xref: /linux/net/bluetooth/hci_event.c (revision 4003c9e78778e93188a09d6043a74f7154449d43)
1 /*
2    BlueZ - Bluetooth protocol stack for Linux
3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
4    Copyright 2023-2024 NXP
5 
6    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
7 
8    This program is free software; you can redistribute it and/or modify
9    it under the terms of the GNU General Public License version 2 as
10    published by the Free Software Foundation;
11 
12    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
13    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
14    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
15    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
16    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
17    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
18    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
19    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20 
21    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
22    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
23    SOFTWARE IS DISCLAIMED.
24 */
25 
26 /* Bluetooth HCI event handling. */
27 
28 #include <linux/unaligned.h>
29 #include <linux/crypto.h>
30 #include <crypto/algapi.h>
31 
32 #include <net/bluetooth/bluetooth.h>
33 #include <net/bluetooth/hci_core.h>
34 #include <net/bluetooth/mgmt.h>
35 
36 #include "hci_debugfs.h"
37 #include "hci_codec.h"
38 #include "smp.h"
39 #include "msft.h"
40 #include "eir.h"
41 
42 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
43 		 "\x00\x00\x00\x00\x00\x00\x00\x00"
44 
45 /* Handle HCI Event packets */
46 
hci_ev_skb_pull(struct hci_dev * hdev,struct sk_buff * skb,u8 ev,size_t len)47 static void *hci_ev_skb_pull(struct hci_dev *hdev, struct sk_buff *skb,
48 			     u8 ev, size_t len)
49 {
50 	void *data;
51 
52 	data = skb_pull_data(skb, len);
53 	if (!data)
54 		bt_dev_err(hdev, "Malformed Event: 0x%2.2x", ev);
55 
56 	return data;
57 }
58 
hci_cc_skb_pull(struct hci_dev * hdev,struct sk_buff * skb,u16 op,size_t len)59 static void *hci_cc_skb_pull(struct hci_dev *hdev, struct sk_buff *skb,
60 			     u16 op, size_t len)
61 {
62 	void *data;
63 
64 	data = skb_pull_data(skb, len);
65 	if (!data)
66 		bt_dev_err(hdev, "Malformed Command Complete: 0x%4.4x", op);
67 
68 	return data;
69 }
70 
hci_le_ev_skb_pull(struct hci_dev * hdev,struct sk_buff * skb,u8 ev,size_t len)71 static void *hci_le_ev_skb_pull(struct hci_dev *hdev, struct sk_buff *skb,
72 				u8 ev, size_t len)
73 {
74 	void *data;
75 
76 	data = skb_pull_data(skb, len);
77 	if (!data)
78 		bt_dev_err(hdev, "Malformed LE Event: 0x%2.2x", ev);
79 
80 	return data;
81 }
82 
hci_cc_inquiry_cancel(struct hci_dev * hdev,void * data,struct sk_buff * skb)83 static u8 hci_cc_inquiry_cancel(struct hci_dev *hdev, void *data,
84 				struct sk_buff *skb)
85 {
86 	struct hci_ev_status *rp = data;
87 
88 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
89 
90 	/* It is possible that we receive Inquiry Complete event right
91 	 * before we receive Inquiry Cancel Command Complete event, in
92 	 * which case the latter event should have status of Command
93 	 * Disallowed. This should not be treated as error, since
94 	 * we actually achieve what Inquiry Cancel wants to achieve,
95 	 * which is to end the last Inquiry session.
96 	 */
97 	if (rp->status == HCI_ERROR_COMMAND_DISALLOWED && !test_bit(HCI_INQUIRY, &hdev->flags)) {
98 		bt_dev_warn(hdev, "Ignoring error of Inquiry Cancel command");
99 		rp->status = 0x00;
100 	}
101 
102 	if (rp->status)
103 		return rp->status;
104 
105 	clear_bit(HCI_INQUIRY, &hdev->flags);
106 	smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
107 	wake_up_bit(&hdev->flags, HCI_INQUIRY);
108 
109 	hci_dev_lock(hdev);
110 	/* Set discovery state to stopped if we're not doing LE active
111 	 * scanning.
112 	 */
113 	if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
114 	    hdev->le_scan_type != LE_SCAN_ACTIVE)
115 		hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
116 	hci_dev_unlock(hdev);
117 
118 	return rp->status;
119 }
120 
hci_cc_periodic_inq(struct hci_dev * hdev,void * data,struct sk_buff * skb)121 static u8 hci_cc_periodic_inq(struct hci_dev *hdev, void *data,
122 			      struct sk_buff *skb)
123 {
124 	struct hci_ev_status *rp = data;
125 
126 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
127 
128 	if (rp->status)
129 		return rp->status;
130 
131 	hci_dev_set_flag(hdev, HCI_PERIODIC_INQ);
132 
133 	return rp->status;
134 }
135 
hci_cc_exit_periodic_inq(struct hci_dev * hdev,void * data,struct sk_buff * skb)136 static u8 hci_cc_exit_periodic_inq(struct hci_dev *hdev, void *data,
137 				   struct sk_buff *skb)
138 {
139 	struct hci_ev_status *rp = data;
140 
141 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
142 
143 	if (rp->status)
144 		return rp->status;
145 
146 	hci_dev_clear_flag(hdev, HCI_PERIODIC_INQ);
147 
148 	return rp->status;
149 }
150 
hci_cc_remote_name_req_cancel(struct hci_dev * hdev,void * data,struct sk_buff * skb)151 static u8 hci_cc_remote_name_req_cancel(struct hci_dev *hdev, void *data,
152 					struct sk_buff *skb)
153 {
154 	struct hci_ev_status *rp = data;
155 
156 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
157 
158 	return rp->status;
159 }
160 
hci_cc_role_discovery(struct hci_dev * hdev,void * data,struct sk_buff * skb)161 static u8 hci_cc_role_discovery(struct hci_dev *hdev, void *data,
162 				struct sk_buff *skb)
163 {
164 	struct hci_rp_role_discovery *rp = data;
165 	struct hci_conn *conn;
166 
167 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
168 
169 	if (rp->status)
170 		return rp->status;
171 
172 	hci_dev_lock(hdev);
173 
174 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
175 	if (conn)
176 		conn->role = rp->role;
177 
178 	hci_dev_unlock(hdev);
179 
180 	return rp->status;
181 }
182 
hci_cc_read_link_policy(struct hci_dev * hdev,void * data,struct sk_buff * skb)183 static u8 hci_cc_read_link_policy(struct hci_dev *hdev, void *data,
184 				  struct sk_buff *skb)
185 {
186 	struct hci_rp_read_link_policy *rp = data;
187 	struct hci_conn *conn;
188 
189 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
190 
191 	if (rp->status)
192 		return rp->status;
193 
194 	hci_dev_lock(hdev);
195 
196 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
197 	if (conn)
198 		conn->link_policy = __le16_to_cpu(rp->policy);
199 
200 	hci_dev_unlock(hdev);
201 
202 	return rp->status;
203 }
204 
hci_cc_write_link_policy(struct hci_dev * hdev,void * data,struct sk_buff * skb)205 static u8 hci_cc_write_link_policy(struct hci_dev *hdev, void *data,
206 				   struct sk_buff *skb)
207 {
208 	struct hci_rp_write_link_policy *rp = data;
209 	struct hci_conn *conn;
210 	void *sent;
211 
212 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
213 
214 	if (rp->status)
215 		return rp->status;
216 
217 	sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
218 	if (!sent)
219 		return rp->status;
220 
221 	hci_dev_lock(hdev);
222 
223 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
224 	if (conn)
225 		conn->link_policy = get_unaligned_le16(sent + 2);
226 
227 	hci_dev_unlock(hdev);
228 
229 	return rp->status;
230 }
231 
hci_cc_read_def_link_policy(struct hci_dev * hdev,void * data,struct sk_buff * skb)232 static u8 hci_cc_read_def_link_policy(struct hci_dev *hdev, void *data,
233 				      struct sk_buff *skb)
234 {
235 	struct hci_rp_read_def_link_policy *rp = data;
236 
237 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
238 
239 	if (rp->status)
240 		return rp->status;
241 
242 	hdev->link_policy = __le16_to_cpu(rp->policy);
243 
244 	return rp->status;
245 }
246 
hci_cc_write_def_link_policy(struct hci_dev * hdev,void * data,struct sk_buff * skb)247 static u8 hci_cc_write_def_link_policy(struct hci_dev *hdev, void *data,
248 				       struct sk_buff *skb)
249 {
250 	struct hci_ev_status *rp = data;
251 	void *sent;
252 
253 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
254 
255 	if (rp->status)
256 		return rp->status;
257 
258 	sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
259 	if (!sent)
260 		return rp->status;
261 
262 	hdev->link_policy = get_unaligned_le16(sent);
263 
264 	return rp->status;
265 }
266 
hci_cc_reset(struct hci_dev * hdev,void * data,struct sk_buff * skb)267 static u8 hci_cc_reset(struct hci_dev *hdev, void *data, struct sk_buff *skb)
268 {
269 	struct hci_ev_status *rp = data;
270 
271 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
272 
273 	clear_bit(HCI_RESET, &hdev->flags);
274 
275 	if (rp->status)
276 		return rp->status;
277 
278 	/* Reset all non-persistent flags */
279 	hci_dev_clear_volatile_flags(hdev);
280 
281 	hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
282 
283 	hdev->inq_tx_power = HCI_TX_POWER_INVALID;
284 	hdev->adv_tx_power = HCI_TX_POWER_INVALID;
285 
286 	memset(hdev->adv_data, 0, sizeof(hdev->adv_data));
287 	hdev->adv_data_len = 0;
288 
289 	memset(hdev->scan_rsp_data, 0, sizeof(hdev->scan_rsp_data));
290 	hdev->scan_rsp_data_len = 0;
291 
292 	hdev->le_scan_type = LE_SCAN_PASSIVE;
293 
294 	hdev->ssp_debug_mode = 0;
295 
296 	hci_bdaddr_list_clear(&hdev->le_accept_list);
297 	hci_bdaddr_list_clear(&hdev->le_resolv_list);
298 
299 	return rp->status;
300 }
301 
hci_cc_read_stored_link_key(struct hci_dev * hdev,void * data,struct sk_buff * skb)302 static u8 hci_cc_read_stored_link_key(struct hci_dev *hdev, void *data,
303 				      struct sk_buff *skb)
304 {
305 	struct hci_rp_read_stored_link_key *rp = data;
306 	struct hci_cp_read_stored_link_key *sent;
307 
308 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
309 
310 	sent = hci_sent_cmd_data(hdev, HCI_OP_READ_STORED_LINK_KEY);
311 	if (!sent)
312 		return rp->status;
313 
314 	if (!rp->status && sent->read_all == 0x01) {
315 		hdev->stored_max_keys = le16_to_cpu(rp->max_keys);
316 		hdev->stored_num_keys = le16_to_cpu(rp->num_keys);
317 	}
318 
319 	return rp->status;
320 }
321 
hci_cc_delete_stored_link_key(struct hci_dev * hdev,void * data,struct sk_buff * skb)322 static u8 hci_cc_delete_stored_link_key(struct hci_dev *hdev, void *data,
323 					struct sk_buff *skb)
324 {
325 	struct hci_rp_delete_stored_link_key *rp = data;
326 	u16 num_keys;
327 
328 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
329 
330 	if (rp->status)
331 		return rp->status;
332 
333 	num_keys = le16_to_cpu(rp->num_keys);
334 
335 	if (num_keys <= hdev->stored_num_keys)
336 		hdev->stored_num_keys -= num_keys;
337 	else
338 		hdev->stored_num_keys = 0;
339 
340 	return rp->status;
341 }
342 
hci_cc_write_local_name(struct hci_dev * hdev,void * data,struct sk_buff * skb)343 static u8 hci_cc_write_local_name(struct hci_dev *hdev, void *data,
344 				  struct sk_buff *skb)
345 {
346 	struct hci_ev_status *rp = data;
347 	void *sent;
348 
349 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
350 
351 	sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
352 	if (!sent)
353 		return rp->status;
354 
355 	hci_dev_lock(hdev);
356 
357 	if (hci_dev_test_flag(hdev, HCI_MGMT))
358 		mgmt_set_local_name_complete(hdev, sent, rp->status);
359 	else if (!rp->status)
360 		memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
361 
362 	hci_dev_unlock(hdev);
363 
364 	return rp->status;
365 }
366 
hci_cc_read_local_name(struct hci_dev * hdev,void * data,struct sk_buff * skb)367 static u8 hci_cc_read_local_name(struct hci_dev *hdev, void *data,
368 				 struct sk_buff *skb)
369 {
370 	struct hci_rp_read_local_name *rp = data;
371 
372 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
373 
374 	if (rp->status)
375 		return rp->status;
376 
377 	if (hci_dev_test_flag(hdev, HCI_SETUP) ||
378 	    hci_dev_test_flag(hdev, HCI_CONFIG))
379 		memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
380 
381 	return rp->status;
382 }
383 
hci_cc_write_auth_enable(struct hci_dev * hdev,void * data,struct sk_buff * skb)384 static u8 hci_cc_write_auth_enable(struct hci_dev *hdev, void *data,
385 				   struct sk_buff *skb)
386 {
387 	struct hci_ev_status *rp = data;
388 	void *sent;
389 
390 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
391 
392 	sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
393 	if (!sent)
394 		return rp->status;
395 
396 	hci_dev_lock(hdev);
397 
398 	if (!rp->status) {
399 		__u8 param = *((__u8 *) sent);
400 
401 		if (param == AUTH_ENABLED)
402 			set_bit(HCI_AUTH, &hdev->flags);
403 		else
404 			clear_bit(HCI_AUTH, &hdev->flags);
405 	}
406 
407 	if (hci_dev_test_flag(hdev, HCI_MGMT))
408 		mgmt_auth_enable_complete(hdev, rp->status);
409 
410 	hci_dev_unlock(hdev);
411 
412 	return rp->status;
413 }
414 
hci_cc_write_encrypt_mode(struct hci_dev * hdev,void * data,struct sk_buff * skb)415 static u8 hci_cc_write_encrypt_mode(struct hci_dev *hdev, void *data,
416 				    struct sk_buff *skb)
417 {
418 	struct hci_ev_status *rp = data;
419 	__u8 param;
420 	void *sent;
421 
422 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
423 
424 	if (rp->status)
425 		return rp->status;
426 
427 	sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
428 	if (!sent)
429 		return rp->status;
430 
431 	param = *((__u8 *) sent);
432 
433 	if (param)
434 		set_bit(HCI_ENCRYPT, &hdev->flags);
435 	else
436 		clear_bit(HCI_ENCRYPT, &hdev->flags);
437 
438 	return rp->status;
439 }
440 
hci_cc_write_scan_enable(struct hci_dev * hdev,void * data,struct sk_buff * skb)441 static u8 hci_cc_write_scan_enable(struct hci_dev *hdev, void *data,
442 				   struct sk_buff *skb)
443 {
444 	struct hci_ev_status *rp = data;
445 	__u8 param;
446 	void *sent;
447 
448 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
449 
450 	sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
451 	if (!sent)
452 		return rp->status;
453 
454 	param = *((__u8 *) sent);
455 
456 	hci_dev_lock(hdev);
457 
458 	if (rp->status) {
459 		hdev->discov_timeout = 0;
460 		goto done;
461 	}
462 
463 	if (param & SCAN_INQUIRY)
464 		set_bit(HCI_ISCAN, &hdev->flags);
465 	else
466 		clear_bit(HCI_ISCAN, &hdev->flags);
467 
468 	if (param & SCAN_PAGE)
469 		set_bit(HCI_PSCAN, &hdev->flags);
470 	else
471 		clear_bit(HCI_PSCAN, &hdev->flags);
472 
473 done:
474 	hci_dev_unlock(hdev);
475 
476 	return rp->status;
477 }
478 
hci_cc_set_event_filter(struct hci_dev * hdev,void * data,struct sk_buff * skb)479 static u8 hci_cc_set_event_filter(struct hci_dev *hdev, void *data,
480 				  struct sk_buff *skb)
481 {
482 	struct hci_ev_status *rp = data;
483 	struct hci_cp_set_event_filter *cp;
484 	void *sent;
485 
486 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
487 
488 	if (rp->status)
489 		return rp->status;
490 
491 	sent = hci_sent_cmd_data(hdev, HCI_OP_SET_EVENT_FLT);
492 	if (!sent)
493 		return rp->status;
494 
495 	cp = (struct hci_cp_set_event_filter *)sent;
496 
497 	if (cp->flt_type == HCI_FLT_CLEAR_ALL)
498 		hci_dev_clear_flag(hdev, HCI_EVENT_FILTER_CONFIGURED);
499 	else
500 		hci_dev_set_flag(hdev, HCI_EVENT_FILTER_CONFIGURED);
501 
502 	return rp->status;
503 }
504 
hci_cc_read_class_of_dev(struct hci_dev * hdev,void * data,struct sk_buff * skb)505 static u8 hci_cc_read_class_of_dev(struct hci_dev *hdev, void *data,
506 				   struct sk_buff *skb)
507 {
508 	struct hci_rp_read_class_of_dev *rp = data;
509 
510 	if (WARN_ON(!hdev))
511 		return HCI_ERROR_UNSPECIFIED;
512 
513 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
514 
515 	if (rp->status)
516 		return rp->status;
517 
518 	memcpy(hdev->dev_class, rp->dev_class, 3);
519 
520 	bt_dev_dbg(hdev, "class 0x%.2x%.2x%.2x", hdev->dev_class[2],
521 		   hdev->dev_class[1], hdev->dev_class[0]);
522 
523 	return rp->status;
524 }
525 
hci_cc_write_class_of_dev(struct hci_dev * hdev,void * data,struct sk_buff * skb)526 static u8 hci_cc_write_class_of_dev(struct hci_dev *hdev, void *data,
527 				    struct sk_buff *skb)
528 {
529 	struct hci_ev_status *rp = data;
530 	void *sent;
531 
532 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
533 
534 	sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
535 	if (!sent)
536 		return rp->status;
537 
538 	hci_dev_lock(hdev);
539 
540 	if (!rp->status)
541 		memcpy(hdev->dev_class, sent, 3);
542 
543 	if (hci_dev_test_flag(hdev, HCI_MGMT))
544 		mgmt_set_class_of_dev_complete(hdev, sent, rp->status);
545 
546 	hci_dev_unlock(hdev);
547 
548 	return rp->status;
549 }
550 
hci_cc_read_voice_setting(struct hci_dev * hdev,void * data,struct sk_buff * skb)551 static u8 hci_cc_read_voice_setting(struct hci_dev *hdev, void *data,
552 				    struct sk_buff *skb)
553 {
554 	struct hci_rp_read_voice_setting *rp = data;
555 	__u16 setting;
556 
557 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
558 
559 	if (rp->status)
560 		return rp->status;
561 
562 	setting = __le16_to_cpu(rp->voice_setting);
563 
564 	if (hdev->voice_setting == setting)
565 		return rp->status;
566 
567 	hdev->voice_setting = setting;
568 
569 	bt_dev_dbg(hdev, "voice setting 0x%4.4x", setting);
570 
571 	if (hdev->notify)
572 		hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
573 
574 	return rp->status;
575 }
576 
hci_cc_write_voice_setting(struct hci_dev * hdev,void * data,struct sk_buff * skb)577 static u8 hci_cc_write_voice_setting(struct hci_dev *hdev, void *data,
578 				     struct sk_buff *skb)
579 {
580 	struct hci_ev_status *rp = data;
581 	__u16 setting;
582 	void *sent;
583 
584 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
585 
586 	if (rp->status)
587 		return rp->status;
588 
589 	sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
590 	if (!sent)
591 		return rp->status;
592 
593 	setting = get_unaligned_le16(sent);
594 
595 	if (hdev->voice_setting == setting)
596 		return rp->status;
597 
598 	hdev->voice_setting = setting;
599 
600 	bt_dev_dbg(hdev, "voice setting 0x%4.4x", setting);
601 
602 	if (hdev->notify)
603 		hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
604 
605 	return rp->status;
606 }
607 
hci_cc_read_num_supported_iac(struct hci_dev * hdev,void * data,struct sk_buff * skb)608 static u8 hci_cc_read_num_supported_iac(struct hci_dev *hdev, void *data,
609 					struct sk_buff *skb)
610 {
611 	struct hci_rp_read_num_supported_iac *rp = data;
612 
613 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
614 
615 	if (rp->status)
616 		return rp->status;
617 
618 	hdev->num_iac = rp->num_iac;
619 
620 	bt_dev_dbg(hdev, "num iac %d", hdev->num_iac);
621 
622 	return rp->status;
623 }
624 
hci_cc_write_ssp_mode(struct hci_dev * hdev,void * data,struct sk_buff * skb)625 static u8 hci_cc_write_ssp_mode(struct hci_dev *hdev, void *data,
626 				struct sk_buff *skb)
627 {
628 	struct hci_ev_status *rp = data;
629 	struct hci_cp_write_ssp_mode *sent;
630 
631 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
632 
633 	sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
634 	if (!sent)
635 		return rp->status;
636 
637 	hci_dev_lock(hdev);
638 
639 	if (!rp->status) {
640 		if (sent->mode)
641 			hdev->features[1][0] |= LMP_HOST_SSP;
642 		else
643 			hdev->features[1][0] &= ~LMP_HOST_SSP;
644 	}
645 
646 	if (!rp->status) {
647 		if (sent->mode)
648 			hci_dev_set_flag(hdev, HCI_SSP_ENABLED);
649 		else
650 			hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
651 	}
652 
653 	hci_dev_unlock(hdev);
654 
655 	return rp->status;
656 }
657 
hci_cc_write_sc_support(struct hci_dev * hdev,void * data,struct sk_buff * skb)658 static u8 hci_cc_write_sc_support(struct hci_dev *hdev, void *data,
659 				  struct sk_buff *skb)
660 {
661 	struct hci_ev_status *rp = data;
662 	struct hci_cp_write_sc_support *sent;
663 
664 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
665 
666 	sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SC_SUPPORT);
667 	if (!sent)
668 		return rp->status;
669 
670 	hci_dev_lock(hdev);
671 
672 	if (!rp->status) {
673 		if (sent->support)
674 			hdev->features[1][0] |= LMP_HOST_SC;
675 		else
676 			hdev->features[1][0] &= ~LMP_HOST_SC;
677 	}
678 
679 	if (!hci_dev_test_flag(hdev, HCI_MGMT) && !rp->status) {
680 		if (sent->support)
681 			hci_dev_set_flag(hdev, HCI_SC_ENABLED);
682 		else
683 			hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
684 	}
685 
686 	hci_dev_unlock(hdev);
687 
688 	return rp->status;
689 }
690 
hci_cc_read_local_version(struct hci_dev * hdev,void * data,struct sk_buff * skb)691 static u8 hci_cc_read_local_version(struct hci_dev *hdev, void *data,
692 				    struct sk_buff *skb)
693 {
694 	struct hci_rp_read_local_version *rp = data;
695 
696 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
697 
698 	if (rp->status)
699 		return rp->status;
700 
701 	if (hci_dev_test_flag(hdev, HCI_SETUP) ||
702 	    hci_dev_test_flag(hdev, HCI_CONFIG)) {
703 		hdev->hci_ver = rp->hci_ver;
704 		hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
705 		hdev->lmp_ver = rp->lmp_ver;
706 		hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
707 		hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
708 	}
709 
710 	return rp->status;
711 }
712 
hci_cc_read_enc_key_size(struct hci_dev * hdev,void * data,struct sk_buff * skb)713 static u8 hci_cc_read_enc_key_size(struct hci_dev *hdev, void *data,
714 				   struct sk_buff *skb)
715 {
716 	struct hci_rp_read_enc_key_size *rp = data;
717 	struct hci_conn *conn;
718 	u16 handle;
719 	u8 status = rp->status;
720 
721 	bt_dev_dbg(hdev, "status 0x%2.2x", status);
722 
723 	handle = le16_to_cpu(rp->handle);
724 
725 	hci_dev_lock(hdev);
726 
727 	conn = hci_conn_hash_lookup_handle(hdev, handle);
728 	if (!conn) {
729 		status = 0xFF;
730 		goto done;
731 	}
732 
733 	/* While unexpected, the read_enc_key_size command may fail. The most
734 	 * secure approach is to then assume the key size is 0 to force a
735 	 * disconnection.
736 	 */
737 	if (status) {
738 		bt_dev_err(hdev, "failed to read key size for handle %u",
739 			   handle);
740 		conn->enc_key_size = 0;
741 	} else {
742 		conn->enc_key_size = rp->key_size;
743 		status = 0;
744 
745 		if (conn->enc_key_size < hdev->min_enc_key_size) {
746 			/* As slave role, the conn->state has been set to
747 			 * BT_CONNECTED and l2cap conn req might not be received
748 			 * yet, at this moment the l2cap layer almost does
749 			 * nothing with the non-zero status.
750 			 * So we also clear encrypt related bits, and then the
751 			 * handler of l2cap conn req will get the right secure
752 			 * state at a later time.
753 			 */
754 			status = HCI_ERROR_AUTH_FAILURE;
755 			clear_bit(HCI_CONN_ENCRYPT, &conn->flags);
756 			clear_bit(HCI_CONN_AES_CCM, &conn->flags);
757 		}
758 	}
759 
760 	hci_encrypt_cfm(conn, status);
761 
762 done:
763 	hci_dev_unlock(hdev);
764 
765 	return status;
766 }
767 
hci_cc_read_local_commands(struct hci_dev * hdev,void * data,struct sk_buff * skb)768 static u8 hci_cc_read_local_commands(struct hci_dev *hdev, void *data,
769 				     struct sk_buff *skb)
770 {
771 	struct hci_rp_read_local_commands *rp = data;
772 
773 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
774 
775 	if (rp->status)
776 		return rp->status;
777 
778 	if (hci_dev_test_flag(hdev, HCI_SETUP) ||
779 	    hci_dev_test_flag(hdev, HCI_CONFIG))
780 		memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
781 
782 	return rp->status;
783 }
784 
hci_cc_read_auth_payload_timeout(struct hci_dev * hdev,void * data,struct sk_buff * skb)785 static u8 hci_cc_read_auth_payload_timeout(struct hci_dev *hdev, void *data,
786 					   struct sk_buff *skb)
787 {
788 	struct hci_rp_read_auth_payload_to *rp = data;
789 	struct hci_conn *conn;
790 
791 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
792 
793 	if (rp->status)
794 		return rp->status;
795 
796 	hci_dev_lock(hdev);
797 
798 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
799 	if (conn)
800 		conn->auth_payload_timeout = __le16_to_cpu(rp->timeout);
801 
802 	hci_dev_unlock(hdev);
803 
804 	return rp->status;
805 }
806 
hci_cc_write_auth_payload_timeout(struct hci_dev * hdev,void * data,struct sk_buff * skb)807 static u8 hci_cc_write_auth_payload_timeout(struct hci_dev *hdev, void *data,
808 					    struct sk_buff *skb)
809 {
810 	struct hci_rp_write_auth_payload_to *rp = data;
811 	struct hci_conn *conn;
812 	void *sent;
813 
814 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
815 
816 	sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_PAYLOAD_TO);
817 	if (!sent)
818 		return rp->status;
819 
820 	hci_dev_lock(hdev);
821 
822 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
823 	if (!conn) {
824 		rp->status = 0xff;
825 		goto unlock;
826 	}
827 
828 	if (!rp->status)
829 		conn->auth_payload_timeout = get_unaligned_le16(sent + 2);
830 
831 unlock:
832 	hci_dev_unlock(hdev);
833 
834 	return rp->status;
835 }
836 
hci_cc_read_local_features(struct hci_dev * hdev,void * data,struct sk_buff * skb)837 static u8 hci_cc_read_local_features(struct hci_dev *hdev, void *data,
838 				     struct sk_buff *skb)
839 {
840 	struct hci_rp_read_local_features *rp = data;
841 
842 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
843 
844 	if (rp->status)
845 		return rp->status;
846 
847 	memcpy(hdev->features, rp->features, 8);
848 
849 	/* Adjust default settings according to features
850 	 * supported by device. */
851 
852 	if (hdev->features[0][0] & LMP_3SLOT)
853 		hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
854 
855 	if (hdev->features[0][0] & LMP_5SLOT)
856 		hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
857 
858 	if (hdev->features[0][1] & LMP_HV2) {
859 		hdev->pkt_type  |= (HCI_HV2);
860 		hdev->esco_type |= (ESCO_HV2);
861 	}
862 
863 	if (hdev->features[0][1] & LMP_HV3) {
864 		hdev->pkt_type  |= (HCI_HV3);
865 		hdev->esco_type |= (ESCO_HV3);
866 	}
867 
868 	if (lmp_esco_capable(hdev))
869 		hdev->esco_type |= (ESCO_EV3);
870 
871 	if (hdev->features[0][4] & LMP_EV4)
872 		hdev->esco_type |= (ESCO_EV4);
873 
874 	if (hdev->features[0][4] & LMP_EV5)
875 		hdev->esco_type |= (ESCO_EV5);
876 
877 	if (hdev->features[0][5] & LMP_EDR_ESCO_2M)
878 		hdev->esco_type |= (ESCO_2EV3);
879 
880 	if (hdev->features[0][5] & LMP_EDR_ESCO_3M)
881 		hdev->esco_type |= (ESCO_3EV3);
882 
883 	if (hdev->features[0][5] & LMP_EDR_3S_ESCO)
884 		hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
885 
886 	return rp->status;
887 }
888 
hci_cc_read_local_ext_features(struct hci_dev * hdev,void * data,struct sk_buff * skb)889 static u8 hci_cc_read_local_ext_features(struct hci_dev *hdev, void *data,
890 					 struct sk_buff *skb)
891 {
892 	struct hci_rp_read_local_ext_features *rp = data;
893 
894 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
895 
896 	if (rp->status)
897 		return rp->status;
898 
899 	if (hdev->max_page < rp->max_page) {
900 		if (test_bit(HCI_QUIRK_BROKEN_LOCAL_EXT_FEATURES_PAGE_2,
901 			     &hdev->quirks))
902 			bt_dev_warn(hdev, "broken local ext features page 2");
903 		else
904 			hdev->max_page = rp->max_page;
905 	}
906 
907 	if (rp->page < HCI_MAX_PAGES)
908 		memcpy(hdev->features[rp->page], rp->features, 8);
909 
910 	return rp->status;
911 }
912 
hci_cc_read_buffer_size(struct hci_dev * hdev,void * data,struct sk_buff * skb)913 static u8 hci_cc_read_buffer_size(struct hci_dev *hdev, void *data,
914 				  struct sk_buff *skb)
915 {
916 	struct hci_rp_read_buffer_size *rp = data;
917 
918 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
919 
920 	if (rp->status)
921 		return rp->status;
922 
923 	hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
924 	hdev->sco_mtu  = rp->sco_mtu;
925 	hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
926 	hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
927 
928 	if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
929 		hdev->sco_mtu  = 64;
930 		hdev->sco_pkts = 8;
931 	}
932 
933 	hdev->acl_cnt = hdev->acl_pkts;
934 	hdev->sco_cnt = hdev->sco_pkts;
935 
936 	BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
937 	       hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
938 
939 	if (!hdev->acl_mtu || !hdev->acl_pkts)
940 		return HCI_ERROR_INVALID_PARAMETERS;
941 
942 	return rp->status;
943 }
944 
hci_cc_read_bd_addr(struct hci_dev * hdev,void * data,struct sk_buff * skb)945 static u8 hci_cc_read_bd_addr(struct hci_dev *hdev, void *data,
946 			      struct sk_buff *skb)
947 {
948 	struct hci_rp_read_bd_addr *rp = data;
949 
950 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
951 
952 	if (rp->status)
953 		return rp->status;
954 
955 	if (test_bit(HCI_INIT, &hdev->flags))
956 		bacpy(&hdev->bdaddr, &rp->bdaddr);
957 
958 	if (hci_dev_test_flag(hdev, HCI_SETUP))
959 		bacpy(&hdev->setup_addr, &rp->bdaddr);
960 
961 	return rp->status;
962 }
963 
hci_cc_read_local_pairing_opts(struct hci_dev * hdev,void * data,struct sk_buff * skb)964 static u8 hci_cc_read_local_pairing_opts(struct hci_dev *hdev, void *data,
965 					 struct sk_buff *skb)
966 {
967 	struct hci_rp_read_local_pairing_opts *rp = data;
968 
969 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
970 
971 	if (rp->status)
972 		return rp->status;
973 
974 	if (hci_dev_test_flag(hdev, HCI_SETUP) ||
975 	    hci_dev_test_flag(hdev, HCI_CONFIG)) {
976 		hdev->pairing_opts = rp->pairing_opts;
977 		hdev->max_enc_key_size = rp->max_key_size;
978 	}
979 
980 	return rp->status;
981 }
982 
hci_cc_read_page_scan_activity(struct hci_dev * hdev,void * data,struct sk_buff * skb)983 static u8 hci_cc_read_page_scan_activity(struct hci_dev *hdev, void *data,
984 					 struct sk_buff *skb)
985 {
986 	struct hci_rp_read_page_scan_activity *rp = data;
987 
988 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
989 
990 	if (rp->status)
991 		return rp->status;
992 
993 	if (test_bit(HCI_INIT, &hdev->flags)) {
994 		hdev->page_scan_interval = __le16_to_cpu(rp->interval);
995 		hdev->page_scan_window = __le16_to_cpu(rp->window);
996 	}
997 
998 	return rp->status;
999 }
1000 
hci_cc_write_page_scan_activity(struct hci_dev * hdev,void * data,struct sk_buff * skb)1001 static u8 hci_cc_write_page_scan_activity(struct hci_dev *hdev, void *data,
1002 					  struct sk_buff *skb)
1003 {
1004 	struct hci_ev_status *rp = data;
1005 	struct hci_cp_write_page_scan_activity *sent;
1006 
1007 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1008 
1009 	if (rp->status)
1010 		return rp->status;
1011 
1012 	sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY);
1013 	if (!sent)
1014 		return rp->status;
1015 
1016 	hdev->page_scan_interval = __le16_to_cpu(sent->interval);
1017 	hdev->page_scan_window = __le16_to_cpu(sent->window);
1018 
1019 	return rp->status;
1020 }
1021 
hci_cc_read_page_scan_type(struct hci_dev * hdev,void * data,struct sk_buff * skb)1022 static u8 hci_cc_read_page_scan_type(struct hci_dev *hdev, void *data,
1023 				     struct sk_buff *skb)
1024 {
1025 	struct hci_rp_read_page_scan_type *rp = data;
1026 
1027 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1028 
1029 	if (rp->status)
1030 		return rp->status;
1031 
1032 	if (test_bit(HCI_INIT, &hdev->flags))
1033 		hdev->page_scan_type = rp->type;
1034 
1035 	return rp->status;
1036 }
1037 
hci_cc_write_page_scan_type(struct hci_dev * hdev,void * data,struct sk_buff * skb)1038 static u8 hci_cc_write_page_scan_type(struct hci_dev *hdev, void *data,
1039 				      struct sk_buff *skb)
1040 {
1041 	struct hci_ev_status *rp = data;
1042 	u8 *type;
1043 
1044 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1045 
1046 	if (rp->status)
1047 		return rp->status;
1048 
1049 	type = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE);
1050 	if (type)
1051 		hdev->page_scan_type = *type;
1052 
1053 	return rp->status;
1054 }
1055 
hci_cc_read_clock(struct hci_dev * hdev,void * data,struct sk_buff * skb)1056 static u8 hci_cc_read_clock(struct hci_dev *hdev, void *data,
1057 			    struct sk_buff *skb)
1058 {
1059 	struct hci_rp_read_clock *rp = data;
1060 	struct hci_cp_read_clock *cp;
1061 	struct hci_conn *conn;
1062 
1063 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1064 
1065 	if (rp->status)
1066 		return rp->status;
1067 
1068 	hci_dev_lock(hdev);
1069 
1070 	cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
1071 	if (!cp)
1072 		goto unlock;
1073 
1074 	if (cp->which == 0x00) {
1075 		hdev->clock = le32_to_cpu(rp->clock);
1076 		goto unlock;
1077 	}
1078 
1079 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1080 	if (conn) {
1081 		conn->clock = le32_to_cpu(rp->clock);
1082 		conn->clock_accuracy = le16_to_cpu(rp->accuracy);
1083 	}
1084 
1085 unlock:
1086 	hci_dev_unlock(hdev);
1087 	return rp->status;
1088 }
1089 
hci_cc_read_inq_rsp_tx_power(struct hci_dev * hdev,void * data,struct sk_buff * skb)1090 static u8 hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev, void *data,
1091 				       struct sk_buff *skb)
1092 {
1093 	struct hci_rp_read_inq_rsp_tx_power *rp = data;
1094 
1095 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1096 
1097 	if (rp->status)
1098 		return rp->status;
1099 
1100 	hdev->inq_tx_power = rp->tx_power;
1101 
1102 	return rp->status;
1103 }
1104 
hci_cc_read_def_err_data_reporting(struct hci_dev * hdev,void * data,struct sk_buff * skb)1105 static u8 hci_cc_read_def_err_data_reporting(struct hci_dev *hdev, void *data,
1106 					     struct sk_buff *skb)
1107 {
1108 	struct hci_rp_read_def_err_data_reporting *rp = data;
1109 
1110 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1111 
1112 	if (rp->status)
1113 		return rp->status;
1114 
1115 	hdev->err_data_reporting = rp->err_data_reporting;
1116 
1117 	return rp->status;
1118 }
1119 
hci_cc_write_def_err_data_reporting(struct hci_dev * hdev,void * data,struct sk_buff * skb)1120 static u8 hci_cc_write_def_err_data_reporting(struct hci_dev *hdev, void *data,
1121 					      struct sk_buff *skb)
1122 {
1123 	struct hci_ev_status *rp = data;
1124 	struct hci_cp_write_def_err_data_reporting *cp;
1125 
1126 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1127 
1128 	if (rp->status)
1129 		return rp->status;
1130 
1131 	cp = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_ERR_DATA_REPORTING);
1132 	if (!cp)
1133 		return rp->status;
1134 
1135 	hdev->err_data_reporting = cp->err_data_reporting;
1136 
1137 	return rp->status;
1138 }
1139 
hci_cc_pin_code_reply(struct hci_dev * hdev,void * data,struct sk_buff * skb)1140 static u8 hci_cc_pin_code_reply(struct hci_dev *hdev, void *data,
1141 				struct sk_buff *skb)
1142 {
1143 	struct hci_rp_pin_code_reply *rp = data;
1144 	struct hci_cp_pin_code_reply *cp;
1145 	struct hci_conn *conn;
1146 
1147 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1148 
1149 	hci_dev_lock(hdev);
1150 
1151 	if (hci_dev_test_flag(hdev, HCI_MGMT))
1152 		mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
1153 
1154 	if (rp->status)
1155 		goto unlock;
1156 
1157 	cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
1158 	if (!cp)
1159 		goto unlock;
1160 
1161 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1162 	if (conn)
1163 		conn->pin_length = cp->pin_len;
1164 
1165 unlock:
1166 	hci_dev_unlock(hdev);
1167 	return rp->status;
1168 }
1169 
hci_cc_pin_code_neg_reply(struct hci_dev * hdev,void * data,struct sk_buff * skb)1170 static u8 hci_cc_pin_code_neg_reply(struct hci_dev *hdev, void *data,
1171 				    struct sk_buff *skb)
1172 {
1173 	struct hci_rp_pin_code_neg_reply *rp = data;
1174 
1175 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1176 
1177 	hci_dev_lock(hdev);
1178 
1179 	if (hci_dev_test_flag(hdev, HCI_MGMT))
1180 		mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
1181 						 rp->status);
1182 
1183 	hci_dev_unlock(hdev);
1184 
1185 	return rp->status;
1186 }
1187 
hci_cc_le_read_buffer_size(struct hci_dev * hdev,void * data,struct sk_buff * skb)1188 static u8 hci_cc_le_read_buffer_size(struct hci_dev *hdev, void *data,
1189 				     struct sk_buff *skb)
1190 {
1191 	struct hci_rp_le_read_buffer_size *rp = data;
1192 
1193 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1194 
1195 	if (rp->status)
1196 		return rp->status;
1197 
1198 	hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
1199 	hdev->le_pkts = rp->le_max_pkt;
1200 
1201 	hdev->le_cnt = hdev->le_pkts;
1202 
1203 	BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
1204 
1205 	if (hdev->le_mtu && hdev->le_mtu < HCI_MIN_LE_MTU)
1206 		return HCI_ERROR_INVALID_PARAMETERS;
1207 
1208 	return rp->status;
1209 }
1210 
hci_cc_le_read_local_features(struct hci_dev * hdev,void * data,struct sk_buff * skb)1211 static u8 hci_cc_le_read_local_features(struct hci_dev *hdev, void *data,
1212 					struct sk_buff *skb)
1213 {
1214 	struct hci_rp_le_read_local_features *rp = data;
1215 
1216 	BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1217 
1218 	if (rp->status)
1219 		return rp->status;
1220 
1221 	memcpy(hdev->le_features, rp->features, 8);
1222 
1223 	return rp->status;
1224 }
1225 
hci_cc_le_read_adv_tx_power(struct hci_dev * hdev,void * data,struct sk_buff * skb)1226 static u8 hci_cc_le_read_adv_tx_power(struct hci_dev *hdev, void *data,
1227 				      struct sk_buff *skb)
1228 {
1229 	struct hci_rp_le_read_adv_tx_power *rp = data;
1230 
1231 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1232 
1233 	if (rp->status)
1234 		return rp->status;
1235 
1236 	hdev->adv_tx_power = rp->tx_power;
1237 
1238 	return rp->status;
1239 }
1240 
hci_cc_user_confirm_reply(struct hci_dev * hdev,void * data,struct sk_buff * skb)1241 static u8 hci_cc_user_confirm_reply(struct hci_dev *hdev, void *data,
1242 				    struct sk_buff *skb)
1243 {
1244 	struct hci_rp_user_confirm_reply *rp = data;
1245 
1246 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1247 
1248 	hci_dev_lock(hdev);
1249 
1250 	if (hci_dev_test_flag(hdev, HCI_MGMT))
1251 		mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,
1252 						 rp->status);
1253 
1254 	hci_dev_unlock(hdev);
1255 
1256 	return rp->status;
1257 }
1258 
hci_cc_user_confirm_neg_reply(struct hci_dev * hdev,void * data,struct sk_buff * skb)1259 static u8 hci_cc_user_confirm_neg_reply(struct hci_dev *hdev, void *data,
1260 					struct sk_buff *skb)
1261 {
1262 	struct hci_rp_user_confirm_reply *rp = data;
1263 
1264 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1265 
1266 	hci_dev_lock(hdev);
1267 
1268 	if (hci_dev_test_flag(hdev, HCI_MGMT))
1269 		mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
1270 						     ACL_LINK, 0, rp->status);
1271 
1272 	hci_dev_unlock(hdev);
1273 
1274 	return rp->status;
1275 }
1276 
hci_cc_user_passkey_reply(struct hci_dev * hdev,void * data,struct sk_buff * skb)1277 static u8 hci_cc_user_passkey_reply(struct hci_dev *hdev, void *data,
1278 				    struct sk_buff *skb)
1279 {
1280 	struct hci_rp_user_confirm_reply *rp = data;
1281 
1282 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1283 
1284 	hci_dev_lock(hdev);
1285 
1286 	if (hci_dev_test_flag(hdev, HCI_MGMT))
1287 		mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
1288 						 0, rp->status);
1289 
1290 	hci_dev_unlock(hdev);
1291 
1292 	return rp->status;
1293 }
1294 
hci_cc_user_passkey_neg_reply(struct hci_dev * hdev,void * data,struct sk_buff * skb)1295 static u8 hci_cc_user_passkey_neg_reply(struct hci_dev *hdev, void *data,
1296 					struct sk_buff *skb)
1297 {
1298 	struct hci_rp_user_confirm_reply *rp = data;
1299 
1300 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1301 
1302 	hci_dev_lock(hdev);
1303 
1304 	if (hci_dev_test_flag(hdev, HCI_MGMT))
1305 		mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
1306 						     ACL_LINK, 0, rp->status);
1307 
1308 	hci_dev_unlock(hdev);
1309 
1310 	return rp->status;
1311 }
1312 
hci_cc_read_local_oob_data(struct hci_dev * hdev,void * data,struct sk_buff * skb)1313 static u8 hci_cc_read_local_oob_data(struct hci_dev *hdev, void *data,
1314 				     struct sk_buff *skb)
1315 {
1316 	struct hci_rp_read_local_oob_data *rp = data;
1317 
1318 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1319 
1320 	return rp->status;
1321 }
1322 
hci_cc_read_local_oob_ext_data(struct hci_dev * hdev,void * data,struct sk_buff * skb)1323 static u8 hci_cc_read_local_oob_ext_data(struct hci_dev *hdev, void *data,
1324 					 struct sk_buff *skb)
1325 {
1326 	struct hci_rp_read_local_oob_ext_data *rp = data;
1327 
1328 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1329 
1330 	return rp->status;
1331 }
1332 
hci_cc_le_set_random_addr(struct hci_dev * hdev,void * data,struct sk_buff * skb)1333 static u8 hci_cc_le_set_random_addr(struct hci_dev *hdev, void *data,
1334 				    struct sk_buff *skb)
1335 {
1336 	struct hci_ev_status *rp = data;
1337 	bdaddr_t *sent;
1338 
1339 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1340 
1341 	if (rp->status)
1342 		return rp->status;
1343 
1344 	sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_RANDOM_ADDR);
1345 	if (!sent)
1346 		return rp->status;
1347 
1348 	hci_dev_lock(hdev);
1349 
1350 	bacpy(&hdev->random_addr, sent);
1351 
1352 	if (!bacmp(&hdev->rpa, sent)) {
1353 		hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
1354 		queue_delayed_work(hdev->workqueue, &hdev->rpa_expired,
1355 				   secs_to_jiffies(hdev->rpa_timeout));
1356 	}
1357 
1358 	hci_dev_unlock(hdev);
1359 
1360 	return rp->status;
1361 }
1362 
hci_cc_le_set_default_phy(struct hci_dev * hdev,void * data,struct sk_buff * skb)1363 static u8 hci_cc_le_set_default_phy(struct hci_dev *hdev, void *data,
1364 				    struct sk_buff *skb)
1365 {
1366 	struct hci_ev_status *rp = data;
1367 	struct hci_cp_le_set_default_phy *cp;
1368 
1369 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1370 
1371 	if (rp->status)
1372 		return rp->status;
1373 
1374 	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_DEFAULT_PHY);
1375 	if (!cp)
1376 		return rp->status;
1377 
1378 	hci_dev_lock(hdev);
1379 
1380 	hdev->le_tx_def_phys = cp->tx_phys;
1381 	hdev->le_rx_def_phys = cp->rx_phys;
1382 
1383 	hci_dev_unlock(hdev);
1384 
1385 	return rp->status;
1386 }
1387 
hci_cc_le_set_adv_set_random_addr(struct hci_dev * hdev,void * data,struct sk_buff * skb)1388 static u8 hci_cc_le_set_adv_set_random_addr(struct hci_dev *hdev, void *data,
1389 					    struct sk_buff *skb)
1390 {
1391 	struct hci_ev_status *rp = data;
1392 	struct hci_cp_le_set_adv_set_rand_addr *cp;
1393 	struct adv_info *adv;
1394 
1395 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1396 
1397 	if (rp->status)
1398 		return rp->status;
1399 
1400 	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_SET_RAND_ADDR);
1401 	/* Update only in case the adv instance since handle 0x00 shall be using
1402 	 * HCI_OP_LE_SET_RANDOM_ADDR since that allows both extended and
1403 	 * non-extended adverting.
1404 	 */
1405 	if (!cp || !cp->handle)
1406 		return rp->status;
1407 
1408 	hci_dev_lock(hdev);
1409 
1410 	adv = hci_find_adv_instance(hdev, cp->handle);
1411 	if (adv) {
1412 		bacpy(&adv->random_addr, &cp->bdaddr);
1413 		if (!bacmp(&hdev->rpa, &cp->bdaddr)) {
1414 			adv->rpa_expired = false;
1415 			queue_delayed_work(hdev->workqueue,
1416 					   &adv->rpa_expired_cb,
1417 					   secs_to_jiffies(hdev->rpa_timeout));
1418 		}
1419 	}
1420 
1421 	hci_dev_unlock(hdev);
1422 
1423 	return rp->status;
1424 }
1425 
hci_cc_le_remove_adv_set(struct hci_dev * hdev,void * data,struct sk_buff * skb)1426 static u8 hci_cc_le_remove_adv_set(struct hci_dev *hdev, void *data,
1427 				   struct sk_buff *skb)
1428 {
1429 	struct hci_ev_status *rp = data;
1430 	u8 *instance;
1431 	int err;
1432 
1433 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1434 
1435 	if (rp->status)
1436 		return rp->status;
1437 
1438 	instance = hci_sent_cmd_data(hdev, HCI_OP_LE_REMOVE_ADV_SET);
1439 	if (!instance)
1440 		return rp->status;
1441 
1442 	hci_dev_lock(hdev);
1443 
1444 	err = hci_remove_adv_instance(hdev, *instance);
1445 	if (!err)
1446 		mgmt_advertising_removed(hci_skb_sk(hdev->sent_cmd), hdev,
1447 					 *instance);
1448 
1449 	hci_dev_unlock(hdev);
1450 
1451 	return rp->status;
1452 }
1453 
hci_cc_le_clear_adv_sets(struct hci_dev * hdev,void * data,struct sk_buff * skb)1454 static u8 hci_cc_le_clear_adv_sets(struct hci_dev *hdev, void *data,
1455 				   struct sk_buff *skb)
1456 {
1457 	struct hci_ev_status *rp = data;
1458 	struct adv_info *adv, *n;
1459 	int err;
1460 
1461 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1462 
1463 	if (rp->status)
1464 		return rp->status;
1465 
1466 	if (!hci_sent_cmd_data(hdev, HCI_OP_LE_CLEAR_ADV_SETS))
1467 		return rp->status;
1468 
1469 	hci_dev_lock(hdev);
1470 
1471 	list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) {
1472 		u8 instance = adv->instance;
1473 
1474 		err = hci_remove_adv_instance(hdev, instance);
1475 		if (!err)
1476 			mgmt_advertising_removed(hci_skb_sk(hdev->sent_cmd),
1477 						 hdev, instance);
1478 	}
1479 
1480 	hci_dev_unlock(hdev);
1481 
1482 	return rp->status;
1483 }
1484 
hci_cc_le_read_transmit_power(struct hci_dev * hdev,void * data,struct sk_buff * skb)1485 static u8 hci_cc_le_read_transmit_power(struct hci_dev *hdev, void *data,
1486 					struct sk_buff *skb)
1487 {
1488 	struct hci_rp_le_read_transmit_power *rp = data;
1489 
1490 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1491 
1492 	if (rp->status)
1493 		return rp->status;
1494 
1495 	hdev->min_le_tx_power = rp->min_le_tx_power;
1496 	hdev->max_le_tx_power = rp->max_le_tx_power;
1497 
1498 	return rp->status;
1499 }
1500 
hci_cc_le_set_privacy_mode(struct hci_dev * hdev,void * data,struct sk_buff * skb)1501 static u8 hci_cc_le_set_privacy_mode(struct hci_dev *hdev, void *data,
1502 				     struct sk_buff *skb)
1503 {
1504 	struct hci_ev_status *rp = data;
1505 	struct hci_cp_le_set_privacy_mode *cp;
1506 	struct hci_conn_params *params;
1507 
1508 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1509 
1510 	if (rp->status)
1511 		return rp->status;
1512 
1513 	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_PRIVACY_MODE);
1514 	if (!cp)
1515 		return rp->status;
1516 
1517 	hci_dev_lock(hdev);
1518 
1519 	params = hci_conn_params_lookup(hdev, &cp->bdaddr, cp->bdaddr_type);
1520 	if (params)
1521 		WRITE_ONCE(params->privacy_mode, cp->mode);
1522 
1523 	hci_dev_unlock(hdev);
1524 
1525 	return rp->status;
1526 }
1527 
hci_cc_le_set_adv_enable(struct hci_dev * hdev,void * data,struct sk_buff * skb)1528 static u8 hci_cc_le_set_adv_enable(struct hci_dev *hdev, void *data,
1529 				   struct sk_buff *skb)
1530 {
1531 	struct hci_ev_status *rp = data;
1532 	__u8 *sent;
1533 
1534 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1535 
1536 	if (rp->status)
1537 		return rp->status;
1538 
1539 	sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_ENABLE);
1540 	if (!sent)
1541 		return rp->status;
1542 
1543 	hci_dev_lock(hdev);
1544 
1545 	/* If we're doing connection initiation as peripheral. Set a
1546 	 * timeout in case something goes wrong.
1547 	 */
1548 	if (*sent) {
1549 		struct hci_conn *conn;
1550 
1551 		hci_dev_set_flag(hdev, HCI_LE_ADV);
1552 
1553 		conn = hci_lookup_le_connect(hdev);
1554 		if (conn)
1555 			queue_delayed_work(hdev->workqueue,
1556 					   &conn->le_conn_timeout,
1557 					   conn->conn_timeout);
1558 	} else {
1559 		hci_dev_clear_flag(hdev, HCI_LE_ADV);
1560 	}
1561 
1562 	hci_dev_unlock(hdev);
1563 
1564 	return rp->status;
1565 }
1566 
hci_cc_le_set_ext_adv_enable(struct hci_dev * hdev,void * data,struct sk_buff * skb)1567 static u8 hci_cc_le_set_ext_adv_enable(struct hci_dev *hdev, void *data,
1568 				       struct sk_buff *skb)
1569 {
1570 	struct hci_cp_le_set_ext_adv_enable *cp;
1571 	struct hci_cp_ext_adv_set *set;
1572 	struct adv_info *adv = NULL, *n;
1573 	struct hci_ev_status *rp = data;
1574 
1575 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1576 
1577 	if (rp->status)
1578 		return rp->status;
1579 
1580 	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE);
1581 	if (!cp)
1582 		return rp->status;
1583 
1584 	set = (void *)cp->data;
1585 
1586 	hci_dev_lock(hdev);
1587 
1588 	if (cp->num_of_sets)
1589 		adv = hci_find_adv_instance(hdev, set->handle);
1590 
1591 	if (cp->enable) {
1592 		struct hci_conn *conn;
1593 
1594 		hci_dev_set_flag(hdev, HCI_LE_ADV);
1595 
1596 		if (adv && !adv->periodic)
1597 			adv->enabled = true;
1598 
1599 		conn = hci_lookup_le_connect(hdev);
1600 		if (conn)
1601 			queue_delayed_work(hdev->workqueue,
1602 					   &conn->le_conn_timeout,
1603 					   conn->conn_timeout);
1604 	} else {
1605 		if (cp->num_of_sets) {
1606 			if (adv)
1607 				adv->enabled = false;
1608 
1609 			/* If just one instance was disabled check if there are
1610 			 * any other instance enabled before clearing HCI_LE_ADV
1611 			 */
1612 			list_for_each_entry_safe(adv, n, &hdev->adv_instances,
1613 						 list) {
1614 				if (adv->enabled)
1615 					goto unlock;
1616 			}
1617 		} else {
1618 			/* All instances shall be considered disabled */
1619 			list_for_each_entry_safe(adv, n, &hdev->adv_instances,
1620 						 list)
1621 				adv->enabled = false;
1622 		}
1623 
1624 		hci_dev_clear_flag(hdev, HCI_LE_ADV);
1625 	}
1626 
1627 unlock:
1628 	hci_dev_unlock(hdev);
1629 	return rp->status;
1630 }
1631 
hci_cc_le_set_scan_param(struct hci_dev * hdev,void * data,struct sk_buff * skb)1632 static u8 hci_cc_le_set_scan_param(struct hci_dev *hdev, void *data,
1633 				   struct sk_buff *skb)
1634 {
1635 	struct hci_cp_le_set_scan_param *cp;
1636 	struct hci_ev_status *rp = data;
1637 
1638 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1639 
1640 	if (rp->status)
1641 		return rp->status;
1642 
1643 	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_PARAM);
1644 	if (!cp)
1645 		return rp->status;
1646 
1647 	hci_dev_lock(hdev);
1648 
1649 	hdev->le_scan_type = cp->type;
1650 
1651 	hci_dev_unlock(hdev);
1652 
1653 	return rp->status;
1654 }
1655 
hci_cc_le_set_ext_scan_param(struct hci_dev * hdev,void * data,struct sk_buff * skb)1656 static u8 hci_cc_le_set_ext_scan_param(struct hci_dev *hdev, void *data,
1657 				       struct sk_buff *skb)
1658 {
1659 	struct hci_cp_le_set_ext_scan_params *cp;
1660 	struct hci_ev_status *rp = data;
1661 	struct hci_cp_le_scan_phy_params *phy_param;
1662 
1663 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1664 
1665 	if (rp->status)
1666 		return rp->status;
1667 
1668 	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_SCAN_PARAMS);
1669 	if (!cp)
1670 		return rp->status;
1671 
1672 	phy_param = (void *)cp->data;
1673 
1674 	hci_dev_lock(hdev);
1675 
1676 	hdev->le_scan_type = phy_param->type;
1677 
1678 	hci_dev_unlock(hdev);
1679 
1680 	return rp->status;
1681 }
1682 
has_pending_adv_report(struct hci_dev * hdev)1683 static bool has_pending_adv_report(struct hci_dev *hdev)
1684 {
1685 	struct discovery_state *d = &hdev->discovery;
1686 
1687 	return bacmp(&d->last_adv_addr, BDADDR_ANY);
1688 }
1689 
clear_pending_adv_report(struct hci_dev * hdev)1690 static void clear_pending_adv_report(struct hci_dev *hdev)
1691 {
1692 	struct discovery_state *d = &hdev->discovery;
1693 
1694 	bacpy(&d->last_adv_addr, BDADDR_ANY);
1695 	d->last_adv_data_len = 0;
1696 }
1697 
store_pending_adv_report(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 bdaddr_type,s8 rssi,u32 flags,u8 * data,u8 len)1698 static void store_pending_adv_report(struct hci_dev *hdev, bdaddr_t *bdaddr,
1699 				     u8 bdaddr_type, s8 rssi, u32 flags,
1700 				     u8 *data, u8 len)
1701 {
1702 	struct discovery_state *d = &hdev->discovery;
1703 
1704 	if (len > max_adv_len(hdev))
1705 		return;
1706 
1707 	bacpy(&d->last_adv_addr, bdaddr);
1708 	d->last_adv_addr_type = bdaddr_type;
1709 	d->last_adv_rssi = rssi;
1710 	d->last_adv_flags = flags;
1711 	memcpy(d->last_adv_data, data, len);
1712 	d->last_adv_data_len = len;
1713 }
1714 
le_set_scan_enable_complete(struct hci_dev * hdev,u8 enable)1715 static void le_set_scan_enable_complete(struct hci_dev *hdev, u8 enable)
1716 {
1717 	hci_dev_lock(hdev);
1718 
1719 	switch (enable) {
1720 	case LE_SCAN_ENABLE:
1721 		hci_dev_set_flag(hdev, HCI_LE_SCAN);
1722 		if (hdev->le_scan_type == LE_SCAN_ACTIVE) {
1723 			clear_pending_adv_report(hdev);
1724 			hci_discovery_set_state(hdev, DISCOVERY_FINDING);
1725 		}
1726 		break;
1727 
1728 	case LE_SCAN_DISABLE:
1729 		/* We do this here instead of when setting DISCOVERY_STOPPED
1730 		 * since the latter would potentially require waiting for
1731 		 * inquiry to stop too.
1732 		 */
1733 		if (has_pending_adv_report(hdev)) {
1734 			struct discovery_state *d = &hdev->discovery;
1735 
1736 			mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
1737 					  d->last_adv_addr_type, NULL,
1738 					  d->last_adv_rssi, d->last_adv_flags,
1739 					  d->last_adv_data,
1740 					  d->last_adv_data_len, NULL, 0, 0);
1741 		}
1742 
1743 		/* Cancel this timer so that we don't try to disable scanning
1744 		 * when it's already disabled.
1745 		 */
1746 		cancel_delayed_work(&hdev->le_scan_disable);
1747 
1748 		hci_dev_clear_flag(hdev, HCI_LE_SCAN);
1749 
1750 		/* The HCI_LE_SCAN_INTERRUPTED flag indicates that we
1751 		 * interrupted scanning due to a connect request. Mark
1752 		 * therefore discovery as stopped.
1753 		 */
1754 		if (hci_dev_test_and_clear_flag(hdev, HCI_LE_SCAN_INTERRUPTED))
1755 			hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1756 		else if (!hci_dev_test_flag(hdev, HCI_LE_ADV) &&
1757 			 hdev->discovery.state == DISCOVERY_FINDING)
1758 			queue_work(hdev->workqueue, &hdev->reenable_adv_work);
1759 
1760 		break;
1761 
1762 	default:
1763 		bt_dev_err(hdev, "use of reserved LE_Scan_Enable param %d",
1764 			   enable);
1765 		break;
1766 	}
1767 
1768 	hci_dev_unlock(hdev);
1769 }
1770 
hci_cc_le_set_scan_enable(struct hci_dev * hdev,void * data,struct sk_buff * skb)1771 static u8 hci_cc_le_set_scan_enable(struct hci_dev *hdev, void *data,
1772 				    struct sk_buff *skb)
1773 {
1774 	struct hci_cp_le_set_scan_enable *cp;
1775 	struct hci_ev_status *rp = data;
1776 
1777 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1778 
1779 	if (rp->status)
1780 		return rp->status;
1781 
1782 	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
1783 	if (!cp)
1784 		return rp->status;
1785 
1786 	le_set_scan_enable_complete(hdev, cp->enable);
1787 
1788 	return rp->status;
1789 }
1790 
hci_cc_le_set_ext_scan_enable(struct hci_dev * hdev,void * data,struct sk_buff * skb)1791 static u8 hci_cc_le_set_ext_scan_enable(struct hci_dev *hdev, void *data,
1792 					struct sk_buff *skb)
1793 {
1794 	struct hci_cp_le_set_ext_scan_enable *cp;
1795 	struct hci_ev_status *rp = data;
1796 
1797 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1798 
1799 	if (rp->status)
1800 		return rp->status;
1801 
1802 	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_SCAN_ENABLE);
1803 	if (!cp)
1804 		return rp->status;
1805 
1806 	le_set_scan_enable_complete(hdev, cp->enable);
1807 
1808 	return rp->status;
1809 }
1810 
hci_cc_le_read_num_adv_sets(struct hci_dev * hdev,void * data,struct sk_buff * skb)1811 static u8 hci_cc_le_read_num_adv_sets(struct hci_dev *hdev, void *data,
1812 				      struct sk_buff *skb)
1813 {
1814 	struct hci_rp_le_read_num_supported_adv_sets *rp = data;
1815 
1816 	bt_dev_dbg(hdev, "status 0x%2.2x No of Adv sets %u", rp->status,
1817 		   rp->num_of_sets);
1818 
1819 	if (rp->status)
1820 		return rp->status;
1821 
1822 	hdev->le_num_of_adv_sets = rp->num_of_sets;
1823 
1824 	return rp->status;
1825 }
1826 
hci_cc_le_read_accept_list_size(struct hci_dev * hdev,void * data,struct sk_buff * skb)1827 static u8 hci_cc_le_read_accept_list_size(struct hci_dev *hdev, void *data,
1828 					  struct sk_buff *skb)
1829 {
1830 	struct hci_rp_le_read_accept_list_size *rp = data;
1831 
1832 	bt_dev_dbg(hdev, "status 0x%2.2x size %u", rp->status, rp->size);
1833 
1834 	if (rp->status)
1835 		return rp->status;
1836 
1837 	hdev->le_accept_list_size = rp->size;
1838 
1839 	return rp->status;
1840 }
1841 
hci_cc_le_clear_accept_list(struct hci_dev * hdev,void * data,struct sk_buff * skb)1842 static u8 hci_cc_le_clear_accept_list(struct hci_dev *hdev, void *data,
1843 				      struct sk_buff *skb)
1844 {
1845 	struct hci_ev_status *rp = data;
1846 
1847 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1848 
1849 	if (rp->status)
1850 		return rp->status;
1851 
1852 	hci_dev_lock(hdev);
1853 	hci_bdaddr_list_clear(&hdev->le_accept_list);
1854 	hci_dev_unlock(hdev);
1855 
1856 	return rp->status;
1857 }
1858 
hci_cc_le_add_to_accept_list(struct hci_dev * hdev,void * data,struct sk_buff * skb)1859 static u8 hci_cc_le_add_to_accept_list(struct hci_dev *hdev, void *data,
1860 				       struct sk_buff *skb)
1861 {
1862 	struct hci_cp_le_add_to_accept_list *sent;
1863 	struct hci_ev_status *rp = data;
1864 
1865 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1866 
1867 	if (rp->status)
1868 		return rp->status;
1869 
1870 	sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_ACCEPT_LIST);
1871 	if (!sent)
1872 		return rp->status;
1873 
1874 	hci_dev_lock(hdev);
1875 	hci_bdaddr_list_add(&hdev->le_accept_list, &sent->bdaddr,
1876 			    sent->bdaddr_type);
1877 	hci_dev_unlock(hdev);
1878 
1879 	return rp->status;
1880 }
1881 
hci_cc_le_del_from_accept_list(struct hci_dev * hdev,void * data,struct sk_buff * skb)1882 static u8 hci_cc_le_del_from_accept_list(struct hci_dev *hdev, void *data,
1883 					 struct sk_buff *skb)
1884 {
1885 	struct hci_cp_le_del_from_accept_list *sent;
1886 	struct hci_ev_status *rp = data;
1887 
1888 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1889 
1890 	if (rp->status)
1891 		return rp->status;
1892 
1893 	sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_ACCEPT_LIST);
1894 	if (!sent)
1895 		return rp->status;
1896 
1897 	hci_dev_lock(hdev);
1898 	hci_bdaddr_list_del(&hdev->le_accept_list, &sent->bdaddr,
1899 			    sent->bdaddr_type);
1900 	hci_dev_unlock(hdev);
1901 
1902 	return rp->status;
1903 }
1904 
hci_cc_le_read_supported_states(struct hci_dev * hdev,void * data,struct sk_buff * skb)1905 static u8 hci_cc_le_read_supported_states(struct hci_dev *hdev, void *data,
1906 					  struct sk_buff *skb)
1907 {
1908 	struct hci_rp_le_read_supported_states *rp = data;
1909 
1910 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1911 
1912 	if (rp->status)
1913 		return rp->status;
1914 
1915 	memcpy(hdev->le_states, rp->le_states, 8);
1916 
1917 	return rp->status;
1918 }
1919 
hci_cc_le_read_def_data_len(struct hci_dev * hdev,void * data,struct sk_buff * skb)1920 static u8 hci_cc_le_read_def_data_len(struct hci_dev *hdev, void *data,
1921 				      struct sk_buff *skb)
1922 {
1923 	struct hci_rp_le_read_def_data_len *rp = data;
1924 
1925 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1926 
1927 	if (rp->status)
1928 		return rp->status;
1929 
1930 	hdev->le_def_tx_len = le16_to_cpu(rp->tx_len);
1931 	hdev->le_def_tx_time = le16_to_cpu(rp->tx_time);
1932 
1933 	return rp->status;
1934 }
1935 
hci_cc_le_write_def_data_len(struct hci_dev * hdev,void * data,struct sk_buff * skb)1936 static u8 hci_cc_le_write_def_data_len(struct hci_dev *hdev, void *data,
1937 				       struct sk_buff *skb)
1938 {
1939 	struct hci_cp_le_write_def_data_len *sent;
1940 	struct hci_ev_status *rp = data;
1941 
1942 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1943 
1944 	if (rp->status)
1945 		return rp->status;
1946 
1947 	sent = hci_sent_cmd_data(hdev, HCI_OP_LE_WRITE_DEF_DATA_LEN);
1948 	if (!sent)
1949 		return rp->status;
1950 
1951 	hdev->le_def_tx_len = le16_to_cpu(sent->tx_len);
1952 	hdev->le_def_tx_time = le16_to_cpu(sent->tx_time);
1953 
1954 	return rp->status;
1955 }
1956 
hci_cc_le_add_to_resolv_list(struct hci_dev * hdev,void * data,struct sk_buff * skb)1957 static u8 hci_cc_le_add_to_resolv_list(struct hci_dev *hdev, void *data,
1958 				       struct sk_buff *skb)
1959 {
1960 	struct hci_cp_le_add_to_resolv_list *sent;
1961 	struct hci_ev_status *rp = data;
1962 
1963 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1964 
1965 	if (rp->status)
1966 		return rp->status;
1967 
1968 	sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_RESOLV_LIST);
1969 	if (!sent)
1970 		return rp->status;
1971 
1972 	hci_dev_lock(hdev);
1973 	hci_bdaddr_list_add_with_irk(&hdev->le_resolv_list, &sent->bdaddr,
1974 				sent->bdaddr_type, sent->peer_irk,
1975 				sent->local_irk);
1976 	hci_dev_unlock(hdev);
1977 
1978 	return rp->status;
1979 }
1980 
hci_cc_le_del_from_resolv_list(struct hci_dev * hdev,void * data,struct sk_buff * skb)1981 static u8 hci_cc_le_del_from_resolv_list(struct hci_dev *hdev, void *data,
1982 					 struct sk_buff *skb)
1983 {
1984 	struct hci_cp_le_del_from_resolv_list *sent;
1985 	struct hci_ev_status *rp = data;
1986 
1987 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1988 
1989 	if (rp->status)
1990 		return rp->status;
1991 
1992 	sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_RESOLV_LIST);
1993 	if (!sent)
1994 		return rp->status;
1995 
1996 	hci_dev_lock(hdev);
1997 	hci_bdaddr_list_del_with_irk(&hdev->le_resolv_list, &sent->bdaddr,
1998 			    sent->bdaddr_type);
1999 	hci_dev_unlock(hdev);
2000 
2001 	return rp->status;
2002 }
2003 
hci_cc_le_clear_resolv_list(struct hci_dev * hdev,void * data,struct sk_buff * skb)2004 static u8 hci_cc_le_clear_resolv_list(struct hci_dev *hdev, void *data,
2005 				      struct sk_buff *skb)
2006 {
2007 	struct hci_ev_status *rp = data;
2008 
2009 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2010 
2011 	if (rp->status)
2012 		return rp->status;
2013 
2014 	hci_dev_lock(hdev);
2015 	hci_bdaddr_list_clear(&hdev->le_resolv_list);
2016 	hci_dev_unlock(hdev);
2017 
2018 	return rp->status;
2019 }
2020 
hci_cc_le_read_resolv_list_size(struct hci_dev * hdev,void * data,struct sk_buff * skb)2021 static u8 hci_cc_le_read_resolv_list_size(struct hci_dev *hdev, void *data,
2022 					  struct sk_buff *skb)
2023 {
2024 	struct hci_rp_le_read_resolv_list_size *rp = data;
2025 
2026 	bt_dev_dbg(hdev, "status 0x%2.2x size %u", rp->status, rp->size);
2027 
2028 	if (rp->status)
2029 		return rp->status;
2030 
2031 	hdev->le_resolv_list_size = rp->size;
2032 
2033 	return rp->status;
2034 }
2035 
hci_cc_le_set_addr_resolution_enable(struct hci_dev * hdev,void * data,struct sk_buff * skb)2036 static u8 hci_cc_le_set_addr_resolution_enable(struct hci_dev *hdev, void *data,
2037 					       struct sk_buff *skb)
2038 {
2039 	struct hci_ev_status *rp = data;
2040 	__u8 *sent;
2041 
2042 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2043 
2044 	if (rp->status)
2045 		return rp->status;
2046 
2047 	sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADDR_RESOLV_ENABLE);
2048 	if (!sent)
2049 		return rp->status;
2050 
2051 	hci_dev_lock(hdev);
2052 
2053 	if (*sent)
2054 		hci_dev_set_flag(hdev, HCI_LL_RPA_RESOLUTION);
2055 	else
2056 		hci_dev_clear_flag(hdev, HCI_LL_RPA_RESOLUTION);
2057 
2058 	hci_dev_unlock(hdev);
2059 
2060 	return rp->status;
2061 }
2062 
hci_cc_le_read_max_data_len(struct hci_dev * hdev,void * data,struct sk_buff * skb)2063 static u8 hci_cc_le_read_max_data_len(struct hci_dev *hdev, void *data,
2064 				      struct sk_buff *skb)
2065 {
2066 	struct hci_rp_le_read_max_data_len *rp = data;
2067 
2068 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2069 
2070 	if (rp->status)
2071 		return rp->status;
2072 
2073 	hdev->le_max_tx_len = le16_to_cpu(rp->tx_len);
2074 	hdev->le_max_tx_time = le16_to_cpu(rp->tx_time);
2075 	hdev->le_max_rx_len = le16_to_cpu(rp->rx_len);
2076 	hdev->le_max_rx_time = le16_to_cpu(rp->rx_time);
2077 
2078 	return rp->status;
2079 }
2080 
hci_cc_write_le_host_supported(struct hci_dev * hdev,void * data,struct sk_buff * skb)2081 static u8 hci_cc_write_le_host_supported(struct hci_dev *hdev, void *data,
2082 					 struct sk_buff *skb)
2083 {
2084 	struct hci_cp_write_le_host_supported *sent;
2085 	struct hci_ev_status *rp = data;
2086 
2087 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2088 
2089 	if (rp->status)
2090 		return rp->status;
2091 
2092 	sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
2093 	if (!sent)
2094 		return rp->status;
2095 
2096 	hci_dev_lock(hdev);
2097 
2098 	if (sent->le) {
2099 		hdev->features[1][0] |= LMP_HOST_LE;
2100 		hci_dev_set_flag(hdev, HCI_LE_ENABLED);
2101 	} else {
2102 		hdev->features[1][0] &= ~LMP_HOST_LE;
2103 		hci_dev_clear_flag(hdev, HCI_LE_ENABLED);
2104 		hci_dev_clear_flag(hdev, HCI_ADVERTISING);
2105 	}
2106 
2107 	if (sent->simul)
2108 		hdev->features[1][0] |= LMP_HOST_LE_BREDR;
2109 	else
2110 		hdev->features[1][0] &= ~LMP_HOST_LE_BREDR;
2111 
2112 	hci_dev_unlock(hdev);
2113 
2114 	return rp->status;
2115 }
2116 
hci_cc_set_adv_param(struct hci_dev * hdev,void * data,struct sk_buff * skb)2117 static u8 hci_cc_set_adv_param(struct hci_dev *hdev, void *data,
2118 			       struct sk_buff *skb)
2119 {
2120 	struct hci_cp_le_set_adv_param *cp;
2121 	struct hci_ev_status *rp = data;
2122 
2123 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2124 
2125 	if (rp->status)
2126 		return rp->status;
2127 
2128 	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_PARAM);
2129 	if (!cp)
2130 		return rp->status;
2131 
2132 	hci_dev_lock(hdev);
2133 	hdev->adv_addr_type = cp->own_address_type;
2134 	hci_dev_unlock(hdev);
2135 
2136 	return rp->status;
2137 }
2138 
hci_cc_set_ext_adv_param(struct hci_dev * hdev,void * data,struct sk_buff * skb)2139 static u8 hci_cc_set_ext_adv_param(struct hci_dev *hdev, void *data,
2140 				   struct sk_buff *skb)
2141 {
2142 	struct hci_rp_le_set_ext_adv_params *rp = data;
2143 	struct hci_cp_le_set_ext_adv_params *cp;
2144 	struct adv_info *adv_instance;
2145 
2146 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2147 
2148 	if (rp->status)
2149 		return rp->status;
2150 
2151 	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_PARAMS);
2152 	if (!cp)
2153 		return rp->status;
2154 
2155 	hci_dev_lock(hdev);
2156 	hdev->adv_addr_type = cp->own_addr_type;
2157 	if (!cp->handle) {
2158 		/* Store in hdev for instance 0 */
2159 		hdev->adv_tx_power = rp->tx_power;
2160 	} else {
2161 		adv_instance = hci_find_adv_instance(hdev, cp->handle);
2162 		if (adv_instance)
2163 			adv_instance->tx_power = rp->tx_power;
2164 	}
2165 	/* Update adv data as tx power is known now */
2166 	hci_update_adv_data(hdev, cp->handle);
2167 
2168 	hci_dev_unlock(hdev);
2169 
2170 	return rp->status;
2171 }
2172 
hci_cc_read_rssi(struct hci_dev * hdev,void * data,struct sk_buff * skb)2173 static u8 hci_cc_read_rssi(struct hci_dev *hdev, void *data,
2174 			   struct sk_buff *skb)
2175 {
2176 	struct hci_rp_read_rssi *rp = data;
2177 	struct hci_conn *conn;
2178 
2179 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2180 
2181 	if (rp->status)
2182 		return rp->status;
2183 
2184 	hci_dev_lock(hdev);
2185 
2186 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
2187 	if (conn)
2188 		conn->rssi = rp->rssi;
2189 
2190 	hci_dev_unlock(hdev);
2191 
2192 	return rp->status;
2193 }
2194 
hci_cc_read_tx_power(struct hci_dev * hdev,void * data,struct sk_buff * skb)2195 static u8 hci_cc_read_tx_power(struct hci_dev *hdev, void *data,
2196 			       struct sk_buff *skb)
2197 {
2198 	struct hci_cp_read_tx_power *sent;
2199 	struct hci_rp_read_tx_power *rp = data;
2200 	struct hci_conn *conn;
2201 
2202 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2203 
2204 	if (rp->status)
2205 		return rp->status;
2206 
2207 	sent = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
2208 	if (!sent)
2209 		return rp->status;
2210 
2211 	hci_dev_lock(hdev);
2212 
2213 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
2214 	if (!conn)
2215 		goto unlock;
2216 
2217 	switch (sent->type) {
2218 	case 0x00:
2219 		conn->tx_power = rp->tx_power;
2220 		break;
2221 	case 0x01:
2222 		conn->max_tx_power = rp->tx_power;
2223 		break;
2224 	}
2225 
2226 unlock:
2227 	hci_dev_unlock(hdev);
2228 	return rp->status;
2229 }
2230 
hci_cc_write_ssp_debug_mode(struct hci_dev * hdev,void * data,struct sk_buff * skb)2231 static u8 hci_cc_write_ssp_debug_mode(struct hci_dev *hdev, void *data,
2232 				      struct sk_buff *skb)
2233 {
2234 	struct hci_ev_status *rp = data;
2235 	u8 *mode;
2236 
2237 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2238 
2239 	if (rp->status)
2240 		return rp->status;
2241 
2242 	mode = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE);
2243 	if (mode)
2244 		hdev->ssp_debug_mode = *mode;
2245 
2246 	return rp->status;
2247 }
2248 
hci_cs_inquiry(struct hci_dev * hdev,__u8 status)2249 static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
2250 {
2251 	bt_dev_dbg(hdev, "status 0x%2.2x", status);
2252 
2253 	if (status)
2254 		return;
2255 
2256 	if (hci_sent_cmd_data(hdev, HCI_OP_INQUIRY))
2257 		set_bit(HCI_INQUIRY, &hdev->flags);
2258 }
2259 
hci_cs_create_conn(struct hci_dev * hdev,__u8 status)2260 static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
2261 {
2262 	struct hci_cp_create_conn *cp;
2263 	struct hci_conn *conn;
2264 
2265 	bt_dev_dbg(hdev, "status 0x%2.2x", status);
2266 
2267 	cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
2268 	if (!cp)
2269 		return;
2270 
2271 	hci_dev_lock(hdev);
2272 
2273 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2274 
2275 	bt_dev_dbg(hdev, "bdaddr %pMR hcon %p", &cp->bdaddr, conn);
2276 
2277 	if (status) {
2278 		if (conn && conn->state == BT_CONNECT) {
2279 			conn->state = BT_CLOSED;
2280 			hci_connect_cfm(conn, status);
2281 			hci_conn_del(conn);
2282 		}
2283 	} else {
2284 		if (!conn) {
2285 			conn = hci_conn_add_unset(hdev, ACL_LINK, &cp->bdaddr,
2286 						  HCI_ROLE_MASTER);
2287 			if (IS_ERR(conn))
2288 				bt_dev_err(hdev, "connection err: %ld", PTR_ERR(conn));
2289 		}
2290 	}
2291 
2292 	hci_dev_unlock(hdev);
2293 }
2294 
hci_cs_add_sco(struct hci_dev * hdev,__u8 status)2295 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
2296 {
2297 	struct hci_cp_add_sco *cp;
2298 	struct hci_conn *acl;
2299 	struct hci_link *link;
2300 	__u16 handle;
2301 
2302 	bt_dev_dbg(hdev, "status 0x%2.2x", status);
2303 
2304 	if (!status)
2305 		return;
2306 
2307 	cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
2308 	if (!cp)
2309 		return;
2310 
2311 	handle = __le16_to_cpu(cp->handle);
2312 
2313 	bt_dev_dbg(hdev, "handle 0x%4.4x", handle);
2314 
2315 	hci_dev_lock(hdev);
2316 
2317 	acl = hci_conn_hash_lookup_handle(hdev, handle);
2318 	if (acl) {
2319 		link = list_first_entry_or_null(&acl->link_list,
2320 						struct hci_link, list);
2321 		if (link && link->conn) {
2322 			link->conn->state = BT_CLOSED;
2323 
2324 			hci_connect_cfm(link->conn, status);
2325 			hci_conn_del(link->conn);
2326 		}
2327 	}
2328 
2329 	hci_dev_unlock(hdev);
2330 }
2331 
hci_cs_auth_requested(struct hci_dev * hdev,__u8 status)2332 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
2333 {
2334 	struct hci_cp_auth_requested *cp;
2335 	struct hci_conn *conn;
2336 
2337 	bt_dev_dbg(hdev, "status 0x%2.2x", status);
2338 
2339 	if (!status)
2340 		return;
2341 
2342 	cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
2343 	if (!cp)
2344 		return;
2345 
2346 	hci_dev_lock(hdev);
2347 
2348 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2349 	if (conn) {
2350 		if (conn->state == BT_CONFIG) {
2351 			hci_connect_cfm(conn, status);
2352 			hci_conn_drop(conn);
2353 		}
2354 	}
2355 
2356 	hci_dev_unlock(hdev);
2357 }
2358 
hci_cs_set_conn_encrypt(struct hci_dev * hdev,__u8 status)2359 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
2360 {
2361 	struct hci_cp_set_conn_encrypt *cp;
2362 	struct hci_conn *conn;
2363 
2364 	bt_dev_dbg(hdev, "status 0x%2.2x", status);
2365 
2366 	if (!status)
2367 		return;
2368 
2369 	cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
2370 	if (!cp)
2371 		return;
2372 
2373 	hci_dev_lock(hdev);
2374 
2375 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2376 	if (conn) {
2377 		if (conn->state == BT_CONFIG) {
2378 			hci_connect_cfm(conn, status);
2379 			hci_conn_drop(conn);
2380 		}
2381 	}
2382 
2383 	hci_dev_unlock(hdev);
2384 }
2385 
hci_outgoing_auth_needed(struct hci_dev * hdev,struct hci_conn * conn)2386 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
2387 				    struct hci_conn *conn)
2388 {
2389 	if (conn->state != BT_CONFIG || !conn->out)
2390 		return 0;
2391 
2392 	if (conn->pending_sec_level == BT_SECURITY_SDP)
2393 		return 0;
2394 
2395 	/* Only request authentication for SSP connections or non-SSP
2396 	 * devices with sec_level MEDIUM or HIGH or if MITM protection
2397 	 * is requested.
2398 	 */
2399 	if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
2400 	    conn->pending_sec_level != BT_SECURITY_FIPS &&
2401 	    conn->pending_sec_level != BT_SECURITY_HIGH &&
2402 	    conn->pending_sec_level != BT_SECURITY_MEDIUM)
2403 		return 0;
2404 
2405 	return 1;
2406 }
2407 
hci_resolve_name(struct hci_dev * hdev,struct inquiry_entry * e)2408 static int hci_resolve_name(struct hci_dev *hdev,
2409 				   struct inquiry_entry *e)
2410 {
2411 	struct hci_cp_remote_name_req cp;
2412 
2413 	memset(&cp, 0, sizeof(cp));
2414 
2415 	bacpy(&cp.bdaddr, &e->data.bdaddr);
2416 	cp.pscan_rep_mode = e->data.pscan_rep_mode;
2417 	cp.pscan_mode = e->data.pscan_mode;
2418 	cp.clock_offset = e->data.clock_offset;
2419 
2420 	return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2421 }
2422 
hci_resolve_next_name(struct hci_dev * hdev)2423 static bool hci_resolve_next_name(struct hci_dev *hdev)
2424 {
2425 	struct discovery_state *discov = &hdev->discovery;
2426 	struct inquiry_entry *e;
2427 
2428 	if (list_empty(&discov->resolve))
2429 		return false;
2430 
2431 	/* We should stop if we already spent too much time resolving names. */
2432 	if (time_after(jiffies, discov->name_resolve_timeout)) {
2433 		bt_dev_warn_ratelimited(hdev, "Name resolve takes too long.");
2434 		return false;
2435 	}
2436 
2437 	e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
2438 	if (!e)
2439 		return false;
2440 
2441 	if (hci_resolve_name(hdev, e) == 0) {
2442 		e->name_state = NAME_PENDING;
2443 		return true;
2444 	}
2445 
2446 	return false;
2447 }
2448 
hci_check_pending_name(struct hci_dev * hdev,struct hci_conn * conn,bdaddr_t * bdaddr,u8 * name,u8 name_len)2449 static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
2450 				   bdaddr_t *bdaddr, u8 *name, u8 name_len)
2451 {
2452 	struct discovery_state *discov = &hdev->discovery;
2453 	struct inquiry_entry *e;
2454 
2455 	/* Update the mgmt connected state if necessary. Be careful with
2456 	 * conn objects that exist but are not (yet) connected however.
2457 	 * Only those in BT_CONFIG or BT_CONNECTED states can be
2458 	 * considered connected.
2459 	 */
2460 	if (conn && (conn->state == BT_CONFIG || conn->state == BT_CONNECTED))
2461 		mgmt_device_connected(hdev, conn, name, name_len);
2462 
2463 	if (discov->state == DISCOVERY_STOPPED)
2464 		return;
2465 
2466 	if (discov->state == DISCOVERY_STOPPING)
2467 		goto discov_complete;
2468 
2469 	if (discov->state != DISCOVERY_RESOLVING)
2470 		return;
2471 
2472 	e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
2473 	/* If the device was not found in a list of found devices names of which
2474 	 * are pending. there is no need to continue resolving a next name as it
2475 	 * will be done upon receiving another Remote Name Request Complete
2476 	 * Event */
2477 	if (!e)
2478 		return;
2479 
2480 	list_del(&e->list);
2481 
2482 	e->name_state = name ? NAME_KNOWN : NAME_NOT_KNOWN;
2483 	mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00, e->data.rssi,
2484 			 name, name_len);
2485 
2486 	if (hci_resolve_next_name(hdev))
2487 		return;
2488 
2489 discov_complete:
2490 	hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2491 }
2492 
hci_cs_remote_name_req(struct hci_dev * hdev,__u8 status)2493 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
2494 {
2495 	struct hci_cp_remote_name_req *cp;
2496 	struct hci_conn *conn;
2497 
2498 	bt_dev_dbg(hdev, "status 0x%2.2x", status);
2499 
2500 	/* If successful wait for the name req complete event before
2501 	 * checking for the need to do authentication */
2502 	if (!status)
2503 		return;
2504 
2505 	cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
2506 	if (!cp)
2507 		return;
2508 
2509 	hci_dev_lock(hdev);
2510 
2511 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2512 
2513 	if (hci_dev_test_flag(hdev, HCI_MGMT))
2514 		hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
2515 
2516 	if (!conn)
2517 		goto unlock;
2518 
2519 	if (!hci_outgoing_auth_needed(hdev, conn))
2520 		goto unlock;
2521 
2522 	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
2523 		struct hci_cp_auth_requested auth_cp;
2524 
2525 		set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
2526 
2527 		auth_cp.handle = __cpu_to_le16(conn->handle);
2528 		hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
2529 			     sizeof(auth_cp), &auth_cp);
2530 	}
2531 
2532 unlock:
2533 	hci_dev_unlock(hdev);
2534 }
2535 
hci_cs_read_remote_features(struct hci_dev * hdev,__u8 status)2536 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
2537 {
2538 	struct hci_cp_read_remote_features *cp;
2539 	struct hci_conn *conn;
2540 
2541 	bt_dev_dbg(hdev, "status 0x%2.2x", status);
2542 
2543 	if (!status)
2544 		return;
2545 
2546 	cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
2547 	if (!cp)
2548 		return;
2549 
2550 	hci_dev_lock(hdev);
2551 
2552 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2553 	if (conn) {
2554 		if (conn->state == BT_CONFIG) {
2555 			hci_connect_cfm(conn, status);
2556 			hci_conn_drop(conn);
2557 		}
2558 	}
2559 
2560 	hci_dev_unlock(hdev);
2561 }
2562 
hci_cs_read_remote_ext_features(struct hci_dev * hdev,__u8 status)2563 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
2564 {
2565 	struct hci_cp_read_remote_ext_features *cp;
2566 	struct hci_conn *conn;
2567 
2568 	bt_dev_dbg(hdev, "status 0x%2.2x", status);
2569 
2570 	if (!status)
2571 		return;
2572 
2573 	cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
2574 	if (!cp)
2575 		return;
2576 
2577 	hci_dev_lock(hdev);
2578 
2579 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2580 	if (conn) {
2581 		if (conn->state == BT_CONFIG) {
2582 			hci_connect_cfm(conn, status);
2583 			hci_conn_drop(conn);
2584 		}
2585 	}
2586 
2587 	hci_dev_unlock(hdev);
2588 }
2589 
hci_setup_sync_conn_status(struct hci_dev * hdev,__u16 handle,__u8 status)2590 static void hci_setup_sync_conn_status(struct hci_dev *hdev, __u16 handle,
2591 				       __u8 status)
2592 {
2593 	struct hci_conn *acl;
2594 	struct hci_link *link;
2595 
2596 	bt_dev_dbg(hdev, "handle 0x%4.4x status 0x%2.2x", handle, status);
2597 
2598 	hci_dev_lock(hdev);
2599 
2600 	acl = hci_conn_hash_lookup_handle(hdev, handle);
2601 	if (acl) {
2602 		link = list_first_entry_or_null(&acl->link_list,
2603 						struct hci_link, list);
2604 		if (link && link->conn) {
2605 			link->conn->state = BT_CLOSED;
2606 
2607 			hci_connect_cfm(link->conn, status);
2608 			hci_conn_del(link->conn);
2609 		}
2610 	}
2611 
2612 	hci_dev_unlock(hdev);
2613 }
2614 
hci_cs_setup_sync_conn(struct hci_dev * hdev,__u8 status)2615 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
2616 {
2617 	struct hci_cp_setup_sync_conn *cp;
2618 
2619 	bt_dev_dbg(hdev, "status 0x%2.2x", status);
2620 
2621 	if (!status)
2622 		return;
2623 
2624 	cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
2625 	if (!cp)
2626 		return;
2627 
2628 	hci_setup_sync_conn_status(hdev, __le16_to_cpu(cp->handle), status);
2629 }
2630 
hci_cs_enhanced_setup_sync_conn(struct hci_dev * hdev,__u8 status)2631 static void hci_cs_enhanced_setup_sync_conn(struct hci_dev *hdev, __u8 status)
2632 {
2633 	struct hci_cp_enhanced_setup_sync_conn *cp;
2634 
2635 	bt_dev_dbg(hdev, "status 0x%2.2x", status);
2636 
2637 	if (!status)
2638 		return;
2639 
2640 	cp = hci_sent_cmd_data(hdev, HCI_OP_ENHANCED_SETUP_SYNC_CONN);
2641 	if (!cp)
2642 		return;
2643 
2644 	hci_setup_sync_conn_status(hdev, __le16_to_cpu(cp->handle), status);
2645 }
2646 
hci_cs_sniff_mode(struct hci_dev * hdev,__u8 status)2647 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
2648 {
2649 	struct hci_cp_sniff_mode *cp;
2650 	struct hci_conn *conn;
2651 
2652 	bt_dev_dbg(hdev, "status 0x%2.2x", status);
2653 
2654 	if (!status)
2655 		return;
2656 
2657 	cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
2658 	if (!cp)
2659 		return;
2660 
2661 	hci_dev_lock(hdev);
2662 
2663 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2664 	if (conn) {
2665 		clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
2666 
2667 		if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2668 			hci_sco_setup(conn, status);
2669 	}
2670 
2671 	hci_dev_unlock(hdev);
2672 }
2673 
hci_cs_exit_sniff_mode(struct hci_dev * hdev,__u8 status)2674 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
2675 {
2676 	struct hci_cp_exit_sniff_mode *cp;
2677 	struct hci_conn *conn;
2678 
2679 	bt_dev_dbg(hdev, "status 0x%2.2x", status);
2680 
2681 	if (!status)
2682 		return;
2683 
2684 	cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
2685 	if (!cp)
2686 		return;
2687 
2688 	hci_dev_lock(hdev);
2689 
2690 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2691 	if (conn) {
2692 		clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
2693 
2694 		if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2695 			hci_sco_setup(conn, status);
2696 	}
2697 
2698 	hci_dev_unlock(hdev);
2699 }
2700 
hci_cs_disconnect(struct hci_dev * hdev,u8 status)2701 static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
2702 {
2703 	struct hci_cp_disconnect *cp;
2704 	struct hci_conn_params *params;
2705 	struct hci_conn *conn;
2706 	bool mgmt_conn;
2707 
2708 	bt_dev_dbg(hdev, "status 0x%2.2x", status);
2709 
2710 	/* Wait for HCI_EV_DISCONN_COMPLETE if status 0x00 and not suspended
2711 	 * otherwise cleanup the connection immediately.
2712 	 */
2713 	if (!status && !hdev->suspended)
2714 		return;
2715 
2716 	cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
2717 	if (!cp)
2718 		return;
2719 
2720 	hci_dev_lock(hdev);
2721 
2722 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2723 	if (!conn)
2724 		goto unlock;
2725 
2726 	if (status) {
2727 		mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2728 				       conn->dst_type, status);
2729 
2730 		if (conn->type == LE_LINK && conn->role == HCI_ROLE_SLAVE) {
2731 			hdev->cur_adv_instance = conn->adv_instance;
2732 			hci_enable_advertising(hdev);
2733 		}
2734 
2735 		/* Inform sockets conn is gone before we delete it */
2736 		hci_disconn_cfm(conn, HCI_ERROR_UNSPECIFIED);
2737 
2738 		goto done;
2739 	}
2740 
2741 	mgmt_conn = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags);
2742 
2743 	if (conn->type == ACL_LINK) {
2744 		if (test_and_clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
2745 			hci_remove_link_key(hdev, &conn->dst);
2746 	}
2747 
2748 	params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
2749 	if (params) {
2750 		switch (params->auto_connect) {
2751 		case HCI_AUTO_CONN_LINK_LOSS:
2752 			if (cp->reason != HCI_ERROR_CONNECTION_TIMEOUT)
2753 				break;
2754 			fallthrough;
2755 
2756 		case HCI_AUTO_CONN_DIRECT:
2757 		case HCI_AUTO_CONN_ALWAYS:
2758 			hci_pend_le_list_del_init(params);
2759 			hci_pend_le_list_add(params, &hdev->pend_le_conns);
2760 			break;
2761 
2762 		default:
2763 			break;
2764 		}
2765 	}
2766 
2767 	mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type,
2768 				 cp->reason, mgmt_conn);
2769 
2770 	hci_disconn_cfm(conn, cp->reason);
2771 
2772 done:
2773 	/* If the disconnection failed for any reason, the upper layer
2774 	 * does not retry to disconnect in current implementation.
2775 	 * Hence, we need to do some basic cleanup here and re-enable
2776 	 * advertising if necessary.
2777 	 */
2778 	hci_conn_del(conn);
2779 unlock:
2780 	hci_dev_unlock(hdev);
2781 }
2782 
ev_bdaddr_type(struct hci_dev * hdev,u8 type,bool * resolved)2783 static u8 ev_bdaddr_type(struct hci_dev *hdev, u8 type, bool *resolved)
2784 {
2785 	/* When using controller based address resolution, then the new
2786 	 * address types 0x02 and 0x03 are used. These types need to be
2787 	 * converted back into either public address or random address type
2788 	 */
2789 	switch (type) {
2790 	case ADDR_LE_DEV_PUBLIC_RESOLVED:
2791 		if (resolved)
2792 			*resolved = true;
2793 		return ADDR_LE_DEV_PUBLIC;
2794 	case ADDR_LE_DEV_RANDOM_RESOLVED:
2795 		if (resolved)
2796 			*resolved = true;
2797 		return ADDR_LE_DEV_RANDOM;
2798 	}
2799 
2800 	if (resolved)
2801 		*resolved = false;
2802 	return type;
2803 }
2804 
cs_le_create_conn(struct hci_dev * hdev,bdaddr_t * peer_addr,u8 peer_addr_type,u8 own_address_type,u8 filter_policy)2805 static void cs_le_create_conn(struct hci_dev *hdev, bdaddr_t *peer_addr,
2806 			      u8 peer_addr_type, u8 own_address_type,
2807 			      u8 filter_policy)
2808 {
2809 	struct hci_conn *conn;
2810 
2811 	conn = hci_conn_hash_lookup_le(hdev, peer_addr,
2812 				       peer_addr_type);
2813 	if (!conn)
2814 		return;
2815 
2816 	own_address_type = ev_bdaddr_type(hdev, own_address_type, NULL);
2817 
2818 	/* Store the initiator and responder address information which
2819 	 * is needed for SMP. These values will not change during the
2820 	 * lifetime of the connection.
2821 	 */
2822 	conn->init_addr_type = own_address_type;
2823 	if (own_address_type == ADDR_LE_DEV_RANDOM)
2824 		bacpy(&conn->init_addr, &hdev->random_addr);
2825 	else
2826 		bacpy(&conn->init_addr, &hdev->bdaddr);
2827 
2828 	conn->resp_addr_type = peer_addr_type;
2829 	bacpy(&conn->resp_addr, peer_addr);
2830 }
2831 
hci_cs_le_create_conn(struct hci_dev * hdev,u8 status)2832 static void hci_cs_le_create_conn(struct hci_dev *hdev, u8 status)
2833 {
2834 	struct hci_cp_le_create_conn *cp;
2835 
2836 	bt_dev_dbg(hdev, "status 0x%2.2x", status);
2837 
2838 	/* All connection failure handling is taken care of by the
2839 	 * hci_conn_failed function which is triggered by the HCI
2840 	 * request completion callbacks used for connecting.
2841 	 */
2842 	if (status)
2843 		return;
2844 
2845 	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
2846 	if (!cp)
2847 		return;
2848 
2849 	hci_dev_lock(hdev);
2850 
2851 	cs_le_create_conn(hdev, &cp->peer_addr, cp->peer_addr_type,
2852 			  cp->own_address_type, cp->filter_policy);
2853 
2854 	hci_dev_unlock(hdev);
2855 }
2856 
hci_cs_le_ext_create_conn(struct hci_dev * hdev,u8 status)2857 static void hci_cs_le_ext_create_conn(struct hci_dev *hdev, u8 status)
2858 {
2859 	struct hci_cp_le_ext_create_conn *cp;
2860 
2861 	bt_dev_dbg(hdev, "status 0x%2.2x", status);
2862 
2863 	/* All connection failure handling is taken care of by the
2864 	 * hci_conn_failed function which is triggered by the HCI
2865 	 * request completion callbacks used for connecting.
2866 	 */
2867 	if (status)
2868 		return;
2869 
2870 	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_EXT_CREATE_CONN);
2871 	if (!cp)
2872 		return;
2873 
2874 	hci_dev_lock(hdev);
2875 
2876 	cs_le_create_conn(hdev, &cp->peer_addr, cp->peer_addr_type,
2877 			  cp->own_addr_type, cp->filter_policy);
2878 
2879 	hci_dev_unlock(hdev);
2880 }
2881 
hci_cs_le_read_remote_features(struct hci_dev * hdev,u8 status)2882 static void hci_cs_le_read_remote_features(struct hci_dev *hdev, u8 status)
2883 {
2884 	struct hci_cp_le_read_remote_features *cp;
2885 	struct hci_conn *conn;
2886 
2887 	bt_dev_dbg(hdev, "status 0x%2.2x", status);
2888 
2889 	if (!status)
2890 		return;
2891 
2892 	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_READ_REMOTE_FEATURES);
2893 	if (!cp)
2894 		return;
2895 
2896 	hci_dev_lock(hdev);
2897 
2898 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2899 	if (conn) {
2900 		if (conn->state == BT_CONFIG) {
2901 			hci_connect_cfm(conn, status);
2902 			hci_conn_drop(conn);
2903 		}
2904 	}
2905 
2906 	hci_dev_unlock(hdev);
2907 }
2908 
hci_cs_le_start_enc(struct hci_dev * hdev,u8 status)2909 static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
2910 {
2911 	struct hci_cp_le_start_enc *cp;
2912 	struct hci_conn *conn;
2913 
2914 	bt_dev_dbg(hdev, "status 0x%2.2x", status);
2915 
2916 	if (!status)
2917 		return;
2918 
2919 	hci_dev_lock(hdev);
2920 
2921 	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_START_ENC);
2922 	if (!cp)
2923 		goto unlock;
2924 
2925 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2926 	if (!conn)
2927 		goto unlock;
2928 
2929 	if (conn->state != BT_CONNECTED)
2930 		goto unlock;
2931 
2932 	hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2933 	hci_conn_drop(conn);
2934 
2935 unlock:
2936 	hci_dev_unlock(hdev);
2937 }
2938 
hci_cs_switch_role(struct hci_dev * hdev,u8 status)2939 static void hci_cs_switch_role(struct hci_dev *hdev, u8 status)
2940 {
2941 	struct hci_cp_switch_role *cp;
2942 	struct hci_conn *conn;
2943 
2944 	BT_DBG("%s status 0x%2.2x", hdev->name, status);
2945 
2946 	if (!status)
2947 		return;
2948 
2949 	cp = hci_sent_cmd_data(hdev, HCI_OP_SWITCH_ROLE);
2950 	if (!cp)
2951 		return;
2952 
2953 	hci_dev_lock(hdev);
2954 
2955 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2956 	if (conn)
2957 		clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
2958 
2959 	hci_dev_unlock(hdev);
2960 }
2961 
hci_inquiry_complete_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)2962 static void hci_inquiry_complete_evt(struct hci_dev *hdev, void *data,
2963 				     struct sk_buff *skb)
2964 {
2965 	struct hci_ev_status *ev = data;
2966 	struct discovery_state *discov = &hdev->discovery;
2967 	struct inquiry_entry *e;
2968 
2969 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
2970 
2971 	if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
2972 		return;
2973 
2974 	smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
2975 	wake_up_bit(&hdev->flags, HCI_INQUIRY);
2976 
2977 	if (!hci_dev_test_flag(hdev, HCI_MGMT))
2978 		return;
2979 
2980 	hci_dev_lock(hdev);
2981 
2982 	if (discov->state != DISCOVERY_FINDING)
2983 		goto unlock;
2984 
2985 	if (list_empty(&discov->resolve)) {
2986 		/* When BR/EDR inquiry is active and no LE scanning is in
2987 		 * progress, then change discovery state to indicate completion.
2988 		 *
2989 		 * When running LE scanning and BR/EDR inquiry simultaneously
2990 		 * and the LE scan already finished, then change the discovery
2991 		 * state to indicate completion.
2992 		 */
2993 		if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
2994 		    !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
2995 			hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2996 		goto unlock;
2997 	}
2998 
2999 	e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
3000 	if (e && hci_resolve_name(hdev, e) == 0) {
3001 		e->name_state = NAME_PENDING;
3002 		hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
3003 		discov->name_resolve_timeout = jiffies + NAME_RESOLVE_DURATION;
3004 	} else {
3005 		/* When BR/EDR inquiry is active and no LE scanning is in
3006 		 * progress, then change discovery state to indicate completion.
3007 		 *
3008 		 * When running LE scanning and BR/EDR inquiry simultaneously
3009 		 * and the LE scan already finished, then change the discovery
3010 		 * state to indicate completion.
3011 		 */
3012 		if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
3013 		    !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
3014 			hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3015 	}
3016 
3017 unlock:
3018 	hci_dev_unlock(hdev);
3019 }
3020 
hci_inquiry_result_evt(struct hci_dev * hdev,void * edata,struct sk_buff * skb)3021 static void hci_inquiry_result_evt(struct hci_dev *hdev, void *edata,
3022 				   struct sk_buff *skb)
3023 {
3024 	struct hci_ev_inquiry_result *ev = edata;
3025 	struct inquiry_data data;
3026 	int i;
3027 
3028 	if (!hci_ev_skb_pull(hdev, skb, HCI_EV_INQUIRY_RESULT,
3029 			     flex_array_size(ev, info, ev->num)))
3030 		return;
3031 
3032 	bt_dev_dbg(hdev, "num %d", ev->num);
3033 
3034 	if (!ev->num)
3035 		return;
3036 
3037 	if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
3038 		return;
3039 
3040 	hci_dev_lock(hdev);
3041 
3042 	for (i = 0; i < ev->num; i++) {
3043 		struct inquiry_info *info = &ev->info[i];
3044 		u32 flags;
3045 
3046 		bacpy(&data.bdaddr, &info->bdaddr);
3047 		data.pscan_rep_mode	= info->pscan_rep_mode;
3048 		data.pscan_period_mode	= info->pscan_period_mode;
3049 		data.pscan_mode		= info->pscan_mode;
3050 		memcpy(data.dev_class, info->dev_class, 3);
3051 		data.clock_offset	= info->clock_offset;
3052 		data.rssi		= HCI_RSSI_INVALID;
3053 		data.ssp_mode		= 0x00;
3054 
3055 		flags = hci_inquiry_cache_update(hdev, &data, false);
3056 
3057 		mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
3058 				  info->dev_class, HCI_RSSI_INVALID,
3059 				  flags, NULL, 0, NULL, 0, 0);
3060 	}
3061 
3062 	hci_dev_unlock(hdev);
3063 }
3064 
hci_conn_complete_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)3065 static void hci_conn_complete_evt(struct hci_dev *hdev, void *data,
3066 				  struct sk_buff *skb)
3067 {
3068 	struct hci_ev_conn_complete *ev = data;
3069 	struct hci_conn *conn;
3070 	u8 status = ev->status;
3071 
3072 	bt_dev_dbg(hdev, "status 0x%2.2x", status);
3073 
3074 	hci_dev_lock(hdev);
3075 
3076 	conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
3077 	if (!conn) {
3078 		/* In case of error status and there is no connection pending
3079 		 * just unlock as there is nothing to cleanup.
3080 		 */
3081 		if (ev->status)
3082 			goto unlock;
3083 
3084 		/* Connection may not exist if auto-connected. Check the bredr
3085 		 * allowlist to see if this device is allowed to auto connect.
3086 		 * If link is an ACL type, create a connection class
3087 		 * automatically.
3088 		 *
3089 		 * Auto-connect will only occur if the event filter is
3090 		 * programmed with a given address. Right now, event filter is
3091 		 * only used during suspend.
3092 		 */
3093 		if (ev->link_type == ACL_LINK &&
3094 		    hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
3095 						      &ev->bdaddr,
3096 						      BDADDR_BREDR)) {
3097 			conn = hci_conn_add_unset(hdev, ev->link_type,
3098 						  &ev->bdaddr, HCI_ROLE_SLAVE);
3099 			if (IS_ERR(conn)) {
3100 				bt_dev_err(hdev, "connection err: %ld", PTR_ERR(conn));
3101 				goto unlock;
3102 			}
3103 		} else {
3104 			if (ev->link_type != SCO_LINK)
3105 				goto unlock;
3106 
3107 			conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK,
3108 						       &ev->bdaddr);
3109 			if (!conn)
3110 				goto unlock;
3111 
3112 			conn->type = SCO_LINK;
3113 		}
3114 	}
3115 
3116 	/* The HCI_Connection_Complete event is only sent once per connection.
3117 	 * Processing it more than once per connection can corrupt kernel memory.
3118 	 *
3119 	 * As the connection handle is set here for the first time, it indicates
3120 	 * whether the connection is already set up.
3121 	 */
3122 	if (!HCI_CONN_HANDLE_UNSET(conn->handle)) {
3123 		bt_dev_err(hdev, "Ignoring HCI_Connection_Complete for existing connection");
3124 		goto unlock;
3125 	}
3126 
3127 	if (!status) {
3128 		status = hci_conn_set_handle(conn, __le16_to_cpu(ev->handle));
3129 		if (status)
3130 			goto done;
3131 
3132 		if (conn->type == ACL_LINK) {
3133 			conn->state = BT_CONFIG;
3134 			hci_conn_hold(conn);
3135 
3136 			if (!conn->out && !hci_conn_ssp_enabled(conn) &&
3137 			    !hci_find_link_key(hdev, &ev->bdaddr))
3138 				conn->disc_timeout = HCI_PAIRING_TIMEOUT;
3139 			else
3140 				conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3141 		} else
3142 			conn->state = BT_CONNECTED;
3143 
3144 		hci_debugfs_create_conn(conn);
3145 		hci_conn_add_sysfs(conn);
3146 
3147 		if (test_bit(HCI_AUTH, &hdev->flags))
3148 			set_bit(HCI_CONN_AUTH, &conn->flags);
3149 
3150 		if (test_bit(HCI_ENCRYPT, &hdev->flags))
3151 			set_bit(HCI_CONN_ENCRYPT, &conn->flags);
3152 
3153 		/* "Link key request" completed ahead of "connect request" completes */
3154 		if (ev->encr_mode == 1 && !test_bit(HCI_CONN_ENCRYPT, &conn->flags) &&
3155 		    ev->link_type == ACL_LINK) {
3156 			struct link_key *key;
3157 			struct hci_cp_read_enc_key_size cp;
3158 
3159 			key = hci_find_link_key(hdev, &ev->bdaddr);
3160 			if (key) {
3161 				set_bit(HCI_CONN_ENCRYPT, &conn->flags);
3162 
3163 				if (!read_key_size_capable(hdev)) {
3164 					conn->enc_key_size = HCI_LINK_KEY_SIZE;
3165 				} else {
3166 					cp.handle = cpu_to_le16(conn->handle);
3167 					if (hci_send_cmd(hdev, HCI_OP_READ_ENC_KEY_SIZE,
3168 							 sizeof(cp), &cp)) {
3169 						bt_dev_err(hdev, "sending read key size failed");
3170 						conn->enc_key_size = HCI_LINK_KEY_SIZE;
3171 					}
3172 				}
3173 
3174 				hci_encrypt_cfm(conn, ev->status);
3175 			}
3176 		}
3177 
3178 		/* Get remote features */
3179 		if (conn->type == ACL_LINK) {
3180 			struct hci_cp_read_remote_features cp;
3181 			cp.handle = ev->handle;
3182 			hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
3183 				     sizeof(cp), &cp);
3184 
3185 			hci_update_scan(hdev);
3186 		}
3187 
3188 		/* Set packet type for incoming connection */
3189 		if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
3190 			struct hci_cp_change_conn_ptype cp;
3191 			cp.handle = ev->handle;
3192 			cp.pkt_type = cpu_to_le16(conn->pkt_type);
3193 			hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
3194 				     &cp);
3195 		}
3196 	}
3197 
3198 	if (conn->type == ACL_LINK)
3199 		hci_sco_setup(conn, ev->status);
3200 
3201 done:
3202 	if (status) {
3203 		hci_conn_failed(conn, status);
3204 	} else if (ev->link_type == SCO_LINK) {
3205 		switch (conn->setting & SCO_AIRMODE_MASK) {
3206 		case SCO_AIRMODE_CVSD:
3207 			if (hdev->notify)
3208 				hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_CVSD);
3209 			break;
3210 		}
3211 
3212 		hci_connect_cfm(conn, status);
3213 	}
3214 
3215 unlock:
3216 	hci_dev_unlock(hdev);
3217 }
3218 
hci_reject_conn(struct hci_dev * hdev,bdaddr_t * bdaddr)3219 static void hci_reject_conn(struct hci_dev *hdev, bdaddr_t *bdaddr)
3220 {
3221 	struct hci_cp_reject_conn_req cp;
3222 
3223 	bacpy(&cp.bdaddr, bdaddr);
3224 	cp.reason = HCI_ERROR_REJ_BAD_ADDR;
3225 	hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
3226 }
3227 
hci_conn_request_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)3228 static void hci_conn_request_evt(struct hci_dev *hdev, void *data,
3229 				 struct sk_buff *skb)
3230 {
3231 	struct hci_ev_conn_request *ev = data;
3232 	int mask = hdev->link_mode;
3233 	struct inquiry_entry *ie;
3234 	struct hci_conn *conn;
3235 	__u8 flags = 0;
3236 
3237 	bt_dev_dbg(hdev, "bdaddr %pMR type 0x%x", &ev->bdaddr, ev->link_type);
3238 
3239 	/* Reject incoming connection from device with same BD ADDR against
3240 	 * CVE-2020-26555
3241 	 */
3242 	if (hdev && !bacmp(&hdev->bdaddr, &ev->bdaddr)) {
3243 		bt_dev_dbg(hdev, "Reject connection with same BD_ADDR %pMR\n",
3244 			   &ev->bdaddr);
3245 		hci_reject_conn(hdev, &ev->bdaddr);
3246 		return;
3247 	}
3248 
3249 	mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
3250 				      &flags);
3251 
3252 	if (!(mask & HCI_LM_ACCEPT)) {
3253 		hci_reject_conn(hdev, &ev->bdaddr);
3254 		return;
3255 	}
3256 
3257 	hci_dev_lock(hdev);
3258 
3259 	if (hci_bdaddr_list_lookup(&hdev->reject_list, &ev->bdaddr,
3260 				   BDADDR_BREDR)) {
3261 		hci_reject_conn(hdev, &ev->bdaddr);
3262 		goto unlock;
3263 	}
3264 
3265 	/* Require HCI_CONNECTABLE or an accept list entry to accept the
3266 	 * connection. These features are only touched through mgmt so
3267 	 * only do the checks if HCI_MGMT is set.
3268 	 */
3269 	if (hci_dev_test_flag(hdev, HCI_MGMT) &&
3270 	    !hci_dev_test_flag(hdev, HCI_CONNECTABLE) &&
3271 	    !hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, &ev->bdaddr,
3272 					       BDADDR_BREDR)) {
3273 		hci_reject_conn(hdev, &ev->bdaddr);
3274 		goto unlock;
3275 	}
3276 
3277 	/* Connection accepted */
3278 
3279 	ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
3280 	if (ie)
3281 		memcpy(ie->data.dev_class, ev->dev_class, 3);
3282 
3283 	conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
3284 			&ev->bdaddr);
3285 	if (!conn) {
3286 		conn = hci_conn_add_unset(hdev, ev->link_type, &ev->bdaddr,
3287 					  HCI_ROLE_SLAVE);
3288 		if (IS_ERR(conn)) {
3289 			bt_dev_err(hdev, "connection err: %ld", PTR_ERR(conn));
3290 			goto unlock;
3291 		}
3292 	}
3293 
3294 	memcpy(conn->dev_class, ev->dev_class, 3);
3295 
3296 	hci_dev_unlock(hdev);
3297 
3298 	if (ev->link_type == ACL_LINK ||
3299 	    (!(flags & HCI_PROTO_DEFER) && !lmp_esco_capable(hdev))) {
3300 		struct hci_cp_accept_conn_req cp;
3301 		conn->state = BT_CONNECT;
3302 
3303 		bacpy(&cp.bdaddr, &ev->bdaddr);
3304 
3305 		if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
3306 			cp.role = 0x00; /* Become central */
3307 		else
3308 			cp.role = 0x01; /* Remain peripheral */
3309 
3310 		hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
3311 	} else if (!(flags & HCI_PROTO_DEFER)) {
3312 		struct hci_cp_accept_sync_conn_req cp;
3313 		conn->state = BT_CONNECT;
3314 
3315 		bacpy(&cp.bdaddr, &ev->bdaddr);
3316 		cp.pkt_type = cpu_to_le16(conn->pkt_type);
3317 
3318 		cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
3319 		cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
3320 		cp.max_latency    = cpu_to_le16(0xffff);
3321 		cp.content_format = cpu_to_le16(hdev->voice_setting);
3322 		cp.retrans_effort = 0xff;
3323 
3324 		hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ, sizeof(cp),
3325 			     &cp);
3326 	} else {
3327 		conn->state = BT_CONNECT2;
3328 		hci_connect_cfm(conn, 0);
3329 	}
3330 
3331 	return;
3332 unlock:
3333 	hci_dev_unlock(hdev);
3334 }
3335 
hci_to_mgmt_reason(u8 err)3336 static u8 hci_to_mgmt_reason(u8 err)
3337 {
3338 	switch (err) {
3339 	case HCI_ERROR_CONNECTION_TIMEOUT:
3340 		return MGMT_DEV_DISCONN_TIMEOUT;
3341 	case HCI_ERROR_REMOTE_USER_TERM:
3342 	case HCI_ERROR_REMOTE_LOW_RESOURCES:
3343 	case HCI_ERROR_REMOTE_POWER_OFF:
3344 		return MGMT_DEV_DISCONN_REMOTE;
3345 	case HCI_ERROR_LOCAL_HOST_TERM:
3346 		return MGMT_DEV_DISCONN_LOCAL_HOST;
3347 	default:
3348 		return MGMT_DEV_DISCONN_UNKNOWN;
3349 	}
3350 }
3351 
hci_disconn_complete_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)3352 static void hci_disconn_complete_evt(struct hci_dev *hdev, void *data,
3353 				     struct sk_buff *skb)
3354 {
3355 	struct hci_ev_disconn_complete *ev = data;
3356 	u8 reason;
3357 	struct hci_conn_params *params;
3358 	struct hci_conn *conn;
3359 	bool mgmt_connected;
3360 
3361 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
3362 
3363 	hci_dev_lock(hdev);
3364 
3365 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3366 	if (!conn)
3367 		goto unlock;
3368 
3369 	if (ev->status) {
3370 		mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
3371 				       conn->dst_type, ev->status);
3372 		goto unlock;
3373 	}
3374 
3375 	conn->state = BT_CLOSED;
3376 
3377 	mgmt_connected = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags);
3378 
3379 	if (test_bit(HCI_CONN_AUTH_FAILURE, &conn->flags))
3380 		reason = MGMT_DEV_DISCONN_AUTH_FAILURE;
3381 	else
3382 		reason = hci_to_mgmt_reason(ev->reason);
3383 
3384 	mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type,
3385 				reason, mgmt_connected);
3386 
3387 	if (conn->type == ACL_LINK) {
3388 		if (test_and_clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
3389 			hci_remove_link_key(hdev, &conn->dst);
3390 
3391 		hci_update_scan(hdev);
3392 	}
3393 
3394 	/* Re-enable passive scanning if disconnected device is marked
3395 	 * as auto-connectable.
3396 	 */
3397 	if (conn->type == LE_LINK) {
3398 		params = hci_conn_params_lookup(hdev, &conn->dst,
3399 						conn->dst_type);
3400 		if (params) {
3401 			switch (params->auto_connect) {
3402 			case HCI_AUTO_CONN_LINK_LOSS:
3403 				if (ev->reason != HCI_ERROR_CONNECTION_TIMEOUT)
3404 					break;
3405 				fallthrough;
3406 
3407 			case HCI_AUTO_CONN_DIRECT:
3408 			case HCI_AUTO_CONN_ALWAYS:
3409 				hci_pend_le_list_del_init(params);
3410 				hci_pend_le_list_add(params,
3411 						     &hdev->pend_le_conns);
3412 				hci_update_passive_scan(hdev);
3413 				break;
3414 
3415 			default:
3416 				break;
3417 			}
3418 		}
3419 	}
3420 
3421 	hci_disconn_cfm(conn, ev->reason);
3422 
3423 	/* Re-enable advertising if necessary, since it might
3424 	 * have been disabled by the connection. From the
3425 	 * HCI_LE_Set_Advertise_Enable command description in
3426 	 * the core specification (v4.0):
3427 	 * "The Controller shall continue advertising until the Host
3428 	 * issues an LE_Set_Advertise_Enable command with
3429 	 * Advertising_Enable set to 0x00 (Advertising is disabled)
3430 	 * or until a connection is created or until the Advertising
3431 	 * is timed out due to Directed Advertising."
3432 	 */
3433 	if (conn->type == LE_LINK && conn->role == HCI_ROLE_SLAVE) {
3434 		hdev->cur_adv_instance = conn->adv_instance;
3435 		hci_enable_advertising(hdev);
3436 	}
3437 
3438 	hci_conn_del(conn);
3439 
3440 unlock:
3441 	hci_dev_unlock(hdev);
3442 }
3443 
hci_auth_complete_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)3444 static void hci_auth_complete_evt(struct hci_dev *hdev, void *data,
3445 				  struct sk_buff *skb)
3446 {
3447 	struct hci_ev_auth_complete *ev = data;
3448 	struct hci_conn *conn;
3449 
3450 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
3451 
3452 	hci_dev_lock(hdev);
3453 
3454 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3455 	if (!conn)
3456 		goto unlock;
3457 
3458 	if (!ev->status) {
3459 		clear_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
3460 		set_bit(HCI_CONN_AUTH, &conn->flags);
3461 		conn->sec_level = conn->pending_sec_level;
3462 	} else {
3463 		if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
3464 			set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
3465 
3466 		mgmt_auth_failed(conn, ev->status);
3467 	}
3468 
3469 	clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
3470 
3471 	if (conn->state == BT_CONFIG) {
3472 		if (!ev->status && hci_conn_ssp_enabled(conn)) {
3473 			struct hci_cp_set_conn_encrypt cp;
3474 			cp.handle  = ev->handle;
3475 			cp.encrypt = 0x01;
3476 			hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
3477 				     &cp);
3478 		} else {
3479 			conn->state = BT_CONNECTED;
3480 			hci_connect_cfm(conn, ev->status);
3481 			hci_conn_drop(conn);
3482 		}
3483 	} else {
3484 		hci_auth_cfm(conn, ev->status);
3485 
3486 		hci_conn_hold(conn);
3487 		conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3488 		hci_conn_drop(conn);
3489 	}
3490 
3491 	if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
3492 		if (!ev->status) {
3493 			struct hci_cp_set_conn_encrypt cp;
3494 			cp.handle  = ev->handle;
3495 			cp.encrypt = 0x01;
3496 			hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
3497 				     &cp);
3498 		} else {
3499 			clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3500 			hci_encrypt_cfm(conn, ev->status);
3501 		}
3502 	}
3503 
3504 unlock:
3505 	hci_dev_unlock(hdev);
3506 }
3507 
hci_remote_name_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)3508 static void hci_remote_name_evt(struct hci_dev *hdev, void *data,
3509 				struct sk_buff *skb)
3510 {
3511 	struct hci_ev_remote_name *ev = data;
3512 	struct hci_conn *conn;
3513 
3514 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
3515 
3516 	hci_dev_lock(hdev);
3517 
3518 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3519 
3520 	if (!hci_dev_test_flag(hdev, HCI_MGMT))
3521 		goto check_auth;
3522 
3523 	if (ev->status == 0)
3524 		hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
3525 				       strnlen(ev->name, HCI_MAX_NAME_LENGTH));
3526 	else
3527 		hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
3528 
3529 check_auth:
3530 	if (!conn)
3531 		goto unlock;
3532 
3533 	if (!hci_outgoing_auth_needed(hdev, conn))
3534 		goto unlock;
3535 
3536 	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
3537 		struct hci_cp_auth_requested cp;
3538 
3539 		set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
3540 
3541 		cp.handle = __cpu_to_le16(conn->handle);
3542 		hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
3543 	}
3544 
3545 unlock:
3546 	hci_dev_unlock(hdev);
3547 }
3548 
hci_encrypt_change_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)3549 static void hci_encrypt_change_evt(struct hci_dev *hdev, void *data,
3550 				   struct sk_buff *skb)
3551 {
3552 	struct hci_ev_encrypt_change *ev = data;
3553 	struct hci_conn *conn;
3554 
3555 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
3556 
3557 	hci_dev_lock(hdev);
3558 
3559 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3560 	if (!conn)
3561 		goto unlock;
3562 
3563 	if (!ev->status) {
3564 		if (ev->encrypt) {
3565 			/* Encryption implies authentication */
3566 			set_bit(HCI_CONN_AUTH, &conn->flags);
3567 			set_bit(HCI_CONN_ENCRYPT, &conn->flags);
3568 			conn->sec_level = conn->pending_sec_level;
3569 
3570 			/* P-256 authentication key implies FIPS */
3571 			if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256)
3572 				set_bit(HCI_CONN_FIPS, &conn->flags);
3573 
3574 			if ((conn->type == ACL_LINK && ev->encrypt == 0x02) ||
3575 			    conn->type == LE_LINK)
3576 				set_bit(HCI_CONN_AES_CCM, &conn->flags);
3577 		} else {
3578 			clear_bit(HCI_CONN_ENCRYPT, &conn->flags);
3579 			clear_bit(HCI_CONN_AES_CCM, &conn->flags);
3580 		}
3581 	}
3582 
3583 	/* We should disregard the current RPA and generate a new one
3584 	 * whenever the encryption procedure fails.
3585 	 */
3586 	if (ev->status && conn->type == LE_LINK) {
3587 		hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
3588 		hci_adv_instances_set_rpa_expired(hdev, true);
3589 	}
3590 
3591 	clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3592 
3593 	/* Check link security requirements are met */
3594 	if (!hci_conn_check_link_mode(conn))
3595 		ev->status = HCI_ERROR_AUTH_FAILURE;
3596 
3597 	if (ev->status && conn->state == BT_CONNECTED) {
3598 		if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
3599 			set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
3600 
3601 		/* Notify upper layers so they can cleanup before
3602 		 * disconnecting.
3603 		 */
3604 		hci_encrypt_cfm(conn, ev->status);
3605 		hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
3606 		hci_conn_drop(conn);
3607 		goto unlock;
3608 	}
3609 
3610 	/* Try reading the encryption key size for encrypted ACL links */
3611 	if (!ev->status && ev->encrypt && conn->type == ACL_LINK) {
3612 		struct hci_cp_read_enc_key_size cp;
3613 
3614 		/* Only send HCI_Read_Encryption_Key_Size if the
3615 		 * controller really supports it. If it doesn't, assume
3616 		 * the default size (16).
3617 		 */
3618 		if (!read_key_size_capable(hdev)) {
3619 			conn->enc_key_size = HCI_LINK_KEY_SIZE;
3620 			goto notify;
3621 		}
3622 
3623 		cp.handle = cpu_to_le16(conn->handle);
3624 		if (hci_send_cmd(hdev, HCI_OP_READ_ENC_KEY_SIZE,
3625 				 sizeof(cp), &cp)) {
3626 			bt_dev_err(hdev, "sending read key size failed");
3627 			conn->enc_key_size = HCI_LINK_KEY_SIZE;
3628 			goto notify;
3629 		}
3630 
3631 		goto unlock;
3632 	}
3633 
3634 	/* We skip the WRITE_AUTH_PAYLOAD_TIMEOUT for ATS2851 based controllers
3635 	 * to avoid unexpected SMP command errors when pairing.
3636 	 */
3637 	if (test_bit(HCI_QUIRK_BROKEN_WRITE_AUTH_PAYLOAD_TIMEOUT,
3638 		     &hdev->quirks))
3639 		goto notify;
3640 
3641 	/* Set the default Authenticated Payload Timeout after
3642 	 * an LE Link is established. As per Core Spec v5.0, Vol 2, Part B
3643 	 * Section 3.3, the HCI command WRITE_AUTH_PAYLOAD_TIMEOUT should be
3644 	 * sent when the link is active and Encryption is enabled, the conn
3645 	 * type can be either LE or ACL and controller must support LMP Ping.
3646 	 * Ensure for AES-CCM encryption as well.
3647 	 */
3648 	if (test_bit(HCI_CONN_ENCRYPT, &conn->flags) &&
3649 	    test_bit(HCI_CONN_AES_CCM, &conn->flags) &&
3650 	    ((conn->type == ACL_LINK && lmp_ping_capable(hdev)) ||
3651 	     (conn->type == LE_LINK && (hdev->le_features[0] & HCI_LE_PING)))) {
3652 		struct hci_cp_write_auth_payload_to cp;
3653 
3654 		cp.handle = cpu_to_le16(conn->handle);
3655 		cp.timeout = cpu_to_le16(hdev->auth_payload_timeout);
3656 		if (hci_send_cmd(conn->hdev, HCI_OP_WRITE_AUTH_PAYLOAD_TO,
3657 				 sizeof(cp), &cp))
3658 			bt_dev_err(hdev, "write auth payload timeout failed");
3659 	}
3660 
3661 notify:
3662 	hci_encrypt_cfm(conn, ev->status);
3663 
3664 unlock:
3665 	hci_dev_unlock(hdev);
3666 }
3667 
hci_change_link_key_complete_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)3668 static void hci_change_link_key_complete_evt(struct hci_dev *hdev, void *data,
3669 					     struct sk_buff *skb)
3670 {
3671 	struct hci_ev_change_link_key_complete *ev = data;
3672 	struct hci_conn *conn;
3673 
3674 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
3675 
3676 	hci_dev_lock(hdev);
3677 
3678 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3679 	if (conn) {
3680 		if (!ev->status)
3681 			set_bit(HCI_CONN_SECURE, &conn->flags);
3682 
3683 		clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
3684 
3685 		hci_key_change_cfm(conn, ev->status);
3686 	}
3687 
3688 	hci_dev_unlock(hdev);
3689 }
3690 
hci_remote_features_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)3691 static void hci_remote_features_evt(struct hci_dev *hdev, void *data,
3692 				    struct sk_buff *skb)
3693 {
3694 	struct hci_ev_remote_features *ev = data;
3695 	struct hci_conn *conn;
3696 
3697 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
3698 
3699 	hci_dev_lock(hdev);
3700 
3701 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3702 	if (!conn)
3703 		goto unlock;
3704 
3705 	if (!ev->status)
3706 		memcpy(conn->features[0], ev->features, 8);
3707 
3708 	if (conn->state != BT_CONFIG)
3709 		goto unlock;
3710 
3711 	if (!ev->status && lmp_ext_feat_capable(hdev) &&
3712 	    lmp_ext_feat_capable(conn)) {
3713 		struct hci_cp_read_remote_ext_features cp;
3714 		cp.handle = ev->handle;
3715 		cp.page = 0x01;
3716 		hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
3717 			     sizeof(cp), &cp);
3718 		goto unlock;
3719 	}
3720 
3721 	if (!ev->status) {
3722 		struct hci_cp_remote_name_req cp;
3723 		memset(&cp, 0, sizeof(cp));
3724 		bacpy(&cp.bdaddr, &conn->dst);
3725 		cp.pscan_rep_mode = 0x02;
3726 		hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
3727 	} else {
3728 		mgmt_device_connected(hdev, conn, NULL, 0);
3729 	}
3730 
3731 	if (!hci_outgoing_auth_needed(hdev, conn)) {
3732 		conn->state = BT_CONNECTED;
3733 		hci_connect_cfm(conn, ev->status);
3734 		hci_conn_drop(conn);
3735 	}
3736 
3737 unlock:
3738 	hci_dev_unlock(hdev);
3739 }
3740 
handle_cmd_cnt_and_timer(struct hci_dev * hdev,u8 ncmd)3741 static inline void handle_cmd_cnt_and_timer(struct hci_dev *hdev, u8 ncmd)
3742 {
3743 	cancel_delayed_work(&hdev->cmd_timer);
3744 
3745 	rcu_read_lock();
3746 	if (!test_bit(HCI_RESET, &hdev->flags)) {
3747 		if (ncmd) {
3748 			cancel_delayed_work(&hdev->ncmd_timer);
3749 			atomic_set(&hdev->cmd_cnt, 1);
3750 		} else {
3751 			if (!hci_dev_test_flag(hdev, HCI_CMD_DRAIN_WORKQUEUE))
3752 				queue_delayed_work(hdev->workqueue, &hdev->ncmd_timer,
3753 						   HCI_NCMD_TIMEOUT);
3754 		}
3755 	}
3756 	rcu_read_unlock();
3757 }
3758 
hci_cc_le_read_buffer_size_v2(struct hci_dev * hdev,void * data,struct sk_buff * skb)3759 static u8 hci_cc_le_read_buffer_size_v2(struct hci_dev *hdev, void *data,
3760 					struct sk_buff *skb)
3761 {
3762 	struct hci_rp_le_read_buffer_size_v2 *rp = data;
3763 
3764 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
3765 
3766 	if (rp->status)
3767 		return rp->status;
3768 
3769 	hdev->le_mtu   = __le16_to_cpu(rp->acl_mtu);
3770 	hdev->le_pkts  = rp->acl_max_pkt;
3771 	hdev->iso_mtu  = __le16_to_cpu(rp->iso_mtu);
3772 	hdev->iso_pkts = rp->iso_max_pkt;
3773 
3774 	hdev->le_cnt  = hdev->le_pkts;
3775 	hdev->iso_cnt = hdev->iso_pkts;
3776 
3777 	BT_DBG("%s acl mtu %d:%d iso mtu %d:%d", hdev->name, hdev->acl_mtu,
3778 	       hdev->acl_pkts, hdev->iso_mtu, hdev->iso_pkts);
3779 
3780 	if (hdev->le_mtu && hdev->le_mtu < HCI_MIN_LE_MTU)
3781 		return HCI_ERROR_INVALID_PARAMETERS;
3782 
3783 	return rp->status;
3784 }
3785 
hci_unbound_cis_failed(struct hci_dev * hdev,u8 cig,u8 status)3786 static void hci_unbound_cis_failed(struct hci_dev *hdev, u8 cig, u8 status)
3787 {
3788 	struct hci_conn *conn, *tmp;
3789 
3790 	lockdep_assert_held(&hdev->lock);
3791 
3792 	list_for_each_entry_safe(conn, tmp, &hdev->conn_hash.list, list) {
3793 		if (conn->type != ISO_LINK || !bacmp(&conn->dst, BDADDR_ANY) ||
3794 		    conn->state == BT_OPEN || conn->iso_qos.ucast.cig != cig)
3795 			continue;
3796 
3797 		if (HCI_CONN_HANDLE_UNSET(conn->handle))
3798 			hci_conn_failed(conn, status);
3799 	}
3800 }
3801 
hci_cc_le_set_cig_params(struct hci_dev * hdev,void * data,struct sk_buff * skb)3802 static u8 hci_cc_le_set_cig_params(struct hci_dev *hdev, void *data,
3803 				   struct sk_buff *skb)
3804 {
3805 	struct hci_rp_le_set_cig_params *rp = data;
3806 	struct hci_cp_le_set_cig_params *cp;
3807 	struct hci_conn *conn;
3808 	u8 status = rp->status;
3809 	bool pending = false;
3810 	int i;
3811 
3812 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
3813 
3814 	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_CIG_PARAMS);
3815 	if (!rp->status && (!cp || rp->num_handles != cp->num_cis ||
3816 			    rp->cig_id != cp->cig_id)) {
3817 		bt_dev_err(hdev, "unexpected Set CIG Parameters response data");
3818 		status = HCI_ERROR_UNSPECIFIED;
3819 	}
3820 
3821 	hci_dev_lock(hdev);
3822 
3823 	/* BLUETOOTH CORE SPECIFICATION Version 5.4 | Vol 4, Part E page 2554
3824 	 *
3825 	 * If the Status return parameter is non-zero, then the state of the CIG
3826 	 * and its CIS configurations shall not be changed by the command. If
3827 	 * the CIG did not already exist, it shall not be created.
3828 	 */
3829 	if (status) {
3830 		/* Keep current configuration, fail only the unbound CIS */
3831 		hci_unbound_cis_failed(hdev, rp->cig_id, status);
3832 		goto unlock;
3833 	}
3834 
3835 	/* BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 4, Part E page 2553
3836 	 *
3837 	 * If the Status return parameter is zero, then the Controller shall
3838 	 * set the Connection_Handle arrayed return parameter to the connection
3839 	 * handle(s) corresponding to the CIS configurations specified in
3840 	 * the CIS_IDs command parameter, in the same order.
3841 	 */
3842 	for (i = 0; i < rp->num_handles; ++i) {
3843 		conn = hci_conn_hash_lookup_cis(hdev, NULL, 0, rp->cig_id,
3844 						cp->cis[i].cis_id);
3845 		if (!conn || !bacmp(&conn->dst, BDADDR_ANY))
3846 			continue;
3847 
3848 		if (conn->state != BT_BOUND && conn->state != BT_CONNECT)
3849 			continue;
3850 
3851 		if (hci_conn_set_handle(conn, __le16_to_cpu(rp->handle[i])))
3852 			continue;
3853 
3854 		if (conn->state == BT_CONNECT)
3855 			pending = true;
3856 	}
3857 
3858 unlock:
3859 	if (pending)
3860 		hci_le_create_cis_pending(hdev);
3861 
3862 	hci_dev_unlock(hdev);
3863 
3864 	return rp->status;
3865 }
3866 
hci_cc_le_setup_iso_path(struct hci_dev * hdev,void * data,struct sk_buff * skb)3867 static u8 hci_cc_le_setup_iso_path(struct hci_dev *hdev, void *data,
3868 				   struct sk_buff *skb)
3869 {
3870 	struct hci_rp_le_setup_iso_path *rp = data;
3871 	struct hci_cp_le_setup_iso_path *cp;
3872 	struct hci_conn *conn;
3873 
3874 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
3875 
3876 	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SETUP_ISO_PATH);
3877 	if (!cp)
3878 		return rp->status;
3879 
3880 	hci_dev_lock(hdev);
3881 
3882 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
3883 	if (!conn)
3884 		goto unlock;
3885 
3886 	if (rp->status) {
3887 		hci_connect_cfm(conn, rp->status);
3888 		hci_conn_del(conn);
3889 		goto unlock;
3890 	}
3891 
3892 	switch (cp->direction) {
3893 	/* Input (Host to Controller) */
3894 	case 0x00:
3895 		/* Only confirm connection if output only */
3896 		if (conn->iso_qos.ucast.out.sdu && !conn->iso_qos.ucast.in.sdu)
3897 			hci_connect_cfm(conn, rp->status);
3898 		break;
3899 	/* Output (Controller to Host) */
3900 	case 0x01:
3901 		/* Confirm connection since conn->iso_qos is always configured
3902 		 * last.
3903 		 */
3904 		hci_connect_cfm(conn, rp->status);
3905 
3906 		/* Notify device connected in case it is a BIG Sync */
3907 		if (!rp->status && test_bit(HCI_CONN_BIG_SYNC, &conn->flags))
3908 			mgmt_device_connected(hdev, conn, NULL, 0);
3909 
3910 		break;
3911 	}
3912 
3913 unlock:
3914 	hci_dev_unlock(hdev);
3915 	return rp->status;
3916 }
3917 
hci_cs_le_create_big(struct hci_dev * hdev,u8 status)3918 static void hci_cs_le_create_big(struct hci_dev *hdev, u8 status)
3919 {
3920 	bt_dev_dbg(hdev, "status 0x%2.2x", status);
3921 }
3922 
hci_cc_set_per_adv_param(struct hci_dev * hdev,void * data,struct sk_buff * skb)3923 static u8 hci_cc_set_per_adv_param(struct hci_dev *hdev, void *data,
3924 				   struct sk_buff *skb)
3925 {
3926 	struct hci_ev_status *rp = data;
3927 	struct hci_cp_le_set_per_adv_params *cp;
3928 
3929 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
3930 
3931 	if (rp->status)
3932 		return rp->status;
3933 
3934 	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_PER_ADV_PARAMS);
3935 	if (!cp)
3936 		return rp->status;
3937 
3938 	/* TODO: set the conn state */
3939 	return rp->status;
3940 }
3941 
hci_cc_le_set_per_adv_enable(struct hci_dev * hdev,void * data,struct sk_buff * skb)3942 static u8 hci_cc_le_set_per_adv_enable(struct hci_dev *hdev, void *data,
3943 				       struct sk_buff *skb)
3944 {
3945 	struct hci_ev_status *rp = data;
3946 	struct hci_cp_le_set_per_adv_enable *cp;
3947 	struct adv_info *adv = NULL, *n;
3948 	u8 per_adv_cnt = 0;
3949 
3950 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
3951 
3952 	if (rp->status)
3953 		return rp->status;
3954 
3955 	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_PER_ADV_ENABLE);
3956 	if (!cp)
3957 		return rp->status;
3958 
3959 	hci_dev_lock(hdev);
3960 
3961 	adv = hci_find_adv_instance(hdev, cp->handle);
3962 
3963 	if (cp->enable) {
3964 		hci_dev_set_flag(hdev, HCI_LE_PER_ADV);
3965 
3966 		if (adv)
3967 			adv->enabled = true;
3968 	} else {
3969 		/* If just one instance was disabled check if there are
3970 		 * any other instance enabled before clearing HCI_LE_PER_ADV.
3971 		 * The current periodic adv instance will be marked as
3972 		 * disabled once extended advertising is also disabled.
3973 		 */
3974 		list_for_each_entry_safe(adv, n, &hdev->adv_instances,
3975 					 list) {
3976 			if (adv->periodic && adv->enabled)
3977 				per_adv_cnt++;
3978 		}
3979 
3980 		if (per_adv_cnt > 1)
3981 			goto unlock;
3982 
3983 		hci_dev_clear_flag(hdev, HCI_LE_PER_ADV);
3984 	}
3985 
3986 unlock:
3987 	hci_dev_unlock(hdev);
3988 
3989 	return rp->status;
3990 }
3991 
3992 #define HCI_CC_VL(_op, _func, _min, _max) \
3993 { \
3994 	.op = _op, \
3995 	.func = _func, \
3996 	.min_len = _min, \
3997 	.max_len = _max, \
3998 }
3999 
4000 #define HCI_CC(_op, _func, _len) \
4001 	HCI_CC_VL(_op, _func, _len, _len)
4002 
4003 #define HCI_CC_STATUS(_op, _func) \
4004 	HCI_CC(_op, _func, sizeof(struct hci_ev_status))
4005 
4006 static const struct hci_cc {
4007 	u16  op;
4008 	u8 (*func)(struct hci_dev *hdev, void *data, struct sk_buff *skb);
4009 	u16  min_len;
4010 	u16  max_len;
4011 } hci_cc_table[] = {
4012 	HCI_CC_STATUS(HCI_OP_INQUIRY_CANCEL, hci_cc_inquiry_cancel),
4013 	HCI_CC_STATUS(HCI_OP_PERIODIC_INQ, hci_cc_periodic_inq),
4014 	HCI_CC_STATUS(HCI_OP_EXIT_PERIODIC_INQ, hci_cc_exit_periodic_inq),
4015 	HCI_CC_STATUS(HCI_OP_REMOTE_NAME_REQ_CANCEL,
4016 		      hci_cc_remote_name_req_cancel),
4017 	HCI_CC(HCI_OP_ROLE_DISCOVERY, hci_cc_role_discovery,
4018 	       sizeof(struct hci_rp_role_discovery)),
4019 	HCI_CC(HCI_OP_READ_LINK_POLICY, hci_cc_read_link_policy,
4020 	       sizeof(struct hci_rp_read_link_policy)),
4021 	HCI_CC(HCI_OP_WRITE_LINK_POLICY, hci_cc_write_link_policy,
4022 	       sizeof(struct hci_rp_write_link_policy)),
4023 	HCI_CC(HCI_OP_READ_DEF_LINK_POLICY, hci_cc_read_def_link_policy,
4024 	       sizeof(struct hci_rp_read_def_link_policy)),
4025 	HCI_CC_STATUS(HCI_OP_WRITE_DEF_LINK_POLICY,
4026 		      hci_cc_write_def_link_policy),
4027 	HCI_CC_STATUS(HCI_OP_RESET, hci_cc_reset),
4028 	HCI_CC(HCI_OP_READ_STORED_LINK_KEY, hci_cc_read_stored_link_key,
4029 	       sizeof(struct hci_rp_read_stored_link_key)),
4030 	HCI_CC(HCI_OP_DELETE_STORED_LINK_KEY, hci_cc_delete_stored_link_key,
4031 	       sizeof(struct hci_rp_delete_stored_link_key)),
4032 	HCI_CC_STATUS(HCI_OP_WRITE_LOCAL_NAME, hci_cc_write_local_name),
4033 	HCI_CC(HCI_OP_READ_LOCAL_NAME, hci_cc_read_local_name,
4034 	       sizeof(struct hci_rp_read_local_name)),
4035 	HCI_CC_STATUS(HCI_OP_WRITE_AUTH_ENABLE, hci_cc_write_auth_enable),
4036 	HCI_CC_STATUS(HCI_OP_WRITE_ENCRYPT_MODE, hci_cc_write_encrypt_mode),
4037 	HCI_CC_STATUS(HCI_OP_WRITE_SCAN_ENABLE, hci_cc_write_scan_enable),
4038 	HCI_CC_STATUS(HCI_OP_SET_EVENT_FLT, hci_cc_set_event_filter),
4039 	HCI_CC(HCI_OP_READ_CLASS_OF_DEV, hci_cc_read_class_of_dev,
4040 	       sizeof(struct hci_rp_read_class_of_dev)),
4041 	HCI_CC_STATUS(HCI_OP_WRITE_CLASS_OF_DEV, hci_cc_write_class_of_dev),
4042 	HCI_CC(HCI_OP_READ_VOICE_SETTING, hci_cc_read_voice_setting,
4043 	       sizeof(struct hci_rp_read_voice_setting)),
4044 	HCI_CC_STATUS(HCI_OP_WRITE_VOICE_SETTING, hci_cc_write_voice_setting),
4045 	HCI_CC(HCI_OP_READ_NUM_SUPPORTED_IAC, hci_cc_read_num_supported_iac,
4046 	       sizeof(struct hci_rp_read_num_supported_iac)),
4047 	HCI_CC_STATUS(HCI_OP_WRITE_SSP_MODE, hci_cc_write_ssp_mode),
4048 	HCI_CC_STATUS(HCI_OP_WRITE_SC_SUPPORT, hci_cc_write_sc_support),
4049 	HCI_CC(HCI_OP_READ_AUTH_PAYLOAD_TO, hci_cc_read_auth_payload_timeout,
4050 	       sizeof(struct hci_rp_read_auth_payload_to)),
4051 	HCI_CC(HCI_OP_WRITE_AUTH_PAYLOAD_TO, hci_cc_write_auth_payload_timeout,
4052 	       sizeof(struct hci_rp_write_auth_payload_to)),
4053 	HCI_CC(HCI_OP_READ_LOCAL_VERSION, hci_cc_read_local_version,
4054 	       sizeof(struct hci_rp_read_local_version)),
4055 	HCI_CC(HCI_OP_READ_LOCAL_COMMANDS, hci_cc_read_local_commands,
4056 	       sizeof(struct hci_rp_read_local_commands)),
4057 	HCI_CC(HCI_OP_READ_LOCAL_FEATURES, hci_cc_read_local_features,
4058 	       sizeof(struct hci_rp_read_local_features)),
4059 	HCI_CC(HCI_OP_READ_LOCAL_EXT_FEATURES, hci_cc_read_local_ext_features,
4060 	       sizeof(struct hci_rp_read_local_ext_features)),
4061 	HCI_CC(HCI_OP_READ_BUFFER_SIZE, hci_cc_read_buffer_size,
4062 	       sizeof(struct hci_rp_read_buffer_size)),
4063 	HCI_CC(HCI_OP_READ_BD_ADDR, hci_cc_read_bd_addr,
4064 	       sizeof(struct hci_rp_read_bd_addr)),
4065 	HCI_CC(HCI_OP_READ_LOCAL_PAIRING_OPTS, hci_cc_read_local_pairing_opts,
4066 	       sizeof(struct hci_rp_read_local_pairing_opts)),
4067 	HCI_CC(HCI_OP_READ_PAGE_SCAN_ACTIVITY, hci_cc_read_page_scan_activity,
4068 	       sizeof(struct hci_rp_read_page_scan_activity)),
4069 	HCI_CC_STATUS(HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
4070 		      hci_cc_write_page_scan_activity),
4071 	HCI_CC(HCI_OP_READ_PAGE_SCAN_TYPE, hci_cc_read_page_scan_type,
4072 	       sizeof(struct hci_rp_read_page_scan_type)),
4073 	HCI_CC_STATUS(HCI_OP_WRITE_PAGE_SCAN_TYPE, hci_cc_write_page_scan_type),
4074 	HCI_CC(HCI_OP_READ_CLOCK, hci_cc_read_clock,
4075 	       sizeof(struct hci_rp_read_clock)),
4076 	HCI_CC(HCI_OP_READ_ENC_KEY_SIZE, hci_cc_read_enc_key_size,
4077 	       sizeof(struct hci_rp_read_enc_key_size)),
4078 	HCI_CC(HCI_OP_READ_INQ_RSP_TX_POWER, hci_cc_read_inq_rsp_tx_power,
4079 	       sizeof(struct hci_rp_read_inq_rsp_tx_power)),
4080 	HCI_CC(HCI_OP_READ_DEF_ERR_DATA_REPORTING,
4081 	       hci_cc_read_def_err_data_reporting,
4082 	       sizeof(struct hci_rp_read_def_err_data_reporting)),
4083 	HCI_CC_STATUS(HCI_OP_WRITE_DEF_ERR_DATA_REPORTING,
4084 		      hci_cc_write_def_err_data_reporting),
4085 	HCI_CC(HCI_OP_PIN_CODE_REPLY, hci_cc_pin_code_reply,
4086 	       sizeof(struct hci_rp_pin_code_reply)),
4087 	HCI_CC(HCI_OP_PIN_CODE_NEG_REPLY, hci_cc_pin_code_neg_reply,
4088 	       sizeof(struct hci_rp_pin_code_neg_reply)),
4089 	HCI_CC(HCI_OP_READ_LOCAL_OOB_DATA, hci_cc_read_local_oob_data,
4090 	       sizeof(struct hci_rp_read_local_oob_data)),
4091 	HCI_CC(HCI_OP_READ_LOCAL_OOB_EXT_DATA, hci_cc_read_local_oob_ext_data,
4092 	       sizeof(struct hci_rp_read_local_oob_ext_data)),
4093 	HCI_CC(HCI_OP_LE_READ_BUFFER_SIZE, hci_cc_le_read_buffer_size,
4094 	       sizeof(struct hci_rp_le_read_buffer_size)),
4095 	HCI_CC(HCI_OP_LE_READ_LOCAL_FEATURES, hci_cc_le_read_local_features,
4096 	       sizeof(struct hci_rp_le_read_local_features)),
4097 	HCI_CC(HCI_OP_LE_READ_ADV_TX_POWER, hci_cc_le_read_adv_tx_power,
4098 	       sizeof(struct hci_rp_le_read_adv_tx_power)),
4099 	HCI_CC(HCI_OP_USER_CONFIRM_REPLY, hci_cc_user_confirm_reply,
4100 	       sizeof(struct hci_rp_user_confirm_reply)),
4101 	HCI_CC(HCI_OP_USER_CONFIRM_NEG_REPLY, hci_cc_user_confirm_neg_reply,
4102 	       sizeof(struct hci_rp_user_confirm_reply)),
4103 	HCI_CC(HCI_OP_USER_PASSKEY_REPLY, hci_cc_user_passkey_reply,
4104 	       sizeof(struct hci_rp_user_confirm_reply)),
4105 	HCI_CC(HCI_OP_USER_PASSKEY_NEG_REPLY, hci_cc_user_passkey_neg_reply,
4106 	       sizeof(struct hci_rp_user_confirm_reply)),
4107 	HCI_CC_STATUS(HCI_OP_LE_SET_RANDOM_ADDR, hci_cc_le_set_random_addr),
4108 	HCI_CC_STATUS(HCI_OP_LE_SET_ADV_ENABLE, hci_cc_le_set_adv_enable),
4109 	HCI_CC_STATUS(HCI_OP_LE_SET_SCAN_PARAM, hci_cc_le_set_scan_param),
4110 	HCI_CC_STATUS(HCI_OP_LE_SET_SCAN_ENABLE, hci_cc_le_set_scan_enable),
4111 	HCI_CC(HCI_OP_LE_READ_ACCEPT_LIST_SIZE,
4112 	       hci_cc_le_read_accept_list_size,
4113 	       sizeof(struct hci_rp_le_read_accept_list_size)),
4114 	HCI_CC_STATUS(HCI_OP_LE_CLEAR_ACCEPT_LIST, hci_cc_le_clear_accept_list),
4115 	HCI_CC_STATUS(HCI_OP_LE_ADD_TO_ACCEPT_LIST,
4116 		      hci_cc_le_add_to_accept_list),
4117 	HCI_CC_STATUS(HCI_OP_LE_DEL_FROM_ACCEPT_LIST,
4118 		      hci_cc_le_del_from_accept_list),
4119 	HCI_CC(HCI_OP_LE_READ_SUPPORTED_STATES, hci_cc_le_read_supported_states,
4120 	       sizeof(struct hci_rp_le_read_supported_states)),
4121 	HCI_CC(HCI_OP_LE_READ_DEF_DATA_LEN, hci_cc_le_read_def_data_len,
4122 	       sizeof(struct hci_rp_le_read_def_data_len)),
4123 	HCI_CC_STATUS(HCI_OP_LE_WRITE_DEF_DATA_LEN,
4124 		      hci_cc_le_write_def_data_len),
4125 	HCI_CC_STATUS(HCI_OP_LE_ADD_TO_RESOLV_LIST,
4126 		      hci_cc_le_add_to_resolv_list),
4127 	HCI_CC_STATUS(HCI_OP_LE_DEL_FROM_RESOLV_LIST,
4128 		      hci_cc_le_del_from_resolv_list),
4129 	HCI_CC_STATUS(HCI_OP_LE_CLEAR_RESOLV_LIST,
4130 		      hci_cc_le_clear_resolv_list),
4131 	HCI_CC(HCI_OP_LE_READ_RESOLV_LIST_SIZE, hci_cc_le_read_resolv_list_size,
4132 	       sizeof(struct hci_rp_le_read_resolv_list_size)),
4133 	HCI_CC_STATUS(HCI_OP_LE_SET_ADDR_RESOLV_ENABLE,
4134 		      hci_cc_le_set_addr_resolution_enable),
4135 	HCI_CC(HCI_OP_LE_READ_MAX_DATA_LEN, hci_cc_le_read_max_data_len,
4136 	       sizeof(struct hci_rp_le_read_max_data_len)),
4137 	HCI_CC_STATUS(HCI_OP_WRITE_LE_HOST_SUPPORTED,
4138 		      hci_cc_write_le_host_supported),
4139 	HCI_CC_STATUS(HCI_OP_LE_SET_ADV_PARAM, hci_cc_set_adv_param),
4140 	HCI_CC(HCI_OP_READ_RSSI, hci_cc_read_rssi,
4141 	       sizeof(struct hci_rp_read_rssi)),
4142 	HCI_CC(HCI_OP_READ_TX_POWER, hci_cc_read_tx_power,
4143 	       sizeof(struct hci_rp_read_tx_power)),
4144 	HCI_CC_STATUS(HCI_OP_WRITE_SSP_DEBUG_MODE, hci_cc_write_ssp_debug_mode),
4145 	HCI_CC_STATUS(HCI_OP_LE_SET_EXT_SCAN_PARAMS,
4146 		      hci_cc_le_set_ext_scan_param),
4147 	HCI_CC_STATUS(HCI_OP_LE_SET_EXT_SCAN_ENABLE,
4148 		      hci_cc_le_set_ext_scan_enable),
4149 	HCI_CC_STATUS(HCI_OP_LE_SET_DEFAULT_PHY, hci_cc_le_set_default_phy),
4150 	HCI_CC(HCI_OP_LE_READ_NUM_SUPPORTED_ADV_SETS,
4151 	       hci_cc_le_read_num_adv_sets,
4152 	       sizeof(struct hci_rp_le_read_num_supported_adv_sets)),
4153 	HCI_CC(HCI_OP_LE_SET_EXT_ADV_PARAMS, hci_cc_set_ext_adv_param,
4154 	       sizeof(struct hci_rp_le_set_ext_adv_params)),
4155 	HCI_CC_STATUS(HCI_OP_LE_SET_EXT_ADV_ENABLE,
4156 		      hci_cc_le_set_ext_adv_enable),
4157 	HCI_CC_STATUS(HCI_OP_LE_SET_ADV_SET_RAND_ADDR,
4158 		      hci_cc_le_set_adv_set_random_addr),
4159 	HCI_CC_STATUS(HCI_OP_LE_REMOVE_ADV_SET, hci_cc_le_remove_adv_set),
4160 	HCI_CC_STATUS(HCI_OP_LE_CLEAR_ADV_SETS, hci_cc_le_clear_adv_sets),
4161 	HCI_CC_STATUS(HCI_OP_LE_SET_PER_ADV_PARAMS, hci_cc_set_per_adv_param),
4162 	HCI_CC_STATUS(HCI_OP_LE_SET_PER_ADV_ENABLE,
4163 		      hci_cc_le_set_per_adv_enable),
4164 	HCI_CC(HCI_OP_LE_READ_TRANSMIT_POWER, hci_cc_le_read_transmit_power,
4165 	       sizeof(struct hci_rp_le_read_transmit_power)),
4166 	HCI_CC_STATUS(HCI_OP_LE_SET_PRIVACY_MODE, hci_cc_le_set_privacy_mode),
4167 	HCI_CC(HCI_OP_LE_READ_BUFFER_SIZE_V2, hci_cc_le_read_buffer_size_v2,
4168 	       sizeof(struct hci_rp_le_read_buffer_size_v2)),
4169 	HCI_CC_VL(HCI_OP_LE_SET_CIG_PARAMS, hci_cc_le_set_cig_params,
4170 		  sizeof(struct hci_rp_le_set_cig_params), HCI_MAX_EVENT_SIZE),
4171 	HCI_CC(HCI_OP_LE_SETUP_ISO_PATH, hci_cc_le_setup_iso_path,
4172 	       sizeof(struct hci_rp_le_setup_iso_path)),
4173 };
4174 
hci_cc_func(struct hci_dev * hdev,const struct hci_cc * cc,struct sk_buff * skb)4175 static u8 hci_cc_func(struct hci_dev *hdev, const struct hci_cc *cc,
4176 		      struct sk_buff *skb)
4177 {
4178 	void *data;
4179 
4180 	if (skb->len < cc->min_len) {
4181 		bt_dev_err(hdev, "unexpected cc 0x%4.4x length: %u < %u",
4182 			   cc->op, skb->len, cc->min_len);
4183 		return HCI_ERROR_UNSPECIFIED;
4184 	}
4185 
4186 	/* Just warn if the length is over max_len size it still be possible to
4187 	 * partially parse the cc so leave to callback to decide if that is
4188 	 * acceptable.
4189 	 */
4190 	if (skb->len > cc->max_len)
4191 		bt_dev_warn(hdev, "unexpected cc 0x%4.4x length: %u > %u",
4192 			    cc->op, skb->len, cc->max_len);
4193 
4194 	data = hci_cc_skb_pull(hdev, skb, cc->op, cc->min_len);
4195 	if (!data)
4196 		return HCI_ERROR_UNSPECIFIED;
4197 
4198 	return cc->func(hdev, data, skb);
4199 }
4200 
hci_cmd_complete_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb,u16 * opcode,u8 * status,hci_req_complete_t * req_complete,hci_req_complete_skb_t * req_complete_skb)4201 static void hci_cmd_complete_evt(struct hci_dev *hdev, void *data,
4202 				 struct sk_buff *skb, u16 *opcode, u8 *status,
4203 				 hci_req_complete_t *req_complete,
4204 				 hci_req_complete_skb_t *req_complete_skb)
4205 {
4206 	struct hci_ev_cmd_complete *ev = data;
4207 	int i;
4208 
4209 	*opcode = __le16_to_cpu(ev->opcode);
4210 
4211 	bt_dev_dbg(hdev, "opcode 0x%4.4x", *opcode);
4212 
4213 	for (i = 0; i < ARRAY_SIZE(hci_cc_table); i++) {
4214 		if (hci_cc_table[i].op == *opcode) {
4215 			*status = hci_cc_func(hdev, &hci_cc_table[i], skb);
4216 			break;
4217 		}
4218 	}
4219 
4220 	if (i == ARRAY_SIZE(hci_cc_table)) {
4221 		/* Unknown opcode, assume byte 0 contains the status, so
4222 		 * that e.g. __hci_cmd_sync() properly returns errors
4223 		 * for vendor specific commands send by HCI drivers.
4224 		 * If a vendor doesn't actually follow this convention we may
4225 		 * need to introduce a vendor CC table in order to properly set
4226 		 * the status.
4227 		 */
4228 		*status = skb->data[0];
4229 	}
4230 
4231 	handle_cmd_cnt_and_timer(hdev, ev->ncmd);
4232 
4233 	hci_req_cmd_complete(hdev, *opcode, *status, req_complete,
4234 			     req_complete_skb);
4235 
4236 	if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
4237 		bt_dev_err(hdev,
4238 			   "unexpected event for opcode 0x%4.4x", *opcode);
4239 		return;
4240 	}
4241 
4242 	if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
4243 		queue_work(hdev->workqueue, &hdev->cmd_work);
4244 }
4245 
hci_cs_le_create_cis(struct hci_dev * hdev,u8 status)4246 static void hci_cs_le_create_cis(struct hci_dev *hdev, u8 status)
4247 {
4248 	struct hci_cp_le_create_cis *cp;
4249 	bool pending = false;
4250 	int i;
4251 
4252 	bt_dev_dbg(hdev, "status 0x%2.2x", status);
4253 
4254 	if (!status)
4255 		return;
4256 
4257 	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CIS);
4258 	if (!cp)
4259 		return;
4260 
4261 	hci_dev_lock(hdev);
4262 
4263 	/* Remove connection if command failed */
4264 	for (i = 0; i < cp->num_cis; i++) {
4265 		struct hci_conn *conn;
4266 		u16 handle;
4267 
4268 		handle = __le16_to_cpu(cp->cis[i].cis_handle);
4269 
4270 		conn = hci_conn_hash_lookup_handle(hdev, handle);
4271 		if (conn) {
4272 			if (test_and_clear_bit(HCI_CONN_CREATE_CIS,
4273 					       &conn->flags))
4274 				pending = true;
4275 			conn->state = BT_CLOSED;
4276 			hci_connect_cfm(conn, status);
4277 			hci_conn_del(conn);
4278 		}
4279 	}
4280 	cp->num_cis = 0;
4281 
4282 	if (pending)
4283 		hci_le_create_cis_pending(hdev);
4284 
4285 	hci_dev_unlock(hdev);
4286 }
4287 
4288 #define HCI_CS(_op, _func) \
4289 { \
4290 	.op = _op, \
4291 	.func = _func, \
4292 }
4293 
4294 static const struct hci_cs {
4295 	u16  op;
4296 	void (*func)(struct hci_dev *hdev, __u8 status);
4297 } hci_cs_table[] = {
4298 	HCI_CS(HCI_OP_INQUIRY, hci_cs_inquiry),
4299 	HCI_CS(HCI_OP_CREATE_CONN, hci_cs_create_conn),
4300 	HCI_CS(HCI_OP_DISCONNECT, hci_cs_disconnect),
4301 	HCI_CS(HCI_OP_ADD_SCO, hci_cs_add_sco),
4302 	HCI_CS(HCI_OP_AUTH_REQUESTED, hci_cs_auth_requested),
4303 	HCI_CS(HCI_OP_SET_CONN_ENCRYPT, hci_cs_set_conn_encrypt),
4304 	HCI_CS(HCI_OP_REMOTE_NAME_REQ, hci_cs_remote_name_req),
4305 	HCI_CS(HCI_OP_READ_REMOTE_FEATURES, hci_cs_read_remote_features),
4306 	HCI_CS(HCI_OP_READ_REMOTE_EXT_FEATURES,
4307 	       hci_cs_read_remote_ext_features),
4308 	HCI_CS(HCI_OP_SETUP_SYNC_CONN, hci_cs_setup_sync_conn),
4309 	HCI_CS(HCI_OP_ENHANCED_SETUP_SYNC_CONN,
4310 	       hci_cs_enhanced_setup_sync_conn),
4311 	HCI_CS(HCI_OP_SNIFF_MODE, hci_cs_sniff_mode),
4312 	HCI_CS(HCI_OP_EXIT_SNIFF_MODE, hci_cs_exit_sniff_mode),
4313 	HCI_CS(HCI_OP_SWITCH_ROLE, hci_cs_switch_role),
4314 	HCI_CS(HCI_OP_LE_CREATE_CONN, hci_cs_le_create_conn),
4315 	HCI_CS(HCI_OP_LE_READ_REMOTE_FEATURES, hci_cs_le_read_remote_features),
4316 	HCI_CS(HCI_OP_LE_START_ENC, hci_cs_le_start_enc),
4317 	HCI_CS(HCI_OP_LE_EXT_CREATE_CONN, hci_cs_le_ext_create_conn),
4318 	HCI_CS(HCI_OP_LE_CREATE_CIS, hci_cs_le_create_cis),
4319 	HCI_CS(HCI_OP_LE_CREATE_BIG, hci_cs_le_create_big),
4320 };
4321 
hci_cmd_status_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb,u16 * opcode,u8 * status,hci_req_complete_t * req_complete,hci_req_complete_skb_t * req_complete_skb)4322 static void hci_cmd_status_evt(struct hci_dev *hdev, void *data,
4323 			       struct sk_buff *skb, u16 *opcode, u8 *status,
4324 			       hci_req_complete_t *req_complete,
4325 			       hci_req_complete_skb_t *req_complete_skb)
4326 {
4327 	struct hci_ev_cmd_status *ev = data;
4328 	int i;
4329 
4330 	*opcode = __le16_to_cpu(ev->opcode);
4331 	*status = ev->status;
4332 
4333 	bt_dev_dbg(hdev, "opcode 0x%4.4x", *opcode);
4334 
4335 	for (i = 0; i < ARRAY_SIZE(hci_cs_table); i++) {
4336 		if (hci_cs_table[i].op == *opcode) {
4337 			hci_cs_table[i].func(hdev, ev->status);
4338 			break;
4339 		}
4340 	}
4341 
4342 	handle_cmd_cnt_and_timer(hdev, ev->ncmd);
4343 
4344 	/* Indicate request completion if the command failed. Also, if
4345 	 * we're not waiting for a special event and we get a success
4346 	 * command status we should try to flag the request as completed
4347 	 * (since for this kind of commands there will not be a command
4348 	 * complete event).
4349 	 */
4350 	if (ev->status || (hdev->req_skb && !hci_skb_event(hdev->req_skb))) {
4351 		hci_req_cmd_complete(hdev, *opcode, ev->status, req_complete,
4352 				     req_complete_skb);
4353 		if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
4354 			bt_dev_err(hdev, "unexpected event for opcode 0x%4.4x",
4355 				   *opcode);
4356 			return;
4357 		}
4358 	}
4359 
4360 	if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
4361 		queue_work(hdev->workqueue, &hdev->cmd_work);
4362 }
4363 
hci_hardware_error_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)4364 static void hci_hardware_error_evt(struct hci_dev *hdev, void *data,
4365 				   struct sk_buff *skb)
4366 {
4367 	struct hci_ev_hardware_error *ev = data;
4368 
4369 	bt_dev_dbg(hdev, "code 0x%2.2x", ev->code);
4370 
4371 	hdev->hw_error_code = ev->code;
4372 
4373 	queue_work(hdev->req_workqueue, &hdev->error_reset);
4374 }
4375 
hci_role_change_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)4376 static void hci_role_change_evt(struct hci_dev *hdev, void *data,
4377 				struct sk_buff *skb)
4378 {
4379 	struct hci_ev_role_change *ev = data;
4380 	struct hci_conn *conn;
4381 
4382 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
4383 
4384 	hci_dev_lock(hdev);
4385 
4386 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4387 	if (conn) {
4388 		if (!ev->status)
4389 			conn->role = ev->role;
4390 
4391 		clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
4392 
4393 		hci_role_switch_cfm(conn, ev->status, ev->role);
4394 	}
4395 
4396 	hci_dev_unlock(hdev);
4397 }
4398 
hci_num_comp_pkts_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)4399 static void hci_num_comp_pkts_evt(struct hci_dev *hdev, void *data,
4400 				  struct sk_buff *skb)
4401 {
4402 	struct hci_ev_num_comp_pkts *ev = data;
4403 	int i;
4404 
4405 	if (!hci_ev_skb_pull(hdev, skb, HCI_EV_NUM_COMP_PKTS,
4406 			     flex_array_size(ev, handles, ev->num)))
4407 		return;
4408 
4409 	bt_dev_dbg(hdev, "num %d", ev->num);
4410 
4411 	for (i = 0; i < ev->num; i++) {
4412 		struct hci_comp_pkts_info *info = &ev->handles[i];
4413 		struct hci_conn *conn;
4414 		__u16  handle, count;
4415 
4416 		handle = __le16_to_cpu(info->handle);
4417 		count  = __le16_to_cpu(info->count);
4418 
4419 		conn = hci_conn_hash_lookup_handle(hdev, handle);
4420 		if (!conn)
4421 			continue;
4422 
4423 		conn->sent -= count;
4424 
4425 		switch (conn->type) {
4426 		case ACL_LINK:
4427 			hdev->acl_cnt += count;
4428 			if (hdev->acl_cnt > hdev->acl_pkts)
4429 				hdev->acl_cnt = hdev->acl_pkts;
4430 			break;
4431 
4432 		case LE_LINK:
4433 			if (hdev->le_pkts) {
4434 				hdev->le_cnt += count;
4435 				if (hdev->le_cnt > hdev->le_pkts)
4436 					hdev->le_cnt = hdev->le_pkts;
4437 			} else {
4438 				hdev->acl_cnt += count;
4439 				if (hdev->acl_cnt > hdev->acl_pkts)
4440 					hdev->acl_cnt = hdev->acl_pkts;
4441 			}
4442 			break;
4443 
4444 		case SCO_LINK:
4445 			hdev->sco_cnt += count;
4446 			if (hdev->sco_cnt > hdev->sco_pkts)
4447 				hdev->sco_cnt = hdev->sco_pkts;
4448 			break;
4449 
4450 		case ISO_LINK:
4451 			if (hdev->iso_pkts) {
4452 				hdev->iso_cnt += count;
4453 				if (hdev->iso_cnt > hdev->iso_pkts)
4454 					hdev->iso_cnt = hdev->iso_pkts;
4455 			} else if (hdev->le_pkts) {
4456 				hdev->le_cnt += count;
4457 				if (hdev->le_cnt > hdev->le_pkts)
4458 					hdev->le_cnt = hdev->le_pkts;
4459 			} else {
4460 				hdev->acl_cnt += count;
4461 				if (hdev->acl_cnt > hdev->acl_pkts)
4462 					hdev->acl_cnt = hdev->acl_pkts;
4463 			}
4464 			break;
4465 
4466 		default:
4467 			bt_dev_err(hdev, "unknown type %d conn %p",
4468 				   conn->type, conn);
4469 			break;
4470 		}
4471 	}
4472 
4473 	queue_work(hdev->workqueue, &hdev->tx_work);
4474 }
4475 
hci_mode_change_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)4476 static void hci_mode_change_evt(struct hci_dev *hdev, void *data,
4477 				struct sk_buff *skb)
4478 {
4479 	struct hci_ev_mode_change *ev = data;
4480 	struct hci_conn *conn;
4481 
4482 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
4483 
4484 	hci_dev_lock(hdev);
4485 
4486 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4487 	if (conn) {
4488 		conn->mode = ev->mode;
4489 
4490 		if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND,
4491 					&conn->flags)) {
4492 			if (conn->mode == HCI_CM_ACTIVE)
4493 				set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
4494 			else
4495 				clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
4496 		}
4497 
4498 		if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
4499 			hci_sco_setup(conn, ev->status);
4500 	}
4501 
4502 	hci_dev_unlock(hdev);
4503 }
4504 
hci_pin_code_request_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)4505 static void hci_pin_code_request_evt(struct hci_dev *hdev, void *data,
4506 				     struct sk_buff *skb)
4507 {
4508 	struct hci_ev_pin_code_req *ev = data;
4509 	struct hci_conn *conn;
4510 
4511 	bt_dev_dbg(hdev, "");
4512 
4513 	hci_dev_lock(hdev);
4514 
4515 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4516 	if (!conn)
4517 		goto unlock;
4518 
4519 	if (conn->state == BT_CONNECTED) {
4520 		hci_conn_hold(conn);
4521 		conn->disc_timeout = HCI_PAIRING_TIMEOUT;
4522 		hci_conn_drop(conn);
4523 	}
4524 
4525 	if (!hci_dev_test_flag(hdev, HCI_BONDABLE) &&
4526 	    !test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags)) {
4527 		hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
4528 			     sizeof(ev->bdaddr), &ev->bdaddr);
4529 	} else if (hci_dev_test_flag(hdev, HCI_MGMT)) {
4530 		u8 secure;
4531 
4532 		if (conn->pending_sec_level == BT_SECURITY_HIGH)
4533 			secure = 1;
4534 		else
4535 			secure = 0;
4536 
4537 		mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
4538 	}
4539 
4540 unlock:
4541 	hci_dev_unlock(hdev);
4542 }
4543 
conn_set_key(struct hci_conn * conn,u8 key_type,u8 pin_len)4544 static void conn_set_key(struct hci_conn *conn, u8 key_type, u8 pin_len)
4545 {
4546 	if (key_type == HCI_LK_CHANGED_COMBINATION)
4547 		return;
4548 
4549 	conn->pin_length = pin_len;
4550 	conn->key_type = key_type;
4551 
4552 	switch (key_type) {
4553 	case HCI_LK_LOCAL_UNIT:
4554 	case HCI_LK_REMOTE_UNIT:
4555 	case HCI_LK_DEBUG_COMBINATION:
4556 		return;
4557 	case HCI_LK_COMBINATION:
4558 		if (pin_len == 16)
4559 			conn->pending_sec_level = BT_SECURITY_HIGH;
4560 		else
4561 			conn->pending_sec_level = BT_SECURITY_MEDIUM;
4562 		break;
4563 	case HCI_LK_UNAUTH_COMBINATION_P192:
4564 	case HCI_LK_UNAUTH_COMBINATION_P256:
4565 		conn->pending_sec_level = BT_SECURITY_MEDIUM;
4566 		break;
4567 	case HCI_LK_AUTH_COMBINATION_P192:
4568 		conn->pending_sec_level = BT_SECURITY_HIGH;
4569 		break;
4570 	case HCI_LK_AUTH_COMBINATION_P256:
4571 		conn->pending_sec_level = BT_SECURITY_FIPS;
4572 		break;
4573 	}
4574 }
4575 
hci_link_key_request_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)4576 static void hci_link_key_request_evt(struct hci_dev *hdev, void *data,
4577 				     struct sk_buff *skb)
4578 {
4579 	struct hci_ev_link_key_req *ev = data;
4580 	struct hci_cp_link_key_reply cp;
4581 	struct hci_conn *conn;
4582 	struct link_key *key;
4583 
4584 	bt_dev_dbg(hdev, "");
4585 
4586 	if (!hci_dev_test_flag(hdev, HCI_MGMT))
4587 		return;
4588 
4589 	hci_dev_lock(hdev);
4590 
4591 	key = hci_find_link_key(hdev, &ev->bdaddr);
4592 	if (!key) {
4593 		bt_dev_dbg(hdev, "link key not found for %pMR", &ev->bdaddr);
4594 		goto not_found;
4595 	}
4596 
4597 	bt_dev_dbg(hdev, "found key type %u for %pMR", key->type, &ev->bdaddr);
4598 
4599 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4600 	if (conn) {
4601 		clear_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
4602 
4603 		if ((key->type == HCI_LK_UNAUTH_COMBINATION_P192 ||
4604 		     key->type == HCI_LK_UNAUTH_COMBINATION_P256) &&
4605 		    conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
4606 			bt_dev_dbg(hdev, "ignoring unauthenticated key");
4607 			goto not_found;
4608 		}
4609 
4610 		if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
4611 		    (conn->pending_sec_level == BT_SECURITY_HIGH ||
4612 		     conn->pending_sec_level == BT_SECURITY_FIPS)) {
4613 			bt_dev_dbg(hdev, "ignoring key unauthenticated for high security");
4614 			goto not_found;
4615 		}
4616 
4617 		conn_set_key(conn, key->type, key->pin_len);
4618 	}
4619 
4620 	bacpy(&cp.bdaddr, &ev->bdaddr);
4621 	memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);
4622 
4623 	hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
4624 
4625 	hci_dev_unlock(hdev);
4626 
4627 	return;
4628 
4629 not_found:
4630 	hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
4631 	hci_dev_unlock(hdev);
4632 }
4633 
hci_link_key_notify_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)4634 static void hci_link_key_notify_evt(struct hci_dev *hdev, void *data,
4635 				    struct sk_buff *skb)
4636 {
4637 	struct hci_ev_link_key_notify *ev = data;
4638 	struct hci_conn *conn;
4639 	struct link_key *key;
4640 	bool persistent;
4641 	u8 pin_len = 0;
4642 
4643 	bt_dev_dbg(hdev, "");
4644 
4645 	hci_dev_lock(hdev);
4646 
4647 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4648 	if (!conn)
4649 		goto unlock;
4650 
4651 	/* Ignore NULL link key against CVE-2020-26555 */
4652 	if (!crypto_memneq(ev->link_key, ZERO_KEY, HCI_LINK_KEY_SIZE)) {
4653 		bt_dev_dbg(hdev, "Ignore NULL link key (ZERO KEY) for %pMR",
4654 			   &ev->bdaddr);
4655 		hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
4656 		hci_conn_drop(conn);
4657 		goto unlock;
4658 	}
4659 
4660 	hci_conn_hold(conn);
4661 	conn->disc_timeout = HCI_DISCONN_TIMEOUT;
4662 	hci_conn_drop(conn);
4663 
4664 	set_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
4665 	conn_set_key(conn, ev->key_type, conn->pin_length);
4666 
4667 	if (!hci_dev_test_flag(hdev, HCI_MGMT))
4668 		goto unlock;
4669 
4670 	key = hci_add_link_key(hdev, conn, &ev->bdaddr, ev->link_key,
4671 			        ev->key_type, pin_len, &persistent);
4672 	if (!key)
4673 		goto unlock;
4674 
4675 	/* Update connection information since adding the key will have
4676 	 * fixed up the type in the case of changed combination keys.
4677 	 */
4678 	if (ev->key_type == HCI_LK_CHANGED_COMBINATION)
4679 		conn_set_key(conn, key->type, key->pin_len);
4680 
4681 	mgmt_new_link_key(hdev, key, persistent);
4682 
4683 	/* Keep debug keys around only if the HCI_KEEP_DEBUG_KEYS flag
4684 	 * is set. If it's not set simply remove the key from the kernel
4685 	 * list (we've still notified user space about it but with
4686 	 * store_hint being 0).
4687 	 */
4688 	if (key->type == HCI_LK_DEBUG_COMBINATION &&
4689 	    !hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) {
4690 		list_del_rcu(&key->list);
4691 		kfree_rcu(key, rcu);
4692 		goto unlock;
4693 	}
4694 
4695 	if (persistent)
4696 		clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
4697 	else
4698 		set_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
4699 
4700 unlock:
4701 	hci_dev_unlock(hdev);
4702 }
4703 
hci_clock_offset_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)4704 static void hci_clock_offset_evt(struct hci_dev *hdev, void *data,
4705 				 struct sk_buff *skb)
4706 {
4707 	struct hci_ev_clock_offset *ev = data;
4708 	struct hci_conn *conn;
4709 
4710 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
4711 
4712 	hci_dev_lock(hdev);
4713 
4714 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4715 	if (conn && !ev->status) {
4716 		struct inquiry_entry *ie;
4717 
4718 		ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
4719 		if (ie) {
4720 			ie->data.clock_offset = ev->clock_offset;
4721 			ie->timestamp = jiffies;
4722 		}
4723 	}
4724 
4725 	hci_dev_unlock(hdev);
4726 }
4727 
hci_pkt_type_change_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)4728 static void hci_pkt_type_change_evt(struct hci_dev *hdev, void *data,
4729 				    struct sk_buff *skb)
4730 {
4731 	struct hci_ev_pkt_type_change *ev = data;
4732 	struct hci_conn *conn;
4733 
4734 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
4735 
4736 	hci_dev_lock(hdev);
4737 
4738 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4739 	if (conn && !ev->status)
4740 		conn->pkt_type = __le16_to_cpu(ev->pkt_type);
4741 
4742 	hci_dev_unlock(hdev);
4743 }
4744 
hci_pscan_rep_mode_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)4745 static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, void *data,
4746 				   struct sk_buff *skb)
4747 {
4748 	struct hci_ev_pscan_rep_mode *ev = data;
4749 	struct inquiry_entry *ie;
4750 
4751 	bt_dev_dbg(hdev, "");
4752 
4753 	hci_dev_lock(hdev);
4754 
4755 	ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
4756 	if (ie) {
4757 		ie->data.pscan_rep_mode = ev->pscan_rep_mode;
4758 		ie->timestamp = jiffies;
4759 	}
4760 
4761 	hci_dev_unlock(hdev);
4762 }
4763 
hci_inquiry_result_with_rssi_evt(struct hci_dev * hdev,void * edata,struct sk_buff * skb)4764 static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, void *edata,
4765 					     struct sk_buff *skb)
4766 {
4767 	struct hci_ev_inquiry_result_rssi *ev = edata;
4768 	struct inquiry_data data;
4769 	int i;
4770 
4771 	bt_dev_dbg(hdev, "num_rsp %d", ev->num);
4772 
4773 	if (!ev->num)
4774 		return;
4775 
4776 	if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
4777 		return;
4778 
4779 	hci_dev_lock(hdev);
4780 
4781 	if (skb->len == array_size(ev->num,
4782 				   sizeof(struct inquiry_info_rssi_pscan))) {
4783 		struct inquiry_info_rssi_pscan *info;
4784 
4785 		for (i = 0; i < ev->num; i++) {
4786 			u32 flags;
4787 
4788 			info = hci_ev_skb_pull(hdev, skb,
4789 					       HCI_EV_INQUIRY_RESULT_WITH_RSSI,
4790 					       sizeof(*info));
4791 			if (!info) {
4792 				bt_dev_err(hdev, "Malformed HCI Event: 0x%2.2x",
4793 					   HCI_EV_INQUIRY_RESULT_WITH_RSSI);
4794 				goto unlock;
4795 			}
4796 
4797 			bacpy(&data.bdaddr, &info->bdaddr);
4798 			data.pscan_rep_mode	= info->pscan_rep_mode;
4799 			data.pscan_period_mode	= info->pscan_period_mode;
4800 			data.pscan_mode		= info->pscan_mode;
4801 			memcpy(data.dev_class, info->dev_class, 3);
4802 			data.clock_offset	= info->clock_offset;
4803 			data.rssi		= info->rssi;
4804 			data.ssp_mode		= 0x00;
4805 
4806 			flags = hci_inquiry_cache_update(hdev, &data, false);
4807 
4808 			mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4809 					  info->dev_class, info->rssi,
4810 					  flags, NULL, 0, NULL, 0, 0);
4811 		}
4812 	} else if (skb->len == array_size(ev->num,
4813 					  sizeof(struct inquiry_info_rssi))) {
4814 		struct inquiry_info_rssi *info;
4815 
4816 		for (i = 0; i < ev->num; i++) {
4817 			u32 flags;
4818 
4819 			info = hci_ev_skb_pull(hdev, skb,
4820 					       HCI_EV_INQUIRY_RESULT_WITH_RSSI,
4821 					       sizeof(*info));
4822 			if (!info) {
4823 				bt_dev_err(hdev, "Malformed HCI Event: 0x%2.2x",
4824 					   HCI_EV_INQUIRY_RESULT_WITH_RSSI);
4825 				goto unlock;
4826 			}
4827 
4828 			bacpy(&data.bdaddr, &info->bdaddr);
4829 			data.pscan_rep_mode	= info->pscan_rep_mode;
4830 			data.pscan_period_mode	= info->pscan_period_mode;
4831 			data.pscan_mode		= 0x00;
4832 			memcpy(data.dev_class, info->dev_class, 3);
4833 			data.clock_offset	= info->clock_offset;
4834 			data.rssi		= info->rssi;
4835 			data.ssp_mode		= 0x00;
4836 
4837 			flags = hci_inquiry_cache_update(hdev, &data, false);
4838 
4839 			mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4840 					  info->dev_class, info->rssi,
4841 					  flags, NULL, 0, NULL, 0, 0);
4842 		}
4843 	} else {
4844 		bt_dev_err(hdev, "Malformed HCI Event: 0x%2.2x",
4845 			   HCI_EV_INQUIRY_RESULT_WITH_RSSI);
4846 	}
4847 unlock:
4848 	hci_dev_unlock(hdev);
4849 }
4850 
hci_remote_ext_features_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)4851 static void hci_remote_ext_features_evt(struct hci_dev *hdev, void *data,
4852 					struct sk_buff *skb)
4853 {
4854 	struct hci_ev_remote_ext_features *ev = data;
4855 	struct hci_conn *conn;
4856 
4857 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
4858 
4859 	hci_dev_lock(hdev);
4860 
4861 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4862 	if (!conn)
4863 		goto unlock;
4864 
4865 	if (ev->page < HCI_MAX_PAGES)
4866 		memcpy(conn->features[ev->page], ev->features, 8);
4867 
4868 	if (!ev->status && ev->page == 0x01) {
4869 		struct inquiry_entry *ie;
4870 
4871 		ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
4872 		if (ie)
4873 			ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
4874 
4875 		if (ev->features[0] & LMP_HOST_SSP) {
4876 			set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
4877 		} else {
4878 			/* It is mandatory by the Bluetooth specification that
4879 			 * Extended Inquiry Results are only used when Secure
4880 			 * Simple Pairing is enabled, but some devices violate
4881 			 * this.
4882 			 *
4883 			 * To make these devices work, the internal SSP
4884 			 * enabled flag needs to be cleared if the remote host
4885 			 * features do not indicate SSP support */
4886 			clear_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
4887 		}
4888 
4889 		if (ev->features[0] & LMP_HOST_SC)
4890 			set_bit(HCI_CONN_SC_ENABLED, &conn->flags);
4891 	}
4892 
4893 	if (conn->state != BT_CONFIG)
4894 		goto unlock;
4895 
4896 	if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
4897 		struct hci_cp_remote_name_req cp;
4898 		memset(&cp, 0, sizeof(cp));
4899 		bacpy(&cp.bdaddr, &conn->dst);
4900 		cp.pscan_rep_mode = 0x02;
4901 		hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
4902 	} else {
4903 		mgmt_device_connected(hdev, conn, NULL, 0);
4904 	}
4905 
4906 	if (!hci_outgoing_auth_needed(hdev, conn)) {
4907 		conn->state = BT_CONNECTED;
4908 		hci_connect_cfm(conn, ev->status);
4909 		hci_conn_drop(conn);
4910 	}
4911 
4912 unlock:
4913 	hci_dev_unlock(hdev);
4914 }
4915 
hci_sync_conn_complete_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)4916 static void hci_sync_conn_complete_evt(struct hci_dev *hdev, void *data,
4917 				       struct sk_buff *skb)
4918 {
4919 	struct hci_ev_sync_conn_complete *ev = data;
4920 	struct hci_conn *conn;
4921 	u8 status = ev->status;
4922 
4923 	switch (ev->link_type) {
4924 	case SCO_LINK:
4925 	case ESCO_LINK:
4926 		break;
4927 	default:
4928 		/* As per Core 5.3 Vol 4 Part E 7.7.35 (p.2219), Link_Type
4929 		 * for HCI_Synchronous_Connection_Complete is limited to
4930 		 * either SCO or eSCO
4931 		 */
4932 		bt_dev_err(hdev, "Ignoring connect complete event for invalid link type");
4933 		return;
4934 	}
4935 
4936 	bt_dev_dbg(hdev, "status 0x%2.2x", status);
4937 
4938 	hci_dev_lock(hdev);
4939 
4940 	conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
4941 	if (!conn) {
4942 		if (ev->link_type == ESCO_LINK)
4943 			goto unlock;
4944 
4945 		/* When the link type in the event indicates SCO connection
4946 		 * and lookup of the connection object fails, then check
4947 		 * if an eSCO connection object exists.
4948 		 *
4949 		 * The core limits the synchronous connections to either
4950 		 * SCO or eSCO. The eSCO connection is preferred and tried
4951 		 * to be setup first and until successfully established,
4952 		 * the link type will be hinted as eSCO.
4953 		 */
4954 		conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
4955 		if (!conn)
4956 			goto unlock;
4957 	}
4958 
4959 	/* The HCI_Synchronous_Connection_Complete event is only sent once per connection.
4960 	 * Processing it more than once per connection can corrupt kernel memory.
4961 	 *
4962 	 * As the connection handle is set here for the first time, it indicates
4963 	 * whether the connection is already set up.
4964 	 */
4965 	if (!HCI_CONN_HANDLE_UNSET(conn->handle)) {
4966 		bt_dev_err(hdev, "Ignoring HCI_Sync_Conn_Complete event for existing connection");
4967 		goto unlock;
4968 	}
4969 
4970 	switch (status) {
4971 	case 0x00:
4972 		status = hci_conn_set_handle(conn, __le16_to_cpu(ev->handle));
4973 		if (status) {
4974 			conn->state = BT_CLOSED;
4975 			break;
4976 		}
4977 
4978 		conn->state  = BT_CONNECTED;
4979 		conn->type   = ev->link_type;
4980 
4981 		hci_debugfs_create_conn(conn);
4982 		hci_conn_add_sysfs(conn);
4983 		break;
4984 
4985 	case 0x10:	/* Connection Accept Timeout */
4986 	case 0x0d:	/* Connection Rejected due to Limited Resources */
4987 	case 0x11:	/* Unsupported Feature or Parameter Value */
4988 	case 0x1c:	/* SCO interval rejected */
4989 	case 0x1a:	/* Unsupported Remote Feature */
4990 	case 0x1e:	/* Invalid LMP Parameters */
4991 	case 0x1f:	/* Unspecified error */
4992 	case 0x20:	/* Unsupported LMP Parameter value */
4993 		if (conn->out) {
4994 			conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
4995 					(hdev->esco_type & EDR_ESCO_MASK);
4996 			if (hci_setup_sync(conn, conn->parent->handle))
4997 				goto unlock;
4998 		}
4999 		fallthrough;
5000 
5001 	default:
5002 		conn->state = BT_CLOSED;
5003 		break;
5004 	}
5005 
5006 	bt_dev_dbg(hdev, "SCO connected with air mode: %02x", ev->air_mode);
5007 	/* Notify only in case of SCO over HCI transport data path which
5008 	 * is zero and non-zero value shall be non-HCI transport data path
5009 	 */
5010 	if (conn->codec.data_path == 0 && hdev->notify) {
5011 		switch (ev->air_mode) {
5012 		case 0x02:
5013 			hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_CVSD);
5014 			break;
5015 		case 0x03:
5016 			hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_TRANSP);
5017 			break;
5018 		}
5019 	}
5020 
5021 	hci_connect_cfm(conn, status);
5022 	if (status)
5023 		hci_conn_del(conn);
5024 
5025 unlock:
5026 	hci_dev_unlock(hdev);
5027 }
5028 
eir_get_length(u8 * eir,size_t eir_len)5029 static inline size_t eir_get_length(u8 *eir, size_t eir_len)
5030 {
5031 	size_t parsed = 0;
5032 
5033 	while (parsed < eir_len) {
5034 		u8 field_len = eir[0];
5035 
5036 		if (field_len == 0)
5037 			return parsed;
5038 
5039 		parsed += field_len + 1;
5040 		eir += field_len + 1;
5041 	}
5042 
5043 	return eir_len;
5044 }
5045 
hci_extended_inquiry_result_evt(struct hci_dev * hdev,void * edata,struct sk_buff * skb)5046 static void hci_extended_inquiry_result_evt(struct hci_dev *hdev, void *edata,
5047 					    struct sk_buff *skb)
5048 {
5049 	struct hci_ev_ext_inquiry_result *ev = edata;
5050 	struct inquiry_data data;
5051 	size_t eir_len;
5052 	int i;
5053 
5054 	if (!hci_ev_skb_pull(hdev, skb, HCI_EV_EXTENDED_INQUIRY_RESULT,
5055 			     flex_array_size(ev, info, ev->num)))
5056 		return;
5057 
5058 	bt_dev_dbg(hdev, "num %d", ev->num);
5059 
5060 	if (!ev->num)
5061 		return;
5062 
5063 	if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
5064 		return;
5065 
5066 	hci_dev_lock(hdev);
5067 
5068 	for (i = 0; i < ev->num; i++) {
5069 		struct extended_inquiry_info *info = &ev->info[i];
5070 		u32 flags;
5071 		bool name_known;
5072 
5073 		bacpy(&data.bdaddr, &info->bdaddr);
5074 		data.pscan_rep_mode	= info->pscan_rep_mode;
5075 		data.pscan_period_mode	= info->pscan_period_mode;
5076 		data.pscan_mode		= 0x00;
5077 		memcpy(data.dev_class, info->dev_class, 3);
5078 		data.clock_offset	= info->clock_offset;
5079 		data.rssi		= info->rssi;
5080 		data.ssp_mode		= 0x01;
5081 
5082 		if (hci_dev_test_flag(hdev, HCI_MGMT))
5083 			name_known = eir_get_data(info->data,
5084 						  sizeof(info->data),
5085 						  EIR_NAME_COMPLETE, NULL);
5086 		else
5087 			name_known = true;
5088 
5089 		flags = hci_inquiry_cache_update(hdev, &data, name_known);
5090 
5091 		eir_len = eir_get_length(info->data, sizeof(info->data));
5092 
5093 		mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
5094 				  info->dev_class, info->rssi,
5095 				  flags, info->data, eir_len, NULL, 0, 0);
5096 	}
5097 
5098 	hci_dev_unlock(hdev);
5099 }
5100 
hci_key_refresh_complete_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)5101 static void hci_key_refresh_complete_evt(struct hci_dev *hdev, void *data,
5102 					 struct sk_buff *skb)
5103 {
5104 	struct hci_ev_key_refresh_complete *ev = data;
5105 	struct hci_conn *conn;
5106 
5107 	bt_dev_dbg(hdev, "status 0x%2.2x handle 0x%4.4x", ev->status,
5108 		   __le16_to_cpu(ev->handle));
5109 
5110 	hci_dev_lock(hdev);
5111 
5112 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5113 	if (!conn)
5114 		goto unlock;
5115 
5116 	/* For BR/EDR the necessary steps are taken through the
5117 	 * auth_complete event.
5118 	 */
5119 	if (conn->type != LE_LINK)
5120 		goto unlock;
5121 
5122 	if (!ev->status)
5123 		conn->sec_level = conn->pending_sec_level;
5124 
5125 	clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
5126 
5127 	if (ev->status && conn->state == BT_CONNECTED) {
5128 		hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
5129 		hci_conn_drop(conn);
5130 		goto unlock;
5131 	}
5132 
5133 	if (conn->state == BT_CONFIG) {
5134 		if (!ev->status)
5135 			conn->state = BT_CONNECTED;
5136 
5137 		hci_connect_cfm(conn, ev->status);
5138 		hci_conn_drop(conn);
5139 	} else {
5140 		hci_auth_cfm(conn, ev->status);
5141 
5142 		hci_conn_hold(conn);
5143 		conn->disc_timeout = HCI_DISCONN_TIMEOUT;
5144 		hci_conn_drop(conn);
5145 	}
5146 
5147 unlock:
5148 	hci_dev_unlock(hdev);
5149 }
5150 
hci_get_auth_req(struct hci_conn * conn)5151 static u8 hci_get_auth_req(struct hci_conn *conn)
5152 {
5153 	/* If remote requests no-bonding follow that lead */
5154 	if (conn->remote_auth == HCI_AT_NO_BONDING ||
5155 	    conn->remote_auth == HCI_AT_NO_BONDING_MITM)
5156 		return conn->remote_auth | (conn->auth_type & 0x01);
5157 
5158 	/* If both remote and local have enough IO capabilities, require
5159 	 * MITM protection
5160 	 */
5161 	if (conn->remote_cap != HCI_IO_NO_INPUT_OUTPUT &&
5162 	    conn->io_capability != HCI_IO_NO_INPUT_OUTPUT)
5163 		return conn->remote_auth | 0x01;
5164 
5165 	/* No MITM protection possible so ignore remote requirement */
5166 	return (conn->remote_auth & ~0x01) | (conn->auth_type & 0x01);
5167 }
5168 
bredr_oob_data_present(struct hci_conn * conn)5169 static u8 bredr_oob_data_present(struct hci_conn *conn)
5170 {
5171 	struct hci_dev *hdev = conn->hdev;
5172 	struct oob_data *data;
5173 
5174 	data = hci_find_remote_oob_data(hdev, &conn->dst, BDADDR_BREDR);
5175 	if (!data)
5176 		return 0x00;
5177 
5178 	if (bredr_sc_enabled(hdev)) {
5179 		/* When Secure Connections is enabled, then just
5180 		 * return the present value stored with the OOB
5181 		 * data. The stored value contains the right present
5182 		 * information. However it can only be trusted when
5183 		 * not in Secure Connection Only mode.
5184 		 */
5185 		if (!hci_dev_test_flag(hdev, HCI_SC_ONLY))
5186 			return data->present;
5187 
5188 		/* When Secure Connections Only mode is enabled, then
5189 		 * the P-256 values are required. If they are not
5190 		 * available, then do not declare that OOB data is
5191 		 * present.
5192 		 */
5193 		if (!crypto_memneq(data->rand256, ZERO_KEY, 16) ||
5194 		    !crypto_memneq(data->hash256, ZERO_KEY, 16))
5195 			return 0x00;
5196 
5197 		return 0x02;
5198 	}
5199 
5200 	/* When Secure Connections is not enabled or actually
5201 	 * not supported by the hardware, then check that if
5202 	 * P-192 data values are present.
5203 	 */
5204 	if (!crypto_memneq(data->rand192, ZERO_KEY, 16) ||
5205 	    !crypto_memneq(data->hash192, ZERO_KEY, 16))
5206 		return 0x00;
5207 
5208 	return 0x01;
5209 }
5210 
hci_io_capa_request_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)5211 static void hci_io_capa_request_evt(struct hci_dev *hdev, void *data,
5212 				    struct sk_buff *skb)
5213 {
5214 	struct hci_ev_io_capa_request *ev = data;
5215 	struct hci_conn *conn;
5216 
5217 	bt_dev_dbg(hdev, "");
5218 
5219 	hci_dev_lock(hdev);
5220 
5221 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
5222 	if (!conn || !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
5223 		goto unlock;
5224 
5225 	/* Assume remote supports SSP since it has triggered this event */
5226 	set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
5227 
5228 	hci_conn_hold(conn);
5229 
5230 	if (!hci_dev_test_flag(hdev, HCI_MGMT))
5231 		goto unlock;
5232 
5233 	/* Allow pairing if we're pairable, the initiators of the
5234 	 * pairing or if the remote is not requesting bonding.
5235 	 */
5236 	if (hci_dev_test_flag(hdev, HCI_BONDABLE) ||
5237 	    test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags) ||
5238 	    (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
5239 		struct hci_cp_io_capability_reply cp;
5240 
5241 		bacpy(&cp.bdaddr, &ev->bdaddr);
5242 		/* Change the IO capability from KeyboardDisplay
5243 		 * to DisplayYesNo as it is not supported by BT spec. */
5244 		cp.capability = (conn->io_capability == 0x04) ?
5245 				HCI_IO_DISPLAY_YESNO : conn->io_capability;
5246 
5247 		/* If we are initiators, there is no remote information yet */
5248 		if (conn->remote_auth == 0xff) {
5249 			/* Request MITM protection if our IO caps allow it
5250 			 * except for the no-bonding case.
5251 			 */
5252 			if (conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
5253 			    conn->auth_type != HCI_AT_NO_BONDING)
5254 				conn->auth_type |= 0x01;
5255 		} else {
5256 			conn->auth_type = hci_get_auth_req(conn);
5257 		}
5258 
5259 		/* If we're not bondable, force one of the non-bondable
5260 		 * authentication requirement values.
5261 		 */
5262 		if (!hci_dev_test_flag(hdev, HCI_BONDABLE))
5263 			conn->auth_type &= HCI_AT_NO_BONDING_MITM;
5264 
5265 		cp.authentication = conn->auth_type;
5266 		cp.oob_data = bredr_oob_data_present(conn);
5267 
5268 		hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
5269 			     sizeof(cp), &cp);
5270 	} else {
5271 		struct hci_cp_io_capability_neg_reply cp;
5272 
5273 		bacpy(&cp.bdaddr, &ev->bdaddr);
5274 		cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
5275 
5276 		hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
5277 			     sizeof(cp), &cp);
5278 	}
5279 
5280 unlock:
5281 	hci_dev_unlock(hdev);
5282 }
5283 
hci_io_capa_reply_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)5284 static void hci_io_capa_reply_evt(struct hci_dev *hdev, void *data,
5285 				  struct sk_buff *skb)
5286 {
5287 	struct hci_ev_io_capa_reply *ev = data;
5288 	struct hci_conn *conn;
5289 
5290 	bt_dev_dbg(hdev, "");
5291 
5292 	hci_dev_lock(hdev);
5293 
5294 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
5295 	if (!conn)
5296 		goto unlock;
5297 
5298 	conn->remote_cap = ev->capability;
5299 	conn->remote_auth = ev->authentication;
5300 
5301 unlock:
5302 	hci_dev_unlock(hdev);
5303 }
5304 
hci_user_confirm_request_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)5305 static void hci_user_confirm_request_evt(struct hci_dev *hdev, void *data,
5306 					 struct sk_buff *skb)
5307 {
5308 	struct hci_ev_user_confirm_req *ev = data;
5309 	int loc_mitm, rem_mitm, confirm_hint = 0;
5310 	struct hci_conn *conn;
5311 
5312 	bt_dev_dbg(hdev, "");
5313 
5314 	hci_dev_lock(hdev);
5315 
5316 	if (!hci_dev_test_flag(hdev, HCI_MGMT))
5317 		goto unlock;
5318 
5319 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
5320 	if (!conn)
5321 		goto unlock;
5322 
5323 	loc_mitm = (conn->auth_type & 0x01);
5324 	rem_mitm = (conn->remote_auth & 0x01);
5325 
5326 	/* If we require MITM but the remote device can't provide that
5327 	 * (it has NoInputNoOutput) then reject the confirmation
5328 	 * request. We check the security level here since it doesn't
5329 	 * necessarily match conn->auth_type.
5330 	 */
5331 	if (conn->pending_sec_level > BT_SECURITY_MEDIUM &&
5332 	    conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
5333 		bt_dev_dbg(hdev, "Rejecting request: remote device can't provide MITM");
5334 		hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
5335 			     sizeof(ev->bdaddr), &ev->bdaddr);
5336 		goto unlock;
5337 	}
5338 
5339 	/* If no side requires MITM protection; use JUST_CFM method */
5340 	if ((!loc_mitm || conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) &&
5341 	    (!rem_mitm || conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)) {
5342 
5343 		/* If we're not the initiator of request authorization and the
5344 		 * local IO capability is not NoInputNoOutput, use JUST_WORKS
5345 		 * method (mgmt_user_confirm with confirm_hint set to 1).
5346 		 */
5347 		if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&
5348 		    conn->io_capability != HCI_IO_NO_INPUT_OUTPUT) {
5349 			bt_dev_dbg(hdev, "Confirming auto-accept as acceptor");
5350 			confirm_hint = 1;
5351 			goto confirm;
5352 		}
5353 
5354 		/* If there already exists link key in local host, leave the
5355 		 * decision to user space since the remote device could be
5356 		 * legitimate or malicious.
5357 		 */
5358 		if (hci_find_link_key(hdev, &ev->bdaddr)) {
5359 			bt_dev_dbg(hdev, "Local host already has link key");
5360 			confirm_hint = 1;
5361 			goto confirm;
5362 		}
5363 
5364 		BT_DBG("Auto-accept of user confirmation with %ums delay",
5365 		       hdev->auto_accept_delay);
5366 
5367 		if (hdev->auto_accept_delay > 0) {
5368 			int delay = msecs_to_jiffies(hdev->auto_accept_delay);
5369 			queue_delayed_work(conn->hdev->workqueue,
5370 					   &conn->auto_accept_work, delay);
5371 			goto unlock;
5372 		}
5373 
5374 		hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
5375 			     sizeof(ev->bdaddr), &ev->bdaddr);
5376 		goto unlock;
5377 	}
5378 
5379 confirm:
5380 	mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0,
5381 				  le32_to_cpu(ev->passkey), confirm_hint);
5382 
5383 unlock:
5384 	hci_dev_unlock(hdev);
5385 }
5386 
hci_user_passkey_request_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)5387 static void hci_user_passkey_request_evt(struct hci_dev *hdev, void *data,
5388 					 struct sk_buff *skb)
5389 {
5390 	struct hci_ev_user_passkey_req *ev = data;
5391 
5392 	bt_dev_dbg(hdev, "");
5393 
5394 	if (hci_dev_test_flag(hdev, HCI_MGMT))
5395 		mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
5396 }
5397 
hci_user_passkey_notify_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)5398 static void hci_user_passkey_notify_evt(struct hci_dev *hdev, void *data,
5399 					struct sk_buff *skb)
5400 {
5401 	struct hci_ev_user_passkey_notify *ev = data;
5402 	struct hci_conn *conn;
5403 
5404 	bt_dev_dbg(hdev, "");
5405 
5406 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
5407 	if (!conn)
5408 		return;
5409 
5410 	conn->passkey_notify = __le32_to_cpu(ev->passkey);
5411 	conn->passkey_entered = 0;
5412 
5413 	if (hci_dev_test_flag(hdev, HCI_MGMT))
5414 		mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
5415 					 conn->dst_type, conn->passkey_notify,
5416 					 conn->passkey_entered);
5417 }
5418 
hci_keypress_notify_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)5419 static void hci_keypress_notify_evt(struct hci_dev *hdev, void *data,
5420 				    struct sk_buff *skb)
5421 {
5422 	struct hci_ev_keypress_notify *ev = data;
5423 	struct hci_conn *conn;
5424 
5425 	bt_dev_dbg(hdev, "");
5426 
5427 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
5428 	if (!conn)
5429 		return;
5430 
5431 	switch (ev->type) {
5432 	case HCI_KEYPRESS_STARTED:
5433 		conn->passkey_entered = 0;
5434 		return;
5435 
5436 	case HCI_KEYPRESS_ENTERED:
5437 		conn->passkey_entered++;
5438 		break;
5439 
5440 	case HCI_KEYPRESS_ERASED:
5441 		conn->passkey_entered--;
5442 		break;
5443 
5444 	case HCI_KEYPRESS_CLEARED:
5445 		conn->passkey_entered = 0;
5446 		break;
5447 
5448 	case HCI_KEYPRESS_COMPLETED:
5449 		return;
5450 	}
5451 
5452 	if (hci_dev_test_flag(hdev, HCI_MGMT))
5453 		mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
5454 					 conn->dst_type, conn->passkey_notify,
5455 					 conn->passkey_entered);
5456 }
5457 
hci_simple_pair_complete_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)5458 static void hci_simple_pair_complete_evt(struct hci_dev *hdev, void *data,
5459 					 struct sk_buff *skb)
5460 {
5461 	struct hci_ev_simple_pair_complete *ev = data;
5462 	struct hci_conn *conn;
5463 
5464 	bt_dev_dbg(hdev, "");
5465 
5466 	hci_dev_lock(hdev);
5467 
5468 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
5469 	if (!conn || !hci_conn_ssp_enabled(conn))
5470 		goto unlock;
5471 
5472 	/* Reset the authentication requirement to unknown */
5473 	conn->remote_auth = 0xff;
5474 
5475 	/* To avoid duplicate auth_failed events to user space we check
5476 	 * the HCI_CONN_AUTH_PEND flag which will be set if we
5477 	 * initiated the authentication. A traditional auth_complete
5478 	 * event gets always produced as initiator and is also mapped to
5479 	 * the mgmt_auth_failed event */
5480 	if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status)
5481 		mgmt_auth_failed(conn, ev->status);
5482 
5483 	hci_conn_drop(conn);
5484 
5485 unlock:
5486 	hci_dev_unlock(hdev);
5487 }
5488 
hci_remote_host_features_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)5489 static void hci_remote_host_features_evt(struct hci_dev *hdev, void *data,
5490 					 struct sk_buff *skb)
5491 {
5492 	struct hci_ev_remote_host_features *ev = data;
5493 	struct inquiry_entry *ie;
5494 	struct hci_conn *conn;
5495 
5496 	bt_dev_dbg(hdev, "");
5497 
5498 	hci_dev_lock(hdev);
5499 
5500 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
5501 	if (conn)
5502 		memcpy(conn->features[1], ev->features, 8);
5503 
5504 	ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
5505 	if (ie)
5506 		ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
5507 
5508 	hci_dev_unlock(hdev);
5509 }
5510 
hci_remote_oob_data_request_evt(struct hci_dev * hdev,void * edata,struct sk_buff * skb)5511 static void hci_remote_oob_data_request_evt(struct hci_dev *hdev, void *edata,
5512 					    struct sk_buff *skb)
5513 {
5514 	struct hci_ev_remote_oob_data_request *ev = edata;
5515 	struct oob_data *data;
5516 
5517 	bt_dev_dbg(hdev, "");
5518 
5519 	hci_dev_lock(hdev);
5520 
5521 	if (!hci_dev_test_flag(hdev, HCI_MGMT))
5522 		goto unlock;
5523 
5524 	data = hci_find_remote_oob_data(hdev, &ev->bdaddr, BDADDR_BREDR);
5525 	if (!data) {
5526 		struct hci_cp_remote_oob_data_neg_reply cp;
5527 
5528 		bacpy(&cp.bdaddr, &ev->bdaddr);
5529 		hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY,
5530 			     sizeof(cp), &cp);
5531 		goto unlock;
5532 	}
5533 
5534 	if (bredr_sc_enabled(hdev)) {
5535 		struct hci_cp_remote_oob_ext_data_reply cp;
5536 
5537 		bacpy(&cp.bdaddr, &ev->bdaddr);
5538 		if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
5539 			memset(cp.hash192, 0, sizeof(cp.hash192));
5540 			memset(cp.rand192, 0, sizeof(cp.rand192));
5541 		} else {
5542 			memcpy(cp.hash192, data->hash192, sizeof(cp.hash192));
5543 			memcpy(cp.rand192, data->rand192, sizeof(cp.rand192));
5544 		}
5545 		memcpy(cp.hash256, data->hash256, sizeof(cp.hash256));
5546 		memcpy(cp.rand256, data->rand256, sizeof(cp.rand256));
5547 
5548 		hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_EXT_DATA_REPLY,
5549 			     sizeof(cp), &cp);
5550 	} else {
5551 		struct hci_cp_remote_oob_data_reply cp;
5552 
5553 		bacpy(&cp.bdaddr, &ev->bdaddr);
5554 		memcpy(cp.hash, data->hash192, sizeof(cp.hash));
5555 		memcpy(cp.rand, data->rand192, sizeof(cp.rand));
5556 
5557 		hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY,
5558 			     sizeof(cp), &cp);
5559 	}
5560 
5561 unlock:
5562 	hci_dev_unlock(hdev);
5563 }
5564 
le_conn_update_addr(struct hci_conn * conn,bdaddr_t * bdaddr,u8 bdaddr_type,bdaddr_t * local_rpa)5565 static void le_conn_update_addr(struct hci_conn *conn, bdaddr_t *bdaddr,
5566 				u8 bdaddr_type, bdaddr_t *local_rpa)
5567 {
5568 	if (conn->out) {
5569 		conn->dst_type = bdaddr_type;
5570 		conn->resp_addr_type = bdaddr_type;
5571 		bacpy(&conn->resp_addr, bdaddr);
5572 
5573 		/* Check if the controller has set a Local RPA then it must be
5574 		 * used instead or hdev->rpa.
5575 		 */
5576 		if (local_rpa && bacmp(local_rpa, BDADDR_ANY)) {
5577 			conn->init_addr_type = ADDR_LE_DEV_RANDOM;
5578 			bacpy(&conn->init_addr, local_rpa);
5579 		} else if (hci_dev_test_flag(conn->hdev, HCI_PRIVACY)) {
5580 			conn->init_addr_type = ADDR_LE_DEV_RANDOM;
5581 			bacpy(&conn->init_addr, &conn->hdev->rpa);
5582 		} else {
5583 			hci_copy_identity_address(conn->hdev, &conn->init_addr,
5584 						  &conn->init_addr_type);
5585 		}
5586 	} else {
5587 		conn->resp_addr_type = conn->hdev->adv_addr_type;
5588 		/* Check if the controller has set a Local RPA then it must be
5589 		 * used instead or hdev->rpa.
5590 		 */
5591 		if (local_rpa && bacmp(local_rpa, BDADDR_ANY)) {
5592 			conn->resp_addr_type = ADDR_LE_DEV_RANDOM;
5593 			bacpy(&conn->resp_addr, local_rpa);
5594 		} else if (conn->hdev->adv_addr_type == ADDR_LE_DEV_RANDOM) {
5595 			/* In case of ext adv, resp_addr will be updated in
5596 			 * Adv Terminated event.
5597 			 */
5598 			if (!ext_adv_capable(conn->hdev))
5599 				bacpy(&conn->resp_addr,
5600 				      &conn->hdev->random_addr);
5601 		} else {
5602 			bacpy(&conn->resp_addr, &conn->hdev->bdaddr);
5603 		}
5604 
5605 		conn->init_addr_type = bdaddr_type;
5606 		bacpy(&conn->init_addr, bdaddr);
5607 
5608 		/* For incoming connections, set the default minimum
5609 		 * and maximum connection interval. They will be used
5610 		 * to check if the parameters are in range and if not
5611 		 * trigger the connection update procedure.
5612 		 */
5613 		conn->le_conn_min_interval = conn->hdev->le_conn_min_interval;
5614 		conn->le_conn_max_interval = conn->hdev->le_conn_max_interval;
5615 	}
5616 }
5617 
le_conn_complete_evt(struct hci_dev * hdev,u8 status,bdaddr_t * bdaddr,u8 bdaddr_type,bdaddr_t * local_rpa,u8 role,u16 handle,u16 interval,u16 latency,u16 supervision_timeout)5618 static void le_conn_complete_evt(struct hci_dev *hdev, u8 status,
5619 				 bdaddr_t *bdaddr, u8 bdaddr_type,
5620 				 bdaddr_t *local_rpa, u8 role, u16 handle,
5621 				 u16 interval, u16 latency,
5622 				 u16 supervision_timeout)
5623 {
5624 	struct hci_conn_params *params;
5625 	struct hci_conn *conn;
5626 	struct smp_irk *irk;
5627 	u8 addr_type;
5628 
5629 	hci_dev_lock(hdev);
5630 
5631 	/* All controllers implicitly stop advertising in the event of a
5632 	 * connection, so ensure that the state bit is cleared.
5633 	 */
5634 	hci_dev_clear_flag(hdev, HCI_LE_ADV);
5635 
5636 	conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr);
5637 	if (!conn) {
5638 		/* In case of error status and there is no connection pending
5639 		 * just unlock as there is nothing to cleanup.
5640 		 */
5641 		if (status)
5642 			goto unlock;
5643 
5644 		conn = hci_conn_add_unset(hdev, LE_LINK, bdaddr, role);
5645 		if (IS_ERR(conn)) {
5646 			bt_dev_err(hdev, "connection err: %ld", PTR_ERR(conn));
5647 			goto unlock;
5648 		}
5649 
5650 		conn->dst_type = bdaddr_type;
5651 
5652 		/* If we didn't have a hci_conn object previously
5653 		 * but we're in central role this must be something
5654 		 * initiated using an accept list. Since accept list based
5655 		 * connections are not "first class citizens" we don't
5656 		 * have full tracking of them. Therefore, we go ahead
5657 		 * with a "best effort" approach of determining the
5658 		 * initiator address based on the HCI_PRIVACY flag.
5659 		 */
5660 		if (conn->out) {
5661 			conn->resp_addr_type = bdaddr_type;
5662 			bacpy(&conn->resp_addr, bdaddr);
5663 			if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
5664 				conn->init_addr_type = ADDR_LE_DEV_RANDOM;
5665 				bacpy(&conn->init_addr, &hdev->rpa);
5666 			} else {
5667 				hci_copy_identity_address(hdev,
5668 							  &conn->init_addr,
5669 							  &conn->init_addr_type);
5670 			}
5671 		}
5672 	} else {
5673 		cancel_delayed_work(&conn->le_conn_timeout);
5674 	}
5675 
5676 	/* The HCI_LE_Connection_Complete event is only sent once per connection.
5677 	 * Processing it more than once per connection can corrupt kernel memory.
5678 	 *
5679 	 * As the connection handle is set here for the first time, it indicates
5680 	 * whether the connection is already set up.
5681 	 */
5682 	if (!HCI_CONN_HANDLE_UNSET(conn->handle)) {
5683 		bt_dev_err(hdev, "Ignoring HCI_Connection_Complete for existing connection");
5684 		goto unlock;
5685 	}
5686 
5687 	le_conn_update_addr(conn, bdaddr, bdaddr_type, local_rpa);
5688 
5689 	/* Lookup the identity address from the stored connection
5690 	 * address and address type.
5691 	 *
5692 	 * When establishing connections to an identity address, the
5693 	 * connection procedure will store the resolvable random
5694 	 * address first. Now if it can be converted back into the
5695 	 * identity address, start using the identity address from
5696 	 * now on.
5697 	 */
5698 	irk = hci_get_irk(hdev, &conn->dst, conn->dst_type);
5699 	if (irk) {
5700 		bacpy(&conn->dst, &irk->bdaddr);
5701 		conn->dst_type = irk->addr_type;
5702 	}
5703 
5704 	conn->dst_type = ev_bdaddr_type(hdev, conn->dst_type, NULL);
5705 
5706 	/* All connection failure handling is taken care of by the
5707 	 * hci_conn_failed function which is triggered by the HCI
5708 	 * request completion callbacks used for connecting.
5709 	 */
5710 	if (status || hci_conn_set_handle(conn, handle))
5711 		goto unlock;
5712 
5713 	/* Drop the connection if it has been aborted */
5714 	if (test_bit(HCI_CONN_CANCEL, &conn->flags)) {
5715 		hci_conn_drop(conn);
5716 		goto unlock;
5717 	}
5718 
5719 	if (conn->dst_type == ADDR_LE_DEV_PUBLIC)
5720 		addr_type = BDADDR_LE_PUBLIC;
5721 	else
5722 		addr_type = BDADDR_LE_RANDOM;
5723 
5724 	/* Drop the connection if the device is blocked */
5725 	if (hci_bdaddr_list_lookup(&hdev->reject_list, &conn->dst, addr_type)) {
5726 		hci_conn_drop(conn);
5727 		goto unlock;
5728 	}
5729 
5730 	mgmt_device_connected(hdev, conn, NULL, 0);
5731 
5732 	conn->sec_level = BT_SECURITY_LOW;
5733 	conn->state = BT_CONFIG;
5734 
5735 	/* Store current advertising instance as connection advertising instance
5736 	 * when sotfware rotation is in use so it can be re-enabled when
5737 	 * disconnected.
5738 	 */
5739 	if (!ext_adv_capable(hdev))
5740 		conn->adv_instance = hdev->cur_adv_instance;
5741 
5742 	conn->le_conn_interval = interval;
5743 	conn->le_conn_latency = latency;
5744 	conn->le_supv_timeout = supervision_timeout;
5745 
5746 	hci_debugfs_create_conn(conn);
5747 	hci_conn_add_sysfs(conn);
5748 
5749 	/* The remote features procedure is defined for central
5750 	 * role only. So only in case of an initiated connection
5751 	 * request the remote features.
5752 	 *
5753 	 * If the local controller supports peripheral-initiated features
5754 	 * exchange, then requesting the remote features in peripheral
5755 	 * role is possible. Otherwise just transition into the
5756 	 * connected state without requesting the remote features.
5757 	 */
5758 	if (conn->out ||
5759 	    (hdev->le_features[0] & HCI_LE_PERIPHERAL_FEATURES)) {
5760 		struct hci_cp_le_read_remote_features cp;
5761 
5762 		cp.handle = __cpu_to_le16(conn->handle);
5763 
5764 		hci_send_cmd(hdev, HCI_OP_LE_READ_REMOTE_FEATURES,
5765 			     sizeof(cp), &cp);
5766 
5767 		hci_conn_hold(conn);
5768 	} else {
5769 		conn->state = BT_CONNECTED;
5770 		hci_connect_cfm(conn, status);
5771 	}
5772 
5773 	params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
5774 					   conn->dst_type);
5775 	if (params) {
5776 		hci_pend_le_list_del_init(params);
5777 		if (params->conn) {
5778 			hci_conn_drop(params->conn);
5779 			hci_conn_put(params->conn);
5780 			params->conn = NULL;
5781 		}
5782 	}
5783 
5784 unlock:
5785 	hci_update_passive_scan(hdev);
5786 	hci_dev_unlock(hdev);
5787 }
5788 
hci_le_conn_complete_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)5789 static void hci_le_conn_complete_evt(struct hci_dev *hdev, void *data,
5790 				     struct sk_buff *skb)
5791 {
5792 	struct hci_ev_le_conn_complete *ev = data;
5793 
5794 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
5795 
5796 	le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,
5797 			     NULL, ev->role, le16_to_cpu(ev->handle),
5798 			     le16_to_cpu(ev->interval),
5799 			     le16_to_cpu(ev->latency),
5800 			     le16_to_cpu(ev->supervision_timeout));
5801 }
5802 
hci_le_enh_conn_complete_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)5803 static void hci_le_enh_conn_complete_evt(struct hci_dev *hdev, void *data,
5804 					 struct sk_buff *skb)
5805 {
5806 	struct hci_ev_le_enh_conn_complete *ev = data;
5807 
5808 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
5809 
5810 	le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,
5811 			     &ev->local_rpa, ev->role, le16_to_cpu(ev->handle),
5812 			     le16_to_cpu(ev->interval),
5813 			     le16_to_cpu(ev->latency),
5814 			     le16_to_cpu(ev->supervision_timeout));
5815 }
5816 
hci_le_ext_adv_term_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)5817 static void hci_le_ext_adv_term_evt(struct hci_dev *hdev, void *data,
5818 				    struct sk_buff *skb)
5819 {
5820 	struct hci_evt_le_ext_adv_set_term *ev = data;
5821 	struct hci_conn *conn;
5822 	struct adv_info *adv, *n;
5823 
5824 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
5825 
5826 	/* The Bluetooth Core 5.3 specification clearly states that this event
5827 	 * shall not be sent when the Host disables the advertising set. So in
5828 	 * case of HCI_ERROR_CANCELLED_BY_HOST, just ignore the event.
5829 	 *
5830 	 * When the Host disables an advertising set, all cleanup is done via
5831 	 * its command callback and not needed to be duplicated here.
5832 	 */
5833 	if (ev->status == HCI_ERROR_CANCELLED_BY_HOST) {
5834 		bt_dev_warn_ratelimited(hdev, "Unexpected advertising set terminated event");
5835 		return;
5836 	}
5837 
5838 	hci_dev_lock(hdev);
5839 
5840 	adv = hci_find_adv_instance(hdev, ev->handle);
5841 
5842 	if (ev->status) {
5843 		if (!adv)
5844 			goto unlock;
5845 
5846 		/* Remove advertising as it has been terminated */
5847 		hci_remove_adv_instance(hdev, ev->handle);
5848 		mgmt_advertising_removed(NULL, hdev, ev->handle);
5849 
5850 		list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) {
5851 			if (adv->enabled)
5852 				goto unlock;
5853 		}
5854 
5855 		/* We are no longer advertising, clear HCI_LE_ADV */
5856 		hci_dev_clear_flag(hdev, HCI_LE_ADV);
5857 		goto unlock;
5858 	}
5859 
5860 	if (adv)
5861 		adv->enabled = false;
5862 
5863 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->conn_handle));
5864 	if (conn) {
5865 		/* Store handle in the connection so the correct advertising
5866 		 * instance can be re-enabled when disconnected.
5867 		 */
5868 		conn->adv_instance = ev->handle;
5869 
5870 		if (hdev->adv_addr_type != ADDR_LE_DEV_RANDOM ||
5871 		    bacmp(&conn->resp_addr, BDADDR_ANY))
5872 			goto unlock;
5873 
5874 		if (!ev->handle) {
5875 			bacpy(&conn->resp_addr, &hdev->random_addr);
5876 			goto unlock;
5877 		}
5878 
5879 		if (adv)
5880 			bacpy(&conn->resp_addr, &adv->random_addr);
5881 	}
5882 
5883 unlock:
5884 	hci_dev_unlock(hdev);
5885 }
5886 
hci_le_conn_update_complete_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)5887 static void hci_le_conn_update_complete_evt(struct hci_dev *hdev, void *data,
5888 					    struct sk_buff *skb)
5889 {
5890 	struct hci_ev_le_conn_update_complete *ev = data;
5891 	struct hci_conn *conn;
5892 
5893 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
5894 
5895 	if (ev->status)
5896 		return;
5897 
5898 	hci_dev_lock(hdev);
5899 
5900 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5901 	if (conn) {
5902 		conn->le_conn_interval = le16_to_cpu(ev->interval);
5903 		conn->le_conn_latency = le16_to_cpu(ev->latency);
5904 		conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
5905 	}
5906 
5907 	hci_dev_unlock(hdev);
5908 }
5909 
5910 /* This function requires the caller holds hdev->lock */
check_pending_le_conn(struct hci_dev * hdev,bdaddr_t * addr,u8 addr_type,bool addr_resolved,u8 adv_type,u8 phy,u8 sec_phy)5911 static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev,
5912 					      bdaddr_t *addr,
5913 					      u8 addr_type, bool addr_resolved,
5914 					      u8 adv_type, u8 phy, u8 sec_phy)
5915 {
5916 	struct hci_conn *conn;
5917 	struct hci_conn_params *params;
5918 
5919 	/* If the event is not connectable don't proceed further */
5920 	if (adv_type != LE_ADV_IND && adv_type != LE_ADV_DIRECT_IND)
5921 		return NULL;
5922 
5923 	/* Ignore if the device is blocked or hdev is suspended */
5924 	if (hci_bdaddr_list_lookup(&hdev->reject_list, addr, addr_type) ||
5925 	    hdev->suspended)
5926 		return NULL;
5927 
5928 	/* Most controller will fail if we try to create new connections
5929 	 * while we have an existing one in peripheral role.
5930 	 */
5931 	if (hdev->conn_hash.le_num_peripheral > 0 &&
5932 	    (test_bit(HCI_QUIRK_BROKEN_LE_STATES, &hdev->quirks) ||
5933 	     !(hdev->le_states[3] & 0x10)))
5934 		return NULL;
5935 
5936 	/* If we're not connectable only connect devices that we have in
5937 	 * our pend_le_conns list.
5938 	 */
5939 	params = hci_pend_le_action_lookup(&hdev->pend_le_conns, addr,
5940 					   addr_type);
5941 	if (!params)
5942 		return NULL;
5943 
5944 	if (!params->explicit_connect) {
5945 		switch (params->auto_connect) {
5946 		case HCI_AUTO_CONN_DIRECT:
5947 			/* Only devices advertising with ADV_DIRECT_IND are
5948 			 * triggering a connection attempt. This is allowing
5949 			 * incoming connections from peripheral devices.
5950 			 */
5951 			if (adv_type != LE_ADV_DIRECT_IND)
5952 				return NULL;
5953 			break;
5954 		case HCI_AUTO_CONN_ALWAYS:
5955 			/* Devices advertising with ADV_IND or ADV_DIRECT_IND
5956 			 * are triggering a connection attempt. This means
5957 			 * that incoming connections from peripheral device are
5958 			 * accepted and also outgoing connections to peripheral
5959 			 * devices are established when found.
5960 			 */
5961 			break;
5962 		default:
5963 			return NULL;
5964 		}
5965 	}
5966 
5967 	conn = hci_connect_le(hdev, addr, addr_type, addr_resolved,
5968 			      BT_SECURITY_LOW, hdev->def_le_autoconnect_timeout,
5969 			      HCI_ROLE_MASTER, phy, sec_phy);
5970 	if (!IS_ERR(conn)) {
5971 		/* If HCI_AUTO_CONN_EXPLICIT is set, conn is already owned
5972 		 * by higher layer that tried to connect, if no then
5973 		 * store the pointer since we don't really have any
5974 		 * other owner of the object besides the params that
5975 		 * triggered it. This way we can abort the connection if
5976 		 * the parameters get removed and keep the reference
5977 		 * count consistent once the connection is established.
5978 		 */
5979 
5980 		if (!params->explicit_connect)
5981 			params->conn = hci_conn_get(conn);
5982 
5983 		return conn;
5984 	}
5985 
5986 	switch (PTR_ERR(conn)) {
5987 	case -EBUSY:
5988 		/* If hci_connect() returns -EBUSY it means there is already
5989 		 * an LE connection attempt going on. Since controllers don't
5990 		 * support more than one connection attempt at the time, we
5991 		 * don't consider this an error case.
5992 		 */
5993 		break;
5994 	default:
5995 		BT_DBG("Failed to connect: err %ld", PTR_ERR(conn));
5996 		return NULL;
5997 	}
5998 
5999 	return NULL;
6000 }
6001 
process_adv_report(struct hci_dev * hdev,u8 type,bdaddr_t * bdaddr,u8 bdaddr_type,bdaddr_t * direct_addr,u8 direct_addr_type,u8 phy,u8 sec_phy,s8 rssi,u8 * data,u8 len,bool ext_adv,bool ctl_time,u64 instant)6002 static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
6003 			       u8 bdaddr_type, bdaddr_t *direct_addr,
6004 			       u8 direct_addr_type, u8 phy, u8 sec_phy, s8 rssi,
6005 			       u8 *data, u8 len, bool ext_adv, bool ctl_time,
6006 			       u64 instant)
6007 {
6008 	struct discovery_state *d = &hdev->discovery;
6009 	struct smp_irk *irk;
6010 	struct hci_conn *conn;
6011 	bool match, bdaddr_resolved;
6012 	u32 flags;
6013 	u8 *ptr;
6014 
6015 	switch (type) {
6016 	case LE_ADV_IND:
6017 	case LE_ADV_DIRECT_IND:
6018 	case LE_ADV_SCAN_IND:
6019 	case LE_ADV_NONCONN_IND:
6020 	case LE_ADV_SCAN_RSP:
6021 		break;
6022 	default:
6023 		bt_dev_err_ratelimited(hdev, "unknown advertising packet "
6024 				       "type: 0x%02x", type);
6025 		return;
6026 	}
6027 
6028 	if (len > max_adv_len(hdev)) {
6029 		bt_dev_err_ratelimited(hdev,
6030 				       "adv larger than maximum supported");
6031 		return;
6032 	}
6033 
6034 	/* Find the end of the data in case the report contains padded zero
6035 	 * bytes at the end causing an invalid length value.
6036 	 *
6037 	 * When data is NULL, len is 0 so there is no need for extra ptr
6038 	 * check as 'ptr < data + 0' is already false in such case.
6039 	 */
6040 	for (ptr = data; ptr < data + len && *ptr; ptr += *ptr + 1) {
6041 		if (ptr + 1 + *ptr > data + len)
6042 			break;
6043 	}
6044 
6045 	/* Adjust for actual length. This handles the case when remote
6046 	 * device is advertising with incorrect data length.
6047 	 */
6048 	len = ptr - data;
6049 
6050 	/* If the direct address is present, then this report is from
6051 	 * a LE Direct Advertising Report event. In that case it is
6052 	 * important to see if the address is matching the local
6053 	 * controller address.
6054 	 */
6055 	if (!hci_dev_test_flag(hdev, HCI_MESH) && direct_addr) {
6056 		direct_addr_type = ev_bdaddr_type(hdev, direct_addr_type,
6057 						  &bdaddr_resolved);
6058 
6059 		/* Only resolvable random addresses are valid for these
6060 		 * kind of reports and others can be ignored.
6061 		 */
6062 		if (!hci_bdaddr_is_rpa(direct_addr, direct_addr_type))
6063 			return;
6064 
6065 		/* If the controller is not using resolvable random
6066 		 * addresses, then this report can be ignored.
6067 		 */
6068 		if (!hci_dev_test_flag(hdev, HCI_PRIVACY))
6069 			return;
6070 
6071 		/* If the local IRK of the controller does not match
6072 		 * with the resolvable random address provided, then
6073 		 * this report can be ignored.
6074 		 */
6075 		if (!smp_irk_matches(hdev, hdev->irk, direct_addr))
6076 			return;
6077 	}
6078 
6079 	/* Check if we need to convert to identity address */
6080 	irk = hci_get_irk(hdev, bdaddr, bdaddr_type);
6081 	if (irk) {
6082 		bdaddr = &irk->bdaddr;
6083 		bdaddr_type = irk->addr_type;
6084 	}
6085 
6086 	bdaddr_type = ev_bdaddr_type(hdev, bdaddr_type, &bdaddr_resolved);
6087 
6088 	/* Check if we have been requested to connect to this device.
6089 	 *
6090 	 * direct_addr is set only for directed advertising reports (it is NULL
6091 	 * for advertising reports) and is already verified to be RPA above.
6092 	 */
6093 	conn = check_pending_le_conn(hdev, bdaddr, bdaddr_type, bdaddr_resolved,
6094 				     type, phy, sec_phy);
6095 	if (!ext_adv && conn && type == LE_ADV_IND &&
6096 	    len <= max_adv_len(hdev)) {
6097 		/* Store report for later inclusion by
6098 		 * mgmt_device_connected
6099 		 */
6100 		memcpy(conn->le_adv_data, data, len);
6101 		conn->le_adv_data_len = len;
6102 	}
6103 
6104 	if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND)
6105 		flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
6106 	else
6107 		flags = 0;
6108 
6109 	/* All scan results should be sent up for Mesh systems */
6110 	if (hci_dev_test_flag(hdev, HCI_MESH)) {
6111 		mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
6112 				  rssi, flags, data, len, NULL, 0, instant);
6113 		return;
6114 	}
6115 
6116 	/* Passive scanning shouldn't trigger any device found events,
6117 	 * except for devices marked as CONN_REPORT for which we do send
6118 	 * device found events, or advertisement monitoring requested.
6119 	 */
6120 	if (hdev->le_scan_type == LE_SCAN_PASSIVE) {
6121 		if (type == LE_ADV_DIRECT_IND)
6122 			return;
6123 
6124 		if (!hci_pend_le_action_lookup(&hdev->pend_le_reports,
6125 					       bdaddr, bdaddr_type) &&
6126 		    idr_is_empty(&hdev->adv_monitors_idr))
6127 			return;
6128 
6129 		mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
6130 				  rssi, flags, data, len, NULL, 0, 0);
6131 		return;
6132 	}
6133 
6134 	/* When receiving a scan response, then there is no way to
6135 	 * know if the remote device is connectable or not. However
6136 	 * since scan responses are merged with a previously seen
6137 	 * advertising report, the flags field from that report
6138 	 * will be used.
6139 	 *
6140 	 * In the unlikely case that a controller just sends a scan
6141 	 * response event that doesn't match the pending report, then
6142 	 * it is marked as a standalone SCAN_RSP.
6143 	 */
6144 	if (type == LE_ADV_SCAN_RSP)
6145 		flags = MGMT_DEV_FOUND_SCAN_RSP;
6146 
6147 	/* If there's nothing pending either store the data from this
6148 	 * event or send an immediate device found event if the data
6149 	 * should not be stored for later.
6150 	 */
6151 	if (!ext_adv &&	!has_pending_adv_report(hdev)) {
6152 		/* If the report will trigger a SCAN_REQ store it for
6153 		 * later merging.
6154 		 */
6155 		if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
6156 			store_pending_adv_report(hdev, bdaddr, bdaddr_type,
6157 						 rssi, flags, data, len);
6158 			return;
6159 		}
6160 
6161 		mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
6162 				  rssi, flags, data, len, NULL, 0, 0);
6163 		return;
6164 	}
6165 
6166 	/* Check if the pending report is for the same device as the new one */
6167 	match = (!bacmp(bdaddr, &d->last_adv_addr) &&
6168 		 bdaddr_type == d->last_adv_addr_type);
6169 
6170 	/* If the pending data doesn't match this report or this isn't a
6171 	 * scan response (e.g. we got a duplicate ADV_IND) then force
6172 	 * sending of the pending data.
6173 	 */
6174 	if (type != LE_ADV_SCAN_RSP || !match) {
6175 		/* Send out whatever is in the cache, but skip duplicates */
6176 		if (!match)
6177 			mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
6178 					  d->last_adv_addr_type, NULL,
6179 					  d->last_adv_rssi, d->last_adv_flags,
6180 					  d->last_adv_data,
6181 					  d->last_adv_data_len, NULL, 0, 0);
6182 
6183 		/* If the new report will trigger a SCAN_REQ store it for
6184 		 * later merging.
6185 		 */
6186 		if (!ext_adv && (type == LE_ADV_IND ||
6187 				 type == LE_ADV_SCAN_IND)) {
6188 			store_pending_adv_report(hdev, bdaddr, bdaddr_type,
6189 						 rssi, flags, data, len);
6190 			return;
6191 		}
6192 
6193 		/* The advertising reports cannot be merged, so clear
6194 		 * the pending report and send out a device found event.
6195 		 */
6196 		clear_pending_adv_report(hdev);
6197 		mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
6198 				  rssi, flags, data, len, NULL, 0, 0);
6199 		return;
6200 	}
6201 
6202 	/* If we get here we've got a pending ADV_IND or ADV_SCAN_IND and
6203 	 * the new event is a SCAN_RSP. We can therefore proceed with
6204 	 * sending a merged device found event.
6205 	 */
6206 	mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
6207 			  d->last_adv_addr_type, NULL, rssi, d->last_adv_flags,
6208 			  d->last_adv_data, d->last_adv_data_len, data, len, 0);
6209 	clear_pending_adv_report(hdev);
6210 }
6211 
hci_le_adv_report_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)6212 static void hci_le_adv_report_evt(struct hci_dev *hdev, void *data,
6213 				  struct sk_buff *skb)
6214 {
6215 	struct hci_ev_le_advertising_report *ev = data;
6216 	u64 instant = jiffies;
6217 
6218 	if (!ev->num)
6219 		return;
6220 
6221 	hci_dev_lock(hdev);
6222 
6223 	while (ev->num--) {
6224 		struct hci_ev_le_advertising_info *info;
6225 		s8 rssi;
6226 
6227 		info = hci_le_ev_skb_pull(hdev, skb,
6228 					  HCI_EV_LE_ADVERTISING_REPORT,
6229 					  sizeof(*info));
6230 		if (!info)
6231 			break;
6232 
6233 		if (!hci_le_ev_skb_pull(hdev, skb, HCI_EV_LE_ADVERTISING_REPORT,
6234 					info->length + 1))
6235 			break;
6236 
6237 		if (info->length <= max_adv_len(hdev)) {
6238 			rssi = info->data[info->length];
6239 			process_adv_report(hdev, info->type, &info->bdaddr,
6240 					   info->bdaddr_type, NULL, 0,
6241 					   HCI_ADV_PHY_1M, 0, rssi,
6242 					   info->data, info->length, false,
6243 					   false, instant);
6244 		} else {
6245 			bt_dev_err(hdev, "Dropping invalid advertising data");
6246 		}
6247 	}
6248 
6249 	hci_dev_unlock(hdev);
6250 }
6251 
ext_evt_type_to_legacy(struct hci_dev * hdev,u16 evt_type)6252 static u8 ext_evt_type_to_legacy(struct hci_dev *hdev, u16 evt_type)
6253 {
6254 	if (evt_type & LE_EXT_ADV_LEGACY_PDU) {
6255 		switch (evt_type) {
6256 		case LE_LEGACY_ADV_IND:
6257 			return LE_ADV_IND;
6258 		case LE_LEGACY_ADV_DIRECT_IND:
6259 			return LE_ADV_DIRECT_IND;
6260 		case LE_LEGACY_ADV_SCAN_IND:
6261 			return LE_ADV_SCAN_IND;
6262 		case LE_LEGACY_NONCONN_IND:
6263 			return LE_ADV_NONCONN_IND;
6264 		case LE_LEGACY_SCAN_RSP_ADV:
6265 		case LE_LEGACY_SCAN_RSP_ADV_SCAN:
6266 			return LE_ADV_SCAN_RSP;
6267 		}
6268 
6269 		goto invalid;
6270 	}
6271 
6272 	if (evt_type & LE_EXT_ADV_CONN_IND) {
6273 		if (evt_type & LE_EXT_ADV_DIRECT_IND)
6274 			return LE_ADV_DIRECT_IND;
6275 
6276 		return LE_ADV_IND;
6277 	}
6278 
6279 	if (evt_type & LE_EXT_ADV_SCAN_RSP)
6280 		return LE_ADV_SCAN_RSP;
6281 
6282 	if (evt_type & LE_EXT_ADV_SCAN_IND)
6283 		return LE_ADV_SCAN_IND;
6284 
6285 	if (evt_type == LE_EXT_ADV_NON_CONN_IND ||
6286 	    evt_type & LE_EXT_ADV_DIRECT_IND)
6287 		return LE_ADV_NONCONN_IND;
6288 
6289 invalid:
6290 	bt_dev_err_ratelimited(hdev, "Unknown advertising packet type: 0x%02x",
6291 			       evt_type);
6292 
6293 	return LE_ADV_INVALID;
6294 }
6295 
hci_le_ext_adv_report_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)6296 static void hci_le_ext_adv_report_evt(struct hci_dev *hdev, void *data,
6297 				      struct sk_buff *skb)
6298 {
6299 	struct hci_ev_le_ext_adv_report *ev = data;
6300 	u64 instant = jiffies;
6301 
6302 	if (!ev->num)
6303 		return;
6304 
6305 	hci_dev_lock(hdev);
6306 
6307 	while (ev->num--) {
6308 		struct hci_ev_le_ext_adv_info *info;
6309 		u8 legacy_evt_type;
6310 		u16 evt_type;
6311 
6312 		info = hci_le_ev_skb_pull(hdev, skb, HCI_EV_LE_EXT_ADV_REPORT,
6313 					  sizeof(*info));
6314 		if (!info)
6315 			break;
6316 
6317 		if (!hci_le_ev_skb_pull(hdev, skb, HCI_EV_LE_EXT_ADV_REPORT,
6318 					info->length))
6319 			break;
6320 
6321 		evt_type = __le16_to_cpu(info->type) & LE_EXT_ADV_EVT_TYPE_MASK;
6322 		legacy_evt_type = ext_evt_type_to_legacy(hdev, evt_type);
6323 
6324 		if (test_bit(HCI_QUIRK_FIXUP_LE_EXT_ADV_REPORT_PHY,
6325 			     &hdev->quirks)) {
6326 			info->primary_phy &= 0x1f;
6327 			info->secondary_phy &= 0x1f;
6328 		}
6329 
6330 		if (legacy_evt_type != LE_ADV_INVALID) {
6331 			process_adv_report(hdev, legacy_evt_type, &info->bdaddr,
6332 					   info->bdaddr_type, NULL, 0,
6333 					   info->primary_phy,
6334 					   info->secondary_phy,
6335 					   info->rssi, info->data, info->length,
6336 					   !(evt_type & LE_EXT_ADV_LEGACY_PDU),
6337 					   false, instant);
6338 		}
6339 	}
6340 
6341 	hci_dev_unlock(hdev);
6342 }
6343 
hci_le_pa_term_sync(struct hci_dev * hdev,__le16 handle)6344 static int hci_le_pa_term_sync(struct hci_dev *hdev, __le16 handle)
6345 {
6346 	struct hci_cp_le_pa_term_sync cp;
6347 
6348 	memset(&cp, 0, sizeof(cp));
6349 	cp.handle = handle;
6350 
6351 	return hci_send_cmd(hdev, HCI_OP_LE_PA_TERM_SYNC, sizeof(cp), &cp);
6352 }
6353 
hci_le_pa_sync_estabilished_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)6354 static void hci_le_pa_sync_estabilished_evt(struct hci_dev *hdev, void *data,
6355 					    struct sk_buff *skb)
6356 {
6357 	struct hci_ev_le_pa_sync_established *ev = data;
6358 	int mask = hdev->link_mode;
6359 	__u8 flags = 0;
6360 	struct hci_conn *pa_sync, *conn;
6361 
6362 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
6363 
6364 	hci_dev_lock(hdev);
6365 
6366 	hci_dev_clear_flag(hdev, HCI_PA_SYNC);
6367 
6368 	conn = hci_conn_hash_lookup_sid(hdev, ev->sid, &ev->bdaddr,
6369 					ev->bdaddr_type);
6370 	if (!conn) {
6371 		bt_dev_err(hdev,
6372 			   "Unable to find connection for dst %pMR sid 0x%2.2x",
6373 			   &ev->bdaddr, ev->sid);
6374 		goto unlock;
6375 	}
6376 
6377 	clear_bit(HCI_CONN_CREATE_PA_SYNC, &conn->flags);
6378 
6379 	conn->sync_handle = le16_to_cpu(ev->handle);
6380 	conn->sid = HCI_SID_INVALID;
6381 
6382 	mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ISO_LINK, &flags);
6383 	if (!(mask & HCI_LM_ACCEPT)) {
6384 		hci_le_pa_term_sync(hdev, ev->handle);
6385 		goto unlock;
6386 	}
6387 
6388 	if (!(flags & HCI_PROTO_DEFER))
6389 		goto unlock;
6390 
6391 	/* Add connection to indicate PA sync event */
6392 	pa_sync = hci_conn_add_unset(hdev, ISO_LINK, BDADDR_ANY,
6393 				     HCI_ROLE_SLAVE);
6394 
6395 	if (IS_ERR(pa_sync))
6396 		goto unlock;
6397 
6398 	pa_sync->sync_handle = le16_to_cpu(ev->handle);
6399 
6400 	if (ev->status) {
6401 		set_bit(HCI_CONN_PA_SYNC_FAILED, &pa_sync->flags);
6402 
6403 		/* Notify iso layer */
6404 		hci_connect_cfm(pa_sync, ev->status);
6405 	}
6406 
6407 unlock:
6408 	/* Handle any other pending PA sync command */
6409 	hci_pa_create_sync_pending(hdev);
6410 
6411 	hci_dev_unlock(hdev);
6412 }
6413 
hci_le_per_adv_report_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)6414 static void hci_le_per_adv_report_evt(struct hci_dev *hdev, void *data,
6415 				      struct sk_buff *skb)
6416 {
6417 	struct hci_ev_le_per_adv_report *ev = data;
6418 	int mask = hdev->link_mode;
6419 	__u8 flags = 0;
6420 	struct hci_conn *pa_sync;
6421 
6422 	bt_dev_dbg(hdev, "sync_handle 0x%4.4x", le16_to_cpu(ev->sync_handle));
6423 
6424 	hci_dev_lock(hdev);
6425 
6426 	mask |= hci_proto_connect_ind(hdev, BDADDR_ANY, ISO_LINK, &flags);
6427 	if (!(mask & HCI_LM_ACCEPT))
6428 		goto unlock;
6429 
6430 	if (!(flags & HCI_PROTO_DEFER))
6431 		goto unlock;
6432 
6433 	pa_sync = hci_conn_hash_lookup_pa_sync_handle
6434 			(hdev,
6435 			le16_to_cpu(ev->sync_handle));
6436 
6437 	if (!pa_sync)
6438 		goto unlock;
6439 
6440 	if (ev->data_status == LE_PA_DATA_COMPLETE &&
6441 	    !test_and_set_bit(HCI_CONN_PA_SYNC, &pa_sync->flags)) {
6442 		/* Notify iso layer */
6443 		hci_connect_cfm(pa_sync, 0);
6444 
6445 		/* Notify MGMT layer */
6446 		mgmt_device_connected(hdev, pa_sync, NULL, 0);
6447 	}
6448 
6449 unlock:
6450 	hci_dev_unlock(hdev);
6451 }
6452 
hci_le_remote_feat_complete_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)6453 static void hci_le_remote_feat_complete_evt(struct hci_dev *hdev, void *data,
6454 					    struct sk_buff *skb)
6455 {
6456 	struct hci_ev_le_remote_feat_complete *ev = data;
6457 	struct hci_conn *conn;
6458 
6459 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
6460 
6461 	hci_dev_lock(hdev);
6462 
6463 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
6464 	if (conn) {
6465 		if (!ev->status)
6466 			memcpy(conn->features[0], ev->features, 8);
6467 
6468 		if (conn->state == BT_CONFIG) {
6469 			__u8 status;
6470 
6471 			/* If the local controller supports peripheral-initiated
6472 			 * features exchange, but the remote controller does
6473 			 * not, then it is possible that the error code 0x1a
6474 			 * for unsupported remote feature gets returned.
6475 			 *
6476 			 * In this specific case, allow the connection to
6477 			 * transition into connected state and mark it as
6478 			 * successful.
6479 			 */
6480 			if (!conn->out && ev->status == HCI_ERROR_UNSUPPORTED_REMOTE_FEATURE &&
6481 			    (hdev->le_features[0] & HCI_LE_PERIPHERAL_FEATURES))
6482 				status = 0x00;
6483 			else
6484 				status = ev->status;
6485 
6486 			conn->state = BT_CONNECTED;
6487 			hci_connect_cfm(conn, status);
6488 			hci_conn_drop(conn);
6489 		}
6490 	}
6491 
6492 	hci_dev_unlock(hdev);
6493 }
6494 
hci_le_ltk_request_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)6495 static void hci_le_ltk_request_evt(struct hci_dev *hdev, void *data,
6496 				   struct sk_buff *skb)
6497 {
6498 	struct hci_ev_le_ltk_req *ev = data;
6499 	struct hci_cp_le_ltk_reply cp;
6500 	struct hci_cp_le_ltk_neg_reply neg;
6501 	struct hci_conn *conn;
6502 	struct smp_ltk *ltk;
6503 
6504 	bt_dev_dbg(hdev, "handle 0x%4.4x", __le16_to_cpu(ev->handle));
6505 
6506 	hci_dev_lock(hdev);
6507 
6508 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
6509 	if (conn == NULL)
6510 		goto not_found;
6511 
6512 	ltk = hci_find_ltk(hdev, &conn->dst, conn->dst_type, conn->role);
6513 	if (!ltk)
6514 		goto not_found;
6515 
6516 	if (smp_ltk_is_sc(ltk)) {
6517 		/* With SC both EDiv and Rand are set to zero */
6518 		if (ev->ediv || ev->rand)
6519 			goto not_found;
6520 	} else {
6521 		/* For non-SC keys check that EDiv and Rand match */
6522 		if (ev->ediv != ltk->ediv || ev->rand != ltk->rand)
6523 			goto not_found;
6524 	}
6525 
6526 	memcpy(cp.ltk, ltk->val, ltk->enc_size);
6527 	memset(cp.ltk + ltk->enc_size, 0, sizeof(cp.ltk) - ltk->enc_size);
6528 	cp.handle = cpu_to_le16(conn->handle);
6529 
6530 	conn->pending_sec_level = smp_ltk_sec_level(ltk);
6531 
6532 	conn->enc_key_size = ltk->enc_size;
6533 
6534 	hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
6535 
6536 	/* Ref. Bluetooth Core SPEC pages 1975 and 2004. STK is a
6537 	 * temporary key used to encrypt a connection following
6538 	 * pairing. It is used during the Encrypted Session Setup to
6539 	 * distribute the keys. Later, security can be re-established
6540 	 * using a distributed LTK.
6541 	 */
6542 	if (ltk->type == SMP_STK) {
6543 		set_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
6544 		list_del_rcu(&ltk->list);
6545 		kfree_rcu(ltk, rcu);
6546 	} else {
6547 		clear_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
6548 	}
6549 
6550 	hci_dev_unlock(hdev);
6551 
6552 	return;
6553 
6554 not_found:
6555 	neg.handle = ev->handle;
6556 	hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
6557 	hci_dev_unlock(hdev);
6558 }
6559 
send_conn_param_neg_reply(struct hci_dev * hdev,u16 handle,u8 reason)6560 static void send_conn_param_neg_reply(struct hci_dev *hdev, u16 handle,
6561 				      u8 reason)
6562 {
6563 	struct hci_cp_le_conn_param_req_neg_reply cp;
6564 
6565 	cp.handle = cpu_to_le16(handle);
6566 	cp.reason = reason;
6567 
6568 	hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_NEG_REPLY, sizeof(cp),
6569 		     &cp);
6570 }
6571 
hci_le_remote_conn_param_req_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)6572 static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev, void *data,
6573 					     struct sk_buff *skb)
6574 {
6575 	struct hci_ev_le_remote_conn_param_req *ev = data;
6576 	struct hci_cp_le_conn_param_req_reply cp;
6577 	struct hci_conn *hcon;
6578 	u16 handle, min, max, latency, timeout;
6579 
6580 	bt_dev_dbg(hdev, "handle 0x%4.4x", __le16_to_cpu(ev->handle));
6581 
6582 	handle = le16_to_cpu(ev->handle);
6583 	min = le16_to_cpu(ev->interval_min);
6584 	max = le16_to_cpu(ev->interval_max);
6585 	latency = le16_to_cpu(ev->latency);
6586 	timeout = le16_to_cpu(ev->timeout);
6587 
6588 	hcon = hci_conn_hash_lookup_handle(hdev, handle);
6589 	if (!hcon || hcon->state != BT_CONNECTED)
6590 		return send_conn_param_neg_reply(hdev, handle,
6591 						 HCI_ERROR_UNKNOWN_CONN_ID);
6592 
6593 	if (max > hcon->le_conn_max_interval)
6594 		return send_conn_param_neg_reply(hdev, handle,
6595 						 HCI_ERROR_INVALID_LL_PARAMS);
6596 
6597 	if (hci_check_conn_params(min, max, latency, timeout))
6598 		return send_conn_param_neg_reply(hdev, handle,
6599 						 HCI_ERROR_INVALID_LL_PARAMS);
6600 
6601 	if (hcon->role == HCI_ROLE_MASTER) {
6602 		struct hci_conn_params *params;
6603 		u8 store_hint;
6604 
6605 		hci_dev_lock(hdev);
6606 
6607 		params = hci_conn_params_lookup(hdev, &hcon->dst,
6608 						hcon->dst_type);
6609 		if (params) {
6610 			params->conn_min_interval = min;
6611 			params->conn_max_interval = max;
6612 			params->conn_latency = latency;
6613 			params->supervision_timeout = timeout;
6614 			store_hint = 0x01;
6615 		} else {
6616 			store_hint = 0x00;
6617 		}
6618 
6619 		hci_dev_unlock(hdev);
6620 
6621 		mgmt_new_conn_param(hdev, &hcon->dst, hcon->dst_type,
6622 				    store_hint, min, max, latency, timeout);
6623 	}
6624 
6625 	cp.handle = ev->handle;
6626 	cp.interval_min = ev->interval_min;
6627 	cp.interval_max = ev->interval_max;
6628 	cp.latency = ev->latency;
6629 	cp.timeout = ev->timeout;
6630 	cp.min_ce_len = 0;
6631 	cp.max_ce_len = 0;
6632 
6633 	hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_REPLY, sizeof(cp), &cp);
6634 }
6635 
hci_le_direct_adv_report_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)6636 static void hci_le_direct_adv_report_evt(struct hci_dev *hdev, void *data,
6637 					 struct sk_buff *skb)
6638 {
6639 	struct hci_ev_le_direct_adv_report *ev = data;
6640 	u64 instant = jiffies;
6641 	int i;
6642 
6643 	if (!hci_le_ev_skb_pull(hdev, skb, HCI_EV_LE_DIRECT_ADV_REPORT,
6644 				flex_array_size(ev, info, ev->num)))
6645 		return;
6646 
6647 	if (!ev->num)
6648 		return;
6649 
6650 	hci_dev_lock(hdev);
6651 
6652 	for (i = 0; i < ev->num; i++) {
6653 		struct hci_ev_le_direct_adv_info *info = &ev->info[i];
6654 
6655 		process_adv_report(hdev, info->type, &info->bdaddr,
6656 				   info->bdaddr_type, &info->direct_addr,
6657 				   info->direct_addr_type, HCI_ADV_PHY_1M, 0,
6658 				   info->rssi, NULL, 0, false, false, instant);
6659 	}
6660 
6661 	hci_dev_unlock(hdev);
6662 }
6663 
hci_le_phy_update_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)6664 static void hci_le_phy_update_evt(struct hci_dev *hdev, void *data,
6665 				  struct sk_buff *skb)
6666 {
6667 	struct hci_ev_le_phy_update_complete *ev = data;
6668 	struct hci_conn *conn;
6669 
6670 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
6671 
6672 	if (ev->status)
6673 		return;
6674 
6675 	hci_dev_lock(hdev);
6676 
6677 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
6678 	if (!conn)
6679 		goto unlock;
6680 
6681 	conn->le_tx_phy = ev->tx_phy;
6682 	conn->le_rx_phy = ev->rx_phy;
6683 
6684 unlock:
6685 	hci_dev_unlock(hdev);
6686 }
6687 
hci_le_cis_estabilished_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)6688 static void hci_le_cis_estabilished_evt(struct hci_dev *hdev, void *data,
6689 					struct sk_buff *skb)
6690 {
6691 	struct hci_evt_le_cis_established *ev = data;
6692 	struct hci_conn *conn;
6693 	struct bt_iso_qos *qos;
6694 	bool pending = false;
6695 	u16 handle = __le16_to_cpu(ev->handle);
6696 	u32 c_sdu_interval, p_sdu_interval;
6697 
6698 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
6699 
6700 	hci_dev_lock(hdev);
6701 
6702 	conn = hci_conn_hash_lookup_handle(hdev, handle);
6703 	if (!conn) {
6704 		bt_dev_err(hdev,
6705 			   "Unable to find connection with handle 0x%4.4x",
6706 			   handle);
6707 		goto unlock;
6708 	}
6709 
6710 	if (conn->type != ISO_LINK) {
6711 		bt_dev_err(hdev,
6712 			   "Invalid connection link type handle 0x%4.4x",
6713 			   handle);
6714 		goto unlock;
6715 	}
6716 
6717 	qos = &conn->iso_qos;
6718 
6719 	pending = test_and_clear_bit(HCI_CONN_CREATE_CIS, &conn->flags);
6720 
6721 	/* BLUETOOTH CORE SPECIFICATION Version 5.4 | Vol 6, Part G
6722 	 * page 3075:
6723 	 * Transport_Latency_C_To_P = CIG_Sync_Delay + (FT_C_To_P) ×
6724 	 * ISO_Interval + SDU_Interval_C_To_P
6725 	 * ...
6726 	 * SDU_Interval = (CIG_Sync_Delay + (FT) x ISO_Interval) -
6727 	 *					Transport_Latency
6728 	 */
6729 	c_sdu_interval = (get_unaligned_le24(ev->cig_sync_delay) +
6730 			 (ev->c_ft * le16_to_cpu(ev->interval) * 1250)) -
6731 			get_unaligned_le24(ev->c_latency);
6732 	p_sdu_interval = (get_unaligned_le24(ev->cig_sync_delay) +
6733 			 (ev->p_ft * le16_to_cpu(ev->interval) * 1250)) -
6734 			get_unaligned_le24(ev->p_latency);
6735 
6736 	switch (conn->role) {
6737 	case HCI_ROLE_SLAVE:
6738 		qos->ucast.in.interval = c_sdu_interval;
6739 		qos->ucast.out.interval = p_sdu_interval;
6740 		/* Convert Transport Latency (us) to Latency (msec) */
6741 		qos->ucast.in.latency =
6742 			DIV_ROUND_CLOSEST(get_unaligned_le24(ev->c_latency),
6743 					  1000);
6744 		qos->ucast.out.latency =
6745 			DIV_ROUND_CLOSEST(get_unaligned_le24(ev->p_latency),
6746 					  1000);
6747 		qos->ucast.in.sdu = le16_to_cpu(ev->c_mtu);
6748 		qos->ucast.out.sdu = le16_to_cpu(ev->p_mtu);
6749 		qos->ucast.in.phy = ev->c_phy;
6750 		qos->ucast.out.phy = ev->p_phy;
6751 		break;
6752 	case HCI_ROLE_MASTER:
6753 		qos->ucast.in.interval = p_sdu_interval;
6754 		qos->ucast.out.interval = c_sdu_interval;
6755 		/* Convert Transport Latency (us) to Latency (msec) */
6756 		qos->ucast.out.latency =
6757 			DIV_ROUND_CLOSEST(get_unaligned_le24(ev->c_latency),
6758 					  1000);
6759 		qos->ucast.in.latency =
6760 			DIV_ROUND_CLOSEST(get_unaligned_le24(ev->p_latency),
6761 					  1000);
6762 		qos->ucast.out.sdu = le16_to_cpu(ev->c_mtu);
6763 		qos->ucast.in.sdu = le16_to_cpu(ev->p_mtu);
6764 		qos->ucast.out.phy = ev->c_phy;
6765 		qos->ucast.in.phy = ev->p_phy;
6766 		break;
6767 	}
6768 
6769 	if (!ev->status) {
6770 		conn->state = BT_CONNECTED;
6771 		hci_debugfs_create_conn(conn);
6772 		hci_conn_add_sysfs(conn);
6773 		hci_iso_setup_path(conn);
6774 		goto unlock;
6775 	}
6776 
6777 	conn->state = BT_CLOSED;
6778 	hci_connect_cfm(conn, ev->status);
6779 	hci_conn_del(conn);
6780 
6781 unlock:
6782 	if (pending)
6783 		hci_le_create_cis_pending(hdev);
6784 
6785 	hci_dev_unlock(hdev);
6786 }
6787 
hci_le_reject_cis(struct hci_dev * hdev,__le16 handle)6788 static void hci_le_reject_cis(struct hci_dev *hdev, __le16 handle)
6789 {
6790 	struct hci_cp_le_reject_cis cp;
6791 
6792 	memset(&cp, 0, sizeof(cp));
6793 	cp.handle = handle;
6794 	cp.reason = HCI_ERROR_REJ_BAD_ADDR;
6795 	hci_send_cmd(hdev, HCI_OP_LE_REJECT_CIS, sizeof(cp), &cp);
6796 }
6797 
hci_le_accept_cis(struct hci_dev * hdev,__le16 handle)6798 static void hci_le_accept_cis(struct hci_dev *hdev, __le16 handle)
6799 {
6800 	struct hci_cp_le_accept_cis cp;
6801 
6802 	memset(&cp, 0, sizeof(cp));
6803 	cp.handle = handle;
6804 	hci_send_cmd(hdev, HCI_OP_LE_ACCEPT_CIS, sizeof(cp), &cp);
6805 }
6806 
hci_le_cis_req_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)6807 static void hci_le_cis_req_evt(struct hci_dev *hdev, void *data,
6808 			       struct sk_buff *skb)
6809 {
6810 	struct hci_evt_le_cis_req *ev = data;
6811 	u16 acl_handle, cis_handle;
6812 	struct hci_conn *acl, *cis;
6813 	int mask;
6814 	__u8 flags = 0;
6815 
6816 	acl_handle = __le16_to_cpu(ev->acl_handle);
6817 	cis_handle = __le16_to_cpu(ev->cis_handle);
6818 
6819 	bt_dev_dbg(hdev, "acl 0x%4.4x handle 0x%4.4x cig 0x%2.2x cis 0x%2.2x",
6820 		   acl_handle, cis_handle, ev->cig_id, ev->cis_id);
6821 
6822 	hci_dev_lock(hdev);
6823 
6824 	acl = hci_conn_hash_lookup_handle(hdev, acl_handle);
6825 	if (!acl)
6826 		goto unlock;
6827 
6828 	mask = hci_proto_connect_ind(hdev, &acl->dst, ISO_LINK, &flags);
6829 	if (!(mask & HCI_LM_ACCEPT)) {
6830 		hci_le_reject_cis(hdev, ev->cis_handle);
6831 		goto unlock;
6832 	}
6833 
6834 	cis = hci_conn_hash_lookup_handle(hdev, cis_handle);
6835 	if (!cis) {
6836 		cis = hci_conn_add(hdev, ISO_LINK, &acl->dst, HCI_ROLE_SLAVE,
6837 				   cis_handle);
6838 		if (IS_ERR(cis)) {
6839 			hci_le_reject_cis(hdev, ev->cis_handle);
6840 			goto unlock;
6841 		}
6842 	}
6843 
6844 	cis->iso_qos.ucast.cig = ev->cig_id;
6845 	cis->iso_qos.ucast.cis = ev->cis_id;
6846 
6847 	if (!(flags & HCI_PROTO_DEFER)) {
6848 		hci_le_accept_cis(hdev, ev->cis_handle);
6849 	} else {
6850 		cis->state = BT_CONNECT2;
6851 		hci_connect_cfm(cis, 0);
6852 	}
6853 
6854 unlock:
6855 	hci_dev_unlock(hdev);
6856 }
6857 
hci_iso_term_big_sync(struct hci_dev * hdev,void * data)6858 static int hci_iso_term_big_sync(struct hci_dev *hdev, void *data)
6859 {
6860 	u8 handle = PTR_UINT(data);
6861 
6862 	return hci_le_terminate_big_sync(hdev, handle,
6863 					 HCI_ERROR_LOCAL_HOST_TERM);
6864 }
6865 
hci_le_create_big_complete_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)6866 static void hci_le_create_big_complete_evt(struct hci_dev *hdev, void *data,
6867 					   struct sk_buff *skb)
6868 {
6869 	struct hci_evt_le_create_big_complete *ev = data;
6870 	struct hci_conn *conn;
6871 	__u8 i = 0;
6872 
6873 	BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
6874 
6875 	if (!hci_le_ev_skb_pull(hdev, skb, HCI_EVT_LE_CREATE_BIG_COMPLETE,
6876 				flex_array_size(ev, bis_handle, ev->num_bis)))
6877 		return;
6878 
6879 	hci_dev_lock(hdev);
6880 
6881 	/* Connect all BISes that are bound to the BIG */
6882 	while ((conn = hci_conn_hash_lookup_big_state(hdev, ev->handle,
6883 						      BT_BOUND))) {
6884 		if (ev->status) {
6885 			hci_connect_cfm(conn, ev->status);
6886 			hci_conn_del(conn);
6887 			continue;
6888 		}
6889 
6890 		if (hci_conn_set_handle(conn,
6891 					__le16_to_cpu(ev->bis_handle[i++])))
6892 			continue;
6893 
6894 		conn->state = BT_CONNECTED;
6895 		set_bit(HCI_CONN_BIG_CREATED, &conn->flags);
6896 		hci_debugfs_create_conn(conn);
6897 		hci_conn_add_sysfs(conn);
6898 		hci_iso_setup_path(conn);
6899 	}
6900 
6901 	if (!ev->status && !i)
6902 		/* If no BISes have been connected for the BIG,
6903 		 * terminate. This is in case all bound connections
6904 		 * have been closed before the BIG creation
6905 		 * has completed.
6906 		 */
6907 		hci_cmd_sync_queue(hdev, hci_iso_term_big_sync,
6908 				   UINT_PTR(ev->handle), NULL);
6909 
6910 	hci_dev_unlock(hdev);
6911 }
6912 
hci_le_big_sync_established_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)6913 static void hci_le_big_sync_established_evt(struct hci_dev *hdev, void *data,
6914 					    struct sk_buff *skb)
6915 {
6916 	struct hci_evt_le_big_sync_estabilished *ev = data;
6917 	struct hci_conn *bis, *conn;
6918 	int i;
6919 
6920 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
6921 
6922 	if (!hci_le_ev_skb_pull(hdev, skb, HCI_EVT_LE_BIG_SYNC_ESTABILISHED,
6923 				flex_array_size(ev, bis, ev->num_bis)))
6924 		return;
6925 
6926 	hci_dev_lock(hdev);
6927 
6928 	conn = hci_conn_hash_lookup_big_sync_pend(hdev, ev->handle,
6929 						  ev->num_bis);
6930 	if (!conn) {
6931 		bt_dev_err(hdev,
6932 			   "Unable to find connection for big 0x%2.2x",
6933 			   ev->handle);
6934 		goto unlock;
6935 	}
6936 
6937 	clear_bit(HCI_CONN_CREATE_BIG_SYNC, &conn->flags);
6938 
6939 	conn->num_bis = 0;
6940 	memset(conn->bis, 0, sizeof(conn->num_bis));
6941 
6942 	for (i = 0; i < ev->num_bis; i++) {
6943 		u16 handle = le16_to_cpu(ev->bis[i]);
6944 		__le32 interval;
6945 
6946 		bis = hci_conn_hash_lookup_handle(hdev, handle);
6947 		if (!bis) {
6948 			if (handle > HCI_CONN_HANDLE_MAX) {
6949 				bt_dev_dbg(hdev, "ignore too large handle %u", handle);
6950 				continue;
6951 			}
6952 			bis = hci_conn_add(hdev, ISO_LINK, BDADDR_ANY,
6953 					   HCI_ROLE_SLAVE, handle);
6954 			if (IS_ERR(bis))
6955 				continue;
6956 		}
6957 
6958 		if (ev->status != 0x42)
6959 			/* Mark PA sync as established */
6960 			set_bit(HCI_CONN_PA_SYNC, &bis->flags);
6961 
6962 		bis->sync_handle = conn->sync_handle;
6963 		bis->iso_qos.bcast.big = ev->handle;
6964 		memset(&interval, 0, sizeof(interval));
6965 		memcpy(&interval, ev->latency, sizeof(ev->latency));
6966 		bis->iso_qos.bcast.in.interval = le32_to_cpu(interval);
6967 		/* Convert ISO Interval (1.25 ms slots) to latency (ms) */
6968 		bis->iso_qos.bcast.in.latency = le16_to_cpu(ev->interval) * 125 / 100;
6969 		bis->iso_qos.bcast.in.sdu = le16_to_cpu(ev->max_pdu);
6970 
6971 		if (!ev->status) {
6972 			set_bit(HCI_CONN_BIG_SYNC, &bis->flags);
6973 			hci_iso_setup_path(bis);
6974 		}
6975 	}
6976 
6977 	/* In case BIG sync failed, notify each failed connection to
6978 	 * the user after all hci connections have been added
6979 	 */
6980 	if (ev->status)
6981 		for (i = 0; i < ev->num_bis; i++) {
6982 			u16 handle = le16_to_cpu(ev->bis[i]);
6983 
6984 			bis = hci_conn_hash_lookup_handle(hdev, handle);
6985 			if (!bis)
6986 				continue;
6987 
6988 			set_bit(HCI_CONN_BIG_SYNC_FAILED, &bis->flags);
6989 			hci_connect_cfm(bis, ev->status);
6990 		}
6991 
6992 unlock:
6993 	/* Handle any other pending BIG sync command */
6994 	hci_le_big_create_sync_pending(hdev);
6995 
6996 	hci_dev_unlock(hdev);
6997 }
6998 
hci_le_big_info_adv_report_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)6999 static void hci_le_big_info_adv_report_evt(struct hci_dev *hdev, void *data,
7000 					   struct sk_buff *skb)
7001 {
7002 	struct hci_evt_le_big_info_adv_report *ev = data;
7003 	int mask = hdev->link_mode;
7004 	__u8 flags = 0;
7005 	struct hci_conn *pa_sync;
7006 
7007 	bt_dev_dbg(hdev, "sync_handle 0x%4.4x", le16_to_cpu(ev->sync_handle));
7008 
7009 	hci_dev_lock(hdev);
7010 
7011 	mask |= hci_proto_connect_ind(hdev, BDADDR_ANY, ISO_LINK, &flags);
7012 	if (!(mask & HCI_LM_ACCEPT))
7013 		goto unlock;
7014 
7015 	if (!(flags & HCI_PROTO_DEFER))
7016 		goto unlock;
7017 
7018 	pa_sync = hci_conn_hash_lookup_pa_sync_handle
7019 			(hdev,
7020 			le16_to_cpu(ev->sync_handle));
7021 
7022 	if (!pa_sync)
7023 		goto unlock;
7024 
7025 	pa_sync->iso_qos.bcast.encryption = ev->encryption;
7026 
7027 	/* Notify iso layer */
7028 	hci_connect_cfm(pa_sync, 0);
7029 
7030 unlock:
7031 	hci_dev_unlock(hdev);
7032 }
7033 
7034 #define HCI_LE_EV_VL(_op, _func, _min_len, _max_len) \
7035 [_op] = { \
7036 	.func = _func, \
7037 	.min_len = _min_len, \
7038 	.max_len = _max_len, \
7039 }
7040 
7041 #define HCI_LE_EV(_op, _func, _len) \
7042 	HCI_LE_EV_VL(_op, _func, _len, _len)
7043 
7044 #define HCI_LE_EV_STATUS(_op, _func) \
7045 	HCI_LE_EV(_op, _func, sizeof(struct hci_ev_status))
7046 
7047 /* Entries in this table shall have their position according to the subevent
7048  * opcode they handle so the use of the macros above is recommend since it does
7049  * attempt to initialize at its proper index using Designated Initializers that
7050  * way events without a callback function can be ommited.
7051  */
7052 static const struct hci_le_ev {
7053 	void (*func)(struct hci_dev *hdev, void *data, struct sk_buff *skb);
7054 	u16  min_len;
7055 	u16  max_len;
7056 } hci_le_ev_table[U8_MAX + 1] = {
7057 	/* [0x01 = HCI_EV_LE_CONN_COMPLETE] */
7058 	HCI_LE_EV(HCI_EV_LE_CONN_COMPLETE, hci_le_conn_complete_evt,
7059 		  sizeof(struct hci_ev_le_conn_complete)),
7060 	/* [0x02 = HCI_EV_LE_ADVERTISING_REPORT] */
7061 	HCI_LE_EV_VL(HCI_EV_LE_ADVERTISING_REPORT, hci_le_adv_report_evt,
7062 		     sizeof(struct hci_ev_le_advertising_report),
7063 		     HCI_MAX_EVENT_SIZE),
7064 	/* [0x03 = HCI_EV_LE_CONN_UPDATE_COMPLETE] */
7065 	HCI_LE_EV(HCI_EV_LE_CONN_UPDATE_COMPLETE,
7066 		  hci_le_conn_update_complete_evt,
7067 		  sizeof(struct hci_ev_le_conn_update_complete)),
7068 	/* [0x04 = HCI_EV_LE_REMOTE_FEAT_COMPLETE] */
7069 	HCI_LE_EV(HCI_EV_LE_REMOTE_FEAT_COMPLETE,
7070 		  hci_le_remote_feat_complete_evt,
7071 		  sizeof(struct hci_ev_le_remote_feat_complete)),
7072 	/* [0x05 = HCI_EV_LE_LTK_REQ] */
7073 	HCI_LE_EV(HCI_EV_LE_LTK_REQ, hci_le_ltk_request_evt,
7074 		  sizeof(struct hci_ev_le_ltk_req)),
7075 	/* [0x06 = HCI_EV_LE_REMOTE_CONN_PARAM_REQ] */
7076 	HCI_LE_EV(HCI_EV_LE_REMOTE_CONN_PARAM_REQ,
7077 		  hci_le_remote_conn_param_req_evt,
7078 		  sizeof(struct hci_ev_le_remote_conn_param_req)),
7079 	/* [0x0a = HCI_EV_LE_ENHANCED_CONN_COMPLETE] */
7080 	HCI_LE_EV(HCI_EV_LE_ENHANCED_CONN_COMPLETE,
7081 		  hci_le_enh_conn_complete_evt,
7082 		  sizeof(struct hci_ev_le_enh_conn_complete)),
7083 	/* [0x0b = HCI_EV_LE_DIRECT_ADV_REPORT] */
7084 	HCI_LE_EV_VL(HCI_EV_LE_DIRECT_ADV_REPORT, hci_le_direct_adv_report_evt,
7085 		     sizeof(struct hci_ev_le_direct_adv_report),
7086 		     HCI_MAX_EVENT_SIZE),
7087 	/* [0x0c = HCI_EV_LE_PHY_UPDATE_COMPLETE] */
7088 	HCI_LE_EV(HCI_EV_LE_PHY_UPDATE_COMPLETE, hci_le_phy_update_evt,
7089 		  sizeof(struct hci_ev_le_phy_update_complete)),
7090 	/* [0x0d = HCI_EV_LE_EXT_ADV_REPORT] */
7091 	HCI_LE_EV_VL(HCI_EV_LE_EXT_ADV_REPORT, hci_le_ext_adv_report_evt,
7092 		     sizeof(struct hci_ev_le_ext_adv_report),
7093 		     HCI_MAX_EVENT_SIZE),
7094 	/* [0x0e = HCI_EV_LE_PA_SYNC_ESTABLISHED] */
7095 	HCI_LE_EV(HCI_EV_LE_PA_SYNC_ESTABLISHED,
7096 		  hci_le_pa_sync_estabilished_evt,
7097 		  sizeof(struct hci_ev_le_pa_sync_established)),
7098 	/* [0x0f = HCI_EV_LE_PER_ADV_REPORT] */
7099 	HCI_LE_EV_VL(HCI_EV_LE_PER_ADV_REPORT,
7100 				 hci_le_per_adv_report_evt,
7101 				 sizeof(struct hci_ev_le_per_adv_report),
7102 				 HCI_MAX_EVENT_SIZE),
7103 	/* [0x12 = HCI_EV_LE_EXT_ADV_SET_TERM] */
7104 	HCI_LE_EV(HCI_EV_LE_EXT_ADV_SET_TERM, hci_le_ext_adv_term_evt,
7105 		  sizeof(struct hci_evt_le_ext_adv_set_term)),
7106 	/* [0x19 = HCI_EVT_LE_CIS_ESTABLISHED] */
7107 	HCI_LE_EV(HCI_EVT_LE_CIS_ESTABLISHED, hci_le_cis_estabilished_evt,
7108 		  sizeof(struct hci_evt_le_cis_established)),
7109 	/* [0x1a = HCI_EVT_LE_CIS_REQ] */
7110 	HCI_LE_EV(HCI_EVT_LE_CIS_REQ, hci_le_cis_req_evt,
7111 		  sizeof(struct hci_evt_le_cis_req)),
7112 	/* [0x1b = HCI_EVT_LE_CREATE_BIG_COMPLETE] */
7113 	HCI_LE_EV_VL(HCI_EVT_LE_CREATE_BIG_COMPLETE,
7114 		     hci_le_create_big_complete_evt,
7115 		     sizeof(struct hci_evt_le_create_big_complete),
7116 		     HCI_MAX_EVENT_SIZE),
7117 	/* [0x1d = HCI_EV_LE_BIG_SYNC_ESTABILISHED] */
7118 	HCI_LE_EV_VL(HCI_EVT_LE_BIG_SYNC_ESTABILISHED,
7119 		     hci_le_big_sync_established_evt,
7120 		     sizeof(struct hci_evt_le_big_sync_estabilished),
7121 		     HCI_MAX_EVENT_SIZE),
7122 	/* [0x22 = HCI_EVT_LE_BIG_INFO_ADV_REPORT] */
7123 	HCI_LE_EV_VL(HCI_EVT_LE_BIG_INFO_ADV_REPORT,
7124 		     hci_le_big_info_adv_report_evt,
7125 		     sizeof(struct hci_evt_le_big_info_adv_report),
7126 		     HCI_MAX_EVENT_SIZE),
7127 };
7128 
hci_le_meta_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb,u16 * opcode,u8 * status,hci_req_complete_t * req_complete,hci_req_complete_skb_t * req_complete_skb)7129 static void hci_le_meta_evt(struct hci_dev *hdev, void *data,
7130 			    struct sk_buff *skb, u16 *opcode, u8 *status,
7131 			    hci_req_complete_t *req_complete,
7132 			    hci_req_complete_skb_t *req_complete_skb)
7133 {
7134 	struct hci_ev_le_meta *ev = data;
7135 	const struct hci_le_ev *subev;
7136 
7137 	bt_dev_dbg(hdev, "subevent 0x%2.2x", ev->subevent);
7138 
7139 	/* Only match event if command OGF is for LE */
7140 	if (hdev->req_skb &&
7141 	    hci_opcode_ogf(hci_skb_opcode(hdev->req_skb)) == 0x08 &&
7142 	    hci_skb_event(hdev->req_skb) == ev->subevent) {
7143 		*opcode = hci_skb_opcode(hdev->req_skb);
7144 		hci_req_cmd_complete(hdev, *opcode, 0x00, req_complete,
7145 				     req_complete_skb);
7146 	}
7147 
7148 	subev = &hci_le_ev_table[ev->subevent];
7149 	if (!subev->func)
7150 		return;
7151 
7152 	if (skb->len < subev->min_len) {
7153 		bt_dev_err(hdev, "unexpected subevent 0x%2.2x length: %u < %u",
7154 			   ev->subevent, skb->len, subev->min_len);
7155 		return;
7156 	}
7157 
7158 	/* Just warn if the length is over max_len size it still be
7159 	 * possible to partially parse the event so leave to callback to
7160 	 * decide if that is acceptable.
7161 	 */
7162 	if (skb->len > subev->max_len)
7163 		bt_dev_warn(hdev, "unexpected subevent 0x%2.2x length: %u > %u",
7164 			    ev->subevent, skb->len, subev->max_len);
7165 	data = hci_le_ev_skb_pull(hdev, skb, ev->subevent, subev->min_len);
7166 	if (!data)
7167 		return;
7168 
7169 	subev->func(hdev, data, skb);
7170 }
7171 
hci_get_cmd_complete(struct hci_dev * hdev,u16 opcode,u8 event,struct sk_buff * skb)7172 static bool hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode,
7173 				 u8 event, struct sk_buff *skb)
7174 {
7175 	struct hci_ev_cmd_complete *ev;
7176 	struct hci_event_hdr *hdr;
7177 
7178 	if (!skb)
7179 		return false;
7180 
7181 	hdr = hci_ev_skb_pull(hdev, skb, event, sizeof(*hdr));
7182 	if (!hdr)
7183 		return false;
7184 
7185 	if (event) {
7186 		if (hdr->evt != event)
7187 			return false;
7188 		return true;
7189 	}
7190 
7191 	/* Check if request ended in Command Status - no way to retrieve
7192 	 * any extra parameters in this case.
7193 	 */
7194 	if (hdr->evt == HCI_EV_CMD_STATUS)
7195 		return false;
7196 
7197 	if (hdr->evt != HCI_EV_CMD_COMPLETE) {
7198 		bt_dev_err(hdev, "last event is not cmd complete (0x%2.2x)",
7199 			   hdr->evt);
7200 		return false;
7201 	}
7202 
7203 	ev = hci_cc_skb_pull(hdev, skb, opcode, sizeof(*ev));
7204 	if (!ev)
7205 		return false;
7206 
7207 	if (opcode != __le16_to_cpu(ev->opcode)) {
7208 		BT_DBG("opcode doesn't match (0x%2.2x != 0x%2.2x)", opcode,
7209 		       __le16_to_cpu(ev->opcode));
7210 		return false;
7211 	}
7212 
7213 	return true;
7214 }
7215 
hci_store_wake_reason(struct hci_dev * hdev,u8 event,struct sk_buff * skb)7216 static void hci_store_wake_reason(struct hci_dev *hdev, u8 event,
7217 				  struct sk_buff *skb)
7218 {
7219 	struct hci_ev_le_advertising_info *adv;
7220 	struct hci_ev_le_direct_adv_info *direct_adv;
7221 	struct hci_ev_le_ext_adv_info *ext_adv;
7222 	const struct hci_ev_conn_complete *conn_complete = (void *)skb->data;
7223 	const struct hci_ev_conn_request *conn_request = (void *)skb->data;
7224 
7225 	hci_dev_lock(hdev);
7226 
7227 	/* If we are currently suspended and this is the first BT event seen,
7228 	 * save the wake reason associated with the event.
7229 	 */
7230 	if (!hdev->suspended || hdev->wake_reason)
7231 		goto unlock;
7232 
7233 	/* Default to remote wake. Values for wake_reason are documented in the
7234 	 * Bluez mgmt api docs.
7235 	 */
7236 	hdev->wake_reason = MGMT_WAKE_REASON_REMOTE_WAKE;
7237 
7238 	/* Once configured for remote wakeup, we should only wake up for
7239 	 * reconnections. It's useful to see which device is waking us up so
7240 	 * keep track of the bdaddr of the connection event that woke us up.
7241 	 */
7242 	if (event == HCI_EV_CONN_REQUEST) {
7243 		bacpy(&hdev->wake_addr, &conn_request->bdaddr);
7244 		hdev->wake_addr_type = BDADDR_BREDR;
7245 	} else if (event == HCI_EV_CONN_COMPLETE) {
7246 		bacpy(&hdev->wake_addr, &conn_complete->bdaddr);
7247 		hdev->wake_addr_type = BDADDR_BREDR;
7248 	} else if (event == HCI_EV_LE_META) {
7249 		struct hci_ev_le_meta *le_ev = (void *)skb->data;
7250 		u8 subevent = le_ev->subevent;
7251 		u8 *ptr = &skb->data[sizeof(*le_ev)];
7252 		u8 num_reports = *ptr;
7253 
7254 		if ((subevent == HCI_EV_LE_ADVERTISING_REPORT ||
7255 		     subevent == HCI_EV_LE_DIRECT_ADV_REPORT ||
7256 		     subevent == HCI_EV_LE_EXT_ADV_REPORT) &&
7257 		    num_reports) {
7258 			adv = (void *)(ptr + 1);
7259 			direct_adv = (void *)(ptr + 1);
7260 			ext_adv = (void *)(ptr + 1);
7261 
7262 			switch (subevent) {
7263 			case HCI_EV_LE_ADVERTISING_REPORT:
7264 				bacpy(&hdev->wake_addr, &adv->bdaddr);
7265 				hdev->wake_addr_type = adv->bdaddr_type;
7266 				break;
7267 			case HCI_EV_LE_DIRECT_ADV_REPORT:
7268 				bacpy(&hdev->wake_addr, &direct_adv->bdaddr);
7269 				hdev->wake_addr_type = direct_adv->bdaddr_type;
7270 				break;
7271 			case HCI_EV_LE_EXT_ADV_REPORT:
7272 				bacpy(&hdev->wake_addr, &ext_adv->bdaddr);
7273 				hdev->wake_addr_type = ext_adv->bdaddr_type;
7274 				break;
7275 			}
7276 		}
7277 	} else {
7278 		hdev->wake_reason = MGMT_WAKE_REASON_UNEXPECTED;
7279 	}
7280 
7281 unlock:
7282 	hci_dev_unlock(hdev);
7283 }
7284 
7285 #define HCI_EV_VL(_op, _func, _min_len, _max_len) \
7286 [_op] = { \
7287 	.req = false, \
7288 	.func = _func, \
7289 	.min_len = _min_len, \
7290 	.max_len = _max_len, \
7291 }
7292 
7293 #define HCI_EV(_op, _func, _len) \
7294 	HCI_EV_VL(_op, _func, _len, _len)
7295 
7296 #define HCI_EV_STATUS(_op, _func) \
7297 	HCI_EV(_op, _func, sizeof(struct hci_ev_status))
7298 
7299 #define HCI_EV_REQ_VL(_op, _func, _min_len, _max_len) \
7300 [_op] = { \
7301 	.req = true, \
7302 	.func_req = _func, \
7303 	.min_len = _min_len, \
7304 	.max_len = _max_len, \
7305 }
7306 
7307 #define HCI_EV_REQ(_op, _func, _len) \
7308 	HCI_EV_REQ_VL(_op, _func, _len, _len)
7309 
7310 /* Entries in this table shall have their position according to the event opcode
7311  * they handle so the use of the macros above is recommend since it does attempt
7312  * to initialize at its proper index using Designated Initializers that way
7313  * events without a callback function don't have entered.
7314  */
7315 static const struct hci_ev {
7316 	bool req;
7317 	union {
7318 		void (*func)(struct hci_dev *hdev, void *data,
7319 			     struct sk_buff *skb);
7320 		void (*func_req)(struct hci_dev *hdev, void *data,
7321 				 struct sk_buff *skb, u16 *opcode, u8 *status,
7322 				 hci_req_complete_t *req_complete,
7323 				 hci_req_complete_skb_t *req_complete_skb);
7324 	};
7325 	u16  min_len;
7326 	u16  max_len;
7327 } hci_ev_table[U8_MAX + 1] = {
7328 	/* [0x01 = HCI_EV_INQUIRY_COMPLETE] */
7329 	HCI_EV_STATUS(HCI_EV_INQUIRY_COMPLETE, hci_inquiry_complete_evt),
7330 	/* [0x02 = HCI_EV_INQUIRY_RESULT] */
7331 	HCI_EV_VL(HCI_EV_INQUIRY_RESULT, hci_inquiry_result_evt,
7332 		  sizeof(struct hci_ev_inquiry_result), HCI_MAX_EVENT_SIZE),
7333 	/* [0x03 = HCI_EV_CONN_COMPLETE] */
7334 	HCI_EV(HCI_EV_CONN_COMPLETE, hci_conn_complete_evt,
7335 	       sizeof(struct hci_ev_conn_complete)),
7336 	/* [0x04 = HCI_EV_CONN_REQUEST] */
7337 	HCI_EV(HCI_EV_CONN_REQUEST, hci_conn_request_evt,
7338 	       sizeof(struct hci_ev_conn_request)),
7339 	/* [0x05 = HCI_EV_DISCONN_COMPLETE] */
7340 	HCI_EV(HCI_EV_DISCONN_COMPLETE, hci_disconn_complete_evt,
7341 	       sizeof(struct hci_ev_disconn_complete)),
7342 	/* [0x06 = HCI_EV_AUTH_COMPLETE] */
7343 	HCI_EV(HCI_EV_AUTH_COMPLETE, hci_auth_complete_evt,
7344 	       sizeof(struct hci_ev_auth_complete)),
7345 	/* [0x07 = HCI_EV_REMOTE_NAME] */
7346 	HCI_EV(HCI_EV_REMOTE_NAME, hci_remote_name_evt,
7347 	       sizeof(struct hci_ev_remote_name)),
7348 	/* [0x08 = HCI_EV_ENCRYPT_CHANGE] */
7349 	HCI_EV(HCI_EV_ENCRYPT_CHANGE, hci_encrypt_change_evt,
7350 	       sizeof(struct hci_ev_encrypt_change)),
7351 	/* [0x09 = HCI_EV_CHANGE_LINK_KEY_COMPLETE] */
7352 	HCI_EV(HCI_EV_CHANGE_LINK_KEY_COMPLETE,
7353 	       hci_change_link_key_complete_evt,
7354 	       sizeof(struct hci_ev_change_link_key_complete)),
7355 	/* [0x0b = HCI_EV_REMOTE_FEATURES] */
7356 	HCI_EV(HCI_EV_REMOTE_FEATURES, hci_remote_features_evt,
7357 	       sizeof(struct hci_ev_remote_features)),
7358 	/* [0x0e = HCI_EV_CMD_COMPLETE] */
7359 	HCI_EV_REQ_VL(HCI_EV_CMD_COMPLETE, hci_cmd_complete_evt,
7360 		      sizeof(struct hci_ev_cmd_complete), HCI_MAX_EVENT_SIZE),
7361 	/* [0x0f = HCI_EV_CMD_STATUS] */
7362 	HCI_EV_REQ(HCI_EV_CMD_STATUS, hci_cmd_status_evt,
7363 		   sizeof(struct hci_ev_cmd_status)),
7364 	/* [0x10 = HCI_EV_CMD_STATUS] */
7365 	HCI_EV(HCI_EV_HARDWARE_ERROR, hci_hardware_error_evt,
7366 	       sizeof(struct hci_ev_hardware_error)),
7367 	/* [0x12 = HCI_EV_ROLE_CHANGE] */
7368 	HCI_EV(HCI_EV_ROLE_CHANGE, hci_role_change_evt,
7369 	       sizeof(struct hci_ev_role_change)),
7370 	/* [0x13 = HCI_EV_NUM_COMP_PKTS] */
7371 	HCI_EV_VL(HCI_EV_NUM_COMP_PKTS, hci_num_comp_pkts_evt,
7372 		  sizeof(struct hci_ev_num_comp_pkts), HCI_MAX_EVENT_SIZE),
7373 	/* [0x14 = HCI_EV_MODE_CHANGE] */
7374 	HCI_EV(HCI_EV_MODE_CHANGE, hci_mode_change_evt,
7375 	       sizeof(struct hci_ev_mode_change)),
7376 	/* [0x16 = HCI_EV_PIN_CODE_REQ] */
7377 	HCI_EV(HCI_EV_PIN_CODE_REQ, hci_pin_code_request_evt,
7378 	       sizeof(struct hci_ev_pin_code_req)),
7379 	/* [0x17 = HCI_EV_LINK_KEY_REQ] */
7380 	HCI_EV(HCI_EV_LINK_KEY_REQ, hci_link_key_request_evt,
7381 	       sizeof(struct hci_ev_link_key_req)),
7382 	/* [0x18 = HCI_EV_LINK_KEY_NOTIFY] */
7383 	HCI_EV(HCI_EV_LINK_KEY_NOTIFY, hci_link_key_notify_evt,
7384 	       sizeof(struct hci_ev_link_key_notify)),
7385 	/* [0x1c = HCI_EV_CLOCK_OFFSET] */
7386 	HCI_EV(HCI_EV_CLOCK_OFFSET, hci_clock_offset_evt,
7387 	       sizeof(struct hci_ev_clock_offset)),
7388 	/* [0x1d = HCI_EV_PKT_TYPE_CHANGE] */
7389 	HCI_EV(HCI_EV_PKT_TYPE_CHANGE, hci_pkt_type_change_evt,
7390 	       sizeof(struct hci_ev_pkt_type_change)),
7391 	/* [0x20 = HCI_EV_PSCAN_REP_MODE] */
7392 	HCI_EV(HCI_EV_PSCAN_REP_MODE, hci_pscan_rep_mode_evt,
7393 	       sizeof(struct hci_ev_pscan_rep_mode)),
7394 	/* [0x22 = HCI_EV_INQUIRY_RESULT_WITH_RSSI] */
7395 	HCI_EV_VL(HCI_EV_INQUIRY_RESULT_WITH_RSSI,
7396 		  hci_inquiry_result_with_rssi_evt,
7397 		  sizeof(struct hci_ev_inquiry_result_rssi),
7398 		  HCI_MAX_EVENT_SIZE),
7399 	/* [0x23 = HCI_EV_REMOTE_EXT_FEATURES] */
7400 	HCI_EV(HCI_EV_REMOTE_EXT_FEATURES, hci_remote_ext_features_evt,
7401 	       sizeof(struct hci_ev_remote_ext_features)),
7402 	/* [0x2c = HCI_EV_SYNC_CONN_COMPLETE] */
7403 	HCI_EV(HCI_EV_SYNC_CONN_COMPLETE, hci_sync_conn_complete_evt,
7404 	       sizeof(struct hci_ev_sync_conn_complete)),
7405 	/* [0x2d = HCI_EV_EXTENDED_INQUIRY_RESULT] */
7406 	HCI_EV_VL(HCI_EV_EXTENDED_INQUIRY_RESULT,
7407 		  hci_extended_inquiry_result_evt,
7408 		  sizeof(struct hci_ev_ext_inquiry_result), HCI_MAX_EVENT_SIZE),
7409 	/* [0x30 = HCI_EV_KEY_REFRESH_COMPLETE] */
7410 	HCI_EV(HCI_EV_KEY_REFRESH_COMPLETE, hci_key_refresh_complete_evt,
7411 	       sizeof(struct hci_ev_key_refresh_complete)),
7412 	/* [0x31 = HCI_EV_IO_CAPA_REQUEST] */
7413 	HCI_EV(HCI_EV_IO_CAPA_REQUEST, hci_io_capa_request_evt,
7414 	       sizeof(struct hci_ev_io_capa_request)),
7415 	/* [0x32 = HCI_EV_IO_CAPA_REPLY] */
7416 	HCI_EV(HCI_EV_IO_CAPA_REPLY, hci_io_capa_reply_evt,
7417 	       sizeof(struct hci_ev_io_capa_reply)),
7418 	/* [0x33 = HCI_EV_USER_CONFIRM_REQUEST] */
7419 	HCI_EV(HCI_EV_USER_CONFIRM_REQUEST, hci_user_confirm_request_evt,
7420 	       sizeof(struct hci_ev_user_confirm_req)),
7421 	/* [0x34 = HCI_EV_USER_PASSKEY_REQUEST] */
7422 	HCI_EV(HCI_EV_USER_PASSKEY_REQUEST, hci_user_passkey_request_evt,
7423 	       sizeof(struct hci_ev_user_passkey_req)),
7424 	/* [0x35 = HCI_EV_REMOTE_OOB_DATA_REQUEST] */
7425 	HCI_EV(HCI_EV_REMOTE_OOB_DATA_REQUEST, hci_remote_oob_data_request_evt,
7426 	       sizeof(struct hci_ev_remote_oob_data_request)),
7427 	/* [0x36 = HCI_EV_SIMPLE_PAIR_COMPLETE] */
7428 	HCI_EV(HCI_EV_SIMPLE_PAIR_COMPLETE, hci_simple_pair_complete_evt,
7429 	       sizeof(struct hci_ev_simple_pair_complete)),
7430 	/* [0x3b = HCI_EV_USER_PASSKEY_NOTIFY] */
7431 	HCI_EV(HCI_EV_USER_PASSKEY_NOTIFY, hci_user_passkey_notify_evt,
7432 	       sizeof(struct hci_ev_user_passkey_notify)),
7433 	/* [0x3c = HCI_EV_KEYPRESS_NOTIFY] */
7434 	HCI_EV(HCI_EV_KEYPRESS_NOTIFY, hci_keypress_notify_evt,
7435 	       sizeof(struct hci_ev_keypress_notify)),
7436 	/* [0x3d = HCI_EV_REMOTE_HOST_FEATURES] */
7437 	HCI_EV(HCI_EV_REMOTE_HOST_FEATURES, hci_remote_host_features_evt,
7438 	       sizeof(struct hci_ev_remote_host_features)),
7439 	/* [0x3e = HCI_EV_LE_META] */
7440 	HCI_EV_REQ_VL(HCI_EV_LE_META, hci_le_meta_evt,
7441 		      sizeof(struct hci_ev_le_meta), HCI_MAX_EVENT_SIZE),
7442 	/* [0xff = HCI_EV_VENDOR] */
7443 	HCI_EV_VL(HCI_EV_VENDOR, msft_vendor_evt, 0, HCI_MAX_EVENT_SIZE),
7444 };
7445 
hci_event_func(struct hci_dev * hdev,u8 event,struct sk_buff * skb,u16 * opcode,u8 * status,hci_req_complete_t * req_complete,hci_req_complete_skb_t * req_complete_skb)7446 static void hci_event_func(struct hci_dev *hdev, u8 event, struct sk_buff *skb,
7447 			   u16 *opcode, u8 *status,
7448 			   hci_req_complete_t *req_complete,
7449 			   hci_req_complete_skb_t *req_complete_skb)
7450 {
7451 	const struct hci_ev *ev = &hci_ev_table[event];
7452 	void *data;
7453 
7454 	if (!ev->func)
7455 		return;
7456 
7457 	if (skb->len < ev->min_len) {
7458 		bt_dev_err(hdev, "unexpected event 0x%2.2x length: %u < %u",
7459 			   event, skb->len, ev->min_len);
7460 		return;
7461 	}
7462 
7463 	/* Just warn if the length is over max_len size it still be
7464 	 * possible to partially parse the event so leave to callback to
7465 	 * decide if that is acceptable.
7466 	 */
7467 	if (skb->len > ev->max_len)
7468 		bt_dev_warn_ratelimited(hdev,
7469 					"unexpected event 0x%2.2x length: %u > %u",
7470 					event, skb->len, ev->max_len);
7471 
7472 	data = hci_ev_skb_pull(hdev, skb, event, ev->min_len);
7473 	if (!data)
7474 		return;
7475 
7476 	if (ev->req)
7477 		ev->func_req(hdev, data, skb, opcode, status, req_complete,
7478 			     req_complete_skb);
7479 	else
7480 		ev->func(hdev, data, skb);
7481 }
7482 
hci_event_packet(struct hci_dev * hdev,struct sk_buff * skb)7483 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
7484 {
7485 	struct hci_event_hdr *hdr = (void *) skb->data;
7486 	hci_req_complete_t req_complete = NULL;
7487 	hci_req_complete_skb_t req_complete_skb = NULL;
7488 	struct sk_buff *orig_skb = NULL;
7489 	u8 status = 0, event, req_evt = 0;
7490 	u16 opcode = HCI_OP_NOP;
7491 
7492 	if (skb->len < sizeof(*hdr)) {
7493 		bt_dev_err(hdev, "Malformed HCI Event");
7494 		goto done;
7495 	}
7496 
7497 	kfree_skb(hdev->recv_event);
7498 	hdev->recv_event = skb_clone(skb, GFP_KERNEL);
7499 
7500 	event = hdr->evt;
7501 	if (!event) {
7502 		bt_dev_warn(hdev, "Received unexpected HCI Event 0x%2.2x",
7503 			    event);
7504 		goto done;
7505 	}
7506 
7507 	/* Only match event if command OGF is not for LE */
7508 	if (hdev->req_skb &&
7509 	    hci_opcode_ogf(hci_skb_opcode(hdev->req_skb)) != 0x08 &&
7510 	    hci_skb_event(hdev->req_skb) == event) {
7511 		hci_req_cmd_complete(hdev, hci_skb_opcode(hdev->req_skb),
7512 				     status, &req_complete, &req_complete_skb);
7513 		req_evt = event;
7514 	}
7515 
7516 	/* If it looks like we might end up having to call
7517 	 * req_complete_skb, store a pristine copy of the skb since the
7518 	 * various handlers may modify the original one through
7519 	 * skb_pull() calls, etc.
7520 	 */
7521 	if (req_complete_skb || event == HCI_EV_CMD_STATUS ||
7522 	    event == HCI_EV_CMD_COMPLETE)
7523 		orig_skb = skb_clone(skb, GFP_KERNEL);
7524 
7525 	skb_pull(skb, HCI_EVENT_HDR_SIZE);
7526 
7527 	/* Store wake reason if we're suspended */
7528 	hci_store_wake_reason(hdev, event, skb);
7529 
7530 	bt_dev_dbg(hdev, "event 0x%2.2x", event);
7531 
7532 	hci_event_func(hdev, event, skb, &opcode, &status, &req_complete,
7533 		       &req_complete_skb);
7534 
7535 	if (req_complete) {
7536 		req_complete(hdev, status, opcode);
7537 	} else if (req_complete_skb) {
7538 		if (!hci_get_cmd_complete(hdev, opcode, req_evt, orig_skb)) {
7539 			kfree_skb(orig_skb);
7540 			orig_skb = NULL;
7541 		}
7542 		req_complete_skb(hdev, status, opcode, orig_skb);
7543 	}
7544 
7545 done:
7546 	kfree_skb(orig_skb);
7547 	kfree_skb(skb);
7548 	hdev->stat.evt_rx++;
7549 }
7550