net/bluetooth/hci_event.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI event handling. */
  26
  27 #include <linux/module.h>
  28
  29 #include <linux/types.h>
  30 #include <linux/errno.h>
  31 #include <linux/kernel.h>
  32 #include <linux/slab.h>
  33 #include <linux/poll.h>
  34 #include <linux/fcntl.h>
  35 #include <linux/init.h>
  36 #include <linux/skbuff.h>
  37 #include <linux/interrupt.h>
  38 #include <linux/notifier.h>
  39 #include <net/sock.h>
  40
  41 #include <asm/system.h>
  42 #include <asm/uaccess.h>
  43 #include <asm/unaligned.h>
  44
  45 #include <net/bluetooth/bluetooth.h>
  46 #include <net/bluetooth/hci_core.h>
  47
  48 /* Code under HCI_AUTO_NAME_RESOLVE contains the CQ fix code taken from the
  49  * kernel release 2.6.39. If we are migrating to a kernel version which is
  50  * less than 2.6.39, then need to retain this patch. For more information
  51  * check git history.
  52  */
  53 #define HCI_AUTO_NAME_RESOLVE
  54
  55 /* Handle HCI Event packets */
  56
  57 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
  58 {
  59         __u8 status = *((__u8 *) skb->data);
  60
  61         BT_DBG("%s status 0x%x", hdev->name, status);
  62
  63         if (status)
  64                 return;
  65
  66         clear_bit(HCI_INQUIRY, &hdev->flags);
  67
  68         hci_req_complete(hdev, status);
  69
  70         hci_conn_check_pending(hdev);
  71 }
  72
  73 static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  74 {
  75         __u8 status = *((__u8 *) skb->data);
  76
  77         BT_DBG("%s status 0x%x", hdev->name, status);
  78
  79         if (status)
  80                 return;
  81
  82         clear_bit(HCI_INQUIRY, &hdev->flags);
  83
  84         hci_conn_check_pending(hdev);
  85 }
  86
  87 static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev, struct sk_buff *skb)
  88 {
  89         BT_DBG("%s", hdev->name);
  90 }
  91
  92 static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
  93 {
  94         struct hci_rp_role_discovery *rp = (void *) skb->data;
  95         struct hci_conn *conn;
  96
  97         BT_DBG("%s status 0x%x", hdev->name, rp->status);
  98
  99         if (rp->status)
 100                 return;
 101
 102         hci_dev_lock(hdev);
 103
 104         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 105         if (conn) {
 106                 if (rp->role)
 107                         conn->link_mode &= ~HCI_LM_MASTER;
 108                 else
 109                         conn->link_mode |= HCI_LM_MASTER;
 110         }
 111
 112         hci_dev_unlock(hdev);
 113 }
 114
 115 static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 116 {
 117         struct hci_rp_read_link_policy *rp = (void *) skb->data;
 118         struct hci_conn *conn;
 119
 120         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 121
 122         if (rp->status)
 123                 return;
 124
 125         hci_dev_lock(hdev);
 126
 127         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 128         if (conn)
 129                 conn->link_policy = __le16_to_cpu(rp->policy);
 130
 131         hci_dev_unlock(hdev);
 132 }
 133
 134 static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 135 {
 136         struct hci_rp_write_link_policy *rp = (void *) skb->data;
 137         struct hci_conn *conn;
 138         void *sent;
 139
 140         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 141
 142         if (rp->status)
 143                 return;
 144
 145         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
 146         if (!sent)
 147                 return;
 148
 149         hci_dev_lock(hdev);
 150
 151         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 152         if (conn)
 153                 conn->link_policy = get_unaligned_le16(sent + 2);
 154
 155         hci_dev_unlock(hdev);
 156 }
 157
 158 static void hci_cc_read_def_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 159 {
 160         struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
 161
 162         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 163
 164         if (rp->status)
 165                 return;
 166
 167         hdev->link_policy = __le16_to_cpu(rp->policy);
 168 }
 169
 170 static void hci_cc_write_def_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 171 {
 172         __u8 status = *((__u8 *) skb->data);
 173         void *sent;
 174
 175         BT_DBG("%s status 0x%x", hdev->name, status);
 176
 177         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
 178         if (!sent)
 179                 return;
 180
 181         if (!status)
 182                 hdev->link_policy = get_unaligned_le16(sent);
 183
 184         hci_req_complete(hdev, status);
 185 }
 186
 187 static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
 188 {
 189         __u8 status = *((__u8 *) skb->data);
 190
 191         BT_DBG("%s status 0x%x", hdev->name, status);
 192
 193         hci_req_complete(hdev, status);
 194 }
 195
 196 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 197 {
 198         __u8 status = *((__u8 *) skb->data);
 199         void *sent;
 200
 201         BT_DBG("%s status 0x%x", hdev->name, status);
 202
 203         if (status)
 204                 return;
 205
 206         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
 207         if (!sent)
 208                 return;
 209
 210         memcpy(hdev->dev_name, sent, 248);
 211 }
 212
 213 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 214 {
 215         struct hci_rp_read_local_name *rp = (void *) skb->data;
 216
 217         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 218
 219         if (rp->status)
 220                 return;
 221
 222         memcpy(hdev->dev_name, rp->name, 248);
 223 }
 224
 225 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
 226 {
 227         __u8 status = *((__u8 *) skb->data);
 228         void *sent;
 229
 230         BT_DBG("%s status 0x%x", hdev->name, status);
 231
 232         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
 233         if (!sent)
 234                 return;
 235
 236         if (!status) {
 237                 __u8 param = *((__u8 *) sent);
 238
 239                 if (param == AUTH_ENABLED)
 240                         set_bit(HCI_AUTH, &hdev->flags);
 241                 else
 242                         clear_bit(HCI_AUTH, &hdev->flags);
 243         }
 244
 245         hci_req_complete(hdev, status);
 246 }
 247
 248 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
 249 {
 250         __u8 status = *((__u8 *) skb->data);
 251         void *sent;
 252
 253         BT_DBG("%s status 0x%x", hdev->name, status);
 254
 255         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
 256         if (!sent)
 257                 return;
 258
 259         if (!status) {
 260                 __u8 param = *((__u8 *) sent);
 261
 262                 if (param)
 263                         set_bit(HCI_ENCRYPT, &hdev->flags);
 264                 else
 265                         clear_bit(HCI_ENCRYPT, &hdev->flags);
 266         }
 267
 268         hci_req_complete(hdev, status);
 269 }
 270
 271 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
 272 {
 273         __u8 status = *((__u8 *) skb->data);
 274         void *sent;
 275
 276         BT_DBG("%s status 0x%x", hdev->name, status);
 277
 278         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
 279         if (!sent)
 280                 return;
 281
 282         if (!status) {
 283                 __u8 param = *((__u8 *) sent);
 284
 285                 clear_bit(HCI_PSCAN, &hdev->flags);
 286                 clear_bit(HCI_ISCAN, &hdev->flags);
 287
 288                 if (param & SCAN_INQUIRY)
 289                         set_bit(HCI_ISCAN, &hdev->flags);
 290
 291                 if (param & SCAN_PAGE)
 292                         set_bit(HCI_PSCAN, &hdev->flags);
 293         }
 294
 295         hci_req_complete(hdev, status);
 296 }
 297
 298 static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 299 {
 300         struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
 301
 302         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 303
 304         if (rp->status)
 305                 return;
 306
 307         memcpy(hdev->dev_class, rp->dev_class, 3);
 308
 309         BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
 310                 hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
 311 }
 312
 313 static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 314 {
 315         __u8 status = *((__u8 *) skb->data);
 316         void *sent;
 317
 318         BT_DBG("%s status 0x%x", hdev->name, status);
 319
 320         if (status)
 321                 return;
 322
 323         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
 324         if (!sent)
 325                 return;
 326
 327         memcpy(hdev->dev_class, sent, 3);
 328 }
 329
 330 static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 331 {
 332         struct hci_rp_read_voice_setting *rp = (void *) skb->data;
 333         __u16 setting;
 334
 335         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 336
 337         if (rp->status)
 338                 return;
 339
 340         setting = __le16_to_cpu(rp->voice_setting);
 341
 342         if (hdev->voice_setting == setting)
 343                 return;
 344
 345         hdev->voice_setting = setting;
 346
 347         BT_DBG("%s voice setting 0x%04x", hdev->name, setting);
 348
 349         if (hdev->notify) {
 350                 tasklet_disable(&hdev->tx_task);
 351                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 352                 tasklet_enable(&hdev->tx_task);
 353         }
 354 }
 355
 356 static void hci_cc_write_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 357 {
 358         __u8 status = *((__u8 *) skb->data);
 359         __u16 setting;
 360         void *sent;
 361
 362         BT_DBG("%s status 0x%x", hdev->name, status);
 363
 364         if (status)
 365                 return;
 366
 367         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
 368         if (!sent)
 369                 return;
 370
 371         setting = get_unaligned_le16(sent);
 372
 373         if (hdev->voice_setting == setting)
 374                 return;
 375
 376         hdev->voice_setting = setting;
 377
 378         BT_DBG("%s voice setting 0x%04x", hdev->name, setting);
 379
 380         if (hdev->notify) {
 381                 tasklet_disable(&hdev->tx_task);
 382                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 383                 tasklet_enable(&hdev->tx_task);
 384         }
 385 }
 386
 387 static void hci_cc_host_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 388 {
 389         __u8 status = *((__u8 *) skb->data);
 390
 391         BT_DBG("%s status 0x%x", hdev->name, status);
 392
 393         hci_req_complete(hdev, status);
 394 }
 395
 396 static void hci_cc_read_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 397 {
 398         struct hci_rp_read_ssp_mode *rp = (void *) skb->data;
 399
 400         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 401
 402         if (rp->status)
 403                 return;
 404
 405         hdev->ssp_mode = rp->mode;
 406 }
 407
 408 static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 409 {
 410         __u8 status = *((__u8 *) skb->data);
 411         void *sent;
 412
 413         BT_DBG("%s status 0x%x", hdev->name, status);
 414
 415         if (status)
 416                 return;
 417
 418         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
 419         if (!sent)
 420                 return;
 421
 422         hdev->ssp_mode = *((__u8 *) sent);
 423 }
 424
 425 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
 426 {
 427         struct hci_rp_read_local_version *rp = (void *) skb->data;
 428
 429         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 430
 431         if (rp->status)
 432                 return;
 433
 434         hdev->hci_ver = rp->hci_ver;
 435         hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
 436         hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
 437
 438         BT_DBG("%s manufacturer %d hci ver %d:%d", hdev->name,
 439                                         hdev->manufacturer,
 440                                         hdev->hci_ver, hdev->hci_rev);
 441 }
 442
 443 static void hci_cc_read_local_commands(struct hci_dev *hdev, struct sk_buff *skb)
 444 {
 445         struct hci_rp_read_local_commands *rp = (void *) skb->data;
 446
 447         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 448
 449         if (rp->status)
 450                 return;
 451
 452         memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 453 }
 454
 455 static void hci_cc_read_local_features(struct hci_dev *hdev, struct sk_buff *skb)
 456 {
 457         struct hci_rp_read_local_features *rp = (void *) skb->data;
 458
 459         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 460
 461         if (rp->status)
 462                 return;
 463
 464         memcpy(hdev->features, rp->features, 8);
 465
 466         /* Adjust default settings according to features
 467          * supported by device. */
 468
 469         if (hdev->features[0] & LMP_3SLOT)
 470                 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 471
 472         if (hdev->features[0] & LMP_5SLOT)
 473                 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 474
 475         if (hdev->features[1] & LMP_HV2) {
 476                 hdev->pkt_type  |= (HCI_HV2);
 477                 hdev->esco_type |= (ESCO_HV2);
 478         }
 479
 480         if (hdev->features[1] & LMP_HV3) {
 481                 hdev->pkt_type  |= (HCI_HV3);
 482                 hdev->esco_type |= (ESCO_HV3);
 483         }
 484
 485         if (hdev->features[3] & LMP_ESCO)
 486                 hdev->esco_type |= (ESCO_EV3);
 487
 488         if (hdev->features[4] & LMP_EV4)
 489                 hdev->esco_type |= (ESCO_EV4);
 490
 491         if (hdev->features[4] & LMP_EV5)
 492                 hdev->esco_type |= (ESCO_EV5);
 493
 494         if (hdev->features[5] & LMP_EDR_ESCO_2M)
 495                 hdev->esco_type |= (ESCO_2EV3);
 496
 497         if (hdev->features[5] & LMP_EDR_ESCO_3M)
 498                 hdev->esco_type |= (ESCO_3EV3);
 499
 500         if (hdev->features[5] & LMP_EDR_3S_ESCO)
 501                 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
 502
 503         BT_DBG("%s features 0x%.2x%.2x%.2x%.2x%.2x%.2x%.2x%.2x", hdev->name,
 504                                         hdev->features[0], hdev->features[1],
 505                                         hdev->features[2], hdev->features[3],
 506                                         hdev->features[4], hdev->features[5],
 507                                         hdev->features[6], hdev->features[7]);
 508 }
 509
 510 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 511 {
 512         struct hci_rp_read_buffer_size *rp = (void *) skb->data;
 513
 514         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 515
 516         if (rp->status)
 517                 return;
 518
 519         hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
 520         hdev->sco_mtu  = rp->sco_mtu;
 521         hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
 522         hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
 523
 524         if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
 525                 hdev->sco_mtu  = 64;
 526                 hdev->sco_pkts = 8;
 527         }
 528
 529         hdev->acl_cnt = hdev->acl_pkts;
 530         hdev->sco_cnt = hdev->sco_pkts;
 531
 532         BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name,
 533                                         hdev->acl_mtu, hdev->acl_pkts,
 534                                         hdev->sco_mtu, hdev->sco_pkts);
 535 }
 536
 537 static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
 538 {
 539         struct hci_rp_read_bd_addr *rp = (void *) skb->data;
 540
 541         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 542
 543         if (!rp->status)
 544                 bacpy(&hdev->bdaddr, &rp->bdaddr);
 545
 546         hci_req_complete(hdev, rp->status);
 547 }
 548
 549 static inline void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
 550 {
 551         BT_DBG("%s status 0x%x", hdev->name, status);
 552
 553         if (status) {
 554                 hci_req_complete(hdev, status);
 555
 556                 hci_conn_check_pending(hdev);
 557         } else
 558                 set_bit(HCI_INQUIRY, &hdev->flags);
 559 }
 560
 561 static inline void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
 562 {
 563         struct hci_cp_create_conn *cp;
 564         struct hci_conn *conn;
 565
 566         BT_DBG("%s status 0x%x", hdev->name, status);
 567
 568         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
 569         if (!cp)
 570                 return;
 571
 572         hci_dev_lock(hdev);
 573
 574         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 575
 576         BT_DBG("%s bdaddr %s conn %p", hdev->name, batostr(&cp->bdaddr), conn);
 577
 578         if (status) {
 579                 if (conn && conn->state == BT_CONNECT) {
 580                         if (status != 0x0c || conn->attempt > 2) {
 581                                 conn->state = BT_CLOSED;
 582                                 hci_proto_connect_cfm(conn, status);
 583                                 hci_conn_del(conn);
 584                         } else
 585                                 conn->state = BT_CONNECT2;
 586                 }
 587         } else {
 588                 if (!conn) {
 589                         conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr);
 590                         if (conn) {
 591                                 conn->out = 1;
 592                                 conn->link_mode |= HCI_LM_MASTER;
 593                         } else
 594                                 BT_ERR("No memory for new connection");
 595                 }
 596         }
 597
 598         hci_dev_unlock(hdev);
 599 }
 600
 601 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
 602 {
 603         struct hci_cp_add_sco *cp;
 604         struct hci_conn *acl, *sco;
 605         __u16 handle;
 606
 607         BT_DBG("%s status 0x%x", hdev->name, status);
 608
 609         if (!status)
 610                 return;
 611
 612         cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
 613         if (!cp)
 614                 return;
 615
 616         handle = __le16_to_cpu(cp->handle);
 617
 618         BT_DBG("%s handle %d", hdev->name, handle);
 619
 620         hci_dev_lock(hdev);
 621
 622         acl = hci_conn_hash_lookup_handle(hdev, handle);
 623         if (acl && (sco = acl->link)) {
 624                 sco->state = BT_CLOSED;
 625
 626                 hci_proto_connect_cfm(sco, status);
 627                 hci_conn_del(sco);
 628         }
 629
 630         hci_dev_unlock(hdev);
 631 }
 632
 633 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
 634 {
 635         struct hci_cp_auth_requested *cp;
 636         struct hci_conn *conn;
 637
 638         BT_DBG("%s status 0x%x", hdev->name, status);
 639
 640         if (!status)
 641                 return;
 642
 643         cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
 644         if (!cp)
 645                 return;
 646
 647         hci_dev_lock(hdev);
 648
 649         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
 650         if (conn) {
 651                 if (conn->state == BT_CONFIG) {
 652                         hci_proto_connect_cfm(conn, status);
 653                         hci_conn_put(conn);
 654                 }
 655         }
 656
 657         hci_dev_unlock(hdev);
 658 }
 659
 660 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
 661 {
 662         struct hci_cp_set_conn_encrypt *cp;
 663         struct hci_conn *conn;
 664
 665         BT_DBG("%s status 0x%x", hdev->name, status);
 666
 667         if (!status)
 668                 return;
 669
 670         cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
 671         if (!cp)
 672                 return;
 673
 674         hci_dev_lock(hdev);
 675
 676         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
 677         if (conn) {
 678                 if (conn->state == BT_CONFIG) {
 679                         hci_proto_connect_cfm(conn, status);
 680                         hci_conn_put(conn);
 681                 }
 682         }
 683
 684         hci_dev_unlock(hdev);
 685 }
 686
 687 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
 688 {
 689         BT_DBG("%s status 0x%x", hdev->name, status);
 690 }
 691
 692 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
 693 {
 694         struct hci_cp_read_remote_features *cp;
 695         struct hci_conn *conn;
 696
 697         BT_DBG("%s status 0x%x", hdev->name, status);
 698
 699         if (!status)
 700                 return;
 701
 702         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
 703         if (!cp)
 704                 return;
 705
 706         hci_dev_lock(hdev);
 707
 708         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
 709         if (conn) {
 710                 if (conn->state == BT_CONFIG) {
 711                         hci_proto_connect_cfm(conn, status);
 712                         hci_conn_put(conn);
 713                 }
 714         }
 715
 716         hci_dev_unlock(hdev);
 717 }
 718
 719 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
 720 {
 721         struct hci_cp_read_remote_ext_features *cp;
 722         struct hci_conn *conn;
 723
 724         BT_DBG("%s status 0x%x", hdev->name, status);
 725
 726         if (!status)
 727                 return;
 728
 729         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
 730         if (!cp)
 731                 return;
 732
 733         hci_dev_lock(hdev);
 734
 735         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
 736         if (conn) {
 737                 if (conn->state == BT_CONFIG) {
 738                         hci_proto_connect_cfm(conn, status);
 739                         hci_conn_put(conn);
 740                 }
 741         }
 742
 743         hci_dev_unlock(hdev);
 744 }
 745
 746 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
 747 {
 748         struct hci_cp_setup_sync_conn *cp;
 749         struct hci_conn *acl, *sco;
 750         __u16 handle;
 751
 752         BT_DBG("%s status 0x%x", hdev->name, status);
 753
 754         if (!status)
 755                 return;
 756
 757         cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
 758         if (!cp)
 759                 return;
 760
 761         handle = __le16_to_cpu(cp->handle);
 762
 763         BT_DBG("%s handle %d", hdev->name, handle);
 764
 765         hci_dev_lock(hdev);
 766
 767         acl = hci_conn_hash_lookup_handle(hdev, handle);
 768         if (acl && (sco = acl->link)) {
 769                 sco->state = BT_CLOSED;
 770
 771                 hci_proto_connect_cfm(sco, status);
 772                 hci_conn_del(sco);
 773         }
 774
 775         hci_dev_unlock(hdev);
 776 }
 777
 778 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
 779 {
 780         struct hci_cp_sniff_mode *cp;
 781         struct hci_conn *conn;
 782
 783         BT_DBG("%s status 0x%x", hdev->name, status);
 784
 785         if (!status)
 786                 return;
 787
 788         cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
 789         if (!cp)
 790                 return;
 791
 792         hci_dev_lock(hdev);
 793
 794         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
 795         if (conn) {
 796                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend);
 797
 798                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->pend))
 799                         hci_sco_setup(conn, status);
 800         }
 801
 802         hci_dev_unlock(hdev);
 803 }
 804
 805 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
 806 {
 807         struct hci_cp_exit_sniff_mode *cp;
 808         struct hci_conn *conn;
 809
 810         BT_DBG("%s status 0x%x", hdev->name, status);
 811
 812         if (!status)
 813                 return;
 814
 815         cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
 816         if (!cp)
 817                 return;
 818
 819         hci_dev_lock(hdev);
 820
 821         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
 822         if (conn) {
 823                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend);
 824
 825                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->pend))
 826                         hci_sco_setup(conn, status);
 827         }
 828
 829         hci_dev_unlock(hdev);
 830 }
 831
 832 static inline void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 833 {
 834         __u8 status = *((__u8 *) skb->data);
 835
 836         BT_DBG("%s status %d", hdev->name, status);
 837
 838         clear_bit(HCI_INQUIRY, &hdev->flags);
 839
 840         hci_req_complete(hdev, status);
 841
 842         hci_conn_check_pending(hdev);
 843 }
 844
 845 static inline void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
 846 {
 847         struct inquiry_data data;
 848         struct inquiry_info *info = (void *) (skb->data + 1);
 849         int num_rsp = *((__u8 *) skb->data);
 850
 851         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
 852
 853         if (!num_rsp)
 854                 return;
 855
 856         hci_dev_lock(hdev);
 857
 858         for (; num_rsp; num_rsp--) {
 859                 bacpy(&data.bdaddr, &info->bdaddr);
 860                 data.pscan_rep_mode     = info->pscan_rep_mode;
 861                 data.pscan_period_mode  = info->pscan_period_mode;
 862                 data.pscan_mode         = info->pscan_mode;
 863                 memcpy(data.dev_class, info->dev_class, 3);
 864                 data.clock_offset       = info->clock_offset;
 865                 data.rssi               = 0x00;
 866                 data.ssp_mode           = 0x00;
 867                 info++;
 868                 hci_inquiry_cache_update(hdev, &data);
 869         }
 870
 871         hci_dev_unlock(hdev);
 872 }
 873
 874 static inline void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 875 {
 876         struct hci_ev_conn_complete *ev = (void *) skb->data;
 877         struct hci_conn *conn;
 878
 879         BT_DBG("%s", hdev->name);
 880
 881         hci_dev_lock(hdev);
 882
 883         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
 884         if (!conn) {
 885                 if (ev->link_type != SCO_LINK)
 886                         goto unlock;
 887
 888                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
 889                 if (!conn)
 890                         goto unlock;
 891
 892                 conn->type = SCO_LINK;
 893         }
 894
 895         if (!ev->status) {
 896                 conn->handle = __le16_to_cpu(ev->handle);
 897
 898                 if (conn->type == ACL_LINK) {
 899                         conn->state = BT_CONFIG;
 900                         hci_conn_hold(conn);
 901                         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
 902                 } else
 903                         conn->state = BT_CONNECTED;
 904
 905                 hci_conn_hold_device(conn);
 906                 hci_conn_add_sysfs(conn);
 907
 908                 if (test_bit(HCI_AUTH, &hdev->flags))
 909                         conn->link_mode |= HCI_LM_AUTH;
 910
 911                 if (test_bit(HCI_ENCRYPT, &hdev->flags))
 912                         conn->link_mode |= HCI_LM_ENCRYPT;
 913
 914                 /* Get remote features */
 915                 if (conn->type == ACL_LINK) {
 916                         struct hci_cp_read_remote_features cp;
 917                         cp.handle = ev->handle;
 918                         hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
 919                                                         sizeof(cp), &cp);
 920                 }
 921
 922                 /* Set packet type for incoming connection */
 923                 if (!conn->out && hdev->hci_ver < 3) {
 924                         struct hci_cp_change_conn_ptype cp;
 925                         cp.handle = ev->handle;
 926                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 927                         hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE,
 928                                                         sizeof(cp), &cp);
 929                 }
 930         } else
 931                 conn->state = BT_CLOSED;
 932
 933         if (conn->type == ACL_LINK)
 934                 hci_sco_setup(conn, ev->status);
 935
 936         if (ev->status) {
 937                 hci_proto_connect_cfm(conn, ev->status);
 938                 hci_conn_del(conn);
 939         } else if (ev->link_type != ACL_LINK)
 940                 hci_proto_connect_cfm(conn, ev->status);
 941
 942 unlock:
 943         hci_dev_unlock(hdev);
 944
 945         hci_conn_check_pending(hdev);
 946 }
 947
 948 #ifdef HCI_AUTO_NAME_RESOLVE
 949 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
 950                                                         struct hci_conn *conn)
 951 {
 952         if (conn->state != BT_CONFIG || !conn->out)
 953                 return 0;
 954
 955         if (conn->sec_level == BT_SECURITY_SDP)
 956                 return 0;
 957
 958         /* Only request authentication for SSP connections */
 959         if (!(hdev->ssp_mode > 0 && conn->ssp_mode > 0))
 960                 return 0;
 961
 962         return 1;
 963 }
 964 #endif
 965
 966 static inline void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
 967 {
 968         struct hci_ev_conn_request *ev = (void *) skb->data;
 969         int mask = hdev->link_mode;
 970
 971         BT_DBG("%s bdaddr %s type 0x%x", hdev->name,
 972                                         batostr(&ev->bdaddr), ev->link_type);
 973
 974         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type);
 975
 976         if ((mask & HCI_LM_ACCEPT) && !hci_blacklist_lookup(hdev, &ev->bdaddr)) {
 977                 /* Connection accepted */
 978                 struct inquiry_entry *ie;
 979                 struct hci_conn *conn;
 980
 981                 hci_dev_lock(hdev);
 982
 983                 if ((ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr)))
 984                         memcpy(ie->data.dev_class, ev->dev_class, 3);
 985
 986                 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
 987                 if (!conn) {
 988                         if (!(conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr))) {
 989                                 BT_ERR("No memory for new connection");
 990                                 hci_dev_unlock(hdev);
 991                                 return;
 992                         }
 993                 }
 994
 995                 memcpy(conn->dev_class, ev->dev_class, 3);
 996                 conn->state = BT_CONNECT;
 997
 998                 hci_dev_unlock(hdev);
 999
1000                 if (ev->link_type == ACL_LINK || !lmp_esco_capable(hdev)) {
1001                         struct hci_cp_accept_conn_req cp;
1002
1003                         bacpy(&cp.bdaddr, &ev->bdaddr);
1004
1005                         if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
1006                                 cp.role = 0x00; /* Become master */
1007                         else
1008                                 cp.role = 0x01; /* Remain slave */
1009
1010                         hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ,
1011                                                         sizeof(cp), &cp);
1012                 } else {
1013                         struct hci_cp_accept_sync_conn_req cp;
1014
1015                         bacpy(&cp.bdaddr, &ev->bdaddr);
1016                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
1017
1018                         cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
1019                         cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
1020                         cp.max_latency    = cpu_to_le16(0xffff);
1021                         cp.content_format = cpu_to_le16(hdev->voice_setting);
1022                         cp.retrans_effort = 0xff;
1023
1024                         hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ,
1025                                                         sizeof(cp), &cp);
1026                 }
1027         } else {
1028                 /* Connection rejected */
1029                 struct hci_cp_reject_conn_req cp;
1030
1031                 bacpy(&cp.bdaddr, &ev->bdaddr);
1032                 cp.reason = 0x0f;
1033                 hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
1034         }
1035 }
1036
1037 static inline void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1038 {
1039         struct hci_ev_disconn_complete *ev = (void *) skb->data;
1040         struct hci_conn *conn;
1041
1042         BT_DBG("%s status %d", hdev->name, ev->status);
1043
1044         if (ev->status)
1045                 return;
1046
1047         hci_dev_lock(hdev);
1048
1049         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1050         if (conn) {
1051                 conn->state = BT_CLOSED;
1052
1053                 hci_proto_disconn_cfm(conn, ev->reason);
1054                 hci_conn_del(conn);
1055         }
1056
1057         hci_dev_unlock(hdev);
1058 }
1059
1060 static inline void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1061 {
1062         struct hci_ev_auth_complete *ev = (void *) skb->data;
1063         struct hci_conn *conn;
1064
1065         BT_DBG("%s status %d", hdev->name, ev->status);
1066
1067         hci_dev_lock(hdev);
1068
1069         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1070         if (conn) {
1071                 if (!ev->status)
1072                         conn->link_mode |= HCI_LM_AUTH;
1073                 else
1074                         conn->sec_level = BT_SECURITY_LOW;
1075
1076                 clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
1077
1078                 if (conn->state == BT_CONFIG) {
1079                         if (!ev->status && hdev->ssp_mode > 0 &&
1080                                                         conn->ssp_mode > 0) {
1081                                 struct hci_cp_set_conn_encrypt cp;
1082                                 cp.handle  = ev->handle;
1083                                 cp.encrypt = 0x01;
1084                                 hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT,
1085                                                         sizeof(cp), &cp);
1086                         } else {
1087                                 conn->state = BT_CONNECTED;
1088                                 hci_proto_connect_cfm(conn, ev->status);
1089                                 hci_conn_put(conn);
1090                         }
1091                 } else {
1092                         hci_auth_cfm(conn, ev->status);
1093
1094                         hci_conn_hold(conn);
1095                         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
1096                         hci_conn_put(conn);
1097                 }
1098
1099                 if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend)) {
1100                         if (!ev->status) {
1101                                 struct hci_cp_set_conn_encrypt cp;
1102                                 cp.handle  = ev->handle;
1103                                 cp.encrypt = 0x01;
1104                                 hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT,
1105                                                         sizeof(cp), &cp);
1106                         } else {
1107                                 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
1108                                 hci_encrypt_cfm(conn, ev->status, 0x00);
1109                         }
1110                 }
1111         }
1112
1113         hci_dev_unlock(hdev);
1114 }
1115 #ifdef HCI_AUTO_NAME_RESOLVE
1116 static inline void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
1117 {
1118         struct hci_ev_remote_name *ev = (void *) skb->data;
1119         struct hci_conn *conn;
1120         BT_DBG("%s", hdev->name);
1121
1122         hci_conn_check_pending(hdev);
1123
1124         hci_dev_lock(hdev);
1125
1126         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
1127         if (conn && hci_outgoing_auth_needed(hdev, conn)) {
1128                 struct hci_cp_auth_requested cp;
1129                 cp.handle = __cpu_to_le16(conn->handle);
1130                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
1131         }
1132
1133         hci_dev_unlock(hdev);
1134 }
1135 #else
1136 static inline void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
1137 {
1138         BT_DBG("%s", hdev->name);
1139
1140         hci_conn_check_pending(hdev);
1141 }
1142 #endif
1143
1144 static inline void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
1145 {
1146         struct hci_ev_encrypt_change *ev = (void *) skb->data;
1147         struct hci_conn *conn;
1148
1149         BT_DBG("%s status %d", hdev->name, ev->status);
1150
1151         hci_dev_lock(hdev);
1152
1153         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1154         if (conn) {
1155                 if (!ev->status) {
1156                         if (ev->encrypt) {
1157                                 /* Encryption implies authentication */
1158                                 conn->link_mode |= HCI_LM_AUTH;
1159                                 conn->link_mode |= HCI_LM_ENCRYPT;
1160                         } else
1161                                 conn->link_mode &= ~HCI_LM_ENCRYPT;
1162                 }
1163
1164                 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
1165
1166                 if (conn->state == BT_CONFIG) {
1167                         if (!ev->status)
1168                                 conn->state = BT_CONNECTED;
1169
1170                         hci_proto_connect_cfm(conn, ev->status);
1171                         hci_conn_put(conn);
1172                 } else
1173                         hci_encrypt_cfm(conn, ev->status, ev->encrypt);
1174         }
1175
1176         hci_dev_unlock(hdev);
1177 }
1178
1179 static inline void hci_change_link_key_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1180 {
1181         struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
1182         struct hci_conn *conn;
1183
1184         BT_DBG("%s status %d", hdev->name, ev->status);
1185
1186         hci_dev_lock(hdev);
1187
1188         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1189         if (conn) {
1190                 if (!ev->status)
1191                         conn->link_mode |= HCI_LM_SECURE;
1192
1193                 clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
1194
1195                 hci_key_change_cfm(conn, ev->status);
1196         }
1197
1198         hci_dev_unlock(hdev);
1199 }
1200
1201 #ifdef HCI_AUTO_NAME_RESOLVE
1202 static inline void hci_remote_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
1203 {
1204         struct hci_ev_remote_features *ev = (void *) skb->data;
1205         struct hci_conn *conn;
1206
1207         BT_DBG("%s status %d", hdev->name, ev->status);
1208
1209         hci_dev_lock(hdev);
1210
1211         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1212         if (!conn)
1213                 goto unlock;
1214
1215         if (!ev->status)
1216                 memcpy(conn->features, ev->features, 8);
1217
1218         if (conn->state != BT_CONFIG)
1219                 goto unlock;
1220
1221         if (!ev->status && lmp_ssp_capable(hdev) && lmp_ssp_capable(conn)) {
1222                 struct hci_cp_read_remote_ext_features cp;
1223                 cp.handle = ev->handle;
1224                 cp.page = 0x01;
1225                 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
1226                                                         sizeof(cp), &cp);
1227                 goto unlock;
1228         }
1229
1230         if (!ev->status) {
1231                 struct hci_cp_remote_name_req cp;
1232                 memset(&cp, 0, sizeof(cp));
1233                 bacpy(&cp.bdaddr, &conn->dst);
1234                 cp.pscan_rep_mode = 0x02;
1235                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1236         }
1237
1238         if (!hci_outgoing_auth_needed(hdev, conn)) {
1239                 conn->state = BT_CONNECTED;
1240                 hci_proto_connect_cfm(conn, ev->status);
1241                 hci_conn_put(conn);
1242         }
1243
1244 unlock:
1245         hci_dev_unlock(hdev);
1246 }
1247 #else
1248 static inline void hci_remote_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
1249 {
1250         struct hci_ev_remote_features *ev = (void *) skb->data;
1251         struct hci_conn *conn;
1252
1253         BT_DBG("%s status %d", hdev->name, ev->status);
1254
1255         hci_dev_lock(hdev);
1256
1257         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1258         if (conn) {
1259                 if (!ev->status)
1260                         memcpy(conn->features, ev->features, 8);
1261
1262                 if (conn->state == BT_CONFIG) {
1263                         if (!ev->status && lmp_ssp_capable(hdev) &&
1264                                                 lmp_ssp_capable(conn)) {
1265                                 struct hci_cp_read_remote_ext_features cp;
1266                                 cp.handle = ev->handle;
1267                                 cp.page = 0x01;
1268                                 hci_send_cmd(hdev,
1269                                         HCI_OP_READ_REMOTE_EXT_FEATURES,
1270                                                         sizeof(cp), &cp);
1271                         } else {
1272                                 conn->state = BT_CONNECTED;
1273                                 hci_proto_connect_cfm(conn, ev->status);
1274                                 hci_conn_put(conn);
1275                         }
1276                 }
1277         }
1278
1279         hci_dev_unlock(hdev);
1280 }
1281 #endif
1282
1283 static inline void hci_remote_version_evt(struct hci_dev *hdev, struct sk_buff *skb)
1284 {
1285         BT_DBG("%s", hdev->name);
1286 }
1287
1288 static inline void hci_qos_setup_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1289 {
1290         BT_DBG("%s", hdev->name);
1291 }
1292
1293 static inline void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1294 {
1295         struct hci_ev_cmd_complete *ev = (void *) skb->data;
1296         __u16 opcode;
1297
1298         skb_pull(skb, sizeof(*ev));
1299
1300         opcode = __le16_to_cpu(ev->opcode);
1301
1302         switch (opcode) {
1303         case HCI_OP_INQUIRY_CANCEL:
1304                 hci_cc_inquiry_cancel(hdev, skb);
1305                 break;
1306
1307         case HCI_OP_EXIT_PERIODIC_INQ:
1308                 hci_cc_exit_periodic_inq(hdev, skb);
1309                 break;
1310
1311         case HCI_OP_REMOTE_NAME_REQ_CANCEL:
1312                 hci_cc_remote_name_req_cancel(hdev, skb);
1313                 break;
1314
1315         case HCI_OP_ROLE_DISCOVERY:
1316                 hci_cc_role_discovery(hdev, skb);
1317                 break;
1318
1319         case HCI_OP_READ_LINK_POLICY:
1320                 hci_cc_read_link_policy(hdev, skb);
1321                 break;
1322
1323         case HCI_OP_WRITE_LINK_POLICY:
1324                 hci_cc_write_link_policy(hdev, skb);
1325                 break;
1326
1327         case HCI_OP_READ_DEF_LINK_POLICY:
1328                 hci_cc_read_def_link_policy(hdev, skb);
1329                 break;
1330
1331         case HCI_OP_WRITE_DEF_LINK_POLICY:
1332                 hci_cc_write_def_link_policy(hdev, skb);
1333                 break;
1334
1335         case HCI_OP_RESET:
1336                 hci_cc_reset(hdev, skb);
1337                 break;
1338
1339         case HCI_OP_WRITE_LOCAL_NAME:
1340                 hci_cc_write_local_name(hdev, skb);
1341                 break;
1342
1343         case HCI_OP_READ_LOCAL_NAME:
1344                 hci_cc_read_local_name(hdev, skb);
1345                 break;
1346
1347         case HCI_OP_WRITE_AUTH_ENABLE:
1348                 hci_cc_write_auth_enable(hdev, skb);
1349                 break;
1350
1351         case HCI_OP_WRITE_ENCRYPT_MODE:
1352                 hci_cc_write_encrypt_mode(hdev, skb);
1353                 break;
1354
1355         case HCI_OP_WRITE_SCAN_ENABLE:
1356                 hci_cc_write_scan_enable(hdev, skb);
1357                 break;
1358
1359         case HCI_OP_READ_CLASS_OF_DEV:
1360                 hci_cc_read_class_of_dev(hdev, skb);
1361                 break;
1362
1363         case HCI_OP_WRITE_CLASS_OF_DEV:
1364                 hci_cc_write_class_of_dev(hdev, skb);
1365                 break;
1366
1367         case HCI_OP_READ_VOICE_SETTING:
1368                 hci_cc_read_voice_setting(hdev, skb);
1369                 break;
1370
1371         case HCI_OP_WRITE_VOICE_SETTING:
1372                 hci_cc_write_voice_setting(hdev, skb);
1373                 break;
1374
1375         case HCI_OP_HOST_BUFFER_SIZE:
1376                 hci_cc_host_buffer_size(hdev, skb);
1377                 break;
1378
1379         case HCI_OP_READ_SSP_MODE:
1380                 hci_cc_read_ssp_mode(hdev, skb);
1381                 break;
1382
1383         case HCI_OP_WRITE_SSP_MODE:
1384                 hci_cc_write_ssp_mode(hdev, skb);
1385                 break;
1386
1387         case HCI_OP_READ_LOCAL_VERSION:
1388                 hci_cc_read_local_version(hdev, skb);
1389                 break;
1390
1391         case HCI_OP_READ_LOCAL_COMMANDS:
1392                 hci_cc_read_local_commands(hdev, skb);
1393                 break;
1394
1395         case HCI_OP_READ_LOCAL_FEATURES:
1396                 hci_cc_read_local_features(hdev, skb);
1397                 break;
1398
1399         case HCI_OP_READ_BUFFER_SIZE:
1400                 hci_cc_read_buffer_size(hdev, skb);
1401                 break;
1402
1403         case HCI_OP_READ_BD_ADDR:
1404                 hci_cc_read_bd_addr(hdev, skb);
1405                 break;
1406
1407         default:
1408                 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
1409                 break;
1410         }
1411
1412         if (ev->ncmd) {
1413                 atomic_set(&hdev->cmd_cnt, 1);
1414                 if (!skb_queue_empty(&hdev->cmd_q))
1415                         tasklet_schedule(&hdev->cmd_task);
1416         }
1417 }
1418
1419 static inline void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb)
1420 {
1421         struct hci_ev_cmd_status *ev = (void *) skb->data;
1422         __u16 opcode;
1423
1424         skb_pull(skb, sizeof(*ev));
1425
1426         opcode = __le16_to_cpu(ev->opcode);
1427
1428         switch (opcode) {
1429         case HCI_OP_INQUIRY:
1430                 hci_cs_inquiry(hdev, ev->status);
1431                 break;
1432
1433         case HCI_OP_CREATE_CONN:
1434                 hci_cs_create_conn(hdev, ev->status);
1435                 break;
1436
1437         case HCI_OP_ADD_SCO:
1438                 hci_cs_add_sco(hdev, ev->status);
1439                 break;
1440
1441         case HCI_OP_AUTH_REQUESTED:
1442                 hci_cs_auth_requested(hdev, ev->status);
1443                 break;
1444
1445         case HCI_OP_SET_CONN_ENCRYPT:
1446                 hci_cs_set_conn_encrypt(hdev, ev->status);
1447                 break;
1448
1449         case HCI_OP_REMOTE_NAME_REQ:
1450                 hci_cs_remote_name_req(hdev, ev->status);
1451                 break;
1452
1453         case HCI_OP_READ_REMOTE_FEATURES:
1454                 hci_cs_read_remote_features(hdev, ev->status);
1455                 break;
1456
1457         case HCI_OP_READ_REMOTE_EXT_FEATURES:
1458                 hci_cs_read_remote_ext_features(hdev, ev->status);
1459                 break;
1460
1461         case HCI_OP_SETUP_SYNC_CONN:
1462                 hci_cs_setup_sync_conn(hdev, ev->status);
1463                 break;
1464
1465         case HCI_OP_SNIFF_MODE:
1466                 hci_cs_sniff_mode(hdev, ev->status);
1467                 break;
1468
1469         case HCI_OP_EXIT_SNIFF_MODE:
1470                 hci_cs_exit_sniff_mode(hdev, ev->status);
1471                 break;
1472
1473         default:
1474                 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
1475                 break;
1476         }
1477
1478         if (ev->ncmd) {
1479                 atomic_set(&hdev->cmd_cnt, 1);
1480                 if (!skb_queue_empty(&hdev->cmd_q))
1481                         tasklet_schedule(&hdev->cmd_task);
1482         }
1483 }
1484
1485 static inline void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
1486 {
1487         struct hci_ev_role_change *ev = (void *) skb->data;
1488         struct hci_conn *conn;
1489
1490         BT_DBG("%s status %d", hdev->name, ev->status);
1491
1492         hci_dev_lock(hdev);
1493
1494         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
1495         if (conn) {
1496                 if (!ev->status) {
1497                         if (ev->role)
1498                                 conn->link_mode &= ~HCI_LM_MASTER;
1499                         else
1500                                 conn->link_mode |= HCI_LM_MASTER;
1501                 }
1502
1503                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->pend);
1504
1505                 hci_role_switch_cfm(conn, ev->status, ev->role);
1506         }
1507
1508         hci_dev_unlock(hdev);
1509 }
1510
1511 static inline void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
1512 {
1513         struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
1514         __le16 *ptr;
1515         int i;
1516
1517         skb_pull(skb, sizeof(*ev));
1518
1519         BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
1520
1521         if (skb->len < ev->num_hndl * 4) {
1522                 BT_DBG("%s bad parameters", hdev->name);
1523                 return;
1524         }
1525
1526         tasklet_disable(&hdev->tx_task);
1527
1528         for (i = 0, ptr = (__le16 *) skb->data; i < ev->num_hndl; i++) {
1529                 struct hci_conn *conn;
1530                 __u16  handle, count;
1531
1532                 handle = get_unaligned_le16(ptr++);
1533                 count  = get_unaligned_le16(ptr++);
1534
1535                 conn = hci_conn_hash_lookup_handle(hdev, handle);
1536                 if (conn) {
1537                         conn->sent -= count;
1538
1539                         if (conn->type == ACL_LINK) {
1540                                 if ((hdev->acl_cnt += count) > hdev->acl_pkts)
1541                                         hdev->acl_cnt = hdev->acl_pkts;
1542                         } else {
1543                                 if ((hdev->sco_cnt += count) > hdev->sco_pkts)
1544                                         hdev->sco_cnt = hdev->sco_pkts;
1545                         }
1546                 }
1547         }
1548
1549         tasklet_schedule(&hdev->tx_task);
1550
1551         tasklet_enable(&hdev->tx_task);
1552 }
1553
1554 static inline void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
1555 {
1556         struct hci_ev_mode_change *ev = (void *) skb->data;
1557         struct hci_conn *conn;
1558
1559         BT_DBG("%s status %d", hdev->name, ev->status);
1560
1561         hci_dev_lock(hdev);
1562
1563         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1564         if (conn) {
1565                 conn->mode = ev->mode;
1566                 conn->interval = __le16_to_cpu(ev->interval);
1567
1568                 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
1569                         if (conn->mode == HCI_CM_ACTIVE)
1570                                 conn->power_save = 1;
1571                         else
1572                                 conn->power_save = 0;
1573                 }
1574
1575                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->pend))
1576                         hci_sco_setup(conn, ev->status);
1577         }
1578
1579         hci_dev_unlock(hdev);
1580 }
1581
1582 static inline void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
1583 {
1584         struct hci_ev_pin_code_req *ev = (void *) skb->data;
1585         struct hci_conn *conn;
1586
1587         BT_DBG("%s", hdev->name);
1588
1589         hci_dev_lock(hdev);
1590
1591         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
1592         if (conn && conn->state == BT_CONNECTED) {
1593                 hci_conn_hold(conn);
1594                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
1595                 hci_conn_put(conn);
1596         }
1597
1598         hci_dev_unlock(hdev);
1599 }
1600
1601 static inline void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
1602 {
1603         BT_DBG("%s", hdev->name);
1604 }
1605
1606 static inline void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
1607 {
1608         struct hci_ev_link_key_notify *ev = (void *) skb->data;
1609         struct hci_conn *conn;
1610
1611         BT_DBG("%s", hdev->name);
1612
1613         hci_dev_lock(hdev);
1614
1615         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
1616         if (conn) {
1617                 hci_conn_hold(conn);
1618                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
1619                 hci_conn_put(conn);
1620         }
1621
1622         hci_dev_unlock(hdev);
1623 }
1624
1625 static inline void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
1626 {
1627         struct hci_ev_clock_offset *ev = (void *) skb->data;
1628         struct hci_conn *conn;
1629
1630         BT_DBG("%s status %d", hdev->name, ev->status);
1631
1632         hci_dev_lock(hdev);
1633
1634         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1635         if (conn && !ev->status) {
1636                 struct inquiry_entry *ie;
1637
1638                 if ((ie = hci_inquiry_cache_lookup(hdev, &conn->dst))) {
1639                         ie->data.clock_offset = ev->clock_offset;
1640                         ie->timestamp = jiffies;
1641                 }
1642         }
1643
1644         hci_dev_unlock(hdev);
1645 }
1646
1647 static inline void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
1648 {
1649         struct hci_ev_pkt_type_change *ev = (void *) skb->data;
1650         struct hci_conn *conn;
1651
1652         BT_DBG("%s status %d", hdev->name, ev->status);
1653
1654         hci_dev_lock(hdev);
1655
1656         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1657         if (conn && !ev->status)
1658                 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
1659
1660         hci_dev_unlock(hdev);
1661 }
1662
1663 static inline void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
1664 {
1665         struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
1666         struct inquiry_entry *ie;
1667
1668         BT_DBG("%s", hdev->name);
1669
1670         hci_dev_lock(hdev);
1671
1672         if ((ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr))) {
1673                 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
1674                 ie->timestamp = jiffies;
1675         }
1676
1677         hci_dev_unlock(hdev);
1678 }
1679
1680 static inline void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, struct sk_buff *skb)
1681 {
1682         struct inquiry_data data;
1683         int num_rsp = *((__u8 *) skb->data);
1684
1685         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
1686
1687         if (!num_rsp)
1688                 return;
1689
1690         hci_dev_lock(hdev);
1691
1692         if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
1693                 struct inquiry_info_with_rssi_and_pscan_mode *info = (void *) (skb->data + 1);
1694
1695                 for (; num_rsp; num_rsp--) {
1696                         bacpy(&data.bdaddr, &info->bdaddr);
1697                         data.pscan_rep_mode     = info->pscan_rep_mode;
1698                         data.pscan_period_mode  = info->pscan_period_mode;
1699                         data.pscan_mode         = info->pscan_mode;
1700                         memcpy(data.dev_class, info->dev_class, 3);
1701                         data.clock_offset       = info->clock_offset;
1702                         data.rssi               = info->rssi;
1703                         data.ssp_mode           = 0x00;
1704                         info++;
1705                         hci_inquiry_cache_update(hdev, &data);
1706                 }
1707         } else {
1708                 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
1709
1710                 for (; num_rsp; num_rsp--) {
1711                         bacpy(&data.bdaddr, &info->bdaddr);
1712                         data.pscan_rep_mode     = info->pscan_rep_mode;
1713                         data.pscan_period_mode  = info->pscan_period_mode;
1714                         data.pscan_mode         = 0x00;
1715                         memcpy(data.dev_class, info->dev_class, 3);
1716                         data.clock_offset       = info->clock_offset;
1717                         data.rssi               = info->rssi;
1718                         data.ssp_mode           = 0x00;
1719                         info++;
1720                         hci_inquiry_cache_update(hdev, &data);
1721                 }
1722         }
1723
1724         hci_dev_unlock(hdev);
1725 }
1726
1727 #ifdef HCI_AUTO_NAME_RESOLVE
1728 static inline void hci_remote_ext_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
1729 {
1730         struct hci_ev_remote_ext_features *ev = (void *) skb->data;
1731         struct hci_conn *conn;
1732
1733         BT_DBG("%s", hdev->name);
1734
1735         hci_dev_lock(hdev);
1736
1737         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1738         if (conn) {
1739                 if (!ev->status && ev->page == 0x01) {
1740                         struct inquiry_entry *ie;
1741
1742                         if ((ie = hci_inquiry_cache_lookup(hdev, &conn->dst)))
1743                                 ie->data.ssp_mode = (ev->features[0] & 0x01);
1744
1745                         conn->ssp_mode = (ev->features[0] & 0x01);
1746                 }
1747
1748                 if (conn->state != BT_CONFIG)
1749                         goto unlock;
1750
1751                 if (!ev->status) {
1752                         struct hci_cp_remote_name_req cp;
1753                         memset(&cp, 0, sizeof(cp));
1754                         bacpy(&cp.bdaddr, &conn->dst);
1755                         cp.pscan_rep_mode = 0x02;
1756                         hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1757                 }
1758
1759                 if (!hci_outgoing_auth_needed(hdev, conn)) {
1760                         conn->state = BT_CONNECTED;
1761                         hci_proto_connect_cfm(conn, ev->status);
1762                         hci_conn_put(conn);
1763                 }
1764         }
1765
1766 unlock:
1767         hci_dev_unlock(hdev);
1768 }
1769 #else
1770 static inline void hci_remote_ext_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
1771 {
1772         struct hci_ev_remote_ext_features *ev = (void *) skb->data;
1773         struct hci_conn *conn;
1774
1775         BT_DBG("%s", hdev->name);
1776
1777         hci_dev_lock(hdev);
1778
1779         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1780         if (conn) {
1781                 if (!ev->status && ev->page == 0x01) {
1782                         struct inquiry_entry *ie;
1783
1784                         if ((ie = hci_inquiry_cache_lookup(hdev, &conn->dst)))
1785                                 ie->data.ssp_mode = (ev->features[0] & 0x01);
1786
1787                         conn->ssp_mode = (ev->features[0] & 0x01);
1788                 }
1789
1790                 if (conn->state == BT_CONFIG) {
1791                         if (!ev->status && hdev->ssp_mode > 0 &&
1792                                         conn->ssp_mode > 0 && conn->out &&
1793                                         conn->sec_level != BT_SECURITY_SDP) {
1794                                 struct hci_cp_auth_requested cp;
1795                                 cp.handle = ev->handle;
1796                                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
1797                                                         sizeof(cp), &cp);
1798                         } else {
1799                                 conn->state = BT_CONNECTED;
1800                                 hci_proto_connect_cfm(conn, ev->status);
1801                                 hci_conn_put(conn);
1802                         }
1803                 }
1804         }
1805
1806         hci_dev_unlock(hdev);
1807 }
1808 #endif
1809
1810 static inline void hci_sync_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1811 {
1812         struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
1813         struct hci_conn *conn;
1814
1815         BT_DBG("%s status %d", hdev->name, ev->status);
1816
1817         hci_dev_lock(hdev);
1818
1819         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
1820         if (!conn) {
1821                 if (ev->link_type == ESCO_LINK)
1822                         goto unlock;
1823
1824                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
1825                 if (!conn)
1826                         goto unlock;
1827
1828                 conn->type = SCO_LINK;
1829         }
1830
1831         switch (ev->status) {
1832         case 0x00:
1833                 conn->handle = __le16_to_cpu(ev->handle);
1834                 conn->state  = BT_CONNECTED;
1835
1836                 hci_conn_hold_device(conn);
1837                 hci_conn_add_sysfs(conn);
1838                 break;
1839
1840         case 0x11:      /* Unsupported Feature or Parameter Value */
1841         case 0x1c:      /* SCO interval rejected */
1842         case 0x1a:      /* Unsupported Remote Feature */
1843         case 0x1f:      /* Unspecified error */
1844                 if (conn->out && conn->attempt < 2) {
1845                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
1846                                         (hdev->esco_type & EDR_ESCO_MASK);
1847                         hci_setup_sync(conn, conn->link->handle);
1848                         goto unlock;
1849                 }
1850                 /* fall through */
1851
1852         default:
1853                 conn->state = BT_CLOSED;
1854                 break;
1855         }
1856
1857         hci_proto_connect_cfm(conn, ev->status);
1858         if (ev->status)
1859                 hci_conn_del(conn);
1860
1861 unlock:
1862         hci_dev_unlock(hdev);
1863 }
1864
1865 static inline void hci_sync_conn_changed_evt(struct hci_dev *hdev, struct sk_buff *skb)
1866 {
1867         BT_DBG("%s", hdev->name);
1868 }
1869
1870 static inline void hci_sniff_subrate_evt(struct hci_dev *hdev, struct sk_buff *skb)
1871 {
1872         struct hci_ev_sniff_subrate *ev = (void *) skb->data;
1873         struct hci_conn *conn;
1874
1875         BT_DBG("%s status %d", hdev->name, ev->status);
1876
1877         hci_dev_lock(hdev);
1878
1879         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1880         if (conn) {
1881         }
1882
1883         hci_dev_unlock(hdev);
1884 }
1885
1886 static inline void hci_extended_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
1887 {
1888         struct inquiry_data data;
1889         struct extended_inquiry_info *info = (void *) (skb->data + 1);
1890         int num_rsp = *((__u8 *) skb->data);
1891
1892         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
1893
1894         if (!num_rsp)
1895                 return;
1896
1897         hci_dev_lock(hdev);
1898
1899         for (; num_rsp; num_rsp--) {
1900                 bacpy(&data.bdaddr, &info->bdaddr);
1901                 data.pscan_rep_mode     = info->pscan_rep_mode;
1902                 data.pscan_period_mode  = info->pscan_period_mode;
1903                 data.pscan_mode         = 0x00;
1904                 memcpy(data.dev_class, info->dev_class, 3);
1905                 data.clock_offset       = info->clock_offset;
1906                 data.rssi               = info->rssi;
1907                 data.ssp_mode           = 0x01;
1908                 info++;
1909                 hci_inquiry_cache_update(hdev, &data);
1910         }
1911
1912         hci_dev_unlock(hdev);
1913 }
1914
1915 static inline void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
1916 {
1917         struct hci_ev_io_capa_request *ev = (void *) skb->data;
1918         struct hci_conn *conn;
1919
1920         BT_DBG("%s", hdev->name);
1921
1922         hci_dev_lock(hdev);
1923
1924         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
1925         if (conn)
1926                 hci_conn_hold(conn);
1927
1928         hci_dev_unlock(hdev);
1929 }
1930
1931 static inline void hci_simple_pair_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1932 {
1933         struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
1934         struct hci_conn *conn;
1935
1936         BT_DBG("%s", hdev->name);
1937
1938         hci_dev_lock(hdev);
1939
1940         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
1941         if (conn)
1942                 hci_conn_put(conn);
1943
1944         hci_dev_unlock(hdev);
1945 }
1946
1947 static inline void hci_remote_host_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
1948 {
1949         struct hci_ev_remote_host_features *ev = (void *) skb->data;
1950         struct inquiry_entry *ie;
1951
1952         BT_DBG("%s", hdev->name);
1953
1954         hci_dev_lock(hdev);
1955
1956         if ((ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr)))
1957                 ie->data.ssp_mode = (ev->features[0] & 0x01);
1958
1959         hci_dev_unlock(hdev);
1960 }
1961
1962 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
1963 {
1964         struct hci_event_hdr *hdr = (void *) skb->data;
1965         __u8 event = hdr->evt;
1966
1967         skb_pull(skb, HCI_EVENT_HDR_SIZE);
1968
1969         switch (event) {
1970         case HCI_EV_INQUIRY_COMPLETE:
1971                 hci_inquiry_complete_evt(hdev, skb);
1972                 break;
1973
1974         case HCI_EV_INQUIRY_RESULT:
1975                 hci_inquiry_result_evt(hdev, skb);
1976                 break;
1977
1978         case HCI_EV_CONN_COMPLETE:
1979                 hci_conn_complete_evt(hdev, skb);
1980                 break;
1981
1982         case HCI_EV_CONN_REQUEST:
1983                 hci_conn_request_evt(hdev, skb);
1984                 break;
1985
1986         case HCI_EV_DISCONN_COMPLETE:
1987                 hci_disconn_complete_evt(hdev, skb);
1988                 break;
1989
1990         case HCI_EV_AUTH_COMPLETE:
1991                 hci_auth_complete_evt(hdev, skb);
1992                 break;
1993
1994         case HCI_EV_REMOTE_NAME:
1995                 hci_remote_name_evt(hdev, skb);
1996                 break;
1997
1998         case HCI_EV_ENCRYPT_CHANGE:
1999                 hci_encrypt_change_evt(hdev, skb);
2000                 break;
2001
2002         case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
2003                 hci_change_link_key_complete_evt(hdev, skb);
2004                 break;
2005
2006         case HCI_EV_REMOTE_FEATURES:
2007                 hci_remote_features_evt(hdev, skb);
2008                 break;
2009
2010         case HCI_EV_REMOTE_VERSION:
2011                 hci_remote_version_evt(hdev, skb);
2012                 break;
2013
2014         case HCI_EV_QOS_SETUP_COMPLETE:
2015                 hci_qos_setup_complete_evt(hdev, skb);
2016                 break;
2017
2018         case HCI_EV_CMD_COMPLETE:
2019                 hci_cmd_complete_evt(hdev, skb);
2020                 break;
2021
2022         case HCI_EV_CMD_STATUS:
2023                 hci_cmd_status_evt(hdev, skb);
2024                 break;
2025
2026         case HCI_EV_ROLE_CHANGE:
2027                 hci_role_change_evt(hdev, skb);
2028                 break;
2029
2030         case HCI_EV_NUM_COMP_PKTS:
2031                 hci_num_comp_pkts_evt(hdev, skb);
2032                 break;
2033
2034         case HCI_EV_MODE_CHANGE:
2035                 hci_mode_change_evt(hdev, skb);
2036                 break;
2037
2038         case HCI_EV_PIN_CODE_REQ:
2039                 hci_pin_code_request_evt(hdev, skb);
2040                 break;
2041
2042         case HCI_EV_LINK_KEY_REQ:
2043                 hci_link_key_request_evt(hdev, skb);
2044                 break;
2045
2046         case HCI_EV_LINK_KEY_NOTIFY:
2047                 hci_link_key_notify_evt(hdev, skb);
2048                 break;
2049
2050         case HCI_EV_CLOCK_OFFSET:
2051                 hci_clock_offset_evt(hdev, skb);
2052                 break;
2053
2054         case HCI_EV_PKT_TYPE_CHANGE:
2055                 hci_pkt_type_change_evt(hdev, skb);
2056                 break;
2057
2058         case HCI_EV_PSCAN_REP_MODE:
2059                 hci_pscan_rep_mode_evt(hdev, skb);
2060                 break;
2061
2062         case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
2063                 hci_inquiry_result_with_rssi_evt(hdev, skb);
2064                 break;
2065
2066         case HCI_EV_REMOTE_EXT_FEATURES:
2067                 hci_remote_ext_features_evt(hdev, skb);
2068                 break;
2069
2070         case HCI_EV_SYNC_CONN_COMPLETE:
2071                 hci_sync_conn_complete_evt(hdev, skb);
2072                 break;
2073
2074         case HCI_EV_SYNC_CONN_CHANGED:
2075                 hci_sync_conn_changed_evt(hdev, skb);
2076                 break;
2077
2078         case HCI_EV_SNIFF_SUBRATE:
2079                 hci_sniff_subrate_evt(hdev, skb);
2080                 break;
2081
2082         case HCI_EV_EXTENDED_INQUIRY_RESULT:
2083                 hci_extended_inquiry_result_evt(hdev, skb);
2084                 break;
2085
2086         case HCI_EV_IO_CAPA_REQUEST:
2087                 hci_io_capa_request_evt(hdev, skb);
2088                 break;
2089
2090         case HCI_EV_SIMPLE_PAIR_COMPLETE:
2091                 hci_simple_pair_complete_evt(hdev, skb);
2092                 break;
2093
2094         case HCI_EV_REMOTE_HOST_FEATURES:
2095                 hci_remote_host_features_evt(hdev, skb);
2096                 break;
2097
2098         default:
2099                 BT_DBG("%s event 0x%x", hdev->name, event);
2100                 break;
2101         }
2102
2103         kfree_skb(skb);
2104         hdev->stat.evt_rx++;
2105 }
2106
2107 /* Generate internal stack event */
2108 void hci_si_event(struct hci_dev *hdev, int type, int dlen, void *data)
2109 {
2110         struct hci_event_hdr *hdr;
2111         struct hci_ev_stack_internal *ev;
2112         struct sk_buff *skb;
2113
2114         skb = bt_skb_alloc(HCI_EVENT_HDR_SIZE + sizeof(*ev) + dlen, GFP_ATOMIC);
2115         if (!skb)
2116                 return;
2117
2118         hdr = (void *) skb_put(skb, HCI_EVENT_HDR_SIZE);
2119         hdr->evt  = HCI_EV_STACK_INTERNAL;
2120         hdr->plen = sizeof(*ev) + dlen;
2121
2122         ev  = (void *) skb_put(skb, sizeof(*ev) + dlen);
2123         ev->type = type;
2124         memcpy(ev->data, data, dlen);
2125
2126         bt_cb(skb)->incoming = 1;
2127         __net_timestamp(skb);
2128
2129         bt_cb(skb)->pkt_type = HCI_EVENT_PKT;
2130         skb->dev = (void *) hdev;
2131         hci_send_to_sock(hdev, skb);
2132         kfree_skb(skb);
2133 }