Pileus Git - ~andy/linux/blob - net/bluetooth/hci_event.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI event handling. */
  26
  27 #include <linux/export.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/mgmt.h>
  33 #include <net/bluetooth/a2mp.h>
  34 #include <net/bluetooth/amp.h>
  35
  36 /* Handle HCI Event packets */
  37
  38 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
  39 {
  40         __u8 status = *((__u8 *) skb->data);
  41
  42         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  43
  44         if (status) {
  45                 hci_dev_lock(hdev);
  46                 mgmt_stop_discovery_failed(hdev, status);
  47                 hci_dev_unlock(hdev);
  48                 return;
  49         }
  50
  51         clear_bit(HCI_INQUIRY, &hdev->flags);
  52
  53         hci_dev_lock(hdev);
  54         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
  55         hci_dev_unlock(hdev);
  56
  57         hci_req_complete(hdev, HCI_OP_INQUIRY_CANCEL, status);
  58
  59         hci_conn_check_pending(hdev);
  60 }
  61
  62 static void hci_cc_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  63 {
  64         __u8 status = *((__u8 *) skb->data);
  65
  66         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  67
  68         if (status)
  69                 return;
  70
  71         set_bit(HCI_PERIODIC_INQ, &hdev->dev_flags);
  72 }
  73
  74 static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  75 {
  76         __u8 status = *((__u8 *) skb->data);
  77
  78         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  79
  80         if (status)
  81                 return;
  82
  83         clear_bit(HCI_PERIODIC_INQ, &hdev->dev_flags);
  84
  85         hci_conn_check_pending(hdev);
  86 }
  87
  88 static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev,
  89                                           struct sk_buff *skb)
  90 {
  91         BT_DBG("%s", hdev->name);
  92 }
  93
  94 static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
  95 {
  96         struct hci_rp_role_discovery *rp = (void *) skb->data;
  97         struct hci_conn *conn;
  98
  99         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 100
 101         if (rp->status)
 102                 return;
 103
 104         hci_dev_lock(hdev);
 105
 106         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 107         if (conn) {
 108                 if (rp->role)
 109                         conn->link_mode &= ~HCI_LM_MASTER;
 110                 else
 111                         conn->link_mode |= HCI_LM_MASTER;
 112         }
 113
 114         hci_dev_unlock(hdev);
 115 }
 116
 117 static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 118 {
 119         struct hci_rp_read_link_policy *rp = (void *) skb->data;
 120         struct hci_conn *conn;
 121
 122         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 123
 124         if (rp->status)
 125                 return;
 126
 127         hci_dev_lock(hdev);
 128
 129         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 130         if (conn)
 131                 conn->link_policy = __le16_to_cpu(rp->policy);
 132
 133         hci_dev_unlock(hdev);
 134 }
 135
 136 static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 137 {
 138         struct hci_rp_write_link_policy *rp = (void *) skb->data;
 139         struct hci_conn *conn;
 140         void *sent;
 141
 142         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 143
 144         if (rp->status)
 145                 return;
 146
 147         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
 148         if (!sent)
 149                 return;
 150
 151         hci_dev_lock(hdev);
 152
 153         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 154         if (conn)
 155                 conn->link_policy = get_unaligned_le16(sent + 2);
 156
 157         hci_dev_unlock(hdev);
 158 }
 159
 160 static void hci_cc_read_def_link_policy(struct hci_dev *hdev,
 161                                         struct sk_buff *skb)
 162 {
 163         struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
 164
 165         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 166
 167         if (rp->status)
 168                 return;
 169
 170         hdev->link_policy = __le16_to_cpu(rp->policy);
 171 }
 172
 173 static void hci_cc_write_def_link_policy(struct hci_dev *hdev,
 174                                          struct sk_buff *skb)
 175 {
 176         __u8 status = *((__u8 *) skb->data);
 177         void *sent;
 178
 179         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 180
 181         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
 182         if (!sent)
 183                 return;
 184
 185         if (!status)
 186                 hdev->link_policy = get_unaligned_le16(sent);
 187
 188         hci_req_complete(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, status);
 189 }
 190
 191 static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
 192 {
 193         __u8 status = *((__u8 *) skb->data);
 194
 195         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 196
 197         clear_bit(HCI_RESET, &hdev->flags);
 198
 199         hci_req_complete(hdev, HCI_OP_RESET, status);
 200
 201         /* Reset all non-persistent flags */
 202         hdev->dev_flags &= ~(BIT(HCI_LE_SCAN) | BIT(HCI_PENDING_CLASS) |
 203                              BIT(HCI_PERIODIC_INQ));
 204
 205         hdev->discovery.state = DISCOVERY_STOPPED;
 206 }
 207
 208 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 209 {
 210         __u8 status = *((__u8 *) skb->data);
 211         void *sent;
 212
 213         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 214
 215         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
 216         if (!sent)
 217                 return;
 218
 219         hci_dev_lock(hdev);
 220
 221         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 222                 mgmt_set_local_name_complete(hdev, sent, status);
 223         else if (!status)
 224                 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
 225
 226         hci_dev_unlock(hdev);
 227
 228         hci_req_complete(hdev, HCI_OP_WRITE_LOCAL_NAME, status);
 229 }
 230
 231 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 232 {
 233         struct hci_rp_read_local_name *rp = (void *) skb->data;
 234
 235         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 236
 237         if (rp->status)
 238                 return;
 239
 240         if (test_bit(HCI_SETUP, &hdev->dev_flags))
 241                 memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
 242 }
 243
 244 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
 245 {
 246         __u8 status = *((__u8 *) skb->data);
 247         void *sent;
 248
 249         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 250
 251         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
 252         if (!sent)
 253                 return;
 254
 255         if (!status) {
 256                 __u8 param = *((__u8 *) sent);
 257
 258                 if (param == AUTH_ENABLED)
 259                         set_bit(HCI_AUTH, &hdev->flags);
 260                 else
 261                         clear_bit(HCI_AUTH, &hdev->flags);
 262         }
 263
 264         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 265                 mgmt_auth_enable_complete(hdev, status);
 266
 267         hci_req_complete(hdev, HCI_OP_WRITE_AUTH_ENABLE, status);
 268 }
 269
 270 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
 271 {
 272         __u8 status = *((__u8 *) skb->data);
 273         void *sent;
 274
 275         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 276
 277         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
 278         if (!sent)
 279                 return;
 280
 281         if (!status) {
 282                 __u8 param = *((__u8 *) sent);
 283
 284                 if (param)
 285                         set_bit(HCI_ENCRYPT, &hdev->flags);
 286                 else
 287                         clear_bit(HCI_ENCRYPT, &hdev->flags);
 288         }
 289
 290         hci_req_complete(hdev, HCI_OP_WRITE_ENCRYPT_MODE, status);
 291 }
 292
 293 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
 294 {
 295         __u8 param, status = *((__u8 *) skb->data);
 296         int old_pscan, old_iscan;
 297         void *sent;
 298
 299         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 300
 301         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
 302         if (!sent)
 303                 return;
 304
 305         param = *((__u8 *) sent);
 306
 307         hci_dev_lock(hdev);
 308
 309         if (status) {
 310                 mgmt_write_scan_failed(hdev, param, status);
 311                 hdev->discov_timeout = 0;
 312                 goto done;
 313         }
 314
 315         old_pscan = test_and_clear_bit(HCI_PSCAN, &hdev->flags);
 316         old_iscan = test_and_clear_bit(HCI_ISCAN, &hdev->flags);
 317
 318         if (param & SCAN_INQUIRY) {
 319                 set_bit(HCI_ISCAN, &hdev->flags);
 320                 if (!old_iscan)
 321                         mgmt_discoverable(hdev, 1);
 322                 if (hdev->discov_timeout > 0) {
 323                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
 324                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
 325                                            to);
 326                 }
 327         } else if (old_iscan)
 328                 mgmt_discoverable(hdev, 0);
 329
 330         if (param & SCAN_PAGE) {
 331                 set_bit(HCI_PSCAN, &hdev->flags);
 332                 if (!old_pscan)
 333                         mgmt_connectable(hdev, 1);
 334         } else if (old_pscan)
 335                 mgmt_connectable(hdev, 0);
 336
 337 done:
 338         hci_dev_unlock(hdev);
 339         hci_req_complete(hdev, HCI_OP_WRITE_SCAN_ENABLE, status);
 340 }
 341
 342 static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 343 {
 344         struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
 345
 346         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 347
 348         if (rp->status)
 349                 return;
 350
 351         memcpy(hdev->dev_class, rp->dev_class, 3);
 352
 353         BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
 354                hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
 355 }
 356
 357 static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 358 {
 359         __u8 status = *((__u8 *) skb->data);
 360         void *sent;
 361
 362         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 363
 364         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
 365         if (!sent)
 366                 return;
 367
 368         hci_dev_lock(hdev);
 369
 370         if (status == 0)
 371                 memcpy(hdev->dev_class, sent, 3);
 372
 373         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 374                 mgmt_set_class_of_dev_complete(hdev, sent, status);
 375
 376         hci_dev_unlock(hdev);
 377 }
 378
 379 static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 380 {
 381         struct hci_rp_read_voice_setting *rp = (void *) skb->data;
 382         __u16 setting;
 383
 384         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 385
 386         if (rp->status)
 387                 return;
 388
 389         setting = __le16_to_cpu(rp->voice_setting);
 390
 391         if (hdev->voice_setting == setting)
 392                 return;
 393
 394         hdev->voice_setting = setting;
 395
 396         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 397
 398         if (hdev->notify)
 399                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 400 }
 401
 402 static void hci_cc_write_voice_setting(struct hci_dev *hdev,
 403                                        struct sk_buff *skb)
 404 {
 405         __u8 status = *((__u8 *) skb->data);
 406         __u16 setting;
 407         void *sent;
 408
 409         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 410
 411         if (status)
 412                 return;
 413
 414         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
 415         if (!sent)
 416                 return;
 417
 418         setting = get_unaligned_le16(sent);
 419
 420         if (hdev->voice_setting == setting)
 421                 return;
 422
 423         hdev->voice_setting = setting;
 424
 425         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 426
 427         if (hdev->notify)
 428                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 429 }
 430
 431 static void hci_cc_host_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 432 {
 433         __u8 status = *((__u8 *) skb->data);
 434
 435         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 436
 437         hci_req_complete(hdev, HCI_OP_HOST_BUFFER_SIZE, status);
 438 }
 439
 440 static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 441 {
 442         __u8 status = *((__u8 *) skb->data);
 443         void *sent;
 444
 445         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 446
 447         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
 448         if (!sent)
 449                 return;
 450
 451         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 452                 mgmt_ssp_enable_complete(hdev, *((u8 *) sent), status);
 453         else if (!status) {
 454                 if (*((u8 *) sent))
 455                         set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
 456                 else
 457                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
 458         }
 459 }
 460
 461 static u8 hci_get_inquiry_mode(struct hci_dev *hdev)
 462 {
 463         if (hdev->features[6] & LMP_EXT_INQ)
 464                 return 2;
 465
 466         if (hdev->features[3] & LMP_RSSI_INQ)
 467                 return 1;
 468
 469         if (hdev->manufacturer == 11 && hdev->hci_rev == 0x00 &&
 470             hdev->lmp_subver == 0x0757)
 471                 return 1;
 472
 473         if (hdev->manufacturer == 15) {
 474                 if (hdev->hci_rev == 0x03 && hdev->lmp_subver == 0x6963)
 475                         return 1;
 476                 if (hdev->hci_rev == 0x09 && hdev->lmp_subver == 0x6963)
 477                         return 1;
 478                 if (hdev->hci_rev == 0x00 && hdev->lmp_subver == 0x6965)
 479                         return 1;
 480         }
 481
 482         if (hdev->manufacturer == 31 && hdev->hci_rev == 0x2005 &&
 483             hdev->lmp_subver == 0x1805)
 484                 return 1;
 485
 486         return 0;
 487 }
 488
 489 static void hci_setup_inquiry_mode(struct hci_dev *hdev)
 490 {
 491         u8 mode;
 492
 493         mode = hci_get_inquiry_mode(hdev);
 494
 495         hci_send_cmd(hdev, HCI_OP_WRITE_INQUIRY_MODE, 1, &mode);
 496 }
 497
 498 static void hci_setup_event_mask(struct hci_dev *hdev)
 499 {
 500         /* The second byte is 0xff instead of 0x9f (two reserved bits
 501          * disabled) since a Broadcom 1.2 dongle doesn't respond to the
 502          * command otherwise */
 503         u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };
 504
 505         /* CSR 1.1 dongles does not accept any bitfield so don't try to set
 506          * any event mask for pre 1.2 devices */
 507         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
 508                 return;
 509
 510         events[4] |= 0x01; /* Flow Specification Complete */
 511         events[4] |= 0x02; /* Inquiry Result with RSSI */
 512         events[4] |= 0x04; /* Read Remote Extended Features Complete */
 513         events[5] |= 0x08; /* Synchronous Connection Complete */
 514         events[5] |= 0x10; /* Synchronous Connection Changed */
 515
 516         if (hdev->features[3] & LMP_RSSI_INQ)
 517                 events[4] |= 0x02; /* Inquiry Result with RSSI */
 518
 519         if (lmp_sniffsubr_capable(hdev))
 520                 events[5] |= 0x20; /* Sniff Subrating */
 521
 522         if (hdev->features[5] & LMP_PAUSE_ENC)
 523                 events[5] |= 0x80; /* Encryption Key Refresh Complete */
 524
 525         if (hdev->features[6] & LMP_EXT_INQ)
 526                 events[5] |= 0x40; /* Extended Inquiry Result */
 527
 528         if (lmp_no_flush_capable(hdev))
 529                 events[7] |= 0x01; /* Enhanced Flush Complete */
 530
 531         if (hdev->features[7] & LMP_LSTO)
 532                 events[6] |= 0x80; /* Link Supervision Timeout Changed */
 533
 534         if (lmp_ssp_capable(hdev)) {
 535                 events[6] |= 0x01;      /* IO Capability Request */
 536                 events[6] |= 0x02;      /* IO Capability Response */
 537                 events[6] |= 0x04;      /* User Confirmation Request */
 538                 events[6] |= 0x08;      /* User Passkey Request */
 539                 events[6] |= 0x10;      /* Remote OOB Data Request */
 540                 events[6] |= 0x20;      /* Simple Pairing Complete */
 541                 events[7] |= 0x04;      /* User Passkey Notification */
 542                 events[7] |= 0x08;      /* Keypress Notification */
 543                 events[7] |= 0x10;      /* Remote Host Supported
 544                                          * Features Notification */
 545         }
 546
 547         if (lmp_le_capable(hdev))
 548                 events[7] |= 0x20;      /* LE Meta-Event */
 549
 550         hci_send_cmd(hdev, HCI_OP_SET_EVENT_MASK, sizeof(events), events);
 551 }
 552
 553 static void hci_setup(struct hci_dev *hdev)
 554 {
 555         if (hdev->dev_type != HCI_BREDR)
 556                 return;
 557
 558         hci_setup_event_mask(hdev);
 559
 560         if (hdev->hci_ver > BLUETOOTH_VER_1_1)
 561                 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
 562
 563         if (lmp_ssp_capable(hdev)) {
 564                 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
 565                         u8 mode = 0x01;
 566                         hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE,
 567                                      sizeof(mode), &mode);
 568                 } else {
 569                         struct hci_cp_write_eir cp;
 570
 571                         memset(hdev->eir, 0, sizeof(hdev->eir));
 572                         memset(&cp, 0, sizeof(cp));
 573
 574                         hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 575                 }
 576         }
 577
 578         if (hdev->features[3] & LMP_RSSI_INQ)
 579                 hci_setup_inquiry_mode(hdev);
 580
 581         if (hdev->features[7] & LMP_INQ_TX_PWR)
 582                 hci_send_cmd(hdev, HCI_OP_READ_INQ_RSP_TX_POWER, 0, NULL);
 583
 584         if (hdev->features[7] & LMP_EXTFEATURES) {
 585                 struct hci_cp_read_local_ext_features cp;
 586
 587                 cp.page = 0x01;
 588                 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES, sizeof(cp),
 589                              &cp);
 590         }
 591
 592         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags)) {
 593                 u8 enable = 1;
 594                 hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(enable),
 595                              &enable);
 596         }
 597 }
 598
 599 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
 600 {
 601         struct hci_rp_read_local_version *rp = (void *) skb->data;
 602
 603         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 604
 605         if (rp->status)
 606                 goto done;
 607
 608         hdev->hci_ver = rp->hci_ver;
 609         hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
 610         hdev->lmp_ver = rp->lmp_ver;
 611         hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
 612         hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
 613
 614         BT_DBG("%s manufacturer 0x%4.4x hci ver %d:%d", hdev->name,
 615                hdev->manufacturer, hdev->hci_ver, hdev->hci_rev);
 616
 617         if (test_bit(HCI_INIT, &hdev->flags))
 618                 hci_setup(hdev);
 619
 620 done:
 621         hci_req_complete(hdev, HCI_OP_READ_LOCAL_VERSION, rp->status);
 622 }
 623
 624 static void hci_setup_link_policy(struct hci_dev *hdev)
 625 {
 626         struct hci_cp_write_def_link_policy cp;
 627         u16 link_policy = 0;
 628
 629         if (lmp_rswitch_capable(hdev))
 630                 link_policy |= HCI_LP_RSWITCH;
 631         if (hdev->features[0] & LMP_HOLD)
 632                 link_policy |= HCI_LP_HOLD;
 633         if (lmp_sniff_capable(hdev))
 634                 link_policy |= HCI_LP_SNIFF;
 635         if (hdev->features[1] & LMP_PARK)
 636                 link_policy |= HCI_LP_PARK;
 637
 638         cp.policy = cpu_to_le16(link_policy);
 639         hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, sizeof(cp), &cp);
 640 }
 641
 642 static void hci_cc_read_local_commands(struct hci_dev *hdev,
 643                                        struct sk_buff *skb)
 644 {
 645         struct hci_rp_read_local_commands *rp = (void *) skb->data;
 646
 647         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 648
 649         if (rp->status)
 650                 goto done;
 651
 652         memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 653
 654         if (test_bit(HCI_INIT, &hdev->flags) && (hdev->commands[5] & 0x10))
 655                 hci_setup_link_policy(hdev);
 656
 657 done:
 658         hci_req_complete(hdev, HCI_OP_READ_LOCAL_COMMANDS, rp->status);
 659 }
 660
 661 static void hci_cc_read_local_features(struct hci_dev *hdev,
 662                                        struct sk_buff *skb)
 663 {
 664         struct hci_rp_read_local_features *rp = (void *) skb->data;
 665
 666         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 667
 668         if (rp->status)
 669                 return;
 670
 671         memcpy(hdev->features, rp->features, 8);
 672
 673         /* Adjust default settings according to features
 674          * supported by device. */
 675
 676         if (hdev->features[0] & LMP_3SLOT)
 677                 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 678
 679         if (hdev->features[0] & LMP_5SLOT)
 680                 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 681
 682         if (hdev->features[1] & LMP_HV2) {
 683                 hdev->pkt_type  |= (HCI_HV2);
 684                 hdev->esco_type |= (ESCO_HV2);
 685         }
 686
 687         if (hdev->features[1] & LMP_HV3) {
 688                 hdev->pkt_type  |= (HCI_HV3);
 689                 hdev->esco_type |= (ESCO_HV3);
 690         }
 691
 692         if (lmp_esco_capable(hdev))
 693                 hdev->esco_type |= (ESCO_EV3);
 694
 695         if (hdev->features[4] & LMP_EV4)
 696                 hdev->esco_type |= (ESCO_EV4);
 697
 698         if (hdev->features[4] & LMP_EV5)
 699                 hdev->esco_type |= (ESCO_EV5);
 700
 701         if (hdev->features[5] & LMP_EDR_ESCO_2M)
 702                 hdev->esco_type |= (ESCO_2EV3);
 703
 704         if (hdev->features[5] & LMP_EDR_ESCO_3M)
 705                 hdev->esco_type |= (ESCO_3EV3);
 706
 707         if (hdev->features[5] & LMP_EDR_3S_ESCO)
 708                 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
 709
 710         BT_DBG("%s features 0x%.2x%.2x%.2x%.2x%.2x%.2x%.2x%.2x", hdev->name,
 711                hdev->features[0], hdev->features[1],
 712                hdev->features[2], hdev->features[3],
 713                hdev->features[4], hdev->features[5],
 714                hdev->features[6], hdev->features[7]);
 715 }
 716
 717 static void hci_set_le_support(struct hci_dev *hdev)
 718 {
 719         struct hci_cp_write_le_host_supported cp;
 720
 721         memset(&cp, 0, sizeof(cp));
 722
 723         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
 724                 cp.le = 1;
 725                 cp.simul = !!(hdev->features[6] & LMP_SIMUL_LE_BR);
 726         }
 727
 728         if (cp.le != !!(hdev->host_features[0] & LMP_HOST_LE))
 729                 hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(cp),
 730                              &cp);
 731 }
 732
 733 static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
 734                                            struct sk_buff *skb)
 735 {
 736         struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
 737
 738         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 739
 740         if (rp->status)
 741                 goto done;
 742
 743         switch (rp->page) {
 744         case 0:
 745                 memcpy(hdev->features, rp->features, 8);
 746                 break;
 747         case 1:
 748                 memcpy(hdev->host_features, rp->features, 8);
 749                 break;
 750         }
 751
 752         if (test_bit(HCI_INIT, &hdev->flags) && lmp_le_capable(hdev))
 753                 hci_set_le_support(hdev);
 754
 755 done:
 756         hci_req_complete(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES, rp->status);
 757 }
 758
 759 static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
 760                                           struct sk_buff *skb)
 761 {
 762         struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;
 763
 764         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 765
 766         if (rp->status)
 767                 return;
 768
 769         hdev->flow_ctl_mode = rp->mode;
 770
 771         hci_req_complete(hdev, HCI_OP_READ_FLOW_CONTROL_MODE, rp->status);
 772 }
 773
 774 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 775 {
 776         struct hci_rp_read_buffer_size *rp = (void *) skb->data;
 777
 778         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 779
 780         if (rp->status)
 781                 return;
 782
 783         hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
 784         hdev->sco_mtu  = rp->sco_mtu;
 785         hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
 786         hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
 787
 788         if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
 789                 hdev->sco_mtu  = 64;
 790                 hdev->sco_pkts = 8;
 791         }
 792
 793         hdev->acl_cnt = hdev->acl_pkts;
 794         hdev->sco_cnt = hdev->sco_pkts;
 795
 796         BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
 797                hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
 798 }
 799
 800 static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
 801 {
 802         struct hci_rp_read_bd_addr *rp = (void *) skb->data;
 803
 804         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 805
 806         if (!rp->status)
 807                 bacpy(&hdev->bdaddr, &rp->bdaddr);
 808
 809         hci_req_complete(hdev, HCI_OP_READ_BD_ADDR, rp->status);
 810 }
 811
 812 static void hci_cc_read_data_block_size(struct hci_dev *hdev,
 813                                         struct sk_buff *skb)
 814 {
 815         struct hci_rp_read_data_block_size *rp = (void *) skb->data;
 816
 817         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 818
 819         if (rp->status)
 820                 return;
 821
 822         hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
 823         hdev->block_len = __le16_to_cpu(rp->block_len);
 824         hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
 825
 826         hdev->block_cnt = hdev->num_blocks;
 827
 828         BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
 829                hdev->block_cnt, hdev->block_len);
 830
 831         hci_req_complete(hdev, HCI_OP_READ_DATA_BLOCK_SIZE, rp->status);
 832 }
 833
 834 static void hci_cc_write_ca_timeout(struct hci_dev *hdev, struct sk_buff *skb)
 835 {
 836         __u8 status = *((__u8 *) skb->data);
 837
 838         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 839
 840         hci_req_complete(hdev, HCI_OP_WRITE_CA_TIMEOUT, status);
 841 }
 842
 843 static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
 844                                        struct sk_buff *skb)
 845 {
 846         struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
 847
 848         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 849
 850         if (rp->status)
 851                 goto a2mp_rsp;
 852
 853         hdev->amp_status = rp->amp_status;
 854         hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
 855         hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
 856         hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
 857         hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
 858         hdev->amp_type = rp->amp_type;
 859         hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
 860         hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
 861         hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
 862         hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
 863
 864         hci_req_complete(hdev, HCI_OP_READ_LOCAL_AMP_INFO, rp->status);
 865
 866 a2mp_rsp:
 867         a2mp_send_getinfo_rsp(hdev);
 868 }
 869
 870 static void hci_cc_read_local_amp_assoc(struct hci_dev *hdev,
 871                                         struct sk_buff *skb)
 872 {
 873         struct hci_rp_read_local_amp_assoc *rp = (void *) skb->data;
 874         struct amp_assoc *assoc = &hdev->loc_assoc;
 875         size_t rem_len, frag_len;
 876
 877         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 878
 879         if (rp->status)
 880                 goto a2mp_rsp;
 881
 882         frag_len = skb->len - sizeof(*rp);
 883         rem_len = __le16_to_cpu(rp->rem_len);
 884
 885         if (rem_len > frag_len) {
 886                 BT_DBG("frag_len %ld rem_len %ld", frag_len, rem_len);
 887
 888                 memcpy(assoc->data + assoc->offset, rp->frag, frag_len);
 889                 assoc->offset += frag_len;
 890
 891                 /* Read other fragments */
 892                 amp_read_loc_assoc_frag(hdev, rp->phy_handle);
 893
 894                 return;
 895         }
 896
 897         memcpy(assoc->data + assoc->offset, rp->frag, rem_len);
 898         assoc->len = assoc->offset + rem_len;
 899         assoc->offset = 0;
 900
 901 a2mp_rsp:
 902         /* Send A2MP Rsp when all fragments are received */
 903         a2mp_send_getampassoc_rsp(hdev, rp->status);
 904         a2mp_send_create_phy_link_req(hdev, rp->status);
 905 }
 906
 907 static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
 908                                           struct sk_buff *skb)
 909 {
 910         __u8 status = *((__u8 *) skb->data);
 911
 912         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 913
 914         hci_req_complete(hdev, HCI_OP_DELETE_STORED_LINK_KEY, status);
 915 }
 916
 917 static void hci_cc_set_event_mask(struct hci_dev *hdev, struct sk_buff *skb)
 918 {
 919         __u8 status = *((__u8 *) skb->data);
 920
 921         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 922
 923         hci_req_complete(hdev, HCI_OP_SET_EVENT_MASK, status);
 924 }
 925
 926 static void hci_cc_write_inquiry_mode(struct hci_dev *hdev,
 927                                       struct sk_buff *skb)
 928 {
 929         __u8 status = *((__u8 *) skb->data);
 930
 931         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 932
 933         hci_req_complete(hdev, HCI_OP_WRITE_INQUIRY_MODE, status);
 934 }
 935
 936 static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
 937                                          struct sk_buff *skb)
 938 {
 939         struct hci_rp_read_inq_rsp_tx_power *rp = (void *) skb->data;
 940
 941         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 942
 943         if (!rp->status)
 944                 hdev->inq_tx_power = rp->tx_power;
 945
 946         hci_req_complete(hdev, HCI_OP_READ_INQ_RSP_TX_POWER, rp->status);
 947 }
 948
 949 static void hci_cc_set_event_flt(struct hci_dev *hdev, struct sk_buff *skb)
 950 {
 951         __u8 status = *((__u8 *) skb->data);
 952
 953         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 954
 955         hci_req_complete(hdev, HCI_OP_SET_EVENT_FLT, status);
 956 }
 957
 958 static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
 959 {
 960         struct hci_rp_pin_code_reply *rp = (void *) skb->data;
 961         struct hci_cp_pin_code_reply *cp;
 962         struct hci_conn *conn;
 963
 964         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 965
 966         hci_dev_lock(hdev);
 967
 968         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 969                 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
 970
 971         if (rp->status)
 972                 goto unlock;
 973
 974         cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
 975         if (!cp)
 976                 goto unlock;
 977
 978         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 979         if (conn)
 980                 conn->pin_length = cp->pin_len;
 981
 982 unlock:
 983         hci_dev_unlock(hdev);
 984 }
 985
 986 static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
 987 {
 988         struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
 989
 990         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 991
 992         hci_dev_lock(hdev);
 993
 994         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 995                 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
 996                                                  rp->status);
 997
 998         hci_dev_unlock(hdev);
 999 }
1000
1001 static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
1002                                        struct sk_buff *skb)
1003 {
1004         struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
1005
1006         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1007
1008         if (rp->status)
1009                 return;
1010
1011         hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
1012         hdev->le_pkts = rp->le_max_pkt;
1013
1014         hdev->le_cnt = hdev->le_pkts;
1015
1016         BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
1017
1018         hci_req_complete(hdev, HCI_OP_LE_READ_BUFFER_SIZE, rp->status);
1019 }
1020
1021 static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
1022 {
1023         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1024
1025         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1026
1027         hci_dev_lock(hdev);
1028
1029         if (test_bit(HCI_MGMT, &hdev->dev_flags))
1030                 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,
1031                                                  rp->status);
1032
1033         hci_dev_unlock(hdev);
1034 }
1035
1036 static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
1037                                           struct sk_buff *skb)
1038 {
1039         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1040
1041         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1042
1043         hci_dev_lock(hdev);
1044
1045         if (test_bit(HCI_MGMT, &hdev->dev_flags))
1046                 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
1047                                                      ACL_LINK, 0, rp->status);
1048
1049         hci_dev_unlock(hdev);
1050 }
1051
1052 static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
1053 {
1054         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1055
1056         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1057
1058         hci_dev_lock(hdev);
1059
1060         if (test_bit(HCI_MGMT, &hdev->dev_flags))
1061                 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
1062                                                  0, rp->status);
1063
1064         hci_dev_unlock(hdev);
1065 }
1066
1067 static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
1068                                           struct sk_buff *skb)
1069 {
1070         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1071
1072         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1073
1074         hci_dev_lock(hdev);
1075
1076         if (test_bit(HCI_MGMT, &hdev->dev_flags))
1077                 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
1078                                                      ACL_LINK, 0, rp->status);
1079
1080         hci_dev_unlock(hdev);
1081 }
1082
1083 static void hci_cc_read_local_oob_data_reply(struct hci_dev *hdev,
1084                                              struct sk_buff *skb)
1085 {
1086         struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
1087
1088         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1089
1090         hci_dev_lock(hdev);
1091         mgmt_read_local_oob_data_reply_complete(hdev, rp->hash,
1092                                                 rp->randomizer, rp->status);
1093         hci_dev_unlock(hdev);
1094 }
1095
1096 static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
1097 {
1098         __u8 status = *((__u8 *) skb->data);
1099
1100         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1101
1102         hci_req_complete(hdev, HCI_OP_LE_SET_SCAN_PARAM, status);
1103
1104         if (status) {
1105                 hci_dev_lock(hdev);
1106                 mgmt_start_discovery_failed(hdev, status);
1107                 hci_dev_unlock(hdev);
1108                 return;
1109         }
1110 }
1111
1112 static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
1113                                       struct sk_buff *skb)
1114 {
1115         struct hci_cp_le_set_scan_enable *cp;
1116         __u8 status = *((__u8 *) skb->data);
1117
1118         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1119
1120         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
1121         if (!cp)
1122                 return;
1123
1124         switch (cp->enable) {
1125         case LE_SCANNING_ENABLED:
1126                 hci_req_complete(hdev, HCI_OP_LE_SET_SCAN_ENABLE, status);
1127
1128                 if (status) {
1129                         hci_dev_lock(hdev);
1130                         mgmt_start_discovery_failed(hdev, status);
1131                         hci_dev_unlock(hdev);
1132                         return;
1133                 }
1134
1135                 set_bit(HCI_LE_SCAN, &hdev->dev_flags);
1136
1137                 hci_dev_lock(hdev);
1138                 hci_discovery_set_state(hdev, DISCOVERY_FINDING);
1139                 hci_dev_unlock(hdev);
1140                 break;
1141
1142         case LE_SCANNING_DISABLED:
1143                 if (status) {
1144                         hci_dev_lock(hdev);
1145                         mgmt_stop_discovery_failed(hdev, status);
1146                         hci_dev_unlock(hdev);
1147                         return;
1148                 }
1149
1150                 clear_bit(HCI_LE_SCAN, &hdev->dev_flags);
1151
1152                 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
1153                     hdev->discovery.state == DISCOVERY_FINDING) {
1154                         mgmt_interleaved_discovery(hdev);
1155                 } else {
1156                         hci_dev_lock(hdev);
1157                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1158                         hci_dev_unlock(hdev);
1159                 }
1160
1161                 break;
1162
1163         default:
1164                 BT_ERR("Used reserved LE_Scan_Enable param %d", cp->enable);
1165                 break;
1166         }
1167 }
1168
1169 static void hci_cc_le_ltk_reply(struct hci_dev *hdev, struct sk_buff *skb)
1170 {
1171         struct hci_rp_le_ltk_reply *rp = (void *) skb->data;
1172
1173         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1174
1175         if (rp->status)
1176                 return;
1177
1178         hci_req_complete(hdev, HCI_OP_LE_LTK_REPLY, rp->status);
1179 }
1180
1181 static void hci_cc_le_ltk_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
1182 {
1183         struct hci_rp_le_ltk_neg_reply *rp = (void *) skb->data;
1184
1185         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1186
1187         if (rp->status)
1188                 return;
1189
1190         hci_req_complete(hdev, HCI_OP_LE_LTK_NEG_REPLY, rp->status);
1191 }
1192
1193 static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
1194                                            struct sk_buff *skb)
1195 {
1196         struct hci_cp_write_le_host_supported *sent;
1197         __u8 status = *((__u8 *) skb->data);
1198
1199         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1200
1201         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
1202         if (!sent)
1203                 return;
1204
1205         if (!status) {
1206                 if (sent->le)
1207                         hdev->host_features[0] |= LMP_HOST_LE;
1208                 else
1209                         hdev->host_features[0] &= ~LMP_HOST_LE;
1210         }
1211
1212         if (test_bit(HCI_MGMT, &hdev->dev_flags) &&
1213             !test_bit(HCI_INIT, &hdev->flags))
1214                 mgmt_le_enable_complete(hdev, sent->le, status);
1215
1216         hci_req_complete(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, status);
1217 }
1218
1219 static void hci_cc_write_remote_amp_assoc(struct hci_dev *hdev,
1220                                           struct sk_buff *skb)
1221 {
1222         struct hci_rp_write_remote_amp_assoc *rp = (void *) skb->data;
1223
1224         BT_DBG("%s status 0x%2.2x phy_handle 0x%2.2x",
1225                hdev->name, rp->status, rp->phy_handle);
1226
1227         if (rp->status)
1228                 return;
1229
1230         amp_write_rem_assoc_continue(hdev, rp->phy_handle);
1231 }
1232
1233 static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
1234 {
1235         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1236
1237         if (status) {
1238                 hci_req_complete(hdev, HCI_OP_INQUIRY, status);
1239                 hci_conn_check_pending(hdev);
1240                 hci_dev_lock(hdev);
1241                 if (test_bit(HCI_MGMT, &hdev->dev_flags))
1242                         mgmt_start_discovery_failed(hdev, status);
1243                 hci_dev_unlock(hdev);
1244                 return;
1245         }
1246
1247         set_bit(HCI_INQUIRY, &hdev->flags);
1248
1249         hci_dev_lock(hdev);
1250         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
1251         hci_dev_unlock(hdev);
1252 }
1253
1254 static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
1255 {
1256         struct hci_cp_create_conn *cp;
1257         struct hci_conn *conn;
1258
1259         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1260
1261         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
1262         if (!cp)
1263                 return;
1264
1265         hci_dev_lock(hdev);
1266
1267         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1268
1269         BT_DBG("%s bdaddr %s hcon %p", hdev->name, batostr(&cp->bdaddr), conn);
1270
1271         if (status) {
1272                 if (conn && conn->state == BT_CONNECT) {
1273                         if (status != 0x0c || conn->attempt > 2) {
1274                                 conn->state = BT_CLOSED;
1275                                 hci_proto_connect_cfm(conn, status);
1276                                 hci_conn_del(conn);
1277                         } else
1278                                 conn->state = BT_CONNECT2;
1279                 }
1280         } else {
1281                 if (!conn) {
1282                         conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr);
1283                         if (conn) {
1284                                 conn->out = true;
1285                                 conn->link_mode |= HCI_LM_MASTER;
1286                         } else
1287                                 BT_ERR("No memory for new connection");
1288                 }
1289         }
1290
1291         hci_dev_unlock(hdev);
1292 }
1293
1294 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
1295 {
1296         struct hci_cp_add_sco *cp;
1297         struct hci_conn *acl, *sco;
1298         __u16 handle;
1299
1300         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1301
1302         if (!status)
1303                 return;
1304
1305         cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
1306         if (!cp)
1307                 return;
1308
1309         handle = __le16_to_cpu(cp->handle);
1310
1311         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1312
1313         hci_dev_lock(hdev);
1314
1315         acl = hci_conn_hash_lookup_handle(hdev, handle);
1316         if (acl) {
1317                 sco = acl->link;
1318                 if (sco) {
1319                         sco->state = BT_CLOSED;
1320
1321                         hci_proto_connect_cfm(sco, status);
1322                         hci_conn_del(sco);
1323                 }
1324         }
1325
1326         hci_dev_unlock(hdev);
1327 }
1328
1329 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
1330 {
1331         struct hci_cp_auth_requested *cp;
1332         struct hci_conn *conn;
1333
1334         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1335
1336         if (!status)
1337                 return;
1338
1339         cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
1340         if (!cp)
1341                 return;
1342
1343         hci_dev_lock(hdev);
1344
1345         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1346         if (conn) {
1347                 if (conn->state == BT_CONFIG) {
1348                         hci_proto_connect_cfm(conn, status);
1349                         hci_conn_put(conn);
1350                 }
1351         }
1352
1353         hci_dev_unlock(hdev);
1354 }
1355
1356 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
1357 {
1358         struct hci_cp_set_conn_encrypt *cp;
1359         struct hci_conn *conn;
1360
1361         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1362
1363         if (!status)
1364                 return;
1365
1366         cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
1367         if (!cp)
1368                 return;
1369
1370         hci_dev_lock(hdev);
1371
1372         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1373         if (conn) {
1374                 if (conn->state == BT_CONFIG) {
1375                         hci_proto_connect_cfm(conn, status);
1376                         hci_conn_put(conn);
1377                 }
1378         }
1379
1380         hci_dev_unlock(hdev);
1381 }
1382
1383 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
1384                                     struct hci_conn *conn)
1385 {
1386         if (conn->state != BT_CONFIG || !conn->out)
1387                 return 0;
1388
1389         if (conn->pending_sec_level == BT_SECURITY_SDP)
1390                 return 0;
1391
1392         /* Only request authentication for SSP connections or non-SSP
1393          * devices with sec_level HIGH or if MITM protection is requested */
1394         if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
1395             conn->pending_sec_level != BT_SECURITY_HIGH)
1396                 return 0;
1397
1398         return 1;
1399 }
1400
1401 static int hci_resolve_name(struct hci_dev *hdev,
1402                                    struct inquiry_entry *e)
1403 {
1404         struct hci_cp_remote_name_req cp;
1405
1406         memset(&cp, 0, sizeof(cp));
1407
1408         bacpy(&cp.bdaddr, &e->data.bdaddr);
1409         cp.pscan_rep_mode = e->data.pscan_rep_mode;
1410         cp.pscan_mode = e->data.pscan_mode;
1411         cp.clock_offset = e->data.clock_offset;
1412
1413         return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1414 }
1415
1416 static bool hci_resolve_next_name(struct hci_dev *hdev)
1417 {
1418         struct discovery_state *discov = &hdev->discovery;
1419         struct inquiry_entry *e;
1420
1421         if (list_empty(&discov->resolve))
1422                 return false;
1423
1424         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
1425         if (!e)
1426                 return false;
1427
1428         if (hci_resolve_name(hdev, e) == 0) {
1429                 e->name_state = NAME_PENDING;
1430                 return true;
1431         }
1432
1433         return false;
1434 }
1435
1436 static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
1437                                    bdaddr_t *bdaddr, u8 *name, u8 name_len)
1438 {
1439         struct discovery_state *discov = &hdev->discovery;
1440         struct inquiry_entry *e;
1441
1442         if (conn && !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
1443                 mgmt_device_connected(hdev, bdaddr, ACL_LINK, 0x00, 0, name,
1444                                       name_len, conn->dev_class);
1445
1446         if (discov->state == DISCOVERY_STOPPED)
1447                 return;
1448
1449         if (discov->state == DISCOVERY_STOPPING)
1450                 goto discov_complete;
1451
1452         if (discov->state != DISCOVERY_RESOLVING)
1453                 return;
1454
1455         e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
1456         /* If the device was not found in a list of found devices names of which
1457          * are pending. there is no need to continue resolving a next name as it
1458          * will be done upon receiving another Remote Name Request Complete
1459          * Event */
1460         if (!e)
1461                 return;
1462
1463         list_del(&e->list);
1464         if (name) {
1465                 e->name_state = NAME_KNOWN;
1466                 mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
1467                                  e->data.rssi, name, name_len);
1468         } else {
1469                 e->name_state = NAME_NOT_KNOWN;
1470         }
1471
1472         if (hci_resolve_next_name(hdev))
1473                 return;
1474
1475 discov_complete:
1476         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1477 }
1478
1479 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
1480 {
1481         struct hci_cp_remote_name_req *cp;
1482         struct hci_conn *conn;
1483
1484         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1485
1486         /* If successful wait for the name req complete event before
1487          * checking for the need to do authentication */
1488         if (!status)
1489                 return;
1490
1491         cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
1492         if (!cp)
1493                 return;
1494
1495         hci_dev_lock(hdev);
1496
1497         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1498
1499         if (test_bit(HCI_MGMT, &hdev->dev_flags))
1500                 hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
1501
1502         if (!conn)
1503                 goto unlock;
1504
1505         if (!hci_outgoing_auth_needed(hdev, conn))
1506                 goto unlock;
1507
1508         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
1509                 struct hci_cp_auth_requested cp;
1510                 cp.handle = __cpu_to_le16(conn->handle);
1511                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
1512         }
1513
1514 unlock:
1515         hci_dev_unlock(hdev);
1516 }
1517
1518 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
1519 {
1520         struct hci_cp_read_remote_features *cp;
1521         struct hci_conn *conn;
1522
1523         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1524
1525         if (!status)
1526                 return;
1527
1528         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
1529         if (!cp)
1530                 return;
1531
1532         hci_dev_lock(hdev);
1533
1534         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1535         if (conn) {
1536                 if (conn->state == BT_CONFIG) {
1537                         hci_proto_connect_cfm(conn, status);
1538                         hci_conn_put(conn);
1539                 }
1540         }
1541
1542         hci_dev_unlock(hdev);
1543 }
1544
1545 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
1546 {
1547         struct hci_cp_read_remote_ext_features *cp;
1548         struct hci_conn *conn;
1549
1550         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1551
1552         if (!status)
1553                 return;
1554
1555         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
1556         if (!cp)
1557                 return;
1558
1559         hci_dev_lock(hdev);
1560
1561         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1562         if (conn) {
1563                 if (conn->state == BT_CONFIG) {
1564                         hci_proto_connect_cfm(conn, status);
1565                         hci_conn_put(conn);
1566                 }
1567         }
1568
1569         hci_dev_unlock(hdev);
1570 }
1571
1572 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
1573 {
1574         struct hci_cp_setup_sync_conn *cp;
1575         struct hci_conn *acl, *sco;
1576         __u16 handle;
1577
1578         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1579
1580         if (!status)
1581                 return;
1582
1583         cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
1584         if (!cp)
1585                 return;
1586
1587         handle = __le16_to_cpu(cp->handle);
1588
1589         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1590
1591         hci_dev_lock(hdev);
1592
1593         acl = hci_conn_hash_lookup_handle(hdev, handle);
1594         if (acl) {
1595                 sco = acl->link;
1596                 if (sco) {
1597                         sco->state = BT_CLOSED;
1598
1599                         hci_proto_connect_cfm(sco, status);
1600                         hci_conn_del(sco);
1601                 }
1602         }
1603
1604         hci_dev_unlock(hdev);
1605 }
1606
1607 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
1608 {
1609         struct hci_cp_sniff_mode *cp;
1610         struct hci_conn *conn;
1611
1612         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1613
1614         if (!status)
1615                 return;
1616
1617         cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
1618         if (!cp)
1619                 return;
1620
1621         hci_dev_lock(hdev);
1622
1623         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1624         if (conn) {
1625                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1626
1627                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
1628                         hci_sco_setup(conn, status);
1629         }
1630
1631         hci_dev_unlock(hdev);
1632 }
1633
1634 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
1635 {
1636         struct hci_cp_exit_sniff_mode *cp;
1637         struct hci_conn *conn;
1638
1639         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1640
1641         if (!status)
1642                 return;
1643
1644         cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
1645         if (!cp)
1646                 return;
1647
1648         hci_dev_lock(hdev);
1649
1650         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1651         if (conn) {
1652                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1653
1654                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
1655                         hci_sco_setup(conn, status);
1656         }
1657
1658         hci_dev_unlock(hdev);
1659 }
1660
1661 static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
1662 {
1663         struct hci_cp_disconnect *cp;
1664         struct hci_conn *conn;
1665
1666         if (!status)
1667                 return;
1668
1669         cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
1670         if (!cp)
1671                 return;
1672
1673         hci_dev_lock(hdev);
1674
1675         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1676         if (conn)
1677                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
1678                                        conn->dst_type, status);
1679
1680         hci_dev_unlock(hdev);
1681 }
1682
1683 static void hci_cs_le_create_conn(struct hci_dev *hdev, __u8 status)
1684 {
1685         struct hci_conn *conn;
1686
1687         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1688
1689         if (status) {
1690                 hci_dev_lock(hdev);
1691
1692                 conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
1693                 if (!conn) {
1694                         hci_dev_unlock(hdev);
1695                         return;
1696                 }
1697
1698                 BT_DBG("%s bdaddr %s conn %p", hdev->name, batostr(&conn->dst),
1699                        conn);
1700
1701                 conn->state = BT_CLOSED;
1702                 mgmt_connect_failed(hdev, &conn->dst, conn->type,
1703                                     conn->dst_type, status);
1704                 hci_proto_connect_cfm(conn, status);
1705                 hci_conn_del(conn);
1706
1707                 hci_dev_unlock(hdev);
1708         }
1709 }
1710
1711 static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
1712 {
1713         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1714 }
1715
1716 static void hci_cs_create_phylink(struct hci_dev *hdev, u8 status)
1717 {
1718         struct hci_cp_create_phy_link *cp;
1719
1720         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1721
1722         if (status)
1723                 return;
1724
1725         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_PHY_LINK);
1726         if (!cp)
1727                 return;
1728
1729         amp_write_remote_assoc(hdev, cp->phy_handle);
1730 }
1731
1732 static void hci_cs_accept_phylink(struct hci_dev *hdev, u8 status)
1733 {
1734         struct hci_cp_accept_phy_link *cp;
1735
1736         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1737
1738         if (status)
1739                 return;
1740
1741         cp = hci_sent_cmd_data(hdev, HCI_OP_ACCEPT_PHY_LINK);
1742         if (!cp)
1743                 return;
1744
1745         amp_write_remote_assoc(hdev, cp->phy_handle);
1746 }
1747
1748 static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1749 {
1750         __u8 status = *((__u8 *) skb->data);
1751         struct discovery_state *discov = &hdev->discovery;
1752         struct inquiry_entry *e;
1753
1754         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1755
1756         hci_req_complete(hdev, HCI_OP_INQUIRY, status);
1757
1758         hci_conn_check_pending(hdev);
1759
1760         if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
1761                 return;
1762
1763         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
1764                 return;
1765
1766         hci_dev_lock(hdev);
1767
1768         if (discov->state != DISCOVERY_FINDING)
1769                 goto unlock;
1770
1771         if (list_empty(&discov->resolve)) {
1772                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1773                 goto unlock;
1774         }
1775
1776         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
1777         if (e && hci_resolve_name(hdev, e) == 0) {
1778                 e->name_state = NAME_PENDING;
1779                 hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
1780         } else {
1781                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1782         }
1783
1784 unlock:
1785         hci_dev_unlock(hdev);
1786 }
1787
1788 static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
1789 {
1790         struct inquiry_data data;
1791         struct inquiry_info *info = (void *) (skb->data + 1);
1792         int num_rsp = *((__u8 *) skb->data);
1793
1794         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
1795
1796         if (!num_rsp)
1797                 return;
1798
1799         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
1800                 return;
1801
1802         hci_dev_lock(hdev);
1803
1804         for (; num_rsp; num_rsp--, info++) {
1805                 bool name_known, ssp;
1806
1807                 bacpy(&data.bdaddr, &info->bdaddr);
1808                 data.pscan_rep_mode     = info->pscan_rep_mode;
1809                 data.pscan_period_mode  = info->pscan_period_mode;
1810                 data.pscan_mode         = info->pscan_mode;
1811                 memcpy(data.dev_class, info->dev_class, 3);
1812                 data.clock_offset       = info->clock_offset;
1813                 data.rssi               = 0x00;
1814                 data.ssp_mode           = 0x00;
1815
1816                 name_known = hci_inquiry_cache_update(hdev, &data, false, &ssp);
1817                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
1818                                   info->dev_class, 0, !name_known, ssp, NULL,
1819                                   0);
1820         }
1821
1822         hci_dev_unlock(hdev);
1823 }
1824
1825 static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1826 {
1827         struct hci_ev_conn_complete *ev = (void *) skb->data;
1828         struct hci_conn *conn;
1829
1830         BT_DBG("%s", hdev->name);
1831
1832         hci_dev_lock(hdev);
1833
1834         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
1835         if (!conn) {
1836                 if (ev->link_type != SCO_LINK)
1837                         goto unlock;
1838
1839                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
1840                 if (!conn)
1841                         goto unlock;
1842
1843                 conn->type = SCO_LINK;
1844         }
1845
1846         if (!ev->status) {
1847                 conn->handle = __le16_to_cpu(ev->handle);
1848
1849                 if (conn->type == ACL_LINK) {
1850                         conn->state = BT_CONFIG;
1851                         hci_conn_hold(conn);
1852
1853                         if (!conn->out && !hci_conn_ssp_enabled(conn) &&
1854                             !hci_find_link_key(hdev, &ev->bdaddr))
1855                                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
1856                         else
1857                                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
1858                 } else
1859                         conn->state = BT_CONNECTED;
1860
1861                 hci_conn_hold_device(conn);
1862                 hci_conn_add_sysfs(conn);
1863
1864                 if (test_bit(HCI_AUTH, &hdev->flags))
1865                         conn->link_mode |= HCI_LM_AUTH;
1866
1867                 if (test_bit(HCI_ENCRYPT, &hdev->flags))
1868                         conn->link_mode |= HCI_LM_ENCRYPT;
1869
1870                 /* Get remote features */
1871                 if (conn->type == ACL_LINK) {
1872                         struct hci_cp_read_remote_features cp;
1873                         cp.handle = ev->handle;
1874                         hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
1875                                      sizeof(cp), &cp);
1876                 }
1877
1878                 /* Set packet type for incoming connection */
1879                 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
1880                         struct hci_cp_change_conn_ptype cp;
1881                         cp.handle = ev->handle;
1882                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
1883                         hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
1884                                      &cp);
1885                 }
1886         } else {
1887                 conn->state = BT_CLOSED;
1888                 if (conn->type == ACL_LINK)
1889                         mgmt_connect_failed(hdev, &ev->bdaddr, conn->type,
1890                                             conn->dst_type, ev->status);
1891         }
1892
1893         if (conn->type == ACL_LINK)
1894                 hci_sco_setup(conn, ev->status);
1895
1896         if (ev->status) {
1897                 hci_proto_connect_cfm(conn, ev->status);
1898                 hci_conn_del(conn);
1899         } else if (ev->link_type != ACL_LINK)
1900                 hci_proto_connect_cfm(conn, ev->status);
1901
1902 unlock:
1903         hci_dev_unlock(hdev);
1904
1905         hci_conn_check_pending(hdev);
1906 }
1907
1908 static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
1909 {
1910         struct hci_ev_conn_request *ev = (void *) skb->data;
1911         int mask = hdev->link_mode;
1912
1913         BT_DBG("%s bdaddr %s type 0x%x", hdev->name, batostr(&ev->bdaddr),
1914                ev->link_type);
1915
1916         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type);
1917
1918         if ((mask & HCI_LM_ACCEPT) &&
1919             !hci_blacklist_lookup(hdev, &ev->bdaddr)) {
1920                 /* Connection accepted */
1921                 struct inquiry_entry *ie;
1922                 struct hci_conn *conn;
1923
1924                 hci_dev_lock(hdev);
1925
1926                 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
1927                 if (ie)
1928                         memcpy(ie->data.dev_class, ev->dev_class, 3);
1929
1930                 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
1931                                                &ev->bdaddr);
1932                 if (!conn) {
1933                         conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr);
1934                         if (!conn) {
1935                                 BT_ERR("No memory for new connection");
1936                                 hci_dev_unlock(hdev);
1937                                 return;
1938                         }
1939                 }
1940
1941                 memcpy(conn->dev_class, ev->dev_class, 3);
1942                 conn->state = BT_CONNECT;
1943
1944                 hci_dev_unlock(hdev);
1945
1946                 if (ev->link_type == ACL_LINK || !lmp_esco_capable(hdev)) {
1947                         struct hci_cp_accept_conn_req cp;
1948
1949                         bacpy(&cp.bdaddr, &ev->bdaddr);
1950
1951                         if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
1952                                 cp.role = 0x00; /* Become master */
1953                         else
1954                                 cp.role = 0x01; /* Remain slave */
1955
1956                         hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp),
1957                                      &cp);
1958                 } else {
1959                         struct hci_cp_accept_sync_conn_req cp;
1960
1961                         bacpy(&cp.bdaddr, &ev->bdaddr);
1962                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
1963
1964                         cp.tx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
1965                         cp.rx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
1966                         cp.max_latency    = __constant_cpu_to_le16(0xffff);
1967                         cp.content_format = cpu_to_le16(hdev->voice_setting);
1968                         cp.retrans_effort = 0xff;
1969
1970                         hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ,
1971                                      sizeof(cp), &cp);
1972                 }
1973         } else {
1974                 /* Connection rejected */
1975                 struct hci_cp_reject_conn_req cp;
1976
1977                 bacpy(&cp.bdaddr, &ev->bdaddr);
1978                 cp.reason = HCI_ERROR_REJ_BAD_ADDR;
1979                 hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
1980         }
1981 }
1982
1983 static u8 hci_to_mgmt_reason(u8 err)
1984 {
1985         switch (err) {
1986         case HCI_ERROR_CONNECTION_TIMEOUT:
1987                 return MGMT_DEV_DISCONN_TIMEOUT;
1988         case HCI_ERROR_REMOTE_USER_TERM:
1989         case HCI_ERROR_REMOTE_LOW_RESOURCES:
1990         case HCI_ERROR_REMOTE_POWER_OFF:
1991                 return MGMT_DEV_DISCONN_REMOTE;
1992         case HCI_ERROR_LOCAL_HOST_TERM:
1993                 return MGMT_DEV_DISCONN_LOCAL_HOST;
1994         default:
1995                 return MGMT_DEV_DISCONN_UNKNOWN;
1996         }
1997 }
1998
1999 static void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2000 {
2001         struct hci_ev_disconn_complete *ev = (void *) skb->data;
2002         struct hci_conn *conn;
2003
2004         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2005
2006         hci_dev_lock(hdev);
2007
2008         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2009         if (!conn)
2010                 goto unlock;
2011
2012         if (ev->status == 0)
2013                 conn->state = BT_CLOSED;
2014
2015         if (test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags) &&
2016             (conn->type == ACL_LINK || conn->type == LE_LINK)) {
2017                 if (ev->status) {
2018                         mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2019                                                conn->dst_type, ev->status);
2020                 } else {
2021                         u8 reason = hci_to_mgmt_reason(ev->reason);
2022
2023                         mgmt_device_disconnected(hdev, &conn->dst, conn->type,
2024                                                  conn->dst_type, reason);
2025                 }
2026         }
2027
2028         if (ev->status == 0) {
2029                 if (conn->type == ACL_LINK && conn->flush_key)
2030                         hci_remove_link_key(hdev, &conn->dst);
2031                 hci_proto_disconn_cfm(conn, ev->reason);
2032                 hci_conn_del(conn);
2033         }
2034
2035 unlock:
2036         hci_dev_unlock(hdev);
2037 }
2038
2039 static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2040 {
2041         struct hci_ev_auth_complete *ev = (void *) skb->data;
2042         struct hci_conn *conn;
2043
2044         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2045
2046         hci_dev_lock(hdev);
2047
2048         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2049         if (!conn)
2050                 goto unlock;
2051
2052         if (!ev->status) {
2053                 if (!hci_conn_ssp_enabled(conn) &&
2054                     test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
2055                         BT_INFO("re-auth of legacy device is not possible.");
2056                 } else {
2057                         conn->link_mode |= HCI_LM_AUTH;
2058                         conn->sec_level = conn->pending_sec_level;
2059                 }
2060         } else {
2061                 mgmt_auth_failed(hdev, &conn->dst, conn->type, conn->dst_type,
2062                                  ev->status);
2063         }
2064
2065         clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
2066         clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
2067
2068         if (conn->state == BT_CONFIG) {
2069                 if (!ev->status && hci_conn_ssp_enabled(conn)) {
2070                         struct hci_cp_set_conn_encrypt cp;
2071                         cp.handle  = ev->handle;
2072                         cp.encrypt = 0x01;
2073                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2074                                      &cp);
2075                 } else {
2076                         conn->state = BT_CONNECTED;
2077                         hci_proto_connect_cfm(conn, ev->status);
2078                         hci_conn_put(conn);
2079                 }
2080         } else {
2081                 hci_auth_cfm(conn, ev->status);
2082
2083                 hci_conn_hold(conn);
2084                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2085                 hci_conn_put(conn);
2086         }
2087
2088         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
2089                 if (!ev->status) {
2090                         struct hci_cp_set_conn_encrypt cp;
2091                         cp.handle  = ev->handle;
2092                         cp.encrypt = 0x01;
2093                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2094                                      &cp);
2095                 } else {
2096                         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2097                         hci_encrypt_cfm(conn, ev->status, 0x00);
2098                 }
2099         }
2100
2101 unlock:
2102         hci_dev_unlock(hdev);
2103 }
2104
2105 static void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
2106 {
2107         struct hci_ev_remote_name *ev = (void *) skb->data;
2108         struct hci_conn *conn;
2109
2110         BT_DBG("%s", hdev->name);
2111
2112         hci_conn_check_pending(hdev);
2113
2114         hci_dev_lock(hdev);
2115
2116         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2117
2118         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
2119                 goto check_auth;
2120
2121         if (ev->status == 0)
2122                 hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
2123                                        strnlen(ev->name, HCI_MAX_NAME_LENGTH));
2124         else
2125                 hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
2126
2127 check_auth:
2128         if (!conn)
2129                 goto unlock;
2130
2131         if (!hci_outgoing_auth_needed(hdev, conn))
2132                 goto unlock;
2133
2134         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
2135                 struct hci_cp_auth_requested cp;
2136                 cp.handle = __cpu_to_le16(conn->handle);
2137                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
2138         }
2139
2140 unlock:
2141         hci_dev_unlock(hdev);
2142 }
2143
2144 static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2145 {
2146         struct hci_ev_encrypt_change *ev = (void *) skb->data;
2147         struct hci_conn *conn;
2148
2149         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2150
2151         hci_dev_lock(hdev);
2152
2153         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2154         if (conn) {
2155                 if (!ev->status) {
2156                         if (ev->encrypt) {
2157                                 /* Encryption implies authentication */
2158                                 conn->link_mode |= HCI_LM_AUTH;
2159                                 conn->link_mode |= HCI_LM_ENCRYPT;
2160                                 conn->sec_level = conn->pending_sec_level;
2161                         } else
2162                                 conn->link_mode &= ~HCI_LM_ENCRYPT;
2163                 }
2164
2165                 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2166
2167                 if (ev->status && conn->state == BT_CONNECTED) {
2168                         hci_acl_disconn(conn, HCI_ERROR_AUTH_FAILURE);
2169                         hci_conn_put(conn);
2170                         goto unlock;
2171                 }
2172
2173                 if (conn->state == BT_CONFIG) {
2174                         if (!ev->status)
2175                                 conn->state = BT_CONNECTED;
2176
2177                         hci_proto_connect_cfm(conn, ev->status);
2178                         hci_conn_put(conn);
2179                 } else
2180                         hci_encrypt_cfm(conn, ev->status, ev->encrypt);
2181         }
2182
2183 unlock:
2184         hci_dev_unlock(hdev);
2185 }
2186
2187 static void hci_change_link_key_complete_evt(struct hci_dev *hdev,
2188                                              struct sk_buff *skb)
2189 {
2190         struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
2191         struct hci_conn *conn;
2192
2193         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2194
2195         hci_dev_lock(hdev);
2196
2197         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2198         if (conn) {
2199                 if (!ev->status)
2200                         conn->link_mode |= HCI_LM_SECURE;
2201
2202                 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
2203
2204                 hci_key_change_cfm(conn, ev->status);
2205         }
2206
2207         hci_dev_unlock(hdev);
2208 }
2209
2210 static void hci_remote_features_evt(struct hci_dev *hdev,
2211                                     struct sk_buff *skb)
2212 {
2213         struct hci_ev_remote_features *ev = (void *) skb->data;
2214         struct hci_conn *conn;
2215
2216         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2217
2218         hci_dev_lock(hdev);
2219
2220         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2221         if (!conn)
2222                 goto unlock;
2223
2224         if (!ev->status)
2225                 memcpy(conn->features, ev->features, 8);
2226
2227         if (conn->state != BT_CONFIG)
2228                 goto unlock;
2229
2230         if (!ev->status && lmp_ssp_capable(hdev) && lmp_ssp_capable(conn)) {
2231                 struct hci_cp_read_remote_ext_features cp;
2232                 cp.handle = ev->handle;
2233                 cp.page = 0x01;
2234                 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
2235                              sizeof(cp), &cp);
2236                 goto unlock;
2237         }
2238
2239         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
2240                 struct hci_cp_remote_name_req cp;
2241                 memset(&cp, 0, sizeof(cp));
2242                 bacpy(&cp.bdaddr, &conn->dst);
2243                 cp.pscan_rep_mode = 0x02;
2244                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2245         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2246                 mgmt_device_connected(hdev, &conn->dst, conn->type,
2247                                       conn->dst_type, 0, NULL, 0,
2248                                       conn->dev_class);
2249
2250         if (!hci_outgoing_auth_needed(hdev, conn)) {
2251                 conn->state = BT_CONNECTED;
2252                 hci_proto_connect_cfm(conn, ev->status);
2253                 hci_conn_put(conn);
2254         }
2255
2256 unlock:
2257         hci_dev_unlock(hdev);
2258 }
2259
2260 static void hci_remote_version_evt(struct hci_dev *hdev, struct sk_buff *skb)
2261 {
2262         BT_DBG("%s", hdev->name);
2263 }
2264
2265 static void hci_qos_setup_complete_evt(struct hci_dev *hdev,
2266                                        struct sk_buff *skb)
2267 {
2268         BT_DBG("%s", hdev->name);
2269 }
2270
2271 static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2272 {
2273         struct hci_ev_cmd_complete *ev = (void *) skb->data;
2274         __u16 opcode;
2275
2276         skb_pull(skb, sizeof(*ev));
2277
2278         opcode = __le16_to_cpu(ev->opcode);
2279
2280         switch (opcode) {
2281         case HCI_OP_INQUIRY_CANCEL:
2282                 hci_cc_inquiry_cancel(hdev, skb);
2283                 break;
2284
2285         case HCI_OP_PERIODIC_INQ:
2286                 hci_cc_periodic_inq(hdev, skb);
2287                 break;
2288
2289         case HCI_OP_EXIT_PERIODIC_INQ:
2290                 hci_cc_exit_periodic_inq(hdev, skb);
2291                 break;
2292
2293         case HCI_OP_REMOTE_NAME_REQ_CANCEL:
2294                 hci_cc_remote_name_req_cancel(hdev, skb);
2295                 break;
2296
2297         case HCI_OP_ROLE_DISCOVERY:
2298                 hci_cc_role_discovery(hdev, skb);
2299                 break;
2300
2301         case HCI_OP_READ_LINK_POLICY:
2302                 hci_cc_read_link_policy(hdev, skb);
2303                 break;
2304
2305         case HCI_OP_WRITE_LINK_POLICY:
2306                 hci_cc_write_link_policy(hdev, skb);
2307                 break;
2308
2309         case HCI_OP_READ_DEF_LINK_POLICY:
2310                 hci_cc_read_def_link_policy(hdev, skb);
2311                 break;
2312
2313         case HCI_OP_WRITE_DEF_LINK_POLICY:
2314                 hci_cc_write_def_link_policy(hdev, skb);
2315                 break;
2316
2317         case HCI_OP_RESET:
2318                 hci_cc_reset(hdev, skb);
2319                 break;
2320
2321         case HCI_OP_WRITE_LOCAL_NAME:
2322                 hci_cc_write_local_name(hdev, skb);
2323                 break;
2324
2325         case HCI_OP_READ_LOCAL_NAME:
2326                 hci_cc_read_local_name(hdev, skb);
2327                 break;
2328
2329         case HCI_OP_WRITE_AUTH_ENABLE:
2330                 hci_cc_write_auth_enable(hdev, skb);
2331                 break;
2332
2333         case HCI_OP_WRITE_ENCRYPT_MODE:
2334                 hci_cc_write_encrypt_mode(hdev, skb);
2335                 break;
2336
2337         case HCI_OP_WRITE_SCAN_ENABLE:
2338                 hci_cc_write_scan_enable(hdev, skb);
2339                 break;
2340
2341         case HCI_OP_READ_CLASS_OF_DEV:
2342                 hci_cc_read_class_of_dev(hdev, skb);
2343                 break;
2344
2345         case HCI_OP_WRITE_CLASS_OF_DEV:
2346                 hci_cc_write_class_of_dev(hdev, skb);
2347                 break;
2348
2349         case HCI_OP_READ_VOICE_SETTING:
2350                 hci_cc_read_voice_setting(hdev, skb);
2351                 break;
2352
2353         case HCI_OP_WRITE_VOICE_SETTING:
2354                 hci_cc_write_voice_setting(hdev, skb);
2355                 break;
2356
2357         case HCI_OP_HOST_BUFFER_SIZE:
2358                 hci_cc_host_buffer_size(hdev, skb);
2359                 break;
2360
2361         case HCI_OP_WRITE_SSP_MODE:
2362                 hci_cc_write_ssp_mode(hdev, skb);
2363                 break;
2364
2365         case HCI_OP_READ_LOCAL_VERSION:
2366                 hci_cc_read_local_version(hdev, skb);
2367                 break;
2368
2369         case HCI_OP_READ_LOCAL_COMMANDS:
2370                 hci_cc_read_local_commands(hdev, skb);
2371                 break;
2372
2373         case HCI_OP_READ_LOCAL_FEATURES:
2374                 hci_cc_read_local_features(hdev, skb);
2375                 break;
2376
2377         case HCI_OP_READ_LOCAL_EXT_FEATURES:
2378                 hci_cc_read_local_ext_features(hdev, skb);
2379                 break;
2380
2381         case HCI_OP_READ_BUFFER_SIZE:
2382                 hci_cc_read_buffer_size(hdev, skb);
2383                 break;
2384
2385         case HCI_OP_READ_BD_ADDR:
2386                 hci_cc_read_bd_addr(hdev, skb);
2387                 break;
2388
2389         case HCI_OP_READ_DATA_BLOCK_SIZE:
2390                 hci_cc_read_data_block_size(hdev, skb);
2391                 break;
2392
2393         case HCI_OP_WRITE_CA_TIMEOUT:
2394                 hci_cc_write_ca_timeout(hdev, skb);
2395                 break;
2396
2397         case HCI_OP_READ_FLOW_CONTROL_MODE:
2398                 hci_cc_read_flow_control_mode(hdev, skb);
2399                 break;
2400
2401         case HCI_OP_READ_LOCAL_AMP_INFO:
2402                 hci_cc_read_local_amp_info(hdev, skb);
2403                 break;
2404
2405         case HCI_OP_READ_LOCAL_AMP_ASSOC:
2406                 hci_cc_read_local_amp_assoc(hdev, skb);
2407                 break;
2408
2409         case HCI_OP_DELETE_STORED_LINK_KEY:
2410                 hci_cc_delete_stored_link_key(hdev, skb);
2411                 break;
2412
2413         case HCI_OP_SET_EVENT_MASK:
2414                 hci_cc_set_event_mask(hdev, skb);
2415                 break;
2416
2417         case HCI_OP_WRITE_INQUIRY_MODE:
2418                 hci_cc_write_inquiry_mode(hdev, skb);
2419                 break;
2420
2421         case HCI_OP_READ_INQ_RSP_TX_POWER:
2422                 hci_cc_read_inq_rsp_tx_power(hdev, skb);
2423                 break;
2424
2425         case HCI_OP_SET_EVENT_FLT:
2426                 hci_cc_set_event_flt(hdev, skb);
2427                 break;
2428
2429         case HCI_OP_PIN_CODE_REPLY:
2430                 hci_cc_pin_code_reply(hdev, skb);
2431                 break;
2432
2433         case HCI_OP_PIN_CODE_NEG_REPLY:
2434                 hci_cc_pin_code_neg_reply(hdev, skb);
2435                 break;
2436
2437         case HCI_OP_READ_LOCAL_OOB_DATA:
2438                 hci_cc_read_local_oob_data_reply(hdev, skb);
2439                 break;
2440
2441         case HCI_OP_LE_READ_BUFFER_SIZE:
2442                 hci_cc_le_read_buffer_size(hdev, skb);
2443                 break;
2444
2445         case HCI_OP_USER_CONFIRM_REPLY:
2446                 hci_cc_user_confirm_reply(hdev, skb);
2447                 break;
2448
2449         case HCI_OP_USER_CONFIRM_NEG_REPLY:
2450                 hci_cc_user_confirm_neg_reply(hdev, skb);
2451                 break;
2452
2453         case HCI_OP_USER_PASSKEY_REPLY:
2454                 hci_cc_user_passkey_reply(hdev, skb);
2455                 break;
2456
2457         case HCI_OP_USER_PASSKEY_NEG_REPLY:
2458                 hci_cc_user_passkey_neg_reply(hdev, skb);
2459                 break;
2460
2461         case HCI_OP_LE_SET_SCAN_PARAM:
2462                 hci_cc_le_set_scan_param(hdev, skb);
2463                 break;
2464
2465         case HCI_OP_LE_SET_SCAN_ENABLE:
2466                 hci_cc_le_set_scan_enable(hdev, skb);
2467                 break;
2468
2469         case HCI_OP_LE_LTK_REPLY:
2470                 hci_cc_le_ltk_reply(hdev, skb);
2471                 break;
2472
2473         case HCI_OP_LE_LTK_NEG_REPLY:
2474                 hci_cc_le_ltk_neg_reply(hdev, skb);
2475                 break;
2476
2477         case HCI_OP_WRITE_LE_HOST_SUPPORTED:
2478                 hci_cc_write_le_host_supported(hdev, skb);
2479                 break;
2480
2481         case HCI_OP_WRITE_REMOTE_AMP_ASSOC:
2482                 hci_cc_write_remote_amp_assoc(hdev, skb);
2483                 break;
2484
2485         default:
2486                 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
2487                 break;
2488         }
2489
2490         if (ev->opcode != HCI_OP_NOP)
2491                 del_timer(&hdev->cmd_timer);
2492
2493         if (ev->ncmd) {
2494                 atomic_set(&hdev->cmd_cnt, 1);
2495                 if (!skb_queue_empty(&hdev->cmd_q))
2496                         queue_work(hdev->workqueue, &hdev->cmd_work);
2497         }
2498 }
2499
2500 static void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb)
2501 {
2502         struct hci_ev_cmd_status *ev = (void *) skb->data;
2503         __u16 opcode;
2504
2505         skb_pull(skb, sizeof(*ev));
2506
2507         opcode = __le16_to_cpu(ev->opcode);
2508
2509         switch (opcode) {
2510         case HCI_OP_INQUIRY:
2511                 hci_cs_inquiry(hdev, ev->status);
2512                 break;
2513
2514         case HCI_OP_CREATE_CONN:
2515                 hci_cs_create_conn(hdev, ev->status);
2516                 break;
2517
2518         case HCI_OP_ADD_SCO:
2519                 hci_cs_add_sco(hdev, ev->status);
2520                 break;
2521
2522         case HCI_OP_AUTH_REQUESTED:
2523                 hci_cs_auth_requested(hdev, ev->status);
2524                 break;
2525
2526         case HCI_OP_SET_CONN_ENCRYPT:
2527                 hci_cs_set_conn_encrypt(hdev, ev->status);
2528                 break;
2529
2530         case HCI_OP_REMOTE_NAME_REQ:
2531                 hci_cs_remote_name_req(hdev, ev->status);
2532                 break;
2533
2534         case HCI_OP_READ_REMOTE_FEATURES:
2535                 hci_cs_read_remote_features(hdev, ev->status);
2536                 break;
2537
2538         case HCI_OP_READ_REMOTE_EXT_FEATURES:
2539                 hci_cs_read_remote_ext_features(hdev, ev->status);
2540                 break;
2541
2542         case HCI_OP_SETUP_SYNC_CONN:
2543                 hci_cs_setup_sync_conn(hdev, ev->status);
2544                 break;
2545
2546         case HCI_OP_SNIFF_MODE:
2547                 hci_cs_sniff_mode(hdev, ev->status);
2548                 break;
2549
2550         case HCI_OP_EXIT_SNIFF_MODE:
2551                 hci_cs_exit_sniff_mode(hdev, ev->status);
2552                 break;
2553
2554         case HCI_OP_DISCONNECT:
2555                 hci_cs_disconnect(hdev, ev->status);
2556                 break;
2557
2558         case HCI_OP_LE_CREATE_CONN:
2559                 hci_cs_le_create_conn(hdev, ev->status);
2560                 break;
2561
2562         case HCI_OP_LE_START_ENC:
2563                 hci_cs_le_start_enc(hdev, ev->status);
2564                 break;
2565
2566         case HCI_OP_CREATE_PHY_LINK:
2567                 hci_cs_create_phylink(hdev, ev->status);
2568                 break;
2569
2570         case HCI_OP_ACCEPT_PHY_LINK:
2571                 hci_cs_accept_phylink(hdev, ev->status);
2572                 break;
2573
2574         default:
2575                 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
2576                 break;
2577         }
2578
2579         if (ev->opcode != HCI_OP_NOP)
2580                 del_timer(&hdev->cmd_timer);
2581
2582         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
2583                 atomic_set(&hdev->cmd_cnt, 1);
2584                 if (!skb_queue_empty(&hdev->cmd_q))
2585                         queue_work(hdev->workqueue, &hdev->cmd_work);
2586         }
2587 }
2588
2589 static void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2590 {
2591         struct hci_ev_role_change *ev = (void *) skb->data;
2592         struct hci_conn *conn;
2593
2594         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2595
2596         hci_dev_lock(hdev);
2597
2598         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2599         if (conn) {
2600                 if (!ev->status) {
2601                         if (ev->role)
2602                                 conn->link_mode &= ~HCI_LM_MASTER;
2603                         else
2604                                 conn->link_mode |= HCI_LM_MASTER;
2605                 }
2606
2607                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
2608
2609                 hci_role_switch_cfm(conn, ev->status, ev->role);
2610         }
2611
2612         hci_dev_unlock(hdev);
2613 }
2614
2615 static void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
2616 {
2617         struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
2618         int i;
2619
2620         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
2621                 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
2622                 return;
2623         }
2624
2625         if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
2626             ev->num_hndl * sizeof(struct hci_comp_pkts_info)) {
2627                 BT_DBG("%s bad parameters", hdev->name);
2628                 return;
2629         }
2630
2631         BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
2632
2633         for (i = 0; i < ev->num_hndl; i++) {
2634                 struct hci_comp_pkts_info *info = &ev->handles[i];
2635                 struct hci_conn *conn;
2636                 __u16  handle, count;
2637
2638                 handle = __le16_to_cpu(info->handle);
2639                 count  = __le16_to_cpu(info->count);
2640
2641                 conn = hci_conn_hash_lookup_handle(hdev, handle);
2642                 if (!conn)
2643                         continue;
2644
2645                 conn->sent -= count;
2646
2647                 switch (conn->type) {
2648                 case ACL_LINK:
2649                         hdev->acl_cnt += count;
2650                         if (hdev->acl_cnt > hdev->acl_pkts)
2651                                 hdev->acl_cnt = hdev->acl_pkts;
2652                         break;
2653
2654                 case LE_LINK:
2655                         if (hdev->le_pkts) {
2656                                 hdev->le_cnt += count;
2657                                 if (hdev->le_cnt > hdev->le_pkts)
2658                                         hdev->le_cnt = hdev->le_pkts;
2659                         } else {
2660                                 hdev->acl_cnt += count;
2661                                 if (hdev->acl_cnt > hdev->acl_pkts)
2662                                         hdev->acl_cnt = hdev->acl_pkts;
2663                         }
2664                         break;
2665
2666                 case SCO_LINK:
2667                         hdev->sco_cnt += count;
2668                         if (hdev->sco_cnt > hdev->sco_pkts)
2669                                 hdev->sco_cnt = hdev->sco_pkts;
2670                         break;
2671
2672                 default:
2673                         BT_ERR("Unknown type %d conn %p", conn->type, conn);
2674                         break;
2675                 }
2676         }
2677
2678         queue_work(hdev->workqueue, &hdev->tx_work);
2679 }
2680
2681 static void hci_num_comp_blocks_evt(struct hci_dev *hdev, struct sk_buff *skb)
2682 {
2683         struct hci_ev_num_comp_blocks *ev = (void *) skb->data;
2684         int i;
2685
2686         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
2687                 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
2688                 return;
2689         }
2690
2691         if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
2692             ev->num_hndl * sizeof(struct hci_comp_blocks_info)) {
2693                 BT_DBG("%s bad parameters", hdev->name);
2694                 return;
2695         }
2696
2697         BT_DBG("%s num_blocks %d num_hndl %d", hdev->name, ev->num_blocks,
2698                ev->num_hndl);
2699
2700         for (i = 0; i < ev->num_hndl; i++) {
2701                 struct hci_comp_blocks_info *info = &ev->handles[i];
2702                 struct hci_conn *conn;
2703                 __u16  handle, block_count;
2704
2705                 handle = __le16_to_cpu(info->handle);
2706                 block_count = __le16_to_cpu(info->blocks);
2707
2708                 conn = hci_conn_hash_lookup_handle(hdev, handle);
2709                 if (!conn)
2710                         continue;
2711
2712                 conn->sent -= block_count;
2713
2714                 switch (conn->type) {
2715                 case ACL_LINK:
2716                         hdev->block_cnt += block_count;
2717                         if (hdev->block_cnt > hdev->num_blocks)
2718                                 hdev->block_cnt = hdev->num_blocks;
2719                         break;
2720
2721                 default:
2722                         BT_ERR("Unknown type %d conn %p", conn->type, conn);
2723                         break;
2724                 }
2725         }
2726
2727         queue_work(hdev->workqueue, &hdev->tx_work);
2728 }
2729
2730 static void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2731 {
2732         struct hci_ev_mode_change *ev = (void *) skb->data;
2733         struct hci_conn *conn;
2734
2735         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2736
2737         hci_dev_lock(hdev);
2738
2739         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2740         if (conn) {
2741                 conn->mode = ev->mode;
2742                 conn->interval = __le16_to_cpu(ev->interval);
2743
2744                 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND,
2745                                         &conn->flags)) {
2746                         if (conn->mode == HCI_CM_ACTIVE)
2747                                 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
2748                         else
2749                                 clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
2750                 }
2751
2752                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2753                         hci_sco_setup(conn, ev->status);
2754         }
2755
2756         hci_dev_unlock(hdev);
2757 }
2758
2759 static void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2760 {
2761         struct hci_ev_pin_code_req *ev = (void *) skb->data;
2762         struct hci_conn *conn;
2763
2764         BT_DBG("%s", hdev->name);
2765
2766         hci_dev_lock(hdev);
2767
2768         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2769         if (!conn)
2770                 goto unlock;
2771
2772         if (conn->state == BT_CONNECTED) {
2773                 hci_conn_hold(conn);
2774                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2775                 hci_conn_put(conn);
2776         }
2777
2778         if (!test_bit(HCI_PAIRABLE, &hdev->dev_flags))
2779                 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2780                              sizeof(ev->bdaddr), &ev->bdaddr);
2781         else if (test_bit(HCI_MGMT, &hdev->dev_flags)) {
2782                 u8 secure;
2783
2784                 if (conn->pending_sec_level == BT_SECURITY_HIGH)
2785                         secure = 1;
2786                 else
2787                         secure = 0;
2788
2789                 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
2790         }
2791
2792 unlock:
2793         hci_dev_unlock(hdev);
2794 }
2795
2796 static void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2797 {
2798         struct hci_ev_link_key_req *ev = (void *) skb->data;
2799         struct hci_cp_link_key_reply cp;
2800         struct hci_conn *conn;
2801         struct link_key *key;
2802
2803         BT_DBG("%s", hdev->name);
2804
2805         if (!test_bit(HCI_LINK_KEYS, &hdev->dev_flags))
2806                 return;
2807
2808         hci_dev_lock(hdev);
2809
2810         key = hci_find_link_key(hdev, &ev->bdaddr);
2811         if (!key) {
2812                 BT_DBG("%s link key not found for %s", hdev->name,
2813                        batostr(&ev->bdaddr));
2814                 goto not_found;
2815         }
2816
2817         BT_DBG("%s found key type %u for %s", hdev->name, key->type,
2818                batostr(&ev->bdaddr));
2819
2820         if (!test_bit(HCI_DEBUG_KEYS, &hdev->dev_flags) &&
2821             key->type == HCI_LK_DEBUG_COMBINATION) {
2822                 BT_DBG("%s ignoring debug key", hdev->name);
2823                 goto not_found;
2824         }
2825
2826         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2827         if (conn) {
2828                 if (key->type == HCI_LK_UNAUTH_COMBINATION &&
2829                     conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
2830                         BT_DBG("%s ignoring unauthenticated key", hdev->name);
2831                         goto not_found;
2832                 }
2833
2834                 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
2835                     conn->pending_sec_level == BT_SECURITY_HIGH) {
2836                         BT_DBG("%s ignoring key unauthenticated for high security",
2837                                hdev->name);
2838                         goto not_found;
2839                 }
2840
2841                 conn->key_type = key->type;
2842                 conn->pin_length = key->pin_len;
2843         }
2844
2845         bacpy(&cp.bdaddr, &ev->bdaddr);
2846         memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);
2847
2848         hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
2849
2850         hci_dev_unlock(hdev);
2851
2852         return;
2853
2854 not_found:
2855         hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
2856         hci_dev_unlock(hdev);
2857 }
2858
2859 static void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
2860 {
2861         struct hci_ev_link_key_notify *ev = (void *) skb->data;
2862         struct hci_conn *conn;
2863         u8 pin_len = 0;
2864
2865         BT_DBG("%s", hdev->name);
2866
2867         hci_dev_lock(hdev);
2868
2869         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2870         if (conn) {
2871                 hci_conn_hold(conn);
2872                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2873                 pin_len = conn->pin_length;
2874
2875                 if (ev->key_type != HCI_LK_CHANGED_COMBINATION)
2876                         conn->key_type = ev->key_type;
2877
2878                 hci_conn_put(conn);
2879         }
2880
2881         if (test_bit(HCI_LINK_KEYS, &hdev->dev_flags))
2882                 hci_add_link_key(hdev, conn, 1, &ev->bdaddr, ev->link_key,
2883                                  ev->key_type, pin_len);
2884
2885         hci_dev_unlock(hdev);
2886 }
2887
2888 static void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
2889 {
2890         struct hci_ev_clock_offset *ev = (void *) skb->data;
2891         struct hci_conn *conn;
2892
2893         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2894
2895         hci_dev_lock(hdev);
2896
2897         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2898         if (conn && !ev->status) {
2899                 struct inquiry_entry *ie;
2900
2901                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
2902                 if (ie) {
2903                         ie->data.clock_offset = ev->clock_offset;
2904                         ie->timestamp = jiffies;
2905                 }
2906         }
2907
2908         hci_dev_unlock(hdev);
2909 }
2910
2911 static void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2912 {
2913         struct hci_ev_pkt_type_change *ev = (void *) skb->data;
2914         struct hci_conn *conn;
2915
2916         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2917
2918         hci_dev_lock(hdev);
2919
2920         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2921         if (conn && !ev->status)
2922                 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
2923
2924         hci_dev_unlock(hdev);
2925 }
2926
2927 static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
2928 {
2929         struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
2930         struct inquiry_entry *ie;
2931
2932         BT_DBG("%s", hdev->name);
2933
2934         hci_dev_lock(hdev);
2935
2936         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2937         if (ie) {
2938                 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
2939                 ie->timestamp = jiffies;
2940         }
2941
2942         hci_dev_unlock(hdev);
2943 }
2944
2945 static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
2946                                              struct sk_buff *skb)
2947 {
2948         struct inquiry_data data;
2949         int num_rsp = *((__u8 *) skb->data);
2950         bool name_known, ssp;
2951
2952         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2953
2954         if (!num_rsp)
2955                 return;
2956
2957         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
2958                 return;
2959
2960         hci_dev_lock(hdev);
2961
2962         if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
2963                 struct inquiry_info_with_rssi_and_pscan_mode *info;
2964                 info = (void *) (skb->data + 1);
2965
2966                 for (; num_rsp; num_rsp--, info++) {
2967                         bacpy(&data.bdaddr, &info->bdaddr);
2968                         data.pscan_rep_mode     = info->pscan_rep_mode;
2969                         data.pscan_period_mode  = info->pscan_period_mode;
2970                         data.pscan_mode         = info->pscan_mode;
2971                         memcpy(data.dev_class, info->dev_class, 3);
2972                         data.clock_offset       = info->clock_offset;
2973                         data.rssi               = info->rssi;
2974                         data.ssp_mode           = 0x00;
2975
2976                         name_known = hci_inquiry_cache_update(hdev, &data,
2977                                                               false, &ssp);
2978                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2979                                           info->dev_class, info->rssi,
2980                                           !name_known, ssp, NULL, 0);
2981                 }
2982         } else {
2983                 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
2984
2985                 for (; num_rsp; num_rsp--, info++) {
2986                         bacpy(&data.bdaddr, &info->bdaddr);
2987                         data.pscan_rep_mode     = info->pscan_rep_mode;
2988                         data.pscan_period_mode  = info->pscan_period_mode;
2989                         data.pscan_mode         = 0x00;
2990                         memcpy(data.dev_class, info->dev_class, 3);
2991                         data.clock_offset       = info->clock_offset;
2992                         data.rssi               = info->rssi;
2993                         data.ssp_mode           = 0x00;
2994                         name_known = hci_inquiry_cache_update(hdev, &data,
2995                                                               false, &ssp);
2996                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2997                                           info->dev_class, info->rssi,
2998                                           !name_known, ssp, NULL, 0);
2999                 }
3000         }
3001
3002         hci_dev_unlock(hdev);
3003 }
3004
3005 static void hci_remote_ext_features_evt(struct hci_dev *hdev,
3006                                         struct sk_buff *skb)
3007 {
3008         struct hci_ev_remote_ext_features *ev = (void *) skb->data;
3009         struct hci_conn *conn;
3010
3011         BT_DBG("%s", hdev->name);
3012
3013         hci_dev_lock(hdev);
3014
3015         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3016         if (!conn)
3017                 goto unlock;
3018
3019         if (!ev->status && ev->page == 0x01) {
3020                 struct inquiry_entry *ie;
3021
3022                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
3023                 if (ie)
3024                         ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
3025
3026                 if (ev->features[0] & LMP_HOST_SSP)
3027                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
3028         }
3029
3030         if (conn->state != BT_CONFIG)
3031                 goto unlock;
3032
3033         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
3034                 struct hci_cp_remote_name_req cp;
3035                 memset(&cp, 0, sizeof(cp));
3036                 bacpy(&cp.bdaddr, &conn->dst);
3037                 cp.pscan_rep_mode = 0x02;
3038                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
3039         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
3040                 mgmt_device_connected(hdev, &conn->dst, conn->type,
3041                                       conn->dst_type, 0, NULL, 0,
3042                                       conn->dev_class);
3043
3044         if (!hci_outgoing_auth_needed(hdev, conn)) {
3045                 conn->state = BT_CONNECTED;
3046                 hci_proto_connect_cfm(conn, ev->status);
3047                 hci_conn_put(conn);
3048         }
3049
3050 unlock:
3051         hci_dev_unlock(hdev);
3052 }
3053
3054 static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
3055                                        struct sk_buff *skb)
3056 {
3057         struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
3058         struct hci_conn *conn;
3059
3060         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3061
3062         hci_dev_lock(hdev);
3063
3064         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
3065         if (!conn) {
3066                 if (ev->link_type == ESCO_LINK)
3067                         goto unlock;
3068
3069                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
3070                 if (!conn)
3071                         goto unlock;
3072
3073                 conn->type = SCO_LINK;
3074         }
3075
3076         switch (ev->status) {
3077         case 0x00:
3078                 conn->handle = __le16_to_cpu(ev->handle);
3079                 conn->state  = BT_CONNECTED;
3080
3081                 hci_conn_hold_device(conn);
3082                 hci_conn_add_sysfs(conn);
3083                 break;
3084
3085         case 0x11:      /* Unsupported Feature or Parameter Value */
3086         case 0x1c:      /* SCO interval rejected */
3087         case 0x1a:      /* Unsupported Remote Feature */
3088         case 0x1f:      /* Unspecified error */
3089                 if (conn->out && conn->attempt < 2) {
3090                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
3091                                         (hdev->esco_type & EDR_ESCO_MASK);
3092                         hci_setup_sync(conn, conn->link->handle);
3093                         goto unlock;
3094                 }
3095                 /* fall through */
3096
3097         default:
3098                 conn->state = BT_CLOSED;
3099                 break;
3100         }
3101
3102         hci_proto_connect_cfm(conn, ev->status);
3103         if (ev->status)
3104                 hci_conn_del(conn);
3105
3106 unlock:
3107         hci_dev_unlock(hdev);
3108 }
3109
3110 static void hci_sync_conn_changed_evt(struct hci_dev *hdev, struct sk_buff *skb)
3111 {
3112         BT_DBG("%s", hdev->name);
3113 }
3114
3115 static void hci_sniff_subrate_evt(struct hci_dev *hdev, struct sk_buff *skb)
3116 {
3117         struct hci_ev_sniff_subrate *ev = (void *) skb->data;
3118
3119         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3120 }
3121
3122 static void hci_extended_inquiry_result_evt(struct hci_dev *hdev,
3123                                             struct sk_buff *skb)
3124 {
3125         struct inquiry_data data;
3126         struct extended_inquiry_info *info = (void *) (skb->data + 1);
3127         int num_rsp = *((__u8 *) skb->data);
3128         size_t eir_len;
3129
3130         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
3131
3132         if (!num_rsp)
3133                 return;
3134
3135         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
3136                 return;
3137
3138         hci_dev_lock(hdev);
3139
3140         for (; num_rsp; num_rsp--, info++) {
3141                 bool name_known, ssp;
3142
3143                 bacpy(&data.bdaddr, &info->bdaddr);
3144                 data.pscan_rep_mode     = info->pscan_rep_mode;
3145                 data.pscan_period_mode  = info->pscan_period_mode;
3146                 data.pscan_mode         = 0x00;
3147                 memcpy(data.dev_class, info->dev_class, 3);
3148                 data.clock_offset       = info->clock_offset;
3149                 data.rssi               = info->rssi;
3150                 data.ssp_mode           = 0x01;
3151
3152                 if (test_bit(HCI_MGMT, &hdev->dev_flags))
3153                         name_known = eir_has_data_type(info->data,
3154                                                        sizeof(info->data),
3155                                                        EIR_NAME_COMPLETE);
3156                 else
3157                         name_known = true;
3158
3159                 name_known = hci_inquiry_cache_update(hdev, &data, name_known,
3160                                                       &ssp);
3161                 eir_len = eir_get_length(info->data, sizeof(info->data));
3162                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
3163                                   info->dev_class, info->rssi, !name_known,
3164                                   ssp, info->data, eir_len);
3165         }
3166
3167         hci_dev_unlock(hdev);
3168 }
3169
3170 static void hci_key_refresh_complete_evt(struct hci_dev *hdev,
3171                                          struct sk_buff *skb)
3172 {
3173         struct hci_ev_key_refresh_complete *ev = (void *) skb->data;
3174         struct hci_conn *conn;
3175
3176         BT_DBG("%s status 0x%2.2x handle 0x%4.4x", hdev->name, ev->status,
3177                __le16_to_cpu(ev->handle));
3178
3179         hci_dev_lock(hdev);
3180
3181         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3182         if (!conn)
3183                 goto unlock;
3184
3185         if (!ev->status)
3186                 conn->sec_level = conn->pending_sec_level;
3187
3188         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3189
3190         if (ev->status && conn->state == BT_CONNECTED) {
3191                 hci_acl_disconn(conn, HCI_ERROR_AUTH_FAILURE);
3192                 hci_conn_put(conn);
3193                 goto unlock;
3194         }
3195
3196         if (conn->state == BT_CONFIG) {
3197                 if (!ev->status)
3198                         conn->state = BT_CONNECTED;
3199
3200                 hci_proto_connect_cfm(conn, ev->status);
3201                 hci_conn_put(conn);
3202         } else {
3203                 hci_auth_cfm(conn, ev->status);
3204
3205                 hci_conn_hold(conn);
3206                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3207                 hci_conn_put(conn);
3208         }
3209
3210 unlock:
3211         hci_dev_unlock(hdev);
3212 }
3213
3214 static u8 hci_get_auth_req(struct hci_conn *conn)
3215 {
3216         /* If remote requests dedicated bonding follow that lead */
3217         if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03) {
3218                 /* If both remote and local IO capabilities allow MITM
3219                  * protection then require it, otherwise don't */
3220                 if (conn->remote_cap == 0x03 || conn->io_capability == 0x03)
3221                         return 0x02;
3222                 else
3223                         return 0x03;
3224         }
3225
3226         /* If remote requests no-bonding follow that lead */
3227         if (conn->remote_auth == 0x00 || conn->remote_auth == 0x01)
3228                 return conn->remote_auth | (conn->auth_type & 0x01);
3229
3230         return conn->auth_type;
3231 }
3232
3233 static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3234 {
3235         struct hci_ev_io_capa_request *ev = (void *) skb->data;
3236         struct hci_conn *conn;
3237
3238         BT_DBG("%s", hdev->name);
3239
3240         hci_dev_lock(hdev);
3241
3242         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3243         if (!conn)
3244                 goto unlock;
3245
3246         hci_conn_hold(conn);
3247
3248         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3249                 goto unlock;
3250
3251         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags) ||
3252             (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
3253                 struct hci_cp_io_capability_reply cp;
3254
3255                 bacpy(&cp.bdaddr, &ev->bdaddr);
3256                 /* Change the IO capability from KeyboardDisplay
3257                  * to DisplayYesNo as it is not supported by BT spec. */
3258                 cp.capability = (conn->io_capability == 0x04) ?
3259                                                 0x01 : conn->io_capability;
3260                 conn->auth_type = hci_get_auth_req(conn);
3261                 cp.authentication = conn->auth_type;
3262
3263                 if (hci_find_remote_oob_data(hdev, &conn->dst) &&
3264                     (conn->out || test_bit(HCI_CONN_REMOTE_OOB, &conn->flags)))
3265                         cp.oob_data = 0x01;
3266                 else
3267                         cp.oob_data = 0x00;
3268
3269                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
3270                              sizeof(cp), &cp);
3271         } else {
3272                 struct hci_cp_io_capability_neg_reply cp;
3273
3274                 bacpy(&cp.bdaddr, &ev->bdaddr);
3275                 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
3276
3277                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
3278                              sizeof(cp), &cp);
3279         }
3280
3281 unlock:
3282         hci_dev_unlock(hdev);
3283 }
3284
3285 static void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
3286 {
3287         struct hci_ev_io_capa_reply *ev = (void *) skb->data;
3288         struct hci_conn *conn;
3289
3290         BT_DBG("%s", hdev->name);
3291
3292         hci_dev_lock(hdev);
3293
3294         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3295         if (!conn)
3296                 goto unlock;
3297
3298         conn->remote_cap = ev->capability;
3299         conn->remote_auth = ev->authentication;
3300         if (ev->oob_data)
3301                 set_bit(HCI_CONN_REMOTE_OOB, &conn->flags);
3302
3303 unlock:
3304         hci_dev_unlock(hdev);
3305 }
3306
3307 static void hci_user_confirm_request_evt(struct hci_dev *hdev,
3308                                          struct sk_buff *skb)
3309 {
3310         struct hci_ev_user_confirm_req *ev = (void *) skb->data;
3311         int loc_mitm, rem_mitm, confirm_hint = 0;
3312         struct hci_conn *conn;
3313
3314         BT_DBG("%s", hdev->name);
3315
3316         hci_dev_lock(hdev);
3317
3318         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3319                 goto unlock;
3320
3321         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3322         if (!conn)
3323                 goto unlock;
3324
3325         loc_mitm = (conn->auth_type & 0x01);
3326         rem_mitm = (conn->remote_auth & 0x01);
3327
3328         /* If we require MITM but the remote device can't provide that
3329          * (it has NoInputNoOutput) then reject the confirmation
3330          * request. The only exception is when we're dedicated bonding
3331          * initiators (connect_cfm_cb set) since then we always have the MITM
3332          * bit set. */
3333         if (!conn->connect_cfm_cb && loc_mitm && conn->remote_cap == 0x03) {
3334                 BT_DBG("Rejecting request: remote device can't provide MITM");
3335                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
3336                              sizeof(ev->bdaddr), &ev->bdaddr);
3337                 goto unlock;
3338         }
3339
3340         /* If no side requires MITM protection; auto-accept */
3341         if ((!loc_mitm || conn->remote_cap == 0x03) &&
3342             (!rem_mitm || conn->io_capability == 0x03)) {
3343
3344                 /* If we're not the initiators request authorization to
3345                  * proceed from user space (mgmt_user_confirm with
3346                  * confirm_hint set to 1). */
3347                 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
3348                         BT_DBG("Confirming auto-accept as acceptor");
3349                         confirm_hint = 1;
3350                         goto confirm;
3351                 }
3352
3353                 BT_DBG("Auto-accept of user confirmation with %ums delay",
3354                        hdev->auto_accept_delay);
3355
3356                 if (hdev->auto_accept_delay > 0) {
3357                         int delay = msecs_to_jiffies(hdev->auto_accept_delay);
3358                         mod_timer(&conn->auto_accept_timer, jiffies + delay);
3359                         goto unlock;
3360                 }
3361
3362                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
3363                              sizeof(ev->bdaddr), &ev->bdaddr);
3364                 goto unlock;
3365         }
3366
3367 confirm:
3368         mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0, ev->passkey,
3369                                   confirm_hint);
3370
3371 unlock:
3372         hci_dev_unlock(hdev);
3373 }
3374
3375 static void hci_user_passkey_request_evt(struct hci_dev *hdev,
3376                                          struct sk_buff *skb)
3377 {
3378         struct hci_ev_user_passkey_req *ev = (void *) skb->data;
3379
3380         BT_DBG("%s", hdev->name);
3381
3382         if (test_bit(HCI_MGMT, &hdev->dev_flags))
3383                 mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
3384 }
3385
3386 static void hci_user_passkey_notify_evt(struct hci_dev *hdev,
3387                                         struct sk_buff *skb)
3388 {
3389         struct hci_ev_user_passkey_notify *ev = (void *) skb->data;
3390         struct hci_conn *conn;
3391
3392         BT_DBG("%s", hdev->name);
3393
3394         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3395         if (!conn)
3396                 return;
3397
3398         conn->passkey_notify = __le32_to_cpu(ev->passkey);
3399         conn->passkey_entered = 0;
3400
3401         if (test_bit(HCI_MGMT, &hdev->dev_flags))
3402                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
3403                                          conn->dst_type, conn->passkey_notify,
3404                                          conn->passkey_entered);
3405 }
3406
3407 static void hci_keypress_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
3408 {
3409         struct hci_ev_keypress_notify *ev = (void *) skb->data;
3410         struct hci_conn *conn;
3411
3412         BT_DBG("%s", hdev->name);
3413
3414         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3415         if (!conn)
3416                 return;
3417
3418         switch (ev->type) {
3419         case HCI_KEYPRESS_STARTED:
3420                 conn->passkey_entered = 0;
3421                 return;
3422
3423         case HCI_KEYPRESS_ENTERED:
3424                 conn->passkey_entered++;
3425                 break;
3426
3427         case HCI_KEYPRESS_ERASED:
3428                 conn->passkey_entered--;
3429                 break;
3430
3431         case HCI_KEYPRESS_CLEARED:
3432                 conn->passkey_entered = 0;
3433                 break;
3434
3435         case HCI_KEYPRESS_COMPLETED:
3436                 return;
3437         }
3438
3439         if (test_bit(HCI_MGMT, &hdev->dev_flags))
3440                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
3441                                          conn->dst_type, conn->passkey_notify,
3442                                          conn->passkey_entered);
3443 }
3444
3445 static void hci_simple_pair_complete_evt(struct hci_dev *hdev,
3446                                          struct sk_buff *skb)
3447 {
3448         struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
3449         struct hci_conn *conn;
3450
3451         BT_DBG("%s", hdev->name);
3452
3453         hci_dev_lock(hdev);
3454
3455         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3456         if (!conn)
3457                 goto unlock;
3458
3459         /* To avoid duplicate auth_failed events to user space we check
3460          * the HCI_CONN_AUTH_PEND flag which will be set if we
3461          * initiated the authentication. A traditional auth_complete
3462          * event gets always produced as initiator and is also mapped to
3463          * the mgmt_auth_failed event */
3464         if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status)
3465                 mgmt_auth_failed(hdev, &conn->dst, conn->type, conn->dst_type,
3466                                  ev->status);
3467
3468         hci_conn_put(conn);
3469
3470 unlock:
3471         hci_dev_unlock(hdev);
3472 }
3473
3474 static void hci_remote_host_features_evt(struct hci_dev *hdev,
3475                                          struct sk_buff *skb)
3476 {
3477         struct hci_ev_remote_host_features *ev = (void *) skb->data;
3478         struct inquiry_entry *ie;
3479
3480         BT_DBG("%s", hdev->name);
3481
3482         hci_dev_lock(hdev);
3483
3484         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
3485         if (ie)
3486                 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
3487
3488         hci_dev_unlock(hdev);
3489 }
3490
3491 static void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
3492                                             struct sk_buff *skb)
3493 {
3494         struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
3495         struct oob_data *data;
3496
3497         BT_DBG("%s", hdev->name);
3498
3499         hci_dev_lock(hdev);
3500
3501         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3502                 goto unlock;
3503
3504         data = hci_find_remote_oob_data(hdev, &ev->bdaddr);
3505         if (data) {
3506                 struct hci_cp_remote_oob_data_reply cp;
3507
3508                 bacpy(&cp.bdaddr, &ev->bdaddr);
3509                 memcpy(cp.hash, data->hash, sizeof(cp.hash));
3510                 memcpy(cp.randomizer, data->randomizer, sizeof(cp.randomizer));
3511
3512                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY, sizeof(cp),
3513                              &cp);
3514         } else {
3515                 struct hci_cp_remote_oob_data_neg_reply cp;
3516
3517                 bacpy(&cp.bdaddr, &ev->bdaddr);
3518                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY, sizeof(cp),
3519                              &cp);
3520         }
3521
3522 unlock:
3523         hci_dev_unlock(hdev);
3524 }
3525
3526 static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
3527 {
3528         struct hci_ev_le_conn_complete *ev = (void *) skb->data;
3529         struct hci_conn *conn;
3530
3531         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3532
3533         hci_dev_lock(hdev);
3534
3535         conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
3536         if (!conn) {
3537                 conn = hci_conn_add(hdev, LE_LINK, &ev->bdaddr);
3538                 if (!conn) {
3539                         BT_ERR("No memory for new connection");
3540                         goto unlock;
3541                 }
3542
3543                 conn->dst_type = ev->bdaddr_type;
3544
3545                 if (ev->role == LE_CONN_ROLE_MASTER) {
3546                         conn->out = true;
3547                         conn->link_mode |= HCI_LM_MASTER;
3548                 }
3549         }
3550
3551         if (ev->status) {
3552                 mgmt_connect_failed(hdev, &conn->dst, conn->type,
3553                                     conn->dst_type, ev->status);
3554                 hci_proto_connect_cfm(conn, ev->status);
3555                 conn->state = BT_CLOSED;
3556                 hci_conn_del(conn);
3557                 goto unlock;
3558         }
3559
3560         if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
3561                 mgmt_device_connected(hdev, &ev->bdaddr, conn->type,
3562                                       conn->dst_type, 0, NULL, 0, NULL);
3563
3564         conn->sec_level = BT_SECURITY_LOW;
3565         conn->handle = __le16_to_cpu(ev->handle);
3566         conn->state = BT_CONNECTED;
3567
3568         hci_conn_hold_device(conn);
3569         hci_conn_add_sysfs(conn);
3570
3571         hci_proto_connect_cfm(conn, ev->status);
3572
3573 unlock:
3574         hci_dev_unlock(hdev);
3575 }
3576
3577 static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
3578 {
3579         u8 num_reports = skb->data[0];
3580         void *ptr = &skb->data[1];
3581         s8 rssi;
3582
3583         hci_dev_lock(hdev);
3584
3585         while (num_reports--) {
3586                 struct hci_ev_le_advertising_info *ev = ptr;
3587
3588                 rssi = ev->data[ev->length];
3589                 mgmt_device_found(hdev, &ev->bdaddr, LE_LINK, ev->bdaddr_type,
3590                                   NULL, rssi, 0, 1, ev->data, ev->length);
3591
3592                 ptr += sizeof(*ev) + ev->length + 1;
3593         }
3594
3595         hci_dev_unlock(hdev);
3596 }
3597
3598 static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3599 {
3600         struct hci_ev_le_ltk_req *ev = (void *) skb->data;
3601         struct hci_cp_le_ltk_reply cp;
3602         struct hci_cp_le_ltk_neg_reply neg;
3603         struct hci_conn *conn;
3604         struct smp_ltk *ltk;
3605
3606         BT_DBG("%s handle 0x%4.4x", hdev->name, __le16_to_cpu(ev->handle));
3607
3608         hci_dev_lock(hdev);
3609
3610         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3611         if (conn == NULL)
3612                 goto not_found;
3613
3614         ltk = hci_find_ltk(hdev, ev->ediv, ev->random);
3615         if (ltk == NULL)
3616                 goto not_found;
3617
3618         memcpy(cp.ltk, ltk->val, sizeof(ltk->val));
3619         cp.handle = cpu_to_le16(conn->handle);
3620
3621         if (ltk->authenticated)
3622                 conn->sec_level = BT_SECURITY_HIGH;
3623
3624         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
3625
3626         if (ltk->type & HCI_SMP_STK) {
3627                 list_del(&ltk->list);
3628                 kfree(ltk);
3629         }
3630
3631         hci_dev_unlock(hdev);
3632
3633         return;
3634
3635 not_found:
3636         neg.handle = ev->handle;
3637         hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
3638         hci_dev_unlock(hdev);
3639 }
3640
3641 static void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
3642 {
3643         struct hci_ev_le_meta *le_ev = (void *) skb->data;
3644
3645         skb_pull(skb, sizeof(*le_ev));
3646
3647         switch (le_ev->subevent) {
3648         case HCI_EV_LE_CONN_COMPLETE:
3649                 hci_le_conn_complete_evt(hdev, skb);
3650                 break;
3651
3652         case HCI_EV_LE_ADVERTISING_REPORT:
3653                 hci_le_adv_report_evt(hdev, skb);
3654                 break;
3655
3656         case HCI_EV_LE_LTK_REQ:
3657                 hci_le_ltk_request_evt(hdev, skb);
3658                 break;
3659
3660         default:
3661                 break;
3662         }
3663 }
3664
3665 static void hci_chan_selected_evt(struct hci_dev *hdev, struct sk_buff *skb)
3666 {
3667         struct hci_ev_channel_selected *ev = (void *) skb->data;
3668         struct hci_conn *hcon;
3669
3670         BT_DBG("%s handle 0x%2.2x", hdev->name, ev->phy_handle);
3671
3672         skb_pull(skb, sizeof(*ev));
3673
3674         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
3675         if (!hcon)
3676                 return;
3677
3678         amp_read_loc_assoc_final_data(hdev, hcon);
3679 }
3680
3681 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
3682 {
3683         struct hci_event_hdr *hdr = (void *) skb->data;
3684         __u8 event = hdr->evt;
3685
3686         skb_pull(skb, HCI_EVENT_HDR_SIZE);
3687
3688         switch (event) {
3689         case HCI_EV_INQUIRY_COMPLETE:
3690                 hci_inquiry_complete_evt(hdev, skb);
3691                 break;
3692
3693         case HCI_EV_INQUIRY_RESULT:
3694                 hci_inquiry_result_evt(hdev, skb);
3695                 break;
3696
3697         case HCI_EV_CONN_COMPLETE:
3698                 hci_conn_complete_evt(hdev, skb);
3699                 break;
3700
3701         case HCI_EV_CONN_REQUEST:
3702                 hci_conn_request_evt(hdev, skb);
3703                 break;
3704
3705         case HCI_EV_DISCONN_COMPLETE:
3706                 hci_disconn_complete_evt(hdev, skb);
3707                 break;
3708
3709         case HCI_EV_AUTH_COMPLETE:
3710                 hci_auth_complete_evt(hdev, skb);
3711                 break;
3712
3713         case HCI_EV_REMOTE_NAME:
3714                 hci_remote_name_evt(hdev, skb);
3715                 break;
3716
3717         case HCI_EV_ENCRYPT_CHANGE:
3718                 hci_encrypt_change_evt(hdev, skb);
3719                 break;
3720
3721         case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
3722                 hci_change_link_key_complete_evt(hdev, skb);
3723                 break;
3724
3725         case HCI_EV_REMOTE_FEATURES:
3726                 hci_remote_features_evt(hdev, skb);
3727                 break;
3728
3729         case HCI_EV_REMOTE_VERSION:
3730                 hci_remote_version_evt(hdev, skb);
3731                 break;
3732
3733         case HCI_EV_QOS_SETUP_COMPLETE:
3734                 hci_qos_setup_complete_evt(hdev, skb);
3735                 break;
3736
3737         case HCI_EV_CMD_COMPLETE:
3738                 hci_cmd_complete_evt(hdev, skb);
3739                 break;
3740
3741         case HCI_EV_CMD_STATUS:
3742                 hci_cmd_status_evt(hdev, skb);
3743                 break;
3744
3745         case HCI_EV_ROLE_CHANGE:
3746                 hci_role_change_evt(hdev, skb);
3747                 break;
3748
3749         case HCI_EV_NUM_COMP_PKTS:
3750                 hci_num_comp_pkts_evt(hdev, skb);
3751                 break;
3752
3753         case HCI_EV_MODE_CHANGE:
3754                 hci_mode_change_evt(hdev, skb);
3755                 break;
3756
3757         case HCI_EV_PIN_CODE_REQ:
3758                 hci_pin_code_request_evt(hdev, skb);
3759                 break;
3760
3761         case HCI_EV_LINK_KEY_REQ:
3762                 hci_link_key_request_evt(hdev, skb);
3763                 break;
3764
3765         case HCI_EV_LINK_KEY_NOTIFY:
3766                 hci_link_key_notify_evt(hdev, skb);
3767                 break;
3768
3769         case HCI_EV_CLOCK_OFFSET:
3770                 hci_clock_offset_evt(hdev, skb);
3771                 break;
3772
3773         case HCI_EV_PKT_TYPE_CHANGE:
3774                 hci_pkt_type_change_evt(hdev, skb);
3775                 break;
3776
3777         case HCI_EV_PSCAN_REP_MODE:
3778                 hci_pscan_rep_mode_evt(hdev, skb);
3779                 break;
3780
3781         case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
3782                 hci_inquiry_result_with_rssi_evt(hdev, skb);
3783                 break;
3784
3785         case HCI_EV_REMOTE_EXT_FEATURES:
3786                 hci_remote_ext_features_evt(hdev, skb);
3787                 break;
3788
3789         case HCI_EV_SYNC_CONN_COMPLETE:
3790                 hci_sync_conn_complete_evt(hdev, skb);
3791                 break;
3792
3793         case HCI_EV_SYNC_CONN_CHANGED:
3794                 hci_sync_conn_changed_evt(hdev, skb);
3795                 break;
3796
3797         case HCI_EV_SNIFF_SUBRATE:
3798                 hci_sniff_subrate_evt(hdev, skb);
3799                 break;
3800
3801         case HCI_EV_EXTENDED_INQUIRY_RESULT:
3802                 hci_extended_inquiry_result_evt(hdev, skb);
3803                 break;
3804
3805         case HCI_EV_KEY_REFRESH_COMPLETE:
3806                 hci_key_refresh_complete_evt(hdev, skb);
3807                 break;
3808
3809         case HCI_EV_IO_CAPA_REQUEST:
3810                 hci_io_capa_request_evt(hdev, skb);
3811                 break;
3812
3813         case HCI_EV_IO_CAPA_REPLY:
3814                 hci_io_capa_reply_evt(hdev, skb);
3815                 break;
3816
3817         case HCI_EV_USER_CONFIRM_REQUEST:
3818                 hci_user_confirm_request_evt(hdev, skb);
3819                 break;
3820
3821         case HCI_EV_USER_PASSKEY_REQUEST:
3822                 hci_user_passkey_request_evt(hdev, skb);
3823                 break;
3824
3825         case HCI_EV_USER_PASSKEY_NOTIFY:
3826                 hci_user_passkey_notify_evt(hdev, skb);
3827                 break;
3828
3829         case HCI_EV_KEYPRESS_NOTIFY:
3830                 hci_keypress_notify_evt(hdev, skb);
3831                 break;
3832
3833         case HCI_EV_SIMPLE_PAIR_COMPLETE:
3834                 hci_simple_pair_complete_evt(hdev, skb);
3835                 break;
3836
3837         case HCI_EV_REMOTE_HOST_FEATURES:
3838                 hci_remote_host_features_evt(hdev, skb);
3839                 break;
3840
3841         case HCI_EV_LE_META:
3842                 hci_le_meta_evt(hdev, skb);
3843                 break;
3844
3845         case HCI_EV_CHANNEL_SELECTED:
3846                 hci_chan_selected_evt(hdev, skb);
3847                 break;
3848
3849         case HCI_EV_REMOTE_OOB_DATA_REQUEST:
3850                 hci_remote_oob_data_request_evt(hdev, skb);
3851                 break;
3852
3853         case HCI_EV_NUM_COMP_BLOCKS:
3854                 hci_num_comp_blocks_evt(hdev, skb);
3855                 break;
3856
3857         default:
3858                 BT_DBG("%s event 0x%2.2x", hdev->name, event);
3859                 break;
3860         }
3861
3862         kfree_skb(skb);
3863         hdev->stat.evt_rx++;
3864 }