/*
   BlueZ - Bluetooth protocol stack for Linux
   Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.

   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>

   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License version 2 as
   published by the Free Software Foundation;

   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
   SOFTWARE IS DISCLAIMED.
*/

/* Bluetooth HCI event handling. */

#include <asm/unaligned.h>

#include <net/bluetooth/bluetooth.h>
#include <net/bluetooth/hci_core.h>
#include <net/bluetooth/mgmt.h>

#include "hci_request.h"
#include "hci_debugfs.h"
#include "a2mp.h"
#include "amp.h"
#include "smp.h"

#define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
                 "\x00\x00\x00\x00\x00\x00\x00\x00"

/* Handle HCI Event packets */

static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
{
        __u8 status = *((__u8 *) skb->data);

        BT_DBG("%s status 0x%2.2x", hdev->name, status);

        if (status)
                return;

        clear_bit(HCI_INQUIRY, &hdev->flags);
        smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
        wake_up_bit(&hdev->flags, HCI_INQUIRY);

        hci_dev_lock(hdev);
        /* Set discovery state to stopped if we're not doing LE active
         * scanning.
         */
        if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
            hdev->le_scan_type != LE_SCAN_ACTIVE)
                hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
        hci_dev_unlock(hdev);

        hci_conn_check_pending(hdev);
}

static void hci_cc_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
{
        __u8 status = *((__u8 *) skb->data);

        BT_DBG("%s status 0x%2.2x", hdev->name, status);

        if (status)
                return;

        hci_dev_set_flag(hdev, HCI_PERIODIC_INQ);
}

static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
{
        __u8 status = *((__u8 *) skb->data);

        BT_DBG("%s status 0x%2.2x", hdev->name, status);

        if (status)
                return;

        hci_dev_clear_flag(hdev, HCI_PERIODIC_INQ);

        hci_conn_check_pending(hdev);
}

static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev,
                                          struct sk_buff *skb)
{
        BT_DBG("%s", hdev->name);
}

static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
{
        struct hci_rp_role_discovery *rp = (void *) skb->data;
        struct hci_conn *conn;

        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);

        if (rp->status)
                return;

        hci_dev_lock(hdev);

        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
        if (conn)
                conn->role = rp->role;

        hci_dev_unlock(hdev);
}

static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
{
        struct hci_rp_read_link_policy *rp = (void *) skb->data;
        struct hci_conn *conn;

        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);

        if (rp->status)
                return;

        hci_dev_lock(hdev);

        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
        if (conn)
                conn->link_policy = __le16_to_cpu(rp->policy);

        hci_dev_unlock(hdev);
}

static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
{
        struct hci_rp_write_link_policy *rp = (void *) skb->data;
        struct hci_conn *conn;
        void *sent;

        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);

        if (rp->status)
                return;

        sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
        if (!sent)
                return;

        hci_dev_lock(hdev);

        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
        if (conn)
                conn->link_policy = get_unaligned_le16(sent + 2);

        hci_dev_unlock(hdev);
}

static void hci_cc_read_def_link_policy(struct hci_dev *hdev,
                                        struct sk_buff *skb)
{
        struct hci_rp_read_def_link_policy *rp = (void *) skb->data;

        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);

        if (rp->status)
                return;

        hdev->link_policy = __le16_to_cpu(rp->policy);
}

static void hci_cc_write_def_link_policy(struct hci_dev *hdev,
                                         struct sk_buff *skb)
{
        __u8 status = *((__u8 *) skb->data);
        void *sent;

        BT_DBG("%s status 0x%2.2x", hdev->name, status);

        if (status)
                return;

        sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
        if (!sent)
                return;

        hdev->link_policy = get_unaligned_le16(sent);
}

static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
{
        __u8 status = *((__u8 *) skb->data);

        BT_DBG("%s status 0x%2.2x", hdev->name, status);

        clear_bit(HCI_RESET, &hdev->flags);

        if (status)
                return;

        /* Reset all non-persistent flags */
        hci_dev_clear_volatile_flags(hdev);

        hci_discovery_set_state(hdev, DISCOVERY_STOPPED);

        hdev->inq_tx_power = HCI_TX_POWER_INVALID;
        hdev->adv_tx_power = HCI_TX_POWER_INVALID;

        memset(hdev->adv_data, 0, sizeof(hdev->adv_data));
        hdev->adv_data_len = 0;

        memset(hdev->scan_rsp_data, 0, sizeof(hdev->scan_rsp_data));
        hdev->scan_rsp_data_len = 0;

        hdev->le_scan_type = LE_SCAN_PASSIVE;

        hdev->ssp_debug_mode = 0;

        hci_bdaddr_list_clear(&hdev->le_white_list);
}

static void hci_cc_read_stored_link_key(struct hci_dev *hdev,
                                        struct sk_buff *skb)
{
        struct hci_rp_read_stored_link_key *rp = (void *)skb->data;
        struct hci_cp_read_stored_link_key *sent;

        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);

        sent = hci_sent_cmd_data(hdev, HCI_OP_READ_STORED_LINK_KEY);
        if (!sent)
                return;

        if (!rp->status && sent->read_all == 0x01) {
                hdev->stored_max_keys = rp->max_keys;
                hdev->stored_num_keys = rp->num_keys;
        }
}

static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
                                          struct sk_buff *skb)
{
        struct hci_rp_delete_stored_link_key *rp = (void *)skb->data;

        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);

        if (rp->status)
                return;

        if (rp->num_keys <= hdev->stored_num_keys)
                hdev->stored_num_keys -= rp->num_keys;
        else
                hdev->stored_num_keys = 0;
}

static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
{
        __u8 status = *((__u8 *) skb->data);
        void *sent;

        BT_DBG("%s status 0x%2.2x", hdev->name, status);

        sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
        if (!sent)
                return;

        hci_dev_lock(hdev);

        if (hci_dev_test_flag(hdev, HCI_MGMT))
                mgmt_set_local_name_complete(hdev, sent, status);
        else if (!status)
                memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);

        hci_dev_unlock(hdev);
}

static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
{
        struct hci_rp_read_local_name *rp = (void *) skb->data;

        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);

        if (rp->status)
                return;

        if (hci_dev_test_flag(hdev, HCI_SETUP) ||
            hci_dev_test_flag(hdev, HCI_CONFIG))
                memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
}

static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
{
        __u8 status = *((__u8 *) skb->data);
        void *sent;

        BT_DBG("%s status 0x%2.2x", hdev->name, status);

        sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
        if (!sent)
                return;

        hci_dev_lock(hdev);

        if (!status) {
                __u8 param = *((__u8 *) sent);

                if (param == AUTH_ENABLED)
                        set_bit(HCI_AUTH, &hdev->flags);
                else
                        clear_bit(HCI_AUTH, &hdev->flags);
        }

        if (hci_dev_test_flag(hdev, HCI_MGMT))
                mgmt_auth_enable_complete(hdev, status);

        hci_dev_unlock(hdev);
}

static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
{
        __u8 status = *((__u8 *) skb->data);
        __u8 param;
        void *sent;

        BT_DBG("%s status 0x%2.2x", hdev->name, status);

        if (status)
                return;

        sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
        if (!sent)
                return;

        param = *((__u8 *) sent);

        if (param)
                set_bit(HCI_ENCRYPT, &hdev->flags);
        else
                clear_bit(HCI_ENCRYPT, &hdev->flags);
}

static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
{
        __u8 status = *((__u8 *) skb->data);
        __u8 param;
        void *sent;

        BT_DBG("%s status 0x%2.2x", hdev->name, status);

        sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
        if (!sent)
                return;

        param = *((__u8 *) sent);

        hci_dev_lock(hdev);

        if (status) {
                hdev->discov_timeout = 0;
                goto done;
        }

        if (param & SCAN_INQUIRY)
                set_bit(HCI_ISCAN, &hdev->flags);
        else
                clear_bit(HCI_ISCAN, &hdev->flags);

        if (param & SCAN_PAGE)
                set_bit(HCI_PSCAN, &hdev->flags);
        else
                clear_bit(HCI_PSCAN, &hdev->flags);

done:
        hci_dev_unlock(hdev);
}

static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
{
        struct hci_rp_read_class_of_dev *rp = (void *) skb->data;

        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);

        if (rp->status)
                return;

        memcpy(hdev->dev_class, rp->dev_class, 3);

        BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
               hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
}

static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
{
        __u8 status = *((__u8 *) skb->data);
        void *sent;

        BT_DBG("%s status 0x%2.2x", hdev->name, status);

        sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
        if (!sent)
                return;

        hci_dev_lock(hdev);

        if (status == 0)
                memcpy(hdev->dev_class, sent, 3);

        if (hci_dev_test_flag(hdev, HCI_MGMT))
                mgmt_set_class_of_dev_complete(hdev, sent, status);

        hci_dev_unlock(hdev);
}

static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
{
        struct hci_rp_read_voice_setting *rp = (void *) skb->data;
        __u16 setting;

        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);

        if (rp->status)
                return;

        setting = __le16_to_cpu(rp->voice_setting);

        if (hdev->voice_setting == setting)
                return;

        hdev->voice_setting = setting;

        BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);

        if (hdev->notify)
                hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
}

static void hci_cc_write_voice_setting(struct hci_dev *hdev,
                                       struct sk_buff *skb)
{
        __u8 status = *((__u8 *) skb->data);
        __u16 setting;
        void *sent;

        BT_DBG("%s status 0x%2.2x", hdev->name, status);

        if (status)
                return;

        sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
        if (!sent)
                return;

        setting = get_unaligned_le16(sent);

        if (hdev->voice_setting == setting)
                return;

        hdev->voice_setting = setting;

        BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);

        if (hdev->notify)
                hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
}

static void hci_cc_read_num_supported_iac(struct hci_dev *hdev,
                                          struct sk_buff *skb)
{
        struct hci_rp_read_num_supported_iac *rp = (void *) skb->data;

        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);

        if (rp->status)
                return;

        hdev->num_iac = rp->num_iac;

        BT_DBG("%s num iac %d", hdev->name, hdev->num_iac);
}

static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
{
        __u8 status = *((__u8 *) skb->data);
        struct hci_cp_write_ssp_mode *sent;

        BT_DBG("%s status 0x%2.2x", hdev->name, status);

        sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
        if (!sent)
                return;

        hci_dev_lock(hdev);

        if (!status) {
                if (sent->mode)
                        hdev->features[1][0] |= LMP_HOST_SSP;
                else
                        hdev->features[1][0] &= ~LMP_HOST_SSP;
        }

        if (hci_dev_test_flag(hdev, HCI_MGMT))
                mgmt_ssp_enable_complete(hdev, sent->mode, status);
        else if (!status) {
                if (sent->mode)
                        hci_dev_set_flag(hdev, HCI_SSP_ENABLED);
                else
                        hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
        }

        hci_dev_unlock(hdev);
}

static void hci_cc_write_sc_support(struct hci_dev *hdev, struct sk_buff *skb)
{
        u8 status = *((u8 *) skb->data);
        struct hci_cp_write_sc_support *sent;

        BT_DBG("%s status 0x%2.2x", hdev->name, status);

        sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SC_SUPPORT);
        if (!sent)
                return;

        hci_dev_lock(hdev);

        if (!status) {
                if (sent->support)
                        hdev->features[1][0] |= LMP_HOST_SC;
                else
                        hdev->features[1][0] &= ~LMP_HOST_SC;
        }

        if (!hci_dev_test_flag(hdev, HCI_MGMT) && !status) {
                if (sent->support)
                        hci_dev_set_flag(hdev, HCI_SC_ENABLED);
                else
                        hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
        }

        hci_dev_unlock(hdev);
}

static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
{
        struct hci_rp_read_local_version *rp = (void *) skb->data;

        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);

        if (rp->status)
                return;

        if (hci_dev_test_flag(hdev, HCI_SETUP) ||
            hci_dev_test_flag(hdev, HCI_CONFIG)) {
                hdev->hci_ver = rp->hci_ver;
                hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
                hdev->lmp_ver = rp->lmp_ver;
                hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
                hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
        }
}

static void hci_cc_read_local_commands(struct hci_dev *hdev,
                                       struct sk_buff *skb)
{
        struct hci_rp_read_local_commands *rp = (void *) skb->data;

        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);

        if (rp->status)
                return;

        if (hci_dev_test_flag(hdev, HCI_SETUP) ||
            hci_dev_test_flag(hdev, HCI_CONFIG))
                memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
}

static void hci_cc_read_local_features(struct hci_dev *hdev,
                                       struct sk_buff *skb)
{
        struct hci_rp_read_local_features *rp = (void *) skb->data;

        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);

        if (rp->status)
                return;

        memcpy(hdev->features, rp->features, 8);

        /* Adjust default settings according to features
         * supported by device. */

        if (hdev->features[0][0] & LMP_3SLOT)
                hdev->pkt_type |= (HCI_DM3 | HCI_DH3);

        if (hdev->features[0][0] & LMP_5SLOT)
                hdev->pkt_type |= (HCI_DM5 | HCI_DH5);

        if (hdev->features[0][1] & LMP_HV2) {
                hdev->pkt_type  |= (HCI_HV2);
                hdev->esco_type |= (ESCO_HV2);
        }

        if (hdev->features[0][1] & LMP_HV3) {
                hdev->pkt_type  |= (HCI_HV3);
                hdev->esco_type |= (ESCO_HV3);
        }

        if (lmp_esco_capable(hdev))
                hdev->esco_type |= (ESCO_EV3);

        if (hdev->features[0][4] & LMP_EV4)
                hdev->esco_type |= (ESCO_EV4);

        if (hdev->features[0][4] & LMP_EV5)
                hdev->esco_type |= (ESCO_EV5);

        if (hdev->features[0][5] & LMP_EDR_ESCO_2M)
                hdev->esco_type |= (ESCO_2EV3);

        if (hdev->features[0][5] & LMP_EDR_ESCO_3M)
                hdev->esco_type |= (ESCO_3EV3);

        if (hdev->features[0][5] & LMP_EDR_3S_ESCO)
                hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
}

static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
                                           struct sk_buff *skb)
{
        struct hci_rp_read_local_ext_features *rp = (void *) skb->data;

        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);

        if (rp->status)
                return;

        if (hdev->max_page < rp->max_page)
                hdev->max_page = rp->max_page;

        if (rp->page < HCI_MAX_PAGES)
                memcpy(hdev->features[rp->page], rp->features, 8);
}

static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
                                          struct sk_buff *skb)
{
        struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;

        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);

        if (rp->status)
                return;

        hdev->flow_ctl_mode = rp->mode;
}

static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
{
        struct hci_rp_read_buffer_size *rp = (void *) skb->data;

        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);

        if (rp->status)
                return;

        hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
        hdev->sco_mtu  = rp->sco_mtu;
        hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
        hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);

        if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
                hdev->sco_mtu  = 64;
                hdev->sco_pkts = 8;
        }

        hdev->acl_cnt = hdev->acl_pkts;
        hdev->sco_cnt = hdev->sco_pkts;

        BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
               hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
}

static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
{
        struct hci_rp_read_bd_addr *rp = (void *) skb->data;

        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);

        if (rp->status)
                return;

        if (test_bit(HCI_INIT, &hdev->flags))
                bacpy(&hdev->bdaddr, &rp->bdaddr);

        if (hci_dev_test_flag(hdev, HCI_SETUP))
                bacpy(&hdev->setup_addr, &rp->bdaddr);
}

static void hci_cc_read_page_scan_activity(struct hci_dev *hdev,
                                           struct sk_buff *skb)
{
        struct hci_rp_read_page_scan_activity *rp = (void *) skb->data;

        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);

        if (rp->status)
                return;

        if (test_bit(HCI_INIT, &hdev->flags)) {
                hdev->page_scan_interval = __le16_to_cpu(rp->interval);
                hdev->page_scan_window = __le16_to_cpu(rp->window);
        }
}

static void hci_cc_write_page_scan_activity(struct hci_dev *hdev,
                                            struct sk_buff *skb)
{
        u8 status = *((u8 *) skb->data);
        struct hci_cp_write_page_scan_activity *sent;

        BT_DBG("%s status 0x%2.2x", hdev->name, status);

        if (status)
                return;

        sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY);
        if (!sent)
                return;

        hdev->page_scan_interval = __le16_to_cpu(sent->interval);
        hdev->page_scan_window = __le16_to_cpu(sent->window);
}

static void hci_cc_read_page_scan_type(struct hci_dev *hdev,
                                           struct sk_buff *skb)
{
        struct hci_rp_read_page_scan_type *rp = (void *) skb->data;

        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);

        if (rp->status)
                return;

        if (test_bit(HCI_INIT, &hdev->flags))
                hdev->page_scan_type = rp->type;
}

static void hci_cc_write_page_scan_type(struct hci_dev *hdev,
                                        struct sk_buff *skb)
{
        u8 status = *((u8 *) skb->data);
        u8 *type;

        BT_DBG("%s status 0x%2.2x", hdev->name, status);

        if (status)
                return;

        type = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE);
        if (type)
                hdev->page_scan_type = *type;
}

static void hci_cc_read_data_block_size(struct hci_dev *hdev,
                                        struct sk_buff *skb)
{
        struct hci_rp_read_data_block_size *rp = (void *) skb->data;

        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);

        if (rp->status)
                return;

        hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
        hdev->block_len = __le16_to_cpu(rp->block_len);
        hdev->num_blocks = __le16_to_cpu(rp->num_blocks);

        hdev->block_cnt = hdev->num_blocks;

        BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
               hdev->block_cnt, hdev->block_len);
}

static void hci_cc_read_clock(struct hci_dev *hdev, struct sk_buff *skb)
{
        struct hci_rp_read_clock *rp = (void *) skb->data;
        struct hci_cp_read_clock *cp;
        struct hci_conn *conn;

        BT_DBG("%s", hdev->name);

        if (skb->len < sizeof(*rp))
                return;

        if (rp->status)
                return;

        hci_dev_lock(hdev);

        cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
        if (!cp)
                goto unlock;

        if (cp->which == 0x00) {
                hdev->clock = le32_to_cpu(rp->clock);
                goto unlock;
        }

        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
        if (conn) {
                conn->clock = le32_to_cpu(rp->clock);
                conn->clock_accuracy = le16_to_cpu(rp->accuracy);
        }

unlock:
        hci_dev_unlock(hdev);
}

static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
                                       struct sk_buff *skb)
{
        struct hci_rp_read_local_amp_info *rp = (void *) skb->data;

        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);

        if (rp->status)
                return;

        hdev->amp_status = rp->amp_status;
        hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
        hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
        hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
        hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
        hdev->amp_type = rp->amp_type;
        hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
        hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
        hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
        hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
}

static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
                                         struct sk_buff *skb)
{
        struct hci_rp_read_inq_rsp_tx_power *rp = (void *) skb->data;

        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);

        if (rp->status)
                return;

        hdev->inq_tx_power = rp->tx_power;
}

static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
{
        struct hci_rp_pin_code_reply *rp = (void *) skb->data;
        struct hci_cp_pin_code_reply *cp;
        struct hci_conn *conn;

        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);

        hci_dev_lock(hdev);

        if (hci_dev_test_flag(hdev, HCI_MGMT))
                mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);

        if (rp->status)
                goto unlock;

        cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
        if (!cp)
                goto unlock;

        conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
        if (conn)
                conn->pin_length = cp->pin_len;

unlock:
        hci_dev_unlock(hdev);
}

static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
{
        struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;

        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);

        hci_dev_lock(hdev);

        if (hci_dev_test_flag(hdev, HCI_MGMT))
                mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
                                                 rp->status);

        hci_dev_unlock(hdev);
}

static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
                                       struct sk_buff *skb)
{
        struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;

        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);

        if (rp->status)
                return;

        hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
        hdev->le_pkts = rp->le_max_pkt;

        hdev->le_cnt = hdev->le_pkts;

        BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
}

static void hci_cc_le_read_local_features(struct hci_dev *hdev,
                                          struct sk_buff *skb)
{
        struct hci_rp_le_read_local_features *rp = (void *) skb->data;

        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);

        if (rp->status)
                return;

        memcpy(hdev->le_features, rp->features, 8);
}

static void hci_cc_le_read_adv_tx_power(struct hci_dev *hdev,
                                        struct sk_buff *skb)
{
        struct hci_rp_le_read_adv_tx_power *rp = (void *) skb->data;

        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);

        if (rp->status)
                return;

        hdev->adv_tx_power = rp->tx_power;
}

static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
{
        struct hci_rp_user_confirm_reply *rp = (void *) skb->data;

        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);

        hci_dev_lock(hdev);

        if (hci_dev_test_flag(hdev, HCI_MGMT))
                mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,
                                                 rp->status);

        hci_dev_unlock(hdev);
}

static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
                                          struct sk_buff *skb)
{
        struct hci_rp_user_confirm_reply *rp = (void *) skb->data;

        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);

        hci_dev_lock(hdev);

        if (hci_dev_test_flag(hdev, HCI_MGMT))
                mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
                                                     ACL_LINK, 0, rp->status);

        hci_dev_unlock(hdev);
}

static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
{
        struct hci_rp_user_confirm_reply *rp = (void *) skb->data;

        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);

        hci_dev_lock(hdev);

        if (hci_dev_test_flag(hdev, HCI_MGMT))
                mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
                                                 0, rp->status);

        hci_dev_unlock(hdev);
}

static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
                                          struct sk_buff *skb)
{
        struct hci_rp_user_confirm_reply *rp = (void *) skb->data;

        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);

        hci_dev_lock(hdev);

        if (hci_dev_test_flag(hdev, HCI_MGMT))

                mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
                                                     ACL_LINK, 0, rp->status);

        hci_dev_unlock(hdev);
}

static void hci_cc_read_local_oob_data(struct hci_dev *hdev,
                                       struct sk_buff *skb)
{
        struct hci_rp_read_local_oob_data *rp = (void *) skb->data;

        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
}

static void hci_cc_read_local_oob_ext_data(struct hci_dev *hdev,
                                           struct sk_buff *skb)
{
        struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;

        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
}

static void hci_cc_le_set_random_addr(struct hci_dev *hdev, struct sk_buff *skb)
{
        __u8 status = *((__u8 *) skb->data);
        bdaddr_t *sent;

        BT_DBG("%s status 0x%2.2x", hdev->name, status);

        if (status)
                return;

        sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_RANDOM_ADDR);
        if (!sent)
                return;

        hci_dev_lock(hdev);

        bacpy(&hdev->random_addr, sent);

        hci_dev_unlock(hdev);
}

static void hci_cc_le_set_adv_enable(struct hci_dev *hdev, struct sk_buff *skb)
{
        __u8 *sent, status = *((__u8 *) skb->data);

        BT_DBG("%s status 0x%2.2x", hdev->name, status);

        if (status)
                return;

        sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_ENABLE);
        if (!sent)
                return;

        hci_dev_lock(hdev);

        /* If we're doing connection initiation as peripheral. Set a
         * timeout in case something goes wrong.
         */
        if (*sent) {
                struct hci_conn *conn;

                hci_dev_set_flag(hdev, HCI_LE_ADV);

                conn = hci_lookup_le_connect(hdev);
                if (conn)
                        queue_delayed_work(hdev->workqueue,
                                           &conn->le_conn_timeout,
                                           conn->conn_timeout);
        } else {
                hci_dev_clear_flag(hdev, HCI_LE_ADV);
        }

        hci_dev_unlock(hdev);
}

static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
{
        struct hci_cp_le_set_scan_param *cp;
        __u8 status = *((__u8 *) skb->data);

        BT_DBG("%s status 0x%2.2x", hdev->name, status);

        if (status)
                return;

        cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_PARAM);
        if (!cp)
                return;

        hci_dev_lock(hdev);

        hdev->le_scan_type = cp->type;

        hci_dev_unlock(hdev);
}

static bool has_pending_adv_report(struct hci_dev *hdev)
{
        struct discovery_state *d = &hdev->discovery;

        return bacmp(&d->last_adv_addr, BDADDR_ANY);
}

static void clear_pending_adv_report(struct hci_dev *hdev)
{
        struct discovery_state *d = &hdev->discovery;

        bacpy(&d->last_adv_addr, BDADDR_ANY);
        d->last_adv_data_len = 0;
}

static void store_pending_adv_report(struct hci_dev *hdev, bdaddr_t *bdaddr,
                                     u8 bdaddr_type, s8 rssi, u32 flags,
                                     u8 *data, u8 len)
{
        struct discovery_state *d = &hdev->discovery;

        bacpy(&d->last_adv_addr, bdaddr);
        d->last_adv_addr_type = bdaddr_type;
        d->last_adv_rssi = rssi;
        d->last_adv_flags = flags;
        memcpy(d->last_adv_data, data, len);
        d->last_adv_data_len = len;
}

static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
                                      struct sk_buff *skb)
{
        struct hci_cp_le_set_scan_enable *cp;
        __u8 status = *((__u8 *) skb->data);

        BT_DBG("%s status 0x%2.2x", hdev->name, status);

        if (status)
                return;

        cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
        if (!cp)
                return;

        hci_dev_lock(hdev);

        switch (cp->enable) {
        case LE_SCAN_ENABLE:
                hci_dev_set_flag(hdev, HCI_LE_SCAN);
                if (hdev->le_scan_type == LE_SCAN_ACTIVE)
                        clear_pending_adv_report(hdev);
                break;

        case LE_SCAN_DISABLE:
                /* We do this here instead of when setting DISCOVERY_STOPPED
                 * since the latter would potentially require waiting for
                 * inquiry to stop too.
                 */
                if (has_pending_adv_report(hdev)) {
                        struct discovery_state *d = &hdev->discovery;

                        mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
                                          d->last_adv_addr_type, NULL,
                                          d->last_adv_rssi, d->last_adv_flags,
                                          d->last_adv_data,
                                          d->last_adv_data_len, NULL, 0);
                }

                /* Cancel this timer so that we don't try to disable scanning
                 * when it's already disabled.
                 */
                cancel_delayed_work(&hdev->le_scan_disable);

                hci_dev_clear_flag(hdev, HCI_LE_SCAN);

                /* The HCI_LE_SCAN_INTERRUPTED flag indicates that we
                 * interrupted scanning due to a connect request. Mark
                 * therefore discovery as stopped. If this was not
                 * because of a connect request advertising might have
                 * been disabled because of active scanning, so
                 * re-enable it again if necessary.
                 */
                if (hci_dev_test_and_clear_flag(hdev, HCI_LE_SCAN_INTERRUPTED))
                        hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
                else if (!hci_dev_test_flag(hdev, HCI_LE_ADV) &&
                         hdev->discovery.state == DISCOVERY_FINDING)
                        hci_req_reenable_advertising(hdev);

                break;

        default:
                bt_dev_err(hdev, "use of reserved LE_Scan_Enable param %d",
                           cp->enable);
                break;
        }

        hci_dev_unlock(hdev);
}

static void hci_cc_le_read_white_list_size(struct hci_dev *hdev,
                                           struct sk_buff *skb)
{
        struct hci_rp_le_read_white_list_size *rp = (void *) skb->data;

        BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);

        if (rp->status)
                return;

        hdev->le_white_list_size = rp->size;
}

static void hci_cc_le_clear_white_list(struct hci_dev *hdev,
                                       struct sk_buff *skb)
{
        __u8 status = *((__u8 *) skb->data);

        BT_DBG("%s status 0x%2.2x", hdev->name, status);

        if (status)
                return;

        hci_bdaddr_list_clear(&hdev->le_white_list);
}

static void hci_cc_le_add_to_white_list(struct hci_dev *hdev,
                                        struct sk_buff *skb)
{
        struct hci_cp_le_add_to_white_list *sent;
        __u8 status = *((__u8 *) skb->data);

        BT_DBG("%s status 0x%2.2x", hdev->name, status);

        if (status)
                return;

        sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_WHITE_LIST);
        if (!sent)
                return;

        hci_bdaddr_list_add(&hdev->le_white_list, &sent->bdaddr,
                           sent->bdaddr_type);
}

static void hci_cc_le_del_from_white_list(struct hci_dev *hdev,
                                          struct sk_buff *skb)
{
        struct hci_cp_le_del_from_white_list *sent;
        __u8 status = *((__u8 *) skb->data);

        BT_DBG("%s status 0x%2.2x", hdev->name, status);

        if (status)
                return;

        sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_WHITE_LIST);
        if (!sent)
                return;

        hci_bdaddr_list_del(&hdev->le_white_list, &sent->bdaddr,
                            sent->bdaddr_type);
}

static void hci_cc_le_read_supported_states(struct hci_dev *hdev,
                                            struct sk_buff *skb)
{
        struct hci_rp_le_read_supported_states *rp = (void *) skb->data;

        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);

        if (rp->status)
                return;

        memcpy(hdev->le_states, rp->le_states, 8);
}

static void hci_cc_le_read_def_data_len(struct hci_dev *hdev,
                                        struct sk_buff *skb)
{
        struct hci_rp_le_read_def_data_len *rp = (void *) skb->data;

        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);

        if (rp->status)
                return;

        hdev->le_def_tx_len = le16_to_cpu(rp->tx_len);
        hdev->le_def_tx_time = le16_to_cpu(rp->tx_time);
}

static void hci_cc_le_write_def_data_len(struct hci_dev *hdev,
                                         struct sk_buff *skb)
{
        struct hci_cp_le_write_def_data_len *sent;
        __u8 status = *((__u8 *) skb->data);

        BT_DBG("%s status 0x%2.2x", hdev->name, status);

        if (status)
                return;

        sent = hci_sent_cmd_data(hdev, HCI_OP_LE_WRITE_DEF_DATA_LEN);
        if (!sent)
                return;

        hdev->le_def_tx_len = le16_to_cpu(sent->tx_len);
        hdev->le_def_tx_time = le16_to_cpu(sent->tx_time);
}

static void hci_cc_le_read_max_data_len(struct hci_dev *hdev,
                                        struct sk_buff *skb)
{
        struct hci_rp_le_read_max_data_len *rp = (void *) skb->data;

        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);

        if (rp->status)
                return;

        hdev->le_max_tx_len = le16_to_cpu(rp->tx_len);
        hdev->le_max_tx_time = le16_to_cpu(rp->tx_time);
        hdev->le_max_rx_len = le16_to_cpu(rp->rx_len);
        hdev->le_max_rx_time = le16_to_cpu(rp->rx_time);
}

static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
                                           struct sk_buff *skb)
{
        struct hci_cp_write_le_host_supported *sent;
        __u8 status = *((__u8 *) skb->data);

        BT_DBG("%s status 0x%2.2x", hdev->name, status);

        if (status)
                return;

        sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
        if (!sent)
                return;

        hci_dev_lock(hdev);

        if (sent->le) {
                hdev->features[1][0] |= LMP_HOST_LE;
                hci_dev_set_flag(hdev, HCI_LE_ENABLED);
        } else {
                hdev->features[1][0] &= ~LMP_HOST_LE;
                hci_dev_clear_flag(hdev, HCI_LE_ENABLED);
                hci_dev_clear_flag(hdev, HCI_ADVERTISING);
        }

        if (sent->simul)
                hdev->features[1][0] |= LMP_HOST_LE_BREDR;
        else
                hdev->features[1][0] &= ~LMP_HOST_LE_BREDR;

        hci_dev_unlock(hdev);
}

static void hci_cc_set_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
{
        struct hci_cp_le_set_adv_param *cp;
        u8 status = *((u8 *) skb->data);

        BT_DBG("%s status 0x%2.2x", hdev->name, status);

        if (status)
                return;

        cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_PARAM);
        if (!cp)
                return;

        hci_dev_lock(hdev);
        hdev->adv_addr_type = cp->own_address_type;
        hci_dev_unlock(hdev);
}

static void hci_cc_read_rssi(struct hci_dev *hdev, struct sk_buff *skb)
{
        struct hci_rp_read_rssi *rp = (void *) skb->data;
        struct hci_conn *conn;

        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);

        if (rp->status)
                return;

        hci_dev_lock(hdev);

        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
        if (conn)
                conn->rssi = rp->rssi;

        hci_dev_unlock(hdev);
}

static void hci_cc_read_tx_power(struct hci_dev *hdev, struct sk_buff *skb)
{
        struct hci_cp_read_tx_power *sent;
        struct hci_rp_read_tx_power *rp = (void *) skb->data;
        struct hci_conn *conn;

        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);

        if (rp->status)
                return;

        sent = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
        if (!sent)
                return;

        hci_dev_lock(hdev);

        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
        if (!conn)
                goto unlock;

        switch (sent->type) {
        case 0x00:
                conn->tx_power = rp->tx_power;
                break;
        case 0x01:
                conn->max_tx_power = rp->tx_power;
                break;
        }

unlock:
        hci_dev_unlock(hdev);
}

static void hci_cc_write_ssp_debug_mode(struct hci_dev *hdev, struct sk_buff *skb)
{
        u8 status = *((u8 *) skb->data);
        u8 *mode;

        BT_DBG("%s status 0x%2.2x", hdev->name, status);

        if (status)
                return;

        mode = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE);
        if (mode)
                hdev->ssp_debug_mode = *mode;
}

static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
{
        BT_DBG("%s status 0x%2.2x", hdev->name, status);

        if (status) {
                hci_conn_check_pending(hdev);
                return;
        }

        set_bit(HCI_INQUIRY, &hdev->flags);
}

static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
{
        struct hci_cp_create_conn *cp;
        struct hci_conn *conn;

        BT_DBG("%s status 0x%2.2x", hdev->name, status);

        cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
        if (!cp)
                return;

        hci_dev_lock(hdev);

        conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);

        BT_DBG("%s bdaddr %pMR hcon %p", hdev->name, &cp->bdaddr, conn);

        if (status) {
                if (conn && conn->state == BT_CONNECT) {
                        if (status != 0x0c || conn->attempt > 2) {
                                conn->state = BT_CLOSED;
                                hci_connect_cfm(conn, status);
                                hci_conn_del(conn);
                        } else
                                conn->state = BT_CONNECT2;
                }
        } else {
                if (!conn) {
                        conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr,
                                            HCI_ROLE_MASTER);
                        if (!conn)
                                bt_dev_err(hdev, "no memory for new connection");
                }
        }

        hci_dev_unlock(hdev);
}

static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
{
        struct hci_cp_add_sco *cp;
        struct hci_conn *acl, *sco;
        __u16 handle;

        BT_DBG("%s status 0x%2.2x", hdev->name, status);

        if (!status)
                return;

        cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
        if (!cp)
                return;

        handle = __le16_to_cpu(cp->handle);

        BT_DBG("%s handle 0x%4.4x", hdev->name, handle);

        hci_dev_lock(hdev);

        acl = hci_conn_hash_lookup_handle(hdev, handle);
        if (acl) {
                sco = acl->link;
                if (sco) {
                        sco->state = BT_CLOSED;

                        hci_connect_cfm(sco, status);
                        hci_conn_del(sco);
                }
        }

        hci_dev_unlock(hdev);
}

static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
{
        struct hci_cp_auth_requested *cp;
        struct hci_conn *conn;

        BT_DBG("%s status 0x%2.2x", hdev->name, status);

        if (!status)
                return;

        cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
        if (!cp)
                return;

        hci_dev_lock(hdev);

        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
        if (conn) {
                if (conn->state == BT_CONFIG) {
                        hci_connect_cfm(conn, status);
                        hci_conn_drop(conn);
                }
        }

        hci_dev_unlock(hdev);
}

static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
{
        struct hci_cp_set_conn_encrypt *cp;
        struct hci_conn *conn;

        BT_DBG("%s status 0x%2.2x", hdev->name, status);

        if (!status)
                return;

        cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
        if (!cp)
                return;

        hci_dev_lock(hdev);

        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
        if (conn) {
                if (conn->state == BT_CONFIG) {
                        hci_connect_cfm(conn, status);
                        hci_conn_drop(conn);
                }
        }

        hci_dev_unlock(hdev);
}

static int hci_outgoing_auth_needed(struct hci_dev *hdev,
                                    struct hci_conn *conn)
{
        if (conn->state != BT_CONFIG || !conn->out)
                return 0;

        if (conn->pending_sec_level == BT_SECURITY_SDP)
                return 0;

        /* Only request authentication for SSP connections or non-SSP
         * devices with sec_level MEDIUM or HIGH or if MITM protection
         * is requested.
         */
        if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
            conn->pending_sec_level != BT_SECURITY_FIPS &&
            conn->pending_sec_level != BT_SECURITY_HIGH &&
            conn->pending_sec_level != BT_SECURITY_MEDIUM)
                return 0;

        return 1;
}

static int hci_resolve_name(struct hci_dev *hdev,
                                   struct inquiry_entry *e)
{
        struct hci_cp_remote_name_req cp;

        memset(&cp, 0, sizeof(cp));

        bacpy(&cp.bdaddr, &e->data.bdaddr);
        cp.pscan_rep_mode = e->data.pscan_rep_mode;
        cp.pscan_mode = e->data.pscan_mode;
        cp.clock_offset = e->data.clock_offset;

        return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
}

static bool hci_resolve_next_name(struct hci_dev *hdev)
{
        struct discovery_state *discov = &hdev->discovery;
        struct inquiry_entry *e;

        if (list_empty(&discov->resolve))
                return false;

        e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
        if (!e)
                return false;

        if (hci_resolve_name(hdev, e) == 0) {
                e->name_state = NAME_PENDING;
                return true;
        }

        return false;
}

static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
                                   bdaddr_t *bdaddr, u8 *name, u8 name_len)
{
        struct discovery_state *discov = &hdev->discovery;
        struct inquiry_entry *e;

        /* Update the mgmt connected state if necessary. Be careful with
         * conn objects that exist but are not (yet) connected however.
         * Only those in BT_CONFIG or BT_CONNECTED states can be
         * considered connected.
         */
        if (conn &&
            (conn->state == BT_CONFIG || conn->state == BT_CONNECTED) &&
            !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
                mgmt_device_connected(hdev, conn, 0, name, name_len);

        if (discov->state == DISCOVERY_STOPPED)
                return;

        if (discov->state == DISCOVERY_STOPPING)
                goto discov_complete;

        if (discov->state != DISCOVERY_RESOLVING)
                return;

        e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
        /* If the device was not found in a list of found devices names of which
         * are pending. there is no need to continue resolving a next name as it
         * will be done upon receiving another Remote Name Request Complete
         * Event */
        if (!e)
                return;

        list_del(&e->list);
        if (name) {
                e->name_state = NAME_KNOWN;
                mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
                                 e->data.rssi, name, name_len);
        } else {
                e->name_state = NAME_NOT_KNOWN;
        }

        if (hci_resolve_next_name(hdev))
                return;

discov_complete:
        hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
}

static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
{
        struct hci_cp_remote_name_req *cp;
        struct hci_conn *conn;

        BT_DBG("%s status 0x%2.2x", hdev->name, status);

        /* If successful wait for the name req complete event before
         * checking for the need to do authentication */
        if (!status)
                return;

        cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
        if (!cp)
                return;

        hci_dev_lock(hdev);

        conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);

        if (hci_dev_test_flag(hdev, HCI_MGMT))
                hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);

        if (!conn)
                goto unlock;

        if (!hci_outgoing_auth_needed(hdev, conn))
                goto unlock;

        if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
                struct hci_cp_auth_requested auth_cp;

                set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);

                auth_cp.handle = __cpu_to_le16(conn->handle);
                hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
                             sizeof(auth_cp), &auth_cp);
        }

unlock:
        hci_dev_unlock(hdev);
}

static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
{
        struct hci_cp_read_remote_features *cp;
        struct hci_conn *conn;

        BT_DBG("%s status 0x%2.2x", hdev->name, status);

        if (!status)
                return;

        cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
        if (!cp)
                return;

        hci_dev_lock(hdev);

        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
        if (conn) {
                if (conn->state == BT_CONFIG) {
                        hci_connect_cfm(conn, status);
                        hci_conn_drop(conn);
                }
        }

        hci_dev_unlock(hdev);
}

static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
{
        struct hci_cp_read_remote_ext_features *cp;
        struct hci_conn *conn;

        BT_DBG("%s status 0x%2.2x", hdev->name, status);

        if (!status)
                return;

        cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
        if (!cp)
                return;

        hci_dev_lock(hdev);

        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
        if (conn) {
                if (conn->state == BT_CONFIG) {
                        hci_connect_cfm(conn, status);
                        hci_conn_drop(conn);
                }
        }

        hci_dev_unlock(hdev);
}

static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
{
        struct hci_cp_setup_sync_conn *cp;
        struct hci_conn *acl, *sco;
        __u16 handle;

        BT_DBG("%s status 0x%2.2x", hdev->name, status);

        if (!status)
                return;

        cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
        if (!cp)
                return;

        handle = __le16_to_cpu(cp->handle);

        BT_DBG("%s handle 0x%4.4x", hdev->name, handle);

        hci_dev_lock(hdev);

        acl = hci_conn_hash_lookup_handle(hdev, handle);
        if (acl) {
                sco = acl->link;
                if (sco) {
                        sco->state = BT_CLOSED;

                        hci_connect_cfm(sco, status);
                        hci_conn_del(sco);
                }
        }

        hci_dev_unlock(hdev);
}

static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
{
        struct hci_cp_sniff_mode *cp;
        struct hci_conn *conn;

        BT_DBG("%s status 0x%2.2x", hdev->name, status);

        if (!status)
                return;

        cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
        if (!cp)
                return;

        hci_dev_lock(hdev);

        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
        if (conn) {
                clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);

                if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
                        hci_sco_setup(conn, status);
        }

        hci_dev_unlock(hdev);
}

static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
{
        struct hci_cp_exit_sniff_mode *cp;
        struct hci_conn *conn;

        BT_DBG("%s status 0x%2.2x", hdev->name, status);

        if (!status)
                return;

        cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
        if (!cp)
                return;

        hci_dev_lock(hdev);

        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
        if (conn) {
                clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);

                if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
                        hci_sco_setup(conn, status);
        }

        hci_dev_unlock(hdev);
}

static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
{
        struct hci_cp_disconnect *cp;
        struct hci_conn *conn;

        if (!status)
                return;

        cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
        if (!cp)
                return;

        hci_dev_lock(hdev);

        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
        if (conn)
                mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
                                       conn->dst_type, status);

        hci_dev_unlock(hdev);
}

static void hci_cs_le_create_conn(struct hci_dev *hdev, u8 status)
{
        struct hci_cp_le_create_conn *cp;
        struct hci_conn *conn;

        BT_DBG("%s status 0x%2.2x", hdev->name, status);

        /* All connection failure handling is taken care of by the
         * hci_le_conn_failed function which is triggered by the HCI
         * request completion callbacks used for connecting.
         */
        if (status)
                return;

        cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
        if (!cp)
                return;

        hci_dev_lock(hdev);

        conn = hci_conn_hash_lookup_le(hdev, &cp->peer_addr,
                                       cp->peer_addr_type);
        if (!conn)
                goto unlock;

        /* Store the initiator and responder address information which
         * is needed for SMP. These values will not change during the
         * lifetime of the connection.
         */
        conn->init_addr_type = cp->own_address_type;
        if (cp->own_address_type == ADDR_LE_DEV_RANDOM)
                bacpy(&conn->init_addr, &hdev->random_addr);
        else
                bacpy(&conn->init_addr, &hdev->bdaddr);

        conn->resp_addr_type = cp->peer_addr_type;
        bacpy(&conn->resp_addr, &cp->peer_addr);

        /* We don't want the connection attempt to stick around
         * indefinitely since LE doesn't have a page timeout concept
         * like BR/EDR. Set a timer for any connection that doesn't use
         * the white list for connecting.
         */
        if (cp->filter_policy == HCI_LE_USE_PEER_ADDR)
                queue_delayed_work(conn->hdev->workqueue,
                                   &conn->le_conn_timeout,
                                   conn->conn_timeout);

unlock:
        hci_dev_unlock(hdev);
}

static void hci_cs_le_read_remote_features(struct hci_dev *hdev, u8 status)
{
        struct hci_cp_le_read_remote_features *cp;
        struct hci_conn *conn;

        BT_DBG("%s status 0x%2.2x", hdev->name, status);

        if (!status)
                return;

        cp = hci_sent_cmd_data(hdev, HCI_OP_LE_READ_REMOTE_FEATURES);
        if (!cp)
                return;

        hci_dev_lock(hdev);

        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
        if (conn) {
                if (conn->state == BT_CONFIG) {
                        hci_connect_cfm(conn, status);
                        hci_conn_drop(conn);
                }
        }

        hci_dev_unlock(hdev);
}

static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
{
        struct hci_cp_le_start_enc *cp;
        struct hci_conn *conn;

        BT_DBG("%s status 0x%2.2x", hdev->name, status);

        if (!status)
                return;

        hci_dev_lock(hdev);

        cp = hci_sent_cmd_data(hdev, HCI_OP_LE_START_ENC);
        if (!cp)
                goto unlock;

        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
        if (!conn)
                goto unlock;

        if (conn->state != BT_CONNECTED)
                goto unlock;

        hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
        hci_conn_drop(conn);

unlock:
        hci_dev_unlock(hdev);
}

static void hci_cs_switch_role(struct hci_dev *hdev, u8 status)
{
        struct hci_cp_switch_role *cp;
        struct hci_conn *conn;

        BT_DBG("%s status 0x%2.2x", hdev->name, status);

        if (!status)
                return;

        cp = hci_sent_cmd_data(hdev, HCI_OP_SWITCH_ROLE);
        if (!cp)
                return;

        hci_dev_lock(hdev);

        conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
        if (conn)
                clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);

        hci_dev_unlock(hdev);
}

static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
{
        __u8 status = *((__u8 *) skb->data);
        struct discovery_state *discov = &hdev->discovery;
        struct inquiry_entry *e;

        BT_DBG("%s status 0x%2.2x", hdev->name, status);

        hci_conn_check_pending(hdev);

        if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
                return;

        smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
        wake_up_bit(&hdev->flags, HCI_INQUIRY);

        if (!hci_dev_test_flag(hdev, HCI_MGMT))
                return;

        hci_dev_lock(hdev);

        if (discov->state != DISCOVERY_FINDING)
                goto unlock;

        if (list_empty(&discov->resolve)) {
                /* When BR/EDR inquiry is active and no LE scanning is in
                 * progress, then change discovery state to indicate completion.
                 *
                 * When running LE scanning and BR/EDR inquiry simultaneously
                 * and the LE scan already finished, then change the discovery
                 * state to indicate completion.
                 */
                if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
                    !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
                        hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
                goto unlock;
        }

        e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
        if (e && hci_resolve_name(hdev, e) == 0) {
                e->name_state = NAME_PENDING;
                hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
        } else {
                /* When BR/EDR inquiry is active and no LE scanning is in
                 * progress, then change discovery state to indicate completion.
                 *
                 * When running LE scanning and BR/EDR inquiry simultaneously
                 * and the LE scan already finished, then change the discovery
                 * state to indicate completion.
                 */
                if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
                    !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
                        hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
        }

unlock:
        hci_dev_unlock(hdev);
}

static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
{
        struct inquiry_data data;
        struct inquiry_info *info = (void *) (skb->data + 1);
        int num_rsp = *((__u8 *) skb->data);

        BT_DBG("%s num_rsp %d", hdev->name, num_rsp);

        if (!num_rsp)
                return;

        if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
                return;

        hci_dev_lock(hdev);

        for (; num_rsp; num_rsp--, info++) {
                u32 flags;

                bacpy(&data.bdaddr, &info->bdaddr);
                data.pscan_rep_mode     = info->pscan_rep_mode;
                data.pscan_period_mode  = info->pscan_period_mode;
                data.pscan_mode         = info->pscan_mode;
                memcpy(data.dev_class, info->dev_class, 3);
                data.clock_offset       = info->clock_offset;
                data.rssi               = HCI_RSSI_INVALID;
                data.ssp_mode           = 0x00;

                flags = hci_inquiry_cache_update(hdev, &data, false);

                mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
                                  info->dev_class, HCI_RSSI_INVALID,
                                  flags, NULL, 0, NULL, 0);
        }

        hci_dev_unlock(hdev);
}

static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
{
        struct hci_ev_conn_complete *ev = (void *) skb->data;
        struct hci_conn *conn;

        BT_DBG("%s", hdev->name);

        hci_dev_lock(hdev);

        conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
        if (!conn) {
                if (ev->link_type != SCO_LINK)
                        goto unlock;

                conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
                if (!conn)
                        goto unlock;

                conn->type = SCO_LINK;
        }

        if (!ev->status) {
                conn->handle = __le16_to_cpu(ev->handle);

                if (conn->type == ACL_LINK) {
                        conn->state = BT_CONFIG;
                        hci_conn_hold(conn);

                        if (!conn->out && !hci_conn_ssp_enabled(conn) &&
                            !hci_find_link_key(hdev, &ev->bdaddr))
                                conn->disc_timeout = HCI_PAIRING_TIMEOUT;
                        else
                                conn->disc_timeout = HCI_DISCONN_TIMEOUT;
                } else
                        conn->state = BT_CONNECTED;

                hci_debugfs_create_conn(conn);
                hci_conn_add_sysfs(conn);

                if (test_bit(HCI_AUTH, &hdev->flags))
                        set_bit(HCI_CONN_AUTH, &conn->flags);

                if (test_bit(HCI_ENCRYPT, &hdev->flags))
                        set_bit(HCI_CONN_ENCRYPT, &conn->flags);

                /* Get remote features */
                if (conn->type == ACL_LINK) {
                        struct hci_cp_read_remote_features cp;
                        cp.handle = ev->handle;
                        hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
                                     sizeof(cp), &cp);

                        hci_req_update_scan(hdev);
                }

                /* Set packet type for incoming connection */
                if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
                        struct hci_cp_change_conn_ptype cp;
                        cp.handle = ev->handle;
                        cp.pkt_type = cpu_to_le16(conn->pkt_type);
                        hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
                                     &cp);
                }
        } else {
                conn->state = BT_CLOSED;
                if (conn->type == ACL_LINK)
                        mgmt_connect_failed(hdev, &conn->dst, conn->type,
                                            conn->dst_type, ev->status);
        }

        if (conn->type == ACL_LINK)
                hci_sco_setup(conn, ev->status);

        if (ev->status) {
                hci_connect_cfm(conn, ev->status);
                hci_conn_del(conn);
        } else if (ev->link_type != ACL_LINK)
                hci_connect_cfm(conn, ev->status);

unlock:
        hci_dev_unlock(hdev);

        hci_conn_check_pending(hdev);
}

static void hci_reject_conn(struct hci_dev *hdev, bdaddr_t *bdaddr)
{
        struct hci_cp_reject_conn_req cp;

        bacpy(&cp.bdaddr, bdaddr);
        cp.reason = HCI_ERROR_REJ_BAD_ADDR;
        hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
}

static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
{
        struct hci_ev_conn_request *ev = (void *) skb->data;
        int mask = hdev->link_mode;
        struct inquiry_entry *ie;
        struct hci_conn *conn;
        __u8 flags = 0;

        BT_DBG("%s bdaddr %pMR type 0x%x", hdev->name, &ev->bdaddr,
               ev->link_type);

        mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
                                      &flags);

        if (!(mask & HCI_LM_ACCEPT)) {
                hci_reject_conn(hdev, &ev->bdaddr);
                return;
        }

        if (hci_bdaddr_list_lookup(&hdev->blacklist, &ev->bdaddr,
                                   BDADDR_BREDR)) {
                hci_reject_conn(hdev, &ev->bdaddr);
                return;
        }

        /* Require HCI_CONNECTABLE or a whitelist entry to accept the
         * connection. These features are only touched through mgmt so
         * only do the checks if HCI_MGMT is set.
         */
        if (hci_dev_test_flag(hdev, HCI_MGMT) &&
            !hci_dev_test_flag(hdev, HCI_CONNECTABLE) &&
            !hci_bdaddr_list_lookup(&hdev->whitelist, &ev->bdaddr,
                                    BDADDR_BREDR)) {
                    hci_reject_conn(hdev, &ev->bdaddr);
                    return;
        }

        /* Connection accepted */

        hci_dev_lock(hdev);

        ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
        if (ie)
                memcpy(ie->data.dev_class, ev->dev_class, 3);

        conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
                        &ev->bdaddr);
        if (!conn) {
                conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr,
                                    HCI_ROLE_SLAVE);
                if (!conn) {
                        bt_dev_err(hdev, "no memory for new connection");
                        hci_dev_unlock(hdev);
                        return;
                }
        }

        memcpy(conn->dev_class, ev->dev_class, 3);

        hci_dev_unlock(hdev);

        if (ev->link_type == ACL_LINK ||
            (!(flags & HCI_PROTO_DEFER) && !lmp_esco_capable(hdev))) {
                struct hci_cp_accept_conn_req cp;
                conn->state = BT_CONNECT;

                bacpy(&cp.bdaddr, &ev->bdaddr);

                if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
                        cp.role = 0x00; /* Become master */
                else
                        cp.role = 0x01; /* Remain slave */

                hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
        } else if (!(flags & HCI_PROTO_DEFER)) {
                struct hci_cp_accept_sync_conn_req cp;
                conn->state = BT_CONNECT;

                bacpy(&cp.bdaddr, &ev->bdaddr);
                cp.pkt_type = cpu_to_le16(conn->pkt_type);

                cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
                cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
                cp.max_latency    = cpu_to_le16(0xffff);
                cp.content_format = cpu_to_le16(hdev->voice_setting);
                cp.retrans_effort = 0xff;

                hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ, sizeof(cp),
                             &cp);
        } else {
                conn->state = BT_CONNECT2;
                hci_connect_cfm(conn, 0);
        }
}

static u8 hci_to_mgmt_reason(u8 err)
{
        switch (err) {
        case HCI_ERROR_CONNECTION_TIMEOUT:
                return MGMT_DEV_DISCONN_TIMEOUT;
        case HCI_ERROR_REMOTE_USER_TERM:
        case HCI_ERROR_REMOTE_LOW_RESOURCES:
        case HCI_ERROR_REMOTE_POWER_OFF:
                return MGMT_DEV_DISCONN_REMOTE;
        case HCI_ERROR_LOCAL_HOST_TERM:
                return MGMT_DEV_DISCONN_LOCAL_HOST;
        default:
                return MGMT_DEV_DISCONN_UNKNOWN;
        }
}

static void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
{
        struct hci_ev_disconn_complete *ev = (void *) skb->data;
        u8 reason;
        struct hci_conn_params *params;
        struct hci_conn *conn;
        bool mgmt_connected;
        u8 type;

        BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);

        hci_dev_lock(hdev);

        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
        if (!conn)
                goto unlock;

        if (ev->status) {
                mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
                                       conn->dst_type, ev->status);
                goto unlock;
        }

        conn->state = BT_CLOSED;

        mgmt_connected = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags);

        if (test_bit(HCI_CONN_AUTH_FAILURE, &conn->flags))
                reason = MGMT_DEV_DISCONN_AUTH_FAILURE;
        else
                reason = hci_to_mgmt_reason(ev->reason);

        mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type,
                                reason, mgmt_connected);

        if (conn->type == ACL_LINK) {
                if (test_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
                        hci_remove_link_key(hdev, &conn->dst);

                hci_req_update_scan(hdev);
        }

        params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
        if (params) {
                switch (params->auto_connect) {
                case HCI_AUTO_CONN_LINK_LOSS:
                        if (ev->reason != HCI_ERROR_CONNECTION_TIMEOUT)
                                break;
                        /* Fall through */

                case HCI_AUTO_CONN_DIRECT:
                case HCI_AUTO_CONN_ALWAYS:
                        list_del_init(&params->action);
                        list_add(&params->action, &hdev->pend_le_conns);
                        hci_update_background_scan(hdev);
                        break;

                default:
                        break;
                }
        }

        type = conn->type;

        hci_disconn_cfm(conn, ev->reason);
        hci_conn_del(conn);

        /* Re-enable advertising if necessary, since it might
         * have been disabled by the connection. From the
         * HCI_LE_Set_Advertise_Enable command description in
         * the core specification (v4.0):
         * "The Controller shall continue advertising until the Host
         * issues an LE_Set_Advertise_Enable command with
         * Advertising_Enable set to 0x00 (Advertising is disabled)
         * or until a connection is created or until the Advertising
         * is timed out due to Directed Advertising."
         */
        if (type == LE_LINK)
                hci_req_reenable_advertising(hdev);

unlock:
        hci_dev_unlock(hdev);
}

static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
{
        struct hci_ev_auth_complete *ev = (void *) skb->data;
        struct hci_conn *conn;

        BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);

        hci_dev_lock(hdev);

        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
        if (!conn)
                goto unlock;

        if (!ev->status) {
                clear_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);

                if (!hci_conn_ssp_enabled(conn) &&
                    test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
                        bt_dev_info(hdev, "re-auth of legacy device is not possible.");
                } else {
                        set_bit(HCI_CONN_AUTH, &conn->flags);
                        conn->sec_level = conn->pending_sec_level;
                }
        } else {
                if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
                        set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);

                mgmt_auth_failed(conn, ev->status);
        }

        clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
        clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);

        if (conn->state == BT_CONFIG) {
                if (!ev->status && hci_conn_ssp_enabled(conn)) {
                        struct hci_cp_set_conn_encrypt cp;
                        cp.handle  = ev->handle;
                        cp.encrypt = 0x01;
                        hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
                                     &cp);
                } else {
                        conn->state = BT_CONNECTED;
                        hci_connect_cfm(conn, ev->status);
                        hci_conn_drop(conn);
                }
        } else {
                hci_auth_cfm(conn, ev->status);

                hci_conn_hold(conn);
                conn->disc_timeout = HCI_DISCONN_TIMEOUT;
                hci_conn_drop(conn);
        }

        if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
                if (!ev->status) {
                        struct hci_cp_set_conn_encrypt cp;
                        cp.handle  = ev->handle;
                        cp.encrypt = 0x01;
                        hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
                                     &cp);
                } else {
                        clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
                        hci_encrypt_cfm(conn, ev->status, 0x00);
                }
        }

unlock:
        hci_dev_unlock(hdev);
}

static void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
{
        struct hci_ev_remote_name *ev = (void *) skb->data;
        struct hci_conn *conn;

        BT_DBG("%s", hdev->name);

        hci_conn_check_pending(hdev);

        hci_dev_lock(hdev);

        conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);

        if (!hci_dev_test_flag(hdev, HCI_MGMT))
                goto check_auth;

        if (ev->status == 0)
                hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
                                       strnlen(ev->name, HCI_MAX_NAME_LENGTH));
        else
                hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);

check_auth:
        if (!conn)
                goto unlock;

        if (!hci_outgoing_auth_needed(hdev, conn))
                goto unlock;

        if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
                struct hci_cp_auth_requested cp;

                set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);

                cp.handle = __cpu_to_le16(conn->handle);
                hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
        }

unlock:
        hci_dev_unlock(hdev);
}

static void read_enc_key_size_complete(struct hci_dev *hdev, u8 status,
                                       u16 opcode, struct sk_buff *skb)
{
        const struct hci_rp_read_enc_key_size *rp;
        struct hci_conn *conn;
        u16 handle;

        BT_DBG("%s status 0x%02x", hdev->name, status);

        if (!skb || skb->len < sizeof(*rp)) {
                bt_dev_err(hdev, "invalid read key size response");
                return;
        }

        rp = (void *)skb->data;
        handle = le16_to_cpu(rp->handle);

        hci_dev_lock(hdev);

        conn = hci_conn_hash_lookup_handle(hdev, handle);
        if (!conn)
                goto unlock;

        /* If we fail to read the encryption key size, assume maximum
         * (which is the same we do also when this HCI command isn't
         * supported.
         */
        if (rp->status) {
                bt_dev_err(hdev, "failed to read key size for handle %u",
                           handle);
                conn->enc_key_size = HCI_LINK_KEY_SIZE;
        } else {
                conn->enc_key_size = rp->key_size;
        }

        if (conn->state == BT_CONFIG) {
                conn->state = BT_CONNECTED;
                hci_connect_cfm(conn, 0);
                hci_conn_drop(conn);
        } else {
                u8 encrypt;

                if (!test_bit(HCI_CONN_ENCRYPT, &conn->flags))
                        encrypt = 0x00;
                else if (test_bit(HCI_CONN_AES_CCM, &conn->flags))
                        encrypt = 0x02;
                else
                        encrypt = 0x01;

                hci_encrypt_cfm(conn, 0, encrypt);
        }

unlock:
        hci_dev_unlock(hdev);
}

static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
{
        struct hci_ev_encrypt_change *ev = (void *) skb->data;
        struct hci_conn *conn;

        BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);

        hci_dev_lock(hdev);

        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
        if (!conn)
                goto unlock;

        if (!ev->status) {
                if (ev->encrypt) {
                        /* Encryption implies authentication */
                        set_bit(HCI_CONN_AUTH, &conn->flags);
                        set_bit(HCI_CONN_ENCRYPT, &conn->flags);
                        conn->sec_level = conn->pending_sec_level;

                        /* P-256 authentication key implies FIPS */
                        if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256)
                                set_bit(HCI_CONN_FIPS, &conn->flags);

                        if ((conn->type == ACL_LINK && ev->encrypt == 0x02) ||
                            conn->type == LE_LINK)
                                set_bit(HCI_CONN_AES_CCM, &conn->flags);
                } else {
                        clear_bit(HCI_CONN_ENCRYPT, &conn->flags);
                        clear_bit(HCI_CONN_AES_CCM, &conn->flags);
                }
        }

        /* We should disregard the current RPA and generate a new one
         * whenever the encryption procedure fails.
         */
        if (ev->status && conn->type == LE_LINK)
                hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);

        clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);

        if (ev->status && conn->state == BT_CONNECTED) {
                if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
                        set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);

                hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
                hci_conn_drop(conn);
                goto unlock;
        }

        /* In Secure Connections Only mode, do not allow any connections
         * that are not encrypted with AES-CCM using a P-256 authenticated
         * combination key.
         */
        if (hci_dev_test_flag(hdev, HCI_SC_ONLY) &&
            (!test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
             conn->key_type != HCI_LK_AUTH_COMBINATION_P256)) {
                hci_connect_cfm(conn, HCI_ERROR_AUTH_FAILURE);
                hci_conn_drop(conn);
                goto unlock;
        }

        /* Try reading the encryption key size for encrypted ACL links */
        if (!ev->status && ev->encrypt && conn->type == ACL_LINK) {
                struct hci_cp_read_enc_key_size cp;
                struct hci_request req;

                /* Only send HCI_Read_Encryption_Key_Size if the
                 * controller really supports it. If it doesn't, assume
                 * the default size (16).
                 */
                if (!(hdev->commands[20] & 0x10)) {
                        conn->enc_key_size = HCI_LINK_KEY_SIZE;
                        goto notify;
                }

                hci_req_init(&req, hdev);

                cp.handle = cpu_to_le16(conn->handle);
                hci_req_add(&req, HCI_OP_READ_ENC_KEY_SIZE, sizeof(cp), &cp);

                if (hci_req_run_skb(&req, read_enc_key_size_complete)) {
                        bt_dev_err(hdev, "sending read key size failed");
                        conn->enc_key_size = HCI_LINK_KEY_SIZE;
                        goto notify;
                }

                goto unlock;
        }

notify:
        if (conn->state == BT_CONFIG) {
                if (!ev->status)
                        conn->state = BT_CONNECTED;

                hci_connect_cfm(conn, ev->status);
                hci_conn_drop(conn);
        } else
                hci_encrypt_cfm(conn, ev->status, ev->encrypt);

unlock:
        hci_dev_unlock(hdev);
}

static void hci_change_link_key_complete_evt(struct hci_dev *hdev,
                                             struct sk_buff *skb)
{
        struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
        struct hci_conn *conn;

        BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);

        hci_dev_lock(hdev);

        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
        if (conn) {
                if (!ev->status)
                        set_bit(HCI_CONN_SECURE, &conn->flags);

                clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);

                hci_key_change_cfm(conn, ev->status);
        }

        hci_dev_unlock(hdev);
}

static void hci_remote_features_evt(struct hci_dev *hdev,
                                    struct sk_buff *skb)
{
        struct hci_ev_remote_features *ev = (void *) skb->data;
        struct hci_conn *conn;

        BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);

        hci_dev_lock(hdev);

        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
        if (!conn)
                goto unlock;

        if (!ev->status)
                memcpy(conn->features[0], ev->features, 8);

        if (conn->state != BT_CONFIG)
                goto unlock;

        if (!ev->status && lmp_ext_feat_capable(hdev) &&
            lmp_ext_feat_capable(conn)) {
                struct hci_cp_read_remote_ext_features cp;
                cp.handle = ev->handle;
                cp.page = 0x01;
                hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
                             sizeof(cp), &cp);
                goto unlock;
        }

        if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
                struct hci_cp_remote_name_req cp;
                memset(&cp, 0, sizeof(cp));
                bacpy(&cp.bdaddr, &conn->dst);
                cp.pscan_rep_mode = 0x02;
                hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
        } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
                mgmt_device_connected(hdev, conn, 0, NULL, 0);

        if (!hci_outgoing_auth_needed(hdev, conn)) {
                conn->state = BT_CONNECTED;
                hci_connect_cfm(conn, ev->status);
                hci_conn_drop(conn);
        }

unlock:
        hci_dev_unlock(hdev);
}

static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb,
                                 u16 *opcode, u8 *status,
                                 hci_req_complete_t *req_complete,
                                 hci_req_complete_skb_t *req_complete_skb)
{
        struct hci_ev_cmd_complete *ev = (void *) skb->data;

        *opcode = __le16_to_cpu(ev->opcode);
        *status = skb->data[sizeof(*ev)];

        skb_pull(skb, sizeof(*ev));

        switch (*opcode) {
        case HCI_OP_INQUIRY_CANCEL:
                hci_cc_inquiry_cancel(hdev, skb);
                break;

        case HCI_OP_PERIODIC_INQ:
                hci_cc_periodic_inq(hdev, skb);
                break;

        case HCI_OP_EXIT_PERIODIC_INQ:
                hci_cc_exit_periodic_inq(hdev, skb);
                break;

        case HCI_OP_REMOTE_NAME_REQ_CANCEL:
                hci_cc_remote_name_req_cancel(hdev, skb);
                break;

        case HCI_OP_ROLE_DISCOVERY:
                hci_cc_role_discovery(hdev, skb);
                break;

        case HCI_OP_READ_LINK_POLICY:
                hci_cc_read_link_policy(hdev, skb);
                break;

        case HCI_OP_WRITE_LINK_POLICY:
                hci_cc_write_link_policy(hdev, skb);
                break;

        case HCI_OP_READ_DEF_LINK_POLICY:
                hci_cc_read_def_link_policy(hdev, skb);
                break;

        case HCI_OP_WRITE_DEF_LINK_POLICY:
                hci_cc_write_def_link_policy(hdev, skb);
                break;

        case HCI_OP_RESET:
                hci_cc_reset(hdev, skb);
                break;

        case HCI_OP_READ_STORED_LINK_KEY:
                hci_cc_read_stored_link_key(hdev, skb);
                break;

        case HCI_OP_DELETE_STORED_LINK_KEY:
                hci_cc_delete_stored_link_key(hdev, skb);
                break;

        case HCI_OP_WRITE_LOCAL_NAME:
                hci_cc_write_local_name(hdev, skb);
                break;

        case HCI_OP_READ_LOCAL_NAME:
                hci_cc_read_local_name(hdev, skb);
                break;

        case HCI_OP_WRITE_AUTH_ENABLE:
                hci_cc_write_auth_enable(hdev, skb);
                break;

        case HCI_OP_WRITE_ENCRYPT_MODE:
                hci_cc_write_encrypt_mode(hdev, skb);
                break;

        case HCI_OP_WRITE_SCAN_ENABLE:
                hci_cc_write_scan_enable(hdev, skb);
                break;

        case HCI_OP_READ_CLASS_OF_DEV:
                hci_cc_read_class_of_dev(hdev, skb);
                break;

        case HCI_OP_WRITE_CLASS_OF_DEV:
                hci_cc_write_class_of_dev(hdev, skb);
                break;

        case HCI_OP_READ_VOICE_SETTING:
                hci_cc_read_voice_setting(hdev, skb);
                break;

        case HCI_OP_WRITE_VOICE_SETTING:
                hci_cc_write_voice_setting(hdev, skb);
                break;

        case HCI_OP_READ_NUM_SUPPORTED_IAC:
                hci_cc_read_num_supported_iac(hdev, skb);
                break;

        case HCI_OP_WRITE_SSP_MODE:
                hci_cc_write_ssp_mode(hdev, skb);
                break;

        case HCI_OP_WRITE_SC_SUPPORT:
                hci_cc_write_sc_support(hdev, skb);
                break;

        case HCI_OP_READ_LOCAL_VERSION:
                hci_cc_read_local_version(hdev, skb);
                break;

        case HCI_OP_READ_LOCAL_COMMANDS:
                hci_cc_read_local_commands(hdev, skb);
                break;

        case HCI_OP_READ_LOCAL_FEATURES:
                hci_cc_read_local_features(hdev, skb);
                break;

        case HCI_OP_READ_LOCAL_EXT_FEATURES:
                hci_cc_read_local_ext_features(hdev, skb);
                break;

        case HCI_OP_READ_BUFFER_SIZE:
                hci_cc_read_buffer_size(hdev, skb);
                break;

        case HCI_OP_READ_BD_ADDR:
                hci_cc_read_bd_addr(hdev, skb);
                break;

        case HCI_OP_READ_PAGE_SCAN_ACTIVITY:
                hci_cc_read_page_scan_activity(hdev, skb);
                break;

        case HCI_OP_WRITE_PAGE_SCAN_ACTIVITY:
                hci_cc_write_page_scan_activity(hdev, skb);
                break;

        case HCI_OP_READ_PAGE_SCAN_TYPE:
                hci_cc_read_page_scan_type(hdev, skb);
                break;

        case HCI_OP_WRITE_PAGE_SCAN_TYPE:
                hci_cc_write_page_scan_type(hdev, skb);
                break;

        case HCI_OP_READ_DATA_BLOCK_SIZE:
                hci_cc_read_data_block_size(hdev, skb);
                break;

        case HCI_OP_READ_FLOW_CONTROL_MODE:
                hci_cc_read_flow_control_mode(hdev, skb);
                break;

        case HCI_OP_READ_LOCAL_AMP_INFO:
                hci_cc_read_local_amp_info(hdev, skb);
                break;

        case HCI_OP_READ_CLOCK:
                hci_cc_read_clock(hdev, skb);
                break;

        case HCI_OP_READ_INQ_RSP_TX_POWER:
                hci_cc_read_inq_rsp_tx_power(hdev, skb);
                break;

        case HCI_OP_PIN_CODE_REPLY:
                hci_cc_pin_code_reply(hdev, skb);
                break;

        case HCI_OP_PIN_CODE_NEG_REPLY:
                hci_cc_pin_code_neg_reply(hdev, skb);
                break;

        case HCI_OP_READ_LOCAL_OOB_DATA:
                hci_cc_read_local_oob_data(hdev, skb);
                break;

        case HCI_OP_READ_LOCAL_OOB_EXT_DATA:
                hci_cc_read_local_oob_ext_data(hdev, skb);
                break;

        case HCI_OP_LE_READ_BUFFER_SIZE:
                hci_cc_le_read_buffer_size(hdev, skb);
                break;

        case HCI_OP_LE_READ_LOCAL_FEATURES:
                hci_cc_le_read_local_features(hdev, skb);
                break;

        case HCI_OP_LE_READ_ADV_TX_POWER:
                hci_cc_le_read_adv_tx_power(hdev, skb);
                break;

        case HCI_OP_USER_CONFIRM_REPLY:
                hci_cc_user_confirm_reply(hdev, skb);
                break;

        case HCI_OP_USER_CONFIRM_NEG_REPLY:
                hci_cc_user_confirm_neg_reply(hdev, skb);
                break;

        case HCI_OP_USER_PASSKEY_REPLY:
                hci_cc_user_passkey_reply(hdev, skb);
                break;

        case HCI_OP_USER_PASSKEY_NEG_REPLY:
                hci_cc_user_passkey_neg_reply(hdev, skb);
                break;

        case HCI_OP_LE_SET_RANDOM_ADDR:
                hci_cc_le_set_random_addr(hdev, skb);
                break;

        case HCI_OP_LE_SET_ADV_ENABLE:
                hci_cc_le_set_adv_enable(hdev, skb);
                break;

        case HCI_OP_LE_SET_SCAN_PARAM:
                hci_cc_le_set_scan_param(hdev, skb);
                break;

        case HCI_OP_LE_SET_SCAN_ENABLE:
                hci_cc_le_set_scan_enable(hdev, skb);
                break;

        case HCI_OP_LE_READ_WHITE_LIST_SIZE:
                hci_cc_le_read_white_list_size(hdev, skb);
                break;

        case HCI_OP_LE_CLEAR_WHITE_LIST:
                hci_cc_le_clear_white_list(hdev, skb);
                break;

        case HCI_OP_LE_ADD_TO_WHITE_LIST:
                hci_cc_le_add_to_white_list(hdev, skb);
                break;