net/bluetooth/hci_event.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI event handling. */
  26
  27 #include <linux/module.h>
  28
  29 #include <linux/types.h>
  30 #include <linux/errno.h>
  31 #include <linux/kernel.h>
  32 #include <linux/slab.h>
  33 #include <linux/poll.h>
  34 #include <linux/fcntl.h>
  35 #include <linux/init.h>
  36 #include <linux/skbuff.h>
  37 #include <linux/interrupt.h>
  38 #include <linux/notifier.h>
  39 #include <net/sock.h>
  40
  41 #include <asm/system.h>
  42 #include <linux/uaccess.h>
  43 #include <asm/unaligned.h>
  44
  45 #include <net/bluetooth/bluetooth.h>
  46 #include <net/bluetooth/hci_core.h>
  47
  48 /* Handle HCI Event packets */
  49
  50 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
  51 {
  52         __u8 status = *((__u8 *) skb->data);
  53
  54         BT_DBG("%s status 0x%x", hdev->name, status);
  55
  56         if (status)
  57                 return;
  58
  59         clear_bit(HCI_INQUIRY, &hdev->flags);
  60
  61         hci_req_complete(hdev, HCI_OP_INQUIRY_CANCEL, status);
  62
  63         hci_conn_check_pending(hdev);
  64 }
  65
  66 static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  67 {
  68         __u8 status = *((__u8 *) skb->data);
  69
  70         BT_DBG("%s status 0x%x", hdev->name, status);
  71
  72         if (status)
  73                 return;
  74
  75         clear_bit(HCI_INQUIRY, &hdev->flags);
  76
  77         hci_conn_check_pending(hdev);
  78 }
  79
  80 static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev, struct sk_buff *skb)
  81 {
  82         BT_DBG("%s", hdev->name);
  83 }
  84
  85 static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
  86 {
  87         struct hci_rp_role_discovery *rp = (void *) skb->data;
  88         struct hci_conn *conn;
  89
  90         BT_DBG("%s status 0x%x", hdev->name, rp->status);
  91
  92         if (rp->status)
  93                 return;
  94
  95         hci_dev_lock(hdev);
  96
  97         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
  98         if (conn) {
  99                 if (rp->role)
 100                         conn->link_mode &= ~HCI_LM_MASTER;
 101                 else
 102                         conn->link_mode |= HCI_LM_MASTER;
 103         }
 104
 105         hci_dev_unlock(hdev);
 106 }
 107
 108 static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 109 {
 110         struct hci_rp_read_link_policy *rp = (void *) skb->data;
 111         struct hci_conn *conn;
 112
 113         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 114
 115         if (rp->status)
 116                 return;
 117
 118         hci_dev_lock(hdev);
 119
 120         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 121         if (conn)
 122                 conn->link_policy = __le16_to_cpu(rp->policy);
 123
 124         hci_dev_unlock(hdev);
 125 }
 126
 127 static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 128 {
 129         struct hci_rp_write_link_policy *rp = (void *) skb->data;
 130         struct hci_conn *conn;
 131         void *sent;
 132
 133         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 134
 135         if (rp->status)
 136                 return;
 137
 138         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
 139         if (!sent)
 140                 return;
 141
 142         hci_dev_lock(hdev);
 143
 144         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 145         if (conn)
 146                 conn->link_policy = get_unaligned_le16(sent + 2);
 147
 148         hci_dev_unlock(hdev);
 149 }
 150
 151 static void hci_cc_read_def_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 152 {
 153         struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
 154
 155         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 156
 157         if (rp->status)
 158                 return;
 159
 160         hdev->link_policy = __le16_to_cpu(rp->policy);
 161 }
 162
 163 static void hci_cc_write_def_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 164 {
 165         __u8 status = *((__u8 *) skb->data);
 166         void *sent;
 167
 168         BT_DBG("%s status 0x%x", hdev->name, status);
 169
 170         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
 171         if (!sent)
 172                 return;
 173
 174         if (!status)
 175                 hdev->link_policy = get_unaligned_le16(sent);
 176
 177         hci_req_complete(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, status);
 178 }
 179
 180 static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
 181 {
 182         __u8 status = *((__u8 *) skb->data);
 183
 184         BT_DBG("%s status 0x%x", hdev->name, status);
 185
 186         hci_req_complete(hdev, HCI_OP_RESET, status);
 187 }
 188
 189 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 190 {
 191         __u8 status = *((__u8 *) skb->data);
 192         void *sent;
 193
 194         BT_DBG("%s status 0x%x", hdev->name, status);
 195
 196         if (status)
 197                 return;
 198
 199         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
 200         if (!sent)
 201                 return;
 202
 203         memcpy(hdev->dev_name, sent, 248);
 204 }
 205
 206 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 207 {
 208         struct hci_rp_read_local_name *rp = (void *) skb->data;
 209
 210         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 211
 212         if (rp->status)
 213                 return;
 214
 215         memcpy(hdev->dev_name, rp->name, 248);
 216 }
 217
 218 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
 219 {
 220         __u8 status = *((__u8 *) skb->data);
 221         void *sent;
 222
 223         BT_DBG("%s status 0x%x", hdev->name, status);
 224
 225         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
 226         if (!sent)
 227                 return;
 228
 229         if (!status) {
 230                 __u8 param = *((__u8 *) sent);
 231
 232                 if (param == AUTH_ENABLED)
 233                         set_bit(HCI_AUTH, &hdev->flags);
 234                 else
 235                         clear_bit(HCI_AUTH, &hdev->flags);
 236         }
 237
 238         hci_req_complete(hdev, HCI_OP_WRITE_AUTH_ENABLE, status);
 239 }
 240
 241 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
 242 {
 243         __u8 status = *((__u8 *) skb->data);
 244         void *sent;
 245
 246         BT_DBG("%s status 0x%x", hdev->name, status);
 247
 248         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
 249         if (!sent)
 250                 return;
 251
 252         if (!status) {
 253                 __u8 param = *((__u8 *) sent);
 254
 255                 if (param)
 256                         set_bit(HCI_ENCRYPT, &hdev->flags);
 257                 else
 258                         clear_bit(HCI_ENCRYPT, &hdev->flags);
 259         }
 260
 261         hci_req_complete(hdev, HCI_OP_WRITE_ENCRYPT_MODE, status);
 262 }
 263
 264 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
 265 {
 266         __u8 status = *((__u8 *) skb->data);
 267         void *sent;
 268
 269         BT_DBG("%s status 0x%x", hdev->name, status);
 270
 271         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
 272         if (!sent)
 273                 return;
 274
 275         if (!status) {
 276                 __u8 param = *((__u8 *) sent);
 277                 int old_pscan, old_iscan;
 278
 279                 old_pscan = test_and_clear_bit(HCI_PSCAN, &hdev->flags);
 280                 old_iscan = test_and_clear_bit(HCI_ISCAN, &hdev->flags);
 281
 282                 if (param & SCAN_INQUIRY) {
 283                         set_bit(HCI_ISCAN, &hdev->flags);
 284                         if (!old_iscan)
 285                                 mgmt_discoverable(hdev->id, 1);
 286                 } else if (old_iscan)
 287                         mgmt_discoverable(hdev->id, 0);
 288
 289                 if (param & SCAN_PAGE) {
 290                         set_bit(HCI_PSCAN, &hdev->flags);
 291                         if (!old_pscan)
 292                                 mgmt_connectable(hdev->id, 1);
 293                 } else if (old_pscan)
 294                         mgmt_connectable(hdev->id, 0);
 295         }
 296
 297         hci_req_complete(hdev, HCI_OP_WRITE_SCAN_ENABLE, status);
 298 }
 299
 300 static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 301 {
 302         struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
 303
 304         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 305
 306         if (rp->status)
 307                 return;
 308
 309         memcpy(hdev->dev_class, rp->dev_class, 3);
 310
 311         BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
 312                 hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
 313 }
 314
 315 static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 316 {
 317         __u8 status = *((__u8 *) skb->data);
 318         void *sent;
 319
 320         BT_DBG("%s status 0x%x", hdev->name, status);
 321
 322         if (status)
 323                 return;
 324
 325         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
 326         if (!sent)
 327                 return;
 328
 329         memcpy(hdev->dev_class, sent, 3);
 330 }
 331
 332 static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 333 {
 334         struct hci_rp_read_voice_setting *rp = (void *) skb->data;
 335         __u16 setting;
 336
 337         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 338
 339         if (rp->status)
 340                 return;
 341
 342         setting = __le16_to_cpu(rp->voice_setting);
 343
 344         if (hdev->voice_setting == setting)
 345                 return;
 346
 347         hdev->voice_setting = setting;
 348
 349         BT_DBG("%s voice setting 0x%04x", hdev->name, setting);
 350
 351         if (hdev->notify) {
 352                 tasklet_disable(&hdev->tx_task);
 353                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 354                 tasklet_enable(&hdev->tx_task);
 355         }
 356 }
 357
 358 static void hci_cc_write_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 359 {
 360         __u8 status = *((__u8 *) skb->data);
 361         __u16 setting;
 362         void *sent;
 363
 364         BT_DBG("%s status 0x%x", hdev->name, status);
 365
 366         if (status)
 367                 return;
 368
 369         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
 370         if (!sent)
 371                 return;
 372
 373         setting = get_unaligned_le16(sent);
 374
 375         if (hdev->voice_setting == setting)
 376                 return;
 377
 378         hdev->voice_setting = setting;
 379
 380         BT_DBG("%s voice setting 0x%04x", hdev->name, setting);
 381
 382         if (hdev->notify) {
 383                 tasklet_disable(&hdev->tx_task);
 384                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 385                 tasklet_enable(&hdev->tx_task);
 386         }
 387 }
 388
 389 static void hci_cc_host_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 390 {
 391         __u8 status = *((__u8 *) skb->data);
 392
 393         BT_DBG("%s status 0x%x", hdev->name, status);
 394
 395         hci_req_complete(hdev, HCI_OP_HOST_BUFFER_SIZE, status);
 396 }
 397
 398 static void hci_cc_read_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 399 {
 400         struct hci_rp_read_ssp_mode *rp = (void *) skb->data;
 401
 402         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 403
 404         if (rp->status)
 405                 return;
 406
 407         hdev->ssp_mode = rp->mode;
 408 }
 409
 410 static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 411 {
 412         __u8 status = *((__u8 *) skb->data);
 413         void *sent;
 414
 415         BT_DBG("%s status 0x%x", hdev->name, status);
 416
 417         if (status)
 418                 return;
 419
 420         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
 421         if (!sent)
 422                 return;
 423
 424         hdev->ssp_mode = *((__u8 *) sent);
 425 }
 426
 427 static u8 hci_get_inquiry_mode(struct hci_dev *hdev)
 428 {
 429         if (hdev->features[6] & LMP_EXT_INQ)
 430                 return 2;
 431
 432         if (hdev->features[3] & LMP_RSSI_INQ)
 433                 return 1;
 434
 435         if (hdev->manufacturer == 11 && hdev->hci_rev == 0x00 &&
 436                                                 hdev->lmp_subver == 0x0757)
 437                 return 1;
 438
 439         if (hdev->manufacturer == 15) {
 440                 if (hdev->hci_rev == 0x03 && hdev->lmp_subver == 0x6963)
 441                         return 1;
 442                 if (hdev->hci_rev == 0x09 && hdev->lmp_subver == 0x6963)
 443                         return 1;
 444                 if (hdev->hci_rev == 0x00 && hdev->lmp_subver == 0x6965)
 445                         return 1;
 446         }
 447
 448         if (hdev->manufacturer == 31 && hdev->hci_rev == 0x2005 &&
 449                                                 hdev->lmp_subver == 0x1805)
 450                 return 1;
 451
 452         return 0;
 453 }
 454
 455 static void hci_setup_inquiry_mode(struct hci_dev *hdev)
 456 {
 457         u8 mode;
 458
 459         mode = hci_get_inquiry_mode(hdev);
 460
 461         hci_send_cmd(hdev, HCI_OP_WRITE_INQUIRY_MODE, 1, &mode);
 462 }
 463
 464 static void hci_setup_event_mask(struct hci_dev *hdev)
 465 {
 466         /* The second byte is 0xff instead of 0x9f (two reserved bits
 467          * disabled) since a Broadcom 1.2 dongle doesn't respond to the
 468          * command otherwise */
 469         u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };
 470
 471         /* Events for 1.2 and newer controllers */
 472         if (hdev->lmp_ver > 1) {
 473                 events[4] |= 0x01; /* Flow Specification Complete */
 474                 events[4] |= 0x02; /* Inquiry Result with RSSI */
 475                 events[4] |= 0x04; /* Read Remote Extended Features Complete */
 476                 events[5] |= 0x08; /* Synchronous Connection Complete */
 477                 events[5] |= 0x10; /* Synchronous Connection Changed */
 478         }
 479
 480         if (hdev->features[3] & LMP_RSSI_INQ)
 481                 events[4] |= 0x04; /* Inquiry Result with RSSI */
 482
 483         if (hdev->features[5] & LMP_SNIFF_SUBR)
 484                 events[5] |= 0x20; /* Sniff Subrating */
 485
 486         if (hdev->features[5] & LMP_PAUSE_ENC)
 487                 events[5] |= 0x80; /* Encryption Key Refresh Complete */
 488
 489         if (hdev->features[6] & LMP_EXT_INQ)
 490                 events[5] |= 0x40; /* Extended Inquiry Result */
 491
 492         if (hdev->features[6] & LMP_NO_FLUSH)
 493                 events[7] |= 0x01; /* Enhanced Flush Complete */
 494
 495         if (hdev->features[7] & LMP_LSTO)
 496                 events[6] |= 0x80; /* Link Supervision Timeout Changed */
 497
 498         if (hdev->features[6] & LMP_SIMPLE_PAIR) {
 499                 events[6] |= 0x01;      /* IO Capability Request */
 500                 events[6] |= 0x02;      /* IO Capability Response */
 501                 events[6] |= 0x04;      /* User Confirmation Request */
 502                 events[6] |= 0x08;      /* User Passkey Request */
 503                 events[6] |= 0x10;      /* Remote OOB Data Request */
 504                 events[6] |= 0x20;      /* Simple Pairing Complete */
 505                 events[7] |= 0x04;      /* User Passkey Notification */
 506                 events[7] |= 0x08;      /* Keypress Notification */
 507                 events[7] |= 0x10;      /* Remote Host Supported
 508                                          * Features Notification */
 509         }
 510
 511         if (hdev->features[4] & LMP_LE)
 512                 events[7] |= 0x20;      /* LE Meta-Event */
 513
 514         hci_send_cmd(hdev, HCI_OP_SET_EVENT_MASK, sizeof(events), events);
 515 }
 516
 517 static void hci_setup(struct hci_dev *hdev)
 518 {
 519         hci_setup_event_mask(hdev);
 520
 521         if (hdev->lmp_ver > 1)
 522                 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
 523
 524         if (hdev->features[6] & LMP_SIMPLE_PAIR) {
 525                 u8 mode = 0x01;
 526                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(mode), &mode);
 527         }
 528
 529         if (hdev->features[3] & LMP_RSSI_INQ)
 530                 hci_setup_inquiry_mode(hdev);
 531
 532         if (hdev->features[7] & LMP_INQ_TX_PWR)
 533                 hci_send_cmd(hdev, HCI_OP_READ_INQ_RSP_TX_POWER, 0, NULL);
 534 }
 535
 536 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
 537 {
 538         struct hci_rp_read_local_version *rp = (void *) skb->data;
 539
 540         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 541
 542         if (rp->status)
 543                 return;
 544
 545         hdev->hci_ver = rp->hci_ver;
 546         hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
 547         hdev->lmp_ver = rp->lmp_ver;
 548         hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
 549         hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
 550
 551         BT_DBG("%s manufacturer %d hci ver %d:%d", hdev->name,
 552                                         hdev->manufacturer,
 553                                         hdev->hci_ver, hdev->hci_rev);
 554
 555         if (test_bit(HCI_INIT, &hdev->flags))
 556                 hci_setup(hdev);
 557 }
 558
 559 static void hci_setup_link_policy(struct hci_dev *hdev)
 560 {
 561         u16 link_policy = 0;
 562
 563         if (hdev->features[0] & LMP_RSWITCH)
 564                 link_policy |= HCI_LP_RSWITCH;
 565         if (hdev->features[0] & LMP_HOLD)
 566                 link_policy |= HCI_LP_HOLD;
 567         if (hdev->features[0] & LMP_SNIFF)
 568                 link_policy |= HCI_LP_SNIFF;
 569         if (hdev->features[1] & LMP_PARK)
 570                 link_policy |= HCI_LP_PARK;
 571
 572         link_policy = cpu_to_le16(link_policy);
 573         hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY,
 574                                         sizeof(link_policy), &link_policy);
 575 }
 576
 577 static void hci_cc_read_local_commands(struct hci_dev *hdev, struct sk_buff *skb)
 578 {
 579         struct hci_rp_read_local_commands *rp = (void *) skb->data;
 580
 581         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 582
 583         if (rp->status)
 584                 goto done;
 585
 586         memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 587
 588         if (test_bit(HCI_INIT, &hdev->flags) && (hdev->commands[5] & 0x10))
 589                 hci_setup_link_policy(hdev);
 590
 591 done:
 592         hci_req_complete(hdev, HCI_OP_READ_LOCAL_COMMANDS, rp->status);
 593 }
 594
 595 static void hci_cc_read_local_features(struct hci_dev *hdev, struct sk_buff *skb)
 596 {
 597         struct hci_rp_read_local_features *rp = (void *) skb->data;
 598
 599         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 600
 601         if (rp->status)
 602                 return;
 603
 604         memcpy(hdev->features, rp->features, 8);
 605
 606         /* Adjust default settings according to features
 607          * supported by device. */
 608
 609         if (hdev->features[0] & LMP_3SLOT)
 610                 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 611
 612         if (hdev->features[0] & LMP_5SLOT)
 613                 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 614
 615         if (hdev->features[1] & LMP_HV2) {
 616                 hdev->pkt_type  |= (HCI_HV2);
 617                 hdev->esco_type |= (ESCO_HV2);
 618         }
 619
 620         if (hdev->features[1] & LMP_HV3) {
 621                 hdev->pkt_type  |= (HCI_HV3);
 622                 hdev->esco_type |= (ESCO_HV3);
 623         }
 624
 625         if (hdev->features[3] & LMP_ESCO)
 626                 hdev->esco_type |= (ESCO_EV3);
 627
 628         if (hdev->features[4] & LMP_EV4)
 629                 hdev->esco_type |= (ESCO_EV4);
 630
 631         if (hdev->features[4] & LMP_EV5)
 632                 hdev->esco_type |= (ESCO_EV5);
 633
 634         if (hdev->features[5] & LMP_EDR_ESCO_2M)
 635                 hdev->esco_type |= (ESCO_2EV3);
 636
 637         if (hdev->features[5] & LMP_EDR_ESCO_3M)
 638                 hdev->esco_type |= (ESCO_3EV3);
 639
 640         if (hdev->features[5] & LMP_EDR_3S_ESCO)
 641                 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
 642
 643         BT_DBG("%s features 0x%.2x%.2x%.2x%.2x%.2x%.2x%.2x%.2x", hdev->name,
 644                                         hdev->features[0], hdev->features[1],
 645                                         hdev->features[2], hdev->features[3],
 646                                         hdev->features[4], hdev->features[5],
 647                                         hdev->features[6], hdev->features[7]);
 648 }
 649
 650 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 651 {
 652         struct hci_rp_read_buffer_size *rp = (void *) skb->data;
 653
 654         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 655
 656         if (rp->status)
 657                 return;
 658
 659         hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
 660         hdev->sco_mtu  = rp->sco_mtu;
 661         hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
 662         hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
 663
 664         if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
 665                 hdev->sco_mtu  = 64;
 666                 hdev->sco_pkts = 8;
 667         }
 668
 669         hdev->acl_cnt = hdev->acl_pkts;
 670         hdev->sco_cnt = hdev->sco_pkts;
 671
 672         BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name,
 673                                         hdev->acl_mtu, hdev->acl_pkts,
 674                                         hdev->sco_mtu, hdev->sco_pkts);
 675 }
 676
 677 static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
 678 {
 679         struct hci_rp_read_bd_addr *rp = (void *) skb->data;
 680
 681         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 682
 683         if (!rp->status)
 684                 bacpy(&hdev->bdaddr, &rp->bdaddr);
 685
 686         hci_req_complete(hdev, HCI_OP_READ_BD_ADDR, rp->status);
 687 }
 688
 689 static void hci_cc_write_ca_timeout(struct hci_dev *hdev, struct sk_buff *skb)
 690 {
 691         __u8 status = *((__u8 *) skb->data);
 692
 693         BT_DBG("%s status 0x%x", hdev->name, status);
 694
 695         hci_req_complete(hdev, HCI_OP_WRITE_CA_TIMEOUT, status);
 696 }
 697
 698 static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
 699                                                         struct sk_buff *skb)
 700 {
 701         __u8 status = *((__u8 *) skb->data);
 702
 703         BT_DBG("%s status 0x%x", hdev->name, status);
 704
 705         hci_req_complete(hdev, HCI_OP_DELETE_STORED_LINK_KEY, status);
 706 }
 707
 708 static void hci_cc_set_event_mask(struct hci_dev *hdev, struct sk_buff *skb)
 709 {
 710         __u8 status = *((__u8 *) skb->data);
 711
 712         BT_DBG("%s status 0x%x", hdev->name, status);
 713
 714         hci_req_complete(hdev, HCI_OP_SET_EVENT_MASK, status);
 715 }
 716
 717 static void hci_cc_write_inquiry_mode(struct hci_dev *hdev,
 718                                                         struct sk_buff *skb)
 719 {
 720         __u8 status = *((__u8 *) skb->data);
 721
 722         BT_DBG("%s status 0x%x", hdev->name, status);
 723
 724         hci_req_complete(hdev, HCI_OP_WRITE_INQUIRY_MODE, status);
 725 }
 726
 727 static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
 728                                                         struct sk_buff *skb)
 729 {
 730         __u8 status = *((__u8 *) skb->data);
 731
 732         BT_DBG("%s status 0x%x", hdev->name, status);
 733
 734         hci_req_complete(hdev, HCI_OP_READ_INQ_RSP_TX_POWER, status);
 735 }
 736
 737 static void hci_cc_set_event_flt(struct hci_dev *hdev, struct sk_buff *skb)
 738 {
 739         __u8 status = *((__u8 *) skb->data);
 740
 741         BT_DBG("%s status 0x%x", hdev->name, status);
 742
 743         hci_req_complete(hdev, HCI_OP_SET_EVENT_FLT, status);
 744 }
 745
 746 static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
 747 {
 748         struct hci_rp_pin_code_reply *rp = (void *) skb->data;
 749         struct hci_cp_pin_code_reply *cp;
 750         struct hci_conn *conn;
 751
 752         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 753
 754         if (test_bit(HCI_MGMT, &hdev->flags))
 755                 mgmt_pin_code_reply_complete(hdev->id, &rp->bdaddr, rp->status);
 756
 757         if (rp->status != 0)
 758                 return;
 759
 760         cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
 761         if (!cp)
 762                 return;
 763
 764         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 765         if (conn)
 766                 conn->pin_length = cp->pin_len;
 767 }
 768
 769 static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
 770 {
 771         struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
 772
 773         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 774
 775         if (test_bit(HCI_MGMT, &hdev->flags))
 776                 mgmt_pin_code_neg_reply_complete(hdev->id, &rp->bdaddr,
 777                                                                 rp->status);
 778 }
 779 static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
 780                                        struct sk_buff *skb)
 781 {
 782         struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
 783
 784         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 785
 786         if (rp->status)
 787                 return;
 788
 789         hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
 790         hdev->le_pkts = rp->le_max_pkt;
 791
 792         hdev->le_cnt = hdev->le_pkts;
 793
 794         BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
 795
 796         hci_req_complete(hdev, HCI_OP_LE_READ_BUFFER_SIZE, rp->status);
 797 }
 798
 799 static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
 800 {
 801         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 802
 803         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 804
 805         if (test_bit(HCI_MGMT, &hdev->flags))
 806                 mgmt_user_confirm_reply_complete(hdev->id, &rp->bdaddr,
 807                                                                 rp->status);
 808 }
 809
 810 static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
 811                                                         struct sk_buff *skb)
 812 {
 813         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 814
 815         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 816
 817         if (test_bit(HCI_MGMT, &hdev->flags))
 818                 mgmt_user_confirm_neg_reply_complete(hdev->id, &rp->bdaddr,
 819                                                                 rp->status);
 820 }
 821
 822 static inline void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
 823 {
 824         BT_DBG("%s status 0x%x", hdev->name, status);
 825
 826         if (status) {
 827                 hci_req_complete(hdev, HCI_OP_INQUIRY, status);
 828
 829                 hci_conn_check_pending(hdev);
 830         } else
 831                 set_bit(HCI_INQUIRY, &hdev->flags);
 832 }
 833
 834 static inline void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
 835 {
 836         struct hci_cp_create_conn *cp;
 837         struct hci_conn *conn;
 838
 839         BT_DBG("%s status 0x%x", hdev->name, status);
 840
 841         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
 842         if (!cp)
 843                 return;
 844
 845         hci_dev_lock(hdev);
 846
 847         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 848
 849         BT_DBG("%s bdaddr %s conn %p", hdev->name, batostr(&cp->bdaddr), conn);
 850
 851         if (status) {
 852                 if (conn && conn->state == BT_CONNECT) {
 853                         if (status != 0x0c || conn->attempt > 2) {
 854                                 conn->state = BT_CLOSED;
 855                                 hci_proto_connect_cfm(conn, status);
 856                                 hci_conn_del(conn);
 857                         } else
 858                                 conn->state = BT_CONNECT2;
 859                 }
 860         } else {
 861                 if (!conn) {
 862                         conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr);
 863                         if (conn) {
 864                                 conn->out = 1;
 865                                 conn->link_mode |= HCI_LM_MASTER;
 866                         } else
 867                                 BT_ERR("No memory for new connection");
 868                 }
 869         }
 870
 871         hci_dev_unlock(hdev);
 872 }
 873
 874 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
 875 {
 876         struct hci_cp_add_sco *cp;
 877         struct hci_conn *acl, *sco;
 878         __u16 handle;
 879
 880         BT_DBG("%s status 0x%x", hdev->name, status);
 881
 882         if (!status)
 883                 return;
 884
 885         cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
 886         if (!cp)
 887                 return;
 888
 889         handle = __le16_to_cpu(cp->handle);
 890
 891         BT_DBG("%s handle %d", hdev->name, handle);
 892
 893         hci_dev_lock(hdev);
 894
 895         acl = hci_conn_hash_lookup_handle(hdev, handle);
 896         if (acl) {
 897                 sco = acl->link;
 898                 if (sco) {
 899                         sco->state = BT_CLOSED;
 900
 901                         hci_proto_connect_cfm(sco, status);
 902                         hci_conn_del(sco);
 903                 }
 904         }
 905
 906         hci_dev_unlock(hdev);
 907 }
 908
 909 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
 910 {
 911         struct hci_cp_auth_requested *cp;
 912         struct hci_conn *conn;
 913
 914         BT_DBG("%s status 0x%x", hdev->name, status);
 915
 916         if (!status)
 917                 return;
 918
 919         cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
 920         if (!cp)
 921                 return;
 922
 923         hci_dev_lock(hdev);
 924
 925         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
 926         if (conn) {
 927                 if (conn->state == BT_CONFIG) {
 928                         hci_proto_connect_cfm(conn, status);
 929                         hci_conn_put(conn);
 930                 }
 931         }
 932
 933         hci_dev_unlock(hdev);
 934 }
 935
 936 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
 937 {
 938         struct hci_cp_set_conn_encrypt *cp;
 939         struct hci_conn *conn;
 940
 941         BT_DBG("%s status 0x%x", hdev->name, status);
 942
 943         if (!status)
 944                 return;
 945
 946         cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
 947         if (!cp)
 948                 return;
 949
 950         hci_dev_lock(hdev);
 951
 952         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
 953         if (conn) {
 954                 if (conn->state == BT_CONFIG) {
 955                         hci_proto_connect_cfm(conn, status);
 956                         hci_conn_put(conn);
 957                 }
 958         }
 959
 960         hci_dev_unlock(hdev);
 961 }
 962
 963 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
 964                                                         struct hci_conn *conn)
 965 {
 966         if (conn->state != BT_CONFIG || !conn->out)
 967                 return 0;
 968
 969         if (conn->pending_sec_level == BT_SECURITY_SDP)
 970                 return 0;
 971
 972         /* Only request authentication for SSP connections or non-SSP
 973          * devices with sec_level HIGH */
 974         if (!(hdev->ssp_mode > 0 && conn->ssp_mode > 0) &&
 975                                 conn->pending_sec_level != BT_SECURITY_HIGH)
 976                 return 0;
 977
 978         return 1;
 979 }
 980
 981 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
 982 {
 983         struct hci_cp_remote_name_req *cp;
 984         struct hci_conn *conn;
 985
 986         BT_DBG("%s status 0x%x", hdev->name, status);
 987
 988         /* If successful wait for the name req complete event before
 989          * checking for the need to do authentication */
 990         if (!status)
 991                 return;
 992
 993         cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
 994         if (!cp)
 995                 return;
 996
 997         hci_dev_lock(hdev);
 998
 999         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1000         if (conn && hci_outgoing_auth_needed(hdev, conn)) {
1001                 struct hci_cp_auth_requested cp;
1002                 cp.handle = __cpu_to_le16(conn->handle);
1003                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
1004         }
1005
1006         hci_dev_unlock(hdev);
1007 }
1008
1009 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
1010 {
1011         struct hci_cp_read_remote_features *cp;
1012         struct hci_conn *conn;
1013
1014         BT_DBG("%s status 0x%x", hdev->name, status);
1015
1016         if (!status)
1017                 return;
1018
1019         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
1020         if (!cp)
1021                 return;
1022
1023         hci_dev_lock(hdev);
1024
1025         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1026         if (conn) {
1027                 if (conn->state == BT_CONFIG) {
1028                         hci_proto_connect_cfm(conn, status);
1029                         hci_conn_put(conn);
1030                 }
1031         }
1032
1033         hci_dev_unlock(hdev);
1034 }
1035
1036 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
1037 {
1038         struct hci_cp_read_remote_ext_features *cp;
1039         struct hci_conn *conn;
1040
1041         BT_DBG("%s status 0x%x", hdev->name, status);
1042
1043         if (!status)
1044                 return;
1045
1046         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
1047         if (!cp)
1048                 return;
1049
1050         hci_dev_lock(hdev);
1051
1052         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1053         if (conn) {
1054                 if (conn->state == BT_CONFIG) {
1055                         hci_proto_connect_cfm(conn, status);
1056                         hci_conn_put(conn);
1057                 }
1058         }
1059
1060         hci_dev_unlock(hdev);
1061 }
1062
1063 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
1064 {
1065         struct hci_cp_setup_sync_conn *cp;
1066         struct hci_conn *acl, *sco;
1067         __u16 handle;
1068
1069         BT_DBG("%s status 0x%x", hdev->name, status);
1070
1071         if (!status)
1072                 return;
1073
1074         cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
1075         if (!cp)
1076                 return;
1077
1078         handle = __le16_to_cpu(cp->handle);
1079
1080         BT_DBG("%s handle %d", hdev->name, handle);
1081
1082         hci_dev_lock(hdev);
1083
1084         acl = hci_conn_hash_lookup_handle(hdev, handle);
1085         if (acl) {
1086                 sco = acl->link;
1087                 if (sco) {
1088                         sco->state = BT_CLOSED;
1089
1090                         hci_proto_connect_cfm(sco, status);
1091                         hci_conn_del(sco);
1092                 }
1093         }
1094
1095         hci_dev_unlock(hdev);
1096 }
1097
1098 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
1099 {
1100         struct hci_cp_sniff_mode *cp;
1101         struct hci_conn *conn;
1102
1103         BT_DBG("%s status 0x%x", hdev->name, status);
1104
1105         if (!status)
1106                 return;
1107
1108         cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
1109         if (!cp)
1110                 return;
1111
1112         hci_dev_lock(hdev);
1113
1114         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1115         if (conn) {
1116                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend);
1117
1118                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->pend))
1119                         hci_sco_setup(conn, status);
1120         }
1121
1122         hci_dev_unlock(hdev);
1123 }
1124
1125 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
1126 {
1127         struct hci_cp_exit_sniff_mode *cp;
1128         struct hci_conn *conn;
1129
1130         BT_DBG("%s status 0x%x", hdev->name, status);
1131
1132         if (!status)
1133                 return;
1134
1135         cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
1136         if (!cp)
1137                 return;
1138
1139         hci_dev_lock(hdev);
1140
1141         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1142         if (conn) {
1143                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend);
1144
1145                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->pend))
1146                         hci_sco_setup(conn, status);
1147         }
1148
1149         hci_dev_unlock(hdev);
1150 }
1151
1152 static void hci_cs_le_create_conn(struct hci_dev *hdev, __u8 status)
1153 {
1154         struct hci_cp_le_create_conn *cp;
1155         struct hci_conn *conn;
1156
1157         BT_DBG("%s status 0x%x", hdev->name, status);
1158
1159         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
1160         if (!cp)
1161                 return;
1162
1163         hci_dev_lock(hdev);
1164
1165         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->peer_addr);
1166
1167         BT_DBG("%s bdaddr %s conn %p", hdev->name, batostr(&cp->peer_addr),
1168                 conn);
1169
1170         if (status) {
1171                 if (conn && conn->state == BT_CONNECT) {
1172                         conn->state = BT_CLOSED;
1173                         hci_proto_connect_cfm(conn, status);
1174                         hci_conn_del(conn);
1175                 }
1176         } else {
1177                 if (!conn) {
1178                         conn = hci_conn_add(hdev, LE_LINK, &cp->peer_addr);
1179                         if (conn)
1180                                 conn->out = 1;
1181                         else
1182                                 BT_ERR("No memory for new connection");
1183                 }
1184         }
1185
1186         hci_dev_unlock(hdev);
1187 }
1188
1189 static inline void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1190 {
1191         __u8 status = *((__u8 *) skb->data);
1192
1193         BT_DBG("%s status %d", hdev->name, status);
1194
1195         clear_bit(HCI_INQUIRY, &hdev->flags);
1196
1197         hci_req_complete(hdev, HCI_OP_INQUIRY, status);
1198
1199         hci_conn_check_pending(hdev);
1200 }
1201
1202 static inline void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
1203 {
1204         struct inquiry_data data;
1205         struct inquiry_info *info = (void *) (skb->data + 1);
1206         int num_rsp = *((__u8 *) skb->data);
1207
1208         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
1209
1210         if (!num_rsp)
1211                 return;
1212
1213         hci_dev_lock(hdev);
1214
1215         for (; num_rsp; num_rsp--) {
1216                 bacpy(&data.bdaddr, &info->bdaddr);
1217                 data.pscan_rep_mode     = info->pscan_rep_mode;
1218                 data.pscan_period_mode  = info->pscan_period_mode;
1219                 data.pscan_mode         = info->pscan_mode;
1220                 memcpy(data.dev_class, info->dev_class, 3);
1221                 data.clock_offset       = info->clock_offset;
1222                 data.rssi               = 0x00;
1223                 data.ssp_mode           = 0x00;
1224                 info++;
1225                 hci_inquiry_cache_update(hdev, &data);
1226         }
1227
1228         hci_dev_unlock(hdev);
1229 }
1230
1231 static inline void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1232 {
1233         struct hci_ev_conn_complete *ev = (void *) skb->data;
1234         struct hci_conn *conn;
1235
1236         BT_DBG("%s", hdev->name);
1237
1238         hci_dev_lock(hdev);
1239
1240         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
1241         if (!conn) {
1242                 if (ev->link_type != SCO_LINK)
1243                         goto unlock;
1244
1245                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
1246                 if (!conn)
1247                         goto unlock;
1248
1249                 conn->type = SCO_LINK;
1250         }
1251
1252         if (!ev->status) {
1253                 conn->handle = __le16_to_cpu(ev->handle);
1254
1255                 if (conn->type == ACL_LINK) {
1256                         conn->state = BT_CONFIG;
1257                         hci_conn_hold(conn);
1258                         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
1259                         mgmt_connected(hdev->id, &ev->bdaddr);
1260                 } else
1261                         conn->state = BT_CONNECTED;
1262
1263                 hci_conn_hold_device(conn);
1264                 hci_conn_add_sysfs(conn);
1265
1266                 if (test_bit(HCI_AUTH, &hdev->flags))
1267                         conn->link_mode |= HCI_LM_AUTH;
1268
1269                 if (test_bit(HCI_ENCRYPT, &hdev->flags))
1270                         conn->link_mode |= HCI_LM_ENCRYPT;
1271
1272                 /* Get remote features */
1273                 if (conn->type == ACL_LINK) {
1274                         struct hci_cp_read_remote_features cp;
1275                         cp.handle = ev->handle;
1276                         hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
1277                                                         sizeof(cp), &cp);
1278                 }
1279
1280                 /* Set packet type for incoming connection */
1281                 if (!conn->out && hdev->hci_ver < 3) {
1282                         struct hci_cp_change_conn_ptype cp;
1283                         cp.handle = ev->handle;
1284                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
1285                         hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE,
1286                                                         sizeof(cp), &cp);
1287                 }
1288         } else {
1289                 conn->state = BT_CLOSED;
1290                 if (conn->type == ACL_LINK)
1291                         mgmt_connect_failed(hdev->id, &ev->bdaddr, ev->status);
1292         }
1293
1294         if (conn->type == ACL_LINK)
1295                 hci_sco_setup(conn, ev->status);
1296
1297         if (ev->status) {
1298                 hci_proto_connect_cfm(conn, ev->status);
1299                 hci_conn_del(conn);
1300         } else if (ev->link_type != ACL_LINK)
1301                 hci_proto_connect_cfm(conn, ev->status);
1302
1303 unlock:
1304         hci_dev_unlock(hdev);
1305
1306         hci_conn_check_pending(hdev);
1307 }
1308
1309 static inline void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
1310 {
1311         struct hci_ev_conn_request *ev = (void *) skb->data;
1312         int mask = hdev->link_mode;
1313
1314         BT_DBG("%s bdaddr %s type 0x%x", hdev->name,
1315                                         batostr(&ev->bdaddr), ev->link_type);
1316
1317         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type);
1318
1319         if ((mask & HCI_LM_ACCEPT) &&
1320                         !hci_blacklist_lookup(hdev, &ev->bdaddr)) {
1321                 /* Connection accepted */
1322                 struct inquiry_entry *ie;
1323                 struct hci_conn *conn;
1324
1325                 hci_dev_lock(hdev);
1326
1327                 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
1328                 if (ie)
1329                         memcpy(ie->data.dev_class, ev->dev_class, 3);
1330
1331                 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
1332                 if (!conn) {
1333                         conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr);
1334                         if (!conn) {
1335                                 BT_ERR("No memory for new connection");
1336                                 hci_dev_unlock(hdev);
1337                                 return;
1338                         }
1339                 }
1340
1341                 memcpy(conn->dev_class, ev->dev_class, 3);
1342                 conn->state = BT_CONNECT;
1343
1344                 hci_dev_unlock(hdev);
1345
1346                 if (ev->link_type == ACL_LINK || !lmp_esco_capable(hdev)) {
1347                         struct hci_cp_accept_conn_req cp;
1348
1349                         bacpy(&cp.bdaddr, &ev->bdaddr);
1350
1351                         if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
1352                                 cp.role = 0x00; /* Become master */
1353                         else
1354                                 cp.role = 0x01; /* Remain slave */
1355
1356                         hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ,
1357                                                         sizeof(cp), &cp);
1358                 } else {
1359                         struct hci_cp_accept_sync_conn_req cp;
1360
1361                         bacpy(&cp.bdaddr, &ev->bdaddr);
1362                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
1363
1364                         cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
1365                         cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
1366                         cp.max_latency    = cpu_to_le16(0xffff);
1367                         cp.content_format = cpu_to_le16(hdev->voice_setting);
1368                         cp.retrans_effort = 0xff;
1369
1370                         hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ,
1371                                                         sizeof(cp), &cp);
1372                 }
1373         } else {
1374                 /* Connection rejected */
1375                 struct hci_cp_reject_conn_req cp;
1376
1377                 bacpy(&cp.bdaddr, &ev->bdaddr);
1378                 cp.reason = 0x0f;
1379                 hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
1380         }
1381 }
1382
1383 static inline void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1384 {
1385         struct hci_ev_disconn_complete *ev = (void *) skb->data;
1386         struct hci_conn *conn;
1387
1388         BT_DBG("%s status %d", hdev->name, ev->status);
1389
1390         if (ev->status) {
1391                 mgmt_disconnect_failed(hdev->id);
1392                 return;
1393         }
1394
1395         hci_dev_lock(hdev);
1396
1397         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1398         if (!conn)
1399                 goto unlock;
1400
1401         conn->state = BT_CLOSED;
1402
1403         if (conn->type == ACL_LINK)
1404                 mgmt_disconnected(hdev->id, &conn->dst);
1405
1406         hci_proto_disconn_cfm(conn, ev->reason);
1407         hci_conn_del(conn);
1408
1409 unlock:
1410         hci_dev_unlock(hdev);
1411 }
1412
1413 static inline void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1414 {
1415         struct hci_ev_auth_complete *ev = (void *) skb->data;
1416         struct hci_conn *conn;
1417
1418         BT_DBG("%s status %d", hdev->name, ev->status);
1419
1420         hci_dev_lock(hdev);
1421
1422         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1423         if (conn) {
1424                 if (!ev->status) {
1425                         conn->link_mode |= HCI_LM_AUTH;
1426                         conn->sec_level = conn->pending_sec_level;
1427                 } else
1428                         conn->sec_level = BT_SECURITY_LOW;
1429
1430                 clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
1431
1432                 if (conn->state == BT_CONFIG) {
1433                         if (!ev->status && hdev->ssp_mode > 0 &&
1434                                                         conn->ssp_mode > 0) {
1435                                 struct hci_cp_set_conn_encrypt cp;
1436                                 cp.handle  = ev->handle;
1437                                 cp.encrypt = 0x01;
1438                                 hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT,
1439                                                         sizeof(cp), &cp);
1440                         } else {
1441                                 conn->state = BT_CONNECTED;
1442                                 hci_proto_connect_cfm(conn, ev->status);
1443                                 hci_conn_put(conn);
1444                         }
1445                 } else {
1446                         hci_auth_cfm(conn, ev->status);
1447
1448                         hci_conn_hold(conn);
1449                         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
1450                         hci_conn_put(conn);
1451                 }
1452
1453                 if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend)) {
1454                         if (!ev->status) {
1455                                 struct hci_cp_set_conn_encrypt cp;
1456                                 cp.handle  = ev->handle;
1457                                 cp.encrypt = 0x01;
1458                                 hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT,
1459                                                         sizeof(cp), &cp);
1460                         } else {
1461                                 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
1462                                 hci_encrypt_cfm(conn, ev->status, 0x00);
1463                         }
1464                 }
1465         }
1466
1467         hci_dev_unlock(hdev);
1468 }
1469
1470 static inline void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
1471 {
1472         struct hci_ev_remote_name *ev = (void *) skb->data;
1473         struct hci_conn *conn;
1474
1475         BT_DBG("%s", hdev->name);
1476
1477         hci_conn_check_pending(hdev);
1478
1479         hci_dev_lock(hdev);
1480
1481         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
1482         if (conn && hci_outgoing_auth_needed(hdev, conn)) {
1483                 struct hci_cp_auth_requested cp;
1484                 cp.handle = __cpu_to_le16(conn->handle);
1485                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
1486         }
1487
1488         hci_dev_unlock(hdev);
1489 }
1490
1491 static inline void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
1492 {
1493         struct hci_ev_encrypt_change *ev = (void *) skb->data;
1494         struct hci_conn *conn;
1495
1496         BT_DBG("%s status %d", hdev->name, ev->status);
1497
1498         hci_dev_lock(hdev);
1499
1500         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1501         if (conn) {
1502                 if (!ev->status) {
1503                         if (ev->encrypt) {
1504                                 /* Encryption implies authentication */
1505                                 conn->link_mode |= HCI_LM_AUTH;
1506                                 conn->link_mode |= HCI_LM_ENCRYPT;
1507                         } else
1508                                 conn->link_mode &= ~HCI_LM_ENCRYPT;
1509                 }
1510
1511                 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
1512
1513                 if (conn->state == BT_CONFIG) {
1514                         if (!ev->status)
1515                                 conn->state = BT_CONNECTED;
1516
1517                         hci_proto_connect_cfm(conn, ev->status);
1518                         hci_conn_put(conn);
1519                 } else
1520                         hci_encrypt_cfm(conn, ev->status, ev->encrypt);
1521         }
1522
1523         hci_dev_unlock(hdev);
1524 }
1525
1526 static inline void hci_change_link_key_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1527 {
1528         struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
1529         struct hci_conn *conn;
1530
1531         BT_DBG("%s status %d", hdev->name, ev->status);
1532
1533         hci_dev_lock(hdev);
1534
1535         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1536         if (conn) {
1537                 if (!ev->status)
1538                         conn->link_mode |= HCI_LM_SECURE;
1539
1540                 clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
1541
1542                 hci_key_change_cfm(conn, ev->status);
1543         }
1544
1545         hci_dev_unlock(hdev);
1546 }
1547
1548 static inline void hci_remote_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
1549 {
1550         struct hci_ev_remote_features *ev = (void *) skb->data;
1551         struct hci_conn *conn;
1552
1553         BT_DBG("%s status %d", hdev->name, ev->status);
1554
1555         hci_dev_lock(hdev);
1556
1557         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1558         if (!conn)
1559                 goto unlock;
1560
1561         if (!ev->status)
1562                 memcpy(conn->features, ev->features, 8);
1563
1564         if (conn->state != BT_CONFIG)
1565                 goto unlock;
1566
1567         if (!ev->status && lmp_ssp_capable(hdev) && lmp_ssp_capable(conn)) {
1568                 struct hci_cp_read_remote_ext_features cp;
1569                 cp.handle = ev->handle;
1570                 cp.page = 0x01;
1571                 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
1572                                                         sizeof(cp), &cp);
1573                 goto unlock;
1574         }
1575
1576         if (!ev->status) {
1577                 struct hci_cp_remote_name_req cp;
1578                 memset(&cp, 0, sizeof(cp));
1579                 bacpy(&cp.bdaddr, &conn->dst);
1580                 cp.pscan_rep_mode = 0x02;
1581                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1582         }
1583
1584         if (!hci_outgoing_auth_needed(hdev, conn)) {
1585                 conn->state = BT_CONNECTED;
1586                 hci_proto_connect_cfm(conn, ev->status);
1587                 hci_conn_put(conn);
1588         }
1589
1590 unlock:
1591         hci_dev_unlock(hdev);
1592 }
1593
1594 static inline void hci_remote_version_evt(struct hci_dev *hdev, struct sk_buff *skb)
1595 {
1596         BT_DBG("%s", hdev->name);
1597 }
1598
1599 static inline void hci_qos_setup_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1600 {
1601         BT_DBG("%s", hdev->name);
1602 }
1603
1604 static inline void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1605 {
1606         struct hci_ev_cmd_complete *ev = (void *) skb->data;
1607         __u16 opcode;
1608
1609         skb_pull(skb, sizeof(*ev));
1610
1611         opcode = __le16_to_cpu(ev->opcode);
1612
1613         switch (opcode) {
1614         case HCI_OP_INQUIRY_CANCEL:
1615                 hci_cc_inquiry_cancel(hdev, skb);
1616                 break;
1617
1618         case HCI_OP_EXIT_PERIODIC_INQ:
1619                 hci_cc_exit_periodic_inq(hdev, skb);
1620                 break;
1621
1622         case HCI_OP_REMOTE_NAME_REQ_CANCEL:
1623                 hci_cc_remote_name_req_cancel(hdev, skb);
1624                 break;
1625
1626         case HCI_OP_ROLE_DISCOVERY:
1627                 hci_cc_role_discovery(hdev, skb);
1628                 break;
1629
1630         case HCI_OP_READ_LINK_POLICY:
1631                 hci_cc_read_link_policy(hdev, skb);
1632                 break;
1633
1634         case HCI_OP_WRITE_LINK_POLICY:
1635                 hci_cc_write_link_policy(hdev, skb);
1636                 break;
1637
1638         case HCI_OP_READ_DEF_LINK_POLICY:
1639                 hci_cc_read_def_link_policy(hdev, skb);
1640                 break;
1641
1642         case HCI_OP_WRITE_DEF_LINK_POLICY:
1643                 hci_cc_write_def_link_policy(hdev, skb);
1644                 break;
1645
1646         case HCI_OP_RESET:
1647                 hci_cc_reset(hdev, skb);
1648                 break;
1649
1650         case HCI_OP_WRITE_LOCAL_NAME:
1651                 hci_cc_write_local_name(hdev, skb);
1652                 break;
1653
1654         case HCI_OP_READ_LOCAL_NAME:
1655                 hci_cc_read_local_name(hdev, skb);
1656                 break;
1657
1658         case HCI_OP_WRITE_AUTH_ENABLE:
1659                 hci_cc_write_auth_enable(hdev, skb);
1660                 break;
1661
1662         case HCI_OP_WRITE_ENCRYPT_MODE:
1663                 hci_cc_write_encrypt_mode(hdev, skb);
1664                 break;
1665
1666         case HCI_OP_WRITE_SCAN_ENABLE:
1667                 hci_cc_write_scan_enable(hdev, skb);
1668                 break;
1669
1670         case HCI_OP_READ_CLASS_OF_DEV:
1671                 hci_cc_read_class_of_dev(hdev, skb);
1672                 break;
1673
1674         case HCI_OP_WRITE_CLASS_OF_DEV:
1675                 hci_cc_write_class_of_dev(hdev, skb);
1676                 break;
1677
1678         case HCI_OP_READ_VOICE_SETTING:
1679                 hci_cc_read_voice_setting(hdev, skb);
1680                 break;
1681
1682         case HCI_OP_WRITE_VOICE_SETTING:
1683                 hci_cc_write_voice_setting(hdev, skb);
1684                 break;
1685
1686         case HCI_OP_HOST_BUFFER_SIZE:
1687                 hci_cc_host_buffer_size(hdev, skb);
1688                 break;
1689
1690         case HCI_OP_READ_SSP_MODE:
1691                 hci_cc_read_ssp_mode(hdev, skb);
1692                 break;
1693
1694         case HCI_OP_WRITE_SSP_MODE:
1695                 hci_cc_write_ssp_mode(hdev, skb);
1696                 break;
1697
1698         case HCI_OP_READ_LOCAL_VERSION:
1699                 hci_cc_read_local_version(hdev, skb);
1700                 break;
1701
1702         case HCI_OP_READ_LOCAL_COMMANDS:
1703                 hci_cc_read_local_commands(hdev, skb);
1704                 break;
1705
1706         case HCI_OP_READ_LOCAL_FEATURES:
1707                 hci_cc_read_local_features(hdev, skb);
1708                 break;
1709
1710         case HCI_OP_READ_BUFFER_SIZE:
1711                 hci_cc_read_buffer_size(hdev, skb);
1712                 break;
1713
1714         case HCI_OP_READ_BD_ADDR:
1715                 hci_cc_read_bd_addr(hdev, skb);
1716                 break;
1717
1718         case HCI_OP_WRITE_CA_TIMEOUT:
1719                 hci_cc_write_ca_timeout(hdev, skb);
1720                 break;
1721
1722         case HCI_OP_DELETE_STORED_LINK_KEY:
1723                 hci_cc_delete_stored_link_key(hdev, skb);
1724                 break;
1725
1726         case HCI_OP_SET_EVENT_MASK:
1727                 hci_cc_set_event_mask(hdev, skb);
1728                 break;
1729
1730         case HCI_OP_WRITE_INQUIRY_MODE:
1731                 hci_cc_write_inquiry_mode(hdev, skb);
1732                 break;
1733
1734         case HCI_OP_READ_INQ_RSP_TX_POWER:
1735                 hci_cc_read_inq_rsp_tx_power(hdev, skb);
1736                 break;
1737
1738         case HCI_OP_SET_EVENT_FLT:
1739                 hci_cc_set_event_flt(hdev, skb);
1740                 break;
1741
1742         case HCI_OP_PIN_CODE_REPLY:
1743                 hci_cc_pin_code_reply(hdev, skb);
1744                 break;
1745
1746         case HCI_OP_PIN_CODE_NEG_REPLY:
1747                 hci_cc_pin_code_neg_reply(hdev, skb);
1748                 break;
1749
1750         case HCI_OP_LE_READ_BUFFER_SIZE:
1751                 hci_cc_le_read_buffer_size(hdev, skb);
1752                 break;
1753
1754         case HCI_OP_USER_CONFIRM_REPLY:
1755                 hci_cc_user_confirm_reply(hdev, skb);
1756                 break;
1757
1758         case HCI_OP_USER_CONFIRM_NEG_REPLY:
1759                 hci_cc_user_confirm_neg_reply(hdev, skb);
1760                 break;
1761
1762         default:
1763                 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
1764                 break;
1765         }
1766
1767         if (ev->opcode != HCI_OP_NOP)
1768                 del_timer(&hdev->cmd_timer);
1769
1770         if (ev->ncmd) {
1771                 atomic_set(&hdev->cmd_cnt, 1);
1772                 if (!skb_queue_empty(&hdev->cmd_q))
1773                         tasklet_schedule(&hdev->cmd_task);
1774         }
1775 }
1776
1777 static inline void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb)
1778 {
1779         struct hci_ev_cmd_status *ev = (void *) skb->data;
1780         __u16 opcode;
1781
1782         skb_pull(skb, sizeof(*ev));
1783
1784         opcode = __le16_to_cpu(ev->opcode);
1785
1786         switch (opcode) {
1787         case HCI_OP_INQUIRY:
1788                 hci_cs_inquiry(hdev, ev->status);
1789                 break;
1790
1791         case HCI_OP_CREATE_CONN:
1792                 hci_cs_create_conn(hdev, ev->status);
1793                 break;
1794
1795         case HCI_OP_ADD_SCO:
1796                 hci_cs_add_sco(hdev, ev->status);
1797                 break;
1798
1799         case HCI_OP_AUTH_REQUESTED:
1800                 hci_cs_auth_requested(hdev, ev->status);
1801                 break;
1802
1803         case HCI_OP_SET_CONN_ENCRYPT:
1804                 hci_cs_set_conn_encrypt(hdev, ev->status);
1805                 break;
1806
1807         case HCI_OP_REMOTE_NAME_REQ:
1808                 hci_cs_remote_name_req(hdev, ev->status);
1809                 break;
1810
1811         case HCI_OP_READ_REMOTE_FEATURES:
1812                 hci_cs_read_remote_features(hdev, ev->status);
1813                 break;
1814
1815         case HCI_OP_READ_REMOTE_EXT_FEATURES:
1816                 hci_cs_read_remote_ext_features(hdev, ev->status);
1817                 break;
1818
1819         case HCI_OP_SETUP_SYNC_CONN:
1820                 hci_cs_setup_sync_conn(hdev, ev->status);
1821                 break;
1822
1823         case HCI_OP_SNIFF_MODE:
1824                 hci_cs_sniff_mode(hdev, ev->status);
1825                 break;
1826
1827         case HCI_OP_EXIT_SNIFF_MODE:
1828                 hci_cs_exit_sniff_mode(hdev, ev->status);
1829                 break;
1830
1831         case HCI_OP_DISCONNECT:
1832                 if (ev->status != 0)
1833                         mgmt_disconnect_failed(hdev->id);
1834                 break;
1835
1836         case HCI_OP_LE_CREATE_CONN:
1837                 hci_cs_le_create_conn(hdev, ev->status);
1838                 break;
1839
1840         default:
1841                 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
1842                 break;
1843         }
1844
1845         if (ev->opcode != HCI_OP_NOP)
1846                 del_timer(&hdev->cmd_timer);
1847
1848         if (ev->ncmd) {
1849                 atomic_set(&hdev->cmd_cnt, 1);
1850                 if (!skb_queue_empty(&hdev->cmd_q))
1851                         tasklet_schedule(&hdev->cmd_task);
1852         }
1853 }
1854
1855 static inline void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
1856 {
1857         struct hci_ev_role_change *ev = (void *) skb->data;
1858         struct hci_conn *conn;
1859
1860         BT_DBG("%s status %d", hdev->name, ev->status);
1861
1862         hci_dev_lock(hdev);
1863
1864         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
1865         if (conn) {
1866                 if (!ev->status) {
1867                         if (ev->role)
1868                                 conn->link_mode &= ~HCI_LM_MASTER;
1869                         else
1870                                 conn->link_mode |= HCI_LM_MASTER;
1871                 }
1872
1873                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->pend);
1874
1875                 hci_role_switch_cfm(conn, ev->status, ev->role);
1876         }
1877
1878         hci_dev_unlock(hdev);
1879 }
1880
1881 static inline void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
1882 {
1883         struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
1884         __le16 *ptr;
1885         int i;
1886
1887         skb_pull(skb, sizeof(*ev));
1888
1889         BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
1890
1891         if (skb->len < ev->num_hndl * 4) {
1892                 BT_DBG("%s bad parameters", hdev->name);
1893                 return;
1894         }
1895
1896         tasklet_disable(&hdev->tx_task);
1897
1898         for (i = 0, ptr = (__le16 *) skb->data; i < ev->num_hndl; i++) {
1899                 struct hci_conn *conn;
1900                 __u16  handle, count;
1901
1902                 handle = get_unaligned_le16(ptr++);
1903                 count  = get_unaligned_le16(ptr++);
1904
1905                 conn = hci_conn_hash_lookup_handle(hdev, handle);
1906                 if (conn) {
1907                         conn->sent -= count;
1908
1909                         if (conn->type == ACL_LINK) {
1910                                 hdev->acl_cnt += count;
1911                                 if (hdev->acl_cnt > hdev->acl_pkts)
1912                                         hdev->acl_cnt = hdev->acl_pkts;
1913                         } else if (conn->type == LE_LINK) {
1914                                 if (hdev->le_pkts) {
1915                                         hdev->le_cnt += count;
1916                                         if (hdev->le_cnt > hdev->le_pkts)
1917                                                 hdev->le_cnt = hdev->le_pkts;
1918                                 } else {
1919                                         hdev->acl_cnt += count;
1920                                         if (hdev->acl_cnt > hdev->acl_pkts)
1921                                                 hdev->acl_cnt = hdev->acl_pkts;
1922                                 }
1923                         } else {
1924                                 hdev->sco_cnt += count;
1925                                 if (hdev->sco_cnt > hdev->sco_pkts)
1926                                         hdev->sco_cnt = hdev->sco_pkts;
1927                         }
1928                 }
1929         }
1930
1931         tasklet_schedule(&hdev->tx_task);
1932
1933         tasklet_enable(&hdev->tx_task);
1934 }
1935
1936 static inline void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
1937 {
1938         struct hci_ev_mode_change *ev = (void *) skb->data;
1939         struct hci_conn *conn;
1940
1941         BT_DBG("%s status %d", hdev->name, ev->status);
1942
1943         hci_dev_lock(hdev);
1944
1945         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1946         if (conn) {
1947                 conn->mode = ev->mode;
1948                 conn->interval = __le16_to_cpu(ev->interval);
1949
1950                 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
1951                         if (conn->mode == HCI_CM_ACTIVE)
1952                                 conn->power_save = 1;
1953                         else
1954                                 conn->power_save = 0;
1955                 }
1956
1957                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->pend))
1958                         hci_sco_setup(conn, ev->status);
1959         }
1960
1961         hci_dev_unlock(hdev);
1962 }
1963
1964 static inline void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
1965 {
1966         struct hci_ev_pin_code_req *ev = (void *) skb->data;
1967         struct hci_conn *conn;
1968
1969         BT_DBG("%s", hdev->name);
1970
1971         hci_dev_lock(hdev);
1972
1973         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
1974         if (conn && conn->state == BT_CONNECTED) {
1975                 hci_conn_hold(conn);
1976                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
1977                 hci_conn_put(conn);
1978         }
1979
1980         if (!test_bit(HCI_PAIRABLE, &hdev->flags))
1981                 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
1982                                         sizeof(ev->bdaddr), &ev->bdaddr);
1983
1984         if (test_bit(HCI_MGMT, &hdev->flags))
1985                 mgmt_pin_code_request(hdev->id, &ev->bdaddr);
1986
1987         hci_dev_unlock(hdev);
1988 }
1989
1990 static inline void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
1991 {
1992         struct hci_ev_link_key_req *ev = (void *) skb->data;
1993         struct hci_cp_link_key_reply cp;
1994         struct hci_conn *conn;
1995         struct link_key *key;
1996
1997         BT_DBG("%s", hdev->name);
1998
1999         if (!test_bit(HCI_LINK_KEYS, &hdev->flags))
2000                 return;
2001
2002         hci_dev_lock(hdev);
2003
2004         key = hci_find_link_key(hdev, &ev->bdaddr);
2005         if (!key) {
2006                 BT_DBG("%s link key not found for %s", hdev->name,
2007                                                         batostr(&ev->bdaddr));
2008                 goto not_found;
2009         }
2010
2011         BT_DBG("%s found key type %u for %s", hdev->name, key->type,
2012                                                         batostr(&ev->bdaddr));
2013
2014         if (!test_bit(HCI_DEBUG_KEYS, &hdev->flags) && key->type == 0x03) {
2015                 BT_DBG("%s ignoring debug key", hdev->name);
2016                 goto not_found;
2017         }
2018
2019         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2020
2021         if (key->type == 0x04 && conn && conn->auth_type != 0xff &&
2022                                                 (conn->auth_type & 0x01)) {
2023                 BT_DBG("%s ignoring unauthenticated key", hdev->name);
2024                 goto not_found;
2025         }
2026
2027         bacpy(&cp.bdaddr, &ev->bdaddr);
2028         memcpy(cp.link_key, key->val, 16);
2029
2030         hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
2031
2032         hci_dev_unlock(hdev);
2033
2034         return;
2035
2036 not_found:
2037         hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
2038         hci_dev_unlock(hdev);
2039 }
2040
2041 static inline void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
2042 {
2043         struct hci_ev_link_key_notify *ev = (void *) skb->data;
2044         struct hci_conn *conn;
2045         u8 pin_len = 0;
2046
2047         BT_DBG("%s", hdev->name);
2048
2049         hci_dev_lock(hdev);
2050
2051         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2052         if (conn) {
2053                 hci_conn_hold(conn);
2054                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2055                 pin_len = conn->pin_length;
2056                 hci_conn_put(conn);
2057         }
2058
2059         if (test_bit(HCI_LINK_KEYS, &hdev->flags))
2060                 hci_add_link_key(hdev, 1, &ev->bdaddr, ev->link_key,
2061                                                         ev->key_type, pin_len);
2062
2063         hci_dev_unlock(hdev);
2064 }
2065
2066 static inline void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
2067 {
2068         struct hci_ev_clock_offset *ev = (void *) skb->data;
2069         struct hci_conn *conn;
2070
2071         BT_DBG("%s status %d", hdev->name, ev->status);
2072
2073         hci_dev_lock(hdev);
2074
2075         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2076         if (conn && !ev->status) {
2077                 struct inquiry_entry *ie;
2078
2079                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
2080                 if (ie) {
2081                         ie->data.clock_offset = ev->clock_offset;
2082                         ie->timestamp = jiffies;
2083                 }
2084         }
2085
2086         hci_dev_unlock(hdev);
2087 }
2088
2089 static inline void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2090 {
2091         struct hci_ev_pkt_type_change *ev = (void *) skb->data;
2092         struct hci_conn *conn;
2093
2094         BT_DBG("%s status %d", hdev->name, ev->status);
2095
2096         hci_dev_lock(hdev);
2097
2098         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2099         if (conn && !ev->status)
2100                 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
2101
2102         hci_dev_unlock(hdev);
2103 }
2104
2105 static inline void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
2106 {
2107         struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
2108         struct inquiry_entry *ie;
2109
2110         BT_DBG("%s", hdev->name);
2111
2112         hci_dev_lock(hdev);
2113
2114         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2115         if (ie) {
2116                 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
2117                 ie->timestamp = jiffies;
2118         }
2119
2120         hci_dev_unlock(hdev);
2121 }
2122
2123 static inline void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, struct sk_buff *skb)
2124 {
2125         struct inquiry_data data;
2126         int num_rsp = *((__u8 *) skb->data);
2127
2128         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2129
2130         if (!num_rsp)
2131                 return;
2132
2133         hci_dev_lock(hdev);
2134
2135         if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
2136                 struct inquiry_info_with_rssi_and_pscan_mode *info;
2137                 info = (void *) (skb->data + 1);
2138
2139                 for (; num_rsp; num_rsp--) {
2140                         bacpy(&data.bdaddr, &info->bdaddr);
2141                         data.pscan_rep_mode     = info->pscan_rep_mode;
2142                         data.pscan_period_mode  = info->pscan_period_mode;
2143                         data.pscan_mode         = info->pscan_mode;
2144                         memcpy(data.dev_class, info->dev_class, 3);
2145                         data.clock_offset       = info->clock_offset;
2146                         data.rssi               = info->rssi;
2147                         data.ssp_mode           = 0x00;
2148                         info++;
2149                         hci_inquiry_cache_update(hdev, &data);
2150                 }
2151         } else {
2152                 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
2153
2154                 for (; num_rsp; num_rsp--) {
2155                         bacpy(&data.bdaddr, &info->bdaddr);
2156                         data.pscan_rep_mode     = info->pscan_rep_mode;
2157                         data.pscan_period_mode  = info->pscan_period_mode;
2158                         data.pscan_mode         = 0x00;
2159                         memcpy(data.dev_class, info->dev_class, 3);
2160                         data.clock_offset       = info->clock_offset;
2161                         data.rssi               = info->rssi;
2162                         data.ssp_mode           = 0x00;
2163                         info++;
2164                         hci_inquiry_cache_update(hdev, &data);
2165                 }
2166         }
2167
2168         hci_dev_unlock(hdev);
2169 }
2170
2171 static inline void hci_remote_ext_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
2172 {
2173         struct hci_ev_remote_ext_features *ev = (void *) skb->data;
2174         struct hci_conn *conn;
2175
2176         BT_DBG("%s", hdev->name);
2177
2178         hci_dev_lock(hdev);
2179
2180         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2181         if (!conn)
2182                 goto unlock;
2183
2184         if (!ev->status && ev->page == 0x01) {
2185                 struct inquiry_entry *ie;
2186
2187                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
2188                 if (ie)
2189                         ie->data.ssp_mode = (ev->features[0] & 0x01);
2190
2191                 conn->ssp_mode = (ev->features[0] & 0x01);
2192         }
2193
2194         if (conn->state != BT_CONFIG)
2195                 goto unlock;
2196
2197         if (!ev->status) {
2198                 struct hci_cp_remote_name_req cp;
2199                 memset(&cp, 0, sizeof(cp));
2200                 bacpy(&cp.bdaddr, &conn->dst);
2201                 cp.pscan_rep_mode = 0x02;
2202                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2203         }
2204
2205         if (!hci_outgoing_auth_needed(hdev, conn)) {
2206                 conn->state = BT_CONNECTED;
2207                 hci_proto_connect_cfm(conn, ev->status);
2208                 hci_conn_put(conn);
2209         }
2210
2211 unlock:
2212         hci_dev_unlock(hdev);
2213 }
2214
2215 static inline void hci_sync_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2216 {
2217         struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
2218         struct hci_conn *conn;
2219
2220         BT_DBG("%s status %d", hdev->name, ev->status);
2221
2222         hci_dev_lock(hdev);
2223
2224         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
2225         if (!conn) {
2226                 if (ev->link_type == ESCO_LINK)
2227                         goto unlock;
2228
2229                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
2230                 if (!conn)
2231                         goto unlock;
2232
2233                 conn->type = SCO_LINK;
2234         }
2235
2236         switch (ev->status) {
2237         case 0x00:
2238                 conn->handle = __le16_to_cpu(ev->handle);
2239                 conn->state  = BT_CONNECTED;
2240
2241                 hci_conn_hold_device(conn);
2242                 hci_conn_add_sysfs(conn);
2243                 break;
2244
2245         case 0x11:      /* Unsupported Feature or Parameter Value */
2246         case 0x1c:      /* SCO interval rejected */
2247         case 0x1a:      /* Unsupported Remote Feature */
2248         case 0x1f:      /* Unspecified error */
2249                 if (conn->out && conn->attempt < 2) {
2250                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
2251                                         (hdev->esco_type & EDR_ESCO_MASK);
2252                         hci_setup_sync(conn, conn->link->handle);
2253                         goto unlock;
2254                 }
2255                 /* fall through */
2256
2257         default:
2258                 conn->state = BT_CLOSED;
2259                 break;
2260         }
2261
2262         hci_proto_connect_cfm(conn, ev->status);
2263         if (ev->status)
2264                 hci_conn_del(conn);
2265
2266 unlock:
2267         hci_dev_unlock(hdev);
2268 }
2269
2270 static inline void hci_sync_conn_changed_evt(struct hci_dev *hdev, struct sk_buff *skb)
2271 {
2272         BT_DBG("%s", hdev->name);
2273 }
2274
2275 static inline void hci_sniff_subrate_evt(struct hci_dev *hdev, struct sk_buff *skb)
2276 {
2277         struct hci_ev_sniff_subrate *ev = (void *) skb->data;
2278
2279         BT_DBG("%s status %d", hdev->name, ev->status);
2280 }
2281
2282 static inline void hci_extended_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
2283 {
2284         struct inquiry_data data;
2285         struct extended_inquiry_info *info = (void *) (skb->data + 1);
2286         int num_rsp = *((__u8 *) skb->data);
2287
2288         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2289
2290         if (!num_rsp)
2291                 return;
2292
2293         hci_dev_lock(hdev);
2294
2295         for (; num_rsp; num_rsp--) {
2296                 bacpy(&data.bdaddr, &info->bdaddr);
2297                 data.pscan_rep_mode     = info->pscan_rep_mode;
2298                 data.pscan_period_mode  = info->pscan_period_mode;
2299                 data.pscan_mode         = 0x00;
2300                 memcpy(data.dev_class, info->dev_class, 3);
2301                 data.clock_offset       = info->clock_offset;
2302                 data.rssi               = info->rssi;
2303                 data.ssp_mode           = 0x01;
2304                 info++;
2305                 hci_inquiry_cache_update(hdev, &data);
2306         }
2307
2308         hci_dev_unlock(hdev);
2309 }
2310
2311 static inline u8 hci_get_auth_req(struct hci_conn *conn)
2312 {
2313         /* If remote requests dedicated bonding follow that lead */
2314         if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03) {
2315                 /* If both remote and local IO capabilities allow MITM
2316                  * protection then require it, otherwise don't */
2317                 if (conn->remote_cap == 0x03 || conn->io_capability == 0x03)
2318                         return 0x02;
2319                 else
2320                         return 0x03;
2321         }
2322
2323         /* If remote requests no-bonding follow that lead */
2324         if (conn->remote_auth == 0x00 || conn->remote_auth == 0x01)
2325                 return 0x00;
2326
2327         return conn->auth_type;
2328 }
2329
2330 static inline void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2331 {
2332         struct hci_ev_io_capa_request *ev = (void *) skb->data;
2333         struct hci_conn *conn;
2334
2335         BT_DBG("%s", hdev->name);
2336
2337         hci_dev_lock(hdev);
2338
2339         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2340         if (!conn)
2341                 goto unlock;
2342
2343         hci_conn_hold(conn);
2344
2345         if (!test_bit(HCI_MGMT, &hdev->flags))
2346                 goto unlock;
2347
2348         if (test_bit(HCI_PAIRABLE, &hdev->flags) ||
2349                         (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
2350                 struct hci_cp_io_capability_reply cp;
2351
2352                 bacpy(&cp.bdaddr, &ev->bdaddr);
2353                 cp.capability = conn->io_capability;
2354                 cp.oob_data = 0;
2355                 cp.authentication = hci_get_auth_req(conn);
2356
2357                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
2358                                                         sizeof(cp), &cp);
2359         } else {
2360                 struct hci_cp_io_capability_neg_reply cp;
2361
2362                 bacpy(&cp.bdaddr, &ev->bdaddr);
2363                 cp.reason = 0x16; /* Pairing not allowed */
2364
2365                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
2366                                                         sizeof(cp), &cp);
2367         }
2368
2369 unlock:
2370         hci_dev_unlock(hdev);
2371 }
2372
2373 static inline void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
2374 {
2375         struct hci_ev_io_capa_reply *ev = (void *) skb->data;
2376         struct hci_conn *conn;
2377
2378         BT_DBG("%s", hdev->name);
2379
2380         hci_dev_lock(hdev);
2381
2382         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2383         if (!conn)
2384                 goto unlock;
2385
2386         hci_conn_hold(conn);
2387
2388         conn->remote_cap = ev->capability;
2389         conn->remote_oob = ev->oob_data;
2390         conn->remote_auth = ev->authentication;
2391
2392 unlock:
2393         hci_dev_unlock(hdev);
2394 }
2395
2396 static inline void hci_user_confirm_request_evt(struct hci_dev *hdev,
2397                                                         struct sk_buff *skb)
2398 {
2399         struct hci_ev_user_confirm_req *ev = (void *) skb->data;
2400
2401         BT_DBG("%s", hdev->name);
2402
2403         hci_dev_lock(hdev);
2404
2405         if (test_bit(HCI_MGMT, &hdev->flags))
2406                 mgmt_user_confirm_request(hdev->id, &ev->bdaddr, ev->passkey);
2407
2408         hci_dev_unlock(hdev);
2409 }
2410
2411 static inline void hci_simple_pair_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2412 {
2413         struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
2414         struct hci_conn *conn;
2415
2416         BT_DBG("%s", hdev->name);
2417
2418         hci_dev_lock(hdev);
2419
2420         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2421         if (conn)
2422                 hci_conn_put(conn);
2423
2424         hci_dev_unlock(hdev);
2425 }
2426
2427 static inline void hci_remote_host_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
2428 {
2429         struct hci_ev_remote_host_features *ev = (void *) skb->data;
2430         struct inquiry_entry *ie;
2431
2432         BT_DBG("%s", hdev->name);
2433
2434         hci_dev_lock(hdev);
2435
2436         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2437         if (ie)
2438                 ie->data.ssp_mode = (ev->features[0] & 0x01);
2439
2440         hci_dev_unlock(hdev);
2441 }
2442
2443 static inline void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2444 {
2445         struct hci_ev_le_conn_complete *ev = (void *) skb->data;
2446         struct hci_conn *conn;
2447
2448         BT_DBG("%s status %d", hdev->name, ev->status);
2449
2450         hci_dev_lock(hdev);
2451
2452         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &ev->bdaddr);
2453         if (!conn) {
2454                 conn = hci_conn_add(hdev, LE_LINK, &ev->bdaddr);
2455                 if (!conn) {
2456                         BT_ERR("No memory for new connection");
2457                         hci_dev_unlock(hdev);
2458                         return;
2459                 }
2460         }
2461
2462         if (ev->status) {
2463                 hci_proto_connect_cfm(conn, ev->status);
2464                 conn->state = BT_CLOSED;
2465                 hci_conn_del(conn);
2466                 goto unlock;
2467         }
2468
2469         conn->handle = __le16_to_cpu(ev->handle);
2470         conn->state = BT_CONNECTED;
2471
2472         hci_conn_hold_device(conn);
2473         hci_conn_add_sysfs(conn);
2474
2475         hci_proto_connect_cfm(conn, ev->status);
2476
2477 unlock:
2478         hci_dev_unlock(hdev);
2479 }
2480
2481 static inline void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
2482 {
2483         struct hci_ev_le_meta *le_ev = (void *) skb->data;
2484
2485         skb_pull(skb, sizeof(*le_ev));
2486
2487         switch (le_ev->subevent) {
2488         case HCI_EV_LE_CONN_COMPLETE:
2489                 hci_le_conn_complete_evt(hdev, skb);
2490                 break;
2491
2492         default:
2493                 break;
2494         }
2495 }
2496
2497 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
2498 {
2499         struct hci_event_hdr *hdr = (void *) skb->data;
2500         __u8 event = hdr->evt;
2501
2502         skb_pull(skb, HCI_EVENT_HDR_SIZE);
2503
2504         switch (event) {
2505         case HCI_EV_INQUIRY_COMPLETE:
2506                 hci_inquiry_complete_evt(hdev, skb);
2507                 break;
2508
2509         case HCI_EV_INQUIRY_RESULT:
2510                 hci_inquiry_result_evt(hdev, skb);
2511                 break;
2512
2513         case HCI_EV_CONN_COMPLETE:
2514                 hci_conn_complete_evt(hdev, skb);
2515                 break;
2516
2517         case HCI_EV_CONN_REQUEST:
2518                 hci_conn_request_evt(hdev, skb);
2519                 break;
2520
2521         case HCI_EV_DISCONN_COMPLETE:
2522                 hci_disconn_complete_evt(hdev, skb);
2523                 break;
2524
2525         case HCI_EV_AUTH_COMPLETE:
2526                 hci_auth_complete_evt(hdev, skb);
2527                 break;
2528
2529         case HCI_EV_REMOTE_NAME:
2530                 hci_remote_name_evt(hdev, skb);
2531                 break;
2532
2533         case HCI_EV_ENCRYPT_CHANGE:
2534                 hci_encrypt_change_evt(hdev, skb);
2535                 break;
2536
2537         case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
2538                 hci_change_link_key_complete_evt(hdev, skb);
2539                 break;
2540
2541         case HCI_EV_REMOTE_FEATURES:
2542                 hci_remote_features_evt(hdev, skb);
2543                 break;
2544
2545         case HCI_EV_REMOTE_VERSION:
2546                 hci_remote_version_evt(hdev, skb);
2547                 break;
2548
2549         case HCI_EV_QOS_SETUP_COMPLETE:
2550                 hci_qos_setup_complete_evt(hdev, skb);
2551                 break;
2552
2553         case HCI_EV_CMD_COMPLETE:
2554                 hci_cmd_complete_evt(hdev, skb);
2555                 break;
2556
2557         case HCI_EV_CMD_STATUS:
2558                 hci_cmd_status_evt(hdev, skb);
2559                 break;
2560
2561         case HCI_EV_ROLE_CHANGE:
2562                 hci_role_change_evt(hdev, skb);
2563                 break;
2564
2565         case HCI_EV_NUM_COMP_PKTS:
2566                 hci_num_comp_pkts_evt(hdev, skb);
2567                 break;
2568
2569         case HCI_EV_MODE_CHANGE:
2570                 hci_mode_change_evt(hdev, skb);
2571                 break;
2572
2573         case HCI_EV_PIN_CODE_REQ:
2574                 hci_pin_code_request_evt(hdev, skb);
2575                 break;
2576
2577         case HCI_EV_LINK_KEY_REQ:
2578                 hci_link_key_request_evt(hdev, skb);
2579                 break;
2580
2581         case HCI_EV_LINK_KEY_NOTIFY:
2582                 hci_link_key_notify_evt(hdev, skb);
2583                 break;
2584
2585         case HCI_EV_CLOCK_OFFSET:
2586                 hci_clock_offset_evt(hdev, skb);
2587                 break;
2588
2589         case HCI_EV_PKT_TYPE_CHANGE:
2590                 hci_pkt_type_change_evt(hdev, skb);
2591                 break;
2592
2593         case HCI_EV_PSCAN_REP_MODE:
2594                 hci_pscan_rep_mode_evt(hdev, skb);
2595                 break;
2596
2597         case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
2598                 hci_inquiry_result_with_rssi_evt(hdev, skb);
2599                 break;
2600
2601         case HCI_EV_REMOTE_EXT_FEATURES:
2602                 hci_remote_ext_features_evt(hdev, skb);
2603                 break;
2604
2605         case HCI_EV_SYNC_CONN_COMPLETE:
2606                 hci_sync_conn_complete_evt(hdev, skb);
2607                 break;
2608
2609         case HCI_EV_SYNC_CONN_CHANGED:
2610                 hci_sync_conn_changed_evt(hdev, skb);
2611                 break;
2612
2613         case HCI_EV_SNIFF_SUBRATE:
2614                 hci_sniff_subrate_evt(hdev, skb);
2615                 break;
2616
2617         case HCI_EV_EXTENDED_INQUIRY_RESULT:
2618                 hci_extended_inquiry_result_evt(hdev, skb);
2619                 break;
2620
2621         case HCI_EV_IO_CAPA_REQUEST:
2622                 hci_io_capa_request_evt(hdev, skb);
2623                 break;
2624
2625         case HCI_EV_IO_CAPA_REPLY:
2626                 hci_io_capa_reply_evt(hdev, skb);
2627                 break;
2628
2629         case HCI_EV_USER_CONFIRM_REQUEST:
2630                 hci_user_confirm_request_evt(hdev, skb);
2631                 break;
2632
2633         case HCI_EV_SIMPLE_PAIR_COMPLETE:
2634                 hci_simple_pair_complete_evt(hdev, skb);
2635                 break;
2636
2637         case HCI_EV_REMOTE_HOST_FEATURES:
2638                 hci_remote_host_features_evt(hdev, skb);
2639                 break;
2640
2641         case HCI_EV_LE_META:
2642                 hci_le_meta_evt(hdev, skb);
2643                 break;
2644
2645         default:
2646                 BT_DBG("%s event 0x%x", hdev->name, event);
2647                 break;
2648         }
2649
2650         kfree_skb(skb);
2651         hdev->stat.evt_rx++;
2652 }
2653
2654 /* Generate internal stack event */
2655 void hci_si_event(struct hci_dev *hdev, int type, int dlen, void *data)
2656 {
2657         struct hci_event_hdr *hdr;
2658         struct hci_ev_stack_internal *ev;
2659         struct sk_buff *skb;
2660
2661         skb = bt_skb_alloc(HCI_EVENT_HDR_SIZE + sizeof(*ev) + dlen, GFP_ATOMIC);
2662         if (!skb)
2663                 return;
2664
2665         hdr = (void *) skb_put(skb, HCI_EVENT_HDR_SIZE);
2666         hdr->evt  = HCI_EV_STACK_INTERNAL;
2667         hdr->plen = sizeof(*ev) + dlen;
2668
2669         ev  = (void *) skb_put(skb, sizeof(*ev) + dlen);
2670         ev->type = type;
2671         memcpy(ev->data, data, dlen);
2672
2673         bt_cb(skb)->incoming = 1;
2674         __net_timestamp(skb);
2675
2676         bt_cb(skb)->pkt_type = HCI_EVENT_PKT;
2677         skb->dev = (void *) hdev;
2678         hci_send_to_sock(hdev, skb, NULL);
2679         kfree_skb(skb);
2680 }