net/bluetooth/hci_event.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI event handling. */
  26
  27 #include <linux/module.h>
  28
  29 #include <linux/types.h>
  30 #include <linux/errno.h>
  31 #include <linux/kernel.h>
  32 #include <linux/slab.h>
  33 #include <linux/poll.h>
  34 #include <linux/fcntl.h>
  35 #include <linux/init.h>
  36 #include <linux/skbuff.h>
  37 #include <linux/interrupt.h>
  38 #include <linux/notifier.h>
  39 #include <net/sock.h>
  40
  41 #include <asm/system.h>
  42 #include <linux/uaccess.h>
  43 #include <asm/unaligned.h>
  44
  45 #include <net/bluetooth/bluetooth.h>
  46 #include <net/bluetooth/hci_core.h>
  47
  48 static int enable_le;
  49
  50 /* Handle HCI Event packets */
  51
  52 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
  53 {
  54         __u8 status = *((__u8 *) skb->data);
  55
  56         BT_DBG("%s status 0x%x", hdev->name, status);
  57
  58         if (status) {
  59                 hci_dev_lock(hdev);
  60                 mgmt_stop_discovery_failed(hdev, status);
  61                 hci_dev_unlock(hdev);
  62                 return;
  63         }
  64
  65         clear_bit(HCI_INQUIRY, &hdev->flags);
  66
  67         hci_dev_lock(hdev);
  68         mgmt_discovering(hdev, 0);
  69         hci_dev_unlock(hdev);
  70
  71         hci_req_complete(hdev, HCI_OP_INQUIRY_CANCEL, status);
  72
  73         hci_conn_check_pending(hdev);
  74 }
  75
  76 static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  77 {
  78         __u8 status = *((__u8 *) skb->data);
  79
  80         BT_DBG("%s status 0x%x", hdev->name, status);
  81
  82         if (status)
  83                 return;
  84
  85         hci_conn_check_pending(hdev);
  86 }
  87
  88 static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev, struct sk_buff *skb)
  89 {
  90         BT_DBG("%s", hdev->name);
  91 }
  92
  93 static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
  94 {
  95         struct hci_rp_role_discovery *rp = (void *) skb->data;
  96         struct hci_conn *conn;
  97
  98         BT_DBG("%s status 0x%x", hdev->name, rp->status);
  99
 100         if (rp->status)
 101                 return;
 102
 103         hci_dev_lock(hdev);
 104
 105         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 106         if (conn) {
 107                 if (rp->role)
 108                         conn->link_mode &= ~HCI_LM_MASTER;
 109                 else
 110                         conn->link_mode |= HCI_LM_MASTER;
 111         }
 112
 113         hci_dev_unlock(hdev);
 114 }
 115
 116 static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 117 {
 118         struct hci_rp_read_link_policy *rp = (void *) skb->data;
 119         struct hci_conn *conn;
 120
 121         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 122
 123         if (rp->status)
 124                 return;
 125
 126         hci_dev_lock(hdev);
 127
 128         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 129         if (conn)
 130                 conn->link_policy = __le16_to_cpu(rp->policy);
 131
 132         hci_dev_unlock(hdev);
 133 }
 134
 135 static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 136 {
 137         struct hci_rp_write_link_policy *rp = (void *) skb->data;
 138         struct hci_conn *conn;
 139         void *sent;
 140
 141         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 142
 143         if (rp->status)
 144                 return;
 145
 146         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
 147         if (!sent)
 148                 return;
 149
 150         hci_dev_lock(hdev);
 151
 152         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 153         if (conn)
 154                 conn->link_policy = get_unaligned_le16(sent + 2);
 155
 156         hci_dev_unlock(hdev);
 157 }
 158
 159 static void hci_cc_read_def_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 160 {
 161         struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
 162
 163         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 164
 165         if (rp->status)
 166                 return;
 167
 168         hdev->link_policy = __le16_to_cpu(rp->policy);
 169 }
 170
 171 static void hci_cc_write_def_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 172 {
 173         __u8 status = *((__u8 *) skb->data);
 174         void *sent;
 175
 176         BT_DBG("%s status 0x%x", hdev->name, status);
 177
 178         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
 179         if (!sent)
 180                 return;
 181
 182         if (!status)
 183                 hdev->link_policy = get_unaligned_le16(sent);
 184
 185         hci_req_complete(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, status);
 186 }
 187
 188 static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
 189 {
 190         __u8 status = *((__u8 *) skb->data);
 191
 192         BT_DBG("%s status 0x%x", hdev->name, status);
 193
 194         clear_bit(HCI_RESET, &hdev->flags);
 195
 196         hci_req_complete(hdev, HCI_OP_RESET, status);
 197
 198         hdev->dev_flags = 0;
 199 }
 200
 201 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 202 {
 203         __u8 status = *((__u8 *) skb->data);
 204         void *sent;
 205
 206         BT_DBG("%s status 0x%x", hdev->name, status);
 207
 208         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
 209         if (!sent)
 210                 return;
 211
 212         hci_dev_lock(hdev);
 213
 214         if (test_bit(HCI_MGMT, &hdev->flags))
 215                 mgmt_set_local_name_complete(hdev, sent, status);
 216
 217         if (status == 0)
 218                 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
 219
 220         hci_dev_unlock(hdev);
 221 }
 222
 223 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 224 {
 225         struct hci_rp_read_local_name *rp = (void *) skb->data;
 226
 227         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 228
 229         if (rp->status)
 230                 return;
 231
 232         memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
 233 }
 234
 235 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
 236 {
 237         __u8 status = *((__u8 *) skb->data);
 238         void *sent;
 239
 240         BT_DBG("%s status 0x%x", hdev->name, status);
 241
 242         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
 243         if (!sent)
 244                 return;
 245
 246         if (!status) {
 247                 __u8 param = *((__u8 *) sent);
 248
 249                 if (param == AUTH_ENABLED)
 250                         set_bit(HCI_AUTH, &hdev->flags);
 251                 else
 252                         clear_bit(HCI_AUTH, &hdev->flags);
 253         }
 254
 255         hci_req_complete(hdev, HCI_OP_WRITE_AUTH_ENABLE, status);
 256 }
 257
 258 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
 259 {
 260         __u8 status = *((__u8 *) skb->data);
 261         void *sent;
 262
 263         BT_DBG("%s status 0x%x", hdev->name, status);
 264
 265         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
 266         if (!sent)
 267                 return;
 268
 269         if (!status) {
 270                 __u8 param = *((__u8 *) sent);
 271
 272                 if (param)
 273                         set_bit(HCI_ENCRYPT, &hdev->flags);
 274                 else
 275                         clear_bit(HCI_ENCRYPT, &hdev->flags);
 276         }
 277
 278         hci_req_complete(hdev, HCI_OP_WRITE_ENCRYPT_MODE, status);
 279 }
 280
 281 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
 282 {
 283         __u8 param, status = *((__u8 *) skb->data);
 284         int old_pscan, old_iscan;
 285         void *sent;
 286
 287         BT_DBG("%s status 0x%x", hdev->name, status);
 288
 289         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
 290         if (!sent)
 291                 return;
 292
 293         param = *((__u8 *) sent);
 294
 295         hci_dev_lock(hdev);
 296
 297         if (status != 0) {
 298                 mgmt_write_scan_failed(hdev, param, status);
 299                 hdev->discov_timeout = 0;
 300                 goto done;
 301         }
 302
 303         old_pscan = test_and_clear_bit(HCI_PSCAN, &hdev->flags);
 304         old_iscan = test_and_clear_bit(HCI_ISCAN, &hdev->flags);
 305
 306         if (param & SCAN_INQUIRY) {
 307                 set_bit(HCI_ISCAN, &hdev->flags);
 308                 if (!old_iscan)
 309                         mgmt_discoverable(hdev, 1);
 310                 if (hdev->discov_timeout > 0) {
 311                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
 312                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
 313                                                                         to);
 314                 }
 315         } else if (old_iscan)
 316                 mgmt_discoverable(hdev, 0);
 317
 318         if (param & SCAN_PAGE) {
 319                 set_bit(HCI_PSCAN, &hdev->flags);
 320                 if (!old_pscan)
 321                         mgmt_connectable(hdev, 1);
 322         } else if (old_pscan)
 323                 mgmt_connectable(hdev, 0);
 324
 325 done:
 326         hci_dev_unlock(hdev);
 327         hci_req_complete(hdev, HCI_OP_WRITE_SCAN_ENABLE, status);
 328 }
 329
 330 static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 331 {
 332         struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
 333
 334         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 335
 336         if (rp->status)
 337                 return;
 338
 339         memcpy(hdev->dev_class, rp->dev_class, 3);
 340
 341         BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
 342                 hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
 343 }
 344
 345 static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 346 {
 347         __u8 status = *((__u8 *) skb->data);
 348         void *sent;
 349
 350         BT_DBG("%s status 0x%x", hdev->name, status);
 351
 352         if (status)
 353                 return;
 354
 355         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
 356         if (!sent)
 357                 return;
 358
 359         memcpy(hdev->dev_class, sent, 3);
 360 }
 361
 362 static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 363 {
 364         struct hci_rp_read_voice_setting *rp = (void *) skb->data;
 365         __u16 setting;
 366
 367         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 368
 369         if (rp->status)
 370                 return;
 371
 372         setting = __le16_to_cpu(rp->voice_setting);
 373
 374         if (hdev->voice_setting == setting)
 375                 return;
 376
 377         hdev->voice_setting = setting;
 378
 379         BT_DBG("%s voice setting 0x%04x", hdev->name, setting);
 380
 381         if (hdev->notify)
 382                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 383 }
 384
 385 static void hci_cc_write_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 386 {
 387         __u8 status = *((__u8 *) skb->data);
 388         __u16 setting;
 389         void *sent;
 390
 391         BT_DBG("%s status 0x%x", hdev->name, status);
 392
 393         if (status)
 394                 return;
 395
 396         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
 397         if (!sent)
 398                 return;
 399
 400         setting = get_unaligned_le16(sent);
 401
 402         if (hdev->voice_setting == setting)
 403                 return;
 404
 405         hdev->voice_setting = setting;
 406
 407         BT_DBG("%s voice setting 0x%04x", hdev->name, setting);
 408
 409         if (hdev->notify)
 410                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 411 }
 412
 413 static void hci_cc_host_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 414 {
 415         __u8 status = *((__u8 *) skb->data);
 416
 417         BT_DBG("%s status 0x%x", hdev->name, status);
 418
 419         hci_req_complete(hdev, HCI_OP_HOST_BUFFER_SIZE, status);
 420 }
 421
 422 static void hci_cc_read_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 423 {
 424         struct hci_rp_read_ssp_mode *rp = (void *) skb->data;
 425
 426         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 427
 428         if (rp->status)
 429                 return;
 430
 431         hdev->ssp_mode = rp->mode;
 432 }
 433
 434 static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 435 {
 436         __u8 status = *((__u8 *) skb->data);
 437         void *sent;
 438
 439         BT_DBG("%s status 0x%x", hdev->name, status);
 440
 441         if (status)
 442                 return;
 443
 444         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
 445         if (!sent)
 446                 return;
 447
 448         hdev->ssp_mode = *((__u8 *) sent);
 449 }
 450
 451 static u8 hci_get_inquiry_mode(struct hci_dev *hdev)
 452 {
 453         if (hdev->features[6] & LMP_EXT_INQ)
 454                 return 2;
 455
 456         if (hdev->features[3] & LMP_RSSI_INQ)
 457                 return 1;
 458
 459         if (hdev->manufacturer == 11 && hdev->hci_rev == 0x00 &&
 460                                                 hdev->lmp_subver == 0x0757)
 461                 return 1;
 462
 463         if (hdev->manufacturer == 15) {
 464                 if (hdev->hci_rev == 0x03 && hdev->lmp_subver == 0x6963)
 465                         return 1;
 466                 if (hdev->hci_rev == 0x09 && hdev->lmp_subver == 0x6963)
 467                         return 1;
 468                 if (hdev->hci_rev == 0x00 && hdev->lmp_subver == 0x6965)
 469                         return 1;
 470         }
 471
 472         if (hdev->manufacturer == 31 && hdev->hci_rev == 0x2005 &&
 473                                                 hdev->lmp_subver == 0x1805)
 474                 return 1;
 475
 476         return 0;
 477 }
 478
 479 static void hci_setup_inquiry_mode(struct hci_dev *hdev)
 480 {
 481         u8 mode;
 482
 483         mode = hci_get_inquiry_mode(hdev);
 484
 485         hci_send_cmd(hdev, HCI_OP_WRITE_INQUIRY_MODE, 1, &mode);
 486 }
 487
 488 static void hci_setup_event_mask(struct hci_dev *hdev)
 489 {
 490         /* The second byte is 0xff instead of 0x9f (two reserved bits
 491          * disabled) since a Broadcom 1.2 dongle doesn't respond to the
 492          * command otherwise */
 493         u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };
 494
 495         /* CSR 1.1 dongles does not accept any bitfield so don't try to set
 496          * any event mask for pre 1.2 devices */
 497         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
 498                 return;
 499
 500         events[4] |= 0x01; /* Flow Specification Complete */
 501         events[4] |= 0x02; /* Inquiry Result with RSSI */
 502         events[4] |= 0x04; /* Read Remote Extended Features Complete */
 503         events[5] |= 0x08; /* Synchronous Connection Complete */
 504         events[5] |= 0x10; /* Synchronous Connection Changed */
 505
 506         if (hdev->features[3] & LMP_RSSI_INQ)
 507                 events[4] |= 0x04; /* Inquiry Result with RSSI */
 508
 509         if (hdev->features[5] & LMP_SNIFF_SUBR)
 510                 events[5] |= 0x20; /* Sniff Subrating */
 511
 512         if (hdev->features[5] & LMP_PAUSE_ENC)
 513                 events[5] |= 0x80; /* Encryption Key Refresh Complete */
 514
 515         if (hdev->features[6] & LMP_EXT_INQ)
 516                 events[5] |= 0x40; /* Extended Inquiry Result */
 517
 518         if (hdev->features[6] & LMP_NO_FLUSH)
 519                 events[7] |= 0x01; /* Enhanced Flush Complete */
 520
 521         if (hdev->features[7] & LMP_LSTO)
 522                 events[6] |= 0x80; /* Link Supervision Timeout Changed */
 523
 524         if (hdev->features[6] & LMP_SIMPLE_PAIR) {
 525                 events[6] |= 0x01;      /* IO Capability Request */
 526                 events[6] |= 0x02;      /* IO Capability Response */
 527                 events[6] |= 0x04;      /* User Confirmation Request */
 528                 events[6] |= 0x08;      /* User Passkey Request */
 529                 events[6] |= 0x10;      /* Remote OOB Data Request */
 530                 events[6] |= 0x20;      /* Simple Pairing Complete */
 531                 events[7] |= 0x04;      /* User Passkey Notification */
 532                 events[7] |= 0x08;      /* Keypress Notification */
 533                 events[7] |= 0x10;      /* Remote Host Supported
 534                                          * Features Notification */
 535         }
 536
 537         if (hdev->features[4] & LMP_LE)
 538                 events[7] |= 0x20;      /* LE Meta-Event */
 539
 540         hci_send_cmd(hdev, HCI_OP_SET_EVENT_MASK, sizeof(events), events);
 541 }
 542
 543 static void hci_set_le_support(struct hci_dev *hdev)
 544 {
 545         struct hci_cp_write_le_host_supported cp;
 546
 547         memset(&cp, 0, sizeof(cp));
 548
 549         if (enable_le) {
 550                 cp.le = 1;
 551                 cp.simul = !!(hdev->features[6] & LMP_SIMUL_LE_BR);
 552         }
 553
 554         hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(cp), &cp);
 555 }
 556
 557 static void hci_setup(struct hci_dev *hdev)
 558 {
 559         hci_setup_event_mask(hdev);
 560
 561         if (hdev->hci_ver > BLUETOOTH_VER_1_1)
 562                 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
 563
 564         if (hdev->features[6] & LMP_SIMPLE_PAIR) {
 565                 u8 mode = 0x01;
 566                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(mode), &mode);
 567         }
 568
 569         if (hdev->features[3] & LMP_RSSI_INQ)
 570                 hci_setup_inquiry_mode(hdev);
 571
 572         if (hdev->features[7] & LMP_INQ_TX_PWR)
 573                 hci_send_cmd(hdev, HCI_OP_READ_INQ_RSP_TX_POWER, 0, NULL);
 574
 575         if (hdev->features[7] & LMP_EXTFEATURES) {
 576                 struct hci_cp_read_local_ext_features cp;
 577
 578                 cp.page = 0x01;
 579                 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES,
 580                                                         sizeof(cp), &cp);
 581         }
 582
 583         if (hdev->features[4] & LMP_LE)
 584                 hci_set_le_support(hdev);
 585 }
 586
 587 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
 588 {
 589         struct hci_rp_read_local_version *rp = (void *) skb->data;
 590
 591         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 592
 593         if (rp->status)
 594                 return;
 595
 596         hdev->hci_ver = rp->hci_ver;
 597         hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
 598         hdev->lmp_ver = rp->lmp_ver;
 599         hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
 600         hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
 601
 602         BT_DBG("%s manufacturer %d hci ver %d:%d", hdev->name,
 603                                         hdev->manufacturer,
 604                                         hdev->hci_ver, hdev->hci_rev);
 605
 606         if (test_bit(HCI_INIT, &hdev->flags))
 607                 hci_setup(hdev);
 608 }
 609
 610 static void hci_setup_link_policy(struct hci_dev *hdev)
 611 {
 612         u16 link_policy = 0;
 613
 614         if (hdev->features[0] & LMP_RSWITCH)
 615                 link_policy |= HCI_LP_RSWITCH;
 616         if (hdev->features[0] & LMP_HOLD)
 617                 link_policy |= HCI_LP_HOLD;
 618         if (hdev->features[0] & LMP_SNIFF)
 619                 link_policy |= HCI_LP_SNIFF;
 620         if (hdev->features[1] & LMP_PARK)
 621                 link_policy |= HCI_LP_PARK;
 622
 623         link_policy = cpu_to_le16(link_policy);
 624         hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY,
 625                                         sizeof(link_policy), &link_policy);
 626 }
 627
 628 static void hci_cc_read_local_commands(struct hci_dev *hdev, struct sk_buff *skb)
 629 {
 630         struct hci_rp_read_local_commands *rp = (void *) skb->data;
 631
 632         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 633
 634         if (rp->status)
 635                 goto done;
 636
 637         memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 638
 639         if (test_bit(HCI_INIT, &hdev->flags) && (hdev->commands[5] & 0x10))
 640                 hci_setup_link_policy(hdev);
 641
 642 done:
 643         hci_req_complete(hdev, HCI_OP_READ_LOCAL_COMMANDS, rp->status);
 644 }
 645
 646 static void hci_cc_read_local_features(struct hci_dev *hdev, struct sk_buff *skb)
 647 {
 648         struct hci_rp_read_local_features *rp = (void *) skb->data;
 649
 650         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 651
 652         if (rp->status)
 653                 return;
 654
 655         memcpy(hdev->features, rp->features, 8);
 656
 657         /* Adjust default settings according to features
 658          * supported by device. */
 659
 660         if (hdev->features[0] & LMP_3SLOT)
 661                 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 662
 663         if (hdev->features[0] & LMP_5SLOT)
 664                 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 665
 666         if (hdev->features[1] & LMP_HV2) {
 667                 hdev->pkt_type  |= (HCI_HV2);
 668                 hdev->esco_type |= (ESCO_HV2);
 669         }
 670
 671         if (hdev->features[1] & LMP_HV3) {
 672                 hdev->pkt_type  |= (HCI_HV3);
 673                 hdev->esco_type |= (ESCO_HV3);
 674         }
 675
 676         if (hdev->features[3] & LMP_ESCO)
 677                 hdev->esco_type |= (ESCO_EV3);
 678
 679         if (hdev->features[4] & LMP_EV4)
 680                 hdev->esco_type |= (ESCO_EV4);
 681
 682         if (hdev->features[4] & LMP_EV5)
 683                 hdev->esco_type |= (ESCO_EV5);
 684
 685         if (hdev->features[5] & LMP_EDR_ESCO_2M)
 686                 hdev->esco_type |= (ESCO_2EV3);
 687
 688         if (hdev->features[5] & LMP_EDR_ESCO_3M)
 689                 hdev->esco_type |= (ESCO_3EV3);
 690
 691         if (hdev->features[5] & LMP_EDR_3S_ESCO)
 692                 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
 693
 694         BT_DBG("%s features 0x%.2x%.2x%.2x%.2x%.2x%.2x%.2x%.2x", hdev->name,
 695                                         hdev->features[0], hdev->features[1],
 696                                         hdev->features[2], hdev->features[3],
 697                                         hdev->features[4], hdev->features[5],
 698                                         hdev->features[6], hdev->features[7]);
 699 }
 700
 701 static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
 702                                                         struct sk_buff *skb)
 703 {
 704         struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
 705
 706         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 707
 708         if (rp->status)
 709                 return;
 710
 711         memcpy(hdev->extfeatures, rp->features, 8);
 712
 713         hci_req_complete(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES, rp->status);
 714 }
 715
 716 static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
 717                                                 struct sk_buff *skb)
 718 {
 719         struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;
 720
 721         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 722
 723         if (rp->status)
 724                 return;
 725
 726         hdev->flow_ctl_mode = rp->mode;
 727
 728         hci_req_complete(hdev, HCI_OP_READ_FLOW_CONTROL_MODE, rp->status);
 729 }
 730
 731 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 732 {
 733         struct hci_rp_read_buffer_size *rp = (void *) skb->data;
 734
 735         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 736
 737         if (rp->status)
 738                 return;
 739
 740         hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
 741         hdev->sco_mtu  = rp->sco_mtu;
 742         hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
 743         hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
 744
 745         if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
 746                 hdev->sco_mtu  = 64;
 747                 hdev->sco_pkts = 8;
 748         }
 749
 750         hdev->acl_cnt = hdev->acl_pkts;
 751         hdev->sco_cnt = hdev->sco_pkts;
 752
 753         BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name,
 754                                         hdev->acl_mtu, hdev->acl_pkts,
 755                                         hdev->sco_mtu, hdev->sco_pkts);
 756 }
 757
 758 static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
 759 {
 760         struct hci_rp_read_bd_addr *rp = (void *) skb->data;
 761
 762         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 763
 764         if (!rp->status)
 765                 bacpy(&hdev->bdaddr, &rp->bdaddr);
 766
 767         hci_req_complete(hdev, HCI_OP_READ_BD_ADDR, rp->status);
 768 }
 769
 770 static void hci_cc_write_ca_timeout(struct hci_dev *hdev, struct sk_buff *skb)
 771 {
 772         __u8 status = *((__u8 *) skb->data);
 773
 774         BT_DBG("%s status 0x%x", hdev->name, status);
 775
 776         hci_req_complete(hdev, HCI_OP_WRITE_CA_TIMEOUT, status);
 777 }
 778
 779 static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
 780                 struct sk_buff *skb)
 781 {
 782         struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
 783
 784         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 785
 786         if (rp->status)
 787                 return;
 788
 789         hdev->amp_status = rp->amp_status;
 790         hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
 791         hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
 792         hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
 793         hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
 794         hdev->amp_type = rp->amp_type;
 795         hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
 796         hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
 797         hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
 798         hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
 799
 800         hci_req_complete(hdev, HCI_OP_READ_LOCAL_AMP_INFO, rp->status);
 801 }
 802
 803 static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
 804                                                         struct sk_buff *skb)
 805 {
 806         __u8 status = *((__u8 *) skb->data);
 807
 808         BT_DBG("%s status 0x%x", hdev->name, status);
 809
 810         hci_req_complete(hdev, HCI_OP_DELETE_STORED_LINK_KEY, status);
 811 }
 812
 813 static void hci_cc_set_event_mask(struct hci_dev *hdev, struct sk_buff *skb)
 814 {
 815         __u8 status = *((__u8 *) skb->data);
 816
 817         BT_DBG("%s status 0x%x", hdev->name, status);
 818
 819         hci_req_complete(hdev, HCI_OP_SET_EVENT_MASK, status);
 820 }
 821
 822 static void hci_cc_write_inquiry_mode(struct hci_dev *hdev,
 823                                                         struct sk_buff *skb)
 824 {
 825         __u8 status = *((__u8 *) skb->data);
 826
 827         BT_DBG("%s status 0x%x", hdev->name, status);
 828
 829         hci_req_complete(hdev, HCI_OP_WRITE_INQUIRY_MODE, status);
 830 }
 831
 832 static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
 833                                                         struct sk_buff *skb)
 834 {
 835         __u8 status = *((__u8 *) skb->data);
 836
 837         BT_DBG("%s status 0x%x", hdev->name, status);
 838
 839         hci_req_complete(hdev, HCI_OP_READ_INQ_RSP_TX_POWER, status);
 840 }
 841
 842 static void hci_cc_set_event_flt(struct hci_dev *hdev, struct sk_buff *skb)
 843 {
 844         __u8 status = *((__u8 *) skb->data);
 845
 846         BT_DBG("%s status 0x%x", hdev->name, status);
 847
 848         hci_req_complete(hdev, HCI_OP_SET_EVENT_FLT, status);
 849 }
 850
 851 static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
 852 {
 853         struct hci_rp_pin_code_reply *rp = (void *) skb->data;
 854         struct hci_cp_pin_code_reply *cp;
 855         struct hci_conn *conn;
 856
 857         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 858
 859         hci_dev_lock(hdev);
 860
 861         if (test_bit(HCI_MGMT, &hdev->flags))
 862                 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
 863
 864         if (rp->status != 0)
 865                 goto unlock;
 866
 867         cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
 868         if (!cp)
 869                 goto unlock;
 870
 871         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 872         if (conn)
 873                 conn->pin_length = cp->pin_len;
 874
 875 unlock:
 876         hci_dev_unlock(hdev);
 877 }
 878
 879 static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
 880 {
 881         struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
 882
 883         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 884
 885         hci_dev_lock(hdev);
 886
 887         if (test_bit(HCI_MGMT, &hdev->flags))
 888                 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
 889                                                                 rp->status);
 890
 891         hci_dev_unlock(hdev);
 892 }
 893
 894 static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
 895                                        struct sk_buff *skb)
 896 {
 897         struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
 898
 899         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 900
 901         if (rp->status)
 902                 return;
 903
 904         hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
 905         hdev->le_pkts = rp->le_max_pkt;
 906
 907         hdev->le_cnt = hdev->le_pkts;
 908
 909         BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
 910
 911         hci_req_complete(hdev, HCI_OP_LE_READ_BUFFER_SIZE, rp->status);
 912 }
 913
 914 static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
 915 {
 916         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 917
 918         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 919
 920         hci_dev_lock(hdev);
 921
 922         if (test_bit(HCI_MGMT, &hdev->flags))
 923                 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr,
 924                                                                 rp->status);
 925
 926         hci_dev_unlock(hdev);
 927 }
 928
 929 static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
 930                                                         struct sk_buff *skb)
 931 {
 932         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 933
 934         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 935
 936         hci_dev_lock(hdev);
 937
 938         if (test_bit(HCI_MGMT, &hdev->flags))
 939                 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
 940                                                                 rp->status);
 941
 942         hci_dev_unlock(hdev);
 943 }
 944
 945 static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
 946 {
 947         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 948
 949         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 950
 951         hci_dev_lock(hdev);
 952
 953         if (test_bit(HCI_MGMT, &hdev->flags))
 954                 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr,
 955                                                                 rp->status);
 956
 957         hci_dev_unlock(hdev);
 958 }
 959
 960 static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
 961                                                         struct sk_buff *skb)
 962 {
 963         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 964
 965         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 966
 967         hci_dev_lock(hdev);
 968
 969         if (test_bit(HCI_MGMT, &hdev->flags))
 970                 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
 971                                                                 rp->status);
 972
 973         hci_dev_unlock(hdev);
 974 }
 975
 976 static void hci_cc_read_local_oob_data_reply(struct hci_dev *hdev,
 977                                                         struct sk_buff *skb)
 978 {
 979         struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
 980
 981         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 982
 983         hci_dev_lock(hdev);
 984         mgmt_read_local_oob_data_reply_complete(hdev, rp->hash,
 985                                                 rp->randomizer, rp->status);
 986         hci_dev_unlock(hdev);
 987 }
 988
 989 static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
 990 {
 991         __u8 status = *((__u8 *) skb->data);
 992
 993         BT_DBG("%s status 0x%x", hdev->name, status);
 994 }
 995
 996 static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
 997                                         struct sk_buff *skb)
 998 {
 999         struct hci_cp_le_set_scan_enable *cp;
1000         __u8 status = *((__u8 *) skb->data);
1001
1002         BT_DBG("%s status 0x%x", hdev->name, status);
1003
1004         if (status)
1005                 return;
1006
1007         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
1008         if (!cp)
1009                 return;
1010
1011         if (cp->enable == 0x01) {
1012                 set_bit(HCI_LE_SCAN, &hdev->dev_flags);
1013
1014                 cancel_delayed_work_sync(&hdev->adv_work);
1015
1016                 hci_dev_lock(hdev);
1017                 hci_adv_entries_clear(hdev);
1018                 hci_dev_unlock(hdev);
1019         } else if (cp->enable == 0x00) {
1020                 clear_bit(HCI_LE_SCAN, &hdev->dev_flags);
1021
1022                 cancel_delayed_work_sync(&hdev->adv_work);
1023                 queue_delayed_work(hdev->workqueue, &hdev->adv_work,
1024                                                  jiffies + ADV_CLEAR_TIMEOUT);
1025         }
1026 }
1027
1028 static void hci_cc_le_ltk_reply(struct hci_dev *hdev, struct sk_buff *skb)
1029 {
1030         struct hci_rp_le_ltk_reply *rp = (void *) skb->data;
1031
1032         BT_DBG("%s status 0x%x", hdev->name, rp->status);
1033
1034         if (rp->status)
1035                 return;
1036
1037         hci_req_complete(hdev, HCI_OP_LE_LTK_REPLY, rp->status);
1038 }
1039
1040 static void hci_cc_le_ltk_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
1041 {
1042         struct hci_rp_le_ltk_neg_reply *rp = (void *) skb->data;
1043
1044         BT_DBG("%s status 0x%x", hdev->name, rp->status);
1045
1046         if (rp->status)
1047                 return;
1048
1049         hci_req_complete(hdev, HCI_OP_LE_LTK_NEG_REPLY, rp->status);
1050 }
1051
1052 static inline void hci_cc_write_le_host_supported(struct hci_dev *hdev,
1053                                                         struct sk_buff *skb)
1054 {
1055         struct hci_cp_read_local_ext_features cp;
1056         __u8 status = *((__u8 *) skb->data);
1057
1058         BT_DBG("%s status 0x%x", hdev->name, status);
1059
1060         if (status)
1061                 return;
1062
1063         cp.page = 0x01;
1064         hci_send_cmd(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES, sizeof(cp), &cp);
1065 }
1066
1067 static inline void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
1068 {
1069         BT_DBG("%s status 0x%x", hdev->name, status);
1070
1071         if (status) {
1072                 hci_req_complete(hdev, HCI_OP_INQUIRY, status);
1073                 hci_conn_check_pending(hdev);
1074                 hci_dev_lock(hdev);
1075                 if (test_bit(HCI_MGMT, &hdev->flags))
1076                         mgmt_start_discovery_failed(hdev, status);
1077                 hci_dev_unlock(hdev);
1078                 return;
1079         }
1080
1081         set_bit(HCI_INQUIRY, &hdev->flags);
1082
1083         hci_dev_lock(hdev);
1084         mgmt_discovering(hdev, 1);
1085         hci_dev_unlock(hdev);
1086 }
1087
1088 static inline void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
1089 {
1090         struct hci_cp_create_conn *cp;
1091         struct hci_conn *conn;
1092
1093         BT_DBG("%s status 0x%x", hdev->name, status);
1094
1095         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
1096         if (!cp)
1097                 return;
1098
1099         hci_dev_lock(hdev);
1100
1101         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1102
1103         BT_DBG("%s bdaddr %s conn %p", hdev->name, batostr(&cp->bdaddr), conn);
1104
1105         if (status) {
1106                 if (conn && conn->state == BT_CONNECT) {
1107                         if (status != 0x0c || conn->attempt > 2) {
1108                                 conn->state = BT_CLOSED;
1109                                 hci_proto_connect_cfm(conn, status);
1110                                 hci_conn_del(conn);
1111                         } else
1112                                 conn->state = BT_CONNECT2;
1113                 }
1114         } else {
1115                 if (!conn) {
1116                         conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr);
1117                         if (conn) {
1118                                 conn->out = 1;
1119                                 conn->link_mode |= HCI_LM_MASTER;
1120                         } else
1121                                 BT_ERR("No memory for new connection");
1122                 }
1123         }
1124
1125         hci_dev_unlock(hdev);
1126 }
1127
1128 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
1129 {
1130         struct hci_cp_add_sco *cp;
1131         struct hci_conn *acl, *sco;
1132         __u16 handle;
1133
1134         BT_DBG("%s status 0x%x", hdev->name, status);
1135
1136         if (!status)
1137                 return;
1138
1139         cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
1140         if (!cp)
1141                 return;
1142
1143         handle = __le16_to_cpu(cp->handle);
1144
1145         BT_DBG("%s handle %d", hdev->name, handle);
1146
1147         hci_dev_lock(hdev);
1148
1149         acl = hci_conn_hash_lookup_handle(hdev, handle);
1150         if (acl) {
1151                 sco = acl->link;
1152                 if (sco) {
1153                         sco->state = BT_CLOSED;
1154
1155                         hci_proto_connect_cfm(sco, status);
1156                         hci_conn_del(sco);
1157                 }
1158         }
1159
1160         hci_dev_unlock(hdev);
1161 }
1162
1163 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
1164 {
1165         struct hci_cp_auth_requested *cp;
1166         struct hci_conn *conn;
1167
1168         BT_DBG("%s status 0x%x", hdev->name, status);
1169
1170         if (!status)
1171                 return;
1172
1173         cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
1174         if (!cp)
1175                 return;
1176
1177         hci_dev_lock(hdev);
1178
1179         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1180         if (conn) {
1181                 if (conn->state == BT_CONFIG) {
1182                         hci_proto_connect_cfm(conn, status);
1183                         hci_conn_put(conn);
1184                 }
1185         }
1186
1187         hci_dev_unlock(hdev);
1188 }
1189
1190 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
1191 {
1192         struct hci_cp_set_conn_encrypt *cp;
1193         struct hci_conn *conn;
1194
1195         BT_DBG("%s status 0x%x", hdev->name, status);
1196
1197         if (!status)
1198                 return;
1199
1200         cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
1201         if (!cp)
1202                 return;
1203
1204         hci_dev_lock(hdev);
1205
1206         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1207         if (conn) {
1208                 if (conn->state == BT_CONFIG) {
1209                         hci_proto_connect_cfm(conn, status);
1210                         hci_conn_put(conn);
1211                 }
1212         }
1213
1214         hci_dev_unlock(hdev);
1215 }
1216
1217 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
1218                                                         struct hci_conn *conn)
1219 {
1220         if (conn->state != BT_CONFIG || !conn->out)
1221                 return 0;
1222
1223         if (conn->pending_sec_level == BT_SECURITY_SDP)
1224                 return 0;
1225
1226         /* Only request authentication for SSP connections or non-SSP
1227          * devices with sec_level HIGH or if MITM protection is requested */
1228         if (!(hdev->ssp_mode > 0 && conn->ssp_mode > 0) &&
1229                                 conn->pending_sec_level != BT_SECURITY_HIGH &&
1230                                 !(conn->auth_type & 0x01))
1231                 return 0;
1232
1233         return 1;
1234 }
1235
1236 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
1237 {
1238         struct hci_cp_remote_name_req *cp;
1239         struct hci_conn *conn;
1240
1241         BT_DBG("%s status 0x%x", hdev->name, status);
1242
1243         /* If successful wait for the name req complete event before
1244          * checking for the need to do authentication */
1245         if (!status)
1246                 return;
1247
1248         cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
1249         if (!cp)
1250                 return;
1251
1252         hci_dev_lock(hdev);
1253
1254         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1255         if (!conn)
1256                 goto unlock;
1257
1258         if (!hci_outgoing_auth_needed(hdev, conn))
1259                 goto unlock;
1260
1261         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
1262                 struct hci_cp_auth_requested cp;
1263                 cp.handle = __cpu_to_le16(conn->handle);
1264                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
1265         }
1266
1267 unlock:
1268         hci_dev_unlock(hdev);
1269 }
1270
1271 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
1272 {
1273         struct hci_cp_read_remote_features *cp;
1274         struct hci_conn *conn;
1275
1276         BT_DBG("%s status 0x%x", hdev->name, status);
1277
1278         if (!status)
1279                 return;
1280
1281         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
1282         if (!cp)
1283                 return;
1284
1285         hci_dev_lock(hdev);
1286
1287         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1288         if (conn) {
1289                 if (conn->state == BT_CONFIG) {
1290                         hci_proto_connect_cfm(conn, status);
1291                         hci_conn_put(conn);
1292                 }
1293         }
1294
1295         hci_dev_unlock(hdev);
1296 }
1297
1298 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
1299 {
1300         struct hci_cp_read_remote_ext_features *cp;
1301         struct hci_conn *conn;
1302
1303         BT_DBG("%s status 0x%x", hdev->name, status);
1304
1305         if (!status)
1306                 return;
1307
1308         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
1309         if (!cp)
1310                 return;
1311
1312         hci_dev_lock(hdev);
1313
1314         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1315         if (conn) {
1316                 if (conn->state == BT_CONFIG) {
1317                         hci_proto_connect_cfm(conn, status);
1318                         hci_conn_put(conn);
1319                 }
1320         }
1321
1322         hci_dev_unlock(hdev);
1323 }
1324
1325 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
1326 {
1327         struct hci_cp_setup_sync_conn *cp;
1328         struct hci_conn *acl, *sco;
1329         __u16 handle;
1330
1331         BT_DBG("%s status 0x%x", hdev->name, status);
1332
1333         if (!status)
1334                 return;
1335
1336         cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
1337         if (!cp)
1338                 return;
1339
1340         handle = __le16_to_cpu(cp->handle);
1341
1342         BT_DBG("%s handle %d", hdev->name, handle);
1343
1344         hci_dev_lock(hdev);
1345
1346         acl = hci_conn_hash_lookup_handle(hdev, handle);
1347         if (acl) {
1348                 sco = acl->link;
1349                 if (sco) {
1350                         sco->state = BT_CLOSED;
1351
1352                         hci_proto_connect_cfm(sco, status);
1353                         hci_conn_del(sco);
1354                 }
1355         }
1356
1357         hci_dev_unlock(hdev);
1358 }
1359
1360 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
1361 {
1362         struct hci_cp_sniff_mode *cp;
1363         struct hci_conn *conn;
1364
1365         BT_DBG("%s status 0x%x", hdev->name, status);
1366
1367         if (!status)
1368                 return;
1369
1370         cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
1371         if (!cp)
1372                 return;
1373
1374         hci_dev_lock(hdev);
1375
1376         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1377         if (conn) {
1378                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend);
1379
1380                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->pend))
1381                         hci_sco_setup(conn, status);
1382         }
1383
1384         hci_dev_unlock(hdev);
1385 }
1386
1387 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
1388 {
1389         struct hci_cp_exit_sniff_mode *cp;
1390         struct hci_conn *conn;
1391
1392         BT_DBG("%s status 0x%x", hdev->name, status);
1393
1394         if (!status)
1395                 return;
1396
1397         cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
1398         if (!cp)
1399                 return;
1400
1401         hci_dev_lock(hdev);
1402
1403         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1404         if (conn) {
1405                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend);
1406
1407                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->pend))
1408                         hci_sco_setup(conn, status);
1409         }
1410
1411         hci_dev_unlock(hdev);
1412 }
1413
1414 static void hci_cs_le_create_conn(struct hci_dev *hdev, __u8 status)
1415 {
1416         struct hci_cp_le_create_conn *cp;
1417         struct hci_conn *conn;
1418
1419         BT_DBG("%s status 0x%x", hdev->name, status);
1420
1421         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
1422         if (!cp)
1423                 return;
1424
1425         hci_dev_lock(hdev);
1426
1427         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->peer_addr);
1428
1429         BT_DBG("%s bdaddr %s conn %p", hdev->name, batostr(&cp->peer_addr),
1430                 conn);
1431
1432         if (status) {
1433                 if (conn && conn->state == BT_CONNECT) {
1434                         conn->state = BT_CLOSED;
1435                         hci_proto_connect_cfm(conn, status);
1436                         hci_conn_del(conn);
1437                 }
1438         } else {
1439                 if (!conn) {
1440                         conn = hci_conn_add(hdev, LE_LINK, &cp->peer_addr);
1441                         if (conn) {
1442                                 conn->dst_type = cp->peer_addr_type;
1443                                 conn->out = 1;
1444                         } else {
1445                                 BT_ERR("No memory for new connection");
1446                         }
1447                 }
1448         }
1449
1450         hci_dev_unlock(hdev);
1451 }
1452
1453 static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
1454 {
1455         BT_DBG("%s status 0x%x", hdev->name, status);
1456 }
1457
1458 static inline void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1459 {
1460         __u8 status = *((__u8 *) skb->data);
1461
1462         BT_DBG("%s status %d", hdev->name, status);
1463
1464         hci_req_complete(hdev, HCI_OP_INQUIRY, status);
1465
1466         hci_conn_check_pending(hdev);
1467
1468         if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
1469                 return;
1470
1471         hci_dev_lock(hdev);
1472         mgmt_discovering(hdev, 0);
1473         hci_dev_unlock(hdev);
1474 }
1475
1476 static inline void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
1477 {
1478         struct inquiry_data data;
1479         struct inquiry_info *info = (void *) (skb->data + 1);
1480         int num_rsp = *((__u8 *) skb->data);
1481
1482         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
1483
1484         if (!num_rsp)
1485                 return;
1486
1487         hci_dev_lock(hdev);
1488
1489         for (; num_rsp; num_rsp--, info++) {
1490                 bacpy(&data.bdaddr, &info->bdaddr);
1491                 data.pscan_rep_mode     = info->pscan_rep_mode;
1492                 data.pscan_period_mode  = info->pscan_period_mode;
1493                 data.pscan_mode         = info->pscan_mode;
1494                 memcpy(data.dev_class, info->dev_class, 3);
1495                 data.clock_offset       = info->clock_offset;
1496                 data.rssi               = 0x00;
1497                 data.ssp_mode           = 0x00;
1498                 hci_inquiry_cache_update(hdev, &data);
1499                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
1500                                                 info->dev_class, 0, NULL);
1501         }
1502
1503         hci_dev_unlock(hdev);
1504 }
1505
1506 static inline void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1507 {
1508         struct hci_ev_conn_complete *ev = (void *) skb->data;
1509         struct hci_conn *conn;
1510
1511         BT_DBG("%s", hdev->name);
1512
1513         hci_dev_lock(hdev);
1514
1515         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
1516         if (!conn) {
1517                 if (ev->link_type != SCO_LINK)
1518                         goto unlock;
1519
1520                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
1521                 if (!conn)
1522                         goto unlock;
1523
1524                 conn->type = SCO_LINK;
1525         }
1526
1527         if (!ev->status) {
1528                 conn->handle = __le16_to_cpu(ev->handle);
1529
1530                 if (conn->type == ACL_LINK) {
1531                         conn->state = BT_CONFIG;
1532                         hci_conn_hold(conn);
1533                         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
1534                         mgmt_connected(hdev, &ev->bdaddr, conn->type,
1535                                                         conn->dst_type);
1536                 } else
1537                         conn->state = BT_CONNECTED;
1538
1539                 hci_conn_hold_device(conn);
1540                 hci_conn_add_sysfs(conn);
1541
1542                 if (test_bit(HCI_AUTH, &hdev->flags))
1543                         conn->link_mode |= HCI_LM_AUTH;
1544
1545                 if (test_bit(HCI_ENCRYPT, &hdev->flags))
1546                         conn->link_mode |= HCI_LM_ENCRYPT;
1547
1548                 /* Get remote features */
1549                 if (conn->type == ACL_LINK) {
1550                         struct hci_cp_read_remote_features cp;
1551                         cp.handle = ev->handle;
1552                         hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
1553                                                         sizeof(cp), &cp);
1554                 }
1555
1556                 /* Set packet type for incoming connection */
1557                 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
1558                         struct hci_cp_change_conn_ptype cp;
1559                         cp.handle = ev->handle;
1560                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
1561                         hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE,
1562                                                         sizeof(cp), &cp);
1563                 }
1564         } else {
1565                 conn->state = BT_CLOSED;
1566                 if (conn->type == ACL_LINK)
1567                         mgmt_connect_failed(hdev, &ev->bdaddr, conn->type,
1568                                                 conn->dst_type, ev->status);
1569         }
1570
1571         if (conn->type == ACL_LINK)
1572                 hci_sco_setup(conn, ev->status);
1573
1574         if (ev->status) {
1575                 hci_proto_connect_cfm(conn, ev->status);
1576                 hci_conn_del(conn);
1577         } else if (ev->link_type != ACL_LINK)
1578                 hci_proto_connect_cfm(conn, ev->status);
1579
1580 unlock:
1581         hci_dev_unlock(hdev);
1582
1583         hci_conn_check_pending(hdev);
1584 }
1585
1586 static inline void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
1587 {
1588         struct hci_ev_conn_request *ev = (void *) skb->data;
1589         int mask = hdev->link_mode;
1590
1591         BT_DBG("%s bdaddr %s type 0x%x", hdev->name,
1592                                         batostr(&ev->bdaddr), ev->link_type);
1593
1594         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type);
1595
1596         if ((mask & HCI_LM_ACCEPT) &&
1597                         !hci_blacklist_lookup(hdev, &ev->bdaddr)) {
1598                 /* Connection accepted */
1599                 struct inquiry_entry *ie;
1600                 struct hci_conn *conn;
1601
1602                 hci_dev_lock(hdev);
1603
1604                 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
1605                 if (ie)
1606                         memcpy(ie->data.dev_class, ev->dev_class, 3);
1607
1608                 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
1609                 if (!conn) {
1610                         conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr);
1611                         if (!conn) {
1612                                 BT_ERR("No memory for new connection");
1613                                 hci_dev_unlock(hdev);
1614                                 return;
1615                         }
1616                 }
1617
1618                 memcpy(conn->dev_class, ev->dev_class, 3);
1619                 conn->state = BT_CONNECT;
1620
1621                 hci_dev_unlock(hdev);
1622
1623                 if (ev->link_type == ACL_LINK || !lmp_esco_capable(hdev)) {
1624                         struct hci_cp_accept_conn_req cp;
1625
1626                         bacpy(&cp.bdaddr, &ev->bdaddr);
1627
1628                         if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
1629                                 cp.role = 0x00; /* Become master */
1630                         else
1631                                 cp.role = 0x01; /* Remain slave */
1632
1633                         hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ,
1634                                                         sizeof(cp), &cp);
1635                 } else {
1636                         struct hci_cp_accept_sync_conn_req cp;
1637
1638                         bacpy(&cp.bdaddr, &ev->bdaddr);
1639                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
1640
1641                         cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
1642                         cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
1643                         cp.max_latency    = cpu_to_le16(0xffff);
1644                         cp.content_format = cpu_to_le16(hdev->voice_setting);
1645                         cp.retrans_effort = 0xff;
1646
1647                         hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ,
1648                                                         sizeof(cp), &cp);
1649                 }
1650         } else {
1651                 /* Connection rejected */
1652                 struct hci_cp_reject_conn_req cp;
1653
1654                 bacpy(&cp.bdaddr, &ev->bdaddr);
1655                 cp.reason = HCI_ERROR_REJ_BAD_ADDR;
1656                 hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
1657         }
1658 }
1659
1660 static inline void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1661 {
1662         struct hci_ev_disconn_complete *ev = (void *) skb->data;
1663         struct hci_conn *conn;
1664
1665         BT_DBG("%s status %d", hdev->name, ev->status);
1666
1667         hci_dev_lock(hdev);
1668
1669         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1670         if (!conn)
1671                 goto unlock;
1672
1673         if (ev->status == 0)
1674                 conn->state = BT_CLOSED;
1675
1676         if (conn->type == ACL_LINK || conn->type == LE_LINK) {
1677                 if (ev->status != 0)
1678                         mgmt_disconnect_failed(hdev, &conn->dst, ev->status);
1679                 else
1680                         mgmt_disconnected(hdev, &conn->dst, conn->type,
1681                                                         conn->dst_type);
1682         }
1683
1684         if (ev->status == 0) {
1685                 hci_proto_disconn_cfm(conn, ev->reason);
1686                 hci_conn_del(conn);
1687         }
1688
1689 unlock:
1690         hci_dev_unlock(hdev);
1691 }
1692
1693 static inline void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1694 {
1695         struct hci_ev_auth_complete *ev = (void *) skb->data;
1696         struct hci_conn *conn;
1697
1698         BT_DBG("%s status %d", hdev->name, ev->status);
1699
1700         hci_dev_lock(hdev);
1701
1702         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1703         if (!conn)
1704                 goto unlock;
1705
1706         if (!ev->status) {
1707                 if (!(conn->ssp_mode > 0 && hdev->ssp_mode > 0) &&
1708                                 test_bit(HCI_CONN_REAUTH_PEND,  &conn->pend)) {
1709                         BT_INFO("re-auth of legacy device is not possible.");
1710                 } else {
1711                         conn->link_mode |= HCI_LM_AUTH;
1712                         conn->sec_level = conn->pending_sec_level;
1713                 }
1714         } else {
1715                 mgmt_auth_failed(hdev, &conn->dst, ev->status);
1716         }
1717
1718         clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
1719         clear_bit(HCI_CONN_REAUTH_PEND, &conn->pend);
1720
1721         if (conn->state == BT_CONFIG) {
1722                 if (!ev->status && hdev->ssp_mode > 0 && conn->ssp_mode > 0) {
1723                         struct hci_cp_set_conn_encrypt cp;
1724                         cp.handle  = ev->handle;
1725                         cp.encrypt = 0x01;
1726                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
1727                                                                         &cp);
1728                 } else {
1729                         conn->state = BT_CONNECTED;
1730                         hci_proto_connect_cfm(conn, ev->status);
1731                         hci_conn_put(conn);
1732                 }
1733         } else {
1734                 hci_auth_cfm(conn, ev->status);
1735
1736                 hci_conn_hold(conn);
1737                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
1738                 hci_conn_put(conn);
1739         }
1740
1741         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend)) {
1742                 if (!ev->status) {
1743                         struct hci_cp_set_conn_encrypt cp;
1744                         cp.handle  = ev->handle;
1745                         cp.encrypt = 0x01;
1746                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
1747                                                                         &cp);
1748                 } else {
1749                         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
1750                         hci_encrypt_cfm(conn, ev->status, 0x00);
1751                 }
1752         }
1753
1754 unlock:
1755         hci_dev_unlock(hdev);
1756 }
1757
1758 static inline void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
1759 {
1760         struct hci_ev_remote_name *ev = (void *) skb->data;
1761         struct hci_conn *conn;
1762
1763         BT_DBG("%s", hdev->name);
1764
1765         hci_conn_check_pending(hdev);
1766
1767         hci_dev_lock(hdev);
1768
1769         if (ev->status == 0 && test_bit(HCI_MGMT, &hdev->flags))
1770                 mgmt_remote_name(hdev, &ev->bdaddr, ev->name);
1771
1772         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
1773         if (!conn)
1774                 goto unlock;
1775
1776         if (!hci_outgoing_auth_needed(hdev, conn))
1777                 goto unlock;
1778
1779         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
1780                 struct hci_cp_auth_requested cp;
1781                 cp.handle = __cpu_to_le16(conn->handle);
1782                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
1783         }
1784
1785 unlock:
1786         hci_dev_unlock(hdev);
1787 }
1788
1789 static inline void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
1790 {
1791         struct hci_ev_encrypt_change *ev = (void *) skb->data;
1792         struct hci_conn *conn;
1793
1794         BT_DBG("%s status %d", hdev->name, ev->status);
1795
1796         hci_dev_lock(hdev);
1797
1798         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1799         if (conn) {
1800                 if (!ev->status) {
1801                         if (ev->encrypt) {
1802                                 /* Encryption implies authentication */
1803                                 conn->link_mode |= HCI_LM_AUTH;
1804                                 conn->link_mode |= HCI_LM_ENCRYPT;
1805                                 conn->sec_level = conn->pending_sec_level;
1806                         } else
1807                                 conn->link_mode &= ~HCI_LM_ENCRYPT;
1808                 }
1809
1810                 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
1811
1812                 if (conn->state == BT_CONFIG) {
1813                         if (!ev->status)
1814                                 conn->state = BT_CONNECTED;
1815
1816                         hci_proto_connect_cfm(conn, ev->status);
1817                         hci_conn_put(conn);
1818                 } else
1819                         hci_encrypt_cfm(conn, ev->status, ev->encrypt);
1820         }
1821
1822         hci_dev_unlock(hdev);
1823 }
1824
1825 static inline void hci_change_link_key_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1826 {
1827         struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
1828         struct hci_conn *conn;
1829
1830         BT_DBG("%s status %d", hdev->name, ev->status);
1831
1832         hci_dev_lock(hdev);
1833
1834         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1835         if (conn) {
1836                 if (!ev->status)
1837                         conn->link_mode |= HCI_LM_SECURE;
1838
1839                 clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
1840
1841                 hci_key_change_cfm(conn, ev->status);
1842         }
1843
1844         hci_dev_unlock(hdev);
1845 }
1846
1847 static inline void hci_remote_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
1848 {
1849         struct hci_ev_remote_features *ev = (void *) skb->data;
1850         struct hci_conn *conn;
1851
1852         BT_DBG("%s status %d", hdev->name, ev->status);
1853
1854         hci_dev_lock(hdev);
1855
1856         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1857         if (!conn)
1858                 goto unlock;
1859
1860         if (!ev->status)
1861                 memcpy(conn->features, ev->features, 8);
1862
1863         if (conn->state != BT_CONFIG)
1864                 goto unlock;
1865
1866         if (!ev->status && lmp_ssp_capable(hdev) && lmp_ssp_capable(conn)) {
1867                 struct hci_cp_read_remote_ext_features cp;
1868                 cp.handle = ev->handle;
1869                 cp.page = 0x01;
1870                 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
1871                                                         sizeof(cp), &cp);
1872                 goto unlock;
1873         }
1874
1875         if (!ev->status) {
1876                 struct hci_cp_remote_name_req cp;
1877                 memset(&cp, 0, sizeof(cp));
1878                 bacpy(&cp.bdaddr, &conn->dst);
1879                 cp.pscan_rep_mode = 0x02;
1880                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1881         }
1882
1883         if (!hci_outgoing_auth_needed(hdev, conn)) {
1884                 conn->state = BT_CONNECTED;
1885                 hci_proto_connect_cfm(conn, ev->status);
1886                 hci_conn_put(conn);
1887         }
1888
1889 unlock:
1890         hci_dev_unlock(hdev);
1891 }
1892
1893 static inline void hci_remote_version_evt(struct hci_dev *hdev, struct sk_buff *skb)
1894 {
1895         BT_DBG("%s", hdev->name);
1896 }
1897
1898 static inline void hci_qos_setup_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1899 {
1900         BT_DBG("%s", hdev->name);
1901 }
1902
1903 static inline void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1904 {
1905         struct hci_ev_cmd_complete *ev = (void *) skb->data;
1906         __u16 opcode;
1907
1908         skb_pull(skb, sizeof(*ev));
1909
1910         opcode = __le16_to_cpu(ev->opcode);
1911
1912         switch (opcode) {
1913         case HCI_OP_INQUIRY_CANCEL:
1914                 hci_cc_inquiry_cancel(hdev, skb);
1915                 break;
1916
1917         case HCI_OP_EXIT_PERIODIC_INQ:
1918                 hci_cc_exit_periodic_inq(hdev, skb);
1919                 break;
1920
1921         case HCI_OP_REMOTE_NAME_REQ_CANCEL:
1922                 hci_cc_remote_name_req_cancel(hdev, skb);
1923                 break;
1924
1925         case HCI_OP_ROLE_DISCOVERY:
1926                 hci_cc_role_discovery(hdev, skb);
1927                 break;
1928
1929         case HCI_OP_READ_LINK_POLICY:
1930                 hci_cc_read_link_policy(hdev, skb);
1931                 break;
1932
1933         case HCI_OP_WRITE_LINK_POLICY:
1934                 hci_cc_write_link_policy(hdev, skb);
1935                 break;
1936
1937         case HCI_OP_READ_DEF_LINK_POLICY:
1938                 hci_cc_read_def_link_policy(hdev, skb);
1939                 break;
1940
1941         case HCI_OP_WRITE_DEF_LINK_POLICY:
1942                 hci_cc_write_def_link_policy(hdev, skb);
1943                 break;
1944
1945         case HCI_OP_RESET:
1946                 hci_cc_reset(hdev, skb);
1947                 break;
1948
1949         case HCI_OP_WRITE_LOCAL_NAME:
1950                 hci_cc_write_local_name(hdev, skb);
1951                 break;
1952
1953         case HCI_OP_READ_LOCAL_NAME:
1954                 hci_cc_read_local_name(hdev, skb);
1955                 break;
1956
1957         case HCI_OP_WRITE_AUTH_ENABLE:
1958                 hci_cc_write_auth_enable(hdev, skb);
1959                 break;
1960
1961         case HCI_OP_WRITE_ENCRYPT_MODE:
1962                 hci_cc_write_encrypt_mode(hdev, skb);
1963                 break;
1964
1965         case HCI_OP_WRITE_SCAN_ENABLE:
1966                 hci_cc_write_scan_enable(hdev, skb);
1967                 break;
1968
1969         case HCI_OP_READ_CLASS_OF_DEV:
1970                 hci_cc_read_class_of_dev(hdev, skb);
1971                 break;
1972
1973         case HCI_OP_WRITE_CLASS_OF_DEV:
1974                 hci_cc_write_class_of_dev(hdev, skb);
1975                 break;
1976
1977         case HCI_OP_READ_VOICE_SETTING:
1978                 hci_cc_read_voice_setting(hdev, skb);
1979                 break;
1980
1981         case HCI_OP_WRITE_VOICE_SETTING:
1982                 hci_cc_write_voice_setting(hdev, skb);
1983                 break;
1984
1985         case HCI_OP_HOST_BUFFER_SIZE:
1986                 hci_cc_host_buffer_size(hdev, skb);
1987                 break;
1988
1989         case HCI_OP_READ_SSP_MODE:
1990                 hci_cc_read_ssp_mode(hdev, skb);
1991                 break;
1992
1993         case HCI_OP_WRITE_SSP_MODE:
1994                 hci_cc_write_ssp_mode(hdev, skb);
1995                 break;
1996
1997         case HCI_OP_READ_LOCAL_VERSION:
1998                 hci_cc_read_local_version(hdev, skb);
1999                 break;
2000
2001         case HCI_OP_READ_LOCAL_COMMANDS:
2002                 hci_cc_read_local_commands(hdev, skb);
2003                 break;
2004
2005         case HCI_OP_READ_LOCAL_FEATURES:
2006                 hci_cc_read_local_features(hdev, skb);
2007                 break;
2008
2009         case HCI_OP_READ_LOCAL_EXT_FEATURES:
2010                 hci_cc_read_local_ext_features(hdev, skb);
2011                 break;
2012
2013         case HCI_OP_READ_BUFFER_SIZE:
2014                 hci_cc_read_buffer_size(hdev, skb);
2015                 break;
2016
2017         case HCI_OP_READ_BD_ADDR:
2018                 hci_cc_read_bd_addr(hdev, skb);
2019                 break;
2020
2021         case HCI_OP_WRITE_CA_TIMEOUT:
2022                 hci_cc_write_ca_timeout(hdev, skb);
2023                 break;
2024
2025         case HCI_OP_READ_FLOW_CONTROL_MODE:
2026                 hci_cc_read_flow_control_mode(hdev, skb);
2027                 break;
2028
2029         case HCI_OP_READ_LOCAL_AMP_INFO:
2030                 hci_cc_read_local_amp_info(hdev, skb);
2031                 break;
2032
2033         case HCI_OP_DELETE_STORED_LINK_KEY:
2034                 hci_cc_delete_stored_link_key(hdev, skb);
2035                 break;
2036
2037         case HCI_OP_SET_EVENT_MASK:
2038                 hci_cc_set_event_mask(hdev, skb);
2039                 break;
2040
2041         case HCI_OP_WRITE_INQUIRY_MODE:
2042                 hci_cc_write_inquiry_mode(hdev, skb);
2043                 break;
2044
2045         case HCI_OP_READ_INQ_RSP_TX_POWER:
2046                 hci_cc_read_inq_rsp_tx_power(hdev, skb);
2047                 break;
2048
2049         case HCI_OP_SET_EVENT_FLT:
2050                 hci_cc_set_event_flt(hdev, skb);
2051                 break;
2052
2053         case HCI_OP_PIN_CODE_REPLY:
2054                 hci_cc_pin_code_reply(hdev, skb);
2055                 break;
2056
2057         case HCI_OP_PIN_CODE_NEG_REPLY:
2058                 hci_cc_pin_code_neg_reply(hdev, skb);
2059                 break;
2060
2061         case HCI_OP_READ_LOCAL_OOB_DATA:
2062                 hci_cc_read_local_oob_data_reply(hdev, skb);
2063                 break;
2064
2065         case HCI_OP_LE_READ_BUFFER_SIZE:
2066                 hci_cc_le_read_buffer_size(hdev, skb);
2067                 break;
2068
2069         case HCI_OP_USER_CONFIRM_REPLY:
2070                 hci_cc_user_confirm_reply(hdev, skb);
2071                 break;
2072
2073         case HCI_OP_USER_CONFIRM_NEG_REPLY:
2074                 hci_cc_user_confirm_neg_reply(hdev, skb);
2075                 break;
2076
2077         case HCI_OP_USER_PASSKEY_REPLY:
2078                 hci_cc_user_passkey_reply(hdev, skb);
2079                 break;
2080
2081         case HCI_OP_USER_PASSKEY_NEG_REPLY:
2082                 hci_cc_user_passkey_neg_reply(hdev, skb);
2083
2084         case HCI_OP_LE_SET_SCAN_PARAM:
2085                 hci_cc_le_set_scan_param(hdev, skb);
2086                 break;
2087
2088         case HCI_OP_LE_SET_SCAN_ENABLE:
2089                 hci_cc_le_set_scan_enable(hdev, skb);
2090                 break;
2091
2092         case HCI_OP_LE_LTK_REPLY:
2093                 hci_cc_le_ltk_reply(hdev, skb);
2094                 break;
2095
2096         case HCI_OP_LE_LTK_NEG_REPLY:
2097                 hci_cc_le_ltk_neg_reply(hdev, skb);
2098                 break;
2099
2100         case HCI_OP_WRITE_LE_HOST_SUPPORTED:
2101                 hci_cc_write_le_host_supported(hdev, skb);
2102                 break;
2103
2104         default:
2105                 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
2106                 break;
2107         }
2108
2109         if (ev->opcode != HCI_OP_NOP)
2110                 del_timer(&hdev->cmd_timer);
2111
2112         if (ev->ncmd) {
2113                 atomic_set(&hdev->cmd_cnt, 1);
2114                 if (!skb_queue_empty(&hdev->cmd_q))
2115                         queue_work(hdev->workqueue, &hdev->cmd_work);
2116         }
2117 }
2118
2119 static inline void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb)
2120 {
2121         struct hci_ev_cmd_status *ev = (void *) skb->data;
2122         __u16 opcode;
2123
2124         skb_pull(skb, sizeof(*ev));
2125
2126         opcode = __le16_to_cpu(ev->opcode);
2127
2128         switch (opcode) {
2129         case HCI_OP_INQUIRY:
2130                 hci_cs_inquiry(hdev, ev->status);
2131                 break;
2132
2133         case HCI_OP_CREATE_CONN:
2134                 hci_cs_create_conn(hdev, ev->status);
2135                 break;
2136
2137         case HCI_OP_ADD_SCO:
2138                 hci_cs_add_sco(hdev, ev->status);
2139                 break;
2140
2141         case HCI_OP_AUTH_REQUESTED:
2142                 hci_cs_auth_requested(hdev, ev->status);
2143                 break;
2144
2145         case HCI_OP_SET_CONN_ENCRYPT:
2146                 hci_cs_set_conn_encrypt(hdev, ev->status);
2147                 break;
2148
2149         case HCI_OP_REMOTE_NAME_REQ:
2150                 hci_cs_remote_name_req(hdev, ev->status);
2151                 break;
2152
2153         case HCI_OP_READ_REMOTE_FEATURES:
2154                 hci_cs_read_remote_features(hdev, ev->status);
2155                 break;
2156
2157         case HCI_OP_READ_REMOTE_EXT_FEATURES:
2158                 hci_cs_read_remote_ext_features(hdev, ev->status);
2159                 break;
2160
2161         case HCI_OP_SETUP_SYNC_CONN:
2162                 hci_cs_setup_sync_conn(hdev, ev->status);
2163                 break;
2164
2165         case HCI_OP_SNIFF_MODE:
2166                 hci_cs_sniff_mode(hdev, ev->status);
2167                 break;
2168
2169         case HCI_OP_EXIT_SNIFF_MODE:
2170                 hci_cs_exit_sniff_mode(hdev, ev->status);
2171                 break;
2172
2173         case HCI_OP_DISCONNECT:
2174                 if (ev->status != 0)
2175                         mgmt_disconnect_failed(hdev, NULL, ev->status);
2176                 break;
2177
2178         case HCI_OP_LE_CREATE_CONN:
2179                 hci_cs_le_create_conn(hdev, ev->status);
2180                 break;
2181
2182         case HCI_OP_LE_START_ENC:
2183                 hci_cs_le_start_enc(hdev, ev->status);
2184                 break;
2185
2186         default:
2187                 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
2188                 break;
2189         }
2190
2191         if (ev->opcode != HCI_OP_NOP)
2192                 del_timer(&hdev->cmd_timer);
2193
2194         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
2195                 atomic_set(&hdev->cmd_cnt, 1);
2196                 if (!skb_queue_empty(&hdev->cmd_q))
2197                         queue_work(hdev->workqueue, &hdev->cmd_work);
2198         }
2199 }
2200
2201 static inline void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2202 {
2203         struct hci_ev_role_change *ev = (void *) skb->data;
2204         struct hci_conn *conn;
2205
2206         BT_DBG("%s status %d", hdev->name, ev->status);
2207
2208         hci_dev_lock(hdev);
2209
2210         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2211         if (conn) {
2212                 if (!ev->status) {
2213                         if (ev->role)
2214                                 conn->link_mode &= ~HCI_LM_MASTER;
2215                         else
2216                                 conn->link_mode |= HCI_LM_MASTER;
2217                 }
2218
2219                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->pend);
2220
2221                 hci_role_switch_cfm(conn, ev->status, ev->role);
2222         }
2223
2224         hci_dev_unlock(hdev);
2225 }
2226
2227 static inline void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
2228 {
2229         struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
2230         __le16 *ptr;
2231         int i;
2232
2233         skb_pull(skb, sizeof(*ev));
2234
2235         BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
2236
2237         if (skb->len < ev->num_hndl * 4) {
2238                 BT_DBG("%s bad parameters", hdev->name);
2239                 return;
2240         }
2241
2242         for (i = 0, ptr = (__le16 *) skb->data; i < ev->num_hndl; i++) {
2243                 struct hci_conn *conn;
2244                 __u16  handle, count;
2245
2246                 handle = get_unaligned_le16(ptr++);
2247                 count  = get_unaligned_le16(ptr++);
2248
2249                 conn = hci_conn_hash_lookup_handle(hdev, handle);
2250                 if (conn) {
2251                         conn->sent -= count;
2252
2253                         if (conn->type == ACL_LINK) {
2254                                 hdev->acl_cnt += count;
2255                                 if (hdev->acl_cnt > hdev->acl_pkts)
2256                                         hdev->acl_cnt = hdev->acl_pkts;
2257                         } else if (conn->type == LE_LINK) {
2258                                 if (hdev->le_pkts) {
2259                                         hdev->le_cnt += count;
2260                                         if (hdev->le_cnt > hdev->le_pkts)
2261                                                 hdev->le_cnt = hdev->le_pkts;
2262                                 } else {
2263                                         hdev->acl_cnt += count;
2264                                         if (hdev->acl_cnt > hdev->acl_pkts)
2265                                                 hdev->acl_cnt = hdev->acl_pkts;
2266                                 }
2267                         } else {
2268                                 hdev->sco_cnt += count;
2269                                 if (hdev->sco_cnt > hdev->sco_pkts)
2270                                         hdev->sco_cnt = hdev->sco_pkts;
2271                         }
2272                 }
2273         }
2274
2275         queue_work(hdev->workqueue, &hdev->tx_work);
2276 }
2277
2278 static inline void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2279 {
2280         struct hci_ev_mode_change *ev = (void *) skb->data;
2281         struct hci_conn *conn;
2282
2283         BT_DBG("%s status %d", hdev->name, ev->status);
2284
2285         hci_dev_lock(hdev);
2286
2287         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2288         if (conn) {
2289                 conn->mode = ev->mode;
2290                 conn->interval = __le16_to_cpu(ev->interval);
2291
2292                 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
2293                         if (conn->mode == HCI_CM_ACTIVE)
2294                                 conn->power_save = 1;
2295                         else
2296                                 conn->power_save = 0;
2297                 }
2298
2299                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->pend))
2300                         hci_sco_setup(conn, ev->status);
2301         }
2302
2303         hci_dev_unlock(hdev);
2304 }
2305
2306 static inline void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2307 {
2308         struct hci_ev_pin_code_req *ev = (void *) skb->data;
2309         struct hci_conn *conn;
2310
2311         BT_DBG("%s", hdev->name);
2312
2313         hci_dev_lock(hdev);
2314
2315         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2316         if (!conn)
2317                 goto unlock;
2318
2319         if (conn->state == BT_CONNECTED) {
2320                 hci_conn_hold(conn);
2321                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2322                 hci_conn_put(conn);
2323         }
2324
2325         if (!test_bit(HCI_PAIRABLE, &hdev->flags))
2326                 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2327                                         sizeof(ev->bdaddr), &ev->bdaddr);
2328         else if (test_bit(HCI_MGMT, &hdev->flags)) {
2329                 u8 secure;
2330
2331                 if (conn->pending_sec_level == BT_SECURITY_HIGH)
2332                         secure = 1;
2333                 else
2334                         secure = 0;
2335
2336                 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
2337         }
2338
2339 unlock:
2340         hci_dev_unlock(hdev);
2341 }
2342
2343 static inline void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2344 {
2345         struct hci_ev_link_key_req *ev = (void *) skb->data;
2346         struct hci_cp_link_key_reply cp;
2347         struct hci_conn *conn;
2348         struct link_key *key;
2349
2350         BT_DBG("%s", hdev->name);
2351
2352         if (!test_bit(HCI_LINK_KEYS, &hdev->flags))
2353                 return;
2354
2355         hci_dev_lock(hdev);
2356
2357         key = hci_find_link_key(hdev, &ev->bdaddr);
2358         if (!key) {
2359                 BT_DBG("%s link key not found for %s", hdev->name,
2360                                                         batostr(&ev->bdaddr));
2361                 goto not_found;
2362         }
2363
2364         BT_DBG("%s found key type %u for %s", hdev->name, key->type,
2365                                                         batostr(&ev->bdaddr));
2366
2367         if (!test_bit(HCI_DEBUG_KEYS, &hdev->flags) &&
2368                                 key->type == HCI_LK_DEBUG_COMBINATION) {
2369                 BT_DBG("%s ignoring debug key", hdev->name);
2370                 goto not_found;
2371         }
2372
2373         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2374         if (conn) {
2375                 if (key->type == HCI_LK_UNAUTH_COMBINATION &&
2376                                 conn->auth_type != 0xff &&
2377                                 (conn->auth_type & 0x01)) {
2378                         BT_DBG("%s ignoring unauthenticated key", hdev->name);
2379                         goto not_found;
2380                 }
2381
2382                 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
2383                                 conn->pending_sec_level == BT_SECURITY_HIGH) {
2384                         BT_DBG("%s ignoring key unauthenticated for high \
2385                                                         security", hdev->name);
2386                         goto not_found;
2387                 }
2388
2389                 conn->key_type = key->type;
2390                 conn->pin_length = key->pin_len;
2391         }
2392
2393         bacpy(&cp.bdaddr, &ev->bdaddr);
2394         memcpy(cp.link_key, key->val, 16);
2395
2396         hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
2397
2398         hci_dev_unlock(hdev);
2399
2400         return;
2401
2402 not_found:
2403         hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
2404         hci_dev_unlock(hdev);
2405 }
2406
2407 static inline void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
2408 {
2409         struct hci_ev_link_key_notify *ev = (void *) skb->data;
2410         struct hci_conn *conn;
2411         u8 pin_len = 0;
2412
2413         BT_DBG("%s", hdev->name);
2414
2415         hci_dev_lock(hdev);
2416
2417         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2418         if (conn) {
2419                 hci_conn_hold(conn);
2420                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2421                 pin_len = conn->pin_length;
2422
2423                 if (ev->key_type != HCI_LK_CHANGED_COMBINATION)
2424                         conn->key_type = ev->key_type;
2425
2426                 hci_conn_put(conn);
2427         }
2428
2429         if (test_bit(HCI_LINK_KEYS, &hdev->flags))
2430                 hci_add_link_key(hdev, conn, 1, &ev->bdaddr, ev->link_key,
2431                                                         ev->key_type, pin_len);
2432
2433         hci_dev_unlock(hdev);
2434 }
2435
2436 static inline void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
2437 {
2438         struct hci_ev_clock_offset *ev = (void *) skb->data;
2439         struct hci_conn *conn;
2440
2441         BT_DBG("%s status %d", hdev->name, ev->status);
2442
2443         hci_dev_lock(hdev);
2444
2445         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2446         if (conn && !ev->status) {
2447                 struct inquiry_entry *ie;
2448
2449                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
2450                 if (ie) {
2451                         ie->data.clock_offset = ev->clock_offset;
2452                         ie->timestamp = jiffies;
2453                 }
2454         }
2455
2456         hci_dev_unlock(hdev);
2457 }
2458
2459 static inline void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2460 {
2461         struct hci_ev_pkt_type_change *ev = (void *) skb->data;
2462         struct hci_conn *conn;
2463
2464         BT_DBG("%s status %d", hdev->name, ev->status);
2465
2466         hci_dev_lock(hdev);
2467
2468         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2469         if (conn && !ev->status)
2470                 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
2471
2472         hci_dev_unlock(hdev);
2473 }
2474
2475 static inline void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
2476 {
2477         struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
2478         struct inquiry_entry *ie;
2479
2480         BT_DBG("%s", hdev->name);
2481
2482         hci_dev_lock(hdev);
2483
2484         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2485         if (ie) {
2486                 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
2487                 ie->timestamp = jiffies;
2488         }
2489
2490         hci_dev_unlock(hdev);
2491 }
2492
2493 static inline void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, struct sk_buff *skb)
2494 {
2495         struct inquiry_data data;
2496         int num_rsp = *((__u8 *) skb->data);
2497
2498         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2499
2500         if (!num_rsp)
2501                 return;
2502
2503         hci_dev_lock(hdev);
2504
2505         if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
2506                 struct inquiry_info_with_rssi_and_pscan_mode *info;
2507                 info = (void *) (skb->data + 1);
2508
2509                 for (; num_rsp; num_rsp--, info++) {
2510                         bacpy(&data.bdaddr, &info->bdaddr);
2511                         data.pscan_rep_mode     = info->pscan_rep_mode;
2512                         data.pscan_period_mode  = info->pscan_period_mode;
2513                         data.pscan_mode         = info->pscan_mode;
2514                         memcpy(data.dev_class, info->dev_class, 3);
2515                         data.clock_offset       = info->clock_offset;
2516                         data.rssi               = info->rssi;
2517                         data.ssp_mode           = 0x00;
2518                         hci_inquiry_cache_update(hdev, &data);
2519                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2520                                                 info->dev_class, info->rssi,
2521                                                 NULL);
2522                 }
2523         } else {
2524                 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
2525
2526                 for (; num_rsp; num_rsp--, info++) {
2527                         bacpy(&data.bdaddr, &info->bdaddr);
2528                         data.pscan_rep_mode     = info->pscan_rep_mode;
2529                         data.pscan_period_mode  = info->pscan_period_mode;
2530                         data.pscan_mode         = 0x00;
2531                         memcpy(data.dev_class, info->dev_class, 3);
2532                         data.clock_offset       = info->clock_offset;
2533                         data.rssi               = info->rssi;
2534                         data.ssp_mode           = 0x00;
2535                         hci_inquiry_cache_update(hdev, &data);
2536                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2537                                                 info->dev_class, info->rssi,
2538                                                 NULL);
2539                 }
2540         }
2541
2542         hci_dev_unlock(hdev);
2543 }
2544
2545 static inline void hci_remote_ext_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
2546 {
2547         struct hci_ev_remote_ext_features *ev = (void *) skb->data;
2548         struct hci_conn *conn;
2549
2550         BT_DBG("%s", hdev->name);
2551
2552         hci_dev_lock(hdev);
2553
2554         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2555         if (!conn)
2556                 goto unlock;
2557
2558         if (!ev->status && ev->page == 0x01) {
2559                 struct inquiry_entry *ie;
2560
2561                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
2562                 if (ie)
2563                         ie->data.ssp_mode = (ev->features[0] & 0x01);
2564
2565                 conn->ssp_mode = (ev->features[0] & 0x01);
2566         }
2567
2568         if (conn->state != BT_CONFIG)
2569                 goto unlock;
2570
2571         if (!ev->status) {
2572                 struct hci_cp_remote_name_req cp;
2573                 memset(&cp, 0, sizeof(cp));
2574                 bacpy(&cp.bdaddr, &conn->dst);
2575                 cp.pscan_rep_mode = 0x02;
2576                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2577         }
2578
2579         if (!hci_outgoing_auth_needed(hdev, conn)) {
2580                 conn->state = BT_CONNECTED;
2581                 hci_proto_connect_cfm(conn, ev->status);
2582                 hci_conn_put(conn);
2583         }
2584
2585 unlock:
2586         hci_dev_unlock(hdev);
2587 }
2588
2589 static inline void hci_sync_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2590 {
2591         struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
2592         struct hci_conn *conn;
2593
2594         BT_DBG("%s status %d", hdev->name, ev->status);
2595
2596         hci_dev_lock(hdev);
2597
2598         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
2599         if (!conn) {
2600                 if (ev->link_type == ESCO_LINK)
2601                         goto unlock;
2602
2603                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
2604                 if (!conn)
2605                         goto unlock;
2606
2607                 conn->type = SCO_LINK;
2608         }
2609
2610         switch (ev->status) {
2611         case 0x00:
2612                 conn->handle = __le16_to_cpu(ev->handle);
2613                 conn->state  = BT_CONNECTED;
2614
2615                 hci_conn_hold_device(conn);
2616                 hci_conn_add_sysfs(conn);
2617                 break;
2618
2619         case 0x11:      /* Unsupported Feature or Parameter Value */
2620         case 0x1c:      /* SCO interval rejected */
2621         case 0x1a:      /* Unsupported Remote Feature */
2622         case 0x1f:      /* Unspecified error */
2623                 if (conn->out && conn->attempt < 2) {
2624                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
2625                                         (hdev->esco_type & EDR_ESCO_MASK);
2626                         hci_setup_sync(conn, conn->link->handle);
2627                         goto unlock;
2628                 }
2629                 /* fall through */
2630
2631         default:
2632                 conn->state = BT_CLOSED;
2633                 break;
2634         }
2635
2636         hci_proto_connect_cfm(conn, ev->status);
2637         if (ev->status)
2638                 hci_conn_del(conn);
2639
2640 unlock:
2641         hci_dev_unlock(hdev);
2642 }
2643
2644 static inline void hci_sync_conn_changed_evt(struct hci_dev *hdev, struct sk_buff *skb)
2645 {
2646         BT_DBG("%s", hdev->name);
2647 }
2648
2649 static inline void hci_sniff_subrate_evt(struct hci_dev *hdev, struct sk_buff *skb)
2650 {
2651         struct hci_ev_sniff_subrate *ev = (void *) skb->data;
2652
2653         BT_DBG("%s status %d", hdev->name, ev->status);
2654 }
2655
2656 static inline void hci_extended_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
2657 {
2658         struct inquiry_data data;
2659         struct extended_inquiry_info *info = (void *) (skb->data + 1);
2660         int num_rsp = *((__u8 *) skb->data);
2661
2662         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2663
2664         if (!num_rsp)
2665                 return;
2666
2667         hci_dev_lock(hdev);
2668
2669         for (; num_rsp; num_rsp--, info++) {
2670                 bacpy(&data.bdaddr, &info->bdaddr);
2671                 data.pscan_rep_mode     = info->pscan_rep_mode;
2672                 data.pscan_period_mode  = info->pscan_period_mode;
2673                 data.pscan_mode         = 0x00;
2674                 memcpy(data.dev_class, info->dev_class, 3);
2675                 data.clock_offset       = info->clock_offset;
2676                 data.rssi               = info->rssi;
2677                 data.ssp_mode           = 0x01;
2678                 hci_inquiry_cache_update(hdev, &data);
2679                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2680                                 info->dev_class, info->rssi, info->data);
2681         }
2682
2683         hci_dev_unlock(hdev);
2684 }
2685
2686 static inline u8 hci_get_auth_req(struct hci_conn *conn)
2687 {
2688         /* If remote requests dedicated bonding follow that lead */
2689         if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03) {
2690                 /* If both remote and local IO capabilities allow MITM
2691                  * protection then require it, otherwise don't */
2692                 if (conn->remote_cap == 0x03 || conn->io_capability == 0x03)
2693                         return 0x02;
2694                 else
2695                         return 0x03;
2696         }
2697
2698         /* If remote requests no-bonding follow that lead */
2699         if (conn->remote_auth == 0x00 || conn->remote_auth == 0x01)
2700                 return conn->remote_auth | (conn->auth_type & 0x01);
2701
2702         return conn->auth_type;
2703 }
2704
2705 static inline void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2706 {
2707         struct hci_ev_io_capa_request *ev = (void *) skb->data;
2708         struct hci_conn *conn;
2709
2710         BT_DBG("%s", hdev->name);
2711
2712         hci_dev_lock(hdev);
2713
2714         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2715         if (!conn)
2716                 goto unlock;
2717
2718         hci_conn_hold(conn);
2719
2720         if (!test_bit(HCI_MGMT, &hdev->flags))
2721                 goto unlock;
2722
2723         if (test_bit(HCI_PAIRABLE, &hdev->flags) ||
2724                         (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
2725                 struct hci_cp_io_capability_reply cp;
2726
2727                 bacpy(&cp.bdaddr, &ev->bdaddr);
2728                 cp.capability = conn->io_capability;
2729                 conn->auth_type = hci_get_auth_req(conn);
2730                 cp.authentication = conn->auth_type;
2731
2732                 if ((conn->out == 0x01 || conn->remote_oob == 0x01) &&
2733                                 hci_find_remote_oob_data(hdev, &conn->dst))
2734                         cp.oob_data = 0x01;
2735                 else
2736                         cp.oob_data = 0x00;
2737
2738                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
2739                                                         sizeof(cp), &cp);
2740         } else {
2741                 struct hci_cp_io_capability_neg_reply cp;
2742
2743                 bacpy(&cp.bdaddr, &ev->bdaddr);
2744                 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
2745
2746                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
2747                                                         sizeof(cp), &cp);
2748         }
2749
2750 unlock:
2751         hci_dev_unlock(hdev);
2752 }
2753
2754 static inline void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
2755 {
2756         struct hci_ev_io_capa_reply *ev = (void *) skb->data;
2757         struct hci_conn *conn;
2758
2759         BT_DBG("%s", hdev->name);
2760
2761         hci_dev_lock(hdev);
2762
2763         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2764         if (!conn)
2765                 goto unlock;
2766
2767         conn->remote_cap = ev->capability;
2768         conn->remote_oob = ev->oob_data;
2769         conn->remote_auth = ev->authentication;
2770
2771 unlock:
2772         hci_dev_unlock(hdev);
2773 }
2774
2775 static inline void hci_user_confirm_request_evt(struct hci_dev *hdev,
2776                                                         struct sk_buff *skb)
2777 {
2778         struct hci_ev_user_confirm_req *ev = (void *) skb->data;
2779         int loc_mitm, rem_mitm, confirm_hint = 0;
2780         struct hci_conn *conn;
2781
2782         BT_DBG("%s", hdev->name);
2783
2784         hci_dev_lock(hdev);
2785
2786         if (!test_bit(HCI_MGMT, &hdev->flags))
2787                 goto unlock;
2788
2789         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2790         if (!conn)
2791                 goto unlock;
2792
2793         loc_mitm = (conn->auth_type & 0x01);
2794         rem_mitm = (conn->remote_auth & 0x01);
2795
2796         /* If we require MITM but the remote device can't provide that
2797          * (it has NoInputNoOutput) then reject the confirmation
2798          * request. The only exception is when we're dedicated bonding
2799          * initiators (connect_cfm_cb set) since then we always have the MITM
2800          * bit set. */
2801         if (!conn->connect_cfm_cb && loc_mitm && conn->remote_cap == 0x03) {
2802                 BT_DBG("Rejecting request: remote device can't provide MITM");
2803                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
2804                                         sizeof(ev->bdaddr), &ev->bdaddr);
2805                 goto unlock;
2806         }
2807
2808         /* If no side requires MITM protection; auto-accept */
2809         if ((!loc_mitm || conn->remote_cap == 0x03) &&
2810                                 (!rem_mitm || conn->io_capability == 0x03)) {
2811
2812                 /* If we're not the initiators request authorization to
2813                  * proceed from user space (mgmt_user_confirm with
2814                  * confirm_hint set to 1). */
2815                 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
2816                         BT_DBG("Confirming auto-accept as acceptor");
2817                         confirm_hint = 1;
2818                         goto confirm;
2819                 }
2820
2821                 BT_DBG("Auto-accept of user confirmation with %ums delay",
2822                                                 hdev->auto_accept_delay);
2823
2824                 if (hdev->auto_accept_delay > 0) {
2825                         int delay = msecs_to_jiffies(hdev->auto_accept_delay);
2826                         mod_timer(&conn->auto_accept_timer, jiffies + delay);
2827                         goto unlock;
2828                 }
2829
2830                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
2831                                                 sizeof(ev->bdaddr), &ev->bdaddr);
2832                 goto unlock;
2833         }
2834
2835 confirm:
2836         mgmt_user_confirm_request(hdev, &ev->bdaddr, ev->passkey,
2837                                                                 confirm_hint);
2838
2839 unlock:
2840         hci_dev_unlock(hdev);
2841 }
2842
2843 static inline void hci_user_passkey_request_evt(struct hci_dev *hdev,
2844                                                         struct sk_buff *skb)
2845 {
2846         struct hci_ev_user_passkey_req *ev = (void *) skb->data;
2847
2848         BT_DBG("%s", hdev->name);
2849
2850         hci_dev_lock(hdev);
2851
2852         if (test_bit(HCI_MGMT, &hdev->flags))
2853                 mgmt_user_passkey_request(hdev, &ev->bdaddr);
2854
2855         hci_dev_unlock(hdev);
2856 }
2857
2858 static inline void hci_simple_pair_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2859 {
2860         struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
2861         struct hci_conn *conn;
2862
2863         BT_DBG("%s", hdev->name);
2864
2865         hci_dev_lock(hdev);
2866
2867         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2868         if (!conn)
2869                 goto unlock;
2870
2871         /* To avoid duplicate auth_failed events to user space we check
2872          * the HCI_CONN_AUTH_PEND flag which will be set if we
2873          * initiated the authentication. A traditional auth_complete
2874          * event gets always produced as initiator and is also mapped to
2875          * the mgmt_auth_failed event */
2876         if (!test_bit(HCI_CONN_AUTH_PEND, &conn->pend) && ev->status != 0)
2877                 mgmt_auth_failed(hdev, &conn->dst, ev->status);
2878
2879         hci_conn_put(conn);
2880
2881 unlock:
2882         hci_dev_unlock(hdev);
2883 }
2884
2885 static inline void hci_remote_host_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
2886 {
2887         struct hci_ev_remote_host_features *ev = (void *) skb->data;
2888         struct inquiry_entry *ie;
2889
2890         BT_DBG("%s", hdev->name);
2891
2892         hci_dev_lock(hdev);
2893
2894         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2895         if (ie)
2896                 ie->data.ssp_mode = (ev->features[0] & 0x01);
2897
2898         hci_dev_unlock(hdev);
2899 }
2900
2901 static inline void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
2902                                                         struct sk_buff *skb)
2903 {
2904         struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
2905         struct oob_data *data;
2906
2907         BT_DBG("%s", hdev->name);
2908
2909         hci_dev_lock(hdev);
2910
2911         if (!test_bit(HCI_MGMT, &hdev->flags))
2912                 goto unlock;
2913
2914         data = hci_find_remote_oob_data(hdev, &ev->bdaddr);
2915         if (data) {
2916                 struct hci_cp_remote_oob_data_reply cp;
2917
2918                 bacpy(&cp.bdaddr, &ev->bdaddr);
2919                 memcpy(cp.hash, data->hash, sizeof(cp.hash));
2920                 memcpy(cp.randomizer, data->randomizer, sizeof(cp.randomizer));
2921
2922                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY, sizeof(cp),
2923                                                                         &cp);
2924         } else {
2925                 struct hci_cp_remote_oob_data_neg_reply cp;
2926
2927                 bacpy(&cp.bdaddr, &ev->bdaddr);
2928                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY, sizeof(cp),
2929                                                                         &cp);
2930         }
2931
2932 unlock:
2933         hci_dev_unlock(hdev);
2934 }
2935
2936 static inline void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2937 {
2938         struct hci_ev_le_conn_complete *ev = (void *) skb->data;
2939         struct hci_conn *conn;
2940
2941         BT_DBG("%s status %d", hdev->name, ev->status);
2942
2943         hci_dev_lock(hdev);
2944
2945         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &ev->bdaddr);
2946         if (!conn) {
2947                 conn = hci_conn_add(hdev, LE_LINK, &ev->bdaddr);
2948                 if (!conn) {
2949                         BT_ERR("No memory for new connection");
2950                         hci_dev_unlock(hdev);
2951                         return;
2952                 }
2953
2954                 conn->dst_type = ev->bdaddr_type;
2955         }
2956
2957         if (ev->status) {
2958                 mgmt_connect_failed(hdev, &ev->bdaddr, conn->type,
2959                                                 conn->dst_type, ev->status);
2960                 hci_proto_connect_cfm(conn, ev->status);
2961                 conn->state = BT_CLOSED;
2962                 hci_conn_del(conn);
2963                 goto unlock;
2964         }
2965
2966         mgmt_connected(hdev, &ev->bdaddr, conn->type, conn->dst_type);
2967
2968         conn->sec_level = BT_SECURITY_LOW;
2969         conn->handle = __le16_to_cpu(ev->handle);
2970         conn->state = BT_CONNECTED;
2971
2972         hci_conn_hold_device(conn);
2973         hci_conn_add_sysfs(conn);
2974
2975         hci_proto_connect_cfm(conn, ev->status);
2976
2977 unlock:
2978         hci_dev_unlock(hdev);
2979 }
2980
2981 static inline void hci_le_adv_report_evt(struct hci_dev *hdev,
2982                                                 struct sk_buff *skb)
2983 {
2984         u8 num_reports = skb->data[0];
2985         void *ptr = &skb->data[1];
2986
2987         hci_dev_lock(hdev);
2988
2989         while (num_reports--) {
2990                 struct hci_ev_le_advertising_info *ev = ptr;
2991
2992                 hci_add_adv_entry(hdev, ev);
2993
2994                 ptr += sizeof(*ev) + ev->length + 1;
2995         }
2996
2997         hci_dev_unlock(hdev);
2998 }
2999
3000 static inline void hci_le_ltk_request_evt(struct hci_dev *hdev,
3001                                                 struct sk_buff *skb)
3002 {
3003         struct hci_ev_le_ltk_req *ev = (void *) skb->data;
3004         struct hci_cp_le_ltk_reply cp;
3005         struct hci_cp_le_ltk_neg_reply neg;
3006         struct hci_conn *conn;
3007         struct link_key *ltk;
3008
3009         BT_DBG("%s handle %d", hdev->name, cpu_to_le16(ev->handle));
3010
3011         hci_dev_lock(hdev);
3012
3013         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3014         if (conn == NULL)
3015                 goto not_found;
3016
3017         ltk = hci_find_ltk(hdev, ev->ediv, ev->random);
3018         if (ltk == NULL)
3019                 goto not_found;
3020
3021         memcpy(cp.ltk, ltk->val, sizeof(ltk->val));
3022         cp.handle = cpu_to_le16(conn->handle);
3023         conn->pin_length = ltk->pin_len;
3024
3025         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
3026
3027         hci_dev_unlock(hdev);
3028
3029         return;
3030
3031 not_found:
3032         neg.handle = ev->handle;
3033         hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
3034         hci_dev_unlock(hdev);
3035 }
3036
3037 static inline void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
3038 {
3039         struct hci_ev_le_meta *le_ev = (void *) skb->data;
3040
3041         skb_pull(skb, sizeof(*le_ev));
3042
3043         switch (le_ev->subevent) {
3044         case HCI_EV_LE_CONN_COMPLETE:
3045                 hci_le_conn_complete_evt(hdev, skb);
3046                 break;
3047
3048         case HCI_EV_LE_ADVERTISING_REPORT:
3049                 hci_le_adv_report_evt(hdev, skb);
3050                 break;
3051
3052         case HCI_EV_LE_LTK_REQ:
3053                 hci_le_ltk_request_evt(hdev, skb);
3054                 break;
3055
3056         default:
3057                 break;
3058         }
3059 }
3060
3061 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
3062 {
3063         struct hci_event_hdr *hdr = (void *) skb->data;
3064         __u8 event = hdr->evt;
3065
3066         skb_pull(skb, HCI_EVENT_HDR_SIZE);
3067
3068         switch (event) {
3069         case HCI_EV_INQUIRY_COMPLETE:
3070                 hci_inquiry_complete_evt(hdev, skb);
3071                 break;
3072
3073         case HCI_EV_INQUIRY_RESULT:
3074                 hci_inquiry_result_evt(hdev, skb);
3075                 break;
3076
3077         case HCI_EV_CONN_COMPLETE:
3078                 hci_conn_complete_evt(hdev, skb);
3079                 break;
3080
3081         case HCI_EV_CONN_REQUEST:
3082                 hci_conn_request_evt(hdev, skb);
3083                 break;
3084
3085         case HCI_EV_DISCONN_COMPLETE:
3086                 hci_disconn_complete_evt(hdev, skb);
3087                 break;
3088
3089         case HCI_EV_AUTH_COMPLETE:
3090                 hci_auth_complete_evt(hdev, skb);
3091                 break;
3092
3093         case HCI_EV_REMOTE_NAME:
3094                 hci_remote_name_evt(hdev, skb);
3095                 break;
3096
3097         case HCI_EV_ENCRYPT_CHANGE:
3098                 hci_encrypt_change_evt(hdev, skb);
3099                 break;
3100
3101         case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
3102                 hci_change_link_key_complete_evt(hdev, skb);
3103                 break;
3104
3105         case HCI_EV_REMOTE_FEATURES:
3106                 hci_remote_features_evt(hdev, skb);
3107                 break;
3108
3109         case HCI_EV_REMOTE_VERSION:
3110                 hci_remote_version_evt(hdev, skb);
3111                 break;
3112
3113         case HCI_EV_QOS_SETUP_COMPLETE:
3114                 hci_qos_setup_complete_evt(hdev, skb);
3115                 break;
3116
3117         case HCI_EV_CMD_COMPLETE:
3118                 hci_cmd_complete_evt(hdev, skb);
3119                 break;
3120
3121         case HCI_EV_CMD_STATUS:
3122                 hci_cmd_status_evt(hdev, skb);
3123                 break;
3124
3125         case HCI_EV_ROLE_CHANGE:
3126                 hci_role_change_evt(hdev, skb);
3127                 break;
3128
3129         case HCI_EV_NUM_COMP_PKTS:
3130                 hci_num_comp_pkts_evt(hdev, skb);
3131                 break;
3132
3133         case HCI_EV_MODE_CHANGE:
3134                 hci_mode_change_evt(hdev, skb);
3135                 break;
3136
3137         case HCI_EV_PIN_CODE_REQ:
3138                 hci_pin_code_request_evt(hdev, skb);
3139                 break;
3140
3141         case HCI_EV_LINK_KEY_REQ:
3142                 hci_link_key_request_evt(hdev, skb);
3143                 break;
3144
3145         case HCI_EV_LINK_KEY_NOTIFY:
3146                 hci_link_key_notify_evt(hdev, skb);
3147                 break;
3148
3149         case HCI_EV_CLOCK_OFFSET:
3150                 hci_clock_offset_evt(hdev, skb);
3151                 break;
3152
3153         case HCI_EV_PKT_TYPE_CHANGE:
3154                 hci_pkt_type_change_evt(hdev, skb);
3155                 break;
3156
3157         case HCI_EV_PSCAN_REP_MODE:
3158                 hci_pscan_rep_mode_evt(hdev, skb);
3159                 break;
3160
3161         case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
3162                 hci_inquiry_result_with_rssi_evt(hdev, skb);
3163                 break;
3164
3165         case HCI_EV_REMOTE_EXT_FEATURES:
3166                 hci_remote_ext_features_evt(hdev, skb);
3167                 break;
3168
3169         case HCI_EV_SYNC_CONN_COMPLETE:
3170                 hci_sync_conn_complete_evt(hdev, skb);
3171                 break;
3172
3173         case HCI_EV_SYNC_CONN_CHANGED:
3174                 hci_sync_conn_changed_evt(hdev, skb);
3175                 break;
3176
3177         case HCI_EV_SNIFF_SUBRATE:
3178                 hci_sniff_subrate_evt(hdev, skb);
3179                 break;
3180
3181         case HCI_EV_EXTENDED_INQUIRY_RESULT:
3182                 hci_extended_inquiry_result_evt(hdev, skb);
3183                 break;
3184
3185         case HCI_EV_IO_CAPA_REQUEST:
3186                 hci_io_capa_request_evt(hdev, skb);
3187                 break;
3188
3189         case HCI_EV_IO_CAPA_REPLY:
3190                 hci_io_capa_reply_evt(hdev, skb);
3191                 break;
3192
3193         case HCI_EV_USER_CONFIRM_REQUEST:
3194                 hci_user_confirm_request_evt(hdev, skb);
3195                 break;
3196
3197         case HCI_EV_USER_PASSKEY_REQUEST:
3198                 hci_user_passkey_request_evt(hdev, skb);
3199                 break;
3200
3201         case HCI_EV_SIMPLE_PAIR_COMPLETE:
3202                 hci_simple_pair_complete_evt(hdev, skb);
3203                 break;
3204
3205         case HCI_EV_REMOTE_HOST_FEATURES:
3206                 hci_remote_host_features_evt(hdev, skb);
3207                 break;
3208
3209         case HCI_EV_LE_META:
3210                 hci_le_meta_evt(hdev, skb);
3211                 break;
3212
3213         case HCI_EV_REMOTE_OOB_DATA_REQUEST:
3214                 hci_remote_oob_data_request_evt(hdev, skb);
3215                 break;
3216
3217         default:
3218                 BT_DBG("%s event 0x%x", hdev->name, event);
3219                 break;
3220         }
3221
3222         kfree_skb(skb);
3223         hdev->stat.evt_rx++;
3224 }
3225
3226 /* Generate internal stack event */
3227 void hci_si_event(struct hci_dev *hdev, int type, int dlen, void *data)
3228 {
3229         struct hci_event_hdr *hdr;
3230         struct hci_ev_stack_internal *ev;
3231         struct sk_buff *skb;
3232
3233         skb = bt_skb_alloc(HCI_EVENT_HDR_SIZE + sizeof(*ev) + dlen, GFP_ATOMIC);
3234         if (!skb)
3235                 return;
3236
3237         hdr = (void *) skb_put(skb, HCI_EVENT_HDR_SIZE);
3238         hdr->evt  = HCI_EV_STACK_INTERNAL;
3239         hdr->plen = sizeof(*ev) + dlen;
3240
3241         ev  = (void *) skb_put(skb, sizeof(*ev) + dlen);
3242         ev->type = type;
3243         memcpy(ev->data, data, dlen);
3244
3245         bt_cb(skb)->incoming = 1;
3246         __net_timestamp(skb);
3247
3248         bt_cb(skb)->pkt_type = HCI_EVENT_PKT;
3249         skb->dev = (void *) hdev;
3250         hci_send_to_sock(hdev, skb, NULL);
3251         kfree_skb(skb);
3252 }
3253
3254 module_param(enable_le, bool, 0644);
3255 MODULE_PARM_DESC(enable_le, "Enable LE support");