net/bluetooth/hci_event.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI event handling. */
  26
  27 #include <linux/module.h>
  28
  29 #include <linux/types.h>
  30 #include <linux/errno.h>
  31 #include <linux/kernel.h>
  32 #include <linux/slab.h>
  33 #include <linux/poll.h>
  34 #include <linux/fcntl.h>
  35 #include <linux/init.h>
  36 #include <linux/skbuff.h>
  37 #include <linux/interrupt.h>
  38 #include <linux/notifier.h>
  39 #include <net/sock.h>
  40
  41 #include <asm/system.h>
  42 #include <linux/uaccess.h>
  43 #include <asm/unaligned.h>
  44
  45 #include <net/bluetooth/bluetooth.h>
  46 #include <net/bluetooth/hci_core.h>
  47
  48 static int enable_le;
  49
  50 /* Handle HCI Event packets */
  51
  52 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
  53 {
  54         __u8 status = *((__u8 *) skb->data);
  55
  56         BT_DBG("%s status 0x%x", hdev->name, status);
  57
  58         if (status) {
  59                 hci_dev_lock(hdev);
  60                 mgmt_stop_discovery_failed(hdev, status);
  61                 hci_dev_unlock(hdev);
  62                 return;
  63         }
  64
  65         clear_bit(HCI_INQUIRY, &hdev->flags);
  66
  67         hci_dev_lock(hdev);
  68         mgmt_discovering(hdev, 0);
  69         hci_dev_unlock(hdev);
  70
  71         hci_req_complete(hdev, HCI_OP_INQUIRY_CANCEL, status);
  72
  73         hci_conn_check_pending(hdev);
  74 }
  75
  76 static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  77 {
  78         __u8 status = *((__u8 *) skb->data);
  79
  80         BT_DBG("%s status 0x%x", hdev->name, status);
  81
  82         if (status)
  83                 return;
  84
  85         hci_conn_check_pending(hdev);
  86 }
  87
  88 static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev, struct sk_buff *skb)
  89 {
  90         BT_DBG("%s", hdev->name);
  91 }
  92
  93 static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
  94 {
  95         struct hci_rp_role_discovery *rp = (void *) skb->data;
  96         struct hci_conn *conn;
  97
  98         BT_DBG("%s status 0x%x", hdev->name, rp->status);
  99
 100         if (rp->status)
 101                 return;
 102
 103         hci_dev_lock(hdev);
 104
 105         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 106         if (conn) {
 107                 if (rp->role)
 108                         conn->link_mode &= ~HCI_LM_MASTER;
 109                 else
 110                         conn->link_mode |= HCI_LM_MASTER;
 111         }
 112
 113         hci_dev_unlock(hdev);
 114 }
 115
 116 static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 117 {
 118         struct hci_rp_read_link_policy *rp = (void *) skb->data;
 119         struct hci_conn *conn;
 120
 121         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 122
 123         if (rp->status)
 124                 return;
 125
 126         hci_dev_lock(hdev);
 127
 128         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 129         if (conn)
 130                 conn->link_policy = __le16_to_cpu(rp->policy);
 131
 132         hci_dev_unlock(hdev);
 133 }
 134
 135 static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 136 {
 137         struct hci_rp_write_link_policy *rp = (void *) skb->data;
 138         struct hci_conn *conn;
 139         void *sent;
 140
 141         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 142
 143         if (rp->status)
 144                 return;
 145
 146         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
 147         if (!sent)
 148                 return;
 149
 150         hci_dev_lock(hdev);
 151
 152         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 153         if (conn)
 154                 conn->link_policy = get_unaligned_le16(sent + 2);
 155
 156         hci_dev_unlock(hdev);
 157 }
 158
 159 static void hci_cc_read_def_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 160 {
 161         struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
 162
 163         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 164
 165         if (rp->status)
 166                 return;
 167
 168         hdev->link_policy = __le16_to_cpu(rp->policy);
 169 }
 170
 171 static void hci_cc_write_def_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 172 {
 173         __u8 status = *((__u8 *) skb->data);
 174         void *sent;
 175
 176         BT_DBG("%s status 0x%x", hdev->name, status);
 177
 178         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
 179         if (!sent)
 180                 return;
 181
 182         if (!status)
 183                 hdev->link_policy = get_unaligned_le16(sent);
 184
 185         hci_req_complete(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, status);
 186 }
 187
 188 static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
 189 {
 190         __u8 status = *((__u8 *) skb->data);
 191
 192         BT_DBG("%s status 0x%x", hdev->name, status);
 193
 194         clear_bit(HCI_RESET, &hdev->flags);
 195
 196         hci_req_complete(hdev, HCI_OP_RESET, status);
 197
 198         hdev->dev_flags = 0;
 199 }
 200
 201 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 202 {
 203         __u8 status = *((__u8 *) skb->data);
 204         void *sent;
 205
 206         BT_DBG("%s status 0x%x", hdev->name, status);
 207
 208         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
 209         if (!sent)
 210                 return;
 211
 212         hci_dev_lock(hdev);
 213
 214         if (test_bit(HCI_MGMT, &hdev->flags))
 215                 mgmt_set_local_name_complete(hdev, sent, status);
 216
 217         if (status == 0)
 218                 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
 219
 220         hci_dev_unlock(hdev);
 221 }
 222
 223 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 224 {
 225         struct hci_rp_read_local_name *rp = (void *) skb->data;
 226
 227         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 228
 229         if (rp->status)
 230                 return;
 231
 232         memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
 233 }
 234
 235 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
 236 {
 237         __u8 status = *((__u8 *) skb->data);
 238         void *sent;
 239
 240         BT_DBG("%s status 0x%x", hdev->name, status);
 241
 242         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
 243         if (!sent)
 244                 return;
 245
 246         if (!status) {
 247                 __u8 param = *((__u8 *) sent);
 248
 249                 if (param == AUTH_ENABLED)
 250                         set_bit(HCI_AUTH, &hdev->flags);
 251                 else
 252                         clear_bit(HCI_AUTH, &hdev->flags);
 253         }
 254
 255         hci_req_complete(hdev, HCI_OP_WRITE_AUTH_ENABLE, status);
 256 }
 257
 258 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
 259 {
 260         __u8 status = *((__u8 *) skb->data);
 261         void *sent;
 262
 263         BT_DBG("%s status 0x%x", hdev->name, status);
 264
 265         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
 266         if (!sent)
 267                 return;
 268
 269         if (!status) {
 270                 __u8 param = *((__u8 *) sent);
 271
 272                 if (param)
 273                         set_bit(HCI_ENCRYPT, &hdev->flags);
 274                 else
 275                         clear_bit(HCI_ENCRYPT, &hdev->flags);
 276         }
 277
 278         hci_req_complete(hdev, HCI_OP_WRITE_ENCRYPT_MODE, status);
 279 }
 280
 281 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
 282 {
 283         __u8 param, status = *((__u8 *) skb->data);
 284         int old_pscan, old_iscan;
 285         void *sent;
 286
 287         BT_DBG("%s status 0x%x", hdev->name, status);
 288
 289         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
 290         if (!sent)
 291                 return;
 292
 293         param = *((__u8 *) sent);
 294
 295         hci_dev_lock(hdev);
 296
 297         if (status != 0) {
 298                 mgmt_write_scan_failed(hdev, param, status);
 299                 hdev->discov_timeout = 0;
 300                 goto done;
 301         }
 302
 303         old_pscan = test_and_clear_bit(HCI_PSCAN, &hdev->flags);
 304         old_iscan = test_and_clear_bit(HCI_ISCAN, &hdev->flags);
 305
 306         if (param & SCAN_INQUIRY) {
 307                 set_bit(HCI_ISCAN, &hdev->flags);
 308                 if (!old_iscan)
 309                         mgmt_discoverable(hdev, 1);
 310                 if (hdev->discov_timeout > 0) {
 311                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
 312                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
 313                                                                         to);
 314                 }
 315         } else if (old_iscan)
 316                 mgmt_discoverable(hdev, 0);
 317
 318         if (param & SCAN_PAGE) {
 319                 set_bit(HCI_PSCAN, &hdev->flags);
 320                 if (!old_pscan)
 321                         mgmt_connectable(hdev, 1);
 322         } else if (old_pscan)
 323                 mgmt_connectable(hdev, 0);
 324
 325 done:
 326         hci_dev_unlock(hdev);
 327         hci_req_complete(hdev, HCI_OP_WRITE_SCAN_ENABLE, status);
 328 }
 329
 330 static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 331 {
 332         struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
 333
 334         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 335
 336         if (rp->status)
 337                 return;
 338
 339         memcpy(hdev->dev_class, rp->dev_class, 3);
 340
 341         BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
 342                 hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
 343 }
 344
 345 static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 346 {
 347         __u8 status = *((__u8 *) skb->data);
 348         void *sent;
 349
 350         BT_DBG("%s status 0x%x", hdev->name, status);
 351
 352         if (status)
 353                 return;
 354
 355         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
 356         if (!sent)
 357                 return;
 358
 359         memcpy(hdev->dev_class, sent, 3);
 360 }
 361
 362 static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 363 {
 364         struct hci_rp_read_voice_setting *rp = (void *) skb->data;
 365         __u16 setting;
 366
 367         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 368
 369         if (rp->status)
 370                 return;
 371
 372         setting = __le16_to_cpu(rp->voice_setting);
 373
 374         if (hdev->voice_setting == setting)
 375                 return;
 376
 377         hdev->voice_setting = setting;
 378
 379         BT_DBG("%s voice setting 0x%04x", hdev->name, setting);
 380
 381         if (hdev->notify)
 382                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 383 }
 384
 385 static void hci_cc_write_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 386 {
 387         __u8 status = *((__u8 *) skb->data);
 388         __u16 setting;
 389         void *sent;
 390
 391         BT_DBG("%s status 0x%x", hdev->name, status);
 392
 393         if (status)
 394                 return;
 395
 396         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
 397         if (!sent)
 398                 return;
 399
 400         setting = get_unaligned_le16(sent);
 401
 402         if (hdev->voice_setting == setting)
 403                 return;
 404
 405         hdev->voice_setting = setting;
 406
 407         BT_DBG("%s voice setting 0x%04x", hdev->name, setting);
 408
 409         if (hdev->notify)
 410                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 411 }
 412
 413 static void hci_cc_host_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 414 {
 415         __u8 status = *((__u8 *) skb->data);
 416
 417         BT_DBG("%s status 0x%x", hdev->name, status);
 418
 419         hci_req_complete(hdev, HCI_OP_HOST_BUFFER_SIZE, status);
 420 }
 421
 422 static void hci_cc_read_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 423 {
 424         struct hci_rp_read_ssp_mode *rp = (void *) skb->data;
 425
 426         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 427
 428         if (rp->status)
 429                 return;
 430
 431         hdev->ssp_mode = rp->mode;
 432 }
 433
 434 static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 435 {
 436         __u8 status = *((__u8 *) skb->data);
 437         void *sent;
 438
 439         BT_DBG("%s status 0x%x", hdev->name, status);
 440
 441         if (status)
 442                 return;
 443
 444         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
 445         if (!sent)
 446                 return;
 447
 448         hdev->ssp_mode = *((__u8 *) sent);
 449 }
 450
 451 static u8 hci_get_inquiry_mode(struct hci_dev *hdev)
 452 {
 453         if (hdev->features[6] & LMP_EXT_INQ)
 454                 return 2;
 455
 456         if (hdev->features[3] & LMP_RSSI_INQ)
 457                 return 1;
 458
 459         if (hdev->manufacturer == 11 && hdev->hci_rev == 0x00 &&
 460                                                 hdev->lmp_subver == 0x0757)
 461                 return 1;
 462
 463         if (hdev->manufacturer == 15) {
 464                 if (hdev->hci_rev == 0x03 && hdev->lmp_subver == 0x6963)
 465                         return 1;
 466                 if (hdev->hci_rev == 0x09 && hdev->lmp_subver == 0x6963)
 467                         return 1;
 468                 if (hdev->hci_rev == 0x00 && hdev->lmp_subver == 0x6965)
 469                         return 1;
 470         }
 471
 472         if (hdev->manufacturer == 31 && hdev->hci_rev == 0x2005 &&
 473                                                 hdev->lmp_subver == 0x1805)
 474                 return 1;
 475
 476         return 0;
 477 }
 478
 479 static void hci_setup_inquiry_mode(struct hci_dev *hdev)
 480 {
 481         u8 mode;
 482
 483         mode = hci_get_inquiry_mode(hdev);
 484
 485         hci_send_cmd(hdev, HCI_OP_WRITE_INQUIRY_MODE, 1, &mode);
 486 }
 487
 488 static void hci_setup_event_mask(struct hci_dev *hdev)
 489 {
 490         /* The second byte is 0xff instead of 0x9f (two reserved bits
 491          * disabled) since a Broadcom 1.2 dongle doesn't respond to the
 492          * command otherwise */
 493         u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };
 494
 495         /* CSR 1.1 dongles does not accept any bitfield so don't try to set
 496          * any event mask for pre 1.2 devices */
 497         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
 498                 return;
 499
 500         events[4] |= 0x01; /* Flow Specification Complete */
 501         events[4] |= 0x02; /* Inquiry Result with RSSI */
 502         events[4] |= 0x04; /* Read Remote Extended Features Complete */
 503         events[5] |= 0x08; /* Synchronous Connection Complete */
 504         events[5] |= 0x10; /* Synchronous Connection Changed */
 505
 506         if (hdev->features[3] & LMP_RSSI_INQ)
 507                 events[4] |= 0x04; /* Inquiry Result with RSSI */
 508
 509         if (hdev->features[5] & LMP_SNIFF_SUBR)
 510                 events[5] |= 0x20; /* Sniff Subrating */
 511
 512         if (hdev->features[5] & LMP_PAUSE_ENC)
 513                 events[5] |= 0x80; /* Encryption Key Refresh Complete */
 514
 515         if (hdev->features[6] & LMP_EXT_INQ)
 516                 events[5] |= 0x40; /* Extended Inquiry Result */
 517
 518         if (hdev->features[6] & LMP_NO_FLUSH)
 519                 events[7] |= 0x01; /* Enhanced Flush Complete */
 520
 521         if (hdev->features[7] & LMP_LSTO)
 522                 events[6] |= 0x80; /* Link Supervision Timeout Changed */
 523
 524         if (hdev->features[6] & LMP_SIMPLE_PAIR) {
 525                 events[6] |= 0x01;      /* IO Capability Request */
 526                 events[6] |= 0x02;      /* IO Capability Response */
 527                 events[6] |= 0x04;      /* User Confirmation Request */
 528                 events[6] |= 0x08;      /* User Passkey Request */
 529                 events[6] |= 0x10;      /* Remote OOB Data Request */
 530                 events[6] |= 0x20;      /* Simple Pairing Complete */
 531                 events[7] |= 0x04;      /* User Passkey Notification */
 532                 events[7] |= 0x08;      /* Keypress Notification */
 533                 events[7] |= 0x10;      /* Remote Host Supported
 534                                          * Features Notification */
 535         }
 536
 537         if (hdev->features[4] & LMP_LE)
 538                 events[7] |= 0x20;      /* LE Meta-Event */
 539
 540         hci_send_cmd(hdev, HCI_OP_SET_EVENT_MASK, sizeof(events), events);
 541 }
 542
 543 static void hci_set_le_support(struct hci_dev *hdev)
 544 {
 545         struct hci_cp_write_le_host_supported cp;
 546
 547         memset(&cp, 0, sizeof(cp));
 548
 549         if (enable_le) {
 550                 cp.le = 1;
 551                 cp.simul = !!(hdev->features[6] & LMP_SIMUL_LE_BR);
 552         }
 553
 554         hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(cp), &cp);
 555 }
 556
 557 static void hci_setup(struct hci_dev *hdev)
 558 {
 559         if (hdev->dev_type != HCI_BREDR)
 560                 return;
 561
 562         hci_setup_event_mask(hdev);
 563
 564         if (hdev->hci_ver > BLUETOOTH_VER_1_1)
 565                 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
 566
 567         if (hdev->features[6] & LMP_SIMPLE_PAIR) {
 568                 u8 mode = 0x01;
 569                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(mode), &mode);
 570         }
 571
 572         if (hdev->features[3] & LMP_RSSI_INQ)
 573                 hci_setup_inquiry_mode(hdev);
 574
 575         if (hdev->features[7] & LMP_INQ_TX_PWR)
 576                 hci_send_cmd(hdev, HCI_OP_READ_INQ_RSP_TX_POWER, 0, NULL);
 577
 578         if (hdev->features[7] & LMP_EXTFEATURES) {
 579                 struct hci_cp_read_local_ext_features cp;
 580
 581                 cp.page = 0x01;
 582                 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES,
 583                                                         sizeof(cp), &cp);
 584         }
 585
 586         if (hdev->features[4] & LMP_LE)
 587                 hci_set_le_support(hdev);
 588 }
 589
 590 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
 591 {
 592         struct hci_rp_read_local_version *rp = (void *) skb->data;
 593
 594         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 595
 596         if (rp->status)
 597                 return;
 598
 599         hdev->hci_ver = rp->hci_ver;
 600         hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
 601         hdev->lmp_ver = rp->lmp_ver;
 602         hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
 603         hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
 604
 605         BT_DBG("%s manufacturer %d hci ver %d:%d", hdev->name,
 606                                         hdev->manufacturer,
 607                                         hdev->hci_ver, hdev->hci_rev);
 608
 609         if (test_bit(HCI_INIT, &hdev->flags))
 610                 hci_setup(hdev);
 611 }
 612
 613 static void hci_setup_link_policy(struct hci_dev *hdev)
 614 {
 615         u16 link_policy = 0;
 616
 617         if (hdev->features[0] & LMP_RSWITCH)
 618                 link_policy |= HCI_LP_RSWITCH;
 619         if (hdev->features[0] & LMP_HOLD)
 620                 link_policy |= HCI_LP_HOLD;
 621         if (hdev->features[0] & LMP_SNIFF)
 622                 link_policy |= HCI_LP_SNIFF;
 623         if (hdev->features[1] & LMP_PARK)
 624                 link_policy |= HCI_LP_PARK;
 625
 626         link_policy = cpu_to_le16(link_policy);
 627         hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY,
 628                                         sizeof(link_policy), &link_policy);
 629 }
 630
 631 static void hci_cc_read_local_commands(struct hci_dev *hdev, struct sk_buff *skb)
 632 {
 633         struct hci_rp_read_local_commands *rp = (void *) skb->data;
 634
 635         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 636
 637         if (rp->status)
 638                 goto done;
 639
 640         memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 641
 642         if (test_bit(HCI_INIT, &hdev->flags) && (hdev->commands[5] & 0x10))
 643                 hci_setup_link_policy(hdev);
 644
 645 done:
 646         hci_req_complete(hdev, HCI_OP_READ_LOCAL_COMMANDS, rp->status);
 647 }
 648
 649 static void hci_cc_read_local_features(struct hci_dev *hdev, struct sk_buff *skb)
 650 {
 651         struct hci_rp_read_local_features *rp = (void *) skb->data;
 652
 653         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 654
 655         if (rp->status)
 656                 return;
 657
 658         memcpy(hdev->features, rp->features, 8);
 659
 660         /* Adjust default settings according to features
 661          * supported by device. */
 662
 663         if (hdev->features[0] & LMP_3SLOT)
 664                 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 665
 666         if (hdev->features[0] & LMP_5SLOT)
 667                 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 668
 669         if (hdev->features[1] & LMP_HV2) {
 670                 hdev->pkt_type  |= (HCI_HV2);
 671                 hdev->esco_type |= (ESCO_HV2);
 672         }
 673
 674         if (hdev->features[1] & LMP_HV3) {
 675                 hdev->pkt_type  |= (HCI_HV3);
 676                 hdev->esco_type |= (ESCO_HV3);
 677         }
 678
 679         if (hdev->features[3] & LMP_ESCO)
 680                 hdev->esco_type |= (ESCO_EV3);
 681
 682         if (hdev->features[4] & LMP_EV4)
 683                 hdev->esco_type |= (ESCO_EV4);
 684
 685         if (hdev->features[4] & LMP_EV5)
 686                 hdev->esco_type |= (ESCO_EV5);
 687
 688         if (hdev->features[5] & LMP_EDR_ESCO_2M)
 689                 hdev->esco_type |= (ESCO_2EV3);
 690
 691         if (hdev->features[5] & LMP_EDR_ESCO_3M)
 692                 hdev->esco_type |= (ESCO_3EV3);
 693
 694         if (hdev->features[5] & LMP_EDR_3S_ESCO)
 695                 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
 696
 697         BT_DBG("%s features 0x%.2x%.2x%.2x%.2x%.2x%.2x%.2x%.2x", hdev->name,
 698                                         hdev->features[0], hdev->features[1],
 699                                         hdev->features[2], hdev->features[3],
 700                                         hdev->features[4], hdev->features[5],
 701                                         hdev->features[6], hdev->features[7]);
 702 }
 703
 704 static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
 705                                                         struct sk_buff *skb)
 706 {
 707         struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
 708
 709         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 710
 711         if (rp->status)
 712                 return;
 713
 714         memcpy(hdev->extfeatures, rp->features, 8);
 715
 716         hci_req_complete(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES, rp->status);
 717 }
 718
 719 static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
 720                                                 struct sk_buff *skb)
 721 {
 722         struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;
 723
 724         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 725
 726         if (rp->status)
 727                 return;
 728
 729         hdev->flow_ctl_mode = rp->mode;
 730
 731         hci_req_complete(hdev, HCI_OP_READ_FLOW_CONTROL_MODE, rp->status);
 732 }
 733
 734 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 735 {
 736         struct hci_rp_read_buffer_size *rp = (void *) skb->data;
 737
 738         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 739
 740         if (rp->status)
 741                 return;
 742
 743         hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
 744         hdev->sco_mtu  = rp->sco_mtu;
 745         hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
 746         hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
 747
 748         if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
 749                 hdev->sco_mtu  = 64;
 750                 hdev->sco_pkts = 8;
 751         }
 752
 753         hdev->acl_cnt = hdev->acl_pkts;
 754         hdev->sco_cnt = hdev->sco_pkts;
 755
 756         BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name,
 757                                         hdev->acl_mtu, hdev->acl_pkts,
 758                                         hdev->sco_mtu, hdev->sco_pkts);
 759 }
 760
 761 static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
 762 {
 763         struct hci_rp_read_bd_addr *rp = (void *) skb->data;
 764
 765         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 766
 767         if (!rp->status)
 768                 bacpy(&hdev->bdaddr, &rp->bdaddr);
 769
 770         hci_req_complete(hdev, HCI_OP_READ_BD_ADDR, rp->status);
 771 }
 772
 773 static void hci_cc_read_data_block_size(struct hci_dev *hdev,
 774                                                         struct sk_buff *skb)
 775 {
 776         struct hci_rp_read_data_block_size *rp = (void *) skb->data;
 777
 778         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 779
 780         if (rp->status)
 781                 return;
 782
 783         hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
 784         hdev->block_len = __le16_to_cpu(rp->block_len);
 785         hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
 786
 787         hdev->block_cnt = hdev->num_blocks;
 788
 789         BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
 790                                         hdev->block_cnt, hdev->block_len);
 791
 792         hci_req_complete(hdev, HCI_OP_READ_DATA_BLOCK_SIZE, rp->status);
 793 }
 794
 795 static void hci_cc_write_ca_timeout(struct hci_dev *hdev, struct sk_buff *skb)
 796 {
 797         __u8 status = *((__u8 *) skb->data);
 798
 799         BT_DBG("%s status 0x%x", hdev->name, status);
 800
 801         hci_req_complete(hdev, HCI_OP_WRITE_CA_TIMEOUT, status);
 802 }
 803
 804 static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
 805                 struct sk_buff *skb)
 806 {
 807         struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
 808
 809         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 810
 811         if (rp->status)
 812                 return;
 813
 814         hdev->amp_status = rp->amp_status;
 815         hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
 816         hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
 817         hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
 818         hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
 819         hdev->amp_type = rp->amp_type;
 820         hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
 821         hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
 822         hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
 823         hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
 824
 825         hci_req_complete(hdev, HCI_OP_READ_LOCAL_AMP_INFO, rp->status);
 826 }
 827
 828 static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
 829                                                         struct sk_buff *skb)
 830 {
 831         __u8 status = *((__u8 *) skb->data);
 832
 833         BT_DBG("%s status 0x%x", hdev->name, status);
 834
 835         hci_req_complete(hdev, HCI_OP_DELETE_STORED_LINK_KEY, status);
 836 }
 837
 838 static void hci_cc_set_event_mask(struct hci_dev *hdev, struct sk_buff *skb)
 839 {
 840         __u8 status = *((__u8 *) skb->data);
 841
 842         BT_DBG("%s status 0x%x", hdev->name, status);
 843
 844         hci_req_complete(hdev, HCI_OP_SET_EVENT_MASK, status);
 845 }
 846
 847 static void hci_cc_write_inquiry_mode(struct hci_dev *hdev,
 848                                                         struct sk_buff *skb)
 849 {
 850         __u8 status = *((__u8 *) skb->data);
 851
 852         BT_DBG("%s status 0x%x", hdev->name, status);
 853
 854         hci_req_complete(hdev, HCI_OP_WRITE_INQUIRY_MODE, status);
 855 }
 856
 857 static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
 858                                                         struct sk_buff *skb)
 859 {
 860         __u8 status = *((__u8 *) skb->data);
 861
 862         BT_DBG("%s status 0x%x", hdev->name, status);
 863
 864         hci_req_complete(hdev, HCI_OP_READ_INQ_RSP_TX_POWER, status);
 865 }
 866
 867 static void hci_cc_set_event_flt(struct hci_dev *hdev, struct sk_buff *skb)
 868 {
 869         __u8 status = *((__u8 *) skb->data);
 870
 871         BT_DBG("%s status 0x%x", hdev->name, status);
 872
 873         hci_req_complete(hdev, HCI_OP_SET_EVENT_FLT, status);
 874 }
 875
 876 static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
 877 {
 878         struct hci_rp_pin_code_reply *rp = (void *) skb->data;
 879         struct hci_cp_pin_code_reply *cp;
 880         struct hci_conn *conn;
 881
 882         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 883
 884         hci_dev_lock(hdev);
 885
 886         if (test_bit(HCI_MGMT, &hdev->flags))
 887                 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
 888
 889         if (rp->status != 0)
 890                 goto unlock;
 891
 892         cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
 893         if (!cp)
 894                 goto unlock;
 895
 896         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 897         if (conn)
 898                 conn->pin_length = cp->pin_len;
 899
 900 unlock:
 901         hci_dev_unlock(hdev);
 902 }
 903
 904 static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
 905 {
 906         struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
 907
 908         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 909
 910         hci_dev_lock(hdev);
 911
 912         if (test_bit(HCI_MGMT, &hdev->flags))
 913                 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
 914                                                                 rp->status);
 915
 916         hci_dev_unlock(hdev);
 917 }
 918
 919 static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
 920                                        struct sk_buff *skb)
 921 {
 922         struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
 923
 924         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 925
 926         if (rp->status)
 927                 return;
 928
 929         hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
 930         hdev->le_pkts = rp->le_max_pkt;
 931
 932         hdev->le_cnt = hdev->le_pkts;
 933
 934         BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
 935
 936         hci_req_complete(hdev, HCI_OP_LE_READ_BUFFER_SIZE, rp->status);
 937 }
 938
 939 static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
 940 {
 941         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 942
 943         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 944
 945         hci_dev_lock(hdev);
 946
 947         if (test_bit(HCI_MGMT, &hdev->flags))
 948                 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr,
 949                                                                 rp->status);
 950
 951         hci_dev_unlock(hdev);
 952 }
 953
 954 static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
 955                                                         struct sk_buff *skb)
 956 {
 957         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 958
 959         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 960
 961         hci_dev_lock(hdev);
 962
 963         if (test_bit(HCI_MGMT, &hdev->flags))
 964                 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
 965                                                                 rp->status);
 966
 967         hci_dev_unlock(hdev);
 968 }
 969
 970 static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
 971 {
 972         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 973
 974         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 975
 976         hci_dev_lock(hdev);
 977
 978         if (test_bit(HCI_MGMT, &hdev->flags))
 979                 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr,
 980                                                                 rp->status);
 981
 982         hci_dev_unlock(hdev);
 983 }
 984
 985 static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
 986                                                         struct sk_buff *skb)
 987 {
 988         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 989
 990         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 991
 992         hci_dev_lock(hdev);
 993
 994         if (test_bit(HCI_MGMT, &hdev->flags))
 995                 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
 996                                                                 rp->status);
 997
 998         hci_dev_unlock(hdev);
 999 }
1000
1001 static void hci_cc_read_local_oob_data_reply(struct hci_dev *hdev,
1002                                                         struct sk_buff *skb)
1003 {
1004         struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
1005
1006         BT_DBG("%s status 0x%x", hdev->name, rp->status);
1007
1008         hci_dev_lock(hdev);
1009         mgmt_read_local_oob_data_reply_complete(hdev, rp->hash,
1010                                                 rp->randomizer, rp->status);
1011         hci_dev_unlock(hdev);
1012 }
1013
1014 static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
1015 {
1016         __u8 status = *((__u8 *) skb->data);
1017
1018         BT_DBG("%s status 0x%x", hdev->name, status);
1019 }
1020
1021 static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
1022                                         struct sk_buff *skb)
1023 {
1024         struct hci_cp_le_set_scan_enable *cp;
1025         __u8 status = *((__u8 *) skb->data);
1026
1027         BT_DBG("%s status 0x%x", hdev->name, status);
1028
1029         if (status)
1030                 return;
1031
1032         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
1033         if (!cp)
1034                 return;
1035
1036         if (cp->enable == 0x01) {
1037                 set_bit(HCI_LE_SCAN, &hdev->dev_flags);
1038
1039                 cancel_delayed_work_sync(&hdev->adv_work);
1040
1041                 hci_dev_lock(hdev);
1042                 hci_adv_entries_clear(hdev);
1043                 hci_dev_unlock(hdev);
1044         } else if (cp->enable == 0x00) {
1045                 clear_bit(HCI_LE_SCAN, &hdev->dev_flags);
1046
1047                 cancel_delayed_work_sync(&hdev->adv_work);
1048                 queue_delayed_work(hdev->workqueue, &hdev->adv_work,
1049                                                  jiffies + ADV_CLEAR_TIMEOUT);
1050         }
1051 }
1052
1053 static void hci_cc_le_ltk_reply(struct hci_dev *hdev, struct sk_buff *skb)
1054 {
1055         struct hci_rp_le_ltk_reply *rp = (void *) skb->data;
1056
1057         BT_DBG("%s status 0x%x", hdev->name, rp->status);
1058
1059         if (rp->status)
1060                 return;
1061
1062         hci_req_complete(hdev, HCI_OP_LE_LTK_REPLY, rp->status);
1063 }
1064
1065 static void hci_cc_le_ltk_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
1066 {
1067         struct hci_rp_le_ltk_neg_reply *rp = (void *) skb->data;
1068
1069         BT_DBG("%s status 0x%x", hdev->name, rp->status);
1070
1071         if (rp->status)
1072                 return;
1073
1074         hci_req_complete(hdev, HCI_OP_LE_LTK_NEG_REPLY, rp->status);
1075 }
1076
1077 static inline void hci_cc_write_le_host_supported(struct hci_dev *hdev,
1078                                                         struct sk_buff *skb)
1079 {
1080         struct hci_cp_read_local_ext_features cp;
1081         __u8 status = *((__u8 *) skb->data);
1082
1083         BT_DBG("%s status 0x%x", hdev->name, status);
1084
1085         if (status)
1086                 return;
1087
1088         cp.page = 0x01;
1089         hci_send_cmd(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES, sizeof(cp), &cp);
1090 }
1091
1092 static inline void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
1093 {
1094         BT_DBG("%s status 0x%x", hdev->name, status);
1095
1096         if (status) {
1097                 hci_req_complete(hdev, HCI_OP_INQUIRY, status);
1098                 hci_conn_check_pending(hdev);
1099                 hci_dev_lock(hdev);
1100                 if (test_bit(HCI_MGMT, &hdev->flags))
1101                         mgmt_start_discovery_failed(hdev, status);
1102                 hci_dev_unlock(hdev);
1103                 return;
1104         }
1105
1106         set_bit(HCI_INQUIRY, &hdev->flags);
1107
1108         hci_dev_lock(hdev);
1109         mgmt_discovering(hdev, 1);
1110         hci_dev_unlock(hdev);
1111 }
1112
1113 static inline void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
1114 {
1115         struct hci_cp_create_conn *cp;
1116         struct hci_conn *conn;
1117
1118         BT_DBG("%s status 0x%x", hdev->name, status);
1119
1120         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
1121         if (!cp)
1122                 return;
1123
1124         hci_dev_lock(hdev);
1125
1126         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1127
1128         BT_DBG("%s bdaddr %s conn %p", hdev->name, batostr(&cp->bdaddr), conn);
1129
1130         if (status) {
1131                 if (conn && conn->state == BT_CONNECT) {
1132                         if (status != 0x0c || conn->attempt > 2) {
1133                                 conn->state = BT_CLOSED;
1134                                 hci_proto_connect_cfm(conn, status);
1135                                 hci_conn_del(conn);
1136                         } else
1137                                 conn->state = BT_CONNECT2;
1138                 }
1139         } else {
1140                 if (!conn) {
1141                         conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr);
1142                         if (conn) {
1143                                 conn->out = 1;
1144                                 conn->link_mode |= HCI_LM_MASTER;
1145                         } else
1146                                 BT_ERR("No memory for new connection");
1147                 }
1148         }
1149
1150         hci_dev_unlock(hdev);
1151 }
1152
1153 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
1154 {
1155         struct hci_cp_add_sco *cp;
1156         struct hci_conn *acl, *sco;
1157         __u16 handle;
1158
1159         BT_DBG("%s status 0x%x", hdev->name, status);
1160
1161         if (!status)
1162                 return;
1163
1164         cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
1165         if (!cp)
1166                 return;
1167
1168         handle = __le16_to_cpu(cp->handle);
1169
1170         BT_DBG("%s handle %d", hdev->name, handle);
1171
1172         hci_dev_lock(hdev);
1173
1174         acl = hci_conn_hash_lookup_handle(hdev, handle);
1175         if (acl) {
1176                 sco = acl->link;
1177                 if (sco) {
1178                         sco->state = BT_CLOSED;
1179
1180                         hci_proto_connect_cfm(sco, status);
1181                         hci_conn_del(sco);
1182                 }
1183         }
1184
1185         hci_dev_unlock(hdev);
1186 }
1187
1188 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
1189 {
1190         struct hci_cp_auth_requested *cp;
1191         struct hci_conn *conn;
1192
1193         BT_DBG("%s status 0x%x", hdev->name, status);
1194
1195         if (!status)
1196                 return;
1197
1198         cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
1199         if (!cp)
1200                 return;
1201
1202         hci_dev_lock(hdev);
1203
1204         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1205         if (conn) {
1206                 if (conn->state == BT_CONFIG) {
1207                         hci_proto_connect_cfm(conn, status);
1208                         hci_conn_put(conn);
1209                 }
1210         }
1211
1212         hci_dev_unlock(hdev);
1213 }
1214
1215 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
1216 {
1217         struct hci_cp_set_conn_encrypt *cp;
1218         struct hci_conn *conn;
1219
1220         BT_DBG("%s status 0x%x", hdev->name, status);
1221
1222         if (!status)
1223                 return;
1224
1225         cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
1226         if (!cp)
1227                 return;
1228
1229         hci_dev_lock(hdev);
1230
1231         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1232         if (conn) {
1233                 if (conn->state == BT_CONFIG) {
1234                         hci_proto_connect_cfm(conn, status);
1235                         hci_conn_put(conn);
1236                 }
1237         }
1238
1239         hci_dev_unlock(hdev);
1240 }
1241
1242 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
1243                                                         struct hci_conn *conn)
1244 {
1245         if (conn->state != BT_CONFIG || !conn->out)
1246                 return 0;
1247
1248         if (conn->pending_sec_level == BT_SECURITY_SDP)
1249                 return 0;
1250
1251         /* Only request authentication for SSP connections or non-SSP
1252          * devices with sec_level HIGH or if MITM protection is requested */
1253         if (!(hdev->ssp_mode > 0 && conn->ssp_mode > 0) &&
1254                                 conn->pending_sec_level != BT_SECURITY_HIGH &&
1255                                 !(conn->auth_type & 0x01))
1256                 return 0;
1257
1258         return 1;
1259 }
1260
1261 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
1262 {
1263         struct hci_cp_remote_name_req *cp;
1264         struct hci_conn *conn;
1265
1266         BT_DBG("%s status 0x%x", hdev->name, status);
1267
1268         /* If successful wait for the name req complete event before
1269          * checking for the need to do authentication */
1270         if (!status)
1271                 return;
1272
1273         cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
1274         if (!cp)
1275                 return;
1276
1277         hci_dev_lock(hdev);
1278
1279         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1280         if (!conn)
1281                 goto unlock;
1282
1283         if (!hci_outgoing_auth_needed(hdev, conn))
1284                 goto unlock;
1285
1286         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
1287                 struct hci_cp_auth_requested cp;
1288                 cp.handle = __cpu_to_le16(conn->handle);
1289                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
1290         }
1291
1292 unlock:
1293         hci_dev_unlock(hdev);
1294 }
1295
1296 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
1297 {
1298         struct hci_cp_read_remote_features *cp;
1299         struct hci_conn *conn;
1300
1301         BT_DBG("%s status 0x%x", hdev->name, status);
1302
1303         if (!status)
1304                 return;
1305
1306         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
1307         if (!cp)
1308                 return;
1309
1310         hci_dev_lock(hdev);
1311
1312         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1313         if (conn) {
1314                 if (conn->state == BT_CONFIG) {
1315                         hci_proto_connect_cfm(conn, status);
1316                         hci_conn_put(conn);
1317                 }
1318         }
1319
1320         hci_dev_unlock(hdev);
1321 }
1322
1323 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
1324 {
1325         struct hci_cp_read_remote_ext_features *cp;
1326         struct hci_conn *conn;
1327
1328         BT_DBG("%s status 0x%x", hdev->name, status);
1329
1330         if (!status)
1331                 return;
1332
1333         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
1334         if (!cp)
1335                 return;
1336
1337         hci_dev_lock(hdev);
1338
1339         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1340         if (conn) {
1341                 if (conn->state == BT_CONFIG) {
1342                         hci_proto_connect_cfm(conn, status);
1343                         hci_conn_put(conn);
1344                 }
1345         }
1346
1347         hci_dev_unlock(hdev);
1348 }
1349
1350 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
1351 {
1352         struct hci_cp_setup_sync_conn *cp;
1353         struct hci_conn *acl, *sco;
1354         __u16 handle;
1355
1356         BT_DBG("%s status 0x%x", hdev->name, status);
1357
1358         if (!status)
1359                 return;
1360
1361         cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
1362         if (!cp)
1363                 return;
1364
1365         handle = __le16_to_cpu(cp->handle);
1366
1367         BT_DBG("%s handle %d", hdev->name, handle);
1368
1369         hci_dev_lock(hdev);
1370
1371         acl = hci_conn_hash_lookup_handle(hdev, handle);
1372         if (acl) {
1373                 sco = acl->link;
1374                 if (sco) {
1375                         sco->state = BT_CLOSED;
1376
1377                         hci_proto_connect_cfm(sco, status);
1378                         hci_conn_del(sco);
1379                 }
1380         }
1381
1382         hci_dev_unlock(hdev);
1383 }
1384
1385 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
1386 {
1387         struct hci_cp_sniff_mode *cp;
1388         struct hci_conn *conn;
1389
1390         BT_DBG("%s status 0x%x", hdev->name, status);
1391
1392         if (!status)
1393                 return;
1394
1395         cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
1396         if (!cp)
1397                 return;
1398
1399         hci_dev_lock(hdev);
1400
1401         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1402         if (conn) {
1403                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend);
1404
1405                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->pend))
1406                         hci_sco_setup(conn, status);
1407         }
1408
1409         hci_dev_unlock(hdev);
1410 }
1411
1412 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
1413 {
1414         struct hci_cp_exit_sniff_mode *cp;
1415         struct hci_conn *conn;
1416
1417         BT_DBG("%s status 0x%x", hdev->name, status);
1418
1419         if (!status)
1420                 return;
1421
1422         cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
1423         if (!cp)
1424                 return;
1425
1426         hci_dev_lock(hdev);
1427
1428         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1429         if (conn) {
1430                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend);
1431
1432                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->pend))
1433                         hci_sco_setup(conn, status);
1434         }
1435
1436         hci_dev_unlock(hdev);
1437 }
1438
1439 static void hci_cs_le_create_conn(struct hci_dev *hdev, __u8 status)
1440 {
1441         struct hci_cp_le_create_conn *cp;
1442         struct hci_conn *conn;
1443
1444         BT_DBG("%s status 0x%x", hdev->name, status);
1445
1446         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
1447         if (!cp)
1448                 return;
1449
1450         hci_dev_lock(hdev);
1451
1452         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->peer_addr);
1453
1454         BT_DBG("%s bdaddr %s conn %p", hdev->name, batostr(&cp->peer_addr),
1455                 conn);
1456
1457         if (status) {
1458                 if (conn && conn->state == BT_CONNECT) {
1459                         conn->state = BT_CLOSED;
1460                         hci_proto_connect_cfm(conn, status);
1461                         hci_conn_del(conn);
1462                 }
1463         } else {
1464                 if (!conn) {
1465                         conn = hci_conn_add(hdev, LE_LINK, &cp->peer_addr);
1466                         if (conn) {
1467                                 conn->dst_type = cp->peer_addr_type;
1468                                 conn->out = 1;
1469                         } else {
1470                                 BT_ERR("No memory for new connection");
1471                         }
1472                 }
1473         }
1474
1475         hci_dev_unlock(hdev);
1476 }
1477
1478 static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
1479 {
1480         BT_DBG("%s status 0x%x", hdev->name, status);
1481 }
1482
1483 static inline void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1484 {
1485         __u8 status = *((__u8 *) skb->data);
1486
1487         BT_DBG("%s status %d", hdev->name, status);
1488
1489         hci_req_complete(hdev, HCI_OP_INQUIRY, status);
1490
1491         hci_conn_check_pending(hdev);
1492
1493         if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
1494                 return;
1495
1496         hci_dev_lock(hdev);
1497         mgmt_discovering(hdev, 0);
1498         hci_dev_unlock(hdev);
1499 }
1500
1501 static inline void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
1502 {
1503         struct inquiry_data data;
1504         struct inquiry_info *info = (void *) (skb->data + 1);
1505         int num_rsp = *((__u8 *) skb->data);
1506
1507         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
1508
1509         if (!num_rsp)
1510                 return;
1511
1512         hci_dev_lock(hdev);
1513
1514         for (; num_rsp; num_rsp--, info++) {
1515                 bacpy(&data.bdaddr, &info->bdaddr);
1516                 data.pscan_rep_mode     = info->pscan_rep_mode;
1517                 data.pscan_period_mode  = info->pscan_period_mode;
1518                 data.pscan_mode         = info->pscan_mode;
1519                 memcpy(data.dev_class, info->dev_class, 3);
1520                 data.clock_offset       = info->clock_offset;
1521                 data.rssi               = 0x00;
1522                 data.ssp_mode           = 0x00;
1523                 hci_inquiry_cache_update(hdev, &data);
1524                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
1525                                                 info->dev_class, 0, NULL);
1526         }
1527
1528         hci_dev_unlock(hdev);
1529 }
1530
1531 static inline void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1532 {
1533         struct hci_ev_conn_complete *ev = (void *) skb->data;
1534         struct hci_conn *conn;
1535
1536         BT_DBG("%s", hdev->name);
1537
1538         hci_dev_lock(hdev);
1539
1540         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
1541         if (!conn) {
1542                 if (ev->link_type != SCO_LINK)
1543                         goto unlock;
1544
1545                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
1546                 if (!conn)
1547                         goto unlock;
1548
1549                 conn->type = SCO_LINK;
1550         }
1551
1552         if (!ev->status) {
1553                 conn->handle = __le16_to_cpu(ev->handle);
1554
1555                 if (conn->type == ACL_LINK) {
1556                         conn->state = BT_CONFIG;
1557                         hci_conn_hold(conn);
1558                         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
1559                         mgmt_connected(hdev, &ev->bdaddr, conn->type,
1560                                                         conn->dst_type);
1561                 } else
1562                         conn->state = BT_CONNECTED;
1563
1564                 hci_conn_hold_device(conn);
1565                 hci_conn_add_sysfs(conn);
1566
1567                 if (test_bit(HCI_AUTH, &hdev->flags))
1568                         conn->link_mode |= HCI_LM_AUTH;
1569
1570                 if (test_bit(HCI_ENCRYPT, &hdev->flags))
1571                         conn->link_mode |= HCI_LM_ENCRYPT;
1572
1573                 /* Get remote features */
1574                 if (conn->type == ACL_LINK) {
1575                         struct hci_cp_read_remote_features cp;
1576                         cp.handle = ev->handle;
1577                         hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
1578                                                         sizeof(cp), &cp);
1579                 }
1580
1581                 /* Set packet type for incoming connection */
1582                 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
1583                         struct hci_cp_change_conn_ptype cp;
1584                         cp.handle = ev->handle;
1585                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
1586                         hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE,
1587                                                         sizeof(cp), &cp);
1588                 }
1589         } else {
1590                 conn->state = BT_CLOSED;
1591                 if (conn->type == ACL_LINK)
1592                         mgmt_connect_failed(hdev, &ev->bdaddr, conn->type,
1593                                                 conn->dst_type, ev->status);
1594         }
1595
1596         if (conn->type == ACL_LINK)
1597                 hci_sco_setup(conn, ev->status);
1598
1599         if (ev->status) {
1600                 hci_proto_connect_cfm(conn, ev->status);
1601                 hci_conn_del(conn);
1602         } else if (ev->link_type != ACL_LINK)
1603                 hci_proto_connect_cfm(conn, ev->status);
1604
1605 unlock:
1606         hci_dev_unlock(hdev);
1607
1608         hci_conn_check_pending(hdev);
1609 }
1610
1611 static inline void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
1612 {
1613         struct hci_ev_conn_request *ev = (void *) skb->data;
1614         int mask = hdev->link_mode;
1615
1616         BT_DBG("%s bdaddr %s type 0x%x", hdev->name,
1617                                         batostr(&ev->bdaddr), ev->link_type);
1618
1619         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type);
1620
1621         if ((mask & HCI_LM_ACCEPT) &&
1622                         !hci_blacklist_lookup(hdev, &ev->bdaddr)) {
1623                 /* Connection accepted */
1624                 struct inquiry_entry *ie;
1625                 struct hci_conn *conn;
1626
1627                 hci_dev_lock(hdev);
1628
1629                 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
1630                 if (ie)
1631                         memcpy(ie->data.dev_class, ev->dev_class, 3);
1632
1633                 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
1634                 if (!conn) {
1635                         conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr);
1636                         if (!conn) {
1637                                 BT_ERR("No memory for new connection");
1638                                 hci_dev_unlock(hdev);
1639                                 return;
1640                         }
1641                 }
1642
1643                 memcpy(conn->dev_class, ev->dev_class, 3);
1644                 conn->state = BT_CONNECT;
1645
1646                 hci_dev_unlock(hdev);
1647
1648                 if (ev->link_type == ACL_LINK || !lmp_esco_capable(hdev)) {
1649                         struct hci_cp_accept_conn_req cp;
1650
1651                         bacpy(&cp.bdaddr, &ev->bdaddr);
1652
1653                         if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
1654                                 cp.role = 0x00; /* Become master */
1655                         else
1656                                 cp.role = 0x01; /* Remain slave */
1657
1658                         hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ,
1659                                                         sizeof(cp), &cp);
1660                 } else {
1661                         struct hci_cp_accept_sync_conn_req cp;
1662
1663                         bacpy(&cp.bdaddr, &ev->bdaddr);
1664                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
1665
1666                         cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
1667                         cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
1668                         cp.max_latency    = cpu_to_le16(0xffff);
1669                         cp.content_format = cpu_to_le16(hdev->voice_setting);
1670                         cp.retrans_effort = 0xff;
1671
1672                         hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ,
1673                                                         sizeof(cp), &cp);
1674                 }
1675         } else {
1676                 /* Connection rejected */
1677                 struct hci_cp_reject_conn_req cp;
1678
1679                 bacpy(&cp.bdaddr, &ev->bdaddr);
1680                 cp.reason = HCI_ERROR_REJ_BAD_ADDR;
1681                 hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
1682         }
1683 }
1684
1685 static inline void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1686 {
1687         struct hci_ev_disconn_complete *ev = (void *) skb->data;
1688         struct hci_conn *conn;
1689
1690         BT_DBG("%s status %d", hdev->name, ev->status);
1691
1692         hci_dev_lock(hdev);
1693
1694         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1695         if (!conn)
1696                 goto unlock;
1697
1698         if (ev->status == 0)
1699                 conn->state = BT_CLOSED;
1700
1701         if (conn->type == ACL_LINK || conn->type == LE_LINK) {
1702                 if (ev->status != 0)
1703                         mgmt_disconnect_failed(hdev, &conn->dst, ev->status);
1704                 else
1705                         mgmt_disconnected(hdev, &conn->dst, conn->type,
1706                                                         conn->dst_type);
1707         }
1708
1709         if (ev->status == 0) {
1710                 hci_proto_disconn_cfm(conn, ev->reason);
1711                 hci_conn_del(conn);
1712         }
1713
1714 unlock:
1715         hci_dev_unlock(hdev);
1716 }
1717
1718 static inline void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1719 {
1720         struct hci_ev_auth_complete *ev = (void *) skb->data;
1721         struct hci_conn *conn;
1722
1723         BT_DBG("%s status %d", hdev->name, ev->status);
1724
1725         hci_dev_lock(hdev);
1726
1727         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1728         if (!conn)
1729                 goto unlock;
1730
1731         if (!ev->status) {
1732                 if (!(conn->ssp_mode > 0 && hdev->ssp_mode > 0) &&
1733                                 test_bit(HCI_CONN_REAUTH_PEND,  &conn->pend)) {
1734                         BT_INFO("re-auth of legacy device is not possible.");
1735                 } else {
1736                         conn->link_mode |= HCI_LM_AUTH;
1737                         conn->sec_level = conn->pending_sec_level;
1738                 }
1739         } else {
1740                 mgmt_auth_failed(hdev, &conn->dst, ev->status);
1741         }
1742
1743         clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
1744         clear_bit(HCI_CONN_REAUTH_PEND, &conn->pend);
1745
1746         if (conn->state == BT_CONFIG) {
1747                 if (!ev->status && hdev->ssp_mode > 0 && conn->ssp_mode > 0) {
1748                         struct hci_cp_set_conn_encrypt cp;
1749                         cp.handle  = ev->handle;
1750                         cp.encrypt = 0x01;
1751                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
1752                                                                         &cp);
1753                 } else {
1754                         conn->state = BT_CONNECTED;
1755                         hci_proto_connect_cfm(conn, ev->status);
1756                         hci_conn_put(conn);
1757                 }
1758         } else {
1759                 hci_auth_cfm(conn, ev->status);
1760
1761                 hci_conn_hold(conn);
1762                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
1763                 hci_conn_put(conn);
1764         }
1765
1766         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend)) {
1767                 if (!ev->status) {
1768                         struct hci_cp_set_conn_encrypt cp;
1769                         cp.handle  = ev->handle;
1770                         cp.encrypt = 0x01;
1771                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
1772                                                                         &cp);
1773                 } else {
1774                         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
1775                         hci_encrypt_cfm(conn, ev->status, 0x00);
1776                 }
1777         }
1778
1779 unlock:
1780         hci_dev_unlock(hdev);
1781 }
1782
1783 static inline void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
1784 {
1785         struct hci_ev_remote_name *ev = (void *) skb->data;
1786         struct hci_conn *conn;
1787
1788         BT_DBG("%s", hdev->name);
1789
1790         hci_conn_check_pending(hdev);
1791
1792         hci_dev_lock(hdev);
1793
1794         if (ev->status == 0 && test_bit(HCI_MGMT, &hdev->flags))
1795                 mgmt_remote_name(hdev, &ev->bdaddr, ev->name);
1796
1797         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
1798         if (!conn)
1799                 goto unlock;
1800
1801         if (!hci_outgoing_auth_needed(hdev, conn))
1802                 goto unlock;
1803
1804         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
1805                 struct hci_cp_auth_requested cp;
1806                 cp.handle = __cpu_to_le16(conn->handle);
1807                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
1808         }
1809
1810 unlock:
1811         hci_dev_unlock(hdev);
1812 }
1813
1814 static inline void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
1815 {
1816         struct hci_ev_encrypt_change *ev = (void *) skb->data;
1817         struct hci_conn *conn;
1818
1819         BT_DBG("%s status %d", hdev->name, ev->status);
1820
1821         hci_dev_lock(hdev);
1822
1823         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1824         if (conn) {
1825                 if (!ev->status) {
1826                         if (ev->encrypt) {
1827                                 /* Encryption implies authentication */
1828                                 conn->link_mode |= HCI_LM_AUTH;
1829                                 conn->link_mode |= HCI_LM_ENCRYPT;
1830                                 conn->sec_level = conn->pending_sec_level;
1831                         } else
1832                                 conn->link_mode &= ~HCI_LM_ENCRYPT;
1833                 }
1834
1835                 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
1836
1837                 if (conn->state == BT_CONFIG) {
1838                         if (!ev->status)
1839                                 conn->state = BT_CONNECTED;
1840
1841                         hci_proto_connect_cfm(conn, ev->status);
1842                         hci_conn_put(conn);
1843                 } else
1844                         hci_encrypt_cfm(conn, ev->status, ev->encrypt);
1845         }
1846
1847         hci_dev_unlock(hdev);
1848 }
1849
1850 static inline void hci_change_link_key_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1851 {
1852         struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
1853         struct hci_conn *conn;
1854
1855         BT_DBG("%s status %d", hdev->name, ev->status);
1856
1857         hci_dev_lock(hdev);
1858
1859         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1860         if (conn) {
1861                 if (!ev->status)
1862                         conn->link_mode |= HCI_LM_SECURE;
1863
1864                 clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
1865
1866                 hci_key_change_cfm(conn, ev->status);
1867         }
1868
1869         hci_dev_unlock(hdev);
1870 }
1871
1872 static inline void hci_remote_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
1873 {
1874         struct hci_ev_remote_features *ev = (void *) skb->data;
1875         struct hci_conn *conn;
1876
1877         BT_DBG("%s status %d", hdev->name, ev->status);
1878
1879         hci_dev_lock(hdev);
1880
1881         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1882         if (!conn)
1883                 goto unlock;
1884
1885         if (!ev->status)
1886                 memcpy(conn->features, ev->features, 8);
1887
1888         if (conn->state != BT_CONFIG)
1889                 goto unlock;
1890
1891         if (!ev->status && lmp_ssp_capable(hdev) && lmp_ssp_capable(conn)) {
1892                 struct hci_cp_read_remote_ext_features cp;
1893                 cp.handle = ev->handle;
1894                 cp.page = 0x01;
1895                 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
1896                                                         sizeof(cp), &cp);
1897                 goto unlock;
1898         }
1899
1900         if (!ev->status) {
1901                 struct hci_cp_remote_name_req cp;
1902                 memset(&cp, 0, sizeof(cp));
1903                 bacpy(&cp.bdaddr, &conn->dst);
1904                 cp.pscan_rep_mode = 0x02;
1905                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1906         }
1907
1908         if (!hci_outgoing_auth_needed(hdev, conn)) {
1909                 conn->state = BT_CONNECTED;
1910                 hci_proto_connect_cfm(conn, ev->status);
1911                 hci_conn_put(conn);
1912         }
1913
1914 unlock:
1915         hci_dev_unlock(hdev);
1916 }
1917
1918 static inline void hci_remote_version_evt(struct hci_dev *hdev, struct sk_buff *skb)
1919 {
1920         BT_DBG("%s", hdev->name);
1921 }
1922
1923 static inline void hci_qos_setup_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1924 {
1925         BT_DBG("%s", hdev->name);
1926 }
1927
1928 static inline void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1929 {
1930         struct hci_ev_cmd_complete *ev = (void *) skb->data;
1931         __u16 opcode;
1932
1933         skb_pull(skb, sizeof(*ev));
1934
1935         opcode = __le16_to_cpu(ev->opcode);
1936
1937         switch (opcode) {
1938         case HCI_OP_INQUIRY_CANCEL:
1939                 hci_cc_inquiry_cancel(hdev, skb);
1940                 break;
1941
1942         case HCI_OP_EXIT_PERIODIC_INQ:
1943                 hci_cc_exit_periodic_inq(hdev, skb);
1944                 break;
1945
1946         case HCI_OP_REMOTE_NAME_REQ_CANCEL:
1947                 hci_cc_remote_name_req_cancel(hdev, skb);
1948                 break;
1949
1950         case HCI_OP_ROLE_DISCOVERY:
1951                 hci_cc_role_discovery(hdev, skb);
1952                 break;
1953
1954         case HCI_OP_READ_LINK_POLICY:
1955                 hci_cc_read_link_policy(hdev, skb);
1956                 break;
1957
1958         case HCI_OP_WRITE_LINK_POLICY:
1959                 hci_cc_write_link_policy(hdev, skb);
1960                 break;
1961
1962         case HCI_OP_READ_DEF_LINK_POLICY:
1963                 hci_cc_read_def_link_policy(hdev, skb);
1964                 break;
1965
1966         case HCI_OP_WRITE_DEF_LINK_POLICY:
1967                 hci_cc_write_def_link_policy(hdev, skb);
1968                 break;
1969
1970         case HCI_OP_RESET:
1971                 hci_cc_reset(hdev, skb);
1972                 break;
1973
1974         case HCI_OP_WRITE_LOCAL_NAME:
1975                 hci_cc_write_local_name(hdev, skb);
1976                 break;
1977
1978         case HCI_OP_READ_LOCAL_NAME:
1979                 hci_cc_read_local_name(hdev, skb);
1980                 break;
1981
1982         case HCI_OP_WRITE_AUTH_ENABLE:
1983                 hci_cc_write_auth_enable(hdev, skb);
1984                 break;
1985
1986         case HCI_OP_WRITE_ENCRYPT_MODE:
1987                 hci_cc_write_encrypt_mode(hdev, skb);
1988                 break;
1989
1990         case HCI_OP_WRITE_SCAN_ENABLE:
1991                 hci_cc_write_scan_enable(hdev, skb);
1992                 break;
1993
1994         case HCI_OP_READ_CLASS_OF_DEV:
1995                 hci_cc_read_class_of_dev(hdev, skb);
1996                 break;
1997
1998         case HCI_OP_WRITE_CLASS_OF_DEV:
1999                 hci_cc_write_class_of_dev(hdev, skb);
2000                 break;
2001
2002         case HCI_OP_READ_VOICE_SETTING:
2003                 hci_cc_read_voice_setting(hdev, skb);
2004                 break;
2005
2006         case HCI_OP_WRITE_VOICE_SETTING:
2007                 hci_cc_write_voice_setting(hdev, skb);
2008                 break;
2009
2010         case HCI_OP_HOST_BUFFER_SIZE:
2011                 hci_cc_host_buffer_size(hdev, skb);
2012                 break;
2013
2014         case HCI_OP_READ_SSP_MODE:
2015                 hci_cc_read_ssp_mode(hdev, skb);
2016                 break;
2017
2018         case HCI_OP_WRITE_SSP_MODE:
2019                 hci_cc_write_ssp_mode(hdev, skb);
2020                 break;
2021
2022         case HCI_OP_READ_LOCAL_VERSION:
2023                 hci_cc_read_local_version(hdev, skb);
2024                 break;
2025
2026         case HCI_OP_READ_LOCAL_COMMANDS:
2027                 hci_cc_read_local_commands(hdev, skb);
2028                 break;
2029
2030         case HCI_OP_READ_LOCAL_FEATURES:
2031                 hci_cc_read_local_features(hdev, skb);
2032                 break;
2033
2034         case HCI_OP_READ_LOCAL_EXT_FEATURES:
2035                 hci_cc_read_local_ext_features(hdev, skb);
2036                 break;
2037
2038         case HCI_OP_READ_BUFFER_SIZE:
2039                 hci_cc_read_buffer_size(hdev, skb);
2040                 break;
2041
2042         case HCI_OP_READ_BD_ADDR:
2043                 hci_cc_read_bd_addr(hdev, skb);
2044                 break;
2045
2046         case HCI_OP_READ_DATA_BLOCK_SIZE:
2047                 hci_cc_read_data_block_size(hdev, skb);
2048                 break;
2049
2050         case HCI_OP_WRITE_CA_TIMEOUT:
2051                 hci_cc_write_ca_timeout(hdev, skb);
2052                 break;
2053
2054         case HCI_OP_READ_FLOW_CONTROL_MODE:
2055                 hci_cc_read_flow_control_mode(hdev, skb);
2056                 break;
2057
2058         case HCI_OP_READ_LOCAL_AMP_INFO:
2059                 hci_cc_read_local_amp_info(hdev, skb);
2060                 break;
2061
2062         case HCI_OP_DELETE_STORED_LINK_KEY:
2063                 hci_cc_delete_stored_link_key(hdev, skb);
2064                 break;
2065
2066         case HCI_OP_SET_EVENT_MASK:
2067                 hci_cc_set_event_mask(hdev, skb);
2068                 break;
2069
2070         case HCI_OP_WRITE_INQUIRY_MODE:
2071                 hci_cc_write_inquiry_mode(hdev, skb);
2072                 break;
2073
2074         case HCI_OP_READ_INQ_RSP_TX_POWER:
2075                 hci_cc_read_inq_rsp_tx_power(hdev, skb);
2076                 break;
2077
2078         case HCI_OP_SET_EVENT_FLT:
2079                 hci_cc_set_event_flt(hdev, skb);
2080                 break;
2081
2082         case HCI_OP_PIN_CODE_REPLY:
2083                 hci_cc_pin_code_reply(hdev, skb);
2084                 break;
2085
2086         case HCI_OP_PIN_CODE_NEG_REPLY:
2087                 hci_cc_pin_code_neg_reply(hdev, skb);
2088                 break;
2089
2090         case HCI_OP_READ_LOCAL_OOB_DATA:
2091                 hci_cc_read_local_oob_data_reply(hdev, skb);
2092                 break;
2093
2094         case HCI_OP_LE_READ_BUFFER_SIZE:
2095                 hci_cc_le_read_buffer_size(hdev, skb);
2096                 break;
2097
2098         case HCI_OP_USER_CONFIRM_REPLY:
2099                 hci_cc_user_confirm_reply(hdev, skb);
2100                 break;
2101
2102         case HCI_OP_USER_CONFIRM_NEG_REPLY:
2103                 hci_cc_user_confirm_neg_reply(hdev, skb);
2104                 break;
2105
2106         case HCI_OP_USER_PASSKEY_REPLY:
2107                 hci_cc_user_passkey_reply(hdev, skb);
2108                 break;
2109
2110         case HCI_OP_USER_PASSKEY_NEG_REPLY:
2111                 hci_cc_user_passkey_neg_reply(hdev, skb);
2112
2113         case HCI_OP_LE_SET_SCAN_PARAM:
2114                 hci_cc_le_set_scan_param(hdev, skb);
2115                 break;
2116
2117         case HCI_OP_LE_SET_SCAN_ENABLE:
2118                 hci_cc_le_set_scan_enable(hdev, skb);
2119                 break;
2120
2121         case HCI_OP_LE_LTK_REPLY:
2122                 hci_cc_le_ltk_reply(hdev, skb);
2123                 break;
2124
2125         case HCI_OP_LE_LTK_NEG_REPLY:
2126                 hci_cc_le_ltk_neg_reply(hdev, skb);
2127                 break;
2128
2129         case HCI_OP_WRITE_LE_HOST_SUPPORTED:
2130                 hci_cc_write_le_host_supported(hdev, skb);
2131                 break;
2132
2133         default:
2134                 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
2135                 break;
2136         }
2137
2138         if (ev->opcode != HCI_OP_NOP)
2139                 del_timer(&hdev->cmd_timer);
2140
2141         if (ev->ncmd) {
2142                 atomic_set(&hdev->cmd_cnt, 1);
2143                 if (!skb_queue_empty(&hdev->cmd_q))
2144                         queue_work(hdev->workqueue, &hdev->cmd_work);
2145         }
2146 }
2147
2148 static inline void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb)
2149 {
2150         struct hci_ev_cmd_status *ev = (void *) skb->data;
2151         __u16 opcode;
2152
2153         skb_pull(skb, sizeof(*ev));
2154
2155         opcode = __le16_to_cpu(ev->opcode);
2156
2157         switch (opcode) {
2158         case HCI_OP_INQUIRY:
2159                 hci_cs_inquiry(hdev, ev->status);
2160                 break;
2161
2162         case HCI_OP_CREATE_CONN:
2163                 hci_cs_create_conn(hdev, ev->status);
2164                 break;
2165
2166         case HCI_OP_ADD_SCO:
2167                 hci_cs_add_sco(hdev, ev->status);
2168                 break;
2169
2170         case HCI_OP_AUTH_REQUESTED:
2171                 hci_cs_auth_requested(hdev, ev->status);
2172                 break;
2173
2174         case HCI_OP_SET_CONN_ENCRYPT:
2175                 hci_cs_set_conn_encrypt(hdev, ev->status);
2176                 break;
2177
2178         case HCI_OP_REMOTE_NAME_REQ:
2179                 hci_cs_remote_name_req(hdev, ev->status);
2180                 break;
2181
2182         case HCI_OP_READ_REMOTE_FEATURES:
2183                 hci_cs_read_remote_features(hdev, ev->status);
2184                 break;
2185
2186         case HCI_OP_READ_REMOTE_EXT_FEATURES:
2187                 hci_cs_read_remote_ext_features(hdev, ev->status);
2188                 break;
2189
2190         case HCI_OP_SETUP_SYNC_CONN:
2191                 hci_cs_setup_sync_conn(hdev, ev->status);
2192                 break;
2193
2194         case HCI_OP_SNIFF_MODE:
2195                 hci_cs_sniff_mode(hdev, ev->status);
2196                 break;
2197
2198         case HCI_OP_EXIT_SNIFF_MODE:
2199                 hci_cs_exit_sniff_mode(hdev, ev->status);
2200                 break;
2201
2202         case HCI_OP_DISCONNECT:
2203                 if (ev->status != 0)
2204                         mgmt_disconnect_failed(hdev, NULL, ev->status);
2205                 break;
2206
2207         case HCI_OP_LE_CREATE_CONN:
2208                 hci_cs_le_create_conn(hdev, ev->status);
2209                 break;
2210
2211         case HCI_OP_LE_START_ENC:
2212                 hci_cs_le_start_enc(hdev, ev->status);
2213                 break;
2214
2215         default:
2216                 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
2217                 break;
2218         }
2219
2220         if (ev->opcode != HCI_OP_NOP)
2221                 del_timer(&hdev->cmd_timer);
2222
2223         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
2224                 atomic_set(&hdev->cmd_cnt, 1);
2225                 if (!skb_queue_empty(&hdev->cmd_q))
2226                         queue_work(hdev->workqueue, &hdev->cmd_work);
2227         }
2228 }
2229
2230 static inline void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2231 {
2232         struct hci_ev_role_change *ev = (void *) skb->data;
2233         struct hci_conn *conn;
2234
2235         BT_DBG("%s status %d", hdev->name, ev->status);
2236
2237         hci_dev_lock(hdev);
2238
2239         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2240         if (conn) {
2241                 if (!ev->status) {
2242                         if (ev->role)
2243                                 conn->link_mode &= ~HCI_LM_MASTER;
2244                         else
2245                                 conn->link_mode |= HCI_LM_MASTER;
2246                 }
2247
2248                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->pend);
2249
2250                 hci_role_switch_cfm(conn, ev->status, ev->role);
2251         }
2252
2253         hci_dev_unlock(hdev);
2254 }
2255
2256 static inline void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
2257 {
2258         struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
2259         __le16 *ptr;
2260         int i;
2261
2262         skb_pull(skb, sizeof(*ev));
2263
2264         BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
2265
2266         if (skb->len < ev->num_hndl * 4) {
2267                 BT_DBG("%s bad parameters", hdev->name);
2268                 return;
2269         }
2270
2271         for (i = 0, ptr = (__le16 *) skb->data; i < ev->num_hndl; i++) {
2272                 struct hci_conn *conn;
2273                 __u16  handle, count;
2274
2275                 handle = get_unaligned_le16(ptr++);
2276                 count  = get_unaligned_le16(ptr++);
2277
2278                 conn = hci_conn_hash_lookup_handle(hdev, handle);
2279                 if (!conn)
2280                         continue;
2281
2282                 conn->sent -= count;
2283
2284                 switch (conn->type) {
2285                 case ACL_LINK:
2286                         hdev->acl_cnt += count;
2287                         if (hdev->acl_cnt > hdev->acl_pkts)
2288                                 hdev->acl_cnt = hdev->acl_pkts;
2289                         break;
2290
2291                 case LE_LINK:
2292                         if (hdev->le_pkts) {
2293                                 hdev->le_cnt += count;
2294                                 if (hdev->le_cnt > hdev->le_pkts)
2295                                         hdev->le_cnt = hdev->le_pkts;
2296                         } else {
2297                                 hdev->acl_cnt += count;
2298                                 if (hdev->acl_cnt > hdev->acl_pkts)
2299                                         hdev->acl_cnt = hdev->acl_pkts;
2300                         }
2301                         break;
2302
2303                 case SCO_LINK:
2304                         hdev->sco_cnt += count;
2305                         if (hdev->sco_cnt > hdev->sco_pkts)
2306                                 hdev->sco_cnt = hdev->sco_pkts;
2307                         break;
2308
2309                 default:
2310                         BT_ERR("Unknown type %d conn %p", conn->type, conn);
2311                         break;
2312                 }
2313         }
2314
2315         queue_work(hdev->workqueue, &hdev->tx_work);
2316 }
2317
2318 static inline void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2319 {
2320         struct hci_ev_mode_change *ev = (void *) skb->data;
2321         struct hci_conn *conn;
2322
2323         BT_DBG("%s status %d", hdev->name, ev->status);
2324
2325         hci_dev_lock(hdev);
2326
2327         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2328         if (conn) {
2329                 conn->mode = ev->mode;
2330                 conn->interval = __le16_to_cpu(ev->interval);
2331
2332                 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
2333                         if (conn->mode == HCI_CM_ACTIVE)
2334                                 conn->power_save = 1;
2335                         else
2336                                 conn->power_save = 0;
2337                 }
2338
2339                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->pend))
2340                         hci_sco_setup(conn, ev->status);
2341         }
2342
2343         hci_dev_unlock(hdev);
2344 }
2345
2346 static inline void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2347 {
2348         struct hci_ev_pin_code_req *ev = (void *) skb->data;
2349         struct hci_conn *conn;
2350
2351         BT_DBG("%s", hdev->name);
2352
2353         hci_dev_lock(hdev);
2354
2355         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2356         if (!conn)
2357                 goto unlock;
2358
2359         if (conn->state == BT_CONNECTED) {
2360                 hci_conn_hold(conn);
2361                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2362                 hci_conn_put(conn);
2363         }
2364
2365         if (!test_bit(HCI_PAIRABLE, &hdev->flags))
2366                 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2367                                         sizeof(ev->bdaddr), &ev->bdaddr);
2368         else if (test_bit(HCI_MGMT, &hdev->flags)) {
2369                 u8 secure;
2370
2371                 if (conn->pending_sec_level == BT_SECURITY_HIGH)
2372                         secure = 1;
2373                 else
2374                         secure = 0;
2375
2376                 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
2377         }
2378
2379 unlock:
2380         hci_dev_unlock(hdev);
2381 }
2382
2383 static inline void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2384 {
2385         struct hci_ev_link_key_req *ev = (void *) skb->data;
2386         struct hci_cp_link_key_reply cp;
2387         struct hci_conn *conn;
2388         struct link_key *key;
2389
2390         BT_DBG("%s", hdev->name);
2391
2392         if (!test_bit(HCI_LINK_KEYS, &hdev->flags))
2393                 return;
2394
2395         hci_dev_lock(hdev);
2396
2397         key = hci_find_link_key(hdev, &ev->bdaddr);
2398         if (!key) {
2399                 BT_DBG("%s link key not found for %s", hdev->name,
2400                                                         batostr(&ev->bdaddr));
2401                 goto not_found;
2402         }
2403
2404         BT_DBG("%s found key type %u for %s", hdev->name, key->type,
2405                                                         batostr(&ev->bdaddr));
2406
2407         if (!test_bit(HCI_DEBUG_KEYS, &hdev->flags) &&
2408                                 key->type == HCI_LK_DEBUG_COMBINATION) {
2409                 BT_DBG("%s ignoring debug key", hdev->name);
2410                 goto not_found;
2411         }
2412
2413         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2414         if (conn) {
2415                 if (key->type == HCI_LK_UNAUTH_COMBINATION &&
2416                                 conn->auth_type != 0xff &&
2417                                 (conn->auth_type & 0x01)) {
2418                         BT_DBG("%s ignoring unauthenticated key", hdev->name);
2419                         goto not_found;
2420                 }
2421
2422                 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
2423                                 conn->pending_sec_level == BT_SECURITY_HIGH) {
2424                         BT_DBG("%s ignoring key unauthenticated for high \
2425                                                         security", hdev->name);
2426                         goto not_found;
2427                 }
2428
2429                 conn->key_type = key->type;
2430                 conn->pin_length = key->pin_len;
2431         }
2432
2433         bacpy(&cp.bdaddr, &ev->bdaddr);
2434         memcpy(cp.link_key, key->val, 16);
2435
2436         hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
2437
2438         hci_dev_unlock(hdev);
2439
2440         return;
2441
2442 not_found:
2443         hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
2444         hci_dev_unlock(hdev);
2445 }
2446
2447 static inline void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
2448 {
2449         struct hci_ev_link_key_notify *ev = (void *) skb->data;
2450         struct hci_conn *conn;
2451         u8 pin_len = 0;
2452
2453         BT_DBG("%s", hdev->name);
2454
2455         hci_dev_lock(hdev);
2456
2457         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2458         if (conn) {
2459                 hci_conn_hold(conn);
2460                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2461                 pin_len = conn->pin_length;
2462
2463                 if (ev->key_type != HCI_LK_CHANGED_COMBINATION)
2464                         conn->key_type = ev->key_type;
2465
2466                 hci_conn_put(conn);
2467         }
2468
2469         if (test_bit(HCI_LINK_KEYS, &hdev->flags))
2470                 hci_add_link_key(hdev, conn, 1, &ev->bdaddr, ev->link_key,
2471                                                         ev->key_type, pin_len);
2472
2473         hci_dev_unlock(hdev);
2474 }
2475
2476 static inline void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
2477 {
2478         struct hci_ev_clock_offset *ev = (void *) skb->data;
2479         struct hci_conn *conn;
2480
2481         BT_DBG("%s status %d", hdev->name, ev->status);
2482
2483         hci_dev_lock(hdev);
2484
2485         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2486         if (conn && !ev->status) {
2487                 struct inquiry_entry *ie;
2488
2489                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
2490                 if (ie) {
2491                         ie->data.clock_offset = ev->clock_offset;
2492                         ie->timestamp = jiffies;
2493                 }
2494         }
2495
2496         hci_dev_unlock(hdev);
2497 }
2498
2499 static inline void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2500 {
2501         struct hci_ev_pkt_type_change *ev = (void *) skb->data;
2502         struct hci_conn *conn;
2503
2504         BT_DBG("%s status %d", hdev->name, ev->status);
2505
2506         hci_dev_lock(hdev);
2507
2508         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2509         if (conn && !ev->status)
2510                 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
2511
2512         hci_dev_unlock(hdev);
2513 }
2514
2515 static inline void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
2516 {
2517         struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
2518         struct inquiry_entry *ie;
2519
2520         BT_DBG("%s", hdev->name);
2521
2522         hci_dev_lock(hdev);
2523
2524         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2525         if (ie) {
2526                 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
2527                 ie->timestamp = jiffies;
2528         }
2529
2530         hci_dev_unlock(hdev);
2531 }
2532
2533 static inline void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, struct sk_buff *skb)
2534 {
2535         struct inquiry_data data;
2536         int num_rsp = *((__u8 *) skb->data);
2537
2538         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2539
2540         if (!num_rsp)
2541                 return;
2542
2543         hci_dev_lock(hdev);
2544
2545         if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
2546                 struct inquiry_info_with_rssi_and_pscan_mode *info;
2547                 info = (void *) (skb->data + 1);
2548
2549                 for (; num_rsp; num_rsp--, info++) {
2550                         bacpy(&data.bdaddr, &info->bdaddr);
2551                         data.pscan_rep_mode     = info->pscan_rep_mode;
2552                         data.pscan_period_mode  = info->pscan_period_mode;
2553                         data.pscan_mode         = info->pscan_mode;
2554                         memcpy(data.dev_class, info->dev_class, 3);
2555                         data.clock_offset       = info->clock_offset;
2556                         data.rssi               = info->rssi;
2557                         data.ssp_mode           = 0x00;
2558                         hci_inquiry_cache_update(hdev, &data);
2559                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2560                                                 info->dev_class, info->rssi,
2561                                                 NULL);
2562                 }
2563         } else {
2564                 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
2565
2566                 for (; num_rsp; num_rsp--, info++) {
2567                         bacpy(&data.bdaddr, &info->bdaddr);
2568                         data.pscan_rep_mode     = info->pscan_rep_mode;
2569                         data.pscan_period_mode  = info->pscan_period_mode;
2570                         data.pscan_mode         = 0x00;
2571                         memcpy(data.dev_class, info->dev_class, 3);
2572                         data.clock_offset       = info->clock_offset;
2573                         data.rssi               = info->rssi;
2574                         data.ssp_mode           = 0x00;
2575                         hci_inquiry_cache_update(hdev, &data);
2576                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2577                                                 info->dev_class, info->rssi,
2578                                                 NULL);
2579                 }
2580         }
2581
2582         hci_dev_unlock(hdev);
2583 }
2584
2585 static inline void hci_remote_ext_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
2586 {
2587         struct hci_ev_remote_ext_features *ev = (void *) skb->data;
2588         struct hci_conn *conn;
2589
2590         BT_DBG("%s", hdev->name);
2591
2592         hci_dev_lock(hdev);
2593
2594         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2595         if (!conn)
2596                 goto unlock;
2597
2598         if (!ev->status && ev->page == 0x01) {
2599                 struct inquiry_entry *ie;
2600
2601                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
2602                 if (ie)
2603                         ie->data.ssp_mode = (ev->features[0] & 0x01);
2604
2605                 conn->ssp_mode = (ev->features[0] & 0x01);
2606         }
2607
2608         if (conn->state != BT_CONFIG)
2609                 goto unlock;
2610
2611         if (!ev->status) {
2612                 struct hci_cp_remote_name_req cp;
2613                 memset(&cp, 0, sizeof(cp));
2614                 bacpy(&cp.bdaddr, &conn->dst);
2615                 cp.pscan_rep_mode = 0x02;
2616                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2617         }
2618
2619         if (!hci_outgoing_auth_needed(hdev, conn)) {
2620                 conn->state = BT_CONNECTED;
2621                 hci_proto_connect_cfm(conn, ev->status);
2622                 hci_conn_put(conn);
2623         }
2624
2625 unlock:
2626         hci_dev_unlock(hdev);
2627 }
2628
2629 static inline void hci_sync_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2630 {
2631         struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
2632         struct hci_conn *conn;
2633
2634         BT_DBG("%s status %d", hdev->name, ev->status);
2635
2636         hci_dev_lock(hdev);
2637
2638         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
2639         if (!conn) {
2640                 if (ev->link_type == ESCO_LINK)
2641                         goto unlock;
2642
2643                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
2644                 if (!conn)
2645                         goto unlock;
2646
2647                 conn->type = SCO_LINK;
2648         }
2649
2650         switch (ev->status) {
2651         case 0x00:
2652                 conn->handle = __le16_to_cpu(ev->handle);
2653                 conn->state  = BT_CONNECTED;
2654
2655                 hci_conn_hold_device(conn);
2656                 hci_conn_add_sysfs(conn);
2657                 break;
2658
2659         case 0x11:      /* Unsupported Feature or Parameter Value */
2660         case 0x1c:      /* SCO interval rejected */
2661         case 0x1a:      /* Unsupported Remote Feature */
2662         case 0x1f:      /* Unspecified error */
2663                 if (conn->out && conn->attempt < 2) {
2664                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
2665                                         (hdev->esco_type & EDR_ESCO_MASK);
2666                         hci_setup_sync(conn, conn->link->handle);
2667                         goto unlock;
2668                 }
2669                 /* fall through */
2670
2671         default:
2672                 conn->state = BT_CLOSED;
2673                 break;
2674         }
2675
2676         hci_proto_connect_cfm(conn, ev->status);
2677         if (ev->status)
2678                 hci_conn_del(conn);
2679
2680 unlock:
2681         hci_dev_unlock(hdev);
2682 }
2683
2684 static inline void hci_sync_conn_changed_evt(struct hci_dev *hdev, struct sk_buff *skb)
2685 {
2686         BT_DBG("%s", hdev->name);
2687 }
2688
2689 static inline void hci_sniff_subrate_evt(struct hci_dev *hdev, struct sk_buff *skb)
2690 {
2691         struct hci_ev_sniff_subrate *ev = (void *) skb->data;
2692
2693         BT_DBG("%s status %d", hdev->name, ev->status);
2694 }
2695
2696 static inline void hci_extended_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
2697 {
2698         struct inquiry_data data;
2699         struct extended_inquiry_info *info = (void *) (skb->data + 1);
2700         int num_rsp = *((__u8 *) skb->data);
2701
2702         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2703
2704         if (!num_rsp)
2705                 return;
2706
2707         hci_dev_lock(hdev);
2708
2709         for (; num_rsp; num_rsp--, info++) {
2710                 bacpy(&data.bdaddr, &info->bdaddr);
2711                 data.pscan_rep_mode     = info->pscan_rep_mode;
2712                 data.pscan_period_mode  = info->pscan_period_mode;
2713                 data.pscan_mode         = 0x00;
2714                 memcpy(data.dev_class, info->dev_class, 3);
2715                 data.clock_offset       = info->clock_offset;
2716                 data.rssi               = info->rssi;
2717                 data.ssp_mode           = 0x01;
2718                 hci_inquiry_cache_update(hdev, &data);
2719                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2720                                 info->dev_class, info->rssi, info->data);
2721         }
2722
2723         hci_dev_unlock(hdev);
2724 }
2725
2726 static inline u8 hci_get_auth_req(struct hci_conn *conn)
2727 {
2728         /* If remote requests dedicated bonding follow that lead */
2729         if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03) {
2730                 /* If both remote and local IO capabilities allow MITM
2731                  * protection then require it, otherwise don't */
2732                 if (conn->remote_cap == 0x03 || conn->io_capability == 0x03)
2733                         return 0x02;
2734                 else
2735                         return 0x03;
2736         }
2737
2738         /* If remote requests no-bonding follow that lead */
2739         if (conn->remote_auth == 0x00 || conn->remote_auth == 0x01)
2740                 return conn->remote_auth | (conn->auth_type & 0x01);
2741
2742         return conn->auth_type;
2743 }
2744
2745 static inline void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2746 {
2747         struct hci_ev_io_capa_request *ev = (void *) skb->data;
2748         struct hci_conn *conn;
2749
2750         BT_DBG("%s", hdev->name);
2751
2752         hci_dev_lock(hdev);
2753
2754         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2755         if (!conn)
2756                 goto unlock;
2757
2758         hci_conn_hold(conn);
2759
2760         if (!test_bit(HCI_MGMT, &hdev->flags))
2761                 goto unlock;
2762
2763         if (test_bit(HCI_PAIRABLE, &hdev->flags) ||
2764                         (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
2765                 struct hci_cp_io_capability_reply cp;
2766
2767                 bacpy(&cp.bdaddr, &ev->bdaddr);
2768                 cp.capability = conn->io_capability;
2769                 conn->auth_type = hci_get_auth_req(conn);
2770                 cp.authentication = conn->auth_type;
2771
2772                 if ((conn->out == 0x01 || conn->remote_oob == 0x01) &&
2773                                 hci_find_remote_oob_data(hdev, &conn->dst))
2774                         cp.oob_data = 0x01;
2775                 else
2776                         cp.oob_data = 0x00;
2777
2778                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
2779                                                         sizeof(cp), &cp);
2780         } else {
2781                 struct hci_cp_io_capability_neg_reply cp;
2782
2783                 bacpy(&cp.bdaddr, &ev->bdaddr);
2784                 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
2785
2786                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
2787                                                         sizeof(cp), &cp);
2788         }
2789
2790 unlock:
2791         hci_dev_unlock(hdev);
2792 }
2793
2794 static inline void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
2795 {
2796         struct hci_ev_io_capa_reply *ev = (void *) skb->data;
2797         struct hci_conn *conn;
2798
2799         BT_DBG("%s", hdev->name);
2800
2801         hci_dev_lock(hdev);
2802
2803         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2804         if (!conn)
2805                 goto unlock;
2806
2807         conn->remote_cap = ev->capability;
2808         conn->remote_oob = ev->oob_data;
2809         conn->remote_auth = ev->authentication;
2810
2811 unlock:
2812         hci_dev_unlock(hdev);
2813 }
2814
2815 static inline void hci_user_confirm_request_evt(struct hci_dev *hdev,
2816                                                         struct sk_buff *skb)
2817 {
2818         struct hci_ev_user_confirm_req *ev = (void *) skb->data;
2819         int loc_mitm, rem_mitm, confirm_hint = 0;
2820         struct hci_conn *conn;
2821
2822         BT_DBG("%s", hdev->name);
2823
2824         hci_dev_lock(hdev);
2825
2826         if (!test_bit(HCI_MGMT, &hdev->flags))
2827                 goto unlock;
2828
2829         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2830         if (!conn)
2831                 goto unlock;
2832
2833         loc_mitm = (conn->auth_type & 0x01);
2834         rem_mitm = (conn->remote_auth & 0x01);
2835
2836         /* If we require MITM but the remote device can't provide that
2837          * (it has NoInputNoOutput) then reject the confirmation
2838          * request. The only exception is when we're dedicated bonding
2839          * initiators (connect_cfm_cb set) since then we always have the MITM
2840          * bit set. */
2841         if (!conn->connect_cfm_cb && loc_mitm && conn->remote_cap == 0x03) {
2842                 BT_DBG("Rejecting request: remote device can't provide MITM");
2843                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
2844                                         sizeof(ev->bdaddr), &ev->bdaddr);
2845                 goto unlock;
2846         }
2847
2848         /* If no side requires MITM protection; auto-accept */
2849         if ((!loc_mitm || conn->remote_cap == 0x03) &&
2850                                 (!rem_mitm || conn->io_capability == 0x03)) {
2851
2852                 /* If we're not the initiators request authorization to
2853                  * proceed from user space (mgmt_user_confirm with
2854                  * confirm_hint set to 1). */
2855                 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
2856                         BT_DBG("Confirming auto-accept as acceptor");
2857                         confirm_hint = 1;
2858                         goto confirm;
2859                 }
2860
2861                 BT_DBG("Auto-accept of user confirmation with %ums delay",
2862                                                 hdev->auto_accept_delay);
2863
2864                 if (hdev->auto_accept_delay > 0) {
2865                         int delay = msecs_to_jiffies(hdev->auto_accept_delay);
2866                         mod_timer(&conn->auto_accept_timer, jiffies + delay);
2867                         goto unlock;
2868                 }
2869
2870                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
2871                                                 sizeof(ev->bdaddr), &ev->bdaddr);
2872                 goto unlock;
2873         }
2874
2875 confirm:
2876         mgmt_user_confirm_request(hdev, &ev->bdaddr, ev->passkey,
2877                                                                 confirm_hint);
2878
2879 unlock:
2880         hci_dev_unlock(hdev);
2881 }
2882
2883 static inline void hci_user_passkey_request_evt(struct hci_dev *hdev,
2884                                                         struct sk_buff *skb)
2885 {
2886         struct hci_ev_user_passkey_req *ev = (void *) skb->data;
2887
2888         BT_DBG("%s", hdev->name);
2889
2890         hci_dev_lock(hdev);
2891
2892         if (test_bit(HCI_MGMT, &hdev->flags))
2893                 mgmt_user_passkey_request(hdev, &ev->bdaddr);
2894
2895         hci_dev_unlock(hdev);
2896 }
2897
2898 static inline void hci_simple_pair_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2899 {
2900         struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
2901         struct hci_conn *conn;
2902
2903         BT_DBG("%s", hdev->name);
2904
2905         hci_dev_lock(hdev);
2906
2907         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2908         if (!conn)
2909                 goto unlock;
2910
2911         /* To avoid duplicate auth_failed events to user space we check
2912          * the HCI_CONN_AUTH_PEND flag which will be set if we
2913          * initiated the authentication. A traditional auth_complete
2914          * event gets always produced as initiator and is also mapped to
2915          * the mgmt_auth_failed event */
2916         if (!test_bit(HCI_CONN_AUTH_PEND, &conn->pend) && ev->status != 0)
2917                 mgmt_auth_failed(hdev, &conn->dst, ev->status);
2918
2919         hci_conn_put(conn);
2920
2921 unlock:
2922         hci_dev_unlock(hdev);
2923 }
2924
2925 static inline void hci_remote_host_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
2926 {
2927         struct hci_ev_remote_host_features *ev = (void *) skb->data;
2928         struct inquiry_entry *ie;
2929
2930         BT_DBG("%s", hdev->name);
2931
2932         hci_dev_lock(hdev);
2933
2934         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2935         if (ie)
2936                 ie->data.ssp_mode = (ev->features[0] & 0x01);
2937
2938         hci_dev_unlock(hdev);
2939 }
2940
2941 static inline void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
2942                                                         struct sk_buff *skb)
2943 {
2944         struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
2945         struct oob_data *data;
2946
2947         BT_DBG("%s", hdev->name);
2948
2949         hci_dev_lock(hdev);
2950
2951         if (!test_bit(HCI_MGMT, &hdev->flags))
2952                 goto unlock;
2953
2954         data = hci_find_remote_oob_data(hdev, &ev->bdaddr);
2955         if (data) {
2956                 struct hci_cp_remote_oob_data_reply cp;
2957
2958                 bacpy(&cp.bdaddr, &ev->bdaddr);
2959                 memcpy(cp.hash, data->hash, sizeof(cp.hash));
2960                 memcpy(cp.randomizer, data->randomizer, sizeof(cp.randomizer));
2961
2962                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY, sizeof(cp),
2963                                                                         &cp);
2964         } else {
2965                 struct hci_cp_remote_oob_data_neg_reply cp;
2966
2967                 bacpy(&cp.bdaddr, &ev->bdaddr);
2968                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY, sizeof(cp),
2969                                                                         &cp);
2970         }
2971
2972 unlock:
2973         hci_dev_unlock(hdev);
2974 }
2975
2976 static inline void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2977 {
2978         struct hci_ev_le_conn_complete *ev = (void *) skb->data;
2979         struct hci_conn *conn;
2980
2981         BT_DBG("%s status %d", hdev->name, ev->status);
2982
2983         hci_dev_lock(hdev);
2984
2985         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &ev->bdaddr);
2986         if (!conn) {
2987                 conn = hci_conn_add(hdev, LE_LINK, &ev->bdaddr);
2988                 if (!conn) {
2989                         BT_ERR("No memory for new connection");
2990                         hci_dev_unlock(hdev);
2991                         return;
2992                 }
2993
2994                 conn->dst_type = ev->bdaddr_type;
2995         }
2996
2997         if (ev->status) {
2998                 mgmt_connect_failed(hdev, &ev->bdaddr, conn->type,
2999                                                 conn->dst_type, ev->status);
3000                 hci_proto_connect_cfm(conn, ev->status);
3001                 conn->state = BT_CLOSED;
3002                 hci_conn_del(conn);
3003                 goto unlock;
3004         }
3005
3006         mgmt_connected(hdev, &ev->bdaddr, conn->type, conn->dst_type);
3007
3008         conn->sec_level = BT_SECURITY_LOW;
3009         conn->handle = __le16_to_cpu(ev->handle);
3010         conn->state = BT_CONNECTED;
3011
3012         hci_conn_hold_device(conn);
3013         hci_conn_add_sysfs(conn);
3014
3015         hci_proto_connect_cfm(conn, ev->status);
3016
3017 unlock:
3018         hci_dev_unlock(hdev);
3019 }
3020
3021 static inline void hci_le_adv_report_evt(struct hci_dev *hdev,
3022                                                 struct sk_buff *skb)
3023 {
3024         u8 num_reports = skb->data[0];
3025         void *ptr = &skb->data[1];
3026
3027         hci_dev_lock(hdev);
3028
3029         while (num_reports--) {
3030                 struct hci_ev_le_advertising_info *ev = ptr;
3031
3032                 hci_add_adv_entry(hdev, ev);
3033
3034                 ptr += sizeof(*ev) + ev->length + 1;
3035         }
3036
3037         hci_dev_unlock(hdev);
3038 }
3039
3040 static inline void hci_le_ltk_request_evt(struct hci_dev *hdev,
3041                                                 struct sk_buff *skb)
3042 {
3043         struct hci_ev_le_ltk_req *ev = (void *) skb->data;
3044         struct hci_cp_le_ltk_reply cp;
3045         struct hci_cp_le_ltk_neg_reply neg;
3046         struct hci_conn *conn;
3047         struct link_key *ltk;
3048
3049         BT_DBG("%s handle %d", hdev->name, cpu_to_le16(ev->handle));
3050
3051         hci_dev_lock(hdev);
3052
3053         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3054         if (conn == NULL)
3055                 goto not_found;
3056
3057         ltk = hci_find_ltk(hdev, ev->ediv, ev->random);
3058         if (ltk == NULL)
3059                 goto not_found;
3060
3061         memcpy(cp.ltk, ltk->val, sizeof(ltk->val));
3062         cp.handle = cpu_to_le16(conn->handle);
3063         conn->pin_length = ltk->pin_len;
3064
3065         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
3066
3067         hci_dev_unlock(hdev);
3068
3069         return;
3070
3071 not_found:
3072         neg.handle = ev->handle;
3073         hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
3074         hci_dev_unlock(hdev);
3075 }
3076
3077 static inline void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
3078 {
3079         struct hci_ev_le_meta *le_ev = (void *) skb->data;
3080
3081         skb_pull(skb, sizeof(*le_ev));
3082
3083         switch (le_ev->subevent) {
3084         case HCI_EV_LE_CONN_COMPLETE:
3085                 hci_le_conn_complete_evt(hdev, skb);
3086                 break;
3087
3088         case HCI_EV_LE_ADVERTISING_REPORT:
3089                 hci_le_adv_report_evt(hdev, skb);
3090                 break;
3091
3092         case HCI_EV_LE_LTK_REQ:
3093                 hci_le_ltk_request_evt(hdev, skb);
3094                 break;
3095
3096         default:
3097                 break;
3098         }
3099 }
3100
3101 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
3102 {
3103         struct hci_event_hdr *hdr = (void *) skb->data;
3104         __u8 event = hdr->evt;
3105
3106         skb_pull(skb, HCI_EVENT_HDR_SIZE);
3107
3108         switch (event) {
3109         case HCI_EV_INQUIRY_COMPLETE:
3110                 hci_inquiry_complete_evt(hdev, skb);
3111                 break;
3112
3113         case HCI_EV_INQUIRY_RESULT:
3114                 hci_inquiry_result_evt(hdev, skb);
3115                 break;
3116
3117         case HCI_EV_CONN_COMPLETE:
3118                 hci_conn_complete_evt(hdev, skb);
3119                 break;
3120
3121         case HCI_EV_CONN_REQUEST:
3122                 hci_conn_request_evt(hdev, skb);
3123                 break;
3124
3125         case HCI_EV_DISCONN_COMPLETE:
3126                 hci_disconn_complete_evt(hdev, skb);
3127                 break;
3128
3129         case HCI_EV_AUTH_COMPLETE:
3130                 hci_auth_complete_evt(hdev, skb);
3131                 break;
3132
3133         case HCI_EV_REMOTE_NAME:
3134                 hci_remote_name_evt(hdev, skb);
3135                 break;
3136
3137         case HCI_EV_ENCRYPT_CHANGE:
3138                 hci_encrypt_change_evt(hdev, skb);
3139                 break;
3140
3141         case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
3142                 hci_change_link_key_complete_evt(hdev, skb);
3143                 break;
3144
3145         case HCI_EV_REMOTE_FEATURES:
3146                 hci_remote_features_evt(hdev, skb);
3147                 break;
3148
3149         case HCI_EV_REMOTE_VERSION:
3150                 hci_remote_version_evt(hdev, skb);
3151                 break;
3152
3153         case HCI_EV_QOS_SETUP_COMPLETE:
3154                 hci_qos_setup_complete_evt(hdev, skb);
3155                 break;
3156
3157         case HCI_EV_CMD_COMPLETE:
3158                 hci_cmd_complete_evt(hdev, skb);
3159                 break;
3160
3161         case HCI_EV_CMD_STATUS:
3162                 hci_cmd_status_evt(hdev, skb);
3163                 break;
3164
3165         case HCI_EV_ROLE_CHANGE:
3166                 hci_role_change_evt(hdev, skb);
3167                 break;
3168
3169         case HCI_EV_NUM_COMP_PKTS:
3170                 hci_num_comp_pkts_evt(hdev, skb);
3171                 break;
3172
3173         case HCI_EV_MODE_CHANGE:
3174                 hci_mode_change_evt(hdev, skb);
3175                 break;
3176
3177         case HCI_EV_PIN_CODE_REQ:
3178                 hci_pin_code_request_evt(hdev, skb);
3179                 break;
3180
3181         case HCI_EV_LINK_KEY_REQ:
3182                 hci_link_key_request_evt(hdev, skb);
3183                 break;
3184
3185         case HCI_EV_LINK_KEY_NOTIFY:
3186                 hci_link_key_notify_evt(hdev, skb);
3187                 break;
3188
3189         case HCI_EV_CLOCK_OFFSET:
3190                 hci_clock_offset_evt(hdev, skb);
3191                 break;
3192
3193         case HCI_EV_PKT_TYPE_CHANGE:
3194                 hci_pkt_type_change_evt(hdev, skb);
3195                 break;
3196
3197         case HCI_EV_PSCAN_REP_MODE:
3198                 hci_pscan_rep_mode_evt(hdev, skb);
3199                 break;
3200
3201         case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
3202                 hci_inquiry_result_with_rssi_evt(hdev, skb);
3203                 break;
3204
3205         case HCI_EV_REMOTE_EXT_FEATURES:
3206                 hci_remote_ext_features_evt(hdev, skb);
3207                 break;
3208
3209         case HCI_EV_SYNC_CONN_COMPLETE:
3210                 hci_sync_conn_complete_evt(hdev, skb);
3211                 break;
3212
3213         case HCI_EV_SYNC_CONN_CHANGED:
3214                 hci_sync_conn_changed_evt(hdev, skb);
3215                 break;
3216
3217         case HCI_EV_SNIFF_SUBRATE:
3218                 hci_sniff_subrate_evt(hdev, skb);
3219                 break;
3220
3221         case HCI_EV_EXTENDED_INQUIRY_RESULT:
3222                 hci_extended_inquiry_result_evt(hdev, skb);
3223                 break;
3224
3225         case HCI_EV_IO_CAPA_REQUEST:
3226                 hci_io_capa_request_evt(hdev, skb);
3227                 break;
3228
3229         case HCI_EV_IO_CAPA_REPLY:
3230                 hci_io_capa_reply_evt(hdev, skb);
3231                 break;
3232
3233         case HCI_EV_USER_CONFIRM_REQUEST:
3234                 hci_user_confirm_request_evt(hdev, skb);
3235                 break;
3236
3237         case HCI_EV_USER_PASSKEY_REQUEST:
3238                 hci_user_passkey_request_evt(hdev, skb);
3239                 break;
3240
3241         case HCI_EV_SIMPLE_PAIR_COMPLETE:
3242                 hci_simple_pair_complete_evt(hdev, skb);
3243                 break;
3244
3245         case HCI_EV_REMOTE_HOST_FEATURES:
3246                 hci_remote_host_features_evt(hdev, skb);
3247                 break;
3248
3249         case HCI_EV_LE_META:
3250                 hci_le_meta_evt(hdev, skb);
3251                 break;
3252
3253         case HCI_EV_REMOTE_OOB_DATA_REQUEST:
3254                 hci_remote_oob_data_request_evt(hdev, skb);
3255                 break;
3256
3257         default:
3258                 BT_DBG("%s event 0x%x", hdev->name, event);
3259                 break;
3260         }
3261
3262         kfree_skb(skb);
3263         hdev->stat.evt_rx++;
3264 }
3265
3266 /* Generate internal stack event */
3267 void hci_si_event(struct hci_dev *hdev, int type, int dlen, void *data)
3268 {
3269         struct hci_event_hdr *hdr;
3270         struct hci_ev_stack_internal *ev;
3271         struct sk_buff *skb;
3272
3273         skb = bt_skb_alloc(HCI_EVENT_HDR_SIZE + sizeof(*ev) + dlen, GFP_ATOMIC);
3274         if (!skb)
3275                 return;
3276
3277         hdr = (void *) skb_put(skb, HCI_EVENT_HDR_SIZE);
3278         hdr->evt  = HCI_EV_STACK_INTERNAL;
3279         hdr->plen = sizeof(*ev) + dlen;
3280
3281         ev  = (void *) skb_put(skb, sizeof(*ev) + dlen);
3282         ev->type = type;
3283         memcpy(ev->data, data, dlen);
3284
3285         bt_cb(skb)->incoming = 1;
3286         __net_timestamp(skb);
3287
3288         bt_cb(skb)->pkt_type = HCI_EVENT_PKT;
3289         skb->dev = (void *) hdev;
3290         hci_send_to_sock(hdev, skb, NULL);
3291         kfree_skb(skb);
3292 }
3293
3294 module_param(enable_le, bool, 0644);
3295 MODULE_PARM_DESC(enable_le, "Enable LE support");