net/bluetooth/hci_event.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI event handling. */
  26
  27 #include <asm/unaligned.h>
  28
  29 #include <net/bluetooth/bluetooth.h>
  30 #include <net/bluetooth/hci_core.h>
  31 #include <net/bluetooth/mgmt.h>
  32 #include <net/bluetooth/a2mp.h>
  33 #include <net/bluetooth/amp.h>
  34
  35 /* Handle HCI Event packets */
  36
  37 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
  38 {
  39         __u8 status = *((__u8 *) skb->data);
  40
  41         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  42
  43         if (status) {
  44                 hci_dev_lock(hdev);
  45                 mgmt_stop_discovery_failed(hdev, status);
  46                 hci_dev_unlock(hdev);
  47                 return;
  48         }
  49
  50         clear_bit(HCI_INQUIRY, &hdev->flags);
  51
  52         hci_dev_lock(hdev);
  53         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
  54         hci_dev_unlock(hdev);
  55
  56         hci_req_complete(hdev, HCI_OP_INQUIRY_CANCEL, status);
  57
  58         hci_conn_check_pending(hdev);
  59 }
  60
  61 static void hci_cc_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  62 {
  63         __u8 status = *((__u8 *) skb->data);
  64
  65         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  66
  67         if (status)
  68                 return;
  69
  70         set_bit(HCI_PERIODIC_INQ, &hdev->dev_flags);
  71 }
  72
  73 static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  74 {
  75         __u8 status = *((__u8 *) skb->data);
  76
  77         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  78
  79         if (status)
  80                 return;
  81
  82         clear_bit(HCI_PERIODIC_INQ, &hdev->dev_flags);
  83
  84         hci_conn_check_pending(hdev);
  85 }
  86
  87 static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev,
  88                                           struct sk_buff *skb)
  89 {
  90         BT_DBG("%s", hdev->name);
  91 }
  92
  93 static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
  94 {
  95         struct hci_rp_role_discovery *rp = (void *) skb->data;
  96         struct hci_conn *conn;
  97
  98         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
  99
 100         if (rp->status)
 101                 return;
 102
 103         hci_dev_lock(hdev);
 104
 105         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 106         if (conn) {
 107                 if (rp->role)
 108                         conn->link_mode &= ~HCI_LM_MASTER;
 109                 else
 110                         conn->link_mode |= HCI_LM_MASTER;
 111         }
 112
 113         hci_dev_unlock(hdev);
 114 }
 115
 116 static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 117 {
 118         struct hci_rp_read_link_policy *rp = (void *) skb->data;
 119         struct hci_conn *conn;
 120
 121         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 122
 123         if (rp->status)
 124                 return;
 125
 126         hci_dev_lock(hdev);
 127
 128         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 129         if (conn)
 130                 conn->link_policy = __le16_to_cpu(rp->policy);
 131
 132         hci_dev_unlock(hdev);
 133 }
 134
 135 static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 136 {
 137         struct hci_rp_write_link_policy *rp = (void *) skb->data;
 138         struct hci_conn *conn;
 139         void *sent;
 140
 141         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 142
 143         if (rp->status)
 144                 return;
 145
 146         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
 147         if (!sent)
 148                 return;
 149
 150         hci_dev_lock(hdev);
 151
 152         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 153         if (conn)
 154                 conn->link_policy = get_unaligned_le16(sent + 2);
 155
 156         hci_dev_unlock(hdev);
 157 }
 158
 159 static void hci_cc_read_def_link_policy(struct hci_dev *hdev,
 160                                         struct sk_buff *skb)
 161 {
 162         struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
 163
 164         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 165
 166         if (rp->status)
 167                 return;
 168
 169         hdev->link_policy = __le16_to_cpu(rp->policy);
 170 }
 171
 172 static void hci_cc_write_def_link_policy(struct hci_dev *hdev,
 173                                          struct sk_buff *skb)
 174 {
 175         __u8 status = *((__u8 *) skb->data);
 176         void *sent;
 177
 178         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 179
 180         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
 181         if (!sent)
 182                 return;
 183
 184         if (!status)
 185                 hdev->link_policy = get_unaligned_le16(sent);
 186
 187         hci_req_complete(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, status);
 188 }
 189
 190 static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
 191 {
 192         __u8 status = *((__u8 *) skb->data);
 193
 194         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 195
 196         clear_bit(HCI_RESET, &hdev->flags);
 197
 198         hci_req_complete(hdev, HCI_OP_RESET, status);
 199
 200         /* Reset all non-persistent flags */
 201         hdev->dev_flags &= ~(BIT(HCI_LE_SCAN) | BIT(HCI_PENDING_CLASS) |
 202                              BIT(HCI_PERIODIC_INQ));
 203
 204         hdev->discovery.state = DISCOVERY_STOPPED;
 205 }
 206
 207 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 208 {
 209         __u8 status = *((__u8 *) skb->data);
 210         void *sent;
 211
 212         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 213
 214         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
 215         if (!sent)
 216                 return;
 217
 218         hci_dev_lock(hdev);
 219
 220         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 221                 mgmt_set_local_name_complete(hdev, sent, status);
 222         else if (!status)
 223                 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
 224
 225         hci_dev_unlock(hdev);
 226
 227         hci_req_complete(hdev, HCI_OP_WRITE_LOCAL_NAME, status);
 228 }
 229
 230 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 231 {
 232         struct hci_rp_read_local_name *rp = (void *) skb->data;
 233
 234         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 235
 236         if (rp->status)
 237                 return;
 238
 239         if (test_bit(HCI_SETUP, &hdev->dev_flags))
 240                 memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
 241 }
 242
 243 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
 244 {
 245         __u8 status = *((__u8 *) skb->data);
 246         void *sent;
 247
 248         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 249
 250         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
 251         if (!sent)
 252                 return;
 253
 254         if (!status) {
 255                 __u8 param = *((__u8 *) sent);
 256
 257                 if (param == AUTH_ENABLED)
 258                         set_bit(HCI_AUTH, &hdev->flags);
 259                 else
 260                         clear_bit(HCI_AUTH, &hdev->flags);
 261         }
 262
 263         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 264                 mgmt_auth_enable_complete(hdev, status);
 265
 266         hci_req_complete(hdev, HCI_OP_WRITE_AUTH_ENABLE, status);
 267 }
 268
 269 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
 270 {
 271         __u8 status = *((__u8 *) skb->data);
 272         void *sent;
 273
 274         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 275
 276         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
 277         if (!sent)
 278                 return;
 279
 280         if (!status) {
 281                 __u8 param = *((__u8 *) sent);
 282
 283                 if (param)
 284                         set_bit(HCI_ENCRYPT, &hdev->flags);
 285                 else
 286                         clear_bit(HCI_ENCRYPT, &hdev->flags);
 287         }
 288
 289         hci_req_complete(hdev, HCI_OP_WRITE_ENCRYPT_MODE, status);
 290 }
 291
 292 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
 293 {
 294         __u8 param, status = *((__u8 *) skb->data);
 295         int old_pscan, old_iscan;
 296         void *sent;
 297
 298         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 299
 300         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
 301         if (!sent)
 302                 return;
 303
 304         param = *((__u8 *) sent);
 305
 306         hci_dev_lock(hdev);
 307
 308         if (status) {
 309                 mgmt_write_scan_failed(hdev, param, status);
 310                 hdev->discov_timeout = 0;
 311                 goto done;
 312         }
 313
 314         old_pscan = test_and_clear_bit(HCI_PSCAN, &hdev->flags);
 315         old_iscan = test_and_clear_bit(HCI_ISCAN, &hdev->flags);
 316
 317         if (param & SCAN_INQUIRY) {
 318                 set_bit(HCI_ISCAN, &hdev->flags);
 319                 if (!old_iscan)
 320                         mgmt_discoverable(hdev, 1);
 321                 if (hdev->discov_timeout > 0) {
 322                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
 323                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
 324                                            to);
 325                 }
 326         } else if (old_iscan)
 327                 mgmt_discoverable(hdev, 0);
 328
 329         if (param & SCAN_PAGE) {
 330                 set_bit(HCI_PSCAN, &hdev->flags);
 331                 if (!old_pscan)
 332                         mgmt_connectable(hdev, 1);
 333         } else if (old_pscan)
 334                 mgmt_connectable(hdev, 0);
 335
 336 done:
 337         hci_dev_unlock(hdev);
 338         hci_req_complete(hdev, HCI_OP_WRITE_SCAN_ENABLE, status);
 339 }
 340
 341 static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 342 {
 343         struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
 344
 345         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 346
 347         if (rp->status)
 348                 return;
 349
 350         memcpy(hdev->dev_class, rp->dev_class, 3);
 351
 352         BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
 353                hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
 354 }
 355
 356 static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 357 {
 358         __u8 status = *((__u8 *) skb->data);
 359         void *sent;
 360
 361         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 362
 363         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
 364         if (!sent)
 365                 return;
 366
 367         hci_dev_lock(hdev);
 368
 369         if (status == 0)
 370                 memcpy(hdev->dev_class, sent, 3);
 371
 372         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 373                 mgmt_set_class_of_dev_complete(hdev, sent, status);
 374
 375         hci_dev_unlock(hdev);
 376 }
 377
 378 static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 379 {
 380         struct hci_rp_read_voice_setting *rp = (void *) skb->data;
 381         __u16 setting;
 382
 383         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 384
 385         if (rp->status)
 386                 return;
 387
 388         setting = __le16_to_cpu(rp->voice_setting);
 389
 390         if (hdev->voice_setting == setting)
 391                 return;
 392
 393         hdev->voice_setting = setting;
 394
 395         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 396
 397         if (hdev->notify)
 398                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 399 }
 400
 401 static void hci_cc_write_voice_setting(struct hci_dev *hdev,
 402                                        struct sk_buff *skb)
 403 {
 404         __u8 status = *((__u8 *) skb->data);
 405         __u16 setting;
 406         void *sent;
 407
 408         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 409
 410         if (status)
 411                 return;
 412
 413         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
 414         if (!sent)
 415                 return;
 416
 417         setting = get_unaligned_le16(sent);
 418
 419         if (hdev->voice_setting == setting)
 420                 return;
 421
 422         hdev->voice_setting = setting;
 423
 424         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 425
 426         if (hdev->notify)
 427                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 428 }
 429
 430 static void hci_cc_host_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 431 {
 432         __u8 status = *((__u8 *) skb->data);
 433
 434         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 435
 436         hci_req_complete(hdev, HCI_OP_HOST_BUFFER_SIZE, status);
 437 }
 438
 439 static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 440 {
 441         __u8 status = *((__u8 *) skb->data);
 442         struct hci_cp_write_ssp_mode *sent;
 443
 444         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 445
 446         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
 447         if (!sent)
 448                 return;
 449
 450         if (!status) {
 451                 if (sent->mode)
 452                         hdev->host_features[0] |= LMP_HOST_SSP;
 453                 else
 454                         hdev->host_features[0] &= ~LMP_HOST_SSP;
 455         }
 456
 457         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 458                 mgmt_ssp_enable_complete(hdev, sent->mode, status);
 459         else if (!status) {
 460                 if (sent->mode)
 461                         set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
 462                 else
 463                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
 464         }
 465 }
 466
 467 static u8 hci_get_inquiry_mode(struct hci_dev *hdev)
 468 {
 469         if (lmp_ext_inq_capable(hdev))
 470                 return 2;
 471
 472         if (lmp_inq_rssi_capable(hdev))
 473                 return 1;
 474
 475         if (hdev->manufacturer == 11 && hdev->hci_rev == 0x00 &&
 476             hdev->lmp_subver == 0x0757)
 477                 return 1;
 478
 479         if (hdev->manufacturer == 15) {
 480                 if (hdev->hci_rev == 0x03 && hdev->lmp_subver == 0x6963)
 481                         return 1;
 482                 if (hdev->hci_rev == 0x09 && hdev->lmp_subver == 0x6963)
 483                         return 1;
 484                 if (hdev->hci_rev == 0x00 && hdev->lmp_subver == 0x6965)
 485                         return 1;
 486         }
 487
 488         if (hdev->manufacturer == 31 && hdev->hci_rev == 0x2005 &&
 489             hdev->lmp_subver == 0x1805)
 490                 return 1;
 491
 492         return 0;
 493 }
 494
 495 static void hci_setup_inquiry_mode(struct hci_dev *hdev)
 496 {
 497         u8 mode;
 498
 499         mode = hci_get_inquiry_mode(hdev);
 500
 501         hci_send_cmd(hdev, HCI_OP_WRITE_INQUIRY_MODE, 1, &mode);
 502 }
 503
 504 static void hci_setup_event_mask(struct hci_dev *hdev)
 505 {
 506         /* The second byte is 0xff instead of 0x9f (two reserved bits
 507          * disabled) since a Broadcom 1.2 dongle doesn't respond to the
 508          * command otherwise */
 509         u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };
 510
 511         /* CSR 1.1 dongles does not accept any bitfield so don't try to set
 512          * any event mask for pre 1.2 devices */
 513         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
 514                 return;
 515
 516         if (lmp_bredr_capable(hdev)) {
 517                 events[4] |= 0x01; /* Flow Specification Complete */
 518                 events[4] |= 0x02; /* Inquiry Result with RSSI */
 519                 events[4] |= 0x04; /* Read Remote Extended Features Complete */
 520                 events[5] |= 0x08; /* Synchronous Connection Complete */
 521                 events[5] |= 0x10; /* Synchronous Connection Changed */
 522         }
 523
 524         if (lmp_inq_rssi_capable(hdev))
 525                 events[4] |= 0x02; /* Inquiry Result with RSSI */
 526
 527         if (lmp_sniffsubr_capable(hdev))
 528                 events[5] |= 0x20; /* Sniff Subrating */
 529
 530         if (lmp_pause_enc_capable(hdev))
 531                 events[5] |= 0x80; /* Encryption Key Refresh Complete */
 532
 533         if (lmp_ext_inq_capable(hdev))
 534                 events[5] |= 0x40; /* Extended Inquiry Result */
 535
 536         if (lmp_no_flush_capable(hdev))
 537                 events[7] |= 0x01; /* Enhanced Flush Complete */
 538
 539         if (lmp_lsto_capable(hdev))
 540                 events[6] |= 0x80; /* Link Supervision Timeout Changed */
 541
 542         if (lmp_ssp_capable(hdev)) {
 543                 events[6] |= 0x01;      /* IO Capability Request */
 544                 events[6] |= 0x02;      /* IO Capability Response */
 545                 events[6] |= 0x04;      /* User Confirmation Request */
 546                 events[6] |= 0x08;      /* User Passkey Request */
 547                 events[6] |= 0x10;      /* Remote OOB Data Request */
 548                 events[6] |= 0x20;      /* Simple Pairing Complete */
 549                 events[7] |= 0x04;      /* User Passkey Notification */
 550                 events[7] |= 0x08;      /* Keypress Notification */
 551                 events[7] |= 0x10;      /* Remote Host Supported
 552                                          * Features Notification */
 553         }
 554
 555         if (lmp_le_capable(hdev))
 556                 events[7] |= 0x20;      /* LE Meta-Event */
 557
 558         hci_send_cmd(hdev, HCI_OP_SET_EVENT_MASK, sizeof(events), events);
 559
 560         if (lmp_le_capable(hdev)) {
 561                 memset(events, 0, sizeof(events));
 562                 events[0] = 0x1f;
 563                 hci_send_cmd(hdev, HCI_OP_LE_SET_EVENT_MASK,
 564                              sizeof(events), events);
 565         }
 566 }
 567
 568 static void bredr_setup(struct hci_dev *hdev)
 569 {
 570         struct hci_cp_delete_stored_link_key cp;
 571         __le16 param;
 572         __u8 flt_type;
 573
 574         /* Read Buffer Size (ACL mtu, max pkt, etc.) */
 575         hci_send_cmd(hdev, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
 576
 577         /* Read Class of Device */
 578         hci_send_cmd(hdev, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
 579
 580         /* Read Local Name */
 581         hci_send_cmd(hdev, HCI_OP_READ_LOCAL_NAME, 0, NULL);
 582
 583         /* Read Voice Setting */
 584         hci_send_cmd(hdev, HCI_OP_READ_VOICE_SETTING, 0, NULL);
 585
 586         /* Clear Event Filters */
 587         flt_type = HCI_FLT_CLEAR_ALL;
 588         hci_send_cmd(hdev, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
 589
 590         /* Connection accept timeout ~20 secs */
 591         param = __constant_cpu_to_le16(0x7d00);
 592         hci_send_cmd(hdev, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
 593
 594         bacpy(&cp.bdaddr, BDADDR_ANY);
 595         cp.delete_all = 1;
 596         hci_send_cmd(hdev, HCI_OP_DELETE_STORED_LINK_KEY, sizeof(cp), &cp);
 597 }
 598
 599 static void le_setup(struct hci_dev *hdev)
 600 {
 601         /* Read LE Buffer Size */
 602         hci_send_cmd(hdev, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
 603
 604         /* Read LE Advertising Channel TX Power */
 605         hci_send_cmd(hdev, HCI_OP_LE_READ_ADV_TX_POWER, 0, NULL);
 606 }
 607
 608 static void hci_setup(struct hci_dev *hdev)
 609 {
 610         if (hdev->dev_type != HCI_BREDR)
 611                 return;
 612
 613         /* Read BD Address */
 614         hci_send_cmd(hdev, HCI_OP_READ_BD_ADDR, 0, NULL);
 615
 616         if (lmp_bredr_capable(hdev))
 617                 bredr_setup(hdev);
 618
 619         if (lmp_le_capable(hdev))
 620                 le_setup(hdev);
 621
 622         hci_setup_event_mask(hdev);
 623
 624         if (hdev->hci_ver > BLUETOOTH_VER_1_1)
 625                 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
 626
 627         if (lmp_ssp_capable(hdev)) {
 628                 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
 629                         u8 mode = 0x01;
 630                         hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE,
 631                                      sizeof(mode), &mode);
 632                 } else {
 633                         struct hci_cp_write_eir cp;
 634
 635                         memset(hdev->eir, 0, sizeof(hdev->eir));
 636                         memset(&cp, 0, sizeof(cp));
 637
 638                         hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 639                 }
 640         }
 641
 642         if (lmp_inq_rssi_capable(hdev))
 643                 hci_setup_inquiry_mode(hdev);
 644
 645         if (lmp_inq_tx_pwr_capable(hdev))
 646                 hci_send_cmd(hdev, HCI_OP_READ_INQ_RSP_TX_POWER, 0, NULL);
 647
 648         if (lmp_ext_feat_capable(hdev)) {
 649                 struct hci_cp_read_local_ext_features cp;
 650
 651                 cp.page = 0x01;
 652                 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES, sizeof(cp),
 653                              &cp);
 654         }
 655
 656         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags)) {
 657                 u8 enable = 1;
 658                 hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(enable),
 659                              &enable);
 660         }
 661 }
 662
 663 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
 664 {
 665         struct hci_rp_read_local_version *rp = (void *) skb->data;
 666
 667         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 668
 669         if (rp->status)
 670                 goto done;
 671
 672         hdev->hci_ver = rp->hci_ver;
 673         hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
 674         hdev->lmp_ver = rp->lmp_ver;
 675         hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
 676         hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
 677
 678         BT_DBG("%s manufacturer 0x%4.4x hci ver %d:%d", hdev->name,
 679                hdev->manufacturer, hdev->hci_ver, hdev->hci_rev);
 680
 681         if (test_bit(HCI_INIT, &hdev->flags))
 682                 hci_setup(hdev);
 683
 684 done:
 685         hci_req_complete(hdev, HCI_OP_READ_LOCAL_VERSION, rp->status);
 686 }
 687
 688 static void hci_setup_link_policy(struct hci_dev *hdev)
 689 {
 690         struct hci_cp_write_def_link_policy cp;
 691         u16 link_policy = 0;
 692
 693         if (lmp_rswitch_capable(hdev))
 694                 link_policy |= HCI_LP_RSWITCH;
 695         if (lmp_hold_capable(hdev))
 696                 link_policy |= HCI_LP_HOLD;
 697         if (lmp_sniff_capable(hdev))
 698                 link_policy |= HCI_LP_SNIFF;
 699         if (lmp_park_capable(hdev))
 700                 link_policy |= HCI_LP_PARK;
 701
 702         cp.policy = cpu_to_le16(link_policy);
 703         hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, sizeof(cp), &cp);
 704 }
 705
 706 static void hci_cc_read_local_commands(struct hci_dev *hdev,
 707                                        struct sk_buff *skb)
 708 {
 709         struct hci_rp_read_local_commands *rp = (void *) skb->data;
 710
 711         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 712
 713         if (rp->status)
 714                 goto done;
 715
 716         memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 717
 718         if (test_bit(HCI_INIT, &hdev->flags) && (hdev->commands[5] & 0x10))
 719                 hci_setup_link_policy(hdev);
 720
 721 done:
 722         hci_req_complete(hdev, HCI_OP_READ_LOCAL_COMMANDS, rp->status);
 723 }
 724
 725 static void hci_cc_read_local_features(struct hci_dev *hdev,
 726                                        struct sk_buff *skb)
 727 {
 728         struct hci_rp_read_local_features *rp = (void *) skb->data;
 729
 730         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 731
 732         if (rp->status)
 733                 return;
 734
 735         memcpy(hdev->features, rp->features, 8);
 736
 737         /* Adjust default settings according to features
 738          * supported by device. */
 739
 740         if (hdev->features[0] & LMP_3SLOT)
 741                 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 742
 743         if (hdev->features[0] & LMP_5SLOT)
 744                 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 745
 746         if (hdev->features[1] & LMP_HV2) {
 747                 hdev->pkt_type  |= (HCI_HV2);
 748                 hdev->esco_type |= (ESCO_HV2);
 749         }
 750
 751         if (hdev->features[1] & LMP_HV3) {
 752                 hdev->pkt_type  |= (HCI_HV3);
 753                 hdev->esco_type |= (ESCO_HV3);
 754         }
 755
 756         if (lmp_esco_capable(hdev))
 757                 hdev->esco_type |= (ESCO_EV3);
 758
 759         if (hdev->features[4] & LMP_EV4)
 760                 hdev->esco_type |= (ESCO_EV4);
 761
 762         if (hdev->features[4] & LMP_EV5)
 763                 hdev->esco_type |= (ESCO_EV5);
 764
 765         if (hdev->features[5] & LMP_EDR_ESCO_2M)
 766                 hdev->esco_type |= (ESCO_2EV3);
 767
 768         if (hdev->features[5] & LMP_EDR_ESCO_3M)
 769                 hdev->esco_type |= (ESCO_3EV3);
 770
 771         if (hdev->features[5] & LMP_EDR_3S_ESCO)
 772                 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
 773
 774         BT_DBG("%s features 0x%.2x%.2x%.2x%.2x%.2x%.2x%.2x%.2x", hdev->name,
 775                hdev->features[0], hdev->features[1],
 776                hdev->features[2], hdev->features[3],
 777                hdev->features[4], hdev->features[5],
 778                hdev->features[6], hdev->features[7]);
 779 }
 780
 781 static void hci_set_le_support(struct hci_dev *hdev)
 782 {
 783         struct hci_cp_write_le_host_supported cp;
 784
 785         memset(&cp, 0, sizeof(cp));
 786
 787         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
 788                 cp.le = 1;
 789                 cp.simul = !!lmp_le_br_capable(hdev);
 790         }
 791
 792         if (cp.le != !!lmp_host_le_capable(hdev))
 793                 hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(cp),
 794                              &cp);
 795 }
 796
 797 static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
 798                                            struct sk_buff *skb)
 799 {
 800         struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
 801
 802         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 803
 804         if (rp->status)
 805                 goto done;
 806
 807         switch (rp->page) {
 808         case 0:
 809                 memcpy(hdev->features, rp->features, 8);
 810                 break;
 811         case 1:
 812                 memcpy(hdev->host_features, rp->features, 8);
 813                 break;
 814         }
 815
 816         if (test_bit(HCI_INIT, &hdev->flags) && lmp_le_capable(hdev))
 817                 hci_set_le_support(hdev);
 818
 819 done:
 820         hci_req_complete(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES, rp->status);
 821 }
 822
 823 static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
 824                                           struct sk_buff *skb)
 825 {
 826         struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;
 827
 828         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 829
 830         if (rp->status)
 831                 return;
 832
 833         hdev->flow_ctl_mode = rp->mode;
 834
 835         hci_req_complete(hdev, HCI_OP_READ_FLOW_CONTROL_MODE, rp->status);
 836 }
 837
 838 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 839 {
 840         struct hci_rp_read_buffer_size *rp = (void *) skb->data;
 841
 842         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 843
 844         if (rp->status)
 845                 return;
 846
 847         hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
 848         hdev->sco_mtu  = rp->sco_mtu;
 849         hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
 850         hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
 851
 852         if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
 853                 hdev->sco_mtu  = 64;
 854                 hdev->sco_pkts = 8;
 855         }
 856
 857         hdev->acl_cnt = hdev->acl_pkts;
 858         hdev->sco_cnt = hdev->sco_pkts;
 859
 860         BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
 861                hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
 862 }
 863
 864 static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
 865 {
 866         struct hci_rp_read_bd_addr *rp = (void *) skb->data;
 867
 868         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 869
 870         if (!rp->status)
 871                 bacpy(&hdev->bdaddr, &rp->bdaddr);
 872
 873         hci_req_complete(hdev, HCI_OP_READ_BD_ADDR, rp->status);
 874 }
 875
 876 static void hci_cc_read_data_block_size(struct hci_dev *hdev,
 877                                         struct sk_buff *skb)
 878 {
 879         struct hci_rp_read_data_block_size *rp = (void *) skb->data;
 880
 881         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 882
 883         if (rp->status)
 884                 return;
 885
 886         hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
 887         hdev->block_len = __le16_to_cpu(rp->block_len);
 888         hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
 889
 890         hdev->block_cnt = hdev->num_blocks;
 891
 892         BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
 893                hdev->block_cnt, hdev->block_len);
 894
 895         hci_req_complete(hdev, HCI_OP_READ_DATA_BLOCK_SIZE, rp->status);
 896 }
 897
 898 static void hci_cc_write_ca_timeout(struct hci_dev *hdev, struct sk_buff *skb)
 899 {
 900         __u8 status = *((__u8 *) skb->data);
 901
 902         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 903
 904         hci_req_complete(hdev, HCI_OP_WRITE_CA_TIMEOUT, status);
 905 }
 906
 907 static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
 908                                        struct sk_buff *skb)
 909 {
 910         struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
 911
 912         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 913
 914         if (rp->status)
 915                 goto a2mp_rsp;
 916
 917         hdev->amp_status = rp->amp_status;
 918         hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
 919         hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
 920         hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
 921         hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
 922         hdev->amp_type = rp->amp_type;
 923         hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
 924         hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
 925         hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
 926         hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
 927
 928         hci_req_complete(hdev, HCI_OP_READ_LOCAL_AMP_INFO, rp->status);
 929
 930 a2mp_rsp:
 931         a2mp_send_getinfo_rsp(hdev);
 932 }
 933
 934 static void hci_cc_read_local_amp_assoc(struct hci_dev *hdev,
 935                                         struct sk_buff *skb)
 936 {
 937         struct hci_rp_read_local_amp_assoc *rp = (void *) skb->data;
 938         struct amp_assoc *assoc = &hdev->loc_assoc;
 939         size_t rem_len, frag_len;
 940
 941         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 942
 943         if (rp->status)
 944                 goto a2mp_rsp;
 945
 946         frag_len = skb->len - sizeof(*rp);
 947         rem_len = __le16_to_cpu(rp->rem_len);
 948
 949         if (rem_len > frag_len) {
 950                 BT_DBG("frag_len %zu rem_len %zu", frag_len, rem_len);
 951
 952                 memcpy(assoc->data + assoc->offset, rp->frag, frag_len);
 953                 assoc->offset += frag_len;
 954
 955                 /* Read other fragments */
 956                 amp_read_loc_assoc_frag(hdev, rp->phy_handle);
 957
 958                 return;
 959         }
 960
 961         memcpy(assoc->data + assoc->offset, rp->frag, rem_len);
 962         assoc->len = assoc->offset + rem_len;
 963         assoc->offset = 0;
 964
 965 a2mp_rsp:
 966         /* Send A2MP Rsp when all fragments are received */
 967         a2mp_send_getampassoc_rsp(hdev, rp->status);
 968         a2mp_send_create_phy_link_req(hdev, rp->status);
 969 }
 970
 971 static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
 972                                           struct sk_buff *skb)
 973 {
 974         __u8 status = *((__u8 *) skb->data);
 975
 976         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 977
 978         hci_req_complete(hdev, HCI_OP_DELETE_STORED_LINK_KEY, status);
 979 }
 980
 981 static void hci_cc_set_event_mask(struct hci_dev *hdev, struct sk_buff *skb)
 982 {
 983         __u8 status = *((__u8 *) skb->data);
 984
 985         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 986
 987         hci_req_complete(hdev, HCI_OP_SET_EVENT_MASK, status);
 988 }
 989
 990 static void hci_cc_write_inquiry_mode(struct hci_dev *hdev,
 991                                       struct sk_buff *skb)
 992 {
 993         __u8 status = *((__u8 *) skb->data);
 994
 995         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 996
 997         hci_req_complete(hdev, HCI_OP_WRITE_INQUIRY_MODE, status);
 998 }
 999
1000 static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
1001                                          struct sk_buff *skb)
1002 {
1003         struct hci_rp_read_inq_rsp_tx_power *rp = (void *) skb->data;
1004
1005         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1006
1007         if (!rp->status)
1008                 hdev->inq_tx_power = rp->tx_power;
1009
1010         hci_req_complete(hdev, HCI_OP_READ_INQ_RSP_TX_POWER, rp->status);
1011 }
1012
1013 static void hci_cc_set_event_flt(struct hci_dev *hdev, struct sk_buff *skb)
1014 {
1015         __u8 status = *((__u8 *) skb->data);
1016
1017         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1018
1019         hci_req_complete(hdev, HCI_OP_SET_EVENT_FLT, status);
1020 }
1021
1022 static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
1023 {
1024         struct hci_rp_pin_code_reply *rp = (void *) skb->data;
1025         struct hci_cp_pin_code_reply *cp;
1026         struct hci_conn *conn;
1027
1028         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1029
1030         hci_dev_lock(hdev);
1031
1032         if (test_bit(HCI_MGMT, &hdev->dev_flags))
1033                 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
1034
1035         if (rp->status)
1036                 goto unlock;
1037
1038         cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
1039         if (!cp)
1040                 goto unlock;
1041
1042         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1043         if (conn)
1044                 conn->pin_length = cp->pin_len;
1045
1046 unlock:
1047         hci_dev_unlock(hdev);
1048 }
1049
1050 static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
1051 {
1052         struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
1053
1054         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1055
1056         hci_dev_lock(hdev);
1057
1058         if (test_bit(HCI_MGMT, &hdev->dev_flags))
1059                 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
1060                                                  rp->status);
1061
1062         hci_dev_unlock(hdev);
1063 }
1064
1065 static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
1066                                        struct sk_buff *skb)
1067 {
1068         struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
1069
1070         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1071
1072         if (rp->status)
1073                 return;
1074
1075         hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
1076         hdev->le_pkts = rp->le_max_pkt;
1077
1078         hdev->le_cnt = hdev->le_pkts;
1079
1080         BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
1081
1082         hci_req_complete(hdev, HCI_OP_LE_READ_BUFFER_SIZE, rp->status);
1083 }
1084
1085 static void hci_cc_le_read_adv_tx_power(struct hci_dev *hdev,
1086                                         struct sk_buff *skb)
1087 {
1088         struct hci_rp_le_read_adv_tx_power *rp = (void *) skb->data;
1089
1090         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1091
1092         if (!rp->status)
1093                 hdev->adv_tx_power = rp->tx_power;
1094
1095         hci_req_complete(hdev, HCI_OP_LE_READ_ADV_TX_POWER, rp->status);
1096 }
1097
1098 static void hci_cc_le_set_event_mask(struct hci_dev *hdev, struct sk_buff *skb)
1099 {
1100         __u8 status = *((__u8 *) skb->data);
1101
1102         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1103
1104         hci_req_complete(hdev, HCI_OP_LE_SET_EVENT_MASK, status);
1105 }
1106
1107 static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
1108 {
1109         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1110
1111         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1112
1113         hci_dev_lock(hdev);
1114
1115         if (test_bit(HCI_MGMT, &hdev->dev_flags))
1116                 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,
1117                                                  rp->status);
1118
1119         hci_dev_unlock(hdev);
1120 }
1121
1122 static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
1123                                           struct sk_buff *skb)
1124 {
1125         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1126
1127         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1128
1129         hci_dev_lock(hdev);
1130
1131         if (test_bit(HCI_MGMT, &hdev->dev_flags))
1132                 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
1133                                                      ACL_LINK, 0, rp->status);
1134
1135         hci_dev_unlock(hdev);
1136 }
1137
1138 static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
1139 {
1140         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1141
1142         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1143
1144         hci_dev_lock(hdev);
1145
1146         if (test_bit(HCI_MGMT, &hdev->dev_flags))
1147                 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
1148                                                  0, rp->status);
1149
1150         hci_dev_unlock(hdev);
1151 }
1152
1153 static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
1154                                           struct sk_buff *skb)
1155 {
1156         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1157
1158         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1159
1160         hci_dev_lock(hdev);
1161
1162         if (test_bit(HCI_MGMT, &hdev->dev_flags))
1163                 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
1164                                                      ACL_LINK, 0, rp->status);
1165
1166         hci_dev_unlock(hdev);
1167 }
1168
1169 static void hci_cc_read_local_oob_data_reply(struct hci_dev *hdev,
1170                                              struct sk_buff *skb)
1171 {
1172         struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
1173
1174         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1175
1176         hci_dev_lock(hdev);
1177         mgmt_read_local_oob_data_reply_complete(hdev, rp->hash,
1178                                                 rp->randomizer, rp->status);
1179         hci_dev_unlock(hdev);
1180 }
1181
1182 static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
1183 {
1184         __u8 status = *((__u8 *) skb->data);
1185
1186         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1187
1188         hci_req_complete(hdev, HCI_OP_LE_SET_SCAN_PARAM, status);
1189
1190         if (status) {
1191                 hci_dev_lock(hdev);
1192                 mgmt_start_discovery_failed(hdev, status);
1193                 hci_dev_unlock(hdev);
1194                 return;
1195         }
1196 }
1197
1198 static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
1199                                       struct sk_buff *skb)
1200 {
1201         struct hci_cp_le_set_scan_enable *cp;
1202         __u8 status = *((__u8 *) skb->data);
1203
1204         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1205
1206         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
1207         if (!cp)
1208                 return;
1209
1210         switch (cp->enable) {
1211         case LE_SCANNING_ENABLED:
1212                 hci_req_complete(hdev, HCI_OP_LE_SET_SCAN_ENABLE, status);
1213
1214                 if (status) {
1215                         hci_dev_lock(hdev);
1216                         mgmt_start_discovery_failed(hdev, status);
1217                         hci_dev_unlock(hdev);
1218                         return;
1219                 }
1220
1221                 set_bit(HCI_LE_SCAN, &hdev->dev_flags);
1222
1223                 hci_dev_lock(hdev);
1224                 hci_discovery_set_state(hdev, DISCOVERY_FINDING);
1225                 hci_dev_unlock(hdev);
1226                 break;
1227
1228         case LE_SCANNING_DISABLED:
1229                 if (status) {
1230                         hci_dev_lock(hdev);
1231                         mgmt_stop_discovery_failed(hdev, status);
1232                         hci_dev_unlock(hdev);
1233                         return;
1234                 }
1235
1236                 clear_bit(HCI_LE_SCAN, &hdev->dev_flags);
1237
1238                 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
1239                     hdev->discovery.state == DISCOVERY_FINDING) {
1240                         mgmt_interleaved_discovery(hdev);
1241                 } else {
1242                         hci_dev_lock(hdev);
1243                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1244                         hci_dev_unlock(hdev);
1245                 }
1246
1247                 break;
1248
1249         default:
1250                 BT_ERR("Used reserved LE_Scan_Enable param %d", cp->enable);
1251                 break;
1252         }
1253 }
1254
1255 static void hci_cc_le_ltk_reply(struct hci_dev *hdev, struct sk_buff *skb)
1256 {
1257         struct hci_rp_le_ltk_reply *rp = (void *) skb->data;
1258
1259         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1260
1261         if (rp->status)
1262                 return;
1263
1264         hci_req_complete(hdev, HCI_OP_LE_LTK_REPLY, rp->status);
1265 }
1266
1267 static void hci_cc_le_ltk_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
1268 {
1269         struct hci_rp_le_ltk_neg_reply *rp = (void *) skb->data;
1270
1271         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1272
1273         if (rp->status)
1274                 return;
1275
1276         hci_req_complete(hdev, HCI_OP_LE_LTK_NEG_REPLY, rp->status);
1277 }
1278
1279 static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
1280                                            struct sk_buff *skb)
1281 {
1282         struct hci_cp_write_le_host_supported *sent;
1283         __u8 status = *((__u8 *) skb->data);
1284
1285         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1286
1287         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
1288         if (!sent)
1289                 return;
1290
1291         if (!status) {
1292                 if (sent->le)
1293                         hdev->host_features[0] |= LMP_HOST_LE;
1294                 else
1295                         hdev->host_features[0] &= ~LMP_HOST_LE;
1296
1297                 if (sent->simul)
1298                         hdev->host_features[0] |= LMP_HOST_LE_BREDR;
1299                 else
1300                         hdev->host_features[0] &= ~LMP_HOST_LE_BREDR;
1301         }
1302
1303         if (test_bit(HCI_MGMT, &hdev->dev_flags) &&
1304             !test_bit(HCI_INIT, &hdev->flags))
1305                 mgmt_le_enable_complete(hdev, sent->le, status);
1306
1307         hci_req_complete(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, status);
1308 }
1309
1310 static void hci_cc_write_remote_amp_assoc(struct hci_dev *hdev,
1311                                           struct sk_buff *skb)
1312 {
1313         struct hci_rp_write_remote_amp_assoc *rp = (void *) skb->data;
1314
1315         BT_DBG("%s status 0x%2.2x phy_handle 0x%2.2x",
1316                hdev->name, rp->status, rp->phy_handle);
1317
1318         if (rp->status)
1319                 return;
1320
1321         amp_write_rem_assoc_continue(hdev, rp->phy_handle);
1322 }
1323
1324 static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
1325 {
1326         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1327
1328         if (status) {
1329                 hci_req_complete(hdev, HCI_OP_INQUIRY, status);
1330                 hci_conn_check_pending(hdev);
1331                 hci_dev_lock(hdev);
1332                 if (test_bit(HCI_MGMT, &hdev->dev_flags))
1333                         mgmt_start_discovery_failed(hdev, status);
1334                 hci_dev_unlock(hdev);
1335                 return;
1336         }
1337
1338         set_bit(HCI_INQUIRY, &hdev->flags);
1339
1340         hci_dev_lock(hdev);
1341         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
1342         hci_dev_unlock(hdev);
1343 }
1344
1345 static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
1346 {
1347         struct hci_cp_create_conn *cp;
1348         struct hci_conn *conn;
1349
1350         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1351
1352         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
1353         if (!cp)
1354                 return;
1355
1356         hci_dev_lock(hdev);
1357
1358         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1359
1360         BT_DBG("%s bdaddr %pMR hcon %p", hdev->name, &cp->bdaddr, conn);
1361
1362         if (status) {
1363                 if (conn && conn->state == BT_CONNECT) {
1364                         if (status != 0x0c || conn->attempt > 2) {
1365                                 conn->state = BT_CLOSED;
1366                                 hci_proto_connect_cfm(conn, status);
1367                                 hci_conn_del(conn);
1368                         } else
1369                                 conn->state = BT_CONNECT2;
1370                 }
1371         } else {
1372                 if (!conn) {
1373                         conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr);
1374                         if (conn) {
1375                                 conn->out = true;
1376                                 conn->link_mode |= HCI_LM_MASTER;
1377                         } else
1378                                 BT_ERR("No memory for new connection");
1379                 }
1380         }
1381
1382         hci_dev_unlock(hdev);
1383 }
1384
1385 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
1386 {
1387         struct hci_cp_add_sco *cp;
1388         struct hci_conn *acl, *sco;
1389         __u16 handle;
1390
1391         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1392
1393         if (!status)
1394                 return;
1395
1396         cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
1397         if (!cp)
1398                 return;
1399
1400         handle = __le16_to_cpu(cp->handle);
1401
1402         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1403
1404         hci_dev_lock(hdev);
1405
1406         acl = hci_conn_hash_lookup_handle(hdev, handle);
1407         if (acl) {
1408                 sco = acl->link;
1409                 if (sco) {
1410                         sco->state = BT_CLOSED;
1411
1412                         hci_proto_connect_cfm(sco, status);
1413                         hci_conn_del(sco);
1414                 }
1415         }
1416
1417         hci_dev_unlock(hdev);
1418 }
1419
1420 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
1421 {
1422         struct hci_cp_auth_requested *cp;
1423         struct hci_conn *conn;
1424
1425         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1426
1427         if (!status)
1428                 return;
1429
1430         cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
1431         if (!cp)
1432                 return;
1433
1434         hci_dev_lock(hdev);
1435
1436         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1437         if (conn) {
1438                 if (conn->state == BT_CONFIG) {
1439                         hci_proto_connect_cfm(conn, status);
1440                         hci_conn_put(conn);
1441                 }
1442         }
1443
1444         hci_dev_unlock(hdev);
1445 }
1446
1447 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
1448 {
1449         struct hci_cp_set_conn_encrypt *cp;
1450         struct hci_conn *conn;
1451
1452         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1453
1454         if (!status)
1455                 return;
1456
1457         cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
1458         if (!cp)
1459                 return;
1460
1461         hci_dev_lock(hdev);
1462
1463         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1464         if (conn) {
1465                 if (conn->state == BT_CONFIG) {
1466                         hci_proto_connect_cfm(conn, status);
1467                         hci_conn_put(conn);
1468                 }
1469         }
1470
1471         hci_dev_unlock(hdev);
1472 }
1473
1474 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
1475                                     struct hci_conn *conn)
1476 {
1477         if (conn->state != BT_CONFIG || !conn->out)
1478                 return 0;
1479
1480         if (conn->pending_sec_level == BT_SECURITY_SDP)
1481                 return 0;
1482
1483         /* Only request authentication for SSP connections or non-SSP
1484          * devices with sec_level HIGH or if MITM protection is requested */
1485         if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
1486             conn->pending_sec_level != BT_SECURITY_HIGH)
1487                 return 0;
1488
1489         return 1;
1490 }
1491
1492 static int hci_resolve_name(struct hci_dev *hdev,
1493                                    struct inquiry_entry *e)
1494 {
1495         struct hci_cp_remote_name_req cp;
1496
1497         memset(&cp, 0, sizeof(cp));
1498
1499         bacpy(&cp.bdaddr, &e->data.bdaddr);
1500         cp.pscan_rep_mode = e->data.pscan_rep_mode;
1501         cp.pscan_mode = e->data.pscan_mode;
1502         cp.clock_offset = e->data.clock_offset;
1503
1504         return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1505 }
1506
1507 static bool hci_resolve_next_name(struct hci_dev *hdev)
1508 {
1509         struct discovery_state *discov = &hdev->discovery;
1510         struct inquiry_entry *e;
1511
1512         if (list_empty(&discov->resolve))
1513                 return false;
1514
1515         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
1516         if (!e)
1517                 return false;
1518
1519         if (hci_resolve_name(hdev, e) == 0) {
1520                 e->name_state = NAME_PENDING;
1521                 return true;
1522         }
1523
1524         return false;
1525 }
1526
1527 static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
1528                                    bdaddr_t *bdaddr, u8 *name, u8 name_len)
1529 {
1530         struct discovery_state *discov = &hdev->discovery;
1531         struct inquiry_entry *e;
1532
1533         if (conn && !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
1534                 mgmt_device_connected(hdev, bdaddr, ACL_LINK, 0x00, 0, name,
1535                                       name_len, conn->dev_class);
1536
1537         if (discov->state == DISCOVERY_STOPPED)
1538                 return;
1539
1540         if (discov->state == DISCOVERY_STOPPING)
1541                 goto discov_complete;
1542
1543         if (discov->state != DISCOVERY_RESOLVING)
1544                 return;
1545
1546         e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
1547         /* If the device was not found in a list of found devices names of which
1548          * are pending. there is no need to continue resolving a next name as it
1549          * will be done upon receiving another Remote Name Request Complete
1550          * Event */
1551         if (!e)
1552                 return;
1553
1554         list_del(&e->list);
1555         if (name) {
1556                 e->name_state = NAME_KNOWN;
1557                 mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
1558                                  e->data.rssi, name, name_len);
1559         } else {
1560                 e->name_state = NAME_NOT_KNOWN;
1561         }
1562
1563         if (hci_resolve_next_name(hdev))
1564                 return;
1565
1566 discov_complete:
1567         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1568 }
1569
1570 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
1571 {
1572         struct hci_cp_remote_name_req *cp;
1573         struct hci_conn *conn;
1574
1575         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1576
1577         /* If successful wait for the name req complete event before
1578          * checking for the need to do authentication */
1579         if (!status)
1580                 return;
1581
1582         cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
1583         if (!cp)
1584                 return;
1585
1586         hci_dev_lock(hdev);
1587
1588         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1589
1590         if (test_bit(HCI_MGMT, &hdev->dev_flags))
1591                 hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
1592
1593         if (!conn)
1594                 goto unlock;
1595
1596         if (!hci_outgoing_auth_needed(hdev, conn))
1597                 goto unlock;
1598
1599         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
1600                 struct hci_cp_auth_requested cp;
1601                 cp.handle = __cpu_to_le16(conn->handle);
1602                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
1603         }
1604
1605 unlock:
1606         hci_dev_unlock(hdev);
1607 }
1608
1609 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
1610 {
1611         struct hci_cp_read_remote_features *cp;
1612         struct hci_conn *conn;
1613
1614         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1615
1616         if (!status)
1617                 return;
1618
1619         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
1620         if (!cp)
1621                 return;
1622
1623         hci_dev_lock(hdev);
1624
1625         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1626         if (conn) {
1627                 if (conn->state == BT_CONFIG) {
1628                         hci_proto_connect_cfm(conn, status);
1629                         hci_conn_put(conn);
1630                 }
1631         }
1632
1633         hci_dev_unlock(hdev);
1634 }
1635
1636 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
1637 {
1638         struct hci_cp_read_remote_ext_features *cp;
1639         struct hci_conn *conn;
1640
1641         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1642
1643         if (!status)
1644                 return;
1645
1646         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
1647         if (!cp)
1648                 return;
1649
1650         hci_dev_lock(hdev);
1651
1652         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1653         if (conn) {
1654                 if (conn->state == BT_CONFIG) {
1655                         hci_proto_connect_cfm(conn, status);
1656                         hci_conn_put(conn);
1657                 }
1658         }
1659
1660         hci_dev_unlock(hdev);
1661 }
1662
1663 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
1664 {
1665         struct hci_cp_setup_sync_conn *cp;
1666         struct hci_conn *acl, *sco;
1667         __u16 handle;
1668
1669         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1670
1671         if (!status)
1672                 return;
1673
1674         cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
1675         if (!cp)
1676                 return;
1677
1678         handle = __le16_to_cpu(cp->handle);
1679
1680         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1681
1682         hci_dev_lock(hdev);
1683
1684         acl = hci_conn_hash_lookup_handle(hdev, handle);
1685         if (acl) {
1686                 sco = acl->link;
1687                 if (sco) {
1688                         sco->state = BT_CLOSED;
1689
1690                         hci_proto_connect_cfm(sco, status);
1691                         hci_conn_del(sco);
1692                 }
1693         }
1694
1695         hci_dev_unlock(hdev);
1696 }
1697
1698 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
1699 {
1700         struct hci_cp_sniff_mode *cp;
1701         struct hci_conn *conn;
1702
1703         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1704
1705         if (!status)
1706                 return;
1707
1708         cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
1709         if (!cp)
1710                 return;
1711
1712         hci_dev_lock(hdev);
1713
1714         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1715         if (conn) {
1716                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1717
1718                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
1719                         hci_sco_setup(conn, status);
1720         }
1721
1722         hci_dev_unlock(hdev);
1723 }
1724
1725 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
1726 {
1727         struct hci_cp_exit_sniff_mode *cp;
1728         struct hci_conn *conn;
1729
1730         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1731
1732         if (!status)
1733                 return;
1734
1735         cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
1736         if (!cp)
1737                 return;
1738
1739         hci_dev_lock(hdev);
1740
1741         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1742         if (conn) {
1743                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1744
1745                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
1746                         hci_sco_setup(conn, status);
1747         }
1748
1749         hci_dev_unlock(hdev);
1750 }
1751
1752 static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
1753 {
1754         struct hci_cp_disconnect *cp;
1755         struct hci_conn *conn;
1756
1757         if (!status)
1758                 return;
1759
1760         cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
1761         if (!cp)
1762                 return;
1763
1764         hci_dev_lock(hdev);
1765
1766         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1767         if (conn)
1768                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
1769                                        conn->dst_type, status);
1770
1771         hci_dev_unlock(hdev);
1772 }
1773
1774 static void hci_cs_le_create_conn(struct hci_dev *hdev, __u8 status)
1775 {
1776         struct hci_conn *conn;
1777
1778         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1779
1780         if (status) {
1781                 hci_dev_lock(hdev);
1782
1783                 conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
1784                 if (!conn) {
1785                         hci_dev_unlock(hdev);
1786                         return;
1787                 }
1788
1789                 BT_DBG("%s bdaddr %pMR conn %p", hdev->name, &conn->dst, conn);
1790
1791                 conn->state = BT_CLOSED;
1792                 mgmt_connect_failed(hdev, &conn->dst, conn->type,
1793                                     conn->dst_type, status);
1794                 hci_proto_connect_cfm(conn, status);
1795                 hci_conn_del(conn);
1796
1797                 hci_dev_unlock(hdev);
1798         }
1799 }
1800
1801 static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
1802 {
1803         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1804 }
1805
1806 static void hci_cs_create_phylink(struct hci_dev *hdev, u8 status)
1807 {
1808         struct hci_cp_create_phy_link *cp;
1809
1810         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1811
1812         if (status)
1813                 return;
1814
1815         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_PHY_LINK);
1816         if (!cp)
1817                 return;
1818
1819         amp_write_remote_assoc(hdev, cp->phy_handle);
1820 }
1821
1822 static void hci_cs_accept_phylink(struct hci_dev *hdev, u8 status)
1823 {
1824         struct hci_cp_accept_phy_link *cp;
1825
1826         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1827
1828         if (status)
1829                 return;
1830
1831         cp = hci_sent_cmd_data(hdev, HCI_OP_ACCEPT_PHY_LINK);
1832         if (!cp)
1833                 return;
1834
1835         amp_write_remote_assoc(hdev, cp->phy_handle);
1836 }
1837
1838 static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1839 {
1840         __u8 status = *((__u8 *) skb->data);
1841         struct discovery_state *discov = &hdev->discovery;
1842         struct inquiry_entry *e;
1843
1844         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1845
1846         hci_req_complete(hdev, HCI_OP_INQUIRY, status);
1847
1848         hci_conn_check_pending(hdev);
1849
1850         if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
1851                 return;
1852
1853         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
1854                 return;
1855
1856         hci_dev_lock(hdev);
1857
1858         if (discov->state != DISCOVERY_FINDING)
1859                 goto unlock;
1860
1861         if (list_empty(&discov->resolve)) {
1862                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1863                 goto unlock;
1864         }
1865
1866         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
1867         if (e && hci_resolve_name(hdev, e) == 0) {
1868                 e->name_state = NAME_PENDING;
1869                 hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
1870         } else {
1871                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1872         }
1873
1874 unlock:
1875         hci_dev_unlock(hdev);
1876 }
1877
1878 static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
1879 {
1880         struct inquiry_data data;
1881         struct inquiry_info *info = (void *) (skb->data + 1);
1882         int num_rsp = *((__u8 *) skb->data);
1883
1884         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
1885
1886         if (!num_rsp)
1887                 return;
1888
1889         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
1890                 return;
1891
1892         hci_dev_lock(hdev);
1893
1894         for (; num_rsp; num_rsp--, info++) {
1895                 bool name_known, ssp;
1896
1897                 bacpy(&data.bdaddr, &info->bdaddr);
1898                 data.pscan_rep_mode     = info->pscan_rep_mode;
1899                 data.pscan_period_mode  = info->pscan_period_mode;
1900                 data.pscan_mode         = info->pscan_mode;
1901                 memcpy(data.dev_class, info->dev_class, 3);
1902                 data.clock_offset       = info->clock_offset;
1903                 data.rssi               = 0x00;
1904                 data.ssp_mode           = 0x00;
1905
1906                 name_known = hci_inquiry_cache_update(hdev, &data, false, &ssp);
1907                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
1908                                   info->dev_class, 0, !name_known, ssp, NULL,
1909                                   0);
1910         }
1911
1912         hci_dev_unlock(hdev);
1913 }
1914
1915 static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1916 {
1917         struct hci_ev_conn_complete *ev = (void *) skb->data;
1918         struct hci_conn *conn;
1919
1920         BT_DBG("%s", hdev->name);
1921
1922         hci_dev_lock(hdev);
1923
1924         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
1925         if (!conn) {
1926                 if (ev->link_type != SCO_LINK)
1927                         goto unlock;
1928
1929                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
1930                 if (!conn)
1931                         goto unlock;
1932
1933                 conn->type = SCO_LINK;
1934         }
1935
1936         if (!ev->status) {
1937                 conn->handle = __le16_to_cpu(ev->handle);
1938
1939                 if (conn->type == ACL_LINK) {
1940                         conn->state = BT_CONFIG;
1941                         hci_conn_hold(conn);
1942
1943                         if (!conn->out && !hci_conn_ssp_enabled(conn) &&
1944                             !hci_find_link_key(hdev, &ev->bdaddr))
1945                                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
1946                         else
1947                                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
1948                 } else
1949                         conn->state = BT_CONNECTED;
1950
1951                 hci_conn_hold_device(conn);
1952                 hci_conn_add_sysfs(conn);
1953
1954                 if (test_bit(HCI_AUTH, &hdev->flags))
1955                         conn->link_mode |= HCI_LM_AUTH;
1956
1957                 if (test_bit(HCI_ENCRYPT, &hdev->flags))
1958                         conn->link_mode |= HCI_LM_ENCRYPT;
1959
1960                 /* Get remote features */
1961                 if (conn->type == ACL_LINK) {
1962                         struct hci_cp_read_remote_features cp;
1963                         cp.handle = ev->handle;
1964                         hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
1965                                      sizeof(cp), &cp);
1966                 }
1967
1968                 /* Set packet type for incoming connection */
1969                 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
1970                         struct hci_cp_change_conn_ptype cp;
1971                         cp.handle = ev->handle;
1972                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
1973                         hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
1974                                      &cp);
1975                 }
1976         } else {
1977                 conn->state = BT_CLOSED;
1978                 if (conn->type == ACL_LINK)
1979                         mgmt_connect_failed(hdev, &ev->bdaddr, conn->type,
1980                                             conn->dst_type, ev->status);
1981         }
1982
1983         if (conn->type == ACL_LINK)
1984                 hci_sco_setup(conn, ev->status);
1985
1986         if (ev->status) {
1987                 hci_proto_connect_cfm(conn, ev->status);
1988                 hci_conn_del(conn);
1989         } else if (ev->link_type != ACL_LINK)
1990                 hci_proto_connect_cfm(conn, ev->status);
1991
1992 unlock:
1993         hci_dev_unlock(hdev);
1994
1995         hci_conn_check_pending(hdev);
1996 }
1997
1998 static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
1999 {
2000         struct hci_ev_conn_request *ev = (void *) skb->data;
2001         int mask = hdev->link_mode;
2002
2003         BT_DBG("%s bdaddr %pMR type 0x%x", hdev->name, &ev->bdaddr,
2004                ev->link_type);
2005
2006         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type);
2007
2008         if ((mask & HCI_LM_ACCEPT) &&
2009             !hci_blacklist_lookup(hdev, &ev->bdaddr)) {
2010                 /* Connection accepted */
2011                 struct inquiry_entry *ie;
2012                 struct hci_conn *conn;
2013
2014                 hci_dev_lock(hdev);
2015
2016                 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2017                 if (ie)
2018                         memcpy(ie->data.dev_class, ev->dev_class, 3);
2019
2020                 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
2021                                                &ev->bdaddr);
2022                 if (!conn) {
2023                         conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr);
2024                         if (!conn) {
2025                                 BT_ERR("No memory for new connection");
2026                                 hci_dev_unlock(hdev);
2027                                 return;
2028                         }
2029                 }
2030
2031                 memcpy(conn->dev_class, ev->dev_class, 3);
2032                 conn->state = BT_CONNECT;
2033
2034                 hci_dev_unlock(hdev);
2035
2036                 if (ev->link_type == ACL_LINK || !lmp_esco_capable(hdev)) {
2037                         struct hci_cp_accept_conn_req cp;
2038
2039                         bacpy(&cp.bdaddr, &ev->bdaddr);
2040
2041                         if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
2042                                 cp.role = 0x00; /* Become master */
2043                         else
2044                                 cp.role = 0x01; /* Remain slave */
2045
2046                         hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp),
2047                                      &cp);
2048                 } else {
2049                         struct hci_cp_accept_sync_conn_req cp;
2050
2051                         bacpy(&cp.bdaddr, &ev->bdaddr);
2052                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
2053
2054                         cp.tx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
2055                         cp.rx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
2056                         cp.max_latency    = __constant_cpu_to_le16(0xffff);
2057                         cp.content_format = cpu_to_le16(hdev->voice_setting);
2058                         cp.retrans_effort = 0xff;
2059
2060                         hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ,
2061                                      sizeof(cp), &cp);
2062                 }
2063         } else {
2064                 /* Connection rejected */
2065                 struct hci_cp_reject_conn_req cp;
2066
2067                 bacpy(&cp.bdaddr, &ev->bdaddr);
2068                 cp.reason = HCI_ERROR_REJ_BAD_ADDR;
2069                 hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
2070         }
2071 }
2072
2073 static u8 hci_to_mgmt_reason(u8 err)
2074 {
2075         switch (err) {
2076         case HCI_ERROR_CONNECTION_TIMEOUT:
2077                 return MGMT_DEV_DISCONN_TIMEOUT;
2078         case HCI_ERROR_REMOTE_USER_TERM:
2079         case HCI_ERROR_REMOTE_LOW_RESOURCES:
2080         case HCI_ERROR_REMOTE_POWER_OFF:
2081                 return MGMT_DEV_DISCONN_REMOTE;
2082         case HCI_ERROR_LOCAL_HOST_TERM:
2083                 return MGMT_DEV_DISCONN_LOCAL_HOST;
2084         default:
2085                 return MGMT_DEV_DISCONN_UNKNOWN;
2086         }
2087 }
2088
2089 static void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2090 {
2091         struct hci_ev_disconn_complete *ev = (void *) skb->data;
2092         struct hci_conn *conn;
2093
2094         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2095
2096         hci_dev_lock(hdev);
2097
2098         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2099         if (!conn)
2100                 goto unlock;
2101
2102         if (ev->status == 0)
2103                 conn->state = BT_CLOSED;
2104
2105         if (test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags) &&
2106             (conn->type == ACL_LINK || conn->type == LE_LINK)) {
2107                 if (ev->status) {
2108                         mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2109                                                conn->dst_type, ev->status);
2110                 } else {
2111                         u8 reason = hci_to_mgmt_reason(ev->reason);
2112
2113                         mgmt_device_disconnected(hdev, &conn->dst, conn->type,
2114                                                  conn->dst_type, reason);
2115                 }
2116         }
2117
2118         if (ev->status == 0) {
2119                 if (conn->type == ACL_LINK && conn->flush_key)
2120                         hci_remove_link_key(hdev, &conn->dst);
2121                 hci_proto_disconn_cfm(conn, ev->reason);
2122                 hci_conn_del(conn);
2123         }
2124
2125 unlock:
2126         hci_dev_unlock(hdev);
2127 }
2128
2129 static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2130 {
2131         struct hci_ev_auth_complete *ev = (void *) skb->data;
2132         struct hci_conn *conn;
2133
2134         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2135
2136         hci_dev_lock(hdev);
2137
2138         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2139         if (!conn)
2140                 goto unlock;
2141
2142         if (!ev->status) {
2143                 if (!hci_conn_ssp_enabled(conn) &&
2144                     test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
2145                         BT_INFO("re-auth of legacy device is not possible.");
2146                 } else {
2147                         conn->link_mode |= HCI_LM_AUTH;
2148                         conn->sec_level = conn->pending_sec_level;
2149                 }
2150         } else {
2151                 mgmt_auth_failed(hdev, &conn->dst, conn->type, conn->dst_type,
2152                                  ev->status);
2153         }
2154
2155         clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
2156         clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
2157
2158         if (conn->state == BT_CONFIG) {
2159                 if (!ev->status && hci_conn_ssp_enabled(conn)) {
2160                         struct hci_cp_set_conn_encrypt cp;
2161                         cp.handle  = ev->handle;
2162                         cp.encrypt = 0x01;
2163                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2164                                      &cp);
2165                 } else {
2166                         conn->state = BT_CONNECTED;
2167                         hci_proto_connect_cfm(conn, ev->status);
2168                         hci_conn_put(conn);
2169                 }
2170         } else {
2171                 hci_auth_cfm(conn, ev->status);
2172
2173                 hci_conn_hold(conn);
2174                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2175                 hci_conn_put(conn);
2176         }
2177
2178         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
2179                 if (!ev->status) {
2180                         struct hci_cp_set_conn_encrypt cp;
2181                         cp.handle  = ev->handle;
2182                         cp.encrypt = 0x01;
2183                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2184                                      &cp);
2185                 } else {
2186                         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2187                         hci_encrypt_cfm(conn, ev->status, 0x00);
2188                 }
2189         }
2190
2191 unlock:
2192         hci_dev_unlock(hdev);
2193 }
2194
2195 static void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
2196 {
2197         struct hci_ev_remote_name *ev = (void *) skb->data;
2198         struct hci_conn *conn;
2199
2200         BT_DBG("%s", hdev->name);
2201
2202         hci_conn_check_pending(hdev);
2203
2204         hci_dev_lock(hdev);
2205
2206         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2207
2208         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
2209                 goto check_auth;
2210
2211         if (ev->status == 0)
2212                 hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
2213                                        strnlen(ev->name, HCI_MAX_NAME_LENGTH));
2214         else
2215                 hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
2216
2217 check_auth:
2218         if (!conn)
2219                 goto unlock;
2220
2221         if (!hci_outgoing_auth_needed(hdev, conn))
2222                 goto unlock;
2223
2224         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
2225                 struct hci_cp_auth_requested cp;
2226                 cp.handle = __cpu_to_le16(conn->handle);
2227                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
2228         }
2229
2230 unlock:
2231         hci_dev_unlock(hdev);
2232 }
2233
2234 static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2235 {
2236         struct hci_ev_encrypt_change *ev = (void *) skb->data;
2237         struct hci_conn *conn;
2238
2239         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2240
2241         hci_dev_lock(hdev);
2242
2243         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2244         if (conn) {
2245                 if (!ev->status) {
2246                         if (ev->encrypt) {
2247                                 /* Encryption implies authentication */
2248                                 conn->link_mode |= HCI_LM_AUTH;
2249                                 conn->link_mode |= HCI_LM_ENCRYPT;
2250                                 conn->sec_level = conn->pending_sec_level;
2251                         } else
2252                                 conn->link_mode &= ~HCI_LM_ENCRYPT;
2253                 }
2254
2255                 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2256
2257                 if (ev->status && conn->state == BT_CONNECTED) {
2258                         hci_acl_disconn(conn, HCI_ERROR_AUTH_FAILURE);
2259                         hci_conn_put(conn);
2260                         goto unlock;
2261                 }
2262
2263                 if (conn->state == BT_CONFIG) {
2264                         if (!ev->status)
2265                                 conn->state = BT_CONNECTED;
2266
2267                         hci_proto_connect_cfm(conn, ev->status);
2268                         hci_conn_put(conn);
2269                 } else
2270                         hci_encrypt_cfm(conn, ev->status, ev->encrypt);
2271         }
2272
2273 unlock:
2274         hci_dev_unlock(hdev);
2275 }
2276
2277 static void hci_change_link_key_complete_evt(struct hci_dev *hdev,
2278                                              struct sk_buff *skb)
2279 {
2280         struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
2281         struct hci_conn *conn;
2282
2283         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2284
2285         hci_dev_lock(hdev);
2286
2287         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2288         if (conn) {
2289                 if (!ev->status)
2290                         conn->link_mode |= HCI_LM_SECURE;
2291
2292                 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
2293
2294                 hci_key_change_cfm(conn, ev->status);
2295         }
2296
2297         hci_dev_unlock(hdev);
2298 }
2299
2300 static void hci_remote_features_evt(struct hci_dev *hdev,
2301                                     struct sk_buff *skb)
2302 {
2303         struct hci_ev_remote_features *ev = (void *) skb->data;
2304         struct hci_conn *conn;
2305
2306         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2307
2308         hci_dev_lock(hdev);
2309
2310         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2311         if (!conn)
2312                 goto unlock;
2313
2314         if (!ev->status)
2315                 memcpy(conn->features, ev->features, 8);
2316
2317         if (conn->state != BT_CONFIG)
2318                 goto unlock;
2319
2320         if (!ev->status && lmp_ssp_capable(hdev) && lmp_ssp_capable(conn)) {
2321                 struct hci_cp_read_remote_ext_features cp;
2322                 cp.handle = ev->handle;
2323                 cp.page = 0x01;
2324                 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
2325                              sizeof(cp), &cp);
2326                 goto unlock;
2327         }
2328
2329         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
2330                 struct hci_cp_remote_name_req cp;
2331                 memset(&cp, 0, sizeof(cp));
2332                 bacpy(&cp.bdaddr, &conn->dst);
2333                 cp.pscan_rep_mode = 0x02;
2334                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2335         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2336                 mgmt_device_connected(hdev, &conn->dst, conn->type,
2337                                       conn->dst_type, 0, NULL, 0,
2338                                       conn->dev_class);
2339
2340         if (!hci_outgoing_auth_needed(hdev, conn)) {
2341                 conn->state = BT_CONNECTED;
2342                 hci_proto_connect_cfm(conn, ev->status);
2343                 hci_conn_put(conn);
2344         }
2345
2346 unlock:
2347         hci_dev_unlock(hdev);
2348 }
2349
2350 static void hci_remote_version_evt(struct hci_dev *hdev, struct sk_buff *skb)
2351 {
2352         BT_DBG("%s", hdev->name);
2353 }
2354
2355 static void hci_qos_setup_complete_evt(struct hci_dev *hdev,
2356                                        struct sk_buff *skb)
2357 {
2358         BT_DBG("%s", hdev->name);
2359 }
2360
2361 static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2362 {
2363         struct hci_ev_cmd_complete *ev = (void *) skb->data;
2364         __u16 opcode;
2365
2366         skb_pull(skb, sizeof(*ev));
2367
2368         opcode = __le16_to_cpu(ev->opcode);
2369
2370         switch (opcode) {
2371         case HCI_OP_INQUIRY_CANCEL:
2372                 hci_cc_inquiry_cancel(hdev, skb);
2373                 break;
2374
2375         case HCI_OP_PERIODIC_INQ:
2376                 hci_cc_periodic_inq(hdev, skb);
2377                 break;
2378
2379         case HCI_OP_EXIT_PERIODIC_INQ:
2380                 hci_cc_exit_periodic_inq(hdev, skb);
2381                 break;
2382
2383         case HCI_OP_REMOTE_NAME_REQ_CANCEL:
2384                 hci_cc_remote_name_req_cancel(hdev, skb);
2385                 break;
2386
2387         case HCI_OP_ROLE_DISCOVERY:
2388                 hci_cc_role_discovery(hdev, skb);
2389                 break;
2390
2391         case HCI_OP_READ_LINK_POLICY:
2392                 hci_cc_read_link_policy(hdev, skb);
2393                 break;
2394
2395         case HCI_OP_WRITE_LINK_POLICY:
2396                 hci_cc_write_link_policy(hdev, skb);
2397                 break;
2398
2399         case HCI_OP_READ_DEF_LINK_POLICY:
2400                 hci_cc_read_def_link_policy(hdev, skb);
2401                 break;
2402
2403         case HCI_OP_WRITE_DEF_LINK_POLICY:
2404                 hci_cc_write_def_link_policy(hdev, skb);
2405                 break;
2406
2407         case HCI_OP_RESET:
2408                 hci_cc_reset(hdev, skb);
2409                 break;
2410
2411         case HCI_OP_WRITE_LOCAL_NAME:
2412                 hci_cc_write_local_name(hdev, skb);
2413                 break;
2414
2415         case HCI_OP_READ_LOCAL_NAME:
2416                 hci_cc_read_local_name(hdev, skb);
2417                 break;
2418
2419         case HCI_OP_WRITE_AUTH_ENABLE:
2420                 hci_cc_write_auth_enable(hdev, skb);
2421                 break;
2422
2423         case HCI_OP_WRITE_ENCRYPT_MODE:
2424                 hci_cc_write_encrypt_mode(hdev, skb);
2425                 break;
2426
2427         case HCI_OP_WRITE_SCAN_ENABLE:
2428                 hci_cc_write_scan_enable(hdev, skb);
2429                 break;
2430
2431         case HCI_OP_READ_CLASS_OF_DEV:
2432                 hci_cc_read_class_of_dev(hdev, skb);
2433                 break;
2434
2435         case HCI_OP_WRITE_CLASS_OF_DEV:
2436                 hci_cc_write_class_of_dev(hdev, skb);
2437                 break;
2438
2439         case HCI_OP_READ_VOICE_SETTING:
2440                 hci_cc_read_voice_setting(hdev, skb);
2441                 break;
2442
2443         case HCI_OP_WRITE_VOICE_SETTING:
2444                 hci_cc_write_voice_setting(hdev, skb);
2445                 break;
2446
2447         case HCI_OP_HOST_BUFFER_SIZE:
2448                 hci_cc_host_buffer_size(hdev, skb);
2449                 break;
2450
2451         case HCI_OP_WRITE_SSP_MODE:
2452                 hci_cc_write_ssp_mode(hdev, skb);
2453                 break;
2454
2455         case HCI_OP_READ_LOCAL_VERSION:
2456                 hci_cc_read_local_version(hdev, skb);
2457                 break;
2458
2459         case HCI_OP_READ_LOCAL_COMMANDS:
2460                 hci_cc_read_local_commands(hdev, skb);
2461                 break;
2462
2463         case HCI_OP_READ_LOCAL_FEATURES:
2464                 hci_cc_read_local_features(hdev, skb);
2465                 break;
2466
2467         case HCI_OP_READ_LOCAL_EXT_FEATURES:
2468                 hci_cc_read_local_ext_features(hdev, skb);
2469                 break;
2470
2471         case HCI_OP_READ_BUFFER_SIZE:
2472                 hci_cc_read_buffer_size(hdev, skb);
2473                 break;
2474
2475         case HCI_OP_READ_BD_ADDR:
2476                 hci_cc_read_bd_addr(hdev, skb);
2477                 break;
2478
2479         case HCI_OP_READ_DATA_BLOCK_SIZE:
2480                 hci_cc_read_data_block_size(hdev, skb);
2481                 break;
2482
2483         case HCI_OP_WRITE_CA_TIMEOUT:
2484                 hci_cc_write_ca_timeout(hdev, skb);
2485                 break;
2486
2487         case HCI_OP_READ_FLOW_CONTROL_MODE:
2488                 hci_cc_read_flow_control_mode(hdev, skb);
2489                 break;
2490
2491         case HCI_OP_READ_LOCAL_AMP_INFO:
2492                 hci_cc_read_local_amp_info(hdev, skb);
2493                 break;
2494
2495         case HCI_OP_READ_LOCAL_AMP_ASSOC:
2496                 hci_cc_read_local_amp_assoc(hdev, skb);
2497                 break;
2498
2499         case HCI_OP_DELETE_STORED_LINK_KEY:
2500                 hci_cc_delete_stored_link_key(hdev, skb);
2501                 break;
2502
2503         case HCI_OP_SET_EVENT_MASK:
2504                 hci_cc_set_event_mask(hdev, skb);
2505                 break;
2506
2507         case HCI_OP_WRITE_INQUIRY_MODE:
2508                 hci_cc_write_inquiry_mode(hdev, skb);
2509                 break;
2510
2511         case HCI_OP_READ_INQ_RSP_TX_POWER:
2512                 hci_cc_read_inq_rsp_tx_power(hdev, skb);
2513                 break;
2514
2515         case HCI_OP_SET_EVENT_FLT:
2516                 hci_cc_set_event_flt(hdev, skb);
2517                 break;
2518
2519         case HCI_OP_PIN_CODE_REPLY:
2520                 hci_cc_pin_code_reply(hdev, skb);
2521                 break;
2522
2523         case HCI_OP_PIN_CODE_NEG_REPLY:
2524                 hci_cc_pin_code_neg_reply(hdev, skb);
2525                 break;
2526
2527         case HCI_OP_READ_LOCAL_OOB_DATA:
2528                 hci_cc_read_local_oob_data_reply(hdev, skb);
2529                 break;
2530
2531         case HCI_OP_LE_READ_BUFFER_SIZE:
2532                 hci_cc_le_read_buffer_size(hdev, skb);
2533                 break;
2534
2535         case HCI_OP_LE_READ_ADV_TX_POWER:
2536                 hci_cc_le_read_adv_tx_power(hdev, skb);
2537                 break;
2538
2539         case HCI_OP_LE_SET_EVENT_MASK:
2540                 hci_cc_le_set_event_mask(hdev, skb);
2541                 break;
2542
2543         case HCI_OP_USER_CONFIRM_REPLY:
2544                 hci_cc_user_confirm_reply(hdev, skb);
2545                 break;
2546
2547         case HCI_OP_USER_CONFIRM_NEG_REPLY:
2548                 hci_cc_user_confirm_neg_reply(hdev, skb);
2549                 break;
2550
2551         case HCI_OP_USER_PASSKEY_REPLY:
2552                 hci_cc_user_passkey_reply(hdev, skb);
2553                 break;
2554
2555         case HCI_OP_USER_PASSKEY_NEG_REPLY:
2556                 hci_cc_user_passkey_neg_reply(hdev, skb);
2557                 break;
2558
2559         case HCI_OP_LE_SET_SCAN_PARAM:
2560                 hci_cc_le_set_scan_param(hdev, skb);
2561                 break;
2562
2563         case HCI_OP_LE_SET_SCAN_ENABLE:
2564                 hci_cc_le_set_scan_enable(hdev, skb);
2565                 break;
2566
2567         case HCI_OP_LE_LTK_REPLY:
2568                 hci_cc_le_ltk_reply(hdev, skb);
2569                 break;
2570
2571         case HCI_OP_LE_LTK_NEG_REPLY:
2572                 hci_cc_le_ltk_neg_reply(hdev, skb);
2573                 break;
2574
2575         case HCI_OP_WRITE_LE_HOST_SUPPORTED:
2576                 hci_cc_write_le_host_supported(hdev, skb);
2577                 break;
2578
2579         case HCI_OP_WRITE_REMOTE_AMP_ASSOC:
2580                 hci_cc_write_remote_amp_assoc(hdev, skb);
2581                 break;
2582
2583         default:
2584                 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
2585                 break;
2586         }
2587
2588         if (ev->opcode != HCI_OP_NOP)
2589                 del_timer(&hdev->cmd_timer);
2590
2591         if (ev->ncmd) {
2592                 atomic_set(&hdev->cmd_cnt, 1);
2593                 if (!skb_queue_empty(&hdev->cmd_q))
2594                         queue_work(hdev->workqueue, &hdev->cmd_work);
2595         }
2596 }
2597
2598 static void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb)
2599 {
2600         struct hci_ev_cmd_status *ev = (void *) skb->data;
2601         __u16 opcode;
2602
2603         skb_pull(skb, sizeof(*ev));
2604
2605         opcode = __le16_to_cpu(ev->opcode);
2606
2607         switch (opcode) {
2608         case HCI_OP_INQUIRY:
2609                 hci_cs_inquiry(hdev, ev->status);
2610                 break;
2611
2612         case HCI_OP_CREATE_CONN:
2613                 hci_cs_create_conn(hdev, ev->status);
2614                 break;
2615
2616         case HCI_OP_ADD_SCO:
2617                 hci_cs_add_sco(hdev, ev->status);
2618                 break;
2619
2620         case HCI_OP_AUTH_REQUESTED:
2621                 hci_cs_auth_requested(hdev, ev->status);
2622                 break;
2623
2624         case HCI_OP_SET_CONN_ENCRYPT:
2625                 hci_cs_set_conn_encrypt(hdev, ev->status);
2626                 break;
2627
2628         case HCI_OP_REMOTE_NAME_REQ:
2629                 hci_cs_remote_name_req(hdev, ev->status);
2630                 break;
2631
2632         case HCI_OP_READ_REMOTE_FEATURES:
2633                 hci_cs_read_remote_features(hdev, ev->status);
2634                 break;
2635
2636         case HCI_OP_READ_REMOTE_EXT_FEATURES:
2637                 hci_cs_read_remote_ext_features(hdev, ev->status);
2638                 break;
2639
2640         case HCI_OP_SETUP_SYNC_CONN:
2641                 hci_cs_setup_sync_conn(hdev, ev->status);
2642                 break;
2643
2644         case HCI_OP_SNIFF_MODE:
2645                 hci_cs_sniff_mode(hdev, ev->status);
2646                 break;
2647
2648         case HCI_OP_EXIT_SNIFF_MODE:
2649                 hci_cs_exit_sniff_mode(hdev, ev->status);
2650                 break;
2651
2652         case HCI_OP_DISCONNECT:
2653                 hci_cs_disconnect(hdev, ev->status);
2654                 break;
2655
2656         case HCI_OP_LE_CREATE_CONN:
2657                 hci_cs_le_create_conn(hdev, ev->status);
2658                 break;
2659
2660         case HCI_OP_LE_START_ENC:
2661                 hci_cs_le_start_enc(hdev, ev->status);
2662                 break;
2663
2664         case HCI_OP_CREATE_PHY_LINK:
2665                 hci_cs_create_phylink(hdev, ev->status);
2666                 break;
2667
2668         case HCI_OP_ACCEPT_PHY_LINK:
2669                 hci_cs_accept_phylink(hdev, ev->status);
2670                 break;
2671
2672         default:
2673                 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
2674                 break;
2675         }
2676
2677         if (ev->opcode != HCI_OP_NOP)
2678                 del_timer(&hdev->cmd_timer);
2679
2680         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
2681                 atomic_set(&hdev->cmd_cnt, 1);
2682                 if (!skb_queue_empty(&hdev->cmd_q))
2683                         queue_work(hdev->workqueue, &hdev->cmd_work);
2684         }
2685 }
2686
2687 static void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2688 {
2689         struct hci_ev_role_change *ev = (void *) skb->data;
2690         struct hci_conn *conn;
2691
2692         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2693
2694         hci_dev_lock(hdev);
2695
2696         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2697         if (conn) {
2698                 if (!ev->status) {
2699                         if (ev->role)
2700                                 conn->link_mode &= ~HCI_LM_MASTER;
2701                         else
2702                                 conn->link_mode |= HCI_LM_MASTER;
2703                 }
2704
2705                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
2706
2707                 hci_role_switch_cfm(conn, ev->status, ev->role);
2708         }
2709
2710         hci_dev_unlock(hdev);
2711 }
2712
2713 static void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
2714 {
2715         struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
2716         int i;
2717
2718         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
2719                 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
2720                 return;
2721         }
2722
2723         if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
2724             ev->num_hndl * sizeof(struct hci_comp_pkts_info)) {
2725                 BT_DBG("%s bad parameters", hdev->name);
2726                 return;
2727         }
2728
2729         BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
2730
2731         for (i = 0; i < ev->num_hndl; i++) {
2732                 struct hci_comp_pkts_info *info = &ev->handles[i];
2733                 struct hci_conn *conn;
2734                 __u16  handle, count;
2735
2736                 handle = __le16_to_cpu(info->handle);
2737                 count  = __le16_to_cpu(info->count);
2738
2739                 conn = hci_conn_hash_lookup_handle(hdev, handle);
2740                 if (!conn)
2741                         continue;
2742
2743                 conn->sent -= count;
2744
2745                 switch (conn->type) {
2746                 case ACL_LINK:
2747                         hdev->acl_cnt += count;
2748                         if (hdev->acl_cnt > hdev->acl_pkts)
2749                                 hdev->acl_cnt = hdev->acl_pkts;
2750                         break;
2751
2752                 case LE_LINK:
2753                         if (hdev->le_pkts) {
2754                                 hdev->le_cnt += count;
2755                                 if (hdev->le_cnt > hdev->le_pkts)
2756                                         hdev->le_cnt = hdev->le_pkts;
2757                         } else {
2758                                 hdev->acl_cnt += count;
2759                                 if (hdev->acl_cnt > hdev->acl_pkts)
2760                                         hdev->acl_cnt = hdev->acl_pkts;
2761                         }
2762                         break;
2763
2764                 case SCO_LINK:
2765                         hdev->sco_cnt += count;
2766                         if (hdev->sco_cnt > hdev->sco_pkts)
2767                                 hdev->sco_cnt = hdev->sco_pkts;
2768                         break;
2769
2770                 default:
2771                         BT_ERR("Unknown type %d conn %p", conn->type, conn);
2772                         break;
2773                 }
2774         }
2775
2776         queue_work(hdev->workqueue, &hdev->tx_work);
2777 }
2778
2779 static struct hci_conn *__hci_conn_lookup_handle(struct hci_dev *hdev,
2780                                                  __u16 handle)
2781 {
2782         struct hci_chan *chan;
2783
2784         switch (hdev->dev_type) {
2785         case HCI_BREDR:
2786                 return hci_conn_hash_lookup_handle(hdev, handle);
2787         case HCI_AMP:
2788                 chan = hci_chan_lookup_handle(hdev, handle);
2789                 if (chan)
2790                         return chan->conn;
2791                 break;
2792         default:
2793                 BT_ERR("%s unknown dev_type %d", hdev->name, hdev->dev_type);
2794                 break;
2795         }
2796
2797         return NULL;
2798 }
2799
2800 static void hci_num_comp_blocks_evt(struct hci_dev *hdev, struct sk_buff *skb)
2801 {
2802         struct hci_ev_num_comp_blocks *ev = (void *) skb->data;
2803         int i;
2804
2805         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
2806                 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
2807                 return;
2808         }
2809
2810         if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
2811             ev->num_hndl * sizeof(struct hci_comp_blocks_info)) {
2812                 BT_DBG("%s bad parameters", hdev->name);
2813                 return;
2814         }
2815
2816         BT_DBG("%s num_blocks %d num_hndl %d", hdev->name, ev->num_blocks,
2817                ev->num_hndl);
2818
2819         for (i = 0; i < ev->num_hndl; i++) {
2820                 struct hci_comp_blocks_info *info = &ev->handles[i];
2821                 struct hci_conn *conn = NULL;
2822                 __u16  handle, block_count;
2823
2824                 handle = __le16_to_cpu(info->handle);
2825                 block_count = __le16_to_cpu(info->blocks);
2826
2827                 conn = __hci_conn_lookup_handle(hdev, handle);
2828                 if (!conn)
2829                         continue;
2830
2831                 conn->sent -= block_count;
2832
2833                 switch (conn->type) {
2834                 case ACL_LINK:
2835                 case AMP_LINK:
2836                         hdev->block_cnt += block_count;
2837                         if (hdev->block_cnt > hdev->num_blocks)
2838                                 hdev->block_cnt = hdev->num_blocks;
2839                         break;
2840
2841                 default:
2842                         BT_ERR("Unknown type %d conn %p", conn->type, conn);
2843                         break;
2844                 }
2845         }
2846
2847         queue_work(hdev->workqueue, &hdev->tx_work);
2848 }
2849
2850 static void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2851 {
2852         struct hci_ev_mode_change *ev = (void *) skb->data;
2853         struct hci_conn *conn;
2854
2855         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2856
2857         hci_dev_lock(hdev);
2858
2859         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2860         if (conn) {
2861                 conn->mode = ev->mode;
2862                 conn->interval = __le16_to_cpu(ev->interval);
2863
2864                 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND,
2865                                         &conn->flags)) {
2866                         if (conn->mode == HCI_CM_ACTIVE)
2867                                 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
2868                         else
2869                                 clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
2870                 }
2871
2872                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2873                         hci_sco_setup(conn, ev->status);
2874         }
2875
2876         hci_dev_unlock(hdev);
2877 }
2878
2879 static void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2880 {
2881         struct hci_ev_pin_code_req *ev = (void *) skb->data;
2882         struct hci_conn *conn;
2883
2884         BT_DBG("%s", hdev->name);
2885
2886         hci_dev_lock(hdev);
2887
2888         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2889         if (!conn)
2890                 goto unlock;
2891
2892         if (conn->state == BT_CONNECTED) {
2893                 hci_conn_hold(conn);
2894                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2895                 hci_conn_put(conn);
2896         }
2897
2898         if (!test_bit(HCI_PAIRABLE, &hdev->dev_flags))
2899                 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2900                              sizeof(ev->bdaddr), &ev->bdaddr);
2901         else if (test_bit(HCI_MGMT, &hdev->dev_flags)) {
2902                 u8 secure;
2903
2904                 if (conn->pending_sec_level == BT_SECURITY_HIGH)
2905                         secure = 1;
2906                 else
2907                         secure = 0;
2908
2909                 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
2910         }
2911
2912 unlock:
2913         hci_dev_unlock(hdev);
2914 }
2915
2916 static void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2917 {
2918         struct hci_ev_link_key_req *ev = (void *) skb->data;
2919         struct hci_cp_link_key_reply cp;
2920         struct hci_conn *conn;
2921         struct link_key *key;
2922
2923         BT_DBG("%s", hdev->name);
2924
2925         if (!test_bit(HCI_LINK_KEYS, &hdev->dev_flags))
2926                 return;
2927
2928         hci_dev_lock(hdev);
2929
2930         key = hci_find_link_key(hdev, &ev->bdaddr);
2931         if (!key) {
2932                 BT_DBG("%s link key not found for %pMR", hdev->name,
2933                        &ev->bdaddr);
2934                 goto not_found;
2935         }
2936
2937         BT_DBG("%s found key type %u for %pMR", hdev->name, key->type,
2938                &ev->bdaddr);
2939
2940         if (!test_bit(HCI_DEBUG_KEYS, &hdev->dev_flags) &&
2941             key->type == HCI_LK_DEBUG_COMBINATION) {
2942                 BT_DBG("%s ignoring debug key", hdev->name);
2943                 goto not_found;
2944         }
2945
2946         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2947         if (conn) {
2948                 if (key->type == HCI_LK_UNAUTH_COMBINATION &&
2949                     conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
2950                         BT_DBG("%s ignoring unauthenticated key", hdev->name);
2951                         goto not_found;
2952                 }
2953
2954                 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
2955                     conn->pending_sec_level == BT_SECURITY_HIGH) {
2956                         BT_DBG("%s ignoring key unauthenticated for high security",
2957                                hdev->name);
2958                         goto not_found;
2959                 }
2960
2961                 conn->key_type = key->type;
2962                 conn->pin_length = key->pin_len;
2963         }
2964
2965         bacpy(&cp.bdaddr, &ev->bdaddr);
2966         memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);
2967
2968         hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
2969
2970         hci_dev_unlock(hdev);
2971
2972         return;
2973
2974 not_found:
2975         hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
2976         hci_dev_unlock(hdev);
2977 }
2978
2979 static void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
2980 {
2981         struct hci_ev_link_key_notify *ev = (void *) skb->data;
2982         struct hci_conn *conn;
2983         u8 pin_len = 0;
2984
2985         BT_DBG("%s", hdev->name);
2986
2987         hci_dev_lock(hdev);
2988
2989         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2990         if (conn) {
2991                 hci_conn_hold(conn);
2992                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2993                 pin_len = conn->pin_length;
2994
2995                 if (ev->key_type != HCI_LK_CHANGED_COMBINATION)
2996                         conn->key_type = ev->key_type;
2997
2998                 hci_conn_put(conn);
2999         }
3000
3001         if (test_bit(HCI_LINK_KEYS, &hdev->dev_flags))
3002                 hci_add_link_key(hdev, conn, 1, &ev->bdaddr, ev->link_key,
3003                                  ev->key_type, pin_len);
3004
3005         hci_dev_unlock(hdev);
3006 }
3007
3008 static void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
3009 {
3010         struct hci_ev_clock_offset *ev = (void *) skb->data;
3011         struct hci_conn *conn;
3012
3013         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3014
3015         hci_dev_lock(hdev);
3016
3017         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3018         if (conn && !ev->status) {
3019                 struct inquiry_entry *ie;
3020
3021                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
3022                 if (ie) {
3023                         ie->data.clock_offset = ev->clock_offset;
3024                         ie->timestamp = jiffies;
3025                 }
3026         }
3027
3028         hci_dev_unlock(hdev);
3029 }
3030
3031 static void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3032 {
3033         struct hci_ev_pkt_type_change *ev = (void *) skb->data;
3034         struct hci_conn *conn;
3035
3036         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3037
3038         hci_dev_lock(hdev);
3039
3040         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3041         if (conn && !ev->status)
3042                 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
3043
3044         hci_dev_unlock(hdev);
3045 }
3046
3047 static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
3048 {
3049         struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
3050         struct inquiry_entry *ie;
3051
3052         BT_DBG("%s", hdev->name);
3053
3054         hci_dev_lock(hdev);
3055
3056         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
3057         if (ie) {
3058                 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
3059                 ie->timestamp = jiffies;
3060         }
3061
3062         hci_dev_unlock(hdev);
3063 }
3064
3065 static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
3066                                              struct sk_buff *skb)
3067 {
3068         struct inquiry_data data;
3069         int num_rsp = *((__u8 *) skb->data);
3070         bool name_known, ssp;
3071
3072         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
3073
3074         if (!num_rsp)
3075                 return;
3076
3077         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
3078                 return;
3079
3080         hci_dev_lock(hdev);
3081
3082         if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
3083                 struct inquiry_info_with_rssi_and_pscan_mode *info;
3084                 info = (void *) (skb->data + 1);
3085
3086                 for (; num_rsp; num_rsp--, info++) {
3087                         bacpy(&data.bdaddr, &info->bdaddr);
3088                         data.pscan_rep_mode     = info->pscan_rep_mode;
3089                         data.pscan_period_mode  = info->pscan_period_mode;
3090                         data.pscan_mode         = info->pscan_mode;
3091                         memcpy(data.dev_class, info->dev_class, 3);
3092                         data.clock_offset       = info->clock_offset;
3093                         data.rssi               = info->rssi;
3094                         data.ssp_mode           = 0x00;
3095
3096                         name_known = hci_inquiry_cache_update(hdev, &data,
3097                                                               false, &ssp);
3098                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
3099                                           info->dev_class, info->rssi,
3100                                           !name_known, ssp, NULL, 0);
3101                 }
3102         } else {
3103                 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
3104
3105                 for (; num_rsp; num_rsp--, info++) {
3106                         bacpy(&data.bdaddr, &info->bdaddr);
3107                         data.pscan_rep_mode     = info->pscan_rep_mode;
3108                         data.pscan_period_mode  = info->pscan_period_mode;
3109                         data.pscan_mode         = 0x00;
3110                         memcpy(data.dev_class, info->dev_class, 3);
3111                         data.clock_offset       = info->clock_offset;
3112                         data.rssi               = info->rssi;
3113                         data.ssp_mode           = 0x00;
3114                         name_known = hci_inquiry_cache_update(hdev, &data,
3115                                                               false, &ssp);
3116                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
3117                                           info->dev_class, info->rssi,
3118                                           !name_known, ssp, NULL, 0);
3119                 }
3120         }
3121
3122         hci_dev_unlock(hdev);
3123 }
3124
3125 static void hci_remote_ext_features_evt(struct hci_dev *hdev,
3126                                         struct sk_buff *skb)
3127 {
3128         struct hci_ev_remote_ext_features *ev = (void *) skb->data;
3129         struct hci_conn *conn;
3130
3131         BT_DBG("%s", hdev->name);
3132
3133         hci_dev_lock(hdev);
3134
3135         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3136         if (!conn)
3137                 goto unlock;
3138
3139         if (!ev->status && ev->page == 0x01) {
3140                 struct inquiry_entry *ie;
3141
3142                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
3143                 if (ie)
3144                         ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
3145
3146                 if (ev->features[0] & LMP_HOST_SSP)
3147                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
3148         }
3149
3150         if (conn->state != BT_CONFIG)
3151                 goto unlock;
3152
3153         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
3154                 struct hci_cp_remote_name_req cp;
3155                 memset(&cp, 0, sizeof(cp));
3156                 bacpy(&cp.bdaddr, &conn->dst);
3157                 cp.pscan_rep_mode = 0x02;
3158                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
3159         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
3160                 mgmt_device_connected(hdev, &conn->dst, conn->type,
3161                                       conn->dst_type, 0, NULL, 0,
3162                                       conn->dev_class);
3163
3164         if (!hci_outgoing_auth_needed(hdev, conn)) {
3165                 conn->state = BT_CONNECTED;
3166                 hci_proto_connect_cfm(conn, ev->status);
3167                 hci_conn_put(conn);
3168         }
3169
3170 unlock:
3171         hci_dev_unlock(hdev);
3172 }
3173
3174 static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
3175                                        struct sk_buff *skb)
3176 {
3177         struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
3178         struct hci_conn *conn;
3179
3180         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3181
3182         hci_dev_lock(hdev);
3183
3184         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
3185         if (!conn) {
3186                 if (ev->link_type == ESCO_LINK)
3187                         goto unlock;
3188
3189                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
3190                 if (!conn)
3191                         goto unlock;
3192
3193                 conn->type = SCO_LINK;
3194         }
3195
3196         switch (ev->status) {
3197         case 0x00:
3198                 conn->handle = __le16_to_cpu(ev->handle);
3199                 conn->state  = BT_CONNECTED;
3200
3201                 hci_conn_hold_device(conn);
3202                 hci_conn_add_sysfs(conn);
3203                 break;
3204
3205         case 0x11:      /* Unsupported Feature or Parameter Value */
3206         case 0x1c:      /* SCO interval rejected */
3207         case 0x1a:      /* Unsupported Remote Feature */
3208         case 0x1f:      /* Unspecified error */
3209                 if (conn->out && conn->attempt < 2) {
3210                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
3211                                         (hdev->esco_type & EDR_ESCO_MASK);
3212                         hci_setup_sync(conn, conn->link->handle);
3213                         goto unlock;
3214                 }
3215                 /* fall through */
3216
3217         default:
3218                 conn->state = BT_CLOSED;
3219                 break;
3220         }
3221
3222         hci_proto_connect_cfm(conn, ev->status);
3223         if (ev->status)
3224                 hci_conn_del(conn);
3225
3226 unlock:
3227         hci_dev_unlock(hdev);
3228 }
3229
3230 static void hci_sync_conn_changed_evt(struct hci_dev *hdev, struct sk_buff *skb)
3231 {
3232         BT_DBG("%s", hdev->name);
3233 }
3234
3235 static void hci_sniff_subrate_evt(struct hci_dev *hdev, struct sk_buff *skb)
3236 {
3237         struct hci_ev_sniff_subrate *ev = (void *) skb->data;
3238
3239         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3240 }
3241
3242 static void hci_extended_inquiry_result_evt(struct hci_dev *hdev,
3243                                             struct sk_buff *skb)
3244 {
3245         struct inquiry_data data;
3246         struct extended_inquiry_info *info = (void *) (skb->data + 1);
3247         int num_rsp = *((__u8 *) skb->data);
3248         size_t eir_len;
3249
3250         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
3251
3252         if (!num_rsp)
3253                 return;
3254
3255         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
3256                 return;
3257
3258         hci_dev_lock(hdev);
3259
3260         for (; num_rsp; num_rsp--, info++) {
3261                 bool name_known, ssp;
3262
3263                 bacpy(&data.bdaddr, &info->bdaddr);
3264                 data.pscan_rep_mode     = info->pscan_rep_mode;
3265                 data.pscan_period_mode  = info->pscan_period_mode;
3266                 data.pscan_mode         = 0x00;
3267                 memcpy(data.dev_class, info->dev_class, 3);
3268                 data.clock_offset       = info->clock_offset;
3269                 data.rssi               = info->rssi;
3270                 data.ssp_mode           = 0x01;
3271
3272                 if (test_bit(HCI_MGMT, &hdev->dev_flags))
3273                         name_known = eir_has_data_type(info->data,
3274                                                        sizeof(info->data),
3275                                                        EIR_NAME_COMPLETE);
3276                 else
3277                         name_known = true;
3278
3279                 name_known = hci_inquiry_cache_update(hdev, &data, name_known,
3280                                                       &ssp);
3281                 eir_len = eir_get_length(info->data, sizeof(info->data));
3282                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
3283                                   info->dev_class, info->rssi, !name_known,
3284                                   ssp, info->data, eir_len);
3285         }
3286
3287         hci_dev_unlock(hdev);
3288 }
3289
3290 static void hci_key_refresh_complete_evt(struct hci_dev *hdev,
3291                                          struct sk_buff *skb)
3292 {
3293         struct hci_ev_key_refresh_complete *ev = (void *) skb->data;
3294         struct hci_conn *conn;
3295
3296         BT_DBG("%s status 0x%2.2x handle 0x%4.4x", hdev->name, ev->status,
3297                __le16_to_cpu(ev->handle));
3298
3299         hci_dev_lock(hdev);
3300
3301         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3302         if (!conn)
3303                 goto unlock;
3304
3305         if (!ev->status)
3306                 conn->sec_level = conn->pending_sec_level;
3307
3308         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3309
3310         if (ev->status && conn->state == BT_CONNECTED) {
3311                 hci_acl_disconn(conn, HCI_ERROR_AUTH_FAILURE);
3312                 hci_conn_put(conn);
3313                 goto unlock;
3314         }
3315
3316         if (conn->state == BT_CONFIG) {
3317                 if (!ev->status)
3318                         conn->state = BT_CONNECTED;
3319
3320                 hci_proto_connect_cfm(conn, ev->status);
3321                 hci_conn_put(conn);
3322         } else {
3323                 hci_auth_cfm(conn, ev->status);
3324
3325                 hci_conn_hold(conn);
3326                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3327                 hci_conn_put(conn);
3328         }
3329
3330 unlock:
3331         hci_dev_unlock(hdev);
3332 }
3333
3334 static u8 hci_get_auth_req(struct hci_conn *conn)
3335 {
3336         /* If remote requests dedicated bonding follow that lead */
3337         if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03) {
3338                 /* If both remote and local IO capabilities allow MITM
3339                  * protection then require it, otherwise don't */
3340                 if (conn->remote_cap == 0x03 || conn->io_capability == 0x03)
3341                         return 0x02;
3342                 else
3343                         return 0x03;
3344         }
3345
3346         /* If remote requests no-bonding follow that lead */
3347         if (conn->remote_auth == 0x00 || conn->remote_auth == 0x01)
3348                 return conn->remote_auth | (conn->auth_type & 0x01);
3349
3350         return conn->auth_type;
3351 }
3352
3353 static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3354 {
3355         struct hci_ev_io_capa_request *ev = (void *) skb->data;
3356         struct hci_conn *conn;
3357
3358         BT_DBG("%s", hdev->name);
3359
3360         hci_dev_lock(hdev);
3361
3362         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3363         if (!conn)
3364                 goto unlock;
3365
3366         hci_conn_hold(conn);
3367
3368         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3369                 goto unlock;
3370
3371         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags) ||
3372             (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
3373                 struct hci_cp_io_capability_reply cp;
3374
3375                 bacpy(&cp.bdaddr, &ev->bdaddr);
3376                 /* Change the IO capability from KeyboardDisplay
3377                  * to DisplayYesNo as it is not supported by BT spec. */
3378                 cp.capability = (conn->io_capability == 0x04) ?
3379                                                 0x01 : conn->io_capability;
3380                 conn->auth_type = hci_get_auth_req(conn);
3381                 cp.authentication = conn->auth_type;
3382
3383                 if (hci_find_remote_oob_data(hdev, &conn->dst) &&
3384                     (conn->out || test_bit(HCI_CONN_REMOTE_OOB, &conn->flags)))
3385                         cp.oob_data = 0x01;
3386                 else
3387                         cp.oob_data = 0x00;
3388
3389                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
3390                              sizeof(cp), &cp);
3391         } else {
3392                 struct hci_cp_io_capability_neg_reply cp;
3393
3394                 bacpy(&cp.bdaddr, &ev->bdaddr);
3395                 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
3396
3397                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
3398                              sizeof(cp), &cp);
3399         }
3400
3401 unlock:
3402         hci_dev_unlock(hdev);
3403 }
3404
3405 static void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
3406 {
3407         struct hci_ev_io_capa_reply *ev = (void *) skb->data;
3408         struct hci_conn *conn;
3409
3410         BT_DBG("%s", hdev->name);
3411
3412         hci_dev_lock(hdev);
3413
3414         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3415         if (!conn)
3416                 goto unlock;
3417
3418         conn->remote_cap = ev->capability;
3419         conn->remote_auth = ev->authentication;
3420         if (ev->oob_data)
3421                 set_bit(HCI_CONN_REMOTE_OOB, &conn->flags);
3422
3423 unlock:
3424         hci_dev_unlock(hdev);
3425 }
3426
3427 static void hci_user_confirm_request_evt(struct hci_dev *hdev,
3428                                          struct sk_buff *skb)
3429 {
3430         struct hci_ev_user_confirm_req *ev = (void *) skb->data;
3431         int loc_mitm, rem_mitm, confirm_hint = 0;
3432         struct hci_conn *conn;
3433
3434         BT_DBG("%s", hdev->name);
3435
3436         hci_dev_lock(hdev);
3437
3438         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3439                 goto unlock;
3440
3441         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3442         if (!conn)
3443                 goto unlock;
3444
3445         loc_mitm = (conn->auth_type & 0x01);
3446         rem_mitm = (conn->remote_auth & 0x01);
3447
3448         /* If we require MITM but the remote device can't provide that
3449          * (it has NoInputNoOutput) then reject the confirmation
3450          * request. The only exception is when we're dedicated bonding
3451          * initiators (connect_cfm_cb set) since then we always have the MITM
3452          * bit set. */
3453         if (!conn->connect_cfm_cb && loc_mitm && conn->remote_cap == 0x03) {
3454                 BT_DBG("Rejecting request: remote device can't provide MITM");
3455                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
3456                              sizeof(ev->bdaddr), &ev->bdaddr);
3457                 goto unlock;
3458         }
3459
3460         /* If no side requires MITM protection; auto-accept */
3461         if ((!loc_mitm || conn->remote_cap == 0x03) &&
3462             (!rem_mitm || conn->io_capability == 0x03)) {
3463
3464                 /* If we're not the initiators request authorization to
3465                  * proceed from user space (mgmt_user_confirm with
3466                  * confirm_hint set to 1). */
3467                 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
3468                         BT_DBG("Confirming auto-accept as acceptor");
3469                         confirm_hint = 1;
3470                         goto confirm;
3471                 }
3472
3473                 BT_DBG("Auto-accept of user confirmation with %ums delay",
3474                        hdev->auto_accept_delay);
3475
3476                 if (hdev->auto_accept_delay > 0) {
3477                         int delay = msecs_to_jiffies(hdev->auto_accept_delay);
3478                         mod_timer(&conn->auto_accept_timer, jiffies + delay);
3479                         goto unlock;
3480                 }
3481
3482                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
3483                              sizeof(ev->bdaddr), &ev->bdaddr);
3484                 goto unlock;
3485         }
3486
3487 confirm:
3488         mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0, ev->passkey,
3489                                   confirm_hint);
3490
3491 unlock:
3492         hci_dev_unlock(hdev);
3493 }
3494
3495 static void hci_user_passkey_request_evt(struct hci_dev *hdev,
3496                                          struct sk_buff *skb)
3497 {
3498         struct hci_ev_user_passkey_req *ev = (void *) skb->data;
3499
3500         BT_DBG("%s", hdev->name);
3501
3502         if (test_bit(HCI_MGMT, &hdev->dev_flags))
3503                 mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
3504 }
3505
3506 static void hci_user_passkey_notify_evt(struct hci_dev *hdev,
3507                                         struct sk_buff *skb)
3508 {
3509         struct hci_ev_user_passkey_notify *ev = (void *) skb->data;
3510         struct hci_conn *conn;
3511
3512         BT_DBG("%s", hdev->name);
3513
3514         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3515         if (!conn)
3516                 return;
3517
3518         conn->passkey_notify = __le32_to_cpu(ev->passkey);
3519         conn->passkey_entered = 0;
3520
3521         if (test_bit(HCI_MGMT, &hdev->dev_flags))
3522                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
3523                                          conn->dst_type, conn->passkey_notify,
3524                                          conn->passkey_entered);
3525 }
3526
3527 static void hci_keypress_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
3528 {
3529         struct hci_ev_keypress_notify *ev = (void *) skb->data;
3530         struct hci_conn *conn;
3531
3532         BT_DBG("%s", hdev->name);
3533
3534         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3535         if (!conn)
3536                 return;
3537
3538         switch (ev->type) {
3539         case HCI_KEYPRESS_STARTED:
3540                 conn->passkey_entered = 0;
3541                 return;
3542
3543         case HCI_KEYPRESS_ENTERED:
3544                 conn->passkey_entered++;
3545                 break;
3546
3547         case HCI_KEYPRESS_ERASED:
3548                 conn->passkey_entered--;
3549                 break;
3550
3551         case HCI_KEYPRESS_CLEARED:
3552                 conn->passkey_entered = 0;
3553                 break;
3554
3555         case HCI_KEYPRESS_COMPLETED:
3556                 return;
3557         }
3558
3559         if (test_bit(HCI_MGMT, &hdev->dev_flags))
3560                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
3561                                          conn->dst_type, conn->passkey_notify,
3562                                          conn->passkey_entered);
3563 }
3564
3565 static void hci_simple_pair_complete_evt(struct hci_dev *hdev,
3566                                          struct sk_buff *skb)
3567 {
3568         struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
3569         struct hci_conn *conn;
3570
3571         BT_DBG("%s", hdev->name);
3572
3573         hci_dev_lock(hdev);
3574
3575         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3576         if (!conn)
3577                 goto unlock;
3578
3579         /* To avoid duplicate auth_failed events to user space we check
3580          * the HCI_CONN_AUTH_PEND flag which will be set if we
3581          * initiated the authentication. A traditional auth_complete
3582          * event gets always produced as initiator and is also mapped to
3583          * the mgmt_auth_failed event */
3584         if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status)
3585                 mgmt_auth_failed(hdev, &conn->dst, conn->type, conn->dst_type,
3586                                  ev->status);
3587
3588         hci_conn_put(conn);
3589
3590 unlock:
3591         hci_dev_unlock(hdev);
3592 }
3593
3594 static void hci_remote_host_features_evt(struct hci_dev *hdev,
3595                                          struct sk_buff *skb)
3596 {
3597         struct hci_ev_remote_host_features *ev = (void *) skb->data;
3598         struct inquiry_entry *ie;
3599
3600         BT_DBG("%s", hdev->name);
3601
3602         hci_dev_lock(hdev);
3603
3604         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
3605         if (ie)
3606                 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
3607
3608         hci_dev_unlock(hdev);
3609 }
3610
3611 static void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
3612                                             struct sk_buff *skb)
3613 {
3614         struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
3615         struct oob_data *data;
3616
3617         BT_DBG("%s", hdev->name);
3618
3619         hci_dev_lock(hdev);
3620
3621         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3622                 goto unlock;
3623
3624         data = hci_find_remote_oob_data(hdev, &ev->bdaddr);
3625         if (data) {
3626                 struct hci_cp_remote_oob_data_reply cp;
3627
3628                 bacpy(&cp.bdaddr, &ev->bdaddr);
3629                 memcpy(cp.hash, data->hash, sizeof(cp.hash));
3630                 memcpy(cp.randomizer, data->randomizer, sizeof(cp.randomizer));
3631
3632                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY, sizeof(cp),
3633                              &cp);
3634         } else {
3635                 struct hci_cp_remote_oob_data_neg_reply cp;
3636
3637                 bacpy(&cp.bdaddr, &ev->bdaddr);
3638                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY, sizeof(cp),
3639                              &cp);
3640         }
3641
3642 unlock:
3643         hci_dev_unlock(hdev);
3644 }
3645
3646 static void hci_phy_link_complete_evt(struct hci_dev *hdev,
3647                                       struct sk_buff *skb)
3648 {
3649         struct hci_ev_phy_link_complete *ev = (void *) skb->data;
3650         struct hci_conn *hcon, *bredr_hcon;
3651
3652         BT_DBG("%s handle 0x%2.2x status 0x%2.2x", hdev->name, ev->phy_handle,
3653                ev->status);
3654
3655         hci_dev_lock(hdev);
3656
3657         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
3658         if (!hcon) {
3659                 hci_dev_unlock(hdev);
3660                 return;
3661         }
3662
3663         if (ev->status) {
3664                 hci_conn_del(hcon);
3665                 hci_dev_unlock(hdev);
3666                 return;
3667         }
3668
3669         bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
3670
3671         hcon->state = BT_CONNECTED;
3672         bacpy(&hcon->dst, &bredr_hcon->dst);
3673
3674         hci_conn_hold(hcon);
3675         hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
3676         hci_conn_put(hcon);
3677
3678         hci_conn_hold_device(hcon);
3679         hci_conn_add_sysfs(hcon);
3680
3681         hci_dev_unlock(hdev);
3682
3683         if (hcon->out) {
3684                 struct hci_dev *bredr_hdev = hci_dev_hold(bredr_hcon->hdev);
3685
3686                 if (!bredr_hdev)
3687                         return;
3688
3689                 /* Placeholder - create chan req
3690                 l2cap_chan_create_cfm(bredr_hcon, hcon->remote_id);
3691                 */
3692
3693                 hci_dev_put(bredr_hdev);
3694         }
3695 }
3696
3697 static void hci_loglink_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
3698 {
3699         struct hci_ev_logical_link_complete *ev = (void *) skb->data;
3700         struct hci_conn *hcon;
3701         struct hci_chan *hchan;
3702         struct amp_mgr *mgr;
3703
3704         BT_DBG("%s log_handle 0x%4.4x phy_handle 0x%2.2x status 0x%2.2x",
3705                hdev->name, le16_to_cpu(ev->handle), ev->phy_handle,
3706                ev->status);
3707
3708         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
3709         if (!hcon)
3710                 return;
3711
3712         /* Create AMP hchan */
3713         hchan = hci_chan_create(hcon);
3714         if (!hchan)
3715                 return;
3716
3717         hchan->handle = le16_to_cpu(ev->handle);
3718
3719         BT_DBG("hcon %p mgr %p hchan %p", hcon, hcon->amp_mgr, hchan);
3720
3721         mgr = hcon->amp_mgr;
3722         if (mgr && mgr->bredr_chan) {
3723                 struct l2cap_chan *bredr_chan = mgr->bredr_chan;
3724
3725                 l2cap_chan_lock(bredr_chan);
3726
3727                 bredr_chan->conn->mtu = hdev->block_mtu;
3728                 l2cap_logical_cfm(bredr_chan, hchan, 0);
3729                 hci_conn_hold(hcon);
3730
3731                 l2cap_chan_unlock(bredr_chan);
3732         }
3733 }
3734
3735 static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
3736 {
3737         struct hci_ev_le_conn_complete *ev = (void *) skb->data;
3738         struct hci_conn *conn;
3739
3740         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3741
3742         hci_dev_lock(hdev);
3743
3744         conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
3745         if (!conn) {
3746                 conn = hci_conn_add(hdev, LE_LINK, &ev->bdaddr);
3747                 if (!conn) {
3748                         BT_ERR("No memory for new connection");
3749                         goto unlock;
3750                 }
3751
3752                 conn->dst_type = ev->bdaddr_type;
3753
3754                 if (ev->role == LE_CONN_ROLE_MASTER) {
3755                         conn->out = true;
3756                         conn->link_mode |= HCI_LM_MASTER;
3757                 }
3758         }
3759
3760         if (ev->status) {
3761                 mgmt_connect_failed(hdev, &conn->dst, conn->type,
3762                                     conn->dst_type, ev->status);
3763                 hci_proto_connect_cfm(conn, ev->status);
3764                 conn->state = BT_CLOSED;
3765                 hci_conn_del(conn);
3766                 goto unlock;
3767         }
3768
3769         if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
3770                 mgmt_device_connected(hdev, &ev->bdaddr, conn->type,
3771                                       conn->dst_type, 0, NULL, 0, NULL);
3772
3773         conn->sec_level = BT_SECURITY_LOW;
3774         conn->handle = __le16_to_cpu(ev->handle);
3775         conn->state = BT_CONNECTED;
3776
3777         hci_conn_hold_device(conn);
3778         hci_conn_add_sysfs(conn);
3779
3780         hci_proto_connect_cfm(conn, ev->status);
3781
3782 unlock:
3783         hci_dev_unlock(hdev);
3784 }
3785
3786 static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
3787 {
3788         u8 num_reports = skb->data[0];
3789         void *ptr = &skb->data[1];
3790         s8 rssi;
3791
3792         hci_dev_lock(hdev);
3793
3794         while (num_reports--) {
3795                 struct hci_ev_le_advertising_info *ev = ptr;
3796
3797                 rssi = ev->data[ev->length];
3798                 mgmt_device_found(hdev, &ev->bdaddr, LE_LINK, ev->bdaddr_type,
3799                                   NULL, rssi, 0, 1, ev->data, ev->length);
3800
3801                 ptr += sizeof(*ev) + ev->length + 1;
3802         }
3803
3804         hci_dev_unlock(hdev);
3805 }
3806
3807 static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3808 {
3809         struct hci_ev_le_ltk_req *ev = (void *) skb->data;
3810         struct hci_cp_le_ltk_reply cp;
3811         struct hci_cp_le_ltk_neg_reply neg;
3812         struct hci_conn *conn;
3813         struct smp_ltk *ltk;
3814
3815         BT_DBG("%s handle 0x%4.4x", hdev->name, __le16_to_cpu(ev->handle));
3816
3817         hci_dev_lock(hdev);
3818
3819         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3820         if (conn == NULL)
3821                 goto not_found;
3822
3823         ltk = hci_find_ltk(hdev, ev->ediv, ev->random);
3824         if (ltk == NULL)
3825                 goto not_found;
3826
3827         memcpy(cp.ltk, ltk->val, sizeof(ltk->val));
3828         cp.handle = cpu_to_le16(conn->handle);
3829
3830         if (ltk->authenticated)
3831                 conn->sec_level = BT_SECURITY_HIGH;
3832
3833         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
3834
3835         if (ltk->type & HCI_SMP_STK) {
3836                 list_del(&ltk->list);
3837                 kfree(ltk);
3838         }
3839
3840         hci_dev_unlock(hdev);
3841
3842         return;
3843
3844 not_found:
3845         neg.handle = ev->handle;
3846         hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
3847         hci_dev_unlock(hdev);
3848 }
3849
3850 static void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
3851 {
3852         struct hci_ev_le_meta *le_ev = (void *) skb->data;
3853
3854         skb_pull(skb, sizeof(*le_ev));
3855
3856         switch (le_ev->subevent) {
3857         case HCI_EV_LE_CONN_COMPLETE:
3858                 hci_le_conn_complete_evt(hdev, skb);
3859                 break;
3860
3861         case HCI_EV_LE_ADVERTISING_REPORT:
3862                 hci_le_adv_report_evt(hdev, skb);
3863                 break;
3864
3865         case HCI_EV_LE_LTK_REQ:
3866                 hci_le_ltk_request_evt(hdev, skb);
3867                 break;
3868
3869         default:
3870                 break;
3871         }
3872 }
3873
3874 static void hci_chan_selected_evt(struct hci_dev *hdev, struct sk_buff *skb)
3875 {
3876         struct hci_ev_channel_selected *ev = (void *) skb->data;
3877         struct hci_conn *hcon;
3878
3879         BT_DBG("%s handle 0x%2.2x", hdev->name, ev->phy_handle);
3880
3881         skb_pull(skb, sizeof(*ev));
3882
3883         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
3884         if (!hcon)
3885                 return;
3886
3887         amp_read_loc_assoc_final_data(hdev, hcon);
3888 }
3889
3890 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
3891 {
3892         struct hci_event_hdr *hdr = (void *) skb->data;
3893         __u8 event = hdr->evt;
3894
3895         skb_pull(skb, HCI_EVENT_HDR_SIZE);
3896
3897         switch (event) {
3898         case HCI_EV_INQUIRY_COMPLETE:
3899                 hci_inquiry_complete_evt(hdev, skb);
3900                 break;
3901
3902         case HCI_EV_INQUIRY_RESULT:
3903                 hci_inquiry_result_evt(hdev, skb);
3904                 break;
3905
3906         case HCI_EV_CONN_COMPLETE:
3907                 hci_conn_complete_evt(hdev, skb);
3908                 break;
3909
3910         case HCI_EV_CONN_REQUEST:
3911                 hci_conn_request_evt(hdev, skb);
3912                 break;
3913
3914         case HCI_EV_DISCONN_COMPLETE:
3915                 hci_disconn_complete_evt(hdev, skb);
3916                 break;
3917
3918         case HCI_EV_AUTH_COMPLETE:
3919                 hci_auth_complete_evt(hdev, skb);
3920                 break;
3921
3922         case HCI_EV_REMOTE_NAME:
3923                 hci_remote_name_evt(hdev, skb);
3924                 break;
3925
3926         case HCI_EV_ENCRYPT_CHANGE:
3927                 hci_encrypt_change_evt(hdev, skb);
3928                 break;
3929
3930         case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
3931                 hci_change_link_key_complete_evt(hdev, skb);
3932                 break;
3933
3934         case HCI_EV_REMOTE_FEATURES:
3935                 hci_remote_features_evt(hdev, skb);
3936                 break;
3937
3938         case HCI_EV_REMOTE_VERSION:
3939                 hci_remote_version_evt(hdev, skb);
3940                 break;
3941
3942         case HCI_EV_QOS_SETUP_COMPLETE:
3943                 hci_qos_setup_complete_evt(hdev, skb);
3944                 break;
3945
3946         case HCI_EV_CMD_COMPLETE:
3947                 hci_cmd_complete_evt(hdev, skb);
3948                 break;
3949
3950         case HCI_EV_CMD_STATUS:
3951                 hci_cmd_status_evt(hdev, skb);
3952                 break;
3953
3954         case HCI_EV_ROLE_CHANGE:
3955                 hci_role_change_evt(hdev, skb);
3956                 break;
3957
3958         case HCI_EV_NUM_COMP_PKTS:
3959                 hci_num_comp_pkts_evt(hdev, skb);
3960                 break;
3961
3962         case HCI_EV_MODE_CHANGE:
3963                 hci_mode_change_evt(hdev, skb);
3964                 break;
3965
3966         case HCI_EV_PIN_CODE_REQ:
3967                 hci_pin_code_request_evt(hdev, skb);
3968                 break;
3969
3970         case HCI_EV_LINK_KEY_REQ:
3971                 hci_link_key_request_evt(hdev, skb);
3972                 break;
3973
3974         case HCI_EV_LINK_KEY_NOTIFY:
3975                 hci_link_key_notify_evt(hdev, skb);
3976                 break;
3977
3978         case HCI_EV_CLOCK_OFFSET:
3979                 hci_clock_offset_evt(hdev, skb);
3980                 break;
3981
3982         case HCI_EV_PKT_TYPE_CHANGE:
3983                 hci_pkt_type_change_evt(hdev, skb);
3984                 break;
3985
3986         case HCI_EV_PSCAN_REP_MODE:
3987                 hci_pscan_rep_mode_evt(hdev, skb);
3988                 break;
3989
3990         case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
3991                 hci_inquiry_result_with_rssi_evt(hdev, skb);
3992                 break;
3993
3994         case HCI_EV_REMOTE_EXT_FEATURES:
3995                 hci_remote_ext_features_evt(hdev, skb);
3996                 break;
3997
3998         case HCI_EV_SYNC_CONN_COMPLETE:
3999                 hci_sync_conn_complete_evt(hdev, skb);
4000                 break;
4001
4002         case HCI_EV_SYNC_CONN_CHANGED:
4003                 hci_sync_conn_changed_evt(hdev, skb);
4004                 break;
4005
4006         case HCI_EV_SNIFF_SUBRATE:
4007                 hci_sniff_subrate_evt(hdev, skb);
4008                 break;
4009
4010         case HCI_EV_EXTENDED_INQUIRY_RESULT:
4011                 hci_extended_inquiry_result_evt(hdev, skb);
4012                 break;
4013
4014         case HCI_EV_KEY_REFRESH_COMPLETE:
4015                 hci_key_refresh_complete_evt(hdev, skb);
4016                 break;
4017
4018         case HCI_EV_IO_CAPA_REQUEST:
4019                 hci_io_capa_request_evt(hdev, skb);
4020                 break;
4021
4022         case HCI_EV_IO_CAPA_REPLY:
4023                 hci_io_capa_reply_evt(hdev, skb);
4024                 break;
4025
4026         case HCI_EV_USER_CONFIRM_REQUEST:
4027                 hci_user_confirm_request_evt(hdev, skb);
4028                 break;
4029
4030         case HCI_EV_USER_PASSKEY_REQUEST:
4031                 hci_user_passkey_request_evt(hdev, skb);
4032                 break;
4033
4034         case HCI_EV_USER_PASSKEY_NOTIFY:
4035                 hci_user_passkey_notify_evt(hdev, skb);
4036                 break;
4037
4038         case HCI_EV_KEYPRESS_NOTIFY:
4039                 hci_keypress_notify_evt(hdev, skb);
4040                 break;
4041
4042         case HCI_EV_SIMPLE_PAIR_COMPLETE:
4043                 hci_simple_pair_complete_evt(hdev, skb);
4044                 break;
4045
4046         case HCI_EV_REMOTE_HOST_FEATURES:
4047                 hci_remote_host_features_evt(hdev, skb);
4048                 break;
4049
4050         case HCI_EV_LE_META:
4051                 hci_le_meta_evt(hdev, skb);
4052                 break;
4053
4054         case HCI_EV_CHANNEL_SELECTED:
4055                 hci_chan_selected_evt(hdev, skb);
4056                 break;
4057
4058         case HCI_EV_REMOTE_OOB_DATA_REQUEST:
4059                 hci_remote_oob_data_request_evt(hdev, skb);
4060                 break;
4061
4062         case HCI_EV_PHY_LINK_COMPLETE:
4063                 hci_phy_link_complete_evt(hdev, skb);
4064                 break;
4065
4066         case HCI_EV_LOGICAL_LINK_COMPLETE:
4067                 hci_loglink_complete_evt(hdev, skb);
4068                 break;
4069
4070         case HCI_EV_NUM_COMP_BLOCKS:
4071                 hci_num_comp_blocks_evt(hdev, skb);
4072                 break;
4073
4074         default:
4075                 BT_DBG("%s event 0x%2.2x", hdev->name, event);
4076                 break;
4077         }
4078
4079         kfree_skb(skb);
4080         hdev->stat.evt_rx++;
4081 }