net/bluetooth/hci_event.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI event handling. */
  26
  27 #include <linux/module.h>
  28
  29 #include <linux/types.h>
  30 #include <linux/errno.h>
  31 #include <linux/kernel.h>
  32 #include <linux/slab.h>
  33 #include <linux/poll.h>
  34 #include <linux/fcntl.h>
  35 #include <linux/init.h>
  36 #include <linux/skbuff.h>
  37 #include <linux/interrupt.h>
  38 #include <linux/notifier.h>
  39 #include <net/sock.h>
  40
  41 #include <asm/system.h>
  42 #include <linux/uaccess.h>
  43 #include <asm/unaligned.h>
  44
  45 #include <net/bluetooth/bluetooth.h>
  46 #include <net/bluetooth/hci_core.h>
  47
  48 static int enable_le;
  49
  50 /* Handle HCI Event packets */
  51
  52 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
  53 {
  54         __u8 status = *((__u8 *) skb->data);
  55
  56         BT_DBG("%s status 0x%x", hdev->name, status);
  57
  58         if (status) {
  59                 hci_dev_lock(hdev);
  60                 mgmt_stop_discovery_failed(hdev, status);
  61                 hci_dev_unlock(hdev);
  62                 return;
  63         }
  64
  65         clear_bit(HCI_INQUIRY, &hdev->flags);
  66
  67         hci_dev_lock(hdev);
  68         mgmt_discovering(hdev, 0);
  69         hci_dev_unlock(hdev);
  70
  71         hci_req_complete(hdev, HCI_OP_INQUIRY_CANCEL, status);
  72
  73         hci_conn_check_pending(hdev);
  74 }
  75
  76 static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  77 {
  78         __u8 status = *((__u8 *) skb->data);
  79
  80         BT_DBG("%s status 0x%x", hdev->name, status);
  81
  82         if (status)
  83                 return;
  84
  85         hci_conn_check_pending(hdev);
  86 }
  87
  88 static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev, struct sk_buff *skb)
  89 {
  90         BT_DBG("%s", hdev->name);
  91 }
  92
  93 static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
  94 {
  95         struct hci_rp_role_discovery *rp = (void *) skb->data;
  96         struct hci_conn *conn;
  97
  98         BT_DBG("%s status 0x%x", hdev->name, rp->status);
  99
 100         if (rp->status)
 101                 return;
 102
 103         hci_dev_lock(hdev);
 104
 105         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 106         if (conn) {
 107                 if (rp->role)
 108                         conn->link_mode &= ~HCI_LM_MASTER;
 109                 else
 110                         conn->link_mode |= HCI_LM_MASTER;
 111         }
 112
 113         hci_dev_unlock(hdev);
 114 }
 115
 116 static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 117 {
 118         struct hci_rp_read_link_policy *rp = (void *) skb->data;
 119         struct hci_conn *conn;
 120
 121         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 122
 123         if (rp->status)
 124                 return;
 125
 126         hci_dev_lock(hdev);
 127
 128         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 129         if (conn)
 130                 conn->link_policy = __le16_to_cpu(rp->policy);
 131
 132         hci_dev_unlock(hdev);
 133 }
 134
 135 static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 136 {
 137         struct hci_rp_write_link_policy *rp = (void *) skb->data;
 138         struct hci_conn *conn;
 139         void *sent;
 140
 141         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 142
 143         if (rp->status)
 144                 return;
 145
 146         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
 147         if (!sent)
 148                 return;
 149
 150         hci_dev_lock(hdev);
 151
 152         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 153         if (conn)
 154                 conn->link_policy = get_unaligned_le16(sent + 2);
 155
 156         hci_dev_unlock(hdev);
 157 }
 158
 159 static void hci_cc_read_def_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 160 {
 161         struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
 162
 163         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 164
 165         if (rp->status)
 166                 return;
 167
 168         hdev->link_policy = __le16_to_cpu(rp->policy);
 169 }
 170
 171 static void hci_cc_write_def_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 172 {
 173         __u8 status = *((__u8 *) skb->data);
 174         void *sent;
 175
 176         BT_DBG("%s status 0x%x", hdev->name, status);
 177
 178         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
 179         if (!sent)
 180                 return;
 181
 182         if (!status)
 183                 hdev->link_policy = get_unaligned_le16(sent);
 184
 185         hci_req_complete(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, status);
 186 }
 187
 188 static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
 189 {
 190         __u8 status = *((__u8 *) skb->data);
 191
 192         BT_DBG("%s status 0x%x", hdev->name, status);
 193
 194         clear_bit(HCI_RESET, &hdev->flags);
 195
 196         hci_req_complete(hdev, HCI_OP_RESET, status);
 197
 198         hdev->dev_flags = 0;
 199 }
 200
 201 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 202 {
 203         __u8 status = *((__u8 *) skb->data);
 204         void *sent;
 205
 206         BT_DBG("%s status 0x%x", hdev->name, status);
 207
 208         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
 209         if (!sent)
 210                 return;
 211
 212         hci_dev_lock(hdev);
 213
 214         if (test_bit(HCI_MGMT, &hdev->flags))
 215                 mgmt_set_local_name_complete(hdev, sent, status);
 216
 217         if (status == 0)
 218                 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
 219
 220         hci_dev_unlock(hdev);
 221 }
 222
 223 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 224 {
 225         struct hci_rp_read_local_name *rp = (void *) skb->data;
 226
 227         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 228
 229         if (rp->status)
 230                 return;
 231
 232         memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
 233 }
 234
 235 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
 236 {
 237         __u8 status = *((__u8 *) skb->data);
 238         void *sent;
 239
 240         BT_DBG("%s status 0x%x", hdev->name, status);
 241
 242         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
 243         if (!sent)
 244                 return;
 245
 246         if (!status) {
 247                 __u8 param = *((__u8 *) sent);
 248
 249                 if (param == AUTH_ENABLED)
 250                         set_bit(HCI_AUTH, &hdev->flags);
 251                 else
 252                         clear_bit(HCI_AUTH, &hdev->flags);
 253         }
 254
 255         hci_req_complete(hdev, HCI_OP_WRITE_AUTH_ENABLE, status);
 256 }
 257
 258 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
 259 {
 260         __u8 status = *((__u8 *) skb->data);
 261         void *sent;
 262
 263         BT_DBG("%s status 0x%x", hdev->name, status);
 264
 265         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
 266         if (!sent)
 267                 return;
 268
 269         if (!status) {
 270                 __u8 param = *((__u8 *) sent);
 271
 272                 if (param)
 273                         set_bit(HCI_ENCRYPT, &hdev->flags);
 274                 else
 275                         clear_bit(HCI_ENCRYPT, &hdev->flags);
 276         }
 277
 278         hci_req_complete(hdev, HCI_OP_WRITE_ENCRYPT_MODE, status);
 279 }
 280
 281 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
 282 {
 283         __u8 param, status = *((__u8 *) skb->data);
 284         int old_pscan, old_iscan;
 285         void *sent;
 286
 287         BT_DBG("%s status 0x%x", hdev->name, status);
 288
 289         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
 290         if (!sent)
 291                 return;
 292
 293         param = *((__u8 *) sent);
 294
 295         hci_dev_lock(hdev);
 296
 297         if (status != 0) {
 298                 mgmt_write_scan_failed(hdev, param, status);
 299                 hdev->discov_timeout = 0;
 300                 goto done;
 301         }
 302
 303         old_pscan = test_and_clear_bit(HCI_PSCAN, &hdev->flags);
 304         old_iscan = test_and_clear_bit(HCI_ISCAN, &hdev->flags);
 305
 306         if (param & SCAN_INQUIRY) {
 307                 set_bit(HCI_ISCAN, &hdev->flags);
 308                 if (!old_iscan)
 309                         mgmt_discoverable(hdev, 1);
 310                 if (hdev->discov_timeout > 0) {
 311                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
 312                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
 313                                                                         to);
 314                 }
 315         } else if (old_iscan)
 316                 mgmt_discoverable(hdev, 0);
 317
 318         if (param & SCAN_PAGE) {
 319                 set_bit(HCI_PSCAN, &hdev->flags);
 320                 if (!old_pscan)
 321                         mgmt_connectable(hdev, 1);
 322         } else if (old_pscan)
 323                 mgmt_connectable(hdev, 0);
 324
 325 done:
 326         hci_dev_unlock(hdev);
 327         hci_req_complete(hdev, HCI_OP_WRITE_SCAN_ENABLE, status);
 328 }
 329
 330 static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 331 {
 332         struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
 333
 334         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 335
 336         if (rp->status)
 337                 return;
 338
 339         memcpy(hdev->dev_class, rp->dev_class, 3);
 340
 341         BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
 342                 hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
 343 }
 344
 345 static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 346 {
 347         __u8 status = *((__u8 *) skb->data);
 348         void *sent;
 349
 350         BT_DBG("%s status 0x%x", hdev->name, status);
 351
 352         if (status)
 353                 return;
 354
 355         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
 356         if (!sent)
 357                 return;
 358
 359         memcpy(hdev->dev_class, sent, 3);
 360 }
 361
 362 static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 363 {
 364         struct hci_rp_read_voice_setting *rp = (void *) skb->data;
 365         __u16 setting;
 366
 367         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 368
 369         if (rp->status)
 370                 return;
 371
 372         setting = __le16_to_cpu(rp->voice_setting);
 373
 374         if (hdev->voice_setting == setting)
 375                 return;
 376
 377         hdev->voice_setting = setting;
 378
 379         BT_DBG("%s voice setting 0x%04x", hdev->name, setting);
 380
 381         if (hdev->notify)
 382                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 383 }
 384
 385 static void hci_cc_write_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 386 {
 387         __u8 status = *((__u8 *) skb->data);
 388         __u16 setting;
 389         void *sent;
 390
 391         BT_DBG("%s status 0x%x", hdev->name, status);
 392
 393         if (status)
 394                 return;
 395
 396         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
 397         if (!sent)
 398                 return;
 399
 400         setting = get_unaligned_le16(sent);
 401
 402         if (hdev->voice_setting == setting)
 403                 return;
 404
 405         hdev->voice_setting = setting;
 406
 407         BT_DBG("%s voice setting 0x%04x", hdev->name, setting);
 408
 409         if (hdev->notify)
 410                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 411 }
 412
 413 static void hci_cc_host_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 414 {
 415         __u8 status = *((__u8 *) skb->data);
 416
 417         BT_DBG("%s status 0x%x", hdev->name, status);
 418
 419         hci_req_complete(hdev, HCI_OP_HOST_BUFFER_SIZE, status);
 420 }
 421
 422 static void hci_cc_read_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 423 {
 424         struct hci_rp_read_ssp_mode *rp = (void *) skb->data;
 425
 426         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 427
 428         if (rp->status)
 429                 return;
 430
 431         hdev->ssp_mode = rp->mode;
 432 }
 433
 434 static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 435 {
 436         __u8 status = *((__u8 *) skb->data);
 437         void *sent;
 438
 439         BT_DBG("%s status 0x%x", hdev->name, status);
 440
 441         if (status)
 442                 return;
 443
 444         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
 445         if (!sent)
 446                 return;
 447
 448         hdev->ssp_mode = *((__u8 *) sent);
 449 }
 450
 451 static u8 hci_get_inquiry_mode(struct hci_dev *hdev)
 452 {
 453         if (hdev->features[6] & LMP_EXT_INQ)
 454                 return 2;
 455
 456         if (hdev->features[3] & LMP_RSSI_INQ)
 457                 return 1;
 458
 459         if (hdev->manufacturer == 11 && hdev->hci_rev == 0x00 &&
 460                                                 hdev->lmp_subver == 0x0757)
 461                 return 1;
 462
 463         if (hdev->manufacturer == 15) {
 464                 if (hdev->hci_rev == 0x03 && hdev->lmp_subver == 0x6963)
 465                         return 1;
 466                 if (hdev->hci_rev == 0x09 && hdev->lmp_subver == 0x6963)
 467                         return 1;
 468                 if (hdev->hci_rev == 0x00 && hdev->lmp_subver == 0x6965)
 469                         return 1;
 470         }
 471
 472         if (hdev->manufacturer == 31 && hdev->hci_rev == 0x2005 &&
 473                                                 hdev->lmp_subver == 0x1805)
 474                 return 1;
 475
 476         return 0;
 477 }
 478
 479 static void hci_setup_inquiry_mode(struct hci_dev *hdev)
 480 {
 481         u8 mode;
 482
 483         mode = hci_get_inquiry_mode(hdev);
 484
 485         hci_send_cmd(hdev, HCI_OP_WRITE_INQUIRY_MODE, 1, &mode);
 486 }
 487
 488 static void hci_setup_event_mask(struct hci_dev *hdev)
 489 {
 490         /* The second byte is 0xff instead of 0x9f (two reserved bits
 491          * disabled) since a Broadcom 1.2 dongle doesn't respond to the
 492          * command otherwise */
 493         u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };
 494
 495         /* CSR 1.1 dongles does not accept any bitfield so don't try to set
 496          * any event mask for pre 1.2 devices */
 497         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
 498                 return;
 499
 500         events[4] |= 0x01; /* Flow Specification Complete */
 501         events[4] |= 0x02; /* Inquiry Result with RSSI */
 502         events[4] |= 0x04; /* Read Remote Extended Features Complete */
 503         events[5] |= 0x08; /* Synchronous Connection Complete */
 504         events[5] |= 0x10; /* Synchronous Connection Changed */
 505
 506         if (hdev->features[3] & LMP_RSSI_INQ)
 507                 events[4] |= 0x04; /* Inquiry Result with RSSI */
 508
 509         if (hdev->features[5] & LMP_SNIFF_SUBR)
 510                 events[5] |= 0x20; /* Sniff Subrating */
 511
 512         if (hdev->features[5] & LMP_PAUSE_ENC)
 513                 events[5] |= 0x80; /* Encryption Key Refresh Complete */
 514
 515         if (hdev->features[6] & LMP_EXT_INQ)
 516                 events[5] |= 0x40; /* Extended Inquiry Result */
 517
 518         if (hdev->features[6] & LMP_NO_FLUSH)
 519                 events[7] |= 0x01; /* Enhanced Flush Complete */
 520
 521         if (hdev->features[7] & LMP_LSTO)
 522                 events[6] |= 0x80; /* Link Supervision Timeout Changed */
 523
 524         if (hdev->features[6] & LMP_SIMPLE_PAIR) {
 525                 events[6] |= 0x01;      /* IO Capability Request */
 526                 events[6] |= 0x02;      /* IO Capability Response */
 527                 events[6] |= 0x04;      /* User Confirmation Request */
 528                 events[6] |= 0x08;      /* User Passkey Request */
 529                 events[6] |= 0x10;      /* Remote OOB Data Request */
 530                 events[6] |= 0x20;      /* Simple Pairing Complete */
 531                 events[7] |= 0x04;      /* User Passkey Notification */
 532                 events[7] |= 0x08;      /* Keypress Notification */
 533                 events[7] |= 0x10;      /* Remote Host Supported
 534                                          * Features Notification */
 535         }
 536
 537         if (hdev->features[4] & LMP_LE)
 538                 events[7] |= 0x20;      /* LE Meta-Event */
 539
 540         hci_send_cmd(hdev, HCI_OP_SET_EVENT_MASK, sizeof(events), events);
 541 }
 542
 543 static void hci_set_le_support(struct hci_dev *hdev)
 544 {
 545         struct hci_cp_write_le_host_supported cp;
 546
 547         memset(&cp, 0, sizeof(cp));
 548
 549         if (enable_le) {
 550                 cp.le = 1;
 551                 cp.simul = !!(hdev->features[6] & LMP_SIMUL_LE_BR);
 552         }
 553
 554         hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(cp), &cp);
 555 }
 556
 557 static void hci_setup(struct hci_dev *hdev)
 558 {
 559         hci_setup_event_mask(hdev);
 560
 561         if (hdev->hci_ver > BLUETOOTH_VER_1_1)
 562                 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
 563
 564         if (hdev->features[6] & LMP_SIMPLE_PAIR) {
 565                 u8 mode = 0x01;
 566                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(mode), &mode);
 567         }
 568
 569         if (hdev->features[3] & LMP_RSSI_INQ)
 570                 hci_setup_inquiry_mode(hdev);
 571
 572         if (hdev->features[7] & LMP_INQ_TX_PWR)
 573                 hci_send_cmd(hdev, HCI_OP_READ_INQ_RSP_TX_POWER, 0, NULL);
 574
 575         if (hdev->features[7] & LMP_EXTFEATURES) {
 576                 struct hci_cp_read_local_ext_features cp;
 577
 578                 cp.page = 0x01;
 579                 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES,
 580                                                         sizeof(cp), &cp);
 581         }
 582
 583         if (hdev->features[4] & LMP_LE)
 584                 hci_set_le_support(hdev);
 585 }
 586
 587 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
 588 {
 589         struct hci_rp_read_local_version *rp = (void *) skb->data;
 590
 591         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 592
 593         if (rp->status)
 594                 return;
 595
 596         hdev->hci_ver = rp->hci_ver;
 597         hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
 598         hdev->lmp_ver = rp->lmp_ver;
 599         hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
 600         hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
 601
 602         BT_DBG("%s manufacturer %d hci ver %d:%d", hdev->name,
 603                                         hdev->manufacturer,
 604                                         hdev->hci_ver, hdev->hci_rev);
 605
 606         if (test_bit(HCI_INIT, &hdev->flags))
 607                 hci_setup(hdev);
 608 }
 609
 610 static void hci_setup_link_policy(struct hci_dev *hdev)
 611 {
 612         u16 link_policy = 0;
 613
 614         if (hdev->features[0] & LMP_RSWITCH)
 615                 link_policy |= HCI_LP_RSWITCH;
 616         if (hdev->features[0] & LMP_HOLD)
 617                 link_policy |= HCI_LP_HOLD;
 618         if (hdev->features[0] & LMP_SNIFF)
 619                 link_policy |= HCI_LP_SNIFF;
 620         if (hdev->features[1] & LMP_PARK)
 621                 link_policy |= HCI_LP_PARK;
 622
 623         link_policy = cpu_to_le16(link_policy);
 624         hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY,
 625                                         sizeof(link_policy), &link_policy);
 626 }
 627
 628 static void hci_cc_read_local_commands(struct hci_dev *hdev, struct sk_buff *skb)
 629 {
 630         struct hci_rp_read_local_commands *rp = (void *) skb->data;
 631
 632         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 633
 634         if (rp->status)
 635                 goto done;
 636
 637         memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 638
 639         if (test_bit(HCI_INIT, &hdev->flags) && (hdev->commands[5] & 0x10))
 640                 hci_setup_link_policy(hdev);
 641
 642 done:
 643         hci_req_complete(hdev, HCI_OP_READ_LOCAL_COMMANDS, rp->status);
 644 }
 645
 646 static void hci_cc_read_local_features(struct hci_dev *hdev, struct sk_buff *skb)
 647 {
 648         struct hci_rp_read_local_features *rp = (void *) skb->data;
 649
 650         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 651
 652         if (rp->status)
 653                 return;
 654
 655         memcpy(hdev->features, rp->features, 8);
 656
 657         /* Adjust default settings according to features
 658          * supported by device. */
 659
 660         if (hdev->features[0] & LMP_3SLOT)
 661                 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 662
 663         if (hdev->features[0] & LMP_5SLOT)
 664                 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 665
 666         if (hdev->features[1] & LMP_HV2) {
 667                 hdev->pkt_type  |= (HCI_HV2);
 668                 hdev->esco_type |= (ESCO_HV2);
 669         }
 670
 671         if (hdev->features[1] & LMP_HV3) {
 672                 hdev->pkt_type  |= (HCI_HV3);
 673                 hdev->esco_type |= (ESCO_HV3);
 674         }
 675
 676         if (hdev->features[3] & LMP_ESCO)
 677                 hdev->esco_type |= (ESCO_EV3);
 678
 679         if (hdev->features[4] & LMP_EV4)
 680                 hdev->esco_type |= (ESCO_EV4);
 681
 682         if (hdev->features[4] & LMP_EV5)
 683                 hdev->esco_type |= (ESCO_EV5);
 684
 685         if (hdev->features[5] & LMP_EDR_ESCO_2M)
 686                 hdev->esco_type |= (ESCO_2EV3);
 687
 688         if (hdev->features[5] & LMP_EDR_ESCO_3M)
 689                 hdev->esco_type |= (ESCO_3EV3);
 690
 691         if (hdev->features[5] & LMP_EDR_3S_ESCO)
 692                 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
 693
 694         BT_DBG("%s features 0x%.2x%.2x%.2x%.2x%.2x%.2x%.2x%.2x", hdev->name,
 695                                         hdev->features[0], hdev->features[1],
 696                                         hdev->features[2], hdev->features[3],
 697                                         hdev->features[4], hdev->features[5],
 698                                         hdev->features[6], hdev->features[7]);
 699 }
 700
 701 static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
 702                                                         struct sk_buff *skb)
 703 {
 704         struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
 705
 706         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 707
 708         if (rp->status)
 709                 return;
 710
 711         memcpy(hdev->extfeatures, rp->features, 8);
 712
 713         hci_req_complete(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES, rp->status);
 714 }
 715
 716 static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
 717                                                 struct sk_buff *skb)
 718 {
 719         struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;
 720
 721         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 722
 723         if (rp->status)
 724                 return;
 725
 726         hdev->flow_ctl_mode = rp->mode;
 727
 728         hci_req_complete(hdev, HCI_OP_READ_FLOW_CONTROL_MODE, rp->status);
 729 }
 730
 731 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 732 {
 733         struct hci_rp_read_buffer_size *rp = (void *) skb->data;
 734
 735         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 736
 737         if (rp->status)
 738                 return;
 739
 740         hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
 741         hdev->sco_mtu  = rp->sco_mtu;
 742         hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
 743         hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
 744
 745         if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
 746                 hdev->sco_mtu  = 64;
 747                 hdev->sco_pkts = 8;
 748         }
 749
 750         hdev->acl_cnt = hdev->acl_pkts;
 751         hdev->sco_cnt = hdev->sco_pkts;
 752
 753         BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name,
 754                                         hdev->acl_mtu, hdev->acl_pkts,
 755                                         hdev->sco_mtu, hdev->sco_pkts);
 756 }
 757
 758 static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
 759 {
 760         struct hci_rp_read_bd_addr *rp = (void *) skb->data;
 761
 762         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 763
 764         if (!rp->status)
 765                 bacpy(&hdev->bdaddr, &rp->bdaddr);
 766
 767         hci_req_complete(hdev, HCI_OP_READ_BD_ADDR, rp->status);
 768 }
 769
 770 static void hci_cc_read_data_block_size(struct hci_dev *hdev,
 771                                                         struct sk_buff *skb)
 772 {
 773         struct hci_rp_read_data_block_size *rp = (void *) skb->data;
 774
 775         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 776
 777         if (rp->status)
 778                 return;
 779
 780         hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
 781         hdev->block_len = __le16_to_cpu(rp->block_len);
 782         hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
 783
 784         hdev->block_cnt = hdev->num_blocks;
 785
 786         BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
 787                                         hdev->block_cnt, hdev->block_len);
 788
 789         hci_req_complete(hdev, HCI_OP_READ_DATA_BLOCK_SIZE, rp->status);
 790 }
 791
 792 static void hci_cc_write_ca_timeout(struct hci_dev *hdev, struct sk_buff *skb)
 793 {
 794         __u8 status = *((__u8 *) skb->data);
 795
 796         BT_DBG("%s status 0x%x", hdev->name, status);
 797
 798         hci_req_complete(hdev, HCI_OP_WRITE_CA_TIMEOUT, status);
 799 }
 800
 801 static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
 802                 struct sk_buff *skb)
 803 {
 804         struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
 805
 806         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 807
 808         if (rp->status)
 809                 return;
 810
 811         hdev->amp_status = rp->amp_status;
 812         hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
 813         hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
 814         hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
 815         hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
 816         hdev->amp_type = rp->amp_type;
 817         hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
 818         hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
 819         hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
 820         hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
 821
 822         hci_req_complete(hdev, HCI_OP_READ_LOCAL_AMP_INFO, rp->status);
 823 }
 824
 825 static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
 826                                                         struct sk_buff *skb)
 827 {
 828         __u8 status = *((__u8 *) skb->data);
 829
 830         BT_DBG("%s status 0x%x", hdev->name, status);
 831
 832         hci_req_complete(hdev, HCI_OP_DELETE_STORED_LINK_KEY, status);
 833 }
 834
 835 static void hci_cc_set_event_mask(struct hci_dev *hdev, struct sk_buff *skb)
 836 {
 837         __u8 status = *((__u8 *) skb->data);
 838
 839         BT_DBG("%s status 0x%x", hdev->name, status);
 840
 841         hci_req_complete(hdev, HCI_OP_SET_EVENT_MASK, status);
 842 }
 843
 844 static void hci_cc_write_inquiry_mode(struct hci_dev *hdev,
 845                                                         struct sk_buff *skb)
 846 {
 847         __u8 status = *((__u8 *) skb->data);
 848
 849         BT_DBG("%s status 0x%x", hdev->name, status);
 850
 851         hci_req_complete(hdev, HCI_OP_WRITE_INQUIRY_MODE, status);
 852 }
 853
 854 static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
 855                                                         struct sk_buff *skb)
 856 {
 857         __u8 status = *((__u8 *) skb->data);
 858
 859         BT_DBG("%s status 0x%x", hdev->name, status);
 860
 861         hci_req_complete(hdev, HCI_OP_READ_INQ_RSP_TX_POWER, status);
 862 }
 863
 864 static void hci_cc_set_event_flt(struct hci_dev *hdev, struct sk_buff *skb)
 865 {
 866         __u8 status = *((__u8 *) skb->data);
 867
 868         BT_DBG("%s status 0x%x", hdev->name, status);
 869
 870         hci_req_complete(hdev, HCI_OP_SET_EVENT_FLT, status);
 871 }
 872
 873 static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
 874 {
 875         struct hci_rp_pin_code_reply *rp = (void *) skb->data;
 876         struct hci_cp_pin_code_reply *cp;
 877         struct hci_conn *conn;
 878
 879         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 880
 881         hci_dev_lock(hdev);
 882
 883         if (test_bit(HCI_MGMT, &hdev->flags))
 884                 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
 885
 886         if (rp->status != 0)
 887                 goto unlock;
 888
 889         cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
 890         if (!cp)
 891                 goto unlock;
 892
 893         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 894         if (conn)
 895                 conn->pin_length = cp->pin_len;
 896
 897 unlock:
 898         hci_dev_unlock(hdev);
 899 }
 900
 901 static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
 902 {
 903         struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
 904
 905         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 906
 907         hci_dev_lock(hdev);
 908
 909         if (test_bit(HCI_MGMT, &hdev->flags))
 910                 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
 911                                                                 rp->status);
 912
 913         hci_dev_unlock(hdev);
 914 }
 915
 916 static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
 917                                        struct sk_buff *skb)
 918 {
 919         struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
 920
 921         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 922
 923         if (rp->status)
 924                 return;
 925
 926         hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
 927         hdev->le_pkts = rp->le_max_pkt;
 928
 929         hdev->le_cnt = hdev->le_pkts;
 930
 931         BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
 932
 933         hci_req_complete(hdev, HCI_OP_LE_READ_BUFFER_SIZE, rp->status);
 934 }
 935
 936 static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
 937 {
 938         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 939
 940         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 941
 942         hci_dev_lock(hdev);
 943
 944         if (test_bit(HCI_MGMT, &hdev->flags))
 945                 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr,
 946                                                                 rp->status);
 947
 948         hci_dev_unlock(hdev);
 949 }
 950
 951 static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
 952                                                         struct sk_buff *skb)
 953 {
 954         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 955
 956         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 957
 958         hci_dev_lock(hdev);
 959
 960         if (test_bit(HCI_MGMT, &hdev->flags))
 961                 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
 962                                                                 rp->status);
 963
 964         hci_dev_unlock(hdev);
 965 }
 966
 967 static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
 968 {
 969         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 970
 971         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 972
 973         hci_dev_lock(hdev);
 974
 975         if (test_bit(HCI_MGMT, &hdev->flags))
 976                 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr,
 977                                                                 rp->status);
 978
 979         hci_dev_unlock(hdev);
 980 }
 981
 982 static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
 983                                                         struct sk_buff *skb)
 984 {
 985         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 986
 987         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 988
 989         hci_dev_lock(hdev);
 990
 991         if (test_bit(HCI_MGMT, &hdev->flags))
 992                 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
 993                                                                 rp->status);
 994
 995         hci_dev_unlock(hdev);
 996 }
 997
 998 static void hci_cc_read_local_oob_data_reply(struct hci_dev *hdev,
 999                                                         struct sk_buff *skb)
1000 {
1001         struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
1002
1003         BT_DBG("%s status 0x%x", hdev->name, rp->status);
1004
1005         hci_dev_lock(hdev);
1006         mgmt_read_local_oob_data_reply_complete(hdev, rp->hash,
1007                                                 rp->randomizer, rp->status);
1008         hci_dev_unlock(hdev);
1009 }
1010
1011 static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
1012 {
1013         __u8 status = *((__u8 *) skb->data);
1014
1015         BT_DBG("%s status 0x%x", hdev->name, status);
1016 }
1017
1018 static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
1019                                         struct sk_buff *skb)
1020 {
1021         struct hci_cp_le_set_scan_enable *cp;
1022         __u8 status = *((__u8 *) skb->data);
1023
1024         BT_DBG("%s status 0x%x", hdev->name, status);
1025
1026         if (status)
1027                 return;
1028
1029         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
1030         if (!cp)
1031                 return;
1032
1033         if (cp->enable == 0x01) {
1034                 set_bit(HCI_LE_SCAN, &hdev->dev_flags);
1035
1036                 cancel_delayed_work_sync(&hdev->adv_work);
1037
1038                 hci_dev_lock(hdev);
1039                 hci_adv_entries_clear(hdev);
1040                 hci_dev_unlock(hdev);
1041         } else if (cp->enable == 0x00) {
1042                 clear_bit(HCI_LE_SCAN, &hdev->dev_flags);
1043
1044                 cancel_delayed_work_sync(&hdev->adv_work);
1045                 queue_delayed_work(hdev->workqueue, &hdev->adv_work,
1046                                                  jiffies + ADV_CLEAR_TIMEOUT);
1047         }
1048 }
1049
1050 static void hci_cc_le_ltk_reply(struct hci_dev *hdev, struct sk_buff *skb)
1051 {
1052         struct hci_rp_le_ltk_reply *rp = (void *) skb->data;
1053
1054         BT_DBG("%s status 0x%x", hdev->name, rp->status);
1055
1056         if (rp->status)
1057                 return;
1058
1059         hci_req_complete(hdev, HCI_OP_LE_LTK_REPLY, rp->status);
1060 }
1061
1062 static void hci_cc_le_ltk_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
1063 {
1064         struct hci_rp_le_ltk_neg_reply *rp = (void *) skb->data;
1065
1066         BT_DBG("%s status 0x%x", hdev->name, rp->status);
1067
1068         if (rp->status)
1069                 return;
1070
1071         hci_req_complete(hdev, HCI_OP_LE_LTK_NEG_REPLY, rp->status);
1072 }
1073
1074 static inline void hci_cc_write_le_host_supported(struct hci_dev *hdev,
1075                                                         struct sk_buff *skb)
1076 {
1077         struct hci_cp_read_local_ext_features cp;
1078         __u8 status = *((__u8 *) skb->data);
1079
1080         BT_DBG("%s status 0x%x", hdev->name, status);
1081
1082         if (status)
1083                 return;
1084
1085         cp.page = 0x01;
1086         hci_send_cmd(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES, sizeof(cp), &cp);
1087 }
1088
1089 static inline void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
1090 {
1091         BT_DBG("%s status 0x%x", hdev->name, status);
1092
1093         if (status) {
1094                 hci_req_complete(hdev, HCI_OP_INQUIRY, status);
1095                 hci_conn_check_pending(hdev);
1096                 hci_dev_lock(hdev);
1097                 if (test_bit(HCI_MGMT, &hdev->flags))
1098                         mgmt_start_discovery_failed(hdev, status);
1099                 hci_dev_unlock(hdev);
1100                 return;
1101         }
1102
1103         set_bit(HCI_INQUIRY, &hdev->flags);
1104
1105         hci_dev_lock(hdev);
1106         mgmt_discovering(hdev, 1);
1107         hci_dev_unlock(hdev);
1108 }
1109
1110 static inline void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
1111 {
1112         struct hci_cp_create_conn *cp;
1113         struct hci_conn *conn;
1114
1115         BT_DBG("%s status 0x%x", hdev->name, status);
1116
1117         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
1118         if (!cp)
1119                 return;
1120
1121         hci_dev_lock(hdev);
1122
1123         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1124
1125         BT_DBG("%s bdaddr %s conn %p", hdev->name, batostr(&cp->bdaddr), conn);
1126
1127         if (status) {
1128                 if (conn && conn->state == BT_CONNECT) {
1129                         if (status != 0x0c || conn->attempt > 2) {
1130                                 conn->state = BT_CLOSED;
1131                                 hci_proto_connect_cfm(conn, status);
1132                                 hci_conn_del(conn);
1133                         } else
1134                                 conn->state = BT_CONNECT2;
1135                 }
1136         } else {
1137                 if (!conn) {
1138                         conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr);
1139                         if (conn) {
1140                                 conn->out = 1;
1141                                 conn->link_mode |= HCI_LM_MASTER;
1142                         } else
1143                                 BT_ERR("No memory for new connection");
1144                 }
1145         }
1146
1147         hci_dev_unlock(hdev);
1148 }
1149
1150 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
1151 {
1152         struct hci_cp_add_sco *cp;
1153         struct hci_conn *acl, *sco;
1154         __u16 handle;
1155
1156         BT_DBG("%s status 0x%x", hdev->name, status);
1157
1158         if (!status)
1159                 return;
1160
1161         cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
1162         if (!cp)
1163                 return;
1164
1165         handle = __le16_to_cpu(cp->handle);
1166
1167         BT_DBG("%s handle %d", hdev->name, handle);
1168
1169         hci_dev_lock(hdev);
1170
1171         acl = hci_conn_hash_lookup_handle(hdev, handle);
1172         if (acl) {
1173                 sco = acl->link;
1174                 if (sco) {
1175                         sco->state = BT_CLOSED;
1176
1177                         hci_proto_connect_cfm(sco, status);
1178                         hci_conn_del(sco);
1179                 }
1180         }
1181
1182         hci_dev_unlock(hdev);
1183 }
1184
1185 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
1186 {
1187         struct hci_cp_auth_requested *cp;
1188         struct hci_conn *conn;
1189
1190         BT_DBG("%s status 0x%x", hdev->name, status);
1191
1192         if (!status)
1193                 return;
1194
1195         cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
1196         if (!cp)
1197                 return;
1198
1199         hci_dev_lock(hdev);
1200
1201         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1202         if (conn) {
1203                 if (conn->state == BT_CONFIG) {
1204                         hci_proto_connect_cfm(conn, status);
1205                         hci_conn_put(conn);
1206                 }
1207         }
1208
1209         hci_dev_unlock(hdev);
1210 }
1211
1212 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
1213 {
1214         struct hci_cp_set_conn_encrypt *cp;
1215         struct hci_conn *conn;
1216
1217         BT_DBG("%s status 0x%x", hdev->name, status);
1218
1219         if (!status)
1220                 return;
1221
1222         cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
1223         if (!cp)
1224                 return;
1225
1226         hci_dev_lock(hdev);
1227
1228         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1229         if (conn) {
1230                 if (conn->state == BT_CONFIG) {
1231                         hci_proto_connect_cfm(conn, status);
1232                         hci_conn_put(conn);
1233                 }
1234         }
1235
1236         hci_dev_unlock(hdev);
1237 }
1238
1239 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
1240                                                         struct hci_conn *conn)
1241 {
1242         if (conn->state != BT_CONFIG || !conn->out)
1243                 return 0;
1244
1245         if (conn->pending_sec_level == BT_SECURITY_SDP)
1246                 return 0;
1247
1248         /* Only request authentication for SSP connections or non-SSP
1249          * devices with sec_level HIGH or if MITM protection is requested */
1250         if (!(hdev->ssp_mode > 0 && conn->ssp_mode > 0) &&
1251                                 conn->pending_sec_level != BT_SECURITY_HIGH &&
1252                                 !(conn->auth_type & 0x01))
1253                 return 0;
1254
1255         return 1;
1256 }
1257
1258 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
1259 {
1260         struct hci_cp_remote_name_req *cp;
1261         struct hci_conn *conn;
1262
1263         BT_DBG("%s status 0x%x", hdev->name, status);
1264
1265         /* If successful wait for the name req complete event before
1266          * checking for the need to do authentication */
1267         if (!status)
1268                 return;
1269
1270         cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
1271         if (!cp)
1272                 return;
1273
1274         hci_dev_lock(hdev);
1275
1276         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1277         if (!conn)
1278                 goto unlock;
1279
1280         if (!hci_outgoing_auth_needed(hdev, conn))
1281                 goto unlock;
1282
1283         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
1284                 struct hci_cp_auth_requested cp;
1285                 cp.handle = __cpu_to_le16(conn->handle);
1286                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
1287         }
1288
1289 unlock:
1290         hci_dev_unlock(hdev);
1291 }
1292
1293 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
1294 {
1295         struct hci_cp_read_remote_features *cp;
1296         struct hci_conn *conn;
1297
1298         BT_DBG("%s status 0x%x", hdev->name, status);
1299
1300         if (!status)
1301                 return;
1302
1303         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
1304         if (!cp)
1305                 return;
1306
1307         hci_dev_lock(hdev);
1308
1309         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1310         if (conn) {
1311                 if (conn->state == BT_CONFIG) {
1312                         hci_proto_connect_cfm(conn, status);
1313                         hci_conn_put(conn);
1314                 }
1315         }
1316
1317         hci_dev_unlock(hdev);
1318 }
1319
1320 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
1321 {
1322         struct hci_cp_read_remote_ext_features *cp;
1323         struct hci_conn *conn;
1324
1325         BT_DBG("%s status 0x%x", hdev->name, status);
1326
1327         if (!status)
1328                 return;
1329
1330         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
1331         if (!cp)
1332                 return;
1333
1334         hci_dev_lock(hdev);
1335
1336         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1337         if (conn) {
1338                 if (conn->state == BT_CONFIG) {
1339                         hci_proto_connect_cfm(conn, status);
1340                         hci_conn_put(conn);
1341                 }
1342         }
1343
1344         hci_dev_unlock(hdev);
1345 }
1346
1347 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
1348 {
1349         struct hci_cp_setup_sync_conn *cp;
1350         struct hci_conn *acl, *sco;
1351         __u16 handle;
1352
1353         BT_DBG("%s status 0x%x", hdev->name, status);
1354
1355         if (!status)
1356                 return;
1357
1358         cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
1359         if (!cp)
1360                 return;
1361
1362         handle = __le16_to_cpu(cp->handle);
1363
1364         BT_DBG("%s handle %d", hdev->name, handle);
1365
1366         hci_dev_lock(hdev);
1367
1368         acl = hci_conn_hash_lookup_handle(hdev, handle);
1369         if (acl) {
1370                 sco = acl->link;
1371                 if (sco) {
1372                         sco->state = BT_CLOSED;
1373
1374                         hci_proto_connect_cfm(sco, status);
1375                         hci_conn_del(sco);
1376                 }
1377         }
1378
1379         hci_dev_unlock(hdev);
1380 }
1381
1382 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
1383 {
1384         struct hci_cp_sniff_mode *cp;
1385         struct hci_conn *conn;
1386
1387         BT_DBG("%s status 0x%x", hdev->name, status);
1388
1389         if (!status)
1390                 return;
1391
1392         cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
1393         if (!cp)
1394                 return;
1395
1396         hci_dev_lock(hdev);
1397
1398         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1399         if (conn) {
1400                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend);
1401
1402                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->pend))
1403                         hci_sco_setup(conn, status);
1404         }
1405
1406         hci_dev_unlock(hdev);
1407 }
1408
1409 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
1410 {
1411         struct hci_cp_exit_sniff_mode *cp;
1412         struct hci_conn *conn;
1413
1414         BT_DBG("%s status 0x%x", hdev->name, status);
1415
1416         if (!status)
1417                 return;
1418
1419         cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
1420         if (!cp)
1421                 return;
1422
1423         hci_dev_lock(hdev);
1424
1425         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1426         if (conn) {
1427                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend);
1428
1429                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->pend))
1430                         hci_sco_setup(conn, status);
1431         }
1432
1433         hci_dev_unlock(hdev);
1434 }
1435
1436 static void hci_cs_le_create_conn(struct hci_dev *hdev, __u8 status)
1437 {
1438         struct hci_cp_le_create_conn *cp;
1439         struct hci_conn *conn;
1440
1441         BT_DBG("%s status 0x%x", hdev->name, status);
1442
1443         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
1444         if (!cp)
1445                 return;
1446
1447         hci_dev_lock(hdev);
1448
1449         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->peer_addr);
1450
1451         BT_DBG("%s bdaddr %s conn %p", hdev->name, batostr(&cp->peer_addr),
1452                 conn);
1453
1454         if (status) {
1455                 if (conn && conn->state == BT_CONNECT) {
1456                         conn->state = BT_CLOSED;
1457                         hci_proto_connect_cfm(conn, status);
1458                         hci_conn_del(conn);
1459                 }
1460         } else {
1461                 if (!conn) {
1462                         conn = hci_conn_add(hdev, LE_LINK, &cp->peer_addr);
1463                         if (conn) {
1464                                 conn->dst_type = cp->peer_addr_type;
1465                                 conn->out = 1;
1466                         } else {
1467                                 BT_ERR("No memory for new connection");
1468                         }
1469                 }
1470         }
1471
1472         hci_dev_unlock(hdev);
1473 }
1474
1475 static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
1476 {
1477         BT_DBG("%s status 0x%x", hdev->name, status);
1478 }
1479
1480 static inline void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1481 {
1482         __u8 status = *((__u8 *) skb->data);
1483
1484         BT_DBG("%s status %d", hdev->name, status);
1485
1486         hci_req_complete(hdev, HCI_OP_INQUIRY, status);
1487
1488         hci_conn_check_pending(hdev);
1489
1490         if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
1491                 return;
1492
1493         hci_dev_lock(hdev);
1494         mgmt_discovering(hdev, 0);
1495         hci_dev_unlock(hdev);
1496 }
1497
1498 static inline void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
1499 {
1500         struct inquiry_data data;
1501         struct inquiry_info *info = (void *) (skb->data + 1);
1502         int num_rsp = *((__u8 *) skb->data);
1503
1504         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
1505
1506         if (!num_rsp)
1507                 return;
1508
1509         hci_dev_lock(hdev);
1510
1511         for (; num_rsp; num_rsp--, info++) {
1512                 bacpy(&data.bdaddr, &info->bdaddr);
1513                 data.pscan_rep_mode     = info->pscan_rep_mode;
1514                 data.pscan_period_mode  = info->pscan_period_mode;
1515                 data.pscan_mode         = info->pscan_mode;
1516                 memcpy(data.dev_class, info->dev_class, 3);
1517                 data.clock_offset       = info->clock_offset;
1518                 data.rssi               = 0x00;
1519                 data.ssp_mode           = 0x00;
1520                 hci_inquiry_cache_update(hdev, &data);
1521                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
1522                                                 info->dev_class, 0, NULL);
1523         }
1524
1525         hci_dev_unlock(hdev);
1526 }
1527
1528 static inline void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1529 {
1530         struct hci_ev_conn_complete *ev = (void *) skb->data;
1531         struct hci_conn *conn;
1532
1533         BT_DBG("%s", hdev->name);
1534
1535         hci_dev_lock(hdev);
1536
1537         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
1538         if (!conn) {
1539                 if (ev->link_type != SCO_LINK)
1540                         goto unlock;
1541
1542                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
1543                 if (!conn)
1544                         goto unlock;
1545
1546                 conn->type = SCO_LINK;
1547         }
1548
1549         if (!ev->status) {
1550                 conn->handle = __le16_to_cpu(ev->handle);
1551
1552                 if (conn->type == ACL_LINK) {
1553                         conn->state = BT_CONFIG;
1554                         hci_conn_hold(conn);
1555                         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
1556                         mgmt_connected(hdev, &ev->bdaddr, conn->type,
1557                                                         conn->dst_type);
1558                 } else
1559                         conn->state = BT_CONNECTED;
1560
1561                 hci_conn_hold_device(conn);
1562                 hci_conn_add_sysfs(conn);
1563
1564                 if (test_bit(HCI_AUTH, &hdev->flags))
1565                         conn->link_mode |= HCI_LM_AUTH;
1566
1567                 if (test_bit(HCI_ENCRYPT, &hdev->flags))
1568                         conn->link_mode |= HCI_LM_ENCRYPT;
1569
1570                 /* Get remote features */
1571                 if (conn->type == ACL_LINK) {
1572                         struct hci_cp_read_remote_features cp;
1573                         cp.handle = ev->handle;
1574                         hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
1575                                                         sizeof(cp), &cp);
1576                 }
1577
1578                 /* Set packet type for incoming connection */
1579                 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
1580                         struct hci_cp_change_conn_ptype cp;
1581                         cp.handle = ev->handle;
1582                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
1583                         hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE,
1584                                                         sizeof(cp), &cp);
1585                 }
1586         } else {
1587                 conn->state = BT_CLOSED;
1588                 if (conn->type == ACL_LINK)
1589                         mgmt_connect_failed(hdev, &ev->bdaddr, conn->type,
1590                                                 conn->dst_type, ev->status);
1591         }
1592
1593         if (conn->type == ACL_LINK)
1594                 hci_sco_setup(conn, ev->status);
1595
1596         if (ev->status) {
1597                 hci_proto_connect_cfm(conn, ev->status);
1598                 hci_conn_del(conn);
1599         } else if (ev->link_type != ACL_LINK)
1600                 hci_proto_connect_cfm(conn, ev->status);
1601
1602 unlock:
1603         hci_dev_unlock(hdev);
1604
1605         hci_conn_check_pending(hdev);
1606 }
1607
1608 static inline void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
1609 {
1610         struct hci_ev_conn_request *ev = (void *) skb->data;
1611         int mask = hdev->link_mode;
1612
1613         BT_DBG("%s bdaddr %s type 0x%x", hdev->name,
1614                                         batostr(&ev->bdaddr), ev->link_type);
1615
1616         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type);
1617
1618         if ((mask & HCI_LM_ACCEPT) &&
1619                         !hci_blacklist_lookup(hdev, &ev->bdaddr)) {
1620                 /* Connection accepted */
1621                 struct inquiry_entry *ie;
1622                 struct hci_conn *conn;
1623
1624                 hci_dev_lock(hdev);
1625
1626                 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
1627                 if (ie)
1628                         memcpy(ie->data.dev_class, ev->dev_class, 3);
1629
1630                 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
1631                 if (!conn) {
1632                         conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr);
1633                         if (!conn) {
1634                                 BT_ERR("No memory for new connection");
1635                                 hci_dev_unlock(hdev);
1636                                 return;
1637                         }
1638                 }
1639
1640                 memcpy(conn->dev_class, ev->dev_class, 3);
1641                 conn->state = BT_CONNECT;
1642
1643                 hci_dev_unlock(hdev);
1644
1645                 if (ev->link_type == ACL_LINK || !lmp_esco_capable(hdev)) {
1646                         struct hci_cp_accept_conn_req cp;
1647
1648                         bacpy(&cp.bdaddr, &ev->bdaddr);
1649
1650                         if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
1651                                 cp.role = 0x00; /* Become master */
1652                         else
1653                                 cp.role = 0x01; /* Remain slave */
1654
1655                         hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ,
1656                                                         sizeof(cp), &cp);
1657                 } else {
1658                         struct hci_cp_accept_sync_conn_req cp;
1659
1660                         bacpy(&cp.bdaddr, &ev->bdaddr);
1661                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
1662
1663                         cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
1664                         cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
1665                         cp.max_latency    = cpu_to_le16(0xffff);
1666                         cp.content_format = cpu_to_le16(hdev->voice_setting);
1667                         cp.retrans_effort = 0xff;
1668
1669                         hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ,
1670                                                         sizeof(cp), &cp);
1671                 }
1672         } else {
1673                 /* Connection rejected */
1674                 struct hci_cp_reject_conn_req cp;
1675
1676                 bacpy(&cp.bdaddr, &ev->bdaddr);
1677                 cp.reason = HCI_ERROR_REJ_BAD_ADDR;
1678                 hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
1679         }
1680 }
1681
1682 static inline void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1683 {
1684         struct hci_ev_disconn_complete *ev = (void *) skb->data;
1685         struct hci_conn *conn;
1686
1687         BT_DBG("%s status %d", hdev->name, ev->status);
1688
1689         hci_dev_lock(hdev);
1690
1691         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1692         if (!conn)
1693                 goto unlock;
1694
1695         if (ev->status == 0)
1696                 conn->state = BT_CLOSED;
1697
1698         if (conn->type == ACL_LINK || conn->type == LE_LINK) {
1699                 if (ev->status != 0)
1700                         mgmt_disconnect_failed(hdev, &conn->dst, ev->status);
1701                 else
1702                         mgmt_disconnected(hdev, &conn->dst, conn->type,
1703                                                         conn->dst_type);
1704         }
1705
1706         if (ev->status == 0) {
1707                 hci_proto_disconn_cfm(conn, ev->reason);
1708                 hci_conn_del(conn);
1709         }
1710
1711 unlock:
1712         hci_dev_unlock(hdev);
1713 }
1714
1715 static inline void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1716 {
1717         struct hci_ev_auth_complete *ev = (void *) skb->data;
1718         struct hci_conn *conn;
1719
1720         BT_DBG("%s status %d", hdev->name, ev->status);
1721
1722         hci_dev_lock(hdev);
1723
1724         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1725         if (!conn)
1726                 goto unlock;
1727
1728         if (!ev->status) {
1729                 if (!(conn->ssp_mode > 0 && hdev->ssp_mode > 0) &&
1730                                 test_bit(HCI_CONN_REAUTH_PEND,  &conn->pend)) {
1731                         BT_INFO("re-auth of legacy device is not possible.");
1732                 } else {
1733                         conn->link_mode |= HCI_LM_AUTH;
1734                         conn->sec_level = conn->pending_sec_level;
1735                 }
1736         } else {
1737                 mgmt_auth_failed(hdev, &conn->dst, ev->status);
1738         }
1739
1740         clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
1741         clear_bit(HCI_CONN_REAUTH_PEND, &conn->pend);
1742
1743         if (conn->state == BT_CONFIG) {
1744                 if (!ev->status && hdev->ssp_mode > 0 && conn->ssp_mode > 0) {
1745                         struct hci_cp_set_conn_encrypt cp;
1746                         cp.handle  = ev->handle;
1747                         cp.encrypt = 0x01;
1748                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
1749                                                                         &cp);
1750                 } else {
1751                         conn->state = BT_CONNECTED;
1752                         hci_proto_connect_cfm(conn, ev->status);
1753                         hci_conn_put(conn);
1754                 }
1755         } else {
1756                 hci_auth_cfm(conn, ev->status);
1757
1758                 hci_conn_hold(conn);
1759                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
1760                 hci_conn_put(conn);
1761         }
1762
1763         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend)) {
1764                 if (!ev->status) {
1765                         struct hci_cp_set_conn_encrypt cp;
1766                         cp.handle  = ev->handle;
1767                         cp.encrypt = 0x01;
1768                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
1769                                                                         &cp);
1770                 } else {
1771                         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
1772                         hci_encrypt_cfm(conn, ev->status, 0x00);
1773                 }
1774         }
1775
1776 unlock:
1777         hci_dev_unlock(hdev);
1778 }
1779
1780 static inline void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
1781 {
1782         struct hci_ev_remote_name *ev = (void *) skb->data;
1783         struct hci_conn *conn;
1784
1785         BT_DBG("%s", hdev->name);
1786
1787         hci_conn_check_pending(hdev);
1788
1789         hci_dev_lock(hdev);
1790
1791         if (ev->status == 0 && test_bit(HCI_MGMT, &hdev->flags))
1792                 mgmt_remote_name(hdev, &ev->bdaddr, ev->name);
1793
1794         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
1795         if (!conn)
1796                 goto unlock;
1797
1798         if (!hci_outgoing_auth_needed(hdev, conn))
1799                 goto unlock;
1800
1801         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
1802                 struct hci_cp_auth_requested cp;
1803                 cp.handle = __cpu_to_le16(conn->handle);
1804                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
1805         }
1806
1807 unlock:
1808         hci_dev_unlock(hdev);
1809 }
1810
1811 static inline void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
1812 {
1813         struct hci_ev_encrypt_change *ev = (void *) skb->data;
1814         struct hci_conn *conn;
1815
1816         BT_DBG("%s status %d", hdev->name, ev->status);
1817
1818         hci_dev_lock(hdev);
1819
1820         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1821         if (conn) {
1822                 if (!ev->status) {
1823                         if (ev->encrypt) {
1824                                 /* Encryption implies authentication */
1825                                 conn->link_mode |= HCI_LM_AUTH;
1826                                 conn->link_mode |= HCI_LM_ENCRYPT;
1827                                 conn->sec_level = conn->pending_sec_level;
1828                         } else
1829                                 conn->link_mode &= ~HCI_LM_ENCRYPT;
1830                 }
1831
1832                 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
1833
1834                 if (conn->state == BT_CONFIG) {
1835                         if (!ev->status)
1836                                 conn->state = BT_CONNECTED;
1837
1838                         hci_proto_connect_cfm(conn, ev->status);
1839                         hci_conn_put(conn);
1840                 } else
1841                         hci_encrypt_cfm(conn, ev->status, ev->encrypt);
1842         }
1843
1844         hci_dev_unlock(hdev);
1845 }
1846
1847 static inline void hci_change_link_key_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1848 {
1849         struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
1850         struct hci_conn *conn;
1851
1852         BT_DBG("%s status %d", hdev->name, ev->status);
1853
1854         hci_dev_lock(hdev);
1855
1856         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1857         if (conn) {
1858                 if (!ev->status)
1859                         conn->link_mode |= HCI_LM_SECURE;
1860
1861                 clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
1862
1863                 hci_key_change_cfm(conn, ev->status);
1864         }
1865
1866         hci_dev_unlock(hdev);
1867 }
1868
1869 static inline void hci_remote_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
1870 {
1871         struct hci_ev_remote_features *ev = (void *) skb->data;
1872         struct hci_conn *conn;
1873
1874         BT_DBG("%s status %d", hdev->name, ev->status);
1875
1876         hci_dev_lock(hdev);
1877
1878         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1879         if (!conn)
1880                 goto unlock;
1881
1882         if (!ev->status)
1883                 memcpy(conn->features, ev->features, 8);
1884
1885         if (conn->state != BT_CONFIG)
1886                 goto unlock;
1887
1888         if (!ev->status && lmp_ssp_capable(hdev) && lmp_ssp_capable(conn)) {
1889                 struct hci_cp_read_remote_ext_features cp;
1890                 cp.handle = ev->handle;
1891                 cp.page = 0x01;
1892                 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
1893                                                         sizeof(cp), &cp);
1894                 goto unlock;
1895         }
1896
1897         if (!ev->status) {
1898                 struct hci_cp_remote_name_req cp;
1899                 memset(&cp, 0, sizeof(cp));
1900                 bacpy(&cp.bdaddr, &conn->dst);
1901                 cp.pscan_rep_mode = 0x02;
1902                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1903         }
1904
1905         if (!hci_outgoing_auth_needed(hdev, conn)) {
1906                 conn->state = BT_CONNECTED;
1907                 hci_proto_connect_cfm(conn, ev->status);
1908                 hci_conn_put(conn);
1909         }
1910
1911 unlock:
1912         hci_dev_unlock(hdev);
1913 }
1914
1915 static inline void hci_remote_version_evt(struct hci_dev *hdev, struct sk_buff *skb)
1916 {
1917         BT_DBG("%s", hdev->name);
1918 }
1919
1920 static inline void hci_qos_setup_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1921 {
1922         BT_DBG("%s", hdev->name);
1923 }
1924
1925 static inline void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1926 {
1927         struct hci_ev_cmd_complete *ev = (void *) skb->data;
1928         __u16 opcode;
1929
1930         skb_pull(skb, sizeof(*ev));
1931
1932         opcode = __le16_to_cpu(ev->opcode);
1933
1934         switch (opcode) {
1935         case HCI_OP_INQUIRY_CANCEL:
1936                 hci_cc_inquiry_cancel(hdev, skb);
1937                 break;
1938
1939         case HCI_OP_EXIT_PERIODIC_INQ:
1940                 hci_cc_exit_periodic_inq(hdev, skb);
1941                 break;
1942
1943         case HCI_OP_REMOTE_NAME_REQ_CANCEL:
1944                 hci_cc_remote_name_req_cancel(hdev, skb);
1945                 break;
1946
1947         case HCI_OP_ROLE_DISCOVERY:
1948                 hci_cc_role_discovery(hdev, skb);
1949                 break;
1950
1951         case HCI_OP_READ_LINK_POLICY:
1952                 hci_cc_read_link_policy(hdev, skb);
1953                 break;
1954
1955         case HCI_OP_WRITE_LINK_POLICY:
1956                 hci_cc_write_link_policy(hdev, skb);
1957                 break;
1958
1959         case HCI_OP_READ_DEF_LINK_POLICY:
1960                 hci_cc_read_def_link_policy(hdev, skb);
1961                 break;
1962
1963         case HCI_OP_WRITE_DEF_LINK_POLICY:
1964                 hci_cc_write_def_link_policy(hdev, skb);
1965                 break;
1966
1967         case HCI_OP_RESET:
1968                 hci_cc_reset(hdev, skb);
1969                 break;
1970
1971         case HCI_OP_WRITE_LOCAL_NAME:
1972                 hci_cc_write_local_name(hdev, skb);
1973                 break;
1974
1975         case HCI_OP_READ_LOCAL_NAME:
1976                 hci_cc_read_local_name(hdev, skb);
1977                 break;
1978
1979         case HCI_OP_WRITE_AUTH_ENABLE:
1980                 hci_cc_write_auth_enable(hdev, skb);
1981                 break;
1982
1983         case HCI_OP_WRITE_ENCRYPT_MODE:
1984                 hci_cc_write_encrypt_mode(hdev, skb);
1985                 break;
1986
1987         case HCI_OP_WRITE_SCAN_ENABLE:
1988                 hci_cc_write_scan_enable(hdev, skb);
1989                 break;
1990
1991         case HCI_OP_READ_CLASS_OF_DEV:
1992                 hci_cc_read_class_of_dev(hdev, skb);
1993                 break;
1994
1995         case HCI_OP_WRITE_CLASS_OF_DEV:
1996                 hci_cc_write_class_of_dev(hdev, skb);
1997                 break;
1998
1999         case HCI_OP_READ_VOICE_SETTING:
2000                 hci_cc_read_voice_setting(hdev, skb);
2001                 break;
2002
2003         case HCI_OP_WRITE_VOICE_SETTING:
2004                 hci_cc_write_voice_setting(hdev, skb);
2005                 break;
2006
2007         case HCI_OP_HOST_BUFFER_SIZE:
2008                 hci_cc_host_buffer_size(hdev, skb);
2009                 break;
2010
2011         case HCI_OP_READ_SSP_MODE:
2012                 hci_cc_read_ssp_mode(hdev, skb);
2013                 break;
2014
2015         case HCI_OP_WRITE_SSP_MODE:
2016                 hci_cc_write_ssp_mode(hdev, skb);
2017                 break;
2018
2019         case HCI_OP_READ_LOCAL_VERSION:
2020                 hci_cc_read_local_version(hdev, skb);
2021                 break;
2022
2023         case HCI_OP_READ_LOCAL_COMMANDS:
2024                 hci_cc_read_local_commands(hdev, skb);
2025                 break;
2026
2027         case HCI_OP_READ_LOCAL_FEATURES:
2028                 hci_cc_read_local_features(hdev, skb);
2029                 break;
2030
2031         case HCI_OP_READ_LOCAL_EXT_FEATURES:
2032                 hci_cc_read_local_ext_features(hdev, skb);
2033                 break;
2034
2035         case HCI_OP_READ_BUFFER_SIZE:
2036                 hci_cc_read_buffer_size(hdev, skb);
2037                 break;
2038
2039         case HCI_OP_READ_BD_ADDR:
2040                 hci_cc_read_bd_addr(hdev, skb);
2041                 break;
2042
2043         case HCI_OP_READ_DATA_BLOCK_SIZE:
2044                 hci_cc_read_data_block_size(hdev, skb);
2045                 break;
2046
2047         case HCI_OP_WRITE_CA_TIMEOUT:
2048                 hci_cc_write_ca_timeout(hdev, skb);
2049                 break;
2050
2051         case HCI_OP_READ_FLOW_CONTROL_MODE:
2052                 hci_cc_read_flow_control_mode(hdev, skb);
2053                 break;
2054
2055         case HCI_OP_READ_LOCAL_AMP_INFO:
2056                 hci_cc_read_local_amp_info(hdev, skb);
2057                 break;
2058
2059         case HCI_OP_DELETE_STORED_LINK_KEY:
2060                 hci_cc_delete_stored_link_key(hdev, skb);
2061                 break;
2062
2063         case HCI_OP_SET_EVENT_MASK:
2064                 hci_cc_set_event_mask(hdev, skb);
2065                 break;
2066
2067         case HCI_OP_WRITE_INQUIRY_MODE:
2068                 hci_cc_write_inquiry_mode(hdev, skb);
2069                 break;
2070
2071         case HCI_OP_READ_INQ_RSP_TX_POWER:
2072                 hci_cc_read_inq_rsp_tx_power(hdev, skb);
2073                 break;
2074
2075         case HCI_OP_SET_EVENT_FLT:
2076                 hci_cc_set_event_flt(hdev, skb);
2077                 break;
2078
2079         case HCI_OP_PIN_CODE_REPLY:
2080                 hci_cc_pin_code_reply(hdev, skb);
2081                 break;
2082
2083         case HCI_OP_PIN_CODE_NEG_REPLY:
2084                 hci_cc_pin_code_neg_reply(hdev, skb);
2085                 break;
2086
2087         case HCI_OP_READ_LOCAL_OOB_DATA:
2088                 hci_cc_read_local_oob_data_reply(hdev, skb);
2089                 break;
2090
2091         case HCI_OP_LE_READ_BUFFER_SIZE:
2092                 hci_cc_le_read_buffer_size(hdev, skb);
2093                 break;
2094
2095         case HCI_OP_USER_CONFIRM_REPLY:
2096                 hci_cc_user_confirm_reply(hdev, skb);
2097                 break;
2098
2099         case HCI_OP_USER_CONFIRM_NEG_REPLY:
2100                 hci_cc_user_confirm_neg_reply(hdev, skb);
2101                 break;
2102
2103         case HCI_OP_USER_PASSKEY_REPLY:
2104                 hci_cc_user_passkey_reply(hdev, skb);
2105                 break;
2106
2107         case HCI_OP_USER_PASSKEY_NEG_REPLY:
2108                 hci_cc_user_passkey_neg_reply(hdev, skb);
2109
2110         case HCI_OP_LE_SET_SCAN_PARAM:
2111                 hci_cc_le_set_scan_param(hdev, skb);
2112                 break;
2113
2114         case HCI_OP_LE_SET_SCAN_ENABLE:
2115                 hci_cc_le_set_scan_enable(hdev, skb);
2116                 break;
2117
2118         case HCI_OP_LE_LTK_REPLY:
2119                 hci_cc_le_ltk_reply(hdev, skb);
2120                 break;
2121
2122         case HCI_OP_LE_LTK_NEG_REPLY:
2123                 hci_cc_le_ltk_neg_reply(hdev, skb);
2124                 break;
2125
2126         case HCI_OP_WRITE_LE_HOST_SUPPORTED:
2127                 hci_cc_write_le_host_supported(hdev, skb);
2128                 break;
2129
2130         default:
2131                 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
2132                 break;
2133         }
2134
2135         if (ev->opcode != HCI_OP_NOP)
2136                 del_timer(&hdev->cmd_timer);
2137
2138         if (ev->ncmd) {
2139                 atomic_set(&hdev->cmd_cnt, 1);
2140                 if (!skb_queue_empty(&hdev->cmd_q))
2141                         queue_work(hdev->workqueue, &hdev->cmd_work);
2142         }
2143 }
2144
2145 static inline void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb)
2146 {
2147         struct hci_ev_cmd_status *ev = (void *) skb->data;
2148         __u16 opcode;
2149
2150         skb_pull(skb, sizeof(*ev));
2151
2152         opcode = __le16_to_cpu(ev->opcode);
2153
2154         switch (opcode) {
2155         case HCI_OP_INQUIRY:
2156                 hci_cs_inquiry(hdev, ev->status);
2157                 break;
2158
2159         case HCI_OP_CREATE_CONN:
2160                 hci_cs_create_conn(hdev, ev->status);
2161                 break;
2162
2163         case HCI_OP_ADD_SCO:
2164                 hci_cs_add_sco(hdev, ev->status);
2165                 break;
2166
2167         case HCI_OP_AUTH_REQUESTED:
2168                 hci_cs_auth_requested(hdev, ev->status);
2169                 break;
2170
2171         case HCI_OP_SET_CONN_ENCRYPT:
2172                 hci_cs_set_conn_encrypt(hdev, ev->status);
2173                 break;
2174
2175         case HCI_OP_REMOTE_NAME_REQ:
2176                 hci_cs_remote_name_req(hdev, ev->status);
2177                 break;
2178
2179         case HCI_OP_READ_REMOTE_FEATURES:
2180                 hci_cs_read_remote_features(hdev, ev->status);
2181                 break;
2182
2183         case HCI_OP_READ_REMOTE_EXT_FEATURES:
2184                 hci_cs_read_remote_ext_features(hdev, ev->status);
2185                 break;
2186
2187         case HCI_OP_SETUP_SYNC_CONN:
2188                 hci_cs_setup_sync_conn(hdev, ev->status);
2189                 break;
2190
2191         case HCI_OP_SNIFF_MODE:
2192                 hci_cs_sniff_mode(hdev, ev->status);
2193                 break;
2194
2195         case HCI_OP_EXIT_SNIFF_MODE:
2196                 hci_cs_exit_sniff_mode(hdev, ev->status);
2197                 break;
2198
2199         case HCI_OP_DISCONNECT:
2200                 if (ev->status != 0)
2201                         mgmt_disconnect_failed(hdev, NULL, ev->status);
2202                 break;
2203
2204         case HCI_OP_LE_CREATE_CONN:
2205                 hci_cs_le_create_conn(hdev, ev->status);
2206                 break;
2207
2208         case HCI_OP_LE_START_ENC:
2209                 hci_cs_le_start_enc(hdev, ev->status);
2210                 break;
2211
2212         default:
2213                 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
2214                 break;
2215         }
2216
2217         if (ev->opcode != HCI_OP_NOP)
2218                 del_timer(&hdev->cmd_timer);
2219
2220         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
2221                 atomic_set(&hdev->cmd_cnt, 1);
2222                 if (!skb_queue_empty(&hdev->cmd_q))
2223                         queue_work(hdev->workqueue, &hdev->cmd_work);
2224         }
2225 }
2226
2227 static inline void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2228 {
2229         struct hci_ev_role_change *ev = (void *) skb->data;
2230         struct hci_conn *conn;
2231
2232         BT_DBG("%s status %d", hdev->name, ev->status);
2233
2234         hci_dev_lock(hdev);
2235
2236         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2237         if (conn) {
2238                 if (!ev->status) {
2239                         if (ev->role)
2240                                 conn->link_mode &= ~HCI_LM_MASTER;
2241                         else
2242                                 conn->link_mode |= HCI_LM_MASTER;
2243                 }
2244
2245                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->pend);
2246
2247                 hci_role_switch_cfm(conn, ev->status, ev->role);
2248         }
2249
2250         hci_dev_unlock(hdev);
2251 }
2252
2253 static inline void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
2254 {
2255         struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
2256         __le16 *ptr;
2257         int i;
2258
2259         skb_pull(skb, sizeof(*ev));
2260
2261         BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
2262
2263         if (skb->len < ev->num_hndl * 4) {
2264                 BT_DBG("%s bad parameters", hdev->name);
2265                 return;
2266         }
2267
2268         for (i = 0, ptr = (__le16 *) skb->data; i < ev->num_hndl; i++) {
2269                 struct hci_conn *conn;
2270                 __u16  handle, count;
2271
2272                 handle = get_unaligned_le16(ptr++);
2273                 count  = get_unaligned_le16(ptr++);
2274
2275                 conn = hci_conn_hash_lookup_handle(hdev, handle);
2276                 if (!conn)
2277                         continue;
2278
2279                 conn->sent -= count;
2280
2281                 switch (conn->type) {
2282                 case ACL_LINK:
2283                         hdev->acl_cnt += count;
2284                         if (hdev->acl_cnt > hdev->acl_pkts)
2285                                 hdev->acl_cnt = hdev->acl_pkts;
2286                         break;
2287
2288                 case LE_LINK:
2289                         if (hdev->le_pkts) {
2290                                 hdev->le_cnt += count;
2291                                 if (hdev->le_cnt > hdev->le_pkts)
2292                                         hdev->le_cnt = hdev->le_pkts;
2293                         } else {
2294                                 hdev->acl_cnt += count;
2295                                 if (hdev->acl_cnt > hdev->acl_pkts)
2296                                         hdev->acl_cnt = hdev->acl_pkts;
2297                         }
2298                         break;
2299
2300                 case SCO_LINK:
2301                         hdev->sco_cnt += count;
2302                         if (hdev->sco_cnt > hdev->sco_pkts)
2303                                 hdev->sco_cnt = hdev->sco_pkts;
2304                         break;
2305
2306                 default:
2307                         BT_ERR("Unknown type %d conn %p", conn->type, conn);
2308                         break;
2309                 }
2310         }
2311
2312         queue_work(hdev->workqueue, &hdev->tx_work);
2313 }
2314
2315 static inline void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2316 {
2317         struct hci_ev_mode_change *ev = (void *) skb->data;
2318         struct hci_conn *conn;
2319
2320         BT_DBG("%s status %d", hdev->name, ev->status);
2321
2322         hci_dev_lock(hdev);
2323
2324         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2325         if (conn) {
2326                 conn->mode = ev->mode;
2327                 conn->interval = __le16_to_cpu(ev->interval);
2328
2329                 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
2330                         if (conn->mode == HCI_CM_ACTIVE)
2331                                 conn->power_save = 1;
2332                         else
2333                                 conn->power_save = 0;
2334                 }
2335
2336                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->pend))
2337                         hci_sco_setup(conn, ev->status);
2338         }
2339
2340         hci_dev_unlock(hdev);
2341 }
2342
2343 static inline void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2344 {
2345         struct hci_ev_pin_code_req *ev = (void *) skb->data;
2346         struct hci_conn *conn;
2347
2348         BT_DBG("%s", hdev->name);
2349
2350         hci_dev_lock(hdev);
2351
2352         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2353         if (!conn)
2354                 goto unlock;
2355
2356         if (conn->state == BT_CONNECTED) {
2357                 hci_conn_hold(conn);
2358                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2359                 hci_conn_put(conn);
2360         }
2361
2362         if (!test_bit(HCI_PAIRABLE, &hdev->flags))
2363                 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2364                                         sizeof(ev->bdaddr), &ev->bdaddr);
2365         else if (test_bit(HCI_MGMT, &hdev->flags)) {
2366                 u8 secure;
2367
2368                 if (conn->pending_sec_level == BT_SECURITY_HIGH)
2369                         secure = 1;
2370                 else
2371                         secure = 0;
2372
2373                 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
2374         }
2375
2376 unlock:
2377         hci_dev_unlock(hdev);
2378 }
2379
2380 static inline void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2381 {
2382         struct hci_ev_link_key_req *ev = (void *) skb->data;
2383         struct hci_cp_link_key_reply cp;
2384         struct hci_conn *conn;
2385         struct link_key *key;
2386
2387         BT_DBG("%s", hdev->name);
2388
2389         if (!test_bit(HCI_LINK_KEYS, &hdev->flags))
2390                 return;
2391
2392         hci_dev_lock(hdev);
2393
2394         key = hci_find_link_key(hdev, &ev->bdaddr);
2395         if (!key) {
2396                 BT_DBG("%s link key not found for %s", hdev->name,
2397                                                         batostr(&ev->bdaddr));
2398                 goto not_found;
2399         }
2400
2401         BT_DBG("%s found key type %u for %s", hdev->name, key->type,
2402                                                         batostr(&ev->bdaddr));
2403
2404         if (!test_bit(HCI_DEBUG_KEYS, &hdev->flags) &&
2405                                 key->type == HCI_LK_DEBUG_COMBINATION) {
2406                 BT_DBG("%s ignoring debug key", hdev->name);
2407                 goto not_found;
2408         }
2409
2410         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2411         if (conn) {
2412                 if (key->type == HCI_LK_UNAUTH_COMBINATION &&
2413                                 conn->auth_type != 0xff &&
2414                                 (conn->auth_type & 0x01)) {
2415                         BT_DBG("%s ignoring unauthenticated key", hdev->name);
2416                         goto not_found;
2417                 }
2418
2419                 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
2420                                 conn->pending_sec_level == BT_SECURITY_HIGH) {
2421                         BT_DBG("%s ignoring key unauthenticated for high \
2422                                                         security", hdev->name);
2423                         goto not_found;
2424                 }
2425
2426                 conn->key_type = key->type;
2427                 conn->pin_length = key->pin_len;
2428         }
2429
2430         bacpy(&cp.bdaddr, &ev->bdaddr);
2431         memcpy(cp.link_key, key->val, 16);
2432
2433         hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
2434
2435         hci_dev_unlock(hdev);
2436
2437         return;
2438
2439 not_found:
2440         hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
2441         hci_dev_unlock(hdev);
2442 }
2443
2444 static inline void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
2445 {
2446         struct hci_ev_link_key_notify *ev = (void *) skb->data;
2447         struct hci_conn *conn;
2448         u8 pin_len = 0;
2449
2450         BT_DBG("%s", hdev->name);
2451
2452         hci_dev_lock(hdev);
2453
2454         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2455         if (conn) {
2456                 hci_conn_hold(conn);
2457                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2458                 pin_len = conn->pin_length;
2459
2460                 if (ev->key_type != HCI_LK_CHANGED_COMBINATION)
2461                         conn->key_type = ev->key_type;
2462
2463                 hci_conn_put(conn);
2464         }
2465
2466         if (test_bit(HCI_LINK_KEYS, &hdev->flags))
2467                 hci_add_link_key(hdev, conn, 1, &ev->bdaddr, ev->link_key,
2468                                                         ev->key_type, pin_len);
2469
2470         hci_dev_unlock(hdev);
2471 }
2472
2473 static inline void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
2474 {
2475         struct hci_ev_clock_offset *ev = (void *) skb->data;
2476         struct hci_conn *conn;
2477
2478         BT_DBG("%s status %d", hdev->name, ev->status);
2479
2480         hci_dev_lock(hdev);
2481
2482         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2483         if (conn && !ev->status) {
2484                 struct inquiry_entry *ie;
2485
2486                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
2487                 if (ie) {
2488                         ie->data.clock_offset = ev->clock_offset;
2489                         ie->timestamp = jiffies;
2490                 }
2491         }
2492
2493         hci_dev_unlock(hdev);
2494 }
2495
2496 static inline void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2497 {
2498         struct hci_ev_pkt_type_change *ev = (void *) skb->data;
2499         struct hci_conn *conn;
2500
2501         BT_DBG("%s status %d", hdev->name, ev->status);
2502
2503         hci_dev_lock(hdev);
2504
2505         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2506         if (conn && !ev->status)
2507                 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
2508
2509         hci_dev_unlock(hdev);
2510 }
2511
2512 static inline void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
2513 {
2514         struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
2515         struct inquiry_entry *ie;
2516
2517         BT_DBG("%s", hdev->name);
2518
2519         hci_dev_lock(hdev);
2520
2521         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2522         if (ie) {
2523                 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
2524                 ie->timestamp = jiffies;
2525         }
2526
2527         hci_dev_unlock(hdev);
2528 }
2529
2530 static inline void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, struct sk_buff *skb)
2531 {
2532         struct inquiry_data data;
2533         int num_rsp = *((__u8 *) skb->data);
2534
2535         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2536
2537         if (!num_rsp)
2538                 return;
2539
2540         hci_dev_lock(hdev);
2541
2542         if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
2543                 struct inquiry_info_with_rssi_and_pscan_mode *info;
2544                 info = (void *) (skb->data + 1);
2545
2546                 for (; num_rsp; num_rsp--, info++) {
2547                         bacpy(&data.bdaddr, &info->bdaddr);
2548                         data.pscan_rep_mode     = info->pscan_rep_mode;
2549                         data.pscan_period_mode  = info->pscan_period_mode;
2550                         data.pscan_mode         = info->pscan_mode;
2551                         memcpy(data.dev_class, info->dev_class, 3);
2552                         data.clock_offset       = info->clock_offset;
2553                         data.rssi               = info->rssi;
2554                         data.ssp_mode           = 0x00;
2555                         hci_inquiry_cache_update(hdev, &data);
2556                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2557                                                 info->dev_class, info->rssi,
2558                                                 NULL);
2559                 }
2560         } else {
2561                 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
2562
2563                 for (; num_rsp; num_rsp--, info++) {
2564                         bacpy(&data.bdaddr, &info->bdaddr);
2565                         data.pscan_rep_mode     = info->pscan_rep_mode;
2566                         data.pscan_period_mode  = info->pscan_period_mode;
2567                         data.pscan_mode         = 0x00;
2568                         memcpy(data.dev_class, info->dev_class, 3);
2569                         data.clock_offset       = info->clock_offset;
2570                         data.rssi               = info->rssi;
2571                         data.ssp_mode           = 0x00;
2572                         hci_inquiry_cache_update(hdev, &data);
2573                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2574                                                 info->dev_class, info->rssi,
2575                                                 NULL);
2576                 }
2577         }
2578
2579         hci_dev_unlock(hdev);
2580 }
2581
2582 static inline void hci_remote_ext_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
2583 {
2584         struct hci_ev_remote_ext_features *ev = (void *) skb->data;
2585         struct hci_conn *conn;
2586
2587         BT_DBG("%s", hdev->name);
2588
2589         hci_dev_lock(hdev);
2590
2591         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2592         if (!conn)
2593                 goto unlock;
2594
2595         if (!ev->status && ev->page == 0x01) {
2596                 struct inquiry_entry *ie;
2597
2598                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
2599                 if (ie)
2600                         ie->data.ssp_mode = (ev->features[0] & 0x01);
2601
2602                 conn->ssp_mode = (ev->features[0] & 0x01);
2603         }
2604
2605         if (conn->state != BT_CONFIG)
2606                 goto unlock;
2607
2608         if (!ev->status) {
2609                 struct hci_cp_remote_name_req cp;
2610                 memset(&cp, 0, sizeof(cp));
2611                 bacpy(&cp.bdaddr, &conn->dst);
2612                 cp.pscan_rep_mode = 0x02;
2613                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2614         }
2615
2616         if (!hci_outgoing_auth_needed(hdev, conn)) {
2617                 conn->state = BT_CONNECTED;
2618                 hci_proto_connect_cfm(conn, ev->status);
2619                 hci_conn_put(conn);
2620         }
2621
2622 unlock:
2623         hci_dev_unlock(hdev);
2624 }
2625
2626 static inline void hci_sync_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2627 {
2628         struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
2629         struct hci_conn *conn;
2630
2631         BT_DBG("%s status %d", hdev->name, ev->status);
2632
2633         hci_dev_lock(hdev);
2634
2635         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
2636         if (!conn) {
2637                 if (ev->link_type == ESCO_LINK)
2638                         goto unlock;
2639
2640                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
2641                 if (!conn)
2642                         goto unlock;
2643
2644                 conn->type = SCO_LINK;
2645         }
2646
2647         switch (ev->status) {
2648         case 0x00:
2649                 conn->handle = __le16_to_cpu(ev->handle);
2650                 conn->state  = BT_CONNECTED;
2651
2652                 hci_conn_hold_device(conn);
2653                 hci_conn_add_sysfs(conn);
2654                 break;
2655
2656         case 0x11:      /* Unsupported Feature or Parameter Value */
2657         case 0x1c:      /* SCO interval rejected */
2658         case 0x1a:      /* Unsupported Remote Feature */
2659         case 0x1f:      /* Unspecified error */
2660                 if (conn->out && conn->attempt < 2) {
2661                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
2662                                         (hdev->esco_type & EDR_ESCO_MASK);
2663                         hci_setup_sync(conn, conn->link->handle);
2664                         goto unlock;
2665                 }
2666                 /* fall through */
2667
2668         default:
2669                 conn->state = BT_CLOSED;
2670                 break;
2671         }
2672
2673         hci_proto_connect_cfm(conn, ev->status);
2674         if (ev->status)
2675                 hci_conn_del(conn);
2676
2677 unlock:
2678         hci_dev_unlock(hdev);
2679 }
2680
2681 static inline void hci_sync_conn_changed_evt(struct hci_dev *hdev, struct sk_buff *skb)
2682 {
2683         BT_DBG("%s", hdev->name);
2684 }
2685
2686 static inline void hci_sniff_subrate_evt(struct hci_dev *hdev, struct sk_buff *skb)
2687 {
2688         struct hci_ev_sniff_subrate *ev = (void *) skb->data;
2689
2690         BT_DBG("%s status %d", hdev->name, ev->status);
2691 }
2692
2693 static inline void hci_extended_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
2694 {
2695         struct inquiry_data data;
2696         struct extended_inquiry_info *info = (void *) (skb->data + 1);
2697         int num_rsp = *((__u8 *) skb->data);
2698
2699         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2700
2701         if (!num_rsp)
2702                 return;
2703
2704         hci_dev_lock(hdev);
2705
2706         for (; num_rsp; num_rsp--, info++) {
2707                 bacpy(&data.bdaddr, &info->bdaddr);
2708                 data.pscan_rep_mode     = info->pscan_rep_mode;
2709                 data.pscan_period_mode  = info->pscan_period_mode;
2710                 data.pscan_mode         = 0x00;
2711                 memcpy(data.dev_class, info->dev_class, 3);
2712                 data.clock_offset       = info->clock_offset;
2713                 data.rssi               = info->rssi;
2714                 data.ssp_mode           = 0x01;
2715                 hci_inquiry_cache_update(hdev, &data);
2716                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2717                                 info->dev_class, info->rssi, info->data);
2718         }
2719
2720         hci_dev_unlock(hdev);
2721 }
2722
2723 static inline u8 hci_get_auth_req(struct hci_conn *conn)
2724 {
2725         /* If remote requests dedicated bonding follow that lead */
2726         if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03) {
2727                 /* If both remote and local IO capabilities allow MITM
2728                  * protection then require it, otherwise don't */
2729                 if (conn->remote_cap == 0x03 || conn->io_capability == 0x03)
2730                         return 0x02;
2731                 else
2732                         return 0x03;
2733         }
2734
2735         /* If remote requests no-bonding follow that lead */
2736         if (conn->remote_auth == 0x00 || conn->remote_auth == 0x01)
2737                 return conn->remote_auth | (conn->auth_type & 0x01);
2738
2739         return conn->auth_type;
2740 }
2741
2742 static inline void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2743 {
2744         struct hci_ev_io_capa_request *ev = (void *) skb->data;
2745         struct hci_conn *conn;
2746
2747         BT_DBG("%s", hdev->name);
2748
2749         hci_dev_lock(hdev);
2750
2751         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2752         if (!conn)
2753                 goto unlock;
2754
2755         hci_conn_hold(conn);
2756
2757         if (!test_bit(HCI_MGMT, &hdev->flags))
2758                 goto unlock;
2759
2760         if (test_bit(HCI_PAIRABLE, &hdev->flags) ||
2761                         (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
2762                 struct hci_cp_io_capability_reply cp;
2763
2764                 bacpy(&cp.bdaddr, &ev->bdaddr);
2765                 cp.capability = conn->io_capability;
2766                 conn->auth_type = hci_get_auth_req(conn);
2767                 cp.authentication = conn->auth_type;
2768
2769                 if ((conn->out == 0x01 || conn->remote_oob == 0x01) &&
2770                                 hci_find_remote_oob_data(hdev, &conn->dst))
2771                         cp.oob_data = 0x01;
2772                 else
2773                         cp.oob_data = 0x00;
2774
2775                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
2776                                                         sizeof(cp), &cp);
2777         } else {
2778                 struct hci_cp_io_capability_neg_reply cp;
2779
2780                 bacpy(&cp.bdaddr, &ev->bdaddr);
2781                 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
2782
2783                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
2784                                                         sizeof(cp), &cp);
2785         }
2786
2787 unlock:
2788         hci_dev_unlock(hdev);
2789 }
2790
2791 static inline void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
2792 {
2793         struct hci_ev_io_capa_reply *ev = (void *) skb->data;
2794         struct hci_conn *conn;
2795
2796         BT_DBG("%s", hdev->name);
2797
2798         hci_dev_lock(hdev);
2799
2800         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2801         if (!conn)
2802                 goto unlock;
2803
2804         conn->remote_cap = ev->capability;
2805         conn->remote_oob = ev->oob_data;
2806         conn->remote_auth = ev->authentication;
2807
2808 unlock:
2809         hci_dev_unlock(hdev);
2810 }
2811
2812 static inline void hci_user_confirm_request_evt(struct hci_dev *hdev,
2813                                                         struct sk_buff *skb)
2814 {
2815         struct hci_ev_user_confirm_req *ev = (void *) skb->data;
2816         int loc_mitm, rem_mitm, confirm_hint = 0;
2817         struct hci_conn *conn;
2818
2819         BT_DBG("%s", hdev->name);
2820
2821         hci_dev_lock(hdev);
2822
2823         if (!test_bit(HCI_MGMT, &hdev->flags))
2824                 goto unlock;
2825
2826         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2827         if (!conn)
2828                 goto unlock;
2829
2830         loc_mitm = (conn->auth_type & 0x01);
2831         rem_mitm = (conn->remote_auth & 0x01);
2832
2833         /* If we require MITM but the remote device can't provide that
2834          * (it has NoInputNoOutput) then reject the confirmation
2835          * request. The only exception is when we're dedicated bonding
2836          * initiators (connect_cfm_cb set) since then we always have the MITM
2837          * bit set. */
2838         if (!conn->connect_cfm_cb && loc_mitm && conn->remote_cap == 0x03) {
2839                 BT_DBG("Rejecting request: remote device can't provide MITM");
2840                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
2841                                         sizeof(ev->bdaddr), &ev->bdaddr);
2842                 goto unlock;
2843         }
2844
2845         /* If no side requires MITM protection; auto-accept */
2846         if ((!loc_mitm || conn->remote_cap == 0x03) &&
2847                                 (!rem_mitm || conn->io_capability == 0x03)) {
2848
2849                 /* If we're not the initiators request authorization to
2850                  * proceed from user space (mgmt_user_confirm with
2851                  * confirm_hint set to 1). */
2852                 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
2853                         BT_DBG("Confirming auto-accept as acceptor");
2854                         confirm_hint = 1;
2855                         goto confirm;
2856                 }
2857
2858                 BT_DBG("Auto-accept of user confirmation with %ums delay",
2859                                                 hdev->auto_accept_delay);
2860
2861                 if (hdev->auto_accept_delay > 0) {
2862                         int delay = msecs_to_jiffies(hdev->auto_accept_delay);
2863                         mod_timer(&conn->auto_accept_timer, jiffies + delay);
2864                         goto unlock;
2865                 }
2866
2867                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
2868                                                 sizeof(ev->bdaddr), &ev->bdaddr);
2869                 goto unlock;
2870         }
2871
2872 confirm:
2873         mgmt_user_confirm_request(hdev, &ev->bdaddr, ev->passkey,
2874                                                                 confirm_hint);
2875
2876 unlock:
2877         hci_dev_unlock(hdev);
2878 }
2879
2880 static inline void hci_user_passkey_request_evt(struct hci_dev *hdev,
2881                                                         struct sk_buff *skb)
2882 {
2883         struct hci_ev_user_passkey_req *ev = (void *) skb->data;
2884
2885         BT_DBG("%s", hdev->name);
2886
2887         hci_dev_lock(hdev);
2888
2889         if (test_bit(HCI_MGMT, &hdev->flags))
2890                 mgmt_user_passkey_request(hdev, &ev->bdaddr);
2891
2892         hci_dev_unlock(hdev);
2893 }
2894
2895 static inline void hci_simple_pair_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2896 {
2897         struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
2898         struct hci_conn *conn;
2899
2900         BT_DBG("%s", hdev->name);
2901
2902         hci_dev_lock(hdev);
2903
2904         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2905         if (!conn)
2906                 goto unlock;
2907
2908         /* To avoid duplicate auth_failed events to user space we check
2909          * the HCI_CONN_AUTH_PEND flag which will be set if we
2910          * initiated the authentication. A traditional auth_complete
2911          * event gets always produced as initiator and is also mapped to
2912          * the mgmt_auth_failed event */
2913         if (!test_bit(HCI_CONN_AUTH_PEND, &conn->pend) && ev->status != 0)
2914                 mgmt_auth_failed(hdev, &conn->dst, ev->status);
2915
2916         hci_conn_put(conn);
2917
2918 unlock:
2919         hci_dev_unlock(hdev);
2920 }
2921
2922 static inline void hci_remote_host_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
2923 {
2924         struct hci_ev_remote_host_features *ev = (void *) skb->data;
2925         struct inquiry_entry *ie;
2926
2927         BT_DBG("%s", hdev->name);
2928
2929         hci_dev_lock(hdev);
2930
2931         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2932         if (ie)
2933                 ie->data.ssp_mode = (ev->features[0] & 0x01);
2934
2935         hci_dev_unlock(hdev);
2936 }
2937
2938 static inline void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
2939                                                         struct sk_buff *skb)
2940 {
2941         struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
2942         struct oob_data *data;
2943
2944         BT_DBG("%s", hdev->name);
2945
2946         hci_dev_lock(hdev);
2947
2948         if (!test_bit(HCI_MGMT, &hdev->flags))
2949                 goto unlock;
2950
2951         data = hci_find_remote_oob_data(hdev, &ev->bdaddr);
2952         if (data) {
2953                 struct hci_cp_remote_oob_data_reply cp;
2954
2955                 bacpy(&cp.bdaddr, &ev->bdaddr);
2956                 memcpy(cp.hash, data->hash, sizeof(cp.hash));
2957                 memcpy(cp.randomizer, data->randomizer, sizeof(cp.randomizer));
2958
2959                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY, sizeof(cp),
2960                                                                         &cp);
2961         } else {
2962                 struct hci_cp_remote_oob_data_neg_reply cp;
2963
2964                 bacpy(&cp.bdaddr, &ev->bdaddr);
2965                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY, sizeof(cp),
2966                                                                         &cp);
2967         }
2968
2969 unlock:
2970         hci_dev_unlock(hdev);
2971 }
2972
2973 static inline void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2974 {
2975         struct hci_ev_le_conn_complete *ev = (void *) skb->data;
2976         struct hci_conn *conn;
2977
2978         BT_DBG("%s status %d", hdev->name, ev->status);
2979
2980         hci_dev_lock(hdev);
2981
2982         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &ev->bdaddr);
2983         if (!conn) {
2984                 conn = hci_conn_add(hdev, LE_LINK, &ev->bdaddr);
2985                 if (!conn) {
2986                         BT_ERR("No memory for new connection");
2987                         hci_dev_unlock(hdev);
2988                         return;
2989                 }
2990
2991                 conn->dst_type = ev->bdaddr_type;
2992         }
2993
2994         if (ev->status) {
2995                 mgmt_connect_failed(hdev, &ev->bdaddr, conn->type,
2996                                                 conn->dst_type, ev->status);
2997                 hci_proto_connect_cfm(conn, ev->status);
2998                 conn->state = BT_CLOSED;
2999                 hci_conn_del(conn);
3000                 goto unlock;
3001         }
3002
3003         mgmt_connected(hdev, &ev->bdaddr, conn->type, conn->dst_type);
3004
3005         conn->sec_level = BT_SECURITY_LOW;
3006         conn->handle = __le16_to_cpu(ev->handle);
3007         conn->state = BT_CONNECTED;
3008
3009         hci_conn_hold_device(conn);
3010         hci_conn_add_sysfs(conn);
3011
3012         hci_proto_connect_cfm(conn, ev->status);
3013
3014 unlock:
3015         hci_dev_unlock(hdev);
3016 }
3017
3018 static inline void hci_le_adv_report_evt(struct hci_dev *hdev,
3019                                                 struct sk_buff *skb)
3020 {
3021         u8 num_reports = skb->data[0];
3022         void *ptr = &skb->data[1];
3023
3024         hci_dev_lock(hdev);
3025
3026         while (num_reports--) {
3027                 struct hci_ev_le_advertising_info *ev = ptr;
3028
3029                 hci_add_adv_entry(hdev, ev);
3030
3031                 ptr += sizeof(*ev) + ev->length + 1;
3032         }
3033
3034         hci_dev_unlock(hdev);
3035 }
3036
3037 static inline void hci_le_ltk_request_evt(struct hci_dev *hdev,
3038                                                 struct sk_buff *skb)
3039 {
3040         struct hci_ev_le_ltk_req *ev = (void *) skb->data;
3041         struct hci_cp_le_ltk_reply cp;
3042         struct hci_cp_le_ltk_neg_reply neg;
3043         struct hci_conn *conn;
3044         struct link_key *ltk;
3045
3046         BT_DBG("%s handle %d", hdev->name, cpu_to_le16(ev->handle));
3047
3048         hci_dev_lock(hdev);
3049
3050         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3051         if (conn == NULL)
3052                 goto not_found;
3053
3054         ltk = hci_find_ltk(hdev, ev->ediv, ev->random);
3055         if (ltk == NULL)
3056                 goto not_found;
3057
3058         memcpy(cp.ltk, ltk->val, sizeof(ltk->val));
3059         cp.handle = cpu_to_le16(conn->handle);
3060         conn->pin_length = ltk->pin_len;
3061
3062         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
3063
3064         hci_dev_unlock(hdev);
3065
3066         return;
3067
3068 not_found:
3069         neg.handle = ev->handle;
3070         hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
3071         hci_dev_unlock(hdev);
3072 }
3073
3074 static inline void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
3075 {
3076         struct hci_ev_le_meta *le_ev = (void *) skb->data;
3077
3078         skb_pull(skb, sizeof(*le_ev));
3079
3080         switch (le_ev->subevent) {
3081         case HCI_EV_LE_CONN_COMPLETE:
3082                 hci_le_conn_complete_evt(hdev, skb);
3083                 break;
3084
3085         case HCI_EV_LE_ADVERTISING_REPORT:
3086                 hci_le_adv_report_evt(hdev, skb);
3087                 break;
3088
3089         case HCI_EV_LE_LTK_REQ:
3090                 hci_le_ltk_request_evt(hdev, skb);
3091                 break;
3092
3093         default:
3094                 break;
3095         }
3096 }
3097
3098 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
3099 {
3100         struct hci_event_hdr *hdr = (void *) skb->data;
3101         __u8 event = hdr->evt;
3102
3103         skb_pull(skb, HCI_EVENT_HDR_SIZE);
3104
3105         switch (event) {
3106         case HCI_EV_INQUIRY_COMPLETE:
3107                 hci_inquiry_complete_evt(hdev, skb);
3108                 break;
3109
3110         case HCI_EV_INQUIRY_RESULT:
3111                 hci_inquiry_result_evt(hdev, skb);
3112                 break;
3113
3114         case HCI_EV_CONN_COMPLETE:
3115                 hci_conn_complete_evt(hdev, skb);
3116                 break;
3117
3118         case HCI_EV_CONN_REQUEST:
3119                 hci_conn_request_evt(hdev, skb);
3120                 break;
3121
3122         case HCI_EV_DISCONN_COMPLETE:
3123                 hci_disconn_complete_evt(hdev, skb);
3124                 break;
3125
3126         case HCI_EV_AUTH_COMPLETE:
3127                 hci_auth_complete_evt(hdev, skb);
3128                 break;
3129
3130         case HCI_EV_REMOTE_NAME:
3131                 hci_remote_name_evt(hdev, skb);
3132                 break;
3133
3134         case HCI_EV_ENCRYPT_CHANGE:
3135                 hci_encrypt_change_evt(hdev, skb);
3136                 break;
3137
3138         case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
3139                 hci_change_link_key_complete_evt(hdev, skb);
3140                 break;
3141
3142         case HCI_EV_REMOTE_FEATURES:
3143                 hci_remote_features_evt(hdev, skb);
3144                 break;
3145
3146         case HCI_EV_REMOTE_VERSION:
3147                 hci_remote_version_evt(hdev, skb);
3148                 break;
3149
3150         case HCI_EV_QOS_SETUP_COMPLETE:
3151                 hci_qos_setup_complete_evt(hdev, skb);
3152                 break;
3153
3154         case HCI_EV_CMD_COMPLETE:
3155                 hci_cmd_complete_evt(hdev, skb);
3156                 break;
3157
3158         case HCI_EV_CMD_STATUS:
3159                 hci_cmd_status_evt(hdev, skb);
3160                 break;
3161
3162         case HCI_EV_ROLE_CHANGE:
3163                 hci_role_change_evt(hdev, skb);
3164                 break;
3165
3166         case HCI_EV_NUM_COMP_PKTS:
3167                 hci_num_comp_pkts_evt(hdev, skb);
3168                 break;
3169
3170         case HCI_EV_MODE_CHANGE:
3171                 hci_mode_change_evt(hdev, skb);
3172                 break;
3173
3174         case HCI_EV_PIN_CODE_REQ:
3175                 hci_pin_code_request_evt(hdev, skb);
3176                 break;
3177
3178         case HCI_EV_LINK_KEY_REQ:
3179                 hci_link_key_request_evt(hdev, skb);
3180                 break;
3181
3182         case HCI_EV_LINK_KEY_NOTIFY:
3183                 hci_link_key_notify_evt(hdev, skb);
3184                 break;
3185
3186         case HCI_EV_CLOCK_OFFSET:
3187                 hci_clock_offset_evt(hdev, skb);
3188                 break;
3189
3190         case HCI_EV_PKT_TYPE_CHANGE:
3191                 hci_pkt_type_change_evt(hdev, skb);
3192                 break;
3193
3194         case HCI_EV_PSCAN_REP_MODE:
3195                 hci_pscan_rep_mode_evt(hdev, skb);
3196                 break;
3197
3198         case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
3199                 hci_inquiry_result_with_rssi_evt(hdev, skb);
3200                 break;
3201
3202         case HCI_EV_REMOTE_EXT_FEATURES:
3203                 hci_remote_ext_features_evt(hdev, skb);
3204                 break;
3205
3206         case HCI_EV_SYNC_CONN_COMPLETE:
3207                 hci_sync_conn_complete_evt(hdev, skb);
3208                 break;
3209
3210         case HCI_EV_SYNC_CONN_CHANGED:
3211                 hci_sync_conn_changed_evt(hdev, skb);
3212                 break;
3213
3214         case HCI_EV_SNIFF_SUBRATE:
3215                 hci_sniff_subrate_evt(hdev, skb);
3216                 break;
3217
3218         case HCI_EV_EXTENDED_INQUIRY_RESULT:
3219                 hci_extended_inquiry_result_evt(hdev, skb);
3220                 break;
3221
3222         case HCI_EV_IO_CAPA_REQUEST:
3223                 hci_io_capa_request_evt(hdev, skb);
3224                 break;
3225
3226         case HCI_EV_IO_CAPA_REPLY:
3227                 hci_io_capa_reply_evt(hdev, skb);
3228                 break;
3229
3230         case HCI_EV_USER_CONFIRM_REQUEST:
3231                 hci_user_confirm_request_evt(hdev, skb);
3232                 break;
3233
3234         case HCI_EV_USER_PASSKEY_REQUEST:
3235                 hci_user_passkey_request_evt(hdev, skb);
3236                 break;
3237
3238         case HCI_EV_SIMPLE_PAIR_COMPLETE:
3239                 hci_simple_pair_complete_evt(hdev, skb);
3240                 break;
3241
3242         case HCI_EV_REMOTE_HOST_FEATURES:
3243                 hci_remote_host_features_evt(hdev, skb);
3244                 break;
3245
3246         case HCI_EV_LE_META:
3247                 hci_le_meta_evt(hdev, skb);
3248                 break;
3249
3250         case HCI_EV_REMOTE_OOB_DATA_REQUEST:
3251                 hci_remote_oob_data_request_evt(hdev, skb);
3252                 break;
3253
3254         default:
3255                 BT_DBG("%s event 0x%x", hdev->name, event);
3256                 break;
3257         }
3258
3259         kfree_skb(skb);
3260         hdev->stat.evt_rx++;
3261 }
3262
3263 /* Generate internal stack event */
3264 void hci_si_event(struct hci_dev *hdev, int type, int dlen, void *data)
3265 {
3266         struct hci_event_hdr *hdr;
3267         struct hci_ev_stack_internal *ev;
3268         struct sk_buff *skb;
3269
3270         skb = bt_skb_alloc(HCI_EVENT_HDR_SIZE + sizeof(*ev) + dlen, GFP_ATOMIC);
3271         if (!skb)
3272                 return;
3273
3274         hdr = (void *) skb_put(skb, HCI_EVENT_HDR_SIZE);
3275         hdr->evt  = HCI_EV_STACK_INTERNAL;
3276         hdr->plen = sizeof(*ev) + dlen;
3277
3278         ev  = (void *) skb_put(skb, sizeof(*ev) + dlen);
3279         ev->type = type;
3280         memcpy(ev->data, data, dlen);
3281
3282         bt_cb(skb)->incoming = 1;
3283         __net_timestamp(skb);
3284
3285         bt_cb(skb)->pkt_type = HCI_EVENT_PKT;
3286         skb->dev = (void *) hdev;
3287         hci_send_to_sock(hdev, skb, NULL);
3288         kfree_skb(skb);
3289 }
3290
3291 module_param(enable_le, bool, 0644);
3292 MODULE_PARM_DESC(enable_le, "Enable LE support");