1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 BlueZ - Bluetooth protocol stack for Linux 4 Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved. 5 Copyright 2023-2024 NXP 6 7 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com> 8 9 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 10 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 11 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 12 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 13 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 14 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 15 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 16 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 17 18 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 19 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 20 SOFTWARE IS DISCLAIMED. 21 */ 22 23 /* Bluetooth HCI event handling. */ 24 25 #include <linux/unaligned.h> 26 #include <linux/crypto.h> 27 #include <crypto/algapi.h> 28 29 #include <net/bluetooth/bluetooth.h> 30 #include <net/bluetooth/hci_core.h> 31 #include <net/bluetooth/mgmt.h> 32 33 #include "hci_debugfs.h" 34 #include "hci_codec.h" 35 #include "smp.h" 36 #include "msft.h" 37 #include "eir.h" 38 39 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \ 40 "\x00\x00\x00\x00\x00\x00\x00\x00" 41 42 /* Handle HCI Event packets */ 43 44 static void *hci_ev_skb_pull(struct hci_dev *hdev, struct sk_buff *skb, 45 u8 ev, size_t len) 46 { 47 void *data; 48 49 data = skb_pull_data(skb, len); 50 if (!data) 51 bt_dev_err(hdev, "Malformed Event: 0x%2.2x", ev); 52 53 return data; 54 } 55 56 static void *hci_cc_skb_pull(struct hci_dev *hdev, struct sk_buff *skb, 57 u16 op, size_t len) 58 { 59 void *data; 60 61 data = skb_pull_data(skb, len); 62 if (!data) 63 bt_dev_err(hdev, "Malformed Command Complete: 0x%4.4x", op); 64 65 return data; 66 } 67 68 static void *hci_le_ev_skb_pull(struct hci_dev *hdev, struct sk_buff *skb, 69 u8 ev, size_t len) 70 { 71 void *data; 72 73 data = skb_pull_data(skb, len); 74 if (!data) 75 bt_dev_err(hdev, "Malformed LE Event: 0x%2.2x", ev); 76 77 return data; 78 } 79 80 static void hci_store_wake_reason(struct hci_dev *hdev, 81 const bdaddr_t *bdaddr, u8 addr_type) 82 __must_hold(&hdev->lock); 83 84 static u8 hci_cc_inquiry_cancel(struct hci_dev *hdev, void *data, 85 struct sk_buff *skb) 86 { 87 struct hci_ev_status *rp = data; 88 89 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 90 91 /* It is possible that we receive Inquiry Complete event right 92 * before we receive Inquiry Cancel Command Complete event, in 93 * which case the latter event should have status of Command 94 * Disallowed. This should not be treated as error, since 95 * we actually achieve what Inquiry Cancel wants to achieve, 96 * which is to end the last Inquiry session. 97 */ 98 if (rp->status == HCI_ERROR_COMMAND_DISALLOWED && !test_bit(HCI_INQUIRY, &hdev->flags)) { 99 bt_dev_warn(hdev, "Ignoring error of Inquiry Cancel command"); 100 rp->status = 0x00; 101 } 102 103 if (rp->status) 104 return rp->status; 105 106 clear_bit(HCI_INQUIRY, &hdev->flags); 107 smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */ 108 wake_up_bit(&hdev->flags, HCI_INQUIRY); 109 110 hci_dev_lock(hdev); 111 /* Set discovery state to stopped if we're not doing LE active 112 * scanning. 113 */ 114 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) || 115 hdev->le_scan_type != LE_SCAN_ACTIVE) 116 hci_discovery_set_state(hdev, DISCOVERY_STOPPED); 117 hci_dev_unlock(hdev); 118 119 return rp->status; 120 } 121 122 static u8 hci_cc_periodic_inq(struct hci_dev *hdev, void *data, 123 struct sk_buff *skb) 124 { 125 struct hci_ev_status *rp = data; 126 127 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 128 129 if (rp->status) 130 return rp->status; 131 132 hci_dev_set_flag(hdev, HCI_PERIODIC_INQ); 133 134 return rp->status; 135 } 136 137 static u8 hci_cc_exit_periodic_inq(struct hci_dev *hdev, void *data, 138 struct sk_buff *skb) 139 { 140 struct hci_ev_status *rp = data; 141 142 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 143 144 if (rp->status) 145 return rp->status; 146 147 hci_dev_clear_flag(hdev, HCI_PERIODIC_INQ); 148 149 return rp->status; 150 } 151 152 static u8 hci_cc_remote_name_req_cancel(struct hci_dev *hdev, void *data, 153 struct sk_buff *skb) 154 { 155 struct hci_rp_remote_name_req_cancel *rp = data; 156 157 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 158 159 return rp->status; 160 } 161 162 static u8 hci_cc_role_discovery(struct hci_dev *hdev, void *data, 163 struct sk_buff *skb) 164 { 165 struct hci_rp_role_discovery *rp = data; 166 struct hci_conn *conn; 167 168 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 169 170 if (rp->status) 171 return rp->status; 172 173 hci_dev_lock(hdev); 174 175 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle)); 176 if (conn) 177 conn->role = rp->role; 178 179 hci_dev_unlock(hdev); 180 181 return rp->status; 182 } 183 184 static u8 hci_cc_read_link_policy(struct hci_dev *hdev, void *data, 185 struct sk_buff *skb) 186 { 187 struct hci_rp_read_link_policy *rp = data; 188 struct hci_conn *conn; 189 190 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 191 192 if (rp->status) 193 return rp->status; 194 195 hci_dev_lock(hdev); 196 197 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle)); 198 if (conn) 199 conn->link_policy = __le16_to_cpu(rp->policy); 200 201 hci_dev_unlock(hdev); 202 203 return rp->status; 204 } 205 206 static u8 hci_cc_write_link_policy(struct hci_dev *hdev, void *data, 207 struct sk_buff *skb) 208 { 209 struct hci_rp_write_link_policy *rp = data; 210 struct hci_conn *conn; 211 void *sent; 212 213 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 214 215 if (rp->status) 216 return rp->status; 217 218 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY); 219 if (!sent) 220 return rp->status; 221 222 hci_dev_lock(hdev); 223 224 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle)); 225 if (conn) 226 conn->link_policy = get_unaligned_le16(sent + 2); 227 228 hci_dev_unlock(hdev); 229 230 return rp->status; 231 } 232 233 static u8 hci_cc_read_def_link_policy(struct hci_dev *hdev, void *data, 234 struct sk_buff *skb) 235 { 236 struct hci_rp_read_def_link_policy *rp = data; 237 238 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 239 240 if (rp->status) 241 return rp->status; 242 243 hdev->link_policy = __le16_to_cpu(rp->policy); 244 245 return rp->status; 246 } 247 248 static u8 hci_cc_write_def_link_policy(struct hci_dev *hdev, void *data, 249 struct sk_buff *skb) 250 { 251 struct hci_ev_status *rp = data; 252 void *sent; 253 254 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 255 256 if (rp->status) 257 return rp->status; 258 259 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY); 260 if (!sent) 261 return rp->status; 262 263 hdev->link_policy = get_unaligned_le16(sent); 264 265 return rp->status; 266 } 267 268 static u8 hci_cc_reset(struct hci_dev *hdev, void *data, struct sk_buff *skb) 269 { 270 struct hci_ev_status *rp = data; 271 272 if (rp->status) 273 bt_dev_err(hdev, "status 0x%2.2x", rp->status); 274 else 275 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 276 277 clear_bit(HCI_RESET, &hdev->flags); 278 279 if (rp->status) 280 return rp->status; 281 282 /* Reset all non-persistent flags */ 283 hci_dev_clear_volatile_flags(hdev); 284 285 hci_discovery_set_state(hdev, DISCOVERY_STOPPED); 286 287 hdev->inq_tx_power = HCI_TX_POWER_INVALID; 288 hdev->adv_tx_power = HCI_TX_POWER_INVALID; 289 290 memset(hdev->adv_data, 0, sizeof(hdev->adv_data)); 291 hdev->adv_data_len = 0; 292 293 memset(hdev->scan_rsp_data, 0, sizeof(hdev->scan_rsp_data)); 294 hdev->scan_rsp_data_len = 0; 295 296 hdev->le_scan_type = LE_SCAN_PASSIVE; 297 298 hdev->ssp_debug_mode = 0; 299 300 hci_dev_lock(hdev); 301 hci_bdaddr_list_clear(&hdev->le_accept_list); 302 hci_bdaddr_list_clear(&hdev->le_resolv_list); 303 hci_dev_unlock(hdev); 304 305 return rp->status; 306 } 307 308 static u8 hci_cc_read_stored_link_key(struct hci_dev *hdev, void *data, 309 struct sk_buff *skb) 310 { 311 struct hci_rp_read_stored_link_key *rp = data; 312 struct hci_cp_read_stored_link_key *sent; 313 314 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 315 316 sent = hci_sent_cmd_data(hdev, HCI_OP_READ_STORED_LINK_KEY); 317 if (!sent) 318 return rp->status; 319 320 if (!rp->status && sent->read_all == 0x01) { 321 hdev->stored_max_keys = le16_to_cpu(rp->max_keys); 322 hdev->stored_num_keys = le16_to_cpu(rp->num_keys); 323 } 324 325 return rp->status; 326 } 327 328 static u8 hci_cc_delete_stored_link_key(struct hci_dev *hdev, void *data, 329 struct sk_buff *skb) 330 { 331 struct hci_rp_delete_stored_link_key *rp = data; 332 u16 num_keys; 333 334 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 335 336 if (rp->status) 337 return rp->status; 338 339 num_keys = le16_to_cpu(rp->num_keys); 340 341 if (num_keys <= hdev->stored_num_keys) 342 hdev->stored_num_keys -= num_keys; 343 else 344 hdev->stored_num_keys = 0; 345 346 return rp->status; 347 } 348 349 static u8 hci_cc_write_local_name(struct hci_dev *hdev, void *data, 350 struct sk_buff *skb) 351 { 352 struct hci_ev_status *rp = data; 353 void *sent; 354 355 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 356 357 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME); 358 if (!sent) 359 return rp->status; 360 361 hci_dev_lock(hdev); 362 363 if (hci_dev_test_flag(hdev, HCI_MGMT)) 364 mgmt_set_local_name_complete(hdev, sent, rp->status); 365 else if (!rp->status) 366 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH); 367 368 hci_dev_unlock(hdev); 369 370 return rp->status; 371 } 372 373 static u8 hci_cc_read_local_name(struct hci_dev *hdev, void *data, 374 struct sk_buff *skb) 375 { 376 struct hci_rp_read_local_name *rp = data; 377 378 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 379 380 if (rp->status) 381 return rp->status; 382 383 if (hci_dev_test_flag(hdev, HCI_SETUP) || 384 hci_dev_test_flag(hdev, HCI_CONFIG)) 385 memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH); 386 387 return rp->status; 388 } 389 390 static u8 hci_cc_write_auth_enable(struct hci_dev *hdev, void *data, 391 struct sk_buff *skb) 392 { 393 struct hci_ev_status *rp = data; 394 void *sent; 395 396 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 397 398 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE); 399 if (!sent) 400 return rp->status; 401 402 hci_dev_lock(hdev); 403 404 if (!rp->status) { 405 __u8 param = *((__u8 *) sent); 406 407 assign_bit(HCI_AUTH, &hdev->flags, param == AUTH_ENABLED); 408 } 409 410 if (hci_dev_test_flag(hdev, HCI_MGMT)) 411 mgmt_auth_enable_complete(hdev, rp->status); 412 413 hci_dev_unlock(hdev); 414 415 return rp->status; 416 } 417 418 static u8 hci_cc_write_encrypt_mode(struct hci_dev *hdev, void *data, 419 struct sk_buff *skb) 420 { 421 struct hci_ev_status *rp = data; 422 __u8 param; 423 void *sent; 424 425 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 426 427 if (rp->status) 428 return rp->status; 429 430 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE); 431 if (!sent) 432 return rp->status; 433 434 param = *((__u8 *) sent); 435 436 assign_bit(HCI_ENCRYPT, &hdev->flags, param); 437 438 return rp->status; 439 } 440 441 static u8 hci_cc_write_scan_enable(struct hci_dev *hdev, void *data, 442 struct sk_buff *skb) 443 { 444 struct hci_ev_status *rp = data; 445 __u8 param; 446 void *sent; 447 448 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 449 450 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE); 451 if (!sent) 452 return rp->status; 453 454 param = *((__u8 *) sent); 455 456 hci_dev_lock(hdev); 457 458 if (rp->status) { 459 hdev->discov_timeout = 0; 460 goto done; 461 } 462 463 assign_bit(HCI_ISCAN, &hdev->flags, param & SCAN_INQUIRY); 464 465 assign_bit(HCI_PSCAN, &hdev->flags, param & SCAN_PAGE); 466 467 done: 468 hci_dev_unlock(hdev); 469 470 return rp->status; 471 } 472 473 static u8 hci_cc_set_event_filter(struct hci_dev *hdev, void *data, 474 struct sk_buff *skb) 475 { 476 struct hci_ev_status *rp = data; 477 struct hci_cp_set_event_filter *cp; 478 void *sent; 479 480 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 481 482 if (rp->status) 483 return rp->status; 484 485 sent = hci_sent_cmd_data(hdev, HCI_OP_SET_EVENT_FLT); 486 if (!sent) 487 return rp->status; 488 489 cp = (struct hci_cp_set_event_filter *)sent; 490 491 if (cp->flt_type == HCI_FLT_CLEAR_ALL) 492 hci_dev_clear_flag(hdev, HCI_EVENT_FILTER_CONFIGURED); 493 else 494 hci_dev_set_flag(hdev, HCI_EVENT_FILTER_CONFIGURED); 495 496 return rp->status; 497 } 498 499 static u8 hci_cc_read_class_of_dev(struct hci_dev *hdev, void *data, 500 struct sk_buff *skb) 501 { 502 struct hci_rp_read_class_of_dev *rp = data; 503 504 if (WARN_ON(!hdev)) 505 return HCI_ERROR_UNSPECIFIED; 506 507 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 508 509 if (rp->status) 510 return rp->status; 511 512 memcpy(hdev->dev_class, rp->dev_class, 3); 513 514 bt_dev_dbg(hdev, "class 0x%.2x%.2x%.2x", hdev->dev_class[2], 515 hdev->dev_class[1], hdev->dev_class[0]); 516 517 return rp->status; 518 } 519 520 static u8 hci_cc_write_class_of_dev(struct hci_dev *hdev, void *data, 521 struct sk_buff *skb) 522 { 523 struct hci_ev_status *rp = data; 524 void *sent; 525 526 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 527 528 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV); 529 if (!sent) 530 return rp->status; 531 532 hci_dev_lock(hdev); 533 534 if (!rp->status) 535 memcpy(hdev->dev_class, sent, 3); 536 537 if (hci_dev_test_flag(hdev, HCI_MGMT)) 538 mgmt_set_class_of_dev_complete(hdev, sent, rp->status); 539 540 hci_dev_unlock(hdev); 541 542 return rp->status; 543 } 544 545 static u8 hci_cc_read_voice_setting(struct hci_dev *hdev, void *data, 546 struct sk_buff *skb) 547 { 548 struct hci_rp_read_voice_setting *rp = data; 549 __u16 setting; 550 551 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 552 553 if (rp->status) 554 return rp->status; 555 556 setting = __le16_to_cpu(rp->voice_setting); 557 558 if (hdev->voice_setting == setting) 559 return rp->status; 560 561 hdev->voice_setting = setting; 562 563 bt_dev_dbg(hdev, "voice setting 0x%4.4x", setting); 564 565 if (hdev->notify) 566 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING); 567 568 return rp->status; 569 } 570 571 static u8 hci_cc_write_voice_setting(struct hci_dev *hdev, void *data, 572 struct sk_buff *skb) 573 { 574 struct hci_ev_status *rp = data; 575 __u16 setting; 576 void *sent; 577 578 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 579 580 if (rp->status) 581 return rp->status; 582 583 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING); 584 if (!sent) 585 return rp->status; 586 587 setting = get_unaligned_le16(sent); 588 589 if (hdev->voice_setting == setting) 590 return rp->status; 591 592 hdev->voice_setting = setting; 593 594 bt_dev_dbg(hdev, "voice setting 0x%4.4x", setting); 595 596 if (hdev->notify) 597 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING); 598 599 return rp->status; 600 } 601 602 static u8 hci_cc_read_num_supported_iac(struct hci_dev *hdev, void *data, 603 struct sk_buff *skb) 604 { 605 struct hci_rp_read_num_supported_iac *rp = data; 606 607 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 608 609 if (rp->status) 610 return rp->status; 611 612 hdev->num_iac = rp->num_iac; 613 614 bt_dev_dbg(hdev, "num iac %d", hdev->num_iac); 615 616 return rp->status; 617 } 618 619 static u8 hci_cc_write_ssp_mode(struct hci_dev *hdev, void *data, 620 struct sk_buff *skb) 621 { 622 struct hci_ev_status *rp = data; 623 struct hci_cp_write_ssp_mode *sent; 624 625 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 626 627 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE); 628 if (!sent) 629 return rp->status; 630 631 hci_dev_lock(hdev); 632 633 if (!rp->status) { 634 if (sent->mode) 635 hdev->features[1][0] |= LMP_HOST_SSP; 636 else 637 hdev->features[1][0] &= ~LMP_HOST_SSP; 638 } 639 640 if (!rp->status) { 641 if (sent->mode) 642 hci_dev_set_flag(hdev, HCI_SSP_ENABLED); 643 else 644 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED); 645 } 646 647 hci_dev_unlock(hdev); 648 649 return rp->status; 650 } 651 652 static u8 hci_cc_write_sc_support(struct hci_dev *hdev, void *data, 653 struct sk_buff *skb) 654 { 655 struct hci_ev_status *rp = data; 656 struct hci_cp_write_sc_support *sent; 657 658 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 659 660 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SC_SUPPORT); 661 if (!sent) 662 return rp->status; 663 664 hci_dev_lock(hdev); 665 666 if (!rp->status) { 667 if (sent->support) 668 hdev->features[1][0] |= LMP_HOST_SC; 669 else 670 hdev->features[1][0] &= ~LMP_HOST_SC; 671 } 672 673 if (!hci_dev_test_flag(hdev, HCI_MGMT) && !rp->status) { 674 if (sent->support) 675 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 676 else 677 hci_dev_clear_flag(hdev, HCI_SC_ENABLED); 678 } 679 680 hci_dev_unlock(hdev); 681 682 return rp->status; 683 } 684 685 static u8 hci_cc_read_local_version(struct hci_dev *hdev, void *data, 686 struct sk_buff *skb) 687 { 688 struct hci_rp_read_local_version *rp = data; 689 690 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 691 692 if (rp->status) 693 return rp->status; 694 695 if (hci_dev_test_flag(hdev, HCI_SETUP) || 696 hci_dev_test_flag(hdev, HCI_CONFIG)) { 697 hdev->hci_ver = rp->hci_ver; 698 hdev->hci_rev = __le16_to_cpu(rp->hci_rev); 699 hdev->lmp_ver = rp->lmp_ver; 700 hdev->manufacturer = __le16_to_cpu(rp->manufacturer); 701 hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver); 702 } 703 704 return rp->status; 705 } 706 707 static u8 hci_cc_read_enc_key_size(struct hci_dev *hdev, void *data, 708 struct sk_buff *skb) 709 { 710 struct hci_rp_read_enc_key_size *rp = data; 711 struct hci_conn *conn; 712 u16 handle; 713 u8 status = rp->status; 714 715 bt_dev_dbg(hdev, "status 0x%2.2x", status); 716 717 handle = le16_to_cpu(rp->handle); 718 719 hci_dev_lock(hdev); 720 721 conn = hci_conn_hash_lookup_handle(hdev, handle); 722 if (!conn) { 723 status = 0xFF; 724 goto done; 725 } 726 727 /* While unexpected, the read_enc_key_size command may fail. The most 728 * secure approach is to then assume the key size is 0 to force a 729 * disconnection. 730 */ 731 if (status) { 732 bt_dev_err(hdev, "failed to read key size for handle %u", 733 handle); 734 conn->enc_key_size = 0; 735 clear_bit(HCI_CONN_ENCRYPT, &conn->flags); 736 clear_bit(HCI_CONN_AES_CCM, &conn->flags); 737 /* Downgrade to reflect the connection no longer being 738 * encrypted, instead of advertising a stale elevated 739 * security level alongside MGMT_CONN_SEC_ENCRYPT_NONE. 740 */ 741 if (conn->sec_level > BT_SECURITY_LOW) 742 conn->sec_level = BT_SECURITY_LOW; 743 } else { 744 u8 *key_enc_size = hci_conn_key_enc_size(conn); 745 746 conn->enc_key_size = rp->key_size; 747 status = 0; 748 749 /* Attempt to check if the key size is too small or if it has 750 * been downgraded from the last time it was stored as part of 751 * the link_key. 752 */ 753 if (conn->enc_key_size < hdev->min_enc_key_size || 754 (key_enc_size && conn->enc_key_size < *key_enc_size)) { 755 /* As slave role, the conn->state has been set to 756 * BT_CONNECTED and l2cap conn req might not be received 757 * yet, at this moment the l2cap layer almost does 758 * nothing with the non-zero status. 759 * So we also clear encrypt related bits, and then the 760 * handler of l2cap conn req will get the right secure 761 * state at a later time. 762 */ 763 status = HCI_ERROR_AUTH_FAILURE; 764 clear_bit(HCI_CONN_ENCRYPT, &conn->flags); 765 clear_bit(HCI_CONN_AES_CCM, &conn->flags); 766 /* Downgrade to reflect the connection no longer being 767 * encrypted, instead of advertising a stale elevated 768 * security level alongside MGMT_CONN_SEC_ENCRYPT_NONE. 769 */ 770 if (conn->sec_level > BT_SECURITY_LOW) 771 conn->sec_level = BT_SECURITY_LOW; 772 } else { 773 /* Pre-apply hci_encrypt_cfm()'s own upgrade rules 774 * here unconditionally on success, so its internal 775 * change check below always finds nothing new: this 776 * function remains the sole place deciding whether 777 * and when to report the change, regardless of 778 * whether the caller already touched conn->sec_level 779 * (e.g. hci_encrypt_change_evt()) or not. 780 */ 781 if (conn->sec_level == BT_SECURITY_SDP) 782 conn->sec_level = BT_SECURITY_LOW; 783 if (conn->pending_sec_level > conn->sec_level) 784 conn->sec_level = conn->pending_sec_level; 785 } 786 787 /* Update the key encryption size with the connection one */ 788 if (key_enc_size && *key_enc_size != conn->enc_key_size) 789 *key_enc_size = conn->enc_key_size; 790 } 791 792 hci_encrypt_cfm(conn, status); 793 794 /* mgmt_security_level_changed() only reports the change for 795 * connections already announced to userspace (it checks 796 * HCI_CONN_MGMT_CONNECTED itself); otherwise it is a no-op here and 797 * reporting is deferred to mgmt_device_connected(). 798 */ 799 mgmt_security_level_changed(conn); 800 801 done: 802 hci_dev_unlock(hdev); 803 804 return status; 805 } 806 807 static u8 hci_cc_read_local_commands(struct hci_dev *hdev, void *data, 808 struct sk_buff *skb) 809 { 810 struct hci_rp_read_local_commands *rp = data; 811 812 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 813 814 if (rp->status) 815 return rp->status; 816 817 if (hci_dev_test_flag(hdev, HCI_SETUP) || 818 hci_dev_test_flag(hdev, HCI_CONFIG)) 819 memcpy(hdev->commands, rp->commands, sizeof(hdev->commands)); 820 821 return rp->status; 822 } 823 824 static u8 hci_cc_read_auth_payload_timeout(struct hci_dev *hdev, void *data, 825 struct sk_buff *skb) 826 { 827 struct hci_rp_read_auth_payload_to *rp = data; 828 struct hci_conn *conn; 829 830 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 831 832 if (rp->status) 833 return rp->status; 834 835 hci_dev_lock(hdev); 836 837 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle)); 838 if (conn) 839 conn->auth_payload_timeout = __le16_to_cpu(rp->timeout); 840 841 hci_dev_unlock(hdev); 842 843 return rp->status; 844 } 845 846 static u8 hci_cc_write_auth_payload_timeout(struct hci_dev *hdev, void *data, 847 struct sk_buff *skb) 848 { 849 struct hci_rp_write_auth_payload_to *rp = data; 850 struct hci_conn *conn; 851 void *sent; 852 853 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 854 855 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_PAYLOAD_TO); 856 if (!sent) 857 return rp->status; 858 859 hci_dev_lock(hdev); 860 861 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle)); 862 if (!conn) { 863 rp->status = 0xff; 864 goto unlock; 865 } 866 867 if (!rp->status) 868 conn->auth_payload_timeout = get_unaligned_le16(sent + 2); 869 870 unlock: 871 hci_dev_unlock(hdev); 872 873 return rp->status; 874 } 875 876 static u8 hci_cc_read_local_features(struct hci_dev *hdev, void *data, 877 struct sk_buff *skb) 878 { 879 struct hci_rp_read_local_features *rp = data; 880 881 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 882 883 if (rp->status) 884 return rp->status; 885 886 memcpy(hdev->features, rp->features, 8); 887 888 /* Adjust default settings according to features 889 * supported by device. */ 890 891 if (hdev->features[0][0] & LMP_3SLOT) 892 hdev->pkt_type |= (HCI_DM3 | HCI_DH3); 893 894 if (hdev->features[0][0] & LMP_5SLOT) 895 hdev->pkt_type |= (HCI_DM5 | HCI_DH5); 896 897 if (hdev->features[0][1] & LMP_HV2) { 898 hdev->pkt_type |= (HCI_HV2); 899 hdev->esco_type |= (ESCO_HV2); 900 } 901 902 if (hdev->features[0][1] & LMP_HV3) { 903 hdev->pkt_type |= (HCI_HV3); 904 hdev->esco_type |= (ESCO_HV3); 905 } 906 907 if (lmp_esco_capable(hdev)) 908 hdev->esco_type |= (ESCO_EV3); 909 910 if (hdev->features[0][4] & LMP_EV4) 911 hdev->esco_type |= (ESCO_EV4); 912 913 if (hdev->features[0][4] & LMP_EV5) 914 hdev->esco_type |= (ESCO_EV5); 915 916 if (hdev->features[0][5] & LMP_EDR_ESCO_2M) 917 hdev->esco_type |= (ESCO_2EV3); 918 919 if (hdev->features[0][5] & LMP_EDR_ESCO_3M) 920 hdev->esco_type |= (ESCO_3EV3); 921 922 if (hdev->features[0][5] & LMP_EDR_3S_ESCO) 923 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5); 924 925 return rp->status; 926 } 927 928 static u8 hci_cc_read_local_ext_features(struct hci_dev *hdev, void *data, 929 struct sk_buff *skb) 930 { 931 struct hci_rp_read_local_ext_features *rp = data; 932 933 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 934 935 if (rp->status) 936 return rp->status; 937 938 if (hdev->max_page < rp->max_page) { 939 if (hci_test_quirk(hdev, 940 HCI_QUIRK_BROKEN_LOCAL_EXT_FEATURES_PAGE_2)) 941 bt_dev_warn(hdev, "broken local ext features page 2"); 942 else 943 hdev->max_page = rp->max_page; 944 } 945 946 if (rp->page < HCI_MAX_PAGES) 947 memcpy(hdev->features[rp->page], rp->features, 8); 948 949 return rp->status; 950 } 951 952 static u8 hci_cc_read_buffer_size(struct hci_dev *hdev, void *data, 953 struct sk_buff *skb) 954 { 955 struct hci_rp_read_buffer_size *rp = data; 956 957 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 958 959 if (rp->status) 960 return rp->status; 961 962 hdev->acl_mtu = __le16_to_cpu(rp->acl_mtu); 963 hdev->sco_mtu = rp->sco_mtu; 964 hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt); 965 hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt); 966 967 if (hci_test_quirk(hdev, HCI_QUIRK_FIXUP_BUFFER_SIZE)) { 968 hdev->sco_mtu = 64; 969 hdev->sco_pkts = 8; 970 } 971 972 if (!read_voice_setting_capable(hdev)) 973 hdev->sco_pkts = 0; 974 975 hdev->acl_cnt = hdev->acl_pkts; 976 hdev->sco_cnt = hdev->sco_pkts; 977 978 BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu, 979 hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts); 980 981 if (!hdev->acl_mtu || !hdev->acl_pkts) 982 return HCI_ERROR_INVALID_PARAMETERS; 983 984 return rp->status; 985 } 986 987 static u8 hci_cc_read_bd_addr(struct hci_dev *hdev, void *data, 988 struct sk_buff *skb) 989 { 990 struct hci_rp_read_bd_addr *rp = data; 991 992 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 993 994 if (rp->status) 995 return rp->status; 996 997 if (test_bit(HCI_INIT, &hdev->flags)) 998 bacpy(&hdev->bdaddr, &rp->bdaddr); 999 1000 if (hci_dev_test_flag(hdev, HCI_SETUP)) 1001 bacpy(&hdev->setup_addr, &rp->bdaddr); 1002 1003 return rp->status; 1004 } 1005 1006 static u8 hci_cc_read_local_pairing_opts(struct hci_dev *hdev, void *data, 1007 struct sk_buff *skb) 1008 { 1009 struct hci_rp_read_local_pairing_opts *rp = data; 1010 1011 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 1012 1013 if (rp->status) 1014 return rp->status; 1015 1016 if (hci_dev_test_flag(hdev, HCI_SETUP) || 1017 hci_dev_test_flag(hdev, HCI_CONFIG)) { 1018 hdev->pairing_opts = rp->pairing_opts; 1019 hdev->max_enc_key_size = rp->max_key_size; 1020 } 1021 1022 return rp->status; 1023 } 1024 1025 static u8 hci_cc_read_page_scan_activity(struct hci_dev *hdev, void *data, 1026 struct sk_buff *skb) 1027 { 1028 struct hci_rp_read_page_scan_activity *rp = data; 1029 1030 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 1031 1032 if (rp->status) 1033 return rp->status; 1034 1035 if (test_bit(HCI_INIT, &hdev->flags)) { 1036 hdev->page_scan_interval = __le16_to_cpu(rp->interval); 1037 hdev->page_scan_window = __le16_to_cpu(rp->window); 1038 } 1039 1040 return rp->status; 1041 } 1042 1043 static u8 hci_cc_write_page_scan_activity(struct hci_dev *hdev, void *data, 1044 struct sk_buff *skb) 1045 { 1046 struct hci_ev_status *rp = data; 1047 struct hci_cp_write_page_scan_activity *sent; 1048 1049 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 1050 1051 if (rp->status) 1052 return rp->status; 1053 1054 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY); 1055 if (!sent) 1056 return rp->status; 1057 1058 hdev->page_scan_interval = __le16_to_cpu(sent->interval); 1059 hdev->page_scan_window = __le16_to_cpu(sent->window); 1060 1061 return rp->status; 1062 } 1063 1064 static u8 hci_cc_read_page_scan_type(struct hci_dev *hdev, void *data, 1065 struct sk_buff *skb) 1066 { 1067 struct hci_rp_read_page_scan_type *rp = data; 1068 1069 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 1070 1071 if (rp->status) 1072 return rp->status; 1073 1074 if (test_bit(HCI_INIT, &hdev->flags)) 1075 hdev->page_scan_type = rp->type; 1076 1077 return rp->status; 1078 } 1079 1080 static u8 hci_cc_write_page_scan_type(struct hci_dev *hdev, void *data, 1081 struct sk_buff *skb) 1082 { 1083 struct hci_ev_status *rp = data; 1084 u8 *type; 1085 1086 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 1087 1088 if (rp->status) 1089 return rp->status; 1090 1091 type = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE); 1092 if (type) 1093 hdev->page_scan_type = *type; 1094 1095 return rp->status; 1096 } 1097 1098 static u8 hci_cc_read_clock(struct hci_dev *hdev, void *data, 1099 struct sk_buff *skb) 1100 { 1101 struct hci_rp_read_clock *rp = data; 1102 struct hci_cp_read_clock *cp; 1103 struct hci_conn *conn; 1104 1105 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 1106 1107 if (rp->status) 1108 return rp->status; 1109 1110 hci_dev_lock(hdev); 1111 1112 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK); 1113 if (!cp) 1114 goto unlock; 1115 1116 if (cp->which == 0x00) { 1117 hdev->clock = le32_to_cpu(rp->clock); 1118 goto unlock; 1119 } 1120 1121 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle)); 1122 if (conn) { 1123 conn->clock = le32_to_cpu(rp->clock); 1124 conn->clock_accuracy = le16_to_cpu(rp->accuracy); 1125 } 1126 1127 unlock: 1128 hci_dev_unlock(hdev); 1129 return rp->status; 1130 } 1131 1132 static u8 hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev, void *data, 1133 struct sk_buff *skb) 1134 { 1135 struct hci_rp_read_inq_rsp_tx_power *rp = data; 1136 1137 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 1138 1139 if (rp->status) 1140 return rp->status; 1141 1142 hdev->inq_tx_power = rp->tx_power; 1143 1144 return rp->status; 1145 } 1146 1147 static u8 hci_cc_read_def_err_data_reporting(struct hci_dev *hdev, void *data, 1148 struct sk_buff *skb) 1149 { 1150 struct hci_rp_read_def_err_data_reporting *rp = data; 1151 1152 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 1153 1154 if (rp->status) 1155 return rp->status; 1156 1157 hdev->err_data_reporting = rp->err_data_reporting; 1158 1159 return rp->status; 1160 } 1161 1162 static u8 hci_cc_write_def_err_data_reporting(struct hci_dev *hdev, void *data, 1163 struct sk_buff *skb) 1164 { 1165 struct hci_ev_status *rp = data; 1166 struct hci_cp_write_def_err_data_reporting *cp; 1167 1168 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 1169 1170 if (rp->status) 1171 return rp->status; 1172 1173 cp = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_ERR_DATA_REPORTING); 1174 if (!cp) 1175 return rp->status; 1176 1177 hdev->err_data_reporting = cp->err_data_reporting; 1178 1179 return rp->status; 1180 } 1181 1182 static u8 hci_cc_pin_code_reply(struct hci_dev *hdev, void *data, 1183 struct sk_buff *skb) 1184 { 1185 struct hci_rp_pin_code_reply *rp = data; 1186 struct hci_cp_pin_code_reply *cp; 1187 struct hci_conn *conn; 1188 1189 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 1190 1191 hci_dev_lock(hdev); 1192 1193 if (hci_dev_test_flag(hdev, HCI_MGMT)) 1194 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status); 1195 1196 if (rp->status) 1197 goto unlock; 1198 1199 cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY); 1200 if (!cp) 1201 goto unlock; 1202 1203 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr); 1204 if (conn) 1205 conn->pin_length = cp->pin_len; 1206 1207 unlock: 1208 hci_dev_unlock(hdev); 1209 return rp->status; 1210 } 1211 1212 static u8 hci_cc_pin_code_neg_reply(struct hci_dev *hdev, void *data, 1213 struct sk_buff *skb) 1214 { 1215 struct hci_rp_pin_code_neg_reply *rp = data; 1216 1217 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 1218 1219 hci_dev_lock(hdev); 1220 1221 if (hci_dev_test_flag(hdev, HCI_MGMT)) 1222 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr, 1223 rp->status); 1224 1225 hci_dev_unlock(hdev); 1226 1227 return rp->status; 1228 } 1229 1230 static u8 hci_cc_le_read_buffer_size(struct hci_dev *hdev, void *data, 1231 struct sk_buff *skb) 1232 { 1233 struct hci_rp_le_read_buffer_size *rp = data; 1234 1235 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 1236 1237 if (rp->status) 1238 return rp->status; 1239 1240 hdev->le_mtu = __le16_to_cpu(rp->le_mtu); 1241 hdev->le_pkts = rp->le_max_pkt; 1242 1243 hdev->le_cnt = hdev->le_pkts; 1244 1245 BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts); 1246 1247 if (hdev->le_mtu && hdev->le_mtu < HCI_MIN_LE_MTU) 1248 return HCI_ERROR_INVALID_PARAMETERS; 1249 1250 return rp->status; 1251 } 1252 1253 static u8 hci_cc_le_read_local_features(struct hci_dev *hdev, void *data, 1254 struct sk_buff *skb) 1255 { 1256 struct hci_rp_le_read_local_features *rp = data; 1257 1258 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status); 1259 1260 if (rp->status) 1261 return rp->status; 1262 1263 memcpy(hdev->le_features, rp->features, 8); 1264 1265 return rp->status; 1266 } 1267 1268 static u8 hci_cc_le_read_conn_interval(struct hci_dev *hdev, void *data, 1269 struct sk_buff *skb) 1270 { 1271 struct hci_rp_le_read_conn_interval *rp = data; 1272 1273 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 1274 1275 if (rp->status) 1276 return rp->status; 1277 1278 if (skb->len < flex_array_size(rp, grps, rp->num_grps)) { 1279 bt_dev_err(hdev, "Invalid response length for 0x%4.4x", 1280 HCI_OP_LE_READ_CONN_INTERVAL); 1281 return HCI_ERROR_UNSPECIFIED; 1282 } 1283 1284 /* Store the minimum supported connection interval so the default rate 1285 * parameters can be clamped to it. It is reported on its own rather 1286 * than derived from the groups, as there may be none. 1287 */ 1288 hdev->le_min_rate_interval = rp->min; 1289 1290 return rp->status; 1291 } 1292 1293 static u8 hci_cc_le_read_adv_tx_power(struct hci_dev *hdev, void *data, 1294 struct sk_buff *skb) 1295 { 1296 struct hci_rp_le_read_adv_tx_power *rp = data; 1297 1298 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 1299 1300 if (rp->status) 1301 return rp->status; 1302 1303 hdev->adv_tx_power = rp->tx_power; 1304 1305 return rp->status; 1306 } 1307 1308 static u8 hci_cc_user_confirm_reply(struct hci_dev *hdev, void *data, 1309 struct sk_buff *skb) 1310 { 1311 struct hci_rp_user_confirm_reply *rp = data; 1312 1313 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 1314 1315 hci_dev_lock(hdev); 1316 1317 if (hci_dev_test_flag(hdev, HCI_MGMT)) 1318 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0, 1319 rp->status); 1320 1321 hci_dev_unlock(hdev); 1322 1323 return rp->status; 1324 } 1325 1326 static u8 hci_cc_user_confirm_neg_reply(struct hci_dev *hdev, void *data, 1327 struct sk_buff *skb) 1328 { 1329 struct hci_rp_user_confirm_reply *rp = data; 1330 1331 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 1332 1333 hci_dev_lock(hdev); 1334 1335 if (hci_dev_test_flag(hdev, HCI_MGMT)) 1336 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr, 1337 ACL_LINK, 0, rp->status); 1338 1339 hci_dev_unlock(hdev); 1340 1341 return rp->status; 1342 } 1343 1344 static u8 hci_cc_user_passkey_reply(struct hci_dev *hdev, void *data, 1345 struct sk_buff *skb) 1346 { 1347 struct hci_rp_user_confirm_reply *rp = data; 1348 1349 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 1350 1351 hci_dev_lock(hdev); 1352 1353 if (hci_dev_test_flag(hdev, HCI_MGMT)) 1354 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 1355 0, rp->status); 1356 1357 hci_dev_unlock(hdev); 1358 1359 return rp->status; 1360 } 1361 1362 static u8 hci_cc_user_passkey_neg_reply(struct hci_dev *hdev, void *data, 1363 struct sk_buff *skb) 1364 { 1365 struct hci_rp_user_confirm_reply *rp = data; 1366 1367 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 1368 1369 hci_dev_lock(hdev); 1370 1371 if (hci_dev_test_flag(hdev, HCI_MGMT)) 1372 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr, 1373 ACL_LINK, 0, rp->status); 1374 1375 hci_dev_unlock(hdev); 1376 1377 return rp->status; 1378 } 1379 1380 static u8 hci_cc_read_local_oob_data(struct hci_dev *hdev, void *data, 1381 struct sk_buff *skb) 1382 { 1383 struct hci_rp_read_local_oob_data *rp = data; 1384 1385 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 1386 1387 return rp->status; 1388 } 1389 1390 static u8 hci_cc_read_local_oob_ext_data(struct hci_dev *hdev, void *data, 1391 struct sk_buff *skb) 1392 { 1393 struct hci_rp_read_local_oob_ext_data *rp = data; 1394 1395 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 1396 1397 return rp->status; 1398 } 1399 1400 static u8 hci_cc_le_set_random_addr(struct hci_dev *hdev, void *data, 1401 struct sk_buff *skb) 1402 { 1403 struct hci_ev_status *rp = data; 1404 bdaddr_t *sent; 1405 1406 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 1407 1408 if (rp->status) 1409 return rp->status; 1410 1411 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_RANDOM_ADDR); 1412 if (!sent) 1413 return rp->status; 1414 1415 hci_dev_lock(hdev); 1416 1417 bacpy(&hdev->random_addr, sent); 1418 1419 if (!bacmp(&hdev->rpa, sent)) { 1420 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED); 1421 queue_delayed_work(hdev->workqueue, &hdev->rpa_expired, 1422 secs_to_jiffies(hdev->rpa_timeout)); 1423 } 1424 1425 hci_dev_unlock(hdev); 1426 1427 return rp->status; 1428 } 1429 1430 static u8 hci_cc_le_set_default_phy(struct hci_dev *hdev, void *data, 1431 struct sk_buff *skb) 1432 { 1433 struct hci_ev_status *rp = data; 1434 struct hci_cp_le_set_default_phy *cp; 1435 1436 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 1437 1438 if (rp->status) 1439 return rp->status; 1440 1441 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_DEFAULT_PHY); 1442 if (!cp) 1443 return rp->status; 1444 1445 hci_dev_lock(hdev); 1446 1447 hdev->le_tx_def_phys = cp->tx_phys; 1448 hdev->le_rx_def_phys = cp->rx_phys; 1449 1450 hci_dev_unlock(hdev); 1451 1452 return rp->status; 1453 } 1454 1455 static u8 hci_cc_le_set_adv_set_random_addr(struct hci_dev *hdev, void *data, 1456 struct sk_buff *skb) 1457 { 1458 struct hci_ev_status *rp = data; 1459 struct hci_cp_le_set_adv_set_rand_addr *cp; 1460 struct adv_info *adv; 1461 1462 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 1463 1464 if (rp->status) 1465 return rp->status; 1466 1467 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_SET_RAND_ADDR); 1468 /* Update only in case the adv instance since handle 0x00 shall be using 1469 * HCI_OP_LE_SET_RANDOM_ADDR since that allows both extended and 1470 * non-extended adverting. 1471 */ 1472 if (!cp || !cp->handle) 1473 return rp->status; 1474 1475 hci_dev_lock(hdev); 1476 1477 adv = hci_find_adv_instance(hdev, cp->handle); 1478 if (adv) { 1479 bacpy(&adv->random_addr, &cp->bdaddr); 1480 if (!bacmp(&hdev->rpa, &cp->bdaddr)) { 1481 adv->rpa_expired = false; 1482 queue_delayed_work(hdev->workqueue, 1483 &adv->rpa_expired_cb, 1484 secs_to_jiffies(hdev->rpa_timeout)); 1485 } 1486 } 1487 1488 hci_dev_unlock(hdev); 1489 1490 return rp->status; 1491 } 1492 1493 static u8 hci_cc_le_remove_adv_set(struct hci_dev *hdev, void *data, 1494 struct sk_buff *skb) 1495 { 1496 struct hci_ev_status *rp = data; 1497 u8 *instance; 1498 int err; 1499 1500 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 1501 1502 if (rp->status) 1503 return rp->status; 1504 1505 instance = hci_sent_cmd_data(hdev, HCI_OP_LE_REMOVE_ADV_SET); 1506 if (!instance) 1507 return rp->status; 1508 1509 hci_dev_lock(hdev); 1510 1511 err = hci_remove_adv_instance(hdev, *instance); 1512 if (!err) 1513 mgmt_advertising_removed(hci_skb_sk(hdev->sent_cmd), hdev, 1514 *instance); 1515 1516 hci_dev_unlock(hdev); 1517 1518 return rp->status; 1519 } 1520 1521 static u8 hci_cc_le_clear_adv_sets(struct hci_dev *hdev, void *data, 1522 struct sk_buff *skb) 1523 { 1524 struct hci_ev_status *rp = data; 1525 struct adv_info *adv, *n; 1526 int err; 1527 1528 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 1529 1530 if (rp->status) 1531 return rp->status; 1532 1533 if (!hci_sent_cmd_data(hdev, HCI_OP_LE_CLEAR_ADV_SETS)) 1534 return rp->status; 1535 1536 hci_dev_lock(hdev); 1537 1538 list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) { 1539 u8 instance = adv->instance; 1540 1541 err = hci_remove_adv_instance(hdev, instance); 1542 if (!err) 1543 mgmt_advertising_removed(hci_skb_sk(hdev->sent_cmd), 1544 hdev, instance); 1545 } 1546 1547 hci_dev_unlock(hdev); 1548 1549 return rp->status; 1550 } 1551 1552 static u8 hci_cc_le_read_transmit_power(struct hci_dev *hdev, void *data, 1553 struct sk_buff *skb) 1554 { 1555 struct hci_rp_le_read_transmit_power *rp = data; 1556 1557 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 1558 1559 if (rp->status) 1560 return rp->status; 1561 1562 hdev->min_le_tx_power = rp->min_le_tx_power; 1563 hdev->max_le_tx_power = rp->max_le_tx_power; 1564 1565 return rp->status; 1566 } 1567 1568 static u8 hci_cc_le_set_privacy_mode(struct hci_dev *hdev, void *data, 1569 struct sk_buff *skb) 1570 { 1571 struct hci_ev_status *rp = data; 1572 struct hci_cp_le_set_privacy_mode *cp; 1573 struct hci_conn_params *params; 1574 1575 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 1576 1577 if (rp->status) 1578 return rp->status; 1579 1580 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_PRIVACY_MODE); 1581 if (!cp) 1582 return rp->status; 1583 1584 hci_dev_lock(hdev); 1585 1586 params = hci_conn_params_lookup(hdev, &cp->bdaddr, cp->bdaddr_type); 1587 if (params) 1588 WRITE_ONCE(params->privacy_mode, cp->mode); 1589 1590 hci_dev_unlock(hdev); 1591 1592 return rp->status; 1593 } 1594 1595 static u8 hci_cc_le_set_adv_enable(struct hci_dev *hdev, void *data, 1596 struct sk_buff *skb) 1597 { 1598 struct hci_ev_status *rp = data; 1599 __u8 *sent; 1600 1601 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 1602 1603 if (rp->status) 1604 return rp->status; 1605 1606 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_ENABLE); 1607 if (!sent) 1608 return rp->status; 1609 1610 hci_dev_lock(hdev); 1611 1612 /* If we're doing connection initiation as peripheral. Set a 1613 * timeout in case something goes wrong. 1614 */ 1615 if (*sent) { 1616 struct hci_conn *conn; 1617 1618 hci_dev_set_flag(hdev, HCI_LE_ADV); 1619 1620 conn = hci_lookup_le_connect(hdev); 1621 if (conn) 1622 queue_delayed_work(hdev->workqueue, 1623 &conn->le_conn_timeout, 1624 conn->conn_timeout); 1625 } else { 1626 hci_dev_clear_flag(hdev, HCI_LE_ADV); 1627 } 1628 1629 hci_dev_unlock(hdev); 1630 1631 return rp->status; 1632 } 1633 1634 /* Update the enabled state of the instance(s) using the advertising set 1635 * identified by handle. 1636 * 1637 * Instances may share handle 0x00 with instance 0 (Global Advertising), e.g. 1638 * when the controller supports a single advertising set, in which case the 1639 * set is owned by the instance last enabled (hdev->cur_adv_instance) and any 1640 * other instance sharing it shall be considered disabled. 1641 */ 1642 static void hci_le_ext_adv_set_enabled(struct hci_dev *hdev, u8 handle, 1643 bool enable) 1644 { 1645 struct adv_info *adv; 1646 bool owned = false; 1647 1648 list_for_each_entry(adv, &hdev->adv_instances, list) { 1649 if (adv->handle != handle) 1650 continue; 1651 1652 adv->enabled = enable && 1653 (handle || 1654 adv->instance == hdev->cur_adv_instance); 1655 owned |= adv->enabled; 1656 } 1657 1658 if (handle) 1659 return; 1660 1661 if (enable && !owned) 1662 hci_dev_set_flag(hdev, HCI_LE_ADV_0); 1663 else 1664 hci_dev_clear_flag(hdev, HCI_LE_ADV_0); 1665 } 1666 1667 static u8 hci_cc_le_set_ext_adv_enable(struct hci_dev *hdev, void *data, 1668 struct sk_buff *skb) 1669 { 1670 struct hci_cp_le_set_ext_adv_enable *cp; 1671 struct hci_cp_ext_adv_set *set; 1672 struct adv_info *adv = NULL, *n; 1673 struct hci_ev_status *rp = data; 1674 1675 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 1676 1677 if (rp->status) 1678 return rp->status; 1679 1680 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE); 1681 if (!cp) 1682 return rp->status; 1683 1684 set = (void *)cp->data; 1685 1686 hci_dev_lock(hdev); 1687 1688 if (cp->enable) { 1689 struct hci_conn *conn; 1690 1691 hci_dev_set_flag(hdev, HCI_LE_ADV); 1692 1693 if (cp->num_of_sets) 1694 hci_le_ext_adv_set_enabled(hdev, set->handle, true); 1695 1696 conn = hci_lookup_le_connect(hdev); 1697 if (conn) 1698 queue_delayed_work(hdev->workqueue, 1699 &conn->le_conn_timeout, 1700 conn->conn_timeout); 1701 } else { 1702 if (cp->num_of_sets) { 1703 hci_le_ext_adv_set_enabled(hdev, set->handle, false); 1704 1705 /* If just one instance was disabled check if there are 1706 * any other instance enabled, including instance 0, 1707 * before clearing HCI_LE_ADV 1708 */ 1709 if (hci_dev_test_flag(hdev, HCI_LE_ADV_0)) 1710 goto unlock; 1711 1712 list_for_each_entry_safe(adv, n, &hdev->adv_instances, 1713 list) { 1714 if (adv->enabled) 1715 goto unlock; 1716 } 1717 } else { 1718 /* All instances shall be considered disabled, except 1719 * instance 0 whose state is preserved so it can be 1720 * re-enabled by hci_resume_advertising_sync. 1721 */ 1722 list_for_each_entry_safe(adv, n, &hdev->adv_instances, 1723 list) 1724 adv->enabled = false; 1725 } 1726 1727 hci_dev_clear_flag(hdev, HCI_LE_ADV); 1728 } 1729 1730 unlock: 1731 hci_dev_unlock(hdev); 1732 return rp->status; 1733 } 1734 1735 static u8 hci_cc_le_set_scan_param(struct hci_dev *hdev, void *data, 1736 struct sk_buff *skb) 1737 { 1738 struct hci_cp_le_set_scan_param *cp; 1739 struct hci_ev_status *rp = data; 1740 1741 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 1742 1743 if (rp->status) 1744 return rp->status; 1745 1746 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_PARAM); 1747 if (!cp) 1748 return rp->status; 1749 1750 hci_dev_lock(hdev); 1751 1752 hdev->le_scan_type = cp->type; 1753 1754 hci_dev_unlock(hdev); 1755 1756 return rp->status; 1757 } 1758 1759 static u8 hci_cc_le_set_ext_scan_param(struct hci_dev *hdev, void *data, 1760 struct sk_buff *skb) 1761 { 1762 struct hci_cp_le_set_ext_scan_params *cp; 1763 struct hci_ev_status *rp = data; 1764 struct hci_cp_le_scan_phy_params *phy_param; 1765 1766 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 1767 1768 if (rp->status) 1769 return rp->status; 1770 1771 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_SCAN_PARAMS); 1772 if (!cp) 1773 return rp->status; 1774 1775 phy_param = (void *)cp->data; 1776 1777 hci_dev_lock(hdev); 1778 1779 hdev->le_scan_type = phy_param->type; 1780 1781 hci_dev_unlock(hdev); 1782 1783 return rp->status; 1784 } 1785 1786 static bool has_pending_adv_report(struct hci_dev *hdev) 1787 { 1788 struct discovery_state *d = &hdev->discovery; 1789 1790 return bacmp(&d->last_adv_addr, BDADDR_ANY); 1791 } 1792 1793 static void clear_pending_adv_report(struct hci_dev *hdev) 1794 { 1795 struct discovery_state *d = &hdev->discovery; 1796 1797 bacpy(&d->last_adv_addr, BDADDR_ANY); 1798 d->last_adv_data_len = 0; 1799 } 1800 1801 static void store_pending_adv_report(struct hci_dev *hdev, bdaddr_t *bdaddr, 1802 u8 bdaddr_type, s8 rssi, u32 flags, 1803 u8 *data, u8 len) 1804 { 1805 struct discovery_state *d = &hdev->discovery; 1806 1807 if (len > max_adv_len(hdev)) 1808 return; 1809 1810 bacpy(&d->last_adv_addr, bdaddr); 1811 d->last_adv_addr_type = bdaddr_type; 1812 d->last_adv_rssi = rssi; 1813 d->last_adv_flags = flags; 1814 memcpy(d->last_adv_data, data, len); 1815 d->last_adv_data_len = len; 1816 } 1817 1818 static void le_set_scan_enable_complete(struct hci_dev *hdev, u8 enable) 1819 { 1820 hci_dev_lock(hdev); 1821 1822 switch (enable) { 1823 case LE_SCAN_ENABLE: 1824 hci_dev_set_flag(hdev, HCI_LE_SCAN); 1825 if (hdev->le_scan_type == LE_SCAN_ACTIVE) { 1826 clear_pending_adv_report(hdev); 1827 hci_discovery_set_state(hdev, DISCOVERY_FINDING); 1828 } 1829 break; 1830 1831 case LE_SCAN_DISABLE: 1832 /* We do this here instead of when setting DISCOVERY_STOPPED 1833 * since the latter would potentially require waiting for 1834 * inquiry to stop too. 1835 */ 1836 if (has_pending_adv_report(hdev)) { 1837 struct discovery_state *d = &hdev->discovery; 1838 1839 mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK, 1840 d->last_adv_addr_type, NULL, 1841 d->last_adv_rssi, d->last_adv_flags, 1842 d->last_adv_data, 1843 d->last_adv_data_len, NULL, 0, 0); 1844 } 1845 1846 /* Cancel this timer so that we don't try to disable scanning 1847 * when it's already disabled. 1848 */ 1849 cancel_delayed_work(&hdev->le_scan_disable); 1850 1851 hci_dev_clear_flag(hdev, HCI_LE_SCAN); 1852 1853 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED && 1854 hci_test_quirk(hdev, HCI_QUIRK_SIMULTANEOUS_DISCOVERY) && 1855 !test_bit(HCI_INQUIRY, &hdev->flags) && 1856 hdev->discovery.state == DISCOVERY_FINDING) { 1857 hci_discovery_set_state(hdev, DISCOVERY_STOPPED); 1858 } 1859 1860 /* The HCI_LE_SCAN_INTERRUPTED flag indicates that we 1861 * interrupted scanning due to a connect request. Mark 1862 * therefore discovery as stopped. 1863 */ 1864 if (hci_dev_test_and_clear_flag(hdev, HCI_LE_SCAN_INTERRUPTED)) 1865 hci_discovery_set_state(hdev, DISCOVERY_STOPPED); 1866 else if (!hci_dev_test_flag(hdev, HCI_LE_ADV) && 1867 hdev->discovery.state == DISCOVERY_FINDING) 1868 queue_work(hdev->workqueue, &hdev->reenable_adv_work); 1869 1870 break; 1871 1872 default: 1873 bt_dev_err(hdev, "use of reserved LE_Scan_Enable param %d", 1874 enable); 1875 break; 1876 } 1877 1878 hci_dev_unlock(hdev); 1879 } 1880 1881 static u8 hci_cc_le_set_scan_enable(struct hci_dev *hdev, void *data, 1882 struct sk_buff *skb) 1883 { 1884 struct hci_cp_le_set_scan_enable *cp; 1885 struct hci_ev_status *rp = data; 1886 1887 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 1888 1889 if (rp->status) 1890 return rp->status; 1891 1892 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE); 1893 if (!cp) 1894 return rp->status; 1895 1896 le_set_scan_enable_complete(hdev, cp->enable); 1897 1898 return rp->status; 1899 } 1900 1901 static u8 hci_cc_le_set_ext_scan_enable(struct hci_dev *hdev, void *data, 1902 struct sk_buff *skb) 1903 { 1904 struct hci_cp_le_set_ext_scan_enable *cp; 1905 struct hci_ev_status *rp = data; 1906 1907 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 1908 1909 if (rp->status) 1910 return rp->status; 1911 1912 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_SCAN_ENABLE); 1913 if (!cp) 1914 return rp->status; 1915 1916 le_set_scan_enable_complete(hdev, cp->enable); 1917 1918 return rp->status; 1919 } 1920 1921 static u8 hci_cc_le_read_num_adv_sets(struct hci_dev *hdev, void *data, 1922 struct sk_buff *skb) 1923 { 1924 struct hci_rp_le_read_num_supported_adv_sets *rp = data; 1925 1926 bt_dev_dbg(hdev, "status 0x%2.2x No of Adv sets %u", rp->status, 1927 rp->num_of_sets); 1928 1929 if (rp->status) 1930 return rp->status; 1931 1932 hdev->le_num_of_adv_sets = rp->num_of_sets; 1933 1934 return rp->status; 1935 } 1936 1937 static u8 hci_cc_le_read_accept_list_size(struct hci_dev *hdev, void *data, 1938 struct sk_buff *skb) 1939 { 1940 struct hci_rp_le_read_accept_list_size *rp = data; 1941 1942 bt_dev_dbg(hdev, "status 0x%2.2x size %u", rp->status, rp->size); 1943 1944 if (rp->status) 1945 return rp->status; 1946 1947 hdev->le_accept_list_size = rp->size; 1948 1949 return rp->status; 1950 } 1951 1952 static u8 hci_cc_le_clear_accept_list(struct hci_dev *hdev, void *data, 1953 struct sk_buff *skb) 1954 { 1955 struct hci_ev_status *rp = data; 1956 1957 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 1958 1959 if (rp->status) 1960 return rp->status; 1961 1962 hci_dev_lock(hdev); 1963 hci_bdaddr_list_clear(&hdev->le_accept_list); 1964 hci_dev_unlock(hdev); 1965 1966 return rp->status; 1967 } 1968 1969 static u8 hci_cc_le_add_to_accept_list(struct hci_dev *hdev, void *data, 1970 struct sk_buff *skb) 1971 { 1972 struct hci_cp_le_add_to_accept_list *sent; 1973 struct hci_ev_status *rp = data; 1974 1975 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 1976 1977 if (rp->status) 1978 return rp->status; 1979 1980 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_ACCEPT_LIST); 1981 if (!sent) 1982 return rp->status; 1983 1984 hci_dev_lock(hdev); 1985 hci_bdaddr_list_add(&hdev->le_accept_list, &sent->bdaddr, 1986 sent->bdaddr_type); 1987 hci_dev_unlock(hdev); 1988 1989 return rp->status; 1990 } 1991 1992 static u8 hci_cc_le_del_from_accept_list(struct hci_dev *hdev, void *data, 1993 struct sk_buff *skb) 1994 { 1995 struct hci_cp_le_del_from_accept_list *sent; 1996 struct hci_ev_status *rp = data; 1997 1998 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 1999 2000 if (rp->status) 2001 return rp->status; 2002 2003 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_ACCEPT_LIST); 2004 if (!sent) 2005 return rp->status; 2006 2007 hci_dev_lock(hdev); 2008 hci_bdaddr_list_del(&hdev->le_accept_list, &sent->bdaddr, 2009 sent->bdaddr_type); 2010 hci_dev_unlock(hdev); 2011 2012 return rp->status; 2013 } 2014 2015 static u8 hci_cc_le_read_supported_states(struct hci_dev *hdev, void *data, 2016 struct sk_buff *skb) 2017 { 2018 struct hci_rp_le_read_supported_states *rp = data; 2019 2020 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 2021 2022 if (rp->status) 2023 return rp->status; 2024 2025 memcpy(hdev->le_states, rp->le_states, 8); 2026 2027 return rp->status; 2028 } 2029 2030 static u8 hci_cc_le_read_def_data_len(struct hci_dev *hdev, void *data, 2031 struct sk_buff *skb) 2032 { 2033 struct hci_rp_le_read_def_data_len *rp = data; 2034 2035 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 2036 2037 if (rp->status) 2038 return rp->status; 2039 2040 hdev->le_def_tx_len = le16_to_cpu(rp->tx_len); 2041 hdev->le_def_tx_time = le16_to_cpu(rp->tx_time); 2042 2043 return rp->status; 2044 } 2045 2046 static u8 hci_cc_le_write_def_data_len(struct hci_dev *hdev, void *data, 2047 struct sk_buff *skb) 2048 { 2049 struct hci_cp_le_write_def_data_len *sent; 2050 struct hci_ev_status *rp = data; 2051 2052 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 2053 2054 if (rp->status) 2055 return rp->status; 2056 2057 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_WRITE_DEF_DATA_LEN); 2058 if (!sent) 2059 return rp->status; 2060 2061 hdev->le_def_tx_len = le16_to_cpu(sent->tx_len); 2062 hdev->le_def_tx_time = le16_to_cpu(sent->tx_time); 2063 2064 return rp->status; 2065 } 2066 2067 static u8 hci_cc_le_add_to_resolv_list(struct hci_dev *hdev, void *data, 2068 struct sk_buff *skb) 2069 { 2070 struct hci_cp_le_add_to_resolv_list *sent; 2071 struct hci_ev_status *rp = data; 2072 2073 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 2074 2075 if (rp->status) 2076 return rp->status; 2077 2078 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_RESOLV_LIST); 2079 if (!sent) 2080 return rp->status; 2081 2082 hci_dev_lock(hdev); 2083 hci_bdaddr_list_add_with_irk(&hdev->le_resolv_list, &sent->bdaddr, 2084 sent->bdaddr_type, sent->peer_irk, 2085 sent->local_irk); 2086 hci_dev_unlock(hdev); 2087 2088 return rp->status; 2089 } 2090 2091 static u8 hci_cc_le_del_from_resolv_list(struct hci_dev *hdev, void *data, 2092 struct sk_buff *skb) 2093 { 2094 struct hci_cp_le_del_from_resolv_list *sent; 2095 struct hci_ev_status *rp = data; 2096 2097 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 2098 2099 if (rp->status) 2100 return rp->status; 2101 2102 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_RESOLV_LIST); 2103 if (!sent) 2104 return rp->status; 2105 2106 hci_dev_lock(hdev); 2107 hci_bdaddr_list_del_with_irk(&hdev->le_resolv_list, &sent->bdaddr, 2108 sent->bdaddr_type); 2109 hci_dev_unlock(hdev); 2110 2111 return rp->status; 2112 } 2113 2114 static u8 hci_cc_le_clear_resolv_list(struct hci_dev *hdev, void *data, 2115 struct sk_buff *skb) 2116 { 2117 struct hci_ev_status *rp = data; 2118 2119 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 2120 2121 if (rp->status) 2122 return rp->status; 2123 2124 hci_dev_lock(hdev); 2125 hci_bdaddr_list_clear(&hdev->le_resolv_list); 2126 hci_dev_unlock(hdev); 2127 2128 return rp->status; 2129 } 2130 2131 static u8 hci_cc_le_read_resolv_list_size(struct hci_dev *hdev, void *data, 2132 struct sk_buff *skb) 2133 { 2134 struct hci_rp_le_read_resolv_list_size *rp = data; 2135 2136 bt_dev_dbg(hdev, "status 0x%2.2x size %u", rp->status, rp->size); 2137 2138 if (rp->status) 2139 return rp->status; 2140 2141 hdev->le_resolv_list_size = rp->size; 2142 2143 return rp->status; 2144 } 2145 2146 static u8 hci_cc_le_set_addr_resolution_enable(struct hci_dev *hdev, void *data, 2147 struct sk_buff *skb) 2148 { 2149 struct hci_ev_status *rp = data; 2150 __u8 *sent; 2151 2152 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 2153 2154 if (rp->status) 2155 return rp->status; 2156 2157 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADDR_RESOLV_ENABLE); 2158 if (!sent) 2159 return rp->status; 2160 2161 hci_dev_lock(hdev); 2162 2163 if (*sent) 2164 hci_dev_set_flag(hdev, HCI_LL_RPA_RESOLUTION); 2165 else 2166 hci_dev_clear_flag(hdev, HCI_LL_RPA_RESOLUTION); 2167 2168 hci_dev_unlock(hdev); 2169 2170 return rp->status; 2171 } 2172 2173 static u8 hci_cc_le_read_max_data_len(struct hci_dev *hdev, void *data, 2174 struct sk_buff *skb) 2175 { 2176 struct hci_rp_le_read_max_data_len *rp = data; 2177 2178 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 2179 2180 if (rp->status) 2181 return rp->status; 2182 2183 hdev->le_max_tx_len = le16_to_cpu(rp->tx_len); 2184 hdev->le_max_tx_time = le16_to_cpu(rp->tx_time); 2185 hdev->le_max_rx_len = le16_to_cpu(rp->rx_len); 2186 hdev->le_max_rx_time = le16_to_cpu(rp->rx_time); 2187 2188 return rp->status; 2189 } 2190 2191 static u8 hci_cc_write_le_host_supported(struct hci_dev *hdev, void *data, 2192 struct sk_buff *skb) 2193 { 2194 struct hci_cp_write_le_host_supported *sent; 2195 struct hci_ev_status *rp = data; 2196 2197 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 2198 2199 if (rp->status) 2200 return rp->status; 2201 2202 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED); 2203 if (!sent) 2204 return rp->status; 2205 2206 hci_dev_lock(hdev); 2207 2208 if (sent->le) { 2209 hdev->features[1][0] |= LMP_HOST_LE; 2210 hci_dev_set_flag(hdev, HCI_LE_ENABLED); 2211 } else { 2212 hdev->features[1][0] &= ~LMP_HOST_LE; 2213 hci_dev_clear_flag(hdev, HCI_LE_ENABLED); 2214 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 2215 } 2216 2217 if (sent->simul) 2218 hdev->features[1][0] |= LMP_HOST_LE_BREDR; 2219 else 2220 hdev->features[1][0] &= ~LMP_HOST_LE_BREDR; 2221 2222 hci_dev_unlock(hdev); 2223 2224 return rp->status; 2225 } 2226 2227 static u8 hci_cc_set_adv_param(struct hci_dev *hdev, void *data, 2228 struct sk_buff *skb) 2229 { 2230 struct hci_cp_le_set_adv_param *cp; 2231 struct hci_ev_status *rp = data; 2232 2233 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 2234 2235 if (rp->status) 2236 return rp->status; 2237 2238 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_PARAM); 2239 if (!cp) 2240 return rp->status; 2241 2242 hci_dev_lock(hdev); 2243 hdev->adv_addr_type = cp->own_address_type; 2244 hci_dev_unlock(hdev); 2245 2246 return rp->status; 2247 } 2248 2249 static u8 hci_cc_read_rssi(struct hci_dev *hdev, void *data, 2250 struct sk_buff *skb) 2251 { 2252 struct hci_rp_read_rssi *rp = data; 2253 struct hci_conn *conn; 2254 2255 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 2256 2257 if (rp->status) 2258 return rp->status; 2259 2260 hci_dev_lock(hdev); 2261 2262 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle)); 2263 if (conn) 2264 conn->rssi = rp->rssi; 2265 2266 hci_dev_unlock(hdev); 2267 2268 return rp->status; 2269 } 2270 2271 static u8 hci_cc_read_tx_power(struct hci_dev *hdev, void *data, 2272 struct sk_buff *skb) 2273 { 2274 struct hci_cp_read_tx_power *sent; 2275 struct hci_rp_read_tx_power *rp = data; 2276 struct hci_conn *conn; 2277 2278 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 2279 2280 if (rp->status) 2281 return rp->status; 2282 2283 sent = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER); 2284 if (!sent) 2285 return rp->status; 2286 2287 hci_dev_lock(hdev); 2288 2289 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle)); 2290 if (!conn) 2291 goto unlock; 2292 2293 switch (sent->type) { 2294 case 0x00: 2295 conn->tx_power = rp->tx_power; 2296 break; 2297 case 0x01: 2298 conn->max_tx_power = rp->tx_power; 2299 break; 2300 } 2301 2302 unlock: 2303 hci_dev_unlock(hdev); 2304 return rp->status; 2305 } 2306 2307 static u8 hci_cc_write_ssp_debug_mode(struct hci_dev *hdev, void *data, 2308 struct sk_buff *skb) 2309 { 2310 struct hci_ev_status *rp = data; 2311 u8 *mode; 2312 2313 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 2314 2315 if (rp->status) 2316 return rp->status; 2317 2318 mode = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE); 2319 if (mode) 2320 hdev->ssp_debug_mode = *mode; 2321 2322 return rp->status; 2323 } 2324 2325 static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status) 2326 { 2327 bt_dev_dbg(hdev, "status 0x%2.2x", status); 2328 2329 if (status) 2330 return; 2331 2332 if (hci_sent_cmd_data(hdev, HCI_OP_INQUIRY)) 2333 set_bit(HCI_INQUIRY, &hdev->flags); 2334 } 2335 2336 static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status) 2337 { 2338 struct hci_cp_create_conn *cp; 2339 struct hci_conn *conn; 2340 2341 bt_dev_dbg(hdev, "status 0x%2.2x", status); 2342 2343 cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN); 2344 if (!cp) 2345 return; 2346 2347 hci_dev_lock(hdev); 2348 2349 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr); 2350 2351 bt_dev_dbg(hdev, "bdaddr %pMR hcon %p", &cp->bdaddr, conn); 2352 2353 if (status) { 2354 if (conn && conn->state == BT_CONNECT) { 2355 conn->state = BT_CLOSED; 2356 hci_connect_cfm(conn, status); 2357 hci_conn_del(conn); 2358 } 2359 } else { 2360 if (!conn) { 2361 conn = hci_conn_add_unset(hdev, ACL_LINK, &cp->bdaddr, 2362 0, HCI_ROLE_MASTER); 2363 if (IS_ERR(conn)) 2364 bt_dev_err(hdev, "connection err: %ld", PTR_ERR(conn)); 2365 } 2366 } 2367 2368 hci_dev_unlock(hdev); 2369 } 2370 2371 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status) 2372 { 2373 struct hci_cp_add_sco *cp; 2374 struct hci_conn *acl; 2375 struct hci_link *link; 2376 __u16 handle; 2377 2378 bt_dev_dbg(hdev, "status 0x%2.2x", status); 2379 2380 if (!status) 2381 return; 2382 2383 cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO); 2384 if (!cp) 2385 return; 2386 2387 handle = __le16_to_cpu(cp->handle); 2388 2389 bt_dev_dbg(hdev, "handle 0x%4.4x", handle); 2390 2391 hci_dev_lock(hdev); 2392 2393 acl = hci_conn_hash_lookup_handle(hdev, handle); 2394 if (acl) { 2395 link = list_first_entry_or_null(&acl->link_list, 2396 struct hci_link, list); 2397 if (link && link->conn) { 2398 link->conn->state = BT_CLOSED; 2399 2400 hci_connect_cfm(link->conn, status); 2401 hci_conn_del(link->conn); 2402 } 2403 } 2404 2405 hci_dev_unlock(hdev); 2406 } 2407 2408 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status) 2409 { 2410 struct hci_cp_auth_requested *cp; 2411 struct hci_conn *conn; 2412 2413 bt_dev_dbg(hdev, "status 0x%2.2x", status); 2414 2415 if (!status) 2416 return; 2417 2418 cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED); 2419 if (!cp) 2420 return; 2421 2422 hci_dev_lock(hdev); 2423 2424 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle)); 2425 if (conn) { 2426 if (conn->state == BT_CONFIG) { 2427 hci_connect_cfm(conn, status); 2428 hci_conn_drop(conn); 2429 } 2430 } 2431 2432 hci_dev_unlock(hdev); 2433 } 2434 2435 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status) 2436 { 2437 struct hci_cp_set_conn_encrypt *cp; 2438 struct hci_conn *conn; 2439 2440 bt_dev_dbg(hdev, "status 0x%2.2x", status); 2441 2442 if (!status) 2443 return; 2444 2445 cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT); 2446 if (!cp) 2447 return; 2448 2449 hci_dev_lock(hdev); 2450 2451 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle)); 2452 if (conn) { 2453 if (conn->state == BT_CONFIG) { 2454 hci_connect_cfm(conn, status); 2455 hci_conn_drop(conn); 2456 } 2457 } 2458 2459 hci_dev_unlock(hdev); 2460 } 2461 2462 static int hci_outgoing_auth_needed(struct hci_dev *hdev, 2463 struct hci_conn *conn) 2464 { 2465 if (conn->state != BT_CONFIG || !conn->out) 2466 return 0; 2467 2468 if (conn->pending_sec_level == BT_SECURITY_SDP) 2469 return 0; 2470 2471 /* Only request authentication for SSP connections or non-SSP 2472 * devices with sec_level MEDIUM or HIGH or if MITM protection 2473 * is requested. 2474 */ 2475 if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) && 2476 conn->pending_sec_level != BT_SECURITY_FIPS && 2477 conn->pending_sec_level != BT_SECURITY_HIGH && 2478 conn->pending_sec_level != BT_SECURITY_MEDIUM) 2479 return 0; 2480 2481 return 1; 2482 } 2483 2484 static int hci_resolve_name(struct hci_dev *hdev, 2485 struct inquiry_entry *e) 2486 { 2487 struct hci_cp_remote_name_req cp; 2488 2489 memset(&cp, 0, sizeof(cp)); 2490 2491 bacpy(&cp.bdaddr, &e->data.bdaddr); 2492 cp.pscan_rep_mode = e->data.pscan_rep_mode; 2493 cp.pscan_mode = e->data.pscan_mode; 2494 cp.clock_offset = e->data.clock_offset; 2495 2496 return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp); 2497 } 2498 2499 static bool hci_resolve_next_name(struct hci_dev *hdev) 2500 { 2501 struct discovery_state *discov = &hdev->discovery; 2502 struct inquiry_entry *e; 2503 2504 if (list_empty(&discov->resolve)) 2505 return false; 2506 2507 /* We should stop if we already spent too much time resolving names. */ 2508 if (time_after(jiffies, discov->name_resolve_timeout)) { 2509 bt_dev_warn_ratelimited(hdev, "Name resolve takes too long."); 2510 return false; 2511 } 2512 2513 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED); 2514 if (!e) 2515 return false; 2516 2517 if (hci_resolve_name(hdev, e) == 0) { 2518 e->name_state = NAME_PENDING; 2519 return true; 2520 } 2521 2522 return false; 2523 } 2524 2525 static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn, 2526 bdaddr_t *bdaddr, u8 *name, u8 name_len) 2527 { 2528 struct discovery_state *discov = &hdev->discovery; 2529 struct inquiry_entry *e; 2530 2531 /* Update the mgmt connected state if necessary. Be careful with 2532 * conn objects that exist but are not (yet) connected however. 2533 * Only those in BT_CONFIG or BT_CONNECTED states can be 2534 * considered connected. 2535 */ 2536 if (conn && (conn->state == BT_CONFIG || conn->state == BT_CONNECTED)) 2537 mgmt_device_connected(hdev, conn, name, name_len); 2538 2539 if (discov->state == DISCOVERY_STOPPED) 2540 return; 2541 2542 if (discov->state == DISCOVERY_STOPPING) 2543 goto discov_complete; 2544 2545 if (discov->state != DISCOVERY_RESOLVING) 2546 return; 2547 2548 e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING); 2549 /* If the device was not found in a list of found devices names of which 2550 * are pending. there is no need to continue resolving a next name as it 2551 * will be done upon receiving another Remote Name Request Complete 2552 * Event */ 2553 if (!e) 2554 return; 2555 2556 list_del(&e->list); 2557 2558 e->name_state = name ? NAME_KNOWN : NAME_NOT_KNOWN; 2559 mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00, e->data.rssi, 2560 name, name_len); 2561 2562 if (hci_resolve_next_name(hdev)) 2563 return; 2564 2565 discov_complete: 2566 hci_discovery_set_state(hdev, DISCOVERY_STOPPED); 2567 } 2568 2569 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status) 2570 { 2571 struct hci_cp_remote_name_req *cp; 2572 struct hci_conn *conn; 2573 2574 bt_dev_dbg(hdev, "status 0x%2.2x", status); 2575 2576 /* If successful wait for the name req complete event before 2577 * checking for the need to do authentication */ 2578 if (!status) 2579 return; 2580 2581 cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ); 2582 if (!cp) 2583 return; 2584 2585 hci_dev_lock(hdev); 2586 2587 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr); 2588 2589 if (hci_dev_test_flag(hdev, HCI_MGMT)) 2590 hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0); 2591 2592 if (!conn) 2593 goto unlock; 2594 2595 if (!hci_outgoing_auth_needed(hdev, conn)) 2596 goto unlock; 2597 2598 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) { 2599 struct hci_cp_auth_requested auth_cp; 2600 2601 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags); 2602 2603 auth_cp.handle = __cpu_to_le16(conn->handle); 2604 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, 2605 sizeof(auth_cp), &auth_cp); 2606 } 2607 2608 unlock: 2609 hci_dev_unlock(hdev); 2610 } 2611 2612 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status) 2613 { 2614 struct hci_cp_read_remote_features *cp; 2615 struct hci_conn *conn; 2616 2617 bt_dev_dbg(hdev, "status 0x%2.2x", status); 2618 2619 if (!status) 2620 return; 2621 2622 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES); 2623 if (!cp) 2624 return; 2625 2626 hci_dev_lock(hdev); 2627 2628 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle)); 2629 if (conn) { 2630 if (conn->state == BT_CONFIG) { 2631 hci_connect_cfm(conn, status); 2632 hci_conn_drop(conn); 2633 } 2634 } 2635 2636 hci_dev_unlock(hdev); 2637 } 2638 2639 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status) 2640 { 2641 struct hci_cp_read_remote_ext_features *cp; 2642 struct hci_conn *conn; 2643 2644 bt_dev_dbg(hdev, "status 0x%2.2x", status); 2645 2646 if (!status) 2647 return; 2648 2649 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES); 2650 if (!cp) 2651 return; 2652 2653 hci_dev_lock(hdev); 2654 2655 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle)); 2656 if (conn) { 2657 if (conn->state == BT_CONFIG) { 2658 hci_connect_cfm(conn, status); 2659 hci_conn_drop(conn); 2660 } 2661 } 2662 2663 hci_dev_unlock(hdev); 2664 } 2665 2666 static void hci_setup_sync_conn_status(struct hci_dev *hdev, __u16 handle, 2667 __u8 status) 2668 { 2669 struct hci_conn *acl; 2670 struct hci_link *link; 2671 2672 bt_dev_dbg(hdev, "handle 0x%4.4x status 0x%2.2x", handle, status); 2673 2674 hci_dev_lock(hdev); 2675 2676 acl = hci_conn_hash_lookup_handle(hdev, handle); 2677 if (acl) { 2678 link = list_first_entry_or_null(&acl->link_list, 2679 struct hci_link, list); 2680 if (link && link->conn) { 2681 link->conn->state = BT_CLOSED; 2682 2683 hci_connect_cfm(link->conn, status); 2684 hci_conn_del(link->conn); 2685 } 2686 } 2687 2688 hci_dev_unlock(hdev); 2689 } 2690 2691 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status) 2692 { 2693 struct hci_cp_setup_sync_conn *cp; 2694 2695 bt_dev_dbg(hdev, "status 0x%2.2x", status); 2696 2697 if (!status) 2698 return; 2699 2700 cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN); 2701 if (!cp) 2702 return; 2703 2704 hci_setup_sync_conn_status(hdev, __le16_to_cpu(cp->handle), status); 2705 } 2706 2707 static void hci_cs_enhanced_setup_sync_conn(struct hci_dev *hdev, __u8 status) 2708 { 2709 struct hci_cp_enhanced_setup_sync_conn *cp; 2710 2711 bt_dev_dbg(hdev, "status 0x%2.2x", status); 2712 2713 if (!status) 2714 return; 2715 2716 cp = hci_sent_cmd_data(hdev, HCI_OP_ENHANCED_SETUP_SYNC_CONN); 2717 if (!cp) 2718 return; 2719 2720 hci_setup_sync_conn_status(hdev, __le16_to_cpu(cp->handle), status); 2721 } 2722 2723 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status) 2724 { 2725 struct hci_cp_sniff_mode *cp; 2726 struct hci_conn *conn; 2727 2728 bt_dev_dbg(hdev, "status 0x%2.2x", status); 2729 2730 if (!status) 2731 return; 2732 2733 cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE); 2734 if (!cp) 2735 return; 2736 2737 hci_dev_lock(hdev); 2738 2739 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle)); 2740 if (conn) { 2741 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags); 2742 2743 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags)) 2744 hci_sco_setup(conn, status); 2745 } 2746 2747 hci_dev_unlock(hdev); 2748 } 2749 2750 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status) 2751 { 2752 struct hci_cp_exit_sniff_mode *cp; 2753 struct hci_conn *conn; 2754 2755 bt_dev_dbg(hdev, "status 0x%2.2x", status); 2756 2757 if (!status) 2758 return; 2759 2760 cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE); 2761 if (!cp) 2762 return; 2763 2764 hci_dev_lock(hdev); 2765 2766 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle)); 2767 if (conn) { 2768 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags); 2769 2770 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags)) 2771 hci_sco_setup(conn, status); 2772 } 2773 2774 hci_dev_unlock(hdev); 2775 } 2776 2777 static void hci_cs_disconnect(struct hci_dev *hdev, u8 status) 2778 { 2779 struct hci_cp_disconnect *cp; 2780 struct hci_conn_params *params; 2781 struct hci_conn *conn; 2782 bool mgmt_conn; 2783 2784 bt_dev_dbg(hdev, "status 0x%2.2x", status); 2785 2786 /* Wait for HCI_EV_DISCONN_COMPLETE if status 0x00 and not suspended 2787 * otherwise cleanup the connection immediately. 2788 */ 2789 if (!status && !hdev->suspended) 2790 return; 2791 2792 cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT); 2793 if (!cp) 2794 return; 2795 2796 hci_dev_lock(hdev); 2797 2798 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle)); 2799 if (!conn) 2800 goto unlock; 2801 2802 if (status && status != HCI_ERROR_UNKNOWN_CONN_ID) { 2803 mgmt_disconnect_failed(hdev, &conn->dst, conn->type, 2804 conn->dst_type, status); 2805 2806 if (conn->type == LE_LINK && conn->role == HCI_ROLE_SLAVE) { 2807 hdev->cur_adv_instance = conn->adv_instance; 2808 hci_enable_advertising(hdev); 2809 } 2810 2811 /* Inform sockets conn is gone before we delete it */ 2812 hci_disconn_cfm(conn, HCI_ERROR_UNSPECIFIED); 2813 2814 goto done; 2815 } 2816 2817 /* During suspend, mark connection as closed immediately 2818 * since we might not receive HCI_EV_DISCONN_COMPLETE 2819 */ 2820 if (hdev->suspended) 2821 conn->state = BT_CLOSED; 2822 2823 /* Only peek at the flag here: hci_conn_del() (via hci_conn_unlink()) 2824 * still needs it set to know whether to report the security level 2825 * reset, so it is consumed there instead of here. 2826 */ 2827 mgmt_conn = test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags); 2828 2829 if (conn->type == ACL_LINK) { 2830 if (test_and_clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags)) 2831 hci_remove_link_key(hdev, &conn->dst); 2832 } 2833 2834 params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type); 2835 if (params) { 2836 switch (params->auto_connect) { 2837 case HCI_AUTO_CONN_LINK_LOSS: 2838 if (cp->reason != HCI_ERROR_CONNECTION_TIMEOUT) 2839 break; 2840 fallthrough; 2841 2842 case HCI_AUTO_CONN_DIRECT: 2843 case HCI_AUTO_CONN_ALWAYS: 2844 hci_pend_le_list_del_init(params); 2845 hci_pend_le_list_add(params, &hdev->pend_le_conns); 2846 break; 2847 2848 default: 2849 break; 2850 } 2851 } 2852 2853 mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type, 2854 hci_to_mgmt_reason(cp->reason), mgmt_conn); 2855 2856 hci_disconn_cfm(conn, cp->reason); 2857 2858 done: 2859 /* If the disconnection failed for any reason, the upper layer 2860 * does not retry to disconnect in current implementation. 2861 * Hence, we need to do some basic cleanup here and re-enable 2862 * advertising if necessary. 2863 */ 2864 hci_conn_del(conn); 2865 unlock: 2866 hci_dev_unlock(hdev); 2867 } 2868 2869 static u8 ev_bdaddr_type(struct hci_dev *hdev, u8 type, bool *resolved) 2870 { 2871 /* When using controller based address resolution, then the new 2872 * address types 0x02 and 0x03 are used. These types need to be 2873 * converted back into either public address or random address type 2874 */ 2875 switch (type) { 2876 case ADDR_LE_DEV_PUBLIC_RESOLVED: 2877 if (resolved) 2878 *resolved = true; 2879 return ADDR_LE_DEV_PUBLIC; 2880 case ADDR_LE_DEV_RANDOM_RESOLVED: 2881 if (resolved) 2882 *resolved = true; 2883 return ADDR_LE_DEV_RANDOM; 2884 } 2885 2886 if (resolved) 2887 *resolved = false; 2888 return type; 2889 } 2890 2891 static void cs_le_create_conn(struct hci_dev *hdev, bdaddr_t *peer_addr, 2892 u8 peer_addr_type, u8 own_address_type, 2893 u8 filter_policy) 2894 { 2895 struct hci_conn *conn; 2896 2897 conn = hci_conn_hash_lookup_le(hdev, peer_addr, 2898 peer_addr_type); 2899 if (!conn) 2900 return; 2901 2902 own_address_type = ev_bdaddr_type(hdev, own_address_type, NULL); 2903 2904 /* Store the initiator and responder address information which 2905 * is needed for SMP. These values will not change during the 2906 * lifetime of the connection. 2907 */ 2908 conn->init_addr_type = own_address_type; 2909 if (own_address_type == ADDR_LE_DEV_RANDOM) 2910 bacpy(&conn->init_addr, &hdev->random_addr); 2911 else 2912 bacpy(&conn->init_addr, &hdev->bdaddr); 2913 2914 conn->resp_addr_type = peer_addr_type; 2915 bacpy(&conn->resp_addr, peer_addr); 2916 } 2917 2918 static void hci_cs_le_create_conn(struct hci_dev *hdev, u8 status) 2919 { 2920 struct hci_cp_le_create_conn *cp; 2921 2922 bt_dev_dbg(hdev, "status 0x%2.2x", status); 2923 2924 /* All connection failure handling is taken care of by the 2925 * hci_conn_failed function which is triggered by the HCI 2926 * request completion callbacks used for connecting. 2927 */ 2928 if (status) 2929 return; 2930 2931 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN); 2932 if (!cp) 2933 return; 2934 2935 hci_dev_lock(hdev); 2936 2937 cs_le_create_conn(hdev, &cp->peer_addr, cp->peer_addr_type, 2938 cp->own_address_type, cp->filter_policy); 2939 2940 hci_dev_unlock(hdev); 2941 } 2942 2943 static void hci_cs_le_ext_create_conn(struct hci_dev *hdev, u8 status) 2944 { 2945 struct hci_cp_le_ext_create_conn *cp; 2946 2947 bt_dev_dbg(hdev, "status 0x%2.2x", status); 2948 2949 /* All connection failure handling is taken care of by the 2950 * hci_conn_failed function which is triggered by the HCI 2951 * request completion callbacks used for connecting. 2952 */ 2953 if (status) 2954 return; 2955 2956 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_EXT_CREATE_CONN); 2957 if (!cp) 2958 return; 2959 2960 hci_dev_lock(hdev); 2961 2962 cs_le_create_conn(hdev, &cp->peer_addr, cp->peer_addr_type, 2963 cp->own_addr_type, cp->filter_policy); 2964 2965 hci_dev_unlock(hdev); 2966 } 2967 2968 static void hci_cs_le_set_phy(struct hci_dev *hdev, u8 status) 2969 { 2970 struct hci_cp_le_set_phy *cp; 2971 struct hci_conn *conn; 2972 2973 bt_dev_dbg(hdev, "status 0x%2.2x", status); 2974 2975 if (status) 2976 return; 2977 2978 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_PHY); 2979 if (!cp) 2980 return; 2981 2982 hci_dev_lock(hdev); 2983 2984 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle)); 2985 if (conn) { 2986 conn->le_tx_def_phys = cp->tx_phys; 2987 conn->le_rx_def_phys = cp->rx_phys; 2988 } 2989 2990 hci_dev_unlock(hdev); 2991 } 2992 2993 static void hci_cs_le_read_remote_features(struct hci_dev *hdev, u8 status) 2994 { 2995 struct hci_cp_le_read_remote_features *cp; 2996 struct hci_conn *conn; 2997 2998 bt_dev_dbg(hdev, "status 0x%2.2x", status); 2999 3000 if (!status) 3001 return; 3002 3003 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_READ_REMOTE_FEATURES); 3004 if (!cp) 3005 return; 3006 3007 hci_dev_lock(hdev); 3008 3009 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle)); 3010 if (conn && conn->state == BT_CONFIG) { 3011 /* If the local controller supports peripheral-initiated 3012 * features exchange, but the remote controller does not, 3013 * then the controller may already return the error code 3014 * 0x1a for unsupported remote feature in the command 3015 * status. 3016 * 3017 * Handle it as hci_le_remote_feat_complete_evt() does and 3018 * allow the connection to transition into connected state. 3019 */ 3020 if (!conn->out && 3021 status == HCI_ERROR_UNSUPPORTED_REMOTE_FEATURE && 3022 (hdev->le_features[0] & HCI_LE_PERIPHERAL_FEATURES)) { 3023 conn->state = BT_CONNECTED; 3024 status = 0x00; 3025 } 3026 3027 hci_connect_cfm(conn, status); 3028 } 3029 3030 hci_dev_unlock(hdev); 3031 } 3032 3033 static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status) 3034 { 3035 struct hci_cp_le_start_enc *cp; 3036 struct hci_conn *conn; 3037 3038 bt_dev_dbg(hdev, "status 0x%2.2x", status); 3039 3040 if (!status) 3041 return; 3042 3043 hci_dev_lock(hdev); 3044 3045 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_START_ENC); 3046 if (!cp) 3047 goto unlock; 3048 3049 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle)); 3050 if (!conn) 3051 goto unlock; 3052 3053 if (conn->state != BT_CONNECTED) 3054 goto unlock; 3055 3056 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE); 3057 hci_conn_drop(conn); 3058 3059 unlock: 3060 hci_dev_unlock(hdev); 3061 } 3062 3063 static void hci_cs_switch_role(struct hci_dev *hdev, u8 status) 3064 { 3065 struct hci_cp_switch_role *cp; 3066 struct hci_conn *conn; 3067 3068 BT_DBG("%s status 0x%2.2x", hdev->name, status); 3069 3070 if (!status) 3071 return; 3072 3073 cp = hci_sent_cmd_data(hdev, HCI_OP_SWITCH_ROLE); 3074 if (!cp) 3075 return; 3076 3077 hci_dev_lock(hdev); 3078 3079 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr); 3080 if (conn) 3081 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags); 3082 3083 hci_dev_unlock(hdev); 3084 } 3085 3086 static void hci_inquiry_complete_evt(struct hci_dev *hdev, void *data, 3087 struct sk_buff *skb) 3088 { 3089 struct hci_ev_status *ev = data; 3090 struct discovery_state *discov = &hdev->discovery; 3091 struct inquiry_entry *e; 3092 3093 bt_dev_dbg(hdev, "status 0x%2.2x", ev->status); 3094 3095 if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags)) 3096 return; 3097 3098 smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */ 3099 wake_up_bit(&hdev->flags, HCI_INQUIRY); 3100 3101 if (!hci_dev_test_flag(hdev, HCI_MGMT)) 3102 return; 3103 3104 hci_dev_lock(hdev); 3105 3106 if (discov->state != DISCOVERY_FINDING) 3107 goto unlock; 3108 3109 if (list_empty(&discov->resolve)) { 3110 /* When BR/EDR inquiry is active and no LE scanning is in 3111 * progress, then change discovery state to indicate completion. 3112 * 3113 * When running LE scanning and BR/EDR inquiry simultaneously 3114 * and the LE scan already finished, then change the discovery 3115 * state to indicate completion. 3116 */ 3117 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) || 3118 !hci_test_quirk(hdev, HCI_QUIRK_SIMULTANEOUS_DISCOVERY)) 3119 hci_discovery_set_state(hdev, DISCOVERY_STOPPED); 3120 goto unlock; 3121 } 3122 3123 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED); 3124 if (e && hci_resolve_name(hdev, e) == 0) { 3125 e->name_state = NAME_PENDING; 3126 hci_discovery_set_state(hdev, DISCOVERY_RESOLVING); 3127 discov->name_resolve_timeout = jiffies + NAME_RESOLVE_DURATION; 3128 } else { 3129 /* When BR/EDR inquiry is active and no LE scanning is in 3130 * progress, then change discovery state to indicate completion. 3131 * 3132 * When running LE scanning and BR/EDR inquiry simultaneously 3133 * and the LE scan already finished, then change the discovery 3134 * state to indicate completion. 3135 */ 3136 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) || 3137 !hci_test_quirk(hdev, HCI_QUIRK_SIMULTANEOUS_DISCOVERY)) 3138 hci_discovery_set_state(hdev, DISCOVERY_STOPPED); 3139 } 3140 3141 unlock: 3142 hci_dev_unlock(hdev); 3143 } 3144 3145 static void hci_inquiry_result_evt(struct hci_dev *hdev, void *edata, 3146 struct sk_buff *skb) 3147 { 3148 struct hci_ev_inquiry_result *ev = edata; 3149 struct inquiry_data data; 3150 int i; 3151 3152 if (!hci_ev_skb_pull(hdev, skb, HCI_EV_INQUIRY_RESULT, 3153 flex_array_size(ev, info, ev->num))) 3154 return; 3155 3156 bt_dev_dbg(hdev, "num %d", ev->num); 3157 3158 if (!ev->num) 3159 return; 3160 3161 if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) 3162 return; 3163 3164 hci_dev_lock(hdev); 3165 3166 for (i = 0; i < ev->num; i++) { 3167 struct inquiry_info *info = &ev->info[i]; 3168 u32 flags; 3169 3170 bacpy(&data.bdaddr, &info->bdaddr); 3171 data.pscan_rep_mode = info->pscan_rep_mode; 3172 data.pscan_period_mode = info->pscan_period_mode; 3173 data.pscan_mode = info->pscan_mode; 3174 memcpy(data.dev_class, info->dev_class, 3); 3175 data.clock_offset = info->clock_offset; 3176 data.rssi = HCI_RSSI_INVALID; 3177 data.ssp_mode = 0x00; 3178 3179 flags = hci_inquiry_cache_update(hdev, &data, false); 3180 3181 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00, 3182 info->dev_class, HCI_RSSI_INVALID, 3183 flags, NULL, 0, NULL, 0, 0); 3184 } 3185 3186 hci_dev_unlock(hdev); 3187 } 3188 3189 static int hci_read_enc_key_size(struct hci_dev *hdev, struct hci_conn *conn) 3190 { 3191 struct hci_cp_read_enc_key_size cp; 3192 u8 *key_enc_size = hci_conn_key_enc_size(conn); 3193 3194 if (!read_key_size_capable(hdev)) { 3195 conn->enc_key_size = HCI_LINK_KEY_SIZE; 3196 return -EOPNOTSUPP; 3197 } 3198 3199 bt_dev_dbg(hdev, "hcon %p", conn); 3200 3201 memset(&cp, 0, sizeof(cp)); 3202 cp.handle = cpu_to_le16(conn->handle); 3203 3204 /* If the key enc_size is already known, use it as conn->enc_key_size, 3205 * otherwise use hdev->min_enc_key_size so the likes of 3206 * l2cap_check_enc_key_size don't fail while waiting for 3207 * HCI_OP_READ_ENC_KEY_SIZE response. 3208 */ 3209 if (key_enc_size && *key_enc_size) 3210 conn->enc_key_size = *key_enc_size; 3211 else 3212 conn->enc_key_size = hdev->min_enc_key_size; 3213 3214 return hci_send_cmd(hdev, HCI_OP_READ_ENC_KEY_SIZE, sizeof(cp), &cp); 3215 } 3216 3217 static void hci_conn_complete_evt(struct hci_dev *hdev, void *data, 3218 struct sk_buff *skb) 3219 { 3220 struct hci_ev_conn_complete *ev = data; 3221 struct hci_conn *conn; 3222 u8 status = ev->status; 3223 3224 bt_dev_dbg(hdev, "status 0x%2.2x", status); 3225 3226 hci_dev_lock(hdev); 3227 hci_store_wake_reason(hdev, &ev->bdaddr, BDADDR_BREDR); 3228 3229 /* Check for existing connection: 3230 * 3231 * 1. If it doesn't exist then it must be receiver/slave role. 3232 * 2. If it does exist confirm that it is connecting/BT_CONNECT in case 3233 * of initiator/master role since there could be a collision where 3234 * either side is attempting to connect or something like a fuzzing 3235 * testing is trying to play tricks to destroy the hcon object before 3236 * it even attempts to connect (e.g. hcon->state == BT_OPEN). 3237 */ 3238 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr); 3239 if (!conn || 3240 (conn->role == HCI_ROLE_MASTER && conn->state != BT_CONNECT)) { 3241 /* In case of error status and there is no connection pending 3242 * just unlock as there is nothing to cleanup. 3243 */ 3244 if (ev->status) 3245 goto unlock; 3246 3247 /* Connection may not exist if auto-connected. Check the bredr 3248 * allowlist to see if this device is allowed to auto connect. 3249 * If link is an ACL type, create a connection class 3250 * automatically. 3251 * 3252 * Auto-connect will only occur if the event filter is 3253 * programmed with a given address. Right now, event filter is 3254 * only used during suspend. 3255 */ 3256 if (ev->link_type == ACL_LINK && 3257 hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, 3258 &ev->bdaddr, 3259 BDADDR_BREDR)) { 3260 conn = hci_conn_add_unset(hdev, ev->link_type, 3261 &ev->bdaddr, 0, 3262 HCI_ROLE_SLAVE); 3263 if (IS_ERR(conn)) { 3264 bt_dev_err(hdev, "connection err: %ld", PTR_ERR(conn)); 3265 goto unlock; 3266 } 3267 } else { 3268 if (ev->link_type != SCO_LINK) 3269 goto unlock; 3270 3271 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, 3272 &ev->bdaddr); 3273 if (!conn) 3274 goto unlock; 3275 3276 conn->type = SCO_LINK; 3277 } 3278 } 3279 3280 /* The HCI_Connection_Complete event is only sent once per connection. 3281 * Processing it more than once per connection can corrupt kernel memory. 3282 * 3283 * As the connection handle is set here for the first time, it indicates 3284 * whether the connection is already set up. 3285 */ 3286 if (!HCI_CONN_HANDLE_UNSET(conn->handle)) { 3287 bt_dev_err(hdev, "Ignoring HCI_Connection_Complete for existing connection"); 3288 goto unlock; 3289 } 3290 3291 if (!status) { 3292 status = hci_conn_set_handle(conn, __le16_to_cpu(ev->handle)); 3293 if (status) 3294 goto done; 3295 3296 if (conn->type == ACL_LINK) { 3297 conn->state = BT_CONFIG; 3298 hci_conn_hold(conn); 3299 3300 if (!conn->out && !hci_conn_ssp_enabled(conn) && 3301 !hci_find_link_key(hdev, &ev->bdaddr)) 3302 conn->disc_timeout = HCI_PAIRING_TIMEOUT; 3303 else 3304 conn->disc_timeout = HCI_DISCONN_TIMEOUT; 3305 } else 3306 conn->state = BT_CONNECTED; 3307 3308 hci_debugfs_create_conn(conn); 3309 hci_conn_add_sysfs(conn); 3310 3311 if (test_bit(HCI_AUTH, &hdev->flags)) 3312 set_bit(HCI_CONN_AUTH, &conn->flags); 3313 3314 if (test_bit(HCI_ENCRYPT, &hdev->flags)) 3315 set_bit(HCI_CONN_ENCRYPT, &conn->flags); 3316 3317 /* "Link key request" completed ahead of "connect request" completes */ 3318 if (ev->encr_mode == 1 && !test_bit(HCI_CONN_ENCRYPT, &conn->flags) && 3319 ev->link_type == ACL_LINK) { 3320 struct link_key *key; 3321 3322 key = hci_find_link_key(hdev, &ev->bdaddr); 3323 if (key) { 3324 set_bit(HCI_CONN_ENCRYPT, &conn->flags); 3325 hci_read_enc_key_size(hdev, conn); 3326 hci_encrypt_cfm(conn, ev->status); 3327 } 3328 } 3329 3330 /* Get remote features */ 3331 if (conn->type == ACL_LINK) { 3332 struct hci_cp_read_remote_features cp; 3333 cp.handle = ev->handle; 3334 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES, 3335 sizeof(cp), &cp); 3336 3337 hci_update_scan(hdev); 3338 } 3339 3340 /* Set packet type for incoming connection */ 3341 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) { 3342 struct hci_cp_change_conn_ptype cp; 3343 cp.handle = ev->handle; 3344 cp.pkt_type = cpu_to_le16(conn->pkt_type); 3345 hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp), 3346 &cp); 3347 } 3348 } 3349 3350 if (conn->type == ACL_LINK) 3351 hci_sco_setup(conn, ev->status); 3352 3353 done: 3354 if (status) { 3355 hci_conn_failed(conn, status); 3356 } else if (ev->link_type == SCO_LINK) { 3357 switch (conn->setting & SCO_AIRMODE_MASK) { 3358 case SCO_AIRMODE_CVSD: 3359 if (hdev->notify) 3360 hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_CVSD); 3361 break; 3362 } 3363 3364 hci_connect_cfm(conn, status); 3365 } 3366 3367 unlock: 3368 hci_dev_unlock(hdev); 3369 } 3370 3371 static void hci_reject_conn(struct hci_dev *hdev, bdaddr_t *bdaddr) 3372 { 3373 struct hci_cp_reject_conn_req cp; 3374 3375 bacpy(&cp.bdaddr, bdaddr); 3376 cp.reason = HCI_ERROR_REJ_BAD_ADDR; 3377 hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp); 3378 } 3379 3380 static void hci_conn_request_evt(struct hci_dev *hdev, void *data, 3381 struct sk_buff *skb) 3382 { 3383 struct hci_ev_conn_request *ev = data; 3384 int mask = hdev->link_mode; 3385 struct inquiry_entry *ie; 3386 struct hci_conn *conn; 3387 __u8 flags = 0; 3388 3389 bt_dev_dbg(hdev, "bdaddr %pMR type 0x%x", &ev->bdaddr, ev->link_type); 3390 3391 hci_dev_lock(hdev); 3392 hci_store_wake_reason(hdev, &ev->bdaddr, BDADDR_BREDR); 3393 hci_dev_unlock(hdev); 3394 3395 /* Reject incoming connection from device with same BD ADDR against 3396 * CVE-2020-26555 3397 */ 3398 if (hdev && !bacmp(&hdev->bdaddr, &ev->bdaddr)) { 3399 bt_dev_dbg(hdev, "Reject connection with same BD_ADDR %pMR\n", 3400 &ev->bdaddr); 3401 hci_reject_conn(hdev, &ev->bdaddr); 3402 return; 3403 } 3404 3405 mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type, 3406 &flags); 3407 3408 if (!(mask & HCI_LM_ACCEPT)) { 3409 hci_reject_conn(hdev, &ev->bdaddr); 3410 return; 3411 } 3412 3413 hci_dev_lock(hdev); 3414 3415 if (hci_bdaddr_list_lookup(&hdev->reject_list, &ev->bdaddr, 3416 BDADDR_BREDR)) { 3417 hci_reject_conn(hdev, &ev->bdaddr); 3418 goto unlock; 3419 } 3420 3421 /* Require HCI_CONNECTABLE or an accept list entry to accept the 3422 * connection. These features are only touched through mgmt so 3423 * only do the checks if HCI_MGMT is set. 3424 */ 3425 if (hci_dev_test_flag(hdev, HCI_MGMT) && 3426 !hci_dev_test_flag(hdev, HCI_CONNECTABLE) && 3427 !hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, &ev->bdaddr, 3428 BDADDR_BREDR)) { 3429 hci_reject_conn(hdev, &ev->bdaddr); 3430 goto unlock; 3431 } 3432 3433 /* Connection accepted */ 3434 3435 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr); 3436 if (ie) 3437 memcpy(ie->data.dev_class, ev->dev_class, 3); 3438 3439 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, 3440 &ev->bdaddr); 3441 if (!conn) { 3442 conn = hci_conn_add_unset(hdev, ev->link_type, &ev->bdaddr, 0, 3443 HCI_ROLE_SLAVE); 3444 if (IS_ERR(conn)) { 3445 bt_dev_err(hdev, "connection err: %ld", PTR_ERR(conn)); 3446 goto unlock; 3447 } 3448 3449 /* Unlike outgoing BR/EDR connections, conn->sec_level is not 3450 * set at connection request time for incoming connections, 3451 * so it is still at its zero-initialized value 3452 * (BT_SECURITY_SDP) here. Set it to BT_SECURITY_LOW so 3453 * mgmt_device_connected() later reports the correct initial 3454 * security level instead of a transient, never-really-in-use 3455 * SDP value. 3456 */ 3457 conn->sec_level = BT_SECURITY_LOW; 3458 } 3459 3460 memcpy(conn->dev_class, ev->dev_class, 3); 3461 3462 if (ev->link_type == ACL_LINK || 3463 (!(flags & HCI_PROTO_DEFER) && !lmp_esco_capable(hdev))) { 3464 struct hci_cp_accept_conn_req cp; 3465 conn->state = BT_CONNECT; 3466 3467 bacpy(&cp.bdaddr, &ev->bdaddr); 3468 3469 if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER)) 3470 cp.role = 0x00; /* Become central */ 3471 else 3472 cp.role = 0x01; /* Remain peripheral */ 3473 3474 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp); 3475 } else if (!(flags & HCI_PROTO_DEFER)) { 3476 struct hci_cp_accept_sync_conn_req cp; 3477 conn->state = BT_CONNECT; 3478 3479 bacpy(&cp.bdaddr, &ev->bdaddr); 3480 cp.pkt_type = cpu_to_le16(conn->pkt_type); 3481 3482 cp.tx_bandwidth = cpu_to_le32(0x00001f40); 3483 cp.rx_bandwidth = cpu_to_le32(0x00001f40); 3484 cp.max_latency = cpu_to_le16(0xffff); 3485 cp.content_format = cpu_to_le16(hdev->voice_setting); 3486 cp.retrans_effort = 0xff; 3487 3488 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ, sizeof(cp), 3489 &cp); 3490 } else { 3491 conn->state = BT_CONNECT2; 3492 hci_connect_cfm(conn, 0); 3493 } 3494 3495 unlock: 3496 hci_dev_unlock(hdev); 3497 } 3498 3499 static void hci_disconn_complete_evt(struct hci_dev *hdev, void *data, 3500 struct sk_buff *skb) 3501 { 3502 struct hci_ev_disconn_complete *ev = data; 3503 u8 reason; 3504 struct hci_conn_params *params; 3505 struct hci_conn *conn; 3506 bool mgmt_connected; 3507 3508 bt_dev_dbg(hdev, "status 0x%2.2x", ev->status); 3509 3510 hci_dev_lock(hdev); 3511 3512 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle)); 3513 if (!conn) 3514 goto unlock; 3515 3516 if (ev->status) { 3517 mgmt_disconnect_failed(hdev, &conn->dst, conn->type, 3518 conn->dst_type, ev->status); 3519 goto unlock; 3520 } 3521 3522 conn->state = BT_CLOSED; 3523 3524 /* Only peek at the flag here: hci_conn_del() (via hci_conn_unlink()) 3525 * still needs it set to know whether to report the security level 3526 * reset, so it is consumed there instead of here. 3527 */ 3528 mgmt_connected = test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags); 3529 3530 if (test_bit(HCI_CONN_AUTH_FAILURE, &conn->flags)) 3531 reason = MGMT_DEV_DISCONN_AUTH_FAILURE; 3532 else 3533 reason = hci_to_mgmt_reason(ev->reason); 3534 3535 mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type, 3536 reason, mgmt_connected); 3537 3538 if (conn->type == ACL_LINK) { 3539 if (test_and_clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags)) 3540 hci_remove_link_key(hdev, &conn->dst); 3541 3542 hci_update_scan(hdev); 3543 } 3544 3545 /* Re-enable passive scanning if disconnected device is marked 3546 * as auto-connectable. 3547 */ 3548 if (conn->type == LE_LINK) { 3549 params = hci_conn_params_lookup(hdev, &conn->dst, 3550 conn->dst_type); 3551 if (params) { 3552 switch (params->auto_connect) { 3553 case HCI_AUTO_CONN_LINK_LOSS: 3554 if (ev->reason != HCI_ERROR_CONNECTION_TIMEOUT) 3555 break; 3556 fallthrough; 3557 3558 case HCI_AUTO_CONN_DIRECT: 3559 case HCI_AUTO_CONN_ALWAYS: 3560 hci_pend_le_list_del_init(params); 3561 hci_pend_le_list_add(params, 3562 &hdev->pend_le_conns); 3563 hci_update_passive_scan(hdev); 3564 break; 3565 3566 default: 3567 break; 3568 } 3569 } 3570 } 3571 3572 hci_disconn_cfm(conn, ev->reason); 3573 3574 /* Re-enable advertising if necessary, since it might 3575 * have been disabled by the connection. From the 3576 * HCI_LE_Set_Advertise_Enable command description in 3577 * the core specification (v4.0): 3578 * "The Controller shall continue advertising until the Host 3579 * issues an LE_Set_Advertise_Enable command with 3580 * Advertising_Enable set to 0x00 (Advertising is disabled) 3581 * or until a connection is created or until the Advertising 3582 * is timed out due to Directed Advertising." 3583 */ 3584 if (conn->type == LE_LINK && conn->role == HCI_ROLE_SLAVE) { 3585 hdev->cur_adv_instance = conn->adv_instance; 3586 hci_enable_advertising(hdev); 3587 } 3588 3589 hci_conn_del(conn); 3590 3591 unlock: 3592 hci_dev_unlock(hdev); 3593 } 3594 3595 static void hci_auth_complete_evt(struct hci_dev *hdev, void *data, 3596 struct sk_buff *skb) 3597 { 3598 struct hci_ev_auth_complete *ev = data; 3599 struct hci_conn *conn; 3600 3601 bt_dev_dbg(hdev, "status 0x%2.2x", ev->status); 3602 3603 hci_dev_lock(hdev); 3604 3605 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle)); 3606 if (!conn) 3607 goto unlock; 3608 3609 if (!ev->status) { 3610 clear_bit(HCI_CONN_AUTH_FAILURE, &conn->flags); 3611 set_bit(HCI_CONN_AUTH, &conn->flags); 3612 /* Authentication alone does not imply encryption: for SSP 3613 * capable devices, encryption is only requested below, and 3614 * for legacy devices it is requested by a separate 3615 * HCI_OP_SET_CONN_ENCRYPT command. Do not report the new 3616 * security level yet, to avoid userspace seeing an elevated 3617 * level alongside no encryption; hci_encrypt_change_evt() 3618 * (possibly via hci_cc_read_enc_key_size() for ACL links) 3619 * reports it once encryption is actually confirmed. 3620 */ 3621 conn->sec_level = conn->pending_sec_level; 3622 } else { 3623 if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING) 3624 set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags); 3625 3626 mgmt_auth_failed(conn, ev->status); 3627 } 3628 3629 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags); 3630 3631 if (conn->state == BT_CONFIG) { 3632 if (!ev->status && hci_conn_ssp_enabled(conn)) { 3633 struct hci_cp_set_conn_encrypt cp; 3634 cp.handle = ev->handle; 3635 cp.encrypt = 0x01; 3636 hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp), 3637 &cp); 3638 } else { 3639 conn->state = BT_CONNECTED; 3640 hci_connect_cfm(conn, ev->status); 3641 hci_conn_drop(conn); 3642 } 3643 } else { 3644 hci_auth_cfm(conn, ev->status); 3645 3646 hci_conn_hold(conn); 3647 conn->disc_timeout = HCI_DISCONN_TIMEOUT; 3648 hci_conn_drop(conn); 3649 } 3650 3651 if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) { 3652 if (!ev->status) { 3653 struct hci_cp_set_conn_encrypt cp; 3654 cp.handle = ev->handle; 3655 cp.encrypt = 0x01; 3656 hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp), 3657 &cp); 3658 } else { 3659 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags); 3660 hci_encrypt_cfm(conn, ev->status); 3661 } 3662 } 3663 3664 unlock: 3665 hci_dev_unlock(hdev); 3666 } 3667 3668 static void hci_remote_name_evt(struct hci_dev *hdev, void *data, 3669 struct sk_buff *skb) 3670 { 3671 struct hci_ev_remote_name *ev = data; 3672 struct hci_conn *conn; 3673 3674 bt_dev_dbg(hdev, "status 0x%2.2x", ev->status); 3675 3676 hci_dev_lock(hdev); 3677 3678 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr); 3679 3680 if (!hci_dev_test_flag(hdev, HCI_MGMT)) 3681 goto check_auth; 3682 3683 if (ev->status == 0) 3684 hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name, 3685 strnlen(ev->name, HCI_MAX_NAME_LENGTH)); 3686 else 3687 hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0); 3688 3689 check_auth: 3690 if (!conn) 3691 goto unlock; 3692 3693 if (!hci_outgoing_auth_needed(hdev, conn)) 3694 goto unlock; 3695 3696 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) { 3697 struct hci_cp_auth_requested cp; 3698 3699 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags); 3700 3701 cp.handle = __cpu_to_le16(conn->handle); 3702 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp); 3703 } 3704 3705 unlock: 3706 hci_dev_unlock(hdev); 3707 } 3708 3709 static void hci_encrypt_change_evt(struct hci_dev *hdev, void *data, 3710 struct sk_buff *skb) 3711 { 3712 struct hci_ev_encrypt_change *ev = data; 3713 struct hci_conn *conn; 3714 3715 bt_dev_dbg(hdev, "status 0x%2.2x", ev->status); 3716 3717 hci_dev_lock(hdev); 3718 3719 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle)); 3720 if (!conn) 3721 goto unlock; 3722 3723 if (!ev->status) { 3724 if (ev->encrypt) { 3725 /* Encryption implies authentication */ 3726 set_bit(HCI_CONN_AUTH, &conn->flags); 3727 set_bit(HCI_CONN_ENCRYPT, &conn->flags); 3728 conn->sec_level = conn->pending_sec_level; 3729 3730 /* P-256 authentication key implies FIPS */ 3731 if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256) 3732 set_bit(HCI_CONN_FIPS, &conn->flags); 3733 3734 if ((conn->type == ACL_LINK && ev->encrypt == 0x02) || 3735 conn->type == LE_LINK) 3736 set_bit(HCI_CONN_AES_CCM, &conn->flags); 3737 3738 /* For ACL links the encryption key size is still 3739 * validated below via hci_read_enc_key_size(). Its 3740 * completion handler, hci_cc_read_enc_key_size(), 3741 * reports the final security level so userspace does 3742 * not see a transient "encrypted" state that a 3743 * key-size downgrade would immediately invalidate. 3744 */ 3745 if (conn->type != ACL_LINK) 3746 mgmt_security_level_changed(conn); 3747 } else { 3748 clear_bit(HCI_CONN_ENCRYPT, &conn->flags); 3749 clear_bit(HCI_CONN_AES_CCM, &conn->flags); 3750 /* Elevated security levels (MEDIUM and above) require 3751 * encryption, so downgrade to reflect the connection 3752 * no longer being encrypted before reporting, instead 3753 * of advertising a stale elevated level alongside 3754 * MGMT_CONN_SEC_ENCRYPT_NONE. 3755 */ 3756 if (conn->sec_level > BT_SECURITY_LOW) 3757 conn->sec_level = BT_SECURITY_LOW; 3758 mgmt_security_level_changed(conn); 3759 } 3760 } 3761 3762 /* We should disregard the current RPA and generate a new one 3763 * whenever the encryption procedure fails. 3764 */ 3765 if (ev->status && conn->type == LE_LINK) { 3766 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED); 3767 hci_adv_instances_set_rpa_expired(hdev, true); 3768 } 3769 3770 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags); 3771 3772 /* Check link security requirements are met */ 3773 if (!hci_conn_check_link_mode(conn)) 3774 ev->status = HCI_ERROR_AUTH_FAILURE; 3775 3776 if (ev->status && conn->state == BT_CONNECTED) { 3777 if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING) 3778 set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags); 3779 3780 /* Notify upper layers so they can cleanup before 3781 * disconnecting. 3782 */ 3783 hci_encrypt_cfm(conn, ev->status); 3784 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE); 3785 hci_conn_drop(conn); 3786 goto unlock; 3787 } 3788 3789 /* Try reading the encryption key size for encrypted ACL links */ 3790 if (!ev->status && ev->encrypt && conn->type == ACL_LINK) { 3791 if (hci_read_enc_key_size(hdev, conn)) { 3792 /* Could not even issue the key-size read: report the 3793 * security level now since hci_cc_read_enc_key_size() 3794 * will not run to do it. 3795 */ 3796 mgmt_security_level_changed(conn); 3797 goto notify; 3798 } 3799 3800 goto unlock; 3801 } 3802 3803 /* We skip the WRITE_AUTH_PAYLOAD_TIMEOUT for ATS2851 based controllers 3804 * to avoid unexpected SMP command errors when pairing. 3805 */ 3806 if (hci_test_quirk(hdev, HCI_QUIRK_BROKEN_WRITE_AUTH_PAYLOAD_TIMEOUT)) 3807 goto notify; 3808 3809 /* Set the default Authenticated Payload Timeout after 3810 * an LE Link is established. As per Core Spec v5.0, Vol 2, Part B 3811 * Section 3.3, the HCI command WRITE_AUTH_PAYLOAD_TIMEOUT should be 3812 * sent when the link is active and Encryption is enabled, the conn 3813 * type can be either LE or ACL and controller must support LMP Ping. 3814 * Ensure for AES-CCM encryption as well. 3815 */ 3816 if (test_bit(HCI_CONN_ENCRYPT, &conn->flags) && 3817 test_bit(HCI_CONN_AES_CCM, &conn->flags) && 3818 ((conn->type == ACL_LINK && lmp_ping_capable(hdev)) || 3819 (conn->type == LE_LINK && (hdev->le_features[0] & HCI_LE_PING)))) { 3820 struct hci_cp_write_auth_payload_to cp; 3821 3822 cp.handle = cpu_to_le16(conn->handle); 3823 cp.timeout = cpu_to_le16(hdev->auth_payload_timeout); 3824 if (hci_send_cmd(conn->hdev, HCI_OP_WRITE_AUTH_PAYLOAD_TO, 3825 sizeof(cp), &cp)) 3826 bt_dev_err(hdev, "write auth payload timeout failed"); 3827 } 3828 3829 notify: 3830 hci_encrypt_cfm(conn, ev->status); 3831 3832 unlock: 3833 hci_dev_unlock(hdev); 3834 } 3835 3836 static void hci_change_link_key_complete_evt(struct hci_dev *hdev, void *data, 3837 struct sk_buff *skb) 3838 { 3839 struct hci_ev_change_link_key_complete *ev = data; 3840 struct hci_conn *conn; 3841 3842 bt_dev_dbg(hdev, "status 0x%2.2x", ev->status); 3843 3844 hci_dev_lock(hdev); 3845 3846 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle)); 3847 if (conn) { 3848 if (!ev->status) 3849 set_bit(HCI_CONN_SECURE, &conn->flags); 3850 3851 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags); 3852 3853 hci_key_change_cfm(conn, ev->status); 3854 } 3855 3856 hci_dev_unlock(hdev); 3857 } 3858 3859 static void hci_remote_features_evt(struct hci_dev *hdev, void *data, 3860 struct sk_buff *skb) 3861 { 3862 struct hci_ev_remote_features *ev = data; 3863 struct hci_conn *conn; 3864 3865 bt_dev_dbg(hdev, "status 0x%2.2x", ev->status); 3866 3867 hci_dev_lock(hdev); 3868 3869 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle)); 3870 if (!conn) 3871 goto unlock; 3872 3873 if (!ev->status) 3874 memcpy(conn->features[0], ev->features, 8); 3875 3876 if (conn->state != BT_CONFIG) 3877 goto unlock; 3878 3879 if (!ev->status && lmp_ext_feat_capable(hdev) && 3880 lmp_ext_feat_capable(conn)) { 3881 struct hci_cp_read_remote_ext_features cp; 3882 cp.handle = ev->handle; 3883 cp.page = 0x01; 3884 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES, 3885 sizeof(cp), &cp); 3886 goto unlock; 3887 } 3888 3889 if (!ev->status) { 3890 struct hci_cp_remote_name_req cp; 3891 memset(&cp, 0, sizeof(cp)); 3892 bacpy(&cp.bdaddr, &conn->dst); 3893 cp.pscan_rep_mode = 0x02; 3894 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp); 3895 } else { 3896 mgmt_device_connected(hdev, conn, NULL, 0); 3897 } 3898 3899 if (!hci_outgoing_auth_needed(hdev, conn)) { 3900 conn->state = BT_CONNECTED; 3901 hci_connect_cfm(conn, ev->status); 3902 hci_conn_drop(conn); 3903 } 3904 3905 unlock: 3906 hci_dev_unlock(hdev); 3907 } 3908 3909 static inline void handle_cmd_cnt_and_timer(struct hci_dev *hdev, u8 ncmd) 3910 { 3911 cancel_delayed_work(&hdev->cmd_timer); 3912 3913 rcu_read_lock(); 3914 if (!test_bit(HCI_RESET, &hdev->flags)) { 3915 if (ncmd) { 3916 cancel_delayed_work(&hdev->ncmd_timer); 3917 atomic_set(&hdev->cmd_cnt, 1); 3918 } else { 3919 if (!hci_dev_test_flag(hdev, HCI_CMD_DRAIN_WORKQUEUE)) 3920 queue_delayed_work(hdev->workqueue, &hdev->ncmd_timer, 3921 HCI_NCMD_TIMEOUT); 3922 } 3923 } 3924 rcu_read_unlock(); 3925 } 3926 3927 static u8 hci_cc_le_read_buffer_size_v2(struct hci_dev *hdev, void *data, 3928 struct sk_buff *skb) 3929 { 3930 struct hci_rp_le_read_buffer_size_v2 *rp = data; 3931 3932 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 3933 3934 if (rp->status) 3935 return rp->status; 3936 3937 hdev->le_mtu = __le16_to_cpu(rp->acl_mtu); 3938 hdev->le_pkts = rp->acl_max_pkt; 3939 hdev->iso_mtu = __le16_to_cpu(rp->iso_mtu); 3940 hdev->iso_pkts = rp->iso_max_pkt; 3941 3942 hdev->le_cnt = hdev->le_pkts; 3943 hdev->iso_cnt = hdev->iso_pkts; 3944 3945 BT_DBG("%s acl mtu %d:%d iso mtu %d:%d", hdev->name, hdev->acl_mtu, 3946 hdev->acl_pkts, hdev->iso_mtu, hdev->iso_pkts); 3947 3948 if (hdev->le_mtu && hdev->le_mtu < HCI_MIN_LE_MTU) 3949 return HCI_ERROR_INVALID_PARAMETERS; 3950 3951 return rp->status; 3952 } 3953 3954 static void hci_unbound_cis_failed(struct hci_dev *hdev, u8 cig, u8 status) 3955 { 3956 struct hci_conn *conn, *tmp; 3957 3958 lockdep_assert_held(&hdev->lock); 3959 3960 list_for_each_entry_safe(conn, tmp, &hdev->conn_hash.list, list) { 3961 if (conn->type != CIS_LINK || 3962 conn->state == BT_OPEN || conn->iso_qos.ucast.cig != cig) 3963 continue; 3964 3965 if (HCI_CONN_HANDLE_UNSET(conn->handle)) 3966 hci_conn_failed(conn, status); 3967 } 3968 } 3969 3970 static u8 hci_cc_le_set_cig_params(struct hci_dev *hdev, void *data, 3971 struct sk_buff *skb) 3972 { 3973 struct hci_rp_le_set_cig_params *rp = data; 3974 struct hci_cp_le_set_cig_params *cp; 3975 struct hci_conn *conn; 3976 u8 status = rp->status; 3977 bool pending = false; 3978 int i; 3979 3980 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 3981 3982 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_CIG_PARAMS); 3983 if (!rp->status && 3984 (!cp || rp->num_handles != cp->num_cis || 3985 rp->cig_id != cp->cig_id || 3986 skb->len < array_size(rp->num_handles, sizeof(*rp->handle)))) { 3987 bt_dev_err(hdev, "unexpected Set CIG Parameters response data"); 3988 status = HCI_ERROR_UNSPECIFIED; 3989 } 3990 3991 hci_dev_lock(hdev); 3992 3993 /* BLUETOOTH CORE SPECIFICATION Version 5.4 | Vol 4, Part E page 2554 3994 * 3995 * If the Status return parameter is non-zero, then the state of the CIG 3996 * and its CIS configurations shall not be changed by the command. If 3997 * the CIG did not already exist, it shall not be created. 3998 */ 3999 if (status) { 4000 /* Keep current configuration, fail only the unbound CIS */ 4001 hci_unbound_cis_failed(hdev, rp->cig_id, status); 4002 goto unlock; 4003 } 4004 4005 /* BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 4, Part E page 2553 4006 * 4007 * If the Status return parameter is zero, then the Controller shall 4008 * set the Connection_Handle arrayed return parameter to the connection 4009 * handle(s) corresponding to the CIS configurations specified in 4010 * the CIS_IDs command parameter, in the same order. 4011 */ 4012 for (i = 0; i < rp->num_handles; ++i) { 4013 conn = hci_conn_hash_lookup_cis(hdev, NULL, 0, rp->cig_id, 4014 cp->cis[i].cis_id); 4015 if (!conn || !bacmp(&conn->dst, BDADDR_ANY)) 4016 continue; 4017 4018 if (conn->state != BT_BOUND && conn->state != BT_CONNECT) 4019 continue; 4020 4021 if (hci_conn_set_handle(conn, __le16_to_cpu(rp->handle[i]))) 4022 continue; 4023 4024 if (conn->state == BT_CONNECT) 4025 pending = true; 4026 } 4027 4028 unlock: 4029 if (pending) 4030 hci_le_create_cis_pending(hdev); 4031 4032 hci_dev_unlock(hdev); 4033 4034 return rp->status; 4035 } 4036 4037 static u8 hci_cc_le_setup_iso_path(struct hci_dev *hdev, void *data, 4038 struct sk_buff *skb) 4039 { 4040 struct hci_rp_le_setup_iso_path *rp = data; 4041 struct hci_cp_le_setup_iso_path *cp; 4042 struct hci_conn *conn; 4043 4044 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 4045 4046 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SETUP_ISO_PATH); 4047 if (!cp) 4048 return rp->status; 4049 4050 hci_dev_lock(hdev); 4051 4052 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle)); 4053 if (!conn) 4054 goto unlock; 4055 4056 if (rp->status) { 4057 hci_connect_cfm(conn, rp->status); 4058 hci_conn_del(conn); 4059 goto unlock; 4060 } 4061 4062 switch (cp->direction) { 4063 /* Input (Host to Controller) */ 4064 case 0x00: 4065 /* Only confirm connection if output only */ 4066 if (conn->iso_qos.ucast.out.sdu && !conn->iso_qos.ucast.in.sdu) 4067 hci_connect_cfm(conn, rp->status); 4068 break; 4069 /* Output (Controller to Host) */ 4070 case 0x01: 4071 /* Confirm connection since conn->iso_qos is always configured 4072 * last. 4073 */ 4074 hci_connect_cfm(conn, rp->status); 4075 4076 /* Notify device connected in case it is a BIG Sync */ 4077 if (!rp->status && test_bit(HCI_CONN_BIG_SYNC, &conn->flags)) 4078 mgmt_device_connected(hdev, conn, NULL, 0); 4079 4080 break; 4081 } 4082 4083 unlock: 4084 hci_dev_unlock(hdev); 4085 return rp->status; 4086 } 4087 4088 static u8 hci_cc_le_read_all_local_features(struct hci_dev *hdev, void *data, 4089 struct sk_buff *skb) 4090 { 4091 struct hci_rp_le_read_all_local_features *rp = data; 4092 4093 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 4094 4095 if (rp->status) 4096 return rp->status; 4097 4098 memcpy(hdev->le_features, rp->features, 248); 4099 4100 return rp->status; 4101 } 4102 4103 static void hci_cs_le_create_big(struct hci_dev *hdev, u8 status) 4104 { 4105 bt_dev_dbg(hdev, "status 0x%2.2x", status); 4106 } 4107 4108 static void hci_cs_le_read_all_remote_features(struct hci_dev *hdev, u8 status) 4109 { 4110 struct hci_cp_le_read_remote_features *cp; 4111 struct hci_conn *conn; 4112 4113 bt_dev_dbg(hdev, "status 0x%2.2x", status); 4114 4115 if (!status) 4116 return; 4117 4118 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_READ_ALL_REMOTE_FEATURES); 4119 if (!cp) 4120 return; 4121 4122 hci_dev_lock(hdev); 4123 4124 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle)); 4125 if (conn && conn->state == BT_CONFIG) { 4126 /* See hci_cs_le_read_remote_features() */ 4127 if (!conn->out && 4128 status == HCI_ERROR_UNSUPPORTED_REMOTE_FEATURE && 4129 (hdev->le_features[0] & HCI_LE_PERIPHERAL_FEATURES)) { 4130 conn->state = BT_CONNECTED; 4131 status = 0x00; 4132 } 4133 4134 hci_connect_cfm(conn, status); 4135 } 4136 4137 hci_dev_unlock(hdev); 4138 } 4139 4140 static u8 hci_cc_set_per_adv_param(struct hci_dev *hdev, void *data, 4141 struct sk_buff *skb) 4142 { 4143 struct hci_ev_status *rp = data; 4144 struct hci_cp_le_set_per_adv_params *cp; 4145 4146 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 4147 4148 if (rp->status) 4149 return rp->status; 4150 4151 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_PER_ADV_PARAMS); 4152 if (!cp) 4153 return rp->status; 4154 4155 /* TODO: set the conn state */ 4156 return rp->status; 4157 } 4158 4159 static u8 hci_cc_le_set_per_adv_enable(struct hci_dev *hdev, void *data, 4160 struct sk_buff *skb) 4161 { 4162 struct hci_ev_status *rp = data; 4163 struct hci_cp_le_set_per_adv_enable *cp; 4164 struct adv_info *adv = NULL, *n; 4165 u8 per_adv_cnt = 0; 4166 4167 bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); 4168 4169 if (rp->status) 4170 return rp->status; 4171 4172 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_PER_ADV_ENABLE); 4173 if (!cp) 4174 return rp->status; 4175 4176 hci_dev_lock(hdev); 4177 4178 adv = hci_find_adv_instance(hdev, cp->handle); 4179 4180 if (cp->enable) { 4181 hci_dev_set_flag(hdev, HCI_LE_PER_ADV); 4182 4183 if (adv) 4184 adv->periodic_enabled = true; 4185 } else { 4186 if (adv) 4187 adv->periodic_enabled = false; 4188 4189 /* If just one instance was disabled check if there are 4190 * any other instance enabled before clearing HCI_LE_PER_ADV. 4191 * The current periodic adv instance will be marked as 4192 * disabled once extended advertising is also disabled. 4193 */ 4194 list_for_each_entry_safe(adv, n, &hdev->adv_instances, 4195 list) { 4196 if (adv->periodic && adv->enabled) 4197 per_adv_cnt++; 4198 } 4199 4200 if (per_adv_cnt > 1) 4201 goto unlock; 4202 4203 hci_dev_clear_flag(hdev, HCI_LE_PER_ADV); 4204 } 4205 4206 unlock: 4207 hci_dev_unlock(hdev); 4208 4209 return rp->status; 4210 } 4211 4212 #define HCI_CC_VL(_op, _func, _min, _max) \ 4213 { \ 4214 .op = _op, \ 4215 .func = _func, \ 4216 .min_len = _min, \ 4217 .max_len = _max, \ 4218 } 4219 4220 #define HCI_CC(_op, _func, _len) \ 4221 HCI_CC_VL(_op, _func, _len, _len) 4222 4223 #define HCI_CC_STATUS(_op, _func) \ 4224 HCI_CC(_op, _func, sizeof(struct hci_ev_status)) 4225 4226 #define HCI_MAX_CC_PLEN \ 4227 (HCI_MAX_EVENT_PLEN - sizeof(struct hci_ev_cmd_complete)) 4228 4229 static const struct hci_cc { 4230 u16 op; 4231 u8 (*func)(struct hci_dev *hdev, void *data, struct sk_buff *skb); 4232 u16 min_len; 4233 u16 max_len; 4234 } hci_cc_table[] = { 4235 HCI_CC_STATUS(HCI_OP_INQUIRY_CANCEL, hci_cc_inquiry_cancel), 4236 HCI_CC_STATUS(HCI_OP_PERIODIC_INQ, hci_cc_periodic_inq), 4237 HCI_CC_STATUS(HCI_OP_EXIT_PERIODIC_INQ, hci_cc_exit_periodic_inq), 4238 HCI_CC(HCI_OP_REMOTE_NAME_REQ_CANCEL, hci_cc_remote_name_req_cancel, 4239 sizeof(struct hci_rp_remote_name_req_cancel)), 4240 HCI_CC(HCI_OP_ROLE_DISCOVERY, hci_cc_role_discovery, 4241 sizeof(struct hci_rp_role_discovery)), 4242 HCI_CC(HCI_OP_READ_LINK_POLICY, hci_cc_read_link_policy, 4243 sizeof(struct hci_rp_read_link_policy)), 4244 HCI_CC(HCI_OP_WRITE_LINK_POLICY, hci_cc_write_link_policy, 4245 sizeof(struct hci_rp_write_link_policy)), 4246 HCI_CC(HCI_OP_READ_DEF_LINK_POLICY, hci_cc_read_def_link_policy, 4247 sizeof(struct hci_rp_read_def_link_policy)), 4248 HCI_CC_STATUS(HCI_OP_WRITE_DEF_LINK_POLICY, 4249 hci_cc_write_def_link_policy), 4250 HCI_CC_STATUS(HCI_OP_RESET, hci_cc_reset), 4251 HCI_CC(HCI_OP_READ_STORED_LINK_KEY, hci_cc_read_stored_link_key, 4252 sizeof(struct hci_rp_read_stored_link_key)), 4253 HCI_CC(HCI_OP_DELETE_STORED_LINK_KEY, hci_cc_delete_stored_link_key, 4254 sizeof(struct hci_rp_delete_stored_link_key)), 4255 HCI_CC_STATUS(HCI_OP_WRITE_LOCAL_NAME, hci_cc_write_local_name), 4256 HCI_CC(HCI_OP_READ_LOCAL_NAME, hci_cc_read_local_name, 4257 sizeof(struct hci_rp_read_local_name)), 4258 HCI_CC_STATUS(HCI_OP_WRITE_AUTH_ENABLE, hci_cc_write_auth_enable), 4259 HCI_CC_STATUS(HCI_OP_WRITE_ENCRYPT_MODE, hci_cc_write_encrypt_mode), 4260 HCI_CC_STATUS(HCI_OP_WRITE_SCAN_ENABLE, hci_cc_write_scan_enable), 4261 HCI_CC_STATUS(HCI_OP_SET_EVENT_FLT, hci_cc_set_event_filter), 4262 HCI_CC(HCI_OP_READ_CLASS_OF_DEV, hci_cc_read_class_of_dev, 4263 sizeof(struct hci_rp_read_class_of_dev)), 4264 HCI_CC_STATUS(HCI_OP_WRITE_CLASS_OF_DEV, hci_cc_write_class_of_dev), 4265 HCI_CC(HCI_OP_READ_VOICE_SETTING, hci_cc_read_voice_setting, 4266 sizeof(struct hci_rp_read_voice_setting)), 4267 HCI_CC_STATUS(HCI_OP_WRITE_VOICE_SETTING, hci_cc_write_voice_setting), 4268 HCI_CC(HCI_OP_READ_NUM_SUPPORTED_IAC, hci_cc_read_num_supported_iac, 4269 sizeof(struct hci_rp_read_num_supported_iac)), 4270 HCI_CC_STATUS(HCI_OP_WRITE_SSP_MODE, hci_cc_write_ssp_mode), 4271 HCI_CC_STATUS(HCI_OP_WRITE_SC_SUPPORT, hci_cc_write_sc_support), 4272 HCI_CC(HCI_OP_READ_AUTH_PAYLOAD_TO, hci_cc_read_auth_payload_timeout, 4273 sizeof(struct hci_rp_read_auth_payload_to)), 4274 HCI_CC(HCI_OP_WRITE_AUTH_PAYLOAD_TO, hci_cc_write_auth_payload_timeout, 4275 sizeof(struct hci_rp_write_auth_payload_to)), 4276 HCI_CC(HCI_OP_READ_LOCAL_VERSION, hci_cc_read_local_version, 4277 sizeof(struct hci_rp_read_local_version)), 4278 HCI_CC(HCI_OP_READ_LOCAL_COMMANDS, hci_cc_read_local_commands, 4279 sizeof(struct hci_rp_read_local_commands)), 4280 HCI_CC(HCI_OP_READ_LOCAL_FEATURES, hci_cc_read_local_features, 4281 sizeof(struct hci_rp_read_local_features)), 4282 HCI_CC(HCI_OP_READ_LOCAL_EXT_FEATURES, hci_cc_read_local_ext_features, 4283 sizeof(struct hci_rp_read_local_ext_features)), 4284 HCI_CC(HCI_OP_READ_BUFFER_SIZE, hci_cc_read_buffer_size, 4285 sizeof(struct hci_rp_read_buffer_size)), 4286 HCI_CC(HCI_OP_READ_BD_ADDR, hci_cc_read_bd_addr, 4287 sizeof(struct hci_rp_read_bd_addr)), 4288 HCI_CC(HCI_OP_READ_LOCAL_PAIRING_OPTS, hci_cc_read_local_pairing_opts, 4289 sizeof(struct hci_rp_read_local_pairing_opts)), 4290 HCI_CC(HCI_OP_READ_PAGE_SCAN_ACTIVITY, hci_cc_read_page_scan_activity, 4291 sizeof(struct hci_rp_read_page_scan_activity)), 4292 HCI_CC_STATUS(HCI_OP_WRITE_PAGE_SCAN_ACTIVITY, 4293 hci_cc_write_page_scan_activity), 4294 HCI_CC(HCI_OP_READ_PAGE_SCAN_TYPE, hci_cc_read_page_scan_type, 4295 sizeof(struct hci_rp_read_page_scan_type)), 4296 HCI_CC_STATUS(HCI_OP_WRITE_PAGE_SCAN_TYPE, hci_cc_write_page_scan_type), 4297 HCI_CC(HCI_OP_READ_CLOCK, hci_cc_read_clock, 4298 sizeof(struct hci_rp_read_clock)), 4299 HCI_CC(HCI_OP_READ_ENC_KEY_SIZE, hci_cc_read_enc_key_size, 4300 sizeof(struct hci_rp_read_enc_key_size)), 4301 HCI_CC(HCI_OP_READ_INQ_RSP_TX_POWER, hci_cc_read_inq_rsp_tx_power, 4302 sizeof(struct hci_rp_read_inq_rsp_tx_power)), 4303 HCI_CC(HCI_OP_READ_DEF_ERR_DATA_REPORTING, 4304 hci_cc_read_def_err_data_reporting, 4305 sizeof(struct hci_rp_read_def_err_data_reporting)), 4306 HCI_CC_STATUS(HCI_OP_WRITE_DEF_ERR_DATA_REPORTING, 4307 hci_cc_write_def_err_data_reporting), 4308 HCI_CC(HCI_OP_PIN_CODE_REPLY, hci_cc_pin_code_reply, 4309 sizeof(struct hci_rp_pin_code_reply)), 4310 HCI_CC(HCI_OP_PIN_CODE_NEG_REPLY, hci_cc_pin_code_neg_reply, 4311 sizeof(struct hci_rp_pin_code_neg_reply)), 4312 HCI_CC(HCI_OP_READ_LOCAL_OOB_DATA, hci_cc_read_local_oob_data, 4313 sizeof(struct hci_rp_read_local_oob_data)), 4314 HCI_CC(HCI_OP_READ_LOCAL_OOB_EXT_DATA, hci_cc_read_local_oob_ext_data, 4315 sizeof(struct hci_rp_read_local_oob_ext_data)), 4316 HCI_CC(HCI_OP_LE_READ_BUFFER_SIZE, hci_cc_le_read_buffer_size, 4317 sizeof(struct hci_rp_le_read_buffer_size)), 4318 HCI_CC(HCI_OP_LE_READ_LOCAL_FEATURES, hci_cc_le_read_local_features, 4319 sizeof(struct hci_rp_le_read_local_features)), 4320 HCI_CC_VL(HCI_OP_LE_READ_CONN_INTERVAL, hci_cc_le_read_conn_interval, 4321 sizeof(struct hci_rp_le_read_conn_interval), 4322 HCI_MAX_CC_PLEN), 4323 HCI_CC(HCI_OP_LE_READ_ADV_TX_POWER, hci_cc_le_read_adv_tx_power, 4324 sizeof(struct hci_rp_le_read_adv_tx_power)), 4325 HCI_CC(HCI_OP_USER_CONFIRM_REPLY, hci_cc_user_confirm_reply, 4326 sizeof(struct hci_rp_user_confirm_reply)), 4327 HCI_CC(HCI_OP_USER_CONFIRM_NEG_REPLY, hci_cc_user_confirm_neg_reply, 4328 sizeof(struct hci_rp_user_confirm_reply)), 4329 HCI_CC(HCI_OP_USER_PASSKEY_REPLY, hci_cc_user_passkey_reply, 4330 sizeof(struct hci_rp_user_confirm_reply)), 4331 HCI_CC(HCI_OP_USER_PASSKEY_NEG_REPLY, hci_cc_user_passkey_neg_reply, 4332 sizeof(struct hci_rp_user_confirm_reply)), 4333 HCI_CC_STATUS(HCI_OP_LE_SET_RANDOM_ADDR, hci_cc_le_set_random_addr), 4334 HCI_CC_STATUS(HCI_OP_LE_SET_ADV_ENABLE, hci_cc_le_set_adv_enable), 4335 HCI_CC_STATUS(HCI_OP_LE_SET_SCAN_PARAM, hci_cc_le_set_scan_param), 4336 HCI_CC_STATUS(HCI_OP_LE_SET_SCAN_ENABLE, hci_cc_le_set_scan_enable), 4337 HCI_CC(HCI_OP_LE_READ_ACCEPT_LIST_SIZE, 4338 hci_cc_le_read_accept_list_size, 4339 sizeof(struct hci_rp_le_read_accept_list_size)), 4340 HCI_CC_STATUS(HCI_OP_LE_CLEAR_ACCEPT_LIST, hci_cc_le_clear_accept_list), 4341 HCI_CC_STATUS(HCI_OP_LE_ADD_TO_ACCEPT_LIST, 4342 hci_cc_le_add_to_accept_list), 4343 HCI_CC_STATUS(HCI_OP_LE_DEL_FROM_ACCEPT_LIST, 4344 hci_cc_le_del_from_accept_list), 4345 HCI_CC(HCI_OP_LE_READ_SUPPORTED_STATES, hci_cc_le_read_supported_states, 4346 sizeof(struct hci_rp_le_read_supported_states)), 4347 HCI_CC(HCI_OP_LE_READ_DEF_DATA_LEN, hci_cc_le_read_def_data_len, 4348 sizeof(struct hci_rp_le_read_def_data_len)), 4349 HCI_CC_STATUS(HCI_OP_LE_WRITE_DEF_DATA_LEN, 4350 hci_cc_le_write_def_data_len), 4351 HCI_CC_STATUS(HCI_OP_LE_ADD_TO_RESOLV_LIST, 4352 hci_cc_le_add_to_resolv_list), 4353 HCI_CC_STATUS(HCI_OP_LE_DEL_FROM_RESOLV_LIST, 4354 hci_cc_le_del_from_resolv_list), 4355 HCI_CC_STATUS(HCI_OP_LE_CLEAR_RESOLV_LIST, 4356 hci_cc_le_clear_resolv_list), 4357 HCI_CC(HCI_OP_LE_READ_RESOLV_LIST_SIZE, hci_cc_le_read_resolv_list_size, 4358 sizeof(struct hci_rp_le_read_resolv_list_size)), 4359 HCI_CC_STATUS(HCI_OP_LE_SET_ADDR_RESOLV_ENABLE, 4360 hci_cc_le_set_addr_resolution_enable), 4361 HCI_CC(HCI_OP_LE_READ_MAX_DATA_LEN, hci_cc_le_read_max_data_len, 4362 sizeof(struct hci_rp_le_read_max_data_len)), 4363 HCI_CC_STATUS(HCI_OP_WRITE_LE_HOST_SUPPORTED, 4364 hci_cc_write_le_host_supported), 4365 HCI_CC_STATUS(HCI_OP_LE_SET_ADV_PARAM, hci_cc_set_adv_param), 4366 HCI_CC(HCI_OP_READ_RSSI, hci_cc_read_rssi, 4367 sizeof(struct hci_rp_read_rssi)), 4368 HCI_CC(HCI_OP_READ_TX_POWER, hci_cc_read_tx_power, 4369 sizeof(struct hci_rp_read_tx_power)), 4370 HCI_CC_STATUS(HCI_OP_WRITE_SSP_DEBUG_MODE, hci_cc_write_ssp_debug_mode), 4371 HCI_CC_STATUS(HCI_OP_LE_SET_EXT_SCAN_PARAMS, 4372 hci_cc_le_set_ext_scan_param), 4373 HCI_CC_STATUS(HCI_OP_LE_SET_EXT_SCAN_ENABLE, 4374 hci_cc_le_set_ext_scan_enable), 4375 HCI_CC_STATUS(HCI_OP_LE_SET_DEFAULT_PHY, hci_cc_le_set_default_phy), 4376 HCI_CC(HCI_OP_LE_READ_NUM_SUPPORTED_ADV_SETS, 4377 hci_cc_le_read_num_adv_sets, 4378 sizeof(struct hci_rp_le_read_num_supported_adv_sets)), 4379 HCI_CC_STATUS(HCI_OP_LE_SET_EXT_ADV_ENABLE, 4380 hci_cc_le_set_ext_adv_enable), 4381 HCI_CC_STATUS(HCI_OP_LE_SET_ADV_SET_RAND_ADDR, 4382 hci_cc_le_set_adv_set_random_addr), 4383 HCI_CC_STATUS(HCI_OP_LE_REMOVE_ADV_SET, hci_cc_le_remove_adv_set), 4384 HCI_CC_STATUS(HCI_OP_LE_CLEAR_ADV_SETS, hci_cc_le_clear_adv_sets), 4385 HCI_CC_STATUS(HCI_OP_LE_SET_PER_ADV_PARAMS, hci_cc_set_per_adv_param), 4386 HCI_CC_STATUS(HCI_OP_LE_SET_PER_ADV_ENABLE, 4387 hci_cc_le_set_per_adv_enable), 4388 HCI_CC(HCI_OP_LE_READ_TRANSMIT_POWER, hci_cc_le_read_transmit_power, 4389 sizeof(struct hci_rp_le_read_transmit_power)), 4390 HCI_CC_STATUS(HCI_OP_LE_SET_PRIVACY_MODE, hci_cc_le_set_privacy_mode), 4391 HCI_CC(HCI_OP_LE_READ_BUFFER_SIZE_V2, hci_cc_le_read_buffer_size_v2, 4392 sizeof(struct hci_rp_le_read_buffer_size_v2)), 4393 HCI_CC_VL(HCI_OP_LE_SET_CIG_PARAMS, hci_cc_le_set_cig_params, 4394 sizeof(struct hci_rp_le_set_cig_params), HCI_MAX_CC_PLEN), 4395 HCI_CC(HCI_OP_LE_SETUP_ISO_PATH, hci_cc_le_setup_iso_path, 4396 sizeof(struct hci_rp_le_setup_iso_path)), 4397 HCI_CC(HCI_OP_LE_READ_ALL_LOCAL_FEATURES, 4398 hci_cc_le_read_all_local_features, 4399 sizeof(struct hci_rp_le_read_all_local_features)), 4400 }; 4401 4402 static u8 hci_cc_func(struct hci_dev *hdev, const struct hci_cc *cc, 4403 struct sk_buff *skb) 4404 { 4405 void *data; 4406 4407 if (skb->len < cc->min_len) { 4408 bt_dev_err(hdev, "unexpected cc 0x%4.4x length: %u < %u", 4409 cc->op, skb->len, cc->min_len); 4410 return HCI_ERROR_UNSPECIFIED; 4411 } 4412 4413 /* Just warn if the length is over max_len size it still be possible to 4414 * partially parse the cc so leave to callback to decide if that is 4415 * acceptable. 4416 */ 4417 if (skb->len > cc->max_len) 4418 bt_dev_warn(hdev, "unexpected cc 0x%4.4x length: %u > %u", 4419 cc->op, skb->len, cc->max_len); 4420 4421 data = hci_cc_skb_pull(hdev, skb, cc->op, cc->min_len); 4422 if (!data) 4423 return HCI_ERROR_UNSPECIFIED; 4424 4425 return cc->func(hdev, data, skb); 4426 } 4427 4428 static void hci_cmd_complete_evt(struct hci_dev *hdev, void *data, 4429 struct sk_buff *skb, u16 *opcode, u8 *status, 4430 hci_req_complete_t *req_complete, 4431 hci_req_complete_skb_t *req_complete_skb) 4432 { 4433 struct hci_ev_cmd_complete *ev = data; 4434 int i; 4435 4436 *opcode = __le16_to_cpu(ev->opcode); 4437 4438 bt_dev_dbg(hdev, "opcode 0x%4.4x", *opcode); 4439 4440 for (i = 0; i < ARRAY_SIZE(hci_cc_table); i++) { 4441 if (hci_cc_table[i].op == *opcode) { 4442 *status = hci_cc_func(hdev, &hci_cc_table[i], skb); 4443 break; 4444 } 4445 } 4446 4447 if (i == ARRAY_SIZE(hci_cc_table)) { 4448 if (!skb->len) { 4449 bt_dev_err(hdev, "Unexpected cc 0x%4.4x with no status", 4450 *opcode); 4451 *status = HCI_ERROR_UNSPECIFIED; 4452 return; 4453 } 4454 4455 /* Unknown opcode, assume byte 0 contains the status, so 4456 * that e.g. __hci_cmd_sync() properly returns errors 4457 * for vendor specific commands send by HCI drivers. 4458 * If a vendor doesn't actually follow this convention we may 4459 * need to introduce a vendor CC table in order to properly set 4460 * the status. 4461 */ 4462 *status = skb->data[0]; 4463 } 4464 4465 handle_cmd_cnt_and_timer(hdev, ev->ncmd); 4466 4467 hci_req_cmd_complete(hdev, *opcode, *status, req_complete, 4468 req_complete_skb); 4469 4470 if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) { 4471 bt_dev_err(hdev, 4472 "unexpected event for opcode 0x%4.4x", *opcode); 4473 return; 4474 } 4475 4476 if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q)) 4477 queue_work(hdev->workqueue, &hdev->cmd_work); 4478 } 4479 4480 static void hci_cs_le_create_cis(struct hci_dev *hdev, u8 status) 4481 { 4482 struct hci_cp_le_create_cis *cp; 4483 bool pending = false; 4484 int i; 4485 4486 bt_dev_dbg(hdev, "status 0x%2.2x", status); 4487 4488 if (!status) 4489 return; 4490 4491 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CIS); 4492 if (!cp) 4493 return; 4494 4495 hci_dev_lock(hdev); 4496 4497 /* Remove connection if command failed */ 4498 for (i = 0; i < cp->num_cis; i++) { 4499 struct hci_conn *conn; 4500 u16 handle; 4501 4502 handle = __le16_to_cpu(cp->cis[i].cis_handle); 4503 4504 conn = hci_conn_hash_lookup_handle(hdev, handle); 4505 if (conn) { 4506 if (test_and_clear_bit(HCI_CONN_CREATE_CIS, 4507 &conn->flags)) 4508 pending = true; 4509 conn->state = BT_CLOSED; 4510 hci_connect_cfm(conn, status); 4511 hci_conn_del(conn); 4512 } 4513 } 4514 cp->num_cis = 0; 4515 4516 if (pending) 4517 hci_le_create_cis_pending(hdev); 4518 4519 hci_dev_unlock(hdev); 4520 } 4521 4522 #define HCI_CS(_op, _func) \ 4523 { \ 4524 .op = _op, \ 4525 .func = _func, \ 4526 } 4527 4528 static const struct hci_cs { 4529 u16 op; 4530 void (*func)(struct hci_dev *hdev, __u8 status); 4531 } hci_cs_table[] = { 4532 HCI_CS(HCI_OP_INQUIRY, hci_cs_inquiry), 4533 HCI_CS(HCI_OP_CREATE_CONN, hci_cs_create_conn), 4534 HCI_CS(HCI_OP_DISCONNECT, hci_cs_disconnect), 4535 HCI_CS(HCI_OP_ADD_SCO, hci_cs_add_sco), 4536 HCI_CS(HCI_OP_AUTH_REQUESTED, hci_cs_auth_requested), 4537 HCI_CS(HCI_OP_SET_CONN_ENCRYPT, hci_cs_set_conn_encrypt), 4538 HCI_CS(HCI_OP_REMOTE_NAME_REQ, hci_cs_remote_name_req), 4539 HCI_CS(HCI_OP_READ_REMOTE_FEATURES, hci_cs_read_remote_features), 4540 HCI_CS(HCI_OP_READ_REMOTE_EXT_FEATURES, 4541 hci_cs_read_remote_ext_features), 4542 HCI_CS(HCI_OP_SETUP_SYNC_CONN, hci_cs_setup_sync_conn), 4543 HCI_CS(HCI_OP_ENHANCED_SETUP_SYNC_CONN, 4544 hci_cs_enhanced_setup_sync_conn), 4545 HCI_CS(HCI_OP_SNIFF_MODE, hci_cs_sniff_mode), 4546 HCI_CS(HCI_OP_EXIT_SNIFF_MODE, hci_cs_exit_sniff_mode), 4547 HCI_CS(HCI_OP_SWITCH_ROLE, hci_cs_switch_role), 4548 HCI_CS(HCI_OP_LE_CREATE_CONN, hci_cs_le_create_conn), 4549 HCI_CS(HCI_OP_LE_READ_REMOTE_FEATURES, hci_cs_le_read_remote_features), 4550 HCI_CS(HCI_OP_LE_START_ENC, hci_cs_le_start_enc), 4551 HCI_CS(HCI_OP_LE_SET_PHY, hci_cs_le_set_phy), 4552 HCI_CS(HCI_OP_LE_EXT_CREATE_CONN, hci_cs_le_ext_create_conn), 4553 HCI_CS(HCI_OP_LE_CREATE_CIS, hci_cs_le_create_cis), 4554 HCI_CS(HCI_OP_LE_CREATE_BIG, hci_cs_le_create_big), 4555 HCI_CS(HCI_OP_LE_READ_ALL_REMOTE_FEATURES, 4556 hci_cs_le_read_all_remote_features), 4557 }; 4558 4559 static void hci_cmd_status_evt(struct hci_dev *hdev, void *data, 4560 struct sk_buff *skb, u16 *opcode, u8 *status, 4561 hci_req_complete_t *req_complete, 4562 hci_req_complete_skb_t *req_complete_skb) 4563 { 4564 struct hci_ev_cmd_status *ev = data; 4565 int i; 4566 4567 *opcode = __le16_to_cpu(ev->opcode); 4568 *status = ev->status; 4569 4570 bt_dev_dbg(hdev, "opcode 0x%4.4x", *opcode); 4571 4572 for (i = 0; i < ARRAY_SIZE(hci_cs_table); i++) { 4573 if (hci_cs_table[i].op == *opcode) { 4574 hci_cs_table[i].func(hdev, ev->status); 4575 break; 4576 } 4577 } 4578 4579 handle_cmd_cnt_and_timer(hdev, ev->ncmd); 4580 4581 /* Indicate request completion if the command failed. Also, if 4582 * we're not waiting for a special event and we get a success 4583 * command status we should try to flag the request as completed 4584 * (since for this kind of commands there will not be a command 4585 * complete event). 4586 */ 4587 if (ev->status || (hdev->req_skb && !hci_skb_event(hdev->req_skb))) { 4588 hci_req_cmd_complete(hdev, *opcode, ev->status, req_complete, 4589 req_complete_skb); 4590 if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) { 4591 bt_dev_err(hdev, "unexpected event for opcode 0x%4.4x", 4592 *opcode); 4593 return; 4594 } 4595 } 4596 4597 if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q)) 4598 queue_work(hdev->workqueue, &hdev->cmd_work); 4599 } 4600 4601 static void hci_hardware_error_evt(struct hci_dev *hdev, void *data, 4602 struct sk_buff *skb) 4603 { 4604 struct hci_ev_hardware_error *ev = data; 4605 4606 bt_dev_dbg(hdev, "code 0x%2.2x", ev->code); 4607 4608 hdev->hw_error_code = ev->code; 4609 4610 queue_work(hdev->req_workqueue, &hdev->error_reset); 4611 } 4612 4613 static void hci_role_change_evt(struct hci_dev *hdev, void *data, 4614 struct sk_buff *skb) 4615 { 4616 struct hci_ev_role_change *ev = data; 4617 struct hci_conn *conn; 4618 4619 bt_dev_dbg(hdev, "status 0x%2.2x", ev->status); 4620 4621 hci_dev_lock(hdev); 4622 4623 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr); 4624 if (conn) { 4625 if (!ev->status) 4626 conn->role = ev->role; 4627 4628 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags); 4629 4630 hci_role_switch_cfm(conn, ev->status, ev->role); 4631 } 4632 4633 hci_dev_unlock(hdev); 4634 } 4635 4636 static void hci_num_comp_pkts_evt(struct hci_dev *hdev, void *data, 4637 struct sk_buff *skb) 4638 { 4639 struct hci_ev_num_comp_pkts *ev = data; 4640 int i; 4641 4642 if (!hci_ev_skb_pull(hdev, skb, HCI_EV_NUM_COMP_PKTS, 4643 flex_array_size(ev, handles, ev->num))) 4644 return; 4645 4646 bt_dev_dbg(hdev, "num %d", ev->num); 4647 4648 hci_dev_lock(hdev); 4649 4650 for (i = 0; i < ev->num; i++) { 4651 struct hci_comp_pkts_info *info = &ev->handles[i]; 4652 struct hci_conn *conn; 4653 __u16 handle, count; 4654 unsigned int i; 4655 4656 handle = __le16_to_cpu(info->handle); 4657 count = __le16_to_cpu(info->count); 4658 4659 conn = hci_conn_hash_lookup_handle(hdev, handle); 4660 if (!conn) 4661 continue; 4662 4663 /* Check if there is really enough packets outstanding before 4664 * attempting to decrease the sent counter otherwise it could 4665 * underflow.. 4666 */ 4667 if (conn->sent >= count) { 4668 conn->sent -= count; 4669 } else { 4670 bt_dev_warn(hdev, "hcon %p sent %u < count %u", 4671 conn, conn->sent, count); 4672 conn->sent = 0; 4673 } 4674 4675 for (i = 0; i < count; ++i) 4676 hci_conn_tx_dequeue(conn); 4677 4678 switch (conn->type) { 4679 case ACL_LINK: 4680 hdev->acl_cnt += count; 4681 if (hdev->acl_cnt > hdev->acl_pkts) 4682 hdev->acl_cnt = hdev->acl_pkts; 4683 break; 4684 4685 case LE_LINK: 4686 if (hdev->le_pkts) { 4687 hdev->le_cnt += count; 4688 if (hdev->le_cnt > hdev->le_pkts) 4689 hdev->le_cnt = hdev->le_pkts; 4690 } else { 4691 hdev->acl_cnt += count; 4692 if (hdev->acl_cnt > hdev->acl_pkts) 4693 hdev->acl_cnt = hdev->acl_pkts; 4694 } 4695 break; 4696 4697 case SCO_LINK: 4698 case ESCO_LINK: 4699 hdev->sco_cnt += count; 4700 if (hdev->sco_cnt > hdev->sco_pkts) 4701 hdev->sco_cnt = hdev->sco_pkts; 4702 4703 break; 4704 4705 case CIS_LINK: 4706 case BIS_LINK: 4707 case PA_LINK: 4708 hdev->iso_cnt += count; 4709 if (hdev->iso_cnt > hdev->iso_pkts) 4710 hdev->iso_cnt = hdev->iso_pkts; 4711 break; 4712 4713 default: 4714 bt_dev_err(hdev, "unknown type %d conn %p", 4715 conn->type, conn); 4716 break; 4717 } 4718 } 4719 4720 queue_work(hdev->workqueue, &hdev->tx_work); 4721 4722 hci_dev_unlock(hdev); 4723 } 4724 4725 static void hci_mode_change_evt(struct hci_dev *hdev, void *data, 4726 struct sk_buff *skb) 4727 { 4728 struct hci_ev_mode_change *ev = data; 4729 struct hci_conn *conn; 4730 4731 bt_dev_dbg(hdev, "status 0x%2.2x", ev->status); 4732 4733 hci_dev_lock(hdev); 4734 4735 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle)); 4736 if (conn) { 4737 conn->mode = ev->mode; 4738 4739 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND, 4740 &conn->flags)) { 4741 assign_bit(HCI_CONN_POWER_SAVE, &conn->flags, 4742 conn->mode == HCI_CM_ACTIVE); 4743 } 4744 4745 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags)) 4746 hci_sco_setup(conn, ev->status); 4747 } 4748 4749 hci_dev_unlock(hdev); 4750 } 4751 4752 static void hci_pin_code_request_evt(struct hci_dev *hdev, void *data, 4753 struct sk_buff *skb) 4754 { 4755 struct hci_ev_pin_code_req *ev = data; 4756 struct hci_conn *conn; 4757 4758 bt_dev_dbg(hdev, ""); 4759 4760 hci_dev_lock(hdev); 4761 4762 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr); 4763 if (!conn) 4764 goto unlock; 4765 4766 if (conn->state == BT_CONNECTED) { 4767 hci_conn_hold(conn); 4768 conn->disc_timeout = HCI_PAIRING_TIMEOUT; 4769 hci_conn_drop(conn); 4770 } 4771 4772 if (!hci_dev_test_flag(hdev, HCI_BONDABLE) && 4773 !test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags)) { 4774 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY, 4775 sizeof(ev->bdaddr), &ev->bdaddr); 4776 } else if (hci_dev_test_flag(hdev, HCI_MGMT)) { 4777 u8 secure; 4778 4779 if (conn->pending_sec_level == BT_SECURITY_HIGH) 4780 secure = 1; 4781 else 4782 secure = 0; 4783 4784 mgmt_pin_code_request(hdev, &ev->bdaddr, secure); 4785 } 4786 4787 unlock: 4788 hci_dev_unlock(hdev); 4789 } 4790 4791 static void conn_set_key(struct hci_conn *conn, u8 key_type, u8 pin_len) 4792 { 4793 if (key_type == HCI_LK_CHANGED_COMBINATION) 4794 return; 4795 4796 conn->pin_length = pin_len; 4797 conn->key_type = key_type; 4798 4799 switch (key_type) { 4800 case HCI_LK_LOCAL_UNIT: 4801 case HCI_LK_REMOTE_UNIT: 4802 case HCI_LK_DEBUG_COMBINATION: 4803 return; 4804 case HCI_LK_COMBINATION: 4805 if (pin_len == 16) 4806 conn->pending_sec_level = BT_SECURITY_HIGH; 4807 else 4808 conn->pending_sec_level = BT_SECURITY_MEDIUM; 4809 break; 4810 case HCI_LK_UNAUTH_COMBINATION_P192: 4811 case HCI_LK_UNAUTH_COMBINATION_P256: 4812 conn->pending_sec_level = BT_SECURITY_MEDIUM; 4813 break; 4814 case HCI_LK_AUTH_COMBINATION_P192: 4815 conn->pending_sec_level = BT_SECURITY_HIGH; 4816 break; 4817 case HCI_LK_AUTH_COMBINATION_P256: 4818 conn->pending_sec_level = BT_SECURITY_FIPS; 4819 break; 4820 } 4821 } 4822 4823 static void hci_link_key_request_evt(struct hci_dev *hdev, void *data, 4824 struct sk_buff *skb) 4825 { 4826 struct hci_ev_link_key_req *ev = data; 4827 struct hci_cp_link_key_reply cp; 4828 struct hci_conn *conn; 4829 struct link_key *key; 4830 4831 bt_dev_dbg(hdev, ""); 4832 4833 if (!hci_dev_test_flag(hdev, HCI_MGMT)) 4834 return; 4835 4836 hci_dev_lock(hdev); 4837 4838 key = hci_find_link_key(hdev, &ev->bdaddr); 4839 if (!key) { 4840 bt_dev_dbg(hdev, "link key not found for %pMR", &ev->bdaddr); 4841 goto not_found; 4842 } 4843 4844 bt_dev_dbg(hdev, "found key type %u for %pMR", key->type, &ev->bdaddr); 4845 4846 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr); 4847 if (conn) { 4848 clear_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags); 4849 4850 if ((key->type == HCI_LK_UNAUTH_COMBINATION_P192 || 4851 key->type == HCI_LK_UNAUTH_COMBINATION_P256) && 4852 conn->auth_type != 0xff && (conn->auth_type & 0x01)) { 4853 bt_dev_dbg(hdev, "ignoring unauthenticated key"); 4854 goto not_found; 4855 } 4856 4857 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 && 4858 (conn->pending_sec_level == BT_SECURITY_HIGH || 4859 conn->pending_sec_level == BT_SECURITY_FIPS)) { 4860 bt_dev_dbg(hdev, "ignoring key unauthenticated for high security"); 4861 goto not_found; 4862 } 4863 4864 conn_set_key(conn, key->type, key->pin_len); 4865 } 4866 4867 bacpy(&cp.bdaddr, &ev->bdaddr); 4868 memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE); 4869 4870 hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp); 4871 4872 hci_dev_unlock(hdev); 4873 4874 return; 4875 4876 not_found: 4877 hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr); 4878 hci_dev_unlock(hdev); 4879 } 4880 4881 static void hci_link_key_notify_evt(struct hci_dev *hdev, void *data, 4882 struct sk_buff *skb) 4883 { 4884 struct hci_ev_link_key_notify *ev = data; 4885 struct hci_conn *conn; 4886 struct link_key *key; 4887 bool persistent; 4888 u8 pin_len = 0; 4889 4890 bt_dev_dbg(hdev, ""); 4891 4892 hci_dev_lock(hdev); 4893 4894 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr); 4895 if (!conn) 4896 goto unlock; 4897 4898 /* Ignore NULL link key against CVE-2020-26555 */ 4899 if (!crypto_memneq(ev->link_key, ZERO_KEY, HCI_LINK_KEY_SIZE)) { 4900 bt_dev_dbg(hdev, "Ignore NULL link key (ZERO KEY) for %pMR", 4901 &ev->bdaddr); 4902 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE); 4903 hci_conn_drop(conn); 4904 goto unlock; 4905 } 4906 4907 hci_conn_hold(conn); 4908 conn->disc_timeout = HCI_DISCONN_TIMEOUT; 4909 hci_conn_drop(conn); 4910 4911 set_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags); 4912 conn_set_key(conn, ev->key_type, conn->pin_length); 4913 4914 if (!hci_dev_test_flag(hdev, HCI_MGMT)) 4915 goto unlock; 4916 4917 key = hci_add_link_key(hdev, conn, &ev->bdaddr, ev->link_key, 4918 ev->key_type, pin_len, &persistent); 4919 if (!key) 4920 goto unlock; 4921 4922 /* Update connection information since adding the key will have 4923 * fixed up the type in the case of changed combination keys. 4924 */ 4925 if (ev->key_type == HCI_LK_CHANGED_COMBINATION) 4926 conn_set_key(conn, key->type, key->pin_len); 4927 4928 mgmt_new_link_key(hdev, key, persistent); 4929 4930 /* Keep debug keys around only if the HCI_KEEP_DEBUG_KEYS flag 4931 * is set. If it's not set simply remove the key from the kernel 4932 * list (we've still notified user space about it but with 4933 * store_hint being 0). 4934 */ 4935 if (key->type == HCI_LK_DEBUG_COMBINATION && 4936 !hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) { 4937 list_del_rcu(&key->list); 4938 kfree_rcu(key, rcu); 4939 goto unlock; 4940 } 4941 4942 assign_bit(HCI_CONN_FLUSH_KEY, &conn->flags, !persistent); 4943 4944 unlock: 4945 hci_dev_unlock(hdev); 4946 } 4947 4948 static void hci_clock_offset_evt(struct hci_dev *hdev, void *data, 4949 struct sk_buff *skb) 4950 { 4951 struct hci_ev_clock_offset *ev = data; 4952 struct hci_conn *conn; 4953 4954 bt_dev_dbg(hdev, "status 0x%2.2x", ev->status); 4955 4956 hci_dev_lock(hdev); 4957 4958 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle)); 4959 if (conn && !ev->status) { 4960 struct inquiry_entry *ie; 4961 4962 ie = hci_inquiry_cache_lookup(hdev, &conn->dst); 4963 if (ie) { 4964 ie->data.clock_offset = ev->clock_offset; 4965 ie->timestamp = jiffies; 4966 } 4967 } 4968 4969 hci_dev_unlock(hdev); 4970 } 4971 4972 static void hci_pkt_type_change_evt(struct hci_dev *hdev, void *data, 4973 struct sk_buff *skb) 4974 { 4975 struct hci_ev_pkt_type_change *ev = data; 4976 struct hci_conn *conn; 4977 4978 bt_dev_dbg(hdev, "status 0x%2.2x", ev->status); 4979 4980 hci_dev_lock(hdev); 4981 4982 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle)); 4983 if (conn && !ev->status) 4984 conn->pkt_type = __le16_to_cpu(ev->pkt_type); 4985 4986 hci_dev_unlock(hdev); 4987 } 4988 4989 static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, void *data, 4990 struct sk_buff *skb) 4991 { 4992 struct hci_ev_pscan_rep_mode *ev = data; 4993 struct inquiry_entry *ie; 4994 4995 bt_dev_dbg(hdev, ""); 4996 4997 hci_dev_lock(hdev); 4998 4999 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr); 5000 if (ie) { 5001 ie->data.pscan_rep_mode = ev->pscan_rep_mode; 5002 ie->timestamp = jiffies; 5003 } 5004 5005 hci_dev_unlock(hdev); 5006 } 5007 5008 static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, void *edata, 5009 struct sk_buff *skb) 5010 { 5011 struct hci_ev_inquiry_result_rssi *ev = edata; 5012 struct inquiry_data data; 5013 int i; 5014 5015 bt_dev_dbg(hdev, "num_rsp %d", ev->num); 5016 5017 if (!ev->num) 5018 return; 5019 5020 if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) 5021 return; 5022 5023 hci_dev_lock(hdev); 5024 5025 if (skb->len == array_size(ev->num, 5026 sizeof(struct inquiry_info_rssi_pscan))) { 5027 struct inquiry_info_rssi_pscan *info; 5028 5029 for (i = 0; i < ev->num; i++) { 5030 u32 flags; 5031 5032 info = hci_ev_skb_pull(hdev, skb, 5033 HCI_EV_INQUIRY_RESULT_WITH_RSSI, 5034 sizeof(*info)); 5035 if (!info) { 5036 bt_dev_err(hdev, "Malformed HCI Event: 0x%2.2x", 5037 HCI_EV_INQUIRY_RESULT_WITH_RSSI); 5038 goto unlock; 5039 } 5040 5041 bacpy(&data.bdaddr, &info->bdaddr); 5042 data.pscan_rep_mode = info->pscan_rep_mode; 5043 data.pscan_period_mode = info->pscan_period_mode; 5044 data.pscan_mode = info->pscan_mode; 5045 memcpy(data.dev_class, info->dev_class, 3); 5046 data.clock_offset = info->clock_offset; 5047 data.rssi = info->rssi; 5048 data.ssp_mode = 0x00; 5049 5050 flags = hci_inquiry_cache_update(hdev, &data, false); 5051 5052 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00, 5053 info->dev_class, info->rssi, 5054 flags, NULL, 0, NULL, 0, 0); 5055 } 5056 } else if (skb->len == array_size(ev->num, 5057 sizeof(struct inquiry_info_rssi))) { 5058 struct inquiry_info_rssi *info; 5059 5060 for (i = 0; i < ev->num; i++) { 5061 u32 flags; 5062 5063 info = hci_ev_skb_pull(hdev, skb, 5064 HCI_EV_INQUIRY_RESULT_WITH_RSSI, 5065 sizeof(*info)); 5066 if (!info) { 5067 bt_dev_err(hdev, "Malformed HCI Event: 0x%2.2x", 5068 HCI_EV_INQUIRY_RESULT_WITH_RSSI); 5069 goto unlock; 5070 } 5071 5072 bacpy(&data.bdaddr, &info->bdaddr); 5073 data.pscan_rep_mode = info->pscan_rep_mode; 5074 data.pscan_period_mode = info->pscan_period_mode; 5075 data.pscan_mode = 0x00; 5076 memcpy(data.dev_class, info->dev_class, 3); 5077 data.clock_offset = info->clock_offset; 5078 data.rssi = info->rssi; 5079 data.ssp_mode = 0x00; 5080 5081 flags = hci_inquiry_cache_update(hdev, &data, false); 5082 5083 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00, 5084 info->dev_class, info->rssi, 5085 flags, NULL, 0, NULL, 0, 0); 5086 } 5087 } else { 5088 bt_dev_err(hdev, "Malformed HCI Event: 0x%2.2x", 5089 HCI_EV_INQUIRY_RESULT_WITH_RSSI); 5090 } 5091 unlock: 5092 hci_dev_unlock(hdev); 5093 } 5094 5095 static void hci_remote_ext_features_evt(struct hci_dev *hdev, void *data, 5096 struct sk_buff *skb) 5097 { 5098 struct hci_ev_remote_ext_features *ev = data; 5099 struct hci_conn *conn; 5100 5101 bt_dev_dbg(hdev, "status 0x%2.2x", ev->status); 5102 5103 hci_dev_lock(hdev); 5104 5105 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle)); 5106 if (!conn) 5107 goto unlock; 5108 5109 if (ev->page < HCI_MAX_PAGES) 5110 memcpy(conn->features[ev->page], ev->features, 8); 5111 5112 if (!ev->status && ev->page == 0x01) { 5113 struct inquiry_entry *ie; 5114 5115 ie = hci_inquiry_cache_lookup(hdev, &conn->dst); 5116 if (ie) 5117 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP); 5118 5119 if (ev->features[0] & LMP_HOST_SSP) { 5120 set_bit(HCI_CONN_SSP_ENABLED, &conn->flags); 5121 } else { 5122 /* It is mandatory by the Bluetooth specification that 5123 * Extended Inquiry Results are only used when Secure 5124 * Simple Pairing is enabled, but some devices violate 5125 * this. 5126 * 5127 * To make these devices work, the internal SSP 5128 * enabled flag needs to be cleared if the remote host 5129 * features do not indicate SSP support */ 5130 clear_bit(HCI_CONN_SSP_ENABLED, &conn->flags); 5131 } 5132 5133 if (ev->features[0] & LMP_HOST_SC) 5134 set_bit(HCI_CONN_SC_ENABLED, &conn->flags); 5135 } 5136 5137 if (conn->state != BT_CONFIG) 5138 goto unlock; 5139 5140 if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) { 5141 struct hci_cp_remote_name_req cp; 5142 memset(&cp, 0, sizeof(cp)); 5143 bacpy(&cp.bdaddr, &conn->dst); 5144 cp.pscan_rep_mode = 0x02; 5145 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp); 5146 } else { 5147 mgmt_device_connected(hdev, conn, NULL, 0); 5148 } 5149 5150 if (!hci_outgoing_auth_needed(hdev, conn)) { 5151 conn->state = BT_CONNECTED; 5152 hci_connect_cfm(conn, ev->status); 5153 hci_conn_drop(conn); 5154 } 5155 5156 unlock: 5157 hci_dev_unlock(hdev); 5158 } 5159 5160 static void hci_sync_conn_complete_evt(struct hci_dev *hdev, void *data, 5161 struct sk_buff *skb) 5162 { 5163 struct hci_ev_sync_conn_complete *ev = data; 5164 struct hci_conn *conn; 5165 u8 status = ev->status; 5166 5167 switch (ev->link_type) { 5168 case SCO_LINK: 5169 case ESCO_LINK: 5170 break; 5171 default: 5172 /* As per Core 5.3 Vol 4 Part E 7.7.35 (p.2219), Link_Type 5173 * for HCI_Synchronous_Connection_Complete is limited to 5174 * either SCO or eSCO 5175 */ 5176 bt_dev_err(hdev, "Ignoring connect complete event for invalid link type"); 5177 return; 5178 } 5179 5180 bt_dev_dbg(hdev, "status 0x%2.2x", status); 5181 5182 hci_dev_lock(hdev); 5183 hci_store_wake_reason(hdev, &ev->bdaddr, BDADDR_BREDR); 5184 5185 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr); 5186 if (!conn) { 5187 if (ev->link_type == ESCO_LINK) 5188 goto unlock; 5189 5190 /* When the link type in the event indicates SCO connection 5191 * and lookup of the connection object fails, then check 5192 * if an eSCO connection object exists. 5193 * 5194 * The core limits the synchronous connections to either 5195 * SCO or eSCO. The eSCO connection is preferred and tried 5196 * to be setup first and until successfully established, 5197 * the link type will be hinted as eSCO. 5198 */ 5199 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr); 5200 if (!conn) 5201 goto unlock; 5202 } 5203 5204 /* The HCI_Synchronous_Connection_Complete event is only sent once per connection. 5205 * Processing it more than once per connection can corrupt kernel memory. 5206 * 5207 * As the connection handle is set here for the first time, it indicates 5208 * whether the connection is already set up. 5209 */ 5210 if (!HCI_CONN_HANDLE_UNSET(conn->handle)) { 5211 bt_dev_err(hdev, "Ignoring HCI_Sync_Conn_Complete event for existing connection"); 5212 goto unlock; 5213 } 5214 5215 switch (status) { 5216 case 0x00: 5217 status = hci_conn_set_handle(conn, __le16_to_cpu(ev->handle)); 5218 if (status) { 5219 conn->state = BT_CLOSED; 5220 break; 5221 } 5222 5223 conn->state = BT_CONNECTED; 5224 conn->type = ev->link_type; 5225 5226 hci_debugfs_create_conn(conn); 5227 hci_conn_add_sysfs(conn); 5228 break; 5229 5230 case 0x10: /* Connection Accept Timeout */ 5231 case 0x0d: /* Connection Rejected due to Limited Resources */ 5232 case 0x11: /* Unsupported Feature or Parameter Value */ 5233 case 0x1c: /* SCO interval rejected */ 5234 case 0x1a: /* Unsupported Remote Feature */ 5235 case 0x1e: /* Invalid LMP Parameters */ 5236 case 0x1f: /* Unspecified error */ 5237 case 0x20: /* Unsupported LMP Parameter value */ 5238 if (conn->out) { 5239 conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) | 5240 (hdev->esco_type & EDR_ESCO_MASK); 5241 if (hci_setup_sync(conn, conn->parent->handle)) 5242 goto unlock; 5243 } 5244 fallthrough; 5245 5246 default: 5247 conn->state = BT_CLOSED; 5248 break; 5249 } 5250 5251 bt_dev_dbg(hdev, "SCO connected with air mode: %02x", ev->air_mode); 5252 /* Notify only in case of SCO over HCI transport data path which 5253 * is zero and non-zero value shall be non-HCI transport data path 5254 */ 5255 if (conn->codec.data_path == 0 && hdev->notify) { 5256 switch (ev->air_mode) { 5257 case 0x02: 5258 hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_CVSD); 5259 break; 5260 case 0x03: 5261 hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_TRANSP); 5262 break; 5263 } 5264 } 5265 5266 hci_connect_cfm(conn, status); 5267 if (status) 5268 hci_conn_del(conn); 5269 5270 unlock: 5271 hci_dev_unlock(hdev); 5272 } 5273 5274 static inline size_t eir_get_length(u8 *eir, size_t eir_len) 5275 { 5276 size_t parsed = 0; 5277 5278 while (parsed < eir_len) { 5279 u8 field_len = eir[0]; 5280 5281 if (field_len == 0) 5282 return parsed; 5283 5284 parsed += field_len + 1; 5285 eir += field_len + 1; 5286 } 5287 5288 return eir_len; 5289 } 5290 5291 static void hci_extended_inquiry_result_evt(struct hci_dev *hdev, void *edata, 5292 struct sk_buff *skb) 5293 { 5294 struct hci_ev_ext_inquiry_result *ev = edata; 5295 struct inquiry_data data; 5296 size_t eir_len; 5297 int i; 5298 5299 if (!hci_ev_skb_pull(hdev, skb, HCI_EV_EXTENDED_INQUIRY_RESULT, 5300 flex_array_size(ev, info, ev->num))) 5301 return; 5302 5303 bt_dev_dbg(hdev, "num %d", ev->num); 5304 5305 if (!ev->num) 5306 return; 5307 5308 if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) 5309 return; 5310 5311 hci_dev_lock(hdev); 5312 5313 for (i = 0; i < ev->num; i++) { 5314 struct extended_inquiry_info *info = &ev->info[i]; 5315 u32 flags; 5316 bool name_known; 5317 5318 bacpy(&data.bdaddr, &info->bdaddr); 5319 data.pscan_rep_mode = info->pscan_rep_mode; 5320 data.pscan_period_mode = info->pscan_period_mode; 5321 data.pscan_mode = 0x00; 5322 memcpy(data.dev_class, info->dev_class, 3); 5323 data.clock_offset = info->clock_offset; 5324 data.rssi = info->rssi; 5325 data.ssp_mode = 0x01; 5326 5327 if (hci_dev_test_flag(hdev, HCI_MGMT)) 5328 name_known = eir_get_data(info->data, 5329 sizeof(info->data), 5330 EIR_NAME_COMPLETE, NULL); 5331 else 5332 name_known = true; 5333 5334 flags = hci_inquiry_cache_update(hdev, &data, name_known); 5335 5336 eir_len = eir_get_length(info->data, sizeof(info->data)); 5337 5338 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00, 5339 info->dev_class, info->rssi, 5340 flags, info->data, eir_len, NULL, 0, 0); 5341 } 5342 5343 hci_dev_unlock(hdev); 5344 } 5345 5346 static void hci_key_refresh_complete_evt(struct hci_dev *hdev, void *data, 5347 struct sk_buff *skb) 5348 { 5349 struct hci_ev_key_refresh_complete *ev = data; 5350 struct hci_conn *conn; 5351 5352 bt_dev_dbg(hdev, "status 0x%2.2x handle 0x%4.4x", ev->status, 5353 __le16_to_cpu(ev->handle)); 5354 5355 hci_dev_lock(hdev); 5356 5357 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle)); 5358 if (!conn) 5359 goto unlock; 5360 5361 /* For BR/EDR the necessary steps are taken through the 5362 * auth_complete event. 5363 */ 5364 if (conn->type != LE_LINK) 5365 goto unlock; 5366 5367 if (!ev->status) { 5368 bool sec_level_changed = 5369 conn->sec_level != conn->pending_sec_level; 5370 5371 conn->sec_level = conn->pending_sec_level; 5372 if (sec_level_changed) 5373 mgmt_security_level_changed(conn); 5374 } 5375 5376 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags); 5377 5378 if (ev->status && conn->state == BT_CONNECTED) { 5379 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE); 5380 hci_conn_drop(conn); 5381 goto unlock; 5382 } 5383 5384 if (conn->state == BT_CONFIG) { 5385 if (!ev->status) 5386 conn->state = BT_CONNECTED; 5387 5388 hci_connect_cfm(conn, ev->status); 5389 hci_conn_drop(conn); 5390 } else { 5391 hci_auth_cfm(conn, ev->status); 5392 5393 hci_conn_hold(conn); 5394 conn->disc_timeout = HCI_DISCONN_TIMEOUT; 5395 hci_conn_drop(conn); 5396 } 5397 5398 unlock: 5399 hci_dev_unlock(hdev); 5400 } 5401 5402 static u8 hci_get_auth_req(struct hci_conn *conn) 5403 { 5404 /* If remote requests no-bonding follow that lead */ 5405 if (conn->remote_auth == HCI_AT_NO_BONDING || 5406 conn->remote_auth == HCI_AT_NO_BONDING_MITM) 5407 return conn->remote_auth | (conn->auth_type & 0x01); 5408 5409 /* If both remote and local have enough IO capabilities, require 5410 * MITM protection 5411 */ 5412 if (conn->remote_cap != HCI_IO_NO_INPUT_OUTPUT && 5413 conn->io_capability != HCI_IO_NO_INPUT_OUTPUT) 5414 return conn->remote_auth | 0x01; 5415 5416 /* No MITM protection possible so ignore remote requirement */ 5417 return (conn->remote_auth & ~0x01) | (conn->auth_type & 0x01); 5418 } 5419 5420 static u8 bredr_oob_data_present(struct hci_conn *conn) 5421 { 5422 struct hci_dev *hdev = conn->hdev; 5423 struct oob_data *data; 5424 5425 data = hci_find_remote_oob_data(hdev, &conn->dst, BDADDR_BREDR); 5426 if (!data) 5427 return 0x00; 5428 5429 if (bredr_sc_enabled(hdev)) { 5430 /* When Secure Connections is enabled, then just 5431 * return the present value stored with the OOB 5432 * data. The stored value contains the right present 5433 * information. However it can only be trusted when 5434 * not in Secure Connection Only mode. 5435 */ 5436 if (!hci_dev_test_flag(hdev, HCI_SC_ONLY)) 5437 return data->present; 5438 5439 /* When Secure Connections Only mode is enabled, then 5440 * the P-256 values are required. If they are not 5441 * available, then do not declare that OOB data is 5442 * present. 5443 */ 5444 if (!crypto_memneq(data->rand256, ZERO_KEY, 16) || 5445 !crypto_memneq(data->hash256, ZERO_KEY, 16)) 5446 return 0x00; 5447 5448 return 0x02; 5449 } 5450 5451 /* When Secure Connections is not enabled or actually 5452 * not supported by the hardware, then check that if 5453 * P-192 data values are present. 5454 */ 5455 if (!crypto_memneq(data->rand192, ZERO_KEY, 16) || 5456 !crypto_memneq(data->hash192, ZERO_KEY, 16)) 5457 return 0x00; 5458 5459 return 0x01; 5460 } 5461 5462 static void hci_io_capa_request_evt(struct hci_dev *hdev, void *data, 5463 struct sk_buff *skb) 5464 { 5465 struct hci_ev_io_capa_request *ev = data; 5466 struct hci_conn *conn; 5467 5468 bt_dev_dbg(hdev, ""); 5469 5470 hci_dev_lock(hdev); 5471 5472 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr); 5473 if (!conn || !hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 5474 goto unlock; 5475 5476 /* Assume remote supports SSP since it has triggered this event */ 5477 set_bit(HCI_CONN_SSP_ENABLED, &conn->flags); 5478 5479 hci_conn_hold(conn); 5480 5481 if (!hci_dev_test_flag(hdev, HCI_MGMT)) 5482 goto unlock; 5483 5484 /* Allow pairing if we're pairable, the initiators of the 5485 * pairing or if the remote is not requesting bonding. 5486 */ 5487 if (hci_dev_test_flag(hdev, HCI_BONDABLE) || 5488 test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags) || 5489 (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) { 5490 struct hci_cp_io_capability_reply cp; 5491 5492 bacpy(&cp.bdaddr, &ev->bdaddr); 5493 /* Change the IO capability from KeyboardDisplay 5494 * to DisplayYesNo as it is not supported by BT spec. */ 5495 cp.capability = (conn->io_capability == 0x04) ? 5496 HCI_IO_DISPLAY_YESNO : conn->io_capability; 5497 5498 /* If we are initiators, there is no remote information yet */ 5499 if (conn->remote_auth == 0xff) { 5500 /* Request MITM protection if our IO caps allow it 5501 * except for the no-bonding case. 5502 */ 5503 if (conn->io_capability != HCI_IO_NO_INPUT_OUTPUT && 5504 conn->auth_type != HCI_AT_NO_BONDING) 5505 conn->auth_type |= 0x01; 5506 } else { 5507 conn->auth_type = hci_get_auth_req(conn); 5508 } 5509 5510 /* If we're not bondable, force one of the non-bondable 5511 * authentication requirement values. 5512 */ 5513 if (!hci_dev_test_flag(hdev, HCI_BONDABLE)) 5514 conn->auth_type &= HCI_AT_NO_BONDING_MITM; 5515 5516 cp.authentication = conn->auth_type; 5517 cp.oob_data = bredr_oob_data_present(conn); 5518 5519 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY, 5520 sizeof(cp), &cp); 5521 } else { 5522 struct hci_cp_io_capability_neg_reply cp; 5523 5524 bacpy(&cp.bdaddr, &ev->bdaddr); 5525 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED; 5526 5527 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY, 5528 sizeof(cp), &cp); 5529 } 5530 5531 unlock: 5532 hci_dev_unlock(hdev); 5533 } 5534 5535 static void hci_io_capa_reply_evt(struct hci_dev *hdev, void *data, 5536 struct sk_buff *skb) 5537 { 5538 struct hci_ev_io_capa_reply *ev = data; 5539 struct hci_conn *conn; 5540 5541 bt_dev_dbg(hdev, ""); 5542 5543 hci_dev_lock(hdev); 5544 5545 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr); 5546 if (!conn) 5547 goto unlock; 5548 5549 conn->remote_cap = ev->capability; 5550 conn->remote_auth = ev->authentication; 5551 5552 unlock: 5553 hci_dev_unlock(hdev); 5554 } 5555 5556 static void hci_user_confirm_request_evt(struct hci_dev *hdev, void *data, 5557 struct sk_buff *skb) 5558 { 5559 struct hci_ev_user_confirm_req *ev = data; 5560 int loc_mitm, rem_mitm, confirm_hint = 0; 5561 struct hci_conn *conn; 5562 5563 bt_dev_dbg(hdev, ""); 5564 5565 hci_dev_lock(hdev); 5566 5567 if (!hci_dev_test_flag(hdev, HCI_MGMT)) 5568 goto unlock; 5569 5570 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr); 5571 if (!conn) 5572 goto unlock; 5573 5574 loc_mitm = (conn->auth_type & 0x01); 5575 rem_mitm = (conn->remote_auth & 0x01); 5576 5577 /* If we require MITM but the remote device can't provide that 5578 * (it has NoInputNoOutput) then reject the confirmation 5579 * request. We check the security level here since it doesn't 5580 * necessarily match conn->auth_type. 5581 */ 5582 if (conn->pending_sec_level > BT_SECURITY_MEDIUM && 5583 conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) { 5584 bt_dev_dbg(hdev, "Rejecting request: remote device can't provide MITM"); 5585 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY, 5586 sizeof(ev->bdaddr), &ev->bdaddr); 5587 goto unlock; 5588 } 5589 5590 /* If no side requires MITM protection; use JUST_CFM method */ 5591 if ((!loc_mitm || conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) && 5592 (!rem_mitm || conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)) { 5593 5594 /* If we're not the initiator of request authorization and the 5595 * local IO capability is not NoInputNoOutput, use JUST_WORKS 5596 * method (mgmt_user_confirm with confirm_hint set to 1). 5597 */ 5598 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && 5599 conn->io_capability != HCI_IO_NO_INPUT_OUTPUT) { 5600 bt_dev_dbg(hdev, "Confirming auto-accept as acceptor"); 5601 confirm_hint = 1; 5602 goto confirm; 5603 } 5604 5605 /* If there already exists link key in local host, leave the 5606 * decision to user space since the remote device could be 5607 * legitimate or malicious. 5608 */ 5609 if (hci_find_link_key(hdev, &ev->bdaddr)) { 5610 bt_dev_dbg(hdev, "Local host already has link key"); 5611 confirm_hint = 1; 5612 goto confirm; 5613 } 5614 5615 BT_DBG("Auto-accept of user confirmation with %ums delay", 5616 hdev->auto_accept_delay); 5617 5618 if (hdev->auto_accept_delay > 0) { 5619 int delay = msecs_to_jiffies(hdev->auto_accept_delay); 5620 queue_delayed_work(conn->hdev->workqueue, 5621 &conn->auto_accept_work, delay); 5622 goto unlock; 5623 } 5624 5625 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY, 5626 sizeof(ev->bdaddr), &ev->bdaddr); 5627 goto unlock; 5628 } 5629 5630 confirm: 5631 mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0, 5632 le32_to_cpu(ev->passkey), confirm_hint); 5633 5634 unlock: 5635 hci_dev_unlock(hdev); 5636 } 5637 5638 static void hci_user_passkey_request_evt(struct hci_dev *hdev, void *data, 5639 struct sk_buff *skb) 5640 { 5641 struct hci_ev_user_passkey_req *ev = data; 5642 5643 bt_dev_dbg(hdev, ""); 5644 5645 if (hci_dev_test_flag(hdev, HCI_MGMT)) 5646 mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0); 5647 } 5648 5649 static void hci_user_passkey_notify_evt(struct hci_dev *hdev, void *data, 5650 struct sk_buff *skb) 5651 { 5652 struct hci_ev_user_passkey_notify *ev = data; 5653 struct hci_conn *conn; 5654 5655 bt_dev_dbg(hdev, ""); 5656 5657 hci_dev_lock(hdev); 5658 5659 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr); 5660 if (!conn) 5661 goto unlock; 5662 5663 conn->passkey_notify = __le32_to_cpu(ev->passkey); 5664 conn->passkey_entered = 0; 5665 5666 if (hci_dev_test_flag(hdev, HCI_MGMT)) 5667 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type, 5668 conn->dst_type, conn->passkey_notify, 5669 conn->passkey_entered); 5670 5671 unlock: 5672 hci_dev_unlock(hdev); 5673 } 5674 5675 static void hci_keypress_notify_evt(struct hci_dev *hdev, void *data, 5676 struct sk_buff *skb) 5677 { 5678 struct hci_ev_keypress_notify *ev = data; 5679 struct hci_conn *conn; 5680 5681 bt_dev_dbg(hdev, ""); 5682 5683 hci_dev_lock(hdev); 5684 5685 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr); 5686 if (!conn) 5687 goto unlock; 5688 5689 switch (ev->type) { 5690 case HCI_KEYPRESS_STARTED: 5691 conn->passkey_entered = 0; 5692 goto unlock; 5693 5694 case HCI_KEYPRESS_ENTERED: 5695 conn->passkey_entered++; 5696 break; 5697 5698 case HCI_KEYPRESS_ERASED: 5699 conn->passkey_entered--; 5700 break; 5701 5702 case HCI_KEYPRESS_CLEARED: 5703 conn->passkey_entered = 0; 5704 break; 5705 5706 case HCI_KEYPRESS_COMPLETED: 5707 goto unlock; 5708 } 5709 5710 if (hci_dev_test_flag(hdev, HCI_MGMT)) 5711 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type, 5712 conn->dst_type, conn->passkey_notify, 5713 conn->passkey_entered); 5714 5715 unlock: 5716 hci_dev_unlock(hdev); 5717 } 5718 5719 static void hci_simple_pair_complete_evt(struct hci_dev *hdev, void *data, 5720 struct sk_buff *skb) 5721 { 5722 struct hci_ev_simple_pair_complete *ev = data; 5723 struct hci_conn *conn; 5724 5725 bt_dev_dbg(hdev, ""); 5726 5727 hci_dev_lock(hdev); 5728 5729 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr); 5730 if (!conn || !hci_conn_ssp_enabled(conn)) 5731 goto unlock; 5732 5733 /* Reset the authentication requirement to unknown */ 5734 conn->remote_auth = 0xff; 5735 5736 /* To avoid duplicate auth_failed events to user space we check 5737 * the HCI_CONN_AUTH_PEND flag which will be set if we 5738 * initiated the authentication. A traditional auth_complete 5739 * event gets always produced as initiator and is also mapped to 5740 * the mgmt_auth_failed event */ 5741 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status) 5742 mgmt_auth_failed(conn, ev->status); 5743 5744 hci_conn_drop(conn); 5745 5746 unlock: 5747 hci_dev_unlock(hdev); 5748 } 5749 5750 static void hci_remote_host_features_evt(struct hci_dev *hdev, void *data, 5751 struct sk_buff *skb) 5752 { 5753 struct hci_ev_remote_host_features *ev = data; 5754 struct inquiry_entry *ie; 5755 struct hci_conn *conn; 5756 5757 bt_dev_dbg(hdev, ""); 5758 5759 hci_dev_lock(hdev); 5760 5761 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr); 5762 if (conn) 5763 memcpy(conn->features[1], ev->features, 8); 5764 5765 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr); 5766 if (ie) 5767 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP); 5768 5769 hci_dev_unlock(hdev); 5770 } 5771 5772 static void hci_remote_oob_data_request_evt(struct hci_dev *hdev, void *edata, 5773 struct sk_buff *skb) 5774 { 5775 struct hci_ev_remote_oob_data_request *ev = edata; 5776 struct oob_data *data; 5777 5778 bt_dev_dbg(hdev, ""); 5779 5780 hci_dev_lock(hdev); 5781 5782 if (!hci_dev_test_flag(hdev, HCI_MGMT)) 5783 goto unlock; 5784 5785 data = hci_find_remote_oob_data(hdev, &ev->bdaddr, BDADDR_BREDR); 5786 if (!data) { 5787 struct hci_cp_remote_oob_data_neg_reply cp; 5788 5789 bacpy(&cp.bdaddr, &ev->bdaddr); 5790 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY, 5791 sizeof(cp), &cp); 5792 goto unlock; 5793 } 5794 5795 if (bredr_sc_enabled(hdev)) { 5796 struct hci_cp_remote_oob_ext_data_reply cp; 5797 5798 bacpy(&cp.bdaddr, &ev->bdaddr); 5799 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) { 5800 memset(cp.hash192, 0, sizeof(cp.hash192)); 5801 memset(cp.rand192, 0, sizeof(cp.rand192)); 5802 } else { 5803 memcpy(cp.hash192, data->hash192, sizeof(cp.hash192)); 5804 memcpy(cp.rand192, data->rand192, sizeof(cp.rand192)); 5805 } 5806 memcpy(cp.hash256, data->hash256, sizeof(cp.hash256)); 5807 memcpy(cp.rand256, data->rand256, sizeof(cp.rand256)); 5808 5809 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_EXT_DATA_REPLY, 5810 sizeof(cp), &cp); 5811 } else { 5812 struct hci_cp_remote_oob_data_reply cp; 5813 5814 bacpy(&cp.bdaddr, &ev->bdaddr); 5815 memcpy(cp.hash, data->hash192, sizeof(cp.hash)); 5816 memcpy(cp.rand, data->rand192, sizeof(cp.rand)); 5817 5818 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY, 5819 sizeof(cp), &cp); 5820 } 5821 5822 unlock: 5823 hci_dev_unlock(hdev); 5824 } 5825 5826 static void le_conn_update_addr(struct hci_conn *conn, bdaddr_t *bdaddr, 5827 u8 bdaddr_type, bdaddr_t *local_rpa) 5828 { 5829 if (conn->out) { 5830 conn->dst_type = bdaddr_type; 5831 conn->resp_addr_type = bdaddr_type; 5832 bacpy(&conn->resp_addr, bdaddr); 5833 5834 /* Check if the controller has set a Local RPA then it must be 5835 * used instead or hdev->rpa. 5836 */ 5837 if (local_rpa && bacmp(local_rpa, BDADDR_ANY)) { 5838 conn->init_addr_type = ADDR_LE_DEV_RANDOM; 5839 bacpy(&conn->init_addr, local_rpa); 5840 } else if (hci_dev_test_flag(conn->hdev, HCI_PRIVACY)) { 5841 conn->init_addr_type = ADDR_LE_DEV_RANDOM; 5842 bacpy(&conn->init_addr, &conn->hdev->rpa); 5843 } else { 5844 hci_copy_identity_address(conn->hdev, &conn->init_addr, 5845 &conn->init_addr_type); 5846 } 5847 } else { 5848 conn->resp_addr_type = conn->hdev->adv_addr_type; 5849 /* Check if the controller has set a Local RPA then it must be 5850 * used instead or hdev->rpa. 5851 */ 5852 if (local_rpa && bacmp(local_rpa, BDADDR_ANY)) { 5853 conn->resp_addr_type = ADDR_LE_DEV_RANDOM; 5854 bacpy(&conn->resp_addr, local_rpa); 5855 } else if (conn->hdev->adv_addr_type == ADDR_LE_DEV_RANDOM) { 5856 /* In case of ext adv, resp_addr will be updated in 5857 * Adv Terminated event. 5858 */ 5859 if (!ext_adv_capable(conn->hdev)) 5860 bacpy(&conn->resp_addr, 5861 &conn->hdev->random_addr); 5862 } else { 5863 bacpy(&conn->resp_addr, &conn->hdev->bdaddr); 5864 } 5865 5866 conn->init_addr_type = bdaddr_type; 5867 bacpy(&conn->init_addr, bdaddr); 5868 5869 /* For incoming connections, set the default minimum 5870 * and maximum connection interval. They will be used 5871 * to check if the parameters are in range and if not 5872 * trigger the connection update procedure. 5873 */ 5874 conn->le_conn_min_interval = conn->hdev->le_conn_min_interval; 5875 conn->le_conn_max_interval = conn->hdev->le_conn_max_interval; 5876 } 5877 } 5878 5879 static void le_conn_complete_evt(struct hci_dev *hdev, u8 status, 5880 bdaddr_t *bdaddr, u8 bdaddr_type, 5881 bdaddr_t *local_rpa, u8 role, u16 handle, 5882 u16 interval, u16 latency, 5883 u16 supervision_timeout) 5884 { 5885 struct hci_conn_params *params; 5886 struct hci_conn *conn; 5887 struct smp_irk *irk; 5888 u8 addr_type; 5889 int err; 5890 5891 hci_dev_lock(hdev); 5892 hci_store_wake_reason(hdev, bdaddr, bdaddr_type); 5893 5894 /* Advertising stops when a connection is created. On a failed 5895 * connection it keeps running, so leave the state bit alone. 5896 */ 5897 if (!status) 5898 hci_dev_clear_flag(hdev, HCI_LE_ADV); 5899 5900 /* Check for existing connection: 5901 * 5902 * 1. If it doesn't exist then use the role to create a new object. 5903 * 2. If it does exist confirm that it is connecting/BT_CONNECT in case 5904 * of initiator/master role since there could be a collision where 5905 * either side is attempting to connect or something like a fuzzing 5906 * testing is trying to play tricks to destroy the hcon object before 5907 * it even attempts to connect (e.g. hcon->state == BT_OPEN). 5908 */ 5909 conn = hci_conn_hash_lookup_role(hdev, LE_LINK, role, bdaddr); 5910 if (!conn || 5911 (conn->role == HCI_ROLE_MASTER && conn->state != BT_CONNECT)) { 5912 /* In case of error status and there is no connection pending 5913 * just unlock as there is nothing to cleanup. 5914 */ 5915 if (status) 5916 goto unlock; 5917 5918 conn = hci_conn_add_unset(hdev, LE_LINK, bdaddr, bdaddr_type, 5919 role); 5920 if (IS_ERR(conn)) { 5921 bt_dev_err(hdev, "connection err: %ld", PTR_ERR(conn)); 5922 goto unlock; 5923 } 5924 5925 /* If we didn't have a hci_conn object previously 5926 * but we're in central role this must be something 5927 * initiated using an accept list. Since accept list based 5928 * connections are not "first class citizens" we don't 5929 * have full tracking of them. Therefore, we go ahead 5930 * with a "best effort" approach of determining the 5931 * initiator address based on the HCI_PRIVACY flag. 5932 */ 5933 if (conn->out) { 5934 conn->resp_addr_type = bdaddr_type; 5935 bacpy(&conn->resp_addr, bdaddr); 5936 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) { 5937 conn->init_addr_type = ADDR_LE_DEV_RANDOM; 5938 bacpy(&conn->init_addr, &hdev->rpa); 5939 } else { 5940 hci_copy_identity_address(hdev, 5941 &conn->init_addr, 5942 &conn->init_addr_type); 5943 } 5944 } 5945 } else { 5946 cancel_delayed_work(&conn->le_conn_timeout); 5947 } 5948 5949 /* The HCI_LE_Connection_Complete event is only sent once per connection. 5950 * Processing it more than once per connection can corrupt kernel memory. 5951 * 5952 * As the connection handle is set here for the first time, it indicates 5953 * whether the connection is already set up. 5954 */ 5955 if (!HCI_CONN_HANDLE_UNSET(conn->handle)) { 5956 bt_dev_err(hdev, "Ignoring HCI_Connection_Complete for existing connection"); 5957 goto unlock; 5958 } 5959 5960 le_conn_update_addr(conn, bdaddr, bdaddr_type, local_rpa); 5961 5962 /* Lookup the identity address from the stored connection 5963 * address and address type. 5964 * 5965 * When establishing connections to an identity address, the 5966 * connection procedure will store the resolvable random 5967 * address first. Now if it can be converted back into the 5968 * identity address, start using the identity address from 5969 * now on. 5970 */ 5971 irk = hci_get_irk(hdev, &conn->dst, conn->dst_type); 5972 if (irk) { 5973 bacpy(&conn->dst, &irk->bdaddr); 5974 conn->dst_type = irk->addr_type; 5975 } 5976 5977 conn->dst_type = ev_bdaddr_type(hdev, conn->dst_type, NULL); 5978 5979 /* All connection failure handling is taken care of by the 5980 * hci_conn_failed function which is triggered by the HCI 5981 * request completion callbacks used for connecting. 5982 */ 5983 if (status || hci_conn_set_handle(conn, handle)) 5984 goto unlock; 5985 5986 /* Drop the connection if it has been aborted */ 5987 if (test_bit(HCI_CONN_CANCEL, &conn->flags)) { 5988 hci_conn_drop(conn); 5989 goto unlock; 5990 } 5991 5992 if (conn->dst_type == ADDR_LE_DEV_PUBLIC) 5993 addr_type = BDADDR_LE_PUBLIC; 5994 else 5995 addr_type = BDADDR_LE_RANDOM; 5996 5997 /* Drop the connection if the device is blocked */ 5998 if (hci_bdaddr_list_lookup(&hdev->reject_list, &conn->dst, addr_type)) { 5999 hci_conn_drop(conn); 6000 goto unlock; 6001 } 6002 6003 /* Unlike outgoing BR/EDR connections, conn->sec_level is not set at 6004 * connection request time for LE, so it is still at its 6005 * zero-initialized value (BT_SECURITY_SDP) here. Set it to 6006 * BT_SECURITY_LOW before reporting the connection so 6007 * mgmt_device_connected() reports the correct initial security level 6008 * instead of a transient, never-really-in-use SDP value. 6009 */ 6010 conn->sec_level = BT_SECURITY_LOW; 6011 mgmt_device_connected(hdev, conn, NULL, 0); 6012 6013 conn->state = BT_CONFIG; 6014 6015 /* Store current advertising instance as connection advertising instance 6016 * when software rotation is in use so it can be re-enabled when 6017 * disconnected. 6018 */ 6019 if (!ext_adv_capable(hdev)) 6020 conn->adv_instance = hdev->cur_adv_instance; 6021 6022 conn->le_conn_interval = interval; 6023 conn->le_conn_latency = latency; 6024 conn->le_supv_timeout = supervision_timeout; 6025 6026 hci_debugfs_create_conn(conn); 6027 hci_conn_add_sysfs(conn); 6028 6029 err = hci_le_read_remote_features(conn); 6030 if (err) { 6031 conn->state = BT_CONNECTED; 6032 hci_connect_cfm(conn, status); 6033 } 6034 6035 params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst, 6036 conn->dst_type); 6037 if (params) { 6038 hci_pend_le_list_del_init(params); 6039 if (params->conn) { 6040 hci_conn_drop(params->conn); 6041 hci_conn_put(params->conn); 6042 params->conn = NULL; 6043 } 6044 } 6045 6046 /* If we are central and have subrate parameters stored, queue a 6047 * connection rate request to apply them. 6048 */ 6049 if (conn->role == HCI_ROLE_MASTER && le_sci_capable(hdev)) { 6050 struct hci_conn_params *p; 6051 6052 p = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type); 6053 if (p && p->subrate_max) 6054 hci_le_conn_rate_request(hdev, conn); 6055 } 6056 6057 unlock: 6058 hci_update_passive_scan(hdev); 6059 hci_dev_unlock(hdev); 6060 } 6061 6062 static void hci_le_conn_complete_evt(struct hci_dev *hdev, void *data, 6063 struct sk_buff *skb) 6064 { 6065 struct hci_ev_le_conn_complete *ev = data; 6066 6067 bt_dev_dbg(hdev, "status 0x%2.2x", ev->status); 6068 6069 le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type, 6070 NULL, ev->role, le16_to_cpu(ev->handle), 6071 le16_to_cpu(ev->interval), 6072 le16_to_cpu(ev->latency), 6073 le16_to_cpu(ev->supervision_timeout)); 6074 } 6075 6076 static void hci_le_enh_conn_complete_evt(struct hci_dev *hdev, void *data, 6077 struct sk_buff *skb) 6078 { 6079 struct hci_ev_le_enh_conn_complete *ev = data; 6080 6081 bt_dev_dbg(hdev, "status 0x%2.2x", ev->status); 6082 6083 le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type, 6084 &ev->local_rpa, ev->role, le16_to_cpu(ev->handle), 6085 le16_to_cpu(ev->interval), 6086 le16_to_cpu(ev->latency), 6087 le16_to_cpu(ev->supervision_timeout)); 6088 } 6089 6090 static void hci_le_pa_sync_lost_evt(struct hci_dev *hdev, void *data, 6091 struct sk_buff *skb) 6092 { 6093 struct hci_ev_le_pa_sync_lost *ev = data; 6094 u16 handle = le16_to_cpu(ev->handle); 6095 struct hci_conn *conn; 6096 6097 bt_dev_dbg(hdev, "sync handle 0x%4.4x", handle); 6098 6099 hci_dev_lock(hdev); 6100 6101 /* Delete the pa sync connection */ 6102 conn = hci_conn_hash_lookup_pa_sync_handle(hdev, handle); 6103 if (conn) { 6104 clear_bit(HCI_CONN_BIG_SYNC, &conn->flags); 6105 clear_bit(HCI_CONN_PA_SYNC, &conn->flags); 6106 hci_disconn_cfm(conn, HCI_ERROR_REMOTE_USER_TERM); 6107 hci_conn_del(conn); 6108 } 6109 6110 hci_dev_unlock(hdev); 6111 } 6112 6113 static void hci_le_ext_adv_term_evt(struct hci_dev *hdev, void *data, 6114 struct sk_buff *skb) 6115 { 6116 struct hci_evt_le_ext_adv_set_term *ev = data; 6117 struct hci_conn *conn; 6118 struct adv_info *adv, *n; 6119 6120 bt_dev_dbg(hdev, "status 0x%2.2x", ev->status); 6121 6122 /* The Bluetooth Core 5.3 specification clearly states that this event 6123 * shall not be sent when the Host disables the advertising set. So in 6124 * case of HCI_ERROR_CANCELLED_BY_HOST, just ignore the event. 6125 * 6126 * When the Host disables an advertising set, all cleanup is done via 6127 * its command callback and not needed to be duplicated here. 6128 */ 6129 if (ev->status == HCI_ERROR_CANCELLED_BY_HOST) { 6130 bt_dev_warn_ratelimited(hdev, "Unexpected advertising set terminated event"); 6131 return; 6132 } 6133 6134 hci_dev_lock(hdev); 6135 6136 adv = hci_find_adv_instance(hdev, ev->handle); 6137 6138 if (ev->status) { 6139 if (!adv) 6140 goto unlock; 6141 6142 /* Remove advertising as it has been terminated */ 6143 hci_remove_adv_instance(hdev, ev->handle); 6144 mgmt_advertising_removed(NULL, hdev, ev->handle); 6145 6146 list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) { 6147 if (adv->enabled) 6148 goto unlock; 6149 } 6150 6151 /* We are no longer advertising, clear HCI_LE_ADV */ 6152 hci_dev_clear_flag(hdev, HCI_LE_ADV); 6153 goto unlock; 6154 } 6155 6156 if (adv) 6157 adv->enabled = false; 6158 6159 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->conn_handle)); 6160 if (conn) { 6161 /* Store handle in the connection so the correct advertising 6162 * instance can be re-enabled when disconnected. 6163 */ 6164 conn->adv_instance = ev->handle; 6165 6166 if (hdev->adv_addr_type != ADDR_LE_DEV_RANDOM || 6167 bacmp(&conn->resp_addr, BDADDR_ANY)) 6168 goto unlock; 6169 6170 if (!ev->handle) { 6171 bacpy(&conn->resp_addr, &hdev->random_addr); 6172 goto unlock; 6173 } 6174 6175 if (adv) 6176 bacpy(&conn->resp_addr, &adv->random_addr); 6177 } 6178 6179 unlock: 6180 hci_dev_unlock(hdev); 6181 } 6182 6183 static int hci_le_pa_term_sync(struct hci_dev *hdev, __le16 handle) 6184 { 6185 struct hci_cp_le_pa_term_sync cp; 6186 6187 memset(&cp, 0, sizeof(cp)); 6188 cp.handle = handle; 6189 6190 return hci_send_cmd(hdev, HCI_OP_LE_PA_TERM_SYNC, sizeof(cp), &cp); 6191 } 6192 6193 static void hci_le_past_received_evt(struct hci_dev *hdev, void *data, 6194 struct sk_buff *skb) 6195 { 6196 struct hci_ev_le_past_received *ev = data; 6197 int mask = hdev->link_mode; 6198 __u8 flags = 0; 6199 struct hci_conn *pa_sync, *conn; 6200 6201 bt_dev_dbg(hdev, "status 0x%2.2x", ev->status); 6202 6203 hci_dev_lock(hdev); 6204 hci_store_wake_reason(hdev, &ev->bdaddr, ev->bdaddr_type); 6205 6206 hci_dev_clear_flag(hdev, HCI_PA_SYNC); 6207 6208 conn = hci_conn_hash_lookup_create_pa_sync(hdev); 6209 if (!conn) { 6210 bt_dev_err(hdev, 6211 "Unable to find connection for dst %pMR sid 0x%2.2x", 6212 &ev->bdaddr, ev->sid); 6213 goto unlock; 6214 } 6215 6216 conn->sync_handle = le16_to_cpu(ev->sync_handle); 6217 conn->sid = HCI_SID_INVALID; 6218 6219 mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, PA_LINK, 6220 &flags); 6221 if (!(mask & HCI_LM_ACCEPT)) { 6222 hci_le_pa_term_sync(hdev, ev->sync_handle); 6223 goto unlock; 6224 } 6225 6226 if (!(flags & HCI_PROTO_DEFER)) 6227 goto unlock; 6228 6229 /* Add connection to indicate PA sync event */ 6230 pa_sync = hci_conn_add_unset(hdev, PA_LINK, BDADDR_ANY, 0, 6231 HCI_ROLE_SLAVE); 6232 6233 if (IS_ERR(pa_sync)) 6234 goto unlock; 6235 6236 pa_sync->sync_handle = le16_to_cpu(ev->sync_handle); 6237 6238 if (ev->status) { 6239 set_bit(HCI_CONN_PA_SYNC_FAILED, &pa_sync->flags); 6240 6241 /* Notify iso layer */ 6242 hci_connect_cfm(pa_sync, ev->status); 6243 } 6244 6245 unlock: 6246 hci_dev_unlock(hdev); 6247 } 6248 6249 static void hci_le_conn_update_complete_evt(struct hci_dev *hdev, void *data, 6250 struct sk_buff *skb) 6251 { 6252 struct hci_ev_le_conn_update_complete *ev = data; 6253 struct hci_conn *conn; 6254 6255 bt_dev_dbg(hdev, "status 0x%2.2x", ev->status); 6256 6257 if (ev->status) 6258 return; 6259 6260 hci_dev_lock(hdev); 6261 6262 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle)); 6263 if (conn) { 6264 conn->le_conn_interval = le16_to_cpu(ev->interval); 6265 conn->le_conn_latency = le16_to_cpu(ev->latency); 6266 conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout); 6267 } 6268 6269 hci_dev_unlock(hdev); 6270 } 6271 6272 /* This function requires the caller holds hdev->lock */ 6273 static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev, 6274 bdaddr_t *addr, 6275 u8 addr_type, bool addr_resolved, 6276 u8 adv_type, u8 phy, u8 sec_phy) 6277 { 6278 struct hci_conn *conn; 6279 struct hci_conn_params *params; 6280 6281 /* If the event is not connectable don't proceed further */ 6282 if (adv_type != LE_ADV_IND && adv_type != LE_ADV_DIRECT_IND) 6283 return NULL; 6284 6285 /* Ignore if the device is blocked or hdev is suspended */ 6286 if (hci_bdaddr_list_lookup(&hdev->reject_list, addr, addr_type) || 6287 hdev->suspended) 6288 return NULL; 6289 6290 /* Most controller will fail if we try to create new connections 6291 * while we have an existing one in peripheral role. 6292 */ 6293 if (hdev->conn_hash.le_num_peripheral > 0 && 6294 (hci_test_quirk(hdev, HCI_QUIRK_BROKEN_LE_STATES) || 6295 !(hdev->le_states[3] & 0x10))) 6296 return NULL; 6297 6298 /* If we're not connectable only connect devices that we have in 6299 * our pend_le_conns list. 6300 */ 6301 params = hci_pend_le_action_lookup(&hdev->pend_le_conns, addr, 6302 addr_type); 6303 if (!params) 6304 return NULL; 6305 6306 if (!params->explicit_connect) { 6307 switch (params->auto_connect) { 6308 case HCI_AUTO_CONN_DIRECT: 6309 /* Only devices advertising with ADV_DIRECT_IND are 6310 * triggering a connection attempt. This is allowing 6311 * incoming connections from peripheral devices. 6312 */ 6313 if (adv_type != LE_ADV_DIRECT_IND) 6314 return NULL; 6315 break; 6316 case HCI_AUTO_CONN_ALWAYS: 6317 /* Devices advertising with ADV_IND or ADV_DIRECT_IND 6318 * are triggering a connection attempt. This means 6319 * that incoming connections from peripheral device are 6320 * accepted and also outgoing connections to peripheral 6321 * devices are established when found. 6322 */ 6323 break; 6324 default: 6325 return NULL; 6326 } 6327 } 6328 6329 conn = hci_connect_le(hdev, addr, addr_type, addr_resolved, 6330 BT_SECURITY_LOW, hdev->def_le_autoconnect_timeout, 6331 HCI_ROLE_MASTER, phy, sec_phy); 6332 if (!IS_ERR(conn)) { 6333 /* If HCI_AUTO_CONN_EXPLICIT is set, conn is already owned 6334 * by higher layer that tried to connect, if no then 6335 * store the pointer since we don't really have any 6336 * other owner of the object besides the params that 6337 * triggered it. This way we can abort the connection if 6338 * the parameters get removed and keep the reference 6339 * count consistent once the connection is established. 6340 */ 6341 6342 if (!params->explicit_connect) 6343 params->conn = hci_conn_get(conn); 6344 6345 return conn; 6346 } 6347 6348 switch (PTR_ERR(conn)) { 6349 case -EBUSY: 6350 /* If hci_connect() returns -EBUSY it means there is already 6351 * an LE connection attempt going on. Since controllers don't 6352 * support more than one connection attempt at the time, we 6353 * don't consider this an error case. 6354 */ 6355 break; 6356 default: 6357 BT_DBG("Failed to connect: err %ld", PTR_ERR(conn)); 6358 return NULL; 6359 } 6360 6361 return NULL; 6362 } 6363 6364 static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr, 6365 u8 bdaddr_type, bdaddr_t *direct_addr, 6366 u8 direct_addr_type, u8 phy, u8 sec_phy, s8 rssi, 6367 u8 *data, u8 len, bool ext_adv, bool ctl_time, 6368 u64 instant) 6369 { 6370 struct discovery_state *d = &hdev->discovery; 6371 struct smp_irk *irk; 6372 struct hci_conn *conn; 6373 bool match, bdaddr_resolved; 6374 u32 flags; 6375 u8 *ptr; 6376 6377 switch (type) { 6378 case LE_ADV_IND: 6379 case LE_ADV_DIRECT_IND: 6380 case LE_ADV_SCAN_IND: 6381 case LE_ADV_NONCONN_IND: 6382 case LE_ADV_SCAN_RSP: 6383 break; 6384 default: 6385 bt_dev_err_ratelimited(hdev, "unknown advertising packet " 6386 "type: 0x%02x", type); 6387 return; 6388 } 6389 6390 if (len > max_adv_len(hdev)) { 6391 bt_dev_err_ratelimited(hdev, 6392 "adv larger than maximum supported"); 6393 return; 6394 } 6395 6396 /* Find the end of the data in case the report contains padded zero 6397 * bytes at the end causing an invalid length value. 6398 * 6399 * When data is NULL, len is 0 so there is no need for extra ptr 6400 * check as 'ptr < data + 0' is already false in such case. 6401 */ 6402 for (ptr = data; ptr < data + len && *ptr; ptr += *ptr + 1) { 6403 if (ptr + 1 + *ptr > data + len) 6404 break; 6405 } 6406 6407 /* Adjust for actual length. This handles the case when remote 6408 * device is advertising with incorrect data length. 6409 */ 6410 len = ptr - data; 6411 6412 /* If the direct address is present, then this report is from 6413 * a LE Direct Advertising Report event. In that case it is 6414 * important to see if the address is matching the local 6415 * controller address. 6416 * 6417 * If local privacy is not enable the controller shall not be 6418 * generating such event since according to its documentation it is only 6419 * valid for filter_policy 0x02 and 0x03, but the fact that it did 6420 * generate LE Direct Advertising Report means it is probably broken and 6421 * won't generate any other event which can potentially break 6422 * auto-connect logic so in case local privacy is not enable this 6423 * ignores the direct_addr so it works as a regular report. 6424 */ 6425 if (!hci_dev_test_flag(hdev, HCI_MESH) && direct_addr && 6426 hci_dev_test_flag(hdev, HCI_PRIVACY)) { 6427 direct_addr_type = ev_bdaddr_type(hdev, direct_addr_type, 6428 &bdaddr_resolved); 6429 6430 /* Only resolvable random addresses are valid for these 6431 * kind of reports and others can be ignored. 6432 */ 6433 if (!hci_bdaddr_is_rpa(direct_addr, direct_addr_type)) 6434 return; 6435 6436 /* If the local IRK of the controller does not match 6437 * with the resolvable random address provided, then 6438 * this report can be ignored. 6439 */ 6440 if (!smp_irk_matches(hdev, hdev->irk, direct_addr)) 6441 return; 6442 } 6443 6444 /* Check if we need to convert to identity address */ 6445 irk = hci_get_irk(hdev, bdaddr, bdaddr_type); 6446 if (irk) { 6447 bdaddr = &irk->bdaddr; 6448 bdaddr_type = irk->addr_type; 6449 } else { 6450 /* The peer is on air with its identity address, so whatever 6451 * RPA is cached for it has been abandoned. Drop it, or 6452 * hci_connect_le() would swap it back in and dial an address 6453 * the peer no longer answers. 6454 */ 6455 irk = hci_find_irk_by_addr(hdev, bdaddr, bdaddr_type); 6456 if (irk) 6457 bacpy(&irk->rpa, BDADDR_ANY); 6458 } 6459 6460 bdaddr_type = ev_bdaddr_type(hdev, bdaddr_type, &bdaddr_resolved); 6461 6462 /* Check if we have been requested to connect to this device. 6463 * 6464 * direct_addr is set only for directed advertising reports (it is NULL 6465 * for advertising reports) and is already verified to be RPA above. 6466 */ 6467 conn = check_pending_le_conn(hdev, bdaddr, bdaddr_type, bdaddr_resolved, 6468 type, phy, sec_phy); 6469 if (!ext_adv && conn && type == LE_ADV_IND && 6470 len <= max_adv_len(hdev)) { 6471 /* Store report for later inclusion by 6472 * mgmt_device_connected 6473 */ 6474 memcpy(conn->le_adv_data, data, len); 6475 conn->le_adv_data_len = len; 6476 } 6477 6478 if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND) 6479 flags = MGMT_DEV_FOUND_NOT_CONNECTABLE; 6480 else 6481 flags = 0; 6482 6483 /* All scan results should be sent up for Mesh systems */ 6484 if (hci_dev_test_flag(hdev, HCI_MESH)) { 6485 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL, 6486 rssi, flags, data, len, NULL, 0, instant); 6487 return; 6488 } 6489 6490 /* Passive scanning shouldn't trigger any device found events, 6491 * except for devices marked as CONN_REPORT for which we do send 6492 * device found events, or advertisement monitoring requested. 6493 */ 6494 if (hdev->le_scan_type == LE_SCAN_PASSIVE) { 6495 if (type == LE_ADV_DIRECT_IND) 6496 return; 6497 6498 if (!hci_pend_le_action_lookup(&hdev->pend_le_reports, 6499 bdaddr, bdaddr_type) && 6500 idr_is_empty(&hdev->adv_monitors_idr)) 6501 return; 6502 6503 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL, 6504 rssi, flags, data, len, NULL, 0, 0); 6505 return; 6506 } 6507 6508 /* When receiving a scan response, then there is no way to 6509 * know if the remote device is connectable or not. However 6510 * since scan responses are merged with a previously seen 6511 * advertising report, the flags field from that report 6512 * will be used. 6513 * 6514 * In the unlikely case that a controller just sends a scan 6515 * response event that doesn't match the pending report, then 6516 * it is marked as a standalone SCAN_RSP. 6517 */ 6518 if (type == LE_ADV_SCAN_RSP) 6519 flags = MGMT_DEV_FOUND_SCAN_RSP; 6520 6521 /* If there's nothing pending either store the data from this 6522 * event or send an immediate device found event if the data 6523 * should not be stored for later. 6524 */ 6525 if (!has_pending_adv_report(hdev)) { 6526 /* If the report will trigger a SCAN_REQ store it for 6527 * later merging. 6528 */ 6529 if (!ext_adv && (type == LE_ADV_IND || 6530 type == LE_ADV_SCAN_IND)) { 6531 store_pending_adv_report(hdev, bdaddr, bdaddr_type, 6532 rssi, flags, data, len); 6533 return; 6534 } 6535 6536 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL, 6537 rssi, flags, data, len, NULL, 0, 0); 6538 return; 6539 } 6540 6541 /* Check if the pending report is for the same device as the new one */ 6542 match = (!bacmp(bdaddr, &d->last_adv_addr) && 6543 bdaddr_type == d->last_adv_addr_type); 6544 6545 /* If the pending data doesn't match this report or this isn't a 6546 * scan response (e.g. we got a duplicate ADV_IND) then force 6547 * sending of the pending data. 6548 */ 6549 if (type != LE_ADV_SCAN_RSP || !match) { 6550 /* Send out whatever is in the cache, but skip duplicates */ 6551 if (!match) 6552 mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK, 6553 d->last_adv_addr_type, NULL, 6554 d->last_adv_rssi, d->last_adv_flags, 6555 d->last_adv_data, 6556 d->last_adv_data_len, NULL, 0, 0); 6557 6558 /* If the new report will trigger a SCAN_REQ store it for 6559 * later merging. 6560 */ 6561 if (!ext_adv && (type == LE_ADV_IND || 6562 type == LE_ADV_SCAN_IND)) { 6563 store_pending_adv_report(hdev, bdaddr, bdaddr_type, 6564 rssi, flags, data, len); 6565 return; 6566 } 6567 6568 /* The advertising reports cannot be merged, so clear 6569 * the pending report and send out a device found event. 6570 */ 6571 clear_pending_adv_report(hdev); 6572 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL, 6573 rssi, flags, data, len, NULL, 0, 0); 6574 return; 6575 } 6576 6577 /* If we get here we've got a pending ADV_IND or ADV_SCAN_IND and 6578 * the new event is a SCAN_RSP. We can therefore proceed with 6579 * sending a merged device found event. 6580 */ 6581 mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK, 6582 d->last_adv_addr_type, NULL, rssi, d->last_adv_flags, 6583 d->last_adv_data, d->last_adv_data_len, data, len, 0); 6584 clear_pending_adv_report(hdev); 6585 } 6586 6587 static void hci_le_adv_report_evt(struct hci_dev *hdev, void *data, 6588 struct sk_buff *skb) 6589 { 6590 struct hci_ev_le_advertising_report *ev = data; 6591 u64 instant = jiffies; 6592 6593 if (!ev->num) 6594 return; 6595 6596 hci_dev_lock(hdev); 6597 6598 while (ev->num--) { 6599 struct hci_ev_le_advertising_info *info; 6600 s8 rssi; 6601 6602 info = hci_le_ev_skb_pull(hdev, skb, 6603 HCI_EV_LE_ADVERTISING_REPORT, 6604 sizeof(*info)); 6605 if (!info) 6606 break; 6607 6608 if (!hci_le_ev_skb_pull(hdev, skb, HCI_EV_LE_ADVERTISING_REPORT, 6609 info->length + 1)) 6610 break; 6611 6612 hci_store_wake_reason(hdev, &info->bdaddr, info->bdaddr_type); 6613 6614 if (info->length <= max_adv_len(hdev)) { 6615 rssi = info->data[info->length]; 6616 process_adv_report(hdev, info->type, &info->bdaddr, 6617 info->bdaddr_type, NULL, 0, 6618 HCI_ADV_PHY_1M, 0, rssi, 6619 info->data, info->length, false, 6620 false, instant); 6621 } else { 6622 bt_dev_err(hdev, "Dropping invalid advertising data"); 6623 } 6624 } 6625 6626 hci_dev_unlock(hdev); 6627 } 6628 6629 static u8 ext_evt_type_to_legacy(struct hci_dev *hdev, u16 evt_type) 6630 { 6631 u16 pdu_type = evt_type & ~LE_EXT_ADV_DATA_STATUS_MASK; 6632 6633 if (!pdu_type) 6634 return LE_ADV_NONCONN_IND; 6635 6636 if (evt_type & LE_EXT_ADV_LEGACY_PDU) { 6637 switch (evt_type) { 6638 case LE_LEGACY_ADV_IND: 6639 return LE_ADV_IND; 6640 case LE_LEGACY_ADV_DIRECT_IND: 6641 return LE_ADV_DIRECT_IND; 6642 case LE_LEGACY_ADV_SCAN_IND: 6643 return LE_ADV_SCAN_IND; 6644 case LE_LEGACY_NONCONN_IND: 6645 return LE_ADV_NONCONN_IND; 6646 case LE_LEGACY_SCAN_RSP_ADV: 6647 case LE_LEGACY_SCAN_RSP_ADV_SCAN: 6648 return LE_ADV_SCAN_RSP; 6649 } 6650 6651 goto invalid; 6652 } 6653 6654 if (evt_type & LE_EXT_ADV_CONN_IND) { 6655 if (evt_type & LE_EXT_ADV_DIRECT_IND) 6656 return LE_ADV_DIRECT_IND; 6657 6658 return LE_ADV_IND; 6659 } 6660 6661 if (evt_type & LE_EXT_ADV_SCAN_RSP) 6662 return LE_ADV_SCAN_RSP; 6663 6664 if (evt_type & LE_EXT_ADV_SCAN_IND) 6665 return LE_ADV_SCAN_IND; 6666 6667 if (evt_type & LE_EXT_ADV_DIRECT_IND) 6668 return LE_ADV_NONCONN_IND; 6669 6670 invalid: 6671 bt_dev_err_ratelimited(hdev, "Unknown advertising packet type: 0x%02x", 6672 evt_type); 6673 6674 return LE_ADV_INVALID; 6675 } 6676 6677 static void hci_le_ext_adv_report_evt(struct hci_dev *hdev, void *data, 6678 struct sk_buff *skb) 6679 { 6680 struct hci_ev_le_ext_adv_report *ev = data; 6681 u64 instant = jiffies; 6682 6683 if (!ev->num) 6684 return; 6685 6686 hci_dev_lock(hdev); 6687 6688 while (ev->num--) { 6689 struct hci_ev_le_ext_adv_info *info; 6690 u8 legacy_evt_type; 6691 u16 evt_type; 6692 6693 info = hci_le_ev_skb_pull(hdev, skb, HCI_EV_LE_EXT_ADV_REPORT, 6694 sizeof(*info)); 6695 if (!info) 6696 break; 6697 6698 if (!hci_le_ev_skb_pull(hdev, skb, HCI_EV_LE_EXT_ADV_REPORT, 6699 info->length)) 6700 break; 6701 6702 hci_store_wake_reason(hdev, &info->bdaddr, info->bdaddr_type); 6703 6704 evt_type = __le16_to_cpu(info->type) & LE_EXT_ADV_EVT_TYPE_MASK; 6705 legacy_evt_type = ext_evt_type_to_legacy(hdev, evt_type); 6706 6707 if (hci_test_quirk(hdev, 6708 HCI_QUIRK_FIXUP_LE_EXT_ADV_REPORT_PHY)) { 6709 info->primary_phy &= 0x1f; 6710 info->secondary_phy &= 0x1f; 6711 } 6712 6713 /* Check if PA Sync is pending and if the hci_conn SID has not 6714 * been set update it. 6715 */ 6716 if (hci_dev_test_flag(hdev, HCI_PA_SYNC)) { 6717 struct hci_conn *conn; 6718 6719 conn = hci_conn_hash_lookup_create_pa_sync(hdev); 6720 if (conn && conn->sid == HCI_SID_INVALID) 6721 conn->sid = info->sid; 6722 } 6723 6724 if (legacy_evt_type != LE_ADV_INVALID) { 6725 process_adv_report(hdev, legacy_evt_type, &info->bdaddr, 6726 info->bdaddr_type, NULL, 0, 6727 info->primary_phy, 6728 info->secondary_phy, 6729 info->rssi, info->data, info->length, 6730 !(evt_type & LE_EXT_ADV_LEGACY_PDU), 6731 false, instant); 6732 } 6733 } 6734 6735 hci_dev_unlock(hdev); 6736 } 6737 6738 static void hci_le_pa_sync_established_evt(struct hci_dev *hdev, void *data, 6739 struct sk_buff *skb) 6740 { 6741 struct hci_ev_le_pa_sync_established *ev = data; 6742 int mask = hdev->link_mode; 6743 __u8 flags = 0; 6744 struct hci_conn *pa_sync, *conn; 6745 6746 bt_dev_dbg(hdev, "status 0x%2.2x", ev->status); 6747 6748 hci_dev_lock(hdev); 6749 hci_store_wake_reason(hdev, &ev->bdaddr, ev->bdaddr_type); 6750 6751 hci_dev_clear_flag(hdev, HCI_PA_SYNC); 6752 6753 conn = hci_conn_hash_lookup_create_pa_sync(hdev); 6754 if (!conn) { 6755 bt_dev_err(hdev, 6756 "Unable to find connection for dst %pMR sid 0x%2.2x", 6757 &ev->bdaddr, ev->sid); 6758 goto unlock; 6759 } 6760 6761 clear_bit(HCI_CONN_CREATE_PA_SYNC, &conn->flags); 6762 6763 conn->sync_handle = le16_to_cpu(ev->handle); 6764 conn->sid = HCI_SID_INVALID; 6765 6766 mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, PA_LINK, 6767 &flags); 6768 if (!(mask & HCI_LM_ACCEPT)) { 6769 hci_le_pa_term_sync(hdev, ev->handle); 6770 goto unlock; 6771 } 6772 6773 if (!(flags & HCI_PROTO_DEFER)) 6774 goto unlock; 6775 6776 /* Add connection to indicate PA sync event */ 6777 pa_sync = hci_conn_add_unset(hdev, PA_LINK, BDADDR_ANY, 0, 6778 HCI_ROLE_SLAVE); 6779 6780 if (IS_ERR(pa_sync)) 6781 goto unlock; 6782 6783 pa_sync->sync_handle = le16_to_cpu(ev->handle); 6784 6785 if (ev->status) { 6786 set_bit(HCI_CONN_PA_SYNC_FAILED, &pa_sync->flags); 6787 6788 /* Notify iso layer */ 6789 hci_connect_cfm(pa_sync, ev->status); 6790 } 6791 6792 unlock: 6793 hci_dev_unlock(hdev); 6794 } 6795 6796 static void hci_le_per_adv_report_evt(struct hci_dev *hdev, void *data, 6797 struct sk_buff *skb) 6798 { 6799 struct hci_ev_le_per_adv_report *ev = data; 6800 int mask = hdev->link_mode; 6801 __u8 flags = 0; 6802 struct hci_conn *pa_sync; 6803 6804 bt_dev_dbg(hdev, "sync_handle 0x%4.4x", le16_to_cpu(ev->sync_handle)); 6805 6806 /* The reassembly in iso_connect_ind() copies ev->length bytes from the 6807 * stored event, so make sure the event actually carries that many data 6808 * bytes before it is consumed. 6809 */ 6810 if (!hci_le_ev_skb_pull(hdev, skb, HCI_EV_LE_PER_ADV_REPORT, ev->length)) 6811 return; 6812 6813 hci_dev_lock(hdev); 6814 6815 mask |= hci_proto_connect_ind(hdev, BDADDR_ANY, PA_LINK, &flags); 6816 if (!(mask & HCI_LM_ACCEPT)) 6817 goto unlock; 6818 6819 if (!(flags & HCI_PROTO_DEFER)) 6820 goto unlock; 6821 6822 pa_sync = hci_conn_hash_lookup_pa_sync_handle 6823 (hdev, 6824 le16_to_cpu(ev->sync_handle)); 6825 6826 if (!pa_sync) 6827 goto unlock; 6828 6829 if (ev->data_status == LE_PA_DATA_COMPLETE && 6830 !test_and_set_bit(HCI_CONN_PA_SYNC, &pa_sync->flags)) { 6831 /* Notify iso layer */ 6832 hci_connect_cfm(pa_sync, 0); 6833 6834 /* Notify MGMT layer */ 6835 mgmt_device_connected(hdev, pa_sync, NULL, 0); 6836 } 6837 6838 unlock: 6839 hci_dev_unlock(hdev); 6840 } 6841 6842 static void hci_le_remote_feat_complete_evt(struct hci_dev *hdev, void *data, 6843 struct sk_buff *skb) 6844 { 6845 struct hci_ev_le_remote_feat_complete *ev = data; 6846 struct hci_conn *conn; 6847 6848 bt_dev_dbg(hdev, "status 0x%2.2x", ev->status); 6849 6850 hci_dev_lock(hdev); 6851 6852 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle)); 6853 if (conn) { 6854 if (!ev->status) { 6855 memcpy(conn->le_features, ev->features, 8); 6856 6857 /* Update supported PHYs */ 6858 if (!(conn->le_features[1] & HCI_LE_PHY_2M)) { 6859 conn->le_tx_def_phys &= ~HCI_LE_SET_PHY_2M; 6860 conn->le_rx_def_phys &= ~HCI_LE_SET_PHY_2M; 6861 } 6862 6863 if (!(conn->le_features[1] & HCI_LE_PHY_CODED)) { 6864 conn->le_tx_def_phys &= ~HCI_LE_SET_PHY_CODED; 6865 conn->le_rx_def_phys &= ~HCI_LE_SET_PHY_CODED; 6866 } 6867 } 6868 6869 if (conn->state == BT_CONFIG) { 6870 __u8 status; 6871 6872 /* If the local controller supports peripheral-initiated 6873 * features exchange, but the remote controller does 6874 * not, then it is possible that the error code 0x1a 6875 * for unsupported remote feature gets returned. 6876 * 6877 * In this specific case, allow the connection to 6878 * transition into connected state and mark it as 6879 * successful. 6880 */ 6881 if (!conn->out && ev->status == HCI_ERROR_UNSUPPORTED_REMOTE_FEATURE && 6882 (hdev->le_features[0] & HCI_LE_PERIPHERAL_FEATURES)) 6883 status = 0x00; 6884 else 6885 status = ev->status; 6886 6887 conn->state = BT_CONNECTED; 6888 hci_connect_cfm(conn, status); 6889 } 6890 } 6891 6892 hci_dev_unlock(hdev); 6893 } 6894 6895 static void hci_le_ltk_request_evt(struct hci_dev *hdev, void *data, 6896 struct sk_buff *skb) 6897 { 6898 struct hci_ev_le_ltk_req *ev = data; 6899 struct hci_cp_le_ltk_reply cp; 6900 struct hci_cp_le_ltk_neg_reply neg; 6901 struct hci_conn *conn; 6902 struct smp_ltk *ltk; 6903 6904 bt_dev_dbg(hdev, "handle 0x%4.4x", __le16_to_cpu(ev->handle)); 6905 6906 hci_dev_lock(hdev); 6907 6908 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle)); 6909 if (conn == NULL) 6910 goto not_found; 6911 6912 ltk = hci_find_ltk(hdev, &conn->dst, conn->dst_type, conn->role); 6913 if (!ltk) 6914 goto not_found; 6915 6916 if (smp_ltk_is_sc(ltk)) { 6917 /* With SC both EDiv and Rand are set to zero */ 6918 if (ev->ediv || ev->rand) 6919 goto not_found; 6920 } else { 6921 /* For non-SC keys check that EDiv and Rand match */ 6922 if (ev->ediv != ltk->ediv || ev->rand != ltk->rand) 6923 goto not_found; 6924 } 6925 6926 memcpy(cp.ltk, ltk->val, ltk->enc_size); 6927 memset(cp.ltk + ltk->enc_size, 0, sizeof(cp.ltk) - ltk->enc_size); 6928 cp.handle = cpu_to_le16(conn->handle); 6929 6930 conn->pending_sec_level = smp_ltk_sec_level(ltk); 6931 6932 conn->enc_key_size = ltk->enc_size; 6933 6934 hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp); 6935 6936 /* Ref. Bluetooth Core SPEC pages 1975 and 2004. STK is a 6937 * temporary key used to encrypt a connection following 6938 * pairing. It is used during the Encrypted Session Setup to 6939 * distribute the keys. Later, security can be re-established 6940 * using a distributed LTK. 6941 */ 6942 if (ltk->type == SMP_STK) { 6943 set_bit(HCI_CONN_STK_ENCRYPT, &conn->flags); 6944 list_del_rcu(<k->list); 6945 kfree_rcu(ltk, rcu); 6946 } else { 6947 clear_bit(HCI_CONN_STK_ENCRYPT, &conn->flags); 6948 } 6949 6950 hci_dev_unlock(hdev); 6951 6952 return; 6953 6954 not_found: 6955 neg.handle = ev->handle; 6956 hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg); 6957 hci_dev_unlock(hdev); 6958 } 6959 6960 static void send_conn_param_neg_reply(struct hci_dev *hdev, u16 handle, 6961 u8 reason) 6962 { 6963 struct hci_cp_le_conn_param_req_neg_reply cp; 6964 6965 cp.handle = cpu_to_le16(handle); 6966 cp.reason = reason; 6967 6968 hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_NEG_REPLY, sizeof(cp), 6969 &cp); 6970 } 6971 6972 static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev, void *data, 6973 struct sk_buff *skb) 6974 { 6975 struct hci_ev_le_remote_conn_param_req *ev = data; 6976 struct hci_cp_le_conn_param_req_reply cp; 6977 struct hci_conn *hcon; 6978 u16 handle, min, max, latency, timeout; 6979 6980 bt_dev_dbg(hdev, "handle 0x%4.4x", __le16_to_cpu(ev->handle)); 6981 6982 handle = le16_to_cpu(ev->handle); 6983 min = le16_to_cpu(ev->interval_min); 6984 max = le16_to_cpu(ev->interval_max); 6985 latency = le16_to_cpu(ev->latency); 6986 timeout = le16_to_cpu(ev->timeout); 6987 6988 hci_dev_lock(hdev); 6989 6990 hcon = hci_conn_hash_lookup_handle(hdev, handle); 6991 if (!hcon || hcon->state != BT_CONNECTED) { 6992 send_conn_param_neg_reply(hdev, handle, 6993 HCI_ERROR_UNKNOWN_CONN_ID); 6994 goto unlock; 6995 } 6996 6997 if (max > hcon->le_conn_max_interval) { 6998 send_conn_param_neg_reply(hdev, handle, 6999 HCI_ERROR_INVALID_LL_PARAMS); 7000 goto unlock; 7001 } 7002 7003 if (hci_check_conn_params(min, max, latency, timeout)) { 7004 send_conn_param_neg_reply(hdev, handle, 7005 HCI_ERROR_INVALID_LL_PARAMS); 7006 goto unlock; 7007 } 7008 7009 if (hcon->role == HCI_ROLE_MASTER) { 7010 struct hci_conn_params *params; 7011 u8 store_hint; 7012 7013 params = hci_conn_params_lookup(hdev, &hcon->dst, 7014 hcon->dst_type); 7015 if (params) { 7016 params->conn_min_interval = min; 7017 params->conn_max_interval = max; 7018 params->conn_latency = latency; 7019 params->supervision_timeout = timeout; 7020 store_hint = 0x01; 7021 } else { 7022 store_hint = 0x00; 7023 } 7024 7025 mgmt_new_conn_param(hdev, &hcon->dst, hcon->dst_type, 7026 store_hint, min, max, latency, timeout); 7027 } 7028 7029 cp.handle = ev->handle; 7030 cp.interval_min = ev->interval_min; 7031 cp.interval_max = ev->interval_max; 7032 cp.latency = ev->latency; 7033 cp.timeout = ev->timeout; 7034 cp.min_ce_len = 0; 7035 cp.max_ce_len = 0; 7036 7037 hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_REPLY, sizeof(cp), &cp); 7038 7039 unlock: 7040 hci_dev_unlock(hdev); 7041 } 7042 7043 static void hci_le_direct_adv_report_evt(struct hci_dev *hdev, void *data, 7044 struct sk_buff *skb) 7045 { 7046 struct hci_ev_le_direct_adv_report *ev = data; 7047 u64 instant = jiffies; 7048 int i; 7049 7050 if (!hci_le_ev_skb_pull(hdev, skb, HCI_EV_LE_DIRECT_ADV_REPORT, 7051 flex_array_size(ev, info, ev->num))) 7052 return; 7053 7054 if (!ev->num) 7055 return; 7056 7057 hci_dev_lock(hdev); 7058 7059 for (i = 0; i < ev->num; i++) { 7060 struct hci_ev_le_direct_adv_info *info = &ev->info[i]; 7061 7062 hci_store_wake_reason(hdev, &info->bdaddr, info->bdaddr_type); 7063 7064 process_adv_report(hdev, info->type, &info->bdaddr, 7065 info->bdaddr_type, &info->direct_addr, 7066 info->direct_addr_type, HCI_ADV_PHY_1M, 0, 7067 info->rssi, NULL, 0, false, false, instant); 7068 } 7069 7070 hci_dev_unlock(hdev); 7071 } 7072 7073 static void hci_le_phy_update_evt(struct hci_dev *hdev, void *data, 7074 struct sk_buff *skb) 7075 { 7076 struct hci_ev_le_phy_update_complete *ev = data; 7077 struct hci_conn *conn; 7078 7079 bt_dev_dbg(hdev, "status 0x%2.2x", ev->status); 7080 7081 if (ev->status) 7082 return; 7083 7084 hci_dev_lock(hdev); 7085 7086 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle)); 7087 if (!conn) 7088 goto unlock; 7089 7090 conn->le_tx_phy = ev->tx_phy; 7091 conn->le_rx_phy = ev->rx_phy; 7092 7093 unlock: 7094 hci_dev_unlock(hdev); 7095 } 7096 7097 /* Convert LE PHY to QoS PHYs */ 7098 static u8 le_phy_qos(u8 phy) 7099 { 7100 switch (phy) { 7101 case 0x01: 7102 return HCI_LE_SET_PHY_1M; 7103 case 0x02: 7104 return HCI_LE_SET_PHY_2M; 7105 case 0x03: 7106 return HCI_LE_SET_PHY_CODED; 7107 } 7108 7109 return 0; 7110 } 7111 7112 static void hci_le_cis_established_evt(struct hci_dev *hdev, void *data, 7113 struct sk_buff *skb) 7114 { 7115 struct hci_evt_le_cis_established *ev = data; 7116 struct hci_conn *conn; 7117 struct bt_iso_qos *qos; 7118 bool pending = false; 7119 u16 handle = __le16_to_cpu(ev->handle); 7120 u32 c_sdu_interval, p_sdu_interval; 7121 7122 bt_dev_dbg(hdev, "status 0x%2.2x", ev->status); 7123 7124 hci_dev_lock(hdev); 7125 7126 conn = hci_conn_hash_lookup_handle(hdev, handle); 7127 if (!conn) { 7128 bt_dev_err(hdev, 7129 "Unable to find connection with handle 0x%4.4x", 7130 handle); 7131 goto unlock; 7132 } 7133 7134 if (conn->type != CIS_LINK) { 7135 bt_dev_err(hdev, 7136 "Invalid connection link type handle 0x%4.4x", 7137 handle); 7138 goto unlock; 7139 } 7140 7141 qos = &conn->iso_qos; 7142 7143 pending = test_and_clear_bit(HCI_CONN_CREATE_CIS, &conn->flags); 7144 7145 /* BLUETOOTH CORE SPECIFICATION Version 5.4 | Vol 6, Part G 7146 * page 3075: 7147 * Transport_Latency_C_To_P = CIG_Sync_Delay + (FT_C_To_P) × 7148 * ISO_Interval + SDU_Interval_C_To_P 7149 * ... 7150 * SDU_Interval = (CIG_Sync_Delay + (FT) x ISO_Interval) - 7151 * Transport_Latency 7152 */ 7153 c_sdu_interval = (get_unaligned_le24(ev->cig_sync_delay) + 7154 (ev->c_ft * le16_to_cpu(ev->interval) * 1250)) - 7155 get_unaligned_le24(ev->c_latency); 7156 p_sdu_interval = (get_unaligned_le24(ev->cig_sync_delay) + 7157 (ev->p_ft * le16_to_cpu(ev->interval) * 1250)) - 7158 get_unaligned_le24(ev->p_latency); 7159 7160 switch (conn->role) { 7161 case HCI_ROLE_SLAVE: 7162 qos->ucast.in.interval = c_sdu_interval; 7163 qos->ucast.out.interval = p_sdu_interval; 7164 /* Convert Transport Latency (us) to Latency (msec) */ 7165 qos->ucast.in.latency = 7166 DIV_ROUND_CLOSEST(get_unaligned_le24(ev->c_latency), 7167 1000); 7168 qos->ucast.out.latency = 7169 DIV_ROUND_CLOSEST(get_unaligned_le24(ev->p_latency), 7170 1000); 7171 qos->ucast.in.sdu = ev->c_bn ? le16_to_cpu(ev->c_mtu) : 0; 7172 qos->ucast.out.sdu = ev->p_bn ? le16_to_cpu(ev->p_mtu) : 0; 7173 qos->ucast.in.phys = le_phy_qos(ev->c_phy); 7174 qos->ucast.out.phys = le_phy_qos(ev->p_phy); 7175 break; 7176 case HCI_ROLE_MASTER: 7177 qos->ucast.in.interval = p_sdu_interval; 7178 qos->ucast.out.interval = c_sdu_interval; 7179 /* Convert Transport Latency (us) to Latency (msec) */ 7180 qos->ucast.out.latency = 7181 DIV_ROUND_CLOSEST(get_unaligned_le24(ev->c_latency), 7182 1000); 7183 qos->ucast.in.latency = 7184 DIV_ROUND_CLOSEST(get_unaligned_le24(ev->p_latency), 7185 1000); 7186 qos->ucast.out.sdu = ev->c_bn ? le16_to_cpu(ev->c_mtu) : 0; 7187 qos->ucast.in.sdu = ev->p_bn ? le16_to_cpu(ev->p_mtu) : 0; 7188 qos->ucast.out.phys = le_phy_qos(ev->c_phy); 7189 qos->ucast.in.phys = le_phy_qos(ev->p_phy); 7190 break; 7191 } 7192 7193 if (!ev->status) { 7194 conn->state = BT_CONNECTED; 7195 hci_debugfs_create_conn(conn); 7196 hci_conn_add_sysfs(conn); 7197 hci_iso_setup_path(conn); 7198 goto unlock; 7199 } 7200 7201 conn->state = BT_CLOSED; 7202 hci_connect_cfm(conn, ev->status); 7203 hci_conn_del(conn); 7204 7205 unlock: 7206 if (pending) 7207 hci_le_create_cis_pending(hdev); 7208 7209 hci_dev_unlock(hdev); 7210 } 7211 7212 static void hci_le_reject_cis(struct hci_dev *hdev, __le16 handle) 7213 { 7214 struct hci_cp_le_reject_cis cp; 7215 7216 memset(&cp, 0, sizeof(cp)); 7217 cp.handle = handle; 7218 cp.reason = HCI_ERROR_REJ_BAD_ADDR; 7219 hci_send_cmd(hdev, HCI_OP_LE_REJECT_CIS, sizeof(cp), &cp); 7220 } 7221 7222 static void hci_le_accept_cis(struct hci_dev *hdev, __le16 handle) 7223 { 7224 struct hci_cp_le_accept_cis cp; 7225 7226 memset(&cp, 0, sizeof(cp)); 7227 cp.handle = handle; 7228 hci_send_cmd(hdev, HCI_OP_LE_ACCEPT_CIS, sizeof(cp), &cp); 7229 } 7230 7231 static void hci_le_cis_req_evt(struct hci_dev *hdev, void *data, 7232 struct sk_buff *skb) 7233 { 7234 struct hci_evt_le_cis_req *ev = data; 7235 u16 acl_handle, cis_handle; 7236 struct hci_conn *acl, *cis; 7237 int mask; 7238 __u8 flags = 0; 7239 7240 acl_handle = __le16_to_cpu(ev->acl_handle); 7241 cis_handle = __le16_to_cpu(ev->cis_handle); 7242 7243 bt_dev_dbg(hdev, "acl 0x%4.4x handle 0x%4.4x cig 0x%2.2x cis 0x%2.2x", 7244 acl_handle, cis_handle, ev->cig_id, ev->cis_id); 7245 7246 hci_dev_lock(hdev); 7247 7248 acl = hci_conn_hash_lookup_handle(hdev, acl_handle); 7249 if (!acl) 7250 goto unlock; 7251 7252 mask = hci_proto_connect_ind(hdev, &acl->dst, CIS_LINK, &flags); 7253 if (!(mask & HCI_LM_ACCEPT)) { 7254 hci_le_reject_cis(hdev, ev->cis_handle); 7255 goto unlock; 7256 } 7257 7258 cis = hci_conn_hash_lookup_handle(hdev, cis_handle); 7259 if (!cis) { 7260 cis = hci_conn_add(hdev, CIS_LINK, &acl->dst, acl->dst_type, 7261 HCI_ROLE_SLAVE, cis_handle); 7262 if (IS_ERR(cis)) { 7263 hci_le_reject_cis(hdev, ev->cis_handle); 7264 goto unlock; 7265 } 7266 } 7267 7268 cis->iso_qos.ucast.cig = ev->cig_id; 7269 cis->iso_qos.ucast.cis = ev->cis_id; 7270 7271 if (!(flags & HCI_PROTO_DEFER)) { 7272 hci_le_accept_cis(hdev, ev->cis_handle); 7273 } else { 7274 cis->state = BT_CONNECT2; 7275 hci_connect_cfm(cis, 0); 7276 } 7277 7278 unlock: 7279 hci_dev_unlock(hdev); 7280 } 7281 7282 static int hci_iso_term_big_sync(struct hci_dev *hdev, void *data) 7283 { 7284 u8 handle = PTR_UINT(data); 7285 7286 return hci_le_terminate_big_sync(hdev, handle, 7287 HCI_ERROR_LOCAL_HOST_TERM); 7288 } 7289 7290 static void hci_le_create_big_complete_evt(struct hci_dev *hdev, void *data, 7291 struct sk_buff *skb) 7292 { 7293 struct hci_evt_le_create_big_complete *ev = data; 7294 struct hci_conn *conn; 7295 __u8 i = 0; 7296 7297 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status); 7298 7299 if (!hci_le_ev_skb_pull(hdev, skb, HCI_EVT_LE_CREATE_BIG_COMPLETE, 7300 flex_array_size(ev, bis_handle, ev->num_bis))) 7301 return; 7302 7303 hci_dev_lock(hdev); 7304 7305 /* Connect all BISes that are bound to the BIG */ 7306 while ((conn = hci_conn_hash_lookup_big_state(hdev, ev->handle, 7307 BT_BOUND, 7308 HCI_ROLE_MASTER))) { 7309 if (ev->status) { 7310 hci_connect_cfm(conn, ev->status); 7311 hci_conn_del(conn); 7312 continue; 7313 } 7314 7315 if (ev->num_bis <= i) { 7316 bt_dev_err(hdev, 7317 "Not enough BIS handles for BIG 0x%2.2x", 7318 ev->handle); 7319 ev->status = HCI_ERROR_UNSPECIFIED; 7320 hci_connect_cfm(conn, ev->status); 7321 hci_conn_del(conn); 7322 continue; 7323 } 7324 7325 if (hci_conn_set_handle(conn, 7326 __le16_to_cpu(ev->bis_handle[i++]))) { 7327 bt_dev_err(hdev, 7328 "Failed to set BIS handle for BIG 0x%2.2x", 7329 ev->handle); 7330 /* Force error so BIG gets terminated as not all BIS 7331 * could be connected. 7332 */ 7333 ev->status = HCI_ERROR_UNSPECIFIED; 7334 hci_connect_cfm(conn, ev->status); 7335 hci_conn_del(conn); 7336 continue; 7337 } 7338 7339 conn->state = BT_CONNECTED; 7340 set_bit(HCI_CONN_BIG_CREATED, &conn->flags); 7341 hci_debugfs_create_conn(conn); 7342 hci_conn_add_sysfs(conn); 7343 hci_iso_setup_path(conn); 7344 } 7345 7346 /* If there is an unexpected error or if no BISes have been connected 7347 * for the BIG, terminate it. 7348 */ 7349 if (ev->status == HCI_ERROR_UNSPECIFIED || (!ev->status && !i)) 7350 /* If no BISes have been connected for the BIG, 7351 * terminate. This is in case all bound connections 7352 * have been closed before the BIG creation 7353 * has completed. 7354 */ 7355 hci_cmd_sync_queue(hdev, hci_iso_term_big_sync, 7356 UINT_PTR(ev->handle), NULL); 7357 7358 hci_dev_unlock(hdev); 7359 } 7360 7361 static void hci_le_big_sync_established_evt(struct hci_dev *hdev, void *data, 7362 struct sk_buff *skb) 7363 { 7364 struct hci_evt_le_big_sync_established *ev = data; 7365 struct hci_conn *bis, *conn; 7366 int i; 7367 7368 bt_dev_dbg(hdev, "status 0x%2.2x", ev->status); 7369 7370 if (!hci_le_ev_skb_pull(hdev, skb, HCI_EVT_LE_BIG_SYNC_ESTABLISHED, 7371 flex_array_size(ev, bis, ev->num_bis))) 7372 return; 7373 7374 hci_dev_lock(hdev); 7375 7376 conn = hci_conn_hash_lookup_big_sync_pend(hdev, ev->handle, 7377 ev->num_bis); 7378 if (!conn) { 7379 bt_dev_err(hdev, 7380 "Unable to find connection for big 0x%2.2x", 7381 ev->handle); 7382 goto unlock; 7383 } 7384 7385 clear_bit(HCI_CONN_CREATE_BIG_SYNC, &conn->flags); 7386 7387 conn->num_bis = 0; 7388 memset(conn->bis, 0, sizeof(conn->bis)); 7389 7390 for (i = 0; i < ev->num_bis; i++) { 7391 u16 handle = le16_to_cpu(ev->bis[i]); 7392 __le32 interval; 7393 7394 bis = hci_conn_hash_lookup_handle(hdev, handle); 7395 if (!bis) { 7396 if (handle > HCI_CONN_HANDLE_MAX) { 7397 bt_dev_dbg(hdev, "ignore too large handle %u", handle); 7398 continue; 7399 } 7400 bis = hci_conn_add(hdev, BIS_LINK, BDADDR_ANY, 0, 7401 HCI_ROLE_SLAVE, handle); 7402 if (IS_ERR(bis)) 7403 continue; 7404 } 7405 7406 if (ev->status != 0x42) 7407 /* Mark PA sync as established */ 7408 set_bit(HCI_CONN_PA_SYNC, &bis->flags); 7409 7410 bis->sync_handle = conn->sync_handle; 7411 bis->iso_qos.bcast.big = ev->handle; 7412 memset(&interval, 0, sizeof(interval)); 7413 memcpy(&interval, ev->latency, sizeof(ev->latency)); 7414 bis->iso_qos.bcast.in.interval = le32_to_cpu(interval); 7415 /* Convert ISO Interval (1.25 ms slots) to latency (ms) */ 7416 bis->iso_qos.bcast.in.latency = le16_to_cpu(ev->interval) * 125 / 100; 7417 bis->iso_qos.bcast.in.sdu = le16_to_cpu(ev->max_pdu); 7418 7419 if (!ev->status) { 7420 bis->state = BT_CONNECTED; 7421 set_bit(HCI_CONN_BIG_SYNC, &bis->flags); 7422 hci_debugfs_create_conn(bis); 7423 hci_conn_add_sysfs(bis); 7424 hci_iso_setup_path(bis); 7425 } 7426 } 7427 7428 /* In case BIG sync failed, notify each failed connection to 7429 * the user after all hci connections have been added 7430 */ 7431 if (ev->status) 7432 for (i = 0; i < ev->num_bis; i++) { 7433 u16 handle = le16_to_cpu(ev->bis[i]); 7434 7435 bis = hci_conn_hash_lookup_handle(hdev, handle); 7436 if (!bis) 7437 continue; 7438 7439 set_bit(HCI_CONN_BIG_SYNC_FAILED, &bis->flags); 7440 hci_connect_cfm(bis, ev->status); 7441 } 7442 7443 unlock: 7444 hci_dev_unlock(hdev); 7445 } 7446 7447 static void hci_le_big_sync_lost_evt(struct hci_dev *hdev, void *data, 7448 struct sk_buff *skb) 7449 { 7450 struct hci_evt_le_big_sync_lost *ev = data; 7451 struct hci_conn *bis; 7452 bool mgmt_conn = false; 7453 7454 bt_dev_dbg(hdev, "big handle 0x%2.2x", ev->handle); 7455 7456 hci_dev_lock(hdev); 7457 7458 /* Delete each bis connection */ 7459 while ((bis = hci_conn_hash_lookup_big_state(hdev, ev->handle, 7460 BT_CONNECTED, 7461 HCI_ROLE_SLAVE))) { 7462 if (!mgmt_conn) { 7463 /* Only peek at the flag here: hci_conn_del() (via 7464 * hci_conn_unlink()) still needs it set to know 7465 * whether to report the security level reset, so 7466 * it is consumed there instead of here. 7467 */ 7468 mgmt_conn = test_bit(HCI_CONN_MGMT_CONNECTED, 7469 &bis->flags); 7470 mgmt_device_disconnected(hdev, &bis->dst, bis->type, 7471 bis->dst_type, ev->reason, 7472 mgmt_conn); 7473 } 7474 7475 clear_bit(HCI_CONN_BIG_SYNC, &bis->flags); 7476 hci_disconn_cfm(bis, ev->reason); 7477 hci_conn_del(bis); 7478 } 7479 7480 hci_dev_unlock(hdev); 7481 } 7482 7483 static void hci_le_big_info_adv_report_evt(struct hci_dev *hdev, void *data, 7484 struct sk_buff *skb) 7485 { 7486 struct hci_evt_le_big_info_adv_report *ev = data; 7487 int mask = hdev->link_mode; 7488 __u8 flags = 0; 7489 struct hci_conn *pa_sync; 7490 7491 bt_dev_dbg(hdev, "sync_handle 0x%4.4x", le16_to_cpu(ev->sync_handle)); 7492 7493 hci_dev_lock(hdev); 7494 7495 mask |= hci_proto_connect_ind(hdev, BDADDR_ANY, BIS_LINK, &flags); 7496 if (!(mask & HCI_LM_ACCEPT)) 7497 goto unlock; 7498 7499 if (!(flags & HCI_PROTO_DEFER)) 7500 goto unlock; 7501 7502 pa_sync = hci_conn_hash_lookup_pa_sync_handle 7503 (hdev, 7504 le16_to_cpu(ev->sync_handle)); 7505 7506 if (!pa_sync) 7507 goto unlock; 7508 7509 pa_sync->iso_qos.bcast.encryption = ev->encryption; 7510 7511 /* Notify iso layer */ 7512 hci_connect_cfm(pa_sync, 0); 7513 7514 unlock: 7515 hci_dev_unlock(hdev); 7516 } 7517 7518 static void hci_le_read_all_remote_features_evt(struct hci_dev *hdev, 7519 void *data, struct sk_buff *skb) 7520 { 7521 struct hci_evt_le_read_all_remote_features_complete *ev = data; 7522 struct hci_conn *conn; 7523 7524 bt_dev_dbg(hdev, "status 0x%2.2x", ev->status); 7525 7526 hci_dev_lock(hdev); 7527 7528 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle)); 7529 if (!conn) 7530 goto unlock; 7531 7532 if (!ev->status) { 7533 memcpy(conn->le_features, ev->features, 248); 7534 7535 /* Update supported PHYs */ 7536 if (!(conn->le_features[1] & HCI_LE_PHY_2M)) { 7537 conn->le_tx_def_phys &= ~HCI_LE_SET_PHY_2M; 7538 conn->le_rx_def_phys &= ~HCI_LE_SET_PHY_2M; 7539 } 7540 7541 if (!(conn->le_features[1] & HCI_LE_PHY_CODED)) { 7542 conn->le_tx_def_phys &= ~HCI_LE_SET_PHY_CODED; 7543 conn->le_rx_def_phys &= ~HCI_LE_SET_PHY_CODED; 7544 } 7545 } 7546 7547 if (conn->state == BT_CONFIG) { 7548 __u8 status; 7549 7550 /* If the local controller supports peripheral-initiated 7551 * features exchange, but the remote controller does 7552 * not, then it is possible that the error code 0x1a 7553 * for unsupported remote feature gets returned. 7554 * 7555 * In this specific case, allow the connection to 7556 * transition into connected state and mark it as 7557 * successful. 7558 */ 7559 if (!conn->out && 7560 ev->status == HCI_ERROR_UNSUPPORTED_REMOTE_FEATURE && 7561 (hdev->le_features[0] & HCI_LE_PERIPHERAL_FEATURES)) 7562 status = 0x00; 7563 else 7564 status = ev->status; 7565 7566 conn->state = BT_CONNECTED; 7567 hci_connect_cfm(conn, status); 7568 } 7569 7570 unlock: 7571 hci_dev_unlock(hdev); 7572 } 7573 7574 static void hci_le_conn_rate_change_evt(struct hci_dev *hdev, void *data, 7575 struct sk_buff *skb) 7576 { 7577 struct hci_evt_le_conn_rate_change *ev = data; 7578 struct hci_conn *conn; 7579 7580 bt_dev_dbg(hdev, "status 0x%2.2x", ev->status); 7581 7582 hci_dev_lock(hdev); 7583 7584 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle)); 7585 if (conn) { 7586 /* Only update the stored rate parameters on success; on 7587 * failure the values in the event are not valid. Userspace is 7588 * notified either way. 7589 */ 7590 if (!ev->status) { 7591 conn->le_rate_interval = le16_to_cpu(ev->interval); 7592 conn->le_subrate = le16_to_cpu(ev->subrate); 7593 conn->le_rate_latency = le16_to_cpu(ev->latency); 7594 conn->le_cont_num = le16_to_cpu(ev->cont_number); 7595 conn->le_rate_supv_timeout = 7596 le16_to_cpu(ev->supv_timeout); 7597 } 7598 mgmt_conn_subrate_notify(hdev, conn, ev->status); 7599 } 7600 7601 hci_dev_unlock(hdev); 7602 } 7603 7604 #define HCI_LE_EV_VL(_op, _func, _min_len, _max_len) \ 7605 [_op] = { \ 7606 .func = _func, \ 7607 .min_len = _min_len, \ 7608 .max_len = _max_len, \ 7609 } 7610 7611 #define HCI_LE_EV(_op, _func, _len) \ 7612 HCI_LE_EV_VL(_op, _func, _len, _len) 7613 7614 #define HCI_LE_EV_STATUS(_op, _func) \ 7615 HCI_LE_EV(_op, _func, sizeof(struct hci_ev_status)) 7616 7617 #define HCI_MAX_LE_SUBEVT_PLEN \ 7618 (HCI_MAX_EVENT_PLEN - sizeof(struct hci_ev_le_meta)) 7619 7620 /* Entries in this table shall have their position according to the subevent 7621 * opcode they handle so the use of the macros above is recommend since it does 7622 * attempt to initialize at its proper index using Designated Initializers that 7623 * way events without a callback function can be omitted. 7624 */ 7625 static const struct hci_le_ev { 7626 void (*func)(struct hci_dev *hdev, void *data, struct sk_buff *skb); 7627 u16 min_len; 7628 u16 max_len; 7629 } hci_le_ev_table[U8_MAX + 1] = { 7630 /* [0x01 = HCI_EV_LE_CONN_COMPLETE] */ 7631 HCI_LE_EV(HCI_EV_LE_CONN_COMPLETE, hci_le_conn_complete_evt, 7632 sizeof(struct hci_ev_le_conn_complete)), 7633 /* [0x02 = HCI_EV_LE_ADVERTISING_REPORT] */ 7634 HCI_LE_EV_VL(HCI_EV_LE_ADVERTISING_REPORT, hci_le_adv_report_evt, 7635 sizeof(struct hci_ev_le_advertising_report), 7636 HCI_MAX_LE_SUBEVT_PLEN), 7637 /* [0x03 = HCI_EV_LE_CONN_UPDATE_COMPLETE] */ 7638 HCI_LE_EV(HCI_EV_LE_CONN_UPDATE_COMPLETE, 7639 hci_le_conn_update_complete_evt, 7640 sizeof(struct hci_ev_le_conn_update_complete)), 7641 /* [0x04 = HCI_EV_LE_REMOTE_FEAT_COMPLETE] */ 7642 HCI_LE_EV(HCI_EV_LE_REMOTE_FEAT_COMPLETE, 7643 hci_le_remote_feat_complete_evt, 7644 sizeof(struct hci_ev_le_remote_feat_complete)), 7645 /* [0x05 = HCI_EV_LE_LTK_REQ] */ 7646 HCI_LE_EV(HCI_EV_LE_LTK_REQ, hci_le_ltk_request_evt, 7647 sizeof(struct hci_ev_le_ltk_req)), 7648 /* [0x06 = HCI_EV_LE_REMOTE_CONN_PARAM_REQ] */ 7649 HCI_LE_EV(HCI_EV_LE_REMOTE_CONN_PARAM_REQ, 7650 hci_le_remote_conn_param_req_evt, 7651 sizeof(struct hci_ev_le_remote_conn_param_req)), 7652 /* [0x0a = HCI_EV_LE_ENHANCED_CONN_COMPLETE] */ 7653 HCI_LE_EV(HCI_EV_LE_ENHANCED_CONN_COMPLETE, 7654 hci_le_enh_conn_complete_evt, 7655 sizeof(struct hci_ev_le_enh_conn_complete)), 7656 /* [0x0b = HCI_EV_LE_DIRECT_ADV_REPORT] */ 7657 HCI_LE_EV_VL(HCI_EV_LE_DIRECT_ADV_REPORT, hci_le_direct_adv_report_evt, 7658 sizeof(struct hci_ev_le_direct_adv_report), 7659 HCI_MAX_LE_SUBEVT_PLEN), 7660 /* [0x0c = HCI_EV_LE_PHY_UPDATE_COMPLETE] */ 7661 HCI_LE_EV(HCI_EV_LE_PHY_UPDATE_COMPLETE, hci_le_phy_update_evt, 7662 sizeof(struct hci_ev_le_phy_update_complete)), 7663 /* [0x0d = HCI_EV_LE_EXT_ADV_REPORT] */ 7664 HCI_LE_EV_VL(HCI_EV_LE_EXT_ADV_REPORT, hci_le_ext_adv_report_evt, 7665 sizeof(struct hci_ev_le_ext_adv_report), 7666 HCI_MAX_LE_SUBEVT_PLEN), 7667 /* [0x0e = HCI_EV_LE_PA_SYNC_ESTABLISHED] */ 7668 HCI_LE_EV(HCI_EV_LE_PA_SYNC_ESTABLISHED, 7669 hci_le_pa_sync_established_evt, 7670 sizeof(struct hci_ev_le_pa_sync_established)), 7671 /* [0x0f = HCI_EV_LE_PER_ADV_REPORT] */ 7672 HCI_LE_EV_VL(HCI_EV_LE_PER_ADV_REPORT, 7673 hci_le_per_adv_report_evt, 7674 sizeof(struct hci_ev_le_per_adv_report), 7675 HCI_MAX_LE_SUBEVT_PLEN), 7676 /* [0x10 = HCI_EV_LE_PA_SYNC_LOST] */ 7677 HCI_LE_EV(HCI_EV_LE_PA_SYNC_LOST, hci_le_pa_sync_lost_evt, 7678 sizeof(struct hci_ev_le_pa_sync_lost)), 7679 /* [0x12 = HCI_EV_LE_EXT_ADV_SET_TERM] */ 7680 HCI_LE_EV(HCI_EV_LE_EXT_ADV_SET_TERM, hci_le_ext_adv_term_evt, 7681 sizeof(struct hci_evt_le_ext_adv_set_term)), 7682 /* [0x18 = HCI_EVT_LE_PAST_RECEIVED] */ 7683 HCI_LE_EV(HCI_EV_LE_PAST_RECEIVED, 7684 hci_le_past_received_evt, 7685 sizeof(struct hci_ev_le_past_received)), 7686 /* [0x19 = HCI_EVT_LE_CIS_ESTABLISHED] */ 7687 HCI_LE_EV(HCI_EVT_LE_CIS_ESTABLISHED, hci_le_cis_established_evt, 7688 sizeof(struct hci_evt_le_cis_established)), 7689 /* [0x1a = HCI_EVT_LE_CIS_REQ] */ 7690 HCI_LE_EV(HCI_EVT_LE_CIS_REQ, hci_le_cis_req_evt, 7691 sizeof(struct hci_evt_le_cis_req)), 7692 /* [0x1b = HCI_EVT_LE_CREATE_BIG_COMPLETE] */ 7693 HCI_LE_EV_VL(HCI_EVT_LE_CREATE_BIG_COMPLETE, 7694 hci_le_create_big_complete_evt, 7695 sizeof(struct hci_evt_le_create_big_complete), 7696 HCI_MAX_LE_SUBEVT_PLEN), 7697 /* [0x1d = HCI_EV_LE_BIG_SYNC_ESTABLISHED] */ 7698 HCI_LE_EV_VL(HCI_EVT_LE_BIG_SYNC_ESTABLISHED, 7699 hci_le_big_sync_established_evt, 7700 sizeof(struct hci_evt_le_big_sync_established), 7701 HCI_MAX_LE_SUBEVT_PLEN), 7702 /* [0x1e = HCI_EVT_LE_BIG_SYNC_LOST] */ 7703 HCI_LE_EV_VL(HCI_EVT_LE_BIG_SYNC_LOST, 7704 hci_le_big_sync_lost_evt, 7705 sizeof(struct hci_evt_le_big_sync_lost), 7706 HCI_MAX_LE_SUBEVT_PLEN), 7707 /* [0x22 = HCI_EVT_LE_BIG_INFO_ADV_REPORT] */ 7708 HCI_LE_EV_VL(HCI_EVT_LE_BIG_INFO_ADV_REPORT, 7709 hci_le_big_info_adv_report_evt, 7710 sizeof(struct hci_evt_le_big_info_adv_report), 7711 HCI_MAX_LE_SUBEVT_PLEN), 7712 /* [0x2b = HCI_EVT_LE_ALL_REMOTE_FEATURES_COMPLETE] */ 7713 HCI_LE_EV_VL(HCI_EVT_LE_ALL_REMOTE_FEATURES_COMPLETE, 7714 hci_le_read_all_remote_features_evt, 7715 sizeof(struct 7716 hci_evt_le_read_all_remote_features_complete), 7717 HCI_MAX_LE_SUBEVT_PLEN), 7718 /* [0x37 = HCI_EVT_LE_CONN_RATE_CHANGE] */ 7719 HCI_LE_EV(HCI_EVT_LE_CONN_RATE_CHANGE, hci_le_conn_rate_change_evt, 7720 sizeof(struct hci_evt_le_conn_rate_change)), 7721 }; 7722 7723 static void hci_le_meta_evt(struct hci_dev *hdev, void *data, 7724 struct sk_buff *skb, u16 *opcode, u8 *status, 7725 hci_req_complete_t *req_complete, 7726 hci_req_complete_skb_t *req_complete_skb) 7727 { 7728 struct hci_ev_le_meta *ev = data; 7729 const struct hci_le_ev *subev; 7730 7731 bt_dev_dbg(hdev, "subevent 0x%2.2x", ev->subevent); 7732 7733 /* Only match event if command OGF is for LE */ 7734 if (hdev->req_skb && 7735 (hci_opcode_ogf(hci_skb_opcode(hdev->req_skb)) == 0x08 || 7736 hci_skb_opcode(hdev->req_skb) == HCI_OP_NOP) && 7737 hci_skb_event(hdev->req_skb) == ev->subevent) { 7738 *opcode = hci_skb_opcode(hdev->req_skb); 7739 hci_req_cmd_complete(hdev, *opcode, 0x00, req_complete, 7740 req_complete_skb); 7741 } 7742 7743 subev = &hci_le_ev_table[ev->subevent]; 7744 if (!subev->func) 7745 return; 7746 7747 if (skb->len < subev->min_len) { 7748 bt_dev_err(hdev, "unexpected subevent 0x%2.2x length: %u < %u", 7749 ev->subevent, skb->len, subev->min_len); 7750 return; 7751 } 7752 7753 /* Just warn if the length is over max_len size it still be 7754 * possible to partially parse the event so leave to callback to 7755 * decide if that is acceptable. 7756 */ 7757 if (skb->len > subev->max_len) 7758 bt_dev_warn(hdev, "unexpected subevent 0x%2.2x length: %u > %u", 7759 ev->subevent, skb->len, subev->max_len); 7760 data = hci_le_ev_skb_pull(hdev, skb, ev->subevent, subev->min_len); 7761 if (!data) 7762 return; 7763 7764 subev->func(hdev, data, skb); 7765 } 7766 7767 static void hci_vendor_evt(struct hci_dev *hdev, void *data, struct sk_buff *skb) 7768 { 7769 if (hdev->handle_ev_vendor && hdev->handle_ev_vendor(hdev, skb)) 7770 return; 7771 7772 msft_vendor_evt(hdev, data, skb); 7773 } 7774 7775 static bool hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode, 7776 u8 event, struct sk_buff *skb) 7777 { 7778 struct hci_ev_cmd_complete *ev; 7779 struct hci_event_hdr *hdr; 7780 7781 if (!skb) 7782 return false; 7783 7784 hdr = hci_ev_skb_pull(hdev, skb, event, sizeof(*hdr)); 7785 if (!hdr) 7786 return false; 7787 7788 if (event) { 7789 if (hdr->evt != event) 7790 return false; 7791 return true; 7792 } 7793 7794 /* Check if request ended in Command Status - no way to retrieve 7795 * any extra parameters in this case. 7796 */ 7797 if (hdr->evt == HCI_EV_CMD_STATUS) 7798 return false; 7799 7800 if (hdr->evt != HCI_EV_CMD_COMPLETE) { 7801 bt_dev_err(hdev, "last event is not cmd complete (0x%2.2x)", 7802 hdr->evt); 7803 return false; 7804 } 7805 7806 ev = hci_cc_skb_pull(hdev, skb, opcode, sizeof(*ev)); 7807 if (!ev) 7808 return false; 7809 7810 if (opcode != __le16_to_cpu(ev->opcode)) { 7811 BT_DBG("opcode doesn't match (0x%2.2x != 0x%2.2x)", opcode, 7812 __le16_to_cpu(ev->opcode)); 7813 return false; 7814 } 7815 7816 return true; 7817 } 7818 7819 static void hci_store_wake_reason(struct hci_dev *hdev, 7820 const bdaddr_t *bdaddr, u8 addr_type) 7821 __must_hold(&hdev->lock) 7822 { 7823 lockdep_assert_held(&hdev->lock); 7824 7825 /* If we are currently suspended and this is the first BT event seen, 7826 * save the wake reason associated with the event. 7827 */ 7828 if (!hdev->suspended || hdev->wake_reason) 7829 return; 7830 7831 if (!bdaddr) { 7832 hdev->wake_reason = MGMT_WAKE_REASON_UNEXPECTED; 7833 return; 7834 } 7835 7836 /* Default to remote wake. Values for wake_reason are documented in the 7837 * Bluez mgmt api docs. 7838 */ 7839 hdev->wake_reason = MGMT_WAKE_REASON_REMOTE_WAKE; 7840 bacpy(&hdev->wake_addr, bdaddr); 7841 hdev->wake_addr_type = addr_type; 7842 } 7843 7844 #define HCI_EV_VL(_op, _func, _min_len, _max_len) \ 7845 [_op] = { \ 7846 .req = false, \ 7847 .func = _func, \ 7848 .min_len = _min_len, \ 7849 .max_len = _max_len, \ 7850 } 7851 7852 #define HCI_EV(_op, _func, _len) \ 7853 HCI_EV_VL(_op, _func, _len, _len) 7854 7855 #define HCI_EV_STATUS(_op, _func) \ 7856 HCI_EV(_op, _func, sizeof(struct hci_ev_status)) 7857 7858 #define HCI_EV_REQ_VL(_op, _func, _min_len, _max_len) \ 7859 [_op] = { \ 7860 .req = true, \ 7861 .func_req = _func, \ 7862 .min_len = _min_len, \ 7863 .max_len = _max_len, \ 7864 } 7865 7866 #define HCI_EV_REQ(_op, _func, _len) \ 7867 HCI_EV_REQ_VL(_op, _func, _len, _len) 7868 7869 /* Entries in this table shall have their position according to the event opcode 7870 * they handle so the use of the macros above is recommend since it does attempt 7871 * to initialize at its proper index using Designated Initializers that way 7872 * events without a callback function don't have entered. 7873 */ 7874 static const struct hci_ev { 7875 bool req; 7876 union { 7877 void (*func)(struct hci_dev *hdev, void *data, 7878 struct sk_buff *skb); 7879 void (*func_req)(struct hci_dev *hdev, void *data, 7880 struct sk_buff *skb, u16 *opcode, u8 *status, 7881 hci_req_complete_t *req_complete, 7882 hci_req_complete_skb_t *req_complete_skb); 7883 }; 7884 u16 min_len; 7885 u16 max_len; 7886 } hci_ev_table[U8_MAX + 1] = { 7887 /* [0x01 = HCI_EV_INQUIRY_COMPLETE] */ 7888 HCI_EV_STATUS(HCI_EV_INQUIRY_COMPLETE, hci_inquiry_complete_evt), 7889 /* [0x02 = HCI_EV_INQUIRY_RESULT] */ 7890 HCI_EV_VL(HCI_EV_INQUIRY_RESULT, hci_inquiry_result_evt, 7891 sizeof(struct hci_ev_inquiry_result), HCI_MAX_EVENT_PLEN), 7892 /* [0x03 = HCI_EV_CONN_COMPLETE] */ 7893 HCI_EV(HCI_EV_CONN_COMPLETE, hci_conn_complete_evt, 7894 sizeof(struct hci_ev_conn_complete)), 7895 /* [0x04 = HCI_EV_CONN_REQUEST] */ 7896 HCI_EV(HCI_EV_CONN_REQUEST, hci_conn_request_evt, 7897 sizeof(struct hci_ev_conn_request)), 7898 /* [0x05 = HCI_EV_DISCONN_COMPLETE] */ 7899 HCI_EV(HCI_EV_DISCONN_COMPLETE, hci_disconn_complete_evt, 7900 sizeof(struct hci_ev_disconn_complete)), 7901 /* [0x06 = HCI_EV_AUTH_COMPLETE] */ 7902 HCI_EV(HCI_EV_AUTH_COMPLETE, hci_auth_complete_evt, 7903 sizeof(struct hci_ev_auth_complete)), 7904 /* [0x07 = HCI_EV_REMOTE_NAME] */ 7905 HCI_EV(HCI_EV_REMOTE_NAME, hci_remote_name_evt, 7906 sizeof(struct hci_ev_remote_name)), 7907 /* [0x08 = HCI_EV_ENCRYPT_CHANGE] */ 7908 HCI_EV(HCI_EV_ENCRYPT_CHANGE, hci_encrypt_change_evt, 7909 sizeof(struct hci_ev_encrypt_change)), 7910 /* [0x09 = HCI_EV_CHANGE_LINK_KEY_COMPLETE] */ 7911 HCI_EV(HCI_EV_CHANGE_LINK_KEY_COMPLETE, 7912 hci_change_link_key_complete_evt, 7913 sizeof(struct hci_ev_change_link_key_complete)), 7914 /* [0x0b = HCI_EV_REMOTE_FEATURES] */ 7915 HCI_EV(HCI_EV_REMOTE_FEATURES, hci_remote_features_evt, 7916 sizeof(struct hci_ev_remote_features)), 7917 /* [0x0e = HCI_EV_CMD_COMPLETE] */ 7918 HCI_EV_REQ_VL(HCI_EV_CMD_COMPLETE, hci_cmd_complete_evt, 7919 sizeof(struct hci_ev_cmd_complete), HCI_MAX_EVENT_PLEN), 7920 /* [0x0f = HCI_EV_CMD_STATUS] */ 7921 HCI_EV_REQ(HCI_EV_CMD_STATUS, hci_cmd_status_evt, 7922 sizeof(struct hci_ev_cmd_status)), 7923 /* [0x10 = HCI_EV_CMD_STATUS] */ 7924 HCI_EV(HCI_EV_HARDWARE_ERROR, hci_hardware_error_evt, 7925 sizeof(struct hci_ev_hardware_error)), 7926 /* [0x12 = HCI_EV_ROLE_CHANGE] */ 7927 HCI_EV(HCI_EV_ROLE_CHANGE, hci_role_change_evt, 7928 sizeof(struct hci_ev_role_change)), 7929 /* [0x13 = HCI_EV_NUM_COMP_PKTS] */ 7930 HCI_EV_VL(HCI_EV_NUM_COMP_PKTS, hci_num_comp_pkts_evt, 7931 sizeof(struct hci_ev_num_comp_pkts), HCI_MAX_EVENT_PLEN), 7932 /* [0x14 = HCI_EV_MODE_CHANGE] */ 7933 HCI_EV(HCI_EV_MODE_CHANGE, hci_mode_change_evt, 7934 sizeof(struct hci_ev_mode_change)), 7935 /* [0x16 = HCI_EV_PIN_CODE_REQ] */ 7936 HCI_EV(HCI_EV_PIN_CODE_REQ, hci_pin_code_request_evt, 7937 sizeof(struct hci_ev_pin_code_req)), 7938 /* [0x17 = HCI_EV_LINK_KEY_REQ] */ 7939 HCI_EV(HCI_EV_LINK_KEY_REQ, hci_link_key_request_evt, 7940 sizeof(struct hci_ev_link_key_req)), 7941 /* [0x18 = HCI_EV_LINK_KEY_NOTIFY] */ 7942 HCI_EV(HCI_EV_LINK_KEY_NOTIFY, hci_link_key_notify_evt, 7943 sizeof(struct hci_ev_link_key_notify)), 7944 /* [0x1c = HCI_EV_CLOCK_OFFSET] */ 7945 HCI_EV(HCI_EV_CLOCK_OFFSET, hci_clock_offset_evt, 7946 sizeof(struct hci_ev_clock_offset)), 7947 /* [0x1d = HCI_EV_PKT_TYPE_CHANGE] */ 7948 HCI_EV(HCI_EV_PKT_TYPE_CHANGE, hci_pkt_type_change_evt, 7949 sizeof(struct hci_ev_pkt_type_change)), 7950 /* [0x20 = HCI_EV_PSCAN_REP_MODE] */ 7951 HCI_EV(HCI_EV_PSCAN_REP_MODE, hci_pscan_rep_mode_evt, 7952 sizeof(struct hci_ev_pscan_rep_mode)), 7953 /* [0x22 = HCI_EV_INQUIRY_RESULT_WITH_RSSI] */ 7954 HCI_EV_VL(HCI_EV_INQUIRY_RESULT_WITH_RSSI, 7955 hci_inquiry_result_with_rssi_evt, 7956 sizeof(struct hci_ev_inquiry_result_rssi), 7957 HCI_MAX_EVENT_PLEN), 7958 /* [0x23 = HCI_EV_REMOTE_EXT_FEATURES] */ 7959 HCI_EV(HCI_EV_REMOTE_EXT_FEATURES, hci_remote_ext_features_evt, 7960 sizeof(struct hci_ev_remote_ext_features)), 7961 /* [0x2c = HCI_EV_SYNC_CONN_COMPLETE] */ 7962 HCI_EV(HCI_EV_SYNC_CONN_COMPLETE, hci_sync_conn_complete_evt, 7963 sizeof(struct hci_ev_sync_conn_complete)), 7964 /* [0x2f = HCI_EV_EXTENDED_INQUIRY_RESULT] */ 7965 HCI_EV_VL(HCI_EV_EXTENDED_INQUIRY_RESULT, 7966 hci_extended_inquiry_result_evt, 7967 sizeof(struct hci_ev_ext_inquiry_result), HCI_MAX_EVENT_PLEN), 7968 /* [0x30 = HCI_EV_KEY_REFRESH_COMPLETE] */ 7969 HCI_EV(HCI_EV_KEY_REFRESH_COMPLETE, hci_key_refresh_complete_evt, 7970 sizeof(struct hci_ev_key_refresh_complete)), 7971 /* [0x31 = HCI_EV_IO_CAPA_REQUEST] */ 7972 HCI_EV(HCI_EV_IO_CAPA_REQUEST, hci_io_capa_request_evt, 7973 sizeof(struct hci_ev_io_capa_request)), 7974 /* [0x32 = HCI_EV_IO_CAPA_REPLY] */ 7975 HCI_EV(HCI_EV_IO_CAPA_REPLY, hci_io_capa_reply_evt, 7976 sizeof(struct hci_ev_io_capa_reply)), 7977 /* [0x33 = HCI_EV_USER_CONFIRM_REQUEST] */ 7978 HCI_EV(HCI_EV_USER_CONFIRM_REQUEST, hci_user_confirm_request_evt, 7979 sizeof(struct hci_ev_user_confirm_req)), 7980 /* [0x34 = HCI_EV_USER_PASSKEY_REQUEST] */ 7981 HCI_EV(HCI_EV_USER_PASSKEY_REQUEST, hci_user_passkey_request_evt, 7982 sizeof(struct hci_ev_user_passkey_req)), 7983 /* [0x35 = HCI_EV_REMOTE_OOB_DATA_REQUEST] */ 7984 HCI_EV(HCI_EV_REMOTE_OOB_DATA_REQUEST, hci_remote_oob_data_request_evt, 7985 sizeof(struct hci_ev_remote_oob_data_request)), 7986 /* [0x36 = HCI_EV_SIMPLE_PAIR_COMPLETE] */ 7987 HCI_EV(HCI_EV_SIMPLE_PAIR_COMPLETE, hci_simple_pair_complete_evt, 7988 sizeof(struct hci_ev_simple_pair_complete)), 7989 /* [0x3b = HCI_EV_USER_PASSKEY_NOTIFY] */ 7990 HCI_EV(HCI_EV_USER_PASSKEY_NOTIFY, hci_user_passkey_notify_evt, 7991 sizeof(struct hci_ev_user_passkey_notify)), 7992 /* [0x3c = HCI_EV_KEYPRESS_NOTIFY] */ 7993 HCI_EV(HCI_EV_KEYPRESS_NOTIFY, hci_keypress_notify_evt, 7994 sizeof(struct hci_ev_keypress_notify)), 7995 /* [0x3d = HCI_EV_REMOTE_HOST_FEATURES] */ 7996 HCI_EV(HCI_EV_REMOTE_HOST_FEATURES, hci_remote_host_features_evt, 7997 sizeof(struct hci_ev_remote_host_features)), 7998 /* [0x3e = HCI_EV_LE_META] */ 7999 HCI_EV_REQ_VL(HCI_EV_LE_META, hci_le_meta_evt, 8000 sizeof(struct hci_ev_le_meta), HCI_MAX_EVENT_PLEN), 8001 /* [0xff = HCI_EV_VENDOR] */ 8002 HCI_EV_VL(HCI_EV_VENDOR, hci_vendor_evt, 0, HCI_MAX_EVENT_PLEN), 8003 }; 8004 8005 static void hci_event_func(struct hci_dev *hdev, u8 event, struct sk_buff *skb, 8006 u16 *opcode, u8 *status, 8007 hci_req_complete_t *req_complete, 8008 hci_req_complete_skb_t *req_complete_skb) 8009 { 8010 const struct hci_ev *ev = &hci_ev_table[event]; 8011 void *data; 8012 8013 if (!ev->func) 8014 return; 8015 8016 if (skb->len < ev->min_len) { 8017 bt_dev_err(hdev, "unexpected event 0x%2.2x length: %u < %u", 8018 event, skb->len, ev->min_len); 8019 return; 8020 } 8021 8022 /* Just warn if the length is over max_len size it still be 8023 * possible to partially parse the event so leave to callback to 8024 * decide if that is acceptable. 8025 */ 8026 if (skb->len > ev->max_len) 8027 bt_dev_warn_ratelimited(hdev, 8028 "unexpected event 0x%2.2x length: %u > %u", 8029 event, skb->len, ev->max_len); 8030 8031 data = hci_ev_skb_pull(hdev, skb, event, ev->min_len); 8032 if (!data) 8033 return; 8034 8035 if (ev->req) 8036 ev->func_req(hdev, data, skb, opcode, status, req_complete, 8037 req_complete_skb); 8038 else 8039 ev->func(hdev, data, skb); 8040 } 8041 8042 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb) 8043 { 8044 struct hci_event_hdr *hdr = (void *) skb->data; 8045 hci_req_complete_t req_complete = NULL; 8046 hci_req_complete_skb_t req_complete_skb = NULL; 8047 struct sk_buff *orig_skb = NULL; 8048 u8 status = 0, event, req_evt = 0; 8049 u16 opcode = HCI_OP_NOP; 8050 8051 if (skb->len < sizeof(*hdr)) { 8052 bt_dev_err(hdev, "Malformed HCI Event"); 8053 goto done; 8054 } 8055 8056 hci_dev_lock(hdev); 8057 kfree_skb(hdev->recv_event); 8058 hdev->recv_event = skb_clone(skb, GFP_KERNEL); 8059 hci_dev_unlock(hdev); 8060 8061 event = hdr->evt; 8062 if (!event) { 8063 bt_dev_warn(hdev, "Received unexpected HCI Event 0x%2.2x", 8064 event); 8065 goto done; 8066 } 8067 8068 /* Only match event if command OGF is not for LE */ 8069 if (hdev->req_skb && 8070 hci_opcode_ogf(hci_skb_opcode(hdev->req_skb)) != 0x08 && 8071 hci_skb_event(hdev->req_skb) == event) { 8072 hci_req_cmd_complete(hdev, hci_skb_opcode(hdev->req_skb), 8073 status, &req_complete, &req_complete_skb); 8074 req_evt = event; 8075 } 8076 8077 /* If it looks like we might end up having to call 8078 * req_complete_skb, store a pristine copy of the skb since the 8079 * various handlers may modify the original one through 8080 * skb_pull() calls, etc. 8081 */ 8082 if (req_complete_skb || event == HCI_EV_CMD_STATUS || 8083 event == HCI_EV_CMD_COMPLETE) 8084 orig_skb = skb_clone(skb, GFP_KERNEL); 8085 8086 skb_pull(skb, HCI_EVENT_HDR_SIZE); 8087 8088 bt_dev_dbg(hdev, "event 0x%2.2x", event); 8089 8090 hci_event_func(hdev, event, skb, &opcode, &status, &req_complete, 8091 &req_complete_skb); 8092 8093 hci_dev_lock(hdev); 8094 hci_store_wake_reason(hdev, NULL, 0); 8095 hci_dev_unlock(hdev); 8096 8097 if (req_complete) { 8098 req_complete(hdev, status, opcode); 8099 } else if (req_complete_skb) { 8100 if (!hci_get_cmd_complete(hdev, opcode, req_evt, orig_skb)) { 8101 kfree_skb(orig_skb); 8102 orig_skb = NULL; 8103 } 8104 req_complete_skb(hdev, status, opcode, orig_skb); 8105 } 8106 8107 done: 8108 kfree_skb(orig_skb); 8109 kfree_skb(skb); 8110 hdev->stat.evt_rx++; 8111 } 8112