net/bluetooth/hci_event.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI event handling. */
  26
  27 #include <asm/unaligned.h>
  28
  29 #include <net/bluetooth/bluetooth.h>
  30 #include <net/bluetooth/hci_core.h>
  31 #include <net/bluetooth/mgmt.h>
  32 #include <net/bluetooth/a2mp.h>
  33 #include <net/bluetooth/amp.h>
  34
  35 /* Handle HCI Event packets */
  36
  37 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
  38 {
  39         __u8 status = *((__u8 *) skb->data);
  40
  41         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  42
  43         if (status) {
  44                 hci_dev_lock(hdev);
  45                 mgmt_stop_discovery_failed(hdev, status);
  46                 hci_dev_unlock(hdev);
  47                 return;
  48         }
  49
  50         clear_bit(HCI_INQUIRY, &hdev->flags);
  51
  52         hci_dev_lock(hdev);
  53         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
  54         hci_dev_unlock(hdev);
  55
  56         hci_req_cmd_complete(hdev, HCI_OP_INQUIRY, status);
  57
  58         hci_conn_check_pending(hdev);
  59 }
  60
  61 static void hci_cc_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  62 {
  63         __u8 status = *((__u8 *) skb->data);
  64
  65         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  66
  67         if (status)
  68                 return;
  69
  70         set_bit(HCI_PERIODIC_INQ, &hdev->dev_flags);
  71 }
  72
  73 static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  74 {
  75         __u8 status = *((__u8 *) skb->data);
  76
  77         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  78
  79         if (status)
  80                 return;
  81
  82         clear_bit(HCI_PERIODIC_INQ, &hdev->dev_flags);
  83
  84         hci_conn_check_pending(hdev);
  85 }
  86
  87 static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev,
  88                                           struct sk_buff *skb)
  89 {
  90         BT_DBG("%s", hdev->name);
  91 }
  92
  93 static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
  94 {
  95         struct hci_rp_role_discovery *rp = (void *) skb->data;
  96         struct hci_conn *conn;
  97
  98         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
  99
 100         if (rp->status)
 101                 return;
 102
 103         hci_dev_lock(hdev);
 104
 105         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 106         if (conn) {
 107                 if (rp->role)
 108                         conn->link_mode &= ~HCI_LM_MASTER;
 109                 else
 110                         conn->link_mode |= HCI_LM_MASTER;
 111         }
 112
 113         hci_dev_unlock(hdev);
 114 }
 115
 116 static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 117 {
 118         struct hci_rp_read_link_policy *rp = (void *) skb->data;
 119         struct hci_conn *conn;
 120
 121         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 122
 123         if (rp->status)
 124                 return;
 125
 126         hci_dev_lock(hdev);
 127
 128         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 129         if (conn)
 130                 conn->link_policy = __le16_to_cpu(rp->policy);
 131
 132         hci_dev_unlock(hdev);
 133 }
 134
 135 static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 136 {
 137         struct hci_rp_write_link_policy *rp = (void *) skb->data;
 138         struct hci_conn *conn;
 139         void *sent;
 140
 141         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 142
 143         if (rp->status)
 144                 return;
 145
 146         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
 147         if (!sent)
 148                 return;
 149
 150         hci_dev_lock(hdev);
 151
 152         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 153         if (conn)
 154                 conn->link_policy = get_unaligned_le16(sent + 2);
 155
 156         hci_dev_unlock(hdev);
 157 }
 158
 159 static void hci_cc_read_def_link_policy(struct hci_dev *hdev,
 160                                         struct sk_buff *skb)
 161 {
 162         struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
 163
 164         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 165
 166         if (rp->status)
 167                 return;
 168
 169         hdev->link_policy = __le16_to_cpu(rp->policy);
 170 }
 171
 172 static void hci_cc_write_def_link_policy(struct hci_dev *hdev,
 173                                          struct sk_buff *skb)
 174 {
 175         __u8 status = *((__u8 *) skb->data);
 176         void *sent;
 177
 178         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 179
 180         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
 181         if (!sent)
 182                 return;
 183
 184         if (!status)
 185                 hdev->link_policy = get_unaligned_le16(sent);
 186 }
 187
 188 static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
 189 {
 190         __u8 status = *((__u8 *) skb->data);
 191
 192         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 193
 194         clear_bit(HCI_RESET, &hdev->flags);
 195
 196         /* Reset all non-persistent flags */
 197         hdev->dev_flags &= ~(BIT(HCI_LE_SCAN) | BIT(HCI_PENDING_CLASS) |
 198                              BIT(HCI_PERIODIC_INQ));
 199
 200         hdev->discovery.state = DISCOVERY_STOPPED;
 201         hdev->inq_tx_power = HCI_TX_POWER_INVALID;
 202         hdev->adv_tx_power = HCI_TX_POWER_INVALID;
 203
 204         memset(hdev->adv_data, 0, sizeof(hdev->adv_data));
 205         hdev->adv_data_len = 0;
 206 }
 207
 208 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 209 {
 210         __u8 status = *((__u8 *) skb->data);
 211         void *sent;
 212
 213         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 214
 215         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
 216         if (!sent)
 217                 return;
 218
 219         hci_dev_lock(hdev);
 220
 221         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 222                 mgmt_set_local_name_complete(hdev, sent, status);
 223         else if (!status)
 224                 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
 225
 226         hci_dev_unlock(hdev);
 227
 228         if (!status && !test_bit(HCI_INIT, &hdev->flags))
 229                 hci_update_ad(hdev);
 230 }
 231
 232 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 233 {
 234         struct hci_rp_read_local_name *rp = (void *) skb->data;
 235
 236         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 237
 238         if (rp->status)
 239                 return;
 240
 241         if (test_bit(HCI_SETUP, &hdev->dev_flags))
 242                 memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
 243 }
 244
 245 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
 246 {
 247         __u8 status = *((__u8 *) skb->data);
 248         void *sent;
 249
 250         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 251
 252         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
 253         if (!sent)
 254                 return;
 255
 256         if (!status) {
 257                 __u8 param = *((__u8 *) sent);
 258
 259                 if (param == AUTH_ENABLED)
 260                         set_bit(HCI_AUTH, &hdev->flags);
 261                 else
 262                         clear_bit(HCI_AUTH, &hdev->flags);
 263         }
 264
 265         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 266                 mgmt_auth_enable_complete(hdev, status);
 267 }
 268
 269 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
 270 {
 271         __u8 status = *((__u8 *) skb->data);
 272         void *sent;
 273
 274         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 275
 276         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
 277         if (!sent)
 278                 return;
 279
 280         if (!status) {
 281                 __u8 param = *((__u8 *) sent);
 282
 283                 if (param)
 284                         set_bit(HCI_ENCRYPT, &hdev->flags);
 285                 else
 286                         clear_bit(HCI_ENCRYPT, &hdev->flags);
 287         }
 288 }
 289
 290 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
 291 {
 292         __u8 param, status = *((__u8 *) skb->data);
 293         int old_pscan, old_iscan;
 294         void *sent;
 295
 296         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 297
 298         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
 299         if (!sent)
 300                 return;
 301
 302         param = *((__u8 *) sent);
 303
 304         hci_dev_lock(hdev);
 305
 306         if (status) {
 307                 mgmt_write_scan_failed(hdev, param, status);
 308                 hdev->discov_timeout = 0;
 309                 goto done;
 310         }
 311
 312         old_pscan = test_and_clear_bit(HCI_PSCAN, &hdev->flags);
 313         old_iscan = test_and_clear_bit(HCI_ISCAN, &hdev->flags);
 314
 315         if (param & SCAN_INQUIRY) {
 316                 set_bit(HCI_ISCAN, &hdev->flags);
 317                 if (!old_iscan)
 318                         mgmt_discoverable(hdev, 1);
 319                 if (hdev->discov_timeout > 0) {
 320                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
 321                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
 322                                            to);
 323                 }
 324         } else if (old_iscan)
 325                 mgmt_discoverable(hdev, 0);
 326
 327         if (param & SCAN_PAGE) {
 328                 set_bit(HCI_PSCAN, &hdev->flags);
 329                 if (!old_pscan)
 330                         mgmt_connectable(hdev, 1);
 331         } else if (old_pscan)
 332                 mgmt_connectable(hdev, 0);
 333
 334 done:
 335         hci_dev_unlock(hdev);
 336 }
 337
 338 static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 339 {
 340         struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
 341
 342         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 343
 344         if (rp->status)
 345                 return;
 346
 347         memcpy(hdev->dev_class, rp->dev_class, 3);
 348
 349         BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
 350                hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
 351 }
 352
 353 static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 354 {
 355         __u8 status = *((__u8 *) skb->data);
 356         void *sent;
 357
 358         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 359
 360         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
 361         if (!sent)
 362                 return;
 363
 364         hci_dev_lock(hdev);
 365
 366         if (status == 0)
 367                 memcpy(hdev->dev_class, sent, 3);
 368
 369         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 370                 mgmt_set_class_of_dev_complete(hdev, sent, status);
 371
 372         hci_dev_unlock(hdev);
 373 }
 374
 375 static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 376 {
 377         struct hci_rp_read_voice_setting *rp = (void *) skb->data;
 378         __u16 setting;
 379
 380         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 381
 382         if (rp->status)
 383                 return;
 384
 385         setting = __le16_to_cpu(rp->voice_setting);
 386
 387         if (hdev->voice_setting == setting)
 388                 return;
 389
 390         hdev->voice_setting = setting;
 391
 392         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 393
 394         if (hdev->notify)
 395                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 396 }
 397
 398 static void hci_cc_write_voice_setting(struct hci_dev *hdev,
 399                                        struct sk_buff *skb)
 400 {
 401         __u8 status = *((__u8 *) skb->data);
 402         __u16 setting;
 403         void *sent;
 404
 405         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 406
 407         if (status)
 408                 return;
 409
 410         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
 411         if (!sent)
 412                 return;
 413
 414         setting = get_unaligned_le16(sent);
 415
 416         if (hdev->voice_setting == setting)
 417                 return;
 418
 419         hdev->voice_setting = setting;
 420
 421         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 422
 423         if (hdev->notify)
 424                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 425 }
 426
 427 static void hci_cc_host_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 428 {
 429         __u8 status = *((__u8 *) skb->data);
 430
 431         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 432 }
 433
 434 static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 435 {
 436         __u8 status = *((__u8 *) skb->data);
 437         struct hci_cp_write_ssp_mode *sent;
 438
 439         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 440
 441         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
 442         if (!sent)
 443                 return;
 444
 445         if (!status) {
 446                 if (sent->mode)
 447                         hdev->host_features[0] |= LMP_HOST_SSP;
 448                 else
 449                         hdev->host_features[0] &= ~LMP_HOST_SSP;
 450         }
 451
 452         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 453                 mgmt_ssp_enable_complete(hdev, sent->mode, status);
 454         else if (!status) {
 455                 if (sent->mode)
 456                         set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
 457                 else
 458                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
 459         }
 460 }
 461
 462 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
 463 {
 464         struct hci_rp_read_local_version *rp = (void *) skb->data;
 465
 466         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 467
 468         if (rp->status)
 469                 return;
 470
 471         hdev->hci_ver = rp->hci_ver;
 472         hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
 473         hdev->lmp_ver = rp->lmp_ver;
 474         hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
 475         hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
 476
 477         BT_DBG("%s manufacturer 0x%4.4x hci ver %d:%d", hdev->name,
 478                hdev->manufacturer, hdev->hci_ver, hdev->hci_rev);
 479 }
 480
 481 static void hci_cc_read_local_commands(struct hci_dev *hdev,
 482                                        struct sk_buff *skb)
 483 {
 484         struct hci_rp_read_local_commands *rp = (void *) skb->data;
 485
 486         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 487
 488         if (!rp->status)
 489                 memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 490 }
 491
 492 static void hci_cc_read_local_features(struct hci_dev *hdev,
 493                                        struct sk_buff *skb)
 494 {
 495         struct hci_rp_read_local_features *rp = (void *) skb->data;
 496
 497         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 498
 499         if (rp->status)
 500                 return;
 501
 502         memcpy(hdev->features, rp->features, 8);
 503
 504         /* Adjust default settings according to features
 505          * supported by device. */
 506
 507         if (hdev->features[0] & LMP_3SLOT)
 508                 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 509
 510         if (hdev->features[0] & LMP_5SLOT)
 511                 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 512
 513         if (hdev->features[1] & LMP_HV2) {
 514                 hdev->pkt_type  |= (HCI_HV2);
 515                 hdev->esco_type |= (ESCO_HV2);
 516         }
 517
 518         if (hdev->features[1] & LMP_HV3) {
 519                 hdev->pkt_type  |= (HCI_HV3);
 520                 hdev->esco_type |= (ESCO_HV3);
 521         }
 522
 523         if (lmp_esco_capable(hdev))
 524                 hdev->esco_type |= (ESCO_EV3);
 525
 526         if (hdev->features[4] & LMP_EV4)
 527                 hdev->esco_type |= (ESCO_EV4);
 528
 529         if (hdev->features[4] & LMP_EV5)
 530                 hdev->esco_type |= (ESCO_EV5);
 531
 532         if (hdev->features[5] & LMP_EDR_ESCO_2M)
 533                 hdev->esco_type |= (ESCO_2EV3);
 534
 535         if (hdev->features[5] & LMP_EDR_ESCO_3M)
 536                 hdev->esco_type |= (ESCO_3EV3);
 537
 538         if (hdev->features[5] & LMP_EDR_3S_ESCO)
 539                 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
 540
 541         BT_DBG("%s features 0x%.2x%.2x%.2x%.2x%.2x%.2x%.2x%.2x", hdev->name,
 542                hdev->features[0], hdev->features[1],
 543                hdev->features[2], hdev->features[3],
 544                hdev->features[4], hdev->features[5],
 545                hdev->features[6], hdev->features[7]);
 546 }
 547
 548 static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
 549                                            struct sk_buff *skb)
 550 {
 551         struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
 552
 553         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 554
 555         if (rp->status)
 556                 return;
 557
 558         switch (rp->page) {
 559         case 0:
 560                 memcpy(hdev->features, rp->features, 8);
 561                 break;
 562         case 1:
 563                 memcpy(hdev->host_features, rp->features, 8);
 564                 break;
 565         }
 566 }
 567
 568 static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
 569                                           struct sk_buff *skb)
 570 {
 571         struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;
 572
 573         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 574
 575         if (!rp->status)
 576                 hdev->flow_ctl_mode = rp->mode;
 577 }
 578
 579 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 580 {
 581         struct hci_rp_read_buffer_size *rp = (void *) skb->data;
 582
 583         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 584
 585         if (rp->status)
 586                 return;
 587
 588         hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
 589         hdev->sco_mtu  = rp->sco_mtu;
 590         hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
 591         hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
 592
 593         if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
 594                 hdev->sco_mtu  = 64;
 595                 hdev->sco_pkts = 8;
 596         }
 597
 598         hdev->acl_cnt = hdev->acl_pkts;
 599         hdev->sco_cnt = hdev->sco_pkts;
 600
 601         BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
 602                hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
 603 }
 604
 605 static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
 606 {
 607         struct hci_rp_read_bd_addr *rp = (void *) skb->data;
 608
 609         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 610
 611         if (!rp->status)
 612                 bacpy(&hdev->bdaddr, &rp->bdaddr);
 613 }
 614
 615 static void hci_cc_read_data_block_size(struct hci_dev *hdev,
 616                                         struct sk_buff *skb)
 617 {
 618         struct hci_rp_read_data_block_size *rp = (void *) skb->data;
 619
 620         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 621
 622         if (rp->status)
 623                 return;
 624
 625         hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
 626         hdev->block_len = __le16_to_cpu(rp->block_len);
 627         hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
 628
 629         hdev->block_cnt = hdev->num_blocks;
 630
 631         BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
 632                hdev->block_cnt, hdev->block_len);
 633 }
 634
 635 static void hci_cc_write_ca_timeout(struct hci_dev *hdev, struct sk_buff *skb)
 636 {
 637         __u8 status = *((__u8 *) skb->data);
 638
 639         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 640 }
 641
 642 static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
 643                                        struct sk_buff *skb)
 644 {
 645         struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
 646
 647         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 648
 649         if (rp->status)
 650                 goto a2mp_rsp;
 651
 652         hdev->amp_status = rp->amp_status;
 653         hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
 654         hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
 655         hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
 656         hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
 657         hdev->amp_type = rp->amp_type;
 658         hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
 659         hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
 660         hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
 661         hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
 662
 663 a2mp_rsp:
 664         a2mp_send_getinfo_rsp(hdev);
 665 }
 666
 667 static void hci_cc_read_local_amp_assoc(struct hci_dev *hdev,
 668                                         struct sk_buff *skb)
 669 {
 670         struct hci_rp_read_local_amp_assoc *rp = (void *) skb->data;
 671         struct amp_assoc *assoc = &hdev->loc_assoc;
 672         size_t rem_len, frag_len;
 673
 674         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 675
 676         if (rp->status)
 677                 goto a2mp_rsp;
 678
 679         frag_len = skb->len - sizeof(*rp);
 680         rem_len = __le16_to_cpu(rp->rem_len);
 681
 682         if (rem_len > frag_len) {
 683                 BT_DBG("frag_len %zu rem_len %zu", frag_len, rem_len);
 684
 685                 memcpy(assoc->data + assoc->offset, rp->frag, frag_len);
 686                 assoc->offset += frag_len;
 687
 688                 /* Read other fragments */
 689                 amp_read_loc_assoc_frag(hdev, rp->phy_handle);
 690
 691                 return;
 692         }
 693
 694         memcpy(assoc->data + assoc->offset, rp->frag, rem_len);
 695         assoc->len = assoc->offset + rem_len;
 696         assoc->offset = 0;
 697
 698 a2mp_rsp:
 699         /* Send A2MP Rsp when all fragments are received */
 700         a2mp_send_getampassoc_rsp(hdev, rp->status);
 701         a2mp_send_create_phy_link_req(hdev, rp->status);
 702 }
 703
 704 static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
 705                                           struct sk_buff *skb)
 706 {
 707         __u8 status = *((__u8 *) skb->data);
 708
 709         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 710 }
 711
 712 static void hci_cc_set_event_mask(struct hci_dev *hdev, struct sk_buff *skb)
 713 {
 714         __u8 status = *((__u8 *) skb->data);
 715
 716         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 717 }
 718
 719 static void hci_cc_write_inquiry_mode(struct hci_dev *hdev,
 720                                       struct sk_buff *skb)
 721 {
 722         __u8 status = *((__u8 *) skb->data);
 723
 724         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 725 }
 726
 727 static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
 728                                          struct sk_buff *skb)
 729 {
 730         struct hci_rp_read_inq_rsp_tx_power *rp = (void *) skb->data;
 731
 732         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 733
 734         if (!rp->status)
 735                 hdev->inq_tx_power = rp->tx_power;
 736 }
 737
 738 static void hci_cc_set_event_flt(struct hci_dev *hdev, struct sk_buff *skb)
 739 {
 740         __u8 status = *((__u8 *) skb->data);
 741
 742         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 743 }
 744
 745 static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
 746 {
 747         struct hci_rp_pin_code_reply *rp = (void *) skb->data;
 748         struct hci_cp_pin_code_reply *cp;
 749         struct hci_conn *conn;
 750
 751         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 752
 753         hci_dev_lock(hdev);
 754
 755         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 756                 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
 757
 758         if (rp->status)
 759                 goto unlock;
 760
 761         cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
 762         if (!cp)
 763                 goto unlock;
 764
 765         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 766         if (conn)
 767                 conn->pin_length = cp->pin_len;
 768
 769 unlock:
 770         hci_dev_unlock(hdev);
 771 }
 772
 773 static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
 774 {
 775         struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
 776
 777         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 778
 779         hci_dev_lock(hdev);
 780
 781         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 782                 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
 783                                                  rp->status);
 784
 785         hci_dev_unlock(hdev);
 786 }
 787
 788 static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
 789                                        struct sk_buff *skb)
 790 {
 791         struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
 792
 793         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 794
 795         if (rp->status)
 796                 return;
 797
 798         hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
 799         hdev->le_pkts = rp->le_max_pkt;
 800
 801         hdev->le_cnt = hdev->le_pkts;
 802
 803         BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
 804 }
 805
 806 static void hci_cc_le_read_local_features(struct hci_dev *hdev,
 807                                           struct sk_buff *skb)
 808 {
 809         struct hci_rp_le_read_local_features *rp = (void *) skb->data;
 810
 811         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 812
 813         if (!rp->status)
 814                 memcpy(hdev->le_features, rp->features, 8);
 815 }
 816
 817 static void hci_cc_le_read_adv_tx_power(struct hci_dev *hdev,
 818                                         struct sk_buff *skb)
 819 {
 820         struct hci_rp_le_read_adv_tx_power *rp = (void *) skb->data;
 821
 822         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 823
 824         if (!rp->status) {
 825                 hdev->adv_tx_power = rp->tx_power;
 826                 if (!test_bit(HCI_INIT, &hdev->flags))
 827                         hci_update_ad(hdev);
 828         }
 829 }
 830
 831 static void hci_cc_le_set_event_mask(struct hci_dev *hdev, struct sk_buff *skb)
 832 {
 833         __u8 status = *((__u8 *) skb->data);
 834
 835         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 836 }
 837
 838 static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
 839 {
 840         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 841
 842         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 843
 844         hci_dev_lock(hdev);
 845
 846         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 847                 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,
 848                                                  rp->status);
 849
 850         hci_dev_unlock(hdev);
 851 }
 852
 853 static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
 854                                           struct sk_buff *skb)
 855 {
 856         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 857
 858         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 859
 860         hci_dev_lock(hdev);
 861
 862         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 863                 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
 864                                                      ACL_LINK, 0, rp->status);
 865
 866         hci_dev_unlock(hdev);
 867 }
 868
 869 static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
 870 {
 871         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 872
 873         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 874
 875         hci_dev_lock(hdev);
 876
 877         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 878                 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
 879                                                  0, rp->status);
 880
 881         hci_dev_unlock(hdev);
 882 }
 883
 884 static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
 885                                           struct sk_buff *skb)
 886 {
 887         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 888
 889         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 890
 891         hci_dev_lock(hdev);
 892
 893         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 894                 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
 895                                                      ACL_LINK, 0, rp->status);
 896
 897         hci_dev_unlock(hdev);
 898 }
 899
 900 static void hci_cc_read_local_oob_data_reply(struct hci_dev *hdev,
 901                                              struct sk_buff *skb)
 902 {
 903         struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
 904
 905         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 906
 907         hci_dev_lock(hdev);
 908         mgmt_read_local_oob_data_reply_complete(hdev, rp->hash,
 909                                                 rp->randomizer, rp->status);
 910         hci_dev_unlock(hdev);
 911 }
 912
 913 static void hci_cc_le_set_adv_enable(struct hci_dev *hdev, struct sk_buff *skb)
 914 {
 915         __u8 *sent, status = *((__u8 *) skb->data);
 916
 917         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 918
 919         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_ENABLE);
 920         if (!sent)
 921                 return;
 922
 923         hci_dev_lock(hdev);
 924
 925         if (!status) {
 926                 if (*sent)
 927                         set_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags);
 928                 else
 929                         clear_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags);
 930         }
 931
 932         hci_dev_unlock(hdev);
 933
 934         if (!test_bit(HCI_INIT, &hdev->flags))
 935                 hci_update_ad(hdev);
 936 }
 937
 938 static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
 939 {
 940         __u8 status = *((__u8 *) skb->data);
 941
 942         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 943
 944         if (status) {
 945                 hci_dev_lock(hdev);
 946                 mgmt_start_discovery_failed(hdev, status);
 947                 hci_dev_unlock(hdev);
 948                 return;
 949         }
 950 }
 951
 952 static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
 953                                       struct sk_buff *skb)
 954 {
 955         struct hci_cp_le_set_scan_enable *cp;
 956         __u8 status = *((__u8 *) skb->data);
 957
 958         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 959
 960         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
 961         if (!cp)
 962                 return;
 963
 964         switch (cp->enable) {
 965         case LE_SCANNING_ENABLED:
 966                 if (status) {
 967                         hci_dev_lock(hdev);
 968                         mgmt_start_discovery_failed(hdev, status);
 969                         hci_dev_unlock(hdev);
 970                         return;
 971                 }
 972
 973                 set_bit(HCI_LE_SCAN, &hdev->dev_flags);
 974
 975                 hci_dev_lock(hdev);
 976                 hci_discovery_set_state(hdev, DISCOVERY_FINDING);
 977                 hci_dev_unlock(hdev);
 978                 break;
 979
 980         case LE_SCANNING_DISABLED:
 981                 if (status) {
 982                         hci_dev_lock(hdev);
 983                         mgmt_stop_discovery_failed(hdev, status);
 984                         hci_dev_unlock(hdev);
 985                         return;
 986                 }
 987
 988                 clear_bit(HCI_LE_SCAN, &hdev->dev_flags);
 989
 990                 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
 991                     hdev->discovery.state == DISCOVERY_FINDING) {
 992                         mgmt_interleaved_discovery(hdev);
 993                 } else {
 994                         hci_dev_lock(hdev);
 995                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
 996                         hci_dev_unlock(hdev);
 997                 }
 998
 999                 break;
1000
1001         default:
1002                 BT_ERR("Used reserved LE_Scan_Enable param %d", cp->enable);
1003                 break;
1004         }
1005 }
1006
1007 static void hci_cc_le_read_white_list_size(struct hci_dev *hdev,
1008                                            struct sk_buff *skb)
1009 {
1010         struct hci_rp_le_read_white_list_size *rp = (void *) skb->data;
1011
1012         BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
1013
1014         if (!rp->status)
1015                 hdev->le_white_list_size = rp->size;
1016 }
1017
1018 static void hci_cc_le_ltk_reply(struct hci_dev *hdev, struct sk_buff *skb)
1019 {
1020         struct hci_rp_le_ltk_reply *rp = (void *) skb->data;
1021
1022         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1023
1024         if (rp->status)
1025                 return;
1026 }
1027
1028 static void hci_cc_le_ltk_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
1029 {
1030         struct hci_rp_le_ltk_neg_reply *rp = (void *) skb->data;
1031
1032         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1033
1034         if (rp->status)
1035                 return;
1036 }
1037
1038 static void hci_cc_le_read_supported_states(struct hci_dev *hdev,
1039                                             struct sk_buff *skb)
1040 {
1041         struct hci_rp_le_read_supported_states *rp = (void *) skb->data;
1042
1043         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1044
1045         if (!rp->status)
1046                 memcpy(hdev->le_states, rp->le_states, 8);
1047 }
1048
1049 static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
1050                                            struct sk_buff *skb)
1051 {
1052         struct hci_cp_write_le_host_supported *sent;
1053         __u8 status = *((__u8 *) skb->data);
1054
1055         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1056
1057         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
1058         if (!sent)
1059                 return;
1060
1061         if (!status) {
1062                 if (sent->le)
1063                         hdev->host_features[0] |= LMP_HOST_LE;
1064                 else
1065                         hdev->host_features[0] &= ~LMP_HOST_LE;
1066
1067                 if (sent->simul)
1068                         hdev->host_features[0] |= LMP_HOST_LE_BREDR;
1069                 else
1070                         hdev->host_features[0] &= ~LMP_HOST_LE_BREDR;
1071         }
1072
1073         if (test_bit(HCI_MGMT, &hdev->dev_flags) &&
1074             !test_bit(HCI_INIT, &hdev->flags))
1075                 mgmt_le_enable_complete(hdev, sent->le, status);
1076 }
1077
1078 static void hci_cc_write_remote_amp_assoc(struct hci_dev *hdev,
1079                                           struct sk_buff *skb)
1080 {
1081         struct hci_rp_write_remote_amp_assoc *rp = (void *) skb->data;
1082
1083         BT_DBG("%s status 0x%2.2x phy_handle 0x%2.2x",
1084                hdev->name, rp->status, rp->phy_handle);
1085
1086         if (rp->status)
1087                 return;
1088
1089         amp_write_rem_assoc_continue(hdev, rp->phy_handle);
1090 }
1091
1092 static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
1093 {
1094         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1095
1096         if (status) {
1097                 hci_conn_check_pending(hdev);
1098                 hci_dev_lock(hdev);
1099                 if (test_bit(HCI_MGMT, &hdev->dev_flags))
1100                         mgmt_start_discovery_failed(hdev, status);
1101                 hci_dev_unlock(hdev);
1102                 return;
1103         }
1104
1105         set_bit(HCI_INQUIRY, &hdev->flags);
1106
1107         hci_dev_lock(hdev);
1108         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
1109         hci_dev_unlock(hdev);
1110 }
1111
1112 static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
1113 {
1114         struct hci_cp_create_conn *cp;
1115         struct hci_conn *conn;
1116
1117         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1118
1119         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
1120         if (!cp)
1121                 return;
1122
1123         hci_dev_lock(hdev);
1124
1125         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1126
1127         BT_DBG("%s bdaddr %pMR hcon %p", hdev->name, &cp->bdaddr, conn);
1128
1129         if (status) {
1130                 if (conn && conn->state == BT_CONNECT) {
1131                         if (status != 0x0c || conn->attempt > 2) {
1132                                 conn->state = BT_CLOSED;
1133                                 hci_proto_connect_cfm(conn, status);
1134                                 hci_conn_del(conn);
1135                         } else
1136                                 conn->state = BT_CONNECT2;
1137                 }
1138         } else {
1139                 if (!conn) {
1140                         conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr);
1141                         if (conn) {
1142                                 conn->out = true;
1143                                 conn->link_mode |= HCI_LM_MASTER;
1144                         } else
1145                                 BT_ERR("No memory for new connection");
1146                 }
1147         }
1148
1149         hci_dev_unlock(hdev);
1150 }
1151
1152 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
1153 {
1154         struct hci_cp_add_sco *cp;
1155         struct hci_conn *acl, *sco;
1156         __u16 handle;
1157
1158         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1159
1160         if (!status)
1161                 return;
1162
1163         cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
1164         if (!cp)
1165                 return;
1166
1167         handle = __le16_to_cpu(cp->handle);
1168
1169         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1170
1171         hci_dev_lock(hdev);
1172
1173         acl = hci_conn_hash_lookup_handle(hdev, handle);
1174         if (acl) {
1175                 sco = acl->link;
1176                 if (sco) {
1177                         sco->state = BT_CLOSED;
1178
1179                         hci_proto_connect_cfm(sco, status);
1180                         hci_conn_del(sco);
1181                 }
1182         }
1183
1184         hci_dev_unlock(hdev);
1185 }
1186
1187 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
1188 {
1189         struct hci_cp_auth_requested *cp;
1190         struct hci_conn *conn;
1191
1192         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1193
1194         if (!status)
1195                 return;
1196
1197         cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
1198         if (!cp)
1199                 return;
1200
1201         hci_dev_lock(hdev);
1202
1203         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1204         if (conn) {
1205                 if (conn->state == BT_CONFIG) {
1206                         hci_proto_connect_cfm(conn, status);
1207                         hci_conn_put(conn);
1208                 }
1209         }
1210
1211         hci_dev_unlock(hdev);
1212 }
1213
1214 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
1215 {
1216         struct hci_cp_set_conn_encrypt *cp;
1217         struct hci_conn *conn;
1218
1219         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1220
1221         if (!status)
1222                 return;
1223
1224         cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
1225         if (!cp)
1226                 return;
1227
1228         hci_dev_lock(hdev);
1229
1230         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1231         if (conn) {
1232                 if (conn->state == BT_CONFIG) {
1233                         hci_proto_connect_cfm(conn, status);
1234                         hci_conn_put(conn);
1235                 }
1236         }
1237
1238         hci_dev_unlock(hdev);
1239 }
1240
1241 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
1242                                     struct hci_conn *conn)
1243 {
1244         if (conn->state != BT_CONFIG || !conn->out)
1245                 return 0;
1246
1247         if (conn->pending_sec_level == BT_SECURITY_SDP)
1248                 return 0;
1249
1250         /* Only request authentication for SSP connections or non-SSP
1251          * devices with sec_level HIGH or if MITM protection is requested */
1252         if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
1253             conn->pending_sec_level != BT_SECURITY_HIGH)
1254                 return 0;
1255
1256         return 1;
1257 }
1258
1259 static int hci_resolve_name(struct hci_dev *hdev,
1260                                    struct inquiry_entry *e)
1261 {
1262         struct hci_cp_remote_name_req cp;
1263
1264         memset(&cp, 0, sizeof(cp));
1265
1266         bacpy(&cp.bdaddr, &e->data.bdaddr);
1267         cp.pscan_rep_mode = e->data.pscan_rep_mode;
1268         cp.pscan_mode = e->data.pscan_mode;
1269         cp.clock_offset = e->data.clock_offset;
1270
1271         return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1272 }
1273
1274 static bool hci_resolve_next_name(struct hci_dev *hdev)
1275 {
1276         struct discovery_state *discov = &hdev->discovery;
1277         struct inquiry_entry *e;
1278
1279         if (list_empty(&discov->resolve))
1280                 return false;
1281
1282         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
1283         if (!e)
1284                 return false;
1285
1286         if (hci_resolve_name(hdev, e) == 0) {
1287                 e->name_state = NAME_PENDING;
1288                 return true;
1289         }
1290
1291         return false;
1292 }
1293
1294 static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
1295                                    bdaddr_t *bdaddr, u8 *name, u8 name_len)
1296 {
1297         struct discovery_state *discov = &hdev->discovery;
1298         struct inquiry_entry *e;
1299
1300         if (conn && !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
1301                 mgmt_device_connected(hdev, bdaddr, ACL_LINK, 0x00, 0, name,
1302                                       name_len, conn->dev_class);
1303
1304         if (discov->state == DISCOVERY_STOPPED)
1305                 return;
1306
1307         if (discov->state == DISCOVERY_STOPPING)
1308                 goto discov_complete;
1309
1310         if (discov->state != DISCOVERY_RESOLVING)
1311                 return;
1312
1313         e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
1314         /* If the device was not found in a list of found devices names of which
1315          * are pending. there is no need to continue resolving a next name as it
1316          * will be done upon receiving another Remote Name Request Complete
1317          * Event */
1318         if (!e)
1319                 return;
1320
1321         list_del(&e->list);
1322         if (name) {
1323                 e->name_state = NAME_KNOWN;
1324                 mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
1325                                  e->data.rssi, name, name_len);
1326         } else {
1327                 e->name_state = NAME_NOT_KNOWN;
1328         }
1329
1330         if (hci_resolve_next_name(hdev))
1331                 return;
1332
1333 discov_complete:
1334         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1335 }
1336
1337 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
1338 {
1339         struct hci_cp_remote_name_req *cp;
1340         struct hci_conn *conn;
1341
1342         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1343
1344         /* If successful wait for the name req complete event before
1345          * checking for the need to do authentication */
1346         if (!status)
1347                 return;
1348
1349         cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
1350         if (!cp)
1351                 return;
1352
1353         hci_dev_lock(hdev);
1354
1355         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1356
1357         if (test_bit(HCI_MGMT, &hdev->dev_flags))
1358                 hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
1359
1360         if (!conn)
1361                 goto unlock;
1362
1363         if (!hci_outgoing_auth_needed(hdev, conn))
1364                 goto unlock;
1365
1366         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
1367                 struct hci_cp_auth_requested cp;
1368                 cp.handle = __cpu_to_le16(conn->handle);
1369                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
1370         }
1371
1372 unlock:
1373         hci_dev_unlock(hdev);
1374 }
1375
1376 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
1377 {
1378         struct hci_cp_read_remote_features *cp;
1379         struct hci_conn *conn;
1380
1381         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1382
1383         if (!status)
1384                 return;
1385
1386         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
1387         if (!cp)
1388                 return;
1389
1390         hci_dev_lock(hdev);
1391
1392         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1393         if (conn) {
1394                 if (conn->state == BT_CONFIG) {
1395                         hci_proto_connect_cfm(conn, status);
1396                         hci_conn_put(conn);
1397                 }
1398         }
1399
1400         hci_dev_unlock(hdev);
1401 }
1402
1403 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
1404 {
1405         struct hci_cp_read_remote_ext_features *cp;
1406         struct hci_conn *conn;
1407
1408         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1409
1410         if (!status)
1411                 return;
1412
1413         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
1414         if (!cp)
1415                 return;
1416
1417         hci_dev_lock(hdev);
1418
1419         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1420         if (conn) {
1421                 if (conn->state == BT_CONFIG) {
1422                         hci_proto_connect_cfm(conn, status);
1423                         hci_conn_put(conn);
1424                 }
1425         }
1426
1427         hci_dev_unlock(hdev);
1428 }
1429
1430 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
1431 {
1432         struct hci_cp_setup_sync_conn *cp;
1433         struct hci_conn *acl, *sco;
1434         __u16 handle;
1435
1436         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1437
1438         if (!status)
1439                 return;
1440
1441         cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
1442         if (!cp)
1443                 return;
1444
1445         handle = __le16_to_cpu(cp->handle);
1446
1447         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1448
1449         hci_dev_lock(hdev);
1450
1451         acl = hci_conn_hash_lookup_handle(hdev, handle);
1452         if (acl) {
1453                 sco = acl->link;
1454                 if (sco) {
1455                         sco->state = BT_CLOSED;
1456
1457                         hci_proto_connect_cfm(sco, status);
1458                         hci_conn_del(sco);
1459                 }
1460         }
1461
1462         hci_dev_unlock(hdev);
1463 }
1464
1465 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
1466 {
1467         struct hci_cp_sniff_mode *cp;
1468         struct hci_conn *conn;
1469
1470         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1471
1472         if (!status)
1473                 return;
1474
1475         cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
1476         if (!cp)
1477                 return;
1478
1479         hci_dev_lock(hdev);
1480
1481         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1482         if (conn) {
1483                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1484
1485                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
1486                         hci_sco_setup(conn, status);
1487         }
1488
1489         hci_dev_unlock(hdev);
1490 }
1491
1492 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
1493 {
1494         struct hci_cp_exit_sniff_mode *cp;
1495         struct hci_conn *conn;
1496
1497         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1498
1499         if (!status)
1500                 return;
1501
1502         cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
1503         if (!cp)
1504                 return;
1505
1506         hci_dev_lock(hdev);
1507
1508         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1509         if (conn) {
1510                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1511
1512                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
1513                         hci_sco_setup(conn, status);
1514         }
1515
1516         hci_dev_unlock(hdev);
1517 }
1518
1519 static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
1520 {
1521         struct hci_cp_disconnect *cp;
1522         struct hci_conn *conn;
1523
1524         if (!status)
1525                 return;
1526
1527         cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
1528         if (!cp)
1529                 return;
1530
1531         hci_dev_lock(hdev);
1532
1533         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1534         if (conn)
1535                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
1536                                        conn->dst_type, status);
1537
1538         hci_dev_unlock(hdev);
1539 }
1540
1541 static void hci_cs_le_create_conn(struct hci_dev *hdev, __u8 status)
1542 {
1543         struct hci_conn *conn;
1544
1545         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1546
1547         if (status) {
1548                 hci_dev_lock(hdev);
1549
1550                 conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
1551                 if (!conn) {
1552                         hci_dev_unlock(hdev);
1553                         return;
1554                 }
1555
1556                 BT_DBG("%s bdaddr %pMR conn %p", hdev->name, &conn->dst, conn);
1557
1558                 conn->state = BT_CLOSED;
1559                 mgmt_connect_failed(hdev, &conn->dst, conn->type,
1560                                     conn->dst_type, status);
1561                 hci_proto_connect_cfm(conn, status);
1562                 hci_conn_del(conn);
1563
1564                 hci_dev_unlock(hdev);
1565         }
1566 }
1567
1568 static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
1569 {
1570         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1571 }
1572
1573 static void hci_cs_create_phylink(struct hci_dev *hdev, u8 status)
1574 {
1575         struct hci_cp_create_phy_link *cp;
1576
1577         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1578
1579         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_PHY_LINK);
1580         if (!cp)
1581                 return;
1582
1583         hci_dev_lock(hdev);
1584
1585         if (status) {
1586                 struct hci_conn *hcon;
1587
1588                 hcon = hci_conn_hash_lookup_handle(hdev, cp->phy_handle);
1589                 if (hcon)
1590                         hci_conn_del(hcon);
1591         } else {
1592                 amp_write_remote_assoc(hdev, cp->phy_handle);
1593         }
1594
1595         hci_dev_unlock(hdev);
1596 }
1597
1598 static void hci_cs_accept_phylink(struct hci_dev *hdev, u8 status)
1599 {
1600         struct hci_cp_accept_phy_link *cp;
1601
1602         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1603
1604         if (status)
1605                 return;
1606
1607         cp = hci_sent_cmd_data(hdev, HCI_OP_ACCEPT_PHY_LINK);
1608         if (!cp)
1609                 return;
1610
1611         amp_write_remote_assoc(hdev, cp->phy_handle);
1612 }
1613
1614 static void hci_cs_create_logical_link(struct hci_dev *hdev, u8 status)
1615 {
1616         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1617 }
1618
1619 static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1620 {
1621         __u8 status = *((__u8 *) skb->data);
1622         struct discovery_state *discov = &hdev->discovery;
1623         struct inquiry_entry *e;
1624
1625         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1626
1627         hci_req_cmd_complete(hdev, HCI_OP_INQUIRY, status);
1628
1629         hci_conn_check_pending(hdev);
1630
1631         if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
1632                 return;
1633
1634         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
1635                 return;
1636
1637         hci_dev_lock(hdev);
1638
1639         if (discov->state != DISCOVERY_FINDING)
1640                 goto unlock;
1641
1642         if (list_empty(&discov->resolve)) {
1643                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1644                 goto unlock;
1645         }
1646
1647         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
1648         if (e && hci_resolve_name(hdev, e) == 0) {
1649                 e->name_state = NAME_PENDING;
1650                 hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
1651         } else {
1652                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1653         }
1654
1655 unlock:
1656         hci_dev_unlock(hdev);
1657 }
1658
1659 static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
1660 {
1661         struct inquiry_data data;
1662         struct inquiry_info *info = (void *) (skb->data + 1);
1663         int num_rsp = *((__u8 *) skb->data);
1664
1665         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
1666
1667         if (!num_rsp)
1668                 return;
1669
1670         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
1671                 return;
1672
1673         hci_dev_lock(hdev);
1674
1675         for (; num_rsp; num_rsp--, info++) {
1676                 bool name_known, ssp;
1677
1678                 bacpy(&data.bdaddr, &info->bdaddr);
1679                 data.pscan_rep_mode     = info->pscan_rep_mode;
1680                 data.pscan_period_mode  = info->pscan_period_mode;
1681                 data.pscan_mode         = info->pscan_mode;
1682                 memcpy(data.dev_class, info->dev_class, 3);
1683                 data.clock_offset       = info->clock_offset;
1684                 data.rssi               = 0x00;
1685                 data.ssp_mode           = 0x00;
1686
1687                 name_known = hci_inquiry_cache_update(hdev, &data, false, &ssp);
1688                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
1689                                   info->dev_class, 0, !name_known, ssp, NULL,
1690                                   0);
1691         }
1692
1693         hci_dev_unlock(hdev);
1694 }
1695
1696 static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1697 {
1698         struct hci_ev_conn_complete *ev = (void *) skb->data;
1699         struct hci_conn *conn;
1700
1701         BT_DBG("%s", hdev->name);
1702
1703         hci_dev_lock(hdev);
1704
1705         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
1706         if (!conn) {
1707                 if (ev->link_type != SCO_LINK)
1708                         goto unlock;
1709
1710                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
1711                 if (!conn)
1712                         goto unlock;
1713
1714                 conn->type = SCO_LINK;
1715         }
1716
1717         if (!ev->status) {
1718                 conn->handle = __le16_to_cpu(ev->handle);
1719
1720                 if (conn->type == ACL_LINK) {
1721                         conn->state = BT_CONFIG;
1722                         hci_conn_hold(conn);
1723
1724                         if (!conn->out && !hci_conn_ssp_enabled(conn) &&
1725                             !hci_find_link_key(hdev, &ev->bdaddr))
1726                                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
1727                         else
1728                                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
1729                 } else
1730                         conn->state = BT_CONNECTED;
1731
1732                 hci_conn_hold_device(conn);
1733                 hci_conn_add_sysfs(conn);
1734
1735                 if (test_bit(HCI_AUTH, &hdev->flags))
1736                         conn->link_mode |= HCI_LM_AUTH;
1737
1738                 if (test_bit(HCI_ENCRYPT, &hdev->flags))
1739                         conn->link_mode |= HCI_LM_ENCRYPT;
1740
1741                 /* Get remote features */
1742                 if (conn->type == ACL_LINK) {
1743                         struct hci_cp_read_remote_features cp;
1744                         cp.handle = ev->handle;
1745                         hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
1746                                      sizeof(cp), &cp);
1747                 }
1748
1749                 /* Set packet type for incoming connection */
1750                 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
1751                         struct hci_cp_change_conn_ptype cp;
1752                         cp.handle = ev->handle;
1753                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
1754                         hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
1755                                      &cp);
1756                 }
1757         } else {
1758                 conn->state = BT_CLOSED;
1759                 if (conn->type == ACL_LINK)
1760                         mgmt_connect_failed(hdev, &ev->bdaddr, conn->type,
1761                                             conn->dst_type, ev->status);
1762         }
1763
1764         if (conn->type == ACL_LINK)
1765                 hci_sco_setup(conn, ev->status);
1766
1767         if (ev->status) {
1768                 hci_proto_connect_cfm(conn, ev->status);
1769                 hci_conn_del(conn);
1770         } else if (ev->link_type != ACL_LINK)
1771                 hci_proto_connect_cfm(conn, ev->status);
1772
1773 unlock:
1774         hci_dev_unlock(hdev);
1775
1776         hci_conn_check_pending(hdev);
1777 }
1778
1779 void hci_conn_accept(struct hci_conn *conn, int mask)
1780 {
1781         struct hci_dev *hdev = conn->hdev;
1782
1783         BT_DBG("conn %p", conn);
1784
1785         conn->state = BT_CONFIG;
1786
1787         if (!lmp_esco_capable(hdev)) {
1788                 struct hci_cp_accept_conn_req cp;
1789
1790                 bacpy(&cp.bdaddr, &conn->dst);
1791
1792                 if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
1793                         cp.role = 0x00; /* Become master */
1794                 else
1795                         cp.role = 0x01; /* Remain slave */
1796
1797                 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
1798         } else /* lmp_esco_capable(hdev)) */ {
1799                 struct hci_cp_accept_sync_conn_req cp;
1800
1801                 bacpy(&cp.bdaddr, &conn->dst);
1802                 cp.pkt_type = cpu_to_le16(conn->pkt_type);
1803
1804                 cp.tx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
1805                 cp.rx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
1806                 cp.max_latency    = __constant_cpu_to_le16(0xffff);
1807                 cp.content_format = cpu_to_le16(hdev->voice_setting);
1808                 cp.retrans_effort = 0xff;
1809
1810                 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ,
1811                              sizeof(cp), &cp);
1812         }
1813 }
1814
1815 static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
1816 {
1817         struct hci_ev_conn_request *ev = (void *) skb->data;
1818         int mask = hdev->link_mode;
1819         __u8 flags = 0;
1820
1821         BT_DBG("%s bdaddr %pMR type 0x%x", hdev->name, &ev->bdaddr,
1822                ev->link_type);
1823
1824         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
1825                                       &flags);
1826
1827         if ((mask & HCI_LM_ACCEPT) &&
1828             !hci_blacklist_lookup(hdev, &ev->bdaddr)) {
1829                 /* Connection accepted */
1830                 struct inquiry_entry *ie;
1831                 struct hci_conn *conn;
1832
1833                 hci_dev_lock(hdev);
1834
1835                 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
1836                 if (ie)
1837                         memcpy(ie->data.dev_class, ev->dev_class, 3);
1838
1839                 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
1840                                                &ev->bdaddr);
1841                 if (!conn) {
1842                         conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr);
1843                         if (!conn) {
1844                                 BT_ERR("No memory for new connection");
1845                                 hci_dev_unlock(hdev);
1846                                 return;
1847                         }
1848                 }
1849
1850                 memcpy(conn->dev_class, ev->dev_class, 3);
1851
1852                 hci_dev_unlock(hdev);
1853
1854                 if (ev->link_type == ACL_LINK ||
1855                     (!(flags & HCI_PROTO_DEFER) && !lmp_esco_capable(hdev))) {
1856                         struct hci_cp_accept_conn_req cp;
1857                         conn->state = BT_CONNECT;
1858
1859                         bacpy(&cp.bdaddr, &ev->bdaddr);
1860
1861                         if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
1862                                 cp.role = 0x00; /* Become master */
1863                         else
1864                                 cp.role = 0x01; /* Remain slave */
1865
1866                         hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp),
1867                                      &cp);
1868                 } else if (!(flags & HCI_PROTO_DEFER)) {
1869                         struct hci_cp_accept_sync_conn_req cp;
1870                         conn->state = BT_CONNECT;
1871
1872                         bacpy(&cp.bdaddr, &ev->bdaddr);
1873                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
1874
1875                         cp.tx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
1876                         cp.rx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
1877                         cp.max_latency    = __constant_cpu_to_le16(0xffff);
1878                         cp.content_format = cpu_to_le16(hdev->voice_setting);
1879                         cp.retrans_effort = 0xff;
1880
1881                         hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ,
1882                                      sizeof(cp), &cp);
1883                 } else {
1884                         conn->state = BT_CONNECT2;
1885                         hci_proto_connect_cfm(conn, 0);
1886                         hci_conn_put(conn);
1887                 }
1888         } else {
1889                 /* Connection rejected */
1890                 struct hci_cp_reject_conn_req cp;
1891
1892                 bacpy(&cp.bdaddr, &ev->bdaddr);
1893                 cp.reason = HCI_ERROR_REJ_BAD_ADDR;
1894                 hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
1895         }
1896 }
1897
1898 static u8 hci_to_mgmt_reason(u8 err)
1899 {
1900         switch (err) {
1901         case HCI_ERROR_CONNECTION_TIMEOUT:
1902                 return MGMT_DEV_DISCONN_TIMEOUT;
1903         case HCI_ERROR_REMOTE_USER_TERM:
1904         case HCI_ERROR_REMOTE_LOW_RESOURCES:
1905         case HCI_ERROR_REMOTE_POWER_OFF:
1906                 return MGMT_DEV_DISCONN_REMOTE;
1907         case HCI_ERROR_LOCAL_HOST_TERM:
1908                 return MGMT_DEV_DISCONN_LOCAL_HOST;
1909         default:
1910                 return MGMT_DEV_DISCONN_UNKNOWN;
1911         }
1912 }
1913
1914 static void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1915 {
1916         struct hci_ev_disconn_complete *ev = (void *) skb->data;
1917         struct hci_conn *conn;
1918
1919         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
1920
1921         hci_dev_lock(hdev);
1922
1923         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1924         if (!conn)
1925                 goto unlock;
1926
1927         if (ev->status == 0)
1928                 conn->state = BT_CLOSED;
1929
1930         if (test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags) &&
1931             (conn->type == ACL_LINK || conn->type == LE_LINK)) {
1932                 if (ev->status) {
1933                         mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
1934                                                conn->dst_type, ev->status);
1935                 } else {
1936                         u8 reason = hci_to_mgmt_reason(ev->reason);
1937
1938                         mgmt_device_disconnected(hdev, &conn->dst, conn->type,
1939                                                  conn->dst_type, reason);
1940                 }
1941         }
1942
1943         if (ev->status == 0) {
1944                 if (conn->type == ACL_LINK && conn->flush_key)
1945                         hci_remove_link_key(hdev, &conn->dst);
1946                 hci_proto_disconn_cfm(conn, ev->reason);
1947                 hci_conn_del(conn);
1948         }
1949
1950 unlock:
1951         hci_dev_unlock(hdev);
1952 }
1953
1954 static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1955 {
1956         struct hci_ev_auth_complete *ev = (void *) skb->data;
1957         struct hci_conn *conn;
1958
1959         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
1960
1961         hci_dev_lock(hdev);
1962
1963         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1964         if (!conn)
1965                 goto unlock;
1966
1967         if (!ev->status) {
1968                 if (!hci_conn_ssp_enabled(conn) &&
1969                     test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
1970                         BT_INFO("re-auth of legacy device is not possible.");
1971                 } else {
1972                         conn->link_mode |= HCI_LM_AUTH;
1973                         conn->sec_level = conn->pending_sec_level;
1974                 }
1975         } else {
1976                 mgmt_auth_failed(hdev, &conn->dst, conn->type, conn->dst_type,
1977                                  ev->status);
1978         }
1979
1980         clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
1981         clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
1982
1983         if (conn->state == BT_CONFIG) {
1984                 if (!ev->status && hci_conn_ssp_enabled(conn)) {
1985                         struct hci_cp_set_conn_encrypt cp;
1986                         cp.handle  = ev->handle;
1987                         cp.encrypt = 0x01;
1988                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
1989                                      &cp);
1990                 } else {
1991                         conn->state = BT_CONNECTED;
1992                         hci_proto_connect_cfm(conn, ev->status);
1993                         hci_conn_put(conn);
1994                 }
1995         } else {
1996                 hci_auth_cfm(conn, ev->status);
1997
1998                 hci_conn_hold(conn);
1999                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2000                 hci_conn_put(conn);
2001         }
2002
2003         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
2004                 if (!ev->status) {
2005                         struct hci_cp_set_conn_encrypt cp;
2006                         cp.handle  = ev->handle;
2007                         cp.encrypt = 0x01;
2008                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2009                                      &cp);
2010                 } else {
2011                         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2012                         hci_encrypt_cfm(conn, ev->status, 0x00);
2013                 }
2014         }
2015
2016 unlock:
2017         hci_dev_unlock(hdev);
2018 }
2019
2020 static void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
2021 {
2022         struct hci_ev_remote_name *ev = (void *) skb->data;
2023         struct hci_conn *conn;
2024
2025         BT_DBG("%s", hdev->name);
2026
2027         hci_conn_check_pending(hdev);
2028
2029         hci_dev_lock(hdev);
2030
2031         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2032
2033         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
2034                 goto check_auth;
2035
2036         if (ev->status == 0)
2037                 hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
2038                                        strnlen(ev->name, HCI_MAX_NAME_LENGTH));
2039         else
2040                 hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
2041
2042 check_auth:
2043         if (!conn)
2044                 goto unlock;
2045
2046         if (!hci_outgoing_auth_needed(hdev, conn))
2047                 goto unlock;
2048
2049         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
2050                 struct hci_cp_auth_requested cp;
2051                 cp.handle = __cpu_to_le16(conn->handle);
2052                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
2053         }
2054
2055 unlock:
2056         hci_dev_unlock(hdev);
2057 }
2058
2059 static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2060 {
2061         struct hci_ev_encrypt_change *ev = (void *) skb->data;
2062         struct hci_conn *conn;
2063
2064         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2065
2066         hci_dev_lock(hdev);
2067
2068         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2069         if (conn) {
2070                 if (!ev->status) {
2071                         if (ev->encrypt) {
2072                                 /* Encryption implies authentication */
2073                                 conn->link_mode |= HCI_LM_AUTH;
2074                                 conn->link_mode |= HCI_LM_ENCRYPT;
2075                                 conn->sec_level = conn->pending_sec_level;
2076                         } else
2077                                 conn->link_mode &= ~HCI_LM_ENCRYPT;
2078                 }
2079
2080                 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2081
2082                 if (ev->status && conn->state == BT_CONNECTED) {
2083                         hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2084                         hci_conn_put(conn);
2085                         goto unlock;
2086                 }
2087
2088                 if (conn->state == BT_CONFIG) {
2089                         if (!ev->status)
2090                                 conn->state = BT_CONNECTED;
2091
2092                         hci_proto_connect_cfm(conn, ev->status);
2093                         hci_conn_put(conn);
2094                 } else
2095                         hci_encrypt_cfm(conn, ev->status, ev->encrypt);
2096         }
2097
2098 unlock:
2099         hci_dev_unlock(hdev);
2100 }
2101
2102 static void hci_change_link_key_complete_evt(struct hci_dev *hdev,
2103                                              struct sk_buff *skb)
2104 {
2105         struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
2106         struct hci_conn *conn;
2107
2108         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2109
2110         hci_dev_lock(hdev);
2111
2112         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2113         if (conn) {
2114                 if (!ev->status)
2115                         conn->link_mode |= HCI_LM_SECURE;
2116
2117                 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
2118
2119                 hci_key_change_cfm(conn, ev->status);
2120         }
2121
2122         hci_dev_unlock(hdev);
2123 }
2124
2125 static void hci_remote_features_evt(struct hci_dev *hdev,
2126                                     struct sk_buff *skb)
2127 {
2128         struct hci_ev_remote_features *ev = (void *) skb->data;
2129         struct hci_conn *conn;
2130
2131         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2132
2133         hci_dev_lock(hdev);
2134
2135         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2136         if (!conn)
2137                 goto unlock;
2138
2139         if (!ev->status)
2140                 memcpy(conn->features, ev->features, 8);
2141
2142         if (conn->state != BT_CONFIG)
2143                 goto unlock;
2144
2145         if (!ev->status && lmp_ssp_capable(hdev) && lmp_ssp_capable(conn)) {
2146                 struct hci_cp_read_remote_ext_features cp;
2147                 cp.handle = ev->handle;
2148                 cp.page = 0x01;
2149                 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
2150                              sizeof(cp), &cp);
2151                 goto unlock;
2152         }
2153
2154         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
2155                 struct hci_cp_remote_name_req cp;
2156                 memset(&cp, 0, sizeof(cp));
2157                 bacpy(&cp.bdaddr, &conn->dst);
2158                 cp.pscan_rep_mode = 0x02;
2159                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2160         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2161                 mgmt_device_connected(hdev, &conn->dst, conn->type,
2162                                       conn->dst_type, 0, NULL, 0,
2163                                       conn->dev_class);
2164
2165         if (!hci_outgoing_auth_needed(hdev, conn)) {
2166                 conn->state = BT_CONNECTED;
2167                 hci_proto_connect_cfm(conn, ev->status);
2168                 hci_conn_put(conn);
2169         }
2170
2171 unlock:
2172         hci_dev_unlock(hdev);
2173 }
2174
2175 static void hci_remote_version_evt(struct hci_dev *hdev, struct sk_buff *skb)
2176 {
2177         BT_DBG("%s", hdev->name);
2178 }
2179
2180 static void hci_qos_setup_complete_evt(struct hci_dev *hdev,
2181                                        struct sk_buff *skb)
2182 {
2183         BT_DBG("%s", hdev->name);
2184 }
2185
2186 static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2187 {
2188         struct hci_ev_cmd_complete *ev = (void *) skb->data;
2189         u8 status = skb->data[sizeof(*ev)];
2190         __u16 opcode;
2191
2192         skb_pull(skb, sizeof(*ev));
2193
2194         opcode = __le16_to_cpu(ev->opcode);
2195
2196         switch (opcode) {
2197         case HCI_OP_INQUIRY_CANCEL:
2198                 hci_cc_inquiry_cancel(hdev, skb);
2199                 break;
2200
2201         case HCI_OP_PERIODIC_INQ:
2202                 hci_cc_periodic_inq(hdev, skb);
2203                 break;
2204
2205         case HCI_OP_EXIT_PERIODIC_INQ:
2206                 hci_cc_exit_periodic_inq(hdev, skb);
2207                 break;
2208
2209         case HCI_OP_REMOTE_NAME_REQ_CANCEL:
2210                 hci_cc_remote_name_req_cancel(hdev, skb);
2211                 break;
2212
2213         case HCI_OP_ROLE_DISCOVERY:
2214                 hci_cc_role_discovery(hdev, skb);
2215                 break;
2216
2217         case HCI_OP_READ_LINK_POLICY:
2218                 hci_cc_read_link_policy(hdev, skb);
2219                 break;
2220
2221         case HCI_OP_WRITE_LINK_POLICY:
2222                 hci_cc_write_link_policy(hdev, skb);
2223                 break;
2224
2225         case HCI_OP_READ_DEF_LINK_POLICY:
2226                 hci_cc_read_def_link_policy(hdev, skb);
2227                 break;
2228
2229         case HCI_OP_WRITE_DEF_LINK_POLICY:
2230                 hci_cc_write_def_link_policy(hdev, skb);
2231                 break;
2232
2233         case HCI_OP_RESET:
2234                 hci_cc_reset(hdev, skb);
2235                 break;
2236
2237         case HCI_OP_WRITE_LOCAL_NAME:
2238                 hci_cc_write_local_name(hdev, skb);
2239                 break;
2240
2241         case HCI_OP_READ_LOCAL_NAME:
2242                 hci_cc_read_local_name(hdev, skb);
2243                 break;
2244
2245         case HCI_OP_WRITE_AUTH_ENABLE:
2246                 hci_cc_write_auth_enable(hdev, skb);
2247                 break;
2248
2249         case HCI_OP_WRITE_ENCRYPT_MODE:
2250                 hci_cc_write_encrypt_mode(hdev, skb);
2251                 break;
2252
2253         case HCI_OP_WRITE_SCAN_ENABLE:
2254                 hci_cc_write_scan_enable(hdev, skb);
2255                 break;
2256
2257         case HCI_OP_READ_CLASS_OF_DEV:
2258                 hci_cc_read_class_of_dev(hdev, skb);
2259                 break;
2260
2261         case HCI_OP_WRITE_CLASS_OF_DEV:
2262                 hci_cc_write_class_of_dev(hdev, skb);
2263                 break;
2264
2265         case HCI_OP_READ_VOICE_SETTING:
2266                 hci_cc_read_voice_setting(hdev, skb);
2267                 break;
2268
2269         case HCI_OP_WRITE_VOICE_SETTING:
2270                 hci_cc_write_voice_setting(hdev, skb);
2271                 break;
2272
2273         case HCI_OP_HOST_BUFFER_SIZE:
2274                 hci_cc_host_buffer_size(hdev, skb);
2275                 break;
2276
2277         case HCI_OP_WRITE_SSP_MODE:
2278                 hci_cc_write_ssp_mode(hdev, skb);
2279                 break;
2280
2281         case HCI_OP_READ_LOCAL_VERSION:
2282                 hci_cc_read_local_version(hdev, skb);
2283                 break;
2284
2285         case HCI_OP_READ_LOCAL_COMMANDS:
2286                 hci_cc_read_local_commands(hdev, skb);
2287                 break;
2288
2289         case HCI_OP_READ_LOCAL_FEATURES:
2290                 hci_cc_read_local_features(hdev, skb);
2291                 break;
2292
2293         case HCI_OP_READ_LOCAL_EXT_FEATURES:
2294                 hci_cc_read_local_ext_features(hdev, skb);
2295                 break;
2296
2297         case HCI_OP_READ_BUFFER_SIZE:
2298                 hci_cc_read_buffer_size(hdev, skb);
2299                 break;
2300
2301         case HCI_OP_READ_BD_ADDR:
2302                 hci_cc_read_bd_addr(hdev, skb);
2303                 break;
2304
2305         case HCI_OP_READ_DATA_BLOCK_SIZE:
2306                 hci_cc_read_data_block_size(hdev, skb);
2307                 break;
2308
2309         case HCI_OP_WRITE_CA_TIMEOUT:
2310                 hci_cc_write_ca_timeout(hdev, skb);
2311                 break;
2312
2313         case HCI_OP_READ_FLOW_CONTROL_MODE:
2314                 hci_cc_read_flow_control_mode(hdev, skb);
2315                 break;
2316
2317         case HCI_OP_READ_LOCAL_AMP_INFO:
2318                 hci_cc_read_local_amp_info(hdev, skb);
2319                 break;
2320
2321         case HCI_OP_READ_LOCAL_AMP_ASSOC:
2322                 hci_cc_read_local_amp_assoc(hdev, skb);
2323                 break;
2324
2325         case HCI_OP_DELETE_STORED_LINK_KEY:
2326                 hci_cc_delete_stored_link_key(hdev, skb);
2327                 break;
2328
2329         case HCI_OP_SET_EVENT_MASK:
2330                 hci_cc_set_event_mask(hdev, skb);
2331                 break;
2332
2333         case HCI_OP_WRITE_INQUIRY_MODE:
2334                 hci_cc_write_inquiry_mode(hdev, skb);
2335                 break;
2336
2337         case HCI_OP_READ_INQ_RSP_TX_POWER:
2338                 hci_cc_read_inq_rsp_tx_power(hdev, skb);
2339                 break;
2340
2341         case HCI_OP_SET_EVENT_FLT:
2342                 hci_cc_set_event_flt(hdev, skb);
2343                 break;
2344
2345         case HCI_OP_PIN_CODE_REPLY:
2346                 hci_cc_pin_code_reply(hdev, skb);
2347                 break;
2348
2349         case HCI_OP_PIN_CODE_NEG_REPLY:
2350                 hci_cc_pin_code_neg_reply(hdev, skb);
2351                 break;
2352
2353         case HCI_OP_READ_LOCAL_OOB_DATA:
2354                 hci_cc_read_local_oob_data_reply(hdev, skb);
2355                 break;
2356
2357         case HCI_OP_LE_READ_BUFFER_SIZE:
2358                 hci_cc_le_read_buffer_size(hdev, skb);
2359                 break;
2360
2361         case HCI_OP_LE_READ_LOCAL_FEATURES:
2362                 hci_cc_le_read_local_features(hdev, skb);
2363                 break;
2364
2365         case HCI_OP_LE_READ_ADV_TX_POWER:
2366                 hci_cc_le_read_adv_tx_power(hdev, skb);
2367                 break;
2368
2369         case HCI_OP_LE_SET_EVENT_MASK:
2370                 hci_cc_le_set_event_mask(hdev, skb);
2371                 break;
2372
2373         case HCI_OP_USER_CONFIRM_REPLY:
2374                 hci_cc_user_confirm_reply(hdev, skb);
2375                 break;
2376
2377         case HCI_OP_USER_CONFIRM_NEG_REPLY:
2378                 hci_cc_user_confirm_neg_reply(hdev, skb);
2379                 break;
2380
2381         case HCI_OP_USER_PASSKEY_REPLY:
2382                 hci_cc_user_passkey_reply(hdev, skb);
2383                 break;
2384
2385         case HCI_OP_USER_PASSKEY_NEG_REPLY:
2386                 hci_cc_user_passkey_neg_reply(hdev, skb);
2387                 break;
2388
2389         case HCI_OP_LE_SET_SCAN_PARAM:
2390                 hci_cc_le_set_scan_param(hdev, skb);
2391                 break;
2392
2393         case HCI_OP_LE_SET_ADV_ENABLE:
2394                 hci_cc_le_set_adv_enable(hdev, skb);
2395                 break;
2396
2397         case HCI_OP_LE_SET_SCAN_ENABLE:
2398                 hci_cc_le_set_scan_enable(hdev, skb);
2399                 break;
2400
2401         case HCI_OP_LE_READ_WHITE_LIST_SIZE:
2402                 hci_cc_le_read_white_list_size(hdev, skb);
2403                 break;
2404
2405         case HCI_OP_LE_LTK_REPLY:
2406                 hci_cc_le_ltk_reply(hdev, skb);
2407                 break;
2408
2409         case HCI_OP_LE_LTK_NEG_REPLY:
2410                 hci_cc_le_ltk_neg_reply(hdev, skb);
2411                 break;
2412
2413         case HCI_OP_LE_READ_SUPPORTED_STATES:
2414                 hci_cc_le_read_supported_states(hdev, skb);
2415                 break;
2416
2417         case HCI_OP_WRITE_LE_HOST_SUPPORTED:
2418                 hci_cc_write_le_host_supported(hdev, skb);
2419                 break;
2420
2421         case HCI_OP_WRITE_REMOTE_AMP_ASSOC:
2422                 hci_cc_write_remote_amp_assoc(hdev, skb);
2423                 break;
2424
2425         default:
2426                 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
2427                 break;
2428         }
2429
2430         if (ev->opcode != HCI_OP_NOP)
2431                 del_timer(&hdev->cmd_timer);
2432
2433         hci_req_cmd_complete(hdev, ev->opcode, status);
2434
2435         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
2436                 atomic_set(&hdev->cmd_cnt, 1);
2437                 if (!skb_queue_empty(&hdev->cmd_q))
2438                         queue_work(hdev->workqueue, &hdev->cmd_work);
2439         }
2440 }
2441
2442 static void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb)
2443 {
2444         struct hci_ev_cmd_status *ev = (void *) skb->data;
2445         __u16 opcode;
2446
2447         skb_pull(skb, sizeof(*ev));
2448
2449         opcode = __le16_to_cpu(ev->opcode);
2450
2451         switch (opcode) {
2452         case HCI_OP_INQUIRY:
2453                 hci_cs_inquiry(hdev, ev->status);
2454                 break;
2455
2456         case HCI_OP_CREATE_CONN:
2457                 hci_cs_create_conn(hdev, ev->status);
2458                 break;
2459
2460         case HCI_OP_ADD_SCO:
2461                 hci_cs_add_sco(hdev, ev->status);
2462                 break;
2463
2464         case HCI_OP_AUTH_REQUESTED:
2465                 hci_cs_auth_requested(hdev, ev->status);
2466                 break;
2467
2468         case HCI_OP_SET_CONN_ENCRYPT:
2469                 hci_cs_set_conn_encrypt(hdev, ev->status);
2470                 break;
2471
2472         case HCI_OP_REMOTE_NAME_REQ:
2473                 hci_cs_remote_name_req(hdev, ev->status);
2474                 break;
2475
2476         case HCI_OP_READ_REMOTE_FEATURES:
2477                 hci_cs_read_remote_features(hdev, ev->status);
2478                 break;
2479
2480         case HCI_OP_READ_REMOTE_EXT_FEATURES:
2481                 hci_cs_read_remote_ext_features(hdev, ev->status);
2482                 break;
2483
2484         case HCI_OP_SETUP_SYNC_CONN:
2485                 hci_cs_setup_sync_conn(hdev, ev->status);
2486                 break;
2487
2488         case HCI_OP_SNIFF_MODE:
2489                 hci_cs_sniff_mode(hdev, ev->status);
2490                 break;
2491
2492         case HCI_OP_EXIT_SNIFF_MODE:
2493                 hci_cs_exit_sniff_mode(hdev, ev->status);
2494                 break;
2495
2496         case HCI_OP_DISCONNECT:
2497                 hci_cs_disconnect(hdev, ev->status);
2498                 break;
2499
2500         case HCI_OP_LE_CREATE_CONN:
2501                 hci_cs_le_create_conn(hdev, ev->status);
2502                 break;
2503
2504         case HCI_OP_LE_START_ENC:
2505                 hci_cs_le_start_enc(hdev, ev->status);
2506                 break;
2507
2508         case HCI_OP_CREATE_PHY_LINK:
2509                 hci_cs_create_phylink(hdev, ev->status);
2510                 break;
2511
2512         case HCI_OP_ACCEPT_PHY_LINK:
2513                 hci_cs_accept_phylink(hdev, ev->status);
2514                 break;
2515
2516         case HCI_OP_CREATE_LOGICAL_LINK:
2517                 hci_cs_create_logical_link(hdev, ev->status);
2518                 break;
2519
2520         default:
2521                 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
2522                 break;
2523         }
2524
2525         if (ev->opcode != HCI_OP_NOP)
2526                 del_timer(&hdev->cmd_timer);
2527
2528         hci_req_cmd_status(hdev, ev->opcode, ev->status);
2529
2530         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
2531                 atomic_set(&hdev->cmd_cnt, 1);
2532                 if (!skb_queue_empty(&hdev->cmd_q))
2533                         queue_work(hdev->workqueue, &hdev->cmd_work);
2534         }
2535 }
2536
2537 static void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2538 {
2539         struct hci_ev_role_change *ev = (void *) skb->data;
2540         struct hci_conn *conn;
2541
2542         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2543
2544         hci_dev_lock(hdev);
2545
2546         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2547         if (conn) {
2548                 if (!ev->status) {
2549                         if (ev->role)
2550                                 conn->link_mode &= ~HCI_LM_MASTER;
2551                         else
2552                                 conn->link_mode |= HCI_LM_MASTER;
2553                 }
2554
2555                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
2556
2557                 hci_role_switch_cfm(conn, ev->status, ev->role);
2558         }
2559
2560         hci_dev_unlock(hdev);
2561 }
2562
2563 static void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
2564 {
2565         struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
2566         int i;
2567
2568         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
2569                 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
2570                 return;
2571         }
2572
2573         if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
2574             ev->num_hndl * sizeof(struct hci_comp_pkts_info)) {
2575                 BT_DBG("%s bad parameters", hdev->name);
2576                 return;
2577         }
2578
2579         BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
2580
2581         for (i = 0; i < ev->num_hndl; i++) {
2582                 struct hci_comp_pkts_info *info = &ev->handles[i];
2583                 struct hci_conn *conn;
2584                 __u16  handle, count;
2585
2586                 handle = __le16_to_cpu(info->handle);
2587                 count  = __le16_to_cpu(info->count);
2588
2589                 conn = hci_conn_hash_lookup_handle(hdev, handle);
2590                 if (!conn)
2591                         continue;
2592
2593                 conn->sent -= count;
2594
2595                 switch (conn->type) {
2596                 case ACL_LINK:
2597                         hdev->acl_cnt += count;
2598                         if (hdev->acl_cnt > hdev->acl_pkts)
2599                                 hdev->acl_cnt = hdev->acl_pkts;
2600                         break;
2601
2602                 case LE_LINK:
2603                         if (hdev->le_pkts) {
2604                                 hdev->le_cnt += count;
2605                                 if (hdev->le_cnt > hdev->le_pkts)
2606                                         hdev->le_cnt = hdev->le_pkts;
2607                         } else {
2608                                 hdev->acl_cnt += count;
2609                                 if (hdev->acl_cnt > hdev->acl_pkts)
2610                                         hdev->acl_cnt = hdev->acl_pkts;
2611                         }
2612                         break;
2613
2614                 case SCO_LINK:
2615                         hdev->sco_cnt += count;
2616                         if (hdev->sco_cnt > hdev->sco_pkts)
2617                                 hdev->sco_cnt = hdev->sco_pkts;
2618                         break;
2619
2620                 default:
2621                         BT_ERR("Unknown type %d conn %p", conn->type, conn);
2622                         break;
2623                 }
2624         }
2625
2626         queue_work(hdev->workqueue, &hdev->tx_work);
2627 }
2628
2629 static struct hci_conn *__hci_conn_lookup_handle(struct hci_dev *hdev,
2630                                                  __u16 handle)
2631 {
2632         struct hci_chan *chan;
2633
2634         switch (hdev->dev_type) {
2635         case HCI_BREDR:
2636                 return hci_conn_hash_lookup_handle(hdev, handle);
2637         case HCI_AMP:
2638                 chan = hci_chan_lookup_handle(hdev, handle);
2639                 if (chan)
2640                         return chan->conn;
2641                 break;
2642         default:
2643                 BT_ERR("%s unknown dev_type %d", hdev->name, hdev->dev_type);
2644                 break;
2645         }
2646
2647         return NULL;
2648 }
2649
2650 static void hci_num_comp_blocks_evt(struct hci_dev *hdev, struct sk_buff *skb)
2651 {
2652         struct hci_ev_num_comp_blocks *ev = (void *) skb->data;
2653         int i;
2654
2655         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
2656                 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
2657                 return;
2658         }
2659
2660         if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
2661             ev->num_hndl * sizeof(struct hci_comp_blocks_info)) {
2662                 BT_DBG("%s bad parameters", hdev->name);
2663                 return;
2664         }
2665
2666         BT_DBG("%s num_blocks %d num_hndl %d", hdev->name, ev->num_blocks,
2667                ev->num_hndl);
2668
2669         for (i = 0; i < ev->num_hndl; i++) {
2670                 struct hci_comp_blocks_info *info = &ev->handles[i];
2671                 struct hci_conn *conn = NULL;
2672                 __u16  handle, block_count;
2673
2674                 handle = __le16_to_cpu(info->handle);
2675                 block_count = __le16_to_cpu(info->blocks);
2676
2677                 conn = __hci_conn_lookup_handle(hdev, handle);
2678                 if (!conn)
2679                         continue;
2680
2681                 conn->sent -= block_count;
2682
2683                 switch (conn->type) {
2684                 case ACL_LINK:
2685                 case AMP_LINK:
2686                         hdev->block_cnt += block_count;
2687                         if (hdev->block_cnt > hdev->num_blocks)
2688                                 hdev->block_cnt = hdev->num_blocks;
2689                         break;
2690
2691                 default:
2692                         BT_ERR("Unknown type %d conn %p", conn->type, conn);
2693                         break;
2694                 }
2695         }
2696
2697         queue_work(hdev->workqueue, &hdev->tx_work);
2698 }
2699
2700 static void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2701 {
2702         struct hci_ev_mode_change *ev = (void *) skb->data;
2703         struct hci_conn *conn;
2704
2705         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2706
2707         hci_dev_lock(hdev);
2708
2709         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2710         if (conn) {
2711                 conn->mode = ev->mode;
2712                 conn->interval = __le16_to_cpu(ev->interval);
2713
2714                 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND,
2715                                         &conn->flags)) {
2716                         if (conn->mode == HCI_CM_ACTIVE)
2717                                 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
2718                         else
2719                                 clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
2720                 }
2721
2722                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2723                         hci_sco_setup(conn, ev->status);
2724         }
2725
2726         hci_dev_unlock(hdev);
2727 }
2728
2729 static void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2730 {
2731         struct hci_ev_pin_code_req *ev = (void *) skb->data;
2732         struct hci_conn *conn;
2733
2734         BT_DBG("%s", hdev->name);
2735
2736         hci_dev_lock(hdev);
2737
2738         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2739         if (!conn)
2740                 goto unlock;
2741
2742         if (conn->state == BT_CONNECTED) {
2743                 hci_conn_hold(conn);
2744                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2745                 hci_conn_put(conn);
2746         }
2747
2748         if (!test_bit(HCI_PAIRABLE, &hdev->dev_flags))
2749                 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2750                              sizeof(ev->bdaddr), &ev->bdaddr);
2751         else if (test_bit(HCI_MGMT, &hdev->dev_flags)) {
2752                 u8 secure;
2753
2754                 if (conn->pending_sec_level == BT_SECURITY_HIGH)
2755                         secure = 1;
2756                 else
2757                         secure = 0;
2758
2759                 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
2760         }
2761
2762 unlock:
2763         hci_dev_unlock(hdev);
2764 }
2765
2766 static void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2767 {
2768         struct hci_ev_link_key_req *ev = (void *) skb->data;
2769         struct hci_cp_link_key_reply cp;
2770         struct hci_conn *conn;
2771         struct link_key *key;
2772
2773         BT_DBG("%s", hdev->name);
2774
2775         if (!test_bit(HCI_LINK_KEYS, &hdev->dev_flags))
2776                 return;
2777
2778         hci_dev_lock(hdev);
2779
2780         key = hci_find_link_key(hdev, &ev->bdaddr);
2781         if (!key) {
2782                 BT_DBG("%s link key not found for %pMR", hdev->name,
2783                        &ev->bdaddr);
2784                 goto not_found;
2785         }
2786
2787         BT_DBG("%s found key type %u for %pMR", hdev->name, key->type,
2788                &ev->bdaddr);
2789
2790         if (!test_bit(HCI_DEBUG_KEYS, &hdev->dev_flags) &&
2791             key->type == HCI_LK_DEBUG_COMBINATION) {
2792                 BT_DBG("%s ignoring debug key", hdev->name);
2793                 goto not_found;
2794         }
2795
2796         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2797         if (conn) {
2798                 if (key->type == HCI_LK_UNAUTH_COMBINATION &&
2799                     conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
2800                         BT_DBG("%s ignoring unauthenticated key", hdev->name);
2801                         goto not_found;
2802                 }
2803
2804                 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
2805                     conn->pending_sec_level == BT_SECURITY_HIGH) {
2806                         BT_DBG("%s ignoring key unauthenticated for high security",
2807                                hdev->name);
2808                         goto not_found;
2809                 }
2810
2811                 conn->key_type = key->type;
2812                 conn->pin_length = key->pin_len;
2813         }
2814
2815         bacpy(&cp.bdaddr, &ev->bdaddr);
2816         memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);
2817
2818         hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
2819
2820         hci_dev_unlock(hdev);
2821
2822         return;
2823
2824 not_found:
2825         hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
2826         hci_dev_unlock(hdev);
2827 }
2828
2829 static void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
2830 {
2831         struct hci_ev_link_key_notify *ev = (void *) skb->data;
2832         struct hci_conn *conn;
2833         u8 pin_len = 0;
2834
2835         BT_DBG("%s", hdev->name);
2836
2837         hci_dev_lock(hdev);
2838
2839         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2840         if (conn) {
2841                 hci_conn_hold(conn);
2842                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2843                 pin_len = conn->pin_length;
2844
2845                 if (ev->key_type != HCI_LK_CHANGED_COMBINATION)
2846                         conn->key_type = ev->key_type;
2847
2848                 hci_conn_put(conn);
2849         }
2850
2851         if (test_bit(HCI_LINK_KEYS, &hdev->dev_flags))
2852                 hci_add_link_key(hdev, conn, 1, &ev->bdaddr, ev->link_key,
2853                                  ev->key_type, pin_len);
2854
2855         hci_dev_unlock(hdev);
2856 }
2857
2858 static void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
2859 {
2860         struct hci_ev_clock_offset *ev = (void *) skb->data;
2861         struct hci_conn *conn;
2862
2863         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2864
2865         hci_dev_lock(hdev);
2866
2867         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2868         if (conn && !ev->status) {
2869                 struct inquiry_entry *ie;
2870
2871                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
2872                 if (ie) {
2873                         ie->data.clock_offset = ev->clock_offset;
2874                         ie->timestamp = jiffies;
2875                 }
2876         }
2877
2878         hci_dev_unlock(hdev);
2879 }
2880
2881 static void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2882 {
2883         struct hci_ev_pkt_type_change *ev = (void *) skb->data;
2884         struct hci_conn *conn;
2885
2886         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2887
2888         hci_dev_lock(hdev);
2889
2890         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2891         if (conn && !ev->status)
2892                 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
2893
2894         hci_dev_unlock(hdev);
2895 }
2896
2897 static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
2898 {
2899         struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
2900         struct inquiry_entry *ie;
2901
2902         BT_DBG("%s", hdev->name);
2903
2904         hci_dev_lock(hdev);
2905
2906         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2907         if (ie) {
2908                 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
2909                 ie->timestamp = jiffies;
2910         }
2911
2912         hci_dev_unlock(hdev);
2913 }
2914
2915 static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
2916                                              struct sk_buff *skb)
2917 {
2918         struct inquiry_data data;
2919         int num_rsp = *((__u8 *) skb->data);
2920         bool name_known, ssp;
2921
2922         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2923
2924         if (!num_rsp)
2925                 return;
2926
2927         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
2928                 return;
2929
2930         hci_dev_lock(hdev);
2931
2932         if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
2933                 struct inquiry_info_with_rssi_and_pscan_mode *info;
2934                 info = (void *) (skb->data + 1);
2935
2936                 for (; num_rsp; num_rsp--, info++) {
2937                         bacpy(&data.bdaddr, &info->bdaddr);
2938                         data.pscan_rep_mode     = info->pscan_rep_mode;
2939                         data.pscan_period_mode  = info->pscan_period_mode;
2940                         data.pscan_mode         = info->pscan_mode;
2941                         memcpy(data.dev_class, info->dev_class, 3);
2942                         data.clock_offset       = info->clock_offset;
2943                         data.rssi               = info->rssi;
2944                         data.ssp_mode           = 0x00;
2945
2946                         name_known = hci_inquiry_cache_update(hdev, &data,
2947                                                               false, &ssp);
2948                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2949                                           info->dev_class, info->rssi,
2950                                           !name_known, ssp, NULL, 0);
2951                 }
2952         } else {
2953                 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
2954
2955                 for (; num_rsp; num_rsp--, info++) {
2956                         bacpy(&data.bdaddr, &info->bdaddr);
2957                         data.pscan_rep_mode     = info->pscan_rep_mode;
2958                         data.pscan_period_mode  = info->pscan_period_mode;
2959                         data.pscan_mode         = 0x00;
2960                         memcpy(data.dev_class, info->dev_class, 3);
2961                         data.clock_offset       = info->clock_offset;
2962                         data.rssi               = info->rssi;
2963                         data.ssp_mode           = 0x00;
2964                         name_known = hci_inquiry_cache_update(hdev, &data,
2965                                                               false, &ssp);
2966                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2967                                           info->dev_class, info->rssi,
2968                                           !name_known, ssp, NULL, 0);
2969                 }
2970         }
2971
2972         hci_dev_unlock(hdev);
2973 }
2974
2975 static void hci_remote_ext_features_evt(struct hci_dev *hdev,
2976                                         struct sk_buff *skb)
2977 {
2978         struct hci_ev_remote_ext_features *ev = (void *) skb->data;
2979         struct hci_conn *conn;
2980
2981         BT_DBG("%s", hdev->name);
2982
2983         hci_dev_lock(hdev);
2984
2985         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2986         if (!conn)
2987                 goto unlock;
2988
2989         if (!ev->status && ev->page == 0x01) {
2990                 struct inquiry_entry *ie;
2991
2992                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
2993                 if (ie)
2994                         ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
2995
2996                 if (ev->features[0] & LMP_HOST_SSP)
2997                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
2998         }
2999
3000         if (conn->state != BT_CONFIG)
3001                 goto unlock;
3002
3003         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
3004                 struct hci_cp_remote_name_req cp;
3005                 memset(&cp, 0, sizeof(cp));
3006                 bacpy(&cp.bdaddr, &conn->dst);
3007                 cp.pscan_rep_mode = 0x02;
3008                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
3009         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
3010                 mgmt_device_connected(hdev, &conn->dst, conn->type,
3011                                       conn->dst_type, 0, NULL, 0,
3012                                       conn->dev_class);
3013
3014         if (!hci_outgoing_auth_needed(hdev, conn)) {
3015                 conn->state = BT_CONNECTED;
3016                 hci_proto_connect_cfm(conn, ev->status);
3017                 hci_conn_put(conn);
3018         }
3019
3020 unlock:
3021         hci_dev_unlock(hdev);
3022 }
3023
3024 static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
3025                                        struct sk_buff *skb)
3026 {
3027         struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
3028         struct hci_conn *conn;
3029
3030         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3031
3032         hci_dev_lock(hdev);
3033
3034         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
3035         if (!conn) {
3036                 if (ev->link_type == ESCO_LINK)
3037                         goto unlock;
3038
3039                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
3040                 if (!conn)
3041                         goto unlock;
3042
3043                 conn->type = SCO_LINK;
3044         }
3045
3046         switch (ev->status) {
3047         case 0x00:
3048                 conn->handle = __le16_to_cpu(ev->handle);
3049                 conn->state  = BT_CONNECTED;
3050
3051                 hci_conn_hold_device(conn);
3052                 hci_conn_add_sysfs(conn);
3053                 break;
3054
3055         case 0x11:      /* Unsupported Feature or Parameter Value */
3056         case 0x1c:      /* SCO interval rejected */
3057         case 0x1a:      /* Unsupported Remote Feature */
3058         case 0x1f:      /* Unspecified error */
3059                 if (conn->out && conn->attempt < 2) {
3060                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
3061                                         (hdev->esco_type & EDR_ESCO_MASK);
3062                         hci_setup_sync(conn, conn->link->handle);
3063                         goto unlock;
3064                 }
3065                 /* fall through */
3066
3067         default:
3068                 conn->state = BT_CLOSED;
3069                 break;
3070         }
3071
3072         hci_proto_connect_cfm(conn, ev->status);
3073         if (ev->status)
3074                 hci_conn_del(conn);
3075
3076 unlock:
3077         hci_dev_unlock(hdev);
3078 }
3079
3080 static void hci_sync_conn_changed_evt(struct hci_dev *hdev, struct sk_buff *skb)
3081 {
3082         BT_DBG("%s", hdev->name);
3083 }
3084
3085 static void hci_sniff_subrate_evt(struct hci_dev *hdev, struct sk_buff *skb)
3086 {
3087         struct hci_ev_sniff_subrate *ev = (void *) skb->data;
3088
3089         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3090 }
3091
3092 static void hci_extended_inquiry_result_evt(struct hci_dev *hdev,
3093                                             struct sk_buff *skb)
3094 {
3095         struct inquiry_data data;
3096         struct extended_inquiry_info *info = (void *) (skb->data + 1);
3097         int num_rsp = *((__u8 *) skb->data);
3098         size_t eir_len;
3099
3100         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
3101
3102         if (!num_rsp)
3103                 return;
3104
3105         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
3106                 return;
3107
3108         hci_dev_lock(hdev);
3109
3110         for (; num_rsp; num_rsp--, info++) {
3111                 bool name_known, ssp;
3112
3113                 bacpy(&data.bdaddr, &info->bdaddr);
3114                 data.pscan_rep_mode     = info->pscan_rep_mode;
3115                 data.pscan_period_mode  = info->pscan_period_mode;
3116                 data.pscan_mode         = 0x00;
3117                 memcpy(data.dev_class, info->dev_class, 3);
3118                 data.clock_offset       = info->clock_offset;
3119                 data.rssi               = info->rssi;
3120                 data.ssp_mode           = 0x01;
3121
3122                 if (test_bit(HCI_MGMT, &hdev->dev_flags))
3123                         name_known = eir_has_data_type(info->data,
3124                                                        sizeof(info->data),
3125                                                        EIR_NAME_COMPLETE);
3126                 else
3127                         name_known = true;
3128
3129                 name_known = hci_inquiry_cache_update(hdev, &data, name_known,
3130                                                       &ssp);
3131                 eir_len = eir_get_length(info->data, sizeof(info->data));
3132                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
3133                                   info->dev_class, info->rssi, !name_known,
3134                                   ssp, info->data, eir_len);
3135         }
3136
3137         hci_dev_unlock(hdev);
3138 }
3139
3140 static void hci_key_refresh_complete_evt(struct hci_dev *hdev,
3141                                          struct sk_buff *skb)
3142 {
3143         struct hci_ev_key_refresh_complete *ev = (void *) skb->data;
3144         struct hci_conn *conn;
3145
3146         BT_DBG("%s status 0x%2.2x handle 0x%4.4x", hdev->name, ev->status,
3147                __le16_to_cpu(ev->handle));
3148
3149         hci_dev_lock(hdev);
3150
3151         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3152         if (!conn)
3153                 goto unlock;
3154
3155         if (!ev->status)
3156                 conn->sec_level = conn->pending_sec_level;
3157
3158         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3159
3160         if (ev->status && conn->state == BT_CONNECTED) {
3161                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
3162                 hci_conn_put(conn);
3163                 goto unlock;
3164         }
3165
3166         if (conn->state == BT_CONFIG) {
3167                 if (!ev->status)
3168                         conn->state = BT_CONNECTED;
3169
3170                 hci_proto_connect_cfm(conn, ev->status);
3171                 hci_conn_put(conn);
3172         } else {
3173                 hci_auth_cfm(conn, ev->status);
3174
3175                 hci_conn_hold(conn);
3176                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3177                 hci_conn_put(conn);
3178         }
3179
3180 unlock:
3181         hci_dev_unlock(hdev);
3182 }
3183
3184 static u8 hci_get_auth_req(struct hci_conn *conn)
3185 {
3186         /* If remote requests dedicated bonding follow that lead */
3187         if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03) {
3188                 /* If both remote and local IO capabilities allow MITM
3189                  * protection then require it, otherwise don't */
3190                 if (conn->remote_cap == 0x03 || conn->io_capability == 0x03)
3191                         return 0x02;
3192                 else
3193                         return 0x03;
3194         }
3195
3196         /* If remote requests no-bonding follow that lead */
3197         if (conn->remote_auth == 0x00 || conn->remote_auth == 0x01)
3198                 return conn->remote_auth | (conn->auth_type & 0x01);
3199
3200         return conn->auth_type;
3201 }
3202
3203 static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3204 {
3205         struct hci_ev_io_capa_request *ev = (void *) skb->data;
3206         struct hci_conn *conn;
3207
3208         BT_DBG("%s", hdev->name);
3209
3210         hci_dev_lock(hdev);
3211
3212         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3213         if (!conn)
3214                 goto unlock;
3215
3216         hci_conn_hold(conn);
3217
3218         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3219                 goto unlock;
3220
3221         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags) ||
3222             (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
3223                 struct hci_cp_io_capability_reply cp;
3224
3225                 bacpy(&cp.bdaddr, &ev->bdaddr);
3226                 /* Change the IO capability from KeyboardDisplay
3227                  * to DisplayYesNo as it is not supported by BT spec. */
3228                 cp.capability = (conn->io_capability == 0x04) ?
3229                                                 0x01 : conn->io_capability;
3230                 conn->auth_type = hci_get_auth_req(conn);
3231                 cp.authentication = conn->auth_type;
3232
3233                 if (hci_find_remote_oob_data(hdev, &conn->dst) &&
3234                     (conn->out || test_bit(HCI_CONN_REMOTE_OOB, &conn->flags)))
3235                         cp.oob_data = 0x01;
3236                 else
3237                         cp.oob_data = 0x00;
3238
3239                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
3240                              sizeof(cp), &cp);
3241         } else {
3242                 struct hci_cp_io_capability_neg_reply cp;
3243
3244                 bacpy(&cp.bdaddr, &ev->bdaddr);
3245                 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
3246
3247                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
3248                              sizeof(cp), &cp);
3249         }
3250
3251 unlock:
3252         hci_dev_unlock(hdev);
3253 }
3254
3255 static void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
3256 {
3257         struct hci_ev_io_capa_reply *ev = (void *) skb->data;
3258         struct hci_conn *conn;
3259
3260         BT_DBG("%s", hdev->name);
3261
3262         hci_dev_lock(hdev);
3263
3264         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3265         if (!conn)
3266                 goto unlock;
3267
3268         conn->remote_cap = ev->capability;
3269         conn->remote_auth = ev->authentication;
3270         if (ev->oob_data)
3271                 set_bit(HCI_CONN_REMOTE_OOB, &conn->flags);
3272
3273 unlock:
3274         hci_dev_unlock(hdev);
3275 }
3276
3277 static void hci_user_confirm_request_evt(struct hci_dev *hdev,
3278                                          struct sk_buff *skb)
3279 {
3280         struct hci_ev_user_confirm_req *ev = (void *) skb->data;
3281         int loc_mitm, rem_mitm, confirm_hint = 0;
3282         struct hci_conn *conn;
3283
3284         BT_DBG("%s", hdev->name);
3285
3286         hci_dev_lock(hdev);
3287
3288         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3289                 goto unlock;
3290
3291         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3292         if (!conn)
3293                 goto unlock;
3294
3295         loc_mitm = (conn->auth_type & 0x01);
3296         rem_mitm = (conn->remote_auth & 0x01);
3297
3298         /* If we require MITM but the remote device can't provide that
3299          * (it has NoInputNoOutput) then reject the confirmation
3300          * request. The only exception is when we're dedicated bonding
3301          * initiators (connect_cfm_cb set) since then we always have the MITM
3302          * bit set. */
3303         if (!conn->connect_cfm_cb && loc_mitm && conn->remote_cap == 0x03) {
3304                 BT_DBG("Rejecting request: remote device can't provide MITM");
3305                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
3306                              sizeof(ev->bdaddr), &ev->bdaddr);
3307                 goto unlock;
3308         }
3309
3310         /* If no side requires MITM protection; auto-accept */
3311         if ((!loc_mitm || conn->remote_cap == 0x03) &&
3312             (!rem_mitm || conn->io_capability == 0x03)) {
3313
3314                 /* If we're not the initiators request authorization to
3315                  * proceed from user space (mgmt_user_confirm with
3316                  * confirm_hint set to 1). */
3317                 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
3318                         BT_DBG("Confirming auto-accept as acceptor");
3319                         confirm_hint = 1;
3320                         goto confirm;
3321                 }
3322
3323                 BT_DBG("Auto-accept of user confirmation with %ums delay",
3324                        hdev->auto_accept_delay);
3325
3326                 if (hdev->auto_accept_delay > 0) {
3327                         int delay = msecs_to_jiffies(hdev->auto_accept_delay);
3328                         mod_timer(&conn->auto_accept_timer, jiffies + delay);
3329                         goto unlock;
3330                 }
3331
3332                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
3333                              sizeof(ev->bdaddr), &ev->bdaddr);
3334                 goto unlock;
3335         }
3336
3337 confirm:
3338         mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0, ev->passkey,
3339                                   confirm_hint);
3340
3341 unlock:
3342         hci_dev_unlock(hdev);
3343 }
3344
3345 static void hci_user_passkey_request_evt(struct hci_dev *hdev,
3346                                          struct sk_buff *skb)
3347 {
3348         struct hci_ev_user_passkey_req *ev = (void *) skb->data;
3349
3350         BT_DBG("%s", hdev->name);
3351
3352         if (test_bit(HCI_MGMT, &hdev->dev_flags))
3353                 mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
3354 }
3355
3356 static void hci_user_passkey_notify_evt(struct hci_dev *hdev,
3357                                         struct sk_buff *skb)
3358 {
3359         struct hci_ev_user_passkey_notify *ev = (void *) skb->data;
3360         struct hci_conn *conn;
3361
3362         BT_DBG("%s", hdev->name);
3363
3364         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3365         if (!conn)
3366                 return;
3367
3368         conn->passkey_notify = __le32_to_cpu(ev->passkey);
3369         conn->passkey_entered = 0;
3370
3371         if (test_bit(HCI_MGMT, &hdev->dev_flags))
3372                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
3373                                          conn->dst_type, conn->passkey_notify,
3374                                          conn->passkey_entered);
3375 }
3376
3377 static void hci_keypress_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
3378 {
3379         struct hci_ev_keypress_notify *ev = (void *) skb->data;
3380         struct hci_conn *conn;
3381
3382         BT_DBG("%s", hdev->name);
3383
3384         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3385         if (!conn)
3386                 return;
3387
3388         switch (ev->type) {
3389         case HCI_KEYPRESS_STARTED:
3390                 conn->passkey_entered = 0;
3391                 return;
3392
3393         case HCI_KEYPRESS_ENTERED:
3394                 conn->passkey_entered++;
3395                 break;
3396
3397         case HCI_KEYPRESS_ERASED:
3398                 conn->passkey_entered--;
3399                 break;
3400
3401         case HCI_KEYPRESS_CLEARED:
3402                 conn->passkey_entered = 0;
3403                 break;
3404
3405         case HCI_KEYPRESS_COMPLETED:
3406                 return;
3407         }
3408
3409         if (test_bit(HCI_MGMT, &hdev->dev_flags))
3410                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
3411                                          conn->dst_type, conn->passkey_notify,
3412                                          conn->passkey_entered);
3413 }
3414
3415 static void hci_simple_pair_complete_evt(struct hci_dev *hdev,
3416                                          struct sk_buff *skb)
3417 {
3418         struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
3419         struct hci_conn *conn;
3420
3421         BT_DBG("%s", hdev->name);
3422
3423         hci_dev_lock(hdev);
3424
3425         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3426         if (!conn)
3427                 goto unlock;
3428
3429         /* To avoid duplicate auth_failed events to user space we check
3430          * the HCI_CONN_AUTH_PEND flag which will be set if we
3431          * initiated the authentication. A traditional auth_complete
3432          * event gets always produced as initiator and is also mapped to
3433          * the mgmt_auth_failed event */
3434         if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status)
3435                 mgmt_auth_failed(hdev, &conn->dst, conn->type, conn->dst_type,
3436                                  ev->status);
3437
3438         hci_conn_put(conn);
3439
3440 unlock:
3441         hci_dev_unlock(hdev);
3442 }
3443
3444 static void hci_remote_host_features_evt(struct hci_dev *hdev,
3445                                          struct sk_buff *skb)
3446 {
3447         struct hci_ev_remote_host_features *ev = (void *) skb->data;
3448         struct inquiry_entry *ie;
3449
3450         BT_DBG("%s", hdev->name);
3451
3452         hci_dev_lock(hdev);
3453
3454         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
3455         if (ie)
3456                 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
3457
3458         hci_dev_unlock(hdev);
3459 }
3460
3461 static void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
3462                                             struct sk_buff *skb)
3463 {
3464         struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
3465         struct oob_data *data;
3466
3467         BT_DBG("%s", hdev->name);
3468
3469         hci_dev_lock(hdev);
3470
3471         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3472                 goto unlock;
3473
3474         data = hci_find_remote_oob_data(hdev, &ev->bdaddr);
3475         if (data) {
3476                 struct hci_cp_remote_oob_data_reply cp;
3477
3478                 bacpy(&cp.bdaddr, &ev->bdaddr);
3479                 memcpy(cp.hash, data->hash, sizeof(cp.hash));
3480                 memcpy(cp.randomizer, data->randomizer, sizeof(cp.randomizer));
3481
3482                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY, sizeof(cp),
3483                              &cp);
3484         } else {
3485                 struct hci_cp_remote_oob_data_neg_reply cp;
3486
3487                 bacpy(&cp.bdaddr, &ev->bdaddr);
3488                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY, sizeof(cp),
3489                              &cp);
3490         }
3491
3492 unlock:
3493         hci_dev_unlock(hdev);
3494 }
3495
3496 static void hci_phy_link_complete_evt(struct hci_dev *hdev,
3497                                       struct sk_buff *skb)
3498 {
3499         struct hci_ev_phy_link_complete *ev = (void *) skb->data;
3500         struct hci_conn *hcon, *bredr_hcon;
3501
3502         BT_DBG("%s handle 0x%2.2x status 0x%2.2x", hdev->name, ev->phy_handle,
3503                ev->status);
3504
3505         hci_dev_lock(hdev);
3506
3507         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
3508         if (!hcon) {
3509                 hci_dev_unlock(hdev);
3510                 return;
3511         }
3512
3513         if (ev->status) {
3514                 hci_conn_del(hcon);
3515                 hci_dev_unlock(hdev);
3516                 return;
3517         }
3518
3519         bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
3520
3521         hcon->state = BT_CONNECTED;
3522         bacpy(&hcon->dst, &bredr_hcon->dst);
3523
3524         hci_conn_hold(hcon);
3525         hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
3526         hci_conn_put(hcon);
3527
3528         hci_conn_hold_device(hcon);
3529         hci_conn_add_sysfs(hcon);
3530
3531         amp_physical_cfm(bredr_hcon, hcon);
3532
3533         hci_dev_unlock(hdev);
3534 }
3535
3536 static void hci_loglink_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
3537 {
3538         struct hci_ev_logical_link_complete *ev = (void *) skb->data;
3539         struct hci_conn *hcon;
3540         struct hci_chan *hchan;
3541         struct amp_mgr *mgr;
3542
3543         BT_DBG("%s log_handle 0x%4.4x phy_handle 0x%2.2x status 0x%2.2x",
3544                hdev->name, le16_to_cpu(ev->handle), ev->phy_handle,
3545                ev->status);
3546
3547         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
3548         if (!hcon)
3549                 return;
3550
3551         /* Create AMP hchan */
3552         hchan = hci_chan_create(hcon);
3553         if (!hchan)
3554                 return;
3555
3556         hchan->handle = le16_to_cpu(ev->handle);
3557
3558         BT_DBG("hcon %p mgr %p hchan %p", hcon, hcon->amp_mgr, hchan);
3559
3560         mgr = hcon->amp_mgr;
3561         if (mgr && mgr->bredr_chan) {
3562                 struct l2cap_chan *bredr_chan = mgr->bredr_chan;
3563
3564                 l2cap_chan_lock(bredr_chan);
3565
3566                 bredr_chan->conn->mtu = hdev->block_mtu;
3567                 l2cap_logical_cfm(bredr_chan, hchan, 0);
3568                 hci_conn_hold(hcon);
3569
3570                 l2cap_chan_unlock(bredr_chan);
3571         }
3572 }
3573
3574 static void hci_disconn_loglink_complete_evt(struct hci_dev *hdev,
3575                                              struct sk_buff *skb)
3576 {
3577         struct hci_ev_disconn_logical_link_complete *ev = (void *) skb->data;
3578         struct hci_chan *hchan;
3579
3580         BT_DBG("%s log handle 0x%4.4x status 0x%2.2x", hdev->name,
3581                le16_to_cpu(ev->handle), ev->status);
3582
3583         if (ev->status)
3584                 return;
3585
3586         hci_dev_lock(hdev);
3587
3588         hchan = hci_chan_lookup_handle(hdev, le16_to_cpu(ev->handle));
3589         if (!hchan)
3590                 goto unlock;
3591
3592         amp_destroy_logical_link(hchan, ev->reason);
3593
3594 unlock:
3595         hci_dev_unlock(hdev);
3596 }
3597
3598 static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev,
3599                                              struct sk_buff *skb)
3600 {
3601         struct hci_ev_disconn_phy_link_complete *ev = (void *) skb->data;
3602         struct hci_conn *hcon;
3603
3604         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3605
3606         if (ev->status)
3607                 return;
3608
3609         hci_dev_lock(hdev);
3610
3611         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
3612         if (hcon) {
3613                 hcon->state = BT_CLOSED;
3614                 hci_conn_del(hcon);
3615         }
3616
3617         hci_dev_unlock(hdev);
3618 }
3619
3620 static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
3621 {
3622         struct hci_ev_le_conn_complete *ev = (void *) skb->data;
3623         struct hci_conn *conn;
3624
3625         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3626
3627         hci_dev_lock(hdev);
3628
3629         conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
3630         if (!conn) {
3631                 conn = hci_conn_add(hdev, LE_LINK, &ev->bdaddr);
3632                 if (!conn) {
3633                         BT_ERR("No memory for new connection");
3634                         goto unlock;
3635                 }
3636
3637                 conn->dst_type = ev->bdaddr_type;
3638
3639                 if (ev->role == LE_CONN_ROLE_MASTER) {
3640                         conn->out = true;
3641                         conn->link_mode |= HCI_LM_MASTER;
3642                 }
3643         }
3644
3645         if (ev->status) {
3646                 mgmt_connect_failed(hdev, &conn->dst, conn->type,
3647                                     conn->dst_type, ev->status);
3648                 hci_proto_connect_cfm(conn, ev->status);
3649                 conn->state = BT_CLOSED;
3650                 hci_conn_del(conn);
3651                 goto unlock;
3652         }
3653
3654         if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
3655                 mgmt_device_connected(hdev, &ev->bdaddr, conn->type,
3656                                       conn->dst_type, 0, NULL, 0, NULL);
3657
3658         conn->sec_level = BT_SECURITY_LOW;
3659         conn->handle = __le16_to_cpu(ev->handle);
3660         conn->state = BT_CONNECTED;
3661
3662         hci_conn_hold_device(conn);
3663         hci_conn_add_sysfs(conn);
3664
3665         hci_proto_connect_cfm(conn, ev->status);
3666
3667 unlock:
3668         hci_dev_unlock(hdev);
3669 }
3670
3671 static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
3672 {
3673         u8 num_reports = skb->data[0];
3674         void *ptr = &skb->data[1];
3675         s8 rssi;
3676
3677         while (num_reports--) {
3678                 struct hci_ev_le_advertising_info *ev = ptr;
3679
3680                 rssi = ev->data[ev->length];
3681                 mgmt_device_found(hdev, &ev->bdaddr, LE_LINK, ev->bdaddr_type,
3682                                   NULL, rssi, 0, 1, ev->data, ev->length);
3683
3684                 ptr += sizeof(*ev) + ev->length + 1;
3685         }
3686 }
3687
3688 static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3689 {
3690         struct hci_ev_le_ltk_req *ev = (void *) skb->data;
3691         struct hci_cp_le_ltk_reply cp;
3692         struct hci_cp_le_ltk_neg_reply neg;
3693         struct hci_conn *conn;
3694         struct smp_ltk *ltk;
3695
3696         BT_DBG("%s handle 0x%4.4x", hdev->name, __le16_to_cpu(ev->handle));
3697
3698         hci_dev_lock(hdev);
3699
3700         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3701         if (conn == NULL)
3702                 goto not_found;
3703
3704         ltk = hci_find_ltk(hdev, ev->ediv, ev->random);
3705         if (ltk == NULL)
3706                 goto not_found;
3707
3708         memcpy(cp.ltk, ltk->val, sizeof(ltk->val));
3709         cp.handle = cpu_to_le16(conn->handle);
3710
3711         if (ltk->authenticated)
3712                 conn->sec_level = BT_SECURITY_HIGH;
3713
3714         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
3715
3716         if (ltk->type & HCI_SMP_STK) {
3717                 list_del(&ltk->list);
3718                 kfree(ltk);
3719         }
3720
3721         hci_dev_unlock(hdev);
3722
3723         return;
3724
3725 not_found:
3726         neg.handle = ev->handle;
3727         hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
3728         hci_dev_unlock(hdev);
3729 }
3730
3731 static void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
3732 {
3733         struct hci_ev_le_meta *le_ev = (void *) skb->data;
3734
3735         skb_pull(skb, sizeof(*le_ev));
3736
3737         switch (le_ev->subevent) {
3738         case HCI_EV_LE_CONN_COMPLETE:
3739                 hci_le_conn_complete_evt(hdev, skb);
3740                 break;
3741
3742         case HCI_EV_LE_ADVERTISING_REPORT:
3743                 hci_le_adv_report_evt(hdev, skb);
3744                 break;
3745
3746         case HCI_EV_LE_LTK_REQ:
3747                 hci_le_ltk_request_evt(hdev, skb);
3748                 break;
3749
3750         default:
3751                 break;
3752         }
3753 }
3754
3755 static void hci_chan_selected_evt(struct hci_dev *hdev, struct sk_buff *skb)
3756 {
3757         struct hci_ev_channel_selected *ev = (void *) skb->data;
3758         struct hci_conn *hcon;
3759
3760         BT_DBG("%s handle 0x%2.2x", hdev->name, ev->phy_handle);
3761
3762         skb_pull(skb, sizeof(*ev));
3763
3764         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
3765         if (!hcon)
3766                 return;
3767
3768         amp_read_loc_assoc_final_data(hdev, hcon);
3769 }
3770
3771 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
3772 {
3773         struct hci_event_hdr *hdr = (void *) skb->data;
3774         __u8 event = hdr->evt;
3775
3776         skb_pull(skb, HCI_EVENT_HDR_SIZE);
3777
3778         switch (event) {
3779         case HCI_EV_INQUIRY_COMPLETE:
3780                 hci_inquiry_complete_evt(hdev, skb);
3781                 break;
3782
3783         case HCI_EV_INQUIRY_RESULT:
3784                 hci_inquiry_result_evt(hdev, skb);
3785                 break;
3786
3787         case HCI_EV_CONN_COMPLETE:
3788                 hci_conn_complete_evt(hdev, skb);
3789                 break;
3790
3791         case HCI_EV_CONN_REQUEST:
3792                 hci_conn_request_evt(hdev, skb);
3793                 break;
3794
3795         case HCI_EV_DISCONN_COMPLETE:
3796                 hci_disconn_complete_evt(hdev, skb);
3797                 break;
3798
3799         case HCI_EV_AUTH_COMPLETE:
3800                 hci_auth_complete_evt(hdev, skb);
3801                 break;
3802
3803         case HCI_EV_REMOTE_NAME:
3804                 hci_remote_name_evt(hdev, skb);
3805                 break;
3806
3807         case HCI_EV_ENCRYPT_CHANGE:
3808                 hci_encrypt_change_evt(hdev, skb);
3809                 break;
3810
3811         case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
3812                 hci_change_link_key_complete_evt(hdev, skb);
3813                 break;
3814
3815         case HCI_EV_REMOTE_FEATURES:
3816                 hci_remote_features_evt(hdev, skb);
3817                 break;
3818
3819         case HCI_EV_REMOTE_VERSION:
3820                 hci_remote_version_evt(hdev, skb);
3821                 break;
3822
3823         case HCI_EV_QOS_SETUP_COMPLETE:
3824                 hci_qos_setup_complete_evt(hdev, skb);
3825                 break;
3826
3827         case HCI_EV_CMD_COMPLETE:
3828                 hci_cmd_complete_evt(hdev, skb);
3829                 break;
3830
3831         case HCI_EV_CMD_STATUS:
3832                 hci_cmd_status_evt(hdev, skb);
3833                 break;
3834
3835         case HCI_EV_ROLE_CHANGE:
3836                 hci_role_change_evt(hdev, skb);
3837                 break;
3838
3839         case HCI_EV_NUM_COMP_PKTS:
3840                 hci_num_comp_pkts_evt(hdev, skb);
3841                 break;
3842
3843         case HCI_EV_MODE_CHANGE:
3844                 hci_mode_change_evt(hdev, skb);
3845                 break;
3846
3847         case HCI_EV_PIN_CODE_REQ:
3848                 hci_pin_code_request_evt(hdev, skb);
3849                 break;
3850
3851         case HCI_EV_LINK_KEY_REQ:
3852                 hci_link_key_request_evt(hdev, skb);
3853                 break;
3854
3855         case HCI_EV_LINK_KEY_NOTIFY:
3856                 hci_link_key_notify_evt(hdev, skb);
3857                 break;
3858
3859         case HCI_EV_CLOCK_OFFSET:
3860                 hci_clock_offset_evt(hdev, skb);
3861                 break;
3862
3863         case HCI_EV_PKT_TYPE_CHANGE:
3864                 hci_pkt_type_change_evt(hdev, skb);
3865                 break;
3866
3867         case HCI_EV_PSCAN_REP_MODE:
3868                 hci_pscan_rep_mode_evt(hdev, skb);
3869                 break;
3870
3871         case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
3872                 hci_inquiry_result_with_rssi_evt(hdev, skb);
3873                 break;
3874
3875         case HCI_EV_REMOTE_EXT_FEATURES:
3876                 hci_remote_ext_features_evt(hdev, skb);
3877                 break;
3878
3879         case HCI_EV_SYNC_CONN_COMPLETE:
3880                 hci_sync_conn_complete_evt(hdev, skb);
3881                 break;
3882
3883         case HCI_EV_SYNC_CONN_CHANGED:
3884                 hci_sync_conn_changed_evt(hdev, skb);
3885                 break;
3886
3887         case HCI_EV_SNIFF_SUBRATE:
3888                 hci_sniff_subrate_evt(hdev, skb);
3889                 break;
3890
3891         case HCI_EV_EXTENDED_INQUIRY_RESULT:
3892                 hci_extended_inquiry_result_evt(hdev, skb);
3893                 break;
3894
3895         case HCI_EV_KEY_REFRESH_COMPLETE:
3896                 hci_key_refresh_complete_evt(hdev, skb);
3897                 break;
3898
3899         case HCI_EV_IO_CAPA_REQUEST:
3900                 hci_io_capa_request_evt(hdev, skb);
3901                 break;
3902
3903         case HCI_EV_IO_CAPA_REPLY:
3904                 hci_io_capa_reply_evt(hdev, skb);
3905                 break;
3906
3907         case HCI_EV_USER_CONFIRM_REQUEST:
3908                 hci_user_confirm_request_evt(hdev, skb);
3909                 break;
3910
3911         case HCI_EV_USER_PASSKEY_REQUEST:
3912                 hci_user_passkey_request_evt(hdev, skb);
3913                 break;
3914
3915         case HCI_EV_USER_PASSKEY_NOTIFY:
3916                 hci_user_passkey_notify_evt(hdev, skb);
3917                 break;
3918
3919         case HCI_EV_KEYPRESS_NOTIFY:
3920                 hci_keypress_notify_evt(hdev, skb);
3921                 break;
3922
3923         case HCI_EV_SIMPLE_PAIR_COMPLETE:
3924                 hci_simple_pair_complete_evt(hdev, skb);
3925                 break;
3926
3927         case HCI_EV_REMOTE_HOST_FEATURES:
3928                 hci_remote_host_features_evt(hdev, skb);
3929                 break;
3930
3931         case HCI_EV_LE_META:
3932                 hci_le_meta_evt(hdev, skb);
3933                 break;
3934
3935         case HCI_EV_CHANNEL_SELECTED:
3936                 hci_chan_selected_evt(hdev, skb);
3937                 break;
3938
3939         case HCI_EV_REMOTE_OOB_DATA_REQUEST:
3940                 hci_remote_oob_data_request_evt(hdev, skb);
3941                 break;
3942
3943         case HCI_EV_PHY_LINK_COMPLETE:
3944                 hci_phy_link_complete_evt(hdev, skb);
3945                 break;
3946
3947         case HCI_EV_LOGICAL_LINK_COMPLETE:
3948                 hci_loglink_complete_evt(hdev, skb);
3949                 break;
3950
3951         case HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE:
3952                 hci_disconn_loglink_complete_evt(hdev, skb);
3953                 break;
3954
3955         case HCI_EV_DISCONN_PHY_LINK_COMPLETE:
3956                 hci_disconn_phylink_complete_evt(hdev, skb);
3957                 break;
3958
3959         case HCI_EV_NUM_COMP_BLOCKS:
3960                 hci_num_comp_blocks_evt(hdev, skb);
3961                 break;
3962
3963         default:
3964                 BT_DBG("%s event 0x%2.2x", hdev->name, event);
3965                 break;
3966         }
3967
3968         kfree_skb(skb);
3969         hdev->stat.evt_rx++;
3970 }