net/bluetooth/hci_event.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI event handling. */
  26
  27 #include <asm/unaligned.h>
  28
  29 #include <net/bluetooth/bluetooth.h>
  30 #include <net/bluetooth/hci_core.h>
  31 #include <net/bluetooth/mgmt.h>
  32
  33 #include "a2mp.h"
  34 #include "amp.h"
  35
  36 /* Handle HCI Event packets */
  37
  38 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
  39 {
  40         __u8 status = *((__u8 *) skb->data);
  41
  42         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  43
  44         if (status)
  45                 return;
  46
  47         clear_bit(HCI_INQUIRY, &hdev->flags);
  48         smp_mb__after_clear_bit(); /* wake_up_bit advises about this barrier */
  49         wake_up_bit(&hdev->flags, HCI_INQUIRY);
  50
  51         hci_conn_check_pending(hdev);
  52 }
  53
  54 static void hci_cc_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  55 {
  56         __u8 status = *((__u8 *) skb->data);
  57
  58         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  59
  60         if (status)
  61                 return;
  62
  63         set_bit(HCI_PERIODIC_INQ, &hdev->dev_flags);
  64 }
  65
  66 static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  67 {
  68         __u8 status = *((__u8 *) skb->data);
  69
  70         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  71
  72         if (status)
  73                 return;
  74
  75         clear_bit(HCI_PERIODIC_INQ, &hdev->dev_flags);
  76
  77         hci_conn_check_pending(hdev);
  78 }
  79
  80 static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev,
  81                                           struct sk_buff *skb)
  82 {
  83         BT_DBG("%s", hdev->name);
  84 }
  85
  86 static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
  87 {
  88         struct hci_rp_role_discovery *rp = (void *) skb->data;
  89         struct hci_conn *conn;
  90
  91         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
  92
  93         if (rp->status)
  94                 return;
  95
  96         hci_dev_lock(hdev);
  97
  98         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
  99         if (conn) {
 100                 if (rp->role)
 101                         conn->link_mode &= ~HCI_LM_MASTER;
 102                 else
 103                         conn->link_mode |= HCI_LM_MASTER;
 104         }
 105
 106         hci_dev_unlock(hdev);
 107 }
 108
 109 static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 110 {
 111         struct hci_rp_read_link_policy *rp = (void *) skb->data;
 112         struct hci_conn *conn;
 113
 114         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 115
 116         if (rp->status)
 117                 return;
 118
 119         hci_dev_lock(hdev);
 120
 121         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 122         if (conn)
 123                 conn->link_policy = __le16_to_cpu(rp->policy);
 124
 125         hci_dev_unlock(hdev);
 126 }
 127
 128 static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 129 {
 130         struct hci_rp_write_link_policy *rp = (void *) skb->data;
 131         struct hci_conn *conn;
 132         void *sent;
 133
 134         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 135
 136         if (rp->status)
 137                 return;
 138
 139         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
 140         if (!sent)
 141                 return;
 142
 143         hci_dev_lock(hdev);
 144
 145         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 146         if (conn)
 147                 conn->link_policy = get_unaligned_le16(sent + 2);
 148
 149         hci_dev_unlock(hdev);
 150 }
 151
 152 static void hci_cc_read_def_link_policy(struct hci_dev *hdev,
 153                                         struct sk_buff *skb)
 154 {
 155         struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
 156
 157         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 158
 159         if (rp->status)
 160                 return;
 161
 162         hdev->link_policy = __le16_to_cpu(rp->policy);
 163 }
 164
 165 static void hci_cc_write_def_link_policy(struct hci_dev *hdev,
 166                                          struct sk_buff *skb)
 167 {
 168         __u8 status = *((__u8 *) skb->data);
 169         void *sent;
 170
 171         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 172
 173         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
 174         if (!sent)
 175                 return;
 176
 177         if (!status)
 178                 hdev->link_policy = get_unaligned_le16(sent);
 179 }
 180
 181 static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
 182 {
 183         __u8 status = *((__u8 *) skb->data);
 184
 185         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 186
 187         clear_bit(HCI_RESET, &hdev->flags);
 188
 189         /* Reset all non-persistent flags */
 190         hdev->dev_flags &= ~HCI_PERSISTENT_MASK;
 191
 192         hdev->discovery.state = DISCOVERY_STOPPED;
 193         hdev->inq_tx_power = HCI_TX_POWER_INVALID;
 194         hdev->adv_tx_power = HCI_TX_POWER_INVALID;
 195
 196         memset(hdev->adv_data, 0, sizeof(hdev->adv_data));
 197         hdev->adv_data_len = 0;
 198
 199         memset(hdev->scan_rsp_data, 0, sizeof(hdev->scan_rsp_data));
 200         hdev->scan_rsp_data_len = 0;
 201 }
 202
 203 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 204 {
 205         __u8 status = *((__u8 *) skb->data);
 206         void *sent;
 207
 208         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 209
 210         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
 211         if (!sent)
 212                 return;
 213
 214         hci_dev_lock(hdev);
 215
 216         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 217                 mgmt_set_local_name_complete(hdev, sent, status);
 218         else if (!status)
 219                 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
 220
 221         hci_dev_unlock(hdev);
 222 }
 223
 224 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 225 {
 226         struct hci_rp_read_local_name *rp = (void *) skb->data;
 227
 228         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 229
 230         if (rp->status)
 231                 return;
 232
 233         if (test_bit(HCI_SETUP, &hdev->dev_flags))
 234                 memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
 235 }
 236
 237 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
 238 {
 239         __u8 status = *((__u8 *) skb->data);
 240         void *sent;
 241
 242         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 243
 244         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
 245         if (!sent)
 246                 return;
 247
 248         if (!status) {
 249                 __u8 param = *((__u8 *) sent);
 250
 251                 if (param == AUTH_ENABLED)
 252                         set_bit(HCI_AUTH, &hdev->flags);
 253                 else
 254                         clear_bit(HCI_AUTH, &hdev->flags);
 255         }
 256
 257         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 258                 mgmt_auth_enable_complete(hdev, status);
 259 }
 260
 261 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
 262 {
 263         __u8 status = *((__u8 *) skb->data);
 264         void *sent;
 265
 266         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 267
 268         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
 269         if (!sent)
 270                 return;
 271
 272         if (!status) {
 273                 __u8 param = *((__u8 *) sent);
 274
 275                 if (param)
 276                         set_bit(HCI_ENCRYPT, &hdev->flags);
 277                 else
 278                         clear_bit(HCI_ENCRYPT, &hdev->flags);
 279         }
 280 }
 281
 282 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
 283 {
 284         __u8 param, status = *((__u8 *) skb->data);
 285         int old_pscan, old_iscan;
 286         void *sent;
 287
 288         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 289
 290         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
 291         if (!sent)
 292                 return;
 293
 294         param = *((__u8 *) sent);
 295
 296         hci_dev_lock(hdev);
 297
 298         if (status) {
 299                 mgmt_write_scan_failed(hdev, param, status);
 300                 hdev->discov_timeout = 0;
 301                 goto done;
 302         }
 303
 304         /* We need to ensure that we set this back on if someone changed
 305          * the scan mode through a raw HCI socket.
 306          */
 307         set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
 308
 309         old_pscan = test_and_clear_bit(HCI_PSCAN, &hdev->flags);
 310         old_iscan = test_and_clear_bit(HCI_ISCAN, &hdev->flags);
 311
 312         if (param & SCAN_INQUIRY) {
 313                 set_bit(HCI_ISCAN, &hdev->flags);
 314                 if (!old_iscan)
 315                         mgmt_discoverable(hdev, 1);
 316         } else if (old_iscan)
 317                 mgmt_discoverable(hdev, 0);
 318
 319         if (param & SCAN_PAGE) {
 320                 set_bit(HCI_PSCAN, &hdev->flags);
 321                 if (!old_pscan)
 322                         mgmt_connectable(hdev, 1);
 323         } else if (old_pscan)
 324                 mgmt_connectable(hdev, 0);
 325
 326 done:
 327         hci_dev_unlock(hdev);
 328 }
 329
 330 static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 331 {
 332         struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
 333
 334         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 335
 336         if (rp->status)
 337                 return;
 338
 339         memcpy(hdev->dev_class, rp->dev_class, 3);
 340
 341         BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
 342                hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
 343 }
 344
 345 static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 346 {
 347         __u8 status = *((__u8 *) skb->data);
 348         void *sent;
 349
 350         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 351
 352         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
 353         if (!sent)
 354                 return;
 355
 356         hci_dev_lock(hdev);
 357
 358         if (status == 0)
 359                 memcpy(hdev->dev_class, sent, 3);
 360
 361         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 362                 mgmt_set_class_of_dev_complete(hdev, sent, status);
 363
 364         hci_dev_unlock(hdev);
 365 }
 366
 367 static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 368 {
 369         struct hci_rp_read_voice_setting *rp = (void *) skb->data;
 370         __u16 setting;
 371
 372         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 373
 374         if (rp->status)
 375                 return;
 376
 377         setting = __le16_to_cpu(rp->voice_setting);
 378
 379         if (hdev->voice_setting == setting)
 380                 return;
 381
 382         hdev->voice_setting = setting;
 383
 384         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 385
 386         if (hdev->notify)
 387                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 388 }
 389
 390 static void hci_cc_write_voice_setting(struct hci_dev *hdev,
 391                                        struct sk_buff *skb)
 392 {
 393         __u8 status = *((__u8 *) skb->data);
 394         __u16 setting;
 395         void *sent;
 396
 397         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 398
 399         if (status)
 400                 return;
 401
 402         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
 403         if (!sent)
 404                 return;
 405
 406         setting = get_unaligned_le16(sent);
 407
 408         if (hdev->voice_setting == setting)
 409                 return;
 410
 411         hdev->voice_setting = setting;
 412
 413         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 414
 415         if (hdev->notify)
 416                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 417 }
 418
 419 static void hci_cc_read_num_supported_iac(struct hci_dev *hdev,
 420                                           struct sk_buff *skb)
 421 {
 422         struct hci_rp_read_num_supported_iac *rp = (void *) skb->data;
 423
 424         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 425
 426         if (rp->status)
 427                 return;
 428
 429         hdev->num_iac = rp->num_iac;
 430
 431         BT_DBG("%s num iac %d", hdev->name, hdev->num_iac);
 432 }
 433
 434 static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 435 {
 436         __u8 status = *((__u8 *) skb->data);
 437         struct hci_cp_write_ssp_mode *sent;
 438
 439         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 440
 441         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
 442         if (!sent)
 443                 return;
 444
 445         if (!status) {
 446                 if (sent->mode)
 447                         hdev->features[1][0] |= LMP_HOST_SSP;
 448                 else
 449                         hdev->features[1][0] &= ~LMP_HOST_SSP;
 450         }
 451
 452         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 453                 mgmt_ssp_enable_complete(hdev, sent->mode, status);
 454         else if (!status) {
 455                 if (sent->mode)
 456                         set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
 457                 else
 458                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
 459         }
 460 }
 461
 462 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
 463 {
 464         struct hci_rp_read_local_version *rp = (void *) skb->data;
 465
 466         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 467
 468         if (rp->status)
 469                 return;
 470
 471         hdev->hci_ver = rp->hci_ver;
 472         hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
 473         hdev->lmp_ver = rp->lmp_ver;
 474         hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
 475         hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
 476
 477         BT_DBG("%s manufacturer 0x%4.4x hci ver %d:%d", hdev->name,
 478                hdev->manufacturer, hdev->hci_ver, hdev->hci_rev);
 479 }
 480
 481 static void hci_cc_read_local_commands(struct hci_dev *hdev,
 482                                        struct sk_buff *skb)
 483 {
 484         struct hci_rp_read_local_commands *rp = (void *) skb->data;
 485
 486         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 487
 488         if (!rp->status)
 489                 memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 490 }
 491
 492 static void hci_cc_read_local_features(struct hci_dev *hdev,
 493                                        struct sk_buff *skb)
 494 {
 495         struct hci_rp_read_local_features *rp = (void *) skb->data;
 496
 497         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 498
 499         if (rp->status)
 500                 return;
 501
 502         memcpy(hdev->features, rp->features, 8);
 503
 504         /* Adjust default settings according to features
 505          * supported by device. */
 506
 507         if (hdev->features[0][0] & LMP_3SLOT)
 508                 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 509
 510         if (hdev->features[0][0] & LMP_5SLOT)
 511                 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 512
 513         if (hdev->features[0][1] & LMP_HV2) {
 514                 hdev->pkt_type  |= (HCI_HV2);
 515                 hdev->esco_type |= (ESCO_HV2);
 516         }
 517
 518         if (hdev->features[0][1] & LMP_HV3) {
 519                 hdev->pkt_type  |= (HCI_HV3);
 520                 hdev->esco_type |= (ESCO_HV3);
 521         }
 522
 523         if (lmp_esco_capable(hdev))
 524                 hdev->esco_type |= (ESCO_EV3);
 525
 526         if (hdev->features[0][4] & LMP_EV4)
 527                 hdev->esco_type |= (ESCO_EV4);
 528
 529         if (hdev->features[0][4] & LMP_EV5)
 530                 hdev->esco_type |= (ESCO_EV5);
 531
 532         if (hdev->features[0][5] & LMP_EDR_ESCO_2M)
 533                 hdev->esco_type |= (ESCO_2EV3);
 534
 535         if (hdev->features[0][5] & LMP_EDR_ESCO_3M)
 536                 hdev->esco_type |= (ESCO_3EV3);
 537
 538         if (hdev->features[0][5] & LMP_EDR_3S_ESCO)
 539                 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
 540
 541         BT_DBG("%s features 0x%.2x%.2x%.2x%.2x%.2x%.2x%.2x%.2x", hdev->name,
 542                hdev->features[0][0], hdev->features[0][1],
 543                hdev->features[0][2], hdev->features[0][3],
 544                hdev->features[0][4], hdev->features[0][5],
 545                hdev->features[0][6], hdev->features[0][7]);
 546 }
 547
 548 static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
 549                                            struct sk_buff *skb)
 550 {
 551         struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
 552
 553         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 554
 555         if (rp->status)
 556                 return;
 557
 558         if (hdev->max_page < rp->max_page)
 559                 hdev->max_page = rp->max_page;
 560
 561         if (rp->page < HCI_MAX_PAGES)
 562                 memcpy(hdev->features[rp->page], rp->features, 8);
 563 }
 564
 565 static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
 566                                           struct sk_buff *skb)
 567 {
 568         struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;
 569
 570         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 571
 572         if (!rp->status)
 573                 hdev->flow_ctl_mode = rp->mode;
 574 }
 575
 576 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 577 {
 578         struct hci_rp_read_buffer_size *rp = (void *) skb->data;
 579
 580         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 581
 582         if (rp->status)
 583                 return;
 584
 585         hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
 586         hdev->sco_mtu  = rp->sco_mtu;
 587         hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
 588         hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
 589
 590         if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
 591                 hdev->sco_mtu  = 64;
 592                 hdev->sco_pkts = 8;
 593         }
 594
 595         hdev->acl_cnt = hdev->acl_pkts;
 596         hdev->sco_cnt = hdev->sco_pkts;
 597
 598         BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
 599                hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
 600 }
 601
 602 static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
 603 {
 604         struct hci_rp_read_bd_addr *rp = (void *) skb->data;
 605
 606         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 607
 608         if (!rp->status)
 609                 bacpy(&hdev->bdaddr, &rp->bdaddr);
 610 }
 611
 612 static void hci_cc_read_page_scan_activity(struct hci_dev *hdev,
 613                                            struct sk_buff *skb)
 614 {
 615         struct hci_rp_read_page_scan_activity *rp = (void *) skb->data;
 616
 617         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 618
 619         if (test_bit(HCI_INIT, &hdev->flags) && !rp->status) {
 620                 hdev->page_scan_interval = __le16_to_cpu(rp->interval);
 621                 hdev->page_scan_window = __le16_to_cpu(rp->window);
 622         }
 623 }
 624
 625 static void hci_cc_write_page_scan_activity(struct hci_dev *hdev,
 626                                             struct sk_buff *skb)
 627 {
 628         u8 status = *((u8 *) skb->data);
 629         struct hci_cp_write_page_scan_activity *sent;
 630
 631         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 632
 633         if (status)
 634                 return;
 635
 636         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY);
 637         if (!sent)
 638                 return;
 639
 640         hdev->page_scan_interval = __le16_to_cpu(sent->interval);
 641         hdev->page_scan_window = __le16_to_cpu(sent->window);
 642 }
 643
 644 static void hci_cc_read_page_scan_type(struct hci_dev *hdev,
 645                                            struct sk_buff *skb)
 646 {
 647         struct hci_rp_read_page_scan_type *rp = (void *) skb->data;
 648
 649         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 650
 651         if (test_bit(HCI_INIT, &hdev->flags) && !rp->status)
 652                 hdev->page_scan_type = rp->type;
 653 }
 654
 655 static void hci_cc_write_page_scan_type(struct hci_dev *hdev,
 656                                         struct sk_buff *skb)
 657 {
 658         u8 status = *((u8 *) skb->data);
 659         u8 *type;
 660
 661         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 662
 663         if (status)
 664                 return;
 665
 666         type = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE);
 667         if (type)
 668                 hdev->page_scan_type = *type;
 669 }
 670
 671 static void hci_cc_read_data_block_size(struct hci_dev *hdev,
 672                                         struct sk_buff *skb)
 673 {
 674         struct hci_rp_read_data_block_size *rp = (void *) skb->data;
 675
 676         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 677
 678         if (rp->status)
 679                 return;
 680
 681         hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
 682         hdev->block_len = __le16_to_cpu(rp->block_len);
 683         hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
 684
 685         hdev->block_cnt = hdev->num_blocks;
 686
 687         BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
 688                hdev->block_cnt, hdev->block_len);
 689 }
 690
 691 static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
 692                                        struct sk_buff *skb)
 693 {
 694         struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
 695
 696         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 697
 698         if (rp->status)
 699                 goto a2mp_rsp;
 700
 701         hdev->amp_status = rp->amp_status;
 702         hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
 703         hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
 704         hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
 705         hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
 706         hdev->amp_type = rp->amp_type;
 707         hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
 708         hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
 709         hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
 710         hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
 711
 712 a2mp_rsp:
 713         a2mp_send_getinfo_rsp(hdev);
 714 }
 715
 716 static void hci_cc_read_local_amp_assoc(struct hci_dev *hdev,
 717                                         struct sk_buff *skb)
 718 {
 719         struct hci_rp_read_local_amp_assoc *rp = (void *) skb->data;
 720         struct amp_assoc *assoc = &hdev->loc_assoc;
 721         size_t rem_len, frag_len;
 722
 723         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 724
 725         if (rp->status)
 726                 goto a2mp_rsp;
 727
 728         frag_len = skb->len - sizeof(*rp);
 729         rem_len = __le16_to_cpu(rp->rem_len);
 730
 731         if (rem_len > frag_len) {
 732                 BT_DBG("frag_len %zu rem_len %zu", frag_len, rem_len);
 733
 734                 memcpy(assoc->data + assoc->offset, rp->frag, frag_len);
 735                 assoc->offset += frag_len;
 736
 737                 /* Read other fragments */
 738                 amp_read_loc_assoc_frag(hdev, rp->phy_handle);
 739
 740                 return;
 741         }
 742
 743         memcpy(assoc->data + assoc->offset, rp->frag, rem_len);
 744         assoc->len = assoc->offset + rem_len;
 745         assoc->offset = 0;
 746
 747 a2mp_rsp:
 748         /* Send A2MP Rsp when all fragments are received */
 749         a2mp_send_getampassoc_rsp(hdev, rp->status);
 750         a2mp_send_create_phy_link_req(hdev, rp->status);
 751 }
 752
 753 static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
 754                                          struct sk_buff *skb)
 755 {
 756         struct hci_rp_read_inq_rsp_tx_power *rp = (void *) skb->data;
 757
 758         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 759
 760         if (!rp->status)
 761                 hdev->inq_tx_power = rp->tx_power;
 762 }
 763
 764 static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
 765 {
 766         struct hci_rp_pin_code_reply *rp = (void *) skb->data;
 767         struct hci_cp_pin_code_reply *cp;
 768         struct hci_conn *conn;
 769
 770         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 771
 772         hci_dev_lock(hdev);
 773
 774         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 775                 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
 776
 777         if (rp->status)
 778                 goto unlock;
 779
 780         cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
 781         if (!cp)
 782                 goto unlock;
 783
 784         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 785         if (conn)
 786                 conn->pin_length = cp->pin_len;
 787
 788 unlock:
 789         hci_dev_unlock(hdev);
 790 }
 791
 792 static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
 793 {
 794         struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
 795
 796         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 797
 798         hci_dev_lock(hdev);
 799
 800         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 801                 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
 802                                                  rp->status);
 803
 804         hci_dev_unlock(hdev);
 805 }
 806
 807 static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
 808                                        struct sk_buff *skb)
 809 {
 810         struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
 811
 812         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 813
 814         if (rp->status)
 815                 return;
 816
 817         hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
 818         hdev->le_pkts = rp->le_max_pkt;
 819
 820         hdev->le_cnt = hdev->le_pkts;
 821
 822         BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
 823 }
 824
 825 static void hci_cc_le_read_local_features(struct hci_dev *hdev,
 826                                           struct sk_buff *skb)
 827 {
 828         struct hci_rp_le_read_local_features *rp = (void *) skb->data;
 829
 830         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 831
 832         if (!rp->status)
 833                 memcpy(hdev->le_features, rp->features, 8);
 834 }
 835
 836 static void hci_cc_le_read_adv_tx_power(struct hci_dev *hdev,
 837                                         struct sk_buff *skb)
 838 {
 839         struct hci_rp_le_read_adv_tx_power *rp = (void *) skb->data;
 840
 841         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 842
 843         if (!rp->status)
 844                 hdev->adv_tx_power = rp->tx_power;
 845 }
 846
 847 static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
 848 {
 849         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 850
 851         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 852
 853         hci_dev_lock(hdev);
 854
 855         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 856                 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,
 857                                                  rp->status);
 858
 859         hci_dev_unlock(hdev);
 860 }
 861
 862 static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
 863                                           struct sk_buff *skb)
 864 {
 865         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 866
 867         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 868
 869         hci_dev_lock(hdev);
 870
 871         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 872                 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
 873                                                      ACL_LINK, 0, rp->status);
 874
 875         hci_dev_unlock(hdev);
 876 }
 877
 878 static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
 879 {
 880         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 881
 882         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 883
 884         hci_dev_lock(hdev);
 885
 886         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 887                 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
 888                                                  0, rp->status);
 889
 890         hci_dev_unlock(hdev);
 891 }
 892
 893 static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
 894                                           struct sk_buff *skb)
 895 {
 896         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 897
 898         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 899
 900         hci_dev_lock(hdev);
 901
 902         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 903                 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
 904                                                      ACL_LINK, 0, rp->status);
 905
 906         hci_dev_unlock(hdev);
 907 }
 908
 909 static void hci_cc_read_local_oob_data_reply(struct hci_dev *hdev,
 910                                              struct sk_buff *skb)
 911 {
 912         struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
 913
 914         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 915
 916         hci_dev_lock(hdev);
 917         mgmt_read_local_oob_data_reply_complete(hdev, rp->hash,
 918                                                 rp->randomizer, rp->status);
 919         hci_dev_unlock(hdev);
 920 }
 921
 922 static void hci_cc_le_set_adv_enable(struct hci_dev *hdev, struct sk_buff *skb)
 923 {
 924         __u8 *sent, status = *((__u8 *) skb->data);
 925
 926         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 927
 928         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_ENABLE);
 929         if (!sent)
 930                 return;
 931
 932         hci_dev_lock(hdev);
 933
 934         if (!status) {
 935                 if (*sent)
 936                         set_bit(HCI_ADVERTISING, &hdev->dev_flags);
 937                 else
 938                         clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
 939         }
 940
 941         hci_dev_unlock(hdev);
 942 }
 943
 944 static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
 945                                       struct sk_buff *skb)
 946 {
 947         struct hci_cp_le_set_scan_enable *cp;
 948         __u8 status = *((__u8 *) skb->data);
 949
 950         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 951
 952         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
 953         if (!cp)
 954                 return;
 955
 956         if (status)
 957                 return;
 958
 959         switch (cp->enable) {
 960         case LE_SCAN_ENABLE:
 961                 set_bit(HCI_LE_SCAN, &hdev->dev_flags);
 962                 break;
 963
 964         case LE_SCAN_DISABLE:
 965                 clear_bit(HCI_LE_SCAN, &hdev->dev_flags);
 966                 break;
 967
 968         default:
 969                 BT_ERR("Used reserved LE_Scan_Enable param %d", cp->enable);
 970                 break;
 971         }
 972 }
 973
 974 static void hci_cc_le_read_white_list_size(struct hci_dev *hdev,
 975                                            struct sk_buff *skb)
 976 {
 977         struct hci_rp_le_read_white_list_size *rp = (void *) skb->data;
 978
 979         BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
 980
 981         if (!rp->status)
 982                 hdev->le_white_list_size = rp->size;
 983 }
 984
 985 static void hci_cc_le_read_supported_states(struct hci_dev *hdev,
 986                                             struct sk_buff *skb)
 987 {
 988         struct hci_rp_le_read_supported_states *rp = (void *) skb->data;
 989
 990         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 991
 992         if (!rp->status)
 993                 memcpy(hdev->le_states, rp->le_states, 8);
 994 }
 995
 996 static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
 997                                            struct sk_buff *skb)
 998 {
 999         struct hci_cp_write_le_host_supported *sent;
1000         __u8 status = *((__u8 *) skb->data);
1001
1002         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1003
1004         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
1005         if (!sent)
1006                 return;
1007
1008         if (!status) {
1009                 if (sent->le) {
1010                         hdev->features[1][0] |= LMP_HOST_LE;
1011                         set_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1012                 } else {
1013                         hdev->features[1][0] &= ~LMP_HOST_LE;
1014                         clear_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1015                         clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
1016                 }
1017
1018                 if (sent->simul)
1019                         hdev->features[1][0] |= LMP_HOST_LE_BREDR;
1020                 else
1021                         hdev->features[1][0] &= ~LMP_HOST_LE_BREDR;
1022         }
1023 }
1024
1025 static void hci_cc_write_remote_amp_assoc(struct hci_dev *hdev,
1026                                           struct sk_buff *skb)
1027 {
1028         struct hci_rp_write_remote_amp_assoc *rp = (void *) skb->data;
1029
1030         BT_DBG("%s status 0x%2.2x phy_handle 0x%2.2x",
1031                hdev->name, rp->status, rp->phy_handle);
1032
1033         if (rp->status)
1034                 return;
1035
1036         amp_write_rem_assoc_continue(hdev, rp->phy_handle);
1037 }
1038
1039 static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
1040 {
1041         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1042
1043         if (status) {
1044                 hci_conn_check_pending(hdev);
1045                 return;
1046         }
1047
1048         set_bit(HCI_INQUIRY, &hdev->flags);
1049 }
1050
1051 static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
1052 {
1053         struct hci_cp_create_conn *cp;
1054         struct hci_conn *conn;
1055
1056         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1057
1058         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
1059         if (!cp)
1060                 return;
1061
1062         hci_dev_lock(hdev);
1063
1064         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1065
1066         BT_DBG("%s bdaddr %pMR hcon %p", hdev->name, &cp->bdaddr, conn);
1067
1068         if (status) {
1069                 if (conn && conn->state == BT_CONNECT) {
1070                         if (status != 0x0c || conn->attempt > 2) {
1071                                 conn->state = BT_CLOSED;
1072                                 hci_proto_connect_cfm(conn, status);
1073                                 hci_conn_del(conn);
1074                         } else
1075                                 conn->state = BT_CONNECT2;
1076                 }
1077         } else {
1078                 if (!conn) {
1079                         conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr);
1080                         if (conn) {
1081                                 conn->out = true;
1082                                 conn->link_mode |= HCI_LM_MASTER;
1083                         } else
1084                                 BT_ERR("No memory for new connection");
1085                 }
1086         }
1087
1088         hci_dev_unlock(hdev);
1089 }
1090
1091 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
1092 {
1093         struct hci_cp_add_sco *cp;
1094         struct hci_conn *acl, *sco;
1095         __u16 handle;
1096
1097         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1098
1099         if (!status)
1100                 return;
1101
1102         cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
1103         if (!cp)
1104                 return;
1105
1106         handle = __le16_to_cpu(cp->handle);
1107
1108         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1109
1110         hci_dev_lock(hdev);
1111
1112         acl = hci_conn_hash_lookup_handle(hdev, handle);
1113         if (acl) {
1114                 sco = acl->link;
1115                 if (sco) {
1116                         sco->state = BT_CLOSED;
1117
1118                         hci_proto_connect_cfm(sco, status);
1119                         hci_conn_del(sco);
1120                 }
1121         }
1122
1123         hci_dev_unlock(hdev);
1124 }
1125
1126 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
1127 {
1128         struct hci_cp_auth_requested *cp;
1129         struct hci_conn *conn;
1130
1131         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1132
1133         if (!status)
1134                 return;
1135
1136         cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
1137         if (!cp)
1138                 return;
1139
1140         hci_dev_lock(hdev);
1141
1142         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1143         if (conn) {
1144                 if (conn->state == BT_CONFIG) {
1145                         hci_proto_connect_cfm(conn, status);
1146                         hci_conn_drop(conn);
1147                 }
1148         }
1149
1150         hci_dev_unlock(hdev);
1151 }
1152
1153 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
1154 {
1155         struct hci_cp_set_conn_encrypt *cp;
1156         struct hci_conn *conn;
1157
1158         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1159
1160         if (!status)
1161                 return;
1162
1163         cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
1164         if (!cp)
1165                 return;
1166
1167         hci_dev_lock(hdev);
1168
1169         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1170         if (conn) {
1171                 if (conn->state == BT_CONFIG) {
1172                         hci_proto_connect_cfm(conn, status);
1173                         hci_conn_drop(conn);
1174                 }
1175         }
1176
1177         hci_dev_unlock(hdev);
1178 }
1179
1180 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
1181                                     struct hci_conn *conn)
1182 {
1183         if (conn->state != BT_CONFIG || !conn->out)
1184                 return 0;
1185
1186         if (conn->pending_sec_level == BT_SECURITY_SDP)
1187                 return 0;
1188
1189         /* Only request authentication for SSP connections or non-SSP
1190          * devices with sec_level HIGH or if MITM protection is requested */
1191         if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
1192             conn->pending_sec_level != BT_SECURITY_HIGH)
1193                 return 0;
1194
1195         return 1;
1196 }
1197
1198 static int hci_resolve_name(struct hci_dev *hdev,
1199                                    struct inquiry_entry *e)
1200 {
1201         struct hci_cp_remote_name_req cp;
1202
1203         memset(&cp, 0, sizeof(cp));
1204
1205         bacpy(&cp.bdaddr, &e->data.bdaddr);
1206         cp.pscan_rep_mode = e->data.pscan_rep_mode;
1207         cp.pscan_mode = e->data.pscan_mode;
1208         cp.clock_offset = e->data.clock_offset;
1209
1210         return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1211 }
1212
1213 static bool hci_resolve_next_name(struct hci_dev *hdev)
1214 {
1215         struct discovery_state *discov = &hdev->discovery;
1216         struct inquiry_entry *e;
1217
1218         if (list_empty(&discov->resolve))
1219                 return false;
1220
1221         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
1222         if (!e)
1223                 return false;
1224
1225         if (hci_resolve_name(hdev, e) == 0) {
1226                 e->name_state = NAME_PENDING;
1227                 return true;
1228         }
1229
1230         return false;
1231 }
1232
1233 static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
1234                                    bdaddr_t *bdaddr, u8 *name, u8 name_len)
1235 {
1236         struct discovery_state *discov = &hdev->discovery;
1237         struct inquiry_entry *e;
1238
1239         if (conn && !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
1240                 mgmt_device_connected(hdev, bdaddr, ACL_LINK, 0x00, 0, name,
1241                                       name_len, conn->dev_class);
1242
1243         if (discov->state == DISCOVERY_STOPPED)
1244                 return;
1245
1246         if (discov->state == DISCOVERY_STOPPING)
1247                 goto discov_complete;
1248
1249         if (discov->state != DISCOVERY_RESOLVING)
1250                 return;
1251
1252         e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
1253         /* If the device was not found in a list of found devices names of which
1254          * are pending. there is no need to continue resolving a next name as it
1255          * will be done upon receiving another Remote Name Request Complete
1256          * Event */
1257         if (!e)
1258                 return;
1259
1260         list_del(&e->list);
1261         if (name) {
1262                 e->name_state = NAME_KNOWN;
1263                 mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
1264                                  e->data.rssi, name, name_len);
1265         } else {
1266                 e->name_state = NAME_NOT_KNOWN;
1267         }
1268
1269         if (hci_resolve_next_name(hdev))
1270                 return;
1271
1272 discov_complete:
1273         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1274 }
1275
1276 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
1277 {
1278         struct hci_cp_remote_name_req *cp;
1279         struct hci_conn *conn;
1280
1281         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1282
1283         /* If successful wait for the name req complete event before
1284          * checking for the need to do authentication */
1285         if (!status)
1286                 return;
1287
1288         cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
1289         if (!cp)
1290                 return;
1291
1292         hci_dev_lock(hdev);
1293
1294         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1295
1296         if (test_bit(HCI_MGMT, &hdev->dev_flags))
1297                 hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
1298
1299         if (!conn)
1300                 goto unlock;
1301
1302         if (!hci_outgoing_auth_needed(hdev, conn))
1303                 goto unlock;
1304
1305         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
1306                 struct hci_cp_auth_requested auth_cp;
1307
1308                 auth_cp.handle = __cpu_to_le16(conn->handle);
1309                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
1310                              sizeof(auth_cp), &auth_cp);
1311         }
1312
1313 unlock:
1314         hci_dev_unlock(hdev);
1315 }
1316
1317 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
1318 {
1319         struct hci_cp_read_remote_features *cp;
1320         struct hci_conn *conn;
1321
1322         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1323
1324         if (!status)
1325                 return;
1326
1327         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
1328         if (!cp)
1329                 return;
1330
1331         hci_dev_lock(hdev);
1332
1333         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1334         if (conn) {
1335                 if (conn->state == BT_CONFIG) {
1336                         hci_proto_connect_cfm(conn, status);
1337                         hci_conn_drop(conn);
1338                 }
1339         }
1340
1341         hci_dev_unlock(hdev);
1342 }
1343
1344 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
1345 {
1346         struct hci_cp_read_remote_ext_features *cp;
1347         struct hci_conn *conn;
1348
1349         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1350
1351         if (!status)
1352                 return;
1353
1354         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
1355         if (!cp)
1356                 return;
1357
1358         hci_dev_lock(hdev);
1359
1360         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1361         if (conn) {
1362                 if (conn->state == BT_CONFIG) {
1363                         hci_proto_connect_cfm(conn, status);
1364                         hci_conn_drop(conn);
1365                 }
1366         }
1367
1368         hci_dev_unlock(hdev);
1369 }
1370
1371 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
1372 {
1373         struct hci_cp_setup_sync_conn *cp;
1374         struct hci_conn *acl, *sco;
1375         __u16 handle;
1376
1377         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1378
1379         if (!status)
1380                 return;
1381
1382         cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
1383         if (!cp)
1384                 return;
1385
1386         handle = __le16_to_cpu(cp->handle);
1387
1388         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1389
1390         hci_dev_lock(hdev);
1391
1392         acl = hci_conn_hash_lookup_handle(hdev, handle);
1393         if (acl) {
1394                 sco = acl->link;
1395                 if (sco) {
1396                         sco->state = BT_CLOSED;
1397
1398                         hci_proto_connect_cfm(sco, status);
1399                         hci_conn_del(sco);
1400                 }
1401         }
1402
1403         hci_dev_unlock(hdev);
1404 }
1405
1406 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
1407 {
1408         struct hci_cp_sniff_mode *cp;
1409         struct hci_conn *conn;
1410
1411         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1412
1413         if (!status)
1414                 return;
1415
1416         cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
1417         if (!cp)
1418                 return;
1419
1420         hci_dev_lock(hdev);
1421
1422         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1423         if (conn) {
1424                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1425
1426                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
1427                         hci_sco_setup(conn, status);
1428         }
1429
1430         hci_dev_unlock(hdev);
1431 }
1432
1433 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
1434 {
1435         struct hci_cp_exit_sniff_mode *cp;
1436         struct hci_conn *conn;
1437
1438         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1439
1440         if (!status)
1441                 return;
1442
1443         cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
1444         if (!cp)
1445                 return;
1446
1447         hci_dev_lock(hdev);
1448
1449         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1450         if (conn) {
1451                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1452
1453                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
1454                         hci_sco_setup(conn, status);
1455         }
1456
1457         hci_dev_unlock(hdev);
1458 }
1459
1460 static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
1461 {
1462         struct hci_cp_disconnect *cp;
1463         struct hci_conn *conn;
1464
1465         if (!status)
1466                 return;
1467
1468         cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
1469         if (!cp)
1470                 return;
1471
1472         hci_dev_lock(hdev);
1473
1474         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1475         if (conn)
1476                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
1477                                        conn->dst_type, status);
1478
1479         hci_dev_unlock(hdev);
1480 }
1481
1482 static void hci_cs_create_phylink(struct hci_dev *hdev, u8 status)
1483 {
1484         struct hci_cp_create_phy_link *cp;
1485
1486         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1487
1488         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_PHY_LINK);
1489         if (!cp)
1490                 return;
1491
1492         hci_dev_lock(hdev);
1493
1494         if (status) {
1495                 struct hci_conn *hcon;
1496
1497                 hcon = hci_conn_hash_lookup_handle(hdev, cp->phy_handle);
1498                 if (hcon)
1499                         hci_conn_del(hcon);
1500         } else {
1501                 amp_write_remote_assoc(hdev, cp->phy_handle);
1502         }
1503
1504         hci_dev_unlock(hdev);
1505 }
1506
1507 static void hci_cs_accept_phylink(struct hci_dev *hdev, u8 status)
1508 {
1509         struct hci_cp_accept_phy_link *cp;
1510
1511         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1512
1513         if (status)
1514                 return;
1515
1516         cp = hci_sent_cmd_data(hdev, HCI_OP_ACCEPT_PHY_LINK);
1517         if (!cp)
1518                 return;
1519
1520         amp_write_remote_assoc(hdev, cp->phy_handle);
1521 }
1522
1523 static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1524 {
1525         __u8 status = *((__u8 *) skb->data);
1526         struct discovery_state *discov = &hdev->discovery;
1527         struct inquiry_entry *e;
1528
1529         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1530
1531         hci_conn_check_pending(hdev);
1532
1533         if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
1534                 return;
1535
1536         smp_mb__after_clear_bit(); /* wake_up_bit advises about this barrier */
1537         wake_up_bit(&hdev->flags, HCI_INQUIRY);
1538
1539         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
1540                 return;
1541
1542         hci_dev_lock(hdev);
1543
1544         if (discov->state != DISCOVERY_FINDING)
1545                 goto unlock;
1546
1547         if (list_empty(&discov->resolve)) {
1548                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1549                 goto unlock;
1550         }
1551
1552         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
1553         if (e && hci_resolve_name(hdev, e) == 0) {
1554                 e->name_state = NAME_PENDING;
1555                 hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
1556         } else {
1557                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1558         }
1559
1560 unlock:
1561         hci_dev_unlock(hdev);
1562 }
1563
1564 static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
1565 {
1566         struct inquiry_data data;
1567         struct inquiry_info *info = (void *) (skb->data + 1);
1568         int num_rsp = *((__u8 *) skb->data);
1569
1570         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
1571
1572         if (!num_rsp)
1573                 return;
1574
1575         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
1576                 return;
1577
1578         hci_dev_lock(hdev);
1579
1580         for (; num_rsp; num_rsp--, info++) {
1581                 bool name_known, ssp;
1582
1583                 bacpy(&data.bdaddr, &info->bdaddr);
1584                 data.pscan_rep_mode     = info->pscan_rep_mode;
1585                 data.pscan_period_mode  = info->pscan_period_mode;
1586                 data.pscan_mode         = info->pscan_mode;
1587                 memcpy(data.dev_class, info->dev_class, 3);
1588                 data.clock_offset       = info->clock_offset;
1589                 data.rssi               = 0x00;
1590                 data.ssp_mode           = 0x00;
1591
1592                 name_known = hci_inquiry_cache_update(hdev, &data, false, &ssp);
1593                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
1594                                   info->dev_class, 0, !name_known, ssp, NULL,
1595                                   0);
1596         }
1597
1598         hci_dev_unlock(hdev);
1599 }
1600
1601 static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1602 {
1603         struct hci_ev_conn_complete *ev = (void *) skb->data;
1604         struct hci_conn *conn;
1605
1606         BT_DBG("%s", hdev->name);
1607
1608         hci_dev_lock(hdev);
1609
1610         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
1611         if (!conn) {
1612                 if (ev->link_type != SCO_LINK)
1613                         goto unlock;
1614
1615                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
1616                 if (!conn)
1617                         goto unlock;
1618
1619                 conn->type = SCO_LINK;
1620         }
1621
1622         if (!ev->status) {
1623                 conn->handle = __le16_to_cpu(ev->handle);
1624
1625                 if (conn->type == ACL_LINK) {
1626                         conn->state = BT_CONFIG;
1627                         hci_conn_hold(conn);
1628
1629                         if (!conn->out && !hci_conn_ssp_enabled(conn) &&
1630                             !hci_find_link_key(hdev, &ev->bdaddr))
1631                                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
1632                         else
1633                                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
1634                 } else
1635                         conn->state = BT_CONNECTED;
1636
1637                 hci_conn_add_sysfs(conn);
1638
1639                 if (test_bit(HCI_AUTH, &hdev->flags))
1640                         conn->link_mode |= HCI_LM_AUTH;
1641
1642                 if (test_bit(HCI_ENCRYPT, &hdev->flags))
1643                         conn->link_mode |= HCI_LM_ENCRYPT;
1644
1645                 /* Get remote features */
1646                 if (conn->type == ACL_LINK) {
1647                         struct hci_cp_read_remote_features cp;
1648                         cp.handle = ev->handle;
1649                         hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
1650                                      sizeof(cp), &cp);
1651                 }
1652
1653                 /* Set packet type for incoming connection */
1654                 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
1655                         struct hci_cp_change_conn_ptype cp;
1656                         cp.handle = ev->handle;
1657                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
1658                         hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
1659                                      &cp);
1660                 }
1661         } else {
1662                 conn->state = BT_CLOSED;
1663                 if (conn->type == ACL_LINK)
1664                         mgmt_connect_failed(hdev, &ev->bdaddr, conn->type,
1665                                             conn->dst_type, ev->status);
1666         }
1667
1668         if (conn->type == ACL_LINK)
1669                 hci_sco_setup(conn, ev->status);
1670
1671         if (ev->status) {
1672                 hci_proto_connect_cfm(conn, ev->status);
1673                 hci_conn_del(conn);
1674         } else if (ev->link_type != ACL_LINK)
1675                 hci_proto_connect_cfm(conn, ev->status);
1676
1677 unlock:
1678         hci_dev_unlock(hdev);
1679
1680         hci_conn_check_pending(hdev);
1681 }
1682
1683 static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
1684 {
1685         struct hci_ev_conn_request *ev = (void *) skb->data;
1686         int mask = hdev->link_mode;
1687         __u8 flags = 0;
1688
1689         BT_DBG("%s bdaddr %pMR type 0x%x", hdev->name, &ev->bdaddr,
1690                ev->link_type);
1691
1692         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
1693                                       &flags);
1694
1695         if ((mask & HCI_LM_ACCEPT) &&
1696             !hci_blacklist_lookup(hdev, &ev->bdaddr, BDADDR_BREDR)) {
1697                 /* Connection accepted */
1698                 struct inquiry_entry *ie;
1699                 struct hci_conn *conn;
1700
1701                 hci_dev_lock(hdev);
1702
1703                 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
1704                 if (ie)
1705                         memcpy(ie->data.dev_class, ev->dev_class, 3);
1706
1707                 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
1708                                                &ev->bdaddr);
1709                 if (!conn) {
1710                         conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr);
1711                         if (!conn) {
1712                                 BT_ERR("No memory for new connection");
1713                                 hci_dev_unlock(hdev);
1714                                 return;
1715                         }
1716                 }
1717
1718                 memcpy(conn->dev_class, ev->dev_class, 3);
1719
1720                 hci_dev_unlock(hdev);
1721
1722                 if (ev->link_type == ACL_LINK ||
1723                     (!(flags & HCI_PROTO_DEFER) && !lmp_esco_capable(hdev))) {
1724                         struct hci_cp_accept_conn_req cp;
1725                         conn->state = BT_CONNECT;
1726
1727                         bacpy(&cp.bdaddr, &ev->bdaddr);
1728
1729                         if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
1730                                 cp.role = 0x00; /* Become master */
1731                         else
1732                                 cp.role = 0x01; /* Remain slave */
1733
1734                         hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp),
1735                                      &cp);
1736                 } else if (!(flags & HCI_PROTO_DEFER)) {
1737                         struct hci_cp_accept_sync_conn_req cp;
1738                         conn->state = BT_CONNECT;
1739
1740                         bacpy(&cp.bdaddr, &ev->bdaddr);
1741                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
1742
1743                         cp.tx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
1744                         cp.rx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
1745                         cp.max_latency    = __constant_cpu_to_le16(0xffff);
1746                         cp.content_format = cpu_to_le16(hdev->voice_setting);
1747                         cp.retrans_effort = 0xff;
1748
1749                         hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ,
1750                                      sizeof(cp), &cp);
1751                 } else {
1752                         conn->state = BT_CONNECT2;
1753                         hci_proto_connect_cfm(conn, 0);
1754                 }
1755         } else {
1756                 /* Connection rejected */
1757                 struct hci_cp_reject_conn_req cp;
1758
1759                 bacpy(&cp.bdaddr, &ev->bdaddr);
1760                 cp.reason = HCI_ERROR_REJ_BAD_ADDR;
1761                 hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
1762         }
1763 }
1764
1765 static u8 hci_to_mgmt_reason(u8 err)
1766 {
1767         switch (err) {
1768         case HCI_ERROR_CONNECTION_TIMEOUT:
1769                 return MGMT_DEV_DISCONN_TIMEOUT;
1770         case HCI_ERROR_REMOTE_USER_TERM:
1771         case HCI_ERROR_REMOTE_LOW_RESOURCES:
1772         case HCI_ERROR_REMOTE_POWER_OFF:
1773                 return MGMT_DEV_DISCONN_REMOTE;
1774         case HCI_ERROR_LOCAL_HOST_TERM:
1775                 return MGMT_DEV_DISCONN_LOCAL_HOST;
1776         default:
1777                 return MGMT_DEV_DISCONN_UNKNOWN;
1778         }
1779 }
1780
1781 static void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1782 {
1783         struct hci_ev_disconn_complete *ev = (void *) skb->data;
1784         struct hci_conn *conn;
1785
1786         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
1787
1788         hci_dev_lock(hdev);
1789
1790         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1791         if (!conn)
1792                 goto unlock;
1793
1794         if (ev->status == 0)
1795                 conn->state = BT_CLOSED;
1796
1797         if (test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags) &&
1798             (conn->type == ACL_LINK || conn->type == LE_LINK)) {
1799                 if (ev->status) {
1800                         mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
1801                                                conn->dst_type, ev->status);
1802                 } else {
1803                         u8 reason = hci_to_mgmt_reason(ev->reason);
1804
1805                         mgmt_device_disconnected(hdev, &conn->dst, conn->type,
1806                                                  conn->dst_type, reason);
1807                 }
1808         }
1809
1810         if (ev->status == 0) {
1811                 u8 type = conn->type;
1812
1813                 if (type == ACL_LINK && conn->flush_key)
1814                         hci_remove_link_key(hdev, &conn->dst);
1815                 hci_proto_disconn_cfm(conn, ev->reason);
1816                 hci_conn_del(conn);
1817
1818                 /* Re-enable advertising if necessary, since it might
1819                  * have been disabled by the connection. From the
1820                  * HCI_LE_Set_Advertise_Enable command description in
1821                  * the core specification (v4.0):
1822                  * "The Controller shall continue advertising until the Host
1823                  * issues an LE_Set_Advertise_Enable command with
1824                  * Advertising_Enable set to 0x00 (Advertising is disabled)
1825                  * or until a connection is created or until the Advertising
1826                  * is timed out due to Directed Advertising."
1827                  */
1828                 if (type == LE_LINK)
1829                         mgmt_reenable_advertising(hdev);
1830         }
1831
1832 unlock:
1833         hci_dev_unlock(hdev);
1834 }
1835
1836 static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1837 {
1838         struct hci_ev_auth_complete *ev = (void *) skb->data;
1839         struct hci_conn *conn;
1840
1841         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
1842
1843         hci_dev_lock(hdev);
1844
1845         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1846         if (!conn)
1847                 goto unlock;
1848
1849         if (!ev->status) {
1850                 if (!hci_conn_ssp_enabled(conn) &&
1851                     test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
1852                         BT_INFO("re-auth of legacy device is not possible.");
1853                 } else {
1854                         conn->link_mode |= HCI_LM_AUTH;
1855                         conn->sec_level = conn->pending_sec_level;
1856                 }
1857         } else {
1858                 mgmt_auth_failed(hdev, &conn->dst, conn->type, conn->dst_type,
1859                                  ev->status);
1860         }
1861
1862         clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
1863         clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
1864
1865         if (conn->state == BT_CONFIG) {
1866                 if (!ev->status && hci_conn_ssp_enabled(conn)) {
1867                         struct hci_cp_set_conn_encrypt cp;
1868                         cp.handle  = ev->handle;
1869                         cp.encrypt = 0x01;
1870                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
1871                                      &cp);
1872                 } else {
1873                         conn->state = BT_CONNECTED;
1874                         hci_proto_connect_cfm(conn, ev->status);
1875                         hci_conn_drop(conn);
1876                 }
1877         } else {
1878                 hci_auth_cfm(conn, ev->status);
1879
1880                 hci_conn_hold(conn);
1881                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
1882                 hci_conn_drop(conn);
1883         }
1884
1885         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
1886                 if (!ev->status) {
1887                         struct hci_cp_set_conn_encrypt cp;
1888                         cp.handle  = ev->handle;
1889                         cp.encrypt = 0x01;
1890                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
1891                                      &cp);
1892                 } else {
1893                         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
1894                         hci_encrypt_cfm(conn, ev->status, 0x00);
1895                 }
1896         }
1897
1898 unlock:
1899         hci_dev_unlock(hdev);
1900 }
1901
1902 static void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
1903 {
1904         struct hci_ev_remote_name *ev = (void *) skb->data;
1905         struct hci_conn *conn;
1906
1907         BT_DBG("%s", hdev->name);
1908
1909         hci_conn_check_pending(hdev);
1910
1911         hci_dev_lock(hdev);
1912
1913         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
1914
1915         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
1916                 goto check_auth;
1917
1918         if (ev->status == 0)
1919                 hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
1920                                        strnlen(ev->name, HCI_MAX_NAME_LENGTH));
1921         else
1922                 hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
1923
1924 check_auth:
1925         if (!conn)
1926                 goto unlock;
1927
1928         if (!hci_outgoing_auth_needed(hdev, conn))
1929                 goto unlock;
1930
1931         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
1932                 struct hci_cp_auth_requested cp;
1933                 cp.handle = __cpu_to_le16(conn->handle);
1934                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
1935         }
1936
1937 unlock:
1938         hci_dev_unlock(hdev);
1939 }
1940
1941 static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
1942 {
1943         struct hci_ev_encrypt_change *ev = (void *) skb->data;
1944         struct hci_conn *conn;
1945
1946         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
1947
1948         hci_dev_lock(hdev);
1949
1950         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1951         if (conn) {
1952                 if (!ev->status) {
1953                         if (ev->encrypt) {
1954                                 /* Encryption implies authentication */
1955                                 conn->link_mode |= HCI_LM_AUTH;
1956                                 conn->link_mode |= HCI_LM_ENCRYPT;
1957                                 conn->sec_level = conn->pending_sec_level;
1958                         } else
1959                                 conn->link_mode &= ~HCI_LM_ENCRYPT;
1960                 }
1961
1962                 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
1963
1964                 if (ev->status && conn->state == BT_CONNECTED) {
1965                         hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
1966                         hci_conn_drop(conn);
1967                         goto unlock;
1968                 }
1969
1970                 if (conn->state == BT_CONFIG) {
1971                         if (!ev->status)
1972                                 conn->state = BT_CONNECTED;
1973
1974                         hci_proto_connect_cfm(conn, ev->status);
1975                         hci_conn_drop(conn);
1976                 } else
1977                         hci_encrypt_cfm(conn, ev->status, ev->encrypt);
1978         }
1979
1980 unlock:
1981         hci_dev_unlock(hdev);
1982 }
1983
1984 static void hci_change_link_key_complete_evt(struct hci_dev *hdev,
1985                                              struct sk_buff *skb)
1986 {
1987         struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
1988         struct hci_conn *conn;
1989
1990         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
1991
1992         hci_dev_lock(hdev);
1993
1994         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1995         if (conn) {
1996                 if (!ev->status)
1997                         conn->link_mode |= HCI_LM_SECURE;
1998
1999                 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
2000
2001                 hci_key_change_cfm(conn, ev->status);
2002         }
2003
2004         hci_dev_unlock(hdev);
2005 }
2006
2007 static void hci_remote_features_evt(struct hci_dev *hdev,
2008                                     struct sk_buff *skb)
2009 {
2010         struct hci_ev_remote_features *ev = (void *) skb->data;
2011         struct hci_conn *conn;
2012
2013         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2014
2015         hci_dev_lock(hdev);
2016
2017         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2018         if (!conn)
2019                 goto unlock;
2020
2021         if (!ev->status)
2022                 memcpy(conn->features[0], ev->features, 8);
2023
2024         if (conn->state != BT_CONFIG)
2025                 goto unlock;
2026
2027         if (!ev->status && lmp_ssp_capable(hdev) && lmp_ssp_capable(conn)) {
2028                 struct hci_cp_read_remote_ext_features cp;
2029                 cp.handle = ev->handle;
2030                 cp.page = 0x01;
2031                 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
2032                              sizeof(cp), &cp);
2033                 goto unlock;
2034         }
2035
2036         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
2037                 struct hci_cp_remote_name_req cp;
2038                 memset(&cp, 0, sizeof(cp));
2039                 bacpy(&cp.bdaddr, &conn->dst);
2040                 cp.pscan_rep_mode = 0x02;
2041                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2042         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2043                 mgmt_device_connected(hdev, &conn->dst, conn->type,
2044                                       conn->dst_type, 0, NULL, 0,
2045                                       conn->dev_class);
2046
2047         if (!hci_outgoing_auth_needed(hdev, conn)) {
2048                 conn->state = BT_CONNECTED;
2049                 hci_proto_connect_cfm(conn, ev->status);
2050                 hci_conn_drop(conn);
2051         }
2052
2053 unlock:
2054         hci_dev_unlock(hdev);
2055 }
2056
2057 static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2058 {
2059         struct hci_ev_cmd_complete *ev = (void *) skb->data;
2060         u8 status = skb->data[sizeof(*ev)];
2061         __u16 opcode;
2062
2063         skb_pull(skb, sizeof(*ev));
2064
2065         opcode = __le16_to_cpu(ev->opcode);
2066
2067         switch (opcode) {
2068         case HCI_OP_INQUIRY_CANCEL:
2069                 hci_cc_inquiry_cancel(hdev, skb);
2070                 break;
2071
2072         case HCI_OP_PERIODIC_INQ:
2073                 hci_cc_periodic_inq(hdev, skb);
2074                 break;
2075
2076         case HCI_OP_EXIT_PERIODIC_INQ:
2077                 hci_cc_exit_periodic_inq(hdev, skb);
2078                 break;
2079
2080         case HCI_OP_REMOTE_NAME_REQ_CANCEL:
2081                 hci_cc_remote_name_req_cancel(hdev, skb);
2082                 break;
2083
2084         case HCI_OP_ROLE_DISCOVERY:
2085                 hci_cc_role_discovery(hdev, skb);
2086                 break;
2087
2088         case HCI_OP_READ_LINK_POLICY:
2089                 hci_cc_read_link_policy(hdev, skb);
2090                 break;
2091
2092         case HCI_OP_WRITE_LINK_POLICY:
2093                 hci_cc_write_link_policy(hdev, skb);
2094                 break;
2095
2096         case HCI_OP_READ_DEF_LINK_POLICY:
2097                 hci_cc_read_def_link_policy(hdev, skb);
2098                 break;
2099
2100         case HCI_OP_WRITE_DEF_LINK_POLICY:
2101                 hci_cc_write_def_link_policy(hdev, skb);
2102                 break;
2103
2104         case HCI_OP_RESET:
2105                 hci_cc_reset(hdev, skb);
2106                 break;
2107
2108         case HCI_OP_WRITE_LOCAL_NAME:
2109                 hci_cc_write_local_name(hdev, skb);
2110                 break;
2111
2112         case HCI_OP_READ_LOCAL_NAME:
2113                 hci_cc_read_local_name(hdev, skb);
2114                 break;
2115
2116         case HCI_OP_WRITE_AUTH_ENABLE:
2117                 hci_cc_write_auth_enable(hdev, skb);
2118                 break;
2119
2120         case HCI_OP_WRITE_ENCRYPT_MODE:
2121                 hci_cc_write_encrypt_mode(hdev, skb);
2122                 break;
2123
2124         case HCI_OP_WRITE_SCAN_ENABLE:
2125                 hci_cc_write_scan_enable(hdev, skb);
2126                 break;
2127
2128         case HCI_OP_READ_CLASS_OF_DEV:
2129                 hci_cc_read_class_of_dev(hdev, skb);
2130                 break;
2131
2132         case HCI_OP_WRITE_CLASS_OF_DEV:
2133                 hci_cc_write_class_of_dev(hdev, skb);
2134                 break;
2135
2136         case HCI_OP_READ_VOICE_SETTING:
2137                 hci_cc_read_voice_setting(hdev, skb);
2138                 break;
2139
2140         case HCI_OP_WRITE_VOICE_SETTING:
2141                 hci_cc_write_voice_setting(hdev, skb);
2142                 break;
2143
2144         case HCI_OP_READ_NUM_SUPPORTED_IAC:
2145                 hci_cc_read_num_supported_iac(hdev, skb);
2146                 break;
2147
2148         case HCI_OP_WRITE_SSP_MODE:
2149                 hci_cc_write_ssp_mode(hdev, skb);
2150                 break;
2151
2152         case HCI_OP_READ_LOCAL_VERSION:
2153                 hci_cc_read_local_version(hdev, skb);
2154                 break;
2155
2156         case HCI_OP_READ_LOCAL_COMMANDS:
2157                 hci_cc_read_local_commands(hdev, skb);
2158                 break;
2159
2160         case HCI_OP_READ_LOCAL_FEATURES:
2161                 hci_cc_read_local_features(hdev, skb);
2162                 break;
2163
2164         case HCI_OP_READ_LOCAL_EXT_FEATURES:
2165                 hci_cc_read_local_ext_features(hdev, skb);
2166                 break;
2167
2168         case HCI_OP_READ_BUFFER_SIZE:
2169                 hci_cc_read_buffer_size(hdev, skb);
2170                 break;
2171
2172         case HCI_OP_READ_BD_ADDR:
2173                 hci_cc_read_bd_addr(hdev, skb);
2174                 break;
2175
2176         case HCI_OP_READ_PAGE_SCAN_ACTIVITY:
2177                 hci_cc_read_page_scan_activity(hdev, skb);
2178                 break;
2179
2180         case HCI_OP_WRITE_PAGE_SCAN_ACTIVITY:
2181                 hci_cc_write_page_scan_activity(hdev, skb);
2182                 break;
2183
2184         case HCI_OP_READ_PAGE_SCAN_TYPE:
2185                 hci_cc_read_page_scan_type(hdev, skb);
2186                 break;
2187
2188         case HCI_OP_WRITE_PAGE_SCAN_TYPE:
2189                 hci_cc_write_page_scan_type(hdev, skb);
2190                 break;
2191
2192         case HCI_OP_READ_DATA_BLOCK_SIZE:
2193                 hci_cc_read_data_block_size(hdev, skb);
2194                 break;
2195
2196         case HCI_OP_READ_FLOW_CONTROL_MODE:
2197                 hci_cc_read_flow_control_mode(hdev, skb);
2198                 break;
2199
2200         case HCI_OP_READ_LOCAL_AMP_INFO:
2201                 hci_cc_read_local_amp_info(hdev, skb);
2202                 break;
2203
2204         case HCI_OP_READ_LOCAL_AMP_ASSOC:
2205                 hci_cc_read_local_amp_assoc(hdev, skb);
2206                 break;
2207
2208         case HCI_OP_READ_INQ_RSP_TX_POWER:
2209                 hci_cc_read_inq_rsp_tx_power(hdev, skb);
2210                 break;
2211
2212         case HCI_OP_PIN_CODE_REPLY:
2213                 hci_cc_pin_code_reply(hdev, skb);
2214                 break;
2215
2216         case HCI_OP_PIN_CODE_NEG_REPLY:
2217                 hci_cc_pin_code_neg_reply(hdev, skb);
2218                 break;
2219
2220         case HCI_OP_READ_LOCAL_OOB_DATA:
2221                 hci_cc_read_local_oob_data_reply(hdev, skb);
2222                 break;
2223
2224         case HCI_OP_LE_READ_BUFFER_SIZE:
2225                 hci_cc_le_read_buffer_size(hdev, skb);
2226                 break;
2227
2228         case HCI_OP_LE_READ_LOCAL_FEATURES:
2229                 hci_cc_le_read_local_features(hdev, skb);
2230                 break;
2231
2232         case HCI_OP_LE_READ_ADV_TX_POWER:
2233                 hci_cc_le_read_adv_tx_power(hdev, skb);
2234                 break;
2235
2236         case HCI_OP_USER_CONFIRM_REPLY:
2237                 hci_cc_user_confirm_reply(hdev, skb);
2238                 break;
2239
2240         case HCI_OP_USER_CONFIRM_NEG_REPLY:
2241                 hci_cc_user_confirm_neg_reply(hdev, skb);
2242                 break;
2243
2244         case HCI_OP_USER_PASSKEY_REPLY:
2245                 hci_cc_user_passkey_reply(hdev, skb);
2246                 break;
2247
2248         case HCI_OP_USER_PASSKEY_NEG_REPLY:
2249                 hci_cc_user_passkey_neg_reply(hdev, skb);
2250                 break;
2251
2252         case HCI_OP_LE_SET_ADV_ENABLE:
2253                 hci_cc_le_set_adv_enable(hdev, skb);
2254                 break;
2255
2256         case HCI_OP_LE_SET_SCAN_ENABLE:
2257                 hci_cc_le_set_scan_enable(hdev, skb);
2258                 break;
2259
2260         case HCI_OP_LE_READ_WHITE_LIST_SIZE:
2261                 hci_cc_le_read_white_list_size(hdev, skb);
2262                 break;
2263
2264         case HCI_OP_LE_READ_SUPPORTED_STATES:
2265                 hci_cc_le_read_supported_states(hdev, skb);
2266                 break;
2267
2268         case HCI_OP_WRITE_LE_HOST_SUPPORTED:
2269                 hci_cc_write_le_host_supported(hdev, skb);
2270                 break;
2271
2272         case HCI_OP_WRITE_REMOTE_AMP_ASSOC:
2273                 hci_cc_write_remote_amp_assoc(hdev, skb);
2274                 break;
2275
2276         default:
2277                 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
2278                 break;
2279         }
2280
2281         if (opcode != HCI_OP_NOP)
2282                 del_timer(&hdev->cmd_timer);
2283
2284         hci_req_cmd_complete(hdev, opcode, status);
2285
2286         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
2287                 atomic_set(&hdev->cmd_cnt, 1);
2288                 if (!skb_queue_empty(&hdev->cmd_q))
2289                         queue_work(hdev->workqueue, &hdev->cmd_work);
2290         }
2291 }
2292
2293 static void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb)
2294 {
2295         struct hci_ev_cmd_status *ev = (void *) skb->data;
2296         __u16 opcode;
2297
2298         skb_pull(skb, sizeof(*ev));
2299
2300         opcode = __le16_to_cpu(ev->opcode);
2301
2302         switch (opcode) {
2303         case HCI_OP_INQUIRY:
2304                 hci_cs_inquiry(hdev, ev->status);
2305                 break;
2306
2307         case HCI_OP_CREATE_CONN:
2308                 hci_cs_create_conn(hdev, ev->status);
2309                 break;
2310
2311         case HCI_OP_ADD_SCO:
2312                 hci_cs_add_sco(hdev, ev->status);
2313                 break;
2314
2315         case HCI_OP_AUTH_REQUESTED:
2316                 hci_cs_auth_requested(hdev, ev->status);
2317                 break;
2318
2319         case HCI_OP_SET_CONN_ENCRYPT:
2320                 hci_cs_set_conn_encrypt(hdev, ev->status);
2321                 break;
2322
2323         case HCI_OP_REMOTE_NAME_REQ:
2324                 hci_cs_remote_name_req(hdev, ev->status);
2325                 break;
2326
2327         case HCI_OP_READ_REMOTE_FEATURES:
2328                 hci_cs_read_remote_features(hdev, ev->status);
2329                 break;
2330
2331         case HCI_OP_READ_REMOTE_EXT_FEATURES:
2332                 hci_cs_read_remote_ext_features(hdev, ev->status);
2333                 break;
2334
2335         case HCI_OP_SETUP_SYNC_CONN:
2336                 hci_cs_setup_sync_conn(hdev, ev->status);
2337                 break;
2338
2339         case HCI_OP_SNIFF_MODE:
2340                 hci_cs_sniff_mode(hdev, ev->status);
2341                 break;
2342
2343         case HCI_OP_EXIT_SNIFF_MODE:
2344                 hci_cs_exit_sniff_mode(hdev, ev->status);
2345                 break;
2346
2347         case HCI_OP_DISCONNECT:
2348                 hci_cs_disconnect(hdev, ev->status);
2349                 break;
2350
2351         case HCI_OP_CREATE_PHY_LINK:
2352                 hci_cs_create_phylink(hdev, ev->status);
2353                 break;
2354
2355         case HCI_OP_ACCEPT_PHY_LINK:
2356                 hci_cs_accept_phylink(hdev, ev->status);
2357                 break;
2358
2359         default:
2360                 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
2361                 break;
2362         }
2363
2364         if (opcode != HCI_OP_NOP)
2365                 del_timer(&hdev->cmd_timer);
2366
2367         if (ev->status ||
2368             (hdev->sent_cmd && !bt_cb(hdev->sent_cmd)->req.event))
2369                 hci_req_cmd_complete(hdev, opcode, ev->status);
2370
2371         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
2372                 atomic_set(&hdev->cmd_cnt, 1);
2373                 if (!skb_queue_empty(&hdev->cmd_q))
2374                         queue_work(hdev->workqueue, &hdev->cmd_work);
2375         }
2376 }
2377
2378 static void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2379 {
2380         struct hci_ev_role_change *ev = (void *) skb->data;
2381         struct hci_conn *conn;
2382
2383         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2384
2385         hci_dev_lock(hdev);
2386
2387         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2388         if (conn) {
2389                 if (!ev->status) {
2390                         if (ev->role)
2391                                 conn->link_mode &= ~HCI_LM_MASTER;
2392                         else
2393                                 conn->link_mode |= HCI_LM_MASTER;
2394                 }
2395
2396                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
2397
2398                 hci_role_switch_cfm(conn, ev->status, ev->role);
2399         }
2400
2401         hci_dev_unlock(hdev);
2402 }
2403
2404 static void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
2405 {
2406         struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
2407         int i;
2408
2409         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
2410                 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
2411                 return;
2412         }
2413
2414         if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
2415             ev->num_hndl * sizeof(struct hci_comp_pkts_info)) {
2416                 BT_DBG("%s bad parameters", hdev->name);
2417                 return;
2418         }
2419
2420         BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
2421
2422         for (i = 0; i < ev->num_hndl; i++) {
2423                 struct hci_comp_pkts_info *info = &ev->handles[i];
2424                 struct hci_conn *conn;
2425                 __u16  handle, count;
2426
2427                 handle = __le16_to_cpu(info->handle);
2428                 count  = __le16_to_cpu(info->count);
2429
2430                 conn = hci_conn_hash_lookup_handle(hdev, handle);
2431                 if (!conn)
2432                         continue;
2433
2434                 conn->sent -= count;
2435
2436                 switch (conn->type) {
2437                 case ACL_LINK:
2438                         hdev->acl_cnt += count;
2439                         if (hdev->acl_cnt > hdev->acl_pkts)
2440                                 hdev->acl_cnt = hdev->acl_pkts;
2441                         break;
2442
2443                 case LE_LINK:
2444                         if (hdev->le_pkts) {
2445                                 hdev->le_cnt += count;
2446                                 if (hdev->le_cnt > hdev->le_pkts)
2447                                         hdev->le_cnt = hdev->le_pkts;
2448                         } else {
2449                                 hdev->acl_cnt += count;
2450                                 if (hdev->acl_cnt > hdev->acl_pkts)
2451                                         hdev->acl_cnt = hdev->acl_pkts;
2452                         }
2453                         break;
2454
2455                 case SCO_LINK:
2456                         hdev->sco_cnt += count;
2457                         if (hdev->sco_cnt > hdev->sco_pkts)
2458                                 hdev->sco_cnt = hdev->sco_pkts;
2459                         break;
2460
2461                 default:
2462                         BT_ERR("Unknown type %d conn %p", conn->type, conn);
2463                         break;
2464                 }
2465         }
2466
2467         queue_work(hdev->workqueue, &hdev->tx_work);
2468 }
2469
2470 static struct hci_conn *__hci_conn_lookup_handle(struct hci_dev *hdev,
2471                                                  __u16 handle)
2472 {
2473         struct hci_chan *chan;
2474
2475         switch (hdev->dev_type) {
2476         case HCI_BREDR:
2477                 return hci_conn_hash_lookup_handle(hdev, handle);
2478         case HCI_AMP:
2479                 chan = hci_chan_lookup_handle(hdev, handle);
2480                 if (chan)
2481                         return chan->conn;
2482                 break;
2483         default:
2484                 BT_ERR("%s unknown dev_type %d", hdev->name, hdev->dev_type);
2485                 break;
2486         }
2487
2488         return NULL;
2489 }
2490
2491 static void hci_num_comp_blocks_evt(struct hci_dev *hdev, struct sk_buff *skb)
2492 {
2493         struct hci_ev_num_comp_blocks *ev = (void *) skb->data;
2494         int i;
2495
2496         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
2497                 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
2498                 return;
2499         }
2500
2501         if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
2502             ev->num_hndl * sizeof(struct hci_comp_blocks_info)) {
2503                 BT_DBG("%s bad parameters", hdev->name);
2504                 return;
2505         }
2506
2507         BT_DBG("%s num_blocks %d num_hndl %d", hdev->name, ev->num_blocks,
2508                ev->num_hndl);
2509
2510         for (i = 0; i < ev->num_hndl; i++) {
2511                 struct hci_comp_blocks_info *info = &ev->handles[i];
2512                 struct hci_conn *conn = NULL;
2513                 __u16  handle, block_count;
2514
2515                 handle = __le16_to_cpu(info->handle);
2516                 block_count = __le16_to_cpu(info->blocks);
2517
2518                 conn = __hci_conn_lookup_handle(hdev, handle);
2519                 if (!conn)
2520                         continue;
2521
2522                 conn->sent -= block_count;
2523
2524                 switch (conn->type) {
2525                 case ACL_LINK:
2526                 case AMP_LINK:
2527                         hdev->block_cnt += block_count;
2528                         if (hdev->block_cnt > hdev->num_blocks)
2529                                 hdev->block_cnt = hdev->num_blocks;
2530                         break;
2531
2532                 default:
2533                         BT_ERR("Unknown type %d conn %p", conn->type, conn);
2534                         break;
2535                 }
2536         }
2537
2538         queue_work(hdev->workqueue, &hdev->tx_work);
2539 }
2540
2541 static void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2542 {
2543         struct hci_ev_mode_change *ev = (void *) skb->data;
2544         struct hci_conn *conn;
2545
2546         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2547
2548         hci_dev_lock(hdev);
2549
2550         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2551         if (conn) {
2552                 conn->mode = ev->mode;
2553                 conn->interval = __le16_to_cpu(ev->interval);
2554
2555                 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND,
2556                                         &conn->flags)) {
2557                         if (conn->mode == HCI_CM_ACTIVE)
2558                                 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
2559                         else
2560                                 clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
2561                 }
2562
2563                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2564                         hci_sco_setup(conn, ev->status);
2565         }
2566
2567         hci_dev_unlock(hdev);
2568 }
2569
2570 static void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2571 {
2572         struct hci_ev_pin_code_req *ev = (void *) skb->data;
2573         struct hci_conn *conn;
2574
2575         BT_DBG("%s", hdev->name);
2576
2577         hci_dev_lock(hdev);
2578
2579         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2580         if (!conn)
2581                 goto unlock;
2582
2583         if (conn->state == BT_CONNECTED) {
2584                 hci_conn_hold(conn);
2585                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2586                 hci_conn_drop(conn);
2587         }
2588
2589         if (!test_bit(HCI_PAIRABLE, &hdev->dev_flags))
2590                 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2591                              sizeof(ev->bdaddr), &ev->bdaddr);
2592         else if (test_bit(HCI_MGMT, &hdev->dev_flags)) {
2593                 u8 secure;
2594
2595                 if (conn->pending_sec_level == BT_SECURITY_HIGH)
2596                         secure = 1;
2597                 else
2598                         secure = 0;
2599
2600                 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
2601         }
2602
2603 unlock:
2604         hci_dev_unlock(hdev);
2605 }
2606
2607 static void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2608 {
2609         struct hci_ev_link_key_req *ev = (void *) skb->data;
2610         struct hci_cp_link_key_reply cp;
2611         struct hci_conn *conn;
2612         struct link_key *key;
2613
2614         BT_DBG("%s", hdev->name);
2615
2616         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
2617                 return;
2618
2619         hci_dev_lock(hdev);
2620
2621         key = hci_find_link_key(hdev, &ev->bdaddr);
2622         if (!key) {
2623                 BT_DBG("%s link key not found for %pMR", hdev->name,
2624                        &ev->bdaddr);
2625                 goto not_found;
2626         }
2627
2628         BT_DBG("%s found key type %u for %pMR", hdev->name, key->type,
2629                &ev->bdaddr);
2630
2631         if (!test_bit(HCI_DEBUG_KEYS, &hdev->dev_flags) &&
2632             key->type == HCI_LK_DEBUG_COMBINATION) {
2633                 BT_DBG("%s ignoring debug key", hdev->name);
2634                 goto not_found;
2635         }
2636
2637         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2638         if (conn) {
2639                 if (key->type == HCI_LK_UNAUTH_COMBINATION &&
2640                     conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
2641                         BT_DBG("%s ignoring unauthenticated key", hdev->name);
2642                         goto not_found;
2643                 }
2644
2645                 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
2646                     conn->pending_sec_level == BT_SECURITY_HIGH) {
2647                         BT_DBG("%s ignoring key unauthenticated for high security",
2648                                hdev->name);
2649                         goto not_found;
2650                 }
2651
2652                 conn->key_type = key->type;
2653                 conn->pin_length = key->pin_len;
2654         }
2655
2656         bacpy(&cp.bdaddr, &ev->bdaddr);
2657         memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);
2658
2659         hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
2660
2661         hci_dev_unlock(hdev);
2662
2663         return;
2664
2665 not_found:
2666         hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
2667         hci_dev_unlock(hdev);
2668 }
2669
2670 static void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
2671 {
2672         struct hci_ev_link_key_notify *ev = (void *) skb->data;
2673         struct hci_conn *conn;
2674         u8 pin_len = 0;
2675
2676         BT_DBG("%s", hdev->name);
2677
2678         hci_dev_lock(hdev);
2679
2680         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2681         if (conn) {
2682                 hci_conn_hold(conn);
2683                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2684                 pin_len = conn->pin_length;
2685
2686                 if (ev->key_type != HCI_LK_CHANGED_COMBINATION)
2687                         conn->key_type = ev->key_type;
2688
2689                 hci_conn_drop(conn);
2690         }
2691
2692         if (test_bit(HCI_MGMT, &hdev->dev_flags))
2693                 hci_add_link_key(hdev, conn, 1, &ev->bdaddr, ev->link_key,
2694                                  ev->key_type, pin_len);
2695
2696         hci_dev_unlock(hdev);
2697 }
2698
2699 static void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
2700 {
2701         struct hci_ev_clock_offset *ev = (void *) skb->data;
2702         struct hci_conn *conn;
2703
2704         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2705
2706         hci_dev_lock(hdev);
2707
2708         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2709         if (conn && !ev->status) {
2710                 struct inquiry_entry *ie;
2711
2712                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
2713                 if (ie) {
2714                         ie->data.clock_offset = ev->clock_offset;
2715                         ie->timestamp = jiffies;
2716                 }
2717         }
2718
2719         hci_dev_unlock(hdev);
2720 }
2721
2722 static void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2723 {
2724         struct hci_ev_pkt_type_change *ev = (void *) skb->data;
2725         struct hci_conn *conn;
2726
2727         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2728
2729         hci_dev_lock(hdev);
2730
2731         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2732         if (conn && !ev->status)
2733                 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
2734
2735         hci_dev_unlock(hdev);
2736 }
2737
2738 static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
2739 {
2740         struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
2741         struct inquiry_entry *ie;
2742
2743         BT_DBG("%s", hdev->name);
2744
2745         hci_dev_lock(hdev);
2746
2747         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2748         if (ie) {
2749                 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
2750                 ie->timestamp = jiffies;
2751         }
2752
2753         hci_dev_unlock(hdev);
2754 }
2755
2756 static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
2757                                              struct sk_buff *skb)
2758 {
2759         struct inquiry_data data;
2760         int num_rsp = *((__u8 *) skb->data);
2761         bool name_known, ssp;
2762
2763         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2764
2765         if (!num_rsp)
2766                 return;
2767
2768         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
2769                 return;
2770
2771         hci_dev_lock(hdev);
2772
2773         if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
2774                 struct inquiry_info_with_rssi_and_pscan_mode *info;
2775                 info = (void *) (skb->data + 1);
2776
2777                 for (; num_rsp; num_rsp--, info++) {
2778                         bacpy(&data.bdaddr, &info->bdaddr);
2779                         data.pscan_rep_mode     = info->pscan_rep_mode;
2780                         data.pscan_period_mode  = info->pscan_period_mode;
2781                         data.pscan_mode         = info->pscan_mode;
2782                         memcpy(data.dev_class, info->dev_class, 3);
2783                         data.clock_offset       = info->clock_offset;
2784                         data.rssi               = info->rssi;
2785                         data.ssp_mode           = 0x00;
2786
2787                         name_known = hci_inquiry_cache_update(hdev, &data,
2788                                                               false, &ssp);
2789                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2790                                           info->dev_class, info->rssi,
2791                                           !name_known, ssp, NULL, 0);
2792                 }
2793         } else {
2794                 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
2795
2796                 for (; num_rsp; num_rsp--, info++) {
2797                         bacpy(&data.bdaddr, &info->bdaddr);
2798                         data.pscan_rep_mode     = info->pscan_rep_mode;
2799                         data.pscan_period_mode  = info->pscan_period_mode;
2800                         data.pscan_mode         = 0x00;
2801                         memcpy(data.dev_class, info->dev_class, 3);
2802                         data.clock_offset       = info->clock_offset;
2803                         data.rssi               = info->rssi;
2804                         data.ssp_mode           = 0x00;
2805                         name_known = hci_inquiry_cache_update(hdev, &data,
2806                                                               false, &ssp);
2807                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2808                                           info->dev_class, info->rssi,
2809                                           !name_known, ssp, NULL, 0);
2810                 }
2811         }
2812
2813         hci_dev_unlock(hdev);
2814 }
2815
2816 static void hci_remote_ext_features_evt(struct hci_dev *hdev,
2817                                         struct sk_buff *skb)
2818 {
2819         struct hci_ev_remote_ext_features *ev = (void *) skb->data;
2820         struct hci_conn *conn;
2821
2822         BT_DBG("%s", hdev->name);
2823
2824         hci_dev_lock(hdev);
2825
2826         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2827         if (!conn)
2828                 goto unlock;
2829
2830         if (ev->page < HCI_MAX_PAGES)
2831                 memcpy(conn->features[ev->page], ev->features, 8);
2832
2833         if (!ev->status && ev->page == 0x01) {
2834                 struct inquiry_entry *ie;
2835
2836                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
2837                 if (ie)
2838                         ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
2839
2840                 if (ev->features[0] & LMP_HOST_SSP) {
2841                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
2842                 } else {
2843                         /* It is mandatory by the Bluetooth specification that
2844                          * Extended Inquiry Results are only used when Secure
2845                          * Simple Pairing is enabled, but some devices violate
2846                          * this.
2847                          *
2848                          * To make these devices work, the internal SSP
2849                          * enabled flag needs to be cleared if the remote host
2850                          * features do not indicate SSP support */
2851                         clear_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
2852                 }
2853         }
2854
2855         if (conn->state != BT_CONFIG)
2856                 goto unlock;
2857
2858         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
2859                 struct hci_cp_remote_name_req cp;
2860                 memset(&cp, 0, sizeof(cp));
2861                 bacpy(&cp.bdaddr, &conn->dst);
2862                 cp.pscan_rep_mode = 0x02;
2863                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2864         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2865                 mgmt_device_connected(hdev, &conn->dst, conn->type,
2866                                       conn->dst_type, 0, NULL, 0,
2867                                       conn->dev_class);
2868
2869         if (!hci_outgoing_auth_needed(hdev, conn)) {
2870                 conn->state = BT_CONNECTED;
2871                 hci_proto_connect_cfm(conn, ev->status);
2872                 hci_conn_drop(conn);
2873         }
2874
2875 unlock:
2876         hci_dev_unlock(hdev);
2877 }
2878
2879 static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
2880                                        struct sk_buff *skb)
2881 {
2882         struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
2883         struct hci_conn *conn;
2884
2885         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2886
2887         hci_dev_lock(hdev);
2888
2889         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
2890         if (!conn) {
2891                 if (ev->link_type == ESCO_LINK)
2892                         goto unlock;
2893
2894                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
2895                 if (!conn)
2896                         goto unlock;
2897
2898                 conn->type = SCO_LINK;
2899         }
2900
2901         switch (ev->status) {
2902         case 0x00:
2903                 conn->handle = __le16_to_cpu(ev->handle);
2904                 conn->state  = BT_CONNECTED;
2905
2906                 hci_conn_add_sysfs(conn);
2907                 break;
2908
2909         case 0x0d:      /* Connection Rejected due to Limited Resources */
2910         case 0x11:      /* Unsupported Feature or Parameter Value */
2911         case 0x1c:      /* SCO interval rejected */
2912         case 0x1a:      /* Unsupported Remote Feature */
2913         case 0x1f:      /* Unspecified error */
2914                 if (conn->out) {
2915                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
2916                                         (hdev->esco_type & EDR_ESCO_MASK);
2917                         if (hci_setup_sync(conn, conn->link->handle))
2918                                 goto unlock;
2919                 }
2920                 /* fall through */
2921
2922         default:
2923                 conn->state = BT_CLOSED;
2924                 break;
2925         }
2926
2927         hci_proto_connect_cfm(conn, ev->status);
2928         if (ev->status)
2929                 hci_conn_del(conn);
2930
2931 unlock:
2932         hci_dev_unlock(hdev);
2933 }
2934
2935 static inline size_t eir_get_length(u8 *eir, size_t eir_len)
2936 {
2937         size_t parsed = 0;
2938
2939         while (parsed < eir_len) {
2940                 u8 field_len = eir[0];
2941
2942                 if (field_len == 0)
2943                         return parsed;
2944
2945                 parsed += field_len + 1;
2946                 eir += field_len + 1;
2947         }
2948
2949         return eir_len;
2950 }
2951
2952 static void hci_extended_inquiry_result_evt(struct hci_dev *hdev,
2953                                             struct sk_buff *skb)
2954 {
2955         struct inquiry_data data;
2956         struct extended_inquiry_info *info = (void *) (skb->data + 1);
2957         int num_rsp = *((__u8 *) skb->data);
2958         size_t eir_len;
2959
2960         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2961
2962         if (!num_rsp)
2963                 return;
2964
2965         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
2966                 return;
2967
2968         hci_dev_lock(hdev);
2969
2970         for (; num_rsp; num_rsp--, info++) {
2971                 bool name_known, ssp;
2972
2973                 bacpy(&data.bdaddr, &info->bdaddr);
2974                 data.pscan_rep_mode     = info->pscan_rep_mode;
2975                 data.pscan_period_mode  = info->pscan_period_mode;
2976                 data.pscan_mode         = 0x00;
2977                 memcpy(data.dev_class, info->dev_class, 3);
2978                 data.clock_offset       = info->clock_offset;
2979                 data.rssi               = info->rssi;
2980                 data.ssp_mode           = 0x01;
2981
2982                 if (test_bit(HCI_MGMT, &hdev->dev_flags))
2983                         name_known = eir_has_data_type(info->data,
2984                                                        sizeof(info->data),
2985                                                        EIR_NAME_COMPLETE);
2986                 else
2987                         name_known = true;
2988
2989                 name_known = hci_inquiry_cache_update(hdev, &data, name_known,
2990                                                       &ssp);
2991                 eir_len = eir_get_length(info->data, sizeof(info->data));
2992                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2993                                   info->dev_class, info->rssi, !name_known,
2994                                   ssp, info->data, eir_len);
2995         }
2996
2997         hci_dev_unlock(hdev);
2998 }
2999
3000 static void hci_key_refresh_complete_evt(struct hci_dev *hdev,
3001                                          struct sk_buff *skb)
3002 {
3003         struct hci_ev_key_refresh_complete *ev = (void *) skb->data;
3004         struct hci_conn *conn;
3005
3006         BT_DBG("%s status 0x%2.2x handle 0x%4.4x", hdev->name, ev->status,
3007                __le16_to_cpu(ev->handle));
3008
3009         hci_dev_lock(hdev);
3010
3011         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3012         if (!conn)
3013                 goto unlock;
3014
3015         if (!ev->status)
3016                 conn->sec_level = conn->pending_sec_level;
3017
3018         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3019
3020         if (ev->status && conn->state == BT_CONNECTED) {
3021                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
3022                 hci_conn_drop(conn);
3023                 goto unlock;
3024         }
3025
3026         if (conn->state == BT_CONFIG) {
3027                 if (!ev->status)
3028                         conn->state = BT_CONNECTED;
3029
3030                 hci_proto_connect_cfm(conn, ev->status);
3031                 hci_conn_drop(conn);
3032         } else {
3033                 hci_auth_cfm(conn, ev->status);
3034
3035                 hci_conn_hold(conn);
3036                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3037                 hci_conn_drop(conn);
3038         }
3039
3040 unlock:
3041         hci_dev_unlock(hdev);
3042 }
3043
3044 static u8 hci_get_auth_req(struct hci_conn *conn)
3045 {
3046         /* If remote requests dedicated bonding follow that lead */
3047         if (conn->remote_auth == HCI_AT_DEDICATED_BONDING ||
3048             conn->remote_auth == HCI_AT_DEDICATED_BONDING_MITM) {
3049                 /* If both remote and local IO capabilities allow MITM
3050                  * protection then require it, otherwise don't */
3051                 if (conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT ||
3052                     conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)
3053                         return HCI_AT_DEDICATED_BONDING;
3054                 else
3055                         return HCI_AT_DEDICATED_BONDING_MITM;
3056         }
3057
3058         /* If remote requests no-bonding follow that lead */
3059         if (conn->remote_auth == HCI_AT_NO_BONDING ||
3060             conn->remote_auth == HCI_AT_NO_BONDING_MITM)
3061                 return conn->remote_auth | (conn->auth_type & 0x01);
3062
3063         return conn->auth_type;
3064 }
3065
3066 static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3067 {
3068         struct hci_ev_io_capa_request *ev = (void *) skb->data;
3069         struct hci_conn *conn;
3070
3071         BT_DBG("%s", hdev->name);
3072
3073         hci_dev_lock(hdev);
3074
3075         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3076         if (!conn)
3077                 goto unlock;
3078
3079         hci_conn_hold(conn);
3080
3081         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3082                 goto unlock;
3083
3084         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags) ||
3085             (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
3086                 struct hci_cp_io_capability_reply cp;
3087
3088                 bacpy(&cp.bdaddr, &ev->bdaddr);
3089                 /* Change the IO capability from KeyboardDisplay
3090                  * to DisplayYesNo as it is not supported by BT spec. */
3091                 cp.capability = (conn->io_capability == 0x04) ?
3092                                 HCI_IO_DISPLAY_YESNO : conn->io_capability;
3093                 conn->auth_type = hci_get_auth_req(conn);
3094                 cp.authentication = conn->auth_type;
3095
3096                 if (hci_find_remote_oob_data(hdev, &conn->dst) &&
3097                     (conn->out || test_bit(HCI_CONN_REMOTE_OOB, &conn->flags)))
3098                         cp.oob_data = 0x01;
3099                 else
3100                         cp.oob_data = 0x00;
3101
3102                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
3103                              sizeof(cp), &cp);
3104         } else {
3105                 struct hci_cp_io_capability_neg_reply cp;
3106
3107                 bacpy(&cp.bdaddr, &ev->bdaddr);
3108                 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
3109
3110                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
3111                              sizeof(cp), &cp);
3112         }
3113
3114 unlock:
3115         hci_dev_unlock(hdev);
3116 }
3117
3118 static void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
3119 {
3120         struct hci_ev_io_capa_reply *ev = (void *) skb->data;
3121         struct hci_conn *conn;
3122
3123         BT_DBG("%s", hdev->name);
3124
3125         hci_dev_lock(hdev);
3126
3127         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3128         if (!conn)
3129                 goto unlock;
3130
3131         conn->remote_cap = ev->capability;
3132         conn->remote_auth = ev->authentication;
3133         if (ev->oob_data)
3134                 set_bit(HCI_CONN_REMOTE_OOB, &conn->flags);
3135
3136 unlock:
3137         hci_dev_unlock(hdev);
3138 }
3139
3140 static void hci_user_confirm_request_evt(struct hci_dev *hdev,
3141                                          struct sk_buff *skb)
3142 {
3143         struct hci_ev_user_confirm_req *ev = (void *) skb->data;
3144         int loc_mitm, rem_mitm, confirm_hint = 0;
3145         struct hci_conn *conn;
3146
3147         BT_DBG("%s", hdev->name);
3148
3149         hci_dev_lock(hdev);
3150
3151         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3152                 goto unlock;
3153
3154         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3155         if (!conn)
3156                 goto unlock;
3157
3158         loc_mitm = (conn->auth_type & 0x01);
3159         rem_mitm = (conn->remote_auth & 0x01);
3160
3161         /* If we require MITM but the remote device can't provide that
3162          * (it has NoInputNoOutput) then reject the confirmation
3163          * request. The only exception is when we're dedicated bonding
3164          * initiators (connect_cfm_cb set) since then we always have the MITM
3165          * bit set. */
3166         if (!conn->connect_cfm_cb && loc_mitm &&
3167             conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
3168                 BT_DBG("Rejecting request: remote device can't provide MITM");
3169                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
3170                              sizeof(ev->bdaddr), &ev->bdaddr);
3171                 goto unlock;
3172         }
3173
3174         /* If no side requires MITM protection; auto-accept */
3175         if ((!loc_mitm || conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) &&
3176             (!rem_mitm || conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)) {
3177
3178                 /* If we're not the initiators request authorization to
3179                  * proceed from user space (mgmt_user_confirm with
3180                  * confirm_hint set to 1). */
3181                 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
3182                         BT_DBG("Confirming auto-accept as acceptor");
3183                         confirm_hint = 1;
3184                         goto confirm;
3185                 }
3186
3187                 BT_DBG("Auto-accept of user confirmation with %ums delay",
3188                        hdev->auto_accept_delay);
3189
3190                 if (hdev->auto_accept_delay > 0) {
3191                         int delay = msecs_to_jiffies(hdev->auto_accept_delay);
3192                         queue_delayed_work(conn->hdev->workqueue,
3193                                            &conn->auto_accept_work, delay);
3194                         goto unlock;
3195                 }
3196
3197                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
3198                              sizeof(ev->bdaddr), &ev->bdaddr);
3199                 goto unlock;
3200         }
3201
3202 confirm:
3203         mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0, ev->passkey,
3204                                   confirm_hint);
3205
3206 unlock:
3207         hci_dev_unlock(hdev);
3208 }
3209
3210 static void hci_user_passkey_request_evt(struct hci_dev *hdev,
3211                                          struct sk_buff *skb)
3212 {
3213         struct hci_ev_user_passkey_req *ev = (void *) skb->data;
3214
3215         BT_DBG("%s", hdev->name);
3216
3217         if (test_bit(HCI_MGMT, &hdev->dev_flags))
3218                 mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
3219 }
3220
3221 static void hci_user_passkey_notify_evt(struct hci_dev *hdev,
3222                                         struct sk_buff *skb)
3223 {
3224         struct hci_ev_user_passkey_notify *ev = (void *) skb->data;
3225         struct hci_conn *conn;
3226
3227         BT_DBG("%s", hdev->name);
3228
3229         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3230         if (!conn)
3231                 return;
3232
3233         conn->passkey_notify = __le32_to_cpu(ev->passkey);
3234         conn->passkey_entered = 0;
3235
3236         if (test_bit(HCI_MGMT, &hdev->dev_flags))
3237                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
3238                                          conn->dst_type, conn->passkey_notify,
3239                                          conn->passkey_entered);
3240 }
3241
3242 static void hci_keypress_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
3243 {
3244         struct hci_ev_keypress_notify *ev = (void *) skb->data;
3245         struct hci_conn *conn;
3246
3247         BT_DBG("%s", hdev->name);
3248
3249         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3250         if (!conn)
3251                 return;
3252
3253         switch (ev->type) {
3254         case HCI_KEYPRESS_STARTED:
3255                 conn->passkey_entered = 0;
3256                 return;
3257
3258         case HCI_KEYPRESS_ENTERED:
3259                 conn->passkey_entered++;
3260                 break;
3261
3262         case HCI_KEYPRESS_ERASED:
3263                 conn->passkey_entered--;
3264                 break;
3265
3266         case HCI_KEYPRESS_CLEARED:
3267                 conn->passkey_entered = 0;
3268                 break;
3269
3270         case HCI_KEYPRESS_COMPLETED:
3271                 return;
3272         }
3273
3274         if (test_bit(HCI_MGMT, &hdev->dev_flags))
3275                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
3276                                          conn->dst_type, conn->passkey_notify,
3277                                          conn->passkey_entered);
3278 }
3279
3280 static void hci_simple_pair_complete_evt(struct hci_dev *hdev,
3281                                          struct sk_buff *skb)
3282 {
3283         struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
3284         struct hci_conn *conn;
3285
3286         BT_DBG("%s", hdev->name);
3287
3288         hci_dev_lock(hdev);
3289
3290         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3291         if (!conn)
3292                 goto unlock;
3293
3294         /* To avoid duplicate auth_failed events to user space we check
3295          * the HCI_CONN_AUTH_PEND flag which will be set if we
3296          * initiated the authentication. A traditional auth_complete
3297          * event gets always produced as initiator and is also mapped to
3298          * the mgmt_auth_failed event */
3299         if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status)
3300                 mgmt_auth_failed(hdev, &conn->dst, conn->type, conn->dst_type,
3301                                  ev->status);
3302
3303         hci_conn_drop(conn);
3304
3305 unlock:
3306         hci_dev_unlock(hdev);
3307 }
3308
3309 static void hci_remote_host_features_evt(struct hci_dev *hdev,
3310                                          struct sk_buff *skb)
3311 {
3312         struct hci_ev_remote_host_features *ev = (void *) skb->data;
3313         struct inquiry_entry *ie;
3314         struct hci_conn *conn;
3315
3316         BT_DBG("%s", hdev->name);
3317
3318         hci_dev_lock(hdev);
3319
3320         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3321         if (conn)
3322                 memcpy(conn->features[1], ev->features, 8);
3323
3324         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
3325         if (ie)
3326                 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
3327
3328         hci_dev_unlock(hdev);
3329 }
3330
3331 static void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
3332                                             struct sk_buff *skb)
3333 {
3334         struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
3335         struct oob_data *data;
3336
3337         BT_DBG("%s", hdev->name);
3338
3339         hci_dev_lock(hdev);
3340
3341         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3342                 goto unlock;
3343
3344         data = hci_find_remote_oob_data(hdev, &ev->bdaddr);
3345         if (data) {
3346                 struct hci_cp_remote_oob_data_reply cp;
3347
3348                 bacpy(&cp.bdaddr, &ev->bdaddr);
3349                 memcpy(cp.hash, data->hash, sizeof(cp.hash));
3350                 memcpy(cp.randomizer, data->randomizer, sizeof(cp.randomizer));
3351
3352                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY, sizeof(cp),
3353                              &cp);
3354         } else {
3355                 struct hci_cp_remote_oob_data_neg_reply cp;
3356
3357                 bacpy(&cp.bdaddr, &ev->bdaddr);
3358                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY, sizeof(cp),
3359                              &cp);
3360         }
3361
3362 unlock:
3363         hci_dev_unlock(hdev);
3364 }
3365
3366 static void hci_phy_link_complete_evt(struct hci_dev *hdev,
3367                                       struct sk_buff *skb)
3368 {
3369         struct hci_ev_phy_link_complete *ev = (void *) skb->data;
3370         struct hci_conn *hcon, *bredr_hcon;
3371
3372         BT_DBG("%s handle 0x%2.2x status 0x%2.2x", hdev->name, ev->phy_handle,
3373                ev->status);
3374
3375         hci_dev_lock(hdev);
3376
3377         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
3378         if (!hcon) {
3379                 hci_dev_unlock(hdev);
3380                 return;
3381         }
3382
3383         if (ev->status) {
3384                 hci_conn_del(hcon);
3385                 hci_dev_unlock(hdev);
3386                 return;
3387         }
3388
3389         bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
3390
3391         hcon->state = BT_CONNECTED;
3392         bacpy(&hcon->dst, &bredr_hcon->dst);
3393
3394         hci_conn_hold(hcon);
3395         hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
3396         hci_conn_drop(hcon);
3397
3398         hci_conn_add_sysfs(hcon);
3399
3400         amp_physical_cfm(bredr_hcon, hcon);
3401
3402         hci_dev_unlock(hdev);
3403 }
3404
3405 static void hci_loglink_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
3406 {
3407         struct hci_ev_logical_link_complete *ev = (void *) skb->data;
3408         struct hci_conn *hcon;
3409         struct hci_chan *hchan;
3410         struct amp_mgr *mgr;
3411
3412         BT_DBG("%s log_handle 0x%4.4x phy_handle 0x%2.2x status 0x%2.2x",
3413                hdev->name, le16_to_cpu(ev->handle), ev->phy_handle,
3414                ev->status);
3415
3416         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
3417         if (!hcon)
3418                 return;
3419
3420         /* Create AMP hchan */
3421         hchan = hci_chan_create(hcon);
3422         if (!hchan)
3423                 return;
3424
3425         hchan->handle = le16_to_cpu(ev->handle);
3426
3427         BT_DBG("hcon %p mgr %p hchan %p", hcon, hcon->amp_mgr, hchan);
3428
3429         mgr = hcon->amp_mgr;
3430         if (mgr && mgr->bredr_chan) {
3431                 struct l2cap_chan *bredr_chan = mgr->bredr_chan;
3432
3433                 l2cap_chan_lock(bredr_chan);
3434
3435                 bredr_chan->conn->mtu = hdev->block_mtu;
3436                 l2cap_logical_cfm(bredr_chan, hchan, 0);
3437                 hci_conn_hold(hcon);
3438
3439                 l2cap_chan_unlock(bredr_chan);
3440         }
3441 }
3442
3443 static void hci_disconn_loglink_complete_evt(struct hci_dev *hdev,
3444                                              struct sk_buff *skb)
3445 {
3446         struct hci_ev_disconn_logical_link_complete *ev = (void *) skb->data;
3447         struct hci_chan *hchan;
3448
3449         BT_DBG("%s log handle 0x%4.4x status 0x%2.2x", hdev->name,
3450                le16_to_cpu(ev->handle), ev->status);
3451
3452         if (ev->status)
3453                 return;
3454
3455         hci_dev_lock(hdev);
3456
3457         hchan = hci_chan_lookup_handle(hdev, le16_to_cpu(ev->handle));
3458         if (!hchan)
3459                 goto unlock;
3460
3461         amp_destroy_logical_link(hchan, ev->reason);
3462
3463 unlock:
3464         hci_dev_unlock(hdev);
3465 }
3466
3467 static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev,
3468                                              struct sk_buff *skb)
3469 {
3470         struct hci_ev_disconn_phy_link_complete *ev = (void *) skb->data;
3471         struct hci_conn *hcon;
3472
3473         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3474
3475         if (ev->status)
3476                 return;
3477
3478         hci_dev_lock(hdev);
3479
3480         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
3481         if (hcon) {
3482                 hcon->state = BT_CLOSED;
3483                 hci_conn_del(hcon);
3484         }
3485
3486         hci_dev_unlock(hdev);
3487 }
3488
3489 static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
3490 {
3491         struct hci_ev_le_conn_complete *ev = (void *) skb->data;
3492         struct hci_conn *conn;
3493
3494         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3495
3496         hci_dev_lock(hdev);
3497
3498         conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
3499         if (!conn) {
3500                 conn = hci_conn_add(hdev, LE_LINK, &ev->bdaddr);
3501                 if (!conn) {
3502                         BT_ERR("No memory for new connection");
3503                         goto unlock;
3504                 }
3505
3506                 conn->dst_type = ev->bdaddr_type;
3507
3508                 /* The advertising parameters for own address type
3509                  * define which source address and source address
3510                  * type this connections has.
3511                  */
3512                 if (bacmp(&conn->src, BDADDR_ANY)) {
3513                         conn->src_type = ADDR_LE_DEV_PUBLIC;
3514                 } else {
3515                         bacpy(&conn->src, &hdev->static_addr);
3516                         conn->src_type = ADDR_LE_DEV_RANDOM;
3517                 }
3518
3519                 if (ev->role == LE_CONN_ROLE_MASTER) {
3520                         conn->out = true;
3521                         conn->link_mode |= HCI_LM_MASTER;
3522                 }
3523         }
3524
3525         if (ev->status) {
3526                 mgmt_connect_failed(hdev, &conn->dst, conn->type,
3527                                     conn->dst_type, ev->status);
3528                 hci_proto_connect_cfm(conn, ev->status);
3529                 conn->state = BT_CLOSED;
3530                 hci_conn_del(conn);
3531                 goto unlock;
3532         }
3533
3534         if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
3535                 mgmt_device_connected(hdev, &ev->bdaddr, conn->type,
3536                                       conn->dst_type, 0, NULL, 0, NULL);
3537
3538         conn->sec_level = BT_SECURITY_LOW;
3539         conn->handle = __le16_to_cpu(ev->handle);
3540         conn->state = BT_CONNECTED;
3541
3542         hci_conn_add_sysfs(conn);
3543
3544         hci_proto_connect_cfm(conn, ev->status);
3545
3546 unlock:
3547         hci_dev_unlock(hdev);
3548 }
3549
3550 static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
3551 {
3552         u8 num_reports = skb->data[0];
3553         void *ptr = &skb->data[1];
3554         s8 rssi;
3555
3556         while (num_reports--) {
3557                 struct hci_ev_le_advertising_info *ev = ptr;
3558
3559                 rssi = ev->data[ev->length];
3560                 mgmt_device_found(hdev, &ev->bdaddr, LE_LINK, ev->bdaddr_type,
3561                                   NULL, rssi, 0, 1, ev->data, ev->length);
3562
3563                 ptr += sizeof(*ev) + ev->length + 1;
3564         }
3565 }
3566
3567 static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3568 {
3569         struct hci_ev_le_ltk_req *ev = (void *) skb->data;
3570         struct hci_cp_le_ltk_reply cp;
3571         struct hci_cp_le_ltk_neg_reply neg;
3572         struct hci_conn *conn;
3573         struct smp_ltk *ltk;
3574
3575         BT_DBG("%s handle 0x%4.4x", hdev->name, __le16_to_cpu(ev->handle));
3576
3577         hci_dev_lock(hdev);
3578
3579         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3580         if (conn == NULL)
3581                 goto not_found;
3582
3583         ltk = hci_find_ltk(hdev, ev->ediv, ev->random);
3584         if (ltk == NULL)
3585                 goto not_found;
3586
3587         memcpy(cp.ltk, ltk->val, sizeof(ltk->val));
3588         cp.handle = cpu_to_le16(conn->handle);
3589
3590         if (ltk->authenticated)
3591                 conn->pending_sec_level = BT_SECURITY_HIGH;
3592         else
3593                 conn->pending_sec_level = BT_SECURITY_MEDIUM;
3594
3595         conn->enc_key_size = ltk->enc_size;
3596
3597         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
3598
3599         if (ltk->type & HCI_SMP_STK) {
3600                 list_del(&ltk->list);
3601                 kfree(ltk);
3602         }
3603
3604         hci_dev_unlock(hdev);
3605
3606         return;
3607
3608 not_found:
3609         neg.handle = ev->handle;
3610         hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
3611         hci_dev_unlock(hdev);
3612 }
3613
3614 static void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
3615 {
3616         struct hci_ev_le_meta *le_ev = (void *) skb->data;
3617
3618         skb_pull(skb, sizeof(*le_ev));
3619
3620         switch (le_ev->subevent) {
3621         case HCI_EV_LE_CONN_COMPLETE:
3622                 hci_le_conn_complete_evt(hdev, skb);
3623                 break;
3624
3625         case HCI_EV_LE_ADVERTISING_REPORT:
3626                 hci_le_adv_report_evt(hdev, skb);
3627                 break;
3628
3629         case HCI_EV_LE_LTK_REQ:
3630                 hci_le_ltk_request_evt(hdev, skb);
3631                 break;
3632
3633         default:
3634                 break;
3635         }
3636 }
3637
3638 static void hci_chan_selected_evt(struct hci_dev *hdev, struct sk_buff *skb)
3639 {
3640         struct hci_ev_channel_selected *ev = (void *) skb->data;
3641         struct hci_conn *hcon;
3642
3643         BT_DBG("%s handle 0x%2.2x", hdev->name, ev->phy_handle);
3644
3645         skb_pull(skb, sizeof(*ev));
3646
3647         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
3648         if (!hcon)
3649                 return;
3650
3651         amp_read_loc_assoc_final_data(hdev, hcon);
3652 }
3653
3654 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
3655 {
3656         struct hci_event_hdr *hdr = (void *) skb->data;
3657         __u8 event = hdr->evt;
3658
3659         hci_dev_lock(hdev);
3660
3661         /* Received events are (currently) only needed when a request is
3662          * ongoing so avoid unnecessary memory allocation.
3663          */
3664         if (hdev->req_status == HCI_REQ_PEND) {
3665                 kfree_skb(hdev->recv_evt);
3666                 hdev->recv_evt = skb_clone(skb, GFP_KERNEL);
3667         }
3668
3669         hci_dev_unlock(hdev);
3670
3671         skb_pull(skb, HCI_EVENT_HDR_SIZE);
3672
3673         if (hdev->sent_cmd && bt_cb(hdev->sent_cmd)->req.event == event) {
3674                 struct hci_command_hdr *cmd_hdr = (void *) hdev->sent_cmd->data;
3675                 u16 opcode = __le16_to_cpu(cmd_hdr->opcode);
3676
3677                 hci_req_cmd_complete(hdev, opcode, 0);
3678         }
3679
3680         switch (event) {
3681         case HCI_EV_INQUIRY_COMPLETE:
3682                 hci_inquiry_complete_evt(hdev, skb);
3683                 break;
3684
3685         case HCI_EV_INQUIRY_RESULT:
3686                 hci_inquiry_result_evt(hdev, skb);
3687                 break;
3688
3689         case HCI_EV_CONN_COMPLETE:
3690                 hci_conn_complete_evt(hdev, skb);
3691                 break;
3692
3693         case HCI_EV_CONN_REQUEST:
3694                 hci_conn_request_evt(hdev, skb);
3695                 break;
3696
3697         case HCI_EV_DISCONN_COMPLETE:
3698                 hci_disconn_complete_evt(hdev, skb);
3699                 break;
3700
3701         case HCI_EV_AUTH_COMPLETE:
3702                 hci_auth_complete_evt(hdev, skb);
3703                 break;
3704
3705         case HCI_EV_REMOTE_NAME:
3706                 hci_remote_name_evt(hdev, skb);
3707                 break;
3708
3709         case HCI_EV_ENCRYPT_CHANGE:
3710                 hci_encrypt_change_evt(hdev, skb);
3711                 break;
3712
3713         case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
3714                 hci_change_link_key_complete_evt(hdev, skb);
3715                 break;
3716
3717         case HCI_EV_REMOTE_FEATURES:
3718                 hci_remote_features_evt(hdev, skb);
3719                 break;
3720
3721         case HCI_EV_CMD_COMPLETE:
3722                 hci_cmd_complete_evt(hdev, skb);
3723                 break;
3724
3725         case HCI_EV_CMD_STATUS:
3726                 hci_cmd_status_evt(hdev, skb);
3727                 break;
3728
3729         case HCI_EV_ROLE_CHANGE:
3730                 hci_role_change_evt(hdev, skb);
3731                 break;
3732
3733         case HCI_EV_NUM_COMP_PKTS:
3734                 hci_num_comp_pkts_evt(hdev, skb);
3735                 break;
3736
3737         case HCI_EV_MODE_CHANGE:
3738                 hci_mode_change_evt(hdev, skb);
3739                 break;
3740
3741         case HCI_EV_PIN_CODE_REQ:
3742                 hci_pin_code_request_evt(hdev, skb);
3743                 break;
3744
3745         case HCI_EV_LINK_KEY_REQ:
3746                 hci_link_key_request_evt(hdev, skb);
3747                 break;
3748
3749         case HCI_EV_LINK_KEY_NOTIFY:
3750                 hci_link_key_notify_evt(hdev, skb);
3751                 break;
3752
3753         case HCI_EV_CLOCK_OFFSET:
3754                 hci_clock_offset_evt(hdev, skb);
3755                 break;
3756
3757         case HCI_EV_PKT_TYPE_CHANGE:
3758                 hci_pkt_type_change_evt(hdev, skb);
3759                 break;
3760
3761         case HCI_EV_PSCAN_REP_MODE:
3762                 hci_pscan_rep_mode_evt(hdev, skb);
3763                 break;
3764
3765         case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
3766                 hci_inquiry_result_with_rssi_evt(hdev, skb);
3767                 break;
3768
3769         case HCI_EV_REMOTE_EXT_FEATURES:
3770                 hci_remote_ext_features_evt(hdev, skb);
3771                 break;
3772
3773         case HCI_EV_SYNC_CONN_COMPLETE:
3774                 hci_sync_conn_complete_evt(hdev, skb);
3775                 break;
3776
3777         case HCI_EV_EXTENDED_INQUIRY_RESULT:
3778                 hci_extended_inquiry_result_evt(hdev, skb);
3779                 break;
3780
3781         case HCI_EV_KEY_REFRESH_COMPLETE:
3782                 hci_key_refresh_complete_evt(hdev, skb);
3783                 break;
3784
3785         case HCI_EV_IO_CAPA_REQUEST:
3786                 hci_io_capa_request_evt(hdev, skb);
3787                 break;
3788
3789         case HCI_EV_IO_CAPA_REPLY:
3790                 hci_io_capa_reply_evt(hdev, skb);
3791                 break;
3792
3793         case HCI_EV_USER_CONFIRM_REQUEST:
3794                 hci_user_confirm_request_evt(hdev, skb);
3795                 break;
3796
3797         case HCI_EV_USER_PASSKEY_REQUEST:
3798                 hci_user_passkey_request_evt(hdev, skb);
3799                 break;
3800
3801         case HCI_EV_USER_PASSKEY_NOTIFY:
3802                 hci_user_passkey_notify_evt(hdev, skb);
3803                 break;
3804
3805         case HCI_EV_KEYPRESS_NOTIFY:
3806                 hci_keypress_notify_evt(hdev, skb);
3807                 break;
3808
3809         case HCI_EV_SIMPLE_PAIR_COMPLETE:
3810                 hci_simple_pair_complete_evt(hdev, skb);
3811                 break;
3812
3813         case HCI_EV_REMOTE_HOST_FEATURES:
3814                 hci_remote_host_features_evt(hdev, skb);
3815                 break;
3816
3817         case HCI_EV_LE_META:
3818                 hci_le_meta_evt(hdev, skb);
3819                 break;
3820
3821         case HCI_EV_CHANNEL_SELECTED:
3822                 hci_chan_selected_evt(hdev, skb);
3823                 break;
3824
3825         case HCI_EV_REMOTE_OOB_DATA_REQUEST:
3826                 hci_remote_oob_data_request_evt(hdev, skb);
3827                 break;
3828
3829         case HCI_EV_PHY_LINK_COMPLETE:
3830                 hci_phy_link_complete_evt(hdev, skb);
3831                 break;
3832
3833         case HCI_EV_LOGICAL_LINK_COMPLETE:
3834                 hci_loglink_complete_evt(hdev, skb);
3835                 break;
3836
3837         case HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE:
3838                 hci_disconn_loglink_complete_evt(hdev, skb);
3839                 break;
3840
3841         case HCI_EV_DISCONN_PHY_LINK_COMPLETE:
3842                 hci_disconn_phylink_complete_evt(hdev, skb);
3843                 break;
3844
3845         case HCI_EV_NUM_COMP_BLOCKS:
3846                 hci_num_comp_blocks_evt(hdev, skb);
3847                 break;
3848
3849         default:
3850                 BT_DBG("%s event 0x%2.2x", hdev->name, event);
3851                 break;
3852         }
3853
3854         kfree_skb(skb);
3855         hdev->stat.evt_rx++;
3856 }