net/bluetooth/hci_event.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI event handling. */
  26
  27 #include <linux/module.h>
  28
  29 #include <linux/types.h>
  30 #include <linux/errno.h>
  31 #include <linux/kernel.h>
  32 #include <linux/slab.h>
  33 #include <linux/poll.h>
  34 #include <linux/fcntl.h>
  35 #include <linux/init.h>
  36 #include <linux/skbuff.h>
  37 #include <linux/interrupt.h>
  38 #include <linux/notifier.h>
  39 #include <net/sock.h>
  40
  41 #include <asm/system.h>
  42 #include <linux/uaccess.h>
  43 #include <asm/unaligned.h>
  44
  45 #include <net/bluetooth/bluetooth.h>
  46 #include <net/bluetooth/hci_core.h>
  47
  48 static bool enable_le;
  49
  50 /* Handle HCI Event packets */
  51
  52 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
  53 {
  54         __u8 status = *((__u8 *) skb->data);
  55
  56         BT_DBG("%s status 0x%x", hdev->name, status);
  57
  58         if (status) {
  59                 hci_dev_lock(hdev);
  60                 mgmt_stop_discovery_failed(hdev, status);
  61                 hci_dev_unlock(hdev);
  62                 return;
  63         }
  64
  65         clear_bit(HCI_INQUIRY, &hdev->flags);
  66
  67         hci_dev_lock(hdev);
  68         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
  69         hci_dev_unlock(hdev);
  70
  71         hci_req_complete(hdev, HCI_OP_INQUIRY_CANCEL, status);
  72
  73         hci_conn_check_pending(hdev);
  74 }
  75
  76 static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  77 {
  78         __u8 status = *((__u8 *) skb->data);
  79
  80         BT_DBG("%s status 0x%x", hdev->name, status);
  81
  82         if (status)
  83                 return;
  84
  85         hci_conn_check_pending(hdev);
  86 }
  87
  88 static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev, struct sk_buff *skb)
  89 {
  90         BT_DBG("%s", hdev->name);
  91 }
  92
  93 static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
  94 {
  95         struct hci_rp_role_discovery *rp = (void *) skb->data;
  96         struct hci_conn *conn;
  97
  98         BT_DBG("%s status 0x%x", hdev->name, rp->status);
  99
 100         if (rp->status)
 101                 return;
 102
 103         hci_dev_lock(hdev);
 104
 105         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 106         if (conn) {
 107                 if (rp->role)
 108                         conn->link_mode &= ~HCI_LM_MASTER;
 109                 else
 110                         conn->link_mode |= HCI_LM_MASTER;
 111         }
 112
 113         hci_dev_unlock(hdev);
 114 }
 115
 116 static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 117 {
 118         struct hci_rp_read_link_policy *rp = (void *) skb->data;
 119         struct hci_conn *conn;
 120
 121         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 122
 123         if (rp->status)
 124                 return;
 125
 126         hci_dev_lock(hdev);
 127
 128         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 129         if (conn)
 130                 conn->link_policy = __le16_to_cpu(rp->policy);
 131
 132         hci_dev_unlock(hdev);
 133 }
 134
 135 static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 136 {
 137         struct hci_rp_write_link_policy *rp = (void *) skb->data;
 138         struct hci_conn *conn;
 139         void *sent;
 140
 141         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 142
 143         if (rp->status)
 144                 return;
 145
 146         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
 147         if (!sent)
 148                 return;
 149
 150         hci_dev_lock(hdev);
 151
 152         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 153         if (conn)
 154                 conn->link_policy = get_unaligned_le16(sent + 2);
 155
 156         hci_dev_unlock(hdev);
 157 }
 158
 159 static void hci_cc_read_def_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 160 {
 161         struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
 162
 163         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 164
 165         if (rp->status)
 166                 return;
 167
 168         hdev->link_policy = __le16_to_cpu(rp->policy);
 169 }
 170
 171 static void hci_cc_write_def_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 172 {
 173         __u8 status = *((__u8 *) skb->data);
 174         void *sent;
 175
 176         BT_DBG("%s status 0x%x", hdev->name, status);
 177
 178         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
 179         if (!sent)
 180                 return;
 181
 182         if (!status)
 183                 hdev->link_policy = get_unaligned_le16(sent);
 184
 185         hci_req_complete(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, status);
 186 }
 187
 188 static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
 189 {
 190         __u8 status = *((__u8 *) skb->data);
 191
 192         BT_DBG("%s status 0x%x", hdev->name, status);
 193
 194         clear_bit(HCI_RESET, &hdev->flags);
 195
 196         hci_req_complete(hdev, HCI_OP_RESET, status);
 197
 198         /* Reset all flags, except persistent ones */
 199         hdev->dev_flags &= BIT(HCI_MGMT) | BIT(HCI_SETUP) | BIT(HCI_AUTO_OFF) |
 200                                 BIT(HCI_LINK_KEYS) | BIT(HCI_DEBUG_KEYS);
 201 }
 202
 203 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 204 {
 205         __u8 status = *((__u8 *) skb->data);
 206         void *sent;
 207
 208         BT_DBG("%s status 0x%x", hdev->name, status);
 209
 210         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
 211         if (!sent)
 212                 return;
 213
 214         hci_dev_lock(hdev);
 215
 216         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 217                 mgmt_set_local_name_complete(hdev, sent, status);
 218
 219         if (status == 0)
 220                 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
 221
 222         hci_dev_unlock(hdev);
 223 }
 224
 225 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 226 {
 227         struct hci_rp_read_local_name *rp = (void *) skb->data;
 228
 229         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 230
 231         if (rp->status)
 232                 return;
 233
 234         memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
 235 }
 236
 237 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
 238 {
 239         __u8 status = *((__u8 *) skb->data);
 240         void *sent;
 241
 242         BT_DBG("%s status 0x%x", hdev->name, status);
 243
 244         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
 245         if (!sent)
 246                 return;
 247
 248         if (!status) {
 249                 __u8 param = *((__u8 *) sent);
 250
 251                 if (param == AUTH_ENABLED)
 252                         set_bit(HCI_AUTH, &hdev->flags);
 253                 else
 254                         clear_bit(HCI_AUTH, &hdev->flags);
 255         }
 256
 257         hci_req_complete(hdev, HCI_OP_WRITE_AUTH_ENABLE, status);
 258 }
 259
 260 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
 261 {
 262         __u8 status = *((__u8 *) skb->data);
 263         void *sent;
 264
 265         BT_DBG("%s status 0x%x", hdev->name, status);
 266
 267         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
 268         if (!sent)
 269                 return;
 270
 271         if (!status) {
 272                 __u8 param = *((__u8 *) sent);
 273
 274                 if (param)
 275                         set_bit(HCI_ENCRYPT, &hdev->flags);
 276                 else
 277                         clear_bit(HCI_ENCRYPT, &hdev->flags);
 278         }
 279
 280         hci_req_complete(hdev, HCI_OP_WRITE_ENCRYPT_MODE, status);
 281 }
 282
 283 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
 284 {
 285         __u8 param, status = *((__u8 *) skb->data);
 286         int old_pscan, old_iscan;
 287         void *sent;
 288
 289         BT_DBG("%s status 0x%x", hdev->name, status);
 290
 291         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
 292         if (!sent)
 293                 return;
 294
 295         param = *((__u8 *) sent);
 296
 297         hci_dev_lock(hdev);
 298
 299         if (status != 0) {
 300                 mgmt_write_scan_failed(hdev, param, status);
 301                 hdev->discov_timeout = 0;
 302                 goto done;
 303         }
 304
 305         old_pscan = test_and_clear_bit(HCI_PSCAN, &hdev->flags);
 306         old_iscan = test_and_clear_bit(HCI_ISCAN, &hdev->flags);
 307
 308         if (param & SCAN_INQUIRY) {
 309                 set_bit(HCI_ISCAN, &hdev->flags);
 310                 if (!old_iscan)
 311                         mgmt_discoverable(hdev, 1);
 312                 if (hdev->discov_timeout > 0) {
 313                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
 314                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
 315                                                                         to);
 316                 }
 317         } else if (old_iscan)
 318                 mgmt_discoverable(hdev, 0);
 319
 320         if (param & SCAN_PAGE) {
 321                 set_bit(HCI_PSCAN, &hdev->flags);
 322                 if (!old_pscan)
 323                         mgmt_connectable(hdev, 1);
 324         } else if (old_pscan)
 325                 mgmt_connectable(hdev, 0);
 326
 327 done:
 328         hci_dev_unlock(hdev);
 329         hci_req_complete(hdev, HCI_OP_WRITE_SCAN_ENABLE, status);
 330 }
 331
 332 static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 333 {
 334         struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
 335
 336         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 337
 338         if (rp->status)
 339                 return;
 340
 341         memcpy(hdev->dev_class, rp->dev_class, 3);
 342
 343         BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
 344                 hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
 345 }
 346
 347 static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 348 {
 349         __u8 status = *((__u8 *) skb->data);
 350         void *sent;
 351
 352         BT_DBG("%s status 0x%x", hdev->name, status);
 353
 354         if (status)
 355                 return;
 356
 357         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
 358         if (!sent)
 359                 return;
 360
 361         memcpy(hdev->dev_class, sent, 3);
 362 }
 363
 364 static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 365 {
 366         struct hci_rp_read_voice_setting *rp = (void *) skb->data;
 367         __u16 setting;
 368
 369         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 370
 371         if (rp->status)
 372                 return;
 373
 374         setting = __le16_to_cpu(rp->voice_setting);
 375
 376         if (hdev->voice_setting == setting)
 377                 return;
 378
 379         hdev->voice_setting = setting;
 380
 381         BT_DBG("%s voice setting 0x%04x", hdev->name, setting);
 382
 383         if (hdev->notify)
 384                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 385 }
 386
 387 static void hci_cc_write_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 388 {
 389         __u8 status = *((__u8 *) skb->data);
 390         __u16 setting;
 391         void *sent;
 392
 393         BT_DBG("%s status 0x%x", hdev->name, status);
 394
 395         if (status)
 396                 return;
 397
 398         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
 399         if (!sent)
 400                 return;
 401
 402         setting = get_unaligned_le16(sent);
 403
 404         if (hdev->voice_setting == setting)
 405                 return;
 406
 407         hdev->voice_setting = setting;
 408
 409         BT_DBG("%s voice setting 0x%04x", hdev->name, setting);
 410
 411         if (hdev->notify)
 412                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 413 }
 414
 415 static void hci_cc_host_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 416 {
 417         __u8 status = *((__u8 *) skb->data);
 418
 419         BT_DBG("%s status 0x%x", hdev->name, status);
 420
 421         hci_req_complete(hdev, HCI_OP_HOST_BUFFER_SIZE, status);
 422 }
 423
 424 static void hci_cc_read_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 425 {
 426         struct hci_rp_read_ssp_mode *rp = (void *) skb->data;
 427
 428         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 429
 430         if (rp->status)
 431                 return;
 432
 433         if (rp->mode)
 434                 set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
 435         else
 436                 clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
 437 }
 438
 439 static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 440 {
 441         __u8 status = *((__u8 *) skb->data);
 442         void *sent;
 443
 444         BT_DBG("%s status 0x%x", hdev->name, status);
 445
 446         if (status)
 447                 return;
 448
 449         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
 450         if (!sent)
 451                 return;
 452
 453         if (*((u8 *) sent))
 454                 set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
 455         else
 456                 clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
 457 }
 458
 459 static u8 hci_get_inquiry_mode(struct hci_dev *hdev)
 460 {
 461         if (hdev->features[6] & LMP_EXT_INQ)
 462                 return 2;
 463
 464         if (hdev->features[3] & LMP_RSSI_INQ)
 465                 return 1;
 466
 467         if (hdev->manufacturer == 11 && hdev->hci_rev == 0x00 &&
 468                                                 hdev->lmp_subver == 0x0757)
 469                 return 1;
 470
 471         if (hdev->manufacturer == 15) {
 472                 if (hdev->hci_rev == 0x03 && hdev->lmp_subver == 0x6963)
 473                         return 1;
 474                 if (hdev->hci_rev == 0x09 && hdev->lmp_subver == 0x6963)
 475                         return 1;
 476                 if (hdev->hci_rev == 0x00 && hdev->lmp_subver == 0x6965)
 477                         return 1;
 478         }
 479
 480         if (hdev->manufacturer == 31 && hdev->hci_rev == 0x2005 &&
 481                                                 hdev->lmp_subver == 0x1805)
 482                 return 1;
 483
 484         return 0;
 485 }
 486
 487 static void hci_setup_inquiry_mode(struct hci_dev *hdev)
 488 {
 489         u8 mode;
 490
 491         mode = hci_get_inquiry_mode(hdev);
 492
 493         hci_send_cmd(hdev, HCI_OP_WRITE_INQUIRY_MODE, 1, &mode);
 494 }
 495
 496 static void hci_setup_event_mask(struct hci_dev *hdev)
 497 {
 498         /* The second byte is 0xff instead of 0x9f (two reserved bits
 499          * disabled) since a Broadcom 1.2 dongle doesn't respond to the
 500          * command otherwise */
 501         u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };
 502
 503         /* CSR 1.1 dongles does not accept any bitfield so don't try to set
 504          * any event mask for pre 1.2 devices */
 505         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
 506                 return;
 507
 508         events[4] |= 0x01; /* Flow Specification Complete */
 509         events[4] |= 0x02; /* Inquiry Result with RSSI */
 510         events[4] |= 0x04; /* Read Remote Extended Features Complete */
 511         events[5] |= 0x08; /* Synchronous Connection Complete */
 512         events[5] |= 0x10; /* Synchronous Connection Changed */
 513
 514         if (hdev->features[3] & LMP_RSSI_INQ)
 515                 events[4] |= 0x04; /* Inquiry Result with RSSI */
 516
 517         if (hdev->features[5] & LMP_SNIFF_SUBR)
 518                 events[5] |= 0x20; /* Sniff Subrating */
 519
 520         if (hdev->features[5] & LMP_PAUSE_ENC)
 521                 events[5] |= 0x80; /* Encryption Key Refresh Complete */
 522
 523         if (hdev->features[6] & LMP_EXT_INQ)
 524                 events[5] |= 0x40; /* Extended Inquiry Result */
 525
 526         if (hdev->features[6] & LMP_NO_FLUSH)
 527                 events[7] |= 0x01; /* Enhanced Flush Complete */
 528
 529         if (hdev->features[7] & LMP_LSTO)
 530                 events[6] |= 0x80; /* Link Supervision Timeout Changed */
 531
 532         if (hdev->features[6] & LMP_SIMPLE_PAIR) {
 533                 events[6] |= 0x01;      /* IO Capability Request */
 534                 events[6] |= 0x02;      /* IO Capability Response */
 535                 events[6] |= 0x04;      /* User Confirmation Request */
 536                 events[6] |= 0x08;      /* User Passkey Request */
 537                 events[6] |= 0x10;      /* Remote OOB Data Request */
 538                 events[6] |= 0x20;      /* Simple Pairing Complete */
 539                 events[7] |= 0x04;      /* User Passkey Notification */
 540                 events[7] |= 0x08;      /* Keypress Notification */
 541                 events[7] |= 0x10;      /* Remote Host Supported
 542                                          * Features Notification */
 543         }
 544
 545         if (hdev->features[4] & LMP_LE)
 546                 events[7] |= 0x20;      /* LE Meta-Event */
 547
 548         hci_send_cmd(hdev, HCI_OP_SET_EVENT_MASK, sizeof(events), events);
 549 }
 550
 551 static void hci_set_le_support(struct hci_dev *hdev)
 552 {
 553         struct hci_cp_write_le_host_supported cp;
 554
 555         memset(&cp, 0, sizeof(cp));
 556
 557         if (enable_le) {
 558                 cp.le = 1;
 559                 cp.simul = !!(hdev->features[6] & LMP_SIMUL_LE_BR);
 560         }
 561
 562         hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(cp), &cp);
 563 }
 564
 565 static void hci_setup(struct hci_dev *hdev)
 566 {
 567         if (hdev->dev_type != HCI_BREDR)
 568                 return;
 569
 570         hci_setup_event_mask(hdev);
 571
 572         if (hdev->hci_ver > BLUETOOTH_VER_1_1)
 573                 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
 574
 575         if (hdev->features[6] & LMP_SIMPLE_PAIR) {
 576                 u8 mode = 0x01;
 577                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(mode), &mode);
 578         }
 579
 580         if (hdev->features[3] & LMP_RSSI_INQ)
 581                 hci_setup_inquiry_mode(hdev);
 582
 583         if (hdev->features[7] & LMP_INQ_TX_PWR)
 584                 hci_send_cmd(hdev, HCI_OP_READ_INQ_RSP_TX_POWER, 0, NULL);
 585
 586         if (hdev->features[7] & LMP_EXTFEATURES) {
 587                 struct hci_cp_read_local_ext_features cp;
 588
 589                 cp.page = 0x01;
 590                 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES,
 591                                                         sizeof(cp), &cp);
 592         }
 593
 594         if (hdev->features[4] & LMP_LE)
 595                 hci_set_le_support(hdev);
 596 }
 597
 598 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
 599 {
 600         struct hci_rp_read_local_version *rp = (void *) skb->data;
 601
 602         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 603
 604         if (rp->status)
 605                 return;
 606
 607         hdev->hci_ver = rp->hci_ver;
 608         hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
 609         hdev->lmp_ver = rp->lmp_ver;
 610         hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
 611         hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
 612
 613         BT_DBG("%s manufacturer %d hci ver %d:%d", hdev->name,
 614                                         hdev->manufacturer,
 615                                         hdev->hci_ver, hdev->hci_rev);
 616
 617         if (test_bit(HCI_INIT, &hdev->flags))
 618                 hci_setup(hdev);
 619 }
 620
 621 static void hci_setup_link_policy(struct hci_dev *hdev)
 622 {
 623         u16 link_policy = 0;
 624
 625         if (hdev->features[0] & LMP_RSWITCH)
 626                 link_policy |= HCI_LP_RSWITCH;
 627         if (hdev->features[0] & LMP_HOLD)
 628                 link_policy |= HCI_LP_HOLD;
 629         if (hdev->features[0] & LMP_SNIFF)
 630                 link_policy |= HCI_LP_SNIFF;
 631         if (hdev->features[1] & LMP_PARK)
 632                 link_policy |= HCI_LP_PARK;
 633
 634         link_policy = cpu_to_le16(link_policy);
 635         hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY,
 636                                         sizeof(link_policy), &link_policy);
 637 }
 638
 639 static void hci_cc_read_local_commands(struct hci_dev *hdev, struct sk_buff *skb)
 640 {
 641         struct hci_rp_read_local_commands *rp = (void *) skb->data;
 642
 643         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 644
 645         if (rp->status)
 646                 goto done;
 647
 648         memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 649
 650         if (test_bit(HCI_INIT, &hdev->flags) && (hdev->commands[5] & 0x10))
 651                 hci_setup_link_policy(hdev);
 652
 653 done:
 654         hci_req_complete(hdev, HCI_OP_READ_LOCAL_COMMANDS, rp->status);
 655 }
 656
 657 static void hci_cc_read_local_features(struct hci_dev *hdev, struct sk_buff *skb)
 658 {
 659         struct hci_rp_read_local_features *rp = (void *) skb->data;
 660
 661         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 662
 663         if (rp->status)
 664                 return;
 665
 666         memcpy(hdev->features, rp->features, 8);
 667
 668         /* Adjust default settings according to features
 669          * supported by device. */
 670
 671         if (hdev->features[0] & LMP_3SLOT)
 672                 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 673
 674         if (hdev->features[0] & LMP_5SLOT)
 675                 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 676
 677         if (hdev->features[1] & LMP_HV2) {
 678                 hdev->pkt_type  |= (HCI_HV2);
 679                 hdev->esco_type |= (ESCO_HV2);
 680         }
 681
 682         if (hdev->features[1] & LMP_HV3) {
 683                 hdev->pkt_type  |= (HCI_HV3);
 684                 hdev->esco_type |= (ESCO_HV3);
 685         }
 686
 687         if (hdev->features[3] & LMP_ESCO)
 688                 hdev->esco_type |= (ESCO_EV3);
 689
 690         if (hdev->features[4] & LMP_EV4)
 691                 hdev->esco_type |= (ESCO_EV4);
 692
 693         if (hdev->features[4] & LMP_EV5)
 694                 hdev->esco_type |= (ESCO_EV5);
 695
 696         if (hdev->features[5] & LMP_EDR_ESCO_2M)
 697                 hdev->esco_type |= (ESCO_2EV3);
 698
 699         if (hdev->features[5] & LMP_EDR_ESCO_3M)
 700                 hdev->esco_type |= (ESCO_3EV3);
 701
 702         if (hdev->features[5] & LMP_EDR_3S_ESCO)
 703                 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
 704
 705         BT_DBG("%s features 0x%.2x%.2x%.2x%.2x%.2x%.2x%.2x%.2x", hdev->name,
 706                                         hdev->features[0], hdev->features[1],
 707                                         hdev->features[2], hdev->features[3],
 708                                         hdev->features[4], hdev->features[5],
 709                                         hdev->features[6], hdev->features[7]);
 710 }
 711
 712 static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
 713                                                         struct sk_buff *skb)
 714 {
 715         struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
 716
 717         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 718
 719         if (rp->status)
 720                 return;
 721
 722         switch (rp->page) {
 723         case 0:
 724                 memcpy(hdev->features, rp->features, 8);
 725                 break;
 726         case 1:
 727                 memcpy(hdev->host_features, rp->features, 8);
 728                 break;
 729         }
 730
 731         hci_req_complete(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES, rp->status);
 732 }
 733
 734 static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
 735                                                 struct sk_buff *skb)
 736 {
 737         struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;
 738
 739         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 740
 741         if (rp->status)
 742                 return;
 743
 744         hdev->flow_ctl_mode = rp->mode;
 745
 746         hci_req_complete(hdev, HCI_OP_READ_FLOW_CONTROL_MODE, rp->status);
 747 }
 748
 749 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 750 {
 751         struct hci_rp_read_buffer_size *rp = (void *) skb->data;
 752
 753         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 754
 755         if (rp->status)
 756                 return;
 757
 758         hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
 759         hdev->sco_mtu  = rp->sco_mtu;
 760         hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
 761         hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
 762
 763         if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
 764                 hdev->sco_mtu  = 64;
 765                 hdev->sco_pkts = 8;
 766         }
 767
 768         hdev->acl_cnt = hdev->acl_pkts;
 769         hdev->sco_cnt = hdev->sco_pkts;
 770
 771         BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name,
 772                                         hdev->acl_mtu, hdev->acl_pkts,
 773                                         hdev->sco_mtu, hdev->sco_pkts);
 774 }
 775
 776 static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
 777 {
 778         struct hci_rp_read_bd_addr *rp = (void *) skb->data;
 779
 780         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 781
 782         if (!rp->status)
 783                 bacpy(&hdev->bdaddr, &rp->bdaddr);
 784
 785         hci_req_complete(hdev, HCI_OP_READ_BD_ADDR, rp->status);
 786 }
 787
 788 static void hci_cc_read_data_block_size(struct hci_dev *hdev,
 789                                                         struct sk_buff *skb)
 790 {
 791         struct hci_rp_read_data_block_size *rp = (void *) skb->data;
 792
 793         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 794
 795         if (rp->status)
 796                 return;
 797
 798         hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
 799         hdev->block_len = __le16_to_cpu(rp->block_len);
 800         hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
 801
 802         hdev->block_cnt = hdev->num_blocks;
 803
 804         BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
 805                                         hdev->block_cnt, hdev->block_len);
 806
 807         hci_req_complete(hdev, HCI_OP_READ_DATA_BLOCK_SIZE, rp->status);
 808 }
 809
 810 static void hci_cc_write_ca_timeout(struct hci_dev *hdev, struct sk_buff *skb)
 811 {
 812         __u8 status = *((__u8 *) skb->data);
 813
 814         BT_DBG("%s status 0x%x", hdev->name, status);
 815
 816         hci_req_complete(hdev, HCI_OP_WRITE_CA_TIMEOUT, status);
 817 }
 818
 819 static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
 820                 struct sk_buff *skb)
 821 {
 822         struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
 823
 824         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 825
 826         if (rp->status)
 827                 return;
 828
 829         hdev->amp_status = rp->amp_status;
 830         hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
 831         hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
 832         hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
 833         hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
 834         hdev->amp_type = rp->amp_type;
 835         hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
 836         hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
 837         hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
 838         hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
 839
 840         hci_req_complete(hdev, HCI_OP_READ_LOCAL_AMP_INFO, rp->status);
 841 }
 842
 843 static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
 844                                                         struct sk_buff *skb)
 845 {
 846         __u8 status = *((__u8 *) skb->data);
 847
 848         BT_DBG("%s status 0x%x", hdev->name, status);
 849
 850         hci_req_complete(hdev, HCI_OP_DELETE_STORED_LINK_KEY, status);
 851 }
 852
 853 static void hci_cc_set_event_mask(struct hci_dev *hdev, struct sk_buff *skb)
 854 {
 855         __u8 status = *((__u8 *) skb->data);
 856
 857         BT_DBG("%s status 0x%x", hdev->name, status);
 858
 859         hci_req_complete(hdev, HCI_OP_SET_EVENT_MASK, status);
 860 }
 861
 862 static void hci_cc_write_inquiry_mode(struct hci_dev *hdev,
 863                                                         struct sk_buff *skb)
 864 {
 865         __u8 status = *((__u8 *) skb->data);
 866
 867         BT_DBG("%s status 0x%x", hdev->name, status);
 868
 869         hci_req_complete(hdev, HCI_OP_WRITE_INQUIRY_MODE, status);
 870 }
 871
 872 static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
 873                                                         struct sk_buff *skb)
 874 {
 875         __u8 status = *((__u8 *) skb->data);
 876
 877         BT_DBG("%s status 0x%x", hdev->name, status);
 878
 879         hci_req_complete(hdev, HCI_OP_READ_INQ_RSP_TX_POWER, status);
 880 }
 881
 882 static void hci_cc_set_event_flt(struct hci_dev *hdev, struct sk_buff *skb)
 883 {
 884         __u8 status = *((__u8 *) skb->data);
 885
 886         BT_DBG("%s status 0x%x", hdev->name, status);
 887
 888         hci_req_complete(hdev, HCI_OP_SET_EVENT_FLT, status);
 889 }
 890
 891 static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
 892 {
 893         struct hci_rp_pin_code_reply *rp = (void *) skb->data;
 894         struct hci_cp_pin_code_reply *cp;
 895         struct hci_conn *conn;
 896
 897         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 898
 899         hci_dev_lock(hdev);
 900
 901         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 902                 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
 903
 904         if (rp->status != 0)
 905                 goto unlock;
 906
 907         cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
 908         if (!cp)
 909                 goto unlock;
 910
 911         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 912         if (conn)
 913                 conn->pin_length = cp->pin_len;
 914
 915 unlock:
 916         hci_dev_unlock(hdev);
 917 }
 918
 919 static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
 920 {
 921         struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
 922
 923         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 924
 925         hci_dev_lock(hdev);
 926
 927         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 928                 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
 929                                                                 rp->status);
 930
 931         hci_dev_unlock(hdev);
 932 }
 933
 934 static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
 935                                        struct sk_buff *skb)
 936 {
 937         struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
 938
 939         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 940
 941         if (rp->status)
 942                 return;
 943
 944         hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
 945         hdev->le_pkts = rp->le_max_pkt;
 946
 947         hdev->le_cnt = hdev->le_pkts;
 948
 949         BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
 950
 951         hci_req_complete(hdev, HCI_OP_LE_READ_BUFFER_SIZE, rp->status);
 952 }
 953
 954 static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
 955 {
 956         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 957
 958         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 959
 960         hci_dev_lock(hdev);
 961
 962         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 963                 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr,
 964                                                                 rp->status);
 965
 966         hci_dev_unlock(hdev);
 967 }
 968
 969 static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
 970                                                         struct sk_buff *skb)
 971 {
 972         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 973
 974         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 975
 976         hci_dev_lock(hdev);
 977
 978         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 979                 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
 980                                                                 rp->status);
 981
 982         hci_dev_unlock(hdev);
 983 }
 984
 985 static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
 986 {
 987         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 988
 989         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 990
 991         hci_dev_lock(hdev);
 992
 993         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 994                 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr,
 995                                                                 rp->status);
 996
 997         hci_dev_unlock(hdev);
 998 }
 999
1000 static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
1001                                                         struct sk_buff *skb)
1002 {
1003         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1004
1005         BT_DBG("%s status 0x%x", hdev->name, rp->status);
1006
1007         hci_dev_lock(hdev);
1008
1009         if (test_bit(HCI_MGMT, &hdev->dev_flags))
1010                 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
1011                                                                 rp->status);
1012
1013         hci_dev_unlock(hdev);
1014 }
1015
1016 static void hci_cc_read_local_oob_data_reply(struct hci_dev *hdev,
1017                                                         struct sk_buff *skb)
1018 {
1019         struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
1020
1021         BT_DBG("%s status 0x%x", hdev->name, rp->status);
1022
1023         hci_dev_lock(hdev);
1024         mgmt_read_local_oob_data_reply_complete(hdev, rp->hash,
1025                                                 rp->randomizer, rp->status);
1026         hci_dev_unlock(hdev);
1027 }
1028
1029 static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
1030 {
1031         __u8 status = *((__u8 *) skb->data);
1032
1033         BT_DBG("%s status 0x%x", hdev->name, status);
1034 }
1035
1036 static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
1037                                         struct sk_buff *skb)
1038 {
1039         struct hci_cp_le_set_scan_enable *cp;
1040         __u8 status = *((__u8 *) skb->data);
1041
1042         BT_DBG("%s status 0x%x", hdev->name, status);
1043
1044         if (status)
1045                 return;
1046
1047         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
1048         if (!cp)
1049                 return;
1050
1051         switch (cp->enable) {
1052         case LE_SCANNING_ENABLED:
1053                 set_bit(HCI_LE_SCAN, &hdev->dev_flags);
1054
1055                 cancel_delayed_work_sync(&hdev->adv_work);
1056
1057                 hci_dev_lock(hdev);
1058                 hci_adv_entries_clear(hdev);
1059                 hci_discovery_set_state(hdev, DISCOVERY_LE_SCAN);
1060                 hci_dev_unlock(hdev);
1061                 break;
1062
1063         case LE_SCANNING_DISABLED:
1064                 clear_bit(HCI_LE_SCAN, &hdev->dev_flags);
1065
1066                 hci_dev_lock(hdev);
1067                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1068                 hci_dev_unlock(hdev);
1069
1070                 schedule_delayed_work(&hdev->adv_work, ADV_CLEAR_TIMEOUT);
1071                 break;
1072
1073         default:
1074                 BT_ERR("Used reserved LE_Scan_Enable param %d", cp->enable);
1075                 break;
1076         }
1077 }
1078
1079 static void hci_cc_le_ltk_reply(struct hci_dev *hdev, struct sk_buff *skb)
1080 {
1081         struct hci_rp_le_ltk_reply *rp = (void *) skb->data;
1082
1083         BT_DBG("%s status 0x%x", hdev->name, rp->status);
1084
1085         if (rp->status)
1086                 return;
1087
1088         hci_req_complete(hdev, HCI_OP_LE_LTK_REPLY, rp->status);
1089 }
1090
1091 static void hci_cc_le_ltk_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
1092 {
1093         struct hci_rp_le_ltk_neg_reply *rp = (void *) skb->data;
1094
1095         BT_DBG("%s status 0x%x", hdev->name, rp->status);
1096
1097         if (rp->status)
1098                 return;
1099
1100         hci_req_complete(hdev, HCI_OP_LE_LTK_NEG_REPLY, rp->status);
1101 }
1102
1103 static inline void hci_cc_write_le_host_supported(struct hci_dev *hdev,
1104                                                         struct sk_buff *skb)
1105 {
1106         struct hci_cp_read_local_ext_features cp;
1107         __u8 status = *((__u8 *) skb->data);
1108
1109         BT_DBG("%s status 0x%x", hdev->name, status);
1110
1111         if (status)
1112                 return;
1113
1114         cp.page = 0x01;
1115         hci_send_cmd(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES, sizeof(cp), &cp);
1116 }
1117
1118 static inline void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
1119 {
1120         BT_DBG("%s status 0x%x", hdev->name, status);
1121
1122         if (status) {
1123                 hci_req_complete(hdev, HCI_OP_INQUIRY, status);
1124                 hci_conn_check_pending(hdev);
1125                 hci_dev_lock(hdev);
1126                 if (test_bit(HCI_MGMT, &hdev->dev_flags))
1127                         mgmt_start_discovery_failed(hdev, status);
1128                 hci_dev_unlock(hdev);
1129                 return;
1130         }
1131
1132         set_bit(HCI_INQUIRY, &hdev->flags);
1133
1134         hci_dev_lock(hdev);
1135         hci_discovery_set_state(hdev, DISCOVERY_INQUIRY);
1136         hci_dev_unlock(hdev);
1137 }
1138
1139 static inline void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
1140 {
1141         struct hci_cp_create_conn *cp;
1142         struct hci_conn *conn;
1143
1144         BT_DBG("%s status 0x%x", hdev->name, status);
1145
1146         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
1147         if (!cp)
1148                 return;
1149
1150         hci_dev_lock(hdev);
1151
1152         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1153
1154         BT_DBG("%s bdaddr %s conn %p", hdev->name, batostr(&cp->bdaddr), conn);
1155
1156         if (status) {
1157                 if (conn && conn->state == BT_CONNECT) {
1158                         if (status != 0x0c || conn->attempt > 2) {
1159                                 conn->state = BT_CLOSED;
1160                                 hci_proto_connect_cfm(conn, status);
1161                                 hci_conn_del(conn);
1162                         } else
1163                                 conn->state = BT_CONNECT2;
1164                 }
1165         } else {
1166                 if (!conn) {
1167                         conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr);
1168                         if (conn) {
1169                                 conn->out = true;
1170                                 conn->link_mode |= HCI_LM_MASTER;
1171                         } else
1172                                 BT_ERR("No memory for new connection");
1173                 }
1174         }
1175
1176         hci_dev_unlock(hdev);
1177 }
1178
1179 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
1180 {
1181         struct hci_cp_add_sco *cp;
1182         struct hci_conn *acl, *sco;
1183         __u16 handle;
1184
1185         BT_DBG("%s status 0x%x", hdev->name, status);
1186
1187         if (!status)
1188                 return;
1189
1190         cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
1191         if (!cp)
1192                 return;
1193
1194         handle = __le16_to_cpu(cp->handle);
1195
1196         BT_DBG("%s handle %d", hdev->name, handle);
1197
1198         hci_dev_lock(hdev);
1199
1200         acl = hci_conn_hash_lookup_handle(hdev, handle);
1201         if (acl) {
1202                 sco = acl->link;
1203                 if (sco) {
1204                         sco->state = BT_CLOSED;
1205
1206                         hci_proto_connect_cfm(sco, status);
1207                         hci_conn_del(sco);
1208                 }
1209         }
1210
1211         hci_dev_unlock(hdev);
1212 }
1213
1214 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
1215 {
1216         struct hci_cp_auth_requested *cp;
1217         struct hci_conn *conn;
1218
1219         BT_DBG("%s status 0x%x", hdev->name, status);
1220
1221         if (!status)
1222                 return;
1223
1224         cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
1225         if (!cp)
1226                 return;
1227
1228         hci_dev_lock(hdev);
1229
1230         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1231         if (conn) {
1232                 if (conn->state == BT_CONFIG) {
1233                         hci_proto_connect_cfm(conn, status);
1234                         hci_conn_put(conn);
1235                 }
1236         }
1237
1238         hci_dev_unlock(hdev);
1239 }
1240
1241 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
1242 {
1243         struct hci_cp_set_conn_encrypt *cp;
1244         struct hci_conn *conn;
1245
1246         BT_DBG("%s status 0x%x", hdev->name, status);
1247
1248         if (!status)
1249                 return;
1250
1251         cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
1252         if (!cp)
1253                 return;
1254
1255         hci_dev_lock(hdev);
1256
1257         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1258         if (conn) {
1259                 if (conn->state == BT_CONFIG) {
1260                         hci_proto_connect_cfm(conn, status);
1261                         hci_conn_put(conn);
1262                 }
1263         }
1264
1265         hci_dev_unlock(hdev);
1266 }
1267
1268 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
1269                                                         struct hci_conn *conn)
1270 {
1271         if (conn->state != BT_CONFIG || !conn->out)
1272                 return 0;
1273
1274         if (conn->pending_sec_level == BT_SECURITY_SDP)
1275                 return 0;
1276
1277         /* Only request authentication for SSP connections or non-SSP
1278          * devices with sec_level HIGH or if MITM protection is requested */
1279         if (!hci_conn_ssp_enabled(conn) &&
1280                                 conn->pending_sec_level != BT_SECURITY_HIGH &&
1281                                 !(conn->auth_type & 0x01))
1282                 return 0;
1283
1284         return 1;
1285 }
1286
1287 static inline int hci_resolve_name(struct hci_dev *hdev, struct inquiry_entry *e)
1288 {
1289         struct hci_cp_remote_name_req cp;
1290
1291         memset(&cp, 0, sizeof(cp));
1292
1293         bacpy(&cp.bdaddr, &e->data.bdaddr);
1294         cp.pscan_rep_mode = e->data.pscan_rep_mode;
1295         cp.pscan_mode = e->data.pscan_mode;
1296         cp.clock_offset = e->data.clock_offset;
1297
1298         return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1299 }
1300
1301 static bool hci_resolve_next_name(struct hci_dev *hdev)
1302 {
1303         struct discovery_state *discov = &hdev->discovery;
1304         struct inquiry_entry *e;
1305
1306         if (list_empty(&discov->resolve))
1307                 return false;
1308
1309         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
1310         if (hci_resolve_name(hdev, e) == 0) {
1311                 e->name_state = NAME_PENDING;
1312                 return true;
1313         }
1314
1315         return false;
1316 }
1317
1318 static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
1319                                         bdaddr_t *bdaddr, u8 *name, u8 name_len)
1320 {
1321         struct discovery_state *discov = &hdev->discovery;
1322         struct inquiry_entry *e;
1323
1324         if (conn && !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
1325                 mgmt_device_connected(hdev, bdaddr, ACL_LINK, 0x00,
1326                                         name, name_len, conn->dev_class);
1327
1328         if (discov->state == DISCOVERY_STOPPED)
1329                 return;
1330
1331         if (discov->state == DISCOVERY_STOPPING)
1332                 goto discov_complete;
1333
1334         if (discov->state != DISCOVERY_RESOLVING)
1335                 return;
1336
1337         e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
1338         if (e) {
1339                 e->name_state = NAME_KNOWN;
1340                 list_del(&e->list);
1341                 if (name)
1342                         mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
1343                                         e->data.rssi, name, name_len);
1344         }
1345
1346         if (hci_resolve_next_name(hdev))
1347                 return;
1348
1349 discov_complete:
1350         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1351 }
1352
1353 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
1354 {
1355         struct hci_cp_remote_name_req *cp;
1356         struct hci_conn *conn;
1357
1358         BT_DBG("%s status 0x%x", hdev->name, status);
1359
1360         /* If successful wait for the name req complete event before
1361          * checking for the need to do authentication */
1362         if (!status)
1363                 return;
1364
1365         cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
1366         if (!cp)
1367                 return;
1368
1369         hci_dev_lock(hdev);
1370
1371         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1372
1373         if (test_bit(HCI_MGMT, &hdev->dev_flags))
1374                 hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
1375
1376         if (!conn)
1377                 goto unlock;
1378
1379         if (!hci_outgoing_auth_needed(hdev, conn))
1380                 goto unlock;
1381
1382         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
1383                 struct hci_cp_auth_requested cp;
1384                 cp.handle = __cpu_to_le16(conn->handle);
1385                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
1386         }
1387
1388 unlock:
1389         hci_dev_unlock(hdev);
1390 }
1391
1392 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
1393 {
1394         struct hci_cp_read_remote_features *cp;
1395         struct hci_conn *conn;
1396
1397         BT_DBG("%s status 0x%x", hdev->name, status);
1398
1399         if (!status)
1400                 return;
1401
1402         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
1403         if (!cp)
1404                 return;
1405
1406         hci_dev_lock(hdev);
1407
1408         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1409         if (conn) {
1410                 if (conn->state == BT_CONFIG) {
1411                         hci_proto_connect_cfm(conn, status);
1412                         hci_conn_put(conn);
1413                 }
1414         }
1415
1416         hci_dev_unlock(hdev);
1417 }
1418
1419 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
1420 {
1421         struct hci_cp_read_remote_ext_features *cp;
1422         struct hci_conn *conn;
1423
1424         BT_DBG("%s status 0x%x", hdev->name, status);
1425
1426         if (!status)
1427                 return;
1428
1429         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
1430         if (!cp)
1431                 return;
1432
1433         hci_dev_lock(hdev);
1434
1435         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1436         if (conn) {
1437                 if (conn->state == BT_CONFIG) {
1438                         hci_proto_connect_cfm(conn, status);
1439                         hci_conn_put(conn);
1440                 }
1441         }
1442
1443         hci_dev_unlock(hdev);
1444 }
1445
1446 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
1447 {
1448         struct hci_cp_setup_sync_conn *cp;
1449         struct hci_conn *acl, *sco;
1450         __u16 handle;
1451
1452         BT_DBG("%s status 0x%x", hdev->name, status);
1453
1454         if (!status)
1455                 return;
1456
1457         cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
1458         if (!cp)
1459                 return;
1460
1461         handle = __le16_to_cpu(cp->handle);
1462
1463         BT_DBG("%s handle %d", hdev->name, handle);
1464
1465         hci_dev_lock(hdev);
1466
1467         acl = hci_conn_hash_lookup_handle(hdev, handle);
1468         if (acl) {
1469                 sco = acl->link;
1470                 if (sco) {
1471                         sco->state = BT_CLOSED;
1472
1473                         hci_proto_connect_cfm(sco, status);
1474                         hci_conn_del(sco);
1475                 }
1476         }
1477
1478         hci_dev_unlock(hdev);
1479 }
1480
1481 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
1482 {
1483         struct hci_cp_sniff_mode *cp;
1484         struct hci_conn *conn;
1485
1486         BT_DBG("%s status 0x%x", hdev->name, status);
1487
1488         if (!status)
1489                 return;
1490
1491         cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
1492         if (!cp)
1493                 return;
1494
1495         hci_dev_lock(hdev);
1496
1497         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1498         if (conn) {
1499                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1500
1501                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
1502                         hci_sco_setup(conn, status);
1503         }
1504
1505         hci_dev_unlock(hdev);
1506 }
1507
1508 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
1509 {
1510         struct hci_cp_exit_sniff_mode *cp;
1511         struct hci_conn *conn;
1512
1513         BT_DBG("%s status 0x%x", hdev->name, status);
1514
1515         if (!status)
1516                 return;
1517
1518         cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
1519         if (!cp)
1520                 return;
1521
1522         hci_dev_lock(hdev);
1523
1524         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1525         if (conn) {
1526                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1527
1528                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
1529                         hci_sco_setup(conn, status);
1530         }
1531
1532         hci_dev_unlock(hdev);
1533 }
1534
1535 static void hci_cs_le_create_conn(struct hci_dev *hdev, __u8 status)
1536 {
1537         struct hci_cp_le_create_conn *cp;
1538         struct hci_conn *conn;
1539
1540         BT_DBG("%s status 0x%x", hdev->name, status);
1541
1542         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
1543         if (!cp)
1544                 return;
1545
1546         hci_dev_lock(hdev);
1547
1548         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->peer_addr);
1549
1550         BT_DBG("%s bdaddr %s conn %p", hdev->name, batostr(&cp->peer_addr),
1551                 conn);
1552
1553         if (status) {
1554                 if (conn && conn->state == BT_CONNECT) {
1555                         conn->state = BT_CLOSED;
1556                         hci_proto_connect_cfm(conn, status);
1557                         hci_conn_del(conn);
1558                 }
1559         } else {
1560                 if (!conn) {
1561                         conn = hci_conn_add(hdev, LE_LINK, &cp->peer_addr);
1562                         if (conn) {
1563                                 conn->dst_type = cp->peer_addr_type;
1564                                 conn->out = true;
1565                         } else {
1566                                 BT_ERR("No memory for new connection");
1567                         }
1568                 }
1569         }
1570
1571         hci_dev_unlock(hdev);
1572 }
1573
1574 static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
1575 {
1576         BT_DBG("%s status 0x%x", hdev->name, status);
1577 }
1578
1579 static inline void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1580 {
1581         __u8 status = *((__u8 *) skb->data);
1582         struct discovery_state *discov = &hdev->discovery;
1583         struct inquiry_entry *e;
1584
1585         BT_DBG("%s status %d", hdev->name, status);
1586
1587         hci_req_complete(hdev, HCI_OP_INQUIRY, status);
1588
1589         hci_conn_check_pending(hdev);
1590
1591         if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
1592                 return;
1593
1594         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
1595                 return;
1596
1597         hci_dev_lock(hdev);
1598
1599         if (discov->state != DISCOVERY_INQUIRY)
1600                 goto unlock;
1601
1602         if (list_empty(&discov->resolve)) {
1603                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1604                 goto unlock;
1605         }
1606
1607         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
1608         if (e && hci_resolve_name(hdev, e) == 0) {
1609                 e->name_state = NAME_PENDING;
1610                 hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
1611         } else {
1612                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1613         }
1614
1615 unlock:
1616         hci_dev_unlock(hdev);
1617 }
1618
1619 static inline void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
1620 {
1621         struct inquiry_data data;
1622         struct inquiry_info *info = (void *) (skb->data + 1);
1623         int num_rsp = *((__u8 *) skb->data);
1624
1625         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
1626
1627         if (!num_rsp)
1628                 return;
1629
1630         hci_dev_lock(hdev);
1631
1632         for (; num_rsp; num_rsp--, info++) {
1633                 bool name_known;
1634
1635                 bacpy(&data.bdaddr, &info->bdaddr);
1636                 data.pscan_rep_mode     = info->pscan_rep_mode;
1637                 data.pscan_period_mode  = info->pscan_period_mode;
1638                 data.pscan_mode         = info->pscan_mode;
1639                 memcpy(data.dev_class, info->dev_class, 3);
1640                 data.clock_offset       = info->clock_offset;
1641                 data.rssi               = 0x00;
1642                 data.ssp_mode           = 0x00;
1643
1644                 name_known = hci_inquiry_cache_update(hdev, &data, false);
1645                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
1646                                         info->dev_class, 0, !name_known,
1647                                         NULL, 0);
1648         }
1649
1650         hci_dev_unlock(hdev);
1651 }
1652
1653 static inline void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1654 {
1655         struct hci_ev_conn_complete *ev = (void *) skb->data;
1656         struct hci_conn *conn;
1657
1658         BT_DBG("%s", hdev->name);
1659
1660         hci_dev_lock(hdev);
1661
1662         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
1663         if (!conn) {
1664                 if (ev->link_type != SCO_LINK)
1665                         goto unlock;
1666
1667                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
1668                 if (!conn)
1669                         goto unlock;
1670
1671                 conn->type = SCO_LINK;
1672         }
1673
1674         if (!ev->status) {
1675                 conn->handle = __le16_to_cpu(ev->handle);
1676
1677                 if (conn->type == ACL_LINK) {
1678                         conn->state = BT_CONFIG;
1679                         hci_conn_hold(conn);
1680                         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
1681                 } else
1682                         conn->state = BT_CONNECTED;
1683
1684                 hci_conn_hold_device(conn);
1685                 hci_conn_add_sysfs(conn);
1686
1687                 if (test_bit(HCI_AUTH, &hdev->flags))
1688                         conn->link_mode |= HCI_LM_AUTH;
1689
1690                 if (test_bit(HCI_ENCRYPT, &hdev->flags))
1691                         conn->link_mode |= HCI_LM_ENCRYPT;
1692
1693                 /* Get remote features */
1694                 if (conn->type == ACL_LINK) {
1695                         struct hci_cp_read_remote_features cp;
1696                         cp.handle = ev->handle;
1697                         hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
1698                                                         sizeof(cp), &cp);
1699                 }
1700
1701                 /* Set packet type for incoming connection */
1702                 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
1703                         struct hci_cp_change_conn_ptype cp;
1704                         cp.handle = ev->handle;
1705                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
1706                         hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE,
1707                                                         sizeof(cp), &cp);
1708                 }
1709         } else {
1710                 conn->state = BT_CLOSED;
1711                 if (conn->type == ACL_LINK)
1712                         mgmt_connect_failed(hdev, &ev->bdaddr, conn->type,
1713                                                 conn->dst_type, ev->status);
1714         }
1715
1716         if (conn->type == ACL_LINK)
1717                 hci_sco_setup(conn, ev->status);
1718
1719         if (ev->status) {
1720                 hci_proto_connect_cfm(conn, ev->status);
1721                 hci_conn_del(conn);
1722         } else if (ev->link_type != ACL_LINK)
1723                 hci_proto_connect_cfm(conn, ev->status);
1724
1725 unlock:
1726         hci_dev_unlock(hdev);
1727
1728         hci_conn_check_pending(hdev);
1729 }
1730
1731 static inline void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
1732 {
1733         struct hci_ev_conn_request *ev = (void *) skb->data;
1734         int mask = hdev->link_mode;
1735
1736         BT_DBG("%s bdaddr %s type 0x%x", hdev->name,
1737                                         batostr(&ev->bdaddr), ev->link_type);
1738
1739         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type);
1740
1741         if ((mask & HCI_LM_ACCEPT) &&
1742                         !hci_blacklist_lookup(hdev, &ev->bdaddr)) {
1743                 /* Connection accepted */
1744                 struct inquiry_entry *ie;
1745                 struct hci_conn *conn;
1746
1747                 hci_dev_lock(hdev);
1748
1749                 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
1750                 if (ie)
1751                         memcpy(ie->data.dev_class, ev->dev_class, 3);
1752
1753                 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
1754                 if (!conn) {
1755                         conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr);
1756                         if (!conn) {
1757                                 BT_ERR("No memory for new connection");
1758                                 hci_dev_unlock(hdev);
1759                                 return;
1760                         }
1761                 }
1762
1763                 memcpy(conn->dev_class, ev->dev_class, 3);
1764                 conn->state = BT_CONNECT;
1765
1766                 hci_dev_unlock(hdev);
1767
1768                 if (ev->link_type == ACL_LINK || !lmp_esco_capable(hdev)) {
1769                         struct hci_cp_accept_conn_req cp;
1770
1771                         bacpy(&cp.bdaddr, &ev->bdaddr);
1772
1773                         if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
1774                                 cp.role = 0x00; /* Become master */
1775                         else
1776                                 cp.role = 0x01; /* Remain slave */
1777
1778                         hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ,
1779                                                         sizeof(cp), &cp);
1780                 } else {
1781                         struct hci_cp_accept_sync_conn_req cp;
1782
1783                         bacpy(&cp.bdaddr, &ev->bdaddr);
1784                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
1785
1786                         cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
1787                         cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
1788                         cp.max_latency    = cpu_to_le16(0xffff);
1789                         cp.content_format = cpu_to_le16(hdev->voice_setting);
1790                         cp.retrans_effort = 0xff;
1791
1792                         hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ,
1793                                                         sizeof(cp), &cp);
1794                 }
1795         } else {
1796                 /* Connection rejected */
1797                 struct hci_cp_reject_conn_req cp;
1798
1799                 bacpy(&cp.bdaddr, &ev->bdaddr);
1800                 cp.reason = HCI_ERROR_REJ_BAD_ADDR;
1801                 hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
1802         }
1803 }
1804
1805 static inline void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1806 {
1807         struct hci_ev_disconn_complete *ev = (void *) skb->data;
1808         struct hci_conn *conn;
1809
1810         BT_DBG("%s status %d", hdev->name, ev->status);
1811
1812         hci_dev_lock(hdev);
1813
1814         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1815         if (!conn)
1816                 goto unlock;
1817
1818         if (ev->status == 0)
1819                 conn->state = BT_CLOSED;
1820
1821         if (test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags) &&
1822                         (conn->type == ACL_LINK || conn->type == LE_LINK)) {
1823                 if (ev->status != 0)
1824                         mgmt_disconnect_failed(hdev, &conn->dst, ev->status);
1825                 else
1826                         mgmt_device_disconnected(hdev, &conn->dst, conn->type,
1827                                                         conn->dst_type);
1828         }
1829
1830         if (ev->status == 0) {
1831                 hci_proto_disconn_cfm(conn, ev->reason);
1832                 hci_conn_del(conn);
1833         }
1834
1835 unlock:
1836         hci_dev_unlock(hdev);
1837 }
1838
1839 static inline void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1840 {
1841         struct hci_ev_auth_complete *ev = (void *) skb->data;
1842         struct hci_conn *conn;
1843
1844         BT_DBG("%s status %d", hdev->name, ev->status);
1845
1846         hci_dev_lock(hdev);
1847
1848         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1849         if (!conn)
1850                 goto unlock;
1851
1852         if (!ev->status) {
1853                 if (!hci_conn_ssp_enabled(conn) &&
1854                                 test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
1855                         BT_INFO("re-auth of legacy device is not possible.");
1856                 } else {
1857                         conn->link_mode |= HCI_LM_AUTH;
1858                         conn->sec_level = conn->pending_sec_level;
1859                 }
1860         } else {
1861                 mgmt_auth_failed(hdev, &conn->dst, ev->status);
1862         }
1863
1864         clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
1865         clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
1866
1867         if (conn->state == BT_CONFIG) {
1868                 if (!ev->status && hci_conn_ssp_enabled(conn)) {
1869                         struct hci_cp_set_conn_encrypt cp;
1870                         cp.handle  = ev->handle;
1871                         cp.encrypt = 0x01;
1872                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
1873                                                                         &cp);
1874                 } else {
1875                         conn->state = BT_CONNECTED;
1876                         hci_proto_connect_cfm(conn, ev->status);
1877                         hci_conn_put(conn);
1878                 }
1879         } else {
1880                 hci_auth_cfm(conn, ev->status);
1881
1882                 hci_conn_hold(conn);
1883                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
1884                 hci_conn_put(conn);
1885         }
1886
1887         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
1888                 if (!ev->status) {
1889                         struct hci_cp_set_conn_encrypt cp;
1890                         cp.handle  = ev->handle;
1891                         cp.encrypt = 0x01;
1892                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
1893                                                                         &cp);
1894                 } else {
1895                         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
1896                         hci_encrypt_cfm(conn, ev->status, 0x00);
1897                 }
1898         }
1899
1900 unlock:
1901         hci_dev_unlock(hdev);
1902 }
1903
1904 static inline void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
1905 {
1906         struct hci_ev_remote_name *ev = (void *) skb->data;
1907         struct hci_conn *conn;
1908
1909         BT_DBG("%s", hdev->name);
1910
1911         hci_conn_check_pending(hdev);
1912
1913         hci_dev_lock(hdev);
1914
1915         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
1916
1917         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
1918                 goto check_auth;
1919
1920         if (ev->status == 0)
1921                 hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
1922                                         strnlen(ev->name, HCI_MAX_NAME_LENGTH));
1923         else
1924                 hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
1925
1926 check_auth:
1927         if (!conn)
1928                 goto unlock;
1929
1930         if (!hci_outgoing_auth_needed(hdev, conn))
1931                 goto unlock;
1932
1933         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
1934                 struct hci_cp_auth_requested cp;
1935                 cp.handle = __cpu_to_le16(conn->handle);
1936                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
1937         }
1938
1939 unlock:
1940         hci_dev_unlock(hdev);
1941 }
1942
1943 static inline void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
1944 {
1945         struct hci_ev_encrypt_change *ev = (void *) skb->data;
1946         struct hci_conn *conn;
1947
1948         BT_DBG("%s status %d", hdev->name, ev->status);
1949
1950         hci_dev_lock(hdev);
1951
1952         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1953         if (conn) {
1954                 if (!ev->status) {
1955                         if (ev->encrypt) {
1956                                 /* Encryption implies authentication */
1957                                 conn->link_mode |= HCI_LM_AUTH;
1958                                 conn->link_mode |= HCI_LM_ENCRYPT;
1959                                 conn->sec_level = conn->pending_sec_level;
1960                         } else
1961                                 conn->link_mode &= ~HCI_LM_ENCRYPT;
1962                 }
1963
1964                 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
1965
1966                 if (conn->state == BT_CONFIG) {
1967                         if (!ev->status)
1968                                 conn->state = BT_CONNECTED;
1969
1970                         hci_proto_connect_cfm(conn, ev->status);
1971                         hci_conn_put(conn);
1972                 } else
1973                         hci_encrypt_cfm(conn, ev->status, ev->encrypt);
1974         }
1975
1976         hci_dev_unlock(hdev);
1977 }
1978
1979 static inline void hci_change_link_key_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1980 {
1981         struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
1982         struct hci_conn *conn;
1983
1984         BT_DBG("%s status %d", hdev->name, ev->status);
1985
1986         hci_dev_lock(hdev);
1987
1988         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1989         if (conn) {
1990                 if (!ev->status)
1991                         conn->link_mode |= HCI_LM_SECURE;
1992
1993                 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
1994
1995                 hci_key_change_cfm(conn, ev->status);
1996         }
1997
1998         hci_dev_unlock(hdev);
1999 }
2000
2001 static inline void hci_remote_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
2002 {
2003         struct hci_ev_remote_features *ev = (void *) skb->data;
2004         struct hci_conn *conn;
2005
2006         BT_DBG("%s status %d", hdev->name, ev->status);
2007
2008         hci_dev_lock(hdev);
2009
2010         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2011         if (!conn)
2012                 goto unlock;
2013
2014         if (!ev->status)
2015                 memcpy(conn->features, ev->features, 8);
2016
2017         if (conn->state != BT_CONFIG)
2018                 goto unlock;
2019
2020         if (!ev->status && lmp_ssp_capable(hdev) && lmp_ssp_capable(conn)) {
2021                 struct hci_cp_read_remote_ext_features cp;
2022                 cp.handle = ev->handle;
2023                 cp.page = 0x01;
2024                 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
2025                                                         sizeof(cp), &cp);
2026                 goto unlock;
2027         }
2028
2029         if (!ev->status) {
2030                 struct hci_cp_remote_name_req cp;
2031                 memset(&cp, 0, sizeof(cp));
2032                 bacpy(&cp.bdaddr, &conn->dst);
2033                 cp.pscan_rep_mode = 0x02;
2034                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2035         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2036                 mgmt_device_connected(hdev, &conn->dst, conn->type,
2037                                                 conn->dst_type, NULL, 0,
2038                                                 conn->dev_class);
2039
2040         if (!hci_outgoing_auth_needed(hdev, conn)) {
2041                 conn->state = BT_CONNECTED;
2042                 hci_proto_connect_cfm(conn, ev->status);
2043                 hci_conn_put(conn);
2044         }
2045
2046 unlock:
2047         hci_dev_unlock(hdev);
2048 }
2049
2050 static inline void hci_remote_version_evt(struct hci_dev *hdev, struct sk_buff *skb)
2051 {
2052         BT_DBG("%s", hdev->name);
2053 }
2054
2055 static inline void hci_qos_setup_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2056 {
2057         BT_DBG("%s", hdev->name);
2058 }
2059
2060 static inline void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2061 {
2062         struct hci_ev_cmd_complete *ev = (void *) skb->data;
2063         __u16 opcode;
2064
2065         skb_pull(skb, sizeof(*ev));
2066
2067         opcode = __le16_to_cpu(ev->opcode);
2068
2069         switch (opcode) {
2070         case HCI_OP_INQUIRY_CANCEL:
2071                 hci_cc_inquiry_cancel(hdev, skb);
2072                 break;
2073
2074         case HCI_OP_EXIT_PERIODIC_INQ:
2075                 hci_cc_exit_periodic_inq(hdev, skb);
2076                 break;
2077
2078         case HCI_OP_REMOTE_NAME_REQ_CANCEL:
2079                 hci_cc_remote_name_req_cancel(hdev, skb);
2080                 break;
2081
2082         case HCI_OP_ROLE_DISCOVERY:
2083                 hci_cc_role_discovery(hdev, skb);
2084                 break;
2085
2086         case HCI_OP_READ_LINK_POLICY:
2087                 hci_cc_read_link_policy(hdev, skb);
2088                 break;
2089
2090         case HCI_OP_WRITE_LINK_POLICY:
2091                 hci_cc_write_link_policy(hdev, skb);
2092                 break;
2093
2094         case HCI_OP_READ_DEF_LINK_POLICY:
2095                 hci_cc_read_def_link_policy(hdev, skb);
2096                 break;
2097
2098         case HCI_OP_WRITE_DEF_LINK_POLICY:
2099                 hci_cc_write_def_link_policy(hdev, skb);
2100                 break;
2101
2102         case HCI_OP_RESET:
2103                 hci_cc_reset(hdev, skb);
2104                 break;
2105
2106         case HCI_OP_WRITE_LOCAL_NAME:
2107                 hci_cc_write_local_name(hdev, skb);
2108                 break;
2109
2110         case HCI_OP_READ_LOCAL_NAME:
2111                 hci_cc_read_local_name(hdev, skb);
2112                 break;
2113
2114         case HCI_OP_WRITE_AUTH_ENABLE:
2115                 hci_cc_write_auth_enable(hdev, skb);
2116                 break;
2117
2118         case HCI_OP_WRITE_ENCRYPT_MODE:
2119                 hci_cc_write_encrypt_mode(hdev, skb);
2120                 break;
2121
2122         case HCI_OP_WRITE_SCAN_ENABLE:
2123                 hci_cc_write_scan_enable(hdev, skb);
2124                 break;
2125
2126         case HCI_OP_READ_CLASS_OF_DEV:
2127                 hci_cc_read_class_of_dev(hdev, skb);
2128                 break;
2129
2130         case HCI_OP_WRITE_CLASS_OF_DEV:
2131                 hci_cc_write_class_of_dev(hdev, skb);
2132                 break;
2133
2134         case HCI_OP_READ_VOICE_SETTING:
2135                 hci_cc_read_voice_setting(hdev, skb);
2136                 break;
2137
2138         case HCI_OP_WRITE_VOICE_SETTING:
2139                 hci_cc_write_voice_setting(hdev, skb);
2140                 break;
2141
2142         case HCI_OP_HOST_BUFFER_SIZE:
2143                 hci_cc_host_buffer_size(hdev, skb);
2144                 break;
2145
2146         case HCI_OP_READ_SSP_MODE:
2147                 hci_cc_read_ssp_mode(hdev, skb);
2148                 break;
2149
2150         case HCI_OP_WRITE_SSP_MODE:
2151                 hci_cc_write_ssp_mode(hdev, skb);
2152                 break;
2153
2154         case HCI_OP_READ_LOCAL_VERSION:
2155                 hci_cc_read_local_version(hdev, skb);
2156                 break;
2157
2158         case HCI_OP_READ_LOCAL_COMMANDS:
2159                 hci_cc_read_local_commands(hdev, skb);
2160                 break;
2161
2162         case HCI_OP_READ_LOCAL_FEATURES:
2163                 hci_cc_read_local_features(hdev, skb);
2164                 break;
2165
2166         case HCI_OP_READ_LOCAL_EXT_FEATURES:
2167                 hci_cc_read_local_ext_features(hdev, skb);
2168                 break;
2169
2170         case HCI_OP_READ_BUFFER_SIZE:
2171                 hci_cc_read_buffer_size(hdev, skb);
2172                 break;
2173
2174         case HCI_OP_READ_BD_ADDR:
2175                 hci_cc_read_bd_addr(hdev, skb);
2176                 break;
2177
2178         case HCI_OP_READ_DATA_BLOCK_SIZE:
2179                 hci_cc_read_data_block_size(hdev, skb);
2180                 break;
2181
2182         case HCI_OP_WRITE_CA_TIMEOUT:
2183                 hci_cc_write_ca_timeout(hdev, skb);
2184                 break;
2185
2186         case HCI_OP_READ_FLOW_CONTROL_MODE:
2187                 hci_cc_read_flow_control_mode(hdev, skb);
2188                 break;
2189
2190         case HCI_OP_READ_LOCAL_AMP_INFO:
2191                 hci_cc_read_local_amp_info(hdev, skb);
2192                 break;
2193
2194         case HCI_OP_DELETE_STORED_LINK_KEY:
2195                 hci_cc_delete_stored_link_key(hdev, skb);
2196                 break;
2197
2198         case HCI_OP_SET_EVENT_MASK:
2199                 hci_cc_set_event_mask(hdev, skb);
2200                 break;
2201
2202         case HCI_OP_WRITE_INQUIRY_MODE:
2203                 hci_cc_write_inquiry_mode(hdev, skb);
2204                 break;
2205
2206         case HCI_OP_READ_INQ_RSP_TX_POWER:
2207                 hci_cc_read_inq_rsp_tx_power(hdev, skb);
2208                 break;
2209
2210         case HCI_OP_SET_EVENT_FLT:
2211                 hci_cc_set_event_flt(hdev, skb);
2212                 break;
2213
2214         case HCI_OP_PIN_CODE_REPLY:
2215                 hci_cc_pin_code_reply(hdev, skb);
2216                 break;
2217
2218         case HCI_OP_PIN_CODE_NEG_REPLY:
2219                 hci_cc_pin_code_neg_reply(hdev, skb);
2220                 break;
2221
2222         case HCI_OP_READ_LOCAL_OOB_DATA:
2223                 hci_cc_read_local_oob_data_reply(hdev, skb);
2224                 break;
2225
2226         case HCI_OP_LE_READ_BUFFER_SIZE:
2227                 hci_cc_le_read_buffer_size(hdev, skb);
2228                 break;
2229
2230         case HCI_OP_USER_CONFIRM_REPLY:
2231                 hci_cc_user_confirm_reply(hdev, skb);
2232                 break;
2233
2234         case HCI_OP_USER_CONFIRM_NEG_REPLY:
2235                 hci_cc_user_confirm_neg_reply(hdev, skb);
2236                 break;
2237
2238         case HCI_OP_USER_PASSKEY_REPLY:
2239                 hci_cc_user_passkey_reply(hdev, skb);
2240                 break;
2241
2242         case HCI_OP_USER_PASSKEY_NEG_REPLY:
2243                 hci_cc_user_passkey_neg_reply(hdev, skb);
2244
2245         case HCI_OP_LE_SET_SCAN_PARAM:
2246                 hci_cc_le_set_scan_param(hdev, skb);
2247                 break;
2248
2249         case HCI_OP_LE_SET_SCAN_ENABLE:
2250                 hci_cc_le_set_scan_enable(hdev, skb);
2251                 break;
2252
2253         case HCI_OP_LE_LTK_REPLY:
2254                 hci_cc_le_ltk_reply(hdev, skb);
2255                 break;
2256
2257         case HCI_OP_LE_LTK_NEG_REPLY:
2258                 hci_cc_le_ltk_neg_reply(hdev, skb);
2259                 break;
2260
2261         case HCI_OP_WRITE_LE_HOST_SUPPORTED:
2262                 hci_cc_write_le_host_supported(hdev, skb);
2263                 break;
2264
2265         default:
2266                 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
2267                 break;
2268         }
2269
2270         if (ev->opcode != HCI_OP_NOP)
2271                 del_timer(&hdev->cmd_timer);
2272
2273         if (ev->ncmd) {
2274                 atomic_set(&hdev->cmd_cnt, 1);
2275                 if (!skb_queue_empty(&hdev->cmd_q))
2276                         queue_work(hdev->workqueue, &hdev->cmd_work);
2277         }
2278 }
2279
2280 static inline void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb)
2281 {
2282         struct hci_ev_cmd_status *ev = (void *) skb->data;
2283         __u16 opcode;
2284
2285         skb_pull(skb, sizeof(*ev));
2286
2287         opcode = __le16_to_cpu(ev->opcode);
2288
2289         switch (opcode) {
2290         case HCI_OP_INQUIRY:
2291                 hci_cs_inquiry(hdev, ev->status);
2292                 break;
2293
2294         case HCI_OP_CREATE_CONN:
2295                 hci_cs_create_conn(hdev, ev->status);
2296                 break;
2297
2298         case HCI_OP_ADD_SCO:
2299                 hci_cs_add_sco(hdev, ev->status);
2300                 break;
2301
2302         case HCI_OP_AUTH_REQUESTED:
2303                 hci_cs_auth_requested(hdev, ev->status);
2304                 break;
2305
2306         case HCI_OP_SET_CONN_ENCRYPT:
2307                 hci_cs_set_conn_encrypt(hdev, ev->status);
2308                 break;
2309
2310         case HCI_OP_REMOTE_NAME_REQ:
2311                 hci_cs_remote_name_req(hdev, ev->status);
2312                 break;
2313
2314         case HCI_OP_READ_REMOTE_FEATURES:
2315                 hci_cs_read_remote_features(hdev, ev->status);
2316                 break;
2317
2318         case HCI_OP_READ_REMOTE_EXT_FEATURES:
2319                 hci_cs_read_remote_ext_features(hdev, ev->status);
2320                 break;
2321
2322         case HCI_OP_SETUP_SYNC_CONN:
2323                 hci_cs_setup_sync_conn(hdev, ev->status);
2324                 break;
2325
2326         case HCI_OP_SNIFF_MODE:
2327                 hci_cs_sniff_mode(hdev, ev->status);
2328                 break;
2329
2330         case HCI_OP_EXIT_SNIFF_MODE:
2331                 hci_cs_exit_sniff_mode(hdev, ev->status);
2332                 break;
2333
2334         case HCI_OP_DISCONNECT:
2335                 if (ev->status != 0)
2336                         mgmt_disconnect_failed(hdev, NULL, ev->status);
2337                 break;
2338
2339         case HCI_OP_LE_CREATE_CONN:
2340                 hci_cs_le_create_conn(hdev, ev->status);
2341                 break;
2342
2343         case HCI_OP_LE_START_ENC:
2344                 hci_cs_le_start_enc(hdev, ev->status);
2345                 break;
2346
2347         default:
2348                 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
2349                 break;
2350         }
2351
2352         if (ev->opcode != HCI_OP_NOP)
2353                 del_timer(&hdev->cmd_timer);
2354
2355         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
2356                 atomic_set(&hdev->cmd_cnt, 1);
2357                 if (!skb_queue_empty(&hdev->cmd_q))
2358                         queue_work(hdev->workqueue, &hdev->cmd_work);
2359         }
2360 }
2361
2362 static inline void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2363 {
2364         struct hci_ev_role_change *ev = (void *) skb->data;
2365         struct hci_conn *conn;
2366
2367         BT_DBG("%s status %d", hdev->name, ev->status);
2368
2369         hci_dev_lock(hdev);
2370
2371         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2372         if (conn) {
2373                 if (!ev->status) {
2374                         if (ev->role)
2375                                 conn->link_mode &= ~HCI_LM_MASTER;
2376                         else
2377                                 conn->link_mode |= HCI_LM_MASTER;
2378                 }
2379
2380                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
2381
2382                 hci_role_switch_cfm(conn, ev->status, ev->role);
2383         }
2384
2385         hci_dev_unlock(hdev);
2386 }
2387
2388 static inline void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
2389 {
2390         struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
2391         int i;
2392
2393         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
2394                 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
2395                 return;
2396         }
2397
2398         if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
2399                         ev->num_hndl * sizeof(struct hci_comp_pkts_info)) {
2400                 BT_DBG("%s bad parameters", hdev->name);
2401                 return;
2402         }
2403
2404         BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
2405
2406         for (i = 0; i < ev->num_hndl; i++) {
2407                 struct hci_comp_pkts_info *info = &ev->handles[i];
2408                 struct hci_conn *conn;
2409                 __u16  handle, count;
2410
2411                 handle = __le16_to_cpu(info->handle);
2412                 count  = __le16_to_cpu(info->count);
2413
2414                 conn = hci_conn_hash_lookup_handle(hdev, handle);
2415                 if (!conn)
2416                         continue;
2417
2418                 conn->sent -= count;
2419
2420                 switch (conn->type) {
2421                 case ACL_LINK:
2422                         hdev->acl_cnt += count;
2423                         if (hdev->acl_cnt > hdev->acl_pkts)
2424                                 hdev->acl_cnt = hdev->acl_pkts;
2425                         break;
2426
2427                 case LE_LINK:
2428                         if (hdev->le_pkts) {
2429                                 hdev->le_cnt += count;
2430                                 if (hdev->le_cnt > hdev->le_pkts)
2431                                         hdev->le_cnt = hdev->le_pkts;
2432                         } else {
2433                                 hdev->acl_cnt += count;
2434                                 if (hdev->acl_cnt > hdev->acl_pkts)
2435                                         hdev->acl_cnt = hdev->acl_pkts;
2436                         }
2437                         break;
2438
2439                 case SCO_LINK:
2440                         hdev->sco_cnt += count;
2441                         if (hdev->sco_cnt > hdev->sco_pkts)
2442                                 hdev->sco_cnt = hdev->sco_pkts;
2443                         break;
2444
2445                 default:
2446                         BT_ERR("Unknown type %d conn %p", conn->type, conn);
2447                         break;
2448                 }
2449         }
2450
2451         queue_work(hdev->workqueue, &hdev->tx_work);
2452 }
2453
2454 static inline void hci_num_comp_blocks_evt(struct hci_dev *hdev,
2455                                                         struct sk_buff *skb)
2456 {
2457         struct hci_ev_num_comp_blocks *ev = (void *) skb->data;
2458         int i;
2459
2460         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
2461                 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
2462                 return;
2463         }
2464
2465         if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
2466                         ev->num_hndl * sizeof(struct hci_comp_blocks_info)) {
2467                 BT_DBG("%s bad parameters", hdev->name);
2468                 return;
2469         }
2470
2471         BT_DBG("%s num_blocks %d num_hndl %d", hdev->name, ev->num_blocks,
2472                                                                 ev->num_hndl);
2473
2474         for (i = 0; i < ev->num_hndl; i++) {
2475                 struct hci_comp_blocks_info *info = &ev->handles[i];
2476                 struct hci_conn *conn;
2477                 __u16  handle, block_count;
2478
2479                 handle = __le16_to_cpu(info->handle);
2480                 block_count = __le16_to_cpu(info->blocks);
2481
2482                 conn = hci_conn_hash_lookup_handle(hdev, handle);
2483                 if (!conn)
2484                         continue;
2485
2486                 conn->sent -= block_count;
2487
2488                 switch (conn->type) {
2489                 case ACL_LINK:
2490                         hdev->block_cnt += block_count;
2491                         if (hdev->block_cnt > hdev->num_blocks)
2492                                 hdev->block_cnt = hdev->num_blocks;
2493                         break;
2494
2495                 default:
2496                         BT_ERR("Unknown type %d conn %p", conn->type, conn);
2497                         break;
2498                 }
2499         }
2500
2501         queue_work(hdev->workqueue, &hdev->tx_work);
2502 }
2503
2504 static inline void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2505 {
2506         struct hci_ev_mode_change *ev = (void *) skb->data;
2507         struct hci_conn *conn;
2508
2509         BT_DBG("%s status %d", hdev->name, ev->status);
2510
2511         hci_dev_lock(hdev);
2512
2513         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2514         if (conn) {
2515                 conn->mode = ev->mode;
2516                 conn->interval = __le16_to_cpu(ev->interval);
2517
2518                 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
2519                         if (conn->mode == HCI_CM_ACTIVE)
2520                                 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
2521                         else
2522                                 clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
2523                 }
2524
2525                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2526                         hci_sco_setup(conn, ev->status);
2527         }
2528
2529         hci_dev_unlock(hdev);
2530 }
2531
2532 static inline void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2533 {
2534         struct hci_ev_pin_code_req *ev = (void *) skb->data;
2535         struct hci_conn *conn;
2536
2537         BT_DBG("%s", hdev->name);
2538
2539         hci_dev_lock(hdev);
2540
2541         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2542         if (!conn)
2543                 goto unlock;
2544
2545         if (conn->state == BT_CONNECTED) {
2546                 hci_conn_hold(conn);
2547                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2548                 hci_conn_put(conn);
2549         }
2550
2551         if (!test_bit(HCI_PAIRABLE, &hdev->dev_flags))
2552                 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2553                                         sizeof(ev->bdaddr), &ev->bdaddr);
2554         else if (test_bit(HCI_MGMT, &hdev->dev_flags)) {
2555                 u8 secure;
2556
2557                 if (conn->pending_sec_level == BT_SECURITY_HIGH)
2558                         secure = 1;
2559                 else
2560                         secure = 0;
2561
2562                 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
2563         }
2564
2565 unlock:
2566         hci_dev_unlock(hdev);
2567 }
2568
2569 static inline void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2570 {
2571         struct hci_ev_link_key_req *ev = (void *) skb->data;
2572         struct hci_cp_link_key_reply cp;
2573         struct hci_conn *conn;
2574         struct link_key *key;
2575
2576         BT_DBG("%s", hdev->name);
2577
2578         if (!test_bit(HCI_LINK_KEYS, &hdev->dev_flags))
2579                 return;
2580
2581         hci_dev_lock(hdev);
2582
2583         key = hci_find_link_key(hdev, &ev->bdaddr);
2584         if (!key) {
2585                 BT_DBG("%s link key not found for %s", hdev->name,
2586                                                         batostr(&ev->bdaddr));
2587                 goto not_found;
2588         }
2589
2590         BT_DBG("%s found key type %u for %s", hdev->name, key->type,
2591                                                         batostr(&ev->bdaddr));
2592
2593         if (!test_bit(HCI_DEBUG_KEYS, &hdev->dev_flags) &&
2594                                 key->type == HCI_LK_DEBUG_COMBINATION) {
2595                 BT_DBG("%s ignoring debug key", hdev->name);
2596                 goto not_found;
2597         }
2598
2599         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2600         if (conn) {
2601                 if (key->type == HCI_LK_UNAUTH_COMBINATION &&
2602                                 conn->auth_type != 0xff &&
2603                                 (conn->auth_type & 0x01)) {
2604                         BT_DBG("%s ignoring unauthenticated key", hdev->name);
2605                         goto not_found;
2606                 }
2607
2608                 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
2609                                 conn->pending_sec_level == BT_SECURITY_HIGH) {
2610                         BT_DBG("%s ignoring key unauthenticated for high \
2611                                                         security", hdev->name);
2612                         goto not_found;
2613                 }
2614
2615                 conn->key_type = key->type;
2616                 conn->pin_length = key->pin_len;
2617         }
2618
2619         bacpy(&cp.bdaddr, &ev->bdaddr);
2620         memcpy(cp.link_key, key->val, 16);
2621
2622         hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
2623
2624         hci_dev_unlock(hdev);
2625
2626         return;
2627
2628 not_found:
2629         hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
2630         hci_dev_unlock(hdev);
2631 }
2632
2633 static inline void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
2634 {
2635         struct hci_ev_link_key_notify *ev = (void *) skb->data;
2636         struct hci_conn *conn;
2637         u8 pin_len = 0;
2638
2639         BT_DBG("%s", hdev->name);
2640
2641         hci_dev_lock(hdev);
2642
2643         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2644         if (conn) {
2645                 hci_conn_hold(conn);
2646                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2647                 pin_len = conn->pin_length;
2648
2649                 if (ev->key_type != HCI_LK_CHANGED_COMBINATION)
2650                         conn->key_type = ev->key_type;
2651
2652                 hci_conn_put(conn);
2653         }
2654
2655         if (test_bit(HCI_LINK_KEYS, &hdev->dev_flags))
2656                 hci_add_link_key(hdev, conn, 1, &ev->bdaddr, ev->link_key,
2657                                                         ev->key_type, pin_len);
2658
2659         hci_dev_unlock(hdev);
2660 }
2661
2662 static inline void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
2663 {
2664         struct hci_ev_clock_offset *ev = (void *) skb->data;
2665         struct hci_conn *conn;
2666
2667         BT_DBG("%s status %d", hdev->name, ev->status);
2668
2669         hci_dev_lock(hdev);
2670
2671         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2672         if (conn && !ev->status) {
2673                 struct inquiry_entry *ie;
2674
2675                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
2676                 if (ie) {
2677                         ie->data.clock_offset = ev->clock_offset;
2678                         ie->timestamp = jiffies;
2679                 }
2680         }
2681
2682         hci_dev_unlock(hdev);
2683 }
2684
2685 static inline void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2686 {
2687         struct hci_ev_pkt_type_change *ev = (void *) skb->data;
2688         struct hci_conn *conn;
2689
2690         BT_DBG("%s status %d", hdev->name, ev->status);
2691
2692         hci_dev_lock(hdev);
2693
2694         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2695         if (conn && !ev->status)
2696                 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
2697
2698         hci_dev_unlock(hdev);
2699 }
2700
2701 static inline void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
2702 {
2703         struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
2704         struct inquiry_entry *ie;
2705
2706         BT_DBG("%s", hdev->name);
2707
2708         hci_dev_lock(hdev);
2709
2710         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2711         if (ie) {
2712                 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
2713                 ie->timestamp = jiffies;
2714         }
2715
2716         hci_dev_unlock(hdev);
2717 }
2718
2719 static inline void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, struct sk_buff *skb)
2720 {
2721         struct inquiry_data data;
2722         int num_rsp = *((__u8 *) skb->data);
2723         bool name_known;
2724
2725         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2726
2727         if (!num_rsp)
2728                 return;
2729
2730         hci_dev_lock(hdev);
2731
2732         if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
2733                 struct inquiry_info_with_rssi_and_pscan_mode *info;
2734                 info = (void *) (skb->data + 1);
2735
2736                 for (; num_rsp; num_rsp--, info++) {
2737                         bacpy(&data.bdaddr, &info->bdaddr);
2738                         data.pscan_rep_mode     = info->pscan_rep_mode;
2739                         data.pscan_period_mode  = info->pscan_period_mode;
2740                         data.pscan_mode         = info->pscan_mode;
2741                         memcpy(data.dev_class, info->dev_class, 3);
2742                         data.clock_offset       = info->clock_offset;
2743                         data.rssi               = info->rssi;
2744                         data.ssp_mode           = 0x00;
2745
2746                         name_known = hci_inquiry_cache_update(hdev, &data,
2747                                                                 false);
2748                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2749                                                 info->dev_class, info->rssi,
2750                                                 !name_known, NULL, 0);
2751                 }
2752         } else {
2753                 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
2754
2755                 for (; num_rsp; num_rsp--, info++) {
2756                         bacpy(&data.bdaddr, &info->bdaddr);
2757                         data.pscan_rep_mode     = info->pscan_rep_mode;
2758                         data.pscan_period_mode  = info->pscan_period_mode;
2759                         data.pscan_mode         = 0x00;
2760                         memcpy(data.dev_class, info->dev_class, 3);
2761                         data.clock_offset       = info->clock_offset;
2762                         data.rssi               = info->rssi;
2763                         data.ssp_mode           = 0x00;
2764                         name_known = hci_inquiry_cache_update(hdev, &data,
2765                                                                 false);
2766                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2767                                                 info->dev_class, info->rssi,
2768                                                 !name_known, NULL, 0);
2769                 }
2770         }
2771
2772         hci_dev_unlock(hdev);
2773 }
2774
2775 static inline void hci_remote_ext_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
2776 {
2777         struct hci_ev_remote_ext_features *ev = (void *) skb->data;
2778         struct hci_conn *conn;
2779
2780         BT_DBG("%s", hdev->name);
2781
2782         hci_dev_lock(hdev);
2783
2784         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2785         if (!conn)
2786                 goto unlock;
2787
2788         if (!ev->status && ev->page == 0x01) {
2789                 struct inquiry_entry *ie;
2790
2791                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
2792                 if (ie)
2793                         ie->data.ssp_mode = (ev->features[0] & 0x01);
2794
2795                 if (ev->features[0] & 0x01)
2796                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
2797         }
2798
2799         if (conn->state != BT_CONFIG)
2800                 goto unlock;
2801
2802         if (!ev->status) {
2803                 struct hci_cp_remote_name_req cp;
2804                 memset(&cp, 0, sizeof(cp));
2805                 bacpy(&cp.bdaddr, &conn->dst);
2806                 cp.pscan_rep_mode = 0x02;
2807                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2808         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2809                 mgmt_device_connected(hdev, &conn->dst, conn->type,
2810                                                 conn->dst_type, NULL, 0,
2811                                                 conn->dev_class);
2812
2813         if (!hci_outgoing_auth_needed(hdev, conn)) {
2814                 conn->state = BT_CONNECTED;
2815                 hci_proto_connect_cfm(conn, ev->status);
2816                 hci_conn_put(conn);
2817         }
2818
2819 unlock:
2820         hci_dev_unlock(hdev);
2821 }
2822
2823 static inline void hci_sync_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2824 {
2825         struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
2826         struct hci_conn *conn;
2827
2828         BT_DBG("%s status %d", hdev->name, ev->status);
2829
2830         hci_dev_lock(hdev);
2831
2832         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
2833         if (!conn) {
2834                 if (ev->link_type == ESCO_LINK)
2835                         goto unlock;
2836
2837                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
2838                 if (!conn)
2839                         goto unlock;
2840
2841                 conn->type = SCO_LINK;
2842         }
2843
2844         switch (ev->status) {
2845         case 0x00:
2846                 conn->handle = __le16_to_cpu(ev->handle);
2847                 conn->state  = BT_CONNECTED;
2848
2849                 hci_conn_hold_device(conn);
2850                 hci_conn_add_sysfs(conn);
2851                 break;
2852
2853         case 0x11:      /* Unsupported Feature or Parameter Value */
2854         case 0x1c:      /* SCO interval rejected */
2855         case 0x1a:      /* Unsupported Remote Feature */
2856         case 0x1f:      /* Unspecified error */
2857                 if (conn->out && conn->attempt < 2) {
2858                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
2859                                         (hdev->esco_type & EDR_ESCO_MASK);
2860                         hci_setup_sync(conn, conn->link->handle);
2861                         goto unlock;
2862                 }
2863                 /* fall through */
2864
2865         default:
2866                 conn->state = BT_CLOSED;
2867                 break;
2868         }
2869
2870         hci_proto_connect_cfm(conn, ev->status);
2871         if (ev->status)
2872                 hci_conn_del(conn);
2873
2874 unlock:
2875         hci_dev_unlock(hdev);
2876 }
2877
2878 static inline void hci_sync_conn_changed_evt(struct hci_dev *hdev, struct sk_buff *skb)
2879 {
2880         BT_DBG("%s", hdev->name);
2881 }
2882
2883 static inline void hci_sniff_subrate_evt(struct hci_dev *hdev, struct sk_buff *skb)
2884 {
2885         struct hci_ev_sniff_subrate *ev = (void *) skb->data;
2886
2887         BT_DBG("%s status %d", hdev->name, ev->status);
2888 }
2889
2890 static inline void hci_extended_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
2891 {
2892         struct inquiry_data data;
2893         struct extended_inquiry_info *info = (void *) (skb->data + 1);
2894         int num_rsp = *((__u8 *) skb->data);
2895
2896         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2897
2898         if (!num_rsp)
2899                 return;
2900
2901         hci_dev_lock(hdev);
2902
2903         for (; num_rsp; num_rsp--, info++) {
2904                 bool name_known;
2905
2906                 bacpy(&data.bdaddr, &info->bdaddr);
2907                 data.pscan_rep_mode     = info->pscan_rep_mode;
2908                 data.pscan_period_mode  = info->pscan_period_mode;
2909                 data.pscan_mode         = 0x00;
2910                 memcpy(data.dev_class, info->dev_class, 3);
2911                 data.clock_offset       = info->clock_offset;
2912                 data.rssi               = info->rssi;
2913                 data.ssp_mode           = 0x01;
2914
2915                 if (test_bit(HCI_MGMT, &hdev->dev_flags))
2916                         name_known = eir_has_data_type(info->data,
2917                                                         sizeof(info->data),
2918                                                         EIR_NAME_COMPLETE);
2919                 else
2920                         name_known = true;
2921
2922                 name_known = hci_inquiry_cache_update(hdev, &data, name_known);
2923                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2924                                                 info->dev_class, info->rssi,
2925                                                 !name_known, info->data,
2926                                                 sizeof(info->data));
2927         }
2928
2929         hci_dev_unlock(hdev);
2930 }
2931
2932 static inline u8 hci_get_auth_req(struct hci_conn *conn)
2933 {
2934         /* If remote requests dedicated bonding follow that lead */
2935         if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03) {
2936                 /* If both remote and local IO capabilities allow MITM
2937                  * protection then require it, otherwise don't */
2938                 if (conn->remote_cap == 0x03 || conn->io_capability == 0x03)
2939                         return 0x02;
2940                 else
2941                         return 0x03;
2942         }
2943
2944         /* If remote requests no-bonding follow that lead */
2945         if (conn->remote_auth == 0x00 || conn->remote_auth == 0x01)
2946                 return conn->remote_auth | (conn->auth_type & 0x01);
2947
2948         return conn->auth_type;
2949 }
2950
2951 static inline void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2952 {
2953         struct hci_ev_io_capa_request *ev = (void *) skb->data;
2954         struct hci_conn *conn;
2955
2956         BT_DBG("%s", hdev->name);
2957
2958         hci_dev_lock(hdev);
2959
2960         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2961         if (!conn)
2962                 goto unlock;
2963
2964         hci_conn_hold(conn);
2965
2966         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
2967                 goto unlock;
2968
2969         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags) ||
2970                         (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
2971                 struct hci_cp_io_capability_reply cp;
2972
2973                 bacpy(&cp.bdaddr, &ev->bdaddr);
2974                 /* Change the IO capability from KeyboardDisplay
2975                  * to DisplayYesNo as it is not supported by BT spec. */
2976                 cp.capability = (conn->io_capability == 0x04) ?
2977                                                 0x01 : conn->io_capability;
2978                 conn->auth_type = hci_get_auth_req(conn);
2979                 cp.authentication = conn->auth_type;
2980
2981                 if ((conn->out || test_bit(HCI_CONN_REMOTE_OOB, &conn->flags)) &&
2982                                 hci_find_remote_oob_data(hdev, &conn->dst))
2983                         cp.oob_data = 0x01;
2984                 else
2985                         cp.oob_data = 0x00;
2986
2987                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
2988                                                         sizeof(cp), &cp);
2989         } else {
2990                 struct hci_cp_io_capability_neg_reply cp;
2991
2992                 bacpy(&cp.bdaddr, &ev->bdaddr);
2993                 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
2994
2995                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
2996                                                         sizeof(cp), &cp);
2997         }
2998
2999 unlock:
3000         hci_dev_unlock(hdev);
3001 }
3002
3003 static inline void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
3004 {
3005         struct hci_ev_io_capa_reply *ev = (void *) skb->data;
3006         struct hci_conn *conn;
3007
3008         BT_DBG("%s", hdev->name);
3009
3010         hci_dev_lock(hdev);
3011
3012         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3013         if (!conn)
3014                 goto unlock;
3015
3016         conn->remote_cap = ev->capability;
3017         conn->remote_auth = ev->authentication;
3018         if (ev->oob_data)
3019                 set_bit(HCI_CONN_REMOTE_OOB, &conn->flags);
3020
3021 unlock:
3022         hci_dev_unlock(hdev);
3023 }
3024
3025 static inline void hci_user_confirm_request_evt(struct hci_dev *hdev,
3026                                                         struct sk_buff *skb)
3027 {
3028         struct hci_ev_user_confirm_req *ev = (void *) skb->data;
3029         int loc_mitm, rem_mitm, confirm_hint = 0;
3030         struct hci_conn *conn;
3031
3032         BT_DBG("%s", hdev->name);
3033
3034         hci_dev_lock(hdev);
3035
3036         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3037                 goto unlock;
3038
3039         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3040         if (!conn)
3041                 goto unlock;
3042
3043         loc_mitm = (conn->auth_type & 0x01);
3044         rem_mitm = (conn->remote_auth & 0x01);
3045
3046         /* If we require MITM but the remote device can't provide that
3047          * (it has NoInputNoOutput) then reject the confirmation
3048          * request. The only exception is when we're dedicated bonding
3049          * initiators (connect_cfm_cb set) since then we always have the MITM
3050          * bit set. */
3051         if (!conn->connect_cfm_cb && loc_mitm && conn->remote_cap == 0x03) {
3052                 BT_DBG("Rejecting request: remote device can't provide MITM");
3053                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
3054                                         sizeof(ev->bdaddr), &ev->bdaddr);
3055                 goto unlock;
3056         }
3057
3058         /* If no side requires MITM protection; auto-accept */
3059         if ((!loc_mitm || conn->remote_cap == 0x03) &&
3060                                 (!rem_mitm || conn->io_capability == 0x03)) {
3061
3062                 /* If we're not the initiators request authorization to
3063                  * proceed from user space (mgmt_user_confirm with
3064                  * confirm_hint set to 1). */
3065                 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
3066                         BT_DBG("Confirming auto-accept as acceptor");
3067                         confirm_hint = 1;
3068                         goto confirm;
3069                 }
3070
3071                 BT_DBG("Auto-accept of user confirmation with %ums delay",
3072                                                 hdev->auto_accept_delay);
3073
3074                 if (hdev->auto_accept_delay > 0) {
3075                         int delay = msecs_to_jiffies(hdev->auto_accept_delay);
3076                         mod_timer(&conn->auto_accept_timer, jiffies + delay);
3077                         goto unlock;
3078                 }
3079
3080                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
3081                                                 sizeof(ev->bdaddr), &ev->bdaddr);
3082                 goto unlock;
3083         }
3084
3085 confirm:
3086         mgmt_user_confirm_request(hdev, &ev->bdaddr, ev->passkey,
3087                                                                 confirm_hint);
3088
3089 unlock:
3090         hci_dev_unlock(hdev);
3091 }
3092
3093 static inline void hci_user_passkey_request_evt(struct hci_dev *hdev,
3094                                                         struct sk_buff *skb)
3095 {
3096         struct hci_ev_user_passkey_req *ev = (void *) skb->data;
3097
3098         BT_DBG("%s", hdev->name);
3099
3100         hci_dev_lock(hdev);
3101
3102         if (test_bit(HCI_MGMT, &hdev->dev_flags))
3103                 mgmt_user_passkey_request(hdev, &ev->bdaddr);
3104
3105         hci_dev_unlock(hdev);
3106 }
3107
3108 static inline void hci_simple_pair_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
3109 {
3110         struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
3111         struct hci_conn *conn;
3112
3113         BT_DBG("%s", hdev->name);
3114
3115         hci_dev_lock(hdev);
3116
3117         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3118         if (!conn)
3119                 goto unlock;
3120
3121         /* To avoid duplicate auth_failed events to user space we check
3122          * the HCI_CONN_AUTH_PEND flag which will be set if we
3123          * initiated the authentication. A traditional auth_complete
3124          * event gets always produced as initiator and is also mapped to
3125          * the mgmt_auth_failed event */
3126         if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status != 0)
3127                 mgmt_auth_failed(hdev, &conn->dst, ev->status);
3128
3129         hci_conn_put(conn);
3130
3131 unlock:
3132         hci_dev_unlock(hdev);
3133 }
3134
3135 static inline void hci_remote_host_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
3136 {
3137         struct hci_ev_remote_host_features *ev = (void *) skb->data;
3138         struct inquiry_entry *ie;
3139
3140         BT_DBG("%s", hdev->name);
3141
3142         hci_dev_lock(hdev);
3143
3144         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
3145         if (ie)
3146                 ie->data.ssp_mode = (ev->features[0] & 0x01);
3147
3148         hci_dev_unlock(hdev);
3149 }
3150
3151 static inline void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
3152                                                         struct sk_buff *skb)
3153 {
3154         struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
3155         struct oob_data *data;
3156
3157         BT_DBG("%s", hdev->name);
3158
3159         hci_dev_lock(hdev);
3160
3161         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3162                 goto unlock;
3163
3164         data = hci_find_remote_oob_data(hdev, &ev->bdaddr);
3165         if (data) {
3166                 struct hci_cp_remote_oob_data_reply cp;
3167
3168                 bacpy(&cp.bdaddr, &ev->bdaddr);
3169                 memcpy(cp.hash, data->hash, sizeof(cp.hash));
3170                 memcpy(cp.randomizer, data->randomizer, sizeof(cp.randomizer));
3171
3172                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY, sizeof(cp),
3173                                                                         &cp);
3174         } else {
3175                 struct hci_cp_remote_oob_data_neg_reply cp;
3176
3177                 bacpy(&cp.bdaddr, &ev->bdaddr);
3178                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY, sizeof(cp),
3179                                                                         &cp);
3180         }
3181
3182 unlock:
3183         hci_dev_unlock(hdev);
3184 }
3185
3186 static inline void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
3187 {
3188         struct hci_ev_le_conn_complete *ev = (void *) skb->data;
3189         struct hci_conn *conn;
3190
3191         BT_DBG("%s status %d", hdev->name, ev->status);
3192
3193         hci_dev_lock(hdev);
3194
3195         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &ev->bdaddr);
3196         if (!conn) {
3197                 conn = hci_conn_add(hdev, LE_LINK, &ev->bdaddr);
3198                 if (!conn) {
3199                         BT_ERR("No memory for new connection");
3200                         hci_dev_unlock(hdev);
3201                         return;
3202                 }
3203
3204                 conn->dst_type = ev->bdaddr_type;
3205         }
3206
3207         if (ev->status) {
3208                 mgmt_connect_failed(hdev, &ev->bdaddr, conn->type,
3209                                                 conn->dst_type, ev->status);
3210                 hci_proto_connect_cfm(conn, ev->status);
3211                 conn->state = BT_CLOSED;
3212                 hci_conn_del(conn);
3213                 goto unlock;
3214         }
3215
3216         if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
3217                 mgmt_device_connected(hdev, &ev->bdaddr, conn->type,
3218                                                 conn->dst_type, NULL, 0, 0);
3219
3220         conn->sec_level = BT_SECURITY_LOW;
3221         conn->handle = __le16_to_cpu(ev->handle);
3222         conn->state = BT_CONNECTED;
3223
3224         hci_conn_hold_device(conn);
3225         hci_conn_add_sysfs(conn);
3226
3227         hci_proto_connect_cfm(conn, ev->status);
3228
3229 unlock:
3230         hci_dev_unlock(hdev);
3231 }
3232
3233 static inline void hci_le_adv_report_evt(struct hci_dev *hdev,
3234                                                 struct sk_buff *skb)
3235 {
3236         u8 num_reports = skb->data[0];
3237         void *ptr = &skb->data[1];
3238         s8 rssi;
3239
3240         hci_dev_lock(hdev);
3241
3242         while (num_reports--) {
3243                 struct hci_ev_le_advertising_info *ev = ptr;
3244
3245                 hci_add_adv_entry(hdev, ev);
3246
3247                 rssi = ev->data[ev->length];
3248                 mgmt_device_found(hdev, &ev->bdaddr, LE_LINK, ev->bdaddr_type,
3249                                         NULL, rssi, 0, ev->data, ev->length);
3250
3251                 ptr += sizeof(*ev) + ev->length + 1;
3252         }
3253
3254         hci_dev_unlock(hdev);
3255 }
3256
3257 static inline void hci_le_ltk_request_evt(struct hci_dev *hdev,
3258                                                 struct sk_buff *skb)
3259 {
3260         struct hci_ev_le_ltk_req *ev = (void *) skb->data;
3261         struct hci_cp_le_ltk_reply cp;
3262         struct hci_cp_le_ltk_neg_reply neg;
3263         struct hci_conn *conn;
3264         struct smp_ltk *ltk;
3265
3266         BT_DBG("%s handle %d", hdev->name, cpu_to_le16(ev->handle));
3267
3268         hci_dev_lock(hdev);
3269
3270         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3271         if (conn == NULL)
3272                 goto not_found;
3273
3274         ltk = hci_find_ltk(hdev, ev->ediv, ev->random);
3275         if (ltk == NULL)
3276                 goto not_found;
3277
3278         memcpy(cp.ltk, ltk->val, sizeof(ltk->val));
3279         cp.handle = cpu_to_le16(conn->handle);
3280
3281         if (ltk->authenticated)
3282                 conn->sec_level = BT_SECURITY_HIGH;
3283
3284         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
3285
3286         if (ltk->type & HCI_SMP_STK) {
3287                 list_del(&ltk->list);
3288                 kfree(ltk);
3289         }
3290
3291         hci_dev_unlock(hdev);
3292
3293         return;
3294
3295 not_found:
3296         neg.handle = ev->handle;
3297         hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
3298         hci_dev_unlock(hdev);
3299 }
3300
3301 static inline void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
3302 {
3303         struct hci_ev_le_meta *le_ev = (void *) skb->data;
3304
3305         skb_pull(skb, sizeof(*le_ev));
3306
3307         switch (le_ev->subevent) {
3308         case HCI_EV_LE_CONN_COMPLETE:
3309                 hci_le_conn_complete_evt(hdev, skb);
3310                 break;
3311
3312         case HCI_EV_LE_ADVERTISING_REPORT:
3313                 hci_le_adv_report_evt(hdev, skb);
3314                 break;
3315
3316         case HCI_EV_LE_LTK_REQ:
3317                 hci_le_ltk_request_evt(hdev, skb);
3318                 break;
3319
3320         default:
3321                 break;
3322         }
3323 }
3324
3325 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
3326 {
3327         struct hci_event_hdr *hdr = (void *) skb->data;
3328         __u8 event = hdr->evt;
3329
3330         skb_pull(skb, HCI_EVENT_HDR_SIZE);
3331
3332         switch (event) {
3333         case HCI_EV_INQUIRY_COMPLETE:
3334                 hci_inquiry_complete_evt(hdev, skb);
3335                 break;
3336
3337         case HCI_EV_INQUIRY_RESULT:
3338                 hci_inquiry_result_evt(hdev, skb);
3339                 break;
3340
3341         case HCI_EV_CONN_COMPLETE:
3342                 hci_conn_complete_evt(hdev, skb);
3343                 break;
3344
3345         case HCI_EV_CONN_REQUEST:
3346                 hci_conn_request_evt(hdev, skb);
3347                 break;
3348
3349         case HCI_EV_DISCONN_COMPLETE:
3350                 hci_disconn_complete_evt(hdev, skb);
3351                 break;
3352
3353         case HCI_EV_AUTH_COMPLETE:
3354                 hci_auth_complete_evt(hdev, skb);
3355                 break;
3356
3357         case HCI_EV_REMOTE_NAME:
3358                 hci_remote_name_evt(hdev, skb);
3359                 break;
3360
3361         case HCI_EV_ENCRYPT_CHANGE:
3362                 hci_encrypt_change_evt(hdev, skb);
3363                 break;
3364
3365         case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
3366                 hci_change_link_key_complete_evt(hdev, skb);
3367                 break;
3368
3369         case HCI_EV_REMOTE_FEATURES:
3370                 hci_remote_features_evt(hdev, skb);
3371                 break;
3372
3373         case HCI_EV_REMOTE_VERSION:
3374                 hci_remote_version_evt(hdev, skb);
3375                 break;
3376
3377         case HCI_EV_QOS_SETUP_COMPLETE:
3378                 hci_qos_setup_complete_evt(hdev, skb);
3379                 break;
3380
3381         case HCI_EV_CMD_COMPLETE:
3382                 hci_cmd_complete_evt(hdev, skb);
3383                 break;
3384
3385         case HCI_EV_CMD_STATUS:
3386                 hci_cmd_status_evt(hdev, skb);
3387                 break;
3388
3389         case HCI_EV_ROLE_CHANGE:
3390                 hci_role_change_evt(hdev, skb);
3391                 break;
3392
3393         case HCI_EV_NUM_COMP_PKTS:
3394                 hci_num_comp_pkts_evt(hdev, skb);
3395                 break;
3396
3397         case HCI_EV_MODE_CHANGE:
3398                 hci_mode_change_evt(hdev, skb);
3399                 break;
3400
3401         case HCI_EV_PIN_CODE_REQ:
3402                 hci_pin_code_request_evt(hdev, skb);
3403                 break;
3404
3405         case HCI_EV_LINK_KEY_REQ:
3406                 hci_link_key_request_evt(hdev, skb);
3407                 break;
3408
3409         case HCI_EV_LINK_KEY_NOTIFY:
3410                 hci_link_key_notify_evt(hdev, skb);
3411                 break;
3412
3413         case HCI_EV_CLOCK_OFFSET:
3414                 hci_clock_offset_evt(hdev, skb);
3415                 break;
3416
3417         case HCI_EV_PKT_TYPE_CHANGE:
3418                 hci_pkt_type_change_evt(hdev, skb);
3419                 break;
3420
3421         case HCI_EV_PSCAN_REP_MODE:
3422                 hci_pscan_rep_mode_evt(hdev, skb);
3423                 break;
3424
3425         case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
3426                 hci_inquiry_result_with_rssi_evt(hdev, skb);
3427                 break;
3428
3429         case HCI_EV_REMOTE_EXT_FEATURES:
3430                 hci_remote_ext_features_evt(hdev, skb);
3431                 break;
3432
3433         case HCI_EV_SYNC_CONN_COMPLETE:
3434                 hci_sync_conn_complete_evt(hdev, skb);
3435                 break;
3436
3437         case HCI_EV_SYNC_CONN_CHANGED:
3438                 hci_sync_conn_changed_evt(hdev, skb);
3439                 break;
3440
3441         case HCI_EV_SNIFF_SUBRATE:
3442                 hci_sniff_subrate_evt(hdev, skb);
3443                 break;
3444
3445         case HCI_EV_EXTENDED_INQUIRY_RESULT:
3446                 hci_extended_inquiry_result_evt(hdev, skb);
3447                 break;
3448
3449         case HCI_EV_IO_CAPA_REQUEST:
3450                 hci_io_capa_request_evt(hdev, skb);
3451                 break;
3452
3453         case HCI_EV_IO_CAPA_REPLY:
3454                 hci_io_capa_reply_evt(hdev, skb);
3455                 break;
3456
3457         case HCI_EV_USER_CONFIRM_REQUEST:
3458                 hci_user_confirm_request_evt(hdev, skb);
3459                 break;
3460
3461         case HCI_EV_USER_PASSKEY_REQUEST:
3462                 hci_user_passkey_request_evt(hdev, skb);
3463                 break;
3464
3465         case HCI_EV_SIMPLE_PAIR_COMPLETE:
3466                 hci_simple_pair_complete_evt(hdev, skb);
3467                 break;
3468
3469         case HCI_EV_REMOTE_HOST_FEATURES:
3470                 hci_remote_host_features_evt(hdev, skb);
3471                 break;
3472
3473         case HCI_EV_LE_META:
3474                 hci_le_meta_evt(hdev, skb);
3475                 break;
3476
3477         case HCI_EV_REMOTE_OOB_DATA_REQUEST:
3478                 hci_remote_oob_data_request_evt(hdev, skb);
3479                 break;
3480
3481         case HCI_EV_NUM_COMP_BLOCKS:
3482                 hci_num_comp_blocks_evt(hdev, skb);
3483                 break;
3484
3485         default:
3486                 BT_DBG("%s event 0x%x", hdev->name, event);
3487                 break;
3488         }
3489
3490         kfree_skb(skb);
3491         hdev->stat.evt_rx++;
3492 }
3493
3494 /* Generate internal stack event */
3495 void hci_si_event(struct hci_dev *hdev, int type, int dlen, void *data)
3496 {
3497         struct hci_event_hdr *hdr;
3498         struct hci_ev_stack_internal *ev;
3499         struct sk_buff *skb;
3500
3501         skb = bt_skb_alloc(HCI_EVENT_HDR_SIZE + sizeof(*ev) + dlen, GFP_ATOMIC);
3502         if (!skb)
3503                 return;
3504
3505         hdr = (void *) skb_put(skb, HCI_EVENT_HDR_SIZE);
3506         hdr->evt  = HCI_EV_STACK_INTERNAL;
3507         hdr->plen = sizeof(*ev) + dlen;
3508
3509         ev  = (void *) skb_put(skb, sizeof(*ev) + dlen);
3510         ev->type = type;
3511         memcpy(ev->data, data, dlen);
3512
3513         bt_cb(skb)->incoming = 1;
3514         __net_timestamp(skb);
3515
3516         bt_cb(skb)->pkt_type = HCI_EVENT_PKT;
3517         skb->dev = (void *) hdev;
3518         hci_send_to_sock(hdev, skb, NULL);
3519         kfree_skb(skb);
3520 }
3521
3522 module_param(enable_le, bool, 0644);
3523 MODULE_PARM_DESC(enable_le, "Enable LE support");