net/bluetooth/hci_event.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI event handling. */
  26
  27 #include <linux/export.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/mgmt.h>
  33
  34 /* Handle HCI Event packets */
  35
  36 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
  37 {
  38         __u8 status = *((__u8 *) skb->data);
  39
  40         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  41
  42         if (status) {
  43                 hci_dev_lock(hdev);
  44                 mgmt_stop_discovery_failed(hdev, status);
  45                 hci_dev_unlock(hdev);
  46                 return;
  47         }
  48
  49         clear_bit(HCI_INQUIRY, &hdev->flags);
  50
  51         hci_dev_lock(hdev);
  52         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
  53         hci_dev_unlock(hdev);
  54
  55         hci_req_complete(hdev, HCI_OP_INQUIRY_CANCEL, status);
  56
  57         hci_conn_check_pending(hdev);
  58 }
  59
  60 static void hci_cc_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  61 {
  62         __u8 status = *((__u8 *) skb->data);
  63
  64         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  65
  66         if (status)
  67                 return;
  68
  69         set_bit(HCI_PERIODIC_INQ, &hdev->dev_flags);
  70 }
  71
  72 static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  73 {
  74         __u8 status = *((__u8 *) skb->data);
  75
  76         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  77
  78         if (status)
  79                 return;
  80
  81         clear_bit(HCI_PERIODIC_INQ, &hdev->dev_flags);
  82
  83         hci_conn_check_pending(hdev);
  84 }
  85
  86 static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev,
  87                                           struct sk_buff *skb)
  88 {
  89         BT_DBG("%s", hdev->name);
  90 }
  91
  92 static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
  93 {
  94         struct hci_rp_role_discovery *rp = (void *) skb->data;
  95         struct hci_conn *conn;
  96
  97         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
  98
  99         if (rp->status)
 100                 return;
 101
 102         hci_dev_lock(hdev);
 103
 104         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 105         if (conn) {
 106                 if (rp->role)
 107                         conn->link_mode &= ~HCI_LM_MASTER;
 108                 else
 109                         conn->link_mode |= HCI_LM_MASTER;
 110         }
 111
 112         hci_dev_unlock(hdev);
 113 }
 114
 115 static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 116 {
 117         struct hci_rp_read_link_policy *rp = (void *) skb->data;
 118         struct hci_conn *conn;
 119
 120         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 121
 122         if (rp->status)
 123                 return;
 124
 125         hci_dev_lock(hdev);
 126
 127         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 128         if (conn)
 129                 conn->link_policy = __le16_to_cpu(rp->policy);
 130
 131         hci_dev_unlock(hdev);
 132 }
 133
 134 static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 135 {
 136         struct hci_rp_write_link_policy *rp = (void *) skb->data;
 137         struct hci_conn *conn;
 138         void *sent;
 139
 140         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 141
 142         if (rp->status)
 143                 return;
 144
 145         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
 146         if (!sent)
 147                 return;
 148
 149         hci_dev_lock(hdev);
 150
 151         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 152         if (conn)
 153                 conn->link_policy = get_unaligned_le16(sent + 2);
 154
 155         hci_dev_unlock(hdev);
 156 }
 157
 158 static void hci_cc_read_def_link_policy(struct hci_dev *hdev,
 159                                         struct sk_buff *skb)
 160 {
 161         struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
 162
 163         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 164
 165         if (rp->status)
 166                 return;
 167
 168         hdev->link_policy = __le16_to_cpu(rp->policy);
 169 }
 170
 171 static void hci_cc_write_def_link_policy(struct hci_dev *hdev,
 172                                          struct sk_buff *skb)
 173 {
 174         __u8 status = *((__u8 *) skb->data);
 175         void *sent;
 176
 177         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 178
 179         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
 180         if (!sent)
 181                 return;
 182
 183         if (!status)
 184                 hdev->link_policy = get_unaligned_le16(sent);
 185
 186         hci_req_complete(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, status);
 187 }
 188
 189 static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
 190 {
 191         __u8 status = *((__u8 *) skb->data);
 192
 193         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 194
 195         clear_bit(HCI_RESET, &hdev->flags);
 196
 197         hci_req_complete(hdev, HCI_OP_RESET, status);
 198
 199         /* Reset all non-persistent flags */
 200         hdev->dev_flags &= ~(BIT(HCI_LE_SCAN) | BIT(HCI_PENDING_CLASS) |
 201                              BIT(HCI_PERIODIC_INQ));
 202
 203         hdev->discovery.state = DISCOVERY_STOPPED;
 204 }
 205
 206 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 207 {
 208         __u8 status = *((__u8 *) skb->data);
 209         void *sent;
 210
 211         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 212
 213         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
 214         if (!sent)
 215                 return;
 216
 217         hci_dev_lock(hdev);
 218
 219         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 220                 mgmt_set_local_name_complete(hdev, sent, status);
 221         else if (!status)
 222                 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
 223
 224         hci_dev_unlock(hdev);
 225
 226         hci_req_complete(hdev, HCI_OP_WRITE_LOCAL_NAME, status);
 227 }
 228
 229 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 230 {
 231         struct hci_rp_read_local_name *rp = (void *) skb->data;
 232
 233         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 234
 235         if (rp->status)
 236                 return;
 237
 238         if (test_bit(HCI_SETUP, &hdev->dev_flags))
 239                 memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
 240 }
 241
 242 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
 243 {
 244         __u8 status = *((__u8 *) skb->data);
 245         void *sent;
 246
 247         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 248
 249         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
 250         if (!sent)
 251                 return;
 252
 253         if (!status) {
 254                 __u8 param = *((__u8 *) sent);
 255
 256                 if (param == AUTH_ENABLED)
 257                         set_bit(HCI_AUTH, &hdev->flags);
 258                 else
 259                         clear_bit(HCI_AUTH, &hdev->flags);
 260         }
 261
 262         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 263                 mgmt_auth_enable_complete(hdev, status);
 264
 265         hci_req_complete(hdev, HCI_OP_WRITE_AUTH_ENABLE, status);
 266 }
 267
 268 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
 269 {
 270         __u8 status = *((__u8 *) skb->data);
 271         void *sent;
 272
 273         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 274
 275         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
 276         if (!sent)
 277                 return;
 278
 279         if (!status) {
 280                 __u8 param = *((__u8 *) sent);
 281
 282                 if (param)
 283                         set_bit(HCI_ENCRYPT, &hdev->flags);
 284                 else
 285                         clear_bit(HCI_ENCRYPT, &hdev->flags);
 286         }
 287
 288         hci_req_complete(hdev, HCI_OP_WRITE_ENCRYPT_MODE, status);
 289 }
 290
 291 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
 292 {
 293         __u8 param, status = *((__u8 *) skb->data);
 294         int old_pscan, old_iscan;
 295         void *sent;
 296
 297         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 298
 299         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
 300         if (!sent)
 301                 return;
 302
 303         param = *((__u8 *) sent);
 304
 305         hci_dev_lock(hdev);
 306
 307         if (status) {
 308                 mgmt_write_scan_failed(hdev, param, status);
 309                 hdev->discov_timeout = 0;
 310                 goto done;
 311         }
 312
 313         old_pscan = test_and_clear_bit(HCI_PSCAN, &hdev->flags);
 314         old_iscan = test_and_clear_bit(HCI_ISCAN, &hdev->flags);
 315
 316         if (param & SCAN_INQUIRY) {
 317                 set_bit(HCI_ISCAN, &hdev->flags);
 318                 if (!old_iscan)
 319                         mgmt_discoverable(hdev, 1);
 320                 if (hdev->discov_timeout > 0) {
 321                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
 322                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
 323                                            to);
 324                 }
 325         } else if (old_iscan)
 326                 mgmt_discoverable(hdev, 0);
 327
 328         if (param & SCAN_PAGE) {
 329                 set_bit(HCI_PSCAN, &hdev->flags);
 330                 if (!old_pscan)
 331                         mgmt_connectable(hdev, 1);
 332         } else if (old_pscan)
 333                 mgmt_connectable(hdev, 0);
 334
 335 done:
 336         hci_dev_unlock(hdev);
 337         hci_req_complete(hdev, HCI_OP_WRITE_SCAN_ENABLE, status);
 338 }
 339
 340 static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 341 {
 342         struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
 343
 344         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 345
 346         if (rp->status)
 347                 return;
 348
 349         memcpy(hdev->dev_class, rp->dev_class, 3);
 350
 351         BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
 352                hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
 353 }
 354
 355 static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 356 {
 357         __u8 status = *((__u8 *) skb->data);
 358         void *sent;
 359
 360         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 361
 362         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
 363         if (!sent)
 364                 return;
 365
 366         hci_dev_lock(hdev);
 367
 368         if (status == 0)
 369                 memcpy(hdev->dev_class, sent, 3);
 370
 371         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 372                 mgmt_set_class_of_dev_complete(hdev, sent, status);
 373
 374         hci_dev_unlock(hdev);
 375 }
 376
 377 static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 378 {
 379         struct hci_rp_read_voice_setting *rp = (void *) skb->data;
 380         __u16 setting;
 381
 382         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 383
 384         if (rp->status)
 385                 return;
 386
 387         setting = __le16_to_cpu(rp->voice_setting);
 388
 389         if (hdev->voice_setting == setting)
 390                 return;
 391
 392         hdev->voice_setting = setting;
 393
 394         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 395
 396         if (hdev->notify)
 397                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 398 }
 399
 400 static void hci_cc_write_voice_setting(struct hci_dev *hdev,
 401                                        struct sk_buff *skb)
 402 {
 403         __u8 status = *((__u8 *) skb->data);
 404         __u16 setting;
 405         void *sent;
 406
 407         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 408
 409         if (status)
 410                 return;
 411
 412         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
 413         if (!sent)
 414                 return;
 415
 416         setting = get_unaligned_le16(sent);
 417
 418         if (hdev->voice_setting == setting)
 419                 return;
 420
 421         hdev->voice_setting = setting;
 422
 423         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 424
 425         if (hdev->notify)
 426                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 427 }
 428
 429 static void hci_cc_host_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 430 {
 431         __u8 status = *((__u8 *) skb->data);
 432
 433         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 434
 435         hci_req_complete(hdev, HCI_OP_HOST_BUFFER_SIZE, status);
 436 }
 437
 438 static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 439 {
 440         __u8 status = *((__u8 *) skb->data);
 441         void *sent;
 442
 443         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 444
 445         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
 446         if (!sent)
 447                 return;
 448
 449         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 450                 mgmt_ssp_enable_complete(hdev, *((u8 *) sent), status);
 451         else if (!status) {
 452                 if (*((u8 *) sent))
 453                         set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
 454                 else
 455                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
 456         }
 457 }
 458
 459 static u8 hci_get_inquiry_mode(struct hci_dev *hdev)
 460 {
 461         if (hdev->features[6] & LMP_EXT_INQ)
 462                 return 2;
 463
 464         if (hdev->features[3] & LMP_RSSI_INQ)
 465                 return 1;
 466
 467         if (hdev->manufacturer == 11 && hdev->hci_rev == 0x00 &&
 468             hdev->lmp_subver == 0x0757)
 469                 return 1;
 470
 471         if (hdev->manufacturer == 15) {
 472                 if (hdev->hci_rev == 0x03 && hdev->lmp_subver == 0x6963)
 473                         return 1;
 474                 if (hdev->hci_rev == 0x09 && hdev->lmp_subver == 0x6963)
 475                         return 1;
 476                 if (hdev->hci_rev == 0x00 && hdev->lmp_subver == 0x6965)
 477                         return 1;
 478         }
 479
 480         if (hdev->manufacturer == 31 && hdev->hci_rev == 0x2005 &&
 481             hdev->lmp_subver == 0x1805)
 482                 return 1;
 483
 484         return 0;
 485 }
 486
 487 static void hci_setup_inquiry_mode(struct hci_dev *hdev)
 488 {
 489         u8 mode;
 490
 491         mode = hci_get_inquiry_mode(hdev);
 492
 493         hci_send_cmd(hdev, HCI_OP_WRITE_INQUIRY_MODE, 1, &mode);
 494 }
 495
 496 static void hci_setup_event_mask(struct hci_dev *hdev)
 497 {
 498         /* The second byte is 0xff instead of 0x9f (two reserved bits
 499          * disabled) since a Broadcom 1.2 dongle doesn't respond to the
 500          * command otherwise */
 501         u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };
 502
 503         /* CSR 1.1 dongles does not accept any bitfield so don't try to set
 504          * any event mask for pre 1.2 devices */
 505         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
 506                 return;
 507
 508         events[4] |= 0x01; /* Flow Specification Complete */
 509         events[4] |= 0x02; /* Inquiry Result with RSSI */
 510         events[4] |= 0x04; /* Read Remote Extended Features Complete */
 511         events[5] |= 0x08; /* Synchronous Connection Complete */
 512         events[5] |= 0x10; /* Synchronous Connection Changed */
 513
 514         if (hdev->features[3] & LMP_RSSI_INQ)
 515                 events[4] |= 0x02; /* Inquiry Result with RSSI */
 516
 517         if (lmp_sniffsubr_capable(hdev))
 518                 events[5] |= 0x20; /* Sniff Subrating */
 519
 520         if (hdev->features[5] & LMP_PAUSE_ENC)
 521                 events[5] |= 0x80; /* Encryption Key Refresh Complete */
 522
 523         if (hdev->features[6] & LMP_EXT_INQ)
 524                 events[5] |= 0x40; /* Extended Inquiry Result */
 525
 526         if (lmp_no_flush_capable(hdev))
 527                 events[7] |= 0x01; /* Enhanced Flush Complete */
 528
 529         if (hdev->features[7] & LMP_LSTO)
 530                 events[6] |= 0x80; /* Link Supervision Timeout Changed */
 531
 532         if (lmp_ssp_capable(hdev)) {
 533                 events[6] |= 0x01;      /* IO Capability Request */
 534                 events[6] |= 0x02;      /* IO Capability Response */
 535                 events[6] |= 0x04;      /* User Confirmation Request */
 536                 events[6] |= 0x08;      /* User Passkey Request */
 537                 events[6] |= 0x10;      /* Remote OOB Data Request */
 538                 events[6] |= 0x20;      /* Simple Pairing Complete */
 539                 events[7] |= 0x04;      /* User Passkey Notification */
 540                 events[7] |= 0x08;      /* Keypress Notification */
 541                 events[7] |= 0x10;      /* Remote Host Supported
 542                                          * Features Notification */
 543         }
 544
 545         if (lmp_le_capable(hdev))
 546                 events[7] |= 0x20;      /* LE Meta-Event */
 547
 548         hci_send_cmd(hdev, HCI_OP_SET_EVENT_MASK, sizeof(events), events);
 549 }
 550
 551 static void hci_setup(struct hci_dev *hdev)
 552 {
 553         if (hdev->dev_type != HCI_BREDR)
 554                 return;
 555
 556         hci_setup_event_mask(hdev);
 557
 558         if (hdev->hci_ver > BLUETOOTH_VER_1_1)
 559                 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
 560
 561         if (lmp_ssp_capable(hdev)) {
 562                 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
 563                         u8 mode = 0x01;
 564                         hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE,
 565                                      sizeof(mode), &mode);
 566                 } else {
 567                         struct hci_cp_write_eir cp;
 568
 569                         memset(hdev->eir, 0, sizeof(hdev->eir));
 570                         memset(&cp, 0, sizeof(cp));
 571
 572                         hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 573                 }
 574         }
 575
 576         if (hdev->features[3] & LMP_RSSI_INQ)
 577                 hci_setup_inquiry_mode(hdev);
 578
 579         if (hdev->features[7] & LMP_INQ_TX_PWR)
 580                 hci_send_cmd(hdev, HCI_OP_READ_INQ_RSP_TX_POWER, 0, NULL);
 581
 582         if (hdev->features[7] & LMP_EXTFEATURES) {
 583                 struct hci_cp_read_local_ext_features cp;
 584
 585                 cp.page = 0x01;
 586                 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES, sizeof(cp),
 587                              &cp);
 588         }
 589
 590         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags)) {
 591                 u8 enable = 1;
 592                 hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(enable),
 593                              &enable);
 594         }
 595 }
 596
 597 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
 598 {
 599         struct hci_rp_read_local_version *rp = (void *) skb->data;
 600
 601         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 602
 603         if (rp->status)
 604                 goto done;
 605
 606         hdev->hci_ver = rp->hci_ver;
 607         hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
 608         hdev->lmp_ver = rp->lmp_ver;
 609         hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
 610         hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
 611
 612         BT_DBG("%s manufacturer 0x%4.4x hci ver %d:%d", hdev->name,
 613                hdev->manufacturer, hdev->hci_ver, hdev->hci_rev);
 614
 615         if (test_bit(HCI_INIT, &hdev->flags))
 616                 hci_setup(hdev);
 617
 618 done:
 619         hci_req_complete(hdev, HCI_OP_READ_LOCAL_VERSION, rp->status);
 620 }
 621
 622 static void hci_setup_link_policy(struct hci_dev *hdev)
 623 {
 624         struct hci_cp_write_def_link_policy cp;
 625         u16 link_policy = 0;
 626
 627         if (lmp_rswitch_capable(hdev))
 628                 link_policy |= HCI_LP_RSWITCH;
 629         if (hdev->features[0] & LMP_HOLD)
 630                 link_policy |= HCI_LP_HOLD;
 631         if (lmp_sniff_capable(hdev))
 632                 link_policy |= HCI_LP_SNIFF;
 633         if (hdev->features[1] & LMP_PARK)
 634                 link_policy |= HCI_LP_PARK;
 635
 636         cp.policy = cpu_to_le16(link_policy);
 637         hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, sizeof(cp), &cp);
 638 }
 639
 640 static void hci_cc_read_local_commands(struct hci_dev *hdev,
 641                                        struct sk_buff *skb)
 642 {
 643         struct hci_rp_read_local_commands *rp = (void *) skb->data;
 644
 645         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 646
 647         if (rp->status)
 648                 goto done;
 649
 650         memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 651
 652         if (test_bit(HCI_INIT, &hdev->flags) && (hdev->commands[5] & 0x10))
 653                 hci_setup_link_policy(hdev);
 654
 655 done:
 656         hci_req_complete(hdev, HCI_OP_READ_LOCAL_COMMANDS, rp->status);
 657 }
 658
 659 static void hci_cc_read_local_features(struct hci_dev *hdev,
 660                                        struct sk_buff *skb)
 661 {
 662         struct hci_rp_read_local_features *rp = (void *) skb->data;
 663
 664         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 665
 666         if (rp->status)
 667                 return;
 668
 669         memcpy(hdev->features, rp->features, 8);
 670
 671         /* Adjust default settings according to features
 672          * supported by device. */
 673
 674         if (hdev->features[0] & LMP_3SLOT)
 675                 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 676
 677         if (hdev->features[0] & LMP_5SLOT)
 678                 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 679
 680         if (hdev->features[1] & LMP_HV2) {
 681                 hdev->pkt_type  |= (HCI_HV2);
 682                 hdev->esco_type |= (ESCO_HV2);
 683         }
 684
 685         if (hdev->features[1] & LMP_HV3) {
 686                 hdev->pkt_type  |= (HCI_HV3);
 687                 hdev->esco_type |= (ESCO_HV3);
 688         }
 689
 690         if (lmp_esco_capable(hdev))
 691                 hdev->esco_type |= (ESCO_EV3);
 692
 693         if (hdev->features[4] & LMP_EV4)
 694                 hdev->esco_type |= (ESCO_EV4);
 695
 696         if (hdev->features[4] & LMP_EV5)
 697                 hdev->esco_type |= (ESCO_EV5);
 698
 699         if (hdev->features[5] & LMP_EDR_ESCO_2M)
 700                 hdev->esco_type |= (ESCO_2EV3);
 701
 702         if (hdev->features[5] & LMP_EDR_ESCO_3M)
 703                 hdev->esco_type |= (ESCO_3EV3);
 704
 705         if (hdev->features[5] & LMP_EDR_3S_ESCO)
 706                 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
 707
 708         BT_DBG("%s features 0x%.2x%.2x%.2x%.2x%.2x%.2x%.2x%.2x", hdev->name,
 709                hdev->features[0], hdev->features[1],
 710                hdev->features[2], hdev->features[3],
 711                hdev->features[4], hdev->features[5],
 712                hdev->features[6], hdev->features[7]);
 713 }
 714
 715 static void hci_set_le_support(struct hci_dev *hdev)
 716 {
 717         struct hci_cp_write_le_host_supported cp;
 718
 719         memset(&cp, 0, sizeof(cp));
 720
 721         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
 722                 cp.le = 1;
 723                 cp.simul = !!(hdev->features[6] & LMP_SIMUL_LE_BR);
 724         }
 725
 726         if (cp.le != !!(hdev->host_features[0] & LMP_HOST_LE))
 727                 hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(cp),
 728                              &cp);
 729 }
 730
 731 static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
 732                                            struct sk_buff *skb)
 733 {
 734         struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
 735
 736         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 737
 738         if (rp->status)
 739                 goto done;
 740
 741         switch (rp->page) {
 742         case 0:
 743                 memcpy(hdev->features, rp->features, 8);
 744                 break;
 745         case 1:
 746                 memcpy(hdev->host_features, rp->features, 8);
 747                 break;
 748         }
 749
 750         if (test_bit(HCI_INIT, &hdev->flags) && lmp_le_capable(hdev))
 751                 hci_set_le_support(hdev);
 752
 753 done:
 754         hci_req_complete(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES, rp->status);
 755 }
 756
 757 static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
 758                                           struct sk_buff *skb)
 759 {
 760         struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;
 761
 762         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 763
 764         if (rp->status)
 765                 return;
 766
 767         hdev->flow_ctl_mode = rp->mode;
 768
 769         hci_req_complete(hdev, HCI_OP_READ_FLOW_CONTROL_MODE, rp->status);
 770 }
 771
 772 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 773 {
 774         struct hci_rp_read_buffer_size *rp = (void *) skb->data;
 775
 776         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 777
 778         if (rp->status)
 779                 return;
 780
 781         hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
 782         hdev->sco_mtu  = rp->sco_mtu;
 783         hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
 784         hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
 785
 786         if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
 787                 hdev->sco_mtu  = 64;
 788                 hdev->sco_pkts = 8;
 789         }
 790
 791         hdev->acl_cnt = hdev->acl_pkts;
 792         hdev->sco_cnt = hdev->sco_pkts;
 793
 794         BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
 795                hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
 796 }
 797
 798 static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
 799 {
 800         struct hci_rp_read_bd_addr *rp = (void *) skb->data;
 801
 802         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 803
 804         if (!rp->status)
 805                 bacpy(&hdev->bdaddr, &rp->bdaddr);
 806
 807         hci_req_complete(hdev, HCI_OP_READ_BD_ADDR, rp->status);
 808 }
 809
 810 static void hci_cc_read_data_block_size(struct hci_dev *hdev,
 811                                         struct sk_buff *skb)
 812 {
 813         struct hci_rp_read_data_block_size *rp = (void *) skb->data;
 814
 815         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 816
 817         if (rp->status)
 818                 return;
 819
 820         hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
 821         hdev->block_len = __le16_to_cpu(rp->block_len);
 822         hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
 823
 824         hdev->block_cnt = hdev->num_blocks;
 825
 826         BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
 827                hdev->block_cnt, hdev->block_len);
 828
 829         hci_req_complete(hdev, HCI_OP_READ_DATA_BLOCK_SIZE, rp->status);
 830 }
 831
 832 static void hci_cc_write_ca_timeout(struct hci_dev *hdev, struct sk_buff *skb)
 833 {
 834         __u8 status = *((__u8 *) skb->data);
 835
 836         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 837
 838         hci_req_complete(hdev, HCI_OP_WRITE_CA_TIMEOUT, status);
 839 }
 840
 841 static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
 842                                        struct sk_buff *skb)
 843 {
 844         struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
 845
 846         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 847
 848         if (rp->status)
 849                 return;
 850
 851         hdev->amp_status = rp->amp_status;
 852         hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
 853         hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
 854         hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
 855         hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
 856         hdev->amp_type = rp->amp_type;
 857         hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
 858         hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
 859         hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
 860         hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
 861
 862         hci_req_complete(hdev, HCI_OP_READ_LOCAL_AMP_INFO, rp->status);
 863 }
 864
 865 static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
 866                                           struct sk_buff *skb)
 867 {
 868         __u8 status = *((__u8 *) skb->data);
 869
 870         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 871
 872         hci_req_complete(hdev, HCI_OP_DELETE_STORED_LINK_KEY, status);
 873 }
 874
 875 static void hci_cc_set_event_mask(struct hci_dev *hdev, struct sk_buff *skb)
 876 {
 877         __u8 status = *((__u8 *) skb->data);
 878
 879         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 880
 881         hci_req_complete(hdev, HCI_OP_SET_EVENT_MASK, status);
 882 }
 883
 884 static void hci_cc_write_inquiry_mode(struct hci_dev *hdev,
 885                                       struct sk_buff *skb)
 886 {
 887         __u8 status = *((__u8 *) skb->data);
 888
 889         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 890
 891         hci_req_complete(hdev, HCI_OP_WRITE_INQUIRY_MODE, status);
 892 }
 893
 894 static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
 895                                          struct sk_buff *skb)
 896 {
 897         struct hci_rp_read_inq_rsp_tx_power *rp = (void *) skb->data;
 898
 899         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 900
 901         if (!rp->status)
 902                 hdev->inq_tx_power = rp->tx_power;
 903
 904         hci_req_complete(hdev, HCI_OP_READ_INQ_RSP_TX_POWER, rp->status);
 905 }
 906
 907 static void hci_cc_set_event_flt(struct hci_dev *hdev, struct sk_buff *skb)
 908 {
 909         __u8 status = *((__u8 *) skb->data);
 910
 911         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 912
 913         hci_req_complete(hdev, HCI_OP_SET_EVENT_FLT, status);
 914 }
 915
 916 static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
 917 {
 918         struct hci_rp_pin_code_reply *rp = (void *) skb->data;
 919         struct hci_cp_pin_code_reply *cp;
 920         struct hci_conn *conn;
 921
 922         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 923
 924         hci_dev_lock(hdev);
 925
 926         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 927                 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
 928
 929         if (rp->status)
 930                 goto unlock;
 931
 932         cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
 933         if (!cp)
 934                 goto unlock;
 935
 936         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 937         if (conn)
 938                 conn->pin_length = cp->pin_len;
 939
 940 unlock:
 941         hci_dev_unlock(hdev);
 942 }
 943
 944 static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
 945 {
 946         struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
 947
 948         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 949
 950         hci_dev_lock(hdev);
 951
 952         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 953                 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
 954                                                  rp->status);
 955
 956         hci_dev_unlock(hdev);
 957 }
 958
 959 static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
 960                                        struct sk_buff *skb)
 961 {
 962         struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
 963
 964         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 965
 966         if (rp->status)
 967                 return;
 968
 969         hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
 970         hdev->le_pkts = rp->le_max_pkt;
 971
 972         hdev->le_cnt = hdev->le_pkts;
 973
 974         BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
 975
 976         hci_req_complete(hdev, HCI_OP_LE_READ_BUFFER_SIZE, rp->status);
 977 }
 978
 979 static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
 980 {
 981         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 982
 983         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 984
 985         hci_dev_lock(hdev);
 986
 987         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 988                 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,
 989                                                  rp->status);
 990
 991         hci_dev_unlock(hdev);
 992 }
 993
 994 static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
 995                                           struct sk_buff *skb)
 996 {
 997         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 998
 999         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1000
1001         hci_dev_lock(hdev);
1002
1003         if (test_bit(HCI_MGMT, &hdev->dev_flags))
1004                 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
1005                                                      ACL_LINK, 0, rp->status);
1006
1007         hci_dev_unlock(hdev);
1008 }
1009
1010 static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
1011 {
1012         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1013
1014         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1015
1016         hci_dev_lock(hdev);
1017
1018         if (test_bit(HCI_MGMT, &hdev->dev_flags))
1019                 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
1020                                                  0, rp->status);
1021
1022         hci_dev_unlock(hdev);
1023 }
1024
1025 static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
1026                                           struct sk_buff *skb)
1027 {
1028         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1029
1030         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1031
1032         hci_dev_lock(hdev);
1033
1034         if (test_bit(HCI_MGMT, &hdev->dev_flags))
1035                 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
1036                                                      ACL_LINK, 0, rp->status);
1037
1038         hci_dev_unlock(hdev);
1039 }
1040
1041 static void hci_cc_read_local_oob_data_reply(struct hci_dev *hdev,
1042                                              struct sk_buff *skb)
1043 {
1044         struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
1045
1046         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1047
1048         hci_dev_lock(hdev);
1049         mgmt_read_local_oob_data_reply_complete(hdev, rp->hash,
1050                                                 rp->randomizer, rp->status);
1051         hci_dev_unlock(hdev);
1052 }
1053
1054 static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
1055 {
1056         __u8 status = *((__u8 *) skb->data);
1057
1058         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1059
1060         hci_req_complete(hdev, HCI_OP_LE_SET_SCAN_PARAM, status);
1061
1062         if (status) {
1063                 hci_dev_lock(hdev);
1064                 mgmt_start_discovery_failed(hdev, status);
1065                 hci_dev_unlock(hdev);
1066                 return;
1067         }
1068 }
1069
1070 static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
1071                                       struct sk_buff *skb)
1072 {
1073         struct hci_cp_le_set_scan_enable *cp;
1074         __u8 status = *((__u8 *) skb->data);
1075
1076         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1077
1078         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
1079         if (!cp)
1080                 return;
1081
1082         switch (cp->enable) {
1083         case LE_SCANNING_ENABLED:
1084                 hci_req_complete(hdev, HCI_OP_LE_SET_SCAN_ENABLE, status);
1085
1086                 if (status) {
1087                         hci_dev_lock(hdev);
1088                         mgmt_start_discovery_failed(hdev, status);
1089                         hci_dev_unlock(hdev);
1090                         return;
1091                 }
1092
1093                 set_bit(HCI_LE_SCAN, &hdev->dev_flags);
1094
1095                 hci_dev_lock(hdev);
1096                 hci_discovery_set_state(hdev, DISCOVERY_FINDING);
1097                 hci_dev_unlock(hdev);
1098                 break;
1099
1100         case LE_SCANNING_DISABLED:
1101                 if (status) {
1102                         hci_dev_lock(hdev);
1103                         mgmt_stop_discovery_failed(hdev, status);
1104                         hci_dev_unlock(hdev);
1105                         return;
1106                 }
1107
1108                 clear_bit(HCI_LE_SCAN, &hdev->dev_flags);
1109
1110                 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
1111                     hdev->discovery.state == DISCOVERY_FINDING) {
1112                         mgmt_interleaved_discovery(hdev);
1113                 } else {
1114                         hci_dev_lock(hdev);
1115                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1116                         hci_dev_unlock(hdev);
1117                 }
1118
1119                 break;
1120
1121         default:
1122                 BT_ERR("Used reserved LE_Scan_Enable param %d", cp->enable);
1123                 break;
1124         }
1125 }
1126
1127 static void hci_cc_le_ltk_reply(struct hci_dev *hdev, struct sk_buff *skb)
1128 {
1129         struct hci_rp_le_ltk_reply *rp = (void *) skb->data;
1130
1131         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1132
1133         if (rp->status)
1134                 return;
1135
1136         hci_req_complete(hdev, HCI_OP_LE_LTK_REPLY, rp->status);
1137 }
1138
1139 static void hci_cc_le_ltk_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
1140 {
1141         struct hci_rp_le_ltk_neg_reply *rp = (void *) skb->data;
1142
1143         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1144
1145         if (rp->status)
1146                 return;
1147
1148         hci_req_complete(hdev, HCI_OP_LE_LTK_NEG_REPLY, rp->status);
1149 }
1150
1151 static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
1152                                            struct sk_buff *skb)
1153 {
1154         struct hci_cp_write_le_host_supported *sent;
1155         __u8 status = *((__u8 *) skb->data);
1156
1157         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1158
1159         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
1160         if (!sent)
1161                 return;
1162
1163         if (!status) {
1164                 if (sent->le)
1165                         hdev->host_features[0] |= LMP_HOST_LE;
1166                 else
1167                         hdev->host_features[0] &= ~LMP_HOST_LE;
1168         }
1169
1170         if (test_bit(HCI_MGMT, &hdev->dev_flags) &&
1171             !test_bit(HCI_INIT, &hdev->flags))
1172                 mgmt_le_enable_complete(hdev, sent->le, status);
1173
1174         hci_req_complete(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, status);
1175 }
1176
1177 static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
1178 {
1179         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1180
1181         if (status) {
1182                 hci_req_complete(hdev, HCI_OP_INQUIRY, status);
1183                 hci_conn_check_pending(hdev);
1184                 hci_dev_lock(hdev);
1185                 if (test_bit(HCI_MGMT, &hdev->dev_flags))
1186                         mgmt_start_discovery_failed(hdev, status);
1187                 hci_dev_unlock(hdev);
1188                 return;
1189         }
1190
1191         set_bit(HCI_INQUIRY, &hdev->flags);
1192
1193         hci_dev_lock(hdev);
1194         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
1195         hci_dev_unlock(hdev);
1196 }
1197
1198 static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
1199 {
1200         struct hci_cp_create_conn *cp;
1201         struct hci_conn *conn;
1202
1203         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1204
1205         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
1206         if (!cp)
1207                 return;
1208
1209         hci_dev_lock(hdev);
1210
1211         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1212
1213         BT_DBG("%s bdaddr %s hcon %p", hdev->name, batostr(&cp->bdaddr), conn);
1214
1215         if (status) {
1216                 if (conn && conn->state == BT_CONNECT) {
1217                         if (status != 0x0c || conn->attempt > 2) {
1218                                 conn->state = BT_CLOSED;
1219                                 hci_proto_connect_cfm(conn, status);
1220                                 hci_conn_del(conn);
1221                         } else
1222                                 conn->state = BT_CONNECT2;
1223                 }
1224         } else {
1225                 if (!conn) {
1226                         conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr);
1227                         if (conn) {
1228                                 conn->out = true;
1229                                 conn->link_mode |= HCI_LM_MASTER;
1230                         } else
1231                                 BT_ERR("No memory for new connection");
1232                 }
1233         }
1234
1235         hci_dev_unlock(hdev);
1236 }
1237
1238 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
1239 {
1240         struct hci_cp_add_sco *cp;
1241         struct hci_conn *acl, *sco;
1242         __u16 handle;
1243
1244         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1245
1246         if (!status)
1247                 return;
1248
1249         cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
1250         if (!cp)
1251                 return;
1252
1253         handle = __le16_to_cpu(cp->handle);
1254
1255         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1256
1257         hci_dev_lock(hdev);
1258
1259         acl = hci_conn_hash_lookup_handle(hdev, handle);
1260         if (acl) {
1261                 sco = acl->link;
1262                 if (sco) {
1263                         sco->state = BT_CLOSED;
1264
1265                         hci_proto_connect_cfm(sco, status);
1266                         hci_conn_del(sco);
1267                 }
1268         }
1269
1270         hci_dev_unlock(hdev);
1271 }
1272
1273 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
1274 {
1275         struct hci_cp_auth_requested *cp;
1276         struct hci_conn *conn;
1277
1278         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1279
1280         if (!status)
1281                 return;
1282
1283         cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
1284         if (!cp)
1285                 return;
1286
1287         hci_dev_lock(hdev);
1288
1289         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1290         if (conn) {
1291                 if (conn->state == BT_CONFIG) {
1292                         hci_proto_connect_cfm(conn, status);
1293                         hci_conn_put(conn);
1294                 }
1295         }
1296
1297         hci_dev_unlock(hdev);
1298 }
1299
1300 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
1301 {
1302         struct hci_cp_set_conn_encrypt *cp;
1303         struct hci_conn *conn;
1304
1305         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1306
1307         if (!status)
1308                 return;
1309
1310         cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
1311         if (!cp)
1312                 return;
1313
1314         hci_dev_lock(hdev);
1315
1316         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1317         if (conn) {
1318                 if (conn->state == BT_CONFIG) {
1319                         hci_proto_connect_cfm(conn, status);
1320                         hci_conn_put(conn);
1321                 }
1322         }
1323
1324         hci_dev_unlock(hdev);
1325 }
1326
1327 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
1328                                     struct hci_conn *conn)
1329 {
1330         if (conn->state != BT_CONFIG || !conn->out)
1331                 return 0;
1332
1333         if (conn->pending_sec_level == BT_SECURITY_SDP)
1334                 return 0;
1335
1336         /* Only request authentication for SSP connections or non-SSP
1337          * devices with sec_level HIGH or if MITM protection is requested */
1338         if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
1339             conn->pending_sec_level != BT_SECURITY_HIGH)
1340                 return 0;
1341
1342         return 1;
1343 }
1344
1345 static int hci_resolve_name(struct hci_dev *hdev,
1346                                    struct inquiry_entry *e)
1347 {
1348         struct hci_cp_remote_name_req cp;
1349
1350         memset(&cp, 0, sizeof(cp));
1351
1352         bacpy(&cp.bdaddr, &e->data.bdaddr);
1353         cp.pscan_rep_mode = e->data.pscan_rep_mode;
1354         cp.pscan_mode = e->data.pscan_mode;
1355         cp.clock_offset = e->data.clock_offset;
1356
1357         return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1358 }
1359
1360 static bool hci_resolve_next_name(struct hci_dev *hdev)
1361 {
1362         struct discovery_state *discov = &hdev->discovery;
1363         struct inquiry_entry *e;
1364
1365         if (list_empty(&discov->resolve))
1366                 return false;
1367
1368         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
1369         if (!e)
1370                 return false;
1371
1372         if (hci_resolve_name(hdev, e) == 0) {
1373                 e->name_state = NAME_PENDING;
1374                 return true;
1375         }
1376
1377         return false;
1378 }
1379
1380 static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
1381                                    bdaddr_t *bdaddr, u8 *name, u8 name_len)
1382 {
1383         struct discovery_state *discov = &hdev->discovery;
1384         struct inquiry_entry *e;
1385
1386         if (conn && !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
1387                 mgmt_device_connected(hdev, bdaddr, ACL_LINK, 0x00, 0, name,
1388                                       name_len, conn->dev_class);
1389
1390         if (discov->state == DISCOVERY_STOPPED)
1391                 return;
1392
1393         if (discov->state == DISCOVERY_STOPPING)
1394                 goto discov_complete;
1395
1396         if (discov->state != DISCOVERY_RESOLVING)
1397                 return;
1398
1399         e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
1400         /* If the device was not found in a list of found devices names of which
1401          * are pending. there is no need to continue resolving a next name as it
1402          * will be done upon receiving another Remote Name Request Complete
1403          * Event */
1404         if (!e)
1405                 return;
1406
1407         list_del(&e->list);
1408         if (name) {
1409                 e->name_state = NAME_KNOWN;
1410                 mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
1411                                  e->data.rssi, name, name_len);
1412         } else {
1413                 e->name_state = NAME_NOT_KNOWN;
1414         }
1415
1416         if (hci_resolve_next_name(hdev))
1417                 return;
1418
1419 discov_complete:
1420         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1421 }
1422
1423 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
1424 {
1425         struct hci_cp_remote_name_req *cp;
1426         struct hci_conn *conn;
1427
1428         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1429
1430         /* If successful wait for the name req complete event before
1431          * checking for the need to do authentication */
1432         if (!status)
1433                 return;
1434
1435         cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
1436         if (!cp)
1437                 return;
1438
1439         hci_dev_lock(hdev);
1440
1441         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1442
1443         if (test_bit(HCI_MGMT, &hdev->dev_flags))
1444                 hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
1445
1446         if (!conn)
1447                 goto unlock;
1448
1449         if (!hci_outgoing_auth_needed(hdev, conn))
1450                 goto unlock;
1451
1452         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
1453                 struct hci_cp_auth_requested cp;
1454                 cp.handle = __cpu_to_le16(conn->handle);
1455                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
1456         }
1457
1458 unlock:
1459         hci_dev_unlock(hdev);
1460 }
1461
1462 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
1463 {
1464         struct hci_cp_read_remote_features *cp;
1465         struct hci_conn *conn;
1466
1467         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1468
1469         if (!status)
1470                 return;
1471
1472         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
1473         if (!cp)
1474                 return;
1475
1476         hci_dev_lock(hdev);
1477
1478         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1479         if (conn) {
1480                 if (conn->state == BT_CONFIG) {
1481                         hci_proto_connect_cfm(conn, status);
1482                         hci_conn_put(conn);
1483                 }
1484         }
1485
1486         hci_dev_unlock(hdev);
1487 }
1488
1489 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
1490 {
1491         struct hci_cp_read_remote_ext_features *cp;
1492         struct hci_conn *conn;
1493
1494         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1495
1496         if (!status)
1497                 return;
1498
1499         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
1500         if (!cp)
1501                 return;
1502
1503         hci_dev_lock(hdev);
1504
1505         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1506         if (conn) {
1507                 if (conn->state == BT_CONFIG) {
1508                         hci_proto_connect_cfm(conn, status);
1509                         hci_conn_put(conn);
1510                 }
1511         }
1512
1513         hci_dev_unlock(hdev);
1514 }
1515
1516 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
1517 {
1518         struct hci_cp_setup_sync_conn *cp;
1519         struct hci_conn *acl, *sco;
1520         __u16 handle;
1521
1522         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1523
1524         if (!status)
1525                 return;
1526
1527         cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
1528         if (!cp)
1529                 return;
1530
1531         handle = __le16_to_cpu(cp->handle);
1532
1533         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1534
1535         hci_dev_lock(hdev);
1536
1537         acl = hci_conn_hash_lookup_handle(hdev, handle);
1538         if (acl) {
1539                 sco = acl->link;
1540                 if (sco) {
1541                         sco->state = BT_CLOSED;
1542
1543                         hci_proto_connect_cfm(sco, status);
1544                         hci_conn_del(sco);
1545                 }
1546         }
1547
1548         hci_dev_unlock(hdev);
1549 }
1550
1551 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
1552 {
1553         struct hci_cp_sniff_mode *cp;
1554         struct hci_conn *conn;
1555
1556         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1557
1558         if (!status)
1559                 return;
1560
1561         cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
1562         if (!cp)
1563                 return;
1564
1565         hci_dev_lock(hdev);
1566
1567         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1568         if (conn) {
1569                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1570
1571                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
1572                         hci_sco_setup(conn, status);
1573         }
1574
1575         hci_dev_unlock(hdev);
1576 }
1577
1578 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
1579 {
1580         struct hci_cp_exit_sniff_mode *cp;
1581         struct hci_conn *conn;
1582
1583         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1584
1585         if (!status)
1586                 return;
1587
1588         cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
1589         if (!cp)
1590                 return;
1591
1592         hci_dev_lock(hdev);
1593
1594         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1595         if (conn) {
1596                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1597
1598                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
1599                         hci_sco_setup(conn, status);
1600         }
1601
1602         hci_dev_unlock(hdev);
1603 }
1604
1605 static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
1606 {
1607         struct hci_cp_disconnect *cp;
1608         struct hci_conn *conn;
1609
1610         if (!status)
1611                 return;
1612
1613         cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
1614         if (!cp)
1615                 return;
1616
1617         hci_dev_lock(hdev);
1618
1619         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1620         if (conn)
1621                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
1622                                        conn->dst_type, status);
1623
1624         hci_dev_unlock(hdev);
1625 }
1626
1627 static void hci_cs_le_create_conn(struct hci_dev *hdev, __u8 status)
1628 {
1629         struct hci_conn *conn;
1630
1631         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1632
1633         if (status) {
1634                 hci_dev_lock(hdev);
1635
1636                 conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
1637                 if (!conn) {
1638                         hci_dev_unlock(hdev);
1639                         return;
1640                 }
1641
1642                 BT_DBG("%s bdaddr %s conn %p", hdev->name, batostr(&conn->dst),
1643                        conn);
1644
1645                 conn->state = BT_CLOSED;
1646                 mgmt_connect_failed(hdev, &conn->dst, conn->type,
1647                                     conn->dst_type, status);
1648                 hci_proto_connect_cfm(conn, status);
1649                 hci_conn_del(conn);
1650
1651                 hci_dev_unlock(hdev);
1652         }
1653 }
1654
1655 static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
1656 {
1657         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1658 }
1659
1660 static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1661 {
1662         __u8 status = *((__u8 *) skb->data);
1663         struct discovery_state *discov = &hdev->discovery;
1664         struct inquiry_entry *e;
1665
1666         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1667
1668         hci_req_complete(hdev, HCI_OP_INQUIRY, status);
1669
1670         hci_conn_check_pending(hdev);
1671
1672         if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
1673                 return;
1674
1675         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
1676                 return;
1677
1678         hci_dev_lock(hdev);
1679
1680         if (discov->state != DISCOVERY_FINDING)
1681                 goto unlock;
1682
1683         if (list_empty(&discov->resolve)) {
1684                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1685                 goto unlock;
1686         }
1687
1688         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
1689         if (e && hci_resolve_name(hdev, e) == 0) {
1690                 e->name_state = NAME_PENDING;
1691                 hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
1692         } else {
1693                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1694         }
1695
1696 unlock:
1697         hci_dev_unlock(hdev);
1698 }
1699
1700 static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
1701 {
1702         struct inquiry_data data;
1703         struct inquiry_info *info = (void *) (skb->data + 1);
1704         int num_rsp = *((__u8 *) skb->data);
1705
1706         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
1707
1708         if (!num_rsp)
1709                 return;
1710
1711         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
1712                 return;
1713
1714         hci_dev_lock(hdev);
1715
1716         for (; num_rsp; num_rsp--, info++) {
1717                 bool name_known, ssp;
1718
1719                 bacpy(&data.bdaddr, &info->bdaddr);
1720                 data.pscan_rep_mode     = info->pscan_rep_mode;
1721                 data.pscan_period_mode  = info->pscan_period_mode;
1722                 data.pscan_mode         = info->pscan_mode;
1723                 memcpy(data.dev_class, info->dev_class, 3);
1724                 data.clock_offset       = info->clock_offset;
1725                 data.rssi               = 0x00;
1726                 data.ssp_mode           = 0x00;
1727
1728                 name_known = hci_inquiry_cache_update(hdev, &data, false, &ssp);
1729                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
1730                                   info->dev_class, 0, !name_known, ssp, NULL,
1731                                   0);
1732         }
1733
1734         hci_dev_unlock(hdev);
1735 }
1736
1737 static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1738 {
1739         struct hci_ev_conn_complete *ev = (void *) skb->data;
1740         struct hci_conn *conn;
1741
1742         BT_DBG("%s", hdev->name);
1743
1744         hci_dev_lock(hdev);
1745
1746         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
1747         if (!conn) {
1748                 if (ev->link_type != SCO_LINK)
1749                         goto unlock;
1750
1751                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
1752                 if (!conn)
1753                         goto unlock;
1754
1755                 conn->type = SCO_LINK;
1756         }
1757
1758         if (!ev->status) {
1759                 conn->handle = __le16_to_cpu(ev->handle);
1760
1761                 if (conn->type == ACL_LINK) {
1762                         conn->state = BT_CONFIG;
1763                         hci_conn_hold(conn);
1764
1765                         if (!conn->out && !hci_conn_ssp_enabled(conn) &&
1766                             !hci_find_link_key(hdev, &ev->bdaddr))
1767                                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
1768                         else
1769                                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
1770                 } else
1771                         conn->state = BT_CONNECTED;
1772
1773                 hci_conn_hold_device(conn);
1774                 hci_conn_add_sysfs(conn);
1775
1776                 if (test_bit(HCI_AUTH, &hdev->flags))
1777                         conn->link_mode |= HCI_LM_AUTH;
1778
1779                 if (test_bit(HCI_ENCRYPT, &hdev->flags))
1780                         conn->link_mode |= HCI_LM_ENCRYPT;
1781
1782                 /* Get remote features */
1783                 if (conn->type == ACL_LINK) {
1784                         struct hci_cp_read_remote_features cp;
1785                         cp.handle = ev->handle;
1786                         hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
1787                                      sizeof(cp), &cp);
1788                 }
1789
1790                 /* Set packet type for incoming connection */
1791                 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
1792                         struct hci_cp_change_conn_ptype cp;
1793                         cp.handle = ev->handle;
1794                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
1795                         hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
1796                                      &cp);
1797                 }
1798         } else {
1799                 conn->state = BT_CLOSED;
1800                 if (conn->type == ACL_LINK)
1801                         mgmt_connect_failed(hdev, &ev->bdaddr, conn->type,
1802                                             conn->dst_type, ev->status);
1803         }
1804
1805         if (conn->type == ACL_LINK)
1806                 hci_sco_setup(conn, ev->status);
1807
1808         if (ev->status) {
1809                 hci_proto_connect_cfm(conn, ev->status);
1810                 hci_conn_del(conn);
1811         } else if (ev->link_type != ACL_LINK)
1812                 hci_proto_connect_cfm(conn, ev->status);
1813
1814 unlock:
1815         hci_dev_unlock(hdev);
1816
1817         hci_conn_check_pending(hdev);
1818 }
1819
1820 static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
1821 {
1822         struct hci_ev_conn_request *ev = (void *) skb->data;
1823         int mask = hdev->link_mode;
1824
1825         BT_DBG("%s bdaddr %s type 0x%x", hdev->name, batostr(&ev->bdaddr),
1826                ev->link_type);
1827
1828         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type);
1829
1830         if ((mask & HCI_LM_ACCEPT) &&
1831             !hci_blacklist_lookup(hdev, &ev->bdaddr)) {
1832                 /* Connection accepted */
1833                 struct inquiry_entry *ie;
1834                 struct hci_conn *conn;
1835
1836                 hci_dev_lock(hdev);
1837
1838                 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
1839                 if (ie)
1840                         memcpy(ie->data.dev_class, ev->dev_class, 3);
1841
1842                 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
1843                                                &ev->bdaddr);
1844                 if (!conn) {
1845                         conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr);
1846                         if (!conn) {
1847                                 BT_ERR("No memory for new connection");
1848                                 hci_dev_unlock(hdev);
1849                                 return;
1850                         }
1851                 }
1852
1853                 memcpy(conn->dev_class, ev->dev_class, 3);
1854                 conn->state = BT_CONNECT;
1855
1856                 hci_dev_unlock(hdev);
1857
1858                 if (ev->link_type == ACL_LINK || !lmp_esco_capable(hdev)) {
1859                         struct hci_cp_accept_conn_req cp;
1860
1861                         bacpy(&cp.bdaddr, &ev->bdaddr);
1862
1863                         if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
1864                                 cp.role = 0x00; /* Become master */
1865                         else
1866                                 cp.role = 0x01; /* Remain slave */
1867
1868                         hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp),
1869                                      &cp);
1870                 } else {
1871                         struct hci_cp_accept_sync_conn_req cp;
1872
1873                         bacpy(&cp.bdaddr, &ev->bdaddr);
1874                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
1875
1876                         cp.tx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
1877                         cp.rx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
1878                         cp.max_latency    = __constant_cpu_to_le16(0xffff);
1879                         cp.content_format = cpu_to_le16(hdev->voice_setting);
1880                         cp.retrans_effort = 0xff;
1881
1882                         hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ,
1883                                      sizeof(cp), &cp);
1884                 }
1885         } else {
1886                 /* Connection rejected */
1887                 struct hci_cp_reject_conn_req cp;
1888
1889                 bacpy(&cp.bdaddr, &ev->bdaddr);
1890                 cp.reason = HCI_ERROR_REJ_BAD_ADDR;
1891                 hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
1892         }
1893 }
1894
1895 static u8 hci_to_mgmt_reason(u8 err)
1896 {
1897         switch (err) {
1898         case HCI_ERROR_CONNECTION_TIMEOUT:
1899                 return MGMT_DEV_DISCONN_TIMEOUT;
1900         case HCI_ERROR_REMOTE_USER_TERM:
1901         case HCI_ERROR_REMOTE_LOW_RESOURCES:
1902         case HCI_ERROR_REMOTE_POWER_OFF:
1903                 return MGMT_DEV_DISCONN_REMOTE;
1904         case HCI_ERROR_LOCAL_HOST_TERM:
1905                 return MGMT_DEV_DISCONN_LOCAL_HOST;
1906         default:
1907                 return MGMT_DEV_DISCONN_UNKNOWN;
1908         }
1909 }
1910
1911 static void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1912 {
1913         struct hci_ev_disconn_complete *ev = (void *) skb->data;
1914         struct hci_conn *conn;
1915
1916         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
1917
1918         hci_dev_lock(hdev);
1919
1920         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1921         if (!conn)
1922                 goto unlock;
1923
1924         if (ev->status == 0)
1925                 conn->state = BT_CLOSED;
1926
1927         if (test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags) &&
1928             (conn->type == ACL_LINK || conn->type == LE_LINK)) {
1929                 if (ev->status) {
1930                         mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
1931                                                conn->dst_type, ev->status);
1932                 } else {
1933                         u8 reason = hci_to_mgmt_reason(ev->reason);
1934
1935                         mgmt_device_disconnected(hdev, &conn->dst, conn->type,
1936                                                  conn->dst_type, reason);
1937                 }
1938         }
1939
1940         if (ev->status == 0) {
1941                 if (conn->type == ACL_LINK && conn->flush_key)
1942                         hci_remove_link_key(hdev, &conn->dst);
1943                 hci_proto_disconn_cfm(conn, ev->reason);
1944                 hci_conn_del(conn);
1945         }
1946
1947 unlock:
1948         hci_dev_unlock(hdev);
1949 }
1950
1951 static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1952 {
1953         struct hci_ev_auth_complete *ev = (void *) skb->data;
1954         struct hci_conn *conn;
1955
1956         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
1957
1958         hci_dev_lock(hdev);
1959
1960         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1961         if (!conn)
1962                 goto unlock;
1963
1964         if (!ev->status) {
1965                 if (!hci_conn_ssp_enabled(conn) &&
1966                     test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
1967                         BT_INFO("re-auth of legacy device is not possible.");
1968                 } else {
1969                         conn->link_mode |= HCI_LM_AUTH;
1970                         conn->sec_level = conn->pending_sec_level;
1971                 }
1972         } else {
1973                 mgmt_auth_failed(hdev, &conn->dst, conn->type, conn->dst_type,
1974                                  ev->status);
1975         }
1976
1977         clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
1978         clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
1979
1980         if (conn->state == BT_CONFIG) {
1981                 if (!ev->status && hci_conn_ssp_enabled(conn)) {
1982                         struct hci_cp_set_conn_encrypt cp;
1983                         cp.handle  = ev->handle;
1984                         cp.encrypt = 0x01;
1985                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
1986                                      &cp);
1987                 } else {
1988                         conn->state = BT_CONNECTED;
1989                         hci_proto_connect_cfm(conn, ev->status);
1990                         hci_conn_put(conn);
1991                 }
1992         } else {
1993                 hci_auth_cfm(conn, ev->status);
1994
1995                 hci_conn_hold(conn);
1996                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
1997                 hci_conn_put(conn);
1998         }
1999
2000         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
2001                 if (!ev->status) {
2002                         struct hci_cp_set_conn_encrypt cp;
2003                         cp.handle  = ev->handle;
2004                         cp.encrypt = 0x01;
2005                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2006                                      &cp);
2007                 } else {
2008                         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2009                         hci_encrypt_cfm(conn, ev->status, 0x00);
2010                 }
2011         }
2012
2013 unlock:
2014         hci_dev_unlock(hdev);
2015 }
2016
2017 static void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
2018 {
2019         struct hci_ev_remote_name *ev = (void *) skb->data;
2020         struct hci_conn *conn;
2021
2022         BT_DBG("%s", hdev->name);
2023
2024         hci_conn_check_pending(hdev);
2025
2026         hci_dev_lock(hdev);
2027
2028         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2029
2030         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
2031                 goto check_auth;
2032
2033         if (ev->status == 0)
2034                 hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
2035                                        strnlen(ev->name, HCI_MAX_NAME_LENGTH));
2036         else
2037                 hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
2038
2039 check_auth:
2040         if (!conn)
2041                 goto unlock;
2042
2043         if (!hci_outgoing_auth_needed(hdev, conn))
2044                 goto unlock;
2045
2046         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
2047                 struct hci_cp_auth_requested cp;
2048                 cp.handle = __cpu_to_le16(conn->handle);
2049                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
2050         }
2051
2052 unlock:
2053         hci_dev_unlock(hdev);
2054 }
2055
2056 static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2057 {
2058         struct hci_ev_encrypt_change *ev = (void *) skb->data;
2059         struct hci_conn *conn;
2060
2061         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2062
2063         hci_dev_lock(hdev);
2064
2065         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2066         if (conn) {
2067                 if (!ev->status) {
2068                         if (ev->encrypt) {
2069                                 /* Encryption implies authentication */
2070                                 conn->link_mode |= HCI_LM_AUTH;
2071                                 conn->link_mode |= HCI_LM_ENCRYPT;
2072                                 conn->sec_level = conn->pending_sec_level;
2073                         } else
2074                                 conn->link_mode &= ~HCI_LM_ENCRYPT;
2075                 }
2076
2077                 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2078
2079                 if (ev->status && conn->state == BT_CONNECTED) {
2080                         hci_acl_disconn(conn, HCI_ERROR_AUTH_FAILURE);
2081                         hci_conn_put(conn);
2082                         goto unlock;
2083                 }
2084
2085                 if (conn->state == BT_CONFIG) {
2086                         if (!ev->status)
2087                                 conn->state = BT_CONNECTED;
2088
2089                         hci_proto_connect_cfm(conn, ev->status);
2090                         hci_conn_put(conn);
2091                 } else
2092                         hci_encrypt_cfm(conn, ev->status, ev->encrypt);
2093         }
2094
2095 unlock:
2096         hci_dev_unlock(hdev);
2097 }
2098
2099 static void hci_change_link_key_complete_evt(struct hci_dev *hdev,
2100                                              struct sk_buff *skb)
2101 {
2102         struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
2103         struct hci_conn *conn;
2104
2105         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2106
2107         hci_dev_lock(hdev);
2108
2109         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2110         if (conn) {
2111                 if (!ev->status)
2112                         conn->link_mode |= HCI_LM_SECURE;
2113
2114                 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
2115
2116                 hci_key_change_cfm(conn, ev->status);
2117         }
2118
2119         hci_dev_unlock(hdev);
2120 }
2121
2122 static void hci_remote_features_evt(struct hci_dev *hdev,
2123                                     struct sk_buff *skb)
2124 {
2125         struct hci_ev_remote_features *ev = (void *) skb->data;
2126         struct hci_conn *conn;
2127
2128         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2129
2130         hci_dev_lock(hdev);
2131
2132         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2133         if (!conn)
2134                 goto unlock;
2135
2136         if (!ev->status)
2137                 memcpy(conn->features, ev->features, 8);
2138
2139         if (conn->state != BT_CONFIG)
2140                 goto unlock;
2141
2142         if (!ev->status && lmp_ssp_capable(hdev) && lmp_ssp_capable(conn)) {
2143                 struct hci_cp_read_remote_ext_features cp;
2144                 cp.handle = ev->handle;
2145                 cp.page = 0x01;
2146                 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
2147                              sizeof(cp), &cp);
2148                 goto unlock;
2149         }
2150
2151         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
2152                 struct hci_cp_remote_name_req cp;
2153                 memset(&cp, 0, sizeof(cp));
2154                 bacpy(&cp.bdaddr, &conn->dst);
2155                 cp.pscan_rep_mode = 0x02;
2156                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2157         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2158                 mgmt_device_connected(hdev, &conn->dst, conn->type,
2159                                       conn->dst_type, 0, NULL, 0,
2160                                       conn->dev_class);
2161
2162         if (!hci_outgoing_auth_needed(hdev, conn)) {
2163                 conn->state = BT_CONNECTED;
2164                 hci_proto_connect_cfm(conn, ev->status);
2165                 hci_conn_put(conn);
2166         }
2167
2168 unlock:
2169         hci_dev_unlock(hdev);
2170 }
2171
2172 static void hci_remote_version_evt(struct hci_dev *hdev, struct sk_buff *skb)
2173 {
2174         BT_DBG("%s", hdev->name);
2175 }
2176
2177 static void hci_qos_setup_complete_evt(struct hci_dev *hdev,
2178                                        struct sk_buff *skb)
2179 {
2180         BT_DBG("%s", hdev->name);
2181 }
2182
2183 static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2184 {
2185         struct hci_ev_cmd_complete *ev = (void *) skb->data;
2186         __u16 opcode;
2187
2188         skb_pull(skb, sizeof(*ev));
2189
2190         opcode = __le16_to_cpu(ev->opcode);
2191
2192         switch (opcode) {
2193         case HCI_OP_INQUIRY_CANCEL:
2194                 hci_cc_inquiry_cancel(hdev, skb);
2195                 break;
2196
2197         case HCI_OP_PERIODIC_INQ:
2198                 hci_cc_periodic_inq(hdev, skb);
2199                 break;
2200
2201         case HCI_OP_EXIT_PERIODIC_INQ:
2202                 hci_cc_exit_periodic_inq(hdev, skb);
2203                 break;
2204
2205         case HCI_OP_REMOTE_NAME_REQ_CANCEL:
2206                 hci_cc_remote_name_req_cancel(hdev, skb);
2207                 break;
2208
2209         case HCI_OP_ROLE_DISCOVERY:
2210                 hci_cc_role_discovery(hdev, skb);
2211                 break;
2212
2213         case HCI_OP_READ_LINK_POLICY:
2214                 hci_cc_read_link_policy(hdev, skb);
2215                 break;
2216
2217         case HCI_OP_WRITE_LINK_POLICY:
2218                 hci_cc_write_link_policy(hdev, skb);
2219                 break;
2220
2221         case HCI_OP_READ_DEF_LINK_POLICY:
2222                 hci_cc_read_def_link_policy(hdev, skb);
2223                 break;
2224
2225         case HCI_OP_WRITE_DEF_LINK_POLICY:
2226                 hci_cc_write_def_link_policy(hdev, skb);
2227                 break;
2228
2229         case HCI_OP_RESET:
2230                 hci_cc_reset(hdev, skb);
2231                 break;
2232
2233         case HCI_OP_WRITE_LOCAL_NAME:
2234                 hci_cc_write_local_name(hdev, skb);
2235                 break;
2236
2237         case HCI_OP_READ_LOCAL_NAME:
2238                 hci_cc_read_local_name(hdev, skb);
2239                 break;
2240
2241         case HCI_OP_WRITE_AUTH_ENABLE:
2242                 hci_cc_write_auth_enable(hdev, skb);
2243                 break;
2244
2245         case HCI_OP_WRITE_ENCRYPT_MODE:
2246                 hci_cc_write_encrypt_mode(hdev, skb);
2247                 break;
2248
2249         case HCI_OP_WRITE_SCAN_ENABLE:
2250                 hci_cc_write_scan_enable(hdev, skb);
2251                 break;
2252
2253         case HCI_OP_READ_CLASS_OF_DEV:
2254                 hci_cc_read_class_of_dev(hdev, skb);
2255                 break;
2256
2257         case HCI_OP_WRITE_CLASS_OF_DEV:
2258                 hci_cc_write_class_of_dev(hdev, skb);
2259                 break;
2260
2261         case HCI_OP_READ_VOICE_SETTING:
2262                 hci_cc_read_voice_setting(hdev, skb);
2263                 break;
2264
2265         case HCI_OP_WRITE_VOICE_SETTING:
2266                 hci_cc_write_voice_setting(hdev, skb);
2267                 break;
2268
2269         case HCI_OP_HOST_BUFFER_SIZE:
2270                 hci_cc_host_buffer_size(hdev, skb);
2271                 break;
2272
2273         case HCI_OP_WRITE_SSP_MODE:
2274                 hci_cc_write_ssp_mode(hdev, skb);
2275                 break;
2276
2277         case HCI_OP_READ_LOCAL_VERSION:
2278                 hci_cc_read_local_version(hdev, skb);
2279                 break;
2280
2281         case HCI_OP_READ_LOCAL_COMMANDS:
2282                 hci_cc_read_local_commands(hdev, skb);
2283                 break;
2284
2285         case HCI_OP_READ_LOCAL_FEATURES:
2286                 hci_cc_read_local_features(hdev, skb);
2287                 break;
2288
2289         case HCI_OP_READ_LOCAL_EXT_FEATURES:
2290                 hci_cc_read_local_ext_features(hdev, skb);
2291                 break;
2292
2293         case HCI_OP_READ_BUFFER_SIZE:
2294                 hci_cc_read_buffer_size(hdev, skb);
2295                 break;
2296
2297         case HCI_OP_READ_BD_ADDR:
2298                 hci_cc_read_bd_addr(hdev, skb);
2299                 break;
2300
2301         case HCI_OP_READ_DATA_BLOCK_SIZE:
2302                 hci_cc_read_data_block_size(hdev, skb);
2303                 break;
2304
2305         case HCI_OP_WRITE_CA_TIMEOUT:
2306                 hci_cc_write_ca_timeout(hdev, skb);
2307                 break;
2308
2309         case HCI_OP_READ_FLOW_CONTROL_MODE:
2310                 hci_cc_read_flow_control_mode(hdev, skb);
2311                 break;
2312
2313         case HCI_OP_READ_LOCAL_AMP_INFO:
2314                 hci_cc_read_local_amp_info(hdev, skb);
2315                 break;
2316
2317         case HCI_OP_DELETE_STORED_LINK_KEY:
2318                 hci_cc_delete_stored_link_key(hdev, skb);
2319                 break;
2320
2321         case HCI_OP_SET_EVENT_MASK:
2322                 hci_cc_set_event_mask(hdev, skb);
2323                 break;
2324
2325         case HCI_OP_WRITE_INQUIRY_MODE:
2326                 hci_cc_write_inquiry_mode(hdev, skb);
2327                 break;
2328
2329         case HCI_OP_READ_INQ_RSP_TX_POWER:
2330                 hci_cc_read_inq_rsp_tx_power(hdev, skb);
2331                 break;
2332
2333         case HCI_OP_SET_EVENT_FLT:
2334                 hci_cc_set_event_flt(hdev, skb);
2335                 break;
2336
2337         case HCI_OP_PIN_CODE_REPLY:
2338                 hci_cc_pin_code_reply(hdev, skb);
2339                 break;
2340
2341         case HCI_OP_PIN_CODE_NEG_REPLY:
2342                 hci_cc_pin_code_neg_reply(hdev, skb);
2343                 break;
2344
2345         case HCI_OP_READ_LOCAL_OOB_DATA:
2346                 hci_cc_read_local_oob_data_reply(hdev, skb);
2347                 break;
2348
2349         case HCI_OP_LE_READ_BUFFER_SIZE:
2350                 hci_cc_le_read_buffer_size(hdev, skb);
2351                 break;
2352
2353         case HCI_OP_USER_CONFIRM_REPLY:
2354                 hci_cc_user_confirm_reply(hdev, skb);
2355                 break;
2356
2357         case HCI_OP_USER_CONFIRM_NEG_REPLY:
2358                 hci_cc_user_confirm_neg_reply(hdev, skb);
2359                 break;
2360
2361         case HCI_OP_USER_PASSKEY_REPLY:
2362                 hci_cc_user_passkey_reply(hdev, skb);
2363                 break;
2364
2365         case HCI_OP_USER_PASSKEY_NEG_REPLY:
2366                 hci_cc_user_passkey_neg_reply(hdev, skb);
2367                 break;
2368
2369         case HCI_OP_LE_SET_SCAN_PARAM:
2370                 hci_cc_le_set_scan_param(hdev, skb);
2371                 break;
2372
2373         case HCI_OP_LE_SET_SCAN_ENABLE:
2374                 hci_cc_le_set_scan_enable(hdev, skb);
2375                 break;
2376
2377         case HCI_OP_LE_LTK_REPLY:
2378                 hci_cc_le_ltk_reply(hdev, skb);
2379                 break;
2380
2381         case HCI_OP_LE_LTK_NEG_REPLY:
2382                 hci_cc_le_ltk_neg_reply(hdev, skb);
2383                 break;
2384
2385         case HCI_OP_WRITE_LE_HOST_SUPPORTED:
2386                 hci_cc_write_le_host_supported(hdev, skb);
2387                 break;
2388
2389         default:
2390                 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
2391                 break;
2392         }
2393
2394         if (ev->opcode != HCI_OP_NOP)
2395                 del_timer(&hdev->cmd_timer);
2396
2397         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
2398                 atomic_set(&hdev->cmd_cnt, 1);
2399                 if (!skb_queue_empty(&hdev->cmd_q))
2400                         queue_work(hdev->workqueue, &hdev->cmd_work);
2401         }
2402 }
2403
2404 static void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb)
2405 {
2406         struct hci_ev_cmd_status *ev = (void *) skb->data;
2407         __u16 opcode;
2408
2409         skb_pull(skb, sizeof(*ev));
2410
2411         opcode = __le16_to_cpu(ev->opcode);
2412
2413         switch (opcode) {
2414         case HCI_OP_INQUIRY:
2415                 hci_cs_inquiry(hdev, ev->status);
2416                 break;
2417
2418         case HCI_OP_CREATE_CONN:
2419                 hci_cs_create_conn(hdev, ev->status);
2420                 break;
2421
2422         case HCI_OP_ADD_SCO:
2423                 hci_cs_add_sco(hdev, ev->status);
2424                 break;
2425
2426         case HCI_OP_AUTH_REQUESTED:
2427                 hci_cs_auth_requested(hdev, ev->status);
2428                 break;
2429
2430         case HCI_OP_SET_CONN_ENCRYPT:
2431                 hci_cs_set_conn_encrypt(hdev, ev->status);
2432                 break;
2433
2434         case HCI_OP_REMOTE_NAME_REQ:
2435                 hci_cs_remote_name_req(hdev, ev->status);
2436                 break;
2437
2438         case HCI_OP_READ_REMOTE_FEATURES:
2439                 hci_cs_read_remote_features(hdev, ev->status);
2440                 break;
2441
2442         case HCI_OP_READ_REMOTE_EXT_FEATURES:
2443                 hci_cs_read_remote_ext_features(hdev, ev->status);
2444                 break;
2445
2446         case HCI_OP_SETUP_SYNC_CONN:
2447                 hci_cs_setup_sync_conn(hdev, ev->status);
2448                 break;
2449
2450         case HCI_OP_SNIFF_MODE:
2451                 hci_cs_sniff_mode(hdev, ev->status);
2452                 break;
2453
2454         case HCI_OP_EXIT_SNIFF_MODE:
2455                 hci_cs_exit_sniff_mode(hdev, ev->status);
2456                 break;
2457
2458         case HCI_OP_DISCONNECT:
2459                 hci_cs_disconnect(hdev, ev->status);
2460                 break;
2461
2462         case HCI_OP_LE_CREATE_CONN:
2463                 hci_cs_le_create_conn(hdev, ev->status);
2464                 break;
2465
2466         case HCI_OP_LE_START_ENC:
2467                 hci_cs_le_start_enc(hdev, ev->status);
2468                 break;
2469
2470         default:
2471                 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
2472                 break;
2473         }
2474
2475         if (ev->opcode != HCI_OP_NOP)
2476                 del_timer(&hdev->cmd_timer);
2477
2478         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
2479                 atomic_set(&hdev->cmd_cnt, 1);
2480                 if (!skb_queue_empty(&hdev->cmd_q))
2481                         queue_work(hdev->workqueue, &hdev->cmd_work);
2482         }
2483 }
2484
2485 static void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2486 {
2487         struct hci_ev_role_change *ev = (void *) skb->data;
2488         struct hci_conn *conn;
2489
2490         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2491
2492         hci_dev_lock(hdev);
2493
2494         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2495         if (conn) {
2496                 if (!ev->status) {
2497                         if (ev->role)
2498                                 conn->link_mode &= ~HCI_LM_MASTER;
2499                         else
2500                                 conn->link_mode |= HCI_LM_MASTER;
2501                 }
2502
2503                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
2504
2505                 hci_role_switch_cfm(conn, ev->status, ev->role);
2506         }
2507
2508         hci_dev_unlock(hdev);
2509 }
2510
2511 static void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
2512 {
2513         struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
2514         int i;
2515
2516         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
2517                 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
2518                 return;
2519         }
2520
2521         if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
2522             ev->num_hndl * sizeof(struct hci_comp_pkts_info)) {
2523                 BT_DBG("%s bad parameters", hdev->name);
2524                 return;
2525         }
2526
2527         BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
2528
2529         for (i = 0; i < ev->num_hndl; i++) {
2530                 struct hci_comp_pkts_info *info = &ev->handles[i];
2531                 struct hci_conn *conn;
2532                 __u16  handle, count;
2533
2534                 handle = __le16_to_cpu(info->handle);
2535                 count  = __le16_to_cpu(info->count);
2536
2537                 conn = hci_conn_hash_lookup_handle(hdev, handle);
2538                 if (!conn)
2539                         continue;
2540
2541                 conn->sent -= count;
2542
2543                 switch (conn->type) {
2544                 case ACL_LINK:
2545                         hdev->acl_cnt += count;
2546                         if (hdev->acl_cnt > hdev->acl_pkts)
2547                                 hdev->acl_cnt = hdev->acl_pkts;
2548                         break;
2549
2550                 case LE_LINK:
2551                         if (hdev->le_pkts) {
2552                                 hdev->le_cnt += count;
2553                                 if (hdev->le_cnt > hdev->le_pkts)
2554                                         hdev->le_cnt = hdev->le_pkts;
2555                         } else {
2556                                 hdev->acl_cnt += count;
2557                                 if (hdev->acl_cnt > hdev->acl_pkts)
2558                                         hdev->acl_cnt = hdev->acl_pkts;
2559                         }
2560                         break;
2561
2562                 case SCO_LINK:
2563                         hdev->sco_cnt += count;
2564                         if (hdev->sco_cnt > hdev->sco_pkts)
2565                                 hdev->sco_cnt = hdev->sco_pkts;
2566                         break;
2567
2568                 default:
2569                         BT_ERR("Unknown type %d conn %p", conn->type, conn);
2570                         break;
2571                 }
2572         }
2573
2574         queue_work(hdev->workqueue, &hdev->tx_work);
2575 }
2576
2577 static void hci_num_comp_blocks_evt(struct hci_dev *hdev, struct sk_buff *skb)
2578 {
2579         struct hci_ev_num_comp_blocks *ev = (void *) skb->data;
2580         int i;
2581
2582         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
2583                 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
2584                 return;
2585         }
2586
2587         if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
2588             ev->num_hndl * sizeof(struct hci_comp_blocks_info)) {
2589                 BT_DBG("%s bad parameters", hdev->name);
2590                 return;
2591         }
2592
2593         BT_DBG("%s num_blocks %d num_hndl %d", hdev->name, ev->num_blocks,
2594                ev->num_hndl);
2595
2596         for (i = 0; i < ev->num_hndl; i++) {
2597                 struct hci_comp_blocks_info *info = &ev->handles[i];
2598                 struct hci_conn *conn;
2599                 __u16  handle, block_count;
2600
2601                 handle = __le16_to_cpu(info->handle);
2602                 block_count = __le16_to_cpu(info->blocks);
2603
2604                 conn = hci_conn_hash_lookup_handle(hdev, handle);
2605                 if (!conn)
2606                         continue;
2607
2608                 conn->sent -= block_count;
2609
2610                 switch (conn->type) {
2611                 case ACL_LINK:
2612                         hdev->block_cnt += block_count;
2613                         if (hdev->block_cnt > hdev->num_blocks)
2614                                 hdev->block_cnt = hdev->num_blocks;
2615                         break;
2616
2617                 default:
2618                         BT_ERR("Unknown type %d conn %p", conn->type, conn);
2619                         break;
2620                 }
2621         }
2622
2623         queue_work(hdev->workqueue, &hdev->tx_work);
2624 }
2625
2626 static void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2627 {
2628         struct hci_ev_mode_change *ev = (void *) skb->data;
2629         struct hci_conn *conn;
2630
2631         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2632
2633         hci_dev_lock(hdev);
2634
2635         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2636         if (conn) {
2637                 conn->mode = ev->mode;
2638                 conn->interval = __le16_to_cpu(ev->interval);
2639
2640                 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND,
2641                                         &conn->flags)) {
2642                         if (conn->mode == HCI_CM_ACTIVE)
2643                                 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
2644                         else
2645                                 clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
2646                 }
2647
2648                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2649                         hci_sco_setup(conn, ev->status);
2650         }
2651
2652         hci_dev_unlock(hdev);
2653 }
2654
2655 static void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2656 {
2657         struct hci_ev_pin_code_req *ev = (void *) skb->data;
2658         struct hci_conn *conn;
2659
2660         BT_DBG("%s", hdev->name);
2661
2662         hci_dev_lock(hdev);
2663
2664         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2665         if (!conn)
2666                 goto unlock;
2667
2668         if (conn->state == BT_CONNECTED) {
2669                 hci_conn_hold(conn);
2670                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2671                 hci_conn_put(conn);
2672         }
2673
2674         if (!test_bit(HCI_PAIRABLE, &hdev->dev_flags))
2675                 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2676                              sizeof(ev->bdaddr), &ev->bdaddr);
2677         else if (test_bit(HCI_MGMT, &hdev->dev_flags)) {
2678                 u8 secure;
2679
2680                 if (conn->pending_sec_level == BT_SECURITY_HIGH)
2681                         secure = 1;
2682                 else
2683                         secure = 0;
2684
2685                 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
2686         }
2687
2688 unlock:
2689         hci_dev_unlock(hdev);
2690 }
2691
2692 static void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2693 {
2694         struct hci_ev_link_key_req *ev = (void *) skb->data;
2695         struct hci_cp_link_key_reply cp;
2696         struct hci_conn *conn;
2697         struct link_key *key;
2698
2699         BT_DBG("%s", hdev->name);
2700
2701         if (!test_bit(HCI_LINK_KEYS, &hdev->dev_flags))
2702                 return;
2703
2704         hci_dev_lock(hdev);
2705
2706         key = hci_find_link_key(hdev, &ev->bdaddr);
2707         if (!key) {
2708                 BT_DBG("%s link key not found for %s", hdev->name,
2709                        batostr(&ev->bdaddr));
2710                 goto not_found;
2711         }
2712
2713         BT_DBG("%s found key type %u for %s", hdev->name, key->type,
2714                batostr(&ev->bdaddr));
2715
2716         if (!test_bit(HCI_DEBUG_KEYS, &hdev->dev_flags) &&
2717             key->type == HCI_LK_DEBUG_COMBINATION) {
2718                 BT_DBG("%s ignoring debug key", hdev->name);
2719                 goto not_found;
2720         }
2721
2722         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2723         if (conn) {
2724                 if (key->type == HCI_LK_UNAUTH_COMBINATION &&
2725                     conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
2726                         BT_DBG("%s ignoring unauthenticated key", hdev->name);
2727                         goto not_found;
2728                 }
2729
2730                 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
2731                     conn->pending_sec_level == BT_SECURITY_HIGH) {
2732                         BT_DBG("%s ignoring key unauthenticated for high security",
2733                                hdev->name);
2734                         goto not_found;
2735                 }
2736
2737                 conn->key_type = key->type;
2738                 conn->pin_length = key->pin_len;
2739         }
2740
2741         bacpy(&cp.bdaddr, &ev->bdaddr);
2742         memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);
2743
2744         hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
2745
2746         hci_dev_unlock(hdev);
2747
2748         return;
2749
2750 not_found:
2751         hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
2752         hci_dev_unlock(hdev);
2753 }
2754
2755 static void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
2756 {
2757         struct hci_ev_link_key_notify *ev = (void *) skb->data;
2758         struct hci_conn *conn;
2759         u8 pin_len = 0;
2760
2761         BT_DBG("%s", hdev->name);
2762
2763         hci_dev_lock(hdev);
2764
2765         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2766         if (conn) {
2767                 hci_conn_hold(conn);
2768                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2769                 pin_len = conn->pin_length;
2770
2771                 if (ev->key_type != HCI_LK_CHANGED_COMBINATION)
2772                         conn->key_type = ev->key_type;
2773
2774                 hci_conn_put(conn);
2775         }
2776
2777         if (test_bit(HCI_LINK_KEYS, &hdev->dev_flags))
2778                 hci_add_link_key(hdev, conn, 1, &ev->bdaddr, ev->link_key,
2779                                  ev->key_type, pin_len);
2780
2781         hci_dev_unlock(hdev);
2782 }
2783
2784 static void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
2785 {
2786         struct hci_ev_clock_offset *ev = (void *) skb->data;
2787         struct hci_conn *conn;
2788
2789         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2790
2791         hci_dev_lock(hdev);
2792
2793         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2794         if (conn && !ev->status) {
2795                 struct inquiry_entry *ie;
2796
2797                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
2798                 if (ie) {
2799                         ie->data.clock_offset = ev->clock_offset;
2800                         ie->timestamp = jiffies;
2801                 }
2802         }
2803
2804         hci_dev_unlock(hdev);
2805 }
2806
2807 static void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2808 {
2809         struct hci_ev_pkt_type_change *ev = (void *) skb->data;
2810         struct hci_conn *conn;
2811
2812         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2813
2814         hci_dev_lock(hdev);
2815
2816         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2817         if (conn && !ev->status)
2818                 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
2819
2820         hci_dev_unlock(hdev);
2821 }
2822
2823 static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
2824 {
2825         struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
2826         struct inquiry_entry *ie;
2827
2828         BT_DBG("%s", hdev->name);
2829
2830         hci_dev_lock(hdev);
2831
2832         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2833         if (ie) {
2834                 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
2835                 ie->timestamp = jiffies;
2836         }
2837
2838         hci_dev_unlock(hdev);
2839 }
2840
2841 static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
2842                                              struct sk_buff *skb)
2843 {
2844         struct inquiry_data data;
2845         int num_rsp = *((__u8 *) skb->data);
2846         bool name_known, ssp;
2847
2848         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2849
2850         if (!num_rsp)
2851                 return;
2852
2853         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
2854                 return;
2855
2856         hci_dev_lock(hdev);
2857
2858         if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
2859                 struct inquiry_info_with_rssi_and_pscan_mode *info;
2860                 info = (void *) (skb->data + 1);
2861
2862                 for (; num_rsp; num_rsp--, info++) {
2863                         bacpy(&data.bdaddr, &info->bdaddr);
2864                         data.pscan_rep_mode     = info->pscan_rep_mode;
2865                         data.pscan_period_mode  = info->pscan_period_mode;
2866                         data.pscan_mode         = info->pscan_mode;
2867                         memcpy(data.dev_class, info->dev_class, 3);
2868                         data.clock_offset       = info->clock_offset;
2869                         data.rssi               = info->rssi;
2870                         data.ssp_mode           = 0x00;
2871
2872                         name_known = hci_inquiry_cache_update(hdev, &data,
2873                                                               false, &ssp);
2874                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2875                                           info->dev_class, info->rssi,
2876                                           !name_known, ssp, NULL, 0);
2877                 }
2878         } else {
2879                 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
2880
2881                 for (; num_rsp; num_rsp--, info++) {
2882                         bacpy(&data.bdaddr, &info->bdaddr);
2883                         data.pscan_rep_mode     = info->pscan_rep_mode;
2884                         data.pscan_period_mode  = info->pscan_period_mode;
2885                         data.pscan_mode         = 0x00;
2886                         memcpy(data.dev_class, info->dev_class, 3);
2887                         data.clock_offset       = info->clock_offset;
2888                         data.rssi               = info->rssi;
2889                         data.ssp_mode           = 0x00;
2890                         name_known = hci_inquiry_cache_update(hdev, &data,
2891                                                               false, &ssp);
2892                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2893                                           info->dev_class, info->rssi,
2894                                           !name_known, ssp, NULL, 0);
2895                 }
2896         }
2897
2898         hci_dev_unlock(hdev);
2899 }
2900
2901 static void hci_remote_ext_features_evt(struct hci_dev *hdev,
2902                                         struct sk_buff *skb)
2903 {
2904         struct hci_ev_remote_ext_features *ev = (void *) skb->data;
2905         struct hci_conn *conn;
2906
2907         BT_DBG("%s", hdev->name);
2908
2909         hci_dev_lock(hdev);
2910
2911         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2912         if (!conn)
2913                 goto unlock;
2914
2915         if (!ev->status && ev->page == 0x01) {
2916                 struct inquiry_entry *ie;
2917
2918                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
2919                 if (ie)
2920                         ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
2921
2922                 if (ev->features[0] & LMP_HOST_SSP)
2923                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
2924         }
2925
2926         if (conn->state != BT_CONFIG)
2927                 goto unlock;
2928
2929         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
2930                 struct hci_cp_remote_name_req cp;
2931                 memset(&cp, 0, sizeof(cp));
2932                 bacpy(&cp.bdaddr, &conn->dst);
2933                 cp.pscan_rep_mode = 0x02;
2934                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2935         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2936                 mgmt_device_connected(hdev, &conn->dst, conn->type,
2937                                       conn->dst_type, 0, NULL, 0,
2938                                       conn->dev_class);
2939
2940         if (!hci_outgoing_auth_needed(hdev, conn)) {
2941                 conn->state = BT_CONNECTED;
2942                 hci_proto_connect_cfm(conn, ev->status);
2943                 hci_conn_put(conn);
2944         }
2945
2946 unlock:
2947         hci_dev_unlock(hdev);
2948 }
2949
2950 static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
2951                                        struct sk_buff *skb)
2952 {
2953         struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
2954         struct hci_conn *conn;
2955
2956         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2957
2958         hci_dev_lock(hdev);
2959
2960         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
2961         if (!conn) {
2962                 if (ev->link_type == ESCO_LINK)
2963                         goto unlock;
2964
2965                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
2966                 if (!conn)
2967                         goto unlock;
2968
2969                 conn->type = SCO_LINK;
2970         }
2971
2972         switch (ev->status) {
2973         case 0x00:
2974                 conn->handle = __le16_to_cpu(ev->handle);
2975                 conn->state  = BT_CONNECTED;
2976
2977                 hci_conn_hold_device(conn);
2978                 hci_conn_add_sysfs(conn);
2979                 break;
2980
2981         case 0x11:      /* Unsupported Feature or Parameter Value */
2982         case 0x1c:      /* SCO interval rejected */
2983         case 0x1a:      /* Unsupported Remote Feature */
2984         case 0x1f:      /* Unspecified error */
2985                 if (conn->out && conn->attempt < 2) {
2986                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
2987                                         (hdev->esco_type & EDR_ESCO_MASK);
2988                         hci_setup_sync(conn, conn->link->handle);
2989                         goto unlock;
2990                 }
2991                 /* fall through */
2992
2993         default:
2994                 conn->state = BT_CLOSED;
2995                 break;
2996         }
2997
2998         hci_proto_connect_cfm(conn, ev->status);
2999         if (ev->status)
3000                 hci_conn_del(conn);
3001
3002 unlock:
3003         hci_dev_unlock(hdev);
3004 }
3005
3006 static void hci_sync_conn_changed_evt(struct hci_dev *hdev, struct sk_buff *skb)
3007 {
3008         BT_DBG("%s", hdev->name);
3009 }
3010
3011 static void hci_sniff_subrate_evt(struct hci_dev *hdev, struct sk_buff *skb)
3012 {
3013         struct hci_ev_sniff_subrate *ev = (void *) skb->data;
3014
3015         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3016 }
3017
3018 static void hci_extended_inquiry_result_evt(struct hci_dev *hdev,
3019                                             struct sk_buff *skb)
3020 {
3021         struct inquiry_data data;
3022         struct extended_inquiry_info *info = (void *) (skb->data + 1);
3023         int num_rsp = *((__u8 *) skb->data);
3024         size_t eir_len;
3025
3026         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
3027
3028         if (!num_rsp)
3029                 return;
3030
3031         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
3032                 return;
3033
3034         hci_dev_lock(hdev);
3035
3036         for (; num_rsp; num_rsp--, info++) {
3037                 bool name_known, ssp;
3038
3039                 bacpy(&data.bdaddr, &info->bdaddr);
3040                 data.pscan_rep_mode     = info->pscan_rep_mode;
3041                 data.pscan_period_mode  = info->pscan_period_mode;
3042                 data.pscan_mode         = 0x00;
3043                 memcpy(data.dev_class, info->dev_class, 3);
3044                 data.clock_offset       = info->clock_offset;
3045                 data.rssi               = info->rssi;
3046                 data.ssp_mode           = 0x01;
3047
3048                 if (test_bit(HCI_MGMT, &hdev->dev_flags))
3049                         name_known = eir_has_data_type(info->data,
3050                                                        sizeof(info->data),
3051                                                        EIR_NAME_COMPLETE);
3052                 else
3053                         name_known = true;
3054
3055                 name_known = hci_inquiry_cache_update(hdev, &data, name_known,
3056                                                       &ssp);
3057                 eir_len = eir_get_length(info->data, sizeof(info->data));
3058                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
3059                                   info->dev_class, info->rssi, !name_known,
3060                                   ssp, info->data, eir_len);
3061         }
3062
3063         hci_dev_unlock(hdev);
3064 }
3065
3066 static void hci_key_refresh_complete_evt(struct hci_dev *hdev,
3067                                          struct sk_buff *skb)
3068 {
3069         struct hci_ev_key_refresh_complete *ev = (void *) skb->data;
3070         struct hci_conn *conn;
3071
3072         BT_DBG("%s status 0x%2.2x handle 0x%4.4x", hdev->name, ev->status,
3073                __le16_to_cpu(ev->handle));
3074
3075         hci_dev_lock(hdev);
3076
3077         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3078         if (!conn)
3079                 goto unlock;
3080
3081         if (!ev->status)
3082                 conn->sec_level = conn->pending_sec_level;
3083
3084         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3085
3086         if (ev->status && conn->state == BT_CONNECTED) {
3087                 hci_acl_disconn(conn, HCI_ERROR_AUTH_FAILURE);
3088                 hci_conn_put(conn);
3089                 goto unlock;
3090         }
3091
3092         if (conn->state == BT_CONFIG) {
3093                 if (!ev->status)
3094                         conn->state = BT_CONNECTED;
3095
3096                 hci_proto_connect_cfm(conn, ev->status);
3097                 hci_conn_put(conn);
3098         } else {
3099                 hci_auth_cfm(conn, ev->status);
3100
3101                 hci_conn_hold(conn);
3102                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3103                 hci_conn_put(conn);
3104         }
3105
3106 unlock:
3107         hci_dev_unlock(hdev);
3108 }
3109
3110 static u8 hci_get_auth_req(struct hci_conn *conn)
3111 {
3112         /* If remote requests dedicated bonding follow that lead */
3113         if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03) {
3114                 /* If both remote and local IO capabilities allow MITM
3115                  * protection then require it, otherwise don't */
3116                 if (conn->remote_cap == 0x03 || conn->io_capability == 0x03)
3117                         return 0x02;
3118                 else
3119                         return 0x03;
3120         }
3121
3122         /* If remote requests no-bonding follow that lead */
3123         if (conn->remote_auth == 0x00 || conn->remote_auth == 0x01)
3124                 return conn->remote_auth | (conn->auth_type & 0x01);
3125
3126         return conn->auth_type;
3127 }
3128
3129 static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3130 {
3131         struct hci_ev_io_capa_request *ev = (void *) skb->data;
3132         struct hci_conn *conn;
3133
3134         BT_DBG("%s", hdev->name);
3135
3136         hci_dev_lock(hdev);
3137
3138         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3139         if (!conn)
3140                 goto unlock;
3141
3142         hci_conn_hold(conn);
3143
3144         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3145                 goto unlock;
3146
3147         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags) ||
3148             (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
3149                 struct hci_cp_io_capability_reply cp;
3150
3151                 bacpy(&cp.bdaddr, &ev->bdaddr);
3152                 /* Change the IO capability from KeyboardDisplay
3153                  * to DisplayYesNo as it is not supported by BT spec. */
3154                 cp.capability = (conn->io_capability == 0x04) ?
3155                                                 0x01 : conn->io_capability;
3156                 conn->auth_type = hci_get_auth_req(conn);
3157                 cp.authentication = conn->auth_type;
3158
3159                 if (hci_find_remote_oob_data(hdev, &conn->dst) &&
3160                     (conn->out || test_bit(HCI_CONN_REMOTE_OOB, &conn->flags)))
3161                         cp.oob_data = 0x01;
3162                 else
3163                         cp.oob_data = 0x00;
3164
3165                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
3166                              sizeof(cp), &cp);
3167         } else {
3168                 struct hci_cp_io_capability_neg_reply cp;
3169
3170                 bacpy(&cp.bdaddr, &ev->bdaddr);
3171                 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
3172
3173                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
3174                              sizeof(cp), &cp);
3175         }
3176
3177 unlock:
3178         hci_dev_unlock(hdev);
3179 }
3180
3181 static void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
3182 {
3183         struct hci_ev_io_capa_reply *ev = (void *) skb->data;
3184         struct hci_conn *conn;
3185
3186         BT_DBG("%s", hdev->name);
3187
3188         hci_dev_lock(hdev);
3189
3190         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3191         if (!conn)
3192                 goto unlock;
3193
3194         conn->remote_cap = ev->capability;
3195         conn->remote_auth = ev->authentication;
3196         if (ev->oob_data)
3197                 set_bit(HCI_CONN_REMOTE_OOB, &conn->flags);
3198
3199 unlock:
3200         hci_dev_unlock(hdev);
3201 }
3202
3203 static void hci_user_confirm_request_evt(struct hci_dev *hdev,
3204                                          struct sk_buff *skb)
3205 {
3206         struct hci_ev_user_confirm_req *ev = (void *) skb->data;
3207         int loc_mitm, rem_mitm, confirm_hint = 0;
3208         struct hci_conn *conn;
3209
3210         BT_DBG("%s", hdev->name);
3211
3212         hci_dev_lock(hdev);
3213
3214         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3215                 goto unlock;
3216
3217         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3218         if (!conn)
3219                 goto unlock;
3220
3221         loc_mitm = (conn->auth_type & 0x01);
3222         rem_mitm = (conn->remote_auth & 0x01);
3223
3224         /* If we require MITM but the remote device can't provide that
3225          * (it has NoInputNoOutput) then reject the confirmation
3226          * request. The only exception is when we're dedicated bonding
3227          * initiators (connect_cfm_cb set) since then we always have the MITM
3228          * bit set. */
3229         if (!conn->connect_cfm_cb && loc_mitm && conn->remote_cap == 0x03) {
3230                 BT_DBG("Rejecting request: remote device can't provide MITM");
3231                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
3232                              sizeof(ev->bdaddr), &ev->bdaddr);
3233                 goto unlock;
3234         }
3235
3236         /* If no side requires MITM protection; auto-accept */
3237         if ((!loc_mitm || conn->remote_cap == 0x03) &&
3238             (!rem_mitm || conn->io_capability == 0x03)) {
3239
3240                 /* If we're not the initiators request authorization to
3241                  * proceed from user space (mgmt_user_confirm with
3242                  * confirm_hint set to 1). */
3243                 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
3244                         BT_DBG("Confirming auto-accept as acceptor");
3245                         confirm_hint = 1;
3246                         goto confirm;
3247                 }
3248
3249                 BT_DBG("Auto-accept of user confirmation with %ums delay",
3250                        hdev->auto_accept_delay);
3251
3252                 if (hdev->auto_accept_delay > 0) {
3253                         int delay = msecs_to_jiffies(hdev->auto_accept_delay);
3254                         mod_timer(&conn->auto_accept_timer, jiffies + delay);
3255                         goto unlock;
3256                 }
3257
3258                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
3259                              sizeof(ev->bdaddr), &ev->bdaddr);
3260                 goto unlock;
3261         }
3262
3263 confirm:
3264         mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0, ev->passkey,
3265                                   confirm_hint);
3266
3267 unlock:
3268         hci_dev_unlock(hdev);
3269 }
3270
3271 static void hci_user_passkey_request_evt(struct hci_dev *hdev,
3272                                          struct sk_buff *skb)
3273 {
3274         struct hci_ev_user_passkey_req *ev = (void *) skb->data;
3275
3276         BT_DBG("%s", hdev->name);
3277
3278         if (test_bit(HCI_MGMT, &hdev->dev_flags))
3279                 mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
3280 }
3281
3282 static void hci_user_passkey_notify_evt(struct hci_dev *hdev,
3283                                         struct sk_buff *skb)
3284 {
3285         struct hci_ev_user_passkey_notify *ev = (void *) skb->data;
3286         struct hci_conn *conn;
3287
3288         BT_DBG("%s", hdev->name);
3289
3290         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3291         if (!conn)
3292                 return;
3293
3294         conn->passkey_notify = __le32_to_cpu(ev->passkey);
3295         conn->passkey_entered = 0;
3296
3297         if (test_bit(HCI_MGMT, &hdev->dev_flags))
3298                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
3299                                          conn->dst_type, conn->passkey_notify,
3300                                          conn->passkey_entered);
3301 }
3302
3303 static void hci_keypress_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
3304 {
3305         struct hci_ev_keypress_notify *ev = (void *) skb->data;
3306         struct hci_conn *conn;
3307
3308         BT_DBG("%s", hdev->name);
3309
3310         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3311         if (!conn)
3312                 return;
3313
3314         switch (ev->type) {
3315         case HCI_KEYPRESS_STARTED:
3316                 conn->passkey_entered = 0;
3317                 return;
3318
3319         case HCI_KEYPRESS_ENTERED:
3320                 conn->passkey_entered++;
3321                 break;
3322
3323         case HCI_KEYPRESS_ERASED:
3324                 conn->passkey_entered--;
3325                 break;
3326
3327         case HCI_KEYPRESS_CLEARED:
3328                 conn->passkey_entered = 0;
3329                 break;
3330
3331         case HCI_KEYPRESS_COMPLETED:
3332                 return;
3333         }
3334
3335         if (test_bit(HCI_MGMT, &hdev->dev_flags))
3336                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
3337                                          conn->dst_type, conn->passkey_notify,
3338                                          conn->passkey_entered);
3339 }
3340
3341 static void hci_simple_pair_complete_evt(struct hci_dev *hdev,
3342                                          struct sk_buff *skb)
3343 {
3344         struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
3345         struct hci_conn *conn;
3346
3347         BT_DBG("%s", hdev->name);
3348
3349         hci_dev_lock(hdev);
3350
3351         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3352         if (!conn)
3353                 goto unlock;
3354
3355         /* To avoid duplicate auth_failed events to user space we check
3356          * the HCI_CONN_AUTH_PEND flag which will be set if we
3357          * initiated the authentication. A traditional auth_complete
3358          * event gets always produced as initiator and is also mapped to
3359          * the mgmt_auth_failed event */
3360         if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status)
3361                 mgmt_auth_failed(hdev, &conn->dst, conn->type, conn->dst_type,
3362                                  ev->status);
3363
3364         hci_conn_put(conn);
3365
3366 unlock:
3367         hci_dev_unlock(hdev);
3368 }
3369
3370 static void hci_remote_host_features_evt(struct hci_dev *hdev,
3371                                          struct sk_buff *skb)
3372 {
3373         struct hci_ev_remote_host_features *ev = (void *) skb->data;
3374         struct inquiry_entry *ie;
3375
3376         BT_DBG("%s", hdev->name);
3377
3378         hci_dev_lock(hdev);
3379
3380         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
3381         if (ie)
3382                 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
3383
3384         hci_dev_unlock(hdev);
3385 }
3386
3387 static void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
3388                                             struct sk_buff *skb)
3389 {
3390         struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
3391         struct oob_data *data;
3392
3393         BT_DBG("%s", hdev->name);
3394
3395         hci_dev_lock(hdev);
3396
3397         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3398                 goto unlock;
3399
3400         data = hci_find_remote_oob_data(hdev, &ev->bdaddr);
3401         if (data) {
3402                 struct hci_cp_remote_oob_data_reply cp;
3403
3404                 bacpy(&cp.bdaddr, &ev->bdaddr);
3405                 memcpy(cp.hash, data->hash, sizeof(cp.hash));
3406                 memcpy(cp.randomizer, data->randomizer, sizeof(cp.randomizer));
3407
3408                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY, sizeof(cp),
3409                              &cp);
3410         } else {
3411                 struct hci_cp_remote_oob_data_neg_reply cp;
3412
3413                 bacpy(&cp.bdaddr, &ev->bdaddr);
3414                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY, sizeof(cp),
3415                              &cp);
3416         }
3417
3418 unlock:
3419         hci_dev_unlock(hdev);
3420 }
3421
3422 static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
3423 {
3424         struct hci_ev_le_conn_complete *ev = (void *) skb->data;
3425         struct hci_conn *conn;
3426
3427         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3428
3429         hci_dev_lock(hdev);
3430
3431         conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
3432         if (!conn) {
3433                 conn = hci_conn_add(hdev, LE_LINK, &ev->bdaddr);
3434                 if (!conn) {
3435                         BT_ERR("No memory for new connection");
3436                         goto unlock;
3437                 }
3438
3439                 conn->dst_type = ev->bdaddr_type;
3440
3441                 if (ev->role == LE_CONN_ROLE_MASTER) {
3442                         conn->out = true;
3443                         conn->link_mode |= HCI_LM_MASTER;
3444                 }
3445         }
3446
3447         if (ev->status) {
3448                 mgmt_connect_failed(hdev, &conn->dst, conn->type,
3449                                     conn->dst_type, ev->status);
3450                 hci_proto_connect_cfm(conn, ev->status);
3451                 conn->state = BT_CLOSED;
3452                 hci_conn_del(conn);
3453                 goto unlock;
3454         }
3455
3456         if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
3457                 mgmt_device_connected(hdev, &ev->bdaddr, conn->type,
3458                                       conn->dst_type, 0, NULL, 0, NULL);
3459
3460         conn->sec_level = BT_SECURITY_LOW;
3461         conn->handle = __le16_to_cpu(ev->handle);
3462         conn->state = BT_CONNECTED;
3463
3464         hci_conn_hold_device(conn);
3465         hci_conn_add_sysfs(conn);
3466
3467         hci_proto_connect_cfm(conn, ev->status);
3468
3469 unlock:
3470         hci_dev_unlock(hdev);
3471 }
3472
3473 static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
3474 {
3475         u8 num_reports = skb->data[0];
3476         void *ptr = &skb->data[1];
3477         s8 rssi;
3478
3479         hci_dev_lock(hdev);
3480
3481         while (num_reports--) {
3482                 struct hci_ev_le_advertising_info *ev = ptr;
3483
3484                 rssi = ev->data[ev->length];
3485                 mgmt_device_found(hdev, &ev->bdaddr, LE_LINK, ev->bdaddr_type,
3486                                   NULL, rssi, 0, 1, ev->data, ev->length);
3487
3488                 ptr += sizeof(*ev) + ev->length + 1;
3489         }
3490
3491         hci_dev_unlock(hdev);
3492 }
3493
3494 static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3495 {
3496         struct hci_ev_le_ltk_req *ev = (void *) skb->data;
3497         struct hci_cp_le_ltk_reply cp;
3498         struct hci_cp_le_ltk_neg_reply neg;
3499         struct hci_conn *conn;
3500         struct smp_ltk *ltk;
3501
3502         BT_DBG("%s handle 0x%4.4x", hdev->name, __le16_to_cpu(ev->handle));
3503
3504         hci_dev_lock(hdev);
3505
3506         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3507         if (conn == NULL)
3508                 goto not_found;
3509
3510         ltk = hci_find_ltk(hdev, ev->ediv, ev->random);
3511         if (ltk == NULL)
3512                 goto not_found;
3513
3514         memcpy(cp.ltk, ltk->val, sizeof(ltk->val));
3515         cp.handle = cpu_to_le16(conn->handle);
3516
3517         if (ltk->authenticated)
3518                 conn->sec_level = BT_SECURITY_HIGH;
3519
3520         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
3521
3522         if (ltk->type & HCI_SMP_STK) {
3523                 list_del(&ltk->list);
3524                 kfree(ltk);
3525         }
3526
3527         hci_dev_unlock(hdev);
3528
3529         return;
3530
3531 not_found:
3532         neg.handle = ev->handle;
3533         hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
3534         hci_dev_unlock(hdev);
3535 }
3536
3537 static void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
3538 {
3539         struct hci_ev_le_meta *le_ev = (void *) skb->data;
3540
3541         skb_pull(skb, sizeof(*le_ev));
3542
3543         switch (le_ev->subevent) {
3544         case HCI_EV_LE_CONN_COMPLETE:
3545                 hci_le_conn_complete_evt(hdev, skb);
3546                 break;
3547
3548         case HCI_EV_LE_ADVERTISING_REPORT:
3549                 hci_le_adv_report_evt(hdev, skb);
3550                 break;
3551
3552         case HCI_EV_LE_LTK_REQ:
3553                 hci_le_ltk_request_evt(hdev, skb);
3554                 break;
3555
3556         default:
3557                 break;
3558         }
3559 }
3560
3561 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
3562 {
3563         struct hci_event_hdr *hdr = (void *) skb->data;
3564         __u8 event = hdr->evt;
3565
3566         skb_pull(skb, HCI_EVENT_HDR_SIZE);
3567
3568         switch (event) {
3569         case HCI_EV_INQUIRY_COMPLETE:
3570                 hci_inquiry_complete_evt(hdev, skb);
3571                 break;
3572
3573         case HCI_EV_INQUIRY_RESULT:
3574                 hci_inquiry_result_evt(hdev, skb);
3575                 break;
3576
3577         case HCI_EV_CONN_COMPLETE:
3578                 hci_conn_complete_evt(hdev, skb);
3579                 break;
3580
3581         case HCI_EV_CONN_REQUEST:
3582                 hci_conn_request_evt(hdev, skb);
3583                 break;
3584
3585         case HCI_EV_DISCONN_COMPLETE:
3586                 hci_disconn_complete_evt(hdev, skb);
3587                 break;
3588
3589         case HCI_EV_AUTH_COMPLETE:
3590                 hci_auth_complete_evt(hdev, skb);
3591                 break;
3592
3593         case HCI_EV_REMOTE_NAME:
3594                 hci_remote_name_evt(hdev, skb);
3595                 break;
3596
3597         case HCI_EV_ENCRYPT_CHANGE:
3598                 hci_encrypt_change_evt(hdev, skb);
3599                 break;
3600
3601         case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
3602                 hci_change_link_key_complete_evt(hdev, skb);
3603                 break;
3604
3605         case HCI_EV_REMOTE_FEATURES:
3606                 hci_remote_features_evt(hdev, skb);
3607                 break;
3608
3609         case HCI_EV_REMOTE_VERSION:
3610                 hci_remote_version_evt(hdev, skb);
3611                 break;
3612
3613         case HCI_EV_QOS_SETUP_COMPLETE:
3614                 hci_qos_setup_complete_evt(hdev, skb);
3615                 break;
3616
3617         case HCI_EV_CMD_COMPLETE:
3618                 hci_cmd_complete_evt(hdev, skb);
3619                 break;
3620
3621         case HCI_EV_CMD_STATUS:
3622                 hci_cmd_status_evt(hdev, skb);
3623                 break;
3624
3625         case HCI_EV_ROLE_CHANGE:
3626                 hci_role_change_evt(hdev, skb);
3627                 break;
3628
3629         case HCI_EV_NUM_COMP_PKTS:
3630                 hci_num_comp_pkts_evt(hdev, skb);
3631                 break;
3632
3633         case HCI_EV_MODE_CHANGE:
3634                 hci_mode_change_evt(hdev, skb);
3635                 break;
3636
3637         case HCI_EV_PIN_CODE_REQ:
3638                 hci_pin_code_request_evt(hdev, skb);
3639                 break;
3640
3641         case HCI_EV_LINK_KEY_REQ:
3642                 hci_link_key_request_evt(hdev, skb);
3643                 break;
3644
3645         case HCI_EV_LINK_KEY_NOTIFY:
3646                 hci_link_key_notify_evt(hdev, skb);
3647                 break;
3648
3649         case HCI_EV_CLOCK_OFFSET:
3650                 hci_clock_offset_evt(hdev, skb);
3651                 break;
3652
3653         case HCI_EV_PKT_TYPE_CHANGE:
3654                 hci_pkt_type_change_evt(hdev, skb);
3655                 break;
3656
3657         case HCI_EV_PSCAN_REP_MODE:
3658                 hci_pscan_rep_mode_evt(hdev, skb);
3659                 break;
3660
3661         case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
3662                 hci_inquiry_result_with_rssi_evt(hdev, skb);
3663                 break;
3664
3665         case HCI_EV_REMOTE_EXT_FEATURES:
3666                 hci_remote_ext_features_evt(hdev, skb);
3667                 break;
3668
3669         case HCI_EV_SYNC_CONN_COMPLETE:
3670                 hci_sync_conn_complete_evt(hdev, skb);
3671                 break;
3672
3673         case HCI_EV_SYNC_CONN_CHANGED:
3674                 hci_sync_conn_changed_evt(hdev, skb);
3675                 break;
3676
3677         case HCI_EV_SNIFF_SUBRATE:
3678                 hci_sniff_subrate_evt(hdev, skb);
3679                 break;
3680
3681         case HCI_EV_EXTENDED_INQUIRY_RESULT:
3682                 hci_extended_inquiry_result_evt(hdev, skb);
3683                 break;
3684
3685         case HCI_EV_KEY_REFRESH_COMPLETE:
3686                 hci_key_refresh_complete_evt(hdev, skb);
3687                 break;
3688
3689         case HCI_EV_IO_CAPA_REQUEST:
3690                 hci_io_capa_request_evt(hdev, skb);
3691                 break;
3692
3693         case HCI_EV_IO_CAPA_REPLY:
3694                 hci_io_capa_reply_evt(hdev, skb);
3695                 break;
3696
3697         case HCI_EV_USER_CONFIRM_REQUEST:
3698                 hci_user_confirm_request_evt(hdev, skb);
3699                 break;
3700
3701         case HCI_EV_USER_PASSKEY_REQUEST:
3702                 hci_user_passkey_request_evt(hdev, skb);
3703                 break;
3704
3705         case HCI_EV_USER_PASSKEY_NOTIFY:
3706                 hci_user_passkey_notify_evt(hdev, skb);
3707                 break;
3708
3709         case HCI_EV_KEYPRESS_NOTIFY:
3710                 hci_keypress_notify_evt(hdev, skb);
3711                 break;
3712
3713         case HCI_EV_SIMPLE_PAIR_COMPLETE:
3714                 hci_simple_pair_complete_evt(hdev, skb);
3715                 break;
3716
3717         case HCI_EV_REMOTE_HOST_FEATURES:
3718                 hci_remote_host_features_evt(hdev, skb);
3719                 break;
3720
3721         case HCI_EV_LE_META:
3722                 hci_le_meta_evt(hdev, skb);
3723                 break;
3724
3725         case HCI_EV_REMOTE_OOB_DATA_REQUEST:
3726                 hci_remote_oob_data_request_evt(hdev, skb);
3727                 break;
3728
3729         case HCI_EV_NUM_COMP_BLOCKS:
3730                 hci_num_comp_blocks_evt(hdev, skb);
3731                 break;
3732
3733         default:
3734                 BT_DBG("%s event 0x%2.2x", hdev->name, event);
3735                 break;
3736         }
3737
3738         kfree_skb(skb);
3739         hdev->stat.evt_rx++;
3740 }