net/bluetooth/hci_event.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI event handling. */
  26
  27 #include <asm/unaligned.h>
  28
  29 #include <net/bluetooth/bluetooth.h>
  30 #include <net/bluetooth/hci_core.h>
  31 #include <net/bluetooth/mgmt.h>
  32
  33 #include "a2mp.h"
  34 #include "amp.h"
  35
  36 /* Handle HCI Event packets */
  37
  38 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
  39 {
  40         __u8 status = *((__u8 *) skb->data);
  41
  42         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  43
  44         if (status)
  45                 return;
  46
  47         clear_bit(HCI_INQUIRY, &hdev->flags);
  48         smp_mb__after_clear_bit(); /* wake_up_bit advises about this barrier */
  49         wake_up_bit(&hdev->flags, HCI_INQUIRY);
  50
  51         hci_dev_lock(hdev);
  52         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
  53         hci_dev_unlock(hdev);
  54
  55         hci_conn_check_pending(hdev);
  56 }
  57
  58 static void hci_cc_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  59 {
  60         __u8 status = *((__u8 *) skb->data);
  61
  62         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  63
  64         if (status)
  65                 return;
  66
  67         set_bit(HCI_PERIODIC_INQ, &hdev->dev_flags);
  68 }
  69
  70 static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  71 {
  72         __u8 status = *((__u8 *) skb->data);
  73
  74         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  75
  76         if (status)
  77                 return;
  78
  79         clear_bit(HCI_PERIODIC_INQ, &hdev->dev_flags);
  80
  81         hci_conn_check_pending(hdev);
  82 }
  83
  84 static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev,
  85                                           struct sk_buff *skb)
  86 {
  87         BT_DBG("%s", hdev->name);
  88 }
  89
  90 static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
  91 {
  92         struct hci_rp_role_discovery *rp = (void *) skb->data;
  93         struct hci_conn *conn;
  94
  95         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
  96
  97         if (rp->status)
  98                 return;
  99
 100         hci_dev_lock(hdev);
 101
 102         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 103         if (conn) {
 104                 if (rp->role)
 105                         conn->link_mode &= ~HCI_LM_MASTER;
 106                 else
 107                         conn->link_mode |= HCI_LM_MASTER;
 108         }
 109
 110         hci_dev_unlock(hdev);
 111 }
 112
 113 static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 114 {
 115         struct hci_rp_read_link_policy *rp = (void *) skb->data;
 116         struct hci_conn *conn;
 117
 118         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 119
 120         if (rp->status)
 121                 return;
 122
 123         hci_dev_lock(hdev);
 124
 125         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 126         if (conn)
 127                 conn->link_policy = __le16_to_cpu(rp->policy);
 128
 129         hci_dev_unlock(hdev);
 130 }
 131
 132 static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 133 {
 134         struct hci_rp_write_link_policy *rp = (void *) skb->data;
 135         struct hci_conn *conn;
 136         void *sent;
 137
 138         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 139
 140         if (rp->status)
 141                 return;
 142
 143         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
 144         if (!sent)
 145                 return;
 146
 147         hci_dev_lock(hdev);
 148
 149         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 150         if (conn)
 151                 conn->link_policy = get_unaligned_le16(sent + 2);
 152
 153         hci_dev_unlock(hdev);
 154 }
 155
 156 static void hci_cc_read_def_link_policy(struct hci_dev *hdev,
 157                                         struct sk_buff *skb)
 158 {
 159         struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
 160
 161         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 162
 163         if (rp->status)
 164                 return;
 165
 166         hdev->link_policy = __le16_to_cpu(rp->policy);
 167 }
 168
 169 static void hci_cc_write_def_link_policy(struct hci_dev *hdev,
 170                                          struct sk_buff *skb)
 171 {
 172         __u8 status = *((__u8 *) skb->data);
 173         void *sent;
 174
 175         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 176
 177         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
 178         if (!sent)
 179                 return;
 180
 181         if (!status)
 182                 hdev->link_policy = get_unaligned_le16(sent);
 183 }
 184
 185 static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
 186 {
 187         __u8 status = *((__u8 *) skb->data);
 188
 189         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 190
 191         clear_bit(HCI_RESET, &hdev->flags);
 192
 193         /* Reset all non-persistent flags */
 194         hdev->dev_flags &= ~HCI_PERSISTENT_MASK;
 195
 196         hdev->discovery.state = DISCOVERY_STOPPED;
 197         hdev->inq_tx_power = HCI_TX_POWER_INVALID;
 198         hdev->adv_tx_power = HCI_TX_POWER_INVALID;
 199
 200         memset(hdev->adv_data, 0, sizeof(hdev->adv_data));
 201         hdev->adv_data_len = 0;
 202
 203         memset(hdev->scan_rsp_data, 0, sizeof(hdev->scan_rsp_data));
 204         hdev->scan_rsp_data_len = 0;
 205
 206         hdev->ssp_debug_mode = 0;
 207 }
 208
 209 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 210 {
 211         __u8 status = *((__u8 *) skb->data);
 212         void *sent;
 213
 214         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 215
 216         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
 217         if (!sent)
 218                 return;
 219
 220         hci_dev_lock(hdev);
 221
 222         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 223                 mgmt_set_local_name_complete(hdev, sent, status);
 224         else if (!status)
 225                 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
 226
 227         hci_dev_unlock(hdev);
 228 }
 229
 230 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 231 {
 232         struct hci_rp_read_local_name *rp = (void *) skb->data;
 233
 234         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 235
 236         if (rp->status)
 237                 return;
 238
 239         if (test_bit(HCI_SETUP, &hdev->dev_flags))
 240                 memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
 241 }
 242
 243 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
 244 {
 245         __u8 status = *((__u8 *) skb->data);
 246         void *sent;
 247
 248         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 249
 250         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
 251         if (!sent)
 252                 return;
 253
 254         if (!status) {
 255                 __u8 param = *((__u8 *) sent);
 256
 257                 if (param == AUTH_ENABLED)
 258                         set_bit(HCI_AUTH, &hdev->flags);
 259                 else
 260                         clear_bit(HCI_AUTH, &hdev->flags);
 261         }
 262
 263         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 264                 mgmt_auth_enable_complete(hdev, status);
 265 }
 266
 267 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
 268 {
 269         __u8 status = *((__u8 *) skb->data);
 270         void *sent;
 271
 272         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 273
 274         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
 275         if (!sent)
 276                 return;
 277
 278         if (!status) {
 279                 __u8 param = *((__u8 *) sent);
 280
 281                 if (param)
 282                         set_bit(HCI_ENCRYPT, &hdev->flags);
 283                 else
 284                         clear_bit(HCI_ENCRYPT, &hdev->flags);
 285         }
 286 }
 287
 288 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
 289 {
 290         __u8 param, status = *((__u8 *) skb->data);
 291         int old_pscan, old_iscan;
 292         void *sent;
 293
 294         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 295
 296         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
 297         if (!sent)
 298                 return;
 299
 300         param = *((__u8 *) sent);
 301
 302         hci_dev_lock(hdev);
 303
 304         if (status) {
 305                 mgmt_write_scan_failed(hdev, param, status);
 306                 hdev->discov_timeout = 0;
 307                 goto done;
 308         }
 309
 310         /* We need to ensure that we set this back on if someone changed
 311          * the scan mode through a raw HCI socket.
 312          */
 313         set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
 314
 315         old_pscan = test_and_clear_bit(HCI_PSCAN, &hdev->flags);
 316         old_iscan = test_and_clear_bit(HCI_ISCAN, &hdev->flags);
 317
 318         if (param & SCAN_INQUIRY) {
 319                 set_bit(HCI_ISCAN, &hdev->flags);
 320                 if (!old_iscan)
 321                         mgmt_discoverable(hdev, 1);
 322         } else if (old_iscan)
 323                 mgmt_discoverable(hdev, 0);
 324
 325         if (param & SCAN_PAGE) {
 326                 set_bit(HCI_PSCAN, &hdev->flags);
 327                 if (!old_pscan)
 328                         mgmt_connectable(hdev, 1);
 329         } else if (old_pscan)
 330                 mgmt_connectable(hdev, 0);
 331
 332 done:
 333         hci_dev_unlock(hdev);
 334 }
 335
 336 static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 337 {
 338         struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
 339
 340         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 341
 342         if (rp->status)
 343                 return;
 344
 345         memcpy(hdev->dev_class, rp->dev_class, 3);
 346
 347         BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
 348                hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
 349 }
 350
 351 static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 352 {
 353         __u8 status = *((__u8 *) skb->data);
 354         void *sent;
 355
 356         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 357
 358         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
 359         if (!sent)
 360                 return;
 361
 362         hci_dev_lock(hdev);
 363
 364         if (status == 0)
 365                 memcpy(hdev->dev_class, sent, 3);
 366
 367         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 368                 mgmt_set_class_of_dev_complete(hdev, sent, status);
 369
 370         hci_dev_unlock(hdev);
 371 }
 372
 373 static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 374 {
 375         struct hci_rp_read_voice_setting *rp = (void *) skb->data;
 376         __u16 setting;
 377
 378         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 379
 380         if (rp->status)
 381                 return;
 382
 383         setting = __le16_to_cpu(rp->voice_setting);
 384
 385         if (hdev->voice_setting == setting)
 386                 return;
 387
 388         hdev->voice_setting = setting;
 389
 390         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 391
 392         if (hdev->notify)
 393                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 394 }
 395
 396 static void hci_cc_write_voice_setting(struct hci_dev *hdev,
 397                                        struct sk_buff *skb)
 398 {
 399         __u8 status = *((__u8 *) skb->data);
 400         __u16 setting;
 401         void *sent;
 402
 403         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 404
 405         if (status)
 406                 return;
 407
 408         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
 409         if (!sent)
 410                 return;
 411
 412         setting = get_unaligned_le16(sent);
 413
 414         if (hdev->voice_setting == setting)
 415                 return;
 416
 417         hdev->voice_setting = setting;
 418
 419         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 420
 421         if (hdev->notify)
 422                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 423 }
 424
 425 static void hci_cc_read_num_supported_iac(struct hci_dev *hdev,
 426                                           struct sk_buff *skb)
 427 {
 428         struct hci_rp_read_num_supported_iac *rp = (void *) skb->data;
 429
 430         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 431
 432         if (rp->status)
 433                 return;
 434
 435         hdev->num_iac = rp->num_iac;
 436
 437         BT_DBG("%s num iac %d", hdev->name, hdev->num_iac);
 438 }
 439
 440 static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 441 {
 442         __u8 status = *((__u8 *) skb->data);
 443         struct hci_cp_write_ssp_mode *sent;
 444
 445         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 446
 447         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
 448         if (!sent)
 449                 return;
 450
 451         if (!status) {
 452                 if (sent->mode)
 453                         hdev->features[1][0] |= LMP_HOST_SSP;
 454                 else
 455                         hdev->features[1][0] &= ~LMP_HOST_SSP;
 456         }
 457
 458         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 459                 mgmt_ssp_enable_complete(hdev, sent->mode, status);
 460         else if (!status) {
 461                 if (sent->mode)
 462                         set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
 463                 else
 464                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
 465         }
 466 }
 467
 468 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
 469 {
 470         struct hci_rp_read_local_version *rp = (void *) skb->data;
 471
 472         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 473
 474         if (rp->status)
 475                 return;
 476
 477         if (test_bit(HCI_SETUP, &hdev->dev_flags)) {
 478                 hdev->hci_ver = rp->hci_ver;
 479                 hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
 480                 hdev->lmp_ver = rp->lmp_ver;
 481                 hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
 482                 hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
 483         }
 484 }
 485
 486 static void hci_cc_read_local_commands(struct hci_dev *hdev,
 487                                        struct sk_buff *skb)
 488 {
 489         struct hci_rp_read_local_commands *rp = (void *) skb->data;
 490
 491         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 492
 493         if (rp->status)
 494                 return;
 495
 496         if (test_bit(HCI_SETUP, &hdev->dev_flags))
 497                 memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 498 }
 499
 500 static void hci_cc_read_local_features(struct hci_dev *hdev,
 501                                        struct sk_buff *skb)
 502 {
 503         struct hci_rp_read_local_features *rp = (void *) skb->data;
 504
 505         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 506
 507         if (rp->status)
 508                 return;
 509
 510         memcpy(hdev->features, rp->features, 8);
 511
 512         /* Adjust default settings according to features
 513          * supported by device. */
 514
 515         if (hdev->features[0][0] & LMP_3SLOT)
 516                 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 517
 518         if (hdev->features[0][0] & LMP_5SLOT)
 519                 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 520
 521         if (hdev->features[0][1] & LMP_HV2) {
 522                 hdev->pkt_type  |= (HCI_HV2);
 523                 hdev->esco_type |= (ESCO_HV2);
 524         }
 525
 526         if (hdev->features[0][1] & LMP_HV3) {
 527                 hdev->pkt_type  |= (HCI_HV3);
 528                 hdev->esco_type |= (ESCO_HV3);
 529         }
 530
 531         if (lmp_esco_capable(hdev))
 532                 hdev->esco_type |= (ESCO_EV3);
 533
 534         if (hdev->features[0][4] & LMP_EV4)
 535                 hdev->esco_type |= (ESCO_EV4);
 536
 537         if (hdev->features[0][4] & LMP_EV5)
 538                 hdev->esco_type |= (ESCO_EV5);
 539
 540         if (hdev->features[0][5] & LMP_EDR_ESCO_2M)
 541                 hdev->esco_type |= (ESCO_2EV3);
 542
 543         if (hdev->features[0][5] & LMP_EDR_ESCO_3M)
 544                 hdev->esco_type |= (ESCO_3EV3);
 545
 546         if (hdev->features[0][5] & LMP_EDR_3S_ESCO)
 547                 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
 548 }
 549
 550 static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
 551                                            struct sk_buff *skb)
 552 {
 553         struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
 554
 555         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 556
 557         if (rp->status)
 558                 return;
 559
 560         if (hdev->max_page < rp->max_page)
 561                 hdev->max_page = rp->max_page;
 562
 563         if (rp->page < HCI_MAX_PAGES)
 564                 memcpy(hdev->features[rp->page], rp->features, 8);
 565 }
 566
 567 static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
 568                                           struct sk_buff *skb)
 569 {
 570         struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;
 571
 572         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 573
 574         if (!rp->status)
 575                 hdev->flow_ctl_mode = rp->mode;
 576 }
 577
 578 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 579 {
 580         struct hci_rp_read_buffer_size *rp = (void *) skb->data;
 581
 582         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 583
 584         if (rp->status)
 585                 return;
 586
 587         hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
 588         hdev->sco_mtu  = rp->sco_mtu;
 589         hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
 590         hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
 591
 592         if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
 593                 hdev->sco_mtu  = 64;
 594                 hdev->sco_pkts = 8;
 595         }
 596
 597         hdev->acl_cnt = hdev->acl_pkts;
 598         hdev->sco_cnt = hdev->sco_pkts;
 599
 600         BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
 601                hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
 602 }
 603
 604 static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
 605 {
 606         struct hci_rp_read_bd_addr *rp = (void *) skb->data;
 607
 608         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 609
 610         if (!rp->status)
 611                 bacpy(&hdev->bdaddr, &rp->bdaddr);
 612 }
 613
 614 static void hci_cc_read_page_scan_activity(struct hci_dev *hdev,
 615                                            struct sk_buff *skb)
 616 {
 617         struct hci_rp_read_page_scan_activity *rp = (void *) skb->data;
 618
 619         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 620
 621         if (test_bit(HCI_INIT, &hdev->flags) && !rp->status) {
 622                 hdev->page_scan_interval = __le16_to_cpu(rp->interval);
 623                 hdev->page_scan_window = __le16_to_cpu(rp->window);
 624         }
 625 }
 626
 627 static void hci_cc_write_page_scan_activity(struct hci_dev *hdev,
 628                                             struct sk_buff *skb)
 629 {
 630         u8 status = *((u8 *) skb->data);
 631         struct hci_cp_write_page_scan_activity *sent;
 632
 633         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 634
 635         if (status)
 636                 return;
 637
 638         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY);
 639         if (!sent)
 640                 return;
 641
 642         hdev->page_scan_interval = __le16_to_cpu(sent->interval);
 643         hdev->page_scan_window = __le16_to_cpu(sent->window);
 644 }
 645
 646 static void hci_cc_read_page_scan_type(struct hci_dev *hdev,
 647                                            struct sk_buff *skb)
 648 {
 649         struct hci_rp_read_page_scan_type *rp = (void *) skb->data;
 650
 651         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 652
 653         if (test_bit(HCI_INIT, &hdev->flags) && !rp->status)
 654                 hdev->page_scan_type = rp->type;
 655 }
 656
 657 static void hci_cc_write_page_scan_type(struct hci_dev *hdev,
 658                                         struct sk_buff *skb)
 659 {
 660         u8 status = *((u8 *) skb->data);
 661         u8 *type;
 662
 663         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 664
 665         if (status)
 666                 return;
 667
 668         type = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE);
 669         if (type)
 670                 hdev->page_scan_type = *type;
 671 }
 672
 673 static void hci_cc_read_data_block_size(struct hci_dev *hdev,
 674                                         struct sk_buff *skb)
 675 {
 676         struct hci_rp_read_data_block_size *rp = (void *) skb->data;
 677
 678         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 679
 680         if (rp->status)
 681                 return;
 682
 683         hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
 684         hdev->block_len = __le16_to_cpu(rp->block_len);
 685         hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
 686
 687         hdev->block_cnt = hdev->num_blocks;
 688
 689         BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
 690                hdev->block_cnt, hdev->block_len);
 691 }
 692
 693 static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
 694                                        struct sk_buff *skb)
 695 {
 696         struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
 697
 698         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 699
 700         if (rp->status)
 701                 goto a2mp_rsp;
 702
 703         hdev->amp_status = rp->amp_status;
 704         hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
 705         hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
 706         hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
 707         hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
 708         hdev->amp_type = rp->amp_type;
 709         hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
 710         hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
 711         hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
 712         hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
 713
 714 a2mp_rsp:
 715         a2mp_send_getinfo_rsp(hdev);
 716 }
 717
 718 static void hci_cc_read_local_amp_assoc(struct hci_dev *hdev,
 719                                         struct sk_buff *skb)
 720 {
 721         struct hci_rp_read_local_amp_assoc *rp = (void *) skb->data;
 722         struct amp_assoc *assoc = &hdev->loc_assoc;
 723         size_t rem_len, frag_len;
 724
 725         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 726
 727         if (rp->status)
 728                 goto a2mp_rsp;
 729
 730         frag_len = skb->len - sizeof(*rp);
 731         rem_len = __le16_to_cpu(rp->rem_len);
 732
 733         if (rem_len > frag_len) {
 734                 BT_DBG("frag_len %zu rem_len %zu", frag_len, rem_len);
 735
 736                 memcpy(assoc->data + assoc->offset, rp->frag, frag_len);
 737                 assoc->offset += frag_len;
 738
 739                 /* Read other fragments */
 740                 amp_read_loc_assoc_frag(hdev, rp->phy_handle);
 741
 742                 return;
 743         }
 744
 745         memcpy(assoc->data + assoc->offset, rp->frag, rem_len);
 746         assoc->len = assoc->offset + rem_len;
 747         assoc->offset = 0;
 748
 749 a2mp_rsp:
 750         /* Send A2MP Rsp when all fragments are received */
 751         a2mp_send_getampassoc_rsp(hdev, rp->status);
 752         a2mp_send_create_phy_link_req(hdev, rp->status);
 753 }
 754
 755 static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
 756                                          struct sk_buff *skb)
 757 {
 758         struct hci_rp_read_inq_rsp_tx_power *rp = (void *) skb->data;
 759
 760         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 761
 762         if (!rp->status)
 763                 hdev->inq_tx_power = rp->tx_power;
 764 }
 765
 766 static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
 767 {
 768         struct hci_rp_pin_code_reply *rp = (void *) skb->data;
 769         struct hci_cp_pin_code_reply *cp;
 770         struct hci_conn *conn;
 771
 772         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 773
 774         hci_dev_lock(hdev);
 775
 776         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 777                 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
 778
 779         if (rp->status)
 780                 goto unlock;
 781
 782         cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
 783         if (!cp)
 784                 goto unlock;
 785
 786         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 787         if (conn)
 788                 conn->pin_length = cp->pin_len;
 789
 790 unlock:
 791         hci_dev_unlock(hdev);
 792 }
 793
 794 static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
 795 {
 796         struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
 797
 798         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 799
 800         hci_dev_lock(hdev);
 801
 802         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 803                 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
 804                                                  rp->status);
 805
 806         hci_dev_unlock(hdev);
 807 }
 808
 809 static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
 810                                        struct sk_buff *skb)
 811 {
 812         struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
 813
 814         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 815
 816         if (rp->status)
 817                 return;
 818
 819         hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
 820         hdev->le_pkts = rp->le_max_pkt;
 821
 822         hdev->le_cnt = hdev->le_pkts;
 823
 824         BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
 825 }
 826
 827 static void hci_cc_le_read_local_features(struct hci_dev *hdev,
 828                                           struct sk_buff *skb)
 829 {
 830         struct hci_rp_le_read_local_features *rp = (void *) skb->data;
 831
 832         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 833
 834         if (!rp->status)
 835                 memcpy(hdev->le_features, rp->features, 8);
 836 }
 837
 838 static void hci_cc_le_read_adv_tx_power(struct hci_dev *hdev,
 839                                         struct sk_buff *skb)
 840 {
 841         struct hci_rp_le_read_adv_tx_power *rp = (void *) skb->data;
 842
 843         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 844
 845         if (!rp->status)
 846                 hdev->adv_tx_power = rp->tx_power;
 847 }
 848
 849 static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
 850 {
 851         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 852
 853         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 854
 855         hci_dev_lock(hdev);
 856
 857         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 858                 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,
 859                                                  rp->status);
 860
 861         hci_dev_unlock(hdev);
 862 }
 863
 864 static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
 865                                           struct sk_buff *skb)
 866 {
 867         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 868
 869         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 870
 871         hci_dev_lock(hdev);
 872
 873         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 874                 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
 875                                                      ACL_LINK, 0, rp->status);
 876
 877         hci_dev_unlock(hdev);
 878 }
 879
 880 static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
 881 {
 882         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 883
 884         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 885
 886         hci_dev_lock(hdev);
 887
 888         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 889                 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
 890                                                  0, rp->status);
 891
 892         hci_dev_unlock(hdev);
 893 }
 894
 895 static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
 896                                           struct sk_buff *skb)
 897 {
 898         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 899
 900         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 901
 902         hci_dev_lock(hdev);
 903
 904         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 905                 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
 906                                                      ACL_LINK, 0, rp->status);
 907
 908         hci_dev_unlock(hdev);
 909 }
 910
 911 static void hci_cc_read_local_oob_data_reply(struct hci_dev *hdev,
 912                                              struct sk_buff *skb)
 913 {
 914         struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
 915
 916         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 917
 918         hci_dev_lock(hdev);
 919         mgmt_read_local_oob_data_reply_complete(hdev, rp->hash,
 920                                                 rp->randomizer, rp->status);
 921         hci_dev_unlock(hdev);
 922 }
 923
 924 static void hci_cc_le_set_adv_enable(struct hci_dev *hdev, struct sk_buff *skb)
 925 {
 926         __u8 *sent, status = *((__u8 *) skb->data);
 927
 928         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 929
 930         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_ENABLE);
 931         if (!sent)
 932                 return;
 933
 934         hci_dev_lock(hdev);
 935
 936         if (!status) {
 937                 if (*sent)
 938                         set_bit(HCI_ADVERTISING, &hdev->dev_flags);
 939                 else
 940                         clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
 941         }
 942
 943         hci_dev_unlock(hdev);
 944 }
 945
 946 static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
 947                                       struct sk_buff *skb)
 948 {
 949         struct hci_cp_le_set_scan_enable *cp;
 950         __u8 status = *((__u8 *) skb->data);
 951
 952         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 953
 954         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
 955         if (!cp)
 956                 return;
 957
 958         if (status)
 959                 return;
 960
 961         switch (cp->enable) {
 962         case LE_SCAN_ENABLE:
 963                 set_bit(HCI_LE_SCAN, &hdev->dev_flags);
 964                 break;
 965
 966         case LE_SCAN_DISABLE:
 967                 clear_bit(HCI_LE_SCAN, &hdev->dev_flags);
 968                 break;
 969
 970         default:
 971                 BT_ERR("Used reserved LE_Scan_Enable param %d", cp->enable);
 972                 break;
 973         }
 974 }
 975
 976 static void hci_cc_le_read_white_list_size(struct hci_dev *hdev,
 977                                            struct sk_buff *skb)
 978 {
 979         struct hci_rp_le_read_white_list_size *rp = (void *) skb->data;
 980
 981         BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
 982
 983         if (!rp->status)
 984                 hdev->le_white_list_size = rp->size;
 985 }
 986
 987 static void hci_cc_le_read_supported_states(struct hci_dev *hdev,
 988                                             struct sk_buff *skb)
 989 {
 990         struct hci_rp_le_read_supported_states *rp = (void *) skb->data;
 991
 992         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 993
 994         if (!rp->status)
 995                 memcpy(hdev->le_states, rp->le_states, 8);
 996 }
 997
 998 static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
 999                                            struct sk_buff *skb)
1000 {
1001         struct hci_cp_write_le_host_supported *sent;
1002         __u8 status = *((__u8 *) skb->data);
1003
1004         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1005
1006         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
1007         if (!sent)
1008                 return;
1009
1010         if (!status) {
1011                 if (sent->le) {
1012                         hdev->features[1][0] |= LMP_HOST_LE;
1013                         set_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1014                 } else {
1015                         hdev->features[1][0] &= ~LMP_HOST_LE;
1016                         clear_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1017                         clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
1018                 }
1019
1020                 if (sent->simul)
1021                         hdev->features[1][0] |= LMP_HOST_LE_BREDR;
1022                 else
1023                         hdev->features[1][0] &= ~LMP_HOST_LE_BREDR;
1024         }
1025 }
1026
1027 static void hci_cc_write_remote_amp_assoc(struct hci_dev *hdev,
1028                                           struct sk_buff *skb)
1029 {
1030         struct hci_rp_write_remote_amp_assoc *rp = (void *) skb->data;
1031
1032         BT_DBG("%s status 0x%2.2x phy_handle 0x%2.2x",
1033                hdev->name, rp->status, rp->phy_handle);
1034
1035         if (rp->status)
1036                 return;
1037
1038         amp_write_rem_assoc_continue(hdev, rp->phy_handle);
1039 }
1040
1041 static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
1042 {
1043         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1044
1045         if (status) {
1046                 hci_conn_check_pending(hdev);
1047                 return;
1048         }
1049
1050         set_bit(HCI_INQUIRY, &hdev->flags);
1051 }
1052
1053 static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
1054 {
1055         struct hci_cp_create_conn *cp;
1056         struct hci_conn *conn;
1057
1058         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1059
1060         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
1061         if (!cp)
1062                 return;
1063
1064         hci_dev_lock(hdev);
1065
1066         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1067
1068         BT_DBG("%s bdaddr %pMR hcon %p", hdev->name, &cp->bdaddr, conn);
1069
1070         if (status) {
1071                 if (conn && conn->state == BT_CONNECT) {
1072                         if (status != 0x0c || conn->attempt > 2) {
1073                                 conn->state = BT_CLOSED;
1074                                 hci_proto_connect_cfm(conn, status);
1075                                 hci_conn_del(conn);
1076                         } else
1077                                 conn->state = BT_CONNECT2;
1078                 }
1079         } else {
1080                 if (!conn) {
1081                         conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr);
1082                         if (conn) {
1083                                 conn->out = true;
1084                                 conn->link_mode |= HCI_LM_MASTER;
1085                         } else
1086                                 BT_ERR("No memory for new connection");
1087                 }
1088         }
1089
1090         hci_dev_unlock(hdev);
1091 }
1092
1093 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
1094 {
1095         struct hci_cp_add_sco *cp;
1096         struct hci_conn *acl, *sco;
1097         __u16 handle;
1098
1099         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1100
1101         if (!status)
1102                 return;
1103
1104         cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
1105         if (!cp)
1106                 return;
1107
1108         handle = __le16_to_cpu(cp->handle);
1109
1110         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1111
1112         hci_dev_lock(hdev);
1113
1114         acl = hci_conn_hash_lookup_handle(hdev, handle);
1115         if (acl) {
1116                 sco = acl->link;
1117                 if (sco) {
1118                         sco->state = BT_CLOSED;
1119
1120                         hci_proto_connect_cfm(sco, status);
1121                         hci_conn_del(sco);
1122                 }
1123         }
1124
1125         hci_dev_unlock(hdev);
1126 }
1127
1128 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
1129 {
1130         struct hci_cp_auth_requested *cp;
1131         struct hci_conn *conn;
1132
1133         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1134
1135         if (!status)
1136                 return;
1137
1138         cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
1139         if (!cp)
1140                 return;
1141
1142         hci_dev_lock(hdev);
1143
1144         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1145         if (conn) {
1146                 if (conn->state == BT_CONFIG) {
1147                         hci_proto_connect_cfm(conn, status);
1148                         hci_conn_drop(conn);
1149                 }
1150         }
1151
1152         hci_dev_unlock(hdev);
1153 }
1154
1155 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
1156 {
1157         struct hci_cp_set_conn_encrypt *cp;
1158         struct hci_conn *conn;
1159
1160         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1161
1162         if (!status)
1163                 return;
1164
1165         cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
1166         if (!cp)
1167                 return;
1168
1169         hci_dev_lock(hdev);
1170
1171         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1172         if (conn) {
1173                 if (conn->state == BT_CONFIG) {
1174                         hci_proto_connect_cfm(conn, status);
1175                         hci_conn_drop(conn);
1176                 }
1177         }
1178
1179         hci_dev_unlock(hdev);
1180 }
1181
1182 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
1183                                     struct hci_conn *conn)
1184 {
1185         if (conn->state != BT_CONFIG || !conn->out)
1186                 return 0;
1187
1188         if (conn->pending_sec_level == BT_SECURITY_SDP)
1189                 return 0;
1190
1191         /* Only request authentication for SSP connections or non-SSP
1192          * devices with sec_level HIGH or if MITM protection is requested */
1193         if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
1194             conn->pending_sec_level != BT_SECURITY_HIGH)
1195                 return 0;
1196
1197         return 1;
1198 }
1199
1200 static int hci_resolve_name(struct hci_dev *hdev,
1201                                    struct inquiry_entry *e)
1202 {
1203         struct hci_cp_remote_name_req cp;
1204
1205         memset(&cp, 0, sizeof(cp));
1206
1207         bacpy(&cp.bdaddr, &e->data.bdaddr);
1208         cp.pscan_rep_mode = e->data.pscan_rep_mode;
1209         cp.pscan_mode = e->data.pscan_mode;
1210         cp.clock_offset = e->data.clock_offset;
1211
1212         return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1213 }
1214
1215 static bool hci_resolve_next_name(struct hci_dev *hdev)
1216 {
1217         struct discovery_state *discov = &hdev->discovery;
1218         struct inquiry_entry *e;
1219
1220         if (list_empty(&discov->resolve))
1221                 return false;
1222
1223         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
1224         if (!e)
1225                 return false;
1226
1227         if (hci_resolve_name(hdev, e) == 0) {
1228                 e->name_state = NAME_PENDING;
1229                 return true;
1230         }
1231
1232         return false;
1233 }
1234
1235 static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
1236                                    bdaddr_t *bdaddr, u8 *name, u8 name_len)
1237 {
1238         struct discovery_state *discov = &hdev->discovery;
1239         struct inquiry_entry *e;
1240
1241         if (conn && !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
1242                 mgmt_device_connected(hdev, bdaddr, ACL_LINK, 0x00, 0, name,
1243                                       name_len, conn->dev_class);
1244
1245         if (discov->state == DISCOVERY_STOPPED)
1246                 return;
1247
1248         if (discov->state == DISCOVERY_STOPPING)
1249                 goto discov_complete;
1250
1251         if (discov->state != DISCOVERY_RESOLVING)
1252                 return;
1253
1254         e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
1255         /* If the device was not found in a list of found devices names of which
1256          * are pending. there is no need to continue resolving a next name as it
1257          * will be done upon receiving another Remote Name Request Complete
1258          * Event */
1259         if (!e)
1260                 return;
1261
1262         list_del(&e->list);
1263         if (name) {
1264                 e->name_state = NAME_KNOWN;
1265                 mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
1266                                  e->data.rssi, name, name_len);
1267         } else {
1268                 e->name_state = NAME_NOT_KNOWN;
1269         }
1270
1271         if (hci_resolve_next_name(hdev))
1272                 return;
1273
1274 discov_complete:
1275         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1276 }
1277
1278 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
1279 {
1280         struct hci_cp_remote_name_req *cp;
1281         struct hci_conn *conn;
1282
1283         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1284
1285         /* If successful wait for the name req complete event before
1286          * checking for the need to do authentication */
1287         if (!status)
1288                 return;
1289
1290         cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
1291         if (!cp)
1292                 return;
1293
1294         hci_dev_lock(hdev);
1295
1296         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1297
1298         if (test_bit(HCI_MGMT, &hdev->dev_flags))
1299                 hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
1300
1301         if (!conn)
1302                 goto unlock;
1303
1304         if (!hci_outgoing_auth_needed(hdev, conn))
1305                 goto unlock;
1306
1307         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
1308                 struct hci_cp_auth_requested auth_cp;
1309
1310                 auth_cp.handle = __cpu_to_le16(conn->handle);
1311                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
1312                              sizeof(auth_cp), &auth_cp);
1313         }
1314
1315 unlock:
1316         hci_dev_unlock(hdev);
1317 }
1318
1319 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
1320 {
1321         struct hci_cp_read_remote_features *cp;
1322         struct hci_conn *conn;
1323
1324         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1325
1326         if (!status)
1327                 return;
1328
1329         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
1330         if (!cp)
1331                 return;
1332
1333         hci_dev_lock(hdev);
1334
1335         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1336         if (conn) {
1337                 if (conn->state == BT_CONFIG) {
1338                         hci_proto_connect_cfm(conn, status);
1339                         hci_conn_drop(conn);
1340                 }
1341         }
1342
1343         hci_dev_unlock(hdev);
1344 }
1345
1346 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
1347 {
1348         struct hci_cp_read_remote_ext_features *cp;
1349         struct hci_conn *conn;
1350
1351         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1352
1353         if (!status)
1354                 return;
1355
1356         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
1357         if (!cp)
1358                 return;
1359
1360         hci_dev_lock(hdev);
1361
1362         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1363         if (conn) {
1364                 if (conn->state == BT_CONFIG) {
1365                         hci_proto_connect_cfm(conn, status);
1366                         hci_conn_drop(conn);
1367                 }
1368         }
1369
1370         hci_dev_unlock(hdev);
1371 }
1372
1373 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
1374 {
1375         struct hci_cp_setup_sync_conn *cp;
1376         struct hci_conn *acl, *sco;
1377         __u16 handle;
1378
1379         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1380
1381         if (!status)
1382                 return;
1383
1384         cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
1385         if (!cp)
1386                 return;
1387
1388         handle = __le16_to_cpu(cp->handle);
1389
1390         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1391
1392         hci_dev_lock(hdev);
1393
1394         acl = hci_conn_hash_lookup_handle(hdev, handle);
1395         if (acl) {
1396                 sco = acl->link;
1397                 if (sco) {
1398                         sco->state = BT_CLOSED;
1399
1400                         hci_proto_connect_cfm(sco, status);
1401                         hci_conn_del(sco);
1402                 }
1403         }
1404
1405         hci_dev_unlock(hdev);
1406 }
1407
1408 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
1409 {
1410         struct hci_cp_sniff_mode *cp;
1411         struct hci_conn *conn;
1412
1413         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1414
1415         if (!status)
1416                 return;
1417
1418         cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
1419         if (!cp)
1420                 return;
1421
1422         hci_dev_lock(hdev);
1423
1424         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1425         if (conn) {
1426                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1427
1428                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
1429                         hci_sco_setup(conn, status);
1430         }
1431
1432         hci_dev_unlock(hdev);
1433 }
1434
1435 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
1436 {
1437         struct hci_cp_exit_sniff_mode *cp;
1438         struct hci_conn *conn;
1439
1440         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1441
1442         if (!status)
1443                 return;
1444
1445         cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
1446         if (!cp)
1447                 return;
1448
1449         hci_dev_lock(hdev);
1450
1451         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1452         if (conn) {
1453                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1454
1455                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
1456                         hci_sco_setup(conn, status);
1457         }
1458
1459         hci_dev_unlock(hdev);
1460 }
1461
1462 static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
1463 {
1464         struct hci_cp_disconnect *cp;
1465         struct hci_conn *conn;
1466
1467         if (!status)
1468                 return;
1469
1470         cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
1471         if (!cp)
1472                 return;
1473
1474         hci_dev_lock(hdev);
1475
1476         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1477         if (conn)
1478                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
1479                                        conn->dst_type, status);
1480
1481         hci_dev_unlock(hdev);
1482 }
1483
1484 static void hci_cs_create_phylink(struct hci_dev *hdev, u8 status)
1485 {
1486         struct hci_cp_create_phy_link *cp;
1487
1488         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1489
1490         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_PHY_LINK);
1491         if (!cp)
1492                 return;
1493
1494         hci_dev_lock(hdev);
1495
1496         if (status) {
1497                 struct hci_conn *hcon;
1498
1499                 hcon = hci_conn_hash_lookup_handle(hdev, cp->phy_handle);
1500                 if (hcon)
1501                         hci_conn_del(hcon);
1502         } else {
1503                 amp_write_remote_assoc(hdev, cp->phy_handle);
1504         }
1505
1506         hci_dev_unlock(hdev);
1507 }
1508
1509 static void hci_cs_accept_phylink(struct hci_dev *hdev, u8 status)
1510 {
1511         struct hci_cp_accept_phy_link *cp;
1512
1513         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1514
1515         if (status)
1516                 return;
1517
1518         cp = hci_sent_cmd_data(hdev, HCI_OP_ACCEPT_PHY_LINK);
1519         if (!cp)
1520                 return;
1521
1522         amp_write_remote_assoc(hdev, cp->phy_handle);
1523 }
1524
1525 static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1526 {
1527         __u8 status = *((__u8 *) skb->data);
1528         struct discovery_state *discov = &hdev->discovery;
1529         struct inquiry_entry *e;
1530
1531         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1532
1533         hci_conn_check_pending(hdev);
1534
1535         if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
1536                 return;
1537
1538         smp_mb__after_clear_bit(); /* wake_up_bit advises about this barrier */
1539         wake_up_bit(&hdev->flags, HCI_INQUIRY);
1540
1541         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
1542                 return;
1543
1544         hci_dev_lock(hdev);
1545
1546         if (discov->state != DISCOVERY_FINDING)
1547                 goto unlock;
1548
1549         if (list_empty(&discov->resolve)) {
1550                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1551                 goto unlock;
1552         }
1553
1554         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
1555         if (e && hci_resolve_name(hdev, e) == 0) {
1556                 e->name_state = NAME_PENDING;
1557                 hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
1558         } else {
1559                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1560         }
1561
1562 unlock:
1563         hci_dev_unlock(hdev);
1564 }
1565
1566 static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
1567 {
1568         struct inquiry_data data;
1569         struct inquiry_info *info = (void *) (skb->data + 1);
1570         int num_rsp = *((__u8 *) skb->data);
1571
1572         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
1573
1574         if (!num_rsp)
1575                 return;
1576
1577         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
1578                 return;
1579
1580         hci_dev_lock(hdev);
1581
1582         for (; num_rsp; num_rsp--, info++) {
1583                 bool name_known, ssp;
1584
1585                 bacpy(&data.bdaddr, &info->bdaddr);
1586                 data.pscan_rep_mode     = info->pscan_rep_mode;
1587                 data.pscan_period_mode  = info->pscan_period_mode;
1588                 data.pscan_mode         = info->pscan_mode;
1589                 memcpy(data.dev_class, info->dev_class, 3);
1590                 data.clock_offset       = info->clock_offset;
1591                 data.rssi               = 0x00;
1592                 data.ssp_mode           = 0x00;
1593
1594                 name_known = hci_inquiry_cache_update(hdev, &data, false, &ssp);
1595                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
1596                                   info->dev_class, 0, !name_known, ssp, NULL,
1597                                   0);
1598         }
1599
1600         hci_dev_unlock(hdev);
1601 }
1602
1603 static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1604 {
1605         struct hci_ev_conn_complete *ev = (void *) skb->data;
1606         struct hci_conn *conn;
1607
1608         BT_DBG("%s", hdev->name);
1609
1610         hci_dev_lock(hdev);
1611
1612         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
1613         if (!conn) {
1614                 if (ev->link_type != SCO_LINK)
1615                         goto unlock;
1616
1617                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
1618                 if (!conn)
1619                         goto unlock;
1620
1621                 conn->type = SCO_LINK;
1622         }
1623
1624         if (!ev->status) {
1625                 conn->handle = __le16_to_cpu(ev->handle);
1626
1627                 if (conn->type == ACL_LINK) {
1628                         conn->state = BT_CONFIG;
1629                         hci_conn_hold(conn);
1630
1631                         if (!conn->out && !hci_conn_ssp_enabled(conn) &&
1632                             !hci_find_link_key(hdev, &ev->bdaddr))
1633                                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
1634                         else
1635                                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
1636                 } else
1637                         conn->state = BT_CONNECTED;
1638
1639                 hci_conn_add_sysfs(conn);
1640
1641                 if (test_bit(HCI_AUTH, &hdev->flags))
1642                         conn->link_mode |= HCI_LM_AUTH;
1643
1644                 if (test_bit(HCI_ENCRYPT, &hdev->flags))
1645                         conn->link_mode |= HCI_LM_ENCRYPT;
1646
1647                 /* Get remote features */
1648                 if (conn->type == ACL_LINK) {
1649                         struct hci_cp_read_remote_features cp;
1650                         cp.handle = ev->handle;
1651                         hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
1652                                      sizeof(cp), &cp);
1653                 }
1654
1655                 /* Set packet type for incoming connection */
1656                 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
1657                         struct hci_cp_change_conn_ptype cp;
1658                         cp.handle = ev->handle;
1659                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
1660                         hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
1661                                      &cp);
1662                 }
1663         } else {
1664                 conn->state = BT_CLOSED;
1665                 if (conn->type == ACL_LINK)
1666                         mgmt_connect_failed(hdev, &ev->bdaddr, conn->type,
1667                                             conn->dst_type, ev->status);
1668         }
1669
1670         if (conn->type == ACL_LINK)
1671                 hci_sco_setup(conn, ev->status);
1672
1673         if (ev->status) {
1674                 hci_proto_connect_cfm(conn, ev->status);
1675                 hci_conn_del(conn);
1676         } else if (ev->link_type != ACL_LINK)
1677                 hci_proto_connect_cfm(conn, ev->status);
1678
1679 unlock:
1680         hci_dev_unlock(hdev);
1681
1682         hci_conn_check_pending(hdev);
1683 }
1684
1685 static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
1686 {
1687         struct hci_ev_conn_request *ev = (void *) skb->data;
1688         int mask = hdev->link_mode;
1689         __u8 flags = 0;
1690
1691         BT_DBG("%s bdaddr %pMR type 0x%x", hdev->name, &ev->bdaddr,
1692                ev->link_type);
1693
1694         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
1695                                       &flags);
1696
1697         if ((mask & HCI_LM_ACCEPT) &&
1698             !hci_blacklist_lookup(hdev, &ev->bdaddr, BDADDR_BREDR)) {
1699                 /* Connection accepted */
1700                 struct inquiry_entry *ie;
1701                 struct hci_conn *conn;
1702
1703                 hci_dev_lock(hdev);
1704
1705                 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
1706                 if (ie)
1707                         memcpy(ie->data.dev_class, ev->dev_class, 3);
1708
1709                 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
1710                                                &ev->bdaddr);
1711                 if (!conn) {
1712                         conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr);
1713                         if (!conn) {
1714                                 BT_ERR("No memory for new connection");
1715                                 hci_dev_unlock(hdev);
1716                                 return;
1717                         }
1718                 }
1719
1720                 memcpy(conn->dev_class, ev->dev_class, 3);
1721
1722                 hci_dev_unlock(hdev);
1723
1724                 if (ev->link_type == ACL_LINK ||
1725                     (!(flags & HCI_PROTO_DEFER) && !lmp_esco_capable(hdev))) {
1726                         struct hci_cp_accept_conn_req cp;
1727                         conn->state = BT_CONNECT;
1728
1729                         bacpy(&cp.bdaddr, &ev->bdaddr);
1730
1731                         if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
1732                                 cp.role = 0x00; /* Become master */
1733                         else
1734                                 cp.role = 0x01; /* Remain slave */
1735
1736                         hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp),
1737                                      &cp);
1738                 } else if (!(flags & HCI_PROTO_DEFER)) {
1739                         struct hci_cp_accept_sync_conn_req cp;
1740                         conn->state = BT_CONNECT;
1741
1742                         bacpy(&cp.bdaddr, &ev->bdaddr);
1743                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
1744
1745                         cp.tx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
1746                         cp.rx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
1747                         cp.max_latency    = __constant_cpu_to_le16(0xffff);
1748                         cp.content_format = cpu_to_le16(hdev->voice_setting);
1749                         cp.retrans_effort = 0xff;
1750
1751                         hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ,
1752                                      sizeof(cp), &cp);
1753                 } else {
1754                         conn->state = BT_CONNECT2;
1755                         hci_proto_connect_cfm(conn, 0);
1756                 }
1757         } else {
1758                 /* Connection rejected */
1759                 struct hci_cp_reject_conn_req cp;
1760
1761                 bacpy(&cp.bdaddr, &ev->bdaddr);
1762                 cp.reason = HCI_ERROR_REJ_BAD_ADDR;
1763                 hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
1764         }
1765 }
1766
1767 static u8 hci_to_mgmt_reason(u8 err)
1768 {
1769         switch (err) {
1770         case HCI_ERROR_CONNECTION_TIMEOUT:
1771                 return MGMT_DEV_DISCONN_TIMEOUT;
1772         case HCI_ERROR_REMOTE_USER_TERM:
1773         case HCI_ERROR_REMOTE_LOW_RESOURCES:
1774         case HCI_ERROR_REMOTE_POWER_OFF:
1775                 return MGMT_DEV_DISCONN_REMOTE;
1776         case HCI_ERROR_LOCAL_HOST_TERM:
1777                 return MGMT_DEV_DISCONN_LOCAL_HOST;
1778         default:
1779                 return MGMT_DEV_DISCONN_UNKNOWN;
1780         }
1781 }
1782
1783 static void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1784 {
1785         struct hci_ev_disconn_complete *ev = (void *) skb->data;
1786         u8 reason = hci_to_mgmt_reason(ev->reason);
1787         struct hci_conn *conn;
1788         u8 type;
1789
1790         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
1791
1792         hci_dev_lock(hdev);
1793
1794         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1795         if (!conn)
1796                 goto unlock;
1797
1798         if (ev->status) {
1799                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
1800                                        conn->dst_type, ev->status);
1801                 goto unlock;
1802         }
1803
1804         conn->state = BT_CLOSED;
1805
1806         if (test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
1807                 mgmt_device_disconnected(hdev, &conn->dst, conn->type,
1808                                          conn->dst_type, reason);
1809
1810         if (conn->type == ACL_LINK && conn->flush_key)
1811                 hci_remove_link_key(hdev, &conn->dst);
1812
1813         type = conn->type;
1814
1815         hci_proto_disconn_cfm(conn, ev->reason);
1816         hci_conn_del(conn);
1817
1818         /* Re-enable advertising if necessary, since it might
1819          * have been disabled by the connection. From the
1820          * HCI_LE_Set_Advertise_Enable command description in
1821          * the core specification (v4.0):
1822          * "The Controller shall continue advertising until the Host
1823          * issues an LE_Set_Advertise_Enable command with
1824          * Advertising_Enable set to 0x00 (Advertising is disabled)
1825          * or until a connection is created or until the Advertising
1826          * is timed out due to Directed Advertising."
1827          */
1828         if (type == LE_LINK)
1829                 mgmt_reenable_advertising(hdev);
1830
1831 unlock:
1832         hci_dev_unlock(hdev);
1833 }
1834
1835 static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1836 {
1837         struct hci_ev_auth_complete *ev = (void *) skb->data;
1838         struct hci_conn *conn;
1839
1840         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
1841
1842         hci_dev_lock(hdev);
1843
1844         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1845         if (!conn)
1846                 goto unlock;
1847
1848         if (!ev->status) {
1849                 if (!hci_conn_ssp_enabled(conn) &&
1850                     test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
1851                         BT_INFO("re-auth of legacy device is not possible.");
1852                 } else {
1853                         conn->link_mode |= HCI_LM_AUTH;
1854                         conn->sec_level = conn->pending_sec_level;
1855                 }
1856         } else {
1857                 mgmt_auth_failed(hdev, &conn->dst, conn->type, conn->dst_type,
1858                                  ev->status);
1859         }
1860
1861         clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
1862         clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
1863
1864         if (conn->state == BT_CONFIG) {
1865                 if (!ev->status && hci_conn_ssp_enabled(conn)) {
1866                         struct hci_cp_set_conn_encrypt cp;
1867                         cp.handle  = ev->handle;
1868                         cp.encrypt = 0x01;
1869                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
1870                                      &cp);
1871                 } else {
1872                         conn->state = BT_CONNECTED;
1873                         hci_proto_connect_cfm(conn, ev->status);
1874                         hci_conn_drop(conn);
1875                 }
1876         } else {
1877                 hci_auth_cfm(conn, ev->status);
1878
1879                 hci_conn_hold(conn);
1880                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
1881                 hci_conn_drop(conn);
1882         }
1883
1884         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
1885                 if (!ev->status) {
1886                         struct hci_cp_set_conn_encrypt cp;
1887                         cp.handle  = ev->handle;
1888                         cp.encrypt = 0x01;
1889                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
1890                                      &cp);
1891                 } else {
1892                         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
1893                         hci_encrypt_cfm(conn, ev->status, 0x00);
1894                 }
1895         }
1896
1897 unlock:
1898         hci_dev_unlock(hdev);
1899 }
1900
1901 static void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
1902 {
1903         struct hci_ev_remote_name *ev = (void *) skb->data;
1904         struct hci_conn *conn;
1905
1906         BT_DBG("%s", hdev->name);
1907
1908         hci_conn_check_pending(hdev);
1909
1910         hci_dev_lock(hdev);
1911
1912         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
1913
1914         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
1915                 goto check_auth;
1916
1917         if (ev->status == 0)
1918                 hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
1919                                        strnlen(ev->name, HCI_MAX_NAME_LENGTH));
1920         else
1921                 hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
1922
1923 check_auth:
1924         if (!conn)
1925                 goto unlock;
1926
1927         if (!hci_outgoing_auth_needed(hdev, conn))
1928                 goto unlock;
1929
1930         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
1931                 struct hci_cp_auth_requested cp;
1932                 cp.handle = __cpu_to_le16(conn->handle);
1933                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
1934         }
1935
1936 unlock:
1937         hci_dev_unlock(hdev);
1938 }
1939
1940 static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
1941 {
1942         struct hci_ev_encrypt_change *ev = (void *) skb->data;
1943         struct hci_conn *conn;
1944
1945         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
1946
1947         hci_dev_lock(hdev);
1948
1949         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1950         if (conn) {
1951                 if (!ev->status) {
1952                         if (ev->encrypt) {
1953                                 /* Encryption implies authentication */
1954                                 conn->link_mode |= HCI_LM_AUTH;
1955                                 conn->link_mode |= HCI_LM_ENCRYPT;
1956                                 conn->sec_level = conn->pending_sec_level;
1957                         } else
1958                                 conn->link_mode &= ~HCI_LM_ENCRYPT;
1959                 }
1960
1961                 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
1962
1963                 if (ev->status && conn->state == BT_CONNECTED) {
1964                         hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
1965                         hci_conn_drop(conn);
1966                         goto unlock;
1967                 }
1968
1969                 if (conn->state == BT_CONFIG) {
1970                         if (!ev->status)
1971                                 conn->state = BT_CONNECTED;
1972
1973                         hci_proto_connect_cfm(conn, ev->status);
1974                         hci_conn_drop(conn);
1975                 } else
1976                         hci_encrypt_cfm(conn, ev->status, ev->encrypt);
1977         }
1978
1979 unlock:
1980         hci_dev_unlock(hdev);
1981 }
1982
1983 static void hci_change_link_key_complete_evt(struct hci_dev *hdev,
1984                                              struct sk_buff *skb)
1985 {
1986         struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
1987         struct hci_conn *conn;
1988
1989         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
1990
1991         hci_dev_lock(hdev);
1992
1993         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1994         if (conn) {
1995                 if (!ev->status)
1996                         conn->link_mode |= HCI_LM_SECURE;
1997
1998                 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
1999
2000                 hci_key_change_cfm(conn, ev->status);
2001         }
2002
2003         hci_dev_unlock(hdev);
2004 }
2005
2006 static void hci_remote_features_evt(struct hci_dev *hdev,
2007                                     struct sk_buff *skb)
2008 {
2009         struct hci_ev_remote_features *ev = (void *) skb->data;
2010         struct hci_conn *conn;
2011
2012         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2013
2014         hci_dev_lock(hdev);
2015
2016         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2017         if (!conn)
2018                 goto unlock;
2019
2020         if (!ev->status)
2021                 memcpy(conn->features[0], ev->features, 8);
2022
2023         if (conn->state != BT_CONFIG)
2024                 goto unlock;
2025
2026         if (!ev->status && lmp_ssp_capable(hdev) && lmp_ssp_capable(conn)) {
2027                 struct hci_cp_read_remote_ext_features cp;
2028                 cp.handle = ev->handle;
2029                 cp.page = 0x01;
2030                 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
2031                              sizeof(cp), &cp);
2032                 goto unlock;
2033         }
2034
2035         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
2036                 struct hci_cp_remote_name_req cp;
2037                 memset(&cp, 0, sizeof(cp));
2038                 bacpy(&cp.bdaddr, &conn->dst);
2039                 cp.pscan_rep_mode = 0x02;
2040                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2041         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2042                 mgmt_device_connected(hdev, &conn->dst, conn->type,
2043                                       conn->dst_type, 0, NULL, 0,
2044                                       conn->dev_class);
2045
2046         if (!hci_outgoing_auth_needed(hdev, conn)) {
2047                 conn->state = BT_CONNECTED;
2048                 hci_proto_connect_cfm(conn, ev->status);
2049                 hci_conn_drop(conn);
2050         }
2051
2052 unlock:
2053         hci_dev_unlock(hdev);
2054 }
2055
2056 static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2057 {
2058         struct hci_ev_cmd_complete *ev = (void *) skb->data;
2059         u8 status = skb->data[sizeof(*ev)];
2060         __u16 opcode;
2061
2062         skb_pull(skb, sizeof(*ev));
2063
2064         opcode = __le16_to_cpu(ev->opcode);
2065
2066         switch (opcode) {
2067         case HCI_OP_INQUIRY_CANCEL:
2068                 hci_cc_inquiry_cancel(hdev, skb);
2069                 break;
2070
2071         case HCI_OP_PERIODIC_INQ:
2072                 hci_cc_periodic_inq(hdev, skb);
2073                 break;
2074
2075         case HCI_OP_EXIT_PERIODIC_INQ:
2076                 hci_cc_exit_periodic_inq(hdev, skb);
2077                 break;
2078
2079         case HCI_OP_REMOTE_NAME_REQ_CANCEL:
2080                 hci_cc_remote_name_req_cancel(hdev, skb);
2081                 break;
2082
2083         case HCI_OP_ROLE_DISCOVERY:
2084                 hci_cc_role_discovery(hdev, skb);
2085                 break;
2086
2087         case HCI_OP_READ_LINK_POLICY:
2088                 hci_cc_read_link_policy(hdev, skb);
2089                 break;
2090
2091         case HCI_OP_WRITE_LINK_POLICY:
2092                 hci_cc_write_link_policy(hdev, skb);
2093                 break;
2094
2095         case HCI_OP_READ_DEF_LINK_POLICY:
2096                 hci_cc_read_def_link_policy(hdev, skb);
2097                 break;
2098
2099         case HCI_OP_WRITE_DEF_LINK_POLICY:
2100                 hci_cc_write_def_link_policy(hdev, skb);
2101                 break;
2102
2103         case HCI_OP_RESET:
2104                 hci_cc_reset(hdev, skb);
2105                 break;
2106
2107         case HCI_OP_WRITE_LOCAL_NAME:
2108                 hci_cc_write_local_name(hdev, skb);
2109                 break;
2110
2111         case HCI_OP_READ_LOCAL_NAME:
2112                 hci_cc_read_local_name(hdev, skb);
2113                 break;
2114
2115         case HCI_OP_WRITE_AUTH_ENABLE:
2116                 hci_cc_write_auth_enable(hdev, skb);
2117                 break;
2118
2119         case HCI_OP_WRITE_ENCRYPT_MODE:
2120                 hci_cc_write_encrypt_mode(hdev, skb);
2121                 break;
2122
2123         case HCI_OP_WRITE_SCAN_ENABLE:
2124                 hci_cc_write_scan_enable(hdev, skb);
2125                 break;
2126
2127         case HCI_OP_READ_CLASS_OF_DEV:
2128                 hci_cc_read_class_of_dev(hdev, skb);
2129                 break;
2130
2131         case HCI_OP_WRITE_CLASS_OF_DEV:
2132                 hci_cc_write_class_of_dev(hdev, skb);
2133                 break;
2134
2135         case HCI_OP_READ_VOICE_SETTING:
2136                 hci_cc_read_voice_setting(hdev, skb);
2137                 break;
2138
2139         case HCI_OP_WRITE_VOICE_SETTING:
2140                 hci_cc_write_voice_setting(hdev, skb);
2141                 break;
2142
2143         case HCI_OP_READ_NUM_SUPPORTED_IAC:
2144                 hci_cc_read_num_supported_iac(hdev, skb);
2145                 break;
2146
2147         case HCI_OP_WRITE_SSP_MODE:
2148                 hci_cc_write_ssp_mode(hdev, skb);
2149                 break;
2150
2151         case HCI_OP_READ_LOCAL_VERSION:
2152                 hci_cc_read_local_version(hdev, skb);
2153                 break;
2154
2155         case HCI_OP_READ_LOCAL_COMMANDS:
2156                 hci_cc_read_local_commands(hdev, skb);
2157                 break;
2158
2159         case HCI_OP_READ_LOCAL_FEATURES:
2160                 hci_cc_read_local_features(hdev, skb);
2161                 break;
2162
2163         case HCI_OP_READ_LOCAL_EXT_FEATURES:
2164                 hci_cc_read_local_ext_features(hdev, skb);
2165                 break;
2166
2167         case HCI_OP_READ_BUFFER_SIZE:
2168                 hci_cc_read_buffer_size(hdev, skb);
2169                 break;
2170
2171         case HCI_OP_READ_BD_ADDR:
2172                 hci_cc_read_bd_addr(hdev, skb);
2173                 break;
2174
2175         case HCI_OP_READ_PAGE_SCAN_ACTIVITY:
2176                 hci_cc_read_page_scan_activity(hdev, skb);
2177                 break;
2178
2179         case HCI_OP_WRITE_PAGE_SCAN_ACTIVITY:
2180                 hci_cc_write_page_scan_activity(hdev, skb);
2181                 break;
2182
2183         case HCI_OP_READ_PAGE_SCAN_TYPE:
2184                 hci_cc_read_page_scan_type(hdev, skb);
2185                 break;
2186
2187         case HCI_OP_WRITE_PAGE_SCAN_TYPE:
2188                 hci_cc_write_page_scan_type(hdev, skb);
2189                 break;
2190
2191         case HCI_OP_READ_DATA_BLOCK_SIZE:
2192                 hci_cc_read_data_block_size(hdev, skb);
2193                 break;
2194
2195         case HCI_OP_READ_FLOW_CONTROL_MODE:
2196                 hci_cc_read_flow_control_mode(hdev, skb);
2197                 break;
2198
2199         case HCI_OP_READ_LOCAL_AMP_INFO:
2200                 hci_cc_read_local_amp_info(hdev, skb);
2201                 break;
2202
2203         case HCI_OP_READ_LOCAL_AMP_ASSOC:
2204                 hci_cc_read_local_amp_assoc(hdev, skb);
2205                 break;
2206
2207         case HCI_OP_READ_INQ_RSP_TX_POWER:
2208                 hci_cc_read_inq_rsp_tx_power(hdev, skb);
2209                 break;
2210
2211         case HCI_OP_PIN_CODE_REPLY:
2212                 hci_cc_pin_code_reply(hdev, skb);
2213                 break;
2214
2215         case HCI_OP_PIN_CODE_NEG_REPLY:
2216                 hci_cc_pin_code_neg_reply(hdev, skb);
2217                 break;
2218
2219         case HCI_OP_READ_LOCAL_OOB_DATA:
2220                 hci_cc_read_local_oob_data_reply(hdev, skb);
2221                 break;
2222
2223         case HCI_OP_LE_READ_BUFFER_SIZE:
2224                 hci_cc_le_read_buffer_size(hdev, skb);
2225                 break;
2226
2227         case HCI_OP_LE_READ_LOCAL_FEATURES:
2228                 hci_cc_le_read_local_features(hdev, skb);
2229                 break;
2230
2231         case HCI_OP_LE_READ_ADV_TX_POWER:
2232                 hci_cc_le_read_adv_tx_power(hdev, skb);
2233                 break;
2234
2235         case HCI_OP_USER_CONFIRM_REPLY:
2236                 hci_cc_user_confirm_reply(hdev, skb);
2237                 break;
2238
2239         case HCI_OP_USER_CONFIRM_NEG_REPLY:
2240                 hci_cc_user_confirm_neg_reply(hdev, skb);
2241                 break;
2242
2243         case HCI_OP_USER_PASSKEY_REPLY:
2244                 hci_cc_user_passkey_reply(hdev, skb);
2245                 break;
2246
2247         case HCI_OP_USER_PASSKEY_NEG_REPLY:
2248                 hci_cc_user_passkey_neg_reply(hdev, skb);
2249                 break;
2250
2251         case HCI_OP_LE_SET_ADV_ENABLE:
2252                 hci_cc_le_set_adv_enable(hdev, skb);
2253                 break;
2254
2255         case HCI_OP_LE_SET_SCAN_ENABLE:
2256                 hci_cc_le_set_scan_enable(hdev, skb);
2257                 break;
2258
2259         case HCI_OP_LE_READ_WHITE_LIST_SIZE:
2260                 hci_cc_le_read_white_list_size(hdev, skb);
2261                 break;
2262
2263         case HCI_OP_LE_READ_SUPPORTED_STATES:
2264                 hci_cc_le_read_supported_states(hdev, skb);
2265                 break;
2266
2267         case HCI_OP_WRITE_LE_HOST_SUPPORTED:
2268                 hci_cc_write_le_host_supported(hdev, skb);
2269                 break;
2270
2271         case HCI_OP_WRITE_REMOTE_AMP_ASSOC:
2272                 hci_cc_write_remote_amp_assoc(hdev, skb);
2273                 break;
2274
2275         default:
2276                 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
2277                 break;
2278         }
2279
2280         if (opcode != HCI_OP_NOP)
2281                 del_timer(&hdev->cmd_timer);
2282
2283         hci_req_cmd_complete(hdev, opcode, status);
2284
2285         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
2286                 atomic_set(&hdev->cmd_cnt, 1);
2287                 if (!skb_queue_empty(&hdev->cmd_q))
2288                         queue_work(hdev->workqueue, &hdev->cmd_work);
2289         }
2290 }
2291
2292 static void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb)
2293 {
2294         struct hci_ev_cmd_status *ev = (void *) skb->data;
2295         __u16 opcode;
2296
2297         skb_pull(skb, sizeof(*ev));
2298
2299         opcode = __le16_to_cpu(ev->opcode);
2300
2301         switch (opcode) {
2302         case HCI_OP_INQUIRY:
2303                 hci_cs_inquiry(hdev, ev->status);
2304                 break;
2305
2306         case HCI_OP_CREATE_CONN:
2307                 hci_cs_create_conn(hdev, ev->status);
2308                 break;
2309
2310         case HCI_OP_ADD_SCO:
2311                 hci_cs_add_sco(hdev, ev->status);
2312                 break;
2313
2314         case HCI_OP_AUTH_REQUESTED:
2315                 hci_cs_auth_requested(hdev, ev->status);
2316                 break;
2317
2318         case HCI_OP_SET_CONN_ENCRYPT:
2319                 hci_cs_set_conn_encrypt(hdev, ev->status);
2320                 break;
2321
2322         case HCI_OP_REMOTE_NAME_REQ:
2323                 hci_cs_remote_name_req(hdev, ev->status);
2324                 break;
2325
2326         case HCI_OP_READ_REMOTE_FEATURES:
2327                 hci_cs_read_remote_features(hdev, ev->status);
2328                 break;
2329
2330         case HCI_OP_READ_REMOTE_EXT_FEATURES:
2331                 hci_cs_read_remote_ext_features(hdev, ev->status);
2332                 break;
2333
2334         case HCI_OP_SETUP_SYNC_CONN:
2335                 hci_cs_setup_sync_conn(hdev, ev->status);
2336                 break;
2337
2338         case HCI_OP_SNIFF_MODE:
2339                 hci_cs_sniff_mode(hdev, ev->status);
2340                 break;
2341
2342         case HCI_OP_EXIT_SNIFF_MODE:
2343                 hci_cs_exit_sniff_mode(hdev, ev->status);
2344                 break;
2345
2346         case HCI_OP_DISCONNECT:
2347                 hci_cs_disconnect(hdev, ev->status);
2348                 break;
2349
2350         case HCI_OP_CREATE_PHY_LINK:
2351                 hci_cs_create_phylink(hdev, ev->status);
2352                 break;
2353
2354         case HCI_OP_ACCEPT_PHY_LINK:
2355                 hci_cs_accept_phylink(hdev, ev->status);
2356                 break;
2357
2358         default:
2359                 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
2360                 break;
2361         }
2362
2363         if (opcode != HCI_OP_NOP)
2364                 del_timer(&hdev->cmd_timer);
2365
2366         if (ev->status ||
2367             (hdev->sent_cmd && !bt_cb(hdev->sent_cmd)->req.event))
2368                 hci_req_cmd_complete(hdev, opcode, ev->status);
2369
2370         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
2371                 atomic_set(&hdev->cmd_cnt, 1);
2372                 if (!skb_queue_empty(&hdev->cmd_q))
2373                         queue_work(hdev->workqueue, &hdev->cmd_work);
2374         }
2375 }
2376
2377 static void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2378 {
2379         struct hci_ev_role_change *ev = (void *) skb->data;
2380         struct hci_conn *conn;
2381
2382         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2383
2384         hci_dev_lock(hdev);
2385
2386         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2387         if (conn) {
2388                 if (!ev->status) {
2389                         if (ev->role)
2390                                 conn->link_mode &= ~HCI_LM_MASTER;
2391                         else
2392                                 conn->link_mode |= HCI_LM_MASTER;
2393                 }
2394
2395                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
2396
2397                 hci_role_switch_cfm(conn, ev->status, ev->role);
2398         }
2399
2400         hci_dev_unlock(hdev);
2401 }
2402
2403 static void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
2404 {
2405         struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
2406         int i;
2407
2408         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
2409                 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
2410                 return;
2411         }
2412
2413         if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
2414             ev->num_hndl * sizeof(struct hci_comp_pkts_info)) {
2415                 BT_DBG("%s bad parameters", hdev->name);
2416                 return;
2417         }
2418
2419         BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
2420
2421         for (i = 0; i < ev->num_hndl; i++) {
2422                 struct hci_comp_pkts_info *info = &ev->handles[i];
2423                 struct hci_conn *conn;
2424                 __u16  handle, count;
2425
2426                 handle = __le16_to_cpu(info->handle);
2427                 count  = __le16_to_cpu(info->count);
2428
2429                 conn = hci_conn_hash_lookup_handle(hdev, handle);
2430                 if (!conn)
2431                         continue;
2432
2433                 conn->sent -= count;
2434
2435                 switch (conn->type) {
2436                 case ACL_LINK:
2437                         hdev->acl_cnt += count;
2438                         if (hdev->acl_cnt > hdev->acl_pkts)
2439                                 hdev->acl_cnt = hdev->acl_pkts;
2440                         break;
2441
2442                 case LE_LINK:
2443                         if (hdev->le_pkts) {
2444                                 hdev->le_cnt += count;
2445                                 if (hdev->le_cnt > hdev->le_pkts)
2446                                         hdev->le_cnt = hdev->le_pkts;
2447                         } else {
2448                                 hdev->acl_cnt += count;
2449                                 if (hdev->acl_cnt > hdev->acl_pkts)
2450                                         hdev->acl_cnt = hdev->acl_pkts;
2451                         }
2452                         break;
2453
2454                 case SCO_LINK:
2455                         hdev->sco_cnt += count;
2456                         if (hdev->sco_cnt > hdev->sco_pkts)
2457                                 hdev->sco_cnt = hdev->sco_pkts;
2458                         break;
2459
2460                 default:
2461                         BT_ERR("Unknown type %d conn %p", conn->type, conn);
2462                         break;
2463                 }
2464         }
2465
2466         queue_work(hdev->workqueue, &hdev->tx_work);
2467 }
2468
2469 static struct hci_conn *__hci_conn_lookup_handle(struct hci_dev *hdev,
2470                                                  __u16 handle)
2471 {
2472         struct hci_chan *chan;
2473
2474         switch (hdev->dev_type) {
2475         case HCI_BREDR:
2476                 return hci_conn_hash_lookup_handle(hdev, handle);
2477         case HCI_AMP:
2478                 chan = hci_chan_lookup_handle(hdev, handle);
2479                 if (chan)
2480                         return chan->conn;
2481                 break;
2482         default:
2483                 BT_ERR("%s unknown dev_type %d", hdev->name, hdev->dev_type);
2484                 break;
2485         }
2486
2487         return NULL;
2488 }
2489
2490 static void hci_num_comp_blocks_evt(struct hci_dev *hdev, struct sk_buff *skb)
2491 {
2492         struct hci_ev_num_comp_blocks *ev = (void *) skb->data;
2493         int i;
2494
2495         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
2496                 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
2497                 return;
2498         }
2499
2500         if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
2501             ev->num_hndl * sizeof(struct hci_comp_blocks_info)) {
2502                 BT_DBG("%s bad parameters", hdev->name);
2503                 return;
2504         }
2505
2506         BT_DBG("%s num_blocks %d num_hndl %d", hdev->name, ev->num_blocks,
2507                ev->num_hndl);
2508
2509         for (i = 0; i < ev->num_hndl; i++) {
2510                 struct hci_comp_blocks_info *info = &ev->handles[i];
2511                 struct hci_conn *conn = NULL;
2512                 __u16  handle, block_count;
2513
2514                 handle = __le16_to_cpu(info->handle);
2515                 block_count = __le16_to_cpu(info->blocks);
2516
2517                 conn = __hci_conn_lookup_handle(hdev, handle);
2518                 if (!conn)
2519                         continue;
2520
2521                 conn->sent -= block_count;
2522
2523                 switch (conn->type) {
2524                 case ACL_LINK:
2525                 case AMP_LINK:
2526                         hdev->block_cnt += block_count;
2527                         if (hdev->block_cnt > hdev->num_blocks)
2528                                 hdev->block_cnt = hdev->num_blocks;
2529                         break;
2530
2531                 default:
2532                         BT_ERR("Unknown type %d conn %p", conn->type, conn);
2533                         break;
2534                 }
2535         }
2536
2537         queue_work(hdev->workqueue, &hdev->tx_work);
2538 }
2539
2540 static void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2541 {
2542         struct hci_ev_mode_change *ev = (void *) skb->data;
2543         struct hci_conn *conn;
2544
2545         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2546
2547         hci_dev_lock(hdev);
2548
2549         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2550         if (conn) {
2551                 conn->mode = ev->mode;
2552
2553                 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND,
2554                                         &conn->flags)) {
2555                         if (conn->mode == HCI_CM_ACTIVE)
2556                                 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
2557                         else
2558                                 clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
2559                 }
2560
2561                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2562                         hci_sco_setup(conn, ev->status);
2563         }
2564
2565         hci_dev_unlock(hdev);
2566 }
2567
2568 static void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2569 {
2570         struct hci_ev_pin_code_req *ev = (void *) skb->data;
2571         struct hci_conn *conn;
2572
2573         BT_DBG("%s", hdev->name);
2574
2575         hci_dev_lock(hdev);
2576
2577         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2578         if (!conn)
2579                 goto unlock;
2580
2581         if (conn->state == BT_CONNECTED) {
2582                 hci_conn_hold(conn);
2583                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2584                 hci_conn_drop(conn);
2585         }
2586
2587         if (!test_bit(HCI_PAIRABLE, &hdev->dev_flags))
2588                 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2589                              sizeof(ev->bdaddr), &ev->bdaddr);
2590         else if (test_bit(HCI_MGMT, &hdev->dev_flags)) {
2591                 u8 secure;
2592
2593                 if (conn->pending_sec_level == BT_SECURITY_HIGH)
2594                         secure = 1;
2595                 else
2596                         secure = 0;
2597
2598                 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
2599         }
2600
2601 unlock:
2602         hci_dev_unlock(hdev);
2603 }
2604
2605 static void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2606 {
2607         struct hci_ev_link_key_req *ev = (void *) skb->data;
2608         struct hci_cp_link_key_reply cp;
2609         struct hci_conn *conn;
2610         struct link_key *key;
2611
2612         BT_DBG("%s", hdev->name);
2613
2614         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
2615                 return;
2616
2617         hci_dev_lock(hdev);
2618
2619         key = hci_find_link_key(hdev, &ev->bdaddr);
2620         if (!key) {
2621                 BT_DBG("%s link key not found for %pMR", hdev->name,
2622                        &ev->bdaddr);
2623                 goto not_found;
2624         }
2625
2626         BT_DBG("%s found key type %u for %pMR", hdev->name, key->type,
2627                &ev->bdaddr);
2628
2629         if (!test_bit(HCI_DEBUG_KEYS, &hdev->dev_flags) &&
2630             key->type == HCI_LK_DEBUG_COMBINATION) {
2631                 BT_DBG("%s ignoring debug key", hdev->name);
2632                 goto not_found;
2633         }
2634
2635         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2636         if (conn) {
2637                 if (key->type == HCI_LK_UNAUTH_COMBINATION &&
2638                     conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
2639                         BT_DBG("%s ignoring unauthenticated key", hdev->name);
2640                         goto not_found;
2641                 }
2642
2643                 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
2644                     conn->pending_sec_level == BT_SECURITY_HIGH) {
2645                         BT_DBG("%s ignoring key unauthenticated for high security",
2646                                hdev->name);
2647                         goto not_found;
2648                 }
2649
2650                 conn->key_type = key->type;
2651                 conn->pin_length = key->pin_len;
2652         }
2653
2654         bacpy(&cp.bdaddr, &ev->bdaddr);
2655         memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);
2656
2657         hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
2658
2659         hci_dev_unlock(hdev);
2660
2661         return;
2662
2663 not_found:
2664         hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
2665         hci_dev_unlock(hdev);
2666 }
2667
2668 static void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
2669 {
2670         struct hci_ev_link_key_notify *ev = (void *) skb->data;
2671         struct hci_conn *conn;
2672         u8 pin_len = 0;
2673
2674         BT_DBG("%s", hdev->name);
2675
2676         hci_dev_lock(hdev);
2677
2678         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2679         if (conn) {
2680                 hci_conn_hold(conn);
2681                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2682                 pin_len = conn->pin_length;
2683
2684                 if (ev->key_type != HCI_LK_CHANGED_COMBINATION)
2685                         conn->key_type = ev->key_type;
2686
2687                 hci_conn_drop(conn);
2688         }
2689
2690         if (test_bit(HCI_MGMT, &hdev->dev_flags))
2691                 hci_add_link_key(hdev, conn, 1, &ev->bdaddr, ev->link_key,
2692                                  ev->key_type, pin_len);
2693
2694         hci_dev_unlock(hdev);
2695 }
2696
2697 static void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
2698 {
2699         struct hci_ev_clock_offset *ev = (void *) skb->data;
2700         struct hci_conn *conn;
2701
2702         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2703
2704         hci_dev_lock(hdev);
2705
2706         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2707         if (conn && !ev->status) {
2708                 struct inquiry_entry *ie;
2709
2710                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
2711                 if (ie) {
2712                         ie->data.clock_offset = ev->clock_offset;
2713                         ie->timestamp = jiffies;
2714                 }
2715         }
2716
2717         hci_dev_unlock(hdev);
2718 }
2719
2720 static void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2721 {
2722         struct hci_ev_pkt_type_change *ev = (void *) skb->data;
2723         struct hci_conn *conn;
2724
2725         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2726
2727         hci_dev_lock(hdev);
2728
2729         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2730         if (conn && !ev->status)
2731                 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
2732
2733         hci_dev_unlock(hdev);
2734 }
2735
2736 static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
2737 {
2738         struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
2739         struct inquiry_entry *ie;
2740
2741         BT_DBG("%s", hdev->name);
2742
2743         hci_dev_lock(hdev);
2744
2745         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2746         if (ie) {
2747                 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
2748                 ie->timestamp = jiffies;
2749         }
2750
2751         hci_dev_unlock(hdev);
2752 }
2753
2754 static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
2755                                              struct sk_buff *skb)
2756 {
2757         struct inquiry_data data;
2758         int num_rsp = *((__u8 *) skb->data);
2759         bool name_known, ssp;
2760
2761         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2762
2763         if (!num_rsp)
2764                 return;
2765
2766         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
2767                 return;
2768
2769         hci_dev_lock(hdev);
2770
2771         if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
2772                 struct inquiry_info_with_rssi_and_pscan_mode *info;
2773                 info = (void *) (skb->data + 1);
2774
2775                 for (; num_rsp; num_rsp--, info++) {
2776                         bacpy(&data.bdaddr, &info->bdaddr);
2777                         data.pscan_rep_mode     = info->pscan_rep_mode;
2778                         data.pscan_period_mode  = info->pscan_period_mode;
2779                         data.pscan_mode         = info->pscan_mode;
2780                         memcpy(data.dev_class, info->dev_class, 3);
2781                         data.clock_offset       = info->clock_offset;
2782                         data.rssi               = info->rssi;
2783                         data.ssp_mode           = 0x00;
2784
2785                         name_known = hci_inquiry_cache_update(hdev, &data,
2786                                                               false, &ssp);
2787                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2788                                           info->dev_class, info->rssi,
2789                                           !name_known, ssp, NULL, 0);
2790                 }
2791         } else {
2792                 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
2793
2794                 for (; num_rsp; num_rsp--, info++) {
2795                         bacpy(&data.bdaddr, &info->bdaddr);
2796                         data.pscan_rep_mode     = info->pscan_rep_mode;
2797                         data.pscan_period_mode  = info->pscan_period_mode;
2798                         data.pscan_mode         = 0x00;
2799                         memcpy(data.dev_class, info->dev_class, 3);
2800                         data.clock_offset       = info->clock_offset;
2801                         data.rssi               = info->rssi;
2802                         data.ssp_mode           = 0x00;
2803                         name_known = hci_inquiry_cache_update(hdev, &data,
2804                                                               false, &ssp);
2805                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2806                                           info->dev_class, info->rssi,
2807                                           !name_known, ssp, NULL, 0);
2808                 }
2809         }
2810
2811         hci_dev_unlock(hdev);
2812 }
2813
2814 static void hci_remote_ext_features_evt(struct hci_dev *hdev,
2815                                         struct sk_buff *skb)
2816 {
2817         struct hci_ev_remote_ext_features *ev = (void *) skb->data;
2818         struct hci_conn *conn;
2819
2820         BT_DBG("%s", hdev->name);
2821
2822         hci_dev_lock(hdev);
2823
2824         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2825         if (!conn)
2826                 goto unlock;
2827
2828         if (ev->page < HCI_MAX_PAGES)
2829                 memcpy(conn->features[ev->page], ev->features, 8);
2830
2831         if (!ev->status && ev->page == 0x01) {
2832                 struct inquiry_entry *ie;
2833
2834                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
2835                 if (ie)
2836                         ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
2837
2838                 if (ev->features[0] & LMP_HOST_SSP) {
2839                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
2840                 } else {
2841                         /* It is mandatory by the Bluetooth specification that
2842                          * Extended Inquiry Results are only used when Secure
2843                          * Simple Pairing is enabled, but some devices violate
2844                          * this.
2845                          *
2846                          * To make these devices work, the internal SSP
2847                          * enabled flag needs to be cleared if the remote host
2848                          * features do not indicate SSP support */
2849                         clear_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
2850                 }
2851         }
2852
2853         if (conn->state != BT_CONFIG)
2854                 goto unlock;
2855
2856         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
2857                 struct hci_cp_remote_name_req cp;
2858                 memset(&cp, 0, sizeof(cp));
2859                 bacpy(&cp.bdaddr, &conn->dst);
2860                 cp.pscan_rep_mode = 0x02;
2861                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2862         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2863                 mgmt_device_connected(hdev, &conn->dst, conn->type,
2864                                       conn->dst_type, 0, NULL, 0,
2865                                       conn->dev_class);
2866
2867         if (!hci_outgoing_auth_needed(hdev, conn)) {
2868                 conn->state = BT_CONNECTED;
2869                 hci_proto_connect_cfm(conn, ev->status);
2870                 hci_conn_drop(conn);
2871         }
2872
2873 unlock:
2874         hci_dev_unlock(hdev);
2875 }
2876
2877 static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
2878                                        struct sk_buff *skb)
2879 {
2880         struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
2881         struct hci_conn *conn;
2882
2883         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2884
2885         hci_dev_lock(hdev);
2886
2887         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
2888         if (!conn) {
2889                 if (ev->link_type == ESCO_LINK)
2890                         goto unlock;
2891
2892                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
2893                 if (!conn)
2894                         goto unlock;
2895
2896                 conn->type = SCO_LINK;
2897         }
2898
2899         switch (ev->status) {
2900         case 0x00:
2901                 conn->handle = __le16_to_cpu(ev->handle);
2902                 conn->state  = BT_CONNECTED;
2903
2904                 hci_conn_add_sysfs(conn);
2905                 break;
2906
2907         case 0x0d:      /* Connection Rejected due to Limited Resources */
2908         case 0x11:      /* Unsupported Feature or Parameter Value */
2909         case 0x1c:      /* SCO interval rejected */
2910         case 0x1a:      /* Unsupported Remote Feature */
2911         case 0x1f:      /* Unspecified error */
2912                 if (conn->out) {
2913                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
2914                                         (hdev->esco_type & EDR_ESCO_MASK);
2915                         if (hci_setup_sync(conn, conn->link->handle))
2916                                 goto unlock;
2917                 }
2918                 /* fall through */
2919
2920         default:
2921                 conn->state = BT_CLOSED;
2922                 break;
2923         }
2924
2925         hci_proto_connect_cfm(conn, ev->status);
2926         if (ev->status)
2927                 hci_conn_del(conn);
2928
2929 unlock:
2930         hci_dev_unlock(hdev);
2931 }
2932
2933 static inline size_t eir_get_length(u8 *eir, size_t eir_len)
2934 {
2935         size_t parsed = 0;
2936
2937         while (parsed < eir_len) {
2938                 u8 field_len = eir[0];
2939
2940                 if (field_len == 0)
2941                         return parsed;
2942
2943                 parsed += field_len + 1;
2944                 eir += field_len + 1;
2945         }
2946
2947         return eir_len;
2948 }
2949
2950 static void hci_extended_inquiry_result_evt(struct hci_dev *hdev,
2951                                             struct sk_buff *skb)
2952 {
2953         struct inquiry_data data;
2954         struct extended_inquiry_info *info = (void *) (skb->data + 1);
2955         int num_rsp = *((__u8 *) skb->data);
2956         size_t eir_len;
2957
2958         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2959
2960         if (!num_rsp)
2961                 return;
2962
2963         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
2964                 return;
2965
2966         hci_dev_lock(hdev);
2967
2968         for (; num_rsp; num_rsp--, info++) {
2969                 bool name_known, ssp;
2970
2971                 bacpy(&data.bdaddr, &info->bdaddr);
2972                 data.pscan_rep_mode     = info->pscan_rep_mode;
2973                 data.pscan_period_mode  = info->pscan_period_mode;
2974                 data.pscan_mode         = 0x00;
2975                 memcpy(data.dev_class, info->dev_class, 3);
2976                 data.clock_offset       = info->clock_offset;
2977                 data.rssi               = info->rssi;
2978                 data.ssp_mode           = 0x01;
2979
2980                 if (test_bit(HCI_MGMT, &hdev->dev_flags))
2981                         name_known = eir_has_data_type(info->data,
2982                                                        sizeof(info->data),
2983                                                        EIR_NAME_COMPLETE);
2984                 else
2985                         name_known = true;
2986
2987                 name_known = hci_inquiry_cache_update(hdev, &data, name_known,
2988                                                       &ssp);
2989                 eir_len = eir_get_length(info->data, sizeof(info->data));
2990                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2991                                   info->dev_class, info->rssi, !name_known,
2992                                   ssp, info->data, eir_len);
2993         }
2994
2995         hci_dev_unlock(hdev);
2996 }
2997
2998 static void hci_key_refresh_complete_evt(struct hci_dev *hdev,
2999                                          struct sk_buff *skb)
3000 {
3001         struct hci_ev_key_refresh_complete *ev = (void *) skb->data;
3002         struct hci_conn *conn;
3003
3004         BT_DBG("%s status 0x%2.2x handle 0x%4.4x", hdev->name, ev->status,
3005                __le16_to_cpu(ev->handle));
3006
3007         hci_dev_lock(hdev);
3008
3009         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3010         if (!conn)
3011                 goto unlock;
3012
3013         /* For BR/EDR the necessary steps are taken through the
3014          * auth_complete event.
3015          */
3016         if (conn->type != LE_LINK)
3017                 goto unlock;
3018
3019         if (!ev->status)
3020                 conn->sec_level = conn->pending_sec_level;
3021
3022         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3023
3024         if (ev->status && conn->state == BT_CONNECTED) {
3025                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
3026                 hci_conn_drop(conn);
3027                 goto unlock;
3028         }
3029
3030         if (conn->state == BT_CONFIG) {
3031                 if (!ev->status)
3032                         conn->state = BT_CONNECTED;
3033
3034                 hci_proto_connect_cfm(conn, ev->status);
3035                 hci_conn_drop(conn);
3036         } else {
3037                 hci_auth_cfm(conn, ev->status);
3038
3039                 hci_conn_hold(conn);
3040                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3041                 hci_conn_drop(conn);
3042         }
3043
3044 unlock:
3045         hci_dev_unlock(hdev);
3046 }
3047
3048 static u8 hci_get_auth_req(struct hci_conn *conn)
3049 {
3050         /* If remote requests dedicated bonding follow that lead */
3051         if (conn->remote_auth == HCI_AT_DEDICATED_BONDING ||
3052             conn->remote_auth == HCI_AT_DEDICATED_BONDING_MITM) {
3053                 /* If both remote and local IO capabilities allow MITM
3054                  * protection then require it, otherwise don't */
3055                 if (conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT ||
3056                     conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)
3057                         return HCI_AT_DEDICATED_BONDING;
3058                 else
3059                         return HCI_AT_DEDICATED_BONDING_MITM;
3060         }
3061
3062         /* If remote requests no-bonding follow that lead */
3063         if (conn->remote_auth == HCI_AT_NO_BONDING ||
3064             conn->remote_auth == HCI_AT_NO_BONDING_MITM)
3065                 return conn->remote_auth | (conn->auth_type & 0x01);
3066
3067         return conn->auth_type;
3068 }
3069
3070 static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3071 {
3072         struct hci_ev_io_capa_request *ev = (void *) skb->data;
3073         struct hci_conn *conn;
3074
3075         BT_DBG("%s", hdev->name);
3076
3077         hci_dev_lock(hdev);
3078
3079         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3080         if (!conn)
3081                 goto unlock;
3082
3083         hci_conn_hold(conn);
3084
3085         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3086                 goto unlock;
3087
3088         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags) ||
3089             (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
3090                 struct hci_cp_io_capability_reply cp;
3091
3092                 bacpy(&cp.bdaddr, &ev->bdaddr);
3093                 /* Change the IO capability from KeyboardDisplay
3094                  * to DisplayYesNo as it is not supported by BT spec. */
3095                 cp.capability = (conn->io_capability == 0x04) ?
3096                                 HCI_IO_DISPLAY_YESNO : conn->io_capability;
3097                 conn->auth_type = hci_get_auth_req(conn);
3098                 cp.authentication = conn->auth_type;
3099
3100                 if (hci_find_remote_oob_data(hdev, &conn->dst) &&
3101                     (conn->out || test_bit(HCI_CONN_REMOTE_OOB, &conn->flags)))
3102                         cp.oob_data = 0x01;
3103                 else
3104                         cp.oob_data = 0x00;
3105
3106                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
3107                              sizeof(cp), &cp);
3108         } else {
3109                 struct hci_cp_io_capability_neg_reply cp;
3110
3111                 bacpy(&cp.bdaddr, &ev->bdaddr);
3112                 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
3113
3114                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
3115                              sizeof(cp), &cp);
3116         }
3117
3118 unlock:
3119         hci_dev_unlock(hdev);
3120 }
3121
3122 static void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
3123 {
3124         struct hci_ev_io_capa_reply *ev = (void *) skb->data;
3125         struct hci_conn *conn;
3126
3127         BT_DBG("%s", hdev->name);
3128
3129         hci_dev_lock(hdev);
3130
3131         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3132         if (!conn)
3133                 goto unlock;
3134
3135         conn->remote_cap = ev->capability;
3136         conn->remote_auth = ev->authentication;
3137         if (ev->oob_data)
3138                 set_bit(HCI_CONN_REMOTE_OOB, &conn->flags);
3139
3140 unlock:
3141         hci_dev_unlock(hdev);
3142 }
3143
3144 static void hci_user_confirm_request_evt(struct hci_dev *hdev,
3145                                          struct sk_buff *skb)
3146 {
3147         struct hci_ev_user_confirm_req *ev = (void *) skb->data;
3148         int loc_mitm, rem_mitm, confirm_hint = 0;
3149         struct hci_conn *conn;
3150
3151         BT_DBG("%s", hdev->name);
3152
3153         hci_dev_lock(hdev);
3154
3155         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3156                 goto unlock;
3157
3158         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3159         if (!conn)
3160                 goto unlock;
3161
3162         loc_mitm = (conn->auth_type & 0x01);
3163         rem_mitm = (conn->remote_auth & 0x01);
3164
3165         /* If we require MITM but the remote device can't provide that
3166          * (it has NoInputNoOutput) then reject the confirmation
3167          * request. The only exception is when we're dedicated bonding
3168          * initiators (connect_cfm_cb set) since then we always have the MITM
3169          * bit set. */
3170         if (!conn->connect_cfm_cb && loc_mitm &&
3171             conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
3172                 BT_DBG("Rejecting request: remote device can't provide MITM");
3173                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
3174                              sizeof(ev->bdaddr), &ev->bdaddr);
3175                 goto unlock;
3176         }
3177
3178         /* If no side requires MITM protection; auto-accept */
3179         if ((!loc_mitm || conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) &&
3180             (!rem_mitm || conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)) {
3181
3182                 /* If we're not the initiators request authorization to
3183                  * proceed from user space (mgmt_user_confirm with
3184                  * confirm_hint set to 1). The exception is if neither
3185                  * side had MITM in which case we do auto-accept.
3186                  */
3187                 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&
3188                     (loc_mitm || rem_mitm)) {
3189                         BT_DBG("Confirming auto-accept as acceptor");
3190                         confirm_hint = 1;
3191                         goto confirm;
3192                 }
3193
3194                 BT_DBG("Auto-accept of user confirmation with %ums delay",
3195                        hdev->auto_accept_delay);
3196
3197                 if (hdev->auto_accept_delay > 0) {
3198                         int delay = msecs_to_jiffies(hdev->auto_accept_delay);
3199                         queue_delayed_work(conn->hdev->workqueue,
3200                                            &conn->auto_accept_work, delay);
3201                         goto unlock;
3202                 }
3203
3204                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
3205                              sizeof(ev->bdaddr), &ev->bdaddr);
3206                 goto unlock;
3207         }
3208
3209 confirm:
3210         mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0, ev->passkey,
3211                                   confirm_hint);
3212
3213 unlock:
3214         hci_dev_unlock(hdev);
3215 }
3216
3217 static void hci_user_passkey_request_evt(struct hci_dev *hdev,
3218                                          struct sk_buff *skb)
3219 {
3220         struct hci_ev_user_passkey_req *ev = (void *) skb->data;
3221
3222         BT_DBG("%s", hdev->name);
3223
3224         if (test_bit(HCI_MGMT, &hdev->dev_flags))
3225                 mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
3226 }
3227
3228 static void hci_user_passkey_notify_evt(struct hci_dev *hdev,
3229                                         struct sk_buff *skb)
3230 {
3231         struct hci_ev_user_passkey_notify *ev = (void *) skb->data;
3232         struct hci_conn *conn;
3233
3234         BT_DBG("%s", hdev->name);
3235
3236         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3237         if (!conn)
3238                 return;
3239
3240         conn->passkey_notify = __le32_to_cpu(ev->passkey);
3241         conn->passkey_entered = 0;
3242
3243         if (test_bit(HCI_MGMT, &hdev->dev_flags))
3244                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
3245                                          conn->dst_type, conn->passkey_notify,
3246                                          conn->passkey_entered);
3247 }
3248
3249 static void hci_keypress_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
3250 {
3251         struct hci_ev_keypress_notify *ev = (void *) skb->data;
3252         struct hci_conn *conn;
3253
3254         BT_DBG("%s", hdev->name);
3255
3256         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3257         if (!conn)
3258                 return;
3259
3260         switch (ev->type) {
3261         case HCI_KEYPRESS_STARTED:
3262                 conn->passkey_entered = 0;
3263                 return;
3264
3265         case HCI_KEYPRESS_ENTERED:
3266                 conn->passkey_entered++;
3267                 break;
3268
3269         case HCI_KEYPRESS_ERASED:
3270                 conn->passkey_entered--;
3271                 break;
3272
3273         case HCI_KEYPRESS_CLEARED:
3274                 conn->passkey_entered = 0;
3275                 break;
3276
3277         case HCI_KEYPRESS_COMPLETED:
3278                 return;
3279         }
3280
3281         if (test_bit(HCI_MGMT, &hdev->dev_flags))
3282                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
3283                                          conn->dst_type, conn->passkey_notify,
3284                                          conn->passkey_entered);
3285 }
3286
3287 static void hci_simple_pair_complete_evt(struct hci_dev *hdev,
3288                                          struct sk_buff *skb)
3289 {
3290         struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
3291         struct hci_conn *conn;
3292
3293         BT_DBG("%s", hdev->name);
3294
3295         hci_dev_lock(hdev);
3296
3297         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3298         if (!conn)
3299                 goto unlock;
3300
3301         /* To avoid duplicate auth_failed events to user space we check
3302          * the HCI_CONN_AUTH_PEND flag which will be set if we
3303          * initiated the authentication. A traditional auth_complete
3304          * event gets always produced as initiator and is also mapped to
3305          * the mgmt_auth_failed event */
3306         if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status)
3307                 mgmt_auth_failed(hdev, &conn->dst, conn->type, conn->dst_type,
3308                                  ev->status);
3309
3310         hci_conn_drop(conn);
3311
3312 unlock:
3313         hci_dev_unlock(hdev);
3314 }
3315
3316 static void hci_remote_host_features_evt(struct hci_dev *hdev,
3317                                          struct sk_buff *skb)
3318 {
3319         struct hci_ev_remote_host_features *ev = (void *) skb->data;
3320         struct inquiry_entry *ie;
3321         struct hci_conn *conn;
3322
3323         BT_DBG("%s", hdev->name);
3324
3325         hci_dev_lock(hdev);
3326
3327         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3328         if (conn)
3329                 memcpy(conn->features[1], ev->features, 8);
3330
3331         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
3332         if (ie)
3333                 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
3334
3335         hci_dev_unlock(hdev);
3336 }
3337
3338 static void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
3339                                             struct sk_buff *skb)
3340 {
3341         struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
3342         struct oob_data *data;
3343
3344         BT_DBG("%s", hdev->name);
3345
3346         hci_dev_lock(hdev);
3347
3348         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3349                 goto unlock;
3350
3351         data = hci_find_remote_oob_data(hdev, &ev->bdaddr);
3352         if (data) {
3353                 struct hci_cp_remote_oob_data_reply cp;
3354
3355                 bacpy(&cp.bdaddr, &ev->bdaddr);
3356                 memcpy(cp.hash, data->hash, sizeof(cp.hash));
3357                 memcpy(cp.randomizer, data->randomizer, sizeof(cp.randomizer));
3358
3359                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY, sizeof(cp),
3360                              &cp);
3361         } else {
3362                 struct hci_cp_remote_oob_data_neg_reply cp;
3363
3364                 bacpy(&cp.bdaddr, &ev->bdaddr);
3365                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY, sizeof(cp),
3366                              &cp);
3367         }
3368
3369 unlock:
3370         hci_dev_unlock(hdev);
3371 }
3372
3373 static void hci_phy_link_complete_evt(struct hci_dev *hdev,
3374                                       struct sk_buff *skb)
3375 {
3376         struct hci_ev_phy_link_complete *ev = (void *) skb->data;
3377         struct hci_conn *hcon, *bredr_hcon;
3378
3379         BT_DBG("%s handle 0x%2.2x status 0x%2.2x", hdev->name, ev->phy_handle,
3380                ev->status);
3381
3382         hci_dev_lock(hdev);
3383
3384         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
3385         if (!hcon) {
3386                 hci_dev_unlock(hdev);
3387                 return;
3388         }
3389
3390         if (ev->status) {
3391                 hci_conn_del(hcon);
3392                 hci_dev_unlock(hdev);
3393                 return;
3394         }
3395
3396         bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
3397
3398         hcon->state = BT_CONNECTED;
3399         bacpy(&hcon->dst, &bredr_hcon->dst);
3400
3401         hci_conn_hold(hcon);
3402         hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
3403         hci_conn_drop(hcon);
3404
3405         hci_conn_add_sysfs(hcon);
3406
3407         amp_physical_cfm(bredr_hcon, hcon);
3408
3409         hci_dev_unlock(hdev);
3410 }
3411
3412 static void hci_loglink_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
3413 {
3414         struct hci_ev_logical_link_complete *ev = (void *) skb->data;
3415         struct hci_conn *hcon;
3416         struct hci_chan *hchan;
3417         struct amp_mgr *mgr;
3418
3419         BT_DBG("%s log_handle 0x%4.4x phy_handle 0x%2.2x status 0x%2.2x",
3420                hdev->name, le16_to_cpu(ev->handle), ev->phy_handle,
3421                ev->status);
3422
3423         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
3424         if (!hcon)
3425                 return;
3426
3427         /* Create AMP hchan */
3428         hchan = hci_chan_create(hcon);
3429         if (!hchan)
3430                 return;
3431
3432         hchan->handle = le16_to_cpu(ev->handle);
3433
3434         BT_DBG("hcon %p mgr %p hchan %p", hcon, hcon->amp_mgr, hchan);
3435
3436         mgr = hcon->amp_mgr;
3437         if (mgr && mgr->bredr_chan) {
3438                 struct l2cap_chan *bredr_chan = mgr->bredr_chan;
3439
3440                 l2cap_chan_lock(bredr_chan);
3441
3442                 bredr_chan->conn->mtu = hdev->block_mtu;
3443                 l2cap_logical_cfm(bredr_chan, hchan, 0);
3444                 hci_conn_hold(hcon);
3445
3446                 l2cap_chan_unlock(bredr_chan);
3447         }
3448 }
3449
3450 static void hci_disconn_loglink_complete_evt(struct hci_dev *hdev,
3451                                              struct sk_buff *skb)
3452 {
3453         struct hci_ev_disconn_logical_link_complete *ev = (void *) skb->data;
3454         struct hci_chan *hchan;
3455
3456         BT_DBG("%s log handle 0x%4.4x status 0x%2.2x", hdev->name,
3457                le16_to_cpu(ev->handle), ev->status);
3458
3459         if (ev->status)
3460                 return;
3461
3462         hci_dev_lock(hdev);
3463
3464         hchan = hci_chan_lookup_handle(hdev, le16_to_cpu(ev->handle));
3465         if (!hchan)
3466                 goto unlock;
3467
3468         amp_destroy_logical_link(hchan, ev->reason);
3469
3470 unlock:
3471         hci_dev_unlock(hdev);
3472 }
3473
3474 static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev,
3475                                              struct sk_buff *skb)
3476 {
3477         struct hci_ev_disconn_phy_link_complete *ev = (void *) skb->data;
3478         struct hci_conn *hcon;
3479
3480         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3481
3482         if (ev->status)
3483                 return;
3484
3485         hci_dev_lock(hdev);
3486
3487         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
3488         if (hcon) {
3489                 hcon->state = BT_CLOSED;
3490                 hci_conn_del(hcon);
3491         }
3492
3493         hci_dev_unlock(hdev);
3494 }
3495
3496 static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
3497 {
3498         struct hci_ev_le_conn_complete *ev = (void *) skb->data;
3499         struct hci_conn *conn;
3500
3501         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3502
3503         hci_dev_lock(hdev);
3504
3505         conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
3506         if (!conn) {
3507                 conn = hci_conn_add(hdev, LE_LINK, &ev->bdaddr);
3508                 if (!conn) {
3509                         BT_ERR("No memory for new connection");
3510                         goto unlock;
3511                 }
3512
3513                 conn->dst_type = ev->bdaddr_type;
3514
3515                 /* The advertising parameters for own address type
3516                  * define which source address and source address
3517                  * type this connections has.
3518                  */
3519                 if (bacmp(&conn->src, BDADDR_ANY)) {
3520                         conn->src_type = ADDR_LE_DEV_PUBLIC;
3521                 } else {
3522                         bacpy(&conn->src, &hdev->static_addr);
3523                         conn->src_type = ADDR_LE_DEV_RANDOM;
3524                 }
3525
3526                 if (ev->role == LE_CONN_ROLE_MASTER) {
3527                         conn->out = true;
3528                         conn->link_mode |= HCI_LM_MASTER;
3529                 }
3530         }
3531
3532         if (ev->status) {
3533                 mgmt_connect_failed(hdev, &conn->dst, conn->type,
3534                                     conn->dst_type, ev->status);
3535                 hci_proto_connect_cfm(conn, ev->status);
3536                 conn->state = BT_CLOSED;
3537                 hci_conn_del(conn);
3538                 goto unlock;
3539         }
3540
3541         if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
3542                 mgmt_device_connected(hdev, &ev->bdaddr, conn->type,
3543                                       conn->dst_type, 0, NULL, 0, NULL);
3544
3545         conn->sec_level = BT_SECURITY_LOW;
3546         conn->handle = __le16_to_cpu(ev->handle);
3547         conn->state = BT_CONNECTED;
3548
3549         if (test_bit(HCI_6LOWPAN_ENABLED, &hdev->dev_flags))
3550                 set_bit(HCI_CONN_6LOWPAN, &conn->flags);
3551
3552         hci_conn_add_sysfs(conn);
3553
3554         hci_proto_connect_cfm(conn, ev->status);
3555
3556 unlock:
3557         hci_dev_unlock(hdev);
3558 }
3559
3560 static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
3561 {
3562         u8 num_reports = skb->data[0];
3563         void *ptr = &skb->data[1];
3564         s8 rssi;
3565
3566         while (num_reports--) {
3567                 struct hci_ev_le_advertising_info *ev = ptr;
3568
3569                 rssi = ev->data[ev->length];
3570                 mgmt_device_found(hdev, &ev->bdaddr, LE_LINK, ev->bdaddr_type,
3571                                   NULL, rssi, 0, 1, ev->data, ev->length);
3572
3573                 ptr += sizeof(*ev) + ev->length + 1;
3574         }
3575 }
3576
3577 static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3578 {
3579         struct hci_ev_le_ltk_req *ev = (void *) skb->data;
3580         struct hci_cp_le_ltk_reply cp;
3581         struct hci_cp_le_ltk_neg_reply neg;
3582         struct hci_conn *conn;
3583         struct smp_ltk *ltk;
3584
3585         BT_DBG("%s handle 0x%4.4x", hdev->name, __le16_to_cpu(ev->handle));
3586
3587         hci_dev_lock(hdev);
3588
3589         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3590         if (conn == NULL)
3591                 goto not_found;
3592
3593         ltk = hci_find_ltk(hdev, ev->ediv, ev->random);
3594         if (ltk == NULL)
3595                 goto not_found;
3596
3597         memcpy(cp.ltk, ltk->val, sizeof(ltk->val));
3598         cp.handle = cpu_to_le16(conn->handle);
3599
3600         if (ltk->authenticated)
3601                 conn->pending_sec_level = BT_SECURITY_HIGH;
3602         else
3603                 conn->pending_sec_level = BT_SECURITY_MEDIUM;
3604
3605         conn->enc_key_size = ltk->enc_size;
3606
3607         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
3608
3609         /* Ref. Bluetooth Core SPEC pages 1975 and 2004. STK is a
3610          * temporary key used to encrypt a connection following
3611          * pairing. It is used during the Encrypted Session Setup to
3612          * distribute the keys. Later, security can be re-established
3613          * using a distributed LTK.
3614          */
3615         if (ltk->type == HCI_SMP_STK_SLAVE) {
3616                 list_del(&ltk->list);
3617                 kfree(ltk);
3618         }
3619
3620         hci_dev_unlock(hdev);
3621
3622         return;
3623
3624 not_found:
3625         neg.handle = ev->handle;
3626         hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
3627         hci_dev_unlock(hdev);
3628 }
3629
3630 static void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
3631 {
3632         struct hci_ev_le_meta *le_ev = (void *) skb->data;
3633
3634         skb_pull(skb, sizeof(*le_ev));
3635
3636         switch (le_ev->subevent) {
3637         case HCI_EV_LE_CONN_COMPLETE:
3638                 hci_le_conn_complete_evt(hdev, skb);
3639                 break;
3640
3641         case HCI_EV_LE_ADVERTISING_REPORT:
3642                 hci_le_adv_report_evt(hdev, skb);
3643                 break;
3644
3645         case HCI_EV_LE_LTK_REQ:
3646                 hci_le_ltk_request_evt(hdev, skb);
3647                 break;
3648
3649         default:
3650                 break;
3651         }
3652 }
3653
3654 static void hci_chan_selected_evt(struct hci_dev *hdev, struct sk_buff *skb)
3655 {
3656         struct hci_ev_channel_selected *ev = (void *) skb->data;
3657         struct hci_conn *hcon;
3658
3659         BT_DBG("%s handle 0x%2.2x", hdev->name, ev->phy_handle);
3660
3661         skb_pull(skb, sizeof(*ev));
3662
3663         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
3664         if (!hcon)
3665                 return;
3666
3667         amp_read_loc_assoc_final_data(hdev, hcon);
3668 }
3669
3670 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
3671 {
3672         struct hci_event_hdr *hdr = (void *) skb->data;
3673         __u8 event = hdr->evt;
3674
3675         hci_dev_lock(hdev);
3676
3677         /* Received events are (currently) only needed when a request is
3678          * ongoing so avoid unnecessary memory allocation.
3679          */
3680         if (hdev->req_status == HCI_REQ_PEND) {
3681                 kfree_skb(hdev->recv_evt);
3682                 hdev->recv_evt = skb_clone(skb, GFP_KERNEL);
3683         }
3684
3685         hci_dev_unlock(hdev);
3686
3687         skb_pull(skb, HCI_EVENT_HDR_SIZE);
3688
3689         if (hdev->sent_cmd && bt_cb(hdev->sent_cmd)->req.event == event) {
3690                 struct hci_command_hdr *cmd_hdr = (void *) hdev->sent_cmd->data;
3691                 u16 opcode = __le16_to_cpu(cmd_hdr->opcode);
3692
3693                 hci_req_cmd_complete(hdev, opcode, 0);
3694         }
3695
3696         switch (event) {
3697         case HCI_EV_INQUIRY_COMPLETE:
3698                 hci_inquiry_complete_evt(hdev, skb);
3699                 break;
3700
3701         case HCI_EV_INQUIRY_RESULT:
3702                 hci_inquiry_result_evt(hdev, skb);
3703                 break;
3704
3705         case HCI_EV_CONN_COMPLETE:
3706                 hci_conn_complete_evt(hdev, skb);
3707                 break;
3708
3709         case HCI_EV_CONN_REQUEST:
3710                 hci_conn_request_evt(hdev, skb);
3711                 break;
3712
3713         case HCI_EV_DISCONN_COMPLETE:
3714                 hci_disconn_complete_evt(hdev, skb);
3715                 break;
3716
3717         case HCI_EV_AUTH_COMPLETE:
3718                 hci_auth_complete_evt(hdev, skb);
3719                 break;
3720
3721         case HCI_EV_REMOTE_NAME:
3722                 hci_remote_name_evt(hdev, skb);
3723                 break;
3724
3725         case HCI_EV_ENCRYPT_CHANGE:
3726                 hci_encrypt_change_evt(hdev, skb);
3727                 break;
3728
3729         case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
3730                 hci_change_link_key_complete_evt(hdev, skb);
3731                 break;
3732
3733         case HCI_EV_REMOTE_FEATURES:
3734                 hci_remote_features_evt(hdev, skb);
3735                 break;
3736
3737         case HCI_EV_CMD_COMPLETE:
3738                 hci_cmd_complete_evt(hdev, skb);
3739                 break;
3740
3741         case HCI_EV_CMD_STATUS:
3742                 hci_cmd_status_evt(hdev, skb);
3743                 break;
3744
3745         case HCI_EV_ROLE_CHANGE:
3746                 hci_role_change_evt(hdev, skb);
3747                 break;
3748
3749         case HCI_EV_NUM_COMP_PKTS:
3750                 hci_num_comp_pkts_evt(hdev, skb);
3751                 break;
3752
3753         case HCI_EV_MODE_CHANGE:
3754                 hci_mode_change_evt(hdev, skb);
3755                 break;
3756
3757         case HCI_EV_PIN_CODE_REQ:
3758                 hci_pin_code_request_evt(hdev, skb);
3759                 break;
3760
3761         case HCI_EV_LINK_KEY_REQ:
3762                 hci_link_key_request_evt(hdev, skb);
3763                 break;
3764
3765         case HCI_EV_LINK_KEY_NOTIFY:
3766                 hci_link_key_notify_evt(hdev, skb);
3767                 break;
3768
3769         case HCI_EV_CLOCK_OFFSET:
3770                 hci_clock_offset_evt(hdev, skb);
3771                 break;
3772
3773         case HCI_EV_PKT_TYPE_CHANGE:
3774                 hci_pkt_type_change_evt(hdev, skb);
3775                 break;
3776
3777         case HCI_EV_PSCAN_REP_MODE:
3778                 hci_pscan_rep_mode_evt(hdev, skb);
3779                 break;
3780
3781         case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
3782                 hci_inquiry_result_with_rssi_evt(hdev, skb);
3783                 break;
3784
3785         case HCI_EV_REMOTE_EXT_FEATURES:
3786                 hci_remote_ext_features_evt(hdev, skb);
3787                 break;
3788
3789         case HCI_EV_SYNC_CONN_COMPLETE:
3790                 hci_sync_conn_complete_evt(hdev, skb);
3791                 break;
3792
3793         case HCI_EV_EXTENDED_INQUIRY_RESULT:
3794                 hci_extended_inquiry_result_evt(hdev, skb);
3795                 break;
3796
3797         case HCI_EV_KEY_REFRESH_COMPLETE:
3798                 hci_key_refresh_complete_evt(hdev, skb);
3799                 break;
3800
3801         case HCI_EV_IO_CAPA_REQUEST:
3802                 hci_io_capa_request_evt(hdev, skb);
3803                 break;
3804
3805         case HCI_EV_IO_CAPA_REPLY:
3806                 hci_io_capa_reply_evt(hdev, skb);
3807                 break;
3808
3809         case HCI_EV_USER_CONFIRM_REQUEST:
3810                 hci_user_confirm_request_evt(hdev, skb);
3811                 break;
3812
3813         case HCI_EV_USER_PASSKEY_REQUEST:
3814                 hci_user_passkey_request_evt(hdev, skb);
3815                 break;
3816
3817         case HCI_EV_USER_PASSKEY_NOTIFY:
3818                 hci_user_passkey_notify_evt(hdev, skb);
3819                 break;
3820
3821         case HCI_EV_KEYPRESS_NOTIFY:
3822                 hci_keypress_notify_evt(hdev, skb);
3823                 break;
3824
3825         case HCI_EV_SIMPLE_PAIR_COMPLETE:
3826                 hci_simple_pair_complete_evt(hdev, skb);
3827                 break;
3828
3829         case HCI_EV_REMOTE_HOST_FEATURES:
3830                 hci_remote_host_features_evt(hdev, skb);
3831                 break;
3832
3833         case HCI_EV_LE_META:
3834                 hci_le_meta_evt(hdev, skb);
3835                 break;
3836
3837         case HCI_EV_CHANNEL_SELECTED:
3838                 hci_chan_selected_evt(hdev, skb);
3839                 break;
3840
3841         case HCI_EV_REMOTE_OOB_DATA_REQUEST:
3842                 hci_remote_oob_data_request_evt(hdev, skb);
3843                 break;
3844
3845         case HCI_EV_PHY_LINK_COMPLETE:
3846                 hci_phy_link_complete_evt(hdev, skb);
3847                 break;
3848
3849         case HCI_EV_LOGICAL_LINK_COMPLETE:
3850                 hci_loglink_complete_evt(hdev, skb);
3851                 break;
3852
3853         case HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE:
3854                 hci_disconn_loglink_complete_evt(hdev, skb);
3855                 break;
3856
3857         case HCI_EV_DISCONN_PHY_LINK_COMPLETE:
3858                 hci_disconn_phylink_complete_evt(hdev, skb);
3859                 break;
3860
3861         case HCI_EV_NUM_COMP_BLOCKS:
3862                 hci_num_comp_blocks_evt(hdev, skb);
3863                 break;
3864
3865         default:
3866                 BT_DBG("%s event 0x%2.2x", hdev->name, event);
3867                 break;
3868         }
3869
3870         kfree_skb(skb);
3871         hdev->stat.evt_rx++;
3872 }