net/bluetooth/hci_event.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI event handling. */
  26
  27 #include <asm/unaligned.h>
  28
  29 #include <net/bluetooth/bluetooth.h>
  30 #include <net/bluetooth/hci_core.h>
  31 #include <net/bluetooth/mgmt.h>
  32
  33 #include "hci_request.h"
  34 #include "hci_debugfs.h"
  35 #include "a2mp.h"
  36 #include "amp.h"
  37 #include "smp.h"
  38
  39 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
  40                  "\x00\x00\x00\x00\x00\x00\x00\x00"
  41
  42 /* Handle HCI Event packets */
  43
  44 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
  45 {
  46         __u8 status = *((__u8 *) skb->data);
  47
  48         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  49
  50         if (status)
  51                 return;
  52
  53         clear_bit(HCI_INQUIRY, &hdev->flags);
  54         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
  55         wake_up_bit(&hdev->flags, HCI_INQUIRY);
  56
  57         hci_dev_lock(hdev);
  58         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
  59         hci_dev_unlock(hdev);
  60
  61         hci_conn_check_pending(hdev);
  62 }
  63
  64 static void hci_cc_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  65 {
  66         __u8 status = *((__u8 *) skb->data);
  67
  68         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  69
  70         if (status)
  71                 return;
  72
  73         hci_dev_set_flag(hdev, HCI_PERIODIC_INQ);
  74 }
  75
  76 static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  77 {
  78         __u8 status = *((__u8 *) skb->data);
  79
  80         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  81
  82         if (status)
  83                 return;
  84
  85         hci_dev_clear_flag(hdev, HCI_PERIODIC_INQ);
  86
  87         hci_conn_check_pending(hdev);
  88 }
  89
  90 static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev,
  91                                           struct sk_buff *skb)
  92 {
  93         BT_DBG("%s", hdev->name);
  94 }
  95
  96 static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
  97 {
  98         struct hci_rp_role_discovery *rp = (void *) skb->data;
  99         struct hci_conn *conn;
 100
 101         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 102
 103         if (rp->status)
 104                 return;
 105
 106         hci_dev_lock(hdev);
 107
 108         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 109         if (conn)
 110                 conn->role = rp->role;
 111
 112         hci_dev_unlock(hdev);
 113 }
 114
 115 static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 116 {
 117         struct hci_rp_read_link_policy *rp = (void *) skb->data;
 118         struct hci_conn *conn;
 119
 120         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 121
 122         if (rp->status)
 123                 return;
 124
 125         hci_dev_lock(hdev);
 126
 127         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 128         if (conn)
 129                 conn->link_policy = __le16_to_cpu(rp->policy);
 130
 131         hci_dev_unlock(hdev);
 132 }
 133
 134 static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 135 {
 136         struct hci_rp_write_link_policy *rp = (void *) skb->data;
 137         struct hci_conn *conn;
 138         void *sent;
 139
 140         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 141
 142         if (rp->status)
 143                 return;
 144
 145         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
 146         if (!sent)
 147                 return;
 148
 149         hci_dev_lock(hdev);
 150
 151         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 152         if (conn)
 153                 conn->link_policy = get_unaligned_le16(sent + 2);
 154
 155         hci_dev_unlock(hdev);
 156 }
 157
 158 static void hci_cc_read_def_link_policy(struct hci_dev *hdev,
 159                                         struct sk_buff *skb)
 160 {
 161         struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
 162
 163         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 164
 165         if (rp->status)
 166                 return;
 167
 168         hdev->link_policy = __le16_to_cpu(rp->policy);
 169 }
 170
 171 static void hci_cc_write_def_link_policy(struct hci_dev *hdev,
 172                                          struct sk_buff *skb)
 173 {
 174         __u8 status = *((__u8 *) skb->data);
 175         void *sent;
 176
 177         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 178
 179         if (status)
 180                 return;
 181
 182         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
 183         if (!sent)
 184                 return;
 185
 186         hdev->link_policy = get_unaligned_le16(sent);
 187 }
 188
 189 static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
 190 {
 191         __u8 status = *((__u8 *) skb->data);
 192
 193         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 194
 195         clear_bit(HCI_RESET, &hdev->flags);
 196
 197         if (status)
 198                 return;
 199
 200         /* Reset all non-persistent flags */
 201         hdev->dev_flags &= ~HCI_PERSISTENT_MASK;
 202
 203         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
 204
 205         hdev->inq_tx_power = HCI_TX_POWER_INVALID;
 206         hdev->adv_tx_power = HCI_TX_POWER_INVALID;
 207
 208         memset(hdev->adv_data, 0, sizeof(hdev->adv_data));
 209         hdev->adv_data_len = 0;
 210
 211         memset(hdev->scan_rsp_data, 0, sizeof(hdev->scan_rsp_data));
 212         hdev->scan_rsp_data_len = 0;
 213
 214         hdev->le_scan_type = LE_SCAN_PASSIVE;
 215
 216         hdev->ssp_debug_mode = 0;
 217
 218         hci_bdaddr_list_clear(&hdev->le_white_list);
 219 }
 220
 221 static void hci_cc_read_stored_link_key(struct hci_dev *hdev,
 222                                         struct sk_buff *skb)
 223 {
 224         struct hci_rp_read_stored_link_key *rp = (void *)skb->data;
 225         struct hci_cp_read_stored_link_key *sent;
 226
 227         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 228
 229         sent = hci_sent_cmd_data(hdev, HCI_OP_READ_STORED_LINK_KEY);
 230         if (!sent)
 231                 return;
 232
 233         if (!rp->status && sent->read_all == 0x01) {
 234                 hdev->stored_max_keys = rp->max_keys;
 235                 hdev->stored_num_keys = rp->num_keys;
 236         }
 237 }
 238
 239 static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
 240                                           struct sk_buff *skb)
 241 {
 242         struct hci_rp_delete_stored_link_key *rp = (void *)skb->data;
 243
 244         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 245
 246         if (rp->status)
 247                 return;
 248
 249         if (rp->num_keys <= hdev->stored_num_keys)
 250                 hdev->stored_num_keys -= rp->num_keys;
 251         else
 252                 hdev->stored_num_keys = 0;
 253 }
 254
 255 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 256 {
 257         __u8 status = *((__u8 *) skb->data);
 258         void *sent;
 259
 260         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 261
 262         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
 263         if (!sent)
 264                 return;
 265
 266         hci_dev_lock(hdev);
 267
 268         if (hci_dev_test_flag(hdev, HCI_MGMT))
 269                 mgmt_set_local_name_complete(hdev, sent, status);
 270         else if (!status)
 271                 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
 272
 273         hci_dev_unlock(hdev);
 274 }
 275
 276 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 277 {
 278         struct hci_rp_read_local_name *rp = (void *) skb->data;
 279
 280         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 281
 282         if (rp->status)
 283                 return;
 284
 285         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 286             hci_dev_test_flag(hdev, HCI_CONFIG))
 287                 memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
 288 }
 289
 290 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
 291 {
 292         __u8 status = *((__u8 *) skb->data);
 293         void *sent;
 294
 295         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 296
 297         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
 298         if (!sent)
 299                 return;
 300
 301         hci_dev_lock(hdev);
 302
 303         if (!status) {
 304                 __u8 param = *((__u8 *) sent);
 305
 306                 if (param == AUTH_ENABLED)
 307                         set_bit(HCI_AUTH, &hdev->flags);
 308                 else
 309                         clear_bit(HCI_AUTH, &hdev->flags);
 310         }
 311
 312         if (hci_dev_test_flag(hdev, HCI_MGMT))
 313                 mgmt_auth_enable_complete(hdev, status);
 314
 315         hci_dev_unlock(hdev);
 316 }
 317
 318 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
 319 {
 320         __u8 status = *((__u8 *) skb->data);
 321         __u8 param;
 322         void *sent;
 323
 324         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 325
 326         if (status)
 327                 return;
 328
 329         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
 330         if (!sent)
 331                 return;
 332
 333         param = *((__u8 *) sent);
 334
 335         if (param)
 336                 set_bit(HCI_ENCRYPT, &hdev->flags);
 337         else
 338                 clear_bit(HCI_ENCRYPT, &hdev->flags);
 339 }
 340
 341 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
 342 {
 343         __u8 status = *((__u8 *) skb->data);
 344         __u8 param;
 345         void *sent;
 346
 347         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 348
 349         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
 350         if (!sent)
 351                 return;
 352
 353         param = *((__u8 *) sent);
 354
 355         hci_dev_lock(hdev);
 356
 357         if (status) {
 358                 hdev->discov_timeout = 0;
 359                 goto done;
 360         }
 361
 362         if (param & SCAN_INQUIRY)
 363                 set_bit(HCI_ISCAN, &hdev->flags);
 364         else
 365                 clear_bit(HCI_ISCAN, &hdev->flags);
 366
 367         if (param & SCAN_PAGE)
 368                 set_bit(HCI_PSCAN, &hdev->flags);
 369         else
 370                 clear_bit(HCI_PSCAN, &hdev->flags);
 371
 372 done:
 373         hci_dev_unlock(hdev);
 374 }
 375
 376 static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 377 {
 378         struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
 379
 380         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 381
 382         if (rp->status)
 383                 return;
 384
 385         memcpy(hdev->dev_class, rp->dev_class, 3);
 386
 387         BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
 388                hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
 389 }
 390
 391 static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 392 {
 393         __u8 status = *((__u8 *) skb->data);
 394         void *sent;
 395
 396         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 397
 398         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
 399         if (!sent)
 400                 return;
 401
 402         hci_dev_lock(hdev);
 403
 404         if (status == 0)
 405                 memcpy(hdev->dev_class, sent, 3);
 406
 407         if (hci_dev_test_flag(hdev, HCI_MGMT))
 408                 mgmt_set_class_of_dev_complete(hdev, sent, status);
 409
 410         hci_dev_unlock(hdev);
 411 }
 412
 413 static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 414 {
 415         struct hci_rp_read_voice_setting *rp = (void *) skb->data;
 416         __u16 setting;
 417
 418         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 419
 420         if (rp->status)
 421                 return;
 422
 423         setting = __le16_to_cpu(rp->voice_setting);
 424
 425         if (hdev->voice_setting == setting)
 426                 return;
 427
 428         hdev->voice_setting = setting;
 429
 430         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 431
 432         if (hdev->notify)
 433                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 434 }
 435
 436 static void hci_cc_write_voice_setting(struct hci_dev *hdev,
 437                                        struct sk_buff *skb)
 438 {
 439         __u8 status = *((__u8 *) skb->data);
 440         __u16 setting;
 441         void *sent;
 442
 443         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 444
 445         if (status)
 446                 return;
 447
 448         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
 449         if (!sent)
 450                 return;
 451
 452         setting = get_unaligned_le16(sent);
 453
 454         if (hdev->voice_setting == setting)
 455                 return;
 456
 457         hdev->voice_setting = setting;
 458
 459         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 460
 461         if (hdev->notify)
 462                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 463 }
 464
 465 static void hci_cc_read_num_supported_iac(struct hci_dev *hdev,
 466                                           struct sk_buff *skb)
 467 {
 468         struct hci_rp_read_num_supported_iac *rp = (void *) skb->data;
 469
 470         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 471
 472         if (rp->status)
 473                 return;
 474
 475         hdev->num_iac = rp->num_iac;
 476
 477         BT_DBG("%s num iac %d", hdev->name, hdev->num_iac);
 478 }
 479
 480 static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 481 {
 482         __u8 status = *((__u8 *) skb->data);
 483         struct hci_cp_write_ssp_mode *sent;
 484
 485         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 486
 487         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
 488         if (!sent)
 489                 return;
 490
 491         hci_dev_lock(hdev);
 492
 493         if (!status) {
 494                 if (sent->mode)
 495                         hdev->features[1][0] |= LMP_HOST_SSP;
 496                 else
 497                         hdev->features[1][0] &= ~LMP_HOST_SSP;
 498         }
 499
 500         if (hci_dev_test_flag(hdev, HCI_MGMT))
 501                 mgmt_ssp_enable_complete(hdev, sent->mode, status);
 502         else if (!status) {
 503                 if (sent->mode)
 504                         hci_dev_set_flag(hdev, HCI_SSP_ENABLED);
 505                 else
 506                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
 507         }
 508
 509         hci_dev_unlock(hdev);
 510 }
 511
 512 static void hci_cc_write_sc_support(struct hci_dev *hdev, struct sk_buff *skb)
 513 {
 514         u8 status = *((u8 *) skb->data);
 515         struct hci_cp_write_sc_support *sent;
 516
 517         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 518
 519         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SC_SUPPORT);
 520         if (!sent)
 521                 return;
 522
 523         hci_dev_lock(hdev);
 524
 525         if (!status) {
 526                 if (sent->support)
 527                         hdev->features[1][0] |= LMP_HOST_SC;
 528                 else
 529                         hdev->features[1][0] &= ~LMP_HOST_SC;
 530         }
 531
 532         if (!hci_dev_test_flag(hdev, HCI_MGMT) && !status) {
 533                 if (sent->support)
 534                         hci_dev_set_flag(hdev, HCI_SC_ENABLED);
 535                 else
 536                         hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
 537         }
 538
 539         hci_dev_unlock(hdev);
 540 }
 541
 542 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
 543 {
 544         struct hci_rp_read_local_version *rp = (void *) skb->data;
 545
 546         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 547
 548         if (rp->status)
 549                 return;
 550
 551         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 552             hci_dev_test_flag(hdev, HCI_CONFIG)) {
 553                 hdev->hci_ver = rp->hci_ver;
 554                 hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
 555                 hdev->lmp_ver = rp->lmp_ver;
 556                 hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
 557                 hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
 558         }
 559 }
 560
 561 static void hci_cc_read_local_commands(struct hci_dev *hdev,
 562                                        struct sk_buff *skb)
 563 {
 564         struct hci_rp_read_local_commands *rp = (void *) skb->data;
 565
 566         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 567
 568         if (rp->status)
 569                 return;
 570
 571         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 572             hci_dev_test_flag(hdev, HCI_CONFIG))
 573                 memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 574 }
 575
 576 static void hci_cc_read_local_features(struct hci_dev *hdev,
 577                                        struct sk_buff *skb)
 578 {
 579         struct hci_rp_read_local_features *rp = (void *) skb->data;
 580
 581         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 582
 583         if (rp->status)
 584                 return;
 585
 586         memcpy(hdev->features, rp->features, 8);
 587
 588         /* Adjust default settings according to features
 589          * supported by device. */
 590
 591         if (hdev->features[0][0] & LMP_3SLOT)
 592                 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 593
 594         if (hdev->features[0][0] & LMP_5SLOT)
 595                 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 596
 597         if (hdev->features[0][1] & LMP_HV2) {
 598                 hdev->pkt_type  |= (HCI_HV2);
 599                 hdev->esco_type |= (ESCO_HV2);
 600         }
 601
 602         if (hdev->features[0][1] & LMP_HV3) {
 603                 hdev->pkt_type  |= (HCI_HV3);
 604                 hdev->esco_type |= (ESCO_HV3);
 605         }
 606
 607         if (lmp_esco_capable(hdev))
 608                 hdev->esco_type |= (ESCO_EV3);
 609
 610         if (hdev->features[0][4] & LMP_EV4)
 611                 hdev->esco_type |= (ESCO_EV4);
 612
 613         if (hdev->features[0][4] & LMP_EV5)
 614                 hdev->esco_type |= (ESCO_EV5);
 615
 616         if (hdev->features[0][5] & LMP_EDR_ESCO_2M)
 617                 hdev->esco_type |= (ESCO_2EV3);
 618
 619         if (hdev->features[0][5] & LMP_EDR_ESCO_3M)
 620                 hdev->esco_type |= (ESCO_3EV3);
 621
 622         if (hdev->features[0][5] & LMP_EDR_3S_ESCO)
 623                 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
 624 }
 625
 626 static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
 627                                            struct sk_buff *skb)
 628 {
 629         struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
 630
 631         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 632
 633         if (rp->status)
 634                 return;
 635
 636         if (hdev->max_page < rp->max_page)
 637                 hdev->max_page = rp->max_page;
 638
 639         if (rp->page < HCI_MAX_PAGES)
 640                 memcpy(hdev->features[rp->page], rp->features, 8);
 641 }
 642
 643 static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
 644                                           struct sk_buff *skb)
 645 {
 646         struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;
 647
 648         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 649
 650         if (rp->status)
 651                 return;
 652
 653         hdev->flow_ctl_mode = rp->mode;
 654 }
 655
 656 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 657 {
 658         struct hci_rp_read_buffer_size *rp = (void *) skb->data;
 659
 660         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 661
 662         if (rp->status)
 663                 return;
 664
 665         hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
 666         hdev->sco_mtu  = rp->sco_mtu;
 667         hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
 668         hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
 669
 670         if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
 671                 hdev->sco_mtu  = 64;
 672                 hdev->sco_pkts = 8;
 673         }
 674
 675         hdev->acl_cnt = hdev->acl_pkts;
 676         hdev->sco_cnt = hdev->sco_pkts;
 677
 678         BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
 679                hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
 680 }
 681
 682 static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
 683 {
 684         struct hci_rp_read_bd_addr *rp = (void *) skb->data;
 685
 686         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 687
 688         if (rp->status)
 689                 return;
 690
 691         if (test_bit(HCI_INIT, &hdev->flags))
 692                 bacpy(&hdev->bdaddr, &rp->bdaddr);
 693
 694         if (hci_dev_test_flag(hdev, HCI_SETUP))
 695                 bacpy(&hdev->setup_addr, &rp->bdaddr);
 696 }
 697
 698 static void hci_cc_read_page_scan_activity(struct hci_dev *hdev,
 699                                            struct sk_buff *skb)
 700 {
 701         struct hci_rp_read_page_scan_activity *rp = (void *) skb->data;
 702
 703         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 704
 705         if (rp->status)
 706                 return;
 707
 708         if (test_bit(HCI_INIT, &hdev->flags)) {
 709                 hdev->page_scan_interval = __le16_to_cpu(rp->interval);
 710                 hdev->page_scan_window = __le16_to_cpu(rp->window);
 711         }
 712 }
 713
 714 static void hci_cc_write_page_scan_activity(struct hci_dev *hdev,
 715                                             struct sk_buff *skb)
 716 {
 717         u8 status = *((u8 *) skb->data);
 718         struct hci_cp_write_page_scan_activity *sent;
 719
 720         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 721
 722         if (status)
 723                 return;
 724
 725         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY);
 726         if (!sent)
 727                 return;
 728
 729         hdev->page_scan_interval = __le16_to_cpu(sent->interval);
 730         hdev->page_scan_window = __le16_to_cpu(sent->window);
 731 }
 732
 733 static void hci_cc_read_page_scan_type(struct hci_dev *hdev,
 734                                            struct sk_buff *skb)
 735 {
 736         struct hci_rp_read_page_scan_type *rp = (void *) skb->data;
 737
 738         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 739
 740         if (rp->status)
 741                 return;
 742
 743         if (test_bit(HCI_INIT, &hdev->flags))
 744                 hdev->page_scan_type = rp->type;
 745 }
 746
 747 static void hci_cc_write_page_scan_type(struct hci_dev *hdev,
 748                                         struct sk_buff *skb)
 749 {
 750         u8 status = *((u8 *) skb->data);
 751         u8 *type;
 752
 753         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 754
 755         if (status)
 756                 return;
 757
 758         type = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE);
 759         if (type)
 760                 hdev->page_scan_type = *type;
 761 }
 762
 763 static void hci_cc_read_data_block_size(struct hci_dev *hdev,
 764                                         struct sk_buff *skb)
 765 {
 766         struct hci_rp_read_data_block_size *rp = (void *) skb->data;
 767
 768         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 769
 770         if (rp->status)
 771                 return;
 772
 773         hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
 774         hdev->block_len = __le16_to_cpu(rp->block_len);
 775         hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
 776
 777         hdev->block_cnt = hdev->num_blocks;
 778
 779         BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
 780                hdev->block_cnt, hdev->block_len);
 781 }
 782
 783 static void hci_cc_read_clock(struct hci_dev *hdev, struct sk_buff *skb)
 784 {
 785         struct hci_rp_read_clock *rp = (void *) skb->data;
 786         struct hci_cp_read_clock *cp;
 787         struct hci_conn *conn;
 788
 789         BT_DBG("%s", hdev->name);
 790
 791         if (skb->len < sizeof(*rp))
 792                 return;
 793
 794         if (rp->status)
 795                 return;
 796
 797         hci_dev_lock(hdev);
 798
 799         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
 800         if (!cp)
 801                 goto unlock;
 802
 803         if (cp->which == 0x00) {
 804                 hdev->clock = le32_to_cpu(rp->clock);
 805                 goto unlock;
 806         }
 807
 808         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 809         if (conn) {
 810                 conn->clock = le32_to_cpu(rp->clock);
 811                 conn->clock_accuracy = le16_to_cpu(rp->accuracy);
 812         }
 813
 814 unlock:
 815         hci_dev_unlock(hdev);
 816 }
 817
 818 static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
 819                                        struct sk_buff *skb)
 820 {
 821         struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
 822
 823         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 824
 825         if (rp->status)
 826                 goto a2mp_rsp;
 827
 828         hdev->amp_status = rp->amp_status;
 829         hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
 830         hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
 831         hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
 832         hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
 833         hdev->amp_type = rp->amp_type;
 834         hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
 835         hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
 836         hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
 837         hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
 838
 839 a2mp_rsp:
 840         a2mp_send_getinfo_rsp(hdev);
 841 }
 842
 843 static void hci_cc_read_local_amp_assoc(struct hci_dev *hdev,
 844                                         struct sk_buff *skb)
 845 {
 846         struct hci_rp_read_local_amp_assoc *rp = (void *) skb->data;
 847         struct amp_assoc *assoc = &hdev->loc_assoc;
 848         size_t rem_len, frag_len;
 849
 850         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 851
 852         if (rp->status)
 853                 goto a2mp_rsp;
 854
 855         frag_len = skb->len - sizeof(*rp);
 856         rem_len = __le16_to_cpu(rp->rem_len);
 857
 858         if (rem_len > frag_len) {
 859                 BT_DBG("frag_len %zu rem_len %zu", frag_len, rem_len);
 860
 861                 memcpy(assoc->data + assoc->offset, rp->frag, frag_len);
 862                 assoc->offset += frag_len;
 863
 864                 /* Read other fragments */
 865                 amp_read_loc_assoc_frag(hdev, rp->phy_handle);
 866
 867                 return;
 868         }
 869
 870         memcpy(assoc->data + assoc->offset, rp->frag, rem_len);
 871         assoc->len = assoc->offset + rem_len;
 872         assoc->offset = 0;
 873
 874 a2mp_rsp:
 875         /* Send A2MP Rsp when all fragments are received */
 876         a2mp_send_getampassoc_rsp(hdev, rp->status);
 877         a2mp_send_create_phy_link_req(hdev, rp->status);
 878 }
 879
 880 static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
 881                                          struct sk_buff *skb)
 882 {
 883         struct hci_rp_read_inq_rsp_tx_power *rp = (void *) skb->data;
 884
 885         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 886
 887         if (rp->status)
 888                 return;
 889
 890         hdev->inq_tx_power = rp->tx_power;
 891 }
 892
 893 static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
 894 {
 895         struct hci_rp_pin_code_reply *rp = (void *) skb->data;
 896         struct hci_cp_pin_code_reply *cp;
 897         struct hci_conn *conn;
 898
 899         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 900
 901         hci_dev_lock(hdev);
 902
 903         if (hci_dev_test_flag(hdev, HCI_MGMT))
 904                 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
 905
 906         if (rp->status)
 907                 goto unlock;
 908
 909         cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
 910         if (!cp)
 911                 goto unlock;
 912
 913         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 914         if (conn)
 915                 conn->pin_length = cp->pin_len;
 916
 917 unlock:
 918         hci_dev_unlock(hdev);
 919 }
 920
 921 static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
 922 {
 923         struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
 924
 925         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 926
 927         hci_dev_lock(hdev);
 928
 929         if (hci_dev_test_flag(hdev, HCI_MGMT))
 930                 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
 931                                                  rp->status);
 932
 933         hci_dev_unlock(hdev);
 934 }
 935
 936 static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
 937                                        struct sk_buff *skb)
 938 {
 939         struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
 940
 941         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 942
 943         if (rp->status)
 944                 return;
 945
 946         hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
 947         hdev->le_pkts = rp->le_max_pkt;
 948
 949         hdev->le_cnt = hdev->le_pkts;
 950
 951         BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
 952 }
 953
 954 static void hci_cc_le_read_local_features(struct hci_dev *hdev,
 955                                           struct sk_buff *skb)
 956 {
 957         struct hci_rp_le_read_local_features *rp = (void *) skb->data;
 958
 959         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 960
 961         if (rp->status)
 962                 return;
 963
 964         memcpy(hdev->le_features, rp->features, 8);
 965 }
 966
 967 static void hci_cc_le_read_adv_tx_power(struct hci_dev *hdev,
 968                                         struct sk_buff *skb)
 969 {
 970         struct hci_rp_le_read_adv_tx_power *rp = (void *) skb->data;
 971
 972         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 973
 974         if (rp->status)
 975                 return;
 976
 977         hdev->adv_tx_power = rp->tx_power;
 978 }
 979
 980 static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
 981 {
 982         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 983
 984         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 985
 986         hci_dev_lock(hdev);
 987
 988         if (hci_dev_test_flag(hdev, HCI_MGMT))
 989                 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,
 990                                                  rp->status);
 991
 992         hci_dev_unlock(hdev);
 993 }
 994
 995 static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
 996                                           struct sk_buff *skb)
 997 {
 998         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 999
1000         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1001
1002         hci_dev_lock(hdev);
1003
1004         if (hci_dev_test_flag(hdev, HCI_MGMT))
1005                 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
1006                                                      ACL_LINK, 0, rp->status);
1007
1008         hci_dev_unlock(hdev);
1009 }
1010
1011 static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
1012 {
1013         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1014
1015         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1016
1017         hci_dev_lock(hdev);
1018
1019         if (hci_dev_test_flag(hdev, HCI_MGMT))
1020                 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
1021                                                  0, rp->status);
1022
1023         hci_dev_unlock(hdev);
1024 }
1025
1026 static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
1027                                           struct sk_buff *skb)
1028 {
1029         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1030
1031         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1032
1033         hci_dev_lock(hdev);
1034
1035         if (hci_dev_test_flag(hdev, HCI_MGMT))
1036                 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
1037                                                      ACL_LINK, 0, rp->status);
1038
1039         hci_dev_unlock(hdev);
1040 }
1041
1042 static void hci_cc_read_local_oob_data(struct hci_dev *hdev,
1043                                        struct sk_buff *skb)
1044 {
1045         struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
1046
1047         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1048
1049         hci_dev_lock(hdev);
1050         mgmt_read_local_oob_data_complete(hdev, rp->hash, rp->rand, NULL, NULL,
1051                                           rp->status);
1052         hci_dev_unlock(hdev);
1053 }
1054
1055 static void hci_cc_read_local_oob_ext_data(struct hci_dev *hdev,
1056                                            struct sk_buff *skb)
1057 {
1058         struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
1059
1060         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1061
1062         hci_dev_lock(hdev);
1063         mgmt_read_local_oob_data_complete(hdev, rp->hash192, rp->rand192,
1064                                           rp->hash256, rp->rand256,
1065                                           rp->status);
1066         hci_dev_unlock(hdev);
1067 }
1068
1069
1070 static void hci_cc_le_set_random_addr(struct hci_dev *hdev, struct sk_buff *skb)
1071 {
1072         __u8 status = *((__u8 *) skb->data);
1073         bdaddr_t *sent;
1074
1075         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1076
1077         if (status)
1078                 return;
1079
1080         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_RANDOM_ADDR);
1081         if (!sent)
1082                 return;
1083
1084         hci_dev_lock(hdev);
1085
1086         bacpy(&hdev->random_addr, sent);
1087
1088         hci_dev_unlock(hdev);
1089 }
1090
1091 static void hci_cc_le_set_adv_enable(struct hci_dev *hdev, struct sk_buff *skb)
1092 {
1093         __u8 *sent, status = *((__u8 *) skb->data);
1094
1095         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1096
1097         if (status)
1098                 return;
1099
1100         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_ENABLE);
1101         if (!sent)
1102                 return;
1103
1104         hci_dev_lock(hdev);
1105
1106         /* If we're doing connection initiation as peripheral. Set a
1107          * timeout in case something goes wrong.
1108          */
1109         if (*sent) {
1110                 struct hci_conn *conn;
1111
1112                 hci_dev_set_flag(hdev, HCI_LE_ADV);
1113
1114                 conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
1115                 if (conn)
1116                         queue_delayed_work(hdev->workqueue,
1117                                            &conn->le_conn_timeout,
1118                                            conn->conn_timeout);
1119         } else {
1120                 hci_dev_clear_flag(hdev, HCI_LE_ADV);
1121         }
1122
1123         hci_dev_unlock(hdev);
1124 }
1125
1126 static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
1127 {
1128         struct hci_cp_le_set_scan_param *cp;
1129         __u8 status = *((__u8 *) skb->data);
1130
1131         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1132
1133         if (status)
1134                 return;
1135
1136         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_PARAM);
1137         if (!cp)
1138                 return;
1139
1140         hci_dev_lock(hdev);
1141
1142         hdev->le_scan_type = cp->type;
1143
1144         hci_dev_unlock(hdev);
1145 }
1146
1147 static bool has_pending_adv_report(struct hci_dev *hdev)
1148 {
1149         struct discovery_state *d = &hdev->discovery;
1150
1151         return bacmp(&d->last_adv_addr, BDADDR_ANY);
1152 }
1153
1154 static void clear_pending_adv_report(struct hci_dev *hdev)
1155 {
1156         struct discovery_state *d = &hdev->discovery;
1157
1158         bacpy(&d->last_adv_addr, BDADDR_ANY);
1159         d->last_adv_data_len = 0;
1160 }
1161
1162 static void store_pending_adv_report(struct hci_dev *hdev, bdaddr_t *bdaddr,
1163                                      u8 bdaddr_type, s8 rssi, u32 flags,
1164                                      u8 *data, u8 len)
1165 {
1166         struct discovery_state *d = &hdev->discovery;
1167
1168         bacpy(&d->last_adv_addr, bdaddr);
1169         d->last_adv_addr_type = bdaddr_type;
1170         d->last_adv_rssi = rssi;
1171         d->last_adv_flags = flags;
1172         memcpy(d->last_adv_data, data, len);
1173         d->last_adv_data_len = len;
1174 }
1175
1176 static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
1177                                       struct sk_buff *skb)
1178 {
1179         struct hci_cp_le_set_scan_enable *cp;
1180         __u8 status = *((__u8 *) skb->data);
1181
1182         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1183
1184         if (status)
1185                 return;
1186
1187         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
1188         if (!cp)
1189                 return;
1190
1191         hci_dev_lock(hdev);
1192
1193         switch (cp->enable) {
1194         case LE_SCAN_ENABLE:
1195                 hci_dev_set_flag(hdev, HCI_LE_SCAN);
1196                 if (hdev->le_scan_type == LE_SCAN_ACTIVE)
1197                         clear_pending_adv_report(hdev);
1198                 break;
1199
1200         case LE_SCAN_DISABLE:
1201                 /* We do this here instead of when setting DISCOVERY_STOPPED
1202                  * since the latter would potentially require waiting for
1203                  * inquiry to stop too.
1204                  */
1205                 if (has_pending_adv_report(hdev)) {
1206                         struct discovery_state *d = &hdev->discovery;
1207
1208                         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
1209                                           d->last_adv_addr_type, NULL,
1210                                           d->last_adv_rssi, d->last_adv_flags,
1211                                           d->last_adv_data,
1212                                           d->last_adv_data_len, NULL, 0);
1213                 }
1214
1215                 /* Cancel this timer so that we don't try to disable scanning
1216                  * when it's already disabled.
1217                  */
1218                 cancel_delayed_work(&hdev->le_scan_disable);
1219
1220                 hci_dev_clear_flag(hdev, HCI_LE_SCAN);
1221
1222                 /* The HCI_LE_SCAN_INTERRUPTED flag indicates that we
1223                  * interrupted scanning due to a connect request. Mark
1224                  * therefore discovery as stopped. If this was not
1225                  * because of a connect request advertising might have
1226                  * been disabled because of active scanning, so
1227                  * re-enable it again if necessary.
1228                  */
1229                 if (hci_dev_test_and_clear_flag(hdev, HCI_LE_SCAN_INTERRUPTED))
1230                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1231                 else if (!hci_dev_test_flag(hdev, HCI_LE_ADV) &&
1232                          hdev->discovery.state == DISCOVERY_FINDING)
1233                         mgmt_reenable_advertising(hdev);
1234
1235                 break;
1236
1237         default:
1238                 BT_ERR("Used reserved LE_Scan_Enable param %d", cp->enable);
1239                 break;
1240         }
1241
1242         hci_dev_unlock(hdev);
1243 }
1244
1245 static void hci_cc_le_read_white_list_size(struct hci_dev *hdev,
1246                                            struct sk_buff *skb)
1247 {
1248         struct hci_rp_le_read_white_list_size *rp = (void *) skb->data;
1249
1250         BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
1251
1252         if (rp->status)
1253                 return;
1254
1255         hdev->le_white_list_size = rp->size;
1256 }
1257
1258 static void hci_cc_le_clear_white_list(struct hci_dev *hdev,
1259                                        struct sk_buff *skb)
1260 {
1261         __u8 status = *((__u8 *) skb->data);
1262
1263         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1264
1265         if (status)
1266                 return;
1267
1268         hci_bdaddr_list_clear(&hdev->le_white_list);
1269 }
1270
1271 static void hci_cc_le_add_to_white_list(struct hci_dev *hdev,
1272                                         struct sk_buff *skb)
1273 {
1274         struct hci_cp_le_add_to_white_list *sent;
1275         __u8 status = *((__u8 *) skb->data);
1276
1277         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1278
1279         if (status)
1280                 return;
1281
1282         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_WHITE_LIST);
1283         if (!sent)
1284                 return;
1285
1286         hci_bdaddr_list_add(&hdev->le_white_list, &sent->bdaddr,
1287                            sent->bdaddr_type);
1288 }
1289
1290 static void hci_cc_le_del_from_white_list(struct hci_dev *hdev,
1291                                           struct sk_buff *skb)
1292 {
1293         struct hci_cp_le_del_from_white_list *sent;
1294         __u8 status = *((__u8 *) skb->data);
1295
1296         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1297
1298         if (status)
1299                 return;
1300
1301         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_WHITE_LIST);
1302         if (!sent)
1303                 return;
1304
1305         hci_bdaddr_list_del(&hdev->le_white_list, &sent->bdaddr,
1306                             sent->bdaddr_type);
1307 }
1308
1309 static void hci_cc_le_read_supported_states(struct hci_dev *hdev,
1310                                             struct sk_buff *skb)
1311 {
1312         struct hci_rp_le_read_supported_states *rp = (void *) skb->data;
1313
1314         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1315
1316         if (rp->status)
1317                 return;
1318
1319         memcpy(hdev->le_states, rp->le_states, 8);
1320 }
1321
1322 static void hci_cc_le_read_def_data_len(struct hci_dev *hdev,
1323                                         struct sk_buff *skb)
1324 {
1325         struct hci_rp_le_read_def_data_len *rp = (void *) skb->data;
1326
1327         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1328
1329         if (rp->status)
1330                 return;
1331
1332         hdev->le_def_tx_len = le16_to_cpu(rp->tx_len);
1333         hdev->le_def_tx_time = le16_to_cpu(rp->tx_time);
1334 }
1335
1336 static void hci_cc_le_write_def_data_len(struct hci_dev *hdev,
1337                                          struct sk_buff *skb)
1338 {
1339         struct hci_cp_le_write_def_data_len *sent;
1340         __u8 status = *((__u8 *) skb->data);
1341
1342         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1343
1344         if (status)
1345                 return;
1346
1347         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_WRITE_DEF_DATA_LEN);
1348         if (!sent)
1349                 return;
1350
1351         hdev->le_def_tx_len = le16_to_cpu(sent->tx_len);
1352         hdev->le_def_tx_time = le16_to_cpu(sent->tx_time);
1353 }
1354
1355 static void hci_cc_le_read_max_data_len(struct hci_dev *hdev,
1356                                         struct sk_buff *skb)
1357 {
1358         struct hci_rp_le_read_max_data_len *rp = (void *) skb->data;
1359
1360         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1361
1362         if (rp->status)
1363                 return;
1364
1365         hdev->le_max_tx_len = le16_to_cpu(rp->tx_len);
1366         hdev->le_max_tx_time = le16_to_cpu(rp->tx_time);
1367         hdev->le_max_rx_len = le16_to_cpu(rp->rx_len);
1368         hdev->le_max_rx_time = le16_to_cpu(rp->rx_time);
1369 }
1370
1371 static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
1372                                            struct sk_buff *skb)
1373 {
1374         struct hci_cp_write_le_host_supported *sent;
1375         __u8 status = *((__u8 *) skb->data);
1376
1377         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1378
1379         if (status)
1380                 return;
1381
1382         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
1383         if (!sent)
1384                 return;
1385
1386         hci_dev_lock(hdev);
1387
1388         if (sent->le) {
1389                 hdev->features[1][0] |= LMP_HOST_LE;
1390                 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
1391         } else {
1392                 hdev->features[1][0] &= ~LMP_HOST_LE;
1393                 hci_dev_clear_flag(hdev, HCI_LE_ENABLED);
1394                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1395         }
1396
1397         if (sent->simul)
1398                 hdev->features[1][0] |= LMP_HOST_LE_BREDR;
1399         else
1400                 hdev->features[1][0] &= ~LMP_HOST_LE_BREDR;
1401
1402         hci_dev_unlock(hdev);
1403 }
1404
1405 static void hci_cc_set_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
1406 {
1407         struct hci_cp_le_set_adv_param *cp;
1408         u8 status = *((u8 *) skb->data);
1409
1410         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1411
1412         if (status)
1413                 return;
1414
1415         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_PARAM);
1416         if (!cp)
1417                 return;
1418
1419         hci_dev_lock(hdev);
1420         hdev->adv_addr_type = cp->own_address_type;
1421         hci_dev_unlock(hdev);
1422 }
1423
1424 static void hci_cc_write_remote_amp_assoc(struct hci_dev *hdev,
1425                                           struct sk_buff *skb)
1426 {
1427         struct hci_rp_write_remote_amp_assoc *rp = (void *) skb->data;
1428
1429         BT_DBG("%s status 0x%2.2x phy_handle 0x%2.2x",
1430                hdev->name, rp->status, rp->phy_handle);
1431
1432         if (rp->status)
1433                 return;
1434
1435         amp_write_rem_assoc_continue(hdev, rp->phy_handle);
1436 }
1437
1438 static void hci_cc_read_rssi(struct hci_dev *hdev, struct sk_buff *skb)
1439 {
1440         struct hci_rp_read_rssi *rp = (void *) skb->data;
1441         struct hci_conn *conn;
1442
1443         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1444
1445         if (rp->status)
1446                 return;
1447
1448         hci_dev_lock(hdev);
1449
1450         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1451         if (conn)
1452                 conn->rssi = rp->rssi;
1453
1454         hci_dev_unlock(hdev);
1455 }
1456
1457 static void hci_cc_read_tx_power(struct hci_dev *hdev, struct sk_buff *skb)
1458 {
1459         struct hci_cp_read_tx_power *sent;
1460         struct hci_rp_read_tx_power *rp = (void *) skb->data;
1461         struct hci_conn *conn;
1462
1463         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1464
1465         if (rp->status)
1466                 return;
1467
1468         sent = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
1469         if (!sent)
1470                 return;
1471
1472         hci_dev_lock(hdev);
1473
1474         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1475         if (!conn)
1476                 goto unlock;
1477
1478         switch (sent->type) {
1479         case 0x00:
1480                 conn->tx_power = rp->tx_power;
1481                 break;
1482         case 0x01:
1483                 conn->max_tx_power = rp->tx_power;
1484                 break;
1485         }
1486
1487 unlock:
1488         hci_dev_unlock(hdev);
1489 }
1490
1491 static void hci_cc_write_ssp_debug_mode(struct hci_dev *hdev, struct sk_buff *skb)
1492 {
1493         u8 status = *((u8 *) skb->data);
1494         u8 *mode;
1495
1496         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1497
1498         if (status)
1499                 return;
1500
1501         mode = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE);
1502         if (mode)
1503                 hdev->ssp_debug_mode = *mode;
1504 }
1505
1506 static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
1507 {
1508         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1509
1510         if (status) {
1511                 hci_conn_check_pending(hdev);
1512                 return;
1513         }
1514
1515         set_bit(HCI_INQUIRY, &hdev->flags);
1516 }
1517
1518 static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
1519 {
1520         struct hci_cp_create_conn *cp;
1521         struct hci_conn *conn;
1522
1523         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1524
1525         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
1526         if (!cp)
1527                 return;
1528
1529         hci_dev_lock(hdev);
1530
1531         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1532
1533         BT_DBG("%s bdaddr %pMR hcon %p", hdev->name, &cp->bdaddr, conn);
1534
1535         if (status) {
1536                 if (conn && conn->state == BT_CONNECT) {
1537                         if (status != 0x0c || conn->attempt > 2) {
1538                                 conn->state = BT_CLOSED;
1539                                 hci_connect_cfm(conn, status);
1540                                 hci_conn_del(conn);
1541                         } else
1542                                 conn->state = BT_CONNECT2;
1543                 }
1544         } else {
1545                 if (!conn) {
1546                         conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr,
1547                                             HCI_ROLE_MASTER);
1548                         if (!conn)
1549                                 BT_ERR("No memory for new connection");
1550                 }
1551         }
1552
1553         hci_dev_unlock(hdev);
1554 }
1555
1556 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
1557 {
1558         struct hci_cp_add_sco *cp;
1559         struct hci_conn *acl, *sco;
1560         __u16 handle;
1561
1562         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1563
1564         if (!status)
1565                 return;
1566
1567         cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
1568         if (!cp)
1569                 return;
1570
1571         handle = __le16_to_cpu(cp->handle);
1572
1573         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1574
1575         hci_dev_lock(hdev);
1576
1577         acl = hci_conn_hash_lookup_handle(hdev, handle);
1578         if (acl) {
1579                 sco = acl->link;
1580                 if (sco) {
1581                         sco->state = BT_CLOSED;
1582
1583                         hci_connect_cfm(sco, status);
1584                         hci_conn_del(sco);
1585                 }
1586         }
1587
1588         hci_dev_unlock(hdev);
1589 }
1590
1591 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
1592 {
1593         struct hci_cp_auth_requested *cp;
1594         struct hci_conn *conn;
1595
1596         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1597
1598         if (!status)
1599                 return;
1600
1601         cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
1602         if (!cp)
1603                 return;
1604
1605         hci_dev_lock(hdev);
1606
1607         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1608         if (conn) {
1609                 if (conn->state == BT_CONFIG) {
1610                         hci_connect_cfm(conn, status);
1611                         hci_conn_drop(conn);
1612                 }
1613         }
1614
1615         hci_dev_unlock(hdev);
1616 }
1617
1618 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
1619 {
1620         struct hci_cp_set_conn_encrypt *cp;
1621         struct hci_conn *conn;
1622
1623         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1624
1625         if (!status)
1626                 return;
1627
1628         cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
1629         if (!cp)
1630                 return;
1631
1632         hci_dev_lock(hdev);
1633
1634         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1635         if (conn) {
1636                 if (conn->state == BT_CONFIG) {
1637                         hci_connect_cfm(conn, status);
1638                         hci_conn_drop(conn);
1639                 }
1640         }
1641
1642         hci_dev_unlock(hdev);
1643 }
1644
1645 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
1646                                     struct hci_conn *conn)
1647 {
1648         if (conn->state != BT_CONFIG || !conn->out)
1649                 return 0;
1650
1651         if (conn->pending_sec_level == BT_SECURITY_SDP)
1652                 return 0;
1653
1654         /* Only request authentication for SSP connections or non-SSP
1655          * devices with sec_level MEDIUM or HIGH or if MITM protection
1656          * is requested.
1657          */
1658         if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
1659             conn->pending_sec_level != BT_SECURITY_FIPS &&
1660             conn->pending_sec_level != BT_SECURITY_HIGH &&
1661             conn->pending_sec_level != BT_SECURITY_MEDIUM)
1662                 return 0;
1663
1664         return 1;
1665 }
1666
1667 static int hci_resolve_name(struct hci_dev *hdev,
1668                                    struct inquiry_entry *e)
1669 {
1670         struct hci_cp_remote_name_req cp;
1671
1672         memset(&cp, 0, sizeof(cp));
1673
1674         bacpy(&cp.bdaddr, &e->data.bdaddr);
1675         cp.pscan_rep_mode = e->data.pscan_rep_mode;
1676         cp.pscan_mode = e->data.pscan_mode;
1677         cp.clock_offset = e->data.clock_offset;
1678
1679         return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1680 }
1681
1682 static bool hci_resolve_next_name(struct hci_dev *hdev)
1683 {
1684         struct discovery_state *discov = &hdev->discovery;
1685         struct inquiry_entry *e;
1686
1687         if (list_empty(&discov->resolve))
1688                 return false;
1689
1690         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
1691         if (!e)
1692                 return false;
1693
1694         if (hci_resolve_name(hdev, e) == 0) {
1695                 e->name_state = NAME_PENDING;
1696                 return true;
1697         }
1698
1699         return false;
1700 }
1701
1702 static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
1703                                    bdaddr_t *bdaddr, u8 *name, u8 name_len)
1704 {
1705         struct discovery_state *discov = &hdev->discovery;
1706         struct inquiry_entry *e;
1707
1708         /* Update the mgmt connected state if necessary. Be careful with
1709          * conn objects that exist but are not (yet) connected however.
1710          * Only those in BT_CONFIG or BT_CONNECTED states can be
1711          * considered connected.
1712          */
1713         if (conn &&
1714             (conn->state == BT_CONFIG || conn->state == BT_CONNECTED) &&
1715             !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
1716                 mgmt_device_connected(hdev, conn, 0, name, name_len);
1717
1718         if (discov->state == DISCOVERY_STOPPED)
1719                 return;
1720
1721         if (discov->state == DISCOVERY_STOPPING)
1722                 goto discov_complete;
1723
1724         if (discov->state != DISCOVERY_RESOLVING)
1725                 return;
1726
1727         e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
1728         /* If the device was not found in a list of found devices names of which
1729          * are pending. there is no need to continue resolving a next name as it
1730          * will be done upon receiving another Remote Name Request Complete
1731          * Event */
1732         if (!e)
1733                 return;
1734
1735         list_del(&e->list);
1736         if (name) {
1737                 e->name_state = NAME_KNOWN;
1738                 mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
1739                                  e->data.rssi, name, name_len);
1740         } else {
1741                 e->name_state = NAME_NOT_KNOWN;
1742         }
1743
1744         if (hci_resolve_next_name(hdev))
1745                 return;
1746
1747 discov_complete:
1748         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1749 }
1750
1751 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
1752 {
1753         struct hci_cp_remote_name_req *cp;
1754         struct hci_conn *conn;
1755
1756         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1757
1758         /* If successful wait for the name req complete event before
1759          * checking for the need to do authentication */
1760         if (!status)
1761                 return;
1762
1763         cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
1764         if (!cp)
1765                 return;
1766
1767         hci_dev_lock(hdev);
1768
1769         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1770
1771         if (hci_dev_test_flag(hdev, HCI_MGMT))
1772                 hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
1773
1774         if (!conn)
1775                 goto unlock;
1776
1777         if (!hci_outgoing_auth_needed(hdev, conn))
1778                 goto unlock;
1779
1780         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
1781                 struct hci_cp_auth_requested auth_cp;
1782
1783                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
1784
1785                 auth_cp.handle = __cpu_to_le16(conn->handle);
1786                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
1787                              sizeof(auth_cp), &auth_cp);
1788         }
1789
1790 unlock:
1791         hci_dev_unlock(hdev);
1792 }
1793
1794 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
1795 {
1796         struct hci_cp_read_remote_features *cp;
1797         struct hci_conn *conn;
1798
1799         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1800
1801         if (!status)
1802                 return;
1803
1804         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
1805         if (!cp)
1806                 return;
1807
1808         hci_dev_lock(hdev);
1809
1810         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1811         if (conn) {
1812                 if (conn->state == BT_CONFIG) {
1813                         hci_connect_cfm(conn, status);
1814                         hci_conn_drop(conn);
1815                 }
1816         }
1817
1818         hci_dev_unlock(hdev);
1819 }
1820
1821 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
1822 {
1823         struct hci_cp_read_remote_ext_features *cp;
1824         struct hci_conn *conn;
1825
1826         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1827
1828         if (!status)
1829                 return;
1830
1831         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
1832         if (!cp)
1833                 return;
1834
1835         hci_dev_lock(hdev);
1836
1837         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1838         if (conn) {
1839                 if (conn->state == BT_CONFIG) {
1840                         hci_connect_cfm(conn, status);
1841                         hci_conn_drop(conn);
1842                 }
1843         }
1844
1845         hci_dev_unlock(hdev);
1846 }
1847
1848 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
1849 {
1850         struct hci_cp_setup_sync_conn *cp;
1851         struct hci_conn *acl, *sco;
1852         __u16 handle;
1853
1854         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1855
1856         if (!status)
1857                 return;
1858
1859         cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
1860         if (!cp)
1861                 return;
1862
1863         handle = __le16_to_cpu(cp->handle);
1864
1865         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1866
1867         hci_dev_lock(hdev);
1868
1869         acl = hci_conn_hash_lookup_handle(hdev, handle);
1870         if (acl) {
1871                 sco = acl->link;
1872                 if (sco) {
1873                         sco->state = BT_CLOSED;
1874
1875                         hci_connect_cfm(sco, status);
1876                         hci_conn_del(sco);
1877                 }
1878         }
1879
1880         hci_dev_unlock(hdev);
1881 }
1882
1883 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
1884 {
1885         struct hci_cp_sniff_mode *cp;
1886         struct hci_conn *conn;
1887
1888         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1889
1890         if (!status)
1891                 return;
1892
1893         cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
1894         if (!cp)
1895                 return;
1896
1897         hci_dev_lock(hdev);
1898
1899         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1900         if (conn) {
1901                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1902
1903                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
1904                         hci_sco_setup(conn, status);
1905         }
1906
1907         hci_dev_unlock(hdev);
1908 }
1909
1910 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
1911 {
1912         struct hci_cp_exit_sniff_mode *cp;
1913         struct hci_conn *conn;
1914
1915         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1916
1917         if (!status)
1918                 return;
1919
1920         cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
1921         if (!cp)
1922                 return;
1923
1924         hci_dev_lock(hdev);
1925
1926         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1927         if (conn) {
1928                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1929
1930                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
1931                         hci_sco_setup(conn, status);
1932         }
1933
1934         hci_dev_unlock(hdev);
1935 }
1936
1937 static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
1938 {
1939         struct hci_cp_disconnect *cp;
1940         struct hci_conn *conn;
1941
1942         if (!status)
1943                 return;
1944
1945         cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
1946         if (!cp)
1947                 return;
1948
1949         hci_dev_lock(hdev);
1950
1951         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1952         if (conn)
1953                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
1954                                        conn->dst_type, status);
1955
1956         hci_dev_unlock(hdev);
1957 }
1958
1959 static void hci_cs_create_phylink(struct hci_dev *hdev, u8 status)
1960 {
1961         struct hci_cp_create_phy_link *cp;
1962
1963         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1964
1965         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_PHY_LINK);
1966         if (!cp)
1967                 return;
1968
1969         hci_dev_lock(hdev);
1970
1971         if (status) {
1972                 struct hci_conn *hcon;
1973
1974                 hcon = hci_conn_hash_lookup_handle(hdev, cp->phy_handle);
1975                 if (hcon)
1976                         hci_conn_del(hcon);
1977         } else {
1978                 amp_write_remote_assoc(hdev, cp->phy_handle);
1979         }
1980
1981         hci_dev_unlock(hdev);
1982 }
1983
1984 static void hci_cs_accept_phylink(struct hci_dev *hdev, u8 status)
1985 {
1986         struct hci_cp_accept_phy_link *cp;
1987
1988         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1989
1990         if (status)
1991                 return;
1992
1993         cp = hci_sent_cmd_data(hdev, HCI_OP_ACCEPT_PHY_LINK);
1994         if (!cp)
1995                 return;
1996
1997         amp_write_remote_assoc(hdev, cp->phy_handle);
1998 }
1999
2000 static void hci_cs_le_create_conn(struct hci_dev *hdev, u8 status)
2001 {
2002         struct hci_cp_le_create_conn *cp;
2003         struct hci_conn *conn;
2004
2005         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2006
2007         /* All connection failure handling is taken care of by the
2008          * hci_le_conn_failed function which is triggered by the HCI
2009          * request completion callbacks used for connecting.
2010          */
2011         if (status)
2012                 return;
2013
2014         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
2015         if (!cp)
2016                 return;
2017
2018         hci_dev_lock(hdev);
2019
2020         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->peer_addr);
2021         if (!conn)
2022                 goto unlock;
2023
2024         /* Store the initiator and responder address information which
2025          * is needed for SMP. These values will not change during the
2026          * lifetime of the connection.
2027          */
2028         conn->init_addr_type = cp->own_address_type;
2029         if (cp->own_address_type == ADDR_LE_DEV_RANDOM)
2030                 bacpy(&conn->init_addr, &hdev->random_addr);
2031         else
2032                 bacpy(&conn->init_addr, &hdev->bdaddr);
2033
2034         conn->resp_addr_type = cp->peer_addr_type;
2035         bacpy(&conn->resp_addr, &cp->peer_addr);
2036
2037         /* We don't want the connection attempt to stick around
2038          * indefinitely since LE doesn't have a page timeout concept
2039          * like BR/EDR. Set a timer for any connection that doesn't use
2040          * the white list for connecting.
2041          */
2042         if (cp->filter_policy == HCI_LE_USE_PEER_ADDR)
2043                 queue_delayed_work(conn->hdev->workqueue,
2044                                    &conn->le_conn_timeout,
2045                                    conn->conn_timeout);
2046
2047 unlock:
2048         hci_dev_unlock(hdev);
2049 }
2050
2051 static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
2052 {
2053         struct hci_cp_le_start_enc *cp;
2054         struct hci_conn *conn;
2055
2056         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2057
2058         if (!status)
2059                 return;
2060
2061         hci_dev_lock(hdev);
2062
2063         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_START_ENC);
2064         if (!cp)
2065                 goto unlock;
2066
2067         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2068         if (!conn)
2069                 goto unlock;
2070
2071         if (conn->state != BT_CONNECTED)
2072                 goto unlock;
2073
2074         hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2075         hci_conn_drop(conn);
2076
2077 unlock:
2078         hci_dev_unlock(hdev);
2079 }
2080
2081 static void hci_cs_switch_role(struct hci_dev *hdev, u8 status)
2082 {
2083         struct hci_cp_switch_role *cp;
2084         struct hci_conn *conn;
2085
2086         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2087
2088         if (!status)
2089                 return;
2090
2091         cp = hci_sent_cmd_data(hdev, HCI_OP_SWITCH_ROLE);
2092         if (!cp)
2093                 return;
2094
2095         hci_dev_lock(hdev);
2096
2097         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2098         if (conn)
2099                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
2100
2101         hci_dev_unlock(hdev);
2102 }
2103
2104 static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2105 {
2106         __u8 status = *((__u8 *) skb->data);
2107         struct discovery_state *discov = &hdev->discovery;
2108         struct inquiry_entry *e;
2109
2110         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2111
2112         hci_conn_check_pending(hdev);
2113
2114         if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
2115                 return;
2116
2117         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
2118         wake_up_bit(&hdev->flags, HCI_INQUIRY);
2119
2120         if (!hci_dev_test_flag(hdev, HCI_MGMT))
2121                 return;
2122
2123         hci_dev_lock(hdev);
2124
2125         if (discov->state != DISCOVERY_FINDING)
2126                 goto unlock;
2127
2128         if (list_empty(&discov->resolve)) {
2129                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2130                 goto unlock;
2131         }
2132
2133         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
2134         if (e && hci_resolve_name(hdev, e) == 0) {
2135                 e->name_state = NAME_PENDING;
2136                 hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
2137         } else {
2138                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2139         }
2140
2141 unlock:
2142         hci_dev_unlock(hdev);
2143 }
2144
2145 static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
2146 {
2147         struct inquiry_data data;
2148         struct inquiry_info *info = (void *) (skb->data + 1);
2149         int num_rsp = *((__u8 *) skb->data);
2150
2151         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2152
2153         if (!num_rsp)
2154                 return;
2155
2156         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
2157                 return;
2158
2159         hci_dev_lock(hdev);
2160
2161         for (; num_rsp; num_rsp--, info++) {
2162                 u32 flags;
2163
2164                 bacpy(&data.bdaddr, &info->bdaddr);
2165                 data.pscan_rep_mode     = info->pscan_rep_mode;
2166                 data.pscan_period_mode  = info->pscan_period_mode;
2167                 data.pscan_mode         = info->pscan_mode;
2168                 memcpy(data.dev_class, info->dev_class, 3);
2169                 data.clock_offset       = info->clock_offset;
2170                 data.rssi               = HCI_RSSI_INVALID;
2171                 data.ssp_mode           = 0x00;
2172
2173                 flags = hci_inquiry_cache_update(hdev, &data, false);
2174
2175                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2176                                   info->dev_class, HCI_RSSI_INVALID,
2177                                   flags, NULL, 0, NULL, 0);
2178         }
2179
2180         hci_dev_unlock(hdev);
2181 }
2182
2183 static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2184 {
2185         struct hci_ev_conn_complete *ev = (void *) skb->data;
2186         struct hci_conn *conn;
2187
2188         BT_DBG("%s", hdev->name);
2189
2190         hci_dev_lock(hdev);
2191
2192         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
2193         if (!conn) {
2194                 if (ev->link_type != SCO_LINK)
2195                         goto unlock;
2196
2197                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
2198                 if (!conn)
2199                         goto unlock;
2200
2201                 conn->type = SCO_LINK;
2202         }
2203
2204         if (!ev->status) {
2205                 conn->handle = __le16_to_cpu(ev->handle);
2206
2207                 if (conn->type == ACL_LINK) {
2208                         conn->state = BT_CONFIG;
2209                         hci_conn_hold(conn);
2210
2211                         if (!conn->out && !hci_conn_ssp_enabled(conn) &&
2212                             !hci_find_link_key(hdev, &ev->bdaddr))
2213                                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2214                         else
2215                                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2216                 } else
2217                         conn->state = BT_CONNECTED;
2218
2219                 hci_debugfs_create_conn(conn);
2220                 hci_conn_add_sysfs(conn);
2221
2222                 if (test_bit(HCI_AUTH, &hdev->flags))
2223                         set_bit(HCI_CONN_AUTH, &conn->flags);
2224
2225                 if (test_bit(HCI_ENCRYPT, &hdev->flags))
2226                         set_bit(HCI_CONN_ENCRYPT, &conn->flags);
2227
2228                 /* Get remote features */
2229                 if (conn->type == ACL_LINK) {
2230                         struct hci_cp_read_remote_features cp;
2231                         cp.handle = ev->handle;
2232                         hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
2233                                      sizeof(cp), &cp);
2234
2235                         hci_update_page_scan(hdev);
2236                 }
2237
2238                 /* Set packet type for incoming connection */
2239                 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
2240                         struct hci_cp_change_conn_ptype cp;
2241                         cp.handle = ev->handle;
2242                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
2243                         hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
2244                                      &cp);
2245                 }
2246         } else {
2247                 conn->state = BT_CLOSED;
2248                 if (conn->type == ACL_LINK)
2249                         mgmt_connect_failed(hdev, &conn->dst, conn->type,
2250                                             conn->dst_type, ev->status);
2251         }
2252
2253         if (conn->type == ACL_LINK)
2254                 hci_sco_setup(conn, ev->status);
2255
2256         if (ev->status) {
2257                 hci_connect_cfm(conn, ev->status);
2258                 hci_conn_del(conn);
2259         } else if (ev->link_type != ACL_LINK)
2260                 hci_connect_cfm(conn, ev->status);
2261
2262 unlock:
2263         hci_dev_unlock(hdev);
2264
2265         hci_conn_check_pending(hdev);
2266 }
2267
2268 static void hci_reject_conn(struct hci_dev *hdev, bdaddr_t *bdaddr)
2269 {
2270         struct hci_cp_reject_conn_req cp;
2271
2272         bacpy(&cp.bdaddr, bdaddr);
2273         cp.reason = HCI_ERROR_REJ_BAD_ADDR;
2274         hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
2275 }
2276
2277 static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2278 {
2279         struct hci_ev_conn_request *ev = (void *) skb->data;
2280         int mask = hdev->link_mode;
2281         struct inquiry_entry *ie;
2282         struct hci_conn *conn;
2283         __u8 flags = 0;
2284
2285         BT_DBG("%s bdaddr %pMR type 0x%x", hdev->name, &ev->bdaddr,
2286                ev->link_type);
2287
2288         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
2289                                       &flags);
2290
2291         if (!(mask & HCI_LM_ACCEPT)) {
2292                 hci_reject_conn(hdev, &ev->bdaddr);
2293                 return;
2294         }
2295
2296         if (hci_bdaddr_list_lookup(&hdev->blacklist, &ev->bdaddr,
2297                                    BDADDR_BREDR)) {
2298                 hci_reject_conn(hdev, &ev->bdaddr);
2299                 return;
2300         }
2301
2302         /* Require HCI_CONNECTABLE or a whitelist entry to accept the
2303          * connection. These features are only touched through mgmt so
2304          * only do the checks if HCI_MGMT is set.
2305          */
2306         if (hci_dev_test_flag(hdev, HCI_MGMT) &&
2307             !hci_dev_test_flag(hdev, HCI_CONNECTABLE) &&
2308             !hci_bdaddr_list_lookup(&hdev->whitelist, &ev->bdaddr,
2309                                     BDADDR_BREDR)) {
2310                     hci_reject_conn(hdev, &ev->bdaddr);
2311                     return;
2312         }
2313
2314         /* Connection accepted */
2315
2316         hci_dev_lock(hdev);
2317
2318         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2319         if (ie)
2320                 memcpy(ie->data.dev_class, ev->dev_class, 3);
2321
2322         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
2323                         &ev->bdaddr);
2324         if (!conn) {
2325                 conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr,
2326                                     HCI_ROLE_SLAVE);
2327                 if (!conn) {
2328                         BT_ERR("No memory for new connection");
2329                         hci_dev_unlock(hdev);
2330                         return;
2331                 }
2332         }
2333
2334         memcpy(conn->dev_class, ev->dev_class, 3);
2335
2336         hci_dev_unlock(hdev);
2337
2338         if (ev->link_type == ACL_LINK ||
2339             (!(flags & HCI_PROTO_DEFER) && !lmp_esco_capable(hdev))) {
2340                 struct hci_cp_accept_conn_req cp;
2341                 conn->state = BT_CONNECT;
2342
2343                 bacpy(&cp.bdaddr, &ev->bdaddr);
2344
2345                 if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
2346                         cp.role = 0x00; /* Become master */
2347                 else
2348                         cp.role = 0x01; /* Remain slave */
2349
2350                 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
2351         } else if (!(flags & HCI_PROTO_DEFER)) {
2352                 struct hci_cp_accept_sync_conn_req cp;
2353                 conn->state = BT_CONNECT;
2354
2355                 bacpy(&cp.bdaddr, &ev->bdaddr);
2356                 cp.pkt_type = cpu_to_le16(conn->pkt_type);
2357
2358                 cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
2359                 cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
2360                 cp.max_latency    = cpu_to_le16(0xffff);
2361                 cp.content_format = cpu_to_le16(hdev->voice_setting);
2362                 cp.retrans_effort = 0xff;
2363
2364                 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ, sizeof(cp),
2365                              &cp);
2366         } else {
2367                 conn->state = BT_CONNECT2;
2368                 hci_connect_cfm(conn, 0);
2369         }
2370 }
2371
2372 static u8 hci_to_mgmt_reason(u8 err)
2373 {
2374         switch (err) {
2375         case HCI_ERROR_CONNECTION_TIMEOUT:
2376                 return MGMT_DEV_DISCONN_TIMEOUT;
2377         case HCI_ERROR_REMOTE_USER_TERM:
2378         case HCI_ERROR_REMOTE_LOW_RESOURCES:
2379         case HCI_ERROR_REMOTE_POWER_OFF:
2380                 return MGMT_DEV_DISCONN_REMOTE;
2381         case HCI_ERROR_LOCAL_HOST_TERM:
2382                 return MGMT_DEV_DISCONN_LOCAL_HOST;
2383         default:
2384                 return MGMT_DEV_DISCONN_UNKNOWN;
2385         }
2386 }
2387
2388 static void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2389 {
2390         struct hci_ev_disconn_complete *ev = (void *) skb->data;
2391         u8 reason = hci_to_mgmt_reason(ev->reason);
2392         struct hci_conn_params *params;
2393         struct hci_conn *conn;
2394         bool mgmt_connected;
2395         u8 type;
2396
2397         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2398
2399         hci_dev_lock(hdev);
2400
2401         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2402         if (!conn)
2403                 goto unlock;
2404
2405         if (ev->status) {
2406                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2407                                        conn->dst_type, ev->status);
2408                 goto unlock;
2409         }
2410
2411         conn->state = BT_CLOSED;
2412
2413         mgmt_connected = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags);
2414         mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type,
2415                                 reason, mgmt_connected);
2416
2417         if (conn->type == ACL_LINK) {
2418                 if (test_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
2419                         hci_remove_link_key(hdev, &conn->dst);
2420
2421                 hci_update_page_scan(hdev);
2422         }
2423
2424         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
2425         if (params) {
2426                 switch (params->auto_connect) {
2427                 case HCI_AUTO_CONN_LINK_LOSS:
2428                         if (ev->reason != HCI_ERROR_CONNECTION_TIMEOUT)
2429                                 break;
2430                         /* Fall through */
2431
2432                 case HCI_AUTO_CONN_DIRECT:
2433                 case HCI_AUTO_CONN_ALWAYS:
2434                         list_del_init(&params->action);
2435                         list_add(&params->action, &hdev->pend_le_conns);
2436                         hci_update_background_scan(hdev);
2437                         break;
2438
2439                 default:
2440                         break;
2441                 }
2442         }
2443
2444         type = conn->type;
2445
2446         hci_disconn_cfm(conn, ev->reason);
2447         hci_conn_del(conn);
2448
2449         /* Re-enable advertising if necessary, since it might
2450          * have been disabled by the connection. From the
2451          * HCI_LE_Set_Advertise_Enable command description in
2452          * the core specification (v4.0):
2453          * "The Controller shall continue advertising until the Host
2454          * issues an LE_Set_Advertise_Enable command with
2455          * Advertising_Enable set to 0x00 (Advertising is disabled)
2456          * or until a connection is created or until the Advertising
2457          * is timed out due to Directed Advertising."
2458          */
2459         if (type == LE_LINK)
2460                 mgmt_reenable_advertising(hdev);
2461
2462 unlock:
2463         hci_dev_unlock(hdev);
2464 }
2465
2466 static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2467 {
2468         struct hci_ev_auth_complete *ev = (void *) skb->data;
2469         struct hci_conn *conn;
2470
2471         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2472
2473         hci_dev_lock(hdev);
2474
2475         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2476         if (!conn)
2477                 goto unlock;
2478
2479         if (!ev->status) {
2480                 if (!hci_conn_ssp_enabled(conn) &&
2481                     test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
2482                         BT_INFO("re-auth of legacy device is not possible.");
2483                 } else {
2484                         set_bit(HCI_CONN_AUTH, &conn->flags);
2485                         conn->sec_level = conn->pending_sec_level;
2486                 }
2487         } else {
2488                 mgmt_auth_failed(conn, ev->status);
2489         }
2490
2491         clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
2492         clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
2493
2494         if (conn->state == BT_CONFIG) {
2495                 if (!ev->status && hci_conn_ssp_enabled(conn)) {
2496                         struct hci_cp_set_conn_encrypt cp;
2497                         cp.handle  = ev->handle;
2498                         cp.encrypt = 0x01;
2499                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2500                                      &cp);
2501                 } else {
2502                         conn->state = BT_CONNECTED;
2503                         hci_connect_cfm(conn, ev->status);
2504                         hci_conn_drop(conn);
2505                 }
2506         } else {
2507                 hci_auth_cfm(conn, ev->status);
2508
2509                 hci_conn_hold(conn);
2510                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2511                 hci_conn_drop(conn);
2512         }
2513
2514         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
2515                 if (!ev->status) {
2516                         struct hci_cp_set_conn_encrypt cp;
2517                         cp.handle  = ev->handle;
2518                         cp.encrypt = 0x01;
2519                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2520                                      &cp);
2521                 } else {
2522                         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2523                         hci_encrypt_cfm(conn, ev->status, 0x00);
2524                 }
2525         }
2526
2527 unlock:
2528         hci_dev_unlock(hdev);
2529 }
2530
2531 static void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
2532 {
2533         struct hci_ev_remote_name *ev = (void *) skb->data;
2534         struct hci_conn *conn;
2535
2536         BT_DBG("%s", hdev->name);
2537
2538         hci_conn_check_pending(hdev);
2539
2540         hci_dev_lock(hdev);
2541
2542         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2543
2544         if (!hci_dev_test_flag(hdev, HCI_MGMT))
2545                 goto check_auth;
2546
2547         if (ev->status == 0)
2548                 hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
2549                                        strnlen(ev->name, HCI_MAX_NAME_LENGTH));
2550         else
2551                 hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
2552
2553 check_auth:
2554         if (!conn)
2555                 goto unlock;
2556
2557         if (!hci_outgoing_auth_needed(hdev, conn))
2558                 goto unlock;
2559
2560         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
2561                 struct hci_cp_auth_requested cp;
2562
2563                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
2564
2565                 cp.handle = __cpu_to_le16(conn->handle);
2566                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
2567         }
2568
2569 unlock:
2570         hci_dev_unlock(hdev);
2571 }
2572
2573 static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2574 {
2575         struct hci_ev_encrypt_change *ev = (void *) skb->data;
2576         struct hci_conn *conn;
2577
2578         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2579
2580         hci_dev_lock(hdev);
2581
2582         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2583         if (!conn)
2584                 goto unlock;
2585
2586         if (!ev->status) {
2587                 if (ev->encrypt) {
2588                         /* Encryption implies authentication */
2589                         set_bit(HCI_CONN_AUTH, &conn->flags);
2590                         set_bit(HCI_CONN_ENCRYPT, &conn->flags);
2591                         conn->sec_level = conn->pending_sec_level;
2592
2593                         /* P-256 authentication key implies FIPS */
2594                         if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256)
2595                                 set_bit(HCI_CONN_FIPS, &conn->flags);
2596
2597                         if ((conn->type == ACL_LINK && ev->encrypt == 0x02) ||
2598                             conn->type == LE_LINK)
2599                                 set_bit(HCI_CONN_AES_CCM, &conn->flags);
2600                 } else {
2601                         clear_bit(HCI_CONN_ENCRYPT, &conn->flags);
2602                         clear_bit(HCI_CONN_AES_CCM, &conn->flags);
2603                 }
2604         }
2605
2606         /* We should disregard the current RPA and generate a new one
2607          * whenever the encryption procedure fails.
2608          */
2609         if (ev->status && conn->type == LE_LINK)
2610                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
2611
2612         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2613
2614         if (ev->status && conn->state == BT_CONNECTED) {
2615                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2616                 hci_conn_drop(conn);
2617                 goto unlock;
2618         }
2619
2620         if (conn->state == BT_CONFIG) {
2621                 if (!ev->status)
2622                         conn->state = BT_CONNECTED;
2623
2624                 /* In Secure Connections Only mode, do not allow any
2625                  * connections that are not encrypted with AES-CCM
2626                  * using a P-256 authenticated combination key.
2627                  */
2628                 if (hci_dev_test_flag(hdev, HCI_SC_ONLY) &&
2629                     (!test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
2630                      conn->key_type != HCI_LK_AUTH_COMBINATION_P256)) {
2631                         hci_connect_cfm(conn, HCI_ERROR_AUTH_FAILURE);
2632                         hci_conn_drop(conn);
2633                         goto unlock;
2634                 }
2635
2636                 hci_connect_cfm(conn, ev->status);
2637                 hci_conn_drop(conn);
2638         } else
2639                 hci_encrypt_cfm(conn, ev->status, ev->encrypt);
2640
2641 unlock:
2642         hci_dev_unlock(hdev);
2643 }
2644
2645 static void hci_change_link_key_complete_evt(struct hci_dev *hdev,
2646                                              struct sk_buff *skb)
2647 {
2648         struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
2649         struct hci_conn *conn;
2650
2651         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2652
2653         hci_dev_lock(hdev);
2654
2655         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2656         if (conn) {
2657                 if (!ev->status)
2658                         set_bit(HCI_CONN_SECURE, &conn->flags);
2659
2660                 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
2661
2662                 hci_key_change_cfm(conn, ev->status);
2663         }
2664
2665         hci_dev_unlock(hdev);
2666 }
2667
2668 static void hci_remote_features_evt(struct hci_dev *hdev,
2669                                     struct sk_buff *skb)
2670 {
2671         struct hci_ev_remote_features *ev = (void *) skb->data;
2672         struct hci_conn *conn;
2673
2674         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2675
2676         hci_dev_lock(hdev);
2677
2678         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2679         if (!conn)
2680                 goto unlock;
2681
2682         if (!ev->status)
2683                 memcpy(conn->features[0], ev->features, 8);
2684
2685         if (conn->state != BT_CONFIG)
2686                 goto unlock;
2687
2688         if (!ev->status && lmp_ext_feat_capable(hdev) &&
2689             lmp_ext_feat_capable(conn)) {
2690                 struct hci_cp_read_remote_ext_features cp;
2691                 cp.handle = ev->handle;
2692                 cp.page = 0x01;
2693                 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
2694                              sizeof(cp), &cp);
2695                 goto unlock;
2696         }
2697
2698         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
2699                 struct hci_cp_remote_name_req cp;
2700                 memset(&cp, 0, sizeof(cp));
2701                 bacpy(&cp.bdaddr, &conn->dst);
2702                 cp.pscan_rep_mode = 0x02;
2703                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2704         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2705                 mgmt_device_connected(hdev, conn, 0, NULL, 0);
2706
2707         if (!hci_outgoing_auth_needed(hdev, conn)) {
2708                 conn->state = BT_CONNECTED;
2709                 hci_connect_cfm(conn, ev->status);
2710                 hci_conn_drop(conn);
2711         }
2712
2713 unlock:
2714         hci_dev_unlock(hdev);
2715 }
2716
2717 static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2718 {
2719         struct hci_ev_cmd_complete *ev = (void *) skb->data;
2720         u8 status = skb->data[sizeof(*ev)];
2721         __u16 opcode;
2722
2723         skb_pull(skb, sizeof(*ev));
2724
2725         opcode = __le16_to_cpu(ev->opcode);
2726
2727         switch (opcode) {
2728         case HCI_OP_INQUIRY_CANCEL:
2729                 hci_cc_inquiry_cancel(hdev, skb);
2730                 break;
2731
2732         case HCI_OP_PERIODIC_INQ:
2733                 hci_cc_periodic_inq(hdev, skb);
2734                 break;
2735
2736         case HCI_OP_EXIT_PERIODIC_INQ:
2737                 hci_cc_exit_periodic_inq(hdev, skb);
2738                 break;
2739
2740         case HCI_OP_REMOTE_NAME_REQ_CANCEL:
2741                 hci_cc_remote_name_req_cancel(hdev, skb);
2742                 break;
2743
2744         case HCI_OP_ROLE_DISCOVERY:
2745                 hci_cc_role_discovery(hdev, skb);
2746                 break;
2747
2748         case HCI_OP_READ_LINK_POLICY:
2749                 hci_cc_read_link_policy(hdev, skb);
2750                 break;
2751
2752         case HCI_OP_WRITE_LINK_POLICY:
2753                 hci_cc_write_link_policy(hdev, skb);
2754                 break;
2755
2756         case HCI_OP_READ_DEF_LINK_POLICY:
2757                 hci_cc_read_def_link_policy(hdev, skb);
2758                 break;
2759
2760         case HCI_OP_WRITE_DEF_LINK_POLICY:
2761                 hci_cc_write_def_link_policy(hdev, skb);
2762                 break;
2763
2764         case HCI_OP_RESET:
2765                 hci_cc_reset(hdev, skb);
2766                 break;
2767
2768         case HCI_OP_READ_STORED_LINK_KEY:
2769                 hci_cc_read_stored_link_key(hdev, skb);
2770                 break;
2771
2772         case HCI_OP_DELETE_STORED_LINK_KEY:
2773                 hci_cc_delete_stored_link_key(hdev, skb);
2774                 break;
2775
2776         case HCI_OP_WRITE_LOCAL_NAME:
2777                 hci_cc_write_local_name(hdev, skb);
2778                 break;
2779
2780         case HCI_OP_READ_LOCAL_NAME:
2781                 hci_cc_read_local_name(hdev, skb);
2782                 break;
2783
2784         case HCI_OP_WRITE_AUTH_ENABLE:
2785                 hci_cc_write_auth_enable(hdev, skb);
2786                 break;
2787
2788         case HCI_OP_WRITE_ENCRYPT_MODE:
2789                 hci_cc_write_encrypt_mode(hdev, skb);
2790                 break;
2791
2792         case HCI_OP_WRITE_SCAN_ENABLE:
2793                 hci_cc_write_scan_enable(hdev, skb);
2794                 break;
2795
2796         case HCI_OP_READ_CLASS_OF_DEV:
2797                 hci_cc_read_class_of_dev(hdev, skb);
2798                 break;
2799
2800         case HCI_OP_WRITE_CLASS_OF_DEV:
2801                 hci_cc_write_class_of_dev(hdev, skb);
2802                 break;
2803
2804         case HCI_OP_READ_VOICE_SETTING:
2805                 hci_cc_read_voice_setting(hdev, skb);
2806                 break;
2807
2808         case HCI_OP_WRITE_VOICE_SETTING:
2809                 hci_cc_write_voice_setting(hdev, skb);
2810                 break;
2811
2812         case HCI_OP_READ_NUM_SUPPORTED_IAC:
2813                 hci_cc_read_num_supported_iac(hdev, skb);
2814                 break;
2815
2816         case HCI_OP_WRITE_SSP_MODE:
2817                 hci_cc_write_ssp_mode(hdev, skb);
2818                 break;
2819
2820         case HCI_OP_WRITE_SC_SUPPORT:
2821                 hci_cc_write_sc_support(hdev, skb);
2822                 break;
2823
2824         case HCI_OP_READ_LOCAL_VERSION:
2825                 hci_cc_read_local_version(hdev, skb);
2826                 break;
2827
2828         case HCI_OP_READ_LOCAL_COMMANDS:
2829                 hci_cc_read_local_commands(hdev, skb);
2830                 break;
2831
2832         case HCI_OP_READ_LOCAL_FEATURES:
2833                 hci_cc_read_local_features(hdev, skb);
2834                 break;
2835
2836         case HCI_OP_READ_LOCAL_EXT_FEATURES:
2837                 hci_cc_read_local_ext_features(hdev, skb);
2838                 break;
2839
2840         case HCI_OP_READ_BUFFER_SIZE:
2841                 hci_cc_read_buffer_size(hdev, skb);
2842                 break;
2843
2844         case HCI_OP_READ_BD_ADDR:
2845                 hci_cc_read_bd_addr(hdev, skb);
2846                 break;
2847
2848         case HCI_OP_READ_PAGE_SCAN_ACTIVITY:
2849                 hci_cc_read_page_scan_activity(hdev, skb);
2850                 break;
2851
2852         case HCI_OP_WRITE_PAGE_SCAN_ACTIVITY:
2853                 hci_cc_write_page_scan_activity(hdev, skb);
2854                 break;
2855
2856         case HCI_OP_READ_PAGE_SCAN_TYPE:
2857                 hci_cc_read_page_scan_type(hdev, skb);
2858                 break;
2859
2860         case HCI_OP_WRITE_PAGE_SCAN_TYPE:
2861                 hci_cc_write_page_scan_type(hdev, skb);
2862                 break;
2863
2864         case HCI_OP_READ_DATA_BLOCK_SIZE:
2865                 hci_cc_read_data_block_size(hdev, skb);
2866                 break;
2867
2868         case HCI_OP_READ_FLOW_CONTROL_MODE:
2869                 hci_cc_read_flow_control_mode(hdev, skb);
2870                 break;
2871
2872         case HCI_OP_READ_LOCAL_AMP_INFO:
2873                 hci_cc_read_local_amp_info(hdev, skb);
2874                 break;
2875
2876         case HCI_OP_READ_CLOCK:
2877                 hci_cc_read_clock(hdev, skb);
2878                 break;
2879
2880         case HCI_OP_READ_LOCAL_AMP_ASSOC:
2881                 hci_cc_read_local_amp_assoc(hdev, skb);
2882                 break;
2883
2884         case HCI_OP_READ_INQ_RSP_TX_POWER:
2885                 hci_cc_read_inq_rsp_tx_power(hdev, skb);
2886                 break;
2887
2888         case HCI_OP_PIN_CODE_REPLY:
2889                 hci_cc_pin_code_reply(hdev, skb);
2890                 break;
2891
2892         case HCI_OP_PIN_CODE_NEG_REPLY:
2893                 hci_cc_pin_code_neg_reply(hdev, skb);
2894                 break;
2895
2896         case HCI_OP_READ_LOCAL_OOB_DATA:
2897                 hci_cc_read_local_oob_data(hdev, skb);
2898                 break;
2899
2900         case HCI_OP_READ_LOCAL_OOB_EXT_DATA:
2901                 hci_cc_read_local_oob_ext_data(hdev, skb);
2902                 break;
2903
2904         case HCI_OP_LE_READ_BUFFER_SIZE:
2905                 hci_cc_le_read_buffer_size(hdev, skb);
2906                 break;
2907
2908         case HCI_OP_LE_READ_LOCAL_FEATURES:
2909                 hci_cc_le_read_local_features(hdev, skb);
2910                 break;
2911
2912         case HCI_OP_LE_READ_ADV_TX_POWER:
2913                 hci_cc_le_read_adv_tx_power(hdev, skb);
2914                 break;
2915
2916         case HCI_OP_USER_CONFIRM_REPLY:
2917                 hci_cc_user_confirm_reply(hdev, skb);
2918                 break;
2919
2920         case HCI_OP_USER_CONFIRM_NEG_REPLY:
2921                 hci_cc_user_confirm_neg_reply(hdev, skb);
2922                 break;
2923
2924         case HCI_OP_USER_PASSKEY_REPLY:
2925                 hci_cc_user_passkey_reply(hdev, skb);
2926                 break;
2927
2928         case HCI_OP_USER_PASSKEY_NEG_REPLY:
2929                 hci_cc_user_passkey_neg_reply(hdev, skb);
2930                 break;
2931
2932         case HCI_OP_LE_SET_RANDOM_ADDR:
2933                 hci_cc_le_set_random_addr(hdev, skb);
2934                 break;
2935
2936         case HCI_OP_LE_SET_ADV_ENABLE:
2937                 hci_cc_le_set_adv_enable(hdev, skb);
2938                 break;
2939
2940         case HCI_OP_LE_SET_SCAN_PARAM:
2941                 hci_cc_le_set_scan_param(hdev, skb);
2942                 break;
2943
2944         case HCI_OP_LE_SET_SCAN_ENABLE:
2945                 hci_cc_le_set_scan_enable(hdev, skb);
2946                 break;
2947
2948         case HCI_OP_LE_READ_WHITE_LIST_SIZE:
2949                 hci_cc_le_read_white_list_size(hdev, skb);
2950                 break;
2951
2952         case HCI_OP_LE_CLEAR_WHITE_LIST:
2953                 hci_cc_le_clear_white_list(hdev, skb);
2954                 break;
2955
2956         case HCI_OP_LE_ADD_TO_WHITE_LIST:
2957                 hci_cc_le_add_to_white_list(hdev, skb);
2958                 break;
2959
2960         case HCI_OP_LE_DEL_FROM_WHITE_LIST:
2961                 hci_cc_le_del_from_white_list(hdev, skb);
2962                 break;
2963
2964         case HCI_OP_LE_READ_SUPPORTED_STATES:
2965                 hci_cc_le_read_supported_states(hdev, skb);
2966                 break;
2967
2968         case HCI_OP_LE_READ_DEF_DATA_LEN:
2969                 hci_cc_le_read_def_data_len(hdev, skb);
2970                 break;
2971
2972         case HCI_OP_LE_WRITE_DEF_DATA_LEN:
2973                 hci_cc_le_write_def_data_len(hdev, skb);
2974                 break;
2975
2976         case HCI_OP_LE_READ_MAX_DATA_LEN:
2977                 hci_cc_le_read_max_data_len(hdev, skb);
2978                 break;
2979
2980         case HCI_OP_WRITE_LE_HOST_SUPPORTED:
2981                 hci_cc_write_le_host_supported(hdev, skb);
2982                 break;
2983
2984         case HCI_OP_LE_SET_ADV_PARAM:
2985                 hci_cc_set_adv_param(hdev, skb);
2986                 break;
2987
2988         case HCI_OP_WRITE_REMOTE_AMP_ASSOC:
2989                 hci_cc_write_remote_amp_assoc(hdev, skb);
2990                 break;
2991
2992         case HCI_OP_READ_RSSI:
2993                 hci_cc_read_rssi(hdev, skb);
2994                 break;
2995
2996         case HCI_OP_READ_TX_POWER:
2997                 hci_cc_read_tx_power(hdev, skb);
2998                 break;
2999
3000         case HCI_OP_WRITE_SSP_DEBUG_MODE:
3001                 hci_cc_write_ssp_debug_mode(hdev, skb);
3002                 break;
3003
3004         default:
3005                 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
3006                 break;
3007         }
3008
3009         if (opcode != HCI_OP_NOP)
3010                 cancel_delayed_work(&hdev->cmd_timer);
3011
3012         hci_req_cmd_complete(hdev, opcode, status);
3013
3014         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
3015                 atomic_set(&hdev->cmd_cnt, 1);
3016                 if (!skb_queue_empty(&hdev->cmd_q))
3017                         queue_work(hdev->workqueue, &hdev->cmd_work);
3018         }
3019 }
3020
3021 static void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb)
3022 {
3023         struct hci_ev_cmd_status *ev = (void *) skb->data;
3024         __u16 opcode;
3025
3026         skb_pull(skb, sizeof(*ev));
3027
3028         opcode = __le16_to_cpu(ev->opcode);
3029
3030         switch (opcode) {
3031         case HCI_OP_INQUIRY:
3032                 hci_cs_inquiry(hdev, ev->status);
3033                 break;
3034
3035         case HCI_OP_CREATE_CONN:
3036                 hci_cs_create_conn(hdev, ev->status);
3037                 break;
3038
3039         case HCI_OP_DISCONNECT:
3040                 hci_cs_disconnect(hdev, ev->status);
3041                 break;
3042
3043         case HCI_OP_ADD_SCO:
3044                 hci_cs_add_sco(hdev, ev->status);
3045                 break;
3046
3047         case HCI_OP_AUTH_REQUESTED:
3048                 hci_cs_auth_requested(hdev, ev->status);
3049                 break;
3050
3051         case HCI_OP_SET_CONN_ENCRYPT:
3052                 hci_cs_set_conn_encrypt(hdev, ev->status);
3053                 break;
3054
3055         case HCI_OP_REMOTE_NAME_REQ:
3056                 hci_cs_remote_name_req(hdev, ev->status);
3057                 break;
3058
3059         case HCI_OP_READ_REMOTE_FEATURES:
3060                 hci_cs_read_remote_features(hdev, ev->status);
3061                 break;
3062
3063         case HCI_OP_READ_REMOTE_EXT_FEATURES:
3064                 hci_cs_read_remote_ext_features(hdev, ev->status);
3065                 break;
3066
3067         case HCI_OP_SETUP_SYNC_CONN:
3068                 hci_cs_setup_sync_conn(hdev, ev->status);
3069                 break;
3070
3071         case HCI_OP_CREATE_PHY_LINK:
3072                 hci_cs_create_phylink(hdev, ev->status);
3073                 break;
3074
3075         case HCI_OP_ACCEPT_PHY_LINK:
3076                 hci_cs_accept_phylink(hdev, ev->status);
3077                 break;
3078
3079         case HCI_OP_SNIFF_MODE:
3080                 hci_cs_sniff_mode(hdev, ev->status);
3081                 break;
3082
3083         case HCI_OP_EXIT_SNIFF_MODE:
3084                 hci_cs_exit_sniff_mode(hdev, ev->status);
3085                 break;
3086
3087         case HCI_OP_SWITCH_ROLE:
3088                 hci_cs_switch_role(hdev, ev->status);
3089                 break;
3090
3091         case HCI_OP_LE_CREATE_CONN:
3092                 hci_cs_le_create_conn(hdev, ev->status);
3093                 break;
3094
3095         case HCI_OP_LE_START_ENC:
3096                 hci_cs_le_start_enc(hdev, ev->status);
3097                 break;
3098
3099         default:
3100                 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
3101                 break;
3102         }
3103
3104         if (opcode != HCI_OP_NOP)
3105                 cancel_delayed_work(&hdev->cmd_timer);
3106
3107         if (ev->status ||
3108             (hdev->sent_cmd && !bt_cb(hdev->sent_cmd)->req_event))
3109                 hci_req_cmd_complete(hdev, opcode, ev->status);
3110
3111         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
3112                 atomic_set(&hdev->cmd_cnt, 1);
3113                 if (!skb_queue_empty(&hdev->cmd_q))
3114                         queue_work(hdev->workqueue, &hdev->cmd_work);
3115         }
3116 }
3117
3118 static void hci_hardware_error_evt(struct hci_dev *hdev, struct sk_buff *skb)
3119 {
3120         struct hci_ev_hardware_error *ev = (void *) skb->data;
3121
3122         hdev->hw_error_code = ev->code;
3123
3124         queue_work(hdev->req_workqueue, &hdev->error_reset);
3125 }
3126
3127 static void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3128 {
3129         struct hci_ev_role_change *ev = (void *) skb->data;
3130         struct hci_conn *conn;
3131
3132         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3133
3134         hci_dev_lock(hdev);
3135
3136         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3137         if (conn) {
3138                 if (!ev->status)
3139                         conn->role = ev->role;
3140
3141                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
3142
3143                 hci_role_switch_cfm(conn, ev->status, ev->role);
3144         }
3145
3146         hci_dev_unlock(hdev);
3147 }
3148
3149 static void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
3150 {
3151         struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
3152         int i;
3153
3154         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
3155                 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
3156                 return;
3157         }
3158
3159         if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
3160             ev->num_hndl * sizeof(struct hci_comp_pkts_info)) {
3161                 BT_DBG("%s bad parameters", hdev->name);
3162                 return;
3163         }
3164
3165         BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
3166
3167         for (i = 0; i < ev->num_hndl; i++) {
3168                 struct hci_comp_pkts_info *info = &ev->handles[i];
3169                 struct hci_conn *conn;
3170                 __u16  handle, count;
3171
3172                 handle = __le16_to_cpu(info->handle);
3173                 count  = __le16_to_cpu(info->count);
3174
3175                 conn = hci_conn_hash_lookup_handle(hdev, handle);
3176                 if (!conn)
3177                         continue;
3178
3179                 conn->sent -= count;
3180
3181                 switch (conn->type) {
3182                 case ACL_LINK:
3183                         hdev->acl_cnt += count;
3184                         if (hdev->acl_cnt > hdev->acl_pkts)
3185                                 hdev->acl_cnt = hdev->acl_pkts;
3186                         break;
3187
3188                 case LE_LINK:
3189                         if (hdev->le_pkts) {
3190                                 hdev->le_cnt += count;
3191                                 if (hdev->le_cnt > hdev->le_pkts)
3192                                         hdev->le_cnt = hdev->le_pkts;
3193                         } else {
3194                                 hdev->acl_cnt += count;
3195                                 if (hdev->acl_cnt > hdev->acl_pkts)
3196                                         hdev->acl_cnt = hdev->acl_pkts;
3197                         }
3198                         break;
3199
3200                 case SCO_LINK:
3201                         hdev->sco_cnt += count;
3202                         if (hdev->sco_cnt > hdev->sco_pkts)
3203                                 hdev->sco_cnt = hdev->sco_pkts;
3204                         break;
3205
3206                 default:
3207                         BT_ERR("Unknown type %d conn %p", conn->type, conn);
3208                         break;
3209                 }
3210         }
3211
3212         queue_work(hdev->workqueue, &hdev->tx_work);
3213 }
3214
3215 static struct hci_conn *__hci_conn_lookup_handle(struct hci_dev *hdev,
3216                                                  __u16 handle)
3217 {
3218         struct hci_chan *chan;
3219
3220         switch (hdev->dev_type) {
3221         case HCI_BREDR:
3222                 return hci_conn_hash_lookup_handle(hdev, handle);
3223         case HCI_AMP:
3224                 chan = hci_chan_lookup_handle(hdev, handle);
3225                 if (chan)
3226                         return chan->conn;
3227                 break;
3228         default:
3229                 BT_ERR("%s unknown dev_type %d", hdev->name, hdev->dev_type);
3230                 break;
3231         }
3232
3233         return NULL;
3234 }
3235
3236 static void hci_num_comp_blocks_evt(struct hci_dev *hdev, struct sk_buff *skb)
3237 {
3238         struct hci_ev_num_comp_blocks *ev = (void *) skb->data;
3239         int i;
3240
3241         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
3242                 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
3243                 return;
3244         }
3245
3246         if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
3247             ev->num_hndl * sizeof(struct hci_comp_blocks_info)) {
3248                 BT_DBG("%s bad parameters", hdev->name);
3249                 return;
3250         }
3251
3252         BT_DBG("%s num_blocks %d num_hndl %d", hdev->name, ev->num_blocks,
3253                ev->num_hndl);
3254
3255         for (i = 0; i < ev->num_hndl; i++) {
3256                 struct hci_comp_blocks_info *info = &ev->handles[i];
3257                 struct hci_conn *conn = NULL;
3258                 __u16  handle, block_count;
3259
3260                 handle = __le16_to_cpu(info->handle);
3261                 block_count = __le16_to_cpu(info->blocks);
3262
3263                 conn = __hci_conn_lookup_handle(hdev, handle);
3264                 if (!conn)
3265                         continue;
3266
3267                 conn->sent -= block_count;
3268
3269                 switch (conn->type) {
3270                 case ACL_LINK:
3271                 case AMP_LINK:
3272                         hdev->block_cnt += block_count;
3273                         if (hdev->block_cnt > hdev->num_blocks)
3274                                 hdev->block_cnt = hdev->num_blocks;
3275                         break;
3276
3277                 default:
3278                         BT_ERR("Unknown type %d conn %p", conn->type, conn);
3279                         break;
3280                 }
3281         }
3282
3283         queue_work(hdev->workqueue, &hdev->tx_work);
3284 }
3285
3286 static void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3287 {
3288         struct hci_ev_mode_change *ev = (void *) skb->data;
3289         struct hci_conn *conn;
3290
3291         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3292
3293         hci_dev_lock(hdev);
3294
3295         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3296         if (conn) {
3297                 conn->mode = ev->mode;
3298
3299                 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND,
3300                                         &conn->flags)) {
3301                         if (conn->mode == HCI_CM_ACTIVE)
3302                                 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
3303                         else
3304                                 clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
3305                 }
3306
3307                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
3308                         hci_sco_setup(conn, ev->status);
3309         }
3310
3311         hci_dev_unlock(hdev);
3312 }
3313
3314 static void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3315 {
3316         struct hci_ev_pin_code_req *ev = (void *) skb->data;
3317         struct hci_conn *conn;
3318
3319         BT_DBG("%s", hdev->name);
3320
3321         hci_dev_lock(hdev);
3322
3323         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3324         if (!conn)
3325                 goto unlock;
3326
3327         if (conn->state == BT_CONNECTED) {
3328                 hci_conn_hold(conn);
3329                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
3330                 hci_conn_drop(conn);
3331         }
3332
3333         if (!hci_dev_test_flag(hdev, HCI_BONDABLE) &&
3334             !test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags)) {
3335                 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
3336                              sizeof(ev->bdaddr), &ev->bdaddr);
3337         } else if (hci_dev_test_flag(hdev, HCI_MGMT)) {
3338                 u8 secure;
3339
3340                 if (conn->pending_sec_level == BT_SECURITY_HIGH)
3341                         secure = 1;
3342                 else
3343                         secure = 0;
3344
3345                 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
3346         }
3347
3348 unlock:
3349         hci_dev_unlock(hdev);
3350 }
3351
3352 static void conn_set_key(struct hci_conn *conn, u8 key_type, u8 pin_len)
3353 {
3354         if (key_type == HCI_LK_CHANGED_COMBINATION)
3355                 return;
3356
3357         conn->pin_length = pin_len;
3358         conn->key_type = key_type;
3359
3360         switch (key_type) {
3361         case HCI_LK_LOCAL_UNIT:
3362         case HCI_LK_REMOTE_UNIT:
3363         case HCI_LK_DEBUG_COMBINATION:
3364                 return;
3365         case HCI_LK_COMBINATION:
3366                 if (pin_len == 16)
3367                         conn->pending_sec_level = BT_SECURITY_HIGH;
3368                 else
3369                         conn->pending_sec_level = BT_SECURITY_MEDIUM;
3370                 break;
3371         case HCI_LK_UNAUTH_COMBINATION_P192:
3372         case HCI_LK_UNAUTH_COMBINATION_P256:
3373                 conn->pending_sec_level = BT_SECURITY_MEDIUM;
3374                 break;
3375         case HCI_LK_AUTH_COMBINATION_P192:
3376                 conn->pending_sec_level = BT_SECURITY_HIGH;
3377                 break;
3378         case HCI_LK_AUTH_COMBINATION_P256:
3379                 conn->pending_sec_level = BT_SECURITY_FIPS;
3380                 break;
3381         }
3382 }
3383
3384 static void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3385 {
3386         struct hci_ev_link_key_req *ev = (void *) skb->data;
3387         struct hci_cp_link_key_reply cp;
3388         struct hci_conn *conn;
3389         struct link_key *key;
3390
3391         BT_DBG("%s", hdev->name);
3392
3393         if (!hci_dev_test_flag(hdev, HCI_MGMT))
3394                 return;
3395
3396         hci_dev_lock(hdev);
3397
3398         key = hci_find_link_key(hdev, &ev->bdaddr);
3399         if (!key) {
3400                 BT_DBG("%s link key not found for %pMR", hdev->name,
3401                        &ev->bdaddr);
3402                 goto not_found;
3403         }
3404
3405         BT_DBG("%s found key type %u for %pMR", hdev->name, key->type,
3406                &ev->bdaddr);
3407
3408         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3409         if (conn) {
3410                 clear_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
3411
3412                 if ((key->type == HCI_LK_UNAUTH_COMBINATION_P192 ||
3413                      key->type == HCI_LK_UNAUTH_COMBINATION_P256) &&
3414                     conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
3415                         BT_DBG("%s ignoring unauthenticated key", hdev->name);
3416                         goto not_found;
3417                 }
3418
3419                 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
3420                     (conn->pending_sec_level == BT_SECURITY_HIGH ||
3421                      conn->pending_sec_level == BT_SECURITY_FIPS)) {
3422                         BT_DBG("%s ignoring key unauthenticated for high security",
3423                                hdev->name);
3424                         goto not_found;
3425                 }
3426
3427                 conn_set_key(conn, key->type, key->pin_len);
3428         }
3429
3430         bacpy(&cp.bdaddr, &ev->bdaddr);
3431         memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);
3432
3433         hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
3434
3435         hci_dev_unlock(hdev);
3436
3437         return;
3438
3439 not_found:
3440         hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
3441         hci_dev_unlock(hdev);
3442 }
3443
3444 static void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
3445 {
3446         struct hci_ev_link_key_notify *ev = (void *) skb->data;
3447         struct hci_conn *conn;
3448         struct link_key *key;
3449         bool persistent;
3450         u8 pin_len = 0;
3451
3452         BT_DBG("%s", hdev->name);
3453
3454         hci_dev_lock(hdev);
3455
3456         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3457         if (!conn)
3458                 goto unlock;
3459
3460         hci_conn_hold(conn);
3461         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3462         hci_conn_drop(conn);
3463
3464         set_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
3465         conn_set_key(conn, ev->key_type, conn->pin_length);
3466
3467         if (!hci_dev_test_flag(hdev, HCI_MGMT))
3468                 goto unlock;
3469
3470         key = hci_add_link_key(hdev, conn, &ev->bdaddr, ev->link_key,
3471                                 ev->key_type, pin_len, &persistent);
3472         if (!key)
3473                 goto unlock;
3474
3475         /* Update connection information since adding the key will have
3476          * fixed up the type in the case of changed combination keys.
3477          */
3478         if (ev->key_type == HCI_LK_CHANGED_COMBINATION)
3479                 conn_set_key(conn, key->type, key->pin_len);
3480
3481         mgmt_new_link_key(hdev, key, persistent);
3482
3483         /* Keep debug keys around only if the HCI_KEEP_DEBUG_KEYS flag
3484          * is set. If it's not set simply remove the key from the kernel
3485          * list (we've still notified user space about it but with
3486          * store_hint being 0).
3487          */
3488         if (key->type == HCI_LK_DEBUG_COMBINATION &&
3489             !hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) {
3490                 list_del_rcu(&key->list);
3491                 kfree_rcu(key, rcu);
3492                 goto unlock;
3493         }
3494
3495         if (persistent)
3496                 clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
3497         else
3498                 set_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
3499
3500 unlock:
3501         hci_dev_unlock(hdev);
3502 }
3503
3504 static void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
3505 {
3506         struct hci_ev_clock_offset *ev = (void *) skb->data;
3507         struct hci_conn *conn;
3508
3509         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3510
3511         hci_dev_lock(hdev);
3512
3513         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3514         if (conn && !ev->status) {
3515                 struct inquiry_entry *ie;
3516
3517                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
3518                 if (ie) {
3519                         ie->data.clock_offset = ev->clock_offset;
3520                         ie->timestamp = jiffies;
3521                 }
3522         }
3523
3524         hci_dev_unlock(hdev);
3525 }
3526
3527 static void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3528 {
3529         struct hci_ev_pkt_type_change *ev = (void *) skb->data;
3530         struct hci_conn *conn;
3531
3532         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3533
3534         hci_dev_lock(hdev);
3535
3536         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3537         if (conn && !ev->status)
3538                 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
3539
3540         hci_dev_unlock(hdev);
3541 }
3542
3543 static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
3544 {
3545         struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
3546         struct inquiry_entry *ie;
3547
3548         BT_DBG("%s", hdev->name);
3549
3550         hci_dev_lock(hdev);
3551
3552         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
3553         if (ie) {
3554                 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
3555                 ie->timestamp = jiffies;
3556         }
3557
3558         hci_dev_unlock(hdev);
3559 }
3560
3561 static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
3562                                              struct sk_buff *skb)
3563 {
3564         struct inquiry_data data;
3565         int num_rsp = *((__u8 *) skb->data);
3566
3567         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
3568
3569         if (!num_rsp)
3570                 return;
3571
3572         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
3573                 return;
3574
3575         hci_dev_lock(hdev);
3576
3577         if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
3578                 struct inquiry_info_with_rssi_and_pscan_mode *info;
3579                 info = (void *) (skb->data + 1);
3580
3581                 for (; num_rsp; num_rsp--, info++) {
3582                         u32 flags;
3583
3584                         bacpy(&data.bdaddr, &info->bdaddr);
3585                         data.pscan_rep_mode     = info->pscan_rep_mode;
3586                         data.pscan_period_mode  = info->pscan_period_mode;
3587                         data.pscan_mode         = info->pscan_mode;
3588                         memcpy(data.dev_class, info->dev_class, 3);
3589                         data.clock_offset       = info->clock_offset;
3590                         data.rssi               = info->rssi;
3591                         data.ssp_mode           = 0x00;
3592
3593                         flags = hci_inquiry_cache_update(hdev, &data, false);
3594
3595                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
3596                                           info->dev_class, info->rssi,
3597                                           flags, NULL, 0, NULL, 0);
3598                 }
3599         } else {
3600                 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
3601
3602                 for (; num_rsp; num_rsp--, info++) {
3603                         u32 flags;
3604
3605                         bacpy(&data.bdaddr, &info->bdaddr);
3606                         data.pscan_rep_mode     = info->pscan_rep_mode;
3607                         data.pscan_period_mode  = info->pscan_period_mode;
3608                         data.pscan_mode         = 0x00;
3609                         memcpy(data.dev_class, info->dev_class, 3);
3610                         data.clock_offset       = info->clock_offset;
3611                         data.rssi               = info->rssi;
3612                         data.ssp_mode           = 0x00;
3613
3614                         flags = hci_inquiry_cache_update(hdev, &data, false);
3615
3616                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
3617                                           info->dev_class, info->rssi,
3618                                           flags, NULL, 0, NULL, 0);
3619                 }
3620         }
3621
3622         hci_dev_unlock(hdev);
3623 }
3624
3625 static void hci_remote_ext_features_evt(struct hci_dev *hdev,
3626                                         struct sk_buff *skb)
3627 {
3628         struct hci_ev_remote_ext_features *ev = (void *) skb->data;
3629         struct hci_conn *conn;
3630
3631         BT_DBG("%s", hdev->name);
3632
3633         hci_dev_lock(hdev);
3634
3635         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3636         if (!conn)
3637                 goto unlock;
3638
3639         if (ev->page < HCI_MAX_PAGES)
3640                 memcpy(conn->features[ev->page], ev->features, 8);
3641
3642         if (!ev->status && ev->page == 0x01) {
3643                 struct inquiry_entry *ie;
3644
3645                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
3646                 if (ie)
3647                         ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
3648
3649                 if (ev->features[0] & LMP_HOST_SSP) {
3650                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
3651                 } else {
3652                         /* It is mandatory by the Bluetooth specification that
3653                          * Extended Inquiry Results are only used when Secure
3654                          * Simple Pairing is enabled, but some devices violate
3655                          * this.
3656                          *
3657                          * To make these devices work, the internal SSP
3658                          * enabled flag needs to be cleared if the remote host
3659                          * features do not indicate SSP support */
3660                         clear_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
3661                 }
3662
3663                 if (ev->features[0] & LMP_HOST_SC)
3664                         set_bit(HCI_CONN_SC_ENABLED, &conn->flags);
3665         }
3666
3667         if (conn->state != BT_CONFIG)
3668                 goto unlock;
3669
3670         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
3671                 struct hci_cp_remote_name_req cp;
3672                 memset(&cp, 0, sizeof(cp));
3673                 bacpy(&cp.bdaddr, &conn->dst);
3674                 cp.pscan_rep_mode = 0x02;
3675                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
3676         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
3677                 mgmt_device_connected(hdev, conn, 0, NULL, 0);
3678
3679         if (!hci_outgoing_auth_needed(hdev, conn)) {
3680                 conn->state = BT_CONNECTED;
3681                 hci_connect_cfm(conn, ev->status);
3682                 hci_conn_drop(conn);
3683         }
3684
3685 unlock:
3686         hci_dev_unlock(hdev);
3687 }
3688
3689 static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
3690                                        struct sk_buff *skb)
3691 {
3692         struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
3693         struct hci_conn *conn;
3694
3695         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3696
3697         hci_dev_lock(hdev);
3698
3699         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
3700         if (!conn) {
3701                 if (ev->link_type == ESCO_LINK)
3702                         goto unlock;
3703
3704                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
3705                 if (!conn)
3706                         goto unlock;
3707
3708                 conn->type = SCO_LINK;
3709         }
3710
3711         switch (ev->status) {
3712         case 0x00:
3713                 conn->handle = __le16_to_cpu(ev->handle);
3714                 conn->state  = BT_CONNECTED;
3715
3716                 hci_debugfs_create_conn(conn);
3717                 hci_conn_add_sysfs(conn);
3718                 break;
3719
3720         case 0x10:      /* Connection Accept Timeout */
3721         case 0x0d:      /* Connection Rejected due to Limited Resources */
3722         case 0x11:      /* Unsupported Feature or Parameter Value */
3723         case 0x1c:      /* SCO interval rejected */
3724         case 0x1a:      /* Unsupported Remote Feature */
3725         case 0x1f:      /* Unspecified error */
3726         case 0x20:      /* Unsupported LMP Parameter value */
3727                 if (conn->out) {
3728                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
3729                                         (hdev->esco_type & EDR_ESCO_MASK);
3730                         if (hci_setup_sync(conn, conn->link->handle))
3731                                 goto unlock;
3732                 }
3733                 /* fall through */
3734
3735         default:
3736                 conn->state = BT_CLOSED;
3737                 break;
3738         }
3739
3740         hci_connect_cfm(conn, ev->status);
3741         if (ev->status)
3742                 hci_conn_del(conn);
3743
3744 unlock:
3745         hci_dev_unlock(hdev);
3746 }
3747
3748 static inline size_t eir_get_length(u8 *eir, size_t eir_len)
3749 {
3750         size_t parsed = 0;
3751
3752         while (parsed < eir_len) {
3753                 u8 field_len = eir[0];
3754
3755                 if (field_len == 0)
3756                         return parsed;
3757
3758                 parsed += field_len + 1;
3759                 eir += field_len + 1;
3760         }
3761
3762         return eir_len;
3763 }
3764
3765 static void hci_extended_inquiry_result_evt(struct hci_dev *hdev,
3766                                             struct sk_buff *skb)
3767 {
3768         struct inquiry_data data;
3769         struct extended_inquiry_info *info = (void *) (skb->data + 1);
3770         int num_rsp = *((__u8 *) skb->data);
3771         size_t eir_len;
3772
3773         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
3774
3775         if (!num_rsp)
3776                 return;
3777
3778         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
3779                 return;
3780
3781         hci_dev_lock(hdev);
3782
3783         for (; num_rsp; num_rsp--, info++) {
3784                 u32 flags;
3785                 bool name_known;
3786
3787                 bacpy(&data.bdaddr, &info->bdaddr);
3788                 data.pscan_rep_mode     = info->pscan_rep_mode;
3789                 data.pscan_period_mode  = info->pscan_period_mode;
3790                 data.pscan_mode         = 0x00;
3791                 memcpy(data.dev_class, info->dev_class, 3);
3792                 data.clock_offset       = info->clock_offset;
3793                 data.rssi               = info->rssi;
3794                 data.ssp_mode           = 0x01;
3795
3796                 if (hci_dev_test_flag(hdev, HCI_MGMT))
3797                         name_known = eir_has_data_type(info->data,
3798                                                        sizeof(info->data),
3799                                                        EIR_NAME_COMPLETE);
3800                 else
3801                         name_known = true;
3802
3803                 flags = hci_inquiry_cache_update(hdev, &data, name_known);
3804
3805                 eir_len = eir_get_length(info->data, sizeof(info->data));
3806
3807                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
3808                                   info->dev_class, info->rssi,
3809                                   flags, info->data, eir_len, NULL, 0);
3810         }
3811
3812         hci_dev_unlock(hdev);
3813 }
3814
3815 static void hci_key_refresh_complete_evt(struct hci_dev *hdev,
3816                                          struct sk_buff *skb)
3817 {
3818         struct hci_ev_key_refresh_complete *ev = (void *) skb->data;
3819         struct hci_conn *conn;
3820
3821         BT_DBG("%s status 0x%2.2x handle 0x%4.4x", hdev->name, ev->status,
3822                __le16_to_cpu(ev->handle));
3823
3824         hci_dev_lock(hdev);
3825
3826         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3827         if (!conn)
3828                 goto unlock;
3829
3830         /* For BR/EDR the necessary steps are taken through the
3831          * auth_complete event.
3832          */
3833         if (conn->type != LE_LINK)
3834                 goto unlock;
3835
3836         if (!ev->status)
3837                 conn->sec_level = conn->pending_sec_level;
3838
3839         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3840
3841         if (ev->status && conn->state == BT_CONNECTED) {
3842                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
3843                 hci_conn_drop(conn);
3844                 goto unlock;
3845         }
3846
3847         if (conn->state == BT_CONFIG) {
3848                 if (!ev->status)
3849                         conn->state = BT_CONNECTED;
3850
3851                 hci_connect_cfm(conn, ev->status);
3852                 hci_conn_drop(conn);
3853         } else {
3854                 hci_auth_cfm(conn, ev->status);
3855
3856                 hci_conn_hold(conn);
3857                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3858                 hci_conn_drop(conn);
3859         }
3860
3861 unlock:
3862         hci_dev_unlock(hdev);
3863 }
3864
3865 static u8 hci_get_auth_req(struct hci_conn *conn)
3866 {
3867         /* If remote requests no-bonding follow that lead */
3868         if (conn->remote_auth == HCI_AT_NO_BONDING ||
3869             conn->remote_auth == HCI_AT_NO_BONDING_MITM)
3870                 return conn->remote_auth | (conn->auth_type & 0x01);
3871
3872         /* If both remote and local have enough IO capabilities, require
3873          * MITM protection
3874          */
3875         if (conn->remote_cap != HCI_IO_NO_INPUT_OUTPUT &&
3876             conn->io_capability != HCI_IO_NO_INPUT_OUTPUT)
3877                 return conn->remote_auth | 0x01;
3878
3879         /* No MITM protection possible so ignore remote requirement */
3880         return (conn->remote_auth & ~0x01) | (conn->auth_type & 0x01);
3881 }
3882
3883 static u8 bredr_oob_data_present(struct hci_conn *conn)
3884 {
3885         struct hci_dev *hdev = conn->hdev;
3886         struct oob_data *data;
3887
3888         data = hci_find_remote_oob_data(hdev, &conn->dst, BDADDR_BREDR);
3889         if (!data)
3890                 return 0x00;
3891
3892         if (conn->out || test_bit(HCI_CONN_REMOTE_OOB, &conn->flags)) {
3893                 if (bredr_sc_enabled(hdev)) {
3894                         /* When Secure Connections is enabled, then just
3895                          * return the present value stored with the OOB
3896                          * data. The stored value contains the right present
3897                          * information. However it can only be trusted when
3898                          * not in Secure Connection Only mode.
3899                          */
3900                         if (!hci_dev_test_flag(hdev, HCI_SC_ONLY))
3901                                 return data->present;
3902
3903                         /* When Secure Connections Only mode is enabled, then
3904                          * the P-256 values are required. If they are not
3905                          * available, then do not declare that OOB data is
3906                          * present.
3907                          */
3908                         if (!memcmp(data->rand256, ZERO_KEY, 16) ||
3909                             !memcmp(data->hash256, ZERO_KEY, 16))
3910                                 return 0x00;
3911
3912                         return 0x02;
3913                 }
3914
3915                 /* When Secure Connections is not enabled or actually
3916                  * not supported by the hardware, then check that if
3917                  * P-192 data values are present.
3918                  */
3919                 if (!memcmp(data->rand192, ZERO_KEY, 16) ||
3920                     !memcmp(data->hash192, ZERO_KEY, 16))
3921                         return 0x00;
3922
3923                 return 0x01;
3924         }
3925
3926         return 0x00;
3927 }
3928
3929 static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3930 {
3931         struct hci_ev_io_capa_request *ev = (void *) skb->data;
3932         struct hci_conn *conn;
3933
3934         BT_DBG("%s", hdev->name);
3935
3936         hci_dev_lock(hdev);
3937
3938         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3939         if (!conn)
3940                 goto unlock;
3941
3942         hci_conn_hold(conn);
3943
3944         if (!hci_dev_test_flag(hdev, HCI_MGMT))
3945                 goto unlock;
3946
3947         /* Allow pairing if we're pairable, the initiators of the
3948          * pairing or if the remote is not requesting bonding.
3949          */
3950         if (hci_dev_test_flag(hdev, HCI_BONDABLE) ||
3951             test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags) ||
3952             (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
3953                 struct hci_cp_io_capability_reply cp;
3954
3955                 bacpy(&cp.bdaddr, &ev->bdaddr);
3956                 /* Change the IO capability from KeyboardDisplay
3957                  * to DisplayYesNo as it is not supported by BT spec. */
3958                 cp.capability = (conn->io_capability == 0x04) ?
3959                                 HCI_IO_DISPLAY_YESNO : conn->io_capability;
3960
3961                 /* If we are initiators, there is no remote information yet */
3962                 if (conn->remote_auth == 0xff) {
3963                         /* Request MITM protection if our IO caps allow it
3964                          * except for the no-bonding case.
3965                          */
3966                         if (conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
3967                             conn->auth_type != HCI_AT_NO_BONDING)
3968                                 conn->auth_type |= 0x01;
3969                 } else {
3970                         conn->auth_type = hci_get_auth_req(conn);
3971                 }
3972
3973                 /* If we're not bondable, force one of the non-bondable
3974                  * authentication requirement values.
3975                  */
3976                 if (!hci_dev_test_flag(hdev, HCI_BONDABLE))
3977                         conn->auth_type &= HCI_AT_NO_BONDING_MITM;
3978
3979                 cp.authentication = conn->auth_type;
3980                 cp.oob_data = bredr_oob_data_present(conn);
3981
3982                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
3983                              sizeof(cp), &cp);
3984         } else {
3985                 struct hci_cp_io_capability_neg_reply cp;
3986
3987                 bacpy(&cp.bdaddr, &ev->bdaddr);
3988                 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
3989
3990                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
3991                              sizeof(cp), &cp);
3992         }
3993
3994 unlock:
3995         hci_dev_unlock(hdev);
3996 }
3997
3998 static void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
3999 {
4000         struct hci_ev_io_capa_reply *ev = (void *) skb->data;
4001         struct hci_conn *conn;
4002
4003         BT_DBG("%s", hdev->name);
4004
4005         hci_dev_lock(hdev);
4006
4007         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4008         if (!conn)
4009                 goto unlock;
4010
4011         conn->remote_cap = ev->capability;
4012         conn->remote_auth = ev->authentication;
4013         if (ev->oob_data)
4014                 set_bit(HCI_CONN_REMOTE_OOB, &conn->flags);
4015
4016 unlock:
4017         hci_dev_unlock(hdev);
4018 }
4019
4020 static void hci_user_confirm_request_evt(struct hci_dev *hdev,
4021                                          struct sk_buff *skb)
4022 {
4023         struct hci_ev_user_confirm_req *ev = (void *) skb->data;
4024         int loc_mitm, rem_mitm, confirm_hint = 0;
4025         struct hci_conn *conn;
4026
4027         BT_DBG("%s", hdev->name);
4028
4029         hci_dev_lock(hdev);
4030
4031         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4032                 goto unlock;
4033
4034         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4035         if (!conn)
4036                 goto unlock;
4037
4038         loc_mitm = (conn->auth_type & 0x01);
4039         rem_mitm = (conn->remote_auth & 0x01);
4040
4041         /* If we require MITM but the remote device can't provide that
4042          * (it has NoInputNoOutput) then reject the confirmation
4043          * request. We check the security level here since it doesn't
4044          * necessarily match conn->auth_type.
4045          */
4046         if (conn->pending_sec_level > BT_SECURITY_MEDIUM &&
4047             conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
4048                 BT_DBG("Rejecting request: remote device can't provide MITM");
4049                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
4050                              sizeof(ev->bdaddr), &ev->bdaddr);
4051                 goto unlock;
4052         }
4053
4054         /* If no side requires MITM protection; auto-accept */
4055         if ((!loc_mitm || conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) &&
4056             (!rem_mitm || conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)) {
4057
4058                 /* If we're not the initiators request authorization to
4059                  * proceed from user space (mgmt_user_confirm with
4060                  * confirm_hint set to 1). The exception is if neither
4061                  * side had MITM or if the local IO capability is
4062                  * NoInputNoOutput, in which case we do auto-accept
4063                  */
4064                 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&
4065                     conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
4066                     (loc_mitm || rem_mitm)) {
4067                         BT_DBG("Confirming auto-accept as acceptor");
4068                         confirm_hint = 1;
4069                         goto confirm;
4070                 }
4071
4072                 BT_DBG("Auto-accept of user confirmation with %ums delay",
4073                        hdev->auto_accept_delay);
4074
4075                 if (hdev->auto_accept_delay > 0) {
4076                         int delay = msecs_to_jiffies(hdev->auto_accept_delay);
4077                         queue_delayed_work(conn->hdev->workqueue,
4078                                            &conn->auto_accept_work, delay);
4079                         goto unlock;
4080                 }
4081
4082                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
4083                              sizeof(ev->bdaddr), &ev->bdaddr);
4084                 goto unlock;
4085         }
4086
4087 confirm:
4088         mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0,
4089                                   le32_to_cpu(ev->passkey), confirm_hint);
4090
4091 unlock:
4092         hci_dev_unlock(hdev);
4093 }
4094
4095 static void hci_user_passkey_request_evt(struct hci_dev *hdev,
4096                                          struct sk_buff *skb)
4097 {
4098         struct hci_ev_user_passkey_req *ev = (void *) skb->data;
4099
4100         BT_DBG("%s", hdev->name);
4101
4102         if (hci_dev_test_flag(hdev, HCI_MGMT))
4103                 mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
4104 }
4105
4106 static void hci_user_passkey_notify_evt(struct hci_dev *hdev,
4107                                         struct sk_buff *skb)
4108 {
4109         struct hci_ev_user_passkey_notify *ev = (void *) skb->data;
4110         struct hci_conn *conn;
4111
4112         BT_DBG("%s", hdev->name);
4113
4114         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4115         if (!conn)
4116                 return;
4117
4118         conn->passkey_notify = __le32_to_cpu(ev->passkey);
4119         conn->passkey_entered = 0;
4120
4121         if (hci_dev_test_flag(hdev, HCI_MGMT))
4122                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
4123                                          conn->dst_type, conn->passkey_notify,
4124                                          conn->passkey_entered);
4125 }
4126
4127 static void hci_keypress_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
4128 {
4129         struct hci_ev_keypress_notify *ev = (void *) skb->data;
4130         struct hci_conn *conn;
4131
4132         BT_DBG("%s", hdev->name);
4133
4134         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4135         if (!conn)
4136                 return;
4137
4138         switch (ev->type) {
4139         case HCI_KEYPRESS_STARTED:
4140                 conn->passkey_entered = 0;
4141                 return;
4142
4143         case HCI_KEYPRESS_ENTERED:
4144                 conn->passkey_entered++;
4145                 break;
4146
4147         case HCI_KEYPRESS_ERASED:
4148                 conn->passkey_entered--;
4149                 break;
4150
4151         case HCI_KEYPRESS_CLEARED:
4152                 conn->passkey_entered = 0;
4153                 break;
4154
4155         case HCI_KEYPRESS_COMPLETED:
4156                 return;
4157         }
4158
4159         if (hci_dev_test_flag(hdev, HCI_MGMT))
4160                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
4161                                          conn->dst_type, conn->passkey_notify,
4162                                          conn->passkey_entered);
4163 }
4164
4165 static void hci_simple_pair_complete_evt(struct hci_dev *hdev,
4166                                          struct sk_buff *skb)
4167 {
4168         struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
4169         struct hci_conn *conn;
4170
4171         BT_DBG("%s", hdev->name);
4172
4173         hci_dev_lock(hdev);
4174
4175         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4176         if (!conn)
4177                 goto unlock;
4178
4179         /* Reset the authentication requirement to unknown */
4180         conn->remote_auth = 0xff;
4181
4182         /* To avoid duplicate auth_failed events to user space we check
4183          * the HCI_CONN_AUTH_PEND flag which will be set if we
4184          * initiated the authentication. A traditional auth_complete
4185          * event gets always produced as initiator and is also mapped to
4186          * the mgmt_auth_failed event */
4187         if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status)
4188                 mgmt_auth_failed(conn, ev->status);
4189
4190         hci_conn_drop(conn);
4191
4192 unlock:
4193         hci_dev_unlock(hdev);
4194 }
4195
4196 static void hci_remote_host_features_evt(struct hci_dev *hdev,
4197                                          struct sk_buff *skb)
4198 {
4199         struct hci_ev_remote_host_features *ev = (void *) skb->data;
4200         struct inquiry_entry *ie;
4201         struct hci_conn *conn;
4202
4203         BT_DBG("%s", hdev->name);
4204
4205         hci_dev_lock(hdev);
4206
4207         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4208         if (conn)
4209                 memcpy(conn->features[1], ev->features, 8);
4210
4211         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
4212         if (ie)
4213                 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
4214
4215         hci_dev_unlock(hdev);
4216 }
4217
4218 static void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
4219                                             struct sk_buff *skb)
4220 {
4221         struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
4222         struct oob_data *data;
4223
4224         BT_DBG("%s", hdev->name);
4225
4226         hci_dev_lock(hdev);
4227
4228         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4229                 goto unlock;
4230
4231         data = hci_find_remote_oob_data(hdev, &ev->bdaddr, BDADDR_BREDR);
4232         if (!data) {
4233                 struct hci_cp_remote_oob_data_neg_reply cp;
4234
4235                 bacpy(&cp.bdaddr, &ev->bdaddr);
4236                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY,
4237                              sizeof(cp), &cp);
4238                 goto unlock;
4239         }
4240
4241         if (bredr_sc_enabled(hdev)) {
4242                 struct hci_cp_remote_oob_ext_data_reply cp;
4243
4244                 bacpy(&cp.bdaddr, &ev->bdaddr);
4245                 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
4246                         memset(cp.hash192, 0, sizeof(cp.hash192));
4247                         memset(cp.rand192, 0, sizeof(cp.rand192));
4248                 } else {
4249                         memcpy(cp.hash192, data->hash192, sizeof(cp.hash192));
4250                         memcpy(cp.rand192, data->rand192, sizeof(cp.rand192));
4251                 }
4252                 memcpy(cp.hash256, data->hash256, sizeof(cp.hash256));
4253                 memcpy(cp.rand256, data->rand256, sizeof(cp.rand256));
4254
4255                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_EXT_DATA_REPLY,
4256                              sizeof(cp), &cp);
4257         } else {
4258                 struct hci_cp_remote_oob_data_reply cp;
4259
4260                 bacpy(&cp.bdaddr, &ev->bdaddr);
4261                 memcpy(cp.hash, data->hash192, sizeof(cp.hash));
4262                 memcpy(cp.rand, data->rand192, sizeof(cp.rand));
4263
4264                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY,
4265                              sizeof(cp), &cp);
4266         }
4267
4268 unlock:
4269         hci_dev_unlock(hdev);
4270 }
4271
4272 static void hci_phy_link_complete_evt(struct hci_dev *hdev,
4273                                       struct sk_buff *skb)
4274 {
4275         struct hci_ev_phy_link_complete *ev = (void *) skb->data;
4276         struct hci_conn *hcon, *bredr_hcon;
4277
4278         BT_DBG("%s handle 0x%2.2x status 0x%2.2x", hdev->name, ev->phy_handle,
4279                ev->status);
4280
4281         hci_dev_lock(hdev);
4282
4283         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4284         if (!hcon) {
4285                 hci_dev_unlock(hdev);
4286                 return;
4287         }
4288
4289         if (ev->status) {
4290                 hci_conn_del(hcon);
4291                 hci_dev_unlock(hdev);
4292                 return;
4293         }
4294
4295         bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
4296
4297         hcon->state = BT_CONNECTED;
4298         bacpy(&hcon->dst, &bredr_hcon->dst);
4299
4300         hci_conn_hold(hcon);
4301         hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
4302         hci_conn_drop(hcon);
4303
4304         hci_debugfs_create_conn(hcon);
4305         hci_conn_add_sysfs(hcon);
4306
4307         amp_physical_cfm(bredr_hcon, hcon);
4308
4309         hci_dev_unlock(hdev);
4310 }
4311
4312 static void hci_loglink_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
4313 {
4314         struct hci_ev_logical_link_complete *ev = (void *) skb->data;
4315         struct hci_conn *hcon;
4316         struct hci_chan *hchan;
4317         struct amp_mgr *mgr;
4318
4319         BT_DBG("%s log_handle 0x%4.4x phy_handle 0x%2.2x status 0x%2.2x",
4320                hdev->name, le16_to_cpu(ev->handle), ev->phy_handle,
4321                ev->status);
4322
4323         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4324         if (!hcon)
4325                 return;
4326
4327         /* Create AMP hchan */
4328         hchan = hci_chan_create(hcon);
4329         if (!hchan)
4330                 return;
4331
4332         hchan->handle = le16_to_cpu(ev->handle);
4333
4334         BT_DBG("hcon %p mgr %p hchan %p", hcon, hcon->amp_mgr, hchan);
4335
4336         mgr = hcon->amp_mgr;
4337         if (mgr && mgr->bredr_chan) {
4338                 struct l2cap_chan *bredr_chan = mgr->bredr_chan;
4339
4340                 l2cap_chan_lock(bredr_chan);
4341
4342                 bredr_chan->conn->mtu = hdev->block_mtu;
4343                 l2cap_logical_cfm(bredr_chan, hchan, 0);
4344                 hci_conn_hold(hcon);
4345
4346                 l2cap_chan_unlock(bredr_chan);
4347         }
4348 }
4349
4350 static void hci_disconn_loglink_complete_evt(struct hci_dev *hdev,
4351                                              struct sk_buff *skb)
4352 {
4353         struct hci_ev_disconn_logical_link_complete *ev = (void *) skb->data;
4354         struct hci_chan *hchan;
4355
4356         BT_DBG("%s log handle 0x%4.4x status 0x%2.2x", hdev->name,
4357                le16_to_cpu(ev->handle), ev->status);
4358
4359         if (ev->status)
4360                 return;
4361
4362         hci_dev_lock(hdev);
4363
4364         hchan = hci_chan_lookup_handle(hdev, le16_to_cpu(ev->handle));
4365         if (!hchan)
4366                 goto unlock;
4367
4368         amp_destroy_logical_link(hchan, ev->reason);
4369
4370 unlock:
4371         hci_dev_unlock(hdev);
4372 }
4373
4374 static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev,
4375                                              struct sk_buff *skb)
4376 {
4377         struct hci_ev_disconn_phy_link_complete *ev = (void *) skb->data;
4378         struct hci_conn *hcon;
4379
4380         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4381
4382         if (ev->status)
4383                 return;
4384
4385         hci_dev_lock(hdev);
4386
4387         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4388         if (hcon) {
4389                 hcon->state = BT_CLOSED;
4390                 hci_conn_del(hcon);
4391         }
4392
4393         hci_dev_unlock(hdev);
4394 }
4395
4396 static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
4397 {
4398         struct hci_ev_le_conn_complete *ev = (void *) skb->data;
4399         struct hci_conn_params *params;
4400         struct hci_conn *conn;
4401         struct smp_irk *irk;
4402         u8 addr_type;
4403
4404         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4405
4406         hci_dev_lock(hdev);
4407
4408         /* All controllers implicitly stop advertising in the event of a
4409          * connection, so ensure that the state bit is cleared.
4410          */
4411         hci_dev_clear_flag(hdev, HCI_LE_ADV);
4412
4413         conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
4414         if (!conn) {
4415                 conn = hci_conn_add(hdev, LE_LINK, &ev->bdaddr, ev->role);
4416                 if (!conn) {
4417                         BT_ERR("No memory for new connection");
4418                         goto unlock;
4419                 }
4420
4421                 conn->dst_type = ev->bdaddr_type;
4422
4423                 /* If we didn't have a hci_conn object previously
4424                  * but we're in master role this must be something
4425                  * initiated using a white list. Since white list based
4426                  * connections are not "first class citizens" we don't
4427                  * have full tracking of them. Therefore, we go ahead
4428                  * with a "best effort" approach of determining the
4429                  * initiator address based on the HCI_PRIVACY flag.
4430                  */
4431                 if (conn->out) {
4432                         conn->resp_addr_type = ev->bdaddr_type;
4433                         bacpy(&conn->resp_addr, &ev->bdaddr);
4434                         if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
4435                                 conn->init_addr_type = ADDR_LE_DEV_RANDOM;
4436                                 bacpy(&conn->init_addr, &hdev->rpa);
4437                         } else {
4438                                 hci_copy_identity_address(hdev,
4439                                                           &conn->init_addr,
4440                                                           &conn->init_addr_type);
4441                         }
4442                 }
4443         } else {
4444                 cancel_delayed_work(&conn->le_conn_timeout);
4445         }
4446
4447         if (!conn->out) {
4448                 /* Set the responder (our side) address type based on
4449                  * the advertising address type.
4450                  */
4451                 conn->resp_addr_type = hdev->adv_addr_type;
4452                 if (hdev->adv_addr_type == ADDR_LE_DEV_RANDOM)
4453                         bacpy(&conn->resp_addr, &hdev->random_addr);
4454                 else
4455                         bacpy(&conn->resp_addr, &hdev->bdaddr);
4456
4457                 conn->init_addr_type = ev->bdaddr_type;
4458                 bacpy(&conn->init_addr, &ev->bdaddr);
4459
4460                 /* For incoming connections, set the default minimum
4461                  * and maximum connection interval. They will be used
4462                  * to check if the parameters are in range and if not
4463                  * trigger the connection update procedure.
4464                  */
4465                 conn->le_conn_min_interval = hdev->le_conn_min_interval;
4466                 conn->le_conn_max_interval = hdev->le_conn_max_interval;
4467         }
4468
4469         /* Lookup the identity address from the stored connection
4470          * address and address type.
4471          *
4472          * When establishing connections to an identity address, the
4473          * connection procedure will store the resolvable random
4474          * address first. Now if it can be converted back into the
4475          * identity address, start using the identity address from
4476          * now on.
4477          */
4478         irk = hci_get_irk(hdev, &conn->dst, conn->dst_type);
4479         if (irk) {
4480                 bacpy(&conn->dst, &irk->bdaddr);
4481                 conn->dst_type = irk->addr_type;
4482         }
4483
4484         if (ev->status) {
4485                 hci_le_conn_failed(conn, ev->status);
4486                 goto unlock;
4487         }
4488
4489         if (conn->dst_type == ADDR_LE_DEV_PUBLIC)
4490                 addr_type = BDADDR_LE_PUBLIC;
4491         else
4492                 addr_type = BDADDR_LE_RANDOM;
4493
4494         /* Drop the connection if the device is blocked */
4495         if (hci_bdaddr_list_lookup(&hdev->blacklist, &conn->dst, addr_type)) {
4496                 hci_conn_drop(conn);
4497                 goto unlock;
4498         }
4499
4500         if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
4501                 mgmt_device_connected(hdev, conn, 0, NULL, 0);
4502
4503         conn->sec_level = BT_SECURITY_LOW;
4504         conn->handle = __le16_to_cpu(ev->handle);
4505         conn->state = BT_CONNECTED;
4506
4507         conn->le_conn_interval = le16_to_cpu(ev->interval);
4508         conn->le_conn_latency = le16_to_cpu(ev->latency);
4509         conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
4510
4511         hci_debugfs_create_conn(conn);
4512         hci_conn_add_sysfs(conn);
4513
4514         hci_connect_cfm(conn, ev->status);
4515
4516         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
4517                                            conn->dst_type);
4518         if (params) {
4519                 list_del_init(&params->action);
4520                 if (params->conn) {
4521                         hci_conn_drop(params->conn);
4522                         hci_conn_put(params->conn);
4523                         params->conn = NULL;
4524                 }
4525         }
4526
4527 unlock:
4528         hci_update_background_scan(hdev);
4529         hci_dev_unlock(hdev);
4530 }
4531
4532 static void hci_le_conn_update_complete_evt(struct hci_dev *hdev,
4533                                             struct sk_buff *skb)
4534 {
4535         struct hci_ev_le_conn_update_complete *ev = (void *) skb->data;
4536         struct hci_conn *conn;
4537
4538         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4539
4540         if (ev->status)
4541                 return;
4542
4543         hci_dev_lock(hdev);
4544
4545         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4546         if (conn) {
4547                 conn->le_conn_interval = le16_to_cpu(ev->interval);
4548                 conn->le_conn_latency = le16_to_cpu(ev->latency);
4549                 conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
4550         }
4551
4552         hci_dev_unlock(hdev);
4553 }
4554
4555 /* This function requires the caller holds hdev->lock */
4556 static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev,
4557                                               bdaddr_t *addr,
4558                                               u8 addr_type, u8 adv_type)
4559 {
4560         struct hci_conn *conn;
4561         struct hci_conn_params *params;
4562
4563         /* If the event is not connectable don't proceed further */
4564         if (adv_type != LE_ADV_IND && adv_type != LE_ADV_DIRECT_IND)
4565                 return NULL;
4566
4567         /* Ignore if the device is blocked */
4568         if (hci_bdaddr_list_lookup(&hdev->blacklist, addr, addr_type))
4569                 return NULL;
4570
4571         /* Most controller will fail if we try to create new connections
4572          * while we have an existing one in slave role.
4573          */
4574         if (hdev->conn_hash.le_num_slave > 0)
4575                 return NULL;
4576
4577         /* If we're not connectable only connect devices that we have in
4578          * our pend_le_conns list.
4579          */
4580         params = hci_pend_le_action_lookup(&hdev->pend_le_conns,
4581                                            addr, addr_type);
4582         if (!params)
4583                 return NULL;
4584
4585         switch (params->auto_connect) {
4586         case HCI_AUTO_CONN_DIRECT:
4587                 /* Only devices advertising with ADV_DIRECT_IND are
4588                  * triggering a connection attempt. This is allowing
4589                  * incoming connections from slave devices.
4590                  */
4591                 if (adv_type != LE_ADV_DIRECT_IND)
4592                         return NULL;
4593                 break;
4594         case HCI_AUTO_CONN_ALWAYS:
4595                 /* Devices advertising with ADV_IND or ADV_DIRECT_IND
4596                  * are triggering a connection attempt. This means
4597                  * that incoming connectioms from slave device are
4598                  * accepted and also outgoing connections to slave
4599                  * devices are established when found.
4600                  */
4601                 break;
4602         default:
4603                 return NULL;
4604         }
4605
4606         conn = hci_connect_le(hdev, addr, addr_type, BT_SECURITY_LOW,
4607                               HCI_LE_AUTOCONN_TIMEOUT, HCI_ROLE_MASTER);
4608         if (!IS_ERR(conn)) {
4609                 /* Store the pointer since we don't really have any
4610                  * other owner of the object besides the params that
4611                  * triggered it. This way we can abort the connection if
4612                  * the parameters get removed and keep the reference
4613                  * count consistent once the connection is established.
4614                  */
4615                 params->conn = hci_conn_get(conn);
4616                 return conn;
4617         }
4618
4619         switch (PTR_ERR(conn)) {
4620         case -EBUSY:
4621                 /* If hci_connect() returns -EBUSY it means there is already
4622                  * an LE connection attempt going on. Since controllers don't
4623                  * support more than one connection attempt at the time, we
4624                  * don't consider this an error case.
4625                  */
4626                 break;
4627         default:
4628                 BT_DBG("Failed to connect: err %ld", PTR_ERR(conn));
4629                 return NULL;
4630         }
4631
4632         return NULL;
4633 }
4634
4635 static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
4636                                u8 bdaddr_type, bdaddr_t *direct_addr,
4637                                u8 direct_addr_type, s8 rssi, u8 *data, u8 len)
4638 {
4639         struct discovery_state *d = &hdev->discovery;
4640         struct smp_irk *irk;
4641         struct hci_conn *conn;
4642         bool match;
4643         u32 flags;
4644
4645         /* If the direct address is present, then this report is from
4646          * a LE Direct Advertising Report event. In that case it is
4647          * important to see if the address is matching the local
4648          * controller address.
4649          */
4650         if (direct_addr) {
4651                 /* Only resolvable random addresses are valid for these
4652                  * kind of reports and others can be ignored.
4653                  */
4654                 if (!hci_bdaddr_is_rpa(direct_addr, direct_addr_type))
4655                         return;
4656
4657                 /* If the controller is not using resolvable random
4658                  * addresses, then this report can be ignored.
4659                  */
4660                 if (!hci_dev_test_flag(hdev, HCI_PRIVACY))
4661                         return;
4662
4663                 /* If the local IRK of the controller does not match
4664                  * with the resolvable random address provided, then
4665                  * this report can be ignored.
4666                  */
4667                 if (!smp_irk_matches(hdev, hdev->irk, direct_addr))
4668                         return;
4669         }
4670
4671         /* Check if we need to convert to identity address */
4672         irk = hci_get_irk(hdev, bdaddr, bdaddr_type);
4673         if (irk) {
4674                 bdaddr = &irk->bdaddr;
4675                 bdaddr_type = irk->addr_type;
4676         }
4677
4678         /* Check if we have been requested to connect to this device */
4679         conn = check_pending_le_conn(hdev, bdaddr, bdaddr_type, type);
4680         if (conn && type == LE_ADV_IND) {
4681                 /* Store report for later inclusion by
4682                  * mgmt_device_connected
4683                  */
4684                 memcpy(conn->le_adv_data, data, len);
4685                 conn->le_adv_data_len = len;
4686         }
4687
4688         /* Passive scanning shouldn't trigger any device found events,
4689          * except for devices marked as CONN_REPORT for which we do send
4690          * device found events.
4691          */
4692         if (hdev->le_scan_type == LE_SCAN_PASSIVE) {
4693                 if (type == LE_ADV_DIRECT_IND)
4694                         return;
4695
4696                 if (!hci_pend_le_action_lookup(&hdev->pend_le_reports,
4697                                                bdaddr, bdaddr_type))
4698                         return;
4699
4700                 if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND)
4701                         flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
4702                 else
4703                         flags = 0;
4704                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
4705                                   rssi, flags, data, len, NULL, 0);
4706                 return;
4707         }
4708
4709         /* When receiving non-connectable or scannable undirected
4710          * advertising reports, this means that the remote device is
4711          * not connectable and then clearly indicate this in the
4712          * device found event.
4713          *
4714          * When receiving a scan response, then there is no way to
4715          * know if the remote device is connectable or not. However
4716          * since scan responses are merged with a previously seen
4717          * advertising report, the flags field from that report
4718          * will be used.
4719          *
4720          * In the really unlikely case that a controller get confused
4721          * and just sends a scan response event, then it is marked as
4722          * not connectable as well.
4723          */
4724         if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND ||
4725             type == LE_ADV_SCAN_RSP)
4726                 flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
4727         else
4728                 flags = 0;
4729
4730         /* If there's nothing pending either store the data from this
4731          * event or send an immediate device found event if the data
4732          * should not be stored for later.
4733          */
4734         if (!has_pending_adv_report(hdev)) {
4735                 /* If the report will trigger a SCAN_REQ store it for
4736                  * later merging.
4737                  */
4738                 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
4739                         store_pending_adv_report(hdev, bdaddr, bdaddr_type,
4740                                                  rssi, flags, data, len);
4741                         return;
4742                 }
4743
4744                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
4745                                   rssi, flags, data, len, NULL, 0);
4746                 return;
4747         }
4748
4749         /* Check if the pending report is for the same device as the new one */
4750         match = (!bacmp(bdaddr, &d->last_adv_addr) &&
4751                  bdaddr_type == d->last_adv_addr_type);
4752
4753         /* If the pending data doesn't match this report or this isn't a
4754          * scan response (e.g. we got a duplicate ADV_IND) then force
4755          * sending of the pending data.
4756          */
4757         if (type != LE_ADV_SCAN_RSP || !match) {
4758                 /* Send out whatever is in the cache, but skip duplicates */
4759                 if (!match)
4760                         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
4761                                           d->last_adv_addr_type, NULL,
4762                                           d->last_adv_rssi, d->last_adv_flags,
4763                                           d->last_adv_data,
4764                                           d->last_adv_data_len, NULL, 0);
4765
4766                 /* If the new report will trigger a SCAN_REQ store it for
4767                  * later merging.
4768                  */
4769                 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
4770                         store_pending_adv_report(hdev, bdaddr, bdaddr_type,
4771                                                  rssi, flags, data, len);
4772                         return;
4773                 }
4774
4775                 /* The advertising reports cannot be merged, so clear
4776                  * the pending report and send out a device found event.
4777                  */
4778                 clear_pending_adv_report(hdev);
4779                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
4780                                   rssi, flags, data, len, NULL, 0);
4781                 return;
4782         }
4783
4784         /* If we get here we've got a pending ADV_IND or ADV_SCAN_IND and
4785          * the new event is a SCAN_RSP. We can therefore proceed with
4786          * sending a merged device found event.
4787          */
4788         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
4789                           d->last_adv_addr_type, NULL, rssi, d->last_adv_flags,
4790                           d->last_adv_data, d->last_adv_data_len, data, len);
4791         clear_pending_adv_report(hdev);
4792 }
4793
4794 static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
4795 {
4796         u8 num_reports = skb->data[0];
4797         void *ptr = &skb->data[1];
4798
4799         hci_dev_lock(hdev);
4800
4801         while (num_reports--) {
4802                 struct hci_ev_le_advertising_info *ev = ptr;
4803                 s8 rssi;
4804
4805                 rssi = ev->data[ev->length];
4806                 process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
4807                                    ev->bdaddr_type, NULL, 0, rssi,
4808                                    ev->data, ev->length);
4809
4810                 ptr += sizeof(*ev) + ev->length + 1;
4811         }
4812
4813         hci_dev_unlock(hdev);
4814 }
4815
4816 static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
4817 {
4818         struct hci_ev_le_ltk_req *ev = (void *) skb->data;
4819         struct hci_cp_le_ltk_reply cp;
4820         struct hci_cp_le_ltk_neg_reply neg;
4821         struct hci_conn *conn;
4822         struct smp_ltk *ltk;
4823
4824         BT_DBG("%s handle 0x%4.4x", hdev->name, __le16_to_cpu(ev->handle));
4825
4826         hci_dev_lock(hdev);
4827
4828         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4829         if (conn == NULL)
4830                 goto not_found;
4831
4832         ltk = hci_find_ltk(hdev, &conn->dst, conn->dst_type, conn->role);
4833         if (!ltk)
4834                 goto not_found;
4835
4836         if (smp_ltk_is_sc(ltk)) {
4837                 /* With SC both EDiv and Rand are set to zero */
4838                 if (ev->ediv || ev->rand)
4839                         goto not_found;
4840         } else {
4841                 /* For non-SC keys check that EDiv and Rand match */
4842                 if (ev->ediv != ltk->ediv || ev->rand != ltk->rand)
4843                         goto not_found;
4844         }
4845
4846         memcpy(cp.ltk, ltk->val, sizeof(ltk->val));
4847         cp.handle = cpu_to_le16(conn->handle);
4848
4849         conn->pending_sec_level = smp_ltk_sec_level(ltk);
4850
4851         conn->enc_key_size = ltk->enc_size;
4852
4853         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
4854
4855         /* Ref. Bluetooth Core SPEC pages 1975 and 2004. STK is a
4856          * temporary key used to encrypt a connection following
4857          * pairing. It is used during the Encrypted Session Setup to
4858          * distribute the keys. Later, security can be re-established
4859          * using a distributed LTK.
4860          */
4861         if (ltk->type == SMP_STK) {
4862                 set_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
4863                 list_del_rcu(&ltk->list);
4864                 kfree_rcu(ltk, rcu);
4865         } else {
4866                 clear_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
4867         }
4868
4869         hci_dev_unlock(hdev);
4870
4871         return;
4872
4873 not_found:
4874         neg.handle = ev->handle;
4875         hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
4876         hci_dev_unlock(hdev);
4877 }
4878
4879 static void send_conn_param_neg_reply(struct hci_dev *hdev, u16 handle,
4880                                       u8 reason)
4881 {
4882         struct hci_cp_le_conn_param_req_neg_reply cp;
4883
4884         cp.handle = cpu_to_le16(handle);
4885         cp.reason = reason;
4886
4887         hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_NEG_REPLY, sizeof(cp),
4888                      &cp);
4889 }
4890
4891 static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev,
4892                                              struct sk_buff *skb)
4893 {
4894         struct hci_ev_le_remote_conn_param_req *ev = (void *) skb->data;
4895         struct hci_cp_le_conn_param_req_reply cp;
4896         struct hci_conn *hcon;
4897         u16 handle, min, max, latency, timeout;
4898
4899         handle = le16_to_cpu(ev->handle);
4900         min = le16_to_cpu(ev->interval_min);
4901         max = le16_to_cpu(ev->interval_max);
4902         latency = le16_to_cpu(ev->latency);
4903         timeout = le16_to_cpu(ev->timeout);
4904
4905         hcon = hci_conn_hash_lookup_handle(hdev, handle);
4906         if (!hcon || hcon->state != BT_CONNECTED)
4907                 return send_conn_param_neg_reply(hdev, handle,
4908                                                  HCI_ERROR_UNKNOWN_CONN_ID);
4909
4910         if (hci_check_conn_params(min, max, latency, timeout))
4911                 return send_conn_param_neg_reply(hdev, handle,
4912                                                  HCI_ERROR_INVALID_LL_PARAMS);
4913
4914         if (hcon->role == HCI_ROLE_MASTER) {
4915                 struct hci_conn_params *params;
4916                 u8 store_hint;
4917
4918                 hci_dev_lock(hdev);
4919
4920                 params = hci_conn_params_lookup(hdev, &hcon->dst,
4921                                                 hcon->dst_type);
4922                 if (params) {
4923                         params->conn_min_interval = min;
4924                         params->conn_max_interval = max;
4925                         params->conn_latency = latency;
4926                         params->supervision_timeout = timeout;
4927                         store_hint = 0x01;
4928                 } else{
4929                         store_hint = 0x00;
4930                 }
4931
4932                 hci_dev_unlock(hdev);
4933
4934                 mgmt_new_conn_param(hdev, &hcon->dst, hcon->dst_type,
4935                                     store_hint, min, max, latency, timeout);
4936         }
4937
4938         cp.handle = ev->handle;
4939         cp.interval_min = ev->interval_min;
4940         cp.interval_max = ev->interval_max;
4941         cp.latency = ev->latency;
4942         cp.timeout = ev->timeout;
4943         cp.min_ce_len = 0;
4944         cp.max_ce_len = 0;
4945
4946         hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_REPLY, sizeof(cp), &cp);
4947 }
4948
4949 static void hci_le_direct_adv_report_evt(struct hci_dev *hdev,
4950                                          struct sk_buff *skb)
4951 {
4952         u8 num_reports = skb->data[0];
4953         void *ptr = &skb->data[1];
4954
4955         hci_dev_lock(hdev);
4956
4957         while (num_reports--) {
4958                 struct hci_ev_le_direct_adv_info *ev = ptr;
4959
4960                 process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
4961                                    ev->bdaddr_type, &ev->direct_addr,
4962                                    ev->direct_addr_type, ev->rssi, NULL, 0);
4963
4964                 ptr += sizeof(*ev);
4965         }
4966
4967         hci_dev_unlock(hdev);
4968 }
4969
4970 static void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
4971 {
4972         struct hci_ev_le_meta *le_ev = (void *) skb->data;
4973
4974         skb_pull(skb, sizeof(*le_ev));
4975
4976         switch (le_ev->subevent) {
4977         case HCI_EV_LE_CONN_COMPLETE:
4978                 hci_le_conn_complete_evt(hdev, skb);
4979                 break;
4980
4981         case HCI_EV_LE_CONN_UPDATE_COMPLETE:
4982                 hci_le_conn_update_complete_evt(hdev, skb);
4983                 break;
4984
4985         case HCI_EV_LE_ADVERTISING_REPORT:
4986                 hci_le_adv_report_evt(hdev, skb);
4987                 break;
4988
4989         case HCI_EV_LE_LTK_REQ:
4990                 hci_le_ltk_request_evt(hdev, skb);
4991                 break;
4992
4993         case HCI_EV_LE_REMOTE_CONN_PARAM_REQ:
4994                 hci_le_remote_conn_param_req_evt(hdev, skb);
4995                 break;
4996
4997         case HCI_EV_LE_DIRECT_ADV_REPORT:
4998                 hci_le_direct_adv_report_evt(hdev, skb);
4999                 break;
5000
5001         default:
5002                 break;
5003         }
5004 }
5005
5006 static void hci_chan_selected_evt(struct hci_dev *hdev, struct sk_buff *skb)
5007 {
5008         struct hci_ev_channel_selected *ev = (void *) skb->data;
5009         struct hci_conn *hcon;
5010
5011         BT_DBG("%s handle 0x%2.2x", hdev->name, ev->phy_handle);
5012
5013         skb_pull(skb, sizeof(*ev));
5014
5015         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
5016         if (!hcon)
5017                 return;
5018
5019         amp_read_loc_assoc_final_data(hdev, hcon);
5020 }
5021
5022 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
5023 {
5024         struct hci_event_hdr *hdr = (void *) skb->data;
5025         __u8 event = hdr->evt;
5026
5027         hci_dev_lock(hdev);
5028
5029         /* Received events are (currently) only needed when a request is
5030          * ongoing so avoid unnecessary memory allocation.
5031          */
5032         if (hci_req_pending(hdev)) {
5033                 kfree_skb(hdev->recv_evt);
5034                 hdev->recv_evt = skb_clone(skb, GFP_KERNEL);
5035         }
5036
5037         hci_dev_unlock(hdev);
5038
5039         skb_pull(skb, HCI_EVENT_HDR_SIZE);
5040
5041         if (hdev->sent_cmd && bt_cb(hdev->sent_cmd)->req_event == event) {
5042                 struct hci_command_hdr *cmd_hdr = (void *) hdev->sent_cmd->data;
5043                 u16 opcode = __le16_to_cpu(cmd_hdr->opcode);
5044
5045                 hci_req_cmd_complete(hdev, opcode, 0);
5046         }
5047
5048         switch (event) {
5049         case HCI_EV_INQUIRY_COMPLETE:
5050                 hci_inquiry_complete_evt(hdev, skb);
5051                 break;
5052
5053         case HCI_EV_INQUIRY_RESULT:
5054                 hci_inquiry_result_evt(hdev, skb);
5055                 break;
5056
5057         case HCI_EV_CONN_COMPLETE:
5058                 hci_conn_complete_evt(hdev, skb);
5059                 break;
5060
5061         case HCI_EV_CONN_REQUEST:
5062                 hci_conn_request_evt(hdev, skb);
5063                 break;
5064
5065         case HCI_EV_DISCONN_COMPLETE:
5066                 hci_disconn_complete_evt(hdev, skb);
5067                 break;
5068
5069         case HCI_EV_AUTH_COMPLETE:
5070                 hci_auth_complete_evt(hdev, skb);
5071                 break;
5072
5073         case HCI_EV_REMOTE_NAME:
5074                 hci_remote_name_evt(hdev, skb);
5075                 break;
5076
5077         case HCI_EV_ENCRYPT_CHANGE:
5078                 hci_encrypt_change_evt(hdev, skb);
5079                 break;
5080
5081         case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
5082                 hci_change_link_key_complete_evt(hdev, skb);
5083                 break;
5084
5085         case HCI_EV_REMOTE_FEATURES:
5086                 hci_remote_features_evt(hdev, skb);
5087                 break;
5088
5089         case HCI_EV_CMD_COMPLETE:
5090                 hci_cmd_complete_evt(hdev, skb);
5091                 break;
5092
5093         case HCI_EV_CMD_STATUS:
5094                 hci_cmd_status_evt(hdev, skb);
5095                 break;
5096
5097         case HCI_EV_HARDWARE_ERROR:
5098                 hci_hardware_error_evt(hdev, skb);
5099                 break;
5100
5101         case HCI_EV_ROLE_CHANGE:
5102                 hci_role_change_evt(hdev, skb);
5103                 break;
5104
5105         case HCI_EV_NUM_COMP_PKTS:
5106                 hci_num_comp_pkts_evt(hdev, skb);
5107                 break;
5108
5109         case HCI_EV_MODE_CHANGE:
5110                 hci_mode_change_evt(hdev, skb);
5111                 break;
5112
5113         case HCI_EV_PIN_CODE_REQ:
5114                 hci_pin_code_request_evt(hdev, skb);
5115                 break;
5116
5117         case HCI_EV_LINK_KEY_REQ:
5118                 hci_link_key_request_evt(hdev, skb);
5119                 break;
5120
5121         case HCI_EV_LINK_KEY_NOTIFY:
5122                 hci_link_key_notify_evt(hdev, skb);
5123                 break;
5124
5125         case HCI_EV_CLOCK_OFFSET:
5126                 hci_clock_offset_evt(hdev, skb);
5127                 break;
5128
5129         case HCI_EV_PKT_TYPE_CHANGE:
5130                 hci_pkt_type_change_evt(hdev, skb);
5131                 break;
5132
5133         case HCI_EV_PSCAN_REP_MODE:
5134                 hci_pscan_rep_mode_evt(hdev, skb);
5135                 break;
5136
5137         case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
5138                 hci_inquiry_result_with_rssi_evt(hdev, skb);
5139                 break;
5140
5141         case HCI_EV_REMOTE_EXT_FEATURES:
5142                 hci_remote_ext_features_evt(hdev, skb);
5143                 break;
5144
5145         case HCI_EV_SYNC_CONN_COMPLETE:
5146                 hci_sync_conn_complete_evt(hdev, skb);
5147                 break;
5148
5149         case HCI_EV_EXTENDED_INQUIRY_RESULT:
5150                 hci_extended_inquiry_result_evt(hdev, skb);
5151                 break;
5152
5153         case HCI_EV_KEY_REFRESH_COMPLETE:
5154                 hci_key_refresh_complete_evt(hdev, skb);
5155                 break;
5156
5157         case HCI_EV_IO_CAPA_REQUEST:
5158                 hci_io_capa_request_evt(hdev, skb);
5159                 break;
5160
5161         case HCI_EV_IO_CAPA_REPLY:
5162                 hci_io_capa_reply_evt(hdev, skb);
5163                 break;
5164
5165         case HCI_EV_USER_CONFIRM_REQUEST:
5166                 hci_user_confirm_request_evt(hdev, skb);
5167                 break;
5168
5169         case HCI_EV_USER_PASSKEY_REQUEST:
5170                 hci_user_passkey_request_evt(hdev, skb);
5171                 break;
5172
5173         case HCI_EV_USER_PASSKEY_NOTIFY:
5174                 hci_user_passkey_notify_evt(hdev, skb);
5175                 break;
5176
5177         case HCI_EV_KEYPRESS_NOTIFY:
5178                 hci_keypress_notify_evt(hdev, skb);
5179                 break;
5180
5181         case HCI_EV_SIMPLE_PAIR_COMPLETE:
5182                 hci_simple_pair_complete_evt(hdev, skb);
5183                 break;
5184
5185         case HCI_EV_REMOTE_HOST_FEATURES:
5186                 hci_remote_host_features_evt(hdev, skb);
5187                 break;
5188
5189         case HCI_EV_LE_META:
5190                 hci_le_meta_evt(hdev, skb);
5191                 break;
5192
5193         case HCI_EV_CHANNEL_SELECTED:
5194                 hci_chan_selected_evt(hdev, skb);
5195                 break;
5196
5197         case HCI_EV_REMOTE_OOB_DATA_REQUEST:
5198                 hci_remote_oob_data_request_evt(hdev, skb);
5199                 break;
5200
5201         case HCI_EV_PHY_LINK_COMPLETE:
5202                 hci_phy_link_complete_evt(hdev, skb);
5203                 break;
5204
5205         case HCI_EV_LOGICAL_LINK_COMPLETE:
5206                 hci_loglink_complete_evt(hdev, skb);
5207                 break;
5208
5209         case HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE:
5210                 hci_disconn_loglink_complete_evt(hdev, skb);
5211                 break;
5212
5213         case HCI_EV_DISCONN_PHY_LINK_COMPLETE:
5214                 hci_disconn_phylink_complete_evt(hdev, skb);
5215                 break;
5216
5217         case HCI_EV_NUM_COMP_BLOCKS:
5218                 hci_num_comp_blocks_evt(hdev, skb);
5219                 break;
5220
5221         default:
5222                 BT_DBG("%s event 0x%2.2x", hdev->name, event);
5223                 break;
5224         }
5225
5226         kfree_skb(skb);
5227         hdev->stat.evt_rx++;
5228 }