net/bluetooth/hci_event.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI event handling. */
  26
  27 #include <asm/unaligned.h>
  28
  29 #include <net/bluetooth/bluetooth.h>
  30 #include <net/bluetooth/hci_core.h>
  31 #include <net/bluetooth/mgmt.h>
  32
  33 #include "a2mp.h"
  34 #include "amp.h"
  35
  36 /* Handle HCI Event packets */
  37
  38 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
  39 {
  40         __u8 status = *((__u8 *) skb->data);
  41
  42         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  43
  44         if (status)
  45                 return;
  46
  47         clear_bit(HCI_INQUIRY, &hdev->flags);
  48         smp_mb__after_clear_bit(); /* wake_up_bit advises about this barrier */
  49         wake_up_bit(&hdev->flags, HCI_INQUIRY);
  50
  51         hci_conn_check_pending(hdev);
  52 }
  53
  54 static void hci_cc_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  55 {
  56         __u8 status = *((__u8 *) skb->data);
  57
  58         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  59
  60         if (status)
  61                 return;
  62
  63         set_bit(HCI_PERIODIC_INQ, &hdev->dev_flags);
  64 }
  65
  66 static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  67 {
  68         __u8 status = *((__u8 *) skb->data);
  69
  70         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  71
  72         if (status)
  73                 return;
  74
  75         clear_bit(HCI_PERIODIC_INQ, &hdev->dev_flags);
  76
  77         hci_conn_check_pending(hdev);
  78 }
  79
  80 static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev,
  81                                           struct sk_buff *skb)
  82 {
  83         BT_DBG("%s", hdev->name);
  84 }
  85
  86 static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
  87 {
  88         struct hci_rp_role_discovery *rp = (void *) skb->data;
  89         struct hci_conn *conn;
  90
  91         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
  92
  93         if (rp->status)
  94                 return;
  95
  96         hci_dev_lock(hdev);
  97
  98         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
  99         if (conn) {
 100                 if (rp->role)
 101                         conn->link_mode &= ~HCI_LM_MASTER;
 102                 else
 103                         conn->link_mode |= HCI_LM_MASTER;
 104         }
 105
 106         hci_dev_unlock(hdev);
 107 }
 108
 109 static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 110 {
 111         struct hci_rp_read_link_policy *rp = (void *) skb->data;
 112         struct hci_conn *conn;
 113
 114         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 115
 116         if (rp->status)
 117                 return;
 118
 119         hci_dev_lock(hdev);
 120
 121         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 122         if (conn)
 123                 conn->link_policy = __le16_to_cpu(rp->policy);
 124
 125         hci_dev_unlock(hdev);
 126 }
 127
 128 static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 129 {
 130         struct hci_rp_write_link_policy *rp = (void *) skb->data;
 131         struct hci_conn *conn;
 132         void *sent;
 133
 134         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 135
 136         if (rp->status)
 137                 return;
 138
 139         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
 140         if (!sent)
 141                 return;
 142
 143         hci_dev_lock(hdev);
 144
 145         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 146         if (conn)
 147                 conn->link_policy = get_unaligned_le16(sent + 2);
 148
 149         hci_dev_unlock(hdev);
 150 }
 151
 152 static void hci_cc_read_def_link_policy(struct hci_dev *hdev,
 153                                         struct sk_buff *skb)
 154 {
 155         struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
 156
 157         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 158
 159         if (rp->status)
 160                 return;
 161
 162         hdev->link_policy = __le16_to_cpu(rp->policy);
 163 }
 164
 165 static void hci_cc_write_def_link_policy(struct hci_dev *hdev,
 166                                          struct sk_buff *skb)
 167 {
 168         __u8 status = *((__u8 *) skb->data);
 169         void *sent;
 170
 171         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 172
 173         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
 174         if (!sent)
 175                 return;
 176
 177         if (!status)
 178                 hdev->link_policy = get_unaligned_le16(sent);
 179 }
 180
 181 static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
 182 {
 183         __u8 status = *((__u8 *) skb->data);
 184
 185         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 186
 187         clear_bit(HCI_RESET, &hdev->flags);
 188
 189         /* Reset all non-persistent flags */
 190         hdev->dev_flags &= ~HCI_PERSISTENT_MASK;
 191
 192         hdev->discovery.state = DISCOVERY_STOPPED;
 193         hdev->inq_tx_power = HCI_TX_POWER_INVALID;
 194         hdev->adv_tx_power = HCI_TX_POWER_INVALID;
 195
 196         memset(hdev->adv_data, 0, sizeof(hdev->adv_data));
 197         hdev->adv_data_len = 0;
 198
 199         memset(hdev->scan_rsp_data, 0, sizeof(hdev->scan_rsp_data));
 200         hdev->scan_rsp_data_len = 0;
 201
 202         hdev->ssp_debug_mode = 0;
 203 }
 204
 205 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 206 {
 207         __u8 status = *((__u8 *) skb->data);
 208         void *sent;
 209
 210         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 211
 212         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
 213         if (!sent)
 214                 return;
 215
 216         hci_dev_lock(hdev);
 217
 218         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 219                 mgmt_set_local_name_complete(hdev, sent, status);
 220         else if (!status)
 221                 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
 222
 223         hci_dev_unlock(hdev);
 224 }
 225
 226 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 227 {
 228         struct hci_rp_read_local_name *rp = (void *) skb->data;
 229
 230         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 231
 232         if (rp->status)
 233                 return;
 234
 235         if (test_bit(HCI_SETUP, &hdev->dev_flags))
 236                 memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
 237 }
 238
 239 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
 240 {
 241         __u8 status = *((__u8 *) skb->data);
 242         void *sent;
 243
 244         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 245
 246         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
 247         if (!sent)
 248                 return;
 249
 250         if (!status) {
 251                 __u8 param = *((__u8 *) sent);
 252
 253                 if (param == AUTH_ENABLED)
 254                         set_bit(HCI_AUTH, &hdev->flags);
 255                 else
 256                         clear_bit(HCI_AUTH, &hdev->flags);
 257         }
 258
 259         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 260                 mgmt_auth_enable_complete(hdev, status);
 261 }
 262
 263 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
 264 {
 265         __u8 status = *((__u8 *) skb->data);
 266         void *sent;
 267
 268         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 269
 270         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
 271         if (!sent)
 272                 return;
 273
 274         if (!status) {
 275                 __u8 param = *((__u8 *) sent);
 276
 277                 if (param)
 278                         set_bit(HCI_ENCRYPT, &hdev->flags);
 279                 else
 280                         clear_bit(HCI_ENCRYPT, &hdev->flags);
 281         }
 282 }
 283
 284 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
 285 {
 286         __u8 param, status = *((__u8 *) skb->data);
 287         int old_pscan, old_iscan;
 288         void *sent;
 289
 290         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 291
 292         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
 293         if (!sent)
 294                 return;
 295
 296         param = *((__u8 *) sent);
 297
 298         hci_dev_lock(hdev);
 299
 300         if (status) {
 301                 mgmt_write_scan_failed(hdev, param, status);
 302                 hdev->discov_timeout = 0;
 303                 goto done;
 304         }
 305
 306         /* We need to ensure that we set this back on if someone changed
 307          * the scan mode through a raw HCI socket.
 308          */
 309         set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
 310
 311         old_pscan = test_and_clear_bit(HCI_PSCAN, &hdev->flags);
 312         old_iscan = test_and_clear_bit(HCI_ISCAN, &hdev->flags);
 313
 314         if (param & SCAN_INQUIRY) {
 315                 set_bit(HCI_ISCAN, &hdev->flags);
 316                 if (!old_iscan)
 317                         mgmt_discoverable(hdev, 1);
 318         } else if (old_iscan)
 319                 mgmt_discoverable(hdev, 0);
 320
 321         if (param & SCAN_PAGE) {
 322                 set_bit(HCI_PSCAN, &hdev->flags);
 323                 if (!old_pscan)
 324                         mgmt_connectable(hdev, 1);
 325         } else if (old_pscan)
 326                 mgmt_connectable(hdev, 0);
 327
 328 done:
 329         hci_dev_unlock(hdev);
 330 }
 331
 332 static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 333 {
 334         struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
 335
 336         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 337
 338         if (rp->status)
 339                 return;
 340
 341         memcpy(hdev->dev_class, rp->dev_class, 3);
 342
 343         BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
 344                hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
 345 }
 346
 347 static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 348 {
 349         __u8 status = *((__u8 *) skb->data);
 350         void *sent;
 351
 352         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 353
 354         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
 355         if (!sent)
 356                 return;
 357
 358         hci_dev_lock(hdev);
 359
 360         if (status == 0)
 361                 memcpy(hdev->dev_class, sent, 3);
 362
 363         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 364                 mgmt_set_class_of_dev_complete(hdev, sent, status);
 365
 366         hci_dev_unlock(hdev);
 367 }
 368
 369 static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 370 {
 371         struct hci_rp_read_voice_setting *rp = (void *) skb->data;
 372         __u16 setting;
 373
 374         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 375
 376         if (rp->status)
 377                 return;
 378
 379         setting = __le16_to_cpu(rp->voice_setting);
 380
 381         if (hdev->voice_setting == setting)
 382                 return;
 383
 384         hdev->voice_setting = setting;
 385
 386         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 387
 388         if (hdev->notify)
 389                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 390 }
 391
 392 static void hci_cc_write_voice_setting(struct hci_dev *hdev,
 393                                        struct sk_buff *skb)
 394 {
 395         __u8 status = *((__u8 *) skb->data);
 396         __u16 setting;
 397         void *sent;
 398
 399         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 400
 401         if (status)
 402                 return;
 403
 404         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
 405         if (!sent)
 406                 return;
 407
 408         setting = get_unaligned_le16(sent);
 409
 410         if (hdev->voice_setting == setting)
 411                 return;
 412
 413         hdev->voice_setting = setting;
 414
 415         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 416
 417         if (hdev->notify)
 418                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 419 }
 420
 421 static void hci_cc_read_num_supported_iac(struct hci_dev *hdev,
 422                                           struct sk_buff *skb)
 423 {
 424         struct hci_rp_read_num_supported_iac *rp = (void *) skb->data;
 425
 426         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 427
 428         if (rp->status)
 429                 return;
 430
 431         hdev->num_iac = rp->num_iac;
 432
 433         BT_DBG("%s num iac %d", hdev->name, hdev->num_iac);
 434 }
 435
 436 static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 437 {
 438         __u8 status = *((__u8 *) skb->data);
 439         struct hci_cp_write_ssp_mode *sent;
 440
 441         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 442
 443         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
 444         if (!sent)
 445                 return;
 446
 447         if (!status) {
 448                 if (sent->mode)
 449                         hdev->features[1][0] |= LMP_HOST_SSP;
 450                 else
 451                         hdev->features[1][0] &= ~LMP_HOST_SSP;
 452         }
 453
 454         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 455                 mgmt_ssp_enable_complete(hdev, sent->mode, status);
 456         else if (!status) {
 457                 if (sent->mode)
 458                         set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
 459                 else
 460                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
 461         }
 462 }
 463
 464 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
 465 {
 466         struct hci_rp_read_local_version *rp = (void *) skb->data;
 467
 468         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 469
 470         if (rp->status)
 471                 return;
 472
 473         if (test_bit(HCI_SETUP, &hdev->dev_flags)) {
 474                 hdev->hci_ver = rp->hci_ver;
 475                 hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
 476                 hdev->lmp_ver = rp->lmp_ver;
 477                 hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
 478                 hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
 479         }
 480 }
 481
 482 static void hci_cc_read_local_commands(struct hci_dev *hdev,
 483                                        struct sk_buff *skb)
 484 {
 485         struct hci_rp_read_local_commands *rp = (void *) skb->data;
 486
 487         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 488
 489         if (!rp->status)
 490                 memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 491 }
 492
 493 static void hci_cc_read_local_features(struct hci_dev *hdev,
 494                                        struct sk_buff *skb)
 495 {
 496         struct hci_rp_read_local_features *rp = (void *) skb->data;
 497
 498         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 499
 500         if (rp->status)
 501                 return;
 502
 503         memcpy(hdev->features, rp->features, 8);
 504
 505         /* Adjust default settings according to features
 506          * supported by device. */
 507
 508         if (hdev->features[0][0] & LMP_3SLOT)
 509                 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 510
 511         if (hdev->features[0][0] & LMP_5SLOT)
 512                 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 513
 514         if (hdev->features[0][1] & LMP_HV2) {
 515                 hdev->pkt_type  |= (HCI_HV2);
 516                 hdev->esco_type |= (ESCO_HV2);
 517         }
 518
 519         if (hdev->features[0][1] & LMP_HV3) {
 520                 hdev->pkt_type  |= (HCI_HV3);
 521                 hdev->esco_type |= (ESCO_HV3);
 522         }
 523
 524         if (lmp_esco_capable(hdev))
 525                 hdev->esco_type |= (ESCO_EV3);
 526
 527         if (hdev->features[0][4] & LMP_EV4)
 528                 hdev->esco_type |= (ESCO_EV4);
 529
 530         if (hdev->features[0][4] & LMP_EV5)
 531                 hdev->esco_type |= (ESCO_EV5);
 532
 533         if (hdev->features[0][5] & LMP_EDR_ESCO_2M)
 534                 hdev->esco_type |= (ESCO_2EV3);
 535
 536         if (hdev->features[0][5] & LMP_EDR_ESCO_3M)
 537                 hdev->esco_type |= (ESCO_3EV3);
 538
 539         if (hdev->features[0][5] & LMP_EDR_3S_ESCO)
 540                 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
 541 }
 542
 543 static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
 544                                            struct sk_buff *skb)
 545 {
 546         struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
 547
 548         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 549
 550         if (rp->status)
 551                 return;
 552
 553         if (hdev->max_page < rp->max_page)
 554                 hdev->max_page = rp->max_page;
 555
 556         if (rp->page < HCI_MAX_PAGES)
 557                 memcpy(hdev->features[rp->page], rp->features, 8);
 558 }
 559
 560 static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
 561                                           struct sk_buff *skb)
 562 {
 563         struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;
 564
 565         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 566
 567         if (!rp->status)
 568                 hdev->flow_ctl_mode = rp->mode;
 569 }
 570
 571 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 572 {
 573         struct hci_rp_read_buffer_size *rp = (void *) skb->data;
 574
 575         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 576
 577         if (rp->status)
 578                 return;
 579
 580         hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
 581         hdev->sco_mtu  = rp->sco_mtu;
 582         hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
 583         hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
 584
 585         if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
 586                 hdev->sco_mtu  = 64;
 587                 hdev->sco_pkts = 8;
 588         }
 589
 590         hdev->acl_cnt = hdev->acl_pkts;
 591         hdev->sco_cnt = hdev->sco_pkts;
 592
 593         BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
 594                hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
 595 }
 596
 597 static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
 598 {
 599         struct hci_rp_read_bd_addr *rp = (void *) skb->data;
 600
 601         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 602
 603         if (!rp->status)
 604                 bacpy(&hdev->bdaddr, &rp->bdaddr);
 605 }
 606
 607 static void hci_cc_read_page_scan_activity(struct hci_dev *hdev,
 608                                            struct sk_buff *skb)
 609 {
 610         struct hci_rp_read_page_scan_activity *rp = (void *) skb->data;
 611
 612         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 613
 614         if (test_bit(HCI_INIT, &hdev->flags) && !rp->status) {
 615                 hdev->page_scan_interval = __le16_to_cpu(rp->interval);
 616                 hdev->page_scan_window = __le16_to_cpu(rp->window);
 617         }
 618 }
 619
 620 static void hci_cc_write_page_scan_activity(struct hci_dev *hdev,
 621                                             struct sk_buff *skb)
 622 {
 623         u8 status = *((u8 *) skb->data);
 624         struct hci_cp_write_page_scan_activity *sent;
 625
 626         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 627
 628         if (status)
 629                 return;
 630
 631         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY);
 632         if (!sent)
 633                 return;
 634
 635         hdev->page_scan_interval = __le16_to_cpu(sent->interval);
 636         hdev->page_scan_window = __le16_to_cpu(sent->window);
 637 }
 638
 639 static void hci_cc_read_page_scan_type(struct hci_dev *hdev,
 640                                            struct sk_buff *skb)
 641 {
 642         struct hci_rp_read_page_scan_type *rp = (void *) skb->data;
 643
 644         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 645
 646         if (test_bit(HCI_INIT, &hdev->flags) && !rp->status)
 647                 hdev->page_scan_type = rp->type;
 648 }
 649
 650 static void hci_cc_write_page_scan_type(struct hci_dev *hdev,
 651                                         struct sk_buff *skb)
 652 {
 653         u8 status = *((u8 *) skb->data);
 654         u8 *type;
 655
 656         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 657
 658         if (status)
 659                 return;
 660
 661         type = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE);
 662         if (type)
 663                 hdev->page_scan_type = *type;
 664 }
 665
 666 static void hci_cc_read_data_block_size(struct hci_dev *hdev,
 667                                         struct sk_buff *skb)
 668 {
 669         struct hci_rp_read_data_block_size *rp = (void *) skb->data;
 670
 671         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 672
 673         if (rp->status)
 674                 return;
 675
 676         hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
 677         hdev->block_len = __le16_to_cpu(rp->block_len);
 678         hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
 679
 680         hdev->block_cnt = hdev->num_blocks;
 681
 682         BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
 683                hdev->block_cnt, hdev->block_len);
 684 }
 685
 686 static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
 687                                        struct sk_buff *skb)
 688 {
 689         struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
 690
 691         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 692
 693         if (rp->status)
 694                 goto a2mp_rsp;
 695
 696         hdev->amp_status = rp->amp_status;
 697         hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
 698         hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
 699         hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
 700         hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
 701         hdev->amp_type = rp->amp_type;
 702         hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
 703         hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
 704         hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
 705         hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
 706
 707 a2mp_rsp:
 708         a2mp_send_getinfo_rsp(hdev);
 709 }
 710
 711 static void hci_cc_read_local_amp_assoc(struct hci_dev *hdev,
 712                                         struct sk_buff *skb)
 713 {
 714         struct hci_rp_read_local_amp_assoc *rp = (void *) skb->data;
 715         struct amp_assoc *assoc = &hdev->loc_assoc;
 716         size_t rem_len, frag_len;
 717
 718         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 719
 720         if (rp->status)
 721                 goto a2mp_rsp;
 722
 723         frag_len = skb->len - sizeof(*rp);
 724         rem_len = __le16_to_cpu(rp->rem_len);
 725
 726         if (rem_len > frag_len) {
 727                 BT_DBG("frag_len %zu rem_len %zu", frag_len, rem_len);
 728
 729                 memcpy(assoc->data + assoc->offset, rp->frag, frag_len);
 730                 assoc->offset += frag_len;
 731
 732                 /* Read other fragments */
 733                 amp_read_loc_assoc_frag(hdev, rp->phy_handle);
 734
 735                 return;
 736         }
 737
 738         memcpy(assoc->data + assoc->offset, rp->frag, rem_len);
 739         assoc->len = assoc->offset + rem_len;
 740         assoc->offset = 0;
 741
 742 a2mp_rsp:
 743         /* Send A2MP Rsp when all fragments are received */
 744         a2mp_send_getampassoc_rsp(hdev, rp->status);
 745         a2mp_send_create_phy_link_req(hdev, rp->status);
 746 }
 747
 748 static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
 749                                          struct sk_buff *skb)
 750 {
 751         struct hci_rp_read_inq_rsp_tx_power *rp = (void *) skb->data;
 752
 753         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 754
 755         if (!rp->status)
 756                 hdev->inq_tx_power = rp->tx_power;
 757 }
 758
 759 static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
 760 {
 761         struct hci_rp_pin_code_reply *rp = (void *) skb->data;
 762         struct hci_cp_pin_code_reply *cp;
 763         struct hci_conn *conn;
 764
 765         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 766
 767         hci_dev_lock(hdev);
 768
 769         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 770                 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
 771
 772         if (rp->status)
 773                 goto unlock;
 774
 775         cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
 776         if (!cp)
 777                 goto unlock;
 778
 779         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 780         if (conn)
 781                 conn->pin_length = cp->pin_len;
 782
 783 unlock:
 784         hci_dev_unlock(hdev);
 785 }
 786
 787 static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
 788 {
 789         struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
 790
 791         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 792
 793         hci_dev_lock(hdev);
 794
 795         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 796                 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
 797                                                  rp->status);
 798
 799         hci_dev_unlock(hdev);
 800 }
 801
 802 static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
 803                                        struct sk_buff *skb)
 804 {
 805         struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
 806
 807         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 808
 809         if (rp->status)
 810                 return;
 811
 812         hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
 813         hdev->le_pkts = rp->le_max_pkt;
 814
 815         hdev->le_cnt = hdev->le_pkts;
 816
 817         BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
 818 }
 819
 820 static void hci_cc_le_read_local_features(struct hci_dev *hdev,
 821                                           struct sk_buff *skb)
 822 {
 823         struct hci_rp_le_read_local_features *rp = (void *) skb->data;
 824
 825         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 826
 827         if (!rp->status)
 828                 memcpy(hdev->le_features, rp->features, 8);
 829 }
 830
 831 static void hci_cc_le_read_adv_tx_power(struct hci_dev *hdev,
 832                                         struct sk_buff *skb)
 833 {
 834         struct hci_rp_le_read_adv_tx_power *rp = (void *) skb->data;
 835
 836         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 837
 838         if (!rp->status)
 839                 hdev->adv_tx_power = rp->tx_power;
 840 }
 841
 842 static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
 843 {
 844         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 845
 846         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 847
 848         hci_dev_lock(hdev);
 849
 850         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 851                 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,
 852                                                  rp->status);
 853
 854         hci_dev_unlock(hdev);
 855 }
 856
 857 static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
 858                                           struct sk_buff *skb)
 859 {
 860         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 861
 862         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 863
 864         hci_dev_lock(hdev);
 865
 866         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 867                 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
 868                                                      ACL_LINK, 0, rp->status);
 869
 870         hci_dev_unlock(hdev);
 871 }
 872
 873 static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
 874 {
 875         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 876
 877         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 878
 879         hci_dev_lock(hdev);
 880
 881         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 882                 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
 883                                                  0, rp->status);
 884
 885         hci_dev_unlock(hdev);
 886 }
 887
 888 static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
 889                                           struct sk_buff *skb)
 890 {
 891         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 892
 893         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 894
 895         hci_dev_lock(hdev);
 896
 897         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 898                 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
 899                                                      ACL_LINK, 0, rp->status);
 900
 901         hci_dev_unlock(hdev);
 902 }
 903
 904 static void hci_cc_read_local_oob_data_reply(struct hci_dev *hdev,
 905                                              struct sk_buff *skb)
 906 {
 907         struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
 908
 909         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 910
 911         hci_dev_lock(hdev);
 912         mgmt_read_local_oob_data_reply_complete(hdev, rp->hash,
 913                                                 rp->randomizer, rp->status);
 914         hci_dev_unlock(hdev);
 915 }
 916
 917 static void hci_cc_le_set_adv_enable(struct hci_dev *hdev, struct sk_buff *skb)
 918 {
 919         __u8 *sent, status = *((__u8 *) skb->data);
 920
 921         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 922
 923         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_ENABLE);
 924         if (!sent)
 925                 return;
 926
 927         hci_dev_lock(hdev);
 928
 929         if (!status) {
 930                 if (*sent)
 931                         set_bit(HCI_ADVERTISING, &hdev->dev_flags);
 932                 else
 933                         clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
 934         }
 935
 936         hci_dev_unlock(hdev);
 937 }
 938
 939 static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
 940                                       struct sk_buff *skb)
 941 {
 942         struct hci_cp_le_set_scan_enable *cp;
 943         __u8 status = *((__u8 *) skb->data);
 944
 945         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 946
 947         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
 948         if (!cp)
 949                 return;
 950
 951         if (status)
 952                 return;
 953
 954         switch (cp->enable) {
 955         case LE_SCAN_ENABLE:
 956                 set_bit(HCI_LE_SCAN, &hdev->dev_flags);
 957                 break;
 958
 959         case LE_SCAN_DISABLE:
 960                 clear_bit(HCI_LE_SCAN, &hdev->dev_flags);
 961                 break;
 962
 963         default:
 964                 BT_ERR("Used reserved LE_Scan_Enable param %d", cp->enable);
 965                 break;
 966         }
 967 }
 968
 969 static void hci_cc_le_read_white_list_size(struct hci_dev *hdev,
 970                                            struct sk_buff *skb)
 971 {
 972         struct hci_rp_le_read_white_list_size *rp = (void *) skb->data;
 973
 974         BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
 975
 976         if (!rp->status)
 977                 hdev->le_white_list_size = rp->size;
 978 }
 979
 980 static void hci_cc_le_read_supported_states(struct hci_dev *hdev,
 981                                             struct sk_buff *skb)
 982 {
 983         struct hci_rp_le_read_supported_states *rp = (void *) skb->data;
 984
 985         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 986
 987         if (!rp->status)
 988                 memcpy(hdev->le_states, rp->le_states, 8);
 989 }
 990
 991 static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
 992                                            struct sk_buff *skb)
 993 {
 994         struct hci_cp_write_le_host_supported *sent;
 995         __u8 status = *((__u8 *) skb->data);
 996
 997         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 998
 999         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
1000         if (!sent)
1001                 return;
1002
1003         if (!status) {
1004                 if (sent->le) {
1005                         hdev->features[1][0] |= LMP_HOST_LE;
1006                         set_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1007                 } else {
1008                         hdev->features[1][0] &= ~LMP_HOST_LE;
1009                         clear_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1010                         clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
1011                 }
1012
1013                 if (sent->simul)
1014                         hdev->features[1][0] |= LMP_HOST_LE_BREDR;
1015                 else
1016                         hdev->features[1][0] &= ~LMP_HOST_LE_BREDR;
1017         }
1018 }
1019
1020 static void hci_cc_write_remote_amp_assoc(struct hci_dev *hdev,
1021                                           struct sk_buff *skb)
1022 {
1023         struct hci_rp_write_remote_amp_assoc *rp = (void *) skb->data;
1024
1025         BT_DBG("%s status 0x%2.2x phy_handle 0x%2.2x",
1026                hdev->name, rp->status, rp->phy_handle);
1027
1028         if (rp->status)
1029                 return;
1030
1031         amp_write_rem_assoc_continue(hdev, rp->phy_handle);
1032 }
1033
1034 static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
1035 {
1036         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1037
1038         if (status) {
1039                 hci_conn_check_pending(hdev);
1040                 return;
1041         }
1042
1043         set_bit(HCI_INQUIRY, &hdev->flags);
1044 }
1045
1046 static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
1047 {
1048         struct hci_cp_create_conn *cp;
1049         struct hci_conn *conn;
1050
1051         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1052
1053         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
1054         if (!cp)
1055                 return;
1056
1057         hci_dev_lock(hdev);
1058
1059         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1060
1061         BT_DBG("%s bdaddr %pMR hcon %p", hdev->name, &cp->bdaddr, conn);
1062
1063         if (status) {
1064                 if (conn && conn->state == BT_CONNECT) {
1065                         if (status != 0x0c || conn->attempt > 2) {
1066                                 conn->state = BT_CLOSED;
1067                                 hci_proto_connect_cfm(conn, status);
1068                                 hci_conn_del(conn);
1069                         } else
1070                                 conn->state = BT_CONNECT2;
1071                 }
1072         } else {
1073                 if (!conn) {
1074                         conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr);
1075                         if (conn) {
1076                                 conn->out = true;
1077                                 conn->link_mode |= HCI_LM_MASTER;
1078                         } else
1079                                 BT_ERR("No memory for new connection");
1080                 }
1081         }
1082
1083         hci_dev_unlock(hdev);
1084 }
1085
1086 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
1087 {
1088         struct hci_cp_add_sco *cp;
1089         struct hci_conn *acl, *sco;
1090         __u16 handle;
1091
1092         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1093
1094         if (!status)
1095                 return;
1096
1097         cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
1098         if (!cp)
1099                 return;
1100
1101         handle = __le16_to_cpu(cp->handle);
1102
1103         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1104
1105         hci_dev_lock(hdev);
1106
1107         acl = hci_conn_hash_lookup_handle(hdev, handle);
1108         if (acl) {
1109                 sco = acl->link;
1110                 if (sco) {
1111                         sco->state = BT_CLOSED;
1112
1113                         hci_proto_connect_cfm(sco, status);
1114                         hci_conn_del(sco);
1115                 }
1116         }
1117
1118         hci_dev_unlock(hdev);
1119 }
1120
1121 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
1122 {
1123         struct hci_cp_auth_requested *cp;
1124         struct hci_conn *conn;
1125
1126         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1127
1128         if (!status)
1129                 return;
1130
1131         cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
1132         if (!cp)
1133                 return;
1134
1135         hci_dev_lock(hdev);
1136
1137         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1138         if (conn) {
1139                 if (conn->state == BT_CONFIG) {
1140                         hci_proto_connect_cfm(conn, status);
1141                         hci_conn_drop(conn);
1142                 }
1143         }
1144
1145         hci_dev_unlock(hdev);
1146 }
1147
1148 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
1149 {
1150         struct hci_cp_set_conn_encrypt *cp;
1151         struct hci_conn *conn;
1152
1153         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1154
1155         if (!status)
1156                 return;
1157
1158         cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
1159         if (!cp)
1160                 return;
1161
1162         hci_dev_lock(hdev);
1163
1164         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1165         if (conn) {
1166                 if (conn->state == BT_CONFIG) {
1167                         hci_proto_connect_cfm(conn, status);
1168                         hci_conn_drop(conn);
1169                 }
1170         }
1171
1172         hci_dev_unlock(hdev);
1173 }
1174
1175 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
1176                                     struct hci_conn *conn)
1177 {
1178         if (conn->state != BT_CONFIG || !conn->out)
1179                 return 0;
1180
1181         if (conn->pending_sec_level == BT_SECURITY_SDP)
1182                 return 0;
1183
1184         /* Only request authentication for SSP connections or non-SSP
1185          * devices with sec_level HIGH or if MITM protection is requested */
1186         if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
1187             conn->pending_sec_level != BT_SECURITY_HIGH)
1188                 return 0;
1189
1190         return 1;
1191 }
1192
1193 static int hci_resolve_name(struct hci_dev *hdev,
1194                                    struct inquiry_entry *e)
1195 {
1196         struct hci_cp_remote_name_req cp;
1197
1198         memset(&cp, 0, sizeof(cp));
1199
1200         bacpy(&cp.bdaddr, &e->data.bdaddr);
1201         cp.pscan_rep_mode = e->data.pscan_rep_mode;
1202         cp.pscan_mode = e->data.pscan_mode;
1203         cp.clock_offset = e->data.clock_offset;
1204
1205         return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1206 }
1207
1208 static bool hci_resolve_next_name(struct hci_dev *hdev)
1209 {
1210         struct discovery_state *discov = &hdev->discovery;
1211         struct inquiry_entry *e;
1212
1213         if (list_empty(&discov->resolve))
1214                 return false;
1215
1216         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
1217         if (!e)
1218                 return false;
1219
1220         if (hci_resolve_name(hdev, e) == 0) {
1221                 e->name_state = NAME_PENDING;
1222                 return true;
1223         }
1224
1225         return false;
1226 }
1227
1228 static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
1229                                    bdaddr_t *bdaddr, u8 *name, u8 name_len)
1230 {
1231         struct discovery_state *discov = &hdev->discovery;
1232         struct inquiry_entry *e;
1233
1234         if (conn && !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
1235                 mgmt_device_connected(hdev, bdaddr, ACL_LINK, 0x00, 0, name,
1236                                       name_len, conn->dev_class);
1237
1238         if (discov->state == DISCOVERY_STOPPED)
1239                 return;
1240
1241         if (discov->state == DISCOVERY_STOPPING)
1242                 goto discov_complete;
1243
1244         if (discov->state != DISCOVERY_RESOLVING)
1245                 return;
1246
1247         e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
1248         /* If the device was not found in a list of found devices names of which
1249          * are pending. there is no need to continue resolving a next name as it
1250          * will be done upon receiving another Remote Name Request Complete
1251          * Event */
1252         if (!e)
1253                 return;
1254
1255         list_del(&e->list);
1256         if (name) {
1257                 e->name_state = NAME_KNOWN;
1258                 mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
1259                                  e->data.rssi, name, name_len);
1260         } else {
1261                 e->name_state = NAME_NOT_KNOWN;
1262         }
1263
1264         if (hci_resolve_next_name(hdev))
1265                 return;
1266
1267 discov_complete:
1268         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1269 }
1270
1271 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
1272 {
1273         struct hci_cp_remote_name_req *cp;
1274         struct hci_conn *conn;
1275
1276         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1277
1278         /* If successful wait for the name req complete event before
1279          * checking for the need to do authentication */
1280         if (!status)
1281                 return;
1282
1283         cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
1284         if (!cp)
1285                 return;
1286
1287         hci_dev_lock(hdev);
1288
1289         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1290
1291         if (test_bit(HCI_MGMT, &hdev->dev_flags))
1292                 hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
1293
1294         if (!conn)
1295                 goto unlock;
1296
1297         if (!hci_outgoing_auth_needed(hdev, conn))
1298                 goto unlock;
1299
1300         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
1301                 struct hci_cp_auth_requested auth_cp;
1302
1303                 auth_cp.handle = __cpu_to_le16(conn->handle);
1304                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
1305                              sizeof(auth_cp), &auth_cp);
1306         }
1307
1308 unlock:
1309         hci_dev_unlock(hdev);
1310 }
1311
1312 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
1313 {
1314         struct hci_cp_read_remote_features *cp;
1315         struct hci_conn *conn;
1316
1317         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1318
1319         if (!status)
1320                 return;
1321
1322         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
1323         if (!cp)
1324                 return;
1325
1326         hci_dev_lock(hdev);
1327
1328         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1329         if (conn) {
1330                 if (conn->state == BT_CONFIG) {
1331                         hci_proto_connect_cfm(conn, status);
1332                         hci_conn_drop(conn);
1333                 }
1334         }
1335
1336         hci_dev_unlock(hdev);
1337 }
1338
1339 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
1340 {
1341         struct hci_cp_read_remote_ext_features *cp;
1342         struct hci_conn *conn;
1343
1344         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1345
1346         if (!status)
1347                 return;
1348
1349         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
1350         if (!cp)
1351                 return;
1352
1353         hci_dev_lock(hdev);
1354
1355         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1356         if (conn) {
1357                 if (conn->state == BT_CONFIG) {
1358                         hci_proto_connect_cfm(conn, status);
1359                         hci_conn_drop(conn);
1360                 }
1361         }
1362
1363         hci_dev_unlock(hdev);
1364 }
1365
1366 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
1367 {
1368         struct hci_cp_setup_sync_conn *cp;
1369         struct hci_conn *acl, *sco;
1370         __u16 handle;
1371
1372         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1373
1374         if (!status)
1375                 return;
1376
1377         cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
1378         if (!cp)
1379                 return;
1380
1381         handle = __le16_to_cpu(cp->handle);
1382
1383         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1384
1385         hci_dev_lock(hdev);
1386
1387         acl = hci_conn_hash_lookup_handle(hdev, handle);
1388         if (acl) {
1389                 sco = acl->link;
1390                 if (sco) {
1391                         sco->state = BT_CLOSED;
1392
1393                         hci_proto_connect_cfm(sco, status);
1394                         hci_conn_del(sco);
1395                 }
1396         }
1397
1398         hci_dev_unlock(hdev);
1399 }
1400
1401 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
1402 {
1403         struct hci_cp_sniff_mode *cp;
1404         struct hci_conn *conn;
1405
1406         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1407
1408         if (!status)
1409                 return;
1410
1411         cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
1412         if (!cp)
1413                 return;
1414
1415         hci_dev_lock(hdev);
1416
1417         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1418         if (conn) {
1419                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1420
1421                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
1422                         hci_sco_setup(conn, status);
1423         }
1424
1425         hci_dev_unlock(hdev);
1426 }
1427
1428 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
1429 {
1430         struct hci_cp_exit_sniff_mode *cp;
1431         struct hci_conn *conn;
1432
1433         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1434
1435         if (!status)
1436                 return;
1437
1438         cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
1439         if (!cp)
1440                 return;
1441
1442         hci_dev_lock(hdev);
1443
1444         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1445         if (conn) {
1446                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1447
1448                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
1449                         hci_sco_setup(conn, status);
1450         }
1451
1452         hci_dev_unlock(hdev);
1453 }
1454
1455 static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
1456 {
1457         struct hci_cp_disconnect *cp;
1458         struct hci_conn *conn;
1459
1460         if (!status)
1461                 return;
1462
1463         cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
1464         if (!cp)
1465                 return;
1466
1467         hci_dev_lock(hdev);
1468
1469         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1470         if (conn)
1471                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
1472                                        conn->dst_type, status);
1473
1474         hci_dev_unlock(hdev);
1475 }
1476
1477 static void hci_cs_create_phylink(struct hci_dev *hdev, u8 status)
1478 {
1479         struct hci_cp_create_phy_link *cp;
1480
1481         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1482
1483         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_PHY_LINK);
1484         if (!cp)
1485                 return;
1486
1487         hci_dev_lock(hdev);
1488
1489         if (status) {
1490                 struct hci_conn *hcon;
1491
1492                 hcon = hci_conn_hash_lookup_handle(hdev, cp->phy_handle);
1493                 if (hcon)
1494                         hci_conn_del(hcon);
1495         } else {
1496                 amp_write_remote_assoc(hdev, cp->phy_handle);
1497         }
1498
1499         hci_dev_unlock(hdev);
1500 }
1501
1502 static void hci_cs_accept_phylink(struct hci_dev *hdev, u8 status)
1503 {
1504         struct hci_cp_accept_phy_link *cp;
1505
1506         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1507
1508         if (status)
1509                 return;
1510
1511         cp = hci_sent_cmd_data(hdev, HCI_OP_ACCEPT_PHY_LINK);
1512         if (!cp)
1513                 return;
1514
1515         amp_write_remote_assoc(hdev, cp->phy_handle);
1516 }
1517
1518 static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1519 {
1520         __u8 status = *((__u8 *) skb->data);
1521         struct discovery_state *discov = &hdev->discovery;
1522         struct inquiry_entry *e;
1523
1524         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1525
1526         hci_conn_check_pending(hdev);
1527
1528         if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
1529                 return;
1530
1531         smp_mb__after_clear_bit(); /* wake_up_bit advises about this barrier */
1532         wake_up_bit(&hdev->flags, HCI_INQUIRY);
1533
1534         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
1535                 return;
1536
1537         hci_dev_lock(hdev);
1538
1539         if (discov->state != DISCOVERY_FINDING)
1540                 goto unlock;
1541
1542         if (list_empty(&discov->resolve)) {
1543                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1544                 goto unlock;
1545         }
1546
1547         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
1548         if (e && hci_resolve_name(hdev, e) == 0) {
1549                 e->name_state = NAME_PENDING;
1550                 hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
1551         } else {
1552                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1553         }
1554
1555 unlock:
1556         hci_dev_unlock(hdev);
1557 }
1558
1559 static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
1560 {
1561         struct inquiry_data data;
1562         struct inquiry_info *info = (void *) (skb->data + 1);
1563         int num_rsp = *((__u8 *) skb->data);
1564
1565         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
1566
1567         if (!num_rsp)
1568                 return;
1569
1570         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
1571                 return;
1572
1573         hci_dev_lock(hdev);
1574
1575         for (; num_rsp; num_rsp--, info++) {
1576                 bool name_known, ssp;
1577
1578                 bacpy(&data.bdaddr, &info->bdaddr);
1579                 data.pscan_rep_mode     = info->pscan_rep_mode;
1580                 data.pscan_period_mode  = info->pscan_period_mode;
1581                 data.pscan_mode         = info->pscan_mode;
1582                 memcpy(data.dev_class, info->dev_class, 3);
1583                 data.clock_offset       = info->clock_offset;
1584                 data.rssi               = 0x00;
1585                 data.ssp_mode           = 0x00;
1586
1587                 name_known = hci_inquiry_cache_update(hdev, &data, false, &ssp);
1588                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
1589                                   info->dev_class, 0, !name_known, ssp, NULL,
1590                                   0);
1591         }
1592
1593         hci_dev_unlock(hdev);
1594 }
1595
1596 static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1597 {
1598         struct hci_ev_conn_complete *ev = (void *) skb->data;
1599         struct hci_conn *conn;
1600
1601         BT_DBG("%s", hdev->name);
1602
1603         hci_dev_lock(hdev);
1604
1605         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
1606         if (!conn) {
1607                 if (ev->link_type != SCO_LINK)
1608                         goto unlock;
1609
1610                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
1611                 if (!conn)
1612                         goto unlock;
1613
1614                 conn->type = SCO_LINK;
1615         }
1616
1617         if (!ev->status) {
1618                 conn->handle = __le16_to_cpu(ev->handle);
1619
1620                 if (conn->type == ACL_LINK) {
1621                         conn->state = BT_CONFIG;
1622                         hci_conn_hold(conn);
1623
1624                         if (!conn->out && !hci_conn_ssp_enabled(conn) &&
1625                             !hci_find_link_key(hdev, &ev->bdaddr))
1626                                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
1627                         else
1628                                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
1629                 } else
1630                         conn->state = BT_CONNECTED;
1631
1632                 hci_conn_add_sysfs(conn);
1633
1634                 if (test_bit(HCI_AUTH, &hdev->flags))
1635                         conn->link_mode |= HCI_LM_AUTH;
1636
1637                 if (test_bit(HCI_ENCRYPT, &hdev->flags))
1638                         conn->link_mode |= HCI_LM_ENCRYPT;
1639
1640                 /* Get remote features */
1641                 if (conn->type == ACL_LINK) {
1642                         struct hci_cp_read_remote_features cp;
1643                         cp.handle = ev->handle;
1644                         hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
1645                                      sizeof(cp), &cp);
1646                 }
1647
1648                 /* Set packet type for incoming connection */
1649                 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
1650                         struct hci_cp_change_conn_ptype cp;
1651                         cp.handle = ev->handle;
1652                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
1653                         hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
1654                                      &cp);
1655                 }
1656         } else {
1657                 conn->state = BT_CLOSED;
1658                 if (conn->type == ACL_LINK)
1659                         mgmt_connect_failed(hdev, &ev->bdaddr, conn->type,
1660                                             conn->dst_type, ev->status);
1661         }
1662
1663         if (conn->type == ACL_LINK)
1664                 hci_sco_setup(conn, ev->status);
1665
1666         if (ev->status) {
1667                 hci_proto_connect_cfm(conn, ev->status);
1668                 hci_conn_del(conn);
1669         } else if (ev->link_type != ACL_LINK)
1670                 hci_proto_connect_cfm(conn, ev->status);
1671
1672 unlock:
1673         hci_dev_unlock(hdev);
1674
1675         hci_conn_check_pending(hdev);
1676 }
1677
1678 static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
1679 {
1680         struct hci_ev_conn_request *ev = (void *) skb->data;
1681         int mask = hdev->link_mode;
1682         __u8 flags = 0;
1683
1684         BT_DBG("%s bdaddr %pMR type 0x%x", hdev->name, &ev->bdaddr,
1685                ev->link_type);
1686
1687         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
1688                                       &flags);
1689
1690         if ((mask & HCI_LM_ACCEPT) &&
1691             !hci_blacklist_lookup(hdev, &ev->bdaddr, BDADDR_BREDR)) {
1692                 /* Connection accepted */
1693                 struct inquiry_entry *ie;
1694                 struct hci_conn *conn;
1695
1696                 hci_dev_lock(hdev);
1697
1698                 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
1699                 if (ie)
1700                         memcpy(ie->data.dev_class, ev->dev_class, 3);
1701
1702                 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
1703                                                &ev->bdaddr);
1704                 if (!conn) {
1705                         conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr);
1706                         if (!conn) {
1707                                 BT_ERR("No memory for new connection");
1708                                 hci_dev_unlock(hdev);
1709                                 return;
1710                         }
1711                 }
1712
1713                 memcpy(conn->dev_class, ev->dev_class, 3);
1714
1715                 hci_dev_unlock(hdev);
1716
1717                 if (ev->link_type == ACL_LINK ||
1718                     (!(flags & HCI_PROTO_DEFER) && !lmp_esco_capable(hdev))) {
1719                         struct hci_cp_accept_conn_req cp;
1720                         conn->state = BT_CONNECT;
1721
1722                         bacpy(&cp.bdaddr, &ev->bdaddr);
1723
1724                         if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
1725                                 cp.role = 0x00; /* Become master */
1726                         else
1727                                 cp.role = 0x01; /* Remain slave */
1728
1729                         hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp),
1730                                      &cp);
1731                 } else if (!(flags & HCI_PROTO_DEFER)) {
1732                         struct hci_cp_accept_sync_conn_req cp;
1733                         conn->state = BT_CONNECT;
1734
1735                         bacpy(&cp.bdaddr, &ev->bdaddr);
1736                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
1737
1738                         cp.tx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
1739                         cp.rx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
1740                         cp.max_latency    = __constant_cpu_to_le16(0xffff);
1741                         cp.content_format = cpu_to_le16(hdev->voice_setting);
1742                         cp.retrans_effort = 0xff;
1743
1744                         hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ,
1745                                      sizeof(cp), &cp);
1746                 } else {
1747                         conn->state = BT_CONNECT2;
1748                         hci_proto_connect_cfm(conn, 0);
1749                 }
1750         } else {
1751                 /* Connection rejected */
1752                 struct hci_cp_reject_conn_req cp;
1753
1754                 bacpy(&cp.bdaddr, &ev->bdaddr);
1755                 cp.reason = HCI_ERROR_REJ_BAD_ADDR;
1756                 hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
1757         }
1758 }
1759
1760 static u8 hci_to_mgmt_reason(u8 err)
1761 {
1762         switch (err) {
1763         case HCI_ERROR_CONNECTION_TIMEOUT:
1764                 return MGMT_DEV_DISCONN_TIMEOUT;
1765         case HCI_ERROR_REMOTE_USER_TERM:
1766         case HCI_ERROR_REMOTE_LOW_RESOURCES:
1767         case HCI_ERROR_REMOTE_POWER_OFF:
1768                 return MGMT_DEV_DISCONN_REMOTE;
1769         case HCI_ERROR_LOCAL_HOST_TERM:
1770                 return MGMT_DEV_DISCONN_LOCAL_HOST;
1771         default:
1772                 return MGMT_DEV_DISCONN_UNKNOWN;
1773         }
1774 }
1775
1776 static void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1777 {
1778         struct hci_ev_disconn_complete *ev = (void *) skb->data;
1779         struct hci_conn *conn;
1780
1781         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
1782
1783         hci_dev_lock(hdev);
1784
1785         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1786         if (!conn)
1787                 goto unlock;
1788
1789         if (ev->status == 0)
1790                 conn->state = BT_CLOSED;
1791
1792         if (test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags) &&
1793             (conn->type == ACL_LINK || conn->type == LE_LINK)) {
1794                 if (ev->status) {
1795                         mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
1796                                                conn->dst_type, ev->status);
1797                 } else {
1798                         u8 reason = hci_to_mgmt_reason(ev->reason);
1799
1800                         mgmt_device_disconnected(hdev, &conn->dst, conn->type,
1801                                                  conn->dst_type, reason);
1802                 }
1803         }
1804
1805         if (ev->status == 0) {
1806                 u8 type = conn->type;
1807
1808                 if (type == ACL_LINK && conn->flush_key)
1809                         hci_remove_link_key(hdev, &conn->dst);
1810                 hci_proto_disconn_cfm(conn, ev->reason);
1811                 hci_conn_del(conn);
1812
1813                 /* Re-enable advertising if necessary, since it might
1814                  * have been disabled by the connection. From the
1815                  * HCI_LE_Set_Advertise_Enable command description in
1816                  * the core specification (v4.0):
1817                  * "The Controller shall continue advertising until the Host
1818                  * issues an LE_Set_Advertise_Enable command with
1819                  * Advertising_Enable set to 0x00 (Advertising is disabled)
1820                  * or until a connection is created or until the Advertising
1821                  * is timed out due to Directed Advertising."
1822                  */
1823                 if (type == LE_LINK)
1824                         mgmt_reenable_advertising(hdev);
1825         }
1826
1827 unlock:
1828         hci_dev_unlock(hdev);
1829 }
1830
1831 static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1832 {
1833         struct hci_ev_auth_complete *ev = (void *) skb->data;
1834         struct hci_conn *conn;
1835
1836         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
1837
1838         hci_dev_lock(hdev);
1839
1840         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1841         if (!conn)
1842                 goto unlock;
1843
1844         if (!ev->status) {
1845                 if (!hci_conn_ssp_enabled(conn) &&
1846                     test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
1847                         BT_INFO("re-auth of legacy device is not possible.");
1848                 } else {
1849                         conn->link_mode |= HCI_LM_AUTH;
1850                         conn->sec_level = conn->pending_sec_level;
1851                 }
1852         } else {
1853                 mgmt_auth_failed(hdev, &conn->dst, conn->type, conn->dst_type,
1854                                  ev->status);
1855         }
1856
1857         clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
1858         clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
1859
1860         if (conn->state == BT_CONFIG) {
1861                 if (!ev->status && hci_conn_ssp_enabled(conn)) {
1862                         struct hci_cp_set_conn_encrypt cp;
1863                         cp.handle  = ev->handle;
1864                         cp.encrypt = 0x01;
1865                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
1866                                      &cp);
1867                 } else {
1868                         conn->state = BT_CONNECTED;
1869                         hci_proto_connect_cfm(conn, ev->status);
1870                         hci_conn_drop(conn);
1871                 }
1872         } else {
1873                 hci_auth_cfm(conn, ev->status);
1874
1875                 hci_conn_hold(conn);
1876                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
1877                 hci_conn_drop(conn);
1878         }
1879
1880         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
1881                 if (!ev->status) {
1882                         struct hci_cp_set_conn_encrypt cp;
1883                         cp.handle  = ev->handle;
1884                         cp.encrypt = 0x01;
1885                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
1886                                      &cp);
1887                 } else {
1888                         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
1889                         hci_encrypt_cfm(conn, ev->status, 0x00);
1890                 }
1891         }
1892
1893 unlock:
1894         hci_dev_unlock(hdev);
1895 }
1896
1897 static void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
1898 {
1899         struct hci_ev_remote_name *ev = (void *) skb->data;
1900         struct hci_conn *conn;
1901
1902         BT_DBG("%s", hdev->name);
1903
1904         hci_conn_check_pending(hdev);
1905
1906         hci_dev_lock(hdev);
1907
1908         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
1909
1910         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
1911                 goto check_auth;
1912
1913         if (ev->status == 0)
1914                 hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
1915                                        strnlen(ev->name, HCI_MAX_NAME_LENGTH));
1916         else
1917                 hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
1918
1919 check_auth:
1920         if (!conn)
1921                 goto unlock;
1922
1923         if (!hci_outgoing_auth_needed(hdev, conn))
1924                 goto unlock;
1925
1926         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
1927                 struct hci_cp_auth_requested cp;
1928                 cp.handle = __cpu_to_le16(conn->handle);
1929                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
1930         }
1931
1932 unlock:
1933         hci_dev_unlock(hdev);
1934 }
1935
1936 static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
1937 {
1938         struct hci_ev_encrypt_change *ev = (void *) skb->data;
1939         struct hci_conn *conn;
1940
1941         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
1942
1943         hci_dev_lock(hdev);
1944
1945         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1946         if (conn) {
1947                 if (!ev->status) {
1948                         if (ev->encrypt) {
1949                                 /* Encryption implies authentication */
1950                                 conn->link_mode |= HCI_LM_AUTH;
1951                                 conn->link_mode |= HCI_LM_ENCRYPT;
1952                                 conn->sec_level = conn->pending_sec_level;
1953                         } else
1954                                 conn->link_mode &= ~HCI_LM_ENCRYPT;
1955                 }
1956
1957                 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
1958
1959                 if (ev->status && conn->state == BT_CONNECTED) {
1960                         hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
1961                         hci_conn_drop(conn);
1962                         goto unlock;
1963                 }
1964
1965                 if (conn->state == BT_CONFIG) {
1966                         if (!ev->status)
1967                                 conn->state = BT_CONNECTED;
1968
1969                         hci_proto_connect_cfm(conn, ev->status);
1970                         hci_conn_drop(conn);
1971                 } else
1972                         hci_encrypt_cfm(conn, ev->status, ev->encrypt);
1973         }
1974
1975 unlock:
1976         hci_dev_unlock(hdev);
1977 }
1978
1979 static void hci_change_link_key_complete_evt(struct hci_dev *hdev,
1980                                              struct sk_buff *skb)
1981 {
1982         struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
1983         struct hci_conn *conn;
1984
1985         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
1986
1987         hci_dev_lock(hdev);
1988
1989         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1990         if (conn) {
1991                 if (!ev->status)
1992                         conn->link_mode |= HCI_LM_SECURE;
1993
1994                 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
1995
1996                 hci_key_change_cfm(conn, ev->status);
1997         }
1998
1999         hci_dev_unlock(hdev);
2000 }
2001
2002 static void hci_remote_features_evt(struct hci_dev *hdev,
2003                                     struct sk_buff *skb)
2004 {
2005         struct hci_ev_remote_features *ev = (void *) skb->data;
2006         struct hci_conn *conn;
2007
2008         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2009
2010         hci_dev_lock(hdev);
2011
2012         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2013         if (!conn)
2014                 goto unlock;
2015
2016         if (!ev->status)
2017                 memcpy(conn->features[0], ev->features, 8);
2018
2019         if (conn->state != BT_CONFIG)
2020                 goto unlock;
2021
2022         if (!ev->status && lmp_ssp_capable(hdev) && lmp_ssp_capable(conn)) {
2023                 struct hci_cp_read_remote_ext_features cp;
2024                 cp.handle = ev->handle;
2025                 cp.page = 0x01;
2026                 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
2027                              sizeof(cp), &cp);
2028                 goto unlock;
2029         }
2030
2031         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
2032                 struct hci_cp_remote_name_req cp;
2033                 memset(&cp, 0, sizeof(cp));
2034                 bacpy(&cp.bdaddr, &conn->dst);
2035                 cp.pscan_rep_mode = 0x02;
2036                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2037         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2038                 mgmt_device_connected(hdev, &conn->dst, conn->type,
2039                                       conn->dst_type, 0, NULL, 0,
2040                                       conn->dev_class);
2041
2042         if (!hci_outgoing_auth_needed(hdev, conn)) {
2043                 conn->state = BT_CONNECTED;
2044                 hci_proto_connect_cfm(conn, ev->status);
2045                 hci_conn_drop(conn);
2046         }
2047
2048 unlock:
2049         hci_dev_unlock(hdev);
2050 }
2051
2052 static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2053 {
2054         struct hci_ev_cmd_complete *ev = (void *) skb->data;
2055         u8 status = skb->data[sizeof(*ev)];
2056         __u16 opcode;
2057
2058         skb_pull(skb, sizeof(*ev));
2059
2060         opcode = __le16_to_cpu(ev->opcode);
2061
2062         switch (opcode) {
2063         case HCI_OP_INQUIRY_CANCEL:
2064                 hci_cc_inquiry_cancel(hdev, skb);
2065                 break;
2066
2067         case HCI_OP_PERIODIC_INQ:
2068                 hci_cc_periodic_inq(hdev, skb);
2069                 break;
2070
2071         case HCI_OP_EXIT_PERIODIC_INQ:
2072                 hci_cc_exit_periodic_inq(hdev, skb);
2073                 break;
2074
2075         case HCI_OP_REMOTE_NAME_REQ_CANCEL:
2076                 hci_cc_remote_name_req_cancel(hdev, skb);
2077                 break;
2078
2079         case HCI_OP_ROLE_DISCOVERY:
2080                 hci_cc_role_discovery(hdev, skb);
2081                 break;
2082
2083         case HCI_OP_READ_LINK_POLICY:
2084                 hci_cc_read_link_policy(hdev, skb);
2085                 break;
2086
2087         case HCI_OP_WRITE_LINK_POLICY:
2088                 hci_cc_write_link_policy(hdev, skb);
2089                 break;
2090
2091         case HCI_OP_READ_DEF_LINK_POLICY:
2092                 hci_cc_read_def_link_policy(hdev, skb);
2093                 break;
2094
2095         case HCI_OP_WRITE_DEF_LINK_POLICY:
2096                 hci_cc_write_def_link_policy(hdev, skb);
2097                 break;
2098
2099         case HCI_OP_RESET:
2100                 hci_cc_reset(hdev, skb);
2101                 break;
2102
2103         case HCI_OP_WRITE_LOCAL_NAME:
2104                 hci_cc_write_local_name(hdev, skb);
2105                 break;
2106
2107         case HCI_OP_READ_LOCAL_NAME:
2108                 hci_cc_read_local_name(hdev, skb);
2109                 break;
2110
2111         case HCI_OP_WRITE_AUTH_ENABLE:
2112                 hci_cc_write_auth_enable(hdev, skb);
2113                 break;
2114
2115         case HCI_OP_WRITE_ENCRYPT_MODE:
2116                 hci_cc_write_encrypt_mode(hdev, skb);
2117                 break;
2118
2119         case HCI_OP_WRITE_SCAN_ENABLE:
2120                 hci_cc_write_scan_enable(hdev, skb);
2121                 break;
2122
2123         case HCI_OP_READ_CLASS_OF_DEV:
2124                 hci_cc_read_class_of_dev(hdev, skb);
2125                 break;
2126
2127         case HCI_OP_WRITE_CLASS_OF_DEV:
2128                 hci_cc_write_class_of_dev(hdev, skb);
2129                 break;
2130
2131         case HCI_OP_READ_VOICE_SETTING:
2132                 hci_cc_read_voice_setting(hdev, skb);
2133                 break;
2134
2135         case HCI_OP_WRITE_VOICE_SETTING:
2136                 hci_cc_write_voice_setting(hdev, skb);
2137                 break;
2138
2139         case HCI_OP_READ_NUM_SUPPORTED_IAC:
2140                 hci_cc_read_num_supported_iac(hdev, skb);
2141                 break;
2142
2143         case HCI_OP_WRITE_SSP_MODE:
2144                 hci_cc_write_ssp_mode(hdev, skb);
2145                 break;
2146
2147         case HCI_OP_READ_LOCAL_VERSION:
2148                 hci_cc_read_local_version(hdev, skb);
2149                 break;
2150
2151         case HCI_OP_READ_LOCAL_COMMANDS:
2152                 hci_cc_read_local_commands(hdev, skb);
2153                 break;
2154
2155         case HCI_OP_READ_LOCAL_FEATURES:
2156                 hci_cc_read_local_features(hdev, skb);
2157                 break;
2158
2159         case HCI_OP_READ_LOCAL_EXT_FEATURES:
2160                 hci_cc_read_local_ext_features(hdev, skb);
2161                 break;
2162
2163         case HCI_OP_READ_BUFFER_SIZE:
2164                 hci_cc_read_buffer_size(hdev, skb);
2165                 break;
2166
2167         case HCI_OP_READ_BD_ADDR:
2168                 hci_cc_read_bd_addr(hdev, skb);
2169                 break;
2170
2171         case HCI_OP_READ_PAGE_SCAN_ACTIVITY:
2172                 hci_cc_read_page_scan_activity(hdev, skb);
2173                 break;
2174
2175         case HCI_OP_WRITE_PAGE_SCAN_ACTIVITY:
2176                 hci_cc_write_page_scan_activity(hdev, skb);
2177                 break;
2178
2179         case HCI_OP_READ_PAGE_SCAN_TYPE:
2180                 hci_cc_read_page_scan_type(hdev, skb);
2181                 break;
2182
2183         case HCI_OP_WRITE_PAGE_SCAN_TYPE:
2184                 hci_cc_write_page_scan_type(hdev, skb);
2185                 break;
2186
2187         case HCI_OP_READ_DATA_BLOCK_SIZE:
2188                 hci_cc_read_data_block_size(hdev, skb);
2189                 break;
2190
2191         case HCI_OP_READ_FLOW_CONTROL_MODE:
2192                 hci_cc_read_flow_control_mode(hdev, skb);
2193                 break;
2194
2195         case HCI_OP_READ_LOCAL_AMP_INFO:
2196                 hci_cc_read_local_amp_info(hdev, skb);
2197                 break;
2198
2199         case HCI_OP_READ_LOCAL_AMP_ASSOC:
2200                 hci_cc_read_local_amp_assoc(hdev, skb);
2201                 break;
2202
2203         case HCI_OP_READ_INQ_RSP_TX_POWER:
2204                 hci_cc_read_inq_rsp_tx_power(hdev, skb);
2205                 break;
2206
2207         case HCI_OP_PIN_CODE_REPLY:
2208                 hci_cc_pin_code_reply(hdev, skb);
2209                 break;
2210
2211         case HCI_OP_PIN_CODE_NEG_REPLY:
2212                 hci_cc_pin_code_neg_reply(hdev, skb);
2213                 break;
2214
2215         case HCI_OP_READ_LOCAL_OOB_DATA:
2216                 hci_cc_read_local_oob_data_reply(hdev, skb);
2217                 break;
2218
2219         case HCI_OP_LE_READ_BUFFER_SIZE:
2220                 hci_cc_le_read_buffer_size(hdev, skb);
2221                 break;
2222
2223         case HCI_OP_LE_READ_LOCAL_FEATURES:
2224                 hci_cc_le_read_local_features(hdev, skb);
2225                 break;
2226
2227         case HCI_OP_LE_READ_ADV_TX_POWER:
2228                 hci_cc_le_read_adv_tx_power(hdev, skb);
2229                 break;
2230
2231         case HCI_OP_USER_CONFIRM_REPLY:
2232                 hci_cc_user_confirm_reply(hdev, skb);
2233                 break;
2234
2235         case HCI_OP_USER_CONFIRM_NEG_REPLY:
2236                 hci_cc_user_confirm_neg_reply(hdev, skb);
2237                 break;
2238
2239         case HCI_OP_USER_PASSKEY_REPLY:
2240                 hci_cc_user_passkey_reply(hdev, skb);
2241                 break;
2242
2243         case HCI_OP_USER_PASSKEY_NEG_REPLY:
2244                 hci_cc_user_passkey_neg_reply(hdev, skb);
2245                 break;
2246
2247         case HCI_OP_LE_SET_ADV_ENABLE:
2248                 hci_cc_le_set_adv_enable(hdev, skb);
2249                 break;
2250
2251         case HCI_OP_LE_SET_SCAN_ENABLE:
2252                 hci_cc_le_set_scan_enable(hdev, skb);
2253                 break;
2254
2255         case HCI_OP_LE_READ_WHITE_LIST_SIZE:
2256                 hci_cc_le_read_white_list_size(hdev, skb);
2257                 break;
2258
2259         case HCI_OP_LE_READ_SUPPORTED_STATES:
2260                 hci_cc_le_read_supported_states(hdev, skb);
2261                 break;
2262
2263         case HCI_OP_WRITE_LE_HOST_SUPPORTED:
2264                 hci_cc_write_le_host_supported(hdev, skb);
2265                 break;
2266
2267         case HCI_OP_WRITE_REMOTE_AMP_ASSOC:
2268                 hci_cc_write_remote_amp_assoc(hdev, skb);
2269                 break;
2270
2271         default:
2272                 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
2273                 break;
2274         }
2275
2276         if (opcode != HCI_OP_NOP)
2277                 del_timer(&hdev->cmd_timer);
2278
2279         hci_req_cmd_complete(hdev, opcode, status);
2280
2281         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
2282                 atomic_set(&hdev->cmd_cnt, 1);
2283                 if (!skb_queue_empty(&hdev->cmd_q))
2284                         queue_work(hdev->workqueue, &hdev->cmd_work);
2285         }
2286 }
2287
2288 static void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb)
2289 {
2290         struct hci_ev_cmd_status *ev = (void *) skb->data;
2291         __u16 opcode;
2292
2293         skb_pull(skb, sizeof(*ev));
2294
2295         opcode = __le16_to_cpu(ev->opcode);
2296
2297         switch (opcode) {
2298         case HCI_OP_INQUIRY:
2299                 hci_cs_inquiry(hdev, ev->status);
2300                 break;
2301
2302         case HCI_OP_CREATE_CONN:
2303                 hci_cs_create_conn(hdev, ev->status);
2304                 break;
2305
2306         case HCI_OP_ADD_SCO:
2307                 hci_cs_add_sco(hdev, ev->status);
2308                 break;
2309
2310         case HCI_OP_AUTH_REQUESTED:
2311                 hci_cs_auth_requested(hdev, ev->status);
2312                 break;
2313
2314         case HCI_OP_SET_CONN_ENCRYPT:
2315                 hci_cs_set_conn_encrypt(hdev, ev->status);
2316                 break;
2317
2318         case HCI_OP_REMOTE_NAME_REQ:
2319                 hci_cs_remote_name_req(hdev, ev->status);
2320                 break;
2321
2322         case HCI_OP_READ_REMOTE_FEATURES:
2323                 hci_cs_read_remote_features(hdev, ev->status);
2324                 break;
2325
2326         case HCI_OP_READ_REMOTE_EXT_FEATURES:
2327                 hci_cs_read_remote_ext_features(hdev, ev->status);
2328                 break;
2329
2330         case HCI_OP_SETUP_SYNC_CONN:
2331                 hci_cs_setup_sync_conn(hdev, ev->status);
2332                 break;
2333
2334         case HCI_OP_SNIFF_MODE:
2335                 hci_cs_sniff_mode(hdev, ev->status);
2336                 break;
2337
2338         case HCI_OP_EXIT_SNIFF_MODE:
2339                 hci_cs_exit_sniff_mode(hdev, ev->status);
2340                 break;
2341
2342         case HCI_OP_DISCONNECT:
2343                 hci_cs_disconnect(hdev, ev->status);
2344                 break;
2345
2346         case HCI_OP_CREATE_PHY_LINK:
2347                 hci_cs_create_phylink(hdev, ev->status);
2348                 break;
2349
2350         case HCI_OP_ACCEPT_PHY_LINK:
2351                 hci_cs_accept_phylink(hdev, ev->status);
2352                 break;
2353
2354         default:
2355                 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
2356                 break;
2357         }
2358
2359         if (opcode != HCI_OP_NOP)
2360                 del_timer(&hdev->cmd_timer);
2361
2362         if (ev->status ||
2363             (hdev->sent_cmd && !bt_cb(hdev->sent_cmd)->req.event))
2364                 hci_req_cmd_complete(hdev, opcode, ev->status);
2365
2366         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
2367                 atomic_set(&hdev->cmd_cnt, 1);
2368                 if (!skb_queue_empty(&hdev->cmd_q))
2369                         queue_work(hdev->workqueue, &hdev->cmd_work);
2370         }
2371 }
2372
2373 static void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2374 {
2375         struct hci_ev_role_change *ev = (void *) skb->data;
2376         struct hci_conn *conn;
2377
2378         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2379
2380         hci_dev_lock(hdev);
2381
2382         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2383         if (conn) {
2384                 if (!ev->status) {
2385                         if (ev->role)
2386                                 conn->link_mode &= ~HCI_LM_MASTER;
2387                         else
2388                                 conn->link_mode |= HCI_LM_MASTER;
2389                 }
2390
2391                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
2392
2393                 hci_role_switch_cfm(conn, ev->status, ev->role);
2394         }
2395
2396         hci_dev_unlock(hdev);
2397 }
2398
2399 static void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
2400 {
2401         struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
2402         int i;
2403
2404         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
2405                 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
2406                 return;
2407         }
2408
2409         if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
2410             ev->num_hndl * sizeof(struct hci_comp_pkts_info)) {
2411                 BT_DBG("%s bad parameters", hdev->name);
2412                 return;
2413         }
2414
2415         BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
2416
2417         for (i = 0; i < ev->num_hndl; i++) {
2418                 struct hci_comp_pkts_info *info = &ev->handles[i];
2419                 struct hci_conn *conn;
2420                 __u16  handle, count;
2421
2422                 handle = __le16_to_cpu(info->handle);
2423                 count  = __le16_to_cpu(info->count);
2424
2425                 conn = hci_conn_hash_lookup_handle(hdev, handle);
2426                 if (!conn)
2427                         continue;
2428
2429                 conn->sent -= count;
2430
2431                 switch (conn->type) {
2432                 case ACL_LINK:
2433                         hdev->acl_cnt += count;
2434                         if (hdev->acl_cnt > hdev->acl_pkts)
2435                                 hdev->acl_cnt = hdev->acl_pkts;
2436                         break;
2437
2438                 case LE_LINK:
2439                         if (hdev->le_pkts) {
2440                                 hdev->le_cnt += count;
2441                                 if (hdev->le_cnt > hdev->le_pkts)
2442                                         hdev->le_cnt = hdev->le_pkts;
2443                         } else {
2444                                 hdev->acl_cnt += count;
2445                                 if (hdev->acl_cnt > hdev->acl_pkts)
2446                                         hdev->acl_cnt = hdev->acl_pkts;
2447                         }
2448                         break;
2449
2450                 case SCO_LINK:
2451                         hdev->sco_cnt += count;
2452                         if (hdev->sco_cnt > hdev->sco_pkts)
2453                                 hdev->sco_cnt = hdev->sco_pkts;
2454                         break;
2455
2456                 default:
2457                         BT_ERR("Unknown type %d conn %p", conn->type, conn);
2458                         break;
2459                 }
2460         }
2461
2462         queue_work(hdev->workqueue, &hdev->tx_work);
2463 }
2464
2465 static struct hci_conn *__hci_conn_lookup_handle(struct hci_dev *hdev,
2466                                                  __u16 handle)
2467 {
2468         struct hci_chan *chan;
2469
2470         switch (hdev->dev_type) {
2471         case HCI_BREDR:
2472                 return hci_conn_hash_lookup_handle(hdev, handle);
2473         case HCI_AMP:
2474                 chan = hci_chan_lookup_handle(hdev, handle);
2475                 if (chan)
2476                         return chan->conn;
2477                 break;
2478         default:
2479                 BT_ERR("%s unknown dev_type %d", hdev->name, hdev->dev_type);
2480                 break;
2481         }
2482
2483         return NULL;
2484 }
2485
2486 static void hci_num_comp_blocks_evt(struct hci_dev *hdev, struct sk_buff *skb)
2487 {
2488         struct hci_ev_num_comp_blocks *ev = (void *) skb->data;
2489         int i;
2490
2491         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
2492                 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
2493                 return;
2494         }
2495
2496         if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
2497             ev->num_hndl * sizeof(struct hci_comp_blocks_info)) {
2498                 BT_DBG("%s bad parameters", hdev->name);
2499                 return;
2500         }
2501
2502         BT_DBG("%s num_blocks %d num_hndl %d", hdev->name, ev->num_blocks,
2503                ev->num_hndl);
2504
2505         for (i = 0; i < ev->num_hndl; i++) {
2506                 struct hci_comp_blocks_info *info = &ev->handles[i];
2507                 struct hci_conn *conn = NULL;
2508                 __u16  handle, block_count;
2509
2510                 handle = __le16_to_cpu(info->handle);
2511                 block_count = __le16_to_cpu(info->blocks);
2512
2513                 conn = __hci_conn_lookup_handle(hdev, handle);
2514                 if (!conn)
2515                         continue;
2516
2517                 conn->sent -= block_count;
2518
2519                 switch (conn->type) {
2520                 case ACL_LINK:
2521                 case AMP_LINK:
2522                         hdev->block_cnt += block_count;
2523                         if (hdev->block_cnt > hdev->num_blocks)
2524                                 hdev->block_cnt = hdev->num_blocks;
2525                         break;
2526
2527                 default:
2528                         BT_ERR("Unknown type %d conn %p", conn->type, conn);
2529                         break;
2530                 }
2531         }
2532
2533         queue_work(hdev->workqueue, &hdev->tx_work);
2534 }
2535
2536 static void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2537 {
2538         struct hci_ev_mode_change *ev = (void *) skb->data;
2539         struct hci_conn *conn;
2540
2541         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2542
2543         hci_dev_lock(hdev);
2544
2545         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2546         if (conn) {
2547                 conn->mode = ev->mode;
2548
2549                 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND,
2550                                         &conn->flags)) {
2551                         if (conn->mode == HCI_CM_ACTIVE)
2552                                 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
2553                         else
2554                                 clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
2555                 }
2556
2557                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2558                         hci_sco_setup(conn, ev->status);
2559         }
2560
2561         hci_dev_unlock(hdev);
2562 }
2563
2564 static void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2565 {
2566         struct hci_ev_pin_code_req *ev = (void *) skb->data;
2567         struct hci_conn *conn;
2568
2569         BT_DBG("%s", hdev->name);
2570
2571         hci_dev_lock(hdev);
2572
2573         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2574         if (!conn)
2575                 goto unlock;
2576
2577         if (conn->state == BT_CONNECTED) {
2578                 hci_conn_hold(conn);
2579                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2580                 hci_conn_drop(conn);
2581         }
2582
2583         if (!test_bit(HCI_PAIRABLE, &hdev->dev_flags))
2584                 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2585                              sizeof(ev->bdaddr), &ev->bdaddr);
2586         else if (test_bit(HCI_MGMT, &hdev->dev_flags)) {
2587                 u8 secure;
2588
2589                 if (conn->pending_sec_level == BT_SECURITY_HIGH)
2590                         secure = 1;
2591                 else
2592                         secure = 0;
2593
2594                 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
2595         }
2596
2597 unlock:
2598         hci_dev_unlock(hdev);
2599 }
2600
2601 static void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2602 {
2603         struct hci_ev_link_key_req *ev = (void *) skb->data;
2604         struct hci_cp_link_key_reply cp;
2605         struct hci_conn *conn;
2606         struct link_key *key;
2607
2608         BT_DBG("%s", hdev->name);
2609
2610         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
2611                 return;
2612
2613         hci_dev_lock(hdev);
2614
2615         key = hci_find_link_key(hdev, &ev->bdaddr);
2616         if (!key) {
2617                 BT_DBG("%s link key not found for %pMR", hdev->name,
2618                        &ev->bdaddr);
2619                 goto not_found;
2620         }
2621
2622         BT_DBG("%s found key type %u for %pMR", hdev->name, key->type,
2623                &ev->bdaddr);
2624
2625         if (!test_bit(HCI_DEBUG_KEYS, &hdev->dev_flags) &&
2626             key->type == HCI_LK_DEBUG_COMBINATION) {
2627                 BT_DBG("%s ignoring debug key", hdev->name);
2628                 goto not_found;
2629         }
2630
2631         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2632         if (conn) {
2633                 if (key->type == HCI_LK_UNAUTH_COMBINATION &&
2634                     conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
2635                         BT_DBG("%s ignoring unauthenticated key", hdev->name);
2636                         goto not_found;
2637                 }
2638
2639                 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
2640                     conn->pending_sec_level == BT_SECURITY_HIGH) {
2641                         BT_DBG("%s ignoring key unauthenticated for high security",
2642                                hdev->name);
2643                         goto not_found;
2644                 }
2645
2646                 conn->key_type = key->type;
2647                 conn->pin_length = key->pin_len;
2648         }
2649
2650         bacpy(&cp.bdaddr, &ev->bdaddr);
2651         memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);
2652
2653         hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
2654
2655         hci_dev_unlock(hdev);
2656
2657         return;
2658
2659 not_found:
2660         hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
2661         hci_dev_unlock(hdev);
2662 }
2663
2664 static void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
2665 {
2666         struct hci_ev_link_key_notify *ev = (void *) skb->data;
2667         struct hci_conn *conn;
2668         u8 pin_len = 0;
2669
2670         BT_DBG("%s", hdev->name);
2671
2672         hci_dev_lock(hdev);
2673
2674         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2675         if (conn) {
2676                 hci_conn_hold(conn);
2677                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2678                 pin_len = conn->pin_length;
2679
2680                 if (ev->key_type != HCI_LK_CHANGED_COMBINATION)
2681                         conn->key_type = ev->key_type;
2682
2683                 hci_conn_drop(conn);
2684         }
2685
2686         if (test_bit(HCI_MGMT, &hdev->dev_flags))
2687                 hci_add_link_key(hdev, conn, 1, &ev->bdaddr, ev->link_key,
2688                                  ev->key_type, pin_len);
2689
2690         hci_dev_unlock(hdev);
2691 }
2692
2693 static void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
2694 {
2695         struct hci_ev_clock_offset *ev = (void *) skb->data;
2696         struct hci_conn *conn;
2697
2698         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2699
2700         hci_dev_lock(hdev);
2701
2702         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2703         if (conn && !ev->status) {
2704                 struct inquiry_entry *ie;
2705
2706                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
2707                 if (ie) {
2708                         ie->data.clock_offset = ev->clock_offset;
2709                         ie->timestamp = jiffies;
2710                 }
2711         }
2712
2713         hci_dev_unlock(hdev);
2714 }
2715
2716 static void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2717 {
2718         struct hci_ev_pkt_type_change *ev = (void *) skb->data;
2719         struct hci_conn *conn;
2720
2721         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2722
2723         hci_dev_lock(hdev);
2724
2725         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2726         if (conn && !ev->status)
2727                 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
2728
2729         hci_dev_unlock(hdev);
2730 }
2731
2732 static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
2733 {
2734         struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
2735         struct inquiry_entry *ie;
2736
2737         BT_DBG("%s", hdev->name);
2738
2739         hci_dev_lock(hdev);
2740
2741         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2742         if (ie) {
2743                 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
2744                 ie->timestamp = jiffies;
2745         }
2746
2747         hci_dev_unlock(hdev);
2748 }
2749
2750 static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
2751                                              struct sk_buff *skb)
2752 {
2753         struct inquiry_data data;
2754         int num_rsp = *((__u8 *) skb->data);
2755         bool name_known, ssp;
2756
2757         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2758
2759         if (!num_rsp)
2760                 return;
2761
2762         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
2763                 return;
2764
2765         hci_dev_lock(hdev);
2766
2767         if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
2768                 struct inquiry_info_with_rssi_and_pscan_mode *info;
2769                 info = (void *) (skb->data + 1);
2770
2771                 for (; num_rsp; num_rsp--, info++) {
2772                         bacpy(&data.bdaddr, &info->bdaddr);
2773                         data.pscan_rep_mode     = info->pscan_rep_mode;
2774                         data.pscan_period_mode  = info->pscan_period_mode;
2775                         data.pscan_mode         = info->pscan_mode;
2776                         memcpy(data.dev_class, info->dev_class, 3);
2777                         data.clock_offset       = info->clock_offset;
2778                         data.rssi               = info->rssi;
2779                         data.ssp_mode           = 0x00;
2780
2781                         name_known = hci_inquiry_cache_update(hdev, &data,
2782                                                               false, &ssp);
2783                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2784                                           info->dev_class, info->rssi,
2785                                           !name_known, ssp, NULL, 0);
2786                 }
2787         } else {
2788                 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
2789
2790                 for (; num_rsp; num_rsp--, info++) {
2791                         bacpy(&data.bdaddr, &info->bdaddr);
2792                         data.pscan_rep_mode     = info->pscan_rep_mode;
2793                         data.pscan_period_mode  = info->pscan_period_mode;
2794                         data.pscan_mode         = 0x00;
2795                         memcpy(data.dev_class, info->dev_class, 3);
2796                         data.clock_offset       = info->clock_offset;
2797                         data.rssi               = info->rssi;
2798                         data.ssp_mode           = 0x00;
2799                         name_known = hci_inquiry_cache_update(hdev, &data,
2800                                                               false, &ssp);
2801                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2802                                           info->dev_class, info->rssi,
2803                                           !name_known, ssp, NULL, 0);
2804                 }
2805         }
2806
2807         hci_dev_unlock(hdev);
2808 }
2809
2810 static void hci_remote_ext_features_evt(struct hci_dev *hdev,
2811                                         struct sk_buff *skb)
2812 {
2813         struct hci_ev_remote_ext_features *ev = (void *) skb->data;
2814         struct hci_conn *conn;
2815
2816         BT_DBG("%s", hdev->name);
2817
2818         hci_dev_lock(hdev);
2819
2820         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2821         if (!conn)
2822                 goto unlock;
2823
2824         if (ev->page < HCI_MAX_PAGES)
2825                 memcpy(conn->features[ev->page], ev->features, 8);
2826
2827         if (!ev->status && ev->page == 0x01) {
2828                 struct inquiry_entry *ie;
2829
2830                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
2831                 if (ie)
2832                         ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
2833
2834                 if (ev->features[0] & LMP_HOST_SSP) {
2835                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
2836                 } else {
2837                         /* It is mandatory by the Bluetooth specification that
2838                          * Extended Inquiry Results are only used when Secure
2839                          * Simple Pairing is enabled, but some devices violate
2840                          * this.
2841                          *
2842                          * To make these devices work, the internal SSP
2843                          * enabled flag needs to be cleared if the remote host
2844                          * features do not indicate SSP support */
2845                         clear_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
2846                 }
2847         }
2848
2849         if (conn->state != BT_CONFIG)
2850                 goto unlock;
2851
2852         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
2853                 struct hci_cp_remote_name_req cp;
2854                 memset(&cp, 0, sizeof(cp));
2855                 bacpy(&cp.bdaddr, &conn->dst);
2856                 cp.pscan_rep_mode = 0x02;
2857                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2858         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2859                 mgmt_device_connected(hdev, &conn->dst, conn->type,
2860                                       conn->dst_type, 0, NULL, 0,
2861                                       conn->dev_class);
2862
2863         if (!hci_outgoing_auth_needed(hdev, conn)) {
2864                 conn->state = BT_CONNECTED;
2865                 hci_proto_connect_cfm(conn, ev->status);
2866                 hci_conn_drop(conn);
2867         }
2868
2869 unlock:
2870         hci_dev_unlock(hdev);
2871 }
2872
2873 static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
2874                                        struct sk_buff *skb)
2875 {
2876         struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
2877         struct hci_conn *conn;
2878
2879         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2880
2881         hci_dev_lock(hdev);
2882
2883         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
2884         if (!conn) {
2885                 if (ev->link_type == ESCO_LINK)
2886                         goto unlock;
2887
2888                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
2889                 if (!conn)
2890                         goto unlock;
2891
2892                 conn->type = SCO_LINK;
2893         }
2894
2895         switch (ev->status) {
2896         case 0x00:
2897                 conn->handle = __le16_to_cpu(ev->handle);
2898                 conn->state  = BT_CONNECTED;
2899
2900                 hci_conn_add_sysfs(conn);
2901                 break;
2902
2903         case 0x0d:      /* Connection Rejected due to Limited Resources */
2904         case 0x11:      /* Unsupported Feature or Parameter Value */
2905         case 0x1c:      /* SCO interval rejected */
2906         case 0x1a:      /* Unsupported Remote Feature */
2907         case 0x1f:      /* Unspecified error */
2908                 if (conn->out) {
2909                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
2910                                         (hdev->esco_type & EDR_ESCO_MASK);
2911                         if (hci_setup_sync(conn, conn->link->handle))
2912                                 goto unlock;
2913                 }
2914                 /* fall through */
2915
2916         default:
2917                 conn->state = BT_CLOSED;
2918                 break;
2919         }
2920
2921         hci_proto_connect_cfm(conn, ev->status);
2922         if (ev->status)
2923                 hci_conn_del(conn);
2924
2925 unlock:
2926         hci_dev_unlock(hdev);
2927 }
2928
2929 static inline size_t eir_get_length(u8 *eir, size_t eir_len)
2930 {
2931         size_t parsed = 0;
2932
2933         while (parsed < eir_len) {
2934                 u8 field_len = eir[0];
2935
2936                 if (field_len == 0)
2937                         return parsed;
2938
2939                 parsed += field_len + 1;
2940                 eir += field_len + 1;
2941         }
2942
2943         return eir_len;
2944 }
2945
2946 static void hci_extended_inquiry_result_evt(struct hci_dev *hdev,
2947                                             struct sk_buff *skb)
2948 {
2949         struct inquiry_data data;
2950         struct extended_inquiry_info *info = (void *) (skb->data + 1);
2951         int num_rsp = *((__u8 *) skb->data);
2952         size_t eir_len;
2953
2954         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2955
2956         if (!num_rsp)
2957                 return;
2958
2959         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
2960                 return;
2961
2962         hci_dev_lock(hdev);
2963
2964         for (; num_rsp; num_rsp--, info++) {
2965                 bool name_known, ssp;
2966
2967                 bacpy(&data.bdaddr, &info->bdaddr);
2968                 data.pscan_rep_mode     = info->pscan_rep_mode;
2969                 data.pscan_period_mode  = info->pscan_period_mode;
2970                 data.pscan_mode         = 0x00;
2971                 memcpy(data.dev_class, info->dev_class, 3);
2972                 data.clock_offset       = info->clock_offset;
2973                 data.rssi               = info->rssi;
2974                 data.ssp_mode           = 0x01;
2975
2976                 if (test_bit(HCI_MGMT, &hdev->dev_flags))
2977                         name_known = eir_has_data_type(info->data,
2978                                                        sizeof(info->data),
2979                                                        EIR_NAME_COMPLETE);
2980                 else
2981                         name_known = true;
2982
2983                 name_known = hci_inquiry_cache_update(hdev, &data, name_known,
2984                                                       &ssp);
2985                 eir_len = eir_get_length(info->data, sizeof(info->data));
2986                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2987                                   info->dev_class, info->rssi, !name_known,
2988                                   ssp, info->data, eir_len);
2989         }
2990
2991         hci_dev_unlock(hdev);
2992 }
2993
2994 static void hci_key_refresh_complete_evt(struct hci_dev *hdev,
2995                                          struct sk_buff *skb)
2996 {
2997         struct hci_ev_key_refresh_complete *ev = (void *) skb->data;
2998         struct hci_conn *conn;
2999
3000         BT_DBG("%s status 0x%2.2x handle 0x%4.4x", hdev->name, ev->status,
3001                __le16_to_cpu(ev->handle));
3002
3003         hci_dev_lock(hdev);
3004
3005         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3006         if (!conn)
3007                 goto unlock;
3008
3009         if (!ev->status)
3010                 conn->sec_level = conn->pending_sec_level;
3011
3012         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3013
3014         if (ev->status && conn->state == BT_CONNECTED) {
3015                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
3016                 hci_conn_drop(conn);
3017                 goto unlock;
3018         }
3019
3020         if (conn->state == BT_CONFIG) {
3021                 if (!ev->status)
3022                         conn->state = BT_CONNECTED;
3023
3024                 hci_proto_connect_cfm(conn, ev->status);
3025                 hci_conn_drop(conn);
3026         } else {
3027                 hci_auth_cfm(conn, ev->status);
3028
3029                 hci_conn_hold(conn);
3030                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3031                 hci_conn_drop(conn);
3032         }
3033
3034 unlock:
3035         hci_dev_unlock(hdev);
3036 }
3037
3038 static u8 hci_get_auth_req(struct hci_conn *conn)
3039 {
3040         /* If remote requests dedicated bonding follow that lead */
3041         if (conn->remote_auth == HCI_AT_DEDICATED_BONDING ||
3042             conn->remote_auth == HCI_AT_DEDICATED_BONDING_MITM) {
3043                 /* If both remote and local IO capabilities allow MITM
3044                  * protection then require it, otherwise don't */
3045                 if (conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT ||
3046                     conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)
3047                         return HCI_AT_DEDICATED_BONDING;
3048                 else
3049                         return HCI_AT_DEDICATED_BONDING_MITM;
3050         }
3051
3052         /* If remote requests no-bonding follow that lead */
3053         if (conn->remote_auth == HCI_AT_NO_BONDING ||
3054             conn->remote_auth == HCI_AT_NO_BONDING_MITM)
3055                 return conn->remote_auth | (conn->auth_type & 0x01);
3056
3057         return conn->auth_type;
3058 }
3059
3060 static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3061 {
3062         struct hci_ev_io_capa_request *ev = (void *) skb->data;
3063         struct hci_conn *conn;
3064
3065         BT_DBG("%s", hdev->name);
3066
3067         hci_dev_lock(hdev);
3068
3069         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3070         if (!conn)
3071                 goto unlock;
3072
3073         hci_conn_hold(conn);
3074
3075         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3076                 goto unlock;
3077
3078         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags) ||
3079             (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
3080                 struct hci_cp_io_capability_reply cp;
3081
3082                 bacpy(&cp.bdaddr, &ev->bdaddr);
3083                 /* Change the IO capability from KeyboardDisplay
3084                  * to DisplayYesNo as it is not supported by BT spec. */
3085                 cp.capability = (conn->io_capability == 0x04) ?
3086                                 HCI_IO_DISPLAY_YESNO : conn->io_capability;
3087                 conn->auth_type = hci_get_auth_req(conn);
3088                 cp.authentication = conn->auth_type;
3089
3090                 if (hci_find_remote_oob_data(hdev, &conn->dst) &&
3091                     (conn->out || test_bit(HCI_CONN_REMOTE_OOB, &conn->flags)))
3092                         cp.oob_data = 0x01;
3093                 else
3094                         cp.oob_data = 0x00;
3095
3096                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
3097                              sizeof(cp), &cp);
3098         } else {
3099                 struct hci_cp_io_capability_neg_reply cp;
3100
3101                 bacpy(&cp.bdaddr, &ev->bdaddr);
3102                 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
3103
3104                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
3105                              sizeof(cp), &cp);
3106         }
3107
3108 unlock:
3109         hci_dev_unlock(hdev);
3110 }
3111
3112 static void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
3113 {
3114         struct hci_ev_io_capa_reply *ev = (void *) skb->data;
3115         struct hci_conn *conn;
3116
3117         BT_DBG("%s", hdev->name);
3118
3119         hci_dev_lock(hdev);
3120
3121         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3122         if (!conn)
3123                 goto unlock;
3124
3125         conn->remote_cap = ev->capability;
3126         conn->remote_auth = ev->authentication;
3127         if (ev->oob_data)
3128                 set_bit(HCI_CONN_REMOTE_OOB, &conn->flags);
3129
3130 unlock:
3131         hci_dev_unlock(hdev);
3132 }
3133
3134 static void hci_user_confirm_request_evt(struct hci_dev *hdev,
3135                                          struct sk_buff *skb)
3136 {
3137         struct hci_ev_user_confirm_req *ev = (void *) skb->data;
3138         int loc_mitm, rem_mitm, confirm_hint = 0;
3139         struct hci_conn *conn;
3140
3141         BT_DBG("%s", hdev->name);
3142
3143         hci_dev_lock(hdev);
3144
3145         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3146                 goto unlock;
3147
3148         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3149         if (!conn)
3150                 goto unlock;
3151
3152         loc_mitm = (conn->auth_type & 0x01);
3153         rem_mitm = (conn->remote_auth & 0x01);
3154
3155         /* If we require MITM but the remote device can't provide that
3156          * (it has NoInputNoOutput) then reject the confirmation
3157          * request. The only exception is when we're dedicated bonding
3158          * initiators (connect_cfm_cb set) since then we always have the MITM
3159          * bit set. */
3160         if (!conn->connect_cfm_cb && loc_mitm &&
3161             conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
3162                 BT_DBG("Rejecting request: remote device can't provide MITM");
3163                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
3164                              sizeof(ev->bdaddr), &ev->bdaddr);
3165                 goto unlock;
3166         }
3167
3168         /* If no side requires MITM protection; auto-accept */
3169         if ((!loc_mitm || conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) &&
3170             (!rem_mitm || conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)) {
3171
3172                 /* If we're not the initiators request authorization to
3173                  * proceed from user space (mgmt_user_confirm with
3174                  * confirm_hint set to 1). */
3175                 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
3176                         BT_DBG("Confirming auto-accept as acceptor");
3177                         confirm_hint = 1;
3178                         goto confirm;
3179                 }
3180
3181                 BT_DBG("Auto-accept of user confirmation with %ums delay",
3182                        hdev->auto_accept_delay);
3183
3184                 if (hdev->auto_accept_delay > 0) {
3185                         int delay = msecs_to_jiffies(hdev->auto_accept_delay);
3186                         queue_delayed_work(conn->hdev->workqueue,
3187                                            &conn->auto_accept_work, delay);
3188                         goto unlock;
3189                 }
3190
3191                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
3192                              sizeof(ev->bdaddr), &ev->bdaddr);
3193                 goto unlock;
3194         }
3195
3196 confirm:
3197         mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0, ev->passkey,
3198                                   confirm_hint);
3199
3200 unlock:
3201         hci_dev_unlock(hdev);
3202 }
3203
3204 static void hci_user_passkey_request_evt(struct hci_dev *hdev,
3205                                          struct sk_buff *skb)
3206 {
3207         struct hci_ev_user_passkey_req *ev = (void *) skb->data;
3208
3209         BT_DBG("%s", hdev->name);
3210
3211         if (test_bit(HCI_MGMT, &hdev->dev_flags))
3212                 mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
3213 }
3214
3215 static void hci_user_passkey_notify_evt(struct hci_dev *hdev,
3216                                         struct sk_buff *skb)
3217 {
3218         struct hci_ev_user_passkey_notify *ev = (void *) skb->data;
3219         struct hci_conn *conn;
3220
3221         BT_DBG("%s", hdev->name);
3222
3223         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3224         if (!conn)
3225                 return;
3226
3227         conn->passkey_notify = __le32_to_cpu(ev->passkey);
3228         conn->passkey_entered = 0;
3229
3230         if (test_bit(HCI_MGMT, &hdev->dev_flags))
3231                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
3232                                          conn->dst_type, conn->passkey_notify,
3233                                          conn->passkey_entered);
3234 }
3235
3236 static void hci_keypress_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
3237 {
3238         struct hci_ev_keypress_notify *ev = (void *) skb->data;
3239         struct hci_conn *conn;
3240
3241         BT_DBG("%s", hdev->name);
3242
3243         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3244         if (!conn)
3245                 return;
3246
3247         switch (ev->type) {
3248         case HCI_KEYPRESS_STARTED:
3249                 conn->passkey_entered = 0;
3250                 return;
3251
3252         case HCI_KEYPRESS_ENTERED:
3253                 conn->passkey_entered++;
3254                 break;
3255
3256         case HCI_KEYPRESS_ERASED:
3257                 conn->passkey_entered--;
3258                 break;
3259
3260         case HCI_KEYPRESS_CLEARED:
3261                 conn->passkey_entered = 0;
3262                 break;
3263
3264         case HCI_KEYPRESS_COMPLETED:
3265                 return;
3266         }
3267
3268         if (test_bit(HCI_MGMT, &hdev->dev_flags))
3269                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
3270                                          conn->dst_type, conn->passkey_notify,
3271                                          conn->passkey_entered);
3272 }
3273
3274 static void hci_simple_pair_complete_evt(struct hci_dev *hdev,
3275                                          struct sk_buff *skb)
3276 {
3277         struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
3278         struct hci_conn *conn;
3279
3280         BT_DBG("%s", hdev->name);
3281
3282         hci_dev_lock(hdev);
3283
3284         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3285         if (!conn)
3286                 goto unlock;
3287
3288         /* To avoid duplicate auth_failed events to user space we check
3289          * the HCI_CONN_AUTH_PEND flag which will be set if we
3290          * initiated the authentication. A traditional auth_complete
3291          * event gets always produced as initiator and is also mapped to
3292          * the mgmt_auth_failed event */
3293         if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status)
3294                 mgmt_auth_failed(hdev, &conn->dst, conn->type, conn->dst_type,
3295                                  ev->status);
3296
3297         hci_conn_drop(conn);
3298
3299 unlock:
3300         hci_dev_unlock(hdev);
3301 }
3302
3303 static void hci_remote_host_features_evt(struct hci_dev *hdev,
3304                                          struct sk_buff *skb)
3305 {
3306         struct hci_ev_remote_host_features *ev = (void *) skb->data;
3307         struct inquiry_entry *ie;
3308         struct hci_conn *conn;
3309
3310         BT_DBG("%s", hdev->name);
3311
3312         hci_dev_lock(hdev);
3313
3314         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3315         if (conn)
3316                 memcpy(conn->features[1], ev->features, 8);
3317
3318         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
3319         if (ie)
3320                 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
3321
3322         hci_dev_unlock(hdev);
3323 }
3324
3325 static void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
3326                                             struct sk_buff *skb)
3327 {
3328         struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
3329         struct oob_data *data;
3330
3331         BT_DBG("%s", hdev->name);
3332
3333         hci_dev_lock(hdev);
3334
3335         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3336                 goto unlock;
3337
3338         data = hci_find_remote_oob_data(hdev, &ev->bdaddr);
3339         if (data) {
3340                 struct hci_cp_remote_oob_data_reply cp;
3341
3342                 bacpy(&cp.bdaddr, &ev->bdaddr);
3343                 memcpy(cp.hash, data->hash, sizeof(cp.hash));
3344                 memcpy(cp.randomizer, data->randomizer, sizeof(cp.randomizer));
3345
3346                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY, sizeof(cp),
3347                              &cp);
3348         } else {
3349                 struct hci_cp_remote_oob_data_neg_reply cp;
3350
3351                 bacpy(&cp.bdaddr, &ev->bdaddr);
3352                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY, sizeof(cp),
3353                              &cp);
3354         }
3355
3356 unlock:
3357         hci_dev_unlock(hdev);
3358 }
3359
3360 static void hci_phy_link_complete_evt(struct hci_dev *hdev,
3361                                       struct sk_buff *skb)
3362 {
3363         struct hci_ev_phy_link_complete *ev = (void *) skb->data;
3364         struct hci_conn *hcon, *bredr_hcon;
3365
3366         BT_DBG("%s handle 0x%2.2x status 0x%2.2x", hdev->name, ev->phy_handle,
3367                ev->status);
3368
3369         hci_dev_lock(hdev);
3370
3371         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
3372         if (!hcon) {
3373                 hci_dev_unlock(hdev);
3374                 return;
3375         }
3376
3377         if (ev->status) {
3378                 hci_conn_del(hcon);
3379                 hci_dev_unlock(hdev);
3380                 return;
3381         }
3382
3383         bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
3384
3385         hcon->state = BT_CONNECTED;
3386         bacpy(&hcon->dst, &bredr_hcon->dst);
3387
3388         hci_conn_hold(hcon);
3389         hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
3390         hci_conn_drop(hcon);
3391
3392         hci_conn_add_sysfs(hcon);
3393
3394         amp_physical_cfm(bredr_hcon, hcon);
3395
3396         hci_dev_unlock(hdev);
3397 }
3398
3399 static void hci_loglink_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
3400 {
3401         struct hci_ev_logical_link_complete *ev = (void *) skb->data;
3402         struct hci_conn *hcon;
3403         struct hci_chan *hchan;
3404         struct amp_mgr *mgr;
3405
3406         BT_DBG("%s log_handle 0x%4.4x phy_handle 0x%2.2x status 0x%2.2x",
3407                hdev->name, le16_to_cpu(ev->handle), ev->phy_handle,
3408                ev->status);
3409
3410         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
3411         if (!hcon)
3412                 return;
3413
3414         /* Create AMP hchan */
3415         hchan = hci_chan_create(hcon);
3416         if (!hchan)
3417                 return;
3418
3419         hchan->handle = le16_to_cpu(ev->handle);
3420
3421         BT_DBG("hcon %p mgr %p hchan %p", hcon, hcon->amp_mgr, hchan);
3422
3423         mgr = hcon->amp_mgr;
3424         if (mgr && mgr->bredr_chan) {
3425                 struct l2cap_chan *bredr_chan = mgr->bredr_chan;
3426
3427                 l2cap_chan_lock(bredr_chan);
3428
3429                 bredr_chan->conn->mtu = hdev->block_mtu;
3430                 l2cap_logical_cfm(bredr_chan, hchan, 0);
3431                 hci_conn_hold(hcon);
3432
3433                 l2cap_chan_unlock(bredr_chan);
3434         }
3435 }
3436
3437 static void hci_disconn_loglink_complete_evt(struct hci_dev *hdev,
3438                                              struct sk_buff *skb)
3439 {
3440         struct hci_ev_disconn_logical_link_complete *ev = (void *) skb->data;
3441         struct hci_chan *hchan;
3442
3443         BT_DBG("%s log handle 0x%4.4x status 0x%2.2x", hdev->name,
3444                le16_to_cpu(ev->handle), ev->status);
3445
3446         if (ev->status)
3447                 return;
3448
3449         hci_dev_lock(hdev);
3450
3451         hchan = hci_chan_lookup_handle(hdev, le16_to_cpu(ev->handle));
3452         if (!hchan)
3453                 goto unlock;
3454
3455         amp_destroy_logical_link(hchan, ev->reason);
3456
3457 unlock:
3458         hci_dev_unlock(hdev);
3459 }
3460
3461 static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev,
3462                                              struct sk_buff *skb)
3463 {
3464         struct hci_ev_disconn_phy_link_complete *ev = (void *) skb->data;
3465         struct hci_conn *hcon;
3466
3467         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3468
3469         if (ev->status)
3470                 return;
3471
3472         hci_dev_lock(hdev);
3473
3474         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
3475         if (hcon) {
3476                 hcon->state = BT_CLOSED;
3477                 hci_conn_del(hcon);
3478         }
3479
3480         hci_dev_unlock(hdev);
3481 }
3482
3483 static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
3484 {
3485         struct hci_ev_le_conn_complete *ev = (void *) skb->data;
3486         struct hci_conn *conn;
3487
3488         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3489
3490         hci_dev_lock(hdev);
3491
3492         conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
3493         if (!conn) {
3494                 conn = hci_conn_add(hdev, LE_LINK, &ev->bdaddr);
3495                 if (!conn) {
3496                         BT_ERR("No memory for new connection");
3497                         goto unlock;
3498                 }
3499
3500                 conn->dst_type = ev->bdaddr_type;
3501
3502                 /* The advertising parameters for own address type
3503                  * define which source address and source address
3504                  * type this connections has.
3505                  */
3506                 if (bacmp(&conn->src, BDADDR_ANY)) {
3507                         conn->src_type = ADDR_LE_DEV_PUBLIC;
3508                 } else {
3509                         bacpy(&conn->src, &hdev->static_addr);
3510                         conn->src_type = ADDR_LE_DEV_RANDOM;
3511                 }
3512
3513                 if (ev->role == LE_CONN_ROLE_MASTER) {
3514                         conn->out = true;
3515                         conn->link_mode |= HCI_LM_MASTER;
3516                 }
3517         }
3518
3519         if (ev->status) {
3520                 mgmt_connect_failed(hdev, &conn->dst, conn->type,
3521                                     conn->dst_type, ev->status);
3522                 hci_proto_connect_cfm(conn, ev->status);
3523                 conn->state = BT_CLOSED;
3524                 hci_conn_del(conn);
3525                 goto unlock;
3526         }
3527
3528         if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
3529                 mgmt_device_connected(hdev, &ev->bdaddr, conn->type,
3530                                       conn->dst_type, 0, NULL, 0, NULL);
3531
3532         conn->sec_level = BT_SECURITY_LOW;
3533         conn->handle = __le16_to_cpu(ev->handle);
3534         conn->state = BT_CONNECTED;
3535
3536         hci_conn_add_sysfs(conn);
3537
3538         hci_proto_connect_cfm(conn, ev->status);
3539
3540 unlock:
3541         hci_dev_unlock(hdev);
3542 }
3543
3544 static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
3545 {
3546         u8 num_reports = skb->data[0];
3547         void *ptr = &skb->data[1];
3548         s8 rssi;
3549
3550         while (num_reports--) {
3551                 struct hci_ev_le_advertising_info *ev = ptr;
3552
3553                 rssi = ev->data[ev->length];
3554                 mgmt_device_found(hdev, &ev->bdaddr, LE_LINK, ev->bdaddr_type,
3555                                   NULL, rssi, 0, 1, ev->data, ev->length);
3556
3557                 ptr += sizeof(*ev) + ev->length + 1;
3558         }
3559 }
3560
3561 static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3562 {
3563         struct hci_ev_le_ltk_req *ev = (void *) skb->data;
3564         struct hci_cp_le_ltk_reply cp;
3565         struct hci_cp_le_ltk_neg_reply neg;
3566         struct hci_conn *conn;
3567         struct smp_ltk *ltk;
3568
3569         BT_DBG("%s handle 0x%4.4x", hdev->name, __le16_to_cpu(ev->handle));
3570
3571         hci_dev_lock(hdev);
3572
3573         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3574         if (conn == NULL)
3575                 goto not_found;
3576
3577         ltk = hci_find_ltk(hdev, ev->ediv, ev->random);
3578         if (ltk == NULL)
3579                 goto not_found;
3580
3581         memcpy(cp.ltk, ltk->val, sizeof(ltk->val));
3582         cp.handle = cpu_to_le16(conn->handle);
3583
3584         if (ltk->authenticated)
3585                 conn->pending_sec_level = BT_SECURITY_HIGH;
3586         else
3587                 conn->pending_sec_level = BT_SECURITY_MEDIUM;
3588
3589         conn->enc_key_size = ltk->enc_size;
3590
3591         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
3592
3593         if (ltk->type & HCI_SMP_STK) {
3594                 list_del(&ltk->list);
3595                 kfree(ltk);
3596         }
3597
3598         hci_dev_unlock(hdev);
3599
3600         return;
3601
3602 not_found:
3603         neg.handle = ev->handle;
3604         hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
3605         hci_dev_unlock(hdev);
3606 }
3607
3608 static void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
3609 {
3610         struct hci_ev_le_meta *le_ev = (void *) skb->data;
3611
3612         skb_pull(skb, sizeof(*le_ev));
3613
3614         switch (le_ev->subevent) {
3615         case HCI_EV_LE_CONN_COMPLETE:
3616                 hci_le_conn_complete_evt(hdev, skb);
3617                 break;
3618
3619         case HCI_EV_LE_ADVERTISING_REPORT:
3620                 hci_le_adv_report_evt(hdev, skb);
3621                 break;
3622
3623         case HCI_EV_LE_LTK_REQ:
3624                 hci_le_ltk_request_evt(hdev, skb);
3625                 break;
3626
3627         default:
3628                 break;
3629         }
3630 }
3631
3632 static void hci_chan_selected_evt(struct hci_dev *hdev, struct sk_buff *skb)
3633 {
3634         struct hci_ev_channel_selected *ev = (void *) skb->data;
3635         struct hci_conn *hcon;
3636
3637         BT_DBG("%s handle 0x%2.2x", hdev->name, ev->phy_handle);
3638
3639         skb_pull(skb, sizeof(*ev));
3640
3641         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
3642         if (!hcon)
3643                 return;
3644
3645         amp_read_loc_assoc_final_data(hdev, hcon);
3646 }
3647
3648 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
3649 {
3650         struct hci_event_hdr *hdr = (void *) skb->data;
3651         __u8 event = hdr->evt;
3652
3653         hci_dev_lock(hdev);
3654
3655         /* Received events are (currently) only needed when a request is
3656          * ongoing so avoid unnecessary memory allocation.
3657          */
3658         if (hdev->req_status == HCI_REQ_PEND) {
3659                 kfree_skb(hdev->recv_evt);
3660                 hdev->recv_evt = skb_clone(skb, GFP_KERNEL);
3661         }
3662
3663         hci_dev_unlock(hdev);
3664
3665         skb_pull(skb, HCI_EVENT_HDR_SIZE);
3666
3667         if (hdev->sent_cmd && bt_cb(hdev->sent_cmd)->req.event == event) {
3668                 struct hci_command_hdr *cmd_hdr = (void *) hdev->sent_cmd->data;
3669                 u16 opcode = __le16_to_cpu(cmd_hdr->opcode);
3670
3671                 hci_req_cmd_complete(hdev, opcode, 0);
3672         }
3673
3674         switch (event) {
3675         case HCI_EV_INQUIRY_COMPLETE:
3676                 hci_inquiry_complete_evt(hdev, skb);
3677                 break;
3678
3679         case HCI_EV_INQUIRY_RESULT:
3680                 hci_inquiry_result_evt(hdev, skb);
3681                 break;
3682
3683         case HCI_EV_CONN_COMPLETE:
3684                 hci_conn_complete_evt(hdev, skb);
3685                 break;
3686
3687         case HCI_EV_CONN_REQUEST:
3688                 hci_conn_request_evt(hdev, skb);
3689                 break;
3690
3691         case HCI_EV_DISCONN_COMPLETE:
3692                 hci_disconn_complete_evt(hdev, skb);
3693                 break;
3694
3695         case HCI_EV_AUTH_COMPLETE:
3696                 hci_auth_complete_evt(hdev, skb);
3697                 break;
3698
3699         case HCI_EV_REMOTE_NAME:
3700                 hci_remote_name_evt(hdev, skb);
3701                 break;
3702
3703         case HCI_EV_ENCRYPT_CHANGE:
3704                 hci_encrypt_change_evt(hdev, skb);
3705                 break;
3706
3707         case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
3708                 hci_change_link_key_complete_evt(hdev, skb);
3709                 break;
3710
3711         case HCI_EV_REMOTE_FEATURES:
3712                 hci_remote_features_evt(hdev, skb);
3713                 break;
3714
3715         case HCI_EV_CMD_COMPLETE:
3716                 hci_cmd_complete_evt(hdev, skb);
3717                 break;
3718
3719         case HCI_EV_CMD_STATUS:
3720                 hci_cmd_status_evt(hdev, skb);
3721                 break;
3722
3723         case HCI_EV_ROLE_CHANGE:
3724                 hci_role_change_evt(hdev, skb);
3725                 break;
3726
3727         case HCI_EV_NUM_COMP_PKTS:
3728                 hci_num_comp_pkts_evt(hdev, skb);
3729                 break;
3730
3731         case HCI_EV_MODE_CHANGE:
3732                 hci_mode_change_evt(hdev, skb);
3733                 break;
3734
3735         case HCI_EV_PIN_CODE_REQ:
3736                 hci_pin_code_request_evt(hdev, skb);
3737                 break;
3738
3739         case HCI_EV_LINK_KEY_REQ:
3740                 hci_link_key_request_evt(hdev, skb);
3741                 break;
3742
3743         case HCI_EV_LINK_KEY_NOTIFY:
3744                 hci_link_key_notify_evt(hdev, skb);
3745                 break;
3746
3747         case HCI_EV_CLOCK_OFFSET:
3748                 hci_clock_offset_evt(hdev, skb);
3749                 break;
3750
3751         case HCI_EV_PKT_TYPE_CHANGE:
3752                 hci_pkt_type_change_evt(hdev, skb);
3753                 break;
3754
3755         case HCI_EV_PSCAN_REP_MODE:
3756                 hci_pscan_rep_mode_evt(hdev, skb);
3757                 break;
3758
3759         case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
3760                 hci_inquiry_result_with_rssi_evt(hdev, skb);
3761                 break;
3762
3763         case HCI_EV_REMOTE_EXT_FEATURES:
3764                 hci_remote_ext_features_evt(hdev, skb);
3765                 break;
3766
3767         case HCI_EV_SYNC_CONN_COMPLETE:
3768                 hci_sync_conn_complete_evt(hdev, skb);
3769                 break;
3770
3771         case HCI_EV_EXTENDED_INQUIRY_RESULT:
3772                 hci_extended_inquiry_result_evt(hdev, skb);
3773                 break;
3774
3775         case HCI_EV_KEY_REFRESH_COMPLETE:
3776                 hci_key_refresh_complete_evt(hdev, skb);
3777                 break;
3778
3779         case HCI_EV_IO_CAPA_REQUEST:
3780                 hci_io_capa_request_evt(hdev, skb);
3781                 break;
3782
3783         case HCI_EV_IO_CAPA_REPLY:
3784                 hci_io_capa_reply_evt(hdev, skb);
3785                 break;
3786
3787         case HCI_EV_USER_CONFIRM_REQUEST:
3788                 hci_user_confirm_request_evt(hdev, skb);
3789                 break;
3790
3791         case HCI_EV_USER_PASSKEY_REQUEST:
3792                 hci_user_passkey_request_evt(hdev, skb);
3793                 break;
3794
3795         case HCI_EV_USER_PASSKEY_NOTIFY:
3796                 hci_user_passkey_notify_evt(hdev, skb);
3797                 break;
3798
3799         case HCI_EV_KEYPRESS_NOTIFY:
3800                 hci_keypress_notify_evt(hdev, skb);
3801                 break;
3802
3803         case HCI_EV_SIMPLE_PAIR_COMPLETE:
3804                 hci_simple_pair_complete_evt(hdev, skb);
3805                 break;
3806
3807         case HCI_EV_REMOTE_HOST_FEATURES:
3808                 hci_remote_host_features_evt(hdev, skb);
3809                 break;
3810
3811         case HCI_EV_LE_META:
3812                 hci_le_meta_evt(hdev, skb);
3813                 break;
3814
3815         case HCI_EV_CHANNEL_SELECTED:
3816                 hci_chan_selected_evt(hdev, skb);
3817                 break;
3818
3819         case HCI_EV_REMOTE_OOB_DATA_REQUEST:
3820                 hci_remote_oob_data_request_evt(hdev, skb);
3821                 break;
3822
3823         case HCI_EV_PHY_LINK_COMPLETE:
3824                 hci_phy_link_complete_evt(hdev, skb);
3825                 break;
3826
3827         case HCI_EV_LOGICAL_LINK_COMPLETE:
3828                 hci_loglink_complete_evt(hdev, skb);
3829                 break;
3830
3831         case HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE:
3832                 hci_disconn_loglink_complete_evt(hdev, skb);
3833                 break;
3834
3835         case HCI_EV_DISCONN_PHY_LINK_COMPLETE:
3836                 hci_disconn_phylink_complete_evt(hdev, skb);
3837                 break;
3838
3839         case HCI_EV_NUM_COMP_BLOCKS:
3840                 hci_num_comp_blocks_evt(hdev, skb);
3841                 break;
3842
3843         default:
3844                 BT_DBG("%s event 0x%2.2x", hdev->name, event);
3845                 break;
3846         }
3847
3848         kfree_skb(skb);
3849         hdev->stat.evt_rx++;
3850 }