net/bluetooth/hci_event.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2000-2001 Qualcomm Incorporated
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI event handling. */
  26
  27 #include <linux/config.h>
  28 #include <linux/module.h>
  29
  30 #include <linux/types.h>
  31 #include <linux/errno.h>
  32 #include <linux/kernel.h>
  33 #include <linux/major.h>
  34 #include <linux/sched.h>
  35 #include <linux/slab.h>
  36 #include <linux/poll.h>
  37 #include <linux/fcntl.h>
  38 #include <linux/init.h>
  39 #include <linux/skbuff.h>
  40 #include <linux/interrupt.h>
  41 #include <linux/notifier.h>
  42 #include <net/sock.h>
  43
  44 #include <asm/system.h>
  45 #include <asm/uaccess.h>
  46 #include <asm/unaligned.h>
  47
  48 #include <net/bluetooth/bluetooth.h>
  49 #include <net/bluetooth/hci_core.h>
  50
  51 #ifndef CONFIG_BT_HCI_CORE_DEBUG
  52 #undef  BT_DBG
  53 #define BT_DBG(D...)
  54 #endif
  55
  56 /* Handle HCI Event packets */
  57
  58 /* Command Complete OGF LINK_CTL  */
  59 static void hci_cc_link_ctl(struct hci_dev *hdev, __u16 ocf, struct sk_buff *skb)
  60 {
  61         __u8 status;
  62
  63         BT_DBG("%s ocf 0x%x", hdev->name, ocf);
  64
  65         switch (ocf) {
  66         case OCF_INQUIRY_CANCEL:
  67                 status = *((__u8 *) skb->data);
  68
  69                 if (status) {
  70                         BT_DBG("%s Inquiry cancel error: status 0x%x", hdev->name, status);
  71                 } else {
  72                         clear_bit(HCI_INQUIRY, &hdev->flags);
  73                         hci_req_complete(hdev, status);
  74                 }
  75                 break;
  76
  77         default:
  78                 BT_DBG("%s Command complete: ogf LINK_CTL ocf %x", hdev->name, ocf);
  79                 break;
  80         }
  81 }
  82
  83 /* Command Complete OGF LINK_POLICY  */
  84 static void hci_cc_link_policy(struct hci_dev *hdev, __u16 ocf, struct sk_buff *skb)
  85 {
  86         struct hci_conn *conn;
  87         struct hci_rp_role_discovery *rd;
  88
  89         BT_DBG("%s ocf 0x%x", hdev->name, ocf);
  90
  91         switch (ocf) {
  92         case OCF_ROLE_DISCOVERY:
  93                 rd = (void *) skb->data;
  94
  95                 if (rd->status)
  96                         break;
  97
  98                 hci_dev_lock(hdev);
  99
 100                 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rd->handle));
 101                 if (conn) {
 102                         if (rd->role)
 103                                 conn->link_mode &= ~HCI_LM_MASTER;
 104                         else
 105                                 conn->link_mode |= HCI_LM_MASTER;
 106                 }
 107
 108                 hci_dev_unlock(hdev);
 109                 break;
 110
 111         default:
 112                 BT_DBG("%s: Command complete: ogf LINK_POLICY ocf %x",
 113                                 hdev->name, ocf);
 114                 break;
 115         }
 116 }
 117
 118 /* Command Complete OGF HOST_CTL  */
 119 static void hci_cc_host_ctl(struct hci_dev *hdev, __u16 ocf, struct sk_buff *skb)
 120 {
 121         __u8 status, param;
 122         __u16 setting;
 123         struct hci_rp_read_voice_setting *vs;
 124         void *sent;
 125
 126         BT_DBG("%s ocf 0x%x", hdev->name, ocf);
 127
 128         switch (ocf) {
 129         case OCF_RESET:
 130                 status = *((__u8 *) skb->data);
 131                 hci_req_complete(hdev, status);
 132                 break;
 133
 134         case OCF_SET_EVENT_FLT:
 135                 status = *((__u8 *) skb->data);
 136                 if (status) {
 137                         BT_DBG("%s SET_EVENT_FLT failed %d", hdev->name, status);
 138                 } else {
 139                         BT_DBG("%s SET_EVENT_FLT succeseful", hdev->name);
 140                 }
 141                 break;
 142
 143         case OCF_WRITE_AUTH_ENABLE:
 144                 sent = hci_sent_cmd_data(hdev, OGF_HOST_CTL, OCF_WRITE_AUTH_ENABLE);
 145                 if (!sent)
 146                         break;
 147
 148                 status = *((__u8 *) skb->data);
 149                 param  = *((__u8 *) sent);
 150
 151                 if (!status) {
 152                         if (param == AUTH_ENABLED)
 153                                 set_bit(HCI_AUTH, &hdev->flags);
 154                         else
 155                                 clear_bit(HCI_AUTH, &hdev->flags);
 156                 }
 157                 hci_req_complete(hdev, status);
 158                 break;
 159
 160         case OCF_WRITE_ENCRYPT_MODE:
 161                 sent = hci_sent_cmd_data(hdev, OGF_HOST_CTL, OCF_WRITE_ENCRYPT_MODE);
 162                 if (!sent)
 163                         break;
 164
 165                 status = *((__u8 *) skb->data);
 166                 param  = *((__u8 *) sent);
 167
 168                 if (!status) {
 169                         if (param)
 170                                 set_bit(HCI_ENCRYPT, &hdev->flags);
 171                         else
 172                                 clear_bit(HCI_ENCRYPT, &hdev->flags);
 173                 }
 174                 hci_req_complete(hdev, status);
 175                 break;
 176
 177         case OCF_WRITE_CA_TIMEOUT:
 178                 status = *((__u8 *) skb->data);
 179                 if (status) {
 180                         BT_DBG("%s OCF_WRITE_CA_TIMEOUT failed %d", hdev->name, status);
 181                 } else {
 182                         BT_DBG("%s OCF_WRITE_CA_TIMEOUT succeseful", hdev->name);
 183                 }
 184                 break;
 185
 186         case OCF_WRITE_PG_TIMEOUT:
 187                 status = *((__u8 *) skb->data);
 188                 if (status) {
 189                         BT_DBG("%s OCF_WRITE_PG_TIMEOUT failed %d", hdev->name, status);
 190                 } else {
 191                         BT_DBG("%s: OCF_WRITE_PG_TIMEOUT succeseful", hdev->name);
 192                 }
 193                 break;
 194
 195         case OCF_WRITE_SCAN_ENABLE:
 196                 sent = hci_sent_cmd_data(hdev, OGF_HOST_CTL, OCF_WRITE_SCAN_ENABLE);
 197                 if (!sent)
 198                         break;
 199
 200                 status = *((__u8 *) skb->data);
 201                 param  = *((__u8 *) sent);
 202
 203                 BT_DBG("param 0x%x", param);
 204
 205                 if (!status) {
 206                         clear_bit(HCI_PSCAN, &hdev->flags);
 207                         clear_bit(HCI_ISCAN, &hdev->flags);
 208                         if (param & SCAN_INQUIRY)
 209                                 set_bit(HCI_ISCAN, &hdev->flags);
 210
 211                         if (param & SCAN_PAGE)
 212                                 set_bit(HCI_PSCAN, &hdev->flags);
 213                 }
 214                 hci_req_complete(hdev, status);
 215                 break;
 216
 217         case OCF_READ_VOICE_SETTING:
 218                 vs = (struct hci_rp_read_voice_setting *) skb->data;
 219
 220                 if (vs->status) {
 221                         BT_DBG("%s READ_VOICE_SETTING failed %d", hdev->name, vs->status);
 222                         break;
 223                 }
 224
 225                 setting = __le16_to_cpu(vs->voice_setting);
 226
 227                 if (hdev->voice_setting != setting ) {
 228                         hdev->voice_setting = setting;
 229
 230                         BT_DBG("%s: voice setting 0x%04x", hdev->name, setting);
 231
 232                         if (hdev->notify)
 233                                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 234                 }
 235                 break;
 236
 237         case OCF_WRITE_VOICE_SETTING:
 238                 sent = hci_sent_cmd_data(hdev, OGF_HOST_CTL, OCF_WRITE_VOICE_SETTING);
 239                 if (!sent)
 240                         break;
 241
 242                 status = *((__u8 *) skb->data);
 243                 setting = __le16_to_cpu(get_unaligned((__u16 *) sent));
 244
 245                 if (!status && hdev->voice_setting != setting) {
 246                         hdev->voice_setting = setting;
 247
 248                         BT_DBG("%s: voice setting 0x%04x", hdev->name, setting);
 249
 250                         if (hdev->notify)
 251                                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 252                 }
 253                 hci_req_complete(hdev, status);
 254                 break;
 255
 256         case OCF_HOST_BUFFER_SIZE:
 257                 status = *((__u8 *) skb->data);
 258                 if (status) {
 259                         BT_DBG("%s OCF_BUFFER_SIZE failed %d", hdev->name, status);
 260                         hci_req_complete(hdev, status);
 261                 }
 262                 break;
 263
 264         default:
 265                 BT_DBG("%s Command complete: ogf HOST_CTL ocf %x", hdev->name, ocf);
 266                 break;
 267         }
 268 }
 269
 270 /* Command Complete OGF INFO_PARAM  */
 271 static void hci_cc_info_param(struct hci_dev *hdev, __u16 ocf, struct sk_buff *skb)
 272 {
 273         struct hci_rp_read_loc_features *lf;
 274         struct hci_rp_read_buffer_size *bs;
 275         struct hci_rp_read_bd_addr *ba;
 276
 277         BT_DBG("%s ocf 0x%x", hdev->name, ocf);
 278
 279         switch (ocf) {
 280         case OCF_READ_LOCAL_FEATURES:
 281                 lf = (struct hci_rp_read_loc_features *) skb->data;
 282
 283                 if (lf->status) {
 284                         BT_DBG("%s READ_LOCAL_FEATURES failed %d", hdev->name, lf->status);
 285                         break;
 286                 }
 287
 288                 memcpy(hdev->features, lf->features, sizeof(hdev->features));
 289
 290                 /* Adjust default settings according to features
 291                  * supported by device. */
 292                 if (hdev->features[0] & LMP_3SLOT)
 293                         hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 294
 295                 if (hdev->features[0] & LMP_5SLOT)
 296                         hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 297
 298                 if (hdev->features[1] & LMP_HV2)
 299                         hdev->pkt_type |= (HCI_HV2);
 300
 301                 if (hdev->features[1] & LMP_HV3)
 302                         hdev->pkt_type |= (HCI_HV3);
 303
 304                 BT_DBG("%s: features 0x%x 0x%x 0x%x", hdev->name, lf->features[0], lf->features[1], lf->features[2]);
 305
 306                 break;
 307
 308         case OCF_READ_BUFFER_SIZE:
 309                 bs = (struct hci_rp_read_buffer_size *) skb->data;
 310
 311                 if (bs->status) {
 312                         BT_DBG("%s READ_BUFFER_SIZE failed %d", hdev->name, bs->status);
 313                         hci_req_complete(hdev, bs->status);
 314                         break;
 315                 }
 316
 317                 hdev->acl_mtu  = __le16_to_cpu(bs->acl_mtu);
 318                 hdev->sco_mtu  = bs->sco_mtu ? bs->sco_mtu : 64;
 319                 hdev->acl_pkts = hdev->acl_cnt = __le16_to_cpu(bs->acl_max_pkt);
 320                 hdev->sco_pkts = hdev->sco_cnt = __le16_to_cpu(bs->sco_max_pkt);
 321
 322                 BT_DBG("%s mtu: acl %d, sco %d max_pkt: acl %d, sco %d", hdev->name,
 323                             hdev->acl_mtu, hdev->sco_mtu, hdev->acl_pkts, hdev->sco_pkts);
 324                 break;
 325
 326         case OCF_READ_BD_ADDR:
 327                 ba = (struct hci_rp_read_bd_addr *) skb->data;
 328
 329                 if (!ba->status) {
 330                         bacpy(&hdev->bdaddr, &ba->bdaddr);
 331                 } else {
 332                         BT_DBG("%s: READ_BD_ADDR failed %d", hdev->name, ba->status);
 333                 }
 334
 335                 hci_req_complete(hdev, ba->status);
 336                 break;
 337
 338         default:
 339                 BT_DBG("%s Command complete: ogf INFO_PARAM ocf %x", hdev->name, ocf);
 340                 break;
 341         }
 342 }
 343
 344 /* Command Status OGF LINK_CTL  */
 345 static inline void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
 346 {
 347         struct hci_conn *conn;
 348         struct hci_cp_create_conn *cp = hci_sent_cmd_data(hdev, OGF_LINK_CTL, OCF_CREATE_CONN);
 349
 350         if (!cp)
 351                 return;
 352
 353         hci_dev_lock(hdev);
 354
 355         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 356
 357         BT_DBG("%s status 0x%x bdaddr %s conn %p", hdev->name,
 358                         status, batostr(&cp->bdaddr), conn);
 359
 360         if (status) {
 361                 if (conn) {
 362                         conn->state = BT_CLOSED;
 363                         hci_proto_connect_cfm(conn, status);
 364                         hci_conn_del(conn);
 365                 }
 366         } else {
 367                 if (!conn) {
 368                         conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr);
 369                         if (conn) {
 370                                 conn->out = 1;
 371                                 conn->link_mode |= HCI_LM_MASTER;
 372                         } else
 373                                 BT_ERR("No memmory for new connection");
 374                 }
 375         }
 376
 377         hci_dev_unlock(hdev);
 378 }
 379
 380 static void hci_cs_link_ctl(struct hci_dev *hdev, __u16 ocf, __u8 status)
 381 {
 382         BT_DBG("%s ocf 0x%x", hdev->name, ocf);
 383
 384         switch (ocf) {
 385         case OCF_CREATE_CONN:
 386                 hci_cs_create_conn(hdev, status);
 387                 break;
 388
 389         case OCF_ADD_SCO:
 390                 if (status) {
 391                         struct hci_conn *acl, *sco;
 392                         struct hci_cp_add_sco *cp = hci_sent_cmd_data(hdev, OGF_LINK_CTL, OCF_ADD_SCO);
 393                         __u16 handle;
 394
 395                         if (!cp)
 396                                 break;
 397
 398                         handle = __le16_to_cpu(cp->handle);
 399
 400                         BT_DBG("%s Add SCO error: handle %d status 0x%x", hdev->name, handle, status);
 401
 402                         hci_dev_lock(hdev);
 403
 404                         acl = hci_conn_hash_lookup_handle(hdev, handle);
 405                         if (acl && (sco = acl->link)) {
 406                                 sco->state = BT_CLOSED;
 407
 408                                 hci_proto_connect_cfm(sco, status);
 409                                 hci_conn_del(sco);
 410                         }
 411
 412                         hci_dev_unlock(hdev);
 413                 }
 414                 break;
 415
 416         case OCF_INQUIRY:
 417                 if (status) {
 418                         BT_DBG("%s Inquiry error: status 0x%x", hdev->name, status);
 419                         hci_req_complete(hdev, status);
 420                 } else {
 421                         set_bit(HCI_INQUIRY, &hdev->flags);
 422                 }
 423                 break;
 424
 425         default:
 426                 BT_DBG("%s Command status: ogf LINK_CTL ocf %x status %d",
 427                         hdev->name, ocf, status);
 428                 break;
 429         }
 430 }
 431
 432 /* Command Status OGF LINK_POLICY */
 433 static void hci_cs_link_policy(struct hci_dev *hdev, __u16 ocf, __u8 status)
 434 {
 435         BT_DBG("%s ocf 0x%x", hdev->name, ocf);
 436
 437         switch (ocf) {
 438         default:
 439                 BT_DBG("%s Command status: ogf HOST_POLICY ocf %x", hdev->name, ocf);
 440                 break;
 441         }
 442 }
 443
 444 /* Command Status OGF HOST_CTL */
 445 static void hci_cs_host_ctl(struct hci_dev *hdev, __u16 ocf, __u8 status)
 446 {
 447         BT_DBG("%s ocf 0x%x", hdev->name, ocf);
 448
 449         switch (ocf) {
 450         default:
 451                 BT_DBG("%s Command status: ogf HOST_CTL ocf %x", hdev->name, ocf);
 452                 break;
 453         }
 454 }
 455
 456 /* Command Status OGF INFO_PARAM  */
 457 static void hci_cs_info_param(struct hci_dev *hdev, __u16 ocf, __u8 status)
 458 {
 459         BT_DBG("%s: hci_cs_info_param: ocf 0x%x", hdev->name, ocf);
 460
 461         switch (ocf) {
 462         default:
 463                 BT_DBG("%s Command status: ogf INFO_PARAM ocf %x", hdev->name, ocf);
 464                 break;
 465         }
 466 }
 467
 468 /* Inquiry Complete */
 469 static inline void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 470 {
 471         __u8 status = *((__u8 *) skb->data);
 472
 473         BT_DBG("%s status %d", hdev->name, status);
 474
 475         clear_bit(HCI_INQUIRY, &hdev->flags);
 476         hci_req_complete(hdev, status);
 477 }
 478
 479 /* Inquiry Result */
 480 static inline void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
 481 {
 482         struct inquiry_info *info = (struct inquiry_info *) (skb->data + 1);
 483         int num_rsp = *((__u8 *) skb->data);
 484
 485         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
 486
 487         hci_dev_lock(hdev);
 488         for (; num_rsp; num_rsp--)
 489                 inquiry_cache_update(hdev, info++);
 490         hci_dev_unlock(hdev);
 491 }
 492
 493 /* Inquiry Result With RSSI */
 494 static inline void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, struct sk_buff *skb)
 495 {
 496         struct inquiry_info_with_rssi *info = (struct inquiry_info_with_rssi *) (skb->data + 1);
 497         int num_rsp = *((__u8 *) skb->data);
 498
 499         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
 500
 501         hci_dev_lock(hdev);
 502         for (; num_rsp; num_rsp--) {
 503                 struct inquiry_info tmp;
 504                 bacpy(&tmp.bdaddr, &info->bdaddr);
 505                 tmp.pscan_rep_mode    = info->pscan_rep_mode;
 506                 tmp.pscan_period_mode = info->pscan_period_mode;
 507                 tmp.pscan_mode        = 0x00;
 508                 memcpy(tmp.dev_class, &info->dev_class, 3);
 509                 tmp.clock_offset      = info->clock_offset;
 510                 info++;
 511                 inquiry_cache_update(hdev, &tmp);
 512         }
 513         hci_dev_unlock(hdev);
 514 }
 515
 516 /* Connect Request */
 517 static inline void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
 518 {
 519         struct hci_ev_conn_request *ev = (struct hci_ev_conn_request *) skb->data;
 520         int mask = hdev->link_mode;
 521
 522         BT_DBG("%s Connection request: %s type 0x%x", hdev->name,
 523                         batostr(&ev->bdaddr), ev->link_type);
 524
 525         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type);
 526
 527         if (mask & HCI_LM_ACCEPT) {
 528                 /* Connection accepted */
 529                 struct hci_conn *conn;
 530                 struct hci_cp_accept_conn_req cp;
 531
 532                 hci_dev_lock(hdev);
 533                 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
 534                 if (!conn) {
 535                         if (!(conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr))) {
 536                                 BT_ERR("No memmory for new connection");
 537                                 hci_dev_unlock(hdev);
 538                                 return;
 539                         }
 540                 }
 541                 conn->state = BT_CONNECT;
 542                 hci_dev_unlock(hdev);
 543
 544                 bacpy(&cp.bdaddr, &ev->bdaddr);
 545
 546                 if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
 547                         cp.role = 0x00; /* Become master */
 548                 else
 549                         cp.role = 0x01; /* Remain slave */
 550
 551                 hci_send_cmd(hdev, OGF_LINK_CTL, OCF_ACCEPT_CONN_REQ, sizeof(cp), &cp);
 552         } else {
 553                 /* Connection rejected */
 554                 struct hci_cp_reject_conn_req cp;
 555
 556                 bacpy(&cp.bdaddr, &ev->bdaddr);
 557                 cp.reason = 0x0f;
 558                 hci_send_cmd(hdev, OGF_LINK_CTL, OCF_REJECT_CONN_REQ, sizeof(cp), &cp);
 559         }
 560 }
 561
 562 /* Connect Complete */
 563 static inline void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 564 {
 565         struct hci_ev_conn_complete *ev = (struct hci_ev_conn_complete *) skb->data;
 566         struct hci_conn *conn = NULL;
 567
 568         BT_DBG("%s", hdev->name);
 569
 570         hci_dev_lock(hdev);
 571
 572         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
 573         if (!conn) {
 574                 hci_dev_unlock(hdev);
 575                 return;
 576         }
 577
 578         if (!ev->status) {
 579                 conn->handle = __le16_to_cpu(ev->handle);
 580                 conn->state  = BT_CONNECTED;
 581
 582                 if (test_bit(HCI_AUTH, &hdev->flags))
 583                         conn->link_mode |= HCI_LM_AUTH;
 584
 585                 if (test_bit(HCI_ENCRYPT, &hdev->flags))
 586                         conn->link_mode |= HCI_LM_ENCRYPT;
 587
 588
 589                 /* Set link policy */
 590                 if (conn->type == ACL_LINK && hdev->link_policy) {
 591                         struct hci_cp_write_link_policy cp;
 592                         cp.handle = ev->handle;
 593                         cp.policy = __cpu_to_le16(hdev->link_policy);
 594                         hci_send_cmd(hdev, OGF_LINK_POLICY, OCF_WRITE_LINK_POLICY, sizeof(cp), &cp);
 595                 }
 596
 597                 /* Set packet type for incoming connection */
 598                 if (!conn->out) {
 599                         struct hci_cp_change_conn_ptype cp;
 600                         cp.handle = ev->handle;
 601                         cp.pkt_type = (conn->type == ACL_LINK) ?
 602                                 __cpu_to_le16(hdev->pkt_type & ACL_PTYPE_MASK):
 603                                 __cpu_to_le16(hdev->pkt_type & SCO_PTYPE_MASK);
 604
 605                         hci_send_cmd(hdev, OGF_LINK_CTL, OCF_CHANGE_CONN_PTYPE, sizeof(cp), &cp);
 606                 }
 607         } else
 608                 conn->state = BT_CLOSED;
 609
 610         if (conn->type == ACL_LINK) {
 611                 struct hci_conn *sco = conn->link;
 612                 if (sco) {
 613                         if (!ev->status)
 614                                 hci_add_sco(sco, conn->handle);
 615                         else {
 616                                 hci_proto_connect_cfm(sco, ev->status);
 617                                 hci_conn_del(sco);
 618                         }
 619                 }
 620         }
 621
 622         hci_proto_connect_cfm(conn, ev->status);
 623         if (ev->status)
 624                 hci_conn_del(conn);
 625
 626         hci_dev_unlock(hdev);
 627 }
 628
 629 /* Disconnect Complete */
 630 static inline void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 631 {
 632         struct hci_ev_disconn_complete *ev = (struct hci_ev_disconn_complete *) skb->data;
 633         struct hci_conn *conn = NULL;
 634         __u16 handle = __le16_to_cpu(ev->handle);
 635
 636         BT_DBG("%s status %d", hdev->name, ev->status);
 637
 638         if (ev->status)
 639                 return;
 640
 641         hci_dev_lock(hdev);
 642
 643         conn = hci_conn_hash_lookup_handle(hdev, handle);
 644         if (conn) {
 645                 conn->state = BT_CLOSED;
 646                 hci_proto_disconn_ind(conn, ev->reason);
 647                 hci_conn_del(conn);
 648         }
 649
 650         hci_dev_unlock(hdev);
 651 }
 652
 653 /* Number of completed packets */
 654 static inline void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
 655 {
 656         struct hci_ev_num_comp_pkts *ev = (struct hci_ev_num_comp_pkts *) skb->data;
 657         __u16 *ptr;
 658         int i;
 659
 660         skb_pull(skb, sizeof(*ev));
 661
 662         BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
 663
 664         if (skb->len < ev->num_hndl * 4) {
 665                 BT_DBG("%s bad parameters", hdev->name);
 666                 return;
 667         }
 668
 669         tasklet_disable(&hdev->tx_task);
 670
 671         for (i = 0, ptr = (__u16 *) skb->data; i < ev->num_hndl; i++) {
 672                 struct hci_conn *conn;
 673                 __u16  handle, count;
 674
 675                 handle = __le16_to_cpu(get_unaligned(ptr++));
 676                 count  = __le16_to_cpu(get_unaligned(ptr++));
 677
 678                 conn = hci_conn_hash_lookup_handle(hdev, handle);
 679                 if (conn) {
 680                         conn->sent -= count;
 681
 682                         if (conn->type == SCO_LINK) {
 683                                 if ((hdev->sco_cnt += count) > hdev->sco_pkts)
 684                                         hdev->sco_cnt = hdev->sco_pkts;
 685                         } else {
 686                                 if ((hdev->acl_cnt += count) > hdev->acl_pkts)
 687                                         hdev->acl_cnt = hdev->acl_pkts;
 688                         }
 689                 }
 690         }
 691         hci_sched_tx(hdev);
 692
 693         tasklet_enable(&hdev->tx_task);
 694 }
 695
 696 /* Role Change */
 697 static inline void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
 698 {
 699         struct hci_ev_role_change *ev = (struct hci_ev_role_change *) skb->data;
 700         struct hci_conn *conn = NULL;
 701
 702         BT_DBG("%s status %d", hdev->name, ev->status);
 703
 704         if (ev->status)
 705                 return;
 706
 707         hci_dev_lock(hdev);
 708
 709         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
 710         if (conn) {
 711                 if (ev->role)
 712                         conn->link_mode &= ~HCI_LM_MASTER;
 713                 else
 714                         conn->link_mode |= HCI_LM_MASTER;
 715         }
 716
 717         hci_dev_unlock(hdev);
 718 }
 719
 720 /* Authentication Complete */
 721 static inline void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 722 {
 723         struct hci_ev_auth_complete *ev = (struct hci_ev_auth_complete *) skb->data;
 724         struct hci_conn *conn = NULL;
 725         __u16 handle = __le16_to_cpu(ev->handle);
 726
 727         BT_DBG("%s status %d", hdev->name, ev->status);
 728
 729         hci_dev_lock(hdev);
 730
 731         conn = hci_conn_hash_lookup_handle(hdev, handle);
 732         if (conn) {
 733                 if (!ev->status)
 734                         conn->link_mode |= HCI_LM_AUTH;
 735                 clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
 736
 737                 hci_proto_auth_cfm(conn, ev->status);
 738
 739                 if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend)) {
 740                         if (!ev->status) {
 741                                 struct hci_cp_set_conn_encrypt cp;
 742                                 cp.handle  = __cpu_to_le16(conn->handle);
 743                                 cp.encrypt = 1;
 744                                 hci_send_cmd(conn->hdev, OGF_LINK_CTL,
 745                                                 OCF_SET_CONN_ENCRYPT,
 746                                                 sizeof(cp), &cp);
 747                         } else {
 748                                 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
 749                                 hci_proto_encrypt_cfm(conn, ev->status);
 750                         }
 751                 }
 752         }
 753
 754         hci_dev_unlock(hdev);
 755 }
 756
 757 /* Encryption Change */
 758 static inline void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
 759 {
 760         struct hci_ev_encrypt_change *ev = (struct hci_ev_encrypt_change *) skb->data;
 761         struct hci_conn *conn = NULL;
 762         __u16 handle = __le16_to_cpu(ev->handle);
 763
 764         BT_DBG("%s status %d", hdev->name, ev->status);
 765
 766         hci_dev_lock(hdev);
 767
 768         conn = hci_conn_hash_lookup_handle(hdev, handle);
 769         if (conn) {
 770                 if (!ev->status) {
 771                         if (ev->encrypt)
 772                                 conn->link_mode |= HCI_LM_ENCRYPT;
 773                         else
 774                                 conn->link_mode &= ~HCI_LM_ENCRYPT;
 775                 }
 776                 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
 777
 778                 hci_proto_encrypt_cfm(conn, ev->status);
 779         }
 780
 781         hci_dev_unlock(hdev);
 782 }
 783
 784 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
 785 {
 786         struct hci_event_hdr *hdr = (struct hci_event_hdr *) skb->data;
 787         struct hci_ev_cmd_complete *ec;
 788         struct hci_ev_cmd_status *cs;
 789         u16 opcode, ocf, ogf;
 790
 791         skb_pull(skb, HCI_EVENT_HDR_SIZE);
 792
 793         BT_DBG("%s evt 0x%x", hdev->name, hdr->evt);
 794
 795         switch (hdr->evt) {
 796         case HCI_EV_NUM_COMP_PKTS:
 797                 hci_num_comp_pkts_evt(hdev, skb);
 798                 break;
 799
 800         case HCI_EV_INQUIRY_COMPLETE:
 801                 hci_inquiry_complete_evt(hdev, skb);
 802                 break;
 803
 804         case HCI_EV_INQUIRY_RESULT:
 805                 hci_inquiry_result_evt(hdev, skb);
 806                 break;
 807
 808         case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
 809                 hci_inquiry_result_with_rssi_evt(hdev, skb);
 810                 break;
 811
 812         case HCI_EV_CONN_REQUEST:
 813                 hci_conn_request_evt(hdev, skb);
 814                 break;
 815
 816         case HCI_EV_CONN_COMPLETE:
 817                 hci_conn_complete_evt(hdev, skb);
 818                 break;
 819
 820         case HCI_EV_DISCONN_COMPLETE:
 821                 hci_disconn_complete_evt(hdev, skb);
 822                 break;
 823
 824         case HCI_EV_ROLE_CHANGE:
 825                 hci_role_change_evt(hdev, skb);
 826                 break;
 827
 828         case HCI_EV_AUTH_COMPLETE:
 829                 hci_auth_complete_evt(hdev, skb);
 830                 break;
 831
 832         case HCI_EV_ENCRYPT_CHANGE:
 833                 hci_encrypt_change_evt(hdev, skb);
 834                 break;
 835
 836         case HCI_EV_CMD_STATUS:
 837                 cs = (struct hci_ev_cmd_status *) skb->data;
 838                 skb_pull(skb, sizeof(cs));
 839
 840                 opcode = __le16_to_cpu(cs->opcode);
 841                 ogf = hci_opcode_ogf(opcode);
 842                 ocf = hci_opcode_ocf(opcode);
 843
 844                 switch (ogf) {
 845                 case OGF_INFO_PARAM:
 846                         hci_cs_info_param(hdev, ocf, cs->status);
 847                         break;
 848
 849                 case OGF_HOST_CTL:
 850                         hci_cs_host_ctl(hdev, ocf, cs->status);
 851                         break;
 852
 853                 case OGF_LINK_CTL:
 854                         hci_cs_link_ctl(hdev, ocf, cs->status);
 855                         break;
 856
 857                 case OGF_LINK_POLICY:
 858                         hci_cs_link_policy(hdev, ocf, cs->status);
 859                         break;
 860
 861                 default:
 862                         BT_DBG("%s Command Status OGF %x", hdev->name, ogf);
 863                         break;
 864                 }
 865
 866                 if (cs->ncmd) {
 867                         atomic_set(&hdev->cmd_cnt, 1);
 868                         if (!skb_queue_empty(&hdev->cmd_q))
 869                                 hci_sched_cmd(hdev);
 870                 }
 871                 break;
 872
 873         case HCI_EV_CMD_COMPLETE:
 874                 ec = (struct hci_ev_cmd_complete *) skb->data;
 875                 skb_pull(skb, sizeof(*ec));
 876
 877                 opcode = __le16_to_cpu(ec->opcode);
 878                 ogf = hci_opcode_ogf(opcode);
 879                 ocf = hci_opcode_ocf(opcode);
 880
 881                 switch (ogf) {
 882                 case OGF_INFO_PARAM:
 883                         hci_cc_info_param(hdev, ocf, skb);
 884                         break;
 885
 886                 case OGF_HOST_CTL:
 887                         hci_cc_host_ctl(hdev, ocf, skb);
 888                         break;
 889
 890                 case OGF_LINK_CTL:
 891                         hci_cc_link_ctl(hdev, ocf, skb);
 892                         break;
 893
 894                 case OGF_LINK_POLICY:
 895                         hci_cc_link_policy(hdev, ocf, skb);
 896                         break;
 897
 898                 default:
 899                         BT_DBG("%s Command Completed OGF %x", hdev->name, ogf);
 900                         break;
 901                 }
 902
 903                 if (ec->ncmd) {
 904                         atomic_set(&hdev->cmd_cnt, 1);
 905                         if (!skb_queue_empty(&hdev->cmd_q))
 906                                 hci_sched_cmd(hdev);
 907                 }
 908                 break;
 909         }
 910
 911         kfree_skb(skb);
 912         hdev->stat.evt_rx++;
 913 }
 914
 915 /* Generate internal stack event */
 916 void hci_si_event(struct hci_dev *hdev, int type, int dlen, void *data)
 917 {
 918         struct hci_event_hdr *hdr;
 919         struct hci_ev_stack_internal *ev;
 920         struct sk_buff *skb;
 921
 922         skb = bt_skb_alloc(HCI_EVENT_HDR_SIZE + sizeof(*ev) + dlen, GFP_ATOMIC);
 923         if (!skb)
 924                 return;
 925
 926         hdr = (void *) skb_put(skb, HCI_EVENT_HDR_SIZE);
 927         hdr->evt  = HCI_EV_STACK_INTERNAL;
 928         hdr->plen = sizeof(*ev) + dlen;
 929
 930         ev  = (void *) skb_put(skb, sizeof(*ev) + dlen);
 931         ev->type = type;
 932         memcpy(ev->data, data, dlen);
 933
 934         skb->pkt_type = HCI_EVENT_PKT;
 935         skb->dev = (void *) hdev;
 936         hci_send_to_sock(hdev, skb);
 937         kfree_skb(skb);
 938 }
 939 EXPORT_SYMBOL(hci_si_event);