net/bluetooth/hci_event.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2000-2001 Qualcomm Incorporated
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI event handling. */
  26
  27 #include <linux/module.h>
  28
  29 #include <linux/types.h>
  30 #include <linux/errno.h>
  31 #include <linux/kernel.h>
  32 #include <linux/slab.h>
  33 #include <linux/poll.h>
  34 #include <linux/fcntl.h>
  35 #include <linux/init.h>
  36 #include <linux/skbuff.h>
  37 #include <linux/interrupt.h>
  38 #include <linux/notifier.h>
  39 #include <net/sock.h>
  40
  41 #include <asm/system.h>
  42 #include <asm/uaccess.h>
  43 #include <asm/unaligned.h>
  44
  45 #include <net/bluetooth/bluetooth.h>
  46 #include <net/bluetooth/hci_core.h>
  47
  48 /* Handle HCI Event packets */
  49
  50 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
  51 {
  52         __u8 status = *((__u8 *) skb->data);
  53
  54         BT_DBG("%s status 0x%x", hdev->name, status);
  55
  56         if (status)
  57                 return;
  58
  59         clear_bit(HCI_INQUIRY, &hdev->flags);
  60
  61         hci_req_complete(hdev, status);
  62
  63         hci_conn_check_pending(hdev);
  64 }
  65
  66 static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  67 {
  68         __u8 status = *((__u8 *) skb->data);
  69
  70         BT_DBG("%s status 0x%x", hdev->name, status);
  71
  72         if (status)
  73                 return;
  74
  75         clear_bit(HCI_INQUIRY, &hdev->flags);
  76
  77         hci_conn_check_pending(hdev);
  78 }
  79
  80 static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev, struct sk_buff *skb)
  81 {
  82         BT_DBG("%s", hdev->name);
  83 }
  84
  85 static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
  86 {
  87         struct hci_rp_role_discovery *rp = (void *) skb->data;
  88         struct hci_conn *conn;
  89
  90         BT_DBG("%s status 0x%x", hdev->name, rp->status);
  91
  92         if (rp->status)
  93                 return;
  94
  95         hci_dev_lock(hdev);
  96
  97         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
  98         if (conn) {
  99                 if (rp->role)
 100                         conn->link_mode &= ~HCI_LM_MASTER;
 101                 else
 102                         conn->link_mode |= HCI_LM_MASTER;
 103         }
 104
 105         hci_dev_unlock(hdev);
 106 }
 107
 108 static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 109 {
 110         struct hci_rp_read_link_policy *rp = (void *) skb->data;
 111         struct hci_conn *conn;
 112
 113         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 114
 115         if (rp->status)
 116                 return;
 117
 118         hci_dev_lock(hdev);
 119
 120         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 121         if (conn)
 122                 conn->link_policy = __le16_to_cpu(rp->policy);
 123
 124         hci_dev_unlock(hdev);
 125 }
 126
 127 static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 128 {
 129         struct hci_rp_write_link_policy *rp = (void *) skb->data;
 130         struct hci_conn *conn;
 131         void *sent;
 132
 133         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 134
 135         if (rp->status)
 136                 return;
 137
 138         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
 139         if (!sent)
 140                 return;
 141
 142         hci_dev_lock(hdev);
 143
 144         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 145         if (conn)
 146                 conn->link_policy = get_unaligned_le16(sent + 2);
 147
 148         hci_dev_unlock(hdev);
 149 }
 150
 151 static void hci_cc_read_def_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 152 {
 153         struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
 154
 155         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 156
 157         if (rp->status)
 158                 return;
 159
 160         hdev->link_policy = __le16_to_cpu(rp->policy);
 161 }
 162
 163 static void hci_cc_write_def_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 164 {
 165         __u8 status = *((__u8 *) skb->data);
 166         void *sent;
 167
 168         BT_DBG("%s status 0x%x", hdev->name, status);
 169
 170         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
 171         if (!sent)
 172                 return;
 173
 174         if (!status)
 175                 hdev->link_policy = get_unaligned_le16(sent);
 176
 177         hci_req_complete(hdev, status);
 178 }
 179
 180 static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
 181 {
 182         __u8 status = *((__u8 *) skb->data);
 183
 184         BT_DBG("%s status 0x%x", hdev->name, status);
 185
 186         hci_req_complete(hdev, status);
 187 }
 188
 189 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 190 {
 191         __u8 status = *((__u8 *) skb->data);
 192         void *sent;
 193
 194         BT_DBG("%s status 0x%x", hdev->name, status);
 195
 196         if (status)
 197                 return;
 198
 199         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
 200         if (!sent)
 201                 return;
 202
 203         memcpy(hdev->dev_name, sent, 248);
 204 }
 205
 206 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 207 {
 208         struct hci_rp_read_local_name *rp = (void *) skb->data;
 209
 210         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 211
 212         if (rp->status)
 213                 return;
 214
 215         memcpy(hdev->dev_name, rp->name, 248);
 216 }
 217
 218 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
 219 {
 220         __u8 status = *((__u8 *) skb->data);
 221         void *sent;
 222
 223         BT_DBG("%s status 0x%x", hdev->name, status);
 224
 225         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
 226         if (!sent)
 227                 return;
 228
 229         if (!status) {
 230                 __u8 param = *((__u8 *) sent);
 231
 232                 if (param == AUTH_ENABLED)
 233                         set_bit(HCI_AUTH, &hdev->flags);
 234                 else
 235                         clear_bit(HCI_AUTH, &hdev->flags);
 236         }
 237
 238         hci_req_complete(hdev, status);
 239 }
 240
 241 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
 242 {
 243         __u8 status = *((__u8 *) skb->data);
 244         void *sent;
 245
 246         BT_DBG("%s status 0x%x", hdev->name, status);
 247
 248         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
 249         if (!sent)
 250                 return;
 251
 252         if (!status) {
 253                 __u8 param = *((__u8 *) sent);
 254
 255                 if (param)
 256                         set_bit(HCI_ENCRYPT, &hdev->flags);
 257                 else
 258                         clear_bit(HCI_ENCRYPT, &hdev->flags);
 259         }
 260
 261         hci_req_complete(hdev, status);
 262 }
 263
 264 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
 265 {
 266         __u8 status = *((__u8 *) skb->data);
 267         void *sent;
 268
 269         BT_DBG("%s status 0x%x", hdev->name, status);
 270
 271         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
 272         if (!sent)
 273                 return;
 274
 275         if (!status) {
 276                 __u8 param = *((__u8 *) sent);
 277
 278                 clear_bit(HCI_PSCAN, &hdev->flags);
 279                 clear_bit(HCI_ISCAN, &hdev->flags);
 280
 281                 if (param & SCAN_INQUIRY)
 282                         set_bit(HCI_ISCAN, &hdev->flags);
 283
 284                 if (param & SCAN_PAGE)
 285                         set_bit(HCI_PSCAN, &hdev->flags);
 286         }
 287
 288         hci_req_complete(hdev, status);
 289 }
 290
 291 static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 292 {
 293         struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
 294
 295         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 296
 297         if (rp->status)
 298                 return;
 299
 300         memcpy(hdev->dev_class, rp->dev_class, 3);
 301
 302         BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
 303                 hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
 304 }
 305
 306 static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 307 {
 308         __u8 status = *((__u8 *) skb->data);
 309         void *sent;
 310
 311         BT_DBG("%s status 0x%x", hdev->name, status);
 312
 313         if (status)
 314                 return;
 315
 316         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
 317         if (!sent)
 318                 return;
 319
 320         memcpy(hdev->dev_class, sent, 3);
 321 }
 322
 323 static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 324 {
 325         struct hci_rp_read_voice_setting *rp = (void *) skb->data;
 326         __u16 setting;
 327
 328         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 329
 330         if (rp->status)
 331                 return;
 332
 333         setting = __le16_to_cpu(rp->voice_setting);
 334
 335         if (hdev->voice_setting == setting)
 336                 return;
 337
 338         hdev->voice_setting = setting;
 339
 340         BT_DBG("%s voice setting 0x%04x", hdev->name, setting);
 341
 342         if (hdev->notify) {
 343                 tasklet_disable(&hdev->tx_task);
 344                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 345                 tasklet_enable(&hdev->tx_task);
 346         }
 347 }
 348
 349 static void hci_cc_write_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 350 {
 351         __u8 status = *((__u8 *) skb->data);
 352         __u16 setting;
 353         void *sent;
 354
 355         BT_DBG("%s status 0x%x", hdev->name, status);
 356
 357         if (status)
 358                 return;
 359
 360         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
 361         if (!sent)
 362                 return;
 363
 364         setting = get_unaligned_le16(sent);
 365
 366         if (hdev->voice_setting == setting)
 367                 return;
 368
 369         hdev->voice_setting = setting;
 370
 371         BT_DBG("%s voice setting 0x%04x", hdev->name, setting);
 372
 373         if (hdev->notify) {
 374                 tasklet_disable(&hdev->tx_task);
 375                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 376                 tasklet_enable(&hdev->tx_task);
 377         }
 378 }
 379
 380 static void hci_cc_host_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 381 {
 382         __u8 status = *((__u8 *) skb->data);
 383
 384         BT_DBG("%s status 0x%x", hdev->name, status);
 385
 386         hci_req_complete(hdev, status);
 387 }
 388
 389 static void hci_cc_read_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 390 {
 391         struct hci_rp_read_ssp_mode *rp = (void *) skb->data;
 392
 393         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 394
 395         if (rp->status)
 396                 return;
 397
 398         hdev->ssp_mode = rp->mode;
 399 }
 400
 401 static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 402 {
 403         __u8 status = *((__u8 *) skb->data);
 404         void *sent;
 405
 406         BT_DBG("%s status 0x%x", hdev->name, status);
 407
 408         if (status)
 409                 return;
 410
 411         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
 412         if (!sent)
 413                 return;
 414
 415         hdev->ssp_mode = *((__u8 *) sent);
 416 }
 417
 418 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
 419 {
 420         struct hci_rp_read_local_version *rp = (void *) skb->data;
 421
 422         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 423
 424         if (rp->status)
 425                 return;
 426
 427         hdev->hci_ver = rp->hci_ver;
 428         hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
 429         hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
 430
 431         BT_DBG("%s manufacturer %d hci ver %d:%d", hdev->name,
 432                                         hdev->manufacturer,
 433                                         hdev->hci_ver, hdev->hci_rev);
 434 }
 435
 436 static void hci_cc_read_local_commands(struct hci_dev *hdev, struct sk_buff *skb)
 437 {
 438         struct hci_rp_read_local_commands *rp = (void *) skb->data;
 439
 440         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 441
 442         if (rp->status)
 443                 return;
 444
 445         memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 446 }
 447
 448 static void hci_cc_read_local_features(struct hci_dev *hdev, struct sk_buff *skb)
 449 {
 450         struct hci_rp_read_local_features *rp = (void *) skb->data;
 451
 452         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 453
 454         if (rp->status)
 455                 return;
 456
 457         memcpy(hdev->features, rp->features, 8);
 458
 459         /* Adjust default settings according to features
 460          * supported by device. */
 461
 462         if (hdev->features[0] & LMP_3SLOT)
 463                 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 464
 465         if (hdev->features[0] & LMP_5SLOT)
 466                 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 467
 468         if (hdev->features[1] & LMP_HV2) {
 469                 hdev->pkt_type  |= (HCI_HV2);
 470                 hdev->esco_type |= (ESCO_HV2);
 471         }
 472
 473         if (hdev->features[1] & LMP_HV3) {
 474                 hdev->pkt_type  |= (HCI_HV3);
 475                 hdev->esco_type |= (ESCO_HV3);
 476         }
 477
 478         if (hdev->features[3] & LMP_ESCO)
 479                 hdev->esco_type |= (ESCO_EV3);
 480
 481         if (hdev->features[4] & LMP_EV4)
 482                 hdev->esco_type |= (ESCO_EV4);
 483
 484         if (hdev->features[4] & LMP_EV5)
 485                 hdev->esco_type |= (ESCO_EV5);
 486
 487         BT_DBG("%s features 0x%.2x%.2x%.2x%.2x%.2x%.2x%.2x%.2x", hdev->name,
 488                                         hdev->features[0], hdev->features[1],
 489                                         hdev->features[2], hdev->features[3],
 490                                         hdev->features[4], hdev->features[5],
 491                                         hdev->features[6], hdev->features[7]);
 492 }
 493
 494 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 495 {
 496         struct hci_rp_read_buffer_size *rp = (void *) skb->data;
 497
 498         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 499
 500         if (rp->status)
 501                 return;
 502
 503         hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
 504         hdev->sco_mtu  = rp->sco_mtu;
 505         hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
 506         hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
 507
 508         if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
 509                 hdev->sco_mtu  = 64;
 510                 hdev->sco_pkts = 8;
 511         }
 512
 513         hdev->acl_cnt = hdev->acl_pkts;
 514         hdev->sco_cnt = hdev->sco_pkts;
 515
 516         BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name,
 517                                         hdev->acl_mtu, hdev->acl_pkts,
 518                                         hdev->sco_mtu, hdev->sco_pkts);
 519 }
 520
 521 static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
 522 {
 523         struct hci_rp_read_bd_addr *rp = (void *) skb->data;
 524
 525         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 526
 527         if (!rp->status)
 528                 bacpy(&hdev->bdaddr, &rp->bdaddr);
 529
 530         hci_req_complete(hdev, rp->status);
 531 }
 532
 533 static inline void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
 534 {
 535         BT_DBG("%s status 0x%x", hdev->name, status);
 536
 537         if (status) {
 538                 hci_req_complete(hdev, status);
 539
 540                 hci_conn_check_pending(hdev);
 541         } else
 542                 set_bit(HCI_INQUIRY, &hdev->flags);
 543 }
 544
 545 static inline void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
 546 {
 547         struct hci_cp_create_conn *cp;
 548         struct hci_conn *conn;
 549
 550         BT_DBG("%s status 0x%x", hdev->name, status);
 551
 552         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
 553         if (!cp)
 554                 return;
 555
 556         hci_dev_lock(hdev);
 557
 558         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 559
 560         BT_DBG("%s bdaddr %s conn %p", hdev->name, batostr(&cp->bdaddr), conn);
 561
 562         if (status) {
 563                 if (conn && conn->state == BT_CONNECT) {
 564                         if (status != 0x0c || conn->attempt > 2) {
 565                                 conn->state = BT_CLOSED;
 566                                 hci_proto_connect_cfm(conn, status);
 567                                 hci_conn_del(conn);
 568                         } else
 569                                 conn->state = BT_CONNECT2;
 570                 }
 571         } else {
 572                 if (!conn) {
 573                         conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr);
 574                         if (conn) {
 575                                 conn->out = 1;
 576                                 conn->link_mode |= HCI_LM_MASTER;
 577                         } else
 578                                 BT_ERR("No memmory for new connection");
 579                 }
 580         }
 581
 582         hci_dev_unlock(hdev);
 583 }
 584
 585 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
 586 {
 587         struct hci_cp_add_sco *cp;
 588         struct hci_conn *acl, *sco;
 589         __u16 handle;
 590
 591         BT_DBG("%s status 0x%x", hdev->name, status);
 592
 593         if (!status)
 594                 return;
 595
 596         cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
 597         if (!cp)
 598                 return;
 599
 600         handle = __le16_to_cpu(cp->handle);
 601
 602         BT_DBG("%s handle %d", hdev->name, handle);
 603
 604         hci_dev_lock(hdev);
 605
 606         acl = hci_conn_hash_lookup_handle(hdev, handle);
 607         if (acl && (sco = acl->link)) {
 608                 sco->state = BT_CLOSED;
 609
 610                 hci_proto_connect_cfm(sco, status);
 611                 hci_conn_del(sco);
 612         }
 613
 614         hci_dev_unlock(hdev);
 615 }
 616
 617 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
 618 {
 619         struct hci_cp_auth_requested *cp;
 620         struct hci_conn *conn;
 621
 622         BT_DBG("%s status 0x%x", hdev->name, status);
 623
 624         if (!status)
 625                 return;
 626
 627         cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
 628         if (!cp)
 629                 return;
 630
 631         hci_dev_lock(hdev);
 632
 633         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
 634         if (conn) {
 635                 if (conn->state == BT_CONFIG) {
 636                         hci_proto_connect_cfm(conn, status);
 637                         hci_conn_put(conn);
 638                 }
 639         }
 640
 641         hci_dev_unlock(hdev);
 642 }
 643
 644 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
 645 {
 646         struct hci_cp_set_conn_encrypt *cp;
 647         struct hci_conn *conn;
 648
 649         BT_DBG("%s status 0x%x", hdev->name, status);
 650
 651         if (!status)
 652                 return;
 653
 654         cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
 655         if (!cp)
 656                 return;
 657
 658         hci_dev_lock(hdev);
 659
 660         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
 661         if (conn) {
 662                 if (conn->state == BT_CONFIG) {
 663                         hci_proto_connect_cfm(conn, status);
 664                         hci_conn_put(conn);
 665                 }
 666         }
 667
 668         hci_dev_unlock(hdev);
 669 }
 670
 671 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
 672 {
 673         BT_DBG("%s status 0x%x", hdev->name, status);
 674 }
 675
 676 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
 677 {
 678         struct hci_cp_read_remote_features *cp;
 679         struct hci_conn *conn;
 680
 681         BT_DBG("%s status 0x%x", hdev->name, status);
 682
 683         if (!status)
 684                 return;
 685
 686         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
 687         if (!cp)
 688                 return;
 689
 690         hci_dev_lock(hdev);
 691
 692         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
 693         if (conn) {
 694                 if (conn->state == BT_CONFIG) {
 695                         hci_proto_connect_cfm(conn, status);
 696                         hci_conn_put(conn);
 697                 }
 698         }
 699
 700         hci_dev_unlock(hdev);
 701 }
 702
 703 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
 704 {
 705         struct hci_cp_read_remote_ext_features *cp;
 706         struct hci_conn *conn;
 707
 708         BT_DBG("%s status 0x%x", hdev->name, status);
 709
 710         if (!status)
 711                 return;
 712
 713         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
 714         if (!cp)
 715                 return;
 716
 717         hci_dev_lock(hdev);
 718
 719         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
 720         if (conn) {
 721                 if (conn->state == BT_CONFIG) {
 722                         hci_proto_connect_cfm(conn, status);
 723                         hci_conn_put(conn);
 724                 }
 725         }
 726
 727         hci_dev_unlock(hdev);
 728 }
 729
 730 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
 731 {
 732         struct hci_cp_setup_sync_conn *cp;
 733         struct hci_conn *acl, *sco;
 734         __u16 handle;
 735
 736         BT_DBG("%s status 0x%x", hdev->name, status);
 737
 738         if (!status)
 739                 return;
 740
 741         cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
 742         if (!cp)
 743                 return;
 744
 745         handle = __le16_to_cpu(cp->handle);
 746
 747         BT_DBG("%s handle %d", hdev->name, handle);
 748
 749         hci_dev_lock(hdev);
 750
 751         acl = hci_conn_hash_lookup_handle(hdev, handle);
 752         if (acl && (sco = acl->link)) {
 753                 sco->state = BT_CLOSED;
 754
 755                 hci_proto_connect_cfm(sco, status);
 756                 hci_conn_del(sco);
 757         }
 758
 759         hci_dev_unlock(hdev);
 760 }
 761
 762 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
 763 {
 764         struct hci_cp_sniff_mode *cp;
 765         struct hci_conn *conn;
 766
 767         BT_DBG("%s status 0x%x", hdev->name, status);
 768
 769         if (!status)
 770                 return;
 771
 772         cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
 773         if (!cp)
 774                 return;
 775
 776         hci_dev_lock(hdev);
 777
 778         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
 779         if (conn)
 780                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend);
 781
 782         hci_dev_unlock(hdev);
 783 }
 784
 785 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
 786 {
 787         struct hci_cp_exit_sniff_mode *cp;
 788         struct hci_conn *conn;
 789
 790         BT_DBG("%s status 0x%x", hdev->name, status);
 791
 792         if (!status)
 793                 return;
 794
 795         cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
 796         if (!cp)
 797                 return;
 798
 799         hci_dev_lock(hdev);
 800
 801         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
 802         if (conn)
 803                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend);
 804
 805         hci_dev_unlock(hdev);
 806 }
 807
 808 static inline void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 809 {
 810         __u8 status = *((__u8 *) skb->data);
 811
 812         BT_DBG("%s status %d", hdev->name, status);
 813
 814         clear_bit(HCI_INQUIRY, &hdev->flags);
 815
 816         hci_req_complete(hdev, status);
 817
 818         hci_conn_check_pending(hdev);
 819 }
 820
 821 static inline void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
 822 {
 823         struct inquiry_data data;
 824         struct inquiry_info *info = (void *) (skb->data + 1);
 825         int num_rsp = *((__u8 *) skb->data);
 826
 827         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
 828
 829         if (!num_rsp)
 830                 return;
 831
 832         hci_dev_lock(hdev);
 833
 834         for (; num_rsp; num_rsp--) {
 835                 bacpy(&data.bdaddr, &info->bdaddr);
 836                 data.pscan_rep_mode     = info->pscan_rep_mode;
 837                 data.pscan_period_mode  = info->pscan_period_mode;
 838                 data.pscan_mode         = info->pscan_mode;
 839                 memcpy(data.dev_class, info->dev_class, 3);
 840                 data.clock_offset       = info->clock_offset;
 841                 data.rssi               = 0x00;
 842                 data.ssp_mode           = 0x00;
 843                 info++;
 844                 hci_inquiry_cache_update(hdev, &data);
 845         }
 846
 847         hci_dev_unlock(hdev);
 848 }
 849
 850 static inline void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 851 {
 852         struct hci_ev_conn_complete *ev = (void *) skb->data;
 853         struct hci_conn *conn;
 854
 855         BT_DBG("%s", hdev->name);
 856
 857         hci_dev_lock(hdev);
 858
 859         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
 860         if (!conn)
 861                 goto unlock;
 862
 863         if (!ev->status) {
 864                 conn->handle = __le16_to_cpu(ev->handle);
 865
 866                 if (conn->type == ACL_LINK) {
 867                         conn->state = BT_CONFIG;
 868                         hci_conn_hold(conn);
 869                 } else
 870                         conn->state = BT_CONNECTED;
 871
 872                 hci_conn_add_sysfs(conn);
 873
 874                 if (test_bit(HCI_AUTH, &hdev->flags))
 875                         conn->link_mode |= HCI_LM_AUTH;
 876
 877                 if (test_bit(HCI_ENCRYPT, &hdev->flags))
 878                         conn->link_mode |= HCI_LM_ENCRYPT;
 879
 880                 /* Get remote features */
 881                 if (conn->type == ACL_LINK) {
 882                         struct hci_cp_read_remote_features cp;
 883                         cp.handle = ev->handle;
 884                         hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
 885                                                         sizeof(cp), &cp);
 886                 }
 887
 888                 /* Set packet type for incoming connection */
 889                 if (!conn->out && hdev->hci_ver < 3) {
 890                         struct hci_cp_change_conn_ptype cp;
 891                         cp.handle = ev->handle;
 892                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 893                         hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE,
 894                                                         sizeof(cp), &cp);
 895                 }
 896         } else
 897                 conn->state = BT_CLOSED;
 898
 899         if (conn->type == ACL_LINK) {
 900                 struct hci_conn *sco = conn->link;
 901                 if (sco) {
 902                         if (!ev->status) {
 903                                 if (lmp_esco_capable(hdev))
 904                                         hci_setup_sync(sco, conn->handle);
 905                                 else
 906                                         hci_add_sco(sco, conn->handle);
 907                         } else {
 908                                 hci_proto_connect_cfm(sco, ev->status);
 909                                 hci_conn_del(sco);
 910                         }
 911                 }
 912         }
 913
 914         if (ev->status) {
 915                 hci_proto_connect_cfm(conn, ev->status);
 916                 hci_conn_del(conn);
 917         } else if (ev->link_type != ACL_LINK)
 918                 hci_proto_connect_cfm(conn, ev->status);
 919
 920 unlock:
 921         hci_dev_unlock(hdev);
 922
 923         hci_conn_check_pending(hdev);
 924 }
 925
 926 static inline void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
 927 {
 928         struct hci_ev_conn_request *ev = (void *) skb->data;
 929         int mask = hdev->link_mode;
 930
 931         BT_DBG("%s bdaddr %s type 0x%x", hdev->name,
 932                                         batostr(&ev->bdaddr), ev->link_type);
 933
 934         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type);
 935
 936         if (mask & HCI_LM_ACCEPT) {
 937                 /* Connection accepted */
 938                 struct inquiry_entry *ie;
 939                 struct hci_conn *conn;
 940
 941                 hci_dev_lock(hdev);
 942
 943                 if ((ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr)))
 944                         memcpy(ie->data.dev_class, ev->dev_class, 3);
 945
 946                 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
 947                 if (!conn) {
 948                         if (!(conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr))) {
 949                                 BT_ERR("No memmory for new connection");
 950                                 hci_dev_unlock(hdev);
 951                                 return;
 952                         }
 953                 }
 954
 955                 memcpy(conn->dev_class, ev->dev_class, 3);
 956                 conn->state = BT_CONNECT;
 957
 958                 hci_dev_unlock(hdev);
 959
 960                 if (ev->link_type == ACL_LINK || !lmp_esco_capable(hdev)) {
 961                         struct hci_cp_accept_conn_req cp;
 962
 963                         bacpy(&cp.bdaddr, &ev->bdaddr);
 964
 965                         if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
 966                                 cp.role = 0x00; /* Become master */
 967                         else
 968                                 cp.role = 0x01; /* Remain slave */
 969
 970                         hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ,
 971                                                         sizeof(cp), &cp);
 972                 } else {
 973                         struct hci_cp_accept_sync_conn_req cp;
 974
 975                         bacpy(&cp.bdaddr, &ev->bdaddr);
 976                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 977
 978                         cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
 979                         cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
 980                         cp.max_latency    = cpu_to_le16(0xffff);
 981                         cp.content_format = cpu_to_le16(hdev->voice_setting);
 982                         cp.retrans_effort = 0xff;
 983
 984                         hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ,
 985                                                         sizeof(cp), &cp);
 986                 }
 987         } else {
 988                 /* Connection rejected */
 989                 struct hci_cp_reject_conn_req cp;
 990
 991                 bacpy(&cp.bdaddr, &ev->bdaddr);
 992                 cp.reason = 0x0f;
 993                 hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
 994         }
 995 }
 996
 997 static inline void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 998 {
 999         struct hci_ev_disconn_complete *ev = (void *) skb->data;
1000         struct hci_conn *conn;
1001
1002         BT_DBG("%s status %d", hdev->name, ev->status);
1003
1004         if (ev->status)
1005                 return;
1006
1007         hci_dev_lock(hdev);
1008
1009         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1010         if (conn) {
1011                 conn->state = BT_CLOSED;
1012
1013                 hci_conn_del_sysfs(conn);
1014
1015                 hci_proto_disconn_ind(conn, ev->reason);
1016                 hci_conn_del(conn);
1017         }
1018
1019         hci_dev_unlock(hdev);
1020 }
1021
1022 static inline void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1023 {
1024         struct hci_ev_auth_complete *ev = (void *) skb->data;
1025         struct hci_conn *conn;
1026
1027         BT_DBG("%s status %d", hdev->name, ev->status);
1028
1029         hci_dev_lock(hdev);
1030
1031         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1032         if (conn) {
1033                 if (!ev->status)
1034                         conn->link_mode |= HCI_LM_AUTH;
1035
1036                 clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
1037
1038                 if (conn->state == BT_CONFIG) {
1039                         if (!ev->status && hdev->ssp_mode > 0 &&
1040                                                         conn->ssp_mode > 0) {
1041                                 struct hci_cp_set_conn_encrypt cp;
1042                                 cp.handle  = ev->handle;
1043                                 cp.encrypt = 0x01;
1044                                 hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT,
1045                                                         sizeof(cp), &cp);
1046                         } else {
1047                                 conn->state = BT_CONNECTED;
1048                                 hci_proto_connect_cfm(conn, ev->status);
1049                                 hci_conn_put(conn);
1050                         }
1051                 } else
1052                         hci_auth_cfm(conn, ev->status);
1053
1054                 if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend)) {
1055                         if (!ev->status) {
1056                                 struct hci_cp_set_conn_encrypt cp;
1057                                 cp.handle  = ev->handle;
1058                                 cp.encrypt = 0x01;
1059                                 hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT,
1060                                                         sizeof(cp), &cp);
1061                         } else {
1062                                 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
1063                                 hci_encrypt_cfm(conn, ev->status, 0x00);
1064                         }
1065                 }
1066         }
1067
1068         hci_dev_unlock(hdev);
1069 }
1070
1071 static inline void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
1072 {
1073         BT_DBG("%s", hdev->name);
1074
1075         hci_conn_check_pending(hdev);
1076 }
1077
1078 static inline void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
1079 {
1080         struct hci_ev_encrypt_change *ev = (void *) skb->data;
1081         struct hci_conn *conn;
1082
1083         BT_DBG("%s status %d", hdev->name, ev->status);
1084
1085         hci_dev_lock(hdev);
1086
1087         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1088         if (conn) {
1089                 if (!ev->status) {
1090                         if (ev->encrypt) {
1091                                 /* Encryption implies authentication */
1092                                 conn->link_mode |= HCI_LM_AUTH;
1093                                 conn->link_mode |= HCI_LM_ENCRYPT;
1094                         } else
1095                                 conn->link_mode &= ~HCI_LM_ENCRYPT;
1096                 }
1097
1098                 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
1099
1100                 if (conn->state == BT_CONFIG) {
1101                         if (!ev->status)
1102                                 conn->state = BT_CONNECTED;
1103
1104                         hci_proto_connect_cfm(conn, ev->status);
1105                         hci_conn_put(conn);
1106                 } else
1107                         hci_encrypt_cfm(conn, ev->status, ev->encrypt);
1108         }
1109
1110         hci_dev_unlock(hdev);
1111 }
1112
1113 static inline void hci_change_link_key_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1114 {
1115         struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
1116         struct hci_conn *conn;
1117
1118         BT_DBG("%s status %d", hdev->name, ev->status);
1119
1120         hci_dev_lock(hdev);
1121
1122         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1123         if (conn) {
1124                 if (!ev->status)
1125                         conn->link_mode |= HCI_LM_SECURE;
1126
1127                 clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
1128
1129                 hci_key_change_cfm(conn, ev->status);
1130         }
1131
1132         hci_dev_unlock(hdev);
1133 }
1134
1135 static inline void hci_remote_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
1136 {
1137         struct hci_ev_remote_features *ev = (void *) skb->data;
1138         struct hci_conn *conn;
1139
1140         BT_DBG("%s status %d", hdev->name, ev->status);
1141
1142         hci_dev_lock(hdev);
1143
1144         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1145         if (conn) {
1146                 if (!ev->status)
1147                         memcpy(conn->features, ev->features, 8);
1148
1149                 if (conn->state == BT_CONFIG) {
1150                         if (!ev->status && lmp_ssp_capable(hdev) &&
1151                                                 lmp_ssp_capable(conn)) {
1152                                 struct hci_cp_read_remote_ext_features cp;
1153                                 cp.handle = ev->handle;
1154                                 cp.page = 0x01;
1155                                 hci_send_cmd(hdev,
1156                                         HCI_OP_READ_REMOTE_EXT_FEATURES,
1157                                                         sizeof(cp), &cp);
1158                         } else {
1159                                 conn->state = BT_CONNECTED;
1160                                 hci_proto_connect_cfm(conn, ev->status);
1161                                 hci_conn_put(conn);
1162                         }
1163                 }
1164         }
1165
1166         hci_dev_unlock(hdev);
1167 }
1168
1169 static inline void hci_remote_version_evt(struct hci_dev *hdev, struct sk_buff *skb)
1170 {
1171         BT_DBG("%s", hdev->name);
1172 }
1173
1174 static inline void hci_qos_setup_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1175 {
1176         BT_DBG("%s", hdev->name);
1177 }
1178
1179 static inline void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1180 {
1181         struct hci_ev_cmd_complete *ev = (void *) skb->data;
1182         __u16 opcode;
1183
1184         skb_pull(skb, sizeof(*ev));
1185
1186         opcode = __le16_to_cpu(ev->opcode);
1187
1188         switch (opcode) {
1189         case HCI_OP_INQUIRY_CANCEL:
1190                 hci_cc_inquiry_cancel(hdev, skb);
1191                 break;
1192
1193         case HCI_OP_EXIT_PERIODIC_INQ:
1194                 hci_cc_exit_periodic_inq(hdev, skb);
1195                 break;
1196
1197         case HCI_OP_REMOTE_NAME_REQ_CANCEL:
1198                 hci_cc_remote_name_req_cancel(hdev, skb);
1199                 break;
1200
1201         case HCI_OP_ROLE_DISCOVERY:
1202                 hci_cc_role_discovery(hdev, skb);
1203                 break;
1204
1205         case HCI_OP_READ_LINK_POLICY:
1206                 hci_cc_read_link_policy(hdev, skb);
1207                 break;
1208
1209         case HCI_OP_WRITE_LINK_POLICY:
1210                 hci_cc_write_link_policy(hdev, skb);
1211                 break;
1212
1213         case HCI_OP_READ_DEF_LINK_POLICY:
1214                 hci_cc_read_def_link_policy(hdev, skb);
1215                 break;
1216
1217         case HCI_OP_WRITE_DEF_LINK_POLICY:
1218                 hci_cc_write_def_link_policy(hdev, skb);
1219                 break;
1220
1221         case HCI_OP_RESET:
1222                 hci_cc_reset(hdev, skb);
1223                 break;
1224
1225         case HCI_OP_WRITE_LOCAL_NAME:
1226                 hci_cc_write_local_name(hdev, skb);
1227                 break;
1228
1229         case HCI_OP_READ_LOCAL_NAME:
1230                 hci_cc_read_local_name(hdev, skb);
1231                 break;
1232
1233         case HCI_OP_WRITE_AUTH_ENABLE:
1234                 hci_cc_write_auth_enable(hdev, skb);
1235                 break;
1236
1237         case HCI_OP_WRITE_ENCRYPT_MODE:
1238                 hci_cc_write_encrypt_mode(hdev, skb);
1239                 break;
1240
1241         case HCI_OP_WRITE_SCAN_ENABLE:
1242                 hci_cc_write_scan_enable(hdev, skb);
1243                 break;
1244
1245         case HCI_OP_READ_CLASS_OF_DEV:
1246                 hci_cc_read_class_of_dev(hdev, skb);
1247                 break;
1248
1249         case HCI_OP_WRITE_CLASS_OF_DEV:
1250                 hci_cc_write_class_of_dev(hdev, skb);
1251                 break;
1252
1253         case HCI_OP_READ_VOICE_SETTING:
1254                 hci_cc_read_voice_setting(hdev, skb);
1255                 break;
1256
1257         case HCI_OP_WRITE_VOICE_SETTING:
1258                 hci_cc_write_voice_setting(hdev, skb);
1259                 break;
1260
1261         case HCI_OP_HOST_BUFFER_SIZE:
1262                 hci_cc_host_buffer_size(hdev, skb);
1263                 break;
1264
1265         case HCI_OP_READ_SSP_MODE:
1266                 hci_cc_read_ssp_mode(hdev, skb);
1267                 break;
1268
1269         case HCI_OP_WRITE_SSP_MODE:
1270                 hci_cc_write_ssp_mode(hdev, skb);
1271                 break;
1272
1273         case HCI_OP_READ_LOCAL_VERSION:
1274                 hci_cc_read_local_version(hdev, skb);
1275                 break;
1276
1277         case HCI_OP_READ_LOCAL_COMMANDS:
1278                 hci_cc_read_local_commands(hdev, skb);
1279                 break;
1280
1281         case HCI_OP_READ_LOCAL_FEATURES:
1282                 hci_cc_read_local_features(hdev, skb);
1283                 break;
1284
1285         case HCI_OP_READ_BUFFER_SIZE:
1286                 hci_cc_read_buffer_size(hdev, skb);
1287                 break;
1288
1289         case HCI_OP_READ_BD_ADDR:
1290                 hci_cc_read_bd_addr(hdev, skb);
1291                 break;
1292
1293         default:
1294                 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
1295                 break;
1296         }
1297
1298         if (ev->ncmd) {
1299                 atomic_set(&hdev->cmd_cnt, 1);
1300                 if (!skb_queue_empty(&hdev->cmd_q))
1301                         hci_sched_cmd(hdev);
1302         }
1303 }
1304
1305 static inline void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb)
1306 {
1307         struct hci_ev_cmd_status *ev = (void *) skb->data;
1308         __u16 opcode;
1309
1310         skb_pull(skb, sizeof(*ev));
1311
1312         opcode = __le16_to_cpu(ev->opcode);
1313
1314         switch (opcode) {
1315         case HCI_OP_INQUIRY:
1316                 hci_cs_inquiry(hdev, ev->status);
1317                 break;
1318
1319         case HCI_OP_CREATE_CONN:
1320                 hci_cs_create_conn(hdev, ev->status);
1321                 break;
1322
1323         case HCI_OP_ADD_SCO:
1324                 hci_cs_add_sco(hdev, ev->status);
1325                 break;
1326
1327         case HCI_OP_AUTH_REQUESTED:
1328                 hci_cs_auth_requested(hdev, ev->status);
1329                 break;
1330
1331         case HCI_OP_SET_CONN_ENCRYPT:
1332                 hci_cs_set_conn_encrypt(hdev, ev->status);
1333                 break;
1334
1335         case HCI_OP_REMOTE_NAME_REQ:
1336                 hci_cs_remote_name_req(hdev, ev->status);
1337                 break;
1338
1339         case HCI_OP_READ_REMOTE_FEATURES:
1340                 hci_cs_read_remote_features(hdev, ev->status);
1341                 break;
1342
1343         case HCI_OP_READ_REMOTE_EXT_FEATURES:
1344                 hci_cs_read_remote_ext_features(hdev, ev->status);
1345                 break;
1346
1347         case HCI_OP_SETUP_SYNC_CONN:
1348                 hci_cs_setup_sync_conn(hdev, ev->status);
1349                 break;
1350
1351         case HCI_OP_SNIFF_MODE:
1352                 hci_cs_sniff_mode(hdev, ev->status);
1353                 break;
1354
1355         case HCI_OP_EXIT_SNIFF_MODE:
1356                 hci_cs_exit_sniff_mode(hdev, ev->status);
1357                 break;
1358
1359         default:
1360                 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
1361                 break;
1362         }
1363
1364         if (ev->ncmd) {
1365                 atomic_set(&hdev->cmd_cnt, 1);
1366                 if (!skb_queue_empty(&hdev->cmd_q))
1367                         hci_sched_cmd(hdev);
1368         }
1369 }
1370
1371 static inline void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
1372 {
1373         struct hci_ev_role_change *ev = (void *) skb->data;
1374         struct hci_conn *conn;
1375
1376         BT_DBG("%s status %d", hdev->name, ev->status);
1377
1378         hci_dev_lock(hdev);
1379
1380         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
1381         if (conn) {
1382                 if (!ev->status) {
1383                         if (ev->role)
1384                                 conn->link_mode &= ~HCI_LM_MASTER;
1385                         else
1386                                 conn->link_mode |= HCI_LM_MASTER;
1387                 }
1388
1389                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->pend);
1390
1391                 hci_role_switch_cfm(conn, ev->status, ev->role);
1392         }
1393
1394         hci_dev_unlock(hdev);
1395 }
1396
1397 static inline void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
1398 {
1399         struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
1400         __le16 *ptr;
1401         int i;
1402
1403         skb_pull(skb, sizeof(*ev));
1404
1405         BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
1406
1407         if (skb->len < ev->num_hndl * 4) {
1408                 BT_DBG("%s bad parameters", hdev->name);
1409                 return;
1410         }
1411
1412         tasklet_disable(&hdev->tx_task);
1413
1414         for (i = 0, ptr = (__le16 *) skb->data; i < ev->num_hndl; i++) {
1415                 struct hci_conn *conn;
1416                 __u16  handle, count;
1417
1418                 handle = get_unaligned_le16(ptr++);
1419                 count  = get_unaligned_le16(ptr++);
1420
1421                 conn = hci_conn_hash_lookup_handle(hdev, handle);
1422                 if (conn) {
1423                         conn->sent -= count;
1424
1425                         if (conn->type == ACL_LINK) {
1426                                 if ((hdev->acl_cnt += count) > hdev->acl_pkts)
1427                                         hdev->acl_cnt = hdev->acl_pkts;
1428                         } else {
1429                                 if ((hdev->sco_cnt += count) > hdev->sco_pkts)
1430                                         hdev->sco_cnt = hdev->sco_pkts;
1431                         }
1432                 }
1433         }
1434
1435         hci_sched_tx(hdev);
1436
1437         tasklet_enable(&hdev->tx_task);
1438 }
1439
1440 static inline void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
1441 {
1442         struct hci_ev_mode_change *ev = (void *) skb->data;
1443         struct hci_conn *conn;
1444
1445         BT_DBG("%s status %d", hdev->name, ev->status);
1446
1447         hci_dev_lock(hdev);
1448
1449         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1450         if (conn) {
1451                 conn->mode = ev->mode;
1452                 conn->interval = __le16_to_cpu(ev->interval);
1453
1454                 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
1455                         if (conn->mode == HCI_CM_ACTIVE)
1456                                 conn->power_save = 1;
1457                         else
1458                                 conn->power_save = 0;
1459                 }
1460         }
1461
1462         hci_dev_unlock(hdev);
1463 }
1464
1465 static inline void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
1466 {
1467         BT_DBG("%s", hdev->name);
1468 }
1469
1470 static inline void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
1471 {
1472         BT_DBG("%s", hdev->name);
1473 }
1474
1475 static inline void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
1476 {
1477         BT_DBG("%s", hdev->name);
1478 }
1479
1480 static inline void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
1481 {
1482         struct hci_ev_clock_offset *ev = (void *) skb->data;
1483         struct hci_conn *conn;
1484
1485         BT_DBG("%s status %d", hdev->name, ev->status);
1486
1487         hci_dev_lock(hdev);
1488
1489         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1490         if (conn && !ev->status) {
1491                 struct inquiry_entry *ie;
1492
1493                 if ((ie = hci_inquiry_cache_lookup(hdev, &conn->dst))) {
1494                         ie->data.clock_offset = ev->clock_offset;
1495                         ie->timestamp = jiffies;
1496                 }
1497         }
1498
1499         hci_dev_unlock(hdev);
1500 }
1501
1502 static inline void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
1503 {
1504         struct hci_ev_pkt_type_change *ev = (void *) skb->data;
1505         struct hci_conn *conn;
1506
1507         BT_DBG("%s status %d", hdev->name, ev->status);
1508
1509         hci_dev_lock(hdev);
1510
1511         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1512         if (conn && !ev->status)
1513                 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
1514
1515         hci_dev_unlock(hdev);
1516 }
1517
1518 static inline void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
1519 {
1520         struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
1521         struct inquiry_entry *ie;
1522
1523         BT_DBG("%s", hdev->name);
1524
1525         hci_dev_lock(hdev);
1526
1527         if ((ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr))) {
1528                 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
1529                 ie->timestamp = jiffies;
1530         }
1531
1532         hci_dev_unlock(hdev);
1533 }
1534
1535 static inline void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, struct sk_buff *skb)
1536 {
1537         struct inquiry_data data;
1538         int num_rsp = *((__u8 *) skb->data);
1539
1540         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
1541
1542         if (!num_rsp)
1543                 return;
1544
1545         hci_dev_lock(hdev);
1546
1547         if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
1548                 struct inquiry_info_with_rssi_and_pscan_mode *info = (void *) (skb->data + 1);
1549
1550                 for (; num_rsp; num_rsp--) {
1551                         bacpy(&data.bdaddr, &info->bdaddr);
1552                         data.pscan_rep_mode     = info->pscan_rep_mode;
1553                         data.pscan_period_mode  = info->pscan_period_mode;
1554                         data.pscan_mode         = info->pscan_mode;
1555                         memcpy(data.dev_class, info->dev_class, 3);
1556                         data.clock_offset       = info->clock_offset;
1557                         data.rssi               = info->rssi;
1558                         data.ssp_mode           = 0x00;
1559                         info++;
1560                         hci_inquiry_cache_update(hdev, &data);
1561                 }
1562         } else {
1563                 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
1564
1565                 for (; num_rsp; num_rsp--) {
1566                         bacpy(&data.bdaddr, &info->bdaddr);
1567                         data.pscan_rep_mode     = info->pscan_rep_mode;
1568                         data.pscan_period_mode  = info->pscan_period_mode;
1569                         data.pscan_mode         = 0x00;
1570                         memcpy(data.dev_class, info->dev_class, 3);
1571                         data.clock_offset       = info->clock_offset;
1572                         data.rssi               = info->rssi;
1573                         data.ssp_mode           = 0x00;
1574                         info++;
1575                         hci_inquiry_cache_update(hdev, &data);
1576                 }
1577         }
1578
1579         hci_dev_unlock(hdev);
1580 }
1581
1582 static inline void hci_remote_ext_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
1583 {
1584         struct hci_ev_remote_ext_features *ev = (void *) skb->data;
1585         struct hci_conn *conn;
1586
1587         BT_DBG("%s", hdev->name);
1588
1589         hci_dev_lock(hdev);
1590
1591         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1592         if (conn) {
1593                 if (!ev->status && ev->page == 0x01) {
1594                         struct inquiry_entry *ie;
1595
1596                         if ((ie = hci_inquiry_cache_lookup(hdev, &conn->dst)))
1597                                 ie->data.ssp_mode = (ev->features[0] & 0x01);
1598
1599                         conn->ssp_mode = (ev->features[0] & 0x01);
1600                 }
1601
1602                 if (conn->state == BT_CONFIG) {
1603                         if (!ev->status && hdev->ssp_mode > 0 &&
1604                                         conn->ssp_mode > 0 && conn->out &&
1605                                         conn->sec_level != BT_SECURITY_SDP) {
1606                                 struct hci_cp_auth_requested cp;
1607                                 cp.handle = ev->handle;
1608                                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
1609                                                         sizeof(cp), &cp);
1610                         } else {
1611                                 conn->state = BT_CONNECTED;
1612                                 hci_proto_connect_cfm(conn, ev->status);
1613                                 hci_conn_put(conn);
1614                         }
1615                 }
1616         }
1617
1618         hci_dev_unlock(hdev);
1619 }
1620
1621 static inline void hci_sync_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1622 {
1623         struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
1624         struct hci_conn *conn;
1625
1626         BT_DBG("%s status %d", hdev->name, ev->status);
1627
1628         hci_dev_lock(hdev);
1629
1630         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
1631         if (!conn) {
1632                 if (ev->link_type == ESCO_LINK)
1633                         goto unlock;
1634
1635                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
1636                 if (!conn)
1637                         goto unlock;
1638
1639                 conn->type = SCO_LINK;
1640         }
1641
1642         if (!ev->status) {
1643                 conn->handle = __le16_to_cpu(ev->handle);
1644                 conn->state  = BT_CONNECTED;
1645
1646                 hci_conn_add_sysfs(conn);
1647         } else
1648                 conn->state = BT_CLOSED;
1649
1650         hci_proto_connect_cfm(conn, ev->status);
1651         if (ev->status)
1652                 hci_conn_del(conn);
1653
1654 unlock:
1655         hci_dev_unlock(hdev);
1656 }
1657
1658 static inline void hci_sync_conn_changed_evt(struct hci_dev *hdev, struct sk_buff *skb)
1659 {
1660         BT_DBG("%s", hdev->name);
1661 }
1662
1663 static inline void hci_sniff_subrate_evt(struct hci_dev *hdev, struct sk_buff *skb)
1664 {
1665         struct hci_ev_sniff_subrate *ev = (void *) skb->data;
1666         struct hci_conn *conn;
1667
1668         BT_DBG("%s status %d", hdev->name, ev->status);
1669
1670         hci_dev_lock(hdev);
1671
1672         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1673         if (conn) {
1674         }
1675
1676         hci_dev_unlock(hdev);
1677 }
1678
1679 static inline void hci_extended_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
1680 {
1681         struct inquiry_data data;
1682         struct extended_inquiry_info *info = (void *) (skb->data + 1);
1683         int num_rsp = *((__u8 *) skb->data);
1684
1685         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
1686
1687         if (!num_rsp)
1688                 return;
1689
1690         hci_dev_lock(hdev);
1691
1692         for (; num_rsp; num_rsp--) {
1693                 bacpy(&data.bdaddr, &info->bdaddr);
1694                 data.pscan_rep_mode     = info->pscan_rep_mode;
1695                 data.pscan_period_mode  = info->pscan_period_mode;
1696                 data.pscan_mode         = 0x00;
1697                 memcpy(data.dev_class, info->dev_class, 3);
1698                 data.clock_offset       = info->clock_offset;
1699                 data.rssi               = info->rssi;
1700                 data.ssp_mode           = 0x01;
1701                 info++;
1702                 hci_inquiry_cache_update(hdev, &data);
1703         }
1704
1705         hci_dev_unlock(hdev);
1706 }
1707
1708 static inline void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
1709 {
1710         struct hci_ev_io_capa_request *ev = (void *) skb->data;
1711         struct hci_conn *conn;
1712
1713         BT_DBG("%s", hdev->name);
1714
1715         hci_dev_lock(hdev);
1716
1717         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
1718         if (conn)
1719                 hci_conn_hold(conn);
1720
1721         hci_dev_unlock(hdev);
1722 }
1723
1724 static inline void hci_simple_pair_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1725 {
1726         struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
1727         struct hci_conn *conn;
1728
1729         BT_DBG("%s", hdev->name);
1730
1731         hci_dev_lock(hdev);
1732
1733         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
1734         if (conn)
1735                 hci_conn_put(conn);
1736
1737         hci_dev_unlock(hdev);
1738 }
1739
1740 static inline void hci_remote_host_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
1741 {
1742         struct hci_ev_remote_host_features *ev = (void *) skb->data;
1743         struct inquiry_entry *ie;
1744
1745         BT_DBG("%s", hdev->name);
1746
1747         hci_dev_lock(hdev);
1748
1749         if ((ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr)))
1750                 ie->data.ssp_mode = (ev->features[0] & 0x01);
1751
1752         hci_dev_unlock(hdev);
1753 }
1754
1755 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
1756 {
1757         struct hci_event_hdr *hdr = (void *) skb->data;
1758         __u8 event = hdr->evt;
1759
1760         skb_pull(skb, HCI_EVENT_HDR_SIZE);
1761
1762         switch (event) {
1763         case HCI_EV_INQUIRY_COMPLETE:
1764                 hci_inquiry_complete_evt(hdev, skb);
1765                 break;
1766
1767         case HCI_EV_INQUIRY_RESULT:
1768                 hci_inquiry_result_evt(hdev, skb);
1769                 break;
1770
1771         case HCI_EV_CONN_COMPLETE:
1772                 hci_conn_complete_evt(hdev, skb);
1773                 break;
1774
1775         case HCI_EV_CONN_REQUEST:
1776                 hci_conn_request_evt(hdev, skb);
1777                 break;
1778
1779         case HCI_EV_DISCONN_COMPLETE:
1780                 hci_disconn_complete_evt(hdev, skb);
1781                 break;
1782
1783         case HCI_EV_AUTH_COMPLETE:
1784                 hci_auth_complete_evt(hdev, skb);
1785                 break;
1786
1787         case HCI_EV_REMOTE_NAME:
1788                 hci_remote_name_evt(hdev, skb);
1789                 break;
1790
1791         case HCI_EV_ENCRYPT_CHANGE:
1792                 hci_encrypt_change_evt(hdev, skb);
1793                 break;
1794
1795         case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
1796                 hci_change_link_key_complete_evt(hdev, skb);
1797                 break;
1798
1799         case HCI_EV_REMOTE_FEATURES:
1800                 hci_remote_features_evt(hdev, skb);
1801                 break;
1802
1803         case HCI_EV_REMOTE_VERSION:
1804                 hci_remote_version_evt(hdev, skb);
1805                 break;
1806
1807         case HCI_EV_QOS_SETUP_COMPLETE:
1808                 hci_qos_setup_complete_evt(hdev, skb);
1809                 break;
1810
1811         case HCI_EV_CMD_COMPLETE:
1812                 hci_cmd_complete_evt(hdev, skb);
1813                 break;
1814
1815         case HCI_EV_CMD_STATUS:
1816                 hci_cmd_status_evt(hdev, skb);
1817                 break;
1818
1819         case HCI_EV_ROLE_CHANGE:
1820                 hci_role_change_evt(hdev, skb);
1821                 break;
1822
1823         case HCI_EV_NUM_COMP_PKTS:
1824                 hci_num_comp_pkts_evt(hdev, skb);
1825                 break;
1826
1827         case HCI_EV_MODE_CHANGE:
1828                 hci_mode_change_evt(hdev, skb);
1829                 break;
1830
1831         case HCI_EV_PIN_CODE_REQ:
1832                 hci_pin_code_request_evt(hdev, skb);
1833                 break;
1834
1835         case HCI_EV_LINK_KEY_REQ:
1836                 hci_link_key_request_evt(hdev, skb);
1837                 break;
1838
1839         case HCI_EV_LINK_KEY_NOTIFY:
1840                 hci_link_key_notify_evt(hdev, skb);
1841                 break;
1842
1843         case HCI_EV_CLOCK_OFFSET:
1844                 hci_clock_offset_evt(hdev, skb);
1845                 break;
1846
1847         case HCI_EV_PKT_TYPE_CHANGE:
1848                 hci_pkt_type_change_evt(hdev, skb);
1849                 break;
1850
1851         case HCI_EV_PSCAN_REP_MODE:
1852                 hci_pscan_rep_mode_evt(hdev, skb);
1853                 break;
1854
1855         case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
1856                 hci_inquiry_result_with_rssi_evt(hdev, skb);
1857                 break;
1858
1859         case HCI_EV_REMOTE_EXT_FEATURES:
1860                 hci_remote_ext_features_evt(hdev, skb);
1861                 break;
1862
1863         case HCI_EV_SYNC_CONN_COMPLETE:
1864                 hci_sync_conn_complete_evt(hdev, skb);
1865                 break;
1866
1867         case HCI_EV_SYNC_CONN_CHANGED:
1868                 hci_sync_conn_changed_evt(hdev, skb);
1869                 break;
1870
1871         case HCI_EV_SNIFF_SUBRATE:
1872                 hci_sniff_subrate_evt(hdev, skb);
1873                 break;
1874
1875         case HCI_EV_EXTENDED_INQUIRY_RESULT:
1876                 hci_extended_inquiry_result_evt(hdev, skb);
1877                 break;
1878
1879         case HCI_EV_IO_CAPA_REQUEST:
1880                 hci_io_capa_request_evt(hdev, skb);
1881                 break;
1882
1883         case HCI_EV_SIMPLE_PAIR_COMPLETE:
1884                 hci_simple_pair_complete_evt(hdev, skb);
1885                 break;
1886
1887         case HCI_EV_REMOTE_HOST_FEATURES:
1888                 hci_remote_host_features_evt(hdev, skb);
1889                 break;
1890
1891         default:
1892                 BT_DBG("%s event 0x%x", hdev->name, event);
1893                 break;
1894         }
1895
1896         kfree_skb(skb);
1897         hdev->stat.evt_rx++;
1898 }
1899
1900 /* Generate internal stack event */
1901 void hci_si_event(struct hci_dev *hdev, int type, int dlen, void *data)
1902 {
1903         struct hci_event_hdr *hdr;
1904         struct hci_ev_stack_internal *ev;
1905         struct sk_buff *skb;
1906
1907         skb = bt_skb_alloc(HCI_EVENT_HDR_SIZE + sizeof(*ev) + dlen, GFP_ATOMIC);
1908         if (!skb)
1909                 return;
1910
1911         hdr = (void *) skb_put(skb, HCI_EVENT_HDR_SIZE);
1912         hdr->evt  = HCI_EV_STACK_INTERNAL;
1913         hdr->plen = sizeof(*ev) + dlen;
1914
1915         ev  = (void *) skb_put(skb, sizeof(*ev) + dlen);
1916         ev->type = type;
1917         memcpy(ev->data, data, dlen);
1918
1919         bt_cb(skb)->incoming = 1;
1920         __net_timestamp(skb);
1921
1922         bt_cb(skb)->pkt_type = HCI_EVENT_PKT;
1923         skb->dev = (void *) hdev;
1924         hci_send_to_sock(hdev, skb);
1925         kfree_skb(skb);
1926 }