net/bluetooth/hci_event.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4    Copyright 2023 NXP
   5
   6    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License version 2 as
  10    published by the Free Software Foundation;
  11
  12    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  13    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  14    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  15    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  16    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  17    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  18    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  19    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  20
  21    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  22    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  23    SOFTWARE IS DISCLAIMED.
  24 */
  25
  26 /* Bluetooth HCI event handling. */
  27
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/mgmt.h>
  33
  34 #include "hci_request.h"
  35 #include "hci_debugfs.h"
  36 #include "a2mp.h"
  37 #include "amp.h"
  38 #include "smp.h"
  39 #include "msft.h"
  40 #include "eir.h"
  41
  42 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
  43                  "\x00\x00\x00\x00\x00\x00\x00\x00"
  44
  45 #define secs_to_jiffies(_secs) msecs_to_jiffies((_secs) * 1000)
  46
  47 /* Handle HCI Event packets */
  48
  49 static void *hci_ev_skb_pull(struct hci_dev *hdev, struct sk_buff *skb,
  50                              u8 ev, size_t len)
  51 {
  52         void *data;
  53
  54         data = skb_pull_data(skb, len);
  55         if (!data)
  56                 bt_dev_err(hdev, "Malformed Event: 0x%2.2x", ev);
  57
  58         return data;
  59 }
  60
  61 static void *hci_cc_skb_pull(struct hci_dev *hdev, struct sk_buff *skb,
  62                              u16 op, size_t len)
  63 {
  64         void *data;
  65
  66         data = skb_pull_data(skb, len);
  67         if (!data)
  68                 bt_dev_err(hdev, "Malformed Command Complete: 0x%4.4x", op);
  69
  70         return data;
  71 }
  72
  73 static void *hci_le_ev_skb_pull(struct hci_dev *hdev, struct sk_buff *skb,
  74                                 u8 ev, size_t len)
  75 {
  76         void *data;
  77
  78         data = skb_pull_data(skb, len);
  79         if (!data)
  80                 bt_dev_err(hdev, "Malformed LE Event: 0x%2.2x", ev);
  81
  82         return data;
  83 }
  84
  85 static u8 hci_cc_inquiry_cancel(struct hci_dev *hdev, void *data,
  86                                 struct sk_buff *skb)
  87 {
  88         struct hci_ev_status *rp = data;
  89
  90         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
  91
  92         /* It is possible that we receive Inquiry Complete event right
  93          * before we receive Inquiry Cancel Command Complete event, in
  94          * which case the latter event should have status of Command
  95          * Disallowed (0x0c). This should not be treated as error, since
  96          * we actually achieve what Inquiry Cancel wants to achieve,
  97          * which is to end the last Inquiry session.
  98          */
  99         if (rp->status == 0x0c && !test_bit(HCI_INQUIRY, &hdev->flags)) {
 100                 bt_dev_warn(hdev, "Ignoring error of Inquiry Cancel command");
 101                 rp->status = 0x00;
 102         }
 103
 104         if (rp->status)
 105                 return rp->status;
 106
 107         clear_bit(HCI_INQUIRY, &hdev->flags);
 108         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
 109         wake_up_bit(&hdev->flags, HCI_INQUIRY);
 110
 111         hci_dev_lock(hdev);
 112         /* Set discovery state to stopped if we're not doing LE active
 113          * scanning.
 114          */
 115         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
 116             hdev->le_scan_type != LE_SCAN_ACTIVE)
 117                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
 118         hci_dev_unlock(hdev);
 119
 120         hci_conn_check_pending(hdev);
 121
 122         return rp->status;
 123 }
 124
 125 static u8 hci_cc_periodic_inq(struct hci_dev *hdev, void *data,
 126                               struct sk_buff *skb)
 127 {
 128         struct hci_ev_status *rp = data;
 129
 130         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 131
 132         if (rp->status)
 133                 return rp->status;
 134
 135         hci_dev_set_flag(hdev, HCI_PERIODIC_INQ);
 136
 137         return rp->status;
 138 }
 139
 140 static u8 hci_cc_exit_periodic_inq(struct hci_dev *hdev, void *data,
 141                                    struct sk_buff *skb)
 142 {
 143         struct hci_ev_status *rp = data;
 144
 145         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 146
 147         if (rp->status)
 148                 return rp->status;
 149
 150         hci_dev_clear_flag(hdev, HCI_PERIODIC_INQ);
 151
 152         hci_conn_check_pending(hdev);
 153
 154         return rp->status;
 155 }
 156
 157 static u8 hci_cc_remote_name_req_cancel(struct hci_dev *hdev, void *data,
 158                                         struct sk_buff *skb)
 159 {
 160         struct hci_ev_status *rp = data;
 161
 162         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 163
 164         return rp->status;
 165 }
 166
 167 static u8 hci_cc_role_discovery(struct hci_dev *hdev, void *data,
 168                                 struct sk_buff *skb)
 169 {
 170         struct hci_rp_role_discovery *rp = data;
 171         struct hci_conn *conn;
 172
 173         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 174
 175         if (rp->status)
 176                 return rp->status;
 177
 178         hci_dev_lock(hdev);
 179
 180         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 181         if (conn)
 182                 conn->role = rp->role;
 183
 184         hci_dev_unlock(hdev);
 185
 186         return rp->status;
 187 }
 188
 189 static u8 hci_cc_read_link_policy(struct hci_dev *hdev, void *data,
 190                                   struct sk_buff *skb)
 191 {
 192         struct hci_rp_read_link_policy *rp = data;
 193         struct hci_conn *conn;
 194
 195         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 196
 197         if (rp->status)
 198                 return rp->status;
 199
 200         hci_dev_lock(hdev);
 201
 202         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 203         if (conn)
 204                 conn->link_policy = __le16_to_cpu(rp->policy);
 205
 206         hci_dev_unlock(hdev);
 207
 208         return rp->status;
 209 }
 210
 211 static u8 hci_cc_write_link_policy(struct hci_dev *hdev, void *data,
 212                                    struct sk_buff *skb)
 213 {
 214         struct hci_rp_write_link_policy *rp = data;
 215         struct hci_conn *conn;
 216         void *sent;
 217
 218         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 219
 220         if (rp->status)
 221                 return rp->status;
 222
 223         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
 224         if (!sent)
 225                 return rp->status;
 226
 227         hci_dev_lock(hdev);
 228
 229         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 230         if (conn)
 231                 conn->link_policy = get_unaligned_le16(sent + 2);
 232
 233         hci_dev_unlock(hdev);
 234
 235         return rp->status;
 236 }
 237
 238 static u8 hci_cc_read_def_link_policy(struct hci_dev *hdev, void *data,
 239                                       struct sk_buff *skb)
 240 {
 241         struct hci_rp_read_def_link_policy *rp = data;
 242
 243         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 244
 245         if (rp->status)
 246                 return rp->status;
 247
 248         hdev->link_policy = __le16_to_cpu(rp->policy);
 249
 250         return rp->status;
 251 }
 252
 253 static u8 hci_cc_write_def_link_policy(struct hci_dev *hdev, void *data,
 254                                        struct sk_buff *skb)
 255 {
 256         struct hci_ev_status *rp = data;
 257         void *sent;
 258
 259         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 260
 261         if (rp->status)
 262                 return rp->status;
 263
 264         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
 265         if (!sent)
 266                 return rp->status;
 267
 268         hdev->link_policy = get_unaligned_le16(sent);
 269
 270         return rp->status;
 271 }
 272
 273 static u8 hci_cc_reset(struct hci_dev *hdev, void *data, struct sk_buff *skb)
 274 {
 275         struct hci_ev_status *rp = data;
 276
 277         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 278
 279         clear_bit(HCI_RESET, &hdev->flags);
 280
 281         if (rp->status)
 282                 return rp->status;
 283
 284         /* Reset all non-persistent flags */
 285         hci_dev_clear_volatile_flags(hdev);
 286
 287         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
 288
 289         hdev->inq_tx_power = HCI_TX_POWER_INVALID;
 290         hdev->adv_tx_power = HCI_TX_POWER_INVALID;
 291
 292         memset(hdev->adv_data, 0, sizeof(hdev->adv_data));
 293         hdev->adv_data_len = 0;
 294
 295         memset(hdev->scan_rsp_data, 0, sizeof(hdev->scan_rsp_data));
 296         hdev->scan_rsp_data_len = 0;
 297
 298         hdev->le_scan_type = LE_SCAN_PASSIVE;
 299
 300         hdev->ssp_debug_mode = 0;
 301
 302         hci_bdaddr_list_clear(&hdev->le_accept_list);
 303         hci_bdaddr_list_clear(&hdev->le_resolv_list);
 304
 305         return rp->status;
 306 }
 307
 308 static u8 hci_cc_read_stored_link_key(struct hci_dev *hdev, void *data,
 309                                       struct sk_buff *skb)
 310 {
 311         struct hci_rp_read_stored_link_key *rp = data;
 312         struct hci_cp_read_stored_link_key *sent;
 313
 314         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 315
 316         sent = hci_sent_cmd_data(hdev, HCI_OP_READ_STORED_LINK_KEY);
 317         if (!sent)
 318                 return rp->status;
 319
 320         if (!rp->status && sent->read_all == 0x01) {
 321                 hdev->stored_max_keys = le16_to_cpu(rp->max_keys);
 322                 hdev->stored_num_keys = le16_to_cpu(rp->num_keys);
 323         }
 324
 325         return rp->status;
 326 }
 327
 328 static u8 hci_cc_delete_stored_link_key(struct hci_dev *hdev, void *data,
 329                                         struct sk_buff *skb)
 330 {
 331         struct hci_rp_delete_stored_link_key *rp = data;
 332         u16 num_keys;
 333
 334         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 335
 336         if (rp->status)
 337                 return rp->status;
 338
 339         num_keys = le16_to_cpu(rp->num_keys);
 340
 341         if (num_keys <= hdev->stored_num_keys)
 342                 hdev->stored_num_keys -= num_keys;
 343         else
 344                 hdev->stored_num_keys = 0;
 345
 346         return rp->status;
 347 }
 348
 349 static u8 hci_cc_write_local_name(struct hci_dev *hdev, void *data,
 350                                   struct sk_buff *skb)
 351 {
 352         struct hci_ev_status *rp = data;
 353         void *sent;
 354
 355         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 356
 357         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
 358         if (!sent)
 359                 return rp->status;
 360
 361         hci_dev_lock(hdev);
 362
 363         if (hci_dev_test_flag(hdev, HCI_MGMT))
 364                 mgmt_set_local_name_complete(hdev, sent, rp->status);
 365         else if (!rp->status)
 366                 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
 367
 368         hci_dev_unlock(hdev);
 369
 370         return rp->status;
 371 }
 372
 373 static u8 hci_cc_read_local_name(struct hci_dev *hdev, void *data,
 374                                  struct sk_buff *skb)
 375 {
 376         struct hci_rp_read_local_name *rp = data;
 377
 378         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 379
 380         if (rp->status)
 381                 return rp->status;
 382
 383         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 384             hci_dev_test_flag(hdev, HCI_CONFIG))
 385                 memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
 386
 387         return rp->status;
 388 }
 389
 390 static u8 hci_cc_write_auth_enable(struct hci_dev *hdev, void *data,
 391                                    struct sk_buff *skb)
 392 {
 393         struct hci_ev_status *rp = data;
 394         void *sent;
 395
 396         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 397
 398         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
 399         if (!sent)
 400                 return rp->status;
 401
 402         hci_dev_lock(hdev);
 403
 404         if (!rp->status) {
 405                 __u8 param = *((__u8 *) sent);
 406
 407                 if (param == AUTH_ENABLED)
 408                         set_bit(HCI_AUTH, &hdev->flags);
 409                 else
 410                         clear_bit(HCI_AUTH, &hdev->flags);
 411         }
 412
 413         if (hci_dev_test_flag(hdev, HCI_MGMT))
 414                 mgmt_auth_enable_complete(hdev, rp->status);
 415
 416         hci_dev_unlock(hdev);
 417
 418         return rp->status;
 419 }
 420
 421 static u8 hci_cc_write_encrypt_mode(struct hci_dev *hdev, void *data,
 422                                     struct sk_buff *skb)
 423 {
 424         struct hci_ev_status *rp = data;
 425         __u8 param;
 426         void *sent;
 427
 428         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 429
 430         if (rp->status)
 431                 return rp->status;
 432
 433         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
 434         if (!sent)
 435                 return rp->status;
 436
 437         param = *((__u8 *) sent);
 438
 439         if (param)
 440                 set_bit(HCI_ENCRYPT, &hdev->flags);
 441         else
 442                 clear_bit(HCI_ENCRYPT, &hdev->flags);
 443
 444         return rp->status;
 445 }
 446
 447 static u8 hci_cc_write_scan_enable(struct hci_dev *hdev, void *data,
 448                                    struct sk_buff *skb)
 449 {
 450         struct hci_ev_status *rp = data;
 451         __u8 param;
 452         void *sent;
 453
 454         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 455
 456         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
 457         if (!sent)
 458                 return rp->status;
 459
 460         param = *((__u8 *) sent);
 461
 462         hci_dev_lock(hdev);
 463
 464         if (rp->status) {
 465                 hdev->discov_timeout = 0;
 466                 goto done;
 467         }
 468
 469         if (param & SCAN_INQUIRY)
 470                 set_bit(HCI_ISCAN, &hdev->flags);
 471         else
 472                 clear_bit(HCI_ISCAN, &hdev->flags);
 473
 474         if (param & SCAN_PAGE)
 475                 set_bit(HCI_PSCAN, &hdev->flags);
 476         else
 477                 clear_bit(HCI_PSCAN, &hdev->flags);
 478
 479 done:
 480         hci_dev_unlock(hdev);
 481
 482         return rp->status;
 483 }
 484
 485 static u8 hci_cc_set_event_filter(struct hci_dev *hdev, void *data,
 486                                   struct sk_buff *skb)
 487 {
 488         struct hci_ev_status *rp = data;
 489         struct hci_cp_set_event_filter *cp;
 490         void *sent;
 491
 492         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 493
 494         if (rp->status)
 495                 return rp->status;
 496
 497         sent = hci_sent_cmd_data(hdev, HCI_OP_SET_EVENT_FLT);
 498         if (!sent)
 499                 return rp->status;
 500
 501         cp = (struct hci_cp_set_event_filter *)sent;
 502
 503         if (cp->flt_type == HCI_FLT_CLEAR_ALL)
 504                 hci_dev_clear_flag(hdev, HCI_EVENT_FILTER_CONFIGURED);
 505         else
 506                 hci_dev_set_flag(hdev, HCI_EVENT_FILTER_CONFIGURED);
 507
 508         return rp->status;
 509 }
 510
 511 static u8 hci_cc_read_class_of_dev(struct hci_dev *hdev, void *data,
 512                                    struct sk_buff *skb)
 513 {
 514         struct hci_rp_read_class_of_dev *rp = data;
 515
 516         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 517
 518         if (rp->status)
 519                 return rp->status;
 520
 521         memcpy(hdev->dev_class, rp->dev_class, 3);
 522
 523         bt_dev_dbg(hdev, "class 0x%.2x%.2x%.2x", hdev->dev_class[2],
 524                    hdev->dev_class[1], hdev->dev_class[0]);
 525
 526         return rp->status;
 527 }
 528
 529 static u8 hci_cc_write_class_of_dev(struct hci_dev *hdev, void *data,
 530                                     struct sk_buff *skb)
 531 {
 532         struct hci_ev_status *rp = data;
 533         void *sent;
 534
 535         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 536
 537         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
 538         if (!sent)
 539                 return rp->status;
 540
 541         hci_dev_lock(hdev);
 542
 543         if (!rp->status)
 544                 memcpy(hdev->dev_class, sent, 3);
 545
 546         if (hci_dev_test_flag(hdev, HCI_MGMT))
 547                 mgmt_set_class_of_dev_complete(hdev, sent, rp->status);
 548
 549         hci_dev_unlock(hdev);
 550
 551         return rp->status;
 552 }
 553
 554 static u8 hci_cc_read_voice_setting(struct hci_dev *hdev, void *data,
 555                                     struct sk_buff *skb)
 556 {
 557         struct hci_rp_read_voice_setting *rp = data;
 558         __u16 setting;
 559
 560         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 561
 562         if (rp->status)
 563                 return rp->status;
 564
 565         setting = __le16_to_cpu(rp->voice_setting);
 566
 567         if (hdev->voice_setting == setting)
 568                 return rp->status;
 569
 570         hdev->voice_setting = setting;
 571
 572         bt_dev_dbg(hdev, "voice setting 0x%4.4x", setting);
 573
 574         if (hdev->notify)
 575                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 576
 577         return rp->status;
 578 }
 579
 580 static u8 hci_cc_write_voice_setting(struct hci_dev *hdev, void *data,
 581                                      struct sk_buff *skb)
 582 {
 583         struct hci_ev_status *rp = data;
 584         __u16 setting;
 585         void *sent;
 586
 587         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 588
 589         if (rp->status)
 590                 return rp->status;
 591
 592         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
 593         if (!sent)
 594                 return rp->status;
 595
 596         setting = get_unaligned_le16(sent);
 597
 598         if (hdev->voice_setting == setting)
 599                 return rp->status;
 600
 601         hdev->voice_setting = setting;
 602
 603         bt_dev_dbg(hdev, "voice setting 0x%4.4x", setting);
 604
 605         if (hdev->notify)
 606                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 607
 608         return rp->status;
 609 }
 610
 611 static u8 hci_cc_read_num_supported_iac(struct hci_dev *hdev, void *data,
 612                                         struct sk_buff *skb)
 613 {
 614         struct hci_rp_read_num_supported_iac *rp = data;
 615
 616         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 617
 618         if (rp->status)
 619                 return rp->status;
 620
 621         hdev->num_iac = rp->num_iac;
 622
 623         bt_dev_dbg(hdev, "num iac %d", hdev->num_iac);
 624
 625         return rp->status;
 626 }
 627
 628 static u8 hci_cc_write_ssp_mode(struct hci_dev *hdev, void *data,
 629                                 struct sk_buff *skb)
 630 {
 631         struct hci_ev_status *rp = data;
 632         struct hci_cp_write_ssp_mode *sent;
 633
 634         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 635
 636         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
 637         if (!sent)
 638                 return rp->status;
 639
 640         hci_dev_lock(hdev);
 641
 642         if (!rp->status) {
 643                 if (sent->mode)
 644                         hdev->features[1][0] |= LMP_HOST_SSP;
 645                 else
 646                         hdev->features[1][0] &= ~LMP_HOST_SSP;
 647         }
 648
 649         if (!rp->status) {
 650                 if (sent->mode)
 651                         hci_dev_set_flag(hdev, HCI_SSP_ENABLED);
 652                 else
 653                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
 654         }
 655
 656         hci_dev_unlock(hdev);
 657
 658         return rp->status;
 659 }
 660
 661 static u8 hci_cc_write_sc_support(struct hci_dev *hdev, void *data,
 662                                   struct sk_buff *skb)
 663 {
 664         struct hci_ev_status *rp = data;
 665         struct hci_cp_write_sc_support *sent;
 666
 667         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 668
 669         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SC_SUPPORT);
 670         if (!sent)
 671                 return rp->status;
 672
 673         hci_dev_lock(hdev);
 674
 675         if (!rp->status) {
 676                 if (sent->support)
 677                         hdev->features[1][0] |= LMP_HOST_SC;
 678                 else
 679                         hdev->features[1][0] &= ~LMP_HOST_SC;
 680         }
 681
 682         if (!hci_dev_test_flag(hdev, HCI_MGMT) && !rp->status) {
 683                 if (sent->support)
 684                         hci_dev_set_flag(hdev, HCI_SC_ENABLED);
 685                 else
 686                         hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
 687         }
 688
 689         hci_dev_unlock(hdev);
 690
 691         return rp->status;
 692 }
 693
 694 static u8 hci_cc_read_local_version(struct hci_dev *hdev, void *data,
 695                                     struct sk_buff *skb)
 696 {
 697         struct hci_rp_read_local_version *rp = data;
 698
 699         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 700
 701         if (rp->status)
 702                 return rp->status;
 703
 704         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 705             hci_dev_test_flag(hdev, HCI_CONFIG)) {
 706                 hdev->hci_ver = rp->hci_ver;
 707                 hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
 708                 hdev->lmp_ver = rp->lmp_ver;
 709                 hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
 710                 hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
 711         }
 712
 713         return rp->status;
 714 }
 715
 716 static u8 hci_cc_read_enc_key_size(struct hci_dev *hdev, void *data,
 717                                    struct sk_buff *skb)
 718 {
 719         struct hci_rp_read_enc_key_size *rp = data;
 720         struct hci_conn *conn;
 721         u16 handle;
 722         u8 status = rp->status;
 723
 724         bt_dev_dbg(hdev, "status 0x%2.2x", status);
 725
 726         handle = le16_to_cpu(rp->handle);
 727
 728         hci_dev_lock(hdev);
 729
 730         conn = hci_conn_hash_lookup_handle(hdev, handle);
 731         if (!conn) {
 732                 status = 0xFF;
 733                 goto done;
 734         }
 735
 736         /* While unexpected, the read_enc_key_size command may fail. The most
 737          * secure approach is to then assume the key size is 0 to force a
 738          * disconnection.
 739          */
 740         if (status) {
 741                 bt_dev_err(hdev, "failed to read key size for handle %u",
 742                            handle);
 743                 conn->enc_key_size = 0;
 744         } else {
 745                 conn->enc_key_size = rp->key_size;
 746                 status = 0;
 747         }
 748
 749         hci_encrypt_cfm(conn, 0);
 750
 751 done:
 752         hci_dev_unlock(hdev);
 753
 754         return status;
 755 }
 756
 757 static u8 hci_cc_read_local_commands(struct hci_dev *hdev, void *data,
 758                                      struct sk_buff *skb)
 759 {
 760         struct hci_rp_read_local_commands *rp = data;
 761
 762         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 763
 764         if (rp->status)
 765                 return rp->status;
 766
 767         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 768             hci_dev_test_flag(hdev, HCI_CONFIG))
 769                 memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 770
 771         return rp->status;
 772 }
 773
 774 static u8 hci_cc_read_auth_payload_timeout(struct hci_dev *hdev, void *data,
 775                                            struct sk_buff *skb)
 776 {
 777         struct hci_rp_read_auth_payload_to *rp = data;
 778         struct hci_conn *conn;
 779
 780         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 781
 782         if (rp->status)
 783                 return rp->status;
 784
 785         hci_dev_lock(hdev);
 786
 787         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 788         if (conn)
 789                 conn->auth_payload_timeout = __le16_to_cpu(rp->timeout);
 790
 791         hci_dev_unlock(hdev);
 792
 793         return rp->status;
 794 }
 795
 796 static u8 hci_cc_write_auth_payload_timeout(struct hci_dev *hdev, void *data,
 797                                             struct sk_buff *skb)
 798 {
 799         struct hci_rp_write_auth_payload_to *rp = data;
 800         struct hci_conn *conn;
 801         void *sent;
 802
 803         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 804
 805         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_PAYLOAD_TO);
 806         if (!sent)
 807                 return rp->status;
 808
 809         hci_dev_lock(hdev);
 810
 811         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 812         if (!conn) {
 813                 rp->status = 0xff;
 814                 goto unlock;
 815         }
 816
 817         if (!rp->status)
 818                 conn->auth_payload_timeout = get_unaligned_le16(sent + 2);
 819
 820         hci_encrypt_cfm(conn, 0);
 821
 822 unlock:
 823         hci_dev_unlock(hdev);
 824
 825         return rp->status;
 826 }
 827
 828 static u8 hci_cc_read_local_features(struct hci_dev *hdev, void *data,
 829                                      struct sk_buff *skb)
 830 {
 831         struct hci_rp_read_local_features *rp = data;
 832
 833         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 834
 835         if (rp->status)
 836                 return rp->status;
 837
 838         memcpy(hdev->features, rp->features, 8);
 839
 840         /* Adjust default settings according to features
 841          * supported by device. */
 842
 843         if (hdev->features[0][0] & LMP_3SLOT)
 844                 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 845
 846         if (hdev->features[0][0] & LMP_5SLOT)
 847                 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 848
 849         if (hdev->features[0][1] & LMP_HV2) {
 850                 hdev->pkt_type  |= (HCI_HV2);
 851                 hdev->esco_type |= (ESCO_HV2);
 852         }
 853
 854         if (hdev->features[0][1] & LMP_HV3) {
 855                 hdev->pkt_type  |= (HCI_HV3);
 856                 hdev->esco_type |= (ESCO_HV3);
 857         }
 858
 859         if (lmp_esco_capable(hdev))
 860                 hdev->esco_type |= (ESCO_EV3);
 861
 862         if (hdev->features[0][4] & LMP_EV4)
 863                 hdev->esco_type |= (ESCO_EV4);
 864
 865         if (hdev->features[0][4] & LMP_EV5)
 866                 hdev->esco_type |= (ESCO_EV5);
 867
 868         if (hdev->features[0][5] & LMP_EDR_ESCO_2M)
 869                 hdev->esco_type |= (ESCO_2EV3);
 870
 871         if (hdev->features[0][5] & LMP_EDR_ESCO_3M)
 872                 hdev->esco_type |= (ESCO_3EV3);
 873
 874         if (hdev->features[0][5] & LMP_EDR_3S_ESCO)
 875                 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
 876
 877         return rp->status;
 878 }
 879
 880 static u8 hci_cc_read_local_ext_features(struct hci_dev *hdev, void *data,
 881                                          struct sk_buff *skb)
 882 {
 883         struct hci_rp_read_local_ext_features *rp = data;
 884
 885         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 886
 887         if (rp->status)
 888                 return rp->status;
 889
 890         if (hdev->max_page < rp->max_page) {
 891                 if (test_bit(HCI_QUIRK_BROKEN_LOCAL_EXT_FEATURES_PAGE_2,
 892                              &hdev->quirks))
 893                         bt_dev_warn(hdev, "broken local ext features page 2");
 894                 else
 895                         hdev->max_page = rp->max_page;
 896         }
 897
 898         if (rp->page < HCI_MAX_PAGES)
 899                 memcpy(hdev->features[rp->page], rp->features, 8);
 900
 901         return rp->status;
 902 }
 903
 904 static u8 hci_cc_read_flow_control_mode(struct hci_dev *hdev, void *data,
 905                                         struct sk_buff *skb)
 906 {
 907         struct hci_rp_read_flow_control_mode *rp = data;
 908
 909         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 910
 911         if (rp->status)
 912                 return rp->status;
 913
 914         hdev->flow_ctl_mode = rp->mode;
 915
 916         return rp->status;
 917 }
 918
 919 static u8 hci_cc_read_buffer_size(struct hci_dev *hdev, void *data,
 920                                   struct sk_buff *skb)
 921 {
 922         struct hci_rp_read_buffer_size *rp = data;
 923
 924         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 925
 926         if (rp->status)
 927                 return rp->status;
 928
 929         hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
 930         hdev->sco_mtu  = rp->sco_mtu;
 931         hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
 932         hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
 933
 934         if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
 935                 hdev->sco_mtu  = 64;
 936                 hdev->sco_pkts = 8;
 937         }
 938
 939         hdev->acl_cnt = hdev->acl_pkts;
 940         hdev->sco_cnt = hdev->sco_pkts;
 941
 942         BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
 943                hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
 944
 945         return rp->status;
 946 }
 947
 948 static u8 hci_cc_read_bd_addr(struct hci_dev *hdev, void *data,
 949                               struct sk_buff *skb)
 950 {
 951         struct hci_rp_read_bd_addr *rp = data;
 952
 953         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 954
 955         if (rp->status)
 956                 return rp->status;
 957
 958         if (test_bit(HCI_INIT, &hdev->flags))
 959                 bacpy(&hdev->bdaddr, &rp->bdaddr);
 960
 961         if (hci_dev_test_flag(hdev, HCI_SETUP))
 962                 bacpy(&hdev->setup_addr, &rp->bdaddr);
 963
 964         return rp->status;
 965 }
 966
 967 static u8 hci_cc_read_local_pairing_opts(struct hci_dev *hdev, void *data,
 968                                          struct sk_buff *skb)
 969 {
 970         struct hci_rp_read_local_pairing_opts *rp = data;
 971
 972         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 973
 974         if (rp->status)
 975                 return rp->status;
 976
 977         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 978             hci_dev_test_flag(hdev, HCI_CONFIG)) {
 979                 hdev->pairing_opts = rp->pairing_opts;
 980                 hdev->max_enc_key_size = rp->max_key_size;
 981         }
 982
 983         return rp->status;
 984 }
 985
 986 static u8 hci_cc_read_page_scan_activity(struct hci_dev *hdev, void *data,
 987                                          struct sk_buff *skb)
 988 {
 989         struct hci_rp_read_page_scan_activity *rp = data;
 990
 991         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 992
 993         if (rp->status)
 994                 return rp->status;
 995
 996         if (test_bit(HCI_INIT, &hdev->flags)) {
 997                 hdev->page_scan_interval = __le16_to_cpu(rp->interval);
 998                 hdev->page_scan_window = __le16_to_cpu(rp->window);
 999         }
1000
1001         return rp->status;
1002 }
1003
1004 static u8 hci_cc_write_page_scan_activity(struct hci_dev *hdev, void *data,
1005                                           struct sk_buff *skb)
1006 {
1007         struct hci_ev_status *rp = data;
1008         struct hci_cp_write_page_scan_activity *sent;
1009
1010         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1011
1012         if (rp->status)
1013                 return rp->status;
1014
1015         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY);
1016         if (!sent)
1017                 return rp->status;
1018
1019         hdev->page_scan_interval = __le16_to_cpu(sent->interval);
1020         hdev->page_scan_window = __le16_to_cpu(sent->window);
1021
1022         return rp->status;
1023 }
1024
1025 static u8 hci_cc_read_page_scan_type(struct hci_dev *hdev, void *data,
1026                                      struct sk_buff *skb)
1027 {
1028         struct hci_rp_read_page_scan_type *rp = data;
1029
1030         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1031
1032         if (rp->status)
1033                 return rp->status;
1034
1035         if (test_bit(HCI_INIT, &hdev->flags))
1036                 hdev->page_scan_type = rp->type;
1037
1038         return rp->status;
1039 }
1040
1041 static u8 hci_cc_write_page_scan_type(struct hci_dev *hdev, void *data,
1042                                       struct sk_buff *skb)
1043 {
1044         struct hci_ev_status *rp = data;
1045         u8 *type;
1046
1047         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1048
1049         if (rp->status)
1050                 return rp->status;
1051
1052         type = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE);
1053         if (type)
1054                 hdev->page_scan_type = *type;
1055
1056         return rp->status;
1057 }
1058
1059 static u8 hci_cc_read_data_block_size(struct hci_dev *hdev, void *data,
1060                                       struct sk_buff *skb)
1061 {
1062         struct hci_rp_read_data_block_size *rp = data;
1063
1064         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1065
1066         if (rp->status)
1067                 return rp->status;
1068
1069         hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
1070         hdev->block_len = __le16_to_cpu(rp->block_len);
1071         hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
1072
1073         hdev->block_cnt = hdev->num_blocks;
1074
1075         BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
1076                hdev->block_cnt, hdev->block_len);
1077
1078         return rp->status;
1079 }
1080
1081 static u8 hci_cc_read_clock(struct hci_dev *hdev, void *data,
1082                             struct sk_buff *skb)
1083 {
1084         struct hci_rp_read_clock *rp = data;
1085         struct hci_cp_read_clock *cp;
1086         struct hci_conn *conn;
1087
1088         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1089
1090         if (rp->status)
1091                 return rp->status;
1092
1093         hci_dev_lock(hdev);
1094
1095         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
1096         if (!cp)
1097                 goto unlock;
1098
1099         if (cp->which == 0x00) {
1100                 hdev->clock = le32_to_cpu(rp->clock);
1101                 goto unlock;
1102         }
1103
1104         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1105         if (conn) {
1106                 conn->clock = le32_to_cpu(rp->clock);
1107                 conn->clock_accuracy = le16_to_cpu(rp->accuracy);
1108         }
1109
1110 unlock:
1111         hci_dev_unlock(hdev);
1112         return rp->status;
1113 }
1114
1115 static u8 hci_cc_read_local_amp_info(struct hci_dev *hdev, void *data,
1116                                      struct sk_buff *skb)
1117 {
1118         struct hci_rp_read_local_amp_info *rp = data;
1119
1120         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1121
1122         if (rp->status)
1123                 return rp->status;
1124
1125         hdev->amp_status = rp->amp_status;
1126         hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
1127         hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
1128         hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
1129         hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
1130         hdev->amp_type = rp->amp_type;
1131         hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
1132         hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
1133         hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
1134         hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
1135
1136         return rp->status;
1137 }
1138
1139 static u8 hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev, void *data,
1140                                        struct sk_buff *skb)
1141 {
1142         struct hci_rp_read_inq_rsp_tx_power *rp = data;
1143
1144         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1145
1146         if (rp->status)
1147                 return rp->status;
1148
1149         hdev->inq_tx_power = rp->tx_power;
1150
1151         return rp->status;
1152 }
1153
1154 static u8 hci_cc_read_def_err_data_reporting(struct hci_dev *hdev, void *data,
1155                                              struct sk_buff *skb)
1156 {
1157         struct hci_rp_read_def_err_data_reporting *rp = data;
1158
1159         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1160
1161         if (rp->status)
1162                 return rp->status;
1163
1164         hdev->err_data_reporting = rp->err_data_reporting;
1165
1166         return rp->status;
1167 }
1168
1169 static u8 hci_cc_write_def_err_data_reporting(struct hci_dev *hdev, void *data,
1170                                               struct sk_buff *skb)
1171 {
1172         struct hci_ev_status *rp = data;
1173         struct hci_cp_write_def_err_data_reporting *cp;
1174
1175         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1176
1177         if (rp->status)
1178                 return rp->status;
1179
1180         cp = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_ERR_DATA_REPORTING);
1181         if (!cp)
1182                 return rp->status;
1183
1184         hdev->err_data_reporting = cp->err_data_reporting;
1185
1186         return rp->status;
1187 }
1188
1189 static u8 hci_cc_pin_code_reply(struct hci_dev *hdev, void *data,
1190                                 struct sk_buff *skb)
1191 {
1192         struct hci_rp_pin_code_reply *rp = data;
1193         struct hci_cp_pin_code_reply *cp;
1194         struct hci_conn *conn;
1195
1196         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1197
1198         hci_dev_lock(hdev);
1199
1200         if (hci_dev_test_flag(hdev, HCI_MGMT))
1201                 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
1202
1203         if (rp->status)
1204                 goto unlock;
1205
1206         cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
1207         if (!cp)
1208                 goto unlock;
1209
1210         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1211         if (conn)
1212                 conn->pin_length = cp->pin_len;
1213
1214 unlock:
1215         hci_dev_unlock(hdev);
1216         return rp->status;
1217 }
1218
1219 static u8 hci_cc_pin_code_neg_reply(struct hci_dev *hdev, void *data,
1220                                     struct sk_buff *skb)
1221 {
1222         struct hci_rp_pin_code_neg_reply *rp = data;
1223
1224         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1225
1226         hci_dev_lock(hdev);
1227
1228         if (hci_dev_test_flag(hdev, HCI_MGMT))
1229                 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
1230                                                  rp->status);
1231
1232         hci_dev_unlock(hdev);
1233
1234         return rp->status;
1235 }
1236
1237 static u8 hci_cc_le_read_buffer_size(struct hci_dev *hdev, void *data,
1238                                      struct sk_buff *skb)
1239 {
1240         struct hci_rp_le_read_buffer_size *rp = data;
1241
1242         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1243
1244         if (rp->status)
1245                 return rp->status;
1246
1247         hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
1248         hdev->le_pkts = rp->le_max_pkt;
1249
1250         hdev->le_cnt = hdev->le_pkts;
1251
1252         BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
1253
1254         return rp->status;
1255 }
1256
1257 static u8 hci_cc_le_read_local_features(struct hci_dev *hdev, void *data,
1258                                         struct sk_buff *skb)
1259 {
1260         struct hci_rp_le_read_local_features *rp = data;
1261
1262         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1263
1264         if (rp->status)
1265                 return rp->status;
1266
1267         memcpy(hdev->le_features, rp->features, 8);
1268
1269         return rp->status;
1270 }
1271
1272 static u8 hci_cc_le_read_adv_tx_power(struct hci_dev *hdev, void *data,
1273                                       struct sk_buff *skb)
1274 {
1275         struct hci_rp_le_read_adv_tx_power *rp = data;
1276
1277         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1278
1279         if (rp->status)
1280                 return rp->status;
1281
1282         hdev->adv_tx_power = rp->tx_power;
1283
1284         return rp->status;
1285 }
1286
1287 static u8 hci_cc_user_confirm_reply(struct hci_dev *hdev, void *data,
1288                                     struct sk_buff *skb)
1289 {
1290         struct hci_rp_user_confirm_reply *rp = data;
1291
1292         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1293
1294         hci_dev_lock(hdev);
1295
1296         if (hci_dev_test_flag(hdev, HCI_MGMT))
1297                 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,
1298                                                  rp->status);
1299
1300         hci_dev_unlock(hdev);
1301
1302         return rp->status;
1303 }
1304
1305 static u8 hci_cc_user_confirm_neg_reply(struct hci_dev *hdev, void *data,
1306                                         struct sk_buff *skb)
1307 {
1308         struct hci_rp_user_confirm_reply *rp = data;
1309
1310         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1311
1312         hci_dev_lock(hdev);
1313
1314         if (hci_dev_test_flag(hdev, HCI_MGMT))
1315                 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
1316                                                      ACL_LINK, 0, rp->status);
1317
1318         hci_dev_unlock(hdev);
1319
1320         return rp->status;
1321 }
1322
1323 static u8 hci_cc_user_passkey_reply(struct hci_dev *hdev, void *data,
1324                                     struct sk_buff *skb)
1325 {
1326         struct hci_rp_user_confirm_reply *rp = data;
1327
1328         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1329
1330         hci_dev_lock(hdev);
1331
1332         if (hci_dev_test_flag(hdev, HCI_MGMT))
1333                 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
1334                                                  0, rp->status);
1335
1336         hci_dev_unlock(hdev);
1337
1338         return rp->status;
1339 }
1340
1341 static u8 hci_cc_user_passkey_neg_reply(struct hci_dev *hdev, void *data,
1342                                         struct sk_buff *skb)
1343 {
1344         struct hci_rp_user_confirm_reply *rp = data;
1345
1346         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1347
1348         hci_dev_lock(hdev);
1349
1350         if (hci_dev_test_flag(hdev, HCI_MGMT))
1351                 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
1352                                                      ACL_LINK, 0, rp->status);
1353
1354         hci_dev_unlock(hdev);
1355
1356         return rp->status;
1357 }
1358
1359 static u8 hci_cc_read_local_oob_data(struct hci_dev *hdev, void *data,
1360                                      struct sk_buff *skb)
1361 {
1362         struct hci_rp_read_local_oob_data *rp = data;
1363
1364         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1365
1366         return rp->status;
1367 }
1368
1369 static u8 hci_cc_read_local_oob_ext_data(struct hci_dev *hdev, void *data,
1370                                          struct sk_buff *skb)
1371 {
1372         struct hci_rp_read_local_oob_ext_data *rp = data;
1373
1374         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1375
1376         return rp->status;
1377 }
1378
1379 static u8 hci_cc_le_set_random_addr(struct hci_dev *hdev, void *data,
1380                                     struct sk_buff *skb)
1381 {
1382         struct hci_ev_status *rp = data;
1383         bdaddr_t *sent;
1384
1385         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1386
1387         if (rp->status)
1388                 return rp->status;
1389
1390         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_RANDOM_ADDR);
1391         if (!sent)
1392                 return rp->status;
1393
1394         hci_dev_lock(hdev);
1395
1396         bacpy(&hdev->random_addr, sent);
1397
1398         if (!bacmp(&hdev->rpa, sent)) {
1399                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
1400                 queue_delayed_work(hdev->workqueue, &hdev->rpa_expired,
1401                                    secs_to_jiffies(hdev->rpa_timeout));
1402         }
1403
1404         hci_dev_unlock(hdev);
1405
1406         return rp->status;
1407 }
1408
1409 static u8 hci_cc_le_set_default_phy(struct hci_dev *hdev, void *data,
1410                                     struct sk_buff *skb)
1411 {
1412         struct hci_ev_status *rp = data;
1413         struct hci_cp_le_set_default_phy *cp;
1414
1415         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1416
1417         if (rp->status)
1418                 return rp->status;
1419
1420         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_DEFAULT_PHY);
1421         if (!cp)
1422                 return rp->status;
1423
1424         hci_dev_lock(hdev);
1425
1426         hdev->le_tx_def_phys = cp->tx_phys;
1427         hdev->le_rx_def_phys = cp->rx_phys;
1428
1429         hci_dev_unlock(hdev);
1430
1431         return rp->status;
1432 }
1433
1434 static u8 hci_cc_le_set_adv_set_random_addr(struct hci_dev *hdev, void *data,
1435                                             struct sk_buff *skb)
1436 {
1437         struct hci_ev_status *rp = data;
1438         struct hci_cp_le_set_adv_set_rand_addr *cp;
1439         struct adv_info *adv;
1440
1441         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1442
1443         if (rp->status)
1444                 return rp->status;
1445
1446         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_SET_RAND_ADDR);
1447         /* Update only in case the adv instance since handle 0x00 shall be using
1448          * HCI_OP_LE_SET_RANDOM_ADDR since that allows both extended and
1449          * non-extended adverting.
1450          */
1451         if (!cp || !cp->handle)
1452                 return rp->status;
1453
1454         hci_dev_lock(hdev);
1455
1456         adv = hci_find_adv_instance(hdev, cp->handle);
1457         if (adv) {
1458                 bacpy(&adv->random_addr, &cp->bdaddr);
1459                 if (!bacmp(&hdev->rpa, &cp->bdaddr)) {
1460                         adv->rpa_expired = false;
1461                         queue_delayed_work(hdev->workqueue,
1462                                            &adv->rpa_expired_cb,
1463                                            secs_to_jiffies(hdev->rpa_timeout));
1464                 }
1465         }
1466
1467         hci_dev_unlock(hdev);
1468
1469         return rp->status;
1470 }
1471
1472 static u8 hci_cc_le_remove_adv_set(struct hci_dev *hdev, void *data,
1473                                    struct sk_buff *skb)
1474 {
1475         struct hci_ev_status *rp = data;
1476         u8 *instance;
1477         int err;
1478
1479         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1480
1481         if (rp->status)
1482                 return rp->status;
1483
1484         instance = hci_sent_cmd_data(hdev, HCI_OP_LE_REMOVE_ADV_SET);
1485         if (!instance)
1486                 return rp->status;
1487
1488         hci_dev_lock(hdev);
1489
1490         err = hci_remove_adv_instance(hdev, *instance);
1491         if (!err)
1492                 mgmt_advertising_removed(hci_skb_sk(hdev->sent_cmd), hdev,
1493                                          *instance);
1494
1495         hci_dev_unlock(hdev);
1496
1497         return rp->status;
1498 }
1499
1500 static u8 hci_cc_le_clear_adv_sets(struct hci_dev *hdev, void *data,
1501                                    struct sk_buff *skb)
1502 {
1503         struct hci_ev_status *rp = data;
1504         struct adv_info *adv, *n;
1505         int err;
1506
1507         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1508
1509         if (rp->status)
1510                 return rp->status;
1511
1512         if (!hci_sent_cmd_data(hdev, HCI_OP_LE_CLEAR_ADV_SETS))
1513                 return rp->status;
1514
1515         hci_dev_lock(hdev);
1516
1517         list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) {
1518                 u8 instance = adv->instance;
1519
1520                 err = hci_remove_adv_instance(hdev, instance);
1521                 if (!err)
1522                         mgmt_advertising_removed(hci_skb_sk(hdev->sent_cmd),
1523                                                  hdev, instance);
1524         }
1525
1526         hci_dev_unlock(hdev);
1527
1528         return rp->status;
1529 }
1530
1531 static u8 hci_cc_le_read_transmit_power(struct hci_dev *hdev, void *data,
1532                                         struct sk_buff *skb)
1533 {
1534         struct hci_rp_le_read_transmit_power *rp = data;
1535
1536         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1537
1538         if (rp->status)
1539                 return rp->status;
1540
1541         hdev->min_le_tx_power = rp->min_le_tx_power;
1542         hdev->max_le_tx_power = rp->max_le_tx_power;
1543
1544         return rp->status;
1545 }
1546
1547 static u8 hci_cc_le_set_privacy_mode(struct hci_dev *hdev, void *data,
1548                                      struct sk_buff *skb)
1549 {
1550         struct hci_ev_status *rp = data;
1551         struct hci_cp_le_set_privacy_mode *cp;
1552         struct hci_conn_params *params;
1553
1554         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1555
1556         if (rp->status)
1557                 return rp->status;
1558
1559         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_PRIVACY_MODE);
1560         if (!cp)
1561                 return rp->status;
1562
1563         hci_dev_lock(hdev);
1564
1565         params = hci_conn_params_lookup(hdev, &cp->bdaddr, cp->bdaddr_type);
1566         if (params)
1567                 WRITE_ONCE(params->privacy_mode, cp->mode);
1568
1569         hci_dev_unlock(hdev);
1570
1571         return rp->status;
1572 }
1573
1574 static u8 hci_cc_le_set_adv_enable(struct hci_dev *hdev, void *data,
1575                                    struct sk_buff *skb)
1576 {
1577         struct hci_ev_status *rp = data;
1578         __u8 *sent;
1579
1580         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1581
1582         if (rp->status)
1583                 return rp->status;
1584
1585         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_ENABLE);
1586         if (!sent)
1587                 return rp->status;
1588
1589         hci_dev_lock(hdev);
1590
1591         /* If we're doing connection initiation as peripheral. Set a
1592          * timeout in case something goes wrong.
1593          */
1594         if (*sent) {
1595                 struct hci_conn *conn;
1596
1597                 hci_dev_set_flag(hdev, HCI_LE_ADV);
1598
1599                 conn = hci_lookup_le_connect(hdev);
1600                 if (conn)
1601                         queue_delayed_work(hdev->workqueue,
1602                                            &conn->le_conn_timeout,
1603                                            conn->conn_timeout);
1604         } else {
1605                 hci_dev_clear_flag(hdev, HCI_LE_ADV);
1606         }
1607
1608         hci_dev_unlock(hdev);
1609
1610         return rp->status;
1611 }
1612
1613 static u8 hci_cc_le_set_ext_adv_enable(struct hci_dev *hdev, void *data,
1614                                        struct sk_buff *skb)
1615 {
1616         struct hci_cp_le_set_ext_adv_enable *cp;
1617         struct hci_cp_ext_adv_set *set;
1618         struct adv_info *adv = NULL, *n;
1619         struct hci_ev_status *rp = data;
1620
1621         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1622
1623         if (rp->status)
1624                 return rp->status;
1625
1626         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE);
1627         if (!cp)
1628                 return rp->status;
1629
1630         set = (void *)cp->data;
1631
1632         hci_dev_lock(hdev);
1633
1634         if (cp->num_of_sets)
1635                 adv = hci_find_adv_instance(hdev, set->handle);
1636
1637         if (cp->enable) {
1638                 struct hci_conn *conn;
1639
1640                 hci_dev_set_flag(hdev, HCI_LE_ADV);
1641
1642                 if (adv)
1643                         adv->enabled = true;
1644
1645                 conn = hci_lookup_le_connect(hdev);
1646                 if (conn)
1647                         queue_delayed_work(hdev->workqueue,
1648                                            &conn->le_conn_timeout,
1649                                            conn->conn_timeout);
1650         } else {
1651                 if (cp->num_of_sets) {
1652                         if (adv)
1653                                 adv->enabled = false;
1654
1655                         /* If just one instance was disabled check if there are
1656                          * any other instance enabled before clearing HCI_LE_ADV
1657                          */
1658                         list_for_each_entry_safe(adv, n, &hdev->adv_instances,
1659                                                  list) {
1660                                 if (adv->enabled)
1661                                         goto unlock;
1662                         }
1663                 } else {
1664                         /* All instances shall be considered disabled */
1665                         list_for_each_entry_safe(adv, n, &hdev->adv_instances,
1666                                                  list)
1667                                 adv->enabled = false;
1668                 }
1669
1670                 hci_dev_clear_flag(hdev, HCI_LE_ADV);
1671         }
1672
1673 unlock:
1674         hci_dev_unlock(hdev);
1675         return rp->status;
1676 }
1677
1678 static u8 hci_cc_le_set_scan_param(struct hci_dev *hdev, void *data,
1679                                    struct sk_buff *skb)
1680 {
1681         struct hci_cp_le_set_scan_param *cp;
1682         struct hci_ev_status *rp = data;
1683
1684         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1685
1686         if (rp->status)
1687                 return rp->status;
1688
1689         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_PARAM);
1690         if (!cp)
1691                 return rp->status;
1692
1693         hci_dev_lock(hdev);
1694
1695         hdev->le_scan_type = cp->type;
1696
1697         hci_dev_unlock(hdev);
1698
1699         return rp->status;
1700 }
1701
1702 static u8 hci_cc_le_set_ext_scan_param(struct hci_dev *hdev, void *data,
1703                                        struct sk_buff *skb)
1704 {
1705         struct hci_cp_le_set_ext_scan_params *cp;
1706         struct hci_ev_status *rp = data;
1707         struct hci_cp_le_scan_phy_params *phy_param;
1708
1709         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1710
1711         if (rp->status)
1712                 return rp->status;
1713
1714         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_SCAN_PARAMS);
1715         if (!cp)
1716                 return rp->status;
1717
1718         phy_param = (void *)cp->data;
1719
1720         hci_dev_lock(hdev);
1721
1722         hdev->le_scan_type = phy_param->type;
1723
1724         hci_dev_unlock(hdev);
1725
1726         return rp->status;
1727 }
1728
1729 static bool has_pending_adv_report(struct hci_dev *hdev)
1730 {
1731         struct discovery_state *d = &hdev->discovery;
1732
1733         return bacmp(&d->last_adv_addr, BDADDR_ANY);
1734 }
1735
1736 static void clear_pending_adv_report(struct hci_dev *hdev)
1737 {
1738         struct discovery_state *d = &hdev->discovery;
1739
1740         bacpy(&d->last_adv_addr, BDADDR_ANY);
1741         d->last_adv_data_len = 0;
1742 }
1743
1744 static void store_pending_adv_report(struct hci_dev *hdev, bdaddr_t *bdaddr,
1745                                      u8 bdaddr_type, s8 rssi, u32 flags,
1746                                      u8 *data, u8 len)
1747 {
1748         struct discovery_state *d = &hdev->discovery;
1749
1750         if (len > HCI_MAX_AD_LENGTH)
1751                 return;
1752
1753         bacpy(&d->last_adv_addr, bdaddr);
1754         d->last_adv_addr_type = bdaddr_type;
1755         d->last_adv_rssi = rssi;
1756         d->last_adv_flags = flags;
1757         memcpy(d->last_adv_data, data, len);
1758         d->last_adv_data_len = len;
1759 }
1760
1761 static void le_set_scan_enable_complete(struct hci_dev *hdev, u8 enable)
1762 {
1763         hci_dev_lock(hdev);
1764
1765         switch (enable) {
1766         case LE_SCAN_ENABLE:
1767                 hci_dev_set_flag(hdev, HCI_LE_SCAN);
1768                 if (hdev->le_scan_type == LE_SCAN_ACTIVE)
1769                         clear_pending_adv_report(hdev);
1770                 if (hci_dev_test_flag(hdev, HCI_MESH))
1771                         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
1772                 break;
1773
1774         case LE_SCAN_DISABLE:
1775                 /* We do this here instead of when setting DISCOVERY_STOPPED
1776                  * since the latter would potentially require waiting for
1777                  * inquiry to stop too.
1778                  */
1779                 if (has_pending_adv_report(hdev)) {
1780                         struct discovery_state *d = &hdev->discovery;
1781
1782                         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
1783                                           d->last_adv_addr_type, NULL,
1784                                           d->last_adv_rssi, d->last_adv_flags,
1785                                           d->last_adv_data,
1786                                           d->last_adv_data_len, NULL, 0, 0);
1787                 }
1788
1789                 /* Cancel this timer so that we don't try to disable scanning
1790                  * when it's already disabled.
1791                  */
1792                 cancel_delayed_work(&hdev->le_scan_disable);
1793
1794                 hci_dev_clear_flag(hdev, HCI_LE_SCAN);
1795
1796                 /* The HCI_LE_SCAN_INTERRUPTED flag indicates that we
1797                  * interrupted scanning due to a connect request. Mark
1798                  * therefore discovery as stopped.
1799                  */
1800                 if (hci_dev_test_and_clear_flag(hdev, HCI_LE_SCAN_INTERRUPTED))
1801                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1802                 else if (!hci_dev_test_flag(hdev, HCI_LE_ADV) &&
1803                          hdev->discovery.state == DISCOVERY_FINDING)
1804                         queue_work(hdev->workqueue, &hdev->reenable_adv_work);
1805
1806                 break;
1807
1808         default:
1809                 bt_dev_err(hdev, "use of reserved LE_Scan_Enable param %d",
1810                            enable);
1811                 break;
1812         }
1813
1814         hci_dev_unlock(hdev);
1815 }
1816
1817 static u8 hci_cc_le_set_scan_enable(struct hci_dev *hdev, void *data,
1818                                     struct sk_buff *skb)
1819 {
1820         struct hci_cp_le_set_scan_enable *cp;
1821         struct hci_ev_status *rp = data;
1822
1823         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1824
1825         if (rp->status)
1826                 return rp->status;
1827
1828         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
1829         if (!cp)
1830                 return rp->status;
1831
1832         le_set_scan_enable_complete(hdev, cp->enable);
1833
1834         return rp->status;
1835 }
1836
1837 static u8 hci_cc_le_set_ext_scan_enable(struct hci_dev *hdev, void *data,
1838                                         struct sk_buff *skb)
1839 {
1840         struct hci_cp_le_set_ext_scan_enable *cp;
1841         struct hci_ev_status *rp = data;
1842
1843         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1844
1845         if (rp->status)
1846                 return rp->status;
1847
1848         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_SCAN_ENABLE);
1849         if (!cp)
1850                 return rp->status;
1851
1852         le_set_scan_enable_complete(hdev, cp->enable);
1853
1854         return rp->status;
1855 }
1856
1857 static u8 hci_cc_le_read_num_adv_sets(struct hci_dev *hdev, void *data,
1858                                       struct sk_buff *skb)
1859 {
1860         struct hci_rp_le_read_num_supported_adv_sets *rp = data;
1861
1862         bt_dev_dbg(hdev, "status 0x%2.2x No of Adv sets %u", rp->status,
1863                    rp->num_of_sets);
1864
1865         if (rp->status)
1866                 return rp->status;
1867
1868         hdev->le_num_of_adv_sets = rp->num_of_sets;
1869
1870         return rp->status;
1871 }
1872
1873 static u8 hci_cc_le_read_accept_list_size(struct hci_dev *hdev, void *data,
1874                                           struct sk_buff *skb)
1875 {
1876         struct hci_rp_le_read_accept_list_size *rp = data;
1877
1878         bt_dev_dbg(hdev, "status 0x%2.2x size %u", rp->status, rp->size);
1879
1880         if (rp->status)
1881                 return rp->status;
1882
1883         hdev->le_accept_list_size = rp->size;
1884
1885         return rp->status;
1886 }
1887
1888 static u8 hci_cc_le_clear_accept_list(struct hci_dev *hdev, void *data,
1889                                       struct sk_buff *skb)
1890 {
1891         struct hci_ev_status *rp = data;
1892
1893         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1894
1895         if (rp->status)
1896                 return rp->status;
1897
1898         hci_dev_lock(hdev);
1899         hci_bdaddr_list_clear(&hdev->le_accept_list);
1900         hci_dev_unlock(hdev);
1901
1902         return rp->status;
1903 }
1904
1905 static u8 hci_cc_le_add_to_accept_list(struct hci_dev *hdev, void *data,
1906                                        struct sk_buff *skb)
1907 {
1908         struct hci_cp_le_add_to_accept_list *sent;
1909         struct hci_ev_status *rp = data;
1910
1911         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1912
1913         if (rp->status)
1914                 return rp->status;
1915
1916         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_ACCEPT_LIST);
1917         if (!sent)
1918                 return rp->status;
1919
1920         hci_dev_lock(hdev);
1921         hci_bdaddr_list_add(&hdev->le_accept_list, &sent->bdaddr,
1922                             sent->bdaddr_type);
1923         hci_dev_unlock(hdev);
1924
1925         return rp->status;
1926 }
1927
1928 static u8 hci_cc_le_del_from_accept_list(struct hci_dev *hdev, void *data,
1929                                          struct sk_buff *skb)
1930 {
1931         struct hci_cp_le_del_from_accept_list *sent;
1932         struct hci_ev_status *rp = data;
1933
1934         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1935
1936         if (rp->status)
1937                 return rp->status;
1938
1939         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_ACCEPT_LIST);
1940         if (!sent)
1941                 return rp->status;
1942
1943         hci_dev_lock(hdev);
1944         hci_bdaddr_list_del(&hdev->le_accept_list, &sent->bdaddr,
1945                             sent->bdaddr_type);
1946         hci_dev_unlock(hdev);
1947
1948         return rp->status;
1949 }
1950
1951 static u8 hci_cc_le_read_supported_states(struct hci_dev *hdev, void *data,
1952                                           struct sk_buff *skb)
1953 {
1954         struct hci_rp_le_read_supported_states *rp = data;
1955
1956         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1957
1958         if (rp->status)
1959                 return rp->status;
1960
1961         memcpy(hdev->le_states, rp->le_states, 8);
1962
1963         return rp->status;
1964 }
1965
1966 static u8 hci_cc_le_read_def_data_len(struct hci_dev *hdev, void *data,
1967                                       struct sk_buff *skb)
1968 {
1969         struct hci_rp_le_read_def_data_len *rp = data;
1970
1971         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1972
1973         if (rp->status)
1974                 return rp->status;
1975
1976         hdev->le_def_tx_len = le16_to_cpu(rp->tx_len);
1977         hdev->le_def_tx_time = le16_to_cpu(rp->tx_time);
1978
1979         return rp->status;
1980 }
1981
1982 static u8 hci_cc_le_write_def_data_len(struct hci_dev *hdev, void *data,
1983                                        struct sk_buff *skb)
1984 {
1985         struct hci_cp_le_write_def_data_len *sent;
1986         struct hci_ev_status *rp = data;
1987
1988         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1989
1990         if (rp->status)
1991                 return rp->status;
1992
1993         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_WRITE_DEF_DATA_LEN);
1994         if (!sent)
1995                 return rp->status;
1996
1997         hdev->le_def_tx_len = le16_to_cpu(sent->tx_len);
1998         hdev->le_def_tx_time = le16_to_cpu(sent->tx_time);
1999
2000         return rp->status;
2001 }
2002
2003 static u8 hci_cc_le_add_to_resolv_list(struct hci_dev *hdev, void *data,
2004                                        struct sk_buff *skb)
2005 {
2006         struct hci_cp_le_add_to_resolv_list *sent;
2007         struct hci_ev_status *rp = data;
2008
2009         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2010
2011         if (rp->status)
2012                 return rp->status;
2013
2014         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_RESOLV_LIST);
2015         if (!sent)
2016                 return rp->status;
2017
2018         hci_dev_lock(hdev);
2019         hci_bdaddr_list_add_with_irk(&hdev->le_resolv_list, &sent->bdaddr,
2020                                 sent->bdaddr_type, sent->peer_irk,
2021                                 sent->local_irk);
2022         hci_dev_unlock(hdev);
2023
2024         return rp->status;
2025 }
2026
2027 static u8 hci_cc_le_del_from_resolv_list(struct hci_dev *hdev, void *data,
2028                                          struct sk_buff *skb)
2029 {
2030         struct hci_cp_le_del_from_resolv_list *sent;
2031         struct hci_ev_status *rp = data;
2032
2033         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2034
2035         if (rp->status)
2036                 return rp->status;
2037
2038         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_RESOLV_LIST);
2039         if (!sent)
2040                 return rp->status;
2041
2042         hci_dev_lock(hdev);
2043         hci_bdaddr_list_del_with_irk(&hdev->le_resolv_list, &sent->bdaddr,
2044                             sent->bdaddr_type);
2045         hci_dev_unlock(hdev);
2046
2047         return rp->status;
2048 }
2049
2050 static u8 hci_cc_le_clear_resolv_list(struct hci_dev *hdev, void *data,
2051                                       struct sk_buff *skb)
2052 {
2053         struct hci_ev_status *rp = data;
2054
2055         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2056
2057         if (rp->status)
2058                 return rp->status;
2059
2060         hci_dev_lock(hdev);
2061         hci_bdaddr_list_clear(&hdev->le_resolv_list);
2062         hci_dev_unlock(hdev);
2063
2064         return rp->status;
2065 }
2066
2067 static u8 hci_cc_le_read_resolv_list_size(struct hci_dev *hdev, void *data,
2068                                           struct sk_buff *skb)
2069 {
2070         struct hci_rp_le_read_resolv_list_size *rp = data;
2071
2072         bt_dev_dbg(hdev, "status 0x%2.2x size %u", rp->status, rp->size);
2073
2074         if (rp->status)
2075                 return rp->status;
2076
2077         hdev->le_resolv_list_size = rp->size;
2078
2079         return rp->status;
2080 }
2081
2082 static u8 hci_cc_le_set_addr_resolution_enable(struct hci_dev *hdev, void *data,
2083                                                struct sk_buff *skb)
2084 {
2085         struct hci_ev_status *rp = data;
2086         __u8 *sent;
2087
2088         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2089
2090         if (rp->status)
2091                 return rp->status;
2092
2093         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADDR_RESOLV_ENABLE);
2094         if (!sent)
2095                 return rp->status;
2096
2097         hci_dev_lock(hdev);
2098
2099         if (*sent)
2100                 hci_dev_set_flag(hdev, HCI_LL_RPA_RESOLUTION);
2101         else
2102                 hci_dev_clear_flag(hdev, HCI_LL_RPA_RESOLUTION);
2103
2104         hci_dev_unlock(hdev);
2105
2106         return rp->status;
2107 }
2108
2109 static u8 hci_cc_le_read_max_data_len(struct hci_dev *hdev, void *data,
2110                                       struct sk_buff *skb)
2111 {
2112         struct hci_rp_le_read_max_data_len *rp = data;
2113
2114         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2115
2116         if (rp->status)
2117                 return rp->status;
2118
2119         hdev->le_max_tx_len = le16_to_cpu(rp->tx_len);
2120         hdev->le_max_tx_time = le16_to_cpu(rp->tx_time);
2121         hdev->le_max_rx_len = le16_to_cpu(rp->rx_len);
2122         hdev->le_max_rx_time = le16_to_cpu(rp->rx_time);
2123
2124         return rp->status;
2125 }
2126
2127 static u8 hci_cc_write_le_host_supported(struct hci_dev *hdev, void *data,
2128                                          struct sk_buff *skb)
2129 {
2130         struct hci_cp_write_le_host_supported *sent;
2131         struct hci_ev_status *rp = data;
2132
2133         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2134
2135         if (rp->status)
2136                 return rp->status;
2137
2138         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
2139         if (!sent)
2140                 return rp->status;
2141
2142         hci_dev_lock(hdev);
2143
2144         if (sent->le) {
2145                 hdev->features[1][0] |= LMP_HOST_LE;
2146                 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
2147         } else {
2148                 hdev->features[1][0] &= ~LMP_HOST_LE;
2149                 hci_dev_clear_flag(hdev, HCI_LE_ENABLED);
2150                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
2151         }
2152
2153         if (sent->simul)
2154                 hdev->features[1][0] |= LMP_HOST_LE_BREDR;
2155         else
2156                 hdev->features[1][0] &= ~LMP_HOST_LE_BREDR;
2157
2158         hci_dev_unlock(hdev);
2159
2160         return rp->status;
2161 }
2162
2163 static u8 hci_cc_set_adv_param(struct hci_dev *hdev, void *data,
2164                                struct sk_buff *skb)
2165 {
2166         struct hci_cp_le_set_adv_param *cp;
2167         struct hci_ev_status *rp = data;
2168
2169         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2170
2171         if (rp->status)
2172                 return rp->status;
2173
2174         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_PARAM);
2175         if (!cp)
2176                 return rp->status;
2177
2178         hci_dev_lock(hdev);
2179         hdev->adv_addr_type = cp->own_address_type;
2180         hci_dev_unlock(hdev);
2181
2182         return rp->status;
2183 }
2184
2185 static u8 hci_cc_set_ext_adv_param(struct hci_dev *hdev, void *data,
2186                                    struct sk_buff *skb)
2187 {
2188         struct hci_rp_le_set_ext_adv_params *rp = data;
2189         struct hci_cp_le_set_ext_adv_params *cp;
2190         struct adv_info *adv_instance;
2191
2192         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2193
2194         if (rp->status)
2195                 return rp->status;
2196
2197         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_PARAMS);
2198         if (!cp)
2199                 return rp->status;
2200
2201         hci_dev_lock(hdev);
2202         hdev->adv_addr_type = cp->own_addr_type;
2203         if (!cp->handle) {
2204                 /* Store in hdev for instance 0 */
2205                 hdev->adv_tx_power = rp->tx_power;
2206         } else {
2207                 adv_instance = hci_find_adv_instance(hdev, cp->handle);
2208                 if (adv_instance)
2209                         adv_instance->tx_power = rp->tx_power;
2210         }
2211         /* Update adv data as tx power is known now */
2212         hci_update_adv_data(hdev, cp->handle);
2213
2214         hci_dev_unlock(hdev);
2215
2216         return rp->status;
2217 }
2218
2219 static u8 hci_cc_read_rssi(struct hci_dev *hdev, void *data,
2220                            struct sk_buff *skb)
2221 {
2222         struct hci_rp_read_rssi *rp = data;
2223         struct hci_conn *conn;
2224
2225         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2226
2227         if (rp->status)
2228                 return rp->status;
2229
2230         hci_dev_lock(hdev);
2231
2232         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
2233         if (conn)
2234                 conn->rssi = rp->rssi;
2235
2236         hci_dev_unlock(hdev);
2237
2238         return rp->status;
2239 }
2240
2241 static u8 hci_cc_read_tx_power(struct hci_dev *hdev, void *data,
2242                                struct sk_buff *skb)
2243 {
2244         struct hci_cp_read_tx_power *sent;
2245         struct hci_rp_read_tx_power *rp = data;
2246         struct hci_conn *conn;
2247
2248         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2249
2250         if (rp->status)
2251                 return rp->status;
2252
2253         sent = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
2254         if (!sent)
2255                 return rp->status;
2256
2257         hci_dev_lock(hdev);
2258
2259         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
2260         if (!conn)
2261                 goto unlock;
2262
2263         switch (sent->type) {
2264         case 0x00:
2265                 conn->tx_power = rp->tx_power;
2266                 break;
2267         case 0x01:
2268                 conn->max_tx_power = rp->tx_power;
2269                 break;
2270         }
2271
2272 unlock:
2273         hci_dev_unlock(hdev);
2274         return rp->status;
2275 }
2276
2277 static u8 hci_cc_write_ssp_debug_mode(struct hci_dev *hdev, void *data,
2278                                       struct sk_buff *skb)
2279 {
2280         struct hci_ev_status *rp = data;
2281         u8 *mode;
2282
2283         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2284
2285         if (rp->status)
2286                 return rp->status;
2287
2288         mode = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE);
2289         if (mode)
2290                 hdev->ssp_debug_mode = *mode;
2291
2292         return rp->status;
2293 }
2294
2295 static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
2296 {
2297         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2298
2299         if (status) {
2300                 hci_conn_check_pending(hdev);
2301                 return;
2302         }
2303
2304         set_bit(HCI_INQUIRY, &hdev->flags);
2305 }
2306
2307 static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
2308 {
2309         struct hci_cp_create_conn *cp;
2310         struct hci_conn *conn;
2311
2312         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2313
2314         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
2315         if (!cp)
2316                 return;
2317
2318         hci_dev_lock(hdev);
2319
2320         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2321
2322         bt_dev_dbg(hdev, "bdaddr %pMR hcon %p", &cp->bdaddr, conn);
2323
2324         if (status) {
2325                 if (conn && conn->state == BT_CONNECT) {
2326                         if (status != 0x0c || conn->attempt > 2) {
2327                                 conn->state = BT_CLOSED;
2328                                 hci_connect_cfm(conn, status);
2329                                 hci_conn_del(conn);
2330                         } else
2331                                 conn->state = BT_CONNECT2;
2332                 }
2333         } else {
2334                 if (!conn) {
2335                         conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr,
2336                                             HCI_ROLE_MASTER);
2337                         if (!conn)
2338                                 bt_dev_err(hdev, "no memory for new connection");
2339                 }
2340         }
2341
2342         hci_dev_unlock(hdev);
2343 }
2344
2345 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
2346 {
2347         struct hci_cp_add_sco *cp;
2348         struct hci_conn *acl;
2349         struct hci_link *link;
2350         __u16 handle;
2351
2352         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2353
2354         if (!status)
2355                 return;
2356
2357         cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
2358         if (!cp)
2359                 return;
2360
2361         handle = __le16_to_cpu(cp->handle);
2362
2363         bt_dev_dbg(hdev, "handle 0x%4.4x", handle);
2364
2365         hci_dev_lock(hdev);
2366
2367         acl = hci_conn_hash_lookup_handle(hdev, handle);
2368         if (acl) {
2369                 link = list_first_entry_or_null(&acl->link_list,
2370                                                 struct hci_link, list);
2371                 if (link && link->conn) {
2372                         link->conn->state = BT_CLOSED;
2373
2374                         hci_connect_cfm(link->conn, status);
2375                         hci_conn_del(link->conn);
2376                 }
2377         }
2378
2379         hci_dev_unlock(hdev);
2380 }
2381
2382 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
2383 {
2384         struct hci_cp_auth_requested *cp;
2385         struct hci_conn *conn;
2386
2387         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2388
2389         if (!status)
2390                 return;
2391
2392         cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
2393         if (!cp)
2394                 return;
2395
2396         hci_dev_lock(hdev);
2397
2398         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2399         if (conn) {
2400                 if (conn->state == BT_CONFIG) {
2401                         hci_connect_cfm(conn, status);
2402                         hci_conn_drop(conn);
2403                 }
2404         }
2405
2406         hci_dev_unlock(hdev);
2407 }
2408
2409 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
2410 {
2411         struct hci_cp_set_conn_encrypt *cp;
2412         struct hci_conn *conn;
2413
2414         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2415
2416         if (!status)
2417                 return;
2418
2419         cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
2420         if (!cp)
2421                 return;
2422
2423         hci_dev_lock(hdev);
2424
2425         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2426         if (conn) {
2427                 if (conn->state == BT_CONFIG) {
2428                         hci_connect_cfm(conn, status);
2429                         hci_conn_drop(conn);
2430                 }
2431         }
2432
2433         hci_dev_unlock(hdev);
2434 }
2435
2436 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
2437                                     struct hci_conn *conn)
2438 {
2439         if (conn->state != BT_CONFIG || !conn->out)
2440                 return 0;
2441
2442         if (conn->pending_sec_level == BT_SECURITY_SDP)
2443                 return 0;
2444
2445         /* Only request authentication for SSP connections or non-SSP
2446          * devices with sec_level MEDIUM or HIGH or if MITM protection
2447          * is requested.
2448          */
2449         if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
2450             conn->pending_sec_level != BT_SECURITY_FIPS &&
2451             conn->pending_sec_level != BT_SECURITY_HIGH &&
2452             conn->pending_sec_level != BT_SECURITY_MEDIUM)
2453                 return 0;
2454
2455         return 1;
2456 }
2457
2458 static int hci_resolve_name(struct hci_dev *hdev,
2459                                    struct inquiry_entry *e)
2460 {
2461         struct hci_cp_remote_name_req cp;
2462
2463         memset(&cp, 0, sizeof(cp));
2464
2465         bacpy(&cp.bdaddr, &e->data.bdaddr);
2466         cp.pscan_rep_mode = e->data.pscan_rep_mode;
2467         cp.pscan_mode = e->data.pscan_mode;
2468         cp.clock_offset = e->data.clock_offset;
2469
2470         return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2471 }
2472
2473 static bool hci_resolve_next_name(struct hci_dev *hdev)
2474 {
2475         struct discovery_state *discov = &hdev->discovery;
2476         struct inquiry_entry *e;
2477
2478         if (list_empty(&discov->resolve))
2479                 return false;
2480
2481         /* We should stop if we already spent too much time resolving names. */
2482         if (time_after(jiffies, discov->name_resolve_timeout)) {
2483                 bt_dev_warn_ratelimited(hdev, "Name resolve takes too long.");
2484                 return false;
2485         }
2486
2487         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
2488         if (!e)
2489                 return false;
2490
2491         if (hci_resolve_name(hdev, e) == 0) {
2492                 e->name_state = NAME_PENDING;
2493                 return true;
2494         }
2495
2496         return false;
2497 }
2498
2499 static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
2500                                    bdaddr_t *bdaddr, u8 *name, u8 name_len)
2501 {
2502         struct discovery_state *discov = &hdev->discovery;
2503         struct inquiry_entry *e;
2504
2505         /* Update the mgmt connected state if necessary. Be careful with
2506          * conn objects that exist but are not (yet) connected however.
2507          * Only those in BT_CONFIG or BT_CONNECTED states can be
2508          * considered connected.
2509          */
2510         if (conn &&
2511             (conn->state == BT_CONFIG || conn->state == BT_CONNECTED) &&
2512             !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2513                 mgmt_device_connected(hdev, conn, name, name_len);
2514
2515         if (discov->state == DISCOVERY_STOPPED)
2516                 return;
2517
2518         if (discov->state == DISCOVERY_STOPPING)
2519                 goto discov_complete;
2520
2521         if (discov->state != DISCOVERY_RESOLVING)
2522                 return;
2523
2524         e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
2525         /* If the device was not found in a list of found devices names of which
2526          * are pending. there is no need to continue resolving a next name as it
2527          * will be done upon receiving another Remote Name Request Complete
2528          * Event */
2529         if (!e)
2530                 return;
2531
2532         list_del(&e->list);
2533
2534         e->name_state = name ? NAME_KNOWN : NAME_NOT_KNOWN;
2535         mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00, e->data.rssi,
2536                          name, name_len);
2537
2538         if (hci_resolve_next_name(hdev))
2539                 return;
2540
2541 discov_complete:
2542         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2543 }
2544
2545 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
2546 {
2547         struct hci_cp_remote_name_req *cp;
2548         struct hci_conn *conn;
2549
2550         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2551
2552         /* If successful wait for the name req complete event before
2553          * checking for the need to do authentication */
2554         if (!status)
2555                 return;
2556
2557         cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
2558         if (!cp)
2559                 return;
2560
2561         hci_dev_lock(hdev);
2562
2563         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2564
2565         if (hci_dev_test_flag(hdev, HCI_MGMT))
2566                 hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
2567
2568         if (!conn)
2569                 goto unlock;
2570
2571         if (!hci_outgoing_auth_needed(hdev, conn))
2572                 goto unlock;
2573
2574         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
2575                 struct hci_cp_auth_requested auth_cp;
2576
2577                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
2578
2579                 auth_cp.handle = __cpu_to_le16(conn->handle);
2580                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
2581                              sizeof(auth_cp), &auth_cp);
2582         }
2583
2584 unlock:
2585         hci_dev_unlock(hdev);
2586 }
2587
2588 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
2589 {
2590         struct hci_cp_read_remote_features *cp;
2591         struct hci_conn *conn;
2592
2593         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2594
2595         if (!status)
2596                 return;
2597
2598         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
2599         if (!cp)
2600                 return;
2601
2602         hci_dev_lock(hdev);
2603
2604         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2605         if (conn) {
2606                 if (conn->state == BT_CONFIG) {
2607                         hci_connect_cfm(conn, status);
2608                         hci_conn_drop(conn);
2609                 }
2610         }
2611
2612         hci_dev_unlock(hdev);
2613 }
2614
2615 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
2616 {
2617         struct hci_cp_read_remote_ext_features *cp;
2618         struct hci_conn *conn;
2619
2620         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2621
2622         if (!status)
2623                 return;
2624
2625         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
2626         if (!cp)
2627                 return;
2628
2629         hci_dev_lock(hdev);
2630
2631         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2632         if (conn) {
2633                 if (conn->state == BT_CONFIG) {
2634                         hci_connect_cfm(conn, status);
2635                         hci_conn_drop(conn);
2636                 }
2637         }
2638
2639         hci_dev_unlock(hdev);
2640 }
2641
2642 static void hci_setup_sync_conn_status(struct hci_dev *hdev, __u16 handle,
2643                                        __u8 status)
2644 {
2645         struct hci_conn *acl;
2646         struct hci_link *link;
2647
2648         bt_dev_dbg(hdev, "handle 0x%4.4x status 0x%2.2x", handle, status);
2649
2650         hci_dev_lock(hdev);
2651
2652         acl = hci_conn_hash_lookup_handle(hdev, handle);
2653         if (acl) {
2654                 link = list_first_entry_or_null(&acl->link_list,
2655                                                 struct hci_link, list);
2656                 if (link && link->conn) {
2657                         link->conn->state = BT_CLOSED;
2658
2659                         hci_connect_cfm(link->conn, status);
2660                         hci_conn_del(link->conn);
2661                 }
2662         }
2663
2664         hci_dev_unlock(hdev);
2665 }
2666
2667 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
2668 {
2669         struct hci_cp_setup_sync_conn *cp;
2670
2671         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2672
2673         if (!status)
2674                 return;
2675
2676         cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
2677         if (!cp)
2678                 return;
2679
2680         hci_setup_sync_conn_status(hdev, __le16_to_cpu(cp->handle), status);
2681 }
2682
2683 static void hci_cs_enhanced_setup_sync_conn(struct hci_dev *hdev, __u8 status)
2684 {
2685         struct hci_cp_enhanced_setup_sync_conn *cp;
2686
2687         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2688
2689         if (!status)
2690                 return;
2691
2692         cp = hci_sent_cmd_data(hdev, HCI_OP_ENHANCED_SETUP_SYNC_CONN);
2693         if (!cp)
2694                 return;
2695
2696         hci_setup_sync_conn_status(hdev, __le16_to_cpu(cp->handle), status);
2697 }
2698
2699 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
2700 {
2701         struct hci_cp_sniff_mode *cp;
2702         struct hci_conn *conn;
2703
2704         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2705
2706         if (!status)
2707                 return;
2708
2709         cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
2710         if (!cp)
2711                 return;
2712
2713         hci_dev_lock(hdev);
2714
2715         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2716         if (conn) {
2717                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
2718
2719                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2720                         hci_sco_setup(conn, status);
2721         }
2722
2723         hci_dev_unlock(hdev);
2724 }
2725
2726 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
2727 {
2728         struct hci_cp_exit_sniff_mode *cp;
2729         struct hci_conn *conn;
2730
2731         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2732
2733         if (!status)
2734                 return;
2735
2736         cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
2737         if (!cp)
2738                 return;
2739
2740         hci_dev_lock(hdev);
2741
2742         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2743         if (conn) {
2744                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
2745
2746                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2747                         hci_sco_setup(conn, status);
2748         }
2749
2750         hci_dev_unlock(hdev);
2751 }
2752
2753 static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
2754 {
2755         struct hci_cp_disconnect *cp;
2756         struct hci_conn_params *params;
2757         struct hci_conn *conn;
2758         bool mgmt_conn;
2759
2760         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2761
2762         /* Wait for HCI_EV_DISCONN_COMPLETE if status 0x00 and not suspended
2763          * otherwise cleanup the connection immediately.
2764          */
2765         if (!status && !hdev->suspended)
2766                 return;
2767
2768         cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
2769         if (!cp)
2770                 return;
2771
2772         hci_dev_lock(hdev);
2773
2774         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2775         if (!conn)
2776                 goto unlock;
2777
2778         if (status) {
2779                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2780                                        conn->dst_type, status);
2781
2782                 if (conn->type == LE_LINK && conn->role == HCI_ROLE_SLAVE) {
2783                         hdev->cur_adv_instance = conn->adv_instance;
2784                         hci_enable_advertising(hdev);
2785                 }
2786
2787                 /* Inform sockets conn is gone before we delete it */
2788                 hci_disconn_cfm(conn, HCI_ERROR_UNSPECIFIED);
2789
2790                 goto done;
2791         }
2792
2793         mgmt_conn = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags);
2794
2795         if (conn->type == ACL_LINK) {
2796                 if (test_and_clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
2797                         hci_remove_link_key(hdev, &conn->dst);
2798         }
2799
2800         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
2801         if (params) {
2802                 switch (params->auto_connect) {
2803                 case HCI_AUTO_CONN_LINK_LOSS:
2804                         if (cp->reason != HCI_ERROR_CONNECTION_TIMEOUT)
2805                                 break;
2806                         fallthrough;
2807
2808                 case HCI_AUTO_CONN_DIRECT:
2809                 case HCI_AUTO_CONN_ALWAYS:
2810                         hci_pend_le_list_del_init(params);
2811                         hci_pend_le_list_add(params, &hdev->pend_le_conns);
2812                         break;
2813
2814                 default:
2815                         break;
2816                 }
2817         }
2818
2819         mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type,
2820                                  cp->reason, mgmt_conn);
2821
2822         hci_disconn_cfm(conn, cp->reason);
2823
2824 done:
2825         /* If the disconnection failed for any reason, the upper layer
2826          * does not retry to disconnect in current implementation.
2827          * Hence, we need to do some basic cleanup here and re-enable
2828          * advertising if necessary.
2829          */
2830         hci_conn_del(conn);
2831 unlock:
2832         hci_dev_unlock(hdev);
2833 }
2834
2835 static u8 ev_bdaddr_type(struct hci_dev *hdev, u8 type, bool *resolved)
2836 {
2837         /* When using controller based address resolution, then the new
2838          * address types 0x02 and 0x03 are used. These types need to be
2839          * converted back into either public address or random address type
2840          */
2841         switch (type) {
2842         case ADDR_LE_DEV_PUBLIC_RESOLVED:
2843                 if (resolved)
2844                         *resolved = true;
2845                 return ADDR_LE_DEV_PUBLIC;
2846         case ADDR_LE_DEV_RANDOM_RESOLVED:
2847                 if (resolved)
2848                         *resolved = true;
2849                 return ADDR_LE_DEV_RANDOM;
2850         }
2851
2852         if (resolved)
2853                 *resolved = false;
2854         return type;
2855 }
2856
2857 static void cs_le_create_conn(struct hci_dev *hdev, bdaddr_t *peer_addr,
2858                               u8 peer_addr_type, u8 own_address_type,
2859                               u8 filter_policy)
2860 {
2861         struct hci_conn *conn;
2862
2863         conn = hci_conn_hash_lookup_le(hdev, peer_addr,
2864                                        peer_addr_type);
2865         if (!conn)
2866                 return;
2867
2868         own_address_type = ev_bdaddr_type(hdev, own_address_type, NULL);
2869
2870         /* Store the initiator and responder address information which
2871          * is needed for SMP. These values will not change during the
2872          * lifetime of the connection.
2873          */
2874         conn->init_addr_type = own_address_type;
2875         if (own_address_type == ADDR_LE_DEV_RANDOM)
2876                 bacpy(&conn->init_addr, &hdev->random_addr);
2877         else
2878                 bacpy(&conn->init_addr, &hdev->bdaddr);
2879
2880         conn->resp_addr_type = peer_addr_type;
2881         bacpy(&conn->resp_addr, peer_addr);
2882 }
2883
2884 static void hci_cs_le_create_conn(struct hci_dev *hdev, u8 status)
2885 {
2886         struct hci_cp_le_create_conn *cp;
2887
2888         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2889
2890         /* All connection failure handling is taken care of by the
2891          * hci_conn_failed function which is triggered by the HCI
2892          * request completion callbacks used for connecting.
2893          */
2894         if (status)
2895                 return;
2896
2897         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
2898         if (!cp)
2899                 return;
2900
2901         hci_dev_lock(hdev);
2902
2903         cs_le_create_conn(hdev, &cp->peer_addr, cp->peer_addr_type,
2904                           cp->own_address_type, cp->filter_policy);
2905
2906         hci_dev_unlock(hdev);
2907 }
2908
2909 static void hci_cs_le_ext_create_conn(struct hci_dev *hdev, u8 status)
2910 {
2911         struct hci_cp_le_ext_create_conn *cp;
2912
2913         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2914
2915         /* All connection failure handling is taken care of by the
2916          * hci_conn_failed function which is triggered by the HCI
2917          * request completion callbacks used for connecting.
2918          */
2919         if (status)
2920                 return;
2921
2922         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_EXT_CREATE_CONN);
2923         if (!cp)
2924                 return;
2925
2926         hci_dev_lock(hdev);
2927
2928         cs_le_create_conn(hdev, &cp->peer_addr, cp->peer_addr_type,
2929                           cp->own_addr_type, cp->filter_policy);
2930
2931         hci_dev_unlock(hdev);
2932 }
2933
2934 static void hci_cs_le_read_remote_features(struct hci_dev *hdev, u8 status)
2935 {
2936         struct hci_cp_le_read_remote_features *cp;
2937         struct hci_conn *conn;
2938
2939         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2940
2941         if (!status)
2942                 return;
2943
2944         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_READ_REMOTE_FEATURES);
2945         if (!cp)
2946                 return;
2947
2948         hci_dev_lock(hdev);
2949
2950         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2951         if (conn) {
2952                 if (conn->state == BT_CONFIG) {
2953                         hci_connect_cfm(conn, status);
2954                         hci_conn_drop(conn);
2955                 }
2956         }
2957
2958         hci_dev_unlock(hdev);
2959 }
2960
2961 static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
2962 {
2963         struct hci_cp_le_start_enc *cp;
2964         struct hci_conn *conn;
2965
2966         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2967
2968         if (!status)
2969                 return;
2970
2971         hci_dev_lock(hdev);
2972
2973         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_START_ENC);
2974         if (!cp)
2975                 goto unlock;
2976
2977         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2978         if (!conn)
2979                 goto unlock;
2980
2981         if (conn->state != BT_CONNECTED)
2982                 goto unlock;
2983
2984         hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2985         hci_conn_drop(conn);
2986
2987 unlock:
2988         hci_dev_unlock(hdev);
2989 }
2990
2991 static void hci_cs_switch_role(struct hci_dev *hdev, u8 status)
2992 {
2993         struct hci_cp_switch_role *cp;
2994         struct hci_conn *conn;
2995
2996         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2997
2998         if (!status)
2999                 return;
3000
3001         cp = hci_sent_cmd_data(hdev, HCI_OP_SWITCH_ROLE);
3002         if (!cp)
3003                 return;
3004
3005         hci_dev_lock(hdev);
3006
3007         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
3008         if (conn)
3009                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
3010
3011         hci_dev_unlock(hdev);
3012 }
3013
3014 static void hci_inquiry_complete_evt(struct hci_dev *hdev, void *data,
3015                                      struct sk_buff *skb)
3016 {
3017         struct hci_ev_status *ev = data;
3018         struct discovery_state *discov = &hdev->discovery;
3019         struct inquiry_entry *e;
3020
3021         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
3022
3023         hci_conn_check_pending(hdev);
3024
3025         if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
3026                 return;
3027
3028         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
3029         wake_up_bit(&hdev->flags, HCI_INQUIRY);
3030
3031         if (!hci_dev_test_flag(hdev, HCI_MGMT))
3032                 return;
3033
3034         hci_dev_lock(hdev);
3035
3036         if (discov->state != DISCOVERY_FINDING)
3037                 goto unlock;
3038
3039         if (list_empty(&discov->resolve)) {
3040                 /* When BR/EDR inquiry is active and no LE scanning is in
3041                  * progress, then change discovery state to indicate completion.
3042                  *
3043                  * When running LE scanning and BR/EDR inquiry simultaneously
3044                  * and the LE scan already finished, then change the discovery
3045                  * state to indicate completion.
3046                  */
3047                 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
3048                     !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
3049                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3050                 goto unlock;
3051         }
3052
3053         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
3054         if (e && hci_resolve_name(hdev, e) == 0) {
3055                 e->name_state = NAME_PENDING;
3056                 hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
3057                 discov->name_resolve_timeout = jiffies + NAME_RESOLVE_DURATION;
3058         } else {
3059                 /* When BR/EDR inquiry is active and no LE scanning is in
3060                  * progress, then change discovery state to indicate completion.
3061                  *
3062                  * When running LE scanning and BR/EDR inquiry simultaneously
3063                  * and the LE scan already finished, then change the discovery
3064                  * state to indicate completion.
3065                  */
3066                 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
3067                     !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
3068                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3069         }
3070
3071 unlock:
3072         hci_dev_unlock(hdev);
3073 }
3074
3075 static void hci_inquiry_result_evt(struct hci_dev *hdev, void *edata,
3076                                    struct sk_buff *skb)
3077 {
3078         struct hci_ev_inquiry_result *ev = edata;
3079         struct inquiry_data data;
3080         int i;
3081
3082         if (!hci_ev_skb_pull(hdev, skb, HCI_EV_INQUIRY_RESULT,
3083                              flex_array_size(ev, info, ev->num)))
3084                 return;
3085
3086         bt_dev_dbg(hdev, "num %d", ev->num);
3087
3088         if (!ev->num)
3089                 return;
3090
3091         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
3092                 return;
3093
3094         hci_dev_lock(hdev);
3095
3096         for (i = 0; i < ev->num; i++) {
3097                 struct inquiry_info *info = &ev->info[i];
3098                 u32 flags;
3099
3100                 bacpy(&data.bdaddr, &info->bdaddr);
3101                 data.pscan_rep_mode     = info->pscan_rep_mode;
3102                 data.pscan_period_mode  = info->pscan_period_mode;
3103                 data.pscan_mode         = info->pscan_mode;
3104                 memcpy(data.dev_class, info->dev_class, 3);
3105                 data.clock_offset       = info->clock_offset;
3106                 data.rssi               = HCI_RSSI_INVALID;
3107                 data.ssp_mode           = 0x00;
3108
3109                 flags = hci_inquiry_cache_update(hdev, &data, false);
3110
3111                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
3112                                   info->dev_class, HCI_RSSI_INVALID,
3113                                   flags, NULL, 0, NULL, 0, 0);
3114         }
3115
3116         hci_dev_unlock(hdev);
3117 }
3118
3119 static void hci_conn_complete_evt(struct hci_dev *hdev, void *data,
3120                                   struct sk_buff *skb)
3121 {
3122         struct hci_ev_conn_complete *ev = data;
3123         struct hci_conn *conn;
3124         u8 status = ev->status;
3125
3126         bt_dev_dbg(hdev, "status 0x%2.2x", status);
3127
3128         hci_dev_lock(hdev);
3129
3130         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
3131         if (!conn) {
3132                 /* In case of error status and there is no connection pending
3133                  * just unlock as there is nothing to cleanup.
3134                  */
3135                 if (ev->status)
3136                         goto unlock;
3137
3138                 /* Connection may not exist if auto-connected. Check the bredr
3139                  * allowlist to see if this device is allowed to auto connect.
3140                  * If link is an ACL type, create a connection class
3141                  * automatically.
3142                  *
3143                  * Auto-connect will only occur if the event filter is
3144                  * programmed with a given address. Right now, event filter is
3145                  * only used during suspend.
3146                  */
3147                 if (ev->link_type == ACL_LINK &&
3148                     hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
3149                                                       &ev->bdaddr,
3150                                                       BDADDR_BREDR)) {
3151                         conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr,
3152                                             HCI_ROLE_SLAVE);
3153                         if (!conn) {
3154                                 bt_dev_err(hdev, "no memory for new conn");
3155                                 goto unlock;
3156                         }
3157                 } else {
3158                         if (ev->link_type != SCO_LINK)
3159                                 goto unlock;
3160
3161                         conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK,
3162                                                        &ev->bdaddr);
3163                         if (!conn)
3164                                 goto unlock;
3165
3166                         conn->type = SCO_LINK;
3167                 }
3168         }
3169
3170         /* The HCI_Connection_Complete event is only sent once per connection.
3171          * Processing it more than once per connection can corrupt kernel memory.
3172          *
3173          * As the connection handle is set here for the first time, it indicates
3174          * whether the connection is already set up.
3175          */
3176         if (conn->handle != HCI_CONN_HANDLE_UNSET) {
3177                 bt_dev_err(hdev, "Ignoring HCI_Connection_Complete for existing connection");
3178                 goto unlock;
3179         }
3180
3181         if (!status) {
3182                 conn->handle = __le16_to_cpu(ev->handle);
3183                 if (conn->handle > HCI_CONN_HANDLE_MAX) {
3184                         bt_dev_err(hdev, "Invalid handle: 0x%4.4x > 0x%4.4x",
3185                                    conn->handle, HCI_CONN_HANDLE_MAX);
3186                         status = HCI_ERROR_INVALID_PARAMETERS;
3187                         goto done;
3188                 }
3189
3190                 if (conn->type == ACL_LINK) {
3191                         conn->state = BT_CONFIG;
3192                         hci_conn_hold(conn);
3193
3194                         if (!conn->out && !hci_conn_ssp_enabled(conn) &&
3195                             !hci_find_link_key(hdev, &ev->bdaddr))
3196                                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
3197                         else
3198                                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3199                 } else
3200                         conn->state = BT_CONNECTED;
3201
3202                 hci_debugfs_create_conn(conn);
3203                 hci_conn_add_sysfs(conn);
3204
3205                 if (test_bit(HCI_AUTH, &hdev->flags))
3206                         set_bit(HCI_CONN_AUTH, &conn->flags);
3207
3208                 if (test_bit(HCI_ENCRYPT, &hdev->flags))
3209                         set_bit(HCI_CONN_ENCRYPT, &conn->flags);
3210
3211                 /* Get remote features */
3212                 if (conn->type == ACL_LINK) {
3213                         struct hci_cp_read_remote_features cp;
3214                         cp.handle = ev->handle;
3215                         hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
3216                                      sizeof(cp), &cp);
3217
3218                         hci_update_scan(hdev);
3219                 }
3220
3221                 /* Set packet type for incoming connection */
3222                 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
3223                         struct hci_cp_change_conn_ptype cp;
3224                         cp.handle = ev->handle;
3225                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
3226                         hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
3227                                      &cp);
3228                 }
3229         }
3230
3231         if (conn->type == ACL_LINK)
3232                 hci_sco_setup(conn, ev->status);
3233
3234 done:
3235         if (status) {
3236                 hci_conn_failed(conn, status);
3237         } else if (ev->link_type == SCO_LINK) {
3238                 switch (conn->setting & SCO_AIRMODE_MASK) {
3239                 case SCO_AIRMODE_CVSD:
3240                         if (hdev->notify)
3241                                 hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_CVSD);
3242                         break;
3243                 }
3244
3245                 hci_connect_cfm(conn, status);
3246         }
3247
3248 unlock:
3249         hci_dev_unlock(hdev);
3250
3251         hci_conn_check_pending(hdev);
3252 }
3253
3254 static void hci_reject_conn(struct hci_dev *hdev, bdaddr_t *bdaddr)
3255 {
3256         struct hci_cp_reject_conn_req cp;
3257
3258         bacpy(&cp.bdaddr, bdaddr);
3259         cp.reason = HCI_ERROR_REJ_BAD_ADDR;
3260         hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
3261 }
3262
3263 static void hci_conn_request_evt(struct hci_dev *hdev, void *data,
3264                                  struct sk_buff *skb)
3265 {
3266         struct hci_ev_conn_request *ev = data;
3267         int mask = hdev->link_mode;
3268         struct inquiry_entry *ie;
3269         struct hci_conn *conn;
3270         __u8 flags = 0;
3271
3272         bt_dev_dbg(hdev, "bdaddr %pMR type 0x%x", &ev->bdaddr, ev->link_type);
3273
3274         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
3275                                       &flags);
3276
3277         if (!(mask & HCI_LM_ACCEPT)) {
3278                 hci_reject_conn(hdev, &ev->bdaddr);
3279                 return;
3280         }
3281
3282         hci_dev_lock(hdev);
3283
3284         if (hci_bdaddr_list_lookup(&hdev->reject_list, &ev->bdaddr,
3285                                    BDADDR_BREDR)) {
3286                 hci_reject_conn(hdev, &ev->bdaddr);
3287                 goto unlock;
3288         }
3289
3290         /* Require HCI_CONNECTABLE or an accept list entry to accept the
3291          * connection. These features are only touched through mgmt so
3292          * only do the checks if HCI_MGMT is set.
3293          */
3294         if (hci_dev_test_flag(hdev, HCI_MGMT) &&
3295             !hci_dev_test_flag(hdev, HCI_CONNECTABLE) &&
3296             !hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, &ev->bdaddr,
3297                                                BDADDR_BREDR)) {
3298                 hci_reject_conn(hdev, &ev->bdaddr);
3299                 goto unlock;
3300         }
3301
3302         /* Connection accepted */
3303
3304         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
3305         if (ie)
3306                 memcpy(ie->data.dev_class, ev->dev_class, 3);
3307
3308         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
3309                         &ev->bdaddr);
3310         if (!conn) {
3311                 conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr,
3312                                     HCI_ROLE_SLAVE);
3313                 if (!conn) {
3314                         bt_dev_err(hdev, "no memory for new connection");
3315                         goto unlock;
3316                 }
3317         }
3318
3319         memcpy(conn->dev_class, ev->dev_class, 3);
3320
3321         hci_dev_unlock(hdev);
3322
3323         if (ev->link_type == ACL_LINK ||
3324             (!(flags & HCI_PROTO_DEFER) && !lmp_esco_capable(hdev))) {
3325                 struct hci_cp_accept_conn_req cp;
3326                 conn->state = BT_CONNECT;
3327
3328                 bacpy(&cp.bdaddr, &ev->bdaddr);
3329
3330                 if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
3331                         cp.role = 0x00; /* Become central */
3332                 else
3333                         cp.role = 0x01; /* Remain peripheral */
3334
3335                 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
3336         } else if (!(flags & HCI_PROTO_DEFER)) {
3337                 struct hci_cp_accept_sync_conn_req cp;
3338                 conn->state = BT_CONNECT;
3339
3340                 bacpy(&cp.bdaddr, &ev->bdaddr);
3341                 cp.pkt_type = cpu_to_le16(conn->pkt_type);
3342
3343                 cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
3344                 cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
3345                 cp.max_latency    = cpu_to_le16(0xffff);
3346                 cp.content_format = cpu_to_le16(hdev->voice_setting);
3347                 cp.retrans_effort = 0xff;
3348
3349                 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ, sizeof(cp),
3350                              &cp);
3351         } else {
3352                 conn->state = BT_CONNECT2;
3353                 hci_connect_cfm(conn, 0);
3354         }
3355
3356         return;
3357 unlock:
3358         hci_dev_unlock(hdev);
3359 }
3360
3361 static u8 hci_to_mgmt_reason(u8 err)
3362 {
3363         switch (err) {
3364         case HCI_ERROR_CONNECTION_TIMEOUT:
3365                 return MGMT_DEV_DISCONN_TIMEOUT;
3366         case HCI_ERROR_REMOTE_USER_TERM:
3367         case HCI_ERROR_REMOTE_LOW_RESOURCES:
3368         case HCI_ERROR_REMOTE_POWER_OFF:
3369                 return MGMT_DEV_DISCONN_REMOTE;
3370         case HCI_ERROR_LOCAL_HOST_TERM:
3371                 return MGMT_DEV_DISCONN_LOCAL_HOST;
3372         default:
3373                 return MGMT_DEV_DISCONN_UNKNOWN;
3374         }
3375 }
3376
3377 static void hci_disconn_complete_evt(struct hci_dev *hdev, void *data,
3378                                      struct sk_buff *skb)
3379 {
3380         struct hci_ev_disconn_complete *ev = data;
3381         u8 reason;
3382         struct hci_conn_params *params;
3383         struct hci_conn *conn;
3384         bool mgmt_connected;
3385
3386         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
3387
3388         hci_dev_lock(hdev);
3389
3390         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3391         if (!conn)
3392                 goto unlock;
3393
3394         if (ev->status) {
3395                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
3396                                        conn->dst_type, ev->status);
3397                 goto unlock;
3398         }
3399
3400         conn->state = BT_CLOSED;
3401
3402         mgmt_connected = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags);
3403
3404         if (test_bit(HCI_CONN_AUTH_FAILURE, &conn->flags))
3405                 reason = MGMT_DEV_DISCONN_AUTH_FAILURE;
3406         else
3407                 reason = hci_to_mgmt_reason(ev->reason);
3408
3409         mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type,
3410                                 reason, mgmt_connected);
3411
3412         if (conn->type == ACL_LINK) {
3413                 if (test_and_clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
3414                         hci_remove_link_key(hdev, &conn->dst);
3415
3416                 hci_update_scan(hdev);
3417         }
3418
3419         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
3420         if (params) {
3421                 switch (params->auto_connect) {
3422                 case HCI_AUTO_CONN_LINK_LOSS:
3423                         if (ev->reason != HCI_ERROR_CONNECTION_TIMEOUT)
3424                                 break;
3425                         fallthrough;
3426
3427                 case HCI_AUTO_CONN_DIRECT:
3428                 case HCI_AUTO_CONN_ALWAYS:
3429                         hci_pend_le_list_del_init(params);
3430                         hci_pend_le_list_add(params, &hdev->pend_le_conns);
3431                         hci_update_passive_scan(hdev);
3432                         break;
3433
3434                 default:
3435                         break;
3436                 }
3437         }
3438
3439         hci_disconn_cfm(conn, ev->reason);
3440
3441         /* Re-enable advertising if necessary, since it might
3442          * have been disabled by the connection. From the
3443          * HCI_LE_Set_Advertise_Enable command description in
3444          * the core specification (v4.0):
3445          * "The Controller shall continue advertising until the Host
3446          * issues an LE_Set_Advertise_Enable command with
3447          * Advertising_Enable set to 0x00 (Advertising is disabled)
3448          * or until a connection is created or until the Advertising
3449          * is timed out due to Directed Advertising."
3450          */
3451         if (conn->type == LE_LINK && conn->role == HCI_ROLE_SLAVE) {
3452                 hdev->cur_adv_instance = conn->adv_instance;
3453                 hci_enable_advertising(hdev);
3454         }
3455
3456         hci_conn_del(conn);
3457
3458 unlock:
3459         hci_dev_unlock(hdev);
3460 }
3461
3462 static void hci_auth_complete_evt(struct hci_dev *hdev, void *data,
3463                                   struct sk_buff *skb)
3464 {
3465         struct hci_ev_auth_complete *ev = data;
3466         struct hci_conn *conn;
3467
3468         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
3469
3470         hci_dev_lock(hdev);
3471
3472         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3473         if (!conn)
3474                 goto unlock;
3475
3476         if (!ev->status) {
3477                 clear_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
3478
3479                 if (!hci_conn_ssp_enabled(conn) &&
3480                     test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
3481                         bt_dev_info(hdev, "re-auth of legacy device is not possible.");
3482                 } else {
3483                         set_bit(HCI_CONN_AUTH, &conn->flags);
3484                         conn->sec_level = conn->pending_sec_level;
3485                 }
3486         } else {
3487                 if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
3488                         set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
3489
3490                 mgmt_auth_failed(conn, ev->status);
3491         }
3492
3493         clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
3494         clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
3495
3496         if (conn->state == BT_CONFIG) {
3497                 if (!ev->status && hci_conn_ssp_enabled(conn)) {
3498                         struct hci_cp_set_conn_encrypt cp;
3499                         cp.handle  = ev->handle;
3500                         cp.encrypt = 0x01;
3501                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
3502                                      &cp);
3503                 } else {
3504                         conn->state = BT_CONNECTED;
3505                         hci_connect_cfm(conn, ev->status);
3506                         hci_conn_drop(conn);
3507                 }
3508         } else {
3509                 hci_auth_cfm(conn, ev->status);
3510
3511                 hci_conn_hold(conn);
3512                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3513                 hci_conn_drop(conn);
3514         }
3515
3516         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
3517                 if (!ev->status) {
3518                         struct hci_cp_set_conn_encrypt cp;
3519                         cp.handle  = ev->handle;
3520                         cp.encrypt = 0x01;
3521                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
3522                                      &cp);
3523                 } else {
3524                         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3525                         hci_encrypt_cfm(conn, ev->status);
3526                 }
3527         }
3528
3529 unlock:
3530         hci_dev_unlock(hdev);
3531 }
3532
3533 static void hci_remote_name_evt(struct hci_dev *hdev, void *data,
3534                                 struct sk_buff *skb)
3535 {
3536         struct hci_ev_remote_name *ev = data;
3537         struct hci_conn *conn;
3538
3539         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
3540
3541         hci_conn_check_pending(hdev);
3542
3543         hci_dev_lock(hdev);
3544
3545         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3546
3547         if (!hci_dev_test_flag(hdev, HCI_MGMT))
3548                 goto check_auth;
3549
3550         if (ev->status == 0)
3551                 hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
3552                                        strnlen(ev->name, HCI_MAX_NAME_LENGTH));
3553         else
3554                 hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
3555
3556 check_auth:
3557         if (!conn)
3558                 goto unlock;
3559
3560         if (!hci_outgoing_auth_needed(hdev, conn))
3561                 goto unlock;
3562
3563         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
3564                 struct hci_cp_auth_requested cp;
3565
3566                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
3567
3568                 cp.handle = __cpu_to_le16(conn->handle);
3569                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
3570         }
3571
3572 unlock:
3573         hci_dev_unlock(hdev);
3574 }
3575
3576 static void hci_encrypt_change_evt(struct hci_dev *hdev, void *data,
3577                                    struct sk_buff *skb)
3578 {
3579         struct hci_ev_encrypt_change *ev = data;
3580         struct hci_conn *conn;
3581
3582         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
3583
3584         hci_dev_lock(hdev);
3585
3586         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3587         if (!conn)
3588                 goto unlock;
3589
3590         if (!ev->status) {
3591                 if (ev->encrypt) {
3592                         /* Encryption implies authentication */
3593                         set_bit(HCI_CONN_AUTH, &conn->flags);
3594                         set_bit(HCI_CONN_ENCRYPT, &conn->flags);
3595                         conn->sec_level = conn->pending_sec_level;
3596
3597                         /* P-256 authentication key implies FIPS */
3598                         if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256)
3599                                 set_bit(HCI_CONN_FIPS, &conn->flags);
3600
3601                         if ((conn->type == ACL_LINK && ev->encrypt == 0x02) ||
3602                             conn->type == LE_LINK)
3603                                 set_bit(HCI_CONN_AES_CCM, &conn->flags);
3604                 } else {
3605                         clear_bit(HCI_CONN_ENCRYPT, &conn->flags);
3606                         clear_bit(HCI_CONN_AES_CCM, &conn->flags);
3607                 }
3608         }
3609
3610         /* We should disregard the current RPA and generate a new one
3611          * whenever the encryption procedure fails.
3612          */
3613         if (ev->status && conn->type == LE_LINK) {
3614                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
3615                 hci_adv_instances_set_rpa_expired(hdev, true);
3616         }
3617
3618         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3619
3620         /* Check link security requirements are met */
3621         if (!hci_conn_check_link_mode(conn))
3622                 ev->status = HCI_ERROR_AUTH_FAILURE;
3623
3624         if (ev->status && conn->state == BT_CONNECTED) {
3625                 if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
3626                         set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
3627
3628                 /* Notify upper layers so they can cleanup before
3629                  * disconnecting.
3630                  */
3631                 hci_encrypt_cfm(conn, ev->status);
3632                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
3633                 hci_conn_drop(conn);
3634                 goto unlock;
3635         }
3636
3637         /* Try reading the encryption key size for encrypted ACL links */
3638         if (!ev->status && ev->encrypt && conn->type == ACL_LINK) {
3639                 struct hci_cp_read_enc_key_size cp;
3640
3641                 /* Only send HCI_Read_Encryption_Key_Size if the
3642                  * controller really supports it. If it doesn't, assume
3643                  * the default size (16).
3644                  */
3645                 if (!(hdev->commands[20] & 0x10)) {
3646                         conn->enc_key_size = HCI_LINK_KEY_SIZE;
3647                         goto notify;
3648                 }
3649
3650                 cp.handle = cpu_to_le16(conn->handle);
3651                 if (hci_send_cmd(hdev, HCI_OP_READ_ENC_KEY_SIZE,
3652                                  sizeof(cp), &cp)) {
3653                         bt_dev_err(hdev, "sending read key size failed");
3654                         conn->enc_key_size = HCI_LINK_KEY_SIZE;
3655                         goto notify;
3656                 }
3657
3658                 goto unlock;
3659         }
3660
3661         /* Set the default Authenticated Payload Timeout after
3662          * an LE Link is established. As per Core Spec v5.0, Vol 2, Part B
3663          * Section 3.3, the HCI command WRITE_AUTH_PAYLOAD_TIMEOUT should be
3664          * sent when the link is active and Encryption is enabled, the conn
3665          * type can be either LE or ACL and controller must support LMP Ping.
3666          * Ensure for AES-CCM encryption as well.
3667          */
3668         if (test_bit(HCI_CONN_ENCRYPT, &conn->flags) &&
3669             test_bit(HCI_CONN_AES_CCM, &conn->flags) &&
3670             ((conn->type == ACL_LINK && lmp_ping_capable(hdev)) ||
3671              (conn->type == LE_LINK && (hdev->le_features[0] & HCI_LE_PING)))) {
3672                 struct hci_cp_write_auth_payload_to cp;
3673
3674                 cp.handle = cpu_to_le16(conn->handle);
3675                 cp.timeout = cpu_to_le16(hdev->auth_payload_timeout);
3676                 if (hci_send_cmd(conn->hdev, HCI_OP_WRITE_AUTH_PAYLOAD_TO,
3677                                  sizeof(cp), &cp)) {
3678                         bt_dev_err(hdev, "write auth payload timeout failed");
3679                         goto notify;
3680                 }
3681
3682                 goto unlock;
3683         }
3684
3685 notify:
3686         hci_encrypt_cfm(conn, ev->status);
3687
3688 unlock:
3689         hci_dev_unlock(hdev);
3690 }
3691
3692 static void hci_change_link_key_complete_evt(struct hci_dev *hdev, void *data,
3693                                              struct sk_buff *skb)
3694 {
3695         struct hci_ev_change_link_key_complete *ev = data;
3696         struct hci_conn *conn;
3697
3698         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
3699
3700         hci_dev_lock(hdev);
3701
3702         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3703         if (conn) {
3704                 if (!ev->status)
3705                         set_bit(HCI_CONN_SECURE, &conn->flags);
3706
3707                 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
3708
3709                 hci_key_change_cfm(conn, ev->status);
3710         }
3711
3712         hci_dev_unlock(hdev);
3713 }
3714
3715 static void hci_remote_features_evt(struct hci_dev *hdev, void *data,
3716                                     struct sk_buff *skb)
3717 {
3718         struct hci_ev_remote_features *ev = data;
3719         struct hci_conn *conn;
3720
3721         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
3722
3723         hci_dev_lock(hdev);
3724
3725         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3726         if (!conn)
3727                 goto unlock;
3728
3729         if (!ev->status)
3730                 memcpy(conn->features[0], ev->features, 8);
3731
3732         if (conn->state != BT_CONFIG)
3733                 goto unlock;
3734
3735         if (!ev->status && lmp_ext_feat_capable(hdev) &&
3736             lmp_ext_feat_capable(conn)) {
3737                 struct hci_cp_read_remote_ext_features cp;
3738                 cp.handle = ev->handle;
3739                 cp.page = 0x01;
3740                 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
3741                              sizeof(cp), &cp);
3742                 goto unlock;
3743         }
3744
3745         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
3746                 struct hci_cp_remote_name_req cp;
3747                 memset(&cp, 0, sizeof(cp));
3748                 bacpy(&cp.bdaddr, &conn->dst);
3749                 cp.pscan_rep_mode = 0x02;
3750                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
3751         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
3752                 mgmt_device_connected(hdev, conn, NULL, 0);
3753
3754         if (!hci_outgoing_auth_needed(hdev, conn)) {
3755                 conn->state = BT_CONNECTED;
3756                 hci_connect_cfm(conn, ev->status);
3757                 hci_conn_drop(conn);
3758         }
3759
3760 unlock:
3761         hci_dev_unlock(hdev);
3762 }
3763
3764 static inline void handle_cmd_cnt_and_timer(struct hci_dev *hdev, u8 ncmd)
3765 {
3766         cancel_delayed_work(&hdev->cmd_timer);
3767
3768         rcu_read_lock();
3769         if (!test_bit(HCI_RESET, &hdev->flags)) {
3770                 if (ncmd) {
3771                         cancel_delayed_work(&hdev->ncmd_timer);
3772                         atomic_set(&hdev->cmd_cnt, 1);
3773                 } else {
3774                         if (!hci_dev_test_flag(hdev, HCI_CMD_DRAIN_WORKQUEUE))
3775                                 queue_delayed_work(hdev->workqueue, &hdev->ncmd_timer,
3776                                                    HCI_NCMD_TIMEOUT);
3777                 }
3778         }
3779         rcu_read_unlock();
3780 }
3781
3782 static u8 hci_cc_le_read_buffer_size_v2(struct hci_dev *hdev, void *data,
3783                                         struct sk_buff *skb)
3784 {
3785         struct hci_rp_le_read_buffer_size_v2 *rp = data;
3786
3787         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
3788
3789         if (rp->status)
3790                 return rp->status;
3791
3792         hdev->le_mtu   = __le16_to_cpu(rp->acl_mtu);
3793         hdev->le_pkts  = rp->acl_max_pkt;
3794         hdev->iso_mtu  = __le16_to_cpu(rp->iso_mtu);
3795         hdev->iso_pkts = rp->iso_max_pkt;
3796
3797         hdev->le_cnt  = hdev->le_pkts;
3798         hdev->iso_cnt = hdev->iso_pkts;
3799
3800         BT_DBG("%s acl mtu %d:%d iso mtu %d:%d", hdev->name, hdev->acl_mtu,
3801                hdev->acl_pkts, hdev->iso_mtu, hdev->iso_pkts);
3802
3803         return rp->status;
3804 }
3805
3806 static u8 hci_cc_le_set_cig_params(struct hci_dev *hdev, void *data,
3807                                    struct sk_buff *skb)
3808 {
3809         struct hci_rp_le_set_cig_params *rp = data;
3810         struct hci_cp_le_set_cig_params *cp;
3811         struct hci_conn *conn;
3812         u8 status = rp->status;
3813         int i;
3814
3815         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
3816
3817         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_CIG_PARAMS);
3818         if (!rp->status && (!cp || rp->num_handles != cp->num_cis ||
3819                             rp->cig_id != cp->cig_id)) {
3820                 bt_dev_err(hdev, "unexpected Set CIG Parameters response data");
3821                 status = HCI_ERROR_UNSPECIFIED;
3822         }
3823
3824         hci_dev_lock(hdev);
3825
3826         if (status) {
3827                 while ((conn = hci_conn_hash_lookup_cig(hdev, rp->cig_id))) {
3828                         conn->state = BT_CLOSED;
3829                         hci_connect_cfm(conn, status);
3830                         hci_conn_del(conn);
3831                 }
3832                 goto unlock;
3833         }
3834
3835         /* BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 4, Part E page 2553
3836          *
3837          * If the Status return parameter is zero, then the Controller shall
3838          * set the Connection_Handle arrayed return parameter to the connection
3839          * handle(s) corresponding to the CIS configurations specified in
3840          * the CIS_IDs command parameter, in the same order.
3841          */
3842         for (i = 0; i < rp->num_handles; ++i) {
3843                 conn = hci_conn_hash_lookup_cis(hdev, NULL, 0, rp->cig_id,
3844                                                 cp->cis[i].cis_id);
3845                 if (!conn || !bacmp(&conn->dst, BDADDR_ANY))
3846                         continue;
3847
3848                 if (conn->state != BT_BOUND && conn->state != BT_CONNECT)
3849                         continue;
3850
3851                 conn->handle = __le16_to_cpu(rp->handle[i]);
3852
3853                 bt_dev_dbg(hdev, "%p handle 0x%4.4x parent %p", conn,
3854                            conn->handle, conn->parent);
3855
3856                 /* Create CIS if LE is already connected */
3857                 if (conn->parent && conn->parent->state == BT_CONNECTED)
3858                         hci_le_create_cis(conn);
3859         }
3860
3861 unlock:
3862         hci_dev_unlock(hdev);
3863
3864         return rp->status;
3865 }
3866
3867 static u8 hci_cc_le_setup_iso_path(struct hci_dev *hdev, void *data,
3868                                    struct sk_buff *skb)
3869 {
3870         struct hci_rp_le_setup_iso_path *rp = data;
3871         struct hci_cp_le_setup_iso_path *cp;
3872         struct hci_conn *conn;
3873
3874         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
3875
3876         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SETUP_ISO_PATH);
3877         if (!cp)
3878                 return rp->status;
3879
3880         hci_dev_lock(hdev);
3881
3882         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
3883         if (!conn)
3884                 goto unlock;
3885
3886         if (rp->status) {
3887                 hci_connect_cfm(conn, rp->status);
3888                 hci_conn_del(conn);
3889                 goto unlock;
3890         }
3891
3892         switch (cp->direction) {
3893         /* Input (Host to Controller) */
3894         case 0x00:
3895                 /* Only confirm connection if output only */
3896                 if (conn->iso_qos.ucast.out.sdu && !conn->iso_qos.ucast.in.sdu)
3897                         hci_connect_cfm(conn, rp->status);
3898                 break;
3899         /* Output (Controller to Host) */
3900         case 0x01:
3901                 /* Confirm connection since conn->iso_qos is always configured
3902                  * last.
3903                  */
3904                 hci_connect_cfm(conn, rp->status);
3905                 break;
3906         }
3907
3908 unlock:
3909         hci_dev_unlock(hdev);
3910         return rp->status;
3911 }
3912
3913 static void hci_cs_le_create_big(struct hci_dev *hdev, u8 status)
3914 {
3915         bt_dev_dbg(hdev, "status 0x%2.2x", status);
3916 }
3917
3918 static u8 hci_cc_set_per_adv_param(struct hci_dev *hdev, void *data,
3919                                    struct sk_buff *skb)
3920 {
3921         struct hci_ev_status *rp = data;
3922         struct hci_cp_le_set_per_adv_params *cp;
3923
3924         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
3925
3926         if (rp->status)
3927                 return rp->status;
3928
3929         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_PER_ADV_PARAMS);
3930         if (!cp)
3931                 return rp->status;
3932
3933         /* TODO: set the conn state */
3934         return rp->status;
3935 }
3936
3937 static u8 hci_cc_le_set_per_adv_enable(struct hci_dev *hdev, void *data,
3938                                        struct sk_buff *skb)
3939 {
3940         struct hci_ev_status *rp = data;
3941         __u8 *sent;
3942
3943         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
3944
3945         if (rp->status)
3946                 return rp->status;
3947
3948         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_PER_ADV_ENABLE);
3949         if (!sent)
3950                 return rp->status;
3951
3952         hci_dev_lock(hdev);
3953
3954         if (*sent)
3955                 hci_dev_set_flag(hdev, HCI_LE_PER_ADV);
3956         else
3957                 hci_dev_clear_flag(hdev, HCI_LE_PER_ADV);
3958
3959         hci_dev_unlock(hdev);
3960
3961         return rp->status;
3962 }
3963
3964 #define HCI_CC_VL(_op, _func, _min, _max) \
3965 { \
3966         .op = _op, \
3967         .func = _func, \
3968         .min_len = _min, \
3969         .max_len = _max, \
3970 }
3971
3972 #define HCI_CC(_op, _func, _len) \
3973         HCI_CC_VL(_op, _func, _len, _len)
3974
3975 #define HCI_CC_STATUS(_op, _func) \
3976         HCI_CC(_op, _func, sizeof(struct hci_ev_status))
3977
3978 static const struct hci_cc {
3979         u16  op;
3980         u8 (*func)(struct hci_dev *hdev, void *data, struct sk_buff *skb);
3981         u16  min_len;
3982         u16  max_len;
3983 } hci_cc_table[] = {
3984         HCI_CC_STATUS(HCI_OP_INQUIRY_CANCEL, hci_cc_inquiry_cancel),
3985         HCI_CC_STATUS(HCI_OP_PERIODIC_INQ, hci_cc_periodic_inq),
3986         HCI_CC_STATUS(HCI_OP_EXIT_PERIODIC_INQ, hci_cc_exit_periodic_inq),
3987         HCI_CC_STATUS(HCI_OP_REMOTE_NAME_REQ_CANCEL,
3988                       hci_cc_remote_name_req_cancel),
3989         HCI_CC(HCI_OP_ROLE_DISCOVERY, hci_cc_role_discovery,
3990                sizeof(struct hci_rp_role_discovery)),
3991         HCI_CC(HCI_OP_READ_LINK_POLICY, hci_cc_read_link_policy,
3992                sizeof(struct hci_rp_read_link_policy)),
3993         HCI_CC(HCI_OP_WRITE_LINK_POLICY, hci_cc_write_link_policy,
3994                sizeof(struct hci_rp_write_link_policy)),
3995         HCI_CC(HCI_OP_READ_DEF_LINK_POLICY, hci_cc_read_def_link_policy,
3996                sizeof(struct hci_rp_read_def_link_policy)),
3997         HCI_CC_STATUS(HCI_OP_WRITE_DEF_LINK_POLICY,
3998                       hci_cc_write_def_link_policy),
3999         HCI_CC_STATUS(HCI_OP_RESET, hci_cc_reset),
4000         HCI_CC(HCI_OP_READ_STORED_LINK_KEY, hci_cc_read_stored_link_key,
4001                sizeof(struct hci_rp_read_stored_link_key)),
4002         HCI_CC(HCI_OP_DELETE_STORED_LINK_KEY, hci_cc_delete_stored_link_key,
4003                sizeof(struct hci_rp_delete_stored_link_key)),
4004         HCI_CC_STATUS(HCI_OP_WRITE_LOCAL_NAME, hci_cc_write_local_name),
4005         HCI_CC(HCI_OP_READ_LOCAL_NAME, hci_cc_read_local_name,
4006                sizeof(struct hci_rp_read_local_name)),
4007         HCI_CC_STATUS(HCI_OP_WRITE_AUTH_ENABLE, hci_cc_write_auth_enable),
4008         HCI_CC_STATUS(HCI_OP_WRITE_ENCRYPT_MODE, hci_cc_write_encrypt_mode),
4009         HCI_CC_STATUS(HCI_OP_WRITE_SCAN_ENABLE, hci_cc_write_scan_enable),
4010         HCI_CC_STATUS(HCI_OP_SET_EVENT_FLT, hci_cc_set_event_filter),
4011         HCI_CC(HCI_OP_READ_CLASS_OF_DEV, hci_cc_read_class_of_dev,
4012                sizeof(struct hci_rp_read_class_of_dev)),
4013         HCI_CC_STATUS(HCI_OP_WRITE_CLASS_OF_DEV, hci_cc_write_class_of_dev),
4014         HCI_CC(HCI_OP_READ_VOICE_SETTING, hci_cc_read_voice_setting,
4015                sizeof(struct hci_rp_read_voice_setting)),
4016         HCI_CC_STATUS(HCI_OP_WRITE_VOICE_SETTING, hci_cc_write_voice_setting),
4017         HCI_CC(HCI_OP_READ_NUM_SUPPORTED_IAC, hci_cc_read_num_supported_iac,
4018                sizeof(struct hci_rp_read_num_supported_iac)),
4019         HCI_CC_STATUS(HCI_OP_WRITE_SSP_MODE, hci_cc_write_ssp_mode),
4020         HCI_CC_STATUS(HCI_OP_WRITE_SC_SUPPORT, hci_cc_write_sc_support),
4021         HCI_CC(HCI_OP_READ_AUTH_PAYLOAD_TO, hci_cc_read_auth_payload_timeout,
4022                sizeof(struct hci_rp_read_auth_payload_to)),
4023         HCI_CC(HCI_OP_WRITE_AUTH_PAYLOAD_TO, hci_cc_write_auth_payload_timeout,
4024                sizeof(struct hci_rp_write_auth_payload_to)),
4025         HCI_CC(HCI_OP_READ_LOCAL_VERSION, hci_cc_read_local_version,
4026                sizeof(struct hci_rp_read_local_version)),
4027         HCI_CC(HCI_OP_READ_LOCAL_COMMANDS, hci_cc_read_local_commands,
4028                sizeof(struct hci_rp_read_local_commands)),
4029         HCI_CC(HCI_OP_READ_LOCAL_FEATURES, hci_cc_read_local_features,
4030                sizeof(struct hci_rp_read_local_features)),
4031         HCI_CC(HCI_OP_READ_LOCAL_EXT_FEATURES, hci_cc_read_local_ext_features,
4032                sizeof(struct hci_rp_read_local_ext_features)),
4033         HCI_CC(HCI_OP_READ_BUFFER_SIZE, hci_cc_read_buffer_size,
4034                sizeof(struct hci_rp_read_buffer_size)),
4035         HCI_CC(HCI_OP_READ_BD_ADDR, hci_cc_read_bd_addr,
4036                sizeof(struct hci_rp_read_bd_addr)),
4037         HCI_CC(HCI_OP_READ_LOCAL_PAIRING_OPTS, hci_cc_read_local_pairing_opts,
4038                sizeof(struct hci_rp_read_local_pairing_opts)),
4039         HCI_CC(HCI_OP_READ_PAGE_SCAN_ACTIVITY, hci_cc_read_page_scan_activity,
4040                sizeof(struct hci_rp_read_page_scan_activity)),
4041         HCI_CC_STATUS(HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
4042                       hci_cc_write_page_scan_activity),
4043         HCI_CC(HCI_OP_READ_PAGE_SCAN_TYPE, hci_cc_read_page_scan_type,
4044                sizeof(struct hci_rp_read_page_scan_type)),
4045         HCI_CC_STATUS(HCI_OP_WRITE_PAGE_SCAN_TYPE, hci_cc_write_page_scan_type),
4046         HCI_CC(HCI_OP_READ_DATA_BLOCK_SIZE, hci_cc_read_data_block_size,
4047                sizeof(struct hci_rp_read_data_block_size)),
4048         HCI_CC(HCI_OP_READ_FLOW_CONTROL_MODE, hci_cc_read_flow_control_mode,
4049                sizeof(struct hci_rp_read_flow_control_mode)),
4050         HCI_CC(HCI_OP_READ_LOCAL_AMP_INFO, hci_cc_read_local_amp_info,
4051                sizeof(struct hci_rp_read_local_amp_info)),
4052         HCI_CC(HCI_OP_READ_CLOCK, hci_cc_read_clock,
4053                sizeof(struct hci_rp_read_clock)),
4054         HCI_CC(HCI_OP_READ_ENC_KEY_SIZE, hci_cc_read_enc_key_size,
4055                sizeof(struct hci_rp_read_enc_key_size)),
4056         HCI_CC(HCI_OP_READ_INQ_RSP_TX_POWER, hci_cc_read_inq_rsp_tx_power,
4057                sizeof(struct hci_rp_read_inq_rsp_tx_power)),
4058         HCI_CC(HCI_OP_READ_DEF_ERR_DATA_REPORTING,
4059                hci_cc_read_def_err_data_reporting,
4060                sizeof(struct hci_rp_read_def_err_data_reporting)),
4061         HCI_CC_STATUS(HCI_OP_WRITE_DEF_ERR_DATA_REPORTING,
4062                       hci_cc_write_def_err_data_reporting),
4063         HCI_CC(HCI_OP_PIN_CODE_REPLY, hci_cc_pin_code_reply,
4064                sizeof(struct hci_rp_pin_code_reply)),
4065         HCI_CC(HCI_OP_PIN_CODE_NEG_REPLY, hci_cc_pin_code_neg_reply,
4066                sizeof(struct hci_rp_pin_code_neg_reply)),
4067         HCI_CC(HCI_OP_READ_LOCAL_OOB_DATA, hci_cc_read_local_oob_data,
4068                sizeof(struct hci_rp_read_local_oob_data)),
4069         HCI_CC(HCI_OP_READ_LOCAL_OOB_EXT_DATA, hci_cc_read_local_oob_ext_data,
4070                sizeof(struct hci_rp_read_local_oob_ext_data)),
4071         HCI_CC(HCI_OP_LE_READ_BUFFER_SIZE, hci_cc_le_read_buffer_size,
4072                sizeof(struct hci_rp_le_read_buffer_size)),
4073         HCI_CC(HCI_OP_LE_READ_LOCAL_FEATURES, hci_cc_le_read_local_features,
4074                sizeof(struct hci_rp_le_read_local_features)),
4075         HCI_CC(HCI_OP_LE_READ_ADV_TX_POWER, hci_cc_le_read_adv_tx_power,
4076                sizeof(struct hci_rp_le_read_adv_tx_power)),
4077         HCI_CC(HCI_OP_USER_CONFIRM_REPLY, hci_cc_user_confirm_reply,
4078                sizeof(struct hci_rp_user_confirm_reply)),
4079         HCI_CC(HCI_OP_USER_CONFIRM_NEG_REPLY, hci_cc_user_confirm_neg_reply,
4080                sizeof(struct hci_rp_user_confirm_reply)),
4081         HCI_CC(HCI_OP_USER_PASSKEY_REPLY, hci_cc_user_passkey_reply,
4082                sizeof(struct hci_rp_user_confirm_reply)),
4083         HCI_CC(HCI_OP_USER_PASSKEY_NEG_REPLY, hci_cc_user_passkey_neg_reply,
4084                sizeof(struct hci_rp_user_confirm_reply)),
4085         HCI_CC_STATUS(HCI_OP_LE_SET_RANDOM_ADDR, hci_cc_le_set_random_addr),
4086         HCI_CC_STATUS(HCI_OP_LE_SET_ADV_ENABLE, hci_cc_le_set_adv_enable),
4087         HCI_CC_STATUS(HCI_OP_LE_SET_SCAN_PARAM, hci_cc_le_set_scan_param),
4088         HCI_CC_STATUS(HCI_OP_LE_SET_SCAN_ENABLE, hci_cc_le_set_scan_enable),
4089         HCI_CC(HCI_OP_LE_READ_ACCEPT_LIST_SIZE,
4090                hci_cc_le_read_accept_list_size,
4091                sizeof(struct hci_rp_le_read_accept_list_size)),
4092         HCI_CC_STATUS(HCI_OP_LE_CLEAR_ACCEPT_LIST, hci_cc_le_clear_accept_list),
4093         HCI_CC_STATUS(HCI_OP_LE_ADD_TO_ACCEPT_LIST,
4094                       hci_cc_le_add_to_accept_list),
4095         HCI_CC_STATUS(HCI_OP_LE_DEL_FROM_ACCEPT_LIST,
4096                       hci_cc_le_del_from_accept_list),
4097         HCI_CC(HCI_OP_LE_READ_SUPPORTED_STATES, hci_cc_le_read_supported_states,
4098                sizeof(struct hci_rp_le_read_supported_states)),
4099         HCI_CC(HCI_OP_LE_READ_DEF_DATA_LEN, hci_cc_le_read_def_data_len,
4100                sizeof(struct hci_rp_le_read_def_data_len)),
4101         HCI_CC_STATUS(HCI_OP_LE_WRITE_DEF_DATA_LEN,
4102                       hci_cc_le_write_def_data_len),
4103         HCI_CC_STATUS(HCI_OP_LE_ADD_TO_RESOLV_LIST,
4104                       hci_cc_le_add_to_resolv_list),
4105         HCI_CC_STATUS(HCI_OP_LE_DEL_FROM_RESOLV_LIST,
4106                       hci_cc_le_del_from_resolv_list),
4107         HCI_CC_STATUS(HCI_OP_LE_CLEAR_RESOLV_LIST,
4108                       hci_cc_le_clear_resolv_list),
4109         HCI_CC(HCI_OP_LE_READ_RESOLV_LIST_SIZE, hci_cc_le_read_resolv_list_size,
4110                sizeof(struct hci_rp_le_read_resolv_list_size)),
4111         HCI_CC_STATUS(HCI_OP_LE_SET_ADDR_RESOLV_ENABLE,
4112                       hci_cc_le_set_addr_resolution_enable),
4113         HCI_CC(HCI_OP_LE_READ_MAX_DATA_LEN, hci_cc_le_read_max_data_len,
4114                sizeof(struct hci_rp_le_read_max_data_len)),
4115         HCI_CC_STATUS(HCI_OP_WRITE_LE_HOST_SUPPORTED,
4116                       hci_cc_write_le_host_supported),
4117         HCI_CC_STATUS(HCI_OP_LE_SET_ADV_PARAM, hci_cc_set_adv_param),
4118         HCI_CC(HCI_OP_READ_RSSI, hci_cc_read_rssi,
4119                sizeof(struct hci_rp_read_rssi)),
4120         HCI_CC(HCI_OP_READ_TX_POWER, hci_cc_read_tx_power,
4121                sizeof(struct hci_rp_read_tx_power)),
4122         HCI_CC_STATUS(HCI_OP_WRITE_SSP_DEBUG_MODE, hci_cc_write_ssp_debug_mode),
4123         HCI_CC_STATUS(HCI_OP_LE_SET_EXT_SCAN_PARAMS,
4124                       hci_cc_le_set_ext_scan_param),
4125         HCI_CC_STATUS(HCI_OP_LE_SET_EXT_SCAN_ENABLE,
4126                       hci_cc_le_set_ext_scan_enable),
4127         HCI_CC_STATUS(HCI_OP_LE_SET_DEFAULT_PHY, hci_cc_le_set_default_phy),
4128         HCI_CC(HCI_OP_LE_READ_NUM_SUPPORTED_ADV_SETS,
4129                hci_cc_le_read_num_adv_sets,
4130                sizeof(struct hci_rp_le_read_num_supported_adv_sets)),
4131         HCI_CC(HCI_OP_LE_SET_EXT_ADV_PARAMS, hci_cc_set_ext_adv_param,
4132                sizeof(struct hci_rp_le_set_ext_adv_params)),
4133         HCI_CC_STATUS(HCI_OP_LE_SET_EXT_ADV_ENABLE,
4134                       hci_cc_le_set_ext_adv_enable),
4135         HCI_CC_STATUS(HCI_OP_LE_SET_ADV_SET_RAND_ADDR,
4136                       hci_cc_le_set_adv_set_random_addr),
4137         HCI_CC_STATUS(HCI_OP_LE_REMOVE_ADV_SET, hci_cc_le_remove_adv_set),
4138         HCI_CC_STATUS(HCI_OP_LE_CLEAR_ADV_SETS, hci_cc_le_clear_adv_sets),
4139         HCI_CC_STATUS(HCI_OP_LE_SET_PER_ADV_PARAMS, hci_cc_set_per_adv_param),
4140         HCI_CC_STATUS(HCI_OP_LE_SET_PER_ADV_ENABLE,
4141                       hci_cc_le_set_per_adv_enable),
4142         HCI_CC(HCI_OP_LE_READ_TRANSMIT_POWER, hci_cc_le_read_transmit_power,
4143                sizeof(struct hci_rp_le_read_transmit_power)),
4144         HCI_CC_STATUS(HCI_OP_LE_SET_PRIVACY_MODE, hci_cc_le_set_privacy_mode),
4145         HCI_CC(HCI_OP_LE_READ_BUFFER_SIZE_V2, hci_cc_le_read_buffer_size_v2,
4146                sizeof(struct hci_rp_le_read_buffer_size_v2)),
4147         HCI_CC_VL(HCI_OP_LE_SET_CIG_PARAMS, hci_cc_le_set_cig_params,
4148                   sizeof(struct hci_rp_le_set_cig_params), HCI_MAX_EVENT_SIZE),
4149         HCI_CC(HCI_OP_LE_SETUP_ISO_PATH, hci_cc_le_setup_iso_path,
4150                sizeof(struct hci_rp_le_setup_iso_path)),
4151 };
4152
4153 static u8 hci_cc_func(struct hci_dev *hdev, const struct hci_cc *cc,
4154                       struct sk_buff *skb)
4155 {
4156         void *data;
4157
4158         if (skb->len < cc->min_len) {
4159                 bt_dev_err(hdev, "unexpected cc 0x%4.4x length: %u < %u",
4160                            cc->op, skb->len, cc->min_len);
4161                 return HCI_ERROR_UNSPECIFIED;
4162         }
4163
4164         /* Just warn if the length is over max_len size it still be possible to
4165          * partially parse the cc so leave to callback to decide if that is
4166          * acceptable.
4167          */
4168         if (skb->len > cc->max_len)
4169                 bt_dev_warn(hdev, "unexpected cc 0x%4.4x length: %u > %u",
4170                             cc->op, skb->len, cc->max_len);
4171
4172         data = hci_cc_skb_pull(hdev, skb, cc->op, cc->min_len);
4173         if (!data)
4174                 return HCI_ERROR_UNSPECIFIED;
4175
4176         return cc->func(hdev, data, skb);
4177 }
4178
4179 static void hci_cmd_complete_evt(struct hci_dev *hdev, void *data,
4180                                  struct sk_buff *skb, u16 *opcode, u8 *status,
4181                                  hci_req_complete_t *req_complete,
4182                                  hci_req_complete_skb_t *req_complete_skb)
4183 {
4184         struct hci_ev_cmd_complete *ev = data;
4185         int i;
4186
4187         *opcode = __le16_to_cpu(ev->opcode);
4188
4189         bt_dev_dbg(hdev, "opcode 0x%4.4x", *opcode);
4190
4191         for (i = 0; i < ARRAY_SIZE(hci_cc_table); i++) {
4192                 if (hci_cc_table[i].op == *opcode) {
4193                         *status = hci_cc_func(hdev, &hci_cc_table[i], skb);
4194                         break;
4195                 }
4196         }
4197
4198         if (i == ARRAY_SIZE(hci_cc_table)) {
4199                 /* Unknown opcode, assume byte 0 contains the status, so
4200                  * that e.g. __hci_cmd_sync() properly returns errors
4201                  * for vendor specific commands send by HCI drivers.
4202                  * If a vendor doesn't actually follow this convention we may
4203                  * need to introduce a vendor CC table in order to properly set
4204                  * the status.
4205                  */
4206                 *status = skb->data[0];
4207         }
4208
4209         handle_cmd_cnt_and_timer(hdev, ev->ncmd);
4210
4211         hci_req_cmd_complete(hdev, *opcode, *status, req_complete,
4212                              req_complete_skb);
4213
4214         if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
4215                 bt_dev_err(hdev,
4216                            "unexpected event for opcode 0x%4.4x", *opcode);
4217                 return;
4218         }
4219
4220         if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
4221                 queue_work(hdev->workqueue, &hdev->cmd_work);
4222 }
4223
4224 static void hci_cs_le_create_cis(struct hci_dev *hdev, u8 status)
4225 {
4226         struct hci_cp_le_create_cis *cp;
4227         int i;
4228
4229         bt_dev_dbg(hdev, "status 0x%2.2x", status);
4230
4231         if (!status)
4232                 return;
4233
4234         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CIS);
4235         if (!cp)
4236                 return;
4237
4238         hci_dev_lock(hdev);
4239
4240         /* Remove connection if command failed */
4241         for (i = 0; cp->num_cis; cp->num_cis--, i++) {
4242                 struct hci_conn *conn;
4243                 u16 handle;
4244
4245                 handle = __le16_to_cpu(cp->cis[i].cis_handle);
4246
4247                 conn = hci_conn_hash_lookup_handle(hdev, handle);
4248                 if (conn) {
4249                         conn->state = BT_CLOSED;
4250                         hci_connect_cfm(conn, status);
4251                         hci_conn_del(conn);
4252                 }
4253         }
4254
4255         hci_dev_unlock(hdev);
4256 }
4257
4258 #define HCI_CS(_op, _func) \
4259 { \
4260         .op = _op, \
4261         .func = _func, \
4262 }
4263
4264 static const struct hci_cs {
4265         u16  op;
4266         void (*func)(struct hci_dev *hdev, __u8 status);
4267 } hci_cs_table[] = {
4268         HCI_CS(HCI_OP_INQUIRY, hci_cs_inquiry),
4269         HCI_CS(HCI_OP_CREATE_CONN, hci_cs_create_conn),
4270         HCI_CS(HCI_OP_DISCONNECT, hci_cs_disconnect),
4271         HCI_CS(HCI_OP_ADD_SCO, hci_cs_add_sco),
4272         HCI_CS(HCI_OP_AUTH_REQUESTED, hci_cs_auth_requested),
4273         HCI_CS(HCI_OP_SET_CONN_ENCRYPT, hci_cs_set_conn_encrypt),
4274         HCI_CS(HCI_OP_REMOTE_NAME_REQ, hci_cs_remote_name_req),
4275         HCI_CS(HCI_OP_READ_REMOTE_FEATURES, hci_cs_read_remote_features),
4276         HCI_CS(HCI_OP_READ_REMOTE_EXT_FEATURES,
4277                hci_cs_read_remote_ext_features),
4278         HCI_CS(HCI_OP_SETUP_SYNC_CONN, hci_cs_setup_sync_conn),
4279         HCI_CS(HCI_OP_ENHANCED_SETUP_SYNC_CONN,
4280                hci_cs_enhanced_setup_sync_conn),
4281         HCI_CS(HCI_OP_SNIFF_MODE, hci_cs_sniff_mode),
4282         HCI_CS(HCI_OP_EXIT_SNIFF_MODE, hci_cs_exit_sniff_mode),
4283         HCI_CS(HCI_OP_SWITCH_ROLE, hci_cs_switch_role),
4284         HCI_CS(HCI_OP_LE_CREATE_CONN, hci_cs_le_create_conn),
4285         HCI_CS(HCI_OP_LE_READ_REMOTE_FEATURES, hci_cs_le_read_remote_features),
4286         HCI_CS(HCI_OP_LE_START_ENC, hci_cs_le_start_enc),
4287         HCI_CS(HCI_OP_LE_EXT_CREATE_CONN, hci_cs_le_ext_create_conn),
4288         HCI_CS(HCI_OP_LE_CREATE_CIS, hci_cs_le_create_cis),
4289         HCI_CS(HCI_OP_LE_CREATE_BIG, hci_cs_le_create_big),
4290 };
4291
4292 static void hci_cmd_status_evt(struct hci_dev *hdev, void *data,
4293                                struct sk_buff *skb, u16 *opcode, u8 *status,
4294                                hci_req_complete_t *req_complete,
4295                                hci_req_complete_skb_t *req_complete_skb)
4296 {
4297         struct hci_ev_cmd_status *ev = data;
4298         int i;
4299
4300         *opcode = __le16_to_cpu(ev->opcode);
4301         *status = ev->status;
4302
4303         bt_dev_dbg(hdev, "opcode 0x%4.4x", *opcode);
4304
4305         for (i = 0; i < ARRAY_SIZE(hci_cs_table); i++) {
4306                 if (hci_cs_table[i].op == *opcode) {
4307                         hci_cs_table[i].func(hdev, ev->status);
4308                         break;
4309                 }
4310         }
4311
4312         handle_cmd_cnt_and_timer(hdev, ev->ncmd);
4313
4314         /* Indicate request completion if the command failed. Also, if
4315          * we're not waiting for a special event and we get a success
4316          * command status we should try to flag the request as completed
4317          * (since for this kind of commands there will not be a command
4318          * complete event).
4319          */
4320         if (ev->status || (hdev->sent_cmd && !hci_skb_event(hdev->sent_cmd))) {
4321                 hci_req_cmd_complete(hdev, *opcode, ev->status, req_complete,
4322                                      req_complete_skb);
4323                 if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
4324                         bt_dev_err(hdev, "unexpected event for opcode 0x%4.4x",
4325                                    *opcode);
4326                         return;
4327                 }
4328         }
4329
4330         if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
4331                 queue_work(hdev->workqueue, &hdev->cmd_work);
4332 }
4333
4334 static void hci_hardware_error_evt(struct hci_dev *hdev, void *data,
4335                                    struct sk_buff *skb)
4336 {
4337         struct hci_ev_hardware_error *ev = data;
4338
4339         bt_dev_dbg(hdev, "code 0x%2.2x", ev->code);
4340
4341         hdev->hw_error_code = ev->code;
4342
4343         queue_work(hdev->req_workqueue, &hdev->error_reset);
4344 }
4345
4346 static void hci_role_change_evt(struct hci_dev *hdev, void *data,
4347                                 struct sk_buff *skb)
4348 {
4349         struct hci_ev_role_change *ev = data;
4350         struct hci_conn *conn;
4351
4352         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
4353
4354         hci_dev_lock(hdev);
4355
4356         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4357         if (conn) {
4358                 if (!ev->status)
4359                         conn->role = ev->role;
4360
4361                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
4362
4363                 hci_role_switch_cfm(conn, ev->status, ev->role);
4364         }
4365
4366         hci_dev_unlock(hdev);
4367 }
4368
4369 static void hci_num_comp_pkts_evt(struct hci_dev *hdev, void *data,
4370                                   struct sk_buff *skb)
4371 {
4372         struct hci_ev_num_comp_pkts *ev = data;
4373         int i;
4374
4375         if (!hci_ev_skb_pull(hdev, skb, HCI_EV_NUM_COMP_PKTS,
4376                              flex_array_size(ev, handles, ev->num)))
4377                 return;
4378
4379         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
4380                 bt_dev_err(hdev, "wrong event for mode %d", hdev->flow_ctl_mode);
4381                 return;
4382         }
4383
4384         bt_dev_dbg(hdev, "num %d", ev->num);
4385
4386         for (i = 0; i < ev->num; i++) {
4387                 struct hci_comp_pkts_info *info = &ev->handles[i];
4388                 struct hci_conn *conn;
4389                 __u16  handle, count;
4390
4391                 handle = __le16_to_cpu(info->handle);
4392                 count  = __le16_to_cpu(info->count);
4393
4394                 conn = hci_conn_hash_lookup_handle(hdev, handle);
4395                 if (!conn)
4396                         continue;
4397
4398                 conn->sent -= count;
4399
4400                 switch (conn->type) {
4401                 case ACL_LINK:
4402                         hdev->acl_cnt += count;
4403                         if (hdev->acl_cnt > hdev->acl_pkts)
4404                                 hdev->acl_cnt = hdev->acl_pkts;
4405                         break;
4406
4407                 case LE_LINK:
4408                         if (hdev->le_pkts) {
4409                                 hdev->le_cnt += count;
4410                                 if (hdev->le_cnt > hdev->le_pkts)
4411                                         hdev->le_cnt = hdev->le_pkts;
4412                         } else {
4413                                 hdev->acl_cnt += count;
4414                                 if (hdev->acl_cnt > hdev->acl_pkts)
4415                                         hdev->acl_cnt = hdev->acl_pkts;
4416                         }
4417                         break;
4418
4419                 case SCO_LINK:
4420                         hdev->sco_cnt += count;
4421                         if (hdev->sco_cnt > hdev->sco_pkts)
4422                                 hdev->sco_cnt = hdev->sco_pkts;
4423                         break;
4424
4425                 case ISO_LINK:
4426                         if (hdev->iso_pkts) {
4427                                 hdev->iso_cnt += count;
4428                                 if (hdev->iso_cnt > hdev->iso_pkts)
4429                                         hdev->iso_cnt = hdev->iso_pkts;
4430                         } else if (hdev->le_pkts) {
4431                                 hdev->le_cnt += count;
4432                                 if (hdev->le_cnt > hdev->le_pkts)
4433                                         hdev->le_cnt = hdev->le_pkts;
4434                         } else {
4435                                 hdev->acl_cnt += count;
4436                                 if (hdev->acl_cnt > hdev->acl_pkts)
4437                                         hdev->acl_cnt = hdev->acl_pkts;
4438                         }
4439                         break;
4440
4441                 default:
4442                         bt_dev_err(hdev, "unknown type %d conn %p",
4443                                    conn->type, conn);
4444                         break;
4445                 }
4446         }
4447
4448         queue_work(hdev->workqueue, &hdev->tx_work);
4449 }
4450
4451 static struct hci_conn *__hci_conn_lookup_handle(struct hci_dev *hdev,
4452                                                  __u16 handle)
4453 {
4454         struct hci_chan *chan;
4455
4456         switch (hdev->dev_type) {
4457         case HCI_PRIMARY:
4458                 return hci_conn_hash_lookup_handle(hdev, handle);
4459         case HCI_AMP:
4460                 chan = hci_chan_lookup_handle(hdev, handle);
4461                 if (chan)
4462                         return chan->conn;
4463                 break;
4464         default:
4465                 bt_dev_err(hdev, "unknown dev_type %d", hdev->dev_type);
4466                 break;
4467         }
4468
4469         return NULL;
4470 }
4471
4472 static void hci_num_comp_blocks_evt(struct hci_dev *hdev, void *data,
4473                                     struct sk_buff *skb)
4474 {
4475         struct hci_ev_num_comp_blocks *ev = data;
4476         int i;
4477
4478         if (!hci_ev_skb_pull(hdev, skb, HCI_EV_NUM_COMP_BLOCKS,
4479                              flex_array_size(ev, handles, ev->num_hndl)))
4480                 return;
4481
4482         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
4483                 bt_dev_err(hdev, "wrong event for mode %d",
4484                            hdev->flow_ctl_mode);
4485                 return;
4486         }
4487
4488         bt_dev_dbg(hdev, "num_blocks %d num_hndl %d", ev->num_blocks,
4489                    ev->num_hndl);
4490
4491         for (i = 0; i < ev->num_hndl; i++) {
4492                 struct hci_comp_blocks_info *info = &ev->handles[i];
4493                 struct hci_conn *conn = NULL;
4494                 __u16  handle, block_count;
4495
4496                 handle = __le16_to_cpu(info->handle);
4497                 block_count = __le16_to_cpu(info->blocks);
4498
4499                 conn = __hci_conn_lookup_handle(hdev, handle);
4500                 if (!conn)
4501                         continue;
4502
4503                 conn->sent -= block_count;
4504
4505                 switch (conn->type) {
4506                 case ACL_LINK:
4507                 case AMP_LINK:
4508                         hdev->block_cnt += block_count;
4509                         if (hdev->block_cnt > hdev->num_blocks)
4510                                 hdev->block_cnt = hdev->num_blocks;
4511                         break;
4512
4513                 default:
4514                         bt_dev_err(hdev, "unknown type %d conn %p",
4515                                    conn->type, conn);
4516                         break;
4517                 }
4518         }
4519
4520         queue_work(hdev->workqueue, &hdev->tx_work);
4521 }
4522
4523 static void hci_mode_change_evt(struct hci_dev *hdev, void *data,
4524                                 struct sk_buff *skb)
4525 {
4526         struct hci_ev_mode_change *ev = data;
4527         struct hci_conn *conn;
4528
4529         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
4530
4531         hci_dev_lock(hdev);
4532
4533         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4534         if (conn) {
4535                 conn->mode = ev->mode;
4536
4537                 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND,
4538                                         &conn->flags)) {
4539                         if (conn->mode == HCI_CM_ACTIVE)
4540                                 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
4541                         else
4542                                 clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
4543                 }
4544
4545                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
4546                         hci_sco_setup(conn, ev->status);
4547         }
4548
4549         hci_dev_unlock(hdev);
4550 }
4551
4552 static void hci_pin_code_request_evt(struct hci_dev *hdev, void *data,
4553                                      struct sk_buff *skb)
4554 {
4555         struct hci_ev_pin_code_req *ev = data;
4556         struct hci_conn *conn;
4557
4558         bt_dev_dbg(hdev, "");
4559
4560         hci_dev_lock(hdev);
4561
4562         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4563         if (!conn)
4564                 goto unlock;
4565
4566         if (conn->state == BT_CONNECTED) {
4567                 hci_conn_hold(conn);
4568                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
4569                 hci_conn_drop(conn);
4570         }
4571
4572         if (!hci_dev_test_flag(hdev, HCI_BONDABLE) &&
4573             !test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags)) {
4574                 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
4575                              sizeof(ev->bdaddr), &ev->bdaddr);
4576         } else if (hci_dev_test_flag(hdev, HCI_MGMT)) {
4577                 u8 secure;
4578
4579                 if (conn->pending_sec_level == BT_SECURITY_HIGH)
4580                         secure = 1;
4581                 else
4582                         secure = 0;
4583
4584                 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
4585         }
4586
4587 unlock:
4588         hci_dev_unlock(hdev);
4589 }
4590
4591 static void conn_set_key(struct hci_conn *conn, u8 key_type, u8 pin_len)
4592 {
4593         if (key_type == HCI_LK_CHANGED_COMBINATION)
4594                 return;
4595
4596         conn->pin_length = pin_len;
4597         conn->key_type = key_type;
4598
4599         switch (key_type) {
4600         case HCI_LK_LOCAL_UNIT:
4601         case HCI_LK_REMOTE_UNIT:
4602         case HCI_LK_DEBUG_COMBINATION:
4603                 return;
4604         case HCI_LK_COMBINATION:
4605                 if (pin_len == 16)
4606                         conn->pending_sec_level = BT_SECURITY_HIGH;
4607                 else
4608                         conn->pending_sec_level = BT_SECURITY_MEDIUM;
4609                 break;
4610         case HCI_LK_UNAUTH_COMBINATION_P192:
4611         case HCI_LK_UNAUTH_COMBINATION_P256:
4612                 conn->pending_sec_level = BT_SECURITY_MEDIUM;
4613                 break;
4614         case HCI_LK_AUTH_COMBINATION_P192:
4615                 conn->pending_sec_level = BT_SECURITY_HIGH;
4616                 break;
4617         case HCI_LK_AUTH_COMBINATION_P256:
4618                 conn->pending_sec_level = BT_SECURITY_FIPS;
4619                 break;
4620         }
4621 }
4622
4623 static void hci_link_key_request_evt(struct hci_dev *hdev, void *data,
4624                                      struct sk_buff *skb)
4625 {
4626         struct hci_ev_link_key_req *ev = data;
4627         struct hci_cp_link_key_reply cp;
4628         struct hci_conn *conn;
4629         struct link_key *key;
4630
4631         bt_dev_dbg(hdev, "");
4632
4633         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4634                 return;
4635
4636         hci_dev_lock(hdev);
4637
4638         key = hci_find_link_key(hdev, &ev->bdaddr);
4639         if (!key) {
4640                 bt_dev_dbg(hdev, "link key not found for %pMR", &ev->bdaddr);
4641                 goto not_found;
4642         }
4643
4644         bt_dev_dbg(hdev, "found key type %u for %pMR", key->type, &ev->bdaddr);
4645
4646         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4647         if (conn) {
4648                 clear_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
4649
4650                 if ((key->type == HCI_LK_UNAUTH_COMBINATION_P192 ||
4651                      key->type == HCI_LK_UNAUTH_COMBINATION_P256) &&
4652                     conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
4653                         bt_dev_dbg(hdev, "ignoring unauthenticated key");
4654                         goto not_found;
4655                 }
4656
4657                 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
4658                     (conn->pending_sec_level == BT_SECURITY_HIGH ||
4659                      conn->pending_sec_level == BT_SECURITY_FIPS)) {
4660                         bt_dev_dbg(hdev, "ignoring key unauthenticated for high security");
4661                         goto not_found;
4662                 }
4663
4664                 conn_set_key(conn, key->type, key->pin_len);
4665         }
4666
4667         bacpy(&cp.bdaddr, &ev->bdaddr);
4668         memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);
4669
4670         hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
4671
4672         hci_dev_unlock(hdev);
4673
4674         return;
4675
4676 not_found:
4677         hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
4678         hci_dev_unlock(hdev);
4679 }
4680
4681 static void hci_link_key_notify_evt(struct hci_dev *hdev, void *data,
4682                                     struct sk_buff *skb)
4683 {
4684         struct hci_ev_link_key_notify *ev = data;
4685         struct hci_conn *conn;
4686         struct link_key *key;
4687         bool persistent;
4688         u8 pin_len = 0;
4689
4690         bt_dev_dbg(hdev, "");
4691
4692         hci_dev_lock(hdev);
4693
4694         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4695         if (!conn)
4696                 goto unlock;
4697
4698         hci_conn_hold(conn);
4699         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
4700         hci_conn_drop(conn);
4701
4702         set_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
4703         conn_set_key(conn, ev->key_type, conn->pin_length);
4704
4705         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4706                 goto unlock;
4707
4708         key = hci_add_link_key(hdev, conn, &ev->bdaddr, ev->link_key,
4709                                 ev->key_type, pin_len, &persistent);
4710         if (!key)
4711                 goto unlock;
4712
4713         /* Update connection information since adding the key will have
4714          * fixed up the type in the case of changed combination keys.
4715          */
4716         if (ev->key_type == HCI_LK_CHANGED_COMBINATION)
4717                 conn_set_key(conn, key->type, key->pin_len);
4718
4719         mgmt_new_link_key(hdev, key, persistent);
4720
4721         /* Keep debug keys around only if the HCI_KEEP_DEBUG_KEYS flag
4722          * is set. If it's not set simply remove the key from the kernel
4723          * list (we've still notified user space about it but with
4724          * store_hint being 0).
4725          */
4726         if (key->type == HCI_LK_DEBUG_COMBINATION &&
4727             !hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) {
4728                 list_del_rcu(&key->list);
4729                 kfree_rcu(key, rcu);
4730                 goto unlock;
4731         }
4732
4733         if (persistent)
4734                 clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
4735         else
4736                 set_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
4737
4738 unlock:
4739         hci_dev_unlock(hdev);
4740 }
4741
4742 static void hci_clock_offset_evt(struct hci_dev *hdev, void *data,
4743                                  struct sk_buff *skb)
4744 {
4745         struct hci_ev_clock_offset *ev = data;
4746         struct hci_conn *conn;
4747
4748         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
4749
4750         hci_dev_lock(hdev);
4751
4752         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4753         if (conn && !ev->status) {
4754                 struct inquiry_entry *ie;
4755
4756                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
4757                 if (ie) {
4758                         ie->data.clock_offset = ev->clock_offset;
4759                         ie->timestamp = jiffies;
4760                 }
4761         }
4762
4763         hci_dev_unlock(hdev);
4764 }
4765
4766 static void hci_pkt_type_change_evt(struct hci_dev *hdev, void *data,
4767                                     struct sk_buff *skb)
4768 {
4769         struct hci_ev_pkt_type_change *ev = data;
4770         struct hci_conn *conn;
4771
4772         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
4773
4774         hci_dev_lock(hdev);
4775
4776         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4777         if (conn && !ev->status)
4778                 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
4779
4780         hci_dev_unlock(hdev);
4781 }
4782
4783 static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, void *data,
4784                                    struct sk_buff *skb)
4785 {
4786         struct hci_ev_pscan_rep_mode *ev = data;
4787         struct inquiry_entry *ie;
4788
4789         bt_dev_dbg(hdev, "");
4790
4791         hci_dev_lock(hdev);
4792
4793         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
4794         if (ie) {
4795                 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
4796                 ie->timestamp = jiffies;
4797         }
4798
4799         hci_dev_unlock(hdev);
4800 }
4801
4802 static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, void *edata,
4803                                              struct sk_buff *skb)
4804 {
4805         struct hci_ev_inquiry_result_rssi *ev = edata;
4806         struct inquiry_data data;
4807         int i;
4808
4809         bt_dev_dbg(hdev, "num_rsp %d", ev->num);
4810
4811         if (!ev->num)
4812                 return;
4813
4814         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
4815                 return;
4816
4817         hci_dev_lock(hdev);
4818
4819         if (skb->len == array_size(ev->num,
4820                                    sizeof(struct inquiry_info_rssi_pscan))) {
4821                 struct inquiry_info_rssi_pscan *info;
4822
4823                 for (i = 0; i < ev->num; i++) {
4824                         u32 flags;
4825
4826                         info = hci_ev_skb_pull(hdev, skb,
4827                                                HCI_EV_INQUIRY_RESULT_WITH_RSSI,
4828                                                sizeof(*info));
4829                         if (!info) {
4830                                 bt_dev_err(hdev, "Malformed HCI Event: 0x%2.2x",
4831                                            HCI_EV_INQUIRY_RESULT_WITH_RSSI);
4832                                 goto unlock;
4833                         }
4834
4835                         bacpy(&data.bdaddr, &info->bdaddr);
4836                         data.pscan_rep_mode     = info->pscan_rep_mode;
4837                         data.pscan_period_mode  = info->pscan_period_mode;
4838                         data.pscan_mode         = info->pscan_mode;
4839                         memcpy(data.dev_class, info->dev_class, 3);
4840                         data.clock_offset       = info->clock_offset;
4841                         data.rssi               = info->rssi;
4842                         data.ssp_mode           = 0x00;
4843
4844                         flags = hci_inquiry_cache_update(hdev, &data, false);
4845
4846                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4847                                           info->dev_class, info->rssi,
4848                                           flags, NULL, 0, NULL, 0, 0);
4849                 }
4850         } else if (skb->len == array_size(ev->num,
4851                                           sizeof(struct inquiry_info_rssi))) {
4852                 struct inquiry_info_rssi *info;
4853
4854                 for (i = 0; i < ev->num; i++) {
4855                         u32 flags;
4856
4857                         info = hci_ev_skb_pull(hdev, skb,
4858                                                HCI_EV_INQUIRY_RESULT_WITH_RSSI,
4859                                                sizeof(*info));
4860                         if (!info) {
4861                                 bt_dev_err(hdev, "Malformed HCI Event: 0x%2.2x",
4862                                            HCI_EV_INQUIRY_RESULT_WITH_RSSI);
4863                                 goto unlock;
4864                         }
4865
4866                         bacpy(&data.bdaddr, &info->bdaddr);
4867                         data.pscan_rep_mode     = info->pscan_rep_mode;
4868                         data.pscan_period_mode  = info->pscan_period_mode;
4869                         data.pscan_mode         = 0x00;
4870                         memcpy(data.dev_class, info->dev_class, 3);
4871                         data.clock_offset       = info->clock_offset;
4872                         data.rssi               = info->rssi;
4873                         data.ssp_mode           = 0x00;
4874
4875                         flags = hci_inquiry_cache_update(hdev, &data, false);
4876
4877                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4878                                           info->dev_class, info->rssi,
4879                                           flags, NULL, 0, NULL, 0, 0);
4880                 }
4881         } else {
4882                 bt_dev_err(hdev, "Malformed HCI Event: 0x%2.2x",
4883                            HCI_EV_INQUIRY_RESULT_WITH_RSSI);
4884         }
4885 unlock:
4886         hci_dev_unlock(hdev);
4887 }
4888
4889 static void hci_remote_ext_features_evt(struct hci_dev *hdev, void *data,
4890                                         struct sk_buff *skb)
4891 {
4892         struct hci_ev_remote_ext_features *ev = data;
4893         struct hci_conn *conn;
4894
4895         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
4896
4897         hci_dev_lock(hdev);
4898
4899         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4900         if (!conn)
4901                 goto unlock;
4902
4903         if (ev->page < HCI_MAX_PAGES)
4904                 memcpy(conn->features[ev->page], ev->features, 8);
4905
4906         if (!ev->status && ev->page == 0x01) {
4907                 struct inquiry_entry *ie;
4908
4909                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
4910                 if (ie)
4911                         ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
4912
4913                 if (ev->features[0] & LMP_HOST_SSP) {
4914                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
4915                 } else {
4916                         /* It is mandatory by the Bluetooth specification that
4917                          * Extended Inquiry Results are only used when Secure
4918                          * Simple Pairing is enabled, but some devices violate
4919                          * this.
4920                          *
4921                          * To make these devices work, the internal SSP
4922                          * enabled flag needs to be cleared if the remote host
4923                          * features do not indicate SSP support */
4924                         clear_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
4925                 }
4926
4927                 if (ev->features[0] & LMP_HOST_SC)
4928                         set_bit(HCI_CONN_SC_ENABLED, &conn->flags);
4929         }
4930
4931         if (conn->state != BT_CONFIG)
4932                 goto unlock;
4933
4934         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
4935                 struct hci_cp_remote_name_req cp;
4936                 memset(&cp, 0, sizeof(cp));
4937                 bacpy(&cp.bdaddr, &conn->dst);
4938                 cp.pscan_rep_mode = 0x02;
4939                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
4940         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
4941                 mgmt_device_connected(hdev, conn, NULL, 0);
4942
4943         if (!hci_outgoing_auth_needed(hdev, conn)) {
4944                 conn->state = BT_CONNECTED;
4945                 hci_connect_cfm(conn, ev->status);
4946                 hci_conn_drop(conn);
4947         }
4948
4949 unlock:
4950         hci_dev_unlock(hdev);
4951 }
4952
4953 static void hci_sync_conn_complete_evt(struct hci_dev *hdev, void *data,
4954                                        struct sk_buff *skb)
4955 {
4956         struct hci_ev_sync_conn_complete *ev = data;
4957         struct hci_conn *conn;
4958         u8 status = ev->status;
4959
4960         switch (ev->link_type) {
4961         case SCO_LINK:
4962         case ESCO_LINK:
4963                 break;
4964         default:
4965                 /* As per Core 5.3 Vol 4 Part E 7.7.35 (p.2219), Link_Type
4966                  * for HCI_Synchronous_Connection_Complete is limited to
4967                  * either SCO or eSCO
4968                  */
4969                 bt_dev_err(hdev, "Ignoring connect complete event for invalid link type");
4970                 return;
4971         }
4972
4973         bt_dev_dbg(hdev, "status 0x%2.2x", status);
4974
4975         hci_dev_lock(hdev);
4976
4977         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
4978         if (!conn) {
4979                 if (ev->link_type == ESCO_LINK)
4980                         goto unlock;
4981
4982                 /* When the link type in the event indicates SCO connection
4983                  * and lookup of the connection object fails, then check
4984                  * if an eSCO connection object exists.
4985                  *
4986                  * The core limits the synchronous connections to either
4987                  * SCO or eSCO. The eSCO connection is preferred and tried
4988                  * to be setup first and until successfully established,
4989                  * the link type will be hinted as eSCO.
4990                  */
4991                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
4992                 if (!conn)
4993                         goto unlock;
4994         }
4995
4996         /* The HCI_Synchronous_Connection_Complete event is only sent once per connection.
4997          * Processing it more than once per connection can corrupt kernel memory.
4998          *
4999          * As the connection handle is set here for the first time, it indicates
5000          * whether the connection is already set up.
5001          */
5002         if (conn->handle != HCI_CONN_HANDLE_UNSET) {
5003                 bt_dev_err(hdev, "Ignoring HCI_Sync_Conn_Complete event for existing connection");
5004                 goto unlock;
5005         }
5006
5007         switch (status) {
5008         case 0x00:
5009                 conn->handle = __le16_to_cpu(ev->handle);
5010                 if (conn->handle > HCI_CONN_HANDLE_MAX) {
5011                         bt_dev_err(hdev, "Invalid handle: 0x%4.4x > 0x%4.4x",
5012                                    conn->handle, HCI_CONN_HANDLE_MAX);
5013                         status = HCI_ERROR_INVALID_PARAMETERS;
5014                         conn->state = BT_CLOSED;
5015                         break;
5016                 }
5017
5018                 conn->state  = BT_CONNECTED;
5019                 conn->type   = ev->link_type;
5020
5021                 hci_debugfs_create_conn(conn);
5022                 hci_conn_add_sysfs(conn);
5023                 break;
5024
5025         case 0x10:      /* Connection Accept Timeout */
5026         case 0x0d:      /* Connection Rejected due to Limited Resources */
5027         case 0x11:      /* Unsupported Feature or Parameter Value */
5028         case 0x1c:      /* SCO interval rejected */
5029         case 0x1a:      /* Unsupported Remote Feature */
5030         case 0x1e:      /* Invalid LMP Parameters */
5031         case 0x1f:      /* Unspecified error */
5032         case 0x20:      /* Unsupported LMP Parameter value */
5033                 if (conn->out) {
5034                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
5035                                         (hdev->esco_type & EDR_ESCO_MASK);
5036                         if (hci_setup_sync(conn, conn->parent->handle))
5037                                 goto unlock;
5038                 }
5039                 fallthrough;
5040
5041         default:
5042                 conn->state = BT_CLOSED;
5043                 break;
5044         }
5045
5046         bt_dev_dbg(hdev, "SCO connected with air mode: %02x", ev->air_mode);
5047         /* Notify only in case of SCO over HCI transport data path which
5048          * is zero and non-zero value shall be non-HCI transport data path
5049          */
5050         if (conn->codec.data_path == 0 && hdev->notify) {
5051                 switch (ev->air_mode) {
5052                 case 0x02:
5053                         hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_CVSD);
5054                         break;
5055                 case 0x03:
5056                         hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_TRANSP);
5057                         break;
5058                 }
5059         }
5060
5061         hci_connect_cfm(conn, status);
5062         if (status)
5063                 hci_conn_del(conn);
5064
5065 unlock:
5066         hci_dev_unlock(hdev);
5067 }
5068
5069 static inline size_t eir_get_length(u8 *eir, size_t eir_len)
5070 {
5071         size_t parsed = 0;
5072
5073         while (parsed < eir_len) {
5074                 u8 field_len = eir[0];
5075
5076                 if (field_len == 0)
5077                         return parsed;
5078
5079                 parsed += field_len + 1;
5080                 eir += field_len + 1;
5081         }
5082
5083         return eir_len;
5084 }
5085
5086 static void hci_extended_inquiry_result_evt(struct hci_dev *hdev, void *edata,
5087                                             struct sk_buff *skb)
5088 {
5089         struct hci_ev_ext_inquiry_result *ev = edata;
5090         struct inquiry_data data;
5091         size_t eir_len;
5092         int i;
5093
5094         if (!hci_ev_skb_pull(hdev, skb, HCI_EV_EXTENDED_INQUIRY_RESULT,
5095                              flex_array_size(ev, info, ev->num)))
5096                 return;
5097
5098         bt_dev_dbg(hdev, "num %d", ev->num);
5099
5100         if (!ev->num)
5101                 return;
5102
5103         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
5104                 return;
5105
5106         hci_dev_lock(hdev);
5107
5108         for (i = 0; i < ev->num; i++) {
5109                 struct extended_inquiry_info *info = &ev->info[i];
5110                 u32 flags;
5111                 bool name_known;
5112
5113                 bacpy(&data.bdaddr, &info->bdaddr);
5114                 data.pscan_rep_mode     = info->pscan_rep_mode;
5115                 data.pscan_period_mode  = info->pscan_period_mode;
5116                 data.pscan_mode         = 0x00;
5117                 memcpy(data.dev_class, info->dev_class, 3);
5118                 data.clock_offset       = info->clock_offset;
5119                 data.rssi               = info->rssi;
5120                 data.ssp_mode           = 0x01;
5121
5122                 if (hci_dev_test_flag(hdev, HCI_MGMT))
5123                         name_known = eir_get_data(info->data,
5124                                                   sizeof(info->data),
5125                                                   EIR_NAME_COMPLETE, NULL);
5126                 else
5127                         name_known = true;
5128
5129                 flags = hci_inquiry_cache_update(hdev, &data, name_known);
5130
5131                 eir_len = eir_get_length(info->data, sizeof(info->data));
5132
5133                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
5134                                   info->dev_class, info->rssi,
5135                                   flags, info->data, eir_len, NULL, 0, 0);
5136         }
5137
5138         hci_dev_unlock(hdev);
5139 }
5140
5141 static void hci_key_refresh_complete_evt(struct hci_dev *hdev, void *data,
5142                                          struct sk_buff *skb)
5143 {
5144         struct hci_ev_key_refresh_complete *ev = data;
5145         struct hci_conn *conn;
5146
5147         bt_dev_dbg(hdev, "status 0x%2.2x handle 0x%4.4x", ev->status,
5148                    __le16_to_cpu(ev->handle));
5149
5150         hci_dev_lock(hdev);
5151
5152         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5153         if (!conn)
5154                 goto unlock;
5155
5156         /* For BR/EDR the necessary steps are taken through the
5157          * auth_complete event.
5158          */
5159         if (conn->type != LE_LINK)
5160                 goto unlock;
5161
5162         if (!ev->status)
5163                 conn->sec_level = conn->pending_sec_level;
5164
5165         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
5166
5167         if (ev->status && conn->state == BT_CONNECTED) {
5168                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
5169                 hci_conn_drop(conn);
5170                 goto unlock;
5171         }
5172
5173         if (conn->state == BT_CONFIG) {
5174                 if (!ev->status)
5175                         conn->state = BT_CONNECTED;
5176
5177                 hci_connect_cfm(conn, ev->status);
5178                 hci_conn_drop(conn);
5179         } else {
5180                 hci_auth_cfm(conn, ev->status);
5181
5182                 hci_conn_hold(conn);
5183                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
5184                 hci_conn_drop(conn);
5185         }
5186
5187 unlock:
5188         hci_dev_unlock(hdev);
5189 }
5190
5191 static u8 hci_get_auth_req(struct hci_conn *conn)
5192 {
5193         /* If remote requests no-bonding follow that lead */
5194         if (conn->remote_auth == HCI_AT_NO_BONDING ||
5195             conn->remote_auth == HCI_AT_NO_BONDING_MITM)
5196                 return conn->remote_auth | (conn->auth_type & 0x01);
5197
5198         /* If both remote and local have enough IO capabilities, require
5199          * MITM protection
5200          */
5201         if (conn->remote_cap != HCI_IO_NO_INPUT_OUTPUT &&
5202             conn->io_capability != HCI_IO_NO_INPUT_OUTPUT)
5203                 return conn->remote_auth | 0x01;
5204
5205         /* No MITM protection possible so ignore remote requirement */
5206         return (conn->remote_auth & ~0x01) | (conn->auth_type & 0x01);
5207 }
5208
5209 static u8 bredr_oob_data_present(struct hci_conn *conn)
5210 {
5211         struct hci_dev *hdev = conn->hdev;
5212         struct oob_data *data;
5213
5214         data = hci_find_remote_oob_data(hdev, &conn->dst, BDADDR_BREDR);
5215         if (!data)
5216                 return 0x00;
5217
5218         if (bredr_sc_enabled(hdev)) {
5219                 /* When Secure Connections is enabled, then just
5220                  * return the present value stored with the OOB
5221                  * data. The stored value contains the right present
5222                  * information. However it can only be trusted when
5223                  * not in Secure Connection Only mode.
5224                  */
5225                 if (!hci_dev_test_flag(hdev, HCI_SC_ONLY))
5226                         return data->present;
5227
5228                 /* When Secure Connections Only mode is enabled, then
5229                  * the P-256 values are required. If they are not
5230                  * available, then do not declare that OOB data is
5231                  * present.
5232                  */
5233                 if (!memcmp(data->rand256, ZERO_KEY, 16) ||
5234                     !memcmp(data->hash256, ZERO_KEY, 16))
5235                         return 0x00;
5236
5237                 return 0x02;
5238         }
5239
5240         /* When Secure Connections is not enabled or actually
5241          * not supported by the hardware, then check that if
5242          * P-192 data values are present.
5243          */
5244         if (!memcmp(data->rand192, ZERO_KEY, 16) ||
5245             !memcmp(data->hash192, ZERO_KEY, 16))
5246                 return 0x00;
5247
5248         return 0x01;
5249 }
5250
5251 static void hci_io_capa_request_evt(struct hci_dev *hdev, void *data,
5252                                     struct sk_buff *skb)
5253 {
5254         struct hci_ev_io_capa_request *ev = data;
5255         struct hci_conn *conn;
5256
5257         bt_dev_dbg(hdev, "");
5258
5259         hci_dev_lock(hdev);
5260
5261         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
5262         if (!conn)
5263                 goto unlock;
5264
5265         hci_conn_hold(conn);
5266
5267         if (!hci_dev_test_flag(hdev, HCI_MGMT))
5268                 goto unlock;
5269
5270         /* Allow pairing if we're pairable, the initiators of the
5271          * pairing or if the remote is not requesting bonding.
5272          */
5273         if (hci_dev_test_flag(hdev, HCI_BONDABLE) ||
5274             test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags) ||
5275             (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
5276                 struct hci_cp_io_capability_reply cp;
5277
5278                 bacpy(&cp.bdaddr, &ev->bdaddr);
5279                 /* Change the IO capability from KeyboardDisplay
5280                  * to DisplayYesNo as it is not supported by BT spec. */
5281                 cp.capability = (conn->io_capability == 0x04) ?
5282                                 HCI_IO_DISPLAY_YESNO : conn->io_capability;
5283
5284                 /* If we are initiators, there is no remote information yet */
5285                 if (conn->remote_auth == 0xff) {
5286                         /* Request MITM protection if our IO caps allow it
5287                          * except for the no-bonding case.
5288                          */
5289                         if (conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
5290                             conn->auth_type != HCI_AT_NO_BONDING)
5291                                 conn->auth_type |= 0x01;
5292                 } else {
5293                         conn->auth_type = hci_get_auth_req(conn);
5294                 }
5295
5296                 /* If we're not bondable, force one of the non-bondable
5297                  * authentication requirement values.
5298                  */
5299                 if (!hci_dev_test_flag(hdev, HCI_BONDABLE))
5300                         conn->auth_type &= HCI_AT_NO_BONDING_MITM;
5301
5302                 cp.authentication = conn->auth_type;
5303                 cp.oob_data = bredr_oob_data_present(conn);
5304
5305                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
5306                              sizeof(cp), &cp);
5307         } else {
5308                 struct hci_cp_io_capability_neg_reply cp;
5309
5310                 bacpy(&cp.bdaddr, &ev->bdaddr);
5311                 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
5312
5313                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
5314                              sizeof(cp), &cp);
5315         }
5316
5317 unlock:
5318         hci_dev_unlock(hdev);
5319 }
5320
5321 static void hci_io_capa_reply_evt(struct hci_dev *hdev, void *data,
5322                                   struct sk_buff *skb)
5323 {
5324         struct hci_ev_io_capa_reply *ev = data;
5325         struct hci_conn *conn;
5326
5327         bt_dev_dbg(hdev, "");
5328
5329         hci_dev_lock(hdev);
5330
5331         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
5332         if (!conn)
5333                 goto unlock;
5334
5335         conn->remote_cap = ev->capability;
5336         conn->remote_auth = ev->authentication;
5337
5338 unlock:
5339         hci_dev_unlock(hdev);
5340 }
5341
5342 static void hci_user_confirm_request_evt(struct hci_dev *hdev, void *data,
5343                                          struct sk_buff *skb)
5344 {
5345         struct hci_ev_user_confirm_req *ev = data;
5346         int loc_mitm, rem_mitm, confirm_hint = 0;
5347         struct hci_conn *conn;
5348
5349         bt_dev_dbg(hdev, "");
5350
5351         hci_dev_lock(hdev);
5352
5353         if (!hci_dev_test_flag(hdev, HCI_MGMT))
5354                 goto unlock;
5355
5356         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
5357         if (!conn)
5358                 goto unlock;
5359
5360         loc_mitm = (conn->auth_type & 0x01);
5361         rem_mitm = (conn->remote_auth & 0x01);
5362
5363         /* If we require MITM but the remote device can't provide that
5364          * (it has NoInputNoOutput) then reject the confirmation
5365          * request. We check the security level here since it doesn't
5366          * necessarily match conn->auth_type.
5367          */
5368         if (conn->pending_sec_level > BT_SECURITY_MEDIUM &&
5369             conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
5370                 bt_dev_dbg(hdev, "Rejecting request: remote device can't provide MITM");
5371                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
5372                              sizeof(ev->bdaddr), &ev->bdaddr);
5373                 goto unlock;
5374         }
5375
5376         /* If no side requires MITM protection; auto-accept */
5377         if ((!loc_mitm || conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) &&
5378             (!rem_mitm || conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)) {
5379
5380                 /* If we're not the initiators request authorization to
5381                  * proceed from user space (mgmt_user_confirm with
5382                  * confirm_hint set to 1). The exception is if neither
5383                  * side had MITM or if the local IO capability is
5384                  * NoInputNoOutput, in which case we do auto-accept
5385                  */
5386                 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&
5387                     conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
5388                     (loc_mitm || rem_mitm)) {
5389                         bt_dev_dbg(hdev, "Confirming auto-accept as acceptor");
5390                         confirm_hint = 1;
5391                         goto confirm;
5392                 }
5393
5394                 /* If there already exists link key in local host, leave the
5395                  * decision to user space since the remote device could be
5396                  * legitimate or malicious.
5397                  */
5398                 if (hci_find_link_key(hdev, &ev->bdaddr)) {
5399                         bt_dev_dbg(hdev, "Local host already has link key");
5400                         confirm_hint = 1;
5401                         goto confirm;
5402                 }
5403
5404                 BT_DBG("Auto-accept of user confirmation with %ums delay",
5405                        hdev->auto_accept_delay);
5406
5407                 if (hdev->auto_accept_delay > 0) {
5408                         int delay = msecs_to_jiffies(hdev->auto_accept_delay);
5409                         queue_delayed_work(conn->hdev->workqueue,
5410                                            &conn->auto_accept_work, delay);
5411                         goto unlock;
5412                 }
5413
5414                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
5415                              sizeof(ev->bdaddr), &ev->bdaddr);
5416                 goto unlock;
5417         }
5418
5419 confirm:
5420         mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0,
5421                                   le32_to_cpu(ev->passkey), confirm_hint);
5422
5423 unlock:
5424         hci_dev_unlock(hdev);
5425 }
5426
5427 static void hci_user_passkey_request_evt(struct hci_dev *hdev, void *data,
5428                                          struct sk_buff *skb)
5429 {
5430         struct hci_ev_user_passkey_req *ev = data;
5431
5432         bt_dev_dbg(hdev, "");
5433
5434         if (hci_dev_test_flag(hdev, HCI_MGMT))
5435                 mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
5436 }
5437
5438 static void hci_user_passkey_notify_evt(struct hci_dev *hdev, void *data,
5439                                         struct sk_buff *skb)
5440 {
5441         struct hci_ev_user_passkey_notify *ev = data;
5442         struct hci_conn *conn;
5443
5444         bt_dev_dbg(hdev, "");
5445
5446         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
5447         if (!conn)
5448                 return;
5449
5450         conn->passkey_notify = __le32_to_cpu(ev->passkey);
5451         conn->passkey_entered = 0;
5452
5453         if (hci_dev_test_flag(hdev, HCI_MGMT))
5454                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
5455                                          conn->dst_type, conn->passkey_notify,
5456                                          conn->passkey_entered);
5457 }
5458
5459 static void hci_keypress_notify_evt(struct hci_dev *hdev, void *data,
5460                                     struct sk_buff *skb)
5461 {
5462         struct hci_ev_keypress_notify *ev = data;
5463         struct hci_conn *conn;
5464
5465         bt_dev_dbg(hdev, "");
5466
5467         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
5468         if (!conn)
5469                 return;
5470
5471         switch (ev->type) {
5472         case HCI_KEYPRESS_STARTED:
5473                 conn->passkey_entered = 0;
5474                 return;
5475
5476         case HCI_KEYPRESS_ENTERED:
5477                 conn->passkey_entered++;
5478                 break;
5479
5480         case HCI_KEYPRESS_ERASED:
5481                 conn->passkey_entered--;
5482                 break;
5483
5484         case HCI_KEYPRESS_CLEARED:
5485                 conn->passkey_entered = 0;
5486                 break;
5487
5488         case HCI_KEYPRESS_COMPLETED:
5489                 return;
5490         }
5491
5492         if (hci_dev_test_flag(hdev, HCI_MGMT))
5493                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
5494                                          conn->dst_type, conn->passkey_notify,
5495                                          conn->passkey_entered);
5496 }
5497
5498 static void hci_simple_pair_complete_evt(struct hci_dev *hdev, void *data,
5499                                          struct sk_buff *skb)
5500 {
5501         struct hci_ev_simple_pair_complete *ev = data;
5502         struct hci_conn *conn;
5503
5504         bt_dev_dbg(hdev, "");
5505
5506         hci_dev_lock(hdev);
5507
5508         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
5509         if (!conn)
5510                 goto unlock;
5511
5512         /* Reset the authentication requirement to unknown */
5513         conn->remote_auth = 0xff;
5514
5515         /* To avoid duplicate auth_failed events to user space we check
5516          * the HCI_CONN_AUTH_PEND flag which will be set if we
5517          * initiated the authentication. A traditional auth_complete
5518          * event gets always produced as initiator and is also mapped to
5519          * the mgmt_auth_failed event */
5520         if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status)
5521                 mgmt_auth_failed(conn, ev->status);
5522
5523         hci_conn_drop(conn);
5524
5525 unlock:
5526         hci_dev_unlock(hdev);
5527 }
5528
5529 static void hci_remote_host_features_evt(struct hci_dev *hdev, void *data,
5530                                          struct sk_buff *skb)
5531 {
5532         struct hci_ev_remote_host_features *ev = data;
5533         struct inquiry_entry *ie;
5534         struct hci_conn *conn;
5535
5536         bt_dev_dbg(hdev, "");
5537
5538         hci_dev_lock(hdev);
5539
5540         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
5541         if (conn)
5542                 memcpy(conn->features[1], ev->features, 8);
5543
5544         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
5545         if (ie)
5546                 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
5547
5548         hci_dev_unlock(hdev);
5549 }
5550
5551 static void hci_remote_oob_data_request_evt(struct hci_dev *hdev, void *edata,
5552                                             struct sk_buff *skb)
5553 {
5554         struct hci_ev_remote_oob_data_request *ev = edata;
5555         struct oob_data *data;
5556
5557         bt_dev_dbg(hdev, "");
5558
5559         hci_dev_lock(hdev);
5560
5561         if (!hci_dev_test_flag(hdev, HCI_MGMT))
5562                 goto unlock;
5563
5564         data = hci_find_remote_oob_data(hdev, &ev->bdaddr, BDADDR_BREDR);
5565         if (!data) {
5566                 struct hci_cp_remote_oob_data_neg_reply cp;
5567
5568                 bacpy(&cp.bdaddr, &ev->bdaddr);
5569                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY,
5570                              sizeof(cp), &cp);
5571                 goto unlock;
5572         }
5573
5574         if (bredr_sc_enabled(hdev)) {
5575                 struct hci_cp_remote_oob_ext_data_reply cp;
5576
5577                 bacpy(&cp.bdaddr, &ev->bdaddr);
5578                 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
5579                         memset(cp.hash192, 0, sizeof(cp.hash192));
5580                         memset(cp.rand192, 0, sizeof(cp.rand192));
5581                 } else {
5582                         memcpy(cp.hash192, data->hash192, sizeof(cp.hash192));
5583                         memcpy(cp.rand192, data->rand192, sizeof(cp.rand192));
5584                 }
5585                 memcpy(cp.hash256, data->hash256, sizeof(cp.hash256));
5586                 memcpy(cp.rand256, data->rand256, sizeof(cp.rand256));
5587
5588                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_EXT_DATA_REPLY,
5589                              sizeof(cp), &cp);
5590         } else {
5591                 struct hci_cp_remote_oob_data_reply cp;
5592
5593                 bacpy(&cp.bdaddr, &ev->bdaddr);
5594                 memcpy(cp.hash, data->hash192, sizeof(cp.hash));
5595                 memcpy(cp.rand, data->rand192, sizeof(cp.rand));
5596
5597                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY,
5598                              sizeof(cp), &cp);
5599         }
5600
5601 unlock:
5602         hci_dev_unlock(hdev);
5603 }
5604
5605 #if IS_ENABLED(CONFIG_BT_HS)
5606 static void hci_chan_selected_evt(struct hci_dev *hdev, void *data,
5607                                   struct sk_buff *skb)
5608 {
5609         struct hci_ev_channel_selected *ev = data;
5610         struct hci_conn *hcon;
5611
5612         bt_dev_dbg(hdev, "handle 0x%2.2x", ev->phy_handle);
5613
5614         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
5615         if (!hcon)
5616                 return;
5617
5618         amp_read_loc_assoc_final_data(hdev, hcon);
5619 }
5620
5621 static void hci_phy_link_complete_evt(struct hci_dev *hdev, void *data,
5622                                       struct sk_buff *skb)
5623 {
5624         struct hci_ev_phy_link_complete *ev = data;
5625         struct hci_conn *hcon, *bredr_hcon;
5626
5627         bt_dev_dbg(hdev, "handle 0x%2.2x status 0x%2.2x", ev->phy_handle,
5628                    ev->status);
5629
5630         hci_dev_lock(hdev);
5631
5632         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
5633         if (!hcon)
5634                 goto unlock;
5635
5636         if (!hcon->amp_mgr)
5637                 goto unlock;
5638
5639         if (ev->status) {
5640                 hci_conn_del(hcon);
5641                 goto unlock;
5642         }
5643
5644         bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
5645
5646         hcon->state = BT_CONNECTED;
5647         bacpy(&hcon->dst, &bredr_hcon->dst);
5648
5649         hci_conn_hold(hcon);
5650         hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
5651         hci_conn_drop(hcon);
5652
5653         hci_debugfs_create_conn(hcon);
5654         hci_conn_add_sysfs(hcon);
5655
5656         amp_physical_cfm(bredr_hcon, hcon);
5657
5658 unlock:
5659         hci_dev_unlock(hdev);
5660 }
5661
5662 static void hci_loglink_complete_evt(struct hci_dev *hdev, void *data,
5663                                      struct sk_buff *skb)
5664 {
5665         struct hci_ev_logical_link_complete *ev = data;
5666         struct hci_conn *hcon;
5667         struct hci_chan *hchan;
5668         struct amp_mgr *mgr;
5669
5670         bt_dev_dbg(hdev, "log_handle 0x%4.4x phy_handle 0x%2.2x status 0x%2.2x",
5671                    le16_to_cpu(ev->handle), ev->phy_handle, ev->status);
5672
5673         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
5674         if (!hcon)
5675                 return;
5676
5677         /* Create AMP hchan */
5678         hchan = hci_chan_create(hcon);
5679         if (!hchan)
5680                 return;
5681
5682         hchan->handle = le16_to_cpu(ev->handle);
5683         hchan->amp = true;
5684
5685         BT_DBG("hcon %p mgr %p hchan %p", hcon, hcon->amp_mgr, hchan);
5686
5687         mgr = hcon->amp_mgr;
5688         if (mgr && mgr->bredr_chan) {
5689                 struct l2cap_chan *bredr_chan = mgr->bredr_chan;
5690
5691                 l2cap_chan_lock(bredr_chan);
5692
5693                 bredr_chan->conn->mtu = hdev->block_mtu;
5694                 l2cap_logical_cfm(bredr_chan, hchan, 0);
5695                 hci_conn_hold(hcon);
5696
5697                 l2cap_chan_unlock(bredr_chan);
5698         }
5699 }
5700
5701 static void hci_disconn_loglink_complete_evt(struct hci_dev *hdev, void *data,
5702                                              struct sk_buff *skb)
5703 {
5704         struct hci_ev_disconn_logical_link_complete *ev = data;
5705         struct hci_chan *hchan;
5706
5707         bt_dev_dbg(hdev, "handle 0x%4.4x status 0x%2.2x",
5708                    le16_to_cpu(ev->handle), ev->status);
5709
5710         if (ev->status)
5711                 return;
5712
5713         hci_dev_lock(hdev);
5714
5715         hchan = hci_chan_lookup_handle(hdev, le16_to_cpu(ev->handle));
5716         if (!hchan || !hchan->amp)
5717                 goto unlock;
5718
5719         amp_destroy_logical_link(hchan, ev->reason);
5720
5721 unlock:
5722         hci_dev_unlock(hdev);
5723 }
5724
5725 static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev, void *data,
5726                                              struct sk_buff *skb)
5727 {
5728         struct hci_ev_disconn_phy_link_complete *ev = data;
5729         struct hci_conn *hcon;
5730
5731         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
5732
5733         if (ev->status)
5734                 return;
5735
5736         hci_dev_lock(hdev);
5737
5738         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
5739         if (hcon && hcon->type == AMP_LINK) {
5740                 hcon->state = BT_CLOSED;
5741                 hci_disconn_cfm(hcon, ev->reason);
5742                 hci_conn_del(hcon);
5743         }
5744
5745         hci_dev_unlock(hdev);
5746 }
5747 #endif
5748
5749 static void le_conn_update_addr(struct hci_conn *conn, bdaddr_t *bdaddr,
5750                                 u8 bdaddr_type, bdaddr_t *local_rpa)
5751 {
5752         if (conn->out) {
5753                 conn->dst_type = bdaddr_type;
5754                 conn->resp_addr_type = bdaddr_type;
5755                 bacpy(&conn->resp_addr, bdaddr);
5756
5757                 /* Check if the controller has set a Local RPA then it must be
5758                  * used instead or hdev->rpa.
5759                  */
5760                 if (local_rpa && bacmp(local_rpa, BDADDR_ANY)) {
5761                         conn->init_addr_type = ADDR_LE_DEV_RANDOM;
5762                         bacpy(&conn->init_addr, local_rpa);
5763                 } else if (hci_dev_test_flag(conn->hdev, HCI_PRIVACY)) {
5764                         conn->init_addr_type = ADDR_LE_DEV_RANDOM;
5765                         bacpy(&conn->init_addr, &conn->hdev->rpa);
5766                 } else {
5767                         hci_copy_identity_address(conn->hdev, &conn->init_addr,
5768                                                   &conn->init_addr_type);
5769                 }
5770         } else {
5771                 conn->resp_addr_type = conn->hdev->adv_addr_type;
5772                 /* Check if the controller has set a Local RPA then it must be
5773                  * used instead or hdev->rpa.
5774                  */
5775                 if (local_rpa && bacmp(local_rpa, BDADDR_ANY)) {
5776                         conn->resp_addr_type = ADDR_LE_DEV_RANDOM;
5777                         bacpy(&conn->resp_addr, local_rpa);
5778                 } else if (conn->hdev->adv_addr_type == ADDR_LE_DEV_RANDOM) {
5779                         /* In case of ext adv, resp_addr will be updated in
5780                          * Adv Terminated event.
5781                          */
5782                         if (!ext_adv_capable(conn->hdev))
5783                                 bacpy(&conn->resp_addr,
5784                                       &conn->hdev->random_addr);
5785                 } else {
5786                         bacpy(&conn->resp_addr, &conn->hdev->bdaddr);
5787                 }
5788
5789                 conn->init_addr_type = bdaddr_type;
5790                 bacpy(&conn->init_addr, bdaddr);
5791
5792                 /* For incoming connections, set the default minimum
5793                  * and maximum connection interval. They will be used
5794                  * to check if the parameters are in range and if not
5795                  * trigger the connection update procedure.
5796                  */
5797                 conn->le_conn_min_interval = conn->hdev->le_conn_min_interval;
5798                 conn->le_conn_max_interval = conn->hdev->le_conn_max_interval;
5799         }
5800 }
5801
5802 static void le_conn_complete_evt(struct hci_dev *hdev, u8 status,
5803                                  bdaddr_t *bdaddr, u8 bdaddr_type,
5804                                  bdaddr_t *local_rpa, u8 role, u16 handle,
5805                                  u16 interval, u16 latency,
5806                                  u16 supervision_timeout)
5807 {
5808         struct hci_conn_params *params;
5809         struct hci_conn *conn;
5810         struct smp_irk *irk;
5811         u8 addr_type;
5812
5813         hci_dev_lock(hdev);
5814
5815         /* All controllers implicitly stop advertising in the event of a
5816          * connection, so ensure that the state bit is cleared.
5817          */
5818         hci_dev_clear_flag(hdev, HCI_LE_ADV);
5819
5820         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr);
5821         if (!conn) {
5822                 /* In case of error status and there is no connection pending
5823                  * just unlock as there is nothing to cleanup.
5824                  */
5825                 if (status)
5826                         goto unlock;
5827
5828                 conn = hci_conn_add(hdev, LE_LINK, bdaddr, role);
5829                 if (!conn) {
5830                         bt_dev_err(hdev, "no memory for new connection");
5831                         goto unlock;
5832                 }
5833
5834                 conn->dst_type = bdaddr_type;
5835
5836                 /* If we didn't have a hci_conn object previously
5837                  * but we're in central role this must be something
5838                  * initiated using an accept list. Since accept list based
5839                  * connections are not "first class citizens" we don't
5840                  * have full tracking of them. Therefore, we go ahead
5841                  * with a "best effort" approach of determining the
5842                  * initiator address based on the HCI_PRIVACY flag.
5843                  */
5844                 if (conn->out) {
5845                         conn->resp_addr_type = bdaddr_type;
5846                         bacpy(&conn->resp_addr, bdaddr);
5847                         if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
5848                                 conn->init_addr_type = ADDR_LE_DEV_RANDOM;
5849                                 bacpy(&conn->init_addr, &hdev->rpa);
5850                         } else {
5851                                 hci_copy_identity_address(hdev,
5852                                                           &conn->init_addr,
5853                                                           &conn->init_addr_type);
5854                         }
5855                 }
5856         } else {
5857                 cancel_delayed_work(&conn->le_conn_timeout);
5858         }
5859
5860         /* The HCI_LE_Connection_Complete event is only sent once per connection.
5861          * Processing it more than once per connection can corrupt kernel memory.
5862          *
5863          * As the connection handle is set here for the first time, it indicates
5864          * whether the connection is already set up.
5865          */
5866         if (conn->handle != HCI_CONN_HANDLE_UNSET) {
5867                 bt_dev_err(hdev, "Ignoring HCI_Connection_Complete for existing connection");
5868                 goto unlock;
5869         }
5870
5871         le_conn_update_addr(conn, bdaddr, bdaddr_type, local_rpa);
5872
5873         /* Lookup the identity address from the stored connection
5874          * address and address type.
5875          *
5876          * When establishing connections to an identity address, the
5877          * connection procedure will store the resolvable random
5878          * address first. Now if it can be converted back into the
5879          * identity address, start using the identity address from
5880          * now on.
5881          */
5882         irk = hci_get_irk(hdev, &conn->dst, conn->dst_type);
5883         if (irk) {
5884                 bacpy(&conn->dst, &irk->bdaddr);
5885                 conn->dst_type = irk->addr_type;
5886         }
5887
5888         conn->dst_type = ev_bdaddr_type(hdev, conn->dst_type, NULL);
5889
5890         if (handle > HCI_CONN_HANDLE_MAX) {
5891                 bt_dev_err(hdev, "Invalid handle: 0x%4.4x > 0x%4.4x", handle,
5892                            HCI_CONN_HANDLE_MAX);
5893                 status = HCI_ERROR_INVALID_PARAMETERS;
5894         }
5895
5896         /* All connection failure handling is taken care of by the
5897          * hci_conn_failed function which is triggered by the HCI
5898          * request completion callbacks used for connecting.
5899          */
5900         if (status)
5901                 goto unlock;
5902
5903         /* Drop the connection if it has been aborted */
5904         if (test_bit(HCI_CONN_CANCEL, &conn->flags)) {
5905                 hci_conn_drop(conn);
5906                 goto unlock;
5907         }
5908
5909         if (conn->dst_type == ADDR_LE_DEV_PUBLIC)
5910                 addr_type = BDADDR_LE_PUBLIC;
5911         else
5912                 addr_type = BDADDR_LE_RANDOM;
5913
5914         /* Drop the connection if the device is blocked */
5915         if (hci_bdaddr_list_lookup(&hdev->reject_list, &conn->dst, addr_type)) {
5916                 hci_conn_drop(conn);
5917                 goto unlock;
5918         }
5919
5920         if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
5921                 mgmt_device_connected(hdev, conn, NULL, 0);
5922
5923         conn->sec_level = BT_SECURITY_LOW;
5924         conn->handle = handle;
5925         conn->state = BT_CONFIG;
5926
5927         /* Store current advertising instance as connection advertising instance
5928          * when sotfware rotation is in use so it can be re-enabled when
5929          * disconnected.
5930          */
5931         if (!ext_adv_capable(hdev))
5932                 conn->adv_instance = hdev->cur_adv_instance;
5933
5934         conn->le_conn_interval = interval;
5935         conn->le_conn_latency = latency;
5936         conn->le_supv_timeout = supervision_timeout;
5937
5938         hci_debugfs_create_conn(conn);
5939         hci_conn_add_sysfs(conn);
5940
5941         /* The remote features procedure is defined for central
5942          * role only. So only in case of an initiated connection
5943          * request the remote features.
5944          *
5945          * If the local controller supports peripheral-initiated features
5946          * exchange, then requesting the remote features in peripheral
5947          * role is possible. Otherwise just transition into the
5948          * connected state without requesting the remote features.
5949          */
5950         if (conn->out ||
5951             (hdev->le_features[0] & HCI_LE_PERIPHERAL_FEATURES)) {
5952                 struct hci_cp_le_read_remote_features cp;
5953
5954                 cp.handle = __cpu_to_le16(conn->handle);
5955
5956                 hci_send_cmd(hdev, HCI_OP_LE_READ_REMOTE_FEATURES,
5957                              sizeof(cp), &cp);
5958
5959                 hci_conn_hold(conn);
5960         } else {
5961                 conn->state = BT_CONNECTED;
5962                 hci_connect_cfm(conn, status);
5963         }
5964
5965         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
5966                                            conn->dst_type);
5967         if (params) {
5968                 hci_pend_le_list_del_init(params);
5969                 if (params->conn) {
5970                         hci_conn_drop(params->conn);
5971                         hci_conn_put(params->conn);
5972                         params->conn = NULL;
5973                 }
5974         }
5975
5976 unlock:
5977         hci_update_passive_scan(hdev);
5978         hci_dev_unlock(hdev);
5979 }
5980
5981 static void hci_le_conn_complete_evt(struct hci_dev *hdev, void *data,
5982                                      struct sk_buff *skb)
5983 {
5984         struct hci_ev_le_conn_complete *ev = data;
5985
5986         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
5987
5988         le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,
5989                              NULL, ev->role, le16_to_cpu(ev->handle),
5990                              le16_to_cpu(ev->interval),
5991                              le16_to_cpu(ev->latency),
5992                              le16_to_cpu(ev->supervision_timeout));
5993 }
5994
5995 static void hci_le_enh_conn_complete_evt(struct hci_dev *hdev, void *data,
5996                                          struct sk_buff *skb)
5997 {
5998         struct hci_ev_le_enh_conn_complete *ev = data;
5999
6000         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
6001
6002         le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,
6003                              &ev->local_rpa, ev->role, le16_to_cpu(ev->handle),
6004                              le16_to_cpu(ev->interval),
6005                              le16_to_cpu(ev->latency),
6006                              le16_to_cpu(ev->supervision_timeout));
6007 }
6008
6009 static void hci_le_ext_adv_term_evt(struct hci_dev *hdev, void *data,
6010                                     struct sk_buff *skb)
6011 {
6012         struct hci_evt_le_ext_adv_set_term *ev = data;
6013         struct hci_conn *conn;
6014         struct adv_info *adv, *n;
6015
6016         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
6017
6018         /* The Bluetooth Core 5.3 specification clearly states that this event
6019          * shall not be sent when the Host disables the advertising set. So in
6020          * case of HCI_ERROR_CANCELLED_BY_HOST, just ignore the event.
6021          *
6022          * When the Host disables an advertising set, all cleanup is done via
6023          * its command callback and not needed to be duplicated here.
6024          */
6025         if (ev->status == HCI_ERROR_CANCELLED_BY_HOST) {
6026                 bt_dev_warn_ratelimited(hdev, "Unexpected advertising set terminated event");
6027                 return;
6028         }
6029
6030         hci_dev_lock(hdev);
6031
6032         adv = hci_find_adv_instance(hdev, ev->handle);
6033
6034         if (ev->status) {
6035                 if (!adv)
6036                         goto unlock;
6037
6038                 /* Remove advertising as it has been terminated */
6039                 hci_remove_adv_instance(hdev, ev->handle);
6040                 mgmt_advertising_removed(NULL, hdev, ev->handle);
6041
6042                 list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) {
6043                         if (adv->enabled)
6044                                 goto unlock;
6045                 }
6046
6047                 /* We are no longer advertising, clear HCI_LE_ADV */
6048                 hci_dev_clear_flag(hdev, HCI_LE_ADV);
6049                 goto unlock;
6050         }
6051
6052         if (adv)
6053                 adv->enabled = false;
6054
6055         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->conn_handle));
6056         if (conn) {
6057                 /* Store handle in the connection so the correct advertising
6058                  * instance can be re-enabled when disconnected.
6059                  */
6060                 conn->adv_instance = ev->handle;
6061
6062                 if (hdev->adv_addr_type != ADDR_LE_DEV_RANDOM ||
6063                     bacmp(&conn->resp_addr, BDADDR_ANY))
6064                         goto unlock;
6065
6066                 if (!ev->handle) {
6067                         bacpy(&conn->resp_addr, &hdev->random_addr);
6068                         goto unlock;
6069                 }
6070
6071                 if (adv)
6072                         bacpy(&conn->resp_addr, &adv->random_addr);
6073         }
6074
6075 unlock:
6076         hci_dev_unlock(hdev);
6077 }
6078
6079 static void hci_le_conn_update_complete_evt(struct hci_dev *hdev, void *data,
6080                                             struct sk_buff *skb)
6081 {
6082         struct hci_ev_le_conn_update_complete *ev = data;
6083         struct hci_conn *conn;
6084
6085         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
6086
6087         if (ev->status)
6088                 return;
6089
6090         hci_dev_lock(hdev);
6091
6092         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
6093         if (conn) {
6094                 conn->le_conn_interval = le16_to_cpu(ev->interval);
6095                 conn->le_conn_latency = le16_to_cpu(ev->latency);
6096                 conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
6097         }
6098
6099         hci_dev_unlock(hdev);
6100 }
6101
6102 /* This function requires the caller holds hdev->lock */
6103 static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev,
6104                                               bdaddr_t *addr,
6105                                               u8 addr_type, bool addr_resolved,
6106                                               u8 adv_type)
6107 {
6108         struct hci_conn *conn;
6109         struct hci_conn_params *params;
6110
6111         /* If the event is not connectable don't proceed further */
6112         if (adv_type != LE_ADV_IND && adv_type != LE_ADV_DIRECT_IND)
6113                 return NULL;
6114
6115         /* Ignore if the device is blocked or hdev is suspended */
6116         if (hci_bdaddr_list_lookup(&hdev->reject_list, addr, addr_type) ||
6117             hdev->suspended)
6118                 return NULL;
6119
6120         /* Most controller will fail if we try to create new connections
6121          * while we have an existing one in peripheral role.
6122          */
6123         if (hdev->conn_hash.le_num_peripheral > 0 &&
6124             (!test_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks) ||
6125              !(hdev->le_states[3] & 0x10)))
6126                 return NULL;
6127
6128         /* If we're not connectable only connect devices that we have in
6129          * our pend_le_conns list.
6130          */
6131         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, addr,
6132                                            addr_type);
6133         if (!params)
6134                 return NULL;
6135
6136         if (!params->explicit_connect) {
6137                 switch (params->auto_connect) {
6138                 case HCI_AUTO_CONN_DIRECT:
6139                         /* Only devices advertising with ADV_DIRECT_IND are
6140                          * triggering a connection attempt. This is allowing
6141                          * incoming connections from peripheral devices.
6142                          */
6143                         if (adv_type != LE_ADV_DIRECT_IND)
6144                                 return NULL;
6145                         break;
6146                 case HCI_AUTO_CONN_ALWAYS:
6147                         /* Devices advertising with ADV_IND or ADV_DIRECT_IND
6148                          * are triggering a connection attempt. This means
6149                          * that incoming connections from peripheral device are
6150                          * accepted and also outgoing connections to peripheral
6151                          * devices are established when found.
6152                          */
6153                         break;
6154                 default:
6155                         return NULL;
6156                 }
6157         }
6158
6159         conn = hci_connect_le(hdev, addr, addr_type, addr_resolved,
6160                               BT_SECURITY_LOW, hdev->def_le_autoconnect_timeout,
6161                               HCI_ROLE_MASTER);
6162         if (!IS_ERR(conn)) {
6163                 /* If HCI_AUTO_CONN_EXPLICIT is set, conn is already owned
6164                  * by higher layer that tried to connect, if no then
6165                  * store the pointer since we don't really have any
6166                  * other owner of the object besides the params that
6167                  * triggered it. This way we can abort the connection if
6168                  * the parameters get removed and keep the reference
6169                  * count consistent once the connection is established.
6170                  */
6171
6172                 if (!params->explicit_connect)
6173                         params->conn = hci_conn_get(conn);
6174
6175                 return conn;
6176         }
6177
6178         switch (PTR_ERR(conn)) {
6179         case -EBUSY:
6180                 /* If hci_connect() returns -EBUSY it means there is already
6181                  * an LE connection attempt going on. Since controllers don't
6182                  * support more than one connection attempt at the time, we
6183                  * don't consider this an error case.
6184                  */
6185                 break;
6186         default:
6187                 BT_DBG("Failed to connect: err %ld", PTR_ERR(conn));
6188                 return NULL;
6189         }
6190
6191         return NULL;
6192 }
6193
6194 static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
6195                                u8 bdaddr_type, bdaddr_t *direct_addr,
6196                                u8 direct_addr_type, s8 rssi, u8 *data, u8 len,
6197                                bool ext_adv, bool ctl_time, u64 instant)
6198 {
6199         struct discovery_state *d = &hdev->discovery;
6200         struct smp_irk *irk;
6201         struct hci_conn *conn;
6202         bool match, bdaddr_resolved;
6203         u32 flags;
6204         u8 *ptr;
6205
6206         switch (type) {
6207         case LE_ADV_IND:
6208         case LE_ADV_DIRECT_IND:
6209         case LE_ADV_SCAN_IND:
6210         case LE_ADV_NONCONN_IND:
6211         case LE_ADV_SCAN_RSP:
6212                 break;
6213         default:
6214                 bt_dev_err_ratelimited(hdev, "unknown advertising packet "
6215                                        "type: 0x%02x", type);
6216                 return;
6217         }
6218
6219         if (!ext_adv && len > HCI_MAX_AD_LENGTH) {
6220                 bt_dev_err_ratelimited(hdev, "legacy adv larger than 31 bytes");
6221                 return;
6222         }
6223
6224         /* Find the end of the data in case the report contains padded zero
6225          * bytes at the end causing an invalid length value.
6226          *
6227          * When data is NULL, len is 0 so there is no need for extra ptr
6228          * check as 'ptr < data + 0' is already false in such case.
6229          */
6230         for (ptr = data; ptr < data + len && *ptr; ptr += *ptr + 1) {
6231                 if (ptr + 1 + *ptr > data + len)
6232                         break;
6233         }
6234
6235         /* Adjust for actual length. This handles the case when remote
6236          * device is advertising with incorrect data length.
6237          */
6238         len = ptr - data;
6239
6240         /* If the direct address is present, then this report is from
6241          * a LE Direct Advertising Report event. In that case it is
6242          * important to see if the address is matching the local
6243          * controller address.
6244          */
6245         if (!hci_dev_test_flag(hdev, HCI_MESH) && direct_addr) {
6246                 direct_addr_type = ev_bdaddr_type(hdev, direct_addr_type,
6247                                                   &bdaddr_resolved);
6248
6249                 /* Only resolvable random addresses are valid for these
6250                  * kind of reports and others can be ignored.
6251                  */
6252                 if (!hci_bdaddr_is_rpa(direct_addr, direct_addr_type))
6253                         return;
6254
6255                 /* If the controller is not using resolvable random
6256                  * addresses, then this report can be ignored.
6257                  */
6258                 if (!hci_dev_test_flag(hdev, HCI_PRIVACY))
6259                         return;
6260
6261                 /* If the local IRK of the controller does not match
6262                  * with the resolvable random address provided, then
6263                  * this report can be ignored.
6264                  */
6265                 if (!smp_irk_matches(hdev, hdev->irk, direct_addr))
6266                         return;
6267         }
6268
6269         /* Check if we need to convert to identity address */
6270         irk = hci_get_irk(hdev, bdaddr, bdaddr_type);
6271         if (irk) {
6272                 bdaddr = &irk->bdaddr;
6273                 bdaddr_type = irk->addr_type;
6274         }
6275
6276         bdaddr_type = ev_bdaddr_type(hdev, bdaddr_type, &bdaddr_resolved);
6277
6278         /* Check if we have been requested to connect to this device.
6279          *
6280          * direct_addr is set only for directed advertising reports (it is NULL
6281          * for advertising reports) and is already verified to be RPA above.
6282          */
6283         conn = check_pending_le_conn(hdev, bdaddr, bdaddr_type, bdaddr_resolved,
6284                                      type);
6285         if (!ext_adv && conn && type == LE_ADV_IND && len <= HCI_MAX_AD_LENGTH) {
6286                 /* Store report for later inclusion by
6287                  * mgmt_device_connected
6288                  */
6289                 memcpy(conn->le_adv_data, data, len);
6290                 conn->le_adv_data_len = len;
6291         }
6292
6293         if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND)
6294                 flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
6295         else
6296                 flags = 0;
6297
6298         /* All scan results should be sent up for Mesh systems */
6299         if (hci_dev_test_flag(hdev, HCI_MESH)) {
6300                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
6301                                   rssi, flags, data, len, NULL, 0, instant);
6302                 return;
6303         }
6304
6305         /* Passive scanning shouldn't trigger any device found events,
6306          * except for devices marked as CONN_REPORT for which we do send
6307          * device found events, or advertisement monitoring requested.
6308          */
6309         if (hdev->le_scan_type == LE_SCAN_PASSIVE) {
6310                 if (type == LE_ADV_DIRECT_IND)
6311                         return;
6312
6313                 if (!hci_pend_le_action_lookup(&hdev->pend_le_reports,
6314                                                bdaddr, bdaddr_type) &&
6315                     idr_is_empty(&hdev->adv_monitors_idr))
6316                         return;
6317
6318                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
6319                                   rssi, flags, data, len, NULL, 0, 0);
6320                 return;
6321         }
6322
6323         /* When receiving a scan response, then there is no way to
6324          * know if the remote device is connectable or not. However
6325          * since scan responses are merged with a previously seen
6326          * advertising report, the flags field from that report
6327          * will be used.
6328          *
6329          * In the unlikely case that a controller just sends a scan
6330          * response event that doesn't match the pending report, then
6331          * it is marked as a standalone SCAN_RSP.
6332          */
6333         if (type == LE_ADV_SCAN_RSP)
6334                 flags = MGMT_DEV_FOUND_SCAN_RSP;
6335
6336         /* If there's nothing pending either store the data from this
6337          * event or send an immediate device found event if the data
6338          * should not be stored for later.
6339          */
6340         if (!ext_adv && !has_pending_adv_report(hdev)) {
6341                 /* If the report will trigger a SCAN_REQ store it for
6342                  * later merging.
6343                  */
6344                 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
6345                         store_pending_adv_report(hdev, bdaddr, bdaddr_type,
6346                                                  rssi, flags, data, len);
6347                         return;
6348                 }
6349
6350                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
6351                                   rssi, flags, data, len, NULL, 0, 0);
6352                 return;
6353         }
6354
6355         /* Check if the pending report is for the same device as the new one */
6356         match = (!bacmp(bdaddr, &d->last_adv_addr) &&
6357                  bdaddr_type == d->last_adv_addr_type);
6358
6359         /* If the pending data doesn't match this report or this isn't a
6360          * scan response (e.g. we got a duplicate ADV_IND) then force
6361          * sending of the pending data.
6362          */
6363         if (type != LE_ADV_SCAN_RSP || !match) {
6364                 /* Send out whatever is in the cache, but skip duplicates */
6365                 if (!match)
6366                         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
6367                                           d->last_adv_addr_type, NULL,
6368                                           d->last_adv_rssi, d->last_adv_flags,
6369                                           d->last_adv_data,
6370                                           d->last_adv_data_len, NULL, 0, 0);
6371
6372                 /* If the new report will trigger a SCAN_REQ store it for
6373                  * later merging.
6374                  */
6375                 if (!ext_adv && (type == LE_ADV_IND ||
6376                                  type == LE_ADV_SCAN_IND)) {
6377                         store_pending_adv_report(hdev, bdaddr, bdaddr_type,
6378                                                  rssi, flags, data, len);
6379                         return;
6380                 }
6381
6382                 /* The advertising reports cannot be merged, so clear
6383                  * the pending report and send out a device found event.
6384                  */
6385                 clear_pending_adv_report(hdev);
6386                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
6387                                   rssi, flags, data, len, NULL, 0, 0);
6388                 return;
6389         }
6390
6391         /* If we get here we've got a pending ADV_IND or ADV_SCAN_IND and
6392          * the new event is a SCAN_RSP. We can therefore proceed with
6393          * sending a merged device found event.
6394          */
6395         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
6396                           d->last_adv_addr_type, NULL, rssi, d->last_adv_flags,
6397                           d->last_adv_data, d->last_adv_data_len, data, len, 0);
6398         clear_pending_adv_report(hdev);
6399 }
6400
6401 static void hci_le_adv_report_evt(struct hci_dev *hdev, void *data,
6402                                   struct sk_buff *skb)
6403 {
6404         struct hci_ev_le_advertising_report *ev = data;
6405         u64 instant = jiffies;
6406
6407         if (!ev->num)
6408                 return;
6409
6410         hci_dev_lock(hdev);
6411
6412         while (ev->num--) {
6413                 struct hci_ev_le_advertising_info *info;
6414                 s8 rssi;
6415
6416                 info = hci_le_ev_skb_pull(hdev, skb,
6417                                           HCI_EV_LE_ADVERTISING_REPORT,
6418                                           sizeof(*info));
6419                 if (!info)
6420                         break;
6421
6422                 if (!hci_le_ev_skb_pull(hdev, skb, HCI_EV_LE_ADVERTISING_REPORT,
6423                                         info->length + 1))
6424                         break;
6425
6426                 if (info->length <= HCI_MAX_AD_LENGTH) {
6427                         rssi = info->data[info->length];
6428                         process_adv_report(hdev, info->type, &info->bdaddr,
6429                                            info->bdaddr_type, NULL, 0, rssi,
6430                                            info->data, info->length, false,
6431                                            false, instant);
6432                 } else {
6433                         bt_dev_err(hdev, "Dropping invalid advertising data");
6434                 }
6435         }
6436
6437         hci_dev_unlock(hdev);
6438 }
6439
6440 static u8 ext_evt_type_to_legacy(struct hci_dev *hdev, u16 evt_type)
6441 {
6442         if (evt_type & LE_EXT_ADV_LEGACY_PDU) {
6443                 switch (evt_type) {
6444                 case LE_LEGACY_ADV_IND:
6445                         return LE_ADV_IND;
6446                 case LE_LEGACY_ADV_DIRECT_IND:
6447                         return LE_ADV_DIRECT_IND;
6448                 case LE_LEGACY_ADV_SCAN_IND:
6449                         return LE_ADV_SCAN_IND;
6450                 case LE_LEGACY_NONCONN_IND:
6451                         return LE_ADV_NONCONN_IND;
6452                 case LE_LEGACY_SCAN_RSP_ADV:
6453                 case LE_LEGACY_SCAN_RSP_ADV_SCAN:
6454                         return LE_ADV_SCAN_RSP;
6455                 }
6456
6457                 goto invalid;
6458         }
6459
6460         if (evt_type & LE_EXT_ADV_CONN_IND) {
6461                 if (evt_type & LE_EXT_ADV_DIRECT_IND)
6462                         return LE_ADV_DIRECT_IND;
6463
6464                 return LE_ADV_IND;
6465         }
6466
6467         if (evt_type & LE_EXT_ADV_SCAN_RSP)
6468                 return LE_ADV_SCAN_RSP;
6469
6470         if (evt_type & LE_EXT_ADV_SCAN_IND)
6471                 return LE_ADV_SCAN_IND;
6472
6473         if (evt_type == LE_EXT_ADV_NON_CONN_IND ||
6474             evt_type & LE_EXT_ADV_DIRECT_IND)
6475                 return LE_ADV_NONCONN_IND;
6476
6477 invalid:
6478         bt_dev_err_ratelimited(hdev, "Unknown advertising packet type: 0x%02x",
6479                                evt_type);
6480
6481         return LE_ADV_INVALID;
6482 }
6483
6484 static void hci_le_ext_adv_report_evt(struct hci_dev *hdev, void *data,
6485                                       struct sk_buff *skb)
6486 {
6487         struct hci_ev_le_ext_adv_report *ev = data;
6488         u64 instant = jiffies;
6489
6490         if (!ev->num)
6491                 return;
6492
6493         hci_dev_lock(hdev);
6494
6495         while (ev->num--) {
6496                 struct hci_ev_le_ext_adv_info *info;
6497                 u8 legacy_evt_type;
6498                 u16 evt_type;
6499
6500                 info = hci_le_ev_skb_pull(hdev, skb, HCI_EV_LE_EXT_ADV_REPORT,
6501                                           sizeof(*info));
6502                 if (!info)
6503                         break;
6504
6505                 if (!hci_le_ev_skb_pull(hdev, skb, HCI_EV_LE_EXT_ADV_REPORT,
6506                                         info->length))
6507                         break;
6508
6509                 evt_type = __le16_to_cpu(info->type) & LE_EXT_ADV_EVT_TYPE_MASK;
6510                 legacy_evt_type = ext_evt_type_to_legacy(hdev, evt_type);
6511                 if (legacy_evt_type != LE_ADV_INVALID) {
6512                         process_adv_report(hdev, legacy_evt_type, &info->bdaddr,
6513                                            info->bdaddr_type, NULL, 0,
6514                                            info->rssi, info->data, info->length,
6515                                            !(evt_type & LE_EXT_ADV_LEGACY_PDU),
6516                                            false, instant);
6517                 }
6518         }
6519
6520         hci_dev_unlock(hdev);
6521 }
6522
6523 static int hci_le_pa_term_sync(struct hci_dev *hdev, __le16 handle)
6524 {
6525         struct hci_cp_le_pa_term_sync cp;
6526
6527         memset(&cp, 0, sizeof(cp));
6528         cp.handle = handle;
6529
6530         return hci_send_cmd(hdev, HCI_OP_LE_PA_TERM_SYNC, sizeof(cp), &cp);
6531 }
6532
6533 static void hci_le_pa_sync_estabilished_evt(struct hci_dev *hdev, void *data,
6534                                             struct sk_buff *skb)
6535 {
6536         struct hci_ev_le_pa_sync_established *ev = data;
6537         int mask = hdev->link_mode;
6538         __u8 flags = 0;
6539
6540         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
6541
6542         if (ev->status)
6543                 return;
6544
6545         hci_dev_lock(hdev);
6546
6547         hci_dev_clear_flag(hdev, HCI_PA_SYNC);
6548
6549         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ISO_LINK, &flags);
6550         if (!(mask & HCI_LM_ACCEPT))
6551                 hci_le_pa_term_sync(hdev, ev->handle);
6552
6553         hci_dev_unlock(hdev);
6554 }
6555
6556 static void hci_le_remote_feat_complete_evt(struct hci_dev *hdev, void *data,
6557                                             struct sk_buff *skb)
6558 {
6559         struct hci_ev_le_remote_feat_complete *ev = data;
6560         struct hci_conn *conn;
6561
6562         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
6563
6564         hci_dev_lock(hdev);
6565
6566         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
6567         if (conn) {
6568                 if (!ev->status)
6569                         memcpy(conn->features[0], ev->features, 8);
6570
6571                 if (conn->state == BT_CONFIG) {
6572                         __u8 status;
6573
6574                         /* If the local controller supports peripheral-initiated
6575                          * features exchange, but the remote controller does
6576                          * not, then it is possible that the error code 0x1a
6577                          * for unsupported remote feature gets returned.
6578                          *
6579                          * In this specific case, allow the connection to
6580                          * transition into connected state and mark it as
6581                          * successful.
6582                          */
6583                         if (!conn->out && ev->status == 0x1a &&
6584                             (hdev->le_features[0] & HCI_LE_PERIPHERAL_FEATURES))
6585                                 status = 0x00;
6586                         else
6587                                 status = ev->status;
6588
6589                         conn->state = BT_CONNECTED;
6590                         hci_connect_cfm(conn, status);
6591                         hci_conn_drop(conn);
6592                 }
6593         }
6594
6595         hci_dev_unlock(hdev);
6596 }
6597
6598 static void hci_le_ltk_request_evt(struct hci_dev *hdev, void *data,
6599                                    struct sk_buff *skb)
6600 {
6601         struct hci_ev_le_ltk_req *ev = data;
6602         struct hci_cp_le_ltk_reply cp;
6603         struct hci_cp_le_ltk_neg_reply neg;
6604         struct hci_conn *conn;
6605         struct smp_ltk *ltk;
6606
6607         bt_dev_dbg(hdev, "handle 0x%4.4x", __le16_to_cpu(ev->handle));
6608
6609         hci_dev_lock(hdev);
6610
6611         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
6612         if (conn == NULL)
6613                 goto not_found;
6614
6615         ltk = hci_find_ltk(hdev, &conn->dst, conn->dst_type, conn->role);
6616         if (!ltk)
6617                 goto not_found;
6618
6619         if (smp_ltk_is_sc(ltk)) {
6620                 /* With SC both EDiv and Rand are set to zero */
6621                 if (ev->ediv || ev->rand)
6622                         goto not_found;
6623         } else {
6624                 /* For non-SC keys check that EDiv and Rand match */
6625                 if (ev->ediv != ltk->ediv || ev->rand != ltk->rand)
6626                         goto not_found;
6627         }
6628
6629         memcpy(cp.ltk, ltk->val, ltk->enc_size);
6630         memset(cp.ltk + ltk->enc_size, 0, sizeof(cp.ltk) - ltk->enc_size);
6631         cp.handle = cpu_to_le16(conn->handle);
6632
6633         conn->pending_sec_level = smp_ltk_sec_level(ltk);
6634
6635         conn->enc_key_size = ltk->enc_size;
6636
6637         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
6638
6639         /* Ref. Bluetooth Core SPEC pages 1975 and 2004. STK is a
6640          * temporary key used to encrypt a connection following
6641          * pairing. It is used during the Encrypted Session Setup to
6642          * distribute the keys. Later, security can be re-established
6643          * using a distributed LTK.
6644          */
6645         if (ltk->type == SMP_STK) {
6646                 set_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
6647                 list_del_rcu(&ltk->list);
6648                 kfree_rcu(ltk, rcu);
6649         } else {
6650                 clear_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
6651         }
6652
6653         hci_dev_unlock(hdev);
6654
6655         return;
6656
6657 not_found:
6658         neg.handle = ev->handle;
6659         hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
6660         hci_dev_unlock(hdev);
6661 }
6662
6663 static void send_conn_param_neg_reply(struct hci_dev *hdev, u16 handle,
6664                                       u8 reason)
6665 {
6666         struct hci_cp_le_conn_param_req_neg_reply cp;
6667
6668         cp.handle = cpu_to_le16(handle);
6669         cp.reason = reason;
6670
6671         hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_NEG_REPLY, sizeof(cp),
6672                      &cp);
6673 }
6674
6675 static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev, void *data,
6676                                              struct sk_buff *skb)
6677 {
6678         struct hci_ev_le_remote_conn_param_req *ev = data;
6679         struct hci_cp_le_conn_param_req_reply cp;
6680         struct hci_conn *hcon;
6681         u16 handle, min, max, latency, timeout;
6682
6683         bt_dev_dbg(hdev, "handle 0x%4.4x", __le16_to_cpu(ev->handle));
6684
6685         handle = le16_to_cpu(ev->handle);
6686         min = le16_to_cpu(ev->interval_min);
6687         max = le16_to_cpu(ev->interval_max);
6688         latency = le16_to_cpu(ev->latency);
6689         timeout = le16_to_cpu(ev->timeout);
6690
6691         hcon = hci_conn_hash_lookup_handle(hdev, handle);
6692         if (!hcon || hcon->state != BT_CONNECTED)
6693                 return send_conn_param_neg_reply(hdev, handle,
6694                                                  HCI_ERROR_UNKNOWN_CONN_ID);
6695
6696         if (hci_check_conn_params(min, max, latency, timeout))
6697                 return send_conn_param_neg_reply(hdev, handle,
6698                                                  HCI_ERROR_INVALID_LL_PARAMS);
6699
6700         if (hcon->role == HCI_ROLE_MASTER) {
6701                 struct hci_conn_params *params;
6702                 u8 store_hint;
6703
6704                 hci_dev_lock(hdev);
6705
6706                 params = hci_conn_params_lookup(hdev, &hcon->dst,
6707                                                 hcon->dst_type);
6708                 if (params) {
6709                         params->conn_min_interval = min;
6710                         params->conn_max_interval = max;
6711                         params->conn_latency = latency;
6712                         params->supervision_timeout = timeout;
6713                         store_hint = 0x01;
6714                 } else {
6715                         store_hint = 0x00;
6716                 }
6717
6718                 hci_dev_unlock(hdev);
6719
6720                 mgmt_new_conn_param(hdev, &hcon->dst, hcon->dst_type,
6721                                     store_hint, min, max, latency, timeout);
6722         }
6723
6724         cp.handle = ev->handle;
6725         cp.interval_min = ev->interval_min;
6726         cp.interval_max = ev->interval_max;
6727         cp.latency = ev->latency;
6728         cp.timeout = ev->timeout;
6729         cp.min_ce_len = 0;
6730         cp.max_ce_len = 0;
6731
6732         hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_REPLY, sizeof(cp), &cp);
6733 }
6734
6735 static void hci_le_direct_adv_report_evt(struct hci_dev *hdev, void *data,
6736                                          struct sk_buff *skb)
6737 {
6738         struct hci_ev_le_direct_adv_report *ev = data;
6739         u64 instant = jiffies;
6740         int i;
6741
6742         if (!hci_le_ev_skb_pull(hdev, skb, HCI_EV_LE_DIRECT_ADV_REPORT,
6743                                 flex_array_size(ev, info, ev->num)))
6744                 return;
6745
6746         if (!ev->num)
6747                 return;
6748
6749         hci_dev_lock(hdev);
6750
6751         for (i = 0; i < ev->num; i++) {
6752                 struct hci_ev_le_direct_adv_info *info = &ev->info[i];
6753
6754                 process_adv_report(hdev, info->type, &info->bdaddr,
6755                                    info->bdaddr_type, &info->direct_addr,
6756                                    info->direct_addr_type, info->rssi, NULL, 0,
6757                                    false, false, instant);
6758         }
6759
6760         hci_dev_unlock(hdev);
6761 }
6762
6763 static void hci_le_phy_update_evt(struct hci_dev *hdev, void *data,
6764                                   struct sk_buff *skb)
6765 {
6766         struct hci_ev_le_phy_update_complete *ev = data;
6767         struct hci_conn *conn;
6768
6769         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
6770
6771         if (ev->status)
6772                 return;
6773
6774         hci_dev_lock(hdev);
6775
6776         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
6777         if (!conn)
6778                 goto unlock;
6779
6780         conn->le_tx_phy = ev->tx_phy;
6781         conn->le_rx_phy = ev->rx_phy;
6782
6783 unlock:
6784         hci_dev_unlock(hdev);
6785 }
6786
6787 static void hci_le_cis_estabilished_evt(struct hci_dev *hdev, void *data,
6788                                         struct sk_buff *skb)
6789 {
6790         struct hci_evt_le_cis_established *ev = data;
6791         struct hci_conn *conn;
6792         struct bt_iso_qos *qos;
6793         u16 handle = __le16_to_cpu(ev->handle);
6794
6795         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
6796
6797         hci_dev_lock(hdev);
6798
6799         conn = hci_conn_hash_lookup_handle(hdev, handle);
6800         if (!conn) {
6801                 bt_dev_err(hdev,
6802                            "Unable to find connection with handle 0x%4.4x",
6803                            handle);
6804                 goto unlock;
6805         }
6806
6807         if (conn->type != ISO_LINK) {
6808                 bt_dev_err(hdev,
6809                            "Invalid connection link type handle 0x%4.4x",
6810                            handle);
6811                 goto unlock;
6812         }
6813
6814         qos = &conn->iso_qos;
6815
6816         /* Convert ISO Interval (1.25 ms slots) to SDU Interval (us) */
6817         qos->ucast.in.interval = le16_to_cpu(ev->interval) * 1250;
6818         qos->ucast.out.interval = qos->ucast.in.interval;
6819
6820         switch (conn->role) {
6821         case HCI_ROLE_SLAVE:
6822                 /* Convert Transport Latency (us) to Latency (msec) */
6823                 qos->ucast.in.latency =
6824                         DIV_ROUND_CLOSEST(get_unaligned_le24(ev->c_latency),
6825                                           1000);
6826                 qos->ucast.out.latency =
6827                         DIV_ROUND_CLOSEST(get_unaligned_le24(ev->p_latency),
6828                                           1000);
6829                 qos->ucast.in.sdu = le16_to_cpu(ev->c_mtu);
6830                 qos->ucast.out.sdu = le16_to_cpu(ev->p_mtu);
6831                 qos->ucast.in.phy = ev->c_phy;
6832                 qos->ucast.out.phy = ev->p_phy;
6833                 break;
6834         case HCI_ROLE_MASTER:
6835                 /* Convert Transport Latency (us) to Latency (msec) */
6836                 qos->ucast.out.latency =
6837                         DIV_ROUND_CLOSEST(get_unaligned_le24(ev->c_latency),
6838                                           1000);
6839                 qos->ucast.in.latency =
6840                         DIV_ROUND_CLOSEST(get_unaligned_le24(ev->p_latency),
6841                                           1000);
6842                 qos->ucast.out.sdu = le16_to_cpu(ev->c_mtu);
6843                 qos->ucast.in.sdu = le16_to_cpu(ev->p_mtu);
6844                 qos->ucast.out.phy = ev->c_phy;
6845                 qos->ucast.in.phy = ev->p_phy;
6846                 break;
6847         }
6848
6849         if (!ev->status) {
6850                 conn->state = BT_CONNECTED;
6851                 hci_debugfs_create_conn(conn);
6852                 hci_conn_add_sysfs(conn);
6853                 hci_iso_setup_path(conn);
6854                 goto unlock;
6855         }
6856
6857         hci_connect_cfm(conn, ev->status);
6858         hci_conn_del(conn);
6859
6860 unlock:
6861         hci_dev_unlock(hdev);
6862 }
6863
6864 static void hci_le_reject_cis(struct hci_dev *hdev, __le16 handle)
6865 {
6866         struct hci_cp_le_reject_cis cp;
6867
6868         memset(&cp, 0, sizeof(cp));
6869         cp.handle = handle;
6870         cp.reason = HCI_ERROR_REJ_BAD_ADDR;
6871         hci_send_cmd(hdev, HCI_OP_LE_REJECT_CIS, sizeof(cp), &cp);
6872 }
6873
6874 static void hci_le_accept_cis(struct hci_dev *hdev, __le16 handle)
6875 {
6876         struct hci_cp_le_accept_cis cp;
6877
6878         memset(&cp, 0, sizeof(cp));
6879         cp.handle = handle;
6880         hci_send_cmd(hdev, HCI_OP_LE_ACCEPT_CIS, sizeof(cp), &cp);
6881 }
6882
6883 static void hci_le_cis_req_evt(struct hci_dev *hdev, void *data,
6884                                struct sk_buff *skb)
6885 {
6886         struct hci_evt_le_cis_req *ev = data;
6887         u16 acl_handle, cis_handle;
6888         struct hci_conn *acl, *cis;
6889         int mask;
6890         __u8 flags = 0;
6891
6892         acl_handle = __le16_to_cpu(ev->acl_handle);
6893         cis_handle = __le16_to_cpu(ev->cis_handle);
6894
6895         bt_dev_dbg(hdev, "acl 0x%4.4x handle 0x%4.4x cig 0x%2.2x cis 0x%2.2x",
6896                    acl_handle, cis_handle, ev->cig_id, ev->cis_id);
6897
6898         hci_dev_lock(hdev);
6899
6900         acl = hci_conn_hash_lookup_handle(hdev, acl_handle);
6901         if (!acl)
6902                 goto unlock;
6903
6904         mask = hci_proto_connect_ind(hdev, &acl->dst, ISO_LINK, &flags);
6905         if (!(mask & HCI_LM_ACCEPT)) {
6906                 hci_le_reject_cis(hdev, ev->cis_handle);
6907                 goto unlock;
6908         }
6909
6910         cis = hci_conn_hash_lookup_handle(hdev, cis_handle);
6911         if (!cis) {
6912                 cis = hci_conn_add(hdev, ISO_LINK, &acl->dst, HCI_ROLE_SLAVE);
6913                 if (!cis) {
6914                         hci_le_reject_cis(hdev, ev->cis_handle);
6915                         goto unlock;
6916                 }
6917                 cis->handle = cis_handle;
6918         }
6919
6920         cis->iso_qos.ucast.cig = ev->cig_id;
6921         cis->iso_qos.ucast.cis = ev->cis_id;
6922
6923         if (!(flags & HCI_PROTO_DEFER)) {
6924                 hci_le_accept_cis(hdev, ev->cis_handle);
6925         } else {
6926                 cis->state = BT_CONNECT2;
6927                 hci_connect_cfm(cis, 0);
6928         }
6929
6930 unlock:
6931         hci_dev_unlock(hdev);
6932 }
6933
6934 static void hci_le_create_big_complete_evt(struct hci_dev *hdev, void *data,
6935                                            struct sk_buff *skb)
6936 {
6937         struct hci_evt_le_create_big_complete *ev = data;
6938         struct hci_conn *conn;
6939
6940         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
6941
6942         if (!hci_le_ev_skb_pull(hdev, skb, HCI_EVT_LE_CREATE_BIG_COMPLETE,
6943                                 flex_array_size(ev, bis_handle, ev->num_bis)))
6944                 return;
6945
6946         hci_dev_lock(hdev);
6947
6948         conn = hci_conn_hash_lookup_big(hdev, ev->handle);
6949         if (!conn)
6950                 goto unlock;
6951
6952         if (conn->type != ISO_LINK) {
6953                 bt_dev_err(hdev,
6954                            "Invalid connection link type handle 0x%2.2x",
6955                            ev->handle);
6956                 goto unlock;
6957         }
6958
6959         if (ev->num_bis)
6960                 conn->handle = __le16_to_cpu(ev->bis_handle[0]);
6961
6962         if (!ev->status) {
6963                 conn->state = BT_CONNECTED;
6964                 hci_debugfs_create_conn(conn);
6965                 hci_conn_add_sysfs(conn);
6966                 hci_iso_setup_path(conn);
6967                 goto unlock;
6968         }
6969
6970         hci_connect_cfm(conn, ev->status);
6971         hci_conn_del(conn);
6972
6973 unlock:
6974         hci_dev_unlock(hdev);
6975 }
6976
6977 static void hci_le_big_sync_established_evt(struct hci_dev *hdev, void *data,
6978                                             struct sk_buff *skb)
6979 {
6980         struct hci_evt_le_big_sync_estabilished *ev = data;
6981         struct hci_conn *bis;
6982         int i;
6983
6984         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
6985
6986         if (!hci_le_ev_skb_pull(hdev, skb, HCI_EVT_LE_BIG_SYNC_ESTABILISHED,
6987                                 flex_array_size(ev, bis, ev->num_bis)))
6988                 return;
6989
6990         if (ev->status)
6991                 return;
6992
6993         hci_dev_lock(hdev);
6994
6995         for (i = 0; i < ev->num_bis; i++) {
6996                 u16 handle = le16_to_cpu(ev->bis[i]);
6997                 __le32 interval;
6998
6999                 bis = hci_conn_hash_lookup_handle(hdev, handle);
7000                 if (!bis) {
7001                         bis = hci_conn_add(hdev, ISO_LINK, BDADDR_ANY,
7002                                            HCI_ROLE_SLAVE);
7003                         if (!bis)
7004                                 continue;
7005                         bis->handle = handle;
7006                 }
7007
7008                 bis->iso_qos.bcast.big = ev->handle;
7009                 memset(&interval, 0, sizeof(interval));
7010                 memcpy(&interval, ev->latency, sizeof(ev->latency));
7011                 bis->iso_qos.bcast.in.interval = le32_to_cpu(interval);
7012                 /* Convert ISO Interval (1.25 ms slots) to latency (ms) */
7013                 bis->iso_qos.bcast.in.latency = le16_to_cpu(ev->interval) * 125 / 100;
7014                 bis->iso_qos.bcast.in.sdu = le16_to_cpu(ev->max_pdu);
7015
7016                 hci_iso_setup_path(bis);
7017         }
7018
7019         hci_dev_unlock(hdev);
7020 }
7021
7022 static void hci_le_big_info_adv_report_evt(struct hci_dev *hdev, void *data,
7023                                            struct sk_buff *skb)
7024 {
7025         struct hci_evt_le_big_info_adv_report *ev = data;
7026         int mask = hdev->link_mode;
7027         __u8 flags = 0;
7028
7029         bt_dev_dbg(hdev, "sync_handle 0x%4.4x", le16_to_cpu(ev->sync_handle));
7030
7031         hci_dev_lock(hdev);
7032
7033         mask |= hci_proto_connect_ind(hdev, BDADDR_ANY, ISO_LINK, &flags);
7034         if (!(mask & HCI_LM_ACCEPT))
7035                 hci_le_pa_term_sync(hdev, ev->sync_handle);
7036
7037         hci_dev_unlock(hdev);
7038 }
7039
7040 #define HCI_LE_EV_VL(_op, _func, _min_len, _max_len) \
7041 [_op] = { \
7042         .func = _func, \
7043         .min_len = _min_len, \
7044         .max_len = _max_len, \
7045 }
7046
7047 #define HCI_LE_EV(_op, _func, _len) \
7048         HCI_LE_EV_VL(_op, _func, _len, _len)
7049
7050 #define HCI_LE_EV_STATUS(_op, _func) \
7051         HCI_LE_EV(_op, _func, sizeof(struct hci_ev_status))
7052
7053 /* Entries in this table shall have their position according to the subevent
7054  * opcode they handle so the use of the macros above is recommend since it does
7055  * attempt to initialize at its proper index using Designated Initializers that
7056  * way events without a callback function can be ommited.
7057  */
7058 static const struct hci_le_ev {
7059         void (*func)(struct hci_dev *hdev, void *data, struct sk_buff *skb);
7060         u16  min_len;
7061         u16  max_len;
7062 } hci_le_ev_table[U8_MAX + 1] = {
7063         /* [0x01 = HCI_EV_LE_CONN_COMPLETE] */
7064         HCI_LE_EV(HCI_EV_LE_CONN_COMPLETE, hci_le_conn_complete_evt,
7065                   sizeof(struct hci_ev_le_conn_complete)),
7066         /* [0x02 = HCI_EV_LE_ADVERTISING_REPORT] */
7067         HCI_LE_EV_VL(HCI_EV_LE_ADVERTISING_REPORT, hci_le_adv_report_evt,
7068                      sizeof(struct hci_ev_le_advertising_report),
7069                      HCI_MAX_EVENT_SIZE),
7070         /* [0x03 = HCI_EV_LE_CONN_UPDATE_COMPLETE] */
7071         HCI_LE_EV(HCI_EV_LE_CONN_UPDATE_COMPLETE,
7072                   hci_le_conn_update_complete_evt,
7073                   sizeof(struct hci_ev_le_conn_update_complete)),
7074         /* [0x04 = HCI_EV_LE_REMOTE_FEAT_COMPLETE] */
7075         HCI_LE_EV(HCI_EV_LE_REMOTE_FEAT_COMPLETE,
7076                   hci_le_remote_feat_complete_evt,
7077                   sizeof(struct hci_ev_le_remote_feat_complete)),
7078         /* [0x05 = HCI_EV_LE_LTK_REQ] */
7079         HCI_LE_EV(HCI_EV_LE_LTK_REQ, hci_le_ltk_request_evt,
7080                   sizeof(struct hci_ev_le_ltk_req)),
7081         /* [0x06 = HCI_EV_LE_REMOTE_CONN_PARAM_REQ] */
7082         HCI_LE_EV(HCI_EV_LE_REMOTE_CONN_PARAM_REQ,
7083                   hci_le_remote_conn_param_req_evt,
7084                   sizeof(struct hci_ev_le_remote_conn_param_req)),
7085         /* [0x0a = HCI_EV_LE_ENHANCED_CONN_COMPLETE] */
7086         HCI_LE_EV(HCI_EV_LE_ENHANCED_CONN_COMPLETE,
7087                   hci_le_enh_conn_complete_evt,
7088                   sizeof(struct hci_ev_le_enh_conn_complete)),
7089         /* [0x0b = HCI_EV_LE_DIRECT_ADV_REPORT] */
7090         HCI_LE_EV_VL(HCI_EV_LE_DIRECT_ADV_REPORT, hci_le_direct_adv_report_evt,
7091                      sizeof(struct hci_ev_le_direct_adv_report),
7092                      HCI_MAX_EVENT_SIZE),
7093         /* [0x0c = HCI_EV_LE_PHY_UPDATE_COMPLETE] */
7094         HCI_LE_EV(HCI_EV_LE_PHY_UPDATE_COMPLETE, hci_le_phy_update_evt,
7095                   sizeof(struct hci_ev_le_phy_update_complete)),
7096         /* [0x0d = HCI_EV_LE_EXT_ADV_REPORT] */
7097         HCI_LE_EV_VL(HCI_EV_LE_EXT_ADV_REPORT, hci_le_ext_adv_report_evt,
7098                      sizeof(struct hci_ev_le_ext_adv_report),
7099                      HCI_MAX_EVENT_SIZE),
7100         /* [0x0e = HCI_EV_LE_PA_SYNC_ESTABLISHED] */
7101         HCI_LE_EV(HCI_EV_LE_PA_SYNC_ESTABLISHED,
7102                   hci_le_pa_sync_estabilished_evt,
7103                   sizeof(struct hci_ev_le_pa_sync_established)),
7104         /* [0x12 = HCI_EV_LE_EXT_ADV_SET_TERM] */
7105         HCI_LE_EV(HCI_EV_LE_EXT_ADV_SET_TERM, hci_le_ext_adv_term_evt,
7106                   sizeof(struct hci_evt_le_ext_adv_set_term)),
7107         /* [0x19 = HCI_EVT_LE_CIS_ESTABLISHED] */
7108         HCI_LE_EV(HCI_EVT_LE_CIS_ESTABLISHED, hci_le_cis_estabilished_evt,
7109                   sizeof(struct hci_evt_le_cis_established)),
7110         /* [0x1a = HCI_EVT_LE_CIS_REQ] */
7111         HCI_LE_EV(HCI_EVT_LE_CIS_REQ, hci_le_cis_req_evt,
7112                   sizeof(struct hci_evt_le_cis_req)),
7113         /* [0x1b = HCI_EVT_LE_CREATE_BIG_COMPLETE] */
7114         HCI_LE_EV_VL(HCI_EVT_LE_CREATE_BIG_COMPLETE,
7115                      hci_le_create_big_complete_evt,
7116                      sizeof(struct hci_evt_le_create_big_complete),
7117                      HCI_MAX_EVENT_SIZE),
7118         /* [0x1d = HCI_EV_LE_BIG_SYNC_ESTABILISHED] */
7119         HCI_LE_EV_VL(HCI_EVT_LE_BIG_SYNC_ESTABILISHED,
7120                      hci_le_big_sync_established_evt,
7121                      sizeof(struct hci_evt_le_big_sync_estabilished),
7122                      HCI_MAX_EVENT_SIZE),
7123         /* [0x22 = HCI_EVT_LE_BIG_INFO_ADV_REPORT] */
7124         HCI_LE_EV_VL(HCI_EVT_LE_BIG_INFO_ADV_REPORT,
7125                      hci_le_big_info_adv_report_evt,
7126                      sizeof(struct hci_evt_le_big_info_adv_report),
7127                      HCI_MAX_EVENT_SIZE),
7128 };
7129
7130 static void hci_le_meta_evt(struct hci_dev *hdev, void *data,
7131                             struct sk_buff *skb, u16 *opcode, u8 *status,
7132                             hci_req_complete_t *req_complete,
7133                             hci_req_complete_skb_t *req_complete_skb)
7134 {
7135         struct hci_ev_le_meta *ev = data;
7136         const struct hci_le_ev *subev;
7137
7138         bt_dev_dbg(hdev, "subevent 0x%2.2x", ev->subevent);
7139
7140         /* Only match event if command OGF is for LE */
7141         if (hdev->sent_cmd &&
7142             hci_opcode_ogf(hci_skb_opcode(hdev->sent_cmd)) == 0x08 &&
7143             hci_skb_event(hdev->sent_cmd) == ev->subevent) {
7144                 *opcode = hci_skb_opcode(hdev->sent_cmd);
7145                 hci_req_cmd_complete(hdev, *opcode, 0x00, req_complete,
7146                                      req_complete_skb);
7147         }
7148
7149         subev = &hci_le_ev_table[ev->subevent];
7150         if (!subev->func)
7151                 return;
7152
7153         if (skb->len < subev->min_len) {
7154                 bt_dev_err(hdev, "unexpected subevent 0x%2.2x length: %u < %u",
7155                            ev->subevent, skb->len, subev->min_len);
7156                 return;
7157         }
7158
7159         /* Just warn if the length is over max_len size it still be
7160          * possible to partially parse the event so leave to callback to
7161          * decide if that is acceptable.
7162          */
7163         if (skb->len > subev->max_len)
7164                 bt_dev_warn(hdev, "unexpected subevent 0x%2.2x length: %u > %u",
7165                             ev->subevent, skb->len, subev->max_len);
7166         data = hci_le_ev_skb_pull(hdev, skb, ev->subevent, subev->min_len);
7167         if (!data)
7168                 return;
7169
7170         subev->func(hdev, data, skb);
7171 }
7172
7173 static bool hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode,
7174                                  u8 event, struct sk_buff *skb)
7175 {
7176         struct hci_ev_cmd_complete *ev;
7177         struct hci_event_hdr *hdr;
7178
7179         if (!skb)
7180                 return false;
7181
7182         hdr = hci_ev_skb_pull(hdev, skb, event, sizeof(*hdr));
7183         if (!hdr)
7184                 return false;
7185
7186         if (event) {
7187                 if (hdr->evt != event)
7188                         return false;
7189                 return true;
7190         }
7191
7192         /* Check if request ended in Command Status - no way to retrieve
7193          * any extra parameters in this case.
7194          */
7195         if (hdr->evt == HCI_EV_CMD_STATUS)
7196                 return false;
7197
7198         if (hdr->evt != HCI_EV_CMD_COMPLETE) {
7199                 bt_dev_err(hdev, "last event is not cmd complete (0x%2.2x)",
7200                            hdr->evt);
7201                 return false;
7202         }
7203
7204         ev = hci_cc_skb_pull(hdev, skb, opcode, sizeof(*ev));
7205         if (!ev)
7206                 return false;
7207
7208         if (opcode != __le16_to_cpu(ev->opcode)) {
7209                 BT_DBG("opcode doesn't match (0x%2.2x != 0x%2.2x)", opcode,
7210                        __le16_to_cpu(ev->opcode));
7211                 return false;
7212         }
7213
7214         return true;
7215 }
7216
7217 static void hci_store_wake_reason(struct hci_dev *hdev, u8 event,
7218                                   struct sk_buff *skb)
7219 {
7220         struct hci_ev_le_advertising_info *adv;
7221         struct hci_ev_le_direct_adv_info *direct_adv;
7222         struct hci_ev_le_ext_adv_info *ext_adv;
7223         const struct hci_ev_conn_complete *conn_complete = (void *)skb->data;
7224         const struct hci_ev_conn_request *conn_request = (void *)skb->data;
7225
7226         hci_dev_lock(hdev);
7227
7228         /* If we are currently suspended and this is the first BT event seen,
7229          * save the wake reason associated with the event.
7230          */
7231         if (!hdev->suspended || hdev->wake_reason)
7232                 goto unlock;
7233
7234         /* Default to remote wake. Values for wake_reason are documented in the
7235          * Bluez mgmt api docs.
7236          */
7237         hdev->wake_reason = MGMT_WAKE_REASON_REMOTE_WAKE;
7238
7239         /* Once configured for remote wakeup, we should only wake up for
7240          * reconnections. It's useful to see which device is waking us up so
7241          * keep track of the bdaddr of the connection event that woke us up.
7242          */
7243         if (event == HCI_EV_CONN_REQUEST) {
7244                 bacpy(&hdev->wake_addr, &conn_complete->bdaddr);
7245                 hdev->wake_addr_type = BDADDR_BREDR;
7246         } else if (event == HCI_EV_CONN_COMPLETE) {
7247                 bacpy(&hdev->wake_addr, &conn_request->bdaddr);
7248                 hdev->wake_addr_type = BDADDR_BREDR;
7249         } else if (event == HCI_EV_LE_META) {
7250                 struct hci_ev_le_meta *le_ev = (void *)skb->data;
7251                 u8 subevent = le_ev->subevent;
7252                 u8 *ptr = &skb->data[sizeof(*le_ev)];
7253                 u8 num_reports = *ptr;
7254
7255                 if ((subevent == HCI_EV_LE_ADVERTISING_REPORT ||
7256                      subevent == HCI_EV_LE_DIRECT_ADV_REPORT ||
7257                      subevent == HCI_EV_LE_EXT_ADV_REPORT) &&
7258                     num_reports) {
7259                         adv = (void *)(ptr + 1);
7260                         direct_adv = (void *)(ptr + 1);
7261                         ext_adv = (void *)(ptr + 1);
7262
7263                         switch (subevent) {
7264                         case HCI_EV_LE_ADVERTISING_REPORT:
7265                                 bacpy(&hdev->wake_addr, &adv->bdaddr);
7266                                 hdev->wake_addr_type = adv->bdaddr_type;
7267                                 break;
7268                         case HCI_EV_LE_DIRECT_ADV_REPORT:
7269                                 bacpy(&hdev->wake_addr, &direct_adv->bdaddr);
7270                                 hdev->wake_addr_type = direct_adv->bdaddr_type;
7271                                 break;
7272                         case HCI_EV_LE_EXT_ADV_REPORT:
7273                                 bacpy(&hdev->wake_addr, &ext_adv->bdaddr);
7274                                 hdev->wake_addr_type = ext_adv->bdaddr_type;
7275                                 break;
7276                         }
7277                 }
7278         } else {
7279                 hdev->wake_reason = MGMT_WAKE_REASON_UNEXPECTED;
7280         }
7281
7282 unlock:
7283         hci_dev_unlock(hdev);
7284 }
7285
7286 #define HCI_EV_VL(_op, _func, _min_len, _max_len) \
7287 [_op] = { \
7288         .req = false, \
7289         .func = _func, \
7290         .min_len = _min_len, \
7291         .max_len = _max_len, \
7292 }
7293
7294 #define HCI_EV(_op, _func, _len) \
7295         HCI_EV_VL(_op, _func, _len, _len)
7296
7297 #define HCI_EV_STATUS(_op, _func) \
7298         HCI_EV(_op, _func, sizeof(struct hci_ev_status))
7299
7300 #define HCI_EV_REQ_VL(_op, _func, _min_len, _max_len) \
7301 [_op] = { \
7302         .req = true, \
7303         .func_req = _func, \
7304         .min_len = _min_len, \
7305         .max_len = _max_len, \
7306 }
7307
7308 #define HCI_EV_REQ(_op, _func, _len) \
7309         HCI_EV_REQ_VL(_op, _func, _len, _len)
7310
7311 /* Entries in this table shall have their position according to the event opcode
7312  * they handle so the use of the macros above is recommend since it does attempt
7313  * to initialize at its proper index using Designated Initializers that way
7314  * events without a callback function don't have entered.
7315  */
7316 static const struct hci_ev {
7317         bool req;
7318         union {
7319                 void (*func)(struct hci_dev *hdev, void *data,
7320                              struct sk_buff *skb);
7321                 void (*func_req)(struct hci_dev *hdev, void *data,
7322                                  struct sk_buff *skb, u16 *opcode, u8 *status,
7323                                  hci_req_complete_t *req_complete,
7324                                  hci_req_complete_skb_t *req_complete_skb);
7325         };
7326         u16  min_len;
7327         u16  max_len;
7328 } hci_ev_table[U8_MAX + 1] = {
7329         /* [0x01 = HCI_EV_INQUIRY_COMPLETE] */
7330         HCI_EV_STATUS(HCI_EV_INQUIRY_COMPLETE, hci_inquiry_complete_evt),
7331         /* [0x02 = HCI_EV_INQUIRY_RESULT] */
7332         HCI_EV_VL(HCI_EV_INQUIRY_RESULT, hci_inquiry_result_evt,
7333                   sizeof(struct hci_ev_inquiry_result), HCI_MAX_EVENT_SIZE),
7334         /* [0x03 = HCI_EV_CONN_COMPLETE] */
7335         HCI_EV(HCI_EV_CONN_COMPLETE, hci_conn_complete_evt,
7336                sizeof(struct hci_ev_conn_complete)),
7337         /* [0x04 = HCI_EV_CONN_REQUEST] */
7338         HCI_EV(HCI_EV_CONN_REQUEST, hci_conn_request_evt,
7339                sizeof(struct hci_ev_conn_request)),
7340         /* [0x05 = HCI_EV_DISCONN_COMPLETE] */
7341         HCI_EV(HCI_EV_DISCONN_COMPLETE, hci_disconn_complete_evt,
7342                sizeof(struct hci_ev_disconn_complete)),
7343         /* [0x06 = HCI_EV_AUTH_COMPLETE] */
7344         HCI_EV(HCI_EV_AUTH_COMPLETE, hci_auth_complete_evt,
7345                sizeof(struct hci_ev_auth_complete)),
7346         /* [0x07 = HCI_EV_REMOTE_NAME] */
7347         HCI_EV(HCI_EV_REMOTE_NAME, hci_remote_name_evt,
7348                sizeof(struct hci_ev_remote_name)),
7349         /* [0x08 = HCI_EV_ENCRYPT_CHANGE] */
7350         HCI_EV(HCI_EV_ENCRYPT_CHANGE, hci_encrypt_change_evt,
7351                sizeof(struct hci_ev_encrypt_change)),
7352         /* [0x09 = HCI_EV_CHANGE_LINK_KEY_COMPLETE] */
7353         HCI_EV(HCI_EV_CHANGE_LINK_KEY_COMPLETE,
7354                hci_change_link_key_complete_evt,
7355                sizeof(struct hci_ev_change_link_key_complete)),
7356         /* [0x0b = HCI_EV_REMOTE_FEATURES] */
7357         HCI_EV(HCI_EV_REMOTE_FEATURES, hci_remote_features_evt,
7358                sizeof(struct hci_ev_remote_features)),
7359         /* [0x0e = HCI_EV_CMD_COMPLETE] */
7360         HCI_EV_REQ_VL(HCI_EV_CMD_COMPLETE, hci_cmd_complete_evt,
7361                       sizeof(struct hci_ev_cmd_complete), HCI_MAX_EVENT_SIZE),
7362         /* [0x0f = HCI_EV_CMD_STATUS] */
7363         HCI_EV_REQ(HCI_EV_CMD_STATUS, hci_cmd_status_evt,
7364                    sizeof(struct hci_ev_cmd_status)),
7365         /* [0x10 = HCI_EV_CMD_STATUS] */
7366         HCI_EV(HCI_EV_HARDWARE_ERROR, hci_hardware_error_evt,
7367                sizeof(struct hci_ev_hardware_error)),
7368         /* [0x12 = HCI_EV_ROLE_CHANGE] */
7369         HCI_EV(HCI_EV_ROLE_CHANGE, hci_role_change_evt,
7370                sizeof(struct hci_ev_role_change)),
7371         /* [0x13 = HCI_EV_NUM_COMP_PKTS] */
7372         HCI_EV_VL(HCI_EV_NUM_COMP_PKTS, hci_num_comp_pkts_evt,
7373                   sizeof(struct hci_ev_num_comp_pkts), HCI_MAX_EVENT_SIZE),
7374         /* [0x14 = HCI_EV_MODE_CHANGE] */
7375         HCI_EV(HCI_EV_MODE_CHANGE, hci_mode_change_evt,
7376                sizeof(struct hci_ev_mode_change)),
7377         /* [0x16 = HCI_EV_PIN_CODE_REQ] */
7378         HCI_EV(HCI_EV_PIN_CODE_REQ, hci_pin_code_request_evt,
7379                sizeof(struct hci_ev_pin_code_req)),
7380         /* [0x17 = HCI_EV_LINK_KEY_REQ] */
7381         HCI_EV(HCI_EV_LINK_KEY_REQ, hci_link_key_request_evt,
7382                sizeof(struct hci_ev_link_key_req)),
7383         /* [0x18 = HCI_EV_LINK_KEY_NOTIFY] */
7384         HCI_EV(HCI_EV_LINK_KEY_NOTIFY, hci_link_key_notify_evt,
7385                sizeof(struct hci_ev_link_key_notify)),
7386         /* [0x1c = HCI_EV_CLOCK_OFFSET] */
7387         HCI_EV(HCI_EV_CLOCK_OFFSET, hci_clock_offset_evt,
7388                sizeof(struct hci_ev_clock_offset)),
7389         /* [0x1d = HCI_EV_PKT_TYPE_CHANGE] */
7390         HCI_EV(HCI_EV_PKT_TYPE_CHANGE, hci_pkt_type_change_evt,
7391                sizeof(struct hci_ev_pkt_type_change)),
7392         /* [0x20 = HCI_EV_PSCAN_REP_MODE] */
7393         HCI_EV(HCI_EV_PSCAN_REP_MODE, hci_pscan_rep_mode_evt,
7394                sizeof(struct hci_ev_pscan_rep_mode)),
7395         /* [0x22 = HCI_EV_INQUIRY_RESULT_WITH_RSSI] */
7396         HCI_EV_VL(HCI_EV_INQUIRY_RESULT_WITH_RSSI,
7397                   hci_inquiry_result_with_rssi_evt,
7398                   sizeof(struct hci_ev_inquiry_result_rssi),
7399                   HCI_MAX_EVENT_SIZE),
7400         /* [0x23 = HCI_EV_REMOTE_EXT_FEATURES] */
7401         HCI_EV(HCI_EV_REMOTE_EXT_FEATURES, hci_remote_ext_features_evt,
7402                sizeof(struct hci_ev_remote_ext_features)),
7403         /* [0x2c = HCI_EV_SYNC_CONN_COMPLETE] */
7404         HCI_EV(HCI_EV_SYNC_CONN_COMPLETE, hci_sync_conn_complete_evt,
7405                sizeof(struct hci_ev_sync_conn_complete)),
7406         /* [0x2d = HCI_EV_EXTENDED_INQUIRY_RESULT] */
7407         HCI_EV_VL(HCI_EV_EXTENDED_INQUIRY_RESULT,
7408                   hci_extended_inquiry_result_evt,
7409                   sizeof(struct hci_ev_ext_inquiry_result), HCI_MAX_EVENT_SIZE),
7410         /* [0x30 = HCI_EV_KEY_REFRESH_COMPLETE] */
7411         HCI_EV(HCI_EV_KEY_REFRESH_COMPLETE, hci_key_refresh_complete_evt,
7412                sizeof(struct hci_ev_key_refresh_complete)),
7413         /* [0x31 = HCI_EV_IO_CAPA_REQUEST] */
7414         HCI_EV(HCI_EV_IO_CAPA_REQUEST, hci_io_capa_request_evt,
7415                sizeof(struct hci_ev_io_capa_request)),
7416         /* [0x32 = HCI_EV_IO_CAPA_REPLY] */
7417         HCI_EV(HCI_EV_IO_CAPA_REPLY, hci_io_capa_reply_evt,
7418                sizeof(struct hci_ev_io_capa_reply)),
7419         /* [0x33 = HCI_EV_USER_CONFIRM_REQUEST] */
7420         HCI_EV(HCI_EV_USER_CONFIRM_REQUEST, hci_user_confirm_request_evt,
7421                sizeof(struct hci_ev_user_confirm_req)),
7422         /* [0x34 = HCI_EV_USER_PASSKEY_REQUEST] */
7423         HCI_EV(HCI_EV_USER_PASSKEY_REQUEST, hci_user_passkey_request_evt,
7424                sizeof(struct hci_ev_user_passkey_req)),
7425         /* [0x35 = HCI_EV_REMOTE_OOB_DATA_REQUEST] */
7426         HCI_EV(HCI_EV_REMOTE_OOB_DATA_REQUEST, hci_remote_oob_data_request_evt,
7427                sizeof(struct hci_ev_remote_oob_data_request)),
7428         /* [0x36 = HCI_EV_SIMPLE_PAIR_COMPLETE] */
7429         HCI_EV(HCI_EV_SIMPLE_PAIR_COMPLETE, hci_simple_pair_complete_evt,
7430                sizeof(struct hci_ev_simple_pair_complete)),
7431         /* [0x3b = HCI_EV_USER_PASSKEY_NOTIFY] */
7432         HCI_EV(HCI_EV_USER_PASSKEY_NOTIFY, hci_user_passkey_notify_evt,
7433                sizeof(struct hci_ev_user_passkey_notify)),
7434         /* [0x3c = HCI_EV_KEYPRESS_NOTIFY] */
7435         HCI_EV(HCI_EV_KEYPRESS_NOTIFY, hci_keypress_notify_evt,
7436                sizeof(struct hci_ev_keypress_notify)),
7437         /* [0x3d = HCI_EV_REMOTE_HOST_FEATURES] */
7438         HCI_EV(HCI_EV_REMOTE_HOST_FEATURES, hci_remote_host_features_evt,
7439                sizeof(struct hci_ev_remote_host_features)),
7440         /* [0x3e = HCI_EV_LE_META] */
7441         HCI_EV_REQ_VL(HCI_EV_LE_META, hci_le_meta_evt,
7442                       sizeof(struct hci_ev_le_meta), HCI_MAX_EVENT_SIZE),
7443 #if IS_ENABLED(CONFIG_BT_HS)
7444         /* [0x40 = HCI_EV_PHY_LINK_COMPLETE] */
7445         HCI_EV(HCI_EV_PHY_LINK_COMPLETE, hci_phy_link_complete_evt,
7446                sizeof(struct hci_ev_phy_link_complete)),
7447         /* [0x41 = HCI_EV_CHANNEL_SELECTED] */
7448         HCI_EV(HCI_EV_CHANNEL_SELECTED, hci_chan_selected_evt,
7449                sizeof(struct hci_ev_channel_selected)),
7450         /* [0x42 = HCI_EV_DISCONN_PHY_LINK_COMPLETE] */
7451         HCI_EV(HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE,
7452                hci_disconn_loglink_complete_evt,
7453                sizeof(struct hci_ev_disconn_logical_link_complete)),
7454         /* [0x45 = HCI_EV_LOGICAL_LINK_COMPLETE] */
7455         HCI_EV(HCI_EV_LOGICAL_LINK_COMPLETE, hci_loglink_complete_evt,
7456                sizeof(struct hci_ev_logical_link_complete)),
7457         /* [0x46 = HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE] */
7458         HCI_EV(HCI_EV_DISCONN_PHY_LINK_COMPLETE,
7459                hci_disconn_phylink_complete_evt,
7460                sizeof(struct hci_ev_disconn_phy_link_complete)),
7461 #endif
7462         /* [0x48 = HCI_EV_NUM_COMP_BLOCKS] */
7463         HCI_EV(HCI_EV_NUM_COMP_BLOCKS, hci_num_comp_blocks_evt,
7464                sizeof(struct hci_ev_num_comp_blocks)),
7465         /* [0xff = HCI_EV_VENDOR] */
7466         HCI_EV_VL(HCI_EV_VENDOR, msft_vendor_evt, 0, HCI_MAX_EVENT_SIZE),
7467 };
7468
7469 static void hci_event_func(struct hci_dev *hdev, u8 event, struct sk_buff *skb,
7470                            u16 *opcode, u8 *status,
7471                            hci_req_complete_t *req_complete,
7472                            hci_req_complete_skb_t *req_complete_skb)
7473 {
7474         const struct hci_ev *ev = &hci_ev_table[event];
7475         void *data;
7476
7477         if (!ev->func)
7478                 return;
7479
7480         if (skb->len < ev->min_len) {
7481                 bt_dev_err(hdev, "unexpected event 0x%2.2x length: %u < %u",
7482                            event, skb->len, ev->min_len);
7483                 return;
7484         }
7485
7486         /* Just warn if the length is over max_len size it still be
7487          * possible to partially parse the event so leave to callback to
7488          * decide if that is acceptable.
7489          */
7490         if (skb->len > ev->max_len)
7491                 bt_dev_warn_ratelimited(hdev,
7492                                         "unexpected event 0x%2.2x length: %u > %u",
7493                                         event, skb->len, ev->max_len);
7494
7495         data = hci_ev_skb_pull(hdev, skb, event, ev->min_len);
7496         if (!data)
7497                 return;
7498
7499         if (ev->req)
7500                 ev->func_req(hdev, data, skb, opcode, status, req_complete,
7501                              req_complete_skb);
7502         else
7503                 ev->func(hdev, data, skb);
7504 }
7505
7506 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
7507 {
7508         struct hci_event_hdr *hdr = (void *) skb->data;
7509         hci_req_complete_t req_complete = NULL;
7510         hci_req_complete_skb_t req_complete_skb = NULL;
7511         struct sk_buff *orig_skb = NULL;
7512         u8 status = 0, event, req_evt = 0;
7513         u16 opcode = HCI_OP_NOP;
7514
7515         if (skb->len < sizeof(*hdr)) {
7516                 bt_dev_err(hdev, "Malformed HCI Event");
7517                 goto done;
7518         }
7519
7520         kfree_skb(hdev->recv_event);
7521         hdev->recv_event = skb_clone(skb, GFP_KERNEL);
7522
7523         event = hdr->evt;
7524         if (!event) {
7525                 bt_dev_warn(hdev, "Received unexpected HCI Event 0x%2.2x",
7526                             event);
7527                 goto done;
7528         }
7529
7530         /* Only match event if command OGF is not for LE */
7531         if (hdev->sent_cmd &&
7532             hci_opcode_ogf(hci_skb_opcode(hdev->sent_cmd)) != 0x08 &&
7533             hci_skb_event(hdev->sent_cmd) == event) {
7534                 hci_req_cmd_complete(hdev, hci_skb_opcode(hdev->sent_cmd),
7535                                      status, &req_complete, &req_complete_skb);
7536                 req_evt = event;
7537         }
7538
7539         /* If it looks like we might end up having to call
7540          * req_complete_skb, store a pristine copy of the skb since the
7541          * various handlers may modify the original one through
7542          * skb_pull() calls, etc.
7543          */
7544         if (req_complete_skb || event == HCI_EV_CMD_STATUS ||
7545             event == HCI_EV_CMD_COMPLETE)
7546                 orig_skb = skb_clone(skb, GFP_KERNEL);
7547
7548         skb_pull(skb, HCI_EVENT_HDR_SIZE);
7549
7550         /* Store wake reason if we're suspended */
7551         hci_store_wake_reason(hdev, event, skb);
7552
7553         bt_dev_dbg(hdev, "event 0x%2.2x", event);
7554
7555         hci_event_func(hdev, event, skb, &opcode, &status, &req_complete,
7556                        &req_complete_skb);
7557
7558         if (req_complete) {
7559                 req_complete(hdev, status, opcode);
7560         } else if (req_complete_skb) {
7561                 if (!hci_get_cmd_complete(hdev, opcode, req_evt, orig_skb)) {
7562                         kfree_skb(orig_skb);
7563                         orig_skb = NULL;
7564                 }
7565                 req_complete_skb(hdev, status, opcode, orig_skb);
7566         }
7567
7568 done:
7569         kfree_skb(orig_skb);
7570         kfree_skb(skb);
7571         hdev->stat.evt_rx++;
7572 }