net/bluetooth/hci_event.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2000-2001 Qualcomm Incorporated
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI event handling. */
  26
  27 #include <linux/module.h>
  28
  29 #include <linux/types.h>
  30 #include <linux/errno.h>
  31 #include <linux/kernel.h>
  32 #include <linux/slab.h>
  33 #include <linux/poll.h>
  34 #include <linux/fcntl.h>
  35 #include <linux/init.h>
  36 #include <linux/skbuff.h>
  37 #include <linux/interrupt.h>
  38 #include <linux/notifier.h>
  39 #include <net/sock.h>
  40
  41 #include <asm/system.h>
  42 #include <asm/uaccess.h>
  43 #include <asm/unaligned.h>
  44
  45 #include <net/bluetooth/bluetooth.h>
  46 #include <net/bluetooth/hci_core.h>
  47
  48 #ifndef CONFIG_BT_HCI_CORE_DEBUG
  49 #undef  BT_DBG
  50 #define BT_DBG(D...)
  51 #endif
  52
  53 /* Handle HCI Event packets */
  54
  55 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
  56 {
  57         __u8 status = *((__u8 *) skb->data);
  58
  59         BT_DBG("%s status 0x%x", hdev->name, status);
  60
  61         if (status)
  62                 return;
  63
  64         clear_bit(HCI_INQUIRY, &hdev->flags);
  65
  66         hci_req_complete(hdev, status);
  67
  68         hci_conn_check_pending(hdev);
  69 }
  70
  71 static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  72 {
  73         __u8 status = *((__u8 *) skb->data);
  74
  75         BT_DBG("%s status 0x%x", hdev->name, status);
  76
  77         if (status)
  78                 return;
  79
  80         clear_bit(HCI_INQUIRY, &hdev->flags);
  81
  82         hci_conn_check_pending(hdev);
  83 }
  84
  85 static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev, struct sk_buff *skb)
  86 {
  87         BT_DBG("%s", hdev->name);
  88 }
  89
  90 static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
  91 {
  92         struct hci_rp_role_discovery *rp = (void *) skb->data;
  93         struct hci_conn *conn;
  94
  95         BT_DBG("%s status 0x%x", hdev->name, rp->status);
  96
  97         if (rp->status)
  98                 return;
  99
 100         hci_dev_lock(hdev);
 101
 102         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 103         if (conn) {
 104                 if (rp->role)
 105                         conn->link_mode &= ~HCI_LM_MASTER;
 106                 else
 107                         conn->link_mode |= HCI_LM_MASTER;
 108         }
 109
 110         hci_dev_unlock(hdev);
 111 }
 112
 113 static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 114 {
 115         struct hci_rp_read_link_policy *rp = (void *) skb->data;
 116         struct hci_conn *conn;
 117
 118         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 119
 120         if (rp->status)
 121                 return;
 122
 123         hci_dev_lock(hdev);
 124
 125         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 126         if (conn)
 127                 conn->link_policy = __le16_to_cpu(rp->policy);
 128
 129         hci_dev_unlock(hdev);
 130 }
 131
 132 static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 133 {
 134         struct hci_rp_write_link_policy *rp = (void *) skb->data;
 135         struct hci_conn *conn;
 136         void *sent;
 137
 138         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 139
 140         if (rp->status)
 141                 return;
 142
 143         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
 144         if (!sent)
 145                 return;
 146
 147         hci_dev_lock(hdev);
 148
 149         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 150         if (conn)
 151                 conn->link_policy = get_unaligned_le16(sent + 2);
 152
 153         hci_dev_unlock(hdev);
 154 }
 155
 156 static void hci_cc_read_def_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 157 {
 158         struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
 159
 160         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 161
 162         if (rp->status)
 163                 return;
 164
 165         hdev->link_policy = __le16_to_cpu(rp->policy);
 166 }
 167
 168 static void hci_cc_write_def_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 169 {
 170         __u8 status = *((__u8 *) skb->data);
 171         void *sent;
 172
 173         BT_DBG("%s status 0x%x", hdev->name, status);
 174
 175         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
 176         if (!sent)
 177                 return;
 178
 179         if (!status)
 180                 hdev->link_policy = get_unaligned_le16(sent);
 181
 182         hci_req_complete(hdev, status);
 183 }
 184
 185 static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
 186 {
 187         __u8 status = *((__u8 *) skb->data);
 188
 189         BT_DBG("%s status 0x%x", hdev->name, status);
 190
 191         hci_req_complete(hdev, status);
 192 }
 193
 194 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 195 {
 196         __u8 status = *((__u8 *) skb->data);
 197         void *sent;
 198
 199         BT_DBG("%s status 0x%x", hdev->name, status);
 200
 201         if (status)
 202                 return;
 203
 204         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
 205         if (!sent)
 206                 return;
 207
 208         memcpy(hdev->dev_name, sent, 248);
 209 }
 210
 211 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 212 {
 213         struct hci_rp_read_local_name *rp = (void *) skb->data;
 214
 215         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 216
 217         if (rp->status)
 218                 return;
 219
 220         memcpy(hdev->dev_name, rp->name, 248);
 221 }
 222
 223 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
 224 {
 225         __u8 status = *((__u8 *) skb->data);
 226         void *sent;
 227
 228         BT_DBG("%s status 0x%x", hdev->name, status);
 229
 230         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
 231         if (!sent)
 232                 return;
 233
 234         if (!status) {
 235                 __u8 param = *((__u8 *) sent);
 236
 237                 if (param == AUTH_ENABLED)
 238                         set_bit(HCI_AUTH, &hdev->flags);
 239                 else
 240                         clear_bit(HCI_AUTH, &hdev->flags);
 241         }
 242
 243         hci_req_complete(hdev, status);
 244 }
 245
 246 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
 247 {
 248         __u8 status = *((__u8 *) skb->data);
 249         void *sent;
 250
 251         BT_DBG("%s status 0x%x", hdev->name, status);
 252
 253         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
 254         if (!sent)
 255                 return;
 256
 257         if (!status) {
 258                 __u8 param = *((__u8 *) sent);
 259
 260                 if (param)
 261                         set_bit(HCI_ENCRYPT, &hdev->flags);
 262                 else
 263                         clear_bit(HCI_ENCRYPT, &hdev->flags);
 264         }
 265
 266         hci_req_complete(hdev, status);
 267 }
 268
 269 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
 270 {
 271         __u8 status = *((__u8 *) skb->data);
 272         void *sent;
 273
 274         BT_DBG("%s status 0x%x", hdev->name, status);
 275
 276         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
 277         if (!sent)
 278                 return;
 279
 280         if (!status) {
 281                 __u8 param = *((__u8 *) sent);
 282
 283                 clear_bit(HCI_PSCAN, &hdev->flags);
 284                 clear_bit(HCI_ISCAN, &hdev->flags);
 285
 286                 if (param & SCAN_INQUIRY)
 287                         set_bit(HCI_ISCAN, &hdev->flags);
 288
 289                 if (param & SCAN_PAGE)
 290                         set_bit(HCI_PSCAN, &hdev->flags);
 291         }
 292
 293         hci_req_complete(hdev, status);
 294 }
 295
 296 static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 297 {
 298         struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
 299
 300         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 301
 302         if (rp->status)
 303                 return;
 304
 305         memcpy(hdev->dev_class, rp->dev_class, 3);
 306
 307         BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
 308                 hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
 309 }
 310
 311 static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 312 {
 313         __u8 status = *((__u8 *) skb->data);
 314         void *sent;
 315
 316         BT_DBG("%s status 0x%x", hdev->name, status);
 317
 318         if (status)
 319                 return;
 320
 321         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
 322         if (!sent)
 323                 return;
 324
 325         memcpy(hdev->dev_class, sent, 3);
 326 }
 327
 328 static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 329 {
 330         struct hci_rp_read_voice_setting *rp = (void *) skb->data;
 331         __u16 setting;
 332
 333         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 334
 335         if (rp->status)
 336                 return;
 337
 338         setting = __le16_to_cpu(rp->voice_setting);
 339
 340         if (hdev->voice_setting == setting)
 341                 return;
 342
 343         hdev->voice_setting = setting;
 344
 345         BT_DBG("%s voice setting 0x%04x", hdev->name, setting);
 346
 347         if (hdev->notify) {
 348                 tasklet_disable(&hdev->tx_task);
 349                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 350                 tasklet_enable(&hdev->tx_task);
 351         }
 352 }
 353
 354 static void hci_cc_write_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 355 {
 356         __u8 status = *((__u8 *) skb->data);
 357         __u16 setting;
 358         void *sent;
 359
 360         BT_DBG("%s status 0x%x", hdev->name, status);
 361
 362         if (status)
 363                 return;
 364
 365         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
 366         if (!sent)
 367                 return;
 368
 369         setting = get_unaligned_le16(sent);
 370
 371         if (hdev->voice_setting == setting)
 372                 return;
 373
 374         hdev->voice_setting = setting;
 375
 376         BT_DBG("%s voice setting 0x%04x", hdev->name, setting);
 377
 378         if (hdev->notify) {
 379                 tasklet_disable(&hdev->tx_task);
 380                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 381                 tasklet_enable(&hdev->tx_task);
 382         }
 383 }
 384
 385 static void hci_cc_host_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 386 {
 387         __u8 status = *((__u8 *) skb->data);
 388
 389         BT_DBG("%s status 0x%x", hdev->name, status);
 390
 391         hci_req_complete(hdev, status);
 392 }
 393
 394 static void hci_cc_read_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 395 {
 396         struct hci_rp_read_ssp_mode *rp = (void *) skb->data;
 397
 398         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 399
 400         if (rp->status)
 401                 return;
 402
 403         hdev->ssp_mode = rp->mode;
 404 }
 405
 406 static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 407 {
 408         __u8 status = *((__u8 *) skb->data);
 409         void *sent;
 410
 411         BT_DBG("%s status 0x%x", hdev->name, status);
 412
 413         if (status)
 414                 return;
 415
 416         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
 417         if (!sent)
 418                 return;
 419
 420         hdev->ssp_mode = *((__u8 *) sent);
 421 }
 422
 423 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
 424 {
 425         struct hci_rp_read_local_version *rp = (void *) skb->data;
 426
 427         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 428
 429         if (rp->status)
 430                 return;
 431
 432         hdev->hci_ver = rp->hci_ver;
 433         hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
 434         hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
 435
 436         BT_DBG("%s manufacturer %d hci ver %d:%d", hdev->name,
 437                                         hdev->manufacturer,
 438                                         hdev->hci_ver, hdev->hci_rev);
 439 }
 440
 441 static void hci_cc_read_local_commands(struct hci_dev *hdev, struct sk_buff *skb)
 442 {
 443         struct hci_rp_read_local_commands *rp = (void *) skb->data;
 444
 445         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 446
 447         if (rp->status)
 448                 return;
 449
 450         memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 451 }
 452
 453 static void hci_cc_read_local_features(struct hci_dev *hdev, struct sk_buff *skb)
 454 {
 455         struct hci_rp_read_local_features *rp = (void *) skb->data;
 456
 457         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 458
 459         if (rp->status)
 460                 return;
 461
 462         memcpy(hdev->features, rp->features, 8);
 463
 464         /* Adjust default settings according to features
 465          * supported by device. */
 466
 467         if (hdev->features[0] & LMP_3SLOT)
 468                 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 469
 470         if (hdev->features[0] & LMP_5SLOT)
 471                 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 472
 473         if (hdev->features[1] & LMP_HV2) {
 474                 hdev->pkt_type  |= (HCI_HV2);
 475                 hdev->esco_type |= (ESCO_HV2);
 476         }
 477
 478         if (hdev->features[1] & LMP_HV3) {
 479                 hdev->pkt_type  |= (HCI_HV3);
 480                 hdev->esco_type |= (ESCO_HV3);
 481         }
 482
 483         if (hdev->features[3] & LMP_ESCO)
 484                 hdev->esco_type |= (ESCO_EV3);
 485
 486         if (hdev->features[4] & LMP_EV4)
 487                 hdev->esco_type |= (ESCO_EV4);
 488
 489         if (hdev->features[4] & LMP_EV5)
 490                 hdev->esco_type |= (ESCO_EV5);
 491
 492         BT_DBG("%s features 0x%.2x%.2x%.2x%.2x%.2x%.2x%.2x%.2x", hdev->name,
 493                                         hdev->features[0], hdev->features[1],
 494                                         hdev->features[2], hdev->features[3],
 495                                         hdev->features[4], hdev->features[5],
 496                                         hdev->features[6], hdev->features[7]);
 497 }
 498
 499 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 500 {
 501         struct hci_rp_read_buffer_size *rp = (void *) skb->data;
 502
 503         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 504
 505         if (rp->status)
 506                 return;
 507
 508         hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
 509         hdev->sco_mtu  = rp->sco_mtu;
 510         hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
 511         hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
 512
 513         if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
 514                 hdev->sco_mtu  = 64;
 515                 hdev->sco_pkts = 8;
 516         }
 517
 518         hdev->acl_cnt = hdev->acl_pkts;
 519         hdev->sco_cnt = hdev->sco_pkts;
 520
 521         BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name,
 522                                         hdev->acl_mtu, hdev->acl_pkts,
 523                                         hdev->sco_mtu, hdev->sco_pkts);
 524 }
 525
 526 static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
 527 {
 528         struct hci_rp_read_bd_addr *rp = (void *) skb->data;
 529
 530         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 531
 532         if (!rp->status)
 533                 bacpy(&hdev->bdaddr, &rp->bdaddr);
 534
 535         hci_req_complete(hdev, rp->status);
 536 }
 537
 538 static inline void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
 539 {
 540         BT_DBG("%s status 0x%x", hdev->name, status);
 541
 542         if (status) {
 543                 hci_req_complete(hdev, status);
 544
 545                 hci_conn_check_pending(hdev);
 546         } else
 547                 set_bit(HCI_INQUIRY, &hdev->flags);
 548 }
 549
 550 static inline void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
 551 {
 552         struct hci_cp_create_conn *cp;
 553         struct hci_conn *conn;
 554
 555         BT_DBG("%s status 0x%x", hdev->name, status);
 556
 557         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
 558         if (!cp)
 559                 return;
 560
 561         hci_dev_lock(hdev);
 562
 563         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 564
 565         BT_DBG("%s bdaddr %s conn %p", hdev->name, batostr(&cp->bdaddr), conn);
 566
 567         if (status) {
 568                 if (conn && conn->state == BT_CONNECT) {
 569                         if (status != 0x0c || conn->attempt > 2) {
 570                                 conn->state = BT_CLOSED;
 571                                 hci_proto_connect_cfm(conn, status);
 572                                 hci_conn_del(conn);
 573                         } else
 574                                 conn->state = BT_CONNECT2;
 575                 }
 576         } else {
 577                 if (!conn) {
 578                         conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr);
 579                         if (conn) {
 580                                 conn->out = 1;
 581                                 conn->link_mode |= HCI_LM_MASTER;
 582                         } else
 583                                 BT_ERR("No memmory for new connection");
 584                 }
 585         }
 586
 587         hci_dev_unlock(hdev);
 588 }
 589
 590 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
 591 {
 592         struct hci_cp_add_sco *cp;
 593         struct hci_conn *acl, *sco;
 594         __u16 handle;
 595
 596         BT_DBG("%s status 0x%x", hdev->name, status);
 597
 598         if (!status)
 599                 return;
 600
 601         cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
 602         if (!cp)
 603                 return;
 604
 605         handle = __le16_to_cpu(cp->handle);
 606
 607         BT_DBG("%s handle %d", hdev->name, handle);
 608
 609         hci_dev_lock(hdev);
 610
 611         acl = hci_conn_hash_lookup_handle(hdev, handle);
 612         if (acl && (sco = acl->link)) {
 613                 sco->state = BT_CLOSED;
 614
 615                 hci_proto_connect_cfm(sco, status);
 616                 hci_conn_del(sco);
 617         }
 618
 619         hci_dev_unlock(hdev);
 620 }
 621
 622 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
 623 {
 624         struct hci_cp_auth_requested *cp;
 625         struct hci_conn *conn;
 626
 627         BT_DBG("%s status 0x%x", hdev->name, status);
 628
 629         if (!status)
 630                 return;
 631
 632         cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
 633         if (!cp)
 634                 return;
 635
 636         hci_dev_lock(hdev);
 637
 638         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
 639         if (conn) {
 640                 if (conn->state == BT_CONFIG) {
 641                         hci_proto_connect_cfm(conn, status);
 642                         hci_conn_put(conn);
 643                 }
 644         }
 645
 646         hci_dev_unlock(hdev);
 647 }
 648
 649 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
 650 {
 651         struct hci_cp_set_conn_encrypt *cp;
 652         struct hci_conn *conn;
 653
 654         BT_DBG("%s status 0x%x", hdev->name, status);
 655
 656         if (!status)
 657                 return;
 658
 659         cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
 660         if (!cp)
 661                 return;
 662
 663         hci_dev_lock(hdev);
 664
 665         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
 666         if (conn) {
 667                 if (conn->state == BT_CONFIG) {
 668                         hci_proto_connect_cfm(conn, status);
 669                         hci_conn_put(conn);
 670                 }
 671         }
 672
 673         hci_dev_unlock(hdev);
 674 }
 675
 676 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
 677 {
 678         BT_DBG("%s status 0x%x", hdev->name, status);
 679 }
 680
 681 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
 682 {
 683         struct hci_cp_read_remote_features *cp;
 684         struct hci_conn *conn;
 685
 686         BT_DBG("%s status 0x%x", hdev->name, status);
 687
 688         if (!status)
 689                 return;
 690
 691         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
 692         if (!cp)
 693                 return;
 694
 695         hci_dev_lock(hdev);
 696
 697         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
 698         if (conn) {
 699                 if (conn->state == BT_CONFIG) {
 700                         hci_proto_connect_cfm(conn, status);
 701                         hci_conn_put(conn);
 702                 }
 703         }
 704
 705         hci_dev_unlock(hdev);
 706 }
 707
 708 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
 709 {
 710         struct hci_cp_read_remote_ext_features *cp;
 711         struct hci_conn *conn;
 712
 713         BT_DBG("%s status 0x%x", hdev->name, status);
 714
 715         if (!status)
 716                 return;
 717
 718         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
 719         if (!cp)
 720                 return;
 721
 722         hci_dev_lock(hdev);
 723
 724         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
 725         if (conn) {
 726                 if (conn->state == BT_CONFIG) {
 727                         hci_proto_connect_cfm(conn, status);
 728                         hci_conn_put(conn);
 729                 }
 730         }
 731
 732         hci_dev_unlock(hdev);
 733 }
 734
 735 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
 736 {
 737         struct hci_cp_setup_sync_conn *cp;
 738         struct hci_conn *acl, *sco;
 739         __u16 handle;
 740
 741         BT_DBG("%s status 0x%x", hdev->name, status);
 742
 743         if (!status)
 744                 return;
 745
 746         cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
 747         if (!cp)
 748                 return;
 749
 750         handle = __le16_to_cpu(cp->handle);
 751
 752         BT_DBG("%s handle %d", hdev->name, handle);
 753
 754         hci_dev_lock(hdev);
 755
 756         acl = hci_conn_hash_lookup_handle(hdev, handle);
 757         if (acl && (sco = acl->link)) {
 758                 sco->state = BT_CLOSED;
 759
 760                 hci_proto_connect_cfm(sco, status);
 761                 hci_conn_del(sco);
 762         }
 763
 764         hci_dev_unlock(hdev);
 765 }
 766
 767 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
 768 {
 769         struct hci_cp_sniff_mode *cp;
 770         struct hci_conn *conn;
 771
 772         BT_DBG("%s status 0x%x", hdev->name, status);
 773
 774         if (!status)
 775                 return;
 776
 777         cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
 778         if (!cp)
 779                 return;
 780
 781         hci_dev_lock(hdev);
 782
 783         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
 784         if (conn)
 785                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend);
 786
 787         hci_dev_unlock(hdev);
 788 }
 789
 790 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
 791 {
 792         struct hci_cp_exit_sniff_mode *cp;
 793         struct hci_conn *conn;
 794
 795         BT_DBG("%s status 0x%x", hdev->name, status);
 796
 797         if (!status)
 798                 return;
 799
 800         cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
 801         if (!cp)
 802                 return;
 803
 804         hci_dev_lock(hdev);
 805
 806         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
 807         if (conn)
 808                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend);
 809
 810         hci_dev_unlock(hdev);
 811 }
 812
 813 static inline void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 814 {
 815         __u8 status = *((__u8 *) skb->data);
 816
 817         BT_DBG("%s status %d", hdev->name, status);
 818
 819         clear_bit(HCI_INQUIRY, &hdev->flags);
 820
 821         hci_req_complete(hdev, status);
 822
 823         hci_conn_check_pending(hdev);
 824 }
 825
 826 static inline void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
 827 {
 828         struct inquiry_data data;
 829         struct inquiry_info *info = (void *) (skb->data + 1);
 830         int num_rsp = *((__u8 *) skb->data);
 831
 832         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
 833
 834         if (!num_rsp)
 835                 return;
 836
 837         hci_dev_lock(hdev);
 838
 839         for (; num_rsp; num_rsp--) {
 840                 bacpy(&data.bdaddr, &info->bdaddr);
 841                 data.pscan_rep_mode     = info->pscan_rep_mode;
 842                 data.pscan_period_mode  = info->pscan_period_mode;
 843                 data.pscan_mode         = info->pscan_mode;
 844                 memcpy(data.dev_class, info->dev_class, 3);
 845                 data.clock_offset       = info->clock_offset;
 846                 data.rssi               = 0x00;
 847                 data.ssp_mode           = 0x00;
 848                 info++;
 849                 hci_inquiry_cache_update(hdev, &data);
 850         }
 851
 852         hci_dev_unlock(hdev);
 853 }
 854
 855 static inline void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 856 {
 857         struct hci_ev_conn_complete *ev = (void *) skb->data;
 858         struct hci_conn *conn;
 859
 860         BT_DBG("%s", hdev->name);
 861
 862         hci_dev_lock(hdev);
 863
 864         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
 865         if (!conn)
 866                 goto unlock;
 867
 868         if (!ev->status) {
 869                 conn->handle = __le16_to_cpu(ev->handle);
 870
 871                 if (conn->type == ACL_LINK) {
 872                         conn->state = BT_CONFIG;
 873                         hci_conn_hold(conn);
 874                 } else
 875                         conn->state = BT_CONNECTED;
 876
 877                 if (test_bit(HCI_AUTH, &hdev->flags))
 878                         conn->link_mode |= HCI_LM_AUTH;
 879
 880                 if (test_bit(HCI_ENCRYPT, &hdev->flags))
 881                         conn->link_mode |= HCI_LM_ENCRYPT;
 882
 883                 /* Get remote features */
 884                 if (conn->type == ACL_LINK) {
 885                         struct hci_cp_read_remote_features cp;
 886                         cp.handle = ev->handle;
 887                         hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
 888                                                         sizeof(cp), &cp);
 889                 }
 890
 891                 /* Set packet type for incoming connection */
 892                 if (!conn->out && hdev->hci_ver < 3) {
 893                         struct hci_cp_change_conn_ptype cp;
 894                         cp.handle = ev->handle;
 895                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 896                         hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE,
 897                                                         sizeof(cp), &cp);
 898                 }
 899         } else
 900                 conn->state = BT_CLOSED;
 901
 902         if (conn->type == ACL_LINK) {
 903                 struct hci_conn *sco = conn->link;
 904                 if (sco) {
 905                         if (!ev->status) {
 906                                 if (lmp_esco_capable(hdev))
 907                                         hci_setup_sync(sco, conn->handle);
 908                                 else
 909                                         hci_add_sco(sco, conn->handle);
 910                         } else {
 911                                 hci_proto_connect_cfm(sco, ev->status);
 912                                 hci_conn_del(sco);
 913                         }
 914                 }
 915         }
 916
 917         if (ev->status) {
 918                 hci_proto_connect_cfm(conn, ev->status);
 919                 hci_conn_del(conn);
 920         }
 921
 922 unlock:
 923         hci_dev_unlock(hdev);
 924
 925         hci_conn_check_pending(hdev);
 926 }
 927
 928 static inline void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
 929 {
 930         struct hci_ev_conn_request *ev = (void *) skb->data;
 931         int mask = hdev->link_mode;
 932
 933         BT_DBG("%s bdaddr %s type 0x%x", hdev->name,
 934                                         batostr(&ev->bdaddr), ev->link_type);
 935
 936         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type);
 937
 938         if (mask & HCI_LM_ACCEPT) {
 939                 /* Connection accepted */
 940                 struct inquiry_entry *ie;
 941                 struct hci_conn *conn;
 942
 943                 hci_dev_lock(hdev);
 944
 945                 if ((ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr)))
 946                         memcpy(ie->data.dev_class, ev->dev_class, 3);
 947
 948                 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
 949                 if (!conn) {
 950                         if (!(conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr))) {
 951                                 BT_ERR("No memmory for new connection");
 952                                 hci_dev_unlock(hdev);
 953                                 return;
 954                         }
 955                 }
 956
 957                 memcpy(conn->dev_class, ev->dev_class, 3);
 958                 conn->state = BT_CONNECT;
 959
 960                 hci_dev_unlock(hdev);
 961
 962                 if (ev->link_type == ACL_LINK || !lmp_esco_capable(hdev)) {
 963                         struct hci_cp_accept_conn_req cp;
 964
 965                         bacpy(&cp.bdaddr, &ev->bdaddr);
 966
 967                         if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
 968                                 cp.role = 0x00; /* Become master */
 969                         else
 970                                 cp.role = 0x01; /* Remain slave */
 971
 972                         hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ,
 973                                                         sizeof(cp), &cp);
 974                 } else {
 975                         struct hci_cp_accept_sync_conn_req cp;
 976
 977                         bacpy(&cp.bdaddr, &ev->bdaddr);
 978                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 979
 980                         cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
 981                         cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
 982                         cp.max_latency    = cpu_to_le16(0xffff);
 983                         cp.content_format = cpu_to_le16(hdev->voice_setting);
 984                         cp.retrans_effort = 0xff;
 985
 986                         hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ,
 987                                                         sizeof(cp), &cp);
 988                 }
 989         } else {
 990                 /* Connection rejected */
 991                 struct hci_cp_reject_conn_req cp;
 992
 993                 bacpy(&cp.bdaddr, &ev->bdaddr);
 994                 cp.reason = 0x0f;
 995                 hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
 996         }
 997 }
 998
 999 static inline void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1000 {
1001         struct hci_ev_disconn_complete *ev = (void *) skb->data;
1002         struct hci_conn *conn;
1003
1004         BT_DBG("%s status %d", hdev->name, ev->status);
1005
1006         if (ev->status)
1007                 return;
1008
1009         hci_dev_lock(hdev);
1010
1011         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1012         if (conn) {
1013                 conn->state = BT_CLOSED;
1014                 hci_proto_disconn_ind(conn, ev->reason);
1015                 hci_conn_del(conn);
1016         }
1017
1018         hci_dev_unlock(hdev);
1019 }
1020
1021 static inline void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1022 {
1023         struct hci_ev_auth_complete *ev = (void *) skb->data;
1024         struct hci_conn *conn;
1025
1026         BT_DBG("%s status %d", hdev->name, ev->status);
1027
1028         hci_dev_lock(hdev);
1029
1030         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1031         if (conn) {
1032                 if (!ev->status)
1033                         conn->link_mode |= HCI_LM_AUTH;
1034
1035                 clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
1036
1037                 if (conn->state == BT_CONFIG) {
1038                         if (!ev->status && hdev->ssp_mode > 0 &&
1039                                                         conn->ssp_mode > 0) {
1040                                 struct hci_cp_set_conn_encrypt cp;
1041                                 cp.handle  = ev->handle;
1042                                 cp.encrypt = 0x01;
1043                                 hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT,
1044                                                         sizeof(cp), &cp);
1045                         } else {
1046                                 conn->state = BT_CONNECTED;
1047                                 hci_proto_connect_cfm(conn, ev->status);
1048                                 hci_conn_put(conn);
1049                         }
1050                 } else
1051                         hci_auth_cfm(conn, ev->status);
1052
1053                 if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend)) {
1054                         if (!ev->status) {
1055                                 struct hci_cp_set_conn_encrypt cp;
1056                                 cp.handle  = ev->handle;
1057                                 cp.encrypt = 0x01;
1058                                 hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT,
1059                                                         sizeof(cp), &cp);
1060                         } else {
1061                                 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
1062                                 hci_encrypt_cfm(conn, ev->status, 0x00);
1063                         }
1064                 }
1065         }
1066
1067         hci_dev_unlock(hdev);
1068 }
1069
1070 static inline void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
1071 {
1072         BT_DBG("%s", hdev->name);
1073
1074         hci_conn_check_pending(hdev);
1075 }
1076
1077 static inline void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
1078 {
1079         struct hci_ev_encrypt_change *ev = (void *) skb->data;
1080         struct hci_conn *conn;
1081
1082         BT_DBG("%s status %d", hdev->name, ev->status);
1083
1084         hci_dev_lock(hdev);
1085
1086         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1087         if (conn) {
1088                 if (!ev->status) {
1089                         if (ev->encrypt) {
1090                                 /* Encryption implies authentication */
1091                                 conn->link_mode |= HCI_LM_AUTH;
1092                                 conn->link_mode |= HCI_LM_ENCRYPT;
1093                         } else
1094                                 conn->link_mode &= ~HCI_LM_ENCRYPT;
1095                 }
1096
1097                 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
1098
1099                 if (conn->state == BT_CONFIG) {
1100                         if (!ev->status)
1101                                 conn->state = BT_CONNECTED;
1102
1103                         hci_proto_connect_cfm(conn, ev->status);
1104                         hci_conn_put(conn);
1105                 } else
1106                         hci_encrypt_cfm(conn, ev->status, ev->encrypt);
1107         }
1108
1109         hci_dev_unlock(hdev);
1110 }
1111
1112 static inline void hci_change_link_key_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1113 {
1114         struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
1115         struct hci_conn *conn;
1116
1117         BT_DBG("%s status %d", hdev->name, ev->status);
1118
1119         hci_dev_lock(hdev);
1120
1121         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1122         if (conn) {
1123                 if (!ev->status)
1124                         conn->link_mode |= HCI_LM_SECURE;
1125
1126                 clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
1127
1128                 hci_key_change_cfm(conn, ev->status);
1129         }
1130
1131         hci_dev_unlock(hdev);
1132 }
1133
1134 static inline void hci_remote_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
1135 {
1136         struct hci_ev_remote_features *ev = (void *) skb->data;
1137         struct hci_conn *conn;
1138
1139         BT_DBG("%s status %d", hdev->name, ev->status);
1140
1141         hci_dev_lock(hdev);
1142
1143         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1144         if (conn) {
1145                 if (!ev->status)
1146                         memcpy(conn->features, ev->features, 8);
1147
1148                 if (conn->state == BT_CONFIG) {
1149                         if (!ev->status && lmp_ssp_capable(hdev) &&
1150                                                 lmp_ssp_capable(conn)) {
1151                                 struct hci_cp_read_remote_ext_features cp;
1152                                 cp.handle = ev->handle;
1153                                 cp.page = 0x01;
1154                                 hci_send_cmd(hdev,
1155                                         HCI_OP_READ_REMOTE_EXT_FEATURES,
1156                                                         sizeof(cp), &cp);
1157                         } else {
1158                                 conn->state = BT_CONNECTED;
1159                                 hci_proto_connect_cfm(conn, ev->status);
1160                                 hci_conn_put(conn);
1161                         }
1162                 }
1163         }
1164
1165         hci_dev_unlock(hdev);
1166 }
1167
1168 static inline void hci_remote_version_evt(struct hci_dev *hdev, struct sk_buff *skb)
1169 {
1170         BT_DBG("%s", hdev->name);
1171 }
1172
1173 static inline void hci_qos_setup_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1174 {
1175         BT_DBG("%s", hdev->name);
1176 }
1177
1178 static inline void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1179 {
1180         struct hci_ev_cmd_complete *ev = (void *) skb->data;
1181         __u16 opcode;
1182
1183         skb_pull(skb, sizeof(*ev));
1184
1185         opcode = __le16_to_cpu(ev->opcode);
1186
1187         switch (opcode) {
1188         case HCI_OP_INQUIRY_CANCEL:
1189                 hci_cc_inquiry_cancel(hdev, skb);
1190                 break;
1191
1192         case HCI_OP_EXIT_PERIODIC_INQ:
1193                 hci_cc_exit_periodic_inq(hdev, skb);
1194                 break;
1195
1196         case HCI_OP_REMOTE_NAME_REQ_CANCEL:
1197                 hci_cc_remote_name_req_cancel(hdev, skb);
1198                 break;
1199
1200         case HCI_OP_ROLE_DISCOVERY:
1201                 hci_cc_role_discovery(hdev, skb);
1202                 break;
1203
1204         case HCI_OP_READ_LINK_POLICY:
1205                 hci_cc_read_link_policy(hdev, skb);
1206                 break;
1207
1208         case HCI_OP_WRITE_LINK_POLICY:
1209                 hci_cc_write_link_policy(hdev, skb);
1210                 break;
1211
1212         case HCI_OP_READ_DEF_LINK_POLICY:
1213                 hci_cc_read_def_link_policy(hdev, skb);
1214                 break;
1215
1216         case HCI_OP_WRITE_DEF_LINK_POLICY:
1217                 hci_cc_write_def_link_policy(hdev, skb);
1218                 break;
1219
1220         case HCI_OP_RESET:
1221                 hci_cc_reset(hdev, skb);
1222                 break;
1223
1224         case HCI_OP_WRITE_LOCAL_NAME:
1225                 hci_cc_write_local_name(hdev, skb);
1226                 break;
1227
1228         case HCI_OP_READ_LOCAL_NAME:
1229                 hci_cc_read_local_name(hdev, skb);
1230                 break;
1231
1232         case HCI_OP_WRITE_AUTH_ENABLE:
1233                 hci_cc_write_auth_enable(hdev, skb);
1234                 break;
1235
1236         case HCI_OP_WRITE_ENCRYPT_MODE:
1237                 hci_cc_write_encrypt_mode(hdev, skb);
1238                 break;
1239
1240         case HCI_OP_WRITE_SCAN_ENABLE:
1241                 hci_cc_write_scan_enable(hdev, skb);
1242                 break;
1243
1244         case HCI_OP_READ_CLASS_OF_DEV:
1245                 hci_cc_read_class_of_dev(hdev, skb);
1246                 break;
1247
1248         case HCI_OP_WRITE_CLASS_OF_DEV:
1249                 hci_cc_write_class_of_dev(hdev, skb);
1250                 break;
1251
1252         case HCI_OP_READ_VOICE_SETTING:
1253                 hci_cc_read_voice_setting(hdev, skb);
1254                 break;
1255
1256         case HCI_OP_WRITE_VOICE_SETTING:
1257                 hci_cc_write_voice_setting(hdev, skb);
1258                 break;
1259
1260         case HCI_OP_HOST_BUFFER_SIZE:
1261                 hci_cc_host_buffer_size(hdev, skb);
1262                 break;
1263
1264         case HCI_OP_READ_SSP_MODE:
1265                 hci_cc_read_ssp_mode(hdev, skb);
1266                 break;
1267
1268         case HCI_OP_WRITE_SSP_MODE:
1269                 hci_cc_write_ssp_mode(hdev, skb);
1270                 break;
1271
1272         case HCI_OP_READ_LOCAL_VERSION:
1273                 hci_cc_read_local_version(hdev, skb);
1274                 break;
1275
1276         case HCI_OP_READ_LOCAL_COMMANDS:
1277                 hci_cc_read_local_commands(hdev, skb);
1278                 break;
1279
1280         case HCI_OP_READ_LOCAL_FEATURES:
1281                 hci_cc_read_local_features(hdev, skb);
1282                 break;
1283
1284         case HCI_OP_READ_BUFFER_SIZE:
1285                 hci_cc_read_buffer_size(hdev, skb);
1286                 break;
1287
1288         case HCI_OP_READ_BD_ADDR:
1289                 hci_cc_read_bd_addr(hdev, skb);
1290                 break;
1291
1292         default:
1293                 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
1294                 break;
1295         }
1296
1297         if (ev->ncmd) {
1298                 atomic_set(&hdev->cmd_cnt, 1);
1299                 if (!skb_queue_empty(&hdev->cmd_q))
1300                         hci_sched_cmd(hdev);
1301         }
1302 }
1303
1304 static inline void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb)
1305 {
1306         struct hci_ev_cmd_status *ev = (void *) skb->data;
1307         __u16 opcode;
1308
1309         skb_pull(skb, sizeof(*ev));
1310
1311         opcode = __le16_to_cpu(ev->opcode);
1312
1313         switch (opcode) {
1314         case HCI_OP_INQUIRY:
1315                 hci_cs_inquiry(hdev, ev->status);
1316                 break;
1317
1318         case HCI_OP_CREATE_CONN:
1319                 hci_cs_create_conn(hdev, ev->status);
1320                 break;
1321
1322         case HCI_OP_ADD_SCO:
1323                 hci_cs_add_sco(hdev, ev->status);
1324                 break;
1325
1326         case HCI_OP_AUTH_REQUESTED:
1327                 hci_cs_auth_requested(hdev, ev->status);
1328                 break;
1329
1330         case HCI_OP_SET_CONN_ENCRYPT:
1331                 hci_cs_set_conn_encrypt(hdev, ev->status);
1332                 break;
1333
1334         case HCI_OP_REMOTE_NAME_REQ:
1335                 hci_cs_remote_name_req(hdev, ev->status);
1336                 break;
1337
1338         case HCI_OP_READ_REMOTE_FEATURES:
1339                 hci_cs_read_remote_features(hdev, ev->status);
1340                 break;
1341
1342         case HCI_OP_READ_REMOTE_EXT_FEATURES:
1343                 hci_cs_read_remote_ext_features(hdev, ev->status);
1344                 break;
1345
1346         case HCI_OP_SETUP_SYNC_CONN:
1347                 hci_cs_setup_sync_conn(hdev, ev->status);
1348                 break;
1349
1350         case HCI_OP_SNIFF_MODE:
1351                 hci_cs_sniff_mode(hdev, ev->status);
1352                 break;
1353
1354         case HCI_OP_EXIT_SNIFF_MODE:
1355                 hci_cs_exit_sniff_mode(hdev, ev->status);
1356                 break;
1357
1358         default:
1359                 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
1360                 break;
1361         }
1362
1363         if (ev->ncmd) {
1364                 atomic_set(&hdev->cmd_cnt, 1);
1365                 if (!skb_queue_empty(&hdev->cmd_q))
1366                         hci_sched_cmd(hdev);
1367         }
1368 }
1369
1370 static inline void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
1371 {
1372         struct hci_ev_role_change *ev = (void *) skb->data;
1373         struct hci_conn *conn;
1374
1375         BT_DBG("%s status %d", hdev->name, ev->status);
1376
1377         hci_dev_lock(hdev);
1378
1379         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
1380         if (conn) {
1381                 if (!ev->status) {
1382                         if (ev->role)
1383                                 conn->link_mode &= ~HCI_LM_MASTER;
1384                         else
1385                                 conn->link_mode |= HCI_LM_MASTER;
1386                 }
1387
1388                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->pend);
1389
1390                 hci_role_switch_cfm(conn, ev->status, ev->role);
1391         }
1392
1393         hci_dev_unlock(hdev);
1394 }
1395
1396 static inline void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
1397 {
1398         struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
1399         __le16 *ptr;
1400         int i;
1401
1402         skb_pull(skb, sizeof(*ev));
1403
1404         BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
1405
1406         if (skb->len < ev->num_hndl * 4) {
1407                 BT_DBG("%s bad parameters", hdev->name);
1408                 return;
1409         }
1410
1411         tasklet_disable(&hdev->tx_task);
1412
1413         for (i = 0, ptr = (__le16 *) skb->data; i < ev->num_hndl; i++) {
1414                 struct hci_conn *conn;
1415                 __u16  handle, count;
1416
1417                 handle = get_unaligned_le16(ptr++);
1418                 count  = get_unaligned_le16(ptr++);
1419
1420                 conn = hci_conn_hash_lookup_handle(hdev, handle);
1421                 if (conn) {
1422                         conn->sent -= count;
1423
1424                         if (conn->type == ACL_LINK) {
1425                                 if ((hdev->acl_cnt += count) > hdev->acl_pkts)
1426                                         hdev->acl_cnt = hdev->acl_pkts;
1427                         } else {
1428                                 if ((hdev->sco_cnt += count) > hdev->sco_pkts)
1429                                         hdev->sco_cnt = hdev->sco_pkts;
1430                         }
1431                 }
1432         }
1433
1434         hci_sched_tx(hdev);
1435
1436         tasklet_enable(&hdev->tx_task);
1437 }
1438
1439 static inline void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
1440 {
1441         struct hci_ev_mode_change *ev = (void *) skb->data;
1442         struct hci_conn *conn;
1443
1444         BT_DBG("%s status %d", hdev->name, ev->status);
1445
1446         hci_dev_lock(hdev);
1447
1448         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1449         if (conn) {
1450                 conn->mode = ev->mode;
1451                 conn->interval = __le16_to_cpu(ev->interval);
1452
1453                 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
1454                         if (conn->mode == HCI_CM_ACTIVE)
1455                                 conn->power_save = 1;
1456                         else
1457                                 conn->power_save = 0;
1458                 }
1459         }
1460
1461         hci_dev_unlock(hdev);
1462 }
1463
1464 static inline void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
1465 {
1466         BT_DBG("%s", hdev->name);
1467 }
1468
1469 static inline void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
1470 {
1471         BT_DBG("%s", hdev->name);
1472 }
1473
1474 static inline void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
1475 {
1476         BT_DBG("%s", hdev->name);
1477 }
1478
1479 static inline void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
1480 {
1481         struct hci_ev_clock_offset *ev = (void *) skb->data;
1482         struct hci_conn *conn;
1483
1484         BT_DBG("%s status %d", hdev->name, ev->status);
1485
1486         hci_dev_lock(hdev);
1487
1488         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1489         if (conn && !ev->status) {
1490                 struct inquiry_entry *ie;
1491
1492                 if ((ie = hci_inquiry_cache_lookup(hdev, &conn->dst))) {
1493                         ie->data.clock_offset = ev->clock_offset;
1494                         ie->timestamp = jiffies;
1495                 }
1496         }
1497
1498         hci_dev_unlock(hdev);
1499 }
1500
1501 static inline void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
1502 {
1503         struct hci_ev_pkt_type_change *ev = (void *) skb->data;
1504         struct hci_conn *conn;
1505
1506         BT_DBG("%s status %d", hdev->name, ev->status);
1507
1508         hci_dev_lock(hdev);
1509
1510         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1511         if (conn && !ev->status)
1512                 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
1513
1514         hci_dev_unlock(hdev);
1515 }
1516
1517 static inline void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
1518 {
1519         struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
1520         struct inquiry_entry *ie;
1521
1522         BT_DBG("%s", hdev->name);
1523
1524         hci_dev_lock(hdev);
1525
1526         if ((ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr))) {
1527                 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
1528                 ie->timestamp = jiffies;
1529         }
1530
1531         hci_dev_unlock(hdev);
1532 }
1533
1534 static inline void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, struct sk_buff *skb)
1535 {
1536         struct inquiry_data data;
1537         int num_rsp = *((__u8 *) skb->data);
1538
1539         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
1540
1541         if (!num_rsp)
1542                 return;
1543
1544         hci_dev_lock(hdev);
1545
1546         if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
1547                 struct inquiry_info_with_rssi_and_pscan_mode *info = (void *) (skb->data + 1);
1548
1549                 for (; num_rsp; num_rsp--) {
1550                         bacpy(&data.bdaddr, &info->bdaddr);
1551                         data.pscan_rep_mode     = info->pscan_rep_mode;
1552                         data.pscan_period_mode  = info->pscan_period_mode;
1553                         data.pscan_mode         = info->pscan_mode;
1554                         memcpy(data.dev_class, info->dev_class, 3);
1555                         data.clock_offset       = info->clock_offset;
1556                         data.rssi               = info->rssi;
1557                         data.ssp_mode           = 0x00;
1558                         info++;
1559                         hci_inquiry_cache_update(hdev, &data);
1560                 }
1561         } else {
1562                 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
1563
1564                 for (; num_rsp; num_rsp--) {
1565                         bacpy(&data.bdaddr, &info->bdaddr);
1566                         data.pscan_rep_mode     = info->pscan_rep_mode;
1567                         data.pscan_period_mode  = info->pscan_period_mode;
1568                         data.pscan_mode         = 0x00;
1569                         memcpy(data.dev_class, info->dev_class, 3);
1570                         data.clock_offset       = info->clock_offset;
1571                         data.rssi               = info->rssi;
1572                         data.ssp_mode           = 0x00;
1573                         info++;
1574                         hci_inquiry_cache_update(hdev, &data);
1575                 }
1576         }
1577
1578         hci_dev_unlock(hdev);
1579 }
1580
1581 static inline void hci_remote_ext_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
1582 {
1583         struct hci_ev_remote_ext_features *ev = (void *) skb->data;
1584         struct hci_conn *conn;
1585
1586         BT_DBG("%s", hdev->name);
1587
1588         hci_dev_lock(hdev);
1589
1590         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1591         if (conn) {
1592                 if (!ev->status && ev->page == 0x01) {
1593                         struct inquiry_entry *ie;
1594
1595                         if ((ie = hci_inquiry_cache_lookup(hdev, &conn->dst)))
1596                                 ie->data.ssp_mode = (ev->features[0] & 0x01);
1597
1598                         conn->ssp_mode = (ev->features[0] & 0x01);
1599                 }
1600
1601                 if (conn->state == BT_CONFIG) {
1602                         if (!ev->status && hdev->ssp_mode > 0 &&
1603                                                         conn->ssp_mode > 0) {
1604                                 if (conn->out) {
1605                                         struct hci_cp_auth_requested cp;
1606                                         cp.handle = ev->handle;
1607                                         hci_send_cmd(hdev,
1608                                                 HCI_OP_AUTH_REQUESTED,
1609                                                         sizeof(cp), &cp);
1610                                 }
1611                         } else {
1612                                 conn->state = BT_CONNECTED;
1613                                 hci_proto_connect_cfm(conn, ev->status);
1614                                 hci_conn_put(conn);
1615                         }
1616                 }
1617         }
1618
1619         hci_dev_unlock(hdev);
1620 }
1621
1622 static inline void hci_sync_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1623 {
1624         struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
1625         struct hci_conn *conn;
1626
1627         BT_DBG("%s status %d", hdev->name, ev->status);
1628
1629         hci_dev_lock(hdev);
1630
1631         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
1632         if (!conn) {
1633                 if (ev->link_type == ESCO_LINK)
1634                         goto unlock;
1635
1636                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
1637                 if (!conn)
1638                         goto unlock;
1639
1640                 conn->type = SCO_LINK;
1641         }
1642
1643         if (!ev->status) {
1644                 conn->handle = __le16_to_cpu(ev->handle);
1645                 conn->state  = BT_CONNECTED;
1646         } else
1647                 conn->state = BT_CLOSED;
1648
1649         hci_proto_connect_cfm(conn, ev->status);
1650         if (ev->status)
1651                 hci_conn_del(conn);
1652
1653 unlock:
1654         hci_dev_unlock(hdev);
1655 }
1656
1657 static inline void hci_sync_conn_changed_evt(struct hci_dev *hdev, struct sk_buff *skb)
1658 {
1659         BT_DBG("%s", hdev->name);
1660 }
1661
1662 static inline void hci_sniff_subrate_evt(struct hci_dev *hdev, struct sk_buff *skb)
1663 {
1664         struct hci_ev_sniff_subrate *ev = (void *) skb->data;
1665         struct hci_conn *conn;
1666
1667         BT_DBG("%s status %d", hdev->name, ev->status);
1668
1669         hci_dev_lock(hdev);
1670
1671         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1672         if (conn) {
1673         }
1674
1675         hci_dev_unlock(hdev);
1676 }
1677
1678 static inline void hci_extended_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
1679 {
1680         struct inquiry_data data;
1681         struct extended_inquiry_info *info = (void *) (skb->data + 1);
1682         int num_rsp = *((__u8 *) skb->data);
1683
1684         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
1685
1686         if (!num_rsp)
1687                 return;
1688
1689         hci_dev_lock(hdev);
1690
1691         for (; num_rsp; num_rsp--) {
1692                 bacpy(&data.bdaddr, &info->bdaddr);
1693                 data.pscan_rep_mode     = info->pscan_rep_mode;
1694                 data.pscan_period_mode  = info->pscan_period_mode;
1695                 data.pscan_mode         = 0x00;
1696                 memcpy(data.dev_class, info->dev_class, 3);
1697                 data.clock_offset       = info->clock_offset;
1698                 data.rssi               = info->rssi;
1699                 data.ssp_mode           = 0x01;
1700                 info++;
1701                 hci_inquiry_cache_update(hdev, &data);
1702         }
1703
1704         hci_dev_unlock(hdev);
1705 }
1706
1707 static inline void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
1708 {
1709         struct hci_ev_io_capa_request *ev = (void *) skb->data;
1710         struct hci_conn *conn;
1711
1712         BT_DBG("%s", hdev->name);
1713
1714         hci_dev_lock(hdev);
1715
1716         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
1717         if (conn)
1718                 hci_conn_hold(conn);
1719
1720         hci_dev_unlock(hdev);
1721 }
1722
1723 static inline void hci_simple_pair_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1724 {
1725         struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
1726         struct hci_conn *conn;
1727
1728         BT_DBG("%s", hdev->name);
1729
1730         hci_dev_lock(hdev);
1731
1732         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
1733         if (conn)
1734                 hci_conn_put(conn);
1735
1736         hci_dev_unlock(hdev);
1737 }
1738
1739 static inline void hci_remote_host_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
1740 {
1741         struct hci_ev_remote_host_features *ev = (void *) skb->data;
1742         struct inquiry_entry *ie;
1743
1744         BT_DBG("%s", hdev->name);
1745
1746         hci_dev_lock(hdev);
1747
1748         if ((ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr)))
1749                 ie->data.ssp_mode = (ev->features[0] & 0x01);
1750
1751         hci_dev_unlock(hdev);
1752 }
1753
1754 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
1755 {
1756         struct hci_event_hdr *hdr = (void *) skb->data;
1757         __u8 event = hdr->evt;
1758
1759         skb_pull(skb, HCI_EVENT_HDR_SIZE);
1760
1761         switch (event) {
1762         case HCI_EV_INQUIRY_COMPLETE:
1763                 hci_inquiry_complete_evt(hdev, skb);
1764                 break;
1765
1766         case HCI_EV_INQUIRY_RESULT:
1767                 hci_inquiry_result_evt(hdev, skb);
1768                 break;
1769
1770         case HCI_EV_CONN_COMPLETE:
1771                 hci_conn_complete_evt(hdev, skb);
1772                 break;
1773
1774         case HCI_EV_CONN_REQUEST:
1775                 hci_conn_request_evt(hdev, skb);
1776                 break;
1777
1778         case HCI_EV_DISCONN_COMPLETE:
1779                 hci_disconn_complete_evt(hdev, skb);
1780                 break;
1781
1782         case HCI_EV_AUTH_COMPLETE:
1783                 hci_auth_complete_evt(hdev, skb);
1784                 break;
1785
1786         case HCI_EV_REMOTE_NAME:
1787                 hci_remote_name_evt(hdev, skb);
1788                 break;
1789
1790         case HCI_EV_ENCRYPT_CHANGE:
1791                 hci_encrypt_change_evt(hdev, skb);
1792                 break;
1793
1794         case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
1795                 hci_change_link_key_complete_evt(hdev, skb);
1796                 break;
1797
1798         case HCI_EV_REMOTE_FEATURES:
1799                 hci_remote_features_evt(hdev, skb);
1800                 break;
1801
1802         case HCI_EV_REMOTE_VERSION:
1803                 hci_remote_version_evt(hdev, skb);
1804                 break;
1805
1806         case HCI_EV_QOS_SETUP_COMPLETE:
1807                 hci_qos_setup_complete_evt(hdev, skb);
1808                 break;
1809
1810         case HCI_EV_CMD_COMPLETE:
1811                 hci_cmd_complete_evt(hdev, skb);
1812                 break;
1813
1814         case HCI_EV_CMD_STATUS:
1815                 hci_cmd_status_evt(hdev, skb);
1816                 break;
1817
1818         case HCI_EV_ROLE_CHANGE:
1819                 hci_role_change_evt(hdev, skb);
1820                 break;
1821
1822         case HCI_EV_NUM_COMP_PKTS:
1823                 hci_num_comp_pkts_evt(hdev, skb);
1824                 break;
1825
1826         case HCI_EV_MODE_CHANGE:
1827                 hci_mode_change_evt(hdev, skb);
1828                 break;
1829
1830         case HCI_EV_PIN_CODE_REQ:
1831                 hci_pin_code_request_evt(hdev, skb);
1832                 break;
1833
1834         case HCI_EV_LINK_KEY_REQ:
1835                 hci_link_key_request_evt(hdev, skb);
1836                 break;
1837
1838         case HCI_EV_LINK_KEY_NOTIFY:
1839                 hci_link_key_notify_evt(hdev, skb);
1840                 break;
1841
1842         case HCI_EV_CLOCK_OFFSET:
1843                 hci_clock_offset_evt(hdev, skb);
1844                 break;
1845
1846         case HCI_EV_PKT_TYPE_CHANGE:
1847                 hci_pkt_type_change_evt(hdev, skb);
1848                 break;
1849
1850         case HCI_EV_PSCAN_REP_MODE:
1851                 hci_pscan_rep_mode_evt(hdev, skb);
1852                 break;
1853
1854         case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
1855                 hci_inquiry_result_with_rssi_evt(hdev, skb);
1856                 break;
1857
1858         case HCI_EV_REMOTE_EXT_FEATURES:
1859                 hci_remote_ext_features_evt(hdev, skb);
1860                 break;
1861
1862         case HCI_EV_SYNC_CONN_COMPLETE:
1863                 hci_sync_conn_complete_evt(hdev, skb);
1864                 break;
1865
1866         case HCI_EV_SYNC_CONN_CHANGED:
1867                 hci_sync_conn_changed_evt(hdev, skb);
1868                 break;
1869
1870         case HCI_EV_SNIFF_SUBRATE:
1871                 hci_sniff_subrate_evt(hdev, skb);
1872                 break;
1873
1874         case HCI_EV_EXTENDED_INQUIRY_RESULT:
1875                 hci_extended_inquiry_result_evt(hdev, skb);
1876                 break;
1877
1878         case HCI_EV_IO_CAPA_REQUEST:
1879                 hci_io_capa_request_evt(hdev, skb);
1880                 break;
1881
1882         case HCI_EV_SIMPLE_PAIR_COMPLETE:
1883                 hci_simple_pair_complete_evt(hdev, skb);
1884                 break;
1885
1886         case HCI_EV_REMOTE_HOST_FEATURES:
1887                 hci_remote_host_features_evt(hdev, skb);
1888                 break;
1889
1890         default:
1891                 BT_DBG("%s event 0x%x", hdev->name, event);
1892                 break;
1893         }
1894
1895         kfree_skb(skb);
1896         hdev->stat.evt_rx++;
1897 }
1898
1899 /* Generate internal stack event */
1900 void hci_si_event(struct hci_dev *hdev, int type, int dlen, void *data)
1901 {
1902         struct hci_event_hdr *hdr;
1903         struct hci_ev_stack_internal *ev;
1904         struct sk_buff *skb;
1905
1906         skb = bt_skb_alloc(HCI_EVENT_HDR_SIZE + sizeof(*ev) + dlen, GFP_ATOMIC);
1907         if (!skb)
1908                 return;
1909
1910         hdr = (void *) skb_put(skb, HCI_EVENT_HDR_SIZE);
1911         hdr->evt  = HCI_EV_STACK_INTERNAL;
1912         hdr->plen = sizeof(*ev) + dlen;
1913
1914         ev  = (void *) skb_put(skb, sizeof(*ev) + dlen);
1915         ev->type = type;
1916         memcpy(ev->data, data, dlen);
1917
1918         bt_cb(skb)->incoming = 1;
1919         __net_timestamp(skb);
1920
1921         bt_cb(skb)->pkt_type = HCI_EVENT_PKT;
1922         skb->dev = (void *) hdev;
1923         hci_send_to_sock(hdev, skb);
1924         kfree_skb(skb);
1925 }