net/bluetooth/hci_event.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI event handling. */
  26
  27 #include <asm/unaligned.h>
  28
  29 #include <net/bluetooth/bluetooth.h>
  30 #include <net/bluetooth/hci_core.h>
  31 #include <net/bluetooth/mgmt.h>
  32
  33 #include "hci_request.h"
  34 #include "hci_debugfs.h"
  35 #include "a2mp.h"
  36 #include "amp.h"
  37 #include "smp.h"
  38
  39 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
  40                  "\x00\x00\x00\x00\x00\x00\x00\x00"
  41
  42 /* Handle HCI Event packets */
  43
  44 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
  45 {
  46         __u8 status = *((__u8 *) skb->data);
  47
  48         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  49
  50         if (status)
  51                 return;
  52
  53         clear_bit(HCI_INQUIRY, &hdev->flags);
  54         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
  55         wake_up_bit(&hdev->flags, HCI_INQUIRY);
  56
  57         hci_dev_lock(hdev);
  58         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
  59         hci_dev_unlock(hdev);
  60
  61         hci_conn_check_pending(hdev);
  62 }
  63
  64 static void hci_cc_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  65 {
  66         __u8 status = *((__u8 *) skb->data);
  67
  68         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  69
  70         if (status)
  71                 return;
  72
  73         set_bit(HCI_PERIODIC_INQ, &hdev->dev_flags);
  74 }
  75
  76 static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  77 {
  78         __u8 status = *((__u8 *) skb->data);
  79
  80         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  81
  82         if (status)
  83                 return;
  84
  85         clear_bit(HCI_PERIODIC_INQ, &hdev->dev_flags);
  86
  87         hci_conn_check_pending(hdev);
  88 }
  89
  90 static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev,
  91                                           struct sk_buff *skb)
  92 {
  93         BT_DBG("%s", hdev->name);
  94 }
  95
  96 static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
  97 {
  98         struct hci_rp_role_discovery *rp = (void *) skb->data;
  99         struct hci_conn *conn;
 100
 101         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 102
 103         if (rp->status)
 104                 return;
 105
 106         hci_dev_lock(hdev);
 107
 108         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 109         if (conn)
 110                 conn->role = rp->role;
 111
 112         hci_dev_unlock(hdev);
 113 }
 114
 115 static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 116 {
 117         struct hci_rp_read_link_policy *rp = (void *) skb->data;
 118         struct hci_conn *conn;
 119
 120         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 121
 122         if (rp->status)
 123                 return;
 124
 125         hci_dev_lock(hdev);
 126
 127         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 128         if (conn)
 129                 conn->link_policy = __le16_to_cpu(rp->policy);
 130
 131         hci_dev_unlock(hdev);
 132 }
 133
 134 static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 135 {
 136         struct hci_rp_write_link_policy *rp = (void *) skb->data;
 137         struct hci_conn *conn;
 138         void *sent;
 139
 140         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 141
 142         if (rp->status)
 143                 return;
 144
 145         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
 146         if (!sent)
 147                 return;
 148
 149         hci_dev_lock(hdev);
 150
 151         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 152         if (conn)
 153                 conn->link_policy = get_unaligned_le16(sent + 2);
 154
 155         hci_dev_unlock(hdev);
 156 }
 157
 158 static void hci_cc_read_def_link_policy(struct hci_dev *hdev,
 159                                         struct sk_buff *skb)
 160 {
 161         struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
 162
 163         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 164
 165         if (rp->status)
 166                 return;
 167
 168         hdev->link_policy = __le16_to_cpu(rp->policy);
 169 }
 170
 171 static void hci_cc_write_def_link_policy(struct hci_dev *hdev,
 172                                          struct sk_buff *skb)
 173 {
 174         __u8 status = *((__u8 *) skb->data);
 175         void *sent;
 176
 177         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 178
 179         if (status)
 180                 return;
 181
 182         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
 183         if (!sent)
 184                 return;
 185
 186         hdev->link_policy = get_unaligned_le16(sent);
 187 }
 188
 189 static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
 190 {
 191         __u8 status = *((__u8 *) skb->data);
 192
 193         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 194
 195         clear_bit(HCI_RESET, &hdev->flags);
 196
 197         if (status)
 198                 return;
 199
 200         /* Reset all non-persistent flags */
 201         hdev->dev_flags &= ~HCI_PERSISTENT_MASK;
 202
 203         hdev->discovery.state = DISCOVERY_STOPPED;
 204         hdev->inq_tx_power = HCI_TX_POWER_INVALID;
 205         hdev->adv_tx_power = HCI_TX_POWER_INVALID;
 206
 207         memset(hdev->adv_data, 0, sizeof(hdev->adv_data));
 208         hdev->adv_data_len = 0;
 209
 210         memset(hdev->scan_rsp_data, 0, sizeof(hdev->scan_rsp_data));
 211         hdev->scan_rsp_data_len = 0;
 212
 213         hdev->le_scan_type = LE_SCAN_PASSIVE;
 214
 215         hdev->ssp_debug_mode = 0;
 216
 217         hci_bdaddr_list_clear(&hdev->le_white_list);
 218 }
 219
 220 static void hci_cc_read_stored_link_key(struct hci_dev *hdev,
 221                                         struct sk_buff *skb)
 222 {
 223         struct hci_rp_read_stored_link_key *rp = (void *)skb->data;
 224         struct hci_cp_read_stored_link_key *sent;
 225
 226         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 227
 228         sent = hci_sent_cmd_data(hdev, HCI_OP_READ_STORED_LINK_KEY);
 229         if (!sent)
 230                 return;
 231
 232         if (!rp->status && sent->read_all == 0x01) {
 233                 hdev->stored_max_keys = rp->max_keys;
 234                 hdev->stored_num_keys = rp->num_keys;
 235         }
 236 }
 237
 238 static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
 239                                           struct sk_buff *skb)
 240 {
 241         struct hci_rp_delete_stored_link_key *rp = (void *)skb->data;
 242
 243         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 244
 245         if (rp->status)
 246                 return;
 247
 248         if (rp->num_keys <= hdev->stored_num_keys)
 249                 hdev->stored_num_keys -= rp->num_keys;
 250         else
 251                 hdev->stored_num_keys = 0;
 252 }
 253
 254 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 255 {
 256         __u8 status = *((__u8 *) skb->data);
 257         void *sent;
 258
 259         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 260
 261         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
 262         if (!sent)
 263                 return;
 264
 265         hci_dev_lock(hdev);
 266
 267         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 268                 mgmt_set_local_name_complete(hdev, sent, status);
 269         else if (!status)
 270                 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
 271
 272         hci_dev_unlock(hdev);
 273 }
 274
 275 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 276 {
 277         struct hci_rp_read_local_name *rp = (void *) skb->data;
 278
 279         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 280
 281         if (rp->status)
 282                 return;
 283
 284         if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
 285             test_bit(HCI_CONFIG, &hdev->dev_flags))
 286                 memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
 287 }
 288
 289 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
 290 {
 291         __u8 status = *((__u8 *) skb->data);
 292         void *sent;
 293
 294         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 295
 296         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
 297         if (!sent)
 298                 return;
 299
 300         hci_dev_lock(hdev);
 301
 302         if (!status) {
 303                 __u8 param = *((__u8 *) sent);
 304
 305                 if (param == AUTH_ENABLED)
 306                         set_bit(HCI_AUTH, &hdev->flags);
 307                 else
 308                         clear_bit(HCI_AUTH, &hdev->flags);
 309         }
 310
 311         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 312                 mgmt_auth_enable_complete(hdev, status);
 313
 314         hci_dev_unlock(hdev);
 315 }
 316
 317 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
 318 {
 319         __u8 status = *((__u8 *) skb->data);
 320         __u8 param;
 321         void *sent;
 322
 323         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 324
 325         if (status)
 326                 return;
 327
 328         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
 329         if (!sent)
 330                 return;
 331
 332         param = *((__u8 *) sent);
 333
 334         if (param)
 335                 set_bit(HCI_ENCRYPT, &hdev->flags);
 336         else
 337                 clear_bit(HCI_ENCRYPT, &hdev->flags);
 338 }
 339
 340 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
 341 {
 342         __u8 status = *((__u8 *) skb->data);
 343         __u8 param;
 344         void *sent;
 345
 346         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 347
 348         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
 349         if (!sent)
 350                 return;
 351
 352         param = *((__u8 *) sent);
 353
 354         hci_dev_lock(hdev);
 355
 356         if (status) {
 357                 hdev->discov_timeout = 0;
 358                 goto done;
 359         }
 360
 361         if (param & SCAN_INQUIRY)
 362                 set_bit(HCI_ISCAN, &hdev->flags);
 363         else
 364                 clear_bit(HCI_ISCAN, &hdev->flags);
 365
 366         if (param & SCAN_PAGE)
 367                 set_bit(HCI_PSCAN, &hdev->flags);
 368         else
 369                 clear_bit(HCI_PSCAN, &hdev->flags);
 370
 371 done:
 372         hci_dev_unlock(hdev);
 373 }
 374
 375 static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 376 {
 377         struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
 378
 379         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 380
 381         if (rp->status)
 382                 return;
 383
 384         memcpy(hdev->dev_class, rp->dev_class, 3);
 385
 386         BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
 387                hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
 388 }
 389
 390 static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 391 {
 392         __u8 status = *((__u8 *) skb->data);
 393         void *sent;
 394
 395         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 396
 397         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
 398         if (!sent)
 399                 return;
 400
 401         hci_dev_lock(hdev);
 402
 403         if (status == 0)
 404                 memcpy(hdev->dev_class, sent, 3);
 405
 406         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 407                 mgmt_set_class_of_dev_complete(hdev, sent, status);
 408
 409         hci_dev_unlock(hdev);
 410 }
 411
 412 static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 413 {
 414         struct hci_rp_read_voice_setting *rp = (void *) skb->data;
 415         __u16 setting;
 416
 417         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 418
 419         if (rp->status)
 420                 return;
 421
 422         setting = __le16_to_cpu(rp->voice_setting);
 423
 424         if (hdev->voice_setting == setting)
 425                 return;
 426
 427         hdev->voice_setting = setting;
 428
 429         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 430
 431         if (hdev->notify)
 432                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 433 }
 434
 435 static void hci_cc_write_voice_setting(struct hci_dev *hdev,
 436                                        struct sk_buff *skb)
 437 {
 438         __u8 status = *((__u8 *) skb->data);
 439         __u16 setting;
 440         void *sent;
 441
 442         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 443
 444         if (status)
 445                 return;
 446
 447         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
 448         if (!sent)
 449                 return;
 450
 451         setting = get_unaligned_le16(sent);
 452
 453         if (hdev->voice_setting == setting)
 454                 return;
 455
 456         hdev->voice_setting = setting;
 457
 458         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 459
 460         if (hdev->notify)
 461                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 462 }
 463
 464 static void hci_cc_read_num_supported_iac(struct hci_dev *hdev,
 465                                           struct sk_buff *skb)
 466 {
 467         struct hci_rp_read_num_supported_iac *rp = (void *) skb->data;
 468
 469         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 470
 471         if (rp->status)
 472                 return;
 473
 474         hdev->num_iac = rp->num_iac;
 475
 476         BT_DBG("%s num iac %d", hdev->name, hdev->num_iac);
 477 }
 478
 479 static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 480 {
 481         __u8 status = *((__u8 *) skb->data);
 482         struct hci_cp_write_ssp_mode *sent;
 483
 484         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 485
 486         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
 487         if (!sent)
 488                 return;
 489
 490         hci_dev_lock(hdev);
 491
 492         if (!status) {
 493                 if (sent->mode)
 494                         hdev->features[1][0] |= LMP_HOST_SSP;
 495                 else
 496                         hdev->features[1][0] &= ~LMP_HOST_SSP;
 497         }
 498
 499         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 500                 mgmt_ssp_enable_complete(hdev, sent->mode, status);
 501         else if (!status) {
 502                 if (sent->mode)
 503                         set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
 504                 else
 505                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
 506         }
 507
 508         hci_dev_unlock(hdev);
 509 }
 510
 511 static void hci_cc_write_sc_support(struct hci_dev *hdev, struct sk_buff *skb)
 512 {
 513         u8 status = *((u8 *) skb->data);
 514         struct hci_cp_write_sc_support *sent;
 515
 516         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 517
 518         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SC_SUPPORT);
 519         if (!sent)
 520                 return;
 521
 522         hci_dev_lock(hdev);
 523
 524         if (!status) {
 525                 if (sent->support)
 526                         hdev->features[1][0] |= LMP_HOST_SC;
 527                 else
 528                         hdev->features[1][0] &= ~LMP_HOST_SC;
 529         }
 530
 531         if (!test_bit(HCI_MGMT, &hdev->dev_flags) && !status) {
 532                 if (sent->support)
 533                         set_bit(HCI_SC_ENABLED, &hdev->dev_flags);
 534                 else
 535                         clear_bit(HCI_SC_ENABLED, &hdev->dev_flags);
 536         }
 537
 538         hci_dev_unlock(hdev);
 539 }
 540
 541 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
 542 {
 543         struct hci_rp_read_local_version *rp = (void *) skb->data;
 544
 545         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 546
 547         if (rp->status)
 548                 return;
 549
 550         if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
 551             test_bit(HCI_CONFIG, &hdev->dev_flags)) {
 552                 hdev->hci_ver = rp->hci_ver;
 553                 hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
 554                 hdev->lmp_ver = rp->lmp_ver;
 555                 hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
 556                 hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
 557         }
 558 }
 559
 560 static void hci_cc_read_local_commands(struct hci_dev *hdev,
 561                                        struct sk_buff *skb)
 562 {
 563         struct hci_rp_read_local_commands *rp = (void *) skb->data;
 564
 565         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 566
 567         if (rp->status)
 568                 return;
 569
 570         if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
 571             test_bit(HCI_CONFIG, &hdev->dev_flags))
 572                 memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 573 }
 574
 575 static void hci_cc_read_local_features(struct hci_dev *hdev,
 576                                        struct sk_buff *skb)
 577 {
 578         struct hci_rp_read_local_features *rp = (void *) skb->data;
 579
 580         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 581
 582         if (rp->status)
 583                 return;
 584
 585         memcpy(hdev->features, rp->features, 8);
 586
 587         /* Adjust default settings according to features
 588          * supported by device. */
 589
 590         if (hdev->features[0][0] & LMP_3SLOT)
 591                 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 592
 593         if (hdev->features[0][0] & LMP_5SLOT)
 594                 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 595
 596         if (hdev->features[0][1] & LMP_HV2) {
 597                 hdev->pkt_type  |= (HCI_HV2);
 598                 hdev->esco_type |= (ESCO_HV2);
 599         }
 600
 601         if (hdev->features[0][1] & LMP_HV3) {
 602                 hdev->pkt_type  |= (HCI_HV3);
 603                 hdev->esco_type |= (ESCO_HV3);
 604         }
 605
 606         if (lmp_esco_capable(hdev))
 607                 hdev->esco_type |= (ESCO_EV3);
 608
 609         if (hdev->features[0][4] & LMP_EV4)
 610                 hdev->esco_type |= (ESCO_EV4);
 611
 612         if (hdev->features[0][4] & LMP_EV5)
 613                 hdev->esco_type |= (ESCO_EV5);
 614
 615         if (hdev->features[0][5] & LMP_EDR_ESCO_2M)
 616                 hdev->esco_type |= (ESCO_2EV3);
 617
 618         if (hdev->features[0][5] & LMP_EDR_ESCO_3M)
 619                 hdev->esco_type |= (ESCO_3EV3);
 620
 621         if (hdev->features[0][5] & LMP_EDR_3S_ESCO)
 622                 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
 623 }
 624
 625 static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
 626                                            struct sk_buff *skb)
 627 {
 628         struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
 629
 630         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 631
 632         if (rp->status)
 633                 return;
 634
 635         if (hdev->max_page < rp->max_page)
 636                 hdev->max_page = rp->max_page;
 637
 638         if (rp->page < HCI_MAX_PAGES)
 639                 memcpy(hdev->features[rp->page], rp->features, 8);
 640 }
 641
 642 static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
 643                                           struct sk_buff *skb)
 644 {
 645         struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;
 646
 647         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 648
 649         if (rp->status)
 650                 return;
 651
 652         hdev->flow_ctl_mode = rp->mode;
 653 }
 654
 655 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 656 {
 657         struct hci_rp_read_buffer_size *rp = (void *) skb->data;
 658
 659         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 660
 661         if (rp->status)
 662                 return;
 663
 664         hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
 665         hdev->sco_mtu  = rp->sco_mtu;
 666         hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
 667         hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
 668
 669         if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
 670                 hdev->sco_mtu  = 64;
 671                 hdev->sco_pkts = 8;
 672         }
 673
 674         hdev->acl_cnt = hdev->acl_pkts;
 675         hdev->sco_cnt = hdev->sco_pkts;
 676
 677         BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
 678                hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
 679 }
 680
 681 static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
 682 {
 683         struct hci_rp_read_bd_addr *rp = (void *) skb->data;
 684
 685         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 686
 687         if (rp->status)
 688                 return;
 689
 690         if (test_bit(HCI_INIT, &hdev->flags))
 691                 bacpy(&hdev->bdaddr, &rp->bdaddr);
 692
 693         if (test_bit(HCI_SETUP, &hdev->dev_flags))
 694                 bacpy(&hdev->setup_addr, &rp->bdaddr);
 695 }
 696
 697 static void hci_cc_read_page_scan_activity(struct hci_dev *hdev,
 698                                            struct sk_buff *skb)
 699 {
 700         struct hci_rp_read_page_scan_activity *rp = (void *) skb->data;
 701
 702         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 703
 704         if (rp->status)
 705                 return;
 706
 707         if (test_bit(HCI_INIT, &hdev->flags)) {
 708                 hdev->page_scan_interval = __le16_to_cpu(rp->interval);
 709                 hdev->page_scan_window = __le16_to_cpu(rp->window);
 710         }
 711 }
 712
 713 static void hci_cc_write_page_scan_activity(struct hci_dev *hdev,
 714                                             struct sk_buff *skb)
 715 {
 716         u8 status = *((u8 *) skb->data);
 717         struct hci_cp_write_page_scan_activity *sent;
 718
 719         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 720
 721         if (status)
 722                 return;
 723
 724         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY);
 725         if (!sent)
 726                 return;
 727
 728         hdev->page_scan_interval = __le16_to_cpu(sent->interval);
 729         hdev->page_scan_window = __le16_to_cpu(sent->window);
 730 }
 731
 732 static void hci_cc_read_page_scan_type(struct hci_dev *hdev,
 733                                            struct sk_buff *skb)
 734 {
 735         struct hci_rp_read_page_scan_type *rp = (void *) skb->data;
 736
 737         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 738
 739         if (rp->status)
 740                 return;
 741
 742         if (test_bit(HCI_INIT, &hdev->flags))
 743                 hdev->page_scan_type = rp->type;
 744 }
 745
 746 static void hci_cc_write_page_scan_type(struct hci_dev *hdev,
 747                                         struct sk_buff *skb)
 748 {
 749         u8 status = *((u8 *) skb->data);
 750         u8 *type;
 751
 752         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 753
 754         if (status)
 755                 return;
 756
 757         type = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE);
 758         if (type)
 759                 hdev->page_scan_type = *type;
 760 }
 761
 762 static void hci_cc_read_data_block_size(struct hci_dev *hdev,
 763                                         struct sk_buff *skb)
 764 {
 765         struct hci_rp_read_data_block_size *rp = (void *) skb->data;
 766
 767         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 768
 769         if (rp->status)
 770                 return;
 771
 772         hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
 773         hdev->block_len = __le16_to_cpu(rp->block_len);
 774         hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
 775
 776         hdev->block_cnt = hdev->num_blocks;
 777
 778         BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
 779                hdev->block_cnt, hdev->block_len);
 780 }
 781
 782 static void hci_cc_read_clock(struct hci_dev *hdev, struct sk_buff *skb)
 783 {
 784         struct hci_rp_read_clock *rp = (void *) skb->data;
 785         struct hci_cp_read_clock *cp;
 786         struct hci_conn *conn;
 787
 788         BT_DBG("%s", hdev->name);
 789
 790         if (skb->len < sizeof(*rp))
 791                 return;
 792
 793         if (rp->status)
 794                 return;
 795
 796         hci_dev_lock(hdev);
 797
 798         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
 799         if (!cp)
 800                 goto unlock;
 801
 802         if (cp->which == 0x00) {
 803                 hdev->clock = le32_to_cpu(rp->clock);
 804                 goto unlock;
 805         }
 806
 807         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 808         if (conn) {
 809                 conn->clock = le32_to_cpu(rp->clock);
 810                 conn->clock_accuracy = le16_to_cpu(rp->accuracy);
 811         }
 812
 813 unlock:
 814         hci_dev_unlock(hdev);
 815 }
 816
 817 static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
 818                                        struct sk_buff *skb)
 819 {
 820         struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
 821
 822         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 823
 824         if (rp->status)
 825                 goto a2mp_rsp;
 826
 827         hdev->amp_status = rp->amp_status;
 828         hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
 829         hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
 830         hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
 831         hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
 832         hdev->amp_type = rp->amp_type;
 833         hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
 834         hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
 835         hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
 836         hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
 837
 838 a2mp_rsp:
 839         a2mp_send_getinfo_rsp(hdev);
 840 }
 841
 842 static void hci_cc_read_local_amp_assoc(struct hci_dev *hdev,
 843                                         struct sk_buff *skb)
 844 {
 845         struct hci_rp_read_local_amp_assoc *rp = (void *) skb->data;
 846         struct amp_assoc *assoc = &hdev->loc_assoc;
 847         size_t rem_len, frag_len;
 848
 849         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 850
 851         if (rp->status)
 852                 goto a2mp_rsp;
 853
 854         frag_len = skb->len - sizeof(*rp);
 855         rem_len = __le16_to_cpu(rp->rem_len);
 856
 857         if (rem_len > frag_len) {
 858                 BT_DBG("frag_len %zu rem_len %zu", frag_len, rem_len);
 859
 860                 memcpy(assoc->data + assoc->offset, rp->frag, frag_len);
 861                 assoc->offset += frag_len;
 862
 863                 /* Read other fragments */
 864                 amp_read_loc_assoc_frag(hdev, rp->phy_handle);
 865
 866                 return;
 867         }
 868
 869         memcpy(assoc->data + assoc->offset, rp->frag, rem_len);
 870         assoc->len = assoc->offset + rem_len;
 871         assoc->offset = 0;
 872
 873 a2mp_rsp:
 874         /* Send A2MP Rsp when all fragments are received */
 875         a2mp_send_getampassoc_rsp(hdev, rp->status);
 876         a2mp_send_create_phy_link_req(hdev, rp->status);
 877 }
 878
 879 static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
 880                                          struct sk_buff *skb)
 881 {
 882         struct hci_rp_read_inq_rsp_tx_power *rp = (void *) skb->data;
 883
 884         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 885
 886         if (rp->status)
 887                 return;
 888
 889         hdev->inq_tx_power = rp->tx_power;
 890 }
 891
 892 static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
 893 {
 894         struct hci_rp_pin_code_reply *rp = (void *) skb->data;
 895         struct hci_cp_pin_code_reply *cp;
 896         struct hci_conn *conn;
 897
 898         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 899
 900         hci_dev_lock(hdev);
 901
 902         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 903                 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
 904
 905         if (rp->status)
 906                 goto unlock;
 907
 908         cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
 909         if (!cp)
 910                 goto unlock;
 911
 912         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 913         if (conn)
 914                 conn->pin_length = cp->pin_len;
 915
 916 unlock:
 917         hci_dev_unlock(hdev);
 918 }
 919
 920 static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
 921 {
 922         struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
 923
 924         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 925
 926         hci_dev_lock(hdev);
 927
 928         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 929                 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
 930                                                  rp->status);
 931
 932         hci_dev_unlock(hdev);
 933 }
 934
 935 static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
 936                                        struct sk_buff *skb)
 937 {
 938         struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
 939
 940         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 941
 942         if (rp->status)
 943                 return;
 944
 945         hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
 946         hdev->le_pkts = rp->le_max_pkt;
 947
 948         hdev->le_cnt = hdev->le_pkts;
 949
 950         BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
 951 }
 952
 953 static void hci_cc_le_read_local_features(struct hci_dev *hdev,
 954                                           struct sk_buff *skb)
 955 {
 956         struct hci_rp_le_read_local_features *rp = (void *) skb->data;
 957
 958         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 959
 960         if (rp->status)
 961                 return;
 962
 963         memcpy(hdev->le_features, rp->features, 8);
 964 }
 965
 966 static void hci_cc_le_read_adv_tx_power(struct hci_dev *hdev,
 967                                         struct sk_buff *skb)
 968 {
 969         struct hci_rp_le_read_adv_tx_power *rp = (void *) skb->data;
 970
 971         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 972
 973         if (rp->status)
 974                 return;
 975
 976         hdev->adv_tx_power = rp->tx_power;
 977 }
 978
 979 static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
 980 {
 981         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 982
 983         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 984
 985         hci_dev_lock(hdev);
 986
 987         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 988                 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,
 989                                                  rp->status);
 990
 991         hci_dev_unlock(hdev);
 992 }
 993
 994 static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
 995                                           struct sk_buff *skb)
 996 {
 997         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 998
 999         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1000
1001         hci_dev_lock(hdev);
1002
1003         if (test_bit(HCI_MGMT, &hdev->dev_flags))
1004                 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
1005                                                      ACL_LINK, 0, rp->status);
1006
1007         hci_dev_unlock(hdev);
1008 }
1009
1010 static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
1011 {
1012         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1013
1014         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1015
1016         hci_dev_lock(hdev);
1017
1018         if (test_bit(HCI_MGMT, &hdev->dev_flags))
1019                 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
1020                                                  0, rp->status);
1021
1022         hci_dev_unlock(hdev);
1023 }
1024
1025 static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
1026                                           struct sk_buff *skb)
1027 {
1028         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1029
1030         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1031
1032         hci_dev_lock(hdev);
1033
1034         if (test_bit(HCI_MGMT, &hdev->dev_flags))
1035                 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
1036                                                      ACL_LINK, 0, rp->status);
1037
1038         hci_dev_unlock(hdev);
1039 }
1040
1041 static void hci_cc_read_local_oob_data(struct hci_dev *hdev,
1042                                        struct sk_buff *skb)
1043 {
1044         struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
1045
1046         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1047
1048         hci_dev_lock(hdev);
1049         mgmt_read_local_oob_data_complete(hdev, rp->hash, rp->rand, NULL, NULL,
1050                                           rp->status);
1051         hci_dev_unlock(hdev);
1052 }
1053
1054 static void hci_cc_read_local_oob_ext_data(struct hci_dev *hdev,
1055                                            struct sk_buff *skb)
1056 {
1057         struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
1058
1059         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1060
1061         hci_dev_lock(hdev);
1062         mgmt_read_local_oob_data_complete(hdev, rp->hash192, rp->rand192,
1063                                           rp->hash256, rp->rand256,
1064                                           rp->status);
1065         hci_dev_unlock(hdev);
1066 }
1067
1068
1069 static void hci_cc_le_set_random_addr(struct hci_dev *hdev, struct sk_buff *skb)
1070 {
1071         __u8 status = *((__u8 *) skb->data);
1072         bdaddr_t *sent;
1073
1074         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1075
1076         if (status)
1077                 return;
1078
1079         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_RANDOM_ADDR);
1080         if (!sent)
1081                 return;
1082
1083         hci_dev_lock(hdev);
1084
1085         bacpy(&hdev->random_addr, sent);
1086
1087         hci_dev_unlock(hdev);
1088 }
1089
1090 static void hci_cc_le_set_adv_enable(struct hci_dev *hdev, struct sk_buff *skb)
1091 {
1092         __u8 *sent, status = *((__u8 *) skb->data);
1093
1094         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1095
1096         if (status)
1097                 return;
1098
1099         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_ENABLE);
1100         if (!sent)
1101                 return;
1102
1103         hci_dev_lock(hdev);
1104
1105         /* If we're doing connection initiation as peripheral. Set a
1106          * timeout in case something goes wrong.
1107          */
1108         if (*sent) {
1109                 struct hci_conn *conn;
1110
1111                 set_bit(HCI_LE_ADV, &hdev->dev_flags);
1112
1113                 conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
1114                 if (conn)
1115                         queue_delayed_work(hdev->workqueue,
1116                                            &conn->le_conn_timeout,
1117                                            conn->conn_timeout);
1118         } else {
1119                 clear_bit(HCI_LE_ADV, &hdev->dev_flags);
1120         }
1121
1122         hci_dev_unlock(hdev);
1123 }
1124
1125 static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
1126 {
1127         struct hci_cp_le_set_scan_param *cp;
1128         __u8 status = *((__u8 *) skb->data);
1129
1130         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1131
1132         if (status)
1133                 return;
1134
1135         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_PARAM);
1136         if (!cp)
1137                 return;
1138
1139         hci_dev_lock(hdev);
1140
1141         hdev->le_scan_type = cp->type;
1142
1143         hci_dev_unlock(hdev);
1144 }
1145
1146 static bool has_pending_adv_report(struct hci_dev *hdev)
1147 {
1148         struct discovery_state *d = &hdev->discovery;
1149
1150         return bacmp(&d->last_adv_addr, BDADDR_ANY);
1151 }
1152
1153 static void clear_pending_adv_report(struct hci_dev *hdev)
1154 {
1155         struct discovery_state *d = &hdev->discovery;
1156
1157         bacpy(&d->last_adv_addr, BDADDR_ANY);
1158         d->last_adv_data_len = 0;
1159 }
1160
1161 static void store_pending_adv_report(struct hci_dev *hdev, bdaddr_t *bdaddr,
1162                                      u8 bdaddr_type, s8 rssi, u32 flags,
1163                                      u8 *data, u8 len)
1164 {
1165         struct discovery_state *d = &hdev->discovery;
1166
1167         bacpy(&d->last_adv_addr, bdaddr);
1168         d->last_adv_addr_type = bdaddr_type;
1169         d->last_adv_rssi = rssi;
1170         d->last_adv_flags = flags;
1171         memcpy(d->last_adv_data, data, len);
1172         d->last_adv_data_len = len;
1173 }
1174
1175 static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
1176                                       struct sk_buff *skb)
1177 {
1178         struct hci_cp_le_set_scan_enable *cp;
1179         __u8 status = *((__u8 *) skb->data);
1180
1181         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1182
1183         if (status)
1184                 return;
1185
1186         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
1187         if (!cp)
1188                 return;
1189
1190         hci_dev_lock(hdev);
1191
1192         switch (cp->enable) {
1193         case LE_SCAN_ENABLE:
1194                 set_bit(HCI_LE_SCAN, &hdev->dev_flags);
1195                 if (hdev->le_scan_type == LE_SCAN_ACTIVE)
1196                         clear_pending_adv_report(hdev);
1197                 break;
1198
1199         case LE_SCAN_DISABLE:
1200                 /* We do this here instead of when setting DISCOVERY_STOPPED
1201                  * since the latter would potentially require waiting for
1202                  * inquiry to stop too.
1203                  */
1204                 if (has_pending_adv_report(hdev)) {
1205                         struct discovery_state *d = &hdev->discovery;
1206
1207                         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
1208                                           d->last_adv_addr_type, NULL,
1209                                           d->last_adv_rssi, d->last_adv_flags,
1210                                           d->last_adv_data,
1211                                           d->last_adv_data_len, NULL, 0);
1212                 }
1213
1214                 /* Cancel this timer so that we don't try to disable scanning
1215                  * when it's already disabled.
1216                  */
1217                 cancel_delayed_work(&hdev->le_scan_disable);
1218
1219                 clear_bit(HCI_LE_SCAN, &hdev->dev_flags);
1220
1221                 /* The HCI_LE_SCAN_INTERRUPTED flag indicates that we
1222                  * interrupted scanning due to a connect request. Mark
1223                  * therefore discovery as stopped. If this was not
1224                  * because of a connect request advertising might have
1225                  * been disabled because of active scanning, so
1226                  * re-enable it again if necessary.
1227                  */
1228                 if (test_and_clear_bit(HCI_LE_SCAN_INTERRUPTED,
1229                                        &hdev->dev_flags))
1230                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1231                 else if (!test_bit(HCI_LE_ADV, &hdev->dev_flags) &&
1232                          hdev->discovery.state == DISCOVERY_FINDING)
1233                         mgmt_reenable_advertising(hdev);
1234
1235                 break;
1236
1237         default:
1238                 BT_ERR("Used reserved LE_Scan_Enable param %d", cp->enable);
1239                 break;
1240         }
1241
1242         hci_dev_unlock(hdev);
1243 }
1244
1245 static void hci_cc_le_read_white_list_size(struct hci_dev *hdev,
1246                                            struct sk_buff *skb)
1247 {
1248         struct hci_rp_le_read_white_list_size *rp = (void *) skb->data;
1249
1250         BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
1251
1252         if (rp->status)
1253                 return;
1254
1255         hdev->le_white_list_size = rp->size;
1256 }
1257
1258 static void hci_cc_le_clear_white_list(struct hci_dev *hdev,
1259                                        struct sk_buff *skb)
1260 {
1261         __u8 status = *((__u8 *) skb->data);
1262
1263         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1264
1265         if (status)
1266                 return;
1267
1268         hci_bdaddr_list_clear(&hdev->le_white_list);
1269 }
1270
1271 static void hci_cc_le_add_to_white_list(struct hci_dev *hdev,
1272                                         struct sk_buff *skb)
1273 {
1274         struct hci_cp_le_add_to_white_list *sent;
1275         __u8 status = *((__u8 *) skb->data);
1276
1277         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1278
1279         if (status)
1280                 return;
1281
1282         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_WHITE_LIST);
1283         if (!sent)
1284                 return;
1285
1286         hci_bdaddr_list_add(&hdev->le_white_list, &sent->bdaddr,
1287                            sent->bdaddr_type);
1288 }
1289
1290 static void hci_cc_le_del_from_white_list(struct hci_dev *hdev,
1291                                           struct sk_buff *skb)
1292 {
1293         struct hci_cp_le_del_from_white_list *sent;
1294         __u8 status = *((__u8 *) skb->data);
1295
1296         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1297
1298         if (status)
1299                 return;
1300
1301         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_WHITE_LIST);
1302         if (!sent)
1303                 return;
1304
1305         hci_bdaddr_list_del(&hdev->le_white_list, &sent->bdaddr,
1306                             sent->bdaddr_type);
1307 }
1308
1309 static void hci_cc_le_read_supported_states(struct hci_dev *hdev,
1310                                             struct sk_buff *skb)
1311 {
1312         struct hci_rp_le_read_supported_states *rp = (void *) skb->data;
1313
1314         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1315
1316         if (rp->status)
1317                 return;
1318
1319         memcpy(hdev->le_states, rp->le_states, 8);
1320 }
1321
1322 static void hci_cc_le_read_def_data_len(struct hci_dev *hdev,
1323                                         struct sk_buff *skb)
1324 {
1325         struct hci_rp_le_read_def_data_len *rp = (void *) skb->data;
1326
1327         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1328
1329         if (rp->status)
1330                 return;
1331
1332         hdev->le_def_tx_len = le16_to_cpu(rp->tx_len);
1333         hdev->le_def_tx_time = le16_to_cpu(rp->tx_time);
1334 }
1335
1336 static void hci_cc_le_write_def_data_len(struct hci_dev *hdev,
1337                                          struct sk_buff *skb)
1338 {
1339         struct hci_cp_le_write_def_data_len *sent;
1340         __u8 status = *((__u8 *) skb->data);
1341
1342         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1343
1344         if (status)
1345                 return;
1346
1347         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_WRITE_DEF_DATA_LEN);
1348         if (!sent)
1349                 return;
1350
1351         hdev->le_def_tx_len = le16_to_cpu(sent->tx_len);
1352         hdev->le_def_tx_time = le16_to_cpu(sent->tx_time);
1353 }
1354
1355 static void hci_cc_le_read_max_data_len(struct hci_dev *hdev,
1356                                         struct sk_buff *skb)
1357 {
1358         struct hci_rp_le_read_max_data_len *rp = (void *) skb->data;
1359
1360         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1361
1362         if (rp->status)
1363                 return;
1364
1365         hdev->le_max_tx_len = le16_to_cpu(rp->tx_len);
1366         hdev->le_max_tx_time = le16_to_cpu(rp->tx_time);
1367         hdev->le_max_rx_len = le16_to_cpu(rp->rx_len);
1368         hdev->le_max_rx_time = le16_to_cpu(rp->rx_time);
1369 }
1370
1371 static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
1372                                            struct sk_buff *skb)
1373 {
1374         struct hci_cp_write_le_host_supported *sent;
1375         __u8 status = *((__u8 *) skb->data);
1376
1377         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1378
1379         if (status)
1380                 return;
1381
1382         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
1383         if (!sent)
1384                 return;
1385
1386         hci_dev_lock(hdev);
1387
1388         if (sent->le) {
1389                 hdev->features[1][0] |= LMP_HOST_LE;
1390                 set_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1391         } else {
1392                 hdev->features[1][0] &= ~LMP_HOST_LE;
1393                 clear_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1394                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
1395         }
1396
1397         if (sent->simul)
1398                 hdev->features[1][0] |= LMP_HOST_LE_BREDR;
1399         else
1400                 hdev->features[1][0] &= ~LMP_HOST_LE_BREDR;
1401
1402         hci_dev_unlock(hdev);
1403 }
1404
1405 static void hci_cc_set_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
1406 {
1407         struct hci_cp_le_set_adv_param *cp;
1408         u8 status = *((u8 *) skb->data);
1409
1410         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1411
1412         if (status)
1413                 return;
1414
1415         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_PARAM);
1416         if (!cp)
1417                 return;
1418
1419         hci_dev_lock(hdev);
1420         hdev->adv_addr_type = cp->own_address_type;
1421         hci_dev_unlock(hdev);
1422 }
1423
1424 static void hci_cc_write_remote_amp_assoc(struct hci_dev *hdev,
1425                                           struct sk_buff *skb)
1426 {
1427         struct hci_rp_write_remote_amp_assoc *rp = (void *) skb->data;
1428
1429         BT_DBG("%s status 0x%2.2x phy_handle 0x%2.2x",
1430                hdev->name, rp->status, rp->phy_handle);
1431
1432         if (rp->status)
1433                 return;
1434
1435         amp_write_rem_assoc_continue(hdev, rp->phy_handle);
1436 }
1437
1438 static void hci_cc_read_rssi(struct hci_dev *hdev, struct sk_buff *skb)
1439 {
1440         struct hci_rp_read_rssi *rp = (void *) skb->data;
1441         struct hci_conn *conn;
1442
1443         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1444
1445         if (rp->status)
1446                 return;
1447
1448         hci_dev_lock(hdev);
1449
1450         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1451         if (conn)
1452                 conn->rssi = rp->rssi;
1453
1454         hci_dev_unlock(hdev);
1455 }
1456
1457 static void hci_cc_read_tx_power(struct hci_dev *hdev, struct sk_buff *skb)
1458 {
1459         struct hci_cp_read_tx_power *sent;
1460         struct hci_rp_read_tx_power *rp = (void *) skb->data;
1461         struct hci_conn *conn;
1462
1463         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1464
1465         if (rp->status)
1466                 return;
1467
1468         sent = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
1469         if (!sent)
1470                 return;
1471
1472         hci_dev_lock(hdev);
1473
1474         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1475         if (!conn)
1476                 goto unlock;
1477
1478         switch (sent->type) {
1479         case 0x00:
1480                 conn->tx_power = rp->tx_power;
1481                 break;
1482         case 0x01:
1483                 conn->max_tx_power = rp->tx_power;
1484                 break;
1485         }
1486
1487 unlock:
1488         hci_dev_unlock(hdev);
1489 }
1490
1491 static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
1492 {
1493         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1494
1495         if (status) {
1496                 hci_conn_check_pending(hdev);
1497                 return;
1498         }
1499
1500         set_bit(HCI_INQUIRY, &hdev->flags);
1501 }
1502
1503 static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
1504 {
1505         struct hci_cp_create_conn *cp;
1506         struct hci_conn *conn;
1507
1508         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1509
1510         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
1511         if (!cp)
1512                 return;
1513
1514         hci_dev_lock(hdev);
1515
1516         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1517
1518         BT_DBG("%s bdaddr %pMR hcon %p", hdev->name, &cp->bdaddr, conn);
1519
1520         if (status) {
1521                 if (conn && conn->state == BT_CONNECT) {
1522                         if (status != 0x0c || conn->attempt > 2) {
1523                                 conn->state = BT_CLOSED;
1524                                 hci_proto_connect_cfm(conn, status);
1525                                 hci_conn_del(conn);
1526                         } else
1527                                 conn->state = BT_CONNECT2;
1528                 }
1529         } else {
1530                 if (!conn) {
1531                         conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr,
1532                                             HCI_ROLE_MASTER);
1533                         if (!conn)
1534                                 BT_ERR("No memory for new connection");
1535                 }
1536         }
1537
1538         hci_dev_unlock(hdev);
1539 }
1540
1541 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
1542 {
1543         struct hci_cp_add_sco *cp;
1544         struct hci_conn *acl, *sco;
1545         __u16 handle;
1546
1547         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1548
1549         if (!status)
1550                 return;
1551
1552         cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
1553         if (!cp)
1554                 return;
1555
1556         handle = __le16_to_cpu(cp->handle);
1557
1558         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1559
1560         hci_dev_lock(hdev);
1561
1562         acl = hci_conn_hash_lookup_handle(hdev, handle);
1563         if (acl) {
1564                 sco = acl->link;
1565                 if (sco) {
1566                         sco->state = BT_CLOSED;
1567
1568                         hci_proto_connect_cfm(sco, status);
1569                         hci_conn_del(sco);
1570                 }
1571         }
1572
1573         hci_dev_unlock(hdev);
1574 }
1575
1576 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
1577 {
1578         struct hci_cp_auth_requested *cp;
1579         struct hci_conn *conn;
1580
1581         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1582
1583         if (!status)
1584                 return;
1585
1586         cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
1587         if (!cp)
1588                 return;
1589
1590         hci_dev_lock(hdev);
1591
1592         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1593         if (conn) {
1594                 if (conn->state == BT_CONFIG) {
1595                         hci_proto_connect_cfm(conn, status);
1596                         hci_conn_drop(conn);
1597                 }
1598         }
1599
1600         hci_dev_unlock(hdev);
1601 }
1602
1603 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
1604 {
1605         struct hci_cp_set_conn_encrypt *cp;
1606         struct hci_conn *conn;
1607
1608         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1609
1610         if (!status)
1611                 return;
1612
1613         cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
1614         if (!cp)
1615                 return;
1616
1617         hci_dev_lock(hdev);
1618
1619         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1620         if (conn) {
1621                 if (conn->state == BT_CONFIG) {
1622                         hci_proto_connect_cfm(conn, status);
1623                         hci_conn_drop(conn);
1624                 }
1625         }
1626
1627         hci_dev_unlock(hdev);
1628 }
1629
1630 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
1631                                     struct hci_conn *conn)
1632 {
1633         if (conn->state != BT_CONFIG || !conn->out)
1634                 return 0;
1635
1636         if (conn->pending_sec_level == BT_SECURITY_SDP)
1637                 return 0;
1638
1639         /* Only request authentication for SSP connections or non-SSP
1640          * devices with sec_level MEDIUM or HIGH or if MITM protection
1641          * is requested.
1642          */
1643         if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
1644             conn->pending_sec_level != BT_SECURITY_FIPS &&
1645             conn->pending_sec_level != BT_SECURITY_HIGH &&
1646             conn->pending_sec_level != BT_SECURITY_MEDIUM)
1647                 return 0;
1648
1649         return 1;
1650 }
1651
1652 static int hci_resolve_name(struct hci_dev *hdev,
1653                                    struct inquiry_entry *e)
1654 {
1655         struct hci_cp_remote_name_req cp;
1656
1657         memset(&cp, 0, sizeof(cp));
1658
1659         bacpy(&cp.bdaddr, &e->data.bdaddr);
1660         cp.pscan_rep_mode = e->data.pscan_rep_mode;
1661         cp.pscan_mode = e->data.pscan_mode;
1662         cp.clock_offset = e->data.clock_offset;
1663
1664         return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1665 }
1666
1667 static bool hci_resolve_next_name(struct hci_dev *hdev)
1668 {
1669         struct discovery_state *discov = &hdev->discovery;
1670         struct inquiry_entry *e;
1671
1672         if (list_empty(&discov->resolve))
1673                 return false;
1674
1675         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
1676         if (!e)
1677                 return false;
1678
1679         if (hci_resolve_name(hdev, e) == 0) {
1680                 e->name_state = NAME_PENDING;
1681                 return true;
1682         }
1683
1684         return false;
1685 }
1686
1687 static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
1688                                    bdaddr_t *bdaddr, u8 *name, u8 name_len)
1689 {
1690         struct discovery_state *discov = &hdev->discovery;
1691         struct inquiry_entry *e;
1692
1693         /* Update the mgmt connected state if necessary. Be careful with
1694          * conn objects that exist but are not (yet) connected however.
1695          * Only those in BT_CONFIG or BT_CONNECTED states can be
1696          * considered connected.
1697          */
1698         if (conn &&
1699             (conn->state == BT_CONFIG || conn->state == BT_CONNECTED) &&
1700             !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
1701                 mgmt_device_connected(hdev, conn, 0, name, name_len);
1702
1703         if (discov->state == DISCOVERY_STOPPED)
1704                 return;
1705
1706         if (discov->state == DISCOVERY_STOPPING)
1707                 goto discov_complete;
1708
1709         if (discov->state != DISCOVERY_RESOLVING)
1710                 return;
1711
1712         e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
1713         /* If the device was not found in a list of found devices names of which
1714          * are pending. there is no need to continue resolving a next name as it
1715          * will be done upon receiving another Remote Name Request Complete
1716          * Event */
1717         if (!e)
1718                 return;
1719
1720         list_del(&e->list);
1721         if (name) {
1722                 e->name_state = NAME_KNOWN;
1723                 mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
1724                                  e->data.rssi, name, name_len);
1725         } else {
1726                 e->name_state = NAME_NOT_KNOWN;
1727         }
1728
1729         if (hci_resolve_next_name(hdev))
1730                 return;
1731
1732 discov_complete:
1733         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1734 }
1735
1736 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
1737 {
1738         struct hci_cp_remote_name_req *cp;
1739         struct hci_conn *conn;
1740
1741         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1742
1743         /* If successful wait for the name req complete event before
1744          * checking for the need to do authentication */
1745         if (!status)
1746                 return;
1747
1748         cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
1749         if (!cp)
1750                 return;
1751
1752         hci_dev_lock(hdev);
1753
1754         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1755
1756         if (test_bit(HCI_MGMT, &hdev->dev_flags))
1757                 hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
1758
1759         if (!conn)
1760                 goto unlock;
1761
1762         if (!hci_outgoing_auth_needed(hdev, conn))
1763                 goto unlock;
1764
1765         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
1766                 struct hci_cp_auth_requested auth_cp;
1767
1768                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
1769
1770                 auth_cp.handle = __cpu_to_le16(conn->handle);
1771                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
1772                              sizeof(auth_cp), &auth_cp);
1773         }
1774
1775 unlock:
1776         hci_dev_unlock(hdev);
1777 }
1778
1779 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
1780 {
1781         struct hci_cp_read_remote_features *cp;
1782         struct hci_conn *conn;
1783
1784         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1785
1786         if (!status)
1787                 return;
1788
1789         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
1790         if (!cp)
1791                 return;
1792
1793         hci_dev_lock(hdev);
1794
1795         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1796         if (conn) {
1797                 if (conn->state == BT_CONFIG) {
1798                         hci_proto_connect_cfm(conn, status);
1799                         hci_conn_drop(conn);
1800                 }
1801         }
1802
1803         hci_dev_unlock(hdev);
1804 }
1805
1806 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
1807 {
1808         struct hci_cp_read_remote_ext_features *cp;
1809         struct hci_conn *conn;
1810
1811         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1812
1813         if (!status)
1814                 return;
1815
1816         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
1817         if (!cp)
1818                 return;
1819
1820         hci_dev_lock(hdev);
1821
1822         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1823         if (conn) {
1824                 if (conn->state == BT_CONFIG) {
1825                         hci_proto_connect_cfm(conn, status);
1826                         hci_conn_drop(conn);
1827                 }
1828         }
1829
1830         hci_dev_unlock(hdev);
1831 }
1832
1833 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
1834 {
1835         struct hci_cp_setup_sync_conn *cp;
1836         struct hci_conn *acl, *sco;
1837         __u16 handle;
1838
1839         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1840
1841         if (!status)
1842                 return;
1843
1844         cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
1845         if (!cp)
1846                 return;
1847
1848         handle = __le16_to_cpu(cp->handle);
1849
1850         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1851
1852         hci_dev_lock(hdev);
1853
1854         acl = hci_conn_hash_lookup_handle(hdev, handle);
1855         if (acl) {
1856                 sco = acl->link;
1857                 if (sco) {
1858                         sco->state = BT_CLOSED;
1859
1860                         hci_proto_connect_cfm(sco, status);
1861                         hci_conn_del(sco);
1862                 }
1863         }
1864
1865         hci_dev_unlock(hdev);
1866 }
1867
1868 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
1869 {
1870         struct hci_cp_sniff_mode *cp;
1871         struct hci_conn *conn;
1872
1873         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1874
1875         if (!status)
1876                 return;
1877
1878         cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
1879         if (!cp)
1880                 return;
1881
1882         hci_dev_lock(hdev);
1883
1884         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1885         if (conn) {
1886                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1887
1888                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
1889                         hci_sco_setup(conn, status);
1890         }
1891
1892         hci_dev_unlock(hdev);
1893 }
1894
1895 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
1896 {
1897         struct hci_cp_exit_sniff_mode *cp;
1898         struct hci_conn *conn;
1899
1900         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1901
1902         if (!status)
1903                 return;
1904
1905         cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
1906         if (!cp)
1907                 return;
1908
1909         hci_dev_lock(hdev);
1910
1911         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1912         if (conn) {
1913                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1914
1915                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
1916                         hci_sco_setup(conn, status);
1917         }
1918
1919         hci_dev_unlock(hdev);
1920 }
1921
1922 static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
1923 {
1924         struct hci_cp_disconnect *cp;
1925         struct hci_conn *conn;
1926
1927         if (!status)
1928                 return;
1929
1930         cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
1931         if (!cp)
1932                 return;
1933
1934         hci_dev_lock(hdev);
1935
1936         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1937         if (conn)
1938                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
1939                                        conn->dst_type, status);
1940
1941         hci_dev_unlock(hdev);
1942 }
1943
1944 static void hci_cs_create_phylink(struct hci_dev *hdev, u8 status)
1945 {
1946         struct hci_cp_create_phy_link *cp;
1947
1948         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1949
1950         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_PHY_LINK);
1951         if (!cp)
1952                 return;
1953
1954         hci_dev_lock(hdev);
1955
1956         if (status) {
1957                 struct hci_conn *hcon;
1958
1959                 hcon = hci_conn_hash_lookup_handle(hdev, cp->phy_handle);
1960                 if (hcon)
1961                         hci_conn_del(hcon);
1962         } else {
1963                 amp_write_remote_assoc(hdev, cp->phy_handle);
1964         }
1965
1966         hci_dev_unlock(hdev);
1967 }
1968
1969 static void hci_cs_accept_phylink(struct hci_dev *hdev, u8 status)
1970 {
1971         struct hci_cp_accept_phy_link *cp;
1972
1973         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1974
1975         if (status)
1976                 return;
1977
1978         cp = hci_sent_cmd_data(hdev, HCI_OP_ACCEPT_PHY_LINK);
1979         if (!cp)
1980                 return;
1981
1982         amp_write_remote_assoc(hdev, cp->phy_handle);
1983 }
1984
1985 static void hci_cs_le_create_conn(struct hci_dev *hdev, u8 status)
1986 {
1987         struct hci_cp_le_create_conn *cp;
1988         struct hci_conn *conn;
1989
1990         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1991
1992         /* All connection failure handling is taken care of by the
1993          * hci_le_conn_failed function which is triggered by the HCI
1994          * request completion callbacks used for connecting.
1995          */
1996         if (status)
1997                 return;
1998
1999         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
2000         if (!cp)
2001                 return;
2002
2003         hci_dev_lock(hdev);
2004
2005         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->peer_addr);
2006         if (!conn)
2007                 goto unlock;
2008
2009         /* Store the initiator and responder address information which
2010          * is needed for SMP. These values will not change during the
2011          * lifetime of the connection.
2012          */
2013         conn->init_addr_type = cp->own_address_type;
2014         if (cp->own_address_type == ADDR_LE_DEV_RANDOM)
2015                 bacpy(&conn->init_addr, &hdev->random_addr);
2016         else
2017                 bacpy(&conn->init_addr, &hdev->bdaddr);
2018
2019         conn->resp_addr_type = cp->peer_addr_type;
2020         bacpy(&conn->resp_addr, &cp->peer_addr);
2021
2022         /* We don't want the connection attempt to stick around
2023          * indefinitely since LE doesn't have a page timeout concept
2024          * like BR/EDR. Set a timer for any connection that doesn't use
2025          * the white list for connecting.
2026          */
2027         if (cp->filter_policy == HCI_LE_USE_PEER_ADDR)
2028                 queue_delayed_work(conn->hdev->workqueue,
2029                                    &conn->le_conn_timeout,
2030                                    conn->conn_timeout);
2031
2032 unlock:
2033         hci_dev_unlock(hdev);
2034 }
2035
2036 static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
2037 {
2038         struct hci_cp_le_start_enc *cp;
2039         struct hci_conn *conn;
2040
2041         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2042
2043         if (!status)
2044                 return;
2045
2046         hci_dev_lock(hdev);
2047
2048         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_START_ENC);
2049         if (!cp)
2050                 goto unlock;
2051
2052         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2053         if (!conn)
2054                 goto unlock;
2055
2056         if (conn->state != BT_CONNECTED)
2057                 goto unlock;
2058
2059         hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2060         hci_conn_drop(conn);
2061
2062 unlock:
2063         hci_dev_unlock(hdev);
2064 }
2065
2066 static void hci_cs_switch_role(struct hci_dev *hdev, u8 status)
2067 {
2068         struct hci_cp_switch_role *cp;
2069         struct hci_conn *conn;
2070
2071         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2072
2073         if (!status)
2074                 return;
2075
2076         cp = hci_sent_cmd_data(hdev, HCI_OP_SWITCH_ROLE);
2077         if (!cp)
2078                 return;
2079
2080         hci_dev_lock(hdev);
2081
2082         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2083         if (conn)
2084                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
2085
2086         hci_dev_unlock(hdev);
2087 }
2088
2089 static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2090 {
2091         __u8 status = *((__u8 *) skb->data);
2092         struct discovery_state *discov = &hdev->discovery;
2093         struct inquiry_entry *e;
2094
2095         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2096
2097         hci_conn_check_pending(hdev);
2098
2099         if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
2100                 return;
2101
2102         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
2103         wake_up_bit(&hdev->flags, HCI_INQUIRY);
2104
2105         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
2106                 return;
2107
2108         hci_dev_lock(hdev);
2109
2110         if (discov->state != DISCOVERY_FINDING)
2111                 goto unlock;
2112
2113         if (list_empty(&discov->resolve)) {
2114                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2115                 goto unlock;
2116         }
2117
2118         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
2119         if (e && hci_resolve_name(hdev, e) == 0) {
2120                 e->name_state = NAME_PENDING;
2121                 hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
2122         } else {
2123                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2124         }
2125
2126 unlock:
2127         hci_dev_unlock(hdev);
2128 }
2129
2130 static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
2131 {
2132         struct inquiry_data data;
2133         struct inquiry_info *info = (void *) (skb->data + 1);
2134         int num_rsp = *((__u8 *) skb->data);
2135
2136         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2137
2138         if (!num_rsp)
2139                 return;
2140
2141         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
2142                 return;
2143
2144         hci_dev_lock(hdev);
2145
2146         for (; num_rsp; num_rsp--, info++) {
2147                 u32 flags;
2148
2149                 bacpy(&data.bdaddr, &info->bdaddr);
2150                 data.pscan_rep_mode     = info->pscan_rep_mode;
2151                 data.pscan_period_mode  = info->pscan_period_mode;
2152                 data.pscan_mode         = info->pscan_mode;
2153                 memcpy(data.dev_class, info->dev_class, 3);
2154                 data.clock_offset       = info->clock_offset;
2155                 data.rssi               = HCI_RSSI_INVALID;
2156                 data.ssp_mode           = 0x00;
2157
2158                 flags = hci_inquiry_cache_update(hdev, &data, false);
2159
2160                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2161                                   info->dev_class, HCI_RSSI_INVALID,
2162                                   flags, NULL, 0, NULL, 0);
2163         }
2164
2165         hci_dev_unlock(hdev);
2166 }
2167
2168 static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2169 {
2170         struct hci_ev_conn_complete *ev = (void *) skb->data;
2171         struct hci_conn *conn;
2172
2173         BT_DBG("%s", hdev->name);
2174
2175         hci_dev_lock(hdev);
2176
2177         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
2178         if (!conn) {
2179                 if (ev->link_type != SCO_LINK)
2180                         goto unlock;
2181
2182                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
2183                 if (!conn)
2184                         goto unlock;
2185
2186                 conn->type = SCO_LINK;
2187         }
2188
2189         if (!ev->status) {
2190                 conn->handle = __le16_to_cpu(ev->handle);
2191
2192                 if (conn->type == ACL_LINK) {
2193                         conn->state = BT_CONFIG;
2194                         hci_conn_hold(conn);
2195
2196                         if (!conn->out && !hci_conn_ssp_enabled(conn) &&
2197                             !hci_find_link_key(hdev, &ev->bdaddr))
2198                                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2199                         else
2200                                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2201                 } else
2202                         conn->state = BT_CONNECTED;
2203
2204                 hci_debugfs_create_conn(conn);
2205                 hci_conn_add_sysfs(conn);
2206
2207                 if (test_bit(HCI_AUTH, &hdev->flags))
2208                         set_bit(HCI_CONN_AUTH, &conn->flags);
2209
2210                 if (test_bit(HCI_ENCRYPT, &hdev->flags))
2211                         set_bit(HCI_CONN_ENCRYPT, &conn->flags);
2212
2213                 /* Get remote features */
2214                 if (conn->type == ACL_LINK) {
2215                         struct hci_cp_read_remote_features cp;
2216                         cp.handle = ev->handle;
2217                         hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
2218                                      sizeof(cp), &cp);
2219
2220                         hci_update_page_scan(hdev);
2221                 }
2222
2223                 /* Set packet type for incoming connection */
2224                 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
2225                         struct hci_cp_change_conn_ptype cp;
2226                         cp.handle = ev->handle;
2227                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
2228                         hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
2229                                      &cp);
2230                 }
2231         } else {
2232                 conn->state = BT_CLOSED;
2233                 if (conn->type == ACL_LINK)
2234                         mgmt_connect_failed(hdev, &conn->dst, conn->type,
2235                                             conn->dst_type, ev->status);
2236         }
2237
2238         if (conn->type == ACL_LINK)
2239                 hci_sco_setup(conn, ev->status);
2240
2241         if (ev->status) {
2242                 hci_proto_connect_cfm(conn, ev->status);
2243                 hci_conn_del(conn);
2244         } else if (ev->link_type != ACL_LINK)
2245                 hci_proto_connect_cfm(conn, ev->status);
2246
2247 unlock:
2248         hci_dev_unlock(hdev);
2249
2250         hci_conn_check_pending(hdev);
2251 }
2252
2253 static void hci_reject_conn(struct hci_dev *hdev, bdaddr_t *bdaddr)
2254 {
2255         struct hci_cp_reject_conn_req cp;
2256
2257         bacpy(&cp.bdaddr, bdaddr);
2258         cp.reason = HCI_ERROR_REJ_BAD_ADDR;
2259         hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
2260 }
2261
2262 static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2263 {
2264         struct hci_ev_conn_request *ev = (void *) skb->data;
2265         int mask = hdev->link_mode;
2266         struct inquiry_entry *ie;
2267         struct hci_conn *conn;
2268         __u8 flags = 0;
2269
2270         BT_DBG("%s bdaddr %pMR type 0x%x", hdev->name, &ev->bdaddr,
2271                ev->link_type);
2272
2273         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
2274                                       &flags);
2275
2276         if (!(mask & HCI_LM_ACCEPT)) {
2277                 hci_reject_conn(hdev, &ev->bdaddr);
2278                 return;
2279         }
2280
2281         if (hci_bdaddr_list_lookup(&hdev->blacklist, &ev->bdaddr,
2282                                    BDADDR_BREDR)) {
2283                 hci_reject_conn(hdev, &ev->bdaddr);
2284                 return;
2285         }
2286
2287         /* Require HCI_CONNECTABLE or a whitelist entry to accept the
2288          * connection. These features are only touched through mgmt so
2289          * only do the checks if HCI_MGMT is set.
2290          */
2291         if (test_bit(HCI_MGMT, &hdev->dev_flags) &&
2292             !test_bit(HCI_CONNECTABLE, &hdev->dev_flags) &&
2293             !hci_bdaddr_list_lookup(&hdev->whitelist, &ev->bdaddr,
2294                                     BDADDR_BREDR)) {
2295                     hci_reject_conn(hdev, &ev->bdaddr);
2296                     return;
2297         }
2298
2299         /* Connection accepted */
2300
2301         hci_dev_lock(hdev);
2302
2303         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2304         if (ie)
2305                 memcpy(ie->data.dev_class, ev->dev_class, 3);
2306
2307         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
2308                         &ev->bdaddr);
2309         if (!conn) {
2310                 conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr,
2311                                     HCI_ROLE_SLAVE);
2312                 if (!conn) {
2313                         BT_ERR("No memory for new connection");
2314                         hci_dev_unlock(hdev);
2315                         return;
2316                 }
2317         }
2318
2319         memcpy(conn->dev_class, ev->dev_class, 3);
2320
2321         hci_dev_unlock(hdev);
2322
2323         if (ev->link_type == ACL_LINK ||
2324             (!(flags & HCI_PROTO_DEFER) && !lmp_esco_capable(hdev))) {
2325                 struct hci_cp_accept_conn_req cp;
2326                 conn->state = BT_CONNECT;
2327
2328                 bacpy(&cp.bdaddr, &ev->bdaddr);
2329
2330                 if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
2331                         cp.role = 0x00; /* Become master */
2332                 else
2333                         cp.role = 0x01; /* Remain slave */
2334
2335                 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
2336         } else if (!(flags & HCI_PROTO_DEFER)) {
2337                 struct hci_cp_accept_sync_conn_req cp;
2338                 conn->state = BT_CONNECT;
2339
2340                 bacpy(&cp.bdaddr, &ev->bdaddr);
2341                 cp.pkt_type = cpu_to_le16(conn->pkt_type);
2342
2343                 cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
2344                 cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
2345                 cp.max_latency    = cpu_to_le16(0xffff);
2346                 cp.content_format = cpu_to_le16(hdev->voice_setting);
2347                 cp.retrans_effort = 0xff;
2348
2349                 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ, sizeof(cp),
2350                              &cp);
2351         } else {
2352                 conn->state = BT_CONNECT2;
2353                 hci_proto_connect_cfm(conn, 0);
2354         }
2355 }
2356
2357 static u8 hci_to_mgmt_reason(u8 err)
2358 {
2359         switch (err) {
2360         case HCI_ERROR_CONNECTION_TIMEOUT:
2361                 return MGMT_DEV_DISCONN_TIMEOUT;
2362         case HCI_ERROR_REMOTE_USER_TERM:
2363         case HCI_ERROR_REMOTE_LOW_RESOURCES:
2364         case HCI_ERROR_REMOTE_POWER_OFF:
2365                 return MGMT_DEV_DISCONN_REMOTE;
2366         case HCI_ERROR_LOCAL_HOST_TERM:
2367                 return MGMT_DEV_DISCONN_LOCAL_HOST;
2368         default:
2369                 return MGMT_DEV_DISCONN_UNKNOWN;
2370         }
2371 }
2372
2373 static void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2374 {
2375         struct hci_ev_disconn_complete *ev = (void *) skb->data;
2376         u8 reason = hci_to_mgmt_reason(ev->reason);
2377         struct hci_conn_params *params;
2378         struct hci_conn *conn;
2379         bool mgmt_connected;
2380         u8 type;
2381
2382         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2383
2384         hci_dev_lock(hdev);
2385
2386         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2387         if (!conn)
2388                 goto unlock;
2389
2390         if (ev->status) {
2391                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2392                                        conn->dst_type, ev->status);
2393                 goto unlock;
2394         }
2395
2396         conn->state = BT_CLOSED;
2397
2398         mgmt_connected = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags);
2399         mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type,
2400                                 reason, mgmt_connected);
2401
2402         if (conn->type == ACL_LINK) {
2403                 if (test_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
2404                         hci_remove_link_key(hdev, &conn->dst);
2405
2406                 hci_update_page_scan(hdev);
2407         }
2408
2409         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
2410         if (params) {
2411                 switch (params->auto_connect) {
2412                 case HCI_AUTO_CONN_LINK_LOSS:
2413                         if (ev->reason != HCI_ERROR_CONNECTION_TIMEOUT)
2414                                 break;
2415                         /* Fall through */
2416
2417                 case HCI_AUTO_CONN_DIRECT:
2418                 case HCI_AUTO_CONN_ALWAYS:
2419                         list_del_init(&params->action);
2420                         list_add(&params->action, &hdev->pend_le_conns);
2421                         hci_update_background_scan(hdev);
2422                         break;
2423
2424                 default:
2425                         break;
2426                 }
2427         }
2428
2429         type = conn->type;
2430
2431         hci_proto_disconn_cfm(conn, ev->reason);
2432         hci_conn_del(conn);
2433
2434         /* Re-enable advertising if necessary, since it might
2435          * have been disabled by the connection. From the
2436          * HCI_LE_Set_Advertise_Enable command description in
2437          * the core specification (v4.0):
2438          * "The Controller shall continue advertising until the Host
2439          * issues an LE_Set_Advertise_Enable command with
2440          * Advertising_Enable set to 0x00 (Advertising is disabled)
2441          * or until a connection is created or until the Advertising
2442          * is timed out due to Directed Advertising."
2443          */
2444         if (type == LE_LINK)
2445                 mgmt_reenable_advertising(hdev);
2446
2447 unlock:
2448         hci_dev_unlock(hdev);
2449 }
2450
2451 static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2452 {
2453         struct hci_ev_auth_complete *ev = (void *) skb->data;
2454         struct hci_conn *conn;
2455
2456         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2457
2458         hci_dev_lock(hdev);
2459
2460         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2461         if (!conn)
2462                 goto unlock;
2463
2464         if (!ev->status) {
2465                 if (!hci_conn_ssp_enabled(conn) &&
2466                     test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
2467                         BT_INFO("re-auth of legacy device is not possible.");
2468                 } else {
2469                         set_bit(HCI_CONN_AUTH, &conn->flags);
2470                         conn->sec_level = conn->pending_sec_level;
2471                 }
2472         } else {
2473                 mgmt_auth_failed(conn, ev->status);
2474         }
2475
2476         clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
2477         clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
2478
2479         if (conn->state == BT_CONFIG) {
2480                 if (!ev->status && hci_conn_ssp_enabled(conn)) {
2481                         struct hci_cp_set_conn_encrypt cp;
2482                         cp.handle  = ev->handle;
2483                         cp.encrypt = 0x01;
2484                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2485                                      &cp);
2486                 } else {
2487                         conn->state = BT_CONNECTED;
2488                         hci_proto_connect_cfm(conn, ev->status);
2489                         hci_conn_drop(conn);
2490                 }
2491         } else {
2492                 hci_auth_cfm(conn, ev->status);
2493
2494                 hci_conn_hold(conn);
2495                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2496                 hci_conn_drop(conn);
2497         }
2498
2499         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
2500                 if (!ev->status) {
2501                         struct hci_cp_set_conn_encrypt cp;
2502                         cp.handle  = ev->handle;
2503                         cp.encrypt = 0x01;
2504                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2505                                      &cp);
2506                 } else {
2507                         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2508                         hci_encrypt_cfm(conn, ev->status, 0x00);
2509                 }
2510         }
2511
2512 unlock:
2513         hci_dev_unlock(hdev);
2514 }
2515
2516 static void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
2517 {
2518         struct hci_ev_remote_name *ev = (void *) skb->data;
2519         struct hci_conn *conn;
2520
2521         BT_DBG("%s", hdev->name);
2522
2523         hci_conn_check_pending(hdev);
2524
2525         hci_dev_lock(hdev);
2526
2527         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2528
2529         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
2530                 goto check_auth;
2531
2532         if (ev->status == 0)
2533                 hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
2534                                        strnlen(ev->name, HCI_MAX_NAME_LENGTH));
2535         else
2536                 hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
2537
2538 check_auth:
2539         if (!conn)
2540                 goto unlock;
2541
2542         if (!hci_outgoing_auth_needed(hdev, conn))
2543                 goto unlock;
2544
2545         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
2546                 struct hci_cp_auth_requested cp;
2547
2548                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
2549
2550                 cp.handle = __cpu_to_le16(conn->handle);
2551                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
2552         }
2553
2554 unlock:
2555         hci_dev_unlock(hdev);
2556 }
2557
2558 static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2559 {
2560         struct hci_ev_encrypt_change *ev = (void *) skb->data;
2561         struct hci_conn *conn;
2562
2563         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2564
2565         hci_dev_lock(hdev);
2566
2567         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2568         if (!conn)
2569                 goto unlock;
2570
2571         if (!ev->status) {
2572                 if (ev->encrypt) {
2573                         /* Encryption implies authentication */
2574                         set_bit(HCI_CONN_AUTH, &conn->flags);
2575                         set_bit(HCI_CONN_ENCRYPT, &conn->flags);
2576                         conn->sec_level = conn->pending_sec_level;
2577
2578                         /* P-256 authentication key implies FIPS */
2579                         if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256)
2580                                 set_bit(HCI_CONN_FIPS, &conn->flags);
2581
2582                         if ((conn->type == ACL_LINK && ev->encrypt == 0x02) ||
2583                             conn->type == LE_LINK)
2584                                 set_bit(HCI_CONN_AES_CCM, &conn->flags);
2585                 } else {
2586                         clear_bit(HCI_CONN_ENCRYPT, &conn->flags);
2587                         clear_bit(HCI_CONN_AES_CCM, &conn->flags);
2588                 }
2589         }
2590
2591         /* We should disregard the current RPA and generate a new one
2592          * whenever the encryption procedure fails.
2593          */
2594         if (ev->status && conn->type == LE_LINK)
2595                 set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
2596
2597         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2598
2599         if (ev->status && conn->state == BT_CONNECTED) {
2600                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2601                 hci_conn_drop(conn);
2602                 goto unlock;
2603         }
2604
2605         if (conn->state == BT_CONFIG) {
2606                 if (!ev->status)
2607                         conn->state = BT_CONNECTED;
2608
2609                 /* In Secure Connections Only mode, do not allow any
2610                  * connections that are not encrypted with AES-CCM
2611                  * using a P-256 authenticated combination key.
2612                  */
2613                 if (test_bit(HCI_SC_ONLY, &hdev->dev_flags) &&
2614                     (!test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
2615                      conn->key_type != HCI_LK_AUTH_COMBINATION_P256)) {
2616                         hci_proto_connect_cfm(conn, HCI_ERROR_AUTH_FAILURE);
2617                         hci_conn_drop(conn);
2618                         goto unlock;
2619                 }
2620
2621                 hci_proto_connect_cfm(conn, ev->status);
2622                 hci_conn_drop(conn);
2623         } else
2624                 hci_encrypt_cfm(conn, ev->status, ev->encrypt);
2625
2626 unlock:
2627         hci_dev_unlock(hdev);
2628 }
2629
2630 static void hci_change_link_key_complete_evt(struct hci_dev *hdev,
2631                                              struct sk_buff *skb)
2632 {
2633         struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
2634         struct hci_conn *conn;
2635
2636         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2637
2638         hci_dev_lock(hdev);
2639
2640         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2641         if (conn) {
2642                 if (!ev->status)
2643                         set_bit(HCI_CONN_SECURE, &conn->flags);
2644
2645                 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
2646
2647                 hci_key_change_cfm(conn, ev->status);
2648         }
2649
2650         hci_dev_unlock(hdev);
2651 }
2652
2653 static void hci_remote_features_evt(struct hci_dev *hdev,
2654                                     struct sk_buff *skb)
2655 {
2656         struct hci_ev_remote_features *ev = (void *) skb->data;
2657         struct hci_conn *conn;
2658
2659         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2660
2661         hci_dev_lock(hdev);
2662
2663         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2664         if (!conn)
2665                 goto unlock;
2666
2667         if (!ev->status)
2668                 memcpy(conn->features[0], ev->features, 8);
2669
2670         if (conn->state != BT_CONFIG)
2671                 goto unlock;
2672
2673         if (!ev->status && lmp_ssp_capable(hdev) && lmp_ssp_capable(conn)) {
2674                 struct hci_cp_read_remote_ext_features cp;
2675                 cp.handle = ev->handle;
2676                 cp.page = 0x01;
2677                 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
2678                              sizeof(cp), &cp);
2679                 goto unlock;
2680         }
2681
2682         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
2683                 struct hci_cp_remote_name_req cp;
2684                 memset(&cp, 0, sizeof(cp));
2685                 bacpy(&cp.bdaddr, &conn->dst);
2686                 cp.pscan_rep_mode = 0x02;
2687                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2688         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2689                 mgmt_device_connected(hdev, conn, 0, NULL, 0);
2690
2691         if (!hci_outgoing_auth_needed(hdev, conn)) {
2692                 conn->state = BT_CONNECTED;
2693                 hci_proto_connect_cfm(conn, ev->status);
2694                 hci_conn_drop(conn);
2695         }
2696
2697 unlock:
2698         hci_dev_unlock(hdev);
2699 }
2700
2701 static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2702 {
2703         struct hci_ev_cmd_complete *ev = (void *) skb->data;
2704         u8 status = skb->data[sizeof(*ev)];
2705         __u16 opcode;
2706
2707         skb_pull(skb, sizeof(*ev));
2708
2709         opcode = __le16_to_cpu(ev->opcode);
2710
2711         switch (opcode) {
2712         case HCI_OP_INQUIRY_CANCEL:
2713                 hci_cc_inquiry_cancel(hdev, skb);
2714                 break;
2715
2716         case HCI_OP_PERIODIC_INQ:
2717                 hci_cc_periodic_inq(hdev, skb);
2718                 break;
2719
2720         case HCI_OP_EXIT_PERIODIC_INQ:
2721                 hci_cc_exit_periodic_inq(hdev, skb);
2722                 break;
2723
2724         case HCI_OP_REMOTE_NAME_REQ_CANCEL:
2725                 hci_cc_remote_name_req_cancel(hdev, skb);
2726                 break;
2727
2728         case HCI_OP_ROLE_DISCOVERY:
2729                 hci_cc_role_discovery(hdev, skb);
2730                 break;
2731
2732         case HCI_OP_READ_LINK_POLICY:
2733                 hci_cc_read_link_policy(hdev, skb);
2734                 break;
2735
2736         case HCI_OP_WRITE_LINK_POLICY:
2737                 hci_cc_write_link_policy(hdev, skb);
2738                 break;
2739
2740         case HCI_OP_READ_DEF_LINK_POLICY:
2741                 hci_cc_read_def_link_policy(hdev, skb);
2742                 break;
2743
2744         case HCI_OP_WRITE_DEF_LINK_POLICY:
2745                 hci_cc_write_def_link_policy(hdev, skb);
2746                 break;
2747
2748         case HCI_OP_RESET:
2749                 hci_cc_reset(hdev, skb);
2750                 break;
2751
2752         case HCI_OP_READ_STORED_LINK_KEY:
2753                 hci_cc_read_stored_link_key(hdev, skb);
2754                 break;
2755
2756         case HCI_OP_DELETE_STORED_LINK_KEY:
2757                 hci_cc_delete_stored_link_key(hdev, skb);
2758                 break;
2759
2760         case HCI_OP_WRITE_LOCAL_NAME:
2761                 hci_cc_write_local_name(hdev, skb);
2762                 break;
2763
2764         case HCI_OP_READ_LOCAL_NAME:
2765                 hci_cc_read_local_name(hdev, skb);
2766                 break;
2767
2768         case HCI_OP_WRITE_AUTH_ENABLE:
2769                 hci_cc_write_auth_enable(hdev, skb);
2770                 break;
2771
2772         case HCI_OP_WRITE_ENCRYPT_MODE:
2773                 hci_cc_write_encrypt_mode(hdev, skb);
2774                 break;
2775
2776         case HCI_OP_WRITE_SCAN_ENABLE:
2777                 hci_cc_write_scan_enable(hdev, skb);
2778                 break;
2779
2780         case HCI_OP_READ_CLASS_OF_DEV:
2781                 hci_cc_read_class_of_dev(hdev, skb);
2782                 break;
2783
2784         case HCI_OP_WRITE_CLASS_OF_DEV:
2785                 hci_cc_write_class_of_dev(hdev, skb);
2786                 break;
2787
2788         case HCI_OP_READ_VOICE_SETTING:
2789                 hci_cc_read_voice_setting(hdev, skb);
2790                 break;
2791
2792         case HCI_OP_WRITE_VOICE_SETTING:
2793                 hci_cc_write_voice_setting(hdev, skb);
2794                 break;
2795
2796         case HCI_OP_READ_NUM_SUPPORTED_IAC:
2797                 hci_cc_read_num_supported_iac(hdev, skb);
2798                 break;
2799
2800         case HCI_OP_WRITE_SSP_MODE:
2801                 hci_cc_write_ssp_mode(hdev, skb);
2802                 break;
2803
2804         case HCI_OP_WRITE_SC_SUPPORT:
2805                 hci_cc_write_sc_support(hdev, skb);
2806                 break;
2807
2808         case HCI_OP_READ_LOCAL_VERSION:
2809                 hci_cc_read_local_version(hdev, skb);
2810                 break;
2811
2812         case HCI_OP_READ_LOCAL_COMMANDS:
2813                 hci_cc_read_local_commands(hdev, skb);
2814                 break;
2815
2816         case HCI_OP_READ_LOCAL_FEATURES:
2817                 hci_cc_read_local_features(hdev, skb);
2818                 break;
2819
2820         case HCI_OP_READ_LOCAL_EXT_FEATURES:
2821                 hci_cc_read_local_ext_features(hdev, skb);
2822                 break;
2823
2824         case HCI_OP_READ_BUFFER_SIZE:
2825                 hci_cc_read_buffer_size(hdev, skb);
2826                 break;
2827
2828         case HCI_OP_READ_BD_ADDR:
2829                 hci_cc_read_bd_addr(hdev, skb);
2830                 break;
2831
2832         case HCI_OP_READ_PAGE_SCAN_ACTIVITY:
2833                 hci_cc_read_page_scan_activity(hdev, skb);
2834                 break;
2835
2836         case HCI_OP_WRITE_PAGE_SCAN_ACTIVITY:
2837                 hci_cc_write_page_scan_activity(hdev, skb);
2838                 break;
2839
2840         case HCI_OP_READ_PAGE_SCAN_TYPE:
2841                 hci_cc_read_page_scan_type(hdev, skb);
2842                 break;
2843
2844         case HCI_OP_WRITE_PAGE_SCAN_TYPE:
2845                 hci_cc_write_page_scan_type(hdev, skb);
2846                 break;
2847
2848         case HCI_OP_READ_DATA_BLOCK_SIZE:
2849                 hci_cc_read_data_block_size(hdev, skb);
2850                 break;
2851
2852         case HCI_OP_READ_FLOW_CONTROL_MODE:
2853                 hci_cc_read_flow_control_mode(hdev, skb);
2854                 break;
2855
2856         case HCI_OP_READ_LOCAL_AMP_INFO:
2857                 hci_cc_read_local_amp_info(hdev, skb);
2858                 break;
2859
2860         case HCI_OP_READ_CLOCK:
2861                 hci_cc_read_clock(hdev, skb);
2862                 break;
2863
2864         case HCI_OP_READ_LOCAL_AMP_ASSOC:
2865                 hci_cc_read_local_amp_assoc(hdev, skb);
2866                 break;
2867
2868         case HCI_OP_READ_INQ_RSP_TX_POWER:
2869                 hci_cc_read_inq_rsp_tx_power(hdev, skb);
2870                 break;
2871
2872         case HCI_OP_PIN_CODE_REPLY:
2873                 hci_cc_pin_code_reply(hdev, skb);
2874                 break;
2875
2876         case HCI_OP_PIN_CODE_NEG_REPLY:
2877                 hci_cc_pin_code_neg_reply(hdev, skb);
2878                 break;
2879
2880         case HCI_OP_READ_LOCAL_OOB_DATA:
2881                 hci_cc_read_local_oob_data(hdev, skb);
2882                 break;
2883
2884         case HCI_OP_READ_LOCAL_OOB_EXT_DATA:
2885                 hci_cc_read_local_oob_ext_data(hdev, skb);
2886                 break;
2887
2888         case HCI_OP_LE_READ_BUFFER_SIZE:
2889                 hci_cc_le_read_buffer_size(hdev, skb);
2890                 break;
2891
2892         case HCI_OP_LE_READ_LOCAL_FEATURES:
2893                 hci_cc_le_read_local_features(hdev, skb);
2894                 break;
2895
2896         case HCI_OP_LE_READ_ADV_TX_POWER:
2897                 hci_cc_le_read_adv_tx_power(hdev, skb);
2898                 break;
2899
2900         case HCI_OP_USER_CONFIRM_REPLY:
2901                 hci_cc_user_confirm_reply(hdev, skb);
2902                 break;
2903
2904         case HCI_OP_USER_CONFIRM_NEG_REPLY:
2905                 hci_cc_user_confirm_neg_reply(hdev, skb);
2906                 break;
2907
2908         case HCI_OP_USER_PASSKEY_REPLY:
2909                 hci_cc_user_passkey_reply(hdev, skb);
2910                 break;
2911
2912         case HCI_OP_USER_PASSKEY_NEG_REPLY:
2913                 hci_cc_user_passkey_neg_reply(hdev, skb);
2914                 break;
2915
2916         case HCI_OP_LE_SET_RANDOM_ADDR:
2917                 hci_cc_le_set_random_addr(hdev, skb);
2918                 break;
2919
2920         case HCI_OP_LE_SET_ADV_ENABLE:
2921                 hci_cc_le_set_adv_enable(hdev, skb);
2922                 break;
2923
2924         case HCI_OP_LE_SET_SCAN_PARAM:
2925                 hci_cc_le_set_scan_param(hdev, skb);
2926                 break;
2927
2928         case HCI_OP_LE_SET_SCAN_ENABLE:
2929                 hci_cc_le_set_scan_enable(hdev, skb);
2930                 break;
2931
2932         case HCI_OP_LE_READ_WHITE_LIST_SIZE:
2933                 hci_cc_le_read_white_list_size(hdev, skb);
2934                 break;
2935
2936         case HCI_OP_LE_CLEAR_WHITE_LIST:
2937                 hci_cc_le_clear_white_list(hdev, skb);
2938                 break;
2939
2940         case HCI_OP_LE_ADD_TO_WHITE_LIST:
2941                 hci_cc_le_add_to_white_list(hdev, skb);
2942                 break;
2943
2944         case HCI_OP_LE_DEL_FROM_WHITE_LIST:
2945                 hci_cc_le_del_from_white_list(hdev, skb);
2946                 break;
2947
2948         case HCI_OP_LE_READ_SUPPORTED_STATES:
2949                 hci_cc_le_read_supported_states(hdev, skb);
2950                 break;
2951
2952         case HCI_OP_LE_READ_DEF_DATA_LEN:
2953                 hci_cc_le_read_def_data_len(hdev, skb);
2954                 break;
2955
2956         case HCI_OP_LE_WRITE_DEF_DATA_LEN:
2957                 hci_cc_le_write_def_data_len(hdev, skb);
2958                 break;
2959
2960         case HCI_OP_LE_READ_MAX_DATA_LEN:
2961                 hci_cc_le_read_max_data_len(hdev, skb);
2962                 break;
2963
2964         case HCI_OP_WRITE_LE_HOST_SUPPORTED:
2965                 hci_cc_write_le_host_supported(hdev, skb);
2966                 break;
2967
2968         case HCI_OP_LE_SET_ADV_PARAM:
2969                 hci_cc_set_adv_param(hdev, skb);
2970                 break;
2971
2972         case HCI_OP_WRITE_REMOTE_AMP_ASSOC:
2973                 hci_cc_write_remote_amp_assoc(hdev, skb);
2974                 break;
2975
2976         case HCI_OP_READ_RSSI:
2977                 hci_cc_read_rssi(hdev, skb);
2978                 break;
2979
2980         case HCI_OP_READ_TX_POWER:
2981                 hci_cc_read_tx_power(hdev, skb);
2982                 break;
2983
2984         default:
2985                 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
2986                 break;
2987         }
2988
2989         if (opcode != HCI_OP_NOP)
2990                 cancel_delayed_work(&hdev->cmd_timer);
2991
2992         hci_req_cmd_complete(hdev, opcode, status);
2993
2994         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
2995                 atomic_set(&hdev->cmd_cnt, 1);
2996                 if (!skb_queue_empty(&hdev->cmd_q))
2997                         queue_work(hdev->workqueue, &hdev->cmd_work);
2998         }
2999 }
3000
3001 static void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb)
3002 {
3003         struct hci_ev_cmd_status *ev = (void *) skb->data;
3004         __u16 opcode;
3005
3006         skb_pull(skb, sizeof(*ev));
3007
3008         opcode = __le16_to_cpu(ev->opcode);
3009
3010         switch (opcode) {
3011         case HCI_OP_INQUIRY:
3012                 hci_cs_inquiry(hdev, ev->status);
3013                 break;
3014
3015         case HCI_OP_CREATE_CONN:
3016                 hci_cs_create_conn(hdev, ev->status);
3017                 break;
3018
3019         case HCI_OP_DISCONNECT:
3020                 hci_cs_disconnect(hdev, ev->status);
3021                 break;
3022
3023         case HCI_OP_ADD_SCO:
3024                 hci_cs_add_sco(hdev, ev->status);
3025                 break;
3026
3027         case HCI_OP_AUTH_REQUESTED:
3028                 hci_cs_auth_requested(hdev, ev->status);
3029                 break;
3030
3031         case HCI_OP_SET_CONN_ENCRYPT:
3032                 hci_cs_set_conn_encrypt(hdev, ev->status);
3033                 break;
3034
3035         case HCI_OP_REMOTE_NAME_REQ:
3036                 hci_cs_remote_name_req(hdev, ev->status);
3037                 break;
3038
3039         case HCI_OP_READ_REMOTE_FEATURES:
3040                 hci_cs_read_remote_features(hdev, ev->status);
3041                 break;
3042
3043         case HCI_OP_READ_REMOTE_EXT_FEATURES:
3044                 hci_cs_read_remote_ext_features(hdev, ev->status);
3045                 break;
3046
3047         case HCI_OP_SETUP_SYNC_CONN:
3048                 hci_cs_setup_sync_conn(hdev, ev->status);
3049                 break;
3050
3051         case HCI_OP_CREATE_PHY_LINK:
3052                 hci_cs_create_phylink(hdev, ev->status);
3053                 break;
3054
3055         case HCI_OP_ACCEPT_PHY_LINK:
3056                 hci_cs_accept_phylink(hdev, ev->status);
3057                 break;
3058
3059         case HCI_OP_SNIFF_MODE:
3060                 hci_cs_sniff_mode(hdev, ev->status);
3061                 break;
3062
3063         case HCI_OP_EXIT_SNIFF_MODE:
3064                 hci_cs_exit_sniff_mode(hdev, ev->status);
3065                 break;
3066
3067         case HCI_OP_SWITCH_ROLE:
3068                 hci_cs_switch_role(hdev, ev->status);
3069                 break;
3070
3071         case HCI_OP_LE_CREATE_CONN:
3072                 hci_cs_le_create_conn(hdev, ev->status);
3073                 break;
3074
3075         case HCI_OP_LE_START_ENC:
3076                 hci_cs_le_start_enc(hdev, ev->status);
3077                 break;
3078
3079         default:
3080                 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
3081                 break;
3082         }
3083
3084         if (opcode != HCI_OP_NOP)
3085                 cancel_delayed_work(&hdev->cmd_timer);
3086
3087         if (ev->status ||
3088             (hdev->sent_cmd && !bt_cb(hdev->sent_cmd)->req.event))
3089                 hci_req_cmd_complete(hdev, opcode, ev->status);
3090
3091         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
3092                 atomic_set(&hdev->cmd_cnt, 1);
3093                 if (!skb_queue_empty(&hdev->cmd_q))
3094                         queue_work(hdev->workqueue, &hdev->cmd_work);
3095         }
3096 }
3097
3098 static void hci_hardware_error_evt(struct hci_dev *hdev, struct sk_buff *skb)
3099 {
3100         struct hci_ev_hardware_error *ev = (void *) skb->data;
3101
3102         BT_ERR("%s hardware error 0x%2.2x", hdev->name, ev->code);
3103 }
3104
3105 static void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3106 {
3107         struct hci_ev_role_change *ev = (void *) skb->data;
3108         struct hci_conn *conn;
3109
3110         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3111
3112         hci_dev_lock(hdev);
3113
3114         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3115         if (conn) {
3116                 if (!ev->status)
3117                         conn->role = ev->role;
3118
3119                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
3120
3121                 hci_role_switch_cfm(conn, ev->status, ev->role);
3122         }
3123
3124         hci_dev_unlock(hdev);
3125 }
3126
3127 static void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
3128 {
3129         struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
3130         int i;
3131
3132         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
3133                 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
3134                 return;
3135         }
3136
3137         if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
3138             ev->num_hndl * sizeof(struct hci_comp_pkts_info)) {
3139                 BT_DBG("%s bad parameters", hdev->name);
3140                 return;
3141         }
3142
3143         BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
3144
3145         for (i = 0; i < ev->num_hndl; i++) {
3146                 struct hci_comp_pkts_info *info = &ev->handles[i];
3147                 struct hci_conn *conn;
3148                 __u16  handle, count;
3149
3150                 handle = __le16_to_cpu(info->handle);
3151                 count  = __le16_to_cpu(info->count);
3152
3153                 conn = hci_conn_hash_lookup_handle(hdev, handle);
3154                 if (!conn)
3155                         continue;
3156
3157                 conn->sent -= count;
3158
3159                 switch (conn->type) {
3160                 case ACL_LINK:
3161                         hdev->acl_cnt += count;
3162                         if (hdev->acl_cnt > hdev->acl_pkts)
3163                                 hdev->acl_cnt = hdev->acl_pkts;
3164                         break;
3165
3166                 case LE_LINK:
3167                         if (hdev->le_pkts) {
3168                                 hdev->le_cnt += count;
3169                                 if (hdev->le_cnt > hdev->le_pkts)
3170                                         hdev->le_cnt = hdev->le_pkts;
3171                         } else {
3172                                 hdev->acl_cnt += count;
3173                                 if (hdev->acl_cnt > hdev->acl_pkts)
3174                                         hdev->acl_cnt = hdev->acl_pkts;
3175                         }
3176                         break;
3177
3178                 case SCO_LINK:
3179                         hdev->sco_cnt += count;
3180                         if (hdev->sco_cnt > hdev->sco_pkts)
3181                                 hdev->sco_cnt = hdev->sco_pkts;
3182                         break;
3183
3184                 default:
3185                         BT_ERR("Unknown type %d conn %p", conn->type, conn);
3186                         break;
3187                 }
3188         }
3189
3190         queue_work(hdev->workqueue, &hdev->tx_work);
3191 }
3192
3193 static struct hci_conn *__hci_conn_lookup_handle(struct hci_dev *hdev,
3194                                                  __u16 handle)
3195 {
3196         struct hci_chan *chan;
3197
3198         switch (hdev->dev_type) {
3199         case HCI_BREDR:
3200                 return hci_conn_hash_lookup_handle(hdev, handle);
3201         case HCI_AMP:
3202                 chan = hci_chan_lookup_handle(hdev, handle);
3203                 if (chan)
3204                         return chan->conn;
3205                 break;
3206         default:
3207                 BT_ERR("%s unknown dev_type %d", hdev->name, hdev->dev_type);
3208                 break;
3209         }
3210
3211         return NULL;
3212 }
3213
3214 static void hci_num_comp_blocks_evt(struct hci_dev *hdev, struct sk_buff *skb)
3215 {
3216         struct hci_ev_num_comp_blocks *ev = (void *) skb->data;
3217         int i;
3218
3219         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
3220                 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
3221                 return;
3222         }
3223
3224         if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
3225             ev->num_hndl * sizeof(struct hci_comp_blocks_info)) {
3226                 BT_DBG("%s bad parameters", hdev->name);
3227                 return;
3228         }
3229
3230         BT_DBG("%s num_blocks %d num_hndl %d", hdev->name, ev->num_blocks,
3231                ev->num_hndl);
3232
3233         for (i = 0; i < ev->num_hndl; i++) {
3234                 struct hci_comp_blocks_info *info = &ev->handles[i];
3235                 struct hci_conn *conn = NULL;
3236                 __u16  handle, block_count;
3237
3238                 handle = __le16_to_cpu(info->handle);
3239                 block_count = __le16_to_cpu(info->blocks);
3240
3241                 conn = __hci_conn_lookup_handle(hdev, handle);
3242                 if (!conn)
3243                         continue;
3244
3245                 conn->sent -= block_count;
3246
3247                 switch (conn->type) {
3248                 case ACL_LINK:
3249                 case AMP_LINK:
3250                         hdev->block_cnt += block_count;
3251                         if (hdev->block_cnt > hdev->num_blocks)
3252                                 hdev->block_cnt = hdev->num_blocks;
3253                         break;
3254
3255                 default:
3256                         BT_ERR("Unknown type %d conn %p", conn->type, conn);
3257                         break;
3258                 }
3259         }
3260
3261         queue_work(hdev->workqueue, &hdev->tx_work);
3262 }
3263
3264 static void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3265 {
3266         struct hci_ev_mode_change *ev = (void *) skb->data;
3267         struct hci_conn *conn;
3268
3269         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3270
3271         hci_dev_lock(hdev);
3272
3273         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3274         if (conn) {
3275                 conn->mode = ev->mode;
3276
3277                 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND,
3278                                         &conn->flags)) {
3279                         if (conn->mode == HCI_CM_ACTIVE)
3280                                 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
3281                         else
3282                                 clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
3283                 }
3284
3285                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
3286                         hci_sco_setup(conn, ev->status);
3287         }
3288
3289         hci_dev_unlock(hdev);
3290 }
3291
3292 static void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3293 {
3294         struct hci_ev_pin_code_req *ev = (void *) skb->data;
3295         struct hci_conn *conn;
3296
3297         BT_DBG("%s", hdev->name);
3298
3299         hci_dev_lock(hdev);
3300
3301         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3302         if (!conn)
3303                 goto unlock;
3304
3305         if (conn->state == BT_CONNECTED) {
3306                 hci_conn_hold(conn);
3307                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
3308                 hci_conn_drop(conn);
3309         }
3310
3311         if (!test_bit(HCI_BONDABLE, &hdev->dev_flags) &&
3312             !test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags)) {
3313                 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
3314                              sizeof(ev->bdaddr), &ev->bdaddr);
3315         } else if (test_bit(HCI_MGMT, &hdev->dev_flags)) {
3316                 u8 secure;
3317
3318                 if (conn->pending_sec_level == BT_SECURITY_HIGH)
3319                         secure = 1;
3320                 else
3321                         secure = 0;
3322
3323                 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
3324         }
3325
3326 unlock:
3327         hci_dev_unlock(hdev);
3328 }
3329
3330 static void conn_set_key(struct hci_conn *conn, u8 key_type, u8 pin_len)
3331 {
3332         if (key_type == HCI_LK_CHANGED_COMBINATION)
3333                 return;
3334
3335         conn->pin_length = pin_len;
3336         conn->key_type = key_type;
3337
3338         switch (key_type) {
3339         case HCI_LK_LOCAL_UNIT:
3340         case HCI_LK_REMOTE_UNIT:
3341         case HCI_LK_DEBUG_COMBINATION:
3342                 return;
3343         case HCI_LK_COMBINATION:
3344                 if (pin_len == 16)
3345                         conn->pending_sec_level = BT_SECURITY_HIGH;
3346                 else
3347                         conn->pending_sec_level = BT_SECURITY_MEDIUM;
3348                 break;
3349         case HCI_LK_UNAUTH_COMBINATION_P192:
3350         case HCI_LK_UNAUTH_COMBINATION_P256:
3351                 conn->pending_sec_level = BT_SECURITY_MEDIUM;
3352                 break;
3353         case HCI_LK_AUTH_COMBINATION_P192:
3354                 conn->pending_sec_level = BT_SECURITY_HIGH;
3355                 break;
3356         case HCI_LK_AUTH_COMBINATION_P256:
3357                 conn->pending_sec_level = BT_SECURITY_FIPS;
3358                 break;
3359         }
3360 }
3361
3362 static void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3363 {
3364         struct hci_ev_link_key_req *ev = (void *) skb->data;
3365         struct hci_cp_link_key_reply cp;
3366         struct hci_conn *conn;
3367         struct link_key *key;
3368
3369         BT_DBG("%s", hdev->name);
3370
3371         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3372                 return;
3373
3374         hci_dev_lock(hdev);
3375
3376         key = hci_find_link_key(hdev, &ev->bdaddr);
3377         if (!key) {
3378                 BT_DBG("%s link key not found for %pMR", hdev->name,
3379                        &ev->bdaddr);
3380                 goto not_found;
3381         }
3382
3383         BT_DBG("%s found key type %u for %pMR", hdev->name, key->type,
3384                &ev->bdaddr);
3385
3386         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3387         if (conn) {
3388                 clear_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
3389
3390                 if ((key->type == HCI_LK_UNAUTH_COMBINATION_P192 ||
3391                      key->type == HCI_LK_UNAUTH_COMBINATION_P256) &&
3392                     conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
3393                         BT_DBG("%s ignoring unauthenticated key", hdev->name);
3394                         goto not_found;
3395                 }
3396
3397                 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
3398                     (conn->pending_sec_level == BT_SECURITY_HIGH ||
3399                      conn->pending_sec_level == BT_SECURITY_FIPS)) {
3400                         BT_DBG("%s ignoring key unauthenticated for high security",
3401                                hdev->name);
3402                         goto not_found;
3403                 }
3404
3405                 conn_set_key(conn, key->type, key->pin_len);
3406         }
3407
3408         bacpy(&cp.bdaddr, &ev->bdaddr);
3409         memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);
3410
3411         hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
3412
3413         hci_dev_unlock(hdev);
3414
3415         return;
3416
3417 not_found:
3418         hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
3419         hci_dev_unlock(hdev);
3420 }
3421
3422 static void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
3423 {
3424         struct hci_ev_link_key_notify *ev = (void *) skb->data;
3425         struct hci_conn *conn;
3426         struct link_key *key;
3427         bool persistent;
3428         u8 pin_len = 0;
3429
3430         BT_DBG("%s", hdev->name);
3431
3432         hci_dev_lock(hdev);
3433
3434         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3435         if (!conn)
3436                 goto unlock;
3437
3438         hci_conn_hold(conn);
3439         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3440         hci_conn_drop(conn);
3441
3442         set_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
3443         conn_set_key(conn, ev->key_type, conn->pin_length);
3444
3445         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3446                 goto unlock;
3447
3448         key = hci_add_link_key(hdev, conn, &ev->bdaddr, ev->link_key,
3449                                 ev->key_type, pin_len, &persistent);
3450         if (!key)
3451                 goto unlock;
3452
3453         /* Update connection information since adding the key will have
3454          * fixed up the type in the case of changed combination keys.
3455          */
3456         if (ev->key_type == HCI_LK_CHANGED_COMBINATION)
3457                 conn_set_key(conn, key->type, key->pin_len);
3458
3459         mgmt_new_link_key(hdev, key, persistent);
3460
3461         /* Keep debug keys around only if the HCI_KEEP_DEBUG_KEYS flag
3462          * is set. If it's not set simply remove the key from the kernel
3463          * list (we've still notified user space about it but with
3464          * store_hint being 0).
3465          */
3466         if (key->type == HCI_LK_DEBUG_COMBINATION &&
3467             !test_bit(HCI_KEEP_DEBUG_KEYS, &hdev->dev_flags)) {
3468                 list_del_rcu(&key->list);
3469                 kfree_rcu(key, rcu);
3470                 goto unlock;
3471         }
3472
3473         if (persistent)
3474                 clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
3475         else
3476                 set_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
3477
3478 unlock:
3479         hci_dev_unlock(hdev);
3480 }
3481
3482 static void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
3483 {
3484         struct hci_ev_clock_offset *ev = (void *) skb->data;
3485         struct hci_conn *conn;
3486
3487         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3488
3489         hci_dev_lock(hdev);
3490
3491         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3492         if (conn && !ev->status) {
3493                 struct inquiry_entry *ie;
3494
3495                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
3496                 if (ie) {
3497                         ie->data.clock_offset = ev->clock_offset;
3498                         ie->timestamp = jiffies;
3499                 }
3500         }
3501
3502         hci_dev_unlock(hdev);
3503 }
3504
3505 static void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3506 {
3507         struct hci_ev_pkt_type_change *ev = (void *) skb->data;
3508         struct hci_conn *conn;
3509
3510         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3511
3512         hci_dev_lock(hdev);
3513
3514         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3515         if (conn && !ev->status)
3516                 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
3517
3518         hci_dev_unlock(hdev);
3519 }
3520
3521 static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
3522 {
3523         struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
3524         struct inquiry_entry *ie;
3525
3526         BT_DBG("%s", hdev->name);
3527
3528         hci_dev_lock(hdev);
3529
3530         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
3531         if (ie) {
3532                 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
3533                 ie->timestamp = jiffies;
3534         }
3535
3536         hci_dev_unlock(hdev);
3537 }
3538
3539 static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
3540                                              struct sk_buff *skb)
3541 {
3542         struct inquiry_data data;
3543         int num_rsp = *((__u8 *) skb->data);
3544
3545         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
3546
3547         if (!num_rsp)
3548                 return;
3549
3550         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
3551                 return;
3552
3553         hci_dev_lock(hdev);
3554
3555         if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
3556                 struct inquiry_info_with_rssi_and_pscan_mode *info;
3557                 info = (void *) (skb->data + 1);
3558
3559                 for (; num_rsp; num_rsp--, info++) {
3560                         u32 flags;
3561
3562                         bacpy(&data.bdaddr, &info->bdaddr);
3563                         data.pscan_rep_mode     = info->pscan_rep_mode;
3564                         data.pscan_period_mode  = info->pscan_period_mode;
3565                         data.pscan_mode         = info->pscan_mode;
3566                         memcpy(data.dev_class, info->dev_class, 3);
3567                         data.clock_offset       = info->clock_offset;
3568                         data.rssi               = info->rssi;
3569                         data.ssp_mode           = 0x00;
3570
3571                         flags = hci_inquiry_cache_update(hdev, &data, false);
3572
3573                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
3574                                           info->dev_class, info->rssi,
3575                                           flags, NULL, 0, NULL, 0);
3576                 }
3577         } else {
3578                 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
3579
3580                 for (; num_rsp; num_rsp--, info++) {
3581                         u32 flags;
3582
3583                         bacpy(&data.bdaddr, &info->bdaddr);
3584                         data.pscan_rep_mode     = info->pscan_rep_mode;
3585                         data.pscan_period_mode  = info->pscan_period_mode;
3586                         data.pscan_mode         = 0x00;
3587                         memcpy(data.dev_class, info->dev_class, 3);
3588                         data.clock_offset       = info->clock_offset;
3589                         data.rssi               = info->rssi;
3590                         data.ssp_mode           = 0x00;
3591
3592                         flags = hci_inquiry_cache_update(hdev, &data, false);
3593
3594                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
3595                                           info->dev_class, info->rssi,
3596                                           flags, NULL, 0, NULL, 0);
3597                 }
3598         }
3599
3600         hci_dev_unlock(hdev);
3601 }
3602
3603 static void hci_remote_ext_features_evt(struct hci_dev *hdev,
3604                                         struct sk_buff *skb)
3605 {
3606         struct hci_ev_remote_ext_features *ev = (void *) skb->data;
3607         struct hci_conn *conn;
3608
3609         BT_DBG("%s", hdev->name);
3610
3611         hci_dev_lock(hdev);
3612
3613         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3614         if (!conn)
3615                 goto unlock;
3616
3617         if (ev->page < HCI_MAX_PAGES)
3618                 memcpy(conn->features[ev->page], ev->features, 8);
3619
3620         if (!ev->status && ev->page == 0x01) {
3621                 struct inquiry_entry *ie;
3622
3623                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
3624                 if (ie)
3625                         ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
3626
3627                 if (ev->features[0] & LMP_HOST_SSP) {
3628                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
3629                 } else {
3630                         /* It is mandatory by the Bluetooth specification that
3631                          * Extended Inquiry Results are only used when Secure
3632                          * Simple Pairing is enabled, but some devices violate
3633                          * this.
3634                          *
3635                          * To make these devices work, the internal SSP
3636                          * enabled flag needs to be cleared if the remote host
3637                          * features do not indicate SSP support */
3638                         clear_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
3639                 }
3640
3641                 if (ev->features[0] & LMP_HOST_SC)
3642                         set_bit(HCI_CONN_SC_ENABLED, &conn->flags);
3643         }
3644
3645         if (conn->state != BT_CONFIG)
3646                 goto unlock;
3647
3648         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
3649                 struct hci_cp_remote_name_req cp;
3650                 memset(&cp, 0, sizeof(cp));
3651                 bacpy(&cp.bdaddr, &conn->dst);
3652                 cp.pscan_rep_mode = 0x02;
3653                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
3654         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
3655                 mgmt_device_connected(hdev, conn, 0, NULL, 0);
3656
3657         if (!hci_outgoing_auth_needed(hdev, conn)) {
3658                 conn->state = BT_CONNECTED;
3659                 hci_proto_connect_cfm(conn, ev->status);
3660                 hci_conn_drop(conn);
3661         }
3662
3663 unlock:
3664         hci_dev_unlock(hdev);
3665 }
3666
3667 static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
3668                                        struct sk_buff *skb)
3669 {
3670         struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
3671         struct hci_conn *conn;
3672
3673         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3674
3675         hci_dev_lock(hdev);
3676
3677         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
3678         if (!conn) {
3679                 if (ev->link_type == ESCO_LINK)
3680                         goto unlock;
3681
3682                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
3683                 if (!conn)
3684                         goto unlock;
3685
3686                 conn->type = SCO_LINK;
3687         }
3688
3689         switch (ev->status) {
3690         case 0x00:
3691                 conn->handle = __le16_to_cpu(ev->handle);
3692                 conn->state  = BT_CONNECTED;
3693
3694                 hci_debugfs_create_conn(conn);
3695                 hci_conn_add_sysfs(conn);
3696                 break;
3697
3698         case 0x10:      /* Connection Accept Timeout */
3699         case 0x0d:      /* Connection Rejected due to Limited Resources */
3700         case 0x11:      /* Unsupported Feature or Parameter Value */
3701         case 0x1c:      /* SCO interval rejected */
3702         case 0x1a:      /* Unsupported Remote Feature */
3703         case 0x1f:      /* Unspecified error */
3704         case 0x20:      /* Unsupported LMP Parameter value */
3705                 if (conn->out) {
3706                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
3707                                         (hdev->esco_type & EDR_ESCO_MASK);
3708                         if (hci_setup_sync(conn, conn->link->handle))
3709                                 goto unlock;
3710                 }
3711                 /* fall through */
3712
3713         default:
3714                 conn->state = BT_CLOSED;
3715                 break;
3716         }
3717
3718         hci_proto_connect_cfm(conn, ev->status);
3719         if (ev->status)
3720                 hci_conn_del(conn);
3721
3722 unlock:
3723         hci_dev_unlock(hdev);
3724 }
3725
3726 static inline size_t eir_get_length(u8 *eir, size_t eir_len)
3727 {
3728         size_t parsed = 0;
3729
3730         while (parsed < eir_len) {
3731                 u8 field_len = eir[0];
3732
3733                 if (field_len == 0)
3734                         return parsed;
3735
3736                 parsed += field_len + 1;
3737                 eir += field_len + 1;
3738         }
3739
3740         return eir_len;
3741 }
3742
3743 static void hci_extended_inquiry_result_evt(struct hci_dev *hdev,
3744                                             struct sk_buff *skb)
3745 {
3746         struct inquiry_data data;
3747         struct extended_inquiry_info *info = (void *) (skb->data + 1);
3748         int num_rsp = *((__u8 *) skb->data);
3749         size_t eir_len;
3750
3751         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
3752
3753         if (!num_rsp)
3754                 return;
3755
3756         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
3757                 return;
3758
3759         hci_dev_lock(hdev);
3760
3761         for (; num_rsp; num_rsp--, info++) {
3762                 u32 flags;
3763                 bool name_known;
3764
3765                 bacpy(&data.bdaddr, &info->bdaddr);
3766                 data.pscan_rep_mode     = info->pscan_rep_mode;
3767                 data.pscan_period_mode  = info->pscan_period_mode;
3768                 data.pscan_mode         = 0x00;
3769                 memcpy(data.dev_class, info->dev_class, 3);
3770                 data.clock_offset       = info->clock_offset;
3771                 data.rssi               = info->rssi;
3772                 data.ssp_mode           = 0x01;
3773
3774                 if (test_bit(HCI_MGMT, &hdev->dev_flags))
3775                         name_known = eir_has_data_type(info->data,
3776                                                        sizeof(info->data),
3777                                                        EIR_NAME_COMPLETE);
3778                 else
3779                         name_known = true;
3780
3781                 flags = hci_inquiry_cache_update(hdev, &data, name_known);
3782
3783                 eir_len = eir_get_length(info->data, sizeof(info->data));
3784
3785                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
3786                                   info->dev_class, info->rssi,
3787                                   flags, info->data, eir_len, NULL, 0);
3788         }
3789
3790         hci_dev_unlock(hdev);
3791 }
3792
3793 static void hci_key_refresh_complete_evt(struct hci_dev *hdev,
3794                                          struct sk_buff *skb)
3795 {
3796         struct hci_ev_key_refresh_complete *ev = (void *) skb->data;
3797         struct hci_conn *conn;
3798
3799         BT_DBG("%s status 0x%2.2x handle 0x%4.4x", hdev->name, ev->status,
3800                __le16_to_cpu(ev->handle));
3801
3802         hci_dev_lock(hdev);
3803
3804         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3805         if (!conn)
3806                 goto unlock;
3807
3808         /* For BR/EDR the necessary steps are taken through the
3809          * auth_complete event.
3810          */
3811         if (conn->type != LE_LINK)
3812                 goto unlock;
3813
3814         if (!ev->status)
3815                 conn->sec_level = conn->pending_sec_level;
3816
3817         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3818
3819         if (ev->status && conn->state == BT_CONNECTED) {
3820                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
3821                 hci_conn_drop(conn);
3822                 goto unlock;
3823         }
3824
3825         if (conn->state == BT_CONFIG) {
3826                 if (!ev->status)
3827                         conn->state = BT_CONNECTED;
3828
3829                 hci_proto_connect_cfm(conn, ev->status);
3830                 hci_conn_drop(conn);
3831         } else {
3832                 hci_auth_cfm(conn, ev->status);
3833
3834                 hci_conn_hold(conn);
3835                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3836                 hci_conn_drop(conn);
3837         }
3838
3839 unlock:
3840         hci_dev_unlock(hdev);
3841 }
3842
3843 static u8 hci_get_auth_req(struct hci_conn *conn)
3844 {
3845         /* If remote requests no-bonding follow that lead */
3846         if (conn->remote_auth == HCI_AT_NO_BONDING ||
3847             conn->remote_auth == HCI_AT_NO_BONDING_MITM)
3848                 return conn->remote_auth | (conn->auth_type & 0x01);
3849
3850         /* If both remote and local have enough IO capabilities, require
3851          * MITM protection
3852          */
3853         if (conn->remote_cap != HCI_IO_NO_INPUT_OUTPUT &&
3854             conn->io_capability != HCI_IO_NO_INPUT_OUTPUT)
3855                 return conn->remote_auth | 0x01;
3856
3857         /* No MITM protection possible so ignore remote requirement */
3858         return (conn->remote_auth & ~0x01) | (conn->auth_type & 0x01);
3859 }
3860
3861 static u8 bredr_oob_data_present(struct hci_conn *conn)
3862 {
3863         struct hci_dev *hdev = conn->hdev;
3864         struct oob_data *data;
3865
3866         data = hci_find_remote_oob_data(hdev, &conn->dst, BDADDR_BREDR);
3867         if (!data)
3868                 return 0x00;
3869
3870         /* When Secure Connections Only mode is enabled, then the P-256
3871          * values are required. If they are not available, then do not
3872          * declare that OOB data is present.
3873          */
3874         if (bredr_sc_enabled(hdev) &&
3875             test_bit(HCI_SC_ONLY, &hdev->dev_flags) &&
3876             (!memcmp(data->rand256, ZERO_KEY, 16) ||
3877              !memcmp(data->hash256, ZERO_KEY, 16)))
3878                 return 0x00;
3879
3880         if (conn->out || test_bit(HCI_CONN_REMOTE_OOB, &conn->flags))
3881                 return 0x01;
3882
3883         return 0x00;
3884 }
3885
3886 static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3887 {
3888         struct hci_ev_io_capa_request *ev = (void *) skb->data;
3889         struct hci_conn *conn;
3890
3891         BT_DBG("%s", hdev->name);
3892
3893         hci_dev_lock(hdev);
3894
3895         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3896         if (!conn)
3897                 goto unlock;
3898
3899         hci_conn_hold(conn);
3900
3901         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3902                 goto unlock;
3903
3904         /* Allow pairing if we're pairable, the initiators of the
3905          * pairing or if the remote is not requesting bonding.
3906          */
3907         if (test_bit(HCI_BONDABLE, &hdev->dev_flags) ||
3908             test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags) ||
3909             (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
3910                 struct hci_cp_io_capability_reply cp;
3911
3912                 bacpy(&cp.bdaddr, &ev->bdaddr);
3913                 /* Change the IO capability from KeyboardDisplay
3914                  * to DisplayYesNo as it is not supported by BT spec. */
3915                 cp.capability = (conn->io_capability == 0x04) ?
3916                                 HCI_IO_DISPLAY_YESNO : conn->io_capability;
3917
3918                 /* If we are initiators, there is no remote information yet */
3919                 if (conn->remote_auth == 0xff) {
3920                         /* Request MITM protection if our IO caps allow it
3921                          * except for the no-bonding case.
3922                          */
3923                         if (conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
3924                             conn->auth_type != HCI_AT_NO_BONDING)
3925                                 conn->auth_type |= 0x01;
3926                 } else {
3927                         conn->auth_type = hci_get_auth_req(conn);
3928                 }
3929
3930                 /* If we're not bondable, force one of the non-bondable
3931                  * authentication requirement values.
3932                  */
3933                 if (!test_bit(HCI_BONDABLE, &hdev->dev_flags))
3934                         conn->auth_type &= HCI_AT_NO_BONDING_MITM;
3935
3936                 cp.authentication = conn->auth_type;
3937                 cp.oob_data = bredr_oob_data_present(conn);
3938
3939                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
3940                              sizeof(cp), &cp);
3941         } else {
3942                 struct hci_cp_io_capability_neg_reply cp;
3943
3944                 bacpy(&cp.bdaddr, &ev->bdaddr);
3945                 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
3946
3947                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
3948                              sizeof(cp), &cp);
3949         }
3950
3951 unlock:
3952         hci_dev_unlock(hdev);
3953 }
3954
3955 static void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
3956 {
3957         struct hci_ev_io_capa_reply *ev = (void *) skb->data;
3958         struct hci_conn *conn;
3959
3960         BT_DBG("%s", hdev->name);
3961
3962         hci_dev_lock(hdev);
3963
3964         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3965         if (!conn)
3966                 goto unlock;
3967
3968         conn->remote_cap = ev->capability;
3969         conn->remote_auth = ev->authentication;
3970         if (ev->oob_data)
3971                 set_bit(HCI_CONN_REMOTE_OOB, &conn->flags);
3972
3973 unlock:
3974         hci_dev_unlock(hdev);
3975 }
3976
3977 static void hci_user_confirm_request_evt(struct hci_dev *hdev,
3978                                          struct sk_buff *skb)
3979 {
3980         struct hci_ev_user_confirm_req *ev = (void *) skb->data;
3981         int loc_mitm, rem_mitm, confirm_hint = 0;
3982         struct hci_conn *conn;
3983
3984         BT_DBG("%s", hdev->name);
3985
3986         hci_dev_lock(hdev);
3987
3988         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3989                 goto unlock;
3990
3991         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3992         if (!conn)
3993                 goto unlock;
3994
3995         loc_mitm = (conn->auth_type & 0x01);
3996         rem_mitm = (conn->remote_auth & 0x01);
3997
3998         /* If we require MITM but the remote device can't provide that
3999          * (it has NoInputNoOutput) then reject the confirmation
4000          * request. We check the security level here since it doesn't
4001          * necessarily match conn->auth_type.
4002          */
4003         if (conn->pending_sec_level > BT_SECURITY_MEDIUM &&
4004             conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
4005                 BT_DBG("Rejecting request: remote device can't provide MITM");
4006                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
4007                              sizeof(ev->bdaddr), &ev->bdaddr);
4008                 goto unlock;
4009         }
4010
4011         /* If no side requires MITM protection; auto-accept */
4012         if ((!loc_mitm || conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) &&
4013             (!rem_mitm || conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)) {
4014
4015                 /* If we're not the initiators request authorization to
4016                  * proceed from user space (mgmt_user_confirm with
4017                  * confirm_hint set to 1). The exception is if neither
4018                  * side had MITM or if the local IO capability is
4019                  * NoInputNoOutput, in which case we do auto-accept
4020                  */
4021                 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&
4022                     conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
4023                     (loc_mitm || rem_mitm)) {
4024                         BT_DBG("Confirming auto-accept as acceptor");
4025                         confirm_hint = 1;
4026                         goto confirm;
4027                 }
4028
4029                 BT_DBG("Auto-accept of user confirmation with %ums delay",
4030                        hdev->auto_accept_delay);
4031
4032                 if (hdev->auto_accept_delay > 0) {
4033                         int delay = msecs_to_jiffies(hdev->auto_accept_delay);
4034                         queue_delayed_work(conn->hdev->workqueue,
4035                                            &conn->auto_accept_work, delay);
4036                         goto unlock;
4037                 }
4038
4039                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
4040                              sizeof(ev->bdaddr), &ev->bdaddr);
4041                 goto unlock;
4042         }
4043
4044 confirm:
4045         mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0,
4046                                   le32_to_cpu(ev->passkey), confirm_hint);
4047
4048 unlock:
4049         hci_dev_unlock(hdev);
4050 }
4051
4052 static void hci_user_passkey_request_evt(struct hci_dev *hdev,
4053                                          struct sk_buff *skb)
4054 {
4055         struct hci_ev_user_passkey_req *ev = (void *) skb->data;
4056
4057         BT_DBG("%s", hdev->name);
4058
4059         if (test_bit(HCI_MGMT, &hdev->dev_flags))
4060                 mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
4061 }
4062
4063 static void hci_user_passkey_notify_evt(struct hci_dev *hdev,
4064                                         struct sk_buff *skb)
4065 {
4066         struct hci_ev_user_passkey_notify *ev = (void *) skb->data;
4067         struct hci_conn *conn;
4068
4069         BT_DBG("%s", hdev->name);
4070
4071         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4072         if (!conn)
4073                 return;
4074
4075         conn->passkey_notify = __le32_to_cpu(ev->passkey);
4076         conn->passkey_entered = 0;
4077
4078         if (test_bit(HCI_MGMT, &hdev->dev_flags))
4079                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
4080                                          conn->dst_type, conn->passkey_notify,
4081                                          conn->passkey_entered);
4082 }
4083
4084 static void hci_keypress_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
4085 {
4086         struct hci_ev_keypress_notify *ev = (void *) skb->data;
4087         struct hci_conn *conn;
4088
4089         BT_DBG("%s", hdev->name);
4090
4091         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4092         if (!conn)
4093                 return;
4094
4095         switch (ev->type) {
4096         case HCI_KEYPRESS_STARTED:
4097                 conn->passkey_entered = 0;
4098                 return;
4099
4100         case HCI_KEYPRESS_ENTERED:
4101                 conn->passkey_entered++;
4102                 break;
4103
4104         case HCI_KEYPRESS_ERASED:
4105                 conn->passkey_entered--;
4106                 break;
4107
4108         case HCI_KEYPRESS_CLEARED:
4109                 conn->passkey_entered = 0;
4110                 break;
4111
4112         case HCI_KEYPRESS_COMPLETED:
4113                 return;
4114         }
4115
4116         if (test_bit(HCI_MGMT, &hdev->dev_flags))
4117                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
4118                                          conn->dst_type, conn->passkey_notify,
4119                                          conn->passkey_entered);
4120 }
4121
4122 static void hci_simple_pair_complete_evt(struct hci_dev *hdev,
4123                                          struct sk_buff *skb)
4124 {
4125         struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
4126         struct hci_conn *conn;
4127
4128         BT_DBG("%s", hdev->name);
4129
4130         hci_dev_lock(hdev);
4131
4132         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4133         if (!conn)
4134                 goto unlock;
4135
4136         /* Reset the authentication requirement to unknown */
4137         conn->remote_auth = 0xff;
4138
4139         /* To avoid duplicate auth_failed events to user space we check
4140          * the HCI_CONN_AUTH_PEND flag which will be set if we
4141          * initiated the authentication. A traditional auth_complete
4142          * event gets always produced as initiator and is also mapped to
4143          * the mgmt_auth_failed event */
4144         if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status)
4145                 mgmt_auth_failed(conn, ev->status);
4146
4147         hci_conn_drop(conn);
4148
4149 unlock:
4150         hci_dev_unlock(hdev);
4151 }
4152
4153 static void hci_remote_host_features_evt(struct hci_dev *hdev,
4154                                          struct sk_buff *skb)
4155 {
4156         struct hci_ev_remote_host_features *ev = (void *) skb->data;
4157         struct inquiry_entry *ie;
4158         struct hci_conn *conn;
4159
4160         BT_DBG("%s", hdev->name);
4161
4162         hci_dev_lock(hdev);
4163
4164         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4165         if (conn)
4166                 memcpy(conn->features[1], ev->features, 8);
4167
4168         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
4169         if (ie)
4170                 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
4171
4172         hci_dev_unlock(hdev);
4173 }
4174
4175 static void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
4176                                             struct sk_buff *skb)
4177 {
4178         struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
4179         struct oob_data *data;
4180
4181         BT_DBG("%s", hdev->name);
4182
4183         hci_dev_lock(hdev);
4184
4185         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
4186                 goto unlock;
4187
4188         data = hci_find_remote_oob_data(hdev, &ev->bdaddr, BDADDR_BREDR);
4189         if (!data) {
4190                 struct hci_cp_remote_oob_data_neg_reply cp;
4191
4192                 bacpy(&cp.bdaddr, &ev->bdaddr);
4193                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY,
4194                              sizeof(cp), &cp);
4195                 goto unlock;
4196         }
4197
4198         if (bredr_sc_enabled(hdev)) {
4199                 struct hci_cp_remote_oob_ext_data_reply cp;
4200
4201                 bacpy(&cp.bdaddr, &ev->bdaddr);
4202                 if (test_bit(HCI_SC_ONLY, &hdev->dev_flags)) {
4203                         memset(cp.hash192, 0, sizeof(cp.hash192));
4204                         memset(cp.rand192, 0, sizeof(cp.rand192));
4205                 } else {
4206                         memcpy(cp.hash192, data->hash192, sizeof(cp.hash192));
4207                         memcpy(cp.rand192, data->rand192, sizeof(cp.rand192));
4208                 }
4209                 memcpy(cp.hash256, data->hash256, sizeof(cp.hash256));
4210                 memcpy(cp.rand256, data->rand256, sizeof(cp.rand256));
4211
4212                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_EXT_DATA_REPLY,
4213                              sizeof(cp), &cp);
4214         } else {
4215                 struct hci_cp_remote_oob_data_reply cp;
4216
4217                 bacpy(&cp.bdaddr, &ev->bdaddr);
4218                 memcpy(cp.hash, data->hash192, sizeof(cp.hash));
4219                 memcpy(cp.rand, data->rand192, sizeof(cp.rand));
4220
4221                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY,
4222                              sizeof(cp), &cp);
4223         }
4224
4225 unlock:
4226         hci_dev_unlock(hdev);
4227 }
4228
4229 static void hci_phy_link_complete_evt(struct hci_dev *hdev,
4230                                       struct sk_buff *skb)
4231 {
4232         struct hci_ev_phy_link_complete *ev = (void *) skb->data;
4233         struct hci_conn *hcon, *bredr_hcon;
4234
4235         BT_DBG("%s handle 0x%2.2x status 0x%2.2x", hdev->name, ev->phy_handle,
4236                ev->status);
4237
4238         hci_dev_lock(hdev);
4239
4240         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4241         if (!hcon) {
4242                 hci_dev_unlock(hdev);
4243                 return;
4244         }
4245
4246         if (ev->status) {
4247                 hci_conn_del(hcon);
4248                 hci_dev_unlock(hdev);
4249                 return;
4250         }
4251
4252         bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
4253
4254         hcon->state = BT_CONNECTED;
4255         bacpy(&hcon->dst, &bredr_hcon->dst);
4256
4257         hci_conn_hold(hcon);
4258         hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
4259         hci_conn_drop(hcon);
4260
4261         hci_debugfs_create_conn(hcon);
4262         hci_conn_add_sysfs(hcon);
4263
4264         amp_physical_cfm(bredr_hcon, hcon);
4265
4266         hci_dev_unlock(hdev);
4267 }
4268
4269 static void hci_loglink_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
4270 {
4271         struct hci_ev_logical_link_complete *ev = (void *) skb->data;
4272         struct hci_conn *hcon;
4273         struct hci_chan *hchan;
4274         struct amp_mgr *mgr;
4275
4276         BT_DBG("%s log_handle 0x%4.4x phy_handle 0x%2.2x status 0x%2.2x",
4277                hdev->name, le16_to_cpu(ev->handle), ev->phy_handle,
4278                ev->status);
4279
4280         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4281         if (!hcon)
4282                 return;
4283
4284         /* Create AMP hchan */
4285         hchan = hci_chan_create(hcon);
4286         if (!hchan)
4287                 return;
4288
4289         hchan->handle = le16_to_cpu(ev->handle);
4290
4291         BT_DBG("hcon %p mgr %p hchan %p", hcon, hcon->amp_mgr, hchan);
4292
4293         mgr = hcon->amp_mgr;
4294         if (mgr && mgr->bredr_chan) {
4295                 struct l2cap_chan *bredr_chan = mgr->bredr_chan;
4296
4297                 l2cap_chan_lock(bredr_chan);
4298
4299                 bredr_chan->conn->mtu = hdev->block_mtu;
4300                 l2cap_logical_cfm(bredr_chan, hchan, 0);
4301                 hci_conn_hold(hcon);
4302
4303                 l2cap_chan_unlock(bredr_chan);
4304         }
4305 }
4306
4307 static void hci_disconn_loglink_complete_evt(struct hci_dev *hdev,
4308                                              struct sk_buff *skb)
4309 {
4310         struct hci_ev_disconn_logical_link_complete *ev = (void *) skb->data;
4311         struct hci_chan *hchan;
4312
4313         BT_DBG("%s log handle 0x%4.4x status 0x%2.2x", hdev->name,
4314                le16_to_cpu(ev->handle), ev->status);
4315
4316         if (ev->status)
4317                 return;
4318
4319         hci_dev_lock(hdev);
4320
4321         hchan = hci_chan_lookup_handle(hdev, le16_to_cpu(ev->handle));
4322         if (!hchan)
4323                 goto unlock;
4324
4325         amp_destroy_logical_link(hchan, ev->reason);
4326
4327 unlock:
4328         hci_dev_unlock(hdev);
4329 }
4330
4331 static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev,
4332                                              struct sk_buff *skb)
4333 {
4334         struct hci_ev_disconn_phy_link_complete *ev = (void *) skb->data;
4335         struct hci_conn *hcon;
4336
4337         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4338
4339         if (ev->status)
4340                 return;
4341
4342         hci_dev_lock(hdev);
4343
4344         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4345         if (hcon) {
4346                 hcon->state = BT_CLOSED;
4347                 hci_conn_del(hcon);
4348         }
4349
4350         hci_dev_unlock(hdev);
4351 }
4352
4353 static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
4354 {
4355         struct hci_ev_le_conn_complete *ev = (void *) skb->data;
4356         struct hci_conn_params *params;
4357         struct hci_conn *conn;
4358         struct smp_irk *irk;
4359         u8 addr_type;
4360
4361         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4362
4363         hci_dev_lock(hdev);
4364
4365         /* All controllers implicitly stop advertising in the event of a
4366          * connection, so ensure that the state bit is cleared.
4367          */
4368         clear_bit(HCI_LE_ADV, &hdev->dev_flags);
4369
4370         conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
4371         if (!conn) {
4372                 conn = hci_conn_add(hdev, LE_LINK, &ev->bdaddr, ev->role);
4373                 if (!conn) {
4374                         BT_ERR("No memory for new connection");
4375                         goto unlock;
4376                 }
4377
4378                 conn->dst_type = ev->bdaddr_type;
4379
4380                 /* If we didn't have a hci_conn object previously
4381                  * but we're in master role this must be something
4382                  * initiated using a white list. Since white list based
4383                  * connections are not "first class citizens" we don't
4384                  * have full tracking of them. Therefore, we go ahead
4385                  * with a "best effort" approach of determining the
4386                  * initiator address based on the HCI_PRIVACY flag.
4387                  */
4388                 if (conn->out) {
4389                         conn->resp_addr_type = ev->bdaddr_type;
4390                         bacpy(&conn->resp_addr, &ev->bdaddr);
4391                         if (test_bit(HCI_PRIVACY, &hdev->dev_flags)) {
4392                                 conn->init_addr_type = ADDR_LE_DEV_RANDOM;
4393                                 bacpy(&conn->init_addr, &hdev->rpa);
4394                         } else {
4395                                 hci_copy_identity_address(hdev,
4396                                                           &conn->init_addr,
4397                                                           &conn->init_addr_type);
4398                         }
4399                 }
4400         } else {
4401                 cancel_delayed_work(&conn->le_conn_timeout);
4402         }
4403
4404         if (!conn->out) {
4405                 /* Set the responder (our side) address type based on
4406                  * the advertising address type.
4407                  */
4408                 conn->resp_addr_type = hdev->adv_addr_type;
4409                 if (hdev->adv_addr_type == ADDR_LE_DEV_RANDOM)
4410                         bacpy(&conn->resp_addr, &hdev->random_addr);
4411                 else
4412                         bacpy(&conn->resp_addr, &hdev->bdaddr);
4413
4414                 conn->init_addr_type = ev->bdaddr_type;
4415                 bacpy(&conn->init_addr, &ev->bdaddr);
4416
4417                 /* For incoming connections, set the default minimum
4418                  * and maximum connection interval. They will be used
4419                  * to check if the parameters are in range and if not
4420                  * trigger the connection update procedure.
4421                  */
4422                 conn->le_conn_min_interval = hdev->le_conn_min_interval;
4423                 conn->le_conn_max_interval = hdev->le_conn_max_interval;
4424         }
4425
4426         /* Lookup the identity address from the stored connection
4427          * address and address type.
4428          *
4429          * When establishing connections to an identity address, the
4430          * connection procedure will store the resolvable random
4431          * address first. Now if it can be converted back into the
4432          * identity address, start using the identity address from
4433          * now on.
4434          */
4435         irk = hci_get_irk(hdev, &conn->dst, conn->dst_type);
4436         if (irk) {
4437                 bacpy(&conn->dst, &irk->bdaddr);
4438                 conn->dst_type = irk->addr_type;
4439         }
4440
4441         if (ev->status) {
4442                 hci_le_conn_failed(conn, ev->status);
4443                 goto unlock;
4444         }
4445
4446         if (conn->dst_type == ADDR_LE_DEV_PUBLIC)
4447                 addr_type = BDADDR_LE_PUBLIC;
4448         else
4449                 addr_type = BDADDR_LE_RANDOM;
4450
4451         /* Drop the connection if the device is blocked */
4452         if (hci_bdaddr_list_lookup(&hdev->blacklist, &conn->dst, addr_type)) {
4453                 hci_conn_drop(conn);
4454                 goto unlock;
4455         }
4456
4457         if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
4458                 mgmt_device_connected(hdev, conn, 0, NULL, 0);
4459
4460         conn->sec_level = BT_SECURITY_LOW;
4461         conn->handle = __le16_to_cpu(ev->handle);
4462         conn->state = BT_CONNECTED;
4463
4464         conn->le_conn_interval = le16_to_cpu(ev->interval);
4465         conn->le_conn_latency = le16_to_cpu(ev->latency);
4466         conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
4467
4468         hci_debugfs_create_conn(conn);
4469         hci_conn_add_sysfs(conn);
4470
4471         hci_proto_connect_cfm(conn, ev->status);
4472
4473         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
4474                                            conn->dst_type);
4475         if (params) {
4476                 list_del_init(&params->action);
4477                 if (params->conn) {
4478                         hci_conn_drop(params->conn);
4479                         hci_conn_put(params->conn);
4480                         params->conn = NULL;
4481                 }
4482         }
4483
4484 unlock:
4485         hci_update_background_scan(hdev);
4486         hci_dev_unlock(hdev);
4487 }
4488
4489 static void hci_le_conn_update_complete_evt(struct hci_dev *hdev,
4490                                             struct sk_buff *skb)
4491 {
4492         struct hci_ev_le_conn_update_complete *ev = (void *) skb->data;
4493         struct hci_conn *conn;
4494
4495         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4496
4497         if (ev->status)
4498                 return;
4499
4500         hci_dev_lock(hdev);
4501
4502         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4503         if (conn) {
4504                 conn->le_conn_interval = le16_to_cpu(ev->interval);
4505                 conn->le_conn_latency = le16_to_cpu(ev->latency);
4506                 conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
4507         }
4508
4509         hci_dev_unlock(hdev);
4510 }
4511
4512 /* This function requires the caller holds hdev->lock */
4513 static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev,
4514                                               bdaddr_t *addr,
4515                                               u8 addr_type, u8 adv_type)
4516 {
4517         struct hci_conn *conn;
4518         struct hci_conn_params *params;
4519
4520         /* If the event is not connectable don't proceed further */
4521         if (adv_type != LE_ADV_IND && adv_type != LE_ADV_DIRECT_IND)
4522                 return NULL;
4523
4524         /* Ignore if the device is blocked */
4525         if (hci_bdaddr_list_lookup(&hdev->blacklist, addr, addr_type))
4526                 return NULL;
4527
4528         /* Most controller will fail if we try to create new connections
4529          * while we have an existing one in slave role.
4530          */
4531         if (hdev->conn_hash.le_num_slave > 0)
4532                 return NULL;
4533
4534         /* If we're not connectable only connect devices that we have in
4535          * our pend_le_conns list.
4536          */
4537         params = hci_pend_le_action_lookup(&hdev->pend_le_conns,
4538                                            addr, addr_type);
4539         if (!params)
4540                 return NULL;
4541
4542         switch (params->auto_connect) {
4543         case HCI_AUTO_CONN_DIRECT:
4544                 /* Only devices advertising with ADV_DIRECT_IND are
4545                  * triggering a connection attempt. This is allowing
4546                  * incoming connections from slave devices.
4547                  */
4548                 if (adv_type != LE_ADV_DIRECT_IND)
4549                         return NULL;
4550                 break;
4551         case HCI_AUTO_CONN_ALWAYS:
4552                 /* Devices advertising with ADV_IND or ADV_DIRECT_IND
4553                  * are triggering a connection attempt. This means
4554                  * that incoming connectioms from slave device are
4555                  * accepted and also outgoing connections to slave
4556                  * devices are established when found.
4557                  */
4558                 break;
4559         default:
4560                 return NULL;
4561         }
4562
4563         conn = hci_connect_le(hdev, addr, addr_type, BT_SECURITY_LOW,
4564                               HCI_LE_AUTOCONN_TIMEOUT, HCI_ROLE_MASTER);
4565         if (!IS_ERR(conn)) {
4566                 /* Store the pointer since we don't really have any
4567                  * other owner of the object besides the params that
4568                  * triggered it. This way we can abort the connection if
4569                  * the parameters get removed and keep the reference
4570                  * count consistent once the connection is established.
4571                  */
4572                 params->conn = hci_conn_get(conn);
4573                 return conn;
4574         }
4575
4576         switch (PTR_ERR(conn)) {
4577         case -EBUSY:
4578                 /* If hci_connect() returns -EBUSY it means there is already
4579                  * an LE connection attempt going on. Since controllers don't
4580                  * support more than one connection attempt at the time, we
4581                  * don't consider this an error case.
4582                  */
4583                 break;
4584         default:
4585                 BT_DBG("Failed to connect: err %ld", PTR_ERR(conn));
4586                 return NULL;
4587         }
4588
4589         return NULL;
4590 }
4591
4592 static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
4593                                u8 bdaddr_type, bdaddr_t *direct_addr,
4594                                u8 direct_addr_type, s8 rssi, u8 *data, u8 len)
4595 {
4596         struct discovery_state *d = &hdev->discovery;
4597         struct smp_irk *irk;
4598         struct hci_conn *conn;
4599         bool match;
4600         u32 flags;
4601
4602         /* If the direct address is present, then this report is from
4603          * a LE Direct Advertising Report event. In that case it is
4604          * important to see if the address is matching the local
4605          * controller address.
4606          */
4607         if (direct_addr) {
4608                 /* Only resolvable random addresses are valid for these
4609                  * kind of reports and others can be ignored.
4610                  */
4611                 if (!hci_bdaddr_is_rpa(direct_addr, direct_addr_type))
4612                         return;
4613
4614                 /* If the controller is not using resolvable random
4615                  * addresses, then this report can be ignored.
4616                  */
4617                 if (!test_bit(HCI_PRIVACY, &hdev->dev_flags))
4618                         return;
4619
4620                 /* If the local IRK of the controller does not match
4621                  * with the resolvable random address provided, then
4622                  * this report can be ignored.
4623                  */
4624                 if (!smp_irk_matches(hdev, hdev->irk, direct_addr))
4625                         return;
4626         }
4627
4628         /* Check if we need to convert to identity address */
4629         irk = hci_get_irk(hdev, bdaddr, bdaddr_type);
4630         if (irk) {
4631                 bdaddr = &irk->bdaddr;
4632                 bdaddr_type = irk->addr_type;
4633         }
4634
4635         /* Check if we have been requested to connect to this device */
4636         conn = check_pending_le_conn(hdev, bdaddr, bdaddr_type, type);
4637         if (conn && type == LE_ADV_IND) {
4638                 /* Store report for later inclusion by
4639                  * mgmt_device_connected
4640                  */
4641                 memcpy(conn->le_adv_data, data, len);
4642                 conn->le_adv_data_len = len;
4643         }
4644
4645         /* Passive scanning shouldn't trigger any device found events,
4646          * except for devices marked as CONN_REPORT for which we do send
4647          * device found events.
4648          */
4649         if (hdev->le_scan_type == LE_SCAN_PASSIVE) {
4650                 if (type == LE_ADV_DIRECT_IND)
4651                         return;
4652
4653                 if (!hci_pend_le_action_lookup(&hdev->pend_le_reports,
4654                                                bdaddr, bdaddr_type))
4655                         return;
4656
4657                 if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND)
4658                         flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
4659                 else
4660                         flags = 0;
4661                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
4662                                   rssi, flags, data, len, NULL, 0);
4663                 return;
4664         }
4665
4666         /* When receiving non-connectable or scannable undirected
4667          * advertising reports, this means that the remote device is
4668          * not connectable and then clearly indicate this in the
4669          * device found event.
4670          *
4671          * When receiving a scan response, then there is no way to
4672          * know if the remote device is connectable or not. However
4673          * since scan responses are merged with a previously seen
4674          * advertising report, the flags field from that report
4675          * will be used.
4676          *
4677          * In the really unlikely case that a controller get confused
4678          * and just sends a scan response event, then it is marked as
4679          * not connectable as well.
4680          */
4681         if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND ||
4682             type == LE_ADV_SCAN_RSP)
4683                 flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
4684         else
4685                 flags = 0;
4686
4687         /* If there's nothing pending either store the data from this
4688          * event or send an immediate device found event if the data
4689          * should not be stored for later.
4690          */
4691         if (!has_pending_adv_report(hdev)) {
4692                 /* If the report will trigger a SCAN_REQ store it for
4693                  * later merging.
4694                  */
4695                 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
4696                         store_pending_adv_report(hdev, bdaddr, bdaddr_type,
4697                                                  rssi, flags, data, len);
4698                         return;
4699                 }
4700
4701                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
4702                                   rssi, flags, data, len, NULL, 0);
4703                 return;
4704         }
4705
4706         /* Check if the pending report is for the same device as the new one */
4707         match = (!bacmp(bdaddr, &d->last_adv_addr) &&
4708                  bdaddr_type == d->last_adv_addr_type);
4709
4710         /* If the pending data doesn't match this report or this isn't a
4711          * scan response (e.g. we got a duplicate ADV_IND) then force
4712          * sending of the pending data.
4713          */
4714         if (type != LE_ADV_SCAN_RSP || !match) {
4715                 /* Send out whatever is in the cache, but skip duplicates */
4716                 if (!match)
4717                         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
4718                                           d->last_adv_addr_type, NULL,
4719                                           d->last_adv_rssi, d->last_adv_flags,
4720                                           d->last_adv_data,
4721                                           d->last_adv_data_len, NULL, 0);
4722
4723                 /* If the new report will trigger a SCAN_REQ store it for
4724                  * later merging.
4725                  */
4726                 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
4727                         store_pending_adv_report(hdev, bdaddr, bdaddr_type,
4728                                                  rssi, flags, data, len);
4729                         return;
4730                 }
4731
4732                 /* The advertising reports cannot be merged, so clear
4733                  * the pending report and send out a device found event.
4734                  */
4735                 clear_pending_adv_report(hdev);
4736                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
4737                                   rssi, flags, data, len, NULL, 0);
4738                 return;
4739         }
4740
4741         /* If we get here we've got a pending ADV_IND or ADV_SCAN_IND and
4742          * the new event is a SCAN_RSP. We can therefore proceed with
4743          * sending a merged device found event.
4744          */
4745         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
4746                           d->last_adv_addr_type, NULL, rssi, d->last_adv_flags,
4747                           d->last_adv_data, d->last_adv_data_len, data, len);
4748         clear_pending_adv_report(hdev);
4749 }
4750
4751 static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
4752 {
4753         u8 num_reports = skb->data[0];
4754         void *ptr = &skb->data[1];
4755
4756         hci_dev_lock(hdev);
4757
4758         while (num_reports--) {
4759                 struct hci_ev_le_advertising_info *ev = ptr;
4760                 s8 rssi;
4761
4762                 rssi = ev->data[ev->length];
4763                 process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
4764                                    ev->bdaddr_type, NULL, 0, rssi,
4765                                    ev->data, ev->length);
4766
4767                 ptr += sizeof(*ev) + ev->length + 1;
4768         }
4769
4770         hci_dev_unlock(hdev);
4771 }
4772
4773 static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
4774 {
4775         struct hci_ev_le_ltk_req *ev = (void *) skb->data;
4776         struct hci_cp_le_ltk_reply cp;
4777         struct hci_cp_le_ltk_neg_reply neg;
4778         struct hci_conn *conn;
4779         struct smp_ltk *ltk;
4780
4781         BT_DBG("%s handle 0x%4.4x", hdev->name, __le16_to_cpu(ev->handle));
4782
4783         hci_dev_lock(hdev);
4784
4785         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4786         if (conn == NULL)
4787                 goto not_found;
4788
4789         ltk = hci_find_ltk(hdev, &conn->dst, conn->dst_type, conn->role);
4790         if (!ltk)
4791                 goto not_found;
4792
4793         if (smp_ltk_is_sc(ltk)) {
4794                 /* With SC both EDiv and Rand are set to zero */
4795                 if (ev->ediv || ev->rand)
4796                         goto not_found;
4797         } else {
4798                 /* For non-SC keys check that EDiv and Rand match */
4799                 if (ev->ediv != ltk->ediv || ev->rand != ltk->rand)
4800                         goto not_found;
4801         }
4802
4803         memcpy(cp.ltk, ltk->val, sizeof(ltk->val));
4804         cp.handle = cpu_to_le16(conn->handle);
4805
4806         conn->pending_sec_level = smp_ltk_sec_level(ltk);
4807
4808         conn->enc_key_size = ltk->enc_size;
4809
4810         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
4811
4812         /* Ref. Bluetooth Core SPEC pages 1975 and 2004. STK is a
4813          * temporary key used to encrypt a connection following
4814          * pairing. It is used during the Encrypted Session Setup to
4815          * distribute the keys. Later, security can be re-established
4816          * using a distributed LTK.
4817          */
4818         if (ltk->type == SMP_STK) {
4819                 set_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
4820                 list_del_rcu(&ltk->list);
4821                 kfree_rcu(ltk, rcu);
4822         } else {
4823                 clear_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
4824         }
4825
4826         hci_dev_unlock(hdev);
4827
4828         return;
4829
4830 not_found:
4831         neg.handle = ev->handle;
4832         hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
4833         hci_dev_unlock(hdev);
4834 }
4835
4836 static void send_conn_param_neg_reply(struct hci_dev *hdev, u16 handle,
4837                                       u8 reason)
4838 {
4839         struct hci_cp_le_conn_param_req_neg_reply cp;
4840
4841         cp.handle = cpu_to_le16(handle);
4842         cp.reason = reason;
4843
4844         hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_NEG_REPLY, sizeof(cp),
4845                      &cp);
4846 }
4847
4848 static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev,
4849                                              struct sk_buff *skb)
4850 {
4851         struct hci_ev_le_remote_conn_param_req *ev = (void *) skb->data;
4852         struct hci_cp_le_conn_param_req_reply cp;
4853         struct hci_conn *hcon;
4854         u16 handle, min, max, latency, timeout;
4855
4856         handle = le16_to_cpu(ev->handle);
4857         min = le16_to_cpu(ev->interval_min);
4858         max = le16_to_cpu(ev->interval_max);
4859         latency = le16_to_cpu(ev->latency);
4860         timeout = le16_to_cpu(ev->timeout);
4861
4862         hcon = hci_conn_hash_lookup_handle(hdev, handle);
4863         if (!hcon || hcon->state != BT_CONNECTED)
4864                 return send_conn_param_neg_reply(hdev, handle,
4865                                                  HCI_ERROR_UNKNOWN_CONN_ID);
4866
4867         if (hci_check_conn_params(min, max, latency, timeout))
4868                 return send_conn_param_neg_reply(hdev, handle,
4869                                                  HCI_ERROR_INVALID_LL_PARAMS);
4870
4871         if (hcon->role == HCI_ROLE_MASTER) {
4872                 struct hci_conn_params *params;
4873                 u8 store_hint;
4874
4875                 hci_dev_lock(hdev);
4876
4877                 params = hci_conn_params_lookup(hdev, &hcon->dst,
4878                                                 hcon->dst_type);
4879                 if (params) {
4880                         params->conn_min_interval = min;
4881                         params->conn_max_interval = max;
4882                         params->conn_latency = latency;
4883                         params->supervision_timeout = timeout;
4884                         store_hint = 0x01;
4885                 } else{
4886                         store_hint = 0x00;
4887                 }
4888
4889                 hci_dev_unlock(hdev);
4890
4891                 mgmt_new_conn_param(hdev, &hcon->dst, hcon->dst_type,
4892                                     store_hint, min, max, latency, timeout);
4893         }
4894
4895         cp.handle = ev->handle;
4896         cp.interval_min = ev->interval_min;
4897         cp.interval_max = ev->interval_max;
4898         cp.latency = ev->latency;
4899         cp.timeout = ev->timeout;
4900         cp.min_ce_len = 0;
4901         cp.max_ce_len = 0;
4902
4903         hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_REPLY, sizeof(cp), &cp);
4904 }
4905
4906 static void hci_le_direct_adv_report_evt(struct hci_dev *hdev,
4907                                          struct sk_buff *skb)
4908 {
4909         u8 num_reports = skb->data[0];
4910         void *ptr = &skb->data[1];
4911
4912         hci_dev_lock(hdev);
4913
4914         while (num_reports--) {
4915                 struct hci_ev_le_direct_adv_info *ev = ptr;
4916
4917                 process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
4918                                    ev->bdaddr_type, &ev->direct_addr,
4919                                    ev->direct_addr_type, ev->rssi, NULL, 0);
4920
4921                 ptr += sizeof(*ev);
4922         }
4923
4924         hci_dev_unlock(hdev);
4925 }
4926
4927 static void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
4928 {
4929         struct hci_ev_le_meta *le_ev = (void *) skb->data;
4930
4931         skb_pull(skb, sizeof(*le_ev));
4932
4933         switch (le_ev->subevent) {
4934         case HCI_EV_LE_CONN_COMPLETE:
4935                 hci_le_conn_complete_evt(hdev, skb);
4936                 break;
4937
4938         case HCI_EV_LE_CONN_UPDATE_COMPLETE:
4939                 hci_le_conn_update_complete_evt(hdev, skb);
4940                 break;
4941
4942         case HCI_EV_LE_ADVERTISING_REPORT:
4943                 hci_le_adv_report_evt(hdev, skb);
4944                 break;
4945
4946         case HCI_EV_LE_LTK_REQ:
4947                 hci_le_ltk_request_evt(hdev, skb);
4948                 break;
4949
4950         case HCI_EV_LE_REMOTE_CONN_PARAM_REQ:
4951                 hci_le_remote_conn_param_req_evt(hdev, skb);
4952                 break;
4953
4954         case HCI_EV_LE_DIRECT_ADV_REPORT:
4955                 hci_le_direct_adv_report_evt(hdev, skb);
4956                 break;
4957
4958         default:
4959                 break;
4960         }
4961 }
4962
4963 static void hci_chan_selected_evt(struct hci_dev *hdev, struct sk_buff *skb)
4964 {
4965         struct hci_ev_channel_selected *ev = (void *) skb->data;
4966         struct hci_conn *hcon;
4967
4968         BT_DBG("%s handle 0x%2.2x", hdev->name, ev->phy_handle);
4969
4970         skb_pull(skb, sizeof(*ev));
4971
4972         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4973         if (!hcon)
4974                 return;
4975
4976         amp_read_loc_assoc_final_data(hdev, hcon);
4977 }
4978
4979 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
4980 {
4981         struct hci_event_hdr *hdr = (void *) skb->data;
4982         __u8 event = hdr->evt;
4983
4984         hci_dev_lock(hdev);
4985
4986         /* Received events are (currently) only needed when a request is
4987          * ongoing so avoid unnecessary memory allocation.
4988          */
4989         if (hci_req_pending(hdev)) {
4990                 kfree_skb(hdev->recv_evt);
4991                 hdev->recv_evt = skb_clone(skb, GFP_KERNEL);
4992         }
4993
4994         hci_dev_unlock(hdev);
4995
4996         skb_pull(skb, HCI_EVENT_HDR_SIZE);
4997
4998         if (hdev->sent_cmd && bt_cb(hdev->sent_cmd)->req.event == event) {
4999                 struct hci_command_hdr *cmd_hdr = (void *) hdev->sent_cmd->data;
5000                 u16 opcode = __le16_to_cpu(cmd_hdr->opcode);
5001
5002                 hci_req_cmd_complete(hdev, opcode, 0);
5003         }
5004
5005         switch (event) {
5006         case HCI_EV_INQUIRY_COMPLETE:
5007                 hci_inquiry_complete_evt(hdev, skb);
5008                 break;
5009
5010         case HCI_EV_INQUIRY_RESULT:
5011                 hci_inquiry_result_evt(hdev, skb);
5012                 break;
5013
5014         case HCI_EV_CONN_COMPLETE:
5015                 hci_conn_complete_evt(hdev, skb);
5016                 break;
5017
5018         case HCI_EV_CONN_REQUEST:
5019                 hci_conn_request_evt(hdev, skb);
5020                 break;
5021
5022         case HCI_EV_DISCONN_COMPLETE:
5023                 hci_disconn_complete_evt(hdev, skb);
5024                 break;
5025
5026         case HCI_EV_AUTH_COMPLETE:
5027                 hci_auth_complete_evt(hdev, skb);
5028                 break;
5029
5030         case HCI_EV_REMOTE_NAME:
5031                 hci_remote_name_evt(hdev, skb);
5032                 break;
5033
5034         case HCI_EV_ENCRYPT_CHANGE:
5035                 hci_encrypt_change_evt(hdev, skb);
5036                 break;
5037
5038         case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
5039                 hci_change_link_key_complete_evt(hdev, skb);
5040                 break;
5041
5042         case HCI_EV_REMOTE_FEATURES:
5043                 hci_remote_features_evt(hdev, skb);
5044                 break;
5045
5046         case HCI_EV_CMD_COMPLETE:
5047                 hci_cmd_complete_evt(hdev, skb);
5048                 break;
5049
5050         case HCI_EV_CMD_STATUS:
5051                 hci_cmd_status_evt(hdev, skb);
5052                 break;
5053
5054         case HCI_EV_HARDWARE_ERROR:
5055                 hci_hardware_error_evt(hdev, skb);
5056                 break;
5057
5058         case HCI_EV_ROLE_CHANGE:
5059                 hci_role_change_evt(hdev, skb);
5060                 break;
5061
5062         case HCI_EV_NUM_COMP_PKTS:
5063                 hci_num_comp_pkts_evt(hdev, skb);
5064                 break;
5065
5066         case HCI_EV_MODE_CHANGE:
5067                 hci_mode_change_evt(hdev, skb);
5068                 break;
5069
5070         case HCI_EV_PIN_CODE_REQ:
5071                 hci_pin_code_request_evt(hdev, skb);
5072                 break;
5073
5074         case HCI_EV_LINK_KEY_REQ:
5075                 hci_link_key_request_evt(hdev, skb);
5076                 break;
5077
5078         case HCI_EV_LINK_KEY_NOTIFY:
5079                 hci_link_key_notify_evt(hdev, skb);
5080                 break;
5081
5082         case HCI_EV_CLOCK_OFFSET:
5083                 hci_clock_offset_evt(hdev, skb);
5084                 break;
5085
5086         case HCI_EV_PKT_TYPE_CHANGE:
5087                 hci_pkt_type_change_evt(hdev, skb);
5088                 break;
5089
5090         case HCI_EV_PSCAN_REP_MODE:
5091                 hci_pscan_rep_mode_evt(hdev, skb);
5092                 break;
5093
5094         case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
5095                 hci_inquiry_result_with_rssi_evt(hdev, skb);
5096                 break;
5097
5098         case HCI_EV_REMOTE_EXT_FEATURES:
5099                 hci_remote_ext_features_evt(hdev, skb);
5100                 break;
5101
5102         case HCI_EV_SYNC_CONN_COMPLETE:
5103                 hci_sync_conn_complete_evt(hdev, skb);
5104                 break;
5105
5106         case HCI_EV_EXTENDED_INQUIRY_RESULT:
5107                 hci_extended_inquiry_result_evt(hdev, skb);
5108                 break;
5109
5110         case HCI_EV_KEY_REFRESH_COMPLETE:
5111                 hci_key_refresh_complete_evt(hdev, skb);
5112                 break;
5113
5114         case HCI_EV_IO_CAPA_REQUEST:
5115                 hci_io_capa_request_evt(hdev, skb);
5116                 break;
5117
5118         case HCI_EV_IO_CAPA_REPLY:
5119                 hci_io_capa_reply_evt(hdev, skb);
5120                 break;
5121
5122         case HCI_EV_USER_CONFIRM_REQUEST:
5123                 hci_user_confirm_request_evt(hdev, skb);
5124                 break;
5125
5126         case HCI_EV_USER_PASSKEY_REQUEST:
5127                 hci_user_passkey_request_evt(hdev, skb);
5128                 break;
5129
5130         case HCI_EV_USER_PASSKEY_NOTIFY:
5131                 hci_user_passkey_notify_evt(hdev, skb);
5132                 break;
5133
5134         case HCI_EV_KEYPRESS_NOTIFY:
5135                 hci_keypress_notify_evt(hdev, skb);
5136                 break;
5137
5138         case HCI_EV_SIMPLE_PAIR_COMPLETE:
5139                 hci_simple_pair_complete_evt(hdev, skb);
5140                 break;
5141
5142         case HCI_EV_REMOTE_HOST_FEATURES:
5143                 hci_remote_host_features_evt(hdev, skb);
5144                 break;
5145
5146         case HCI_EV_LE_META:
5147                 hci_le_meta_evt(hdev, skb);
5148                 break;
5149
5150         case HCI_EV_CHANNEL_SELECTED:
5151                 hci_chan_selected_evt(hdev, skb);
5152                 break;
5153
5154         case HCI_EV_REMOTE_OOB_DATA_REQUEST:
5155                 hci_remote_oob_data_request_evt(hdev, skb);
5156                 break;
5157
5158         case HCI_EV_PHY_LINK_COMPLETE:
5159                 hci_phy_link_complete_evt(hdev, skb);
5160                 break;
5161
5162         case HCI_EV_LOGICAL_LINK_COMPLETE:
5163                 hci_loglink_complete_evt(hdev, skb);
5164                 break;
5165
5166         case HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE:
5167                 hci_disconn_loglink_complete_evt(hdev, skb);
5168                 break;
5169
5170         case HCI_EV_DISCONN_PHY_LINK_COMPLETE:
5171                 hci_disconn_phylink_complete_evt(hdev, skb);
5172                 break;
5173
5174         case HCI_EV_NUM_COMP_BLOCKS:
5175                 hci_num_comp_blocks_evt(hdev, skb);
5176                 break;
5177
5178         default:
5179                 BT_DBG("%s event 0x%2.2x", hdev->name, event);
5180                 break;
5181         }
5182
5183         kfree_skb(skb);
5184         hdev->stat.evt_rx++;
5185 }