net/bluetooth/hci_event.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2000-2001 Qualcomm Incorporated
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI event handling. */
  26
  27 #include <linux/module.h>
  28
  29 #include <linux/types.h>
  30 #include <linux/errno.h>
  31 #include <linux/kernel.h>
  32 #include <linux/sched.h>
  33 #include <linux/slab.h>
  34 #include <linux/poll.h>
  35 #include <linux/fcntl.h>
  36 #include <linux/init.h>
  37 #include <linux/skbuff.h>
  38 #include <linux/interrupt.h>
  39 #include <linux/notifier.h>
  40 #include <net/sock.h>
  41
  42 #include <asm/system.h>
  43 #include <asm/uaccess.h>
  44 #include <asm/unaligned.h>
  45
  46 #include <net/bluetooth/bluetooth.h>
  47 #include <net/bluetooth/hci_core.h>
  48
  49 #ifndef CONFIG_BT_HCI_CORE_DEBUG
  50 #undef  BT_DBG
  51 #define BT_DBG(D...)
  52 #endif
  53
  54 /* Handle HCI Event packets */
  55
  56 /* Command Complete OGF LINK_CTL  */
  57 static void hci_cc_link_ctl(struct hci_dev *hdev, __u16 ocf, struct sk_buff *skb)
  58 {
  59         __u8 status;
  60
  61         BT_DBG("%s ocf 0x%x", hdev->name, ocf);
  62
  63         switch (ocf) {
  64         case OCF_INQUIRY_CANCEL:
  65                 status = *((__u8 *) skb->data);
  66
  67                 if (status) {
  68                         BT_DBG("%s Inquiry cancel error: status 0x%x", hdev->name, status);
  69                 } else {
  70                         clear_bit(HCI_INQUIRY, &hdev->flags);
  71                         hci_req_complete(hdev, status);
  72                 }
  73                 break;
  74
  75         default:
  76                 BT_DBG("%s Command complete: ogf LINK_CTL ocf %x", hdev->name, ocf);
  77                 break;
  78         }
  79 }
  80
  81 /* Command Complete OGF LINK_POLICY  */
  82 static void hci_cc_link_policy(struct hci_dev *hdev, __u16 ocf, struct sk_buff *skb)
  83 {
  84         struct hci_conn *conn;
  85         struct hci_rp_role_discovery *rd;
  86
  87         BT_DBG("%s ocf 0x%x", hdev->name, ocf);
  88
  89         switch (ocf) {
  90         case OCF_ROLE_DISCOVERY:
  91                 rd = (void *) skb->data;
  92
  93                 if (rd->status)
  94                         break;
  95
  96                 hci_dev_lock(hdev);
  97
  98                 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rd->handle));
  99                 if (conn) {
 100                         if (rd->role)
 101                                 conn->link_mode &= ~HCI_LM_MASTER;
 102                         else
 103                                 conn->link_mode |= HCI_LM_MASTER;
 104                 }
 105
 106                 hci_dev_unlock(hdev);
 107                 break;
 108
 109         default:
 110                 BT_DBG("%s: Command complete: ogf LINK_POLICY ocf %x",
 111                                 hdev->name, ocf);
 112                 break;
 113         }
 114 }
 115
 116 /* Command Complete OGF HOST_CTL  */
 117 static void hci_cc_host_ctl(struct hci_dev *hdev, __u16 ocf, struct sk_buff *skb)
 118 {
 119         __u8 status, param;
 120         __u16 setting;
 121         struct hci_rp_read_voice_setting *vs;
 122         void *sent;
 123
 124         BT_DBG("%s ocf 0x%x", hdev->name, ocf);
 125
 126         switch (ocf) {
 127         case OCF_RESET:
 128                 status = *((__u8 *) skb->data);
 129                 hci_req_complete(hdev, status);
 130                 break;
 131
 132         case OCF_SET_EVENT_FLT:
 133                 status = *((__u8 *) skb->data);
 134                 if (status) {
 135                         BT_DBG("%s SET_EVENT_FLT failed %d", hdev->name, status);
 136                 } else {
 137                         BT_DBG("%s SET_EVENT_FLT succeseful", hdev->name);
 138                 }
 139                 break;
 140
 141         case OCF_WRITE_AUTH_ENABLE:
 142                 sent = hci_sent_cmd_data(hdev, OGF_HOST_CTL, OCF_WRITE_AUTH_ENABLE);
 143                 if (!sent)
 144                         break;
 145
 146                 status = *((__u8 *) skb->data);
 147                 param  = *((__u8 *) sent);
 148
 149                 if (!status) {
 150                         if (param == AUTH_ENABLED)
 151                                 set_bit(HCI_AUTH, &hdev->flags);
 152                         else
 153                                 clear_bit(HCI_AUTH, &hdev->flags);
 154                 }
 155                 hci_req_complete(hdev, status);
 156                 break;
 157
 158         case OCF_WRITE_ENCRYPT_MODE:
 159                 sent = hci_sent_cmd_data(hdev, OGF_HOST_CTL, OCF_WRITE_ENCRYPT_MODE);
 160                 if (!sent)
 161                         break;
 162
 163                 status = *((__u8 *) skb->data);
 164                 param  = *((__u8 *) sent);
 165
 166                 if (!status) {
 167                         if (param)
 168                                 set_bit(HCI_ENCRYPT, &hdev->flags);
 169                         else
 170                                 clear_bit(HCI_ENCRYPT, &hdev->flags);
 171                 }
 172                 hci_req_complete(hdev, status);
 173                 break;
 174
 175         case OCF_WRITE_CA_TIMEOUT:
 176                 status = *((__u8 *) skb->data);
 177                 if (status) {
 178                         BT_DBG("%s OCF_WRITE_CA_TIMEOUT failed %d", hdev->name, status);
 179                 } else {
 180                         BT_DBG("%s OCF_WRITE_CA_TIMEOUT succeseful", hdev->name);
 181                 }
 182                 break;
 183
 184         case OCF_WRITE_PG_TIMEOUT:
 185                 status = *((__u8 *) skb->data);
 186                 if (status) {
 187                         BT_DBG("%s OCF_WRITE_PG_TIMEOUT failed %d", hdev->name, status);
 188                 } else {
 189                         BT_DBG("%s: OCF_WRITE_PG_TIMEOUT succeseful", hdev->name);
 190                 }
 191                 break;
 192
 193         case OCF_WRITE_SCAN_ENABLE:
 194                 sent = hci_sent_cmd_data(hdev, OGF_HOST_CTL, OCF_WRITE_SCAN_ENABLE);
 195                 if (!sent)
 196                         break;
 197
 198                 status = *((__u8 *) skb->data);
 199                 param  = *((__u8 *) sent);
 200
 201                 BT_DBG("param 0x%x", param);
 202
 203                 if (!status) {
 204                         clear_bit(HCI_PSCAN, &hdev->flags);
 205                         clear_bit(HCI_ISCAN, &hdev->flags);
 206                         if (param & SCAN_INQUIRY)
 207                                 set_bit(HCI_ISCAN, &hdev->flags);
 208
 209                         if (param & SCAN_PAGE)
 210                                 set_bit(HCI_PSCAN, &hdev->flags);
 211                 }
 212                 hci_req_complete(hdev, status);
 213                 break;
 214
 215         case OCF_READ_VOICE_SETTING:
 216                 vs = (struct hci_rp_read_voice_setting *) skb->data;
 217
 218                 if (vs->status) {
 219                         BT_DBG("%s READ_VOICE_SETTING failed %d", hdev->name, vs->status);
 220                         break;
 221                 }
 222
 223                 setting = __le16_to_cpu(vs->voice_setting);
 224
 225                 if (hdev->voice_setting != setting ) {
 226                         hdev->voice_setting = setting;
 227
 228                         BT_DBG("%s: voice setting 0x%04x", hdev->name, setting);
 229
 230                         if (hdev->notify) {
 231                                 tasklet_disable(&hdev->tx_task);
 232                                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 233                                 tasklet_enable(&hdev->tx_task);
 234                         }
 235                 }
 236                 break;
 237
 238         case OCF_WRITE_VOICE_SETTING:
 239                 sent = hci_sent_cmd_data(hdev, OGF_HOST_CTL, OCF_WRITE_VOICE_SETTING);
 240                 if (!sent)
 241                         break;
 242
 243                 status = *((__u8 *) skb->data);
 244                 setting = __le16_to_cpu(get_unaligned((__le16 *) sent));
 245
 246                 if (!status && hdev->voice_setting != setting) {
 247                         hdev->voice_setting = setting;
 248
 249                         BT_DBG("%s: voice setting 0x%04x", hdev->name, setting);
 250
 251                         if (hdev->notify) {
 252                                 tasklet_disable(&hdev->tx_task);
 253                                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 254                                 tasklet_enable(&hdev->tx_task);
 255                         }
 256                 }
 257                 hci_req_complete(hdev, status);
 258                 break;
 259
 260         case OCF_HOST_BUFFER_SIZE:
 261                 status = *((__u8 *) skb->data);
 262                 if (status) {
 263                         BT_DBG("%s OCF_BUFFER_SIZE failed %d", hdev->name, status);
 264                         hci_req_complete(hdev, status);
 265                 }
 266                 break;
 267
 268         default:
 269                 BT_DBG("%s Command complete: ogf HOST_CTL ocf %x", hdev->name, ocf);
 270                 break;
 271         }
 272 }
 273
 274 /* Command Complete OGF INFO_PARAM  */
 275 static void hci_cc_info_param(struct hci_dev *hdev, __u16 ocf, struct sk_buff *skb)
 276 {
 277         struct hci_rp_read_loc_features *lf;
 278         struct hci_rp_read_buffer_size *bs;
 279         struct hci_rp_read_bd_addr *ba;
 280
 281         BT_DBG("%s ocf 0x%x", hdev->name, ocf);
 282
 283         switch (ocf) {
 284         case OCF_READ_LOCAL_FEATURES:
 285                 lf = (struct hci_rp_read_loc_features *) skb->data;
 286
 287                 if (lf->status) {
 288                         BT_DBG("%s READ_LOCAL_FEATURES failed %d", hdev->name, lf->status);
 289                         break;
 290                 }
 291
 292                 memcpy(hdev->features, lf->features, sizeof(hdev->features));
 293
 294                 /* Adjust default settings according to features
 295                  * supported by device. */
 296                 if (hdev->features[0] & LMP_3SLOT)
 297                         hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 298
 299                 if (hdev->features[0] & LMP_5SLOT)
 300                         hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 301
 302                 if (hdev->features[1] & LMP_HV2)
 303                         hdev->pkt_type |= (HCI_HV2);
 304
 305                 if (hdev->features[1] & LMP_HV3)
 306                         hdev->pkt_type |= (HCI_HV3);
 307
 308                 BT_DBG("%s: features 0x%x 0x%x 0x%x", hdev->name, lf->features[0], lf->features[1], lf->features[2]);
 309
 310                 break;
 311
 312         case OCF_READ_BUFFER_SIZE:
 313                 bs = (struct hci_rp_read_buffer_size *) skb->data;
 314
 315                 if (bs->status) {
 316                         BT_DBG("%s READ_BUFFER_SIZE failed %d", hdev->name, bs->status);
 317                         hci_req_complete(hdev, bs->status);
 318                         break;
 319                 }
 320
 321                 hdev->acl_mtu  = __le16_to_cpu(bs->acl_mtu);
 322                 hdev->sco_mtu  = bs->sco_mtu ? bs->sco_mtu : 64;
 323                 hdev->acl_pkts = hdev->acl_cnt = __le16_to_cpu(bs->acl_max_pkt);
 324                 hdev->sco_pkts = hdev->sco_cnt = __le16_to_cpu(bs->sco_max_pkt);
 325
 326                 BT_DBG("%s mtu: acl %d, sco %d max_pkt: acl %d, sco %d", hdev->name,
 327                         hdev->acl_mtu, hdev->sco_mtu, hdev->acl_pkts, hdev->sco_pkts);
 328                 break;
 329
 330         case OCF_READ_BD_ADDR:
 331                 ba = (struct hci_rp_read_bd_addr *) skb->data;
 332
 333                 if (!ba->status) {
 334                         bacpy(&hdev->bdaddr, &ba->bdaddr);
 335                 } else {
 336                         BT_DBG("%s: READ_BD_ADDR failed %d", hdev->name, ba->status);
 337                 }
 338
 339                 hci_req_complete(hdev, ba->status);
 340                 break;
 341
 342         default:
 343                 BT_DBG("%s Command complete: ogf INFO_PARAM ocf %x", hdev->name, ocf);
 344                 break;
 345         }
 346 }
 347
 348 /* Command Status OGF LINK_CTL  */
 349 static inline void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
 350 {
 351         struct hci_conn *conn;
 352         struct hci_cp_create_conn *cp = hci_sent_cmd_data(hdev, OGF_LINK_CTL, OCF_CREATE_CONN);
 353
 354         if (!cp)
 355                 return;
 356
 357         hci_dev_lock(hdev);
 358
 359         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 360
 361         BT_DBG("%s status 0x%x bdaddr %s conn %p", hdev->name,
 362                         status, batostr(&cp->bdaddr), conn);
 363
 364         if (status) {
 365                 if (conn && conn->state == BT_CONNECT) {
 366                         conn->state = BT_CLOSED;
 367                         hci_proto_connect_cfm(conn, status);
 368                         hci_conn_del(conn);
 369                 }
 370         } else {
 371                 if (!conn) {
 372                         conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr);
 373                         if (conn) {
 374                                 conn->out = 1;
 375                                 conn->link_mode |= HCI_LM_MASTER;
 376                         } else
 377                                 BT_ERR("No memmory for new connection");
 378                 }
 379         }
 380
 381         hci_dev_unlock(hdev);
 382 }
 383
 384 static void hci_cs_link_ctl(struct hci_dev *hdev, __u16 ocf, __u8 status)
 385 {
 386         BT_DBG("%s ocf 0x%x", hdev->name, ocf);
 387
 388         switch (ocf) {
 389         case OCF_CREATE_CONN:
 390                 hci_cs_create_conn(hdev, status);
 391                 break;
 392
 393         case OCF_ADD_SCO:
 394                 if (status) {
 395                         struct hci_conn *acl, *sco;
 396                         struct hci_cp_add_sco *cp = hci_sent_cmd_data(hdev, OGF_LINK_CTL, OCF_ADD_SCO);
 397                         __u16 handle;
 398
 399                         if (!cp)
 400                                 break;
 401
 402                         handle = __le16_to_cpu(cp->handle);
 403
 404                         BT_DBG("%s Add SCO error: handle %d status 0x%x", hdev->name, handle, status);
 405
 406                         hci_dev_lock(hdev);
 407
 408                         acl = hci_conn_hash_lookup_handle(hdev, handle);
 409                         if (acl && (sco = acl->link)) {
 410                                 sco->state = BT_CLOSED;
 411
 412                                 hci_proto_connect_cfm(sco, status);
 413                                 hci_conn_del(sco);
 414                         }
 415
 416                         hci_dev_unlock(hdev);
 417                 }
 418                 break;
 419
 420         case OCF_INQUIRY:
 421                 if (status) {
 422                         BT_DBG("%s Inquiry error: status 0x%x", hdev->name, status);
 423                         hci_req_complete(hdev, status);
 424                 } else {
 425                         set_bit(HCI_INQUIRY, &hdev->flags);
 426                 }
 427                 break;
 428
 429         default:
 430                 BT_DBG("%s Command status: ogf LINK_CTL ocf %x status %d",
 431                         hdev->name, ocf, status);
 432                 break;
 433         }
 434 }
 435
 436 /* Command Status OGF LINK_POLICY */
 437 static void hci_cs_link_policy(struct hci_dev *hdev, __u16 ocf, __u8 status)
 438 {
 439         BT_DBG("%s ocf 0x%x", hdev->name, ocf);
 440
 441         switch (ocf) {
 442         default:
 443                 BT_DBG("%s Command status: ogf HOST_POLICY ocf %x", hdev->name, ocf);
 444                 break;
 445         }
 446 }
 447
 448 /* Command Status OGF HOST_CTL */
 449 static void hci_cs_host_ctl(struct hci_dev *hdev, __u16 ocf, __u8 status)
 450 {
 451         BT_DBG("%s ocf 0x%x", hdev->name, ocf);
 452
 453         switch (ocf) {
 454         default:
 455                 BT_DBG("%s Command status: ogf HOST_CTL ocf %x", hdev->name, ocf);
 456                 break;
 457         }
 458 }
 459
 460 /* Command Status OGF INFO_PARAM  */
 461 static void hci_cs_info_param(struct hci_dev *hdev, __u16 ocf, __u8 status)
 462 {
 463         BT_DBG("%s: hci_cs_info_param: ocf 0x%x", hdev->name, ocf);
 464
 465         switch (ocf) {
 466         default:
 467                 BT_DBG("%s Command status: ogf INFO_PARAM ocf %x", hdev->name, ocf);
 468                 break;
 469         }
 470 }
 471
 472 /* Inquiry Complete */
 473 static inline void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 474 {
 475         __u8 status = *((__u8 *) skb->data);
 476
 477         BT_DBG("%s status %d", hdev->name, status);
 478
 479         clear_bit(HCI_INQUIRY, &hdev->flags);
 480         hci_req_complete(hdev, status);
 481 }
 482
 483 /* Inquiry Result */
 484 static inline void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
 485 {
 486         struct inquiry_data data;
 487         struct inquiry_info *info = (struct inquiry_info *) (skb->data + 1);
 488         int num_rsp = *((__u8 *) skb->data);
 489
 490         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
 491
 492         if (!num_rsp)
 493                 return;
 494
 495         hci_dev_lock(hdev);
 496
 497         for (; num_rsp; num_rsp--) {
 498                 bacpy(&data.bdaddr, &info->bdaddr);
 499                 data.pscan_rep_mode     = info->pscan_rep_mode;
 500                 data.pscan_period_mode  = info->pscan_period_mode;
 501                 data.pscan_mode         = info->pscan_mode;
 502                 memcpy(data.dev_class, info->dev_class, 3);
 503                 data.clock_offset       = info->clock_offset;
 504                 data.rssi               = 0x00;
 505                 info++;
 506                 hci_inquiry_cache_update(hdev, &data);
 507         }
 508
 509         hci_dev_unlock(hdev);
 510 }
 511
 512 /* Inquiry Result With RSSI */
 513 static inline void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, struct sk_buff *skb)
 514 {
 515         struct inquiry_data data;
 516         int num_rsp = *((__u8 *) skb->data);
 517
 518         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
 519
 520         if (!num_rsp)
 521                 return;
 522
 523         hci_dev_lock(hdev);
 524
 525         if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
 526                 struct inquiry_info_with_rssi_and_pscan_mode *info =
 527                         (struct inquiry_info_with_rssi_and_pscan_mode *) (skb->data + 1);
 528
 529                 for (; num_rsp; num_rsp--) {
 530                         bacpy(&data.bdaddr, &info->bdaddr);
 531                         data.pscan_rep_mode     = info->pscan_rep_mode;
 532                         data.pscan_period_mode  = info->pscan_period_mode;
 533                         data.pscan_mode         = info->pscan_mode;
 534                         memcpy(data.dev_class, info->dev_class, 3);
 535                         data.clock_offset       = info->clock_offset;
 536                         data.rssi               = info->rssi;
 537                         info++;
 538                         hci_inquiry_cache_update(hdev, &data);
 539                 }
 540         } else {
 541                 struct inquiry_info_with_rssi *info =
 542                         (struct inquiry_info_with_rssi *) (skb->data + 1);
 543
 544                 for (; num_rsp; num_rsp--) {
 545                         bacpy(&data.bdaddr, &info->bdaddr);
 546                         data.pscan_rep_mode     = info->pscan_rep_mode;
 547                         data.pscan_period_mode  = info->pscan_period_mode;
 548                         data.pscan_mode         = 0x00;
 549                         memcpy(data.dev_class, info->dev_class, 3);
 550                         data.clock_offset       = info->clock_offset;
 551                         data.rssi               = info->rssi;
 552                         info++;
 553                         hci_inquiry_cache_update(hdev, &data);
 554                 }
 555         }
 556
 557         hci_dev_unlock(hdev);
 558 }
 559
 560 /* Extended Inquiry Result */
 561 static inline void hci_extended_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
 562 {
 563         struct inquiry_data data;
 564         struct extended_inquiry_info *info = (struct extended_inquiry_info *) (skb->data + 1);
 565         int num_rsp = *((__u8 *) skb->data);
 566
 567         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
 568
 569         if (!num_rsp)
 570                 return;
 571
 572         hci_dev_lock(hdev);
 573
 574         for (; num_rsp; num_rsp--) {
 575                 bacpy(&data.bdaddr, &info->bdaddr);
 576                 data.pscan_rep_mode     = info->pscan_rep_mode;
 577                 data.pscan_period_mode  = info->pscan_period_mode;
 578                 data.pscan_mode         = 0x00;
 579                 memcpy(data.dev_class, info->dev_class, 3);
 580                 data.clock_offset       = info->clock_offset;
 581                 data.rssi               = info->rssi;
 582                 info++;
 583                 hci_inquiry_cache_update(hdev, &data);
 584         }
 585
 586         hci_dev_unlock(hdev);
 587 }
 588
 589 /* Connect Request */
 590 static inline void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
 591 {
 592         struct hci_ev_conn_request *ev = (struct hci_ev_conn_request *) skb->data;
 593         int mask = hdev->link_mode;
 594
 595         BT_DBG("%s Connection request: %s type 0x%x", hdev->name,
 596                         batostr(&ev->bdaddr), ev->link_type);
 597
 598         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type);
 599
 600         if (mask & HCI_LM_ACCEPT) {
 601                 /* Connection accepted */
 602                 struct hci_conn *conn;
 603                 struct hci_cp_accept_conn_req cp;
 604
 605                 hci_dev_lock(hdev);
 606                 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
 607                 if (!conn) {
 608                         if (!(conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr))) {
 609                                 BT_ERR("No memmory for new connection");
 610                                 hci_dev_unlock(hdev);
 611                                 return;
 612                         }
 613                 }
 614                 memcpy(conn->dev_class, ev->dev_class, 3);
 615                 conn->state = BT_CONNECT;
 616                 hci_dev_unlock(hdev);
 617
 618                 bacpy(&cp.bdaddr, &ev->bdaddr);
 619
 620                 if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
 621                         cp.role = 0x00; /* Become master */
 622                 else
 623                         cp.role = 0x01; /* Remain slave */
 624
 625                 hci_send_cmd(hdev, OGF_LINK_CTL, OCF_ACCEPT_CONN_REQ, sizeof(cp), &cp);
 626         } else {
 627                 /* Connection rejected */
 628                 struct hci_cp_reject_conn_req cp;
 629
 630                 bacpy(&cp.bdaddr, &ev->bdaddr);
 631                 cp.reason = 0x0f;
 632                 hci_send_cmd(hdev, OGF_LINK_CTL, OCF_REJECT_CONN_REQ, sizeof(cp), &cp);
 633         }
 634 }
 635
 636 /* Connect Complete */
 637 static inline void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 638 {
 639         struct hci_ev_conn_complete *ev = (struct hci_ev_conn_complete *) skb->data;
 640         struct hci_conn *conn = NULL;
 641
 642         BT_DBG("%s", hdev->name);
 643
 644         hci_dev_lock(hdev);
 645
 646         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
 647         if (!conn) {
 648                 hci_dev_unlock(hdev);
 649                 return;
 650         }
 651
 652         if (!ev->status) {
 653                 conn->handle = __le16_to_cpu(ev->handle);
 654                 conn->state  = BT_CONNECTED;
 655
 656                 if (test_bit(HCI_AUTH, &hdev->flags))
 657                         conn->link_mode |= HCI_LM_AUTH;
 658
 659                 if (test_bit(HCI_ENCRYPT, &hdev->flags))
 660                         conn->link_mode |= HCI_LM_ENCRYPT;
 661
 662                 /* Set link policy */
 663                 if (conn->type == ACL_LINK && hdev->link_policy) {
 664                         struct hci_cp_write_link_policy cp;
 665                         cp.handle = ev->handle;
 666                         cp.policy = __cpu_to_le16(hdev->link_policy);
 667                         hci_send_cmd(hdev, OGF_LINK_POLICY, OCF_WRITE_LINK_POLICY, sizeof(cp), &cp);
 668                 }
 669
 670                 /* Set packet type for incoming connection */
 671                 if (!conn->out) {
 672                         struct hci_cp_change_conn_ptype cp;
 673                         cp.handle = ev->handle;
 674                         cp.pkt_type = (conn->type == ACL_LINK) ?
 675                                 __cpu_to_le16(hdev->pkt_type & ACL_PTYPE_MASK):
 676                                 __cpu_to_le16(hdev->pkt_type & SCO_PTYPE_MASK);
 677
 678                         hci_send_cmd(hdev, OGF_LINK_CTL, OCF_CHANGE_CONN_PTYPE, sizeof(cp), &cp);
 679                 }
 680         } else
 681                 conn->state = BT_CLOSED;
 682
 683         if (conn->type == ACL_LINK) {
 684                 struct hci_conn *sco = conn->link;
 685                 if (sco) {
 686                         if (!ev->status)
 687                                 hci_add_sco(sco, conn->handle);
 688                         else {
 689                                 hci_proto_connect_cfm(sco, ev->status);
 690                                 hci_conn_del(sco);
 691                         }
 692                 }
 693         }
 694
 695         hci_proto_connect_cfm(conn, ev->status);
 696         if (ev->status)
 697                 hci_conn_del(conn);
 698
 699         hci_dev_unlock(hdev);
 700 }
 701
 702 /* Disconnect Complete */
 703 static inline void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 704 {
 705         struct hci_ev_disconn_complete *ev = (struct hci_ev_disconn_complete *) skb->data;
 706         struct hci_conn *conn = NULL;
 707         __u16 handle = __le16_to_cpu(ev->handle);
 708
 709         BT_DBG("%s status %d", hdev->name, ev->status);
 710
 711         if (ev->status)
 712                 return;
 713
 714         hci_dev_lock(hdev);
 715
 716         conn = hci_conn_hash_lookup_handle(hdev, handle);
 717         if (conn) {
 718                 conn->state = BT_CLOSED;
 719                 hci_proto_disconn_ind(conn, ev->reason);
 720                 hci_conn_del(conn);
 721         }
 722
 723         hci_dev_unlock(hdev);
 724 }
 725
 726 /* Number of completed packets */
 727 static inline void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
 728 {
 729         struct hci_ev_num_comp_pkts *ev = (struct hci_ev_num_comp_pkts *) skb->data;
 730         __le16 *ptr;
 731         int i;
 732
 733         skb_pull(skb, sizeof(*ev));
 734
 735         BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
 736
 737         if (skb->len < ev->num_hndl * 4) {
 738                 BT_DBG("%s bad parameters", hdev->name);
 739                 return;
 740         }
 741
 742         tasklet_disable(&hdev->tx_task);
 743
 744         for (i = 0, ptr = (__le16 *) skb->data; i < ev->num_hndl; i++) {
 745                 struct hci_conn *conn;
 746                 __u16  handle, count;
 747
 748                 handle = __le16_to_cpu(get_unaligned(ptr++));
 749                 count  = __le16_to_cpu(get_unaligned(ptr++));
 750
 751                 conn = hci_conn_hash_lookup_handle(hdev, handle);
 752                 if (conn) {
 753                         conn->sent -= count;
 754
 755                         if (conn->type == SCO_LINK) {
 756                                 if ((hdev->sco_cnt += count) > hdev->sco_pkts)
 757                                         hdev->sco_cnt = hdev->sco_pkts;
 758                         } else {
 759                                 if ((hdev->acl_cnt += count) > hdev->acl_pkts)
 760                                         hdev->acl_cnt = hdev->acl_pkts;
 761                         }
 762                 }
 763         }
 764         hci_sched_tx(hdev);
 765
 766         tasklet_enable(&hdev->tx_task);
 767 }
 768
 769 /* Role Change */
 770 static inline void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
 771 {
 772         struct hci_ev_role_change *ev = (struct hci_ev_role_change *) skb->data;
 773         struct hci_conn *conn = NULL;
 774
 775         BT_DBG("%s status %d", hdev->name, ev->status);
 776
 777         hci_dev_lock(hdev);
 778
 779         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
 780         if (conn) {
 781                 if (!ev->status) {
 782                         if (ev->role)
 783                                 conn->link_mode &= ~HCI_LM_MASTER;
 784                         else
 785                                 conn->link_mode |= HCI_LM_MASTER;
 786                 }
 787
 788                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->pend);
 789
 790                 hci_role_switch_cfm(conn, ev->status, ev->role);
 791         }
 792
 793         hci_dev_unlock(hdev);
 794 }
 795
 796 /* Authentication Complete */
 797 static inline void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 798 {
 799         struct hci_ev_auth_complete *ev = (struct hci_ev_auth_complete *) skb->data;
 800         struct hci_conn *conn = NULL;
 801         __u16 handle = __le16_to_cpu(ev->handle);
 802
 803         BT_DBG("%s status %d", hdev->name, ev->status);
 804
 805         hci_dev_lock(hdev);
 806
 807         conn = hci_conn_hash_lookup_handle(hdev, handle);
 808         if (conn) {
 809                 if (!ev->status)
 810                         conn->link_mode |= HCI_LM_AUTH;
 811
 812                 clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
 813
 814                 hci_auth_cfm(conn, ev->status);
 815
 816                 if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend)) {
 817                         if (!ev->status) {
 818                                 struct hci_cp_set_conn_encrypt cp;
 819                                 cp.handle  = __cpu_to_le16(conn->handle);
 820                                 cp.encrypt = 1;
 821                                 hci_send_cmd(conn->hdev, OGF_LINK_CTL,
 822                                                 OCF_SET_CONN_ENCRYPT,
 823                                                 sizeof(cp), &cp);
 824                         } else {
 825                                 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
 826                                 hci_encrypt_cfm(conn, ev->status, 0x00);
 827                         }
 828                 }
 829         }
 830
 831         hci_dev_unlock(hdev);
 832 }
 833
 834 /* Encryption Change */
 835 static inline void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
 836 {
 837         struct hci_ev_encrypt_change *ev = (struct hci_ev_encrypt_change *) skb->data;
 838         struct hci_conn *conn = NULL;
 839         __u16 handle = __le16_to_cpu(ev->handle);
 840
 841         BT_DBG("%s status %d", hdev->name, ev->status);
 842
 843         hci_dev_lock(hdev);
 844
 845         conn = hci_conn_hash_lookup_handle(hdev, handle);
 846         if (conn) {
 847                 if (!ev->status) {
 848                         if (ev->encrypt)
 849                                 conn->link_mode |= HCI_LM_ENCRYPT;
 850                         else
 851                                 conn->link_mode &= ~HCI_LM_ENCRYPT;
 852                 }
 853
 854                 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
 855
 856                 hci_encrypt_cfm(conn, ev->status, ev->encrypt);
 857         }
 858
 859         hci_dev_unlock(hdev);
 860 }
 861
 862 /* Change Connection Link Key Complete */
 863 static inline void hci_change_conn_link_key_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 864 {
 865         struct hci_ev_change_conn_link_key_complete *ev = (struct hci_ev_change_conn_link_key_complete *) skb->data;
 866         struct hci_conn *conn = NULL;
 867         __u16 handle = __le16_to_cpu(ev->handle);
 868
 869         BT_DBG("%s status %d", hdev->name, ev->status);
 870
 871         hci_dev_lock(hdev);
 872
 873         conn = hci_conn_hash_lookup_handle(hdev, handle);
 874         if (conn) {
 875                 if (!ev->status)
 876                         conn->link_mode |= HCI_LM_SECURE;
 877
 878                 clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
 879
 880                 hci_key_change_cfm(conn, ev->status);
 881         }
 882
 883         hci_dev_unlock(hdev);
 884 }
 885
 886 /* Pin Code Request*/
 887 static inline void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
 888 {
 889 }
 890
 891 /* Link Key Request */
 892 static inline void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
 893 {
 894 }
 895
 896 /* Link Key Notification */
 897 static inline void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
 898 {
 899 }
 900
 901 /* Clock Offset */
 902 static inline void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
 903 {
 904         struct hci_ev_clock_offset *ev = (struct hci_ev_clock_offset *) skb->data;
 905         struct hci_conn *conn = NULL;
 906         __u16 handle = __le16_to_cpu(ev->handle);
 907
 908         BT_DBG("%s status %d", hdev->name, ev->status);
 909
 910         hci_dev_lock(hdev);
 911
 912         conn = hci_conn_hash_lookup_handle(hdev, handle);
 913         if (conn && !ev->status) {
 914                 struct inquiry_entry *ie;
 915
 916                 if ((ie = hci_inquiry_cache_lookup(hdev, &conn->dst))) {
 917                         ie->data.clock_offset = ev->clock_offset;
 918                         ie->timestamp = jiffies;
 919                 }
 920         }
 921
 922         hci_dev_unlock(hdev);
 923 }
 924
 925 /* Page Scan Repetition Mode */
 926 static inline void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
 927 {
 928         struct hci_ev_pscan_rep_mode *ev = (struct hci_ev_pscan_rep_mode *) skb->data;
 929         struct inquiry_entry *ie;
 930
 931         BT_DBG("%s", hdev->name);
 932
 933         hci_dev_lock(hdev);
 934
 935         if ((ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr))) {
 936                 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
 937                 ie->timestamp = jiffies;
 938         }
 939
 940         hci_dev_unlock(hdev);
 941 }
 942
 943 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
 944 {
 945         struct hci_event_hdr *hdr = (struct hci_event_hdr *) skb->data;
 946         struct hci_ev_cmd_complete *ec;
 947         struct hci_ev_cmd_status *cs;
 948         u16 opcode, ocf, ogf;
 949
 950         skb_pull(skb, HCI_EVENT_HDR_SIZE);
 951
 952         BT_DBG("%s evt 0x%x", hdev->name, hdr->evt);
 953
 954         switch (hdr->evt) {
 955         case HCI_EV_NUM_COMP_PKTS:
 956                 hci_num_comp_pkts_evt(hdev, skb);
 957                 break;
 958
 959         case HCI_EV_INQUIRY_COMPLETE:
 960                 hci_inquiry_complete_evt(hdev, skb);
 961                 break;
 962
 963         case HCI_EV_INQUIRY_RESULT:
 964                 hci_inquiry_result_evt(hdev, skb);
 965                 break;
 966
 967         case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
 968                 hci_inquiry_result_with_rssi_evt(hdev, skb);
 969                 break;
 970
 971         case HCI_EV_EXTENDED_INQUIRY_RESULT:
 972                 hci_extended_inquiry_result_evt(hdev, skb);
 973                 break;
 974
 975         case HCI_EV_CONN_REQUEST:
 976                 hci_conn_request_evt(hdev, skb);
 977                 break;
 978
 979         case HCI_EV_CONN_COMPLETE:
 980                 hci_conn_complete_evt(hdev, skb);
 981                 break;
 982
 983         case HCI_EV_DISCONN_COMPLETE:
 984                 hci_disconn_complete_evt(hdev, skb);
 985                 break;
 986
 987         case HCI_EV_ROLE_CHANGE:
 988                 hci_role_change_evt(hdev, skb);
 989                 break;
 990
 991         case HCI_EV_AUTH_COMPLETE:
 992                 hci_auth_complete_evt(hdev, skb);
 993                 break;
 994
 995         case HCI_EV_ENCRYPT_CHANGE:
 996                 hci_encrypt_change_evt(hdev, skb);
 997                 break;
 998
 999         case HCI_EV_CHANGE_CONN_LINK_KEY_COMPLETE:
1000                 hci_change_conn_link_key_complete_evt(hdev, skb);
1001                 break;
1002
1003         case HCI_EV_PIN_CODE_REQ:
1004                 hci_pin_code_request_evt(hdev, skb);
1005                 break;
1006
1007         case HCI_EV_LINK_KEY_REQ:
1008                 hci_link_key_request_evt(hdev, skb);
1009                 break;
1010
1011         case HCI_EV_LINK_KEY_NOTIFY:
1012                 hci_link_key_notify_evt(hdev, skb);
1013                 break;
1014
1015         case HCI_EV_CLOCK_OFFSET:
1016                 hci_clock_offset_evt(hdev, skb);
1017                 break;
1018
1019         case HCI_EV_PSCAN_REP_MODE:
1020                 hci_pscan_rep_mode_evt(hdev, skb);
1021                 break;
1022
1023         case HCI_EV_CMD_STATUS:
1024                 cs = (struct hci_ev_cmd_status *) skb->data;
1025                 skb_pull(skb, sizeof(cs));
1026
1027                 opcode = __le16_to_cpu(cs->opcode);
1028                 ogf = hci_opcode_ogf(opcode);
1029                 ocf = hci_opcode_ocf(opcode);
1030
1031                 switch (ogf) {
1032                 case OGF_INFO_PARAM:
1033                         hci_cs_info_param(hdev, ocf, cs->status);
1034                         break;
1035
1036                 case OGF_HOST_CTL:
1037                         hci_cs_host_ctl(hdev, ocf, cs->status);
1038                         break;
1039
1040                 case OGF_LINK_CTL:
1041                         hci_cs_link_ctl(hdev, ocf, cs->status);
1042                         break;
1043
1044                 case OGF_LINK_POLICY:
1045                         hci_cs_link_policy(hdev, ocf, cs->status);
1046                         break;
1047
1048                 default:
1049                         BT_DBG("%s Command Status OGF %x", hdev->name, ogf);
1050                         break;
1051                 }
1052
1053                 if (cs->ncmd) {
1054                         atomic_set(&hdev->cmd_cnt, 1);
1055                         if (!skb_queue_empty(&hdev->cmd_q))
1056                                 hci_sched_cmd(hdev);
1057                 }
1058                 break;
1059
1060         case HCI_EV_CMD_COMPLETE:
1061                 ec = (struct hci_ev_cmd_complete *) skb->data;
1062                 skb_pull(skb, sizeof(*ec));
1063
1064                 opcode = __le16_to_cpu(ec->opcode);
1065                 ogf = hci_opcode_ogf(opcode);
1066                 ocf = hci_opcode_ocf(opcode);
1067
1068                 switch (ogf) {
1069                 case OGF_INFO_PARAM:
1070                         hci_cc_info_param(hdev, ocf, skb);
1071                         break;
1072
1073                 case OGF_HOST_CTL:
1074                         hci_cc_host_ctl(hdev, ocf, skb);
1075                         break;
1076
1077                 case OGF_LINK_CTL:
1078                         hci_cc_link_ctl(hdev, ocf, skb);
1079                         break;
1080
1081                 case OGF_LINK_POLICY:
1082                         hci_cc_link_policy(hdev, ocf, skb);
1083                         break;
1084
1085                 default:
1086                         BT_DBG("%s Command Completed OGF %x", hdev->name, ogf);
1087                         break;
1088                 }
1089
1090                 if (ec->ncmd) {
1091                         atomic_set(&hdev->cmd_cnt, 1);
1092                         if (!skb_queue_empty(&hdev->cmd_q))
1093                                 hci_sched_cmd(hdev);
1094                 }
1095                 break;
1096         }
1097
1098         kfree_skb(skb);
1099         hdev->stat.evt_rx++;
1100 }
1101
1102 /* Generate internal stack event */
1103 void hci_si_event(struct hci_dev *hdev, int type, int dlen, void *data)
1104 {
1105         struct hci_event_hdr *hdr;
1106         struct hci_ev_stack_internal *ev;
1107         struct sk_buff *skb;
1108
1109         skb = bt_skb_alloc(HCI_EVENT_HDR_SIZE + sizeof(*ev) + dlen, GFP_ATOMIC);
1110         if (!skb)
1111                 return;
1112
1113         hdr = (void *) skb_put(skb, HCI_EVENT_HDR_SIZE);
1114         hdr->evt  = HCI_EV_STACK_INTERNAL;
1115         hdr->plen = sizeof(*ev) + dlen;
1116
1117         ev  = (void *) skb_put(skb, sizeof(*ev) + dlen);
1118         ev->type = type;
1119         memcpy(ev->data, data, dlen);
1120
1121         bt_cb(skb)->incoming = 1;
1122         __net_timestamp(skb);
1123
1124         bt_cb(skb)->pkt_type = HCI_EVENT_PKT;
1125         skb->dev = (void *) hdev;
1126         hci_send_to_sock(hdev, skb);
1127         kfree_skb(skb);
1128 }