net/bluetooth/hci_event.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4    Copyright 2023 NXP
   5
   6    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License version 2 as
  10    published by the Free Software Foundation;
  11
  12    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  13    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  14    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  15    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  16    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  17    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  18    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  19    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  20
  21    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  22    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  23    SOFTWARE IS DISCLAIMED.
  24 */
  25
  26 /* Bluetooth HCI event handling. */
  27
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/mgmt.h>
  33
  34 #include "hci_request.h"
  35 #include "hci_debugfs.h"
  36 #include "hci_codec.h"
  37 #include "a2mp.h"
  38 #include "amp.h"
  39 #include "smp.h"
  40 #include "msft.h"
  41 #include "eir.h"
  42
  43 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
  44                  "\x00\x00\x00\x00\x00\x00\x00\x00"
  45
  46 #define secs_to_jiffies(_secs) msecs_to_jiffies((_secs) * 1000)
  47
  48 /* Handle HCI Event packets */
  49
  50 static void *hci_ev_skb_pull(struct hci_dev *hdev, struct sk_buff *skb,
  51                              u8 ev, size_t len)
  52 {
  53         void *data;
  54
  55         data = skb_pull_data(skb, len);
  56         if (!data)
  57                 bt_dev_err(hdev, "Malformed Event: 0x%2.2x", ev);
  58
  59         return data;
  60 }
  61
  62 static void *hci_cc_skb_pull(struct hci_dev *hdev, struct sk_buff *skb,
  63                              u16 op, size_t len)
  64 {
  65         void *data;
  66
  67         data = skb_pull_data(skb, len);
  68         if (!data)
  69                 bt_dev_err(hdev, "Malformed Command Complete: 0x%4.4x", op);
  70
  71         return data;
  72 }
  73
  74 static void *hci_le_ev_skb_pull(struct hci_dev *hdev, struct sk_buff *skb,
  75                                 u8 ev, size_t len)
  76 {
  77         void *data;
  78
  79         data = skb_pull_data(skb, len);
  80         if (!data)
  81                 bt_dev_err(hdev, "Malformed LE Event: 0x%2.2x", ev);
  82
  83         return data;
  84 }
  85
  86 static u8 hci_cc_inquiry_cancel(struct hci_dev *hdev, void *data,
  87                                 struct sk_buff *skb)
  88 {
  89         struct hci_ev_status *rp = data;
  90
  91         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
  92
  93         /* It is possible that we receive Inquiry Complete event right
  94          * before we receive Inquiry Cancel Command Complete event, in
  95          * which case the latter event should have status of Command
  96          * Disallowed (0x0c). This should not be treated as error, since
  97          * we actually achieve what Inquiry Cancel wants to achieve,
  98          * which is to end the last Inquiry session.
  99          */
 100         if (rp->status == 0x0c && !test_bit(HCI_INQUIRY, &hdev->flags)) {
 101                 bt_dev_warn(hdev, "Ignoring error of Inquiry Cancel command");
 102                 rp->status = 0x00;
 103         }
 104
 105         if (rp->status)
 106                 return rp->status;
 107
 108         clear_bit(HCI_INQUIRY, &hdev->flags);
 109         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
 110         wake_up_bit(&hdev->flags, HCI_INQUIRY);
 111
 112         hci_dev_lock(hdev);
 113         /* Set discovery state to stopped if we're not doing LE active
 114          * scanning.
 115          */
 116         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
 117             hdev->le_scan_type != LE_SCAN_ACTIVE)
 118                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
 119         hci_dev_unlock(hdev);
 120
 121         hci_conn_check_pending(hdev);
 122
 123         return rp->status;
 124 }
 125
 126 static u8 hci_cc_periodic_inq(struct hci_dev *hdev, void *data,
 127                               struct sk_buff *skb)
 128 {
 129         struct hci_ev_status *rp = data;
 130
 131         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 132
 133         if (rp->status)
 134                 return rp->status;
 135
 136         hci_dev_set_flag(hdev, HCI_PERIODIC_INQ);
 137
 138         return rp->status;
 139 }
 140
 141 static u8 hci_cc_exit_periodic_inq(struct hci_dev *hdev, void *data,
 142                                    struct sk_buff *skb)
 143 {
 144         struct hci_ev_status *rp = data;
 145
 146         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 147
 148         if (rp->status)
 149                 return rp->status;
 150
 151         hci_dev_clear_flag(hdev, HCI_PERIODIC_INQ);
 152
 153         hci_conn_check_pending(hdev);
 154
 155         return rp->status;
 156 }
 157
 158 static u8 hci_cc_remote_name_req_cancel(struct hci_dev *hdev, void *data,
 159                                         struct sk_buff *skb)
 160 {
 161         struct hci_ev_status *rp = data;
 162
 163         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 164
 165         return rp->status;
 166 }
 167
 168 static u8 hci_cc_role_discovery(struct hci_dev *hdev, void *data,
 169                                 struct sk_buff *skb)
 170 {
 171         struct hci_rp_role_discovery *rp = data;
 172         struct hci_conn *conn;
 173
 174         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 175
 176         if (rp->status)
 177                 return rp->status;
 178
 179         hci_dev_lock(hdev);
 180
 181         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 182         if (conn)
 183                 conn->role = rp->role;
 184
 185         hci_dev_unlock(hdev);
 186
 187         return rp->status;
 188 }
 189
 190 static u8 hci_cc_read_link_policy(struct hci_dev *hdev, void *data,
 191                                   struct sk_buff *skb)
 192 {
 193         struct hci_rp_read_link_policy *rp = data;
 194         struct hci_conn *conn;
 195
 196         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 197
 198         if (rp->status)
 199                 return rp->status;
 200
 201         hci_dev_lock(hdev);
 202
 203         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 204         if (conn)
 205                 conn->link_policy = __le16_to_cpu(rp->policy);
 206
 207         hci_dev_unlock(hdev);
 208
 209         return rp->status;
 210 }
 211
 212 static u8 hci_cc_write_link_policy(struct hci_dev *hdev, void *data,
 213                                    struct sk_buff *skb)
 214 {
 215         struct hci_rp_write_link_policy *rp = data;
 216         struct hci_conn *conn;
 217         void *sent;
 218
 219         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 220
 221         if (rp->status)
 222                 return rp->status;
 223
 224         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
 225         if (!sent)
 226                 return rp->status;
 227
 228         hci_dev_lock(hdev);
 229
 230         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 231         if (conn)
 232                 conn->link_policy = get_unaligned_le16(sent + 2);
 233
 234         hci_dev_unlock(hdev);
 235
 236         return rp->status;
 237 }
 238
 239 static u8 hci_cc_read_def_link_policy(struct hci_dev *hdev, void *data,
 240                                       struct sk_buff *skb)
 241 {
 242         struct hci_rp_read_def_link_policy *rp = data;
 243
 244         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 245
 246         if (rp->status)
 247                 return rp->status;
 248
 249         hdev->link_policy = __le16_to_cpu(rp->policy);
 250
 251         return rp->status;
 252 }
 253
 254 static u8 hci_cc_write_def_link_policy(struct hci_dev *hdev, void *data,
 255                                        struct sk_buff *skb)
 256 {
 257         struct hci_ev_status *rp = data;
 258         void *sent;
 259
 260         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 261
 262         if (rp->status)
 263                 return rp->status;
 264
 265         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
 266         if (!sent)
 267                 return rp->status;
 268
 269         hdev->link_policy = get_unaligned_le16(sent);
 270
 271         return rp->status;
 272 }
 273
 274 static u8 hci_cc_reset(struct hci_dev *hdev, void *data, struct sk_buff *skb)
 275 {
 276         struct hci_ev_status *rp = data;
 277
 278         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 279
 280         clear_bit(HCI_RESET, &hdev->flags);
 281
 282         if (rp->status)
 283                 return rp->status;
 284
 285         /* Reset all non-persistent flags */
 286         hci_dev_clear_volatile_flags(hdev);
 287
 288         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
 289
 290         hdev->inq_tx_power = HCI_TX_POWER_INVALID;
 291         hdev->adv_tx_power = HCI_TX_POWER_INVALID;
 292
 293         memset(hdev->adv_data, 0, sizeof(hdev->adv_data));
 294         hdev->adv_data_len = 0;
 295
 296         memset(hdev->scan_rsp_data, 0, sizeof(hdev->scan_rsp_data));
 297         hdev->scan_rsp_data_len = 0;
 298
 299         hdev->le_scan_type = LE_SCAN_PASSIVE;
 300
 301         hdev->ssp_debug_mode = 0;
 302
 303         hci_bdaddr_list_clear(&hdev->le_accept_list);
 304         hci_bdaddr_list_clear(&hdev->le_resolv_list);
 305
 306         return rp->status;
 307 }
 308
 309 static u8 hci_cc_read_stored_link_key(struct hci_dev *hdev, void *data,
 310                                       struct sk_buff *skb)
 311 {
 312         struct hci_rp_read_stored_link_key *rp = data;
 313         struct hci_cp_read_stored_link_key *sent;
 314
 315         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 316
 317         sent = hci_sent_cmd_data(hdev, HCI_OP_READ_STORED_LINK_KEY);
 318         if (!sent)
 319                 return rp->status;
 320
 321         if (!rp->status && sent->read_all == 0x01) {
 322                 hdev->stored_max_keys = le16_to_cpu(rp->max_keys);
 323                 hdev->stored_num_keys = le16_to_cpu(rp->num_keys);
 324         }
 325
 326         return rp->status;
 327 }
 328
 329 static u8 hci_cc_delete_stored_link_key(struct hci_dev *hdev, void *data,
 330                                         struct sk_buff *skb)
 331 {
 332         struct hci_rp_delete_stored_link_key *rp = data;
 333         u16 num_keys;
 334
 335         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 336
 337         if (rp->status)
 338                 return rp->status;
 339
 340         num_keys = le16_to_cpu(rp->num_keys);
 341
 342         if (num_keys <= hdev->stored_num_keys)
 343                 hdev->stored_num_keys -= num_keys;
 344         else
 345                 hdev->stored_num_keys = 0;
 346
 347         return rp->status;
 348 }
 349
 350 static u8 hci_cc_write_local_name(struct hci_dev *hdev, void *data,
 351                                   struct sk_buff *skb)
 352 {
 353         struct hci_ev_status *rp = data;
 354         void *sent;
 355
 356         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 357
 358         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
 359         if (!sent)
 360                 return rp->status;
 361
 362         hci_dev_lock(hdev);
 363
 364         if (hci_dev_test_flag(hdev, HCI_MGMT))
 365                 mgmt_set_local_name_complete(hdev, sent, rp->status);
 366         else if (!rp->status)
 367                 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
 368
 369         hci_dev_unlock(hdev);
 370
 371         return rp->status;
 372 }
 373
 374 static u8 hci_cc_read_local_name(struct hci_dev *hdev, void *data,
 375                                  struct sk_buff *skb)
 376 {
 377         struct hci_rp_read_local_name *rp = data;
 378
 379         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 380
 381         if (rp->status)
 382                 return rp->status;
 383
 384         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 385             hci_dev_test_flag(hdev, HCI_CONFIG))
 386                 memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
 387
 388         return rp->status;
 389 }
 390
 391 static u8 hci_cc_write_auth_enable(struct hci_dev *hdev, void *data,
 392                                    struct sk_buff *skb)
 393 {
 394         struct hci_ev_status *rp = data;
 395         void *sent;
 396
 397         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 398
 399         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
 400         if (!sent)
 401                 return rp->status;
 402
 403         hci_dev_lock(hdev);
 404
 405         if (!rp->status) {
 406                 __u8 param = *((__u8 *) sent);
 407
 408                 if (param == AUTH_ENABLED)
 409                         set_bit(HCI_AUTH, &hdev->flags);
 410                 else
 411                         clear_bit(HCI_AUTH, &hdev->flags);
 412         }
 413
 414         if (hci_dev_test_flag(hdev, HCI_MGMT))
 415                 mgmt_auth_enable_complete(hdev, rp->status);
 416
 417         hci_dev_unlock(hdev);
 418
 419         return rp->status;
 420 }
 421
 422 static u8 hci_cc_write_encrypt_mode(struct hci_dev *hdev, void *data,
 423                                     struct sk_buff *skb)
 424 {
 425         struct hci_ev_status *rp = data;
 426         __u8 param;
 427         void *sent;
 428
 429         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 430
 431         if (rp->status)
 432                 return rp->status;
 433
 434         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
 435         if (!sent)
 436                 return rp->status;
 437
 438         param = *((__u8 *) sent);
 439
 440         if (param)
 441                 set_bit(HCI_ENCRYPT, &hdev->flags);
 442         else
 443                 clear_bit(HCI_ENCRYPT, &hdev->flags);
 444
 445         return rp->status;
 446 }
 447
 448 static u8 hci_cc_write_scan_enable(struct hci_dev *hdev, void *data,
 449                                    struct sk_buff *skb)
 450 {
 451         struct hci_ev_status *rp = data;
 452         __u8 param;
 453         void *sent;
 454
 455         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 456
 457         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
 458         if (!sent)
 459                 return rp->status;
 460
 461         param = *((__u8 *) sent);
 462
 463         hci_dev_lock(hdev);
 464
 465         if (rp->status) {
 466                 hdev->discov_timeout = 0;
 467                 goto done;
 468         }
 469
 470         if (param & SCAN_INQUIRY)
 471                 set_bit(HCI_ISCAN, &hdev->flags);
 472         else
 473                 clear_bit(HCI_ISCAN, &hdev->flags);
 474
 475         if (param & SCAN_PAGE)
 476                 set_bit(HCI_PSCAN, &hdev->flags);
 477         else
 478                 clear_bit(HCI_PSCAN, &hdev->flags);
 479
 480 done:
 481         hci_dev_unlock(hdev);
 482
 483         return rp->status;
 484 }
 485
 486 static u8 hci_cc_set_event_filter(struct hci_dev *hdev, void *data,
 487                                   struct sk_buff *skb)
 488 {
 489         struct hci_ev_status *rp = data;
 490         struct hci_cp_set_event_filter *cp;
 491         void *sent;
 492
 493         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 494
 495         if (rp->status)
 496                 return rp->status;
 497
 498         sent = hci_sent_cmd_data(hdev, HCI_OP_SET_EVENT_FLT);
 499         if (!sent)
 500                 return rp->status;
 501
 502         cp = (struct hci_cp_set_event_filter *)sent;
 503
 504         if (cp->flt_type == HCI_FLT_CLEAR_ALL)
 505                 hci_dev_clear_flag(hdev, HCI_EVENT_FILTER_CONFIGURED);
 506         else
 507                 hci_dev_set_flag(hdev, HCI_EVENT_FILTER_CONFIGURED);
 508
 509         return rp->status;
 510 }
 511
 512 static u8 hci_cc_read_class_of_dev(struct hci_dev *hdev, void *data,
 513                                    struct sk_buff *skb)
 514 {
 515         struct hci_rp_read_class_of_dev *rp = data;
 516
 517         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 518
 519         if (rp->status)
 520                 return rp->status;
 521
 522         memcpy(hdev->dev_class, rp->dev_class, 3);
 523
 524         bt_dev_dbg(hdev, "class 0x%.2x%.2x%.2x", hdev->dev_class[2],
 525                    hdev->dev_class[1], hdev->dev_class[0]);
 526
 527         return rp->status;
 528 }
 529
 530 static u8 hci_cc_write_class_of_dev(struct hci_dev *hdev, void *data,
 531                                     struct sk_buff *skb)
 532 {
 533         struct hci_ev_status *rp = data;
 534         void *sent;
 535
 536         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 537
 538         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
 539         if (!sent)
 540                 return rp->status;
 541
 542         hci_dev_lock(hdev);
 543
 544         if (!rp->status)
 545                 memcpy(hdev->dev_class, sent, 3);
 546
 547         if (hci_dev_test_flag(hdev, HCI_MGMT))
 548                 mgmt_set_class_of_dev_complete(hdev, sent, rp->status);
 549
 550         hci_dev_unlock(hdev);
 551
 552         return rp->status;
 553 }
 554
 555 static u8 hci_cc_read_voice_setting(struct hci_dev *hdev, void *data,
 556                                     struct sk_buff *skb)
 557 {
 558         struct hci_rp_read_voice_setting *rp = data;
 559         __u16 setting;
 560
 561         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 562
 563         if (rp->status)
 564                 return rp->status;
 565
 566         setting = __le16_to_cpu(rp->voice_setting);
 567
 568         if (hdev->voice_setting == setting)
 569                 return rp->status;
 570
 571         hdev->voice_setting = setting;
 572
 573         bt_dev_dbg(hdev, "voice setting 0x%4.4x", setting);
 574
 575         if (hdev->notify)
 576                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 577
 578         return rp->status;
 579 }
 580
 581 static u8 hci_cc_write_voice_setting(struct hci_dev *hdev, void *data,
 582                                      struct sk_buff *skb)
 583 {
 584         struct hci_ev_status *rp = data;
 585         __u16 setting;
 586         void *sent;
 587
 588         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 589
 590         if (rp->status)
 591                 return rp->status;
 592
 593         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
 594         if (!sent)
 595                 return rp->status;
 596
 597         setting = get_unaligned_le16(sent);
 598
 599         if (hdev->voice_setting == setting)
 600                 return rp->status;
 601
 602         hdev->voice_setting = setting;
 603
 604         bt_dev_dbg(hdev, "voice setting 0x%4.4x", setting);
 605
 606         if (hdev->notify)
 607                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 608
 609         return rp->status;
 610 }
 611
 612 static u8 hci_cc_read_num_supported_iac(struct hci_dev *hdev, void *data,
 613                                         struct sk_buff *skb)
 614 {
 615         struct hci_rp_read_num_supported_iac *rp = data;
 616
 617         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 618
 619         if (rp->status)
 620                 return rp->status;
 621
 622         hdev->num_iac = rp->num_iac;
 623
 624         bt_dev_dbg(hdev, "num iac %d", hdev->num_iac);
 625
 626         return rp->status;
 627 }
 628
 629 static u8 hci_cc_write_ssp_mode(struct hci_dev *hdev, void *data,
 630                                 struct sk_buff *skb)
 631 {
 632         struct hci_ev_status *rp = data;
 633         struct hci_cp_write_ssp_mode *sent;
 634
 635         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 636
 637         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
 638         if (!sent)
 639                 return rp->status;
 640
 641         hci_dev_lock(hdev);
 642
 643         if (!rp->status) {
 644                 if (sent->mode)
 645                         hdev->features[1][0] |= LMP_HOST_SSP;
 646                 else
 647                         hdev->features[1][0] &= ~LMP_HOST_SSP;
 648         }
 649
 650         if (!rp->status) {
 651                 if (sent->mode)
 652                         hci_dev_set_flag(hdev, HCI_SSP_ENABLED);
 653                 else
 654                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
 655         }
 656
 657         hci_dev_unlock(hdev);
 658
 659         return rp->status;
 660 }
 661
 662 static u8 hci_cc_write_sc_support(struct hci_dev *hdev, void *data,
 663                                   struct sk_buff *skb)
 664 {
 665         struct hci_ev_status *rp = data;
 666         struct hci_cp_write_sc_support *sent;
 667
 668         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 669
 670         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SC_SUPPORT);
 671         if (!sent)
 672                 return rp->status;
 673
 674         hci_dev_lock(hdev);
 675
 676         if (!rp->status) {
 677                 if (sent->support)
 678                         hdev->features[1][0] |= LMP_HOST_SC;
 679                 else
 680                         hdev->features[1][0] &= ~LMP_HOST_SC;
 681         }
 682
 683         if (!hci_dev_test_flag(hdev, HCI_MGMT) && !rp->status) {
 684                 if (sent->support)
 685                         hci_dev_set_flag(hdev, HCI_SC_ENABLED);
 686                 else
 687                         hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
 688         }
 689
 690         hci_dev_unlock(hdev);
 691
 692         return rp->status;
 693 }
 694
 695 static u8 hci_cc_read_local_version(struct hci_dev *hdev, void *data,
 696                                     struct sk_buff *skb)
 697 {
 698         struct hci_rp_read_local_version *rp = data;
 699
 700         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 701
 702         if (rp->status)
 703                 return rp->status;
 704
 705         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 706             hci_dev_test_flag(hdev, HCI_CONFIG)) {
 707                 hdev->hci_ver = rp->hci_ver;
 708                 hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
 709                 hdev->lmp_ver = rp->lmp_ver;
 710                 hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
 711                 hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
 712         }
 713
 714         return rp->status;
 715 }
 716
 717 static u8 hci_cc_read_enc_key_size(struct hci_dev *hdev, void *data,
 718                                    struct sk_buff *skb)
 719 {
 720         struct hci_rp_read_enc_key_size *rp = data;
 721         struct hci_conn *conn;
 722         u16 handle;
 723         u8 status = rp->status;
 724
 725         bt_dev_dbg(hdev, "status 0x%2.2x", status);
 726
 727         handle = le16_to_cpu(rp->handle);
 728
 729         hci_dev_lock(hdev);
 730
 731         conn = hci_conn_hash_lookup_handle(hdev, handle);
 732         if (!conn) {
 733                 status = 0xFF;
 734                 goto done;
 735         }
 736
 737         /* While unexpected, the read_enc_key_size command may fail. The most
 738          * secure approach is to then assume the key size is 0 to force a
 739          * disconnection.
 740          */
 741         if (status) {
 742                 bt_dev_err(hdev, "failed to read key size for handle %u",
 743                            handle);
 744                 conn->enc_key_size = 0;
 745         } else {
 746                 conn->enc_key_size = rp->key_size;
 747                 status = 0;
 748         }
 749
 750         hci_encrypt_cfm(conn, 0);
 751
 752 done:
 753         hci_dev_unlock(hdev);
 754
 755         return status;
 756 }
 757
 758 static u8 hci_cc_read_local_commands(struct hci_dev *hdev, void *data,
 759                                      struct sk_buff *skb)
 760 {
 761         struct hci_rp_read_local_commands *rp = data;
 762
 763         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 764
 765         if (rp->status)
 766                 return rp->status;
 767
 768         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 769             hci_dev_test_flag(hdev, HCI_CONFIG))
 770                 memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 771
 772         return rp->status;
 773 }
 774
 775 static u8 hci_cc_read_auth_payload_timeout(struct hci_dev *hdev, void *data,
 776                                            struct sk_buff *skb)
 777 {
 778         struct hci_rp_read_auth_payload_to *rp = data;
 779         struct hci_conn *conn;
 780
 781         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 782
 783         if (rp->status)
 784                 return rp->status;
 785
 786         hci_dev_lock(hdev);
 787
 788         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 789         if (conn)
 790                 conn->auth_payload_timeout = __le16_to_cpu(rp->timeout);
 791
 792         hci_dev_unlock(hdev);
 793
 794         return rp->status;
 795 }
 796
 797 static u8 hci_cc_write_auth_payload_timeout(struct hci_dev *hdev, void *data,
 798                                             struct sk_buff *skb)
 799 {
 800         struct hci_rp_write_auth_payload_to *rp = data;
 801         struct hci_conn *conn;
 802         void *sent;
 803
 804         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 805
 806         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_PAYLOAD_TO);
 807         if (!sent)
 808                 return rp->status;
 809
 810         hci_dev_lock(hdev);
 811
 812         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 813         if (!conn) {
 814                 rp->status = 0xff;
 815                 goto unlock;
 816         }
 817
 818         if (!rp->status)
 819                 conn->auth_payload_timeout = get_unaligned_le16(sent + 2);
 820
 821         hci_encrypt_cfm(conn, 0);
 822
 823 unlock:
 824         hci_dev_unlock(hdev);
 825
 826         return rp->status;
 827 }
 828
 829 static u8 hci_cc_read_local_features(struct hci_dev *hdev, void *data,
 830                                      struct sk_buff *skb)
 831 {
 832         struct hci_rp_read_local_features *rp = data;
 833
 834         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 835
 836         if (rp->status)
 837                 return rp->status;
 838
 839         memcpy(hdev->features, rp->features, 8);
 840
 841         /* Adjust default settings according to features
 842          * supported by device. */
 843
 844         if (hdev->features[0][0] & LMP_3SLOT)
 845                 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 846
 847         if (hdev->features[0][0] & LMP_5SLOT)
 848                 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 849
 850         if (hdev->features[0][1] & LMP_HV2) {
 851                 hdev->pkt_type  |= (HCI_HV2);
 852                 hdev->esco_type |= (ESCO_HV2);
 853         }
 854
 855         if (hdev->features[0][1] & LMP_HV3) {
 856                 hdev->pkt_type  |= (HCI_HV3);
 857                 hdev->esco_type |= (ESCO_HV3);
 858         }
 859
 860         if (lmp_esco_capable(hdev))
 861                 hdev->esco_type |= (ESCO_EV3);
 862
 863         if (hdev->features[0][4] & LMP_EV4)
 864                 hdev->esco_type |= (ESCO_EV4);
 865
 866         if (hdev->features[0][4] & LMP_EV5)
 867                 hdev->esco_type |= (ESCO_EV5);
 868
 869         if (hdev->features[0][5] & LMP_EDR_ESCO_2M)
 870                 hdev->esco_type |= (ESCO_2EV3);
 871
 872         if (hdev->features[0][5] & LMP_EDR_ESCO_3M)
 873                 hdev->esco_type |= (ESCO_3EV3);
 874
 875         if (hdev->features[0][5] & LMP_EDR_3S_ESCO)
 876                 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
 877
 878         return rp->status;
 879 }
 880
 881 static u8 hci_cc_read_local_ext_features(struct hci_dev *hdev, void *data,
 882                                          struct sk_buff *skb)
 883 {
 884         struct hci_rp_read_local_ext_features *rp = data;
 885
 886         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 887
 888         if (rp->status)
 889                 return rp->status;
 890
 891         if (hdev->max_page < rp->max_page) {
 892                 if (test_bit(HCI_QUIRK_BROKEN_LOCAL_EXT_FEATURES_PAGE_2,
 893                              &hdev->quirks))
 894                         bt_dev_warn(hdev, "broken local ext features page 2");
 895                 else
 896                         hdev->max_page = rp->max_page;
 897         }
 898
 899         if (rp->page < HCI_MAX_PAGES)
 900                 memcpy(hdev->features[rp->page], rp->features, 8);
 901
 902         return rp->status;
 903 }
 904
 905 static u8 hci_cc_read_flow_control_mode(struct hci_dev *hdev, void *data,
 906                                         struct sk_buff *skb)
 907 {
 908         struct hci_rp_read_flow_control_mode *rp = data;
 909
 910         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 911
 912         if (rp->status)
 913                 return rp->status;
 914
 915         hdev->flow_ctl_mode = rp->mode;
 916
 917         return rp->status;
 918 }
 919
 920 static u8 hci_cc_read_buffer_size(struct hci_dev *hdev, void *data,
 921                                   struct sk_buff *skb)
 922 {
 923         struct hci_rp_read_buffer_size *rp = data;
 924
 925         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 926
 927         if (rp->status)
 928                 return rp->status;
 929
 930         hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
 931         hdev->sco_mtu  = rp->sco_mtu;
 932         hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
 933         hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
 934
 935         if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
 936                 hdev->sco_mtu  = 64;
 937                 hdev->sco_pkts = 8;
 938         }
 939
 940         hdev->acl_cnt = hdev->acl_pkts;
 941         hdev->sco_cnt = hdev->sco_pkts;
 942
 943         BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
 944                hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
 945
 946         return rp->status;
 947 }
 948
 949 static u8 hci_cc_read_bd_addr(struct hci_dev *hdev, void *data,
 950                               struct sk_buff *skb)
 951 {
 952         struct hci_rp_read_bd_addr *rp = data;
 953
 954         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 955
 956         if (rp->status)
 957                 return rp->status;
 958
 959         if (test_bit(HCI_INIT, &hdev->flags))
 960                 bacpy(&hdev->bdaddr, &rp->bdaddr);
 961
 962         if (hci_dev_test_flag(hdev, HCI_SETUP))
 963                 bacpy(&hdev->setup_addr, &rp->bdaddr);
 964
 965         return rp->status;
 966 }
 967
 968 static u8 hci_cc_read_local_pairing_opts(struct hci_dev *hdev, void *data,
 969                                          struct sk_buff *skb)
 970 {
 971         struct hci_rp_read_local_pairing_opts *rp = data;
 972
 973         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 974
 975         if (rp->status)
 976                 return rp->status;
 977
 978         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 979             hci_dev_test_flag(hdev, HCI_CONFIG)) {
 980                 hdev->pairing_opts = rp->pairing_opts;
 981                 hdev->max_enc_key_size = rp->max_key_size;
 982         }
 983
 984         return rp->status;
 985 }
 986
 987 static u8 hci_cc_read_page_scan_activity(struct hci_dev *hdev, void *data,
 988                                          struct sk_buff *skb)
 989 {
 990         struct hci_rp_read_page_scan_activity *rp = data;
 991
 992         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 993
 994         if (rp->status)
 995                 return rp->status;
 996
 997         if (test_bit(HCI_INIT, &hdev->flags)) {
 998                 hdev->page_scan_interval = __le16_to_cpu(rp->interval);
 999                 hdev->page_scan_window = __le16_to_cpu(rp->window);
1000         }
1001
1002         return rp->status;
1003 }
1004
1005 static u8 hci_cc_write_page_scan_activity(struct hci_dev *hdev, void *data,
1006                                           struct sk_buff *skb)
1007 {
1008         struct hci_ev_status *rp = data;
1009         struct hci_cp_write_page_scan_activity *sent;
1010
1011         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1012
1013         if (rp->status)
1014                 return rp->status;
1015
1016         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY);
1017         if (!sent)
1018                 return rp->status;
1019
1020         hdev->page_scan_interval = __le16_to_cpu(sent->interval);
1021         hdev->page_scan_window = __le16_to_cpu(sent->window);
1022
1023         return rp->status;
1024 }
1025
1026 static u8 hci_cc_read_page_scan_type(struct hci_dev *hdev, void *data,
1027                                      struct sk_buff *skb)
1028 {
1029         struct hci_rp_read_page_scan_type *rp = data;
1030
1031         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1032
1033         if (rp->status)
1034                 return rp->status;
1035
1036         if (test_bit(HCI_INIT, &hdev->flags))
1037                 hdev->page_scan_type = rp->type;
1038
1039         return rp->status;
1040 }
1041
1042 static u8 hci_cc_write_page_scan_type(struct hci_dev *hdev, void *data,
1043                                       struct sk_buff *skb)
1044 {
1045         struct hci_ev_status *rp = data;
1046         u8 *type;
1047
1048         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1049
1050         if (rp->status)
1051                 return rp->status;
1052
1053         type = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE);
1054         if (type)
1055                 hdev->page_scan_type = *type;
1056
1057         return rp->status;
1058 }
1059
1060 static u8 hci_cc_read_data_block_size(struct hci_dev *hdev, void *data,
1061                                       struct sk_buff *skb)
1062 {
1063         struct hci_rp_read_data_block_size *rp = data;
1064
1065         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1066
1067         if (rp->status)
1068                 return rp->status;
1069
1070         hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
1071         hdev->block_len = __le16_to_cpu(rp->block_len);
1072         hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
1073
1074         hdev->block_cnt = hdev->num_blocks;
1075
1076         BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
1077                hdev->block_cnt, hdev->block_len);
1078
1079         return rp->status;
1080 }
1081
1082 static u8 hci_cc_read_clock(struct hci_dev *hdev, void *data,
1083                             struct sk_buff *skb)
1084 {
1085         struct hci_rp_read_clock *rp = data;
1086         struct hci_cp_read_clock *cp;
1087         struct hci_conn *conn;
1088
1089         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1090
1091         if (rp->status)
1092                 return rp->status;
1093
1094         hci_dev_lock(hdev);
1095
1096         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
1097         if (!cp)
1098                 goto unlock;
1099
1100         if (cp->which == 0x00) {
1101                 hdev->clock = le32_to_cpu(rp->clock);
1102                 goto unlock;
1103         }
1104
1105         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1106         if (conn) {
1107                 conn->clock = le32_to_cpu(rp->clock);
1108                 conn->clock_accuracy = le16_to_cpu(rp->accuracy);
1109         }
1110
1111 unlock:
1112         hci_dev_unlock(hdev);
1113         return rp->status;
1114 }
1115
1116 static u8 hci_cc_read_local_amp_info(struct hci_dev *hdev, void *data,
1117                                      struct sk_buff *skb)
1118 {
1119         struct hci_rp_read_local_amp_info *rp = data;
1120
1121         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1122
1123         if (rp->status)
1124                 return rp->status;
1125
1126         hdev->amp_status = rp->amp_status;
1127         hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
1128         hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
1129         hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
1130         hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
1131         hdev->amp_type = rp->amp_type;
1132         hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
1133         hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
1134         hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
1135         hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
1136
1137         return rp->status;
1138 }
1139
1140 static u8 hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev, void *data,
1141                                        struct sk_buff *skb)
1142 {
1143         struct hci_rp_read_inq_rsp_tx_power *rp = data;
1144
1145         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1146
1147         if (rp->status)
1148                 return rp->status;
1149
1150         hdev->inq_tx_power = rp->tx_power;
1151
1152         return rp->status;
1153 }
1154
1155 static u8 hci_cc_read_def_err_data_reporting(struct hci_dev *hdev, void *data,
1156                                              struct sk_buff *skb)
1157 {
1158         struct hci_rp_read_def_err_data_reporting *rp = data;
1159
1160         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1161
1162         if (rp->status)
1163                 return rp->status;
1164
1165         hdev->err_data_reporting = rp->err_data_reporting;
1166
1167         return rp->status;
1168 }
1169
1170 static u8 hci_cc_write_def_err_data_reporting(struct hci_dev *hdev, void *data,
1171                                               struct sk_buff *skb)
1172 {
1173         struct hci_ev_status *rp = data;
1174         struct hci_cp_write_def_err_data_reporting *cp;
1175
1176         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1177
1178         if (rp->status)
1179                 return rp->status;
1180
1181         cp = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_ERR_DATA_REPORTING);
1182         if (!cp)
1183                 return rp->status;
1184
1185         hdev->err_data_reporting = cp->err_data_reporting;
1186
1187         return rp->status;
1188 }
1189
1190 static u8 hci_cc_pin_code_reply(struct hci_dev *hdev, void *data,
1191                                 struct sk_buff *skb)
1192 {
1193         struct hci_rp_pin_code_reply *rp = data;
1194         struct hci_cp_pin_code_reply *cp;
1195         struct hci_conn *conn;
1196
1197         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1198
1199         hci_dev_lock(hdev);
1200
1201         if (hci_dev_test_flag(hdev, HCI_MGMT))
1202                 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
1203
1204         if (rp->status)
1205                 goto unlock;
1206
1207         cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
1208         if (!cp)
1209                 goto unlock;
1210
1211         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1212         if (conn)
1213                 conn->pin_length = cp->pin_len;
1214
1215 unlock:
1216         hci_dev_unlock(hdev);
1217         return rp->status;
1218 }
1219
1220 static u8 hci_cc_pin_code_neg_reply(struct hci_dev *hdev, void *data,
1221                                     struct sk_buff *skb)
1222 {
1223         struct hci_rp_pin_code_neg_reply *rp = data;
1224
1225         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1226
1227         hci_dev_lock(hdev);
1228
1229         if (hci_dev_test_flag(hdev, HCI_MGMT))
1230                 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
1231                                                  rp->status);
1232
1233         hci_dev_unlock(hdev);
1234
1235         return rp->status;
1236 }
1237
1238 static u8 hci_cc_le_read_buffer_size(struct hci_dev *hdev, void *data,
1239                                      struct sk_buff *skb)
1240 {
1241         struct hci_rp_le_read_buffer_size *rp = data;
1242
1243         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1244
1245         if (rp->status)
1246                 return rp->status;
1247
1248         hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
1249         hdev->le_pkts = rp->le_max_pkt;
1250
1251         hdev->le_cnt = hdev->le_pkts;
1252
1253         BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
1254
1255         return rp->status;
1256 }
1257
1258 static u8 hci_cc_le_read_local_features(struct hci_dev *hdev, void *data,
1259                                         struct sk_buff *skb)
1260 {
1261         struct hci_rp_le_read_local_features *rp = data;
1262
1263         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1264
1265         if (rp->status)
1266                 return rp->status;
1267
1268         memcpy(hdev->le_features, rp->features, 8);
1269
1270         return rp->status;
1271 }
1272
1273 static u8 hci_cc_le_read_adv_tx_power(struct hci_dev *hdev, void *data,
1274                                       struct sk_buff *skb)
1275 {
1276         struct hci_rp_le_read_adv_tx_power *rp = data;
1277
1278         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1279
1280         if (rp->status)
1281                 return rp->status;
1282
1283         hdev->adv_tx_power = rp->tx_power;
1284
1285         return rp->status;
1286 }
1287
1288 static u8 hci_cc_user_confirm_reply(struct hci_dev *hdev, void *data,
1289                                     struct sk_buff *skb)
1290 {
1291         struct hci_rp_user_confirm_reply *rp = data;
1292
1293         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1294
1295         hci_dev_lock(hdev);
1296
1297         if (hci_dev_test_flag(hdev, HCI_MGMT))
1298                 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,
1299                                                  rp->status);
1300
1301         hci_dev_unlock(hdev);
1302
1303         return rp->status;
1304 }
1305
1306 static u8 hci_cc_user_confirm_neg_reply(struct hci_dev *hdev, void *data,
1307                                         struct sk_buff *skb)
1308 {
1309         struct hci_rp_user_confirm_reply *rp = data;
1310
1311         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1312
1313         hci_dev_lock(hdev);
1314
1315         if (hci_dev_test_flag(hdev, HCI_MGMT))
1316                 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
1317                                                      ACL_LINK, 0, rp->status);
1318
1319         hci_dev_unlock(hdev);
1320
1321         return rp->status;
1322 }
1323
1324 static u8 hci_cc_user_passkey_reply(struct hci_dev *hdev, void *data,
1325                                     struct sk_buff *skb)
1326 {
1327         struct hci_rp_user_confirm_reply *rp = data;
1328
1329         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1330
1331         hci_dev_lock(hdev);
1332
1333         if (hci_dev_test_flag(hdev, HCI_MGMT))
1334                 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
1335                                                  0, rp->status);
1336
1337         hci_dev_unlock(hdev);
1338
1339         return rp->status;
1340 }
1341
1342 static u8 hci_cc_user_passkey_neg_reply(struct hci_dev *hdev, void *data,
1343                                         struct sk_buff *skb)
1344 {
1345         struct hci_rp_user_confirm_reply *rp = data;
1346
1347         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1348
1349         hci_dev_lock(hdev);
1350
1351         if (hci_dev_test_flag(hdev, HCI_MGMT))
1352                 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
1353                                                      ACL_LINK, 0, rp->status);
1354
1355         hci_dev_unlock(hdev);
1356
1357         return rp->status;
1358 }
1359
1360 static u8 hci_cc_read_local_oob_data(struct hci_dev *hdev, void *data,
1361                                      struct sk_buff *skb)
1362 {
1363         struct hci_rp_read_local_oob_data *rp = data;
1364
1365         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1366
1367         return rp->status;
1368 }
1369
1370 static u8 hci_cc_read_local_oob_ext_data(struct hci_dev *hdev, void *data,
1371                                          struct sk_buff *skb)
1372 {
1373         struct hci_rp_read_local_oob_ext_data *rp = data;
1374
1375         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1376
1377         return rp->status;
1378 }
1379
1380 static u8 hci_cc_le_set_random_addr(struct hci_dev *hdev, void *data,
1381                                     struct sk_buff *skb)
1382 {
1383         struct hci_ev_status *rp = data;
1384         bdaddr_t *sent;
1385
1386         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1387
1388         if (rp->status)
1389                 return rp->status;
1390
1391         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_RANDOM_ADDR);
1392         if (!sent)
1393                 return rp->status;
1394
1395         hci_dev_lock(hdev);
1396
1397         bacpy(&hdev->random_addr, sent);
1398
1399         if (!bacmp(&hdev->rpa, sent)) {
1400                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
1401                 queue_delayed_work(hdev->workqueue, &hdev->rpa_expired,
1402                                    secs_to_jiffies(hdev->rpa_timeout));
1403         }
1404
1405         hci_dev_unlock(hdev);
1406
1407         return rp->status;
1408 }
1409
1410 static u8 hci_cc_le_set_default_phy(struct hci_dev *hdev, void *data,
1411                                     struct sk_buff *skb)
1412 {
1413         struct hci_ev_status *rp = data;
1414         struct hci_cp_le_set_default_phy *cp;
1415
1416         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1417
1418         if (rp->status)
1419                 return rp->status;
1420
1421         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_DEFAULT_PHY);
1422         if (!cp)
1423                 return rp->status;
1424
1425         hci_dev_lock(hdev);
1426
1427         hdev->le_tx_def_phys = cp->tx_phys;
1428         hdev->le_rx_def_phys = cp->rx_phys;
1429
1430         hci_dev_unlock(hdev);
1431
1432         return rp->status;
1433 }
1434
1435 static u8 hci_cc_le_set_adv_set_random_addr(struct hci_dev *hdev, void *data,
1436                                             struct sk_buff *skb)
1437 {
1438         struct hci_ev_status *rp = data;
1439         struct hci_cp_le_set_adv_set_rand_addr *cp;
1440         struct adv_info *adv;
1441
1442         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1443
1444         if (rp->status)
1445                 return rp->status;
1446
1447         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_SET_RAND_ADDR);
1448         /* Update only in case the adv instance since handle 0x00 shall be using
1449          * HCI_OP_LE_SET_RANDOM_ADDR since that allows both extended and
1450          * non-extended adverting.
1451          */
1452         if (!cp || !cp->handle)
1453                 return rp->status;
1454
1455         hci_dev_lock(hdev);
1456
1457         adv = hci_find_adv_instance(hdev, cp->handle);
1458         if (adv) {
1459                 bacpy(&adv->random_addr, &cp->bdaddr);
1460                 if (!bacmp(&hdev->rpa, &cp->bdaddr)) {
1461                         adv->rpa_expired = false;
1462                         queue_delayed_work(hdev->workqueue,
1463                                            &adv->rpa_expired_cb,
1464                                            secs_to_jiffies(hdev->rpa_timeout));
1465                 }
1466         }
1467
1468         hci_dev_unlock(hdev);
1469
1470         return rp->status;
1471 }
1472
1473 static u8 hci_cc_le_remove_adv_set(struct hci_dev *hdev, void *data,
1474                                    struct sk_buff *skb)
1475 {
1476         struct hci_ev_status *rp = data;
1477         u8 *instance;
1478         int err;
1479
1480         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1481
1482         if (rp->status)
1483                 return rp->status;
1484
1485         instance = hci_sent_cmd_data(hdev, HCI_OP_LE_REMOVE_ADV_SET);
1486         if (!instance)
1487                 return rp->status;
1488
1489         hci_dev_lock(hdev);
1490
1491         err = hci_remove_adv_instance(hdev, *instance);
1492         if (!err)
1493                 mgmt_advertising_removed(hci_skb_sk(hdev->sent_cmd), hdev,
1494                                          *instance);
1495
1496         hci_dev_unlock(hdev);
1497
1498         return rp->status;
1499 }
1500
1501 static u8 hci_cc_le_clear_adv_sets(struct hci_dev *hdev, void *data,
1502                                    struct sk_buff *skb)
1503 {
1504         struct hci_ev_status *rp = data;
1505         struct adv_info *adv, *n;
1506         int err;
1507
1508         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1509
1510         if (rp->status)
1511                 return rp->status;
1512
1513         if (!hci_sent_cmd_data(hdev, HCI_OP_LE_CLEAR_ADV_SETS))
1514                 return rp->status;
1515
1516         hci_dev_lock(hdev);
1517
1518         list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) {
1519                 u8 instance = adv->instance;
1520
1521                 err = hci_remove_adv_instance(hdev, instance);
1522                 if (!err)
1523                         mgmt_advertising_removed(hci_skb_sk(hdev->sent_cmd),
1524                                                  hdev, instance);
1525         }
1526
1527         hci_dev_unlock(hdev);
1528
1529         return rp->status;
1530 }
1531
1532 static u8 hci_cc_le_read_transmit_power(struct hci_dev *hdev, void *data,
1533                                         struct sk_buff *skb)
1534 {
1535         struct hci_rp_le_read_transmit_power *rp = data;
1536
1537         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1538
1539         if (rp->status)
1540                 return rp->status;
1541
1542         hdev->min_le_tx_power = rp->min_le_tx_power;
1543         hdev->max_le_tx_power = rp->max_le_tx_power;
1544
1545         return rp->status;
1546 }
1547
1548 static u8 hci_cc_le_set_privacy_mode(struct hci_dev *hdev, void *data,
1549                                      struct sk_buff *skb)
1550 {
1551         struct hci_ev_status *rp = data;
1552         struct hci_cp_le_set_privacy_mode *cp;
1553         struct hci_conn_params *params;
1554
1555         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1556
1557         if (rp->status)
1558                 return rp->status;
1559
1560         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_PRIVACY_MODE);
1561         if (!cp)
1562                 return rp->status;
1563
1564         hci_dev_lock(hdev);
1565
1566         params = hci_conn_params_lookup(hdev, &cp->bdaddr, cp->bdaddr_type);
1567         if (params)
1568                 WRITE_ONCE(params->privacy_mode, cp->mode);
1569
1570         hci_dev_unlock(hdev);
1571
1572         return rp->status;
1573 }
1574
1575 static u8 hci_cc_le_set_adv_enable(struct hci_dev *hdev, void *data,
1576                                    struct sk_buff *skb)
1577 {
1578         struct hci_ev_status *rp = data;
1579         __u8 *sent;
1580
1581         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1582
1583         if (rp->status)
1584                 return rp->status;
1585
1586         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_ENABLE);
1587         if (!sent)
1588                 return rp->status;
1589
1590         hci_dev_lock(hdev);
1591
1592         /* If we're doing connection initiation as peripheral. Set a
1593          * timeout in case something goes wrong.
1594          */
1595         if (*sent) {
1596                 struct hci_conn *conn;
1597
1598                 hci_dev_set_flag(hdev, HCI_LE_ADV);
1599
1600                 conn = hci_lookup_le_connect(hdev);
1601                 if (conn)
1602                         queue_delayed_work(hdev->workqueue,
1603                                            &conn->le_conn_timeout,
1604                                            conn->conn_timeout);
1605         } else {
1606                 hci_dev_clear_flag(hdev, HCI_LE_ADV);
1607         }
1608
1609         hci_dev_unlock(hdev);
1610
1611         return rp->status;
1612 }
1613
1614 static u8 hci_cc_le_set_ext_adv_enable(struct hci_dev *hdev, void *data,
1615                                        struct sk_buff *skb)
1616 {
1617         struct hci_cp_le_set_ext_adv_enable *cp;
1618         struct hci_cp_ext_adv_set *set;
1619         struct adv_info *adv = NULL, *n;
1620         struct hci_ev_status *rp = data;
1621
1622         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1623
1624         if (rp->status)
1625                 return rp->status;
1626
1627         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE);
1628         if (!cp)
1629                 return rp->status;
1630
1631         set = (void *)cp->data;
1632
1633         hci_dev_lock(hdev);
1634
1635         if (cp->num_of_sets)
1636                 adv = hci_find_adv_instance(hdev, set->handle);
1637
1638         if (cp->enable) {
1639                 struct hci_conn *conn;
1640
1641                 hci_dev_set_flag(hdev, HCI_LE_ADV);
1642
1643                 if (adv && !adv->periodic)
1644                         adv->enabled = true;
1645
1646                 conn = hci_lookup_le_connect(hdev);
1647                 if (conn)
1648                         queue_delayed_work(hdev->workqueue,
1649                                            &conn->le_conn_timeout,
1650                                            conn->conn_timeout);
1651         } else {
1652                 if (cp->num_of_sets) {
1653                         if (adv)
1654                                 adv->enabled = false;
1655
1656                         /* If just one instance was disabled check if there are
1657                          * any other instance enabled before clearing HCI_LE_ADV
1658                          */
1659                         list_for_each_entry_safe(adv, n, &hdev->adv_instances,
1660                                                  list) {
1661                                 if (adv->enabled)
1662                                         goto unlock;
1663                         }
1664                 } else {
1665                         /* All instances shall be considered disabled */
1666                         list_for_each_entry_safe(adv, n, &hdev->adv_instances,
1667                                                  list)
1668                                 adv->enabled = false;
1669                 }
1670
1671                 hci_dev_clear_flag(hdev, HCI_LE_ADV);
1672         }
1673
1674 unlock:
1675         hci_dev_unlock(hdev);
1676         return rp->status;
1677 }
1678
1679 static u8 hci_cc_le_set_scan_param(struct hci_dev *hdev, void *data,
1680                                    struct sk_buff *skb)
1681 {
1682         struct hci_cp_le_set_scan_param *cp;
1683         struct hci_ev_status *rp = data;
1684
1685         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1686
1687         if (rp->status)
1688                 return rp->status;
1689
1690         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_PARAM);
1691         if (!cp)
1692                 return rp->status;
1693
1694         hci_dev_lock(hdev);
1695
1696         hdev->le_scan_type = cp->type;
1697
1698         hci_dev_unlock(hdev);
1699
1700         return rp->status;
1701 }
1702
1703 static u8 hci_cc_le_set_ext_scan_param(struct hci_dev *hdev, void *data,
1704                                        struct sk_buff *skb)
1705 {
1706         struct hci_cp_le_set_ext_scan_params *cp;
1707         struct hci_ev_status *rp = data;
1708         struct hci_cp_le_scan_phy_params *phy_param;
1709
1710         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1711
1712         if (rp->status)
1713                 return rp->status;
1714
1715         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_SCAN_PARAMS);
1716         if (!cp)
1717                 return rp->status;
1718
1719         phy_param = (void *)cp->data;
1720
1721         hci_dev_lock(hdev);
1722
1723         hdev->le_scan_type = phy_param->type;
1724
1725         hci_dev_unlock(hdev);
1726
1727         return rp->status;
1728 }
1729
1730 static bool has_pending_adv_report(struct hci_dev *hdev)
1731 {
1732         struct discovery_state *d = &hdev->discovery;
1733
1734         return bacmp(&d->last_adv_addr, BDADDR_ANY);
1735 }
1736
1737 static void clear_pending_adv_report(struct hci_dev *hdev)
1738 {
1739         struct discovery_state *d = &hdev->discovery;
1740
1741         bacpy(&d->last_adv_addr, BDADDR_ANY);
1742         d->last_adv_data_len = 0;
1743 }
1744
1745 static void store_pending_adv_report(struct hci_dev *hdev, bdaddr_t *bdaddr,
1746                                      u8 bdaddr_type, s8 rssi, u32 flags,
1747                                      u8 *data, u8 len)
1748 {
1749         struct discovery_state *d = &hdev->discovery;
1750
1751         if (len > max_adv_len(hdev))
1752                 return;
1753
1754         bacpy(&d->last_adv_addr, bdaddr);
1755         d->last_adv_addr_type = bdaddr_type;
1756         d->last_adv_rssi = rssi;
1757         d->last_adv_flags = flags;
1758         memcpy(d->last_adv_data, data, len);
1759         d->last_adv_data_len = len;
1760 }
1761
1762 static void le_set_scan_enable_complete(struct hci_dev *hdev, u8 enable)
1763 {
1764         hci_dev_lock(hdev);
1765
1766         switch (enable) {
1767         case LE_SCAN_ENABLE:
1768                 hci_dev_set_flag(hdev, HCI_LE_SCAN);
1769                 if (hdev->le_scan_type == LE_SCAN_ACTIVE)
1770                         clear_pending_adv_report(hdev);
1771                 if (hci_dev_test_flag(hdev, HCI_MESH))
1772                         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
1773                 break;
1774
1775         case LE_SCAN_DISABLE:
1776                 /* We do this here instead of when setting DISCOVERY_STOPPED
1777                  * since the latter would potentially require waiting for
1778                  * inquiry to stop too.
1779                  */
1780                 if (has_pending_adv_report(hdev)) {
1781                         struct discovery_state *d = &hdev->discovery;
1782
1783                         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
1784                                           d->last_adv_addr_type, NULL,
1785                                           d->last_adv_rssi, d->last_adv_flags,
1786                                           d->last_adv_data,
1787                                           d->last_adv_data_len, NULL, 0, 0);
1788                 }
1789
1790                 /* Cancel this timer so that we don't try to disable scanning
1791                  * when it's already disabled.
1792                  */
1793                 cancel_delayed_work(&hdev->le_scan_disable);
1794
1795                 hci_dev_clear_flag(hdev, HCI_LE_SCAN);
1796
1797                 /* The HCI_LE_SCAN_INTERRUPTED flag indicates that we
1798                  * interrupted scanning due to a connect request. Mark
1799                  * therefore discovery as stopped.
1800                  */
1801                 if (hci_dev_test_and_clear_flag(hdev, HCI_LE_SCAN_INTERRUPTED))
1802                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1803                 else if (!hci_dev_test_flag(hdev, HCI_LE_ADV) &&
1804                          hdev->discovery.state == DISCOVERY_FINDING)
1805                         queue_work(hdev->workqueue, &hdev->reenable_adv_work);
1806
1807                 break;
1808
1809         default:
1810                 bt_dev_err(hdev, "use of reserved LE_Scan_Enable param %d",
1811                            enable);
1812                 break;
1813         }
1814
1815         hci_dev_unlock(hdev);
1816 }
1817
1818 static u8 hci_cc_le_set_scan_enable(struct hci_dev *hdev, void *data,
1819                                     struct sk_buff *skb)
1820 {
1821         struct hci_cp_le_set_scan_enable *cp;
1822         struct hci_ev_status *rp = data;
1823
1824         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1825
1826         if (rp->status)
1827                 return rp->status;
1828
1829         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
1830         if (!cp)
1831                 return rp->status;
1832
1833         le_set_scan_enable_complete(hdev, cp->enable);
1834
1835         return rp->status;
1836 }
1837
1838 static u8 hci_cc_le_set_ext_scan_enable(struct hci_dev *hdev, void *data,
1839                                         struct sk_buff *skb)
1840 {
1841         struct hci_cp_le_set_ext_scan_enable *cp;
1842         struct hci_ev_status *rp = data;
1843
1844         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1845
1846         if (rp->status)
1847                 return rp->status;
1848
1849         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_SCAN_ENABLE);
1850         if (!cp)
1851                 return rp->status;
1852
1853         le_set_scan_enable_complete(hdev, cp->enable);
1854
1855         return rp->status;
1856 }
1857
1858 static u8 hci_cc_le_read_num_adv_sets(struct hci_dev *hdev, void *data,
1859                                       struct sk_buff *skb)
1860 {
1861         struct hci_rp_le_read_num_supported_adv_sets *rp = data;
1862
1863         bt_dev_dbg(hdev, "status 0x%2.2x No of Adv sets %u", rp->status,
1864                    rp->num_of_sets);
1865
1866         if (rp->status)
1867                 return rp->status;
1868
1869         hdev->le_num_of_adv_sets = rp->num_of_sets;
1870
1871         return rp->status;
1872 }
1873
1874 static u8 hci_cc_le_read_accept_list_size(struct hci_dev *hdev, void *data,
1875                                           struct sk_buff *skb)
1876 {
1877         struct hci_rp_le_read_accept_list_size *rp = data;
1878
1879         bt_dev_dbg(hdev, "status 0x%2.2x size %u", rp->status, rp->size);
1880
1881         if (rp->status)
1882                 return rp->status;
1883
1884         hdev->le_accept_list_size = rp->size;
1885
1886         return rp->status;
1887 }
1888
1889 static u8 hci_cc_le_clear_accept_list(struct hci_dev *hdev, void *data,
1890                                       struct sk_buff *skb)
1891 {
1892         struct hci_ev_status *rp = data;
1893
1894         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1895
1896         if (rp->status)
1897                 return rp->status;
1898
1899         hci_dev_lock(hdev);
1900         hci_bdaddr_list_clear(&hdev->le_accept_list);
1901         hci_dev_unlock(hdev);
1902
1903         return rp->status;
1904 }
1905
1906 static u8 hci_cc_le_add_to_accept_list(struct hci_dev *hdev, void *data,
1907                                        struct sk_buff *skb)
1908 {
1909         struct hci_cp_le_add_to_accept_list *sent;
1910         struct hci_ev_status *rp = data;
1911
1912         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1913
1914         if (rp->status)
1915                 return rp->status;
1916
1917         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_ACCEPT_LIST);
1918         if (!sent)
1919                 return rp->status;
1920
1921         hci_dev_lock(hdev);
1922         hci_bdaddr_list_add(&hdev->le_accept_list, &sent->bdaddr,
1923                             sent->bdaddr_type);
1924         hci_dev_unlock(hdev);
1925
1926         return rp->status;
1927 }
1928
1929 static u8 hci_cc_le_del_from_accept_list(struct hci_dev *hdev, void *data,
1930                                          struct sk_buff *skb)
1931 {
1932         struct hci_cp_le_del_from_accept_list *sent;
1933         struct hci_ev_status *rp = data;
1934
1935         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1936
1937         if (rp->status)
1938                 return rp->status;
1939
1940         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_ACCEPT_LIST);
1941         if (!sent)
1942                 return rp->status;
1943
1944         hci_dev_lock(hdev);
1945         hci_bdaddr_list_del(&hdev->le_accept_list, &sent->bdaddr,
1946                             sent->bdaddr_type);
1947         hci_dev_unlock(hdev);
1948
1949         return rp->status;
1950 }
1951
1952 static u8 hci_cc_le_read_supported_states(struct hci_dev *hdev, void *data,
1953                                           struct sk_buff *skb)
1954 {
1955         struct hci_rp_le_read_supported_states *rp = data;
1956
1957         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1958
1959         if (rp->status)
1960                 return rp->status;
1961
1962         memcpy(hdev->le_states, rp->le_states, 8);
1963
1964         return rp->status;
1965 }
1966
1967 static u8 hci_cc_le_read_def_data_len(struct hci_dev *hdev, void *data,
1968                                       struct sk_buff *skb)
1969 {
1970         struct hci_rp_le_read_def_data_len *rp = data;
1971
1972         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1973
1974         if (rp->status)
1975                 return rp->status;
1976
1977         hdev->le_def_tx_len = le16_to_cpu(rp->tx_len);
1978         hdev->le_def_tx_time = le16_to_cpu(rp->tx_time);
1979
1980         return rp->status;
1981 }
1982
1983 static u8 hci_cc_le_write_def_data_len(struct hci_dev *hdev, void *data,
1984                                        struct sk_buff *skb)
1985 {
1986         struct hci_cp_le_write_def_data_len *sent;
1987         struct hci_ev_status *rp = data;
1988
1989         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1990
1991         if (rp->status)
1992                 return rp->status;
1993
1994         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_WRITE_DEF_DATA_LEN);
1995         if (!sent)
1996                 return rp->status;
1997
1998         hdev->le_def_tx_len = le16_to_cpu(sent->tx_len);
1999         hdev->le_def_tx_time = le16_to_cpu(sent->tx_time);
2000
2001         return rp->status;
2002 }
2003
2004 static u8 hci_cc_le_add_to_resolv_list(struct hci_dev *hdev, void *data,
2005                                        struct sk_buff *skb)
2006 {
2007         struct hci_cp_le_add_to_resolv_list *sent;
2008         struct hci_ev_status *rp = data;
2009
2010         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2011
2012         if (rp->status)
2013                 return rp->status;
2014
2015         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_RESOLV_LIST);
2016         if (!sent)
2017                 return rp->status;
2018
2019         hci_dev_lock(hdev);
2020         hci_bdaddr_list_add_with_irk(&hdev->le_resolv_list, &sent->bdaddr,
2021                                 sent->bdaddr_type, sent->peer_irk,
2022                                 sent->local_irk);
2023         hci_dev_unlock(hdev);
2024
2025         return rp->status;
2026 }
2027
2028 static u8 hci_cc_le_del_from_resolv_list(struct hci_dev *hdev, void *data,
2029                                          struct sk_buff *skb)
2030 {
2031         struct hci_cp_le_del_from_resolv_list *sent;
2032         struct hci_ev_status *rp = data;
2033
2034         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2035
2036         if (rp->status)
2037                 return rp->status;
2038
2039         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_RESOLV_LIST);
2040         if (!sent)
2041                 return rp->status;
2042
2043         hci_dev_lock(hdev);
2044         hci_bdaddr_list_del_with_irk(&hdev->le_resolv_list, &sent->bdaddr,
2045                             sent->bdaddr_type);
2046         hci_dev_unlock(hdev);
2047
2048         return rp->status;
2049 }
2050
2051 static u8 hci_cc_le_clear_resolv_list(struct hci_dev *hdev, void *data,
2052                                       struct sk_buff *skb)
2053 {
2054         struct hci_ev_status *rp = data;
2055
2056         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2057
2058         if (rp->status)
2059                 return rp->status;
2060
2061         hci_dev_lock(hdev);
2062         hci_bdaddr_list_clear(&hdev->le_resolv_list);
2063         hci_dev_unlock(hdev);
2064
2065         return rp->status;
2066 }
2067
2068 static u8 hci_cc_le_read_resolv_list_size(struct hci_dev *hdev, void *data,
2069                                           struct sk_buff *skb)
2070 {
2071         struct hci_rp_le_read_resolv_list_size *rp = data;
2072
2073         bt_dev_dbg(hdev, "status 0x%2.2x size %u", rp->status, rp->size);
2074
2075         if (rp->status)
2076                 return rp->status;
2077
2078         hdev->le_resolv_list_size = rp->size;
2079
2080         return rp->status;
2081 }
2082
2083 static u8 hci_cc_le_set_addr_resolution_enable(struct hci_dev *hdev, void *data,
2084                                                struct sk_buff *skb)
2085 {
2086         struct hci_ev_status *rp = data;
2087         __u8 *sent;
2088
2089         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2090
2091         if (rp->status)
2092                 return rp->status;
2093
2094         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADDR_RESOLV_ENABLE);
2095         if (!sent)
2096                 return rp->status;
2097
2098         hci_dev_lock(hdev);
2099
2100         if (*sent)
2101                 hci_dev_set_flag(hdev, HCI_LL_RPA_RESOLUTION);
2102         else
2103                 hci_dev_clear_flag(hdev, HCI_LL_RPA_RESOLUTION);
2104
2105         hci_dev_unlock(hdev);
2106
2107         return rp->status;
2108 }
2109
2110 static u8 hci_cc_le_read_max_data_len(struct hci_dev *hdev, void *data,
2111                                       struct sk_buff *skb)
2112 {
2113         struct hci_rp_le_read_max_data_len *rp = data;
2114
2115         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2116
2117         if (rp->status)
2118                 return rp->status;
2119
2120         hdev->le_max_tx_len = le16_to_cpu(rp->tx_len);
2121         hdev->le_max_tx_time = le16_to_cpu(rp->tx_time);
2122         hdev->le_max_rx_len = le16_to_cpu(rp->rx_len);
2123         hdev->le_max_rx_time = le16_to_cpu(rp->rx_time);
2124
2125         return rp->status;
2126 }
2127
2128 static u8 hci_cc_write_le_host_supported(struct hci_dev *hdev, void *data,
2129                                          struct sk_buff *skb)
2130 {
2131         struct hci_cp_write_le_host_supported *sent;
2132         struct hci_ev_status *rp = data;
2133
2134         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2135
2136         if (rp->status)
2137                 return rp->status;
2138
2139         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
2140         if (!sent)
2141                 return rp->status;
2142
2143         hci_dev_lock(hdev);
2144
2145         if (sent->le) {
2146                 hdev->features[1][0] |= LMP_HOST_LE;
2147                 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
2148         } else {
2149                 hdev->features[1][0] &= ~LMP_HOST_LE;
2150                 hci_dev_clear_flag(hdev, HCI_LE_ENABLED);
2151                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
2152         }
2153
2154         if (sent->simul)
2155                 hdev->features[1][0] |= LMP_HOST_LE_BREDR;
2156         else
2157                 hdev->features[1][0] &= ~LMP_HOST_LE_BREDR;
2158
2159         hci_dev_unlock(hdev);
2160
2161         return rp->status;
2162 }
2163
2164 static u8 hci_cc_set_adv_param(struct hci_dev *hdev, void *data,
2165                                struct sk_buff *skb)
2166 {
2167         struct hci_cp_le_set_adv_param *cp;
2168         struct hci_ev_status *rp = data;
2169
2170         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2171
2172         if (rp->status)
2173                 return rp->status;
2174
2175         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_PARAM);
2176         if (!cp)
2177                 return rp->status;
2178
2179         hci_dev_lock(hdev);
2180         hdev->adv_addr_type = cp->own_address_type;
2181         hci_dev_unlock(hdev);
2182
2183         return rp->status;
2184 }
2185
2186 static u8 hci_cc_set_ext_adv_param(struct hci_dev *hdev, void *data,
2187                                    struct sk_buff *skb)
2188 {
2189         struct hci_rp_le_set_ext_adv_params *rp = data;
2190         struct hci_cp_le_set_ext_adv_params *cp;
2191         struct adv_info *adv_instance;
2192
2193         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2194
2195         if (rp->status)
2196                 return rp->status;
2197
2198         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_PARAMS);
2199         if (!cp)
2200                 return rp->status;
2201
2202         hci_dev_lock(hdev);
2203         hdev->adv_addr_type = cp->own_addr_type;
2204         if (!cp->handle) {
2205                 /* Store in hdev for instance 0 */
2206                 hdev->adv_tx_power = rp->tx_power;
2207         } else {
2208                 adv_instance = hci_find_adv_instance(hdev, cp->handle);
2209                 if (adv_instance)
2210                         adv_instance->tx_power = rp->tx_power;
2211         }
2212         /* Update adv data as tx power is known now */
2213         hci_update_adv_data(hdev, cp->handle);
2214
2215         hci_dev_unlock(hdev);
2216
2217         return rp->status;
2218 }
2219
2220 static u8 hci_cc_read_rssi(struct hci_dev *hdev, void *data,
2221                            struct sk_buff *skb)
2222 {
2223         struct hci_rp_read_rssi *rp = data;
2224         struct hci_conn *conn;
2225
2226         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2227
2228         if (rp->status)
2229                 return rp->status;
2230
2231         hci_dev_lock(hdev);
2232
2233         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
2234         if (conn)
2235                 conn->rssi = rp->rssi;
2236
2237         hci_dev_unlock(hdev);
2238
2239         return rp->status;
2240 }
2241
2242 static u8 hci_cc_read_tx_power(struct hci_dev *hdev, void *data,
2243                                struct sk_buff *skb)
2244 {
2245         struct hci_cp_read_tx_power *sent;
2246         struct hci_rp_read_tx_power *rp = data;
2247         struct hci_conn *conn;
2248
2249         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2250
2251         if (rp->status)
2252                 return rp->status;
2253
2254         sent = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
2255         if (!sent)
2256                 return rp->status;
2257
2258         hci_dev_lock(hdev);
2259
2260         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
2261         if (!conn)
2262                 goto unlock;
2263
2264         switch (sent->type) {
2265         case 0x00:
2266                 conn->tx_power = rp->tx_power;
2267                 break;
2268         case 0x01:
2269                 conn->max_tx_power = rp->tx_power;
2270                 break;
2271         }
2272
2273 unlock:
2274         hci_dev_unlock(hdev);
2275         return rp->status;
2276 }
2277
2278 static u8 hci_cc_write_ssp_debug_mode(struct hci_dev *hdev, void *data,
2279                                       struct sk_buff *skb)
2280 {
2281         struct hci_ev_status *rp = data;
2282         u8 *mode;
2283
2284         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2285
2286         if (rp->status)
2287                 return rp->status;
2288
2289         mode = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE);
2290         if (mode)
2291                 hdev->ssp_debug_mode = *mode;
2292
2293         return rp->status;
2294 }
2295
2296 static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
2297 {
2298         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2299
2300         if (status) {
2301                 hci_conn_check_pending(hdev);
2302                 return;
2303         }
2304
2305         set_bit(HCI_INQUIRY, &hdev->flags);
2306 }
2307
2308 static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
2309 {
2310         struct hci_cp_create_conn *cp;
2311         struct hci_conn *conn;
2312
2313         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2314
2315         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
2316         if (!cp)
2317                 return;
2318
2319         hci_dev_lock(hdev);
2320
2321         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2322
2323         bt_dev_dbg(hdev, "bdaddr %pMR hcon %p", &cp->bdaddr, conn);
2324
2325         if (status) {
2326                 if (conn && conn->state == BT_CONNECT) {
2327                         if (status != 0x0c || conn->attempt > 2) {
2328                                 conn->state = BT_CLOSED;
2329                                 hci_connect_cfm(conn, status);
2330                                 hci_conn_del(conn);
2331                         } else
2332                                 conn->state = BT_CONNECT2;
2333                 }
2334         } else {
2335                 if (!conn) {
2336                         conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr,
2337                                             HCI_ROLE_MASTER);
2338                         if (!conn)
2339                                 bt_dev_err(hdev, "no memory for new connection");
2340                 }
2341         }
2342
2343         hci_dev_unlock(hdev);
2344 }
2345
2346 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
2347 {
2348         struct hci_cp_add_sco *cp;
2349         struct hci_conn *acl;
2350         struct hci_link *link;
2351         __u16 handle;
2352
2353         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2354
2355         if (!status)
2356                 return;
2357
2358         cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
2359         if (!cp)
2360                 return;
2361
2362         handle = __le16_to_cpu(cp->handle);
2363
2364         bt_dev_dbg(hdev, "handle 0x%4.4x", handle);
2365
2366         hci_dev_lock(hdev);
2367
2368         acl = hci_conn_hash_lookup_handle(hdev, handle);
2369         if (acl) {
2370                 link = list_first_entry_or_null(&acl->link_list,
2371                                                 struct hci_link, list);
2372                 if (link && link->conn) {
2373                         link->conn->state = BT_CLOSED;
2374
2375                         hci_connect_cfm(link->conn, status);
2376                         hci_conn_del(link->conn);
2377                 }
2378         }
2379
2380         hci_dev_unlock(hdev);
2381 }
2382
2383 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
2384 {
2385         struct hci_cp_auth_requested *cp;
2386         struct hci_conn *conn;
2387
2388         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2389
2390         if (!status)
2391                 return;
2392
2393         cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
2394         if (!cp)
2395                 return;
2396
2397         hci_dev_lock(hdev);
2398
2399         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2400         if (conn) {
2401                 if (conn->state == BT_CONFIG) {
2402                         hci_connect_cfm(conn, status);
2403                         hci_conn_drop(conn);
2404                 }
2405         }
2406
2407         hci_dev_unlock(hdev);
2408 }
2409
2410 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
2411 {
2412         struct hci_cp_set_conn_encrypt *cp;
2413         struct hci_conn *conn;
2414
2415         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2416
2417         if (!status)
2418                 return;
2419
2420         cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
2421         if (!cp)
2422                 return;
2423
2424         hci_dev_lock(hdev);
2425
2426         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2427         if (conn) {
2428                 if (conn->state == BT_CONFIG) {
2429                         hci_connect_cfm(conn, status);
2430                         hci_conn_drop(conn);
2431                 }
2432         }
2433
2434         hci_dev_unlock(hdev);
2435 }
2436
2437 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
2438                                     struct hci_conn *conn)
2439 {
2440         if (conn->state != BT_CONFIG || !conn->out)
2441                 return 0;
2442
2443         if (conn->pending_sec_level == BT_SECURITY_SDP)
2444                 return 0;
2445
2446         /* Only request authentication for SSP connections or non-SSP
2447          * devices with sec_level MEDIUM or HIGH or if MITM protection
2448          * is requested.
2449          */
2450         if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
2451             conn->pending_sec_level != BT_SECURITY_FIPS &&
2452             conn->pending_sec_level != BT_SECURITY_HIGH &&
2453             conn->pending_sec_level != BT_SECURITY_MEDIUM)
2454                 return 0;
2455
2456         return 1;
2457 }
2458
2459 static int hci_resolve_name(struct hci_dev *hdev,
2460                                    struct inquiry_entry *e)
2461 {
2462         struct hci_cp_remote_name_req cp;
2463
2464         memset(&cp, 0, sizeof(cp));
2465
2466         bacpy(&cp.bdaddr, &e->data.bdaddr);
2467         cp.pscan_rep_mode = e->data.pscan_rep_mode;
2468         cp.pscan_mode = e->data.pscan_mode;
2469         cp.clock_offset = e->data.clock_offset;
2470
2471         return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2472 }
2473
2474 static bool hci_resolve_next_name(struct hci_dev *hdev)
2475 {
2476         struct discovery_state *discov = &hdev->discovery;
2477         struct inquiry_entry *e;
2478
2479         if (list_empty(&discov->resolve))
2480                 return false;
2481
2482         /* We should stop if we already spent too much time resolving names. */
2483         if (time_after(jiffies, discov->name_resolve_timeout)) {
2484                 bt_dev_warn_ratelimited(hdev, "Name resolve takes too long.");
2485                 return false;
2486         }
2487
2488         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
2489         if (!e)
2490                 return false;
2491
2492         if (hci_resolve_name(hdev, e) == 0) {
2493                 e->name_state = NAME_PENDING;
2494                 return true;
2495         }
2496
2497         return false;
2498 }
2499
2500 static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
2501                                    bdaddr_t *bdaddr, u8 *name, u8 name_len)
2502 {
2503         struct discovery_state *discov = &hdev->discovery;
2504         struct inquiry_entry *e;
2505
2506         /* Update the mgmt connected state if necessary. Be careful with
2507          * conn objects that exist but are not (yet) connected however.
2508          * Only those in BT_CONFIG or BT_CONNECTED states can be
2509          * considered connected.
2510          */
2511         if (conn &&
2512             (conn->state == BT_CONFIG || conn->state == BT_CONNECTED) &&
2513             !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2514                 mgmt_device_connected(hdev, conn, name, name_len);
2515
2516         if (discov->state == DISCOVERY_STOPPED)
2517                 return;
2518
2519         if (discov->state == DISCOVERY_STOPPING)
2520                 goto discov_complete;
2521
2522         if (discov->state != DISCOVERY_RESOLVING)
2523                 return;
2524
2525         e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
2526         /* If the device was not found in a list of found devices names of which
2527          * are pending. there is no need to continue resolving a next name as it
2528          * will be done upon receiving another Remote Name Request Complete
2529          * Event */
2530         if (!e)
2531                 return;
2532
2533         list_del(&e->list);
2534
2535         e->name_state = name ? NAME_KNOWN : NAME_NOT_KNOWN;
2536         mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00, e->data.rssi,
2537                          name, name_len);
2538
2539         if (hci_resolve_next_name(hdev))
2540                 return;
2541
2542 discov_complete:
2543         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2544 }
2545
2546 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
2547 {
2548         struct hci_cp_remote_name_req *cp;
2549         struct hci_conn *conn;
2550
2551         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2552
2553         /* If successful wait for the name req complete event before
2554          * checking for the need to do authentication */
2555         if (!status)
2556                 return;
2557
2558         cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
2559         if (!cp)
2560                 return;
2561
2562         hci_dev_lock(hdev);
2563
2564         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2565
2566         if (hci_dev_test_flag(hdev, HCI_MGMT))
2567                 hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
2568
2569         if (!conn)
2570                 goto unlock;
2571
2572         if (!hci_outgoing_auth_needed(hdev, conn))
2573                 goto unlock;
2574
2575         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
2576                 struct hci_cp_auth_requested auth_cp;
2577
2578                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
2579
2580                 auth_cp.handle = __cpu_to_le16(conn->handle);
2581                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
2582                              sizeof(auth_cp), &auth_cp);
2583         }
2584
2585 unlock:
2586         hci_dev_unlock(hdev);
2587 }
2588
2589 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
2590 {
2591         struct hci_cp_read_remote_features *cp;
2592         struct hci_conn *conn;
2593
2594         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2595
2596         if (!status)
2597                 return;
2598
2599         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
2600         if (!cp)
2601                 return;
2602
2603         hci_dev_lock(hdev);
2604
2605         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2606         if (conn) {
2607                 if (conn->state == BT_CONFIG) {
2608                         hci_connect_cfm(conn, status);
2609                         hci_conn_drop(conn);
2610                 }
2611         }
2612
2613         hci_dev_unlock(hdev);
2614 }
2615
2616 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
2617 {
2618         struct hci_cp_read_remote_ext_features *cp;
2619         struct hci_conn *conn;
2620
2621         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2622
2623         if (!status)
2624                 return;
2625
2626         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
2627         if (!cp)
2628                 return;
2629
2630         hci_dev_lock(hdev);
2631
2632         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2633         if (conn) {
2634                 if (conn->state == BT_CONFIG) {
2635                         hci_connect_cfm(conn, status);
2636                         hci_conn_drop(conn);
2637                 }
2638         }
2639
2640         hci_dev_unlock(hdev);
2641 }
2642
2643 static void hci_setup_sync_conn_status(struct hci_dev *hdev, __u16 handle,
2644                                        __u8 status)
2645 {
2646         struct hci_conn *acl;
2647         struct hci_link *link;
2648
2649         bt_dev_dbg(hdev, "handle 0x%4.4x status 0x%2.2x", handle, status);
2650
2651         hci_dev_lock(hdev);
2652
2653         acl = hci_conn_hash_lookup_handle(hdev, handle);
2654         if (acl) {
2655                 link = list_first_entry_or_null(&acl->link_list,
2656                                                 struct hci_link, list);
2657                 if (link && link->conn) {
2658                         link->conn->state = BT_CLOSED;
2659
2660                         hci_connect_cfm(link->conn, status);
2661                         hci_conn_del(link->conn);
2662                 }
2663         }
2664
2665         hci_dev_unlock(hdev);
2666 }
2667
2668 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
2669 {
2670         struct hci_cp_setup_sync_conn *cp;
2671
2672         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2673
2674         if (!status)
2675                 return;
2676
2677         cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
2678         if (!cp)
2679                 return;
2680
2681         hci_setup_sync_conn_status(hdev, __le16_to_cpu(cp->handle), status);
2682 }
2683
2684 static void hci_cs_enhanced_setup_sync_conn(struct hci_dev *hdev, __u8 status)
2685 {
2686         struct hci_cp_enhanced_setup_sync_conn *cp;
2687
2688         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2689
2690         if (!status)
2691                 return;
2692
2693         cp = hci_sent_cmd_data(hdev, HCI_OP_ENHANCED_SETUP_SYNC_CONN);
2694         if (!cp)
2695                 return;
2696
2697         hci_setup_sync_conn_status(hdev, __le16_to_cpu(cp->handle), status);
2698 }
2699
2700 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
2701 {
2702         struct hci_cp_sniff_mode *cp;
2703         struct hci_conn *conn;
2704
2705         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2706
2707         if (!status)
2708                 return;
2709
2710         cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
2711         if (!cp)
2712                 return;
2713
2714         hci_dev_lock(hdev);
2715
2716         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2717         if (conn) {
2718                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
2719
2720                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2721                         hci_sco_setup(conn, status);
2722         }
2723
2724         hci_dev_unlock(hdev);
2725 }
2726
2727 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
2728 {
2729         struct hci_cp_exit_sniff_mode *cp;
2730         struct hci_conn *conn;
2731
2732         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2733
2734         if (!status)
2735                 return;
2736
2737         cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
2738         if (!cp)
2739                 return;
2740
2741         hci_dev_lock(hdev);
2742
2743         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2744         if (conn) {
2745                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
2746
2747                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2748                         hci_sco_setup(conn, status);
2749         }
2750
2751         hci_dev_unlock(hdev);
2752 }
2753
2754 static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
2755 {
2756         struct hci_cp_disconnect *cp;
2757         struct hci_conn_params *params;
2758         struct hci_conn *conn;
2759         bool mgmt_conn;
2760
2761         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2762
2763         /* Wait for HCI_EV_DISCONN_COMPLETE if status 0x00 and not suspended
2764          * otherwise cleanup the connection immediately.
2765          */
2766         if (!status && !hdev->suspended)
2767                 return;
2768
2769         cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
2770         if (!cp)
2771                 return;
2772
2773         hci_dev_lock(hdev);
2774
2775         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2776         if (!conn)
2777                 goto unlock;
2778
2779         if (status) {
2780                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2781                                        conn->dst_type, status);
2782
2783                 if (conn->type == LE_LINK && conn->role == HCI_ROLE_SLAVE) {
2784                         hdev->cur_adv_instance = conn->adv_instance;
2785                         hci_enable_advertising(hdev);
2786                 }
2787
2788                 /* Inform sockets conn is gone before we delete it */
2789                 hci_disconn_cfm(conn, HCI_ERROR_UNSPECIFIED);
2790
2791                 goto done;
2792         }
2793
2794         mgmt_conn = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags);
2795
2796         if (conn->type == ACL_LINK) {
2797                 if (test_and_clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
2798                         hci_remove_link_key(hdev, &conn->dst);
2799         }
2800
2801         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
2802         if (params) {
2803                 switch (params->auto_connect) {
2804                 case HCI_AUTO_CONN_LINK_LOSS:
2805                         if (cp->reason != HCI_ERROR_CONNECTION_TIMEOUT)
2806                                 break;
2807                         fallthrough;
2808
2809                 case HCI_AUTO_CONN_DIRECT:
2810                 case HCI_AUTO_CONN_ALWAYS:
2811                         hci_pend_le_list_del_init(params);
2812                         hci_pend_le_list_add(params, &hdev->pend_le_conns);
2813                         break;
2814
2815                 default:
2816                         break;
2817                 }
2818         }
2819
2820         mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type,
2821                                  cp->reason, mgmt_conn);
2822
2823         hci_disconn_cfm(conn, cp->reason);
2824
2825 done:
2826         /* If the disconnection failed for any reason, the upper layer
2827          * does not retry to disconnect in current implementation.
2828          * Hence, we need to do some basic cleanup here and re-enable
2829          * advertising if necessary.
2830          */
2831         hci_conn_del(conn);
2832 unlock:
2833         hci_dev_unlock(hdev);
2834 }
2835
2836 static u8 ev_bdaddr_type(struct hci_dev *hdev, u8 type, bool *resolved)
2837 {
2838         /* When using controller based address resolution, then the new
2839          * address types 0x02 and 0x03 are used. These types need to be
2840          * converted back into either public address or random address type
2841          */
2842         switch (type) {
2843         case ADDR_LE_DEV_PUBLIC_RESOLVED:
2844                 if (resolved)
2845                         *resolved = true;
2846                 return ADDR_LE_DEV_PUBLIC;
2847         case ADDR_LE_DEV_RANDOM_RESOLVED:
2848                 if (resolved)
2849                         *resolved = true;
2850                 return ADDR_LE_DEV_RANDOM;
2851         }
2852
2853         if (resolved)
2854                 *resolved = false;
2855         return type;
2856 }
2857
2858 static void cs_le_create_conn(struct hci_dev *hdev, bdaddr_t *peer_addr,
2859                               u8 peer_addr_type, u8 own_address_type,
2860                               u8 filter_policy)
2861 {
2862         struct hci_conn *conn;
2863
2864         conn = hci_conn_hash_lookup_le(hdev, peer_addr,
2865                                        peer_addr_type);
2866         if (!conn)
2867                 return;
2868
2869         own_address_type = ev_bdaddr_type(hdev, own_address_type, NULL);
2870
2871         /* Store the initiator and responder address information which
2872          * is needed for SMP. These values will not change during the
2873          * lifetime of the connection.
2874          */
2875         conn->init_addr_type = own_address_type;
2876         if (own_address_type == ADDR_LE_DEV_RANDOM)
2877                 bacpy(&conn->init_addr, &hdev->random_addr);
2878         else
2879                 bacpy(&conn->init_addr, &hdev->bdaddr);
2880
2881         conn->resp_addr_type = peer_addr_type;
2882         bacpy(&conn->resp_addr, peer_addr);
2883 }
2884
2885 static void hci_cs_le_create_conn(struct hci_dev *hdev, u8 status)
2886 {
2887         struct hci_cp_le_create_conn *cp;
2888
2889         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2890
2891         /* All connection failure handling is taken care of by the
2892          * hci_conn_failed function which is triggered by the HCI
2893          * request completion callbacks used for connecting.
2894          */
2895         if (status)
2896                 return;
2897
2898         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
2899         if (!cp)
2900                 return;
2901
2902         hci_dev_lock(hdev);
2903
2904         cs_le_create_conn(hdev, &cp->peer_addr, cp->peer_addr_type,
2905                           cp->own_address_type, cp->filter_policy);
2906
2907         hci_dev_unlock(hdev);
2908 }
2909
2910 static void hci_cs_le_ext_create_conn(struct hci_dev *hdev, u8 status)
2911 {
2912         struct hci_cp_le_ext_create_conn *cp;
2913
2914         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2915
2916         /* All connection failure handling is taken care of by the
2917          * hci_conn_failed function which is triggered by the HCI
2918          * request completion callbacks used for connecting.
2919          */
2920         if (status)
2921                 return;
2922
2923         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_EXT_CREATE_CONN);
2924         if (!cp)
2925                 return;
2926
2927         hci_dev_lock(hdev);
2928
2929         cs_le_create_conn(hdev, &cp->peer_addr, cp->peer_addr_type,
2930                           cp->own_addr_type, cp->filter_policy);
2931
2932         hci_dev_unlock(hdev);
2933 }
2934
2935 static void hci_cs_le_read_remote_features(struct hci_dev *hdev, u8 status)
2936 {
2937         struct hci_cp_le_read_remote_features *cp;
2938         struct hci_conn *conn;
2939
2940         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2941
2942         if (!status)
2943                 return;
2944
2945         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_READ_REMOTE_FEATURES);
2946         if (!cp)
2947                 return;
2948
2949         hci_dev_lock(hdev);
2950
2951         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2952         if (conn) {
2953                 if (conn->state == BT_CONFIG) {
2954                         hci_connect_cfm(conn, status);
2955                         hci_conn_drop(conn);
2956                 }
2957         }
2958
2959         hci_dev_unlock(hdev);
2960 }
2961
2962 static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
2963 {
2964         struct hci_cp_le_start_enc *cp;
2965         struct hci_conn *conn;
2966
2967         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2968
2969         if (!status)
2970                 return;
2971
2972         hci_dev_lock(hdev);
2973
2974         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_START_ENC);
2975         if (!cp)
2976                 goto unlock;
2977
2978         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2979         if (!conn)
2980                 goto unlock;
2981
2982         if (conn->state != BT_CONNECTED)
2983                 goto unlock;
2984
2985         hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2986         hci_conn_drop(conn);
2987
2988 unlock:
2989         hci_dev_unlock(hdev);
2990 }
2991
2992 static void hci_cs_switch_role(struct hci_dev *hdev, u8 status)
2993 {
2994         struct hci_cp_switch_role *cp;
2995         struct hci_conn *conn;
2996
2997         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2998
2999         if (!status)
3000                 return;
3001
3002         cp = hci_sent_cmd_data(hdev, HCI_OP_SWITCH_ROLE);
3003         if (!cp)
3004                 return;
3005
3006         hci_dev_lock(hdev);
3007
3008         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
3009         if (conn)
3010                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
3011
3012         hci_dev_unlock(hdev);
3013 }
3014
3015 static void hci_inquiry_complete_evt(struct hci_dev *hdev, void *data,
3016                                      struct sk_buff *skb)
3017 {
3018         struct hci_ev_status *ev = data;
3019         struct discovery_state *discov = &hdev->discovery;
3020         struct inquiry_entry *e;
3021
3022         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
3023
3024         hci_conn_check_pending(hdev);
3025
3026         if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
3027                 return;
3028
3029         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
3030         wake_up_bit(&hdev->flags, HCI_INQUIRY);
3031
3032         if (!hci_dev_test_flag(hdev, HCI_MGMT))
3033                 return;
3034
3035         hci_dev_lock(hdev);
3036
3037         if (discov->state != DISCOVERY_FINDING)
3038                 goto unlock;
3039
3040         if (list_empty(&discov->resolve)) {
3041                 /* When BR/EDR inquiry is active and no LE scanning is in
3042                  * progress, then change discovery state to indicate completion.
3043                  *
3044                  * When running LE scanning and BR/EDR inquiry simultaneously
3045                  * and the LE scan already finished, then change the discovery
3046                  * state to indicate completion.
3047                  */
3048                 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
3049                     !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
3050                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3051                 goto unlock;
3052         }
3053
3054         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
3055         if (e && hci_resolve_name(hdev, e) == 0) {
3056                 e->name_state = NAME_PENDING;
3057                 hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
3058                 discov->name_resolve_timeout = jiffies + NAME_RESOLVE_DURATION;
3059         } else {
3060                 /* When BR/EDR inquiry is active and no LE scanning is in
3061                  * progress, then change discovery state to indicate completion.
3062                  *
3063                  * When running LE scanning and BR/EDR inquiry simultaneously
3064                  * and the LE scan already finished, then change the discovery
3065                  * state to indicate completion.
3066                  */
3067                 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
3068                     !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
3069                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3070         }
3071
3072 unlock:
3073         hci_dev_unlock(hdev);
3074 }
3075
3076 static void hci_inquiry_result_evt(struct hci_dev *hdev, void *edata,
3077                                    struct sk_buff *skb)
3078 {
3079         struct hci_ev_inquiry_result *ev = edata;
3080         struct inquiry_data data;
3081         int i;
3082
3083         if (!hci_ev_skb_pull(hdev, skb, HCI_EV_INQUIRY_RESULT,
3084                              flex_array_size(ev, info, ev->num)))
3085                 return;
3086
3087         bt_dev_dbg(hdev, "num %d", ev->num);
3088
3089         if (!ev->num)
3090                 return;
3091
3092         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
3093                 return;
3094
3095         hci_dev_lock(hdev);
3096
3097         for (i = 0; i < ev->num; i++) {
3098                 struct inquiry_info *info = &ev->info[i];
3099                 u32 flags;
3100
3101                 bacpy(&data.bdaddr, &info->bdaddr);
3102                 data.pscan_rep_mode     = info->pscan_rep_mode;
3103                 data.pscan_period_mode  = info->pscan_period_mode;
3104                 data.pscan_mode         = info->pscan_mode;
3105                 memcpy(data.dev_class, info->dev_class, 3);
3106                 data.clock_offset       = info->clock_offset;
3107                 data.rssi               = HCI_RSSI_INVALID;
3108                 data.ssp_mode           = 0x00;
3109
3110                 flags = hci_inquiry_cache_update(hdev, &data, false);
3111
3112                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
3113                                   info->dev_class, HCI_RSSI_INVALID,
3114                                   flags, NULL, 0, NULL, 0, 0);
3115         }
3116
3117         hci_dev_unlock(hdev);
3118 }
3119
3120 static void hci_conn_complete_evt(struct hci_dev *hdev, void *data,
3121                                   struct sk_buff *skb)
3122 {
3123         struct hci_ev_conn_complete *ev = data;
3124         struct hci_conn *conn;
3125         u8 status = ev->status;
3126
3127         bt_dev_dbg(hdev, "status 0x%2.2x", status);
3128
3129         hci_dev_lock(hdev);
3130
3131         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
3132         if (!conn) {
3133                 /* In case of error status and there is no connection pending
3134                  * just unlock as there is nothing to cleanup.
3135                  */
3136                 if (ev->status)
3137                         goto unlock;
3138
3139                 /* Connection may not exist if auto-connected. Check the bredr
3140                  * allowlist to see if this device is allowed to auto connect.
3141                  * If link is an ACL type, create a connection class
3142                  * automatically.
3143                  *
3144                  * Auto-connect will only occur if the event filter is
3145                  * programmed with a given address. Right now, event filter is
3146                  * only used during suspend.
3147                  */
3148                 if (ev->link_type == ACL_LINK &&
3149                     hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
3150                                                       &ev->bdaddr,
3151                                                       BDADDR_BREDR)) {
3152                         conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr,
3153                                             HCI_ROLE_SLAVE);
3154                         if (!conn) {
3155                                 bt_dev_err(hdev, "no memory for new conn");
3156                                 goto unlock;
3157                         }
3158                 } else {
3159                         if (ev->link_type != SCO_LINK)
3160                                 goto unlock;
3161
3162                         conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK,
3163                                                        &ev->bdaddr);
3164                         if (!conn)
3165                                 goto unlock;
3166
3167                         conn->type = SCO_LINK;
3168                 }
3169         }
3170
3171         /* The HCI_Connection_Complete event is only sent once per connection.
3172          * Processing it more than once per connection can corrupt kernel memory.
3173          *
3174          * As the connection handle is set here for the first time, it indicates
3175          * whether the connection is already set up.
3176          */
3177         if (!HCI_CONN_HANDLE_UNSET(conn->handle)) {
3178                 bt_dev_err(hdev, "Ignoring HCI_Connection_Complete for existing connection");
3179                 goto unlock;
3180         }
3181
3182         if (!status) {
3183                 status = hci_conn_set_handle(conn, __le16_to_cpu(ev->handle));
3184                 if (status)
3185                         goto done;
3186
3187                 if (conn->type == ACL_LINK) {
3188                         conn->state = BT_CONFIG;
3189                         hci_conn_hold(conn);
3190
3191                         if (!conn->out && !hci_conn_ssp_enabled(conn) &&
3192                             !hci_find_link_key(hdev, &ev->bdaddr))
3193                                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
3194                         else
3195                                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3196                 } else
3197                         conn->state = BT_CONNECTED;
3198
3199                 hci_debugfs_create_conn(conn);
3200                 hci_conn_add_sysfs(conn);
3201
3202                 if (test_bit(HCI_AUTH, &hdev->flags))
3203                         set_bit(HCI_CONN_AUTH, &conn->flags);
3204
3205                 if (test_bit(HCI_ENCRYPT, &hdev->flags))
3206                         set_bit(HCI_CONN_ENCRYPT, &conn->flags);
3207
3208                 /* Get remote features */
3209                 if (conn->type == ACL_LINK) {
3210                         struct hci_cp_read_remote_features cp;
3211                         cp.handle = ev->handle;
3212                         hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
3213                                      sizeof(cp), &cp);
3214
3215                         hci_update_scan(hdev);
3216                 }
3217
3218                 /* Set packet type for incoming connection */
3219                 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
3220                         struct hci_cp_change_conn_ptype cp;
3221                         cp.handle = ev->handle;
3222                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
3223                         hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
3224                                      &cp);
3225                 }
3226         }
3227
3228         if (conn->type == ACL_LINK)
3229                 hci_sco_setup(conn, ev->status);
3230
3231 done:
3232         if (status) {
3233                 hci_conn_failed(conn, status);
3234         } else if (ev->link_type == SCO_LINK) {
3235                 switch (conn->setting & SCO_AIRMODE_MASK) {
3236                 case SCO_AIRMODE_CVSD:
3237                         if (hdev->notify)
3238                                 hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_CVSD);
3239                         break;
3240                 }
3241
3242                 hci_connect_cfm(conn, status);
3243         }
3244
3245 unlock:
3246         hci_dev_unlock(hdev);
3247
3248         hci_conn_check_pending(hdev);
3249 }
3250
3251 static void hci_reject_conn(struct hci_dev *hdev, bdaddr_t *bdaddr)
3252 {
3253         struct hci_cp_reject_conn_req cp;
3254
3255         bacpy(&cp.bdaddr, bdaddr);
3256         cp.reason = HCI_ERROR_REJ_BAD_ADDR;
3257         hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
3258 }
3259
3260 static void hci_conn_request_evt(struct hci_dev *hdev, void *data,
3261                                  struct sk_buff *skb)
3262 {
3263         struct hci_ev_conn_request *ev = data;
3264         int mask = hdev->link_mode;
3265         struct inquiry_entry *ie;
3266         struct hci_conn *conn;
3267         __u8 flags = 0;
3268
3269         bt_dev_dbg(hdev, "bdaddr %pMR type 0x%x", &ev->bdaddr, ev->link_type);
3270
3271         /* Reject incoming connection from device with same BD ADDR against
3272          * CVE-2020-26555
3273          */
3274         if (!bacmp(&hdev->bdaddr, &ev->bdaddr))
3275         {
3276                 bt_dev_dbg(hdev, "Reject connection with same BD_ADDR %pMR\n",
3277                            &ev->bdaddr);
3278                 hci_reject_conn(hdev, &ev->bdaddr);
3279                 return;
3280         }
3281
3282         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
3283                                       &flags);
3284
3285         if (!(mask & HCI_LM_ACCEPT)) {
3286                 hci_reject_conn(hdev, &ev->bdaddr);
3287                 return;
3288         }
3289
3290         hci_dev_lock(hdev);
3291
3292         if (hci_bdaddr_list_lookup(&hdev->reject_list, &ev->bdaddr,
3293                                    BDADDR_BREDR)) {
3294                 hci_reject_conn(hdev, &ev->bdaddr);
3295                 goto unlock;
3296         }
3297
3298         /* Require HCI_CONNECTABLE or an accept list entry to accept the
3299          * connection. These features are only touched through mgmt so
3300          * only do the checks if HCI_MGMT is set.
3301          */
3302         if (hci_dev_test_flag(hdev, HCI_MGMT) &&
3303             !hci_dev_test_flag(hdev, HCI_CONNECTABLE) &&
3304             !hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, &ev->bdaddr,
3305                                                BDADDR_BREDR)) {
3306                 hci_reject_conn(hdev, &ev->bdaddr);
3307                 goto unlock;
3308         }
3309
3310         /* Connection accepted */
3311
3312         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
3313         if (ie)
3314                 memcpy(ie->data.dev_class, ev->dev_class, 3);
3315
3316         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
3317                         &ev->bdaddr);
3318         if (!conn) {
3319                 conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr,
3320                                     HCI_ROLE_SLAVE);
3321                 if (!conn) {
3322                         bt_dev_err(hdev, "no memory for new connection");
3323                         goto unlock;
3324                 }
3325         }
3326
3327         memcpy(conn->dev_class, ev->dev_class, 3);
3328
3329         hci_dev_unlock(hdev);
3330
3331         if (ev->link_type == ACL_LINK ||
3332             (!(flags & HCI_PROTO_DEFER) && !lmp_esco_capable(hdev))) {
3333                 struct hci_cp_accept_conn_req cp;
3334                 conn->state = BT_CONNECT;
3335
3336                 bacpy(&cp.bdaddr, &ev->bdaddr);
3337
3338                 if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
3339                         cp.role = 0x00; /* Become central */
3340                 else
3341                         cp.role = 0x01; /* Remain peripheral */
3342
3343                 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
3344         } else if (!(flags & HCI_PROTO_DEFER)) {
3345                 struct hci_cp_accept_sync_conn_req cp;
3346                 conn->state = BT_CONNECT;
3347
3348                 bacpy(&cp.bdaddr, &ev->bdaddr);
3349                 cp.pkt_type = cpu_to_le16(conn->pkt_type);
3350
3351                 cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
3352                 cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
3353                 cp.max_latency    = cpu_to_le16(0xffff);
3354                 cp.content_format = cpu_to_le16(hdev->voice_setting);
3355                 cp.retrans_effort = 0xff;
3356
3357                 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ, sizeof(cp),
3358                              &cp);
3359         } else {
3360                 conn->state = BT_CONNECT2;
3361                 hci_connect_cfm(conn, 0);
3362         }
3363
3364         return;
3365 unlock:
3366         hci_dev_unlock(hdev);
3367 }
3368
3369 static u8 hci_to_mgmt_reason(u8 err)
3370 {
3371         switch (err) {
3372         case HCI_ERROR_CONNECTION_TIMEOUT:
3373                 return MGMT_DEV_DISCONN_TIMEOUT;
3374         case HCI_ERROR_REMOTE_USER_TERM:
3375         case HCI_ERROR_REMOTE_LOW_RESOURCES:
3376         case HCI_ERROR_REMOTE_POWER_OFF:
3377                 return MGMT_DEV_DISCONN_REMOTE;
3378         case HCI_ERROR_LOCAL_HOST_TERM:
3379                 return MGMT_DEV_DISCONN_LOCAL_HOST;
3380         default:
3381                 return MGMT_DEV_DISCONN_UNKNOWN;
3382         }
3383 }
3384
3385 static void hci_disconn_complete_evt(struct hci_dev *hdev, void *data,
3386                                      struct sk_buff *skb)
3387 {
3388         struct hci_ev_disconn_complete *ev = data;
3389         u8 reason;
3390         struct hci_conn_params *params;
3391         struct hci_conn *conn;
3392         bool mgmt_connected;
3393
3394         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
3395
3396         hci_dev_lock(hdev);
3397
3398         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3399         if (!conn)
3400                 goto unlock;
3401
3402         if (ev->status) {
3403                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
3404                                        conn->dst_type, ev->status);
3405                 goto unlock;
3406         }
3407
3408         conn->state = BT_CLOSED;
3409
3410         mgmt_connected = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags);
3411
3412         if (test_bit(HCI_CONN_AUTH_FAILURE, &conn->flags))
3413                 reason = MGMT_DEV_DISCONN_AUTH_FAILURE;
3414         else
3415                 reason = hci_to_mgmt_reason(ev->reason);
3416
3417         mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type,
3418                                 reason, mgmt_connected);
3419
3420         if (conn->type == ACL_LINK) {
3421                 if (test_and_clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
3422                         hci_remove_link_key(hdev, &conn->dst);
3423
3424                 hci_update_scan(hdev);
3425         }
3426
3427         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
3428         if (params) {
3429                 switch (params->auto_connect) {
3430                 case HCI_AUTO_CONN_LINK_LOSS:
3431                         if (ev->reason != HCI_ERROR_CONNECTION_TIMEOUT)
3432                                 break;
3433                         fallthrough;
3434
3435                 case HCI_AUTO_CONN_DIRECT:
3436                 case HCI_AUTO_CONN_ALWAYS:
3437                         hci_pend_le_list_del_init(params);
3438                         hci_pend_le_list_add(params, &hdev->pend_le_conns);
3439                         hci_update_passive_scan(hdev);
3440                         break;
3441
3442                 default:
3443                         break;
3444                 }
3445         }
3446
3447         hci_disconn_cfm(conn, ev->reason);
3448
3449         /* Re-enable advertising if necessary, since it might
3450          * have been disabled by the connection. From the
3451          * HCI_LE_Set_Advertise_Enable command description in
3452          * the core specification (v4.0):
3453          * "The Controller shall continue advertising until the Host
3454          * issues an LE_Set_Advertise_Enable command with
3455          * Advertising_Enable set to 0x00 (Advertising is disabled)
3456          * or until a connection is created or until the Advertising
3457          * is timed out due to Directed Advertising."
3458          */
3459         if (conn->type == LE_LINK && conn->role == HCI_ROLE_SLAVE) {
3460                 hdev->cur_adv_instance = conn->adv_instance;
3461                 hci_enable_advertising(hdev);
3462         }
3463
3464         hci_conn_del(conn);
3465
3466 unlock:
3467         hci_dev_unlock(hdev);
3468 }
3469
3470 static void hci_auth_complete_evt(struct hci_dev *hdev, void *data,
3471                                   struct sk_buff *skb)
3472 {
3473         struct hci_ev_auth_complete *ev = data;
3474         struct hci_conn *conn;
3475
3476         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
3477
3478         hci_dev_lock(hdev);
3479
3480         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3481         if (!conn)
3482                 goto unlock;
3483
3484         if (!ev->status) {
3485                 clear_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
3486
3487                 if (!hci_conn_ssp_enabled(conn) &&
3488                     test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
3489                         bt_dev_info(hdev, "re-auth of legacy device is not possible.");
3490                 } else {
3491                         set_bit(HCI_CONN_AUTH, &conn->flags);
3492                         conn->sec_level = conn->pending_sec_level;
3493                 }
3494         } else {
3495                 if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
3496                         set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
3497
3498                 mgmt_auth_failed(conn, ev->status);
3499         }
3500
3501         clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
3502         clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
3503
3504         if (conn->state == BT_CONFIG) {
3505                 if (!ev->status && hci_conn_ssp_enabled(conn)) {
3506                         struct hci_cp_set_conn_encrypt cp;
3507                         cp.handle  = ev->handle;
3508                         cp.encrypt = 0x01;
3509                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
3510                                      &cp);
3511                 } else {
3512                         conn->state = BT_CONNECTED;
3513                         hci_connect_cfm(conn, ev->status);
3514                         hci_conn_drop(conn);
3515                 }
3516         } else {
3517                 hci_auth_cfm(conn, ev->status);
3518
3519                 hci_conn_hold(conn);
3520                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3521                 hci_conn_drop(conn);
3522         }
3523
3524         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
3525                 if (!ev->status) {
3526                         struct hci_cp_set_conn_encrypt cp;
3527                         cp.handle  = ev->handle;
3528                         cp.encrypt = 0x01;
3529                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
3530                                      &cp);
3531                 } else {
3532                         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3533                         hci_encrypt_cfm(conn, ev->status);
3534                 }
3535         }
3536
3537 unlock:
3538         hci_dev_unlock(hdev);
3539 }
3540
3541 static void hci_remote_name_evt(struct hci_dev *hdev, void *data,
3542                                 struct sk_buff *skb)
3543 {
3544         struct hci_ev_remote_name *ev = data;
3545         struct hci_conn *conn;
3546
3547         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
3548
3549         hci_conn_check_pending(hdev);
3550
3551         hci_dev_lock(hdev);
3552
3553         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3554
3555         if (!hci_dev_test_flag(hdev, HCI_MGMT))
3556                 goto check_auth;
3557
3558         if (ev->status == 0)
3559                 hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
3560                                        strnlen(ev->name, HCI_MAX_NAME_LENGTH));
3561         else
3562                 hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
3563
3564 check_auth:
3565         if (!conn)
3566                 goto unlock;
3567
3568         if (!hci_outgoing_auth_needed(hdev, conn))
3569                 goto unlock;
3570
3571         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
3572                 struct hci_cp_auth_requested cp;
3573
3574                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
3575
3576                 cp.handle = __cpu_to_le16(conn->handle);
3577                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
3578         }
3579
3580 unlock:
3581         hci_dev_unlock(hdev);
3582 }
3583
3584 static void hci_encrypt_change_evt(struct hci_dev *hdev, void *data,
3585                                    struct sk_buff *skb)
3586 {
3587         struct hci_ev_encrypt_change *ev = data;
3588         struct hci_conn *conn;
3589
3590         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
3591
3592         hci_dev_lock(hdev);
3593
3594         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3595         if (!conn)
3596                 goto unlock;
3597
3598         if (!ev->status) {
3599                 if (ev->encrypt) {
3600                         /* Encryption implies authentication */
3601                         set_bit(HCI_CONN_AUTH, &conn->flags);
3602                         set_bit(HCI_CONN_ENCRYPT, &conn->flags);
3603                         conn->sec_level = conn->pending_sec_level;
3604
3605                         /* P-256 authentication key implies FIPS */
3606                         if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256)
3607                                 set_bit(HCI_CONN_FIPS, &conn->flags);
3608
3609                         if ((conn->type == ACL_LINK && ev->encrypt == 0x02) ||
3610                             conn->type == LE_LINK)
3611                                 set_bit(HCI_CONN_AES_CCM, &conn->flags);
3612                 } else {
3613                         clear_bit(HCI_CONN_ENCRYPT, &conn->flags);
3614                         clear_bit(HCI_CONN_AES_CCM, &conn->flags);
3615                 }
3616         }
3617
3618         /* We should disregard the current RPA and generate a new one
3619          * whenever the encryption procedure fails.
3620          */
3621         if (ev->status && conn->type == LE_LINK) {
3622                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
3623                 hci_adv_instances_set_rpa_expired(hdev, true);
3624         }
3625
3626         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3627
3628         /* Check link security requirements are met */
3629         if (!hci_conn_check_link_mode(conn))
3630                 ev->status = HCI_ERROR_AUTH_FAILURE;
3631
3632         if (ev->status && conn->state == BT_CONNECTED) {
3633                 if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
3634                         set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
3635
3636                 /* Notify upper layers so they can cleanup before
3637                  * disconnecting.
3638                  */
3639                 hci_encrypt_cfm(conn, ev->status);
3640                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
3641                 hci_conn_drop(conn);
3642                 goto unlock;
3643         }
3644
3645         /* Try reading the encryption key size for encrypted ACL links */
3646         if (!ev->status && ev->encrypt && conn->type == ACL_LINK) {
3647                 struct hci_cp_read_enc_key_size cp;
3648
3649                 /* Only send HCI_Read_Encryption_Key_Size if the
3650                  * controller really supports it. If it doesn't, assume
3651                  * the default size (16).
3652                  */
3653                 if (!(hdev->commands[20] & 0x10)) {
3654                         conn->enc_key_size = HCI_LINK_KEY_SIZE;
3655                         goto notify;
3656                 }
3657
3658                 cp.handle = cpu_to_le16(conn->handle);
3659                 if (hci_send_cmd(hdev, HCI_OP_READ_ENC_KEY_SIZE,
3660                                  sizeof(cp), &cp)) {
3661                         bt_dev_err(hdev, "sending read key size failed");
3662                         conn->enc_key_size = HCI_LINK_KEY_SIZE;
3663                         goto notify;
3664                 }
3665
3666                 goto unlock;
3667         }
3668
3669         /* Set the default Authenticated Payload Timeout after
3670          * an LE Link is established. As per Core Spec v5.0, Vol 2, Part B
3671          * Section 3.3, the HCI command WRITE_AUTH_PAYLOAD_TIMEOUT should be
3672          * sent when the link is active and Encryption is enabled, the conn
3673          * type can be either LE or ACL and controller must support LMP Ping.
3674          * Ensure for AES-CCM encryption as well.
3675          */
3676         if (test_bit(HCI_CONN_ENCRYPT, &conn->flags) &&
3677             test_bit(HCI_CONN_AES_CCM, &conn->flags) &&
3678             ((conn->type == ACL_LINK && lmp_ping_capable(hdev)) ||
3679              (conn->type == LE_LINK && (hdev->le_features[0] & HCI_LE_PING)))) {
3680                 struct hci_cp_write_auth_payload_to cp;
3681
3682                 cp.handle = cpu_to_le16(conn->handle);
3683                 cp.timeout = cpu_to_le16(hdev->auth_payload_timeout);
3684                 if (hci_send_cmd(conn->hdev, HCI_OP_WRITE_AUTH_PAYLOAD_TO,
3685                                  sizeof(cp), &cp)) {
3686                         bt_dev_err(hdev, "write auth payload timeout failed");
3687                         goto notify;
3688                 }
3689
3690                 goto unlock;
3691         }
3692
3693 notify:
3694         hci_encrypt_cfm(conn, ev->status);
3695
3696 unlock:
3697         hci_dev_unlock(hdev);
3698 }
3699
3700 static void hci_change_link_key_complete_evt(struct hci_dev *hdev, void *data,
3701                                              struct sk_buff *skb)
3702 {
3703         struct hci_ev_change_link_key_complete *ev = data;
3704         struct hci_conn *conn;
3705
3706         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
3707
3708         hci_dev_lock(hdev);
3709
3710         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3711         if (conn) {
3712                 if (!ev->status)
3713                         set_bit(HCI_CONN_SECURE, &conn->flags);
3714
3715                 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
3716
3717                 hci_key_change_cfm(conn, ev->status);
3718         }
3719
3720         hci_dev_unlock(hdev);
3721 }
3722
3723 static void hci_remote_features_evt(struct hci_dev *hdev, void *data,
3724                                     struct sk_buff *skb)
3725 {
3726         struct hci_ev_remote_features *ev = data;
3727         struct hci_conn *conn;
3728
3729         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
3730
3731         hci_dev_lock(hdev);
3732
3733         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3734         if (!conn)
3735                 goto unlock;
3736
3737         if (!ev->status)
3738                 memcpy(conn->features[0], ev->features, 8);
3739
3740         if (conn->state != BT_CONFIG)
3741                 goto unlock;
3742
3743         if (!ev->status && lmp_ext_feat_capable(hdev) &&
3744             lmp_ext_feat_capable(conn)) {
3745                 struct hci_cp_read_remote_ext_features cp;
3746                 cp.handle = ev->handle;
3747                 cp.page = 0x01;
3748                 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
3749                              sizeof(cp), &cp);
3750                 goto unlock;
3751         }
3752
3753         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
3754                 struct hci_cp_remote_name_req cp;
3755                 memset(&cp, 0, sizeof(cp));
3756                 bacpy(&cp.bdaddr, &conn->dst);
3757                 cp.pscan_rep_mode = 0x02;
3758                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
3759         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
3760                 mgmt_device_connected(hdev, conn, NULL, 0);
3761
3762         if (!hci_outgoing_auth_needed(hdev, conn)) {
3763                 conn->state = BT_CONNECTED;
3764                 hci_connect_cfm(conn, ev->status);
3765                 hci_conn_drop(conn);
3766         }
3767
3768 unlock:
3769         hci_dev_unlock(hdev);
3770 }
3771
3772 static inline void handle_cmd_cnt_and_timer(struct hci_dev *hdev, u8 ncmd)
3773 {
3774         cancel_delayed_work(&hdev->cmd_timer);
3775
3776         rcu_read_lock();
3777         if (!test_bit(HCI_RESET, &hdev->flags)) {
3778                 if (ncmd) {
3779                         cancel_delayed_work(&hdev->ncmd_timer);
3780                         atomic_set(&hdev->cmd_cnt, 1);
3781                 } else {
3782                         if (!hci_dev_test_flag(hdev, HCI_CMD_DRAIN_WORKQUEUE))
3783                                 queue_delayed_work(hdev->workqueue, &hdev->ncmd_timer,
3784                                                    HCI_NCMD_TIMEOUT);
3785                 }
3786         }
3787         rcu_read_unlock();
3788 }
3789
3790 static u8 hci_cc_le_read_buffer_size_v2(struct hci_dev *hdev, void *data,
3791                                         struct sk_buff *skb)
3792 {
3793         struct hci_rp_le_read_buffer_size_v2 *rp = data;
3794
3795         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
3796
3797         if (rp->status)
3798                 return rp->status;
3799
3800         hdev->le_mtu   = __le16_to_cpu(rp->acl_mtu);
3801         hdev->le_pkts  = rp->acl_max_pkt;
3802         hdev->iso_mtu  = __le16_to_cpu(rp->iso_mtu);
3803         hdev->iso_pkts = rp->iso_max_pkt;
3804
3805         hdev->le_cnt  = hdev->le_pkts;
3806         hdev->iso_cnt = hdev->iso_pkts;
3807
3808         BT_DBG("%s acl mtu %d:%d iso mtu %d:%d", hdev->name, hdev->acl_mtu,
3809                hdev->acl_pkts, hdev->iso_mtu, hdev->iso_pkts);
3810
3811         return rp->status;
3812 }
3813
3814 static void hci_unbound_cis_failed(struct hci_dev *hdev, u8 cig, u8 status)
3815 {
3816         struct hci_conn *conn, *tmp;
3817
3818         lockdep_assert_held(&hdev->lock);
3819
3820         list_for_each_entry_safe(conn, tmp, &hdev->conn_hash.list, list) {
3821                 if (conn->type != ISO_LINK || !bacmp(&conn->dst, BDADDR_ANY) ||
3822                     conn->state == BT_OPEN || conn->iso_qos.ucast.cig != cig)
3823                         continue;
3824
3825                 if (HCI_CONN_HANDLE_UNSET(conn->handle))
3826                         hci_conn_failed(conn, status);
3827         }
3828 }
3829
3830 static u8 hci_cc_le_set_cig_params(struct hci_dev *hdev, void *data,
3831                                    struct sk_buff *skb)
3832 {
3833         struct hci_rp_le_set_cig_params *rp = data;
3834         struct hci_cp_le_set_cig_params *cp;
3835         struct hci_conn *conn;
3836         u8 status = rp->status;
3837         bool pending = false;
3838         int i;
3839
3840         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
3841
3842         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_CIG_PARAMS);
3843         if (!rp->status && (!cp || rp->num_handles != cp->num_cis ||
3844                             rp->cig_id != cp->cig_id)) {
3845                 bt_dev_err(hdev, "unexpected Set CIG Parameters response data");
3846                 status = HCI_ERROR_UNSPECIFIED;
3847         }
3848
3849         hci_dev_lock(hdev);
3850
3851         /* BLUETOOTH CORE SPECIFICATION Version 5.4 | Vol 4, Part E page 2554
3852          *
3853          * If the Status return parameter is non-zero, then the state of the CIG
3854          * and its CIS configurations shall not be changed by the command. If
3855          * the CIG did not already exist, it shall not be created.
3856          */
3857         if (status) {
3858                 /* Keep current configuration, fail only the unbound CIS */
3859                 hci_unbound_cis_failed(hdev, rp->cig_id, status);
3860                 goto unlock;
3861         }
3862
3863         /* BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 4, Part E page 2553
3864          *
3865          * If the Status return parameter is zero, then the Controller shall
3866          * set the Connection_Handle arrayed return parameter to the connection
3867          * handle(s) corresponding to the CIS configurations specified in
3868          * the CIS_IDs command parameter, in the same order.
3869          */
3870         for (i = 0; i < rp->num_handles; ++i) {
3871                 conn = hci_conn_hash_lookup_cis(hdev, NULL, 0, rp->cig_id,
3872                                                 cp->cis[i].cis_id);
3873                 if (!conn || !bacmp(&conn->dst, BDADDR_ANY))
3874                         continue;
3875
3876                 if (conn->state != BT_BOUND && conn->state != BT_CONNECT)
3877                         continue;
3878
3879                 if (hci_conn_set_handle(conn, __le16_to_cpu(rp->handle[i])))
3880                         continue;
3881
3882                 if (conn->state == BT_CONNECT)
3883                         pending = true;
3884         }
3885
3886 unlock:
3887         if (pending)
3888                 hci_le_create_cis_pending(hdev);
3889
3890         hci_dev_unlock(hdev);
3891
3892         return rp->status;
3893 }
3894
3895 static u8 hci_cc_le_setup_iso_path(struct hci_dev *hdev, void *data,
3896                                    struct sk_buff *skb)
3897 {
3898         struct hci_rp_le_setup_iso_path *rp = data;
3899         struct hci_cp_le_setup_iso_path *cp;
3900         struct hci_conn *conn;
3901
3902         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
3903
3904         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SETUP_ISO_PATH);
3905         if (!cp)
3906                 return rp->status;
3907
3908         hci_dev_lock(hdev);
3909
3910         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
3911         if (!conn)
3912                 goto unlock;
3913
3914         if (rp->status) {
3915                 hci_connect_cfm(conn, rp->status);
3916                 hci_conn_del(conn);
3917                 goto unlock;
3918         }
3919
3920         switch (cp->direction) {
3921         /* Input (Host to Controller) */
3922         case 0x00:
3923                 /* Only confirm connection if output only */
3924                 if (conn->iso_qos.ucast.out.sdu && !conn->iso_qos.ucast.in.sdu)
3925                         hci_connect_cfm(conn, rp->status);
3926                 break;
3927         /* Output (Controller to Host) */
3928         case 0x01:
3929                 /* Confirm connection since conn->iso_qos is always configured
3930                  * last.
3931                  */
3932                 hci_connect_cfm(conn, rp->status);
3933                 break;
3934         }
3935
3936 unlock:
3937         hci_dev_unlock(hdev);
3938         return rp->status;
3939 }
3940
3941 static void hci_cs_le_create_big(struct hci_dev *hdev, u8 status)
3942 {
3943         bt_dev_dbg(hdev, "status 0x%2.2x", status);
3944 }
3945
3946 static u8 hci_cc_set_per_adv_param(struct hci_dev *hdev, void *data,
3947                                    struct sk_buff *skb)
3948 {
3949         struct hci_ev_status *rp = data;
3950         struct hci_cp_le_set_per_adv_params *cp;
3951
3952         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
3953
3954         if (rp->status)
3955                 return rp->status;
3956
3957         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_PER_ADV_PARAMS);
3958         if (!cp)
3959                 return rp->status;
3960
3961         /* TODO: set the conn state */
3962         return rp->status;
3963 }
3964
3965 static u8 hci_cc_le_set_per_adv_enable(struct hci_dev *hdev, void *data,
3966                                        struct sk_buff *skb)
3967 {
3968         struct hci_ev_status *rp = data;
3969         struct hci_cp_le_set_per_adv_enable *cp;
3970         struct adv_info *adv = NULL, *n;
3971         u8 per_adv_cnt = 0;
3972
3973         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
3974
3975         if (rp->status)
3976                 return rp->status;
3977
3978         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_PER_ADV_ENABLE);
3979         if (!cp)
3980                 return rp->status;
3981
3982         hci_dev_lock(hdev);
3983
3984         adv = hci_find_adv_instance(hdev, cp->handle);
3985
3986         if (cp->enable) {
3987                 hci_dev_set_flag(hdev, HCI_LE_PER_ADV);
3988
3989                 if (adv)
3990                         adv->enabled = true;
3991         } else {
3992                 /* If just one instance was disabled check if there are
3993                  * any other instance enabled before clearing HCI_LE_PER_ADV.
3994                  * The current periodic adv instance will be marked as
3995                  * disabled once extended advertising is also disabled.
3996                  */
3997                 list_for_each_entry_safe(adv, n, &hdev->adv_instances,
3998                                          list) {
3999                         if (adv->periodic && adv->enabled)
4000                                 per_adv_cnt++;
4001                 }
4002
4003                 if (per_adv_cnt > 1)
4004                         goto unlock;
4005
4006                 hci_dev_clear_flag(hdev, HCI_LE_PER_ADV);
4007         }
4008
4009 unlock:
4010         hci_dev_unlock(hdev);
4011
4012         return rp->status;
4013 }
4014
4015 #define HCI_CC_VL(_op, _func, _min, _max) \
4016 { \
4017         .op = _op, \
4018         .func = _func, \
4019         .min_len = _min, \
4020         .max_len = _max, \
4021 }
4022
4023 #define HCI_CC(_op, _func, _len) \
4024         HCI_CC_VL(_op, _func, _len, _len)
4025
4026 #define HCI_CC_STATUS(_op, _func) \
4027         HCI_CC(_op, _func, sizeof(struct hci_ev_status))
4028
4029 static const struct hci_cc {
4030         u16  op;
4031         u8 (*func)(struct hci_dev *hdev, void *data, struct sk_buff *skb);
4032         u16  min_len;
4033         u16  max_len;
4034 } hci_cc_table[] = {
4035         HCI_CC_STATUS(HCI_OP_INQUIRY_CANCEL, hci_cc_inquiry_cancel),
4036         HCI_CC_STATUS(HCI_OP_PERIODIC_INQ, hci_cc_periodic_inq),
4037         HCI_CC_STATUS(HCI_OP_EXIT_PERIODIC_INQ, hci_cc_exit_periodic_inq),
4038         HCI_CC_STATUS(HCI_OP_REMOTE_NAME_REQ_CANCEL,
4039                       hci_cc_remote_name_req_cancel),
4040         HCI_CC(HCI_OP_ROLE_DISCOVERY, hci_cc_role_discovery,
4041                sizeof(struct hci_rp_role_discovery)),
4042         HCI_CC(HCI_OP_READ_LINK_POLICY, hci_cc_read_link_policy,
4043                sizeof(struct hci_rp_read_link_policy)),
4044         HCI_CC(HCI_OP_WRITE_LINK_POLICY, hci_cc_write_link_policy,
4045                sizeof(struct hci_rp_write_link_policy)),
4046         HCI_CC(HCI_OP_READ_DEF_LINK_POLICY, hci_cc_read_def_link_policy,
4047                sizeof(struct hci_rp_read_def_link_policy)),
4048         HCI_CC_STATUS(HCI_OP_WRITE_DEF_LINK_POLICY,
4049                       hci_cc_write_def_link_policy),
4050         HCI_CC_STATUS(HCI_OP_RESET, hci_cc_reset),
4051         HCI_CC(HCI_OP_READ_STORED_LINK_KEY, hci_cc_read_stored_link_key,
4052                sizeof(struct hci_rp_read_stored_link_key)),
4053         HCI_CC(HCI_OP_DELETE_STORED_LINK_KEY, hci_cc_delete_stored_link_key,
4054                sizeof(struct hci_rp_delete_stored_link_key)),
4055         HCI_CC_STATUS(HCI_OP_WRITE_LOCAL_NAME, hci_cc_write_local_name),
4056         HCI_CC(HCI_OP_READ_LOCAL_NAME, hci_cc_read_local_name,
4057                sizeof(struct hci_rp_read_local_name)),
4058         HCI_CC_STATUS(HCI_OP_WRITE_AUTH_ENABLE, hci_cc_write_auth_enable),
4059         HCI_CC_STATUS(HCI_OP_WRITE_ENCRYPT_MODE, hci_cc_write_encrypt_mode),
4060         HCI_CC_STATUS(HCI_OP_WRITE_SCAN_ENABLE, hci_cc_write_scan_enable),
4061         HCI_CC_STATUS(HCI_OP_SET_EVENT_FLT, hci_cc_set_event_filter),
4062         HCI_CC(HCI_OP_READ_CLASS_OF_DEV, hci_cc_read_class_of_dev,
4063                sizeof(struct hci_rp_read_class_of_dev)),
4064         HCI_CC_STATUS(HCI_OP_WRITE_CLASS_OF_DEV, hci_cc_write_class_of_dev),
4065         HCI_CC(HCI_OP_READ_VOICE_SETTING, hci_cc_read_voice_setting,
4066                sizeof(struct hci_rp_read_voice_setting)),
4067         HCI_CC_STATUS(HCI_OP_WRITE_VOICE_SETTING, hci_cc_write_voice_setting),
4068         HCI_CC(HCI_OP_READ_NUM_SUPPORTED_IAC, hci_cc_read_num_supported_iac,
4069                sizeof(struct hci_rp_read_num_supported_iac)),
4070         HCI_CC_STATUS(HCI_OP_WRITE_SSP_MODE, hci_cc_write_ssp_mode),
4071         HCI_CC_STATUS(HCI_OP_WRITE_SC_SUPPORT, hci_cc_write_sc_support),
4072         HCI_CC(HCI_OP_READ_AUTH_PAYLOAD_TO, hci_cc_read_auth_payload_timeout,
4073                sizeof(struct hci_rp_read_auth_payload_to)),
4074         HCI_CC(HCI_OP_WRITE_AUTH_PAYLOAD_TO, hci_cc_write_auth_payload_timeout,
4075                sizeof(struct hci_rp_write_auth_payload_to)),
4076         HCI_CC(HCI_OP_READ_LOCAL_VERSION, hci_cc_read_local_version,
4077                sizeof(struct hci_rp_read_local_version)),
4078         HCI_CC(HCI_OP_READ_LOCAL_COMMANDS, hci_cc_read_local_commands,
4079                sizeof(struct hci_rp_read_local_commands)),
4080         HCI_CC(HCI_OP_READ_LOCAL_FEATURES, hci_cc_read_local_features,
4081                sizeof(struct hci_rp_read_local_features)),
4082         HCI_CC(HCI_OP_READ_LOCAL_EXT_FEATURES, hci_cc_read_local_ext_features,
4083                sizeof(struct hci_rp_read_local_ext_features)),
4084         HCI_CC(HCI_OP_READ_BUFFER_SIZE, hci_cc_read_buffer_size,
4085                sizeof(struct hci_rp_read_buffer_size)),
4086         HCI_CC(HCI_OP_READ_BD_ADDR, hci_cc_read_bd_addr,
4087                sizeof(struct hci_rp_read_bd_addr)),
4088         HCI_CC(HCI_OP_READ_LOCAL_PAIRING_OPTS, hci_cc_read_local_pairing_opts,
4089                sizeof(struct hci_rp_read_local_pairing_opts)),
4090         HCI_CC(HCI_OP_READ_PAGE_SCAN_ACTIVITY, hci_cc_read_page_scan_activity,
4091                sizeof(struct hci_rp_read_page_scan_activity)),
4092         HCI_CC_STATUS(HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
4093                       hci_cc_write_page_scan_activity),
4094         HCI_CC(HCI_OP_READ_PAGE_SCAN_TYPE, hci_cc_read_page_scan_type,
4095                sizeof(struct hci_rp_read_page_scan_type)),
4096         HCI_CC_STATUS(HCI_OP_WRITE_PAGE_SCAN_TYPE, hci_cc_write_page_scan_type),
4097         HCI_CC(HCI_OP_READ_DATA_BLOCK_SIZE, hci_cc_read_data_block_size,
4098                sizeof(struct hci_rp_read_data_block_size)),
4099         HCI_CC(HCI_OP_READ_FLOW_CONTROL_MODE, hci_cc_read_flow_control_mode,
4100                sizeof(struct hci_rp_read_flow_control_mode)),
4101         HCI_CC(HCI_OP_READ_LOCAL_AMP_INFO, hci_cc_read_local_amp_info,
4102                sizeof(struct hci_rp_read_local_amp_info)),
4103         HCI_CC(HCI_OP_READ_CLOCK, hci_cc_read_clock,
4104                sizeof(struct hci_rp_read_clock)),
4105         HCI_CC(HCI_OP_READ_ENC_KEY_SIZE, hci_cc_read_enc_key_size,
4106                sizeof(struct hci_rp_read_enc_key_size)),
4107         HCI_CC(HCI_OP_READ_INQ_RSP_TX_POWER, hci_cc_read_inq_rsp_tx_power,
4108                sizeof(struct hci_rp_read_inq_rsp_tx_power)),
4109         HCI_CC(HCI_OP_READ_DEF_ERR_DATA_REPORTING,
4110                hci_cc_read_def_err_data_reporting,
4111                sizeof(struct hci_rp_read_def_err_data_reporting)),
4112         HCI_CC_STATUS(HCI_OP_WRITE_DEF_ERR_DATA_REPORTING,
4113                       hci_cc_write_def_err_data_reporting),
4114         HCI_CC(HCI_OP_PIN_CODE_REPLY, hci_cc_pin_code_reply,
4115                sizeof(struct hci_rp_pin_code_reply)),
4116         HCI_CC(HCI_OP_PIN_CODE_NEG_REPLY, hci_cc_pin_code_neg_reply,
4117                sizeof(struct hci_rp_pin_code_neg_reply)),
4118         HCI_CC(HCI_OP_READ_LOCAL_OOB_DATA, hci_cc_read_local_oob_data,
4119                sizeof(struct hci_rp_read_local_oob_data)),
4120         HCI_CC(HCI_OP_READ_LOCAL_OOB_EXT_DATA, hci_cc_read_local_oob_ext_data,
4121                sizeof(struct hci_rp_read_local_oob_ext_data)),
4122         HCI_CC(HCI_OP_LE_READ_BUFFER_SIZE, hci_cc_le_read_buffer_size,
4123                sizeof(struct hci_rp_le_read_buffer_size)),
4124         HCI_CC(HCI_OP_LE_READ_LOCAL_FEATURES, hci_cc_le_read_local_features,
4125                sizeof(struct hci_rp_le_read_local_features)),
4126         HCI_CC(HCI_OP_LE_READ_ADV_TX_POWER, hci_cc_le_read_adv_tx_power,
4127                sizeof(struct hci_rp_le_read_adv_tx_power)),
4128         HCI_CC(HCI_OP_USER_CONFIRM_REPLY, hci_cc_user_confirm_reply,
4129                sizeof(struct hci_rp_user_confirm_reply)),
4130         HCI_CC(HCI_OP_USER_CONFIRM_NEG_REPLY, hci_cc_user_confirm_neg_reply,
4131                sizeof(struct hci_rp_user_confirm_reply)),
4132         HCI_CC(HCI_OP_USER_PASSKEY_REPLY, hci_cc_user_passkey_reply,
4133                sizeof(struct hci_rp_user_confirm_reply)),
4134         HCI_CC(HCI_OP_USER_PASSKEY_NEG_REPLY, hci_cc_user_passkey_neg_reply,
4135                sizeof(struct hci_rp_user_confirm_reply)),
4136         HCI_CC_STATUS(HCI_OP_LE_SET_RANDOM_ADDR, hci_cc_le_set_random_addr),
4137         HCI_CC_STATUS(HCI_OP_LE_SET_ADV_ENABLE, hci_cc_le_set_adv_enable),
4138         HCI_CC_STATUS(HCI_OP_LE_SET_SCAN_PARAM, hci_cc_le_set_scan_param),
4139         HCI_CC_STATUS(HCI_OP_LE_SET_SCAN_ENABLE, hci_cc_le_set_scan_enable),
4140         HCI_CC(HCI_OP_LE_READ_ACCEPT_LIST_SIZE,
4141                hci_cc_le_read_accept_list_size,
4142                sizeof(struct hci_rp_le_read_accept_list_size)),
4143         HCI_CC_STATUS(HCI_OP_LE_CLEAR_ACCEPT_LIST, hci_cc_le_clear_accept_list),
4144         HCI_CC_STATUS(HCI_OP_LE_ADD_TO_ACCEPT_LIST,
4145                       hci_cc_le_add_to_accept_list),
4146         HCI_CC_STATUS(HCI_OP_LE_DEL_FROM_ACCEPT_LIST,
4147                       hci_cc_le_del_from_accept_list),
4148         HCI_CC(HCI_OP_LE_READ_SUPPORTED_STATES, hci_cc_le_read_supported_states,
4149                sizeof(struct hci_rp_le_read_supported_states)),
4150         HCI_CC(HCI_OP_LE_READ_DEF_DATA_LEN, hci_cc_le_read_def_data_len,
4151                sizeof(struct hci_rp_le_read_def_data_len)),
4152         HCI_CC_STATUS(HCI_OP_LE_WRITE_DEF_DATA_LEN,
4153                       hci_cc_le_write_def_data_len),
4154         HCI_CC_STATUS(HCI_OP_LE_ADD_TO_RESOLV_LIST,
4155                       hci_cc_le_add_to_resolv_list),
4156         HCI_CC_STATUS(HCI_OP_LE_DEL_FROM_RESOLV_LIST,
4157                       hci_cc_le_del_from_resolv_list),
4158         HCI_CC_STATUS(HCI_OP_LE_CLEAR_RESOLV_LIST,
4159                       hci_cc_le_clear_resolv_list),
4160         HCI_CC(HCI_OP_LE_READ_RESOLV_LIST_SIZE, hci_cc_le_read_resolv_list_size,
4161                sizeof(struct hci_rp_le_read_resolv_list_size)),
4162         HCI_CC_STATUS(HCI_OP_LE_SET_ADDR_RESOLV_ENABLE,
4163                       hci_cc_le_set_addr_resolution_enable),
4164         HCI_CC(HCI_OP_LE_READ_MAX_DATA_LEN, hci_cc_le_read_max_data_len,
4165                sizeof(struct hci_rp_le_read_max_data_len)),
4166         HCI_CC_STATUS(HCI_OP_WRITE_LE_HOST_SUPPORTED,
4167                       hci_cc_write_le_host_supported),
4168         HCI_CC_STATUS(HCI_OP_LE_SET_ADV_PARAM, hci_cc_set_adv_param),
4169         HCI_CC(HCI_OP_READ_RSSI, hci_cc_read_rssi,
4170                sizeof(struct hci_rp_read_rssi)),
4171         HCI_CC(HCI_OP_READ_TX_POWER, hci_cc_read_tx_power,
4172                sizeof(struct hci_rp_read_tx_power)),
4173         HCI_CC_STATUS(HCI_OP_WRITE_SSP_DEBUG_MODE, hci_cc_write_ssp_debug_mode),
4174         HCI_CC_STATUS(HCI_OP_LE_SET_EXT_SCAN_PARAMS,
4175                       hci_cc_le_set_ext_scan_param),
4176         HCI_CC_STATUS(HCI_OP_LE_SET_EXT_SCAN_ENABLE,
4177                       hci_cc_le_set_ext_scan_enable),
4178         HCI_CC_STATUS(HCI_OP_LE_SET_DEFAULT_PHY, hci_cc_le_set_default_phy),
4179         HCI_CC(HCI_OP_LE_READ_NUM_SUPPORTED_ADV_SETS,
4180                hci_cc_le_read_num_adv_sets,
4181                sizeof(struct hci_rp_le_read_num_supported_adv_sets)),
4182         HCI_CC(HCI_OP_LE_SET_EXT_ADV_PARAMS, hci_cc_set_ext_adv_param,
4183                sizeof(struct hci_rp_le_set_ext_adv_params)),
4184         HCI_CC_STATUS(HCI_OP_LE_SET_EXT_ADV_ENABLE,
4185                       hci_cc_le_set_ext_adv_enable),
4186         HCI_CC_STATUS(HCI_OP_LE_SET_ADV_SET_RAND_ADDR,
4187                       hci_cc_le_set_adv_set_random_addr),
4188         HCI_CC_STATUS(HCI_OP_LE_REMOVE_ADV_SET, hci_cc_le_remove_adv_set),
4189         HCI_CC_STATUS(HCI_OP_LE_CLEAR_ADV_SETS, hci_cc_le_clear_adv_sets),
4190         HCI_CC_STATUS(HCI_OP_LE_SET_PER_ADV_PARAMS, hci_cc_set_per_adv_param),
4191         HCI_CC_STATUS(HCI_OP_LE_SET_PER_ADV_ENABLE,
4192                       hci_cc_le_set_per_adv_enable),
4193         HCI_CC(HCI_OP_LE_READ_TRANSMIT_POWER, hci_cc_le_read_transmit_power,
4194                sizeof(struct hci_rp_le_read_transmit_power)),
4195         HCI_CC_STATUS(HCI_OP_LE_SET_PRIVACY_MODE, hci_cc_le_set_privacy_mode),
4196         HCI_CC(HCI_OP_LE_READ_BUFFER_SIZE_V2, hci_cc_le_read_buffer_size_v2,
4197                sizeof(struct hci_rp_le_read_buffer_size_v2)),
4198         HCI_CC_VL(HCI_OP_LE_SET_CIG_PARAMS, hci_cc_le_set_cig_params,
4199                   sizeof(struct hci_rp_le_set_cig_params), HCI_MAX_EVENT_SIZE),
4200         HCI_CC(HCI_OP_LE_SETUP_ISO_PATH, hci_cc_le_setup_iso_path,
4201                sizeof(struct hci_rp_le_setup_iso_path)),
4202 };
4203
4204 static u8 hci_cc_func(struct hci_dev *hdev, const struct hci_cc *cc,
4205                       struct sk_buff *skb)
4206 {
4207         void *data;
4208
4209         if (skb->len < cc->min_len) {
4210                 bt_dev_err(hdev, "unexpected cc 0x%4.4x length: %u < %u",
4211                            cc->op, skb->len, cc->min_len);
4212                 return HCI_ERROR_UNSPECIFIED;
4213         }
4214
4215         /* Just warn if the length is over max_len size it still be possible to
4216          * partially parse the cc so leave to callback to decide if that is
4217          * acceptable.
4218          */
4219         if (skb->len > cc->max_len)
4220                 bt_dev_warn(hdev, "unexpected cc 0x%4.4x length: %u > %u",
4221                             cc->op, skb->len, cc->max_len);
4222
4223         data = hci_cc_skb_pull(hdev, skb, cc->op, cc->min_len);
4224         if (!data)
4225                 return HCI_ERROR_UNSPECIFIED;
4226
4227         return cc->func(hdev, data, skb);
4228 }
4229
4230 static void hci_cmd_complete_evt(struct hci_dev *hdev, void *data,
4231                                  struct sk_buff *skb, u16 *opcode, u8 *status,
4232                                  hci_req_complete_t *req_complete,
4233                                  hci_req_complete_skb_t *req_complete_skb)
4234 {
4235         struct hci_ev_cmd_complete *ev = data;
4236         int i;
4237
4238         *opcode = __le16_to_cpu(ev->opcode);
4239
4240         bt_dev_dbg(hdev, "opcode 0x%4.4x", *opcode);
4241
4242         for (i = 0; i < ARRAY_SIZE(hci_cc_table); i++) {
4243                 if (hci_cc_table[i].op == *opcode) {
4244                         *status = hci_cc_func(hdev, &hci_cc_table[i], skb);
4245                         break;
4246                 }
4247         }
4248
4249         if (i == ARRAY_SIZE(hci_cc_table)) {
4250                 /* Unknown opcode, assume byte 0 contains the status, so
4251                  * that e.g. __hci_cmd_sync() properly returns errors
4252                  * for vendor specific commands send by HCI drivers.
4253                  * If a vendor doesn't actually follow this convention we may
4254                  * need to introduce a vendor CC table in order to properly set
4255                  * the status.
4256                  */
4257                 *status = skb->data[0];
4258         }
4259
4260         handle_cmd_cnt_and_timer(hdev, ev->ncmd);
4261
4262         hci_req_cmd_complete(hdev, *opcode, *status, req_complete,
4263                              req_complete_skb);
4264
4265         if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
4266                 bt_dev_err(hdev,
4267                            "unexpected event for opcode 0x%4.4x", *opcode);
4268                 return;
4269         }
4270
4271         if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
4272                 queue_work(hdev->workqueue, &hdev->cmd_work);
4273 }
4274
4275 static void hci_cs_le_create_cis(struct hci_dev *hdev, u8 status)
4276 {
4277         struct hci_cp_le_create_cis *cp;
4278         bool pending = false;
4279         int i;
4280
4281         bt_dev_dbg(hdev, "status 0x%2.2x", status);
4282
4283         if (!status)
4284                 return;
4285
4286         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CIS);
4287         if (!cp)
4288                 return;
4289
4290         hci_dev_lock(hdev);
4291
4292         /* Remove connection if command failed */
4293         for (i = 0; cp->num_cis; cp->num_cis--, i++) {
4294                 struct hci_conn *conn;
4295                 u16 handle;
4296
4297                 handle = __le16_to_cpu(cp->cis[i].cis_handle);
4298
4299                 conn = hci_conn_hash_lookup_handle(hdev, handle);
4300                 if (conn) {
4301                         if (test_and_clear_bit(HCI_CONN_CREATE_CIS,
4302                                                &conn->flags))
4303                                 pending = true;
4304                         conn->state = BT_CLOSED;
4305                         hci_connect_cfm(conn, status);
4306                         hci_conn_del(conn);
4307                 }
4308         }
4309
4310         if (pending)
4311                 hci_le_create_cis_pending(hdev);
4312
4313         hci_dev_unlock(hdev);
4314 }
4315
4316 #define HCI_CS(_op, _func) \
4317 { \
4318         .op = _op, \
4319         .func = _func, \
4320 }
4321
4322 static const struct hci_cs {
4323         u16  op;
4324         void (*func)(struct hci_dev *hdev, __u8 status);
4325 } hci_cs_table[] = {
4326         HCI_CS(HCI_OP_INQUIRY, hci_cs_inquiry),
4327         HCI_CS(HCI_OP_CREATE_CONN, hci_cs_create_conn),
4328         HCI_CS(HCI_OP_DISCONNECT, hci_cs_disconnect),
4329         HCI_CS(HCI_OP_ADD_SCO, hci_cs_add_sco),
4330         HCI_CS(HCI_OP_AUTH_REQUESTED, hci_cs_auth_requested),
4331         HCI_CS(HCI_OP_SET_CONN_ENCRYPT, hci_cs_set_conn_encrypt),
4332         HCI_CS(HCI_OP_REMOTE_NAME_REQ, hci_cs_remote_name_req),
4333         HCI_CS(HCI_OP_READ_REMOTE_FEATURES, hci_cs_read_remote_features),
4334         HCI_CS(HCI_OP_READ_REMOTE_EXT_FEATURES,
4335                hci_cs_read_remote_ext_features),
4336         HCI_CS(HCI_OP_SETUP_SYNC_CONN, hci_cs_setup_sync_conn),
4337         HCI_CS(HCI_OP_ENHANCED_SETUP_SYNC_CONN,
4338                hci_cs_enhanced_setup_sync_conn),
4339         HCI_CS(HCI_OP_SNIFF_MODE, hci_cs_sniff_mode),
4340         HCI_CS(HCI_OP_EXIT_SNIFF_MODE, hci_cs_exit_sniff_mode),
4341         HCI_CS(HCI_OP_SWITCH_ROLE, hci_cs_switch_role),
4342         HCI_CS(HCI_OP_LE_CREATE_CONN, hci_cs_le_create_conn),
4343         HCI_CS(HCI_OP_LE_READ_REMOTE_FEATURES, hci_cs_le_read_remote_features),
4344         HCI_CS(HCI_OP_LE_START_ENC, hci_cs_le_start_enc),
4345         HCI_CS(HCI_OP_LE_EXT_CREATE_CONN, hci_cs_le_ext_create_conn),
4346         HCI_CS(HCI_OP_LE_CREATE_CIS, hci_cs_le_create_cis),
4347         HCI_CS(HCI_OP_LE_CREATE_BIG, hci_cs_le_create_big),
4348 };
4349
4350 static void hci_cmd_status_evt(struct hci_dev *hdev, void *data,
4351                                struct sk_buff *skb, u16 *opcode, u8 *status,
4352                                hci_req_complete_t *req_complete,
4353                                hci_req_complete_skb_t *req_complete_skb)
4354 {
4355         struct hci_ev_cmd_status *ev = data;
4356         int i;
4357
4358         *opcode = __le16_to_cpu(ev->opcode);
4359         *status = ev->status;
4360
4361         bt_dev_dbg(hdev, "opcode 0x%4.4x", *opcode);
4362
4363         for (i = 0; i < ARRAY_SIZE(hci_cs_table); i++) {
4364                 if (hci_cs_table[i].op == *opcode) {
4365                         hci_cs_table[i].func(hdev, ev->status);
4366                         break;
4367                 }
4368         }
4369
4370         handle_cmd_cnt_and_timer(hdev, ev->ncmd);
4371
4372         /* Indicate request completion if the command failed. Also, if
4373          * we're not waiting for a special event and we get a success
4374          * command status we should try to flag the request as completed
4375          * (since for this kind of commands there will not be a command
4376          * complete event).
4377          */
4378         if (ev->status || (hdev->sent_cmd && !hci_skb_event(hdev->sent_cmd))) {
4379                 hci_req_cmd_complete(hdev, *opcode, ev->status, req_complete,
4380                                      req_complete_skb);
4381                 if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
4382                         bt_dev_err(hdev, "unexpected event for opcode 0x%4.4x",
4383                                    *opcode);
4384                         return;
4385                 }
4386         }
4387
4388         if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
4389                 queue_work(hdev->workqueue, &hdev->cmd_work);
4390 }
4391
4392 static void hci_hardware_error_evt(struct hci_dev *hdev, void *data,
4393                                    struct sk_buff *skb)
4394 {
4395         struct hci_ev_hardware_error *ev = data;
4396
4397         bt_dev_dbg(hdev, "code 0x%2.2x", ev->code);
4398
4399         hdev->hw_error_code = ev->code;
4400
4401         queue_work(hdev->req_workqueue, &hdev->error_reset);
4402 }
4403
4404 static void hci_role_change_evt(struct hci_dev *hdev, void *data,
4405                                 struct sk_buff *skb)
4406 {
4407         struct hci_ev_role_change *ev = data;
4408         struct hci_conn *conn;
4409
4410         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
4411
4412         hci_dev_lock(hdev);
4413
4414         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4415         if (conn) {
4416                 if (!ev->status)
4417                         conn->role = ev->role;
4418
4419                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
4420
4421                 hci_role_switch_cfm(conn, ev->status, ev->role);
4422         }
4423
4424         hci_dev_unlock(hdev);
4425 }
4426
4427 static void hci_num_comp_pkts_evt(struct hci_dev *hdev, void *data,
4428                                   struct sk_buff *skb)
4429 {
4430         struct hci_ev_num_comp_pkts *ev = data;
4431         int i;
4432
4433         if (!hci_ev_skb_pull(hdev, skb, HCI_EV_NUM_COMP_PKTS,
4434                              flex_array_size(ev, handles, ev->num)))
4435                 return;
4436
4437         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
4438                 bt_dev_err(hdev, "wrong event for mode %d", hdev->flow_ctl_mode);
4439                 return;
4440         }
4441
4442         bt_dev_dbg(hdev, "num %d", ev->num);
4443
4444         for (i = 0; i < ev->num; i++) {
4445                 struct hci_comp_pkts_info *info = &ev->handles[i];
4446                 struct hci_conn *conn;
4447                 __u16  handle, count;
4448
4449                 handle = __le16_to_cpu(info->handle);
4450                 count  = __le16_to_cpu(info->count);
4451
4452                 conn = hci_conn_hash_lookup_handle(hdev, handle);
4453                 if (!conn)
4454                         continue;
4455
4456                 conn->sent -= count;
4457
4458                 switch (conn->type) {
4459                 case ACL_LINK:
4460                         hdev->acl_cnt += count;
4461                         if (hdev->acl_cnt > hdev->acl_pkts)
4462                                 hdev->acl_cnt = hdev->acl_pkts;
4463                         break;
4464
4465                 case LE_LINK:
4466                         if (hdev->le_pkts) {
4467                                 hdev->le_cnt += count;
4468                                 if (hdev->le_cnt > hdev->le_pkts)
4469                                         hdev->le_cnt = hdev->le_pkts;
4470                         } else {
4471                                 hdev->acl_cnt += count;
4472                                 if (hdev->acl_cnt > hdev->acl_pkts)
4473                                         hdev->acl_cnt = hdev->acl_pkts;
4474                         }
4475                         break;
4476
4477                 case SCO_LINK:
4478                         hdev->sco_cnt += count;
4479                         if (hdev->sco_cnt > hdev->sco_pkts)
4480                                 hdev->sco_cnt = hdev->sco_pkts;
4481                         break;
4482
4483                 case ISO_LINK:
4484                         if (hdev->iso_pkts) {
4485                                 hdev->iso_cnt += count;
4486                                 if (hdev->iso_cnt > hdev->iso_pkts)
4487                                         hdev->iso_cnt = hdev->iso_pkts;
4488                         } else if (hdev->le_pkts) {
4489                                 hdev->le_cnt += count;
4490                                 if (hdev->le_cnt > hdev->le_pkts)
4491                                         hdev->le_cnt = hdev->le_pkts;
4492                         } else {
4493                                 hdev->acl_cnt += count;
4494                                 if (hdev->acl_cnt > hdev->acl_pkts)
4495                                         hdev->acl_cnt = hdev->acl_pkts;
4496                         }
4497                         break;
4498
4499                 default:
4500                         bt_dev_err(hdev, "unknown type %d conn %p",
4501                                    conn->type, conn);
4502                         break;
4503                 }
4504         }
4505
4506         queue_work(hdev->workqueue, &hdev->tx_work);
4507 }
4508
4509 static struct hci_conn *__hci_conn_lookup_handle(struct hci_dev *hdev,
4510                                                  __u16 handle)
4511 {
4512         struct hci_chan *chan;
4513
4514         switch (hdev->dev_type) {
4515         case HCI_PRIMARY:
4516                 return hci_conn_hash_lookup_handle(hdev, handle);
4517         case HCI_AMP:
4518                 chan = hci_chan_lookup_handle(hdev, handle);
4519                 if (chan)
4520                         return chan->conn;
4521                 break;
4522         default:
4523                 bt_dev_err(hdev, "unknown dev_type %d", hdev->dev_type);
4524                 break;
4525         }
4526
4527         return NULL;
4528 }
4529
4530 static void hci_num_comp_blocks_evt(struct hci_dev *hdev, void *data,
4531                                     struct sk_buff *skb)
4532 {
4533         struct hci_ev_num_comp_blocks *ev = data;
4534         int i;
4535
4536         if (!hci_ev_skb_pull(hdev, skb, HCI_EV_NUM_COMP_BLOCKS,
4537                              flex_array_size(ev, handles, ev->num_hndl)))
4538                 return;
4539
4540         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
4541                 bt_dev_err(hdev, "wrong event for mode %d",
4542                            hdev->flow_ctl_mode);
4543                 return;
4544         }
4545
4546         bt_dev_dbg(hdev, "num_blocks %d num_hndl %d", ev->num_blocks,
4547                    ev->num_hndl);
4548
4549         for (i = 0; i < ev->num_hndl; i++) {
4550                 struct hci_comp_blocks_info *info = &ev->handles[i];
4551                 struct hci_conn *conn = NULL;
4552                 __u16  handle, block_count;
4553
4554                 handle = __le16_to_cpu(info->handle);
4555                 block_count = __le16_to_cpu(info->blocks);
4556
4557                 conn = __hci_conn_lookup_handle(hdev, handle);
4558                 if (!conn)
4559                         continue;
4560
4561                 conn->sent -= block_count;
4562
4563                 switch (conn->type) {
4564                 case ACL_LINK:
4565                 case AMP_LINK:
4566                         hdev->block_cnt += block_count;
4567                         if (hdev->block_cnt > hdev->num_blocks)
4568                                 hdev->block_cnt = hdev->num_blocks;
4569                         break;
4570
4571                 default:
4572                         bt_dev_err(hdev, "unknown type %d conn %p",
4573                                    conn->type, conn);
4574                         break;
4575                 }
4576         }
4577
4578         queue_work(hdev->workqueue, &hdev->tx_work);
4579 }
4580
4581 static void hci_mode_change_evt(struct hci_dev *hdev, void *data,
4582                                 struct sk_buff *skb)
4583 {
4584         struct hci_ev_mode_change *ev = data;
4585         struct hci_conn *conn;
4586
4587         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
4588
4589         hci_dev_lock(hdev);
4590
4591         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4592         if (conn) {
4593                 conn->mode = ev->mode;
4594
4595                 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND,
4596                                         &conn->flags)) {
4597                         if (conn->mode == HCI_CM_ACTIVE)
4598                                 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
4599                         else
4600                                 clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
4601                 }
4602
4603                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
4604                         hci_sco_setup(conn, ev->status);
4605         }
4606
4607         hci_dev_unlock(hdev);
4608 }
4609
4610 static void hci_pin_code_request_evt(struct hci_dev *hdev, void *data,
4611                                      struct sk_buff *skb)
4612 {
4613         struct hci_ev_pin_code_req *ev = data;
4614         struct hci_conn *conn;
4615
4616         bt_dev_dbg(hdev, "");
4617
4618         hci_dev_lock(hdev);
4619
4620         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4621         if (!conn)
4622                 goto unlock;
4623
4624         if (conn->state == BT_CONNECTED) {
4625                 hci_conn_hold(conn);
4626                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
4627                 hci_conn_drop(conn);
4628         }
4629
4630         if (!hci_dev_test_flag(hdev, HCI_BONDABLE) &&
4631             !test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags)) {
4632                 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
4633                              sizeof(ev->bdaddr), &ev->bdaddr);
4634         } else if (hci_dev_test_flag(hdev, HCI_MGMT)) {
4635                 u8 secure;
4636
4637                 if (conn->pending_sec_level == BT_SECURITY_HIGH)
4638                         secure = 1;
4639                 else
4640                         secure = 0;
4641
4642                 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
4643         }
4644
4645 unlock:
4646         hci_dev_unlock(hdev);
4647 }
4648
4649 static void conn_set_key(struct hci_conn *conn, u8 key_type, u8 pin_len)
4650 {
4651         if (key_type == HCI_LK_CHANGED_COMBINATION)
4652                 return;
4653
4654         conn->pin_length = pin_len;
4655         conn->key_type = key_type;
4656
4657         switch (key_type) {
4658         case HCI_LK_LOCAL_UNIT:
4659         case HCI_LK_REMOTE_UNIT:
4660         case HCI_LK_DEBUG_COMBINATION:
4661                 return;
4662         case HCI_LK_COMBINATION:
4663                 if (pin_len == 16)
4664                         conn->pending_sec_level = BT_SECURITY_HIGH;
4665                 else
4666                         conn->pending_sec_level = BT_SECURITY_MEDIUM;
4667                 break;
4668         case HCI_LK_UNAUTH_COMBINATION_P192:
4669         case HCI_LK_UNAUTH_COMBINATION_P256:
4670                 conn->pending_sec_level = BT_SECURITY_MEDIUM;
4671                 break;
4672         case HCI_LK_AUTH_COMBINATION_P192:
4673                 conn->pending_sec_level = BT_SECURITY_HIGH;
4674                 break;
4675         case HCI_LK_AUTH_COMBINATION_P256:
4676                 conn->pending_sec_level = BT_SECURITY_FIPS;
4677                 break;
4678         }
4679 }
4680
4681 static void hci_link_key_request_evt(struct hci_dev *hdev, void *data,
4682                                      struct sk_buff *skb)
4683 {
4684         struct hci_ev_link_key_req *ev = data;
4685         struct hci_cp_link_key_reply cp;
4686         struct hci_conn *conn;
4687         struct link_key *key;
4688
4689         bt_dev_dbg(hdev, "");
4690
4691         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4692                 return;
4693
4694         hci_dev_lock(hdev);
4695
4696         key = hci_find_link_key(hdev, &ev->bdaddr);
4697         if (!key) {
4698                 bt_dev_dbg(hdev, "link key not found for %pMR", &ev->bdaddr);
4699                 goto not_found;
4700         }
4701
4702         bt_dev_dbg(hdev, "found key type %u for %pMR", key->type, &ev->bdaddr);
4703
4704         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4705         if (conn) {
4706                 clear_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
4707
4708                 if ((key->type == HCI_LK_UNAUTH_COMBINATION_P192 ||
4709                      key->type == HCI_LK_UNAUTH_COMBINATION_P256) &&
4710                     conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
4711                         bt_dev_dbg(hdev, "ignoring unauthenticated key");
4712                         goto not_found;
4713                 }
4714
4715                 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
4716                     (conn->pending_sec_level == BT_SECURITY_HIGH ||
4717                      conn->pending_sec_level == BT_SECURITY_FIPS)) {
4718                         bt_dev_dbg(hdev, "ignoring key unauthenticated for high security");
4719                         goto not_found;
4720                 }
4721
4722                 conn_set_key(conn, key->type, key->pin_len);
4723         }
4724
4725         bacpy(&cp.bdaddr, &ev->bdaddr);
4726         memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);
4727
4728         hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
4729
4730         hci_dev_unlock(hdev);
4731
4732         return;
4733
4734 not_found:
4735         hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
4736         hci_dev_unlock(hdev);
4737 }
4738
4739 static void hci_link_key_notify_evt(struct hci_dev *hdev, void *data,
4740                                     struct sk_buff *skb)
4741 {
4742         struct hci_ev_link_key_notify *ev = data;
4743         struct hci_conn *conn;
4744         struct link_key *key;
4745         bool persistent;
4746         u8 pin_len = 0;
4747
4748         bt_dev_dbg(hdev, "");
4749
4750         hci_dev_lock(hdev);
4751
4752         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4753         if (!conn)
4754                 goto unlock;
4755
4756         /* Ignore NULL link key against CVE-2020-26555 */
4757         if (!memcmp(ev->link_key, ZERO_KEY, HCI_LINK_KEY_SIZE)) {
4758                 bt_dev_dbg(hdev, "Ignore NULL link key (ZERO KEY) for %pMR",
4759                            &ev->bdaddr);
4760                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
4761                 hci_conn_drop(conn);
4762                 goto unlock;
4763         }
4764
4765         hci_conn_hold(conn);
4766         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
4767         hci_conn_drop(conn);
4768
4769         set_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
4770         conn_set_key(conn, ev->key_type, conn->pin_length);
4771
4772         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4773                 goto unlock;
4774
4775         key = hci_add_link_key(hdev, conn, &ev->bdaddr, ev->link_key,
4776                                 ev->key_type, pin_len, &persistent);
4777         if (!key)
4778                 goto unlock;
4779
4780         /* Update connection information since adding the key will have
4781          * fixed up the type in the case of changed combination keys.
4782          */
4783         if (ev->key_type == HCI_LK_CHANGED_COMBINATION)
4784                 conn_set_key(conn, key->type, key->pin_len);
4785
4786         mgmt_new_link_key(hdev, key, persistent);
4787
4788         /* Keep debug keys around only if the HCI_KEEP_DEBUG_KEYS flag
4789          * is set. If it's not set simply remove the key from the kernel
4790          * list (we've still notified user space about it but with
4791          * store_hint being 0).
4792          */
4793         if (key->type == HCI_LK_DEBUG_COMBINATION &&
4794             !hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) {
4795                 list_del_rcu(&key->list);
4796                 kfree_rcu(key, rcu);
4797                 goto unlock;
4798         }
4799
4800         if (persistent)
4801                 clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
4802         else
4803                 set_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
4804
4805 unlock:
4806         hci_dev_unlock(hdev);
4807 }
4808
4809 static void hci_clock_offset_evt(struct hci_dev *hdev, void *data,
4810                                  struct sk_buff *skb)
4811 {
4812         struct hci_ev_clock_offset *ev = data;
4813         struct hci_conn *conn;
4814
4815         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
4816
4817         hci_dev_lock(hdev);
4818
4819         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4820         if (conn && !ev->status) {
4821                 struct inquiry_entry *ie;
4822
4823                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
4824                 if (ie) {
4825                         ie->data.clock_offset = ev->clock_offset;
4826                         ie->timestamp = jiffies;
4827                 }
4828         }
4829
4830         hci_dev_unlock(hdev);
4831 }
4832
4833 static void hci_pkt_type_change_evt(struct hci_dev *hdev, void *data,
4834                                     struct sk_buff *skb)
4835 {
4836         struct hci_ev_pkt_type_change *ev = data;
4837         struct hci_conn *conn;
4838
4839         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
4840
4841         hci_dev_lock(hdev);
4842
4843         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4844         if (conn && !ev->status)
4845                 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
4846
4847         hci_dev_unlock(hdev);
4848 }
4849
4850 static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, void *data,
4851                                    struct sk_buff *skb)
4852 {
4853         struct hci_ev_pscan_rep_mode *ev = data;
4854         struct inquiry_entry *ie;
4855
4856         bt_dev_dbg(hdev, "");
4857
4858         hci_dev_lock(hdev);
4859
4860         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
4861         if (ie) {
4862                 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
4863                 ie->timestamp = jiffies;
4864         }
4865
4866         hci_dev_unlock(hdev);
4867 }
4868
4869 static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, void *edata,
4870                                              struct sk_buff *skb)
4871 {
4872         struct hci_ev_inquiry_result_rssi *ev = edata;
4873         struct inquiry_data data;
4874         int i;
4875
4876         bt_dev_dbg(hdev, "num_rsp %d", ev->num);
4877
4878         if (!ev->num)
4879                 return;
4880
4881         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
4882                 return;
4883
4884         hci_dev_lock(hdev);
4885
4886         if (skb->len == array_size(ev->num,
4887                                    sizeof(struct inquiry_info_rssi_pscan))) {
4888                 struct inquiry_info_rssi_pscan *info;
4889
4890                 for (i = 0; i < ev->num; i++) {
4891                         u32 flags;
4892
4893                         info = hci_ev_skb_pull(hdev, skb,
4894                                                HCI_EV_INQUIRY_RESULT_WITH_RSSI,
4895                                                sizeof(*info));
4896                         if (!info) {
4897                                 bt_dev_err(hdev, "Malformed HCI Event: 0x%2.2x",
4898                                            HCI_EV_INQUIRY_RESULT_WITH_RSSI);
4899                                 goto unlock;
4900                         }
4901
4902                         bacpy(&data.bdaddr, &info->bdaddr);
4903                         data.pscan_rep_mode     = info->pscan_rep_mode;
4904                         data.pscan_period_mode  = info->pscan_period_mode;
4905                         data.pscan_mode         = info->pscan_mode;
4906                         memcpy(data.dev_class, info->dev_class, 3);
4907                         data.clock_offset       = info->clock_offset;
4908                         data.rssi               = info->rssi;
4909                         data.ssp_mode           = 0x00;
4910
4911                         flags = hci_inquiry_cache_update(hdev, &data, false);
4912
4913                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4914                                           info->dev_class, info->rssi,
4915                                           flags, NULL, 0, NULL, 0, 0);
4916                 }
4917         } else if (skb->len == array_size(ev->num,
4918                                           sizeof(struct inquiry_info_rssi))) {
4919                 struct inquiry_info_rssi *info;
4920
4921                 for (i = 0; i < ev->num; i++) {
4922                         u32 flags;
4923
4924                         info = hci_ev_skb_pull(hdev, skb,
4925                                                HCI_EV_INQUIRY_RESULT_WITH_RSSI,
4926                                                sizeof(*info));
4927                         if (!info) {
4928                                 bt_dev_err(hdev, "Malformed HCI Event: 0x%2.2x",
4929                                            HCI_EV_INQUIRY_RESULT_WITH_RSSI);
4930                                 goto unlock;
4931                         }
4932
4933                         bacpy(&data.bdaddr, &info->bdaddr);
4934                         data.pscan_rep_mode     = info->pscan_rep_mode;
4935                         data.pscan_period_mode  = info->pscan_period_mode;
4936                         data.pscan_mode         = 0x00;
4937                         memcpy(data.dev_class, info->dev_class, 3);
4938                         data.clock_offset       = info->clock_offset;
4939                         data.rssi               = info->rssi;
4940                         data.ssp_mode           = 0x00;
4941
4942                         flags = hci_inquiry_cache_update(hdev, &data, false);
4943
4944                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4945                                           info->dev_class, info->rssi,
4946                                           flags, NULL, 0, NULL, 0, 0);
4947                 }
4948         } else {
4949                 bt_dev_err(hdev, "Malformed HCI Event: 0x%2.2x",
4950                            HCI_EV_INQUIRY_RESULT_WITH_RSSI);
4951         }
4952 unlock:
4953         hci_dev_unlock(hdev);
4954 }
4955
4956 static void hci_remote_ext_features_evt(struct hci_dev *hdev, void *data,
4957                                         struct sk_buff *skb)
4958 {
4959         struct hci_ev_remote_ext_features *ev = data;
4960         struct hci_conn *conn;
4961
4962         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
4963
4964         hci_dev_lock(hdev);
4965
4966         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4967         if (!conn)
4968                 goto unlock;
4969
4970         if (ev->page < HCI_MAX_PAGES)
4971                 memcpy(conn->features[ev->page], ev->features, 8);
4972
4973         if (!ev->status && ev->page == 0x01) {
4974                 struct inquiry_entry *ie;
4975
4976                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
4977                 if (ie)
4978                         ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
4979
4980                 if (ev->features[0] & LMP_HOST_SSP) {
4981                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
4982                 } else {
4983                         /* It is mandatory by the Bluetooth specification that
4984                          * Extended Inquiry Results are only used when Secure
4985                          * Simple Pairing is enabled, but some devices violate
4986                          * this.
4987                          *
4988                          * To make these devices work, the internal SSP
4989                          * enabled flag needs to be cleared if the remote host
4990                          * features do not indicate SSP support */
4991                         clear_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
4992                 }
4993
4994                 if (ev->features[0] & LMP_HOST_SC)
4995                         set_bit(HCI_CONN_SC_ENABLED, &conn->flags);
4996         }
4997
4998         if (conn->state != BT_CONFIG)
4999                 goto unlock;
5000
5001         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
5002                 struct hci_cp_remote_name_req cp;
5003                 memset(&cp, 0, sizeof(cp));
5004                 bacpy(&cp.bdaddr, &conn->dst);
5005                 cp.pscan_rep_mode = 0x02;
5006                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
5007         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
5008                 mgmt_device_connected(hdev, conn, NULL, 0);
5009
5010         if (!hci_outgoing_auth_needed(hdev, conn)) {
5011                 conn->state = BT_CONNECTED;
5012                 hci_connect_cfm(conn, ev->status);
5013                 hci_conn_drop(conn);
5014         }
5015
5016 unlock:
5017         hci_dev_unlock(hdev);
5018 }
5019
5020 static void hci_sync_conn_complete_evt(struct hci_dev *hdev, void *data,
5021                                        struct sk_buff *skb)
5022 {
5023         struct hci_ev_sync_conn_complete *ev = data;
5024         struct hci_conn *conn;
5025         u8 status = ev->status;
5026
5027         switch (ev->link_type) {
5028         case SCO_LINK:
5029         case ESCO_LINK:
5030                 break;
5031         default:
5032                 /* As per Core 5.3 Vol 4 Part E 7.7.35 (p.2219), Link_Type
5033                  * for HCI_Synchronous_Connection_Complete is limited to
5034                  * either SCO or eSCO
5035                  */
5036                 bt_dev_err(hdev, "Ignoring connect complete event for invalid link type");
5037                 return;
5038         }
5039
5040         bt_dev_dbg(hdev, "status 0x%2.2x", status);
5041
5042         hci_dev_lock(hdev);
5043
5044         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
5045         if (!conn) {
5046                 if (ev->link_type == ESCO_LINK)
5047                         goto unlock;
5048
5049                 /* When the link type in the event indicates SCO connection
5050                  * and lookup of the connection object fails, then check
5051                  * if an eSCO connection object exists.
5052                  *
5053                  * The core limits the synchronous connections to either
5054                  * SCO or eSCO. The eSCO connection is preferred and tried
5055                  * to be setup first and until successfully established,
5056                  * the link type will be hinted as eSCO.
5057                  */
5058                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
5059                 if (!conn)
5060                         goto unlock;
5061         }
5062
5063         /* The HCI_Synchronous_Connection_Complete event is only sent once per connection.
5064          * Processing it more than once per connection can corrupt kernel memory.
5065          *
5066          * As the connection handle is set here for the first time, it indicates
5067          * whether the connection is already set up.
5068          */
5069         if (!HCI_CONN_HANDLE_UNSET(conn->handle)) {
5070                 bt_dev_err(hdev, "Ignoring HCI_Sync_Conn_Complete event for existing connection");
5071                 goto unlock;
5072         }
5073
5074         switch (status) {
5075         case 0x00:
5076                 status = hci_conn_set_handle(conn, __le16_to_cpu(ev->handle));
5077                 if (status) {
5078                         conn->state = BT_CLOSED;
5079                         break;
5080                 }
5081
5082                 conn->state  = BT_CONNECTED;
5083                 conn->type   = ev->link_type;
5084
5085                 hci_debugfs_create_conn(conn);
5086                 hci_conn_add_sysfs(conn);
5087                 break;
5088
5089         case 0x10:      /* Connection Accept Timeout */
5090         case 0x0d:      /* Connection Rejected due to Limited Resources */
5091         case 0x11:      /* Unsupported Feature or Parameter Value */
5092         case 0x1c:      /* SCO interval rejected */
5093         case 0x1a:      /* Unsupported Remote Feature */
5094         case 0x1e:      /* Invalid LMP Parameters */
5095         case 0x1f:      /* Unspecified error */
5096         case 0x20:      /* Unsupported LMP Parameter value */
5097                 if (conn->out) {
5098                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
5099                                         (hdev->esco_type & EDR_ESCO_MASK);
5100                         if (hci_setup_sync(conn, conn->parent->handle))
5101                                 goto unlock;
5102                 }
5103                 fallthrough;
5104
5105         default:
5106                 conn->state = BT_CLOSED;
5107                 break;
5108         }
5109
5110         bt_dev_dbg(hdev, "SCO connected with air mode: %02x", ev->air_mode);
5111         /* Notify only in case of SCO over HCI transport data path which
5112          * is zero and non-zero value shall be non-HCI transport data path
5113          */
5114         if (conn->codec.data_path == 0 && hdev->notify) {
5115                 switch (ev->air_mode) {
5116                 case 0x02:
5117                         hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_CVSD);
5118                         break;
5119                 case 0x03:
5120                         hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_TRANSP);
5121                         break;
5122                 }
5123         }
5124
5125         hci_connect_cfm(conn, status);
5126         if (status)
5127                 hci_conn_del(conn);
5128
5129 unlock:
5130         hci_dev_unlock(hdev);
5131 }
5132
5133 static inline size_t eir_get_length(u8 *eir, size_t eir_len)
5134 {
5135         size_t parsed = 0;
5136
5137         while (parsed < eir_len) {
5138                 u8 field_len = eir[0];
5139
5140                 if (field_len == 0)
5141                         return parsed;
5142
5143                 parsed += field_len + 1;
5144                 eir += field_len + 1;
5145         }
5146
5147         return eir_len;
5148 }
5149
5150 static void hci_extended_inquiry_result_evt(struct hci_dev *hdev, void *edata,
5151                                             struct sk_buff *skb)
5152 {
5153         struct hci_ev_ext_inquiry_result *ev = edata;
5154         struct inquiry_data data;
5155         size_t eir_len;
5156         int i;
5157
5158         if (!hci_ev_skb_pull(hdev, skb, HCI_EV_EXTENDED_INQUIRY_RESULT,
5159                              flex_array_size(ev, info, ev->num)))
5160                 return;
5161
5162         bt_dev_dbg(hdev, "num %d", ev->num);
5163
5164         if (!ev->num)
5165                 return;
5166
5167         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
5168                 return;
5169
5170         hci_dev_lock(hdev);
5171
5172         for (i = 0; i < ev->num; i++) {
5173                 struct extended_inquiry_info *info = &ev->info[i];
5174                 u32 flags;
5175                 bool name_known;
5176
5177                 bacpy(&data.bdaddr, &info->bdaddr);
5178                 data.pscan_rep_mode     = info->pscan_rep_mode;
5179                 data.pscan_period_mode  = info->pscan_period_mode;
5180                 data.pscan_mode         = 0x00;
5181                 memcpy(data.dev_class, info->dev_class, 3);
5182                 data.clock_offset       = info->clock_offset;
5183                 data.rssi               = info->rssi;
5184                 data.ssp_mode           = 0x01;
5185
5186                 if (hci_dev_test_flag(hdev, HCI_MGMT))
5187                         name_known = eir_get_data(info->data,
5188                                                   sizeof(info->data),
5189                                                   EIR_NAME_COMPLETE, NULL);
5190                 else
5191                         name_known = true;
5192
5193                 flags = hci_inquiry_cache_update(hdev, &data, name_known);
5194
5195                 eir_len = eir_get_length(info->data, sizeof(info->data));
5196
5197                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
5198                                   info->dev_class, info->rssi,
5199                                   flags, info->data, eir_len, NULL, 0, 0);
5200         }
5201
5202         hci_dev_unlock(hdev);
5203 }
5204
5205 static void hci_key_refresh_complete_evt(struct hci_dev *hdev, void *data,
5206                                          struct sk_buff *skb)
5207 {
5208         struct hci_ev_key_refresh_complete *ev = data;
5209         struct hci_conn *conn;
5210
5211         bt_dev_dbg(hdev, "status 0x%2.2x handle 0x%4.4x", ev->status,
5212                    __le16_to_cpu(ev->handle));
5213
5214         hci_dev_lock(hdev);
5215
5216         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5217         if (!conn)
5218                 goto unlock;
5219
5220         /* For BR/EDR the necessary steps are taken through the
5221          * auth_complete event.
5222          */
5223         if (conn->type != LE_LINK)
5224                 goto unlock;
5225
5226         if (!ev->status)
5227                 conn->sec_level = conn->pending_sec_level;
5228
5229         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
5230
5231         if (ev->status && conn->state == BT_CONNECTED) {
5232                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
5233                 hci_conn_drop(conn);
5234                 goto unlock;
5235         }
5236
5237         if (conn->state == BT_CONFIG) {
5238                 if (!ev->status)
5239                         conn->state = BT_CONNECTED;
5240
5241                 hci_connect_cfm(conn, ev->status);
5242                 hci_conn_drop(conn);
5243         } else {
5244                 hci_auth_cfm(conn, ev->status);
5245
5246                 hci_conn_hold(conn);
5247                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
5248                 hci_conn_drop(conn);
5249         }
5250
5251 unlock:
5252         hci_dev_unlock(hdev);
5253 }
5254
5255 static u8 hci_get_auth_req(struct hci_conn *conn)
5256 {
5257         /* If remote requests no-bonding follow that lead */
5258         if (conn->remote_auth == HCI_AT_NO_BONDING ||
5259             conn->remote_auth == HCI_AT_NO_BONDING_MITM)
5260                 return conn->remote_auth | (conn->auth_type & 0x01);
5261
5262         /* If both remote and local have enough IO capabilities, require
5263          * MITM protection
5264          */
5265         if (conn->remote_cap != HCI_IO_NO_INPUT_OUTPUT &&
5266             conn->io_capability != HCI_IO_NO_INPUT_OUTPUT)
5267                 return conn->remote_auth | 0x01;
5268
5269         /* No MITM protection possible so ignore remote requirement */
5270         return (conn->remote_auth & ~0x01) | (conn->auth_type & 0x01);
5271 }
5272
5273 static u8 bredr_oob_data_present(struct hci_conn *conn)
5274 {
5275         struct hci_dev *hdev = conn->hdev;
5276         struct oob_data *data;
5277
5278         data = hci_find_remote_oob_data(hdev, &conn->dst, BDADDR_BREDR);
5279         if (!data)
5280                 return 0x00;
5281
5282         if (bredr_sc_enabled(hdev)) {
5283                 /* When Secure Connections is enabled, then just
5284                  * return the present value stored with the OOB
5285                  * data. The stored value contains the right present
5286                  * information. However it can only be trusted when
5287                  * not in Secure Connection Only mode.
5288                  */
5289                 if (!hci_dev_test_flag(hdev, HCI_SC_ONLY))
5290                         return data->present;
5291
5292                 /* When Secure Connections Only mode is enabled, then
5293                  * the P-256 values are required. If they are not
5294                  * available, then do not declare that OOB data is
5295                  * present.
5296                  */
5297                 if (!memcmp(data->rand256, ZERO_KEY, 16) ||
5298                     !memcmp(data->hash256, ZERO_KEY, 16))
5299                         return 0x00;
5300
5301                 return 0x02;
5302         }
5303
5304         /* When Secure Connections is not enabled or actually
5305          * not supported by the hardware, then check that if
5306          * P-192 data values are present.
5307          */
5308         if (!memcmp(data->rand192, ZERO_KEY, 16) ||
5309             !memcmp(data->hash192, ZERO_KEY, 16))
5310                 return 0x00;
5311
5312         return 0x01;
5313 }
5314
5315 static void hci_io_capa_request_evt(struct hci_dev *hdev, void *data,
5316                                     struct sk_buff *skb)
5317 {
5318         struct hci_ev_io_capa_request *ev = data;
5319         struct hci_conn *conn;
5320
5321         bt_dev_dbg(hdev, "");
5322
5323         hci_dev_lock(hdev);
5324
5325         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
5326         if (!conn)
5327                 goto unlock;
5328
5329         hci_conn_hold(conn);
5330
5331         if (!hci_dev_test_flag(hdev, HCI_MGMT))
5332                 goto unlock;
5333
5334         /* Allow pairing if we're pairable, the initiators of the
5335          * pairing or if the remote is not requesting bonding.
5336          */
5337         if (hci_dev_test_flag(hdev, HCI_BONDABLE) ||
5338             test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags) ||
5339             (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
5340                 struct hci_cp_io_capability_reply cp;
5341
5342                 bacpy(&cp.bdaddr, &ev->bdaddr);
5343                 /* Change the IO capability from KeyboardDisplay
5344                  * to DisplayYesNo as it is not supported by BT spec. */
5345                 cp.capability = (conn->io_capability == 0x04) ?
5346                                 HCI_IO_DISPLAY_YESNO : conn->io_capability;
5347
5348                 /* If we are initiators, there is no remote information yet */
5349                 if (conn->remote_auth == 0xff) {
5350                         /* Request MITM protection if our IO caps allow it
5351                          * except for the no-bonding case.
5352                          */
5353                         if (conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
5354                             conn->auth_type != HCI_AT_NO_BONDING)
5355                                 conn->auth_type |= 0x01;
5356                 } else {
5357                         conn->auth_type = hci_get_auth_req(conn);
5358                 }
5359
5360                 /* If we're not bondable, force one of the non-bondable
5361                  * authentication requirement values.
5362                  */
5363                 if (!hci_dev_test_flag(hdev, HCI_BONDABLE))
5364                         conn->auth_type &= HCI_AT_NO_BONDING_MITM;
5365
5366                 cp.authentication = conn->auth_type;
5367                 cp.oob_data = bredr_oob_data_present(conn);
5368
5369                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
5370                              sizeof(cp), &cp);
5371         } else {
5372                 struct hci_cp_io_capability_neg_reply cp;
5373
5374                 bacpy(&cp.bdaddr, &ev->bdaddr);
5375                 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
5376
5377                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
5378                              sizeof(cp), &cp);
5379         }
5380
5381 unlock:
5382         hci_dev_unlock(hdev);
5383 }
5384
5385 static void hci_io_capa_reply_evt(struct hci_dev *hdev, void *data,
5386                                   struct sk_buff *skb)
5387 {
5388         struct hci_ev_io_capa_reply *ev = data;
5389         struct hci_conn *conn;
5390
5391         bt_dev_dbg(hdev, "");
5392
5393         hci_dev_lock(hdev);
5394
5395         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
5396         if (!conn)
5397                 goto unlock;
5398
5399         conn->remote_cap = ev->capability;
5400         conn->remote_auth = ev->authentication;
5401
5402 unlock:
5403         hci_dev_unlock(hdev);
5404 }
5405
5406 static void hci_user_confirm_request_evt(struct hci_dev *hdev, void *data,
5407                                          struct sk_buff *skb)
5408 {
5409         struct hci_ev_user_confirm_req *ev = data;
5410         int loc_mitm, rem_mitm, confirm_hint = 0;
5411         struct hci_conn *conn;
5412
5413         bt_dev_dbg(hdev, "");
5414
5415         hci_dev_lock(hdev);
5416
5417         if (!hci_dev_test_flag(hdev, HCI_MGMT))
5418                 goto unlock;
5419
5420         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
5421         if (!conn)
5422                 goto unlock;
5423
5424         loc_mitm = (conn->auth_type & 0x01);
5425         rem_mitm = (conn->remote_auth & 0x01);
5426
5427         /* If we require MITM but the remote device can't provide that
5428          * (it has NoInputNoOutput) then reject the confirmation
5429          * request. We check the security level here since it doesn't
5430          * necessarily match conn->auth_type.
5431          */
5432         if (conn->pending_sec_level > BT_SECURITY_MEDIUM &&
5433             conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
5434                 bt_dev_dbg(hdev, "Rejecting request: remote device can't provide MITM");
5435                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
5436                              sizeof(ev->bdaddr), &ev->bdaddr);
5437                 goto unlock;
5438         }
5439
5440         /* If no side requires MITM protection; auto-accept */
5441         if ((!loc_mitm || conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) &&
5442             (!rem_mitm || conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)) {
5443
5444                 /* If we're not the initiators request authorization to
5445                  * proceed from user space (mgmt_user_confirm with
5446                  * confirm_hint set to 1). The exception is if neither
5447                  * side had MITM or if the local IO capability is
5448                  * NoInputNoOutput, in which case we do auto-accept
5449                  */
5450                 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&
5451                     conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
5452                     (loc_mitm || rem_mitm)) {
5453                         bt_dev_dbg(hdev, "Confirming auto-accept as acceptor");
5454                         confirm_hint = 1;
5455                         goto confirm;
5456                 }
5457
5458                 /* If there already exists link key in local host, leave the
5459                  * decision to user space since the remote device could be
5460                  * legitimate or malicious.
5461                  */
5462                 if (hci_find_link_key(hdev, &ev->bdaddr)) {
5463                         bt_dev_dbg(hdev, "Local host already has link key");
5464                         confirm_hint = 1;
5465                         goto confirm;
5466                 }
5467
5468                 BT_DBG("Auto-accept of user confirmation with %ums delay",
5469                        hdev->auto_accept_delay);
5470
5471                 if (hdev->auto_accept_delay > 0) {
5472                         int delay = msecs_to_jiffies(hdev->auto_accept_delay);
5473                         queue_delayed_work(conn->hdev->workqueue,
5474                                            &conn->auto_accept_work, delay);
5475                         goto unlock;
5476                 }
5477
5478                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
5479                              sizeof(ev->bdaddr), &ev->bdaddr);
5480                 goto unlock;
5481         }
5482
5483 confirm:
5484         mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0,
5485                                   le32_to_cpu(ev->passkey), confirm_hint);
5486
5487 unlock:
5488         hci_dev_unlock(hdev);
5489 }
5490
5491 static void hci_user_passkey_request_evt(struct hci_dev *hdev, void *data,
5492                                          struct sk_buff *skb)
5493 {
5494         struct hci_ev_user_passkey_req *ev = data;
5495
5496         bt_dev_dbg(hdev, "");
5497
5498         if (hci_dev_test_flag(hdev, HCI_MGMT))
5499                 mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
5500 }
5501
5502 static void hci_user_passkey_notify_evt(struct hci_dev *hdev, void *data,
5503                                         struct sk_buff *skb)
5504 {
5505         struct hci_ev_user_passkey_notify *ev = data;
5506         struct hci_conn *conn;
5507
5508         bt_dev_dbg(hdev, "");
5509
5510         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
5511         if (!conn)
5512                 return;
5513
5514         conn->passkey_notify = __le32_to_cpu(ev->passkey);
5515         conn->passkey_entered = 0;
5516
5517         if (hci_dev_test_flag(hdev, HCI_MGMT))
5518                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
5519                                          conn->dst_type, conn->passkey_notify,
5520                                          conn->passkey_entered);
5521 }
5522
5523 static void hci_keypress_notify_evt(struct hci_dev *hdev, void *data,
5524                                     struct sk_buff *skb)
5525 {
5526         struct hci_ev_keypress_notify *ev = data;
5527         struct hci_conn *conn;
5528
5529         bt_dev_dbg(hdev, "");
5530
5531         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
5532         if (!conn)
5533                 return;
5534
5535         switch (ev->type) {
5536         case HCI_KEYPRESS_STARTED:
5537                 conn->passkey_entered = 0;
5538                 return;
5539
5540         case HCI_KEYPRESS_ENTERED:
5541                 conn->passkey_entered++;
5542                 break;
5543
5544         case HCI_KEYPRESS_ERASED:
5545                 conn->passkey_entered--;
5546                 break;
5547
5548         case HCI_KEYPRESS_CLEARED:
5549                 conn->passkey_entered = 0;
5550                 break;
5551
5552         case HCI_KEYPRESS_COMPLETED:
5553                 return;
5554         }
5555
5556         if (hci_dev_test_flag(hdev, HCI_MGMT))
5557                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
5558                                          conn->dst_type, conn->passkey_notify,
5559                                          conn->passkey_entered);
5560 }
5561
5562 static void hci_simple_pair_complete_evt(struct hci_dev *hdev, void *data,
5563                                          struct sk_buff *skb)
5564 {
5565         struct hci_ev_simple_pair_complete *ev = data;
5566         struct hci_conn *conn;
5567
5568         bt_dev_dbg(hdev, "");
5569
5570         hci_dev_lock(hdev);
5571
5572         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
5573         if (!conn)
5574                 goto unlock;
5575
5576         /* Reset the authentication requirement to unknown */
5577         conn->remote_auth = 0xff;
5578
5579         /* To avoid duplicate auth_failed events to user space we check
5580          * the HCI_CONN_AUTH_PEND flag which will be set if we
5581          * initiated the authentication. A traditional auth_complete
5582          * event gets always produced as initiator and is also mapped to
5583          * the mgmt_auth_failed event */
5584         if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status)
5585                 mgmt_auth_failed(conn, ev->status);
5586
5587         hci_conn_drop(conn);
5588
5589 unlock:
5590         hci_dev_unlock(hdev);
5591 }
5592
5593 static void hci_remote_host_features_evt(struct hci_dev *hdev, void *data,
5594                                          struct sk_buff *skb)
5595 {
5596         struct hci_ev_remote_host_features *ev = data;
5597         struct inquiry_entry *ie;
5598         struct hci_conn *conn;
5599
5600         bt_dev_dbg(hdev, "");
5601
5602         hci_dev_lock(hdev);
5603
5604         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
5605         if (conn)
5606                 memcpy(conn->features[1], ev->features, 8);
5607
5608         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
5609         if (ie)
5610                 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
5611
5612         hci_dev_unlock(hdev);
5613 }
5614
5615 static void hci_remote_oob_data_request_evt(struct hci_dev *hdev, void *edata,
5616                                             struct sk_buff *skb)
5617 {
5618         struct hci_ev_remote_oob_data_request *ev = edata;
5619         struct oob_data *data;
5620
5621         bt_dev_dbg(hdev, "");
5622
5623         hci_dev_lock(hdev);
5624
5625         if (!hci_dev_test_flag(hdev, HCI_MGMT))
5626                 goto unlock;
5627
5628         data = hci_find_remote_oob_data(hdev, &ev->bdaddr, BDADDR_BREDR);
5629         if (!data) {
5630                 struct hci_cp_remote_oob_data_neg_reply cp;
5631
5632                 bacpy(&cp.bdaddr, &ev->bdaddr);
5633                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY,
5634                              sizeof(cp), &cp);
5635                 goto unlock;
5636         }
5637
5638         if (bredr_sc_enabled(hdev)) {
5639                 struct hci_cp_remote_oob_ext_data_reply cp;
5640
5641                 bacpy(&cp.bdaddr, &ev->bdaddr);
5642                 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
5643                         memset(cp.hash192, 0, sizeof(cp.hash192));
5644                         memset(cp.rand192, 0, sizeof(cp.rand192));
5645                 } else {
5646                         memcpy(cp.hash192, data->hash192, sizeof(cp.hash192));
5647                         memcpy(cp.rand192, data->rand192, sizeof(cp.rand192));
5648                 }
5649                 memcpy(cp.hash256, data->hash256, sizeof(cp.hash256));
5650                 memcpy(cp.rand256, data->rand256, sizeof(cp.rand256));
5651
5652                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_EXT_DATA_REPLY,
5653                              sizeof(cp), &cp);
5654         } else {
5655                 struct hci_cp_remote_oob_data_reply cp;
5656
5657                 bacpy(&cp.bdaddr, &ev->bdaddr);
5658                 memcpy(cp.hash, data->hash192, sizeof(cp.hash));
5659                 memcpy(cp.rand, data->rand192, sizeof(cp.rand));
5660
5661                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY,
5662                              sizeof(cp), &cp);
5663         }
5664
5665 unlock:
5666         hci_dev_unlock(hdev);
5667 }
5668
5669 #if IS_ENABLED(CONFIG_BT_HS)
5670 static void hci_chan_selected_evt(struct hci_dev *hdev, void *data,
5671                                   struct sk_buff *skb)
5672 {
5673         struct hci_ev_channel_selected *ev = data;
5674         struct hci_conn *hcon;
5675
5676         bt_dev_dbg(hdev, "handle 0x%2.2x", ev->phy_handle);
5677
5678         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
5679         if (!hcon)
5680                 return;
5681
5682         amp_read_loc_assoc_final_data(hdev, hcon);
5683 }
5684
5685 static void hci_phy_link_complete_evt(struct hci_dev *hdev, void *data,
5686                                       struct sk_buff *skb)
5687 {
5688         struct hci_ev_phy_link_complete *ev = data;
5689         struct hci_conn *hcon, *bredr_hcon;
5690
5691         bt_dev_dbg(hdev, "handle 0x%2.2x status 0x%2.2x", ev->phy_handle,
5692                    ev->status);
5693
5694         hci_dev_lock(hdev);
5695
5696         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
5697         if (!hcon)
5698                 goto unlock;
5699
5700         if (!hcon->amp_mgr)
5701                 goto unlock;
5702
5703         if (ev->status) {
5704                 hci_conn_del(hcon);
5705                 goto unlock;
5706         }
5707
5708         bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
5709
5710         hcon->state = BT_CONNECTED;
5711         bacpy(&hcon->dst, &bredr_hcon->dst);
5712
5713         hci_conn_hold(hcon);
5714         hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
5715         hci_conn_drop(hcon);
5716
5717         hci_debugfs_create_conn(hcon);
5718         hci_conn_add_sysfs(hcon);
5719
5720         amp_physical_cfm(bredr_hcon, hcon);
5721
5722 unlock:
5723         hci_dev_unlock(hdev);
5724 }
5725
5726 static void hci_loglink_complete_evt(struct hci_dev *hdev, void *data,
5727                                      struct sk_buff *skb)
5728 {
5729         struct hci_ev_logical_link_complete *ev = data;
5730         struct hci_conn *hcon;
5731         struct hci_chan *hchan;
5732         struct amp_mgr *mgr;
5733
5734         bt_dev_dbg(hdev, "log_handle 0x%4.4x phy_handle 0x%2.2x status 0x%2.2x",
5735                    le16_to_cpu(ev->handle), ev->phy_handle, ev->status);
5736
5737         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
5738         if (!hcon)
5739                 return;
5740
5741         /* Create AMP hchan */
5742         hchan = hci_chan_create(hcon);
5743         if (!hchan)
5744                 return;
5745
5746         hchan->handle = le16_to_cpu(ev->handle);
5747         hchan->amp = true;
5748
5749         BT_DBG("hcon %p mgr %p hchan %p", hcon, hcon->amp_mgr, hchan);
5750
5751         mgr = hcon->amp_mgr;
5752         if (mgr && mgr->bredr_chan) {
5753                 struct l2cap_chan *bredr_chan = mgr->bredr_chan;
5754
5755                 l2cap_chan_lock(bredr_chan);
5756
5757                 bredr_chan->conn->mtu = hdev->block_mtu;
5758                 l2cap_logical_cfm(bredr_chan, hchan, 0);
5759                 hci_conn_hold(hcon);
5760
5761                 l2cap_chan_unlock(bredr_chan);
5762         }
5763 }
5764
5765 static void hci_disconn_loglink_complete_evt(struct hci_dev *hdev, void *data,
5766                                              struct sk_buff *skb)
5767 {
5768         struct hci_ev_disconn_logical_link_complete *ev = data;
5769         struct hci_chan *hchan;
5770
5771         bt_dev_dbg(hdev, "handle 0x%4.4x status 0x%2.2x",
5772                    le16_to_cpu(ev->handle), ev->status);
5773
5774         if (ev->status)
5775                 return;
5776
5777         hci_dev_lock(hdev);
5778
5779         hchan = hci_chan_lookup_handle(hdev, le16_to_cpu(ev->handle));
5780         if (!hchan || !hchan->amp)
5781                 goto unlock;
5782
5783         amp_destroy_logical_link(hchan, ev->reason);
5784
5785 unlock:
5786         hci_dev_unlock(hdev);
5787 }
5788
5789 static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev, void *data,
5790                                              struct sk_buff *skb)
5791 {
5792         struct hci_ev_disconn_phy_link_complete *ev = data;
5793         struct hci_conn *hcon;
5794
5795         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
5796
5797         if (ev->status)
5798                 return;
5799
5800         hci_dev_lock(hdev);
5801
5802         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
5803         if (hcon && hcon->type == AMP_LINK) {
5804                 hcon->state = BT_CLOSED;
5805                 hci_disconn_cfm(hcon, ev->reason);
5806                 hci_conn_del(hcon);
5807         }
5808
5809         hci_dev_unlock(hdev);
5810 }
5811 #endif
5812
5813 static void le_conn_update_addr(struct hci_conn *conn, bdaddr_t *bdaddr,
5814                                 u8 bdaddr_type, bdaddr_t *local_rpa)
5815 {
5816         if (conn->out) {
5817                 conn->dst_type = bdaddr_type;
5818                 conn->resp_addr_type = bdaddr_type;
5819                 bacpy(&conn->resp_addr, bdaddr);
5820
5821                 /* Check if the controller has set a Local RPA then it must be
5822                  * used instead or hdev->rpa.
5823                  */
5824                 if (local_rpa && bacmp(local_rpa, BDADDR_ANY)) {
5825                         conn->init_addr_type = ADDR_LE_DEV_RANDOM;
5826                         bacpy(&conn->init_addr, local_rpa);
5827                 } else if (hci_dev_test_flag(conn->hdev, HCI_PRIVACY)) {
5828                         conn->init_addr_type = ADDR_LE_DEV_RANDOM;
5829                         bacpy(&conn->init_addr, &conn->hdev->rpa);
5830                 } else {
5831                         hci_copy_identity_address(conn->hdev, &conn->init_addr,
5832                                                   &conn->init_addr_type);
5833                 }
5834         } else {
5835                 conn->resp_addr_type = conn->hdev->adv_addr_type;
5836                 /* Check if the controller has set a Local RPA then it must be
5837                  * used instead or hdev->rpa.
5838                  */
5839                 if (local_rpa && bacmp(local_rpa, BDADDR_ANY)) {
5840                         conn->resp_addr_type = ADDR_LE_DEV_RANDOM;
5841                         bacpy(&conn->resp_addr, local_rpa);
5842                 } else if (conn->hdev->adv_addr_type == ADDR_LE_DEV_RANDOM) {
5843                         /* In case of ext adv, resp_addr will be updated in
5844                          * Adv Terminated event.
5845                          */
5846                         if (!ext_adv_capable(conn->hdev))
5847                                 bacpy(&conn->resp_addr,
5848                                       &conn->hdev->random_addr);
5849                 } else {
5850                         bacpy(&conn->resp_addr, &conn->hdev->bdaddr);
5851                 }
5852
5853                 conn->init_addr_type = bdaddr_type;
5854                 bacpy(&conn->init_addr, bdaddr);
5855
5856                 /* For incoming connections, set the default minimum
5857                  * and maximum connection interval. They will be used
5858                  * to check if the parameters are in range and if not
5859                  * trigger the connection update procedure.
5860                  */
5861                 conn->le_conn_min_interval = conn->hdev->le_conn_min_interval;
5862                 conn->le_conn_max_interval = conn->hdev->le_conn_max_interval;
5863         }
5864 }
5865
5866 static void le_conn_complete_evt(struct hci_dev *hdev, u8 status,
5867                                  bdaddr_t *bdaddr, u8 bdaddr_type,
5868                                  bdaddr_t *local_rpa, u8 role, u16 handle,
5869                                  u16 interval, u16 latency,
5870                                  u16 supervision_timeout)
5871 {
5872         struct hci_conn_params *params;
5873         struct hci_conn *conn;
5874         struct smp_irk *irk;
5875         u8 addr_type;
5876
5877         hci_dev_lock(hdev);
5878
5879         /* All controllers implicitly stop advertising in the event of a
5880          * connection, so ensure that the state bit is cleared.
5881          */
5882         hci_dev_clear_flag(hdev, HCI_LE_ADV);
5883
5884         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr);
5885         if (!conn) {
5886                 /* In case of error status and there is no connection pending
5887                  * just unlock as there is nothing to cleanup.
5888                  */
5889                 if (status)
5890                         goto unlock;
5891
5892                 conn = hci_conn_add(hdev, LE_LINK, bdaddr, role);
5893                 if (!conn) {
5894                         bt_dev_err(hdev, "no memory for new connection");
5895                         goto unlock;
5896                 }
5897
5898                 conn->dst_type = bdaddr_type;
5899
5900                 /* If we didn't have a hci_conn object previously
5901                  * but we're in central role this must be something
5902                  * initiated using an accept list. Since accept list based
5903                  * connections are not "first class citizens" we don't
5904                  * have full tracking of them. Therefore, we go ahead
5905                  * with a "best effort" approach of determining the
5906                  * initiator address based on the HCI_PRIVACY flag.
5907                  */
5908                 if (conn->out) {
5909                         conn->resp_addr_type = bdaddr_type;
5910                         bacpy(&conn->resp_addr, bdaddr);
5911                         if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
5912                                 conn->init_addr_type = ADDR_LE_DEV_RANDOM;
5913                                 bacpy(&conn->init_addr, &hdev->rpa);
5914                         } else {
5915                                 hci_copy_identity_address(hdev,
5916                                                           &conn->init_addr,
5917                                                           &conn->init_addr_type);
5918                         }
5919                 }
5920         } else {
5921                 cancel_delayed_work(&conn->le_conn_timeout);
5922         }
5923
5924         /* The HCI_LE_Connection_Complete event is only sent once per connection.
5925          * Processing it more than once per connection can corrupt kernel memory.
5926          *
5927          * As the connection handle is set here for the first time, it indicates
5928          * whether the connection is already set up.
5929          */
5930         if (!HCI_CONN_HANDLE_UNSET(conn->handle)) {
5931                 bt_dev_err(hdev, "Ignoring HCI_Connection_Complete for existing connection");
5932                 goto unlock;
5933         }
5934
5935         le_conn_update_addr(conn, bdaddr, bdaddr_type, local_rpa);
5936
5937         /* Lookup the identity address from the stored connection
5938          * address and address type.
5939          *
5940          * When establishing connections to an identity address, the
5941          * connection procedure will store the resolvable random
5942          * address first. Now if it can be converted back into the
5943          * identity address, start using the identity address from
5944          * now on.
5945          */
5946         irk = hci_get_irk(hdev, &conn->dst, conn->dst_type);
5947         if (irk) {
5948                 bacpy(&conn->dst, &irk->bdaddr);
5949                 conn->dst_type = irk->addr_type;
5950         }
5951
5952         conn->dst_type = ev_bdaddr_type(hdev, conn->dst_type, NULL);
5953
5954         if (handle > HCI_CONN_HANDLE_MAX) {
5955                 bt_dev_err(hdev, "Invalid handle: 0x%4.4x > 0x%4.4x", handle,
5956                            HCI_CONN_HANDLE_MAX);
5957                 status = HCI_ERROR_INVALID_PARAMETERS;
5958         }
5959
5960         /* All connection failure handling is taken care of by the
5961          * hci_conn_failed function which is triggered by the HCI
5962          * request completion callbacks used for connecting.
5963          */
5964         if (status)
5965                 goto unlock;
5966
5967         /* Drop the connection if it has been aborted */
5968         if (test_bit(HCI_CONN_CANCEL, &conn->flags)) {
5969                 hci_conn_drop(conn);
5970                 goto unlock;
5971         }
5972
5973         if (conn->dst_type == ADDR_LE_DEV_PUBLIC)
5974                 addr_type = BDADDR_LE_PUBLIC;
5975         else
5976                 addr_type = BDADDR_LE_RANDOM;
5977
5978         /* Drop the connection if the device is blocked */
5979         if (hci_bdaddr_list_lookup(&hdev->reject_list, &conn->dst, addr_type)) {
5980                 hci_conn_drop(conn);
5981                 goto unlock;
5982         }
5983
5984         if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
5985                 mgmt_device_connected(hdev, conn, NULL, 0);
5986
5987         conn->sec_level = BT_SECURITY_LOW;
5988         conn->handle = handle;
5989         conn->state = BT_CONFIG;
5990
5991         /* Store current advertising instance as connection advertising instance
5992          * when sotfware rotation is in use so it can be re-enabled when
5993          * disconnected.
5994          */
5995         if (!ext_adv_capable(hdev))
5996                 conn->adv_instance = hdev->cur_adv_instance;
5997
5998         conn->le_conn_interval = interval;
5999         conn->le_conn_latency = latency;
6000         conn->le_supv_timeout = supervision_timeout;
6001
6002         hci_debugfs_create_conn(conn);
6003         hci_conn_add_sysfs(conn);
6004
6005         /* The remote features procedure is defined for central
6006          * role only. So only in case of an initiated connection
6007          * request the remote features.
6008          *
6009          * If the local controller supports peripheral-initiated features
6010          * exchange, then requesting the remote features in peripheral
6011          * role is possible. Otherwise just transition into the
6012          * connected state without requesting the remote features.
6013          */
6014         if (conn->out ||
6015             (hdev->le_features[0] & HCI_LE_PERIPHERAL_FEATURES)) {
6016                 struct hci_cp_le_read_remote_features cp;
6017
6018                 cp.handle = __cpu_to_le16(conn->handle);
6019
6020                 hci_send_cmd(hdev, HCI_OP_LE_READ_REMOTE_FEATURES,
6021                              sizeof(cp), &cp);
6022
6023                 hci_conn_hold(conn);
6024         } else {
6025                 conn->state = BT_CONNECTED;
6026                 hci_connect_cfm(conn, status);
6027         }
6028
6029         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
6030                                            conn->dst_type);
6031         if (params) {
6032                 hci_pend_le_list_del_init(params);
6033                 if (params->conn) {
6034                         hci_conn_drop(params->conn);
6035                         hci_conn_put(params->conn);
6036                         params->conn = NULL;
6037                 }
6038         }
6039
6040 unlock:
6041         hci_update_passive_scan(hdev);
6042         hci_dev_unlock(hdev);
6043 }
6044
6045 static void hci_le_conn_complete_evt(struct hci_dev *hdev, void *data,
6046                                      struct sk_buff *skb)
6047 {
6048         struct hci_ev_le_conn_complete *ev = data;
6049
6050         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
6051
6052         le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,
6053                              NULL, ev->role, le16_to_cpu(ev->handle),
6054                              le16_to_cpu(ev->interval),
6055                              le16_to_cpu(ev->latency),
6056                              le16_to_cpu(ev->supervision_timeout));
6057 }
6058
6059 static void hci_le_enh_conn_complete_evt(struct hci_dev *hdev, void *data,
6060                                          struct sk_buff *skb)
6061 {
6062         struct hci_ev_le_enh_conn_complete *ev = data;
6063
6064         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
6065
6066         le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,
6067                              &ev->local_rpa, ev->role, le16_to_cpu(ev->handle),
6068                              le16_to_cpu(ev->interval),
6069                              le16_to_cpu(ev->latency),
6070                              le16_to_cpu(ev->supervision_timeout));
6071 }
6072
6073 static void hci_le_ext_adv_term_evt(struct hci_dev *hdev, void *data,
6074                                     struct sk_buff *skb)
6075 {
6076         struct hci_evt_le_ext_adv_set_term *ev = data;
6077         struct hci_conn *conn;
6078         struct adv_info *adv, *n;
6079
6080         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
6081
6082         /* The Bluetooth Core 5.3 specification clearly states that this event
6083          * shall not be sent when the Host disables the advertising set. So in
6084          * case of HCI_ERROR_CANCELLED_BY_HOST, just ignore the event.
6085          *
6086          * When the Host disables an advertising set, all cleanup is done via
6087          * its command callback and not needed to be duplicated here.
6088          */
6089         if (ev->status == HCI_ERROR_CANCELLED_BY_HOST) {
6090                 bt_dev_warn_ratelimited(hdev, "Unexpected advertising set terminated event");
6091                 return;
6092         }
6093
6094         hci_dev_lock(hdev);
6095
6096         adv = hci_find_adv_instance(hdev, ev->handle);
6097
6098         if (ev->status) {
6099                 if (!adv)
6100                         goto unlock;
6101
6102                 /* Remove advertising as it has been terminated */
6103                 hci_remove_adv_instance(hdev, ev->handle);
6104                 mgmt_advertising_removed(NULL, hdev, ev->handle);
6105
6106                 list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) {
6107                         if (adv->enabled)
6108                                 goto unlock;
6109                 }
6110
6111                 /* We are no longer advertising, clear HCI_LE_ADV */
6112                 hci_dev_clear_flag(hdev, HCI_LE_ADV);
6113                 goto unlock;
6114         }
6115
6116         if (adv)
6117                 adv->enabled = false;
6118
6119         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->conn_handle));
6120         if (conn) {
6121                 /* Store handle in the connection so the correct advertising
6122                  * instance can be re-enabled when disconnected.
6123                  */
6124                 conn->adv_instance = ev->handle;
6125
6126                 if (hdev->adv_addr_type != ADDR_LE_DEV_RANDOM ||
6127                     bacmp(&conn->resp_addr, BDADDR_ANY))
6128                         goto unlock;
6129
6130                 if (!ev->handle) {
6131                         bacpy(&conn->resp_addr, &hdev->random_addr);
6132                         goto unlock;
6133                 }
6134
6135                 if (adv)
6136                         bacpy(&conn->resp_addr, &adv->random_addr);
6137         }
6138
6139 unlock:
6140         hci_dev_unlock(hdev);
6141 }
6142
6143 static void hci_le_conn_update_complete_evt(struct hci_dev *hdev, void *data,
6144                                             struct sk_buff *skb)
6145 {
6146         struct hci_ev_le_conn_update_complete *ev = data;
6147         struct hci_conn *conn;
6148
6149         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
6150
6151         if (ev->status)
6152                 return;
6153
6154         hci_dev_lock(hdev);
6155
6156         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
6157         if (conn) {
6158                 conn->le_conn_interval = le16_to_cpu(ev->interval);
6159                 conn->le_conn_latency = le16_to_cpu(ev->latency);
6160                 conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
6161         }
6162
6163         hci_dev_unlock(hdev);
6164 }
6165
6166 /* This function requires the caller holds hdev->lock */
6167 static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev,
6168                                               bdaddr_t *addr,
6169                                               u8 addr_type, bool addr_resolved,
6170                                               u8 adv_type)
6171 {
6172         struct hci_conn *conn;
6173         struct hci_conn_params *params;
6174
6175         /* If the event is not connectable don't proceed further */
6176         if (adv_type != LE_ADV_IND && adv_type != LE_ADV_DIRECT_IND)
6177                 return NULL;
6178
6179         /* Ignore if the device is blocked or hdev is suspended */
6180         if (hci_bdaddr_list_lookup(&hdev->reject_list, addr, addr_type) ||
6181             hdev->suspended)
6182                 return NULL;
6183
6184         /* Most controller will fail if we try to create new connections
6185          * while we have an existing one in peripheral role.
6186          */
6187         if (hdev->conn_hash.le_num_peripheral > 0 &&
6188             (!test_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks) ||
6189              !(hdev->le_states[3] & 0x10)))
6190                 return NULL;
6191
6192         /* If we're not connectable only connect devices that we have in
6193          * our pend_le_conns list.
6194          */
6195         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, addr,
6196                                            addr_type);
6197         if (!params)
6198                 return NULL;
6199
6200         if (!params->explicit_connect) {
6201                 switch (params->auto_connect) {
6202                 case HCI_AUTO_CONN_DIRECT:
6203                         /* Only devices advertising with ADV_DIRECT_IND are
6204                          * triggering a connection attempt. This is allowing
6205                          * incoming connections from peripheral devices.
6206                          */
6207                         if (adv_type != LE_ADV_DIRECT_IND)
6208                                 return NULL;
6209                         break;
6210                 case HCI_AUTO_CONN_ALWAYS:
6211                         /* Devices advertising with ADV_IND or ADV_DIRECT_IND
6212                          * are triggering a connection attempt. This means
6213                          * that incoming connections from peripheral device are
6214                          * accepted and also outgoing connections to peripheral
6215                          * devices are established when found.
6216                          */
6217                         break;
6218                 default:
6219                         return NULL;
6220                 }
6221         }
6222
6223         conn = hci_connect_le(hdev, addr, addr_type, addr_resolved,
6224                               BT_SECURITY_LOW, hdev->def_le_autoconnect_timeout,
6225                               HCI_ROLE_MASTER);
6226         if (!IS_ERR(conn)) {
6227                 /* If HCI_AUTO_CONN_EXPLICIT is set, conn is already owned
6228                  * by higher layer that tried to connect, if no then
6229                  * store the pointer since we don't really have any
6230                  * other owner of the object besides the params that
6231                  * triggered it. This way we can abort the connection if
6232                  * the parameters get removed and keep the reference
6233                  * count consistent once the connection is established.
6234                  */
6235
6236                 if (!params->explicit_connect)
6237                         params->conn = hci_conn_get(conn);
6238
6239                 return conn;
6240         }
6241
6242         switch (PTR_ERR(conn)) {
6243         case -EBUSY:
6244                 /* If hci_connect() returns -EBUSY it means there is already
6245                  * an LE connection attempt going on. Since controllers don't
6246                  * support more than one connection attempt at the time, we
6247                  * don't consider this an error case.
6248                  */
6249                 break;
6250         default:
6251                 BT_DBG("Failed to connect: err %ld", PTR_ERR(conn));
6252                 return NULL;
6253         }
6254
6255         return NULL;
6256 }
6257
6258 static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
6259                                u8 bdaddr_type, bdaddr_t *direct_addr,
6260                                u8 direct_addr_type, s8 rssi, u8 *data, u8 len,
6261                                bool ext_adv, bool ctl_time, u64 instant)
6262 {
6263         struct discovery_state *d = &hdev->discovery;
6264         struct smp_irk *irk;
6265         struct hci_conn *conn;
6266         bool match, bdaddr_resolved;
6267         u32 flags;
6268         u8 *ptr;
6269
6270         switch (type) {
6271         case LE_ADV_IND:
6272         case LE_ADV_DIRECT_IND:
6273         case LE_ADV_SCAN_IND:
6274         case LE_ADV_NONCONN_IND:
6275         case LE_ADV_SCAN_RSP:
6276                 break;
6277         default:
6278                 bt_dev_err_ratelimited(hdev, "unknown advertising packet "
6279                                        "type: 0x%02x", type);
6280                 return;
6281         }
6282
6283         if (len > max_adv_len(hdev)) {
6284                 bt_dev_err_ratelimited(hdev,
6285                                        "adv larger than maximum supported");
6286                 return;
6287         }
6288
6289         /* Find the end of the data in case the report contains padded zero
6290          * bytes at the end causing an invalid length value.
6291          *
6292          * When data is NULL, len is 0 so there is no need for extra ptr
6293          * check as 'ptr < data + 0' is already false in such case.
6294          */
6295         for (ptr = data; ptr < data + len && *ptr; ptr += *ptr + 1) {
6296                 if (ptr + 1 + *ptr > data + len)
6297                         break;
6298         }
6299
6300         /* Adjust for actual length. This handles the case when remote
6301          * device is advertising with incorrect data length.
6302          */
6303         len = ptr - data;
6304
6305         /* If the direct address is present, then this report is from
6306          * a LE Direct Advertising Report event. In that case it is
6307          * important to see if the address is matching the local
6308          * controller address.
6309          */
6310         if (!hci_dev_test_flag(hdev, HCI_MESH) && direct_addr) {
6311                 direct_addr_type = ev_bdaddr_type(hdev, direct_addr_type,
6312                                                   &bdaddr_resolved);
6313
6314                 /* Only resolvable random addresses are valid for these
6315                  * kind of reports and others can be ignored.
6316                  */
6317                 if (!hci_bdaddr_is_rpa(direct_addr, direct_addr_type))
6318                         return;
6319
6320                 /* If the controller is not using resolvable random
6321                  * addresses, then this report can be ignored.
6322                  */
6323                 if (!hci_dev_test_flag(hdev, HCI_PRIVACY))
6324                         return;
6325
6326                 /* If the local IRK of the controller does not match
6327                  * with the resolvable random address provided, then
6328                  * this report can be ignored.
6329                  */
6330                 if (!smp_irk_matches(hdev, hdev->irk, direct_addr))
6331                         return;
6332         }
6333
6334         /* Check if we need to convert to identity address */
6335         irk = hci_get_irk(hdev, bdaddr, bdaddr_type);
6336         if (irk) {
6337                 bdaddr = &irk->bdaddr;
6338                 bdaddr_type = irk->addr_type;
6339         }
6340
6341         bdaddr_type = ev_bdaddr_type(hdev, bdaddr_type, &bdaddr_resolved);
6342
6343         /* Check if we have been requested to connect to this device.
6344          *
6345          * direct_addr is set only for directed advertising reports (it is NULL
6346          * for advertising reports) and is already verified to be RPA above.
6347          */
6348         conn = check_pending_le_conn(hdev, bdaddr, bdaddr_type, bdaddr_resolved,
6349                                      type);
6350         if (!ext_adv && conn && type == LE_ADV_IND &&
6351             len <= max_adv_len(hdev)) {
6352                 /* Store report for later inclusion by
6353                  * mgmt_device_connected
6354                  */
6355                 memcpy(conn->le_adv_data, data, len);
6356                 conn->le_adv_data_len = len;
6357         }
6358
6359         if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND)
6360                 flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
6361         else
6362                 flags = 0;
6363
6364         /* All scan results should be sent up for Mesh systems */
6365         if (hci_dev_test_flag(hdev, HCI_MESH)) {
6366                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
6367                                   rssi, flags, data, len, NULL, 0, instant);
6368                 return;
6369         }
6370
6371         /* Passive scanning shouldn't trigger any device found events,
6372          * except for devices marked as CONN_REPORT for which we do send
6373          * device found events, or advertisement monitoring requested.
6374          */
6375         if (hdev->le_scan_type == LE_SCAN_PASSIVE) {
6376                 if (type == LE_ADV_DIRECT_IND)
6377                         return;
6378
6379                 if (!hci_pend_le_action_lookup(&hdev->pend_le_reports,
6380                                                bdaddr, bdaddr_type) &&
6381                     idr_is_empty(&hdev->adv_monitors_idr))
6382                         return;
6383
6384                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
6385                                   rssi, flags, data, len, NULL, 0, 0);
6386                 return;
6387         }
6388
6389         /* When receiving a scan response, then there is no way to
6390          * know if the remote device is connectable or not. However
6391          * since scan responses are merged with a previously seen
6392          * advertising report, the flags field from that report
6393          * will be used.
6394          *
6395          * In the unlikely case that a controller just sends a scan
6396          * response event that doesn't match the pending report, then
6397          * it is marked as a standalone SCAN_RSP.
6398          */
6399         if (type == LE_ADV_SCAN_RSP)
6400                 flags = MGMT_DEV_FOUND_SCAN_RSP;
6401
6402         /* If there's nothing pending either store the data from this
6403          * event or send an immediate device found event if the data
6404          * should not be stored for later.
6405          */
6406         if (!ext_adv && !has_pending_adv_report(hdev)) {
6407                 /* If the report will trigger a SCAN_REQ store it for
6408                  * later merging.
6409                  */
6410                 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
6411                         store_pending_adv_report(hdev, bdaddr, bdaddr_type,
6412                                                  rssi, flags, data, len);
6413                         return;
6414                 }
6415
6416                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
6417                                   rssi, flags, data, len, NULL, 0, 0);
6418                 return;
6419         }
6420
6421         /* Check if the pending report is for the same device as the new one */
6422         match = (!bacmp(bdaddr, &d->last_adv_addr) &&
6423                  bdaddr_type == d->last_adv_addr_type);
6424
6425         /* If the pending data doesn't match this report or this isn't a
6426          * scan response (e.g. we got a duplicate ADV_IND) then force
6427          * sending of the pending data.
6428          */
6429         if (type != LE_ADV_SCAN_RSP || !match) {
6430                 /* Send out whatever is in the cache, but skip duplicates */
6431                 if (!match)
6432                         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
6433                                           d->last_adv_addr_type, NULL,
6434                                           d->last_adv_rssi, d->last_adv_flags,
6435                                           d->last_adv_data,
6436                                           d->last_adv_data_len, NULL, 0, 0);
6437
6438                 /* If the new report will trigger a SCAN_REQ store it for
6439                  * later merging.
6440                  */
6441                 if (!ext_adv && (type == LE_ADV_IND ||
6442                                  type == LE_ADV_SCAN_IND)) {
6443                         store_pending_adv_report(hdev, bdaddr, bdaddr_type,
6444                                                  rssi, flags, data, len);
6445                         return;
6446                 }
6447
6448                 /* The advertising reports cannot be merged, so clear
6449                  * the pending report and send out a device found event.
6450                  */
6451                 clear_pending_adv_report(hdev);
6452                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
6453                                   rssi, flags, data, len, NULL, 0, 0);
6454                 return;
6455         }
6456
6457         /* If we get here we've got a pending ADV_IND or ADV_SCAN_IND and
6458          * the new event is a SCAN_RSP. We can therefore proceed with
6459          * sending a merged device found event.
6460          */
6461         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
6462                           d->last_adv_addr_type, NULL, rssi, d->last_adv_flags,
6463                           d->last_adv_data, d->last_adv_data_len, data, len, 0);
6464         clear_pending_adv_report(hdev);
6465 }
6466
6467 static void hci_le_adv_report_evt(struct hci_dev *hdev, void *data,
6468                                   struct sk_buff *skb)
6469 {
6470         struct hci_ev_le_advertising_report *ev = data;
6471         u64 instant = jiffies;
6472
6473         if (!ev->num)
6474                 return;
6475
6476         hci_dev_lock(hdev);
6477
6478         while (ev->num--) {
6479                 struct hci_ev_le_advertising_info *info;
6480                 s8 rssi;
6481
6482                 info = hci_le_ev_skb_pull(hdev, skb,
6483                                           HCI_EV_LE_ADVERTISING_REPORT,
6484                                           sizeof(*info));
6485                 if (!info)
6486                         break;
6487
6488                 if (!hci_le_ev_skb_pull(hdev, skb, HCI_EV_LE_ADVERTISING_REPORT,
6489                                         info->length + 1))
6490                         break;
6491
6492                 if (info->length <= max_adv_len(hdev)) {
6493                         rssi = info->data[info->length];
6494                         process_adv_report(hdev, info->type, &info->bdaddr,
6495                                            info->bdaddr_type, NULL, 0, rssi,
6496                                            info->data, info->length, false,
6497                                            false, instant);
6498                 } else {
6499                         bt_dev_err(hdev, "Dropping invalid advertising data");
6500                 }
6501         }
6502
6503         hci_dev_unlock(hdev);
6504 }
6505
6506 static u8 ext_evt_type_to_legacy(struct hci_dev *hdev, u16 evt_type)
6507 {
6508         if (evt_type & LE_EXT_ADV_LEGACY_PDU) {
6509                 switch (evt_type) {
6510                 case LE_LEGACY_ADV_IND:
6511                         return LE_ADV_IND;
6512                 case LE_LEGACY_ADV_DIRECT_IND:
6513                         return LE_ADV_DIRECT_IND;
6514                 case LE_LEGACY_ADV_SCAN_IND:
6515                         return LE_ADV_SCAN_IND;
6516                 case LE_LEGACY_NONCONN_IND:
6517                         return LE_ADV_NONCONN_IND;
6518                 case LE_LEGACY_SCAN_RSP_ADV:
6519                 case LE_LEGACY_SCAN_RSP_ADV_SCAN:
6520                         return LE_ADV_SCAN_RSP;
6521                 }
6522
6523                 goto invalid;
6524         }
6525
6526         if (evt_type & LE_EXT_ADV_CONN_IND) {
6527                 if (evt_type & LE_EXT_ADV_DIRECT_IND)
6528                         return LE_ADV_DIRECT_IND;
6529
6530                 return LE_ADV_IND;
6531         }
6532
6533         if (evt_type & LE_EXT_ADV_SCAN_RSP)
6534                 return LE_ADV_SCAN_RSP;
6535
6536         if (evt_type & LE_EXT_ADV_SCAN_IND)
6537                 return LE_ADV_SCAN_IND;
6538
6539         if (evt_type == LE_EXT_ADV_NON_CONN_IND ||
6540             evt_type & LE_EXT_ADV_DIRECT_IND)
6541                 return LE_ADV_NONCONN_IND;
6542
6543 invalid:
6544         bt_dev_err_ratelimited(hdev, "Unknown advertising packet type: 0x%02x",
6545                                evt_type);
6546
6547         return LE_ADV_INVALID;
6548 }
6549
6550 static void hci_le_ext_adv_report_evt(struct hci_dev *hdev, void *data,
6551                                       struct sk_buff *skb)
6552 {
6553         struct hci_ev_le_ext_adv_report *ev = data;
6554         u64 instant = jiffies;
6555
6556         if (!ev->num)
6557                 return;
6558
6559         hci_dev_lock(hdev);
6560
6561         while (ev->num--) {
6562                 struct hci_ev_le_ext_adv_info *info;
6563                 u8 legacy_evt_type;
6564                 u16 evt_type;
6565
6566                 info = hci_le_ev_skb_pull(hdev, skb, HCI_EV_LE_EXT_ADV_REPORT,
6567                                           sizeof(*info));
6568                 if (!info)
6569                         break;
6570
6571                 if (!hci_le_ev_skb_pull(hdev, skb, HCI_EV_LE_EXT_ADV_REPORT,
6572                                         info->length))
6573                         break;
6574
6575                 evt_type = __le16_to_cpu(info->type) & LE_EXT_ADV_EVT_TYPE_MASK;
6576                 legacy_evt_type = ext_evt_type_to_legacy(hdev, evt_type);
6577                 if (legacy_evt_type != LE_ADV_INVALID) {
6578                         process_adv_report(hdev, legacy_evt_type, &info->bdaddr,
6579                                            info->bdaddr_type, NULL, 0,
6580                                            info->rssi, info->data, info->length,
6581                                            !(evt_type & LE_EXT_ADV_LEGACY_PDU),
6582                                            false, instant);
6583                 }
6584         }
6585
6586         hci_dev_unlock(hdev);
6587 }
6588
6589 static int hci_le_pa_term_sync(struct hci_dev *hdev, __le16 handle)
6590 {
6591         struct hci_cp_le_pa_term_sync cp;
6592
6593         memset(&cp, 0, sizeof(cp));
6594         cp.handle = handle;
6595
6596         return hci_send_cmd(hdev, HCI_OP_LE_PA_TERM_SYNC, sizeof(cp), &cp);
6597 }
6598
6599 static void hci_le_pa_sync_estabilished_evt(struct hci_dev *hdev, void *data,
6600                                             struct sk_buff *skb)
6601 {
6602         struct hci_ev_le_pa_sync_established *ev = data;
6603         int mask = hdev->link_mode;
6604         __u8 flags = 0;
6605         struct hci_conn *bis;
6606
6607         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
6608
6609         hci_dev_lock(hdev);
6610
6611         hci_dev_clear_flag(hdev, HCI_PA_SYNC);
6612
6613         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ISO_LINK, &flags);
6614         if (!(mask & HCI_LM_ACCEPT)) {
6615                 hci_le_pa_term_sync(hdev, ev->handle);
6616                 goto unlock;
6617         }
6618
6619         if (!(flags & HCI_PROTO_DEFER))
6620                 goto unlock;
6621
6622         /* Add connection to indicate the PA sync event */
6623         bis = hci_conn_add(hdev, ISO_LINK, BDADDR_ANY,
6624                            HCI_ROLE_SLAVE);
6625
6626         if (!bis)
6627                 goto unlock;
6628
6629         if (ev->status)
6630                 set_bit(HCI_CONN_PA_SYNC_FAILED, &bis->flags);
6631         else
6632                 set_bit(HCI_CONN_PA_SYNC, &bis->flags);
6633
6634         /* Notify connection to iso layer */
6635         hci_connect_cfm(bis, ev->status);
6636
6637 unlock:
6638         hci_dev_unlock(hdev);
6639 }
6640
6641 static void hci_le_per_adv_report_evt(struct hci_dev *hdev, void *data,
6642                                       struct sk_buff *skb)
6643 {
6644         struct hci_ev_le_per_adv_report *ev = data;
6645         int mask = hdev->link_mode;
6646         __u8 flags = 0;
6647
6648         bt_dev_dbg(hdev, "sync_handle 0x%4.4x", le16_to_cpu(ev->sync_handle));
6649
6650         hci_dev_lock(hdev);
6651
6652         mask |= hci_proto_connect_ind(hdev, BDADDR_ANY, ISO_LINK, &flags);
6653         if (!(mask & HCI_LM_ACCEPT))
6654                 hci_le_pa_term_sync(hdev, ev->sync_handle);
6655
6656         hci_dev_unlock(hdev);
6657 }
6658
6659 static void hci_le_remote_feat_complete_evt(struct hci_dev *hdev, void *data,
6660                                             struct sk_buff *skb)
6661 {
6662         struct hci_ev_le_remote_feat_complete *ev = data;
6663         struct hci_conn *conn;
6664
6665         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
6666
6667         hci_dev_lock(hdev);
6668
6669         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
6670         if (conn) {
6671                 if (!ev->status)
6672                         memcpy(conn->features[0], ev->features, 8);
6673
6674                 if (conn->state == BT_CONFIG) {
6675                         __u8 status;
6676
6677                         /* If the local controller supports peripheral-initiated
6678                          * features exchange, but the remote controller does
6679                          * not, then it is possible that the error code 0x1a
6680                          * for unsupported remote feature gets returned.
6681                          *
6682                          * In this specific case, allow the connection to
6683                          * transition into connected state and mark it as
6684                          * successful.
6685                          */
6686                         if (!conn->out && ev->status == 0x1a &&
6687                             (hdev->le_features[0] & HCI_LE_PERIPHERAL_FEATURES))
6688                                 status = 0x00;
6689                         else
6690                                 status = ev->status;
6691
6692                         conn->state = BT_CONNECTED;
6693                         hci_connect_cfm(conn, status);
6694                         hci_conn_drop(conn);
6695                 }
6696         }
6697
6698         hci_dev_unlock(hdev);
6699 }
6700
6701 static void hci_le_ltk_request_evt(struct hci_dev *hdev, void *data,
6702                                    struct sk_buff *skb)
6703 {
6704         struct hci_ev_le_ltk_req *ev = data;
6705         struct hci_cp_le_ltk_reply cp;
6706         struct hci_cp_le_ltk_neg_reply neg;
6707         struct hci_conn *conn;
6708         struct smp_ltk *ltk;
6709
6710         bt_dev_dbg(hdev, "handle 0x%4.4x", __le16_to_cpu(ev->handle));
6711
6712         hci_dev_lock(hdev);
6713
6714         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
6715         if (conn == NULL)
6716                 goto not_found;
6717
6718         ltk = hci_find_ltk(hdev, &conn->dst, conn->dst_type, conn->role);
6719         if (!ltk)
6720                 goto not_found;
6721
6722         if (smp_ltk_is_sc(ltk)) {
6723                 /* With SC both EDiv and Rand are set to zero */
6724                 if (ev->ediv || ev->rand)
6725                         goto not_found;
6726         } else {
6727                 /* For non-SC keys check that EDiv and Rand match */
6728                 if (ev->ediv != ltk->ediv || ev->rand != ltk->rand)
6729                         goto not_found;
6730         }
6731
6732         memcpy(cp.ltk, ltk->val, ltk->enc_size);
6733         memset(cp.ltk + ltk->enc_size, 0, sizeof(cp.ltk) - ltk->enc_size);
6734         cp.handle = cpu_to_le16(conn->handle);
6735
6736         conn->pending_sec_level = smp_ltk_sec_level(ltk);
6737
6738         conn->enc_key_size = ltk->enc_size;
6739
6740         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
6741
6742         /* Ref. Bluetooth Core SPEC pages 1975 and 2004. STK is a
6743          * temporary key used to encrypt a connection following
6744          * pairing. It is used during the Encrypted Session Setup to
6745          * distribute the keys. Later, security can be re-established
6746          * using a distributed LTK.
6747          */
6748         if (ltk->type == SMP_STK) {
6749                 set_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
6750                 list_del_rcu(&ltk->list);
6751                 kfree_rcu(ltk, rcu);
6752         } else {
6753                 clear_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
6754         }
6755
6756         hci_dev_unlock(hdev);
6757
6758         return;
6759
6760 not_found:
6761         neg.handle = ev->handle;
6762         hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
6763         hci_dev_unlock(hdev);
6764 }
6765
6766 static void send_conn_param_neg_reply(struct hci_dev *hdev, u16 handle,
6767                                       u8 reason)
6768 {
6769         struct hci_cp_le_conn_param_req_neg_reply cp;
6770
6771         cp.handle = cpu_to_le16(handle);
6772         cp.reason = reason;
6773
6774         hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_NEG_REPLY, sizeof(cp),
6775                      &cp);
6776 }
6777
6778 static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev, void *data,
6779                                              struct sk_buff *skb)
6780 {
6781         struct hci_ev_le_remote_conn_param_req *ev = data;
6782         struct hci_cp_le_conn_param_req_reply cp;
6783         struct hci_conn *hcon;
6784         u16 handle, min, max, latency, timeout;
6785
6786         bt_dev_dbg(hdev, "handle 0x%4.4x", __le16_to_cpu(ev->handle));
6787
6788         handle = le16_to_cpu(ev->handle);
6789         min = le16_to_cpu(ev->interval_min);
6790         max = le16_to_cpu(ev->interval_max);
6791         latency = le16_to_cpu(ev->latency);
6792         timeout = le16_to_cpu(ev->timeout);
6793
6794         hcon = hci_conn_hash_lookup_handle(hdev, handle);
6795         if (!hcon || hcon->state != BT_CONNECTED)
6796                 return send_conn_param_neg_reply(hdev, handle,
6797                                                  HCI_ERROR_UNKNOWN_CONN_ID);
6798
6799         if (hci_check_conn_params(min, max, latency, timeout))
6800                 return send_conn_param_neg_reply(hdev, handle,
6801                                                  HCI_ERROR_INVALID_LL_PARAMS);
6802
6803         if (hcon->role == HCI_ROLE_MASTER) {
6804                 struct hci_conn_params *params;
6805                 u8 store_hint;
6806
6807                 hci_dev_lock(hdev);
6808
6809                 params = hci_conn_params_lookup(hdev, &hcon->dst,
6810                                                 hcon->dst_type);
6811                 if (params) {
6812                         params->conn_min_interval = min;
6813                         params->conn_max_interval = max;
6814                         params->conn_latency = latency;
6815                         params->supervision_timeout = timeout;
6816                         store_hint = 0x01;
6817                 } else {
6818                         store_hint = 0x00;
6819                 }
6820
6821                 hci_dev_unlock(hdev);
6822
6823                 mgmt_new_conn_param(hdev, &hcon->dst, hcon->dst_type,
6824                                     store_hint, min, max, latency, timeout);
6825         }
6826
6827         cp.handle = ev->handle;
6828         cp.interval_min = ev->interval_min;
6829         cp.interval_max = ev->interval_max;
6830         cp.latency = ev->latency;
6831         cp.timeout = ev->timeout;
6832         cp.min_ce_len = 0;
6833         cp.max_ce_len = 0;
6834
6835         hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_REPLY, sizeof(cp), &cp);
6836 }
6837
6838 static void hci_le_direct_adv_report_evt(struct hci_dev *hdev, void *data,
6839                                          struct sk_buff *skb)
6840 {
6841         struct hci_ev_le_direct_adv_report *ev = data;
6842         u64 instant = jiffies;
6843         int i;
6844
6845         if (!hci_le_ev_skb_pull(hdev, skb, HCI_EV_LE_DIRECT_ADV_REPORT,
6846                                 flex_array_size(ev, info, ev->num)))
6847                 return;
6848
6849         if (!ev->num)
6850                 return;
6851
6852         hci_dev_lock(hdev);
6853
6854         for (i = 0; i < ev->num; i++) {
6855                 struct hci_ev_le_direct_adv_info *info = &ev->info[i];
6856
6857                 process_adv_report(hdev, info->type, &info->bdaddr,
6858                                    info->bdaddr_type, &info->direct_addr,
6859                                    info->direct_addr_type, info->rssi, NULL, 0,
6860                                    false, false, instant);
6861         }
6862
6863         hci_dev_unlock(hdev);
6864 }
6865
6866 static void hci_le_phy_update_evt(struct hci_dev *hdev, void *data,
6867                                   struct sk_buff *skb)
6868 {
6869         struct hci_ev_le_phy_update_complete *ev = data;
6870         struct hci_conn *conn;
6871
6872         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
6873
6874         if (ev->status)
6875                 return;
6876
6877         hci_dev_lock(hdev);
6878
6879         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
6880         if (!conn)
6881                 goto unlock;
6882
6883         conn->le_tx_phy = ev->tx_phy;
6884         conn->le_rx_phy = ev->rx_phy;
6885
6886 unlock:
6887         hci_dev_unlock(hdev);
6888 }
6889
6890 static void hci_le_cis_estabilished_evt(struct hci_dev *hdev, void *data,
6891                                         struct sk_buff *skb)
6892 {
6893         struct hci_evt_le_cis_established *ev = data;
6894         struct hci_conn *conn;
6895         struct bt_iso_qos *qos;
6896         bool pending = false;
6897         u16 handle = __le16_to_cpu(ev->handle);
6898
6899         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
6900
6901         hci_dev_lock(hdev);
6902
6903         conn = hci_conn_hash_lookup_handle(hdev, handle);
6904         if (!conn) {
6905                 bt_dev_err(hdev,
6906                            "Unable to find connection with handle 0x%4.4x",
6907                            handle);
6908                 goto unlock;
6909         }
6910
6911         if (conn->type != ISO_LINK) {
6912                 bt_dev_err(hdev,
6913                            "Invalid connection link type handle 0x%4.4x",
6914                            handle);
6915                 goto unlock;
6916         }
6917
6918         qos = &conn->iso_qos;
6919
6920         pending = test_and_clear_bit(HCI_CONN_CREATE_CIS, &conn->flags);
6921
6922         /* Convert ISO Interval (1.25 ms slots) to SDU Interval (us) */
6923         qos->ucast.in.interval = le16_to_cpu(ev->interval) * 1250;
6924         qos->ucast.out.interval = qos->ucast.in.interval;
6925
6926         switch (conn->role) {
6927         case HCI_ROLE_SLAVE:
6928                 /* Convert Transport Latency (us) to Latency (msec) */
6929                 qos->ucast.in.latency =
6930                         DIV_ROUND_CLOSEST(get_unaligned_le24(ev->c_latency),
6931                                           1000);
6932                 qos->ucast.out.latency =
6933                         DIV_ROUND_CLOSEST(get_unaligned_le24(ev->p_latency),
6934                                           1000);
6935                 qos->ucast.in.sdu = le16_to_cpu(ev->c_mtu);
6936                 qos->ucast.out.sdu = le16_to_cpu(ev->p_mtu);
6937                 qos->ucast.in.phy = ev->c_phy;
6938                 qos->ucast.out.phy = ev->p_phy;
6939                 break;
6940         case HCI_ROLE_MASTER:
6941                 /* Convert Transport Latency (us) to Latency (msec) */
6942                 qos->ucast.out.latency =
6943                         DIV_ROUND_CLOSEST(get_unaligned_le24(ev->c_latency),
6944                                           1000);
6945                 qos->ucast.in.latency =
6946                         DIV_ROUND_CLOSEST(get_unaligned_le24(ev->p_latency),
6947                                           1000);
6948                 qos->ucast.out.sdu = le16_to_cpu(ev->c_mtu);
6949                 qos->ucast.in.sdu = le16_to_cpu(ev->p_mtu);
6950                 qos->ucast.out.phy = ev->c_phy;
6951                 qos->ucast.in.phy = ev->p_phy;
6952                 break;
6953         }
6954
6955         if (!ev->status) {
6956                 conn->state = BT_CONNECTED;
6957                 hci_debugfs_create_conn(conn);
6958                 hci_conn_add_sysfs(conn);
6959                 hci_iso_setup_path(conn);
6960                 goto unlock;
6961         }
6962
6963         conn->state = BT_CLOSED;
6964         hci_connect_cfm(conn, ev->status);
6965         hci_conn_del(conn);
6966
6967 unlock:
6968         if (pending)
6969                 hci_le_create_cis_pending(hdev);
6970
6971         hci_dev_unlock(hdev);
6972 }
6973
6974 static void hci_le_reject_cis(struct hci_dev *hdev, __le16 handle)
6975 {
6976         struct hci_cp_le_reject_cis cp;
6977
6978         memset(&cp, 0, sizeof(cp));
6979         cp.handle = handle;
6980         cp.reason = HCI_ERROR_REJ_BAD_ADDR;
6981         hci_send_cmd(hdev, HCI_OP_LE_REJECT_CIS, sizeof(cp), &cp);
6982 }
6983
6984 static void hci_le_accept_cis(struct hci_dev *hdev, __le16 handle)
6985 {
6986         struct hci_cp_le_accept_cis cp;
6987
6988         memset(&cp, 0, sizeof(cp));
6989         cp.handle = handle;
6990         hci_send_cmd(hdev, HCI_OP_LE_ACCEPT_CIS, sizeof(cp), &cp);
6991 }
6992
6993 static void hci_le_cis_req_evt(struct hci_dev *hdev, void *data,
6994                                struct sk_buff *skb)
6995 {
6996         struct hci_evt_le_cis_req *ev = data;
6997         u16 acl_handle, cis_handle;
6998         struct hci_conn *acl, *cis;
6999         int mask;
7000         __u8 flags = 0;
7001
7002         acl_handle = __le16_to_cpu(ev->acl_handle);
7003         cis_handle = __le16_to_cpu(ev->cis_handle);
7004
7005         bt_dev_dbg(hdev, "acl 0x%4.4x handle 0x%4.4x cig 0x%2.2x cis 0x%2.2x",
7006                    acl_handle, cis_handle, ev->cig_id, ev->cis_id);
7007
7008         hci_dev_lock(hdev);
7009
7010         acl = hci_conn_hash_lookup_handle(hdev, acl_handle);
7011         if (!acl)
7012                 goto unlock;
7013
7014         mask = hci_proto_connect_ind(hdev, &acl->dst, ISO_LINK, &flags);
7015         if (!(mask & HCI_LM_ACCEPT)) {
7016                 hci_le_reject_cis(hdev, ev->cis_handle);
7017                 goto unlock;
7018         }
7019
7020         cis = hci_conn_hash_lookup_handle(hdev, cis_handle);
7021         if (!cis) {
7022                 cis = hci_conn_add(hdev, ISO_LINK, &acl->dst, HCI_ROLE_SLAVE);
7023                 if (!cis) {
7024                         hci_le_reject_cis(hdev, ev->cis_handle);
7025                         goto unlock;
7026                 }
7027                 cis->handle = cis_handle;
7028         }
7029
7030         cis->iso_qos.ucast.cig = ev->cig_id;
7031         cis->iso_qos.ucast.cis = ev->cis_id;
7032
7033         if (!(flags & HCI_PROTO_DEFER)) {
7034                 hci_le_accept_cis(hdev, ev->cis_handle);
7035         } else {
7036                 cis->state = BT_CONNECT2;
7037                 hci_connect_cfm(cis, 0);
7038         }
7039
7040 unlock:
7041         hci_dev_unlock(hdev);
7042 }
7043
7044 static int hci_iso_term_big_sync(struct hci_dev *hdev, void *data)
7045 {
7046         u8 handle = PTR_UINT(data);
7047
7048         return hci_le_terminate_big_sync(hdev, handle,
7049                                          HCI_ERROR_LOCAL_HOST_TERM);
7050 }
7051
7052 static void hci_le_create_big_complete_evt(struct hci_dev *hdev, void *data,
7053                                            struct sk_buff *skb)
7054 {
7055         struct hci_evt_le_create_big_complete *ev = data;
7056         struct hci_conn *conn;
7057         __u8 i = 0;
7058
7059         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
7060
7061         if (!hci_le_ev_skb_pull(hdev, skb, HCI_EVT_LE_CREATE_BIG_COMPLETE,
7062                                 flex_array_size(ev, bis_handle, ev->num_bis)))
7063                 return;
7064
7065         hci_dev_lock(hdev);
7066         rcu_read_lock();
7067
7068         /* Connect all BISes that are bound to the BIG */
7069         list_for_each_entry_rcu(conn, &hdev->conn_hash.list, list) {
7070                 if (bacmp(&conn->dst, BDADDR_ANY) ||
7071                     conn->type != ISO_LINK ||
7072                     conn->iso_qos.bcast.big != ev->handle)
7073                         continue;
7074
7075                 if (hci_conn_set_handle(conn,
7076                                         __le16_to_cpu(ev->bis_handle[i++])))
7077                         continue;
7078
7079                 if (!ev->status) {
7080                         conn->state = BT_CONNECTED;
7081                         set_bit(HCI_CONN_BIG_CREATED, &conn->flags);
7082                         rcu_read_unlock();
7083                         hci_debugfs_create_conn(conn);
7084                         hci_conn_add_sysfs(conn);
7085                         hci_iso_setup_path(conn);
7086                         rcu_read_lock();
7087                         continue;
7088                 }
7089
7090                 hci_connect_cfm(conn, ev->status);
7091                 rcu_read_unlock();
7092                 hci_conn_del(conn);
7093                 rcu_read_lock();
7094         }
7095
7096         rcu_read_unlock();
7097
7098         if (!ev->status && !i)
7099                 /* If no BISes have been connected for the BIG,
7100                  * terminate. This is in case all bound connections
7101                  * have been closed before the BIG creation
7102                  * has completed.
7103                  */
7104                 hci_cmd_sync_queue(hdev, hci_iso_term_big_sync,
7105                                    UINT_PTR(ev->handle), NULL);
7106
7107         hci_dev_unlock(hdev);
7108 }
7109
7110 static void hci_le_big_sync_established_evt(struct hci_dev *hdev, void *data,
7111                                             struct sk_buff *skb)
7112 {
7113         struct hci_evt_le_big_sync_estabilished *ev = data;
7114         struct hci_conn *bis;
7115         struct hci_conn *pa_sync;
7116         int i;
7117
7118         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
7119
7120         if (!hci_le_ev_skb_pull(hdev, skb, HCI_EVT_LE_BIG_SYNC_ESTABILISHED,
7121                                 flex_array_size(ev, bis, ev->num_bis)))
7122                 return;
7123
7124         hci_dev_lock(hdev);
7125
7126         if (!ev->status) {
7127                 pa_sync = hci_conn_hash_lookup_pa_sync(hdev, ev->handle);
7128                 if (pa_sync)
7129                         /* Also mark the BIG sync established event on the
7130                          * associated PA sync hcon
7131                          */
7132                         set_bit(HCI_CONN_BIG_SYNC, &pa_sync->flags);
7133         }
7134
7135         for (i = 0; i < ev->num_bis; i++) {
7136                 u16 handle = le16_to_cpu(ev->bis[i]);
7137                 __le32 interval;
7138
7139                 bis = hci_conn_hash_lookup_handle(hdev, handle);
7140                 if (!bis) {
7141                         bis = hci_conn_add(hdev, ISO_LINK, BDADDR_ANY,
7142                                            HCI_ROLE_SLAVE);
7143                         if (!bis)
7144                                 continue;
7145                         bis->handle = handle;
7146                 }
7147
7148                 if (ev->status != 0x42)
7149                         /* Mark PA sync as established */
7150                         set_bit(HCI_CONN_PA_SYNC, &bis->flags);
7151
7152                 bis->iso_qos.bcast.big = ev->handle;
7153                 memset(&interval, 0, sizeof(interval));
7154                 memcpy(&interval, ev->latency, sizeof(ev->latency));
7155                 bis->iso_qos.bcast.in.interval = le32_to_cpu(interval);
7156                 /* Convert ISO Interval (1.25 ms slots) to latency (ms) */
7157                 bis->iso_qos.bcast.in.latency = le16_to_cpu(ev->interval) * 125 / 100;
7158                 bis->iso_qos.bcast.in.sdu = le16_to_cpu(ev->max_pdu);
7159
7160                 if (!ev->status) {
7161                         set_bit(HCI_CONN_BIG_SYNC, &bis->flags);
7162                         hci_iso_setup_path(bis);
7163                 }
7164         }
7165
7166         /* In case BIG sync failed, notify each failed connection to
7167          * the user after all hci connections have been added
7168          */
7169         if (ev->status)
7170                 for (i = 0; i < ev->num_bis; i++) {
7171                         u16 handle = le16_to_cpu(ev->bis[i]);
7172
7173                         bis = hci_conn_hash_lookup_handle(hdev, handle);
7174
7175                         set_bit(HCI_CONN_BIG_SYNC_FAILED, &bis->flags);
7176                         hci_connect_cfm(bis, ev->status);
7177                 }
7178
7179         hci_dev_unlock(hdev);
7180 }
7181
7182 static void hci_le_big_info_adv_report_evt(struct hci_dev *hdev, void *data,
7183                                            struct sk_buff *skb)
7184 {
7185         struct hci_evt_le_big_info_adv_report *ev = data;
7186         int mask = hdev->link_mode;
7187         __u8 flags = 0;
7188
7189         bt_dev_dbg(hdev, "sync_handle 0x%4.4x", le16_to_cpu(ev->sync_handle));
7190
7191         hci_dev_lock(hdev);
7192
7193         mask |= hci_proto_connect_ind(hdev, BDADDR_ANY, ISO_LINK, &flags);
7194         if (!(mask & HCI_LM_ACCEPT))
7195                 hci_le_pa_term_sync(hdev, ev->sync_handle);
7196
7197         hci_dev_unlock(hdev);
7198 }
7199
7200 #define HCI_LE_EV_VL(_op, _func, _min_len, _max_len) \
7201 [_op] = { \
7202         .func = _func, \
7203         .min_len = _min_len, \
7204         .max_len = _max_len, \
7205 }
7206
7207 #define HCI_LE_EV(_op, _func, _len) \
7208         HCI_LE_EV_VL(_op, _func, _len, _len)
7209
7210 #define HCI_LE_EV_STATUS(_op, _func) \
7211         HCI_LE_EV(_op, _func, sizeof(struct hci_ev_status))
7212
7213 /* Entries in this table shall have their position according to the subevent
7214  * opcode they handle so the use of the macros above is recommend since it does
7215  * attempt to initialize at its proper index using Designated Initializers that
7216  * way events without a callback function can be ommited.
7217  */
7218 static const struct hci_le_ev {
7219         void (*func)(struct hci_dev *hdev, void *data, struct sk_buff *skb);
7220         u16  min_len;
7221         u16  max_len;
7222 } hci_le_ev_table[U8_MAX + 1] = {
7223         /* [0x01 = HCI_EV_LE_CONN_COMPLETE] */
7224         HCI_LE_EV(HCI_EV_LE_CONN_COMPLETE, hci_le_conn_complete_evt,
7225                   sizeof(struct hci_ev_le_conn_complete)),
7226         /* [0x02 = HCI_EV_LE_ADVERTISING_REPORT] */
7227         HCI_LE_EV_VL(HCI_EV_LE_ADVERTISING_REPORT, hci_le_adv_report_evt,
7228                      sizeof(struct hci_ev_le_advertising_report),
7229                      HCI_MAX_EVENT_SIZE),
7230         /* [0x03 = HCI_EV_LE_CONN_UPDATE_COMPLETE] */
7231         HCI_LE_EV(HCI_EV_LE_CONN_UPDATE_COMPLETE,
7232                   hci_le_conn_update_complete_evt,
7233                   sizeof(struct hci_ev_le_conn_update_complete)),
7234         /* [0x04 = HCI_EV_LE_REMOTE_FEAT_COMPLETE] */
7235         HCI_LE_EV(HCI_EV_LE_REMOTE_FEAT_COMPLETE,
7236                   hci_le_remote_feat_complete_evt,
7237                   sizeof(struct hci_ev_le_remote_feat_complete)),
7238         /* [0x05 = HCI_EV_LE_LTK_REQ] */
7239         HCI_LE_EV(HCI_EV_LE_LTK_REQ, hci_le_ltk_request_evt,
7240                   sizeof(struct hci_ev_le_ltk_req)),
7241         /* [0x06 = HCI_EV_LE_REMOTE_CONN_PARAM_REQ] */
7242         HCI_LE_EV(HCI_EV_LE_REMOTE_CONN_PARAM_REQ,
7243                   hci_le_remote_conn_param_req_evt,
7244                   sizeof(struct hci_ev_le_remote_conn_param_req)),
7245         /* [0x0a = HCI_EV_LE_ENHANCED_CONN_COMPLETE] */
7246         HCI_LE_EV(HCI_EV_LE_ENHANCED_CONN_COMPLETE,
7247                   hci_le_enh_conn_complete_evt,
7248                   sizeof(struct hci_ev_le_enh_conn_complete)),
7249         /* [0x0b = HCI_EV_LE_DIRECT_ADV_REPORT] */
7250         HCI_LE_EV_VL(HCI_EV_LE_DIRECT_ADV_REPORT, hci_le_direct_adv_report_evt,
7251                      sizeof(struct hci_ev_le_direct_adv_report),
7252                      HCI_MAX_EVENT_SIZE),
7253         /* [0x0c = HCI_EV_LE_PHY_UPDATE_COMPLETE] */
7254         HCI_LE_EV(HCI_EV_LE_PHY_UPDATE_COMPLETE, hci_le_phy_update_evt,
7255                   sizeof(struct hci_ev_le_phy_update_complete)),
7256         /* [0x0d = HCI_EV_LE_EXT_ADV_REPORT] */
7257         HCI_LE_EV_VL(HCI_EV_LE_EXT_ADV_REPORT, hci_le_ext_adv_report_evt,
7258                      sizeof(struct hci_ev_le_ext_adv_report),
7259                      HCI_MAX_EVENT_SIZE),
7260         /* [0x0e = HCI_EV_LE_PA_SYNC_ESTABLISHED] */
7261         HCI_LE_EV(HCI_EV_LE_PA_SYNC_ESTABLISHED,
7262                   hci_le_pa_sync_estabilished_evt,
7263                   sizeof(struct hci_ev_le_pa_sync_established)),
7264         /* [0x0f = HCI_EV_LE_PER_ADV_REPORT] */
7265         HCI_LE_EV_VL(HCI_EV_LE_PER_ADV_REPORT,
7266                                  hci_le_per_adv_report_evt,
7267                                  sizeof(struct hci_ev_le_per_adv_report),
7268                                  HCI_MAX_EVENT_SIZE),
7269         /* [0x12 = HCI_EV_LE_EXT_ADV_SET_TERM] */
7270         HCI_LE_EV(HCI_EV_LE_EXT_ADV_SET_TERM, hci_le_ext_adv_term_evt,
7271                   sizeof(struct hci_evt_le_ext_adv_set_term)),
7272         /* [0x19 = HCI_EVT_LE_CIS_ESTABLISHED] */
7273         HCI_LE_EV(HCI_EVT_LE_CIS_ESTABLISHED, hci_le_cis_estabilished_evt,
7274                   sizeof(struct hci_evt_le_cis_established)),
7275         /* [0x1a = HCI_EVT_LE_CIS_REQ] */
7276         HCI_LE_EV(HCI_EVT_LE_CIS_REQ, hci_le_cis_req_evt,
7277                   sizeof(struct hci_evt_le_cis_req)),
7278         /* [0x1b = HCI_EVT_LE_CREATE_BIG_COMPLETE] */
7279         HCI_LE_EV_VL(HCI_EVT_LE_CREATE_BIG_COMPLETE,
7280                      hci_le_create_big_complete_evt,
7281                      sizeof(struct hci_evt_le_create_big_complete),
7282                      HCI_MAX_EVENT_SIZE),
7283         /* [0x1d = HCI_EV_LE_BIG_SYNC_ESTABILISHED] */
7284         HCI_LE_EV_VL(HCI_EVT_LE_BIG_SYNC_ESTABILISHED,
7285                      hci_le_big_sync_established_evt,
7286                      sizeof(struct hci_evt_le_big_sync_estabilished),
7287                      HCI_MAX_EVENT_SIZE),
7288         /* [0x22 = HCI_EVT_LE_BIG_INFO_ADV_REPORT] */
7289         HCI_LE_EV_VL(HCI_EVT_LE_BIG_INFO_ADV_REPORT,
7290                      hci_le_big_info_adv_report_evt,
7291                      sizeof(struct hci_evt_le_big_info_adv_report),
7292                      HCI_MAX_EVENT_SIZE),
7293 };
7294
7295 static void hci_le_meta_evt(struct hci_dev *hdev, void *data,
7296                             struct sk_buff *skb, u16 *opcode, u8 *status,
7297                             hci_req_complete_t *req_complete,
7298                             hci_req_complete_skb_t *req_complete_skb)
7299 {
7300         struct hci_ev_le_meta *ev = data;
7301         const struct hci_le_ev *subev;
7302
7303         bt_dev_dbg(hdev, "subevent 0x%2.2x", ev->subevent);
7304
7305         /* Only match event if command OGF is for LE */
7306         if (hdev->sent_cmd &&
7307             hci_opcode_ogf(hci_skb_opcode(hdev->sent_cmd)) == 0x08 &&
7308             hci_skb_event(hdev->sent_cmd) == ev->subevent) {
7309                 *opcode = hci_skb_opcode(hdev->sent_cmd);
7310                 hci_req_cmd_complete(hdev, *opcode, 0x00, req_complete,
7311                                      req_complete_skb);
7312         }
7313
7314         subev = &hci_le_ev_table[ev->subevent];
7315         if (!subev->func)
7316                 return;
7317
7318         if (skb->len < subev->min_len) {
7319                 bt_dev_err(hdev, "unexpected subevent 0x%2.2x length: %u < %u",
7320                            ev->subevent, skb->len, subev->min_len);
7321                 return;
7322         }
7323
7324         /* Just warn if the length is over max_len size it still be
7325          * possible to partially parse the event so leave to callback to
7326          * decide if that is acceptable.
7327          */
7328         if (skb->len > subev->max_len)
7329                 bt_dev_warn(hdev, "unexpected subevent 0x%2.2x length: %u > %u",
7330                             ev->subevent, skb->len, subev->max_len);
7331         data = hci_le_ev_skb_pull(hdev, skb, ev->subevent, subev->min_len);
7332         if (!data)
7333                 return;
7334
7335         subev->func(hdev, data, skb);
7336 }
7337
7338 static bool hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode,
7339                                  u8 event, struct sk_buff *skb)
7340 {
7341         struct hci_ev_cmd_complete *ev;
7342         struct hci_event_hdr *hdr;
7343
7344         if (!skb)
7345                 return false;
7346
7347         hdr = hci_ev_skb_pull(hdev, skb, event, sizeof(*hdr));
7348         if (!hdr)
7349                 return false;
7350
7351         if (event) {
7352                 if (hdr->evt != event)
7353                         return false;
7354                 return true;
7355         }
7356
7357         /* Check if request ended in Command Status - no way to retrieve
7358          * any extra parameters in this case.
7359          */
7360         if (hdr->evt == HCI_EV_CMD_STATUS)
7361                 return false;
7362
7363         if (hdr->evt != HCI_EV_CMD_COMPLETE) {
7364                 bt_dev_err(hdev, "last event is not cmd complete (0x%2.2x)",
7365                            hdr->evt);
7366                 return false;
7367         }
7368
7369         ev = hci_cc_skb_pull(hdev, skb, opcode, sizeof(*ev));
7370         if (!ev)
7371                 return false;
7372
7373         if (opcode != __le16_to_cpu(ev->opcode)) {
7374                 BT_DBG("opcode doesn't match (0x%2.2x != 0x%2.2x)", opcode,
7375                        __le16_to_cpu(ev->opcode));
7376                 return false;
7377         }
7378
7379         return true;
7380 }
7381
7382 static void hci_store_wake_reason(struct hci_dev *hdev, u8 event,
7383                                   struct sk_buff *skb)
7384 {
7385         struct hci_ev_le_advertising_info *adv;
7386         struct hci_ev_le_direct_adv_info *direct_adv;
7387         struct hci_ev_le_ext_adv_info *ext_adv;
7388         const struct hci_ev_conn_complete *conn_complete = (void *)skb->data;
7389         const struct hci_ev_conn_request *conn_request = (void *)skb->data;
7390
7391         hci_dev_lock(hdev);
7392
7393         /* If we are currently suspended and this is the first BT event seen,
7394          * save the wake reason associated with the event.
7395          */
7396         if (!hdev->suspended || hdev->wake_reason)
7397                 goto unlock;
7398
7399         /* Default to remote wake. Values for wake_reason are documented in the
7400          * Bluez mgmt api docs.
7401          */
7402         hdev->wake_reason = MGMT_WAKE_REASON_REMOTE_WAKE;
7403
7404         /* Once configured for remote wakeup, we should only wake up for
7405          * reconnections. It's useful to see which device is waking us up so
7406          * keep track of the bdaddr of the connection event that woke us up.
7407          */
7408         if (event == HCI_EV_CONN_REQUEST) {
7409                 bacpy(&hdev->wake_addr, &conn_complete->bdaddr);
7410                 hdev->wake_addr_type = BDADDR_BREDR;
7411         } else if (event == HCI_EV_CONN_COMPLETE) {
7412                 bacpy(&hdev->wake_addr, &conn_request->bdaddr);
7413                 hdev->wake_addr_type = BDADDR_BREDR;
7414         } else if (event == HCI_EV_LE_META) {
7415                 struct hci_ev_le_meta *le_ev = (void *)skb->data;
7416                 u8 subevent = le_ev->subevent;
7417                 u8 *ptr = &skb->data[sizeof(*le_ev)];
7418                 u8 num_reports = *ptr;
7419
7420                 if ((subevent == HCI_EV_LE_ADVERTISING_REPORT ||
7421                      subevent == HCI_EV_LE_DIRECT_ADV_REPORT ||
7422                      subevent == HCI_EV_LE_EXT_ADV_REPORT) &&
7423                     num_reports) {
7424                         adv = (void *)(ptr + 1);
7425                         direct_adv = (void *)(ptr + 1);
7426                         ext_adv = (void *)(ptr + 1);
7427
7428                         switch (subevent) {
7429                         case HCI_EV_LE_ADVERTISING_REPORT:
7430                                 bacpy(&hdev->wake_addr, &adv->bdaddr);
7431                                 hdev->wake_addr_type = adv->bdaddr_type;
7432                                 break;
7433                         case HCI_EV_LE_DIRECT_ADV_REPORT:
7434                                 bacpy(&hdev->wake_addr, &direct_adv->bdaddr);
7435                                 hdev->wake_addr_type = direct_adv->bdaddr_type;
7436                                 break;
7437                         case HCI_EV_LE_EXT_ADV_REPORT:
7438                                 bacpy(&hdev->wake_addr, &ext_adv->bdaddr);
7439                                 hdev->wake_addr_type = ext_adv->bdaddr_type;
7440                                 break;
7441                         }
7442                 }
7443         } else {
7444                 hdev->wake_reason = MGMT_WAKE_REASON_UNEXPECTED;
7445         }
7446
7447 unlock:
7448         hci_dev_unlock(hdev);
7449 }
7450
7451 #define HCI_EV_VL(_op, _func, _min_len, _max_len) \
7452 [_op] = { \
7453         .req = false, \
7454         .func = _func, \
7455         .min_len = _min_len, \
7456         .max_len = _max_len, \
7457 }
7458
7459 #define HCI_EV(_op, _func, _len) \
7460         HCI_EV_VL(_op, _func, _len, _len)
7461
7462 #define HCI_EV_STATUS(_op, _func) \
7463         HCI_EV(_op, _func, sizeof(struct hci_ev_status))
7464
7465 #define HCI_EV_REQ_VL(_op, _func, _min_len, _max_len) \
7466 [_op] = { \
7467         .req = true, \
7468         .func_req = _func, \
7469         .min_len = _min_len, \
7470         .max_len = _max_len, \
7471 }
7472
7473 #define HCI_EV_REQ(_op, _func, _len) \
7474         HCI_EV_REQ_VL(_op, _func, _len, _len)
7475
7476 /* Entries in this table shall have their position according to the event opcode
7477  * they handle so the use of the macros above is recommend since it does attempt
7478  * to initialize at its proper index using Designated Initializers that way
7479  * events without a callback function don't have entered.
7480  */
7481 static const struct hci_ev {
7482         bool req;
7483         union {
7484                 void (*func)(struct hci_dev *hdev, void *data,
7485                              struct sk_buff *skb);
7486                 void (*func_req)(struct hci_dev *hdev, void *data,
7487                                  struct sk_buff *skb, u16 *opcode, u8 *status,
7488                                  hci_req_complete_t *req_complete,
7489                                  hci_req_complete_skb_t *req_complete_skb);
7490         };
7491         u16  min_len;
7492         u16  max_len;
7493 } hci_ev_table[U8_MAX + 1] = {
7494         /* [0x01 = HCI_EV_INQUIRY_COMPLETE] */
7495         HCI_EV_STATUS(HCI_EV_INQUIRY_COMPLETE, hci_inquiry_complete_evt),
7496         /* [0x02 = HCI_EV_INQUIRY_RESULT] */
7497         HCI_EV_VL(HCI_EV_INQUIRY_RESULT, hci_inquiry_result_evt,
7498                   sizeof(struct hci_ev_inquiry_result), HCI_MAX_EVENT_SIZE),
7499         /* [0x03 = HCI_EV_CONN_COMPLETE] */
7500         HCI_EV(HCI_EV_CONN_COMPLETE, hci_conn_complete_evt,
7501                sizeof(struct hci_ev_conn_complete)),
7502         /* [0x04 = HCI_EV_CONN_REQUEST] */
7503         HCI_EV(HCI_EV_CONN_REQUEST, hci_conn_request_evt,
7504                sizeof(struct hci_ev_conn_request)),
7505         /* [0x05 = HCI_EV_DISCONN_COMPLETE] */
7506         HCI_EV(HCI_EV_DISCONN_COMPLETE, hci_disconn_complete_evt,
7507                sizeof(struct hci_ev_disconn_complete)),
7508         /* [0x06 = HCI_EV_AUTH_COMPLETE] */
7509         HCI_EV(HCI_EV_AUTH_COMPLETE, hci_auth_complete_evt,
7510                sizeof(struct hci_ev_auth_complete)),
7511         /* [0x07 = HCI_EV_REMOTE_NAME] */
7512         HCI_EV(HCI_EV_REMOTE_NAME, hci_remote_name_evt,
7513                sizeof(struct hci_ev_remote_name)),
7514         /* [0x08 = HCI_EV_ENCRYPT_CHANGE] */
7515         HCI_EV(HCI_EV_ENCRYPT_CHANGE, hci_encrypt_change_evt,
7516                sizeof(struct hci_ev_encrypt_change)),
7517         /* [0x09 = HCI_EV_CHANGE_LINK_KEY_COMPLETE] */
7518         HCI_EV(HCI_EV_CHANGE_LINK_KEY_COMPLETE,
7519                hci_change_link_key_complete_evt,
7520                sizeof(struct hci_ev_change_link_key_complete)),
7521         /* [0x0b = HCI_EV_REMOTE_FEATURES] */
7522         HCI_EV(HCI_EV_REMOTE_FEATURES, hci_remote_features_evt,
7523                sizeof(struct hci_ev_remote_features)),
7524         /* [0x0e = HCI_EV_CMD_COMPLETE] */
7525         HCI_EV_REQ_VL(HCI_EV_CMD_COMPLETE, hci_cmd_complete_evt,
7526                       sizeof(struct hci_ev_cmd_complete), HCI_MAX_EVENT_SIZE),
7527         /* [0x0f = HCI_EV_CMD_STATUS] */
7528         HCI_EV_REQ(HCI_EV_CMD_STATUS, hci_cmd_status_evt,
7529                    sizeof(struct hci_ev_cmd_status)),
7530         /* [0x10 = HCI_EV_CMD_STATUS] */
7531         HCI_EV(HCI_EV_HARDWARE_ERROR, hci_hardware_error_evt,
7532                sizeof(struct hci_ev_hardware_error)),
7533         /* [0x12 = HCI_EV_ROLE_CHANGE] */
7534         HCI_EV(HCI_EV_ROLE_CHANGE, hci_role_change_evt,
7535                sizeof(struct hci_ev_role_change)),
7536         /* [0x13 = HCI_EV_NUM_COMP_PKTS] */
7537         HCI_EV_VL(HCI_EV_NUM_COMP_PKTS, hci_num_comp_pkts_evt,
7538                   sizeof(struct hci_ev_num_comp_pkts), HCI_MAX_EVENT_SIZE),
7539         /* [0x14 = HCI_EV_MODE_CHANGE] */
7540         HCI_EV(HCI_EV_MODE_CHANGE, hci_mode_change_evt,
7541                sizeof(struct hci_ev_mode_change)),
7542         /* [0x16 = HCI_EV_PIN_CODE_REQ] */
7543         HCI_EV(HCI_EV_PIN_CODE_REQ, hci_pin_code_request_evt,
7544                sizeof(struct hci_ev_pin_code_req)),
7545         /* [0x17 = HCI_EV_LINK_KEY_REQ] */
7546         HCI_EV(HCI_EV_LINK_KEY_REQ, hci_link_key_request_evt,
7547                sizeof(struct hci_ev_link_key_req)),
7548         /* [0x18 = HCI_EV_LINK_KEY_NOTIFY] */
7549         HCI_EV(HCI_EV_LINK_KEY_NOTIFY, hci_link_key_notify_evt,
7550                sizeof(struct hci_ev_link_key_notify)),
7551         /* [0x1c = HCI_EV_CLOCK_OFFSET] */
7552         HCI_EV(HCI_EV_CLOCK_OFFSET, hci_clock_offset_evt,
7553                sizeof(struct hci_ev_clock_offset)),
7554         /* [0x1d = HCI_EV_PKT_TYPE_CHANGE] */
7555         HCI_EV(HCI_EV_PKT_TYPE_CHANGE, hci_pkt_type_change_evt,
7556                sizeof(struct hci_ev_pkt_type_change)),
7557         /* [0x20 = HCI_EV_PSCAN_REP_MODE] */
7558         HCI_EV(HCI_EV_PSCAN_REP_MODE, hci_pscan_rep_mode_evt,
7559                sizeof(struct hci_ev_pscan_rep_mode)),
7560         /* [0x22 = HCI_EV_INQUIRY_RESULT_WITH_RSSI] */
7561         HCI_EV_VL(HCI_EV_INQUIRY_RESULT_WITH_RSSI,
7562                   hci_inquiry_result_with_rssi_evt,
7563                   sizeof(struct hci_ev_inquiry_result_rssi),
7564                   HCI_MAX_EVENT_SIZE),
7565         /* [0x23 = HCI_EV_REMOTE_EXT_FEATURES] */
7566         HCI_EV(HCI_EV_REMOTE_EXT_FEATURES, hci_remote_ext_features_evt,
7567                sizeof(struct hci_ev_remote_ext_features)),
7568         /* [0x2c = HCI_EV_SYNC_CONN_COMPLETE] */
7569         HCI_EV(HCI_EV_SYNC_CONN_COMPLETE, hci_sync_conn_complete_evt,
7570                sizeof(struct hci_ev_sync_conn_complete)),
7571         /* [0x2d = HCI_EV_EXTENDED_INQUIRY_RESULT] */
7572         HCI_EV_VL(HCI_EV_EXTENDED_INQUIRY_RESULT,
7573                   hci_extended_inquiry_result_evt,
7574                   sizeof(struct hci_ev_ext_inquiry_result), HCI_MAX_EVENT_SIZE),
7575         /* [0x30 = HCI_EV_KEY_REFRESH_COMPLETE] */
7576         HCI_EV(HCI_EV_KEY_REFRESH_COMPLETE, hci_key_refresh_complete_evt,
7577                sizeof(struct hci_ev_key_refresh_complete)),
7578         /* [0x31 = HCI_EV_IO_CAPA_REQUEST] */
7579         HCI_EV(HCI_EV_IO_CAPA_REQUEST, hci_io_capa_request_evt,
7580                sizeof(struct hci_ev_io_capa_request)),
7581         /* [0x32 = HCI_EV_IO_CAPA_REPLY] */
7582         HCI_EV(HCI_EV_IO_CAPA_REPLY, hci_io_capa_reply_evt,
7583                sizeof(struct hci_ev_io_capa_reply)),
7584         /* [0x33 = HCI_EV_USER_CONFIRM_REQUEST] */
7585         HCI_EV(HCI_EV_USER_CONFIRM_REQUEST, hci_user_confirm_request_evt,
7586                sizeof(struct hci_ev_user_confirm_req)),
7587         /* [0x34 = HCI_EV_USER_PASSKEY_REQUEST] */
7588         HCI_EV(HCI_EV_USER_PASSKEY_REQUEST, hci_user_passkey_request_evt,
7589                sizeof(struct hci_ev_user_passkey_req)),
7590         /* [0x35 = HCI_EV_REMOTE_OOB_DATA_REQUEST] */
7591         HCI_EV(HCI_EV_REMOTE_OOB_DATA_REQUEST, hci_remote_oob_data_request_evt,
7592                sizeof(struct hci_ev_remote_oob_data_request)),
7593         /* [0x36 = HCI_EV_SIMPLE_PAIR_COMPLETE] */
7594         HCI_EV(HCI_EV_SIMPLE_PAIR_COMPLETE, hci_simple_pair_complete_evt,
7595                sizeof(struct hci_ev_simple_pair_complete)),
7596         /* [0x3b = HCI_EV_USER_PASSKEY_NOTIFY] */
7597         HCI_EV(HCI_EV_USER_PASSKEY_NOTIFY, hci_user_passkey_notify_evt,
7598                sizeof(struct hci_ev_user_passkey_notify)),
7599         /* [0x3c = HCI_EV_KEYPRESS_NOTIFY] */
7600         HCI_EV(HCI_EV_KEYPRESS_NOTIFY, hci_keypress_notify_evt,
7601                sizeof(struct hci_ev_keypress_notify)),
7602         /* [0x3d = HCI_EV_REMOTE_HOST_FEATURES] */
7603         HCI_EV(HCI_EV_REMOTE_HOST_FEATURES, hci_remote_host_features_evt,
7604                sizeof(struct hci_ev_remote_host_features)),
7605         /* [0x3e = HCI_EV_LE_META] */
7606         HCI_EV_REQ_VL(HCI_EV_LE_META, hci_le_meta_evt,
7607                       sizeof(struct hci_ev_le_meta), HCI_MAX_EVENT_SIZE),
7608 #if IS_ENABLED(CONFIG_BT_HS)
7609         /* [0x40 = HCI_EV_PHY_LINK_COMPLETE] */
7610         HCI_EV(HCI_EV_PHY_LINK_COMPLETE, hci_phy_link_complete_evt,
7611                sizeof(struct hci_ev_phy_link_complete)),
7612         /* [0x41 = HCI_EV_CHANNEL_SELECTED] */
7613         HCI_EV(HCI_EV_CHANNEL_SELECTED, hci_chan_selected_evt,
7614                sizeof(struct hci_ev_channel_selected)),
7615         /* [0x42 = HCI_EV_DISCONN_PHY_LINK_COMPLETE] */
7616         HCI_EV(HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE,
7617                hci_disconn_loglink_complete_evt,
7618                sizeof(struct hci_ev_disconn_logical_link_complete)),
7619         /* [0x45 = HCI_EV_LOGICAL_LINK_COMPLETE] */
7620         HCI_EV(HCI_EV_LOGICAL_LINK_COMPLETE, hci_loglink_complete_evt,
7621                sizeof(struct hci_ev_logical_link_complete)),
7622         /* [0x46 = HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE] */
7623         HCI_EV(HCI_EV_DISCONN_PHY_LINK_COMPLETE,
7624                hci_disconn_phylink_complete_evt,
7625                sizeof(struct hci_ev_disconn_phy_link_complete)),
7626 #endif
7627         /* [0x48 = HCI_EV_NUM_COMP_BLOCKS] */
7628         HCI_EV(HCI_EV_NUM_COMP_BLOCKS, hci_num_comp_blocks_evt,
7629                sizeof(struct hci_ev_num_comp_blocks)),
7630         /* [0xff = HCI_EV_VENDOR] */
7631         HCI_EV_VL(HCI_EV_VENDOR, msft_vendor_evt, 0, HCI_MAX_EVENT_SIZE),
7632 };
7633
7634 static void hci_event_func(struct hci_dev *hdev, u8 event, struct sk_buff *skb,
7635                            u16 *opcode, u8 *status,
7636                            hci_req_complete_t *req_complete,
7637                            hci_req_complete_skb_t *req_complete_skb)
7638 {
7639         const struct hci_ev *ev = &hci_ev_table[event];
7640         void *data;
7641
7642         if (!ev->func)
7643                 return;
7644
7645         if (skb->len < ev->min_len) {
7646                 bt_dev_err(hdev, "unexpected event 0x%2.2x length: %u < %u",
7647                            event, skb->len, ev->min_len);
7648                 return;
7649         }
7650
7651         /* Just warn if the length is over max_len size it still be
7652          * possible to partially parse the event so leave to callback to
7653          * decide if that is acceptable.
7654          */
7655         if (skb->len > ev->max_len)
7656                 bt_dev_warn_ratelimited(hdev,
7657                                         "unexpected event 0x%2.2x length: %u > %u",
7658                                         event, skb->len, ev->max_len);
7659
7660         data = hci_ev_skb_pull(hdev, skb, event, ev->min_len);
7661         if (!data)
7662                 return;
7663
7664         if (ev->req)
7665                 ev->func_req(hdev, data, skb, opcode, status, req_complete,
7666                              req_complete_skb);
7667         else
7668                 ev->func(hdev, data, skb);
7669 }
7670
7671 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
7672 {
7673         struct hci_event_hdr *hdr = (void *) skb->data;
7674         hci_req_complete_t req_complete = NULL;
7675         hci_req_complete_skb_t req_complete_skb = NULL;
7676         struct sk_buff *orig_skb = NULL;
7677         u8 status = 0, event, req_evt = 0;
7678         u16 opcode = HCI_OP_NOP;
7679
7680         if (skb->len < sizeof(*hdr)) {
7681                 bt_dev_err(hdev, "Malformed HCI Event");
7682                 goto done;
7683         }
7684
7685         kfree_skb(hdev->recv_event);
7686         hdev->recv_event = skb_clone(skb, GFP_KERNEL);
7687
7688         event = hdr->evt;
7689         if (!event) {
7690                 bt_dev_warn(hdev, "Received unexpected HCI Event 0x%2.2x",
7691                             event);
7692                 goto done;
7693         }
7694
7695         /* Only match event if command OGF is not for LE */
7696         if (hdev->sent_cmd &&
7697             hci_opcode_ogf(hci_skb_opcode(hdev->sent_cmd)) != 0x08 &&
7698             hci_skb_event(hdev->sent_cmd) == event) {
7699                 hci_req_cmd_complete(hdev, hci_skb_opcode(hdev->sent_cmd),
7700                                      status, &req_complete, &req_complete_skb);
7701                 req_evt = event;
7702         }
7703
7704         /* If it looks like we might end up having to call
7705          * req_complete_skb, store a pristine copy of the skb since the
7706          * various handlers may modify the original one through
7707          * skb_pull() calls, etc.
7708          */
7709         if (req_complete_skb || event == HCI_EV_CMD_STATUS ||
7710             event == HCI_EV_CMD_COMPLETE)
7711                 orig_skb = skb_clone(skb, GFP_KERNEL);
7712
7713         skb_pull(skb, HCI_EVENT_HDR_SIZE);
7714
7715         /* Store wake reason if we're suspended */
7716         hci_store_wake_reason(hdev, event, skb);
7717
7718         bt_dev_dbg(hdev, "event 0x%2.2x", event);
7719
7720         hci_event_func(hdev, event, skb, &opcode, &status, &req_complete,
7721                        &req_complete_skb);
7722
7723         if (req_complete) {
7724                 req_complete(hdev, status, opcode);
7725         } else if (req_complete_skb) {
7726                 if (!hci_get_cmd_complete(hdev, opcode, req_evt, orig_skb)) {
7727                         kfree_skb(orig_skb);
7728                         orig_skb = NULL;
7729                 }
7730                 req_complete_skb(hdev, status, opcode, orig_skb);
7731         }
7732
7733 done:
7734         kfree_skb(orig_skb);
7735         kfree_skb(skb);
7736         hdev->stat.evt_rx++;
7737 }