net/bluetooth/hci_event.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI event handling. */
  26
  27 #include <linux/module.h>
  28
  29 #include <linux/types.h>
  30 #include <linux/errno.h>
  31 #include <linux/kernel.h>
  32 #include <linux/slab.h>
  33 #include <linux/poll.h>
  34 #include <linux/fcntl.h>
  35 #include <linux/init.h>
  36 #include <linux/skbuff.h>
  37 #include <linux/interrupt.h>
  38 #include <linux/notifier.h>
  39 #include <net/sock.h>
  40
  41 #include <asm/system.h>
  42 #include <linux/uaccess.h>
  43 #include <asm/unaligned.h>
  44
  45 #include <net/bluetooth/bluetooth.h>
  46 #include <net/bluetooth/hci_core.h>
  47
  48 static int enable_le;
  49
  50 /* Handle HCI Event packets */
  51
  52 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
  53 {
  54         __u8 status = *((__u8 *) skb->data);
  55
  56         BT_DBG("%s status 0x%x", hdev->name, status);
  57
  58         if (status)
  59                 return;
  60
  61         if (test_and_clear_bit(HCI_INQUIRY, &hdev->flags) &&
  62                         test_bit(HCI_MGMT, &hdev->flags))
  63                 mgmt_discovering(hdev->id, 0);
  64
  65         hci_req_complete(hdev, HCI_OP_INQUIRY_CANCEL, status);
  66
  67         hci_conn_check_pending(hdev);
  68 }
  69
  70 static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  71 {
  72         __u8 status = *((__u8 *) skb->data);
  73
  74         BT_DBG("%s status 0x%x", hdev->name, status);
  75
  76         if (status)
  77                 return;
  78
  79         if (test_and_clear_bit(HCI_INQUIRY, &hdev->flags) &&
  80                                 test_bit(HCI_MGMT, &hdev->flags))
  81                 mgmt_discovering(hdev->id, 0);
  82
  83         hci_conn_check_pending(hdev);
  84 }
  85
  86 static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev, struct sk_buff *skb)
  87 {
  88         BT_DBG("%s", hdev->name);
  89 }
  90
  91 static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
  92 {
  93         struct hci_rp_role_discovery *rp = (void *) skb->data;
  94         struct hci_conn *conn;
  95
  96         BT_DBG("%s status 0x%x", hdev->name, rp->status);
  97
  98         if (rp->status)
  99                 return;
 100
 101         hci_dev_lock(hdev);
 102
 103         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 104         if (conn) {
 105                 if (rp->role)
 106                         conn->link_mode &= ~HCI_LM_MASTER;
 107                 else
 108                         conn->link_mode |= HCI_LM_MASTER;
 109         }
 110
 111         hci_dev_unlock(hdev);
 112 }
 113
 114 static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 115 {
 116         struct hci_rp_read_link_policy *rp = (void *) skb->data;
 117         struct hci_conn *conn;
 118
 119         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 120
 121         if (rp->status)
 122                 return;
 123
 124         hci_dev_lock(hdev);
 125
 126         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 127         if (conn)
 128                 conn->link_policy = __le16_to_cpu(rp->policy);
 129
 130         hci_dev_unlock(hdev);
 131 }
 132
 133 static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 134 {
 135         struct hci_rp_write_link_policy *rp = (void *) skb->data;
 136         struct hci_conn *conn;
 137         void *sent;
 138
 139         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 140
 141         if (rp->status)
 142                 return;
 143
 144         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
 145         if (!sent)
 146                 return;
 147
 148         hci_dev_lock(hdev);
 149
 150         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 151         if (conn)
 152                 conn->link_policy = get_unaligned_le16(sent + 2);
 153
 154         hci_dev_unlock(hdev);
 155 }
 156
 157 static void hci_cc_read_def_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 158 {
 159         struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
 160
 161         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 162
 163         if (rp->status)
 164                 return;
 165
 166         hdev->link_policy = __le16_to_cpu(rp->policy);
 167 }
 168
 169 static void hci_cc_write_def_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 170 {
 171         __u8 status = *((__u8 *) skb->data);
 172         void *sent;
 173
 174         BT_DBG("%s status 0x%x", hdev->name, status);
 175
 176         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
 177         if (!sent)
 178                 return;
 179
 180         if (!status)
 181                 hdev->link_policy = get_unaligned_le16(sent);
 182
 183         hci_req_complete(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, status);
 184 }
 185
 186 static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
 187 {
 188         __u8 status = *((__u8 *) skb->data);
 189
 190         BT_DBG("%s status 0x%x", hdev->name, status);
 191
 192         clear_bit(HCI_RESET, &hdev->flags);
 193
 194         hci_req_complete(hdev, HCI_OP_RESET, status);
 195 }
 196
 197 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 198 {
 199         __u8 status = *((__u8 *) skb->data);
 200         void *sent;
 201
 202         BT_DBG("%s status 0x%x", hdev->name, status);
 203
 204         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
 205         if (!sent)
 206                 return;
 207
 208         if (test_bit(HCI_MGMT, &hdev->flags))
 209                 mgmt_set_local_name_complete(hdev->id, sent, status);
 210
 211         if (status)
 212                 return;
 213
 214         memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
 215 }
 216
 217 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 218 {
 219         struct hci_rp_read_local_name *rp = (void *) skb->data;
 220
 221         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 222
 223         if (rp->status)
 224                 return;
 225
 226         memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
 227 }
 228
 229 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
 230 {
 231         __u8 status = *((__u8 *) skb->data);
 232         void *sent;
 233
 234         BT_DBG("%s status 0x%x", hdev->name, status);
 235
 236         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
 237         if (!sent)
 238                 return;
 239
 240         if (!status) {
 241                 __u8 param = *((__u8 *) sent);
 242
 243                 if (param == AUTH_ENABLED)
 244                         set_bit(HCI_AUTH, &hdev->flags);
 245                 else
 246                         clear_bit(HCI_AUTH, &hdev->flags);
 247         }
 248
 249         hci_req_complete(hdev, HCI_OP_WRITE_AUTH_ENABLE, status);
 250 }
 251
 252 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
 253 {
 254         __u8 status = *((__u8 *) skb->data);
 255         void *sent;
 256
 257         BT_DBG("%s status 0x%x", hdev->name, status);
 258
 259         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
 260         if (!sent)
 261                 return;
 262
 263         if (!status) {
 264                 __u8 param = *((__u8 *) sent);
 265
 266                 if (param)
 267                         set_bit(HCI_ENCRYPT, &hdev->flags);
 268                 else
 269                         clear_bit(HCI_ENCRYPT, &hdev->flags);
 270         }
 271
 272         hci_req_complete(hdev, HCI_OP_WRITE_ENCRYPT_MODE, status);
 273 }
 274
 275 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
 276 {
 277         __u8 status = *((__u8 *) skb->data);
 278         void *sent;
 279
 280         BT_DBG("%s status 0x%x", hdev->name, status);
 281
 282         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
 283         if (!sent)
 284                 return;
 285
 286         if (!status) {
 287                 __u8 param = *((__u8 *) sent);
 288                 int old_pscan, old_iscan;
 289
 290                 old_pscan = test_and_clear_bit(HCI_PSCAN, &hdev->flags);
 291                 old_iscan = test_and_clear_bit(HCI_ISCAN, &hdev->flags);
 292
 293                 if (param & SCAN_INQUIRY) {
 294                         set_bit(HCI_ISCAN, &hdev->flags);
 295                         if (!old_iscan)
 296                                 mgmt_discoverable(hdev->id, 1);
 297                 } else if (old_iscan)
 298                         mgmt_discoverable(hdev->id, 0);
 299
 300                 if (param & SCAN_PAGE) {
 301                         set_bit(HCI_PSCAN, &hdev->flags);
 302                         if (!old_pscan)
 303                                 mgmt_connectable(hdev->id, 1);
 304                 } else if (old_pscan)
 305                         mgmt_connectable(hdev->id, 0);
 306         }
 307
 308         hci_req_complete(hdev, HCI_OP_WRITE_SCAN_ENABLE, status);
 309 }
 310
 311 static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 312 {
 313         struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
 314
 315         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 316
 317         if (rp->status)
 318                 return;
 319
 320         memcpy(hdev->dev_class, rp->dev_class, 3);
 321
 322         BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
 323                 hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
 324 }
 325
 326 static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 327 {
 328         __u8 status = *((__u8 *) skb->data);
 329         void *sent;
 330
 331         BT_DBG("%s status 0x%x", hdev->name, status);
 332
 333         if (status)
 334                 return;
 335
 336         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
 337         if (!sent)
 338                 return;
 339
 340         memcpy(hdev->dev_class, sent, 3);
 341 }
 342
 343 static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 344 {
 345         struct hci_rp_read_voice_setting *rp = (void *) skb->data;
 346         __u16 setting;
 347
 348         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 349
 350         if (rp->status)
 351                 return;
 352
 353         setting = __le16_to_cpu(rp->voice_setting);
 354
 355         if (hdev->voice_setting == setting)
 356                 return;
 357
 358         hdev->voice_setting = setting;
 359
 360         BT_DBG("%s voice setting 0x%04x", hdev->name, setting);
 361
 362         if (hdev->notify) {
 363                 tasklet_disable(&hdev->tx_task);
 364                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 365                 tasklet_enable(&hdev->tx_task);
 366         }
 367 }
 368
 369 static void hci_cc_write_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 370 {
 371         __u8 status = *((__u8 *) skb->data);
 372         __u16 setting;
 373         void *sent;
 374
 375         BT_DBG("%s status 0x%x", hdev->name, status);
 376
 377         if (status)
 378                 return;
 379
 380         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
 381         if (!sent)
 382                 return;
 383
 384         setting = get_unaligned_le16(sent);
 385
 386         if (hdev->voice_setting == setting)
 387                 return;
 388
 389         hdev->voice_setting = setting;
 390
 391         BT_DBG("%s voice setting 0x%04x", hdev->name, setting);
 392
 393         if (hdev->notify) {
 394                 tasklet_disable(&hdev->tx_task);
 395                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 396                 tasklet_enable(&hdev->tx_task);
 397         }
 398 }
 399
 400 static void hci_cc_host_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 401 {
 402         __u8 status = *((__u8 *) skb->data);
 403
 404         BT_DBG("%s status 0x%x", hdev->name, status);
 405
 406         hci_req_complete(hdev, HCI_OP_HOST_BUFFER_SIZE, status);
 407 }
 408
 409 static void hci_cc_read_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 410 {
 411         struct hci_rp_read_ssp_mode *rp = (void *) skb->data;
 412
 413         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 414
 415         if (rp->status)
 416                 return;
 417
 418         hdev->ssp_mode = rp->mode;
 419 }
 420
 421 static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 422 {
 423         __u8 status = *((__u8 *) skb->data);
 424         void *sent;
 425
 426         BT_DBG("%s status 0x%x", hdev->name, status);
 427
 428         if (status)
 429                 return;
 430
 431         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
 432         if (!sent)
 433                 return;
 434
 435         hdev->ssp_mode = *((__u8 *) sent);
 436 }
 437
 438 static u8 hci_get_inquiry_mode(struct hci_dev *hdev)
 439 {
 440         if (hdev->features[6] & LMP_EXT_INQ)
 441                 return 2;
 442
 443         if (hdev->features[3] & LMP_RSSI_INQ)
 444                 return 1;
 445
 446         if (hdev->manufacturer == 11 && hdev->hci_rev == 0x00 &&
 447                                                 hdev->lmp_subver == 0x0757)
 448                 return 1;
 449
 450         if (hdev->manufacturer == 15) {
 451                 if (hdev->hci_rev == 0x03 && hdev->lmp_subver == 0x6963)
 452                         return 1;
 453                 if (hdev->hci_rev == 0x09 && hdev->lmp_subver == 0x6963)
 454                         return 1;
 455                 if (hdev->hci_rev == 0x00 && hdev->lmp_subver == 0x6965)
 456                         return 1;
 457         }
 458
 459         if (hdev->manufacturer == 31 && hdev->hci_rev == 0x2005 &&
 460                                                 hdev->lmp_subver == 0x1805)
 461                 return 1;
 462
 463         return 0;
 464 }
 465
 466 static void hci_setup_inquiry_mode(struct hci_dev *hdev)
 467 {
 468         u8 mode;
 469
 470         mode = hci_get_inquiry_mode(hdev);
 471
 472         hci_send_cmd(hdev, HCI_OP_WRITE_INQUIRY_MODE, 1, &mode);
 473 }
 474
 475 static void hci_setup_event_mask(struct hci_dev *hdev)
 476 {
 477         /* The second byte is 0xff instead of 0x9f (two reserved bits
 478          * disabled) since a Broadcom 1.2 dongle doesn't respond to the
 479          * command otherwise */
 480         u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };
 481
 482         /* CSR 1.1 dongles does not accept any bitfield so don't try to set
 483          * any event mask for pre 1.2 devices */
 484         if (hdev->lmp_ver <= 1)
 485                 return;
 486
 487         events[4] |= 0x01; /* Flow Specification Complete */
 488         events[4] |= 0x02; /* Inquiry Result with RSSI */
 489         events[4] |= 0x04; /* Read Remote Extended Features Complete */
 490         events[5] |= 0x08; /* Synchronous Connection Complete */
 491         events[5] |= 0x10; /* Synchronous Connection Changed */
 492
 493         if (hdev->features[3] & LMP_RSSI_INQ)
 494                 events[4] |= 0x04; /* Inquiry Result with RSSI */
 495
 496         if (hdev->features[5] & LMP_SNIFF_SUBR)
 497                 events[5] |= 0x20; /* Sniff Subrating */
 498
 499         if (hdev->features[5] & LMP_PAUSE_ENC)
 500                 events[5] |= 0x80; /* Encryption Key Refresh Complete */
 501
 502         if (hdev->features[6] & LMP_EXT_INQ)
 503                 events[5] |= 0x40; /* Extended Inquiry Result */
 504
 505         if (hdev->features[6] & LMP_NO_FLUSH)
 506                 events[7] |= 0x01; /* Enhanced Flush Complete */
 507
 508         if (hdev->features[7] & LMP_LSTO)
 509                 events[6] |= 0x80; /* Link Supervision Timeout Changed */
 510
 511         if (hdev->features[6] & LMP_SIMPLE_PAIR) {
 512                 events[6] |= 0x01;      /* IO Capability Request */
 513                 events[6] |= 0x02;      /* IO Capability Response */
 514                 events[6] |= 0x04;      /* User Confirmation Request */
 515                 events[6] |= 0x08;      /* User Passkey Request */
 516                 events[6] |= 0x10;      /* Remote OOB Data Request */
 517                 events[6] |= 0x20;      /* Simple Pairing Complete */
 518                 events[7] |= 0x04;      /* User Passkey Notification */
 519                 events[7] |= 0x08;      /* Keypress Notification */
 520                 events[7] |= 0x10;      /* Remote Host Supported
 521                                          * Features Notification */
 522         }
 523
 524         if (hdev->features[4] & LMP_LE)
 525                 events[7] |= 0x20;      /* LE Meta-Event */
 526
 527         hci_send_cmd(hdev, HCI_OP_SET_EVENT_MASK, sizeof(events), events);
 528 }
 529
 530 static void hci_set_le_support(struct hci_dev *hdev)
 531 {
 532         struct hci_cp_write_le_host_supported cp;
 533
 534         memset(&cp, 0, sizeof(cp));
 535
 536         if (enable_le) {
 537                 cp.le = 1;
 538                 cp.simul = !!(hdev->features[6] & LMP_SIMUL_LE_BR);
 539         }
 540
 541         hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(cp), &cp);
 542 }
 543
 544 static void hci_setup(struct hci_dev *hdev)
 545 {
 546         hci_setup_event_mask(hdev);
 547
 548         if (hdev->hci_ver > 1)
 549                 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
 550
 551         if (hdev->features[6] & LMP_SIMPLE_PAIR) {
 552                 u8 mode = 0x01;
 553                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(mode), &mode);
 554         }
 555
 556         if (hdev->features[3] & LMP_RSSI_INQ)
 557                 hci_setup_inquiry_mode(hdev);
 558
 559         if (hdev->features[7] & LMP_INQ_TX_PWR)
 560                 hci_send_cmd(hdev, HCI_OP_READ_INQ_RSP_TX_POWER, 0, NULL);
 561
 562         if (hdev->features[7] & LMP_EXTFEATURES) {
 563                 struct hci_cp_read_local_ext_features cp;
 564
 565                 cp.page = 0x01;
 566                 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES,
 567                                                         sizeof(cp), &cp);
 568         }
 569
 570         if (hdev->features[4] & LMP_LE)
 571                 hci_set_le_support(hdev);
 572 }
 573
 574 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
 575 {
 576         struct hci_rp_read_local_version *rp = (void *) skb->data;
 577
 578         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 579
 580         if (rp->status)
 581                 return;
 582
 583         hdev->hci_ver = rp->hci_ver;
 584         hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
 585         hdev->lmp_ver = rp->lmp_ver;
 586         hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
 587         hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
 588
 589         BT_DBG("%s manufacturer %d hci ver %d:%d", hdev->name,
 590                                         hdev->manufacturer,
 591                                         hdev->hci_ver, hdev->hci_rev);
 592
 593         if (test_bit(HCI_INIT, &hdev->flags))
 594                 hci_setup(hdev);
 595 }
 596
 597 static void hci_setup_link_policy(struct hci_dev *hdev)
 598 {
 599         u16 link_policy = 0;
 600
 601         if (hdev->features[0] & LMP_RSWITCH)
 602                 link_policy |= HCI_LP_RSWITCH;
 603         if (hdev->features[0] & LMP_HOLD)
 604                 link_policy |= HCI_LP_HOLD;
 605         if (hdev->features[0] & LMP_SNIFF)
 606                 link_policy |= HCI_LP_SNIFF;
 607         if (hdev->features[1] & LMP_PARK)
 608                 link_policy |= HCI_LP_PARK;
 609
 610         link_policy = cpu_to_le16(link_policy);
 611         hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY,
 612                                         sizeof(link_policy), &link_policy);
 613 }
 614
 615 static void hci_cc_read_local_commands(struct hci_dev *hdev, struct sk_buff *skb)
 616 {
 617         struct hci_rp_read_local_commands *rp = (void *) skb->data;
 618
 619         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 620
 621         if (rp->status)
 622                 goto done;
 623
 624         memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 625
 626         if (test_bit(HCI_INIT, &hdev->flags) && (hdev->commands[5] & 0x10))
 627                 hci_setup_link_policy(hdev);
 628
 629 done:
 630         hci_req_complete(hdev, HCI_OP_READ_LOCAL_COMMANDS, rp->status);
 631 }
 632
 633 static void hci_cc_read_local_features(struct hci_dev *hdev, struct sk_buff *skb)
 634 {
 635         struct hci_rp_read_local_features *rp = (void *) skb->data;
 636
 637         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 638
 639         if (rp->status)
 640                 return;
 641
 642         memcpy(hdev->features, rp->features, 8);
 643
 644         /* Adjust default settings according to features
 645          * supported by device. */
 646
 647         if (hdev->features[0] & LMP_3SLOT)
 648                 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 649
 650         if (hdev->features[0] & LMP_5SLOT)
 651                 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 652
 653         if (hdev->features[1] & LMP_HV2) {
 654                 hdev->pkt_type  |= (HCI_HV2);
 655                 hdev->esco_type |= (ESCO_HV2);
 656         }
 657
 658         if (hdev->features[1] & LMP_HV3) {
 659                 hdev->pkt_type  |= (HCI_HV3);
 660                 hdev->esco_type |= (ESCO_HV3);
 661         }
 662
 663         if (hdev->features[3] & LMP_ESCO)
 664                 hdev->esco_type |= (ESCO_EV3);
 665
 666         if (hdev->features[4] & LMP_EV4)
 667                 hdev->esco_type |= (ESCO_EV4);
 668
 669         if (hdev->features[4] & LMP_EV5)
 670                 hdev->esco_type |= (ESCO_EV5);
 671
 672         if (hdev->features[5] & LMP_EDR_ESCO_2M)
 673                 hdev->esco_type |= (ESCO_2EV3);
 674
 675         if (hdev->features[5] & LMP_EDR_ESCO_3M)
 676                 hdev->esco_type |= (ESCO_3EV3);
 677
 678         if (hdev->features[5] & LMP_EDR_3S_ESCO)
 679                 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
 680
 681         BT_DBG("%s features 0x%.2x%.2x%.2x%.2x%.2x%.2x%.2x%.2x", hdev->name,
 682                                         hdev->features[0], hdev->features[1],
 683                                         hdev->features[2], hdev->features[3],
 684                                         hdev->features[4], hdev->features[5],
 685                                         hdev->features[6], hdev->features[7]);
 686 }
 687
 688 static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
 689                                                         struct sk_buff *skb)
 690 {
 691         struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
 692
 693         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 694
 695         if (rp->status)
 696                 return;
 697
 698         memcpy(hdev->extfeatures, rp->features, 8);
 699
 700         hci_req_complete(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES, rp->status);
 701 }
 702
 703 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 704 {
 705         struct hci_rp_read_buffer_size *rp = (void *) skb->data;
 706
 707         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 708
 709         if (rp->status)
 710                 return;
 711
 712         hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
 713         hdev->sco_mtu  = rp->sco_mtu;
 714         hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
 715         hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
 716
 717         if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
 718                 hdev->sco_mtu  = 64;
 719                 hdev->sco_pkts = 8;
 720         }
 721
 722         hdev->acl_cnt = hdev->acl_pkts;
 723         hdev->sco_cnt = hdev->sco_pkts;
 724
 725         BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name,
 726                                         hdev->acl_mtu, hdev->acl_pkts,
 727                                         hdev->sco_mtu, hdev->sco_pkts);
 728 }
 729
 730 static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
 731 {
 732         struct hci_rp_read_bd_addr *rp = (void *) skb->data;
 733
 734         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 735
 736         if (!rp->status)
 737                 bacpy(&hdev->bdaddr, &rp->bdaddr);
 738
 739         hci_req_complete(hdev, HCI_OP_READ_BD_ADDR, rp->status);
 740 }
 741
 742 static void hci_cc_write_ca_timeout(struct hci_dev *hdev, struct sk_buff *skb)
 743 {
 744         __u8 status = *((__u8 *) skb->data);
 745
 746         BT_DBG("%s status 0x%x", hdev->name, status);
 747
 748         hci_req_complete(hdev, HCI_OP_WRITE_CA_TIMEOUT, status);
 749 }
 750
 751 static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
 752                                                         struct sk_buff *skb)
 753 {
 754         __u8 status = *((__u8 *) skb->data);
 755
 756         BT_DBG("%s status 0x%x", hdev->name, status);
 757
 758         hci_req_complete(hdev, HCI_OP_DELETE_STORED_LINK_KEY, status);
 759 }
 760
 761 static void hci_cc_set_event_mask(struct hci_dev *hdev, struct sk_buff *skb)
 762 {
 763         __u8 status = *((__u8 *) skb->data);
 764
 765         BT_DBG("%s status 0x%x", hdev->name, status);
 766
 767         hci_req_complete(hdev, HCI_OP_SET_EVENT_MASK, status);
 768 }
 769
 770 static void hci_cc_write_inquiry_mode(struct hci_dev *hdev,
 771                                                         struct sk_buff *skb)
 772 {
 773         __u8 status = *((__u8 *) skb->data);
 774
 775         BT_DBG("%s status 0x%x", hdev->name, status);
 776
 777         hci_req_complete(hdev, HCI_OP_WRITE_INQUIRY_MODE, status);
 778 }
 779
 780 static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
 781                                                         struct sk_buff *skb)
 782 {
 783         __u8 status = *((__u8 *) skb->data);
 784
 785         BT_DBG("%s status 0x%x", hdev->name, status);
 786
 787         hci_req_complete(hdev, HCI_OP_READ_INQ_RSP_TX_POWER, status);
 788 }
 789
 790 static void hci_cc_set_event_flt(struct hci_dev *hdev, struct sk_buff *skb)
 791 {
 792         __u8 status = *((__u8 *) skb->data);
 793
 794         BT_DBG("%s status 0x%x", hdev->name, status);
 795
 796         hci_req_complete(hdev, HCI_OP_SET_EVENT_FLT, status);
 797 }
 798
 799 static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
 800 {
 801         struct hci_rp_pin_code_reply *rp = (void *) skb->data;
 802         struct hci_cp_pin_code_reply *cp;
 803         struct hci_conn *conn;
 804
 805         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 806
 807         if (test_bit(HCI_MGMT, &hdev->flags))
 808                 mgmt_pin_code_reply_complete(hdev->id, &rp->bdaddr, rp->status);
 809
 810         if (rp->status != 0)
 811                 return;
 812
 813         cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
 814         if (!cp)
 815                 return;
 816
 817         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 818         if (conn)
 819                 conn->pin_length = cp->pin_len;
 820 }
 821
 822 static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
 823 {
 824         struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
 825
 826         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 827
 828         if (test_bit(HCI_MGMT, &hdev->flags))
 829                 mgmt_pin_code_neg_reply_complete(hdev->id, &rp->bdaddr,
 830                                                                 rp->status);
 831 }
 832 static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
 833                                        struct sk_buff *skb)
 834 {
 835         struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
 836
 837         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 838
 839         if (rp->status)
 840                 return;
 841
 842         hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
 843         hdev->le_pkts = rp->le_max_pkt;
 844
 845         hdev->le_cnt = hdev->le_pkts;
 846
 847         BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
 848
 849         hci_req_complete(hdev, HCI_OP_LE_READ_BUFFER_SIZE, rp->status);
 850 }
 851
 852 static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
 853 {
 854         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 855
 856         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 857
 858         if (test_bit(HCI_MGMT, &hdev->flags))
 859                 mgmt_user_confirm_reply_complete(hdev->id, &rp->bdaddr,
 860                                                                 rp->status);
 861 }
 862
 863 static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
 864                                                         struct sk_buff *skb)
 865 {
 866         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 867
 868         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 869
 870         if (test_bit(HCI_MGMT, &hdev->flags))
 871                 mgmt_user_confirm_neg_reply_complete(hdev->id, &rp->bdaddr,
 872                                                                 rp->status);
 873 }
 874
 875 static void hci_cc_read_local_oob_data_reply(struct hci_dev *hdev,
 876                                                         struct sk_buff *skb)
 877 {
 878         struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
 879
 880         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 881
 882         mgmt_read_local_oob_data_reply_complete(hdev->id, rp->hash,
 883                                                 rp->randomizer, rp->status);
 884 }
 885
 886 static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
 887                                         struct sk_buff *skb)
 888 {
 889         struct hci_cp_le_set_scan_enable *cp;
 890         __u8 status = *((__u8 *) skb->data);
 891
 892         BT_DBG("%s status 0x%x", hdev->name, status);
 893
 894         if (status)
 895                 return;
 896
 897         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
 898         if (!cp)
 899                 return;
 900
 901         if (cp->enable == 0x01) {
 902                 del_timer(&hdev->adv_timer);
 903
 904                 hci_dev_lock(hdev);
 905                 hci_adv_entries_clear(hdev);
 906                 hci_dev_unlock(hdev);
 907         } else if (cp->enable == 0x00) {
 908                 mod_timer(&hdev->adv_timer, jiffies + ADV_CLEAR_TIMEOUT);
 909         }
 910 }
 911
 912 static void hci_cc_le_ltk_reply(struct hci_dev *hdev, struct sk_buff *skb)
 913 {
 914         struct hci_rp_le_ltk_reply *rp = (void *) skb->data;
 915
 916         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 917
 918         if (rp->status)
 919                 return;
 920
 921         hci_req_complete(hdev, HCI_OP_LE_LTK_REPLY, rp->status);
 922 }
 923
 924 static void hci_cc_le_ltk_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
 925 {
 926         struct hci_rp_le_ltk_neg_reply *rp = (void *) skb->data;
 927
 928         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 929
 930         if (rp->status)
 931                 return;
 932
 933         hci_req_complete(hdev, HCI_OP_LE_LTK_NEG_REPLY, rp->status);
 934 }
 935
 936 static inline void hci_cc_write_le_host_supported(struct hci_dev *hdev,
 937                                                         struct sk_buff *skb)
 938 {
 939         struct hci_cp_read_local_ext_features cp;
 940         __u8 status = *((__u8 *) skb->data);
 941
 942         BT_DBG("%s status 0x%x", hdev->name, status);
 943
 944         if (status)
 945                 return;
 946
 947         cp.page = 0x01;
 948         hci_send_cmd(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES, sizeof(cp), &cp);
 949 }
 950
 951 static inline void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
 952 {
 953         BT_DBG("%s status 0x%x", hdev->name, status);
 954
 955         if (status) {
 956                 hci_req_complete(hdev, HCI_OP_INQUIRY, status);
 957                 hci_conn_check_pending(hdev);
 958                 return;
 959         }
 960
 961         if (!test_and_set_bit(HCI_INQUIRY, &hdev->flags) &&
 962                                 test_bit(HCI_MGMT, &hdev->flags))
 963                 mgmt_discovering(hdev->id, 1);
 964 }
 965
 966 static inline void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
 967 {
 968         struct hci_cp_create_conn *cp;
 969         struct hci_conn *conn;
 970
 971         BT_DBG("%s status 0x%x", hdev->name, status);
 972
 973         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
 974         if (!cp)
 975                 return;
 976
 977         hci_dev_lock(hdev);
 978
 979         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 980
 981         BT_DBG("%s bdaddr %s conn %p", hdev->name, batostr(&cp->bdaddr), conn);
 982
 983         if (status) {
 984                 if (conn && conn->state == BT_CONNECT) {
 985                         if (status != 0x0c || conn->attempt > 2) {
 986                                 conn->state = BT_CLOSED;
 987                                 hci_proto_connect_cfm(conn, status);
 988                                 hci_conn_del(conn);
 989                         } else
 990                                 conn->state = BT_CONNECT2;
 991                 }
 992         } else {
 993                 if (!conn) {
 994                         conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr);
 995                         if (conn) {
 996                                 conn->out = 1;
 997                                 conn->link_mode |= HCI_LM_MASTER;
 998                         } else
 999                                 BT_ERR("No memory for new connection");
1000                 }
1001         }
1002
1003         hci_dev_unlock(hdev);
1004 }
1005
1006 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
1007 {
1008         struct hci_cp_add_sco *cp;
1009         struct hci_conn *acl, *sco;
1010         __u16 handle;
1011
1012         BT_DBG("%s status 0x%x", hdev->name, status);
1013
1014         if (!status)
1015                 return;
1016
1017         cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
1018         if (!cp)
1019                 return;
1020
1021         handle = __le16_to_cpu(cp->handle);
1022
1023         BT_DBG("%s handle %d", hdev->name, handle);
1024
1025         hci_dev_lock(hdev);
1026
1027         acl = hci_conn_hash_lookup_handle(hdev, handle);
1028         if (acl) {
1029                 sco = acl->link;
1030                 if (sco) {
1031                         sco->state = BT_CLOSED;
1032
1033                         hci_proto_connect_cfm(sco, status);
1034                         hci_conn_del(sco);
1035                 }
1036         }
1037
1038         hci_dev_unlock(hdev);
1039 }
1040
1041 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
1042 {
1043         struct hci_cp_auth_requested *cp;
1044         struct hci_conn *conn;
1045
1046         BT_DBG("%s status 0x%x", hdev->name, status);
1047
1048         if (!status)
1049                 return;
1050
1051         cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
1052         if (!cp)
1053                 return;
1054
1055         hci_dev_lock(hdev);
1056
1057         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1058         if (conn) {
1059                 if (conn->state == BT_CONFIG) {
1060                         hci_proto_connect_cfm(conn, status);
1061                         hci_conn_put(conn);
1062                 }
1063         }
1064
1065         hci_dev_unlock(hdev);
1066 }
1067
1068 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
1069 {
1070         struct hci_cp_set_conn_encrypt *cp;
1071         struct hci_conn *conn;
1072
1073         BT_DBG("%s status 0x%x", hdev->name, status);
1074
1075         if (!status)
1076                 return;
1077
1078         cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
1079         if (!cp)
1080                 return;
1081
1082         hci_dev_lock(hdev);
1083
1084         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1085         if (conn) {
1086                 if (conn->state == BT_CONFIG) {
1087                         hci_proto_connect_cfm(conn, status);
1088                         hci_conn_put(conn);
1089                 }
1090         }
1091
1092         hci_dev_unlock(hdev);
1093 }
1094
1095 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
1096                                                         struct hci_conn *conn)
1097 {
1098         if (conn->state != BT_CONFIG || !conn->out)
1099                 return 0;
1100
1101         if (conn->pending_sec_level == BT_SECURITY_SDP)
1102                 return 0;
1103
1104         /* Only request authentication for SSP connections or non-SSP
1105          * devices with sec_level HIGH or if MITM protection is requested */
1106         if (!(hdev->ssp_mode > 0 && conn->ssp_mode > 0) &&
1107                                 conn->pending_sec_level != BT_SECURITY_HIGH &&
1108                                 !(conn->auth_type & 0x01))
1109                 return 0;
1110
1111         return 1;
1112 }
1113
1114 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
1115 {
1116         struct hci_cp_remote_name_req *cp;
1117         struct hci_conn *conn;
1118
1119         BT_DBG("%s status 0x%x", hdev->name, status);
1120
1121         /* If successful wait for the name req complete event before
1122          * checking for the need to do authentication */
1123         if (!status)
1124                 return;
1125
1126         cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
1127         if (!cp)
1128                 return;
1129
1130         hci_dev_lock(hdev);
1131
1132         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1133         if (!conn)
1134                 goto unlock;
1135
1136         if (!hci_outgoing_auth_needed(hdev, conn))
1137                 goto unlock;
1138
1139         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
1140                 struct hci_cp_auth_requested cp;
1141                 cp.handle = __cpu_to_le16(conn->handle);
1142                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
1143         }
1144
1145 unlock:
1146         hci_dev_unlock(hdev);
1147 }
1148
1149 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
1150 {
1151         struct hci_cp_read_remote_features *cp;
1152         struct hci_conn *conn;
1153
1154         BT_DBG("%s status 0x%x", hdev->name, status);
1155
1156         if (!status)
1157                 return;
1158
1159         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
1160         if (!cp)
1161                 return;
1162
1163         hci_dev_lock(hdev);
1164
1165         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1166         if (conn) {
1167                 if (conn->state == BT_CONFIG) {
1168                         hci_proto_connect_cfm(conn, status);
1169                         hci_conn_put(conn);
1170                 }
1171         }
1172
1173         hci_dev_unlock(hdev);
1174 }
1175
1176 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
1177 {
1178         struct hci_cp_read_remote_ext_features *cp;
1179         struct hci_conn *conn;
1180
1181         BT_DBG("%s status 0x%x", hdev->name, status);
1182
1183         if (!status)
1184                 return;
1185
1186         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
1187         if (!cp)
1188                 return;
1189
1190         hci_dev_lock(hdev);
1191
1192         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1193         if (conn) {
1194                 if (conn->state == BT_CONFIG) {
1195                         hci_proto_connect_cfm(conn, status);
1196                         hci_conn_put(conn);
1197                 }
1198         }
1199
1200         hci_dev_unlock(hdev);
1201 }
1202
1203 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
1204 {
1205         struct hci_cp_setup_sync_conn *cp;
1206         struct hci_conn *acl, *sco;
1207         __u16 handle;
1208
1209         BT_DBG("%s status 0x%x", hdev->name, status);
1210
1211         if (!status)
1212                 return;
1213
1214         cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
1215         if (!cp)
1216                 return;
1217
1218         handle = __le16_to_cpu(cp->handle);
1219
1220         BT_DBG("%s handle %d", hdev->name, handle);
1221
1222         hci_dev_lock(hdev);
1223
1224         acl = hci_conn_hash_lookup_handle(hdev, handle);
1225         if (acl) {
1226                 sco = acl->link;
1227                 if (sco) {
1228                         sco->state = BT_CLOSED;
1229
1230                         hci_proto_connect_cfm(sco, status);
1231                         hci_conn_del(sco);
1232                 }
1233         }
1234
1235         hci_dev_unlock(hdev);
1236 }
1237
1238 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
1239 {
1240         struct hci_cp_sniff_mode *cp;
1241         struct hci_conn *conn;
1242
1243         BT_DBG("%s status 0x%x", hdev->name, status);
1244
1245         if (!status)
1246                 return;
1247
1248         cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
1249         if (!cp)
1250                 return;
1251
1252         hci_dev_lock(hdev);
1253
1254         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1255         if (conn) {
1256                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend);
1257
1258                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->pend))
1259                         hci_sco_setup(conn, status);
1260         }
1261
1262         hci_dev_unlock(hdev);
1263 }
1264
1265 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
1266 {
1267         struct hci_cp_exit_sniff_mode *cp;
1268         struct hci_conn *conn;
1269
1270         BT_DBG("%s status 0x%x", hdev->name, status);
1271
1272         if (!status)
1273                 return;
1274
1275         cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
1276         if (!cp)
1277                 return;
1278
1279         hci_dev_lock(hdev);
1280
1281         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1282         if (conn) {
1283                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend);
1284
1285                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->pend))
1286                         hci_sco_setup(conn, status);
1287         }
1288
1289         hci_dev_unlock(hdev);
1290 }
1291
1292 static void hci_cs_le_create_conn(struct hci_dev *hdev, __u8 status)
1293 {
1294         struct hci_cp_le_create_conn *cp;
1295         struct hci_conn *conn;
1296
1297         BT_DBG("%s status 0x%x", hdev->name, status);
1298
1299         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
1300         if (!cp)
1301                 return;
1302
1303         hci_dev_lock(hdev);
1304
1305         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->peer_addr);
1306
1307         BT_DBG("%s bdaddr %s conn %p", hdev->name, batostr(&cp->peer_addr),
1308                 conn);
1309
1310         if (status) {
1311                 if (conn && conn->state == BT_CONNECT) {
1312                         conn->state = BT_CLOSED;
1313                         hci_proto_connect_cfm(conn, status);
1314                         hci_conn_del(conn);
1315                 }
1316         } else {
1317                 if (!conn) {
1318                         conn = hci_conn_add(hdev, LE_LINK, &cp->peer_addr);
1319                         if (conn) {
1320                                 conn->dst_type = cp->peer_addr_type;
1321                                 conn->out = 1;
1322                         } else {
1323                                 BT_ERR("No memory for new connection");
1324                         }
1325                 }
1326         }
1327
1328         hci_dev_unlock(hdev);
1329 }
1330
1331 static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
1332 {
1333         BT_DBG("%s status 0x%x", hdev->name, status);
1334 }
1335
1336 static inline void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1337 {
1338         __u8 status = *((__u8 *) skb->data);
1339
1340         BT_DBG("%s status %d", hdev->name, status);
1341
1342         if (test_and_clear_bit(HCI_INQUIRY, &hdev->flags) &&
1343                                 test_bit(HCI_MGMT, &hdev->flags))
1344                 mgmt_discovering(hdev->id, 0);
1345
1346         hci_req_complete(hdev, HCI_OP_INQUIRY, status);
1347
1348         hci_conn_check_pending(hdev);
1349 }
1350
1351 static inline void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
1352 {
1353         struct inquiry_data data;
1354         struct inquiry_info *info = (void *) (skb->data + 1);
1355         int num_rsp = *((__u8 *) skb->data);
1356
1357         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
1358
1359         if (!num_rsp)
1360                 return;
1361
1362         hci_dev_lock(hdev);
1363
1364         if (!test_and_set_bit(HCI_INQUIRY, &hdev->flags)) {
1365
1366                 if (test_bit(HCI_MGMT, &hdev->flags))
1367                         mgmt_discovering(hdev->id, 1);
1368         }
1369
1370         for (; num_rsp; num_rsp--, info++) {
1371                 bacpy(&data.bdaddr, &info->bdaddr);
1372                 data.pscan_rep_mode     = info->pscan_rep_mode;
1373                 data.pscan_period_mode  = info->pscan_period_mode;
1374                 data.pscan_mode         = info->pscan_mode;
1375                 memcpy(data.dev_class, info->dev_class, 3);
1376                 data.clock_offset       = info->clock_offset;
1377                 data.rssi               = 0x00;
1378                 data.ssp_mode           = 0x00;
1379                 hci_inquiry_cache_update(hdev, &data);
1380                 mgmt_device_found(hdev->id, &info->bdaddr, info->dev_class, 0,
1381                                                                         NULL);
1382         }
1383
1384         hci_dev_unlock(hdev);
1385 }
1386
1387 static inline void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1388 {
1389         struct hci_ev_conn_complete *ev = (void *) skb->data;
1390         struct hci_conn *conn;
1391
1392         BT_DBG("%s", hdev->name);
1393
1394         hci_dev_lock(hdev);
1395
1396         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
1397         if (!conn) {
1398                 if (ev->link_type != SCO_LINK)
1399                         goto unlock;
1400
1401                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
1402                 if (!conn)
1403                         goto unlock;
1404
1405                 conn->type = SCO_LINK;
1406         }
1407
1408         if (!ev->status) {
1409                 conn->handle = __le16_to_cpu(ev->handle);
1410
1411                 if (conn->type == ACL_LINK) {
1412                         conn->state = BT_CONFIG;
1413                         hci_conn_hold(conn);
1414
1415                         if (!conn->out &&
1416                             !(conn->ssp_mode && conn->hdev->ssp_mode) &&
1417                             !hci_find_link_key(hdev, &ev->bdaddr))
1418                                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
1419                         else
1420                                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
1421                         mgmt_connected(hdev->id, &ev->bdaddr, conn->type);
1422                 } else
1423                         conn->state = BT_CONNECTED;
1424
1425                 hci_conn_hold_device(conn);
1426                 hci_conn_add_sysfs(conn);
1427
1428                 if (test_bit(HCI_AUTH, &hdev->flags))
1429                         conn->link_mode |= HCI_LM_AUTH;
1430
1431                 if (test_bit(HCI_ENCRYPT, &hdev->flags))
1432                         conn->link_mode |= HCI_LM_ENCRYPT;
1433
1434                 /* Get remote features */
1435                 if (conn->type == ACL_LINK) {
1436                         struct hci_cp_read_remote_features cp;
1437                         cp.handle = ev->handle;
1438                         hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
1439                                                         sizeof(cp), &cp);
1440                 }
1441
1442                 /* Set packet type for incoming connection */
1443                 if (!conn->out && hdev->hci_ver < 3) {
1444                         struct hci_cp_change_conn_ptype cp;
1445                         cp.handle = ev->handle;
1446                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
1447                         hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE,
1448                                                         sizeof(cp), &cp);
1449                 }
1450         } else {
1451                 conn->state = BT_CLOSED;
1452                 if (conn->type == ACL_LINK)
1453                         mgmt_connect_failed(hdev->id, &ev->bdaddr, ev->status);
1454         }
1455
1456         if (conn->type == ACL_LINK)
1457                 hci_sco_setup(conn, ev->status);
1458
1459         if (ev->status) {
1460                 hci_proto_connect_cfm(conn, ev->status);
1461                 hci_conn_del(conn);
1462         } else if (ev->link_type != ACL_LINK)
1463                 hci_proto_connect_cfm(conn, ev->status);
1464
1465 unlock:
1466         hci_dev_unlock(hdev);
1467
1468         hci_conn_check_pending(hdev);
1469 }
1470
1471 static inline void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
1472 {
1473         struct hci_ev_conn_request *ev = (void *) skb->data;
1474         int mask = hdev->link_mode;
1475
1476         BT_DBG("%s bdaddr %s type 0x%x", hdev->name,
1477                                         batostr(&ev->bdaddr), ev->link_type);
1478
1479         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type);
1480
1481         if ((mask & HCI_LM_ACCEPT) &&
1482                         !hci_blacklist_lookup(hdev, &ev->bdaddr)) {
1483                 /* Connection accepted */
1484                 struct inquiry_entry *ie;
1485                 struct hci_conn *conn;
1486
1487                 hci_dev_lock(hdev);
1488
1489                 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
1490                 if (ie)
1491                         memcpy(ie->data.dev_class, ev->dev_class, 3);
1492
1493                 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
1494                 if (!conn) {
1495                         conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr);
1496                         if (!conn) {
1497                                 BT_ERR("No memory for new connection");
1498                                 hci_dev_unlock(hdev);
1499                                 return;
1500                         }
1501                 }
1502
1503                 memcpy(conn->dev_class, ev->dev_class, 3);
1504                 conn->state = BT_CONNECT;
1505
1506                 hci_dev_unlock(hdev);
1507
1508                 if (ev->link_type == ACL_LINK || !lmp_esco_capable(hdev)) {
1509                         struct hci_cp_accept_conn_req cp;
1510
1511                         bacpy(&cp.bdaddr, &ev->bdaddr);
1512
1513                         if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
1514                                 cp.role = 0x00; /* Become master */
1515                         else
1516                                 cp.role = 0x01; /* Remain slave */
1517
1518                         hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ,
1519                                                         sizeof(cp), &cp);
1520                 } else {
1521                         struct hci_cp_accept_sync_conn_req cp;
1522
1523                         bacpy(&cp.bdaddr, &ev->bdaddr);
1524                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
1525
1526                         cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
1527                         cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
1528                         cp.max_latency    = cpu_to_le16(0xffff);
1529                         cp.content_format = cpu_to_le16(hdev->voice_setting);
1530                         cp.retrans_effort = 0xff;
1531
1532                         hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ,
1533                                                         sizeof(cp), &cp);
1534                 }
1535         } else {
1536                 /* Connection rejected */
1537                 struct hci_cp_reject_conn_req cp;
1538
1539                 bacpy(&cp.bdaddr, &ev->bdaddr);
1540                 cp.reason = 0x0f;
1541                 hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
1542         }
1543 }
1544
1545 static inline void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1546 {
1547         struct hci_ev_disconn_complete *ev = (void *) skb->data;
1548         struct hci_conn *conn;
1549
1550         BT_DBG("%s status %d", hdev->name, ev->status);
1551
1552         if (ev->status) {
1553                 mgmt_disconnect_failed(hdev->id);
1554                 return;
1555         }
1556
1557         hci_dev_lock(hdev);
1558
1559         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1560         if (!conn)
1561                 goto unlock;
1562
1563         conn->state = BT_CLOSED;
1564
1565         if (conn->type == ACL_LINK || conn->type == LE_LINK)
1566                 mgmt_disconnected(hdev->id, &conn->dst);
1567
1568         hci_proto_disconn_cfm(conn, ev->reason);
1569         hci_conn_del(conn);
1570
1571 unlock:
1572         hci_dev_unlock(hdev);
1573 }
1574
1575 static inline void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1576 {
1577         struct hci_ev_auth_complete *ev = (void *) skb->data;
1578         struct hci_conn *conn;
1579
1580         BT_DBG("%s status %d", hdev->name, ev->status);
1581
1582         hci_dev_lock(hdev);
1583
1584         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1585         if (!conn)
1586                 goto unlock;
1587
1588         if (!ev->status) {
1589                 if (!(conn->ssp_mode > 0 && hdev->ssp_mode > 0) &&
1590                                 test_bit(HCI_CONN_REAUTH_PEND,  &conn->pend)) {
1591                         BT_INFO("re-auth of legacy device is not possible.");
1592                 } else {
1593                         conn->link_mode |= HCI_LM_AUTH;
1594                         conn->sec_level = conn->pending_sec_level;
1595                 }
1596         } else {
1597                 mgmt_auth_failed(hdev->id, &conn->dst, ev->status);
1598         }
1599
1600         clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
1601         clear_bit(HCI_CONN_REAUTH_PEND, &conn->pend);
1602
1603         if (conn->state == BT_CONFIG) {
1604                 if (!ev->status && hdev->ssp_mode > 0 && conn->ssp_mode > 0) {
1605                         struct hci_cp_set_conn_encrypt cp;
1606                         cp.handle  = ev->handle;
1607                         cp.encrypt = 0x01;
1608                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
1609                                                                         &cp);
1610                 } else {
1611                         conn->state = BT_CONNECTED;
1612                         hci_proto_connect_cfm(conn, ev->status);
1613                         hci_conn_put(conn);
1614                 }
1615         } else {
1616                 hci_auth_cfm(conn, ev->status);
1617
1618                 hci_conn_hold(conn);
1619                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
1620                 hci_conn_put(conn);
1621         }
1622
1623         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend)) {
1624                 if (!ev->status) {
1625                         struct hci_cp_set_conn_encrypt cp;
1626                         cp.handle  = ev->handle;
1627                         cp.encrypt = 0x01;
1628                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
1629                                                                         &cp);
1630                 } else {
1631                         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
1632                         hci_encrypt_cfm(conn, ev->status, 0x00);
1633                 }
1634         }
1635
1636 unlock:
1637         hci_dev_unlock(hdev);
1638 }
1639
1640 static inline void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
1641 {
1642         struct hci_ev_remote_name *ev = (void *) skb->data;
1643         struct hci_conn *conn;
1644
1645         BT_DBG("%s", hdev->name);
1646
1647         hci_conn_check_pending(hdev);
1648
1649         hci_dev_lock(hdev);
1650
1651         if (ev->status == 0 && test_bit(HCI_MGMT, &hdev->flags))
1652                 mgmt_remote_name(hdev->id, &ev->bdaddr, ev->name);
1653
1654         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
1655         if (!conn)
1656                 goto unlock;
1657
1658         if (!hci_outgoing_auth_needed(hdev, conn))
1659                 goto unlock;
1660
1661         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
1662                 struct hci_cp_auth_requested cp;
1663                 cp.handle = __cpu_to_le16(conn->handle);
1664                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
1665         }
1666
1667 unlock:
1668         hci_dev_unlock(hdev);
1669 }
1670
1671 static inline void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
1672 {
1673         struct hci_ev_encrypt_change *ev = (void *) skb->data;
1674         struct hci_conn *conn;
1675
1676         BT_DBG("%s status %d", hdev->name, ev->status);
1677
1678         hci_dev_lock(hdev);
1679
1680         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1681         if (conn) {
1682                 if (!ev->status) {
1683                         if (ev->encrypt) {
1684                                 /* Encryption implies authentication */
1685                                 conn->link_mode |= HCI_LM_AUTH;
1686                                 conn->link_mode |= HCI_LM_ENCRYPT;
1687                                 conn->sec_level = conn->pending_sec_level;
1688                         } else
1689                                 conn->link_mode &= ~HCI_LM_ENCRYPT;
1690                 }
1691
1692                 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
1693
1694                 if (conn->state == BT_CONFIG) {
1695                         if (!ev->status)
1696                                 conn->state = BT_CONNECTED;
1697
1698                         hci_proto_connect_cfm(conn, ev->status);
1699                         hci_conn_put(conn);
1700                 } else
1701                         hci_encrypt_cfm(conn, ev->status, ev->encrypt);
1702         }
1703
1704         hci_dev_unlock(hdev);
1705 }
1706
1707 static inline void hci_change_link_key_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1708 {
1709         struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
1710         struct hci_conn *conn;
1711
1712         BT_DBG("%s status %d", hdev->name, ev->status);
1713
1714         hci_dev_lock(hdev);
1715
1716         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1717         if (conn) {
1718                 if (!ev->status)
1719                         conn->link_mode |= HCI_LM_SECURE;
1720
1721                 clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
1722
1723                 hci_key_change_cfm(conn, ev->status);
1724         }
1725
1726         hci_dev_unlock(hdev);
1727 }
1728
1729 static inline void hci_remote_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
1730 {
1731         struct hci_ev_remote_features *ev = (void *) skb->data;
1732         struct hci_conn *conn;
1733
1734         BT_DBG("%s status %d", hdev->name, ev->status);
1735
1736         hci_dev_lock(hdev);
1737
1738         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1739         if (!conn)
1740                 goto unlock;
1741
1742         if (!ev->status)
1743                 memcpy(conn->features, ev->features, 8);
1744
1745         if (conn->state != BT_CONFIG)
1746                 goto unlock;
1747
1748         if (!ev->status && lmp_ssp_capable(hdev) && lmp_ssp_capable(conn)) {
1749                 struct hci_cp_read_remote_ext_features cp;
1750                 cp.handle = ev->handle;
1751                 cp.page = 0x01;
1752                 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
1753                                                         sizeof(cp), &cp);
1754                 goto unlock;
1755         }
1756
1757         if (!ev->status) {
1758                 struct hci_cp_remote_name_req cp;
1759                 memset(&cp, 0, sizeof(cp));
1760                 bacpy(&cp.bdaddr, &conn->dst);
1761                 cp.pscan_rep_mode = 0x02;
1762                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1763         }
1764
1765         if (!hci_outgoing_auth_needed(hdev, conn)) {
1766                 conn->state = BT_CONNECTED;
1767                 hci_proto_connect_cfm(conn, ev->status);
1768                 hci_conn_put(conn);
1769         }
1770
1771 unlock:
1772         hci_dev_unlock(hdev);
1773 }
1774
1775 static inline void hci_remote_version_evt(struct hci_dev *hdev, struct sk_buff *skb)
1776 {
1777         BT_DBG("%s", hdev->name);
1778 }
1779
1780 static inline void hci_qos_setup_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1781 {
1782         BT_DBG("%s", hdev->name);
1783 }
1784
1785 static inline void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1786 {
1787         struct hci_ev_cmd_complete *ev = (void *) skb->data;
1788         __u16 opcode;
1789
1790         skb_pull(skb, sizeof(*ev));
1791
1792         opcode = __le16_to_cpu(ev->opcode);
1793
1794         switch (opcode) {
1795         case HCI_OP_INQUIRY_CANCEL:
1796                 hci_cc_inquiry_cancel(hdev, skb);
1797                 break;
1798
1799         case HCI_OP_EXIT_PERIODIC_INQ:
1800                 hci_cc_exit_periodic_inq(hdev, skb);
1801                 break;
1802
1803         case HCI_OP_REMOTE_NAME_REQ_CANCEL:
1804                 hci_cc_remote_name_req_cancel(hdev, skb);
1805                 break;
1806
1807         case HCI_OP_ROLE_DISCOVERY:
1808                 hci_cc_role_discovery(hdev, skb);
1809                 break;
1810
1811         case HCI_OP_READ_LINK_POLICY:
1812                 hci_cc_read_link_policy(hdev, skb);
1813                 break;
1814
1815         case HCI_OP_WRITE_LINK_POLICY:
1816                 hci_cc_write_link_policy(hdev, skb);
1817                 break;
1818
1819         case HCI_OP_READ_DEF_LINK_POLICY:
1820                 hci_cc_read_def_link_policy(hdev, skb);
1821                 break;
1822
1823         case HCI_OP_WRITE_DEF_LINK_POLICY:
1824                 hci_cc_write_def_link_policy(hdev, skb);
1825                 break;
1826
1827         case HCI_OP_RESET:
1828                 hci_cc_reset(hdev, skb);
1829                 break;
1830
1831         case HCI_OP_WRITE_LOCAL_NAME:
1832                 hci_cc_write_local_name(hdev, skb);
1833                 break;
1834
1835         case HCI_OP_READ_LOCAL_NAME:
1836                 hci_cc_read_local_name(hdev, skb);
1837                 break;
1838
1839         case HCI_OP_WRITE_AUTH_ENABLE:
1840                 hci_cc_write_auth_enable(hdev, skb);
1841                 break;
1842
1843         case HCI_OP_WRITE_ENCRYPT_MODE:
1844                 hci_cc_write_encrypt_mode(hdev, skb);
1845                 break;
1846
1847         case HCI_OP_WRITE_SCAN_ENABLE:
1848                 hci_cc_write_scan_enable(hdev, skb);
1849                 break;
1850
1851         case HCI_OP_READ_CLASS_OF_DEV:
1852                 hci_cc_read_class_of_dev(hdev, skb);
1853                 break;
1854
1855         case HCI_OP_WRITE_CLASS_OF_DEV:
1856                 hci_cc_write_class_of_dev(hdev, skb);
1857                 break;
1858
1859         case HCI_OP_READ_VOICE_SETTING:
1860                 hci_cc_read_voice_setting(hdev, skb);
1861                 break;
1862
1863         case HCI_OP_WRITE_VOICE_SETTING:
1864                 hci_cc_write_voice_setting(hdev, skb);
1865                 break;
1866
1867         case HCI_OP_HOST_BUFFER_SIZE:
1868                 hci_cc_host_buffer_size(hdev, skb);
1869                 break;
1870
1871         case HCI_OP_READ_SSP_MODE:
1872                 hci_cc_read_ssp_mode(hdev, skb);
1873                 break;
1874
1875         case HCI_OP_WRITE_SSP_MODE:
1876                 hci_cc_write_ssp_mode(hdev, skb);
1877                 break;
1878
1879         case HCI_OP_READ_LOCAL_VERSION:
1880                 hci_cc_read_local_version(hdev, skb);
1881                 break;
1882
1883         case HCI_OP_READ_LOCAL_COMMANDS:
1884                 hci_cc_read_local_commands(hdev, skb);
1885                 break;
1886
1887         case HCI_OP_READ_LOCAL_FEATURES:
1888                 hci_cc_read_local_features(hdev, skb);
1889                 break;
1890
1891         case HCI_OP_READ_LOCAL_EXT_FEATURES:
1892                 hci_cc_read_local_ext_features(hdev, skb);
1893                 break;
1894
1895         case HCI_OP_READ_BUFFER_SIZE:
1896                 hci_cc_read_buffer_size(hdev, skb);
1897                 break;
1898
1899         case HCI_OP_READ_BD_ADDR:
1900                 hci_cc_read_bd_addr(hdev, skb);
1901                 break;
1902
1903         case HCI_OP_WRITE_CA_TIMEOUT:
1904                 hci_cc_write_ca_timeout(hdev, skb);
1905                 break;
1906
1907         case HCI_OP_DELETE_STORED_LINK_KEY:
1908                 hci_cc_delete_stored_link_key(hdev, skb);
1909                 break;
1910
1911         case HCI_OP_SET_EVENT_MASK:
1912                 hci_cc_set_event_mask(hdev, skb);
1913                 break;
1914
1915         case HCI_OP_WRITE_INQUIRY_MODE:
1916                 hci_cc_write_inquiry_mode(hdev, skb);
1917                 break;
1918
1919         case HCI_OP_READ_INQ_RSP_TX_POWER:
1920                 hci_cc_read_inq_rsp_tx_power(hdev, skb);
1921                 break;
1922
1923         case HCI_OP_SET_EVENT_FLT:
1924                 hci_cc_set_event_flt(hdev, skb);
1925                 break;
1926
1927         case HCI_OP_PIN_CODE_REPLY:
1928                 hci_cc_pin_code_reply(hdev, skb);
1929                 break;
1930
1931         case HCI_OP_PIN_CODE_NEG_REPLY:
1932                 hci_cc_pin_code_neg_reply(hdev, skb);
1933                 break;
1934
1935         case HCI_OP_READ_LOCAL_OOB_DATA:
1936                 hci_cc_read_local_oob_data_reply(hdev, skb);
1937                 break;
1938
1939         case HCI_OP_LE_READ_BUFFER_SIZE:
1940                 hci_cc_le_read_buffer_size(hdev, skb);
1941                 break;
1942
1943         case HCI_OP_USER_CONFIRM_REPLY:
1944                 hci_cc_user_confirm_reply(hdev, skb);
1945                 break;
1946
1947         case HCI_OP_USER_CONFIRM_NEG_REPLY:
1948                 hci_cc_user_confirm_neg_reply(hdev, skb);
1949                 break;
1950
1951         case HCI_OP_LE_SET_SCAN_ENABLE:
1952                 hci_cc_le_set_scan_enable(hdev, skb);
1953                 break;
1954
1955         case HCI_OP_LE_LTK_REPLY:
1956                 hci_cc_le_ltk_reply(hdev, skb);
1957                 break;
1958
1959         case HCI_OP_LE_LTK_NEG_REPLY:
1960                 hci_cc_le_ltk_neg_reply(hdev, skb);
1961                 break;
1962
1963         case HCI_OP_WRITE_LE_HOST_SUPPORTED:
1964                 hci_cc_write_le_host_supported(hdev, skb);
1965                 break;
1966
1967         default:
1968                 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
1969                 break;
1970         }
1971
1972         if (ev->opcode != HCI_OP_NOP)
1973                 del_timer(&hdev->cmd_timer);
1974
1975         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
1976                 atomic_set(&hdev->cmd_cnt, 1);
1977                 if (!skb_queue_empty(&hdev->cmd_q))
1978                         tasklet_schedule(&hdev->cmd_task);
1979         }
1980 }
1981
1982 static inline void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb)
1983 {
1984         struct hci_ev_cmd_status *ev = (void *) skb->data;
1985         __u16 opcode;
1986
1987         skb_pull(skb, sizeof(*ev));
1988
1989         opcode = __le16_to_cpu(ev->opcode);
1990
1991         switch (opcode) {
1992         case HCI_OP_INQUIRY:
1993                 hci_cs_inquiry(hdev, ev->status);
1994                 break;
1995
1996         case HCI_OP_CREATE_CONN:
1997                 hci_cs_create_conn(hdev, ev->status);
1998                 break;
1999
2000         case HCI_OP_ADD_SCO:
2001                 hci_cs_add_sco(hdev, ev->status);
2002                 break;
2003
2004         case HCI_OP_AUTH_REQUESTED:
2005                 hci_cs_auth_requested(hdev, ev->status);
2006                 break;
2007
2008         case HCI_OP_SET_CONN_ENCRYPT:
2009                 hci_cs_set_conn_encrypt(hdev, ev->status);
2010                 break;
2011
2012         case HCI_OP_REMOTE_NAME_REQ:
2013                 hci_cs_remote_name_req(hdev, ev->status);
2014                 break;
2015
2016         case HCI_OP_READ_REMOTE_FEATURES:
2017                 hci_cs_read_remote_features(hdev, ev->status);
2018                 break;
2019
2020         case HCI_OP_READ_REMOTE_EXT_FEATURES:
2021                 hci_cs_read_remote_ext_features(hdev, ev->status);
2022                 break;
2023
2024         case HCI_OP_SETUP_SYNC_CONN:
2025                 hci_cs_setup_sync_conn(hdev, ev->status);
2026                 break;
2027
2028         case HCI_OP_SNIFF_MODE:
2029                 hci_cs_sniff_mode(hdev, ev->status);
2030                 break;
2031
2032         case HCI_OP_EXIT_SNIFF_MODE:
2033                 hci_cs_exit_sniff_mode(hdev, ev->status);
2034                 break;
2035
2036         case HCI_OP_DISCONNECT:
2037                 if (ev->status != 0)
2038                         mgmt_disconnect_failed(hdev->id);
2039                 break;
2040
2041         case HCI_OP_LE_CREATE_CONN:
2042                 hci_cs_le_create_conn(hdev, ev->status);
2043                 break;
2044
2045         case HCI_OP_LE_START_ENC:
2046                 hci_cs_le_start_enc(hdev, ev->status);
2047                 break;
2048
2049         default:
2050                 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
2051                 break;
2052         }
2053
2054         if (ev->opcode != HCI_OP_NOP)
2055                 del_timer(&hdev->cmd_timer);
2056
2057         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
2058                 atomic_set(&hdev->cmd_cnt, 1);
2059                 if (!skb_queue_empty(&hdev->cmd_q))
2060                         tasklet_schedule(&hdev->cmd_task);
2061         }
2062 }
2063
2064 static inline void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2065 {
2066         struct hci_ev_role_change *ev = (void *) skb->data;
2067         struct hci_conn *conn;
2068
2069         BT_DBG("%s status %d", hdev->name, ev->status);
2070
2071         hci_dev_lock(hdev);
2072
2073         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2074         if (conn) {
2075                 if (!ev->status) {
2076                         if (ev->role)
2077                                 conn->link_mode &= ~HCI_LM_MASTER;
2078                         else
2079                                 conn->link_mode |= HCI_LM_MASTER;
2080                 }
2081
2082                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->pend);
2083
2084                 hci_role_switch_cfm(conn, ev->status, ev->role);
2085         }
2086
2087         hci_dev_unlock(hdev);
2088 }
2089
2090 static inline void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
2091 {
2092         struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
2093         __le16 *ptr;
2094         int i;
2095
2096         skb_pull(skb, sizeof(*ev));
2097
2098         BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
2099
2100         if (skb->len < ev->num_hndl * 4) {
2101                 BT_DBG("%s bad parameters", hdev->name);
2102                 return;
2103         }
2104
2105         tasklet_disable(&hdev->tx_task);
2106
2107         for (i = 0, ptr = (__le16 *) skb->data; i < ev->num_hndl; i++) {
2108                 struct hci_conn *conn;
2109                 __u16  handle, count;
2110
2111                 handle = get_unaligned_le16(ptr++);
2112                 count  = get_unaligned_le16(ptr++);
2113
2114                 conn = hci_conn_hash_lookup_handle(hdev, handle);
2115                 if (conn) {
2116                         conn->sent -= count;
2117
2118                         if (conn->type == ACL_LINK) {
2119                                 hdev->acl_cnt += count;
2120                                 if (hdev->acl_cnt > hdev->acl_pkts)
2121                                         hdev->acl_cnt = hdev->acl_pkts;
2122                         } else if (conn->type == LE_LINK) {
2123                                 if (hdev->le_pkts) {
2124                                         hdev->le_cnt += count;
2125                                         if (hdev->le_cnt > hdev->le_pkts)
2126                                                 hdev->le_cnt = hdev->le_pkts;
2127                                 } else {
2128                                         hdev->acl_cnt += count;
2129                                         if (hdev->acl_cnt > hdev->acl_pkts)
2130                                                 hdev->acl_cnt = hdev->acl_pkts;
2131                                 }
2132                         } else {
2133                                 hdev->sco_cnt += count;
2134                                 if (hdev->sco_cnt > hdev->sco_pkts)
2135                                         hdev->sco_cnt = hdev->sco_pkts;
2136                         }
2137                 }
2138         }
2139
2140         tasklet_schedule(&hdev->tx_task);
2141
2142         tasklet_enable(&hdev->tx_task);
2143 }
2144
2145 static inline void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2146 {
2147         struct hci_ev_mode_change *ev = (void *) skb->data;
2148         struct hci_conn *conn;
2149
2150         BT_DBG("%s status %d", hdev->name, ev->status);
2151
2152         hci_dev_lock(hdev);
2153
2154         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2155         if (conn) {
2156                 conn->mode = ev->mode;
2157                 conn->interval = __le16_to_cpu(ev->interval);
2158
2159                 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
2160                         if (conn->mode == HCI_CM_ACTIVE)
2161                                 conn->power_save = 1;
2162                         else
2163                                 conn->power_save = 0;
2164                 }
2165
2166                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->pend))
2167                         hci_sco_setup(conn, ev->status);
2168         }
2169
2170         hci_dev_unlock(hdev);
2171 }
2172
2173 static inline void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2174 {
2175         struct hci_ev_pin_code_req *ev = (void *) skb->data;
2176         struct hci_conn *conn;
2177
2178         BT_DBG("%s", hdev->name);
2179
2180         hci_dev_lock(hdev);
2181
2182         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2183         if (!conn)
2184                 goto unlock;
2185
2186         if (conn->state == BT_CONNECTED) {
2187                 hci_conn_hold(conn);
2188                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2189                 hci_conn_put(conn);
2190         }
2191
2192         if (!test_bit(HCI_PAIRABLE, &hdev->flags))
2193                 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2194                                         sizeof(ev->bdaddr), &ev->bdaddr);
2195         else if (test_bit(HCI_MGMT, &hdev->flags)) {
2196                 u8 secure;
2197
2198                 if (conn->pending_sec_level == BT_SECURITY_HIGH)
2199                         secure = 1;
2200                 else
2201                         secure = 0;
2202
2203                 mgmt_pin_code_request(hdev->id, &ev->bdaddr, secure);
2204         }
2205
2206 unlock:
2207         hci_dev_unlock(hdev);
2208 }
2209
2210 static inline void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2211 {
2212         struct hci_ev_link_key_req *ev = (void *) skb->data;
2213         struct hci_cp_link_key_reply cp;
2214         struct hci_conn *conn;
2215         struct link_key *key;
2216
2217         BT_DBG("%s", hdev->name);
2218
2219         if (!test_bit(HCI_LINK_KEYS, &hdev->flags))
2220                 return;
2221
2222         hci_dev_lock(hdev);
2223
2224         key = hci_find_link_key(hdev, &ev->bdaddr);
2225         if (!key) {
2226                 BT_DBG("%s link key not found for %s", hdev->name,
2227                                                         batostr(&ev->bdaddr));
2228                 goto not_found;
2229         }
2230
2231         BT_DBG("%s found key type %u for %s", hdev->name, key->type,
2232                                                         batostr(&ev->bdaddr));
2233
2234         if (!test_bit(HCI_DEBUG_KEYS, &hdev->flags) &&
2235                                 key->type == HCI_LK_DEBUG_COMBINATION) {
2236                 BT_DBG("%s ignoring debug key", hdev->name);
2237                 goto not_found;
2238         }
2239
2240         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2241         if (conn) {
2242                 if (key->type == HCI_LK_UNAUTH_COMBINATION &&
2243                                 conn->auth_type != 0xff &&
2244                                 (conn->auth_type & 0x01)) {
2245                         BT_DBG("%s ignoring unauthenticated key", hdev->name);
2246                         goto not_found;
2247                 }
2248
2249                 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
2250                                 conn->pending_sec_level == BT_SECURITY_HIGH) {
2251                         BT_DBG("%s ignoring key unauthenticated for high \
2252                                                         security", hdev->name);
2253                         goto not_found;
2254                 }
2255
2256                 conn->key_type = key->type;
2257                 conn->pin_length = key->pin_len;
2258         }
2259
2260         bacpy(&cp.bdaddr, &ev->bdaddr);
2261         memcpy(cp.link_key, key->val, 16);
2262
2263         hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
2264
2265         hci_dev_unlock(hdev);
2266
2267         return;
2268
2269 not_found:
2270         hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
2271         hci_dev_unlock(hdev);
2272 }
2273
2274 static inline void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
2275 {
2276         struct hci_ev_link_key_notify *ev = (void *) skb->data;
2277         struct hci_conn *conn;
2278         u8 pin_len = 0;
2279
2280         BT_DBG("%s", hdev->name);
2281
2282         hci_dev_lock(hdev);
2283
2284         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2285         if (conn) {
2286                 hci_conn_hold(conn);
2287                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2288                 pin_len = conn->pin_length;
2289
2290                 if (ev->key_type != HCI_LK_CHANGED_COMBINATION)
2291                         conn->key_type = ev->key_type;
2292
2293                 hci_conn_put(conn);
2294         }
2295
2296         if (test_bit(HCI_LINK_KEYS, &hdev->flags))
2297                 hci_add_link_key(hdev, conn, 1, &ev->bdaddr, ev->link_key,
2298                                                         ev->key_type, pin_len);
2299
2300         hci_dev_unlock(hdev);
2301 }
2302
2303 static inline void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
2304 {
2305         struct hci_ev_clock_offset *ev = (void *) skb->data;
2306         struct hci_conn *conn;
2307
2308         BT_DBG("%s status %d", hdev->name, ev->status);
2309
2310         hci_dev_lock(hdev);
2311
2312         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2313         if (conn && !ev->status) {
2314                 struct inquiry_entry *ie;
2315
2316                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
2317                 if (ie) {
2318                         ie->data.clock_offset = ev->clock_offset;
2319                         ie->timestamp = jiffies;
2320                 }
2321         }
2322
2323         hci_dev_unlock(hdev);
2324 }
2325
2326 static inline void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2327 {
2328         struct hci_ev_pkt_type_change *ev = (void *) skb->data;
2329         struct hci_conn *conn;
2330
2331         BT_DBG("%s status %d", hdev->name, ev->status);
2332
2333         hci_dev_lock(hdev);
2334
2335         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2336         if (conn && !ev->status)
2337                 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
2338
2339         hci_dev_unlock(hdev);
2340 }
2341
2342 static inline void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
2343 {
2344         struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
2345         struct inquiry_entry *ie;
2346
2347         BT_DBG("%s", hdev->name);
2348
2349         hci_dev_lock(hdev);
2350
2351         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2352         if (ie) {
2353                 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
2354                 ie->timestamp = jiffies;
2355         }
2356
2357         hci_dev_unlock(hdev);
2358 }
2359
2360 static inline void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, struct sk_buff *skb)
2361 {
2362         struct inquiry_data data;
2363         int num_rsp = *((__u8 *) skb->data);
2364
2365         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2366
2367         if (!num_rsp)
2368                 return;
2369
2370         hci_dev_lock(hdev);
2371
2372         if (!test_and_set_bit(HCI_INQUIRY, &hdev->flags)) {
2373
2374                 if (test_bit(HCI_MGMT, &hdev->flags))
2375                         mgmt_discovering(hdev->id, 1);
2376         }
2377
2378         if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
2379                 struct inquiry_info_with_rssi_and_pscan_mode *info;
2380                 info = (void *) (skb->data + 1);
2381
2382                 for (; num_rsp; num_rsp--, info++) {
2383                         bacpy(&data.bdaddr, &info->bdaddr);
2384                         data.pscan_rep_mode     = info->pscan_rep_mode;
2385                         data.pscan_period_mode  = info->pscan_period_mode;
2386                         data.pscan_mode         = info->pscan_mode;
2387                         memcpy(data.dev_class, info->dev_class, 3);
2388                         data.clock_offset       = info->clock_offset;
2389                         data.rssi               = info->rssi;
2390                         data.ssp_mode           = 0x00;
2391                         hci_inquiry_cache_update(hdev, &data);
2392                         mgmt_device_found(hdev->id, &info->bdaddr,
2393                                                 info->dev_class, info->rssi,
2394                                                 NULL);
2395                 }
2396         } else {
2397                 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
2398
2399                 for (; num_rsp; num_rsp--, info++) {
2400                         bacpy(&data.bdaddr, &info->bdaddr);
2401                         data.pscan_rep_mode     = info->pscan_rep_mode;
2402                         data.pscan_period_mode  = info->pscan_period_mode;
2403                         data.pscan_mode         = 0x00;
2404                         memcpy(data.dev_class, info->dev_class, 3);
2405                         data.clock_offset       = info->clock_offset;
2406                         data.rssi               = info->rssi;
2407                         data.ssp_mode           = 0x00;
2408                         hci_inquiry_cache_update(hdev, &data);
2409                         mgmt_device_found(hdev->id, &info->bdaddr,
2410                                                 info->dev_class, info->rssi,
2411                                                 NULL);
2412                 }
2413         }
2414
2415         hci_dev_unlock(hdev);
2416 }
2417
2418 static inline void hci_remote_ext_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
2419 {
2420         struct hci_ev_remote_ext_features *ev = (void *) skb->data;
2421         struct hci_conn *conn;
2422
2423         BT_DBG("%s", hdev->name);
2424
2425         hci_dev_lock(hdev);
2426
2427         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2428         if (!conn)
2429                 goto unlock;
2430
2431         if (!ev->status && ev->page == 0x01) {
2432                 struct inquiry_entry *ie;
2433
2434                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
2435                 if (ie)
2436                         ie->data.ssp_mode = (ev->features[0] & 0x01);
2437
2438                 conn->ssp_mode = (ev->features[0] & 0x01);
2439         }
2440
2441         if (conn->state != BT_CONFIG)
2442                 goto unlock;
2443
2444         if (!ev->status) {
2445                 struct hci_cp_remote_name_req cp;
2446                 memset(&cp, 0, sizeof(cp));
2447                 bacpy(&cp.bdaddr, &conn->dst);
2448                 cp.pscan_rep_mode = 0x02;
2449                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2450         }
2451
2452         if (!hci_outgoing_auth_needed(hdev, conn)) {
2453                 conn->state = BT_CONNECTED;
2454                 hci_proto_connect_cfm(conn, ev->status);
2455                 hci_conn_put(conn);
2456         }
2457
2458 unlock:
2459         hci_dev_unlock(hdev);
2460 }
2461
2462 static inline void hci_sync_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2463 {
2464         struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
2465         struct hci_conn *conn;
2466
2467         BT_DBG("%s status %d", hdev->name, ev->status);
2468
2469         hci_dev_lock(hdev);
2470
2471         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
2472         if (!conn) {
2473                 if (ev->link_type == ESCO_LINK)
2474                         goto unlock;
2475
2476                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
2477                 if (!conn)
2478                         goto unlock;
2479
2480                 conn->type = SCO_LINK;
2481         }
2482
2483         switch (ev->status) {
2484         case 0x00:
2485                 conn->handle = __le16_to_cpu(ev->handle);
2486                 conn->state  = BT_CONNECTED;
2487
2488                 hci_conn_hold_device(conn);
2489                 hci_conn_add_sysfs(conn);
2490                 break;
2491
2492         case 0x11:      /* Unsupported Feature or Parameter Value */
2493         case 0x1c:      /* SCO interval rejected */
2494         case 0x1a:      /* Unsupported Remote Feature */
2495         case 0x1f:      /* Unspecified error */
2496                 if (conn->out && conn->attempt < 2) {
2497                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
2498                                         (hdev->esco_type & EDR_ESCO_MASK);
2499                         hci_setup_sync(conn, conn->link->handle);
2500                         goto unlock;
2501                 }
2502                 /* fall through */
2503
2504         default:
2505                 conn->state = BT_CLOSED;
2506                 break;
2507         }
2508
2509         hci_proto_connect_cfm(conn, ev->status);
2510         if (ev->status)
2511                 hci_conn_del(conn);
2512
2513 unlock:
2514         hci_dev_unlock(hdev);
2515 }
2516
2517 static inline void hci_sync_conn_changed_evt(struct hci_dev *hdev, struct sk_buff *skb)
2518 {
2519         BT_DBG("%s", hdev->name);
2520 }
2521
2522 static inline void hci_sniff_subrate_evt(struct hci_dev *hdev, struct sk_buff *skb)
2523 {
2524         struct hci_ev_sniff_subrate *ev = (void *) skb->data;
2525
2526         BT_DBG("%s status %d", hdev->name, ev->status);
2527 }
2528
2529 static inline void hci_extended_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
2530 {
2531         struct inquiry_data data;
2532         struct extended_inquiry_info *info = (void *) (skb->data + 1);
2533         int num_rsp = *((__u8 *) skb->data);
2534
2535         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2536
2537         if (!num_rsp)
2538                 return;
2539
2540         if (!test_and_set_bit(HCI_INQUIRY, &hdev->flags)) {
2541
2542                 if (test_bit(HCI_MGMT, &hdev->flags))
2543                         mgmt_discovering(hdev->id, 1);
2544         }
2545
2546         hci_dev_lock(hdev);
2547
2548         for (; num_rsp; num_rsp--, info++) {
2549                 bacpy(&data.bdaddr, &info->bdaddr);
2550                 data.pscan_rep_mode     = info->pscan_rep_mode;
2551                 data.pscan_period_mode  = info->pscan_period_mode;
2552                 data.pscan_mode         = 0x00;
2553                 memcpy(data.dev_class, info->dev_class, 3);
2554                 data.clock_offset       = info->clock_offset;
2555                 data.rssi               = info->rssi;
2556                 data.ssp_mode           = 0x01;
2557                 hci_inquiry_cache_update(hdev, &data);
2558                 mgmt_device_found(hdev->id, &info->bdaddr, info->dev_class,
2559                                                 info->rssi, info->data);
2560         }
2561
2562         hci_dev_unlock(hdev);
2563 }
2564
2565 static inline u8 hci_get_auth_req(struct hci_conn *conn)
2566 {
2567         /* If remote requests dedicated bonding follow that lead */
2568         if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03) {
2569                 /* If both remote and local IO capabilities allow MITM
2570                  * protection then require it, otherwise don't */
2571                 if (conn->remote_cap == 0x03 || conn->io_capability == 0x03)
2572                         return 0x02;
2573                 else
2574                         return 0x03;
2575         }
2576
2577         /* If remote requests no-bonding follow that lead */
2578         if (conn->remote_auth == 0x00 || conn->remote_auth == 0x01)
2579                 return conn->remote_auth | (conn->auth_type & 0x01);
2580
2581         return conn->auth_type;
2582 }
2583
2584 static inline void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2585 {
2586         struct hci_ev_io_capa_request *ev = (void *) skb->data;
2587         struct hci_conn *conn;
2588
2589         BT_DBG("%s", hdev->name);
2590
2591         hci_dev_lock(hdev);
2592
2593         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2594         if (!conn)
2595                 goto unlock;
2596
2597         hci_conn_hold(conn);
2598
2599         if (!test_bit(HCI_MGMT, &hdev->flags))
2600                 goto unlock;
2601
2602         if (test_bit(HCI_PAIRABLE, &hdev->flags) ||
2603                         (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
2604                 struct hci_cp_io_capability_reply cp;
2605
2606                 bacpy(&cp.bdaddr, &ev->bdaddr);
2607                 cp.capability = conn->io_capability;
2608                 conn->auth_type = hci_get_auth_req(conn);
2609                 cp.authentication = conn->auth_type;
2610
2611                 if ((conn->out == 0x01 || conn->remote_oob == 0x01) &&
2612                                 hci_find_remote_oob_data(hdev, &conn->dst))
2613                         cp.oob_data = 0x01;
2614                 else
2615                         cp.oob_data = 0x00;
2616
2617                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
2618                                                         sizeof(cp), &cp);
2619         } else {
2620                 struct hci_cp_io_capability_neg_reply cp;
2621
2622                 bacpy(&cp.bdaddr, &ev->bdaddr);
2623                 cp.reason = 0x18; /* Pairing not allowed */
2624
2625                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
2626                                                         sizeof(cp), &cp);
2627         }
2628
2629 unlock:
2630         hci_dev_unlock(hdev);
2631 }
2632
2633 static inline void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
2634 {
2635         struct hci_ev_io_capa_reply *ev = (void *) skb->data;
2636         struct hci_conn *conn;
2637
2638         BT_DBG("%s", hdev->name);
2639
2640         hci_dev_lock(hdev);
2641
2642         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2643         if (!conn)
2644                 goto unlock;
2645
2646         conn->remote_cap = ev->capability;
2647         conn->remote_oob = ev->oob_data;
2648         conn->remote_auth = ev->authentication;
2649
2650 unlock:
2651         hci_dev_unlock(hdev);
2652 }
2653
2654 static inline void hci_user_confirm_request_evt(struct hci_dev *hdev,
2655                                                         struct sk_buff *skb)
2656 {
2657         struct hci_ev_user_confirm_req *ev = (void *) skb->data;
2658         int loc_mitm, rem_mitm, confirm_hint = 0;
2659         struct hci_conn *conn;
2660
2661         BT_DBG("%s", hdev->name);
2662
2663         hci_dev_lock(hdev);
2664
2665         if (!test_bit(HCI_MGMT, &hdev->flags))
2666                 goto unlock;
2667
2668         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2669         if (!conn)
2670                 goto unlock;
2671
2672         loc_mitm = (conn->auth_type & 0x01);
2673         rem_mitm = (conn->remote_auth & 0x01);
2674
2675         /* If we require MITM but the remote device can't provide that
2676          * (it has NoInputNoOutput) then reject the confirmation
2677          * request. The only exception is when we're dedicated bonding
2678          * initiators (connect_cfm_cb set) since then we always have the MITM
2679          * bit set. */
2680         if (!conn->connect_cfm_cb && loc_mitm && conn->remote_cap == 0x03) {
2681                 BT_DBG("Rejecting request: remote device can't provide MITM");
2682                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
2683                                         sizeof(ev->bdaddr), &ev->bdaddr);
2684                 goto unlock;
2685         }
2686
2687         /* If no side requires MITM protection; auto-accept */
2688         if ((!loc_mitm || conn->remote_cap == 0x03) &&
2689                                 (!rem_mitm || conn->io_capability == 0x03)) {
2690
2691                 /* If we're not the initiators request authorization to
2692                  * proceed from user space (mgmt_user_confirm with
2693                  * confirm_hint set to 1). The exception is if neither
2694                  * side had MITM in which case we do auto-accept.
2695                  */
2696                 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->pend) &&
2697                     (loc_mitm || rem_mitm)) {
2698                         BT_DBG("Confirming auto-accept as acceptor");
2699                         confirm_hint = 1;
2700                         goto confirm;
2701                 }
2702
2703                 BT_DBG("Auto-accept of user confirmation with %ums delay",
2704                                                 hdev->auto_accept_delay);
2705
2706                 if (hdev->auto_accept_delay > 0) {
2707                         int delay = msecs_to_jiffies(hdev->auto_accept_delay);
2708                         mod_timer(&conn->auto_accept_timer, jiffies + delay);
2709                         goto unlock;
2710                 }
2711
2712                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
2713                                                 sizeof(ev->bdaddr), &ev->bdaddr);
2714                 goto unlock;
2715         }
2716
2717 confirm:
2718         mgmt_user_confirm_request(hdev->id, &ev->bdaddr, ev->passkey,
2719                                                                 confirm_hint);
2720
2721 unlock:
2722         hci_dev_unlock(hdev);
2723 }
2724
2725 static inline void hci_simple_pair_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2726 {
2727         struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
2728         struct hci_conn *conn;
2729
2730         BT_DBG("%s", hdev->name);
2731
2732         hci_dev_lock(hdev);
2733
2734         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2735         if (!conn)
2736                 goto unlock;
2737
2738         /* To avoid duplicate auth_failed events to user space we check
2739          * the HCI_CONN_AUTH_PEND flag which will be set if we
2740          * initiated the authentication. A traditional auth_complete
2741          * event gets always produced as initiator and is also mapped to
2742          * the mgmt_auth_failed event */
2743         if (!test_bit(HCI_CONN_AUTH_PEND, &conn->pend) && ev->status != 0)
2744                 mgmt_auth_failed(hdev->id, &conn->dst, ev->status);
2745
2746         hci_conn_put(conn);
2747
2748 unlock:
2749         hci_dev_unlock(hdev);
2750 }
2751
2752 static inline void hci_remote_host_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
2753 {
2754         struct hci_ev_remote_host_features *ev = (void *) skb->data;
2755         struct inquiry_entry *ie;
2756
2757         BT_DBG("%s", hdev->name);
2758
2759         hci_dev_lock(hdev);
2760
2761         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2762         if (ie)
2763                 ie->data.ssp_mode = (ev->features[0] & 0x01);
2764
2765         hci_dev_unlock(hdev);
2766 }
2767
2768 static inline void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
2769                                                         struct sk_buff *skb)
2770 {
2771         struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
2772         struct oob_data *data;
2773
2774         BT_DBG("%s", hdev->name);
2775
2776         hci_dev_lock(hdev);
2777
2778         if (!test_bit(HCI_MGMT, &hdev->flags))
2779                 goto unlock;
2780
2781         data = hci_find_remote_oob_data(hdev, &ev->bdaddr);
2782         if (data) {
2783                 struct hci_cp_remote_oob_data_reply cp;
2784
2785                 bacpy(&cp.bdaddr, &ev->bdaddr);
2786                 memcpy(cp.hash, data->hash, sizeof(cp.hash));
2787                 memcpy(cp.randomizer, data->randomizer, sizeof(cp.randomizer));
2788
2789                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY, sizeof(cp),
2790                                                                         &cp);
2791         } else {
2792                 struct hci_cp_remote_oob_data_neg_reply cp;
2793
2794                 bacpy(&cp.bdaddr, &ev->bdaddr);
2795                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY, sizeof(cp),
2796                                                                         &cp);
2797         }
2798
2799 unlock:
2800         hci_dev_unlock(hdev);
2801 }
2802
2803 static inline void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2804 {
2805         struct hci_ev_le_conn_complete *ev = (void *) skb->data;
2806         struct hci_conn *conn;
2807
2808         BT_DBG("%s status %d", hdev->name, ev->status);
2809
2810         hci_dev_lock(hdev);
2811
2812         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &ev->bdaddr);
2813         if (!conn) {
2814                 conn = hci_conn_add(hdev, LE_LINK, &ev->bdaddr);
2815                 if (!conn) {
2816                         BT_ERR("No memory for new connection");
2817                         hci_dev_unlock(hdev);
2818                         return;
2819                 }
2820
2821                 conn->dst_type = ev->bdaddr_type;
2822         }
2823
2824         if (ev->status) {
2825                 mgmt_connect_failed(hdev->id, &ev->bdaddr, ev->status);
2826                 hci_proto_connect_cfm(conn, ev->status);
2827                 conn->state = BT_CLOSED;
2828                 hci_conn_del(conn);
2829                 goto unlock;
2830         }
2831
2832         mgmt_connected(hdev->id, &ev->bdaddr, conn->type);
2833
2834         conn->sec_level = BT_SECURITY_LOW;
2835         conn->handle = __le16_to_cpu(ev->handle);
2836         conn->state = BT_CONNECTED;
2837
2838         hci_conn_hold_device(conn);
2839         hci_conn_add_sysfs(conn);
2840
2841         hci_proto_connect_cfm(conn, ev->status);
2842
2843 unlock:
2844         hci_dev_unlock(hdev);
2845 }
2846
2847 static inline void hci_le_adv_report_evt(struct hci_dev *hdev,
2848                                                 struct sk_buff *skb)
2849 {
2850         u8 num_reports = skb->data[0];
2851         void *ptr = &skb->data[1];
2852
2853         hci_dev_lock(hdev);
2854
2855         while (num_reports--) {
2856                 struct hci_ev_le_advertising_info *ev = ptr;
2857
2858                 hci_add_adv_entry(hdev, ev);
2859
2860                 ptr += sizeof(*ev) + ev->length + 1;
2861         }
2862
2863         hci_dev_unlock(hdev);
2864 }
2865
2866 static inline void hci_le_ltk_request_evt(struct hci_dev *hdev,
2867                                                 struct sk_buff *skb)
2868 {
2869         struct hci_ev_le_ltk_req *ev = (void *) skb->data;
2870         struct hci_cp_le_ltk_reply cp;
2871         struct hci_cp_le_ltk_neg_reply neg;
2872         struct hci_conn *conn;
2873         struct link_key *ltk;
2874
2875         BT_DBG("%s handle %d", hdev->name, cpu_to_le16(ev->handle));
2876
2877         hci_dev_lock(hdev);
2878
2879         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2880         if (conn == NULL)
2881                 goto not_found;
2882
2883         ltk = hci_find_ltk(hdev, ev->ediv, ev->random);
2884         if (ltk == NULL)
2885                 goto not_found;
2886
2887         memcpy(cp.ltk, ltk->val, sizeof(ltk->val));
2888         cp.handle = cpu_to_le16(conn->handle);
2889         conn->pin_length = ltk->pin_len;
2890
2891         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
2892
2893         hci_dev_unlock(hdev);
2894
2895         return;
2896
2897 not_found:
2898         neg.handle = ev->handle;
2899         hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
2900         hci_dev_unlock(hdev);
2901 }
2902
2903 static inline void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
2904 {
2905         struct hci_ev_le_meta *le_ev = (void *) skb->data;
2906
2907         skb_pull(skb, sizeof(*le_ev));
2908
2909         switch (le_ev->subevent) {
2910         case HCI_EV_LE_CONN_COMPLETE:
2911                 hci_le_conn_complete_evt(hdev, skb);
2912                 break;
2913
2914         case HCI_EV_LE_ADVERTISING_REPORT:
2915                 hci_le_adv_report_evt(hdev, skb);
2916                 break;
2917
2918         case HCI_EV_LE_LTK_REQ:
2919                 hci_le_ltk_request_evt(hdev, skb);
2920                 break;
2921
2922         default:
2923                 break;
2924         }
2925 }
2926
2927 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
2928 {
2929         struct hci_event_hdr *hdr = (void *) skb->data;
2930         __u8 event = hdr->evt;
2931
2932         skb_pull(skb, HCI_EVENT_HDR_SIZE);
2933
2934         switch (event) {
2935         case HCI_EV_INQUIRY_COMPLETE:
2936                 hci_inquiry_complete_evt(hdev, skb);
2937                 break;
2938
2939         case HCI_EV_INQUIRY_RESULT:
2940                 hci_inquiry_result_evt(hdev, skb);
2941                 break;
2942
2943         case HCI_EV_CONN_COMPLETE:
2944                 hci_conn_complete_evt(hdev, skb);
2945                 break;
2946
2947         case HCI_EV_CONN_REQUEST:
2948                 hci_conn_request_evt(hdev, skb);
2949                 break;
2950
2951         case HCI_EV_DISCONN_COMPLETE:
2952                 hci_disconn_complete_evt(hdev, skb);
2953                 break;
2954
2955         case HCI_EV_AUTH_COMPLETE:
2956                 hci_auth_complete_evt(hdev, skb);
2957                 break;
2958
2959         case HCI_EV_REMOTE_NAME:
2960                 hci_remote_name_evt(hdev, skb);
2961                 break;
2962
2963         case HCI_EV_ENCRYPT_CHANGE:
2964                 hci_encrypt_change_evt(hdev, skb);
2965                 break;
2966
2967         case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
2968                 hci_change_link_key_complete_evt(hdev, skb);
2969                 break;
2970
2971         case HCI_EV_REMOTE_FEATURES:
2972                 hci_remote_features_evt(hdev, skb);
2973                 break;
2974
2975         case HCI_EV_REMOTE_VERSION:
2976                 hci_remote_version_evt(hdev, skb);
2977                 break;
2978
2979         case HCI_EV_QOS_SETUP_COMPLETE:
2980                 hci_qos_setup_complete_evt(hdev, skb);
2981                 break;
2982
2983         case HCI_EV_CMD_COMPLETE:
2984                 hci_cmd_complete_evt(hdev, skb);
2985                 break;
2986
2987         case HCI_EV_CMD_STATUS:
2988                 hci_cmd_status_evt(hdev, skb);
2989                 break;
2990
2991         case HCI_EV_ROLE_CHANGE:
2992                 hci_role_change_evt(hdev, skb);
2993                 break;
2994
2995         case HCI_EV_NUM_COMP_PKTS:
2996                 hci_num_comp_pkts_evt(hdev, skb);
2997                 break;
2998
2999         case HCI_EV_MODE_CHANGE:
3000                 hci_mode_change_evt(hdev, skb);
3001                 break;
3002
3003         case HCI_EV_PIN_CODE_REQ:
3004                 hci_pin_code_request_evt(hdev, skb);
3005                 break;
3006
3007         case HCI_EV_LINK_KEY_REQ:
3008                 hci_link_key_request_evt(hdev, skb);
3009                 break;
3010
3011         case HCI_EV_LINK_KEY_NOTIFY:
3012                 hci_link_key_notify_evt(hdev, skb);
3013                 break;
3014
3015         case HCI_EV_CLOCK_OFFSET:
3016                 hci_clock_offset_evt(hdev, skb);
3017                 break;
3018
3019         case HCI_EV_PKT_TYPE_CHANGE:
3020                 hci_pkt_type_change_evt(hdev, skb);
3021                 break;
3022
3023         case HCI_EV_PSCAN_REP_MODE:
3024                 hci_pscan_rep_mode_evt(hdev, skb);
3025                 break;
3026
3027         case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
3028                 hci_inquiry_result_with_rssi_evt(hdev, skb);
3029                 break;
3030
3031         case HCI_EV_REMOTE_EXT_FEATURES:
3032                 hci_remote_ext_features_evt(hdev, skb);
3033                 break;
3034
3035         case HCI_EV_SYNC_CONN_COMPLETE:
3036                 hci_sync_conn_complete_evt(hdev, skb);
3037                 break;
3038
3039         case HCI_EV_SYNC_CONN_CHANGED:
3040                 hci_sync_conn_changed_evt(hdev, skb);
3041                 break;
3042
3043         case HCI_EV_SNIFF_SUBRATE:
3044                 hci_sniff_subrate_evt(hdev, skb);
3045                 break;
3046
3047         case HCI_EV_EXTENDED_INQUIRY_RESULT:
3048                 hci_extended_inquiry_result_evt(hdev, skb);
3049                 break;
3050
3051         case HCI_EV_IO_CAPA_REQUEST:
3052                 hci_io_capa_request_evt(hdev, skb);
3053                 break;
3054
3055         case HCI_EV_IO_CAPA_REPLY:
3056                 hci_io_capa_reply_evt(hdev, skb);
3057                 break;
3058
3059         case HCI_EV_USER_CONFIRM_REQUEST:
3060                 hci_user_confirm_request_evt(hdev, skb);
3061                 break;
3062
3063         case HCI_EV_SIMPLE_PAIR_COMPLETE:
3064                 hci_simple_pair_complete_evt(hdev, skb);
3065                 break;
3066
3067         case HCI_EV_REMOTE_HOST_FEATURES:
3068                 hci_remote_host_features_evt(hdev, skb);
3069                 break;
3070
3071         case HCI_EV_LE_META:
3072                 hci_le_meta_evt(hdev, skb);
3073                 break;
3074
3075         case HCI_EV_REMOTE_OOB_DATA_REQUEST:
3076                 hci_remote_oob_data_request_evt(hdev, skb);
3077                 break;
3078
3079         default:
3080                 BT_DBG("%s event 0x%x", hdev->name, event);
3081                 break;
3082         }
3083
3084         kfree_skb(skb);
3085         hdev->stat.evt_rx++;
3086 }
3087
3088 /* Generate internal stack event */
3089 void hci_si_event(struct hci_dev *hdev, int type, int dlen, void *data)
3090 {
3091         struct hci_event_hdr *hdr;
3092         struct hci_ev_stack_internal *ev;
3093         struct sk_buff *skb;
3094
3095         skb = bt_skb_alloc(HCI_EVENT_HDR_SIZE + sizeof(*ev) + dlen, GFP_ATOMIC);
3096         if (!skb)
3097                 return;
3098
3099         hdr = (void *) skb_put(skb, HCI_EVENT_HDR_SIZE);
3100         hdr->evt  = HCI_EV_STACK_INTERNAL;
3101         hdr->plen = sizeof(*ev) + dlen;
3102
3103         ev  = (void *) skb_put(skb, sizeof(*ev) + dlen);
3104         ev->type = type;
3105         memcpy(ev->data, data, dlen);
3106
3107         bt_cb(skb)->incoming = 1;
3108         __net_timestamp(skb);
3109
3110         bt_cb(skb)->pkt_type = HCI_EVENT_PKT;
3111         skb->dev = (void *) hdev;
3112         hci_send_to_sock(hdev, skb, NULL);
3113         kfree_skb(skb);
3114 }
3115
3116 module_param(enable_le, bool, 0444);
3117 MODULE_PARM_DESC(enable_le, "Enable LE support");