1 /*
2    BlueZ - Bluetooth protocol stack for Linux
3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
4    Copyright 2023-2024 NXP
5 
6    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
7 
8    This program is free software; you can redistribute it and/or modify
9    it under the terms of the GNU General Public License version 2 as
10    published by the Free Software Foundation;
11 
12    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
13    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
14    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
15    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
16    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
17    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
18    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
19    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20 
21    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
22    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
23    SOFTWARE IS DISCLAIMED.
24 */
25 
26 /* Bluetooth HCI event handling. */
27 
28 #include <linux/unaligned.h>
29 #include <linux/crypto.h>
30 #include <crypto/algapi.h>
31 
32 #include <net/bluetooth/bluetooth.h>
33 #include <net/bluetooth/hci_core.h>
34 #include <net/bluetooth/mgmt.h>
35 
36 #include "hci_debugfs.h"
37 #include "hci_codec.h"
38 #include "smp.h"
39 #include "msft.h"
40 #include "eir.h"
41 
42 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
43 		 "\x00\x00\x00\x00\x00\x00\x00\x00"
44 
45 /* Handle HCI Event packets */
46 
hci_ev_skb_pull(struct hci_dev * hdev,struct sk_buff * skb,u8 ev,size_t len)47 static void *hci_ev_skb_pull(struct hci_dev *hdev, struct sk_buff *skb,
48 			     u8 ev, size_t len)
49 {
50 	void *data;
51 
52 	data = skb_pull_data(skb, len);
53 	if (!data)
54 		bt_dev_err(hdev, "Malformed Event: 0x%2.2x", ev);
55 
56 	return data;
57 }
58 
hci_cc_skb_pull(struct hci_dev * hdev,struct sk_buff * skb,u16 op,size_t len)59 static void *hci_cc_skb_pull(struct hci_dev *hdev, struct sk_buff *skb,
60 			     u16 op, size_t len)
61 {
62 	void *data;
63 
64 	data = skb_pull_data(skb, len);
65 	if (!data)
66 		bt_dev_err(hdev, "Malformed Command Complete: 0x%4.4x", op);
67 
68 	return data;
69 }
70 
hci_le_ev_skb_pull(struct hci_dev * hdev,struct sk_buff * skb,u8 ev,size_t len)71 static void *hci_le_ev_skb_pull(struct hci_dev *hdev, struct sk_buff *skb,
72 				u8 ev, size_t len)
73 {
74 	void *data;
75 
76 	data = skb_pull_data(skb, len);
77 	if (!data)
78 		bt_dev_err(hdev, "Malformed LE Event: 0x%2.2x", ev);
79 
80 	return data;
81 }
82 
hci_cc_inquiry_cancel(struct hci_dev * hdev,void * data,struct sk_buff * skb)83 static u8 hci_cc_inquiry_cancel(struct hci_dev *hdev, void *data,
84 				struct sk_buff *skb)
85 {
86 	struct hci_ev_status *rp = data;
87 
88 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
89 
90 	/* It is possible that we receive Inquiry Complete event right
91 	 * before we receive Inquiry Cancel Command Complete event, in
92 	 * which case the latter event should have status of Command
93 	 * Disallowed. This should not be treated as error, since
94 	 * we actually achieve what Inquiry Cancel wants to achieve,
95 	 * which is to end the last Inquiry session.
96 	 */
97 	if (rp->status == HCI_ERROR_COMMAND_DISALLOWED && !test_bit(HCI_INQUIRY, &hdev->flags)) {
98 		bt_dev_warn(hdev, "Ignoring error of Inquiry Cancel command");
99 		rp->status = 0x00;
100 	}
101 
102 	if (rp->status)
103 		return rp->status;
104 
105 	clear_bit(HCI_INQUIRY, &hdev->flags);
106 	smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
107 	wake_up_bit(&hdev->flags, HCI_INQUIRY);
108 
109 	hci_dev_lock(hdev);
110 	/* Set discovery state to stopped if we're not doing LE active
111 	 * scanning.
112 	 */
113 	if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
114 	    hdev->le_scan_type != LE_SCAN_ACTIVE)
115 		hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
116 	hci_dev_unlock(hdev);
117 
118 	return rp->status;
119 }
120 
hci_cc_periodic_inq(struct hci_dev * hdev,void * data,struct sk_buff * skb)121 static u8 hci_cc_periodic_inq(struct hci_dev *hdev, void *data,
122 			      struct sk_buff *skb)
123 {
124 	struct hci_ev_status *rp = data;
125 
126 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
127 
128 	if (rp->status)
129 		return rp->status;
130 
131 	hci_dev_set_flag(hdev, HCI_PERIODIC_INQ);
132 
133 	return rp->status;
134 }
135 
hci_cc_exit_periodic_inq(struct hci_dev * hdev,void * data,struct sk_buff * skb)136 static u8 hci_cc_exit_periodic_inq(struct hci_dev *hdev, void *data,
137 				   struct sk_buff *skb)
138 {
139 	struct hci_ev_status *rp = data;
140 
141 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
142 
143 	if (rp->status)
144 		return rp->status;
145 
146 	hci_dev_clear_flag(hdev, HCI_PERIODIC_INQ);
147 
148 	return rp->status;
149 }
150 
hci_cc_remote_name_req_cancel(struct hci_dev * hdev,void * data,struct sk_buff * skb)151 static u8 hci_cc_remote_name_req_cancel(struct hci_dev *hdev, void *data,
152 					struct sk_buff *skb)
153 {
154 	struct hci_rp_remote_name_req_cancel *rp = data;
155 
156 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
157 
158 	return rp->status;
159 }
160 
hci_cc_role_discovery(struct hci_dev * hdev,void * data,struct sk_buff * skb)161 static u8 hci_cc_role_discovery(struct hci_dev *hdev, void *data,
162 				struct sk_buff *skb)
163 {
164 	struct hci_rp_role_discovery *rp = data;
165 	struct hci_conn *conn;
166 
167 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
168 
169 	if (rp->status)
170 		return rp->status;
171 
172 	hci_dev_lock(hdev);
173 
174 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
175 	if (conn)
176 		conn->role = rp->role;
177 
178 	hci_dev_unlock(hdev);
179 
180 	return rp->status;
181 }
182 
hci_cc_read_link_policy(struct hci_dev * hdev,void * data,struct sk_buff * skb)183 static u8 hci_cc_read_link_policy(struct hci_dev *hdev, void *data,
184 				  struct sk_buff *skb)
185 {
186 	struct hci_rp_read_link_policy *rp = data;
187 	struct hci_conn *conn;
188 
189 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
190 
191 	if (rp->status)
192 		return rp->status;
193 
194 	hci_dev_lock(hdev);
195 
196 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
197 	if (conn)
198 		conn->link_policy = __le16_to_cpu(rp->policy);
199 
200 	hci_dev_unlock(hdev);
201 
202 	return rp->status;
203 }
204 
hci_cc_write_link_policy(struct hci_dev * hdev,void * data,struct sk_buff * skb)205 static u8 hci_cc_write_link_policy(struct hci_dev *hdev, void *data,
206 				   struct sk_buff *skb)
207 {
208 	struct hci_rp_write_link_policy *rp = data;
209 	struct hci_conn *conn;
210 	void *sent;
211 
212 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
213 
214 	if (rp->status)
215 		return rp->status;
216 
217 	sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
218 	if (!sent)
219 		return rp->status;
220 
221 	hci_dev_lock(hdev);
222 
223 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
224 	if (conn)
225 		conn->link_policy = get_unaligned_le16(sent + 2);
226 
227 	hci_dev_unlock(hdev);
228 
229 	return rp->status;
230 }
231 
hci_cc_read_def_link_policy(struct hci_dev * hdev,void * data,struct sk_buff * skb)232 static u8 hci_cc_read_def_link_policy(struct hci_dev *hdev, void *data,
233 				      struct sk_buff *skb)
234 {
235 	struct hci_rp_read_def_link_policy *rp = data;
236 
237 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
238 
239 	if (rp->status)
240 		return rp->status;
241 
242 	hdev->link_policy = __le16_to_cpu(rp->policy);
243 
244 	return rp->status;
245 }
246 
hci_cc_write_def_link_policy(struct hci_dev * hdev,void * data,struct sk_buff * skb)247 static u8 hci_cc_write_def_link_policy(struct hci_dev *hdev, void *data,
248 				       struct sk_buff *skb)
249 {
250 	struct hci_ev_status *rp = data;
251 	void *sent;
252 
253 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
254 
255 	if (rp->status)
256 		return rp->status;
257 
258 	sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
259 	if (!sent)
260 		return rp->status;
261 
262 	hdev->link_policy = get_unaligned_le16(sent);
263 
264 	return rp->status;
265 }
266 
hci_cc_reset(struct hci_dev * hdev,void * data,struct sk_buff * skb)267 static u8 hci_cc_reset(struct hci_dev *hdev, void *data, struct sk_buff *skb)
268 {
269 	struct hci_ev_status *rp = data;
270 
271 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
272 
273 	clear_bit(HCI_RESET, &hdev->flags);
274 
275 	if (rp->status)
276 		return rp->status;
277 
278 	/* Reset all non-persistent flags */
279 	hci_dev_clear_volatile_flags(hdev);
280 
281 	hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
282 
283 	hdev->inq_tx_power = HCI_TX_POWER_INVALID;
284 	hdev->adv_tx_power = HCI_TX_POWER_INVALID;
285 
286 	memset(hdev->adv_data, 0, sizeof(hdev->adv_data));
287 	hdev->adv_data_len = 0;
288 
289 	memset(hdev->scan_rsp_data, 0, sizeof(hdev->scan_rsp_data));
290 	hdev->scan_rsp_data_len = 0;
291 
292 	hdev->le_scan_type = LE_SCAN_PASSIVE;
293 
294 	hdev->ssp_debug_mode = 0;
295 
296 	hci_bdaddr_list_clear(&hdev->le_accept_list);
297 	hci_bdaddr_list_clear(&hdev->le_resolv_list);
298 
299 	return rp->status;
300 }
301 
hci_cc_read_stored_link_key(struct hci_dev * hdev,void * data,struct sk_buff * skb)302 static u8 hci_cc_read_stored_link_key(struct hci_dev *hdev, void *data,
303 				      struct sk_buff *skb)
304 {
305 	struct hci_rp_read_stored_link_key *rp = data;
306 	struct hci_cp_read_stored_link_key *sent;
307 
308 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
309 
310 	sent = hci_sent_cmd_data(hdev, HCI_OP_READ_STORED_LINK_KEY);
311 	if (!sent)
312 		return rp->status;
313 
314 	if (!rp->status && sent->read_all == 0x01) {
315 		hdev->stored_max_keys = le16_to_cpu(rp->max_keys);
316 		hdev->stored_num_keys = le16_to_cpu(rp->num_keys);
317 	}
318 
319 	return rp->status;
320 }
321 
hci_cc_delete_stored_link_key(struct hci_dev * hdev,void * data,struct sk_buff * skb)322 static u8 hci_cc_delete_stored_link_key(struct hci_dev *hdev, void *data,
323 					struct sk_buff *skb)
324 {
325 	struct hci_rp_delete_stored_link_key *rp = data;
326 	u16 num_keys;
327 
328 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
329 
330 	if (rp->status)
331 		return rp->status;
332 
333 	num_keys = le16_to_cpu(rp->num_keys);
334 
335 	if (num_keys <= hdev->stored_num_keys)
336 		hdev->stored_num_keys -= num_keys;
337 	else
338 		hdev->stored_num_keys = 0;
339 
340 	return rp->status;
341 }
342 
hci_cc_write_local_name(struct hci_dev * hdev,void * data,struct sk_buff * skb)343 static u8 hci_cc_write_local_name(struct hci_dev *hdev, void *data,
344 				  struct sk_buff *skb)
345 {
346 	struct hci_ev_status *rp = data;
347 	void *sent;
348 
349 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
350 
351 	sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
352 	if (!sent)
353 		return rp->status;
354 
355 	hci_dev_lock(hdev);
356 
357 	if (hci_dev_test_flag(hdev, HCI_MGMT))
358 		mgmt_set_local_name_complete(hdev, sent, rp->status);
359 	else if (!rp->status)
360 		memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
361 
362 	hci_dev_unlock(hdev);
363 
364 	return rp->status;
365 }
366 
hci_cc_read_local_name(struct hci_dev * hdev,void * data,struct sk_buff * skb)367 static u8 hci_cc_read_local_name(struct hci_dev *hdev, void *data,
368 				 struct sk_buff *skb)
369 {
370 	struct hci_rp_read_local_name *rp = data;
371 
372 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
373 
374 	if (rp->status)
375 		return rp->status;
376 
377 	if (hci_dev_test_flag(hdev, HCI_SETUP) ||
378 	    hci_dev_test_flag(hdev, HCI_CONFIG))
379 		memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
380 
381 	return rp->status;
382 }
383 
hci_cc_write_auth_enable(struct hci_dev * hdev,void * data,struct sk_buff * skb)384 static u8 hci_cc_write_auth_enable(struct hci_dev *hdev, void *data,
385 				   struct sk_buff *skb)
386 {
387 	struct hci_ev_status *rp = data;
388 	void *sent;
389 
390 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
391 
392 	sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
393 	if (!sent)
394 		return rp->status;
395 
396 	hci_dev_lock(hdev);
397 
398 	if (!rp->status) {
399 		__u8 param = *((__u8 *) sent);
400 
401 		if (param == AUTH_ENABLED)
402 			set_bit(HCI_AUTH, &hdev->flags);
403 		else
404 			clear_bit(HCI_AUTH, &hdev->flags);
405 	}
406 
407 	if (hci_dev_test_flag(hdev, HCI_MGMT))
408 		mgmt_auth_enable_complete(hdev, rp->status);
409 
410 	hci_dev_unlock(hdev);
411 
412 	return rp->status;
413 }
414 
hci_cc_write_encrypt_mode(struct hci_dev * hdev,void * data,struct sk_buff * skb)415 static u8 hci_cc_write_encrypt_mode(struct hci_dev *hdev, void *data,
416 				    struct sk_buff *skb)
417 {
418 	struct hci_ev_status *rp = data;
419 	__u8 param;
420 	void *sent;
421 
422 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
423 
424 	if (rp->status)
425 		return rp->status;
426 
427 	sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
428 	if (!sent)
429 		return rp->status;
430 
431 	param = *((__u8 *) sent);
432 
433 	if (param)
434 		set_bit(HCI_ENCRYPT, &hdev->flags);
435 	else
436 		clear_bit(HCI_ENCRYPT, &hdev->flags);
437 
438 	return rp->status;
439 }
440 
hci_cc_write_scan_enable(struct hci_dev * hdev,void * data,struct sk_buff * skb)441 static u8 hci_cc_write_scan_enable(struct hci_dev *hdev, void *data,
442 				   struct sk_buff *skb)
443 {
444 	struct hci_ev_status *rp = data;
445 	__u8 param;
446 	void *sent;
447 
448 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
449 
450 	sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
451 	if (!sent)
452 		return rp->status;
453 
454 	param = *((__u8 *) sent);
455 
456 	hci_dev_lock(hdev);
457 
458 	if (rp->status) {
459 		hdev->discov_timeout = 0;
460 		goto done;
461 	}
462 
463 	if (param & SCAN_INQUIRY)
464 		set_bit(HCI_ISCAN, &hdev->flags);
465 	else
466 		clear_bit(HCI_ISCAN, &hdev->flags);
467 
468 	if (param & SCAN_PAGE)
469 		set_bit(HCI_PSCAN, &hdev->flags);
470 	else
471 		clear_bit(HCI_PSCAN, &hdev->flags);
472 
473 done:
474 	hci_dev_unlock(hdev);
475 
476 	return rp->status;
477 }
478 
hci_cc_set_event_filter(struct hci_dev * hdev,void * data,struct sk_buff * skb)479 static u8 hci_cc_set_event_filter(struct hci_dev *hdev, void *data,
480 				  struct sk_buff *skb)
481 {
482 	struct hci_ev_status *rp = data;
483 	struct hci_cp_set_event_filter *cp;
484 	void *sent;
485 
486 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
487 
488 	if (rp->status)
489 		return rp->status;
490 
491 	sent = hci_sent_cmd_data(hdev, HCI_OP_SET_EVENT_FLT);
492 	if (!sent)
493 		return rp->status;
494 
495 	cp = (struct hci_cp_set_event_filter *)sent;
496 
497 	if (cp->flt_type == HCI_FLT_CLEAR_ALL)
498 		hci_dev_clear_flag(hdev, HCI_EVENT_FILTER_CONFIGURED);
499 	else
500 		hci_dev_set_flag(hdev, HCI_EVENT_FILTER_CONFIGURED);
501 
502 	return rp->status;
503 }
504 
hci_cc_read_class_of_dev(struct hci_dev * hdev,void * data,struct sk_buff * skb)505 static u8 hci_cc_read_class_of_dev(struct hci_dev *hdev, void *data,
506 				   struct sk_buff *skb)
507 {
508 	struct hci_rp_read_class_of_dev *rp = data;
509 
510 	if (WARN_ON(!hdev))
511 		return HCI_ERROR_UNSPECIFIED;
512 
513 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
514 
515 	if (rp->status)
516 		return rp->status;
517 
518 	memcpy(hdev->dev_class, rp->dev_class, 3);
519 
520 	bt_dev_dbg(hdev, "class 0x%.2x%.2x%.2x", hdev->dev_class[2],
521 		   hdev->dev_class[1], hdev->dev_class[0]);
522 
523 	return rp->status;
524 }
525 
hci_cc_write_class_of_dev(struct hci_dev * hdev,void * data,struct sk_buff * skb)526 static u8 hci_cc_write_class_of_dev(struct hci_dev *hdev, void *data,
527 				    struct sk_buff *skb)
528 {
529 	struct hci_ev_status *rp = data;
530 	void *sent;
531 
532 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
533 
534 	sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
535 	if (!sent)
536 		return rp->status;
537 
538 	hci_dev_lock(hdev);
539 
540 	if (!rp->status)
541 		memcpy(hdev->dev_class, sent, 3);
542 
543 	if (hci_dev_test_flag(hdev, HCI_MGMT))
544 		mgmt_set_class_of_dev_complete(hdev, sent, rp->status);
545 
546 	hci_dev_unlock(hdev);
547 
548 	return rp->status;
549 }
550 
hci_cc_read_voice_setting(struct hci_dev * hdev,void * data,struct sk_buff * skb)551 static u8 hci_cc_read_voice_setting(struct hci_dev *hdev, void *data,
552 				    struct sk_buff *skb)
553 {
554 	struct hci_rp_read_voice_setting *rp = data;
555 	__u16 setting;
556 
557 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
558 
559 	if (rp->status)
560 		return rp->status;
561 
562 	setting = __le16_to_cpu(rp->voice_setting);
563 
564 	if (hdev->voice_setting == setting)
565 		return rp->status;
566 
567 	hdev->voice_setting = setting;
568 
569 	bt_dev_dbg(hdev, "voice setting 0x%4.4x", setting);
570 
571 	if (hdev->notify)
572 		hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
573 
574 	return rp->status;
575 }
576 
hci_cc_write_voice_setting(struct hci_dev * hdev,void * data,struct sk_buff * skb)577 static u8 hci_cc_write_voice_setting(struct hci_dev *hdev, void *data,
578 				     struct sk_buff *skb)
579 {
580 	struct hci_ev_status *rp = data;
581 	__u16 setting;
582 	void *sent;
583 
584 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
585 
586 	if (rp->status)
587 		return rp->status;
588 
589 	sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
590 	if (!sent)
591 		return rp->status;
592 
593 	setting = get_unaligned_le16(sent);
594 
595 	if (hdev->voice_setting == setting)
596 		return rp->status;
597 
598 	hdev->voice_setting = setting;
599 
600 	bt_dev_dbg(hdev, "voice setting 0x%4.4x", setting);
601 
602 	if (hdev->notify)
603 		hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
604 
605 	return rp->status;
606 }
607 
hci_cc_read_num_supported_iac(struct hci_dev * hdev,void * data,struct sk_buff * skb)608 static u8 hci_cc_read_num_supported_iac(struct hci_dev *hdev, void *data,
609 					struct sk_buff *skb)
610 {
611 	struct hci_rp_read_num_supported_iac *rp = data;
612 
613 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
614 
615 	if (rp->status)
616 		return rp->status;
617 
618 	hdev->num_iac = rp->num_iac;
619 
620 	bt_dev_dbg(hdev, "num iac %d", hdev->num_iac);
621 
622 	return rp->status;
623 }
624 
hci_cc_write_ssp_mode(struct hci_dev * hdev,void * data,struct sk_buff * skb)625 static u8 hci_cc_write_ssp_mode(struct hci_dev *hdev, void *data,
626 				struct sk_buff *skb)
627 {
628 	struct hci_ev_status *rp = data;
629 	struct hci_cp_write_ssp_mode *sent;
630 
631 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
632 
633 	sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
634 	if (!sent)
635 		return rp->status;
636 
637 	hci_dev_lock(hdev);
638 
639 	if (!rp->status) {
640 		if (sent->mode)
641 			hdev->features[1][0] |= LMP_HOST_SSP;
642 		else
643 			hdev->features[1][0] &= ~LMP_HOST_SSP;
644 	}
645 
646 	if (!rp->status) {
647 		if (sent->mode)
648 			hci_dev_set_flag(hdev, HCI_SSP_ENABLED);
649 		else
650 			hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
651 	}
652 
653 	hci_dev_unlock(hdev);
654 
655 	return rp->status;
656 }
657 
hci_cc_write_sc_support(struct hci_dev * hdev,void * data,struct sk_buff * skb)658 static u8 hci_cc_write_sc_support(struct hci_dev *hdev, void *data,
659 				  struct sk_buff *skb)
660 {
661 	struct hci_ev_status *rp = data;
662 	struct hci_cp_write_sc_support *sent;
663 
664 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
665 
666 	sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SC_SUPPORT);
667 	if (!sent)
668 		return rp->status;
669 
670 	hci_dev_lock(hdev);
671 
672 	if (!rp->status) {
673 		if (sent->support)
674 			hdev->features[1][0] |= LMP_HOST_SC;
675 		else
676 			hdev->features[1][0] &= ~LMP_HOST_SC;
677 	}
678 
679 	if (!hci_dev_test_flag(hdev, HCI_MGMT) && !rp->status) {
680 		if (sent->support)
681 			hci_dev_set_flag(hdev, HCI_SC_ENABLED);
682 		else
683 			hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
684 	}
685 
686 	hci_dev_unlock(hdev);
687 
688 	return rp->status;
689 }
690 
hci_cc_read_local_version(struct hci_dev * hdev,void * data,struct sk_buff * skb)691 static u8 hci_cc_read_local_version(struct hci_dev *hdev, void *data,
692 				    struct sk_buff *skb)
693 {
694 	struct hci_rp_read_local_version *rp = data;
695 
696 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
697 
698 	if (rp->status)
699 		return rp->status;
700 
701 	if (hci_dev_test_flag(hdev, HCI_SETUP) ||
702 	    hci_dev_test_flag(hdev, HCI_CONFIG)) {
703 		hdev->hci_ver = rp->hci_ver;
704 		hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
705 		hdev->lmp_ver = rp->lmp_ver;
706 		hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
707 		hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
708 	}
709 
710 	return rp->status;
711 }
712 
hci_cc_read_enc_key_size(struct hci_dev * hdev,void * data,struct sk_buff * skb)713 static u8 hci_cc_read_enc_key_size(struct hci_dev *hdev, void *data,
714 				   struct sk_buff *skb)
715 {
716 	struct hci_rp_read_enc_key_size *rp = data;
717 	struct hci_conn *conn;
718 	u16 handle;
719 	u8 status = rp->status;
720 
721 	bt_dev_dbg(hdev, "status 0x%2.2x", status);
722 
723 	handle = le16_to_cpu(rp->handle);
724 
725 	hci_dev_lock(hdev);
726 
727 	conn = hci_conn_hash_lookup_handle(hdev, handle);
728 	if (!conn) {
729 		status = 0xFF;
730 		goto done;
731 	}
732 
733 	/* While unexpected, the read_enc_key_size command may fail. The most
734 	 * secure approach is to then assume the key size is 0 to force a
735 	 * disconnection.
736 	 */
737 	if (status) {
738 		bt_dev_err(hdev, "failed to read key size for handle %u",
739 			   handle);
740 		conn->enc_key_size = 0;
741 	} else {
742 		u8 *key_enc_size = hci_conn_key_enc_size(conn);
743 
744 		conn->enc_key_size = rp->key_size;
745 		status = 0;
746 
747 		/* Attempt to check if the key size is too small or if it has
748 		 * been downgraded from the last time it was stored as part of
749 		 * the link_key.
750 		 */
751 		if (conn->enc_key_size < hdev->min_enc_key_size ||
752 		    (key_enc_size && conn->enc_key_size < *key_enc_size)) {
753 			/* As slave role, the conn->state has been set to
754 			 * BT_CONNECTED and l2cap conn req might not be received
755 			 * yet, at this moment the l2cap layer almost does
756 			 * nothing with the non-zero status.
757 			 * So we also clear encrypt related bits, and then the
758 			 * handler of l2cap conn req will get the right secure
759 			 * state at a later time.
760 			 */
761 			status = HCI_ERROR_AUTH_FAILURE;
762 			clear_bit(HCI_CONN_ENCRYPT, &conn->flags);
763 			clear_bit(HCI_CONN_AES_CCM, &conn->flags);
764 		}
765 
766 		/* Update the key encryption size with the connection one */
767 		if (key_enc_size && *key_enc_size != conn->enc_key_size)
768 			*key_enc_size = conn->enc_key_size;
769 	}
770 
771 	hci_encrypt_cfm(conn, status);
772 
773 done:
774 	hci_dev_unlock(hdev);
775 
776 	return status;
777 }
778 
hci_cc_read_local_commands(struct hci_dev * hdev,void * data,struct sk_buff * skb)779 static u8 hci_cc_read_local_commands(struct hci_dev *hdev, void *data,
780 				     struct sk_buff *skb)
781 {
782 	struct hci_rp_read_local_commands *rp = data;
783 
784 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
785 
786 	if (rp->status)
787 		return rp->status;
788 
789 	if (hci_dev_test_flag(hdev, HCI_SETUP) ||
790 	    hci_dev_test_flag(hdev, HCI_CONFIG))
791 		memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
792 
793 	return rp->status;
794 }
795 
hci_cc_read_auth_payload_timeout(struct hci_dev * hdev,void * data,struct sk_buff * skb)796 static u8 hci_cc_read_auth_payload_timeout(struct hci_dev *hdev, void *data,
797 					   struct sk_buff *skb)
798 {
799 	struct hci_rp_read_auth_payload_to *rp = data;
800 	struct hci_conn *conn;
801 
802 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
803 
804 	if (rp->status)
805 		return rp->status;
806 
807 	hci_dev_lock(hdev);
808 
809 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
810 	if (conn)
811 		conn->auth_payload_timeout = __le16_to_cpu(rp->timeout);
812 
813 	hci_dev_unlock(hdev);
814 
815 	return rp->status;
816 }
817 
hci_cc_write_auth_payload_timeout(struct hci_dev * hdev,void * data,struct sk_buff * skb)818 static u8 hci_cc_write_auth_payload_timeout(struct hci_dev *hdev, void *data,
819 					    struct sk_buff *skb)
820 {
821 	struct hci_rp_write_auth_payload_to *rp = data;
822 	struct hci_conn *conn;
823 	void *sent;
824 
825 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
826 
827 	sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_PAYLOAD_TO);
828 	if (!sent)
829 		return rp->status;
830 
831 	hci_dev_lock(hdev);
832 
833 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
834 	if (!conn) {
835 		rp->status = 0xff;
836 		goto unlock;
837 	}
838 
839 	if (!rp->status)
840 		conn->auth_payload_timeout = get_unaligned_le16(sent + 2);
841 
842 unlock:
843 	hci_dev_unlock(hdev);
844 
845 	return rp->status;
846 }
847 
hci_cc_read_local_features(struct hci_dev * hdev,void * data,struct sk_buff * skb)848 static u8 hci_cc_read_local_features(struct hci_dev *hdev, void *data,
849 				     struct sk_buff *skb)
850 {
851 	struct hci_rp_read_local_features *rp = data;
852 
853 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
854 
855 	if (rp->status)
856 		return rp->status;
857 
858 	memcpy(hdev->features, rp->features, 8);
859 
860 	/* Adjust default settings according to features
861 	 * supported by device. */
862 
863 	if (hdev->features[0][0] & LMP_3SLOT)
864 		hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
865 
866 	if (hdev->features[0][0] & LMP_5SLOT)
867 		hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
868 
869 	if (hdev->features[0][1] & LMP_HV2) {
870 		hdev->pkt_type  |= (HCI_HV2);
871 		hdev->esco_type |= (ESCO_HV2);
872 	}
873 
874 	if (hdev->features[0][1] & LMP_HV3) {
875 		hdev->pkt_type  |= (HCI_HV3);
876 		hdev->esco_type |= (ESCO_HV3);
877 	}
878 
879 	if (lmp_esco_capable(hdev))
880 		hdev->esco_type |= (ESCO_EV3);
881 
882 	if (hdev->features[0][4] & LMP_EV4)
883 		hdev->esco_type |= (ESCO_EV4);
884 
885 	if (hdev->features[0][4] & LMP_EV5)
886 		hdev->esco_type |= (ESCO_EV5);
887 
888 	if (hdev->features[0][5] & LMP_EDR_ESCO_2M)
889 		hdev->esco_type |= (ESCO_2EV3);
890 
891 	if (hdev->features[0][5] & LMP_EDR_ESCO_3M)
892 		hdev->esco_type |= (ESCO_3EV3);
893 
894 	if (hdev->features[0][5] & LMP_EDR_3S_ESCO)
895 		hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
896 
897 	return rp->status;
898 }
899 
hci_cc_read_local_ext_features(struct hci_dev * hdev,void * data,struct sk_buff * skb)900 static u8 hci_cc_read_local_ext_features(struct hci_dev *hdev, void *data,
901 					 struct sk_buff *skb)
902 {
903 	struct hci_rp_read_local_ext_features *rp = data;
904 
905 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
906 
907 	if (rp->status)
908 		return rp->status;
909 
910 	if (hdev->max_page < rp->max_page) {
911 		if (test_bit(HCI_QUIRK_BROKEN_LOCAL_EXT_FEATURES_PAGE_2,
912 			     &hdev->quirks))
913 			bt_dev_warn(hdev, "broken local ext features page 2");
914 		else
915 			hdev->max_page = rp->max_page;
916 	}
917 
918 	if (rp->page < HCI_MAX_PAGES)
919 		memcpy(hdev->features[rp->page], rp->features, 8);
920 
921 	return rp->status;
922 }
923 
hci_cc_read_buffer_size(struct hci_dev * hdev,void * data,struct sk_buff * skb)924 static u8 hci_cc_read_buffer_size(struct hci_dev *hdev, void *data,
925 				  struct sk_buff *skb)
926 {
927 	struct hci_rp_read_buffer_size *rp = data;
928 
929 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
930 
931 	if (rp->status)
932 		return rp->status;
933 
934 	hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
935 	hdev->sco_mtu  = rp->sco_mtu;
936 	hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
937 	hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
938 
939 	if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
940 		hdev->sco_mtu  = 64;
941 		hdev->sco_pkts = 8;
942 	}
943 
944 	if (!read_voice_setting_capable(hdev))
945 		hdev->sco_pkts = 0;
946 
947 	hdev->acl_cnt = hdev->acl_pkts;
948 	hdev->sco_cnt = hdev->sco_pkts;
949 
950 	BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
951 	       hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
952 
953 	if (!hdev->acl_mtu || !hdev->acl_pkts)
954 		return HCI_ERROR_INVALID_PARAMETERS;
955 
956 	return rp->status;
957 }
958 
hci_cc_read_bd_addr(struct hci_dev * hdev,void * data,struct sk_buff * skb)959 static u8 hci_cc_read_bd_addr(struct hci_dev *hdev, void *data,
960 			      struct sk_buff *skb)
961 {
962 	struct hci_rp_read_bd_addr *rp = data;
963 
964 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
965 
966 	if (rp->status)
967 		return rp->status;
968 
969 	if (test_bit(HCI_INIT, &hdev->flags))
970 		bacpy(&hdev->bdaddr, &rp->bdaddr);
971 
972 	if (hci_dev_test_flag(hdev, HCI_SETUP))
973 		bacpy(&hdev->setup_addr, &rp->bdaddr);
974 
975 	return rp->status;
976 }
977 
hci_cc_read_local_pairing_opts(struct hci_dev * hdev,void * data,struct sk_buff * skb)978 static u8 hci_cc_read_local_pairing_opts(struct hci_dev *hdev, void *data,
979 					 struct sk_buff *skb)
980 {
981 	struct hci_rp_read_local_pairing_opts *rp = data;
982 
983 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
984 
985 	if (rp->status)
986 		return rp->status;
987 
988 	if (hci_dev_test_flag(hdev, HCI_SETUP) ||
989 	    hci_dev_test_flag(hdev, HCI_CONFIG)) {
990 		hdev->pairing_opts = rp->pairing_opts;
991 		hdev->max_enc_key_size = rp->max_key_size;
992 	}
993 
994 	return rp->status;
995 }
996 
hci_cc_read_page_scan_activity(struct hci_dev * hdev,void * data,struct sk_buff * skb)997 static u8 hci_cc_read_page_scan_activity(struct hci_dev *hdev, void *data,
998 					 struct sk_buff *skb)
999 {
1000 	struct hci_rp_read_page_scan_activity *rp = data;
1001 
1002 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1003 
1004 	if (rp->status)
1005 		return rp->status;
1006 
1007 	if (test_bit(HCI_INIT, &hdev->flags)) {
1008 		hdev->page_scan_interval = __le16_to_cpu(rp->interval);
1009 		hdev->page_scan_window = __le16_to_cpu(rp->window);
1010 	}
1011 
1012 	return rp->status;
1013 }
1014 
hci_cc_write_page_scan_activity(struct hci_dev * hdev,void * data,struct sk_buff * skb)1015 static u8 hci_cc_write_page_scan_activity(struct hci_dev *hdev, void *data,
1016 					  struct sk_buff *skb)
1017 {
1018 	struct hci_ev_status *rp = data;
1019 	struct hci_cp_write_page_scan_activity *sent;
1020 
1021 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1022 
1023 	if (rp->status)
1024 		return rp->status;
1025 
1026 	sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY);
1027 	if (!sent)
1028 		return rp->status;
1029 
1030 	hdev->page_scan_interval = __le16_to_cpu(sent->interval);
1031 	hdev->page_scan_window = __le16_to_cpu(sent->window);
1032 
1033 	return rp->status;
1034 }
1035 
hci_cc_read_page_scan_type(struct hci_dev * hdev,void * data,struct sk_buff * skb)1036 static u8 hci_cc_read_page_scan_type(struct hci_dev *hdev, void *data,
1037 				     struct sk_buff *skb)
1038 {
1039 	struct hci_rp_read_page_scan_type *rp = data;
1040 
1041 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1042 
1043 	if (rp->status)
1044 		return rp->status;
1045 
1046 	if (test_bit(HCI_INIT, &hdev->flags))
1047 		hdev->page_scan_type = rp->type;
1048 
1049 	return rp->status;
1050 }
1051 
hci_cc_write_page_scan_type(struct hci_dev * hdev,void * data,struct sk_buff * skb)1052 static u8 hci_cc_write_page_scan_type(struct hci_dev *hdev, void *data,
1053 				      struct sk_buff *skb)
1054 {
1055 	struct hci_ev_status *rp = data;
1056 	u8 *type;
1057 
1058 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1059 
1060 	if (rp->status)
1061 		return rp->status;
1062 
1063 	type = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE);
1064 	if (type)
1065 		hdev->page_scan_type = *type;
1066 
1067 	return rp->status;
1068 }
1069 
hci_cc_read_clock(struct hci_dev * hdev,void * data,struct sk_buff * skb)1070 static u8 hci_cc_read_clock(struct hci_dev *hdev, void *data,
1071 			    struct sk_buff *skb)
1072 {
1073 	struct hci_rp_read_clock *rp = data;
1074 	struct hci_cp_read_clock *cp;
1075 	struct hci_conn *conn;
1076 
1077 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1078 
1079 	if (rp->status)
1080 		return rp->status;
1081 
1082 	hci_dev_lock(hdev);
1083 
1084 	cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
1085 	if (!cp)
1086 		goto unlock;
1087 
1088 	if (cp->which == 0x00) {
1089 		hdev->clock = le32_to_cpu(rp->clock);
1090 		goto unlock;
1091 	}
1092 
1093 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1094 	if (conn) {
1095 		conn->clock = le32_to_cpu(rp->clock);
1096 		conn->clock_accuracy = le16_to_cpu(rp->accuracy);
1097 	}
1098 
1099 unlock:
1100 	hci_dev_unlock(hdev);
1101 	return rp->status;
1102 }
1103 
hci_cc_read_inq_rsp_tx_power(struct hci_dev * hdev,void * data,struct sk_buff * skb)1104 static u8 hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev, void *data,
1105 				       struct sk_buff *skb)
1106 {
1107 	struct hci_rp_read_inq_rsp_tx_power *rp = data;
1108 
1109 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1110 
1111 	if (rp->status)
1112 		return rp->status;
1113 
1114 	hdev->inq_tx_power = rp->tx_power;
1115 
1116 	return rp->status;
1117 }
1118 
hci_cc_read_def_err_data_reporting(struct hci_dev * hdev,void * data,struct sk_buff * skb)1119 static u8 hci_cc_read_def_err_data_reporting(struct hci_dev *hdev, void *data,
1120 					     struct sk_buff *skb)
1121 {
1122 	struct hci_rp_read_def_err_data_reporting *rp = data;
1123 
1124 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1125 
1126 	if (rp->status)
1127 		return rp->status;
1128 
1129 	hdev->err_data_reporting = rp->err_data_reporting;
1130 
1131 	return rp->status;
1132 }
1133 
hci_cc_write_def_err_data_reporting(struct hci_dev * hdev,void * data,struct sk_buff * skb)1134 static u8 hci_cc_write_def_err_data_reporting(struct hci_dev *hdev, void *data,
1135 					      struct sk_buff *skb)
1136 {
1137 	struct hci_ev_status *rp = data;
1138 	struct hci_cp_write_def_err_data_reporting *cp;
1139 
1140 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1141 
1142 	if (rp->status)
1143 		return rp->status;
1144 
1145 	cp = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_ERR_DATA_REPORTING);
1146 	if (!cp)
1147 		return rp->status;
1148 
1149 	hdev->err_data_reporting = cp->err_data_reporting;
1150 
1151 	return rp->status;
1152 }
1153 
hci_cc_pin_code_reply(struct hci_dev * hdev,void * data,struct sk_buff * skb)1154 static u8 hci_cc_pin_code_reply(struct hci_dev *hdev, void *data,
1155 				struct sk_buff *skb)
1156 {
1157 	struct hci_rp_pin_code_reply *rp = data;
1158 	struct hci_cp_pin_code_reply *cp;
1159 	struct hci_conn *conn;
1160 
1161 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1162 
1163 	hci_dev_lock(hdev);
1164 
1165 	if (hci_dev_test_flag(hdev, HCI_MGMT))
1166 		mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
1167 
1168 	if (rp->status)
1169 		goto unlock;
1170 
1171 	cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
1172 	if (!cp)
1173 		goto unlock;
1174 
1175 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1176 	if (conn)
1177 		conn->pin_length = cp->pin_len;
1178 
1179 unlock:
1180 	hci_dev_unlock(hdev);
1181 	return rp->status;
1182 }
1183 
hci_cc_pin_code_neg_reply(struct hci_dev * hdev,void * data,struct sk_buff * skb)1184 static u8 hci_cc_pin_code_neg_reply(struct hci_dev *hdev, void *data,
1185 				    struct sk_buff *skb)
1186 {
1187 	struct hci_rp_pin_code_neg_reply *rp = data;
1188 
1189 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1190 
1191 	hci_dev_lock(hdev);
1192 
1193 	if (hci_dev_test_flag(hdev, HCI_MGMT))
1194 		mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
1195 						 rp->status);
1196 
1197 	hci_dev_unlock(hdev);
1198 
1199 	return rp->status;
1200 }
1201 
hci_cc_le_read_buffer_size(struct hci_dev * hdev,void * data,struct sk_buff * skb)1202 static u8 hci_cc_le_read_buffer_size(struct hci_dev *hdev, void *data,
1203 				     struct sk_buff *skb)
1204 {
1205 	struct hci_rp_le_read_buffer_size *rp = data;
1206 
1207 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1208 
1209 	if (rp->status)
1210 		return rp->status;
1211 
1212 	hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
1213 	hdev->le_pkts = rp->le_max_pkt;
1214 
1215 	hdev->le_cnt = hdev->le_pkts;
1216 
1217 	BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
1218 
1219 	if (hdev->le_mtu && hdev->le_mtu < HCI_MIN_LE_MTU)
1220 		return HCI_ERROR_INVALID_PARAMETERS;
1221 
1222 	return rp->status;
1223 }
1224 
hci_cc_le_read_local_features(struct hci_dev * hdev,void * data,struct sk_buff * skb)1225 static u8 hci_cc_le_read_local_features(struct hci_dev *hdev, void *data,
1226 					struct sk_buff *skb)
1227 {
1228 	struct hci_rp_le_read_local_features *rp = data;
1229 
1230 	BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1231 
1232 	if (rp->status)
1233 		return rp->status;
1234 
1235 	memcpy(hdev->le_features, rp->features, 8);
1236 
1237 	return rp->status;
1238 }
1239 
hci_cc_le_read_adv_tx_power(struct hci_dev * hdev,void * data,struct sk_buff * skb)1240 static u8 hci_cc_le_read_adv_tx_power(struct hci_dev *hdev, void *data,
1241 				      struct sk_buff *skb)
1242 {
1243 	struct hci_rp_le_read_adv_tx_power *rp = data;
1244 
1245 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1246 
1247 	if (rp->status)
1248 		return rp->status;
1249 
1250 	hdev->adv_tx_power = rp->tx_power;
1251 
1252 	return rp->status;
1253 }
1254 
hci_cc_user_confirm_reply(struct hci_dev * hdev,void * data,struct sk_buff * skb)1255 static u8 hci_cc_user_confirm_reply(struct hci_dev *hdev, void *data,
1256 				    struct sk_buff *skb)
1257 {
1258 	struct hci_rp_user_confirm_reply *rp = data;
1259 
1260 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1261 
1262 	hci_dev_lock(hdev);
1263 
1264 	if (hci_dev_test_flag(hdev, HCI_MGMT))
1265 		mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,
1266 						 rp->status);
1267 
1268 	hci_dev_unlock(hdev);
1269 
1270 	return rp->status;
1271 }
1272 
hci_cc_user_confirm_neg_reply(struct hci_dev * hdev,void * data,struct sk_buff * skb)1273 static u8 hci_cc_user_confirm_neg_reply(struct hci_dev *hdev, void *data,
1274 					struct sk_buff *skb)
1275 {
1276 	struct hci_rp_user_confirm_reply *rp = data;
1277 
1278 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1279 
1280 	hci_dev_lock(hdev);
1281 
1282 	if (hci_dev_test_flag(hdev, HCI_MGMT))
1283 		mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
1284 						     ACL_LINK, 0, rp->status);
1285 
1286 	hci_dev_unlock(hdev);
1287 
1288 	return rp->status;
1289 }
1290 
hci_cc_user_passkey_reply(struct hci_dev * hdev,void * data,struct sk_buff * skb)1291 static u8 hci_cc_user_passkey_reply(struct hci_dev *hdev, void *data,
1292 				    struct sk_buff *skb)
1293 {
1294 	struct hci_rp_user_confirm_reply *rp = data;
1295 
1296 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1297 
1298 	hci_dev_lock(hdev);
1299 
1300 	if (hci_dev_test_flag(hdev, HCI_MGMT))
1301 		mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
1302 						 0, rp->status);
1303 
1304 	hci_dev_unlock(hdev);
1305 
1306 	return rp->status;
1307 }
1308 
hci_cc_user_passkey_neg_reply(struct hci_dev * hdev,void * data,struct sk_buff * skb)1309 static u8 hci_cc_user_passkey_neg_reply(struct hci_dev *hdev, void *data,
1310 					struct sk_buff *skb)
1311 {
1312 	struct hci_rp_user_confirm_reply *rp = data;
1313 
1314 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1315 
1316 	hci_dev_lock(hdev);
1317 
1318 	if (hci_dev_test_flag(hdev, HCI_MGMT))
1319 		mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
1320 						     ACL_LINK, 0, rp->status);
1321 
1322 	hci_dev_unlock(hdev);
1323 
1324 	return rp->status;
1325 }
1326 
hci_cc_read_local_oob_data(struct hci_dev * hdev,void * data,struct sk_buff * skb)1327 static u8 hci_cc_read_local_oob_data(struct hci_dev *hdev, void *data,
1328 				     struct sk_buff *skb)
1329 {
1330 	struct hci_rp_read_local_oob_data *rp = data;
1331 
1332 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1333 
1334 	return rp->status;
1335 }
1336 
hci_cc_read_local_oob_ext_data(struct hci_dev * hdev,void * data,struct sk_buff * skb)1337 static u8 hci_cc_read_local_oob_ext_data(struct hci_dev *hdev, void *data,
1338 					 struct sk_buff *skb)
1339 {
1340 	struct hci_rp_read_local_oob_ext_data *rp = data;
1341 
1342 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1343 
1344 	return rp->status;
1345 }
1346 
hci_cc_le_set_random_addr(struct hci_dev * hdev,void * data,struct sk_buff * skb)1347 static u8 hci_cc_le_set_random_addr(struct hci_dev *hdev, void *data,
1348 				    struct sk_buff *skb)
1349 {
1350 	struct hci_ev_status *rp = data;
1351 	bdaddr_t *sent;
1352 
1353 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1354 
1355 	if (rp->status)
1356 		return rp->status;
1357 
1358 	sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_RANDOM_ADDR);
1359 	if (!sent)
1360 		return rp->status;
1361 
1362 	hci_dev_lock(hdev);
1363 
1364 	bacpy(&hdev->random_addr, sent);
1365 
1366 	if (!bacmp(&hdev->rpa, sent)) {
1367 		hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
1368 		queue_delayed_work(hdev->workqueue, &hdev->rpa_expired,
1369 				   secs_to_jiffies(hdev->rpa_timeout));
1370 	}
1371 
1372 	hci_dev_unlock(hdev);
1373 
1374 	return rp->status;
1375 }
1376 
hci_cc_le_set_default_phy(struct hci_dev * hdev,void * data,struct sk_buff * skb)1377 static u8 hci_cc_le_set_default_phy(struct hci_dev *hdev, void *data,
1378 				    struct sk_buff *skb)
1379 {
1380 	struct hci_ev_status *rp = data;
1381 	struct hci_cp_le_set_default_phy *cp;
1382 
1383 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1384 
1385 	if (rp->status)
1386 		return rp->status;
1387 
1388 	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_DEFAULT_PHY);
1389 	if (!cp)
1390 		return rp->status;
1391 
1392 	hci_dev_lock(hdev);
1393 
1394 	hdev->le_tx_def_phys = cp->tx_phys;
1395 	hdev->le_rx_def_phys = cp->rx_phys;
1396 
1397 	hci_dev_unlock(hdev);
1398 
1399 	return rp->status;
1400 }
1401 
hci_cc_le_set_adv_set_random_addr(struct hci_dev * hdev,void * data,struct sk_buff * skb)1402 static u8 hci_cc_le_set_adv_set_random_addr(struct hci_dev *hdev, void *data,
1403 					    struct sk_buff *skb)
1404 {
1405 	struct hci_ev_status *rp = data;
1406 	struct hci_cp_le_set_adv_set_rand_addr *cp;
1407 	struct adv_info *adv;
1408 
1409 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1410 
1411 	if (rp->status)
1412 		return rp->status;
1413 
1414 	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_SET_RAND_ADDR);
1415 	/* Update only in case the adv instance since handle 0x00 shall be using
1416 	 * HCI_OP_LE_SET_RANDOM_ADDR since that allows both extended and
1417 	 * non-extended adverting.
1418 	 */
1419 	if (!cp || !cp->handle)
1420 		return rp->status;
1421 
1422 	hci_dev_lock(hdev);
1423 
1424 	adv = hci_find_adv_instance(hdev, cp->handle);
1425 	if (adv) {
1426 		bacpy(&adv->random_addr, &cp->bdaddr);
1427 		if (!bacmp(&hdev->rpa, &cp->bdaddr)) {
1428 			adv->rpa_expired = false;
1429 			queue_delayed_work(hdev->workqueue,
1430 					   &adv->rpa_expired_cb,
1431 					   secs_to_jiffies(hdev->rpa_timeout));
1432 		}
1433 	}
1434 
1435 	hci_dev_unlock(hdev);
1436 
1437 	return rp->status;
1438 }
1439 
hci_cc_le_remove_adv_set(struct hci_dev * hdev,void * data,struct sk_buff * skb)1440 static u8 hci_cc_le_remove_adv_set(struct hci_dev *hdev, void *data,
1441 				   struct sk_buff *skb)
1442 {
1443 	struct hci_ev_status *rp = data;
1444 	u8 *instance;
1445 	int err;
1446 
1447 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1448 
1449 	if (rp->status)
1450 		return rp->status;
1451 
1452 	instance = hci_sent_cmd_data(hdev, HCI_OP_LE_REMOVE_ADV_SET);
1453 	if (!instance)
1454 		return rp->status;
1455 
1456 	hci_dev_lock(hdev);
1457 
1458 	err = hci_remove_adv_instance(hdev, *instance);
1459 	if (!err)
1460 		mgmt_advertising_removed(hci_skb_sk(hdev->sent_cmd), hdev,
1461 					 *instance);
1462 
1463 	hci_dev_unlock(hdev);
1464 
1465 	return rp->status;
1466 }
1467 
hci_cc_le_clear_adv_sets(struct hci_dev * hdev,void * data,struct sk_buff * skb)1468 static u8 hci_cc_le_clear_adv_sets(struct hci_dev *hdev, void *data,
1469 				   struct sk_buff *skb)
1470 {
1471 	struct hci_ev_status *rp = data;
1472 	struct adv_info *adv, *n;
1473 	int err;
1474 
1475 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1476 
1477 	if (rp->status)
1478 		return rp->status;
1479 
1480 	if (!hci_sent_cmd_data(hdev, HCI_OP_LE_CLEAR_ADV_SETS))
1481 		return rp->status;
1482 
1483 	hci_dev_lock(hdev);
1484 
1485 	list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) {
1486 		u8 instance = adv->instance;
1487 
1488 		err = hci_remove_adv_instance(hdev, instance);
1489 		if (!err)
1490 			mgmt_advertising_removed(hci_skb_sk(hdev->sent_cmd),
1491 						 hdev, instance);
1492 	}
1493 
1494 	hci_dev_unlock(hdev);
1495 
1496 	return rp->status;
1497 }
1498 
hci_cc_le_read_transmit_power(struct hci_dev * hdev,void * data,struct sk_buff * skb)1499 static u8 hci_cc_le_read_transmit_power(struct hci_dev *hdev, void *data,
1500 					struct sk_buff *skb)
1501 {
1502 	struct hci_rp_le_read_transmit_power *rp = data;
1503 
1504 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1505 
1506 	if (rp->status)
1507 		return rp->status;
1508 
1509 	hdev->min_le_tx_power = rp->min_le_tx_power;
1510 	hdev->max_le_tx_power = rp->max_le_tx_power;
1511 
1512 	return rp->status;
1513 }
1514 
hci_cc_le_set_privacy_mode(struct hci_dev * hdev,void * data,struct sk_buff * skb)1515 static u8 hci_cc_le_set_privacy_mode(struct hci_dev *hdev, void *data,
1516 				     struct sk_buff *skb)
1517 {
1518 	struct hci_ev_status *rp = data;
1519 	struct hci_cp_le_set_privacy_mode *cp;
1520 	struct hci_conn_params *params;
1521 
1522 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1523 
1524 	if (rp->status)
1525 		return rp->status;
1526 
1527 	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_PRIVACY_MODE);
1528 	if (!cp)
1529 		return rp->status;
1530 
1531 	hci_dev_lock(hdev);
1532 
1533 	params = hci_conn_params_lookup(hdev, &cp->bdaddr, cp->bdaddr_type);
1534 	if (params)
1535 		WRITE_ONCE(params->privacy_mode, cp->mode);
1536 
1537 	hci_dev_unlock(hdev);
1538 
1539 	return rp->status;
1540 }
1541 
hci_cc_le_set_adv_enable(struct hci_dev * hdev,void * data,struct sk_buff * skb)1542 static u8 hci_cc_le_set_adv_enable(struct hci_dev *hdev, void *data,
1543 				   struct sk_buff *skb)
1544 {
1545 	struct hci_ev_status *rp = data;
1546 	__u8 *sent;
1547 
1548 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1549 
1550 	if (rp->status)
1551 		return rp->status;
1552 
1553 	sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_ENABLE);
1554 	if (!sent)
1555 		return rp->status;
1556 
1557 	hci_dev_lock(hdev);
1558 
1559 	/* If we're doing connection initiation as peripheral. Set a
1560 	 * timeout in case something goes wrong.
1561 	 */
1562 	if (*sent) {
1563 		struct hci_conn *conn;
1564 
1565 		hci_dev_set_flag(hdev, HCI_LE_ADV);
1566 
1567 		conn = hci_lookup_le_connect(hdev);
1568 		if (conn)
1569 			queue_delayed_work(hdev->workqueue,
1570 					   &conn->le_conn_timeout,
1571 					   conn->conn_timeout);
1572 	} else {
1573 		hci_dev_clear_flag(hdev, HCI_LE_ADV);
1574 	}
1575 
1576 	hci_dev_unlock(hdev);
1577 
1578 	return rp->status;
1579 }
1580 
hci_cc_le_set_ext_adv_enable(struct hci_dev * hdev,void * data,struct sk_buff * skb)1581 static u8 hci_cc_le_set_ext_adv_enable(struct hci_dev *hdev, void *data,
1582 				       struct sk_buff *skb)
1583 {
1584 	struct hci_cp_le_set_ext_adv_enable *cp;
1585 	struct hci_cp_ext_adv_set *set;
1586 	struct adv_info *adv = NULL, *n;
1587 	struct hci_ev_status *rp = data;
1588 
1589 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1590 
1591 	if (rp->status)
1592 		return rp->status;
1593 
1594 	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE);
1595 	if (!cp)
1596 		return rp->status;
1597 
1598 	set = (void *)cp->data;
1599 
1600 	hci_dev_lock(hdev);
1601 
1602 	if (cp->num_of_sets)
1603 		adv = hci_find_adv_instance(hdev, set->handle);
1604 
1605 	if (cp->enable) {
1606 		struct hci_conn *conn;
1607 
1608 		hci_dev_set_flag(hdev, HCI_LE_ADV);
1609 
1610 		if (adv && !adv->periodic)
1611 			adv->enabled = true;
1612 
1613 		conn = hci_lookup_le_connect(hdev);
1614 		if (conn)
1615 			queue_delayed_work(hdev->workqueue,
1616 					   &conn->le_conn_timeout,
1617 					   conn->conn_timeout);
1618 	} else {
1619 		if (cp->num_of_sets) {
1620 			if (adv)
1621 				adv->enabled = false;
1622 
1623 			/* If just one instance was disabled check if there are
1624 			 * any other instance enabled before clearing HCI_LE_ADV
1625 			 */
1626 			list_for_each_entry_safe(adv, n, &hdev->adv_instances,
1627 						 list) {
1628 				if (adv->enabled)
1629 					goto unlock;
1630 			}
1631 		} else {
1632 			/* All instances shall be considered disabled */
1633 			list_for_each_entry_safe(adv, n, &hdev->adv_instances,
1634 						 list)
1635 				adv->enabled = false;
1636 		}
1637 
1638 		hci_dev_clear_flag(hdev, HCI_LE_ADV);
1639 	}
1640 
1641 unlock:
1642 	hci_dev_unlock(hdev);
1643 	return rp->status;
1644 }
1645 
hci_cc_le_set_scan_param(struct hci_dev * hdev,void * data,struct sk_buff * skb)1646 static u8 hci_cc_le_set_scan_param(struct hci_dev *hdev, void *data,
1647 				   struct sk_buff *skb)
1648 {
1649 	struct hci_cp_le_set_scan_param *cp;
1650 	struct hci_ev_status *rp = data;
1651 
1652 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1653 
1654 	if (rp->status)
1655 		return rp->status;
1656 
1657 	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_PARAM);
1658 	if (!cp)
1659 		return rp->status;
1660 
1661 	hci_dev_lock(hdev);
1662 
1663 	hdev->le_scan_type = cp->type;
1664 
1665 	hci_dev_unlock(hdev);
1666 
1667 	return rp->status;
1668 }
1669 
hci_cc_le_set_ext_scan_param(struct hci_dev * hdev,void * data,struct sk_buff * skb)1670 static u8 hci_cc_le_set_ext_scan_param(struct hci_dev *hdev, void *data,
1671 				       struct sk_buff *skb)
1672 {
1673 	struct hci_cp_le_set_ext_scan_params *cp;
1674 	struct hci_ev_status *rp = data;
1675 	struct hci_cp_le_scan_phy_params *phy_param;
1676 
1677 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1678 
1679 	if (rp->status)
1680 		return rp->status;
1681 
1682 	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_SCAN_PARAMS);
1683 	if (!cp)
1684 		return rp->status;
1685 
1686 	phy_param = (void *)cp->data;
1687 
1688 	hci_dev_lock(hdev);
1689 
1690 	hdev->le_scan_type = phy_param->type;
1691 
1692 	hci_dev_unlock(hdev);
1693 
1694 	return rp->status;
1695 }
1696 
has_pending_adv_report(struct hci_dev * hdev)1697 static bool has_pending_adv_report(struct hci_dev *hdev)
1698 {
1699 	struct discovery_state *d = &hdev->discovery;
1700 
1701 	return bacmp(&d->last_adv_addr, BDADDR_ANY);
1702 }
1703 
clear_pending_adv_report(struct hci_dev * hdev)1704 static void clear_pending_adv_report(struct hci_dev *hdev)
1705 {
1706 	struct discovery_state *d = &hdev->discovery;
1707 
1708 	bacpy(&d->last_adv_addr, BDADDR_ANY);
1709 	d->last_adv_data_len = 0;
1710 }
1711 
store_pending_adv_report(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 bdaddr_type,s8 rssi,u32 flags,u8 * data,u8 len)1712 static void store_pending_adv_report(struct hci_dev *hdev, bdaddr_t *bdaddr,
1713 				     u8 bdaddr_type, s8 rssi, u32 flags,
1714 				     u8 *data, u8 len)
1715 {
1716 	struct discovery_state *d = &hdev->discovery;
1717 
1718 	if (len > max_adv_len(hdev))
1719 		return;
1720 
1721 	bacpy(&d->last_adv_addr, bdaddr);
1722 	d->last_adv_addr_type = bdaddr_type;
1723 	d->last_adv_rssi = rssi;
1724 	d->last_adv_flags = flags;
1725 	memcpy(d->last_adv_data, data, len);
1726 	d->last_adv_data_len = len;
1727 }
1728 
le_set_scan_enable_complete(struct hci_dev * hdev,u8 enable)1729 static void le_set_scan_enable_complete(struct hci_dev *hdev, u8 enable)
1730 {
1731 	hci_dev_lock(hdev);
1732 
1733 	switch (enable) {
1734 	case LE_SCAN_ENABLE:
1735 		hci_dev_set_flag(hdev, HCI_LE_SCAN);
1736 		if (hdev->le_scan_type == LE_SCAN_ACTIVE) {
1737 			clear_pending_adv_report(hdev);
1738 			hci_discovery_set_state(hdev, DISCOVERY_FINDING);
1739 		}
1740 		break;
1741 
1742 	case LE_SCAN_DISABLE:
1743 		/* We do this here instead of when setting DISCOVERY_STOPPED
1744 		 * since the latter would potentially require waiting for
1745 		 * inquiry to stop too.
1746 		 */
1747 		if (has_pending_adv_report(hdev)) {
1748 			struct discovery_state *d = &hdev->discovery;
1749 
1750 			mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
1751 					  d->last_adv_addr_type, NULL,
1752 					  d->last_adv_rssi, d->last_adv_flags,
1753 					  d->last_adv_data,
1754 					  d->last_adv_data_len, NULL, 0, 0);
1755 		}
1756 
1757 		/* Cancel this timer so that we don't try to disable scanning
1758 		 * when it's already disabled.
1759 		 */
1760 		cancel_delayed_work(&hdev->le_scan_disable);
1761 
1762 		hci_dev_clear_flag(hdev, HCI_LE_SCAN);
1763 
1764 		/* The HCI_LE_SCAN_INTERRUPTED flag indicates that we
1765 		 * interrupted scanning due to a connect request. Mark
1766 		 * therefore discovery as stopped.
1767 		 */
1768 		if (hci_dev_test_and_clear_flag(hdev, HCI_LE_SCAN_INTERRUPTED))
1769 			hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1770 		else if (!hci_dev_test_flag(hdev, HCI_LE_ADV) &&
1771 			 hdev->discovery.state == DISCOVERY_FINDING)
1772 			queue_work(hdev->workqueue, &hdev->reenable_adv_work);
1773 
1774 		break;
1775 
1776 	default:
1777 		bt_dev_err(hdev, "use of reserved LE_Scan_Enable param %d",
1778 			   enable);
1779 		break;
1780 	}
1781 
1782 	hci_dev_unlock(hdev);
1783 }
1784 
hci_cc_le_set_scan_enable(struct hci_dev * hdev,void * data,struct sk_buff * skb)1785 static u8 hci_cc_le_set_scan_enable(struct hci_dev *hdev, void *data,
1786 				    struct sk_buff *skb)
1787 {
1788 	struct hci_cp_le_set_scan_enable *cp;
1789 	struct hci_ev_status *rp = data;
1790 
1791 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1792 
1793 	if (rp->status)
1794 		return rp->status;
1795 
1796 	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
1797 	if (!cp)
1798 		return rp->status;
1799 
1800 	le_set_scan_enable_complete(hdev, cp->enable);
1801 
1802 	return rp->status;
1803 }
1804 
hci_cc_le_set_ext_scan_enable(struct hci_dev * hdev,void * data,struct sk_buff * skb)1805 static u8 hci_cc_le_set_ext_scan_enable(struct hci_dev *hdev, void *data,
1806 					struct sk_buff *skb)
1807 {
1808 	struct hci_cp_le_set_ext_scan_enable *cp;
1809 	struct hci_ev_status *rp = data;
1810 
1811 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1812 
1813 	if (rp->status)
1814 		return rp->status;
1815 
1816 	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_SCAN_ENABLE);
1817 	if (!cp)
1818 		return rp->status;
1819 
1820 	le_set_scan_enable_complete(hdev, cp->enable);
1821 
1822 	return rp->status;
1823 }
1824 
hci_cc_le_read_num_adv_sets(struct hci_dev * hdev,void * data,struct sk_buff * skb)1825 static u8 hci_cc_le_read_num_adv_sets(struct hci_dev *hdev, void *data,
1826 				      struct sk_buff *skb)
1827 {
1828 	struct hci_rp_le_read_num_supported_adv_sets *rp = data;
1829 
1830 	bt_dev_dbg(hdev, "status 0x%2.2x No of Adv sets %u", rp->status,
1831 		   rp->num_of_sets);
1832 
1833 	if (rp->status)
1834 		return rp->status;
1835 
1836 	hdev->le_num_of_adv_sets = rp->num_of_sets;
1837 
1838 	return rp->status;
1839 }
1840 
hci_cc_le_read_accept_list_size(struct hci_dev * hdev,void * data,struct sk_buff * skb)1841 static u8 hci_cc_le_read_accept_list_size(struct hci_dev *hdev, void *data,
1842 					  struct sk_buff *skb)
1843 {
1844 	struct hci_rp_le_read_accept_list_size *rp = data;
1845 
1846 	bt_dev_dbg(hdev, "status 0x%2.2x size %u", rp->status, rp->size);
1847 
1848 	if (rp->status)
1849 		return rp->status;
1850 
1851 	hdev->le_accept_list_size = rp->size;
1852 
1853 	return rp->status;
1854 }
1855 
hci_cc_le_clear_accept_list(struct hci_dev * hdev,void * data,struct sk_buff * skb)1856 static u8 hci_cc_le_clear_accept_list(struct hci_dev *hdev, void *data,
1857 				      struct sk_buff *skb)
1858 {
1859 	struct hci_ev_status *rp = data;
1860 
1861 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1862 
1863 	if (rp->status)
1864 		return rp->status;
1865 
1866 	hci_dev_lock(hdev);
1867 	hci_bdaddr_list_clear(&hdev->le_accept_list);
1868 	hci_dev_unlock(hdev);
1869 
1870 	return rp->status;
1871 }
1872 
hci_cc_le_add_to_accept_list(struct hci_dev * hdev,void * data,struct sk_buff * skb)1873 static u8 hci_cc_le_add_to_accept_list(struct hci_dev *hdev, void *data,
1874 				       struct sk_buff *skb)
1875 {
1876 	struct hci_cp_le_add_to_accept_list *sent;
1877 	struct hci_ev_status *rp = data;
1878 
1879 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1880 
1881 	if (rp->status)
1882 		return rp->status;
1883 
1884 	sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_ACCEPT_LIST);
1885 	if (!sent)
1886 		return rp->status;
1887 
1888 	hci_dev_lock(hdev);
1889 	hci_bdaddr_list_add(&hdev->le_accept_list, &sent->bdaddr,
1890 			    sent->bdaddr_type);
1891 	hci_dev_unlock(hdev);
1892 
1893 	return rp->status;
1894 }
1895 
hci_cc_le_del_from_accept_list(struct hci_dev * hdev,void * data,struct sk_buff * skb)1896 static u8 hci_cc_le_del_from_accept_list(struct hci_dev *hdev, void *data,
1897 					 struct sk_buff *skb)
1898 {
1899 	struct hci_cp_le_del_from_accept_list *sent;
1900 	struct hci_ev_status *rp = data;
1901 
1902 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1903 
1904 	if (rp->status)
1905 		return rp->status;
1906 
1907 	sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_ACCEPT_LIST);
1908 	if (!sent)
1909 		return rp->status;
1910 
1911 	hci_dev_lock(hdev);
1912 	hci_bdaddr_list_del(&hdev->le_accept_list, &sent->bdaddr,
1913 			    sent->bdaddr_type);
1914 	hci_dev_unlock(hdev);
1915 
1916 	return rp->status;
1917 }
1918 
hci_cc_le_read_supported_states(struct hci_dev * hdev,void * data,struct sk_buff * skb)1919 static u8 hci_cc_le_read_supported_states(struct hci_dev *hdev, void *data,
1920 					  struct sk_buff *skb)
1921 {
1922 	struct hci_rp_le_read_supported_states *rp = data;
1923 
1924 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1925 
1926 	if (rp->status)
1927 		return rp->status;
1928 
1929 	memcpy(hdev->le_states, rp->le_states, 8);
1930 
1931 	return rp->status;
1932 }
1933 
hci_cc_le_read_def_data_len(struct hci_dev * hdev,void * data,struct sk_buff * skb)1934 static u8 hci_cc_le_read_def_data_len(struct hci_dev *hdev, void *data,
1935 				      struct sk_buff *skb)
1936 {
1937 	struct hci_rp_le_read_def_data_len *rp = data;
1938 
1939 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1940 
1941 	if (rp->status)
1942 		return rp->status;
1943 
1944 	hdev->le_def_tx_len = le16_to_cpu(rp->tx_len);
1945 	hdev->le_def_tx_time = le16_to_cpu(rp->tx_time);
1946 
1947 	return rp->status;
1948 }
1949 
hci_cc_le_write_def_data_len(struct hci_dev * hdev,void * data,struct sk_buff * skb)1950 static u8 hci_cc_le_write_def_data_len(struct hci_dev *hdev, void *data,
1951 				       struct sk_buff *skb)
1952 {
1953 	struct hci_cp_le_write_def_data_len *sent;
1954 	struct hci_ev_status *rp = data;
1955 
1956 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1957 
1958 	if (rp->status)
1959 		return rp->status;
1960 
1961 	sent = hci_sent_cmd_data(hdev, HCI_OP_LE_WRITE_DEF_DATA_LEN);
1962 	if (!sent)
1963 		return rp->status;
1964 
1965 	hdev->le_def_tx_len = le16_to_cpu(sent->tx_len);
1966 	hdev->le_def_tx_time = le16_to_cpu(sent->tx_time);
1967 
1968 	return rp->status;
1969 }
1970 
hci_cc_le_add_to_resolv_list(struct hci_dev * hdev,void * data,struct sk_buff * skb)1971 static u8 hci_cc_le_add_to_resolv_list(struct hci_dev *hdev, void *data,
1972 				       struct sk_buff *skb)
1973 {
1974 	struct hci_cp_le_add_to_resolv_list *sent;
1975 	struct hci_ev_status *rp = data;
1976 
1977 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1978 
1979 	if (rp->status)
1980 		return rp->status;
1981 
1982 	sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_RESOLV_LIST);
1983 	if (!sent)
1984 		return rp->status;
1985 
1986 	hci_dev_lock(hdev);
1987 	hci_bdaddr_list_add_with_irk(&hdev->le_resolv_list, &sent->bdaddr,
1988 				sent->bdaddr_type, sent->peer_irk,
1989 				sent->local_irk);
1990 	hci_dev_unlock(hdev);
1991 
1992 	return rp->status;
1993 }
1994 
hci_cc_le_del_from_resolv_list(struct hci_dev * hdev,void * data,struct sk_buff * skb)1995 static u8 hci_cc_le_del_from_resolv_list(struct hci_dev *hdev, void *data,
1996 					 struct sk_buff *skb)
1997 {
1998 	struct hci_cp_le_del_from_resolv_list *sent;
1999 	struct hci_ev_status *rp = data;
2000 
2001 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2002 
2003 	if (rp->status)
2004 		return rp->status;
2005 
2006 	sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_RESOLV_LIST);
2007 	if (!sent)
2008 		return rp->status;
2009 
2010 	hci_dev_lock(hdev);
2011 	hci_bdaddr_list_del_with_irk(&hdev->le_resolv_list, &sent->bdaddr,
2012 			    sent->bdaddr_type);
2013 	hci_dev_unlock(hdev);
2014 
2015 	return rp->status;
2016 }
2017 
hci_cc_le_clear_resolv_list(struct hci_dev * hdev,void * data,struct sk_buff * skb)2018 static u8 hci_cc_le_clear_resolv_list(struct hci_dev *hdev, void *data,
2019 				      struct sk_buff *skb)
2020 {
2021 	struct hci_ev_status *rp = data;
2022 
2023 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2024 
2025 	if (rp->status)
2026 		return rp->status;
2027 
2028 	hci_dev_lock(hdev);
2029 	hci_bdaddr_list_clear(&hdev->le_resolv_list);
2030 	hci_dev_unlock(hdev);
2031 
2032 	return rp->status;
2033 }
2034 
hci_cc_le_read_resolv_list_size(struct hci_dev * hdev,void * data,struct sk_buff * skb)2035 static u8 hci_cc_le_read_resolv_list_size(struct hci_dev *hdev, void *data,
2036 					  struct sk_buff *skb)
2037 {
2038 	struct hci_rp_le_read_resolv_list_size *rp = data;
2039 
2040 	bt_dev_dbg(hdev, "status 0x%2.2x size %u", rp->status, rp->size);
2041 
2042 	if (rp->status)
2043 		return rp->status;
2044 
2045 	hdev->le_resolv_list_size = rp->size;
2046 
2047 	return rp->status;
2048 }
2049 
hci_cc_le_set_addr_resolution_enable(struct hci_dev * hdev,void * data,struct sk_buff * skb)2050 static u8 hci_cc_le_set_addr_resolution_enable(struct hci_dev *hdev, void *data,
2051 					       struct sk_buff *skb)
2052 {
2053 	struct hci_ev_status *rp = data;
2054 	__u8 *sent;
2055 
2056 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2057 
2058 	if (rp->status)
2059 		return rp->status;
2060 
2061 	sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADDR_RESOLV_ENABLE);
2062 	if (!sent)
2063 		return rp->status;
2064 
2065 	hci_dev_lock(hdev);
2066 
2067 	if (*sent)
2068 		hci_dev_set_flag(hdev, HCI_LL_RPA_RESOLUTION);
2069 	else
2070 		hci_dev_clear_flag(hdev, HCI_LL_RPA_RESOLUTION);
2071 
2072 	hci_dev_unlock(hdev);
2073 
2074 	return rp->status;
2075 }
2076 
hci_cc_le_read_max_data_len(struct hci_dev * hdev,void * data,struct sk_buff * skb)2077 static u8 hci_cc_le_read_max_data_len(struct hci_dev *hdev, void *data,
2078 				      struct sk_buff *skb)
2079 {
2080 	struct hci_rp_le_read_max_data_len *rp = data;
2081 
2082 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2083 
2084 	if (rp->status)
2085 		return rp->status;
2086 
2087 	hdev->le_max_tx_len = le16_to_cpu(rp->tx_len);
2088 	hdev->le_max_tx_time = le16_to_cpu(rp->tx_time);
2089 	hdev->le_max_rx_len = le16_to_cpu(rp->rx_len);
2090 	hdev->le_max_rx_time = le16_to_cpu(rp->rx_time);
2091 
2092 	return rp->status;
2093 }
2094 
hci_cc_write_le_host_supported(struct hci_dev * hdev,void * data,struct sk_buff * skb)2095 static u8 hci_cc_write_le_host_supported(struct hci_dev *hdev, void *data,
2096 					 struct sk_buff *skb)
2097 {
2098 	struct hci_cp_write_le_host_supported *sent;
2099 	struct hci_ev_status *rp = data;
2100 
2101 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2102 
2103 	if (rp->status)
2104 		return rp->status;
2105 
2106 	sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
2107 	if (!sent)
2108 		return rp->status;
2109 
2110 	hci_dev_lock(hdev);
2111 
2112 	if (sent->le) {
2113 		hdev->features[1][0] |= LMP_HOST_LE;
2114 		hci_dev_set_flag(hdev, HCI_LE_ENABLED);
2115 	} else {
2116 		hdev->features[1][0] &= ~LMP_HOST_LE;
2117 		hci_dev_clear_flag(hdev, HCI_LE_ENABLED);
2118 		hci_dev_clear_flag(hdev, HCI_ADVERTISING);
2119 	}
2120 
2121 	if (sent->simul)
2122 		hdev->features[1][0] |= LMP_HOST_LE_BREDR;
2123 	else
2124 		hdev->features[1][0] &= ~LMP_HOST_LE_BREDR;
2125 
2126 	hci_dev_unlock(hdev);
2127 
2128 	return rp->status;
2129 }
2130 
hci_cc_set_adv_param(struct hci_dev * hdev,void * data,struct sk_buff * skb)2131 static u8 hci_cc_set_adv_param(struct hci_dev *hdev, void *data,
2132 			       struct sk_buff *skb)
2133 {
2134 	struct hci_cp_le_set_adv_param *cp;
2135 	struct hci_ev_status *rp = data;
2136 
2137 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2138 
2139 	if (rp->status)
2140 		return rp->status;
2141 
2142 	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_PARAM);
2143 	if (!cp)
2144 		return rp->status;
2145 
2146 	hci_dev_lock(hdev);
2147 	hdev->adv_addr_type = cp->own_address_type;
2148 	hci_dev_unlock(hdev);
2149 
2150 	return rp->status;
2151 }
2152 
hci_cc_set_ext_adv_param(struct hci_dev * hdev,void * data,struct sk_buff * skb)2153 static u8 hci_cc_set_ext_adv_param(struct hci_dev *hdev, void *data,
2154 				   struct sk_buff *skb)
2155 {
2156 	struct hci_rp_le_set_ext_adv_params *rp = data;
2157 	struct hci_cp_le_set_ext_adv_params *cp;
2158 	struct adv_info *adv_instance;
2159 
2160 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2161 
2162 	if (rp->status)
2163 		return rp->status;
2164 
2165 	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_PARAMS);
2166 	if (!cp)
2167 		return rp->status;
2168 
2169 	hci_dev_lock(hdev);
2170 	hdev->adv_addr_type = cp->own_addr_type;
2171 	if (!cp->handle) {
2172 		/* Store in hdev for instance 0 */
2173 		hdev->adv_tx_power = rp->tx_power;
2174 	} else {
2175 		adv_instance = hci_find_adv_instance(hdev, cp->handle);
2176 		if (adv_instance)
2177 			adv_instance->tx_power = rp->tx_power;
2178 	}
2179 	/* Update adv data as tx power is known now */
2180 	hci_update_adv_data(hdev, cp->handle);
2181 
2182 	hci_dev_unlock(hdev);
2183 
2184 	return rp->status;
2185 }
2186 
hci_cc_read_rssi(struct hci_dev * hdev,void * data,struct sk_buff * skb)2187 static u8 hci_cc_read_rssi(struct hci_dev *hdev, void *data,
2188 			   struct sk_buff *skb)
2189 {
2190 	struct hci_rp_read_rssi *rp = data;
2191 	struct hci_conn *conn;
2192 
2193 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2194 
2195 	if (rp->status)
2196 		return rp->status;
2197 
2198 	hci_dev_lock(hdev);
2199 
2200 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
2201 	if (conn)
2202 		conn->rssi = rp->rssi;
2203 
2204 	hci_dev_unlock(hdev);
2205 
2206 	return rp->status;
2207 }
2208 
hci_cc_read_tx_power(struct hci_dev * hdev,void * data,struct sk_buff * skb)2209 static u8 hci_cc_read_tx_power(struct hci_dev *hdev, void *data,
2210 			       struct sk_buff *skb)
2211 {
2212 	struct hci_cp_read_tx_power *sent;
2213 	struct hci_rp_read_tx_power *rp = data;
2214 	struct hci_conn *conn;
2215 
2216 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2217 
2218 	if (rp->status)
2219 		return rp->status;
2220 
2221 	sent = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
2222 	if (!sent)
2223 		return rp->status;
2224 
2225 	hci_dev_lock(hdev);
2226 
2227 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
2228 	if (!conn)
2229 		goto unlock;
2230 
2231 	switch (sent->type) {
2232 	case 0x00:
2233 		conn->tx_power = rp->tx_power;
2234 		break;
2235 	case 0x01:
2236 		conn->max_tx_power = rp->tx_power;
2237 		break;
2238 	}
2239 
2240 unlock:
2241 	hci_dev_unlock(hdev);
2242 	return rp->status;
2243 }
2244 
hci_cc_write_ssp_debug_mode(struct hci_dev * hdev,void * data,struct sk_buff * skb)2245 static u8 hci_cc_write_ssp_debug_mode(struct hci_dev *hdev, void *data,
2246 				      struct sk_buff *skb)
2247 {
2248 	struct hci_ev_status *rp = data;
2249 	u8 *mode;
2250 
2251 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2252 
2253 	if (rp->status)
2254 		return rp->status;
2255 
2256 	mode = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE);
2257 	if (mode)
2258 		hdev->ssp_debug_mode = *mode;
2259 
2260 	return rp->status;
2261 }
2262 
hci_cs_inquiry(struct hci_dev * hdev,__u8 status)2263 static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
2264 {
2265 	bt_dev_dbg(hdev, "status 0x%2.2x", status);
2266 
2267 	if (status)
2268 		return;
2269 
2270 	if (hci_sent_cmd_data(hdev, HCI_OP_INQUIRY))
2271 		set_bit(HCI_INQUIRY, &hdev->flags);
2272 }
2273 
hci_cs_create_conn(struct hci_dev * hdev,__u8 status)2274 static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
2275 {
2276 	struct hci_cp_create_conn *cp;
2277 	struct hci_conn *conn;
2278 
2279 	bt_dev_dbg(hdev, "status 0x%2.2x", status);
2280 
2281 	cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
2282 	if (!cp)
2283 		return;
2284 
2285 	hci_dev_lock(hdev);
2286 
2287 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2288 
2289 	bt_dev_dbg(hdev, "bdaddr %pMR hcon %p", &cp->bdaddr, conn);
2290 
2291 	if (status) {
2292 		if (conn && conn->state == BT_CONNECT) {
2293 			conn->state = BT_CLOSED;
2294 			hci_connect_cfm(conn, status);
2295 			hci_conn_del(conn);
2296 		}
2297 	} else {
2298 		if (!conn) {
2299 			conn = hci_conn_add_unset(hdev, ACL_LINK, &cp->bdaddr,
2300 						  HCI_ROLE_MASTER);
2301 			if (IS_ERR(conn))
2302 				bt_dev_err(hdev, "connection err: %ld", PTR_ERR(conn));
2303 		}
2304 	}
2305 
2306 	hci_dev_unlock(hdev);
2307 }
2308 
hci_cs_add_sco(struct hci_dev * hdev,__u8 status)2309 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
2310 {
2311 	struct hci_cp_add_sco *cp;
2312 	struct hci_conn *acl;
2313 	struct hci_link *link;
2314 	__u16 handle;
2315 
2316 	bt_dev_dbg(hdev, "status 0x%2.2x", status);
2317 
2318 	if (!status)
2319 		return;
2320 
2321 	cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
2322 	if (!cp)
2323 		return;
2324 
2325 	handle = __le16_to_cpu(cp->handle);
2326 
2327 	bt_dev_dbg(hdev, "handle 0x%4.4x", handle);
2328 
2329 	hci_dev_lock(hdev);
2330 
2331 	acl = hci_conn_hash_lookup_handle(hdev, handle);
2332 	if (acl) {
2333 		link = list_first_entry_or_null(&acl->link_list,
2334 						struct hci_link, list);
2335 		if (link && link->conn) {
2336 			link->conn->state = BT_CLOSED;
2337 
2338 			hci_connect_cfm(link->conn, status);
2339 			hci_conn_del(link->conn);
2340 		}
2341 	}
2342 
2343 	hci_dev_unlock(hdev);
2344 }
2345 
hci_cs_auth_requested(struct hci_dev * hdev,__u8 status)2346 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
2347 {
2348 	struct hci_cp_auth_requested *cp;
2349 	struct hci_conn *conn;
2350 
2351 	bt_dev_dbg(hdev, "status 0x%2.2x", status);
2352 
2353 	if (!status)
2354 		return;
2355 
2356 	cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
2357 	if (!cp)
2358 		return;
2359 
2360 	hci_dev_lock(hdev);
2361 
2362 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2363 	if (conn) {
2364 		if (conn->state == BT_CONFIG) {
2365 			hci_connect_cfm(conn, status);
2366 			hci_conn_drop(conn);
2367 		}
2368 	}
2369 
2370 	hci_dev_unlock(hdev);
2371 }
2372 
hci_cs_set_conn_encrypt(struct hci_dev * hdev,__u8 status)2373 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
2374 {
2375 	struct hci_cp_set_conn_encrypt *cp;
2376 	struct hci_conn *conn;
2377 
2378 	bt_dev_dbg(hdev, "status 0x%2.2x", status);
2379 
2380 	if (!status)
2381 		return;
2382 
2383 	cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
2384 	if (!cp)
2385 		return;
2386 
2387 	hci_dev_lock(hdev);
2388 
2389 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2390 	if (conn) {
2391 		if (conn->state == BT_CONFIG) {
2392 			hci_connect_cfm(conn, status);
2393 			hci_conn_drop(conn);
2394 		}
2395 	}
2396 
2397 	hci_dev_unlock(hdev);
2398 }
2399 
hci_outgoing_auth_needed(struct hci_dev * hdev,struct hci_conn * conn)2400 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
2401 				    struct hci_conn *conn)
2402 {
2403 	if (conn->state != BT_CONFIG || !conn->out)
2404 		return 0;
2405 
2406 	if (conn->pending_sec_level == BT_SECURITY_SDP)
2407 		return 0;
2408 
2409 	/* Only request authentication for SSP connections or non-SSP
2410 	 * devices with sec_level MEDIUM or HIGH or if MITM protection
2411 	 * is requested.
2412 	 */
2413 	if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
2414 	    conn->pending_sec_level != BT_SECURITY_FIPS &&
2415 	    conn->pending_sec_level != BT_SECURITY_HIGH &&
2416 	    conn->pending_sec_level != BT_SECURITY_MEDIUM)
2417 		return 0;
2418 
2419 	return 1;
2420 }
2421 
hci_resolve_name(struct hci_dev * hdev,struct inquiry_entry * e)2422 static int hci_resolve_name(struct hci_dev *hdev,
2423 				   struct inquiry_entry *e)
2424 {
2425 	struct hci_cp_remote_name_req cp;
2426 
2427 	memset(&cp, 0, sizeof(cp));
2428 
2429 	bacpy(&cp.bdaddr, &e->data.bdaddr);
2430 	cp.pscan_rep_mode = e->data.pscan_rep_mode;
2431 	cp.pscan_mode = e->data.pscan_mode;
2432 	cp.clock_offset = e->data.clock_offset;
2433 
2434 	return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2435 }
2436 
hci_resolve_next_name(struct hci_dev * hdev)2437 static bool hci_resolve_next_name(struct hci_dev *hdev)
2438 {
2439 	struct discovery_state *discov = &hdev->discovery;
2440 	struct inquiry_entry *e;
2441 
2442 	if (list_empty(&discov->resolve))
2443 		return false;
2444 
2445 	/* We should stop if we already spent too much time resolving names. */
2446 	if (time_after(jiffies, discov->name_resolve_timeout)) {
2447 		bt_dev_warn_ratelimited(hdev, "Name resolve takes too long.");
2448 		return false;
2449 	}
2450 
2451 	e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
2452 	if (!e)
2453 		return false;
2454 
2455 	if (hci_resolve_name(hdev, e) == 0) {
2456 		e->name_state = NAME_PENDING;
2457 		return true;
2458 	}
2459 
2460 	return false;
2461 }
2462 
hci_check_pending_name(struct hci_dev * hdev,struct hci_conn * conn,bdaddr_t * bdaddr,u8 * name,u8 name_len)2463 static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
2464 				   bdaddr_t *bdaddr, u8 *name, u8 name_len)
2465 {
2466 	struct discovery_state *discov = &hdev->discovery;
2467 	struct inquiry_entry *e;
2468 
2469 	/* Update the mgmt connected state if necessary. Be careful with
2470 	 * conn objects that exist but are not (yet) connected however.
2471 	 * Only those in BT_CONFIG or BT_CONNECTED states can be
2472 	 * considered connected.
2473 	 */
2474 	if (conn && (conn->state == BT_CONFIG || conn->state == BT_CONNECTED))
2475 		mgmt_device_connected(hdev, conn, name, name_len);
2476 
2477 	if (discov->state == DISCOVERY_STOPPED)
2478 		return;
2479 
2480 	if (discov->state == DISCOVERY_STOPPING)
2481 		goto discov_complete;
2482 
2483 	if (discov->state != DISCOVERY_RESOLVING)
2484 		return;
2485 
2486 	e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
2487 	/* If the device was not found in a list of found devices names of which
2488 	 * are pending. there is no need to continue resolving a next name as it
2489 	 * will be done upon receiving another Remote Name Request Complete
2490 	 * Event */
2491 	if (!e)
2492 		return;
2493 
2494 	list_del(&e->list);
2495 
2496 	e->name_state = name ? NAME_KNOWN : NAME_NOT_KNOWN;
2497 	mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00, e->data.rssi,
2498 			 name, name_len);
2499 
2500 	if (hci_resolve_next_name(hdev))
2501 		return;
2502 
2503 discov_complete:
2504 	hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2505 }
2506 
hci_cs_remote_name_req(struct hci_dev * hdev,__u8 status)2507 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
2508 {
2509 	struct hci_cp_remote_name_req *cp;
2510 	struct hci_conn *conn;
2511 
2512 	bt_dev_dbg(hdev, "status 0x%2.2x", status);
2513 
2514 	/* If successful wait for the name req complete event before
2515 	 * checking for the need to do authentication */
2516 	if (!status)
2517 		return;
2518 
2519 	cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
2520 	if (!cp)
2521 		return;
2522 
2523 	hci_dev_lock(hdev);
2524 
2525 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2526 
2527 	if (hci_dev_test_flag(hdev, HCI_MGMT))
2528 		hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
2529 
2530 	if (!conn)
2531 		goto unlock;
2532 
2533 	if (!hci_outgoing_auth_needed(hdev, conn))
2534 		goto unlock;
2535 
2536 	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
2537 		struct hci_cp_auth_requested auth_cp;
2538 
2539 		set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
2540 
2541 		auth_cp.handle = __cpu_to_le16(conn->handle);
2542 		hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
2543 			     sizeof(auth_cp), &auth_cp);
2544 	}
2545 
2546 unlock:
2547 	hci_dev_unlock(hdev);
2548 }
2549 
hci_cs_read_remote_features(struct hci_dev * hdev,__u8 status)2550 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
2551 {
2552 	struct hci_cp_read_remote_features *cp;
2553 	struct hci_conn *conn;
2554 
2555 	bt_dev_dbg(hdev, "status 0x%2.2x", status);
2556 
2557 	if (!status)
2558 		return;
2559 
2560 	cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
2561 	if (!cp)
2562 		return;
2563 
2564 	hci_dev_lock(hdev);
2565 
2566 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2567 	if (conn) {
2568 		if (conn->state == BT_CONFIG) {
2569 			hci_connect_cfm(conn, status);
2570 			hci_conn_drop(conn);
2571 		}
2572 	}
2573 
2574 	hci_dev_unlock(hdev);
2575 }
2576 
hci_cs_read_remote_ext_features(struct hci_dev * hdev,__u8 status)2577 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
2578 {
2579 	struct hci_cp_read_remote_ext_features *cp;
2580 	struct hci_conn *conn;
2581 
2582 	bt_dev_dbg(hdev, "status 0x%2.2x", status);
2583 
2584 	if (!status)
2585 		return;
2586 
2587 	cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
2588 	if (!cp)
2589 		return;
2590 
2591 	hci_dev_lock(hdev);
2592 
2593 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2594 	if (conn) {
2595 		if (conn->state == BT_CONFIG) {
2596 			hci_connect_cfm(conn, status);
2597 			hci_conn_drop(conn);
2598 		}
2599 	}
2600 
2601 	hci_dev_unlock(hdev);
2602 }
2603 
hci_setup_sync_conn_status(struct hci_dev * hdev,__u16 handle,__u8 status)2604 static void hci_setup_sync_conn_status(struct hci_dev *hdev, __u16 handle,
2605 				       __u8 status)
2606 {
2607 	struct hci_conn *acl;
2608 	struct hci_link *link;
2609 
2610 	bt_dev_dbg(hdev, "handle 0x%4.4x status 0x%2.2x", handle, status);
2611 
2612 	hci_dev_lock(hdev);
2613 
2614 	acl = hci_conn_hash_lookup_handle(hdev, handle);
2615 	if (acl) {
2616 		link = list_first_entry_or_null(&acl->link_list,
2617 						struct hci_link, list);
2618 		if (link && link->conn) {
2619 			link->conn->state = BT_CLOSED;
2620 
2621 			hci_connect_cfm(link->conn, status);
2622 			hci_conn_del(link->conn);
2623 		}
2624 	}
2625 
2626 	hci_dev_unlock(hdev);
2627 }
2628 
hci_cs_setup_sync_conn(struct hci_dev * hdev,__u8 status)2629 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
2630 {
2631 	struct hci_cp_setup_sync_conn *cp;
2632 
2633 	bt_dev_dbg(hdev, "status 0x%2.2x", status);
2634 
2635 	if (!status)
2636 		return;
2637 
2638 	cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
2639 	if (!cp)
2640 		return;
2641 
2642 	hci_setup_sync_conn_status(hdev, __le16_to_cpu(cp->handle), status);
2643 }
2644 
hci_cs_enhanced_setup_sync_conn(struct hci_dev * hdev,__u8 status)2645 static void hci_cs_enhanced_setup_sync_conn(struct hci_dev *hdev, __u8 status)
2646 {
2647 	struct hci_cp_enhanced_setup_sync_conn *cp;
2648 
2649 	bt_dev_dbg(hdev, "status 0x%2.2x", status);
2650 
2651 	if (!status)
2652 		return;
2653 
2654 	cp = hci_sent_cmd_data(hdev, HCI_OP_ENHANCED_SETUP_SYNC_CONN);
2655 	if (!cp)
2656 		return;
2657 
2658 	hci_setup_sync_conn_status(hdev, __le16_to_cpu(cp->handle), status);
2659 }
2660 
hci_cs_sniff_mode(struct hci_dev * hdev,__u8 status)2661 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
2662 {
2663 	struct hci_cp_sniff_mode *cp;
2664 	struct hci_conn *conn;
2665 
2666 	bt_dev_dbg(hdev, "status 0x%2.2x", status);
2667 
2668 	if (!status)
2669 		return;
2670 
2671 	cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
2672 	if (!cp)
2673 		return;
2674 
2675 	hci_dev_lock(hdev);
2676 
2677 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2678 	if (conn) {
2679 		clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
2680 
2681 		if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2682 			hci_sco_setup(conn, status);
2683 	}
2684 
2685 	hci_dev_unlock(hdev);
2686 }
2687 
hci_cs_exit_sniff_mode(struct hci_dev * hdev,__u8 status)2688 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
2689 {
2690 	struct hci_cp_exit_sniff_mode *cp;
2691 	struct hci_conn *conn;
2692 
2693 	bt_dev_dbg(hdev, "status 0x%2.2x", status);
2694 
2695 	if (!status)
2696 		return;
2697 
2698 	cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
2699 	if (!cp)
2700 		return;
2701 
2702 	hci_dev_lock(hdev);
2703 
2704 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2705 	if (conn) {
2706 		clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
2707 
2708 		if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2709 			hci_sco_setup(conn, status);
2710 	}
2711 
2712 	hci_dev_unlock(hdev);
2713 }
2714 
hci_cs_disconnect(struct hci_dev * hdev,u8 status)2715 static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
2716 {
2717 	struct hci_cp_disconnect *cp;
2718 	struct hci_conn_params *params;
2719 	struct hci_conn *conn;
2720 	bool mgmt_conn;
2721 
2722 	bt_dev_dbg(hdev, "status 0x%2.2x", status);
2723 
2724 	/* Wait for HCI_EV_DISCONN_COMPLETE if status 0x00 and not suspended
2725 	 * otherwise cleanup the connection immediately.
2726 	 */
2727 	if (!status && !hdev->suspended)
2728 		return;
2729 
2730 	cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
2731 	if (!cp)
2732 		return;
2733 
2734 	hci_dev_lock(hdev);
2735 
2736 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2737 	if (!conn)
2738 		goto unlock;
2739 
2740 	if (status) {
2741 		mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2742 				       conn->dst_type, status);
2743 
2744 		if (conn->type == LE_LINK && conn->role == HCI_ROLE_SLAVE) {
2745 			hdev->cur_adv_instance = conn->adv_instance;
2746 			hci_enable_advertising(hdev);
2747 		}
2748 
2749 		/* Inform sockets conn is gone before we delete it */
2750 		hci_disconn_cfm(conn, HCI_ERROR_UNSPECIFIED);
2751 
2752 		goto done;
2753 	}
2754 
2755 	mgmt_conn = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags);
2756 
2757 	if (conn->type == ACL_LINK) {
2758 		if (test_and_clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
2759 			hci_remove_link_key(hdev, &conn->dst);
2760 	}
2761 
2762 	params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
2763 	if (params) {
2764 		switch (params->auto_connect) {
2765 		case HCI_AUTO_CONN_LINK_LOSS:
2766 			if (cp->reason != HCI_ERROR_CONNECTION_TIMEOUT)
2767 				break;
2768 			fallthrough;
2769 
2770 		case HCI_AUTO_CONN_DIRECT:
2771 		case HCI_AUTO_CONN_ALWAYS:
2772 			hci_pend_le_list_del_init(params);
2773 			hci_pend_le_list_add(params, &hdev->pend_le_conns);
2774 			break;
2775 
2776 		default:
2777 			break;
2778 		}
2779 	}
2780 
2781 	mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type,
2782 				 cp->reason, mgmt_conn);
2783 
2784 	hci_disconn_cfm(conn, cp->reason);
2785 
2786 done:
2787 	/* If the disconnection failed for any reason, the upper layer
2788 	 * does not retry to disconnect in current implementation.
2789 	 * Hence, we need to do some basic cleanup here and re-enable
2790 	 * advertising if necessary.
2791 	 */
2792 	hci_conn_del(conn);
2793 unlock:
2794 	hci_dev_unlock(hdev);
2795 }
2796 
ev_bdaddr_type(struct hci_dev * hdev,u8 type,bool * resolved)2797 static u8 ev_bdaddr_type(struct hci_dev *hdev, u8 type, bool *resolved)
2798 {
2799 	/* When using controller based address resolution, then the new
2800 	 * address types 0x02 and 0x03 are used. These types need to be
2801 	 * converted back into either public address or random address type
2802 	 */
2803 	switch (type) {
2804 	case ADDR_LE_DEV_PUBLIC_RESOLVED:
2805 		if (resolved)
2806 			*resolved = true;
2807 		return ADDR_LE_DEV_PUBLIC;
2808 	case ADDR_LE_DEV_RANDOM_RESOLVED:
2809 		if (resolved)
2810 			*resolved = true;
2811 		return ADDR_LE_DEV_RANDOM;
2812 	}
2813 
2814 	if (resolved)
2815 		*resolved = false;
2816 	return type;
2817 }
2818 
cs_le_create_conn(struct hci_dev * hdev,bdaddr_t * peer_addr,u8 peer_addr_type,u8 own_address_type,u8 filter_policy)2819 static void cs_le_create_conn(struct hci_dev *hdev, bdaddr_t *peer_addr,
2820 			      u8 peer_addr_type, u8 own_address_type,
2821 			      u8 filter_policy)
2822 {
2823 	struct hci_conn *conn;
2824 
2825 	conn = hci_conn_hash_lookup_le(hdev, peer_addr,
2826 				       peer_addr_type);
2827 	if (!conn)
2828 		return;
2829 
2830 	own_address_type = ev_bdaddr_type(hdev, own_address_type, NULL);
2831 
2832 	/* Store the initiator and responder address information which
2833 	 * is needed for SMP. These values will not change during the
2834 	 * lifetime of the connection.
2835 	 */
2836 	conn->init_addr_type = own_address_type;
2837 	if (own_address_type == ADDR_LE_DEV_RANDOM)
2838 		bacpy(&conn->init_addr, &hdev->random_addr);
2839 	else
2840 		bacpy(&conn->init_addr, &hdev->bdaddr);
2841 
2842 	conn->resp_addr_type = peer_addr_type;
2843 	bacpy(&conn->resp_addr, peer_addr);
2844 }
2845 
hci_cs_le_create_conn(struct hci_dev * hdev,u8 status)2846 static void hci_cs_le_create_conn(struct hci_dev *hdev, u8 status)
2847 {
2848 	struct hci_cp_le_create_conn *cp;
2849 
2850 	bt_dev_dbg(hdev, "status 0x%2.2x", status);
2851 
2852 	/* All connection failure handling is taken care of by the
2853 	 * hci_conn_failed function which is triggered by the HCI
2854 	 * request completion callbacks used for connecting.
2855 	 */
2856 	if (status)
2857 		return;
2858 
2859 	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
2860 	if (!cp)
2861 		return;
2862 
2863 	hci_dev_lock(hdev);
2864 
2865 	cs_le_create_conn(hdev, &cp->peer_addr, cp->peer_addr_type,
2866 			  cp->own_address_type, cp->filter_policy);
2867 
2868 	hci_dev_unlock(hdev);
2869 }
2870 
hci_cs_le_ext_create_conn(struct hci_dev * hdev,u8 status)2871 static void hci_cs_le_ext_create_conn(struct hci_dev *hdev, u8 status)
2872 {
2873 	struct hci_cp_le_ext_create_conn *cp;
2874 
2875 	bt_dev_dbg(hdev, "status 0x%2.2x", status);
2876 
2877 	/* All connection failure handling is taken care of by the
2878 	 * hci_conn_failed function which is triggered by the HCI
2879 	 * request completion callbacks used for connecting.
2880 	 */
2881 	if (status)
2882 		return;
2883 
2884 	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_EXT_CREATE_CONN);
2885 	if (!cp)
2886 		return;
2887 
2888 	hci_dev_lock(hdev);
2889 
2890 	cs_le_create_conn(hdev, &cp->peer_addr, cp->peer_addr_type,
2891 			  cp->own_addr_type, cp->filter_policy);
2892 
2893 	hci_dev_unlock(hdev);
2894 }
2895 
hci_cs_le_read_remote_features(struct hci_dev * hdev,u8 status)2896 static void hci_cs_le_read_remote_features(struct hci_dev *hdev, u8 status)
2897 {
2898 	struct hci_cp_le_read_remote_features *cp;
2899 	struct hci_conn *conn;
2900 
2901 	bt_dev_dbg(hdev, "status 0x%2.2x", status);
2902 
2903 	if (!status)
2904 		return;
2905 
2906 	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_READ_REMOTE_FEATURES);
2907 	if (!cp)
2908 		return;
2909 
2910 	hci_dev_lock(hdev);
2911 
2912 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2913 	if (conn) {
2914 		if (conn->state == BT_CONFIG) {
2915 			hci_connect_cfm(conn, status);
2916 			hci_conn_drop(conn);
2917 		}
2918 	}
2919 
2920 	hci_dev_unlock(hdev);
2921 }
2922 
hci_cs_le_start_enc(struct hci_dev * hdev,u8 status)2923 static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
2924 {
2925 	struct hci_cp_le_start_enc *cp;
2926 	struct hci_conn *conn;
2927 
2928 	bt_dev_dbg(hdev, "status 0x%2.2x", status);
2929 
2930 	if (!status)
2931 		return;
2932 
2933 	hci_dev_lock(hdev);
2934 
2935 	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_START_ENC);
2936 	if (!cp)
2937 		goto unlock;
2938 
2939 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2940 	if (!conn)
2941 		goto unlock;
2942 
2943 	if (conn->state != BT_CONNECTED)
2944 		goto unlock;
2945 
2946 	hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2947 	hci_conn_drop(conn);
2948 
2949 unlock:
2950 	hci_dev_unlock(hdev);
2951 }
2952 
hci_cs_switch_role(struct hci_dev * hdev,u8 status)2953 static void hci_cs_switch_role(struct hci_dev *hdev, u8 status)
2954 {
2955 	struct hci_cp_switch_role *cp;
2956 	struct hci_conn *conn;
2957 
2958 	BT_DBG("%s status 0x%2.2x", hdev->name, status);
2959 
2960 	if (!status)
2961 		return;
2962 
2963 	cp = hci_sent_cmd_data(hdev, HCI_OP_SWITCH_ROLE);
2964 	if (!cp)
2965 		return;
2966 
2967 	hci_dev_lock(hdev);
2968 
2969 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2970 	if (conn)
2971 		clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
2972 
2973 	hci_dev_unlock(hdev);
2974 }
2975 
hci_inquiry_complete_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)2976 static void hci_inquiry_complete_evt(struct hci_dev *hdev, void *data,
2977 				     struct sk_buff *skb)
2978 {
2979 	struct hci_ev_status *ev = data;
2980 	struct discovery_state *discov = &hdev->discovery;
2981 	struct inquiry_entry *e;
2982 
2983 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
2984 
2985 	if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
2986 		return;
2987 
2988 	smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
2989 	wake_up_bit(&hdev->flags, HCI_INQUIRY);
2990 
2991 	if (!hci_dev_test_flag(hdev, HCI_MGMT))
2992 		return;
2993 
2994 	hci_dev_lock(hdev);
2995 
2996 	if (discov->state != DISCOVERY_FINDING)
2997 		goto unlock;
2998 
2999 	if (list_empty(&discov->resolve)) {
3000 		/* When BR/EDR inquiry is active and no LE scanning is in
3001 		 * progress, then change discovery state to indicate completion.
3002 		 *
3003 		 * When running LE scanning and BR/EDR inquiry simultaneously
3004 		 * and the LE scan already finished, then change the discovery
3005 		 * state to indicate completion.
3006 		 */
3007 		if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
3008 		    !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
3009 			hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3010 		goto unlock;
3011 	}
3012 
3013 	e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
3014 	if (e && hci_resolve_name(hdev, e) == 0) {
3015 		e->name_state = NAME_PENDING;
3016 		hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
3017 		discov->name_resolve_timeout = jiffies + NAME_RESOLVE_DURATION;
3018 	} else {
3019 		/* When BR/EDR inquiry is active and no LE scanning is in
3020 		 * progress, then change discovery state to indicate completion.
3021 		 *
3022 		 * When running LE scanning and BR/EDR inquiry simultaneously
3023 		 * and the LE scan already finished, then change the discovery
3024 		 * state to indicate completion.
3025 		 */
3026 		if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
3027 		    !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
3028 			hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3029 	}
3030 
3031 unlock:
3032 	hci_dev_unlock(hdev);
3033 }
3034 
hci_inquiry_result_evt(struct hci_dev * hdev,void * edata,struct sk_buff * skb)3035 static void hci_inquiry_result_evt(struct hci_dev *hdev, void *edata,
3036 				   struct sk_buff *skb)
3037 {
3038 	struct hci_ev_inquiry_result *ev = edata;
3039 	struct inquiry_data data;
3040 	int i;
3041 
3042 	if (!hci_ev_skb_pull(hdev, skb, HCI_EV_INQUIRY_RESULT,
3043 			     flex_array_size(ev, info, ev->num)))
3044 		return;
3045 
3046 	bt_dev_dbg(hdev, "num %d", ev->num);
3047 
3048 	if (!ev->num)
3049 		return;
3050 
3051 	if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
3052 		return;
3053 
3054 	hci_dev_lock(hdev);
3055 
3056 	for (i = 0; i < ev->num; i++) {
3057 		struct inquiry_info *info = &ev->info[i];
3058 		u32 flags;
3059 
3060 		bacpy(&data.bdaddr, &info->bdaddr);
3061 		data.pscan_rep_mode	= info->pscan_rep_mode;
3062 		data.pscan_period_mode	= info->pscan_period_mode;
3063 		data.pscan_mode		= info->pscan_mode;
3064 		memcpy(data.dev_class, info->dev_class, 3);
3065 		data.clock_offset	= info->clock_offset;
3066 		data.rssi		= HCI_RSSI_INVALID;
3067 		data.ssp_mode		= 0x00;
3068 
3069 		flags = hci_inquiry_cache_update(hdev, &data, false);
3070 
3071 		mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
3072 				  info->dev_class, HCI_RSSI_INVALID,
3073 				  flags, NULL, 0, NULL, 0, 0);
3074 	}
3075 
3076 	hci_dev_unlock(hdev);
3077 }
3078 
hci_read_enc_key_size(struct hci_dev * hdev,struct hci_conn * conn)3079 static int hci_read_enc_key_size(struct hci_dev *hdev, struct hci_conn *conn)
3080 {
3081 	struct hci_cp_read_enc_key_size cp;
3082 	u8 *key_enc_size = hci_conn_key_enc_size(conn);
3083 
3084 	if (!read_key_size_capable(hdev)) {
3085 		conn->enc_key_size = HCI_LINK_KEY_SIZE;
3086 		return -EOPNOTSUPP;
3087 	}
3088 
3089 	bt_dev_dbg(hdev, "hcon %p", conn);
3090 
3091 	memset(&cp, 0, sizeof(cp));
3092 	cp.handle = cpu_to_le16(conn->handle);
3093 
3094 	/* If the key enc_size is already known, use it as conn->enc_key_size,
3095 	 * otherwise use hdev->min_enc_key_size so the likes of
3096 	 * l2cap_check_enc_key_size don't fail while waiting for
3097 	 * HCI_OP_READ_ENC_KEY_SIZE response.
3098 	 */
3099 	if (key_enc_size && *key_enc_size)
3100 		conn->enc_key_size = *key_enc_size;
3101 	else
3102 		conn->enc_key_size = hdev->min_enc_key_size;
3103 
3104 	return hci_send_cmd(hdev, HCI_OP_READ_ENC_KEY_SIZE, sizeof(cp), &cp);
3105 }
3106 
hci_conn_complete_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)3107 static void hci_conn_complete_evt(struct hci_dev *hdev, void *data,
3108 				  struct sk_buff *skb)
3109 {
3110 	struct hci_ev_conn_complete *ev = data;
3111 	struct hci_conn *conn;
3112 	u8 status = ev->status;
3113 
3114 	bt_dev_dbg(hdev, "status 0x%2.2x", status);
3115 
3116 	hci_dev_lock(hdev);
3117 
3118 	conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
3119 	if (!conn) {
3120 		/* In case of error status and there is no connection pending
3121 		 * just unlock as there is nothing to cleanup.
3122 		 */
3123 		if (ev->status)
3124 			goto unlock;
3125 
3126 		/* Connection may not exist if auto-connected. Check the bredr
3127 		 * allowlist to see if this device is allowed to auto connect.
3128 		 * If link is an ACL type, create a connection class
3129 		 * automatically.
3130 		 *
3131 		 * Auto-connect will only occur if the event filter is
3132 		 * programmed with a given address. Right now, event filter is
3133 		 * only used during suspend.
3134 		 */
3135 		if (ev->link_type == ACL_LINK &&
3136 		    hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
3137 						      &ev->bdaddr,
3138 						      BDADDR_BREDR)) {
3139 			conn = hci_conn_add_unset(hdev, ev->link_type,
3140 						  &ev->bdaddr, HCI_ROLE_SLAVE);
3141 			if (IS_ERR(conn)) {
3142 				bt_dev_err(hdev, "connection err: %ld", PTR_ERR(conn));
3143 				goto unlock;
3144 			}
3145 		} else {
3146 			if (ev->link_type != SCO_LINK)
3147 				goto unlock;
3148 
3149 			conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK,
3150 						       &ev->bdaddr);
3151 			if (!conn)
3152 				goto unlock;
3153 
3154 			conn->type = SCO_LINK;
3155 		}
3156 	}
3157 
3158 	/* The HCI_Connection_Complete event is only sent once per connection.
3159 	 * Processing it more than once per connection can corrupt kernel memory.
3160 	 *
3161 	 * As the connection handle is set here for the first time, it indicates
3162 	 * whether the connection is already set up.
3163 	 */
3164 	if (!HCI_CONN_HANDLE_UNSET(conn->handle)) {
3165 		bt_dev_err(hdev, "Ignoring HCI_Connection_Complete for existing connection");
3166 		goto unlock;
3167 	}
3168 
3169 	if (!status) {
3170 		status = hci_conn_set_handle(conn, __le16_to_cpu(ev->handle));
3171 		if (status)
3172 			goto done;
3173 
3174 		if (conn->type == ACL_LINK) {
3175 			conn->state = BT_CONFIG;
3176 			hci_conn_hold(conn);
3177 
3178 			if (!conn->out && !hci_conn_ssp_enabled(conn) &&
3179 			    !hci_find_link_key(hdev, &ev->bdaddr))
3180 				conn->disc_timeout = HCI_PAIRING_TIMEOUT;
3181 			else
3182 				conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3183 		} else
3184 			conn->state = BT_CONNECTED;
3185 
3186 		hci_debugfs_create_conn(conn);
3187 		hci_conn_add_sysfs(conn);
3188 
3189 		if (test_bit(HCI_AUTH, &hdev->flags))
3190 			set_bit(HCI_CONN_AUTH, &conn->flags);
3191 
3192 		if (test_bit(HCI_ENCRYPT, &hdev->flags))
3193 			set_bit(HCI_CONN_ENCRYPT, &conn->flags);
3194 
3195 		/* "Link key request" completed ahead of "connect request" completes */
3196 		if (ev->encr_mode == 1 && !test_bit(HCI_CONN_ENCRYPT, &conn->flags) &&
3197 		    ev->link_type == ACL_LINK) {
3198 			struct link_key *key;
3199 
3200 			key = hci_find_link_key(hdev, &ev->bdaddr);
3201 			if (key) {
3202 				set_bit(HCI_CONN_ENCRYPT, &conn->flags);
3203 				hci_read_enc_key_size(hdev, conn);
3204 				hci_encrypt_cfm(conn, ev->status);
3205 			}
3206 		}
3207 
3208 		/* Get remote features */
3209 		if (conn->type == ACL_LINK) {
3210 			struct hci_cp_read_remote_features cp;
3211 			cp.handle = ev->handle;
3212 			hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
3213 				     sizeof(cp), &cp);
3214 
3215 			hci_update_scan(hdev);
3216 		}
3217 
3218 		/* Set packet type for incoming connection */
3219 		if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
3220 			struct hci_cp_change_conn_ptype cp;
3221 			cp.handle = ev->handle;
3222 			cp.pkt_type = cpu_to_le16(conn->pkt_type);
3223 			hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
3224 				     &cp);
3225 		}
3226 	}
3227 
3228 	if (conn->type == ACL_LINK)
3229 		hci_sco_setup(conn, ev->status);
3230 
3231 done:
3232 	if (status) {
3233 		hci_conn_failed(conn, status);
3234 	} else if (ev->link_type == SCO_LINK) {
3235 		switch (conn->setting & SCO_AIRMODE_MASK) {
3236 		case SCO_AIRMODE_CVSD:
3237 			if (hdev->notify)
3238 				hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_CVSD);
3239 			break;
3240 		}
3241 
3242 		hci_connect_cfm(conn, status);
3243 	}
3244 
3245 unlock:
3246 	hci_dev_unlock(hdev);
3247 }
3248 
hci_reject_conn(struct hci_dev * hdev,bdaddr_t * bdaddr)3249 static void hci_reject_conn(struct hci_dev *hdev, bdaddr_t *bdaddr)
3250 {
3251 	struct hci_cp_reject_conn_req cp;
3252 
3253 	bacpy(&cp.bdaddr, bdaddr);
3254 	cp.reason = HCI_ERROR_REJ_BAD_ADDR;
3255 	hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
3256 }
3257 
hci_conn_request_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)3258 static void hci_conn_request_evt(struct hci_dev *hdev, void *data,
3259 				 struct sk_buff *skb)
3260 {
3261 	struct hci_ev_conn_request *ev = data;
3262 	int mask = hdev->link_mode;
3263 	struct inquiry_entry *ie;
3264 	struct hci_conn *conn;
3265 	__u8 flags = 0;
3266 
3267 	bt_dev_dbg(hdev, "bdaddr %pMR type 0x%x", &ev->bdaddr, ev->link_type);
3268 
3269 	/* Reject incoming connection from device with same BD ADDR against
3270 	 * CVE-2020-26555
3271 	 */
3272 	if (hdev && !bacmp(&hdev->bdaddr, &ev->bdaddr)) {
3273 		bt_dev_dbg(hdev, "Reject connection with same BD_ADDR %pMR\n",
3274 			   &ev->bdaddr);
3275 		hci_reject_conn(hdev, &ev->bdaddr);
3276 		return;
3277 	}
3278 
3279 	mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
3280 				      &flags);
3281 
3282 	if (!(mask & HCI_LM_ACCEPT)) {
3283 		hci_reject_conn(hdev, &ev->bdaddr);
3284 		return;
3285 	}
3286 
3287 	hci_dev_lock(hdev);
3288 
3289 	if (hci_bdaddr_list_lookup(&hdev->reject_list, &ev->bdaddr,
3290 				   BDADDR_BREDR)) {
3291 		hci_reject_conn(hdev, &ev->bdaddr);
3292 		goto unlock;
3293 	}
3294 
3295 	/* Require HCI_CONNECTABLE or an accept list entry to accept the
3296 	 * connection. These features are only touched through mgmt so
3297 	 * only do the checks if HCI_MGMT is set.
3298 	 */
3299 	if (hci_dev_test_flag(hdev, HCI_MGMT) &&
3300 	    !hci_dev_test_flag(hdev, HCI_CONNECTABLE) &&
3301 	    !hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, &ev->bdaddr,
3302 					       BDADDR_BREDR)) {
3303 		hci_reject_conn(hdev, &ev->bdaddr);
3304 		goto unlock;
3305 	}
3306 
3307 	/* Connection accepted */
3308 
3309 	ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
3310 	if (ie)
3311 		memcpy(ie->data.dev_class, ev->dev_class, 3);
3312 
3313 	conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
3314 			&ev->bdaddr);
3315 	if (!conn) {
3316 		conn = hci_conn_add_unset(hdev, ev->link_type, &ev->bdaddr,
3317 					  HCI_ROLE_SLAVE);
3318 		if (IS_ERR(conn)) {
3319 			bt_dev_err(hdev, "connection err: %ld", PTR_ERR(conn));
3320 			goto unlock;
3321 		}
3322 	}
3323 
3324 	memcpy(conn->dev_class, ev->dev_class, 3);
3325 
3326 	hci_dev_unlock(hdev);
3327 
3328 	if (ev->link_type == ACL_LINK ||
3329 	    (!(flags & HCI_PROTO_DEFER) && !lmp_esco_capable(hdev))) {
3330 		struct hci_cp_accept_conn_req cp;
3331 		conn->state = BT_CONNECT;
3332 
3333 		bacpy(&cp.bdaddr, &ev->bdaddr);
3334 
3335 		if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
3336 			cp.role = 0x00; /* Become central */
3337 		else
3338 			cp.role = 0x01; /* Remain peripheral */
3339 
3340 		hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
3341 	} else if (!(flags & HCI_PROTO_DEFER)) {
3342 		struct hci_cp_accept_sync_conn_req cp;
3343 		conn->state = BT_CONNECT;
3344 
3345 		bacpy(&cp.bdaddr, &ev->bdaddr);
3346 		cp.pkt_type = cpu_to_le16(conn->pkt_type);
3347 
3348 		cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
3349 		cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
3350 		cp.max_latency    = cpu_to_le16(0xffff);
3351 		cp.content_format = cpu_to_le16(hdev->voice_setting);
3352 		cp.retrans_effort = 0xff;
3353 
3354 		hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ, sizeof(cp),
3355 			     &cp);
3356 	} else {
3357 		conn->state = BT_CONNECT2;
3358 		hci_connect_cfm(conn, 0);
3359 	}
3360 
3361 	return;
3362 unlock:
3363 	hci_dev_unlock(hdev);
3364 }
3365 
hci_to_mgmt_reason(u8 err)3366 static u8 hci_to_mgmt_reason(u8 err)
3367 {
3368 	switch (err) {
3369 	case HCI_ERROR_CONNECTION_TIMEOUT:
3370 		return MGMT_DEV_DISCONN_TIMEOUT;
3371 	case HCI_ERROR_REMOTE_USER_TERM:
3372 	case HCI_ERROR_REMOTE_LOW_RESOURCES:
3373 	case HCI_ERROR_REMOTE_POWER_OFF:
3374 		return MGMT_DEV_DISCONN_REMOTE;
3375 	case HCI_ERROR_LOCAL_HOST_TERM:
3376 		return MGMT_DEV_DISCONN_LOCAL_HOST;
3377 	default:
3378 		return MGMT_DEV_DISCONN_UNKNOWN;
3379 	}
3380 }
3381 
hci_disconn_complete_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)3382 static void hci_disconn_complete_evt(struct hci_dev *hdev, void *data,
3383 				     struct sk_buff *skb)
3384 {
3385 	struct hci_ev_disconn_complete *ev = data;
3386 	u8 reason;
3387 	struct hci_conn_params *params;
3388 	struct hci_conn *conn;
3389 	bool mgmt_connected;
3390 
3391 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
3392 
3393 	hci_dev_lock(hdev);
3394 
3395 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3396 	if (!conn)
3397 		goto unlock;
3398 
3399 	if (ev->status) {
3400 		mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
3401 				       conn->dst_type, ev->status);
3402 		goto unlock;
3403 	}
3404 
3405 	conn->state = BT_CLOSED;
3406 
3407 	mgmt_connected = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags);
3408 
3409 	if (test_bit(HCI_CONN_AUTH_FAILURE, &conn->flags))
3410 		reason = MGMT_DEV_DISCONN_AUTH_FAILURE;
3411 	else
3412 		reason = hci_to_mgmt_reason(ev->reason);
3413 
3414 	mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type,
3415 				reason, mgmt_connected);
3416 
3417 	if (conn->type == ACL_LINK) {
3418 		if (test_and_clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
3419 			hci_remove_link_key(hdev, &conn->dst);
3420 
3421 		hci_update_scan(hdev);
3422 	}
3423 
3424 	/* Re-enable passive scanning if disconnected device is marked
3425 	 * as auto-connectable.
3426 	 */
3427 	if (conn->type == LE_LINK) {
3428 		params = hci_conn_params_lookup(hdev, &conn->dst,
3429 						conn->dst_type);
3430 		if (params) {
3431 			switch (params->auto_connect) {
3432 			case HCI_AUTO_CONN_LINK_LOSS:
3433 				if (ev->reason != HCI_ERROR_CONNECTION_TIMEOUT)
3434 					break;
3435 				fallthrough;
3436 
3437 			case HCI_AUTO_CONN_DIRECT:
3438 			case HCI_AUTO_CONN_ALWAYS:
3439 				hci_pend_le_list_del_init(params);
3440 				hci_pend_le_list_add(params,
3441 						     &hdev->pend_le_conns);
3442 				hci_update_passive_scan(hdev);
3443 				break;
3444 
3445 			default:
3446 				break;
3447 			}
3448 		}
3449 	}
3450 
3451 	hci_disconn_cfm(conn, ev->reason);
3452 
3453 	/* Re-enable advertising if necessary, since it might
3454 	 * have been disabled by the connection. From the
3455 	 * HCI_LE_Set_Advertise_Enable command description in
3456 	 * the core specification (v4.0):
3457 	 * "The Controller shall continue advertising until the Host
3458 	 * issues an LE_Set_Advertise_Enable command with
3459 	 * Advertising_Enable set to 0x00 (Advertising is disabled)
3460 	 * or until a connection is created or until the Advertising
3461 	 * is timed out due to Directed Advertising."
3462 	 */
3463 	if (conn->type == LE_LINK && conn->role == HCI_ROLE_SLAVE) {
3464 		hdev->cur_adv_instance = conn->adv_instance;
3465 		hci_enable_advertising(hdev);
3466 	}
3467 
3468 	hci_conn_del(conn);
3469 
3470 unlock:
3471 	hci_dev_unlock(hdev);
3472 }
3473 
hci_auth_complete_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)3474 static void hci_auth_complete_evt(struct hci_dev *hdev, void *data,
3475 				  struct sk_buff *skb)
3476 {
3477 	struct hci_ev_auth_complete *ev = data;
3478 	struct hci_conn *conn;
3479 
3480 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
3481 
3482 	hci_dev_lock(hdev);
3483 
3484 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3485 	if (!conn)
3486 		goto unlock;
3487 
3488 	if (!ev->status) {
3489 		clear_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
3490 		set_bit(HCI_CONN_AUTH, &conn->flags);
3491 		conn->sec_level = conn->pending_sec_level;
3492 	} else {
3493 		if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
3494 			set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
3495 
3496 		mgmt_auth_failed(conn, ev->status);
3497 	}
3498 
3499 	clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
3500 
3501 	if (conn->state == BT_CONFIG) {
3502 		if (!ev->status && hci_conn_ssp_enabled(conn)) {
3503 			struct hci_cp_set_conn_encrypt cp;
3504 			cp.handle  = ev->handle;
3505 			cp.encrypt = 0x01;
3506 			hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
3507 				     &cp);
3508 		} else {
3509 			conn->state = BT_CONNECTED;
3510 			hci_connect_cfm(conn, ev->status);
3511 			hci_conn_drop(conn);
3512 		}
3513 	} else {
3514 		hci_auth_cfm(conn, ev->status);
3515 
3516 		hci_conn_hold(conn);
3517 		conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3518 		hci_conn_drop(conn);
3519 	}
3520 
3521 	if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
3522 		if (!ev->status) {
3523 			struct hci_cp_set_conn_encrypt cp;
3524 			cp.handle  = ev->handle;
3525 			cp.encrypt = 0x01;
3526 			hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
3527 				     &cp);
3528 		} else {
3529 			clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3530 			hci_encrypt_cfm(conn, ev->status);
3531 		}
3532 	}
3533 
3534 unlock:
3535 	hci_dev_unlock(hdev);
3536 }
3537 
hci_remote_name_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)3538 static void hci_remote_name_evt(struct hci_dev *hdev, void *data,
3539 				struct sk_buff *skb)
3540 {
3541 	struct hci_ev_remote_name *ev = data;
3542 	struct hci_conn *conn;
3543 
3544 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
3545 
3546 	hci_dev_lock(hdev);
3547 
3548 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3549 
3550 	if (!hci_dev_test_flag(hdev, HCI_MGMT))
3551 		goto check_auth;
3552 
3553 	if (ev->status == 0)
3554 		hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
3555 				       strnlen(ev->name, HCI_MAX_NAME_LENGTH));
3556 	else
3557 		hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
3558 
3559 check_auth:
3560 	if (!conn)
3561 		goto unlock;
3562 
3563 	if (!hci_outgoing_auth_needed(hdev, conn))
3564 		goto unlock;
3565 
3566 	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
3567 		struct hci_cp_auth_requested cp;
3568 
3569 		set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
3570 
3571 		cp.handle = __cpu_to_le16(conn->handle);
3572 		hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
3573 	}
3574 
3575 unlock:
3576 	hci_dev_unlock(hdev);
3577 }
3578 
hci_encrypt_change_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)3579 static void hci_encrypt_change_evt(struct hci_dev *hdev, void *data,
3580 				   struct sk_buff *skb)
3581 {
3582 	struct hci_ev_encrypt_change *ev = data;
3583 	struct hci_conn *conn;
3584 
3585 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
3586 
3587 	hci_dev_lock(hdev);
3588 
3589 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3590 	if (!conn)
3591 		goto unlock;
3592 
3593 	if (!ev->status) {
3594 		if (ev->encrypt) {
3595 			/* Encryption implies authentication */
3596 			set_bit(HCI_CONN_AUTH, &conn->flags);
3597 			set_bit(HCI_CONN_ENCRYPT, &conn->flags);
3598 			conn->sec_level = conn->pending_sec_level;
3599 
3600 			/* P-256 authentication key implies FIPS */
3601 			if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256)
3602 				set_bit(HCI_CONN_FIPS, &conn->flags);
3603 
3604 			if ((conn->type == ACL_LINK && ev->encrypt == 0x02) ||
3605 			    conn->type == LE_LINK)
3606 				set_bit(HCI_CONN_AES_CCM, &conn->flags);
3607 		} else {
3608 			clear_bit(HCI_CONN_ENCRYPT, &conn->flags);
3609 			clear_bit(HCI_CONN_AES_CCM, &conn->flags);
3610 		}
3611 	}
3612 
3613 	/* We should disregard the current RPA and generate a new one
3614 	 * whenever the encryption procedure fails.
3615 	 */
3616 	if (ev->status && conn->type == LE_LINK) {
3617 		hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
3618 		hci_adv_instances_set_rpa_expired(hdev, true);
3619 	}
3620 
3621 	clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3622 
3623 	/* Check link security requirements are met */
3624 	if (!hci_conn_check_link_mode(conn))
3625 		ev->status = HCI_ERROR_AUTH_FAILURE;
3626 
3627 	if (ev->status && conn->state == BT_CONNECTED) {
3628 		if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
3629 			set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
3630 
3631 		/* Notify upper layers so they can cleanup before
3632 		 * disconnecting.
3633 		 */
3634 		hci_encrypt_cfm(conn, ev->status);
3635 		hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
3636 		hci_conn_drop(conn);
3637 		goto unlock;
3638 	}
3639 
3640 	/* Try reading the encryption key size for encrypted ACL links */
3641 	if (!ev->status && ev->encrypt && conn->type == ACL_LINK) {
3642 		if (hci_read_enc_key_size(hdev, conn))
3643 			goto notify;
3644 
3645 		goto unlock;
3646 	}
3647 
3648 	/* We skip the WRITE_AUTH_PAYLOAD_TIMEOUT for ATS2851 based controllers
3649 	 * to avoid unexpected SMP command errors when pairing.
3650 	 */
3651 	if (test_bit(HCI_QUIRK_BROKEN_WRITE_AUTH_PAYLOAD_TIMEOUT,
3652 		     &hdev->quirks))
3653 		goto notify;
3654 
3655 	/* Set the default Authenticated Payload Timeout after
3656 	 * an LE Link is established. As per Core Spec v5.0, Vol 2, Part B
3657 	 * Section 3.3, the HCI command WRITE_AUTH_PAYLOAD_TIMEOUT should be
3658 	 * sent when the link is active and Encryption is enabled, the conn
3659 	 * type can be either LE or ACL and controller must support LMP Ping.
3660 	 * Ensure for AES-CCM encryption as well.
3661 	 */
3662 	if (test_bit(HCI_CONN_ENCRYPT, &conn->flags) &&
3663 	    test_bit(HCI_CONN_AES_CCM, &conn->flags) &&
3664 	    ((conn->type == ACL_LINK && lmp_ping_capable(hdev)) ||
3665 	     (conn->type == LE_LINK && (hdev->le_features[0] & HCI_LE_PING)))) {
3666 		struct hci_cp_write_auth_payload_to cp;
3667 
3668 		cp.handle = cpu_to_le16(conn->handle);
3669 		cp.timeout = cpu_to_le16(hdev->auth_payload_timeout);
3670 		if (hci_send_cmd(conn->hdev, HCI_OP_WRITE_AUTH_PAYLOAD_TO,
3671 				 sizeof(cp), &cp))
3672 			bt_dev_err(hdev, "write auth payload timeout failed");
3673 	}
3674 
3675 notify:
3676 	hci_encrypt_cfm(conn, ev->status);
3677 
3678 unlock:
3679 	hci_dev_unlock(hdev);
3680 }
3681 
hci_change_link_key_complete_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)3682 static void hci_change_link_key_complete_evt(struct hci_dev *hdev, void *data,
3683 					     struct sk_buff *skb)
3684 {
3685 	struct hci_ev_change_link_key_complete *ev = data;
3686 	struct hci_conn *conn;
3687 
3688 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
3689 
3690 	hci_dev_lock(hdev);
3691 
3692 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3693 	if (conn) {
3694 		if (!ev->status)
3695 			set_bit(HCI_CONN_SECURE, &conn->flags);
3696 
3697 		clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
3698 
3699 		hci_key_change_cfm(conn, ev->status);
3700 	}
3701 
3702 	hci_dev_unlock(hdev);
3703 }
3704 
hci_remote_features_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)3705 static void hci_remote_features_evt(struct hci_dev *hdev, void *data,
3706 				    struct sk_buff *skb)
3707 {
3708 	struct hci_ev_remote_features *ev = data;
3709 	struct hci_conn *conn;
3710 
3711 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
3712 
3713 	hci_dev_lock(hdev);
3714 
3715 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3716 	if (!conn)
3717 		goto unlock;
3718 
3719 	if (!ev->status)
3720 		memcpy(conn->features[0], ev->features, 8);
3721 
3722 	if (conn->state != BT_CONFIG)
3723 		goto unlock;
3724 
3725 	if (!ev->status && lmp_ext_feat_capable(hdev) &&
3726 	    lmp_ext_feat_capable(conn)) {
3727 		struct hci_cp_read_remote_ext_features cp;
3728 		cp.handle = ev->handle;
3729 		cp.page = 0x01;
3730 		hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
3731 			     sizeof(cp), &cp);
3732 		goto unlock;
3733 	}
3734 
3735 	if (!ev->status) {
3736 		struct hci_cp_remote_name_req cp;
3737 		memset(&cp, 0, sizeof(cp));
3738 		bacpy(&cp.bdaddr, &conn->dst);
3739 		cp.pscan_rep_mode = 0x02;
3740 		hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
3741 	} else {
3742 		mgmt_device_connected(hdev, conn, NULL, 0);
3743 	}
3744 
3745 	if (!hci_outgoing_auth_needed(hdev, conn)) {
3746 		conn->state = BT_CONNECTED;
3747 		hci_connect_cfm(conn, ev->status);
3748 		hci_conn_drop(conn);
3749 	}
3750 
3751 unlock:
3752 	hci_dev_unlock(hdev);
3753 }
3754 
handle_cmd_cnt_and_timer(struct hci_dev * hdev,u8 ncmd)3755 static inline void handle_cmd_cnt_and_timer(struct hci_dev *hdev, u8 ncmd)
3756 {
3757 	cancel_delayed_work(&hdev->cmd_timer);
3758 
3759 	rcu_read_lock();
3760 	if (!test_bit(HCI_RESET, &hdev->flags)) {
3761 		if (ncmd) {
3762 			cancel_delayed_work(&hdev->ncmd_timer);
3763 			atomic_set(&hdev->cmd_cnt, 1);
3764 		} else {
3765 			if (!hci_dev_test_flag(hdev, HCI_CMD_DRAIN_WORKQUEUE))
3766 				queue_delayed_work(hdev->workqueue, &hdev->ncmd_timer,
3767 						   HCI_NCMD_TIMEOUT);
3768 		}
3769 	}
3770 	rcu_read_unlock();
3771 }
3772 
hci_cc_le_read_buffer_size_v2(struct hci_dev * hdev,void * data,struct sk_buff * skb)3773 static u8 hci_cc_le_read_buffer_size_v2(struct hci_dev *hdev, void *data,
3774 					struct sk_buff *skb)
3775 {
3776 	struct hci_rp_le_read_buffer_size_v2 *rp = data;
3777 
3778 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
3779 
3780 	if (rp->status)
3781 		return rp->status;
3782 
3783 	hdev->le_mtu   = __le16_to_cpu(rp->acl_mtu);
3784 	hdev->le_pkts  = rp->acl_max_pkt;
3785 	hdev->iso_mtu  = __le16_to_cpu(rp->iso_mtu);
3786 	hdev->iso_pkts = rp->iso_max_pkt;
3787 
3788 	hdev->le_cnt  = hdev->le_pkts;
3789 	hdev->iso_cnt = hdev->iso_pkts;
3790 
3791 	BT_DBG("%s acl mtu %d:%d iso mtu %d:%d", hdev->name, hdev->acl_mtu,
3792 	       hdev->acl_pkts, hdev->iso_mtu, hdev->iso_pkts);
3793 
3794 	if (hdev->le_mtu && hdev->le_mtu < HCI_MIN_LE_MTU)
3795 		return HCI_ERROR_INVALID_PARAMETERS;
3796 
3797 	return rp->status;
3798 }
3799 
hci_unbound_cis_failed(struct hci_dev * hdev,u8 cig,u8 status)3800 static void hci_unbound_cis_failed(struct hci_dev *hdev, u8 cig, u8 status)
3801 {
3802 	struct hci_conn *conn, *tmp;
3803 
3804 	lockdep_assert_held(&hdev->lock);
3805 
3806 	list_for_each_entry_safe(conn, tmp, &hdev->conn_hash.list, list) {
3807 		if (conn->type != ISO_LINK || !bacmp(&conn->dst, BDADDR_ANY) ||
3808 		    conn->state == BT_OPEN || conn->iso_qos.ucast.cig != cig)
3809 			continue;
3810 
3811 		if (HCI_CONN_HANDLE_UNSET(conn->handle))
3812 			hci_conn_failed(conn, status);
3813 	}
3814 }
3815 
hci_cc_le_set_cig_params(struct hci_dev * hdev,void * data,struct sk_buff * skb)3816 static u8 hci_cc_le_set_cig_params(struct hci_dev *hdev, void *data,
3817 				   struct sk_buff *skb)
3818 {
3819 	struct hci_rp_le_set_cig_params *rp = data;
3820 	struct hci_cp_le_set_cig_params *cp;
3821 	struct hci_conn *conn;
3822 	u8 status = rp->status;
3823 	bool pending = false;
3824 	int i;
3825 
3826 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
3827 
3828 	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_CIG_PARAMS);
3829 	if (!rp->status && (!cp || rp->num_handles != cp->num_cis ||
3830 			    rp->cig_id != cp->cig_id)) {
3831 		bt_dev_err(hdev, "unexpected Set CIG Parameters response data");
3832 		status = HCI_ERROR_UNSPECIFIED;
3833 	}
3834 
3835 	hci_dev_lock(hdev);
3836 
3837 	/* BLUETOOTH CORE SPECIFICATION Version 5.4 | Vol 4, Part E page 2554
3838 	 *
3839 	 * If the Status return parameter is non-zero, then the state of the CIG
3840 	 * and its CIS configurations shall not be changed by the command. If
3841 	 * the CIG did not already exist, it shall not be created.
3842 	 */
3843 	if (status) {
3844 		/* Keep current configuration, fail only the unbound CIS */
3845 		hci_unbound_cis_failed(hdev, rp->cig_id, status);
3846 		goto unlock;
3847 	}
3848 
3849 	/* BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 4, Part E page 2553
3850 	 *
3851 	 * If the Status return parameter is zero, then the Controller shall
3852 	 * set the Connection_Handle arrayed return parameter to the connection
3853 	 * handle(s) corresponding to the CIS configurations specified in
3854 	 * the CIS_IDs command parameter, in the same order.
3855 	 */
3856 	for (i = 0; i < rp->num_handles; ++i) {
3857 		conn = hci_conn_hash_lookup_cis(hdev, NULL, 0, rp->cig_id,
3858 						cp->cis[i].cis_id);
3859 		if (!conn || !bacmp(&conn->dst, BDADDR_ANY))
3860 			continue;
3861 
3862 		if (conn->state != BT_BOUND && conn->state != BT_CONNECT)
3863 			continue;
3864 
3865 		if (hci_conn_set_handle(conn, __le16_to_cpu(rp->handle[i])))
3866 			continue;
3867 
3868 		if (conn->state == BT_CONNECT)
3869 			pending = true;
3870 	}
3871 
3872 unlock:
3873 	if (pending)
3874 		hci_le_create_cis_pending(hdev);
3875 
3876 	hci_dev_unlock(hdev);
3877 
3878 	return rp->status;
3879 }
3880 
hci_cc_le_setup_iso_path(struct hci_dev * hdev,void * data,struct sk_buff * skb)3881 static u8 hci_cc_le_setup_iso_path(struct hci_dev *hdev, void *data,
3882 				   struct sk_buff *skb)
3883 {
3884 	struct hci_rp_le_setup_iso_path *rp = data;
3885 	struct hci_cp_le_setup_iso_path *cp;
3886 	struct hci_conn *conn;
3887 
3888 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
3889 
3890 	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SETUP_ISO_PATH);
3891 	if (!cp)
3892 		return rp->status;
3893 
3894 	hci_dev_lock(hdev);
3895 
3896 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
3897 	if (!conn)
3898 		goto unlock;
3899 
3900 	if (rp->status) {
3901 		hci_connect_cfm(conn, rp->status);
3902 		hci_conn_del(conn);
3903 		goto unlock;
3904 	}
3905 
3906 	switch (cp->direction) {
3907 	/* Input (Host to Controller) */
3908 	case 0x00:
3909 		/* Only confirm connection if output only */
3910 		if (conn->iso_qos.ucast.out.sdu && !conn->iso_qos.ucast.in.sdu)
3911 			hci_connect_cfm(conn, rp->status);
3912 		break;
3913 	/* Output (Controller to Host) */
3914 	case 0x01:
3915 		/* Confirm connection since conn->iso_qos is always configured
3916 		 * last.
3917 		 */
3918 		hci_connect_cfm(conn, rp->status);
3919 
3920 		/* Notify device connected in case it is a BIG Sync */
3921 		if (!rp->status && test_bit(HCI_CONN_BIG_SYNC, &conn->flags))
3922 			mgmt_device_connected(hdev, conn, NULL, 0);
3923 
3924 		break;
3925 	}
3926 
3927 unlock:
3928 	hci_dev_unlock(hdev);
3929 	return rp->status;
3930 }
3931 
hci_cs_le_create_big(struct hci_dev * hdev,u8 status)3932 static void hci_cs_le_create_big(struct hci_dev *hdev, u8 status)
3933 {
3934 	bt_dev_dbg(hdev, "status 0x%2.2x", status);
3935 }
3936 
hci_cc_set_per_adv_param(struct hci_dev * hdev,void * data,struct sk_buff * skb)3937 static u8 hci_cc_set_per_adv_param(struct hci_dev *hdev, void *data,
3938 				   struct sk_buff *skb)
3939 {
3940 	struct hci_ev_status *rp = data;
3941 	struct hci_cp_le_set_per_adv_params *cp;
3942 
3943 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
3944 
3945 	if (rp->status)
3946 		return rp->status;
3947 
3948 	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_PER_ADV_PARAMS);
3949 	if (!cp)
3950 		return rp->status;
3951 
3952 	/* TODO: set the conn state */
3953 	return rp->status;
3954 }
3955 
hci_cc_le_set_per_adv_enable(struct hci_dev * hdev,void * data,struct sk_buff * skb)3956 static u8 hci_cc_le_set_per_adv_enable(struct hci_dev *hdev, void *data,
3957 				       struct sk_buff *skb)
3958 {
3959 	struct hci_ev_status *rp = data;
3960 	struct hci_cp_le_set_per_adv_enable *cp;
3961 	struct adv_info *adv = NULL, *n;
3962 	u8 per_adv_cnt = 0;
3963 
3964 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
3965 
3966 	if (rp->status)
3967 		return rp->status;
3968 
3969 	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_PER_ADV_ENABLE);
3970 	if (!cp)
3971 		return rp->status;
3972 
3973 	hci_dev_lock(hdev);
3974 
3975 	adv = hci_find_adv_instance(hdev, cp->handle);
3976 
3977 	if (cp->enable) {
3978 		hci_dev_set_flag(hdev, HCI_LE_PER_ADV);
3979 
3980 		if (adv)
3981 			adv->enabled = true;
3982 	} else {
3983 		/* If just one instance was disabled check if there are
3984 		 * any other instance enabled before clearing HCI_LE_PER_ADV.
3985 		 * The current periodic adv instance will be marked as
3986 		 * disabled once extended advertising is also disabled.
3987 		 */
3988 		list_for_each_entry_safe(adv, n, &hdev->adv_instances,
3989 					 list) {
3990 			if (adv->periodic && adv->enabled)
3991 				per_adv_cnt++;
3992 		}
3993 
3994 		if (per_adv_cnt > 1)
3995 			goto unlock;
3996 
3997 		hci_dev_clear_flag(hdev, HCI_LE_PER_ADV);
3998 	}
3999 
4000 unlock:
4001 	hci_dev_unlock(hdev);
4002 
4003 	return rp->status;
4004 }
4005 
4006 #define HCI_CC_VL(_op, _func, _min, _max) \
4007 { \
4008 	.op = _op, \
4009 	.func = _func, \
4010 	.min_len = _min, \
4011 	.max_len = _max, \
4012 }
4013 
4014 #define HCI_CC(_op, _func, _len) \
4015 	HCI_CC_VL(_op, _func, _len, _len)
4016 
4017 #define HCI_CC_STATUS(_op, _func) \
4018 	HCI_CC(_op, _func, sizeof(struct hci_ev_status))
4019 
4020 static const struct hci_cc {
4021 	u16  op;
4022 	u8 (*func)(struct hci_dev *hdev, void *data, struct sk_buff *skb);
4023 	u16  min_len;
4024 	u16  max_len;
4025 } hci_cc_table[] = {
4026 	HCI_CC_STATUS(HCI_OP_INQUIRY_CANCEL, hci_cc_inquiry_cancel),
4027 	HCI_CC_STATUS(HCI_OP_PERIODIC_INQ, hci_cc_periodic_inq),
4028 	HCI_CC_STATUS(HCI_OP_EXIT_PERIODIC_INQ, hci_cc_exit_periodic_inq),
4029 	HCI_CC(HCI_OP_REMOTE_NAME_REQ_CANCEL, hci_cc_remote_name_req_cancel,
4030 	       sizeof(struct hci_rp_remote_name_req_cancel)),
4031 	HCI_CC(HCI_OP_ROLE_DISCOVERY, hci_cc_role_discovery,
4032 	       sizeof(struct hci_rp_role_discovery)),
4033 	HCI_CC(HCI_OP_READ_LINK_POLICY, hci_cc_read_link_policy,
4034 	       sizeof(struct hci_rp_read_link_policy)),
4035 	HCI_CC(HCI_OP_WRITE_LINK_POLICY, hci_cc_write_link_policy,
4036 	       sizeof(struct hci_rp_write_link_policy)),
4037 	HCI_CC(HCI_OP_READ_DEF_LINK_POLICY, hci_cc_read_def_link_policy,
4038 	       sizeof(struct hci_rp_read_def_link_policy)),
4039 	HCI_CC_STATUS(HCI_OP_WRITE_DEF_LINK_POLICY,
4040 		      hci_cc_write_def_link_policy),
4041 	HCI_CC_STATUS(HCI_OP_RESET, hci_cc_reset),
4042 	HCI_CC(HCI_OP_READ_STORED_LINK_KEY, hci_cc_read_stored_link_key,
4043 	       sizeof(struct hci_rp_read_stored_link_key)),
4044 	HCI_CC(HCI_OP_DELETE_STORED_LINK_KEY, hci_cc_delete_stored_link_key,
4045 	       sizeof(struct hci_rp_delete_stored_link_key)),
4046 	HCI_CC_STATUS(HCI_OP_WRITE_LOCAL_NAME, hci_cc_write_local_name),
4047 	HCI_CC(HCI_OP_READ_LOCAL_NAME, hci_cc_read_local_name,
4048 	       sizeof(struct hci_rp_read_local_name)),
4049 	HCI_CC_STATUS(HCI_OP_WRITE_AUTH_ENABLE, hci_cc_write_auth_enable),
4050 	HCI_CC_STATUS(HCI_OP_WRITE_ENCRYPT_MODE, hci_cc_write_encrypt_mode),
4051 	HCI_CC_STATUS(HCI_OP_WRITE_SCAN_ENABLE, hci_cc_write_scan_enable),
4052 	HCI_CC_STATUS(HCI_OP_SET_EVENT_FLT, hci_cc_set_event_filter),
4053 	HCI_CC(HCI_OP_READ_CLASS_OF_DEV, hci_cc_read_class_of_dev,
4054 	       sizeof(struct hci_rp_read_class_of_dev)),
4055 	HCI_CC_STATUS(HCI_OP_WRITE_CLASS_OF_DEV, hci_cc_write_class_of_dev),
4056 	HCI_CC(HCI_OP_READ_VOICE_SETTING, hci_cc_read_voice_setting,
4057 	       sizeof(struct hci_rp_read_voice_setting)),
4058 	HCI_CC_STATUS(HCI_OP_WRITE_VOICE_SETTING, hci_cc_write_voice_setting),
4059 	HCI_CC(HCI_OP_READ_NUM_SUPPORTED_IAC, hci_cc_read_num_supported_iac,
4060 	       sizeof(struct hci_rp_read_num_supported_iac)),
4061 	HCI_CC_STATUS(HCI_OP_WRITE_SSP_MODE, hci_cc_write_ssp_mode),
4062 	HCI_CC_STATUS(HCI_OP_WRITE_SC_SUPPORT, hci_cc_write_sc_support),
4063 	HCI_CC(HCI_OP_READ_AUTH_PAYLOAD_TO, hci_cc_read_auth_payload_timeout,
4064 	       sizeof(struct hci_rp_read_auth_payload_to)),
4065 	HCI_CC(HCI_OP_WRITE_AUTH_PAYLOAD_TO, hci_cc_write_auth_payload_timeout,
4066 	       sizeof(struct hci_rp_write_auth_payload_to)),
4067 	HCI_CC(HCI_OP_READ_LOCAL_VERSION, hci_cc_read_local_version,
4068 	       sizeof(struct hci_rp_read_local_version)),
4069 	HCI_CC(HCI_OP_READ_LOCAL_COMMANDS, hci_cc_read_local_commands,
4070 	       sizeof(struct hci_rp_read_local_commands)),
4071 	HCI_CC(HCI_OP_READ_LOCAL_FEATURES, hci_cc_read_local_features,
4072 	       sizeof(struct hci_rp_read_local_features)),
4073 	HCI_CC(HCI_OP_READ_LOCAL_EXT_FEATURES, hci_cc_read_local_ext_features,
4074 	       sizeof(struct hci_rp_read_local_ext_features)),
4075 	HCI_CC(HCI_OP_READ_BUFFER_SIZE, hci_cc_read_buffer_size,
4076 	       sizeof(struct hci_rp_read_buffer_size)),
4077 	HCI_CC(HCI_OP_READ_BD_ADDR, hci_cc_read_bd_addr,
4078 	       sizeof(struct hci_rp_read_bd_addr)),
4079 	HCI_CC(HCI_OP_READ_LOCAL_PAIRING_OPTS, hci_cc_read_local_pairing_opts,
4080 	       sizeof(struct hci_rp_read_local_pairing_opts)),
4081 	HCI_CC(HCI_OP_READ_PAGE_SCAN_ACTIVITY, hci_cc_read_page_scan_activity,
4082 	       sizeof(struct hci_rp_read_page_scan_activity)),
4083 	HCI_CC_STATUS(HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
4084 		      hci_cc_write_page_scan_activity),
4085 	HCI_CC(HCI_OP_READ_PAGE_SCAN_TYPE, hci_cc_read_page_scan_type,
4086 	       sizeof(struct hci_rp_read_page_scan_type)),
4087 	HCI_CC_STATUS(HCI_OP_WRITE_PAGE_SCAN_TYPE, hci_cc_write_page_scan_type),
4088 	HCI_CC(HCI_OP_READ_CLOCK, hci_cc_read_clock,
4089 	       sizeof(struct hci_rp_read_clock)),
4090 	HCI_CC(HCI_OP_READ_ENC_KEY_SIZE, hci_cc_read_enc_key_size,
4091 	       sizeof(struct hci_rp_read_enc_key_size)),
4092 	HCI_CC(HCI_OP_READ_INQ_RSP_TX_POWER, hci_cc_read_inq_rsp_tx_power,
4093 	       sizeof(struct hci_rp_read_inq_rsp_tx_power)),
4094 	HCI_CC(HCI_OP_READ_DEF_ERR_DATA_REPORTING,
4095 	       hci_cc_read_def_err_data_reporting,
4096 	       sizeof(struct hci_rp_read_def_err_data_reporting)),
4097 	HCI_CC_STATUS(HCI_OP_WRITE_DEF_ERR_DATA_REPORTING,
4098 		      hci_cc_write_def_err_data_reporting),
4099 	HCI_CC(HCI_OP_PIN_CODE_REPLY, hci_cc_pin_code_reply,
4100 	       sizeof(struct hci_rp_pin_code_reply)),
4101 	HCI_CC(HCI_OP_PIN_CODE_NEG_REPLY, hci_cc_pin_code_neg_reply,
4102 	       sizeof(struct hci_rp_pin_code_neg_reply)),
4103 	HCI_CC(HCI_OP_READ_LOCAL_OOB_DATA, hci_cc_read_local_oob_data,
4104 	       sizeof(struct hci_rp_read_local_oob_data)),
4105 	HCI_CC(HCI_OP_READ_LOCAL_OOB_EXT_DATA, hci_cc_read_local_oob_ext_data,
4106 	       sizeof(struct hci_rp_read_local_oob_ext_data)),
4107 	HCI_CC(HCI_OP_LE_READ_BUFFER_SIZE, hci_cc_le_read_buffer_size,
4108 	       sizeof(struct hci_rp_le_read_buffer_size)),
4109 	HCI_CC(HCI_OP_LE_READ_LOCAL_FEATURES, hci_cc_le_read_local_features,
4110 	       sizeof(struct hci_rp_le_read_local_features)),
4111 	HCI_CC(HCI_OP_LE_READ_ADV_TX_POWER, hci_cc_le_read_adv_tx_power,
4112 	       sizeof(struct hci_rp_le_read_adv_tx_power)),
4113 	HCI_CC(HCI_OP_USER_CONFIRM_REPLY, hci_cc_user_confirm_reply,
4114 	       sizeof(struct hci_rp_user_confirm_reply)),
4115 	HCI_CC(HCI_OP_USER_CONFIRM_NEG_REPLY, hci_cc_user_confirm_neg_reply,
4116 	       sizeof(struct hci_rp_user_confirm_reply)),
4117 	HCI_CC(HCI_OP_USER_PASSKEY_REPLY, hci_cc_user_passkey_reply,
4118 	       sizeof(struct hci_rp_user_confirm_reply)),
4119 	HCI_CC(HCI_OP_USER_PASSKEY_NEG_REPLY, hci_cc_user_passkey_neg_reply,
4120 	       sizeof(struct hci_rp_user_confirm_reply)),
4121 	HCI_CC_STATUS(HCI_OP_LE_SET_RANDOM_ADDR, hci_cc_le_set_random_addr),
4122 	HCI_CC_STATUS(HCI_OP_LE_SET_ADV_ENABLE, hci_cc_le_set_adv_enable),
4123 	HCI_CC_STATUS(HCI_OP_LE_SET_SCAN_PARAM, hci_cc_le_set_scan_param),
4124 	HCI_CC_STATUS(HCI_OP_LE_SET_SCAN_ENABLE, hci_cc_le_set_scan_enable),
4125 	HCI_CC(HCI_OP_LE_READ_ACCEPT_LIST_SIZE,
4126 	       hci_cc_le_read_accept_list_size,
4127 	       sizeof(struct hci_rp_le_read_accept_list_size)),
4128 	HCI_CC_STATUS(HCI_OP_LE_CLEAR_ACCEPT_LIST, hci_cc_le_clear_accept_list),
4129 	HCI_CC_STATUS(HCI_OP_LE_ADD_TO_ACCEPT_LIST,
4130 		      hci_cc_le_add_to_accept_list),
4131 	HCI_CC_STATUS(HCI_OP_LE_DEL_FROM_ACCEPT_LIST,
4132 		      hci_cc_le_del_from_accept_list),
4133 	HCI_CC(HCI_OP_LE_READ_SUPPORTED_STATES, hci_cc_le_read_supported_states,
4134 	       sizeof(struct hci_rp_le_read_supported_states)),
4135 	HCI_CC(HCI_OP_LE_READ_DEF_DATA_LEN, hci_cc_le_read_def_data_len,
4136 	       sizeof(struct hci_rp_le_read_def_data_len)),
4137 	HCI_CC_STATUS(HCI_OP_LE_WRITE_DEF_DATA_LEN,
4138 		      hci_cc_le_write_def_data_len),
4139 	HCI_CC_STATUS(HCI_OP_LE_ADD_TO_RESOLV_LIST,
4140 		      hci_cc_le_add_to_resolv_list),
4141 	HCI_CC_STATUS(HCI_OP_LE_DEL_FROM_RESOLV_LIST,
4142 		      hci_cc_le_del_from_resolv_list),
4143 	HCI_CC_STATUS(HCI_OP_LE_CLEAR_RESOLV_LIST,
4144 		      hci_cc_le_clear_resolv_list),
4145 	HCI_CC(HCI_OP_LE_READ_RESOLV_LIST_SIZE, hci_cc_le_read_resolv_list_size,
4146 	       sizeof(struct hci_rp_le_read_resolv_list_size)),
4147 	HCI_CC_STATUS(HCI_OP_LE_SET_ADDR_RESOLV_ENABLE,
4148 		      hci_cc_le_set_addr_resolution_enable),
4149 	HCI_CC(HCI_OP_LE_READ_MAX_DATA_LEN, hci_cc_le_read_max_data_len,
4150 	       sizeof(struct hci_rp_le_read_max_data_len)),
4151 	HCI_CC_STATUS(HCI_OP_WRITE_LE_HOST_SUPPORTED,
4152 		      hci_cc_write_le_host_supported),
4153 	HCI_CC_STATUS(HCI_OP_LE_SET_ADV_PARAM, hci_cc_set_adv_param),
4154 	HCI_CC(HCI_OP_READ_RSSI, hci_cc_read_rssi,
4155 	       sizeof(struct hci_rp_read_rssi)),
4156 	HCI_CC(HCI_OP_READ_TX_POWER, hci_cc_read_tx_power,
4157 	       sizeof(struct hci_rp_read_tx_power)),
4158 	HCI_CC_STATUS(HCI_OP_WRITE_SSP_DEBUG_MODE, hci_cc_write_ssp_debug_mode),
4159 	HCI_CC_STATUS(HCI_OP_LE_SET_EXT_SCAN_PARAMS,
4160 		      hci_cc_le_set_ext_scan_param),
4161 	HCI_CC_STATUS(HCI_OP_LE_SET_EXT_SCAN_ENABLE,
4162 		      hci_cc_le_set_ext_scan_enable),
4163 	HCI_CC_STATUS(HCI_OP_LE_SET_DEFAULT_PHY, hci_cc_le_set_default_phy),
4164 	HCI_CC(HCI_OP_LE_READ_NUM_SUPPORTED_ADV_SETS,
4165 	       hci_cc_le_read_num_adv_sets,
4166 	       sizeof(struct hci_rp_le_read_num_supported_adv_sets)),
4167 	HCI_CC(HCI_OP_LE_SET_EXT_ADV_PARAMS, hci_cc_set_ext_adv_param,
4168 	       sizeof(struct hci_rp_le_set_ext_adv_params)),
4169 	HCI_CC_STATUS(HCI_OP_LE_SET_EXT_ADV_ENABLE,
4170 		      hci_cc_le_set_ext_adv_enable),
4171 	HCI_CC_STATUS(HCI_OP_LE_SET_ADV_SET_RAND_ADDR,
4172 		      hci_cc_le_set_adv_set_random_addr),
4173 	HCI_CC_STATUS(HCI_OP_LE_REMOVE_ADV_SET, hci_cc_le_remove_adv_set),
4174 	HCI_CC_STATUS(HCI_OP_LE_CLEAR_ADV_SETS, hci_cc_le_clear_adv_sets),
4175 	HCI_CC_STATUS(HCI_OP_LE_SET_PER_ADV_PARAMS, hci_cc_set_per_adv_param),
4176 	HCI_CC_STATUS(HCI_OP_LE_SET_PER_ADV_ENABLE,
4177 		      hci_cc_le_set_per_adv_enable),
4178 	HCI_CC(HCI_OP_LE_READ_TRANSMIT_POWER, hci_cc_le_read_transmit_power,
4179 	       sizeof(struct hci_rp_le_read_transmit_power)),
4180 	HCI_CC_STATUS(HCI_OP_LE_SET_PRIVACY_MODE, hci_cc_le_set_privacy_mode),
4181 	HCI_CC(HCI_OP_LE_READ_BUFFER_SIZE_V2, hci_cc_le_read_buffer_size_v2,
4182 	       sizeof(struct hci_rp_le_read_buffer_size_v2)),
4183 	HCI_CC_VL(HCI_OP_LE_SET_CIG_PARAMS, hci_cc_le_set_cig_params,
4184 		  sizeof(struct hci_rp_le_set_cig_params), HCI_MAX_EVENT_SIZE),
4185 	HCI_CC(HCI_OP_LE_SETUP_ISO_PATH, hci_cc_le_setup_iso_path,
4186 	       sizeof(struct hci_rp_le_setup_iso_path)),
4187 };
4188 
hci_cc_func(struct hci_dev * hdev,const struct hci_cc * cc,struct sk_buff * skb)4189 static u8 hci_cc_func(struct hci_dev *hdev, const struct hci_cc *cc,
4190 		      struct sk_buff *skb)
4191 {
4192 	void *data;
4193 
4194 	if (skb->len < cc->min_len) {
4195 		bt_dev_err(hdev, "unexpected cc 0x%4.4x length: %u < %u",
4196 			   cc->op, skb->len, cc->min_len);
4197 		return HCI_ERROR_UNSPECIFIED;
4198 	}
4199 
4200 	/* Just warn if the length is over max_len size it still be possible to
4201 	 * partially parse the cc so leave to callback to decide if that is
4202 	 * acceptable.
4203 	 */
4204 	if (skb->len > cc->max_len)
4205 		bt_dev_warn(hdev, "unexpected cc 0x%4.4x length: %u > %u",
4206 			    cc->op, skb->len, cc->max_len);
4207 
4208 	data = hci_cc_skb_pull(hdev, skb, cc->op, cc->min_len);
4209 	if (!data)
4210 		return HCI_ERROR_UNSPECIFIED;
4211 
4212 	return cc->func(hdev, data, skb);
4213 }
4214 
hci_cmd_complete_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb,u16 * opcode,u8 * status,hci_req_complete_t * req_complete,hci_req_complete_skb_t * req_complete_skb)4215 static void hci_cmd_complete_evt(struct hci_dev *hdev, void *data,
4216 				 struct sk_buff *skb, u16 *opcode, u8 *status,
4217 				 hci_req_complete_t *req_complete,
4218 				 hci_req_complete_skb_t *req_complete_skb)
4219 {
4220 	struct hci_ev_cmd_complete *ev = data;
4221 	int i;
4222 
4223 	*opcode = __le16_to_cpu(ev->opcode);
4224 
4225 	bt_dev_dbg(hdev, "opcode 0x%4.4x", *opcode);
4226 
4227 	for (i = 0; i < ARRAY_SIZE(hci_cc_table); i++) {
4228 		if (hci_cc_table[i].op == *opcode) {
4229 			*status = hci_cc_func(hdev, &hci_cc_table[i], skb);
4230 			break;
4231 		}
4232 	}
4233 
4234 	if (i == ARRAY_SIZE(hci_cc_table)) {
4235 		/* Unknown opcode, assume byte 0 contains the status, so
4236 		 * that e.g. __hci_cmd_sync() properly returns errors
4237 		 * for vendor specific commands send by HCI drivers.
4238 		 * If a vendor doesn't actually follow this convention we may
4239 		 * need to introduce a vendor CC table in order to properly set
4240 		 * the status.
4241 		 */
4242 		*status = skb->data[0];
4243 	}
4244 
4245 	handle_cmd_cnt_and_timer(hdev, ev->ncmd);
4246 
4247 	hci_req_cmd_complete(hdev, *opcode, *status, req_complete,
4248 			     req_complete_skb);
4249 
4250 	if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
4251 		bt_dev_err(hdev,
4252 			   "unexpected event for opcode 0x%4.4x", *opcode);
4253 		return;
4254 	}
4255 
4256 	if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
4257 		queue_work(hdev->workqueue, &hdev->cmd_work);
4258 }
4259 
hci_cs_le_create_cis(struct hci_dev * hdev,u8 status)4260 static void hci_cs_le_create_cis(struct hci_dev *hdev, u8 status)
4261 {
4262 	struct hci_cp_le_create_cis *cp;
4263 	bool pending = false;
4264 	int i;
4265 
4266 	bt_dev_dbg(hdev, "status 0x%2.2x", status);
4267 
4268 	if (!status)
4269 		return;
4270 
4271 	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CIS);
4272 	if (!cp)
4273 		return;
4274 
4275 	hci_dev_lock(hdev);
4276 
4277 	/* Remove connection if command failed */
4278 	for (i = 0; i < cp->num_cis; i++) {
4279 		struct hci_conn *conn;
4280 		u16 handle;
4281 
4282 		handle = __le16_to_cpu(cp->cis[i].cis_handle);
4283 
4284 		conn = hci_conn_hash_lookup_handle(hdev, handle);
4285 		if (conn) {
4286 			if (test_and_clear_bit(HCI_CONN_CREATE_CIS,
4287 					       &conn->flags))
4288 				pending = true;
4289 			conn->state = BT_CLOSED;
4290 			hci_connect_cfm(conn, status);
4291 			hci_conn_del(conn);
4292 		}
4293 	}
4294 	cp->num_cis = 0;
4295 
4296 	if (pending)
4297 		hci_le_create_cis_pending(hdev);
4298 
4299 	hci_dev_unlock(hdev);
4300 }
4301 
4302 #define HCI_CS(_op, _func) \
4303 { \
4304 	.op = _op, \
4305 	.func = _func, \
4306 }
4307 
4308 static const struct hci_cs {
4309 	u16  op;
4310 	void (*func)(struct hci_dev *hdev, __u8 status);
4311 } hci_cs_table[] = {
4312 	HCI_CS(HCI_OP_INQUIRY, hci_cs_inquiry),
4313 	HCI_CS(HCI_OP_CREATE_CONN, hci_cs_create_conn),
4314 	HCI_CS(HCI_OP_DISCONNECT, hci_cs_disconnect),
4315 	HCI_CS(HCI_OP_ADD_SCO, hci_cs_add_sco),
4316 	HCI_CS(HCI_OP_AUTH_REQUESTED, hci_cs_auth_requested),
4317 	HCI_CS(HCI_OP_SET_CONN_ENCRYPT, hci_cs_set_conn_encrypt),
4318 	HCI_CS(HCI_OP_REMOTE_NAME_REQ, hci_cs_remote_name_req),
4319 	HCI_CS(HCI_OP_READ_REMOTE_FEATURES, hci_cs_read_remote_features),
4320 	HCI_CS(HCI_OP_READ_REMOTE_EXT_FEATURES,
4321 	       hci_cs_read_remote_ext_features),
4322 	HCI_CS(HCI_OP_SETUP_SYNC_CONN, hci_cs_setup_sync_conn),
4323 	HCI_CS(HCI_OP_ENHANCED_SETUP_SYNC_CONN,
4324 	       hci_cs_enhanced_setup_sync_conn),
4325 	HCI_CS(HCI_OP_SNIFF_MODE, hci_cs_sniff_mode),
4326 	HCI_CS(HCI_OP_EXIT_SNIFF_MODE, hci_cs_exit_sniff_mode),
4327 	HCI_CS(HCI_OP_SWITCH_ROLE, hci_cs_switch_role),
4328 	HCI_CS(HCI_OP_LE_CREATE_CONN, hci_cs_le_create_conn),
4329 	HCI_CS(HCI_OP_LE_READ_REMOTE_FEATURES, hci_cs_le_read_remote_features),
4330 	HCI_CS(HCI_OP_LE_START_ENC, hci_cs_le_start_enc),
4331 	HCI_CS(HCI_OP_LE_EXT_CREATE_CONN, hci_cs_le_ext_create_conn),
4332 	HCI_CS(HCI_OP_LE_CREATE_CIS, hci_cs_le_create_cis),
4333 	HCI_CS(HCI_OP_LE_CREATE_BIG, hci_cs_le_create_big),
4334 };
4335 
hci_cmd_status_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb,u16 * opcode,u8 * status,hci_req_complete_t * req_complete,hci_req_complete_skb_t * req_complete_skb)4336 static void hci_cmd_status_evt(struct hci_dev *hdev, void *data,
4337 			       struct sk_buff *skb, u16 *opcode, u8 *status,
4338 			       hci_req_complete_t *req_complete,
4339 			       hci_req_complete_skb_t *req_complete_skb)
4340 {
4341 	struct hci_ev_cmd_status *ev = data;
4342 	int i;
4343 
4344 	*opcode = __le16_to_cpu(ev->opcode);
4345 	*status = ev->status;
4346 
4347 	bt_dev_dbg(hdev, "opcode 0x%4.4x", *opcode);
4348 
4349 	for (i = 0; i < ARRAY_SIZE(hci_cs_table); i++) {
4350 		if (hci_cs_table[i].op == *opcode) {
4351 			hci_cs_table[i].func(hdev, ev->status);
4352 			break;
4353 		}
4354 	}
4355 
4356 	handle_cmd_cnt_and_timer(hdev, ev->ncmd);
4357 
4358 	/* Indicate request completion if the command failed. Also, if
4359 	 * we're not waiting for a special event and we get a success
4360 	 * command status we should try to flag the request as completed
4361 	 * (since for this kind of commands there will not be a command
4362 	 * complete event).
4363 	 */
4364 	if (ev->status || (hdev->req_skb && !hci_skb_event(hdev->req_skb))) {
4365 		hci_req_cmd_complete(hdev, *opcode, ev->status, req_complete,
4366 				     req_complete_skb);
4367 		if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
4368 			bt_dev_err(hdev, "unexpected event for opcode 0x%4.4x",
4369 				   *opcode);
4370 			return;
4371 		}
4372 	}
4373 
4374 	if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
4375 		queue_work(hdev->workqueue, &hdev->cmd_work);
4376 }
4377 
hci_hardware_error_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)4378 static void hci_hardware_error_evt(struct hci_dev *hdev, void *data,
4379 				   struct sk_buff *skb)
4380 {
4381 	struct hci_ev_hardware_error *ev = data;
4382 
4383 	bt_dev_dbg(hdev, "code 0x%2.2x", ev->code);
4384 
4385 	hdev->hw_error_code = ev->code;
4386 
4387 	queue_work(hdev->req_workqueue, &hdev->error_reset);
4388 }
4389 
hci_role_change_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)4390 static void hci_role_change_evt(struct hci_dev *hdev, void *data,
4391 				struct sk_buff *skb)
4392 {
4393 	struct hci_ev_role_change *ev = data;
4394 	struct hci_conn *conn;
4395 
4396 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
4397 
4398 	hci_dev_lock(hdev);
4399 
4400 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4401 	if (conn) {
4402 		if (!ev->status)
4403 			conn->role = ev->role;
4404 
4405 		clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
4406 
4407 		hci_role_switch_cfm(conn, ev->status, ev->role);
4408 	}
4409 
4410 	hci_dev_unlock(hdev);
4411 }
4412 
hci_num_comp_pkts_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)4413 static void hci_num_comp_pkts_evt(struct hci_dev *hdev, void *data,
4414 				  struct sk_buff *skb)
4415 {
4416 	struct hci_ev_num_comp_pkts *ev = data;
4417 	int i;
4418 
4419 	if (!hci_ev_skb_pull(hdev, skb, HCI_EV_NUM_COMP_PKTS,
4420 			     flex_array_size(ev, handles, ev->num)))
4421 		return;
4422 
4423 	bt_dev_dbg(hdev, "num %d", ev->num);
4424 
4425 	for (i = 0; i < ev->num; i++) {
4426 		struct hci_comp_pkts_info *info = &ev->handles[i];
4427 		struct hci_conn *conn;
4428 		__u16  handle, count;
4429 		unsigned int i;
4430 
4431 		handle = __le16_to_cpu(info->handle);
4432 		count  = __le16_to_cpu(info->count);
4433 
4434 		conn = hci_conn_hash_lookup_handle(hdev, handle);
4435 		if (!conn)
4436 			continue;
4437 
4438 		conn->sent -= count;
4439 
4440 		for (i = 0; i < count; ++i)
4441 			hci_conn_tx_dequeue(conn);
4442 
4443 		switch (conn->type) {
4444 		case ACL_LINK:
4445 			hdev->acl_cnt += count;
4446 			if (hdev->acl_cnt > hdev->acl_pkts)
4447 				hdev->acl_cnt = hdev->acl_pkts;
4448 			break;
4449 
4450 		case LE_LINK:
4451 			if (hdev->le_pkts) {
4452 				hdev->le_cnt += count;
4453 				if (hdev->le_cnt > hdev->le_pkts)
4454 					hdev->le_cnt = hdev->le_pkts;
4455 			} else {
4456 				hdev->acl_cnt += count;
4457 				if (hdev->acl_cnt > hdev->acl_pkts)
4458 					hdev->acl_cnt = hdev->acl_pkts;
4459 			}
4460 			break;
4461 
4462 		case SCO_LINK:
4463 		case ESCO_LINK:
4464 			hdev->sco_cnt += count;
4465 			if (hdev->sco_cnt > hdev->sco_pkts)
4466 				hdev->sco_cnt = hdev->sco_pkts;
4467 
4468 			break;
4469 
4470 		case ISO_LINK:
4471 			if (hdev->iso_pkts) {
4472 				hdev->iso_cnt += count;
4473 				if (hdev->iso_cnt > hdev->iso_pkts)
4474 					hdev->iso_cnt = hdev->iso_pkts;
4475 			} else if (hdev->le_pkts) {
4476 				hdev->le_cnt += count;
4477 				if (hdev->le_cnt > hdev->le_pkts)
4478 					hdev->le_cnt = hdev->le_pkts;
4479 			} else {
4480 				hdev->acl_cnt += count;
4481 				if (hdev->acl_cnt > hdev->acl_pkts)
4482 					hdev->acl_cnt = hdev->acl_pkts;
4483 			}
4484 			break;
4485 
4486 		default:
4487 			bt_dev_err(hdev, "unknown type %d conn %p",
4488 				   conn->type, conn);
4489 			break;
4490 		}
4491 	}
4492 
4493 	queue_work(hdev->workqueue, &hdev->tx_work);
4494 }
4495 
hci_mode_change_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)4496 static void hci_mode_change_evt(struct hci_dev *hdev, void *data,
4497 				struct sk_buff *skb)
4498 {
4499 	struct hci_ev_mode_change *ev = data;
4500 	struct hci_conn *conn;
4501 
4502 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
4503 
4504 	hci_dev_lock(hdev);
4505 
4506 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4507 	if (conn) {
4508 		conn->mode = ev->mode;
4509 
4510 		if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND,
4511 					&conn->flags)) {
4512 			if (conn->mode == HCI_CM_ACTIVE)
4513 				set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
4514 			else
4515 				clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
4516 		}
4517 
4518 		if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
4519 			hci_sco_setup(conn, ev->status);
4520 	}
4521 
4522 	hci_dev_unlock(hdev);
4523 }
4524 
hci_pin_code_request_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)4525 static void hci_pin_code_request_evt(struct hci_dev *hdev, void *data,
4526 				     struct sk_buff *skb)
4527 {
4528 	struct hci_ev_pin_code_req *ev = data;
4529 	struct hci_conn *conn;
4530 
4531 	bt_dev_dbg(hdev, "");
4532 
4533 	hci_dev_lock(hdev);
4534 
4535 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4536 	if (!conn)
4537 		goto unlock;
4538 
4539 	if (conn->state == BT_CONNECTED) {
4540 		hci_conn_hold(conn);
4541 		conn->disc_timeout = HCI_PAIRING_TIMEOUT;
4542 		hci_conn_drop(conn);
4543 	}
4544 
4545 	if (!hci_dev_test_flag(hdev, HCI_BONDABLE) &&
4546 	    !test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags)) {
4547 		hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
4548 			     sizeof(ev->bdaddr), &ev->bdaddr);
4549 	} else if (hci_dev_test_flag(hdev, HCI_MGMT)) {
4550 		u8 secure;
4551 
4552 		if (conn->pending_sec_level == BT_SECURITY_HIGH)
4553 			secure = 1;
4554 		else
4555 			secure = 0;
4556 
4557 		mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
4558 	}
4559 
4560 unlock:
4561 	hci_dev_unlock(hdev);
4562 }
4563 
conn_set_key(struct hci_conn * conn,u8 key_type,u8 pin_len)4564 static void conn_set_key(struct hci_conn *conn, u8 key_type, u8 pin_len)
4565 {
4566 	if (key_type == HCI_LK_CHANGED_COMBINATION)
4567 		return;
4568 
4569 	conn->pin_length = pin_len;
4570 	conn->key_type = key_type;
4571 
4572 	switch (key_type) {
4573 	case HCI_LK_LOCAL_UNIT:
4574 	case HCI_LK_REMOTE_UNIT:
4575 	case HCI_LK_DEBUG_COMBINATION:
4576 		return;
4577 	case HCI_LK_COMBINATION:
4578 		if (pin_len == 16)
4579 			conn->pending_sec_level = BT_SECURITY_HIGH;
4580 		else
4581 			conn->pending_sec_level = BT_SECURITY_MEDIUM;
4582 		break;
4583 	case HCI_LK_UNAUTH_COMBINATION_P192:
4584 	case HCI_LK_UNAUTH_COMBINATION_P256:
4585 		conn->pending_sec_level = BT_SECURITY_MEDIUM;
4586 		break;
4587 	case HCI_LK_AUTH_COMBINATION_P192:
4588 		conn->pending_sec_level = BT_SECURITY_HIGH;
4589 		break;
4590 	case HCI_LK_AUTH_COMBINATION_P256:
4591 		conn->pending_sec_level = BT_SECURITY_FIPS;
4592 		break;
4593 	}
4594 }
4595 
hci_link_key_request_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)4596 static void hci_link_key_request_evt(struct hci_dev *hdev, void *data,
4597 				     struct sk_buff *skb)
4598 {
4599 	struct hci_ev_link_key_req *ev = data;
4600 	struct hci_cp_link_key_reply cp;
4601 	struct hci_conn *conn;
4602 	struct link_key *key;
4603 
4604 	bt_dev_dbg(hdev, "");
4605 
4606 	if (!hci_dev_test_flag(hdev, HCI_MGMT))
4607 		return;
4608 
4609 	hci_dev_lock(hdev);
4610 
4611 	key = hci_find_link_key(hdev, &ev->bdaddr);
4612 	if (!key) {
4613 		bt_dev_dbg(hdev, "link key not found for %pMR", &ev->bdaddr);
4614 		goto not_found;
4615 	}
4616 
4617 	bt_dev_dbg(hdev, "found key type %u for %pMR", key->type, &ev->bdaddr);
4618 
4619 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4620 	if (conn) {
4621 		clear_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
4622 
4623 		if ((key->type == HCI_LK_UNAUTH_COMBINATION_P192 ||
4624 		     key->type == HCI_LK_UNAUTH_COMBINATION_P256) &&
4625 		    conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
4626 			bt_dev_dbg(hdev, "ignoring unauthenticated key");
4627 			goto not_found;
4628 		}
4629 
4630 		if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
4631 		    (conn->pending_sec_level == BT_SECURITY_HIGH ||
4632 		     conn->pending_sec_level == BT_SECURITY_FIPS)) {
4633 			bt_dev_dbg(hdev, "ignoring key unauthenticated for high security");
4634 			goto not_found;
4635 		}
4636 
4637 		conn_set_key(conn, key->type, key->pin_len);
4638 	}
4639 
4640 	bacpy(&cp.bdaddr, &ev->bdaddr);
4641 	memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);
4642 
4643 	hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
4644 
4645 	hci_dev_unlock(hdev);
4646 
4647 	return;
4648 
4649 not_found:
4650 	hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
4651 	hci_dev_unlock(hdev);
4652 }
4653 
hci_link_key_notify_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)4654 static void hci_link_key_notify_evt(struct hci_dev *hdev, void *data,
4655 				    struct sk_buff *skb)
4656 {
4657 	struct hci_ev_link_key_notify *ev = data;
4658 	struct hci_conn *conn;
4659 	struct link_key *key;
4660 	bool persistent;
4661 	u8 pin_len = 0;
4662 
4663 	bt_dev_dbg(hdev, "");
4664 
4665 	hci_dev_lock(hdev);
4666 
4667 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4668 	if (!conn)
4669 		goto unlock;
4670 
4671 	/* Ignore NULL link key against CVE-2020-26555 */
4672 	if (!crypto_memneq(ev->link_key, ZERO_KEY, HCI_LINK_KEY_SIZE)) {
4673 		bt_dev_dbg(hdev, "Ignore NULL link key (ZERO KEY) for %pMR",
4674 			   &ev->bdaddr);
4675 		hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
4676 		hci_conn_drop(conn);
4677 		goto unlock;
4678 	}
4679 
4680 	hci_conn_hold(conn);
4681 	conn->disc_timeout = HCI_DISCONN_TIMEOUT;
4682 	hci_conn_drop(conn);
4683 
4684 	set_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
4685 	conn_set_key(conn, ev->key_type, conn->pin_length);
4686 
4687 	if (!hci_dev_test_flag(hdev, HCI_MGMT))
4688 		goto unlock;
4689 
4690 	key = hci_add_link_key(hdev, conn, &ev->bdaddr, ev->link_key,
4691 			        ev->key_type, pin_len, &persistent);
4692 	if (!key)
4693 		goto unlock;
4694 
4695 	/* Update connection information since adding the key will have
4696 	 * fixed up the type in the case of changed combination keys.
4697 	 */
4698 	if (ev->key_type == HCI_LK_CHANGED_COMBINATION)
4699 		conn_set_key(conn, key->type, key->pin_len);
4700 
4701 	mgmt_new_link_key(hdev, key, persistent);
4702 
4703 	/* Keep debug keys around only if the HCI_KEEP_DEBUG_KEYS flag
4704 	 * is set. If it's not set simply remove the key from the kernel
4705 	 * list (we've still notified user space about it but with
4706 	 * store_hint being 0).
4707 	 */
4708 	if (key->type == HCI_LK_DEBUG_COMBINATION &&
4709 	    !hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) {
4710 		list_del_rcu(&key->list);
4711 		kfree_rcu(key, rcu);
4712 		goto unlock;
4713 	}
4714 
4715 	if (persistent)
4716 		clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
4717 	else
4718 		set_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
4719 
4720 unlock:
4721 	hci_dev_unlock(hdev);
4722 }
4723 
hci_clock_offset_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)4724 static void hci_clock_offset_evt(struct hci_dev *hdev, void *data,
4725 				 struct sk_buff *skb)
4726 {
4727 	struct hci_ev_clock_offset *ev = data;
4728 	struct hci_conn *conn;
4729 
4730 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
4731 
4732 	hci_dev_lock(hdev);
4733 
4734 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4735 	if (conn && !ev->status) {
4736 		struct inquiry_entry *ie;
4737 
4738 		ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
4739 		if (ie) {
4740 			ie->data.clock_offset = ev->clock_offset;
4741 			ie->timestamp = jiffies;
4742 		}
4743 	}
4744 
4745 	hci_dev_unlock(hdev);
4746 }
4747 
hci_pkt_type_change_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)4748 static void hci_pkt_type_change_evt(struct hci_dev *hdev, void *data,
4749 				    struct sk_buff *skb)
4750 {
4751 	struct hci_ev_pkt_type_change *ev = data;
4752 	struct hci_conn *conn;
4753 
4754 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
4755 
4756 	hci_dev_lock(hdev);
4757 
4758 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4759 	if (conn && !ev->status)
4760 		conn->pkt_type = __le16_to_cpu(ev->pkt_type);
4761 
4762 	hci_dev_unlock(hdev);
4763 }
4764 
hci_pscan_rep_mode_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)4765 static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, void *data,
4766 				   struct sk_buff *skb)
4767 {
4768 	struct hci_ev_pscan_rep_mode *ev = data;
4769 	struct inquiry_entry *ie;
4770 
4771 	bt_dev_dbg(hdev, "");
4772 
4773 	hci_dev_lock(hdev);
4774 
4775 	ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
4776 	if (ie) {
4777 		ie->data.pscan_rep_mode = ev->pscan_rep_mode;
4778 		ie->timestamp = jiffies;
4779 	}
4780 
4781 	hci_dev_unlock(hdev);
4782 }
4783 
hci_inquiry_result_with_rssi_evt(struct hci_dev * hdev,void * edata,struct sk_buff * skb)4784 static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, void *edata,
4785 					     struct sk_buff *skb)
4786 {
4787 	struct hci_ev_inquiry_result_rssi *ev = edata;
4788 	struct inquiry_data data;
4789 	int i;
4790 
4791 	bt_dev_dbg(hdev, "num_rsp %d", ev->num);
4792 
4793 	if (!ev->num)
4794 		return;
4795 
4796 	if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
4797 		return;
4798 
4799 	hci_dev_lock(hdev);
4800 
4801 	if (skb->len == array_size(ev->num,
4802 				   sizeof(struct inquiry_info_rssi_pscan))) {
4803 		struct inquiry_info_rssi_pscan *info;
4804 
4805 		for (i = 0; i < ev->num; i++) {
4806 			u32 flags;
4807 
4808 			info = hci_ev_skb_pull(hdev, skb,
4809 					       HCI_EV_INQUIRY_RESULT_WITH_RSSI,
4810 					       sizeof(*info));
4811 			if (!info) {
4812 				bt_dev_err(hdev, "Malformed HCI Event: 0x%2.2x",
4813 					   HCI_EV_INQUIRY_RESULT_WITH_RSSI);
4814 				goto unlock;
4815 			}
4816 
4817 			bacpy(&data.bdaddr, &info->bdaddr);
4818 			data.pscan_rep_mode	= info->pscan_rep_mode;
4819 			data.pscan_period_mode	= info->pscan_period_mode;
4820 			data.pscan_mode		= info->pscan_mode;
4821 			memcpy(data.dev_class, info->dev_class, 3);
4822 			data.clock_offset	= info->clock_offset;
4823 			data.rssi		= info->rssi;
4824 			data.ssp_mode		= 0x00;
4825 
4826 			flags = hci_inquiry_cache_update(hdev, &data, false);
4827 
4828 			mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4829 					  info->dev_class, info->rssi,
4830 					  flags, NULL, 0, NULL, 0, 0);
4831 		}
4832 	} else if (skb->len == array_size(ev->num,
4833 					  sizeof(struct inquiry_info_rssi))) {
4834 		struct inquiry_info_rssi *info;
4835 
4836 		for (i = 0; i < ev->num; i++) {
4837 			u32 flags;
4838 
4839 			info = hci_ev_skb_pull(hdev, skb,
4840 					       HCI_EV_INQUIRY_RESULT_WITH_RSSI,
4841 					       sizeof(*info));
4842 			if (!info) {
4843 				bt_dev_err(hdev, "Malformed HCI Event: 0x%2.2x",
4844 					   HCI_EV_INQUIRY_RESULT_WITH_RSSI);
4845 				goto unlock;
4846 			}
4847 
4848 			bacpy(&data.bdaddr, &info->bdaddr);
4849 			data.pscan_rep_mode	= info->pscan_rep_mode;
4850 			data.pscan_period_mode	= info->pscan_period_mode;
4851 			data.pscan_mode		= 0x00;
4852 			memcpy(data.dev_class, info->dev_class, 3);
4853 			data.clock_offset	= info->clock_offset;
4854 			data.rssi		= info->rssi;
4855 			data.ssp_mode		= 0x00;
4856 
4857 			flags = hci_inquiry_cache_update(hdev, &data, false);
4858 
4859 			mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4860 					  info->dev_class, info->rssi,
4861 					  flags, NULL, 0, NULL, 0, 0);
4862 		}
4863 	} else {
4864 		bt_dev_err(hdev, "Malformed HCI Event: 0x%2.2x",
4865 			   HCI_EV_INQUIRY_RESULT_WITH_RSSI);
4866 	}
4867 unlock:
4868 	hci_dev_unlock(hdev);
4869 }
4870 
hci_remote_ext_features_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)4871 static void hci_remote_ext_features_evt(struct hci_dev *hdev, void *data,
4872 					struct sk_buff *skb)
4873 {
4874 	struct hci_ev_remote_ext_features *ev = data;
4875 	struct hci_conn *conn;
4876 
4877 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
4878 
4879 	hci_dev_lock(hdev);
4880 
4881 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4882 	if (!conn)
4883 		goto unlock;
4884 
4885 	if (ev->page < HCI_MAX_PAGES)
4886 		memcpy(conn->features[ev->page], ev->features, 8);
4887 
4888 	if (!ev->status && ev->page == 0x01) {
4889 		struct inquiry_entry *ie;
4890 
4891 		ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
4892 		if (ie)
4893 			ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
4894 
4895 		if (ev->features[0] & LMP_HOST_SSP) {
4896 			set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
4897 		} else {
4898 			/* It is mandatory by the Bluetooth specification that
4899 			 * Extended Inquiry Results are only used when Secure
4900 			 * Simple Pairing is enabled, but some devices violate
4901 			 * this.
4902 			 *
4903 			 * To make these devices work, the internal SSP
4904 			 * enabled flag needs to be cleared if the remote host
4905 			 * features do not indicate SSP support */
4906 			clear_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
4907 		}
4908 
4909 		if (ev->features[0] & LMP_HOST_SC)
4910 			set_bit(HCI_CONN_SC_ENABLED, &conn->flags);
4911 	}
4912 
4913 	if (conn->state != BT_CONFIG)
4914 		goto unlock;
4915 
4916 	if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
4917 		struct hci_cp_remote_name_req cp;
4918 		memset(&cp, 0, sizeof(cp));
4919 		bacpy(&cp.bdaddr, &conn->dst);
4920 		cp.pscan_rep_mode = 0x02;
4921 		hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
4922 	} else {
4923 		mgmt_device_connected(hdev, conn, NULL, 0);
4924 	}
4925 
4926 	if (!hci_outgoing_auth_needed(hdev, conn)) {
4927 		conn->state = BT_CONNECTED;
4928 		hci_connect_cfm(conn, ev->status);
4929 		hci_conn_drop(conn);
4930 	}
4931 
4932 unlock:
4933 	hci_dev_unlock(hdev);
4934 }
4935 
hci_sync_conn_complete_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)4936 static void hci_sync_conn_complete_evt(struct hci_dev *hdev, void *data,
4937 				       struct sk_buff *skb)
4938 {
4939 	struct hci_ev_sync_conn_complete *ev = data;
4940 	struct hci_conn *conn;
4941 	u8 status = ev->status;
4942 
4943 	switch (ev->link_type) {
4944 	case SCO_LINK:
4945 	case ESCO_LINK:
4946 		break;
4947 	default:
4948 		/* As per Core 5.3 Vol 4 Part E 7.7.35 (p.2219), Link_Type
4949 		 * for HCI_Synchronous_Connection_Complete is limited to
4950 		 * either SCO or eSCO
4951 		 */
4952 		bt_dev_err(hdev, "Ignoring connect complete event for invalid link type");
4953 		return;
4954 	}
4955 
4956 	bt_dev_dbg(hdev, "status 0x%2.2x", status);
4957 
4958 	hci_dev_lock(hdev);
4959 
4960 	conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
4961 	if (!conn) {
4962 		if (ev->link_type == ESCO_LINK)
4963 			goto unlock;
4964 
4965 		/* When the link type in the event indicates SCO connection
4966 		 * and lookup of the connection object fails, then check
4967 		 * if an eSCO connection object exists.
4968 		 *
4969 		 * The core limits the synchronous connections to either
4970 		 * SCO or eSCO. The eSCO connection is preferred and tried
4971 		 * to be setup first and until successfully established,
4972 		 * the link type will be hinted as eSCO.
4973 		 */
4974 		conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
4975 		if (!conn)
4976 			goto unlock;
4977 	}
4978 
4979 	/* The HCI_Synchronous_Connection_Complete event is only sent once per connection.
4980 	 * Processing it more than once per connection can corrupt kernel memory.
4981 	 *
4982 	 * As the connection handle is set here for the first time, it indicates
4983 	 * whether the connection is already set up.
4984 	 */
4985 	if (!HCI_CONN_HANDLE_UNSET(conn->handle)) {
4986 		bt_dev_err(hdev, "Ignoring HCI_Sync_Conn_Complete event for existing connection");
4987 		goto unlock;
4988 	}
4989 
4990 	switch (status) {
4991 	case 0x00:
4992 		status = hci_conn_set_handle(conn, __le16_to_cpu(ev->handle));
4993 		if (status) {
4994 			conn->state = BT_CLOSED;
4995 			break;
4996 		}
4997 
4998 		conn->state  = BT_CONNECTED;
4999 		conn->type   = ev->link_type;
5000 
5001 		hci_debugfs_create_conn(conn);
5002 		hci_conn_add_sysfs(conn);
5003 		break;
5004 
5005 	case 0x10:	/* Connection Accept Timeout */
5006 	case 0x0d:	/* Connection Rejected due to Limited Resources */
5007 	case 0x11:	/* Unsupported Feature or Parameter Value */
5008 	case 0x1c:	/* SCO interval rejected */
5009 	case 0x1a:	/* Unsupported Remote Feature */
5010 	case 0x1e:	/* Invalid LMP Parameters */
5011 	case 0x1f:	/* Unspecified error */
5012 	case 0x20:	/* Unsupported LMP Parameter value */
5013 		if (conn->out) {
5014 			conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
5015 					(hdev->esco_type & EDR_ESCO_MASK);
5016 			if (hci_setup_sync(conn, conn->parent->handle))
5017 				goto unlock;
5018 		}
5019 		fallthrough;
5020 
5021 	default:
5022 		conn->state = BT_CLOSED;
5023 		break;
5024 	}
5025 
5026 	bt_dev_dbg(hdev, "SCO connected with air mode: %02x", ev->air_mode);
5027 	/* Notify only in case of SCO over HCI transport data path which
5028 	 * is zero and non-zero value shall be non-HCI transport data path
5029 	 */
5030 	if (conn->codec.data_path == 0 && hdev->notify) {
5031 		switch (ev->air_mode) {
5032 		case 0x02:
5033 			hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_CVSD);
5034 			break;
5035 		case 0x03:
5036 			hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_TRANSP);
5037 			break;
5038 		}
5039 	}
5040 
5041 	hci_connect_cfm(conn, status);
5042 	if (status)
5043 		hci_conn_del(conn);
5044 
5045 unlock:
5046 	hci_dev_unlock(hdev);
5047 }
5048 
eir_get_length(u8 * eir,size_t eir_len)5049 static inline size_t eir_get_length(u8 *eir, size_t eir_len)
5050 {
5051 	size_t parsed = 0;
5052 
5053 	while (parsed < eir_len) {
5054 		u8 field_len = eir[0];
5055 
5056 		if (field_len == 0)
5057 			return parsed;
5058 
5059 		parsed += field_len + 1;
5060 		eir += field_len + 1;
5061 	}
5062 
5063 	return eir_len;
5064 }
5065 
hci_extended_inquiry_result_evt(struct hci_dev * hdev,void * edata,struct sk_buff * skb)5066 static void hci_extended_inquiry_result_evt(struct hci_dev *hdev, void *edata,
5067 					    struct sk_buff *skb)
5068 {
5069 	struct hci_ev_ext_inquiry_result *ev = edata;
5070 	struct inquiry_data data;
5071 	size_t eir_len;
5072 	int i;
5073 
5074 	if (!hci_ev_skb_pull(hdev, skb, HCI_EV_EXTENDED_INQUIRY_RESULT,
5075 			     flex_array_size(ev, info, ev->num)))
5076 		return;
5077 
5078 	bt_dev_dbg(hdev, "num %d", ev->num);
5079 
5080 	if (!ev->num)
5081 		return;
5082 
5083 	if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
5084 		return;
5085 
5086 	hci_dev_lock(hdev);
5087 
5088 	for (i = 0; i < ev->num; i++) {
5089 		struct extended_inquiry_info *info = &ev->info[i];
5090 		u32 flags;
5091 		bool name_known;
5092 
5093 		bacpy(&data.bdaddr, &info->bdaddr);
5094 		data.pscan_rep_mode	= info->pscan_rep_mode;
5095 		data.pscan_period_mode	= info->pscan_period_mode;
5096 		data.pscan_mode		= 0x00;
5097 		memcpy(data.dev_class, info->dev_class, 3);
5098 		data.clock_offset	= info->clock_offset;
5099 		data.rssi		= info->rssi;
5100 		data.ssp_mode		= 0x01;
5101 
5102 		if (hci_dev_test_flag(hdev, HCI_MGMT))
5103 			name_known = eir_get_data(info->data,
5104 						  sizeof(info->data),
5105 						  EIR_NAME_COMPLETE, NULL);
5106 		else
5107 			name_known = true;
5108 
5109 		flags = hci_inquiry_cache_update(hdev, &data, name_known);
5110 
5111 		eir_len = eir_get_length(info->data, sizeof(info->data));
5112 
5113 		mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
5114 				  info->dev_class, info->rssi,
5115 				  flags, info->data, eir_len, NULL, 0, 0);
5116 	}
5117 
5118 	hci_dev_unlock(hdev);
5119 }
5120 
hci_key_refresh_complete_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)5121 static void hci_key_refresh_complete_evt(struct hci_dev *hdev, void *data,
5122 					 struct sk_buff *skb)
5123 {
5124 	struct hci_ev_key_refresh_complete *ev = data;
5125 	struct hci_conn *conn;
5126 
5127 	bt_dev_dbg(hdev, "status 0x%2.2x handle 0x%4.4x", ev->status,
5128 		   __le16_to_cpu(ev->handle));
5129 
5130 	hci_dev_lock(hdev);
5131 
5132 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5133 	if (!conn)
5134 		goto unlock;
5135 
5136 	/* For BR/EDR the necessary steps are taken through the
5137 	 * auth_complete event.
5138 	 */
5139 	if (conn->type != LE_LINK)
5140 		goto unlock;
5141 
5142 	if (!ev->status)
5143 		conn->sec_level = conn->pending_sec_level;
5144 
5145 	clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
5146 
5147 	if (ev->status && conn->state == BT_CONNECTED) {
5148 		hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
5149 		hci_conn_drop(conn);
5150 		goto unlock;
5151 	}
5152 
5153 	if (conn->state == BT_CONFIG) {
5154 		if (!ev->status)
5155 			conn->state = BT_CONNECTED;
5156 
5157 		hci_connect_cfm(conn, ev->status);
5158 		hci_conn_drop(conn);
5159 	} else {
5160 		hci_auth_cfm(conn, ev->status);
5161 
5162 		hci_conn_hold(conn);
5163 		conn->disc_timeout = HCI_DISCONN_TIMEOUT;
5164 		hci_conn_drop(conn);
5165 	}
5166 
5167 unlock:
5168 	hci_dev_unlock(hdev);
5169 }
5170 
hci_get_auth_req(struct hci_conn * conn)5171 static u8 hci_get_auth_req(struct hci_conn *conn)
5172 {
5173 	/* If remote requests no-bonding follow that lead */
5174 	if (conn->remote_auth == HCI_AT_NO_BONDING ||
5175 	    conn->remote_auth == HCI_AT_NO_BONDING_MITM)
5176 		return conn->remote_auth | (conn->auth_type & 0x01);
5177 
5178 	/* If both remote and local have enough IO capabilities, require
5179 	 * MITM protection
5180 	 */
5181 	if (conn->remote_cap != HCI_IO_NO_INPUT_OUTPUT &&
5182 	    conn->io_capability != HCI_IO_NO_INPUT_OUTPUT)
5183 		return conn->remote_auth | 0x01;
5184 
5185 	/* No MITM protection possible so ignore remote requirement */
5186 	return (conn->remote_auth & ~0x01) | (conn->auth_type & 0x01);
5187 }
5188 
bredr_oob_data_present(struct hci_conn * conn)5189 static u8 bredr_oob_data_present(struct hci_conn *conn)
5190 {
5191 	struct hci_dev *hdev = conn->hdev;
5192 	struct oob_data *data;
5193 
5194 	data = hci_find_remote_oob_data(hdev, &conn->dst, BDADDR_BREDR);
5195 	if (!data)
5196 		return 0x00;
5197 
5198 	if (bredr_sc_enabled(hdev)) {
5199 		/* When Secure Connections is enabled, then just
5200 		 * return the present value stored with the OOB
5201 		 * data. The stored value contains the right present
5202 		 * information. However it can only be trusted when
5203 		 * not in Secure Connection Only mode.
5204 		 */
5205 		if (!hci_dev_test_flag(hdev, HCI_SC_ONLY))
5206 			return data->present;
5207 
5208 		/* When Secure Connections Only mode is enabled, then
5209 		 * the P-256 values are required. If they are not
5210 		 * available, then do not declare that OOB data is
5211 		 * present.
5212 		 */
5213 		if (!crypto_memneq(data->rand256, ZERO_KEY, 16) ||
5214 		    !crypto_memneq(data->hash256, ZERO_KEY, 16))
5215 			return 0x00;
5216 
5217 		return 0x02;
5218 	}
5219 
5220 	/* When Secure Connections is not enabled or actually
5221 	 * not supported by the hardware, then check that if
5222 	 * P-192 data values are present.
5223 	 */
5224 	if (!crypto_memneq(data->rand192, ZERO_KEY, 16) ||
5225 	    !crypto_memneq(data->hash192, ZERO_KEY, 16))
5226 		return 0x00;
5227 
5228 	return 0x01;
5229 }
5230 
hci_io_capa_request_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)5231 static void hci_io_capa_request_evt(struct hci_dev *hdev, void *data,
5232 				    struct sk_buff *skb)
5233 {
5234 	struct hci_ev_io_capa_request *ev = data;
5235 	struct hci_conn *conn;
5236 
5237 	bt_dev_dbg(hdev, "");
5238 
5239 	hci_dev_lock(hdev);
5240 
5241 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
5242 	if (!conn || !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
5243 		goto unlock;
5244 
5245 	/* Assume remote supports SSP since it has triggered this event */
5246 	set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
5247 
5248 	hci_conn_hold(conn);
5249 
5250 	if (!hci_dev_test_flag(hdev, HCI_MGMT))
5251 		goto unlock;
5252 
5253 	/* Allow pairing if we're pairable, the initiators of the
5254 	 * pairing or if the remote is not requesting bonding.
5255 	 */
5256 	if (hci_dev_test_flag(hdev, HCI_BONDABLE) ||
5257 	    test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags) ||
5258 	    (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
5259 		struct hci_cp_io_capability_reply cp;
5260 
5261 		bacpy(&cp.bdaddr, &ev->bdaddr);
5262 		/* Change the IO capability from KeyboardDisplay
5263 		 * to DisplayYesNo as it is not supported by BT spec. */
5264 		cp.capability = (conn->io_capability == 0x04) ?
5265 				HCI_IO_DISPLAY_YESNO : conn->io_capability;
5266 
5267 		/* If we are initiators, there is no remote information yet */
5268 		if (conn->remote_auth == 0xff) {
5269 			/* Request MITM protection if our IO caps allow it
5270 			 * except for the no-bonding case.
5271 			 */
5272 			if (conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
5273 			    conn->auth_type != HCI_AT_NO_BONDING)
5274 				conn->auth_type |= 0x01;
5275 		} else {
5276 			conn->auth_type = hci_get_auth_req(conn);
5277 		}
5278 
5279 		/* If we're not bondable, force one of the non-bondable
5280 		 * authentication requirement values.
5281 		 */
5282 		if (!hci_dev_test_flag(hdev, HCI_BONDABLE))
5283 			conn->auth_type &= HCI_AT_NO_BONDING_MITM;
5284 
5285 		cp.authentication = conn->auth_type;
5286 		cp.oob_data = bredr_oob_data_present(conn);
5287 
5288 		hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
5289 			     sizeof(cp), &cp);
5290 	} else {
5291 		struct hci_cp_io_capability_neg_reply cp;
5292 
5293 		bacpy(&cp.bdaddr, &ev->bdaddr);
5294 		cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
5295 
5296 		hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
5297 			     sizeof(cp), &cp);
5298 	}
5299 
5300 unlock:
5301 	hci_dev_unlock(hdev);
5302 }
5303 
hci_io_capa_reply_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)5304 static void hci_io_capa_reply_evt(struct hci_dev *hdev, void *data,
5305 				  struct sk_buff *skb)
5306 {
5307 	struct hci_ev_io_capa_reply *ev = data;
5308 	struct hci_conn *conn;
5309 
5310 	bt_dev_dbg(hdev, "");
5311 
5312 	hci_dev_lock(hdev);
5313 
5314 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
5315 	if (!conn)
5316 		goto unlock;
5317 
5318 	conn->remote_cap = ev->capability;
5319 	conn->remote_auth = ev->authentication;
5320 
5321 unlock:
5322 	hci_dev_unlock(hdev);
5323 }
5324 
hci_user_confirm_request_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)5325 static void hci_user_confirm_request_evt(struct hci_dev *hdev, void *data,
5326 					 struct sk_buff *skb)
5327 {
5328 	struct hci_ev_user_confirm_req *ev = data;
5329 	int loc_mitm, rem_mitm, confirm_hint = 0;
5330 	struct hci_conn *conn;
5331 
5332 	bt_dev_dbg(hdev, "");
5333 
5334 	hci_dev_lock(hdev);
5335 
5336 	if (!hci_dev_test_flag(hdev, HCI_MGMT))
5337 		goto unlock;
5338 
5339 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
5340 	if (!conn)
5341 		goto unlock;
5342 
5343 	loc_mitm = (conn->auth_type & 0x01);
5344 	rem_mitm = (conn->remote_auth & 0x01);
5345 
5346 	/* If we require MITM but the remote device can't provide that
5347 	 * (it has NoInputNoOutput) then reject the confirmation
5348 	 * request. We check the security level here since it doesn't
5349 	 * necessarily match conn->auth_type.
5350 	 */
5351 	if (conn->pending_sec_level > BT_SECURITY_MEDIUM &&
5352 	    conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
5353 		bt_dev_dbg(hdev, "Rejecting request: remote device can't provide MITM");
5354 		hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
5355 			     sizeof(ev->bdaddr), &ev->bdaddr);
5356 		goto unlock;
5357 	}
5358 
5359 	/* If no side requires MITM protection; use JUST_CFM method */
5360 	if ((!loc_mitm || conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) &&
5361 	    (!rem_mitm || conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)) {
5362 
5363 		/* If we're not the initiator of request authorization and the
5364 		 * local IO capability is not NoInputNoOutput, use JUST_WORKS
5365 		 * method (mgmt_user_confirm with confirm_hint set to 1).
5366 		 */
5367 		if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&
5368 		    conn->io_capability != HCI_IO_NO_INPUT_OUTPUT) {
5369 			bt_dev_dbg(hdev, "Confirming auto-accept as acceptor");
5370 			confirm_hint = 1;
5371 			goto confirm;
5372 		}
5373 
5374 		/* If there already exists link key in local host, leave the
5375 		 * decision to user space since the remote device could be
5376 		 * legitimate or malicious.
5377 		 */
5378 		if (hci_find_link_key(hdev, &ev->bdaddr)) {
5379 			bt_dev_dbg(hdev, "Local host already has link key");
5380 			confirm_hint = 1;
5381 			goto confirm;
5382 		}
5383 
5384 		BT_DBG("Auto-accept of user confirmation with %ums delay",
5385 		       hdev->auto_accept_delay);
5386 
5387 		if (hdev->auto_accept_delay > 0) {
5388 			int delay = msecs_to_jiffies(hdev->auto_accept_delay);
5389 			queue_delayed_work(conn->hdev->workqueue,
5390 					   &conn->auto_accept_work, delay);
5391 			goto unlock;
5392 		}
5393 
5394 		hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
5395 			     sizeof(ev->bdaddr), &ev->bdaddr);
5396 		goto unlock;
5397 	}
5398 
5399 confirm:
5400 	mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0,
5401 				  le32_to_cpu(ev->passkey), confirm_hint);
5402 
5403 unlock:
5404 	hci_dev_unlock(hdev);
5405 }
5406 
hci_user_passkey_request_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)5407 static void hci_user_passkey_request_evt(struct hci_dev *hdev, void *data,
5408 					 struct sk_buff *skb)
5409 {
5410 	struct hci_ev_user_passkey_req *ev = data;
5411 
5412 	bt_dev_dbg(hdev, "");
5413 
5414 	if (hci_dev_test_flag(hdev, HCI_MGMT))
5415 		mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
5416 }
5417 
hci_user_passkey_notify_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)5418 static void hci_user_passkey_notify_evt(struct hci_dev *hdev, void *data,
5419 					struct sk_buff *skb)
5420 {
5421 	struct hci_ev_user_passkey_notify *ev = data;
5422 	struct hci_conn *conn;
5423 
5424 	bt_dev_dbg(hdev, "");
5425 
5426 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
5427 	if (!conn)
5428 		return;
5429 
5430 	conn->passkey_notify = __le32_to_cpu(ev->passkey);
5431 	conn->passkey_entered = 0;
5432 
5433 	if (hci_dev_test_flag(hdev, HCI_MGMT))
5434 		mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
5435 					 conn->dst_type, conn->passkey_notify,
5436 					 conn->passkey_entered);
5437 }
5438 
hci_keypress_notify_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)5439 static void hci_keypress_notify_evt(struct hci_dev *hdev, void *data,
5440 				    struct sk_buff *skb)
5441 {
5442 	struct hci_ev_keypress_notify *ev = data;
5443 	struct hci_conn *conn;
5444 
5445 	bt_dev_dbg(hdev, "");
5446 
5447 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
5448 	if (!conn)
5449 		return;
5450 
5451 	switch (ev->type) {
5452 	case HCI_KEYPRESS_STARTED:
5453 		conn->passkey_entered = 0;
5454 		return;
5455 
5456 	case HCI_KEYPRESS_ENTERED:
5457 		conn->passkey_entered++;
5458 		break;
5459 
5460 	case HCI_KEYPRESS_ERASED:
5461 		conn->passkey_entered--;
5462 		break;
5463 
5464 	case HCI_KEYPRESS_CLEARED:
5465 		conn->passkey_entered = 0;
5466 		break;
5467 
5468 	case HCI_KEYPRESS_COMPLETED:
5469 		return;
5470 	}
5471 
5472 	if (hci_dev_test_flag(hdev, HCI_MGMT))
5473 		mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
5474 					 conn->dst_type, conn->passkey_notify,
5475 					 conn->passkey_entered);
5476 }
5477 
hci_simple_pair_complete_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)5478 static void hci_simple_pair_complete_evt(struct hci_dev *hdev, void *data,
5479 					 struct sk_buff *skb)
5480 {
5481 	struct hci_ev_simple_pair_complete *ev = data;
5482 	struct hci_conn *conn;
5483 
5484 	bt_dev_dbg(hdev, "");
5485 
5486 	hci_dev_lock(hdev);
5487 
5488 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
5489 	if (!conn || !hci_conn_ssp_enabled(conn))
5490 		goto unlock;
5491 
5492 	/* Reset the authentication requirement to unknown */
5493 	conn->remote_auth = 0xff;
5494 
5495 	/* To avoid duplicate auth_failed events to user space we check
5496 	 * the HCI_CONN_AUTH_PEND flag which will be set if we
5497 	 * initiated the authentication. A traditional auth_complete
5498 	 * event gets always produced as initiator and is also mapped to
5499 	 * the mgmt_auth_failed event */
5500 	if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status)
5501 		mgmt_auth_failed(conn, ev->status);
5502 
5503 	hci_conn_drop(conn);
5504 
5505 unlock:
5506 	hci_dev_unlock(hdev);
5507 }
5508 
hci_remote_host_features_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)5509 static void hci_remote_host_features_evt(struct hci_dev *hdev, void *data,
5510 					 struct sk_buff *skb)
5511 {
5512 	struct hci_ev_remote_host_features *ev = data;
5513 	struct inquiry_entry *ie;
5514 	struct hci_conn *conn;
5515 
5516 	bt_dev_dbg(hdev, "");
5517 
5518 	hci_dev_lock(hdev);
5519 
5520 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
5521 	if (conn)
5522 		memcpy(conn->features[1], ev->features, 8);
5523 
5524 	ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
5525 	if (ie)
5526 		ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
5527 
5528 	hci_dev_unlock(hdev);
5529 }
5530 
hci_remote_oob_data_request_evt(struct hci_dev * hdev,void * edata,struct sk_buff * skb)5531 static void hci_remote_oob_data_request_evt(struct hci_dev *hdev, void *edata,
5532 					    struct sk_buff *skb)
5533 {
5534 	struct hci_ev_remote_oob_data_request *ev = edata;
5535 	struct oob_data *data;
5536 
5537 	bt_dev_dbg(hdev, "");
5538 
5539 	hci_dev_lock(hdev);
5540 
5541 	if (!hci_dev_test_flag(hdev, HCI_MGMT))
5542 		goto unlock;
5543 
5544 	data = hci_find_remote_oob_data(hdev, &ev->bdaddr, BDADDR_BREDR);
5545 	if (!data) {
5546 		struct hci_cp_remote_oob_data_neg_reply cp;
5547 
5548 		bacpy(&cp.bdaddr, &ev->bdaddr);
5549 		hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY,
5550 			     sizeof(cp), &cp);
5551 		goto unlock;
5552 	}
5553 
5554 	if (bredr_sc_enabled(hdev)) {
5555 		struct hci_cp_remote_oob_ext_data_reply cp;
5556 
5557 		bacpy(&cp.bdaddr, &ev->bdaddr);
5558 		if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
5559 			memset(cp.hash192, 0, sizeof(cp.hash192));
5560 			memset(cp.rand192, 0, sizeof(cp.rand192));
5561 		} else {
5562 			memcpy(cp.hash192, data->hash192, sizeof(cp.hash192));
5563 			memcpy(cp.rand192, data->rand192, sizeof(cp.rand192));
5564 		}
5565 		memcpy(cp.hash256, data->hash256, sizeof(cp.hash256));
5566 		memcpy(cp.rand256, data->rand256, sizeof(cp.rand256));
5567 
5568 		hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_EXT_DATA_REPLY,
5569 			     sizeof(cp), &cp);
5570 	} else {
5571 		struct hci_cp_remote_oob_data_reply cp;
5572 
5573 		bacpy(&cp.bdaddr, &ev->bdaddr);
5574 		memcpy(cp.hash, data->hash192, sizeof(cp.hash));
5575 		memcpy(cp.rand, data->rand192, sizeof(cp.rand));
5576 
5577 		hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY,
5578 			     sizeof(cp), &cp);
5579 	}
5580 
5581 unlock:
5582 	hci_dev_unlock(hdev);
5583 }
5584 
le_conn_update_addr(struct hci_conn * conn,bdaddr_t * bdaddr,u8 bdaddr_type,bdaddr_t * local_rpa)5585 static void le_conn_update_addr(struct hci_conn *conn, bdaddr_t *bdaddr,
5586 				u8 bdaddr_type, bdaddr_t *local_rpa)
5587 {
5588 	if (conn->out) {
5589 		conn->dst_type = bdaddr_type;
5590 		conn->resp_addr_type = bdaddr_type;
5591 		bacpy(&conn->resp_addr, bdaddr);
5592 
5593 		/* Check if the controller has set a Local RPA then it must be
5594 		 * used instead or hdev->rpa.
5595 		 */
5596 		if (local_rpa && bacmp(local_rpa, BDADDR_ANY)) {
5597 			conn->init_addr_type = ADDR_LE_DEV_RANDOM;
5598 			bacpy(&conn->init_addr, local_rpa);
5599 		} else if (hci_dev_test_flag(conn->hdev, HCI_PRIVACY)) {
5600 			conn->init_addr_type = ADDR_LE_DEV_RANDOM;
5601 			bacpy(&conn->init_addr, &conn->hdev->rpa);
5602 		} else {
5603 			hci_copy_identity_address(conn->hdev, &conn->init_addr,
5604 						  &conn->init_addr_type);
5605 		}
5606 	} else {
5607 		conn->resp_addr_type = conn->hdev->adv_addr_type;
5608 		/* Check if the controller has set a Local RPA then it must be
5609 		 * used instead or hdev->rpa.
5610 		 */
5611 		if (local_rpa && bacmp(local_rpa, BDADDR_ANY)) {
5612 			conn->resp_addr_type = ADDR_LE_DEV_RANDOM;
5613 			bacpy(&conn->resp_addr, local_rpa);
5614 		} else if (conn->hdev->adv_addr_type == ADDR_LE_DEV_RANDOM) {
5615 			/* In case of ext adv, resp_addr will be updated in
5616 			 * Adv Terminated event.
5617 			 */
5618 			if (!ext_adv_capable(conn->hdev))
5619 				bacpy(&conn->resp_addr,
5620 				      &conn->hdev->random_addr);
5621 		} else {
5622 			bacpy(&conn->resp_addr, &conn->hdev->bdaddr);
5623 		}
5624 
5625 		conn->init_addr_type = bdaddr_type;
5626 		bacpy(&conn->init_addr, bdaddr);
5627 
5628 		/* For incoming connections, set the default minimum
5629 		 * and maximum connection interval. They will be used
5630 		 * to check if the parameters are in range and if not
5631 		 * trigger the connection update procedure.
5632 		 */
5633 		conn->le_conn_min_interval = conn->hdev->le_conn_min_interval;
5634 		conn->le_conn_max_interval = conn->hdev->le_conn_max_interval;
5635 	}
5636 }
5637 
le_conn_complete_evt(struct hci_dev * hdev,u8 status,bdaddr_t * bdaddr,u8 bdaddr_type,bdaddr_t * local_rpa,u8 role,u16 handle,u16 interval,u16 latency,u16 supervision_timeout)5638 static void le_conn_complete_evt(struct hci_dev *hdev, u8 status,
5639 				 bdaddr_t *bdaddr, u8 bdaddr_type,
5640 				 bdaddr_t *local_rpa, u8 role, u16 handle,
5641 				 u16 interval, u16 latency,
5642 				 u16 supervision_timeout)
5643 {
5644 	struct hci_conn_params *params;
5645 	struct hci_conn *conn;
5646 	struct smp_irk *irk;
5647 	u8 addr_type;
5648 
5649 	hci_dev_lock(hdev);
5650 
5651 	/* All controllers implicitly stop advertising in the event of a
5652 	 * connection, so ensure that the state bit is cleared.
5653 	 */
5654 	hci_dev_clear_flag(hdev, HCI_LE_ADV);
5655 
5656 	conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr);
5657 	if (!conn) {
5658 		/* In case of error status and there is no connection pending
5659 		 * just unlock as there is nothing to cleanup.
5660 		 */
5661 		if (status)
5662 			goto unlock;
5663 
5664 		conn = hci_conn_add_unset(hdev, LE_LINK, bdaddr, role);
5665 		if (IS_ERR(conn)) {
5666 			bt_dev_err(hdev, "connection err: %ld", PTR_ERR(conn));
5667 			goto unlock;
5668 		}
5669 
5670 		conn->dst_type = bdaddr_type;
5671 
5672 		/* If we didn't have a hci_conn object previously
5673 		 * but we're in central role this must be something
5674 		 * initiated using an accept list. Since accept list based
5675 		 * connections are not "first class citizens" we don't
5676 		 * have full tracking of them. Therefore, we go ahead
5677 		 * with a "best effort" approach of determining the
5678 		 * initiator address based on the HCI_PRIVACY flag.
5679 		 */
5680 		if (conn->out) {
5681 			conn->resp_addr_type = bdaddr_type;
5682 			bacpy(&conn->resp_addr, bdaddr);
5683 			if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
5684 				conn->init_addr_type = ADDR_LE_DEV_RANDOM;
5685 				bacpy(&conn->init_addr, &hdev->rpa);
5686 			} else {
5687 				hci_copy_identity_address(hdev,
5688 							  &conn->init_addr,
5689 							  &conn->init_addr_type);
5690 			}
5691 		}
5692 	} else {
5693 		cancel_delayed_work(&conn->le_conn_timeout);
5694 	}
5695 
5696 	/* The HCI_LE_Connection_Complete event is only sent once per connection.
5697 	 * Processing it more than once per connection can corrupt kernel memory.
5698 	 *
5699 	 * As the connection handle is set here for the first time, it indicates
5700 	 * whether the connection is already set up.
5701 	 */
5702 	if (!HCI_CONN_HANDLE_UNSET(conn->handle)) {
5703 		bt_dev_err(hdev, "Ignoring HCI_Connection_Complete for existing connection");
5704 		goto unlock;
5705 	}
5706 
5707 	le_conn_update_addr(conn, bdaddr, bdaddr_type, local_rpa);
5708 
5709 	/* Lookup the identity address from the stored connection
5710 	 * address and address type.
5711 	 *
5712 	 * When establishing connections to an identity address, the
5713 	 * connection procedure will store the resolvable random
5714 	 * address first. Now if it can be converted back into the
5715 	 * identity address, start using the identity address from
5716 	 * now on.
5717 	 */
5718 	irk = hci_get_irk(hdev, &conn->dst, conn->dst_type);
5719 	if (irk) {
5720 		bacpy(&conn->dst, &irk->bdaddr);
5721 		conn->dst_type = irk->addr_type;
5722 	}
5723 
5724 	conn->dst_type = ev_bdaddr_type(hdev, conn->dst_type, NULL);
5725 
5726 	/* All connection failure handling is taken care of by the
5727 	 * hci_conn_failed function which is triggered by the HCI
5728 	 * request completion callbacks used for connecting.
5729 	 */
5730 	if (status || hci_conn_set_handle(conn, handle))
5731 		goto unlock;
5732 
5733 	/* Drop the connection if it has been aborted */
5734 	if (test_bit(HCI_CONN_CANCEL, &conn->flags)) {
5735 		hci_conn_drop(conn);
5736 		goto unlock;
5737 	}
5738 
5739 	if (conn->dst_type == ADDR_LE_DEV_PUBLIC)
5740 		addr_type = BDADDR_LE_PUBLIC;
5741 	else
5742 		addr_type = BDADDR_LE_RANDOM;
5743 
5744 	/* Drop the connection if the device is blocked */
5745 	if (hci_bdaddr_list_lookup(&hdev->reject_list, &conn->dst, addr_type)) {
5746 		hci_conn_drop(conn);
5747 		goto unlock;
5748 	}
5749 
5750 	mgmt_device_connected(hdev, conn, NULL, 0);
5751 
5752 	conn->sec_level = BT_SECURITY_LOW;
5753 	conn->state = BT_CONFIG;
5754 
5755 	/* Store current advertising instance as connection advertising instance
5756 	 * when sotfware rotation is in use so it can be re-enabled when
5757 	 * disconnected.
5758 	 */
5759 	if (!ext_adv_capable(hdev))
5760 		conn->adv_instance = hdev->cur_adv_instance;
5761 
5762 	conn->le_conn_interval = interval;
5763 	conn->le_conn_latency = latency;
5764 	conn->le_supv_timeout = supervision_timeout;
5765 
5766 	hci_debugfs_create_conn(conn);
5767 	hci_conn_add_sysfs(conn);
5768 
5769 	/* The remote features procedure is defined for central
5770 	 * role only. So only in case of an initiated connection
5771 	 * request the remote features.
5772 	 *
5773 	 * If the local controller supports peripheral-initiated features
5774 	 * exchange, then requesting the remote features in peripheral
5775 	 * role is possible. Otherwise just transition into the
5776 	 * connected state without requesting the remote features.
5777 	 */
5778 	if (conn->out ||
5779 	    (hdev->le_features[0] & HCI_LE_PERIPHERAL_FEATURES)) {
5780 		struct hci_cp_le_read_remote_features cp;
5781 
5782 		cp.handle = __cpu_to_le16(conn->handle);
5783 
5784 		hci_send_cmd(hdev, HCI_OP_LE_READ_REMOTE_FEATURES,
5785 			     sizeof(cp), &cp);
5786 
5787 		hci_conn_hold(conn);
5788 	} else {
5789 		conn->state = BT_CONNECTED;
5790 		hci_connect_cfm(conn, status);
5791 	}
5792 
5793 	params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
5794 					   conn->dst_type);
5795 	if (params) {
5796 		hci_pend_le_list_del_init(params);
5797 		if (params->conn) {
5798 			hci_conn_drop(params->conn);
5799 			hci_conn_put(params->conn);
5800 			params->conn = NULL;
5801 		}
5802 	}
5803 
5804 unlock:
5805 	hci_update_passive_scan(hdev);
5806 	hci_dev_unlock(hdev);
5807 }
5808 
hci_le_conn_complete_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)5809 static void hci_le_conn_complete_evt(struct hci_dev *hdev, void *data,
5810 				     struct sk_buff *skb)
5811 {
5812 	struct hci_ev_le_conn_complete *ev = data;
5813 
5814 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
5815 
5816 	le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,
5817 			     NULL, ev->role, le16_to_cpu(ev->handle),
5818 			     le16_to_cpu(ev->interval),
5819 			     le16_to_cpu(ev->latency),
5820 			     le16_to_cpu(ev->supervision_timeout));
5821 }
5822 
hci_le_enh_conn_complete_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)5823 static void hci_le_enh_conn_complete_evt(struct hci_dev *hdev, void *data,
5824 					 struct sk_buff *skb)
5825 {
5826 	struct hci_ev_le_enh_conn_complete *ev = data;
5827 
5828 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
5829 
5830 	le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,
5831 			     &ev->local_rpa, ev->role, le16_to_cpu(ev->handle),
5832 			     le16_to_cpu(ev->interval),
5833 			     le16_to_cpu(ev->latency),
5834 			     le16_to_cpu(ev->supervision_timeout));
5835 }
5836 
hci_le_ext_adv_term_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)5837 static void hci_le_ext_adv_term_evt(struct hci_dev *hdev, void *data,
5838 				    struct sk_buff *skb)
5839 {
5840 	struct hci_evt_le_ext_adv_set_term *ev = data;
5841 	struct hci_conn *conn;
5842 	struct adv_info *adv, *n;
5843 
5844 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
5845 
5846 	/* The Bluetooth Core 5.3 specification clearly states that this event
5847 	 * shall not be sent when the Host disables the advertising set. So in
5848 	 * case of HCI_ERROR_CANCELLED_BY_HOST, just ignore the event.
5849 	 *
5850 	 * When the Host disables an advertising set, all cleanup is done via
5851 	 * its command callback and not needed to be duplicated here.
5852 	 */
5853 	if (ev->status == HCI_ERROR_CANCELLED_BY_HOST) {
5854 		bt_dev_warn_ratelimited(hdev, "Unexpected advertising set terminated event");
5855 		return;
5856 	}
5857 
5858 	hci_dev_lock(hdev);
5859 
5860 	adv = hci_find_adv_instance(hdev, ev->handle);
5861 
5862 	if (ev->status) {
5863 		if (!adv)
5864 			goto unlock;
5865 
5866 		/* Remove advertising as it has been terminated */
5867 		hci_remove_adv_instance(hdev, ev->handle);
5868 		mgmt_advertising_removed(NULL, hdev, ev->handle);
5869 
5870 		list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) {
5871 			if (adv->enabled)
5872 				goto unlock;
5873 		}
5874 
5875 		/* We are no longer advertising, clear HCI_LE_ADV */
5876 		hci_dev_clear_flag(hdev, HCI_LE_ADV);
5877 		goto unlock;
5878 	}
5879 
5880 	if (adv)
5881 		adv->enabled = false;
5882 
5883 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->conn_handle));
5884 	if (conn) {
5885 		/* Store handle in the connection so the correct advertising
5886 		 * instance can be re-enabled when disconnected.
5887 		 */
5888 		conn->adv_instance = ev->handle;
5889 
5890 		if (hdev->adv_addr_type != ADDR_LE_DEV_RANDOM ||
5891 		    bacmp(&conn->resp_addr, BDADDR_ANY))
5892 			goto unlock;
5893 
5894 		if (!ev->handle) {
5895 			bacpy(&conn->resp_addr, &hdev->random_addr);
5896 			goto unlock;
5897 		}
5898 
5899 		if (adv)
5900 			bacpy(&conn->resp_addr, &adv->random_addr);
5901 	}
5902 
5903 unlock:
5904 	hci_dev_unlock(hdev);
5905 }
5906 
hci_le_conn_update_complete_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)5907 static void hci_le_conn_update_complete_evt(struct hci_dev *hdev, void *data,
5908 					    struct sk_buff *skb)
5909 {
5910 	struct hci_ev_le_conn_update_complete *ev = data;
5911 	struct hci_conn *conn;
5912 
5913 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
5914 
5915 	if (ev->status)
5916 		return;
5917 
5918 	hci_dev_lock(hdev);
5919 
5920 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5921 	if (conn) {
5922 		conn->le_conn_interval = le16_to_cpu(ev->interval);
5923 		conn->le_conn_latency = le16_to_cpu(ev->latency);
5924 		conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
5925 	}
5926 
5927 	hci_dev_unlock(hdev);
5928 }
5929 
5930 /* This function requires the caller holds hdev->lock */
check_pending_le_conn(struct hci_dev * hdev,bdaddr_t * addr,u8 addr_type,bool addr_resolved,u8 adv_type,u8 phy,u8 sec_phy)5931 static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev,
5932 					      bdaddr_t *addr,
5933 					      u8 addr_type, bool addr_resolved,
5934 					      u8 adv_type, u8 phy, u8 sec_phy)
5935 {
5936 	struct hci_conn *conn;
5937 	struct hci_conn_params *params;
5938 
5939 	/* If the event is not connectable don't proceed further */
5940 	if (adv_type != LE_ADV_IND && adv_type != LE_ADV_DIRECT_IND)
5941 		return NULL;
5942 
5943 	/* Ignore if the device is blocked or hdev is suspended */
5944 	if (hci_bdaddr_list_lookup(&hdev->reject_list, addr, addr_type) ||
5945 	    hdev->suspended)
5946 		return NULL;
5947 
5948 	/* Most controller will fail if we try to create new connections
5949 	 * while we have an existing one in peripheral role.
5950 	 */
5951 	if (hdev->conn_hash.le_num_peripheral > 0 &&
5952 	    (test_bit(HCI_QUIRK_BROKEN_LE_STATES, &hdev->quirks) ||
5953 	     !(hdev->le_states[3] & 0x10)))
5954 		return NULL;
5955 
5956 	/* If we're not connectable only connect devices that we have in
5957 	 * our pend_le_conns list.
5958 	 */
5959 	params = hci_pend_le_action_lookup(&hdev->pend_le_conns, addr,
5960 					   addr_type);
5961 	if (!params)
5962 		return NULL;
5963 
5964 	if (!params->explicit_connect) {
5965 		switch (params->auto_connect) {
5966 		case HCI_AUTO_CONN_DIRECT:
5967 			/* Only devices advertising with ADV_DIRECT_IND are
5968 			 * triggering a connection attempt. This is allowing
5969 			 * incoming connections from peripheral devices.
5970 			 */
5971 			if (adv_type != LE_ADV_DIRECT_IND)
5972 				return NULL;
5973 			break;
5974 		case HCI_AUTO_CONN_ALWAYS:
5975 			/* Devices advertising with ADV_IND or ADV_DIRECT_IND
5976 			 * are triggering a connection attempt. This means
5977 			 * that incoming connections from peripheral device are
5978 			 * accepted and also outgoing connections to peripheral
5979 			 * devices are established when found.
5980 			 */
5981 			break;
5982 		default:
5983 			return NULL;
5984 		}
5985 	}
5986 
5987 	conn = hci_connect_le(hdev, addr, addr_type, addr_resolved,
5988 			      BT_SECURITY_LOW, hdev->def_le_autoconnect_timeout,
5989 			      HCI_ROLE_MASTER, phy, sec_phy);
5990 	if (!IS_ERR(conn)) {
5991 		/* If HCI_AUTO_CONN_EXPLICIT is set, conn is already owned
5992 		 * by higher layer that tried to connect, if no then
5993 		 * store the pointer since we don't really have any
5994 		 * other owner of the object besides the params that
5995 		 * triggered it. This way we can abort the connection if
5996 		 * the parameters get removed and keep the reference
5997 		 * count consistent once the connection is established.
5998 		 */
5999 
6000 		if (!params->explicit_connect)
6001 			params->conn = hci_conn_get(conn);
6002 
6003 		return conn;
6004 	}
6005 
6006 	switch (PTR_ERR(conn)) {
6007 	case -EBUSY:
6008 		/* If hci_connect() returns -EBUSY it means there is already
6009 		 * an LE connection attempt going on. Since controllers don't
6010 		 * support more than one connection attempt at the time, we
6011 		 * don't consider this an error case.
6012 		 */
6013 		break;
6014 	default:
6015 		BT_DBG("Failed to connect: err %ld", PTR_ERR(conn));
6016 		return NULL;
6017 	}
6018 
6019 	return NULL;
6020 }
6021 
process_adv_report(struct hci_dev * hdev,u8 type,bdaddr_t * bdaddr,u8 bdaddr_type,bdaddr_t * direct_addr,u8 direct_addr_type,u8 phy,u8 sec_phy,s8 rssi,u8 * data,u8 len,bool ext_adv,bool ctl_time,u64 instant)6022 static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
6023 			       u8 bdaddr_type, bdaddr_t *direct_addr,
6024 			       u8 direct_addr_type, u8 phy, u8 sec_phy, s8 rssi,
6025 			       u8 *data, u8 len, bool ext_adv, bool ctl_time,
6026 			       u64 instant)
6027 {
6028 	struct discovery_state *d = &hdev->discovery;
6029 	struct smp_irk *irk;
6030 	struct hci_conn *conn;
6031 	bool match, bdaddr_resolved;
6032 	u32 flags;
6033 	u8 *ptr;
6034 
6035 	switch (type) {
6036 	case LE_ADV_IND:
6037 	case LE_ADV_DIRECT_IND:
6038 	case LE_ADV_SCAN_IND:
6039 	case LE_ADV_NONCONN_IND:
6040 	case LE_ADV_SCAN_RSP:
6041 		break;
6042 	default:
6043 		bt_dev_err_ratelimited(hdev, "unknown advertising packet "
6044 				       "type: 0x%02x", type);
6045 		return;
6046 	}
6047 
6048 	if (len > max_adv_len(hdev)) {
6049 		bt_dev_err_ratelimited(hdev,
6050 				       "adv larger than maximum supported");
6051 		return;
6052 	}
6053 
6054 	/* Find the end of the data in case the report contains padded zero
6055 	 * bytes at the end causing an invalid length value.
6056 	 *
6057 	 * When data is NULL, len is 0 so there is no need for extra ptr
6058 	 * check as 'ptr < data + 0' is already false in such case.
6059 	 */
6060 	for (ptr = data; ptr < data + len && *ptr; ptr += *ptr + 1) {
6061 		if (ptr + 1 + *ptr > data + len)
6062 			break;
6063 	}
6064 
6065 	/* Adjust for actual length. This handles the case when remote
6066 	 * device is advertising with incorrect data length.
6067 	 */
6068 	len = ptr - data;
6069 
6070 	/* If the direct address is present, then this report is from
6071 	 * a LE Direct Advertising Report event. In that case it is
6072 	 * important to see if the address is matching the local
6073 	 * controller address.
6074 	 *
6075 	 * If local privacy is not enable the controller shall not be
6076 	 * generating such event since according to its documentation it is only
6077 	 * valid for filter_policy 0x02 and 0x03, but the fact that it did
6078 	 * generate LE Direct Advertising Report means it is probably broken and
6079 	 * won't generate any other event which can potentially break
6080 	 * auto-connect logic so in case local privacy is not enable this
6081 	 * ignores the direct_addr so it works as a regular report.
6082 	 */
6083 	if (!hci_dev_test_flag(hdev, HCI_MESH) && direct_addr &&
6084 	    hci_dev_test_flag(hdev, HCI_PRIVACY)) {
6085 		direct_addr_type = ev_bdaddr_type(hdev, direct_addr_type,
6086 						  &bdaddr_resolved);
6087 
6088 		/* Only resolvable random addresses are valid for these
6089 		 * kind of reports and others can be ignored.
6090 		 */
6091 		if (!hci_bdaddr_is_rpa(direct_addr, direct_addr_type))
6092 			return;
6093 
6094 		/* If the local IRK of the controller does not match
6095 		 * with the resolvable random address provided, then
6096 		 * this report can be ignored.
6097 		 */
6098 		if (!smp_irk_matches(hdev, hdev->irk, direct_addr))
6099 			return;
6100 	}
6101 
6102 	/* Check if we need to convert to identity address */
6103 	irk = hci_get_irk(hdev, bdaddr, bdaddr_type);
6104 	if (irk) {
6105 		bdaddr = &irk->bdaddr;
6106 		bdaddr_type = irk->addr_type;
6107 	}
6108 
6109 	bdaddr_type = ev_bdaddr_type(hdev, bdaddr_type, &bdaddr_resolved);
6110 
6111 	/* Check if we have been requested to connect to this device.
6112 	 *
6113 	 * direct_addr is set only for directed advertising reports (it is NULL
6114 	 * for advertising reports) and is already verified to be RPA above.
6115 	 */
6116 	conn = check_pending_le_conn(hdev, bdaddr, bdaddr_type, bdaddr_resolved,
6117 				     type, phy, sec_phy);
6118 	if (!ext_adv && conn && type == LE_ADV_IND &&
6119 	    len <= max_adv_len(hdev)) {
6120 		/* Store report for later inclusion by
6121 		 * mgmt_device_connected
6122 		 */
6123 		memcpy(conn->le_adv_data, data, len);
6124 		conn->le_adv_data_len = len;
6125 	}
6126 
6127 	if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND)
6128 		flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
6129 	else
6130 		flags = 0;
6131 
6132 	/* All scan results should be sent up for Mesh systems */
6133 	if (hci_dev_test_flag(hdev, HCI_MESH)) {
6134 		mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
6135 				  rssi, flags, data, len, NULL, 0, instant);
6136 		return;
6137 	}
6138 
6139 	/* Passive scanning shouldn't trigger any device found events,
6140 	 * except for devices marked as CONN_REPORT for which we do send
6141 	 * device found events, or advertisement monitoring requested.
6142 	 */
6143 	if (hdev->le_scan_type == LE_SCAN_PASSIVE) {
6144 		if (type == LE_ADV_DIRECT_IND)
6145 			return;
6146 
6147 		if (!hci_pend_le_action_lookup(&hdev->pend_le_reports,
6148 					       bdaddr, bdaddr_type) &&
6149 		    idr_is_empty(&hdev->adv_monitors_idr))
6150 			return;
6151 
6152 		mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
6153 				  rssi, flags, data, len, NULL, 0, 0);
6154 		return;
6155 	}
6156 
6157 	/* When receiving a scan response, then there is no way to
6158 	 * know if the remote device is connectable or not. However
6159 	 * since scan responses are merged with a previously seen
6160 	 * advertising report, the flags field from that report
6161 	 * will be used.
6162 	 *
6163 	 * In the unlikely case that a controller just sends a scan
6164 	 * response event that doesn't match the pending report, then
6165 	 * it is marked as a standalone SCAN_RSP.
6166 	 */
6167 	if (type == LE_ADV_SCAN_RSP)
6168 		flags = MGMT_DEV_FOUND_SCAN_RSP;
6169 
6170 	/* If there's nothing pending either store the data from this
6171 	 * event or send an immediate device found event if the data
6172 	 * should not be stored for later.
6173 	 */
6174 	if (!has_pending_adv_report(hdev)) {
6175 		/* If the report will trigger a SCAN_REQ store it for
6176 		 * later merging.
6177 		 */
6178 		if (!ext_adv && (type == LE_ADV_IND ||
6179 				 type == LE_ADV_SCAN_IND)) {
6180 			store_pending_adv_report(hdev, bdaddr, bdaddr_type,
6181 						 rssi, flags, data, len);
6182 			return;
6183 		}
6184 
6185 		mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
6186 				  rssi, flags, data, len, NULL, 0, 0);
6187 		return;
6188 	}
6189 
6190 	/* Check if the pending report is for the same device as the new one */
6191 	match = (!bacmp(bdaddr, &d->last_adv_addr) &&
6192 		 bdaddr_type == d->last_adv_addr_type);
6193 
6194 	/* If the pending data doesn't match this report or this isn't a
6195 	 * scan response (e.g. we got a duplicate ADV_IND) then force
6196 	 * sending of the pending data.
6197 	 */
6198 	if (type != LE_ADV_SCAN_RSP || !match) {
6199 		/* Send out whatever is in the cache, but skip duplicates */
6200 		if (!match)
6201 			mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
6202 					  d->last_adv_addr_type, NULL,
6203 					  d->last_adv_rssi, d->last_adv_flags,
6204 					  d->last_adv_data,
6205 					  d->last_adv_data_len, NULL, 0, 0);
6206 
6207 		/* If the new report will trigger a SCAN_REQ store it for
6208 		 * later merging.
6209 		 */
6210 		if (!ext_adv && (type == LE_ADV_IND ||
6211 				 type == LE_ADV_SCAN_IND)) {
6212 			store_pending_adv_report(hdev, bdaddr, bdaddr_type,
6213 						 rssi, flags, data, len);
6214 			return;
6215 		}
6216 
6217 		/* The advertising reports cannot be merged, so clear
6218 		 * the pending report and send out a device found event.
6219 		 */
6220 		clear_pending_adv_report(hdev);
6221 		mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
6222 				  rssi, flags, data, len, NULL, 0, 0);
6223 		return;
6224 	}
6225 
6226 	/* If we get here we've got a pending ADV_IND or ADV_SCAN_IND and
6227 	 * the new event is a SCAN_RSP. We can therefore proceed with
6228 	 * sending a merged device found event.
6229 	 */
6230 	mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
6231 			  d->last_adv_addr_type, NULL, rssi, d->last_adv_flags,
6232 			  d->last_adv_data, d->last_adv_data_len, data, len, 0);
6233 	clear_pending_adv_report(hdev);
6234 }
6235 
hci_le_adv_report_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)6236 static void hci_le_adv_report_evt(struct hci_dev *hdev, void *data,
6237 				  struct sk_buff *skb)
6238 {
6239 	struct hci_ev_le_advertising_report *ev = data;
6240 	u64 instant = jiffies;
6241 
6242 	if (!ev->num)
6243 		return;
6244 
6245 	hci_dev_lock(hdev);
6246 
6247 	while (ev->num--) {
6248 		struct hci_ev_le_advertising_info *info;
6249 		s8 rssi;
6250 
6251 		info = hci_le_ev_skb_pull(hdev, skb,
6252 					  HCI_EV_LE_ADVERTISING_REPORT,
6253 					  sizeof(*info));
6254 		if (!info)
6255 			break;
6256 
6257 		if (!hci_le_ev_skb_pull(hdev, skb, HCI_EV_LE_ADVERTISING_REPORT,
6258 					info->length + 1))
6259 			break;
6260 
6261 		if (info->length <= max_adv_len(hdev)) {
6262 			rssi = info->data[info->length];
6263 			process_adv_report(hdev, info->type, &info->bdaddr,
6264 					   info->bdaddr_type, NULL, 0,
6265 					   HCI_ADV_PHY_1M, 0, rssi,
6266 					   info->data, info->length, false,
6267 					   false, instant);
6268 		} else {
6269 			bt_dev_err(hdev, "Dropping invalid advertising data");
6270 		}
6271 	}
6272 
6273 	hci_dev_unlock(hdev);
6274 }
6275 
ext_evt_type_to_legacy(struct hci_dev * hdev,u16 evt_type)6276 static u8 ext_evt_type_to_legacy(struct hci_dev *hdev, u16 evt_type)
6277 {
6278 	if (evt_type & LE_EXT_ADV_LEGACY_PDU) {
6279 		switch (evt_type) {
6280 		case LE_LEGACY_ADV_IND:
6281 			return LE_ADV_IND;
6282 		case LE_LEGACY_ADV_DIRECT_IND:
6283 			return LE_ADV_DIRECT_IND;
6284 		case LE_LEGACY_ADV_SCAN_IND:
6285 			return LE_ADV_SCAN_IND;
6286 		case LE_LEGACY_NONCONN_IND:
6287 			return LE_ADV_NONCONN_IND;
6288 		case LE_LEGACY_SCAN_RSP_ADV:
6289 		case LE_LEGACY_SCAN_RSP_ADV_SCAN:
6290 			return LE_ADV_SCAN_RSP;
6291 		}
6292 
6293 		goto invalid;
6294 	}
6295 
6296 	if (evt_type & LE_EXT_ADV_CONN_IND) {
6297 		if (evt_type & LE_EXT_ADV_DIRECT_IND)
6298 			return LE_ADV_DIRECT_IND;
6299 
6300 		return LE_ADV_IND;
6301 	}
6302 
6303 	if (evt_type & LE_EXT_ADV_SCAN_RSP)
6304 		return LE_ADV_SCAN_RSP;
6305 
6306 	if (evt_type & LE_EXT_ADV_SCAN_IND)
6307 		return LE_ADV_SCAN_IND;
6308 
6309 	if (evt_type == LE_EXT_ADV_NON_CONN_IND ||
6310 	    evt_type & LE_EXT_ADV_DIRECT_IND)
6311 		return LE_ADV_NONCONN_IND;
6312 
6313 invalid:
6314 	bt_dev_err_ratelimited(hdev, "Unknown advertising packet type: 0x%02x",
6315 			       evt_type);
6316 
6317 	return LE_ADV_INVALID;
6318 }
6319 
hci_le_ext_adv_report_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)6320 static void hci_le_ext_adv_report_evt(struct hci_dev *hdev, void *data,
6321 				      struct sk_buff *skb)
6322 {
6323 	struct hci_ev_le_ext_adv_report *ev = data;
6324 	u64 instant = jiffies;
6325 
6326 	if (!ev->num)
6327 		return;
6328 
6329 	hci_dev_lock(hdev);
6330 
6331 	while (ev->num--) {
6332 		struct hci_ev_le_ext_adv_info *info;
6333 		u8 legacy_evt_type;
6334 		u16 evt_type;
6335 
6336 		info = hci_le_ev_skb_pull(hdev, skb, HCI_EV_LE_EXT_ADV_REPORT,
6337 					  sizeof(*info));
6338 		if (!info)
6339 			break;
6340 
6341 		if (!hci_le_ev_skb_pull(hdev, skb, HCI_EV_LE_EXT_ADV_REPORT,
6342 					info->length))
6343 			break;
6344 
6345 		evt_type = __le16_to_cpu(info->type) & LE_EXT_ADV_EVT_TYPE_MASK;
6346 		legacy_evt_type = ext_evt_type_to_legacy(hdev, evt_type);
6347 
6348 		if (test_bit(HCI_QUIRK_FIXUP_LE_EXT_ADV_REPORT_PHY,
6349 			     &hdev->quirks)) {
6350 			info->primary_phy &= 0x1f;
6351 			info->secondary_phy &= 0x1f;
6352 		}
6353 
6354 		if (legacy_evt_type != LE_ADV_INVALID) {
6355 			process_adv_report(hdev, legacy_evt_type, &info->bdaddr,
6356 					   info->bdaddr_type, NULL, 0,
6357 					   info->primary_phy,
6358 					   info->secondary_phy,
6359 					   info->rssi, info->data, info->length,
6360 					   !(evt_type & LE_EXT_ADV_LEGACY_PDU),
6361 					   false, instant);
6362 		}
6363 	}
6364 
6365 	hci_dev_unlock(hdev);
6366 }
6367 
hci_le_pa_term_sync(struct hci_dev * hdev,__le16 handle)6368 static int hci_le_pa_term_sync(struct hci_dev *hdev, __le16 handle)
6369 {
6370 	struct hci_cp_le_pa_term_sync cp;
6371 
6372 	memset(&cp, 0, sizeof(cp));
6373 	cp.handle = handle;
6374 
6375 	return hci_send_cmd(hdev, HCI_OP_LE_PA_TERM_SYNC, sizeof(cp), &cp);
6376 }
6377 
hci_le_pa_sync_estabilished_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)6378 static void hci_le_pa_sync_estabilished_evt(struct hci_dev *hdev, void *data,
6379 					    struct sk_buff *skb)
6380 {
6381 	struct hci_ev_le_pa_sync_established *ev = data;
6382 	int mask = hdev->link_mode;
6383 	__u8 flags = 0;
6384 	struct hci_conn *pa_sync, *conn;
6385 
6386 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
6387 
6388 	hci_dev_lock(hdev);
6389 
6390 	hci_dev_clear_flag(hdev, HCI_PA_SYNC);
6391 
6392 	conn = hci_conn_hash_lookup_create_pa_sync(hdev);
6393 	if (!conn) {
6394 		bt_dev_err(hdev,
6395 			   "Unable to find connection for dst %pMR sid 0x%2.2x",
6396 			   &ev->bdaddr, ev->sid);
6397 		goto unlock;
6398 	}
6399 
6400 	clear_bit(HCI_CONN_CREATE_PA_SYNC, &conn->flags);
6401 
6402 	conn->sync_handle = le16_to_cpu(ev->handle);
6403 	conn->sid = HCI_SID_INVALID;
6404 
6405 	mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ISO_LINK, &flags);
6406 	if (!(mask & HCI_LM_ACCEPT)) {
6407 		hci_le_pa_term_sync(hdev, ev->handle);
6408 		goto unlock;
6409 	}
6410 
6411 	if (!(flags & HCI_PROTO_DEFER))
6412 		goto unlock;
6413 
6414 	/* Add connection to indicate PA sync event */
6415 	pa_sync = hci_conn_add_unset(hdev, ISO_LINK, BDADDR_ANY,
6416 				     HCI_ROLE_SLAVE);
6417 
6418 	if (IS_ERR(pa_sync))
6419 		goto unlock;
6420 
6421 	pa_sync->sync_handle = le16_to_cpu(ev->handle);
6422 
6423 	if (ev->status) {
6424 		set_bit(HCI_CONN_PA_SYNC_FAILED, &pa_sync->flags);
6425 
6426 		/* Notify iso layer */
6427 		hci_connect_cfm(pa_sync, ev->status);
6428 	}
6429 
6430 unlock:
6431 	hci_dev_unlock(hdev);
6432 }
6433 
hci_le_per_adv_report_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)6434 static void hci_le_per_adv_report_evt(struct hci_dev *hdev, void *data,
6435 				      struct sk_buff *skb)
6436 {
6437 	struct hci_ev_le_per_adv_report *ev = data;
6438 	int mask = hdev->link_mode;
6439 	__u8 flags = 0;
6440 	struct hci_conn *pa_sync;
6441 
6442 	bt_dev_dbg(hdev, "sync_handle 0x%4.4x", le16_to_cpu(ev->sync_handle));
6443 
6444 	hci_dev_lock(hdev);
6445 
6446 	mask |= hci_proto_connect_ind(hdev, BDADDR_ANY, ISO_LINK, &flags);
6447 	if (!(mask & HCI_LM_ACCEPT))
6448 		goto unlock;
6449 
6450 	if (!(flags & HCI_PROTO_DEFER))
6451 		goto unlock;
6452 
6453 	pa_sync = hci_conn_hash_lookup_pa_sync_handle
6454 			(hdev,
6455 			le16_to_cpu(ev->sync_handle));
6456 
6457 	if (!pa_sync)
6458 		goto unlock;
6459 
6460 	if (ev->data_status == LE_PA_DATA_COMPLETE &&
6461 	    !test_and_set_bit(HCI_CONN_PA_SYNC, &pa_sync->flags)) {
6462 		/* Notify iso layer */
6463 		hci_connect_cfm(pa_sync, 0);
6464 
6465 		/* Notify MGMT layer */
6466 		mgmt_device_connected(hdev, pa_sync, NULL, 0);
6467 	}
6468 
6469 unlock:
6470 	hci_dev_unlock(hdev);
6471 }
6472 
hci_le_remote_feat_complete_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)6473 static void hci_le_remote_feat_complete_evt(struct hci_dev *hdev, void *data,
6474 					    struct sk_buff *skb)
6475 {
6476 	struct hci_ev_le_remote_feat_complete *ev = data;
6477 	struct hci_conn *conn;
6478 
6479 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
6480 
6481 	hci_dev_lock(hdev);
6482 
6483 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
6484 	if (conn) {
6485 		if (!ev->status)
6486 			memcpy(conn->features[0], ev->features, 8);
6487 
6488 		if (conn->state == BT_CONFIG) {
6489 			__u8 status;
6490 
6491 			/* If the local controller supports peripheral-initiated
6492 			 * features exchange, but the remote controller does
6493 			 * not, then it is possible that the error code 0x1a
6494 			 * for unsupported remote feature gets returned.
6495 			 *
6496 			 * In this specific case, allow the connection to
6497 			 * transition into connected state and mark it as
6498 			 * successful.
6499 			 */
6500 			if (!conn->out && ev->status == HCI_ERROR_UNSUPPORTED_REMOTE_FEATURE &&
6501 			    (hdev->le_features[0] & HCI_LE_PERIPHERAL_FEATURES))
6502 				status = 0x00;
6503 			else
6504 				status = ev->status;
6505 
6506 			conn->state = BT_CONNECTED;
6507 			hci_connect_cfm(conn, status);
6508 			hci_conn_drop(conn);
6509 		}
6510 	}
6511 
6512 	hci_dev_unlock(hdev);
6513 }
6514 
hci_le_ltk_request_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)6515 static void hci_le_ltk_request_evt(struct hci_dev *hdev, void *data,
6516 				   struct sk_buff *skb)
6517 {
6518 	struct hci_ev_le_ltk_req *ev = data;
6519 	struct hci_cp_le_ltk_reply cp;
6520 	struct hci_cp_le_ltk_neg_reply neg;
6521 	struct hci_conn *conn;
6522 	struct smp_ltk *ltk;
6523 
6524 	bt_dev_dbg(hdev, "handle 0x%4.4x", __le16_to_cpu(ev->handle));
6525 
6526 	hci_dev_lock(hdev);
6527 
6528 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
6529 	if (conn == NULL)
6530 		goto not_found;
6531 
6532 	ltk = hci_find_ltk(hdev, &conn->dst, conn->dst_type, conn->role);
6533 	if (!ltk)
6534 		goto not_found;
6535 
6536 	if (smp_ltk_is_sc(ltk)) {
6537 		/* With SC both EDiv and Rand are set to zero */
6538 		if (ev->ediv || ev->rand)
6539 			goto not_found;
6540 	} else {
6541 		/* For non-SC keys check that EDiv and Rand match */
6542 		if (ev->ediv != ltk->ediv || ev->rand != ltk->rand)
6543 			goto not_found;
6544 	}
6545 
6546 	memcpy(cp.ltk, ltk->val, ltk->enc_size);
6547 	memset(cp.ltk + ltk->enc_size, 0, sizeof(cp.ltk) - ltk->enc_size);
6548 	cp.handle = cpu_to_le16(conn->handle);
6549 
6550 	conn->pending_sec_level = smp_ltk_sec_level(ltk);
6551 
6552 	conn->enc_key_size = ltk->enc_size;
6553 
6554 	hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
6555 
6556 	/* Ref. Bluetooth Core SPEC pages 1975 and 2004. STK is a
6557 	 * temporary key used to encrypt a connection following
6558 	 * pairing. It is used during the Encrypted Session Setup to
6559 	 * distribute the keys. Later, security can be re-established
6560 	 * using a distributed LTK.
6561 	 */
6562 	if (ltk->type == SMP_STK) {
6563 		set_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
6564 		list_del_rcu(&ltk->list);
6565 		kfree_rcu(ltk, rcu);
6566 	} else {
6567 		clear_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
6568 	}
6569 
6570 	hci_dev_unlock(hdev);
6571 
6572 	return;
6573 
6574 not_found:
6575 	neg.handle = ev->handle;
6576 	hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
6577 	hci_dev_unlock(hdev);
6578 }
6579 
send_conn_param_neg_reply(struct hci_dev * hdev,u16 handle,u8 reason)6580 static void send_conn_param_neg_reply(struct hci_dev *hdev, u16 handle,
6581 				      u8 reason)
6582 {
6583 	struct hci_cp_le_conn_param_req_neg_reply cp;
6584 
6585 	cp.handle = cpu_to_le16(handle);
6586 	cp.reason = reason;
6587 
6588 	hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_NEG_REPLY, sizeof(cp),
6589 		     &cp);
6590 }
6591 
hci_le_remote_conn_param_req_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)6592 static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev, void *data,
6593 					     struct sk_buff *skb)
6594 {
6595 	struct hci_ev_le_remote_conn_param_req *ev = data;
6596 	struct hci_cp_le_conn_param_req_reply cp;
6597 	struct hci_conn *hcon;
6598 	u16 handle, min, max, latency, timeout;
6599 
6600 	bt_dev_dbg(hdev, "handle 0x%4.4x", __le16_to_cpu(ev->handle));
6601 
6602 	handle = le16_to_cpu(ev->handle);
6603 	min = le16_to_cpu(ev->interval_min);
6604 	max = le16_to_cpu(ev->interval_max);
6605 	latency = le16_to_cpu(ev->latency);
6606 	timeout = le16_to_cpu(ev->timeout);
6607 
6608 	hcon = hci_conn_hash_lookup_handle(hdev, handle);
6609 	if (!hcon || hcon->state != BT_CONNECTED)
6610 		return send_conn_param_neg_reply(hdev, handle,
6611 						 HCI_ERROR_UNKNOWN_CONN_ID);
6612 
6613 	if (max > hcon->le_conn_max_interval)
6614 		return send_conn_param_neg_reply(hdev, handle,
6615 						 HCI_ERROR_INVALID_LL_PARAMS);
6616 
6617 	if (hci_check_conn_params(min, max, latency, timeout))
6618 		return send_conn_param_neg_reply(hdev, handle,
6619 						 HCI_ERROR_INVALID_LL_PARAMS);
6620 
6621 	if (hcon->role == HCI_ROLE_MASTER) {
6622 		struct hci_conn_params *params;
6623 		u8 store_hint;
6624 
6625 		hci_dev_lock(hdev);
6626 
6627 		params = hci_conn_params_lookup(hdev, &hcon->dst,
6628 						hcon->dst_type);
6629 		if (params) {
6630 			params->conn_min_interval = min;
6631 			params->conn_max_interval = max;
6632 			params->conn_latency = latency;
6633 			params->supervision_timeout = timeout;
6634 			store_hint = 0x01;
6635 		} else {
6636 			store_hint = 0x00;
6637 		}
6638 
6639 		hci_dev_unlock(hdev);
6640 
6641 		mgmt_new_conn_param(hdev, &hcon->dst, hcon->dst_type,
6642 				    store_hint, min, max, latency, timeout);
6643 	}
6644 
6645 	cp.handle = ev->handle;
6646 	cp.interval_min = ev->interval_min;
6647 	cp.interval_max = ev->interval_max;
6648 	cp.latency = ev->latency;
6649 	cp.timeout = ev->timeout;
6650 	cp.min_ce_len = 0;
6651 	cp.max_ce_len = 0;
6652 
6653 	hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_REPLY, sizeof(cp), &cp);
6654 }
6655 
hci_le_direct_adv_report_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)6656 static void hci_le_direct_adv_report_evt(struct hci_dev *hdev, void *data,
6657 					 struct sk_buff *skb)
6658 {
6659 	struct hci_ev_le_direct_adv_report *ev = data;
6660 	u64 instant = jiffies;
6661 	int i;
6662 
6663 	if (!hci_le_ev_skb_pull(hdev, skb, HCI_EV_LE_DIRECT_ADV_REPORT,
6664 				flex_array_size(ev, info, ev->num)))
6665 		return;
6666 
6667 	if (!ev->num)
6668 		return;
6669 
6670 	hci_dev_lock(hdev);
6671 
6672 	for (i = 0; i < ev->num; i++) {
6673 		struct hci_ev_le_direct_adv_info *info = &ev->info[i];
6674 
6675 		process_adv_report(hdev, info->type, &info->bdaddr,
6676 				   info->bdaddr_type, &info->direct_addr,
6677 				   info->direct_addr_type, HCI_ADV_PHY_1M, 0,
6678 				   info->rssi, NULL, 0, false, false, instant);
6679 	}
6680 
6681 	hci_dev_unlock(hdev);
6682 }
6683 
hci_le_phy_update_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)6684 static void hci_le_phy_update_evt(struct hci_dev *hdev, void *data,
6685 				  struct sk_buff *skb)
6686 {
6687 	struct hci_ev_le_phy_update_complete *ev = data;
6688 	struct hci_conn *conn;
6689 
6690 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
6691 
6692 	if (ev->status)
6693 		return;
6694 
6695 	hci_dev_lock(hdev);
6696 
6697 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
6698 	if (!conn)
6699 		goto unlock;
6700 
6701 	conn->le_tx_phy = ev->tx_phy;
6702 	conn->le_rx_phy = ev->rx_phy;
6703 
6704 unlock:
6705 	hci_dev_unlock(hdev);
6706 }
6707 
hci_le_cis_estabilished_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)6708 static void hci_le_cis_estabilished_evt(struct hci_dev *hdev, void *data,
6709 					struct sk_buff *skb)
6710 {
6711 	struct hci_evt_le_cis_established *ev = data;
6712 	struct hci_conn *conn;
6713 	struct bt_iso_qos *qos;
6714 	bool pending = false;
6715 	u16 handle = __le16_to_cpu(ev->handle);
6716 	u32 c_sdu_interval, p_sdu_interval;
6717 
6718 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
6719 
6720 	hci_dev_lock(hdev);
6721 
6722 	conn = hci_conn_hash_lookup_handle(hdev, handle);
6723 	if (!conn) {
6724 		bt_dev_err(hdev,
6725 			   "Unable to find connection with handle 0x%4.4x",
6726 			   handle);
6727 		goto unlock;
6728 	}
6729 
6730 	if (conn->type != ISO_LINK) {
6731 		bt_dev_err(hdev,
6732 			   "Invalid connection link type handle 0x%4.4x",
6733 			   handle);
6734 		goto unlock;
6735 	}
6736 
6737 	qos = &conn->iso_qos;
6738 
6739 	pending = test_and_clear_bit(HCI_CONN_CREATE_CIS, &conn->flags);
6740 
6741 	/* BLUETOOTH CORE SPECIFICATION Version 5.4 | Vol 6, Part G
6742 	 * page 3075:
6743 	 * Transport_Latency_C_To_P = CIG_Sync_Delay + (FT_C_To_P) ×
6744 	 * ISO_Interval + SDU_Interval_C_To_P
6745 	 * ...
6746 	 * SDU_Interval = (CIG_Sync_Delay + (FT) x ISO_Interval) -
6747 	 *					Transport_Latency
6748 	 */
6749 	c_sdu_interval = (get_unaligned_le24(ev->cig_sync_delay) +
6750 			 (ev->c_ft * le16_to_cpu(ev->interval) * 1250)) -
6751 			get_unaligned_le24(ev->c_latency);
6752 	p_sdu_interval = (get_unaligned_le24(ev->cig_sync_delay) +
6753 			 (ev->p_ft * le16_to_cpu(ev->interval) * 1250)) -
6754 			get_unaligned_le24(ev->p_latency);
6755 
6756 	switch (conn->role) {
6757 	case HCI_ROLE_SLAVE:
6758 		qos->ucast.in.interval = c_sdu_interval;
6759 		qos->ucast.out.interval = p_sdu_interval;
6760 		/* Convert Transport Latency (us) to Latency (msec) */
6761 		qos->ucast.in.latency =
6762 			DIV_ROUND_CLOSEST(get_unaligned_le24(ev->c_latency),
6763 					  1000);
6764 		qos->ucast.out.latency =
6765 			DIV_ROUND_CLOSEST(get_unaligned_le24(ev->p_latency),
6766 					  1000);
6767 		qos->ucast.in.sdu = le16_to_cpu(ev->c_mtu);
6768 		qos->ucast.out.sdu = le16_to_cpu(ev->p_mtu);
6769 		qos->ucast.in.phy = ev->c_phy;
6770 		qos->ucast.out.phy = ev->p_phy;
6771 		break;
6772 	case HCI_ROLE_MASTER:
6773 		qos->ucast.in.interval = p_sdu_interval;
6774 		qos->ucast.out.interval = c_sdu_interval;
6775 		/* Convert Transport Latency (us) to Latency (msec) */
6776 		qos->ucast.out.latency =
6777 			DIV_ROUND_CLOSEST(get_unaligned_le24(ev->c_latency),
6778 					  1000);
6779 		qos->ucast.in.latency =
6780 			DIV_ROUND_CLOSEST(get_unaligned_le24(ev->p_latency),
6781 					  1000);
6782 		qos->ucast.out.sdu = le16_to_cpu(ev->c_mtu);
6783 		qos->ucast.in.sdu = le16_to_cpu(ev->p_mtu);
6784 		qos->ucast.out.phy = ev->c_phy;
6785 		qos->ucast.in.phy = ev->p_phy;
6786 		break;
6787 	}
6788 
6789 	if (!ev->status) {
6790 		conn->state = BT_CONNECTED;
6791 		hci_debugfs_create_conn(conn);
6792 		hci_conn_add_sysfs(conn);
6793 		hci_iso_setup_path(conn);
6794 		goto unlock;
6795 	}
6796 
6797 	conn->state = BT_CLOSED;
6798 	hci_connect_cfm(conn, ev->status);
6799 	hci_conn_del(conn);
6800 
6801 unlock:
6802 	if (pending)
6803 		hci_le_create_cis_pending(hdev);
6804 
6805 	hci_dev_unlock(hdev);
6806 }
6807 
hci_le_reject_cis(struct hci_dev * hdev,__le16 handle)6808 static void hci_le_reject_cis(struct hci_dev *hdev, __le16 handle)
6809 {
6810 	struct hci_cp_le_reject_cis cp;
6811 
6812 	memset(&cp, 0, sizeof(cp));
6813 	cp.handle = handle;
6814 	cp.reason = HCI_ERROR_REJ_BAD_ADDR;
6815 	hci_send_cmd(hdev, HCI_OP_LE_REJECT_CIS, sizeof(cp), &cp);
6816 }
6817 
hci_le_accept_cis(struct hci_dev * hdev,__le16 handle)6818 static void hci_le_accept_cis(struct hci_dev *hdev, __le16 handle)
6819 {
6820 	struct hci_cp_le_accept_cis cp;
6821 
6822 	memset(&cp, 0, sizeof(cp));
6823 	cp.handle = handle;
6824 	hci_send_cmd(hdev, HCI_OP_LE_ACCEPT_CIS, sizeof(cp), &cp);
6825 }
6826 
hci_le_cis_req_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)6827 static void hci_le_cis_req_evt(struct hci_dev *hdev, void *data,
6828 			       struct sk_buff *skb)
6829 {
6830 	struct hci_evt_le_cis_req *ev = data;
6831 	u16 acl_handle, cis_handle;
6832 	struct hci_conn *acl, *cis;
6833 	int mask;
6834 	__u8 flags = 0;
6835 
6836 	acl_handle = __le16_to_cpu(ev->acl_handle);
6837 	cis_handle = __le16_to_cpu(ev->cis_handle);
6838 
6839 	bt_dev_dbg(hdev, "acl 0x%4.4x handle 0x%4.4x cig 0x%2.2x cis 0x%2.2x",
6840 		   acl_handle, cis_handle, ev->cig_id, ev->cis_id);
6841 
6842 	hci_dev_lock(hdev);
6843 
6844 	acl = hci_conn_hash_lookup_handle(hdev, acl_handle);
6845 	if (!acl)
6846 		goto unlock;
6847 
6848 	mask = hci_proto_connect_ind(hdev, &acl->dst, ISO_LINK, &flags);
6849 	if (!(mask & HCI_LM_ACCEPT)) {
6850 		hci_le_reject_cis(hdev, ev->cis_handle);
6851 		goto unlock;
6852 	}
6853 
6854 	cis = hci_conn_hash_lookup_handle(hdev, cis_handle);
6855 	if (!cis) {
6856 		cis = hci_conn_add(hdev, ISO_LINK, &acl->dst, HCI_ROLE_SLAVE,
6857 				   cis_handle);
6858 		if (IS_ERR(cis)) {
6859 			hci_le_reject_cis(hdev, ev->cis_handle);
6860 			goto unlock;
6861 		}
6862 	}
6863 
6864 	cis->iso_qos.ucast.cig = ev->cig_id;
6865 	cis->iso_qos.ucast.cis = ev->cis_id;
6866 
6867 	if (!(flags & HCI_PROTO_DEFER)) {
6868 		hci_le_accept_cis(hdev, ev->cis_handle);
6869 	} else {
6870 		cis->state = BT_CONNECT2;
6871 		hci_connect_cfm(cis, 0);
6872 	}
6873 
6874 unlock:
6875 	hci_dev_unlock(hdev);
6876 }
6877 
hci_iso_term_big_sync(struct hci_dev * hdev,void * data)6878 static int hci_iso_term_big_sync(struct hci_dev *hdev, void *data)
6879 {
6880 	u8 handle = PTR_UINT(data);
6881 
6882 	return hci_le_terminate_big_sync(hdev, handle,
6883 					 HCI_ERROR_LOCAL_HOST_TERM);
6884 }
6885 
hci_le_create_big_complete_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)6886 static void hci_le_create_big_complete_evt(struct hci_dev *hdev, void *data,
6887 					   struct sk_buff *skb)
6888 {
6889 	struct hci_evt_le_create_big_complete *ev = data;
6890 	struct hci_conn *conn;
6891 	__u8 i = 0;
6892 
6893 	BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
6894 
6895 	if (!hci_le_ev_skb_pull(hdev, skb, HCI_EVT_LE_CREATE_BIG_COMPLETE,
6896 				flex_array_size(ev, bis_handle, ev->num_bis)))
6897 		return;
6898 
6899 	hci_dev_lock(hdev);
6900 
6901 	/* Connect all BISes that are bound to the BIG */
6902 	while ((conn = hci_conn_hash_lookup_big_state(hdev, ev->handle,
6903 						      BT_BOUND))) {
6904 		if (ev->status) {
6905 			hci_connect_cfm(conn, ev->status);
6906 			hci_conn_del(conn);
6907 			continue;
6908 		}
6909 
6910 		if (hci_conn_set_handle(conn,
6911 					__le16_to_cpu(ev->bis_handle[i++])))
6912 			continue;
6913 
6914 		conn->state = BT_CONNECTED;
6915 		set_bit(HCI_CONN_BIG_CREATED, &conn->flags);
6916 		hci_debugfs_create_conn(conn);
6917 		hci_conn_add_sysfs(conn);
6918 		hci_iso_setup_path(conn);
6919 	}
6920 
6921 	if (!ev->status && !i)
6922 		/* If no BISes have been connected for the BIG,
6923 		 * terminate. This is in case all bound connections
6924 		 * have been closed before the BIG creation
6925 		 * has completed.
6926 		 */
6927 		hci_cmd_sync_queue(hdev, hci_iso_term_big_sync,
6928 				   UINT_PTR(ev->handle), NULL);
6929 
6930 	hci_dev_unlock(hdev);
6931 }
6932 
hci_le_big_sync_established_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)6933 static void hci_le_big_sync_established_evt(struct hci_dev *hdev, void *data,
6934 					    struct sk_buff *skb)
6935 {
6936 	struct hci_evt_le_big_sync_estabilished *ev = data;
6937 	struct hci_conn *bis, *conn;
6938 	int i;
6939 
6940 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
6941 
6942 	if (!hci_le_ev_skb_pull(hdev, skb, HCI_EVT_LE_BIG_SYNC_ESTABLISHED,
6943 				flex_array_size(ev, bis, ev->num_bis)))
6944 		return;
6945 
6946 	hci_dev_lock(hdev);
6947 
6948 	conn = hci_conn_hash_lookup_big_sync_pend(hdev, ev->handle,
6949 						  ev->num_bis);
6950 	if (!conn) {
6951 		bt_dev_err(hdev,
6952 			   "Unable to find connection for big 0x%2.2x",
6953 			   ev->handle);
6954 		goto unlock;
6955 	}
6956 
6957 	clear_bit(HCI_CONN_CREATE_BIG_SYNC, &conn->flags);
6958 
6959 	conn->num_bis = 0;
6960 	memset(conn->bis, 0, sizeof(conn->num_bis));
6961 
6962 	for (i = 0; i < ev->num_bis; i++) {
6963 		u16 handle = le16_to_cpu(ev->bis[i]);
6964 		__le32 interval;
6965 
6966 		bis = hci_conn_hash_lookup_handle(hdev, handle);
6967 		if (!bis) {
6968 			if (handle > HCI_CONN_HANDLE_MAX) {
6969 				bt_dev_dbg(hdev, "ignore too large handle %u", handle);
6970 				continue;
6971 			}
6972 			bis = hci_conn_add(hdev, ISO_LINK, BDADDR_ANY,
6973 					   HCI_ROLE_SLAVE, handle);
6974 			if (IS_ERR(bis))
6975 				continue;
6976 		}
6977 
6978 		if (ev->status != 0x42)
6979 			/* Mark PA sync as established */
6980 			set_bit(HCI_CONN_PA_SYNC, &bis->flags);
6981 
6982 		bis->sync_handle = conn->sync_handle;
6983 		bis->iso_qos.bcast.big = ev->handle;
6984 		memset(&interval, 0, sizeof(interval));
6985 		memcpy(&interval, ev->latency, sizeof(ev->latency));
6986 		bis->iso_qos.bcast.in.interval = le32_to_cpu(interval);
6987 		/* Convert ISO Interval (1.25 ms slots) to latency (ms) */
6988 		bis->iso_qos.bcast.in.latency = le16_to_cpu(ev->interval) * 125 / 100;
6989 		bis->iso_qos.bcast.in.sdu = le16_to_cpu(ev->max_pdu);
6990 
6991 		if (!ev->status) {
6992 			set_bit(HCI_CONN_BIG_SYNC, &bis->flags);
6993 			hci_iso_setup_path(bis);
6994 		}
6995 	}
6996 
6997 	/* In case BIG sync failed, notify each failed connection to
6998 	 * the user after all hci connections have been added
6999 	 */
7000 	if (ev->status)
7001 		for (i = 0; i < ev->num_bis; i++) {
7002 			u16 handle = le16_to_cpu(ev->bis[i]);
7003 
7004 			bis = hci_conn_hash_lookup_handle(hdev, handle);
7005 			if (!bis)
7006 				continue;
7007 
7008 			set_bit(HCI_CONN_BIG_SYNC_FAILED, &bis->flags);
7009 			hci_connect_cfm(bis, ev->status);
7010 		}
7011 
7012 unlock:
7013 	hci_dev_unlock(hdev);
7014 }
7015 
hci_le_big_info_adv_report_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb)7016 static void hci_le_big_info_adv_report_evt(struct hci_dev *hdev, void *data,
7017 					   struct sk_buff *skb)
7018 {
7019 	struct hci_evt_le_big_info_adv_report *ev = data;
7020 	int mask = hdev->link_mode;
7021 	__u8 flags = 0;
7022 	struct hci_conn *pa_sync;
7023 
7024 	bt_dev_dbg(hdev, "sync_handle 0x%4.4x", le16_to_cpu(ev->sync_handle));
7025 
7026 	hci_dev_lock(hdev);
7027 
7028 	mask |= hci_proto_connect_ind(hdev, BDADDR_ANY, ISO_LINK, &flags);
7029 	if (!(mask & HCI_LM_ACCEPT))
7030 		goto unlock;
7031 
7032 	if (!(flags & HCI_PROTO_DEFER))
7033 		goto unlock;
7034 
7035 	pa_sync = hci_conn_hash_lookup_pa_sync_handle
7036 			(hdev,
7037 			le16_to_cpu(ev->sync_handle));
7038 
7039 	if (!pa_sync)
7040 		goto unlock;
7041 
7042 	pa_sync->iso_qos.bcast.encryption = ev->encryption;
7043 
7044 	/* Notify iso layer */
7045 	hci_connect_cfm(pa_sync, 0);
7046 
7047 unlock:
7048 	hci_dev_unlock(hdev);
7049 }
7050 
7051 #define HCI_LE_EV_VL(_op, _func, _min_len, _max_len) \
7052 [_op] = { \
7053 	.func = _func, \
7054 	.min_len = _min_len, \
7055 	.max_len = _max_len, \
7056 }
7057 
7058 #define HCI_LE_EV(_op, _func, _len) \
7059 	HCI_LE_EV_VL(_op, _func, _len, _len)
7060 
7061 #define HCI_LE_EV_STATUS(_op, _func) \
7062 	HCI_LE_EV(_op, _func, sizeof(struct hci_ev_status))
7063 
7064 /* Entries in this table shall have their position according to the subevent
7065  * opcode they handle so the use of the macros above is recommend since it does
7066  * attempt to initialize at its proper index using Designated Initializers that
7067  * way events without a callback function can be ommited.
7068  */
7069 static const struct hci_le_ev {
7070 	void (*func)(struct hci_dev *hdev, void *data, struct sk_buff *skb);
7071 	u16  min_len;
7072 	u16  max_len;
7073 } hci_le_ev_table[U8_MAX + 1] = {
7074 	/* [0x01 = HCI_EV_LE_CONN_COMPLETE] */
7075 	HCI_LE_EV(HCI_EV_LE_CONN_COMPLETE, hci_le_conn_complete_evt,
7076 		  sizeof(struct hci_ev_le_conn_complete)),
7077 	/* [0x02 = HCI_EV_LE_ADVERTISING_REPORT] */
7078 	HCI_LE_EV_VL(HCI_EV_LE_ADVERTISING_REPORT, hci_le_adv_report_evt,
7079 		     sizeof(struct hci_ev_le_advertising_report),
7080 		     HCI_MAX_EVENT_SIZE),
7081 	/* [0x03 = HCI_EV_LE_CONN_UPDATE_COMPLETE] */
7082 	HCI_LE_EV(HCI_EV_LE_CONN_UPDATE_COMPLETE,
7083 		  hci_le_conn_update_complete_evt,
7084 		  sizeof(struct hci_ev_le_conn_update_complete)),
7085 	/* [0x04 = HCI_EV_LE_REMOTE_FEAT_COMPLETE] */
7086 	HCI_LE_EV(HCI_EV_LE_REMOTE_FEAT_COMPLETE,
7087 		  hci_le_remote_feat_complete_evt,
7088 		  sizeof(struct hci_ev_le_remote_feat_complete)),
7089 	/* [0x05 = HCI_EV_LE_LTK_REQ] */
7090 	HCI_LE_EV(HCI_EV_LE_LTK_REQ, hci_le_ltk_request_evt,
7091 		  sizeof(struct hci_ev_le_ltk_req)),
7092 	/* [0x06 = HCI_EV_LE_REMOTE_CONN_PARAM_REQ] */
7093 	HCI_LE_EV(HCI_EV_LE_REMOTE_CONN_PARAM_REQ,
7094 		  hci_le_remote_conn_param_req_evt,
7095 		  sizeof(struct hci_ev_le_remote_conn_param_req)),
7096 	/* [0x0a = HCI_EV_LE_ENHANCED_CONN_COMPLETE] */
7097 	HCI_LE_EV(HCI_EV_LE_ENHANCED_CONN_COMPLETE,
7098 		  hci_le_enh_conn_complete_evt,
7099 		  sizeof(struct hci_ev_le_enh_conn_complete)),
7100 	/* [0x0b = HCI_EV_LE_DIRECT_ADV_REPORT] */
7101 	HCI_LE_EV_VL(HCI_EV_LE_DIRECT_ADV_REPORT, hci_le_direct_adv_report_evt,
7102 		     sizeof(struct hci_ev_le_direct_adv_report),
7103 		     HCI_MAX_EVENT_SIZE),
7104 	/* [0x0c = HCI_EV_LE_PHY_UPDATE_COMPLETE] */
7105 	HCI_LE_EV(HCI_EV_LE_PHY_UPDATE_COMPLETE, hci_le_phy_update_evt,
7106 		  sizeof(struct hci_ev_le_phy_update_complete)),
7107 	/* [0x0d = HCI_EV_LE_EXT_ADV_REPORT] */
7108 	HCI_LE_EV_VL(HCI_EV_LE_EXT_ADV_REPORT, hci_le_ext_adv_report_evt,
7109 		     sizeof(struct hci_ev_le_ext_adv_report),
7110 		     HCI_MAX_EVENT_SIZE),
7111 	/* [0x0e = HCI_EV_LE_PA_SYNC_ESTABLISHED] */
7112 	HCI_LE_EV(HCI_EV_LE_PA_SYNC_ESTABLISHED,
7113 		  hci_le_pa_sync_estabilished_evt,
7114 		  sizeof(struct hci_ev_le_pa_sync_established)),
7115 	/* [0x0f = HCI_EV_LE_PER_ADV_REPORT] */
7116 	HCI_LE_EV_VL(HCI_EV_LE_PER_ADV_REPORT,
7117 				 hci_le_per_adv_report_evt,
7118 				 sizeof(struct hci_ev_le_per_adv_report),
7119 				 HCI_MAX_EVENT_SIZE),
7120 	/* [0x12 = HCI_EV_LE_EXT_ADV_SET_TERM] */
7121 	HCI_LE_EV(HCI_EV_LE_EXT_ADV_SET_TERM, hci_le_ext_adv_term_evt,
7122 		  sizeof(struct hci_evt_le_ext_adv_set_term)),
7123 	/* [0x19 = HCI_EVT_LE_CIS_ESTABLISHED] */
7124 	HCI_LE_EV(HCI_EVT_LE_CIS_ESTABLISHED, hci_le_cis_estabilished_evt,
7125 		  sizeof(struct hci_evt_le_cis_established)),
7126 	/* [0x1a = HCI_EVT_LE_CIS_REQ] */
7127 	HCI_LE_EV(HCI_EVT_LE_CIS_REQ, hci_le_cis_req_evt,
7128 		  sizeof(struct hci_evt_le_cis_req)),
7129 	/* [0x1b = HCI_EVT_LE_CREATE_BIG_COMPLETE] */
7130 	HCI_LE_EV_VL(HCI_EVT_LE_CREATE_BIG_COMPLETE,
7131 		     hci_le_create_big_complete_evt,
7132 		     sizeof(struct hci_evt_le_create_big_complete),
7133 		     HCI_MAX_EVENT_SIZE),
7134 	/* [0x1d = HCI_EV_LE_BIG_SYNC_ESTABLISHED] */
7135 	HCI_LE_EV_VL(HCI_EVT_LE_BIG_SYNC_ESTABLISHED,
7136 		     hci_le_big_sync_established_evt,
7137 		     sizeof(struct hci_evt_le_big_sync_estabilished),
7138 		     HCI_MAX_EVENT_SIZE),
7139 	/* [0x22 = HCI_EVT_LE_BIG_INFO_ADV_REPORT] */
7140 	HCI_LE_EV_VL(HCI_EVT_LE_BIG_INFO_ADV_REPORT,
7141 		     hci_le_big_info_adv_report_evt,
7142 		     sizeof(struct hci_evt_le_big_info_adv_report),
7143 		     HCI_MAX_EVENT_SIZE),
7144 };
7145 
hci_le_meta_evt(struct hci_dev * hdev,void * data,struct sk_buff * skb,u16 * opcode,u8 * status,hci_req_complete_t * req_complete,hci_req_complete_skb_t * req_complete_skb)7146 static void hci_le_meta_evt(struct hci_dev *hdev, void *data,
7147 			    struct sk_buff *skb, u16 *opcode, u8 *status,
7148 			    hci_req_complete_t *req_complete,
7149 			    hci_req_complete_skb_t *req_complete_skb)
7150 {
7151 	struct hci_ev_le_meta *ev = data;
7152 	const struct hci_le_ev *subev;
7153 
7154 	bt_dev_dbg(hdev, "subevent 0x%2.2x", ev->subevent);
7155 
7156 	/* Only match event if command OGF is for LE */
7157 	if (hdev->req_skb &&
7158 	    hci_opcode_ogf(hci_skb_opcode(hdev->req_skb)) == 0x08 &&
7159 	    hci_skb_event(hdev->req_skb) == ev->subevent) {
7160 		*opcode = hci_skb_opcode(hdev->req_skb);
7161 		hci_req_cmd_complete(hdev, *opcode, 0x00, req_complete,
7162 				     req_complete_skb);
7163 	}
7164 
7165 	subev = &hci_le_ev_table[ev->subevent];
7166 	if (!subev->func)
7167 		return;
7168 
7169 	if (skb->len < subev->min_len) {
7170 		bt_dev_err(hdev, "unexpected subevent 0x%2.2x length: %u < %u",
7171 			   ev->subevent, skb->len, subev->min_len);
7172 		return;
7173 	}
7174 
7175 	/* Just warn if the length is over max_len size it still be
7176 	 * possible to partially parse the event so leave to callback to
7177 	 * decide if that is acceptable.
7178 	 */
7179 	if (skb->len > subev->max_len)
7180 		bt_dev_warn(hdev, "unexpected subevent 0x%2.2x length: %u > %u",
7181 			    ev->subevent, skb->len, subev->max_len);
7182 	data = hci_le_ev_skb_pull(hdev, skb, ev->subevent, subev->min_len);
7183 	if (!data)
7184 		return;
7185 
7186 	subev->func(hdev, data, skb);
7187 }
7188 
hci_get_cmd_complete(struct hci_dev * hdev,u16 opcode,u8 event,struct sk_buff * skb)7189 static bool hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode,
7190 				 u8 event, struct sk_buff *skb)
7191 {
7192 	struct hci_ev_cmd_complete *ev;
7193 	struct hci_event_hdr *hdr;
7194 
7195 	if (!skb)
7196 		return false;
7197 
7198 	hdr = hci_ev_skb_pull(hdev, skb, event, sizeof(*hdr));
7199 	if (!hdr)
7200 		return false;
7201 
7202 	if (event) {
7203 		if (hdr->evt != event)
7204 			return false;
7205 		return true;
7206 	}
7207 
7208 	/* Check if request ended in Command Status - no way to retrieve
7209 	 * any extra parameters in this case.
7210 	 */
7211 	if (hdr->evt == HCI_EV_CMD_STATUS)
7212 		return false;
7213 
7214 	if (hdr->evt != HCI_EV_CMD_COMPLETE) {
7215 		bt_dev_err(hdev, "last event is not cmd complete (0x%2.2x)",
7216 			   hdr->evt);
7217 		return false;
7218 	}
7219 
7220 	ev = hci_cc_skb_pull(hdev, skb, opcode, sizeof(*ev));
7221 	if (!ev)
7222 		return false;
7223 
7224 	if (opcode != __le16_to_cpu(ev->opcode)) {
7225 		BT_DBG("opcode doesn't match (0x%2.2x != 0x%2.2x)", opcode,
7226 		       __le16_to_cpu(ev->opcode));
7227 		return false;
7228 	}
7229 
7230 	return true;
7231 }
7232 
hci_store_wake_reason(struct hci_dev * hdev,u8 event,struct sk_buff * skb)7233 static void hci_store_wake_reason(struct hci_dev *hdev, u8 event,
7234 				  struct sk_buff *skb)
7235 {
7236 	struct hci_ev_le_advertising_info *adv;
7237 	struct hci_ev_le_direct_adv_info *direct_adv;
7238 	struct hci_ev_le_ext_adv_info *ext_adv;
7239 	const struct hci_ev_conn_complete *conn_complete = (void *)skb->data;
7240 	const struct hci_ev_conn_request *conn_request = (void *)skb->data;
7241 
7242 	hci_dev_lock(hdev);
7243 
7244 	/* If we are currently suspended and this is the first BT event seen,
7245 	 * save the wake reason associated with the event.
7246 	 */
7247 	if (!hdev->suspended || hdev->wake_reason)
7248 		goto unlock;
7249 
7250 	/* Default to remote wake. Values for wake_reason are documented in the
7251 	 * Bluez mgmt api docs.
7252 	 */
7253 	hdev->wake_reason = MGMT_WAKE_REASON_REMOTE_WAKE;
7254 
7255 	/* Once configured for remote wakeup, we should only wake up for
7256 	 * reconnections. It's useful to see which device is waking us up so
7257 	 * keep track of the bdaddr of the connection event that woke us up.
7258 	 */
7259 	if (event == HCI_EV_CONN_REQUEST) {
7260 		bacpy(&hdev->wake_addr, &conn_request->bdaddr);
7261 		hdev->wake_addr_type = BDADDR_BREDR;
7262 	} else if (event == HCI_EV_CONN_COMPLETE) {
7263 		bacpy(&hdev->wake_addr, &conn_complete->bdaddr);
7264 		hdev->wake_addr_type = BDADDR_BREDR;
7265 	} else if (event == HCI_EV_LE_META) {
7266 		struct hci_ev_le_meta *le_ev = (void *)skb->data;
7267 		u8 subevent = le_ev->subevent;
7268 		u8 *ptr = &skb->data[sizeof(*le_ev)];
7269 		u8 num_reports = *ptr;
7270 
7271 		if ((subevent == HCI_EV_LE_ADVERTISING_REPORT ||
7272 		     subevent == HCI_EV_LE_DIRECT_ADV_REPORT ||
7273 		     subevent == HCI_EV_LE_EXT_ADV_REPORT) &&
7274 		    num_reports) {
7275 			adv = (void *)(ptr + 1);
7276 			direct_adv = (void *)(ptr + 1);
7277 			ext_adv = (void *)(ptr + 1);
7278 
7279 			switch (subevent) {
7280 			case HCI_EV_LE_ADVERTISING_REPORT:
7281 				bacpy(&hdev->wake_addr, &adv->bdaddr);
7282 				hdev->wake_addr_type = adv->bdaddr_type;
7283 				break;
7284 			case HCI_EV_LE_DIRECT_ADV_REPORT:
7285 				bacpy(&hdev->wake_addr, &direct_adv->bdaddr);
7286 				hdev->wake_addr_type = direct_adv->bdaddr_type;
7287 				break;
7288 			case HCI_EV_LE_EXT_ADV_REPORT:
7289 				bacpy(&hdev->wake_addr, &ext_adv->bdaddr);
7290 				hdev->wake_addr_type = ext_adv->bdaddr_type;
7291 				break;
7292 			}
7293 		}
7294 	} else {
7295 		hdev->wake_reason = MGMT_WAKE_REASON_UNEXPECTED;
7296 	}
7297 
7298 unlock:
7299 	hci_dev_unlock(hdev);
7300 }
7301 
7302 #define HCI_EV_VL(_op, _func, _min_len, _max_len) \
7303 [_op] = { \
7304 	.req = false, \
7305 	.func = _func, \
7306 	.min_len = _min_len, \
7307 	.max_len = _max_len, \
7308 }
7309 
7310 #define HCI_EV(_op, _func, _len) \
7311 	HCI_EV_VL(_op, _func, _len, _len)
7312 
7313 #define HCI_EV_STATUS(_op, _func) \
7314 	HCI_EV(_op, _func, sizeof(struct hci_ev_status))
7315 
7316 #define HCI_EV_REQ_VL(_op, _func, _min_len, _max_len) \
7317 [_op] = { \
7318 	.req = true, \
7319 	.func_req = _func, \
7320 	.min_len = _min_len, \
7321 	.max_len = _max_len, \
7322 }
7323 
7324 #define HCI_EV_REQ(_op, _func, _len) \
7325 	HCI_EV_REQ_VL(_op, _func, _len, _len)
7326 
7327 /* Entries in this table shall have their position according to the event opcode
7328  * they handle so the use of the macros above is recommend since it does attempt
7329  * to initialize at its proper index using Designated Initializers that way
7330  * events without a callback function don't have entered.
7331  */
7332 static const struct hci_ev {
7333 	bool req;
7334 	union {
7335 		void (*func)(struct hci_dev *hdev, void *data,
7336 			     struct sk_buff *skb);
7337 		void (*func_req)(struct hci_dev *hdev, void *data,
7338 				 struct sk_buff *skb, u16 *opcode, u8 *status,
7339 				 hci_req_complete_t *req_complete,
7340 				 hci_req_complete_skb_t *req_complete_skb);
7341 	};
7342 	u16  min_len;
7343 	u16  max_len;
7344 } hci_ev_table[U8_MAX + 1] = {
7345 	/* [0x01 = HCI_EV_INQUIRY_COMPLETE] */
7346 	HCI_EV_STATUS(HCI_EV_INQUIRY_COMPLETE, hci_inquiry_complete_evt),
7347 	/* [0x02 = HCI_EV_INQUIRY_RESULT] */
7348 	HCI_EV_VL(HCI_EV_INQUIRY_RESULT, hci_inquiry_result_evt,
7349 		  sizeof(struct hci_ev_inquiry_result), HCI_MAX_EVENT_SIZE),
7350 	/* [0x03 = HCI_EV_CONN_COMPLETE] */
7351 	HCI_EV(HCI_EV_CONN_COMPLETE, hci_conn_complete_evt,
7352 	       sizeof(struct hci_ev_conn_complete)),
7353 	/* [0x04 = HCI_EV_CONN_REQUEST] */
7354 	HCI_EV(HCI_EV_CONN_REQUEST, hci_conn_request_evt,
7355 	       sizeof(struct hci_ev_conn_request)),
7356 	/* [0x05 = HCI_EV_DISCONN_COMPLETE] */
7357 	HCI_EV(HCI_EV_DISCONN_COMPLETE, hci_disconn_complete_evt,
7358 	       sizeof(struct hci_ev_disconn_complete)),
7359 	/* [0x06 = HCI_EV_AUTH_COMPLETE] */
7360 	HCI_EV(HCI_EV_AUTH_COMPLETE, hci_auth_complete_evt,
7361 	       sizeof(struct hci_ev_auth_complete)),
7362 	/* [0x07 = HCI_EV_REMOTE_NAME] */
7363 	HCI_EV(HCI_EV_REMOTE_NAME, hci_remote_name_evt,
7364 	       sizeof(struct hci_ev_remote_name)),
7365 	/* [0x08 = HCI_EV_ENCRYPT_CHANGE] */
7366 	HCI_EV(HCI_EV_ENCRYPT_CHANGE, hci_encrypt_change_evt,
7367 	       sizeof(struct hci_ev_encrypt_change)),
7368 	/* [0x09 = HCI_EV_CHANGE_LINK_KEY_COMPLETE] */
7369 	HCI_EV(HCI_EV_CHANGE_LINK_KEY_COMPLETE,
7370 	       hci_change_link_key_complete_evt,
7371 	       sizeof(struct hci_ev_change_link_key_complete)),
7372 	/* [0x0b = HCI_EV_REMOTE_FEATURES] */
7373 	HCI_EV(HCI_EV_REMOTE_FEATURES, hci_remote_features_evt,
7374 	       sizeof(struct hci_ev_remote_features)),
7375 	/* [0x0e = HCI_EV_CMD_COMPLETE] */
7376 	HCI_EV_REQ_VL(HCI_EV_CMD_COMPLETE, hci_cmd_complete_evt,
7377 		      sizeof(struct hci_ev_cmd_complete), HCI_MAX_EVENT_SIZE),
7378 	/* [0x0f = HCI_EV_CMD_STATUS] */
7379 	HCI_EV_REQ(HCI_EV_CMD_STATUS, hci_cmd_status_evt,
7380 		   sizeof(struct hci_ev_cmd_status)),
7381 	/* [0x10 = HCI_EV_CMD_STATUS] */
7382 	HCI_EV(HCI_EV_HARDWARE_ERROR, hci_hardware_error_evt,
7383 	       sizeof(struct hci_ev_hardware_error)),
7384 	/* [0x12 = HCI_EV_ROLE_CHANGE] */
7385 	HCI_EV(HCI_EV_ROLE_CHANGE, hci_role_change_evt,
7386 	       sizeof(struct hci_ev_role_change)),
7387 	/* [0x13 = HCI_EV_NUM_COMP_PKTS] */
7388 	HCI_EV_VL(HCI_EV_NUM_COMP_PKTS, hci_num_comp_pkts_evt,
7389 		  sizeof(struct hci_ev_num_comp_pkts), HCI_MAX_EVENT_SIZE),
7390 	/* [0x14 = HCI_EV_MODE_CHANGE] */
7391 	HCI_EV(HCI_EV_MODE_CHANGE, hci_mode_change_evt,
7392 	       sizeof(struct hci_ev_mode_change)),
7393 	/* [0x16 = HCI_EV_PIN_CODE_REQ] */
7394 	HCI_EV(HCI_EV_PIN_CODE_REQ, hci_pin_code_request_evt,
7395 	       sizeof(struct hci_ev_pin_code_req)),
7396 	/* [0x17 = HCI_EV_LINK_KEY_REQ] */
7397 	HCI_EV(HCI_EV_LINK_KEY_REQ, hci_link_key_request_evt,
7398 	       sizeof(struct hci_ev_link_key_req)),
7399 	/* [0x18 = HCI_EV_LINK_KEY_NOTIFY] */
7400 	HCI_EV(HCI_EV_LINK_KEY_NOTIFY, hci_link_key_notify_evt,
7401 	       sizeof(struct hci_ev_link_key_notify)),
7402 	/* [0x1c = HCI_EV_CLOCK_OFFSET] */
7403 	HCI_EV(HCI_EV_CLOCK_OFFSET, hci_clock_offset_evt,
7404 	       sizeof(struct hci_ev_clock_offset)),
7405 	/* [0x1d = HCI_EV_PKT_TYPE_CHANGE] */
7406 	HCI_EV(HCI_EV_PKT_TYPE_CHANGE, hci_pkt_type_change_evt,
7407 	       sizeof(struct hci_ev_pkt_type_change)),
7408 	/* [0x20 = HCI_EV_PSCAN_REP_MODE] */
7409 	HCI_EV(HCI_EV_PSCAN_REP_MODE, hci_pscan_rep_mode_evt,
7410 	       sizeof(struct hci_ev_pscan_rep_mode)),
7411 	/* [0x22 = HCI_EV_INQUIRY_RESULT_WITH_RSSI] */
7412 	HCI_EV_VL(HCI_EV_INQUIRY_RESULT_WITH_RSSI,
7413 		  hci_inquiry_result_with_rssi_evt,
7414 		  sizeof(struct hci_ev_inquiry_result_rssi),
7415 		  HCI_MAX_EVENT_SIZE),
7416 	/* [0x23 = HCI_EV_REMOTE_EXT_FEATURES] */
7417 	HCI_EV(HCI_EV_REMOTE_EXT_FEATURES, hci_remote_ext_features_evt,
7418 	       sizeof(struct hci_ev_remote_ext_features)),
7419 	/* [0x2c = HCI_EV_SYNC_CONN_COMPLETE] */
7420 	HCI_EV(HCI_EV_SYNC_CONN_COMPLETE, hci_sync_conn_complete_evt,
7421 	       sizeof(struct hci_ev_sync_conn_complete)),
7422 	/* [0x2d = HCI_EV_EXTENDED_INQUIRY_RESULT] */
7423 	HCI_EV_VL(HCI_EV_EXTENDED_INQUIRY_RESULT,
7424 		  hci_extended_inquiry_result_evt,
7425 		  sizeof(struct hci_ev_ext_inquiry_result), HCI_MAX_EVENT_SIZE),
7426 	/* [0x30 = HCI_EV_KEY_REFRESH_COMPLETE] */
7427 	HCI_EV(HCI_EV_KEY_REFRESH_COMPLETE, hci_key_refresh_complete_evt,
7428 	       sizeof(struct hci_ev_key_refresh_complete)),
7429 	/* [0x31 = HCI_EV_IO_CAPA_REQUEST] */
7430 	HCI_EV(HCI_EV_IO_CAPA_REQUEST, hci_io_capa_request_evt,
7431 	       sizeof(struct hci_ev_io_capa_request)),
7432 	/* [0x32 = HCI_EV_IO_CAPA_REPLY] */
7433 	HCI_EV(HCI_EV_IO_CAPA_REPLY, hci_io_capa_reply_evt,
7434 	       sizeof(struct hci_ev_io_capa_reply)),
7435 	/* [0x33 = HCI_EV_USER_CONFIRM_REQUEST] */
7436 	HCI_EV(HCI_EV_USER_CONFIRM_REQUEST, hci_user_confirm_request_evt,
7437 	       sizeof(struct hci_ev_user_confirm_req)),
7438 	/* [0x34 = HCI_EV_USER_PASSKEY_REQUEST] */
7439 	HCI_EV(HCI_EV_USER_PASSKEY_REQUEST, hci_user_passkey_request_evt,
7440 	       sizeof(struct hci_ev_user_passkey_req)),
7441 	/* [0x35 = HCI_EV_REMOTE_OOB_DATA_REQUEST] */
7442 	HCI_EV(HCI_EV_REMOTE_OOB_DATA_REQUEST, hci_remote_oob_data_request_evt,
7443 	       sizeof(struct hci_ev_remote_oob_data_request)),
7444 	/* [0x36 = HCI_EV_SIMPLE_PAIR_COMPLETE] */
7445 	HCI_EV(HCI_EV_SIMPLE_PAIR_COMPLETE, hci_simple_pair_complete_evt,
7446 	       sizeof(struct hci_ev_simple_pair_complete)),
7447 	/* [0x3b = HCI_EV_USER_PASSKEY_NOTIFY] */
7448 	HCI_EV(HCI_EV_USER_PASSKEY_NOTIFY, hci_user_passkey_notify_evt,
7449 	       sizeof(struct hci_ev_user_passkey_notify)),
7450 	/* [0x3c = HCI_EV_KEYPRESS_NOTIFY] */
7451 	HCI_EV(HCI_EV_KEYPRESS_NOTIFY, hci_keypress_notify_evt,
7452 	       sizeof(struct hci_ev_keypress_notify)),
7453 	/* [0x3d = HCI_EV_REMOTE_HOST_FEATURES] */
7454 	HCI_EV(HCI_EV_REMOTE_HOST_FEATURES, hci_remote_host_features_evt,
7455 	       sizeof(struct hci_ev_remote_host_features)),
7456 	/* [0x3e = HCI_EV_LE_META] */
7457 	HCI_EV_REQ_VL(HCI_EV_LE_META, hci_le_meta_evt,
7458 		      sizeof(struct hci_ev_le_meta), HCI_MAX_EVENT_SIZE),
7459 	/* [0xff = HCI_EV_VENDOR] */
7460 	HCI_EV_VL(HCI_EV_VENDOR, msft_vendor_evt, 0, HCI_MAX_EVENT_SIZE),
7461 };
7462 
hci_event_func(struct hci_dev * hdev,u8 event,struct sk_buff * skb,u16 * opcode,u8 * status,hci_req_complete_t * req_complete,hci_req_complete_skb_t * req_complete_skb)7463 static void hci_event_func(struct hci_dev *hdev, u8 event, struct sk_buff *skb,
7464 			   u16 *opcode, u8 *status,
7465 			   hci_req_complete_t *req_complete,
7466 			   hci_req_complete_skb_t *req_complete_skb)
7467 {
7468 	const struct hci_ev *ev = &hci_ev_table[event];
7469 	void *data;
7470 
7471 	if (!ev->func)
7472 		return;
7473 
7474 	if (skb->len < ev->min_len) {
7475 		bt_dev_err(hdev, "unexpected event 0x%2.2x length: %u < %u",
7476 			   event, skb->len, ev->min_len);
7477 		return;
7478 	}
7479 
7480 	/* Just warn if the length is over max_len size it still be
7481 	 * possible to partially parse the event so leave to callback to
7482 	 * decide if that is acceptable.
7483 	 */
7484 	if (skb->len > ev->max_len)
7485 		bt_dev_warn_ratelimited(hdev,
7486 					"unexpected event 0x%2.2x length: %u > %u",
7487 					event, skb->len, ev->max_len);
7488 
7489 	data = hci_ev_skb_pull(hdev, skb, event, ev->min_len);
7490 	if (!data)
7491 		return;
7492 
7493 	if (ev->req)
7494 		ev->func_req(hdev, data, skb, opcode, status, req_complete,
7495 			     req_complete_skb);
7496 	else
7497 		ev->func(hdev, data, skb);
7498 }
7499 
hci_event_packet(struct hci_dev * hdev,struct sk_buff * skb)7500 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
7501 {
7502 	struct hci_event_hdr *hdr = (void *) skb->data;
7503 	hci_req_complete_t req_complete = NULL;
7504 	hci_req_complete_skb_t req_complete_skb = NULL;
7505 	struct sk_buff *orig_skb = NULL;
7506 	u8 status = 0, event, req_evt = 0;
7507 	u16 opcode = HCI_OP_NOP;
7508 
7509 	if (skb->len < sizeof(*hdr)) {
7510 		bt_dev_err(hdev, "Malformed HCI Event");
7511 		goto done;
7512 	}
7513 
7514 	kfree_skb(hdev->recv_event);
7515 	hdev->recv_event = skb_clone(skb, GFP_KERNEL);
7516 
7517 	event = hdr->evt;
7518 	if (!event) {
7519 		bt_dev_warn(hdev, "Received unexpected HCI Event 0x%2.2x",
7520 			    event);
7521 		goto done;
7522 	}
7523 
7524 	/* Only match event if command OGF is not for LE */
7525 	if (hdev->req_skb &&
7526 	    hci_opcode_ogf(hci_skb_opcode(hdev->req_skb)) != 0x08 &&
7527 	    hci_skb_event(hdev->req_skb) == event) {
7528 		hci_req_cmd_complete(hdev, hci_skb_opcode(hdev->req_skb),
7529 				     status, &req_complete, &req_complete_skb);
7530 		req_evt = event;
7531 	}
7532 
7533 	/* If it looks like we might end up having to call
7534 	 * req_complete_skb, store a pristine copy of the skb since the
7535 	 * various handlers may modify the original one through
7536 	 * skb_pull() calls, etc.
7537 	 */
7538 	if (req_complete_skb || event == HCI_EV_CMD_STATUS ||
7539 	    event == HCI_EV_CMD_COMPLETE)
7540 		orig_skb = skb_clone(skb, GFP_KERNEL);
7541 
7542 	skb_pull(skb, HCI_EVENT_HDR_SIZE);
7543 
7544 	/* Store wake reason if we're suspended */
7545 	hci_store_wake_reason(hdev, event, skb);
7546 
7547 	bt_dev_dbg(hdev, "event 0x%2.2x", event);
7548 
7549 	hci_event_func(hdev, event, skb, &opcode, &status, &req_complete,
7550 		       &req_complete_skb);
7551 
7552 	if (req_complete) {
7553 		req_complete(hdev, status, opcode);
7554 	} else if (req_complete_skb) {
7555 		if (!hci_get_cmd_complete(hdev, opcode, req_evt, orig_skb)) {
7556 			kfree_skb(orig_skb);
7557 			orig_skb = NULL;
7558 		}
7559 		req_complete_skb(hdev, status, opcode, orig_skb);
7560 	}
7561 
7562 done:
7563 	kfree_skb(orig_skb);
7564 	kfree_skb(skb);
7565 	hdev->stat.evt_rx++;
7566 }
7567