net/bluetooth/hci_event.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI event handling. */
  26
  27 #include <linux/module.h>
  28
  29 #include <linux/types.h>
  30 #include <linux/errno.h>
  31 #include <linux/kernel.h>
  32 #include <linux/slab.h>
  33 #include <linux/poll.h>
  34 #include <linux/fcntl.h>
  35 #include <linux/init.h>
  36 #include <linux/skbuff.h>
  37 #include <linux/interrupt.h>
  38 #include <linux/notifier.h>
  39 #include <net/sock.h>
  40
  41 #include <asm/system.h>
  42 #include <linux/uaccess.h>
  43 #include <asm/unaligned.h>
  44
  45 #include <net/bluetooth/bluetooth.h>
  46 #include <net/bluetooth/hci_core.h>
  47
  48 /* Handle HCI Event packets */
  49
  50 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
  51 {
  52         __u8 status = *((__u8 *) skb->data);
  53
  54         BT_DBG("%s status 0x%x", hdev->name, status);
  55
  56         if (status)
  57                 return;
  58
  59         clear_bit(HCI_INQUIRY, &hdev->flags);
  60
  61         hci_req_complete(hdev, HCI_OP_INQUIRY_CANCEL, status);
  62
  63         hci_conn_check_pending(hdev);
  64 }
  65
  66 static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  67 {
  68         __u8 status = *((__u8 *) skb->data);
  69
  70         BT_DBG("%s status 0x%x", hdev->name, status);
  71
  72         if (status)
  73                 return;
  74
  75         clear_bit(HCI_INQUIRY, &hdev->flags);
  76
  77         hci_conn_check_pending(hdev);
  78 }
  79
  80 static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev, struct sk_buff *skb)
  81 {
  82         BT_DBG("%s", hdev->name);
  83 }
  84
  85 static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
  86 {
  87         struct hci_rp_role_discovery *rp = (void *) skb->data;
  88         struct hci_conn *conn;
  89
  90         BT_DBG("%s status 0x%x", hdev->name, rp->status);
  91
  92         if (rp->status)
  93                 return;
  94
  95         hci_dev_lock(hdev);
  96
  97         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
  98         if (conn) {
  99                 if (rp->role)
 100                         conn->link_mode &= ~HCI_LM_MASTER;
 101                 else
 102                         conn->link_mode |= HCI_LM_MASTER;
 103         }
 104
 105         hci_dev_unlock(hdev);
 106 }
 107
 108 static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 109 {
 110         struct hci_rp_read_link_policy *rp = (void *) skb->data;
 111         struct hci_conn *conn;
 112
 113         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 114
 115         if (rp->status)
 116                 return;
 117
 118         hci_dev_lock(hdev);
 119
 120         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 121         if (conn)
 122                 conn->link_policy = __le16_to_cpu(rp->policy);
 123
 124         hci_dev_unlock(hdev);
 125 }
 126
 127 static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 128 {
 129         struct hci_rp_write_link_policy *rp = (void *) skb->data;
 130         struct hci_conn *conn;
 131         void *sent;
 132
 133         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 134
 135         if (rp->status)
 136                 return;
 137
 138         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
 139         if (!sent)
 140                 return;
 141
 142         hci_dev_lock(hdev);
 143
 144         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 145         if (conn)
 146                 conn->link_policy = get_unaligned_le16(sent + 2);
 147
 148         hci_dev_unlock(hdev);
 149 }
 150
 151 static void hci_cc_read_def_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 152 {
 153         struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
 154
 155         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 156
 157         if (rp->status)
 158                 return;
 159
 160         hdev->link_policy = __le16_to_cpu(rp->policy);
 161 }
 162
 163 static void hci_cc_write_def_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 164 {
 165         __u8 status = *((__u8 *) skb->data);
 166         void *sent;
 167
 168         BT_DBG("%s status 0x%x", hdev->name, status);
 169
 170         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
 171         if (!sent)
 172                 return;
 173
 174         if (!status)
 175                 hdev->link_policy = get_unaligned_le16(sent);
 176
 177         hci_req_complete(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, status);
 178 }
 179
 180 static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
 181 {
 182         __u8 status = *((__u8 *) skb->data);
 183
 184         BT_DBG("%s status 0x%x", hdev->name, status);
 185
 186         clear_bit(HCI_RESET, &hdev->flags);
 187
 188         hci_req_complete(hdev, HCI_OP_RESET, status);
 189 }
 190
 191 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 192 {
 193         __u8 status = *((__u8 *) skb->data);
 194         void *sent;
 195
 196         BT_DBG("%s status 0x%x", hdev->name, status);
 197
 198         if (status)
 199                 return;
 200
 201         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
 202         if (!sent)
 203                 return;
 204
 205         memcpy(hdev->dev_name, sent, 248);
 206 }
 207
 208 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 209 {
 210         struct hci_rp_read_local_name *rp = (void *) skb->data;
 211
 212         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 213
 214         if (rp->status)
 215                 return;
 216
 217         memcpy(hdev->dev_name, rp->name, 248);
 218 }
 219
 220 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
 221 {
 222         __u8 status = *((__u8 *) skb->data);
 223         void *sent;
 224
 225         BT_DBG("%s status 0x%x", hdev->name, status);
 226
 227         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
 228         if (!sent)
 229                 return;
 230
 231         if (!status) {
 232                 __u8 param = *((__u8 *) sent);
 233
 234                 if (param == AUTH_ENABLED)
 235                         set_bit(HCI_AUTH, &hdev->flags);
 236                 else
 237                         clear_bit(HCI_AUTH, &hdev->flags);
 238         }
 239
 240         hci_req_complete(hdev, HCI_OP_WRITE_AUTH_ENABLE, status);
 241 }
 242
 243 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
 244 {
 245         __u8 status = *((__u8 *) skb->data);
 246         void *sent;
 247
 248         BT_DBG("%s status 0x%x", hdev->name, status);
 249
 250         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
 251         if (!sent)
 252                 return;
 253
 254         if (!status) {
 255                 __u8 param = *((__u8 *) sent);
 256
 257                 if (param)
 258                         set_bit(HCI_ENCRYPT, &hdev->flags);
 259                 else
 260                         clear_bit(HCI_ENCRYPT, &hdev->flags);
 261         }
 262
 263         hci_req_complete(hdev, HCI_OP_WRITE_ENCRYPT_MODE, status);
 264 }
 265
 266 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
 267 {
 268         __u8 status = *((__u8 *) skb->data);
 269         void *sent;
 270
 271         BT_DBG("%s status 0x%x", hdev->name, status);
 272
 273         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
 274         if (!sent)
 275                 return;
 276
 277         if (!status) {
 278                 __u8 param = *((__u8 *) sent);
 279                 int old_pscan, old_iscan;
 280
 281                 old_pscan = test_and_clear_bit(HCI_PSCAN, &hdev->flags);
 282                 old_iscan = test_and_clear_bit(HCI_ISCAN, &hdev->flags);
 283
 284                 if (param & SCAN_INQUIRY) {
 285                         set_bit(HCI_ISCAN, &hdev->flags);
 286                         if (!old_iscan)
 287                                 mgmt_discoverable(hdev->id, 1);
 288                 } else if (old_iscan)
 289                         mgmt_discoverable(hdev->id, 0);
 290
 291                 if (param & SCAN_PAGE) {
 292                         set_bit(HCI_PSCAN, &hdev->flags);
 293                         if (!old_pscan)
 294                                 mgmt_connectable(hdev->id, 1);
 295                 } else if (old_pscan)
 296                         mgmt_connectable(hdev->id, 0);
 297         }
 298
 299         hci_req_complete(hdev, HCI_OP_WRITE_SCAN_ENABLE, status);
 300 }
 301
 302 static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 303 {
 304         struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
 305
 306         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 307
 308         if (rp->status)
 309                 return;
 310
 311         memcpy(hdev->dev_class, rp->dev_class, 3);
 312
 313         BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
 314                 hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
 315 }
 316
 317 static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 318 {
 319         __u8 status = *((__u8 *) skb->data);
 320         void *sent;
 321
 322         BT_DBG("%s status 0x%x", hdev->name, status);
 323
 324         if (status)
 325                 return;
 326
 327         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
 328         if (!sent)
 329                 return;
 330
 331         memcpy(hdev->dev_class, sent, 3);
 332 }
 333
 334 static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 335 {
 336         struct hci_rp_read_voice_setting *rp = (void *) skb->data;
 337         __u16 setting;
 338
 339         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 340
 341         if (rp->status)
 342                 return;
 343
 344         setting = __le16_to_cpu(rp->voice_setting);
 345
 346         if (hdev->voice_setting == setting)
 347                 return;
 348
 349         hdev->voice_setting = setting;
 350
 351         BT_DBG("%s voice setting 0x%04x", hdev->name, setting);
 352
 353         if (hdev->notify) {
 354                 tasklet_disable(&hdev->tx_task);
 355                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 356                 tasklet_enable(&hdev->tx_task);
 357         }
 358 }
 359
 360 static void hci_cc_write_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 361 {
 362         __u8 status = *((__u8 *) skb->data);
 363         __u16 setting;
 364         void *sent;
 365
 366         BT_DBG("%s status 0x%x", hdev->name, status);
 367
 368         if (status)
 369                 return;
 370
 371         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
 372         if (!sent)
 373                 return;
 374
 375         setting = get_unaligned_le16(sent);
 376
 377         if (hdev->voice_setting == setting)
 378                 return;
 379
 380         hdev->voice_setting = setting;
 381
 382         BT_DBG("%s voice setting 0x%04x", hdev->name, setting);
 383
 384         if (hdev->notify) {
 385                 tasklet_disable(&hdev->tx_task);
 386                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 387                 tasklet_enable(&hdev->tx_task);
 388         }
 389 }
 390
 391 static void hci_cc_host_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 392 {
 393         __u8 status = *((__u8 *) skb->data);
 394
 395         BT_DBG("%s status 0x%x", hdev->name, status);
 396
 397         hci_req_complete(hdev, HCI_OP_HOST_BUFFER_SIZE, status);
 398 }
 399
 400 static void hci_cc_read_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 401 {
 402         struct hci_rp_read_ssp_mode *rp = (void *) skb->data;
 403
 404         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 405
 406         if (rp->status)
 407                 return;
 408
 409         hdev->ssp_mode = rp->mode;
 410 }
 411
 412 static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 413 {
 414         __u8 status = *((__u8 *) skb->data);
 415         void *sent;
 416
 417         BT_DBG("%s status 0x%x", hdev->name, status);
 418
 419         if (status)
 420                 return;
 421
 422         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
 423         if (!sent)
 424                 return;
 425
 426         hdev->ssp_mode = *((__u8 *) sent);
 427 }
 428
 429 static u8 hci_get_inquiry_mode(struct hci_dev *hdev)
 430 {
 431         if (hdev->features[6] & LMP_EXT_INQ)
 432                 return 2;
 433
 434         if (hdev->features[3] & LMP_RSSI_INQ)
 435                 return 1;
 436
 437         if (hdev->manufacturer == 11 && hdev->hci_rev == 0x00 &&
 438                                                 hdev->lmp_subver == 0x0757)
 439                 return 1;
 440
 441         if (hdev->manufacturer == 15) {
 442                 if (hdev->hci_rev == 0x03 && hdev->lmp_subver == 0x6963)
 443                         return 1;
 444                 if (hdev->hci_rev == 0x09 && hdev->lmp_subver == 0x6963)
 445                         return 1;
 446                 if (hdev->hci_rev == 0x00 && hdev->lmp_subver == 0x6965)
 447                         return 1;
 448         }
 449
 450         if (hdev->manufacturer == 31 && hdev->hci_rev == 0x2005 &&
 451                                                 hdev->lmp_subver == 0x1805)
 452                 return 1;
 453
 454         return 0;
 455 }
 456
 457 static void hci_setup_inquiry_mode(struct hci_dev *hdev)
 458 {
 459         u8 mode;
 460
 461         mode = hci_get_inquiry_mode(hdev);
 462
 463         hci_send_cmd(hdev, HCI_OP_WRITE_INQUIRY_MODE, 1, &mode);
 464 }
 465
 466 static void hci_setup_event_mask(struct hci_dev *hdev)
 467 {
 468         /* The second byte is 0xff instead of 0x9f (two reserved bits
 469          * disabled) since a Broadcom 1.2 dongle doesn't respond to the
 470          * command otherwise */
 471         u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };
 472
 473         /* Events for 1.2 and newer controllers */
 474         if (hdev->lmp_ver > 1) {
 475                 events[4] |= 0x01; /* Flow Specification Complete */
 476                 events[4] |= 0x02; /* Inquiry Result with RSSI */
 477                 events[4] |= 0x04; /* Read Remote Extended Features Complete */
 478                 events[5] |= 0x08; /* Synchronous Connection Complete */
 479                 events[5] |= 0x10; /* Synchronous Connection Changed */
 480         }
 481
 482         if (hdev->features[3] & LMP_RSSI_INQ)
 483                 events[4] |= 0x04; /* Inquiry Result with RSSI */
 484
 485         if (hdev->features[5] & LMP_SNIFF_SUBR)
 486                 events[5] |= 0x20; /* Sniff Subrating */
 487
 488         if (hdev->features[5] & LMP_PAUSE_ENC)
 489                 events[5] |= 0x80; /* Encryption Key Refresh Complete */
 490
 491         if (hdev->features[6] & LMP_EXT_INQ)
 492                 events[5] |= 0x40; /* Extended Inquiry Result */
 493
 494         if (hdev->features[6] & LMP_NO_FLUSH)
 495                 events[7] |= 0x01; /* Enhanced Flush Complete */
 496
 497         if (hdev->features[7] & LMP_LSTO)
 498                 events[6] |= 0x80; /* Link Supervision Timeout Changed */
 499
 500         if (hdev->features[6] & LMP_SIMPLE_PAIR) {
 501                 events[6] |= 0x01;      /* IO Capability Request */
 502                 events[6] |= 0x02;      /* IO Capability Response */
 503                 events[6] |= 0x04;      /* User Confirmation Request */
 504                 events[6] |= 0x08;      /* User Passkey Request */
 505                 events[6] |= 0x10;      /* Remote OOB Data Request */
 506                 events[6] |= 0x20;      /* Simple Pairing Complete */
 507                 events[7] |= 0x04;      /* User Passkey Notification */
 508                 events[7] |= 0x08;      /* Keypress Notification */
 509                 events[7] |= 0x10;      /* Remote Host Supported
 510                                          * Features Notification */
 511         }
 512
 513         if (hdev->features[4] & LMP_LE)
 514                 events[7] |= 0x20;      /* LE Meta-Event */
 515
 516         hci_send_cmd(hdev, HCI_OP_SET_EVENT_MASK, sizeof(events), events);
 517 }
 518
 519 static void hci_setup(struct hci_dev *hdev)
 520 {
 521         hci_setup_event_mask(hdev);
 522
 523         if (hdev->lmp_ver > 1)
 524                 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
 525
 526         if (hdev->features[6] & LMP_SIMPLE_PAIR) {
 527                 u8 mode = 0x01;
 528                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(mode), &mode);
 529         }
 530
 531         if (hdev->features[3] & LMP_RSSI_INQ)
 532                 hci_setup_inquiry_mode(hdev);
 533
 534         if (hdev->features[7] & LMP_INQ_TX_PWR)
 535                 hci_send_cmd(hdev, HCI_OP_READ_INQ_RSP_TX_POWER, 0, NULL);
 536 }
 537
 538 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
 539 {
 540         struct hci_rp_read_local_version *rp = (void *) skb->data;
 541
 542         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 543
 544         if (rp->status)
 545                 return;
 546
 547         hdev->hci_ver = rp->hci_ver;
 548         hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
 549         hdev->lmp_ver = rp->lmp_ver;
 550         hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
 551         hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
 552
 553         BT_DBG("%s manufacturer %d hci ver %d:%d", hdev->name,
 554                                         hdev->manufacturer,
 555                                         hdev->hci_ver, hdev->hci_rev);
 556
 557         if (test_bit(HCI_INIT, &hdev->flags))
 558                 hci_setup(hdev);
 559 }
 560
 561 static void hci_setup_link_policy(struct hci_dev *hdev)
 562 {
 563         u16 link_policy = 0;
 564
 565         if (hdev->features[0] & LMP_RSWITCH)
 566                 link_policy |= HCI_LP_RSWITCH;
 567         if (hdev->features[0] & LMP_HOLD)
 568                 link_policy |= HCI_LP_HOLD;
 569         if (hdev->features[0] & LMP_SNIFF)
 570                 link_policy |= HCI_LP_SNIFF;
 571         if (hdev->features[1] & LMP_PARK)
 572                 link_policy |= HCI_LP_PARK;
 573
 574         link_policy = cpu_to_le16(link_policy);
 575         hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY,
 576                                         sizeof(link_policy), &link_policy);
 577 }
 578
 579 static void hci_cc_read_local_commands(struct hci_dev *hdev, struct sk_buff *skb)
 580 {
 581         struct hci_rp_read_local_commands *rp = (void *) skb->data;
 582
 583         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 584
 585         if (rp->status)
 586                 goto done;
 587
 588         memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 589
 590         if (test_bit(HCI_INIT, &hdev->flags) && (hdev->commands[5] & 0x10))
 591                 hci_setup_link_policy(hdev);
 592
 593 done:
 594         hci_req_complete(hdev, HCI_OP_READ_LOCAL_COMMANDS, rp->status);
 595 }
 596
 597 static void hci_cc_read_local_features(struct hci_dev *hdev, struct sk_buff *skb)
 598 {
 599         struct hci_rp_read_local_features *rp = (void *) skb->data;
 600
 601         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 602
 603         if (rp->status)
 604                 return;
 605
 606         memcpy(hdev->features, rp->features, 8);
 607
 608         /* Adjust default settings according to features
 609          * supported by device. */
 610
 611         if (hdev->features[0] & LMP_3SLOT)
 612                 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 613
 614         if (hdev->features[0] & LMP_5SLOT)
 615                 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 616
 617         if (hdev->features[1] & LMP_HV2) {
 618                 hdev->pkt_type  |= (HCI_HV2);
 619                 hdev->esco_type |= (ESCO_HV2);
 620         }
 621
 622         if (hdev->features[1] & LMP_HV3) {
 623                 hdev->pkt_type  |= (HCI_HV3);
 624                 hdev->esco_type |= (ESCO_HV3);
 625         }
 626
 627         if (hdev->features[3] & LMP_ESCO)
 628                 hdev->esco_type |= (ESCO_EV3);
 629
 630         if (hdev->features[4] & LMP_EV4)
 631                 hdev->esco_type |= (ESCO_EV4);
 632
 633         if (hdev->features[4] & LMP_EV5)
 634                 hdev->esco_type |= (ESCO_EV5);
 635
 636         if (hdev->features[5] & LMP_EDR_ESCO_2M)
 637                 hdev->esco_type |= (ESCO_2EV3);
 638
 639         if (hdev->features[5] & LMP_EDR_ESCO_3M)
 640                 hdev->esco_type |= (ESCO_3EV3);
 641
 642         if (hdev->features[5] & LMP_EDR_3S_ESCO)
 643                 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
 644
 645         BT_DBG("%s features 0x%.2x%.2x%.2x%.2x%.2x%.2x%.2x%.2x", hdev->name,
 646                                         hdev->features[0], hdev->features[1],
 647                                         hdev->features[2], hdev->features[3],
 648                                         hdev->features[4], hdev->features[5],
 649                                         hdev->features[6], hdev->features[7]);
 650 }
 651
 652 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 653 {
 654         struct hci_rp_read_buffer_size *rp = (void *) skb->data;
 655
 656         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 657
 658         if (rp->status)
 659                 return;
 660
 661         hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
 662         hdev->sco_mtu  = rp->sco_mtu;
 663         hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
 664         hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
 665
 666         if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
 667                 hdev->sco_mtu  = 64;
 668                 hdev->sco_pkts = 8;
 669         }
 670
 671         hdev->acl_cnt = hdev->acl_pkts;
 672         hdev->sco_cnt = hdev->sco_pkts;
 673
 674         BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name,
 675                                         hdev->acl_mtu, hdev->acl_pkts,
 676                                         hdev->sco_mtu, hdev->sco_pkts);
 677 }
 678
 679 static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
 680 {
 681         struct hci_rp_read_bd_addr *rp = (void *) skb->data;
 682
 683         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 684
 685         if (!rp->status)
 686                 bacpy(&hdev->bdaddr, &rp->bdaddr);
 687
 688         hci_req_complete(hdev, HCI_OP_READ_BD_ADDR, rp->status);
 689 }
 690
 691 static void hci_cc_write_ca_timeout(struct hci_dev *hdev, struct sk_buff *skb)
 692 {
 693         __u8 status = *((__u8 *) skb->data);
 694
 695         BT_DBG("%s status 0x%x", hdev->name, status);
 696
 697         hci_req_complete(hdev, HCI_OP_WRITE_CA_TIMEOUT, status);
 698 }
 699
 700 static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
 701                                                         struct sk_buff *skb)
 702 {
 703         __u8 status = *((__u8 *) skb->data);
 704
 705         BT_DBG("%s status 0x%x", hdev->name, status);
 706
 707         hci_req_complete(hdev, HCI_OP_DELETE_STORED_LINK_KEY, status);
 708 }
 709
 710 static void hci_cc_set_event_mask(struct hci_dev *hdev, struct sk_buff *skb)
 711 {
 712         __u8 status = *((__u8 *) skb->data);
 713
 714         BT_DBG("%s status 0x%x", hdev->name, status);
 715
 716         hci_req_complete(hdev, HCI_OP_SET_EVENT_MASK, status);
 717 }
 718
 719 static void hci_cc_write_inquiry_mode(struct hci_dev *hdev,
 720                                                         struct sk_buff *skb)
 721 {
 722         __u8 status = *((__u8 *) skb->data);
 723
 724         BT_DBG("%s status 0x%x", hdev->name, status);
 725
 726         hci_req_complete(hdev, HCI_OP_WRITE_INQUIRY_MODE, status);
 727 }
 728
 729 static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
 730                                                         struct sk_buff *skb)
 731 {
 732         __u8 status = *((__u8 *) skb->data);
 733
 734         BT_DBG("%s status 0x%x", hdev->name, status);
 735
 736         hci_req_complete(hdev, HCI_OP_READ_INQ_RSP_TX_POWER, status);
 737 }
 738
 739 static void hci_cc_set_event_flt(struct hci_dev *hdev, struct sk_buff *skb)
 740 {
 741         __u8 status = *((__u8 *) skb->data);
 742
 743         BT_DBG("%s status 0x%x", hdev->name, status);
 744
 745         hci_req_complete(hdev, HCI_OP_SET_EVENT_FLT, status);
 746 }
 747
 748 static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
 749 {
 750         struct hci_rp_pin_code_reply *rp = (void *) skb->data;
 751         struct hci_cp_pin_code_reply *cp;
 752         struct hci_conn *conn;
 753
 754         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 755
 756         if (test_bit(HCI_MGMT, &hdev->flags))
 757                 mgmt_pin_code_reply_complete(hdev->id, &rp->bdaddr, rp->status);
 758
 759         if (rp->status != 0)
 760                 return;
 761
 762         cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
 763         if (!cp)
 764                 return;
 765
 766         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 767         if (conn)
 768                 conn->pin_length = cp->pin_len;
 769 }
 770
 771 static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
 772 {
 773         struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
 774
 775         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 776
 777         if (test_bit(HCI_MGMT, &hdev->flags))
 778                 mgmt_pin_code_neg_reply_complete(hdev->id, &rp->bdaddr,
 779                                                                 rp->status);
 780 }
 781 static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
 782                                        struct sk_buff *skb)
 783 {
 784         struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
 785
 786         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 787
 788         if (rp->status)
 789                 return;
 790
 791         hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
 792         hdev->le_pkts = rp->le_max_pkt;
 793
 794         hdev->le_cnt = hdev->le_pkts;
 795
 796         BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
 797
 798         hci_req_complete(hdev, HCI_OP_LE_READ_BUFFER_SIZE, rp->status);
 799 }
 800
 801 static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
 802 {
 803         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 804
 805         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 806
 807         if (test_bit(HCI_MGMT, &hdev->flags))
 808                 mgmt_user_confirm_reply_complete(hdev->id, &rp->bdaddr,
 809                                                                 rp->status);
 810 }
 811
 812 static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
 813                                                         struct sk_buff *skb)
 814 {
 815         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 816
 817         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 818
 819         if (test_bit(HCI_MGMT, &hdev->flags))
 820                 mgmt_user_confirm_neg_reply_complete(hdev->id, &rp->bdaddr,
 821                                                                 rp->status);
 822 }
 823
 824 static inline void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
 825 {
 826         BT_DBG("%s status 0x%x", hdev->name, status);
 827
 828         if (status) {
 829                 hci_req_complete(hdev, HCI_OP_INQUIRY, status);
 830
 831                 hci_conn_check_pending(hdev);
 832         } else
 833                 set_bit(HCI_INQUIRY, &hdev->flags);
 834 }
 835
 836 static inline void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
 837 {
 838         struct hci_cp_create_conn *cp;
 839         struct hci_conn *conn;
 840
 841         BT_DBG("%s status 0x%x", hdev->name, status);
 842
 843         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
 844         if (!cp)
 845                 return;
 846
 847         hci_dev_lock(hdev);
 848
 849         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 850
 851         BT_DBG("%s bdaddr %s conn %p", hdev->name, batostr(&cp->bdaddr), conn);
 852
 853         if (status) {
 854                 if (conn && conn->state == BT_CONNECT) {
 855                         if (status != 0x0c || conn->attempt > 2) {
 856                                 conn->state = BT_CLOSED;
 857                                 hci_proto_connect_cfm(conn, status);
 858                                 hci_conn_del(conn);
 859                         } else
 860                                 conn->state = BT_CONNECT2;
 861                 }
 862         } else {
 863                 if (!conn) {
 864                         conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr);
 865                         if (conn) {
 866                                 conn->out = 1;
 867                                 conn->link_mode |= HCI_LM_MASTER;
 868                         } else
 869                                 BT_ERR("No memory for new connection");
 870                 }
 871         }
 872
 873         hci_dev_unlock(hdev);
 874 }
 875
 876 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
 877 {
 878         struct hci_cp_add_sco *cp;
 879         struct hci_conn *acl, *sco;
 880         __u16 handle;
 881
 882         BT_DBG("%s status 0x%x", hdev->name, status);
 883
 884         if (!status)
 885                 return;
 886
 887         cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
 888         if (!cp)
 889                 return;
 890
 891         handle = __le16_to_cpu(cp->handle);
 892
 893         BT_DBG("%s handle %d", hdev->name, handle);
 894
 895         hci_dev_lock(hdev);
 896
 897         acl = hci_conn_hash_lookup_handle(hdev, handle);
 898         if (acl) {
 899                 sco = acl->link;
 900                 if (sco) {
 901                         sco->state = BT_CLOSED;
 902
 903                         hci_proto_connect_cfm(sco, status);
 904                         hci_conn_del(sco);
 905                 }
 906         }
 907
 908         hci_dev_unlock(hdev);
 909 }
 910
 911 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
 912 {
 913         struct hci_cp_auth_requested *cp;
 914         struct hci_conn *conn;
 915
 916         BT_DBG("%s status 0x%x", hdev->name, status);
 917
 918         if (!status)
 919                 return;
 920
 921         cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
 922         if (!cp)
 923                 return;
 924
 925         hci_dev_lock(hdev);
 926
 927         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
 928         if (conn) {
 929                 if (conn->state == BT_CONFIG) {
 930                         hci_proto_connect_cfm(conn, status);
 931                         hci_conn_put(conn);
 932                 }
 933         }
 934
 935         hci_dev_unlock(hdev);
 936 }
 937
 938 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
 939 {
 940         struct hci_cp_set_conn_encrypt *cp;
 941         struct hci_conn *conn;
 942
 943         BT_DBG("%s status 0x%x", hdev->name, status);
 944
 945         if (!status)
 946                 return;
 947
 948         cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
 949         if (!cp)
 950                 return;
 951
 952         hci_dev_lock(hdev);
 953
 954         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
 955         if (conn) {
 956                 if (conn->state == BT_CONFIG) {
 957                         hci_proto_connect_cfm(conn, status);
 958                         hci_conn_put(conn);
 959                 }
 960         }
 961
 962         hci_dev_unlock(hdev);
 963 }
 964
 965 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
 966                                                         struct hci_conn *conn)
 967 {
 968         if (conn->state != BT_CONFIG || !conn->out)
 969                 return 0;
 970
 971         if (conn->pending_sec_level == BT_SECURITY_SDP)
 972                 return 0;
 973
 974         /* Only request authentication for SSP connections or non-SSP
 975          * devices with sec_level HIGH */
 976         if (!(hdev->ssp_mode > 0 && conn->ssp_mode > 0) &&
 977                                 conn->pending_sec_level != BT_SECURITY_HIGH)
 978                 return 0;
 979
 980         return 1;
 981 }
 982
 983 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
 984 {
 985         struct hci_cp_remote_name_req *cp;
 986         struct hci_conn *conn;
 987
 988         BT_DBG("%s status 0x%x", hdev->name, status);
 989
 990         /* If successful wait for the name req complete event before
 991          * checking for the need to do authentication */
 992         if (!status)
 993                 return;
 994
 995         cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
 996         if (!cp)
 997                 return;
 998
 999         hci_dev_lock(hdev);
1000
1001         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1002         if (conn && hci_outgoing_auth_needed(hdev, conn)) {
1003                 struct hci_cp_auth_requested cp;
1004                 cp.handle = __cpu_to_le16(conn->handle);
1005                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
1006         }
1007
1008         hci_dev_unlock(hdev);
1009 }
1010
1011 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
1012 {
1013         struct hci_cp_read_remote_features *cp;
1014         struct hci_conn *conn;
1015
1016         BT_DBG("%s status 0x%x", hdev->name, status);
1017
1018         if (!status)
1019                 return;
1020
1021         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
1022         if (!cp)
1023                 return;
1024
1025         hci_dev_lock(hdev);
1026
1027         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1028         if (conn) {
1029                 if (conn->state == BT_CONFIG) {
1030                         hci_proto_connect_cfm(conn, status);
1031                         hci_conn_put(conn);
1032                 }
1033         }
1034
1035         hci_dev_unlock(hdev);
1036 }
1037
1038 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
1039 {
1040         struct hci_cp_read_remote_ext_features *cp;
1041         struct hci_conn *conn;
1042
1043         BT_DBG("%s status 0x%x", hdev->name, status);
1044
1045         if (!status)
1046                 return;
1047
1048         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
1049         if (!cp)
1050                 return;
1051
1052         hci_dev_lock(hdev);
1053
1054         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1055         if (conn) {
1056                 if (conn->state == BT_CONFIG) {
1057                         hci_proto_connect_cfm(conn, status);
1058                         hci_conn_put(conn);
1059                 }
1060         }
1061
1062         hci_dev_unlock(hdev);
1063 }
1064
1065 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
1066 {
1067         struct hci_cp_setup_sync_conn *cp;
1068         struct hci_conn *acl, *sco;
1069         __u16 handle;
1070
1071         BT_DBG("%s status 0x%x", hdev->name, status);
1072
1073         if (!status)
1074                 return;
1075
1076         cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
1077         if (!cp)
1078                 return;
1079
1080         handle = __le16_to_cpu(cp->handle);
1081
1082         BT_DBG("%s handle %d", hdev->name, handle);
1083
1084         hci_dev_lock(hdev);
1085
1086         acl = hci_conn_hash_lookup_handle(hdev, handle);
1087         if (acl) {
1088                 sco = acl->link;
1089                 if (sco) {
1090                         sco->state = BT_CLOSED;
1091
1092                         hci_proto_connect_cfm(sco, status);
1093                         hci_conn_del(sco);
1094                 }
1095         }
1096
1097         hci_dev_unlock(hdev);
1098 }
1099
1100 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
1101 {
1102         struct hci_cp_sniff_mode *cp;
1103         struct hci_conn *conn;
1104
1105         BT_DBG("%s status 0x%x", hdev->name, status);
1106
1107         if (!status)
1108                 return;
1109
1110         cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
1111         if (!cp)
1112                 return;
1113
1114         hci_dev_lock(hdev);
1115
1116         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1117         if (conn) {
1118                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend);
1119
1120                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->pend))
1121                         hci_sco_setup(conn, status);
1122         }
1123
1124         hci_dev_unlock(hdev);
1125 }
1126
1127 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
1128 {
1129         struct hci_cp_exit_sniff_mode *cp;
1130         struct hci_conn *conn;
1131
1132         BT_DBG("%s status 0x%x", hdev->name, status);
1133
1134         if (!status)
1135                 return;
1136
1137         cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
1138         if (!cp)
1139                 return;
1140
1141         hci_dev_lock(hdev);
1142
1143         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1144         if (conn) {
1145                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend);
1146
1147                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->pend))
1148                         hci_sco_setup(conn, status);
1149         }
1150
1151         hci_dev_unlock(hdev);
1152 }
1153
1154 static void hci_cs_le_create_conn(struct hci_dev *hdev, __u8 status)
1155 {
1156         struct hci_cp_le_create_conn *cp;
1157         struct hci_conn *conn;
1158
1159         BT_DBG("%s status 0x%x", hdev->name, status);
1160
1161         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
1162         if (!cp)
1163                 return;
1164
1165         hci_dev_lock(hdev);
1166
1167         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->peer_addr);
1168
1169         BT_DBG("%s bdaddr %s conn %p", hdev->name, batostr(&cp->peer_addr),
1170                 conn);
1171
1172         if (status) {
1173                 if (conn && conn->state == BT_CONNECT) {
1174                         conn->state = BT_CLOSED;
1175                         hci_proto_connect_cfm(conn, status);
1176                         hci_conn_del(conn);
1177                 }
1178         } else {
1179                 if (!conn) {
1180                         conn = hci_conn_add(hdev, LE_LINK, &cp->peer_addr);
1181                         if (conn)
1182                                 conn->out = 1;
1183                         else
1184                                 BT_ERR("No memory for new connection");
1185                 }
1186         }
1187
1188         hci_dev_unlock(hdev);
1189 }
1190
1191 static inline void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1192 {
1193         __u8 status = *((__u8 *) skb->data);
1194
1195         BT_DBG("%s status %d", hdev->name, status);
1196
1197         clear_bit(HCI_INQUIRY, &hdev->flags);
1198
1199         hci_req_complete(hdev, HCI_OP_INQUIRY, status);
1200
1201         hci_conn_check_pending(hdev);
1202 }
1203
1204 static inline void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
1205 {
1206         struct inquiry_data data;
1207         struct inquiry_info *info = (void *) (skb->data + 1);
1208         int num_rsp = *((__u8 *) skb->data);
1209
1210         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
1211
1212         if (!num_rsp)
1213                 return;
1214
1215         hci_dev_lock(hdev);
1216
1217         for (; num_rsp; num_rsp--) {
1218                 bacpy(&data.bdaddr, &info->bdaddr);
1219                 data.pscan_rep_mode     = info->pscan_rep_mode;
1220                 data.pscan_period_mode  = info->pscan_period_mode;
1221                 data.pscan_mode         = info->pscan_mode;
1222                 memcpy(data.dev_class, info->dev_class, 3);
1223                 data.clock_offset       = info->clock_offset;
1224                 data.rssi               = 0x00;
1225                 data.ssp_mode           = 0x00;
1226                 info++;
1227                 hci_inquiry_cache_update(hdev, &data);
1228         }
1229
1230         hci_dev_unlock(hdev);
1231 }
1232
1233 static inline void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1234 {
1235         struct hci_ev_conn_complete *ev = (void *) skb->data;
1236         struct hci_conn *conn;
1237
1238         BT_DBG("%s", hdev->name);
1239
1240         hci_dev_lock(hdev);
1241
1242         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
1243         if (!conn) {
1244                 if (ev->link_type != SCO_LINK)
1245                         goto unlock;
1246
1247                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
1248                 if (!conn)
1249                         goto unlock;
1250
1251                 conn->type = SCO_LINK;
1252         }
1253
1254         if (!ev->status) {
1255                 conn->handle = __le16_to_cpu(ev->handle);
1256
1257                 if (conn->type == ACL_LINK) {
1258                         conn->state = BT_CONFIG;
1259                         hci_conn_hold(conn);
1260                         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
1261                         mgmt_connected(hdev->id, &ev->bdaddr);
1262                 } else
1263                         conn->state = BT_CONNECTED;
1264
1265                 hci_conn_hold_device(conn);
1266                 hci_conn_add_sysfs(conn);
1267
1268                 if (test_bit(HCI_AUTH, &hdev->flags))
1269                         conn->link_mode |= HCI_LM_AUTH;
1270
1271                 if (test_bit(HCI_ENCRYPT, &hdev->flags))
1272                         conn->link_mode |= HCI_LM_ENCRYPT;
1273
1274                 /* Get remote features */
1275                 if (conn->type == ACL_LINK) {
1276                         struct hci_cp_read_remote_features cp;
1277                         cp.handle = ev->handle;
1278                         hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
1279                                                         sizeof(cp), &cp);
1280                 }
1281
1282                 /* Set packet type for incoming connection */
1283                 if (!conn->out && hdev->hci_ver < 3) {
1284                         struct hci_cp_change_conn_ptype cp;
1285                         cp.handle = ev->handle;
1286                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
1287                         hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE,
1288                                                         sizeof(cp), &cp);
1289                 }
1290         } else {
1291                 conn->state = BT_CLOSED;
1292                 if (conn->type == ACL_LINK)
1293                         mgmt_connect_failed(hdev->id, &ev->bdaddr, ev->status);
1294         }
1295
1296         if (conn->type == ACL_LINK)
1297                 hci_sco_setup(conn, ev->status);
1298
1299         if (ev->status) {
1300                 hci_proto_connect_cfm(conn, ev->status);
1301                 hci_conn_del(conn);
1302         } else if (ev->link_type != ACL_LINK)
1303                 hci_proto_connect_cfm(conn, ev->status);
1304
1305 unlock:
1306         hci_dev_unlock(hdev);
1307
1308         hci_conn_check_pending(hdev);
1309 }
1310
1311 static inline void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
1312 {
1313         struct hci_ev_conn_request *ev = (void *) skb->data;
1314         int mask = hdev->link_mode;
1315
1316         BT_DBG("%s bdaddr %s type 0x%x", hdev->name,
1317                                         batostr(&ev->bdaddr), ev->link_type);
1318
1319         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type);
1320
1321         if ((mask & HCI_LM_ACCEPT) &&
1322                         !hci_blacklist_lookup(hdev, &ev->bdaddr)) {
1323                 /* Connection accepted */
1324                 struct inquiry_entry *ie;
1325                 struct hci_conn *conn;
1326
1327                 hci_dev_lock(hdev);
1328
1329                 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
1330                 if (ie)
1331                         memcpy(ie->data.dev_class, ev->dev_class, 3);
1332
1333                 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
1334                 if (!conn) {
1335                         conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr);
1336                         if (!conn) {
1337                                 BT_ERR("No memory for new connection");
1338                                 hci_dev_unlock(hdev);
1339                                 return;
1340                         }
1341                 }
1342
1343                 memcpy(conn->dev_class, ev->dev_class, 3);
1344                 conn->state = BT_CONNECT;
1345
1346                 hci_dev_unlock(hdev);
1347
1348                 if (ev->link_type == ACL_LINK || !lmp_esco_capable(hdev)) {
1349                         struct hci_cp_accept_conn_req cp;
1350
1351                         bacpy(&cp.bdaddr, &ev->bdaddr);
1352
1353                         if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
1354                                 cp.role = 0x00; /* Become master */
1355                         else
1356                                 cp.role = 0x01; /* Remain slave */
1357
1358                         hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ,
1359                                                         sizeof(cp), &cp);
1360                 } else {
1361                         struct hci_cp_accept_sync_conn_req cp;
1362
1363                         bacpy(&cp.bdaddr, &ev->bdaddr);
1364                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
1365
1366                         cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
1367                         cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
1368                         cp.max_latency    = cpu_to_le16(0xffff);
1369                         cp.content_format = cpu_to_le16(hdev->voice_setting);
1370                         cp.retrans_effort = 0xff;
1371
1372                         hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ,
1373                                                         sizeof(cp), &cp);
1374                 }
1375         } else {
1376                 /* Connection rejected */
1377                 struct hci_cp_reject_conn_req cp;
1378
1379                 bacpy(&cp.bdaddr, &ev->bdaddr);
1380                 cp.reason = 0x0f;
1381                 hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
1382         }
1383 }
1384
1385 static inline void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1386 {
1387         struct hci_ev_disconn_complete *ev = (void *) skb->data;
1388         struct hci_conn *conn;
1389
1390         BT_DBG("%s status %d", hdev->name, ev->status);
1391
1392         if (ev->status) {
1393                 mgmt_disconnect_failed(hdev->id);
1394                 return;
1395         }
1396
1397         hci_dev_lock(hdev);
1398
1399         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1400         if (!conn)
1401                 goto unlock;
1402
1403         conn->state = BT_CLOSED;
1404
1405         if (conn->type == ACL_LINK)
1406                 mgmt_disconnected(hdev->id, &conn->dst);
1407
1408         hci_proto_disconn_cfm(conn, ev->reason);
1409         hci_conn_del(conn);
1410
1411 unlock:
1412         hci_dev_unlock(hdev);
1413 }
1414
1415 static inline void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1416 {
1417         struct hci_ev_auth_complete *ev = (void *) skb->data;
1418         struct hci_conn *conn;
1419
1420         BT_DBG("%s status %d", hdev->name, ev->status);
1421
1422         hci_dev_lock(hdev);
1423
1424         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1425         if (conn) {
1426                 if (!ev->status) {
1427                         conn->link_mode |= HCI_LM_AUTH;
1428                         conn->sec_level = conn->pending_sec_level;
1429                 } else {
1430                         mgmt_auth_failed(hdev->id, &conn->dst, ev->status);
1431                         conn->sec_level = BT_SECURITY_LOW;
1432                 }
1433
1434                 clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
1435
1436                 if (conn->state == BT_CONFIG) {
1437                         if (!ev->status && hdev->ssp_mode > 0 &&
1438                                                         conn->ssp_mode > 0) {
1439                                 struct hci_cp_set_conn_encrypt cp;
1440                                 cp.handle  = ev->handle;
1441                                 cp.encrypt = 0x01;
1442                                 hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT,
1443                                                         sizeof(cp), &cp);
1444                         } else {
1445                                 conn->state = BT_CONNECTED;
1446                                 hci_proto_connect_cfm(conn, ev->status);
1447                                 hci_conn_put(conn);
1448                         }
1449                 } else {
1450                         hci_auth_cfm(conn, ev->status);
1451
1452                         hci_conn_hold(conn);
1453                         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
1454                         hci_conn_put(conn);
1455                 }
1456
1457                 if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend)) {
1458                         if (!ev->status) {
1459                                 struct hci_cp_set_conn_encrypt cp;
1460                                 cp.handle  = ev->handle;
1461                                 cp.encrypt = 0x01;
1462                                 hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT,
1463                                                         sizeof(cp), &cp);
1464                         } else {
1465                                 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
1466                                 hci_encrypt_cfm(conn, ev->status, 0x00);
1467                         }
1468                 }
1469         }
1470
1471         hci_dev_unlock(hdev);
1472 }
1473
1474 static inline void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
1475 {
1476         struct hci_ev_remote_name *ev = (void *) skb->data;
1477         struct hci_conn *conn;
1478
1479         BT_DBG("%s", hdev->name);
1480
1481         hci_conn_check_pending(hdev);
1482
1483         hci_dev_lock(hdev);
1484
1485         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
1486         if (conn && hci_outgoing_auth_needed(hdev, conn)) {
1487                 struct hci_cp_auth_requested cp;
1488                 cp.handle = __cpu_to_le16(conn->handle);
1489                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
1490         }
1491
1492         hci_dev_unlock(hdev);
1493 }
1494
1495 static inline void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
1496 {
1497         struct hci_ev_encrypt_change *ev = (void *) skb->data;
1498         struct hci_conn *conn;
1499
1500         BT_DBG("%s status %d", hdev->name, ev->status);
1501
1502         hci_dev_lock(hdev);
1503
1504         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1505         if (conn) {
1506                 if (!ev->status) {
1507                         if (ev->encrypt) {
1508                                 /* Encryption implies authentication */
1509                                 conn->link_mode |= HCI_LM_AUTH;
1510                                 conn->link_mode |= HCI_LM_ENCRYPT;
1511                         } else
1512                                 conn->link_mode &= ~HCI_LM_ENCRYPT;
1513                 }
1514
1515                 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
1516
1517                 if (conn->state == BT_CONFIG) {
1518                         if (!ev->status)
1519                                 conn->state = BT_CONNECTED;
1520
1521                         hci_proto_connect_cfm(conn, ev->status);
1522                         hci_conn_put(conn);
1523                 } else
1524                         hci_encrypt_cfm(conn, ev->status, ev->encrypt);
1525         }
1526
1527         hci_dev_unlock(hdev);
1528 }
1529
1530 static inline void hci_change_link_key_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1531 {
1532         struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
1533         struct hci_conn *conn;
1534
1535         BT_DBG("%s status %d", hdev->name, ev->status);
1536
1537         hci_dev_lock(hdev);
1538
1539         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1540         if (conn) {
1541                 if (!ev->status)
1542                         conn->link_mode |= HCI_LM_SECURE;
1543
1544                 clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
1545
1546                 hci_key_change_cfm(conn, ev->status);
1547         }
1548
1549         hci_dev_unlock(hdev);
1550 }
1551
1552 static inline void hci_remote_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
1553 {
1554         struct hci_ev_remote_features *ev = (void *) skb->data;
1555         struct hci_conn *conn;
1556
1557         BT_DBG("%s status %d", hdev->name, ev->status);
1558
1559         hci_dev_lock(hdev);
1560
1561         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1562         if (!conn)
1563                 goto unlock;
1564
1565         if (!ev->status)
1566                 memcpy(conn->features, ev->features, 8);
1567
1568         if (conn->state != BT_CONFIG)
1569                 goto unlock;
1570
1571         if (!ev->status && lmp_ssp_capable(hdev) && lmp_ssp_capable(conn)) {
1572                 struct hci_cp_read_remote_ext_features cp;
1573                 cp.handle = ev->handle;
1574                 cp.page = 0x01;
1575                 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
1576                                                         sizeof(cp), &cp);
1577                 goto unlock;
1578         }
1579
1580         if (!ev->status) {
1581                 struct hci_cp_remote_name_req cp;
1582                 memset(&cp, 0, sizeof(cp));
1583                 bacpy(&cp.bdaddr, &conn->dst);
1584                 cp.pscan_rep_mode = 0x02;
1585                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1586         }
1587
1588         if (!hci_outgoing_auth_needed(hdev, conn)) {
1589                 conn->state = BT_CONNECTED;
1590                 hci_proto_connect_cfm(conn, ev->status);
1591                 hci_conn_put(conn);
1592         }
1593
1594 unlock:
1595         hci_dev_unlock(hdev);
1596 }
1597
1598 static inline void hci_remote_version_evt(struct hci_dev *hdev, struct sk_buff *skb)
1599 {
1600         BT_DBG("%s", hdev->name);
1601 }
1602
1603 static inline void hci_qos_setup_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1604 {
1605         BT_DBG("%s", hdev->name);
1606 }
1607
1608 static inline void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1609 {
1610         struct hci_ev_cmd_complete *ev = (void *) skb->data;
1611         __u16 opcode;
1612
1613         skb_pull(skb, sizeof(*ev));
1614
1615         opcode = __le16_to_cpu(ev->opcode);
1616
1617         switch (opcode) {
1618         case HCI_OP_INQUIRY_CANCEL:
1619                 hci_cc_inquiry_cancel(hdev, skb);
1620                 break;
1621
1622         case HCI_OP_EXIT_PERIODIC_INQ:
1623                 hci_cc_exit_periodic_inq(hdev, skb);
1624                 break;
1625
1626         case HCI_OP_REMOTE_NAME_REQ_CANCEL:
1627                 hci_cc_remote_name_req_cancel(hdev, skb);
1628                 break;
1629
1630         case HCI_OP_ROLE_DISCOVERY:
1631                 hci_cc_role_discovery(hdev, skb);
1632                 break;
1633
1634         case HCI_OP_READ_LINK_POLICY:
1635                 hci_cc_read_link_policy(hdev, skb);
1636                 break;
1637
1638         case HCI_OP_WRITE_LINK_POLICY:
1639                 hci_cc_write_link_policy(hdev, skb);
1640                 break;
1641
1642         case HCI_OP_READ_DEF_LINK_POLICY:
1643                 hci_cc_read_def_link_policy(hdev, skb);
1644                 break;
1645
1646         case HCI_OP_WRITE_DEF_LINK_POLICY:
1647                 hci_cc_write_def_link_policy(hdev, skb);
1648                 break;
1649
1650         case HCI_OP_RESET:
1651                 hci_cc_reset(hdev, skb);
1652                 break;
1653
1654         case HCI_OP_WRITE_LOCAL_NAME:
1655                 hci_cc_write_local_name(hdev, skb);
1656                 break;
1657
1658         case HCI_OP_READ_LOCAL_NAME:
1659                 hci_cc_read_local_name(hdev, skb);
1660                 break;
1661
1662         case HCI_OP_WRITE_AUTH_ENABLE:
1663                 hci_cc_write_auth_enable(hdev, skb);
1664                 break;
1665
1666         case HCI_OP_WRITE_ENCRYPT_MODE:
1667                 hci_cc_write_encrypt_mode(hdev, skb);
1668                 break;
1669
1670         case HCI_OP_WRITE_SCAN_ENABLE:
1671                 hci_cc_write_scan_enable(hdev, skb);
1672                 break;
1673
1674         case HCI_OP_READ_CLASS_OF_DEV:
1675                 hci_cc_read_class_of_dev(hdev, skb);
1676                 break;
1677
1678         case HCI_OP_WRITE_CLASS_OF_DEV:
1679                 hci_cc_write_class_of_dev(hdev, skb);
1680                 break;
1681
1682         case HCI_OP_READ_VOICE_SETTING:
1683                 hci_cc_read_voice_setting(hdev, skb);
1684                 break;
1685
1686         case HCI_OP_WRITE_VOICE_SETTING:
1687                 hci_cc_write_voice_setting(hdev, skb);
1688                 break;
1689
1690         case HCI_OP_HOST_BUFFER_SIZE:
1691                 hci_cc_host_buffer_size(hdev, skb);
1692                 break;
1693
1694         case HCI_OP_READ_SSP_MODE:
1695                 hci_cc_read_ssp_mode(hdev, skb);
1696                 break;
1697
1698         case HCI_OP_WRITE_SSP_MODE:
1699                 hci_cc_write_ssp_mode(hdev, skb);
1700                 break;
1701
1702         case HCI_OP_READ_LOCAL_VERSION:
1703                 hci_cc_read_local_version(hdev, skb);
1704                 break;
1705
1706         case HCI_OP_READ_LOCAL_COMMANDS:
1707                 hci_cc_read_local_commands(hdev, skb);
1708                 break;
1709
1710         case HCI_OP_READ_LOCAL_FEATURES:
1711                 hci_cc_read_local_features(hdev, skb);
1712                 break;
1713
1714         case HCI_OP_READ_BUFFER_SIZE:
1715                 hci_cc_read_buffer_size(hdev, skb);
1716                 break;
1717
1718         case HCI_OP_READ_BD_ADDR:
1719                 hci_cc_read_bd_addr(hdev, skb);
1720                 break;
1721
1722         case HCI_OP_WRITE_CA_TIMEOUT:
1723                 hci_cc_write_ca_timeout(hdev, skb);
1724                 break;
1725
1726         case HCI_OP_DELETE_STORED_LINK_KEY:
1727                 hci_cc_delete_stored_link_key(hdev, skb);
1728                 break;
1729
1730         case HCI_OP_SET_EVENT_MASK:
1731                 hci_cc_set_event_mask(hdev, skb);
1732                 break;
1733
1734         case HCI_OP_WRITE_INQUIRY_MODE:
1735                 hci_cc_write_inquiry_mode(hdev, skb);
1736                 break;
1737
1738         case HCI_OP_READ_INQ_RSP_TX_POWER:
1739                 hci_cc_read_inq_rsp_tx_power(hdev, skb);
1740                 break;
1741
1742         case HCI_OP_SET_EVENT_FLT:
1743                 hci_cc_set_event_flt(hdev, skb);
1744                 break;
1745
1746         case HCI_OP_PIN_CODE_REPLY:
1747                 hci_cc_pin_code_reply(hdev, skb);
1748                 break;
1749
1750         case HCI_OP_PIN_CODE_NEG_REPLY:
1751                 hci_cc_pin_code_neg_reply(hdev, skb);
1752                 break;
1753
1754         case HCI_OP_LE_READ_BUFFER_SIZE:
1755                 hci_cc_le_read_buffer_size(hdev, skb);
1756                 break;
1757
1758         case HCI_OP_USER_CONFIRM_REPLY:
1759                 hci_cc_user_confirm_reply(hdev, skb);
1760                 break;
1761
1762         case HCI_OP_USER_CONFIRM_NEG_REPLY:
1763                 hci_cc_user_confirm_neg_reply(hdev, skb);
1764                 break;
1765
1766         default:
1767                 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
1768                 break;
1769         }
1770
1771         if (ev->opcode != HCI_OP_NOP)
1772                 del_timer(&hdev->cmd_timer);
1773
1774         if (ev->ncmd) {
1775                 atomic_set(&hdev->cmd_cnt, 1);
1776                 if (!skb_queue_empty(&hdev->cmd_q))
1777                         tasklet_schedule(&hdev->cmd_task);
1778         }
1779 }
1780
1781 static inline void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb)
1782 {
1783         struct hci_ev_cmd_status *ev = (void *) skb->data;
1784         __u16 opcode;
1785
1786         skb_pull(skb, sizeof(*ev));
1787
1788         opcode = __le16_to_cpu(ev->opcode);
1789
1790         switch (opcode) {
1791         case HCI_OP_INQUIRY:
1792                 hci_cs_inquiry(hdev, ev->status);
1793                 break;
1794
1795         case HCI_OP_CREATE_CONN:
1796                 hci_cs_create_conn(hdev, ev->status);
1797                 break;
1798
1799         case HCI_OP_ADD_SCO:
1800                 hci_cs_add_sco(hdev, ev->status);
1801                 break;
1802
1803         case HCI_OP_AUTH_REQUESTED:
1804                 hci_cs_auth_requested(hdev, ev->status);
1805                 break;
1806
1807         case HCI_OP_SET_CONN_ENCRYPT:
1808                 hci_cs_set_conn_encrypt(hdev, ev->status);
1809                 break;
1810
1811         case HCI_OP_REMOTE_NAME_REQ:
1812                 hci_cs_remote_name_req(hdev, ev->status);
1813                 break;
1814
1815         case HCI_OP_READ_REMOTE_FEATURES:
1816                 hci_cs_read_remote_features(hdev, ev->status);
1817                 break;
1818
1819         case HCI_OP_READ_REMOTE_EXT_FEATURES:
1820                 hci_cs_read_remote_ext_features(hdev, ev->status);
1821                 break;
1822
1823         case HCI_OP_SETUP_SYNC_CONN:
1824                 hci_cs_setup_sync_conn(hdev, ev->status);
1825                 break;
1826
1827         case HCI_OP_SNIFF_MODE:
1828                 hci_cs_sniff_mode(hdev, ev->status);
1829                 break;
1830
1831         case HCI_OP_EXIT_SNIFF_MODE:
1832                 hci_cs_exit_sniff_mode(hdev, ev->status);
1833                 break;
1834
1835         case HCI_OP_DISCONNECT:
1836                 if (ev->status != 0)
1837                         mgmt_disconnect_failed(hdev->id);
1838                 break;
1839
1840         case HCI_OP_LE_CREATE_CONN:
1841                 hci_cs_le_create_conn(hdev, ev->status);
1842                 break;
1843
1844         default:
1845                 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
1846                 break;
1847         }
1848
1849         if (ev->opcode != HCI_OP_NOP)
1850                 del_timer(&hdev->cmd_timer);
1851
1852         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
1853                 atomic_set(&hdev->cmd_cnt, 1);
1854                 if (!skb_queue_empty(&hdev->cmd_q))
1855                         tasklet_schedule(&hdev->cmd_task);
1856         }
1857 }
1858
1859 static inline void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
1860 {
1861         struct hci_ev_role_change *ev = (void *) skb->data;
1862         struct hci_conn *conn;
1863
1864         BT_DBG("%s status %d", hdev->name, ev->status);
1865
1866         hci_dev_lock(hdev);
1867
1868         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
1869         if (conn) {
1870                 if (!ev->status) {
1871                         if (ev->role)
1872                                 conn->link_mode &= ~HCI_LM_MASTER;
1873                         else
1874                                 conn->link_mode |= HCI_LM_MASTER;
1875                 }
1876
1877                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->pend);
1878
1879                 hci_role_switch_cfm(conn, ev->status, ev->role);
1880         }
1881
1882         hci_dev_unlock(hdev);
1883 }
1884
1885 static inline void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
1886 {
1887         struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
1888         __le16 *ptr;
1889         int i;
1890
1891         skb_pull(skb, sizeof(*ev));
1892
1893         BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
1894
1895         if (skb->len < ev->num_hndl * 4) {
1896                 BT_DBG("%s bad parameters", hdev->name);
1897                 return;
1898         }
1899
1900         tasklet_disable(&hdev->tx_task);
1901
1902         for (i = 0, ptr = (__le16 *) skb->data; i < ev->num_hndl; i++) {
1903                 struct hci_conn *conn;
1904                 __u16  handle, count;
1905
1906                 handle = get_unaligned_le16(ptr++);
1907                 count  = get_unaligned_le16(ptr++);
1908
1909                 conn = hci_conn_hash_lookup_handle(hdev, handle);
1910                 if (conn) {
1911                         conn->sent -= count;
1912
1913                         if (conn->type == ACL_LINK) {
1914                                 hdev->acl_cnt += count;
1915                                 if (hdev->acl_cnt > hdev->acl_pkts)
1916                                         hdev->acl_cnt = hdev->acl_pkts;
1917                         } else if (conn->type == LE_LINK) {
1918                                 if (hdev->le_pkts) {
1919                                         hdev->le_cnt += count;
1920                                         if (hdev->le_cnt > hdev->le_pkts)
1921                                                 hdev->le_cnt = hdev->le_pkts;
1922                                 } else {
1923                                         hdev->acl_cnt += count;
1924                                         if (hdev->acl_cnt > hdev->acl_pkts)
1925                                                 hdev->acl_cnt = hdev->acl_pkts;
1926                                 }
1927                         } else {
1928                                 hdev->sco_cnt += count;
1929                                 if (hdev->sco_cnt > hdev->sco_pkts)
1930                                         hdev->sco_cnt = hdev->sco_pkts;
1931                         }
1932                 }
1933         }
1934
1935         tasklet_schedule(&hdev->tx_task);
1936
1937         tasklet_enable(&hdev->tx_task);
1938 }
1939
1940 static inline void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
1941 {
1942         struct hci_ev_mode_change *ev = (void *) skb->data;
1943         struct hci_conn *conn;
1944
1945         BT_DBG("%s status %d", hdev->name, ev->status);
1946
1947         hci_dev_lock(hdev);
1948
1949         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1950         if (conn) {
1951                 conn->mode = ev->mode;
1952                 conn->interval = __le16_to_cpu(ev->interval);
1953
1954                 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
1955                         if (conn->mode == HCI_CM_ACTIVE)
1956                                 conn->power_save = 1;
1957                         else
1958                                 conn->power_save = 0;
1959                 }
1960
1961                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->pend))
1962                         hci_sco_setup(conn, ev->status);
1963         }
1964
1965         hci_dev_unlock(hdev);
1966 }
1967
1968 static inline void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
1969 {
1970         struct hci_ev_pin_code_req *ev = (void *) skb->data;
1971         struct hci_conn *conn;
1972
1973         BT_DBG("%s", hdev->name);
1974
1975         hci_dev_lock(hdev);
1976
1977         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
1978         if (conn && conn->state == BT_CONNECTED) {
1979                 hci_conn_hold(conn);
1980                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
1981                 hci_conn_put(conn);
1982         }
1983
1984         if (!test_bit(HCI_PAIRABLE, &hdev->flags))
1985                 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
1986                                         sizeof(ev->bdaddr), &ev->bdaddr);
1987
1988         if (test_bit(HCI_MGMT, &hdev->flags))
1989                 mgmt_pin_code_request(hdev->id, &ev->bdaddr);
1990
1991         hci_dev_unlock(hdev);
1992 }
1993
1994 static inline void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
1995 {
1996         struct hci_ev_link_key_req *ev = (void *) skb->data;
1997         struct hci_cp_link_key_reply cp;
1998         struct hci_conn *conn;
1999         struct link_key *key;
2000
2001         BT_DBG("%s", hdev->name);
2002
2003         if (!test_bit(HCI_LINK_KEYS, &hdev->flags))
2004                 return;
2005
2006         hci_dev_lock(hdev);
2007
2008         key = hci_find_link_key(hdev, &ev->bdaddr);
2009         if (!key) {
2010                 BT_DBG("%s link key not found for %s", hdev->name,
2011                                                         batostr(&ev->bdaddr));
2012                 goto not_found;
2013         }
2014
2015         BT_DBG("%s found key type %u for %s", hdev->name, key->type,
2016                                                         batostr(&ev->bdaddr));
2017
2018         if (!test_bit(HCI_DEBUG_KEYS, &hdev->flags) && key->type == 0x03) {
2019                 BT_DBG("%s ignoring debug key", hdev->name);
2020                 goto not_found;
2021         }
2022
2023         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2024
2025         if (key->type == 0x04 && conn && conn->auth_type != 0xff &&
2026                                                 (conn->auth_type & 0x01)) {
2027                 BT_DBG("%s ignoring unauthenticated key", hdev->name);
2028                 goto not_found;
2029         }
2030
2031         bacpy(&cp.bdaddr, &ev->bdaddr);
2032         memcpy(cp.link_key, key->val, 16);
2033
2034         hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
2035
2036         hci_dev_unlock(hdev);
2037
2038         return;
2039
2040 not_found:
2041         hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
2042         hci_dev_unlock(hdev);
2043 }
2044
2045 static inline void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
2046 {
2047         struct hci_ev_link_key_notify *ev = (void *) skb->data;
2048         struct hci_conn *conn;
2049         u8 pin_len = 0;
2050
2051         BT_DBG("%s", hdev->name);
2052
2053         hci_dev_lock(hdev);
2054
2055         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2056         if (conn) {
2057                 hci_conn_hold(conn);
2058                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2059                 pin_len = conn->pin_length;
2060                 hci_conn_put(conn);
2061         }
2062
2063         if (test_bit(HCI_LINK_KEYS, &hdev->flags))
2064                 hci_add_link_key(hdev, 1, &ev->bdaddr, ev->link_key,
2065                                                         ev->key_type, pin_len);
2066
2067         hci_dev_unlock(hdev);
2068 }
2069
2070 static inline void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
2071 {
2072         struct hci_ev_clock_offset *ev = (void *) skb->data;
2073         struct hci_conn *conn;
2074
2075         BT_DBG("%s status %d", hdev->name, ev->status);
2076
2077         hci_dev_lock(hdev);
2078
2079         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2080         if (conn && !ev->status) {
2081                 struct inquiry_entry *ie;
2082
2083                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
2084                 if (ie) {
2085                         ie->data.clock_offset = ev->clock_offset;
2086                         ie->timestamp = jiffies;
2087                 }
2088         }
2089
2090         hci_dev_unlock(hdev);
2091 }
2092
2093 static inline void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2094 {
2095         struct hci_ev_pkt_type_change *ev = (void *) skb->data;
2096         struct hci_conn *conn;
2097
2098         BT_DBG("%s status %d", hdev->name, ev->status);
2099
2100         hci_dev_lock(hdev);
2101
2102         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2103         if (conn && !ev->status)
2104                 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
2105
2106         hci_dev_unlock(hdev);
2107 }
2108
2109 static inline void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
2110 {
2111         struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
2112         struct inquiry_entry *ie;
2113
2114         BT_DBG("%s", hdev->name);
2115
2116         hci_dev_lock(hdev);
2117
2118         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2119         if (ie) {
2120                 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
2121                 ie->timestamp = jiffies;
2122         }
2123
2124         hci_dev_unlock(hdev);
2125 }
2126
2127 static inline void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, struct sk_buff *skb)
2128 {
2129         struct inquiry_data data;
2130         int num_rsp = *((__u8 *) skb->data);
2131
2132         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2133
2134         if (!num_rsp)
2135                 return;
2136
2137         hci_dev_lock(hdev);
2138
2139         if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
2140                 struct inquiry_info_with_rssi_and_pscan_mode *info;
2141                 info = (void *) (skb->data + 1);
2142
2143                 for (; num_rsp; num_rsp--) {
2144                         bacpy(&data.bdaddr, &info->bdaddr);
2145                         data.pscan_rep_mode     = info->pscan_rep_mode;
2146                         data.pscan_period_mode  = info->pscan_period_mode;
2147                         data.pscan_mode         = info->pscan_mode;
2148                         memcpy(data.dev_class, info->dev_class, 3);
2149                         data.clock_offset       = info->clock_offset;
2150                         data.rssi               = info->rssi;
2151                         data.ssp_mode           = 0x00;
2152                         info++;
2153                         hci_inquiry_cache_update(hdev, &data);
2154                 }
2155         } else {
2156                 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
2157
2158                 for (; num_rsp; num_rsp--) {
2159                         bacpy(&data.bdaddr, &info->bdaddr);
2160                         data.pscan_rep_mode     = info->pscan_rep_mode;
2161                         data.pscan_period_mode  = info->pscan_period_mode;
2162                         data.pscan_mode         = 0x00;
2163                         memcpy(data.dev_class, info->dev_class, 3);
2164                         data.clock_offset       = info->clock_offset;
2165                         data.rssi               = info->rssi;
2166                         data.ssp_mode           = 0x00;
2167                         info++;
2168                         hci_inquiry_cache_update(hdev, &data);
2169                 }
2170         }
2171
2172         hci_dev_unlock(hdev);
2173 }
2174
2175 static inline void hci_remote_ext_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
2176 {
2177         struct hci_ev_remote_ext_features *ev = (void *) skb->data;
2178         struct hci_conn *conn;
2179
2180         BT_DBG("%s", hdev->name);
2181
2182         hci_dev_lock(hdev);
2183
2184         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2185         if (!conn)
2186                 goto unlock;
2187
2188         if (!ev->status && ev->page == 0x01) {
2189                 struct inquiry_entry *ie;
2190
2191                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
2192                 if (ie)
2193                         ie->data.ssp_mode = (ev->features[0] & 0x01);
2194
2195                 conn->ssp_mode = (ev->features[0] & 0x01);
2196         }
2197
2198         if (conn->state != BT_CONFIG)
2199                 goto unlock;
2200
2201         if (!ev->status) {
2202                 struct hci_cp_remote_name_req cp;
2203                 memset(&cp, 0, sizeof(cp));
2204                 bacpy(&cp.bdaddr, &conn->dst);
2205                 cp.pscan_rep_mode = 0x02;
2206                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2207         }
2208
2209         if (!hci_outgoing_auth_needed(hdev, conn)) {
2210                 conn->state = BT_CONNECTED;
2211                 hci_proto_connect_cfm(conn, ev->status);
2212                 hci_conn_put(conn);
2213         }
2214
2215 unlock:
2216         hci_dev_unlock(hdev);
2217 }
2218
2219 static inline void hci_sync_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2220 {
2221         struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
2222         struct hci_conn *conn;
2223
2224         BT_DBG("%s status %d", hdev->name, ev->status);
2225
2226         hci_dev_lock(hdev);
2227
2228         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
2229         if (!conn) {
2230                 if (ev->link_type == ESCO_LINK)
2231                         goto unlock;
2232
2233                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
2234                 if (!conn)
2235                         goto unlock;
2236
2237                 conn->type = SCO_LINK;
2238         }
2239
2240         switch (ev->status) {
2241         case 0x00:
2242                 conn->handle = __le16_to_cpu(ev->handle);
2243                 conn->state  = BT_CONNECTED;
2244
2245                 hci_conn_hold_device(conn);
2246                 hci_conn_add_sysfs(conn);
2247                 break;
2248
2249         case 0x11:      /* Unsupported Feature or Parameter Value */
2250         case 0x1c:      /* SCO interval rejected */
2251         case 0x1a:      /* Unsupported Remote Feature */
2252         case 0x1f:      /* Unspecified error */
2253                 if (conn->out && conn->attempt < 2) {
2254                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
2255                                         (hdev->esco_type & EDR_ESCO_MASK);
2256                         hci_setup_sync(conn, conn->link->handle);
2257                         goto unlock;
2258                 }
2259                 /* fall through */
2260
2261         default:
2262                 conn->state = BT_CLOSED;
2263                 break;
2264         }
2265
2266         hci_proto_connect_cfm(conn, ev->status);
2267         if (ev->status)
2268                 hci_conn_del(conn);
2269
2270 unlock:
2271         hci_dev_unlock(hdev);
2272 }
2273
2274 static inline void hci_sync_conn_changed_evt(struct hci_dev *hdev, struct sk_buff *skb)
2275 {
2276         BT_DBG("%s", hdev->name);
2277 }
2278
2279 static inline void hci_sniff_subrate_evt(struct hci_dev *hdev, struct sk_buff *skb)
2280 {
2281         struct hci_ev_sniff_subrate *ev = (void *) skb->data;
2282
2283         BT_DBG("%s status %d", hdev->name, ev->status);
2284 }
2285
2286 static inline void hci_extended_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
2287 {
2288         struct inquiry_data data;
2289         struct extended_inquiry_info *info = (void *) (skb->data + 1);
2290         int num_rsp = *((__u8 *) skb->data);
2291
2292         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2293
2294         if (!num_rsp)
2295                 return;
2296
2297         hci_dev_lock(hdev);
2298
2299         for (; num_rsp; num_rsp--) {
2300                 bacpy(&data.bdaddr, &info->bdaddr);
2301                 data.pscan_rep_mode     = info->pscan_rep_mode;
2302                 data.pscan_period_mode  = info->pscan_period_mode;
2303                 data.pscan_mode         = 0x00;
2304                 memcpy(data.dev_class, info->dev_class, 3);
2305                 data.clock_offset       = info->clock_offset;
2306                 data.rssi               = info->rssi;
2307                 data.ssp_mode           = 0x01;
2308                 info++;
2309                 hci_inquiry_cache_update(hdev, &data);
2310         }
2311
2312         hci_dev_unlock(hdev);
2313 }
2314
2315 static inline u8 hci_get_auth_req(struct hci_conn *conn)
2316 {
2317         /* If remote requests dedicated bonding follow that lead */
2318         if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03) {
2319                 /* If both remote and local IO capabilities allow MITM
2320                  * protection then require it, otherwise don't */
2321                 if (conn->remote_cap == 0x03 || conn->io_capability == 0x03)
2322                         return 0x02;
2323                 else
2324                         return 0x03;
2325         }
2326
2327         /* If remote requests no-bonding follow that lead */
2328         if (conn->remote_auth == 0x00 || conn->remote_auth == 0x01)
2329                 return 0x00;
2330
2331         return conn->auth_type;
2332 }
2333
2334 static inline void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2335 {
2336         struct hci_ev_io_capa_request *ev = (void *) skb->data;
2337         struct hci_conn *conn;
2338
2339         BT_DBG("%s", hdev->name);
2340
2341         hci_dev_lock(hdev);
2342
2343         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2344         if (!conn)
2345                 goto unlock;
2346
2347         hci_conn_hold(conn);
2348
2349         if (!test_bit(HCI_MGMT, &hdev->flags))
2350                 goto unlock;
2351
2352         if (test_bit(HCI_PAIRABLE, &hdev->flags) ||
2353                         (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
2354                 struct hci_cp_io_capability_reply cp;
2355
2356                 bacpy(&cp.bdaddr, &ev->bdaddr);
2357                 cp.capability = conn->io_capability;
2358                 cp.oob_data = 0;
2359                 cp.authentication = hci_get_auth_req(conn);
2360
2361                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
2362                                                         sizeof(cp), &cp);
2363         } else {
2364                 struct hci_cp_io_capability_neg_reply cp;
2365
2366                 bacpy(&cp.bdaddr, &ev->bdaddr);
2367                 cp.reason = 0x16; /* Pairing not allowed */
2368
2369                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
2370                                                         sizeof(cp), &cp);
2371         }
2372
2373 unlock:
2374         hci_dev_unlock(hdev);
2375 }
2376
2377 static inline void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
2378 {
2379         struct hci_ev_io_capa_reply *ev = (void *) skb->data;
2380         struct hci_conn *conn;
2381
2382         BT_DBG("%s", hdev->name);
2383
2384         hci_dev_lock(hdev);
2385
2386         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2387         if (!conn)
2388                 goto unlock;
2389
2390         conn->remote_cap = ev->capability;
2391         conn->remote_oob = ev->oob_data;
2392         conn->remote_auth = ev->authentication;
2393
2394 unlock:
2395         hci_dev_unlock(hdev);
2396 }
2397
2398 static inline void hci_user_confirm_request_evt(struct hci_dev *hdev,
2399                                                         struct sk_buff *skb)
2400 {
2401         struct hci_ev_user_confirm_req *ev = (void *) skb->data;
2402
2403         BT_DBG("%s", hdev->name);
2404
2405         hci_dev_lock(hdev);
2406
2407         if (test_bit(HCI_MGMT, &hdev->flags))
2408                 mgmt_user_confirm_request(hdev->id, &ev->bdaddr, ev->passkey);
2409
2410         hci_dev_unlock(hdev);
2411 }
2412
2413 static inline void hci_simple_pair_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2414 {
2415         struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
2416         struct hci_conn *conn;
2417
2418         BT_DBG("%s", hdev->name);
2419
2420         hci_dev_lock(hdev);
2421
2422         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2423         if (!conn)
2424                 goto unlock;
2425
2426         /* To avoid duplicate auth_failed events to user space we check
2427          * the HCI_CONN_AUTH_PEND flag which will be set if we
2428          * initiated the authentication. A traditional auth_complete
2429          * event gets always produced as initiator and is also mapped to
2430          * the mgmt_auth_failed event */
2431         if (!test_bit(HCI_CONN_AUTH_PEND, &conn->pend) && ev->status != 0)
2432                 mgmt_auth_failed(hdev->id, &conn->dst, ev->status);
2433
2434         hci_conn_put(conn);
2435
2436 unlock:
2437         hci_dev_unlock(hdev);
2438 }
2439
2440 static inline void hci_remote_host_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
2441 {
2442         struct hci_ev_remote_host_features *ev = (void *) skb->data;
2443         struct inquiry_entry *ie;
2444
2445         BT_DBG("%s", hdev->name);
2446
2447         hci_dev_lock(hdev);
2448
2449         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2450         if (ie)
2451                 ie->data.ssp_mode = (ev->features[0] & 0x01);
2452
2453         hci_dev_unlock(hdev);
2454 }
2455
2456 static inline void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2457 {
2458         struct hci_ev_le_conn_complete *ev = (void *) skb->data;
2459         struct hci_conn *conn;
2460
2461         BT_DBG("%s status %d", hdev->name, ev->status);
2462
2463         hci_dev_lock(hdev);
2464
2465         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &ev->bdaddr);
2466         if (!conn) {
2467                 conn = hci_conn_add(hdev, LE_LINK, &ev->bdaddr);
2468                 if (!conn) {
2469                         BT_ERR("No memory for new connection");
2470                         hci_dev_unlock(hdev);
2471                         return;
2472                 }
2473         }
2474
2475         if (ev->status) {
2476                 hci_proto_connect_cfm(conn, ev->status);
2477                 conn->state = BT_CLOSED;
2478                 hci_conn_del(conn);
2479                 goto unlock;
2480         }
2481
2482         conn->handle = __le16_to_cpu(ev->handle);
2483         conn->state = BT_CONNECTED;
2484
2485         hci_conn_hold_device(conn);
2486         hci_conn_add_sysfs(conn);
2487
2488         hci_proto_connect_cfm(conn, ev->status);
2489
2490 unlock:
2491         hci_dev_unlock(hdev);
2492 }
2493
2494 static inline void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
2495 {
2496         struct hci_ev_le_meta *le_ev = (void *) skb->data;
2497
2498         skb_pull(skb, sizeof(*le_ev));
2499
2500         switch (le_ev->subevent) {
2501         case HCI_EV_LE_CONN_COMPLETE:
2502                 hci_le_conn_complete_evt(hdev, skb);
2503                 break;
2504
2505         default:
2506                 break;
2507         }
2508 }
2509
2510 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
2511 {
2512         struct hci_event_hdr *hdr = (void *) skb->data;
2513         __u8 event = hdr->evt;
2514
2515         skb_pull(skb, HCI_EVENT_HDR_SIZE);
2516
2517         switch (event) {
2518         case HCI_EV_INQUIRY_COMPLETE:
2519                 hci_inquiry_complete_evt(hdev, skb);
2520                 break;
2521
2522         case HCI_EV_INQUIRY_RESULT:
2523                 hci_inquiry_result_evt(hdev, skb);
2524                 break;
2525
2526         case HCI_EV_CONN_COMPLETE:
2527                 hci_conn_complete_evt(hdev, skb);
2528                 break;
2529
2530         case HCI_EV_CONN_REQUEST:
2531                 hci_conn_request_evt(hdev, skb);
2532                 break;
2533
2534         case HCI_EV_DISCONN_COMPLETE:
2535                 hci_disconn_complete_evt(hdev, skb);
2536                 break;
2537
2538         case HCI_EV_AUTH_COMPLETE:
2539                 hci_auth_complete_evt(hdev, skb);
2540                 break;
2541
2542         case HCI_EV_REMOTE_NAME:
2543                 hci_remote_name_evt(hdev, skb);
2544                 break;
2545
2546         case HCI_EV_ENCRYPT_CHANGE:
2547                 hci_encrypt_change_evt(hdev, skb);
2548                 break;
2549
2550         case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
2551                 hci_change_link_key_complete_evt(hdev, skb);
2552                 break;
2553
2554         case HCI_EV_REMOTE_FEATURES:
2555                 hci_remote_features_evt(hdev, skb);
2556                 break;
2557
2558         case HCI_EV_REMOTE_VERSION:
2559                 hci_remote_version_evt(hdev, skb);
2560                 break;
2561
2562         case HCI_EV_QOS_SETUP_COMPLETE:
2563                 hci_qos_setup_complete_evt(hdev, skb);
2564                 break;
2565
2566         case HCI_EV_CMD_COMPLETE:
2567                 hci_cmd_complete_evt(hdev, skb);
2568                 break;
2569
2570         case HCI_EV_CMD_STATUS:
2571                 hci_cmd_status_evt(hdev, skb);
2572                 break;
2573
2574         case HCI_EV_ROLE_CHANGE:
2575                 hci_role_change_evt(hdev, skb);
2576                 break;
2577
2578         case HCI_EV_NUM_COMP_PKTS:
2579                 hci_num_comp_pkts_evt(hdev, skb);
2580                 break;
2581
2582         case HCI_EV_MODE_CHANGE:
2583                 hci_mode_change_evt(hdev, skb);
2584                 break;
2585
2586         case HCI_EV_PIN_CODE_REQ:
2587                 hci_pin_code_request_evt(hdev, skb);
2588                 break;
2589
2590         case HCI_EV_LINK_KEY_REQ:
2591                 hci_link_key_request_evt(hdev, skb);
2592                 break;
2593
2594         case HCI_EV_LINK_KEY_NOTIFY:
2595                 hci_link_key_notify_evt(hdev, skb);
2596                 break;
2597
2598         case HCI_EV_CLOCK_OFFSET:
2599                 hci_clock_offset_evt(hdev, skb);
2600                 break;
2601
2602         case HCI_EV_PKT_TYPE_CHANGE:
2603                 hci_pkt_type_change_evt(hdev, skb);
2604                 break;
2605
2606         case HCI_EV_PSCAN_REP_MODE:
2607                 hci_pscan_rep_mode_evt(hdev, skb);
2608                 break;
2609
2610         case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
2611                 hci_inquiry_result_with_rssi_evt(hdev, skb);
2612                 break;
2613
2614         case HCI_EV_REMOTE_EXT_FEATURES:
2615                 hci_remote_ext_features_evt(hdev, skb);
2616                 break;
2617
2618         case HCI_EV_SYNC_CONN_COMPLETE:
2619                 hci_sync_conn_complete_evt(hdev, skb);
2620                 break;
2621
2622         case HCI_EV_SYNC_CONN_CHANGED:
2623                 hci_sync_conn_changed_evt(hdev, skb);
2624                 break;
2625
2626         case HCI_EV_SNIFF_SUBRATE:
2627                 hci_sniff_subrate_evt(hdev, skb);
2628                 break;
2629
2630         case HCI_EV_EXTENDED_INQUIRY_RESULT:
2631                 hci_extended_inquiry_result_evt(hdev, skb);
2632                 break;
2633
2634         case HCI_EV_IO_CAPA_REQUEST:
2635                 hci_io_capa_request_evt(hdev, skb);
2636                 break;
2637
2638         case HCI_EV_IO_CAPA_REPLY:
2639                 hci_io_capa_reply_evt(hdev, skb);
2640                 break;
2641
2642         case HCI_EV_USER_CONFIRM_REQUEST:
2643                 hci_user_confirm_request_evt(hdev, skb);
2644                 break;
2645
2646         case HCI_EV_SIMPLE_PAIR_COMPLETE:
2647                 hci_simple_pair_complete_evt(hdev, skb);
2648                 break;
2649
2650         case HCI_EV_REMOTE_HOST_FEATURES:
2651                 hci_remote_host_features_evt(hdev, skb);
2652                 break;
2653
2654         case HCI_EV_LE_META:
2655                 hci_le_meta_evt(hdev, skb);
2656                 break;
2657
2658         default:
2659                 BT_DBG("%s event 0x%x", hdev->name, event);
2660                 break;
2661         }
2662
2663         kfree_skb(skb);
2664         hdev->stat.evt_rx++;
2665 }
2666
2667 /* Generate internal stack event */
2668 void hci_si_event(struct hci_dev *hdev, int type, int dlen, void *data)
2669 {
2670         struct hci_event_hdr *hdr;
2671         struct hci_ev_stack_internal *ev;
2672         struct sk_buff *skb;
2673
2674         skb = bt_skb_alloc(HCI_EVENT_HDR_SIZE + sizeof(*ev) + dlen, GFP_ATOMIC);
2675         if (!skb)
2676                 return;
2677
2678         hdr = (void *) skb_put(skb, HCI_EVENT_HDR_SIZE);
2679         hdr->evt  = HCI_EV_STACK_INTERNAL;
2680         hdr->plen = sizeof(*ev) + dlen;
2681
2682         ev  = (void *) skb_put(skb, sizeof(*ev) + dlen);
2683         ev->type = type;
2684         memcpy(ev->data, data, dlen);
2685
2686         bt_cb(skb)->incoming = 1;
2687         __net_timestamp(skb);
2688
2689         bt_cb(skb)->pkt_type = HCI_EVENT_PKT;
2690         skb->dev = (void *) hdev;
2691         hci_send_to_sock(hdev, skb, NULL);
2692         kfree_skb(skb);
2693 }