net/bluetooth/hci_event.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI event handling. */
  26
  27 #include <linux/module.h>
  28
  29 #include <linux/types.h>
  30 #include <linux/errno.h>
  31 #include <linux/kernel.h>
  32 #include <linux/slab.h>
  33 #include <linux/poll.h>
  34 #include <linux/fcntl.h>
  35 #include <linux/init.h>
  36 #include <linux/skbuff.h>
  37 #include <linux/interrupt.h>
  38 #include <net/sock.h>
  39
  40 #include <asm/system.h>
  41 #include <linux/uaccess.h>
  42 #include <asm/unaligned.h>
  43
  44 #include <net/bluetooth/bluetooth.h>
  45 #include <net/bluetooth/hci_core.h>
  46
  47 /* Handle HCI Event packets */
  48
  49 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
  50 {
  51         __u8 status = *((__u8 *) skb->data);
  52
  53         BT_DBG("%s status 0x%x", hdev->name, status);
  54
  55         if (status) {
  56                 hci_dev_lock(hdev);
  57                 mgmt_stop_discovery_failed(hdev, status);
  58                 hci_dev_unlock(hdev);
  59                 return;
  60         }
  61
  62         clear_bit(HCI_INQUIRY, &hdev->flags);
  63
  64         hci_dev_lock(hdev);
  65         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
  66         hci_dev_unlock(hdev);
  67
  68         hci_req_complete(hdev, HCI_OP_INQUIRY_CANCEL, status);
  69
  70         hci_conn_check_pending(hdev);
  71 }
  72
  73 static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  74 {
  75         __u8 status = *((__u8 *) skb->data);
  76
  77         BT_DBG("%s status 0x%x", hdev->name, status);
  78
  79         if (status)
  80                 return;
  81
  82         hci_conn_check_pending(hdev);
  83 }
  84
  85 static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev, struct sk_buff *skb)
  86 {
  87         BT_DBG("%s", hdev->name);
  88 }
  89
  90 static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
  91 {
  92         struct hci_rp_role_discovery *rp = (void *) skb->data;
  93         struct hci_conn *conn;
  94
  95         BT_DBG("%s status 0x%x", hdev->name, rp->status);
  96
  97         if (rp->status)
  98                 return;
  99
 100         hci_dev_lock(hdev);
 101
 102         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 103         if (conn) {
 104                 if (rp->role)
 105                         conn->link_mode &= ~HCI_LM_MASTER;
 106                 else
 107                         conn->link_mode |= HCI_LM_MASTER;
 108         }
 109
 110         hci_dev_unlock(hdev);
 111 }
 112
 113 static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 114 {
 115         struct hci_rp_read_link_policy *rp = (void *) skb->data;
 116         struct hci_conn *conn;
 117
 118         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 119
 120         if (rp->status)
 121                 return;
 122
 123         hci_dev_lock(hdev);
 124
 125         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 126         if (conn)
 127                 conn->link_policy = __le16_to_cpu(rp->policy);
 128
 129         hci_dev_unlock(hdev);
 130 }
 131
 132 static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 133 {
 134         struct hci_rp_write_link_policy *rp = (void *) skb->data;
 135         struct hci_conn *conn;
 136         void *sent;
 137
 138         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 139
 140         if (rp->status)
 141                 return;
 142
 143         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
 144         if (!sent)
 145                 return;
 146
 147         hci_dev_lock(hdev);
 148
 149         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 150         if (conn)
 151                 conn->link_policy = get_unaligned_le16(sent + 2);
 152
 153         hci_dev_unlock(hdev);
 154 }
 155
 156 static void hci_cc_read_def_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 157 {
 158         struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
 159
 160         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 161
 162         if (rp->status)
 163                 return;
 164
 165         hdev->link_policy = __le16_to_cpu(rp->policy);
 166 }
 167
 168 static void hci_cc_write_def_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 169 {
 170         __u8 status = *((__u8 *) skb->data);
 171         void *sent;
 172
 173         BT_DBG("%s status 0x%x", hdev->name, status);
 174
 175         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
 176         if (!sent)
 177                 return;
 178
 179         if (!status)
 180                 hdev->link_policy = get_unaligned_le16(sent);
 181
 182         hci_req_complete(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, status);
 183 }
 184
 185 static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
 186 {
 187         __u8 status = *((__u8 *) skb->data);
 188
 189         BT_DBG("%s status 0x%x", hdev->name, status);
 190
 191         clear_bit(HCI_RESET, &hdev->flags);
 192
 193         hci_req_complete(hdev, HCI_OP_RESET, status);
 194
 195         /* Reset all non-persistent flags */
 196         hdev->dev_flags &= ~(BIT(HCI_LE_SCAN));
 197
 198         hdev->discovery.state = DISCOVERY_STOPPED;
 199 }
 200
 201 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 202 {
 203         __u8 status = *((__u8 *) skb->data);
 204         void *sent;
 205
 206         BT_DBG("%s status 0x%x", hdev->name, status);
 207
 208         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
 209         if (!sent)
 210                 return;
 211
 212         hci_dev_lock(hdev);
 213
 214         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 215                 mgmt_set_local_name_complete(hdev, sent, status);
 216         else if (!status)
 217                 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
 218
 219         hci_dev_unlock(hdev);
 220 }
 221
 222 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 223 {
 224         struct hci_rp_read_local_name *rp = (void *) skb->data;
 225
 226         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 227
 228         if (rp->status)
 229                 return;
 230
 231         if (test_bit(HCI_SETUP, &hdev->dev_flags))
 232                 memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
 233 }
 234
 235 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
 236 {
 237         __u8 status = *((__u8 *) skb->data);
 238         void *sent;
 239
 240         BT_DBG("%s status 0x%x", hdev->name, status);
 241
 242         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
 243         if (!sent)
 244                 return;
 245
 246         if (!status) {
 247                 __u8 param = *((__u8 *) sent);
 248
 249                 if (param == AUTH_ENABLED)
 250                         set_bit(HCI_AUTH, &hdev->flags);
 251                 else
 252                         clear_bit(HCI_AUTH, &hdev->flags);
 253         }
 254
 255         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 256                 mgmt_auth_enable_complete(hdev, status);
 257
 258         hci_req_complete(hdev, HCI_OP_WRITE_AUTH_ENABLE, status);
 259 }
 260
 261 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
 262 {
 263         __u8 status = *((__u8 *) skb->data);
 264         void *sent;
 265
 266         BT_DBG("%s status 0x%x", hdev->name, status);
 267
 268         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
 269         if (!sent)
 270                 return;
 271
 272         if (!status) {
 273                 __u8 param = *((__u8 *) sent);
 274
 275                 if (param)
 276                         set_bit(HCI_ENCRYPT, &hdev->flags);
 277                 else
 278                         clear_bit(HCI_ENCRYPT, &hdev->flags);
 279         }
 280
 281         hci_req_complete(hdev, HCI_OP_WRITE_ENCRYPT_MODE, status);
 282 }
 283
 284 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
 285 {
 286         __u8 param, status = *((__u8 *) skb->data);
 287         int old_pscan, old_iscan;
 288         void *sent;
 289
 290         BT_DBG("%s status 0x%x", hdev->name, status);
 291
 292         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
 293         if (!sent)
 294                 return;
 295
 296         param = *((__u8 *) sent);
 297
 298         hci_dev_lock(hdev);
 299
 300         if (status != 0) {
 301                 mgmt_write_scan_failed(hdev, param, status);
 302                 hdev->discov_timeout = 0;
 303                 goto done;
 304         }
 305
 306         old_pscan = test_and_clear_bit(HCI_PSCAN, &hdev->flags);
 307         old_iscan = test_and_clear_bit(HCI_ISCAN, &hdev->flags);
 308
 309         if (param & SCAN_INQUIRY) {
 310                 set_bit(HCI_ISCAN, &hdev->flags);
 311                 if (!old_iscan)
 312                         mgmt_discoverable(hdev, 1);
 313                 if (hdev->discov_timeout > 0) {
 314                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
 315                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
 316                                                                         to);
 317                 }
 318         } else if (old_iscan)
 319                 mgmt_discoverable(hdev, 0);
 320
 321         if (param & SCAN_PAGE) {
 322                 set_bit(HCI_PSCAN, &hdev->flags);
 323                 if (!old_pscan)
 324                         mgmt_connectable(hdev, 1);
 325         } else if (old_pscan)
 326                 mgmt_connectable(hdev, 0);
 327
 328 done:
 329         hci_dev_unlock(hdev);
 330         hci_req_complete(hdev, HCI_OP_WRITE_SCAN_ENABLE, status);
 331 }
 332
 333 static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 334 {
 335         struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
 336
 337         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 338
 339         if (rp->status)
 340                 return;
 341
 342         memcpy(hdev->dev_class, rp->dev_class, 3);
 343
 344         BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
 345                 hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
 346 }
 347
 348 static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 349 {
 350         __u8 status = *((__u8 *) skb->data);
 351         void *sent;
 352
 353         BT_DBG("%s status 0x%x", hdev->name, status);
 354
 355         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
 356         if (!sent)
 357                 return;
 358
 359         hci_dev_lock(hdev);
 360
 361         if (status == 0)
 362                 memcpy(hdev->dev_class, sent, 3);
 363
 364         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 365                 mgmt_set_class_of_dev_complete(hdev, sent, status);
 366
 367         hci_dev_unlock(hdev);
 368 }
 369
 370 static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 371 {
 372         struct hci_rp_read_voice_setting *rp = (void *) skb->data;
 373         __u16 setting;
 374
 375         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 376
 377         if (rp->status)
 378                 return;
 379
 380         setting = __le16_to_cpu(rp->voice_setting);
 381
 382         if (hdev->voice_setting == setting)
 383                 return;
 384
 385         hdev->voice_setting = setting;
 386
 387         BT_DBG("%s voice setting 0x%04x", hdev->name, setting);
 388
 389         if (hdev->notify)
 390                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 391 }
 392
 393 static void hci_cc_write_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 394 {
 395         __u8 status = *((__u8 *) skb->data);
 396         __u16 setting;
 397         void *sent;
 398
 399         BT_DBG("%s status 0x%x", hdev->name, status);
 400
 401         if (status)
 402                 return;
 403
 404         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
 405         if (!sent)
 406                 return;
 407
 408         setting = get_unaligned_le16(sent);
 409
 410         if (hdev->voice_setting == setting)
 411                 return;
 412
 413         hdev->voice_setting = setting;
 414
 415         BT_DBG("%s voice setting 0x%04x", hdev->name, setting);
 416
 417         if (hdev->notify)
 418                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 419 }
 420
 421 static void hci_cc_host_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 422 {
 423         __u8 status = *((__u8 *) skb->data);
 424
 425         BT_DBG("%s status 0x%x", hdev->name, status);
 426
 427         hci_req_complete(hdev, HCI_OP_HOST_BUFFER_SIZE, status);
 428 }
 429
 430 static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 431 {
 432         __u8 status = *((__u8 *) skb->data);
 433         void *sent;
 434
 435         BT_DBG("%s status 0x%x", hdev->name, status);
 436
 437         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
 438         if (!sent)
 439                 return;
 440
 441         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 442                 mgmt_ssp_enable_complete(hdev, *((u8 *) sent), status);
 443         else if (!status) {
 444                 if (*((u8 *) sent))
 445                         set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
 446                 else
 447                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
 448         }
 449 }
 450
 451 static u8 hci_get_inquiry_mode(struct hci_dev *hdev)
 452 {
 453         if (hdev->features[6] & LMP_EXT_INQ)
 454                 return 2;
 455
 456         if (hdev->features[3] & LMP_RSSI_INQ)
 457                 return 1;
 458
 459         if (hdev->manufacturer == 11 && hdev->hci_rev == 0x00 &&
 460                                                 hdev->lmp_subver == 0x0757)
 461                 return 1;
 462
 463         if (hdev->manufacturer == 15) {
 464                 if (hdev->hci_rev == 0x03 && hdev->lmp_subver == 0x6963)
 465                         return 1;
 466                 if (hdev->hci_rev == 0x09 && hdev->lmp_subver == 0x6963)
 467                         return 1;
 468                 if (hdev->hci_rev == 0x00 && hdev->lmp_subver == 0x6965)
 469                         return 1;
 470         }
 471
 472         if (hdev->manufacturer == 31 && hdev->hci_rev == 0x2005 &&
 473                                                 hdev->lmp_subver == 0x1805)
 474                 return 1;
 475
 476         return 0;
 477 }
 478
 479 static void hci_setup_inquiry_mode(struct hci_dev *hdev)
 480 {
 481         u8 mode;
 482
 483         mode = hci_get_inquiry_mode(hdev);
 484
 485         hci_send_cmd(hdev, HCI_OP_WRITE_INQUIRY_MODE, 1, &mode);
 486 }
 487
 488 static void hci_setup_event_mask(struct hci_dev *hdev)
 489 {
 490         /* The second byte is 0xff instead of 0x9f (two reserved bits
 491          * disabled) since a Broadcom 1.2 dongle doesn't respond to the
 492          * command otherwise */
 493         u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };
 494
 495         /* CSR 1.1 dongles does not accept any bitfield so don't try to set
 496          * any event mask for pre 1.2 devices */
 497         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
 498                 return;
 499
 500         events[4] |= 0x01; /* Flow Specification Complete */
 501         events[4] |= 0x02; /* Inquiry Result with RSSI */
 502         events[4] |= 0x04; /* Read Remote Extended Features Complete */
 503         events[5] |= 0x08; /* Synchronous Connection Complete */
 504         events[5] |= 0x10; /* Synchronous Connection Changed */
 505
 506         if (hdev->features[3] & LMP_RSSI_INQ)
 507                 events[4] |= 0x04; /* Inquiry Result with RSSI */
 508
 509         if (hdev->features[5] & LMP_SNIFF_SUBR)
 510                 events[5] |= 0x20; /* Sniff Subrating */
 511
 512         if (hdev->features[5] & LMP_PAUSE_ENC)
 513                 events[5] |= 0x80; /* Encryption Key Refresh Complete */
 514
 515         if (hdev->features[6] & LMP_EXT_INQ)
 516                 events[5] |= 0x40; /* Extended Inquiry Result */
 517
 518         if (hdev->features[6] & LMP_NO_FLUSH)
 519                 events[7] |= 0x01; /* Enhanced Flush Complete */
 520
 521         if (hdev->features[7] & LMP_LSTO)
 522                 events[6] |= 0x80; /* Link Supervision Timeout Changed */
 523
 524         if (hdev->features[6] & LMP_SIMPLE_PAIR) {
 525                 events[6] |= 0x01;      /* IO Capability Request */
 526                 events[6] |= 0x02;      /* IO Capability Response */
 527                 events[6] |= 0x04;      /* User Confirmation Request */
 528                 events[6] |= 0x08;      /* User Passkey Request */
 529                 events[6] |= 0x10;      /* Remote OOB Data Request */
 530                 events[6] |= 0x20;      /* Simple Pairing Complete */
 531                 events[7] |= 0x04;      /* User Passkey Notification */
 532                 events[7] |= 0x08;      /* Keypress Notification */
 533                 events[7] |= 0x10;      /* Remote Host Supported
 534                                          * Features Notification */
 535         }
 536
 537         if (hdev->features[4] & LMP_LE)
 538                 events[7] |= 0x20;      /* LE Meta-Event */
 539
 540         hci_send_cmd(hdev, HCI_OP_SET_EVENT_MASK, sizeof(events), events);
 541 }
 542
 543 static void hci_set_le_support(struct hci_dev *hdev)
 544 {
 545         struct hci_cp_write_le_host_supported cp;
 546
 547         memset(&cp, 0, sizeof(cp));
 548
 549         if (enable_le && test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
 550                 cp.le = 1;
 551                 cp.simul = !!(hdev->features[6] & LMP_SIMUL_LE_BR);
 552         }
 553
 554         hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(cp), &cp);
 555 }
 556
 557 static void hci_setup(struct hci_dev *hdev)
 558 {
 559         if (hdev->dev_type != HCI_BREDR)
 560                 return;
 561
 562         hci_setup_event_mask(hdev);
 563
 564         if (hdev->hci_ver > BLUETOOTH_VER_1_1)
 565                 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
 566
 567         if (!test_bit(HCI_SETUP, &hdev->dev_flags) &&
 568                                         test_bit(HCI_MGMT, &hdev->dev_flags)) {
 569                 struct hci_cp_write_local_name cp;
 570
 571                 memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
 572                 hci_send_cmd(hdev, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
 573         }
 574
 575         if (hdev->features[6] & LMP_SIMPLE_PAIR) {
 576                 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
 577                         u8 mode = 0x01;
 578                         hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE,
 579                                                         sizeof(mode), &mode);
 580                 } else {
 581                         struct hci_cp_write_eir cp;
 582
 583                         memset(hdev->eir, 0, sizeof(hdev->eir));
 584                         memset(&cp, 0, sizeof(cp));
 585
 586                         hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 587                 }
 588         }
 589
 590         if (hdev->features[3] & LMP_RSSI_INQ)
 591                 hci_setup_inquiry_mode(hdev);
 592
 593         if (hdev->features[7] & LMP_INQ_TX_PWR)
 594                 hci_send_cmd(hdev, HCI_OP_READ_INQ_RSP_TX_POWER, 0, NULL);
 595
 596         if (hdev->features[7] & LMP_EXTFEATURES) {
 597                 struct hci_cp_read_local_ext_features cp;
 598
 599                 cp.page = 0x01;
 600                 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES,
 601                                                         sizeof(cp), &cp);
 602         }
 603
 604         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags)) {
 605                 u8 enable = 1;
 606                 hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE,
 607                                                 sizeof(enable), &enable);
 608         }
 609
 610         if (hdev->features[4] & LMP_LE)
 611                 hci_set_le_support(hdev);
 612 }
 613
 614 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
 615 {
 616         struct hci_rp_read_local_version *rp = (void *) skb->data;
 617
 618         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 619
 620         if (rp->status)
 621                 return;
 622
 623         hdev->hci_ver = rp->hci_ver;
 624         hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
 625         hdev->lmp_ver = rp->lmp_ver;
 626         hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
 627         hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
 628
 629         BT_DBG("%s manufacturer %d hci ver %d:%d", hdev->name,
 630                                         hdev->manufacturer,
 631                                         hdev->hci_ver, hdev->hci_rev);
 632
 633         if (test_bit(HCI_INIT, &hdev->flags))
 634                 hci_setup(hdev);
 635 }
 636
 637 static void hci_setup_link_policy(struct hci_dev *hdev)
 638 {
 639         u16 link_policy = 0;
 640
 641         if (hdev->features[0] & LMP_RSWITCH)
 642                 link_policy |= HCI_LP_RSWITCH;
 643         if (hdev->features[0] & LMP_HOLD)
 644                 link_policy |= HCI_LP_HOLD;
 645         if (hdev->features[0] & LMP_SNIFF)
 646                 link_policy |= HCI_LP_SNIFF;
 647         if (hdev->features[1] & LMP_PARK)
 648                 link_policy |= HCI_LP_PARK;
 649
 650         link_policy = cpu_to_le16(link_policy);
 651         hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY,
 652                                         sizeof(link_policy), &link_policy);
 653 }
 654
 655 static void hci_cc_read_local_commands(struct hci_dev *hdev, struct sk_buff *skb)
 656 {
 657         struct hci_rp_read_local_commands *rp = (void *) skb->data;
 658
 659         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 660
 661         if (rp->status)
 662                 goto done;
 663
 664         memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 665
 666         if (test_bit(HCI_INIT, &hdev->flags) && (hdev->commands[5] & 0x10))
 667                 hci_setup_link_policy(hdev);
 668
 669 done:
 670         hci_req_complete(hdev, HCI_OP_READ_LOCAL_COMMANDS, rp->status);
 671 }
 672
 673 static void hci_cc_read_local_features(struct hci_dev *hdev, struct sk_buff *skb)
 674 {
 675         struct hci_rp_read_local_features *rp = (void *) skb->data;
 676
 677         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 678
 679         if (rp->status)
 680                 return;
 681
 682         memcpy(hdev->features, rp->features, 8);
 683
 684         /* Adjust default settings according to features
 685          * supported by device. */
 686
 687         if (hdev->features[0] & LMP_3SLOT)
 688                 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 689
 690         if (hdev->features[0] & LMP_5SLOT)
 691                 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 692
 693         if (hdev->features[1] & LMP_HV2) {
 694                 hdev->pkt_type  |= (HCI_HV2);
 695                 hdev->esco_type |= (ESCO_HV2);
 696         }
 697
 698         if (hdev->features[1] & LMP_HV3) {
 699                 hdev->pkt_type  |= (HCI_HV3);
 700                 hdev->esco_type |= (ESCO_HV3);
 701         }
 702
 703         if (hdev->features[3] & LMP_ESCO)
 704                 hdev->esco_type |= (ESCO_EV3);
 705
 706         if (hdev->features[4] & LMP_EV4)
 707                 hdev->esco_type |= (ESCO_EV4);
 708
 709         if (hdev->features[4] & LMP_EV5)
 710                 hdev->esco_type |= (ESCO_EV5);
 711
 712         if (hdev->features[5] & LMP_EDR_ESCO_2M)
 713                 hdev->esco_type |= (ESCO_2EV3);
 714
 715         if (hdev->features[5] & LMP_EDR_ESCO_3M)
 716                 hdev->esco_type |= (ESCO_3EV3);
 717
 718         if (hdev->features[5] & LMP_EDR_3S_ESCO)
 719                 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
 720
 721         BT_DBG("%s features 0x%.2x%.2x%.2x%.2x%.2x%.2x%.2x%.2x", hdev->name,
 722                                         hdev->features[0], hdev->features[1],
 723                                         hdev->features[2], hdev->features[3],
 724                                         hdev->features[4], hdev->features[5],
 725                                         hdev->features[6], hdev->features[7]);
 726 }
 727
 728 static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
 729                                                         struct sk_buff *skb)
 730 {
 731         struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
 732
 733         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 734
 735         if (rp->status)
 736                 return;
 737
 738         switch (rp->page) {
 739         case 0:
 740                 memcpy(hdev->features, rp->features, 8);
 741                 break;
 742         case 1:
 743                 memcpy(hdev->host_features, rp->features, 8);
 744                 break;
 745         }
 746
 747         hci_req_complete(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES, rp->status);
 748 }
 749
 750 static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
 751                                                 struct sk_buff *skb)
 752 {
 753         struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;
 754
 755         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 756
 757         if (rp->status)
 758                 return;
 759
 760         hdev->flow_ctl_mode = rp->mode;
 761
 762         hci_req_complete(hdev, HCI_OP_READ_FLOW_CONTROL_MODE, rp->status);
 763 }
 764
 765 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 766 {
 767         struct hci_rp_read_buffer_size *rp = (void *) skb->data;
 768
 769         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 770
 771         if (rp->status)
 772                 return;
 773
 774         hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
 775         hdev->sco_mtu  = rp->sco_mtu;
 776         hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
 777         hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
 778
 779         if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
 780                 hdev->sco_mtu  = 64;
 781                 hdev->sco_pkts = 8;
 782         }
 783
 784         hdev->acl_cnt = hdev->acl_pkts;
 785         hdev->sco_cnt = hdev->sco_pkts;
 786
 787         BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name,
 788                                         hdev->acl_mtu, hdev->acl_pkts,
 789                                         hdev->sco_mtu, hdev->sco_pkts);
 790 }
 791
 792 static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
 793 {
 794         struct hci_rp_read_bd_addr *rp = (void *) skb->data;
 795
 796         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 797
 798         if (!rp->status)
 799                 bacpy(&hdev->bdaddr, &rp->bdaddr);
 800
 801         hci_req_complete(hdev, HCI_OP_READ_BD_ADDR, rp->status);
 802 }
 803
 804 static void hci_cc_read_data_block_size(struct hci_dev *hdev,
 805                                                         struct sk_buff *skb)
 806 {
 807         struct hci_rp_read_data_block_size *rp = (void *) skb->data;
 808
 809         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 810
 811         if (rp->status)
 812                 return;
 813
 814         hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
 815         hdev->block_len = __le16_to_cpu(rp->block_len);
 816         hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
 817
 818         hdev->block_cnt = hdev->num_blocks;
 819
 820         BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
 821                                         hdev->block_cnt, hdev->block_len);
 822
 823         hci_req_complete(hdev, HCI_OP_READ_DATA_BLOCK_SIZE, rp->status);
 824 }
 825
 826 static void hci_cc_write_ca_timeout(struct hci_dev *hdev, struct sk_buff *skb)
 827 {
 828         __u8 status = *((__u8 *) skb->data);
 829
 830         BT_DBG("%s status 0x%x", hdev->name, status);
 831
 832         hci_req_complete(hdev, HCI_OP_WRITE_CA_TIMEOUT, status);
 833 }
 834
 835 static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
 836                 struct sk_buff *skb)
 837 {
 838         struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
 839
 840         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 841
 842         if (rp->status)
 843                 return;
 844
 845         hdev->amp_status = rp->amp_status;
 846         hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
 847         hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
 848         hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
 849         hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
 850         hdev->amp_type = rp->amp_type;
 851         hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
 852         hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
 853         hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
 854         hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
 855
 856         hci_req_complete(hdev, HCI_OP_READ_LOCAL_AMP_INFO, rp->status);
 857 }
 858
 859 static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
 860                                                         struct sk_buff *skb)
 861 {
 862         __u8 status = *((__u8 *) skb->data);
 863
 864         BT_DBG("%s status 0x%x", hdev->name, status);
 865
 866         hci_req_complete(hdev, HCI_OP_DELETE_STORED_LINK_KEY, status);
 867 }
 868
 869 static void hci_cc_set_event_mask(struct hci_dev *hdev, struct sk_buff *skb)
 870 {
 871         __u8 status = *((__u8 *) skb->data);
 872
 873         BT_DBG("%s status 0x%x", hdev->name, status);
 874
 875         hci_req_complete(hdev, HCI_OP_SET_EVENT_MASK, status);
 876 }
 877
 878 static void hci_cc_write_inquiry_mode(struct hci_dev *hdev,
 879                                                         struct sk_buff *skb)
 880 {
 881         __u8 status = *((__u8 *) skb->data);
 882
 883         BT_DBG("%s status 0x%x", hdev->name, status);
 884
 885         hci_req_complete(hdev, HCI_OP_WRITE_INQUIRY_MODE, status);
 886 }
 887
 888 static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
 889                                                         struct sk_buff *skb)
 890 {
 891         __u8 status = *((__u8 *) skb->data);
 892
 893         BT_DBG("%s status 0x%x", hdev->name, status);
 894
 895         hci_req_complete(hdev, HCI_OP_READ_INQ_RSP_TX_POWER, status);
 896 }
 897
 898 static void hci_cc_set_event_flt(struct hci_dev *hdev, struct sk_buff *skb)
 899 {
 900         __u8 status = *((__u8 *) skb->data);
 901
 902         BT_DBG("%s status 0x%x", hdev->name, status);
 903
 904         hci_req_complete(hdev, HCI_OP_SET_EVENT_FLT, status);
 905 }
 906
 907 static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
 908 {
 909         struct hci_rp_pin_code_reply *rp = (void *) skb->data;
 910         struct hci_cp_pin_code_reply *cp;
 911         struct hci_conn *conn;
 912
 913         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 914
 915         hci_dev_lock(hdev);
 916
 917         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 918                 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
 919
 920         if (rp->status != 0)
 921                 goto unlock;
 922
 923         cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
 924         if (!cp)
 925                 goto unlock;
 926
 927         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 928         if (conn)
 929                 conn->pin_length = cp->pin_len;
 930
 931 unlock:
 932         hci_dev_unlock(hdev);
 933 }
 934
 935 static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
 936 {
 937         struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
 938
 939         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 940
 941         hci_dev_lock(hdev);
 942
 943         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 944                 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
 945                                                                 rp->status);
 946
 947         hci_dev_unlock(hdev);
 948 }
 949
 950 static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
 951                                        struct sk_buff *skb)
 952 {
 953         struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
 954
 955         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 956
 957         if (rp->status)
 958                 return;
 959
 960         hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
 961         hdev->le_pkts = rp->le_max_pkt;
 962
 963         hdev->le_cnt = hdev->le_pkts;
 964
 965         BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
 966
 967         hci_req_complete(hdev, HCI_OP_LE_READ_BUFFER_SIZE, rp->status);
 968 }
 969
 970 static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
 971 {
 972         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 973
 974         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 975
 976         hci_dev_lock(hdev);
 977
 978         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 979                 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
 980                                                                 0, rp->status);
 981
 982         hci_dev_unlock(hdev);
 983 }
 984
 985 static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
 986                                                         struct sk_buff *skb)
 987 {
 988         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 989
 990         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 991
 992         hci_dev_lock(hdev);
 993
 994         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 995                 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
 996                                                                 ACL_LINK, 0,
 997                                                                 rp->status);
 998
 999         hci_dev_unlock(hdev);
1000 }
1001
1002 static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
1003 {
1004         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1005
1006         BT_DBG("%s status 0x%x", hdev->name, rp->status);
1007
1008         hci_dev_lock(hdev);
1009
1010         if (test_bit(HCI_MGMT, &hdev->dev_flags))
1011                 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
1012                                                                 0, rp->status);
1013
1014         hci_dev_unlock(hdev);
1015 }
1016
1017 static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
1018                                                         struct sk_buff *skb)
1019 {
1020         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1021
1022         BT_DBG("%s status 0x%x", hdev->name, rp->status);
1023
1024         hci_dev_lock(hdev);
1025
1026         if (test_bit(HCI_MGMT, &hdev->dev_flags))
1027                 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
1028                                                                 ACL_LINK, 0,
1029                                                                 rp->status);
1030
1031         hci_dev_unlock(hdev);
1032 }
1033
1034 static void hci_cc_read_local_oob_data_reply(struct hci_dev *hdev,
1035                                                         struct sk_buff *skb)
1036 {
1037         struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
1038
1039         BT_DBG("%s status 0x%x", hdev->name, rp->status);
1040
1041         hci_dev_lock(hdev);
1042         mgmt_read_local_oob_data_reply_complete(hdev, rp->hash,
1043                                                 rp->randomizer, rp->status);
1044         hci_dev_unlock(hdev);
1045 }
1046
1047 static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
1048 {
1049         __u8 status = *((__u8 *) skb->data);
1050
1051         BT_DBG("%s status 0x%x", hdev->name, status);
1052
1053         hci_req_complete(hdev, HCI_OP_LE_SET_SCAN_PARAM, status);
1054
1055         if (status) {
1056                 hci_dev_lock(hdev);
1057                 mgmt_start_discovery_failed(hdev, status);
1058                 hci_dev_unlock(hdev);
1059                 return;
1060         }
1061 }
1062
1063 static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
1064                                         struct sk_buff *skb)
1065 {
1066         struct hci_cp_le_set_scan_enable *cp;
1067         __u8 status = *((__u8 *) skb->data);
1068
1069         BT_DBG("%s status 0x%x", hdev->name, status);
1070
1071         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
1072         if (!cp)
1073                 return;
1074
1075         switch (cp->enable) {
1076         case LE_SCANNING_ENABLED:
1077                 hci_req_complete(hdev, HCI_OP_LE_SET_SCAN_ENABLE, status);
1078
1079                 if (status) {
1080                         hci_dev_lock(hdev);
1081                         mgmt_start_discovery_failed(hdev, status);
1082                         hci_dev_unlock(hdev);
1083                         return;
1084                 }
1085
1086                 set_bit(HCI_LE_SCAN, &hdev->dev_flags);
1087
1088                 cancel_delayed_work_sync(&hdev->adv_work);
1089
1090                 hci_dev_lock(hdev);
1091                 hci_adv_entries_clear(hdev);
1092                 hci_discovery_set_state(hdev, DISCOVERY_FINDING);
1093                 hci_dev_unlock(hdev);
1094                 break;
1095
1096         case LE_SCANNING_DISABLED:
1097                 if (status)
1098                         return;
1099
1100                 clear_bit(HCI_LE_SCAN, &hdev->dev_flags);
1101
1102                 schedule_delayed_work(&hdev->adv_work, ADV_CLEAR_TIMEOUT);
1103
1104                 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED) {
1105                         mgmt_interleaved_discovery(hdev);
1106                 } else {
1107                         hci_dev_lock(hdev);
1108                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1109                         hci_dev_unlock(hdev);
1110                 }
1111
1112                 break;
1113
1114         default:
1115                 BT_ERR("Used reserved LE_Scan_Enable param %d", cp->enable);
1116                 break;
1117         }
1118 }
1119
1120 static void hci_cc_le_ltk_reply(struct hci_dev *hdev, struct sk_buff *skb)
1121 {
1122         struct hci_rp_le_ltk_reply *rp = (void *) skb->data;
1123
1124         BT_DBG("%s status 0x%x", hdev->name, rp->status);
1125
1126         if (rp->status)
1127                 return;
1128
1129         hci_req_complete(hdev, HCI_OP_LE_LTK_REPLY, rp->status);
1130 }
1131
1132 static void hci_cc_le_ltk_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
1133 {
1134         struct hci_rp_le_ltk_neg_reply *rp = (void *) skb->data;
1135
1136         BT_DBG("%s status 0x%x", hdev->name, rp->status);
1137
1138         if (rp->status)
1139                 return;
1140
1141         hci_req_complete(hdev, HCI_OP_LE_LTK_NEG_REPLY, rp->status);
1142 }
1143
1144 static inline void hci_cc_write_le_host_supported(struct hci_dev *hdev,
1145                                                         struct sk_buff *skb)
1146 {
1147         struct hci_cp_read_local_ext_features cp;
1148         struct hci_cp_write_le_host_supported *sent;
1149         __u8 status = *((__u8 *) skb->data);
1150
1151         BT_DBG("%s status 0x%x", hdev->name, status);
1152
1153         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
1154         if (sent && test_bit(HCI_MGMT, &hdev->dev_flags))
1155                 mgmt_le_enable_complete(hdev, sent->le, status);
1156
1157         if (status)
1158                 return;
1159
1160         cp.page = 0x01;
1161         hci_send_cmd(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES, sizeof(cp), &cp);
1162 }
1163
1164 static inline void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
1165 {
1166         BT_DBG("%s status 0x%x", hdev->name, status);
1167
1168         if (status) {
1169                 hci_req_complete(hdev, HCI_OP_INQUIRY, status);
1170                 hci_conn_check_pending(hdev);
1171                 hci_dev_lock(hdev);
1172                 if (test_bit(HCI_MGMT, &hdev->dev_flags))
1173                         mgmt_start_discovery_failed(hdev, status);
1174                 hci_dev_unlock(hdev);
1175                 return;
1176         }
1177
1178         set_bit(HCI_INQUIRY, &hdev->flags);
1179
1180         hci_dev_lock(hdev);
1181         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
1182         hci_dev_unlock(hdev);
1183 }
1184
1185 static inline void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
1186 {
1187         struct hci_cp_create_conn *cp;
1188         struct hci_conn *conn;
1189
1190         BT_DBG("%s status 0x%x", hdev->name, status);
1191
1192         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
1193         if (!cp)
1194                 return;
1195
1196         hci_dev_lock(hdev);
1197
1198         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1199
1200         BT_DBG("%s bdaddr %s conn %p", hdev->name, batostr(&cp->bdaddr), conn);
1201
1202         if (status) {
1203                 if (conn && conn->state == BT_CONNECT) {
1204                         if (status != 0x0c || conn->attempt > 2) {
1205                                 conn->state = BT_CLOSED;
1206                                 hci_proto_connect_cfm(conn, status);
1207                                 hci_conn_del(conn);
1208                         } else
1209                                 conn->state = BT_CONNECT2;
1210                 }
1211         } else {
1212                 if (!conn) {
1213                         conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr);
1214                         if (conn) {
1215                                 conn->out = true;
1216                                 conn->link_mode |= HCI_LM_MASTER;
1217                         } else
1218                                 BT_ERR("No memory for new connection");
1219                 }
1220         }
1221
1222         hci_dev_unlock(hdev);
1223 }
1224
1225 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
1226 {
1227         struct hci_cp_add_sco *cp;
1228         struct hci_conn *acl, *sco;
1229         __u16 handle;
1230
1231         BT_DBG("%s status 0x%x", hdev->name, status);
1232
1233         if (!status)
1234                 return;
1235
1236         cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
1237         if (!cp)
1238                 return;
1239
1240         handle = __le16_to_cpu(cp->handle);
1241
1242         BT_DBG("%s handle %d", hdev->name, handle);
1243
1244         hci_dev_lock(hdev);
1245
1246         acl = hci_conn_hash_lookup_handle(hdev, handle);
1247         if (acl) {
1248                 sco = acl->link;
1249                 if (sco) {
1250                         sco->state = BT_CLOSED;
1251
1252                         hci_proto_connect_cfm(sco, status);
1253                         hci_conn_del(sco);
1254                 }
1255         }
1256
1257         hci_dev_unlock(hdev);
1258 }
1259
1260 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
1261 {
1262         struct hci_cp_auth_requested *cp;
1263         struct hci_conn *conn;
1264
1265         BT_DBG("%s status 0x%x", hdev->name, status);
1266
1267         if (!status)
1268                 return;
1269
1270         cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
1271         if (!cp)
1272                 return;
1273
1274         hci_dev_lock(hdev);
1275
1276         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1277         if (conn) {
1278                 if (conn->state == BT_CONFIG) {
1279                         hci_proto_connect_cfm(conn, status);
1280                         hci_conn_put(conn);
1281                 }
1282         }
1283
1284         hci_dev_unlock(hdev);
1285 }
1286
1287 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
1288 {
1289         struct hci_cp_set_conn_encrypt *cp;
1290         struct hci_conn *conn;
1291
1292         BT_DBG("%s status 0x%x", hdev->name, status);
1293
1294         if (!status)
1295                 return;
1296
1297         cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
1298         if (!cp)
1299                 return;
1300
1301         hci_dev_lock(hdev);
1302
1303         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1304         if (conn) {
1305                 if (conn->state == BT_CONFIG) {
1306                         hci_proto_connect_cfm(conn, status);
1307                         hci_conn_put(conn);
1308                 }
1309         }
1310
1311         hci_dev_unlock(hdev);
1312 }
1313
1314 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
1315                                                         struct hci_conn *conn)
1316 {
1317         if (conn->state != BT_CONFIG || !conn->out)
1318                 return 0;
1319
1320         if (conn->pending_sec_level == BT_SECURITY_SDP)
1321                 return 0;
1322
1323         /* Only request authentication for SSP connections or non-SSP
1324          * devices with sec_level HIGH or if MITM protection is requested */
1325         if (!hci_conn_ssp_enabled(conn) &&
1326                                 conn->pending_sec_level != BT_SECURITY_HIGH &&
1327                                 !(conn->auth_type & 0x01))
1328                 return 0;
1329
1330         return 1;
1331 }
1332
1333 static inline int hci_resolve_name(struct hci_dev *hdev, struct inquiry_entry *e)
1334 {
1335         struct hci_cp_remote_name_req cp;
1336
1337         memset(&cp, 0, sizeof(cp));
1338
1339         bacpy(&cp.bdaddr, &e->data.bdaddr);
1340         cp.pscan_rep_mode = e->data.pscan_rep_mode;
1341         cp.pscan_mode = e->data.pscan_mode;
1342         cp.clock_offset = e->data.clock_offset;
1343
1344         return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1345 }
1346
1347 static bool hci_resolve_next_name(struct hci_dev *hdev)
1348 {
1349         struct discovery_state *discov = &hdev->discovery;
1350         struct inquiry_entry *e;
1351
1352         if (list_empty(&discov->resolve))
1353                 return false;
1354
1355         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
1356         if (hci_resolve_name(hdev, e) == 0) {
1357                 e->name_state = NAME_PENDING;
1358                 return true;
1359         }
1360
1361         return false;
1362 }
1363
1364 static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
1365                                         bdaddr_t *bdaddr, u8 *name, u8 name_len)
1366 {
1367         struct discovery_state *discov = &hdev->discovery;
1368         struct inquiry_entry *e;
1369
1370         if (conn && !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
1371                 mgmt_device_connected(hdev, bdaddr, ACL_LINK, 0x00, 0,
1372                                         name, name_len, conn->dev_class);
1373
1374         if (discov->state == DISCOVERY_STOPPED)
1375                 return;
1376
1377         if (discov->state == DISCOVERY_STOPPING)
1378                 goto discov_complete;
1379
1380         if (discov->state != DISCOVERY_RESOLVING)
1381                 return;
1382
1383         e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
1384         if (e) {
1385                 e->name_state = NAME_KNOWN;
1386                 list_del(&e->list);
1387                 if (name)
1388                         mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
1389                                         e->data.rssi, name, name_len);
1390         }
1391
1392         if (hci_resolve_next_name(hdev))
1393                 return;
1394
1395 discov_complete:
1396         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1397 }
1398
1399 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
1400 {
1401         struct hci_cp_remote_name_req *cp;
1402         struct hci_conn *conn;
1403
1404         BT_DBG("%s status 0x%x", hdev->name, status);
1405
1406         /* If successful wait for the name req complete event before
1407          * checking for the need to do authentication */
1408         if (!status)
1409                 return;
1410
1411         cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
1412         if (!cp)
1413                 return;
1414
1415         hci_dev_lock(hdev);
1416
1417         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1418
1419         if (test_bit(HCI_MGMT, &hdev->dev_flags))
1420                 hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
1421
1422         if (!conn)
1423                 goto unlock;
1424
1425         if (!hci_outgoing_auth_needed(hdev, conn))
1426                 goto unlock;
1427
1428         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
1429                 struct hci_cp_auth_requested cp;
1430                 cp.handle = __cpu_to_le16(conn->handle);
1431                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
1432         }
1433
1434 unlock:
1435         hci_dev_unlock(hdev);
1436 }
1437
1438 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
1439 {
1440         struct hci_cp_read_remote_features *cp;
1441         struct hci_conn *conn;
1442
1443         BT_DBG("%s status 0x%x", hdev->name, status);
1444
1445         if (!status)
1446                 return;
1447
1448         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
1449         if (!cp)
1450                 return;
1451
1452         hci_dev_lock(hdev);
1453
1454         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1455         if (conn) {
1456                 if (conn->state == BT_CONFIG) {
1457                         hci_proto_connect_cfm(conn, status);
1458                         hci_conn_put(conn);
1459                 }
1460         }
1461
1462         hci_dev_unlock(hdev);
1463 }
1464
1465 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
1466 {
1467         struct hci_cp_read_remote_ext_features *cp;
1468         struct hci_conn *conn;
1469
1470         BT_DBG("%s status 0x%x", hdev->name, status);
1471
1472         if (!status)
1473                 return;
1474
1475         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
1476         if (!cp)
1477                 return;
1478
1479         hci_dev_lock(hdev);
1480
1481         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1482         if (conn) {
1483                 if (conn->state == BT_CONFIG) {
1484                         hci_proto_connect_cfm(conn, status);
1485                         hci_conn_put(conn);
1486                 }
1487         }
1488
1489         hci_dev_unlock(hdev);
1490 }
1491
1492 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
1493 {
1494         struct hci_cp_setup_sync_conn *cp;
1495         struct hci_conn *acl, *sco;
1496         __u16 handle;
1497
1498         BT_DBG("%s status 0x%x", hdev->name, status);
1499
1500         if (!status)
1501                 return;
1502
1503         cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
1504         if (!cp)
1505                 return;
1506
1507         handle = __le16_to_cpu(cp->handle);
1508
1509         BT_DBG("%s handle %d", hdev->name, handle);
1510
1511         hci_dev_lock(hdev);
1512
1513         acl = hci_conn_hash_lookup_handle(hdev, handle);
1514         if (acl) {
1515                 sco = acl->link;
1516                 if (sco) {
1517                         sco->state = BT_CLOSED;
1518
1519                         hci_proto_connect_cfm(sco, status);
1520                         hci_conn_del(sco);
1521                 }
1522         }
1523
1524         hci_dev_unlock(hdev);
1525 }
1526
1527 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
1528 {
1529         struct hci_cp_sniff_mode *cp;
1530         struct hci_conn *conn;
1531
1532         BT_DBG("%s status 0x%x", hdev->name, status);
1533
1534         if (!status)
1535                 return;
1536
1537         cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
1538         if (!cp)
1539                 return;
1540
1541         hci_dev_lock(hdev);
1542
1543         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1544         if (conn) {
1545                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1546
1547                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
1548                         hci_sco_setup(conn, status);
1549         }
1550
1551         hci_dev_unlock(hdev);
1552 }
1553
1554 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
1555 {
1556         struct hci_cp_exit_sniff_mode *cp;
1557         struct hci_conn *conn;
1558
1559         BT_DBG("%s status 0x%x", hdev->name, status);
1560
1561         if (!status)
1562                 return;
1563
1564         cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
1565         if (!cp)
1566                 return;
1567
1568         hci_dev_lock(hdev);
1569
1570         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1571         if (conn) {
1572                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1573
1574                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
1575                         hci_sco_setup(conn, status);
1576         }
1577
1578         hci_dev_unlock(hdev);
1579 }
1580
1581 static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
1582 {
1583         struct hci_cp_disconnect *cp;
1584         struct hci_conn *conn;
1585
1586         if (!status)
1587                 return;
1588
1589         cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
1590         if (!cp)
1591                 return;
1592
1593         hci_dev_lock(hdev);
1594
1595         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1596         if (conn)
1597                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
1598                                                 conn->dst_type, status);
1599
1600         hci_dev_unlock(hdev);
1601 }
1602
1603 static void hci_cs_le_create_conn(struct hci_dev *hdev, __u8 status)
1604 {
1605         struct hci_cp_le_create_conn *cp;
1606         struct hci_conn *conn;
1607
1608         BT_DBG("%s status 0x%x", hdev->name, status);
1609
1610         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
1611         if (!cp)
1612                 return;
1613
1614         hci_dev_lock(hdev);
1615
1616         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->peer_addr);
1617
1618         BT_DBG("%s bdaddr %s conn %p", hdev->name, batostr(&cp->peer_addr),
1619                 conn);
1620
1621         if (status) {
1622                 if (conn && conn->state == BT_CONNECT) {
1623                         conn->state = BT_CLOSED;
1624                         hci_proto_connect_cfm(conn, status);
1625                         hci_conn_del(conn);
1626                 }
1627         } else {
1628                 if (!conn) {
1629                         conn = hci_conn_add(hdev, LE_LINK, &cp->peer_addr);
1630                         if (conn) {
1631                                 conn->dst_type = cp->peer_addr_type;
1632                                 conn->out = true;
1633                         } else {
1634                                 BT_ERR("No memory for new connection");
1635                         }
1636                 }
1637         }
1638
1639         hci_dev_unlock(hdev);
1640 }
1641
1642 static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
1643 {
1644         BT_DBG("%s status 0x%x", hdev->name, status);
1645 }
1646
1647 static inline void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1648 {
1649         __u8 status = *((__u8 *) skb->data);
1650         struct discovery_state *discov = &hdev->discovery;
1651         struct inquiry_entry *e;
1652
1653         BT_DBG("%s status %d", hdev->name, status);
1654
1655         hci_req_complete(hdev, HCI_OP_INQUIRY, status);
1656
1657         hci_conn_check_pending(hdev);
1658
1659         if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
1660                 return;
1661
1662         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
1663                 return;
1664
1665         hci_dev_lock(hdev);
1666
1667         if (discov->state != DISCOVERY_FINDING)
1668                 goto unlock;
1669
1670         if (list_empty(&discov->resolve)) {
1671                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1672                 goto unlock;
1673         }
1674
1675         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
1676         if (e && hci_resolve_name(hdev, e) == 0) {
1677                 e->name_state = NAME_PENDING;
1678                 hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
1679         } else {
1680                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1681         }
1682
1683 unlock:
1684         hci_dev_unlock(hdev);
1685 }
1686
1687 static inline void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
1688 {
1689         struct inquiry_data data;
1690         struct inquiry_info *info = (void *) (skb->data + 1);
1691         int num_rsp = *((__u8 *) skb->data);
1692
1693         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
1694
1695         if (!num_rsp)
1696                 return;
1697
1698         hci_dev_lock(hdev);
1699
1700         for (; num_rsp; num_rsp--, info++) {
1701                 bool name_known, ssp;
1702
1703                 bacpy(&data.bdaddr, &info->bdaddr);
1704                 data.pscan_rep_mode     = info->pscan_rep_mode;
1705                 data.pscan_period_mode  = info->pscan_period_mode;
1706                 data.pscan_mode         = info->pscan_mode;
1707                 memcpy(data.dev_class, info->dev_class, 3);
1708                 data.clock_offset       = info->clock_offset;
1709                 data.rssi               = 0x00;
1710                 data.ssp_mode           = 0x00;
1711
1712                 name_known = hci_inquiry_cache_update(hdev, &data, false, &ssp);
1713                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
1714                                         info->dev_class, 0, !name_known, ssp,
1715                                         NULL, 0);
1716         }
1717
1718         hci_dev_unlock(hdev);
1719 }
1720
1721 static inline void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1722 {
1723         struct hci_ev_conn_complete *ev = (void *) skb->data;
1724         struct hci_conn *conn;
1725
1726         BT_DBG("%s", hdev->name);
1727
1728         hci_dev_lock(hdev);
1729
1730         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
1731         if (!conn) {
1732                 if (ev->link_type != SCO_LINK)
1733                         goto unlock;
1734
1735                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
1736                 if (!conn)
1737                         goto unlock;
1738
1739                 conn->type = SCO_LINK;
1740         }
1741
1742         if (!ev->status) {
1743                 conn->handle = __le16_to_cpu(ev->handle);
1744
1745                 if (conn->type == ACL_LINK) {
1746                         conn->state = BT_CONFIG;
1747                         hci_conn_hold(conn);
1748                         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
1749                 } else
1750                         conn->state = BT_CONNECTED;
1751
1752                 hci_conn_hold_device(conn);
1753                 hci_conn_add_sysfs(conn);
1754
1755                 if (test_bit(HCI_AUTH, &hdev->flags))
1756                         conn->link_mode |= HCI_LM_AUTH;
1757
1758                 if (test_bit(HCI_ENCRYPT, &hdev->flags))
1759                         conn->link_mode |= HCI_LM_ENCRYPT;
1760
1761                 /* Get remote features */
1762                 if (conn->type == ACL_LINK) {
1763                         struct hci_cp_read_remote_features cp;
1764                         cp.handle = ev->handle;
1765                         hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
1766                                                         sizeof(cp), &cp);
1767                 }
1768
1769                 /* Set packet type for incoming connection */
1770                 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
1771                         struct hci_cp_change_conn_ptype cp;
1772                         cp.handle = ev->handle;
1773                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
1774                         hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE,
1775                                                         sizeof(cp), &cp);
1776                 }
1777         } else {
1778                 conn->state = BT_CLOSED;
1779                 if (conn->type == ACL_LINK)
1780                         mgmt_connect_failed(hdev, &ev->bdaddr, conn->type,
1781                                                 conn->dst_type, ev->status);
1782         }
1783
1784         if (conn->type == ACL_LINK)
1785                 hci_sco_setup(conn, ev->status);
1786
1787         if (ev->status) {
1788                 hci_proto_connect_cfm(conn, ev->status);
1789                 hci_conn_del(conn);
1790         } else if (ev->link_type != ACL_LINK)
1791                 hci_proto_connect_cfm(conn, ev->status);
1792
1793 unlock:
1794         hci_dev_unlock(hdev);
1795
1796         hci_conn_check_pending(hdev);
1797 }
1798
1799 static inline void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
1800 {
1801         struct hci_ev_conn_request *ev = (void *) skb->data;
1802         int mask = hdev->link_mode;
1803
1804         BT_DBG("%s bdaddr %s type 0x%x", hdev->name,
1805                                         batostr(&ev->bdaddr), ev->link_type);
1806
1807         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type);
1808
1809         if ((mask & HCI_LM_ACCEPT) &&
1810                         !hci_blacklist_lookup(hdev, &ev->bdaddr)) {
1811                 /* Connection accepted */
1812                 struct inquiry_entry *ie;
1813                 struct hci_conn *conn;
1814
1815                 hci_dev_lock(hdev);
1816
1817                 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
1818                 if (ie)
1819                         memcpy(ie->data.dev_class, ev->dev_class, 3);
1820
1821                 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
1822                 if (!conn) {
1823                         conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr);
1824                         if (!conn) {
1825                                 BT_ERR("No memory for new connection");
1826                                 hci_dev_unlock(hdev);
1827                                 return;
1828                         }
1829                 }
1830
1831                 memcpy(conn->dev_class, ev->dev_class, 3);
1832                 conn->state = BT_CONNECT;
1833
1834                 hci_dev_unlock(hdev);
1835
1836                 if (ev->link_type == ACL_LINK || !lmp_esco_capable(hdev)) {
1837                         struct hci_cp_accept_conn_req cp;
1838
1839                         bacpy(&cp.bdaddr, &ev->bdaddr);
1840
1841                         if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
1842                                 cp.role = 0x00; /* Become master */
1843                         else
1844                                 cp.role = 0x01; /* Remain slave */
1845
1846                         hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ,
1847                                                         sizeof(cp), &cp);
1848                 } else {
1849                         struct hci_cp_accept_sync_conn_req cp;
1850
1851                         bacpy(&cp.bdaddr, &ev->bdaddr);
1852                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
1853
1854                         cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
1855                         cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
1856                         cp.max_latency    = cpu_to_le16(0xffff);
1857                         cp.content_format = cpu_to_le16(hdev->voice_setting);
1858                         cp.retrans_effort = 0xff;
1859
1860                         hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ,
1861                                                         sizeof(cp), &cp);
1862                 }
1863         } else {
1864                 /* Connection rejected */
1865                 struct hci_cp_reject_conn_req cp;
1866
1867                 bacpy(&cp.bdaddr, &ev->bdaddr);
1868                 cp.reason = HCI_ERROR_REJ_BAD_ADDR;
1869                 hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
1870         }
1871 }
1872
1873 static inline void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1874 {
1875         struct hci_ev_disconn_complete *ev = (void *) skb->data;
1876         struct hci_conn *conn;
1877
1878         BT_DBG("%s status %d", hdev->name, ev->status);
1879
1880         hci_dev_lock(hdev);
1881
1882         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1883         if (!conn)
1884                 goto unlock;
1885
1886         if (ev->status == 0)
1887                 conn->state = BT_CLOSED;
1888
1889         if (test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags) &&
1890                         (conn->type == ACL_LINK || conn->type == LE_LINK)) {
1891                 if (ev->status != 0)
1892                         mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
1893                                                 conn->dst_type, ev->status);
1894                 else
1895                         mgmt_device_disconnected(hdev, &conn->dst, conn->type,
1896                                                         conn->dst_type);
1897         }
1898
1899         if (ev->status == 0) {
1900                 hci_proto_disconn_cfm(conn, ev->reason);
1901                 hci_conn_del(conn);
1902         }
1903
1904 unlock:
1905         hci_dev_unlock(hdev);
1906 }
1907
1908 static inline void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1909 {
1910         struct hci_ev_auth_complete *ev = (void *) skb->data;
1911         struct hci_conn *conn;
1912
1913         BT_DBG("%s status %d", hdev->name, ev->status);
1914
1915         hci_dev_lock(hdev);
1916
1917         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1918         if (!conn)
1919                 goto unlock;
1920
1921         if (!ev->status) {
1922                 if (!hci_conn_ssp_enabled(conn) &&
1923                                 test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
1924                         BT_INFO("re-auth of legacy device is not possible.");
1925                 } else {
1926                         conn->link_mode |= HCI_LM_AUTH;
1927                         conn->sec_level = conn->pending_sec_level;
1928                 }
1929         } else {
1930                 mgmt_auth_failed(hdev, &conn->dst, conn->type, conn->dst_type,
1931                                                                 ev->status);
1932         }
1933
1934         clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
1935         clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
1936
1937         if (conn->state == BT_CONFIG) {
1938                 if (!ev->status && hci_conn_ssp_enabled(conn)) {
1939                         struct hci_cp_set_conn_encrypt cp;
1940                         cp.handle  = ev->handle;
1941                         cp.encrypt = 0x01;
1942                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
1943                                                                         &cp);
1944                 } else {
1945                         conn->state = BT_CONNECTED;
1946                         hci_proto_connect_cfm(conn, ev->status);
1947                         hci_conn_put(conn);
1948                 }
1949         } else {
1950                 hci_auth_cfm(conn, ev->status);
1951
1952                 hci_conn_hold(conn);
1953                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
1954                 hci_conn_put(conn);
1955         }
1956
1957         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
1958                 if (!ev->status) {
1959                         struct hci_cp_set_conn_encrypt cp;
1960                         cp.handle  = ev->handle;
1961                         cp.encrypt = 0x01;
1962                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
1963                                                                         &cp);
1964                 } else {
1965                         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
1966                         hci_encrypt_cfm(conn, ev->status, 0x00);
1967                 }
1968         }
1969
1970 unlock:
1971         hci_dev_unlock(hdev);
1972 }
1973
1974 static inline void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
1975 {
1976         struct hci_ev_remote_name *ev = (void *) skb->data;
1977         struct hci_conn *conn;
1978
1979         BT_DBG("%s", hdev->name);
1980
1981         hci_conn_check_pending(hdev);
1982
1983         hci_dev_lock(hdev);
1984
1985         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
1986
1987         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
1988                 goto check_auth;
1989
1990         if (ev->status == 0)
1991                 hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
1992                                         strnlen(ev->name, HCI_MAX_NAME_LENGTH));
1993         else
1994                 hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
1995
1996 check_auth:
1997         if (!conn)
1998                 goto unlock;
1999
2000         if (!hci_outgoing_auth_needed(hdev, conn))
2001                 goto unlock;
2002
2003         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
2004                 struct hci_cp_auth_requested cp;
2005                 cp.handle = __cpu_to_le16(conn->handle);
2006                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
2007         }
2008
2009 unlock:
2010         hci_dev_unlock(hdev);
2011 }
2012
2013 static inline void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2014 {
2015         struct hci_ev_encrypt_change *ev = (void *) skb->data;
2016         struct hci_conn *conn;
2017
2018         BT_DBG("%s status %d", hdev->name, ev->status);
2019
2020         hci_dev_lock(hdev);
2021
2022         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2023         if (conn) {
2024                 if (!ev->status) {
2025                         if (ev->encrypt) {
2026                                 /* Encryption implies authentication */
2027                                 conn->link_mode |= HCI_LM_AUTH;
2028                                 conn->link_mode |= HCI_LM_ENCRYPT;
2029                                 conn->sec_level = conn->pending_sec_level;
2030                         } else
2031                                 conn->link_mode &= ~HCI_LM_ENCRYPT;
2032                 }
2033
2034                 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2035
2036                 if (conn->state == BT_CONFIG) {
2037                         if (!ev->status)
2038                                 conn->state = BT_CONNECTED;
2039
2040                         hci_proto_connect_cfm(conn, ev->status);
2041                         hci_conn_put(conn);
2042                 } else
2043                         hci_encrypt_cfm(conn, ev->status, ev->encrypt);
2044         }
2045
2046         hci_dev_unlock(hdev);
2047 }
2048
2049 static inline void hci_change_link_key_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2050 {
2051         struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
2052         struct hci_conn *conn;
2053
2054         BT_DBG("%s status %d", hdev->name, ev->status);
2055
2056         hci_dev_lock(hdev);
2057
2058         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2059         if (conn) {
2060                 if (!ev->status)
2061                         conn->link_mode |= HCI_LM_SECURE;
2062
2063                 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
2064
2065                 hci_key_change_cfm(conn, ev->status);
2066         }
2067
2068         hci_dev_unlock(hdev);
2069 }
2070
2071 static inline void hci_remote_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
2072 {
2073         struct hci_ev_remote_features *ev = (void *) skb->data;
2074         struct hci_conn *conn;
2075
2076         BT_DBG("%s status %d", hdev->name, ev->status);
2077
2078         hci_dev_lock(hdev);
2079
2080         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2081         if (!conn)
2082                 goto unlock;
2083
2084         if (!ev->status)
2085                 memcpy(conn->features, ev->features, 8);
2086
2087         if (conn->state != BT_CONFIG)
2088                 goto unlock;
2089
2090         if (!ev->status && lmp_ssp_capable(hdev) && lmp_ssp_capable(conn)) {
2091                 struct hci_cp_read_remote_ext_features cp;
2092                 cp.handle = ev->handle;
2093                 cp.page = 0x01;
2094                 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
2095                                                         sizeof(cp), &cp);
2096                 goto unlock;
2097         }
2098
2099         if (!ev->status) {
2100                 struct hci_cp_remote_name_req cp;
2101                 memset(&cp, 0, sizeof(cp));
2102                 bacpy(&cp.bdaddr, &conn->dst);
2103                 cp.pscan_rep_mode = 0x02;
2104                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2105         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2106                 mgmt_device_connected(hdev, &conn->dst, conn->type,
2107                                                 conn->dst_type, 0, NULL, 0,
2108                                                 conn->dev_class);
2109
2110         if (!hci_outgoing_auth_needed(hdev, conn)) {
2111                 conn->state = BT_CONNECTED;
2112                 hci_proto_connect_cfm(conn, ev->status);
2113                 hci_conn_put(conn);
2114         }
2115
2116 unlock:
2117         hci_dev_unlock(hdev);
2118 }
2119
2120 static inline void hci_remote_version_evt(struct hci_dev *hdev, struct sk_buff *skb)
2121 {
2122         BT_DBG("%s", hdev->name);
2123 }
2124
2125 static inline void hci_qos_setup_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2126 {
2127         BT_DBG("%s", hdev->name);
2128 }
2129
2130 static inline void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2131 {
2132         struct hci_ev_cmd_complete *ev = (void *) skb->data;
2133         __u16 opcode;
2134
2135         skb_pull(skb, sizeof(*ev));
2136
2137         opcode = __le16_to_cpu(ev->opcode);
2138
2139         switch (opcode) {
2140         case HCI_OP_INQUIRY_CANCEL:
2141                 hci_cc_inquiry_cancel(hdev, skb);
2142                 break;
2143
2144         case HCI_OP_EXIT_PERIODIC_INQ:
2145                 hci_cc_exit_periodic_inq(hdev, skb);
2146                 break;
2147
2148         case HCI_OP_REMOTE_NAME_REQ_CANCEL:
2149                 hci_cc_remote_name_req_cancel(hdev, skb);
2150                 break;
2151
2152         case HCI_OP_ROLE_DISCOVERY:
2153                 hci_cc_role_discovery(hdev, skb);
2154                 break;
2155
2156         case HCI_OP_READ_LINK_POLICY:
2157                 hci_cc_read_link_policy(hdev, skb);
2158                 break;
2159
2160         case HCI_OP_WRITE_LINK_POLICY:
2161                 hci_cc_write_link_policy(hdev, skb);
2162                 break;
2163
2164         case HCI_OP_READ_DEF_LINK_POLICY:
2165                 hci_cc_read_def_link_policy(hdev, skb);
2166                 break;
2167
2168         case HCI_OP_WRITE_DEF_LINK_POLICY:
2169                 hci_cc_write_def_link_policy(hdev, skb);
2170                 break;
2171
2172         case HCI_OP_RESET:
2173                 hci_cc_reset(hdev, skb);
2174                 break;
2175
2176         case HCI_OP_WRITE_LOCAL_NAME:
2177                 hci_cc_write_local_name(hdev, skb);
2178                 break;
2179
2180         case HCI_OP_READ_LOCAL_NAME:
2181                 hci_cc_read_local_name(hdev, skb);
2182                 break;
2183
2184         case HCI_OP_WRITE_AUTH_ENABLE:
2185                 hci_cc_write_auth_enable(hdev, skb);
2186                 break;
2187
2188         case HCI_OP_WRITE_ENCRYPT_MODE:
2189                 hci_cc_write_encrypt_mode(hdev, skb);
2190                 break;
2191
2192         case HCI_OP_WRITE_SCAN_ENABLE:
2193                 hci_cc_write_scan_enable(hdev, skb);
2194                 break;
2195
2196         case HCI_OP_READ_CLASS_OF_DEV:
2197                 hci_cc_read_class_of_dev(hdev, skb);
2198                 break;
2199
2200         case HCI_OP_WRITE_CLASS_OF_DEV:
2201                 hci_cc_write_class_of_dev(hdev, skb);
2202                 break;
2203
2204         case HCI_OP_READ_VOICE_SETTING:
2205                 hci_cc_read_voice_setting(hdev, skb);
2206                 break;
2207
2208         case HCI_OP_WRITE_VOICE_SETTING:
2209                 hci_cc_write_voice_setting(hdev, skb);
2210                 break;
2211
2212         case HCI_OP_HOST_BUFFER_SIZE:
2213                 hci_cc_host_buffer_size(hdev, skb);
2214                 break;
2215
2216         case HCI_OP_WRITE_SSP_MODE:
2217                 hci_cc_write_ssp_mode(hdev, skb);
2218                 break;
2219
2220         case HCI_OP_READ_LOCAL_VERSION:
2221                 hci_cc_read_local_version(hdev, skb);
2222                 break;
2223
2224         case HCI_OP_READ_LOCAL_COMMANDS:
2225                 hci_cc_read_local_commands(hdev, skb);
2226                 break;
2227
2228         case HCI_OP_READ_LOCAL_FEATURES:
2229                 hci_cc_read_local_features(hdev, skb);
2230                 break;
2231
2232         case HCI_OP_READ_LOCAL_EXT_FEATURES:
2233                 hci_cc_read_local_ext_features(hdev, skb);
2234                 break;
2235
2236         case HCI_OP_READ_BUFFER_SIZE:
2237                 hci_cc_read_buffer_size(hdev, skb);
2238                 break;
2239
2240         case HCI_OP_READ_BD_ADDR:
2241                 hci_cc_read_bd_addr(hdev, skb);
2242                 break;
2243
2244         case HCI_OP_READ_DATA_BLOCK_SIZE:
2245                 hci_cc_read_data_block_size(hdev, skb);
2246                 break;
2247
2248         case HCI_OP_WRITE_CA_TIMEOUT:
2249                 hci_cc_write_ca_timeout(hdev, skb);
2250                 break;
2251
2252         case HCI_OP_READ_FLOW_CONTROL_MODE:
2253                 hci_cc_read_flow_control_mode(hdev, skb);
2254                 break;
2255
2256         case HCI_OP_READ_LOCAL_AMP_INFO:
2257                 hci_cc_read_local_amp_info(hdev, skb);
2258                 break;
2259
2260         case HCI_OP_DELETE_STORED_LINK_KEY:
2261                 hci_cc_delete_stored_link_key(hdev, skb);
2262                 break;
2263
2264         case HCI_OP_SET_EVENT_MASK:
2265                 hci_cc_set_event_mask(hdev, skb);
2266                 break;
2267
2268         case HCI_OP_WRITE_INQUIRY_MODE:
2269                 hci_cc_write_inquiry_mode(hdev, skb);
2270                 break;
2271
2272         case HCI_OP_READ_INQ_RSP_TX_POWER:
2273                 hci_cc_read_inq_rsp_tx_power(hdev, skb);
2274                 break;
2275
2276         case HCI_OP_SET_EVENT_FLT:
2277                 hci_cc_set_event_flt(hdev, skb);
2278                 break;
2279
2280         case HCI_OP_PIN_CODE_REPLY:
2281                 hci_cc_pin_code_reply(hdev, skb);
2282                 break;
2283
2284         case HCI_OP_PIN_CODE_NEG_REPLY:
2285                 hci_cc_pin_code_neg_reply(hdev, skb);
2286                 break;
2287
2288         case HCI_OP_READ_LOCAL_OOB_DATA:
2289                 hci_cc_read_local_oob_data_reply(hdev, skb);
2290                 break;
2291
2292         case HCI_OP_LE_READ_BUFFER_SIZE:
2293                 hci_cc_le_read_buffer_size(hdev, skb);
2294                 break;
2295
2296         case HCI_OP_USER_CONFIRM_REPLY:
2297                 hci_cc_user_confirm_reply(hdev, skb);
2298                 break;
2299
2300         case HCI_OP_USER_CONFIRM_NEG_REPLY:
2301                 hci_cc_user_confirm_neg_reply(hdev, skb);
2302                 break;
2303
2304         case HCI_OP_USER_PASSKEY_REPLY:
2305                 hci_cc_user_passkey_reply(hdev, skb);
2306                 break;
2307
2308         case HCI_OP_USER_PASSKEY_NEG_REPLY:
2309                 hci_cc_user_passkey_neg_reply(hdev, skb);
2310
2311         case HCI_OP_LE_SET_SCAN_PARAM:
2312                 hci_cc_le_set_scan_param(hdev, skb);
2313                 break;
2314
2315         case HCI_OP_LE_SET_SCAN_ENABLE:
2316                 hci_cc_le_set_scan_enable(hdev, skb);
2317                 break;
2318
2319         case HCI_OP_LE_LTK_REPLY:
2320                 hci_cc_le_ltk_reply(hdev, skb);
2321                 break;
2322
2323         case HCI_OP_LE_LTK_NEG_REPLY:
2324                 hci_cc_le_ltk_neg_reply(hdev, skb);
2325                 break;
2326
2327         case HCI_OP_WRITE_LE_HOST_SUPPORTED:
2328                 hci_cc_write_le_host_supported(hdev, skb);
2329                 break;
2330
2331         default:
2332                 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
2333                 break;
2334         }
2335
2336         if (ev->opcode != HCI_OP_NOP)
2337                 del_timer(&hdev->cmd_timer);
2338
2339         if (ev->ncmd) {
2340                 atomic_set(&hdev->cmd_cnt, 1);
2341                 if (!skb_queue_empty(&hdev->cmd_q))
2342                         queue_work(hdev->workqueue, &hdev->cmd_work);
2343         }
2344 }
2345
2346 static inline void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb)
2347 {
2348         struct hci_ev_cmd_status *ev = (void *) skb->data;
2349         __u16 opcode;
2350
2351         skb_pull(skb, sizeof(*ev));
2352
2353         opcode = __le16_to_cpu(ev->opcode);
2354
2355         switch (opcode) {
2356         case HCI_OP_INQUIRY:
2357                 hci_cs_inquiry(hdev, ev->status);
2358                 break;
2359
2360         case HCI_OP_CREATE_CONN:
2361                 hci_cs_create_conn(hdev, ev->status);
2362                 break;
2363
2364         case HCI_OP_ADD_SCO:
2365                 hci_cs_add_sco(hdev, ev->status);
2366                 break;
2367
2368         case HCI_OP_AUTH_REQUESTED:
2369                 hci_cs_auth_requested(hdev, ev->status);
2370                 break;
2371
2372         case HCI_OP_SET_CONN_ENCRYPT:
2373                 hci_cs_set_conn_encrypt(hdev, ev->status);
2374                 break;
2375
2376         case HCI_OP_REMOTE_NAME_REQ:
2377                 hci_cs_remote_name_req(hdev, ev->status);
2378                 break;
2379
2380         case HCI_OP_READ_REMOTE_FEATURES:
2381                 hci_cs_read_remote_features(hdev, ev->status);
2382                 break;
2383
2384         case HCI_OP_READ_REMOTE_EXT_FEATURES:
2385                 hci_cs_read_remote_ext_features(hdev, ev->status);
2386                 break;
2387
2388         case HCI_OP_SETUP_SYNC_CONN:
2389                 hci_cs_setup_sync_conn(hdev, ev->status);
2390                 break;
2391
2392         case HCI_OP_SNIFF_MODE:
2393                 hci_cs_sniff_mode(hdev, ev->status);
2394                 break;
2395
2396         case HCI_OP_EXIT_SNIFF_MODE:
2397                 hci_cs_exit_sniff_mode(hdev, ev->status);
2398                 break;
2399
2400         case HCI_OP_DISCONNECT:
2401                 hci_cs_disconnect(hdev, ev->status);
2402                 break;
2403
2404         case HCI_OP_LE_CREATE_CONN:
2405                 hci_cs_le_create_conn(hdev, ev->status);
2406                 break;
2407
2408         case HCI_OP_LE_START_ENC:
2409                 hci_cs_le_start_enc(hdev, ev->status);
2410                 break;
2411
2412         default:
2413                 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
2414                 break;
2415         }
2416
2417         if (ev->opcode != HCI_OP_NOP)
2418                 del_timer(&hdev->cmd_timer);
2419
2420         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
2421                 atomic_set(&hdev->cmd_cnt, 1);
2422                 if (!skb_queue_empty(&hdev->cmd_q))
2423                         queue_work(hdev->workqueue, &hdev->cmd_work);
2424         }
2425 }
2426
2427 static inline void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2428 {
2429         struct hci_ev_role_change *ev = (void *) skb->data;
2430         struct hci_conn *conn;
2431
2432         BT_DBG("%s status %d", hdev->name, ev->status);
2433
2434         hci_dev_lock(hdev);
2435
2436         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2437         if (conn) {
2438                 if (!ev->status) {
2439                         if (ev->role)
2440                                 conn->link_mode &= ~HCI_LM_MASTER;
2441                         else
2442                                 conn->link_mode |= HCI_LM_MASTER;
2443                 }
2444
2445                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
2446
2447                 hci_role_switch_cfm(conn, ev->status, ev->role);
2448         }
2449
2450         hci_dev_unlock(hdev);
2451 }
2452
2453 static inline void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
2454 {
2455         struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
2456         int i;
2457
2458         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
2459                 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
2460                 return;
2461         }
2462
2463         if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
2464                         ev->num_hndl * sizeof(struct hci_comp_pkts_info)) {
2465                 BT_DBG("%s bad parameters", hdev->name);
2466                 return;
2467         }
2468
2469         BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
2470
2471         for (i = 0; i < ev->num_hndl; i++) {
2472                 struct hci_comp_pkts_info *info = &ev->handles[i];
2473                 struct hci_conn *conn;
2474                 __u16  handle, count;
2475
2476                 handle = __le16_to_cpu(info->handle);
2477                 count  = __le16_to_cpu(info->count);
2478
2479                 conn = hci_conn_hash_lookup_handle(hdev, handle);
2480                 if (!conn)
2481                         continue;
2482
2483                 conn->sent -= count;
2484
2485                 switch (conn->type) {
2486                 case ACL_LINK:
2487                         hdev->acl_cnt += count;
2488                         if (hdev->acl_cnt > hdev->acl_pkts)
2489                                 hdev->acl_cnt = hdev->acl_pkts;
2490                         break;
2491
2492                 case LE_LINK:
2493                         if (hdev->le_pkts) {
2494                                 hdev->le_cnt += count;
2495                                 if (hdev->le_cnt > hdev->le_pkts)
2496                                         hdev->le_cnt = hdev->le_pkts;
2497                         } else {
2498                                 hdev->acl_cnt += count;
2499                                 if (hdev->acl_cnt > hdev->acl_pkts)
2500                                         hdev->acl_cnt = hdev->acl_pkts;
2501                         }
2502                         break;
2503
2504                 case SCO_LINK:
2505                         hdev->sco_cnt += count;
2506                         if (hdev->sco_cnt > hdev->sco_pkts)
2507                                 hdev->sco_cnt = hdev->sco_pkts;
2508                         break;
2509
2510                 default:
2511                         BT_ERR("Unknown type %d conn %p", conn->type, conn);
2512                         break;
2513                 }
2514         }
2515
2516         queue_work(hdev->workqueue, &hdev->tx_work);
2517 }
2518
2519 static inline void hci_num_comp_blocks_evt(struct hci_dev *hdev,
2520                                                         struct sk_buff *skb)
2521 {
2522         struct hci_ev_num_comp_blocks *ev = (void *) skb->data;
2523         int i;
2524
2525         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
2526                 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
2527                 return;
2528         }
2529
2530         if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
2531                         ev->num_hndl * sizeof(struct hci_comp_blocks_info)) {
2532                 BT_DBG("%s bad parameters", hdev->name);
2533                 return;
2534         }
2535
2536         BT_DBG("%s num_blocks %d num_hndl %d", hdev->name, ev->num_blocks,
2537                                                                 ev->num_hndl);
2538
2539         for (i = 0; i < ev->num_hndl; i++) {
2540                 struct hci_comp_blocks_info *info = &ev->handles[i];
2541                 struct hci_conn *conn;
2542                 __u16  handle, block_count;
2543
2544                 handle = __le16_to_cpu(info->handle);
2545                 block_count = __le16_to_cpu(info->blocks);
2546
2547                 conn = hci_conn_hash_lookup_handle(hdev, handle);
2548                 if (!conn)
2549                         continue;
2550
2551                 conn->sent -= block_count;
2552
2553                 switch (conn->type) {
2554                 case ACL_LINK:
2555                         hdev->block_cnt += block_count;
2556                         if (hdev->block_cnt > hdev->num_blocks)
2557                                 hdev->block_cnt = hdev->num_blocks;
2558                         break;
2559
2560                 default:
2561                         BT_ERR("Unknown type %d conn %p", conn->type, conn);
2562                         break;
2563                 }
2564         }
2565
2566         queue_work(hdev->workqueue, &hdev->tx_work);
2567 }
2568
2569 static inline void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2570 {
2571         struct hci_ev_mode_change *ev = (void *) skb->data;
2572         struct hci_conn *conn;
2573
2574         BT_DBG("%s status %d", hdev->name, ev->status);
2575
2576         hci_dev_lock(hdev);
2577
2578         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2579         if (conn) {
2580                 conn->mode = ev->mode;
2581                 conn->interval = __le16_to_cpu(ev->interval);
2582
2583                 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
2584                         if (conn->mode == HCI_CM_ACTIVE)
2585                                 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
2586                         else
2587                                 clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
2588                 }
2589
2590                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2591                         hci_sco_setup(conn, ev->status);
2592         }
2593
2594         hci_dev_unlock(hdev);
2595 }
2596
2597 static inline void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2598 {
2599         struct hci_ev_pin_code_req *ev = (void *) skb->data;
2600         struct hci_conn *conn;
2601
2602         BT_DBG("%s", hdev->name);
2603
2604         hci_dev_lock(hdev);
2605
2606         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2607         if (!conn)
2608                 goto unlock;
2609
2610         if (conn->state == BT_CONNECTED) {
2611                 hci_conn_hold(conn);
2612                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2613                 hci_conn_put(conn);
2614         }
2615
2616         if (!test_bit(HCI_PAIRABLE, &hdev->dev_flags))
2617                 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2618                                         sizeof(ev->bdaddr), &ev->bdaddr);
2619         else if (test_bit(HCI_MGMT, &hdev->dev_flags)) {
2620                 u8 secure;
2621
2622                 if (conn->pending_sec_level == BT_SECURITY_HIGH)
2623                         secure = 1;
2624                 else
2625                         secure = 0;
2626
2627                 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
2628         }
2629
2630 unlock:
2631         hci_dev_unlock(hdev);
2632 }
2633
2634 static inline void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2635 {
2636         struct hci_ev_link_key_req *ev = (void *) skb->data;
2637         struct hci_cp_link_key_reply cp;
2638         struct hci_conn *conn;
2639         struct link_key *key;
2640
2641         BT_DBG("%s", hdev->name);
2642
2643         if (!test_bit(HCI_LINK_KEYS, &hdev->dev_flags))
2644                 return;
2645
2646         hci_dev_lock(hdev);
2647
2648         key = hci_find_link_key(hdev, &ev->bdaddr);
2649         if (!key) {
2650                 BT_DBG("%s link key not found for %s", hdev->name,
2651                                                         batostr(&ev->bdaddr));
2652                 goto not_found;
2653         }
2654
2655         BT_DBG("%s found key type %u for %s", hdev->name, key->type,
2656                                                         batostr(&ev->bdaddr));
2657
2658         if (!test_bit(HCI_DEBUG_KEYS, &hdev->dev_flags) &&
2659                                 key->type == HCI_LK_DEBUG_COMBINATION) {
2660                 BT_DBG("%s ignoring debug key", hdev->name);
2661                 goto not_found;
2662         }
2663
2664         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2665         if (conn) {
2666                 if (key->type == HCI_LK_UNAUTH_COMBINATION &&
2667                                 conn->auth_type != 0xff &&
2668                                 (conn->auth_type & 0x01)) {
2669                         BT_DBG("%s ignoring unauthenticated key", hdev->name);
2670                         goto not_found;
2671                 }
2672
2673                 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
2674                                 conn->pending_sec_level == BT_SECURITY_HIGH) {
2675                         BT_DBG("%s ignoring key unauthenticated for high \
2676                                                         security", hdev->name);
2677                         goto not_found;
2678                 }
2679
2680                 conn->key_type = key->type;
2681                 conn->pin_length = key->pin_len;
2682         }
2683
2684         bacpy(&cp.bdaddr, &ev->bdaddr);
2685         memcpy(cp.link_key, key->val, 16);
2686
2687         hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
2688
2689         hci_dev_unlock(hdev);
2690
2691         return;
2692
2693 not_found:
2694         hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
2695         hci_dev_unlock(hdev);
2696 }
2697
2698 static inline void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
2699 {
2700         struct hci_ev_link_key_notify *ev = (void *) skb->data;
2701         struct hci_conn *conn;
2702         u8 pin_len = 0;
2703
2704         BT_DBG("%s", hdev->name);
2705
2706         hci_dev_lock(hdev);
2707
2708         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2709         if (conn) {
2710                 hci_conn_hold(conn);
2711                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2712                 pin_len = conn->pin_length;
2713
2714                 if (ev->key_type != HCI_LK_CHANGED_COMBINATION)
2715                         conn->key_type = ev->key_type;
2716
2717                 hci_conn_put(conn);
2718         }
2719
2720         if (test_bit(HCI_LINK_KEYS, &hdev->dev_flags))
2721                 hci_add_link_key(hdev, conn, 1, &ev->bdaddr, ev->link_key,
2722                                                         ev->key_type, pin_len);
2723
2724         hci_dev_unlock(hdev);
2725 }
2726
2727 static inline void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
2728 {
2729         struct hci_ev_clock_offset *ev = (void *) skb->data;
2730         struct hci_conn *conn;
2731
2732         BT_DBG("%s status %d", hdev->name, ev->status);
2733
2734         hci_dev_lock(hdev);
2735
2736         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2737         if (conn && !ev->status) {
2738                 struct inquiry_entry *ie;
2739
2740                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
2741                 if (ie) {
2742                         ie->data.clock_offset = ev->clock_offset;
2743                         ie->timestamp = jiffies;
2744                 }
2745         }
2746
2747         hci_dev_unlock(hdev);
2748 }
2749
2750 static inline void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2751 {
2752         struct hci_ev_pkt_type_change *ev = (void *) skb->data;
2753         struct hci_conn *conn;
2754
2755         BT_DBG("%s status %d", hdev->name, ev->status);
2756
2757         hci_dev_lock(hdev);
2758
2759         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2760         if (conn && !ev->status)
2761                 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
2762
2763         hci_dev_unlock(hdev);
2764 }
2765
2766 static inline void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
2767 {
2768         struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
2769         struct inquiry_entry *ie;
2770
2771         BT_DBG("%s", hdev->name);
2772
2773         hci_dev_lock(hdev);
2774
2775         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2776         if (ie) {
2777                 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
2778                 ie->timestamp = jiffies;
2779         }
2780
2781         hci_dev_unlock(hdev);
2782 }
2783
2784 static inline void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, struct sk_buff *skb)
2785 {
2786         struct inquiry_data data;
2787         int num_rsp = *((__u8 *) skb->data);
2788         bool name_known, ssp;
2789
2790         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2791
2792         if (!num_rsp)
2793                 return;
2794
2795         hci_dev_lock(hdev);
2796
2797         if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
2798                 struct inquiry_info_with_rssi_and_pscan_mode *info;
2799                 info = (void *) (skb->data + 1);
2800
2801                 for (; num_rsp; num_rsp--, info++) {
2802                         bacpy(&data.bdaddr, &info->bdaddr);
2803                         data.pscan_rep_mode     = info->pscan_rep_mode;
2804                         data.pscan_period_mode  = info->pscan_period_mode;
2805                         data.pscan_mode         = info->pscan_mode;
2806                         memcpy(data.dev_class, info->dev_class, 3);
2807                         data.clock_offset       = info->clock_offset;
2808                         data.rssi               = info->rssi;
2809                         data.ssp_mode           = 0x00;
2810
2811                         name_known = hci_inquiry_cache_update(hdev, &data,
2812                                                                 false, &ssp);
2813                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2814                                                 info->dev_class, info->rssi,
2815                                                 !name_known, ssp, NULL, 0);
2816                 }
2817         } else {
2818                 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
2819
2820                 for (; num_rsp; num_rsp--, info++) {
2821                         bacpy(&data.bdaddr, &info->bdaddr);
2822                         data.pscan_rep_mode     = info->pscan_rep_mode;
2823                         data.pscan_period_mode  = info->pscan_period_mode;
2824                         data.pscan_mode         = 0x00;
2825                         memcpy(data.dev_class, info->dev_class, 3);
2826                         data.clock_offset       = info->clock_offset;
2827                         data.rssi               = info->rssi;
2828                         data.ssp_mode           = 0x00;
2829                         name_known = hci_inquiry_cache_update(hdev, &data,
2830                                                                 false, &ssp);
2831                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2832                                                 info->dev_class, info->rssi,
2833                                                 !name_known, ssp, NULL, 0);
2834                 }
2835         }
2836
2837         hci_dev_unlock(hdev);
2838 }
2839
2840 static inline void hci_remote_ext_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
2841 {
2842         struct hci_ev_remote_ext_features *ev = (void *) skb->data;
2843         struct hci_conn *conn;
2844
2845         BT_DBG("%s", hdev->name);
2846
2847         hci_dev_lock(hdev);
2848
2849         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2850         if (!conn)
2851                 goto unlock;
2852
2853         if (!ev->status && ev->page == 0x01) {
2854                 struct inquiry_entry *ie;
2855
2856                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
2857                 if (ie)
2858                         ie->data.ssp_mode = (ev->features[0] & 0x01);
2859
2860                 if (ev->features[0] & 0x01)
2861                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
2862         }
2863
2864         if (conn->state != BT_CONFIG)
2865                 goto unlock;
2866
2867         if (!ev->status) {
2868                 struct hci_cp_remote_name_req cp;
2869                 memset(&cp, 0, sizeof(cp));
2870                 bacpy(&cp.bdaddr, &conn->dst);
2871                 cp.pscan_rep_mode = 0x02;
2872                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2873         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2874                 mgmt_device_connected(hdev, &conn->dst, conn->type,
2875                                                 conn->dst_type, 0, NULL, 0,
2876                                                 conn->dev_class);
2877
2878         if (!hci_outgoing_auth_needed(hdev, conn)) {
2879                 conn->state = BT_CONNECTED;
2880                 hci_proto_connect_cfm(conn, ev->status);
2881                 hci_conn_put(conn);
2882         }
2883
2884 unlock:
2885         hci_dev_unlock(hdev);
2886 }
2887
2888 static inline void hci_sync_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2889 {
2890         struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
2891         struct hci_conn *conn;
2892
2893         BT_DBG("%s status %d", hdev->name, ev->status);
2894
2895         hci_dev_lock(hdev);
2896
2897         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
2898         if (!conn) {
2899                 if (ev->link_type == ESCO_LINK)
2900                         goto unlock;
2901
2902                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
2903                 if (!conn)
2904                         goto unlock;
2905
2906                 conn->type = SCO_LINK;
2907         }
2908
2909         switch (ev->status) {
2910         case 0x00:
2911                 conn->handle = __le16_to_cpu(ev->handle);
2912                 conn->state  = BT_CONNECTED;
2913
2914                 hci_conn_hold_device(conn);
2915                 hci_conn_add_sysfs(conn);
2916                 break;
2917
2918         case 0x11:      /* Unsupported Feature or Parameter Value */
2919         case 0x1c:      /* SCO interval rejected */
2920         case 0x1a:      /* Unsupported Remote Feature */
2921         case 0x1f:      /* Unspecified error */
2922                 if (conn->out && conn->attempt < 2) {
2923                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
2924                                         (hdev->esco_type & EDR_ESCO_MASK);
2925                         hci_setup_sync(conn, conn->link->handle);
2926                         goto unlock;
2927                 }
2928                 /* fall through */
2929
2930         default:
2931                 conn->state = BT_CLOSED;
2932                 break;
2933         }
2934
2935         hci_proto_connect_cfm(conn, ev->status);
2936         if (ev->status)
2937                 hci_conn_del(conn);
2938
2939 unlock:
2940         hci_dev_unlock(hdev);
2941 }
2942
2943 static inline void hci_sync_conn_changed_evt(struct hci_dev *hdev, struct sk_buff *skb)
2944 {
2945         BT_DBG("%s", hdev->name);
2946 }
2947
2948 static inline void hci_sniff_subrate_evt(struct hci_dev *hdev, struct sk_buff *skb)
2949 {
2950         struct hci_ev_sniff_subrate *ev = (void *) skb->data;
2951
2952         BT_DBG("%s status %d", hdev->name, ev->status);
2953 }
2954
2955 static inline void hci_extended_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
2956 {
2957         struct inquiry_data data;
2958         struct extended_inquiry_info *info = (void *) (skb->data + 1);
2959         int num_rsp = *((__u8 *) skb->data);
2960
2961         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2962
2963         if (!num_rsp)
2964                 return;
2965
2966         hci_dev_lock(hdev);
2967
2968         for (; num_rsp; num_rsp--, info++) {
2969                 bool name_known, ssp;
2970
2971                 bacpy(&data.bdaddr, &info->bdaddr);
2972                 data.pscan_rep_mode     = info->pscan_rep_mode;
2973                 data.pscan_period_mode  = info->pscan_period_mode;
2974                 data.pscan_mode         = 0x00;
2975                 memcpy(data.dev_class, info->dev_class, 3);
2976                 data.clock_offset       = info->clock_offset;
2977                 data.rssi               = info->rssi;
2978                 data.ssp_mode           = 0x01;
2979
2980                 if (test_bit(HCI_MGMT, &hdev->dev_flags))
2981                         name_known = eir_has_data_type(info->data,
2982                                                         sizeof(info->data),
2983                                                         EIR_NAME_COMPLETE);
2984                 else
2985                         name_known = true;
2986
2987                 name_known = hci_inquiry_cache_update(hdev, &data, name_known,
2988                                                                         &ssp);
2989                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2990                                                 info->dev_class, info->rssi,
2991                                                 !name_known, ssp, info->data,
2992                                                 sizeof(info->data));
2993         }
2994
2995         hci_dev_unlock(hdev);
2996 }
2997
2998 static inline u8 hci_get_auth_req(struct hci_conn *conn)
2999 {
3000         /* If remote requests dedicated bonding follow that lead */
3001         if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03) {
3002                 /* If both remote and local IO capabilities allow MITM
3003                  * protection then require it, otherwise don't */
3004                 if (conn->remote_cap == 0x03 || conn->io_capability == 0x03)
3005                         return 0x02;
3006                 else
3007                         return 0x03;
3008         }
3009
3010         /* If remote requests no-bonding follow that lead */
3011         if (conn->remote_auth == 0x00 || conn->remote_auth == 0x01)
3012                 return conn->remote_auth | (conn->auth_type & 0x01);
3013
3014         return conn->auth_type;
3015 }
3016
3017 static inline void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3018 {
3019         struct hci_ev_io_capa_request *ev = (void *) skb->data;
3020         struct hci_conn *conn;
3021
3022         BT_DBG("%s", hdev->name);
3023
3024         hci_dev_lock(hdev);
3025
3026         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3027         if (!conn)
3028                 goto unlock;
3029
3030         hci_conn_hold(conn);
3031
3032         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3033                 goto unlock;
3034
3035         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags) ||
3036                         (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
3037                 struct hci_cp_io_capability_reply cp;
3038
3039                 bacpy(&cp.bdaddr, &ev->bdaddr);
3040                 /* Change the IO capability from KeyboardDisplay
3041                  * to DisplayYesNo as it is not supported by BT spec. */
3042                 cp.capability = (conn->io_capability == 0x04) ?
3043                                                 0x01 : conn->io_capability;
3044                 conn->auth_type = hci_get_auth_req(conn);
3045                 cp.authentication = conn->auth_type;
3046
3047                 if ((conn->out || test_bit(HCI_CONN_REMOTE_OOB, &conn->flags)) &&
3048                                 hci_find_remote_oob_data(hdev, &conn->dst))
3049                         cp.oob_data = 0x01;
3050                 else
3051                         cp.oob_data = 0x00;
3052
3053                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
3054                                                         sizeof(cp), &cp);
3055         } else {
3056                 struct hci_cp_io_capability_neg_reply cp;
3057
3058                 bacpy(&cp.bdaddr, &ev->bdaddr);
3059                 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
3060
3061                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
3062                                                         sizeof(cp), &cp);
3063         }
3064
3065 unlock:
3066         hci_dev_unlock(hdev);
3067 }
3068
3069 static inline void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
3070 {
3071         struct hci_ev_io_capa_reply *ev = (void *) skb->data;
3072         struct hci_conn *conn;
3073
3074         BT_DBG("%s", hdev->name);
3075
3076         hci_dev_lock(hdev);
3077
3078         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3079         if (!conn)
3080                 goto unlock;
3081
3082         conn->remote_cap = ev->capability;
3083         conn->remote_auth = ev->authentication;
3084         if (ev->oob_data)
3085                 set_bit(HCI_CONN_REMOTE_OOB, &conn->flags);
3086
3087 unlock:
3088         hci_dev_unlock(hdev);
3089 }
3090
3091 static inline void hci_user_confirm_request_evt(struct hci_dev *hdev,
3092                                                         struct sk_buff *skb)
3093 {
3094         struct hci_ev_user_confirm_req *ev = (void *) skb->data;
3095         int loc_mitm, rem_mitm, confirm_hint = 0;
3096         struct hci_conn *conn;
3097
3098         BT_DBG("%s", hdev->name);
3099
3100         hci_dev_lock(hdev);
3101
3102         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3103                 goto unlock;
3104
3105         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3106         if (!conn)
3107                 goto unlock;
3108
3109         loc_mitm = (conn->auth_type & 0x01);
3110         rem_mitm = (conn->remote_auth & 0x01);
3111
3112         /* If we require MITM but the remote device can't provide that
3113          * (it has NoInputNoOutput) then reject the confirmation
3114          * request. The only exception is when we're dedicated bonding
3115          * initiators (connect_cfm_cb set) since then we always have the MITM
3116          * bit set. */
3117         if (!conn->connect_cfm_cb && loc_mitm && conn->remote_cap == 0x03) {
3118                 BT_DBG("Rejecting request: remote device can't provide MITM");
3119                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
3120                                         sizeof(ev->bdaddr), &ev->bdaddr);
3121                 goto unlock;
3122         }
3123
3124         /* If no side requires MITM protection; auto-accept */
3125         if ((!loc_mitm || conn->remote_cap == 0x03) &&
3126                                 (!rem_mitm || conn->io_capability == 0x03)) {
3127
3128                 /* If we're not the initiators request authorization to
3129                  * proceed from user space (mgmt_user_confirm with
3130                  * confirm_hint set to 1). */
3131                 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
3132                         BT_DBG("Confirming auto-accept as acceptor");
3133                         confirm_hint = 1;
3134                         goto confirm;
3135                 }
3136
3137                 BT_DBG("Auto-accept of user confirmation with %ums delay",
3138                                                 hdev->auto_accept_delay);
3139
3140                 if (hdev->auto_accept_delay > 0) {
3141                         int delay = msecs_to_jiffies(hdev->auto_accept_delay);
3142                         mod_timer(&conn->auto_accept_timer, jiffies + delay);
3143                         goto unlock;
3144                 }
3145
3146                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
3147                                                 sizeof(ev->bdaddr), &ev->bdaddr);
3148                 goto unlock;
3149         }
3150
3151 confirm:
3152         mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0, ev->passkey,
3153                                                                 confirm_hint);
3154
3155 unlock:
3156         hci_dev_unlock(hdev);
3157 }
3158
3159 static inline void hci_user_passkey_request_evt(struct hci_dev *hdev,
3160                                                         struct sk_buff *skb)
3161 {
3162         struct hci_ev_user_passkey_req *ev = (void *) skb->data;
3163
3164         BT_DBG("%s", hdev->name);
3165
3166         hci_dev_lock(hdev);
3167
3168         if (test_bit(HCI_MGMT, &hdev->dev_flags))
3169                 mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
3170
3171         hci_dev_unlock(hdev);
3172 }
3173
3174 static inline void hci_simple_pair_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
3175 {
3176         struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
3177         struct hci_conn *conn;
3178
3179         BT_DBG("%s", hdev->name);
3180
3181         hci_dev_lock(hdev);
3182
3183         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3184         if (!conn)
3185                 goto unlock;
3186
3187         /* To avoid duplicate auth_failed events to user space we check
3188          * the HCI_CONN_AUTH_PEND flag which will be set if we
3189          * initiated the authentication. A traditional auth_complete
3190          * event gets always produced as initiator and is also mapped to
3191          * the mgmt_auth_failed event */
3192         if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status != 0)
3193                 mgmt_auth_failed(hdev, &conn->dst, conn->type, conn->dst_type,
3194                                                                 ev->status);
3195
3196         hci_conn_put(conn);
3197
3198 unlock:
3199         hci_dev_unlock(hdev);
3200 }
3201
3202 static inline void hci_remote_host_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
3203 {
3204         struct hci_ev_remote_host_features *ev = (void *) skb->data;
3205         struct inquiry_entry *ie;
3206
3207         BT_DBG("%s", hdev->name);
3208
3209         hci_dev_lock(hdev);
3210
3211         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
3212         if (ie)
3213                 ie->data.ssp_mode = (ev->features[0] & 0x01);
3214
3215         hci_dev_unlock(hdev);
3216 }
3217
3218 static inline void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
3219                                                         struct sk_buff *skb)
3220 {
3221         struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
3222         struct oob_data *data;
3223
3224         BT_DBG("%s", hdev->name);
3225
3226         hci_dev_lock(hdev);
3227
3228         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3229                 goto unlock;
3230
3231         data = hci_find_remote_oob_data(hdev, &ev->bdaddr);
3232         if (data) {
3233                 struct hci_cp_remote_oob_data_reply cp;
3234
3235                 bacpy(&cp.bdaddr, &ev->bdaddr);
3236                 memcpy(cp.hash, data->hash, sizeof(cp.hash));
3237                 memcpy(cp.randomizer, data->randomizer, sizeof(cp.randomizer));
3238
3239                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY, sizeof(cp),
3240                                                                         &cp);
3241         } else {
3242                 struct hci_cp_remote_oob_data_neg_reply cp;
3243
3244                 bacpy(&cp.bdaddr, &ev->bdaddr);
3245                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY, sizeof(cp),
3246                                                                         &cp);
3247         }
3248
3249 unlock:
3250         hci_dev_unlock(hdev);
3251 }
3252
3253 static inline void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
3254 {
3255         struct hci_ev_le_conn_complete *ev = (void *) skb->data;
3256         struct hci_conn *conn;
3257
3258         BT_DBG("%s status %d", hdev->name, ev->status);
3259
3260         hci_dev_lock(hdev);
3261
3262         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &ev->bdaddr);
3263         if (!conn) {
3264                 conn = hci_conn_add(hdev, LE_LINK, &ev->bdaddr);
3265                 if (!conn) {
3266                         BT_ERR("No memory for new connection");
3267                         hci_dev_unlock(hdev);
3268                         return;
3269                 }
3270
3271                 conn->dst_type = ev->bdaddr_type;
3272         }
3273
3274         if (ev->status) {
3275                 mgmt_connect_failed(hdev, &ev->bdaddr, conn->type,
3276                                                 conn->dst_type, ev->status);
3277                 hci_proto_connect_cfm(conn, ev->status);
3278                 conn->state = BT_CLOSED;
3279                 hci_conn_del(conn);
3280                 goto unlock;
3281         }
3282
3283         if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
3284                 mgmt_device_connected(hdev, &ev->bdaddr, conn->type,
3285                                                 conn->dst_type, 0, NULL, 0, 0);
3286
3287         conn->sec_level = BT_SECURITY_LOW;
3288         conn->handle = __le16_to_cpu(ev->handle);
3289         conn->state = BT_CONNECTED;
3290
3291         hci_conn_hold_device(conn);
3292         hci_conn_add_sysfs(conn);
3293
3294         hci_proto_connect_cfm(conn, ev->status);
3295
3296 unlock:
3297         hci_dev_unlock(hdev);
3298 }
3299
3300 static inline void hci_le_adv_report_evt(struct hci_dev *hdev,
3301                                                 struct sk_buff *skb)
3302 {
3303         u8 num_reports = skb->data[0];
3304         void *ptr = &skb->data[1];
3305         s8 rssi;
3306
3307         hci_dev_lock(hdev);
3308
3309         while (num_reports--) {
3310                 struct hci_ev_le_advertising_info *ev = ptr;
3311
3312                 hci_add_adv_entry(hdev, ev);
3313
3314                 rssi = ev->data[ev->length];
3315                 mgmt_device_found(hdev, &ev->bdaddr, LE_LINK, ev->bdaddr_type,
3316                                         NULL, rssi, 0, 1, ev->data,
3317                                         ev->length);
3318
3319                 ptr += sizeof(*ev) + ev->length + 1;
3320         }
3321
3322         hci_dev_unlock(hdev);
3323 }
3324
3325 static inline void hci_le_ltk_request_evt(struct hci_dev *hdev,
3326                                                 struct sk_buff *skb)
3327 {
3328         struct hci_ev_le_ltk_req *ev = (void *) skb->data;
3329         struct hci_cp_le_ltk_reply cp;
3330         struct hci_cp_le_ltk_neg_reply neg;
3331         struct hci_conn *conn;
3332         struct smp_ltk *ltk;
3333
3334         BT_DBG("%s handle %d", hdev->name, cpu_to_le16(ev->handle));
3335
3336         hci_dev_lock(hdev);
3337
3338         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3339         if (conn == NULL)
3340                 goto not_found;
3341
3342         ltk = hci_find_ltk(hdev, ev->ediv, ev->random);
3343         if (ltk == NULL)
3344                 goto not_found;
3345
3346         memcpy(cp.ltk, ltk->val, sizeof(ltk->val));
3347         cp.handle = cpu_to_le16(conn->handle);
3348
3349         if (ltk->authenticated)
3350                 conn->sec_level = BT_SECURITY_HIGH;
3351
3352         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
3353
3354         if (ltk->type & HCI_SMP_STK) {
3355                 list_del(&ltk->list);
3356                 kfree(ltk);
3357         }
3358
3359         hci_dev_unlock(hdev);
3360
3361         return;
3362
3363 not_found:
3364         neg.handle = ev->handle;
3365         hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
3366         hci_dev_unlock(hdev);
3367 }
3368
3369 static inline void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
3370 {
3371         struct hci_ev_le_meta *le_ev = (void *) skb->data;
3372
3373         skb_pull(skb, sizeof(*le_ev));
3374
3375         switch (le_ev->subevent) {
3376         case HCI_EV_LE_CONN_COMPLETE:
3377                 hci_le_conn_complete_evt(hdev, skb);
3378                 break;
3379
3380         case HCI_EV_LE_ADVERTISING_REPORT:
3381                 hci_le_adv_report_evt(hdev, skb);
3382                 break;
3383
3384         case HCI_EV_LE_LTK_REQ:
3385                 hci_le_ltk_request_evt(hdev, skb);
3386                 break;
3387
3388         default:
3389                 break;
3390         }
3391 }
3392
3393 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
3394 {
3395         struct hci_event_hdr *hdr = (void *) skb->data;
3396         __u8 event = hdr->evt;
3397
3398         skb_pull(skb, HCI_EVENT_HDR_SIZE);
3399
3400         switch (event) {
3401         case HCI_EV_INQUIRY_COMPLETE:
3402                 hci_inquiry_complete_evt(hdev, skb);
3403                 break;
3404
3405         case HCI_EV_INQUIRY_RESULT:
3406                 hci_inquiry_result_evt(hdev, skb);
3407                 break;
3408
3409         case HCI_EV_CONN_COMPLETE:
3410                 hci_conn_complete_evt(hdev, skb);
3411                 break;
3412
3413         case HCI_EV_CONN_REQUEST:
3414                 hci_conn_request_evt(hdev, skb);
3415                 break;
3416
3417         case HCI_EV_DISCONN_COMPLETE:
3418                 hci_disconn_complete_evt(hdev, skb);
3419                 break;
3420
3421         case HCI_EV_AUTH_COMPLETE:
3422                 hci_auth_complete_evt(hdev, skb);
3423                 break;
3424
3425         case HCI_EV_REMOTE_NAME:
3426                 hci_remote_name_evt(hdev, skb);
3427                 break;
3428
3429         case HCI_EV_ENCRYPT_CHANGE:
3430                 hci_encrypt_change_evt(hdev, skb);
3431                 break;
3432
3433         case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
3434                 hci_change_link_key_complete_evt(hdev, skb);
3435                 break;
3436
3437         case HCI_EV_REMOTE_FEATURES:
3438                 hci_remote_features_evt(hdev, skb);
3439                 break;
3440
3441         case HCI_EV_REMOTE_VERSION:
3442                 hci_remote_version_evt(hdev, skb);
3443                 break;
3444
3445         case HCI_EV_QOS_SETUP_COMPLETE:
3446                 hci_qos_setup_complete_evt(hdev, skb);
3447                 break;
3448
3449         case HCI_EV_CMD_COMPLETE:
3450                 hci_cmd_complete_evt(hdev, skb);
3451                 break;
3452
3453         case HCI_EV_CMD_STATUS:
3454                 hci_cmd_status_evt(hdev, skb);
3455                 break;
3456
3457         case HCI_EV_ROLE_CHANGE:
3458                 hci_role_change_evt(hdev, skb);
3459                 break;
3460
3461         case HCI_EV_NUM_COMP_PKTS:
3462                 hci_num_comp_pkts_evt(hdev, skb);
3463                 break;
3464
3465         case HCI_EV_MODE_CHANGE:
3466                 hci_mode_change_evt(hdev, skb);
3467                 break;
3468
3469         case HCI_EV_PIN_CODE_REQ:
3470                 hci_pin_code_request_evt(hdev, skb);
3471                 break;
3472
3473         case HCI_EV_LINK_KEY_REQ:
3474                 hci_link_key_request_evt(hdev, skb);
3475                 break;
3476
3477         case HCI_EV_LINK_KEY_NOTIFY:
3478                 hci_link_key_notify_evt(hdev, skb);
3479                 break;
3480
3481         case HCI_EV_CLOCK_OFFSET:
3482                 hci_clock_offset_evt(hdev, skb);
3483                 break;
3484
3485         case HCI_EV_PKT_TYPE_CHANGE:
3486                 hci_pkt_type_change_evt(hdev, skb);
3487                 break;
3488
3489         case HCI_EV_PSCAN_REP_MODE:
3490                 hci_pscan_rep_mode_evt(hdev, skb);
3491                 break;
3492
3493         case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
3494                 hci_inquiry_result_with_rssi_evt(hdev, skb);
3495                 break;
3496
3497         case HCI_EV_REMOTE_EXT_FEATURES:
3498                 hci_remote_ext_features_evt(hdev, skb);
3499                 break;
3500
3501         case HCI_EV_SYNC_CONN_COMPLETE:
3502                 hci_sync_conn_complete_evt(hdev, skb);
3503                 break;
3504
3505         case HCI_EV_SYNC_CONN_CHANGED:
3506                 hci_sync_conn_changed_evt(hdev, skb);
3507                 break;
3508
3509         case HCI_EV_SNIFF_SUBRATE:
3510                 hci_sniff_subrate_evt(hdev, skb);
3511                 break;
3512
3513         case HCI_EV_EXTENDED_INQUIRY_RESULT:
3514                 hci_extended_inquiry_result_evt(hdev, skb);
3515                 break;
3516
3517         case HCI_EV_IO_CAPA_REQUEST:
3518                 hci_io_capa_request_evt(hdev, skb);
3519                 break;
3520
3521         case HCI_EV_IO_CAPA_REPLY:
3522                 hci_io_capa_reply_evt(hdev, skb);
3523                 break;
3524
3525         case HCI_EV_USER_CONFIRM_REQUEST:
3526                 hci_user_confirm_request_evt(hdev, skb);
3527                 break;
3528
3529         case HCI_EV_USER_PASSKEY_REQUEST:
3530                 hci_user_passkey_request_evt(hdev, skb);
3531                 break;
3532
3533         case HCI_EV_SIMPLE_PAIR_COMPLETE:
3534                 hci_simple_pair_complete_evt(hdev, skb);
3535                 break;
3536
3537         case HCI_EV_REMOTE_HOST_FEATURES:
3538                 hci_remote_host_features_evt(hdev, skb);
3539                 break;
3540
3541         case HCI_EV_LE_META:
3542                 hci_le_meta_evt(hdev, skb);
3543                 break;
3544
3545         case HCI_EV_REMOTE_OOB_DATA_REQUEST:
3546                 hci_remote_oob_data_request_evt(hdev, skb);
3547                 break;
3548
3549         case HCI_EV_NUM_COMP_BLOCKS:
3550                 hci_num_comp_blocks_evt(hdev, skb);
3551                 break;
3552
3553         default:
3554                 BT_DBG("%s event 0x%x", hdev->name, event);
3555                 break;
3556         }
3557
3558         kfree_skb(skb);
3559         hdev->stat.evt_rx++;
3560 }