net/bluetooth/hci_event.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI event handling. */
  26
  27 #include <linux/module.h>
  28
  29 #include <linux/types.h>
  30 #include <linux/errno.h>
  31 #include <linux/kernel.h>
  32 #include <linux/slab.h>
  33 #include <linux/poll.h>
  34 #include <linux/fcntl.h>
  35 #include <linux/init.h>
  36 #include <linux/skbuff.h>
  37 #include <linux/interrupt.h>
  38 #include <linux/notifier.h>
  39 #include <net/sock.h>
  40
  41 #include <asm/system.h>
  42 #include <linux/uaccess.h>
  43 #include <asm/unaligned.h>
  44
  45 #include <net/bluetooth/bluetooth.h>
  46 #include <net/bluetooth/hci_core.h>
  47
  48 /* Handle HCI Event packets */
  49
  50 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
  51 {
  52         __u8 status = *((__u8 *) skb->data);
  53
  54         BT_DBG("%s status 0x%x", hdev->name, status);
  55
  56         if (status)
  57                 return;
  58
  59         clear_bit(HCI_INQUIRY, &hdev->flags);
  60
  61         hci_req_complete(hdev, HCI_OP_INQUIRY_CANCEL, status);
  62
  63         hci_conn_check_pending(hdev);
  64 }
  65
  66 static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  67 {
  68         __u8 status = *((__u8 *) skb->data);
  69
  70         BT_DBG("%s status 0x%x", hdev->name, status);
  71
  72         if (status)
  73                 return;
  74
  75         clear_bit(HCI_INQUIRY, &hdev->flags);
  76
  77         hci_conn_check_pending(hdev);
  78 }
  79
  80 static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev, struct sk_buff *skb)
  81 {
  82         BT_DBG("%s", hdev->name);
  83 }
  84
  85 static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
  86 {
  87         struct hci_rp_role_discovery *rp = (void *) skb->data;
  88         struct hci_conn *conn;
  89
  90         BT_DBG("%s status 0x%x", hdev->name, rp->status);
  91
  92         if (rp->status)
  93                 return;
  94
  95         hci_dev_lock(hdev);
  96
  97         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
  98         if (conn) {
  99                 if (rp->role)
 100                         conn->link_mode &= ~HCI_LM_MASTER;
 101                 else
 102                         conn->link_mode |= HCI_LM_MASTER;
 103         }
 104
 105         hci_dev_unlock(hdev);
 106 }
 107
 108 static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 109 {
 110         struct hci_rp_read_link_policy *rp = (void *) skb->data;
 111         struct hci_conn *conn;
 112
 113         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 114
 115         if (rp->status)
 116                 return;
 117
 118         hci_dev_lock(hdev);
 119
 120         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 121         if (conn)
 122                 conn->link_policy = __le16_to_cpu(rp->policy);
 123
 124         hci_dev_unlock(hdev);
 125 }
 126
 127 static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 128 {
 129         struct hci_rp_write_link_policy *rp = (void *) skb->data;
 130         struct hci_conn *conn;
 131         void *sent;
 132
 133         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 134
 135         if (rp->status)
 136                 return;
 137
 138         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
 139         if (!sent)
 140                 return;
 141
 142         hci_dev_lock(hdev);
 143
 144         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 145         if (conn)
 146                 conn->link_policy = get_unaligned_le16(sent + 2);
 147
 148         hci_dev_unlock(hdev);
 149 }
 150
 151 static void hci_cc_read_def_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 152 {
 153         struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
 154
 155         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 156
 157         if (rp->status)
 158                 return;
 159
 160         hdev->link_policy = __le16_to_cpu(rp->policy);
 161 }
 162
 163 static void hci_cc_write_def_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 164 {
 165         __u8 status = *((__u8 *) skb->data);
 166         void *sent;
 167
 168         BT_DBG("%s status 0x%x", hdev->name, status);
 169
 170         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
 171         if (!sent)
 172                 return;
 173
 174         if (!status)
 175                 hdev->link_policy = get_unaligned_le16(sent);
 176
 177         hci_req_complete(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, status);
 178 }
 179
 180 static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
 181 {
 182         __u8 status = *((__u8 *) skb->data);
 183
 184         BT_DBG("%s status 0x%x", hdev->name, status);
 185
 186         hci_req_complete(hdev, HCI_OP_RESET, status);
 187 }
 188
 189 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 190 {
 191         __u8 status = *((__u8 *) skb->data);
 192         void *sent;
 193
 194         BT_DBG("%s status 0x%x", hdev->name, status);
 195
 196         if (status)
 197                 return;
 198
 199         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
 200         if (!sent)
 201                 return;
 202
 203         memcpy(hdev->dev_name, sent, 248);
 204 }
 205
 206 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 207 {
 208         struct hci_rp_read_local_name *rp = (void *) skb->data;
 209
 210         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 211
 212         if (rp->status)
 213                 return;
 214
 215         memcpy(hdev->dev_name, rp->name, 248);
 216 }
 217
 218 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
 219 {
 220         __u8 status = *((__u8 *) skb->data);
 221         void *sent;
 222
 223         BT_DBG("%s status 0x%x", hdev->name, status);
 224
 225         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
 226         if (!sent)
 227                 return;
 228
 229         if (!status) {
 230                 __u8 param = *((__u8 *) sent);
 231
 232                 if (param == AUTH_ENABLED)
 233                         set_bit(HCI_AUTH, &hdev->flags);
 234                 else
 235                         clear_bit(HCI_AUTH, &hdev->flags);
 236         }
 237
 238         hci_req_complete(hdev, HCI_OP_WRITE_AUTH_ENABLE, status);
 239 }
 240
 241 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
 242 {
 243         __u8 status = *((__u8 *) skb->data);
 244         void *sent;
 245
 246         BT_DBG("%s status 0x%x", hdev->name, status);
 247
 248         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
 249         if (!sent)
 250                 return;
 251
 252         if (!status) {
 253                 __u8 param = *((__u8 *) sent);
 254
 255                 if (param)
 256                         set_bit(HCI_ENCRYPT, &hdev->flags);
 257                 else
 258                         clear_bit(HCI_ENCRYPT, &hdev->flags);
 259         }
 260
 261         hci_req_complete(hdev, HCI_OP_WRITE_ENCRYPT_MODE, status);
 262 }
 263
 264 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
 265 {
 266         __u8 status = *((__u8 *) skb->data);
 267         void *sent;
 268
 269         BT_DBG("%s status 0x%x", hdev->name, status);
 270
 271         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
 272         if (!sent)
 273                 return;
 274
 275         if (!status) {
 276                 __u8 param = *((__u8 *) sent);
 277                 int old_pscan, old_iscan;
 278
 279                 old_pscan = test_and_clear_bit(HCI_PSCAN, &hdev->flags);
 280                 old_iscan = test_and_clear_bit(HCI_ISCAN, &hdev->flags);
 281
 282                 if (param & SCAN_INQUIRY) {
 283                         set_bit(HCI_ISCAN, &hdev->flags);
 284                         if (!old_iscan)
 285                                 mgmt_discoverable(hdev->id, 1);
 286                 } else if (old_iscan)
 287                         mgmt_discoverable(hdev->id, 0);
 288
 289                 if (param & SCAN_PAGE) {
 290                         set_bit(HCI_PSCAN, &hdev->flags);
 291                         if (!old_pscan)
 292                                 mgmt_connectable(hdev->id, 1);
 293                 } else if (old_pscan)
 294                         mgmt_connectable(hdev->id, 0);
 295         }
 296
 297         hci_req_complete(hdev, HCI_OP_WRITE_SCAN_ENABLE, status);
 298 }
 299
 300 static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 301 {
 302         struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
 303
 304         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 305
 306         if (rp->status)
 307                 return;
 308
 309         memcpy(hdev->dev_class, rp->dev_class, 3);
 310
 311         BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
 312                 hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
 313 }
 314
 315 static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 316 {
 317         __u8 status = *((__u8 *) skb->data);
 318         void *sent;
 319
 320         BT_DBG("%s status 0x%x", hdev->name, status);
 321
 322         if (status)
 323                 return;
 324
 325         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
 326         if (!sent)
 327                 return;
 328
 329         memcpy(hdev->dev_class, sent, 3);
 330 }
 331
 332 static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 333 {
 334         struct hci_rp_read_voice_setting *rp = (void *) skb->data;
 335         __u16 setting;
 336
 337         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 338
 339         if (rp->status)
 340                 return;
 341
 342         setting = __le16_to_cpu(rp->voice_setting);
 343
 344         if (hdev->voice_setting == setting)
 345                 return;
 346
 347         hdev->voice_setting = setting;
 348
 349         BT_DBG("%s voice setting 0x%04x", hdev->name, setting);
 350
 351         if (hdev->notify) {
 352                 tasklet_disable(&hdev->tx_task);
 353                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 354                 tasklet_enable(&hdev->tx_task);
 355         }
 356 }
 357
 358 static void hci_cc_write_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 359 {
 360         __u8 status = *((__u8 *) skb->data);
 361         __u16 setting;
 362         void *sent;
 363
 364         BT_DBG("%s status 0x%x", hdev->name, status);
 365
 366         if (status)
 367                 return;
 368
 369         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
 370         if (!sent)
 371                 return;
 372
 373         setting = get_unaligned_le16(sent);
 374
 375         if (hdev->voice_setting == setting)
 376                 return;
 377
 378         hdev->voice_setting = setting;
 379
 380         BT_DBG("%s voice setting 0x%04x", hdev->name, setting);
 381
 382         if (hdev->notify) {
 383                 tasklet_disable(&hdev->tx_task);
 384                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 385                 tasklet_enable(&hdev->tx_task);
 386         }
 387 }
 388
 389 static void hci_cc_host_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 390 {
 391         __u8 status = *((__u8 *) skb->data);
 392
 393         BT_DBG("%s status 0x%x", hdev->name, status);
 394
 395         hci_req_complete(hdev, HCI_OP_HOST_BUFFER_SIZE, status);
 396 }
 397
 398 static void hci_cc_read_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 399 {
 400         struct hci_rp_read_ssp_mode *rp = (void *) skb->data;
 401
 402         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 403
 404         if (rp->status)
 405                 return;
 406
 407         hdev->ssp_mode = rp->mode;
 408 }
 409
 410 static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 411 {
 412         __u8 status = *((__u8 *) skb->data);
 413         void *sent;
 414
 415         BT_DBG("%s status 0x%x", hdev->name, status);
 416
 417         if (status)
 418                 return;
 419
 420         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
 421         if (!sent)
 422                 return;
 423
 424         hdev->ssp_mode = *((__u8 *) sent);
 425 }
 426
 427 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
 428 {
 429         struct hci_rp_read_local_version *rp = (void *) skb->data;
 430
 431         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 432
 433         if (rp->status)
 434                 return;
 435
 436         hdev->hci_ver = rp->hci_ver;
 437         hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
 438         hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
 439
 440         BT_DBG("%s manufacturer %d hci ver %d:%d", hdev->name,
 441                                         hdev->manufacturer,
 442                                         hdev->hci_ver, hdev->hci_rev);
 443 }
 444
 445 static void hci_cc_read_local_commands(struct hci_dev *hdev, struct sk_buff *skb)
 446 {
 447         struct hci_rp_read_local_commands *rp = (void *) skb->data;
 448
 449         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 450
 451         if (rp->status)
 452                 return;
 453
 454         memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 455 }
 456
 457 static void hci_cc_read_local_features(struct hci_dev *hdev, struct sk_buff *skb)
 458 {
 459         struct hci_rp_read_local_features *rp = (void *) skb->data;
 460
 461         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 462
 463         if (rp->status)
 464                 return;
 465
 466         memcpy(hdev->features, rp->features, 8);
 467
 468         /* Adjust default settings according to features
 469          * supported by device. */
 470
 471         if (hdev->features[0] & LMP_3SLOT)
 472                 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 473
 474         if (hdev->features[0] & LMP_5SLOT)
 475                 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 476
 477         if (hdev->features[1] & LMP_HV2) {
 478                 hdev->pkt_type  |= (HCI_HV2);
 479                 hdev->esco_type |= (ESCO_HV2);
 480         }
 481
 482         if (hdev->features[1] & LMP_HV3) {
 483                 hdev->pkt_type  |= (HCI_HV3);
 484                 hdev->esco_type |= (ESCO_HV3);
 485         }
 486
 487         if (hdev->features[3] & LMP_ESCO)
 488                 hdev->esco_type |= (ESCO_EV3);
 489
 490         if (hdev->features[4] & LMP_EV4)
 491                 hdev->esco_type |= (ESCO_EV4);
 492
 493         if (hdev->features[4] & LMP_EV5)
 494                 hdev->esco_type |= (ESCO_EV5);
 495
 496         if (hdev->features[5] & LMP_EDR_ESCO_2M)
 497                 hdev->esco_type |= (ESCO_2EV3);
 498
 499         if (hdev->features[5] & LMP_EDR_ESCO_3M)
 500                 hdev->esco_type |= (ESCO_3EV3);
 501
 502         if (hdev->features[5] & LMP_EDR_3S_ESCO)
 503                 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
 504
 505         BT_DBG("%s features 0x%.2x%.2x%.2x%.2x%.2x%.2x%.2x%.2x", hdev->name,
 506                                         hdev->features[0], hdev->features[1],
 507                                         hdev->features[2], hdev->features[3],
 508                                         hdev->features[4], hdev->features[5],
 509                                         hdev->features[6], hdev->features[7]);
 510 }
 511
 512 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 513 {
 514         struct hci_rp_read_buffer_size *rp = (void *) skb->data;
 515
 516         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 517
 518         if (rp->status)
 519                 return;
 520
 521         hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
 522         hdev->sco_mtu  = rp->sco_mtu;
 523         hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
 524         hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
 525
 526         if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
 527                 hdev->sco_mtu  = 64;
 528                 hdev->sco_pkts = 8;
 529         }
 530
 531         hdev->acl_cnt = hdev->acl_pkts;
 532         hdev->sco_cnt = hdev->sco_pkts;
 533
 534         BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name,
 535                                         hdev->acl_mtu, hdev->acl_pkts,
 536                                         hdev->sco_mtu, hdev->sco_pkts);
 537 }
 538
 539 static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
 540 {
 541         struct hci_rp_read_bd_addr *rp = (void *) skb->data;
 542
 543         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 544
 545         if (!rp->status)
 546                 bacpy(&hdev->bdaddr, &rp->bdaddr);
 547
 548         hci_req_complete(hdev, HCI_OP_READ_BD_ADDR, rp->status);
 549 }
 550
 551 static void hci_cc_write_ca_timeout(struct hci_dev *hdev, struct sk_buff *skb)
 552 {
 553         __u8 status = *((__u8 *) skb->data);
 554
 555         BT_DBG("%s status 0x%x", hdev->name, status);
 556
 557         hci_req_complete(hdev, HCI_OP_WRITE_CA_TIMEOUT, status);
 558 }
 559
 560 static inline void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
 561 {
 562         BT_DBG("%s status 0x%x", hdev->name, status);
 563
 564         if (status) {
 565                 hci_req_complete(hdev, HCI_OP_INQUIRY, status);
 566
 567                 hci_conn_check_pending(hdev);
 568         } else
 569                 set_bit(HCI_INQUIRY, &hdev->flags);
 570 }
 571
 572 static inline void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
 573 {
 574         struct hci_cp_create_conn *cp;
 575         struct hci_conn *conn;
 576
 577         BT_DBG("%s status 0x%x", hdev->name, status);
 578
 579         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
 580         if (!cp)
 581                 return;
 582
 583         hci_dev_lock(hdev);
 584
 585         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 586
 587         BT_DBG("%s bdaddr %s conn %p", hdev->name, batostr(&cp->bdaddr), conn);
 588
 589         if (status) {
 590                 if (conn && conn->state == BT_CONNECT) {
 591                         if (status != 0x0c || conn->attempt > 2) {
 592                                 conn->state = BT_CLOSED;
 593                                 hci_proto_connect_cfm(conn, status);
 594                                 hci_conn_del(conn);
 595                         } else
 596                                 conn->state = BT_CONNECT2;
 597                 }
 598         } else {
 599                 if (!conn) {
 600                         conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr);
 601                         if (conn) {
 602                                 conn->out = 1;
 603                                 conn->link_mode |= HCI_LM_MASTER;
 604                         } else
 605                                 BT_ERR("No memory for new connection");
 606                 }
 607         }
 608
 609         hci_dev_unlock(hdev);
 610 }
 611
 612 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
 613 {
 614         struct hci_cp_add_sco *cp;
 615         struct hci_conn *acl, *sco;
 616         __u16 handle;
 617
 618         BT_DBG("%s status 0x%x", hdev->name, status);
 619
 620         if (!status)
 621                 return;
 622
 623         cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
 624         if (!cp)
 625                 return;
 626
 627         handle = __le16_to_cpu(cp->handle);
 628
 629         BT_DBG("%s handle %d", hdev->name, handle);
 630
 631         hci_dev_lock(hdev);
 632
 633         acl = hci_conn_hash_lookup_handle(hdev, handle);
 634         if (acl && (sco = acl->link)) {
 635                 sco->state = BT_CLOSED;
 636
 637                 hci_proto_connect_cfm(sco, status);
 638                 hci_conn_del(sco);
 639         }
 640
 641         hci_dev_unlock(hdev);
 642 }
 643
 644 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
 645 {
 646         struct hci_cp_auth_requested *cp;
 647         struct hci_conn *conn;
 648
 649         BT_DBG("%s status 0x%x", hdev->name, status);
 650
 651         if (!status)
 652                 return;
 653
 654         cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
 655         if (!cp)
 656                 return;
 657
 658         hci_dev_lock(hdev);
 659
 660         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
 661         if (conn) {
 662                 if (conn->state == BT_CONFIG) {
 663                         hci_proto_connect_cfm(conn, status);
 664                         hci_conn_put(conn);
 665                 }
 666         }
 667
 668         hci_dev_unlock(hdev);
 669 }
 670
 671 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
 672 {
 673         struct hci_cp_set_conn_encrypt *cp;
 674         struct hci_conn *conn;
 675
 676         BT_DBG("%s status 0x%x", hdev->name, status);
 677
 678         if (!status)
 679                 return;
 680
 681         cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
 682         if (!cp)
 683                 return;
 684
 685         hci_dev_lock(hdev);
 686
 687         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
 688         if (conn) {
 689                 if (conn->state == BT_CONFIG) {
 690                         hci_proto_connect_cfm(conn, status);
 691                         hci_conn_put(conn);
 692                 }
 693         }
 694
 695         hci_dev_unlock(hdev);
 696 }
 697
 698 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
 699                                                 struct hci_conn *conn)
 700 {
 701         if (conn->state != BT_CONFIG || !conn->out)
 702                 return 0;
 703
 704         if (conn->pending_sec_level == BT_SECURITY_SDP)
 705                 return 0;
 706
 707         /* Only request authentication for SSP connections or non-SSP
 708          * devices with sec_level HIGH */
 709         if (!(hdev->ssp_mode > 0 && conn->ssp_mode > 0) &&
 710                                 conn->pending_sec_level != BT_SECURITY_HIGH)
 711                 return 0;
 712
 713         return 1;
 714 }
 715
 716 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
 717 {
 718         struct hci_cp_remote_name_req *cp;
 719         struct hci_conn *conn;
 720
 721         BT_DBG("%s status 0x%x", hdev->name, status);
 722
 723         /* If successful wait for the name req complete event before
 724          * checking for the need to do authentication */
 725         if (!status)
 726                 return;
 727
 728         cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
 729         if (!cp)
 730                 return;
 731
 732         hci_dev_lock(hdev);
 733
 734         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 735         if (conn && hci_outgoing_auth_needed(hdev, conn)) {
 736                 struct hci_cp_auth_requested cp;
 737                 cp.handle = __cpu_to_le16(conn->handle);
 738                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
 739         }
 740
 741         hci_dev_unlock(hdev);
 742 }
 743
 744 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
 745 {
 746         struct hci_cp_read_remote_features *cp;
 747         struct hci_conn *conn;
 748
 749         BT_DBG("%s status 0x%x", hdev->name, status);
 750
 751         if (!status)
 752                 return;
 753
 754         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
 755         if (!cp)
 756                 return;
 757
 758         hci_dev_lock(hdev);
 759
 760         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
 761         if (conn) {
 762                 if (conn->state == BT_CONFIG) {
 763                         hci_proto_connect_cfm(conn, status);
 764                         hci_conn_put(conn);
 765                 }
 766         }
 767
 768         hci_dev_unlock(hdev);
 769 }
 770
 771 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
 772 {
 773         struct hci_cp_read_remote_ext_features *cp;
 774         struct hci_conn *conn;
 775
 776         BT_DBG("%s status 0x%x", hdev->name, status);
 777
 778         if (!status)
 779                 return;
 780
 781         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
 782         if (!cp)
 783                 return;
 784
 785         hci_dev_lock(hdev);
 786
 787         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
 788         if (conn) {
 789                 if (conn->state == BT_CONFIG) {
 790                         hci_proto_connect_cfm(conn, status);
 791                         hci_conn_put(conn);
 792                 }
 793         }
 794
 795         hci_dev_unlock(hdev);
 796 }
 797
 798 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
 799 {
 800         struct hci_cp_setup_sync_conn *cp;
 801         struct hci_conn *acl, *sco;
 802         __u16 handle;
 803
 804         BT_DBG("%s status 0x%x", hdev->name, status);
 805
 806         if (!status)
 807                 return;
 808
 809         cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
 810         if (!cp)
 811                 return;
 812
 813         handle = __le16_to_cpu(cp->handle);
 814
 815         BT_DBG("%s handle %d", hdev->name, handle);
 816
 817         hci_dev_lock(hdev);
 818
 819         acl = hci_conn_hash_lookup_handle(hdev, handle);
 820         if (acl && (sco = acl->link)) {
 821                 sco->state = BT_CLOSED;
 822
 823                 hci_proto_connect_cfm(sco, status);
 824                 hci_conn_del(sco);
 825         }
 826
 827         hci_dev_unlock(hdev);
 828 }
 829
 830 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
 831 {
 832         struct hci_cp_sniff_mode *cp;
 833         struct hci_conn *conn;
 834
 835         BT_DBG("%s status 0x%x", hdev->name, status);
 836
 837         if (!status)
 838                 return;
 839
 840         cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
 841         if (!cp)
 842                 return;
 843
 844         hci_dev_lock(hdev);
 845
 846         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
 847         if (conn) {
 848                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend);
 849
 850                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->pend))
 851                         hci_sco_setup(conn, status);
 852         }
 853
 854         hci_dev_unlock(hdev);
 855 }
 856
 857 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
 858 {
 859         struct hci_cp_exit_sniff_mode *cp;
 860         struct hci_conn *conn;
 861
 862         BT_DBG("%s status 0x%x", hdev->name, status);
 863
 864         if (!status)
 865                 return;
 866
 867         cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
 868         if (!cp)
 869                 return;
 870
 871         hci_dev_lock(hdev);
 872
 873         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
 874         if (conn) {
 875                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend);
 876
 877                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->pend))
 878                         hci_sco_setup(conn, status);
 879         }
 880
 881         hci_dev_unlock(hdev);
 882 }
 883
 884 static inline void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 885 {
 886         __u8 status = *((__u8 *) skb->data);
 887
 888         BT_DBG("%s status %d", hdev->name, status);
 889
 890         clear_bit(HCI_INQUIRY, &hdev->flags);
 891
 892         hci_req_complete(hdev, HCI_OP_INQUIRY, status);
 893
 894         hci_conn_check_pending(hdev);
 895 }
 896
 897 static inline void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
 898 {
 899         struct inquiry_data data;
 900         struct inquiry_info *info = (void *) (skb->data + 1);
 901         int num_rsp = *((__u8 *) skb->data);
 902
 903         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
 904
 905         if (!num_rsp)
 906                 return;
 907
 908         hci_dev_lock(hdev);
 909
 910         for (; num_rsp; num_rsp--) {
 911                 bacpy(&data.bdaddr, &info->bdaddr);
 912                 data.pscan_rep_mode     = info->pscan_rep_mode;
 913                 data.pscan_period_mode  = info->pscan_period_mode;
 914                 data.pscan_mode         = info->pscan_mode;
 915                 memcpy(data.dev_class, info->dev_class, 3);
 916                 data.clock_offset       = info->clock_offset;
 917                 data.rssi               = 0x00;
 918                 data.ssp_mode           = 0x00;
 919                 info++;
 920                 hci_inquiry_cache_update(hdev, &data);
 921         }
 922
 923         hci_dev_unlock(hdev);
 924 }
 925
 926 static inline void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 927 {
 928         struct hci_ev_conn_complete *ev = (void *) skb->data;
 929         struct hci_conn *conn;
 930
 931         BT_DBG("%s", hdev->name);
 932
 933         hci_dev_lock(hdev);
 934
 935         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
 936         if (!conn) {
 937                 if (ev->link_type != SCO_LINK)
 938                         goto unlock;
 939
 940                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
 941                 if (!conn)
 942                         goto unlock;
 943
 944                 conn->type = SCO_LINK;
 945         }
 946
 947         if (!ev->status) {
 948                 conn->handle = __le16_to_cpu(ev->handle);
 949
 950                 if (conn->type == ACL_LINK) {
 951                         conn->state = BT_CONFIG;
 952                         hci_conn_hold(conn);
 953                         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
 954                 } else
 955                         conn->state = BT_CONNECTED;
 956
 957                 hci_conn_hold_device(conn);
 958                 hci_conn_add_sysfs(conn);
 959
 960                 if (test_bit(HCI_AUTH, &hdev->flags))
 961                         conn->link_mode |= HCI_LM_AUTH;
 962
 963                 if (test_bit(HCI_ENCRYPT, &hdev->flags))
 964                         conn->link_mode |= HCI_LM_ENCRYPT;
 965
 966                 /* Get remote features */
 967                 if (conn->type == ACL_LINK) {
 968                         struct hci_cp_read_remote_features cp;
 969                         cp.handle = ev->handle;
 970                         hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
 971                                                         sizeof(cp), &cp);
 972                 }
 973
 974                 /* Set packet type for incoming connection */
 975                 if (!conn->out && hdev->hci_ver < 3) {
 976                         struct hci_cp_change_conn_ptype cp;
 977                         cp.handle = ev->handle;
 978                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 979                         hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE,
 980                                                         sizeof(cp), &cp);
 981                 }
 982         } else
 983                 conn->state = BT_CLOSED;
 984
 985         if (conn->type == ACL_LINK)
 986                 hci_sco_setup(conn, ev->status);
 987
 988         if (ev->status) {
 989                 hci_proto_connect_cfm(conn, ev->status);
 990                 hci_conn_del(conn);
 991         } else if (ev->link_type != ACL_LINK)
 992                 hci_proto_connect_cfm(conn, ev->status);
 993
 994 unlock:
 995         hci_dev_unlock(hdev);
 996
 997         hci_conn_check_pending(hdev);
 998 }
 999
1000 static inline void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
1001 {
1002         struct hci_ev_conn_request *ev = (void *) skb->data;
1003         int mask = hdev->link_mode;
1004
1005         BT_DBG("%s bdaddr %s type 0x%x", hdev->name,
1006                                         batostr(&ev->bdaddr), ev->link_type);
1007
1008         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type);
1009
1010         if ((mask & HCI_LM_ACCEPT) && !hci_blacklist_lookup(hdev, &ev->bdaddr)) {
1011                 /* Connection accepted */
1012                 struct inquiry_entry *ie;
1013                 struct hci_conn *conn;
1014
1015                 hci_dev_lock(hdev);
1016
1017                 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
1018                 if (ie)
1019                         memcpy(ie->data.dev_class, ev->dev_class, 3);
1020
1021                 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
1022                 if (!conn) {
1023                         conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr);
1024                         if (!conn) {
1025                                 BT_ERR("No memory for new connection");
1026                                 hci_dev_unlock(hdev);
1027                                 return;
1028                         }
1029                 }
1030
1031                 memcpy(conn->dev_class, ev->dev_class, 3);
1032                 conn->state = BT_CONNECT;
1033
1034                 hci_dev_unlock(hdev);
1035
1036                 if (ev->link_type == ACL_LINK || !lmp_esco_capable(hdev)) {
1037                         struct hci_cp_accept_conn_req cp;
1038
1039                         bacpy(&cp.bdaddr, &ev->bdaddr);
1040
1041                         if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
1042                                 cp.role = 0x00; /* Become master */
1043                         else
1044                                 cp.role = 0x01; /* Remain slave */
1045
1046                         hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ,
1047                                                         sizeof(cp), &cp);
1048                 } else {
1049                         struct hci_cp_accept_sync_conn_req cp;
1050
1051                         bacpy(&cp.bdaddr, &ev->bdaddr);
1052                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
1053
1054                         cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
1055                         cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
1056                         cp.max_latency    = cpu_to_le16(0xffff);
1057                         cp.content_format = cpu_to_le16(hdev->voice_setting);
1058                         cp.retrans_effort = 0xff;
1059
1060                         hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ,
1061                                                         sizeof(cp), &cp);
1062                 }
1063         } else {
1064                 /* Connection rejected */
1065                 struct hci_cp_reject_conn_req cp;
1066
1067                 bacpy(&cp.bdaddr, &ev->bdaddr);
1068                 cp.reason = 0x0f;
1069                 hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
1070         }
1071 }
1072
1073 static inline void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1074 {
1075         struct hci_ev_disconn_complete *ev = (void *) skb->data;
1076         struct hci_conn *conn;
1077
1078         BT_DBG("%s status %d", hdev->name, ev->status);
1079
1080         if (ev->status)
1081                 return;
1082
1083         hci_dev_lock(hdev);
1084
1085         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1086         if (conn) {
1087                 conn->state = BT_CLOSED;
1088
1089                 hci_proto_disconn_cfm(conn, ev->reason);
1090                 hci_conn_del(conn);
1091         }
1092
1093         hci_dev_unlock(hdev);
1094 }
1095
1096 static inline void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1097 {
1098         struct hci_ev_auth_complete *ev = (void *) skb->data;
1099         struct hci_conn *conn;
1100
1101         BT_DBG("%s status %d", hdev->name, ev->status);
1102
1103         hci_dev_lock(hdev);
1104
1105         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1106         if (conn) {
1107                 if (!ev->status) {
1108                         conn->link_mode |= HCI_LM_AUTH;
1109                         conn->sec_level = conn->pending_sec_level;
1110                 } else
1111                         conn->sec_level = BT_SECURITY_LOW;
1112
1113                 clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
1114
1115                 if (conn->state == BT_CONFIG) {
1116                         if (!ev->status && hdev->ssp_mode > 0 &&
1117                                                         conn->ssp_mode > 0) {
1118                                 struct hci_cp_set_conn_encrypt cp;
1119                                 cp.handle  = ev->handle;
1120                                 cp.encrypt = 0x01;
1121                                 hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT,
1122                                                         sizeof(cp), &cp);
1123                         } else {
1124                                 conn->state = BT_CONNECTED;
1125                                 hci_proto_connect_cfm(conn, ev->status);
1126                                 hci_conn_put(conn);
1127                         }
1128                 } else {
1129                         hci_auth_cfm(conn, ev->status);
1130
1131                         hci_conn_hold(conn);
1132                         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
1133                         hci_conn_put(conn);
1134                 }
1135
1136                 if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend)) {
1137                         if (!ev->status) {
1138                                 struct hci_cp_set_conn_encrypt cp;
1139                                 cp.handle  = ev->handle;
1140                                 cp.encrypt = 0x01;
1141                                 hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT,
1142                                                         sizeof(cp), &cp);
1143                         } else {
1144                                 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
1145                                 hci_encrypt_cfm(conn, ev->status, 0x00);
1146                         }
1147                 }
1148         }
1149
1150         hci_dev_unlock(hdev);
1151 }
1152
1153 static inline void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
1154 {
1155         struct hci_ev_remote_name *ev = (void *) skb->data;
1156         struct hci_conn *conn;
1157
1158         BT_DBG("%s", hdev->name);
1159
1160         hci_conn_check_pending(hdev);
1161
1162         hci_dev_lock(hdev);
1163
1164         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
1165         if (conn && hci_outgoing_auth_needed(hdev, conn)) {
1166                 struct hci_cp_auth_requested cp;
1167                 cp.handle = __cpu_to_le16(conn->handle);
1168                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
1169         }
1170
1171         hci_dev_unlock(hdev);
1172 }
1173
1174 static inline void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
1175 {
1176         struct hci_ev_encrypt_change *ev = (void *) skb->data;
1177         struct hci_conn *conn;
1178
1179         BT_DBG("%s status %d", hdev->name, ev->status);
1180
1181         hci_dev_lock(hdev);
1182
1183         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1184         if (conn) {
1185                 if (!ev->status) {
1186                         if (ev->encrypt) {
1187                                 /* Encryption implies authentication */
1188                                 conn->link_mode |= HCI_LM_AUTH;
1189                                 conn->link_mode |= HCI_LM_ENCRYPT;
1190                         } else
1191                                 conn->link_mode &= ~HCI_LM_ENCRYPT;
1192                 }
1193
1194                 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
1195
1196                 if (conn->state == BT_CONFIG) {
1197                         if (!ev->status)
1198                                 conn->state = BT_CONNECTED;
1199
1200                         hci_proto_connect_cfm(conn, ev->status);
1201                         hci_conn_put(conn);
1202                 } else
1203                         hci_encrypt_cfm(conn, ev->status, ev->encrypt);
1204         }
1205
1206         hci_dev_unlock(hdev);
1207 }
1208
1209 static inline void hci_change_link_key_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1210 {
1211         struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
1212         struct hci_conn *conn;
1213
1214         BT_DBG("%s status %d", hdev->name, ev->status);
1215
1216         hci_dev_lock(hdev);
1217
1218         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1219         if (conn) {
1220                 if (!ev->status)
1221                         conn->link_mode |= HCI_LM_SECURE;
1222
1223                 clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
1224
1225                 hci_key_change_cfm(conn, ev->status);
1226         }
1227
1228         hci_dev_unlock(hdev);
1229 }
1230
1231 static inline void hci_remote_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
1232 {
1233         struct hci_ev_remote_features *ev = (void *) skb->data;
1234         struct hci_conn *conn;
1235
1236         BT_DBG("%s status %d", hdev->name, ev->status);
1237
1238         hci_dev_lock(hdev);
1239
1240         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1241         if (!conn)
1242                 goto unlock;
1243
1244         if (!ev->status)
1245                 memcpy(conn->features, ev->features, 8);
1246
1247         if (conn->state != BT_CONFIG)
1248                 goto unlock;
1249
1250         if (!ev->status && lmp_ssp_capable(hdev) && lmp_ssp_capable(conn)) {
1251                 struct hci_cp_read_remote_ext_features cp;
1252                 cp.handle = ev->handle;
1253                 cp.page = 0x01;
1254                 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
1255                                                         sizeof(cp), &cp);
1256                 goto unlock;
1257         }
1258
1259         if (!ev->status) {
1260                 struct hci_cp_remote_name_req cp;
1261                 memset(&cp, 0, sizeof(cp));
1262                 bacpy(&cp.bdaddr, &conn->dst);
1263                 cp.pscan_rep_mode = 0x02;
1264                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1265         }
1266
1267         if (!hci_outgoing_auth_needed(hdev, conn)) {
1268                 conn->state = BT_CONNECTED;
1269                 hci_proto_connect_cfm(conn, ev->status);
1270                 hci_conn_put(conn);
1271         }
1272
1273 unlock:
1274         hci_dev_unlock(hdev);
1275 }
1276
1277 static inline void hci_remote_version_evt(struct hci_dev *hdev, struct sk_buff *skb)
1278 {
1279         BT_DBG("%s", hdev->name);
1280 }
1281
1282 static inline void hci_qos_setup_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1283 {
1284         BT_DBG("%s", hdev->name);
1285 }
1286
1287 static inline void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1288 {
1289         struct hci_ev_cmd_complete *ev = (void *) skb->data;
1290         __u16 opcode;
1291
1292         skb_pull(skb, sizeof(*ev));
1293
1294         opcode = __le16_to_cpu(ev->opcode);
1295
1296         switch (opcode) {
1297         case HCI_OP_INQUIRY_CANCEL:
1298                 hci_cc_inquiry_cancel(hdev, skb);
1299                 break;
1300
1301         case HCI_OP_EXIT_PERIODIC_INQ:
1302                 hci_cc_exit_periodic_inq(hdev, skb);
1303                 break;
1304
1305         case HCI_OP_REMOTE_NAME_REQ_CANCEL:
1306                 hci_cc_remote_name_req_cancel(hdev, skb);
1307                 break;
1308
1309         case HCI_OP_ROLE_DISCOVERY:
1310                 hci_cc_role_discovery(hdev, skb);
1311                 break;
1312
1313         case HCI_OP_READ_LINK_POLICY:
1314                 hci_cc_read_link_policy(hdev, skb);
1315                 break;
1316
1317         case HCI_OP_WRITE_LINK_POLICY:
1318                 hci_cc_write_link_policy(hdev, skb);
1319                 break;
1320
1321         case HCI_OP_READ_DEF_LINK_POLICY:
1322                 hci_cc_read_def_link_policy(hdev, skb);
1323                 break;
1324
1325         case HCI_OP_WRITE_DEF_LINK_POLICY:
1326                 hci_cc_write_def_link_policy(hdev, skb);
1327                 break;
1328
1329         case HCI_OP_RESET:
1330                 hci_cc_reset(hdev, skb);
1331                 break;
1332
1333         case HCI_OP_WRITE_LOCAL_NAME:
1334                 hci_cc_write_local_name(hdev, skb);
1335                 break;
1336
1337         case HCI_OP_READ_LOCAL_NAME:
1338                 hci_cc_read_local_name(hdev, skb);
1339                 break;
1340
1341         case HCI_OP_WRITE_AUTH_ENABLE:
1342                 hci_cc_write_auth_enable(hdev, skb);
1343                 break;
1344
1345         case HCI_OP_WRITE_ENCRYPT_MODE:
1346                 hci_cc_write_encrypt_mode(hdev, skb);
1347                 break;
1348
1349         case HCI_OP_WRITE_SCAN_ENABLE:
1350                 hci_cc_write_scan_enable(hdev, skb);
1351                 break;
1352
1353         case HCI_OP_READ_CLASS_OF_DEV:
1354                 hci_cc_read_class_of_dev(hdev, skb);
1355                 break;
1356
1357         case HCI_OP_WRITE_CLASS_OF_DEV:
1358                 hci_cc_write_class_of_dev(hdev, skb);
1359                 break;
1360
1361         case HCI_OP_READ_VOICE_SETTING:
1362                 hci_cc_read_voice_setting(hdev, skb);
1363                 break;
1364
1365         case HCI_OP_WRITE_VOICE_SETTING:
1366                 hci_cc_write_voice_setting(hdev, skb);
1367                 break;
1368
1369         case HCI_OP_HOST_BUFFER_SIZE:
1370                 hci_cc_host_buffer_size(hdev, skb);
1371                 break;
1372
1373         case HCI_OP_READ_SSP_MODE:
1374                 hci_cc_read_ssp_mode(hdev, skb);
1375                 break;
1376
1377         case HCI_OP_WRITE_SSP_MODE:
1378                 hci_cc_write_ssp_mode(hdev, skb);
1379                 break;
1380
1381         case HCI_OP_READ_LOCAL_VERSION:
1382                 hci_cc_read_local_version(hdev, skb);
1383                 break;
1384
1385         case HCI_OP_READ_LOCAL_COMMANDS:
1386                 hci_cc_read_local_commands(hdev, skb);
1387                 break;
1388
1389         case HCI_OP_READ_LOCAL_FEATURES:
1390                 hci_cc_read_local_features(hdev, skb);
1391                 break;
1392
1393         case HCI_OP_READ_BUFFER_SIZE:
1394                 hci_cc_read_buffer_size(hdev, skb);
1395                 break;
1396
1397         case HCI_OP_READ_BD_ADDR:
1398                 hci_cc_read_bd_addr(hdev, skb);
1399                 break;
1400
1401         case HCI_OP_WRITE_CA_TIMEOUT:
1402                 hci_cc_write_ca_timeout(hdev, skb);
1403                 break;
1404
1405         default:
1406                 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
1407                 break;
1408         }
1409
1410         if (ev->ncmd) {
1411                 atomic_set(&hdev->cmd_cnt, 1);
1412                 if (!skb_queue_empty(&hdev->cmd_q))
1413                         tasklet_schedule(&hdev->cmd_task);
1414         }
1415 }
1416
1417 static inline void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb)
1418 {
1419         struct hci_ev_cmd_status *ev = (void *) skb->data;
1420         __u16 opcode;
1421
1422         skb_pull(skb, sizeof(*ev));
1423
1424         opcode = __le16_to_cpu(ev->opcode);
1425
1426         switch (opcode) {
1427         case HCI_OP_INQUIRY:
1428                 hci_cs_inquiry(hdev, ev->status);
1429                 break;
1430
1431         case HCI_OP_CREATE_CONN:
1432                 hci_cs_create_conn(hdev, ev->status);
1433                 break;
1434
1435         case HCI_OP_ADD_SCO:
1436                 hci_cs_add_sco(hdev, ev->status);
1437                 break;
1438
1439         case HCI_OP_AUTH_REQUESTED:
1440                 hci_cs_auth_requested(hdev, ev->status);
1441                 break;
1442
1443         case HCI_OP_SET_CONN_ENCRYPT:
1444                 hci_cs_set_conn_encrypt(hdev, ev->status);
1445                 break;
1446
1447         case HCI_OP_REMOTE_NAME_REQ:
1448                 hci_cs_remote_name_req(hdev, ev->status);
1449                 break;
1450
1451         case HCI_OP_READ_REMOTE_FEATURES:
1452                 hci_cs_read_remote_features(hdev, ev->status);
1453                 break;
1454
1455         case HCI_OP_READ_REMOTE_EXT_FEATURES:
1456                 hci_cs_read_remote_ext_features(hdev, ev->status);
1457                 break;
1458
1459         case HCI_OP_SETUP_SYNC_CONN:
1460                 hci_cs_setup_sync_conn(hdev, ev->status);
1461                 break;
1462
1463         case HCI_OP_SNIFF_MODE:
1464                 hci_cs_sniff_mode(hdev, ev->status);
1465                 break;
1466
1467         case HCI_OP_EXIT_SNIFF_MODE:
1468                 hci_cs_exit_sniff_mode(hdev, ev->status);
1469                 break;
1470
1471         default:
1472                 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
1473                 break;
1474         }
1475
1476         if (ev->ncmd) {
1477                 atomic_set(&hdev->cmd_cnt, 1);
1478                 if (!skb_queue_empty(&hdev->cmd_q))
1479                         tasklet_schedule(&hdev->cmd_task);
1480         }
1481 }
1482
1483 static inline void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
1484 {
1485         struct hci_ev_role_change *ev = (void *) skb->data;
1486         struct hci_conn *conn;
1487
1488         BT_DBG("%s status %d", hdev->name, ev->status);
1489
1490         hci_dev_lock(hdev);
1491
1492         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
1493         if (conn) {
1494                 if (!ev->status) {
1495                         if (ev->role)
1496                                 conn->link_mode &= ~HCI_LM_MASTER;
1497                         else
1498                                 conn->link_mode |= HCI_LM_MASTER;
1499                 }
1500
1501                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->pend);
1502
1503                 hci_role_switch_cfm(conn, ev->status, ev->role);
1504         }
1505
1506         hci_dev_unlock(hdev);
1507 }
1508
1509 static inline void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
1510 {
1511         struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
1512         __le16 *ptr;
1513         int i;
1514
1515         skb_pull(skb, sizeof(*ev));
1516
1517         BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
1518
1519         if (skb->len < ev->num_hndl * 4) {
1520                 BT_DBG("%s bad parameters", hdev->name);
1521                 return;
1522         }
1523
1524         tasklet_disable(&hdev->tx_task);
1525
1526         for (i = 0, ptr = (__le16 *) skb->data; i < ev->num_hndl; i++) {
1527                 struct hci_conn *conn;
1528                 __u16  handle, count;
1529
1530                 handle = get_unaligned_le16(ptr++);
1531                 count  = get_unaligned_le16(ptr++);
1532
1533                 conn = hci_conn_hash_lookup_handle(hdev, handle);
1534                 if (conn) {
1535                         conn->sent -= count;
1536
1537                         if (conn->type == ACL_LINK) {
1538                                 hdev->acl_cnt += count;
1539                                 if (hdev->acl_cnt > hdev->acl_pkts)
1540                                         hdev->acl_cnt = hdev->acl_pkts;
1541                         } else {
1542                                 hdev->sco_cnt += count;
1543                                 if (hdev->sco_cnt > hdev->sco_pkts)
1544                                         hdev->sco_cnt = hdev->sco_pkts;
1545                         }
1546                 }
1547         }
1548
1549         tasklet_schedule(&hdev->tx_task);
1550
1551         tasklet_enable(&hdev->tx_task);
1552 }
1553
1554 static inline void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
1555 {
1556         struct hci_ev_mode_change *ev = (void *) skb->data;
1557         struct hci_conn *conn;
1558
1559         BT_DBG("%s status %d", hdev->name, ev->status);
1560
1561         hci_dev_lock(hdev);
1562
1563         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1564         if (conn) {
1565                 conn->mode = ev->mode;
1566                 conn->interval = __le16_to_cpu(ev->interval);
1567
1568                 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
1569                         if (conn->mode == HCI_CM_ACTIVE)
1570                                 conn->power_save = 1;
1571                         else
1572                                 conn->power_save = 0;
1573                 }
1574
1575                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->pend))
1576                         hci_sco_setup(conn, ev->status);
1577         }
1578
1579         hci_dev_unlock(hdev);
1580 }
1581
1582 static inline void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
1583 {
1584         struct hci_ev_pin_code_req *ev = (void *) skb->data;
1585         struct hci_conn *conn;
1586
1587         BT_DBG("%s", hdev->name);
1588
1589         hci_dev_lock(hdev);
1590
1591         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
1592         if (conn && conn->state == BT_CONNECTED) {
1593                 hci_conn_hold(conn);
1594                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
1595                 hci_conn_put(conn);
1596         }
1597
1598         if (!test_bit(HCI_PAIRABLE, &hdev->flags))
1599                 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
1600                                         sizeof(ev->bdaddr), &ev->bdaddr);
1601
1602         hci_dev_unlock(hdev);
1603 }
1604
1605 static inline void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
1606 {
1607         BT_DBG("%s", hdev->name);
1608 }
1609
1610 static inline void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
1611 {
1612         struct hci_ev_link_key_notify *ev = (void *) skb->data;
1613         struct hci_conn *conn;
1614
1615         BT_DBG("%s", hdev->name);
1616
1617         hci_dev_lock(hdev);
1618
1619         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
1620         if (conn) {
1621                 hci_conn_hold(conn);
1622                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
1623                 hci_conn_put(conn);
1624         }
1625
1626         hci_dev_unlock(hdev);
1627 }
1628
1629 static inline void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
1630 {
1631         struct hci_ev_clock_offset *ev = (void *) skb->data;
1632         struct hci_conn *conn;
1633
1634         BT_DBG("%s status %d", hdev->name, ev->status);
1635
1636         hci_dev_lock(hdev);
1637
1638         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1639         if (conn && !ev->status) {
1640                 struct inquiry_entry *ie;
1641
1642                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
1643                 if (ie) {
1644                         ie->data.clock_offset = ev->clock_offset;
1645                         ie->timestamp = jiffies;
1646                 }
1647         }
1648
1649         hci_dev_unlock(hdev);
1650 }
1651
1652 static inline void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
1653 {
1654         struct hci_ev_pkt_type_change *ev = (void *) skb->data;
1655         struct hci_conn *conn;
1656
1657         BT_DBG("%s status %d", hdev->name, ev->status);
1658
1659         hci_dev_lock(hdev);
1660
1661         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1662         if (conn && !ev->status)
1663                 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
1664
1665         hci_dev_unlock(hdev);
1666 }
1667
1668 static inline void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
1669 {
1670         struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
1671         struct inquiry_entry *ie;
1672
1673         BT_DBG("%s", hdev->name);
1674
1675         hci_dev_lock(hdev);
1676
1677         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
1678         if (ie) {
1679                 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
1680                 ie->timestamp = jiffies;
1681         }
1682
1683         hci_dev_unlock(hdev);
1684 }
1685
1686 static inline void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, struct sk_buff *skb)
1687 {
1688         struct inquiry_data data;
1689         int num_rsp = *((__u8 *) skb->data);
1690
1691         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
1692
1693         if (!num_rsp)
1694                 return;
1695
1696         hci_dev_lock(hdev);
1697
1698         if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
1699                 struct inquiry_info_with_rssi_and_pscan_mode *info = (void *) (skb->data + 1);
1700
1701                 for (; num_rsp; num_rsp--) {
1702                         bacpy(&data.bdaddr, &info->bdaddr);
1703                         data.pscan_rep_mode     = info->pscan_rep_mode;
1704                         data.pscan_period_mode  = info->pscan_period_mode;
1705                         data.pscan_mode         = info->pscan_mode;
1706                         memcpy(data.dev_class, info->dev_class, 3);
1707                         data.clock_offset       = info->clock_offset;
1708                         data.rssi               = info->rssi;
1709                         data.ssp_mode           = 0x00;
1710                         info++;
1711                         hci_inquiry_cache_update(hdev, &data);
1712                 }
1713         } else {
1714                 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
1715
1716                 for (; num_rsp; num_rsp--) {
1717                         bacpy(&data.bdaddr, &info->bdaddr);
1718                         data.pscan_rep_mode     = info->pscan_rep_mode;
1719                         data.pscan_period_mode  = info->pscan_period_mode;
1720                         data.pscan_mode         = 0x00;
1721                         memcpy(data.dev_class, info->dev_class, 3);
1722                         data.clock_offset       = info->clock_offset;
1723                         data.rssi               = info->rssi;
1724                         data.ssp_mode           = 0x00;
1725                         info++;
1726                         hci_inquiry_cache_update(hdev, &data);
1727                 }
1728         }
1729
1730         hci_dev_unlock(hdev);
1731 }
1732
1733 static inline void hci_remote_ext_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
1734 {
1735         struct hci_ev_remote_ext_features *ev = (void *) skb->data;
1736         struct hci_conn *conn;
1737
1738         BT_DBG("%s", hdev->name);
1739
1740         hci_dev_lock(hdev);
1741
1742         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1743         if (!conn)
1744                 goto unlock;
1745
1746         if (!ev->status && ev->page == 0x01) {
1747                 struct inquiry_entry *ie;
1748
1749                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
1750                 if (ie)
1751                         ie->data.ssp_mode = (ev->features[0] & 0x01);
1752
1753                 conn->ssp_mode = (ev->features[0] & 0x01);
1754         }
1755
1756         if (conn->state != BT_CONFIG)
1757                 goto unlock;
1758
1759         if (!ev->status) {
1760                 struct hci_cp_remote_name_req cp;
1761                 memset(&cp, 0, sizeof(cp));
1762                 bacpy(&cp.bdaddr, &conn->dst);
1763                 cp.pscan_rep_mode = 0x02;
1764                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1765         }
1766
1767         if (!hci_outgoing_auth_needed(hdev, conn)) {
1768                 conn->state = BT_CONNECTED;
1769                 hci_proto_connect_cfm(conn, ev->status);
1770                 hci_conn_put(conn);
1771         }
1772
1773 unlock:
1774         hci_dev_unlock(hdev);
1775 }
1776
1777 static inline void hci_sync_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1778 {
1779         struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
1780         struct hci_conn *conn;
1781
1782         BT_DBG("%s status %d", hdev->name, ev->status);
1783
1784         hci_dev_lock(hdev);
1785
1786         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
1787         if (!conn) {
1788                 if (ev->link_type == ESCO_LINK)
1789                         goto unlock;
1790
1791                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
1792                 if (!conn)
1793                         goto unlock;
1794
1795                 conn->type = SCO_LINK;
1796         }
1797
1798         switch (ev->status) {
1799         case 0x00:
1800                 conn->handle = __le16_to_cpu(ev->handle);
1801                 conn->state  = BT_CONNECTED;
1802
1803                 hci_conn_hold_device(conn);
1804                 hci_conn_add_sysfs(conn);
1805                 break;
1806
1807         case 0x11:      /* Unsupported Feature or Parameter Value */
1808         case 0x1c:      /* SCO interval rejected */
1809         case 0x1a:      /* Unsupported Remote Feature */
1810         case 0x1f:      /* Unspecified error */
1811                 if (conn->out && conn->attempt < 2) {
1812                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
1813                                         (hdev->esco_type & EDR_ESCO_MASK);
1814                         hci_setup_sync(conn, conn->link->handle);
1815                         goto unlock;
1816                 }
1817                 /* fall through */
1818
1819         default:
1820                 conn->state = BT_CLOSED;
1821                 break;
1822         }
1823
1824         hci_proto_connect_cfm(conn, ev->status);
1825         if (ev->status)
1826                 hci_conn_del(conn);
1827
1828 unlock:
1829         hci_dev_unlock(hdev);
1830 }
1831
1832 static inline void hci_sync_conn_changed_evt(struct hci_dev *hdev, struct sk_buff *skb)
1833 {
1834         BT_DBG("%s", hdev->name);
1835 }
1836
1837 static inline void hci_sniff_subrate_evt(struct hci_dev *hdev, struct sk_buff *skb)
1838 {
1839         struct hci_ev_sniff_subrate *ev = (void *) skb->data;
1840         struct hci_conn *conn;
1841
1842         BT_DBG("%s status %d", hdev->name, ev->status);
1843
1844         hci_dev_lock(hdev);
1845
1846         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1847         if (conn) {
1848         }
1849
1850         hci_dev_unlock(hdev);
1851 }
1852
1853 static inline void hci_extended_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
1854 {
1855         struct inquiry_data data;
1856         struct extended_inquiry_info *info = (void *) (skb->data + 1);
1857         int num_rsp = *((__u8 *) skb->data);
1858
1859         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
1860
1861         if (!num_rsp)
1862                 return;
1863
1864         hci_dev_lock(hdev);
1865
1866         for (; num_rsp; num_rsp--) {
1867                 bacpy(&data.bdaddr, &info->bdaddr);
1868                 data.pscan_rep_mode     = info->pscan_rep_mode;
1869                 data.pscan_period_mode  = info->pscan_period_mode;
1870                 data.pscan_mode         = 0x00;
1871                 memcpy(data.dev_class, info->dev_class, 3);
1872                 data.clock_offset       = info->clock_offset;
1873                 data.rssi               = info->rssi;
1874                 data.ssp_mode           = 0x01;
1875                 info++;
1876                 hci_inquiry_cache_update(hdev, &data);
1877         }
1878
1879         hci_dev_unlock(hdev);
1880 }
1881
1882 static inline void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
1883 {
1884         struct hci_ev_io_capa_request *ev = (void *) skb->data;
1885         struct hci_conn *conn;
1886
1887         BT_DBG("%s", hdev->name);
1888
1889         hci_dev_lock(hdev);
1890
1891         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
1892         if (!conn)
1893                 goto unlock;
1894
1895         hci_conn_hold(conn);
1896
1897         if (!test_bit(HCI_MGMT, &hdev->flags))
1898                 goto unlock;
1899
1900         if (test_bit(HCI_PAIRABLE, &hdev->flags) ||
1901                         (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
1902                 /* FIXME: Do IO capa response based on information
1903                  * provided through the management interface */
1904         } else {
1905                 struct hci_cp_io_capability_neg_reply cp;
1906
1907                 bacpy(&cp.bdaddr, &ev->bdaddr);
1908                 cp.reason = 0x16; /* Pairing not allowed */
1909
1910                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
1911                                                         sizeof(cp), &cp);
1912         }
1913
1914 unlock:
1915         hci_dev_unlock(hdev);
1916 }
1917
1918 static inline void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
1919 {
1920         struct hci_ev_io_capa_reply *ev = (void *) skb->data;
1921         struct hci_conn *conn;
1922
1923         BT_DBG("%s", hdev->name);
1924
1925         hci_dev_lock(hdev);
1926
1927         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
1928         if (!conn)
1929                 goto unlock;
1930
1931         hci_conn_hold(conn);
1932
1933         conn->remote_cap = ev->capability;
1934         conn->remote_oob = ev->oob_data;
1935         conn->remote_auth = ev->authentication;
1936
1937 unlock:
1938         hci_dev_unlock(hdev);
1939 }
1940
1941 static inline void hci_simple_pair_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1942 {
1943         struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
1944         struct hci_conn *conn;
1945
1946         BT_DBG("%s", hdev->name);
1947
1948         hci_dev_lock(hdev);
1949
1950         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
1951         if (conn)
1952                 hci_conn_put(conn);
1953
1954         hci_dev_unlock(hdev);
1955 }
1956
1957 static inline void hci_remote_host_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
1958 {
1959         struct hci_ev_remote_host_features *ev = (void *) skb->data;
1960         struct inquiry_entry *ie;
1961
1962         BT_DBG("%s", hdev->name);
1963
1964         hci_dev_lock(hdev);
1965
1966         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
1967         if (ie)
1968                 ie->data.ssp_mode = (ev->features[0] & 0x01);
1969
1970         hci_dev_unlock(hdev);
1971 }
1972
1973 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
1974 {
1975         struct hci_event_hdr *hdr = (void *) skb->data;
1976         __u8 event = hdr->evt;
1977
1978         skb_pull(skb, HCI_EVENT_HDR_SIZE);
1979
1980         switch (event) {
1981         case HCI_EV_INQUIRY_COMPLETE:
1982                 hci_inquiry_complete_evt(hdev, skb);
1983                 break;
1984
1985         case HCI_EV_INQUIRY_RESULT:
1986                 hci_inquiry_result_evt(hdev, skb);
1987                 break;
1988
1989         case HCI_EV_CONN_COMPLETE:
1990                 hci_conn_complete_evt(hdev, skb);
1991                 break;
1992
1993         case HCI_EV_CONN_REQUEST:
1994                 hci_conn_request_evt(hdev, skb);
1995                 break;
1996
1997         case HCI_EV_DISCONN_COMPLETE:
1998                 hci_disconn_complete_evt(hdev, skb);
1999                 break;
2000
2001         case HCI_EV_AUTH_COMPLETE:
2002                 hci_auth_complete_evt(hdev, skb);
2003                 break;
2004
2005         case HCI_EV_REMOTE_NAME:
2006                 hci_remote_name_evt(hdev, skb);
2007                 break;
2008
2009         case HCI_EV_ENCRYPT_CHANGE:
2010                 hci_encrypt_change_evt(hdev, skb);
2011                 break;
2012
2013         case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
2014                 hci_change_link_key_complete_evt(hdev, skb);
2015                 break;
2016
2017         case HCI_EV_REMOTE_FEATURES:
2018                 hci_remote_features_evt(hdev, skb);
2019                 break;
2020
2021         case HCI_EV_REMOTE_VERSION:
2022                 hci_remote_version_evt(hdev, skb);
2023                 break;
2024
2025         case HCI_EV_QOS_SETUP_COMPLETE:
2026                 hci_qos_setup_complete_evt(hdev, skb);
2027                 break;
2028
2029         case HCI_EV_CMD_COMPLETE:
2030                 hci_cmd_complete_evt(hdev, skb);
2031                 break;
2032
2033         case HCI_EV_CMD_STATUS:
2034                 hci_cmd_status_evt(hdev, skb);
2035                 break;
2036
2037         case HCI_EV_ROLE_CHANGE:
2038                 hci_role_change_evt(hdev, skb);
2039                 break;
2040
2041         case HCI_EV_NUM_COMP_PKTS:
2042                 hci_num_comp_pkts_evt(hdev, skb);
2043                 break;
2044
2045         case HCI_EV_MODE_CHANGE:
2046                 hci_mode_change_evt(hdev, skb);
2047                 break;
2048
2049         case HCI_EV_PIN_CODE_REQ:
2050                 hci_pin_code_request_evt(hdev, skb);
2051                 break;
2052
2053         case HCI_EV_LINK_KEY_REQ:
2054                 hci_link_key_request_evt(hdev, skb);
2055                 break;
2056
2057         case HCI_EV_LINK_KEY_NOTIFY:
2058                 hci_link_key_notify_evt(hdev, skb);
2059                 break;
2060
2061         case HCI_EV_CLOCK_OFFSET:
2062                 hci_clock_offset_evt(hdev, skb);
2063                 break;
2064
2065         case HCI_EV_PKT_TYPE_CHANGE:
2066                 hci_pkt_type_change_evt(hdev, skb);
2067                 break;
2068
2069         case HCI_EV_PSCAN_REP_MODE:
2070                 hci_pscan_rep_mode_evt(hdev, skb);
2071                 break;
2072
2073         case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
2074                 hci_inquiry_result_with_rssi_evt(hdev, skb);
2075                 break;
2076
2077         case HCI_EV_REMOTE_EXT_FEATURES:
2078                 hci_remote_ext_features_evt(hdev, skb);
2079                 break;
2080
2081         case HCI_EV_SYNC_CONN_COMPLETE:
2082                 hci_sync_conn_complete_evt(hdev, skb);
2083                 break;
2084
2085         case HCI_EV_SYNC_CONN_CHANGED:
2086                 hci_sync_conn_changed_evt(hdev, skb);
2087                 break;
2088
2089         case HCI_EV_SNIFF_SUBRATE:
2090                 hci_sniff_subrate_evt(hdev, skb);
2091                 break;
2092
2093         case HCI_EV_EXTENDED_INQUIRY_RESULT:
2094                 hci_extended_inquiry_result_evt(hdev, skb);
2095                 break;
2096
2097         case HCI_EV_IO_CAPA_REQUEST:
2098                 hci_io_capa_request_evt(hdev, skb);
2099                 break;
2100
2101         case HCI_EV_IO_CAPA_REPLY:
2102                 hci_io_capa_reply_evt(hdev, skb);
2103                 break;
2104
2105         case HCI_EV_SIMPLE_PAIR_COMPLETE:
2106                 hci_simple_pair_complete_evt(hdev, skb);
2107                 break;
2108
2109         case HCI_EV_REMOTE_HOST_FEATURES:
2110                 hci_remote_host_features_evt(hdev, skb);
2111                 break;
2112
2113         default:
2114                 BT_DBG("%s event 0x%x", hdev->name, event);
2115                 break;
2116         }
2117
2118         kfree_skb(skb);
2119         hdev->stat.evt_rx++;
2120 }
2121
2122 /* Generate internal stack event */
2123 void hci_si_event(struct hci_dev *hdev, int type, int dlen, void *data)
2124 {
2125         struct hci_event_hdr *hdr;
2126         struct hci_ev_stack_internal *ev;
2127         struct sk_buff *skb;
2128
2129         skb = bt_skb_alloc(HCI_EVENT_HDR_SIZE + sizeof(*ev) + dlen, GFP_ATOMIC);
2130         if (!skb)
2131                 return;
2132
2133         hdr = (void *) skb_put(skb, HCI_EVENT_HDR_SIZE);
2134         hdr->evt  = HCI_EV_STACK_INTERNAL;
2135         hdr->plen = sizeof(*ev) + dlen;
2136
2137         ev  = (void *) skb_put(skb, sizeof(*ev) + dlen);
2138         ev->type = type;
2139         memcpy(ev->data, data, dlen);
2140
2141         bt_cb(skb)->incoming = 1;
2142         __net_timestamp(skb);
2143
2144         bt_cb(skb)->pkt_type = HCI_EVENT_PKT;
2145         skb->dev = (void *) hdev;
2146         hci_send_to_sock(hdev, skb, NULL);
2147         kfree_skb(skb);
2148 }