net/bluetooth/hci_event.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI event handling. */
  26
  27 #include <linux/module.h>
  28
  29 #include <linux/types.h>
  30 #include <linux/errno.h>
  31 #include <linux/kernel.h>
  32 #include <linux/slab.h>
  33 #include <linux/poll.h>
  34 #include <linux/fcntl.h>
  35 #include <linux/init.h>
  36 #include <linux/skbuff.h>
  37 #include <linux/interrupt.h>
  38 #include <net/sock.h>
  39
  40 #include <asm/system.h>
  41 #include <linux/uaccess.h>
  42 #include <asm/unaligned.h>
  43
  44 #include <net/bluetooth/bluetooth.h>
  45 #include <net/bluetooth/hci_core.h>
  46
  47 /* Handle HCI Event packets */
  48
  49 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
  50 {
  51         __u8 status = *((__u8 *) skb->data);
  52
  53         BT_DBG("%s status 0x%x", hdev->name, status);
  54
  55         if (status) {
  56                 hci_dev_lock(hdev);
  57                 mgmt_stop_discovery_failed(hdev, status);
  58                 hci_dev_unlock(hdev);
  59                 return;
  60         }
  61
  62         clear_bit(HCI_INQUIRY, &hdev->flags);
  63
  64         hci_dev_lock(hdev);
  65         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
  66         hci_dev_unlock(hdev);
  67
  68         hci_req_complete(hdev, HCI_OP_INQUIRY_CANCEL, status);
  69
  70         hci_conn_check_pending(hdev);
  71 }
  72
  73 static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  74 {
  75         __u8 status = *((__u8 *) skb->data);
  76
  77         BT_DBG("%s status 0x%x", hdev->name, status);
  78
  79         if (status)
  80                 return;
  81
  82         hci_conn_check_pending(hdev);
  83 }
  84
  85 static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev, struct sk_buff *skb)
  86 {
  87         BT_DBG("%s", hdev->name);
  88 }
  89
  90 static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
  91 {
  92         struct hci_rp_role_discovery *rp = (void *) skb->data;
  93         struct hci_conn *conn;
  94
  95         BT_DBG("%s status 0x%x", hdev->name, rp->status);
  96
  97         if (rp->status)
  98                 return;
  99
 100         hci_dev_lock(hdev);
 101
 102         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 103         if (conn) {
 104                 if (rp->role)
 105                         conn->link_mode &= ~HCI_LM_MASTER;
 106                 else
 107                         conn->link_mode |= HCI_LM_MASTER;
 108         }
 109
 110         hci_dev_unlock(hdev);
 111 }
 112
 113 static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 114 {
 115         struct hci_rp_read_link_policy *rp = (void *) skb->data;
 116         struct hci_conn *conn;
 117
 118         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 119
 120         if (rp->status)
 121                 return;
 122
 123         hci_dev_lock(hdev);
 124
 125         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 126         if (conn)
 127                 conn->link_policy = __le16_to_cpu(rp->policy);
 128
 129         hci_dev_unlock(hdev);
 130 }
 131
 132 static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 133 {
 134         struct hci_rp_write_link_policy *rp = (void *) skb->data;
 135         struct hci_conn *conn;
 136         void *sent;
 137
 138         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 139
 140         if (rp->status)
 141                 return;
 142
 143         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
 144         if (!sent)
 145                 return;
 146
 147         hci_dev_lock(hdev);
 148
 149         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 150         if (conn)
 151                 conn->link_policy = get_unaligned_le16(sent + 2);
 152
 153         hci_dev_unlock(hdev);
 154 }
 155
 156 static void hci_cc_read_def_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 157 {
 158         struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
 159
 160         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 161
 162         if (rp->status)
 163                 return;
 164
 165         hdev->link_policy = __le16_to_cpu(rp->policy);
 166 }
 167
 168 static void hci_cc_write_def_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 169 {
 170         __u8 status = *((__u8 *) skb->data);
 171         void *sent;
 172
 173         BT_DBG("%s status 0x%x", hdev->name, status);
 174
 175         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
 176         if (!sent)
 177                 return;
 178
 179         if (!status)
 180                 hdev->link_policy = get_unaligned_le16(sent);
 181
 182         hci_req_complete(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, status);
 183 }
 184
 185 static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
 186 {
 187         __u8 status = *((__u8 *) skb->data);
 188
 189         BT_DBG("%s status 0x%x", hdev->name, status);
 190
 191         clear_bit(HCI_RESET, &hdev->flags);
 192
 193         hci_req_complete(hdev, HCI_OP_RESET, status);
 194
 195         /* Reset all non-persistent flags */
 196         hdev->dev_flags &= ~(BIT(HCI_LE_SCAN));
 197 }
 198
 199 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 200 {
 201         __u8 status = *((__u8 *) skb->data);
 202         void *sent;
 203
 204         BT_DBG("%s status 0x%x", hdev->name, status);
 205
 206         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
 207         if (!sent)
 208                 return;
 209
 210         hci_dev_lock(hdev);
 211
 212         if (status == 0)
 213                 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
 214
 215         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 216                 mgmt_set_local_name_complete(hdev, sent, status);
 217
 218         hci_dev_unlock(hdev);
 219 }
 220
 221 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 222 {
 223         struct hci_rp_read_local_name *rp = (void *) skb->data;
 224
 225         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 226
 227         if (rp->status)
 228                 return;
 229
 230         memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
 231 }
 232
 233 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
 234 {
 235         __u8 status = *((__u8 *) skb->data);
 236         void *sent;
 237
 238         BT_DBG("%s status 0x%x", hdev->name, status);
 239
 240         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
 241         if (!sent)
 242                 return;
 243
 244         if (!status) {
 245                 __u8 param = *((__u8 *) sent);
 246
 247                 if (param == AUTH_ENABLED)
 248                         set_bit(HCI_AUTH, &hdev->flags);
 249                 else
 250                         clear_bit(HCI_AUTH, &hdev->flags);
 251         }
 252
 253         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 254                 mgmt_auth_enable_complete(hdev, status);
 255
 256         hci_req_complete(hdev, HCI_OP_WRITE_AUTH_ENABLE, status);
 257 }
 258
 259 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
 260 {
 261         __u8 status = *((__u8 *) skb->data);
 262         void *sent;
 263
 264         BT_DBG("%s status 0x%x", hdev->name, status);
 265
 266         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
 267         if (!sent)
 268                 return;
 269
 270         if (!status) {
 271                 __u8 param = *((__u8 *) sent);
 272
 273                 if (param)
 274                         set_bit(HCI_ENCRYPT, &hdev->flags);
 275                 else
 276                         clear_bit(HCI_ENCRYPT, &hdev->flags);
 277         }
 278
 279         hci_req_complete(hdev, HCI_OP_WRITE_ENCRYPT_MODE, status);
 280 }
 281
 282 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
 283 {
 284         __u8 param, status = *((__u8 *) skb->data);
 285         int old_pscan, old_iscan;
 286         void *sent;
 287
 288         BT_DBG("%s status 0x%x", hdev->name, status);
 289
 290         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
 291         if (!sent)
 292                 return;
 293
 294         param = *((__u8 *) sent);
 295
 296         hci_dev_lock(hdev);
 297
 298         if (status != 0) {
 299                 mgmt_write_scan_failed(hdev, param, status);
 300                 hdev->discov_timeout = 0;
 301                 goto done;
 302         }
 303
 304         old_pscan = test_and_clear_bit(HCI_PSCAN, &hdev->flags);
 305         old_iscan = test_and_clear_bit(HCI_ISCAN, &hdev->flags);
 306
 307         if (param & SCAN_INQUIRY) {
 308                 set_bit(HCI_ISCAN, &hdev->flags);
 309                 if (!old_iscan)
 310                         mgmt_discoverable(hdev, 1);
 311                 if (hdev->discov_timeout > 0) {
 312                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
 313                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
 314                                                                         to);
 315                 }
 316         } else if (old_iscan)
 317                 mgmt_discoverable(hdev, 0);
 318
 319         if (param & SCAN_PAGE) {
 320                 set_bit(HCI_PSCAN, &hdev->flags);
 321                 if (!old_pscan)
 322                         mgmt_connectable(hdev, 1);
 323         } else if (old_pscan)
 324                 mgmt_connectable(hdev, 0);
 325
 326 done:
 327         hci_dev_unlock(hdev);
 328         hci_req_complete(hdev, HCI_OP_WRITE_SCAN_ENABLE, status);
 329 }
 330
 331 static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 332 {
 333         struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
 334
 335         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 336
 337         if (rp->status)
 338                 return;
 339
 340         memcpy(hdev->dev_class, rp->dev_class, 3);
 341
 342         BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
 343                 hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
 344 }
 345
 346 static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 347 {
 348         __u8 status = *((__u8 *) skb->data);
 349         void *sent;
 350
 351         BT_DBG("%s status 0x%x", hdev->name, status);
 352
 353         if (status)
 354                 return;
 355
 356         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
 357         if (!sent)
 358                 return;
 359
 360         memcpy(hdev->dev_class, sent, 3);
 361 }
 362
 363 static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 364 {
 365         struct hci_rp_read_voice_setting *rp = (void *) skb->data;
 366         __u16 setting;
 367
 368         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 369
 370         if (rp->status)
 371                 return;
 372
 373         setting = __le16_to_cpu(rp->voice_setting);
 374
 375         if (hdev->voice_setting == setting)
 376                 return;
 377
 378         hdev->voice_setting = setting;
 379
 380         BT_DBG("%s voice setting 0x%04x", hdev->name, setting);
 381
 382         if (hdev->notify)
 383                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 384 }
 385
 386 static void hci_cc_write_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 387 {
 388         __u8 status = *((__u8 *) skb->data);
 389         __u16 setting;
 390         void *sent;
 391
 392         BT_DBG("%s status 0x%x", hdev->name, status);
 393
 394         if (status)
 395                 return;
 396
 397         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
 398         if (!sent)
 399                 return;
 400
 401         setting = get_unaligned_le16(sent);
 402
 403         if (hdev->voice_setting == setting)
 404                 return;
 405
 406         hdev->voice_setting = setting;
 407
 408         BT_DBG("%s voice setting 0x%04x", hdev->name, setting);
 409
 410         if (hdev->notify)
 411                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 412 }
 413
 414 static void hci_cc_host_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 415 {
 416         __u8 status = *((__u8 *) skb->data);
 417
 418         BT_DBG("%s status 0x%x", hdev->name, status);
 419
 420         hci_req_complete(hdev, HCI_OP_HOST_BUFFER_SIZE, status);
 421 }
 422
 423 static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 424 {
 425         __u8 status = *((__u8 *) skb->data);
 426         void *sent;
 427
 428         BT_DBG("%s status 0x%x", hdev->name, status);
 429
 430         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
 431         if (!sent)
 432                 return;
 433
 434         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 435                 mgmt_ssp_enable_complete(hdev, *((u8 *) sent), status);
 436         else if (!status) {
 437                 if (*((u8 *) sent))
 438                         set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
 439                 else
 440                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
 441         }
 442 }
 443
 444 static u8 hci_get_inquiry_mode(struct hci_dev *hdev)
 445 {
 446         if (hdev->features[6] & LMP_EXT_INQ)
 447                 return 2;
 448
 449         if (hdev->features[3] & LMP_RSSI_INQ)
 450                 return 1;
 451
 452         if (hdev->manufacturer == 11 && hdev->hci_rev == 0x00 &&
 453                                                 hdev->lmp_subver == 0x0757)
 454                 return 1;
 455
 456         if (hdev->manufacturer == 15) {
 457                 if (hdev->hci_rev == 0x03 && hdev->lmp_subver == 0x6963)
 458                         return 1;
 459                 if (hdev->hci_rev == 0x09 && hdev->lmp_subver == 0x6963)
 460                         return 1;
 461                 if (hdev->hci_rev == 0x00 && hdev->lmp_subver == 0x6965)
 462                         return 1;
 463         }
 464
 465         if (hdev->manufacturer == 31 && hdev->hci_rev == 0x2005 &&
 466                                                 hdev->lmp_subver == 0x1805)
 467                 return 1;
 468
 469         return 0;
 470 }
 471
 472 static void hci_setup_inquiry_mode(struct hci_dev *hdev)
 473 {
 474         u8 mode;
 475
 476         mode = hci_get_inquiry_mode(hdev);
 477
 478         hci_send_cmd(hdev, HCI_OP_WRITE_INQUIRY_MODE, 1, &mode);
 479 }
 480
 481 static void hci_setup_event_mask(struct hci_dev *hdev)
 482 {
 483         /* The second byte is 0xff instead of 0x9f (two reserved bits
 484          * disabled) since a Broadcom 1.2 dongle doesn't respond to the
 485          * command otherwise */
 486         u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };
 487
 488         /* CSR 1.1 dongles does not accept any bitfield so don't try to set
 489          * any event mask for pre 1.2 devices */
 490         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
 491                 return;
 492
 493         events[4] |= 0x01; /* Flow Specification Complete */
 494         events[4] |= 0x02; /* Inquiry Result with RSSI */
 495         events[4] |= 0x04; /* Read Remote Extended Features Complete */
 496         events[5] |= 0x08; /* Synchronous Connection Complete */
 497         events[5] |= 0x10; /* Synchronous Connection Changed */
 498
 499         if (hdev->features[3] & LMP_RSSI_INQ)
 500                 events[4] |= 0x04; /* Inquiry Result with RSSI */
 501
 502         if (hdev->features[5] & LMP_SNIFF_SUBR)
 503                 events[5] |= 0x20; /* Sniff Subrating */
 504
 505         if (hdev->features[5] & LMP_PAUSE_ENC)
 506                 events[5] |= 0x80; /* Encryption Key Refresh Complete */
 507
 508         if (hdev->features[6] & LMP_EXT_INQ)
 509                 events[5] |= 0x40; /* Extended Inquiry Result */
 510
 511         if (hdev->features[6] & LMP_NO_FLUSH)
 512                 events[7] |= 0x01; /* Enhanced Flush Complete */
 513
 514         if (hdev->features[7] & LMP_LSTO)
 515                 events[6] |= 0x80; /* Link Supervision Timeout Changed */
 516
 517         if (hdev->features[6] & LMP_SIMPLE_PAIR) {
 518                 events[6] |= 0x01;      /* IO Capability Request */
 519                 events[6] |= 0x02;      /* IO Capability Response */
 520                 events[6] |= 0x04;      /* User Confirmation Request */
 521                 events[6] |= 0x08;      /* User Passkey Request */
 522                 events[6] |= 0x10;      /* Remote OOB Data Request */
 523                 events[6] |= 0x20;      /* Simple Pairing Complete */
 524                 events[7] |= 0x04;      /* User Passkey Notification */
 525                 events[7] |= 0x08;      /* Keypress Notification */
 526                 events[7] |= 0x10;      /* Remote Host Supported
 527                                          * Features Notification */
 528         }
 529
 530         if (hdev->features[4] & LMP_LE)
 531                 events[7] |= 0x20;      /* LE Meta-Event */
 532
 533         hci_send_cmd(hdev, HCI_OP_SET_EVENT_MASK, sizeof(events), events);
 534 }
 535
 536 static void hci_set_le_support(struct hci_dev *hdev)
 537 {
 538         struct hci_cp_write_le_host_supported cp;
 539
 540         memset(&cp, 0, sizeof(cp));
 541
 542         if (enable_le && test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
 543                 cp.le = 1;
 544                 cp.simul = !!(hdev->features[6] & LMP_SIMUL_LE_BR);
 545         }
 546
 547         hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(cp), &cp);
 548 }
 549
 550 static void hci_setup(struct hci_dev *hdev)
 551 {
 552         if (hdev->dev_type != HCI_BREDR)
 553                 return;
 554
 555         hci_setup_event_mask(hdev);
 556
 557         if (hdev->hci_ver > BLUETOOTH_VER_1_1)
 558                 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
 559
 560         if (hdev->features[6] & LMP_SIMPLE_PAIR) {
 561                 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
 562                         u8 mode = 0x01;
 563                         hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE,
 564                                                         sizeof(mode), &mode);
 565                 } else {
 566                         struct hci_cp_write_eir cp;
 567
 568                         memset(hdev->eir, 0, sizeof(hdev->eir));
 569                         memset(&cp, 0, sizeof(cp));
 570
 571                         hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 572                 }
 573         }
 574
 575         if (hdev->features[3] & LMP_RSSI_INQ)
 576                 hci_setup_inquiry_mode(hdev);
 577
 578         if (hdev->features[7] & LMP_INQ_TX_PWR)
 579                 hci_send_cmd(hdev, HCI_OP_READ_INQ_RSP_TX_POWER, 0, NULL);
 580
 581         if (hdev->features[7] & LMP_EXTFEATURES) {
 582                 struct hci_cp_read_local_ext_features cp;
 583
 584                 cp.page = 0x01;
 585                 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES,
 586                                                         sizeof(cp), &cp);
 587         }
 588
 589         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags)) {
 590                 u8 enable = 1;
 591                 hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE,
 592                                                 sizeof(enable), &enable);
 593         }
 594
 595         if (hdev->features[4] & LMP_LE)
 596                 hci_set_le_support(hdev);
 597 }
 598
 599 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
 600 {
 601         struct hci_rp_read_local_version *rp = (void *) skb->data;
 602
 603         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 604
 605         if (rp->status)
 606                 return;
 607
 608         hdev->hci_ver = rp->hci_ver;
 609         hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
 610         hdev->lmp_ver = rp->lmp_ver;
 611         hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
 612         hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
 613
 614         BT_DBG("%s manufacturer %d hci ver %d:%d", hdev->name,
 615                                         hdev->manufacturer,
 616                                         hdev->hci_ver, hdev->hci_rev);
 617
 618         if (test_bit(HCI_INIT, &hdev->flags))
 619                 hci_setup(hdev);
 620 }
 621
 622 static void hci_setup_link_policy(struct hci_dev *hdev)
 623 {
 624         u16 link_policy = 0;
 625
 626         if (hdev->features[0] & LMP_RSWITCH)
 627                 link_policy |= HCI_LP_RSWITCH;
 628         if (hdev->features[0] & LMP_HOLD)
 629                 link_policy |= HCI_LP_HOLD;
 630         if (hdev->features[0] & LMP_SNIFF)
 631                 link_policy |= HCI_LP_SNIFF;
 632         if (hdev->features[1] & LMP_PARK)
 633                 link_policy |= HCI_LP_PARK;
 634
 635         link_policy = cpu_to_le16(link_policy);
 636         hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY,
 637                                         sizeof(link_policy), &link_policy);
 638 }
 639
 640 static void hci_cc_read_local_commands(struct hci_dev *hdev, struct sk_buff *skb)
 641 {
 642         struct hci_rp_read_local_commands *rp = (void *) skb->data;
 643
 644         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 645
 646         if (rp->status)
 647                 goto done;
 648
 649         memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 650
 651         if (test_bit(HCI_INIT, &hdev->flags) && (hdev->commands[5] & 0x10))
 652                 hci_setup_link_policy(hdev);
 653
 654 done:
 655         hci_req_complete(hdev, HCI_OP_READ_LOCAL_COMMANDS, rp->status);
 656 }
 657
 658 static void hci_cc_read_local_features(struct hci_dev *hdev, struct sk_buff *skb)
 659 {
 660         struct hci_rp_read_local_features *rp = (void *) skb->data;
 661
 662         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 663
 664         if (rp->status)
 665                 return;
 666
 667         memcpy(hdev->features, rp->features, 8);
 668
 669         /* Adjust default settings according to features
 670          * supported by device. */
 671
 672         if (hdev->features[0] & LMP_3SLOT)
 673                 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 674
 675         if (hdev->features[0] & LMP_5SLOT)
 676                 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 677
 678         if (hdev->features[1] & LMP_HV2) {
 679                 hdev->pkt_type  |= (HCI_HV2);
 680                 hdev->esco_type |= (ESCO_HV2);
 681         }
 682
 683         if (hdev->features[1] & LMP_HV3) {
 684                 hdev->pkt_type  |= (HCI_HV3);
 685                 hdev->esco_type |= (ESCO_HV3);
 686         }
 687
 688         if (hdev->features[3] & LMP_ESCO)
 689                 hdev->esco_type |= (ESCO_EV3);
 690
 691         if (hdev->features[4] & LMP_EV4)
 692                 hdev->esco_type |= (ESCO_EV4);
 693
 694         if (hdev->features[4] & LMP_EV5)
 695                 hdev->esco_type |= (ESCO_EV5);
 696
 697         if (hdev->features[5] & LMP_EDR_ESCO_2M)
 698                 hdev->esco_type |= (ESCO_2EV3);
 699
 700         if (hdev->features[5] & LMP_EDR_ESCO_3M)
 701                 hdev->esco_type |= (ESCO_3EV3);
 702
 703         if (hdev->features[5] & LMP_EDR_3S_ESCO)
 704                 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
 705
 706         BT_DBG("%s features 0x%.2x%.2x%.2x%.2x%.2x%.2x%.2x%.2x", hdev->name,
 707                                         hdev->features[0], hdev->features[1],
 708                                         hdev->features[2], hdev->features[3],
 709                                         hdev->features[4], hdev->features[5],
 710                                         hdev->features[6], hdev->features[7]);
 711 }
 712
 713 static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
 714                                                         struct sk_buff *skb)
 715 {
 716         struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
 717
 718         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 719
 720         if (rp->status)
 721                 return;
 722
 723         switch (rp->page) {
 724         case 0:
 725                 memcpy(hdev->features, rp->features, 8);
 726                 break;
 727         case 1:
 728                 memcpy(hdev->host_features, rp->features, 8);
 729                 break;
 730         }
 731
 732         hci_req_complete(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES, rp->status);
 733 }
 734
 735 static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
 736                                                 struct sk_buff *skb)
 737 {
 738         struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;
 739
 740         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 741
 742         if (rp->status)
 743                 return;
 744
 745         hdev->flow_ctl_mode = rp->mode;
 746
 747         hci_req_complete(hdev, HCI_OP_READ_FLOW_CONTROL_MODE, rp->status);
 748 }
 749
 750 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 751 {
 752         struct hci_rp_read_buffer_size *rp = (void *) skb->data;
 753
 754         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 755
 756         if (rp->status)
 757                 return;
 758
 759         hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
 760         hdev->sco_mtu  = rp->sco_mtu;
 761         hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
 762         hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
 763
 764         if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
 765                 hdev->sco_mtu  = 64;
 766                 hdev->sco_pkts = 8;
 767         }
 768
 769         hdev->acl_cnt = hdev->acl_pkts;
 770         hdev->sco_cnt = hdev->sco_pkts;
 771
 772         BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name,
 773                                         hdev->acl_mtu, hdev->acl_pkts,
 774                                         hdev->sco_mtu, hdev->sco_pkts);
 775 }
 776
 777 static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
 778 {
 779         struct hci_rp_read_bd_addr *rp = (void *) skb->data;
 780
 781         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 782
 783         if (!rp->status)
 784                 bacpy(&hdev->bdaddr, &rp->bdaddr);
 785
 786         hci_req_complete(hdev, HCI_OP_READ_BD_ADDR, rp->status);
 787 }
 788
 789 static void hci_cc_read_data_block_size(struct hci_dev *hdev,
 790                                                         struct sk_buff *skb)
 791 {
 792         struct hci_rp_read_data_block_size *rp = (void *) skb->data;
 793
 794         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 795
 796         if (rp->status)
 797                 return;
 798
 799         hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
 800         hdev->block_len = __le16_to_cpu(rp->block_len);
 801         hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
 802
 803         hdev->block_cnt = hdev->num_blocks;
 804
 805         BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
 806                                         hdev->block_cnt, hdev->block_len);
 807
 808         hci_req_complete(hdev, HCI_OP_READ_DATA_BLOCK_SIZE, rp->status);
 809 }
 810
 811 static void hci_cc_write_ca_timeout(struct hci_dev *hdev, struct sk_buff *skb)
 812 {
 813         __u8 status = *((__u8 *) skb->data);
 814
 815         BT_DBG("%s status 0x%x", hdev->name, status);
 816
 817         hci_req_complete(hdev, HCI_OP_WRITE_CA_TIMEOUT, status);
 818 }
 819
 820 static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
 821                 struct sk_buff *skb)
 822 {
 823         struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
 824
 825         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 826
 827         if (rp->status)
 828                 return;
 829
 830         hdev->amp_status = rp->amp_status;
 831         hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
 832         hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
 833         hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
 834         hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
 835         hdev->amp_type = rp->amp_type;
 836         hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
 837         hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
 838         hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
 839         hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
 840
 841         hci_req_complete(hdev, HCI_OP_READ_LOCAL_AMP_INFO, rp->status);
 842 }
 843
 844 static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
 845                                                         struct sk_buff *skb)
 846 {
 847         __u8 status = *((__u8 *) skb->data);
 848
 849         BT_DBG("%s status 0x%x", hdev->name, status);
 850
 851         hci_req_complete(hdev, HCI_OP_DELETE_STORED_LINK_KEY, status);
 852 }
 853
 854 static void hci_cc_set_event_mask(struct hci_dev *hdev, struct sk_buff *skb)
 855 {
 856         __u8 status = *((__u8 *) skb->data);
 857
 858         BT_DBG("%s status 0x%x", hdev->name, status);
 859
 860         hci_req_complete(hdev, HCI_OP_SET_EVENT_MASK, status);
 861 }
 862
 863 static void hci_cc_write_inquiry_mode(struct hci_dev *hdev,
 864                                                         struct sk_buff *skb)
 865 {
 866         __u8 status = *((__u8 *) skb->data);
 867
 868         BT_DBG("%s status 0x%x", hdev->name, status);
 869
 870         hci_req_complete(hdev, HCI_OP_WRITE_INQUIRY_MODE, status);
 871 }
 872
 873 static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
 874                                                         struct sk_buff *skb)
 875 {
 876         __u8 status = *((__u8 *) skb->data);
 877
 878         BT_DBG("%s status 0x%x", hdev->name, status);
 879
 880         hci_req_complete(hdev, HCI_OP_READ_INQ_RSP_TX_POWER, status);
 881 }
 882
 883 static void hci_cc_set_event_flt(struct hci_dev *hdev, struct sk_buff *skb)
 884 {
 885         __u8 status = *((__u8 *) skb->data);
 886
 887         BT_DBG("%s status 0x%x", hdev->name, status);
 888
 889         hci_req_complete(hdev, HCI_OP_SET_EVENT_FLT, status);
 890 }
 891
 892 static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
 893 {
 894         struct hci_rp_pin_code_reply *rp = (void *) skb->data;
 895         struct hci_cp_pin_code_reply *cp;
 896         struct hci_conn *conn;
 897
 898         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 899
 900         hci_dev_lock(hdev);
 901
 902         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 903                 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
 904
 905         if (rp->status != 0)
 906                 goto unlock;
 907
 908         cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
 909         if (!cp)
 910                 goto unlock;
 911
 912         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 913         if (conn)
 914                 conn->pin_length = cp->pin_len;
 915
 916 unlock:
 917         hci_dev_unlock(hdev);
 918 }
 919
 920 static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
 921 {
 922         struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
 923
 924         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 925
 926         hci_dev_lock(hdev);
 927
 928         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 929                 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
 930                                                                 rp->status);
 931
 932         hci_dev_unlock(hdev);
 933 }
 934
 935 static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
 936                                        struct sk_buff *skb)
 937 {
 938         struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
 939
 940         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 941
 942         if (rp->status)
 943                 return;
 944
 945         hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
 946         hdev->le_pkts = rp->le_max_pkt;
 947
 948         hdev->le_cnt = hdev->le_pkts;
 949
 950         BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
 951
 952         hci_req_complete(hdev, HCI_OP_LE_READ_BUFFER_SIZE, rp->status);
 953 }
 954
 955 static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
 956 {
 957         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 958
 959         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 960
 961         hci_dev_lock(hdev);
 962
 963         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 964                 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
 965                                                                 0, rp->status);
 966
 967         hci_dev_unlock(hdev);
 968 }
 969
 970 static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
 971                                                         struct sk_buff *skb)
 972 {
 973         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 974
 975         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 976
 977         hci_dev_lock(hdev);
 978
 979         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 980                 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
 981                                                                 ACL_LINK, 0,
 982                                                                 rp->status);
 983
 984         hci_dev_unlock(hdev);
 985 }
 986
 987 static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
 988 {
 989         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 990
 991         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 992
 993         hci_dev_lock(hdev);
 994
 995         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 996                 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
 997                                                                 0, rp->status);
 998
 999         hci_dev_unlock(hdev);
1000 }
1001
1002 static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
1003                                                         struct sk_buff *skb)
1004 {
1005         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1006
1007         BT_DBG("%s status 0x%x", hdev->name, rp->status);
1008
1009         hci_dev_lock(hdev);
1010
1011         if (test_bit(HCI_MGMT, &hdev->dev_flags))
1012                 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
1013                                                                 ACL_LINK, 0,
1014                                                                 rp->status);
1015
1016         hci_dev_unlock(hdev);
1017 }
1018
1019 static void hci_cc_read_local_oob_data_reply(struct hci_dev *hdev,
1020                                                         struct sk_buff *skb)
1021 {
1022         struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
1023
1024         BT_DBG("%s status 0x%x", hdev->name, rp->status);
1025
1026         hci_dev_lock(hdev);
1027         mgmt_read_local_oob_data_reply_complete(hdev, rp->hash,
1028                                                 rp->randomizer, rp->status);
1029         hci_dev_unlock(hdev);
1030 }
1031
1032 static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
1033 {
1034         __u8 status = *((__u8 *) skb->data);
1035
1036         BT_DBG("%s status 0x%x", hdev->name, status);
1037
1038         hci_req_complete(hdev, HCI_OP_LE_SET_SCAN_PARAM, status);
1039
1040         if (status) {
1041                 hci_dev_lock(hdev);
1042                 mgmt_start_discovery_failed(hdev, status);
1043                 hci_dev_unlock(hdev);
1044                 return;
1045         }
1046 }
1047
1048 static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
1049                                         struct sk_buff *skb)
1050 {
1051         struct hci_cp_le_set_scan_enable *cp;
1052         __u8 status = *((__u8 *) skb->data);
1053
1054         BT_DBG("%s status 0x%x", hdev->name, status);
1055
1056         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
1057         if (!cp)
1058                 return;
1059
1060         switch (cp->enable) {
1061         case LE_SCANNING_ENABLED:
1062                 hci_req_complete(hdev, HCI_OP_LE_SET_SCAN_ENABLE, status);
1063
1064                 if (status) {
1065                         hci_dev_lock(hdev);
1066                         mgmt_start_discovery_failed(hdev, status);
1067                         hci_dev_unlock(hdev);
1068                         return;
1069                 }
1070
1071                 set_bit(HCI_LE_SCAN, &hdev->dev_flags);
1072
1073                 cancel_delayed_work_sync(&hdev->adv_work);
1074
1075                 hci_dev_lock(hdev);
1076                 hci_adv_entries_clear(hdev);
1077                 hci_discovery_set_state(hdev, DISCOVERY_FINDING);
1078                 hci_dev_unlock(hdev);
1079                 break;
1080
1081         case LE_SCANNING_DISABLED:
1082                 if (status)
1083                         return;
1084
1085                 clear_bit(HCI_LE_SCAN, &hdev->dev_flags);
1086
1087                 schedule_delayed_work(&hdev->adv_work, ADV_CLEAR_TIMEOUT);
1088
1089                 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED) {
1090                         mgmt_interleaved_discovery(hdev);
1091                 } else {
1092                         hci_dev_lock(hdev);
1093                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1094                         hci_dev_unlock(hdev);
1095                 }
1096
1097                 break;
1098
1099         default:
1100                 BT_ERR("Used reserved LE_Scan_Enable param %d", cp->enable);
1101                 break;
1102         }
1103 }
1104
1105 static void hci_cc_le_ltk_reply(struct hci_dev *hdev, struct sk_buff *skb)
1106 {
1107         struct hci_rp_le_ltk_reply *rp = (void *) skb->data;
1108
1109         BT_DBG("%s status 0x%x", hdev->name, rp->status);
1110
1111         if (rp->status)
1112                 return;
1113
1114         hci_req_complete(hdev, HCI_OP_LE_LTK_REPLY, rp->status);
1115 }
1116
1117 static void hci_cc_le_ltk_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
1118 {
1119         struct hci_rp_le_ltk_neg_reply *rp = (void *) skb->data;
1120
1121         BT_DBG("%s status 0x%x", hdev->name, rp->status);
1122
1123         if (rp->status)
1124                 return;
1125
1126         hci_req_complete(hdev, HCI_OP_LE_LTK_NEG_REPLY, rp->status);
1127 }
1128
1129 static inline void hci_cc_write_le_host_supported(struct hci_dev *hdev,
1130                                                         struct sk_buff *skb)
1131 {
1132         struct hci_cp_read_local_ext_features cp;
1133         struct hci_cp_write_le_host_supported *sent;
1134         __u8 status = *((__u8 *) skb->data);
1135
1136         BT_DBG("%s status 0x%x", hdev->name, status);
1137
1138         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
1139         if (sent && test_bit(HCI_MGMT, &hdev->dev_flags))
1140                 mgmt_le_enable_complete(hdev, sent->le, status);
1141
1142         if (status)
1143                 return;
1144
1145         cp.page = 0x01;
1146         hci_send_cmd(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES, sizeof(cp), &cp);
1147 }
1148
1149 static inline void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
1150 {
1151         BT_DBG("%s status 0x%x", hdev->name, status);
1152
1153         if (status) {
1154                 hci_req_complete(hdev, HCI_OP_INQUIRY, status);
1155                 hci_conn_check_pending(hdev);
1156                 hci_dev_lock(hdev);
1157                 if (test_bit(HCI_MGMT, &hdev->dev_flags))
1158                         mgmt_start_discovery_failed(hdev, status);
1159                 hci_dev_unlock(hdev);
1160                 return;
1161         }
1162
1163         set_bit(HCI_INQUIRY, &hdev->flags);
1164
1165         hci_dev_lock(hdev);
1166         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
1167         hci_dev_unlock(hdev);
1168 }
1169
1170 static inline void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
1171 {
1172         struct hci_cp_create_conn *cp;
1173         struct hci_conn *conn;
1174
1175         BT_DBG("%s status 0x%x", hdev->name, status);
1176
1177         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
1178         if (!cp)
1179                 return;
1180
1181         hci_dev_lock(hdev);
1182
1183         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1184
1185         BT_DBG("%s bdaddr %s conn %p", hdev->name, batostr(&cp->bdaddr), conn);
1186
1187         if (status) {
1188                 if (conn && conn->state == BT_CONNECT) {
1189                         if (status != 0x0c || conn->attempt > 2) {
1190                                 conn->state = BT_CLOSED;
1191                                 hci_proto_connect_cfm(conn, status);
1192                                 hci_conn_del(conn);
1193                         } else
1194                                 conn->state = BT_CONNECT2;
1195                 }
1196         } else {
1197                 if (!conn) {
1198                         conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr);
1199                         if (conn) {
1200                                 conn->out = true;
1201                                 conn->link_mode |= HCI_LM_MASTER;
1202                         } else
1203                                 BT_ERR("No memory for new connection");
1204                 }
1205         }
1206
1207         hci_dev_unlock(hdev);
1208 }
1209
1210 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
1211 {
1212         struct hci_cp_add_sco *cp;
1213         struct hci_conn *acl, *sco;
1214         __u16 handle;
1215
1216         BT_DBG("%s status 0x%x", hdev->name, status);
1217
1218         if (!status)
1219                 return;
1220
1221         cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
1222         if (!cp)
1223                 return;
1224
1225         handle = __le16_to_cpu(cp->handle);
1226
1227         BT_DBG("%s handle %d", hdev->name, handle);
1228
1229         hci_dev_lock(hdev);
1230
1231         acl = hci_conn_hash_lookup_handle(hdev, handle);
1232         if (acl) {
1233                 sco = acl->link;
1234                 if (sco) {
1235                         sco->state = BT_CLOSED;
1236
1237                         hci_proto_connect_cfm(sco, status);
1238                         hci_conn_del(sco);
1239                 }
1240         }
1241
1242         hci_dev_unlock(hdev);
1243 }
1244
1245 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
1246 {
1247         struct hci_cp_auth_requested *cp;
1248         struct hci_conn *conn;
1249
1250         BT_DBG("%s status 0x%x", hdev->name, status);
1251
1252         if (!status)
1253                 return;
1254
1255         cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
1256         if (!cp)
1257                 return;
1258
1259         hci_dev_lock(hdev);
1260
1261         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1262         if (conn) {
1263                 if (conn->state == BT_CONFIG) {
1264                         hci_proto_connect_cfm(conn, status);
1265                         hci_conn_put(conn);
1266                 }
1267         }
1268
1269         hci_dev_unlock(hdev);
1270 }
1271
1272 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
1273 {
1274         struct hci_cp_set_conn_encrypt *cp;
1275         struct hci_conn *conn;
1276
1277         BT_DBG("%s status 0x%x", hdev->name, status);
1278
1279         if (!status)
1280                 return;
1281
1282         cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
1283         if (!cp)
1284                 return;
1285
1286         hci_dev_lock(hdev);
1287
1288         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1289         if (conn) {
1290                 if (conn->state == BT_CONFIG) {
1291                         hci_proto_connect_cfm(conn, status);
1292                         hci_conn_put(conn);
1293                 }
1294         }
1295
1296         hci_dev_unlock(hdev);
1297 }
1298
1299 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
1300                                                         struct hci_conn *conn)
1301 {
1302         if (conn->state != BT_CONFIG || !conn->out)
1303                 return 0;
1304
1305         if (conn->pending_sec_level == BT_SECURITY_SDP)
1306                 return 0;
1307
1308         /* Only request authentication for SSP connections or non-SSP
1309          * devices with sec_level HIGH or if MITM protection is requested */
1310         if (!hci_conn_ssp_enabled(conn) &&
1311                                 conn->pending_sec_level != BT_SECURITY_HIGH &&
1312                                 !(conn->auth_type & 0x01))
1313                 return 0;
1314
1315         return 1;
1316 }
1317
1318 static inline int hci_resolve_name(struct hci_dev *hdev, struct inquiry_entry *e)
1319 {
1320         struct hci_cp_remote_name_req cp;
1321
1322         memset(&cp, 0, sizeof(cp));
1323
1324         bacpy(&cp.bdaddr, &e->data.bdaddr);
1325         cp.pscan_rep_mode = e->data.pscan_rep_mode;
1326         cp.pscan_mode = e->data.pscan_mode;
1327         cp.clock_offset = e->data.clock_offset;
1328
1329         return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1330 }
1331
1332 static bool hci_resolve_next_name(struct hci_dev *hdev)
1333 {
1334         struct discovery_state *discov = &hdev->discovery;
1335         struct inquiry_entry *e;
1336
1337         if (list_empty(&discov->resolve))
1338                 return false;
1339
1340         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
1341         if (hci_resolve_name(hdev, e) == 0) {
1342                 e->name_state = NAME_PENDING;
1343                 return true;
1344         }
1345
1346         return false;
1347 }
1348
1349 static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
1350                                         bdaddr_t *bdaddr, u8 *name, u8 name_len)
1351 {
1352         struct discovery_state *discov = &hdev->discovery;
1353         struct inquiry_entry *e;
1354
1355         if (conn && !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
1356                 mgmt_device_connected(hdev, bdaddr, ACL_LINK, 0x00,
1357                                         name, name_len, conn->dev_class);
1358
1359         if (discov->state == DISCOVERY_STOPPED)
1360                 return;
1361
1362         if (discov->state == DISCOVERY_STOPPING)
1363                 goto discov_complete;
1364
1365         if (discov->state != DISCOVERY_RESOLVING)
1366                 return;
1367
1368         e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
1369         if (e) {
1370                 e->name_state = NAME_KNOWN;
1371                 list_del(&e->list);
1372                 if (name)
1373                         mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
1374                                         e->data.rssi, name, name_len);
1375         }
1376
1377         if (hci_resolve_next_name(hdev))
1378                 return;
1379
1380 discov_complete:
1381         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1382 }
1383
1384 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
1385 {
1386         struct hci_cp_remote_name_req *cp;
1387         struct hci_conn *conn;
1388
1389         BT_DBG("%s status 0x%x", hdev->name, status);
1390
1391         /* If successful wait for the name req complete event before
1392          * checking for the need to do authentication */
1393         if (!status)
1394                 return;
1395
1396         cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
1397         if (!cp)
1398                 return;
1399
1400         hci_dev_lock(hdev);
1401
1402         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1403
1404         if (test_bit(HCI_MGMT, &hdev->dev_flags))
1405                 hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
1406
1407         if (!conn)
1408                 goto unlock;
1409
1410         if (!hci_outgoing_auth_needed(hdev, conn))
1411                 goto unlock;
1412
1413         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
1414                 struct hci_cp_auth_requested cp;
1415                 cp.handle = __cpu_to_le16(conn->handle);
1416                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
1417         }
1418
1419 unlock:
1420         hci_dev_unlock(hdev);
1421 }
1422
1423 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
1424 {
1425         struct hci_cp_read_remote_features *cp;
1426         struct hci_conn *conn;
1427
1428         BT_DBG("%s status 0x%x", hdev->name, status);
1429
1430         if (!status)
1431                 return;
1432
1433         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
1434         if (!cp)
1435                 return;
1436
1437         hci_dev_lock(hdev);
1438
1439         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1440         if (conn) {
1441                 if (conn->state == BT_CONFIG) {
1442                         hci_proto_connect_cfm(conn, status);
1443                         hci_conn_put(conn);
1444                 }
1445         }
1446
1447         hci_dev_unlock(hdev);
1448 }
1449
1450 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
1451 {
1452         struct hci_cp_read_remote_ext_features *cp;
1453         struct hci_conn *conn;
1454
1455         BT_DBG("%s status 0x%x", hdev->name, status);
1456
1457         if (!status)
1458                 return;
1459
1460         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
1461         if (!cp)
1462                 return;
1463
1464         hci_dev_lock(hdev);
1465
1466         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1467         if (conn) {
1468                 if (conn->state == BT_CONFIG) {
1469                         hci_proto_connect_cfm(conn, status);
1470                         hci_conn_put(conn);
1471                 }
1472         }
1473
1474         hci_dev_unlock(hdev);
1475 }
1476
1477 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
1478 {
1479         struct hci_cp_setup_sync_conn *cp;
1480         struct hci_conn *acl, *sco;
1481         __u16 handle;
1482
1483         BT_DBG("%s status 0x%x", hdev->name, status);
1484
1485         if (!status)
1486                 return;
1487
1488         cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
1489         if (!cp)
1490                 return;
1491
1492         handle = __le16_to_cpu(cp->handle);
1493
1494         BT_DBG("%s handle %d", hdev->name, handle);
1495
1496         hci_dev_lock(hdev);
1497
1498         acl = hci_conn_hash_lookup_handle(hdev, handle);
1499         if (acl) {
1500                 sco = acl->link;
1501                 if (sco) {
1502                         sco->state = BT_CLOSED;
1503
1504                         hci_proto_connect_cfm(sco, status);
1505                         hci_conn_del(sco);
1506                 }
1507         }
1508
1509         hci_dev_unlock(hdev);
1510 }
1511
1512 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
1513 {
1514         struct hci_cp_sniff_mode *cp;
1515         struct hci_conn *conn;
1516
1517         BT_DBG("%s status 0x%x", hdev->name, status);
1518
1519         if (!status)
1520                 return;
1521
1522         cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
1523         if (!cp)
1524                 return;
1525
1526         hci_dev_lock(hdev);
1527
1528         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1529         if (conn) {
1530                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1531
1532                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
1533                         hci_sco_setup(conn, status);
1534         }
1535
1536         hci_dev_unlock(hdev);
1537 }
1538
1539 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
1540 {
1541         struct hci_cp_exit_sniff_mode *cp;
1542         struct hci_conn *conn;
1543
1544         BT_DBG("%s status 0x%x", hdev->name, status);
1545
1546         if (!status)
1547                 return;
1548
1549         cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
1550         if (!cp)
1551                 return;
1552
1553         hci_dev_lock(hdev);
1554
1555         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1556         if (conn) {
1557                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1558
1559                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
1560                         hci_sco_setup(conn, status);
1561         }
1562
1563         hci_dev_unlock(hdev);
1564 }
1565
1566 static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
1567 {
1568         struct hci_cp_disconnect *cp;
1569         struct hci_conn *conn;
1570
1571         if (!status)
1572                 return;
1573
1574         cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
1575         if (!cp)
1576                 return;
1577
1578         hci_dev_lock(hdev);
1579
1580         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1581         if (conn)
1582                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
1583                                                 conn->dst_type, status);
1584
1585         hci_dev_unlock(hdev);
1586 }
1587
1588 static void hci_cs_le_create_conn(struct hci_dev *hdev, __u8 status)
1589 {
1590         struct hci_cp_le_create_conn *cp;
1591         struct hci_conn *conn;
1592
1593         BT_DBG("%s status 0x%x", hdev->name, status);
1594
1595         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
1596         if (!cp)
1597                 return;
1598
1599         hci_dev_lock(hdev);
1600
1601         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->peer_addr);
1602
1603         BT_DBG("%s bdaddr %s conn %p", hdev->name, batostr(&cp->peer_addr),
1604                 conn);
1605
1606         if (status) {
1607                 if (conn && conn->state == BT_CONNECT) {
1608                         conn->state = BT_CLOSED;
1609                         hci_proto_connect_cfm(conn, status);
1610                         hci_conn_del(conn);
1611                 }
1612         } else {
1613                 if (!conn) {
1614                         conn = hci_conn_add(hdev, LE_LINK, &cp->peer_addr);
1615                         if (conn) {
1616                                 conn->dst_type = cp->peer_addr_type;
1617                                 conn->out = true;
1618                         } else {
1619                                 BT_ERR("No memory for new connection");
1620                         }
1621                 }
1622         }
1623
1624         hci_dev_unlock(hdev);
1625 }
1626
1627 static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
1628 {
1629         BT_DBG("%s status 0x%x", hdev->name, status);
1630 }
1631
1632 static inline void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1633 {
1634         __u8 status = *((__u8 *) skb->data);
1635         struct discovery_state *discov = &hdev->discovery;
1636         struct inquiry_entry *e;
1637
1638         BT_DBG("%s status %d", hdev->name, status);
1639
1640         hci_req_complete(hdev, HCI_OP_INQUIRY, status);
1641
1642         hci_conn_check_pending(hdev);
1643
1644         if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
1645                 return;
1646
1647         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
1648                 return;
1649
1650         hci_dev_lock(hdev);
1651
1652         if (discov->state != DISCOVERY_FINDING)
1653                 goto unlock;
1654
1655         if (list_empty(&discov->resolve)) {
1656                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1657                 goto unlock;
1658         }
1659
1660         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
1661         if (e && hci_resolve_name(hdev, e) == 0) {
1662                 e->name_state = NAME_PENDING;
1663                 hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
1664         } else {
1665                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1666         }
1667
1668 unlock:
1669         hci_dev_unlock(hdev);
1670 }
1671
1672 static inline void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
1673 {
1674         struct inquiry_data data;
1675         struct inquiry_info *info = (void *) (skb->data + 1);
1676         int num_rsp = *((__u8 *) skb->data);
1677
1678         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
1679
1680         if (!num_rsp)
1681                 return;
1682
1683         hci_dev_lock(hdev);
1684
1685         for (; num_rsp; num_rsp--, info++) {
1686                 bool name_known;
1687
1688                 bacpy(&data.bdaddr, &info->bdaddr);
1689                 data.pscan_rep_mode     = info->pscan_rep_mode;
1690                 data.pscan_period_mode  = info->pscan_period_mode;
1691                 data.pscan_mode         = info->pscan_mode;
1692                 memcpy(data.dev_class, info->dev_class, 3);
1693                 data.clock_offset       = info->clock_offset;
1694                 data.rssi               = 0x00;
1695                 data.ssp_mode           = 0x00;
1696
1697                 name_known = hci_inquiry_cache_update(hdev, &data, false);
1698                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
1699                                         info->dev_class, 0, !name_known,
1700                                         NULL, 0);
1701         }
1702
1703         hci_dev_unlock(hdev);
1704 }
1705
1706 static inline void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1707 {
1708         struct hci_ev_conn_complete *ev = (void *) skb->data;
1709         struct hci_conn *conn;
1710
1711         BT_DBG("%s", hdev->name);
1712
1713         hci_dev_lock(hdev);
1714
1715         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
1716         if (!conn) {
1717                 if (ev->link_type != SCO_LINK)
1718                         goto unlock;
1719
1720                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
1721                 if (!conn)
1722                         goto unlock;
1723
1724                 conn->type = SCO_LINK;
1725         }
1726
1727         if (!ev->status) {
1728                 conn->handle = __le16_to_cpu(ev->handle);
1729
1730                 if (conn->type == ACL_LINK) {
1731                         conn->state = BT_CONFIG;
1732                         hci_conn_hold(conn);
1733                         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
1734                 } else
1735                         conn->state = BT_CONNECTED;
1736
1737                 hci_conn_hold_device(conn);
1738                 hci_conn_add_sysfs(conn);
1739
1740                 if (test_bit(HCI_AUTH, &hdev->flags))
1741                         conn->link_mode |= HCI_LM_AUTH;
1742
1743                 if (test_bit(HCI_ENCRYPT, &hdev->flags))
1744                         conn->link_mode |= HCI_LM_ENCRYPT;
1745
1746                 /* Get remote features */
1747                 if (conn->type == ACL_LINK) {
1748                         struct hci_cp_read_remote_features cp;
1749                         cp.handle = ev->handle;
1750                         hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
1751                                                         sizeof(cp), &cp);
1752                 }
1753
1754                 /* Set packet type for incoming connection */
1755                 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
1756                         struct hci_cp_change_conn_ptype cp;
1757                         cp.handle = ev->handle;
1758                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
1759                         hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE,
1760                                                         sizeof(cp), &cp);
1761                 }
1762         } else {
1763                 conn->state = BT_CLOSED;
1764                 if (conn->type == ACL_LINK)
1765                         mgmt_connect_failed(hdev, &ev->bdaddr, conn->type,
1766                                                 conn->dst_type, ev->status);
1767         }
1768
1769         if (conn->type == ACL_LINK)
1770                 hci_sco_setup(conn, ev->status);
1771
1772         if (ev->status) {
1773                 hci_proto_connect_cfm(conn, ev->status);
1774                 hci_conn_del(conn);
1775         } else if (ev->link_type != ACL_LINK)
1776                 hci_proto_connect_cfm(conn, ev->status);
1777
1778 unlock:
1779         hci_dev_unlock(hdev);
1780
1781         hci_conn_check_pending(hdev);
1782 }
1783
1784 static inline void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
1785 {
1786         struct hci_ev_conn_request *ev = (void *) skb->data;
1787         int mask = hdev->link_mode;
1788
1789         BT_DBG("%s bdaddr %s type 0x%x", hdev->name,
1790                                         batostr(&ev->bdaddr), ev->link_type);
1791
1792         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type);
1793
1794         if ((mask & HCI_LM_ACCEPT) &&
1795                         !hci_blacklist_lookup(hdev, &ev->bdaddr)) {
1796                 /* Connection accepted */
1797                 struct inquiry_entry *ie;
1798                 struct hci_conn *conn;
1799
1800                 hci_dev_lock(hdev);
1801
1802                 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
1803                 if (ie)
1804                         memcpy(ie->data.dev_class, ev->dev_class, 3);
1805
1806                 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
1807                 if (!conn) {
1808                         conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr);
1809                         if (!conn) {
1810                                 BT_ERR("No memory for new connection");
1811                                 hci_dev_unlock(hdev);
1812                                 return;
1813                         }
1814                 }
1815
1816                 memcpy(conn->dev_class, ev->dev_class, 3);
1817                 conn->state = BT_CONNECT;
1818
1819                 hci_dev_unlock(hdev);
1820
1821                 if (ev->link_type == ACL_LINK || !lmp_esco_capable(hdev)) {
1822                         struct hci_cp_accept_conn_req cp;
1823
1824                         bacpy(&cp.bdaddr, &ev->bdaddr);
1825
1826                         if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
1827                                 cp.role = 0x00; /* Become master */
1828                         else
1829                                 cp.role = 0x01; /* Remain slave */
1830
1831                         hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ,
1832                                                         sizeof(cp), &cp);
1833                 } else {
1834                         struct hci_cp_accept_sync_conn_req cp;
1835
1836                         bacpy(&cp.bdaddr, &ev->bdaddr);
1837                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
1838
1839                         cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
1840                         cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
1841                         cp.max_latency    = cpu_to_le16(0xffff);
1842                         cp.content_format = cpu_to_le16(hdev->voice_setting);
1843                         cp.retrans_effort = 0xff;
1844
1845                         hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ,
1846                                                         sizeof(cp), &cp);
1847                 }
1848         } else {
1849                 /* Connection rejected */
1850                 struct hci_cp_reject_conn_req cp;
1851
1852                 bacpy(&cp.bdaddr, &ev->bdaddr);
1853                 cp.reason = HCI_ERROR_REJ_BAD_ADDR;
1854                 hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
1855         }
1856 }
1857
1858 static inline void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1859 {
1860         struct hci_ev_disconn_complete *ev = (void *) skb->data;
1861         struct hci_conn *conn;
1862
1863         BT_DBG("%s status %d", hdev->name, ev->status);
1864
1865         hci_dev_lock(hdev);
1866
1867         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1868         if (!conn)
1869                 goto unlock;
1870
1871         if (ev->status == 0)
1872                 conn->state = BT_CLOSED;
1873
1874         if (test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags) &&
1875                         (conn->type == ACL_LINK || conn->type == LE_LINK)) {
1876                 if (ev->status != 0)
1877                         mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
1878                                                 conn->dst_type, ev->status);
1879                 else
1880                         mgmt_device_disconnected(hdev, &conn->dst, conn->type,
1881                                                         conn->dst_type);
1882         }
1883
1884         if (ev->status == 0) {
1885                 hci_proto_disconn_cfm(conn, ev->reason);
1886                 hci_conn_del(conn);
1887         }
1888
1889 unlock:
1890         hci_dev_unlock(hdev);
1891 }
1892
1893 static inline void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1894 {
1895         struct hci_ev_auth_complete *ev = (void *) skb->data;
1896         struct hci_conn *conn;
1897
1898         BT_DBG("%s status %d", hdev->name, ev->status);
1899
1900         hci_dev_lock(hdev);
1901
1902         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1903         if (!conn)
1904                 goto unlock;
1905
1906         if (!ev->status) {
1907                 if (!hci_conn_ssp_enabled(conn) &&
1908                                 test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
1909                         BT_INFO("re-auth of legacy device is not possible.");
1910                 } else {
1911                         conn->link_mode |= HCI_LM_AUTH;
1912                         conn->sec_level = conn->pending_sec_level;
1913                 }
1914         } else {
1915                 mgmt_auth_failed(hdev, &conn->dst, conn->type, conn->dst_type,
1916                                                                 ev->status);
1917         }
1918
1919         clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
1920         clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
1921
1922         if (conn->state == BT_CONFIG) {
1923                 if (!ev->status && hci_conn_ssp_enabled(conn)) {
1924                         struct hci_cp_set_conn_encrypt cp;
1925                         cp.handle  = ev->handle;
1926                         cp.encrypt = 0x01;
1927                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
1928                                                                         &cp);
1929                 } else {
1930                         conn->state = BT_CONNECTED;
1931                         hci_proto_connect_cfm(conn, ev->status);
1932                         hci_conn_put(conn);
1933                 }
1934         } else {
1935                 hci_auth_cfm(conn, ev->status);
1936
1937                 hci_conn_hold(conn);
1938                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
1939                 hci_conn_put(conn);
1940         }
1941
1942         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
1943                 if (!ev->status) {
1944                         struct hci_cp_set_conn_encrypt cp;
1945                         cp.handle  = ev->handle;
1946                         cp.encrypt = 0x01;
1947                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
1948                                                                         &cp);
1949                 } else {
1950                         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
1951                         hci_encrypt_cfm(conn, ev->status, 0x00);
1952                 }
1953         }
1954
1955 unlock:
1956         hci_dev_unlock(hdev);
1957 }
1958
1959 static inline void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
1960 {
1961         struct hci_ev_remote_name *ev = (void *) skb->data;
1962         struct hci_conn *conn;
1963
1964         BT_DBG("%s", hdev->name);
1965
1966         hci_conn_check_pending(hdev);
1967
1968         hci_dev_lock(hdev);
1969
1970         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
1971
1972         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
1973                 goto check_auth;
1974
1975         if (ev->status == 0)
1976                 hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
1977                                         strnlen(ev->name, HCI_MAX_NAME_LENGTH));
1978         else
1979                 hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
1980
1981 check_auth:
1982         if (!conn)
1983                 goto unlock;
1984
1985         if (!hci_outgoing_auth_needed(hdev, conn))
1986                 goto unlock;
1987
1988         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
1989                 struct hci_cp_auth_requested cp;
1990                 cp.handle = __cpu_to_le16(conn->handle);
1991                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
1992         }
1993
1994 unlock:
1995         hci_dev_unlock(hdev);
1996 }
1997
1998 static inline void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
1999 {
2000         struct hci_ev_encrypt_change *ev = (void *) skb->data;
2001         struct hci_conn *conn;
2002
2003         BT_DBG("%s status %d", hdev->name, ev->status);
2004
2005         hci_dev_lock(hdev);
2006
2007         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2008         if (conn) {
2009                 if (!ev->status) {
2010                         if (ev->encrypt) {
2011                                 /* Encryption implies authentication */
2012                                 conn->link_mode |= HCI_LM_AUTH;
2013                                 conn->link_mode |= HCI_LM_ENCRYPT;
2014                                 conn->sec_level = conn->pending_sec_level;
2015                         } else
2016                                 conn->link_mode &= ~HCI_LM_ENCRYPT;
2017                 }
2018
2019                 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2020
2021                 if (conn->state == BT_CONFIG) {
2022                         if (!ev->status)
2023                                 conn->state = BT_CONNECTED;
2024
2025                         hci_proto_connect_cfm(conn, ev->status);
2026                         hci_conn_put(conn);
2027                 } else
2028                         hci_encrypt_cfm(conn, ev->status, ev->encrypt);
2029         }
2030
2031         hci_dev_unlock(hdev);
2032 }
2033
2034 static inline void hci_change_link_key_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2035 {
2036         struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
2037         struct hci_conn *conn;
2038
2039         BT_DBG("%s status %d", hdev->name, ev->status);
2040
2041         hci_dev_lock(hdev);
2042
2043         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2044         if (conn) {
2045                 if (!ev->status)
2046                         conn->link_mode |= HCI_LM_SECURE;
2047
2048                 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
2049
2050                 hci_key_change_cfm(conn, ev->status);
2051         }
2052
2053         hci_dev_unlock(hdev);
2054 }
2055
2056 static inline void hci_remote_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
2057 {
2058         struct hci_ev_remote_features *ev = (void *) skb->data;
2059         struct hci_conn *conn;
2060
2061         BT_DBG("%s status %d", hdev->name, ev->status);
2062
2063         hci_dev_lock(hdev);
2064
2065         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2066         if (!conn)
2067                 goto unlock;
2068
2069         if (!ev->status)
2070                 memcpy(conn->features, ev->features, 8);
2071
2072         if (conn->state != BT_CONFIG)
2073                 goto unlock;
2074
2075         if (!ev->status && lmp_ssp_capable(hdev) && lmp_ssp_capable(conn)) {
2076                 struct hci_cp_read_remote_ext_features cp;
2077                 cp.handle = ev->handle;
2078                 cp.page = 0x01;
2079                 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
2080                                                         sizeof(cp), &cp);
2081                 goto unlock;
2082         }
2083
2084         if (!ev->status) {
2085                 struct hci_cp_remote_name_req cp;
2086                 memset(&cp, 0, sizeof(cp));
2087                 bacpy(&cp.bdaddr, &conn->dst);
2088                 cp.pscan_rep_mode = 0x02;
2089                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2090         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2091                 mgmt_device_connected(hdev, &conn->dst, conn->type,
2092                                                 conn->dst_type, NULL, 0,
2093                                                 conn->dev_class);
2094
2095         if (!hci_outgoing_auth_needed(hdev, conn)) {
2096                 conn->state = BT_CONNECTED;
2097                 hci_proto_connect_cfm(conn, ev->status);
2098                 hci_conn_put(conn);
2099         }
2100
2101 unlock:
2102         hci_dev_unlock(hdev);
2103 }
2104
2105 static inline void hci_remote_version_evt(struct hci_dev *hdev, struct sk_buff *skb)
2106 {
2107         BT_DBG("%s", hdev->name);
2108 }
2109
2110 static inline void hci_qos_setup_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2111 {
2112         BT_DBG("%s", hdev->name);
2113 }
2114
2115 static inline void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2116 {
2117         struct hci_ev_cmd_complete *ev = (void *) skb->data;
2118         __u16 opcode;
2119
2120         skb_pull(skb, sizeof(*ev));
2121
2122         opcode = __le16_to_cpu(ev->opcode);
2123
2124         switch (opcode) {
2125         case HCI_OP_INQUIRY_CANCEL:
2126                 hci_cc_inquiry_cancel(hdev, skb);
2127                 break;
2128
2129         case HCI_OP_EXIT_PERIODIC_INQ:
2130                 hci_cc_exit_periodic_inq(hdev, skb);
2131                 break;
2132
2133         case HCI_OP_REMOTE_NAME_REQ_CANCEL:
2134                 hci_cc_remote_name_req_cancel(hdev, skb);
2135                 break;
2136
2137         case HCI_OP_ROLE_DISCOVERY:
2138                 hci_cc_role_discovery(hdev, skb);
2139                 break;
2140
2141         case HCI_OP_READ_LINK_POLICY:
2142                 hci_cc_read_link_policy(hdev, skb);
2143                 break;
2144
2145         case HCI_OP_WRITE_LINK_POLICY:
2146                 hci_cc_write_link_policy(hdev, skb);
2147                 break;
2148
2149         case HCI_OP_READ_DEF_LINK_POLICY:
2150                 hci_cc_read_def_link_policy(hdev, skb);
2151                 break;
2152
2153         case HCI_OP_WRITE_DEF_LINK_POLICY:
2154                 hci_cc_write_def_link_policy(hdev, skb);
2155                 break;
2156
2157         case HCI_OP_RESET:
2158                 hci_cc_reset(hdev, skb);
2159                 break;
2160
2161         case HCI_OP_WRITE_LOCAL_NAME:
2162                 hci_cc_write_local_name(hdev, skb);
2163                 break;
2164
2165         case HCI_OP_READ_LOCAL_NAME:
2166                 hci_cc_read_local_name(hdev, skb);
2167                 break;
2168
2169         case HCI_OP_WRITE_AUTH_ENABLE:
2170                 hci_cc_write_auth_enable(hdev, skb);
2171                 break;
2172
2173         case HCI_OP_WRITE_ENCRYPT_MODE:
2174                 hci_cc_write_encrypt_mode(hdev, skb);
2175                 break;
2176
2177         case HCI_OP_WRITE_SCAN_ENABLE:
2178                 hci_cc_write_scan_enable(hdev, skb);
2179                 break;
2180
2181         case HCI_OP_READ_CLASS_OF_DEV:
2182                 hci_cc_read_class_of_dev(hdev, skb);
2183                 break;
2184
2185         case HCI_OP_WRITE_CLASS_OF_DEV:
2186                 hci_cc_write_class_of_dev(hdev, skb);
2187                 break;
2188
2189         case HCI_OP_READ_VOICE_SETTING:
2190                 hci_cc_read_voice_setting(hdev, skb);
2191                 break;
2192
2193         case HCI_OP_WRITE_VOICE_SETTING:
2194                 hci_cc_write_voice_setting(hdev, skb);
2195                 break;
2196
2197         case HCI_OP_HOST_BUFFER_SIZE:
2198                 hci_cc_host_buffer_size(hdev, skb);
2199                 break;
2200
2201         case HCI_OP_WRITE_SSP_MODE:
2202                 hci_cc_write_ssp_mode(hdev, skb);
2203                 break;
2204
2205         case HCI_OP_READ_LOCAL_VERSION:
2206                 hci_cc_read_local_version(hdev, skb);
2207                 break;
2208
2209         case HCI_OP_READ_LOCAL_COMMANDS:
2210                 hci_cc_read_local_commands(hdev, skb);
2211                 break;
2212
2213         case HCI_OP_READ_LOCAL_FEATURES:
2214                 hci_cc_read_local_features(hdev, skb);
2215                 break;
2216
2217         case HCI_OP_READ_LOCAL_EXT_FEATURES:
2218                 hci_cc_read_local_ext_features(hdev, skb);
2219                 break;
2220
2221         case HCI_OP_READ_BUFFER_SIZE:
2222                 hci_cc_read_buffer_size(hdev, skb);
2223                 break;
2224
2225         case HCI_OP_READ_BD_ADDR:
2226                 hci_cc_read_bd_addr(hdev, skb);
2227                 break;
2228
2229         case HCI_OP_READ_DATA_BLOCK_SIZE:
2230                 hci_cc_read_data_block_size(hdev, skb);
2231                 break;
2232
2233         case HCI_OP_WRITE_CA_TIMEOUT:
2234                 hci_cc_write_ca_timeout(hdev, skb);
2235                 break;
2236
2237         case HCI_OP_READ_FLOW_CONTROL_MODE:
2238                 hci_cc_read_flow_control_mode(hdev, skb);
2239                 break;
2240
2241         case HCI_OP_READ_LOCAL_AMP_INFO:
2242                 hci_cc_read_local_amp_info(hdev, skb);
2243                 break;
2244
2245         case HCI_OP_DELETE_STORED_LINK_KEY:
2246                 hci_cc_delete_stored_link_key(hdev, skb);
2247                 break;
2248
2249         case HCI_OP_SET_EVENT_MASK:
2250                 hci_cc_set_event_mask(hdev, skb);
2251                 break;
2252
2253         case HCI_OP_WRITE_INQUIRY_MODE:
2254                 hci_cc_write_inquiry_mode(hdev, skb);
2255                 break;
2256
2257         case HCI_OP_READ_INQ_RSP_TX_POWER:
2258                 hci_cc_read_inq_rsp_tx_power(hdev, skb);
2259                 break;
2260
2261         case HCI_OP_SET_EVENT_FLT:
2262                 hci_cc_set_event_flt(hdev, skb);
2263                 break;
2264
2265         case HCI_OP_PIN_CODE_REPLY:
2266                 hci_cc_pin_code_reply(hdev, skb);
2267                 break;
2268
2269         case HCI_OP_PIN_CODE_NEG_REPLY:
2270                 hci_cc_pin_code_neg_reply(hdev, skb);
2271                 break;
2272
2273         case HCI_OP_READ_LOCAL_OOB_DATA:
2274                 hci_cc_read_local_oob_data_reply(hdev, skb);
2275                 break;
2276
2277         case HCI_OP_LE_READ_BUFFER_SIZE:
2278                 hci_cc_le_read_buffer_size(hdev, skb);
2279                 break;
2280
2281         case HCI_OP_USER_CONFIRM_REPLY:
2282                 hci_cc_user_confirm_reply(hdev, skb);
2283                 break;
2284
2285         case HCI_OP_USER_CONFIRM_NEG_REPLY:
2286                 hci_cc_user_confirm_neg_reply(hdev, skb);
2287                 break;
2288
2289         case HCI_OP_USER_PASSKEY_REPLY:
2290                 hci_cc_user_passkey_reply(hdev, skb);
2291                 break;
2292
2293         case HCI_OP_USER_PASSKEY_NEG_REPLY:
2294                 hci_cc_user_passkey_neg_reply(hdev, skb);
2295
2296         case HCI_OP_LE_SET_SCAN_PARAM:
2297                 hci_cc_le_set_scan_param(hdev, skb);
2298                 break;
2299
2300         case HCI_OP_LE_SET_SCAN_ENABLE:
2301                 hci_cc_le_set_scan_enable(hdev, skb);
2302                 break;
2303
2304         case HCI_OP_LE_LTK_REPLY:
2305                 hci_cc_le_ltk_reply(hdev, skb);
2306                 break;
2307
2308         case HCI_OP_LE_LTK_NEG_REPLY:
2309                 hci_cc_le_ltk_neg_reply(hdev, skb);
2310                 break;
2311
2312         case HCI_OP_WRITE_LE_HOST_SUPPORTED:
2313                 hci_cc_write_le_host_supported(hdev, skb);
2314                 break;
2315
2316         default:
2317                 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
2318                 break;
2319         }
2320
2321         if (ev->opcode != HCI_OP_NOP)
2322                 del_timer(&hdev->cmd_timer);
2323
2324         if (ev->ncmd) {
2325                 atomic_set(&hdev->cmd_cnt, 1);
2326                 if (!skb_queue_empty(&hdev->cmd_q))
2327                         queue_work(hdev->workqueue, &hdev->cmd_work);
2328         }
2329 }
2330
2331 static inline void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb)
2332 {
2333         struct hci_ev_cmd_status *ev = (void *) skb->data;
2334         __u16 opcode;
2335
2336         skb_pull(skb, sizeof(*ev));
2337
2338         opcode = __le16_to_cpu(ev->opcode);
2339
2340         switch (opcode) {
2341         case HCI_OP_INQUIRY:
2342                 hci_cs_inquiry(hdev, ev->status);
2343                 break;
2344
2345         case HCI_OP_CREATE_CONN:
2346                 hci_cs_create_conn(hdev, ev->status);
2347                 break;
2348
2349         case HCI_OP_ADD_SCO:
2350                 hci_cs_add_sco(hdev, ev->status);
2351                 break;
2352
2353         case HCI_OP_AUTH_REQUESTED:
2354                 hci_cs_auth_requested(hdev, ev->status);
2355                 break;
2356
2357         case HCI_OP_SET_CONN_ENCRYPT:
2358                 hci_cs_set_conn_encrypt(hdev, ev->status);
2359                 break;
2360
2361         case HCI_OP_REMOTE_NAME_REQ:
2362                 hci_cs_remote_name_req(hdev, ev->status);
2363                 break;
2364
2365         case HCI_OP_READ_REMOTE_FEATURES:
2366                 hci_cs_read_remote_features(hdev, ev->status);
2367                 break;
2368
2369         case HCI_OP_READ_REMOTE_EXT_FEATURES:
2370                 hci_cs_read_remote_ext_features(hdev, ev->status);
2371                 break;
2372
2373         case HCI_OP_SETUP_SYNC_CONN:
2374                 hci_cs_setup_sync_conn(hdev, ev->status);
2375                 break;
2376
2377         case HCI_OP_SNIFF_MODE:
2378                 hci_cs_sniff_mode(hdev, ev->status);
2379                 break;
2380
2381         case HCI_OP_EXIT_SNIFF_MODE:
2382                 hci_cs_exit_sniff_mode(hdev, ev->status);
2383                 break;
2384
2385         case HCI_OP_DISCONNECT:
2386                 hci_cs_disconnect(hdev, ev->status);
2387                 break;
2388
2389         case HCI_OP_LE_CREATE_CONN:
2390                 hci_cs_le_create_conn(hdev, ev->status);
2391                 break;
2392
2393         case HCI_OP_LE_START_ENC:
2394                 hci_cs_le_start_enc(hdev, ev->status);
2395                 break;
2396
2397         default:
2398                 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
2399                 break;
2400         }
2401
2402         if (ev->opcode != HCI_OP_NOP)
2403                 del_timer(&hdev->cmd_timer);
2404
2405         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
2406                 atomic_set(&hdev->cmd_cnt, 1);
2407                 if (!skb_queue_empty(&hdev->cmd_q))
2408                         queue_work(hdev->workqueue, &hdev->cmd_work);
2409         }
2410 }
2411
2412 static inline void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2413 {
2414         struct hci_ev_role_change *ev = (void *) skb->data;
2415         struct hci_conn *conn;
2416
2417         BT_DBG("%s status %d", hdev->name, ev->status);
2418
2419         hci_dev_lock(hdev);
2420
2421         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2422         if (conn) {
2423                 if (!ev->status) {
2424                         if (ev->role)
2425                                 conn->link_mode &= ~HCI_LM_MASTER;
2426                         else
2427                                 conn->link_mode |= HCI_LM_MASTER;
2428                 }
2429
2430                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
2431
2432                 hci_role_switch_cfm(conn, ev->status, ev->role);
2433         }
2434
2435         hci_dev_unlock(hdev);
2436 }
2437
2438 static inline void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
2439 {
2440         struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
2441         int i;
2442
2443         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
2444                 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
2445                 return;
2446         }
2447
2448         if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
2449                         ev->num_hndl * sizeof(struct hci_comp_pkts_info)) {
2450                 BT_DBG("%s bad parameters", hdev->name);
2451                 return;
2452         }
2453
2454         BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
2455
2456         for (i = 0; i < ev->num_hndl; i++) {
2457                 struct hci_comp_pkts_info *info = &ev->handles[i];
2458                 struct hci_conn *conn;
2459                 __u16  handle, count;
2460
2461                 handle = __le16_to_cpu(info->handle);
2462                 count  = __le16_to_cpu(info->count);
2463
2464                 conn = hci_conn_hash_lookup_handle(hdev, handle);
2465                 if (!conn)
2466                         continue;
2467
2468                 conn->sent -= count;
2469
2470                 switch (conn->type) {
2471                 case ACL_LINK:
2472                         hdev->acl_cnt += count;
2473                         if (hdev->acl_cnt > hdev->acl_pkts)
2474                                 hdev->acl_cnt = hdev->acl_pkts;
2475                         break;
2476
2477                 case LE_LINK:
2478                         if (hdev->le_pkts) {
2479                                 hdev->le_cnt += count;
2480                                 if (hdev->le_cnt > hdev->le_pkts)
2481                                         hdev->le_cnt = hdev->le_pkts;
2482                         } else {
2483                                 hdev->acl_cnt += count;
2484                                 if (hdev->acl_cnt > hdev->acl_pkts)
2485                                         hdev->acl_cnt = hdev->acl_pkts;
2486                         }
2487                         break;
2488
2489                 case SCO_LINK:
2490                         hdev->sco_cnt += count;
2491                         if (hdev->sco_cnt > hdev->sco_pkts)
2492                                 hdev->sco_cnt = hdev->sco_pkts;
2493                         break;
2494
2495                 default:
2496                         BT_ERR("Unknown type %d conn %p", conn->type, conn);
2497                         break;
2498                 }
2499         }
2500
2501         queue_work(hdev->workqueue, &hdev->tx_work);
2502 }
2503
2504 static inline void hci_num_comp_blocks_evt(struct hci_dev *hdev,
2505                                                         struct sk_buff *skb)
2506 {
2507         struct hci_ev_num_comp_blocks *ev = (void *) skb->data;
2508         int i;
2509
2510         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
2511                 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
2512                 return;
2513         }
2514
2515         if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
2516                         ev->num_hndl * sizeof(struct hci_comp_blocks_info)) {
2517                 BT_DBG("%s bad parameters", hdev->name);
2518                 return;
2519         }
2520
2521         BT_DBG("%s num_blocks %d num_hndl %d", hdev->name, ev->num_blocks,
2522                                                                 ev->num_hndl);
2523
2524         for (i = 0; i < ev->num_hndl; i++) {
2525                 struct hci_comp_blocks_info *info = &ev->handles[i];
2526                 struct hci_conn *conn;
2527                 __u16  handle, block_count;
2528
2529                 handle = __le16_to_cpu(info->handle);
2530                 block_count = __le16_to_cpu(info->blocks);
2531
2532                 conn = hci_conn_hash_lookup_handle(hdev, handle);
2533                 if (!conn)
2534                         continue;
2535
2536                 conn->sent -= block_count;
2537
2538                 switch (conn->type) {
2539                 case ACL_LINK:
2540                         hdev->block_cnt += block_count;
2541                         if (hdev->block_cnt > hdev->num_blocks)
2542                                 hdev->block_cnt = hdev->num_blocks;
2543                         break;
2544
2545                 default:
2546                         BT_ERR("Unknown type %d conn %p", conn->type, conn);
2547                         break;
2548                 }
2549         }
2550
2551         queue_work(hdev->workqueue, &hdev->tx_work);
2552 }
2553
2554 static inline void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2555 {
2556         struct hci_ev_mode_change *ev = (void *) skb->data;
2557         struct hci_conn *conn;
2558
2559         BT_DBG("%s status %d", hdev->name, ev->status);
2560
2561         hci_dev_lock(hdev);
2562
2563         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2564         if (conn) {
2565                 conn->mode = ev->mode;
2566                 conn->interval = __le16_to_cpu(ev->interval);
2567
2568                 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
2569                         if (conn->mode == HCI_CM_ACTIVE)
2570                                 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
2571                         else
2572                                 clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
2573                 }
2574
2575                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2576                         hci_sco_setup(conn, ev->status);
2577         }
2578
2579         hci_dev_unlock(hdev);
2580 }
2581
2582 static inline void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2583 {
2584         struct hci_ev_pin_code_req *ev = (void *) skb->data;
2585         struct hci_conn *conn;
2586
2587         BT_DBG("%s", hdev->name);
2588
2589         hci_dev_lock(hdev);
2590
2591         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2592         if (!conn)
2593                 goto unlock;
2594
2595         if (conn->state == BT_CONNECTED) {
2596                 hci_conn_hold(conn);
2597                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2598                 hci_conn_put(conn);
2599         }
2600
2601         if (!test_bit(HCI_PAIRABLE, &hdev->dev_flags))
2602                 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2603                                         sizeof(ev->bdaddr), &ev->bdaddr);
2604         else if (test_bit(HCI_MGMT, &hdev->dev_flags)) {
2605                 u8 secure;
2606
2607                 if (conn->pending_sec_level == BT_SECURITY_HIGH)
2608                         secure = 1;
2609                 else
2610                         secure = 0;
2611
2612                 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
2613         }
2614
2615 unlock:
2616         hci_dev_unlock(hdev);
2617 }
2618
2619 static inline void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2620 {
2621         struct hci_ev_link_key_req *ev = (void *) skb->data;
2622         struct hci_cp_link_key_reply cp;
2623         struct hci_conn *conn;
2624         struct link_key *key;
2625
2626         BT_DBG("%s", hdev->name);
2627
2628         if (!test_bit(HCI_LINK_KEYS, &hdev->dev_flags))
2629                 return;
2630
2631         hci_dev_lock(hdev);
2632
2633         key = hci_find_link_key(hdev, &ev->bdaddr);
2634         if (!key) {
2635                 BT_DBG("%s link key not found for %s", hdev->name,
2636                                                         batostr(&ev->bdaddr));
2637                 goto not_found;
2638         }
2639
2640         BT_DBG("%s found key type %u for %s", hdev->name, key->type,
2641                                                         batostr(&ev->bdaddr));
2642
2643         if (!test_bit(HCI_DEBUG_KEYS, &hdev->dev_flags) &&
2644                                 key->type == HCI_LK_DEBUG_COMBINATION) {
2645                 BT_DBG("%s ignoring debug key", hdev->name);
2646                 goto not_found;
2647         }
2648
2649         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2650         if (conn) {
2651                 if (key->type == HCI_LK_UNAUTH_COMBINATION &&
2652                                 conn->auth_type != 0xff &&
2653                                 (conn->auth_type & 0x01)) {
2654                         BT_DBG("%s ignoring unauthenticated key", hdev->name);
2655                         goto not_found;
2656                 }
2657
2658                 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
2659                                 conn->pending_sec_level == BT_SECURITY_HIGH) {
2660                         BT_DBG("%s ignoring key unauthenticated for high \
2661                                                         security", hdev->name);
2662                         goto not_found;
2663                 }
2664
2665                 conn->key_type = key->type;
2666                 conn->pin_length = key->pin_len;
2667         }
2668
2669         bacpy(&cp.bdaddr, &ev->bdaddr);
2670         memcpy(cp.link_key, key->val, 16);
2671
2672         hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
2673
2674         hci_dev_unlock(hdev);
2675
2676         return;
2677
2678 not_found:
2679         hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
2680         hci_dev_unlock(hdev);
2681 }
2682
2683 static inline void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
2684 {
2685         struct hci_ev_link_key_notify *ev = (void *) skb->data;
2686         struct hci_conn *conn;
2687         u8 pin_len = 0;
2688
2689         BT_DBG("%s", hdev->name);
2690
2691         hci_dev_lock(hdev);
2692
2693         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2694         if (conn) {
2695                 hci_conn_hold(conn);
2696                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2697                 pin_len = conn->pin_length;
2698
2699                 if (ev->key_type != HCI_LK_CHANGED_COMBINATION)
2700                         conn->key_type = ev->key_type;
2701
2702                 hci_conn_put(conn);
2703         }
2704
2705         if (test_bit(HCI_LINK_KEYS, &hdev->dev_flags))
2706                 hci_add_link_key(hdev, conn, 1, &ev->bdaddr, ev->link_key,
2707                                                         ev->key_type, pin_len);
2708
2709         hci_dev_unlock(hdev);
2710 }
2711
2712 static inline void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
2713 {
2714         struct hci_ev_clock_offset *ev = (void *) skb->data;
2715         struct hci_conn *conn;
2716
2717         BT_DBG("%s status %d", hdev->name, ev->status);
2718
2719         hci_dev_lock(hdev);
2720
2721         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2722         if (conn && !ev->status) {
2723                 struct inquiry_entry *ie;
2724
2725                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
2726                 if (ie) {
2727                         ie->data.clock_offset = ev->clock_offset;
2728                         ie->timestamp = jiffies;
2729                 }
2730         }
2731
2732         hci_dev_unlock(hdev);
2733 }
2734
2735 static inline void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2736 {
2737         struct hci_ev_pkt_type_change *ev = (void *) skb->data;
2738         struct hci_conn *conn;
2739
2740         BT_DBG("%s status %d", hdev->name, ev->status);
2741
2742         hci_dev_lock(hdev);
2743
2744         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2745         if (conn && !ev->status)
2746                 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
2747
2748         hci_dev_unlock(hdev);
2749 }
2750
2751 static inline void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
2752 {
2753         struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
2754         struct inquiry_entry *ie;
2755
2756         BT_DBG("%s", hdev->name);
2757
2758         hci_dev_lock(hdev);
2759
2760         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2761         if (ie) {
2762                 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
2763                 ie->timestamp = jiffies;
2764         }
2765
2766         hci_dev_unlock(hdev);
2767 }
2768
2769 static inline void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, struct sk_buff *skb)
2770 {
2771         struct inquiry_data data;
2772         int num_rsp = *((__u8 *) skb->data);
2773         bool name_known;
2774
2775         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2776
2777         if (!num_rsp)
2778                 return;
2779
2780         hci_dev_lock(hdev);
2781
2782         if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
2783                 struct inquiry_info_with_rssi_and_pscan_mode *info;
2784                 info = (void *) (skb->data + 1);
2785
2786                 for (; num_rsp; num_rsp--, info++) {
2787                         bacpy(&data.bdaddr, &info->bdaddr);
2788                         data.pscan_rep_mode     = info->pscan_rep_mode;
2789                         data.pscan_period_mode  = info->pscan_period_mode;
2790                         data.pscan_mode         = info->pscan_mode;
2791                         memcpy(data.dev_class, info->dev_class, 3);
2792                         data.clock_offset       = info->clock_offset;
2793                         data.rssi               = info->rssi;
2794                         data.ssp_mode           = 0x00;
2795
2796                         name_known = hci_inquiry_cache_update(hdev, &data,
2797                                                                 false);
2798                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2799                                                 info->dev_class, info->rssi,
2800                                                 !name_known, NULL, 0);
2801                 }
2802         } else {
2803                 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
2804
2805                 for (; num_rsp; num_rsp--, info++) {
2806                         bacpy(&data.bdaddr, &info->bdaddr);
2807                         data.pscan_rep_mode     = info->pscan_rep_mode;
2808                         data.pscan_period_mode  = info->pscan_period_mode;
2809                         data.pscan_mode         = 0x00;
2810                         memcpy(data.dev_class, info->dev_class, 3);
2811                         data.clock_offset       = info->clock_offset;
2812                         data.rssi               = info->rssi;
2813                         data.ssp_mode           = 0x00;
2814                         name_known = hci_inquiry_cache_update(hdev, &data,
2815                                                                 false);
2816                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2817                                                 info->dev_class, info->rssi,
2818                                                 !name_known, NULL, 0);
2819                 }
2820         }
2821
2822         hci_dev_unlock(hdev);
2823 }
2824
2825 static inline void hci_remote_ext_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
2826 {
2827         struct hci_ev_remote_ext_features *ev = (void *) skb->data;
2828         struct hci_conn *conn;
2829
2830         BT_DBG("%s", hdev->name);
2831
2832         hci_dev_lock(hdev);
2833
2834         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2835         if (!conn)
2836                 goto unlock;
2837
2838         if (!ev->status && ev->page == 0x01) {
2839                 struct inquiry_entry *ie;
2840
2841                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
2842                 if (ie)
2843                         ie->data.ssp_mode = (ev->features[0] & 0x01);
2844
2845                 if (ev->features[0] & 0x01)
2846                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
2847         }
2848
2849         if (conn->state != BT_CONFIG)
2850                 goto unlock;
2851
2852         if (!ev->status) {
2853                 struct hci_cp_remote_name_req cp;
2854                 memset(&cp, 0, sizeof(cp));
2855                 bacpy(&cp.bdaddr, &conn->dst);
2856                 cp.pscan_rep_mode = 0x02;
2857                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2858         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2859                 mgmt_device_connected(hdev, &conn->dst, conn->type,
2860                                                 conn->dst_type, NULL, 0,
2861                                                 conn->dev_class);
2862
2863         if (!hci_outgoing_auth_needed(hdev, conn)) {
2864                 conn->state = BT_CONNECTED;
2865                 hci_proto_connect_cfm(conn, ev->status);
2866                 hci_conn_put(conn);
2867         }
2868
2869 unlock:
2870         hci_dev_unlock(hdev);
2871 }
2872
2873 static inline void hci_sync_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2874 {
2875         struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
2876         struct hci_conn *conn;
2877
2878         BT_DBG("%s status %d", hdev->name, ev->status);
2879
2880         hci_dev_lock(hdev);
2881
2882         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
2883         if (!conn) {
2884                 if (ev->link_type == ESCO_LINK)
2885                         goto unlock;
2886
2887                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
2888                 if (!conn)
2889                         goto unlock;
2890
2891                 conn->type = SCO_LINK;
2892         }
2893
2894         switch (ev->status) {
2895         case 0x00:
2896                 conn->handle = __le16_to_cpu(ev->handle);
2897                 conn->state  = BT_CONNECTED;
2898
2899                 hci_conn_hold_device(conn);
2900                 hci_conn_add_sysfs(conn);
2901                 break;
2902
2903         case 0x11:      /* Unsupported Feature or Parameter Value */
2904         case 0x1c:      /* SCO interval rejected */
2905         case 0x1a:      /* Unsupported Remote Feature */
2906         case 0x1f:      /* Unspecified error */
2907                 if (conn->out && conn->attempt < 2) {
2908                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
2909                                         (hdev->esco_type & EDR_ESCO_MASK);
2910                         hci_setup_sync(conn, conn->link->handle);
2911                         goto unlock;
2912                 }
2913                 /* fall through */
2914
2915         default:
2916                 conn->state = BT_CLOSED;
2917                 break;
2918         }
2919
2920         hci_proto_connect_cfm(conn, ev->status);
2921         if (ev->status)
2922                 hci_conn_del(conn);
2923
2924 unlock:
2925         hci_dev_unlock(hdev);
2926 }
2927
2928 static inline void hci_sync_conn_changed_evt(struct hci_dev *hdev, struct sk_buff *skb)
2929 {
2930         BT_DBG("%s", hdev->name);
2931 }
2932
2933 static inline void hci_sniff_subrate_evt(struct hci_dev *hdev, struct sk_buff *skb)
2934 {
2935         struct hci_ev_sniff_subrate *ev = (void *) skb->data;
2936
2937         BT_DBG("%s status %d", hdev->name, ev->status);
2938 }
2939
2940 static inline void hci_extended_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
2941 {
2942         struct inquiry_data data;
2943         struct extended_inquiry_info *info = (void *) (skb->data + 1);
2944         int num_rsp = *((__u8 *) skb->data);
2945
2946         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2947
2948         if (!num_rsp)
2949                 return;
2950
2951         hci_dev_lock(hdev);
2952
2953         for (; num_rsp; num_rsp--, info++) {
2954                 bool name_known;
2955
2956                 bacpy(&data.bdaddr, &info->bdaddr);
2957                 data.pscan_rep_mode     = info->pscan_rep_mode;
2958                 data.pscan_period_mode  = info->pscan_period_mode;
2959                 data.pscan_mode         = 0x00;
2960                 memcpy(data.dev_class, info->dev_class, 3);
2961                 data.clock_offset       = info->clock_offset;
2962                 data.rssi               = info->rssi;
2963                 data.ssp_mode           = 0x01;
2964
2965                 if (test_bit(HCI_MGMT, &hdev->dev_flags))
2966                         name_known = eir_has_data_type(info->data,
2967                                                         sizeof(info->data),
2968                                                         EIR_NAME_COMPLETE);
2969                 else
2970                         name_known = true;
2971
2972                 name_known = hci_inquiry_cache_update(hdev, &data, name_known);
2973                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2974                                                 info->dev_class, info->rssi,
2975                                                 !name_known, info->data,
2976                                                 sizeof(info->data));
2977         }
2978
2979         hci_dev_unlock(hdev);
2980 }
2981
2982 static inline u8 hci_get_auth_req(struct hci_conn *conn)
2983 {
2984         /* If remote requests dedicated bonding follow that lead */
2985         if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03) {
2986                 /* If both remote and local IO capabilities allow MITM
2987                  * protection then require it, otherwise don't */
2988                 if (conn->remote_cap == 0x03 || conn->io_capability == 0x03)
2989                         return 0x02;
2990                 else
2991                         return 0x03;
2992         }
2993
2994         /* If remote requests no-bonding follow that lead */
2995         if (conn->remote_auth == 0x00 || conn->remote_auth == 0x01)
2996                 return conn->remote_auth | (conn->auth_type & 0x01);
2997
2998         return conn->auth_type;
2999 }
3000
3001 static inline void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3002 {
3003         struct hci_ev_io_capa_request *ev = (void *) skb->data;
3004         struct hci_conn *conn;
3005
3006         BT_DBG("%s", hdev->name);
3007
3008         hci_dev_lock(hdev);
3009
3010         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3011         if (!conn)
3012                 goto unlock;
3013
3014         hci_conn_hold(conn);
3015
3016         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3017                 goto unlock;
3018
3019         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags) ||
3020                         (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
3021                 struct hci_cp_io_capability_reply cp;
3022
3023                 bacpy(&cp.bdaddr, &ev->bdaddr);
3024                 /* Change the IO capability from KeyboardDisplay
3025                  * to DisplayYesNo as it is not supported by BT spec. */
3026                 cp.capability = (conn->io_capability == 0x04) ?
3027                                                 0x01 : conn->io_capability;
3028                 conn->auth_type = hci_get_auth_req(conn);
3029                 cp.authentication = conn->auth_type;
3030
3031                 if ((conn->out || test_bit(HCI_CONN_REMOTE_OOB, &conn->flags)) &&
3032                                 hci_find_remote_oob_data(hdev, &conn->dst))
3033                         cp.oob_data = 0x01;
3034                 else
3035                         cp.oob_data = 0x00;
3036
3037                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
3038                                                         sizeof(cp), &cp);
3039         } else {
3040                 struct hci_cp_io_capability_neg_reply cp;
3041
3042                 bacpy(&cp.bdaddr, &ev->bdaddr);
3043                 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
3044
3045                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
3046                                                         sizeof(cp), &cp);
3047         }
3048
3049 unlock:
3050         hci_dev_unlock(hdev);
3051 }
3052
3053 static inline void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
3054 {
3055         struct hci_ev_io_capa_reply *ev = (void *) skb->data;
3056         struct hci_conn *conn;
3057
3058         BT_DBG("%s", hdev->name);
3059
3060         hci_dev_lock(hdev);
3061
3062         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3063         if (!conn)
3064                 goto unlock;
3065
3066         conn->remote_cap = ev->capability;
3067         conn->remote_auth = ev->authentication;
3068         if (ev->oob_data)
3069                 set_bit(HCI_CONN_REMOTE_OOB, &conn->flags);
3070
3071 unlock:
3072         hci_dev_unlock(hdev);
3073 }
3074
3075 static inline void hci_user_confirm_request_evt(struct hci_dev *hdev,
3076                                                         struct sk_buff *skb)
3077 {
3078         struct hci_ev_user_confirm_req *ev = (void *) skb->data;
3079         int loc_mitm, rem_mitm, confirm_hint = 0;
3080         struct hci_conn *conn;
3081
3082         BT_DBG("%s", hdev->name);
3083
3084         hci_dev_lock(hdev);
3085
3086         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3087                 goto unlock;
3088
3089         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3090         if (!conn)
3091                 goto unlock;
3092
3093         loc_mitm = (conn->auth_type & 0x01);
3094         rem_mitm = (conn->remote_auth & 0x01);
3095
3096         /* If we require MITM but the remote device can't provide that
3097          * (it has NoInputNoOutput) then reject the confirmation
3098          * request. The only exception is when we're dedicated bonding
3099          * initiators (connect_cfm_cb set) since then we always have the MITM
3100          * bit set. */
3101         if (!conn->connect_cfm_cb && loc_mitm && conn->remote_cap == 0x03) {
3102                 BT_DBG("Rejecting request: remote device can't provide MITM");
3103                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
3104                                         sizeof(ev->bdaddr), &ev->bdaddr);
3105                 goto unlock;
3106         }
3107
3108         /* If no side requires MITM protection; auto-accept */
3109         if ((!loc_mitm || conn->remote_cap == 0x03) &&
3110                                 (!rem_mitm || conn->io_capability == 0x03)) {
3111
3112                 /* If we're not the initiators request authorization to
3113                  * proceed from user space (mgmt_user_confirm with
3114                  * confirm_hint set to 1). */
3115                 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
3116                         BT_DBG("Confirming auto-accept as acceptor");
3117                         confirm_hint = 1;
3118                         goto confirm;
3119                 }
3120
3121                 BT_DBG("Auto-accept of user confirmation with %ums delay",
3122                                                 hdev->auto_accept_delay);
3123
3124                 if (hdev->auto_accept_delay > 0) {
3125                         int delay = msecs_to_jiffies(hdev->auto_accept_delay);
3126                         mod_timer(&conn->auto_accept_timer, jiffies + delay);
3127                         goto unlock;
3128                 }
3129
3130                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
3131                                                 sizeof(ev->bdaddr), &ev->bdaddr);
3132                 goto unlock;
3133         }
3134
3135 confirm:
3136         mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0, ev->passkey,
3137                                                                 confirm_hint);
3138
3139 unlock:
3140         hci_dev_unlock(hdev);
3141 }
3142
3143 static inline void hci_user_passkey_request_evt(struct hci_dev *hdev,
3144                                                         struct sk_buff *skb)
3145 {
3146         struct hci_ev_user_passkey_req *ev = (void *) skb->data;
3147
3148         BT_DBG("%s", hdev->name);
3149
3150         hci_dev_lock(hdev);
3151
3152         if (test_bit(HCI_MGMT, &hdev->dev_flags))
3153                 mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
3154
3155         hci_dev_unlock(hdev);
3156 }
3157
3158 static inline void hci_simple_pair_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
3159 {
3160         struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
3161         struct hci_conn *conn;
3162
3163         BT_DBG("%s", hdev->name);
3164
3165         hci_dev_lock(hdev);
3166
3167         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3168         if (!conn)
3169                 goto unlock;
3170
3171         /* To avoid duplicate auth_failed events to user space we check
3172          * the HCI_CONN_AUTH_PEND flag which will be set if we
3173          * initiated the authentication. A traditional auth_complete
3174          * event gets always produced as initiator and is also mapped to
3175          * the mgmt_auth_failed event */
3176         if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status != 0)
3177                 mgmt_auth_failed(hdev, &conn->dst, conn->type, conn->dst_type,
3178                                                                 ev->status);
3179
3180         hci_conn_put(conn);
3181
3182 unlock:
3183         hci_dev_unlock(hdev);
3184 }
3185
3186 static inline void hci_remote_host_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
3187 {
3188         struct hci_ev_remote_host_features *ev = (void *) skb->data;
3189         struct inquiry_entry *ie;
3190
3191         BT_DBG("%s", hdev->name);
3192
3193         hci_dev_lock(hdev);
3194
3195         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
3196         if (ie)
3197                 ie->data.ssp_mode = (ev->features[0] & 0x01);
3198
3199         hci_dev_unlock(hdev);
3200 }
3201
3202 static inline void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
3203                                                         struct sk_buff *skb)
3204 {
3205         struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
3206         struct oob_data *data;
3207
3208         BT_DBG("%s", hdev->name);
3209
3210         hci_dev_lock(hdev);
3211
3212         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3213                 goto unlock;
3214
3215         data = hci_find_remote_oob_data(hdev, &ev->bdaddr);
3216         if (data) {
3217                 struct hci_cp_remote_oob_data_reply cp;
3218
3219                 bacpy(&cp.bdaddr, &ev->bdaddr);
3220                 memcpy(cp.hash, data->hash, sizeof(cp.hash));
3221                 memcpy(cp.randomizer, data->randomizer, sizeof(cp.randomizer));
3222
3223                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY, sizeof(cp),
3224                                                                         &cp);
3225         } else {
3226                 struct hci_cp_remote_oob_data_neg_reply cp;
3227
3228                 bacpy(&cp.bdaddr, &ev->bdaddr);
3229                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY, sizeof(cp),
3230                                                                         &cp);
3231         }
3232
3233 unlock:
3234         hci_dev_unlock(hdev);
3235 }
3236
3237 static inline void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
3238 {
3239         struct hci_ev_le_conn_complete *ev = (void *) skb->data;
3240         struct hci_conn *conn;
3241
3242         BT_DBG("%s status %d", hdev->name, ev->status);
3243
3244         hci_dev_lock(hdev);
3245
3246         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &ev->bdaddr);
3247         if (!conn) {
3248                 conn = hci_conn_add(hdev, LE_LINK, &ev->bdaddr);
3249                 if (!conn) {
3250                         BT_ERR("No memory for new connection");
3251                         hci_dev_unlock(hdev);
3252                         return;
3253                 }
3254
3255                 conn->dst_type = ev->bdaddr_type;
3256         }
3257
3258         if (ev->status) {
3259                 mgmt_connect_failed(hdev, &ev->bdaddr, conn->type,
3260                                                 conn->dst_type, ev->status);
3261                 hci_proto_connect_cfm(conn, ev->status);
3262                 conn->state = BT_CLOSED;
3263                 hci_conn_del(conn);
3264                 goto unlock;
3265         }
3266
3267         if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
3268                 mgmt_device_connected(hdev, &ev->bdaddr, conn->type,
3269                                                 conn->dst_type, NULL, 0, 0);
3270
3271         conn->sec_level = BT_SECURITY_LOW;
3272         conn->handle = __le16_to_cpu(ev->handle);
3273         conn->state = BT_CONNECTED;
3274
3275         hci_conn_hold_device(conn);
3276         hci_conn_add_sysfs(conn);
3277
3278         hci_proto_connect_cfm(conn, ev->status);
3279
3280 unlock:
3281         hci_dev_unlock(hdev);
3282 }
3283
3284 static inline void hci_le_adv_report_evt(struct hci_dev *hdev,
3285                                                 struct sk_buff *skb)
3286 {
3287         u8 num_reports = skb->data[0];
3288         void *ptr = &skb->data[1];
3289         s8 rssi;
3290
3291         hci_dev_lock(hdev);
3292
3293         while (num_reports--) {
3294                 struct hci_ev_le_advertising_info *ev = ptr;
3295
3296                 hci_add_adv_entry(hdev, ev);
3297
3298                 rssi = ev->data[ev->length];
3299                 mgmt_device_found(hdev, &ev->bdaddr, LE_LINK, ev->bdaddr_type,
3300                                         NULL, rssi, 0, ev->data, ev->length);
3301
3302                 ptr += sizeof(*ev) + ev->length + 1;
3303         }
3304
3305         hci_dev_unlock(hdev);
3306 }
3307
3308 static inline void hci_le_ltk_request_evt(struct hci_dev *hdev,
3309                                                 struct sk_buff *skb)
3310 {
3311         struct hci_ev_le_ltk_req *ev = (void *) skb->data;
3312         struct hci_cp_le_ltk_reply cp;
3313         struct hci_cp_le_ltk_neg_reply neg;
3314         struct hci_conn *conn;
3315         struct smp_ltk *ltk;
3316
3317         BT_DBG("%s handle %d", hdev->name, cpu_to_le16(ev->handle));
3318
3319         hci_dev_lock(hdev);
3320
3321         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3322         if (conn == NULL)
3323                 goto not_found;
3324
3325         ltk = hci_find_ltk(hdev, ev->ediv, ev->random);
3326         if (ltk == NULL)
3327                 goto not_found;
3328
3329         memcpy(cp.ltk, ltk->val, sizeof(ltk->val));
3330         cp.handle = cpu_to_le16(conn->handle);
3331
3332         if (ltk->authenticated)
3333                 conn->sec_level = BT_SECURITY_HIGH;
3334
3335         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
3336
3337         if (ltk->type & HCI_SMP_STK) {
3338                 list_del(&ltk->list);
3339                 kfree(ltk);
3340         }
3341
3342         hci_dev_unlock(hdev);
3343
3344         return;
3345
3346 not_found:
3347         neg.handle = ev->handle;
3348         hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
3349         hci_dev_unlock(hdev);
3350 }
3351
3352 static inline void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
3353 {
3354         struct hci_ev_le_meta *le_ev = (void *) skb->data;
3355
3356         skb_pull(skb, sizeof(*le_ev));
3357
3358         switch (le_ev->subevent) {
3359         case HCI_EV_LE_CONN_COMPLETE:
3360                 hci_le_conn_complete_evt(hdev, skb);
3361                 break;
3362
3363         case HCI_EV_LE_ADVERTISING_REPORT:
3364                 hci_le_adv_report_evt(hdev, skb);
3365                 break;
3366
3367         case HCI_EV_LE_LTK_REQ:
3368                 hci_le_ltk_request_evt(hdev, skb);
3369                 break;
3370
3371         default:
3372                 break;
3373         }
3374 }
3375
3376 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
3377 {
3378         struct hci_event_hdr *hdr = (void *) skb->data;
3379         __u8 event = hdr->evt;
3380
3381         skb_pull(skb, HCI_EVENT_HDR_SIZE);
3382
3383         switch (event) {
3384         case HCI_EV_INQUIRY_COMPLETE:
3385                 hci_inquiry_complete_evt(hdev, skb);
3386                 break;
3387
3388         case HCI_EV_INQUIRY_RESULT:
3389                 hci_inquiry_result_evt(hdev, skb);
3390                 break;
3391
3392         case HCI_EV_CONN_COMPLETE:
3393                 hci_conn_complete_evt(hdev, skb);
3394                 break;
3395
3396         case HCI_EV_CONN_REQUEST:
3397                 hci_conn_request_evt(hdev, skb);
3398                 break;
3399
3400         case HCI_EV_DISCONN_COMPLETE:
3401                 hci_disconn_complete_evt(hdev, skb);
3402                 break;
3403
3404         case HCI_EV_AUTH_COMPLETE:
3405                 hci_auth_complete_evt(hdev, skb);
3406                 break;
3407
3408         case HCI_EV_REMOTE_NAME:
3409                 hci_remote_name_evt(hdev, skb);
3410                 break;
3411
3412         case HCI_EV_ENCRYPT_CHANGE:
3413                 hci_encrypt_change_evt(hdev, skb);
3414                 break;
3415
3416         case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
3417                 hci_change_link_key_complete_evt(hdev, skb);
3418                 break;
3419
3420         case HCI_EV_REMOTE_FEATURES:
3421                 hci_remote_features_evt(hdev, skb);
3422                 break;
3423
3424         case HCI_EV_REMOTE_VERSION:
3425                 hci_remote_version_evt(hdev, skb);
3426                 break;
3427
3428         case HCI_EV_QOS_SETUP_COMPLETE:
3429                 hci_qos_setup_complete_evt(hdev, skb);
3430                 break;
3431
3432         case HCI_EV_CMD_COMPLETE:
3433                 hci_cmd_complete_evt(hdev, skb);
3434                 break;
3435
3436         case HCI_EV_CMD_STATUS:
3437                 hci_cmd_status_evt(hdev, skb);
3438                 break;
3439
3440         case HCI_EV_ROLE_CHANGE:
3441                 hci_role_change_evt(hdev, skb);
3442                 break;
3443
3444         case HCI_EV_NUM_COMP_PKTS:
3445                 hci_num_comp_pkts_evt(hdev, skb);
3446                 break;
3447
3448         case HCI_EV_MODE_CHANGE:
3449                 hci_mode_change_evt(hdev, skb);
3450                 break;
3451
3452         case HCI_EV_PIN_CODE_REQ:
3453                 hci_pin_code_request_evt(hdev, skb);
3454                 break;
3455
3456         case HCI_EV_LINK_KEY_REQ:
3457                 hci_link_key_request_evt(hdev, skb);
3458                 break;
3459
3460         case HCI_EV_LINK_KEY_NOTIFY:
3461                 hci_link_key_notify_evt(hdev, skb);
3462                 break;
3463
3464         case HCI_EV_CLOCK_OFFSET:
3465                 hci_clock_offset_evt(hdev, skb);
3466                 break;
3467
3468         case HCI_EV_PKT_TYPE_CHANGE:
3469                 hci_pkt_type_change_evt(hdev, skb);
3470                 break;
3471
3472         case HCI_EV_PSCAN_REP_MODE:
3473                 hci_pscan_rep_mode_evt(hdev, skb);
3474                 break;
3475
3476         case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
3477                 hci_inquiry_result_with_rssi_evt(hdev, skb);
3478                 break;
3479
3480         case HCI_EV_REMOTE_EXT_FEATURES:
3481                 hci_remote_ext_features_evt(hdev, skb);
3482                 break;
3483
3484         case HCI_EV_SYNC_CONN_COMPLETE:
3485                 hci_sync_conn_complete_evt(hdev, skb);
3486                 break;
3487
3488         case HCI_EV_SYNC_CONN_CHANGED:
3489                 hci_sync_conn_changed_evt(hdev, skb);
3490                 break;
3491
3492         case HCI_EV_SNIFF_SUBRATE:
3493                 hci_sniff_subrate_evt(hdev, skb);
3494                 break;
3495
3496         case HCI_EV_EXTENDED_INQUIRY_RESULT:
3497                 hci_extended_inquiry_result_evt(hdev, skb);
3498                 break;
3499
3500         case HCI_EV_IO_CAPA_REQUEST:
3501                 hci_io_capa_request_evt(hdev, skb);
3502                 break;
3503
3504         case HCI_EV_IO_CAPA_REPLY:
3505                 hci_io_capa_reply_evt(hdev, skb);
3506                 break;
3507
3508         case HCI_EV_USER_CONFIRM_REQUEST:
3509                 hci_user_confirm_request_evt(hdev, skb);
3510                 break;
3511
3512         case HCI_EV_USER_PASSKEY_REQUEST:
3513                 hci_user_passkey_request_evt(hdev, skb);
3514                 break;
3515
3516         case HCI_EV_SIMPLE_PAIR_COMPLETE:
3517                 hci_simple_pair_complete_evt(hdev, skb);
3518                 break;
3519
3520         case HCI_EV_REMOTE_HOST_FEATURES:
3521                 hci_remote_host_features_evt(hdev, skb);
3522                 break;
3523
3524         case HCI_EV_LE_META:
3525                 hci_le_meta_evt(hdev, skb);
3526                 break;
3527
3528         case HCI_EV_REMOTE_OOB_DATA_REQUEST:
3529                 hci_remote_oob_data_request_evt(hdev, skb);
3530                 break;
3531
3532         case HCI_EV_NUM_COMP_BLOCKS:
3533                 hci_num_comp_blocks_evt(hdev, skb);
3534                 break;
3535
3536         default:
3537                 BT_DBG("%s event 0x%x", hdev->name, event);
3538                 break;
3539         }
3540
3541         kfree_skb(skb);
3542         hdev->stat.evt_rx++;
3543 }