net/bluetooth/hci_event.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI event handling. */
  26
  27 #include <asm/unaligned.h>
  28
  29 #include <net/bluetooth/bluetooth.h>
  30 #include <net/bluetooth/hci_core.h>
  31 #include <net/bluetooth/mgmt.h>
  32
  33 #include "hci_request.h"
  34 #include "hci_debugfs.h"
  35 #include "a2mp.h"
  36 #include "amp.h"
  37 #include "smp.h"
  38 #include "msft.h"
  39 #include "eir.h"
  40
  41 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
  42                  "\x00\x00\x00\x00\x00\x00\x00\x00"
  43
  44 #define secs_to_jiffies(_secs) msecs_to_jiffies((_secs) * 1000)
  45
  46 /* Handle HCI Event packets */
  47
  48 static void *hci_ev_skb_pull(struct hci_dev *hdev, struct sk_buff *skb,
  49                              u8 ev, size_t len)
  50 {
  51         void *data;
  52
  53         data = skb_pull_data(skb, len);
  54         if (!data)
  55                 bt_dev_err(hdev, "Malformed Event: 0x%2.2x", ev);
  56
  57         return data;
  58 }
  59
  60 static void *hci_cc_skb_pull(struct hci_dev *hdev, struct sk_buff *skb,
  61                              u16 op, size_t len)
  62 {
  63         void *data;
  64
  65         data = skb_pull_data(skb, len);
  66         if (!data)
  67                 bt_dev_err(hdev, "Malformed Command Complete: 0x%4.4x", op);
  68
  69         return data;
  70 }
  71
  72 static void *hci_le_ev_skb_pull(struct hci_dev *hdev, struct sk_buff *skb,
  73                                 u8 ev, size_t len)
  74 {
  75         void *data;
  76
  77         data = skb_pull_data(skb, len);
  78         if (!data)
  79                 bt_dev_err(hdev, "Malformed LE Event: 0x%2.2x", ev);
  80
  81         return data;
  82 }
  83
  84 static u8 hci_cc_inquiry_cancel(struct hci_dev *hdev, void *data,
  85                                 struct sk_buff *skb)
  86 {
  87         struct hci_ev_status *rp = data;
  88
  89         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
  90
  91         /* It is possible that we receive Inquiry Complete event right
  92          * before we receive Inquiry Cancel Command Complete event, in
  93          * which case the latter event should have status of Command
  94          * Disallowed (0x0c). This should not be treated as error, since
  95          * we actually achieve what Inquiry Cancel wants to achieve,
  96          * which is to end the last Inquiry session.
  97          */
  98         if (rp->status == 0x0c && !test_bit(HCI_INQUIRY, &hdev->flags)) {
  99                 bt_dev_warn(hdev, "Ignoring error of Inquiry Cancel command");
 100                 rp->status = 0x00;
 101         }
 102
 103         if (rp->status)
 104                 return rp->status;
 105
 106         clear_bit(HCI_INQUIRY, &hdev->flags);
 107         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
 108         wake_up_bit(&hdev->flags, HCI_INQUIRY);
 109
 110         hci_dev_lock(hdev);
 111         /* Set discovery state to stopped if we're not doing LE active
 112          * scanning.
 113          */
 114         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
 115             hdev->le_scan_type != LE_SCAN_ACTIVE)
 116                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
 117         hci_dev_unlock(hdev);
 118
 119         hci_conn_check_pending(hdev);
 120
 121         return rp->status;
 122 }
 123
 124 static u8 hci_cc_periodic_inq(struct hci_dev *hdev, void *data,
 125                               struct sk_buff *skb)
 126 {
 127         struct hci_ev_status *rp = data;
 128
 129         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 130
 131         if (rp->status)
 132                 return rp->status;
 133
 134         hci_dev_set_flag(hdev, HCI_PERIODIC_INQ);
 135
 136         return rp->status;
 137 }
 138
 139 static u8 hci_cc_exit_periodic_inq(struct hci_dev *hdev, void *data,
 140                                    struct sk_buff *skb)
 141 {
 142         struct hci_ev_status *rp = data;
 143
 144         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 145
 146         if (rp->status)
 147                 return rp->status;
 148
 149         hci_dev_clear_flag(hdev, HCI_PERIODIC_INQ);
 150
 151         hci_conn_check_pending(hdev);
 152
 153         return rp->status;
 154 }
 155
 156 static u8 hci_cc_remote_name_req_cancel(struct hci_dev *hdev, void *data,
 157                                         struct sk_buff *skb)
 158 {
 159         struct hci_ev_status *rp = data;
 160
 161         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 162
 163         return rp->status;
 164 }
 165
 166 static u8 hci_cc_role_discovery(struct hci_dev *hdev, void *data,
 167                                 struct sk_buff *skb)
 168 {
 169         struct hci_rp_role_discovery *rp = data;
 170         struct hci_conn *conn;
 171
 172         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 173
 174         if (rp->status)
 175                 return rp->status;
 176
 177         hci_dev_lock(hdev);
 178
 179         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 180         if (conn)
 181                 conn->role = rp->role;
 182
 183         hci_dev_unlock(hdev);
 184
 185         return rp->status;
 186 }
 187
 188 static u8 hci_cc_read_link_policy(struct hci_dev *hdev, void *data,
 189                                   struct sk_buff *skb)
 190 {
 191         struct hci_rp_read_link_policy *rp = data;
 192         struct hci_conn *conn;
 193
 194         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 195
 196         if (rp->status)
 197                 return rp->status;
 198
 199         hci_dev_lock(hdev);
 200
 201         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 202         if (conn)
 203                 conn->link_policy = __le16_to_cpu(rp->policy);
 204
 205         hci_dev_unlock(hdev);
 206
 207         return rp->status;
 208 }
 209
 210 static u8 hci_cc_write_link_policy(struct hci_dev *hdev, void *data,
 211                                    struct sk_buff *skb)
 212 {
 213         struct hci_rp_write_link_policy *rp = data;
 214         struct hci_conn *conn;
 215         void *sent;
 216
 217         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 218
 219         if (rp->status)
 220                 return rp->status;
 221
 222         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
 223         if (!sent)
 224                 return rp->status;
 225
 226         hci_dev_lock(hdev);
 227
 228         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 229         if (conn)
 230                 conn->link_policy = get_unaligned_le16(sent + 2);
 231
 232         hci_dev_unlock(hdev);
 233
 234         return rp->status;
 235 }
 236
 237 static u8 hci_cc_read_def_link_policy(struct hci_dev *hdev, void *data,
 238                                       struct sk_buff *skb)
 239 {
 240         struct hci_rp_read_def_link_policy *rp = data;
 241
 242         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 243
 244         if (rp->status)
 245                 return rp->status;
 246
 247         hdev->link_policy = __le16_to_cpu(rp->policy);
 248
 249         return rp->status;
 250 }
 251
 252 static u8 hci_cc_write_def_link_policy(struct hci_dev *hdev, void *data,
 253                                        struct sk_buff *skb)
 254 {
 255         struct hci_ev_status *rp = data;
 256         void *sent;
 257
 258         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 259
 260         if (rp->status)
 261                 return rp->status;
 262
 263         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
 264         if (!sent)
 265                 return rp->status;
 266
 267         hdev->link_policy = get_unaligned_le16(sent);
 268
 269         return rp->status;
 270 }
 271
 272 static u8 hci_cc_reset(struct hci_dev *hdev, void *data, struct sk_buff *skb)
 273 {
 274         struct hci_ev_status *rp = data;
 275
 276         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 277
 278         clear_bit(HCI_RESET, &hdev->flags);
 279
 280         if (rp->status)
 281                 return rp->status;
 282
 283         /* Reset all non-persistent flags */
 284         hci_dev_clear_volatile_flags(hdev);
 285
 286         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
 287
 288         hdev->inq_tx_power = HCI_TX_POWER_INVALID;
 289         hdev->adv_tx_power = HCI_TX_POWER_INVALID;
 290
 291         memset(hdev->adv_data, 0, sizeof(hdev->adv_data));
 292         hdev->adv_data_len = 0;
 293
 294         memset(hdev->scan_rsp_data, 0, sizeof(hdev->scan_rsp_data));
 295         hdev->scan_rsp_data_len = 0;
 296
 297         hdev->le_scan_type = LE_SCAN_PASSIVE;
 298
 299         hdev->ssp_debug_mode = 0;
 300
 301         hci_bdaddr_list_clear(&hdev->le_accept_list);
 302         hci_bdaddr_list_clear(&hdev->le_resolv_list);
 303
 304         return rp->status;
 305 }
 306
 307 static u8 hci_cc_read_stored_link_key(struct hci_dev *hdev, void *data,
 308                                       struct sk_buff *skb)
 309 {
 310         struct hci_rp_read_stored_link_key *rp = data;
 311         struct hci_cp_read_stored_link_key *sent;
 312
 313         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 314
 315         sent = hci_sent_cmd_data(hdev, HCI_OP_READ_STORED_LINK_KEY);
 316         if (!sent)
 317                 return rp->status;
 318
 319         if (!rp->status && sent->read_all == 0x01) {
 320                 hdev->stored_max_keys = le16_to_cpu(rp->max_keys);
 321                 hdev->stored_num_keys = le16_to_cpu(rp->num_keys);
 322         }
 323
 324         return rp->status;
 325 }
 326
 327 static u8 hci_cc_delete_stored_link_key(struct hci_dev *hdev, void *data,
 328                                         struct sk_buff *skb)
 329 {
 330         struct hci_rp_delete_stored_link_key *rp = data;
 331
 332         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 333
 334         if (rp->status)
 335                 return rp->status;
 336
 337         if (rp->num_keys <= hdev->stored_num_keys)
 338                 hdev->stored_num_keys -= le16_to_cpu(rp->num_keys);
 339         else
 340                 hdev->stored_num_keys = 0;
 341
 342         return rp->status;
 343 }
 344
 345 static u8 hci_cc_write_local_name(struct hci_dev *hdev, void *data,
 346                                   struct sk_buff *skb)
 347 {
 348         struct hci_ev_status *rp = data;
 349         void *sent;
 350
 351         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 352
 353         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
 354         if (!sent)
 355                 return rp->status;
 356
 357         hci_dev_lock(hdev);
 358
 359         if (hci_dev_test_flag(hdev, HCI_MGMT))
 360                 mgmt_set_local_name_complete(hdev, sent, rp->status);
 361         else if (!rp->status)
 362                 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
 363
 364         hci_dev_unlock(hdev);
 365
 366         return rp->status;
 367 }
 368
 369 static u8 hci_cc_read_local_name(struct hci_dev *hdev, void *data,
 370                                  struct sk_buff *skb)
 371 {
 372         struct hci_rp_read_local_name *rp = data;
 373
 374         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 375
 376         if (rp->status)
 377                 return rp->status;
 378
 379         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 380             hci_dev_test_flag(hdev, HCI_CONFIG))
 381                 memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
 382
 383         return rp->status;
 384 }
 385
 386 static u8 hci_cc_write_auth_enable(struct hci_dev *hdev, void *data,
 387                                    struct sk_buff *skb)
 388 {
 389         struct hci_ev_status *rp = data;
 390         void *sent;
 391
 392         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 393
 394         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
 395         if (!sent)
 396                 return rp->status;
 397
 398         hci_dev_lock(hdev);
 399
 400         if (!rp->status) {
 401                 __u8 param = *((__u8 *) sent);
 402
 403                 if (param == AUTH_ENABLED)
 404                         set_bit(HCI_AUTH, &hdev->flags);
 405                 else
 406                         clear_bit(HCI_AUTH, &hdev->flags);
 407         }
 408
 409         if (hci_dev_test_flag(hdev, HCI_MGMT))
 410                 mgmt_auth_enable_complete(hdev, rp->status);
 411
 412         hci_dev_unlock(hdev);
 413
 414         return rp->status;
 415 }
 416
 417 static u8 hci_cc_write_encrypt_mode(struct hci_dev *hdev, void *data,
 418                                     struct sk_buff *skb)
 419 {
 420         struct hci_ev_status *rp = data;
 421         __u8 param;
 422         void *sent;
 423
 424         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 425
 426         if (rp->status)
 427                 return rp->status;
 428
 429         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
 430         if (!sent)
 431                 return rp->status;
 432
 433         param = *((__u8 *) sent);
 434
 435         if (param)
 436                 set_bit(HCI_ENCRYPT, &hdev->flags);
 437         else
 438                 clear_bit(HCI_ENCRYPT, &hdev->flags);
 439
 440         return rp->status;
 441 }
 442
 443 static u8 hci_cc_write_scan_enable(struct hci_dev *hdev, void *data,
 444                                    struct sk_buff *skb)
 445 {
 446         struct hci_ev_status *rp = data;
 447         __u8 param;
 448         void *sent;
 449
 450         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 451
 452         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
 453         if (!sent)
 454                 return rp->status;
 455
 456         param = *((__u8 *) sent);
 457
 458         hci_dev_lock(hdev);
 459
 460         if (rp->status) {
 461                 hdev->discov_timeout = 0;
 462                 goto done;
 463         }
 464
 465         if (param & SCAN_INQUIRY)
 466                 set_bit(HCI_ISCAN, &hdev->flags);
 467         else
 468                 clear_bit(HCI_ISCAN, &hdev->flags);
 469
 470         if (param & SCAN_PAGE)
 471                 set_bit(HCI_PSCAN, &hdev->flags);
 472         else
 473                 clear_bit(HCI_PSCAN, &hdev->flags);
 474
 475 done:
 476         hci_dev_unlock(hdev);
 477
 478         return rp->status;
 479 }
 480
 481 static u8 hci_cc_set_event_filter(struct hci_dev *hdev, void *data,
 482                                   struct sk_buff *skb)
 483 {
 484         struct hci_ev_status *rp = data;
 485         struct hci_cp_set_event_filter *cp;
 486         void *sent;
 487
 488         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 489
 490         if (rp->status)
 491                 return rp->status;
 492
 493         sent = hci_sent_cmd_data(hdev, HCI_OP_SET_EVENT_FLT);
 494         if (!sent)
 495                 return rp->status;
 496
 497         cp = (struct hci_cp_set_event_filter *)sent;
 498
 499         if (cp->flt_type == HCI_FLT_CLEAR_ALL)
 500                 hci_dev_clear_flag(hdev, HCI_EVENT_FILTER_CONFIGURED);
 501         else
 502                 hci_dev_set_flag(hdev, HCI_EVENT_FILTER_CONFIGURED);
 503
 504         return rp->status;
 505 }
 506
 507 static u8 hci_cc_read_class_of_dev(struct hci_dev *hdev, void *data,
 508                                    struct sk_buff *skb)
 509 {
 510         struct hci_rp_read_class_of_dev *rp = data;
 511
 512         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 513
 514         if (rp->status)
 515                 return rp->status;
 516
 517         memcpy(hdev->dev_class, rp->dev_class, 3);
 518
 519         bt_dev_dbg(hdev, "class 0x%.2x%.2x%.2x", hdev->dev_class[2],
 520                    hdev->dev_class[1], hdev->dev_class[0]);
 521
 522         return rp->status;
 523 }
 524
 525 static u8 hci_cc_write_class_of_dev(struct hci_dev *hdev, void *data,
 526                                     struct sk_buff *skb)
 527 {
 528         struct hci_ev_status *rp = data;
 529         void *sent;
 530
 531         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 532
 533         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
 534         if (!sent)
 535                 return rp->status;
 536
 537         hci_dev_lock(hdev);
 538
 539         if (!rp->status)
 540                 memcpy(hdev->dev_class, sent, 3);
 541
 542         if (hci_dev_test_flag(hdev, HCI_MGMT))
 543                 mgmt_set_class_of_dev_complete(hdev, sent, rp->status);
 544
 545         hci_dev_unlock(hdev);
 546
 547         return rp->status;
 548 }
 549
 550 static u8 hci_cc_read_voice_setting(struct hci_dev *hdev, void *data,
 551                                     struct sk_buff *skb)
 552 {
 553         struct hci_rp_read_voice_setting *rp = data;
 554         __u16 setting;
 555
 556         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 557
 558         if (rp->status)
 559                 return rp->status;
 560
 561         setting = __le16_to_cpu(rp->voice_setting);
 562
 563         if (hdev->voice_setting == setting)
 564                 return rp->status;
 565
 566         hdev->voice_setting = setting;
 567
 568         bt_dev_dbg(hdev, "voice setting 0x%4.4x", setting);
 569
 570         if (hdev->notify)
 571                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 572
 573         return rp->status;
 574 }
 575
 576 static u8 hci_cc_write_voice_setting(struct hci_dev *hdev, void *data,
 577                                      struct sk_buff *skb)
 578 {
 579         struct hci_ev_status *rp = data;
 580         __u16 setting;
 581         void *sent;
 582
 583         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 584
 585         if (rp->status)
 586                 return rp->status;
 587
 588         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
 589         if (!sent)
 590                 return rp->status;
 591
 592         setting = get_unaligned_le16(sent);
 593
 594         if (hdev->voice_setting == setting)
 595                 return rp->status;
 596
 597         hdev->voice_setting = setting;
 598
 599         bt_dev_dbg(hdev, "voice setting 0x%4.4x", setting);
 600
 601         if (hdev->notify)
 602                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 603
 604         return rp->status;
 605 }
 606
 607 static u8 hci_cc_read_num_supported_iac(struct hci_dev *hdev, void *data,
 608                                         struct sk_buff *skb)
 609 {
 610         struct hci_rp_read_num_supported_iac *rp = data;
 611
 612         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 613
 614         if (rp->status)
 615                 return rp->status;
 616
 617         hdev->num_iac = rp->num_iac;
 618
 619         bt_dev_dbg(hdev, "num iac %d", hdev->num_iac);
 620
 621         return rp->status;
 622 }
 623
 624 static u8 hci_cc_write_ssp_mode(struct hci_dev *hdev, void *data,
 625                                 struct sk_buff *skb)
 626 {
 627         struct hci_ev_status *rp = data;
 628         struct hci_cp_write_ssp_mode *sent;
 629
 630         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 631
 632         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
 633         if (!sent)
 634                 return rp->status;
 635
 636         hci_dev_lock(hdev);
 637
 638         if (!rp->status) {
 639                 if (sent->mode)
 640                         hdev->features[1][0] |= LMP_HOST_SSP;
 641                 else
 642                         hdev->features[1][0] &= ~LMP_HOST_SSP;
 643         }
 644
 645         if (!rp->status) {
 646                 if (sent->mode)
 647                         hci_dev_set_flag(hdev, HCI_SSP_ENABLED);
 648                 else
 649                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
 650         }
 651
 652         hci_dev_unlock(hdev);
 653
 654         return rp->status;
 655 }
 656
 657 static u8 hci_cc_write_sc_support(struct hci_dev *hdev, void *data,
 658                                   struct sk_buff *skb)
 659 {
 660         struct hci_ev_status *rp = data;
 661         struct hci_cp_write_sc_support *sent;
 662
 663         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 664
 665         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SC_SUPPORT);
 666         if (!sent)
 667                 return rp->status;
 668
 669         hci_dev_lock(hdev);
 670
 671         if (!rp->status) {
 672                 if (sent->support)
 673                         hdev->features[1][0] |= LMP_HOST_SC;
 674                 else
 675                         hdev->features[1][0] &= ~LMP_HOST_SC;
 676         }
 677
 678         if (!hci_dev_test_flag(hdev, HCI_MGMT) && !rp->status) {
 679                 if (sent->support)
 680                         hci_dev_set_flag(hdev, HCI_SC_ENABLED);
 681                 else
 682                         hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
 683         }
 684
 685         hci_dev_unlock(hdev);
 686
 687         return rp->status;
 688 }
 689
 690 static u8 hci_cc_read_local_version(struct hci_dev *hdev, void *data,
 691                                     struct sk_buff *skb)
 692 {
 693         struct hci_rp_read_local_version *rp = data;
 694
 695         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 696
 697         if (rp->status)
 698                 return rp->status;
 699
 700         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 701             hci_dev_test_flag(hdev, HCI_CONFIG)) {
 702                 hdev->hci_ver = rp->hci_ver;
 703                 hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
 704                 hdev->lmp_ver = rp->lmp_ver;
 705                 hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
 706                 hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
 707         }
 708
 709         return rp->status;
 710 }
 711
 712 static u8 hci_cc_read_local_commands(struct hci_dev *hdev, void *data,
 713                                      struct sk_buff *skb)
 714 {
 715         struct hci_rp_read_local_commands *rp = data;
 716
 717         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 718
 719         if (rp->status)
 720                 return rp->status;
 721
 722         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 723             hci_dev_test_flag(hdev, HCI_CONFIG))
 724                 memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 725
 726         return rp->status;
 727 }
 728
 729 static u8 hci_cc_read_auth_payload_timeout(struct hci_dev *hdev, void *data,
 730                                            struct sk_buff *skb)
 731 {
 732         struct hci_rp_read_auth_payload_to *rp = data;
 733         struct hci_conn *conn;
 734
 735         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 736
 737         if (rp->status)
 738                 return rp->status;
 739
 740         hci_dev_lock(hdev);
 741
 742         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 743         if (conn)
 744                 conn->auth_payload_timeout = __le16_to_cpu(rp->timeout);
 745
 746         hci_dev_unlock(hdev);
 747
 748         return rp->status;
 749 }
 750
 751 static u8 hci_cc_write_auth_payload_timeout(struct hci_dev *hdev, void *data,
 752                                             struct sk_buff *skb)
 753 {
 754         struct hci_rp_write_auth_payload_to *rp = data;
 755         struct hci_conn *conn;
 756         void *sent;
 757
 758         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 759
 760         if (rp->status)
 761                 return rp->status;
 762
 763         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_PAYLOAD_TO);
 764         if (!sent)
 765                 return rp->status;
 766
 767         hci_dev_lock(hdev);
 768
 769         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 770         if (conn)
 771                 conn->auth_payload_timeout = get_unaligned_le16(sent + 2);
 772
 773         hci_dev_unlock(hdev);
 774
 775         return rp->status;
 776 }
 777
 778 static u8 hci_cc_read_local_features(struct hci_dev *hdev, void *data,
 779                                      struct sk_buff *skb)
 780 {
 781         struct hci_rp_read_local_features *rp = data;
 782
 783         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 784
 785         if (rp->status)
 786                 return rp->status;
 787
 788         memcpy(hdev->features, rp->features, 8);
 789
 790         /* Adjust default settings according to features
 791          * supported by device. */
 792
 793         if (hdev->features[0][0] & LMP_3SLOT)
 794                 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 795
 796         if (hdev->features[0][0] & LMP_5SLOT)
 797                 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 798
 799         if (hdev->features[0][1] & LMP_HV2) {
 800                 hdev->pkt_type  |= (HCI_HV2);
 801                 hdev->esco_type |= (ESCO_HV2);
 802         }
 803
 804         if (hdev->features[0][1] & LMP_HV3) {
 805                 hdev->pkt_type  |= (HCI_HV3);
 806                 hdev->esco_type |= (ESCO_HV3);
 807         }
 808
 809         if (lmp_esco_capable(hdev))
 810                 hdev->esco_type |= (ESCO_EV3);
 811
 812         if (hdev->features[0][4] & LMP_EV4)
 813                 hdev->esco_type |= (ESCO_EV4);
 814
 815         if (hdev->features[0][4] & LMP_EV5)
 816                 hdev->esco_type |= (ESCO_EV5);
 817
 818         if (hdev->features[0][5] & LMP_EDR_ESCO_2M)
 819                 hdev->esco_type |= (ESCO_2EV3);
 820
 821         if (hdev->features[0][5] & LMP_EDR_ESCO_3M)
 822                 hdev->esco_type |= (ESCO_3EV3);
 823
 824         if (hdev->features[0][5] & LMP_EDR_3S_ESCO)
 825                 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
 826
 827         return rp->status;
 828 }
 829
 830 static u8 hci_cc_read_local_ext_features(struct hci_dev *hdev, void *data,
 831                                          struct sk_buff *skb)
 832 {
 833         struct hci_rp_read_local_ext_features *rp = data;
 834
 835         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 836
 837         if (rp->status)
 838                 return rp->status;
 839
 840         if (hdev->max_page < rp->max_page)
 841                 hdev->max_page = rp->max_page;
 842
 843         if (rp->page < HCI_MAX_PAGES)
 844                 memcpy(hdev->features[rp->page], rp->features, 8);
 845
 846         return rp->status;
 847 }
 848
 849 static u8 hci_cc_read_flow_control_mode(struct hci_dev *hdev, void *data,
 850                                         struct sk_buff *skb)
 851 {
 852         struct hci_rp_read_flow_control_mode *rp = data;
 853
 854         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 855
 856         if (rp->status)
 857                 return rp->status;
 858
 859         hdev->flow_ctl_mode = rp->mode;
 860
 861         return rp->status;
 862 }
 863
 864 static u8 hci_cc_read_buffer_size(struct hci_dev *hdev, void *data,
 865                                   struct sk_buff *skb)
 866 {
 867         struct hci_rp_read_buffer_size *rp = data;
 868
 869         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 870
 871         if (rp->status)
 872                 return rp->status;
 873
 874         hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
 875         hdev->sco_mtu  = rp->sco_mtu;
 876         hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
 877         hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
 878
 879         if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
 880                 hdev->sco_mtu  = 64;
 881                 hdev->sco_pkts = 8;
 882         }
 883
 884         hdev->acl_cnt = hdev->acl_pkts;
 885         hdev->sco_cnt = hdev->sco_pkts;
 886
 887         BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
 888                hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
 889
 890         return rp->status;
 891 }
 892
 893 static u8 hci_cc_read_bd_addr(struct hci_dev *hdev, void *data,
 894                               struct sk_buff *skb)
 895 {
 896         struct hci_rp_read_bd_addr *rp = data;
 897
 898         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 899
 900         if (rp->status)
 901                 return rp->status;
 902
 903         if (test_bit(HCI_INIT, &hdev->flags))
 904                 bacpy(&hdev->bdaddr, &rp->bdaddr);
 905
 906         if (hci_dev_test_flag(hdev, HCI_SETUP))
 907                 bacpy(&hdev->setup_addr, &rp->bdaddr);
 908
 909         return rp->status;
 910 }
 911
 912 static u8 hci_cc_read_local_pairing_opts(struct hci_dev *hdev, void *data,
 913                                          struct sk_buff *skb)
 914 {
 915         struct hci_rp_read_local_pairing_opts *rp = data;
 916
 917         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 918
 919         if (rp->status)
 920                 return rp->status;
 921
 922         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 923             hci_dev_test_flag(hdev, HCI_CONFIG)) {
 924                 hdev->pairing_opts = rp->pairing_opts;
 925                 hdev->max_enc_key_size = rp->max_key_size;
 926         }
 927
 928         return rp->status;
 929 }
 930
 931 static u8 hci_cc_read_page_scan_activity(struct hci_dev *hdev, void *data,
 932                                          struct sk_buff *skb)
 933 {
 934         struct hci_rp_read_page_scan_activity *rp = data;
 935
 936         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 937
 938         if (rp->status)
 939                 return rp->status;
 940
 941         if (test_bit(HCI_INIT, &hdev->flags)) {
 942                 hdev->page_scan_interval = __le16_to_cpu(rp->interval);
 943                 hdev->page_scan_window = __le16_to_cpu(rp->window);
 944         }
 945
 946         return rp->status;
 947 }
 948
 949 static u8 hci_cc_write_page_scan_activity(struct hci_dev *hdev, void *data,
 950                                           struct sk_buff *skb)
 951 {
 952         struct hci_ev_status *rp = data;
 953         struct hci_cp_write_page_scan_activity *sent;
 954
 955         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 956
 957         if (rp->status)
 958                 return rp->status;
 959
 960         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY);
 961         if (!sent)
 962                 return rp->status;
 963
 964         hdev->page_scan_interval = __le16_to_cpu(sent->interval);
 965         hdev->page_scan_window = __le16_to_cpu(sent->window);
 966
 967         return rp->status;
 968 }
 969
 970 static u8 hci_cc_read_page_scan_type(struct hci_dev *hdev, void *data,
 971                                      struct sk_buff *skb)
 972 {
 973         struct hci_rp_read_page_scan_type *rp = data;
 974
 975         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 976
 977         if (rp->status)
 978                 return rp->status;
 979
 980         if (test_bit(HCI_INIT, &hdev->flags))
 981                 hdev->page_scan_type = rp->type;
 982
 983         return rp->status;
 984 }
 985
 986 static u8 hci_cc_write_page_scan_type(struct hci_dev *hdev, void *data,
 987                                       struct sk_buff *skb)
 988 {
 989         struct hci_ev_status *rp = data;
 990         u8 *type;
 991
 992         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 993
 994         if (rp->status)
 995                 return rp->status;
 996
 997         type = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE);
 998         if (type)
 999                 hdev->page_scan_type = *type;
1000
1001         return rp->status;
1002 }
1003
1004 static u8 hci_cc_read_data_block_size(struct hci_dev *hdev, void *data,
1005                                       struct sk_buff *skb)
1006 {
1007         struct hci_rp_read_data_block_size *rp = data;
1008
1009         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1010
1011         if (rp->status)
1012                 return rp->status;
1013
1014         hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
1015         hdev->block_len = __le16_to_cpu(rp->block_len);
1016         hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
1017
1018         hdev->block_cnt = hdev->num_blocks;
1019
1020         BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
1021                hdev->block_cnt, hdev->block_len);
1022
1023         return rp->status;
1024 }
1025
1026 static u8 hci_cc_read_clock(struct hci_dev *hdev, void *data,
1027                             struct sk_buff *skb)
1028 {
1029         struct hci_rp_read_clock *rp = data;
1030         struct hci_cp_read_clock *cp;
1031         struct hci_conn *conn;
1032
1033         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1034
1035         if (rp->status)
1036                 return rp->status;
1037
1038         hci_dev_lock(hdev);
1039
1040         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
1041         if (!cp)
1042                 goto unlock;
1043
1044         if (cp->which == 0x00) {
1045                 hdev->clock = le32_to_cpu(rp->clock);
1046                 goto unlock;
1047         }
1048
1049         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1050         if (conn) {
1051                 conn->clock = le32_to_cpu(rp->clock);
1052                 conn->clock_accuracy = le16_to_cpu(rp->accuracy);
1053         }
1054
1055 unlock:
1056         hci_dev_unlock(hdev);
1057         return rp->status;
1058 }
1059
1060 static u8 hci_cc_read_local_amp_info(struct hci_dev *hdev, void *data,
1061                                      struct sk_buff *skb)
1062 {
1063         struct hci_rp_read_local_amp_info *rp = data;
1064
1065         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1066
1067         if (rp->status)
1068                 return rp->status;
1069
1070         hdev->amp_status = rp->amp_status;
1071         hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
1072         hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
1073         hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
1074         hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
1075         hdev->amp_type = rp->amp_type;
1076         hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
1077         hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
1078         hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
1079         hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
1080
1081         return rp->status;
1082 }
1083
1084 static u8 hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev, void *data,
1085                                        struct sk_buff *skb)
1086 {
1087         struct hci_rp_read_inq_rsp_tx_power *rp = data;
1088
1089         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1090
1091         if (rp->status)
1092                 return rp->status;
1093
1094         hdev->inq_tx_power = rp->tx_power;
1095
1096         return rp->status;
1097 }
1098
1099 static u8 hci_cc_read_def_err_data_reporting(struct hci_dev *hdev, void *data,
1100                                              struct sk_buff *skb)
1101 {
1102         struct hci_rp_read_def_err_data_reporting *rp = data;
1103
1104         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1105
1106         if (rp->status)
1107                 return rp->status;
1108
1109         hdev->err_data_reporting = rp->err_data_reporting;
1110
1111         return rp->status;
1112 }
1113
1114 static u8 hci_cc_write_def_err_data_reporting(struct hci_dev *hdev, void *data,
1115                                               struct sk_buff *skb)
1116 {
1117         struct hci_ev_status *rp = data;
1118         struct hci_cp_write_def_err_data_reporting *cp;
1119
1120         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1121
1122         if (rp->status)
1123                 return rp->status;
1124
1125         cp = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_ERR_DATA_REPORTING);
1126         if (!cp)
1127                 return rp->status;
1128
1129         hdev->err_data_reporting = cp->err_data_reporting;
1130
1131         return rp->status;
1132 }
1133
1134 static u8 hci_cc_pin_code_reply(struct hci_dev *hdev, void *data,
1135                                 struct sk_buff *skb)
1136 {
1137         struct hci_rp_pin_code_reply *rp = data;
1138         struct hci_cp_pin_code_reply *cp;
1139         struct hci_conn *conn;
1140
1141         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1142
1143         hci_dev_lock(hdev);
1144
1145         if (hci_dev_test_flag(hdev, HCI_MGMT))
1146                 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
1147
1148         if (rp->status)
1149                 goto unlock;
1150
1151         cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
1152         if (!cp)
1153                 goto unlock;
1154
1155         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1156         if (conn)
1157                 conn->pin_length = cp->pin_len;
1158
1159 unlock:
1160         hci_dev_unlock(hdev);
1161         return rp->status;
1162 }
1163
1164 static u8 hci_cc_pin_code_neg_reply(struct hci_dev *hdev, void *data,
1165                                     struct sk_buff *skb)
1166 {
1167         struct hci_rp_pin_code_neg_reply *rp = data;
1168
1169         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1170
1171         hci_dev_lock(hdev);
1172
1173         if (hci_dev_test_flag(hdev, HCI_MGMT))
1174                 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
1175                                                  rp->status);
1176
1177         hci_dev_unlock(hdev);
1178
1179         return rp->status;
1180 }
1181
1182 static u8 hci_cc_le_read_buffer_size(struct hci_dev *hdev, void *data,
1183                                      struct sk_buff *skb)
1184 {
1185         struct hci_rp_le_read_buffer_size *rp = data;
1186
1187         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1188
1189         if (rp->status)
1190                 return rp->status;
1191
1192         hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
1193         hdev->le_pkts = rp->le_max_pkt;
1194
1195         hdev->le_cnt = hdev->le_pkts;
1196
1197         BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
1198
1199         return rp->status;
1200 }
1201
1202 static u8 hci_cc_le_read_local_features(struct hci_dev *hdev, void *data,
1203                                         struct sk_buff *skb)
1204 {
1205         struct hci_rp_le_read_local_features *rp = data;
1206
1207         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1208
1209         if (rp->status)
1210                 return rp->status;
1211
1212         memcpy(hdev->le_features, rp->features, 8);
1213
1214         return rp->status;
1215 }
1216
1217 static u8 hci_cc_le_read_adv_tx_power(struct hci_dev *hdev, void *data,
1218                                       struct sk_buff *skb)
1219 {
1220         struct hci_rp_le_read_adv_tx_power *rp = data;
1221
1222         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1223
1224         if (rp->status)
1225                 return rp->status;
1226
1227         hdev->adv_tx_power = rp->tx_power;
1228
1229         return rp->status;
1230 }
1231
1232 static u8 hci_cc_user_confirm_reply(struct hci_dev *hdev, void *data,
1233                                     struct sk_buff *skb)
1234 {
1235         struct hci_rp_user_confirm_reply *rp = data;
1236
1237         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1238
1239         hci_dev_lock(hdev);
1240
1241         if (hci_dev_test_flag(hdev, HCI_MGMT))
1242                 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,
1243                                                  rp->status);
1244
1245         hci_dev_unlock(hdev);
1246
1247         return rp->status;
1248 }
1249
1250 static u8 hci_cc_user_confirm_neg_reply(struct hci_dev *hdev, void *data,
1251                                         struct sk_buff *skb)
1252 {
1253         struct hci_rp_user_confirm_reply *rp = data;
1254
1255         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1256
1257         hci_dev_lock(hdev);
1258
1259         if (hci_dev_test_flag(hdev, HCI_MGMT))
1260                 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
1261                                                      ACL_LINK, 0, rp->status);
1262
1263         hci_dev_unlock(hdev);
1264
1265         return rp->status;
1266 }
1267
1268 static u8 hci_cc_user_passkey_reply(struct hci_dev *hdev, void *data,
1269                                     struct sk_buff *skb)
1270 {
1271         struct hci_rp_user_confirm_reply *rp = data;
1272
1273         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1274
1275         hci_dev_lock(hdev);
1276
1277         if (hci_dev_test_flag(hdev, HCI_MGMT))
1278                 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
1279                                                  0, rp->status);
1280
1281         hci_dev_unlock(hdev);
1282
1283         return rp->status;
1284 }
1285
1286 static u8 hci_cc_user_passkey_neg_reply(struct hci_dev *hdev, void *data,
1287                                         struct sk_buff *skb)
1288 {
1289         struct hci_rp_user_confirm_reply *rp = data;
1290
1291         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1292
1293         hci_dev_lock(hdev);
1294
1295         if (hci_dev_test_flag(hdev, HCI_MGMT))
1296                 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
1297                                                      ACL_LINK, 0, rp->status);
1298
1299         hci_dev_unlock(hdev);
1300
1301         return rp->status;
1302 }
1303
1304 static u8 hci_cc_read_local_oob_data(struct hci_dev *hdev, void *data,
1305                                      struct sk_buff *skb)
1306 {
1307         struct hci_rp_read_local_oob_data *rp = data;
1308
1309         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1310
1311         return rp->status;
1312 }
1313
1314 static u8 hci_cc_read_local_oob_ext_data(struct hci_dev *hdev, void *data,
1315                                          struct sk_buff *skb)
1316 {
1317         struct hci_rp_read_local_oob_ext_data *rp = data;
1318
1319         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1320
1321         return rp->status;
1322 }
1323
1324 static u8 hci_cc_le_set_random_addr(struct hci_dev *hdev, void *data,
1325                                     struct sk_buff *skb)
1326 {
1327         struct hci_ev_status *rp = data;
1328         bdaddr_t *sent;
1329
1330         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1331
1332         if (rp->status)
1333                 return rp->status;
1334
1335         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_RANDOM_ADDR);
1336         if (!sent)
1337                 return rp->status;
1338
1339         hci_dev_lock(hdev);
1340
1341         bacpy(&hdev->random_addr, sent);
1342
1343         if (!bacmp(&hdev->rpa, sent)) {
1344                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
1345                 queue_delayed_work(hdev->workqueue, &hdev->rpa_expired,
1346                                    secs_to_jiffies(hdev->rpa_timeout));
1347         }
1348
1349         hci_dev_unlock(hdev);
1350
1351         return rp->status;
1352 }
1353
1354 static u8 hci_cc_le_set_default_phy(struct hci_dev *hdev, void *data,
1355                                     struct sk_buff *skb)
1356 {
1357         struct hci_ev_status *rp = data;
1358         struct hci_cp_le_set_default_phy *cp;
1359
1360         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1361
1362         if (rp->status)
1363                 return rp->status;
1364
1365         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_DEFAULT_PHY);
1366         if (!cp)
1367                 return rp->status;
1368
1369         hci_dev_lock(hdev);
1370
1371         hdev->le_tx_def_phys = cp->tx_phys;
1372         hdev->le_rx_def_phys = cp->rx_phys;
1373
1374         hci_dev_unlock(hdev);
1375
1376         return rp->status;
1377 }
1378
1379 static u8 hci_cc_le_set_adv_set_random_addr(struct hci_dev *hdev, void *data,
1380                                             struct sk_buff *skb)
1381 {
1382         struct hci_ev_status *rp = data;
1383         struct hci_cp_le_set_adv_set_rand_addr *cp;
1384         struct adv_info *adv;
1385
1386         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1387
1388         if (rp->status)
1389                 return rp->status;
1390
1391         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_SET_RAND_ADDR);
1392         /* Update only in case the adv instance since handle 0x00 shall be using
1393          * HCI_OP_LE_SET_RANDOM_ADDR since that allows both extended and
1394          * non-extended adverting.
1395          */
1396         if (!cp || !cp->handle)
1397                 return rp->status;
1398
1399         hci_dev_lock(hdev);
1400
1401         adv = hci_find_adv_instance(hdev, cp->handle);
1402         if (adv) {
1403                 bacpy(&adv->random_addr, &cp->bdaddr);
1404                 if (!bacmp(&hdev->rpa, &cp->bdaddr)) {
1405                         adv->rpa_expired = false;
1406                         queue_delayed_work(hdev->workqueue,
1407                                            &adv->rpa_expired_cb,
1408                                            secs_to_jiffies(hdev->rpa_timeout));
1409                 }
1410         }
1411
1412         hci_dev_unlock(hdev);
1413
1414         return rp->status;
1415 }
1416
1417 static u8 hci_cc_le_remove_adv_set(struct hci_dev *hdev, void *data,
1418                                    struct sk_buff *skb)
1419 {
1420         struct hci_ev_status *rp = data;
1421         u8 *instance;
1422         int err;
1423
1424         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1425
1426         if (rp->status)
1427                 return rp->status;
1428
1429         instance = hci_sent_cmd_data(hdev, HCI_OP_LE_REMOVE_ADV_SET);
1430         if (!instance)
1431                 return rp->status;
1432
1433         hci_dev_lock(hdev);
1434
1435         err = hci_remove_adv_instance(hdev, *instance);
1436         if (!err)
1437                 mgmt_advertising_removed(hci_skb_sk(hdev->sent_cmd), hdev,
1438                                          *instance);
1439
1440         hci_dev_unlock(hdev);
1441
1442         return rp->status;
1443 }
1444
1445 static u8 hci_cc_le_clear_adv_sets(struct hci_dev *hdev, void *data,
1446                                    struct sk_buff *skb)
1447 {
1448         struct hci_ev_status *rp = data;
1449         struct adv_info *adv, *n;
1450         int err;
1451
1452         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1453
1454         if (rp->status)
1455                 return rp->status;
1456
1457         if (!hci_sent_cmd_data(hdev, HCI_OP_LE_CLEAR_ADV_SETS))
1458                 return rp->status;
1459
1460         hci_dev_lock(hdev);
1461
1462         list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) {
1463                 u8 instance = adv->instance;
1464
1465                 err = hci_remove_adv_instance(hdev, instance);
1466                 if (!err)
1467                         mgmt_advertising_removed(hci_skb_sk(hdev->sent_cmd),
1468                                                  hdev, instance);
1469         }
1470
1471         hci_dev_unlock(hdev);
1472
1473         return rp->status;
1474 }
1475
1476 static u8 hci_cc_le_read_transmit_power(struct hci_dev *hdev, void *data,
1477                                         struct sk_buff *skb)
1478 {
1479         struct hci_rp_le_read_transmit_power *rp = data;
1480
1481         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1482
1483         if (rp->status)
1484                 return rp->status;
1485
1486         hdev->min_le_tx_power = rp->min_le_tx_power;
1487         hdev->max_le_tx_power = rp->max_le_tx_power;
1488
1489         return rp->status;
1490 }
1491
1492 static u8 hci_cc_le_set_privacy_mode(struct hci_dev *hdev, void *data,
1493                                      struct sk_buff *skb)
1494 {
1495         struct hci_ev_status *rp = data;
1496         struct hci_cp_le_set_privacy_mode *cp;
1497         struct hci_conn_params *params;
1498
1499         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1500
1501         if (rp->status)
1502                 return rp->status;
1503
1504         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_PRIVACY_MODE);
1505         if (!cp)
1506                 return rp->status;
1507
1508         hci_dev_lock(hdev);
1509
1510         params = hci_conn_params_lookup(hdev, &cp->bdaddr, cp->bdaddr_type);
1511         if (params)
1512                 params->privacy_mode = cp->mode;
1513
1514         hci_dev_unlock(hdev);
1515
1516         return rp->status;
1517 }
1518
1519 static u8 hci_cc_le_set_adv_enable(struct hci_dev *hdev, void *data,
1520                                    struct sk_buff *skb)
1521 {
1522         struct hci_ev_status *rp = data;
1523         __u8 *sent;
1524
1525         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1526
1527         if (rp->status)
1528                 return rp->status;
1529
1530         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_ENABLE);
1531         if (!sent)
1532                 return rp->status;
1533
1534         hci_dev_lock(hdev);
1535
1536         /* If we're doing connection initiation as peripheral. Set a
1537          * timeout in case something goes wrong.
1538          */
1539         if (*sent) {
1540                 struct hci_conn *conn;
1541
1542                 hci_dev_set_flag(hdev, HCI_LE_ADV);
1543
1544                 conn = hci_lookup_le_connect(hdev);
1545                 if (conn)
1546                         queue_delayed_work(hdev->workqueue,
1547                                            &conn->le_conn_timeout,
1548                                            conn->conn_timeout);
1549         } else {
1550                 hci_dev_clear_flag(hdev, HCI_LE_ADV);
1551         }
1552
1553         hci_dev_unlock(hdev);
1554
1555         return rp->status;
1556 }
1557
1558 static u8 hci_cc_le_set_ext_adv_enable(struct hci_dev *hdev, void *data,
1559                                        struct sk_buff *skb)
1560 {
1561         struct hci_cp_le_set_ext_adv_enable *cp;
1562         struct hci_cp_ext_adv_set *set;
1563         struct adv_info *adv = NULL, *n;
1564         struct hci_ev_status *rp = data;
1565
1566         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1567
1568         if (rp->status)
1569                 return rp->status;
1570
1571         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE);
1572         if (!cp)
1573                 return rp->status;
1574
1575         set = (void *)cp->data;
1576
1577         hci_dev_lock(hdev);
1578
1579         if (cp->num_of_sets)
1580                 adv = hci_find_adv_instance(hdev, set->handle);
1581
1582         if (cp->enable) {
1583                 struct hci_conn *conn;
1584
1585                 hci_dev_set_flag(hdev, HCI_LE_ADV);
1586
1587                 if (adv)
1588                         adv->enabled = true;
1589
1590                 conn = hci_lookup_le_connect(hdev);
1591                 if (conn)
1592                         queue_delayed_work(hdev->workqueue,
1593                                            &conn->le_conn_timeout,
1594                                            conn->conn_timeout);
1595         } else {
1596                 if (cp->num_of_sets) {
1597                         if (adv)
1598                                 adv->enabled = false;
1599
1600                         /* If just one instance was disabled check if there are
1601                          * any other instance enabled before clearing HCI_LE_ADV
1602                          */
1603                         list_for_each_entry_safe(adv, n, &hdev->adv_instances,
1604                                                  list) {
1605                                 if (adv->enabled)
1606                                         goto unlock;
1607                         }
1608                 } else {
1609                         /* All instances shall be considered disabled */
1610                         list_for_each_entry_safe(adv, n, &hdev->adv_instances,
1611                                                  list)
1612                                 adv->enabled = false;
1613                 }
1614
1615                 hci_dev_clear_flag(hdev, HCI_LE_ADV);
1616         }
1617
1618 unlock:
1619         hci_dev_unlock(hdev);
1620         return rp->status;
1621 }
1622
1623 static u8 hci_cc_le_set_scan_param(struct hci_dev *hdev, void *data,
1624                                    struct sk_buff *skb)
1625 {
1626         struct hci_cp_le_set_scan_param *cp;
1627         struct hci_ev_status *rp = data;
1628
1629         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1630
1631         if (rp->status)
1632                 return rp->status;
1633
1634         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_PARAM);
1635         if (!cp)
1636                 return rp->status;
1637
1638         hci_dev_lock(hdev);
1639
1640         hdev->le_scan_type = cp->type;
1641
1642         hci_dev_unlock(hdev);
1643
1644         return rp->status;
1645 }
1646
1647 static u8 hci_cc_le_set_ext_scan_param(struct hci_dev *hdev, void *data,
1648                                        struct sk_buff *skb)
1649 {
1650         struct hci_cp_le_set_ext_scan_params *cp;
1651         struct hci_ev_status *rp = data;
1652         struct hci_cp_le_scan_phy_params *phy_param;
1653
1654         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1655
1656         if (rp->status)
1657                 return rp->status;
1658
1659         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_SCAN_PARAMS);
1660         if (!cp)
1661                 return rp->status;
1662
1663         phy_param = (void *)cp->data;
1664
1665         hci_dev_lock(hdev);
1666
1667         hdev->le_scan_type = phy_param->type;
1668
1669         hci_dev_unlock(hdev);
1670
1671         return rp->status;
1672 }
1673
1674 static bool has_pending_adv_report(struct hci_dev *hdev)
1675 {
1676         struct discovery_state *d = &hdev->discovery;
1677
1678         return bacmp(&d->last_adv_addr, BDADDR_ANY);
1679 }
1680
1681 static void clear_pending_adv_report(struct hci_dev *hdev)
1682 {
1683         struct discovery_state *d = &hdev->discovery;
1684
1685         bacpy(&d->last_adv_addr, BDADDR_ANY);
1686         d->last_adv_data_len = 0;
1687 }
1688
1689 static void store_pending_adv_report(struct hci_dev *hdev, bdaddr_t *bdaddr,
1690                                      u8 bdaddr_type, s8 rssi, u32 flags,
1691                                      u8 *data, u8 len)
1692 {
1693         struct discovery_state *d = &hdev->discovery;
1694
1695         if (len > HCI_MAX_AD_LENGTH)
1696                 return;
1697
1698         bacpy(&d->last_adv_addr, bdaddr);
1699         d->last_adv_addr_type = bdaddr_type;
1700         d->last_adv_rssi = rssi;
1701         d->last_adv_flags = flags;
1702         memcpy(d->last_adv_data, data, len);
1703         d->last_adv_data_len = len;
1704 }
1705
1706 static void le_set_scan_enable_complete(struct hci_dev *hdev, u8 enable)
1707 {
1708         hci_dev_lock(hdev);
1709
1710         switch (enable) {
1711         case LE_SCAN_ENABLE:
1712                 hci_dev_set_flag(hdev, HCI_LE_SCAN);
1713                 if (hdev->le_scan_type == LE_SCAN_ACTIVE)
1714                         clear_pending_adv_report(hdev);
1715                 break;
1716
1717         case LE_SCAN_DISABLE:
1718                 /* We do this here instead of when setting DISCOVERY_STOPPED
1719                  * since the latter would potentially require waiting for
1720                  * inquiry to stop too.
1721                  */
1722                 if (has_pending_adv_report(hdev)) {
1723                         struct discovery_state *d = &hdev->discovery;
1724
1725                         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
1726                                           d->last_adv_addr_type, NULL,
1727                                           d->last_adv_rssi, d->last_adv_flags,
1728                                           d->last_adv_data,
1729                                           d->last_adv_data_len, NULL, 0);
1730                 }
1731
1732                 /* Cancel this timer so that we don't try to disable scanning
1733                  * when it's already disabled.
1734                  */
1735                 cancel_delayed_work(&hdev->le_scan_disable);
1736
1737                 hci_dev_clear_flag(hdev, HCI_LE_SCAN);
1738
1739                 /* The HCI_LE_SCAN_INTERRUPTED flag indicates that we
1740                  * interrupted scanning due to a connect request. Mark
1741                  * therefore discovery as stopped.
1742                  */
1743                 if (hci_dev_test_and_clear_flag(hdev, HCI_LE_SCAN_INTERRUPTED))
1744                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1745
1746                 break;
1747
1748         default:
1749                 bt_dev_err(hdev, "use of reserved LE_Scan_Enable param %d",
1750                            enable);
1751                 break;
1752         }
1753
1754         hci_dev_unlock(hdev);
1755 }
1756
1757 static u8 hci_cc_le_set_scan_enable(struct hci_dev *hdev, void *data,
1758                                     struct sk_buff *skb)
1759 {
1760         struct hci_cp_le_set_scan_enable *cp;
1761         struct hci_ev_status *rp = data;
1762
1763         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1764
1765         if (rp->status)
1766                 return rp->status;
1767
1768         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
1769         if (!cp)
1770                 return rp->status;
1771
1772         le_set_scan_enable_complete(hdev, cp->enable);
1773
1774         return rp->status;
1775 }
1776
1777 static u8 hci_cc_le_set_ext_scan_enable(struct hci_dev *hdev, void *data,
1778                                         struct sk_buff *skb)
1779 {
1780         struct hci_cp_le_set_ext_scan_enable *cp;
1781         struct hci_ev_status *rp = data;
1782
1783         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1784
1785         if (rp->status)
1786                 return rp->status;
1787
1788         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_SCAN_ENABLE);
1789         if (!cp)
1790                 return rp->status;
1791
1792         le_set_scan_enable_complete(hdev, cp->enable);
1793
1794         return rp->status;
1795 }
1796
1797 static u8 hci_cc_le_read_num_adv_sets(struct hci_dev *hdev, void *data,
1798                                       struct sk_buff *skb)
1799 {
1800         struct hci_rp_le_read_num_supported_adv_sets *rp = data;
1801
1802         bt_dev_dbg(hdev, "status 0x%2.2x No of Adv sets %u", rp->status,
1803                    rp->num_of_sets);
1804
1805         if (rp->status)
1806                 return rp->status;
1807
1808         hdev->le_num_of_adv_sets = rp->num_of_sets;
1809
1810         return rp->status;
1811 }
1812
1813 static u8 hci_cc_le_read_accept_list_size(struct hci_dev *hdev, void *data,
1814                                           struct sk_buff *skb)
1815 {
1816         struct hci_rp_le_read_accept_list_size *rp = data;
1817
1818         bt_dev_dbg(hdev, "status 0x%2.2x size %u", rp->status, rp->size);
1819
1820         if (rp->status)
1821                 return rp->status;
1822
1823         hdev->le_accept_list_size = rp->size;
1824
1825         return rp->status;
1826 }
1827
1828 static u8 hci_cc_le_clear_accept_list(struct hci_dev *hdev, void *data,
1829                                       struct sk_buff *skb)
1830 {
1831         struct hci_ev_status *rp = data;
1832
1833         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1834
1835         if (rp->status)
1836                 return rp->status;
1837
1838         hci_dev_lock(hdev);
1839         hci_bdaddr_list_clear(&hdev->le_accept_list);
1840         hci_dev_unlock(hdev);
1841
1842         return rp->status;
1843 }
1844
1845 static u8 hci_cc_le_add_to_accept_list(struct hci_dev *hdev, void *data,
1846                                        struct sk_buff *skb)
1847 {
1848         struct hci_cp_le_add_to_accept_list *sent;
1849         struct hci_ev_status *rp = data;
1850
1851         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1852
1853         if (rp->status)
1854                 return rp->status;
1855
1856         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_ACCEPT_LIST);
1857         if (!sent)
1858                 return rp->status;
1859
1860         hci_dev_lock(hdev);
1861         hci_bdaddr_list_add(&hdev->le_accept_list, &sent->bdaddr,
1862                             sent->bdaddr_type);
1863         hci_dev_unlock(hdev);
1864
1865         return rp->status;
1866 }
1867
1868 static u8 hci_cc_le_del_from_accept_list(struct hci_dev *hdev, void *data,
1869                                          struct sk_buff *skb)
1870 {
1871         struct hci_cp_le_del_from_accept_list *sent;
1872         struct hci_ev_status *rp = data;
1873
1874         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1875
1876         if (rp->status)
1877                 return rp->status;
1878
1879         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_ACCEPT_LIST);
1880         if (!sent)
1881                 return rp->status;
1882
1883         hci_dev_lock(hdev);
1884         hci_bdaddr_list_del(&hdev->le_accept_list, &sent->bdaddr,
1885                             sent->bdaddr_type);
1886         hci_dev_unlock(hdev);
1887
1888         return rp->status;
1889 }
1890
1891 static u8 hci_cc_le_read_supported_states(struct hci_dev *hdev, void *data,
1892                                           struct sk_buff *skb)
1893 {
1894         struct hci_rp_le_read_supported_states *rp = data;
1895
1896         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1897
1898         if (rp->status)
1899                 return rp->status;
1900
1901         memcpy(hdev->le_states, rp->le_states, 8);
1902
1903         return rp->status;
1904 }
1905
1906 static u8 hci_cc_le_read_def_data_len(struct hci_dev *hdev, void *data,
1907                                       struct sk_buff *skb)
1908 {
1909         struct hci_rp_le_read_def_data_len *rp = data;
1910
1911         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1912
1913         if (rp->status)
1914                 return rp->status;
1915
1916         hdev->le_def_tx_len = le16_to_cpu(rp->tx_len);
1917         hdev->le_def_tx_time = le16_to_cpu(rp->tx_time);
1918
1919         return rp->status;
1920 }
1921
1922 static u8 hci_cc_le_write_def_data_len(struct hci_dev *hdev, void *data,
1923                                        struct sk_buff *skb)
1924 {
1925         struct hci_cp_le_write_def_data_len *sent;
1926         struct hci_ev_status *rp = data;
1927
1928         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1929
1930         if (rp->status)
1931                 return rp->status;
1932
1933         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_WRITE_DEF_DATA_LEN);
1934         if (!sent)
1935                 return rp->status;
1936
1937         hdev->le_def_tx_len = le16_to_cpu(sent->tx_len);
1938         hdev->le_def_tx_time = le16_to_cpu(sent->tx_time);
1939
1940         return rp->status;
1941 }
1942
1943 static u8 hci_cc_le_add_to_resolv_list(struct hci_dev *hdev, void *data,
1944                                        struct sk_buff *skb)
1945 {
1946         struct hci_cp_le_add_to_resolv_list *sent;
1947         struct hci_ev_status *rp = data;
1948
1949         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1950
1951         if (rp->status)
1952                 return rp->status;
1953
1954         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_RESOLV_LIST);
1955         if (!sent)
1956                 return rp->status;
1957
1958         hci_dev_lock(hdev);
1959         hci_bdaddr_list_add_with_irk(&hdev->le_resolv_list, &sent->bdaddr,
1960                                 sent->bdaddr_type, sent->peer_irk,
1961                                 sent->local_irk);
1962         hci_dev_unlock(hdev);
1963
1964         return rp->status;
1965 }
1966
1967 static u8 hci_cc_le_del_from_resolv_list(struct hci_dev *hdev, void *data,
1968                                          struct sk_buff *skb)
1969 {
1970         struct hci_cp_le_del_from_resolv_list *sent;
1971         struct hci_ev_status *rp = data;
1972
1973         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1974
1975         if (rp->status)
1976                 return rp->status;
1977
1978         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_RESOLV_LIST);
1979         if (!sent)
1980                 return rp->status;
1981
1982         hci_dev_lock(hdev);
1983         hci_bdaddr_list_del_with_irk(&hdev->le_resolv_list, &sent->bdaddr,
1984                             sent->bdaddr_type);
1985         hci_dev_unlock(hdev);
1986
1987         return rp->status;
1988 }
1989
1990 static u8 hci_cc_le_clear_resolv_list(struct hci_dev *hdev, void *data,
1991                                       struct sk_buff *skb)
1992 {
1993         struct hci_ev_status *rp = data;
1994
1995         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1996
1997         if (rp->status)
1998                 return rp->status;
1999
2000         hci_dev_lock(hdev);
2001         hci_bdaddr_list_clear(&hdev->le_resolv_list);
2002         hci_dev_unlock(hdev);
2003
2004         return rp->status;
2005 }
2006
2007 static u8 hci_cc_le_read_resolv_list_size(struct hci_dev *hdev, void *data,
2008                                           struct sk_buff *skb)
2009 {
2010         struct hci_rp_le_read_resolv_list_size *rp = data;
2011
2012         bt_dev_dbg(hdev, "status 0x%2.2x size %u", rp->status, rp->size);
2013
2014         if (rp->status)
2015                 return rp->status;
2016
2017         hdev->le_resolv_list_size = rp->size;
2018
2019         return rp->status;
2020 }
2021
2022 static u8 hci_cc_le_set_addr_resolution_enable(struct hci_dev *hdev, void *data,
2023                                                struct sk_buff *skb)
2024 {
2025         struct hci_ev_status *rp = data;
2026         __u8 *sent;
2027
2028         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2029
2030         if (rp->status)
2031                 return rp->status;
2032
2033         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADDR_RESOLV_ENABLE);
2034         if (!sent)
2035                 return rp->status;
2036
2037         hci_dev_lock(hdev);
2038
2039         if (*sent)
2040                 hci_dev_set_flag(hdev, HCI_LL_RPA_RESOLUTION);
2041         else
2042                 hci_dev_clear_flag(hdev, HCI_LL_RPA_RESOLUTION);
2043
2044         hci_dev_unlock(hdev);
2045
2046         return rp->status;
2047 }
2048
2049 static u8 hci_cc_le_read_max_data_len(struct hci_dev *hdev, void *data,
2050                                       struct sk_buff *skb)
2051 {
2052         struct hci_rp_le_read_max_data_len *rp = data;
2053
2054         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2055
2056         if (rp->status)
2057                 return rp->status;
2058
2059         hdev->le_max_tx_len = le16_to_cpu(rp->tx_len);
2060         hdev->le_max_tx_time = le16_to_cpu(rp->tx_time);
2061         hdev->le_max_rx_len = le16_to_cpu(rp->rx_len);
2062         hdev->le_max_rx_time = le16_to_cpu(rp->rx_time);
2063
2064         return rp->status;
2065 }
2066
2067 static u8 hci_cc_write_le_host_supported(struct hci_dev *hdev, void *data,
2068                                          struct sk_buff *skb)
2069 {
2070         struct hci_cp_write_le_host_supported *sent;
2071         struct hci_ev_status *rp = data;
2072
2073         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2074
2075         if (rp->status)
2076                 return rp->status;
2077
2078         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
2079         if (!sent)
2080                 return rp->status;
2081
2082         hci_dev_lock(hdev);
2083
2084         if (sent->le) {
2085                 hdev->features[1][0] |= LMP_HOST_LE;
2086                 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
2087         } else {
2088                 hdev->features[1][0] &= ~LMP_HOST_LE;
2089                 hci_dev_clear_flag(hdev, HCI_LE_ENABLED);
2090                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
2091         }
2092
2093         if (sent->simul)
2094                 hdev->features[1][0] |= LMP_HOST_LE_BREDR;
2095         else
2096                 hdev->features[1][0] &= ~LMP_HOST_LE_BREDR;
2097
2098         hci_dev_unlock(hdev);
2099
2100         return rp->status;
2101 }
2102
2103 static u8 hci_cc_set_adv_param(struct hci_dev *hdev, void *data,
2104                                struct sk_buff *skb)
2105 {
2106         struct hci_cp_le_set_adv_param *cp;
2107         struct hci_ev_status *rp = data;
2108
2109         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2110
2111         if (rp->status)
2112                 return rp->status;
2113
2114         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_PARAM);
2115         if (!cp)
2116                 return rp->status;
2117
2118         hci_dev_lock(hdev);
2119         hdev->adv_addr_type = cp->own_address_type;
2120         hci_dev_unlock(hdev);
2121
2122         return rp->status;
2123 }
2124
2125 static u8 hci_cc_set_ext_adv_param(struct hci_dev *hdev, void *data,
2126                                    struct sk_buff *skb)
2127 {
2128         struct hci_rp_le_set_ext_adv_params *rp = data;
2129         struct hci_cp_le_set_ext_adv_params *cp;
2130         struct adv_info *adv_instance;
2131
2132         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2133
2134         if (rp->status)
2135                 return rp->status;
2136
2137         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_PARAMS);
2138         if (!cp)
2139                 return rp->status;
2140
2141         hci_dev_lock(hdev);
2142         hdev->adv_addr_type = cp->own_addr_type;
2143         if (!cp->handle) {
2144                 /* Store in hdev for instance 0 */
2145                 hdev->adv_tx_power = rp->tx_power;
2146         } else {
2147                 adv_instance = hci_find_adv_instance(hdev, cp->handle);
2148                 if (adv_instance)
2149                         adv_instance->tx_power = rp->tx_power;
2150         }
2151         /* Update adv data as tx power is known now */
2152         hci_req_update_adv_data(hdev, cp->handle);
2153
2154         hci_dev_unlock(hdev);
2155
2156         return rp->status;
2157 }
2158
2159 static u8 hci_cc_read_rssi(struct hci_dev *hdev, void *data,
2160                            struct sk_buff *skb)
2161 {
2162         struct hci_rp_read_rssi *rp = data;
2163         struct hci_conn *conn;
2164
2165         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2166
2167         if (rp->status)
2168                 return rp->status;
2169
2170         hci_dev_lock(hdev);
2171
2172         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
2173         if (conn)
2174                 conn->rssi = rp->rssi;
2175
2176         hci_dev_unlock(hdev);
2177
2178         return rp->status;
2179 }
2180
2181 static u8 hci_cc_read_tx_power(struct hci_dev *hdev, void *data,
2182                                struct sk_buff *skb)
2183 {
2184         struct hci_cp_read_tx_power *sent;
2185         struct hci_rp_read_tx_power *rp = data;
2186         struct hci_conn *conn;
2187
2188         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2189
2190         if (rp->status)
2191                 return rp->status;
2192
2193         sent = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
2194         if (!sent)
2195                 return rp->status;
2196
2197         hci_dev_lock(hdev);
2198
2199         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
2200         if (!conn)
2201                 goto unlock;
2202
2203         switch (sent->type) {
2204         case 0x00:
2205                 conn->tx_power = rp->tx_power;
2206                 break;
2207         case 0x01:
2208                 conn->max_tx_power = rp->tx_power;
2209                 break;
2210         }
2211
2212 unlock:
2213         hci_dev_unlock(hdev);
2214         return rp->status;
2215 }
2216
2217 static u8 hci_cc_write_ssp_debug_mode(struct hci_dev *hdev, void *data,
2218                                       struct sk_buff *skb)
2219 {
2220         struct hci_ev_status *rp = data;
2221         u8 *mode;
2222
2223         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2224
2225         if (rp->status)
2226                 return rp->status;
2227
2228         mode = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE);
2229         if (mode)
2230                 hdev->ssp_debug_mode = *mode;
2231
2232         return rp->status;
2233 }
2234
2235 static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
2236 {
2237         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2238
2239         if (status) {
2240                 hci_conn_check_pending(hdev);
2241                 return;
2242         }
2243
2244         set_bit(HCI_INQUIRY, &hdev->flags);
2245 }
2246
2247 static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
2248 {
2249         struct hci_cp_create_conn *cp;
2250         struct hci_conn *conn;
2251
2252         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2253
2254         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
2255         if (!cp)
2256                 return;
2257
2258         hci_dev_lock(hdev);
2259
2260         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2261
2262         bt_dev_dbg(hdev, "bdaddr %pMR hcon %p", &cp->bdaddr, conn);
2263
2264         if (status) {
2265                 if (conn && conn->state == BT_CONNECT) {
2266                         if (status != 0x0c || conn->attempt > 2) {
2267                                 conn->state = BT_CLOSED;
2268                                 hci_connect_cfm(conn, status);
2269                                 hci_conn_del(conn);
2270                         } else
2271                                 conn->state = BT_CONNECT2;
2272                 }
2273         } else {
2274                 if (!conn) {
2275                         conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr,
2276                                             HCI_ROLE_MASTER);
2277                         if (!conn)
2278                                 bt_dev_err(hdev, "no memory for new connection");
2279                 }
2280         }
2281
2282         hci_dev_unlock(hdev);
2283 }
2284
2285 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
2286 {
2287         struct hci_cp_add_sco *cp;
2288         struct hci_conn *acl, *sco;
2289         __u16 handle;
2290
2291         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2292
2293         if (!status)
2294                 return;
2295
2296         cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
2297         if (!cp)
2298                 return;
2299
2300         handle = __le16_to_cpu(cp->handle);
2301
2302         bt_dev_dbg(hdev, "handle 0x%4.4x", handle);
2303
2304         hci_dev_lock(hdev);
2305
2306         acl = hci_conn_hash_lookup_handle(hdev, handle);
2307         if (acl) {
2308                 sco = acl->link;
2309                 if (sco) {
2310                         sco->state = BT_CLOSED;
2311
2312                         hci_connect_cfm(sco, status);
2313                         hci_conn_del(sco);
2314                 }
2315         }
2316
2317         hci_dev_unlock(hdev);
2318 }
2319
2320 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
2321 {
2322         struct hci_cp_auth_requested *cp;
2323         struct hci_conn *conn;
2324
2325         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2326
2327         if (!status)
2328                 return;
2329
2330         cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
2331         if (!cp)
2332                 return;
2333
2334         hci_dev_lock(hdev);
2335
2336         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2337         if (conn) {
2338                 if (conn->state == BT_CONFIG) {
2339                         hci_connect_cfm(conn, status);
2340                         hci_conn_drop(conn);
2341                 }
2342         }
2343
2344         hci_dev_unlock(hdev);
2345 }
2346
2347 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
2348 {
2349         struct hci_cp_set_conn_encrypt *cp;
2350         struct hci_conn *conn;
2351
2352         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2353
2354         if (!status)
2355                 return;
2356
2357         cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
2358         if (!cp)
2359                 return;
2360
2361         hci_dev_lock(hdev);
2362
2363         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2364         if (conn) {
2365                 if (conn->state == BT_CONFIG) {
2366                         hci_connect_cfm(conn, status);
2367                         hci_conn_drop(conn);
2368                 }
2369         }
2370
2371         hci_dev_unlock(hdev);
2372 }
2373
2374 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
2375                                     struct hci_conn *conn)
2376 {
2377         if (conn->state != BT_CONFIG || !conn->out)
2378                 return 0;
2379
2380         if (conn->pending_sec_level == BT_SECURITY_SDP)
2381                 return 0;
2382
2383         /* Only request authentication for SSP connections or non-SSP
2384          * devices with sec_level MEDIUM or HIGH or if MITM protection
2385          * is requested.
2386          */
2387         if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
2388             conn->pending_sec_level != BT_SECURITY_FIPS &&
2389             conn->pending_sec_level != BT_SECURITY_HIGH &&
2390             conn->pending_sec_level != BT_SECURITY_MEDIUM)
2391                 return 0;
2392
2393         return 1;
2394 }
2395
2396 static int hci_resolve_name(struct hci_dev *hdev,
2397                                    struct inquiry_entry *e)
2398 {
2399         struct hci_cp_remote_name_req cp;
2400
2401         memset(&cp, 0, sizeof(cp));
2402
2403         bacpy(&cp.bdaddr, &e->data.bdaddr);
2404         cp.pscan_rep_mode = e->data.pscan_rep_mode;
2405         cp.pscan_mode = e->data.pscan_mode;
2406         cp.clock_offset = e->data.clock_offset;
2407
2408         return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2409 }
2410
2411 static bool hci_resolve_next_name(struct hci_dev *hdev)
2412 {
2413         struct discovery_state *discov = &hdev->discovery;
2414         struct inquiry_entry *e;
2415
2416         if (list_empty(&discov->resolve))
2417                 return false;
2418
2419         /* We should stop if we already spent too much time resolving names. */
2420         if (time_after(jiffies, discov->name_resolve_timeout)) {
2421                 bt_dev_warn_ratelimited(hdev, "Name resolve takes too long.");
2422                 return false;
2423         }
2424
2425         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
2426         if (!e)
2427                 return false;
2428
2429         if (hci_resolve_name(hdev, e) == 0) {
2430                 e->name_state = NAME_PENDING;
2431                 return true;
2432         }
2433
2434         return false;
2435 }
2436
2437 static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
2438                                    bdaddr_t *bdaddr, u8 *name, u8 name_len)
2439 {
2440         struct discovery_state *discov = &hdev->discovery;
2441         struct inquiry_entry *e;
2442
2443         /* Update the mgmt connected state if necessary. Be careful with
2444          * conn objects that exist but are not (yet) connected however.
2445          * Only those in BT_CONFIG or BT_CONNECTED states can be
2446          * considered connected.
2447          */
2448         if (conn &&
2449             (conn->state == BT_CONFIG || conn->state == BT_CONNECTED) &&
2450             !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2451                 mgmt_device_connected(hdev, conn, name, name_len);
2452
2453         if (discov->state == DISCOVERY_STOPPED)
2454                 return;
2455
2456         if (discov->state == DISCOVERY_STOPPING)
2457                 goto discov_complete;
2458
2459         if (discov->state != DISCOVERY_RESOLVING)
2460                 return;
2461
2462         e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
2463         /* If the device was not found in a list of found devices names of which
2464          * are pending. there is no need to continue resolving a next name as it
2465          * will be done upon receiving another Remote Name Request Complete
2466          * Event */
2467         if (!e)
2468                 return;
2469
2470         list_del(&e->list);
2471
2472         e->name_state = name ? NAME_KNOWN : NAME_NOT_KNOWN;
2473         mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00, e->data.rssi,
2474                          name, name_len);
2475
2476         if (hci_resolve_next_name(hdev))
2477                 return;
2478
2479 discov_complete:
2480         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2481 }
2482
2483 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
2484 {
2485         struct hci_cp_remote_name_req *cp;
2486         struct hci_conn *conn;
2487
2488         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2489
2490         /* If successful wait for the name req complete event before
2491          * checking for the need to do authentication */
2492         if (!status)
2493                 return;
2494
2495         cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
2496         if (!cp)
2497                 return;
2498
2499         hci_dev_lock(hdev);
2500
2501         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2502
2503         if (hci_dev_test_flag(hdev, HCI_MGMT))
2504                 hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
2505
2506         if (!conn)
2507                 goto unlock;
2508
2509         if (!hci_outgoing_auth_needed(hdev, conn))
2510                 goto unlock;
2511
2512         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
2513                 struct hci_cp_auth_requested auth_cp;
2514
2515                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
2516
2517                 auth_cp.handle = __cpu_to_le16(conn->handle);
2518                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
2519                              sizeof(auth_cp), &auth_cp);
2520         }
2521
2522 unlock:
2523         hci_dev_unlock(hdev);
2524 }
2525
2526 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
2527 {
2528         struct hci_cp_read_remote_features *cp;
2529         struct hci_conn *conn;
2530
2531         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2532
2533         if (!status)
2534                 return;
2535
2536         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
2537         if (!cp)
2538                 return;
2539
2540         hci_dev_lock(hdev);
2541
2542         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2543         if (conn) {
2544                 if (conn->state == BT_CONFIG) {
2545                         hci_connect_cfm(conn, status);
2546                         hci_conn_drop(conn);
2547                 }
2548         }
2549
2550         hci_dev_unlock(hdev);
2551 }
2552
2553 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
2554 {
2555         struct hci_cp_read_remote_ext_features *cp;
2556         struct hci_conn *conn;
2557
2558         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2559
2560         if (!status)
2561                 return;
2562
2563         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
2564         if (!cp)
2565                 return;
2566
2567         hci_dev_lock(hdev);
2568
2569         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2570         if (conn) {
2571                 if (conn->state == BT_CONFIG) {
2572                         hci_connect_cfm(conn, status);
2573                         hci_conn_drop(conn);
2574                 }
2575         }
2576
2577         hci_dev_unlock(hdev);
2578 }
2579
2580 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
2581 {
2582         struct hci_cp_setup_sync_conn *cp;
2583         struct hci_conn *acl, *sco;
2584         __u16 handle;
2585
2586         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2587
2588         if (!status)
2589                 return;
2590
2591         cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
2592         if (!cp)
2593                 return;
2594
2595         handle = __le16_to_cpu(cp->handle);
2596
2597         bt_dev_dbg(hdev, "handle 0x%4.4x", handle);
2598
2599         hci_dev_lock(hdev);
2600
2601         acl = hci_conn_hash_lookup_handle(hdev, handle);
2602         if (acl) {
2603                 sco = acl->link;
2604                 if (sco) {
2605                         sco->state = BT_CLOSED;
2606
2607                         hci_connect_cfm(sco, status);
2608                         hci_conn_del(sco);
2609                 }
2610         }
2611
2612         hci_dev_unlock(hdev);
2613 }
2614
2615 static void hci_cs_enhanced_setup_sync_conn(struct hci_dev *hdev, __u8 status)
2616 {
2617         struct hci_cp_enhanced_setup_sync_conn *cp;
2618         struct hci_conn *acl, *sco;
2619         __u16 handle;
2620
2621         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2622
2623         if (!status)
2624                 return;
2625
2626         cp = hci_sent_cmd_data(hdev, HCI_OP_ENHANCED_SETUP_SYNC_CONN);
2627         if (!cp)
2628                 return;
2629
2630         handle = __le16_to_cpu(cp->handle);
2631
2632         bt_dev_dbg(hdev, "handle 0x%4.4x", handle);
2633
2634         hci_dev_lock(hdev);
2635
2636         acl = hci_conn_hash_lookup_handle(hdev, handle);
2637         if (acl) {
2638                 sco = acl->link;
2639                 if (sco) {
2640                         sco->state = BT_CLOSED;
2641
2642                         hci_connect_cfm(sco, status);
2643                         hci_conn_del(sco);
2644                 }
2645         }
2646
2647         hci_dev_unlock(hdev);
2648 }
2649
2650 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
2651 {
2652         struct hci_cp_sniff_mode *cp;
2653         struct hci_conn *conn;
2654
2655         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2656
2657         if (!status)
2658                 return;
2659
2660         cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
2661         if (!cp)
2662                 return;
2663
2664         hci_dev_lock(hdev);
2665
2666         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2667         if (conn) {
2668                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
2669
2670                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2671                         hci_sco_setup(conn, status);
2672         }
2673
2674         hci_dev_unlock(hdev);
2675 }
2676
2677 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
2678 {
2679         struct hci_cp_exit_sniff_mode *cp;
2680         struct hci_conn *conn;
2681
2682         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2683
2684         if (!status)
2685                 return;
2686
2687         cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
2688         if (!cp)
2689                 return;
2690
2691         hci_dev_lock(hdev);
2692
2693         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2694         if (conn) {
2695                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
2696
2697                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2698                         hci_sco_setup(conn, status);
2699         }
2700
2701         hci_dev_unlock(hdev);
2702 }
2703
2704 static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
2705 {
2706         struct hci_cp_disconnect *cp;
2707         struct hci_conn_params *params;
2708         struct hci_conn *conn;
2709         bool mgmt_conn;
2710
2711         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2712
2713         /* Wait for HCI_EV_DISCONN_COMPLETE if status 0x00 and not suspended
2714          * otherwise cleanup the connection immediately.
2715          */
2716         if (!status && !hdev->suspended)
2717                 return;
2718
2719         cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
2720         if (!cp)
2721                 return;
2722
2723         hci_dev_lock(hdev);
2724
2725         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2726         if (!conn)
2727                 goto unlock;
2728
2729         if (status) {
2730                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2731                                        conn->dst_type, status);
2732
2733                 if (conn->type == LE_LINK && conn->role == HCI_ROLE_SLAVE) {
2734                         hdev->cur_adv_instance = conn->adv_instance;
2735                         hci_enable_advertising(hdev);
2736                 }
2737
2738                 goto done;
2739         }
2740
2741         mgmt_conn = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags);
2742
2743         if (conn->type == ACL_LINK) {
2744                 if (test_and_clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
2745                         hci_remove_link_key(hdev, &conn->dst);
2746         }
2747
2748         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
2749         if (params) {
2750                 switch (params->auto_connect) {
2751                 case HCI_AUTO_CONN_LINK_LOSS:
2752                         if (cp->reason != HCI_ERROR_CONNECTION_TIMEOUT)
2753                                 break;
2754                         fallthrough;
2755
2756                 case HCI_AUTO_CONN_DIRECT:
2757                 case HCI_AUTO_CONN_ALWAYS:
2758                         list_del_init(&params->action);
2759                         list_add(&params->action, &hdev->pend_le_conns);
2760                         break;
2761
2762                 default:
2763                         break;
2764                 }
2765         }
2766
2767         mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type,
2768                                  cp->reason, mgmt_conn);
2769
2770         hci_disconn_cfm(conn, cp->reason);
2771
2772 done:
2773         /* If the disconnection failed for any reason, the upper layer
2774          * does not retry to disconnect in current implementation.
2775          * Hence, we need to do some basic cleanup here and re-enable
2776          * advertising if necessary.
2777          */
2778         hci_conn_del(conn);
2779 unlock:
2780         hci_dev_unlock(hdev);
2781 }
2782
2783 static u8 ev_bdaddr_type(struct hci_dev *hdev, u8 type, bool *resolved)
2784 {
2785         /* When using controller based address resolution, then the new
2786          * address types 0x02 and 0x03 are used. These types need to be
2787          * converted back into either public address or random address type
2788          */
2789         switch (type) {
2790         case ADDR_LE_DEV_PUBLIC_RESOLVED:
2791                 if (resolved)
2792                         *resolved = true;
2793                 return ADDR_LE_DEV_PUBLIC;
2794         case ADDR_LE_DEV_RANDOM_RESOLVED:
2795                 if (resolved)
2796                         *resolved = true;
2797                 return ADDR_LE_DEV_RANDOM;
2798         }
2799
2800         if (resolved)
2801                 *resolved = false;
2802         return type;
2803 }
2804
2805 static void cs_le_create_conn(struct hci_dev *hdev, bdaddr_t *peer_addr,
2806                               u8 peer_addr_type, u8 own_address_type,
2807                               u8 filter_policy)
2808 {
2809         struct hci_conn *conn;
2810
2811         conn = hci_conn_hash_lookup_le(hdev, peer_addr,
2812                                        peer_addr_type);
2813         if (!conn)
2814                 return;
2815
2816         own_address_type = ev_bdaddr_type(hdev, own_address_type, NULL);
2817
2818         /* Store the initiator and responder address information which
2819          * is needed for SMP. These values will not change during the
2820          * lifetime of the connection.
2821          */
2822         conn->init_addr_type = own_address_type;
2823         if (own_address_type == ADDR_LE_DEV_RANDOM)
2824                 bacpy(&conn->init_addr, &hdev->random_addr);
2825         else
2826                 bacpy(&conn->init_addr, &hdev->bdaddr);
2827
2828         conn->resp_addr_type = peer_addr_type;
2829         bacpy(&conn->resp_addr, peer_addr);
2830
2831         /* We don't want the connection attempt to stick around
2832          * indefinitely since LE doesn't have a page timeout concept
2833          * like BR/EDR. Set a timer for any connection that doesn't use
2834          * the accept list for connecting.
2835          */
2836         if (filter_policy == HCI_LE_USE_PEER_ADDR)
2837                 queue_delayed_work(conn->hdev->workqueue,
2838                                    &conn->le_conn_timeout,
2839                                    conn->conn_timeout);
2840 }
2841
2842 static void hci_cs_le_create_conn(struct hci_dev *hdev, u8 status)
2843 {
2844         struct hci_cp_le_create_conn *cp;
2845
2846         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2847
2848         /* All connection failure handling is taken care of by the
2849          * hci_conn_failed function which is triggered by the HCI
2850          * request completion callbacks used for connecting.
2851          */
2852         if (status)
2853                 return;
2854
2855         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
2856         if (!cp)
2857                 return;
2858
2859         hci_dev_lock(hdev);
2860
2861         cs_le_create_conn(hdev, &cp->peer_addr, cp->peer_addr_type,
2862                           cp->own_address_type, cp->filter_policy);
2863
2864         hci_dev_unlock(hdev);
2865 }
2866
2867 static void hci_cs_le_ext_create_conn(struct hci_dev *hdev, u8 status)
2868 {
2869         struct hci_cp_le_ext_create_conn *cp;
2870
2871         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2872
2873         /* All connection failure handling is taken care of by the
2874          * hci_conn_failed function which is triggered by the HCI
2875          * request completion callbacks used for connecting.
2876          */
2877         if (status)
2878                 return;
2879
2880         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_EXT_CREATE_CONN);
2881         if (!cp)
2882                 return;
2883
2884         hci_dev_lock(hdev);
2885
2886         cs_le_create_conn(hdev, &cp->peer_addr, cp->peer_addr_type,
2887                           cp->own_addr_type, cp->filter_policy);
2888
2889         hci_dev_unlock(hdev);
2890 }
2891
2892 static void hci_cs_le_read_remote_features(struct hci_dev *hdev, u8 status)
2893 {
2894         struct hci_cp_le_read_remote_features *cp;
2895         struct hci_conn *conn;
2896
2897         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2898
2899         if (!status)
2900                 return;
2901
2902         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_READ_REMOTE_FEATURES);
2903         if (!cp)
2904                 return;
2905
2906         hci_dev_lock(hdev);
2907
2908         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2909         if (conn) {
2910                 if (conn->state == BT_CONFIG) {
2911                         hci_connect_cfm(conn, status);
2912                         hci_conn_drop(conn);
2913                 }
2914         }
2915
2916         hci_dev_unlock(hdev);
2917 }
2918
2919 static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
2920 {
2921         struct hci_cp_le_start_enc *cp;
2922         struct hci_conn *conn;
2923
2924         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2925
2926         if (!status)
2927                 return;
2928
2929         hci_dev_lock(hdev);
2930
2931         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_START_ENC);
2932         if (!cp)
2933                 goto unlock;
2934
2935         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2936         if (!conn)
2937                 goto unlock;
2938
2939         if (conn->state != BT_CONNECTED)
2940                 goto unlock;
2941
2942         hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2943         hci_conn_drop(conn);
2944
2945 unlock:
2946         hci_dev_unlock(hdev);
2947 }
2948
2949 static void hci_cs_switch_role(struct hci_dev *hdev, u8 status)
2950 {
2951         struct hci_cp_switch_role *cp;
2952         struct hci_conn *conn;
2953
2954         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2955
2956         if (!status)
2957                 return;
2958
2959         cp = hci_sent_cmd_data(hdev, HCI_OP_SWITCH_ROLE);
2960         if (!cp)
2961                 return;
2962
2963         hci_dev_lock(hdev);
2964
2965         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2966         if (conn)
2967                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
2968
2969         hci_dev_unlock(hdev);
2970 }
2971
2972 static void hci_inquiry_complete_evt(struct hci_dev *hdev, void *data,
2973                                      struct sk_buff *skb)
2974 {
2975         struct hci_ev_status *ev = data;
2976         struct discovery_state *discov = &hdev->discovery;
2977         struct inquiry_entry *e;
2978
2979         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
2980
2981         hci_conn_check_pending(hdev);
2982
2983         if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
2984                 return;
2985
2986         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
2987         wake_up_bit(&hdev->flags, HCI_INQUIRY);
2988
2989         if (!hci_dev_test_flag(hdev, HCI_MGMT))
2990                 return;
2991
2992         hci_dev_lock(hdev);
2993
2994         if (discov->state != DISCOVERY_FINDING)
2995                 goto unlock;
2996
2997         if (list_empty(&discov->resolve)) {
2998                 /* When BR/EDR inquiry is active and no LE scanning is in
2999                  * progress, then change discovery state to indicate completion.
3000                  *
3001                  * When running LE scanning and BR/EDR inquiry simultaneously
3002                  * and the LE scan already finished, then change the discovery
3003                  * state to indicate completion.
3004                  */
3005                 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
3006                     !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
3007                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3008                 goto unlock;
3009         }
3010
3011         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
3012         if (e && hci_resolve_name(hdev, e) == 0) {
3013                 e->name_state = NAME_PENDING;
3014                 hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
3015                 discov->name_resolve_timeout = jiffies + NAME_RESOLVE_DURATION;
3016         } else {
3017                 /* When BR/EDR inquiry is active and no LE scanning is in
3018                  * progress, then change discovery state to indicate completion.
3019                  *
3020                  * When running LE scanning and BR/EDR inquiry simultaneously
3021                  * and the LE scan already finished, then change the discovery
3022                  * state to indicate completion.
3023                  */
3024                 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
3025                     !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
3026                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3027         }
3028
3029 unlock:
3030         hci_dev_unlock(hdev);
3031 }
3032
3033 static void hci_inquiry_result_evt(struct hci_dev *hdev, void *edata,
3034                                    struct sk_buff *skb)
3035 {
3036         struct hci_ev_inquiry_result *ev = edata;
3037         struct inquiry_data data;
3038         int i;
3039
3040         if (!hci_ev_skb_pull(hdev, skb, HCI_EV_INQUIRY_RESULT,
3041                              flex_array_size(ev, info, ev->num)))
3042                 return;
3043
3044         bt_dev_dbg(hdev, "num %d", ev->num);
3045
3046         if (!ev->num)
3047                 return;
3048
3049         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
3050                 return;
3051
3052         hci_dev_lock(hdev);
3053
3054         for (i = 0; i < ev->num; i++) {
3055                 struct inquiry_info *info = &ev->info[i];
3056                 u32 flags;
3057
3058                 bacpy(&data.bdaddr, &info->bdaddr);
3059                 data.pscan_rep_mode     = info->pscan_rep_mode;
3060                 data.pscan_period_mode  = info->pscan_period_mode;
3061                 data.pscan_mode         = info->pscan_mode;
3062                 memcpy(data.dev_class, info->dev_class, 3);
3063                 data.clock_offset       = info->clock_offset;
3064                 data.rssi               = HCI_RSSI_INVALID;
3065                 data.ssp_mode           = 0x00;
3066
3067                 flags = hci_inquiry_cache_update(hdev, &data, false);
3068
3069                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
3070                                   info->dev_class, HCI_RSSI_INVALID,
3071                                   flags, NULL, 0, NULL, 0);
3072         }
3073
3074         hci_dev_unlock(hdev);
3075 }
3076
3077 static void hci_conn_complete_evt(struct hci_dev *hdev, void *data,
3078                                   struct sk_buff *skb)
3079 {
3080         struct hci_ev_conn_complete *ev = data;
3081         struct hci_conn *conn;
3082         u8 status = ev->status;
3083
3084         bt_dev_dbg(hdev, "status 0x%2.2x", status);
3085
3086         hci_dev_lock(hdev);
3087
3088         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
3089         if (!conn) {
3090                 /* In case of error status and there is no connection pending
3091                  * just unlock as there is nothing to cleanup.
3092                  */
3093                 if (ev->status)
3094                         goto unlock;
3095
3096                 /* Connection may not exist if auto-connected. Check the bredr
3097                  * allowlist to see if this device is allowed to auto connect.
3098                  * If link is an ACL type, create a connection class
3099                  * automatically.
3100                  *
3101                  * Auto-connect will only occur if the event filter is
3102                  * programmed with a given address. Right now, event filter is
3103                  * only used during suspend.
3104                  */
3105                 if (ev->link_type == ACL_LINK &&
3106                     hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
3107                                                       &ev->bdaddr,
3108                                                       BDADDR_BREDR)) {
3109                         conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr,
3110                                             HCI_ROLE_SLAVE);
3111                         if (!conn) {
3112                                 bt_dev_err(hdev, "no memory for new conn");
3113                                 goto unlock;
3114                         }
3115                 } else {
3116                         if (ev->link_type != SCO_LINK)
3117                                 goto unlock;
3118
3119                         conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK,
3120                                                        &ev->bdaddr);
3121                         if (!conn)
3122                                 goto unlock;
3123
3124                         conn->type = SCO_LINK;
3125                 }
3126         }
3127
3128         /* The HCI_Connection_Complete event is only sent once per connection.
3129          * Processing it more than once per connection can corrupt kernel memory.
3130          *
3131          * As the connection handle is set here for the first time, it indicates
3132          * whether the connection is already set up.
3133          */
3134         if (conn->handle != HCI_CONN_HANDLE_UNSET) {
3135                 bt_dev_err(hdev, "Ignoring HCI_Connection_Complete for existing connection");
3136                 goto unlock;
3137         }
3138
3139         if (!status) {
3140                 conn->handle = __le16_to_cpu(ev->handle);
3141                 if (conn->handle > HCI_CONN_HANDLE_MAX) {
3142                         bt_dev_err(hdev, "Invalid handle: 0x%4.4x > 0x%4.4x",
3143                                    conn->handle, HCI_CONN_HANDLE_MAX);
3144                         status = HCI_ERROR_INVALID_PARAMETERS;
3145                         goto done;
3146                 }
3147
3148                 if (conn->type == ACL_LINK) {
3149                         conn->state = BT_CONFIG;
3150                         hci_conn_hold(conn);
3151
3152                         if (!conn->out && !hci_conn_ssp_enabled(conn) &&
3153                             !hci_find_link_key(hdev, &ev->bdaddr))
3154                                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
3155                         else
3156                                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3157                 } else
3158                         conn->state = BT_CONNECTED;
3159
3160                 hci_debugfs_create_conn(conn);
3161                 hci_conn_add_sysfs(conn);
3162
3163                 if (test_bit(HCI_AUTH, &hdev->flags))
3164                         set_bit(HCI_CONN_AUTH, &conn->flags);
3165
3166                 if (test_bit(HCI_ENCRYPT, &hdev->flags))
3167                         set_bit(HCI_CONN_ENCRYPT, &conn->flags);
3168
3169                 /* Get remote features */
3170                 if (conn->type == ACL_LINK) {
3171                         struct hci_cp_read_remote_features cp;
3172                         cp.handle = ev->handle;
3173                         hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
3174                                      sizeof(cp), &cp);
3175
3176                         hci_update_scan(hdev);
3177                 }
3178
3179                 /* Set packet type for incoming connection */
3180                 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
3181                         struct hci_cp_change_conn_ptype cp;
3182                         cp.handle = ev->handle;
3183                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
3184                         hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
3185                                      &cp);
3186                 }
3187         }
3188
3189         if (conn->type == ACL_LINK)
3190                 hci_sco_setup(conn, ev->status);
3191
3192 done:
3193         if (status) {
3194                 hci_conn_failed(conn, status);
3195         } else if (ev->link_type == SCO_LINK) {
3196                 switch (conn->setting & SCO_AIRMODE_MASK) {
3197                 case SCO_AIRMODE_CVSD:
3198                         if (hdev->notify)
3199                                 hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_CVSD);
3200                         break;
3201                 }
3202
3203                 hci_connect_cfm(conn, status);
3204         }
3205
3206 unlock:
3207         hci_dev_unlock(hdev);
3208
3209         hci_conn_check_pending(hdev);
3210 }
3211
3212 static void hci_reject_conn(struct hci_dev *hdev, bdaddr_t *bdaddr)
3213 {
3214         struct hci_cp_reject_conn_req cp;
3215
3216         bacpy(&cp.bdaddr, bdaddr);
3217         cp.reason = HCI_ERROR_REJ_BAD_ADDR;
3218         hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
3219 }
3220
3221 static void hci_conn_request_evt(struct hci_dev *hdev, void *data,
3222                                  struct sk_buff *skb)
3223 {
3224         struct hci_ev_conn_request *ev = data;
3225         int mask = hdev->link_mode;
3226         struct inquiry_entry *ie;
3227         struct hci_conn *conn;
3228         __u8 flags = 0;
3229
3230         bt_dev_dbg(hdev, "bdaddr %pMR type 0x%x", &ev->bdaddr, ev->link_type);
3231
3232         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
3233                                       &flags);
3234
3235         if (!(mask & HCI_LM_ACCEPT)) {
3236                 hci_reject_conn(hdev, &ev->bdaddr);
3237                 return;
3238         }
3239
3240         hci_dev_lock(hdev);
3241
3242         if (hci_bdaddr_list_lookup(&hdev->reject_list, &ev->bdaddr,
3243                                    BDADDR_BREDR)) {
3244                 hci_reject_conn(hdev, &ev->bdaddr);
3245                 goto unlock;
3246         }
3247
3248         /* Require HCI_CONNECTABLE or an accept list entry to accept the
3249          * connection. These features are only touched through mgmt so
3250          * only do the checks if HCI_MGMT is set.
3251          */
3252         if (hci_dev_test_flag(hdev, HCI_MGMT) &&
3253             !hci_dev_test_flag(hdev, HCI_CONNECTABLE) &&
3254             !hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, &ev->bdaddr,
3255                                                BDADDR_BREDR)) {
3256                 hci_reject_conn(hdev, &ev->bdaddr);
3257                 goto unlock;
3258         }
3259
3260         /* Connection accepted */
3261
3262         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
3263         if (ie)
3264                 memcpy(ie->data.dev_class, ev->dev_class, 3);
3265
3266         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
3267                         &ev->bdaddr);
3268         if (!conn) {
3269                 conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr,
3270                                     HCI_ROLE_SLAVE);
3271                 if (!conn) {
3272                         bt_dev_err(hdev, "no memory for new connection");
3273                         goto unlock;
3274                 }
3275         }
3276
3277         memcpy(conn->dev_class, ev->dev_class, 3);
3278
3279         hci_dev_unlock(hdev);
3280
3281         if (ev->link_type == ACL_LINK ||
3282             (!(flags & HCI_PROTO_DEFER) && !lmp_esco_capable(hdev))) {
3283                 struct hci_cp_accept_conn_req cp;
3284                 conn->state = BT_CONNECT;
3285
3286                 bacpy(&cp.bdaddr, &ev->bdaddr);
3287
3288                 if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
3289                         cp.role = 0x00; /* Become central */
3290                 else
3291                         cp.role = 0x01; /* Remain peripheral */
3292
3293                 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
3294         } else if (!(flags & HCI_PROTO_DEFER)) {
3295                 struct hci_cp_accept_sync_conn_req cp;
3296                 conn->state = BT_CONNECT;
3297
3298                 bacpy(&cp.bdaddr, &ev->bdaddr);
3299                 cp.pkt_type = cpu_to_le16(conn->pkt_type);
3300
3301                 cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
3302                 cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
3303                 cp.max_latency    = cpu_to_le16(0xffff);
3304                 cp.content_format = cpu_to_le16(hdev->voice_setting);
3305                 cp.retrans_effort = 0xff;
3306
3307                 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ, sizeof(cp),
3308                              &cp);
3309         } else {
3310                 conn->state = BT_CONNECT2;
3311                 hci_connect_cfm(conn, 0);
3312         }
3313
3314         return;
3315 unlock:
3316         hci_dev_unlock(hdev);
3317 }
3318
3319 static u8 hci_to_mgmt_reason(u8 err)
3320 {
3321         switch (err) {
3322         case HCI_ERROR_CONNECTION_TIMEOUT:
3323                 return MGMT_DEV_DISCONN_TIMEOUT;
3324         case HCI_ERROR_REMOTE_USER_TERM:
3325         case HCI_ERROR_REMOTE_LOW_RESOURCES:
3326         case HCI_ERROR_REMOTE_POWER_OFF:
3327                 return MGMT_DEV_DISCONN_REMOTE;
3328         case HCI_ERROR_LOCAL_HOST_TERM:
3329                 return MGMT_DEV_DISCONN_LOCAL_HOST;
3330         default:
3331                 return MGMT_DEV_DISCONN_UNKNOWN;
3332         }
3333 }
3334
3335 static void hci_disconn_complete_evt(struct hci_dev *hdev, void *data,
3336                                      struct sk_buff *skb)
3337 {
3338         struct hci_ev_disconn_complete *ev = data;
3339         u8 reason;
3340         struct hci_conn_params *params;
3341         struct hci_conn *conn;
3342         bool mgmt_connected;
3343
3344         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
3345
3346         hci_dev_lock(hdev);
3347
3348         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3349         if (!conn)
3350                 goto unlock;
3351
3352         if (ev->status) {
3353                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
3354                                        conn->dst_type, ev->status);
3355                 goto unlock;
3356         }
3357
3358         conn->state = BT_CLOSED;
3359
3360         mgmt_connected = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags);
3361
3362         if (test_bit(HCI_CONN_AUTH_FAILURE, &conn->flags))
3363                 reason = MGMT_DEV_DISCONN_AUTH_FAILURE;
3364         else
3365                 reason = hci_to_mgmt_reason(ev->reason);
3366
3367         mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type,
3368                                 reason, mgmt_connected);
3369
3370         if (conn->type == ACL_LINK) {
3371                 if (test_and_clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
3372                         hci_remove_link_key(hdev, &conn->dst);
3373
3374                 hci_update_scan(hdev);
3375         }
3376
3377         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
3378         if (params) {
3379                 switch (params->auto_connect) {
3380                 case HCI_AUTO_CONN_LINK_LOSS:
3381                         if (ev->reason != HCI_ERROR_CONNECTION_TIMEOUT)
3382                                 break;
3383                         fallthrough;
3384
3385                 case HCI_AUTO_CONN_DIRECT:
3386                 case HCI_AUTO_CONN_ALWAYS:
3387                         list_del_init(&params->action);
3388                         list_add(&params->action, &hdev->pend_le_conns);
3389                         hci_update_passive_scan(hdev);
3390                         break;
3391
3392                 default:
3393                         break;
3394                 }
3395         }
3396
3397         hci_disconn_cfm(conn, ev->reason);
3398
3399         /* Re-enable advertising if necessary, since it might
3400          * have been disabled by the connection. From the
3401          * HCI_LE_Set_Advertise_Enable command description in
3402          * the core specification (v4.0):
3403          * "The Controller shall continue advertising until the Host
3404          * issues an LE_Set_Advertise_Enable command with
3405          * Advertising_Enable set to 0x00 (Advertising is disabled)
3406          * or until a connection is created or until the Advertising
3407          * is timed out due to Directed Advertising."
3408          */
3409         if (conn->type == LE_LINK && conn->role == HCI_ROLE_SLAVE) {
3410                 hdev->cur_adv_instance = conn->adv_instance;
3411                 hci_enable_advertising(hdev);
3412         }
3413
3414         hci_conn_del(conn);
3415
3416 unlock:
3417         hci_dev_unlock(hdev);
3418 }
3419
3420 static void hci_auth_complete_evt(struct hci_dev *hdev, void *data,
3421                                   struct sk_buff *skb)
3422 {
3423         struct hci_ev_auth_complete *ev = data;
3424         struct hci_conn *conn;
3425
3426         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
3427
3428         hci_dev_lock(hdev);
3429
3430         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3431         if (!conn)
3432                 goto unlock;
3433
3434         if (!ev->status) {
3435                 clear_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
3436
3437                 if (!hci_conn_ssp_enabled(conn) &&
3438                     test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
3439                         bt_dev_info(hdev, "re-auth of legacy device is not possible.");
3440                 } else {
3441                         set_bit(HCI_CONN_AUTH, &conn->flags);
3442                         conn->sec_level = conn->pending_sec_level;
3443                 }
3444         } else {
3445                 if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
3446                         set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
3447
3448                 mgmt_auth_failed(conn, ev->status);
3449         }
3450
3451         clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
3452         clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
3453
3454         if (conn->state == BT_CONFIG) {
3455                 if (!ev->status && hci_conn_ssp_enabled(conn)) {
3456                         struct hci_cp_set_conn_encrypt cp;
3457                         cp.handle  = ev->handle;
3458                         cp.encrypt = 0x01;
3459                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
3460                                      &cp);
3461                 } else {
3462                         conn->state = BT_CONNECTED;
3463                         hci_connect_cfm(conn, ev->status);
3464                         hci_conn_drop(conn);
3465                 }
3466         } else {
3467                 hci_auth_cfm(conn, ev->status);
3468
3469                 hci_conn_hold(conn);
3470                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3471                 hci_conn_drop(conn);
3472         }
3473
3474         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
3475                 if (!ev->status) {
3476                         struct hci_cp_set_conn_encrypt cp;
3477                         cp.handle  = ev->handle;
3478                         cp.encrypt = 0x01;
3479                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
3480                                      &cp);
3481                 } else {
3482                         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3483                         hci_encrypt_cfm(conn, ev->status);
3484                 }
3485         }
3486
3487 unlock:
3488         hci_dev_unlock(hdev);
3489 }
3490
3491 static void hci_remote_name_evt(struct hci_dev *hdev, void *data,
3492                                 struct sk_buff *skb)
3493 {
3494         struct hci_ev_remote_name *ev = data;
3495         struct hci_conn *conn;
3496
3497         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
3498
3499         hci_conn_check_pending(hdev);
3500
3501         hci_dev_lock(hdev);
3502
3503         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3504
3505         if (!hci_dev_test_flag(hdev, HCI_MGMT))
3506                 goto check_auth;
3507
3508         if (ev->status == 0)
3509                 hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
3510                                        strnlen(ev->name, HCI_MAX_NAME_LENGTH));
3511         else
3512                 hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
3513
3514 check_auth:
3515         if (!conn)
3516                 goto unlock;
3517
3518         if (!hci_outgoing_auth_needed(hdev, conn))
3519                 goto unlock;
3520
3521         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
3522                 struct hci_cp_auth_requested cp;
3523
3524                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
3525
3526                 cp.handle = __cpu_to_le16(conn->handle);
3527                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
3528         }
3529
3530 unlock:
3531         hci_dev_unlock(hdev);
3532 }
3533
3534 static void read_enc_key_size_complete(struct hci_dev *hdev, u8 status,
3535                                        u16 opcode, struct sk_buff *skb)
3536 {
3537         const struct hci_rp_read_enc_key_size *rp;
3538         struct hci_conn *conn;
3539         u16 handle;
3540
3541         BT_DBG("%s status 0x%02x", hdev->name, status);
3542
3543         if (!skb || skb->len < sizeof(*rp)) {
3544                 bt_dev_err(hdev, "invalid read key size response");
3545                 return;
3546         }
3547
3548         rp = (void *)skb->data;
3549         handle = le16_to_cpu(rp->handle);
3550
3551         hci_dev_lock(hdev);
3552
3553         conn = hci_conn_hash_lookup_handle(hdev, handle);
3554         if (!conn)
3555                 goto unlock;
3556
3557         /* While unexpected, the read_enc_key_size command may fail. The most
3558          * secure approach is to then assume the key size is 0 to force a
3559          * disconnection.
3560          */
3561         if (rp->status) {
3562                 bt_dev_err(hdev, "failed to read key size for handle %u",
3563                            handle);
3564                 conn->enc_key_size = 0;
3565         } else {
3566                 conn->enc_key_size = rp->key_size;
3567         }
3568
3569         hci_encrypt_cfm(conn, 0);
3570
3571 unlock:
3572         hci_dev_unlock(hdev);
3573 }
3574
3575 static void hci_encrypt_change_evt(struct hci_dev *hdev, void *data,
3576                                    struct sk_buff *skb)
3577 {
3578         struct hci_ev_encrypt_change *ev = data;
3579         struct hci_conn *conn;
3580
3581         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
3582
3583         hci_dev_lock(hdev);
3584
3585         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3586         if (!conn)
3587                 goto unlock;
3588
3589         if (!ev->status) {
3590                 if (ev->encrypt) {
3591                         /* Encryption implies authentication */
3592                         set_bit(HCI_CONN_AUTH, &conn->flags);
3593                         set_bit(HCI_CONN_ENCRYPT, &conn->flags);
3594                         conn->sec_level = conn->pending_sec_level;
3595
3596                         /* P-256 authentication key implies FIPS */
3597                         if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256)
3598                                 set_bit(HCI_CONN_FIPS, &conn->flags);
3599
3600                         if ((conn->type == ACL_LINK && ev->encrypt == 0x02) ||
3601                             conn->type == LE_LINK)
3602                                 set_bit(HCI_CONN_AES_CCM, &conn->flags);
3603                 } else {
3604                         clear_bit(HCI_CONN_ENCRYPT, &conn->flags);
3605                         clear_bit(HCI_CONN_AES_CCM, &conn->flags);
3606                 }
3607         }
3608
3609         /* We should disregard the current RPA and generate a new one
3610          * whenever the encryption procedure fails.
3611          */
3612         if (ev->status && conn->type == LE_LINK) {
3613                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
3614                 hci_adv_instances_set_rpa_expired(hdev, true);
3615         }
3616
3617         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3618
3619         /* Check link security requirements are met */
3620         if (!hci_conn_check_link_mode(conn))
3621                 ev->status = HCI_ERROR_AUTH_FAILURE;
3622
3623         if (ev->status && conn->state == BT_CONNECTED) {
3624                 if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
3625                         set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
3626
3627                 /* Notify upper layers so they can cleanup before
3628                  * disconnecting.
3629                  */
3630                 hci_encrypt_cfm(conn, ev->status);
3631                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
3632                 hci_conn_drop(conn);
3633                 goto unlock;
3634         }
3635
3636         /* Try reading the encryption key size for encrypted ACL links */
3637         if (!ev->status && ev->encrypt && conn->type == ACL_LINK) {
3638                 struct hci_cp_read_enc_key_size cp;
3639                 struct hci_request req;
3640
3641                 /* Only send HCI_Read_Encryption_Key_Size if the
3642                  * controller really supports it. If it doesn't, assume
3643                  * the default size (16).
3644                  */
3645                 if (!(hdev->commands[20] & 0x10)) {
3646                         conn->enc_key_size = HCI_LINK_KEY_SIZE;
3647                         goto notify;
3648                 }
3649
3650                 hci_req_init(&req, hdev);
3651
3652                 cp.handle = cpu_to_le16(conn->handle);
3653                 hci_req_add(&req, HCI_OP_READ_ENC_KEY_SIZE, sizeof(cp), &cp);
3654
3655                 if (hci_req_run_skb(&req, read_enc_key_size_complete)) {
3656                         bt_dev_err(hdev, "sending read key size failed");
3657                         conn->enc_key_size = HCI_LINK_KEY_SIZE;
3658                         goto notify;
3659                 }
3660
3661                 goto unlock;
3662         }
3663
3664         /* Set the default Authenticated Payload Timeout after
3665          * an LE Link is established. As per Core Spec v5.0, Vol 2, Part B
3666          * Section 3.3, the HCI command WRITE_AUTH_PAYLOAD_TIMEOUT should be
3667          * sent when the link is active and Encryption is enabled, the conn
3668          * type can be either LE or ACL and controller must support LMP Ping.
3669          * Ensure for AES-CCM encryption as well.
3670          */
3671         if (test_bit(HCI_CONN_ENCRYPT, &conn->flags) &&
3672             test_bit(HCI_CONN_AES_CCM, &conn->flags) &&
3673             ((conn->type == ACL_LINK && lmp_ping_capable(hdev)) ||
3674              (conn->type == LE_LINK && (hdev->le_features[0] & HCI_LE_PING)))) {
3675                 struct hci_cp_write_auth_payload_to cp;
3676
3677                 cp.handle = cpu_to_le16(conn->handle);
3678                 cp.timeout = cpu_to_le16(hdev->auth_payload_timeout);
3679                 hci_send_cmd(conn->hdev, HCI_OP_WRITE_AUTH_PAYLOAD_TO,
3680                              sizeof(cp), &cp);
3681         }
3682
3683 notify:
3684         hci_encrypt_cfm(conn, ev->status);
3685
3686 unlock:
3687         hci_dev_unlock(hdev);
3688 }
3689
3690 static void hci_change_link_key_complete_evt(struct hci_dev *hdev, void *data,
3691                                              struct sk_buff *skb)
3692 {
3693         struct hci_ev_change_link_key_complete *ev = data;
3694         struct hci_conn *conn;
3695
3696         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
3697
3698         hci_dev_lock(hdev);
3699
3700         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3701         if (conn) {
3702                 if (!ev->status)
3703                         set_bit(HCI_CONN_SECURE, &conn->flags);
3704
3705                 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
3706
3707                 hci_key_change_cfm(conn, ev->status);
3708         }
3709
3710         hci_dev_unlock(hdev);
3711 }
3712
3713 static void hci_remote_features_evt(struct hci_dev *hdev, void *data,
3714                                     struct sk_buff *skb)
3715 {
3716         struct hci_ev_remote_features *ev = data;
3717         struct hci_conn *conn;
3718
3719         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
3720
3721         hci_dev_lock(hdev);
3722
3723         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3724         if (!conn)
3725                 goto unlock;
3726
3727         if (!ev->status)
3728                 memcpy(conn->features[0], ev->features, 8);
3729
3730         if (conn->state != BT_CONFIG)
3731                 goto unlock;
3732
3733         if (!ev->status && lmp_ext_feat_capable(hdev) &&
3734             lmp_ext_feat_capable(conn)) {
3735                 struct hci_cp_read_remote_ext_features cp;
3736                 cp.handle = ev->handle;
3737                 cp.page = 0x01;
3738                 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
3739                              sizeof(cp), &cp);
3740                 goto unlock;
3741         }
3742
3743         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
3744                 struct hci_cp_remote_name_req cp;
3745                 memset(&cp, 0, sizeof(cp));
3746                 bacpy(&cp.bdaddr, &conn->dst);
3747                 cp.pscan_rep_mode = 0x02;
3748                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
3749         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
3750                 mgmt_device_connected(hdev, conn, NULL, 0);
3751
3752         if (!hci_outgoing_auth_needed(hdev, conn)) {
3753                 conn->state = BT_CONNECTED;
3754                 hci_connect_cfm(conn, ev->status);
3755                 hci_conn_drop(conn);
3756         }
3757
3758 unlock:
3759         hci_dev_unlock(hdev);
3760 }
3761
3762 static inline void handle_cmd_cnt_and_timer(struct hci_dev *hdev, u8 ncmd)
3763 {
3764         cancel_delayed_work(&hdev->cmd_timer);
3765
3766         if (!test_bit(HCI_RESET, &hdev->flags)) {
3767                 if (ncmd) {
3768                         cancel_delayed_work(&hdev->ncmd_timer);
3769                         atomic_set(&hdev->cmd_cnt, 1);
3770                 } else {
3771                         if (!hci_dev_test_flag(hdev, HCI_CMD_DRAIN_WORKQUEUE))
3772                                 schedule_delayed_work(&hdev->ncmd_timer,
3773                                                       HCI_NCMD_TIMEOUT);
3774                 }
3775         }
3776 }
3777
3778 static u8 hci_cc_le_read_buffer_size_v2(struct hci_dev *hdev, void *data,
3779                                         struct sk_buff *skb)
3780 {
3781         struct hci_rp_le_read_buffer_size_v2 *rp = data;
3782
3783         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
3784
3785         if (rp->status)
3786                 return rp->status;
3787
3788         hdev->le_mtu   = __le16_to_cpu(rp->acl_mtu);
3789         hdev->le_pkts  = rp->acl_max_pkt;
3790         hdev->iso_mtu  = __le16_to_cpu(rp->iso_mtu);
3791         hdev->iso_pkts = rp->iso_max_pkt;
3792
3793         hdev->le_cnt  = hdev->le_pkts;
3794         hdev->iso_cnt = hdev->iso_pkts;
3795
3796         BT_DBG("%s acl mtu %d:%d iso mtu %d:%d", hdev->name, hdev->acl_mtu,
3797                hdev->acl_pkts, hdev->iso_mtu, hdev->iso_pkts);
3798
3799         return rp->status;
3800 }
3801
3802 static u8 hci_cc_le_set_cig_params(struct hci_dev *hdev, void *data,
3803                                    struct sk_buff *skb)
3804 {
3805         struct hci_rp_le_set_cig_params *rp = data;
3806         struct hci_conn *conn;
3807         int i = 0;
3808
3809         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
3810
3811         hci_dev_lock(hdev);
3812
3813         if (rp->status) {
3814                 while ((conn = hci_conn_hash_lookup_cig(hdev, rp->cig_id))) {
3815                         conn->state = BT_CLOSED;
3816                         hci_connect_cfm(conn, rp->status);
3817                         hci_conn_del(conn);
3818                 }
3819                 goto unlock;
3820         }
3821
3822         rcu_read_lock();
3823
3824         list_for_each_entry_rcu(conn, &hdev->conn_hash.list, list) {
3825                 if (conn->type != ISO_LINK || conn->iso_qos.cig != rp->cig_id ||
3826                     conn->state == BT_CONNECTED)
3827                         continue;
3828
3829                 conn->handle = __le16_to_cpu(rp->handle[i++]);
3830
3831                 bt_dev_dbg(hdev, "%p handle 0x%4.4x link %p", conn,
3832                            conn->handle, conn->link);
3833
3834                 /* Create CIS if LE is already connected */
3835                 if (conn->link && conn->link->state == BT_CONNECTED)
3836                         hci_le_create_cis(conn->link);
3837
3838                 if (i == rp->num_handles)
3839                         break;
3840         }
3841
3842         rcu_read_unlock();
3843
3844 unlock:
3845         hci_dev_unlock(hdev);
3846
3847         return rp->status;
3848 }
3849
3850 static u8 hci_cc_le_setup_iso_path(struct hci_dev *hdev, void *data,
3851                                    struct sk_buff *skb)
3852 {
3853         struct hci_rp_le_setup_iso_path *rp = data;
3854         struct hci_cp_le_setup_iso_path *cp;
3855         struct hci_conn *conn;
3856
3857         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
3858
3859         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SETUP_ISO_PATH);
3860         if (!cp)
3861                 return rp->status;
3862
3863         hci_dev_lock(hdev);
3864
3865         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
3866         if (!conn)
3867                 goto unlock;
3868
3869         if (rp->status) {
3870                 hci_connect_cfm(conn, rp->status);
3871                 hci_conn_del(conn);
3872                 goto unlock;
3873         }
3874
3875         switch (cp->direction) {
3876         /* Input (Host to Controller) */
3877         case 0x00:
3878                 /* Only confirm connection if output only */
3879                 if (conn->iso_qos.out.sdu && !conn->iso_qos.in.sdu)
3880                         hci_connect_cfm(conn, rp->status);
3881                 break;
3882         /* Output (Controller to Host) */
3883         case 0x01:
3884                 /* Confirm connection since conn->iso_qos is always configured
3885                  * last.
3886                  */
3887                 hci_connect_cfm(conn, rp->status);
3888                 break;
3889         }
3890
3891 unlock:
3892         hci_dev_unlock(hdev);
3893         return rp->status;
3894 }
3895
3896 #define HCI_CC_VL(_op, _func, _min, _max) \
3897 { \
3898         .op = _op, \
3899         .func = _func, \
3900         .min_len = _min, \
3901         .max_len = _max, \
3902 }
3903
3904 #define HCI_CC(_op, _func, _len) \
3905         HCI_CC_VL(_op, _func, _len, _len)
3906
3907 #define HCI_CC_STATUS(_op, _func) \
3908         HCI_CC(_op, _func, sizeof(struct hci_ev_status))
3909
3910 static const struct hci_cc {
3911         u16  op;
3912         u8 (*func)(struct hci_dev *hdev, void *data, struct sk_buff *skb);
3913         u16  min_len;
3914         u16  max_len;
3915 } hci_cc_table[] = {
3916         HCI_CC_STATUS(HCI_OP_INQUIRY_CANCEL, hci_cc_inquiry_cancel),
3917         HCI_CC_STATUS(HCI_OP_PERIODIC_INQ, hci_cc_periodic_inq),
3918         HCI_CC_STATUS(HCI_OP_EXIT_PERIODIC_INQ, hci_cc_exit_periodic_inq),
3919         HCI_CC_STATUS(HCI_OP_REMOTE_NAME_REQ_CANCEL,
3920                       hci_cc_remote_name_req_cancel),
3921         HCI_CC(HCI_OP_ROLE_DISCOVERY, hci_cc_role_discovery,
3922                sizeof(struct hci_rp_role_discovery)),
3923         HCI_CC(HCI_OP_READ_LINK_POLICY, hci_cc_read_link_policy,
3924                sizeof(struct hci_rp_read_link_policy)),
3925         HCI_CC(HCI_OP_WRITE_LINK_POLICY, hci_cc_write_link_policy,
3926                sizeof(struct hci_rp_write_link_policy)),
3927         HCI_CC(HCI_OP_READ_DEF_LINK_POLICY, hci_cc_read_def_link_policy,
3928                sizeof(struct hci_rp_read_def_link_policy)),
3929         HCI_CC_STATUS(HCI_OP_WRITE_DEF_LINK_POLICY,
3930                       hci_cc_write_def_link_policy),
3931         HCI_CC_STATUS(HCI_OP_RESET, hci_cc_reset),
3932         HCI_CC(HCI_OP_READ_STORED_LINK_KEY, hci_cc_read_stored_link_key,
3933                sizeof(struct hci_rp_read_stored_link_key)),
3934         HCI_CC(HCI_OP_DELETE_STORED_LINK_KEY, hci_cc_delete_stored_link_key,
3935                sizeof(struct hci_rp_delete_stored_link_key)),
3936         HCI_CC_STATUS(HCI_OP_WRITE_LOCAL_NAME, hci_cc_write_local_name),
3937         HCI_CC(HCI_OP_READ_LOCAL_NAME, hci_cc_read_local_name,
3938                sizeof(struct hci_rp_read_local_name)),
3939         HCI_CC_STATUS(HCI_OP_WRITE_AUTH_ENABLE, hci_cc_write_auth_enable),
3940         HCI_CC_STATUS(HCI_OP_WRITE_ENCRYPT_MODE, hci_cc_write_encrypt_mode),
3941         HCI_CC_STATUS(HCI_OP_WRITE_SCAN_ENABLE, hci_cc_write_scan_enable),
3942         HCI_CC_STATUS(HCI_OP_SET_EVENT_FLT, hci_cc_set_event_filter),
3943         HCI_CC(HCI_OP_READ_CLASS_OF_DEV, hci_cc_read_class_of_dev,
3944                sizeof(struct hci_rp_read_class_of_dev)),
3945         HCI_CC_STATUS(HCI_OP_WRITE_CLASS_OF_DEV, hci_cc_write_class_of_dev),
3946         HCI_CC(HCI_OP_READ_VOICE_SETTING, hci_cc_read_voice_setting,
3947                sizeof(struct hci_rp_read_voice_setting)),
3948         HCI_CC_STATUS(HCI_OP_WRITE_VOICE_SETTING, hci_cc_write_voice_setting),
3949         HCI_CC(HCI_OP_READ_NUM_SUPPORTED_IAC, hci_cc_read_num_supported_iac,
3950                sizeof(struct hci_rp_read_num_supported_iac)),
3951         HCI_CC_STATUS(HCI_OP_WRITE_SSP_MODE, hci_cc_write_ssp_mode),
3952         HCI_CC_STATUS(HCI_OP_WRITE_SC_SUPPORT, hci_cc_write_sc_support),
3953         HCI_CC(HCI_OP_READ_AUTH_PAYLOAD_TO, hci_cc_read_auth_payload_timeout,
3954                sizeof(struct hci_rp_read_auth_payload_to)),
3955         HCI_CC(HCI_OP_WRITE_AUTH_PAYLOAD_TO, hci_cc_write_auth_payload_timeout,
3956                sizeof(struct hci_rp_write_auth_payload_to)),
3957         HCI_CC(HCI_OP_READ_LOCAL_VERSION, hci_cc_read_local_version,
3958                sizeof(struct hci_rp_read_local_version)),
3959         HCI_CC(HCI_OP_READ_LOCAL_COMMANDS, hci_cc_read_local_commands,
3960                sizeof(struct hci_rp_read_local_commands)),
3961         HCI_CC(HCI_OP_READ_LOCAL_FEATURES, hci_cc_read_local_features,
3962                sizeof(struct hci_rp_read_local_features)),
3963         HCI_CC(HCI_OP_READ_LOCAL_EXT_FEATURES, hci_cc_read_local_ext_features,
3964                sizeof(struct hci_rp_read_local_ext_features)),
3965         HCI_CC(HCI_OP_READ_BUFFER_SIZE, hci_cc_read_buffer_size,
3966                sizeof(struct hci_rp_read_buffer_size)),
3967         HCI_CC(HCI_OP_READ_BD_ADDR, hci_cc_read_bd_addr,
3968                sizeof(struct hci_rp_read_bd_addr)),
3969         HCI_CC(HCI_OP_READ_LOCAL_PAIRING_OPTS, hci_cc_read_local_pairing_opts,
3970                sizeof(struct hci_rp_read_local_pairing_opts)),
3971         HCI_CC(HCI_OP_READ_PAGE_SCAN_ACTIVITY, hci_cc_read_page_scan_activity,
3972                sizeof(struct hci_rp_read_page_scan_activity)),
3973         HCI_CC_STATUS(HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
3974                       hci_cc_write_page_scan_activity),
3975         HCI_CC(HCI_OP_READ_PAGE_SCAN_TYPE, hci_cc_read_page_scan_type,
3976                sizeof(struct hci_rp_read_page_scan_type)),
3977         HCI_CC_STATUS(HCI_OP_WRITE_PAGE_SCAN_TYPE, hci_cc_write_page_scan_type),
3978         HCI_CC(HCI_OP_READ_DATA_BLOCK_SIZE, hci_cc_read_data_block_size,
3979                sizeof(struct hci_rp_read_data_block_size)),
3980         HCI_CC(HCI_OP_READ_FLOW_CONTROL_MODE, hci_cc_read_flow_control_mode,
3981                sizeof(struct hci_rp_read_flow_control_mode)),
3982         HCI_CC(HCI_OP_READ_LOCAL_AMP_INFO, hci_cc_read_local_amp_info,
3983                sizeof(struct hci_rp_read_local_amp_info)),
3984         HCI_CC(HCI_OP_READ_CLOCK, hci_cc_read_clock,
3985                sizeof(struct hci_rp_read_clock)),
3986         HCI_CC(HCI_OP_READ_INQ_RSP_TX_POWER, hci_cc_read_inq_rsp_tx_power,
3987                sizeof(struct hci_rp_read_inq_rsp_tx_power)),
3988         HCI_CC(HCI_OP_READ_DEF_ERR_DATA_REPORTING,
3989                hci_cc_read_def_err_data_reporting,
3990                sizeof(struct hci_rp_read_def_err_data_reporting)),
3991         HCI_CC_STATUS(HCI_OP_WRITE_DEF_ERR_DATA_REPORTING,
3992                       hci_cc_write_def_err_data_reporting),
3993         HCI_CC(HCI_OP_PIN_CODE_REPLY, hci_cc_pin_code_reply,
3994                sizeof(struct hci_rp_pin_code_reply)),
3995         HCI_CC(HCI_OP_PIN_CODE_NEG_REPLY, hci_cc_pin_code_neg_reply,
3996                sizeof(struct hci_rp_pin_code_neg_reply)),
3997         HCI_CC(HCI_OP_READ_LOCAL_OOB_DATA, hci_cc_read_local_oob_data,
3998                sizeof(struct hci_rp_read_local_oob_data)),
3999         HCI_CC(HCI_OP_READ_LOCAL_OOB_EXT_DATA, hci_cc_read_local_oob_ext_data,
4000                sizeof(struct hci_rp_read_local_oob_ext_data)),
4001         HCI_CC(HCI_OP_LE_READ_BUFFER_SIZE, hci_cc_le_read_buffer_size,
4002                sizeof(struct hci_rp_le_read_buffer_size)),
4003         HCI_CC(HCI_OP_LE_READ_LOCAL_FEATURES, hci_cc_le_read_local_features,
4004                sizeof(struct hci_rp_le_read_local_features)),
4005         HCI_CC(HCI_OP_LE_READ_ADV_TX_POWER, hci_cc_le_read_adv_tx_power,
4006                sizeof(struct hci_rp_le_read_adv_tx_power)),
4007         HCI_CC(HCI_OP_USER_CONFIRM_REPLY, hci_cc_user_confirm_reply,
4008                sizeof(struct hci_rp_user_confirm_reply)),
4009         HCI_CC(HCI_OP_USER_CONFIRM_NEG_REPLY, hci_cc_user_confirm_neg_reply,
4010                sizeof(struct hci_rp_user_confirm_reply)),
4011         HCI_CC(HCI_OP_USER_PASSKEY_REPLY, hci_cc_user_passkey_reply,
4012                sizeof(struct hci_rp_user_confirm_reply)),
4013         HCI_CC(HCI_OP_USER_PASSKEY_NEG_REPLY, hci_cc_user_passkey_neg_reply,
4014                sizeof(struct hci_rp_user_confirm_reply)),
4015         HCI_CC_STATUS(HCI_OP_LE_SET_RANDOM_ADDR, hci_cc_le_set_random_addr),
4016         HCI_CC_STATUS(HCI_OP_LE_SET_ADV_ENABLE, hci_cc_le_set_adv_enable),
4017         HCI_CC_STATUS(HCI_OP_LE_SET_SCAN_PARAM, hci_cc_le_set_scan_param),
4018         HCI_CC_STATUS(HCI_OP_LE_SET_SCAN_ENABLE, hci_cc_le_set_scan_enable),
4019         HCI_CC(HCI_OP_LE_READ_ACCEPT_LIST_SIZE,
4020                hci_cc_le_read_accept_list_size,
4021                sizeof(struct hci_rp_le_read_accept_list_size)),
4022         HCI_CC_STATUS(HCI_OP_LE_CLEAR_ACCEPT_LIST, hci_cc_le_clear_accept_list),
4023         HCI_CC_STATUS(HCI_OP_LE_ADD_TO_ACCEPT_LIST,
4024                       hci_cc_le_add_to_accept_list),
4025         HCI_CC_STATUS(HCI_OP_LE_DEL_FROM_ACCEPT_LIST,
4026                       hci_cc_le_del_from_accept_list),
4027         HCI_CC(HCI_OP_LE_READ_SUPPORTED_STATES, hci_cc_le_read_supported_states,
4028                sizeof(struct hci_rp_le_read_supported_states)),
4029         HCI_CC(HCI_OP_LE_READ_DEF_DATA_LEN, hci_cc_le_read_def_data_len,
4030                sizeof(struct hci_rp_le_read_def_data_len)),
4031         HCI_CC_STATUS(HCI_OP_LE_WRITE_DEF_DATA_LEN,
4032                       hci_cc_le_write_def_data_len),
4033         HCI_CC_STATUS(HCI_OP_LE_ADD_TO_RESOLV_LIST,
4034                       hci_cc_le_add_to_resolv_list),
4035         HCI_CC_STATUS(HCI_OP_LE_DEL_FROM_RESOLV_LIST,
4036                       hci_cc_le_del_from_resolv_list),
4037         HCI_CC_STATUS(HCI_OP_LE_CLEAR_RESOLV_LIST,
4038                       hci_cc_le_clear_resolv_list),
4039         HCI_CC(HCI_OP_LE_READ_RESOLV_LIST_SIZE, hci_cc_le_read_resolv_list_size,
4040                sizeof(struct hci_rp_le_read_resolv_list_size)),
4041         HCI_CC_STATUS(HCI_OP_LE_SET_ADDR_RESOLV_ENABLE,
4042                       hci_cc_le_set_addr_resolution_enable),
4043         HCI_CC(HCI_OP_LE_READ_MAX_DATA_LEN, hci_cc_le_read_max_data_len,
4044                sizeof(struct hci_rp_le_read_max_data_len)),
4045         HCI_CC_STATUS(HCI_OP_WRITE_LE_HOST_SUPPORTED,
4046                       hci_cc_write_le_host_supported),
4047         HCI_CC_STATUS(HCI_OP_LE_SET_ADV_PARAM, hci_cc_set_adv_param),
4048         HCI_CC(HCI_OP_READ_RSSI, hci_cc_read_rssi,
4049                sizeof(struct hci_rp_read_rssi)),
4050         HCI_CC(HCI_OP_READ_TX_POWER, hci_cc_read_tx_power,
4051                sizeof(struct hci_rp_read_tx_power)),
4052         HCI_CC_STATUS(HCI_OP_WRITE_SSP_DEBUG_MODE, hci_cc_write_ssp_debug_mode),
4053         HCI_CC_STATUS(HCI_OP_LE_SET_EXT_SCAN_PARAMS,
4054                       hci_cc_le_set_ext_scan_param),
4055         HCI_CC_STATUS(HCI_OP_LE_SET_EXT_SCAN_ENABLE,
4056                       hci_cc_le_set_ext_scan_enable),
4057         HCI_CC_STATUS(HCI_OP_LE_SET_DEFAULT_PHY, hci_cc_le_set_default_phy),
4058         HCI_CC(HCI_OP_LE_READ_NUM_SUPPORTED_ADV_SETS,
4059                hci_cc_le_read_num_adv_sets,
4060                sizeof(struct hci_rp_le_read_num_supported_adv_sets)),
4061         HCI_CC(HCI_OP_LE_SET_EXT_ADV_PARAMS, hci_cc_set_ext_adv_param,
4062                sizeof(struct hci_rp_le_set_ext_adv_params)),
4063         HCI_CC_STATUS(HCI_OP_LE_SET_EXT_ADV_ENABLE,
4064                       hci_cc_le_set_ext_adv_enable),
4065         HCI_CC_STATUS(HCI_OP_LE_SET_ADV_SET_RAND_ADDR,
4066                       hci_cc_le_set_adv_set_random_addr),
4067         HCI_CC_STATUS(HCI_OP_LE_REMOVE_ADV_SET, hci_cc_le_remove_adv_set),
4068         HCI_CC_STATUS(HCI_OP_LE_CLEAR_ADV_SETS, hci_cc_le_clear_adv_sets),
4069         HCI_CC(HCI_OP_LE_READ_TRANSMIT_POWER, hci_cc_le_read_transmit_power,
4070                sizeof(struct hci_rp_le_read_transmit_power)),
4071         HCI_CC_STATUS(HCI_OP_LE_SET_PRIVACY_MODE, hci_cc_le_set_privacy_mode),
4072         HCI_CC(HCI_OP_LE_READ_BUFFER_SIZE_V2, hci_cc_le_read_buffer_size_v2,
4073                sizeof(struct hci_rp_le_read_buffer_size_v2)),
4074         HCI_CC_VL(HCI_OP_LE_SET_CIG_PARAMS, hci_cc_le_set_cig_params,
4075                   sizeof(struct hci_rp_le_set_cig_params), HCI_MAX_EVENT_SIZE),
4076         HCI_CC(HCI_OP_LE_SETUP_ISO_PATH, hci_cc_le_setup_iso_path,
4077                sizeof(struct hci_rp_le_setup_iso_path)),
4078 };
4079
4080 static u8 hci_cc_func(struct hci_dev *hdev, const struct hci_cc *cc,
4081                       struct sk_buff *skb)
4082 {
4083         void *data;
4084
4085         if (skb->len < cc->min_len) {
4086                 bt_dev_err(hdev, "unexpected cc 0x%4.4x length: %u < %u",
4087                            cc->op, skb->len, cc->min_len);
4088                 return HCI_ERROR_UNSPECIFIED;
4089         }
4090
4091         /* Just warn if the length is over max_len size it still be possible to
4092          * partially parse the cc so leave to callback to decide if that is
4093          * acceptable.
4094          */
4095         if (skb->len > cc->max_len)
4096                 bt_dev_warn(hdev, "unexpected cc 0x%4.4x length: %u > %u",
4097                             cc->op, skb->len, cc->max_len);
4098
4099         data = hci_cc_skb_pull(hdev, skb, cc->op, cc->min_len);
4100         if (!data)
4101                 return HCI_ERROR_UNSPECIFIED;
4102
4103         return cc->func(hdev, data, skb);
4104 }
4105
4106 static void hci_cmd_complete_evt(struct hci_dev *hdev, void *data,
4107                                  struct sk_buff *skb, u16 *opcode, u8 *status,
4108                                  hci_req_complete_t *req_complete,
4109                                  hci_req_complete_skb_t *req_complete_skb)
4110 {
4111         struct hci_ev_cmd_complete *ev = data;
4112         int i;
4113
4114         *opcode = __le16_to_cpu(ev->opcode);
4115
4116         bt_dev_dbg(hdev, "opcode 0x%4.4x", *opcode);
4117
4118         for (i = 0; i < ARRAY_SIZE(hci_cc_table); i++) {
4119                 if (hci_cc_table[i].op == *opcode) {
4120                         *status = hci_cc_func(hdev, &hci_cc_table[i], skb);
4121                         break;
4122                 }
4123         }
4124
4125         handle_cmd_cnt_and_timer(hdev, ev->ncmd);
4126
4127         hci_req_cmd_complete(hdev, *opcode, *status, req_complete,
4128                              req_complete_skb);
4129
4130         if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
4131                 bt_dev_err(hdev,
4132                            "unexpected event for opcode 0x%4.4x", *opcode);
4133                 return;
4134         }
4135
4136         if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
4137                 queue_work(hdev->workqueue, &hdev->cmd_work);
4138 }
4139
4140 static void hci_cs_le_create_cis(struct hci_dev *hdev, u8 status)
4141 {
4142         struct hci_cp_le_create_cis *cp;
4143         int i;
4144
4145         bt_dev_dbg(hdev, "status 0x%2.2x", status);
4146
4147         if (!status)
4148                 return;
4149
4150         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CIS);
4151         if (!cp)
4152                 return;
4153
4154         hci_dev_lock(hdev);
4155
4156         /* Remove connection if command failed */
4157         for (i = 0; cp->num_cis; cp->num_cis--, i++) {
4158                 struct hci_conn *conn;
4159                 u16 handle;
4160
4161                 handle = __le16_to_cpu(cp->cis[i].cis_handle);
4162
4163                 conn = hci_conn_hash_lookup_handle(hdev, handle);
4164                 if (conn) {
4165                         conn->state = BT_CLOSED;
4166                         hci_connect_cfm(conn, status);
4167                         hci_conn_del(conn);
4168                 }
4169         }
4170
4171         hci_dev_unlock(hdev);
4172 }
4173
4174 #define HCI_CS(_op, _func) \
4175 { \
4176         .op = _op, \
4177         .func = _func, \
4178 }
4179
4180 static const struct hci_cs {
4181         u16  op;
4182         void (*func)(struct hci_dev *hdev, __u8 status);
4183 } hci_cs_table[] = {
4184         HCI_CS(HCI_OP_INQUIRY, hci_cs_inquiry),
4185         HCI_CS(HCI_OP_CREATE_CONN, hci_cs_create_conn),
4186         HCI_CS(HCI_OP_DISCONNECT, hci_cs_disconnect),
4187         HCI_CS(HCI_OP_ADD_SCO, hci_cs_add_sco),
4188         HCI_CS(HCI_OP_AUTH_REQUESTED, hci_cs_auth_requested),
4189         HCI_CS(HCI_OP_SET_CONN_ENCRYPT, hci_cs_set_conn_encrypt),
4190         HCI_CS(HCI_OP_REMOTE_NAME_REQ, hci_cs_remote_name_req),
4191         HCI_CS(HCI_OP_READ_REMOTE_FEATURES, hci_cs_read_remote_features),
4192         HCI_CS(HCI_OP_READ_REMOTE_EXT_FEATURES,
4193                hci_cs_read_remote_ext_features),
4194         HCI_CS(HCI_OP_SETUP_SYNC_CONN, hci_cs_setup_sync_conn),
4195         HCI_CS(HCI_OP_ENHANCED_SETUP_SYNC_CONN,
4196                hci_cs_enhanced_setup_sync_conn),
4197         HCI_CS(HCI_OP_SNIFF_MODE, hci_cs_sniff_mode),
4198         HCI_CS(HCI_OP_EXIT_SNIFF_MODE, hci_cs_exit_sniff_mode),
4199         HCI_CS(HCI_OP_SWITCH_ROLE, hci_cs_switch_role),
4200         HCI_CS(HCI_OP_LE_CREATE_CONN, hci_cs_le_create_conn),
4201         HCI_CS(HCI_OP_LE_READ_REMOTE_FEATURES, hci_cs_le_read_remote_features),
4202         HCI_CS(HCI_OP_LE_START_ENC, hci_cs_le_start_enc),
4203         HCI_CS(HCI_OP_LE_EXT_CREATE_CONN, hci_cs_le_ext_create_conn),
4204         HCI_CS(HCI_OP_LE_CREATE_CIS, hci_cs_le_create_cis),
4205 };
4206
4207 static void hci_cmd_status_evt(struct hci_dev *hdev, void *data,
4208                                struct sk_buff *skb, u16 *opcode, u8 *status,
4209                                hci_req_complete_t *req_complete,
4210                                hci_req_complete_skb_t *req_complete_skb)
4211 {
4212         struct hci_ev_cmd_status *ev = data;
4213         int i;
4214
4215         *opcode = __le16_to_cpu(ev->opcode);
4216         *status = ev->status;
4217
4218         bt_dev_dbg(hdev, "opcode 0x%4.4x", *opcode);
4219
4220         for (i = 0; i < ARRAY_SIZE(hci_cs_table); i++) {
4221                 if (hci_cs_table[i].op == *opcode) {
4222                         hci_cs_table[i].func(hdev, ev->status);
4223                         break;
4224                 }
4225         }
4226
4227         handle_cmd_cnt_and_timer(hdev, ev->ncmd);
4228
4229         /* Indicate request completion if the command failed. Also, if
4230          * we're not waiting for a special event and we get a success
4231          * command status we should try to flag the request as completed
4232          * (since for this kind of commands there will not be a command
4233          * complete event).
4234          */
4235         if (ev->status || (hdev->sent_cmd && !hci_skb_event(hdev->sent_cmd))) {
4236                 hci_req_cmd_complete(hdev, *opcode, ev->status, req_complete,
4237                                      req_complete_skb);
4238                 if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
4239                         bt_dev_err(hdev, "unexpected event for opcode 0x%4.4x",
4240                                    *opcode);
4241                         return;
4242                 }
4243         }
4244
4245         if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
4246                 queue_work(hdev->workqueue, &hdev->cmd_work);
4247 }
4248
4249 static void hci_hardware_error_evt(struct hci_dev *hdev, void *data,
4250                                    struct sk_buff *skb)
4251 {
4252         struct hci_ev_hardware_error *ev = data;
4253
4254         bt_dev_dbg(hdev, "code 0x%2.2x", ev->code);
4255
4256         hdev->hw_error_code = ev->code;
4257
4258         queue_work(hdev->req_workqueue, &hdev->error_reset);
4259 }
4260
4261 static void hci_role_change_evt(struct hci_dev *hdev, void *data,
4262                                 struct sk_buff *skb)
4263 {
4264         struct hci_ev_role_change *ev = data;
4265         struct hci_conn *conn;
4266
4267         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
4268
4269         hci_dev_lock(hdev);
4270
4271         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4272         if (conn) {
4273                 if (!ev->status)
4274                         conn->role = ev->role;
4275
4276                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
4277
4278                 hci_role_switch_cfm(conn, ev->status, ev->role);
4279         }
4280
4281         hci_dev_unlock(hdev);
4282 }
4283
4284 static void hci_num_comp_pkts_evt(struct hci_dev *hdev, void *data,
4285                                   struct sk_buff *skb)
4286 {
4287         struct hci_ev_num_comp_pkts *ev = data;
4288         int i;
4289
4290         if (!hci_ev_skb_pull(hdev, skb, HCI_EV_NUM_COMP_PKTS,
4291                              flex_array_size(ev, handles, ev->num)))
4292                 return;
4293
4294         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
4295                 bt_dev_err(hdev, "wrong event for mode %d", hdev->flow_ctl_mode);
4296                 return;
4297         }
4298
4299         bt_dev_dbg(hdev, "num %d", ev->num);
4300
4301         for (i = 0; i < ev->num; i++) {
4302                 struct hci_comp_pkts_info *info = &ev->handles[i];
4303                 struct hci_conn *conn;
4304                 __u16  handle, count;
4305
4306                 handle = __le16_to_cpu(info->handle);
4307                 count  = __le16_to_cpu(info->count);
4308
4309                 conn = hci_conn_hash_lookup_handle(hdev, handle);
4310                 if (!conn)
4311                         continue;
4312
4313                 conn->sent -= count;
4314
4315                 switch (conn->type) {
4316                 case ACL_LINK:
4317                         hdev->acl_cnt += count;
4318                         if (hdev->acl_cnt > hdev->acl_pkts)
4319                                 hdev->acl_cnt = hdev->acl_pkts;
4320                         break;
4321
4322                 case LE_LINK:
4323                         if (hdev->le_pkts) {
4324                                 hdev->le_cnt += count;
4325                                 if (hdev->le_cnt > hdev->le_pkts)
4326                                         hdev->le_cnt = hdev->le_pkts;
4327                         } else {
4328                                 hdev->acl_cnt += count;
4329                                 if (hdev->acl_cnt > hdev->acl_pkts)
4330                                         hdev->acl_cnt = hdev->acl_pkts;
4331                         }
4332                         break;
4333
4334                 case SCO_LINK:
4335                         hdev->sco_cnt += count;
4336                         if (hdev->sco_cnt > hdev->sco_pkts)
4337                                 hdev->sco_cnt = hdev->sco_pkts;
4338                         break;
4339
4340                 case ISO_LINK:
4341                         if (hdev->iso_pkts) {
4342                                 hdev->iso_cnt += count;
4343                                 if (hdev->iso_cnt > hdev->iso_pkts)
4344                                         hdev->iso_cnt = hdev->iso_pkts;
4345                         } else if (hdev->le_pkts) {
4346                                 hdev->le_cnt += count;
4347                                 if (hdev->le_cnt > hdev->le_pkts)
4348                                         hdev->le_cnt = hdev->le_pkts;
4349                         } else {
4350                                 hdev->acl_cnt += count;
4351                                 if (hdev->acl_cnt > hdev->acl_pkts)
4352                                         hdev->acl_cnt = hdev->acl_pkts;
4353                         }
4354                         break;
4355
4356                 default:
4357                         bt_dev_err(hdev, "unknown type %d conn %p",
4358                                    conn->type, conn);
4359                         break;
4360                 }
4361         }
4362
4363         queue_work(hdev->workqueue, &hdev->tx_work);
4364 }
4365
4366 static struct hci_conn *__hci_conn_lookup_handle(struct hci_dev *hdev,
4367                                                  __u16 handle)
4368 {
4369         struct hci_chan *chan;
4370
4371         switch (hdev->dev_type) {
4372         case HCI_PRIMARY:
4373                 return hci_conn_hash_lookup_handle(hdev, handle);
4374         case HCI_AMP:
4375                 chan = hci_chan_lookup_handle(hdev, handle);
4376                 if (chan)
4377                         return chan->conn;
4378                 break;
4379         default:
4380                 bt_dev_err(hdev, "unknown dev_type %d", hdev->dev_type);
4381                 break;
4382         }
4383
4384         return NULL;
4385 }
4386
4387 static void hci_num_comp_blocks_evt(struct hci_dev *hdev, void *data,
4388                                     struct sk_buff *skb)
4389 {
4390         struct hci_ev_num_comp_blocks *ev = data;
4391         int i;
4392
4393         if (!hci_ev_skb_pull(hdev, skb, HCI_EV_NUM_COMP_BLOCKS,
4394                              flex_array_size(ev, handles, ev->num_hndl)))
4395                 return;
4396
4397         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
4398                 bt_dev_err(hdev, "wrong event for mode %d",
4399                            hdev->flow_ctl_mode);
4400                 return;
4401         }
4402
4403         bt_dev_dbg(hdev, "num_blocks %d num_hndl %d", ev->num_blocks,
4404                    ev->num_hndl);
4405
4406         for (i = 0; i < ev->num_hndl; i++) {
4407                 struct hci_comp_blocks_info *info = &ev->handles[i];
4408                 struct hci_conn *conn = NULL;
4409                 __u16  handle, block_count;
4410
4411                 handle = __le16_to_cpu(info->handle);
4412                 block_count = __le16_to_cpu(info->blocks);
4413
4414                 conn = __hci_conn_lookup_handle(hdev, handle);
4415                 if (!conn)
4416                         continue;
4417
4418                 conn->sent -= block_count;
4419
4420                 switch (conn->type) {
4421                 case ACL_LINK:
4422                 case AMP_LINK:
4423                         hdev->block_cnt += block_count;
4424                         if (hdev->block_cnt > hdev->num_blocks)
4425                                 hdev->block_cnt = hdev->num_blocks;
4426                         break;
4427
4428                 default:
4429                         bt_dev_err(hdev, "unknown type %d conn %p",
4430                                    conn->type, conn);
4431                         break;
4432                 }
4433         }
4434
4435         queue_work(hdev->workqueue, &hdev->tx_work);
4436 }
4437
4438 static void hci_mode_change_evt(struct hci_dev *hdev, void *data,
4439                                 struct sk_buff *skb)
4440 {
4441         struct hci_ev_mode_change *ev = data;
4442         struct hci_conn *conn;
4443
4444         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
4445
4446         hci_dev_lock(hdev);
4447
4448         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4449         if (conn) {
4450                 conn->mode = ev->mode;
4451
4452                 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND,
4453                                         &conn->flags)) {
4454                         if (conn->mode == HCI_CM_ACTIVE)
4455                                 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
4456                         else
4457                                 clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
4458                 }
4459
4460                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
4461                         hci_sco_setup(conn, ev->status);
4462         }
4463
4464         hci_dev_unlock(hdev);
4465 }
4466
4467 static void hci_pin_code_request_evt(struct hci_dev *hdev, void *data,
4468                                      struct sk_buff *skb)
4469 {
4470         struct hci_ev_pin_code_req *ev = data;
4471         struct hci_conn *conn;
4472
4473         bt_dev_dbg(hdev, "");
4474
4475         hci_dev_lock(hdev);
4476
4477         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4478         if (!conn)
4479                 goto unlock;
4480
4481         if (conn->state == BT_CONNECTED) {
4482                 hci_conn_hold(conn);
4483                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
4484                 hci_conn_drop(conn);
4485         }
4486
4487         if (!hci_dev_test_flag(hdev, HCI_BONDABLE) &&
4488             !test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags)) {
4489                 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
4490                              sizeof(ev->bdaddr), &ev->bdaddr);
4491         } else if (hci_dev_test_flag(hdev, HCI_MGMT)) {
4492                 u8 secure;
4493
4494                 if (conn->pending_sec_level == BT_SECURITY_HIGH)
4495                         secure = 1;
4496                 else
4497                         secure = 0;
4498
4499                 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
4500         }
4501
4502 unlock:
4503         hci_dev_unlock(hdev);
4504 }
4505
4506 static void conn_set_key(struct hci_conn *conn, u8 key_type, u8 pin_len)
4507 {
4508         if (key_type == HCI_LK_CHANGED_COMBINATION)
4509                 return;
4510
4511         conn->pin_length = pin_len;
4512         conn->key_type = key_type;
4513
4514         switch (key_type) {
4515         case HCI_LK_LOCAL_UNIT:
4516         case HCI_LK_REMOTE_UNIT:
4517         case HCI_LK_DEBUG_COMBINATION:
4518                 return;
4519         case HCI_LK_COMBINATION:
4520                 if (pin_len == 16)
4521                         conn->pending_sec_level = BT_SECURITY_HIGH;
4522                 else
4523                         conn->pending_sec_level = BT_SECURITY_MEDIUM;
4524                 break;
4525         case HCI_LK_UNAUTH_COMBINATION_P192:
4526         case HCI_LK_UNAUTH_COMBINATION_P256:
4527                 conn->pending_sec_level = BT_SECURITY_MEDIUM;
4528                 break;
4529         case HCI_LK_AUTH_COMBINATION_P192:
4530                 conn->pending_sec_level = BT_SECURITY_HIGH;
4531                 break;
4532         case HCI_LK_AUTH_COMBINATION_P256:
4533                 conn->pending_sec_level = BT_SECURITY_FIPS;
4534                 break;
4535         }
4536 }
4537
4538 static void hci_link_key_request_evt(struct hci_dev *hdev, void *data,
4539                                      struct sk_buff *skb)
4540 {
4541         struct hci_ev_link_key_req *ev = data;
4542         struct hci_cp_link_key_reply cp;
4543         struct hci_conn *conn;
4544         struct link_key *key;
4545
4546         bt_dev_dbg(hdev, "");
4547
4548         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4549                 return;
4550
4551         hci_dev_lock(hdev);
4552
4553         key = hci_find_link_key(hdev, &ev->bdaddr);
4554         if (!key) {
4555                 bt_dev_dbg(hdev, "link key not found for %pMR", &ev->bdaddr);
4556                 goto not_found;
4557         }
4558
4559         bt_dev_dbg(hdev, "found key type %u for %pMR", key->type, &ev->bdaddr);
4560
4561         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4562         if (conn) {
4563                 clear_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
4564
4565                 if ((key->type == HCI_LK_UNAUTH_COMBINATION_P192 ||
4566                      key->type == HCI_LK_UNAUTH_COMBINATION_P256) &&
4567                     conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
4568                         bt_dev_dbg(hdev, "ignoring unauthenticated key");
4569                         goto not_found;
4570                 }
4571
4572                 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
4573                     (conn->pending_sec_level == BT_SECURITY_HIGH ||
4574                      conn->pending_sec_level == BT_SECURITY_FIPS)) {
4575                         bt_dev_dbg(hdev, "ignoring key unauthenticated for high security");
4576                         goto not_found;
4577                 }
4578
4579                 conn_set_key(conn, key->type, key->pin_len);
4580         }
4581
4582         bacpy(&cp.bdaddr, &ev->bdaddr);
4583         memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);
4584
4585         hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
4586
4587         hci_dev_unlock(hdev);
4588
4589         return;
4590
4591 not_found:
4592         hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
4593         hci_dev_unlock(hdev);
4594 }
4595
4596 static void hci_link_key_notify_evt(struct hci_dev *hdev, void *data,
4597                                     struct sk_buff *skb)
4598 {
4599         struct hci_ev_link_key_notify *ev = data;
4600         struct hci_conn *conn;
4601         struct link_key *key;
4602         bool persistent;
4603         u8 pin_len = 0;
4604
4605         bt_dev_dbg(hdev, "");
4606
4607         hci_dev_lock(hdev);
4608
4609         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4610         if (!conn)
4611                 goto unlock;
4612
4613         hci_conn_hold(conn);
4614         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
4615         hci_conn_drop(conn);
4616
4617         set_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
4618         conn_set_key(conn, ev->key_type, conn->pin_length);
4619
4620         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4621                 goto unlock;
4622
4623         key = hci_add_link_key(hdev, conn, &ev->bdaddr, ev->link_key,
4624                                 ev->key_type, pin_len, &persistent);
4625         if (!key)
4626                 goto unlock;
4627
4628         /* Update connection information since adding the key will have
4629          * fixed up the type in the case of changed combination keys.
4630          */
4631         if (ev->key_type == HCI_LK_CHANGED_COMBINATION)
4632                 conn_set_key(conn, key->type, key->pin_len);
4633
4634         mgmt_new_link_key(hdev, key, persistent);
4635
4636         /* Keep debug keys around only if the HCI_KEEP_DEBUG_KEYS flag
4637          * is set. If it's not set simply remove the key from the kernel
4638          * list (we've still notified user space about it but with
4639          * store_hint being 0).
4640          */
4641         if (key->type == HCI_LK_DEBUG_COMBINATION &&
4642             !hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) {
4643                 list_del_rcu(&key->list);
4644                 kfree_rcu(key, rcu);
4645                 goto unlock;
4646         }
4647
4648         if (persistent)
4649                 clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
4650         else
4651                 set_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
4652
4653 unlock:
4654         hci_dev_unlock(hdev);
4655 }
4656
4657 static void hci_clock_offset_evt(struct hci_dev *hdev, void *data,
4658                                  struct sk_buff *skb)
4659 {
4660         struct hci_ev_clock_offset *ev = data;
4661         struct hci_conn *conn;
4662
4663         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
4664
4665         hci_dev_lock(hdev);
4666
4667         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4668         if (conn && !ev->status) {
4669                 struct inquiry_entry *ie;
4670
4671                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
4672                 if (ie) {
4673                         ie->data.clock_offset = ev->clock_offset;
4674                         ie->timestamp = jiffies;
4675                 }
4676         }
4677
4678         hci_dev_unlock(hdev);
4679 }
4680
4681 static void hci_pkt_type_change_evt(struct hci_dev *hdev, void *data,
4682                                     struct sk_buff *skb)
4683 {
4684         struct hci_ev_pkt_type_change *ev = data;
4685         struct hci_conn *conn;
4686
4687         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
4688
4689         hci_dev_lock(hdev);
4690
4691         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4692         if (conn && !ev->status)
4693                 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
4694
4695         hci_dev_unlock(hdev);
4696 }
4697
4698 static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, void *data,
4699                                    struct sk_buff *skb)
4700 {
4701         struct hci_ev_pscan_rep_mode *ev = data;
4702         struct inquiry_entry *ie;
4703
4704         bt_dev_dbg(hdev, "");
4705
4706         hci_dev_lock(hdev);
4707
4708         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
4709         if (ie) {
4710                 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
4711                 ie->timestamp = jiffies;
4712         }
4713
4714         hci_dev_unlock(hdev);
4715 }
4716
4717 static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, void *edata,
4718                                              struct sk_buff *skb)
4719 {
4720         struct hci_ev_inquiry_result_rssi *ev = edata;
4721         struct inquiry_data data;
4722         int i;
4723
4724         bt_dev_dbg(hdev, "num_rsp %d", ev->num);
4725
4726         if (!ev->num)
4727                 return;
4728
4729         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
4730                 return;
4731
4732         hci_dev_lock(hdev);
4733
4734         if (skb->len == array_size(ev->num,
4735                                    sizeof(struct inquiry_info_rssi_pscan))) {
4736                 struct inquiry_info_rssi_pscan *info;
4737
4738                 for (i = 0; i < ev->num; i++) {
4739                         u32 flags;
4740
4741                         info = hci_ev_skb_pull(hdev, skb,
4742                                                HCI_EV_INQUIRY_RESULT_WITH_RSSI,
4743                                                sizeof(*info));
4744                         if (!info) {
4745                                 bt_dev_err(hdev, "Malformed HCI Event: 0x%2.2x",
4746                                            HCI_EV_INQUIRY_RESULT_WITH_RSSI);
4747                                 goto unlock;
4748                         }
4749
4750                         bacpy(&data.bdaddr, &info->bdaddr);
4751                         data.pscan_rep_mode     = info->pscan_rep_mode;
4752                         data.pscan_period_mode  = info->pscan_period_mode;
4753                         data.pscan_mode         = info->pscan_mode;
4754                         memcpy(data.dev_class, info->dev_class, 3);
4755                         data.clock_offset       = info->clock_offset;
4756                         data.rssi               = info->rssi;
4757                         data.ssp_mode           = 0x00;
4758
4759                         flags = hci_inquiry_cache_update(hdev, &data, false);
4760
4761                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4762                                           info->dev_class, info->rssi,
4763                                           flags, NULL, 0, NULL, 0);
4764                 }
4765         } else if (skb->len == array_size(ev->num,
4766                                           sizeof(struct inquiry_info_rssi))) {
4767                 struct inquiry_info_rssi *info;
4768
4769                 for (i = 0; i < ev->num; i++) {
4770                         u32 flags;
4771
4772                         info = hci_ev_skb_pull(hdev, skb,
4773                                                HCI_EV_INQUIRY_RESULT_WITH_RSSI,
4774                                                sizeof(*info));
4775                         if (!info) {
4776                                 bt_dev_err(hdev, "Malformed HCI Event: 0x%2.2x",
4777                                            HCI_EV_INQUIRY_RESULT_WITH_RSSI);
4778                                 goto unlock;
4779                         }
4780
4781                         bacpy(&data.bdaddr, &info->bdaddr);
4782                         data.pscan_rep_mode     = info->pscan_rep_mode;
4783                         data.pscan_period_mode  = info->pscan_period_mode;
4784                         data.pscan_mode         = 0x00;
4785                         memcpy(data.dev_class, info->dev_class, 3);
4786                         data.clock_offset       = info->clock_offset;
4787                         data.rssi               = info->rssi;
4788                         data.ssp_mode           = 0x00;
4789
4790                         flags = hci_inquiry_cache_update(hdev, &data, false);
4791
4792                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4793                                           info->dev_class, info->rssi,
4794                                           flags, NULL, 0, NULL, 0);
4795                 }
4796         } else {
4797                 bt_dev_err(hdev, "Malformed HCI Event: 0x%2.2x",
4798                            HCI_EV_INQUIRY_RESULT_WITH_RSSI);
4799         }
4800 unlock:
4801         hci_dev_unlock(hdev);
4802 }
4803
4804 static void hci_remote_ext_features_evt(struct hci_dev *hdev, void *data,
4805                                         struct sk_buff *skb)
4806 {
4807         struct hci_ev_remote_ext_features *ev = data;
4808         struct hci_conn *conn;
4809
4810         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
4811
4812         hci_dev_lock(hdev);
4813
4814         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4815         if (!conn)
4816                 goto unlock;
4817
4818         if (ev->page < HCI_MAX_PAGES)
4819                 memcpy(conn->features[ev->page], ev->features, 8);
4820
4821         if (!ev->status && ev->page == 0x01) {
4822                 struct inquiry_entry *ie;
4823
4824                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
4825                 if (ie)
4826                         ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
4827
4828                 if (ev->features[0] & LMP_HOST_SSP) {
4829                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
4830                 } else {
4831                         /* It is mandatory by the Bluetooth specification that
4832                          * Extended Inquiry Results are only used when Secure
4833                          * Simple Pairing is enabled, but some devices violate
4834                          * this.
4835                          *
4836                          * To make these devices work, the internal SSP
4837                          * enabled flag needs to be cleared if the remote host
4838                          * features do not indicate SSP support */
4839                         clear_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
4840                 }
4841
4842                 if (ev->features[0] & LMP_HOST_SC)
4843                         set_bit(HCI_CONN_SC_ENABLED, &conn->flags);
4844         }
4845
4846         if (conn->state != BT_CONFIG)
4847                 goto unlock;
4848
4849         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
4850                 struct hci_cp_remote_name_req cp;
4851                 memset(&cp, 0, sizeof(cp));
4852                 bacpy(&cp.bdaddr, &conn->dst);
4853                 cp.pscan_rep_mode = 0x02;
4854                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
4855         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
4856                 mgmt_device_connected(hdev, conn, NULL, 0);
4857
4858         if (!hci_outgoing_auth_needed(hdev, conn)) {
4859                 conn->state = BT_CONNECTED;
4860                 hci_connect_cfm(conn, ev->status);
4861                 hci_conn_drop(conn);
4862         }
4863
4864 unlock:
4865         hci_dev_unlock(hdev);
4866 }
4867
4868 static void hci_sync_conn_complete_evt(struct hci_dev *hdev, void *data,
4869                                        struct sk_buff *skb)
4870 {
4871         struct hci_ev_sync_conn_complete *ev = data;
4872         struct hci_conn *conn;
4873         u8 status = ev->status;
4874
4875         switch (ev->link_type) {
4876         case SCO_LINK:
4877         case ESCO_LINK:
4878                 break;
4879         default:
4880                 /* As per Core 5.3 Vol 4 Part E 7.7.35 (p.2219), Link_Type
4881                  * for HCI_Synchronous_Connection_Complete is limited to
4882                  * either SCO or eSCO
4883                  */
4884                 bt_dev_err(hdev, "Ignoring connect complete event for invalid link type");
4885                 return;
4886         }
4887
4888         bt_dev_dbg(hdev, "status 0x%2.2x", status);
4889
4890         hci_dev_lock(hdev);
4891
4892         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
4893         if (!conn) {
4894                 if (ev->link_type == ESCO_LINK)
4895                         goto unlock;
4896
4897                 /* When the link type in the event indicates SCO connection
4898                  * and lookup of the connection object fails, then check
4899                  * if an eSCO connection object exists.
4900                  *
4901                  * The core limits the synchronous connections to either
4902                  * SCO or eSCO. The eSCO connection is preferred and tried
4903                  * to be setup first and until successfully established,
4904                  * the link type will be hinted as eSCO.
4905                  */
4906                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
4907                 if (!conn)
4908                         goto unlock;
4909         }
4910
4911         /* The HCI_Synchronous_Connection_Complete event is only sent once per connection.
4912          * Processing it more than once per connection can corrupt kernel memory.
4913          *
4914          * As the connection handle is set here for the first time, it indicates
4915          * whether the connection is already set up.
4916          */
4917         if (conn->handle != HCI_CONN_HANDLE_UNSET) {
4918                 bt_dev_err(hdev, "Ignoring HCI_Sync_Conn_Complete event for existing connection");
4919                 goto unlock;
4920         }
4921
4922         switch (status) {
4923         case 0x00:
4924                 conn->handle = __le16_to_cpu(ev->handle);
4925                 if (conn->handle > HCI_CONN_HANDLE_MAX) {
4926                         bt_dev_err(hdev, "Invalid handle: 0x%4.4x > 0x%4.4x",
4927                                    conn->handle, HCI_CONN_HANDLE_MAX);
4928                         status = HCI_ERROR_INVALID_PARAMETERS;
4929                         conn->state = BT_CLOSED;
4930                         break;
4931                 }
4932
4933                 conn->state  = BT_CONNECTED;
4934                 conn->type   = ev->link_type;
4935
4936                 hci_debugfs_create_conn(conn);
4937                 hci_conn_add_sysfs(conn);
4938                 break;
4939
4940         case 0x10:      /* Connection Accept Timeout */
4941         case 0x0d:      /* Connection Rejected due to Limited Resources */
4942         case 0x11:      /* Unsupported Feature or Parameter Value */
4943         case 0x1c:      /* SCO interval rejected */
4944         case 0x1a:      /* Unsupported Remote Feature */
4945         case 0x1e:      /* Invalid LMP Parameters */
4946         case 0x1f:      /* Unspecified error */
4947         case 0x20:      /* Unsupported LMP Parameter value */
4948                 if (conn->out) {
4949                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
4950                                         (hdev->esco_type & EDR_ESCO_MASK);
4951                         if (hci_setup_sync(conn, conn->link->handle))
4952                                 goto unlock;
4953                 }
4954                 fallthrough;
4955
4956         default:
4957                 conn->state = BT_CLOSED;
4958                 break;
4959         }
4960
4961         bt_dev_dbg(hdev, "SCO connected with air mode: %02x", ev->air_mode);
4962         /* Notify only in case of SCO over HCI transport data path which
4963          * is zero and non-zero value shall be non-HCI transport data path
4964          */
4965         if (conn->codec.data_path == 0 && hdev->notify) {
4966                 switch (ev->air_mode) {
4967                 case 0x02:
4968                         hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_CVSD);
4969                         break;
4970                 case 0x03:
4971                         hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_TRANSP);
4972                         break;
4973                 }
4974         }
4975
4976         hci_connect_cfm(conn, status);
4977         if (status)
4978                 hci_conn_del(conn);
4979
4980 unlock:
4981         hci_dev_unlock(hdev);
4982 }
4983
4984 static inline size_t eir_get_length(u8 *eir, size_t eir_len)
4985 {
4986         size_t parsed = 0;
4987
4988         while (parsed < eir_len) {
4989                 u8 field_len = eir[0];
4990
4991                 if (field_len == 0)
4992                         return parsed;
4993
4994                 parsed += field_len + 1;
4995                 eir += field_len + 1;
4996         }
4997
4998         return eir_len;
4999 }
5000
5001 static void hci_extended_inquiry_result_evt(struct hci_dev *hdev, void *edata,
5002                                             struct sk_buff *skb)
5003 {
5004         struct hci_ev_ext_inquiry_result *ev = edata;
5005         struct inquiry_data data;
5006         size_t eir_len;
5007         int i;
5008
5009         if (!hci_ev_skb_pull(hdev, skb, HCI_EV_EXTENDED_INQUIRY_RESULT,
5010                              flex_array_size(ev, info, ev->num)))
5011                 return;
5012
5013         bt_dev_dbg(hdev, "num %d", ev->num);
5014
5015         if (!ev->num)
5016                 return;
5017
5018         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
5019                 return;
5020
5021         hci_dev_lock(hdev);
5022
5023         for (i = 0; i < ev->num; i++) {
5024                 struct extended_inquiry_info *info = &ev->info[i];
5025                 u32 flags;
5026                 bool name_known;
5027
5028                 bacpy(&data.bdaddr, &info->bdaddr);
5029                 data.pscan_rep_mode     = info->pscan_rep_mode;
5030                 data.pscan_period_mode  = info->pscan_period_mode;
5031                 data.pscan_mode         = 0x00;
5032                 memcpy(data.dev_class, info->dev_class, 3);
5033                 data.clock_offset       = info->clock_offset;
5034                 data.rssi               = info->rssi;
5035                 data.ssp_mode           = 0x01;
5036
5037                 if (hci_dev_test_flag(hdev, HCI_MGMT))
5038                         name_known = eir_get_data(info->data,
5039                                                   sizeof(info->data),
5040                                                   EIR_NAME_COMPLETE, NULL);
5041                 else
5042                         name_known = true;
5043
5044                 flags = hci_inquiry_cache_update(hdev, &data, name_known);
5045
5046                 eir_len = eir_get_length(info->data, sizeof(info->data));
5047
5048                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
5049                                   info->dev_class, info->rssi,
5050                                   flags, info->data, eir_len, NULL, 0);
5051         }
5052
5053         hci_dev_unlock(hdev);
5054 }
5055
5056 static void hci_key_refresh_complete_evt(struct hci_dev *hdev, void *data,
5057                                          struct sk_buff *skb)
5058 {
5059         struct hci_ev_key_refresh_complete *ev = data;
5060         struct hci_conn *conn;
5061
5062         bt_dev_dbg(hdev, "status 0x%2.2x handle 0x%4.4x", ev->status,
5063                    __le16_to_cpu(ev->handle));
5064
5065         hci_dev_lock(hdev);
5066
5067         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5068         if (!conn)
5069                 goto unlock;
5070
5071         /* For BR/EDR the necessary steps are taken through the
5072          * auth_complete event.
5073          */
5074         if (conn->type != LE_LINK)
5075                 goto unlock;
5076
5077         if (!ev->status)
5078                 conn->sec_level = conn->pending_sec_level;
5079
5080         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
5081
5082         if (ev->status && conn->state == BT_CONNECTED) {
5083                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
5084                 hci_conn_drop(conn);
5085                 goto unlock;
5086         }
5087
5088         if (conn->state == BT_CONFIG) {
5089                 if (!ev->status)
5090                         conn->state = BT_CONNECTED;
5091
5092                 hci_connect_cfm(conn, ev->status);
5093                 hci_conn_drop(conn);
5094         } else {
5095                 hci_auth_cfm(conn, ev->status);
5096
5097                 hci_conn_hold(conn);
5098                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
5099                 hci_conn_drop(conn);
5100         }
5101
5102 unlock:
5103         hci_dev_unlock(hdev);
5104 }
5105
5106 static u8 hci_get_auth_req(struct hci_conn *conn)
5107 {
5108         /* If remote requests no-bonding follow that lead */
5109         if (conn->remote_auth == HCI_AT_NO_BONDING ||
5110             conn->remote_auth == HCI_AT_NO_BONDING_MITM)
5111                 return conn->remote_auth | (conn->auth_type & 0x01);
5112
5113         /* If both remote and local have enough IO capabilities, require
5114          * MITM protection
5115          */
5116         if (conn->remote_cap != HCI_IO_NO_INPUT_OUTPUT &&
5117             conn->io_capability != HCI_IO_NO_INPUT_OUTPUT)
5118                 return conn->remote_auth | 0x01;
5119
5120         /* No MITM protection possible so ignore remote requirement */
5121         return (conn->remote_auth & ~0x01) | (conn->auth_type & 0x01);
5122 }
5123
5124 static u8 bredr_oob_data_present(struct hci_conn *conn)
5125 {
5126         struct hci_dev *hdev = conn->hdev;
5127         struct oob_data *data;
5128
5129         data = hci_find_remote_oob_data(hdev, &conn->dst, BDADDR_BREDR);
5130         if (!data)
5131                 return 0x00;
5132
5133         if (bredr_sc_enabled(hdev)) {
5134                 /* When Secure Connections is enabled, then just
5135                  * return the present value stored with the OOB
5136                  * data. The stored value contains the right present
5137                  * information. However it can only be trusted when
5138                  * not in Secure Connection Only mode.
5139                  */
5140                 if (!hci_dev_test_flag(hdev, HCI_SC_ONLY))
5141                         return data->present;
5142
5143                 /* When Secure Connections Only mode is enabled, then
5144                  * the P-256 values are required. If they are not
5145                  * available, then do not declare that OOB data is
5146                  * present.
5147                  */
5148                 if (!memcmp(data->rand256, ZERO_KEY, 16) ||
5149                     !memcmp(data->hash256, ZERO_KEY, 16))
5150                         return 0x00;
5151
5152                 return 0x02;
5153         }
5154
5155         /* When Secure Connections is not enabled or actually
5156          * not supported by the hardware, then check that if
5157          * P-192 data values are present.
5158          */
5159         if (!memcmp(data->rand192, ZERO_KEY, 16) ||
5160             !memcmp(data->hash192, ZERO_KEY, 16))
5161                 return 0x00;
5162
5163         return 0x01;
5164 }
5165
5166 static void hci_io_capa_request_evt(struct hci_dev *hdev, void *data,
5167                                     struct sk_buff *skb)
5168 {
5169         struct hci_ev_io_capa_request *ev = data;
5170         struct hci_conn *conn;
5171
5172         bt_dev_dbg(hdev, "");
5173
5174         hci_dev_lock(hdev);
5175
5176         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
5177         if (!conn)
5178                 goto unlock;
5179
5180         hci_conn_hold(conn);
5181
5182         if (!hci_dev_test_flag(hdev, HCI_MGMT))
5183                 goto unlock;
5184
5185         /* Allow pairing if we're pairable, the initiators of the
5186          * pairing or if the remote is not requesting bonding.
5187          */
5188         if (hci_dev_test_flag(hdev, HCI_BONDABLE) ||
5189             test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags) ||
5190             (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
5191                 struct hci_cp_io_capability_reply cp;
5192
5193                 bacpy(&cp.bdaddr, &ev->bdaddr);
5194                 /* Change the IO capability from KeyboardDisplay
5195                  * to DisplayYesNo as it is not supported by BT spec. */
5196                 cp.capability = (conn->io_capability == 0x04) ?
5197                                 HCI_IO_DISPLAY_YESNO : conn->io_capability;
5198
5199                 /* If we are initiators, there is no remote information yet */
5200                 if (conn->remote_auth == 0xff) {
5201                         /* Request MITM protection if our IO caps allow it
5202                          * except for the no-bonding case.
5203                          */
5204                         if (conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
5205                             conn->auth_type != HCI_AT_NO_BONDING)
5206                                 conn->auth_type |= 0x01;
5207                 } else {
5208                         conn->auth_type = hci_get_auth_req(conn);
5209                 }
5210
5211                 /* If we're not bondable, force one of the non-bondable
5212                  * authentication requirement values.
5213                  */
5214                 if (!hci_dev_test_flag(hdev, HCI_BONDABLE))
5215                         conn->auth_type &= HCI_AT_NO_BONDING_MITM;
5216
5217                 cp.authentication = conn->auth_type;
5218                 cp.oob_data = bredr_oob_data_present(conn);
5219
5220                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
5221                              sizeof(cp), &cp);
5222         } else {
5223                 struct hci_cp_io_capability_neg_reply cp;
5224
5225                 bacpy(&cp.bdaddr, &ev->bdaddr);
5226                 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
5227
5228                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
5229                              sizeof(cp), &cp);
5230         }
5231
5232 unlock:
5233         hci_dev_unlock(hdev);
5234 }
5235
5236 static void hci_io_capa_reply_evt(struct hci_dev *hdev, void *data,
5237                                   struct sk_buff *skb)
5238 {
5239         struct hci_ev_io_capa_reply *ev = data;
5240         struct hci_conn *conn;
5241
5242         bt_dev_dbg(hdev, "");
5243
5244         hci_dev_lock(hdev);
5245
5246         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
5247         if (!conn)
5248                 goto unlock;
5249
5250         conn->remote_cap = ev->capability;
5251         conn->remote_auth = ev->authentication;
5252
5253 unlock:
5254         hci_dev_unlock(hdev);
5255 }
5256
5257 static void hci_user_confirm_request_evt(struct hci_dev *hdev, void *data,
5258                                          struct sk_buff *skb)
5259 {
5260         struct hci_ev_user_confirm_req *ev = data;
5261         int loc_mitm, rem_mitm, confirm_hint = 0;
5262         struct hci_conn *conn;
5263
5264         bt_dev_dbg(hdev, "");
5265
5266         hci_dev_lock(hdev);
5267
5268         if (!hci_dev_test_flag(hdev, HCI_MGMT))
5269                 goto unlock;
5270
5271         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
5272         if (!conn)
5273                 goto unlock;
5274
5275         loc_mitm = (conn->auth_type & 0x01);
5276         rem_mitm = (conn->remote_auth & 0x01);
5277
5278         /* If we require MITM but the remote device can't provide that
5279          * (it has NoInputNoOutput) then reject the confirmation
5280          * request. We check the security level here since it doesn't
5281          * necessarily match conn->auth_type.
5282          */
5283         if (conn->pending_sec_level > BT_SECURITY_MEDIUM &&
5284             conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
5285                 bt_dev_dbg(hdev, "Rejecting request: remote device can't provide MITM");
5286                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
5287                              sizeof(ev->bdaddr), &ev->bdaddr);
5288                 goto unlock;
5289         }
5290
5291         /* If no side requires MITM protection; auto-accept */
5292         if ((!loc_mitm || conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) &&
5293             (!rem_mitm || conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)) {
5294
5295                 /* If we're not the initiators request authorization to
5296                  * proceed from user space (mgmt_user_confirm with
5297                  * confirm_hint set to 1). The exception is if neither
5298                  * side had MITM or if the local IO capability is
5299                  * NoInputNoOutput, in which case we do auto-accept
5300                  */
5301                 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&
5302                     conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
5303                     (loc_mitm || rem_mitm)) {
5304                         bt_dev_dbg(hdev, "Confirming auto-accept as acceptor");
5305                         confirm_hint = 1;
5306                         goto confirm;
5307                 }
5308
5309                 /* If there already exists link key in local host, leave the
5310                  * decision to user space since the remote device could be
5311                  * legitimate or malicious.
5312                  */
5313                 if (hci_find_link_key(hdev, &ev->bdaddr)) {
5314                         bt_dev_dbg(hdev, "Local host already has link key");
5315                         confirm_hint = 1;
5316                         goto confirm;
5317                 }
5318
5319                 BT_DBG("Auto-accept of user confirmation with %ums delay",
5320                        hdev->auto_accept_delay);
5321
5322                 if (hdev->auto_accept_delay > 0) {
5323                         int delay = msecs_to_jiffies(hdev->auto_accept_delay);
5324                         queue_delayed_work(conn->hdev->workqueue,
5325                                            &conn->auto_accept_work, delay);
5326                         goto unlock;
5327                 }
5328
5329                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
5330                              sizeof(ev->bdaddr), &ev->bdaddr);
5331                 goto unlock;
5332         }
5333
5334 confirm:
5335         mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0,
5336                                   le32_to_cpu(ev->passkey), confirm_hint);
5337
5338 unlock:
5339         hci_dev_unlock(hdev);
5340 }
5341
5342 static void hci_user_passkey_request_evt(struct hci_dev *hdev, void *data,
5343                                          struct sk_buff *skb)
5344 {
5345         struct hci_ev_user_passkey_req *ev = data;
5346
5347         bt_dev_dbg(hdev, "");
5348
5349         if (hci_dev_test_flag(hdev, HCI_MGMT))
5350                 mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
5351 }
5352
5353 static void hci_user_passkey_notify_evt(struct hci_dev *hdev, void *data,
5354                                         struct sk_buff *skb)
5355 {
5356         struct hci_ev_user_passkey_notify *ev = data;
5357         struct hci_conn *conn;
5358
5359         bt_dev_dbg(hdev, "");
5360
5361         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
5362         if (!conn)
5363                 return;
5364
5365         conn->passkey_notify = __le32_to_cpu(ev->passkey);
5366         conn->passkey_entered = 0;
5367
5368         if (hci_dev_test_flag(hdev, HCI_MGMT))
5369                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
5370                                          conn->dst_type, conn->passkey_notify,
5371                                          conn->passkey_entered);
5372 }
5373
5374 static void hci_keypress_notify_evt(struct hci_dev *hdev, void *data,
5375                                     struct sk_buff *skb)
5376 {
5377         struct hci_ev_keypress_notify *ev = data;
5378         struct hci_conn *conn;
5379
5380         bt_dev_dbg(hdev, "");
5381
5382         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
5383         if (!conn)
5384                 return;
5385
5386         switch (ev->type) {
5387         case HCI_KEYPRESS_STARTED:
5388                 conn->passkey_entered = 0;
5389                 return;
5390
5391         case HCI_KEYPRESS_ENTERED:
5392                 conn->passkey_entered++;
5393                 break;
5394
5395         case HCI_KEYPRESS_ERASED:
5396                 conn->passkey_entered--;
5397                 break;
5398
5399         case HCI_KEYPRESS_CLEARED:
5400                 conn->passkey_entered = 0;
5401                 break;
5402
5403         case HCI_KEYPRESS_COMPLETED:
5404                 return;
5405         }
5406
5407         if (hci_dev_test_flag(hdev, HCI_MGMT))
5408                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
5409                                          conn->dst_type, conn->passkey_notify,
5410                                          conn->passkey_entered);
5411 }
5412
5413 static void hci_simple_pair_complete_evt(struct hci_dev *hdev, void *data,
5414                                          struct sk_buff *skb)
5415 {
5416         struct hci_ev_simple_pair_complete *ev = data;
5417         struct hci_conn *conn;
5418
5419         bt_dev_dbg(hdev, "");
5420
5421         hci_dev_lock(hdev);
5422
5423         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
5424         if (!conn)
5425                 goto unlock;
5426
5427         /* Reset the authentication requirement to unknown */
5428         conn->remote_auth = 0xff;
5429
5430         /* To avoid duplicate auth_failed events to user space we check
5431          * the HCI_CONN_AUTH_PEND flag which will be set if we
5432          * initiated the authentication. A traditional auth_complete
5433          * event gets always produced as initiator and is also mapped to
5434          * the mgmt_auth_failed event */
5435         if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status)
5436                 mgmt_auth_failed(conn, ev->status);
5437
5438         hci_conn_drop(conn);
5439
5440 unlock:
5441         hci_dev_unlock(hdev);
5442 }
5443
5444 static void hci_remote_host_features_evt(struct hci_dev *hdev, void *data,
5445                                          struct sk_buff *skb)
5446 {
5447         struct hci_ev_remote_host_features *ev = data;
5448         struct inquiry_entry *ie;
5449         struct hci_conn *conn;
5450
5451         bt_dev_dbg(hdev, "");
5452
5453         hci_dev_lock(hdev);
5454
5455         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
5456         if (conn)
5457                 memcpy(conn->features[1], ev->features, 8);
5458
5459         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
5460         if (ie)
5461                 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
5462
5463         hci_dev_unlock(hdev);
5464 }
5465
5466 static void hci_remote_oob_data_request_evt(struct hci_dev *hdev, void *edata,
5467                                             struct sk_buff *skb)
5468 {
5469         struct hci_ev_remote_oob_data_request *ev = edata;
5470         struct oob_data *data;
5471
5472         bt_dev_dbg(hdev, "");
5473
5474         hci_dev_lock(hdev);
5475
5476         if (!hci_dev_test_flag(hdev, HCI_MGMT))
5477                 goto unlock;
5478
5479         data = hci_find_remote_oob_data(hdev, &ev->bdaddr, BDADDR_BREDR);
5480         if (!data) {
5481                 struct hci_cp_remote_oob_data_neg_reply cp;
5482
5483                 bacpy(&cp.bdaddr, &ev->bdaddr);
5484                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY,
5485                              sizeof(cp), &cp);
5486                 goto unlock;
5487         }
5488
5489         if (bredr_sc_enabled(hdev)) {
5490                 struct hci_cp_remote_oob_ext_data_reply cp;
5491
5492                 bacpy(&cp.bdaddr, &ev->bdaddr);
5493                 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
5494                         memset(cp.hash192, 0, sizeof(cp.hash192));
5495                         memset(cp.rand192, 0, sizeof(cp.rand192));
5496                 } else {
5497                         memcpy(cp.hash192, data->hash192, sizeof(cp.hash192));
5498                         memcpy(cp.rand192, data->rand192, sizeof(cp.rand192));
5499                 }
5500                 memcpy(cp.hash256, data->hash256, sizeof(cp.hash256));
5501                 memcpy(cp.rand256, data->rand256, sizeof(cp.rand256));
5502
5503                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_EXT_DATA_REPLY,
5504                              sizeof(cp), &cp);
5505         } else {
5506                 struct hci_cp_remote_oob_data_reply cp;
5507
5508                 bacpy(&cp.bdaddr, &ev->bdaddr);
5509                 memcpy(cp.hash, data->hash192, sizeof(cp.hash));
5510                 memcpy(cp.rand, data->rand192, sizeof(cp.rand));
5511
5512                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY,
5513                              sizeof(cp), &cp);
5514         }
5515
5516 unlock:
5517         hci_dev_unlock(hdev);
5518 }
5519
5520 #if IS_ENABLED(CONFIG_BT_HS)
5521 static void hci_chan_selected_evt(struct hci_dev *hdev, void *data,
5522                                   struct sk_buff *skb)
5523 {
5524         struct hci_ev_channel_selected *ev = data;
5525         struct hci_conn *hcon;
5526
5527         bt_dev_dbg(hdev, "handle 0x%2.2x", ev->phy_handle);
5528
5529         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
5530         if (!hcon)
5531                 return;
5532
5533         amp_read_loc_assoc_final_data(hdev, hcon);
5534 }
5535
5536 static void hci_phy_link_complete_evt(struct hci_dev *hdev, void *data,
5537                                       struct sk_buff *skb)
5538 {
5539         struct hci_ev_phy_link_complete *ev = data;
5540         struct hci_conn *hcon, *bredr_hcon;
5541
5542         bt_dev_dbg(hdev, "handle 0x%2.2x status 0x%2.2x", ev->phy_handle,
5543                    ev->status);
5544
5545         hci_dev_lock(hdev);
5546
5547         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
5548         if (!hcon)
5549                 goto unlock;
5550
5551         if (!hcon->amp_mgr)
5552                 goto unlock;
5553
5554         if (ev->status) {
5555                 hci_conn_del(hcon);
5556                 goto unlock;
5557         }
5558
5559         bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
5560
5561         hcon->state = BT_CONNECTED;
5562         bacpy(&hcon->dst, &bredr_hcon->dst);
5563
5564         hci_conn_hold(hcon);
5565         hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
5566         hci_conn_drop(hcon);
5567
5568         hci_debugfs_create_conn(hcon);
5569         hci_conn_add_sysfs(hcon);
5570
5571         amp_physical_cfm(bredr_hcon, hcon);
5572
5573 unlock:
5574         hci_dev_unlock(hdev);
5575 }
5576
5577 static void hci_loglink_complete_evt(struct hci_dev *hdev, void *data,
5578                                      struct sk_buff *skb)
5579 {
5580         struct hci_ev_logical_link_complete *ev = data;
5581         struct hci_conn *hcon;
5582         struct hci_chan *hchan;
5583         struct amp_mgr *mgr;
5584
5585         bt_dev_dbg(hdev, "log_handle 0x%4.4x phy_handle 0x%2.2x status 0x%2.2x",
5586                    le16_to_cpu(ev->handle), ev->phy_handle, ev->status);
5587
5588         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
5589         if (!hcon)
5590                 return;
5591
5592         /* Create AMP hchan */
5593         hchan = hci_chan_create(hcon);
5594         if (!hchan)
5595                 return;
5596
5597         hchan->handle = le16_to_cpu(ev->handle);
5598         hchan->amp = true;
5599
5600         BT_DBG("hcon %p mgr %p hchan %p", hcon, hcon->amp_mgr, hchan);
5601
5602         mgr = hcon->amp_mgr;
5603         if (mgr && mgr->bredr_chan) {
5604                 struct l2cap_chan *bredr_chan = mgr->bredr_chan;
5605
5606                 l2cap_chan_lock(bredr_chan);
5607
5608                 bredr_chan->conn->mtu = hdev->block_mtu;
5609                 l2cap_logical_cfm(bredr_chan, hchan, 0);
5610                 hci_conn_hold(hcon);
5611
5612                 l2cap_chan_unlock(bredr_chan);
5613         }
5614 }
5615
5616 static void hci_disconn_loglink_complete_evt(struct hci_dev *hdev, void *data,
5617                                              struct sk_buff *skb)
5618 {
5619         struct hci_ev_disconn_logical_link_complete *ev = data;
5620         struct hci_chan *hchan;
5621
5622         bt_dev_dbg(hdev, "handle 0x%4.4x status 0x%2.2x",
5623                    le16_to_cpu(ev->handle), ev->status);
5624
5625         if (ev->status)
5626                 return;
5627
5628         hci_dev_lock(hdev);
5629
5630         hchan = hci_chan_lookup_handle(hdev, le16_to_cpu(ev->handle));
5631         if (!hchan || !hchan->amp)
5632                 goto unlock;
5633
5634         amp_destroy_logical_link(hchan, ev->reason);
5635
5636 unlock:
5637         hci_dev_unlock(hdev);
5638 }
5639
5640 static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev, void *data,
5641                                              struct sk_buff *skb)
5642 {
5643         struct hci_ev_disconn_phy_link_complete *ev = data;
5644         struct hci_conn *hcon;
5645
5646         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
5647
5648         if (ev->status)
5649                 return;
5650
5651         hci_dev_lock(hdev);
5652
5653         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
5654         if (hcon && hcon->type == AMP_LINK) {
5655                 hcon->state = BT_CLOSED;
5656                 hci_disconn_cfm(hcon, ev->reason);
5657                 hci_conn_del(hcon);
5658         }
5659
5660         hci_dev_unlock(hdev);
5661 }
5662 #endif
5663
5664 static void le_conn_update_addr(struct hci_conn *conn, bdaddr_t *bdaddr,
5665                                 u8 bdaddr_type, bdaddr_t *local_rpa)
5666 {
5667         if (conn->out) {
5668                 conn->dst_type = bdaddr_type;
5669                 conn->resp_addr_type = bdaddr_type;
5670                 bacpy(&conn->resp_addr, bdaddr);
5671
5672                 /* Check if the controller has set a Local RPA then it must be
5673                  * used instead or hdev->rpa.
5674                  */
5675                 if (local_rpa && bacmp(local_rpa, BDADDR_ANY)) {
5676                         conn->init_addr_type = ADDR_LE_DEV_RANDOM;
5677                         bacpy(&conn->init_addr, local_rpa);
5678                 } else if (hci_dev_test_flag(conn->hdev, HCI_PRIVACY)) {
5679                         conn->init_addr_type = ADDR_LE_DEV_RANDOM;
5680                         bacpy(&conn->init_addr, &conn->hdev->rpa);
5681                 } else {
5682                         hci_copy_identity_address(conn->hdev, &conn->init_addr,
5683                                                   &conn->init_addr_type);
5684                 }
5685         } else {
5686                 conn->resp_addr_type = conn->hdev->adv_addr_type;
5687                 /* Check if the controller has set a Local RPA then it must be
5688                  * used instead or hdev->rpa.
5689                  */
5690                 if (local_rpa && bacmp(local_rpa, BDADDR_ANY)) {
5691                         conn->resp_addr_type = ADDR_LE_DEV_RANDOM;
5692                         bacpy(&conn->resp_addr, local_rpa);
5693                 } else if (conn->hdev->adv_addr_type == ADDR_LE_DEV_RANDOM) {
5694                         /* In case of ext adv, resp_addr will be updated in
5695                          * Adv Terminated event.
5696                          */
5697                         if (!ext_adv_capable(conn->hdev))
5698                                 bacpy(&conn->resp_addr,
5699                                       &conn->hdev->random_addr);
5700                 } else {
5701                         bacpy(&conn->resp_addr, &conn->hdev->bdaddr);
5702                 }
5703
5704                 conn->init_addr_type = bdaddr_type;
5705                 bacpy(&conn->init_addr, bdaddr);
5706
5707                 /* For incoming connections, set the default minimum
5708                  * and maximum connection interval. They will be used
5709                  * to check if the parameters are in range and if not
5710                  * trigger the connection update procedure.
5711                  */
5712                 conn->le_conn_min_interval = conn->hdev->le_conn_min_interval;
5713                 conn->le_conn_max_interval = conn->hdev->le_conn_max_interval;
5714         }
5715 }
5716
5717 static void le_conn_complete_evt(struct hci_dev *hdev, u8 status,
5718                                  bdaddr_t *bdaddr, u8 bdaddr_type,
5719                                  bdaddr_t *local_rpa, u8 role, u16 handle,
5720                                  u16 interval, u16 latency,
5721                                  u16 supervision_timeout)
5722 {
5723         struct hci_conn_params *params;
5724         struct hci_conn *conn;
5725         struct smp_irk *irk;
5726         u8 addr_type;
5727
5728         hci_dev_lock(hdev);
5729
5730         /* All controllers implicitly stop advertising in the event of a
5731          * connection, so ensure that the state bit is cleared.
5732          */
5733         hci_dev_clear_flag(hdev, HCI_LE_ADV);
5734
5735         conn = hci_lookup_le_connect(hdev);
5736         if (!conn) {
5737                 /* In case of error status and there is no connection pending
5738                  * just unlock as there is nothing to cleanup.
5739                  */
5740                 if (status)
5741                         goto unlock;
5742
5743                 conn = hci_conn_add(hdev, LE_LINK, bdaddr, role);
5744                 if (!conn) {
5745                         bt_dev_err(hdev, "no memory for new connection");
5746                         goto unlock;
5747                 }
5748
5749                 conn->dst_type = bdaddr_type;
5750
5751                 /* If we didn't have a hci_conn object previously
5752                  * but we're in central role this must be something
5753                  * initiated using an accept list. Since accept list based
5754                  * connections are not "first class citizens" we don't
5755                  * have full tracking of them. Therefore, we go ahead
5756                  * with a "best effort" approach of determining the
5757                  * initiator address based on the HCI_PRIVACY flag.
5758                  */
5759                 if (conn->out) {
5760                         conn->resp_addr_type = bdaddr_type;
5761                         bacpy(&conn->resp_addr, bdaddr);
5762                         if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
5763                                 conn->init_addr_type = ADDR_LE_DEV_RANDOM;
5764                                 bacpy(&conn->init_addr, &hdev->rpa);
5765                         } else {
5766                                 hci_copy_identity_address(hdev,
5767                                                           &conn->init_addr,
5768                                                           &conn->init_addr_type);
5769                         }
5770                 }
5771         } else {
5772                 cancel_delayed_work(&conn->le_conn_timeout);
5773         }
5774
5775         /* The HCI_LE_Connection_Complete event is only sent once per connection.
5776          * Processing it more than once per connection can corrupt kernel memory.
5777          *
5778          * As the connection handle is set here for the first time, it indicates
5779          * whether the connection is already set up.
5780          */
5781         if (conn->handle != HCI_CONN_HANDLE_UNSET) {
5782                 bt_dev_err(hdev, "Ignoring HCI_Connection_Complete for existing connection");
5783                 goto unlock;
5784         }
5785
5786         le_conn_update_addr(conn, bdaddr, bdaddr_type, local_rpa);
5787
5788         /* Lookup the identity address from the stored connection
5789          * address and address type.
5790          *
5791          * When establishing connections to an identity address, the
5792          * connection procedure will store the resolvable random
5793          * address first. Now if it can be converted back into the
5794          * identity address, start using the identity address from
5795          * now on.
5796          */
5797         irk = hci_get_irk(hdev, &conn->dst, conn->dst_type);
5798         if (irk) {
5799                 bacpy(&conn->dst, &irk->bdaddr);
5800                 conn->dst_type = irk->addr_type;
5801         }
5802
5803         conn->dst_type = ev_bdaddr_type(hdev, conn->dst_type, NULL);
5804
5805         if (handle > HCI_CONN_HANDLE_MAX) {
5806                 bt_dev_err(hdev, "Invalid handle: 0x%4.4x > 0x%4.4x", handle,
5807                            HCI_CONN_HANDLE_MAX);
5808                 status = HCI_ERROR_INVALID_PARAMETERS;
5809         }
5810
5811         /* All connection failure handling is taken care of by the
5812          * hci_conn_failed function which is triggered by the HCI
5813          * request completion callbacks used for connecting.
5814          */
5815         if (status)
5816                 goto unlock;
5817
5818         if (conn->dst_type == ADDR_LE_DEV_PUBLIC)
5819                 addr_type = BDADDR_LE_PUBLIC;
5820         else
5821                 addr_type = BDADDR_LE_RANDOM;
5822
5823         /* Drop the connection if the device is blocked */
5824         if (hci_bdaddr_list_lookup(&hdev->reject_list, &conn->dst, addr_type)) {
5825                 hci_conn_drop(conn);
5826                 goto unlock;
5827         }
5828
5829         if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
5830                 mgmt_device_connected(hdev, conn, NULL, 0);
5831
5832         conn->sec_level = BT_SECURITY_LOW;
5833         conn->handle = handle;
5834         conn->state = BT_CONFIG;
5835
5836         /* Store current advertising instance as connection advertising instance
5837          * when sotfware rotation is in use so it can be re-enabled when
5838          * disconnected.
5839          */
5840         if (!ext_adv_capable(hdev))
5841                 conn->adv_instance = hdev->cur_adv_instance;
5842
5843         conn->le_conn_interval = interval;
5844         conn->le_conn_latency = latency;
5845         conn->le_supv_timeout = supervision_timeout;
5846
5847         hci_debugfs_create_conn(conn);
5848         hci_conn_add_sysfs(conn);
5849
5850         /* The remote features procedure is defined for central
5851          * role only. So only in case of an initiated connection
5852          * request the remote features.
5853          *
5854          * If the local controller supports peripheral-initiated features
5855          * exchange, then requesting the remote features in peripheral
5856          * role is possible. Otherwise just transition into the
5857          * connected state without requesting the remote features.
5858          */
5859         if (conn->out ||
5860             (hdev->le_features[0] & HCI_LE_PERIPHERAL_FEATURES)) {
5861                 struct hci_cp_le_read_remote_features cp;
5862
5863                 cp.handle = __cpu_to_le16(conn->handle);
5864
5865                 hci_send_cmd(hdev, HCI_OP_LE_READ_REMOTE_FEATURES,
5866                              sizeof(cp), &cp);
5867
5868                 hci_conn_hold(conn);
5869         } else {
5870                 conn->state = BT_CONNECTED;
5871                 hci_connect_cfm(conn, status);
5872         }
5873
5874         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
5875                                            conn->dst_type);
5876         if (params) {
5877                 list_del_init(&params->action);
5878                 if (params->conn) {
5879                         hci_conn_drop(params->conn);
5880                         hci_conn_put(params->conn);
5881                         params->conn = NULL;
5882                 }
5883         }
5884
5885 unlock:
5886         hci_update_passive_scan(hdev);
5887         hci_dev_unlock(hdev);
5888 }
5889
5890 static void hci_le_conn_complete_evt(struct hci_dev *hdev, void *data,
5891                                      struct sk_buff *skb)
5892 {
5893         struct hci_ev_le_conn_complete *ev = data;
5894
5895         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
5896
5897         le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,
5898                              NULL, ev->role, le16_to_cpu(ev->handle),
5899                              le16_to_cpu(ev->interval),
5900                              le16_to_cpu(ev->latency),
5901                              le16_to_cpu(ev->supervision_timeout));
5902 }
5903
5904 static void hci_le_enh_conn_complete_evt(struct hci_dev *hdev, void *data,
5905                                          struct sk_buff *skb)
5906 {
5907         struct hci_ev_le_enh_conn_complete *ev = data;
5908
5909         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
5910
5911         le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,
5912                              &ev->local_rpa, ev->role, le16_to_cpu(ev->handle),
5913                              le16_to_cpu(ev->interval),
5914                              le16_to_cpu(ev->latency),
5915                              le16_to_cpu(ev->supervision_timeout));
5916 }
5917
5918 static void hci_le_ext_adv_term_evt(struct hci_dev *hdev, void *data,
5919                                     struct sk_buff *skb)
5920 {
5921         struct hci_evt_le_ext_adv_set_term *ev = data;
5922         struct hci_conn *conn;
5923         struct adv_info *adv, *n;
5924
5925         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
5926
5927         /* The Bluetooth Core 5.3 specification clearly states that this event
5928          * shall not be sent when the Host disables the advertising set. So in
5929          * case of HCI_ERROR_CANCELLED_BY_HOST, just ignore the event.
5930          *
5931          * When the Host disables an advertising set, all cleanup is done via
5932          * its command callback and not needed to be duplicated here.
5933          */
5934         if (ev->status == HCI_ERROR_CANCELLED_BY_HOST) {
5935                 bt_dev_warn_ratelimited(hdev, "Unexpected advertising set terminated event");
5936                 return;
5937         }
5938
5939         hci_dev_lock(hdev);
5940
5941         adv = hci_find_adv_instance(hdev, ev->handle);
5942
5943         if (ev->status) {
5944                 if (!adv)
5945                         goto unlock;
5946
5947                 /* Remove advertising as it has been terminated */
5948                 hci_remove_adv_instance(hdev, ev->handle);
5949                 mgmt_advertising_removed(NULL, hdev, ev->handle);
5950
5951                 list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) {
5952                         if (adv->enabled)
5953                                 goto unlock;
5954                 }
5955
5956                 /* We are no longer advertising, clear HCI_LE_ADV */
5957                 hci_dev_clear_flag(hdev, HCI_LE_ADV);
5958                 goto unlock;
5959         }
5960
5961         if (adv)
5962                 adv->enabled = false;
5963
5964         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->conn_handle));
5965         if (conn) {
5966                 /* Store handle in the connection so the correct advertising
5967                  * instance can be re-enabled when disconnected.
5968                  */
5969                 conn->adv_instance = ev->handle;
5970
5971                 if (hdev->adv_addr_type != ADDR_LE_DEV_RANDOM ||
5972                     bacmp(&conn->resp_addr, BDADDR_ANY))
5973                         goto unlock;
5974
5975                 if (!ev->handle) {
5976                         bacpy(&conn->resp_addr, &hdev->random_addr);
5977                         goto unlock;
5978                 }
5979
5980                 if (adv)
5981                         bacpy(&conn->resp_addr, &adv->random_addr);
5982         }
5983
5984 unlock:
5985         hci_dev_unlock(hdev);
5986 }
5987
5988 static void hci_le_conn_update_complete_evt(struct hci_dev *hdev, void *data,
5989                                             struct sk_buff *skb)
5990 {
5991         struct hci_ev_le_conn_update_complete *ev = data;
5992         struct hci_conn *conn;
5993
5994         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
5995
5996         if (ev->status)
5997                 return;
5998
5999         hci_dev_lock(hdev);
6000
6001         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
6002         if (conn) {
6003                 conn->le_conn_interval = le16_to_cpu(ev->interval);
6004                 conn->le_conn_latency = le16_to_cpu(ev->latency);
6005                 conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
6006         }
6007
6008         hci_dev_unlock(hdev);
6009 }
6010
6011 /* This function requires the caller holds hdev->lock */
6012 static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev,
6013                                               bdaddr_t *addr,
6014                                               u8 addr_type, bool addr_resolved,
6015                                               u8 adv_type)
6016 {
6017         struct hci_conn *conn;
6018         struct hci_conn_params *params;
6019
6020         /* If the event is not connectable don't proceed further */
6021         if (adv_type != LE_ADV_IND && adv_type != LE_ADV_DIRECT_IND)
6022                 return NULL;
6023
6024         /* Ignore if the device is blocked or hdev is suspended */
6025         if (hci_bdaddr_list_lookup(&hdev->reject_list, addr, addr_type) ||
6026             hdev->suspended)
6027                 return NULL;
6028
6029         /* Most controller will fail if we try to create new connections
6030          * while we have an existing one in peripheral role.
6031          */
6032         if (hdev->conn_hash.le_num_peripheral > 0 &&
6033             (!test_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks) ||
6034              !(hdev->le_states[3] & 0x10)))
6035                 return NULL;
6036
6037         /* If we're not connectable only connect devices that we have in
6038          * our pend_le_conns list.
6039          */
6040         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, addr,
6041                                            addr_type);
6042         if (!params)
6043                 return NULL;
6044
6045         if (!params->explicit_connect) {
6046                 switch (params->auto_connect) {
6047                 case HCI_AUTO_CONN_DIRECT:
6048                         /* Only devices advertising with ADV_DIRECT_IND are
6049                          * triggering a connection attempt. This is allowing
6050                          * incoming connections from peripheral devices.
6051                          */
6052                         if (adv_type != LE_ADV_DIRECT_IND)
6053                                 return NULL;
6054                         break;
6055                 case HCI_AUTO_CONN_ALWAYS:
6056                         /* Devices advertising with ADV_IND or ADV_DIRECT_IND
6057                          * are triggering a connection attempt. This means
6058                          * that incoming connections from peripheral device are
6059                          * accepted and also outgoing connections to peripheral
6060                          * devices are established when found.
6061                          */
6062                         break;
6063                 default:
6064                         return NULL;
6065                 }
6066         }
6067
6068         conn = hci_connect_le(hdev, addr, addr_type, addr_resolved,
6069                               BT_SECURITY_LOW, hdev->def_le_autoconnect_timeout,
6070                               HCI_ROLE_MASTER);
6071         if (!IS_ERR(conn)) {
6072                 /* If HCI_AUTO_CONN_EXPLICIT is set, conn is already owned
6073                  * by higher layer that tried to connect, if no then
6074                  * store the pointer since we don't really have any
6075                  * other owner of the object besides the params that
6076                  * triggered it. This way we can abort the connection if
6077                  * the parameters get removed and keep the reference
6078                  * count consistent once the connection is established.
6079                  */
6080
6081                 if (!params->explicit_connect)
6082                         params->conn = hci_conn_get(conn);
6083
6084                 return conn;
6085         }
6086
6087         switch (PTR_ERR(conn)) {
6088         case -EBUSY:
6089                 /* If hci_connect() returns -EBUSY it means there is already
6090                  * an LE connection attempt going on. Since controllers don't
6091                  * support more than one connection attempt at the time, we
6092                  * don't consider this an error case.
6093                  */
6094                 break;
6095         default:
6096                 BT_DBG("Failed to connect: err %ld", PTR_ERR(conn));
6097                 return NULL;
6098         }
6099
6100         return NULL;
6101 }
6102
6103 static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
6104                                u8 bdaddr_type, bdaddr_t *direct_addr,
6105                                u8 direct_addr_type, s8 rssi, u8 *data, u8 len,
6106                                bool ext_adv)
6107 {
6108         struct discovery_state *d = &hdev->discovery;
6109         struct smp_irk *irk;
6110         struct hci_conn *conn;
6111         bool match, bdaddr_resolved;
6112         u32 flags;
6113         u8 *ptr;
6114
6115         switch (type) {
6116         case LE_ADV_IND:
6117         case LE_ADV_DIRECT_IND:
6118         case LE_ADV_SCAN_IND:
6119         case LE_ADV_NONCONN_IND:
6120         case LE_ADV_SCAN_RSP:
6121                 break;
6122         default:
6123                 bt_dev_err_ratelimited(hdev, "unknown advertising packet "
6124                                        "type: 0x%02x", type);
6125                 return;
6126         }
6127
6128         if (!ext_adv && len > HCI_MAX_AD_LENGTH) {
6129                 bt_dev_err_ratelimited(hdev, "legacy adv larger than 31 bytes");
6130                 return;
6131         }
6132
6133         /* Find the end of the data in case the report contains padded zero
6134          * bytes at the end causing an invalid length value.
6135          *
6136          * When data is NULL, len is 0 so there is no need for extra ptr
6137          * check as 'ptr < data + 0' is already false in such case.
6138          */
6139         for (ptr = data; ptr < data + len && *ptr; ptr += *ptr + 1) {
6140                 if (ptr + 1 + *ptr > data + len)
6141                         break;
6142         }
6143
6144         /* Adjust for actual length. This handles the case when remote
6145          * device is advertising with incorrect data length.
6146          */
6147         len = ptr - data;
6148
6149         /* If the direct address is present, then this report is from
6150          * a LE Direct Advertising Report event. In that case it is
6151          * important to see if the address is matching the local
6152          * controller address.
6153          */
6154         if (direct_addr) {
6155                 direct_addr_type = ev_bdaddr_type(hdev, direct_addr_type,
6156                                                   &bdaddr_resolved);
6157
6158                 /* Only resolvable random addresses are valid for these
6159                  * kind of reports and others can be ignored.
6160                  */
6161                 if (!hci_bdaddr_is_rpa(direct_addr, direct_addr_type))
6162                         return;
6163
6164                 /* If the controller is not using resolvable random
6165                  * addresses, then this report can be ignored.
6166                  */
6167                 if (!hci_dev_test_flag(hdev, HCI_PRIVACY))
6168                         return;
6169
6170                 /* If the local IRK of the controller does not match
6171                  * with the resolvable random address provided, then
6172                  * this report can be ignored.
6173                  */
6174                 if (!smp_irk_matches(hdev, hdev->irk, direct_addr))
6175                         return;
6176         }
6177
6178         /* Check if we need to convert to identity address */
6179         irk = hci_get_irk(hdev, bdaddr, bdaddr_type);
6180         if (irk) {
6181                 bdaddr = &irk->bdaddr;
6182                 bdaddr_type = irk->addr_type;
6183         }
6184
6185         bdaddr_type = ev_bdaddr_type(hdev, bdaddr_type, &bdaddr_resolved);
6186
6187         /* Check if we have been requested to connect to this device.
6188          *
6189          * direct_addr is set only for directed advertising reports (it is NULL
6190          * for advertising reports) and is already verified to be RPA above.
6191          */
6192         conn = check_pending_le_conn(hdev, bdaddr, bdaddr_type, bdaddr_resolved,
6193                                      type);
6194         if (!ext_adv && conn && type == LE_ADV_IND && len <= HCI_MAX_AD_LENGTH) {
6195                 /* Store report for later inclusion by
6196                  * mgmt_device_connected
6197                  */
6198                 memcpy(conn->le_adv_data, data, len);
6199                 conn->le_adv_data_len = len;
6200         }
6201
6202         /* Passive scanning shouldn't trigger any device found events,
6203          * except for devices marked as CONN_REPORT for which we do send
6204          * device found events, or advertisement monitoring requested.
6205          */
6206         if (hdev->le_scan_type == LE_SCAN_PASSIVE) {
6207                 if (type == LE_ADV_DIRECT_IND)
6208                         return;
6209
6210                 if (!hci_pend_le_action_lookup(&hdev->pend_le_reports,
6211                                                bdaddr, bdaddr_type) &&
6212                     idr_is_empty(&hdev->adv_monitors_idr))
6213                         return;
6214
6215                 if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND)
6216                         flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
6217                 else
6218                         flags = 0;
6219                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
6220                                   rssi, flags, data, len, NULL, 0);
6221                 return;
6222         }
6223
6224         /* When receiving non-connectable or scannable undirected
6225          * advertising reports, this means that the remote device is
6226          * not connectable and then clearly indicate this in the
6227          * device found event.
6228          *
6229          * When receiving a scan response, then there is no way to
6230          * know if the remote device is connectable or not. However
6231          * since scan responses are merged with a previously seen
6232          * advertising report, the flags field from that report
6233          * will be used.
6234          *
6235          * In the really unlikely case that a controller get confused
6236          * and just sends a scan response event, then it is marked as
6237          * not connectable as well.
6238          */
6239         if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND ||
6240             type == LE_ADV_SCAN_RSP)
6241                 flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
6242         else
6243                 flags = 0;
6244
6245         /* If there's nothing pending either store the data from this
6246          * event or send an immediate device found event if the data
6247          * should not be stored for later.
6248          */
6249         if (!ext_adv && !has_pending_adv_report(hdev)) {
6250                 /* If the report will trigger a SCAN_REQ store it for
6251                  * later merging.
6252                  */
6253                 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
6254                         store_pending_adv_report(hdev, bdaddr, bdaddr_type,
6255                                                  rssi, flags, data, len);
6256                         return;
6257                 }
6258
6259                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
6260                                   rssi, flags, data, len, NULL, 0);
6261                 return;
6262         }
6263
6264         /* Check if the pending report is for the same device as the new one */
6265         match = (!bacmp(bdaddr, &d->last_adv_addr) &&
6266                  bdaddr_type == d->last_adv_addr_type);
6267
6268         /* If the pending data doesn't match this report or this isn't a
6269          * scan response (e.g. we got a duplicate ADV_IND) then force
6270          * sending of the pending data.
6271          */
6272         if (type != LE_ADV_SCAN_RSP || !match) {
6273                 /* Send out whatever is in the cache, but skip duplicates */
6274                 if (!match)
6275                         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
6276                                           d->last_adv_addr_type, NULL,
6277                                           d->last_adv_rssi, d->last_adv_flags,
6278                                           d->last_adv_data,
6279                                           d->last_adv_data_len, NULL, 0);
6280
6281                 /* If the new report will trigger a SCAN_REQ store it for
6282                  * later merging.
6283                  */
6284                 if (!ext_adv && (type == LE_ADV_IND ||
6285                                  type == LE_ADV_SCAN_IND)) {
6286                         store_pending_adv_report(hdev, bdaddr, bdaddr_type,
6287                                                  rssi, flags, data, len);
6288                         return;
6289                 }
6290
6291                 /* The advertising reports cannot be merged, so clear
6292                  * the pending report and send out a device found event.
6293                  */
6294                 clear_pending_adv_report(hdev);
6295                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
6296                                   rssi, flags, data, len, NULL, 0);
6297                 return;
6298         }
6299
6300         /* If we get here we've got a pending ADV_IND or ADV_SCAN_IND and
6301          * the new event is a SCAN_RSP. We can therefore proceed with
6302          * sending a merged device found event.
6303          */
6304         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
6305                           d->last_adv_addr_type, NULL, rssi, d->last_adv_flags,
6306                           d->last_adv_data, d->last_adv_data_len, data, len);
6307         clear_pending_adv_report(hdev);
6308 }
6309
6310 static void hci_le_adv_report_evt(struct hci_dev *hdev, void *data,
6311                                   struct sk_buff *skb)
6312 {
6313         struct hci_ev_le_advertising_report *ev = data;
6314
6315         if (!ev->num)
6316                 return;
6317
6318         hci_dev_lock(hdev);
6319
6320         while (ev->num--) {
6321                 struct hci_ev_le_advertising_info *info;
6322                 s8 rssi;
6323
6324                 info = hci_le_ev_skb_pull(hdev, skb,
6325                                           HCI_EV_LE_ADVERTISING_REPORT,
6326                                           sizeof(*info));
6327                 if (!info)
6328                         break;
6329
6330                 if (!hci_le_ev_skb_pull(hdev, skb, HCI_EV_LE_ADVERTISING_REPORT,
6331                                         info->length + 1))
6332                         break;
6333
6334                 if (info->length <= HCI_MAX_AD_LENGTH) {
6335                         rssi = info->data[info->length];
6336                         process_adv_report(hdev, info->type, &info->bdaddr,
6337                                            info->bdaddr_type, NULL, 0, rssi,
6338                                            info->data, info->length, false);
6339                 } else {
6340                         bt_dev_err(hdev, "Dropping invalid advertising data");
6341                 }
6342         }
6343
6344         hci_dev_unlock(hdev);
6345 }
6346
6347 static u8 ext_evt_type_to_legacy(struct hci_dev *hdev, u16 evt_type)
6348 {
6349         if (evt_type & LE_EXT_ADV_LEGACY_PDU) {
6350                 switch (evt_type) {
6351                 case LE_LEGACY_ADV_IND:
6352                         return LE_ADV_IND;
6353                 case LE_LEGACY_ADV_DIRECT_IND:
6354                         return LE_ADV_DIRECT_IND;
6355                 case LE_LEGACY_ADV_SCAN_IND:
6356                         return LE_ADV_SCAN_IND;
6357                 case LE_LEGACY_NONCONN_IND:
6358                         return LE_ADV_NONCONN_IND;
6359                 case LE_LEGACY_SCAN_RSP_ADV:
6360                 case LE_LEGACY_SCAN_RSP_ADV_SCAN:
6361                         return LE_ADV_SCAN_RSP;
6362                 }
6363
6364                 goto invalid;
6365         }
6366
6367         if (evt_type & LE_EXT_ADV_CONN_IND) {
6368                 if (evt_type & LE_EXT_ADV_DIRECT_IND)
6369                         return LE_ADV_DIRECT_IND;
6370
6371                 return LE_ADV_IND;
6372         }
6373
6374         if (evt_type & LE_EXT_ADV_SCAN_RSP)
6375                 return LE_ADV_SCAN_RSP;
6376
6377         if (evt_type & LE_EXT_ADV_SCAN_IND)
6378                 return LE_ADV_SCAN_IND;
6379
6380         if (evt_type == LE_EXT_ADV_NON_CONN_IND ||
6381             evt_type & LE_EXT_ADV_DIRECT_IND)
6382                 return LE_ADV_NONCONN_IND;
6383
6384 invalid:
6385         bt_dev_err_ratelimited(hdev, "Unknown advertising packet type: 0x%02x",
6386                                evt_type);
6387
6388         return LE_ADV_INVALID;
6389 }
6390
6391 static void hci_le_ext_adv_report_evt(struct hci_dev *hdev, void *data,
6392                                       struct sk_buff *skb)
6393 {
6394         struct hci_ev_le_ext_adv_report *ev = data;
6395
6396         if (!ev->num)
6397                 return;
6398
6399         hci_dev_lock(hdev);
6400
6401         while (ev->num--) {
6402                 struct hci_ev_le_ext_adv_info *info;
6403                 u8 legacy_evt_type;
6404                 u16 evt_type;
6405
6406                 info = hci_le_ev_skb_pull(hdev, skb, HCI_EV_LE_EXT_ADV_REPORT,
6407                                           sizeof(*info));
6408                 if (!info)
6409                         break;
6410
6411                 if (!hci_le_ev_skb_pull(hdev, skb, HCI_EV_LE_EXT_ADV_REPORT,
6412                                         info->length))
6413                         break;
6414
6415                 evt_type = __le16_to_cpu(info->type);
6416                 legacy_evt_type = ext_evt_type_to_legacy(hdev, evt_type);
6417                 if (legacy_evt_type != LE_ADV_INVALID) {
6418                         process_adv_report(hdev, legacy_evt_type, &info->bdaddr,
6419                                            info->bdaddr_type, NULL, 0,
6420                                            info->rssi, info->data, info->length,
6421                                            !(evt_type & LE_EXT_ADV_LEGACY_PDU));
6422                 }
6423         }
6424
6425         hci_dev_unlock(hdev);
6426 }
6427
6428 static void hci_le_remote_feat_complete_evt(struct hci_dev *hdev, void *data,
6429                                             struct sk_buff *skb)
6430 {
6431         struct hci_ev_le_remote_feat_complete *ev = data;
6432         struct hci_conn *conn;
6433
6434         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
6435
6436         hci_dev_lock(hdev);
6437
6438         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
6439         if (conn) {
6440                 if (!ev->status)
6441                         memcpy(conn->features[0], ev->features, 8);
6442
6443                 if (conn->state == BT_CONFIG) {
6444                         __u8 status;
6445
6446                         /* If the local controller supports peripheral-initiated
6447                          * features exchange, but the remote controller does
6448                          * not, then it is possible that the error code 0x1a
6449                          * for unsupported remote feature gets returned.
6450                          *
6451                          * In this specific case, allow the connection to
6452                          * transition into connected state and mark it as
6453                          * successful.
6454                          */
6455                         if (!conn->out && ev->status == 0x1a &&
6456                             (hdev->le_features[0] & HCI_LE_PERIPHERAL_FEATURES))
6457                                 status = 0x00;
6458                         else
6459                                 status = ev->status;
6460
6461                         conn->state = BT_CONNECTED;
6462                         hci_connect_cfm(conn, status);
6463                         hci_conn_drop(conn);
6464                 }
6465         }
6466
6467         hci_dev_unlock(hdev);
6468 }
6469
6470 static void hci_le_ltk_request_evt(struct hci_dev *hdev, void *data,
6471                                    struct sk_buff *skb)
6472 {
6473         struct hci_ev_le_ltk_req *ev = data;
6474         struct hci_cp_le_ltk_reply cp;
6475         struct hci_cp_le_ltk_neg_reply neg;
6476         struct hci_conn *conn;
6477         struct smp_ltk *ltk;
6478
6479         bt_dev_dbg(hdev, "handle 0x%4.4x", __le16_to_cpu(ev->handle));
6480
6481         hci_dev_lock(hdev);
6482
6483         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
6484         if (conn == NULL)
6485                 goto not_found;
6486
6487         ltk = hci_find_ltk(hdev, &conn->dst, conn->dst_type, conn->role);
6488         if (!ltk)
6489                 goto not_found;
6490
6491         if (smp_ltk_is_sc(ltk)) {
6492                 /* With SC both EDiv and Rand are set to zero */
6493                 if (ev->ediv || ev->rand)
6494                         goto not_found;
6495         } else {
6496                 /* For non-SC keys check that EDiv and Rand match */
6497                 if (ev->ediv != ltk->ediv || ev->rand != ltk->rand)
6498                         goto not_found;
6499         }
6500
6501         memcpy(cp.ltk, ltk->val, ltk->enc_size);
6502         memset(cp.ltk + ltk->enc_size, 0, sizeof(cp.ltk) - ltk->enc_size);
6503         cp.handle = cpu_to_le16(conn->handle);
6504
6505         conn->pending_sec_level = smp_ltk_sec_level(ltk);
6506
6507         conn->enc_key_size = ltk->enc_size;
6508
6509         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
6510
6511         /* Ref. Bluetooth Core SPEC pages 1975 and 2004. STK is a
6512          * temporary key used to encrypt a connection following
6513          * pairing. It is used during the Encrypted Session Setup to
6514          * distribute the keys. Later, security can be re-established
6515          * using a distributed LTK.
6516          */
6517         if (ltk->type == SMP_STK) {
6518                 set_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
6519                 list_del_rcu(&ltk->list);
6520                 kfree_rcu(ltk, rcu);
6521         } else {
6522                 clear_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
6523         }
6524
6525         hci_dev_unlock(hdev);
6526
6527         return;
6528
6529 not_found:
6530         neg.handle = ev->handle;
6531         hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
6532         hci_dev_unlock(hdev);
6533 }
6534
6535 static void send_conn_param_neg_reply(struct hci_dev *hdev, u16 handle,
6536                                       u8 reason)
6537 {
6538         struct hci_cp_le_conn_param_req_neg_reply cp;
6539
6540         cp.handle = cpu_to_le16(handle);
6541         cp.reason = reason;
6542
6543         hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_NEG_REPLY, sizeof(cp),
6544                      &cp);
6545 }
6546
6547 static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev, void *data,
6548                                              struct sk_buff *skb)
6549 {
6550         struct hci_ev_le_remote_conn_param_req *ev = data;
6551         struct hci_cp_le_conn_param_req_reply cp;
6552         struct hci_conn *hcon;
6553         u16 handle, min, max, latency, timeout;
6554
6555         bt_dev_dbg(hdev, "handle 0x%4.4x", __le16_to_cpu(ev->handle));
6556
6557         handle = le16_to_cpu(ev->handle);
6558         min = le16_to_cpu(ev->interval_min);
6559         max = le16_to_cpu(ev->interval_max);
6560         latency = le16_to_cpu(ev->latency);
6561         timeout = le16_to_cpu(ev->timeout);
6562
6563         hcon = hci_conn_hash_lookup_handle(hdev, handle);
6564         if (!hcon || hcon->state != BT_CONNECTED)
6565                 return send_conn_param_neg_reply(hdev, handle,
6566                                                  HCI_ERROR_UNKNOWN_CONN_ID);
6567
6568         if (hci_check_conn_params(min, max, latency, timeout))
6569                 return send_conn_param_neg_reply(hdev, handle,
6570                                                  HCI_ERROR_INVALID_LL_PARAMS);
6571
6572         if (hcon->role == HCI_ROLE_MASTER) {
6573                 struct hci_conn_params *params;
6574                 u8 store_hint;
6575
6576                 hci_dev_lock(hdev);
6577
6578                 params = hci_conn_params_lookup(hdev, &hcon->dst,
6579                                                 hcon->dst_type);
6580                 if (params) {
6581                         params->conn_min_interval = min;
6582                         params->conn_max_interval = max;
6583                         params->conn_latency = latency;
6584                         params->supervision_timeout = timeout;
6585                         store_hint = 0x01;
6586                 } else {
6587                         store_hint = 0x00;
6588                 }
6589
6590                 hci_dev_unlock(hdev);
6591
6592                 mgmt_new_conn_param(hdev, &hcon->dst, hcon->dst_type,
6593                                     store_hint, min, max, latency, timeout);
6594         }
6595
6596         cp.handle = ev->handle;
6597         cp.interval_min = ev->interval_min;
6598         cp.interval_max = ev->interval_max;
6599         cp.latency = ev->latency;
6600         cp.timeout = ev->timeout;
6601         cp.min_ce_len = 0;
6602         cp.max_ce_len = 0;
6603
6604         hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_REPLY, sizeof(cp), &cp);
6605 }
6606
6607 static void hci_le_direct_adv_report_evt(struct hci_dev *hdev, void *data,
6608                                          struct sk_buff *skb)
6609 {
6610         struct hci_ev_le_direct_adv_report *ev = data;
6611         int i;
6612
6613         if (!hci_le_ev_skb_pull(hdev, skb, HCI_EV_LE_DIRECT_ADV_REPORT,
6614                                 flex_array_size(ev, info, ev->num)))
6615                 return;
6616
6617         if (!ev->num)
6618                 return;
6619
6620         hci_dev_lock(hdev);
6621
6622         for (i = 0; i < ev->num; i++) {
6623                 struct hci_ev_le_direct_adv_info *info = &ev->info[i];
6624
6625                 process_adv_report(hdev, info->type, &info->bdaddr,
6626                                    info->bdaddr_type, &info->direct_addr,
6627                                    info->direct_addr_type, info->rssi, NULL, 0,
6628                                    false);
6629         }
6630
6631         hci_dev_unlock(hdev);
6632 }
6633
6634 static void hci_le_phy_update_evt(struct hci_dev *hdev, void *data,
6635                                   struct sk_buff *skb)
6636 {
6637         struct hci_ev_le_phy_update_complete *ev = data;
6638         struct hci_conn *conn;
6639
6640         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
6641
6642         if (ev->status)
6643                 return;
6644
6645         hci_dev_lock(hdev);
6646
6647         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
6648         if (!conn)
6649                 goto unlock;
6650
6651         conn->le_tx_phy = ev->tx_phy;
6652         conn->le_rx_phy = ev->rx_phy;
6653
6654 unlock:
6655         hci_dev_unlock(hdev);
6656 }
6657
6658 static void hci_le_cis_estabilished_evt(struct hci_dev *hdev, void *data,
6659                                         struct sk_buff *skb)
6660 {
6661         struct hci_evt_le_cis_established *ev = data;
6662         struct hci_conn *conn;
6663         u16 handle = __le16_to_cpu(ev->handle);
6664
6665         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
6666
6667         hci_dev_lock(hdev);
6668
6669         conn = hci_conn_hash_lookup_handle(hdev, handle);
6670         if (!conn) {
6671                 bt_dev_err(hdev,
6672                            "Unable to find connection with handle 0x%4.4x",
6673                            handle);
6674                 goto unlock;
6675         }
6676
6677         if (conn->role == HCI_ROLE_SLAVE) {
6678                 __le32 interval;
6679
6680                 memset(&interval, 0, sizeof(interval));
6681
6682                 memcpy(&interval, ev->c_latency, sizeof(ev->c_latency));
6683                 conn->iso_qos.in.interval = le32_to_cpu(interval);
6684                 memcpy(&interval, ev->p_latency, sizeof(ev->p_latency));
6685                 conn->iso_qos.out.interval = le32_to_cpu(interval);
6686                 conn->iso_qos.in.latency = le16_to_cpu(ev->interval);
6687                 conn->iso_qos.out.latency = le16_to_cpu(ev->interval);
6688                 conn->iso_qos.in.sdu = le16_to_cpu(ev->c_mtu);
6689                 conn->iso_qos.out.sdu = le16_to_cpu(ev->p_mtu);
6690                 conn->iso_qos.in.phy = ev->c_phy;
6691                 conn->iso_qos.out.phy = ev->p_phy;
6692         }
6693
6694         if (!ev->status) {
6695                 conn->state = BT_CONNECTED;
6696                 hci_debugfs_create_conn(conn);
6697                 hci_conn_add_sysfs(conn);
6698                 hci_iso_setup_path(conn);
6699                 goto unlock;
6700         }
6701
6702         hci_connect_cfm(conn, ev->status);
6703         hci_conn_del(conn);
6704
6705 unlock:
6706         hci_dev_unlock(hdev);
6707 }
6708
6709 static void hci_le_reject_cis(struct hci_dev *hdev, __le16 handle)
6710 {
6711         struct hci_cp_le_reject_cis cp;
6712
6713         memset(&cp, 0, sizeof(cp));
6714         cp.handle = handle;
6715         cp.reason = HCI_ERROR_REJ_BAD_ADDR;
6716         hci_send_cmd(hdev, HCI_OP_LE_REJECT_CIS, sizeof(cp), &cp);
6717 }
6718
6719 static void hci_le_accept_cis(struct hci_dev *hdev, __le16 handle)
6720 {
6721         struct hci_cp_le_accept_cis cp;
6722
6723         memset(&cp, 0, sizeof(cp));
6724         cp.handle = handle;
6725         hci_send_cmd(hdev, HCI_OP_LE_ACCEPT_CIS, sizeof(cp), &cp);
6726 }
6727
6728 static void hci_le_cis_req_evt(struct hci_dev *hdev, void *data,
6729                                struct sk_buff *skb)
6730 {
6731         struct hci_evt_le_cis_req *ev = data;
6732         u16 acl_handle, cis_handle;
6733         struct hci_conn *acl, *cis;
6734         int mask;
6735         __u8 flags = 0;
6736
6737         acl_handle = __le16_to_cpu(ev->acl_handle);
6738         cis_handle = __le16_to_cpu(ev->cis_handle);
6739
6740         bt_dev_dbg(hdev, "acl 0x%4.4x handle 0x%4.4x cig 0x%2.2x cis 0x%2.2x",
6741                    acl_handle, cis_handle, ev->cig_id, ev->cis_id);
6742
6743         hci_dev_lock(hdev);
6744
6745         acl = hci_conn_hash_lookup_handle(hdev, acl_handle);
6746         if (!acl)
6747                 goto unlock;
6748
6749         mask = hci_proto_connect_ind(hdev, &acl->dst, ISO_LINK, &flags);
6750         if (!(mask & HCI_LM_ACCEPT)) {
6751                 hci_le_reject_cis(hdev, ev->cis_handle);
6752                 goto unlock;
6753         }
6754
6755         cis = hci_conn_hash_lookup_handle(hdev, cis_handle);
6756         if (!cis) {
6757                 cis = hci_conn_add(hdev, ISO_LINK, &acl->dst, HCI_ROLE_SLAVE);
6758                 if (!cis) {
6759                         hci_le_reject_cis(hdev, ev->cis_handle);
6760                         goto unlock;
6761                 }
6762                 cis->handle = cis_handle;
6763         }
6764
6765         cis->iso_qos.cig = ev->cig_id;
6766         cis->iso_qos.cis = ev->cis_id;
6767
6768         if (!(flags & HCI_PROTO_DEFER)) {
6769                 hci_le_accept_cis(hdev, ev->cis_handle);
6770         } else {
6771                 cis->state = BT_CONNECT2;
6772                 hci_connect_cfm(cis, 0);
6773         }
6774
6775 unlock:
6776         hci_dev_unlock(hdev);
6777 }
6778
6779 #define HCI_LE_EV_VL(_op, _func, _min_len, _max_len) \
6780 [_op] = { \
6781         .func = _func, \
6782         .min_len = _min_len, \
6783         .max_len = _max_len, \
6784 }
6785
6786 #define HCI_LE_EV(_op, _func, _len) \
6787         HCI_LE_EV_VL(_op, _func, _len, _len)
6788
6789 #define HCI_LE_EV_STATUS(_op, _func) \
6790         HCI_LE_EV(_op, _func, sizeof(struct hci_ev_status))
6791
6792 /* Entries in this table shall have their position according to the subevent
6793  * opcode they handle so the use of the macros above is recommend since it does
6794  * attempt to initialize at its proper index using Designated Initializers that
6795  * way events without a callback function can be ommited.
6796  */
6797 static const struct hci_le_ev {
6798         void (*func)(struct hci_dev *hdev, void *data, struct sk_buff *skb);
6799         u16  min_len;
6800         u16  max_len;
6801 } hci_le_ev_table[U8_MAX + 1] = {
6802         /* [0x01 = HCI_EV_LE_CONN_COMPLETE] */
6803         HCI_LE_EV(HCI_EV_LE_CONN_COMPLETE, hci_le_conn_complete_evt,
6804                   sizeof(struct hci_ev_le_conn_complete)),
6805         /* [0x02 = HCI_EV_LE_ADVERTISING_REPORT] */
6806         HCI_LE_EV_VL(HCI_EV_LE_ADVERTISING_REPORT, hci_le_adv_report_evt,
6807                      sizeof(struct hci_ev_le_advertising_report),
6808                      HCI_MAX_EVENT_SIZE),
6809         /* [0x03 = HCI_EV_LE_CONN_UPDATE_COMPLETE] */
6810         HCI_LE_EV(HCI_EV_LE_CONN_UPDATE_COMPLETE,
6811                   hci_le_conn_update_complete_evt,
6812                   sizeof(struct hci_ev_le_conn_update_complete)),
6813         /* [0x04 = HCI_EV_LE_REMOTE_FEAT_COMPLETE] */
6814         HCI_LE_EV(HCI_EV_LE_REMOTE_FEAT_COMPLETE,
6815                   hci_le_remote_feat_complete_evt,
6816                   sizeof(struct hci_ev_le_remote_feat_complete)),
6817         /* [0x05 = HCI_EV_LE_LTK_REQ] */
6818         HCI_LE_EV(HCI_EV_LE_LTK_REQ, hci_le_ltk_request_evt,
6819                   sizeof(struct hci_ev_le_ltk_req)),
6820         /* [0x06 = HCI_EV_LE_REMOTE_CONN_PARAM_REQ] */
6821         HCI_LE_EV(HCI_EV_LE_REMOTE_CONN_PARAM_REQ,
6822                   hci_le_remote_conn_param_req_evt,
6823                   sizeof(struct hci_ev_le_remote_conn_param_req)),
6824         /* [0x0a = HCI_EV_LE_ENHANCED_CONN_COMPLETE] */
6825         HCI_LE_EV(HCI_EV_LE_ENHANCED_CONN_COMPLETE,
6826                   hci_le_enh_conn_complete_evt,
6827                   sizeof(struct hci_ev_le_enh_conn_complete)),
6828         /* [0x0b = HCI_EV_LE_DIRECT_ADV_REPORT] */
6829         HCI_LE_EV_VL(HCI_EV_LE_DIRECT_ADV_REPORT, hci_le_direct_adv_report_evt,
6830                      sizeof(struct hci_ev_le_direct_adv_report),
6831                      HCI_MAX_EVENT_SIZE),
6832         /* [0x0c = HCI_EV_LE_PHY_UPDATE_COMPLETE] */
6833         HCI_LE_EV(HCI_EV_LE_PHY_UPDATE_COMPLETE, hci_le_phy_update_evt,
6834                   sizeof(struct hci_ev_le_phy_update_complete)),
6835         /* [0x0d = HCI_EV_LE_EXT_ADV_REPORT] */
6836         HCI_LE_EV_VL(HCI_EV_LE_EXT_ADV_REPORT, hci_le_ext_adv_report_evt,
6837                      sizeof(struct hci_ev_le_ext_adv_report),
6838                      HCI_MAX_EVENT_SIZE),
6839         /* [0x12 = HCI_EV_LE_EXT_ADV_SET_TERM] */
6840         HCI_LE_EV(HCI_EV_LE_EXT_ADV_SET_TERM, hci_le_ext_adv_term_evt,
6841                   sizeof(struct hci_evt_le_ext_adv_set_term)),
6842         /* [0x19 = HCI_EVT_LE_CIS_ESTABLISHED] */
6843         HCI_LE_EV(HCI_EVT_LE_CIS_ESTABLISHED, hci_le_cis_estabilished_evt,
6844                   sizeof(struct hci_evt_le_cis_established)),
6845         /* [0x1a = HCI_EVT_LE_CIS_REQ] */
6846         HCI_LE_EV(HCI_EVT_LE_CIS_REQ, hci_le_cis_req_evt,
6847                   sizeof(struct hci_evt_le_cis_req)),
6848 };
6849
6850 static void hci_le_meta_evt(struct hci_dev *hdev, void *data,
6851                             struct sk_buff *skb, u16 *opcode, u8 *status,
6852                             hci_req_complete_t *req_complete,
6853                             hci_req_complete_skb_t *req_complete_skb)
6854 {
6855         struct hci_ev_le_meta *ev = data;
6856         const struct hci_le_ev *subev;
6857
6858         bt_dev_dbg(hdev, "subevent 0x%2.2x", ev->subevent);
6859
6860         /* Only match event if command OGF is for LE */
6861         if (hdev->sent_cmd &&
6862             hci_opcode_ogf(hci_skb_opcode(hdev->sent_cmd)) == 0x08 &&
6863             hci_skb_event(hdev->sent_cmd) == ev->subevent) {
6864                 *opcode = hci_skb_opcode(hdev->sent_cmd);
6865                 hci_req_cmd_complete(hdev, *opcode, 0x00, req_complete,
6866                                      req_complete_skb);
6867         }
6868
6869         subev = &hci_le_ev_table[ev->subevent];
6870         if (!subev->func)
6871                 return;
6872
6873         if (skb->len < subev->min_len) {
6874                 bt_dev_err(hdev, "unexpected subevent 0x%2.2x length: %u < %u",
6875                            ev->subevent, skb->len, subev->min_len);
6876                 return;
6877         }
6878
6879         /* Just warn if the length is over max_len size it still be
6880          * possible to partially parse the event so leave to callback to
6881          * decide if that is acceptable.
6882          */
6883         if (skb->len > subev->max_len)
6884                 bt_dev_warn(hdev, "unexpected subevent 0x%2.2x length: %u > %u",
6885                             ev->subevent, skb->len, subev->max_len);
6886         data = hci_le_ev_skb_pull(hdev, skb, ev->subevent, subev->min_len);
6887         if (!data)
6888                 return;
6889
6890         subev->func(hdev, data, skb);
6891 }
6892
6893 static bool hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode,
6894                                  u8 event, struct sk_buff *skb)
6895 {
6896         struct hci_ev_cmd_complete *ev;
6897         struct hci_event_hdr *hdr;
6898
6899         if (!skb)
6900                 return false;
6901
6902         hdr = hci_ev_skb_pull(hdev, skb, event, sizeof(*hdr));
6903         if (!hdr)
6904                 return false;
6905
6906         if (event) {
6907                 if (hdr->evt != event)
6908                         return false;
6909                 return true;
6910         }
6911
6912         /* Check if request ended in Command Status - no way to retrieve
6913          * any extra parameters in this case.
6914          */
6915         if (hdr->evt == HCI_EV_CMD_STATUS)
6916                 return false;
6917
6918         if (hdr->evt != HCI_EV_CMD_COMPLETE) {
6919                 bt_dev_err(hdev, "last event is not cmd complete (0x%2.2x)",
6920                            hdr->evt);
6921                 return false;
6922         }
6923
6924         ev = hci_cc_skb_pull(hdev, skb, opcode, sizeof(*ev));
6925         if (!ev)
6926                 return false;
6927
6928         if (opcode != __le16_to_cpu(ev->opcode)) {
6929                 BT_DBG("opcode doesn't match (0x%2.2x != 0x%2.2x)", opcode,
6930                        __le16_to_cpu(ev->opcode));
6931                 return false;
6932         }
6933
6934         return true;
6935 }
6936
6937 static void hci_store_wake_reason(struct hci_dev *hdev, u8 event,
6938                                   struct sk_buff *skb)
6939 {
6940         struct hci_ev_le_advertising_info *adv;
6941         struct hci_ev_le_direct_adv_info *direct_adv;
6942         struct hci_ev_le_ext_adv_info *ext_adv;
6943         const struct hci_ev_conn_complete *conn_complete = (void *)skb->data;
6944         const struct hci_ev_conn_request *conn_request = (void *)skb->data;
6945
6946         hci_dev_lock(hdev);
6947
6948         /* If we are currently suspended and this is the first BT event seen,
6949          * save the wake reason associated with the event.
6950          */
6951         if (!hdev->suspended || hdev->wake_reason)
6952                 goto unlock;
6953
6954         /* Default to remote wake. Values for wake_reason are documented in the
6955          * Bluez mgmt api docs.
6956          */
6957         hdev->wake_reason = MGMT_WAKE_REASON_REMOTE_WAKE;
6958
6959         /* Once configured for remote wakeup, we should only wake up for
6960          * reconnections. It's useful to see which device is waking us up so
6961          * keep track of the bdaddr of the connection event that woke us up.
6962          */
6963         if (event == HCI_EV_CONN_REQUEST) {
6964                 bacpy(&hdev->wake_addr, &conn_complete->bdaddr);
6965                 hdev->wake_addr_type = BDADDR_BREDR;
6966         } else if (event == HCI_EV_CONN_COMPLETE) {
6967                 bacpy(&hdev->wake_addr, &conn_request->bdaddr);
6968                 hdev->wake_addr_type = BDADDR_BREDR;
6969         } else if (event == HCI_EV_LE_META) {
6970                 struct hci_ev_le_meta *le_ev = (void *)skb->data;
6971                 u8 subevent = le_ev->subevent;
6972                 u8 *ptr = &skb->data[sizeof(*le_ev)];
6973                 u8 num_reports = *ptr;
6974
6975                 if ((subevent == HCI_EV_LE_ADVERTISING_REPORT ||
6976                      subevent == HCI_EV_LE_DIRECT_ADV_REPORT ||
6977                      subevent == HCI_EV_LE_EXT_ADV_REPORT) &&
6978                     num_reports) {
6979                         adv = (void *)(ptr + 1);
6980                         direct_adv = (void *)(ptr + 1);
6981                         ext_adv = (void *)(ptr + 1);
6982
6983                         switch (subevent) {
6984                         case HCI_EV_LE_ADVERTISING_REPORT:
6985                                 bacpy(&hdev->wake_addr, &adv->bdaddr);
6986                                 hdev->wake_addr_type = adv->bdaddr_type;
6987                                 break;
6988                         case HCI_EV_LE_DIRECT_ADV_REPORT:
6989                                 bacpy(&hdev->wake_addr, &direct_adv->bdaddr);
6990                                 hdev->wake_addr_type = direct_adv->bdaddr_type;
6991                                 break;
6992                         case HCI_EV_LE_EXT_ADV_REPORT:
6993                                 bacpy(&hdev->wake_addr, &ext_adv->bdaddr);
6994                                 hdev->wake_addr_type = ext_adv->bdaddr_type;
6995                                 break;
6996                         }
6997                 }
6998         } else {
6999                 hdev->wake_reason = MGMT_WAKE_REASON_UNEXPECTED;
7000         }
7001
7002 unlock:
7003         hci_dev_unlock(hdev);
7004 }
7005
7006 #define HCI_EV_VL(_op, _func, _min_len, _max_len) \
7007 [_op] = { \
7008         .req = false, \
7009         .func = _func, \
7010         .min_len = _min_len, \
7011         .max_len = _max_len, \
7012 }
7013
7014 #define HCI_EV(_op, _func, _len) \
7015         HCI_EV_VL(_op, _func, _len, _len)
7016
7017 #define HCI_EV_STATUS(_op, _func) \
7018         HCI_EV(_op, _func, sizeof(struct hci_ev_status))
7019
7020 #define HCI_EV_REQ_VL(_op, _func, _min_len, _max_len) \
7021 [_op] = { \
7022         .req = true, \
7023         .func_req = _func, \
7024         .min_len = _min_len, \
7025         .max_len = _max_len, \
7026 }
7027
7028 #define HCI_EV_REQ(_op, _func, _len) \
7029         HCI_EV_REQ_VL(_op, _func, _len, _len)
7030
7031 /* Entries in this table shall have their position according to the event opcode
7032  * they handle so the use of the macros above is recommend since it does attempt
7033  * to initialize at its proper index using Designated Initializers that way
7034  * events without a callback function don't have entered.
7035  */
7036 static const struct hci_ev {
7037         bool req;
7038         union {
7039                 void (*func)(struct hci_dev *hdev, void *data,
7040                              struct sk_buff *skb);
7041                 void (*func_req)(struct hci_dev *hdev, void *data,
7042                                  struct sk_buff *skb, u16 *opcode, u8 *status,
7043                                  hci_req_complete_t *req_complete,
7044                                  hci_req_complete_skb_t *req_complete_skb);
7045         };
7046         u16  min_len;
7047         u16  max_len;
7048 } hci_ev_table[U8_MAX + 1] = {
7049         /* [0x01 = HCI_EV_INQUIRY_COMPLETE] */
7050         HCI_EV_STATUS(HCI_EV_INQUIRY_COMPLETE, hci_inquiry_complete_evt),
7051         /* [0x02 = HCI_EV_INQUIRY_RESULT] */
7052         HCI_EV_VL(HCI_EV_INQUIRY_RESULT, hci_inquiry_result_evt,
7053                   sizeof(struct hci_ev_inquiry_result), HCI_MAX_EVENT_SIZE),
7054         /* [0x03 = HCI_EV_CONN_COMPLETE] */
7055         HCI_EV(HCI_EV_CONN_COMPLETE, hci_conn_complete_evt,
7056                sizeof(struct hci_ev_conn_complete)),
7057         /* [0x04 = HCI_EV_CONN_REQUEST] */
7058         HCI_EV(HCI_EV_CONN_REQUEST, hci_conn_request_evt,
7059                sizeof(struct hci_ev_conn_request)),
7060         /* [0x05 = HCI_EV_DISCONN_COMPLETE] */
7061         HCI_EV(HCI_EV_DISCONN_COMPLETE, hci_disconn_complete_evt,
7062                sizeof(struct hci_ev_disconn_complete)),
7063         /* [0x06 = HCI_EV_AUTH_COMPLETE] */
7064         HCI_EV(HCI_EV_AUTH_COMPLETE, hci_auth_complete_evt,
7065                sizeof(struct hci_ev_auth_complete)),
7066         /* [0x07 = HCI_EV_REMOTE_NAME] */
7067         HCI_EV(HCI_EV_REMOTE_NAME, hci_remote_name_evt,
7068                sizeof(struct hci_ev_remote_name)),
7069         /* [0x08 = HCI_EV_ENCRYPT_CHANGE] */
7070         HCI_EV(HCI_EV_ENCRYPT_CHANGE, hci_encrypt_change_evt,
7071                sizeof(struct hci_ev_encrypt_change)),
7072         /* [0x09 = HCI_EV_CHANGE_LINK_KEY_COMPLETE] */
7073         HCI_EV(HCI_EV_CHANGE_LINK_KEY_COMPLETE,
7074                hci_change_link_key_complete_evt,
7075                sizeof(struct hci_ev_change_link_key_complete)),
7076         /* [0x0b = HCI_EV_REMOTE_FEATURES] */
7077         HCI_EV(HCI_EV_REMOTE_FEATURES, hci_remote_features_evt,
7078                sizeof(struct hci_ev_remote_features)),
7079         /* [0x0e = HCI_EV_CMD_COMPLETE] */
7080         HCI_EV_REQ_VL(HCI_EV_CMD_COMPLETE, hci_cmd_complete_evt,
7081                       sizeof(struct hci_ev_cmd_complete), HCI_MAX_EVENT_SIZE),
7082         /* [0x0f = HCI_EV_CMD_STATUS] */
7083         HCI_EV_REQ(HCI_EV_CMD_STATUS, hci_cmd_status_evt,
7084                    sizeof(struct hci_ev_cmd_status)),
7085         /* [0x10 = HCI_EV_CMD_STATUS] */
7086         HCI_EV(HCI_EV_HARDWARE_ERROR, hci_hardware_error_evt,
7087                sizeof(struct hci_ev_hardware_error)),
7088         /* [0x12 = HCI_EV_ROLE_CHANGE] */
7089         HCI_EV(HCI_EV_ROLE_CHANGE, hci_role_change_evt,
7090                sizeof(struct hci_ev_role_change)),
7091         /* [0x13 = HCI_EV_NUM_COMP_PKTS] */
7092         HCI_EV_VL(HCI_EV_NUM_COMP_PKTS, hci_num_comp_pkts_evt,
7093                   sizeof(struct hci_ev_num_comp_pkts), HCI_MAX_EVENT_SIZE),
7094         /* [0x14 = HCI_EV_MODE_CHANGE] */
7095         HCI_EV(HCI_EV_MODE_CHANGE, hci_mode_change_evt,
7096                sizeof(struct hci_ev_mode_change)),
7097         /* [0x16 = HCI_EV_PIN_CODE_REQ] */
7098         HCI_EV(HCI_EV_PIN_CODE_REQ, hci_pin_code_request_evt,
7099                sizeof(struct hci_ev_pin_code_req)),
7100         /* [0x17 = HCI_EV_LINK_KEY_REQ] */
7101         HCI_EV(HCI_EV_LINK_KEY_REQ, hci_link_key_request_evt,
7102                sizeof(struct hci_ev_link_key_req)),
7103         /* [0x18 = HCI_EV_LINK_KEY_NOTIFY] */
7104         HCI_EV(HCI_EV_LINK_KEY_NOTIFY, hci_link_key_notify_evt,
7105                sizeof(struct hci_ev_link_key_notify)),
7106         /* [0x1c = HCI_EV_CLOCK_OFFSET] */
7107         HCI_EV(HCI_EV_CLOCK_OFFSET, hci_clock_offset_evt,
7108                sizeof(struct hci_ev_clock_offset)),
7109         /* [0x1d = HCI_EV_PKT_TYPE_CHANGE] */
7110         HCI_EV(HCI_EV_PKT_TYPE_CHANGE, hci_pkt_type_change_evt,
7111                sizeof(struct hci_ev_pkt_type_change)),
7112         /* [0x20 = HCI_EV_PSCAN_REP_MODE] */
7113         HCI_EV(HCI_EV_PSCAN_REP_MODE, hci_pscan_rep_mode_evt,
7114                sizeof(struct hci_ev_pscan_rep_mode)),
7115         /* [0x22 = HCI_EV_INQUIRY_RESULT_WITH_RSSI] */
7116         HCI_EV_VL(HCI_EV_INQUIRY_RESULT_WITH_RSSI,
7117                   hci_inquiry_result_with_rssi_evt,
7118                   sizeof(struct hci_ev_inquiry_result_rssi),
7119                   HCI_MAX_EVENT_SIZE),
7120         /* [0x23 = HCI_EV_REMOTE_EXT_FEATURES] */
7121         HCI_EV(HCI_EV_REMOTE_EXT_FEATURES, hci_remote_ext_features_evt,
7122                sizeof(struct hci_ev_remote_ext_features)),
7123         /* [0x2c = HCI_EV_SYNC_CONN_COMPLETE] */
7124         HCI_EV(HCI_EV_SYNC_CONN_COMPLETE, hci_sync_conn_complete_evt,
7125                sizeof(struct hci_ev_sync_conn_complete)),
7126         /* [0x2d = HCI_EV_EXTENDED_INQUIRY_RESULT] */
7127         HCI_EV_VL(HCI_EV_EXTENDED_INQUIRY_RESULT,
7128                   hci_extended_inquiry_result_evt,
7129                   sizeof(struct hci_ev_ext_inquiry_result), HCI_MAX_EVENT_SIZE),
7130         /* [0x30 = HCI_EV_KEY_REFRESH_COMPLETE] */
7131         HCI_EV(HCI_EV_KEY_REFRESH_COMPLETE, hci_key_refresh_complete_evt,
7132                sizeof(struct hci_ev_key_refresh_complete)),
7133         /* [0x31 = HCI_EV_IO_CAPA_REQUEST] */
7134         HCI_EV(HCI_EV_IO_CAPA_REQUEST, hci_io_capa_request_evt,
7135                sizeof(struct hci_ev_io_capa_request)),
7136         /* [0x32 = HCI_EV_IO_CAPA_REPLY] */
7137         HCI_EV(HCI_EV_IO_CAPA_REPLY, hci_io_capa_reply_evt,
7138                sizeof(struct hci_ev_io_capa_reply)),
7139         /* [0x33 = HCI_EV_USER_CONFIRM_REQUEST] */
7140         HCI_EV(HCI_EV_USER_CONFIRM_REQUEST, hci_user_confirm_request_evt,
7141                sizeof(struct hci_ev_user_confirm_req)),
7142         /* [0x34 = HCI_EV_USER_PASSKEY_REQUEST] */
7143         HCI_EV(HCI_EV_USER_PASSKEY_REQUEST, hci_user_passkey_request_evt,
7144                sizeof(struct hci_ev_user_passkey_req)),
7145         /* [0x35 = HCI_EV_REMOTE_OOB_DATA_REQUEST] */
7146         HCI_EV(HCI_EV_REMOTE_OOB_DATA_REQUEST, hci_remote_oob_data_request_evt,
7147                sizeof(struct hci_ev_remote_oob_data_request)),
7148         /* [0x36 = HCI_EV_SIMPLE_PAIR_COMPLETE] */
7149         HCI_EV(HCI_EV_SIMPLE_PAIR_COMPLETE, hci_simple_pair_complete_evt,
7150                sizeof(struct hci_ev_simple_pair_complete)),
7151         /* [0x3b = HCI_EV_USER_PASSKEY_NOTIFY] */
7152         HCI_EV(HCI_EV_USER_PASSKEY_NOTIFY, hci_user_passkey_notify_evt,
7153                sizeof(struct hci_ev_user_passkey_notify)),
7154         /* [0x3c = HCI_EV_KEYPRESS_NOTIFY] */
7155         HCI_EV(HCI_EV_KEYPRESS_NOTIFY, hci_keypress_notify_evt,
7156                sizeof(struct hci_ev_keypress_notify)),
7157         /* [0x3d = HCI_EV_REMOTE_HOST_FEATURES] */
7158         HCI_EV(HCI_EV_REMOTE_HOST_FEATURES, hci_remote_host_features_evt,
7159                sizeof(struct hci_ev_remote_host_features)),
7160         /* [0x3e = HCI_EV_LE_META] */
7161         HCI_EV_REQ_VL(HCI_EV_LE_META, hci_le_meta_evt,
7162                       sizeof(struct hci_ev_le_meta), HCI_MAX_EVENT_SIZE),
7163 #if IS_ENABLED(CONFIG_BT_HS)
7164         /* [0x40 = HCI_EV_PHY_LINK_COMPLETE] */
7165         HCI_EV(HCI_EV_PHY_LINK_COMPLETE, hci_phy_link_complete_evt,
7166                sizeof(struct hci_ev_phy_link_complete)),
7167         /* [0x41 = HCI_EV_CHANNEL_SELECTED] */
7168         HCI_EV(HCI_EV_CHANNEL_SELECTED, hci_chan_selected_evt,
7169                sizeof(struct hci_ev_channel_selected)),
7170         /* [0x42 = HCI_EV_DISCONN_PHY_LINK_COMPLETE] */
7171         HCI_EV(HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE,
7172                hci_disconn_loglink_complete_evt,
7173                sizeof(struct hci_ev_disconn_logical_link_complete)),
7174         /* [0x45 = HCI_EV_LOGICAL_LINK_COMPLETE] */
7175         HCI_EV(HCI_EV_LOGICAL_LINK_COMPLETE, hci_loglink_complete_evt,
7176                sizeof(struct hci_ev_logical_link_complete)),
7177         /* [0x46 = HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE] */
7178         HCI_EV(HCI_EV_DISCONN_PHY_LINK_COMPLETE,
7179                hci_disconn_phylink_complete_evt,
7180                sizeof(struct hci_ev_disconn_phy_link_complete)),
7181 #endif
7182         /* [0x48 = HCI_EV_NUM_COMP_BLOCKS] */
7183         HCI_EV(HCI_EV_NUM_COMP_BLOCKS, hci_num_comp_blocks_evt,
7184                sizeof(struct hci_ev_num_comp_blocks)),
7185         /* [0xff = HCI_EV_VENDOR] */
7186         HCI_EV_VL(HCI_EV_VENDOR, msft_vendor_evt, 0, HCI_MAX_EVENT_SIZE),
7187 };
7188
7189 static void hci_event_func(struct hci_dev *hdev, u8 event, struct sk_buff *skb,
7190                            u16 *opcode, u8 *status,
7191                            hci_req_complete_t *req_complete,
7192                            hci_req_complete_skb_t *req_complete_skb)
7193 {
7194         const struct hci_ev *ev = &hci_ev_table[event];
7195         void *data;
7196
7197         if (!ev->func)
7198                 return;
7199
7200         if (skb->len < ev->min_len) {
7201                 bt_dev_err(hdev, "unexpected event 0x%2.2x length: %u < %u",
7202                            event, skb->len, ev->min_len);
7203                 return;
7204         }
7205
7206         /* Just warn if the length is over max_len size it still be
7207          * possible to partially parse the event so leave to callback to
7208          * decide if that is acceptable.
7209          */
7210         if (skb->len > ev->max_len)
7211                 bt_dev_warn_ratelimited(hdev,
7212                                         "unexpected event 0x%2.2x length: %u > %u",
7213                                         event, skb->len, ev->max_len);
7214
7215         data = hci_ev_skb_pull(hdev, skb, event, ev->min_len);
7216         if (!data)
7217                 return;
7218
7219         if (ev->req)
7220                 ev->func_req(hdev, data, skb, opcode, status, req_complete,
7221                              req_complete_skb);
7222         else
7223                 ev->func(hdev, data, skb);
7224 }
7225
7226 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
7227 {
7228         struct hci_event_hdr *hdr = (void *) skb->data;
7229         hci_req_complete_t req_complete = NULL;
7230         hci_req_complete_skb_t req_complete_skb = NULL;
7231         struct sk_buff *orig_skb = NULL;
7232         u8 status = 0, event, req_evt = 0;
7233         u16 opcode = HCI_OP_NOP;
7234
7235         if (skb->len < sizeof(*hdr)) {
7236                 bt_dev_err(hdev, "Malformed HCI Event");
7237                 goto done;
7238         }
7239
7240         kfree_skb(hdev->recv_event);
7241         hdev->recv_event = skb_clone(skb, GFP_KERNEL);
7242
7243         event = hdr->evt;
7244         if (!event) {
7245                 bt_dev_warn(hdev, "Received unexpected HCI Event 0x%2.2x",
7246                             event);
7247                 goto done;
7248         }
7249
7250         /* Only match event if command OGF is not for LE */
7251         if (hdev->sent_cmd &&
7252             hci_opcode_ogf(hci_skb_opcode(hdev->sent_cmd)) != 0x08 &&
7253             hci_skb_event(hdev->sent_cmd) == event) {
7254                 hci_req_cmd_complete(hdev, hci_skb_opcode(hdev->sent_cmd),
7255                                      status, &req_complete, &req_complete_skb);
7256                 req_evt = event;
7257         }
7258
7259         /* If it looks like we might end up having to call
7260          * req_complete_skb, store a pristine copy of the skb since the
7261          * various handlers may modify the original one through
7262          * skb_pull() calls, etc.
7263          */
7264         if (req_complete_skb || event == HCI_EV_CMD_STATUS ||
7265             event == HCI_EV_CMD_COMPLETE)
7266                 orig_skb = skb_clone(skb, GFP_KERNEL);
7267
7268         skb_pull(skb, HCI_EVENT_HDR_SIZE);
7269
7270         /* Store wake reason if we're suspended */
7271         hci_store_wake_reason(hdev, event, skb);
7272
7273         bt_dev_dbg(hdev, "event 0x%2.2x", event);
7274
7275         hci_event_func(hdev, event, skb, &opcode, &status, &req_complete,
7276                        &req_complete_skb);
7277
7278         if (req_complete) {
7279                 req_complete(hdev, status, opcode);
7280         } else if (req_complete_skb) {
7281                 if (!hci_get_cmd_complete(hdev, opcode, req_evt, orig_skb)) {
7282                         kfree_skb(orig_skb);
7283                         orig_skb = NULL;
7284                 }
7285                 req_complete_skb(hdev, status, opcode, orig_skb);
7286         }
7287
7288 done:
7289         kfree_skb(orig_skb);
7290         kfree_skb(skb);
7291         hdev->stat.evt_rx++;
7292 }