1	/*
2	BlueZ - Bluetooth protocol stack for Linux
3	Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
4	Copyright 2023 NXP
5
6	Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
7
8	This program is free software; you can redistribute it and/or modify
9	it under the terms of the GNU General Public License version 2 as
10	published by the Free Software Foundation;
11
12	THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
13	OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
14	FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
15	IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
16	CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
17	WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
18	ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
19	OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20
21	ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
22	COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
23	SOFTWARE IS DISCLAIMED.
24	*/
25
26	/* Bluetooth HCI event handling. */
27
28	#include <asm/unaligned.h>
29	#include <linux/crypto.h>
30	#include <crypto/algapi.h>
31
32	#include <net/bluetooth/bluetooth.h>
33	#include <net/bluetooth/hci_core.h>
34	#include <net/bluetooth/mgmt.h>
35
36	#include "hci_request.h"
37	#include "hci_debugfs.h"
38	#include "hci_codec.h"
39	#include "smp.h"
40	#include "msft.h"
41	#include "eir.h"
42
43	#define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
44	"\x00\x00\x00\x00\x00\x00\x00\x00"
45
46	#define secs_to_jiffies(_secs) msecs_to_jiffies((_secs) * 1000)
47
48	/* Handle HCI Event packets */
49
50	static void *hci_ev_skb_pull(struct hci_dev *hdev, struct sk_buff *skb,
51	u8 ev, size_t len)
52	{
53	void *data;
54
55	data = skb_pull_data(skb, len);
56	if (!data)
57	bt_dev_err(hdev, "Malformed Event: 0x%2.2x", ev);
58
59	return data;
60	}
61
62	static void *hci_cc_skb_pull(struct hci_dev *hdev, struct sk_buff *skb,
63	u16 op, size_t len)
64	{
65	void *data;
66
67	data = skb_pull_data(skb, len);
68	if (!data)
69	bt_dev_err(hdev, "Malformed Command Complete: 0x%4.4x", op);
70
71	return data;
72	}
73
74	static void *hci_le_ev_skb_pull(struct hci_dev *hdev, struct sk_buff *skb,
75	u8 ev, size_t len)
76	{
77	void *data;
78
79	data = skb_pull_data(skb, len);
80	if (!data)
81	bt_dev_err(hdev, "Malformed LE Event: 0x%2.2x", ev);
82
83	return data;
84	}
85
86	static u8 hci_cc_inquiry_cancel(struct hci_dev *hdev, void *data,
87	struct sk_buff *skb)
88	{
89	struct hci_ev_status *rp = data;
90
91	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
92
93	/* It is possible that we receive Inquiry Complete event right
94	* before we receive Inquiry Cancel Command Complete event, in
95	* which case the latter event should have status of Command
96	* Disallowed. This should not be treated as error, since
97	* we actually achieve what Inquiry Cancel wants to achieve,
98	* which is to end the last Inquiry session.
99	*/
100	if (rp->status == HCI_ERROR_COMMAND_DISALLOWED && !test_bit(HCI_INQUIRY, &hdev->flags)) {
101	bt_dev_warn(hdev, "Ignoring error of Inquiry Cancel command");
102	rp->status = 0x00;
103	}
104
105	if (rp->status)
106	return rp->status;
107
108	clear_bit(nr: HCI_INQUIRY, addr: &hdev->flags);
109	smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
110	wake_up_bit(word: &hdev->flags, bit: HCI_INQUIRY);
111
112	hci_dev_lock(hdev);
113	/* Set discovery state to stopped if we're not doing LE active
114	* scanning.
115	*/
116	if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
117	hdev->le_scan_type != LE_SCAN_ACTIVE)
118	hci_discovery_set_state(hdev, state: DISCOVERY_STOPPED);
119	hci_dev_unlock(hdev);
120
121	return rp->status;
122	}
123
124	static u8 hci_cc_periodic_inq(struct hci_dev *hdev, void *data,
125	struct sk_buff *skb)
126	{
127	struct hci_ev_status *rp = data;
128
129	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
130
131	if (rp->status)
132	return rp->status;
133
134	hci_dev_set_flag(hdev, HCI_PERIODIC_INQ);
135
136	return rp->status;
137	}
138
139	static u8 hci_cc_exit_periodic_inq(struct hci_dev *hdev, void *data,
140	struct sk_buff *skb)
141	{
142	struct hci_ev_status *rp = data;
143
144	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
145
146	if (rp->status)
147	return rp->status;
148
149	hci_dev_clear_flag(hdev, HCI_PERIODIC_INQ);
150
151	return rp->status;
152	}
153
154	static u8 hci_cc_remote_name_req_cancel(struct hci_dev *hdev, void *data,
155	struct sk_buff *skb)
156	{
157	struct hci_ev_status *rp = data;
158
159	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
160
161	return rp->status;
162	}
163
164	static u8 hci_cc_role_discovery(struct hci_dev *hdev, void *data,
165	struct sk_buff *skb)
166	{
167	struct hci_rp_role_discovery *rp = data;
168	struct hci_conn *conn;
169
170	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
171
172	if (rp->status)
173	return rp->status;
174
175	hci_dev_lock(hdev);
176
177	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
178	if (conn)
179	conn->role = rp->role;
180
181	hci_dev_unlock(hdev);
182
183	return rp->status;
184	}
185
186	static u8 hci_cc_read_link_policy(struct hci_dev *hdev, void *data,
187	struct sk_buff *skb)
188	{
189	struct hci_rp_read_link_policy *rp = data;
190	struct hci_conn *conn;
191
192	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
193
194	if (rp->status)
195	return rp->status;
196
197	hci_dev_lock(hdev);
198
199	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
200	if (conn)
201	conn->link_policy = __le16_to_cpu(rp->policy);
202
203	hci_dev_unlock(hdev);
204
205	return rp->status;
206	}
207
208	static u8 hci_cc_write_link_policy(struct hci_dev *hdev, void *data,
209	struct sk_buff *skb)
210	{
211	struct hci_rp_write_link_policy *rp = data;
212	struct hci_conn *conn;
213	void *sent;
214
215	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
216
217	if (rp->status)
218	return rp->status;
219
220	sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
221	if (!sent)
222	return rp->status;
223
224	hci_dev_lock(hdev);
225
226	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
227	if (conn)
228	conn->link_policy = get_unaligned_le16(p: sent + 2);
229
230	hci_dev_unlock(hdev);
231
232	return rp->status;
233	}
234
235	static u8 hci_cc_read_def_link_policy(struct hci_dev *hdev, void *data,
236	struct sk_buff *skb)
237	{
238	struct hci_rp_read_def_link_policy *rp = data;
239
240	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
241
242	if (rp->status)
243	return rp->status;
244
245	hdev->link_policy = __le16_to_cpu(rp->policy);
246
247	return rp->status;
248	}
249
250	static u8 hci_cc_write_def_link_policy(struct hci_dev *hdev, void *data,
251	struct sk_buff *skb)
252	{
253	struct hci_ev_status *rp = data;
254	void *sent;
255
256	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
257
258	if (rp->status)
259	return rp->status;
260
261	sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
262	if (!sent)
263	return rp->status;
264
265	hdev->link_policy = get_unaligned_le16(p: sent);
266
267	return rp->status;
268	}
269
270	static u8 hci_cc_reset(struct hci_dev *hdev, void *data, struct sk_buff *skb)
271	{
272	struct hci_ev_status *rp = data;
273
274	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
275
276	clear_bit(nr: HCI_RESET, addr: &hdev->flags);
277
278	if (rp->status)
279	return rp->status;
280
281	/* Reset all non-persistent flags */
282	hci_dev_clear_volatile_flags(hdev);
283
284	hci_discovery_set_state(hdev, state: DISCOVERY_STOPPED);
285
286	hdev->inq_tx_power = HCI_TX_POWER_INVALID;
287	hdev->adv_tx_power = HCI_TX_POWER_INVALID;
288
289	memset(hdev->adv_data, 0, sizeof(hdev->adv_data));
290	hdev->adv_data_len = 0;
291
292	memset(hdev->scan_rsp_data, 0, sizeof(hdev->scan_rsp_data));
293	hdev->scan_rsp_data_len = 0;
294
295	hdev->le_scan_type = LE_SCAN_PASSIVE;
296
297	hdev->ssp_debug_mode = 0;
298
299	hci_bdaddr_list_clear(list: &hdev->le_accept_list);
300	hci_bdaddr_list_clear(list: &hdev->le_resolv_list);
301
302	return rp->status;
303	}
304
305	static u8 hci_cc_read_stored_link_key(struct hci_dev *hdev, void *data,
306	struct sk_buff *skb)
307	{
308	struct hci_rp_read_stored_link_key *rp = data;
309	struct hci_cp_read_stored_link_key *sent;
310
311	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
312
313	sent = hci_sent_cmd_data(hdev, HCI_OP_READ_STORED_LINK_KEY);
314	if (!sent)
315	return rp->status;
316
317	if (!rp->status && sent->read_all == 0x01) {
318	hdev->stored_max_keys = le16_to_cpu(rp->max_keys);
319	hdev->stored_num_keys = le16_to_cpu(rp->num_keys);
320	}
321
322	return rp->status;
323	}
324
325	static u8 hci_cc_delete_stored_link_key(struct hci_dev *hdev, void *data,
326	struct sk_buff *skb)
327	{
328	struct hci_rp_delete_stored_link_key *rp = data;
329	u16 num_keys;
330
331	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
332
333	if (rp->status)
334	return rp->status;
335
336	num_keys = le16_to_cpu(rp->num_keys);
337
338	if (num_keys <= hdev->stored_num_keys)
339	hdev->stored_num_keys -= num_keys;
340	else
341	hdev->stored_num_keys = 0;
342
343	return rp->status;
344	}
345
346	static u8 hci_cc_write_local_name(struct hci_dev *hdev, void *data,
347	struct sk_buff *skb)
348	{
349	struct hci_ev_status *rp = data;
350	void *sent;
351
352	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
353
354	sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
355	if (!sent)
356	return rp->status;
357
358	hci_dev_lock(hdev);
359
360	if (hci_dev_test_flag(hdev, HCI_MGMT))
361	mgmt_set_local_name_complete(hdev, name: sent, status: rp->status);
362	else if (!rp->status)
363	memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
364
365	hci_dev_unlock(hdev);
366
367	return rp->status;
368	}
369
370	static u8 hci_cc_read_local_name(struct hci_dev *hdev, void *data,
371	struct sk_buff *skb)
372	{
373	struct hci_rp_read_local_name *rp = data;
374
375	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
376
377	if (rp->status)
378	return rp->status;
379
380	if (hci_dev_test_flag(hdev, HCI_SETUP) ||
381	hci_dev_test_flag(hdev, HCI_CONFIG))
382	memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
383
384	return rp->status;
385	}
386
387	static u8 hci_cc_write_auth_enable(struct hci_dev *hdev, void *data,
388	struct sk_buff *skb)
389	{
390	struct hci_ev_status *rp = data;
391	void *sent;
392
393	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
394
395	sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
396	if (!sent)
397	return rp->status;
398
399	hci_dev_lock(hdev);
400
401	if (!rp->status) {
402	__u8 param = *((__u8 *) sent);
403
404	if (param == AUTH_ENABLED)
405	set_bit(nr: HCI_AUTH, addr: &hdev->flags);
406	else
407	clear_bit(nr: HCI_AUTH, addr: &hdev->flags);
408	}
409
410	if (hci_dev_test_flag(hdev, HCI_MGMT))
411	mgmt_auth_enable_complete(hdev, status: rp->status);
412
413	hci_dev_unlock(hdev);
414
415	return rp->status;
416	}
417
418	static u8 hci_cc_write_encrypt_mode(struct hci_dev *hdev, void *data,
419	struct sk_buff *skb)
420	{
421	struct hci_ev_status *rp = data;
422	__u8 param;
423	void *sent;
424
425	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
426
427	if (rp->status)
428	return rp->status;
429
430	sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
431	if (!sent)
432	return rp->status;
433
434	param = *((__u8 *) sent);
435
436	if (param)
437	set_bit(nr: HCI_ENCRYPT, addr: &hdev->flags);
438	else
439	clear_bit(nr: HCI_ENCRYPT, addr: &hdev->flags);
440
441	return rp->status;
442	}
443
444	static u8 hci_cc_write_scan_enable(struct hci_dev *hdev, void *data,
445	struct sk_buff *skb)
446	{
447	struct hci_ev_status *rp = data;
448	__u8 param;
449	void *sent;
450
451	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
452
453	sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
454	if (!sent)
455	return rp->status;
456
457	param = *((__u8 *) sent);
458
459	hci_dev_lock(hdev);
460
461	if (rp->status) {
462	hdev->discov_timeout = 0;
463	goto done;
464	}
465
466	if (param & SCAN_INQUIRY)
467	set_bit(nr: HCI_ISCAN, addr: &hdev->flags);
468	else
469	clear_bit(nr: HCI_ISCAN, addr: &hdev->flags);
470
471	if (param & SCAN_PAGE)
472	set_bit(nr: HCI_PSCAN, addr: &hdev->flags);
473	else
474	clear_bit(nr: HCI_PSCAN, addr: &hdev->flags);
475
476	done:
477	hci_dev_unlock(hdev);
478
479	return rp->status;
480	}
481
482	static u8 hci_cc_set_event_filter(struct hci_dev *hdev, void *data,
483	struct sk_buff *skb)
484	{
485	struct hci_ev_status *rp = data;
486	struct hci_cp_set_event_filter *cp;
487	void *sent;
488
489	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
490
491	if (rp->status)
492	return rp->status;
493
494	sent = hci_sent_cmd_data(hdev, HCI_OP_SET_EVENT_FLT);
495	if (!sent)
496	return rp->status;
497
498	cp = (struct hci_cp_set_event_filter *)sent;
499
500	if (cp->flt_type == HCI_FLT_CLEAR_ALL)
501	hci_dev_clear_flag(hdev, HCI_EVENT_FILTER_CONFIGURED);
502	else
503	hci_dev_set_flag(hdev, HCI_EVENT_FILTER_CONFIGURED);
504
505	return rp->status;
506	}
507
508	static u8 hci_cc_read_class_of_dev(struct hci_dev *hdev, void *data,
509	struct sk_buff *skb)
510	{
511	struct hci_rp_read_class_of_dev *rp = data;
512
513	if (WARN_ON(!hdev))
514	return HCI_ERROR_UNSPECIFIED;
515
516	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
517
518	if (rp->status)
519	return rp->status;
520
521	memcpy(hdev->dev_class, rp->dev_class, 3);
522
523	bt_dev_dbg(hdev, "class 0x%.2x%.2x%.2x", hdev->dev_class[2],
524	hdev->dev_class[1], hdev->dev_class[0]);
525
526	return rp->status;
527	}
528
529	static u8 hci_cc_write_class_of_dev(struct hci_dev *hdev, void *data,
530	struct sk_buff *skb)
531	{
532	struct hci_ev_status *rp = data;
533	void *sent;
534
535	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
536
537	sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
538	if (!sent)
539	return rp->status;
540
541	hci_dev_lock(hdev);
542
543	if (!rp->status)
544	memcpy(hdev->dev_class, sent, 3);
545
546	if (hci_dev_test_flag(hdev, HCI_MGMT))
547	mgmt_set_class_of_dev_complete(hdev, dev_class: sent, status: rp->status);
548
549	hci_dev_unlock(hdev);
550
551	return rp->status;
552	}
553
554	static u8 hci_cc_read_voice_setting(struct hci_dev *hdev, void *data,
555	struct sk_buff *skb)
556	{
557	struct hci_rp_read_voice_setting *rp = data;
558	__u16 setting;
559
560	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
561
562	if (rp->status)
563	return rp->status;
564
565	setting = __le16_to_cpu(rp->voice_setting);
566
567	if (hdev->voice_setting == setting)
568	return rp->status;
569
570	hdev->voice_setting = setting;
571
572	bt_dev_dbg(hdev, "voice setting 0x%4.4x", setting);
573
574	if (hdev->notify)
575	hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
576
577	return rp->status;
578	}
579
580	static u8 hci_cc_write_voice_setting(struct hci_dev *hdev, void *data,
581	struct sk_buff *skb)
582	{
583	struct hci_ev_status *rp = data;
584	__u16 setting;
585	void *sent;
586
587	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
588
589	if (rp->status)
590	return rp->status;
591
592	sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
593	if (!sent)
594	return rp->status;
595
596	setting = get_unaligned_le16(p: sent);
597
598	if (hdev->voice_setting == setting)
599	return rp->status;
600
601	hdev->voice_setting = setting;
602
603	bt_dev_dbg(hdev, "voice setting 0x%4.4x", setting);
604
605	if (hdev->notify)
606	hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
607
608	return rp->status;
609	}
610
611	static u8 hci_cc_read_num_supported_iac(struct hci_dev *hdev, void *data,
612	struct sk_buff *skb)
613	{
614	struct hci_rp_read_num_supported_iac *rp = data;
615
616	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
617
618	if (rp->status)
619	return rp->status;
620
621	hdev->num_iac = rp->num_iac;
622
623	bt_dev_dbg(hdev, "num iac %d", hdev->num_iac);
624
625	return rp->status;
626	}
627
628	static u8 hci_cc_write_ssp_mode(struct hci_dev *hdev, void *data,
629	struct sk_buff *skb)
630	{
631	struct hci_ev_status *rp = data;
632	struct hci_cp_write_ssp_mode *sent;
633
634	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
635
636	sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
637	if (!sent)
638	return rp->status;
639
640	hci_dev_lock(hdev);
641
642	if (!rp->status) {
643	if (sent->mode)
644	hdev->features[1][0] |= LMP_HOST_SSP;
645	else
646	hdev->features[1][0] &= ~LMP_HOST_SSP;
647	}
648
649	if (!rp->status) {
650	if (sent->mode)
651	hci_dev_set_flag(hdev, HCI_SSP_ENABLED);
652	else
653	hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
654	}
655
656	hci_dev_unlock(hdev);
657
658	return rp->status;
659	}
660
661	static u8 hci_cc_write_sc_support(struct hci_dev *hdev, void *data,
662	struct sk_buff *skb)
663	{
664	struct hci_ev_status *rp = data;
665	struct hci_cp_write_sc_support *sent;
666
667	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
668
669	sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SC_SUPPORT);
670	if (!sent)
671	return rp->status;
672
673	hci_dev_lock(hdev);
674
675	if (!rp->status) {
676	if (sent->support)
677	hdev->features[1][0] |= LMP_HOST_SC;
678	else
679	hdev->features[1][0] &= ~LMP_HOST_SC;
680	}
681
682	if (!hci_dev_test_flag(hdev, HCI_MGMT) && !rp->status) {
683	if (sent->support)
684	hci_dev_set_flag(hdev, HCI_SC_ENABLED);
685	else
686	hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
687	}
688
689	hci_dev_unlock(hdev);
690
691	return rp->status;
692	}
693
694	static u8 hci_cc_read_local_version(struct hci_dev *hdev, void *data,
695	struct sk_buff *skb)
696	{
697	struct hci_rp_read_local_version *rp = data;
698
699	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
700
701	if (rp->status)
702	return rp->status;
703
704	if (hci_dev_test_flag(hdev, HCI_SETUP) ||
705	hci_dev_test_flag(hdev, HCI_CONFIG)) {
706	hdev->hci_ver = rp->hci_ver;
707	hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
708	hdev->lmp_ver = rp->lmp_ver;
709	hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
710	hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
711	}
712
713	return rp->status;
714	}
715
716	static u8 hci_cc_read_enc_key_size(struct hci_dev *hdev, void *data,
717	struct sk_buff *skb)
718	{
719	struct hci_rp_read_enc_key_size *rp = data;
720	struct hci_conn *conn;
721	u16 handle;
722	u8 status = rp->status;
723
724	bt_dev_dbg(hdev, "status 0x%2.2x", status);
725
726	handle = le16_to_cpu(rp->handle);
727
728	hci_dev_lock(hdev);
729
730	conn = hci_conn_hash_lookup_handle(hdev, handle);
731	if (!conn) {
732	status = 0xFF;
733	goto done;
734	}
735
736	/* While unexpected, the read_enc_key_size command may fail. The most
737	* secure approach is to then assume the key size is 0 to force a
738	* disconnection.
739	*/
740	if (status) {
741	bt_dev_err(hdev, "failed to read key size for handle %u",
742	handle);
743	conn->enc_key_size = 0;
744	} else {
745	conn->enc_key_size = rp->key_size;
746	status = 0;
747
748	if (conn->enc_key_size < hdev->min_enc_key_size) {
749	/* As slave role, the conn->state has been set to
750	* BT_CONNECTED and l2cap conn req might not be received
751	* yet, at this moment the l2cap layer almost does
752	* nothing with the non-zero status.
753	* So we also clear encrypt related bits, and then the
754	* handler of l2cap conn req will get the right secure
755	* state at a later time.
756	*/
757	status = HCI_ERROR_AUTH_FAILURE;
758	clear_bit(nr: HCI_CONN_ENCRYPT, addr: &conn->flags);
759	clear_bit(nr: HCI_CONN_AES_CCM, addr: &conn->flags);
760	}
761	}
762
763	hci_encrypt_cfm(conn, status);
764
765	done:
766	hci_dev_unlock(hdev);
767
768	return status;
769	}
770
771	static u8 hci_cc_read_local_commands(struct hci_dev *hdev, void *data,
772	struct sk_buff *skb)
773	{
774	struct hci_rp_read_local_commands *rp = data;
775
776	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
777
778	if (rp->status)
779	return rp->status;
780
781	if (hci_dev_test_flag(hdev, HCI_SETUP) ||
782	hci_dev_test_flag(hdev, HCI_CONFIG))
783	memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
784
785	return rp->status;
786	}
787
788	static u8 hci_cc_read_auth_payload_timeout(struct hci_dev *hdev, void *data,
789	struct sk_buff *skb)
790	{
791	struct hci_rp_read_auth_payload_to *rp = data;
792	struct hci_conn *conn;
793
794	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
795
796	if (rp->status)
797	return rp->status;
798
799	hci_dev_lock(hdev);
800
801	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
802	if (conn)
803	conn->auth_payload_timeout = __le16_to_cpu(rp->timeout);
804
805	hci_dev_unlock(hdev);
806
807	return rp->status;
808	}
809
810	static u8 hci_cc_write_auth_payload_timeout(struct hci_dev *hdev, void *data,
811	struct sk_buff *skb)
812	{
813	struct hci_rp_write_auth_payload_to *rp = data;
814	struct hci_conn *conn;
815	void *sent;
816
817	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
818
819	sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_PAYLOAD_TO);
820	if (!sent)
821	return rp->status;
822
823	hci_dev_lock(hdev);
824
825	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
826	if (!conn) {
827	rp->status = 0xff;
828	goto unlock;
829	}
830
831	if (!rp->status)
832	conn->auth_payload_timeout = get_unaligned_le16(p: sent + 2);
833
834	unlock:
835	hci_dev_unlock(hdev);
836
837	return rp->status;
838	}
839
840	static u8 hci_cc_read_local_features(struct hci_dev *hdev, void *data,
841	struct sk_buff *skb)
842	{
843	struct hci_rp_read_local_features *rp = data;
844
845	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
846
847	if (rp->status)
848	return rp->status;
849
850	memcpy(hdev->features, rp->features, 8);
851
852	/* Adjust default settings according to features
853	* supported by device. */
854
855	if (hdev->features[0][0] & LMP_3SLOT)
856	hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
857
858	if (hdev->features[0][0] & LMP_5SLOT)
859	hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
860
861	if (hdev->features[0][1] & LMP_HV2) {
862	hdev->pkt_type |= (HCI_HV2);
863	hdev->esco_type |= (ESCO_HV2);
864	}
865
866	if (hdev->features[0][1] & LMP_HV3) {
867	hdev->pkt_type |= (HCI_HV3);
868	hdev->esco_type |= (ESCO_HV3);
869	}
870
871	if (lmp_esco_capable(hdev))
872	hdev->esco_type |= (ESCO_EV3);
873
874	if (hdev->features[0][4] & LMP_EV4)
875	hdev->esco_type |= (ESCO_EV4);
876
877	if (hdev->features[0][4] & LMP_EV5)
878	hdev->esco_type |= (ESCO_EV5);
879
880	if (hdev->features[0][5] & LMP_EDR_ESCO_2M)
881	hdev->esco_type |= (ESCO_2EV3);
882
883	if (hdev->features[0][5] & LMP_EDR_ESCO_3M)
884	hdev->esco_type |= (ESCO_3EV3);
885
886	if (hdev->features[0][5] & LMP_EDR_3S_ESCO)
887	hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
888
889	return rp->status;
890	}
891
892	static u8 hci_cc_read_local_ext_features(struct hci_dev *hdev, void *data,
893	struct sk_buff *skb)
894	{
895	struct hci_rp_read_local_ext_features *rp = data;
896
897	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
898
899	if (rp->status)
900	return rp->status;
901
902	if (hdev->max_page < rp->max_page) {
903	if (test_bit(HCI_QUIRK_BROKEN_LOCAL_EXT_FEATURES_PAGE_2,
904	&hdev->quirks))
905	bt_dev_warn(hdev, "broken local ext features page 2");
906	else
907	hdev->max_page = rp->max_page;
908	}
909
910	if (rp->page < HCI_MAX_PAGES)
911	memcpy(hdev->features[rp->page], rp->features, 8);
912
913	return rp->status;
914	}
915
916	static u8 hci_cc_read_flow_control_mode(struct hci_dev *hdev, void *data,
917	struct sk_buff *skb)
918	{
919	struct hci_rp_read_flow_control_mode *rp = data;
920
921	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
922
923	if (rp->status)
924	return rp->status;
925
926	hdev->flow_ctl_mode = rp->mode;
927
928	return rp->status;
929	}
930
931	static u8 hci_cc_read_buffer_size(struct hci_dev *hdev, void *data,
932	struct sk_buff *skb)
933	{
934	struct hci_rp_read_buffer_size *rp = data;
935
936	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
937
938	if (rp->status)
939	return rp->status;
940
941	hdev->acl_mtu = __le16_to_cpu(rp->acl_mtu);
942	hdev->sco_mtu = rp->sco_mtu;
943	hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
944	hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
945
946	if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
947	hdev->sco_mtu = 64;
948	hdev->sco_pkts = 8;
949	}
950
951	hdev->acl_cnt = hdev->acl_pkts;
952	hdev->sco_cnt = hdev->sco_pkts;
953
954	BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
955	hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
956
957	return rp->status;
958	}
959
960	static u8 hci_cc_read_bd_addr(struct hci_dev *hdev, void *data,
961	struct sk_buff *skb)
962	{
963	struct hci_rp_read_bd_addr *rp = data;
964
965	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
966
967	if (rp->status)
968	return rp->status;
969
970	if (test_bit(HCI_INIT, &hdev->flags))
971	bacpy(dst: &hdev->bdaddr, src: &rp->bdaddr);
972
973	if (hci_dev_test_flag(hdev, HCI_SETUP))
974	bacpy(dst: &hdev->setup_addr, src: &rp->bdaddr);
975
976	return rp->status;
977	}
978
979	static u8 hci_cc_read_local_pairing_opts(struct hci_dev *hdev, void *data,
980	struct sk_buff *skb)
981	{
982	struct hci_rp_read_local_pairing_opts *rp = data;
983
984	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
985
986	if (rp->status)
987	return rp->status;
988
989	if (hci_dev_test_flag(hdev, HCI_SETUP) ||
990	hci_dev_test_flag(hdev, HCI_CONFIG)) {
991	hdev->pairing_opts = rp->pairing_opts;
992	hdev->max_enc_key_size = rp->max_key_size;
993	}
994
995	return rp->status;
996	}
997
998	static u8 hci_cc_read_page_scan_activity(struct hci_dev *hdev, void *data,
999	struct sk_buff *skb)
1000	{
1001	struct hci_rp_read_page_scan_activity *rp = data;
1002
1003	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1004
1005	if (rp->status)
1006	return rp->status;
1007
1008	if (test_bit(HCI_INIT, &hdev->flags)) {
1009	hdev->page_scan_interval = __le16_to_cpu(rp->interval);
1010	hdev->page_scan_window = __le16_to_cpu(rp->window);
1011	}
1012
1013	return rp->status;
1014	}
1015
1016	static u8 hci_cc_write_page_scan_activity(struct hci_dev *hdev, void *data,
1017	struct sk_buff *skb)
1018	{
1019	struct hci_ev_status *rp = data;
1020	struct hci_cp_write_page_scan_activity *sent;
1021
1022	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1023
1024	if (rp->status)
1025	return rp->status;
1026
1027	sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY);
1028	if (!sent)
1029	return rp->status;
1030
1031	hdev->page_scan_interval = __le16_to_cpu(sent->interval);
1032	hdev->page_scan_window = __le16_to_cpu(sent->window);
1033
1034	return rp->status;
1035	}
1036
1037	static u8 hci_cc_read_page_scan_type(struct hci_dev *hdev, void *data,
1038	struct sk_buff *skb)
1039	{
1040	struct hci_rp_read_page_scan_type *rp = data;
1041
1042	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1043
1044	if (rp->status)
1045	return rp->status;
1046
1047	if (test_bit(HCI_INIT, &hdev->flags))
1048	hdev->page_scan_type = rp->type;
1049
1050	return rp->status;
1051	}
1052
1053	static u8 hci_cc_write_page_scan_type(struct hci_dev *hdev, void *data,
1054	struct sk_buff *skb)
1055	{
1056	struct hci_ev_status *rp = data;
1057	u8 *type;
1058
1059	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1060
1061	if (rp->status)
1062	return rp->status;
1063
1064	type = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE);
1065	if (type)
1066	hdev->page_scan_type = *type;
1067
1068	return rp->status;
1069	}
1070
1071	static u8 hci_cc_read_data_block_size(struct hci_dev *hdev, void *data,
1072	struct sk_buff *skb)
1073	{
1074	struct hci_rp_read_data_block_size *rp = data;
1075
1076	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1077
1078	if (rp->status)
1079	return rp->status;
1080
1081	hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
1082	hdev->block_len = __le16_to_cpu(rp->block_len);
1083	hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
1084
1085	hdev->block_cnt = hdev->num_blocks;
1086
1087	BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
1088	hdev->block_cnt, hdev->block_len);
1089
1090	return rp->status;
1091	}
1092
1093	static u8 hci_cc_read_clock(struct hci_dev *hdev, void *data,
1094	struct sk_buff *skb)
1095	{
1096	struct hci_rp_read_clock *rp = data;
1097	struct hci_cp_read_clock *cp;
1098	struct hci_conn *conn;
1099
1100	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1101
1102	if (rp->status)
1103	return rp->status;
1104
1105	hci_dev_lock(hdev);
1106
1107	cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
1108	if (!cp)
1109	goto unlock;
1110
1111	if (cp->which == 0x00) {
1112	hdev->clock = le32_to_cpu(rp->clock);
1113	goto unlock;
1114	}
1115
1116	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1117	if (conn) {
1118	conn->clock = le32_to_cpu(rp->clock);
1119	conn->clock_accuracy = le16_to_cpu(rp->accuracy);
1120	}
1121
1122	unlock:
1123	hci_dev_unlock(hdev);
1124	return rp->status;
1125	}
1126
1127	static u8 hci_cc_read_local_amp_info(struct hci_dev *hdev, void *data,
1128	struct sk_buff *skb)
1129	{
1130	struct hci_rp_read_local_amp_info *rp = data;
1131
1132	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1133
1134	if (rp->status)
1135	return rp->status;
1136
1137	hdev->amp_status = rp->amp_status;
1138	hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
1139	hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
1140	hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
1141	hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
1142	hdev->amp_type = rp->amp_type;
1143	hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
1144	hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
1145	hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
1146	hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
1147
1148	return rp->status;
1149	}
1150
1151	static u8 hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev, void *data,
1152	struct sk_buff *skb)
1153	{
1154	struct hci_rp_read_inq_rsp_tx_power *rp = data;
1155
1156	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1157
1158	if (rp->status)
1159	return rp->status;
1160
1161	hdev->inq_tx_power = rp->tx_power;
1162
1163	return rp->status;
1164	}
1165
1166	static u8 hci_cc_read_def_err_data_reporting(struct hci_dev *hdev, void *data,
1167	struct sk_buff *skb)
1168	{
1169	struct hci_rp_read_def_err_data_reporting *rp = data;
1170
1171	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1172
1173	if (rp->status)
1174	return rp->status;
1175
1176	hdev->err_data_reporting = rp->err_data_reporting;
1177
1178	return rp->status;
1179	}
1180
1181	static u8 hci_cc_write_def_err_data_reporting(struct hci_dev *hdev, void *data,
1182	struct sk_buff *skb)
1183	{
1184	struct hci_ev_status *rp = data;
1185	struct hci_cp_write_def_err_data_reporting *cp;
1186
1187	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1188
1189	if (rp->status)
1190	return rp->status;
1191
1192	cp = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_ERR_DATA_REPORTING);
1193	if (!cp)
1194	return rp->status;
1195
1196	hdev->err_data_reporting = cp->err_data_reporting;
1197
1198	return rp->status;
1199	}
1200
1201	static u8 hci_cc_pin_code_reply(struct hci_dev *hdev, void *data,
1202	struct sk_buff *skb)
1203	{
1204	struct hci_rp_pin_code_reply *rp = data;
1205	struct hci_cp_pin_code_reply *cp;
1206	struct hci_conn *conn;
1207
1208	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1209
1210	hci_dev_lock(hdev);
1211
1212	if (hci_dev_test_flag(hdev, HCI_MGMT))
1213	mgmt_pin_code_reply_complete(hdev, bdaddr: &rp->bdaddr, status: rp->status);
1214
1215	if (rp->status)
1216	goto unlock;
1217
1218	cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
1219	if (!cp)
1220	goto unlock;
1221
1222	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, ba: &cp->bdaddr);
1223	if (conn)
1224	conn->pin_length = cp->pin_len;
1225
1226	unlock:
1227	hci_dev_unlock(hdev);
1228	return rp->status;
1229	}
1230
1231	static u8 hci_cc_pin_code_neg_reply(struct hci_dev *hdev, void *data,
1232	struct sk_buff *skb)
1233	{
1234	struct hci_rp_pin_code_neg_reply *rp = data;
1235
1236	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1237
1238	hci_dev_lock(hdev);
1239
1240	if (hci_dev_test_flag(hdev, HCI_MGMT))
1241	mgmt_pin_code_neg_reply_complete(hdev, bdaddr: &rp->bdaddr,
1242	status: rp->status);
1243
1244	hci_dev_unlock(hdev);
1245
1246	return rp->status;
1247	}
1248
1249	static u8 hci_cc_le_read_buffer_size(struct hci_dev *hdev, void *data,
1250	struct sk_buff *skb)
1251	{
1252	struct hci_rp_le_read_buffer_size *rp = data;
1253
1254	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1255
1256	if (rp->status)
1257	return rp->status;
1258
1259	hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
1260	hdev->le_pkts = rp->le_max_pkt;
1261
1262	hdev->le_cnt = hdev->le_pkts;
1263
1264	BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
1265
1266	return rp->status;
1267	}
1268
1269	static u8 hci_cc_le_read_local_features(struct hci_dev *hdev, void *data,
1270	struct sk_buff *skb)
1271	{
1272	struct hci_rp_le_read_local_features *rp = data;
1273
1274	BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1275
1276	if (rp->status)
1277	return rp->status;
1278
1279	memcpy(hdev->le_features, rp->features, 8);
1280
1281	return rp->status;
1282	}
1283
1284	static u8 hci_cc_le_read_adv_tx_power(struct hci_dev *hdev, void *data,
1285	struct sk_buff *skb)
1286	{
1287	struct hci_rp_le_read_adv_tx_power *rp = data;
1288
1289	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1290
1291	if (rp->status)
1292	return rp->status;
1293
1294	hdev->adv_tx_power = rp->tx_power;
1295
1296	return rp->status;
1297	}
1298
1299	static u8 hci_cc_user_confirm_reply(struct hci_dev *hdev, void *data,
1300	struct sk_buff *skb)
1301	{
1302	struct hci_rp_user_confirm_reply *rp = data;
1303
1304	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1305
1306	hci_dev_lock(hdev);
1307
1308	if (hci_dev_test_flag(hdev, HCI_MGMT))
1309	mgmt_user_confirm_reply_complete(hdev, bdaddr: &rp->bdaddr, ACL_LINK, addr_type: 0,
1310	status: rp->status);
1311
1312	hci_dev_unlock(hdev);
1313
1314	return rp->status;
1315	}
1316
1317	static u8 hci_cc_user_confirm_neg_reply(struct hci_dev *hdev, void *data,
1318	struct sk_buff *skb)
1319	{
1320	struct hci_rp_user_confirm_reply *rp = data;
1321
1322	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1323
1324	hci_dev_lock(hdev);
1325
1326	if (hci_dev_test_flag(hdev, HCI_MGMT))
1327	mgmt_user_confirm_neg_reply_complete(hdev, bdaddr: &rp->bdaddr,
1328	ACL_LINK, addr_type: 0, status: rp->status);
1329
1330	hci_dev_unlock(hdev);
1331
1332	return rp->status;
1333	}
1334
1335	static u8 hci_cc_user_passkey_reply(struct hci_dev *hdev, void *data,
1336	struct sk_buff *skb)
1337	{
1338	struct hci_rp_user_confirm_reply *rp = data;
1339
1340	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1341
1342	hci_dev_lock(hdev);
1343
1344	if (hci_dev_test_flag(hdev, HCI_MGMT))
1345	mgmt_user_passkey_reply_complete(hdev, bdaddr: &rp->bdaddr, ACL_LINK,
1346	addr_type: 0, status: rp->status);
1347
1348	hci_dev_unlock(hdev);
1349
1350	return rp->status;
1351	}
1352
1353	static u8 hci_cc_user_passkey_neg_reply(struct hci_dev *hdev, void *data,
1354	struct sk_buff *skb)
1355	{
1356	struct hci_rp_user_confirm_reply *rp = data;
1357
1358	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1359
1360	hci_dev_lock(hdev);
1361
1362	if (hci_dev_test_flag(hdev, HCI_MGMT))
1363	mgmt_user_passkey_neg_reply_complete(hdev, bdaddr: &rp->bdaddr,
1364	ACL_LINK, addr_type: 0, status: rp->status);
1365
1366	hci_dev_unlock(hdev);
1367
1368	return rp->status;
1369	}
1370
1371	static u8 hci_cc_read_local_oob_data(struct hci_dev *hdev, void *data,
1372	struct sk_buff *skb)
1373	{
1374	struct hci_rp_read_local_oob_data *rp = data;
1375
1376	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1377
1378	return rp->status;
1379	}
1380
1381	static u8 hci_cc_read_local_oob_ext_data(struct hci_dev *hdev, void *data,
1382	struct sk_buff *skb)
1383	{
1384	struct hci_rp_read_local_oob_ext_data *rp = data;
1385
1386	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1387
1388	return rp->status;
1389	}
1390
1391	static u8 hci_cc_le_set_random_addr(struct hci_dev *hdev, void *data,
1392	struct sk_buff *skb)
1393	{
1394	struct hci_ev_status *rp = data;
1395	bdaddr_t *sent;
1396
1397	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1398
1399	if (rp->status)
1400	return rp->status;
1401
1402	sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_RANDOM_ADDR);
1403	if (!sent)
1404	return rp->status;
1405
1406	hci_dev_lock(hdev);
1407
1408	bacpy(dst: &hdev->random_addr, src: sent);
1409
1410	if (!bacmp(ba1: &hdev->rpa, ba2: sent)) {
1411	hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
1412	queue_delayed_work(wq: hdev->workqueue, dwork: &hdev->rpa_expired,
1413	secs_to_jiffies(hdev->rpa_timeout));
1414	}
1415
1416	hci_dev_unlock(hdev);
1417
1418	return rp->status;
1419	}
1420
1421	static u8 hci_cc_le_set_default_phy(struct hci_dev *hdev, void *data,
1422	struct sk_buff *skb)
1423	{
1424	struct hci_ev_status *rp = data;
1425	struct hci_cp_le_set_default_phy *cp;
1426
1427	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1428
1429	if (rp->status)
1430	return rp->status;
1431
1432	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_DEFAULT_PHY);
1433	if (!cp)
1434	return rp->status;
1435
1436	hci_dev_lock(hdev);
1437
1438	hdev->le_tx_def_phys = cp->tx_phys;
1439	hdev->le_rx_def_phys = cp->rx_phys;
1440
1441	hci_dev_unlock(hdev);
1442
1443	return rp->status;
1444	}
1445
1446	static u8 hci_cc_le_set_adv_set_random_addr(struct hci_dev *hdev, void *data,
1447	struct sk_buff *skb)
1448	{
1449	struct hci_ev_status *rp = data;
1450	struct hci_cp_le_set_adv_set_rand_addr *cp;
1451	struct adv_info *adv;
1452
1453	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1454
1455	if (rp->status)
1456	return rp->status;
1457
1458	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_SET_RAND_ADDR);
1459	/* Update only in case the adv instance since handle 0x00 shall be using
1460	* HCI_OP_LE_SET_RANDOM_ADDR since that allows both extended and
1461	* non-extended adverting.
1462	*/
1463	if (!cp || !cp->handle)
1464	return rp->status;
1465
1466	hci_dev_lock(hdev);
1467
1468	adv = hci_find_adv_instance(hdev, instance: cp->handle);
1469	if (adv) {
1470	bacpy(dst: &adv->random_addr, src: &cp->bdaddr);
1471	if (!bacmp(ba1: &hdev->rpa, ba2: &cp->bdaddr)) {
1472	adv->rpa_expired = false;
1473	queue_delayed_work(wq: hdev->workqueue,
1474	dwork: &adv->rpa_expired_cb,
1475	secs_to_jiffies(hdev->rpa_timeout));
1476	}
1477	}
1478
1479	hci_dev_unlock(hdev);
1480
1481	return rp->status;
1482	}
1483
1484	static u8 hci_cc_le_remove_adv_set(struct hci_dev *hdev, void *data,
1485	struct sk_buff *skb)
1486	{
1487	struct hci_ev_status *rp = data;
1488	u8 *instance;
1489	int err;
1490
1491	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1492
1493	if (rp->status)
1494	return rp->status;
1495
1496	instance = hci_sent_cmd_data(hdev, HCI_OP_LE_REMOVE_ADV_SET);
1497	if (!instance)
1498	return rp->status;
1499
1500	hci_dev_lock(hdev);
1501
1502	err = hci_remove_adv_instance(hdev, instance: *instance);
1503	if (!err)
1504	mgmt_advertising_removed(hci_skb_sk(hdev->sent_cmd), hdev,
1505	instance: *instance);
1506
1507	hci_dev_unlock(hdev);
1508
1509	return rp->status;
1510	}
1511
1512	static u8 hci_cc_le_clear_adv_sets(struct hci_dev *hdev, void *data,
1513	struct sk_buff *skb)
1514	{
1515	struct hci_ev_status *rp = data;
1516	struct adv_info *adv, *n;
1517	int err;
1518
1519	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1520
1521	if (rp->status)
1522	return rp->status;
1523
1524	if (!hci_sent_cmd_data(hdev, HCI_OP_LE_CLEAR_ADV_SETS))
1525	return rp->status;
1526
1527	hci_dev_lock(hdev);
1528
1529	list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) {
1530	u8 instance = adv->instance;
1531
1532	err = hci_remove_adv_instance(hdev, instance);
1533	if (!err)
1534	mgmt_advertising_removed(hci_skb_sk(hdev->sent_cmd),
1535	hdev, instance);
1536	}
1537
1538	hci_dev_unlock(hdev);
1539
1540	return rp->status;
1541	}
1542
1543	static u8 hci_cc_le_read_transmit_power(struct hci_dev *hdev, void *data,
1544	struct sk_buff *skb)
1545	{
1546	struct hci_rp_le_read_transmit_power *rp = data;
1547
1548	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1549
1550	if (rp->status)
1551	return rp->status;
1552
1553	hdev->min_le_tx_power = rp->min_le_tx_power;
1554	hdev->max_le_tx_power = rp->max_le_tx_power;
1555
1556	return rp->status;
1557	}
1558
1559	static u8 hci_cc_le_set_privacy_mode(struct hci_dev *hdev, void *data,
1560	struct sk_buff *skb)
1561	{
1562	struct hci_ev_status *rp = data;
1563	struct hci_cp_le_set_privacy_mode *cp;
1564	struct hci_conn_params *params;
1565
1566	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1567
1568	if (rp->status)
1569	return rp->status;
1570
1571	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_PRIVACY_MODE);
1572	if (!cp)
1573	return rp->status;
1574
1575	hci_dev_lock(hdev);
1576
1577	params = hci_conn_params_lookup(hdev, addr: &cp->bdaddr, addr_type: cp->bdaddr_type);
1578	if (params)
1579	WRITE_ONCE(params->privacy_mode, cp->mode);
1580
1581	hci_dev_unlock(hdev);
1582
1583	return rp->status;
1584	}
1585
1586	static u8 hci_cc_le_set_adv_enable(struct hci_dev *hdev, void *data,
1587	struct sk_buff *skb)
1588	{
1589	struct hci_ev_status *rp = data;
1590	__u8 *sent;
1591
1592	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1593
1594	if (rp->status)
1595	return rp->status;
1596
1597	sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_ENABLE);
1598	if (!sent)
1599	return rp->status;
1600
1601	hci_dev_lock(hdev);
1602
1603	/* If we're doing connection initiation as peripheral. Set a
1604	* timeout in case something goes wrong.
1605	*/
1606	if (*sent) {
1607	struct hci_conn *conn;
1608
1609	hci_dev_set_flag(hdev, HCI_LE_ADV);
1610
1611	conn = hci_lookup_le_connect(hdev);
1612	if (conn)
1613	queue_delayed_work(wq: hdev->workqueue,
1614	dwork: &conn->le_conn_timeout,
1615	delay: conn->conn_timeout);
1616	} else {
1617	hci_dev_clear_flag(hdev, HCI_LE_ADV);
1618	}
1619
1620	hci_dev_unlock(hdev);
1621
1622	return rp->status;
1623	}
1624
1625	static u8 hci_cc_le_set_ext_adv_enable(struct hci_dev *hdev, void *data,
1626	struct sk_buff *skb)
1627	{
1628	struct hci_cp_le_set_ext_adv_enable *cp;
1629	struct hci_cp_ext_adv_set *set;
1630	struct adv_info *adv = NULL, *n;
1631	struct hci_ev_status *rp = data;
1632
1633	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1634
1635	if (rp->status)
1636	return rp->status;
1637
1638	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE);
1639	if (!cp)
1640	return rp->status;
1641
1642	set = (void *)cp->data;
1643
1644	hci_dev_lock(hdev);
1645
1646	if (cp->num_of_sets)
1647	adv = hci_find_adv_instance(hdev, instance: set->handle);
1648
1649	if (cp->enable) {
1650	struct hci_conn *conn;
1651
1652	hci_dev_set_flag(hdev, HCI_LE_ADV);
1653
1654	if (adv && !adv->periodic)
1655	adv->enabled = true;
1656
1657	conn = hci_lookup_le_connect(hdev);
1658	if (conn)
1659	queue_delayed_work(wq: hdev->workqueue,
1660	dwork: &conn->le_conn_timeout,
1661	delay: conn->conn_timeout);
1662	} else {
1663	if (cp->num_of_sets) {
1664	if (adv)
1665	adv->enabled = false;
1666
1667	/* If just one instance was disabled check if there are
1668	* any other instance enabled before clearing HCI_LE_ADV
1669	*/
1670	list_for_each_entry_safe(adv, n, &hdev->adv_instances,
1671	list) {
1672	if (adv->enabled)
1673	goto unlock;
1674	}
1675	} else {
1676	/* All instances shall be considered disabled */
1677	list_for_each_entry_safe(adv, n, &hdev->adv_instances,
1678	list)
1679	adv->enabled = false;
1680	}
1681
1682	hci_dev_clear_flag(hdev, HCI_LE_ADV);
1683	}
1684
1685	unlock:
1686	hci_dev_unlock(hdev);
1687	return rp->status;
1688	}
1689
1690	static u8 hci_cc_le_set_scan_param(struct hci_dev *hdev, void *data,
1691	struct sk_buff *skb)
1692	{
1693	struct hci_cp_le_set_scan_param *cp;
1694	struct hci_ev_status *rp = data;
1695
1696	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1697
1698	if (rp->status)
1699	return rp->status;
1700
1701	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_PARAM);
1702	if (!cp)
1703	return rp->status;
1704
1705	hci_dev_lock(hdev);
1706
1707	hdev->le_scan_type = cp->type;
1708
1709	hci_dev_unlock(hdev);
1710
1711	return rp->status;
1712	}
1713
1714	static u8 hci_cc_le_set_ext_scan_param(struct hci_dev *hdev, void *data,
1715	struct sk_buff *skb)
1716	{
1717	struct hci_cp_le_set_ext_scan_params *cp;
1718	struct hci_ev_status *rp = data;
1719	struct hci_cp_le_scan_phy_params *phy_param;
1720
1721	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1722
1723	if (rp->status)
1724	return rp->status;
1725
1726	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_SCAN_PARAMS);
1727	if (!cp)
1728	return rp->status;
1729
1730	phy_param = (void *)cp->data;
1731
1732	hci_dev_lock(hdev);
1733
1734	hdev->le_scan_type = phy_param->type;
1735
1736	hci_dev_unlock(hdev);
1737
1738	return rp->status;
1739	}
1740
1741	static bool has_pending_adv_report(struct hci_dev *hdev)
1742	{
1743	struct discovery_state *d = &hdev->discovery;
1744
1745	return bacmp(ba1: &d->last_adv_addr, BDADDR_ANY);
1746	}
1747
1748	static void clear_pending_adv_report(struct hci_dev *hdev)
1749	{
1750	struct discovery_state *d = &hdev->discovery;
1751
1752	bacpy(dst: &d->last_adv_addr, BDADDR_ANY);
1753	d->last_adv_data_len = 0;
1754	}
1755
1756	static void store_pending_adv_report(struct hci_dev *hdev, bdaddr_t *bdaddr,
1757	u8 bdaddr_type, s8 rssi, u32 flags,
1758	u8 *data, u8 len)
1759	{
1760	struct discovery_state *d = &hdev->discovery;
1761
1762	if (len > max_adv_len(hdev))
1763	return;
1764
1765	bacpy(dst: &d->last_adv_addr, src: bdaddr);
1766	d->last_adv_addr_type = bdaddr_type;
1767	d->last_adv_rssi = rssi;
1768	d->last_adv_flags = flags;
1769	memcpy(d->last_adv_data, data, len);
1770	d->last_adv_data_len = len;
1771	}
1772
1773	static void le_set_scan_enable_complete(struct hci_dev *hdev, u8 enable)
1774	{
1775	hci_dev_lock(hdev);
1776
1777	switch (enable) {
1778	case LE_SCAN_ENABLE:
1779	hci_dev_set_flag(hdev, HCI_LE_SCAN);
1780	if (hdev->le_scan_type == LE_SCAN_ACTIVE)
1781	clear_pending_adv_report(hdev);
1782	if (hci_dev_test_flag(hdev, HCI_MESH))
1783	hci_discovery_set_state(hdev, state: DISCOVERY_FINDING);
1784	break;
1785
1786	case LE_SCAN_DISABLE:
1787	/* We do this here instead of when setting DISCOVERY_STOPPED
1788	* since the latter would potentially require waiting for
1789	* inquiry to stop too.
1790	*/
1791	if (has_pending_adv_report(hdev)) {
1792	struct discovery_state *d = &hdev->discovery;
1793
1794	mgmt_device_found(hdev, bdaddr: &d->last_adv_addr, LE_LINK,
1795	addr_type: d->last_adv_addr_type, NULL,
1796	rssi: d->last_adv_rssi, flags: d->last_adv_flags,
1797	eir: d->last_adv_data,
1798	eir_len: d->last_adv_data_len, NULL, scan_rsp_len: 0, instant: 0);
1799	}
1800
1801	/* Cancel this timer so that we don't try to disable scanning
1802	* when it's already disabled.
1803	*/
1804	cancel_delayed_work(dwork: &hdev->le_scan_disable);
1805
1806	hci_dev_clear_flag(hdev, HCI_LE_SCAN);
1807
1808	/* The HCI_LE_SCAN_INTERRUPTED flag indicates that we
1809	* interrupted scanning due to a connect request. Mark
1810	* therefore discovery as stopped.
1811	*/
1812	if (hci_dev_test_and_clear_flag(hdev, HCI_LE_SCAN_INTERRUPTED))
1813	hci_discovery_set_state(hdev, state: DISCOVERY_STOPPED);
1814	else if (!hci_dev_test_flag(hdev, HCI_LE_ADV) &&
1815	hdev->discovery.state == DISCOVERY_FINDING)
1816	queue_work(wq: hdev->workqueue, work: &hdev->reenable_adv_work);
1817
1818	break;
1819
1820	default:
1821	bt_dev_err(hdev, "use of reserved LE_Scan_Enable param %d",
1822	enable);
1823	break;
1824	}
1825
1826	hci_dev_unlock(hdev);
1827	}
1828
1829	static u8 hci_cc_le_set_scan_enable(struct hci_dev *hdev, void *data,
1830	struct sk_buff *skb)
1831	{
1832	struct hci_cp_le_set_scan_enable *cp;
1833	struct hci_ev_status *rp = data;
1834
1835	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1836
1837	if (rp->status)
1838	return rp->status;
1839
1840	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
1841	if (!cp)
1842	return rp->status;
1843
1844	le_set_scan_enable_complete(hdev, enable: cp->enable);
1845
1846	return rp->status;
1847	}
1848
1849	static u8 hci_cc_le_set_ext_scan_enable(struct hci_dev *hdev, void *data,
1850	struct sk_buff *skb)
1851	{
1852	struct hci_cp_le_set_ext_scan_enable *cp;
1853	struct hci_ev_status *rp = data;
1854
1855	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1856
1857	if (rp->status)
1858	return rp->status;
1859
1860	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_SCAN_ENABLE);
1861	if (!cp)
1862	return rp->status;
1863
1864	le_set_scan_enable_complete(hdev, enable: cp->enable);
1865
1866	return rp->status;
1867	}
1868
1869	static u8 hci_cc_le_read_num_adv_sets(struct hci_dev *hdev, void *data,
1870	struct sk_buff *skb)
1871	{
1872	struct hci_rp_le_read_num_supported_adv_sets *rp = data;
1873
1874	bt_dev_dbg(hdev, "status 0x%2.2x No of Adv sets %u", rp->status,
1875	rp->num_of_sets);
1876
1877	if (rp->status)
1878	return rp->status;
1879
1880	hdev->le_num_of_adv_sets = rp->num_of_sets;
1881
1882	return rp->status;
1883	}
1884
1885	static u8 hci_cc_le_read_accept_list_size(struct hci_dev *hdev, void *data,
1886	struct sk_buff *skb)
1887	{
1888	struct hci_rp_le_read_accept_list_size *rp = data;
1889
1890	bt_dev_dbg(hdev, "status 0x%2.2x size %u", rp->status, rp->size);
1891
1892	if (rp->status)
1893	return rp->status;
1894
1895	hdev->le_accept_list_size = rp->size;
1896
1897	return rp->status;
1898	}
1899
1900	static u8 hci_cc_le_clear_accept_list(struct hci_dev *hdev, void *data,
1901	struct sk_buff *skb)
1902	{
1903	struct hci_ev_status *rp = data;
1904
1905	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1906
1907	if (rp->status)
1908	return rp->status;
1909
1910	hci_dev_lock(hdev);
1911	hci_bdaddr_list_clear(list: &hdev->le_accept_list);
1912	hci_dev_unlock(hdev);
1913
1914	return rp->status;
1915	}
1916
1917	static u8 hci_cc_le_add_to_accept_list(struct hci_dev *hdev, void *data,
1918	struct sk_buff *skb)
1919	{
1920	struct hci_cp_le_add_to_accept_list *sent;
1921	struct hci_ev_status *rp = data;
1922
1923	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1924
1925	if (rp->status)
1926	return rp->status;
1927
1928	sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_ACCEPT_LIST);
1929	if (!sent)
1930	return rp->status;
1931
1932	hci_dev_lock(hdev);
1933	hci_bdaddr_list_add(list: &hdev->le_accept_list, bdaddr: &sent->bdaddr,
1934	type: sent->bdaddr_type);
1935	hci_dev_unlock(hdev);
1936
1937	return rp->status;
1938	}
1939
1940	static u8 hci_cc_le_del_from_accept_list(struct hci_dev *hdev, void *data,
1941	struct sk_buff *skb)
1942	{
1943	struct hci_cp_le_del_from_accept_list *sent;
1944	struct hci_ev_status *rp = data;
1945
1946	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1947
1948	if (rp->status)
1949	return rp->status;
1950
1951	sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_ACCEPT_LIST);
1952	if (!sent)
1953	return rp->status;
1954
1955	hci_dev_lock(hdev);
1956	hci_bdaddr_list_del(list: &hdev->le_accept_list, bdaddr: &sent->bdaddr,
1957	type: sent->bdaddr_type);
1958	hci_dev_unlock(hdev);
1959
1960	return rp->status;
1961	}
1962
1963	static u8 hci_cc_le_read_supported_states(struct hci_dev *hdev, void *data,
1964	struct sk_buff *skb)
1965	{
1966	struct hci_rp_le_read_supported_states *rp = data;
1967
1968	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1969
1970	if (rp->status)
1971	return rp->status;
1972
1973	memcpy(hdev->le_states, rp->le_states, 8);
1974
1975	return rp->status;
1976	}
1977
1978	static u8 hci_cc_le_read_def_data_len(struct hci_dev *hdev, void *data,
1979	struct sk_buff *skb)
1980	{
1981	struct hci_rp_le_read_def_data_len *rp = data;
1982
1983	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1984
1985	if (rp->status)
1986	return rp->status;
1987
1988	hdev->le_def_tx_len = le16_to_cpu(rp->tx_len);
1989	hdev->le_def_tx_time = le16_to_cpu(rp->tx_time);
1990
1991	return rp->status;
1992	}
1993
1994	static u8 hci_cc_le_write_def_data_len(struct hci_dev *hdev, void *data,
1995	struct sk_buff *skb)
1996	{
1997	struct hci_cp_le_write_def_data_len *sent;
1998	struct hci_ev_status *rp = data;
1999
2000	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2001
2002	if (rp->status)
2003	return rp->status;
2004
2005	sent = hci_sent_cmd_data(hdev, HCI_OP_LE_WRITE_DEF_DATA_LEN);
2006	if (!sent)
2007	return rp->status;
2008
2009	hdev->le_def_tx_len = le16_to_cpu(sent->tx_len);
2010	hdev->le_def_tx_time = le16_to_cpu(sent->tx_time);
2011
2012	return rp->status;
2013	}
2014
2015	static u8 hci_cc_le_add_to_resolv_list(struct hci_dev *hdev, void *data,
2016	struct sk_buff *skb)
2017	{
2018	struct hci_cp_le_add_to_resolv_list *sent;
2019	struct hci_ev_status *rp = data;
2020
2021	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2022
2023	if (rp->status)
2024	return rp->status;
2025
2026	sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_RESOLV_LIST);
2027	if (!sent)
2028	return rp->status;
2029
2030	hci_dev_lock(hdev);
2031	hci_bdaddr_list_add_with_irk(list: &hdev->le_resolv_list, bdaddr: &sent->bdaddr,
2032	type: sent->bdaddr_type, peer_irk: sent->peer_irk,
2033	local_irk: sent->local_irk);
2034	hci_dev_unlock(hdev);
2035
2036	return rp->status;
2037	}
2038
2039	static u8 hci_cc_le_del_from_resolv_list(struct hci_dev *hdev, void *data,
2040	struct sk_buff *skb)
2041	{
2042	struct hci_cp_le_del_from_resolv_list *sent;
2043	struct hci_ev_status *rp = data;
2044
2045	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2046
2047	if (rp->status)
2048	return rp->status;
2049
2050	sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_RESOLV_LIST);
2051	if (!sent)
2052	return rp->status;
2053
2054	hci_dev_lock(hdev);
2055	hci_bdaddr_list_del_with_irk(list: &hdev->le_resolv_list, bdaddr: &sent->bdaddr,
2056	type: sent->bdaddr_type);
2057	hci_dev_unlock(hdev);
2058
2059	return rp->status;
2060	}
2061
2062	static u8 hci_cc_le_clear_resolv_list(struct hci_dev *hdev, void *data,
2063	struct sk_buff *skb)
2064	{
2065	struct hci_ev_status *rp = data;
2066
2067	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2068
2069	if (rp->status)
2070	return rp->status;
2071
2072	hci_dev_lock(hdev);
2073	hci_bdaddr_list_clear(list: &hdev->le_resolv_list);
2074	hci_dev_unlock(hdev);
2075
2076	return rp->status;
2077	}
2078
2079	static u8 hci_cc_le_read_resolv_list_size(struct hci_dev *hdev, void *data,
2080	struct sk_buff *skb)
2081	{
2082	struct hci_rp_le_read_resolv_list_size *rp = data;
2083
2084	bt_dev_dbg(hdev, "status 0x%2.2x size %u", rp->status, rp->size);
2085
2086	if (rp->status)
2087	return rp->status;
2088
2089	hdev->le_resolv_list_size = rp->size;
2090
2091	return rp->status;
2092	}
2093
2094	static u8 hci_cc_le_set_addr_resolution_enable(struct hci_dev *hdev, void *data,
2095	struct sk_buff *skb)
2096	{
2097	struct hci_ev_status *rp = data;
2098	__u8 *sent;
2099
2100	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2101
2102	if (rp->status)
2103	return rp->status;
2104
2105	sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADDR_RESOLV_ENABLE);
2106	if (!sent)
2107	return rp->status;
2108
2109	hci_dev_lock(hdev);
2110
2111	if (*sent)
2112	hci_dev_set_flag(hdev, HCI_LL_RPA_RESOLUTION);
2113	else
2114	hci_dev_clear_flag(hdev, HCI_LL_RPA_RESOLUTION);
2115
2116	hci_dev_unlock(hdev);
2117
2118	return rp->status;
2119	}
2120
2121	static u8 hci_cc_le_read_max_data_len(struct hci_dev *hdev, void *data,
2122	struct sk_buff *skb)
2123	{
2124	struct hci_rp_le_read_max_data_len *rp = data;
2125
2126	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2127
2128	if (rp->status)
2129	return rp->status;
2130
2131	hdev->le_max_tx_len = le16_to_cpu(rp->tx_len);
2132	hdev->le_max_tx_time = le16_to_cpu(rp->tx_time);
2133	hdev->le_max_rx_len = le16_to_cpu(rp->rx_len);
2134	hdev->le_max_rx_time = le16_to_cpu(rp->rx_time);
2135
2136	return rp->status;
2137	}
2138
2139	static u8 hci_cc_write_le_host_supported(struct hci_dev *hdev, void *data,
2140	struct sk_buff *skb)
2141	{
2142	struct hci_cp_write_le_host_supported *sent;
2143	struct hci_ev_status *rp = data;
2144
2145	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2146
2147	if (rp->status)
2148	return rp->status;
2149
2150	sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
2151	if (!sent)
2152	return rp->status;
2153
2154	hci_dev_lock(hdev);
2155
2156	if (sent->le) {
2157	hdev->features[1][0] |= LMP_HOST_LE;
2158	hci_dev_set_flag(hdev, HCI_LE_ENABLED);
2159	} else {
2160	hdev->features[1][0] &= ~LMP_HOST_LE;
2161	hci_dev_clear_flag(hdev, HCI_LE_ENABLED);
2162	hci_dev_clear_flag(hdev, HCI_ADVERTISING);
2163	}
2164
2165	if (sent->simul)
2166	hdev->features[1][0] |= LMP_HOST_LE_BREDR;
2167	else
2168	hdev->features[1][0] &= ~LMP_HOST_LE_BREDR;
2169
2170	hci_dev_unlock(hdev);
2171
2172	return rp->status;
2173	}
2174
2175	static u8 hci_cc_set_adv_param(struct hci_dev *hdev, void *data,
2176	struct sk_buff *skb)
2177	{
2178	struct hci_cp_le_set_adv_param *cp;
2179	struct hci_ev_status *rp = data;
2180
2181	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2182
2183	if (rp->status)
2184	return rp->status;
2185
2186	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_PARAM);
2187	if (!cp)
2188	return rp->status;
2189
2190	hci_dev_lock(hdev);
2191	hdev->adv_addr_type = cp->own_address_type;
2192	hci_dev_unlock(hdev);
2193
2194	return rp->status;
2195	}
2196
2197	static u8 hci_cc_set_ext_adv_param(struct hci_dev *hdev, void *data,
2198	struct sk_buff *skb)
2199	{
2200	struct hci_rp_le_set_ext_adv_params *rp = data;
2201	struct hci_cp_le_set_ext_adv_params *cp;
2202	struct adv_info *adv_instance;
2203
2204	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2205
2206	if (rp->status)
2207	return rp->status;
2208
2209	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_PARAMS);
2210	if (!cp)
2211	return rp->status;
2212
2213	hci_dev_lock(hdev);
2214	hdev->adv_addr_type = cp->own_addr_type;
2215	if (!cp->handle) {
2216	/* Store in hdev for instance 0 */
2217	hdev->adv_tx_power = rp->tx_power;
2218	} else {
2219	adv_instance = hci_find_adv_instance(hdev, instance: cp->handle);
2220	if (adv_instance)
2221	adv_instance->tx_power = rp->tx_power;
2222	}
2223	/* Update adv data as tx power is known now */
2224	hci_update_adv_data(hdev, instance: cp->handle);
2225
2226	hci_dev_unlock(hdev);
2227
2228	return rp->status;
2229	}
2230
2231	static u8 hci_cc_read_rssi(struct hci_dev *hdev, void *data,
2232	struct sk_buff *skb)
2233	{
2234	struct hci_rp_read_rssi *rp = data;
2235	struct hci_conn *conn;
2236
2237	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2238
2239	if (rp->status)
2240	return rp->status;
2241
2242	hci_dev_lock(hdev);
2243
2244	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
2245	if (conn)
2246	conn->rssi = rp->rssi;
2247
2248	hci_dev_unlock(hdev);
2249
2250	return rp->status;
2251	}
2252
2253	static u8 hci_cc_read_tx_power(struct hci_dev *hdev, void *data,
2254	struct sk_buff *skb)
2255	{
2256	struct hci_cp_read_tx_power *sent;
2257	struct hci_rp_read_tx_power *rp = data;
2258	struct hci_conn *conn;
2259
2260	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2261
2262	if (rp->status)
2263	return rp->status;
2264
2265	sent = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
2266	if (!sent)
2267	return rp->status;
2268
2269	hci_dev_lock(hdev);
2270
2271	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
2272	if (!conn)
2273	goto unlock;
2274
2275	switch (sent->type) {
2276	case 0x00:
2277	conn->tx_power = rp->tx_power;
2278	break;
2279	case 0x01:
2280	conn->max_tx_power = rp->tx_power;
2281	break;
2282	}
2283
2284	unlock:
2285	hci_dev_unlock(hdev);
2286	return rp->status;
2287	}
2288
2289	static u8 hci_cc_write_ssp_debug_mode(struct hci_dev *hdev, void *data,
2290	struct sk_buff *skb)
2291	{
2292	struct hci_ev_status *rp = data;
2293	u8 *mode;
2294
2295	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2296
2297	if (rp->status)
2298	return rp->status;
2299
2300	mode = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE);
2301	if (mode)
2302	hdev->ssp_debug_mode = *mode;
2303
2304	return rp->status;
2305	}
2306
2307	static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
2308	{
2309	bt_dev_dbg(hdev, "status 0x%2.2x", status);
2310
2311	if (status)
2312	return;
2313
2314	if (hci_sent_cmd_data(hdev, HCI_OP_INQUIRY))
2315	set_bit(nr: HCI_INQUIRY, addr: &hdev->flags);
2316	}
2317
2318	static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
2319	{
2320	struct hci_cp_create_conn *cp;
2321	struct hci_conn *conn;
2322
2323	bt_dev_dbg(hdev, "status 0x%2.2x", status);
2324
2325	cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
2326	if (!cp)
2327	return;
2328
2329	hci_dev_lock(hdev);
2330
2331	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, ba: &cp->bdaddr);
2332
2333	bt_dev_dbg(hdev, "bdaddr %pMR hcon %p", &cp->bdaddr, conn);
2334
2335	if (status) {
2336	if (conn && conn->state == BT_CONNECT) {
2337	conn->state = BT_CLOSED;
2338	hci_connect_cfm(conn, status);
2339	hci_conn_del(conn);
2340	}
2341	} else {
2342	if (!conn) {
2343	conn = hci_conn_add_unset(hdev, ACL_LINK, dst: &cp->bdaddr,
2344	HCI_ROLE_MASTER);
2345	if (!conn)
2346	bt_dev_err(hdev, "no memory for new connection");
2347	}
2348	}
2349
2350	hci_dev_unlock(hdev);
2351	}
2352
2353	static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
2354	{
2355	struct hci_cp_add_sco *cp;
2356	struct hci_conn *acl;
2357	struct hci_link *link;
2358	__u16 handle;
2359
2360	bt_dev_dbg(hdev, "status 0x%2.2x", status);
2361
2362	if (!status)
2363	return;
2364
2365	cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
2366	if (!cp)
2367	return;
2368
2369	handle = __le16_to_cpu(cp->handle);
2370
2371	bt_dev_dbg(hdev, "handle 0x%4.4x", handle);
2372
2373	hci_dev_lock(hdev);
2374
2375	acl = hci_conn_hash_lookup_handle(hdev, handle);
2376	if (acl) {
2377	link = list_first_entry_or_null(&acl->link_list,
2378	struct hci_link, list);
2379	if (link && link->conn) {
2380	link->conn->state = BT_CLOSED;
2381
2382	hci_connect_cfm(conn: link->conn, status);
2383	hci_conn_del(conn: link->conn);
2384	}
2385	}
2386
2387	hci_dev_unlock(hdev);
2388	}
2389
2390	static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
2391	{
2392	struct hci_cp_auth_requested *cp;
2393	struct hci_conn *conn;
2394
2395	bt_dev_dbg(hdev, "status 0x%2.2x", status);
2396
2397	if (!status)
2398	return;
2399
2400	cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
2401	if (!cp)
2402	return;
2403
2404	hci_dev_lock(hdev);
2405
2406	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2407	if (conn) {
2408	if (conn->state == BT_CONFIG) {
2409	hci_connect_cfm(conn, status);
2410	hci_conn_drop(conn);
2411	}
2412	}
2413
2414	hci_dev_unlock(hdev);
2415	}
2416
2417	static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
2418	{
2419	struct hci_cp_set_conn_encrypt *cp;
2420	struct hci_conn *conn;
2421
2422	bt_dev_dbg(hdev, "status 0x%2.2x", status);
2423
2424	if (!status)
2425	return;
2426
2427	cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
2428	if (!cp)
2429	return;
2430
2431	hci_dev_lock(hdev);
2432
2433	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2434	if (conn) {
2435	if (conn->state == BT_CONFIG) {
2436	hci_connect_cfm(conn, status);
2437	hci_conn_drop(conn);
2438	}
2439	}
2440
2441	hci_dev_unlock(hdev);
2442	}
2443
2444	static int hci_outgoing_auth_needed(struct hci_dev *hdev,
2445	struct hci_conn *conn)
2446	{
2447	if (conn->state != BT_CONFIG || !conn->out)
2448	return 0;
2449
2450	if (conn->pending_sec_level == BT_SECURITY_SDP)
2451	return 0;
2452
2453	/* Only request authentication for SSP connections or non-SSP
2454	* devices with sec_level MEDIUM or HIGH or if MITM protection
2455	* is requested.
2456	*/
2457	if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
2458	conn->pending_sec_level != BT_SECURITY_FIPS &&
2459	conn->pending_sec_level != BT_SECURITY_HIGH &&
2460	conn->pending_sec_level != BT_SECURITY_MEDIUM)
2461	return 0;
2462
2463	return 1;
2464	}
2465
2466	static int hci_resolve_name(struct hci_dev *hdev,
2467	struct inquiry_entry *e)
2468	{
2469	struct hci_cp_remote_name_req cp;
2470
2471	memset(&cp, 0, sizeof(cp));
2472
2473	bacpy(dst: &cp.bdaddr, src: &e->data.bdaddr);
2474	cp.pscan_rep_mode = e->data.pscan_rep_mode;
2475	cp.pscan_mode = e->data.pscan_mode;
2476	cp.clock_offset = e->data.clock_offset;
2477
2478	return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, plen: sizeof(cp), param: &cp);
2479	}
2480
2481	static bool hci_resolve_next_name(struct hci_dev *hdev)
2482	{
2483	struct discovery_state *discov = &hdev->discovery;
2484	struct inquiry_entry *e;
2485
2486	if (list_empty(head: &discov->resolve))
2487	return false;
2488
2489	/* We should stop if we already spent too much time resolving names. */
2490	if (time_after(jiffies, discov->name_resolve_timeout)) {
2491	bt_dev_warn_ratelimited(hdev, "Name resolve takes too long.");
2492	return false;
2493	}
2494
2495	e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, state: NAME_NEEDED);
2496	if (!e)
2497	return false;
2498
2499	if (hci_resolve_name(hdev, e) == 0) {
2500	e->name_state = NAME_PENDING;
2501	return true;
2502	}
2503
2504	return false;
2505	}
2506
2507	static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
2508	bdaddr_t *bdaddr, u8 *name, u8 name_len)
2509	{
2510	struct discovery_state *discov = &hdev->discovery;
2511	struct inquiry_entry *e;
2512
2513	/* Update the mgmt connected state if necessary. Be careful with
2514	* conn objects that exist but are not (yet) connected however.
2515	* Only those in BT_CONFIG or BT_CONNECTED states can be
2516	* considered connected.
2517	*/
2518	if (conn && (conn->state == BT_CONFIG || conn->state == BT_CONNECTED))
2519	mgmt_device_connected(hdev, conn, name, name_len);
2520
2521	if (discov->state == DISCOVERY_STOPPED)
2522	return;
2523
2524	if (discov->state == DISCOVERY_STOPPING)
2525	goto discov_complete;
2526
2527	if (discov->state != DISCOVERY_RESOLVING)
2528	return;
2529
2530	e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, state: NAME_PENDING);
2531	/* If the device was not found in a list of found devices names of which
2532	* are pending. there is no need to continue resolving a next name as it
2533	* will be done upon receiving another Remote Name Request Complete
2534	* Event */
2535	if (!e)
2536	return;
2537
2538	list_del(entry: &e->list);
2539
2540	e->name_state = name ? NAME_KNOWN : NAME_NOT_KNOWN;
2541	mgmt_remote_name(hdev, bdaddr, ACL_LINK, addr_type: 0x00, rssi: e->data.rssi,
2542	name, name_len);
2543
2544	if (hci_resolve_next_name(hdev))
2545	return;
2546
2547	discov_complete:
2548	hci_discovery_set_state(hdev, state: DISCOVERY_STOPPED);
2549	}
2550
2551	static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
2552	{
2553	struct hci_cp_remote_name_req *cp;
2554	struct hci_conn *conn;
2555
2556	bt_dev_dbg(hdev, "status 0x%2.2x", status);
2557
2558	/* If successful wait for the name req complete event before
2559	* checking for the need to do authentication */
2560	if (!status)
2561	return;
2562
2563	cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
2564	if (!cp)
2565	return;
2566
2567	hci_dev_lock(hdev);
2568
2569	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, ba: &cp->bdaddr);
2570
2571	if (hci_dev_test_flag(hdev, HCI_MGMT))
2572	hci_check_pending_name(hdev, conn, bdaddr: &cp->bdaddr, NULL, name_len: 0);
2573
2574	if (!conn)
2575	goto unlock;
2576
2577	if (!hci_outgoing_auth_needed(hdev, conn))
2578	goto unlock;
2579
2580	if (!test_and_set_bit(nr: HCI_CONN_AUTH_PEND, addr: &conn->flags)) {
2581	struct hci_cp_auth_requested auth_cp;
2582
2583	set_bit(nr: HCI_CONN_AUTH_INITIATOR, addr: &conn->flags);
2584
2585	auth_cp.handle = __cpu_to_le16(conn->handle);
2586	hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
2587	plen: sizeof(auth_cp), param: &auth_cp);
2588	}
2589
2590	unlock:
2591	hci_dev_unlock(hdev);
2592	}
2593
2594	static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
2595	{
2596	struct hci_cp_read_remote_features *cp;
2597	struct hci_conn *conn;
2598
2599	bt_dev_dbg(hdev, "status 0x%2.2x", status);
2600
2601	if (!status)
2602	return;
2603
2604	cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
2605	if (!cp)
2606	return;
2607
2608	hci_dev_lock(hdev);
2609
2610	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2611	if (conn) {
2612	if (conn->state == BT_CONFIG) {
2613	hci_connect_cfm(conn, status);
2614	hci_conn_drop(conn);
2615	}
2616	}
2617
2618	hci_dev_unlock(hdev);
2619	}
2620
2621	static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
2622	{
2623	struct hci_cp_read_remote_ext_features *cp;
2624	struct hci_conn *conn;
2625
2626	bt_dev_dbg(hdev, "status 0x%2.2x", status);
2627
2628	if (!status)
2629	return;
2630
2631	cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
2632	if (!cp)
2633	return;
2634
2635	hci_dev_lock(hdev);
2636
2637	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2638	if (conn) {
2639	if (conn->state == BT_CONFIG) {
2640	hci_connect_cfm(conn, status);
2641	hci_conn_drop(conn);
2642	}
2643	}
2644
2645	hci_dev_unlock(hdev);
2646	}
2647
2648	static void hci_setup_sync_conn_status(struct hci_dev *hdev, __u16 handle,
2649	__u8 status)
2650	{
2651	struct hci_conn *acl;
2652	struct hci_link *link;
2653
2654	bt_dev_dbg(hdev, "handle 0x%4.4x status 0x%2.2x", handle, status);
2655
2656	hci_dev_lock(hdev);
2657
2658	acl = hci_conn_hash_lookup_handle(hdev, handle);
2659	if (acl) {
2660	link = list_first_entry_or_null(&acl->link_list,
2661	struct hci_link, list);
2662	if (link && link->conn) {
2663	link->conn->state = BT_CLOSED;
2664
2665	hci_connect_cfm(conn: link->conn, status);
2666	hci_conn_del(conn: link->conn);
2667	}
2668	}
2669
2670	hci_dev_unlock(hdev);
2671	}
2672
2673	static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
2674	{
2675	struct hci_cp_setup_sync_conn *cp;
2676
2677	bt_dev_dbg(hdev, "status 0x%2.2x", status);
2678
2679	if (!status)
2680	return;
2681
2682	cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
2683	if (!cp)
2684	return;
2685
2686	hci_setup_sync_conn_status(hdev, __le16_to_cpu(cp->handle), status);
2687	}
2688
2689	static void hci_cs_enhanced_setup_sync_conn(struct hci_dev *hdev, __u8 status)
2690	{
2691	struct hci_cp_enhanced_setup_sync_conn *cp;
2692
2693	bt_dev_dbg(hdev, "status 0x%2.2x", status);
2694
2695	if (!status)
2696	return;
2697
2698	cp = hci_sent_cmd_data(hdev, HCI_OP_ENHANCED_SETUP_SYNC_CONN);
2699	if (!cp)
2700	return;
2701
2702	hci_setup_sync_conn_status(hdev, __le16_to_cpu(cp->handle), status);
2703	}
2704
2705	static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
2706	{
2707	struct hci_cp_sniff_mode *cp;
2708	struct hci_conn *conn;
2709
2710	bt_dev_dbg(hdev, "status 0x%2.2x", status);
2711
2712	if (!status)
2713	return;
2714
2715	cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
2716	if (!cp)
2717	return;
2718
2719	hci_dev_lock(hdev);
2720
2721	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2722	if (conn) {
2723	clear_bit(nr: HCI_CONN_MODE_CHANGE_PEND, addr: &conn->flags);
2724
2725	if (test_and_clear_bit(nr: HCI_CONN_SCO_SETUP_PEND, addr: &conn->flags))
2726	hci_sco_setup(conn, status);
2727	}
2728
2729	hci_dev_unlock(hdev);
2730	}
2731
2732	static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
2733	{
2734	struct hci_cp_exit_sniff_mode *cp;
2735	struct hci_conn *conn;
2736
2737	bt_dev_dbg(hdev, "status 0x%2.2x", status);
2738
2739	if (!status)
2740	return;
2741
2742	cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
2743	if (!cp)
2744	return;
2745
2746	hci_dev_lock(hdev);
2747
2748	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2749	if (conn) {
2750	clear_bit(nr: HCI_CONN_MODE_CHANGE_PEND, addr: &conn->flags);
2751
2752	if (test_and_clear_bit(nr: HCI_CONN_SCO_SETUP_PEND, addr: &conn->flags))
2753	hci_sco_setup(conn, status);
2754	}
2755
2756	hci_dev_unlock(hdev);
2757	}
2758
2759	static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
2760	{
2761	struct hci_cp_disconnect *cp;
2762	struct hci_conn_params *params;
2763	struct hci_conn *conn;
2764	bool mgmt_conn;
2765
2766	bt_dev_dbg(hdev, "status 0x%2.2x", status);
2767
2768	/* Wait for HCI_EV_DISCONN_COMPLETE if status 0x00 and not suspended
2769	* otherwise cleanup the connection immediately.
2770	*/
2771	if (!status && !hdev->suspended)
2772	return;
2773
2774	cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
2775	if (!cp)
2776	return;
2777
2778	hci_dev_lock(hdev);
2779
2780	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2781	if (!conn)
2782	goto unlock;
2783
2784	if (status) {
2785	mgmt_disconnect_failed(hdev, bdaddr: &conn->dst, link_type: conn->type,
2786	addr_type: conn->dst_type, status);
2787
2788	if (conn->type == LE_LINK && conn->role == HCI_ROLE_SLAVE) {
2789	hdev->cur_adv_instance = conn->adv_instance;
2790	hci_enable_advertising(hdev);
2791	}
2792
2793	/* Inform sockets conn is gone before we delete it */
2794	hci_disconn_cfm(conn, HCI_ERROR_UNSPECIFIED);
2795
2796	goto done;
2797	}
2798
2799	mgmt_conn = test_and_clear_bit(nr: HCI_CONN_MGMT_CONNECTED, addr: &conn->flags);
2800
2801	if (conn->type == ACL_LINK) {
2802	if (test_and_clear_bit(nr: HCI_CONN_FLUSH_KEY, addr: &conn->flags))
2803	hci_remove_link_key(hdev, bdaddr: &conn->dst);
2804	}
2805
2806	params = hci_conn_params_lookup(hdev, addr: &conn->dst, addr_type: conn->dst_type);
2807	if (params) {
2808	switch (params->auto_connect) {
2809	case HCI_AUTO_CONN_LINK_LOSS:
2810	if (cp->reason != HCI_ERROR_CONNECTION_TIMEOUT)
2811	break;
2812	fallthrough;
2813
2814	case HCI_AUTO_CONN_DIRECT:
2815	case HCI_AUTO_CONN_ALWAYS:
2816	hci_pend_le_list_del_init(param: params);
2817	hci_pend_le_list_add(param: params, list: &hdev->pend_le_conns);
2818	break;
2819
2820	default:
2821	break;
2822	}
2823	}
2824
2825	mgmt_device_disconnected(hdev, bdaddr: &conn->dst, link_type: conn->type, addr_type: conn->dst_type,
2826	reason: cp->reason, mgmt_connected: mgmt_conn);
2827
2828	hci_disconn_cfm(conn, reason: cp->reason);
2829
2830	done:
2831	/* If the disconnection failed for any reason, the upper layer
2832	* does not retry to disconnect in current implementation.
2833	* Hence, we need to do some basic cleanup here and re-enable
2834	* advertising if necessary.
2835	*/
2836	hci_conn_del(conn);
2837	unlock:
2838	hci_dev_unlock(hdev);
2839	}
2840
2841	static u8 ev_bdaddr_type(struct hci_dev *hdev, u8 type, bool *resolved)
2842	{
2843	/* When using controller based address resolution, then the new
2844	* address types 0x02 and 0x03 are used. These types need to be
2845	* converted back into either public address or random address type
2846	*/
2847	switch (type) {
2848	case ADDR_LE_DEV_PUBLIC_RESOLVED:
2849	if (resolved)
2850	*resolved = true;
2851	return ADDR_LE_DEV_PUBLIC;
2852	case ADDR_LE_DEV_RANDOM_RESOLVED:
2853	if (resolved)
2854	*resolved = true;
2855	return ADDR_LE_DEV_RANDOM;
2856	}
2857
2858	if (resolved)
2859	*resolved = false;
2860	return type;
2861	}
2862
2863	static void cs_le_create_conn(struct hci_dev *hdev, bdaddr_t *peer_addr,
2864	u8 peer_addr_type, u8 own_address_type,
2865	u8 filter_policy)
2866	{
2867	struct hci_conn *conn;
2868
2869	conn = hci_conn_hash_lookup_le(hdev, ba: peer_addr,
2870	ba_type: peer_addr_type);
2871	if (!conn)
2872	return;
2873
2874	own_address_type = ev_bdaddr_type(hdev, type: own_address_type, NULL);
2875
2876	/* Store the initiator and responder address information which
2877	* is needed for SMP. These values will not change during the
2878	* lifetime of the connection.
2879	*/
2880	conn->init_addr_type = own_address_type;
2881	if (own_address_type == ADDR_LE_DEV_RANDOM)
2882	bacpy(dst: &conn->init_addr, src: &hdev->random_addr);
2883	else
2884	bacpy(dst: &conn->init_addr, src: &hdev->bdaddr);
2885
2886	conn->resp_addr_type = peer_addr_type;
2887	bacpy(dst: &conn->resp_addr, src: peer_addr);
2888	}
2889
2890	static void hci_cs_le_create_conn(struct hci_dev *hdev, u8 status)
2891	{
2892	struct hci_cp_le_create_conn *cp;
2893
2894	bt_dev_dbg(hdev, "status 0x%2.2x", status);
2895
2896	/* All connection failure handling is taken care of by the
2897	* hci_conn_failed function which is triggered by the HCI
2898	* request completion callbacks used for connecting.
2899	*/
2900	if (status)
2901	return;
2902
2903	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
2904	if (!cp)
2905	return;
2906
2907	hci_dev_lock(hdev);
2908
2909	cs_le_create_conn(hdev, peer_addr: &cp->peer_addr, peer_addr_type: cp->peer_addr_type,
2910	own_address_type: cp->own_address_type, filter_policy: cp->filter_policy);
2911
2912	hci_dev_unlock(hdev);
2913	}
2914
2915	static void hci_cs_le_ext_create_conn(struct hci_dev *hdev, u8 status)
2916	{
2917	struct hci_cp_le_ext_create_conn *cp;
2918
2919	bt_dev_dbg(hdev, "status 0x%2.2x", status);
2920
2921	/* All connection failure handling is taken care of by the
2922	* hci_conn_failed function which is triggered by the HCI
2923	* request completion callbacks used for connecting.
2924	*/
2925	if (status)
2926	return;
2927
2928	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_EXT_CREATE_CONN);
2929	if (!cp)
2930	return;
2931
2932	hci_dev_lock(hdev);
2933
2934	cs_le_create_conn(hdev, peer_addr: &cp->peer_addr, peer_addr_type: cp->peer_addr_type,
2935	own_address_type: cp->own_addr_type, filter_policy: cp->filter_policy);
2936
2937	hci_dev_unlock(hdev);
2938	}
2939
2940	static void hci_cs_le_read_remote_features(struct hci_dev *hdev, u8 status)
2941	{
2942	struct hci_cp_le_read_remote_features *cp;
2943	struct hci_conn *conn;
2944
2945	bt_dev_dbg(hdev, "status 0x%2.2x", status);
2946
2947	if (!status)
2948	return;
2949
2950	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_READ_REMOTE_FEATURES);
2951	if (!cp)
2952	return;
2953
2954	hci_dev_lock(hdev);
2955
2956	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2957	if (conn) {
2958	if (conn->state == BT_CONFIG) {
2959	hci_connect_cfm(conn, status);
2960	hci_conn_drop(conn);
2961	}
2962	}
2963
2964	hci_dev_unlock(hdev);
2965	}
2966
2967	static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
2968	{
2969	struct hci_cp_le_start_enc *cp;
2970	struct hci_conn *conn;
2971
2972	bt_dev_dbg(hdev, "status 0x%2.2x", status);
2973
2974	if (!status)
2975	return;
2976
2977	hci_dev_lock(hdev);
2978
2979	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_START_ENC);
2980	if (!cp)
2981	goto unlock;
2982
2983	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2984	if (!conn)
2985	goto unlock;
2986
2987	if (conn->state != BT_CONNECTED)
2988	goto unlock;
2989
2990	hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2991	hci_conn_drop(conn);
2992
2993	unlock:
2994	hci_dev_unlock(hdev);
2995	}
2996
2997	static void hci_cs_switch_role(struct hci_dev *hdev, u8 status)
2998	{
2999	struct hci_cp_switch_role *cp;
3000	struct hci_conn *conn;
3001
3002	BT_DBG("%s status 0x%2.2x", hdev->name, status);
3003
3004	if (!status)
3005	return;
3006
3007	cp = hci_sent_cmd_data(hdev, HCI_OP_SWITCH_ROLE);
3008	if (!cp)
3009	return;
3010
3011	hci_dev_lock(hdev);
3012
3013	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, ba: &cp->bdaddr);
3014	if (conn)
3015	clear_bit(nr: HCI_CONN_RSWITCH_PEND, addr: &conn->flags);
3016
3017	hci_dev_unlock(hdev);
3018	}
3019
3020	static void hci_inquiry_complete_evt(struct hci_dev *hdev, void *data,
3021	struct sk_buff *skb)
3022	{
3023	struct hci_ev_status *ev = data;
3024	struct discovery_state *discov = &hdev->discovery;
3025	struct inquiry_entry *e;
3026
3027	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
3028
3029	if (!test_and_clear_bit(nr: HCI_INQUIRY, addr: &hdev->flags))
3030	return;
3031
3032	smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
3033	wake_up_bit(word: &hdev->flags, bit: HCI_INQUIRY);
3034
3035	if (!hci_dev_test_flag(hdev, HCI_MGMT))
3036	return;
3037
3038	hci_dev_lock(hdev);
3039
3040	if (discov->state != DISCOVERY_FINDING)
3041	goto unlock;
3042
3043	if (list_empty(head: &discov->resolve)) {
3044	/* When BR/EDR inquiry is active and no LE scanning is in
3045	* progress, then change discovery state to indicate completion.
3046	*
3047	* When running LE scanning and BR/EDR inquiry simultaneously
3048	* and the LE scan already finished, then change the discovery
3049	* state to indicate completion.
3050	*/
3051	if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
3052	!test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
3053	hci_discovery_set_state(hdev, state: DISCOVERY_STOPPED);
3054	goto unlock;
3055	}
3056
3057	e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, state: NAME_NEEDED);
3058	if (e && hci_resolve_name(hdev, e) == 0) {
3059	e->name_state = NAME_PENDING;
3060	hci_discovery_set_state(hdev, state: DISCOVERY_RESOLVING);
3061	discov->name_resolve_timeout = jiffies + NAME_RESOLVE_DURATION;
3062	} else {
3063	/* When BR/EDR inquiry is active and no LE scanning is in
3064	* progress, then change discovery state to indicate completion.
3065	*
3066	* When running LE scanning and BR/EDR inquiry simultaneously
3067	* and the LE scan already finished, then change the discovery
3068	* state to indicate completion.
3069	*/
3070	if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
3071	!test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
3072	hci_discovery_set_state(hdev, state: DISCOVERY_STOPPED);
3073	}
3074
3075	unlock:
3076	hci_dev_unlock(hdev);
3077	}
3078
3079	static void hci_inquiry_result_evt(struct hci_dev *hdev, void *edata,
3080	struct sk_buff *skb)
3081	{
3082	struct hci_ev_inquiry_result *ev = edata;
3083	struct inquiry_data data;
3084	int i;
3085
3086	if (!hci_ev_skb_pull(hdev, skb, HCI_EV_INQUIRY_RESULT,
3087	flex_array_size(ev, info, ev->num)))
3088	return;
3089
3090	bt_dev_dbg(hdev, "num %d", ev->num);
3091
3092	if (!ev->num)
3093	return;
3094
3095	if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
3096	return;
3097
3098	hci_dev_lock(hdev);
3099
3100	for (i = 0; i < ev->num; i++) {
3101	struct inquiry_info *info = &ev->info[i];
3102	u32 flags;
3103
3104	bacpy(dst: &data.bdaddr, src: &info->bdaddr);
3105	data.pscan_rep_mode = info->pscan_rep_mode;
3106	data.pscan_period_mode = info->pscan_period_mode;
3107	data.pscan_mode = info->pscan_mode;
3108	memcpy(data.dev_class, info->dev_class, 3);
3109	data.clock_offset = info->clock_offset;
3110	data.rssi = HCI_RSSI_INVALID;
3111	data.ssp_mode = 0x00;
3112
3113	flags = hci_inquiry_cache_update(hdev, data: &data, name_known: false);
3114
3115	mgmt_device_found(hdev, bdaddr: &info->bdaddr, ACL_LINK, addr_type: 0x00,
3116	dev_class: info->dev_class, HCI_RSSI_INVALID,
3117	flags, NULL, eir_len: 0, NULL, scan_rsp_len: 0, instant: 0);
3118	}
3119
3120	hci_dev_unlock(hdev);
3121	}
3122
3123	static void hci_conn_complete_evt(struct hci_dev *hdev, void *data,
3124	struct sk_buff *skb)
3125	{
3126	struct hci_ev_conn_complete *ev = data;
3127	struct hci_conn *conn;
3128	u8 status = ev->status;
3129
3130	bt_dev_dbg(hdev, "status 0x%2.2x", status);
3131
3132	hci_dev_lock(hdev);
3133
3134	conn = hci_conn_hash_lookup_ba(hdev, type: ev->link_type, ba: &ev->bdaddr);
3135	if (!conn) {
3136	/* In case of error status and there is no connection pending
3137	* just unlock as there is nothing to cleanup.
3138	*/
3139	if (ev->status)
3140	goto unlock;
3141
3142	/* Connection may not exist if auto-connected. Check the bredr
3143	* allowlist to see if this device is allowed to auto connect.
3144	* If link is an ACL type, create a connection class
3145	* automatically.
3146	*
3147	* Auto-connect will only occur if the event filter is
3148	* programmed with a given address. Right now, event filter is
3149	* only used during suspend.
3150	*/
3151	if (ev->link_type == ACL_LINK &&
3152	hci_bdaddr_list_lookup_with_flags(list: &hdev->accept_list,
3153	bdaddr: &ev->bdaddr,
3154	BDADDR_BREDR)) {
3155	conn = hci_conn_add_unset(hdev, type: ev->link_type,
3156	dst: &ev->bdaddr, HCI_ROLE_SLAVE);
3157	if (!conn) {
3158	bt_dev_err(hdev, "no memory for new conn");
3159	goto unlock;
3160	}
3161	} else {
3162	if (ev->link_type != SCO_LINK)
3163	goto unlock;
3164
3165	conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK,
3166	ba: &ev->bdaddr);
3167	if (!conn)
3168	goto unlock;
3169
3170	conn->type = SCO_LINK;
3171	}
3172	}
3173
3174	/* The HCI_Connection_Complete event is only sent once per connection.
3175	* Processing it more than once per connection can corrupt kernel memory.
3176	*
3177	* As the connection handle is set here for the first time, it indicates
3178	* whether the connection is already set up.
3179	*/
3180	if (!HCI_CONN_HANDLE_UNSET(conn->handle)) {
3181	bt_dev_err(hdev, "Ignoring HCI_Connection_Complete for existing connection");
3182	goto unlock;
3183	}
3184
3185	if (!status) {
3186	status = hci_conn_set_handle(conn, __le16_to_cpu(ev->handle));
3187	if (status)
3188	goto done;
3189
3190	if (conn->type == ACL_LINK) {
3191	conn->state = BT_CONFIG;
3192	hci_conn_hold(conn);
3193
3194	if (!conn->out && !hci_conn_ssp_enabled(conn) &&
3195	!hci_find_link_key(hdev, bdaddr: &ev->bdaddr))
3196	conn->disc_timeout = HCI_PAIRING_TIMEOUT;
3197	else
3198	conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3199	} else
3200	conn->state = BT_CONNECTED;
3201
3202	hci_debugfs_create_conn(conn);
3203	hci_conn_add_sysfs(conn);
3204
3205	if (test_bit(HCI_AUTH, &hdev->flags))
3206	set_bit(nr: HCI_CONN_AUTH, addr: &conn->flags);
3207
3208	if (test_bit(HCI_ENCRYPT, &hdev->flags))
3209	set_bit(nr: HCI_CONN_ENCRYPT, addr: &conn->flags);
3210
3211	/* "Link key request" completed ahead of "connect request" completes */
3212	if (ev->encr_mode == 1 && !test_bit(HCI_CONN_ENCRYPT, &conn->flags) &&
3213	ev->link_type == ACL_LINK) {
3214	struct link_key *key;
3215	struct hci_cp_read_enc_key_size cp;
3216
3217	key = hci_find_link_key(hdev, bdaddr: &ev->bdaddr);
3218	if (key) {
3219	set_bit(nr: HCI_CONN_ENCRYPT, addr: &conn->flags);
3220
3221	if (!(hdev->commands[20] & 0x10)) {
3222	conn->enc_key_size = HCI_LINK_KEY_SIZE;
3223	} else {
3224	cp.handle = cpu_to_le16(conn->handle);
3225	if (hci_send_cmd(hdev, HCI_OP_READ_ENC_KEY_SIZE,
3226	plen: sizeof(cp), param: &cp)) {
3227	bt_dev_err(hdev, "sending read key size failed");
3228	conn->enc_key_size = HCI_LINK_KEY_SIZE;
3229	}
3230	}
3231
3232	hci_encrypt_cfm(conn, status: ev->status);
3233	}
3234	}
3235
3236	/* Get remote features */
3237	if (conn->type == ACL_LINK) {
3238	struct hci_cp_read_remote_features cp;
3239	cp.handle = ev->handle;
3240	hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
3241	plen: sizeof(cp), param: &cp);
3242
3243	hci_update_scan(hdev);
3244	}
3245
3246	/* Set packet type for incoming connection */
3247	if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
3248	struct hci_cp_change_conn_ptype cp;
3249	cp.handle = ev->handle;
3250	cp.pkt_type = cpu_to_le16(conn->pkt_type);
3251	hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, plen: sizeof(cp),
3252	param: &cp);
3253	}
3254	}
3255
3256	if (conn->type == ACL_LINK)
3257	hci_sco_setup(conn, status: ev->status);
3258
3259	done:
3260	if (status) {
3261	hci_conn_failed(conn, status);
3262	} else if (ev->link_type == SCO_LINK) {
3263	switch (conn->setting & SCO_AIRMODE_MASK) {
3264	case SCO_AIRMODE_CVSD:
3265	if (hdev->notify)
3266	hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_CVSD);
3267	break;
3268	}
3269
3270	hci_connect_cfm(conn, status);
3271	}
3272
3273	unlock:
3274	hci_dev_unlock(hdev);
3275	}
3276
3277	static void hci_reject_conn(struct hci_dev *hdev, bdaddr_t *bdaddr)
3278	{
3279	struct hci_cp_reject_conn_req cp;
3280
3281	bacpy(dst: &cp.bdaddr, src: bdaddr);
3282	cp.reason = HCI_ERROR_REJ_BAD_ADDR;
3283	hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, plen: sizeof(cp), param: &cp);
3284	}
3285
3286	static void hci_conn_request_evt(struct hci_dev *hdev, void *data,
3287	struct sk_buff *skb)
3288	{
3289	struct hci_ev_conn_request *ev = data;
3290	int mask = hdev->link_mode;
3291	struct inquiry_entry *ie;
3292	struct hci_conn *conn;
3293	__u8 flags = 0;
3294
3295	bt_dev_dbg(hdev, "bdaddr %pMR type 0x%x", &ev->bdaddr, ev->link_type);
3296
3297	/* Reject incoming connection from device with same BD ADDR against
3298	* CVE-2020-26555
3299	*/
3300	if (hdev && !bacmp(ba1: &hdev->bdaddr, ba2: &ev->bdaddr)) {
3301	bt_dev_dbg(hdev, "Reject connection with same BD_ADDR %pMR\n",
3302	&ev->bdaddr);
3303	hci_reject_conn(hdev, bdaddr: &ev->bdaddr);
3304	return;
3305	}
3306
3307	mask |= hci_proto_connect_ind(hdev, bdaddr: &ev->bdaddr, type: ev->link_type,
3308	flags: &flags);
3309
3310	if (!(mask & HCI_LM_ACCEPT)) {
3311	hci_reject_conn(hdev, bdaddr: &ev->bdaddr);
3312	return;
3313	}
3314
3315	hci_dev_lock(hdev);
3316
3317	if (hci_bdaddr_list_lookup(list: &hdev->reject_list, bdaddr: &ev->bdaddr,
3318	BDADDR_BREDR)) {
3319	hci_reject_conn(hdev, bdaddr: &ev->bdaddr);
3320	goto unlock;
3321	}
3322
3323	/* Require HCI_CONNECTABLE or an accept list entry to accept the
3324	* connection. These features are only touched through mgmt so
3325	* only do the checks if HCI_MGMT is set.
3326	*/
3327	if (hci_dev_test_flag(hdev, HCI_MGMT) &&
3328	!hci_dev_test_flag(hdev, HCI_CONNECTABLE) &&
3329	!hci_bdaddr_list_lookup_with_flags(list: &hdev->accept_list, bdaddr: &ev->bdaddr,
3330	BDADDR_BREDR)) {
3331	hci_reject_conn(hdev, bdaddr: &ev->bdaddr);
3332	goto unlock;
3333	}
3334
3335	/* Connection accepted */
3336
3337	ie = hci_inquiry_cache_lookup(hdev, bdaddr: &ev->bdaddr);
3338	if (ie)
3339	memcpy(ie->data.dev_class, ev->dev_class, 3);
3340
3341	conn = hci_conn_hash_lookup_ba(hdev, type: ev->link_type,
3342	ba: &ev->bdaddr);
3343	if (!conn) {
3344	conn = hci_conn_add_unset(hdev, type: ev->link_type, dst: &ev->bdaddr,
3345	HCI_ROLE_SLAVE);
3346	if (!conn) {
3347	bt_dev_err(hdev, "no memory for new connection");
3348	goto unlock;
3349	}
3350	}
3351
3352	memcpy(conn->dev_class, ev->dev_class, 3);
3353
3354	hci_dev_unlock(hdev);
3355
3356	if (ev->link_type == ACL_LINK ||
3357	(!(flags & HCI_PROTO_DEFER) && !lmp_esco_capable(hdev))) {
3358	struct hci_cp_accept_conn_req cp;
3359	conn->state = BT_CONNECT;
3360
3361	bacpy(dst: &cp.bdaddr, src: &ev->bdaddr);
3362
3363	if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
3364	cp.role = 0x00; /* Become central */
3365	else
3366	cp.role = 0x01; /* Remain peripheral */
3367
3368	hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, plen: sizeof(cp), param: &cp);
3369	} else if (!(flags & HCI_PROTO_DEFER)) {
3370	struct hci_cp_accept_sync_conn_req cp;
3371	conn->state = BT_CONNECT;
3372
3373	bacpy(dst: &cp.bdaddr, src: &ev->bdaddr);
3374	cp.pkt_type = cpu_to_le16(conn->pkt_type);
3375
3376	cp.tx_bandwidth = cpu_to_le32(0x00001f40);
3377	cp.rx_bandwidth = cpu_to_le32(0x00001f40);
3378	cp.max_latency = cpu_to_le16(0xffff);
3379	cp.content_format = cpu_to_le16(hdev->voice_setting);
3380	cp.retrans_effort = 0xff;
3381
3382	hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ, plen: sizeof(cp),
3383	param: &cp);
3384	} else {
3385	conn->state = BT_CONNECT2;
3386	hci_connect_cfm(conn, status: 0);
3387	}
3388
3389	return;
3390	unlock:
3391	hci_dev_unlock(hdev);
3392	}
3393
3394	static u8 hci_to_mgmt_reason(u8 err)
3395	{
3396	switch (err) {
3397	case HCI_ERROR_CONNECTION_TIMEOUT:
3398	return MGMT_DEV_DISCONN_TIMEOUT;
3399	case HCI_ERROR_REMOTE_USER_TERM:
3400	case HCI_ERROR_REMOTE_LOW_RESOURCES:
3401	case HCI_ERROR_REMOTE_POWER_OFF:
3402	return MGMT_DEV_DISCONN_REMOTE;
3403	case HCI_ERROR_LOCAL_HOST_TERM:
3404	return MGMT_DEV_DISCONN_LOCAL_HOST;
3405	default:
3406	return MGMT_DEV_DISCONN_UNKNOWN;
3407	}
3408	}
3409
3410	static void hci_disconn_complete_evt(struct hci_dev *hdev, void *data,
3411	struct sk_buff *skb)
3412	{
3413	struct hci_ev_disconn_complete *ev = data;
3414	u8 reason;
3415	struct hci_conn_params *params;
3416	struct hci_conn *conn;
3417	bool mgmt_connected;
3418
3419	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
3420
3421	hci_dev_lock(hdev);
3422
3423	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3424	if (!conn)
3425	goto unlock;
3426
3427	if (ev->status) {
3428	mgmt_disconnect_failed(hdev, bdaddr: &conn->dst, link_type: conn->type,
3429	addr_type: conn->dst_type, status: ev->status);
3430	goto unlock;
3431	}
3432
3433	conn->state = BT_CLOSED;
3434
3435	mgmt_connected = test_and_clear_bit(nr: HCI_CONN_MGMT_CONNECTED, addr: &conn->flags);
3436
3437	if (test_bit(HCI_CONN_AUTH_FAILURE, &conn->flags))
3438	reason = MGMT_DEV_DISCONN_AUTH_FAILURE;
3439	else
3440	reason = hci_to_mgmt_reason(err: ev->reason);
3441
3442	mgmt_device_disconnected(hdev, bdaddr: &conn->dst, link_type: conn->type, addr_type: conn->dst_type,
3443	reason, mgmt_connected);
3444
3445	if (conn->type == ACL_LINK) {
3446	if (test_and_clear_bit(nr: HCI_CONN_FLUSH_KEY, addr: &conn->flags))
3447	hci_remove_link_key(hdev, bdaddr: &conn->dst);
3448
3449	hci_update_scan(hdev);
3450	}
3451
3452	params = hci_conn_params_lookup(hdev, addr: &conn->dst, addr_type: conn->dst_type);
3453	if (params) {
3454	switch (params->auto_connect) {
3455	case HCI_AUTO_CONN_LINK_LOSS:
3456	if (ev->reason != HCI_ERROR_CONNECTION_TIMEOUT)
3457	break;
3458	fallthrough;
3459
3460	case HCI_AUTO_CONN_DIRECT:
3461	case HCI_AUTO_CONN_ALWAYS:
3462	hci_pend_le_list_del_init(param: params);
3463	hci_pend_le_list_add(param: params, list: &hdev->pend_le_conns);
3464	hci_update_passive_scan(hdev);
3465	break;
3466
3467	default:
3468	break;
3469	}
3470	}
3471
3472	hci_disconn_cfm(conn, reason: ev->reason);
3473
3474	/* Re-enable advertising if necessary, since it might
3475	* have been disabled by the connection. From the
3476	* HCI_LE_Set_Advertise_Enable command description in
3477	* the core specification (v4.0):
3478	* "The Controller shall continue advertising until the Host
3479	* issues an LE_Set_Advertise_Enable command with
3480	* Advertising_Enable set to 0x00 (Advertising is disabled)
3481	* or until a connection is created or until the Advertising
3482	* is timed out due to Directed Advertising."
3483	*/
3484	if (conn->type == LE_LINK && conn->role == HCI_ROLE_SLAVE) {
3485	hdev->cur_adv_instance = conn->adv_instance;
3486	hci_enable_advertising(hdev);
3487	}
3488
3489	hci_conn_del(conn);
3490
3491	unlock:
3492	hci_dev_unlock(hdev);
3493	}
3494
3495	static void hci_auth_complete_evt(struct hci_dev *hdev, void *data,
3496	struct sk_buff *skb)
3497	{
3498	struct hci_ev_auth_complete *ev = data;
3499	struct hci_conn *conn;
3500
3501	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
3502
3503	hci_dev_lock(hdev);
3504
3505	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3506	if (!conn)
3507	goto unlock;
3508
3509	if (!ev->status) {
3510	clear_bit(nr: HCI_CONN_AUTH_FAILURE, addr: &conn->flags);
3511	set_bit(nr: HCI_CONN_AUTH, addr: &conn->flags);
3512	conn->sec_level = conn->pending_sec_level;
3513	} else {
3514	if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
3515	set_bit(nr: HCI_CONN_AUTH_FAILURE, addr: &conn->flags);
3516
3517	mgmt_auth_failed(conn, status: ev->status);
3518	}
3519
3520	clear_bit(nr: HCI_CONN_AUTH_PEND, addr: &conn->flags);
3521
3522	if (conn->state == BT_CONFIG) {
3523	if (!ev->status && hci_conn_ssp_enabled(conn)) {
3524	struct hci_cp_set_conn_encrypt cp;
3525	cp.handle = ev->handle;
3526	cp.encrypt = 0x01;
3527	hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, plen: sizeof(cp),
3528	param: &cp);
3529	} else {
3530	conn->state = BT_CONNECTED;
3531	hci_connect_cfm(conn, status: ev->status);
3532	hci_conn_drop(conn);
3533	}
3534	} else {
3535	hci_auth_cfm(conn, status: ev->status);
3536
3537	hci_conn_hold(conn);
3538	conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3539	hci_conn_drop(conn);
3540	}
3541
3542	if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
3543	if (!ev->status) {
3544	struct hci_cp_set_conn_encrypt cp;
3545	cp.handle = ev->handle;
3546	cp.encrypt = 0x01;
3547	hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, plen: sizeof(cp),
3548	param: &cp);
3549	} else {
3550	clear_bit(nr: HCI_CONN_ENCRYPT_PEND, addr: &conn->flags);
3551	hci_encrypt_cfm(conn, status: ev->status);
3552	}
3553	}
3554
3555	unlock:
3556	hci_dev_unlock(hdev);
3557	}
3558
3559	static void hci_remote_name_evt(struct hci_dev *hdev, void *data,
3560	struct sk_buff *skb)
3561	{
3562	struct hci_ev_remote_name *ev = data;
3563	struct hci_conn *conn;
3564
3565	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
3566
3567	hci_dev_lock(hdev);
3568
3569	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, ba: &ev->bdaddr);
3570
3571	if (!hci_dev_test_flag(hdev, HCI_MGMT))
3572	goto check_auth;
3573
3574	if (ev->status == 0)
3575	hci_check_pending_name(hdev, conn, bdaddr: &ev->bdaddr, name: ev->name,
3576	name_len: strnlen(p: ev->name, HCI_MAX_NAME_LENGTH));
3577	else
3578	hci_check_pending_name(hdev, conn, bdaddr: &ev->bdaddr, NULL, name_len: 0);
3579
3580	check_auth:
3581	if (!conn)
3582	goto unlock;
3583
3584	if (!hci_outgoing_auth_needed(hdev, conn))
3585	goto unlock;
3586
3587	if (!test_and_set_bit(nr: HCI_CONN_AUTH_PEND, addr: &conn->flags)) {
3588	struct hci_cp_auth_requested cp;
3589
3590	set_bit(nr: HCI_CONN_AUTH_INITIATOR, addr: &conn->flags);
3591
3592	cp.handle = __cpu_to_le16(conn->handle);
3593	hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, plen: sizeof(cp), param: &cp);
3594	}
3595
3596	unlock:
3597	hci_dev_unlock(hdev);
3598	}
3599
3600	static void hci_encrypt_change_evt(struct hci_dev *hdev, void *data,
3601	struct sk_buff *skb)
3602	{
3603	struct hci_ev_encrypt_change *ev = data;
3604	struct hci_conn *conn;
3605
3606	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
3607
3608	hci_dev_lock(hdev);
3609
3610	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3611	if (!conn)
3612	goto unlock;
3613
3614	if (!ev->status) {
3615	if (ev->encrypt) {
3616	/* Encryption implies authentication */
3617	set_bit(nr: HCI_CONN_AUTH, addr: &conn->flags);
3618	set_bit(nr: HCI_CONN_ENCRYPT, addr: &conn->flags);
3619	conn->sec_level = conn->pending_sec_level;
3620
3621	/* P-256 authentication key implies FIPS */
3622	if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256)
3623	set_bit(nr: HCI_CONN_FIPS, addr: &conn->flags);
3624
3625	if ((conn->type == ACL_LINK && ev->encrypt == 0x02) ||
3626	conn->type == LE_LINK)
3627	set_bit(nr: HCI_CONN_AES_CCM, addr: &conn->flags);
3628	} else {
3629	clear_bit(nr: HCI_CONN_ENCRYPT, addr: &conn->flags);
3630	clear_bit(nr: HCI_CONN_AES_CCM, addr: &conn->flags);
3631	}
3632	}
3633
3634	/* We should disregard the current RPA and generate a new one
3635	* whenever the encryption procedure fails.
3636	*/
3637	if (ev->status && conn->type == LE_LINK) {
3638	hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
3639	hci_adv_instances_set_rpa_expired(hdev, rpa_expired: true);
3640	}
3641
3642	clear_bit(nr: HCI_CONN_ENCRYPT_PEND, addr: &conn->flags);
3643
3644	/* Check link security requirements are met */
3645	if (!hci_conn_check_link_mode(conn))
3646	ev->status = HCI_ERROR_AUTH_FAILURE;
3647
3648	if (ev->status && conn->state == BT_CONNECTED) {
3649	if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
3650	set_bit(nr: HCI_CONN_AUTH_FAILURE, addr: &conn->flags);
3651
3652	/* Notify upper layers so they can cleanup before
3653	* disconnecting.
3654	*/
3655	hci_encrypt_cfm(conn, status: ev->status);
3656	hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
3657	hci_conn_drop(conn);
3658	goto unlock;
3659	}
3660
3661	/* Try reading the encryption key size for encrypted ACL links */
3662	if (!ev->status && ev->encrypt && conn->type == ACL_LINK) {
3663	struct hci_cp_read_enc_key_size cp;
3664
3665	/* Only send HCI_Read_Encryption_Key_Size if the
3666	* controller really supports it. If it doesn't, assume
3667	* the default size (16).
3668	*/
3669	if (!(hdev->commands[20] & 0x10) ||
3670	test_bit(HCI_QUIRK_BROKEN_READ_ENC_KEY_SIZE, &hdev->quirks)) {
3671	conn->enc_key_size = HCI_LINK_KEY_SIZE;
3672	goto notify;
3673	}
3674
3675	cp.handle = cpu_to_le16(conn->handle);
3676	if (hci_send_cmd(hdev, HCI_OP_READ_ENC_KEY_SIZE,
3677	plen: sizeof(cp), param: &cp)) {
3678	bt_dev_err(hdev, "sending read key size failed");
3679	conn->enc_key_size = HCI_LINK_KEY_SIZE;
3680	goto notify;
3681	}
3682
3683	goto unlock;
3684	}
3685
3686	/* Set the default Authenticated Payload Timeout after
3687	* an LE Link is established. As per Core Spec v5.0, Vol 2, Part B
3688	* Section 3.3, the HCI command WRITE_AUTH_PAYLOAD_TIMEOUT should be
3689	* sent when the link is active and Encryption is enabled, the conn
3690	* type can be either LE or ACL and controller must support LMP Ping.
3691	* Ensure for AES-CCM encryption as well.
3692	*/
3693	if (test_bit(HCI_CONN_ENCRYPT, &conn->flags) &&
3694	test_bit(HCI_CONN_AES_CCM, &conn->flags) &&
3695	((conn->type == ACL_LINK && lmp_ping_capable(hdev)) ||
3696	(conn->type == LE_LINK && (hdev->le_features[0] & HCI_LE_PING)))) {
3697	struct hci_cp_write_auth_payload_to cp;
3698
3699	cp.handle = cpu_to_le16(conn->handle);
3700	cp.timeout = cpu_to_le16(hdev->auth_payload_timeout);
3701	if (hci_send_cmd(hdev: conn->hdev, HCI_OP_WRITE_AUTH_PAYLOAD_TO,
3702	plen: sizeof(cp), param: &cp))
3703	bt_dev_err(hdev, "write auth payload timeout failed");
3704	}
3705
3706	notify:
3707	hci_encrypt_cfm(conn, status: ev->status);
3708
3709	unlock:
3710	hci_dev_unlock(hdev);
3711	}
3712
3713	static void hci_change_link_key_complete_evt(struct hci_dev *hdev, void *data,
3714	struct sk_buff *skb)
3715	{
3716	struct hci_ev_change_link_key_complete *ev = data;
3717	struct hci_conn *conn;
3718
3719	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
3720
3721	hci_dev_lock(hdev);
3722
3723	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3724	if (conn) {
3725	if (!ev->status)
3726	set_bit(nr: HCI_CONN_SECURE, addr: &conn->flags);
3727
3728	clear_bit(nr: HCI_CONN_AUTH_PEND, addr: &conn->flags);
3729
3730	hci_key_change_cfm(conn, status: ev->status);
3731	}
3732
3733	hci_dev_unlock(hdev);
3734	}
3735
3736	static void hci_remote_features_evt(struct hci_dev *hdev, void *data,
3737	struct sk_buff *skb)
3738	{
3739	struct hci_ev_remote_features *ev = data;
3740	struct hci_conn *conn;
3741
3742	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
3743
3744	hci_dev_lock(hdev);
3745
3746	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3747	if (!conn)
3748	goto unlock;
3749
3750	if (!ev->status)
3751	memcpy(conn->features[0], ev->features, 8);
3752
3753	if (conn->state != BT_CONFIG)
3754	goto unlock;
3755
3756	if (!ev->status && lmp_ext_feat_capable(hdev) &&
3757	lmp_ext_feat_capable(conn)) {
3758	struct hci_cp_read_remote_ext_features cp;
3759	cp.handle = ev->handle;
3760	cp.page = 0x01;
3761	hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
3762	plen: sizeof(cp), param: &cp);
3763	goto unlock;
3764	}
3765
3766	if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
3767	struct hci_cp_remote_name_req cp;
3768	memset(&cp, 0, sizeof(cp));
3769	bacpy(dst: &cp.bdaddr, src: &conn->dst);
3770	cp.pscan_rep_mode = 0x02;
3771	hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, plen: sizeof(cp), param: &cp);
3772	} else {
3773	mgmt_device_connected(hdev, conn, NULL, name_len: 0);
3774	}
3775
3776	if (!hci_outgoing_auth_needed(hdev, conn)) {
3777	conn->state = BT_CONNECTED;
3778	hci_connect_cfm(conn, status: ev->status);
3779	hci_conn_drop(conn);
3780	}
3781
3782	unlock:
3783	hci_dev_unlock(hdev);
3784	}
3785
3786	static inline void handle_cmd_cnt_and_timer(struct hci_dev *hdev, u8 ncmd)
3787	{
3788	cancel_delayed_work(dwork: &hdev->cmd_timer);
3789
3790	rcu_read_lock();
3791	if (!test_bit(HCI_RESET, &hdev->flags)) {
3792	if (ncmd) {
3793	cancel_delayed_work(dwork: &hdev->ncmd_timer);
3794	atomic_set(v: &hdev->cmd_cnt, i: 1);
3795	} else {
3796	if (!hci_dev_test_flag(hdev, HCI_CMD_DRAIN_WORKQUEUE))
3797	queue_delayed_work(wq: hdev->workqueue, dwork: &hdev->ncmd_timer,
3798	HCI_NCMD_TIMEOUT);
3799	}
3800	}
3801	rcu_read_unlock();
3802	}
3803
3804	static u8 hci_cc_le_read_buffer_size_v2(struct hci_dev *hdev, void *data,
3805	struct sk_buff *skb)
3806	{
3807	struct hci_rp_le_read_buffer_size_v2 *rp = data;
3808
3809	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
3810
3811	if (rp->status)
3812	return rp->status;
3813
3814	hdev->le_mtu = __le16_to_cpu(rp->acl_mtu);
3815	hdev->le_pkts = rp->acl_max_pkt;
3816	hdev->iso_mtu = __le16_to_cpu(rp->iso_mtu);
3817	hdev->iso_pkts = rp->iso_max_pkt;
3818
3819	hdev->le_cnt = hdev->le_pkts;
3820	hdev->iso_cnt = hdev->iso_pkts;
3821
3822	BT_DBG("%s acl mtu %d:%d iso mtu %d:%d", hdev->name, hdev->acl_mtu,
3823	hdev->acl_pkts, hdev->iso_mtu, hdev->iso_pkts);
3824
3825	return rp->status;
3826	}
3827
3828	static void hci_unbound_cis_failed(struct hci_dev *hdev, u8 cig, u8 status)
3829	{
3830	struct hci_conn *conn, *tmp;
3831
3832	lockdep_assert_held(&hdev->lock);
3833
3834	list_for_each_entry_safe(conn, tmp, &hdev->conn_hash.list, list) {
3835	if (conn->type != ISO_LINK || !bacmp(ba1: &conn->dst, BDADDR_ANY) ||
3836	conn->state == BT_OPEN || conn->iso_qos.ucast.cig != cig)
3837	continue;
3838
3839	if (HCI_CONN_HANDLE_UNSET(conn->handle))
3840	hci_conn_failed(conn, status);
3841	}
3842	}
3843
3844	static u8 hci_cc_le_set_cig_params(struct hci_dev *hdev, void *data,
3845	struct sk_buff *skb)
3846	{
3847	struct hci_rp_le_set_cig_params *rp = data;
3848	struct hci_cp_le_set_cig_params *cp;
3849	struct hci_conn *conn;
3850	u8 status = rp->status;
3851	bool pending = false;
3852	int i;
3853
3854	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
3855
3856	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_CIG_PARAMS);
3857	if (!rp->status && (!cp || rp->num_handles != cp->num_cis ||
3858	rp->cig_id != cp->cig_id)) {
3859	bt_dev_err(hdev, "unexpected Set CIG Parameters response data");
3860	status = HCI_ERROR_UNSPECIFIED;
3861	}
3862
3863	hci_dev_lock(hdev);
3864
3865	/* BLUETOOTH CORE SPECIFICATION Version 5.4 | Vol 4, Part E page 2554
3866	*
3867	* If the Status return parameter is non-zero, then the state of the CIG
3868	* and its CIS configurations shall not be changed by the command. If
3869	* the CIG did not already exist, it shall not be created.
3870	*/
3871	if (status) {
3872	/* Keep current configuration, fail only the unbound CIS */
3873	hci_unbound_cis_failed(hdev, cig: rp->cig_id, status);
3874	goto unlock;
3875	}
3876
3877	/* BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 4, Part E page 2553
3878	*
3879	* If the Status return parameter is zero, then the Controller shall
3880	* set the Connection_Handle arrayed return parameter to the connection
3881	* handle(s) corresponding to the CIS configurations specified in
3882	* the CIS_IDs command parameter, in the same order.
3883	*/
3884	for (i = 0; i < rp->num_handles; ++i) {
3885	conn = hci_conn_hash_lookup_cis(hdev, NULL, ba_type: 0, cig: rp->cig_id,
3886	id: cp->cis[i].cis_id);
3887	if (!conn || !bacmp(ba1: &conn->dst, BDADDR_ANY))
3888	continue;
3889
3890	if (conn->state != BT_BOUND && conn->state != BT_CONNECT)
3891	continue;
3892
3893	if (hci_conn_set_handle(conn, __le16_to_cpu(rp->handle[i])))
3894	continue;
3895
3896	if (conn->state == BT_CONNECT)
3897	pending = true;
3898	}
3899
3900	unlock:
3901	if (pending)
3902	hci_le_create_cis_pending(hdev);
3903
3904	hci_dev_unlock(hdev);
3905
3906	return rp->status;
3907	}
3908
3909	static u8 hci_cc_le_setup_iso_path(struct hci_dev *hdev, void *data,
3910	struct sk_buff *skb)
3911	{
3912	struct hci_rp_le_setup_iso_path *rp = data;
3913	struct hci_cp_le_setup_iso_path *cp;
3914	struct hci_conn *conn;
3915
3916	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
3917
3918	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SETUP_ISO_PATH);
3919	if (!cp)
3920	return rp->status;
3921
3922	hci_dev_lock(hdev);
3923
3924	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
3925	if (!conn)
3926	goto unlock;
3927
3928	if (rp->status) {
3929	hci_connect_cfm(conn, status: rp->status);
3930	hci_conn_del(conn);
3931	goto unlock;
3932	}
3933
3934	switch (cp->direction) {
3935	/* Input (Host to Controller) */
3936	case 0x00:
3937	/* Only confirm connection if output only */
3938	if (conn->iso_qos.ucast.out.sdu && !conn->iso_qos.ucast.in.sdu)
3939	hci_connect_cfm(conn, status: rp->status);
3940	break;
3941	/* Output (Controller to Host) */
3942	case 0x01:
3943	/* Confirm connection since conn->iso_qos is always configured
3944	* last.
3945	*/
3946	hci_connect_cfm(conn, status: rp->status);
3947
3948	/* Notify device connected in case it is a BIG Sync */
3949	if (!rp->status && test_bit(HCI_CONN_BIG_SYNC, &conn->flags))
3950	mgmt_device_connected(hdev, conn, NULL, name_len: 0);
3951
3952	break;
3953	}
3954
3955	unlock:
3956	hci_dev_unlock(hdev);
3957	return rp->status;
3958	}
3959
3960	static void hci_cs_le_create_big(struct hci_dev *hdev, u8 status)
3961	{
3962	bt_dev_dbg(hdev, "status 0x%2.2x", status);
3963	}
3964
3965	static u8 hci_cc_set_per_adv_param(struct hci_dev *hdev, void *data,
3966	struct sk_buff *skb)
3967	{
3968	struct hci_ev_status *rp = data;
3969	struct hci_cp_le_set_per_adv_params *cp;
3970
3971	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
3972
3973	if (rp->status)
3974	return rp->status;
3975
3976	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_PER_ADV_PARAMS);
3977	if (!cp)
3978	return rp->status;
3979
3980	/* TODO: set the conn state */
3981	return rp->status;
3982	}
3983
3984	static u8 hci_cc_le_set_per_adv_enable(struct hci_dev *hdev, void *data,
3985	struct sk_buff *skb)
3986	{
3987	struct hci_ev_status *rp = data;
3988	struct hci_cp_le_set_per_adv_enable *cp;
3989	struct adv_info *adv = NULL, *n;
3990	u8 per_adv_cnt = 0;
3991
3992	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
3993
3994	if (rp->status)
3995	return rp->status;
3996
3997	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_PER_ADV_ENABLE);
3998	if (!cp)
3999	return rp->status;
4000
4001	hci_dev_lock(hdev);
4002
4003	adv = hci_find_adv_instance(hdev, instance: cp->handle);
4004
4005	if (cp->enable) {
4006	hci_dev_set_flag(hdev, HCI_LE_PER_ADV);
4007
4008	if (adv)
4009	adv->enabled = true;
4010	} else {
4011	/* If just one instance was disabled check if there are
4012	* any other instance enabled before clearing HCI_LE_PER_ADV.
4013	* The current periodic adv instance will be marked as
4014	* disabled once extended advertising is also disabled.
4015	*/
4016	list_for_each_entry_safe(adv, n, &hdev->adv_instances,
4017	list) {
4018	if (adv->periodic && adv->enabled)
4019	per_adv_cnt++;
4020	}
4021
4022	if (per_adv_cnt > 1)
4023	goto unlock;
4024
4025	hci_dev_clear_flag(hdev, HCI_LE_PER_ADV);
4026	}
4027
4028	unlock:
4029	hci_dev_unlock(hdev);
4030
4031	return rp->status;
4032	}
4033
4034	#define HCI_CC_VL(_op, _func, _min, _max) \
4035	{ \
4036	.op = _op, \
4037	.func = _func, \
4038	.min_len = _min, \
4039	.max_len = _max, \
4040	}
4041
4042	#define HCI_CC(_op, _func, _len) \
4043	HCI_CC_VL(_op, _func, _len, _len)
4044
4045	#define HCI_CC_STATUS(_op, _func) \
4046	HCI_CC(_op, _func, sizeof(struct hci_ev_status))
4047
4048	static const struct hci_cc {
4049	u16 op;
4050	u8 (*func)(struct hci_dev *hdev, void *data, struct sk_buff *skb);
4051	u16 min_len;
4052	u16 max_len;
4053	} hci_cc_table[] = {
4054	HCI_CC_STATUS(HCI_OP_INQUIRY_CANCEL, hci_cc_inquiry_cancel),
4055	HCI_CC_STATUS(HCI_OP_PERIODIC_INQ, hci_cc_periodic_inq),
4056	HCI_CC_STATUS(HCI_OP_EXIT_PERIODIC_INQ, hci_cc_exit_periodic_inq),
4057	HCI_CC_STATUS(HCI_OP_REMOTE_NAME_REQ_CANCEL,
4058	hci_cc_remote_name_req_cancel),
4059	HCI_CC(HCI_OP_ROLE_DISCOVERY, hci_cc_role_discovery,
4060	sizeof(struct hci_rp_role_discovery)),
4061	HCI_CC(HCI_OP_READ_LINK_POLICY, hci_cc_read_link_policy,
4062	sizeof(struct hci_rp_read_link_policy)),
4063	HCI_CC(HCI_OP_WRITE_LINK_POLICY, hci_cc_write_link_policy,
4064	sizeof(struct hci_rp_write_link_policy)),
4065	HCI_CC(HCI_OP_READ_DEF_LINK_POLICY, hci_cc_read_def_link_policy,
4066	sizeof(struct hci_rp_read_def_link_policy)),
4067	HCI_CC_STATUS(HCI_OP_WRITE_DEF_LINK_POLICY,
4068	hci_cc_write_def_link_policy),
4069	HCI_CC_STATUS(HCI_OP_RESET, hci_cc_reset),
4070	HCI_CC(HCI_OP_READ_STORED_LINK_KEY, hci_cc_read_stored_link_key,
4071	sizeof(struct hci_rp_read_stored_link_key)),
4072	HCI_CC(HCI_OP_DELETE_STORED_LINK_KEY, hci_cc_delete_stored_link_key,
4073	sizeof(struct hci_rp_delete_stored_link_key)),
4074	HCI_CC_STATUS(HCI_OP_WRITE_LOCAL_NAME, hci_cc_write_local_name),
4075	HCI_CC(HCI_OP_READ_LOCAL_NAME, hci_cc_read_local_name,
4076	sizeof(struct hci_rp_read_local_name)),
4077	HCI_CC_STATUS(HCI_OP_WRITE_AUTH_ENABLE, hci_cc_write_auth_enable),
4078	HCI_CC_STATUS(HCI_OP_WRITE_ENCRYPT_MODE, hci_cc_write_encrypt_mode),
4079	HCI_CC_STATUS(HCI_OP_WRITE_SCAN_ENABLE, hci_cc_write_scan_enable),
4080	HCI_CC_STATUS(HCI_OP_SET_EVENT_FLT, hci_cc_set_event_filter),
4081	HCI_CC(HCI_OP_READ_CLASS_OF_DEV, hci_cc_read_class_of_dev,
4082	sizeof(struct hci_rp_read_class_of_dev)),
4083	HCI_CC_STATUS(HCI_OP_WRITE_CLASS_OF_DEV, hci_cc_write_class_of_dev),
4084	HCI_CC(HCI_OP_READ_VOICE_SETTING, hci_cc_read_voice_setting,
4085	sizeof(struct hci_rp_read_voice_setting)),
4086	HCI_CC_STATUS(HCI_OP_WRITE_VOICE_SETTING, hci_cc_write_voice_setting),
4087	HCI_CC(HCI_OP_READ_NUM_SUPPORTED_IAC, hci_cc_read_num_supported_iac,
4088	sizeof(struct hci_rp_read_num_supported_iac)),
4089	HCI_CC_STATUS(HCI_OP_WRITE_SSP_MODE, hci_cc_write_ssp_mode),
4090	HCI_CC_STATUS(HCI_OP_WRITE_SC_SUPPORT, hci_cc_write_sc_support),
4091	HCI_CC(HCI_OP_READ_AUTH_PAYLOAD_TO, hci_cc_read_auth_payload_timeout,
4092	sizeof(struct hci_rp_read_auth_payload_to)),
4093	HCI_CC(HCI_OP_WRITE_AUTH_PAYLOAD_TO, hci_cc_write_auth_payload_timeout,
4094	sizeof(struct hci_rp_write_auth_payload_to)),
4095	HCI_CC(HCI_OP_READ_LOCAL_VERSION, hci_cc_read_local_version,
4096	sizeof(struct hci_rp_read_local_version)),
4097	HCI_CC(HCI_OP_READ_LOCAL_COMMANDS, hci_cc_read_local_commands,
4098	sizeof(struct hci_rp_read_local_commands)),
4099	HCI_CC(HCI_OP_READ_LOCAL_FEATURES, hci_cc_read_local_features,
4100	sizeof(struct hci_rp_read_local_features)),
4101	HCI_CC(HCI_OP_READ_LOCAL_EXT_FEATURES, hci_cc_read_local_ext_features,
4102	sizeof(struct hci_rp_read_local_ext_features)),
4103	HCI_CC(HCI_OP_READ_BUFFER_SIZE, hci_cc_read_buffer_size,
4104	sizeof(struct hci_rp_read_buffer_size)),
4105	HCI_CC(HCI_OP_READ_BD_ADDR, hci_cc_read_bd_addr,
4106	sizeof(struct hci_rp_read_bd_addr)),
4107	HCI_CC(HCI_OP_READ_LOCAL_PAIRING_OPTS, hci_cc_read_local_pairing_opts,
4108	sizeof(struct hci_rp_read_local_pairing_opts)),
4109	HCI_CC(HCI_OP_READ_PAGE_SCAN_ACTIVITY, hci_cc_read_page_scan_activity,
4110	sizeof(struct hci_rp_read_page_scan_activity)),
4111	HCI_CC_STATUS(HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
4112	hci_cc_write_page_scan_activity),
4113	HCI_CC(HCI_OP_READ_PAGE_SCAN_TYPE, hci_cc_read_page_scan_type,
4114	sizeof(struct hci_rp_read_page_scan_type)),
4115	HCI_CC_STATUS(HCI_OP_WRITE_PAGE_SCAN_TYPE, hci_cc_write_page_scan_type),
4116	HCI_CC(HCI_OP_READ_DATA_BLOCK_SIZE, hci_cc_read_data_block_size,
4117	sizeof(struct hci_rp_read_data_block_size)),
4118	HCI_CC(HCI_OP_READ_FLOW_CONTROL_MODE, hci_cc_read_flow_control_mode,
4119	sizeof(struct hci_rp_read_flow_control_mode)),
4120	HCI_CC(HCI_OP_READ_LOCAL_AMP_INFO, hci_cc_read_local_amp_info,
4121	sizeof(struct hci_rp_read_local_amp_info)),
4122	HCI_CC(HCI_OP_READ_CLOCK, hci_cc_read_clock,
4123	sizeof(struct hci_rp_read_clock)),
4124	HCI_CC(HCI_OP_READ_ENC_KEY_SIZE, hci_cc_read_enc_key_size,
4125	sizeof(struct hci_rp_read_enc_key_size)),
4126	HCI_CC(HCI_OP_READ_INQ_RSP_TX_POWER, hci_cc_read_inq_rsp_tx_power,
4127	sizeof(struct hci_rp_read_inq_rsp_tx_power)),
4128	HCI_CC(HCI_OP_READ_DEF_ERR_DATA_REPORTING,
4129	hci_cc_read_def_err_data_reporting,
4130	sizeof(struct hci_rp_read_def_err_data_reporting)),
4131	HCI_CC_STATUS(HCI_OP_WRITE_DEF_ERR_DATA_REPORTING,
4132	hci_cc_write_def_err_data_reporting),
4133	HCI_CC(HCI_OP_PIN_CODE_REPLY, hci_cc_pin_code_reply,
4134	sizeof(struct hci_rp_pin_code_reply)),
4135	HCI_CC(HCI_OP_PIN_CODE_NEG_REPLY, hci_cc_pin_code_neg_reply,
4136	sizeof(struct hci_rp_pin_code_neg_reply)),
4137	HCI_CC(HCI_OP_READ_LOCAL_OOB_DATA, hci_cc_read_local_oob_data,
4138	sizeof(struct hci_rp_read_local_oob_data)),
4139	HCI_CC(HCI_OP_READ_LOCAL_OOB_EXT_DATA, hci_cc_read_local_oob_ext_data,
4140	sizeof(struct hci_rp_read_local_oob_ext_data)),
4141	HCI_CC(HCI_OP_LE_READ_BUFFER_SIZE, hci_cc_le_read_buffer_size,
4142	sizeof(struct hci_rp_le_read_buffer_size)),
4143	HCI_CC(HCI_OP_LE_READ_LOCAL_FEATURES, hci_cc_le_read_local_features,
4144	sizeof(struct hci_rp_le_read_local_features)),
4145	HCI_CC(HCI_OP_LE_READ_ADV_TX_POWER, hci_cc_le_read_adv_tx_power,
4146	sizeof(struct hci_rp_le_read_adv_tx_power)),
4147	HCI_CC(HCI_OP_USER_CONFIRM_REPLY, hci_cc_user_confirm_reply,
4148	sizeof(struct hci_rp_user_confirm_reply)),
4149	HCI_CC(HCI_OP_USER_CONFIRM_NEG_REPLY, hci_cc_user_confirm_neg_reply,
4150	sizeof(struct hci_rp_user_confirm_reply)),
4151	HCI_CC(HCI_OP_USER_PASSKEY_REPLY, hci_cc_user_passkey_reply,
4152	sizeof(struct hci_rp_user_confirm_reply)),
4153	HCI_CC(HCI_OP_USER_PASSKEY_NEG_REPLY, hci_cc_user_passkey_neg_reply,
4154	sizeof(struct hci_rp_user_confirm_reply)),
4155	HCI_CC_STATUS(HCI_OP_LE_SET_RANDOM_ADDR, hci_cc_le_set_random_addr),
4156	HCI_CC_STATUS(HCI_OP_LE_SET_ADV_ENABLE, hci_cc_le_set_adv_enable),
4157	HCI_CC_STATUS(HCI_OP_LE_SET_SCAN_PARAM, hci_cc_le_set_scan_param),
4158	HCI_CC_STATUS(HCI_OP_LE_SET_SCAN_ENABLE, hci_cc_le_set_scan_enable),
4159	HCI_CC(HCI_OP_LE_READ_ACCEPT_LIST_SIZE,
4160	hci_cc_le_read_accept_list_size,
4161	sizeof(struct hci_rp_le_read_accept_list_size)),
4162	HCI_CC_STATUS(HCI_OP_LE_CLEAR_ACCEPT_LIST, hci_cc_le_clear_accept_list),
4163	HCI_CC_STATUS(HCI_OP_LE_ADD_TO_ACCEPT_LIST,
4164	hci_cc_le_add_to_accept_list),
4165	HCI_CC_STATUS(HCI_OP_LE_DEL_FROM_ACCEPT_LIST,
4166	hci_cc_le_del_from_accept_list),
4167	HCI_CC(HCI_OP_LE_READ_SUPPORTED_STATES, hci_cc_le_read_supported_states,
4168	sizeof(struct hci_rp_le_read_supported_states)),
4169	HCI_CC(HCI_OP_LE_READ_DEF_DATA_LEN, hci_cc_le_read_def_data_len,
4170	sizeof(struct hci_rp_le_read_def_data_len)),
4171	HCI_CC_STATUS(HCI_OP_LE_WRITE_DEF_DATA_LEN,
4172	hci_cc_le_write_def_data_len),
4173	HCI_CC_STATUS(HCI_OP_LE_ADD_TO_RESOLV_LIST,
4174	hci_cc_le_add_to_resolv_list),
4175	HCI_CC_STATUS(HCI_OP_LE_DEL_FROM_RESOLV_LIST,
4176	hci_cc_le_del_from_resolv_list),
4177	HCI_CC_STATUS(HCI_OP_LE_CLEAR_RESOLV_LIST,
4178	hci_cc_le_clear_resolv_list),
4179	HCI_CC(HCI_OP_LE_READ_RESOLV_LIST_SIZE, hci_cc_le_read_resolv_list_size,
4180	sizeof(struct hci_rp_le_read_resolv_list_size)),
4181	HCI_CC_STATUS(HCI_OP_LE_SET_ADDR_RESOLV_ENABLE,
4182	hci_cc_le_set_addr_resolution_enable),
4183	HCI_CC(HCI_OP_LE_READ_MAX_DATA_LEN, hci_cc_le_read_max_data_len,
4184	sizeof(struct hci_rp_le_read_max_data_len)),
4185	HCI_CC_STATUS(HCI_OP_WRITE_LE_HOST_SUPPORTED,
4186	hci_cc_write_le_host_supported),
4187	HCI_CC_STATUS(HCI_OP_LE_SET_ADV_PARAM, hci_cc_set_adv_param),
4188	HCI_CC(HCI_OP_READ_RSSI, hci_cc_read_rssi,
4189	sizeof(struct hci_rp_read_rssi)),
4190	HCI_CC(HCI_OP_READ_TX_POWER, hci_cc_read_tx_power,
4191	sizeof(struct hci_rp_read_tx_power)),
4192	HCI_CC_STATUS(HCI_OP_WRITE_SSP_DEBUG_MODE, hci_cc_write_ssp_debug_mode),
4193	HCI_CC_STATUS(HCI_OP_LE_SET_EXT_SCAN_PARAMS,
4194	hci_cc_le_set_ext_scan_param),
4195	HCI_CC_STATUS(HCI_OP_LE_SET_EXT_SCAN_ENABLE,
4196	hci_cc_le_set_ext_scan_enable),
4197	HCI_CC_STATUS(HCI_OP_LE_SET_DEFAULT_PHY, hci_cc_le_set_default_phy),
4198	HCI_CC(HCI_OP_LE_READ_NUM_SUPPORTED_ADV_SETS,
4199	hci_cc_le_read_num_adv_sets,
4200	sizeof(struct hci_rp_le_read_num_supported_adv_sets)),
4201	HCI_CC(HCI_OP_LE_SET_EXT_ADV_PARAMS, hci_cc_set_ext_adv_param,
4202	sizeof(struct hci_rp_le_set_ext_adv_params)),
4203	HCI_CC_STATUS(HCI_OP_LE_SET_EXT_ADV_ENABLE,
4204	hci_cc_le_set_ext_adv_enable),
4205	HCI_CC_STATUS(HCI_OP_LE_SET_ADV_SET_RAND_ADDR,
4206	hci_cc_le_set_adv_set_random_addr),
4207	HCI_CC_STATUS(HCI_OP_LE_REMOVE_ADV_SET, hci_cc_le_remove_adv_set),
4208	HCI_CC_STATUS(HCI_OP_LE_CLEAR_ADV_SETS, hci_cc_le_clear_adv_sets),
4209	HCI_CC_STATUS(HCI_OP_LE_SET_PER_ADV_PARAMS, hci_cc_set_per_adv_param),
4210	HCI_CC_STATUS(HCI_OP_LE_SET_PER_ADV_ENABLE,
4211	hci_cc_le_set_per_adv_enable),
4212	HCI_CC(HCI_OP_LE_READ_TRANSMIT_POWER, hci_cc_le_read_transmit_power,
4213	sizeof(struct hci_rp_le_read_transmit_power)),
4214	HCI_CC_STATUS(HCI_OP_LE_SET_PRIVACY_MODE, hci_cc_le_set_privacy_mode),
4215	HCI_CC(HCI_OP_LE_READ_BUFFER_SIZE_V2, hci_cc_le_read_buffer_size_v2,
4216	sizeof(struct hci_rp_le_read_buffer_size_v2)),
4217	HCI_CC_VL(HCI_OP_LE_SET_CIG_PARAMS, hci_cc_le_set_cig_params,
4218	sizeof(struct hci_rp_le_set_cig_params), HCI_MAX_EVENT_SIZE),
4219	HCI_CC(HCI_OP_LE_SETUP_ISO_PATH, hci_cc_le_setup_iso_path,
4220	sizeof(struct hci_rp_le_setup_iso_path)),
4221	};
4222
4223	static u8 hci_cc_func(struct hci_dev *hdev, const struct hci_cc *cc,
4224	struct sk_buff *skb)
4225	{
4226	void *data;
4227
4228	if (skb->len < cc->min_len) {
4229	bt_dev_err(hdev, "unexpected cc 0x%4.4x length: %u < %u",
4230	cc->op, skb->len, cc->min_len);
4231	return HCI_ERROR_UNSPECIFIED;
4232	}
4233
4234	/* Just warn if the length is over max_len size it still be possible to
4235	* partially parse the cc so leave to callback to decide if that is
4236	* acceptable.
4237	*/
4238	if (skb->len > cc->max_len)
4239	bt_dev_warn(hdev, "unexpected cc 0x%4.4x length: %u > %u",
4240	cc->op, skb->len, cc->max_len);
4241
4242	data = hci_cc_skb_pull(hdev, skb, op: cc->op, len: cc->min_len);
4243	if (!data)
4244	return HCI_ERROR_UNSPECIFIED;
4245
4246	return cc->func(hdev, data, skb);
4247	}
4248
4249	static void hci_cmd_complete_evt(struct hci_dev *hdev, void *data,
4250	struct sk_buff *skb, u16 *opcode, u8 *status,
4251	hci_req_complete_t *req_complete,
4252	hci_req_complete_skb_t *req_complete_skb)
4253	{
4254	struct hci_ev_cmd_complete *ev = data;
4255	int i;
4256
4257	*opcode = __le16_to_cpu(ev->opcode);
4258
4259	bt_dev_dbg(hdev, "opcode 0x%4.4x", *opcode);
4260
4261	for (i = 0; i < ARRAY_SIZE(hci_cc_table); i++) {
4262	if (hci_cc_table[i].op == *opcode) {
4263	*status = hci_cc_func(hdev, cc: &hci_cc_table[i], skb);
4264	break;
4265	}
4266	}
4267
4268	if (i == ARRAY_SIZE(hci_cc_table)) {
4269	/* Unknown opcode, assume byte 0 contains the status, so
4270	* that e.g. __hci_cmd_sync() properly returns errors
4271	* for vendor specific commands send by HCI drivers.
4272	* If a vendor doesn't actually follow this convention we may
4273	* need to introduce a vendor CC table in order to properly set
4274	* the status.
4275	*/
4276	*status = skb->data[0];
4277	}
4278
4279	handle_cmd_cnt_and_timer(hdev, ncmd: ev->ncmd);
4280
4281	hci_req_cmd_complete(hdev, opcode: *opcode, status: *status, req_complete,
4282	req_complete_skb);
4283
4284	if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
4285	bt_dev_err(hdev,
4286	"unexpected event for opcode 0x%4.4x", *opcode);
4287	return;
4288	}
4289
4290	if (atomic_read(v: &hdev->cmd_cnt) && !skb_queue_empty(list: &hdev->cmd_q))
4291	queue_work(wq: hdev->workqueue, work: &hdev->cmd_work);
4292	}
4293
4294	static void hci_cs_le_create_cis(struct hci_dev *hdev, u8 status)
4295	{
4296	struct hci_cp_le_create_cis *cp;
4297	bool pending = false;
4298	int i;
4299
4300	bt_dev_dbg(hdev, "status 0x%2.2x", status);
4301
4302	if (!status)
4303	return;
4304
4305	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CIS);
4306	if (!cp)
4307	return;
4308
4309	hci_dev_lock(hdev);
4310
4311	/* Remove connection if command failed */
4312	for (i = 0; cp->num_cis; cp->num_cis--, i++) {
4313	struct hci_conn *conn;
4314	u16 handle;
4315
4316	handle = __le16_to_cpu(cp->cis[i].cis_handle);
4317
4318	conn = hci_conn_hash_lookup_handle(hdev, handle);
4319	if (conn) {
4320	if (test_and_clear_bit(nr: HCI_CONN_CREATE_CIS,
4321	addr: &conn->flags))
4322	pending = true;
4323	conn->state = BT_CLOSED;
4324	hci_connect_cfm(conn, status);
4325	hci_conn_del(conn);
4326	}
4327	}
4328
4329	if (pending)
4330	hci_le_create_cis_pending(hdev);
4331
4332	hci_dev_unlock(hdev);
4333	}
4334
4335	#define HCI_CS(_op, _func) \
4336	{ \
4337	.op = _op, \
4338	.func = _func, \
4339	}
4340
4341	static const struct hci_cs {
4342	u16 op;
4343	void (*func)(struct hci_dev *hdev, __u8 status);
4344	} hci_cs_table[] = {
4345	HCI_CS(HCI_OP_INQUIRY, hci_cs_inquiry),
4346	HCI_CS(HCI_OP_CREATE_CONN, hci_cs_create_conn),
4347	HCI_CS(HCI_OP_DISCONNECT, hci_cs_disconnect),
4348	HCI_CS(HCI_OP_ADD_SCO, hci_cs_add_sco),
4349	HCI_CS(HCI_OP_AUTH_REQUESTED, hci_cs_auth_requested),
4350	HCI_CS(HCI_OP_SET_CONN_ENCRYPT, hci_cs_set_conn_encrypt),
4351	HCI_CS(HCI_OP_REMOTE_NAME_REQ, hci_cs_remote_name_req),
4352	HCI_CS(HCI_OP_READ_REMOTE_FEATURES, hci_cs_read_remote_features),
4353	HCI_CS(HCI_OP_READ_REMOTE_EXT_FEATURES,
4354	hci_cs_read_remote_ext_features),
4355	HCI_CS(HCI_OP_SETUP_SYNC_CONN, hci_cs_setup_sync_conn),
4356	HCI_CS(HCI_OP_ENHANCED_SETUP_SYNC_CONN,
4357	hci_cs_enhanced_setup_sync_conn),
4358	HCI_CS(HCI_OP_SNIFF_MODE, hci_cs_sniff_mode),
4359	HCI_CS(HCI_OP_EXIT_SNIFF_MODE, hci_cs_exit_sniff_mode),
4360	HCI_CS(HCI_OP_SWITCH_ROLE, hci_cs_switch_role),
4361	HCI_CS(HCI_OP_LE_CREATE_CONN, hci_cs_le_create_conn),
4362	HCI_CS(HCI_OP_LE_READ_REMOTE_FEATURES, hci_cs_le_read_remote_features),
4363	HCI_CS(HCI_OP_LE_START_ENC, hci_cs_le_start_enc),
4364	HCI_CS(HCI_OP_LE_EXT_CREATE_CONN, hci_cs_le_ext_create_conn),
4365	HCI_CS(HCI_OP_LE_CREATE_CIS, hci_cs_le_create_cis),
4366	HCI_CS(HCI_OP_LE_CREATE_BIG, hci_cs_le_create_big),
4367	};
4368
4369	static void hci_cmd_status_evt(struct hci_dev *hdev, void *data,
4370	struct sk_buff *skb, u16 *opcode, u8 *status,
4371	hci_req_complete_t *req_complete,
4372	hci_req_complete_skb_t *req_complete_skb)
4373	{
4374	struct hci_ev_cmd_status *ev = data;
4375	int i;
4376
4377	*opcode = __le16_to_cpu(ev->opcode);
4378	*status = ev->status;
4379
4380	bt_dev_dbg(hdev, "opcode 0x%4.4x", *opcode);
4381
4382	for (i = 0; i < ARRAY_SIZE(hci_cs_table); i++) {
4383	if (hci_cs_table[i].op == *opcode) {
4384	hci_cs_table[i].func(hdev, ev->status);
4385	break;
4386	}
4387	}
4388
4389	handle_cmd_cnt_and_timer(hdev, ncmd: ev->ncmd);
4390
4391	/* Indicate request completion if the command failed. Also, if
4392	* we're not waiting for a special event and we get a success
4393	* command status we should try to flag the request as completed
4394	* (since for this kind of commands there will not be a command
4395	* complete event).
4396	*/
4397	if (ev->status || (hdev->req_skb && !hci_skb_event(hdev->req_skb))) {
4398	hci_req_cmd_complete(hdev, opcode: *opcode, status: ev->status, req_complete,
4399	req_complete_skb);
4400	if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
4401	bt_dev_err(hdev, "unexpected event for opcode 0x%4.4x",
4402	*opcode);
4403	return;
4404	}
4405	}
4406
4407	if (atomic_read(v: &hdev->cmd_cnt) && !skb_queue_empty(list: &hdev->cmd_q))
4408	queue_work(wq: hdev->workqueue, work: &hdev->cmd_work);
4409	}
4410
4411	static void hci_hardware_error_evt(struct hci_dev *hdev, void *data,
4412	struct sk_buff *skb)
4413	{
4414	struct hci_ev_hardware_error *ev = data;
4415
4416	bt_dev_dbg(hdev, "code 0x%2.2x", ev->code);
4417
4418	hdev->hw_error_code = ev->code;
4419
4420	queue_work(wq: hdev->req_workqueue, work: &hdev->error_reset);
4421	}
4422
4423	static void hci_role_change_evt(struct hci_dev *hdev, void *data,
4424	struct sk_buff *skb)
4425	{
4426	struct hci_ev_role_change *ev = data;
4427	struct hci_conn *conn;
4428
4429	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
4430
4431	hci_dev_lock(hdev);
4432
4433	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, ba: &ev->bdaddr);
4434	if (conn) {
4435	if (!ev->status)
4436	conn->role = ev->role;
4437
4438	clear_bit(nr: HCI_CONN_RSWITCH_PEND, addr: &conn->flags);
4439
4440	hci_role_switch_cfm(conn, status: ev->status, role: ev->role);
4441	}
4442
4443	hci_dev_unlock(hdev);
4444	}
4445
4446	static void hci_num_comp_pkts_evt(struct hci_dev *hdev, void *data,
4447	struct sk_buff *skb)
4448	{
4449	struct hci_ev_num_comp_pkts *ev = data;
4450	int i;
4451
4452	if (!hci_ev_skb_pull(hdev, skb, HCI_EV_NUM_COMP_PKTS,
4453	flex_array_size(ev, handles, ev->num)))
4454	return;
4455
4456	if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
4457	bt_dev_err(hdev, "wrong event for mode %d", hdev->flow_ctl_mode);
4458	return;
4459	}
4460
4461	bt_dev_dbg(hdev, "num %d", ev->num);
4462
4463	for (i = 0; i < ev->num; i++) {
4464	struct hci_comp_pkts_info *info = &ev->handles[i];
4465	struct hci_conn *conn;
4466	__u16 handle, count;
4467
4468	handle = __le16_to_cpu(info->handle);
4469	count = __le16_to_cpu(info->count);
4470
4471	conn = hci_conn_hash_lookup_handle(hdev, handle);
4472	if (!conn)
4473	continue;
4474
4475	conn->sent -= count;
4476
4477	switch (conn->type) {
4478	case ACL_LINK:
4479	hdev->acl_cnt += count;
4480	if (hdev->acl_cnt > hdev->acl_pkts)
4481	hdev->acl_cnt = hdev->acl_pkts;
4482	break;
4483
4484	case LE_LINK:
4485	if (hdev->le_pkts) {
4486	hdev->le_cnt += count;
4487	if (hdev->le_cnt > hdev->le_pkts)
4488	hdev->le_cnt = hdev->le_pkts;
4489	} else {
4490	hdev->acl_cnt += count;
4491	if (hdev->acl_cnt > hdev->acl_pkts)
4492	hdev->acl_cnt = hdev->acl_pkts;
4493	}
4494	break;
4495
4496	case SCO_LINK:
4497	hdev->sco_cnt += count;
4498	if (hdev->sco_cnt > hdev->sco_pkts)
4499	hdev->sco_cnt = hdev->sco_pkts;
4500	break;
4501
4502	case ISO_LINK:
4503	if (hdev->iso_pkts) {
4504	hdev->iso_cnt += count;
4505	if (hdev->iso_cnt > hdev->iso_pkts)
4506	hdev->iso_cnt = hdev->iso_pkts;
4507	} else if (hdev->le_pkts) {
4508	hdev->le_cnt += count;
4509	if (hdev->le_cnt > hdev->le_pkts)
4510	hdev->le_cnt = hdev->le_pkts;
4511	} else {
4512	hdev->acl_cnt += count;
4513	if (hdev->acl_cnt > hdev->acl_pkts)
4514	hdev->acl_cnt = hdev->acl_pkts;
4515	}
4516	break;
4517
4518	default:
4519	bt_dev_err(hdev, "unknown type %d conn %p",
4520	conn->type, conn);
4521	break;
4522	}
4523	}
4524
4525	queue_work(wq: hdev->workqueue, work: &hdev->tx_work);
4526	}
4527
4528	static struct hci_conn *__hci_conn_lookup_handle(struct hci_dev *hdev,
4529	__u16 handle)
4530	{
4531	struct hci_chan *chan;
4532
4533	switch (hdev->dev_type) {
4534	case HCI_PRIMARY:
4535	return hci_conn_hash_lookup_handle(hdev, handle);
4536	case HCI_AMP:
4537	chan = hci_chan_lookup_handle(hdev, handle);
4538	if (chan)
4539	return chan->conn;
4540	break;
4541	default:
4542	bt_dev_err(hdev, "unknown dev_type %d", hdev->dev_type);
4543	break;
4544	}
4545
4546	return NULL;
4547	}
4548
4549	static void hci_num_comp_blocks_evt(struct hci_dev *hdev, void *data,
4550	struct sk_buff *skb)
4551	{
4552	struct hci_ev_num_comp_blocks *ev = data;
4553	int i;
4554
4555	if (!hci_ev_skb_pull(hdev, skb, HCI_EV_NUM_COMP_BLOCKS,
4556	flex_array_size(ev, handles, ev->num_hndl)))
4557	return;
4558
4559	if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
4560	bt_dev_err(hdev, "wrong event for mode %d",
4561	hdev->flow_ctl_mode);
4562	return;
4563	}
4564
4565	bt_dev_dbg(hdev, "num_blocks %d num_hndl %d", ev->num_blocks,
4566	ev->num_hndl);
4567
4568	for (i = 0; i < ev->num_hndl; i++) {
4569	struct hci_comp_blocks_info *info = &ev->handles[i];
4570	struct hci_conn *conn = NULL;
4571	__u16 handle, block_count;
4572
4573	handle = __le16_to_cpu(info->handle);
4574	block_count = __le16_to_cpu(info->blocks);
4575
4576	conn = __hci_conn_lookup_handle(hdev, handle);
4577	if (!conn)
4578	continue;
4579
4580	conn->sent -= block_count;
4581
4582	switch (conn->type) {
4583	case ACL_LINK:
4584	case AMP_LINK:
4585	hdev->block_cnt += block_count;
4586	if (hdev->block_cnt > hdev->num_blocks)
4587	hdev->block_cnt = hdev->num_blocks;
4588	break;
4589
4590	default:
4591	bt_dev_err(hdev, "unknown type %d conn %p",
4592	conn->type, conn);
4593	break;
4594	}
4595	}
4596
4597	queue_work(wq: hdev->workqueue, work: &hdev->tx_work);
4598	}
4599
4600	static void hci_mode_change_evt(struct hci_dev *hdev, void *data,
4601	struct sk_buff *skb)
4602	{
4603	struct hci_ev_mode_change *ev = data;
4604	struct hci_conn *conn;
4605
4606	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
4607
4608	hci_dev_lock(hdev);
4609
4610	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4611	if (conn) {
4612	conn->mode = ev->mode;
4613
4614	if (!test_and_clear_bit(nr: HCI_CONN_MODE_CHANGE_PEND,
4615	addr: &conn->flags)) {
4616	if (conn->mode == HCI_CM_ACTIVE)
4617	set_bit(nr: HCI_CONN_POWER_SAVE, addr: &conn->flags);
4618	else
4619	clear_bit(nr: HCI_CONN_POWER_SAVE, addr: &conn->flags);
4620	}
4621
4622	if (test_and_clear_bit(nr: HCI_CONN_SCO_SETUP_PEND, addr: &conn->flags))
4623	hci_sco_setup(conn, status: ev->status);
4624	}
4625
4626	hci_dev_unlock(hdev);
4627	}
4628
4629	static void hci_pin_code_request_evt(struct hci_dev *hdev, void *data,
4630	struct sk_buff *skb)
4631	{
4632	struct hci_ev_pin_code_req *ev = data;
4633	struct hci_conn *conn;
4634
4635	bt_dev_dbg(hdev, "");
4636
4637	hci_dev_lock(hdev);
4638
4639	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, ba: &ev->bdaddr);
4640	if (!conn)
4641	goto unlock;
4642
4643	if (conn->state == BT_CONNECTED) {
4644	hci_conn_hold(conn);
4645	conn->disc_timeout = HCI_PAIRING_TIMEOUT;
4646	hci_conn_drop(conn);
4647	}
4648
4649	if (!hci_dev_test_flag(hdev, HCI_BONDABLE) &&
4650	!test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags)) {
4651	hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
4652	plen: sizeof(ev->bdaddr), param: &ev->bdaddr);
4653	} else if (hci_dev_test_flag(hdev, HCI_MGMT)) {
4654	u8 secure;
4655
4656	if (conn->pending_sec_level == BT_SECURITY_HIGH)
4657	secure = 1;
4658	else
4659	secure = 0;
4660
4661	mgmt_pin_code_request(hdev, bdaddr: &ev->bdaddr, secure);
4662	}
4663
4664	unlock:
4665	hci_dev_unlock(hdev);
4666	}
4667
4668	static void conn_set_key(struct hci_conn *conn, u8 key_type, u8 pin_len)
4669	{
4670	if (key_type == HCI_LK_CHANGED_COMBINATION)
4671	return;
4672
4673	conn->pin_length = pin_len;
4674	conn->key_type = key_type;
4675
4676	switch (key_type) {
4677	case HCI_LK_LOCAL_UNIT:
4678	case HCI_LK_REMOTE_UNIT:
4679	case HCI_LK_DEBUG_COMBINATION:
4680	return;
4681	case HCI_LK_COMBINATION:
4682	if (pin_len == 16)
4683	conn->pending_sec_level = BT_SECURITY_HIGH;
4684	else
4685	conn->pending_sec_level = BT_SECURITY_MEDIUM;
4686	break;
4687	case HCI_LK_UNAUTH_COMBINATION_P192:
4688	case HCI_LK_UNAUTH_COMBINATION_P256:
4689	conn->pending_sec_level = BT_SECURITY_MEDIUM;
4690	break;
4691	case HCI_LK_AUTH_COMBINATION_P192:
4692	conn->pending_sec_level = BT_SECURITY_HIGH;
4693	break;
4694	case HCI_LK_AUTH_COMBINATION_P256:
4695	conn->pending_sec_level = BT_SECURITY_FIPS;
4696	break;
4697	}
4698	}
4699
4700	static void hci_link_key_request_evt(struct hci_dev *hdev, void *data,
4701	struct sk_buff *skb)
4702	{
4703	struct hci_ev_link_key_req *ev = data;
4704	struct hci_cp_link_key_reply cp;
4705	struct hci_conn *conn;
4706	struct link_key *key;
4707
4708	bt_dev_dbg(hdev, "");
4709
4710	if (!hci_dev_test_flag(hdev, HCI_MGMT))
4711	return;
4712
4713	hci_dev_lock(hdev);
4714
4715	key = hci_find_link_key(hdev, bdaddr: &ev->bdaddr);
4716	if (!key) {
4717	bt_dev_dbg(hdev, "link key not found for %pMR", &ev->bdaddr);
4718	goto not_found;
4719	}
4720
4721	bt_dev_dbg(hdev, "found key type %u for %pMR", key->type, &ev->bdaddr);
4722
4723	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, ba: &ev->bdaddr);
4724	if (conn) {
4725	clear_bit(nr: HCI_CONN_NEW_LINK_KEY, addr: &conn->flags);
4726
4727	if ((key->type == HCI_LK_UNAUTH_COMBINATION_P192 ||
4728	key->type == HCI_LK_UNAUTH_COMBINATION_P256) &&
4729	conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
4730	bt_dev_dbg(hdev, "ignoring unauthenticated key");
4731	goto not_found;
4732	}
4733
4734	if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
4735	(conn->pending_sec_level == BT_SECURITY_HIGH ||
4736	conn->pending_sec_level == BT_SECURITY_FIPS)) {
4737	bt_dev_dbg(hdev, "ignoring key unauthenticated for high security");
4738	goto not_found;
4739	}
4740
4741	conn_set_key(conn, key_type: key->type, pin_len: key->pin_len);
4742	}
4743
4744	bacpy(dst: &cp.bdaddr, src: &ev->bdaddr);
4745	memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);
4746
4747	hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, plen: sizeof(cp), param: &cp);
4748
4749	hci_dev_unlock(hdev);
4750
4751	return;
4752
4753	not_found:
4754	hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, plen: 6, param: &ev->bdaddr);
4755	hci_dev_unlock(hdev);
4756	}
4757
4758	static void hci_link_key_notify_evt(struct hci_dev *hdev, void *data,
4759	struct sk_buff *skb)
4760	{
4761	struct hci_ev_link_key_notify *ev = data;
4762	struct hci_conn *conn;
4763	struct link_key *key;
4764	bool persistent;
4765	u8 pin_len = 0;
4766
4767	bt_dev_dbg(hdev, "");
4768
4769	hci_dev_lock(hdev);
4770
4771	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, ba: &ev->bdaddr);
4772	if (!conn)
4773	goto unlock;
4774
4775	/* Ignore NULL link key against CVE-2020-26555 */
4776	if (!crypto_memneq(a: ev->link_key, ZERO_KEY, HCI_LINK_KEY_SIZE)) {
4777	bt_dev_dbg(hdev, "Ignore NULL link key (ZERO KEY) for %pMR",
4778	&ev->bdaddr);
4779	hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
4780	hci_conn_drop(conn);
4781	goto unlock;
4782	}
4783
4784	hci_conn_hold(conn);
4785	conn->disc_timeout = HCI_DISCONN_TIMEOUT;
4786	hci_conn_drop(conn);
4787
4788	set_bit(nr: HCI_CONN_NEW_LINK_KEY, addr: &conn->flags);
4789	conn_set_key(conn, key_type: ev->key_type, pin_len: conn->pin_length);
4790
4791	if (!hci_dev_test_flag(hdev, HCI_MGMT))
4792	goto unlock;
4793
4794	key = hci_add_link_key(hdev, conn, bdaddr: &ev->bdaddr, val: ev->link_key,
4795	type: ev->key_type, pin_len, persistent: &persistent);
4796	if (!key)
4797	goto unlock;
4798
4799	/* Update connection information since adding the key will have
4800	* fixed up the type in the case of changed combination keys.
4801	*/
4802	if (ev->key_type == HCI_LK_CHANGED_COMBINATION)
4803	conn_set_key(conn, key_type: key->type, pin_len: key->pin_len);
4804
4805	mgmt_new_link_key(hdev, key, persistent);
4806
4807	/* Keep debug keys around only if the HCI_KEEP_DEBUG_KEYS flag
4808	* is set. If it's not set simply remove the key from the kernel
4809	* list (we've still notified user space about it but with
4810	* store_hint being 0).
4811	*/
4812	if (key->type == HCI_LK_DEBUG_COMBINATION &&
4813	!hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) {
4814	list_del_rcu(entry: &key->list);
4815	kfree_rcu(key, rcu);
4816	goto unlock;
4817	}
4818
4819	if (persistent)
4820	clear_bit(nr: HCI_CONN_FLUSH_KEY, addr: &conn->flags);
4821	else
4822	set_bit(nr: HCI_CONN_FLUSH_KEY, addr: &conn->flags);
4823
4824	unlock:
4825	hci_dev_unlock(hdev);
4826	}
4827
4828	static void hci_clock_offset_evt(struct hci_dev *hdev, void *data,
4829	struct sk_buff *skb)
4830	{
4831	struct hci_ev_clock_offset *ev = data;
4832	struct hci_conn *conn;
4833
4834	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
4835
4836	hci_dev_lock(hdev);
4837
4838	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4839	if (conn && !ev->status) {
4840	struct inquiry_entry *ie;
4841
4842	ie = hci_inquiry_cache_lookup(hdev, bdaddr: &conn->dst);
4843	if (ie) {
4844	ie->data.clock_offset = ev->clock_offset;
4845	ie->timestamp = jiffies;
4846	}
4847	}
4848
4849	hci_dev_unlock(hdev);
4850	}
4851
4852	static void hci_pkt_type_change_evt(struct hci_dev *hdev, void *data,
4853	struct sk_buff *skb)
4854	{
4855	struct hci_ev_pkt_type_change *ev = data;
4856	struct hci_conn *conn;
4857
4858	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
4859
4860	hci_dev_lock(hdev);
4861
4862	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4863	if (conn && !ev->status)
4864	conn->pkt_type = __le16_to_cpu(ev->pkt_type);
4865
4866	hci_dev_unlock(hdev);
4867	}
4868
4869	static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, void *data,
4870	struct sk_buff *skb)
4871	{
4872	struct hci_ev_pscan_rep_mode *ev = data;
4873	struct inquiry_entry *ie;
4874
4875	bt_dev_dbg(hdev, "");
4876
4877	hci_dev_lock(hdev);
4878
4879	ie = hci_inquiry_cache_lookup(hdev, bdaddr: &ev->bdaddr);
4880	if (ie) {
4881	ie->data.pscan_rep_mode = ev->pscan_rep_mode;
4882	ie->timestamp = jiffies;
4883	}
4884
4885	hci_dev_unlock(hdev);
4886	}
4887
4888	static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, void *edata,
4889	struct sk_buff *skb)
4890	{
4891	struct hci_ev_inquiry_result_rssi *ev = edata;
4892	struct inquiry_data data;
4893	int i;
4894
4895	bt_dev_dbg(hdev, "num_rsp %d", ev->num);
4896
4897	if (!ev->num)
4898	return;
4899
4900	if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
4901	return;
4902
4903	hci_dev_lock(hdev);
4904
4905	if (skb->len == array_size(ev->num,
4906	sizeof(struct inquiry_info_rssi_pscan))) {
4907	struct inquiry_info_rssi_pscan *info;
4908
4909	for (i = 0; i < ev->num; i++) {
4910	u32 flags;
4911
4912	info = hci_ev_skb_pull(hdev, skb,
4913	HCI_EV_INQUIRY_RESULT_WITH_RSSI,
4914	len: sizeof(*info));
4915	if (!info) {
4916	bt_dev_err(hdev, "Malformed HCI Event: 0x%2.2x",
4917	HCI_EV_INQUIRY_RESULT_WITH_RSSI);
4918	goto unlock;
4919	}
4920
4921	bacpy(dst: &data.bdaddr, src: &info->bdaddr);
4922	data.pscan_rep_mode = info->pscan_rep_mode;
4923	data.pscan_period_mode = info->pscan_period_mode;
4924	data.pscan_mode = info->pscan_mode;
4925	memcpy(data.dev_class, info->dev_class, 3);
4926	data.clock_offset = info->clock_offset;
4927	data.rssi = info->rssi;
4928	data.ssp_mode = 0x00;
4929
4930	flags = hci_inquiry_cache_update(hdev, data: &data, name_known: false);
4931
4932	mgmt_device_found(hdev, bdaddr: &info->bdaddr, ACL_LINK, addr_type: 0x00,
4933	dev_class: info->dev_class, rssi: info->rssi,
4934	flags, NULL, eir_len: 0, NULL, scan_rsp_len: 0, instant: 0);
4935	}
4936	} else if (skb->len == array_size(ev->num,
4937	sizeof(struct inquiry_info_rssi))) {
4938	struct inquiry_info_rssi *info;
4939
4940	for (i = 0; i < ev->num; i++) {
4941	u32 flags;
4942
4943	info = hci_ev_skb_pull(hdev, skb,
4944	HCI_EV_INQUIRY_RESULT_WITH_RSSI,
4945	len: sizeof(*info));
4946	if (!info) {
4947	bt_dev_err(hdev, "Malformed HCI Event: 0x%2.2x",
4948	HCI_EV_INQUIRY_RESULT_WITH_RSSI);
4949	goto unlock;
4950	}
4951
4952	bacpy(dst: &data.bdaddr, src: &info->bdaddr);
4953	data.pscan_rep_mode = info->pscan_rep_mode;
4954	data.pscan_period_mode = info->pscan_period_mode;
4955	data.pscan_mode = 0x00;
4956	memcpy(data.dev_class, info->dev_class, 3);
4957	data.clock_offset = info->clock_offset;
4958	data.rssi = info->rssi;
4959	data.ssp_mode = 0x00;
4960
4961	flags = hci_inquiry_cache_update(hdev, data: &data, name_known: false);
4962
4963	mgmt_device_found(hdev, bdaddr: &info->bdaddr, ACL_LINK, addr_type: 0x00,
4964	dev_class: info->dev_class, rssi: info->rssi,
4965	flags, NULL, eir_len: 0, NULL, scan_rsp_len: 0, instant: 0);
4966	}
4967	} else {
4968	bt_dev_err(hdev, "Malformed HCI Event: 0x%2.2x",
4969	HCI_EV_INQUIRY_RESULT_WITH_RSSI);
4970	}
4971	unlock:
4972	hci_dev_unlock(hdev);
4973	}
4974
4975	static void hci_remote_ext_features_evt(struct hci_dev *hdev, void *data,
4976	struct sk_buff *skb)
4977	{
4978	struct hci_ev_remote_ext_features *ev = data;
4979	struct hci_conn *conn;
4980
4981	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
4982
4983	hci_dev_lock(hdev);
4984
4985	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4986	if (!conn)
4987	goto unlock;
4988
4989	if (ev->page < HCI_MAX_PAGES)
4990	memcpy(conn->features[ev->page], ev->features, 8);
4991
4992	if (!ev->status && ev->page == 0x01) {
4993	struct inquiry_entry *ie;
4994
4995	ie = hci_inquiry_cache_lookup(hdev, bdaddr: &conn->dst);
4996	if (ie)
4997	ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
4998
4999	if (ev->features[0] & LMP_HOST_SSP) {
5000	set_bit(nr: HCI_CONN_SSP_ENABLED, addr: &conn->flags);
5001	} else {
5002	/* It is mandatory by the Bluetooth specification that
5003	* Extended Inquiry Results are only used when Secure
5004	* Simple Pairing is enabled, but some devices violate
5005	* this.
5006	*
5007	* To make these devices work, the internal SSP
5008	* enabled flag needs to be cleared if the remote host
5009	* features do not indicate SSP support */
5010	clear_bit(nr: HCI_CONN_SSP_ENABLED, addr: &conn->flags);
5011	}
5012
5013	if (ev->features[0] & LMP_HOST_SC)
5014	set_bit(nr: HCI_CONN_SC_ENABLED, addr: &conn->flags);
5015	}
5016
5017	if (conn->state != BT_CONFIG)
5018	goto unlock;
5019
5020	if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
5021	struct hci_cp_remote_name_req cp;
5022	memset(&cp, 0, sizeof(cp));
5023	bacpy(dst: &cp.bdaddr, src: &conn->dst);
5024	cp.pscan_rep_mode = 0x02;
5025	hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, plen: sizeof(cp), param: &cp);
5026	} else {
5027	mgmt_device_connected(hdev, conn, NULL, name_len: 0);
5028	}
5029
5030	if (!hci_outgoing_auth_needed(hdev, conn)) {
5031	conn->state = BT_CONNECTED;
5032	hci_connect_cfm(conn, status: ev->status);
5033	hci_conn_drop(conn);
5034	}
5035
5036	unlock:
5037	hci_dev_unlock(hdev);
5038	}
5039
5040	static void hci_sync_conn_complete_evt(struct hci_dev *hdev, void *data,
5041	struct sk_buff *skb)
5042	{
5043	struct hci_ev_sync_conn_complete *ev = data;
5044	struct hci_conn *conn;
5045	u8 status = ev->status;
5046
5047	switch (ev->link_type) {
5048	case SCO_LINK:
5049	case ESCO_LINK:
5050	break;
5051	default:
5052	/* As per Core 5.3 Vol 4 Part E 7.7.35 (p.2219), Link_Type
5053	* for HCI_Synchronous_Connection_Complete is limited to
5054	* either SCO or eSCO
5055	*/
5056	bt_dev_err(hdev, "Ignoring connect complete event for invalid link type");
5057	return;
5058	}
5059
5060	bt_dev_dbg(hdev, "status 0x%2.2x", status);
5061
5062	hci_dev_lock(hdev);
5063
5064	conn = hci_conn_hash_lookup_ba(hdev, type: ev->link_type, ba: &ev->bdaddr);
5065	if (!conn) {
5066	if (ev->link_type == ESCO_LINK)
5067	goto unlock;
5068
5069	/* When the link type in the event indicates SCO connection
5070	* and lookup of the connection object fails, then check
5071	* if an eSCO connection object exists.
5072	*
5073	* The core limits the synchronous connections to either
5074	* SCO or eSCO. The eSCO connection is preferred and tried
5075	* to be setup first and until successfully established,
5076	* the link type will be hinted as eSCO.
5077	*/
5078	conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, ba: &ev->bdaddr);
5079	if (!conn)
5080	goto unlock;
5081	}
5082
5083	/* The HCI_Synchronous_Connection_Complete event is only sent once per connection.
5084	* Processing it more than once per connection can corrupt kernel memory.
5085	*
5086	* As the connection handle is set here for the first time, it indicates
5087	* whether the connection is already set up.
5088	*/
5089	if (!HCI_CONN_HANDLE_UNSET(conn->handle)) {
5090	bt_dev_err(hdev, "Ignoring HCI_Sync_Conn_Complete event for existing connection");
5091	goto unlock;
5092	}
5093
5094	switch (status) {
5095	case 0x00:
5096	status = hci_conn_set_handle(conn, __le16_to_cpu(ev->handle));
5097	if (status) {
5098	conn->state = BT_CLOSED;
5099	break;
5100	}
5101
5102	conn->state = BT_CONNECTED;
5103	conn->type = ev->link_type;
5104
5105	hci_debugfs_create_conn(conn);
5106	hci_conn_add_sysfs(conn);
5107	break;
5108
5109	case 0x10: /* Connection Accept Timeout */
5110	case 0x0d: /* Connection Rejected due to Limited Resources */
5111	case 0x11: /* Unsupported Feature or Parameter Value */
5112	case 0x1c: /* SCO interval rejected */
5113	case 0x1a: /* Unsupported Remote Feature */
5114	case 0x1e: /* Invalid LMP Parameters */
5115	case 0x1f: /* Unspecified error */
5116	case 0x20: /* Unsupported LMP Parameter value */
5117	if (conn->out) {
5118	conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
5119	(hdev->esco_type & EDR_ESCO_MASK);
5120	if (hci_setup_sync(conn, handle: conn->parent->handle))
5121	goto unlock;
5122	}
5123	fallthrough;
5124
5125	default:
5126	conn->state = BT_CLOSED;
5127	break;
5128	}
5129
5130	bt_dev_dbg(hdev, "SCO connected with air mode: %02x", ev->air_mode);
5131	/* Notify only in case of SCO over HCI transport data path which
5132	* is zero and non-zero value shall be non-HCI transport data path
5133	*/
5134	if (conn->codec.data_path == 0 && hdev->notify) {
5135	switch (ev->air_mode) {
5136	case 0x02:
5137	hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_CVSD);
5138	break;
5139	case 0x03:
5140	hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_TRANSP);
5141	break;
5142	}
5143	}
5144
5145	hci_connect_cfm(conn, status);
5146	if (status)
5147	hci_conn_del(conn);
5148
5149	unlock:
5150	hci_dev_unlock(hdev);
5151	}
5152
5153	static inline size_t eir_get_length(u8 *eir, size_t eir_len)
5154	{
5155	size_t parsed = 0;
5156
5157	while (parsed < eir_len) {
5158	u8 field_len = eir[0];
5159
5160	if (field_len == 0)
5161	return parsed;
5162
5163	parsed += field_len + 1;
5164	eir += field_len + 1;
5165	}
5166
5167	return eir_len;
5168	}
5169
5170	static void hci_extended_inquiry_result_evt(struct hci_dev *hdev, void *edata,
5171	struct sk_buff *skb)
5172	{
5173	struct hci_ev_ext_inquiry_result *ev = edata;
5174	struct inquiry_data data;
5175	size_t eir_len;
5176	int i;
5177
5178	if (!hci_ev_skb_pull(hdev, skb, HCI_EV_EXTENDED_INQUIRY_RESULT,
5179	flex_array_size(ev, info, ev->num)))
5180	return;
5181
5182	bt_dev_dbg(hdev, "num %d", ev->num);
5183
5184	if (!ev->num)
5185	return;
5186
5187	if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
5188	return;
5189
5190	hci_dev_lock(hdev);
5191
5192	for (i = 0; i < ev->num; i++) {
5193	struct extended_inquiry_info *info = &ev->info[i];
5194	u32 flags;
5195	bool name_known;
5196
5197	bacpy(dst: &data.bdaddr, src: &info->bdaddr);
5198	data.pscan_rep_mode = info->pscan_rep_mode;
5199	data.pscan_period_mode = info->pscan_period_mode;
5200	data.pscan_mode = 0x00;
5201	memcpy(data.dev_class, info->dev_class, 3);
5202	data.clock_offset = info->clock_offset;
5203	data.rssi = info->rssi;
5204	data.ssp_mode = 0x01;
5205
5206	if (hci_dev_test_flag(hdev, HCI_MGMT))
5207	name_known = eir_get_data(eir: info->data,
5208	eir_len: sizeof(info->data),
5209	EIR_NAME_COMPLETE, NULL);
5210	else
5211	name_known = true;
5212
5213	flags = hci_inquiry_cache_update(hdev, data: &data, name_known);
5214
5215	eir_len = eir_get_length(eir: info->data, eir_len: sizeof(info->data));
5216
5217	mgmt_device_found(hdev, bdaddr: &info->bdaddr, ACL_LINK, addr_type: 0x00,
5218	dev_class: info->dev_class, rssi: info->rssi,
5219	flags, eir: info->data, eir_len, NULL, scan_rsp_len: 0, instant: 0);
5220	}
5221
5222	hci_dev_unlock(hdev);
5223	}
5224
5225	static void hci_key_refresh_complete_evt(struct hci_dev *hdev, void *data,
5226	struct sk_buff *skb)
5227	{
5228	struct hci_ev_key_refresh_complete *ev = data;
5229	struct hci_conn *conn;
5230
5231	bt_dev_dbg(hdev, "status 0x%2.2x handle 0x%4.4x", ev->status,
5232	__le16_to_cpu(ev->handle));
5233
5234	hci_dev_lock(hdev);
5235
5236	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5237	if (!conn)
5238	goto unlock;
5239
5240	/* For BR/EDR the necessary steps are taken through the
5241	* auth_complete event.
5242	*/
5243	if (conn->type != LE_LINK)
5244	goto unlock;
5245
5246	if (!ev->status)
5247	conn->sec_level = conn->pending_sec_level;
5248
5249	clear_bit(nr: HCI_CONN_ENCRYPT_PEND, addr: &conn->flags);
5250
5251	if (ev->status && conn->state == BT_CONNECTED) {
5252	hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
5253	hci_conn_drop(conn);
5254	goto unlock;
5255	}
5256
5257	if (conn->state == BT_CONFIG) {
5258	if (!ev->status)
5259	conn->state = BT_CONNECTED;
5260
5261	hci_connect_cfm(conn, status: ev->status);
5262	hci_conn_drop(conn);
5263	} else {
5264	hci_auth_cfm(conn, status: ev->status);
5265
5266	hci_conn_hold(conn);
5267	conn->disc_timeout = HCI_DISCONN_TIMEOUT;
5268	hci_conn_drop(conn);
5269	}
5270
5271	unlock:
5272	hci_dev_unlock(hdev);
5273	}
5274
5275	static u8 hci_get_auth_req(struct hci_conn *conn)
5276	{
5277	/* If remote requests no-bonding follow that lead */
5278	if (conn->remote_auth == HCI_AT_NO_BONDING ||
5279	conn->remote_auth == HCI_AT_NO_BONDING_MITM)
5280	return conn->remote_auth | (conn->auth_type & 0x01);
5281
5282	/* If both remote and local have enough IO capabilities, require
5283	* MITM protection
5284	*/
5285	if (conn->remote_cap != HCI_IO_NO_INPUT_OUTPUT &&
5286	conn->io_capability != HCI_IO_NO_INPUT_OUTPUT)
5287	return conn->remote_auth | 0x01;
5288
5289	/* No MITM protection possible so ignore remote requirement */
5290	return (conn->remote_auth & ~0x01) | (conn->auth_type & 0x01);
5291	}
5292
5293	static u8 bredr_oob_data_present(struct hci_conn *conn)
5294	{
5295	struct hci_dev *hdev = conn->hdev;
5296	struct oob_data *data;
5297
5298	data = hci_find_remote_oob_data(hdev, bdaddr: &conn->dst, BDADDR_BREDR);
5299	if (!data)
5300	return 0x00;
5301
5302	if (bredr_sc_enabled(hdev)) {
5303	/* When Secure Connections is enabled, then just
5304	* return the present value stored with the OOB
5305	* data. The stored value contains the right present
5306	* information. However it can only be trusted when
5307	* not in Secure Connection Only mode.
5308	*/
5309	if (!hci_dev_test_flag(hdev, HCI_SC_ONLY))
5310	return data->present;
5311
5312	/* When Secure Connections Only mode is enabled, then
5313	* the P-256 values are required. If they are not
5314	* available, then do not declare that OOB data is
5315	* present.
5316	*/
5317	if (!crypto_memneq(a: data->rand256, ZERO_KEY, size: 16) ||
5318	!crypto_memneq(a: data->hash256, ZERO_KEY, size: 16))
5319	return 0x00;
5320
5321	return 0x02;
5322	}
5323
5324	/* When Secure Connections is not enabled or actually
5325	* not supported by the hardware, then check that if
5326	* P-192 data values are present.
5327	*/
5328	if (!crypto_memneq(a: data->rand192, ZERO_KEY, size: 16) ||
5329	!crypto_memneq(a: data->hash192, ZERO_KEY, size: 16))
5330	return 0x00;
5331
5332	return 0x01;
5333	}
5334
5335	static void hci_io_capa_request_evt(struct hci_dev *hdev, void *data,
5336	struct sk_buff *skb)
5337	{
5338	struct hci_ev_io_capa_request *ev = data;
5339	struct hci_conn *conn;
5340
5341	bt_dev_dbg(hdev, "");
5342
5343	hci_dev_lock(hdev);
5344
5345	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, ba: &ev->bdaddr);
5346	if (!conn || !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
5347	goto unlock;
5348
5349	/* Assume remote supports SSP since it has triggered this event */
5350	set_bit(nr: HCI_CONN_SSP_ENABLED, addr: &conn->flags);
5351
5352	hci_conn_hold(conn);
5353
5354	if (!hci_dev_test_flag(hdev, HCI_MGMT))
5355	goto unlock;
5356
5357	/* Allow pairing if we're pairable, the initiators of the
5358	* pairing or if the remote is not requesting bonding.
5359	*/
5360	if (hci_dev_test_flag(hdev, HCI_BONDABLE) ||
5361	test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags) ||
5362	(conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
5363	struct hci_cp_io_capability_reply cp;
5364
5365	bacpy(dst: &cp.bdaddr, src: &ev->bdaddr);
5366	/* Change the IO capability from KeyboardDisplay
5367	* to DisplayYesNo as it is not supported by BT spec. */
5368	cp.capability = (conn->io_capability == 0x04) ?
5369	HCI_IO_DISPLAY_YESNO : conn->io_capability;
5370
5371	/* If we are initiators, there is no remote information yet */
5372	if (conn->remote_auth == 0xff) {
5373	/* Request MITM protection if our IO caps allow it
5374	* except for the no-bonding case.
5375	*/
5376	if (conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
5377	conn->auth_type != HCI_AT_NO_BONDING)
5378	conn->auth_type |= 0x01;
5379	} else {
5380	conn->auth_type = hci_get_auth_req(conn);
5381	}
5382
5383	/* If we're not bondable, force one of the non-bondable
5384	* authentication requirement values.
5385	*/
5386	if (!hci_dev_test_flag(hdev, HCI_BONDABLE))
5387	conn->auth_type &= HCI_AT_NO_BONDING_MITM;
5388
5389	cp.authentication = conn->auth_type;
5390	cp.oob_data = bredr_oob_data_present(conn);
5391
5392	hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
5393	plen: sizeof(cp), param: &cp);
5394	} else {
5395	struct hci_cp_io_capability_neg_reply cp;
5396
5397	bacpy(dst: &cp.bdaddr, src: &ev->bdaddr);
5398	cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
5399
5400	hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
5401	plen: sizeof(cp), param: &cp);
5402	}
5403
5404	unlock:
5405	hci_dev_unlock(hdev);
5406	}
5407
5408	static void hci_io_capa_reply_evt(struct hci_dev *hdev, void *data,
5409	struct sk_buff *skb)
5410	{
5411	struct hci_ev_io_capa_reply *ev = data;
5412	struct hci_conn *conn;
5413
5414	bt_dev_dbg(hdev, "");
5415
5416	hci_dev_lock(hdev);
5417
5418	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, ba: &ev->bdaddr);
5419	if (!conn)
5420	goto unlock;
5421
5422	conn->remote_cap = ev->capability;
5423	conn->remote_auth = ev->authentication;
5424
5425	unlock:
5426	hci_dev_unlock(hdev);
5427	}
5428
5429	static void hci_user_confirm_request_evt(struct hci_dev *hdev, void *data,
5430	struct sk_buff *skb)
5431	{
5432	struct hci_ev_user_confirm_req *ev = data;
5433	int loc_mitm, rem_mitm, confirm_hint = 0;
5434	struct hci_conn *conn;
5435
5436	bt_dev_dbg(hdev, "");
5437
5438	hci_dev_lock(hdev);
5439
5440	if (!hci_dev_test_flag(hdev, HCI_MGMT))
5441	goto unlock;
5442
5443	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, ba: &ev->bdaddr);
5444	if (!conn)
5445	goto unlock;
5446
5447	loc_mitm = (conn->auth_type & 0x01);
5448	rem_mitm = (conn->remote_auth & 0x01);
5449
5450	/* If we require MITM but the remote device can't provide that
5451	* (it has NoInputNoOutput) then reject the confirmation
5452	* request. We check the security level here since it doesn't
5453	* necessarily match conn->auth_type.
5454	*/
5455	if (conn->pending_sec_level > BT_SECURITY_MEDIUM &&
5456	conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
5457	bt_dev_dbg(hdev, "Rejecting request: remote device can't provide MITM");
5458	hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
5459	plen: sizeof(ev->bdaddr), param: &ev->bdaddr);
5460	goto unlock;
5461	}
5462
5463	/* If no side requires MITM protection; auto-accept */
5464	if ((!loc_mitm || conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) &&
5465	(!rem_mitm || conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)) {
5466
5467	/* If we're not the initiators request authorization to
5468	* proceed from user space (mgmt_user_confirm with
5469	* confirm_hint set to 1). The exception is if neither
5470	* side had MITM or if the local IO capability is
5471	* NoInputNoOutput, in which case we do auto-accept
5472	*/
5473	if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&
5474	conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
5475	(loc_mitm || rem_mitm)) {
5476	bt_dev_dbg(hdev, "Confirming auto-accept as acceptor");
5477	confirm_hint = 1;
5478	goto confirm;
5479	}
5480
5481	/* If there already exists link key in local host, leave the
5482	* decision to user space since the remote device could be
5483	* legitimate or malicious.
5484	*/
5485	if (hci_find_link_key(hdev, bdaddr: &ev->bdaddr)) {
5486	bt_dev_dbg(hdev, "Local host already has link key");
5487	confirm_hint = 1;
5488	goto confirm;
5489	}
5490
5491	BT_DBG("Auto-accept of user confirmation with %ums delay",
5492	hdev->auto_accept_delay);
5493
5494	if (hdev->auto_accept_delay > 0) {
5495	int delay = msecs_to_jiffies(m: hdev->auto_accept_delay);
5496	queue_delayed_work(wq: conn->hdev->workqueue,
5497	dwork: &conn->auto_accept_work, delay);
5498	goto unlock;
5499	}
5500
5501	hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
5502	plen: sizeof(ev->bdaddr), param: &ev->bdaddr);
5503	goto unlock;
5504	}
5505
5506	confirm:
5507	mgmt_user_confirm_request(hdev, bdaddr: &ev->bdaddr, ACL_LINK, addr_type: 0,
5508	le32_to_cpu(ev->passkey), confirm_hint);
5509
5510	unlock:
5511	hci_dev_unlock(hdev);
5512	}
5513
5514	static void hci_user_passkey_request_evt(struct hci_dev *hdev, void *data,
5515	struct sk_buff *skb)
5516	{
5517	struct hci_ev_user_passkey_req *ev = data;
5518
5519	bt_dev_dbg(hdev, "");
5520
5521	if (hci_dev_test_flag(hdev, HCI_MGMT))
5522	mgmt_user_passkey_request(hdev, bdaddr: &ev->bdaddr, ACL_LINK, addr_type: 0);
5523	}
5524
5525	static void hci_user_passkey_notify_evt(struct hci_dev *hdev, void *data,
5526	struct sk_buff *skb)
5527	{
5528	struct hci_ev_user_passkey_notify *ev = data;
5529	struct hci_conn *conn;
5530
5531	bt_dev_dbg(hdev, "");
5532
5533	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, ba: &ev->bdaddr);
5534	if (!conn)
5535	return;
5536
5537	conn->passkey_notify = __le32_to_cpu(ev->passkey);
5538	conn->passkey_entered = 0;
5539
5540	if (hci_dev_test_flag(hdev, HCI_MGMT))
5541	mgmt_user_passkey_notify(hdev, bdaddr: &conn->dst, link_type: conn->type,
5542	addr_type: conn->dst_type, passkey: conn->passkey_notify,
5543	entered: conn->passkey_entered);
5544	}
5545
5546	static void hci_keypress_notify_evt(struct hci_dev *hdev, void *data,
5547	struct sk_buff *skb)
5548	{
5549	struct hci_ev_keypress_notify *ev = data;
5550	struct hci_conn *conn;
5551
5552	bt_dev_dbg(hdev, "");
5553
5554	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, ba: &ev->bdaddr);
5555	if (!conn)
5556	return;
5557
5558	switch (ev->type) {
5559	case HCI_KEYPRESS_STARTED:
5560	conn->passkey_entered = 0;
5561	return;
5562
5563	case HCI_KEYPRESS_ENTERED:
5564	conn->passkey_entered++;
5565	break;
5566
5567	case HCI_KEYPRESS_ERASED:
5568	conn->passkey_entered--;
5569	break;
5570
5571	case HCI_KEYPRESS_CLEARED:
5572	conn->passkey_entered = 0;
5573	break;
5574
5575	case HCI_KEYPRESS_COMPLETED:
5576	return;
5577	}
5578
5579	if (hci_dev_test_flag(hdev, HCI_MGMT))
5580	mgmt_user_passkey_notify(hdev, bdaddr: &conn->dst, link_type: conn->type,
5581	addr_type: conn->dst_type, passkey: conn->passkey_notify,
5582	entered: conn->passkey_entered);
5583	}
5584
5585	static void hci_simple_pair_complete_evt(struct hci_dev *hdev, void *data,
5586	struct sk_buff *skb)
5587	{
5588	struct hci_ev_simple_pair_complete *ev = data;
5589	struct hci_conn *conn;
5590
5591	bt_dev_dbg(hdev, "");
5592
5593	hci_dev_lock(hdev);
5594
5595	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, ba: &ev->bdaddr);
5596	if (!conn || !hci_conn_ssp_enabled(conn))
5597	goto unlock;
5598
5599	/* Reset the authentication requirement to unknown */
5600	conn->remote_auth = 0xff;
5601
5602	/* To avoid duplicate auth_failed events to user space we check
5603	* the HCI_CONN_AUTH_PEND flag which will be set if we
5604	* initiated the authentication. A traditional auth_complete
5605	* event gets always produced as initiator and is also mapped to
5606	* the mgmt_auth_failed event */
5607	if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status)
5608	mgmt_auth_failed(conn, status: ev->status);
5609
5610	hci_conn_drop(conn);
5611
5612	unlock:
5613	hci_dev_unlock(hdev);
5614	}
5615
5616	static void hci_remote_host_features_evt(struct hci_dev *hdev, void *data,
5617	struct sk_buff *skb)
5618	{
5619	struct hci_ev_remote_host_features *ev = data;
5620	struct inquiry_entry *ie;
5621	struct hci_conn *conn;
5622
5623	bt_dev_dbg(hdev, "");
5624
5625	hci_dev_lock(hdev);
5626
5627	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, ba: &ev->bdaddr);
5628	if (conn)
5629	memcpy(conn->features[1], ev->features, 8);
5630
5631	ie = hci_inquiry_cache_lookup(hdev, bdaddr: &ev->bdaddr);
5632	if (ie)
5633	ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
5634
5635	hci_dev_unlock(hdev);
5636	}
5637
5638	static void hci_remote_oob_data_request_evt(struct hci_dev *hdev, void *edata,
5639	struct sk_buff *skb)
5640	{
5641	struct hci_ev_remote_oob_data_request *ev = edata;
5642	struct oob_data *data;
5643
5644	bt_dev_dbg(hdev, "");
5645
5646	hci_dev_lock(hdev);
5647
5648	if (!hci_dev_test_flag(hdev, HCI_MGMT))
5649	goto unlock;
5650
5651	data = hci_find_remote_oob_data(hdev, bdaddr: &ev->bdaddr, BDADDR_BREDR);
5652	if (!data) {
5653	struct hci_cp_remote_oob_data_neg_reply cp;
5654
5655	bacpy(dst: &cp.bdaddr, src: &ev->bdaddr);
5656	hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY,
5657	plen: sizeof(cp), param: &cp);
5658	goto unlock;
5659	}
5660
5661	if (bredr_sc_enabled(hdev)) {
5662	struct hci_cp_remote_oob_ext_data_reply cp;
5663
5664	bacpy(dst: &cp.bdaddr, src: &ev->bdaddr);
5665	if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
5666	memset(cp.hash192, 0, sizeof(cp.hash192));
5667	memset(cp.rand192, 0, sizeof(cp.rand192));
5668	} else {
5669	memcpy(cp.hash192, data->hash192, sizeof(cp.hash192));
5670	memcpy(cp.rand192, data->rand192, sizeof(cp.rand192));
5671	}
5672	memcpy(cp.hash256, data->hash256, sizeof(cp.hash256));
5673	memcpy(cp.rand256, data->rand256, sizeof(cp.rand256));
5674
5675	hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_EXT_DATA_REPLY,
5676	plen: sizeof(cp), param: &cp);
5677	} else {
5678	struct hci_cp_remote_oob_data_reply cp;
5679
5680	bacpy(dst: &cp.bdaddr, src: &ev->bdaddr);
5681	memcpy(cp.hash, data->hash192, sizeof(cp.hash));
5682	memcpy(cp.rand, data->rand192, sizeof(cp.rand));
5683
5684	hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY,
5685	plen: sizeof(cp), param: &cp);
5686	}
5687
5688	unlock:
5689	hci_dev_unlock(hdev);
5690	}
5691
5692	static void le_conn_update_addr(struct hci_conn *conn, bdaddr_t *bdaddr,
5693	u8 bdaddr_type, bdaddr_t *local_rpa)
5694	{
5695	if (conn->out) {
5696	conn->dst_type = bdaddr_type;
5697	conn->resp_addr_type = bdaddr_type;
5698	bacpy(dst: &conn->resp_addr, src: bdaddr);
5699
5700	/* Check if the controller has set a Local RPA then it must be
5701	* used instead or hdev->rpa.
5702	*/
5703	if (local_rpa && bacmp(ba1: local_rpa, BDADDR_ANY)) {
5704	conn->init_addr_type = ADDR_LE_DEV_RANDOM;
5705	bacpy(dst: &conn->init_addr, src: local_rpa);
5706	} else if (hci_dev_test_flag(conn->hdev, HCI_PRIVACY)) {
5707	conn->init_addr_type = ADDR_LE_DEV_RANDOM;
5708	bacpy(dst: &conn->init_addr, src: &conn->hdev->rpa);
5709	} else {
5710	hci_copy_identity_address(hdev: conn->hdev, bdaddr: &conn->init_addr,
5711	bdaddr_type: &conn->init_addr_type);
5712	}
5713	} else {
5714	conn->resp_addr_type = conn->hdev->adv_addr_type;
5715	/* Check if the controller has set a Local RPA then it must be
5716	* used instead or hdev->rpa.
5717	*/
5718	if (local_rpa && bacmp(ba1: local_rpa, BDADDR_ANY)) {
5719	conn->resp_addr_type = ADDR_LE_DEV_RANDOM;
5720	bacpy(dst: &conn->resp_addr, src: local_rpa);
5721	} else if (conn->hdev->adv_addr_type == ADDR_LE_DEV_RANDOM) {
5722	/* In case of ext adv, resp_addr will be updated in
5723	* Adv Terminated event.
5724	*/
5725	if (!ext_adv_capable(conn->hdev))
5726	bacpy(dst: &conn->resp_addr,
5727	src: &conn->hdev->random_addr);
5728	} else {
5729	bacpy(dst: &conn->resp_addr, src: &conn->hdev->bdaddr);
5730	}
5731
5732	conn->init_addr_type = bdaddr_type;
5733	bacpy(dst: &conn->init_addr, src: bdaddr);
5734
5735	/* For incoming connections, set the default minimum
5736	* and maximum connection interval. They will be used
5737	* to check if the parameters are in range and if not
5738	* trigger the connection update procedure.
5739	*/
5740	conn->le_conn_min_interval = conn->hdev->le_conn_min_interval;
5741	conn->le_conn_max_interval = conn->hdev->le_conn_max_interval;
5742	}
5743	}
5744
5745	static void le_conn_complete_evt(struct hci_dev *hdev, u8 status,
5746	bdaddr_t *bdaddr, u8 bdaddr_type,
5747	bdaddr_t *local_rpa, u8 role, u16 handle,
5748	u16 interval, u16 latency,
5749	u16 supervision_timeout)
5750	{
5751	struct hci_conn_params *params;
5752	struct hci_conn *conn;
5753	struct smp_irk *irk;
5754	u8 addr_type;
5755
5756	hci_dev_lock(hdev);
5757
5758	/* All controllers implicitly stop advertising in the event of a
5759	* connection, so ensure that the state bit is cleared.
5760	*/
5761	hci_dev_clear_flag(hdev, HCI_LE_ADV);
5762
5763	conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, ba: bdaddr);
5764	if (!conn) {
5765	/* In case of error status and there is no connection pending
5766	* just unlock as there is nothing to cleanup.
5767	*/
5768	if (status)
5769	goto unlock;
5770
5771	conn = hci_conn_add_unset(hdev, LE_LINK, dst: bdaddr, role);
5772	if (!conn) {
5773	bt_dev_err(hdev, "no memory for new connection");
5774	goto unlock;
5775	}
5776
5777	conn->dst_type = bdaddr_type;
5778
5779	/* If we didn't have a hci_conn object previously
5780	* but we're in central role this must be something
5781	* initiated using an accept list. Since accept list based
5782	* connections are not "first class citizens" we don't
5783	* have full tracking of them. Therefore, we go ahead
5784	* with a "best effort" approach of determining the
5785	* initiator address based on the HCI_PRIVACY flag.
5786	*/
5787	if (conn->out) {
5788	conn->resp_addr_type = bdaddr_type;
5789	bacpy(dst: &conn->resp_addr, src: bdaddr);
5790	if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
5791	conn->init_addr_type = ADDR_LE_DEV_RANDOM;
5792	bacpy(dst: &conn->init_addr, src: &hdev->rpa);
5793	} else {
5794	hci_copy_identity_address(hdev,
5795	bdaddr: &conn->init_addr,
5796	bdaddr_type: &conn->init_addr_type);
5797	}
5798	}
5799	} else {
5800	cancel_delayed_work(dwork: &conn->le_conn_timeout);
5801	}
5802
5803	/* The HCI_LE_Connection_Complete event is only sent once per connection.
5804	* Processing it more than once per connection can corrupt kernel memory.
5805	*
5806	* As the connection handle is set here for the first time, it indicates
5807	* whether the connection is already set up.
5808	*/
5809	if (!HCI_CONN_HANDLE_UNSET(conn->handle)) {
5810	bt_dev_err(hdev, "Ignoring HCI_Connection_Complete for existing connection");
5811	goto unlock;
5812	}
5813
5814	le_conn_update_addr(conn, bdaddr, bdaddr_type, local_rpa);
5815
5816	/* Lookup the identity address from the stored connection
5817	* address and address type.
5818	*
5819	* When establishing connections to an identity address, the
5820	* connection procedure will store the resolvable random
5821	* address first. Now if it can be converted back into the
5822	* identity address, start using the identity address from
5823	* now on.
5824	*/
5825	irk = hci_get_irk(hdev, bdaddr: &conn->dst, addr_type: conn->dst_type);
5826	if (irk) {
5827	bacpy(dst: &conn->dst, src: &irk->bdaddr);
5828	conn->dst_type = irk->addr_type;
5829	}
5830
5831	conn->dst_type = ev_bdaddr_type(hdev, type: conn->dst_type, NULL);
5832
5833	/* All connection failure handling is taken care of by the
5834	* hci_conn_failed function which is triggered by the HCI
5835	* request completion callbacks used for connecting.
5836	*/
5837	if (status || hci_conn_set_handle(conn, handle))
5838	goto unlock;
5839
5840	/* Drop the connection if it has been aborted */
5841	if (test_bit(HCI_CONN_CANCEL, &conn->flags)) {
5842	hci_conn_drop(conn);
5843	goto unlock;
5844	}
5845
5846	if (conn->dst_type == ADDR_LE_DEV_PUBLIC)
5847	addr_type = BDADDR_LE_PUBLIC;
5848	else
5849	addr_type = BDADDR_LE_RANDOM;
5850
5851	/* Drop the connection if the device is blocked */
5852	if (hci_bdaddr_list_lookup(list: &hdev->reject_list, bdaddr: &conn->dst, type: addr_type)) {
5853	hci_conn_drop(conn);
5854	goto unlock;
5855	}
5856
5857	mgmt_device_connected(hdev, conn, NULL, name_len: 0);
5858
5859	conn->sec_level = BT_SECURITY_LOW;
5860	conn->state = BT_CONFIG;
5861
5862	/* Store current advertising instance as connection advertising instance
5863	* when sotfware rotation is in use so it can be re-enabled when
5864	* disconnected.
5865	*/
5866	if (!ext_adv_capable(hdev))
5867	conn->adv_instance = hdev->cur_adv_instance;
5868
5869	conn->le_conn_interval = interval;
5870	conn->le_conn_latency = latency;
5871	conn->le_supv_timeout = supervision_timeout;
5872
5873	hci_debugfs_create_conn(conn);
5874	hci_conn_add_sysfs(conn);
5875
5876	/* The remote features procedure is defined for central
5877	* role only. So only in case of an initiated connection
5878	* request the remote features.
5879	*
5880	* If the local controller supports peripheral-initiated features
5881	* exchange, then requesting the remote features in peripheral
5882	* role is possible. Otherwise just transition into the
5883	* connected state without requesting the remote features.
5884	*/
5885	if (conn->out ||
5886	(hdev->le_features[0] & HCI_LE_PERIPHERAL_FEATURES)) {
5887	struct hci_cp_le_read_remote_features cp;
5888
5889	cp.handle = __cpu_to_le16(conn->handle);
5890
5891	hci_send_cmd(hdev, HCI_OP_LE_READ_REMOTE_FEATURES,
5892	plen: sizeof(cp), param: &cp);
5893
5894	hci_conn_hold(conn);
5895	} else {
5896	conn->state = BT_CONNECTED;
5897	hci_connect_cfm(conn, status);
5898	}
5899
5900	params = hci_pend_le_action_lookup(list: &hdev->pend_le_conns, addr: &conn->dst,
5901	addr_type: conn->dst_type);
5902	if (params) {
5903	hci_pend_le_list_del_init(param: params);
5904	if (params->conn) {
5905	hci_conn_drop(conn: params->conn);
5906	hci_conn_put(conn: params->conn);
5907	params->conn = NULL;
5908	}
5909	}
5910
5911	unlock:
5912	hci_update_passive_scan(hdev);
5913	hci_dev_unlock(hdev);
5914	}
5915
5916	static void hci_le_conn_complete_evt(struct hci_dev *hdev, void *data,
5917	struct sk_buff *skb)
5918	{
5919	struct hci_ev_le_conn_complete *ev = data;
5920
5921	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
5922
5923	le_conn_complete_evt(hdev, status: ev->status, bdaddr: &ev->bdaddr, bdaddr_type: ev->bdaddr_type,
5924	NULL, role: ev->role, le16_to_cpu(ev->handle),
5925	le16_to_cpu(ev->interval),
5926	le16_to_cpu(ev->latency),
5927	le16_to_cpu(ev->supervision_timeout));
5928	}
5929
5930	static void hci_le_enh_conn_complete_evt(struct hci_dev *hdev, void *data,
5931	struct sk_buff *skb)
5932	{
5933	struct hci_ev_le_enh_conn_complete *ev = data;
5934
5935	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
5936
5937	le_conn_complete_evt(hdev, status: ev->status, bdaddr: &ev->bdaddr, bdaddr_type: ev->bdaddr_type,
5938	local_rpa: &ev->local_rpa, role: ev->role, le16_to_cpu(ev->handle),
5939	le16_to_cpu(ev->interval),
5940	le16_to_cpu(ev->latency),
5941	le16_to_cpu(ev->supervision_timeout));
5942	}
5943
5944	static void hci_le_ext_adv_term_evt(struct hci_dev *hdev, void *data,
5945	struct sk_buff *skb)
5946	{
5947	struct hci_evt_le_ext_adv_set_term *ev = data;
5948	struct hci_conn *conn;
5949	struct adv_info *adv, *n;
5950
5951	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
5952
5953	/* The Bluetooth Core 5.3 specification clearly states that this event
5954	* shall not be sent when the Host disables the advertising set. So in
5955	* case of HCI_ERROR_CANCELLED_BY_HOST, just ignore the event.
5956	*
5957	* When the Host disables an advertising set, all cleanup is done via
5958	* its command callback and not needed to be duplicated here.
5959	*/
5960	if (ev->status == HCI_ERROR_CANCELLED_BY_HOST) {
5961	bt_dev_warn_ratelimited(hdev, "Unexpected advertising set terminated event");
5962	return;
5963	}
5964
5965	hci_dev_lock(hdev);
5966
5967	adv = hci_find_adv_instance(hdev, instance: ev->handle);
5968
5969	if (ev->status) {
5970	if (!adv)
5971	goto unlock;
5972
5973	/* Remove advertising as it has been terminated */
5974	hci_remove_adv_instance(hdev, instance: ev->handle);
5975	mgmt_advertising_removed(NULL, hdev, instance: ev->handle);
5976
5977	list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) {
5978	if (adv->enabled)
5979	goto unlock;
5980	}
5981
5982	/* We are no longer advertising, clear HCI_LE_ADV */
5983	hci_dev_clear_flag(hdev, HCI_LE_ADV);
5984	goto unlock;
5985	}
5986
5987	if (adv)
5988	adv->enabled = false;
5989
5990	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->conn_handle));
5991	if (conn) {
5992	/* Store handle in the connection so the correct advertising
5993	* instance can be re-enabled when disconnected.
5994	*/
5995	conn->adv_instance = ev->handle;
5996
5997	if (hdev->adv_addr_type != ADDR_LE_DEV_RANDOM ||
5998	bacmp(ba1: &conn->resp_addr, BDADDR_ANY))
5999	goto unlock;
6000
6001	if (!ev->handle) {
6002	bacpy(dst: &conn->resp_addr, src: &hdev->random_addr);
6003	goto unlock;
6004	}
6005
6006	if (adv)
6007	bacpy(dst: &conn->resp_addr, src: &adv->random_addr);
6008	}
6009
6010	unlock:
6011	hci_dev_unlock(hdev);
6012	}
6013
6014	static void hci_le_conn_update_complete_evt(struct hci_dev *hdev, void *data,
6015	struct sk_buff *skb)
6016	{
6017	struct hci_ev_le_conn_update_complete *ev = data;
6018	struct hci_conn *conn;
6019
6020	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
6021
6022	if (ev->status)
6023	return;
6024
6025	hci_dev_lock(hdev);
6026
6027	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
6028	if (conn) {
6029	conn->le_conn_interval = le16_to_cpu(ev->interval);
6030	conn->le_conn_latency = le16_to_cpu(ev->latency);
6031	conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
6032	}
6033
6034	hci_dev_unlock(hdev);
6035	}
6036
6037	/* This function requires the caller holds hdev->lock */
6038	static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev,
6039	bdaddr_t *addr,
6040	u8 addr_type, bool addr_resolved,
6041	u8 adv_type)
6042	{
6043	struct hci_conn *conn;
6044	struct hci_conn_params *params;
6045
6046	/* If the event is not connectable don't proceed further */
6047	if (adv_type != LE_ADV_IND && adv_type != LE_ADV_DIRECT_IND)
6048	return NULL;
6049
6050	/* Ignore if the device is blocked or hdev is suspended */
6051	if (hci_bdaddr_list_lookup(list: &hdev->reject_list, bdaddr: addr, type: addr_type) ||
6052	hdev->suspended)
6053	return NULL;
6054
6055	/* Most controller will fail if we try to create new connections
6056	* while we have an existing one in peripheral role.
6057	*/
6058	if (hdev->conn_hash.le_num_peripheral > 0 &&
6059	(!test_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks) ||
6060	!(hdev->le_states[3] & 0x10)))
6061	return NULL;
6062
6063	/* If we're not connectable only connect devices that we have in
6064	* our pend_le_conns list.
6065	*/
6066	params = hci_pend_le_action_lookup(list: &hdev->pend_le_conns, addr,
6067	addr_type);
6068	if (!params)
6069	return NULL;
6070
6071	if (!params->explicit_connect) {
6072	switch (params->auto_connect) {
6073	case HCI_AUTO_CONN_DIRECT:
6074	/* Only devices advertising with ADV_DIRECT_IND are
6075	* triggering a connection attempt. This is allowing
6076	* incoming connections from peripheral devices.
6077	*/
6078	if (adv_type != LE_ADV_DIRECT_IND)
6079	return NULL;
6080	break;
6081	case HCI_AUTO_CONN_ALWAYS:
6082	/* Devices advertising with ADV_IND or ADV_DIRECT_IND
6083	* are triggering a connection attempt. This means
6084	* that incoming connections from peripheral device are
6085	* accepted and also outgoing connections to peripheral
6086	* devices are established when found.
6087	*/
6088	break;
6089	default:
6090	return NULL;
6091	}
6092	}
6093
6094	conn = hci_connect_le(hdev, dst: addr, dst_type: addr_type, dst_resolved: addr_resolved,
6095	BT_SECURITY_LOW, conn_timeout: hdev->def_le_autoconnect_timeout,
6096	HCI_ROLE_MASTER);
6097	if (!IS_ERR(ptr: conn)) {
6098	/* If HCI_AUTO_CONN_EXPLICIT is set, conn is already owned
6099	* by higher layer that tried to connect, if no then
6100	* store the pointer since we don't really have any
6101	* other owner of the object besides the params that
6102	* triggered it. This way we can abort the connection if
6103	* the parameters get removed and keep the reference
6104	* count consistent once the connection is established.
6105	*/
6106
6107	if (!params->explicit_connect)
6108	params->conn = hci_conn_get(conn);
6109
6110	return conn;
6111	}
6112
6113	switch (PTR_ERR(ptr: conn)) {
6114	case -EBUSY:
6115	/* If hci_connect() returns -EBUSY it means there is already
6116	* an LE connection attempt going on. Since controllers don't
6117	* support more than one connection attempt at the time, we
6118	* don't consider this an error case.
6119	*/
6120	break;
6121	default:
6122	BT_DBG("Failed to connect: err %ld", PTR_ERR(conn));
6123	return NULL;
6124	}
6125
6126	return NULL;
6127	}
6128
6129	static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
6130	u8 bdaddr_type, bdaddr_t *direct_addr,
6131	u8 direct_addr_type, s8 rssi, u8 *data, u8 len,
6132	bool ext_adv, bool ctl_time, u64 instant)
6133	{
6134	struct discovery_state *d = &hdev->discovery;
6135	struct smp_irk *irk;
6136	struct hci_conn *conn;
6137	bool match, bdaddr_resolved;
6138	u32 flags;
6139	u8 *ptr;
6140
6141	switch (type) {
6142	case LE_ADV_IND:
6143	case LE_ADV_DIRECT_IND:
6144	case LE_ADV_SCAN_IND:
6145	case LE_ADV_NONCONN_IND:
6146	case LE_ADV_SCAN_RSP:
6147	break;
6148	default:
6149	bt_dev_err_ratelimited(hdev, "unknown advertising packet "
6150	"type: 0x%02x", type);
6151	return;
6152	}
6153
6154	if (len > max_adv_len(hdev)) {
6155	bt_dev_err_ratelimited(hdev,
6156	"adv larger than maximum supported");
6157	return;
6158	}
6159
6160	/* Find the end of the data in case the report contains padded zero
6161	* bytes at the end causing an invalid length value.
6162	*
6163	* When data is NULL, len is 0 so there is no need for extra ptr
6164	* check as 'ptr < data + 0' is already false in such case.
6165	*/
6166	for (ptr = data; ptr < data + len && *ptr; ptr += *ptr + 1) {
6167	if (ptr + 1 + *ptr > data + len)
6168	break;
6169	}
6170
6171	/* Adjust for actual length. This handles the case when remote
6172	* device is advertising with incorrect data length.
6173	*/
6174	len = ptr - data;
6175
6176	/* If the direct address is present, then this report is from
6177	* a LE Direct Advertising Report event. In that case it is
6178	* important to see if the address is matching the local
6179	* controller address.
6180	*/
6181	if (!hci_dev_test_flag(hdev, HCI_MESH) && direct_addr) {
6182	direct_addr_type = ev_bdaddr_type(hdev, type: direct_addr_type,
6183	resolved: &bdaddr_resolved);
6184
6185	/* Only resolvable random addresses are valid for these
6186	* kind of reports and others can be ignored.
6187	*/
6188	if (!hci_bdaddr_is_rpa(bdaddr: direct_addr, addr_type: direct_addr_type))
6189	return;
6190
6191	/* If the controller is not using resolvable random
6192	* addresses, then this report can be ignored.
6193	*/
6194	if (!hci_dev_test_flag(hdev, HCI_PRIVACY))
6195	return;
6196
6197	/* If the local IRK of the controller does not match
6198	* with the resolvable random address provided, then
6199	* this report can be ignored.
6200	*/
6201	if (!smp_irk_matches(hdev, irk: hdev->irk, bdaddr: direct_addr))
6202	return;
6203	}
6204
6205	/* Check if we need to convert to identity address */
6206	irk = hci_get_irk(hdev, bdaddr, addr_type: bdaddr_type);
6207	if (irk) {
6208	bdaddr = &irk->bdaddr;
6209	bdaddr_type = irk->addr_type;
6210	}
6211
6212	bdaddr_type = ev_bdaddr_type(hdev, type: bdaddr_type, resolved: &bdaddr_resolved);
6213
6214	/* Check if we have been requested to connect to this device.
6215	*
6216	* direct_addr is set only for directed advertising reports (it is NULL
6217	* for advertising reports) and is already verified to be RPA above.
6218	*/
6219	conn = check_pending_le_conn(hdev, addr: bdaddr, addr_type: bdaddr_type, addr_resolved: bdaddr_resolved,
6220	adv_type: type);
6221	if (!ext_adv && conn && type == LE_ADV_IND &&
6222	len <= max_adv_len(hdev)) {
6223	/* Store report for later inclusion by
6224	* mgmt_device_connected
6225	*/
6226	memcpy(conn->le_adv_data, data, len);
6227	conn->le_adv_data_len = len;
6228	}
6229
6230	if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND)
6231	flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
6232	else
6233	flags = 0;
6234
6235	/* All scan results should be sent up for Mesh systems */
6236	if (hci_dev_test_flag(hdev, HCI_MESH)) {
6237	mgmt_device_found(hdev, bdaddr, LE_LINK, addr_type: bdaddr_type, NULL,
6238	rssi, flags, eir: data, eir_len: len, NULL, scan_rsp_len: 0, instant);
6239	return;
6240	}
6241
6242	/* Passive scanning shouldn't trigger any device found events,
6243	* except for devices marked as CONN_REPORT for which we do send
6244	* device found events, or advertisement monitoring requested.
6245	*/
6246	if (hdev->le_scan_type == LE_SCAN_PASSIVE) {
6247	if (type == LE_ADV_DIRECT_IND)
6248	return;
6249
6250	if (!hci_pend_le_action_lookup(list: &hdev->pend_le_reports,
6251	addr: bdaddr, addr_type: bdaddr_type) &&
6252	idr_is_empty(idr: &hdev->adv_monitors_idr))
6253	return;
6254
6255	mgmt_device_found(hdev, bdaddr, LE_LINK, addr_type: bdaddr_type, NULL,
6256	rssi, flags, eir: data, eir_len: len, NULL, scan_rsp_len: 0, instant: 0);
6257	return;
6258	}
6259
6260	/* When receiving a scan response, then there is no way to
6261	* know if the remote device is connectable or not. However
6262	* since scan responses are merged with a previously seen
6263	* advertising report, the flags field from that report
6264	* will be used.
6265	*
6266	* In the unlikely case that a controller just sends a scan
6267	* response event that doesn't match the pending report, then
6268	* it is marked as a standalone SCAN_RSP.
6269	*/
6270	if (type == LE_ADV_SCAN_RSP)
6271	flags = MGMT_DEV_FOUND_SCAN_RSP;
6272
6273	/* If there's nothing pending either store the data from this
6274	* event or send an immediate device found event if the data
6275	* should not be stored for later.
6276	*/
6277	if (!ext_adv && !has_pending_adv_report(hdev)) {
6278	/* If the report will trigger a SCAN_REQ store it for
6279	* later merging.
6280	*/
6281	if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
6282	store_pending_adv_report(hdev, bdaddr, bdaddr_type,
6283	rssi, flags, data, len);
6284	return;
6285	}
6286
6287	mgmt_device_found(hdev, bdaddr, LE_LINK, addr_type: bdaddr_type, NULL,
6288	rssi, flags, eir: data, eir_len: len, NULL, scan_rsp_len: 0, instant: 0);
6289	return;
6290	}
6291
6292	/* Check if the pending report is for the same device as the new one */
6293	match = (!bacmp(ba1: bdaddr, ba2: &d->last_adv_addr) &&
6294	bdaddr_type == d->last_adv_addr_type);
6295
6296	/* If the pending data doesn't match this report or this isn't a
6297	* scan response (e.g. we got a duplicate ADV_IND) then force
6298	* sending of the pending data.
6299	*/
6300	if (type != LE_ADV_SCAN_RSP || !match) {
6301	/* Send out whatever is in the cache, but skip duplicates */
6302	if (!match)
6303	mgmt_device_found(hdev, bdaddr: &d->last_adv_addr, LE_LINK,
6304	addr_type: d->last_adv_addr_type, NULL,
6305	rssi: d->last_adv_rssi, flags: d->last_adv_flags,
6306	eir: d->last_adv_data,
6307	eir_len: d->last_adv_data_len, NULL, scan_rsp_len: 0, instant: 0);
6308
6309	/* If the new report will trigger a SCAN_REQ store it for
6310	* later merging.
6311	*/
6312	if (!ext_adv && (type == LE_ADV_IND ||
6313	type == LE_ADV_SCAN_IND)) {
6314	store_pending_adv_report(hdev, bdaddr, bdaddr_type,
6315	rssi, flags, data, len);
6316	return;
6317	}
6318
6319	/* The advertising reports cannot be merged, so clear
6320	* the pending report and send out a device found event.
6321	*/
6322	clear_pending_adv_report(hdev);
6323	mgmt_device_found(hdev, bdaddr, LE_LINK, addr_type: bdaddr_type, NULL,
6324	rssi, flags, eir: data, eir_len: len, NULL, scan_rsp_len: 0, instant: 0);
6325	return;
6326	}
6327
6328	/* If we get here we've got a pending ADV_IND or ADV_SCAN_IND and
6329	* the new event is a SCAN_RSP. We can therefore proceed with
6330	* sending a merged device found event.
6331	*/
6332	mgmt_device_found(hdev, bdaddr: &d->last_adv_addr, LE_LINK,
6333	addr_type: d->last_adv_addr_type, NULL, rssi, flags: d->last_adv_flags,
6334	eir: d->last_adv_data, eir_len: d->last_adv_data_len, scan_rsp: data, scan_rsp_len: len, instant: 0);
6335	clear_pending_adv_report(hdev);
6336	}
6337
6338	static void hci_le_adv_report_evt(struct hci_dev *hdev, void *data,
6339	struct sk_buff *skb)
6340	{
6341	struct hci_ev_le_advertising_report *ev = data;
6342	u64 instant = jiffies;
6343
6344	if (!ev->num)
6345	return;
6346
6347	hci_dev_lock(hdev);
6348
6349	while (ev->num--) {
6350	struct hci_ev_le_advertising_info *info;
6351	s8 rssi;
6352
6353	info = hci_le_ev_skb_pull(hdev, skb,
6354	HCI_EV_LE_ADVERTISING_REPORT,
6355	len: sizeof(*info));
6356	if (!info)
6357	break;
6358
6359	if (!hci_le_ev_skb_pull(hdev, skb, HCI_EV_LE_ADVERTISING_REPORT,
6360	len: info->length + 1))
6361	break;
6362
6363	if (info->length <= max_adv_len(hdev)) {
6364	rssi = info->data[info->length];
6365	process_adv_report(hdev, type: info->type, bdaddr: &info->bdaddr,
6366	bdaddr_type: info->bdaddr_type, NULL, direct_addr_type: 0, rssi,
6367	data: info->data, len: info->length, ext_adv: false,
6368	ctl_time: false, instant);
6369	} else {
6370	bt_dev_err(hdev, "Dropping invalid advertising data");
6371	}
6372	}
6373
6374	hci_dev_unlock(hdev);
6375	}
6376
6377	static u8 ext_evt_type_to_legacy(struct hci_dev *hdev, u16 evt_type)
6378	{
6379	if (evt_type & LE_EXT_ADV_LEGACY_PDU) {
6380	switch (evt_type) {
6381	case LE_LEGACY_ADV_IND:
6382	return LE_ADV_IND;
6383	case LE_LEGACY_ADV_DIRECT_IND:
6384	return LE_ADV_DIRECT_IND;
6385	case LE_LEGACY_ADV_SCAN_IND:
6386	return LE_ADV_SCAN_IND;
6387	case LE_LEGACY_NONCONN_IND:
6388	return LE_ADV_NONCONN_IND;
6389	case LE_LEGACY_SCAN_RSP_ADV:
6390	case LE_LEGACY_SCAN_RSP_ADV_SCAN:
6391	return LE_ADV_SCAN_RSP;
6392	}
6393
6394	goto invalid;
6395	}
6396
6397	if (evt_type & LE_EXT_ADV_CONN_IND) {
6398	if (evt_type & LE_EXT_ADV_DIRECT_IND)
6399	return LE_ADV_DIRECT_IND;
6400
6401	return LE_ADV_IND;
6402	}
6403
6404	if (evt_type & LE_EXT_ADV_SCAN_RSP)
6405	return LE_ADV_SCAN_RSP;
6406
6407	if (evt_type & LE_EXT_ADV_SCAN_IND)
6408	return LE_ADV_SCAN_IND;
6409
6410	if (evt_type == LE_EXT_ADV_NON_CONN_IND ||
6411	evt_type & LE_EXT_ADV_DIRECT_IND)
6412	return LE_ADV_NONCONN_IND;
6413
6414	invalid:
6415	bt_dev_err_ratelimited(hdev, "Unknown advertising packet type: 0x%02x",
6416	evt_type);
6417
6418	return LE_ADV_INVALID;
6419	}
6420
6421	static void hci_le_ext_adv_report_evt(struct hci_dev *hdev, void *data,
6422	struct sk_buff *skb)
6423	{
6424	struct hci_ev_le_ext_adv_report *ev = data;
6425	u64 instant = jiffies;
6426
6427	if (!ev->num)
6428	return;
6429
6430	hci_dev_lock(hdev);
6431
6432	while (ev->num--) {
6433	struct hci_ev_le_ext_adv_info *info;
6434	u8 legacy_evt_type;
6435	u16 evt_type;
6436
6437	info = hci_le_ev_skb_pull(hdev, skb, HCI_EV_LE_EXT_ADV_REPORT,
6438	len: sizeof(*info));
6439	if (!info)
6440	break;
6441
6442	if (!hci_le_ev_skb_pull(hdev, skb, HCI_EV_LE_EXT_ADV_REPORT,
6443	len: info->length))
6444	break;
6445
6446	evt_type = __le16_to_cpu(info->type) & LE_EXT_ADV_EVT_TYPE_MASK;
6447	legacy_evt_type = ext_evt_type_to_legacy(hdev, evt_type);
6448	if (legacy_evt_type != LE_ADV_INVALID) {
6449	process_adv_report(hdev, type: legacy_evt_type, bdaddr: &info->bdaddr,
6450	bdaddr_type: info->bdaddr_type, NULL, direct_addr_type: 0,
6451	rssi: info->rssi, data: info->data, len: info->length,
6452	ext_adv: !(evt_type & LE_EXT_ADV_LEGACY_PDU),
6453	ctl_time: false, instant);
6454	}
6455	}
6456
6457	hci_dev_unlock(hdev);
6458	}
6459
6460	static int hci_le_pa_term_sync(struct hci_dev *hdev, __le16 handle)
6461	{
6462	struct hci_cp_le_pa_term_sync cp;
6463
6464	memset(&cp, 0, sizeof(cp));
6465	cp.handle = handle;
6466
6467	return hci_send_cmd(hdev, HCI_OP_LE_PA_TERM_SYNC, plen: sizeof(cp), param: &cp);
6468	}
6469
6470	static void hci_le_pa_sync_estabilished_evt(struct hci_dev *hdev, void *data,
6471	struct sk_buff *skb)
6472	{
6473	struct hci_ev_le_pa_sync_established *ev = data;
6474	int mask = hdev->link_mode;
6475	__u8 flags = 0;
6476	struct hci_conn *pa_sync;
6477
6478	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
6479
6480	hci_dev_lock(hdev);
6481
6482	hci_dev_clear_flag(hdev, HCI_PA_SYNC);
6483
6484	mask |= hci_proto_connect_ind(hdev, bdaddr: &ev->bdaddr, ISO_LINK, flags: &flags);
6485	if (!(mask & HCI_LM_ACCEPT)) {
6486	hci_le_pa_term_sync(hdev, handle: ev->handle);
6487	goto unlock;
6488	}
6489
6490	if (!(flags & HCI_PROTO_DEFER))
6491	goto unlock;
6492
6493	if (ev->status) {
6494	/* Add connection to indicate the failed PA sync event */
6495	pa_sync = hci_conn_add_unset(hdev, ISO_LINK, BDADDR_ANY,
6496	HCI_ROLE_SLAVE);
6497
6498	if (!pa_sync)
6499	goto unlock;
6500
6501	set_bit(nr: HCI_CONN_PA_SYNC_FAILED, addr: &pa_sync->flags);
6502
6503	/* Notify iso layer */
6504	hci_connect_cfm(conn: pa_sync, status: ev->status);
6505	}
6506
6507	unlock:
6508	hci_dev_unlock(hdev);
6509	}
6510
6511	static void hci_le_per_adv_report_evt(struct hci_dev *hdev, void *data,
6512	struct sk_buff *skb)
6513	{
6514	struct hci_ev_le_per_adv_report *ev = data;
6515	int mask = hdev->link_mode;
6516	__u8 flags = 0;
6517
6518	bt_dev_dbg(hdev, "sync_handle 0x%4.4x", le16_to_cpu(ev->sync_handle));
6519
6520	hci_dev_lock(hdev);
6521
6522	mask |= hci_proto_connect_ind(hdev, BDADDR_ANY, ISO_LINK, flags: &flags);
6523	if (!(mask & HCI_LM_ACCEPT))
6524	hci_le_pa_term_sync(hdev, handle: ev->sync_handle);
6525
6526	hci_dev_unlock(hdev);
6527	}
6528
6529	static void hci_le_remote_feat_complete_evt(struct hci_dev *hdev, void *data,
6530	struct sk_buff *skb)
6531	{
6532	struct hci_ev_le_remote_feat_complete *ev = data;
6533	struct hci_conn *conn;
6534
6535	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
6536
6537	hci_dev_lock(hdev);
6538
6539	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
6540	if (conn) {
6541	if (!ev->status)
6542	memcpy(conn->features[0], ev->features, 8);
6543
6544	if (conn->state == BT_CONFIG) {
6545	__u8 status;
6546
6547	/* If the local controller supports peripheral-initiated
6548	* features exchange, but the remote controller does
6549	* not, then it is possible that the error code 0x1a
6550	* for unsupported remote feature gets returned.
6551	*
6552	* In this specific case, allow the connection to
6553	* transition into connected state and mark it as
6554	* successful.
6555	*/
6556	if (!conn->out && ev->status == HCI_ERROR_UNSUPPORTED_REMOTE_FEATURE &&
6557	(hdev->le_features[0] & HCI_LE_PERIPHERAL_FEATURES))
6558	status = 0x00;
6559	else
6560	status = ev->status;
6561
6562	conn->state = BT_CONNECTED;
6563	hci_connect_cfm(conn, status);
6564	hci_conn_drop(conn);
6565	}
6566	}
6567
6568	hci_dev_unlock(hdev);
6569	}
6570
6571	static void hci_le_ltk_request_evt(struct hci_dev *hdev, void *data,
6572	struct sk_buff *skb)
6573	{
6574	struct hci_ev_le_ltk_req *ev = data;
6575	struct hci_cp_le_ltk_reply cp;
6576	struct hci_cp_le_ltk_neg_reply neg;
6577	struct hci_conn *conn;
6578	struct smp_ltk *ltk;
6579
6580	bt_dev_dbg(hdev, "handle 0x%4.4x", __le16_to_cpu(ev->handle));
6581
6582	hci_dev_lock(hdev);
6583
6584	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
6585	if (conn == NULL)
6586	goto not_found;
6587
6588	ltk = hci_find_ltk(hdev, bdaddr: &conn->dst, addr_type: conn->dst_type, role: conn->role);
6589	if (!ltk)
6590	goto not_found;
6591
6592	if (smp_ltk_is_sc(key: ltk)) {
6593	/* With SC both EDiv and Rand are set to zero */
6594	if (ev->ediv || ev->rand)
6595	goto not_found;
6596	} else {
6597	/* For non-SC keys check that EDiv and Rand match */
6598	if (ev->ediv != ltk->ediv || ev->rand != ltk->rand)
6599	goto not_found;
6600	}
6601
6602	memcpy(cp.ltk, ltk->val, ltk->enc_size);
6603	memset(cp.ltk + ltk->enc_size, 0, sizeof(cp.ltk) - ltk->enc_size);
6604	cp.handle = cpu_to_le16(conn->handle);
6605
6606	conn->pending_sec_level = smp_ltk_sec_level(key: ltk);
6607
6608	conn->enc_key_size = ltk->enc_size;
6609
6610	hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, plen: sizeof(cp), param: &cp);
6611
6612	/* Ref. Bluetooth Core SPEC pages 1975 and 2004. STK is a
6613	* temporary key used to encrypt a connection following
6614	* pairing. It is used during the Encrypted Session Setup to
6615	* distribute the keys. Later, security can be re-established
6616	* using a distributed LTK.
6617	*/
6618	if (ltk->type == SMP_STK) {
6619	set_bit(nr: HCI_CONN_STK_ENCRYPT, addr: &conn->flags);
6620	list_del_rcu(entry: &ltk->list);
6621	kfree_rcu(ltk, rcu);
6622	} else {
6623	clear_bit(nr: HCI_CONN_STK_ENCRYPT, addr: &conn->flags);
6624	}
6625
6626	hci_dev_unlock(hdev);
6627
6628	return;
6629
6630	not_found:
6631	neg.handle = ev->handle;
6632	hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, plen: sizeof(neg), param: &neg);
6633	hci_dev_unlock(hdev);
6634	}
6635
6636	static void send_conn_param_neg_reply(struct hci_dev *hdev, u16 handle,
6637	u8 reason)
6638	{
6639	struct hci_cp_le_conn_param_req_neg_reply cp;
6640
6641	cp.handle = cpu_to_le16(handle);
6642	cp.reason = reason;
6643
6644	hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_NEG_REPLY, plen: sizeof(cp),
6645	param: &cp);
6646	}
6647
6648	static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev, void *data,
6649	struct sk_buff *skb)
6650	{
6651	struct hci_ev_le_remote_conn_param_req *ev = data;
6652	struct hci_cp_le_conn_param_req_reply cp;
6653	struct hci_conn *hcon;
6654	u16 handle, min, max, latency, timeout;
6655
6656	bt_dev_dbg(hdev, "handle 0x%4.4x", __le16_to_cpu(ev->handle));
6657
6658	handle = le16_to_cpu(ev->handle);
6659	min = le16_to_cpu(ev->interval_min);
6660	max = le16_to_cpu(ev->interval_max);
6661	latency = le16_to_cpu(ev->latency);
6662	timeout = le16_to_cpu(ev->timeout);
6663
6664	hcon = hci_conn_hash_lookup_handle(hdev, handle);
6665	if (!hcon || hcon->state != BT_CONNECTED)
6666	return send_conn_param_neg_reply(hdev, handle,
6667	HCI_ERROR_UNKNOWN_CONN_ID);
6668
6669	if (max > hcon->le_conn_max_interval)
6670	return send_conn_param_neg_reply(hdev, handle,
6671	HCI_ERROR_INVALID_LL_PARAMS);
6672
6673	if (hci_check_conn_params(min, max, latency, to_multiplier: timeout))
6674	return send_conn_param_neg_reply(hdev, handle,
6675	HCI_ERROR_INVALID_LL_PARAMS);
6676
6677	if (hcon->role == HCI_ROLE_MASTER) {
6678	struct hci_conn_params *params;
6679	u8 store_hint;
6680
6681	hci_dev_lock(hdev);
6682
6683	params = hci_conn_params_lookup(hdev, addr: &hcon->dst,
6684	addr_type: hcon->dst_type);
6685	if (params) {
6686	params->conn_min_interval = min;
6687	params->conn_max_interval = max;
6688	params->conn_latency = latency;
6689	params->supervision_timeout = timeout;
6690	store_hint = 0x01;
6691	} else {
6692	store_hint = 0x00;
6693	}
6694
6695	hci_dev_unlock(hdev);
6696
6697	mgmt_new_conn_param(hdev, bdaddr: &hcon->dst, bdaddr_type: hcon->dst_type,
6698	store_hint, min_interval: min, max_interval: max, latency, timeout);
6699	}
6700
6701	cp.handle = ev->handle;
6702	cp.interval_min = ev->interval_min;
6703	cp.interval_max = ev->interval_max;
6704	cp.latency = ev->latency;
6705	cp.timeout = ev->timeout;
6706	cp.min_ce_len = 0;
6707	cp.max_ce_len = 0;
6708
6709	hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_REPLY, plen: sizeof(cp), param: &cp);
6710	}
6711
6712	static void hci_le_direct_adv_report_evt(struct hci_dev *hdev, void *data,
6713	struct sk_buff *skb)
6714	{
6715	struct hci_ev_le_direct_adv_report *ev = data;
6716	u64 instant = jiffies;
6717	int i;
6718
6719	if (!hci_le_ev_skb_pull(hdev, skb, HCI_EV_LE_DIRECT_ADV_REPORT,
6720	flex_array_size(ev, info, ev->num)))
6721	return;
6722
6723	if (!ev->num)
6724	return;
6725
6726	hci_dev_lock(hdev);
6727
6728	for (i = 0; i < ev->num; i++) {
6729	struct hci_ev_le_direct_adv_info *info = &ev->info[i];
6730
6731	process_adv_report(hdev, type: info->type, bdaddr: &info->bdaddr,
6732	bdaddr_type: info->bdaddr_type, direct_addr: &info->direct_addr,
6733	direct_addr_type: info->direct_addr_type, rssi: info->rssi, NULL, len: 0,
6734	ext_adv: false, ctl_time: false, instant);
6735	}
6736
6737	hci_dev_unlock(hdev);
6738	}
6739
6740	static void hci_le_phy_update_evt(struct hci_dev *hdev, void *data,
6741	struct sk_buff *skb)
6742	{
6743	struct hci_ev_le_phy_update_complete *ev = data;
6744	struct hci_conn *conn;
6745
6746	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
6747
6748	if (ev->status)
6749	return;
6750
6751	hci_dev_lock(hdev);
6752
6753	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
6754	if (!conn)
6755	goto unlock;
6756
6757	conn->le_tx_phy = ev->tx_phy;
6758	conn->le_rx_phy = ev->rx_phy;
6759
6760	unlock:
6761	hci_dev_unlock(hdev);
6762	}
6763
6764	static void hci_le_cis_estabilished_evt(struct hci_dev *hdev, void *data,
6765	struct sk_buff *skb)
6766	{
6767	struct hci_evt_le_cis_established *ev = data;
6768	struct hci_conn *conn;
6769	struct bt_iso_qos *qos;
6770	bool pending = false;
6771	u16 handle = __le16_to_cpu(ev->handle);
6772
6773	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
6774
6775	hci_dev_lock(hdev);
6776
6777	conn = hci_conn_hash_lookup_handle(hdev, handle);
6778	if (!conn) {
6779	bt_dev_err(hdev,
6780	"Unable to find connection with handle 0x%4.4x",
6781	handle);
6782	goto unlock;
6783	}
6784
6785	if (conn->type != ISO_LINK) {
6786	bt_dev_err(hdev,
6787	"Invalid connection link type handle 0x%4.4x",
6788	handle);
6789	goto unlock;
6790	}
6791
6792	qos = &conn->iso_qos;
6793
6794	pending = test_and_clear_bit(nr: HCI_CONN_CREATE_CIS, addr: &conn->flags);
6795
6796	/* Convert ISO Interval (1.25 ms slots) to SDU Interval (us) */
6797	qos->ucast.in.interval = le16_to_cpu(ev->interval) * 1250;
6798	qos->ucast.out.interval = qos->ucast.in.interval;
6799
6800	switch (conn->role) {
6801	case HCI_ROLE_SLAVE:
6802	/* Convert Transport Latency (us) to Latency (msec) */
6803	qos->ucast.in.latency =
6804	DIV_ROUND_CLOSEST(get_unaligned_le24(ev->c_latency),
6805	1000);
6806	qos->ucast.out.latency =
6807	DIV_ROUND_CLOSEST(get_unaligned_le24(ev->p_latency),
6808	1000);
6809	qos->ucast.in.sdu = le16_to_cpu(ev->c_mtu);
6810	qos->ucast.out.sdu = le16_to_cpu(ev->p_mtu);
6811	qos->ucast.in.phy = ev->c_phy;
6812	qos->ucast.out.phy = ev->p_phy;
6813	break;
6814	case HCI_ROLE_MASTER:
6815	/* Convert Transport Latency (us) to Latency (msec) */
6816	qos->ucast.out.latency =
6817	DIV_ROUND_CLOSEST(get_unaligned_le24(ev->c_latency),
6818	1000);
6819	qos->ucast.in.latency =
6820	DIV_ROUND_CLOSEST(get_unaligned_le24(ev->p_latency),
6821	1000);
6822	qos->ucast.out.sdu = le16_to_cpu(ev->c_mtu);
6823	qos->ucast.in.sdu = le16_to_cpu(ev->p_mtu);
6824	qos->ucast.out.phy = ev->c_phy;
6825	qos->ucast.in.phy = ev->p_phy;
6826	break;
6827	}
6828
6829	if (!ev->status) {
6830	conn->state = BT_CONNECTED;
6831	hci_debugfs_create_conn(conn);
6832	hci_conn_add_sysfs(conn);
6833	hci_iso_setup_path(conn);
6834	goto unlock;
6835	}
6836
6837	conn->state = BT_CLOSED;
6838	hci_connect_cfm(conn, status: ev->status);
6839	hci_conn_del(conn);
6840
6841	unlock:
6842	if (pending)
6843	hci_le_create_cis_pending(hdev);
6844
6845	hci_dev_unlock(hdev);
6846	}
6847
6848	static void hci_le_reject_cis(struct hci_dev *hdev, __le16 handle)
6849	{
6850	struct hci_cp_le_reject_cis cp;
6851
6852	memset(&cp, 0, sizeof(cp));
6853	cp.handle = handle;
6854	cp.reason = HCI_ERROR_REJ_BAD_ADDR;
6855	hci_send_cmd(hdev, HCI_OP_LE_REJECT_CIS, plen: sizeof(cp), param: &cp);
6856	}
6857
6858	static void hci_le_accept_cis(struct hci_dev *hdev, __le16 handle)
6859	{
6860	struct hci_cp_le_accept_cis cp;
6861
6862	memset(&cp, 0, sizeof(cp));
6863	cp.handle = handle;
6864	hci_send_cmd(hdev, HCI_OP_LE_ACCEPT_CIS, plen: sizeof(cp), param: &cp);
6865	}
6866
6867	static void hci_le_cis_req_evt(struct hci_dev *hdev, void *data,
6868	struct sk_buff *skb)
6869	{
6870	struct hci_evt_le_cis_req *ev = data;
6871	u16 acl_handle, cis_handle;
6872	struct hci_conn *acl, *cis;
6873	int mask;
6874	__u8 flags = 0;
6875
6876	acl_handle = __le16_to_cpu(ev->acl_handle);
6877	cis_handle = __le16_to_cpu(ev->cis_handle);
6878
6879	bt_dev_dbg(hdev, "acl 0x%4.4x handle 0x%4.4x cig 0x%2.2x cis 0x%2.2x",
6880	acl_handle, cis_handle, ev->cig_id, ev->cis_id);
6881
6882	hci_dev_lock(hdev);
6883
6884	acl = hci_conn_hash_lookup_handle(hdev, handle: acl_handle);
6885	if (!acl)
6886	goto unlock;
6887
6888	mask = hci_proto_connect_ind(hdev, bdaddr: &acl->dst, ISO_LINK, flags: &flags);
6889	if (!(mask & HCI_LM_ACCEPT)) {
6890	hci_le_reject_cis(hdev, handle: ev->cis_handle);
6891	goto unlock;
6892	}
6893
6894	cis = hci_conn_hash_lookup_handle(hdev, handle: cis_handle);
6895	if (!cis) {
6896	cis = hci_conn_add(hdev, ISO_LINK, dst: &acl->dst, HCI_ROLE_SLAVE,
6897	handle: cis_handle);
6898	if (!cis) {
6899	hci_le_reject_cis(hdev, handle: ev->cis_handle);
6900	goto unlock;
6901	}
6902	}
6903
6904	cis->iso_qos.ucast.cig = ev->cig_id;
6905	cis->iso_qos.ucast.cis = ev->cis_id;
6906
6907	if (!(flags & HCI_PROTO_DEFER)) {
6908	hci_le_accept_cis(hdev, handle: ev->cis_handle);
6909	} else {
6910	cis->state = BT_CONNECT2;
6911	hci_connect_cfm(conn: cis, status: 0);
6912	}
6913
6914	unlock:
6915	hci_dev_unlock(hdev);
6916	}
6917
6918	static int hci_iso_term_big_sync(struct hci_dev *hdev, void *data)
6919	{
6920	u8 handle = PTR_UINT(data);
6921
6922	return hci_le_terminate_big_sync(hdev, handle,
6923	HCI_ERROR_LOCAL_HOST_TERM);
6924	}
6925
6926	static void hci_le_create_big_complete_evt(struct hci_dev *hdev, void *data,
6927	struct sk_buff *skb)
6928	{
6929	struct hci_evt_le_create_big_complete *ev = data;
6930	struct hci_conn *conn;
6931	__u8 i = 0;
6932
6933	BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
6934
6935	if (!hci_le_ev_skb_pull(hdev, skb, HCI_EVT_LE_CREATE_BIG_COMPLETE,
6936	flex_array_size(ev, bis_handle, ev->num_bis)))
6937	return;
6938
6939	hci_dev_lock(hdev);
6940	rcu_read_lock();
6941
6942	/* Connect all BISes that are bound to the BIG */
6943	list_for_each_entry_rcu(conn, &hdev->conn_hash.list, list) {
6944	if (bacmp(ba1: &conn->dst, BDADDR_ANY) ||
6945	conn->type != ISO_LINK ||
6946	conn->iso_qos.bcast.big != ev->handle)
6947	continue;
6948
6949	if (hci_conn_set_handle(conn,
6950	__le16_to_cpu(ev->bis_handle[i++])))
6951	continue;
6952
6953	if (!ev->status) {
6954	conn->state = BT_CONNECTED;
6955	set_bit(nr: HCI_CONN_BIG_CREATED, addr: &conn->flags);
6956	rcu_read_unlock();
6957	hci_debugfs_create_conn(conn);
6958	hci_conn_add_sysfs(conn);
6959	hci_iso_setup_path(conn);
6960	rcu_read_lock();
6961	continue;
6962	}
6963
6964	hci_connect_cfm(conn, status: ev->status);
6965	rcu_read_unlock();
6966	hci_conn_del(conn);
6967	rcu_read_lock();
6968	}
6969
6970	rcu_read_unlock();
6971
6972	if (!ev->status && !i)
6973	/* If no BISes have been connected for the BIG,
6974	* terminate. This is in case all bound connections
6975	* have been closed before the BIG creation
6976	* has completed.
6977	*/
6978	hci_cmd_sync_queue(hdev, func: hci_iso_term_big_sync,
6979	UINT_PTR(ev->handle), NULL);
6980
6981	hci_dev_unlock(hdev);
6982	}
6983
6984	static void hci_le_big_sync_established_evt(struct hci_dev *hdev, void *data,
6985	struct sk_buff *skb)
6986	{
6987	struct hci_evt_le_big_sync_estabilished *ev = data;
6988	struct hci_conn *bis;
6989	int i;
6990
6991	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
6992
6993	if (!hci_le_ev_skb_pull(hdev, skb, HCI_EVT_LE_BIG_SYNC_ESTABILISHED,
6994	flex_array_size(ev, bis, ev->num_bis)))
6995	return;
6996
6997	hci_dev_lock(hdev);
6998
6999	for (i = 0; i < ev->num_bis; i++) {
7000	u16 handle = le16_to_cpu(ev->bis[i]);
7001	__le32 interval;
7002
7003	bis = hci_conn_hash_lookup_handle(hdev, handle);
7004	if (!bis) {
7005	bis = hci_conn_add(hdev, ISO_LINK, BDADDR_ANY,
7006	HCI_ROLE_SLAVE, handle);
7007	if (!bis)
7008	continue;
7009	}
7010
7011	if (ev->status != 0x42)
7012	/* Mark PA sync as established */
7013	set_bit(nr: HCI_CONN_PA_SYNC, addr: &bis->flags);
7014
7015	bis->iso_qos.bcast.big = ev->handle;
7016	memset(&interval, 0, sizeof(interval));
7017	memcpy(&interval, ev->latency, sizeof(ev->latency));
7018	bis->iso_qos.bcast.in.interval = le32_to_cpu(interval);
7019	/* Convert ISO Interval (1.25 ms slots) to latency (ms) */
7020	bis->iso_qos.bcast.in.latency = le16_to_cpu(ev->interval) * 125 / 100;
7021	bis->iso_qos.bcast.in.sdu = le16_to_cpu(ev->max_pdu);
7022
7023	if (!ev->status) {
7024	set_bit(nr: HCI_CONN_BIG_SYNC, addr: &bis->flags);
7025	hci_iso_setup_path(conn: bis);
7026	}
7027	}
7028
7029	/* In case BIG sync failed, notify each failed connection to
7030	* the user after all hci connections have been added
7031	*/
7032	if (ev->status)
7033	for (i = 0; i < ev->num_bis; i++) {
7034	u16 handle = le16_to_cpu(ev->bis[i]);
7035
7036	bis = hci_conn_hash_lookup_handle(hdev, handle);
7037
7038	set_bit(nr: HCI_CONN_BIG_SYNC_FAILED, addr: &bis->flags);
7039	hci_connect_cfm(conn: bis, status: ev->status);
7040	}
7041
7042	hci_dev_unlock(hdev);
7043	}
7044
7045	static void hci_le_big_info_adv_report_evt(struct hci_dev *hdev, void *data,
7046	struct sk_buff *skb)
7047	{
7048	struct hci_evt_le_big_info_adv_report *ev = data;
7049	int mask = hdev->link_mode;
7050	__u8 flags = 0;
7051	struct hci_conn *pa_sync;
7052
7053	bt_dev_dbg(hdev, "sync_handle 0x%4.4x", le16_to_cpu(ev->sync_handle));
7054
7055	hci_dev_lock(hdev);
7056
7057	mask |= hci_proto_connect_ind(hdev, BDADDR_ANY, ISO_LINK, flags: &flags);
7058	if (!(mask & HCI_LM_ACCEPT)) {
7059	hci_le_pa_term_sync(hdev, handle: ev->sync_handle);
7060	goto unlock;
7061	}
7062
7063	if (!(flags & HCI_PROTO_DEFER))
7064	goto unlock;
7065
7066	pa_sync = hci_conn_hash_lookup_pa_sync_handle
7067	(hdev,
7068	le16_to_cpu(ev->sync_handle));
7069
7070	if (pa_sync)
7071	goto unlock;
7072
7073	/* Add connection to indicate the PA sync event */
7074	pa_sync = hci_conn_add_unset(hdev, ISO_LINK, BDADDR_ANY,
7075	HCI_ROLE_SLAVE);
7076
7077	if (!pa_sync)
7078	goto unlock;
7079
7080	pa_sync->sync_handle = le16_to_cpu(ev->sync_handle);
7081	set_bit(nr: HCI_CONN_PA_SYNC, addr: &pa_sync->flags);
7082
7083	/* Notify iso layer */
7084	hci_connect_cfm(conn: pa_sync, status: 0x00);
7085
7086	/* Notify MGMT layer */
7087	mgmt_device_connected(hdev, conn: pa_sync, NULL, name_len: 0);
7088
7089	unlock:
7090	hci_dev_unlock(hdev);
7091	}
7092
7093	#define HCI_LE_EV_VL(_op, _func, _min_len, _max_len) \
7094	[_op] = { \
7095	.func = _func, \
7096	.min_len = _min_len, \
7097	.max_len = _max_len, \
7098	}
7099
7100	#define HCI_LE_EV(_op, _func, _len) \
7101	HCI_LE_EV_VL(_op, _func, _len, _len)
7102
7103	#define HCI_LE_EV_STATUS(_op, _func) \
7104	HCI_LE_EV(_op, _func, sizeof(struct hci_ev_status))
7105
7106	/* Entries in this table shall have their position according to the subevent
7107	* opcode they handle so the use of the macros above is recommend since it does
7108	* attempt to initialize at its proper index using Designated Initializers that
7109	* way events without a callback function can be ommited.
7110	*/
7111	static const struct hci_le_ev {
7112	void (*func)(struct hci_dev *hdev, void *data, struct sk_buff *skb);
7113	u16 min_len;
7114	u16 max_len;
7115	} hci_le_ev_table[U8_MAX + 1] = {
7116	/* [0x01 = HCI_EV_LE_CONN_COMPLETE] */
7117	HCI_LE_EV(HCI_EV_LE_CONN_COMPLETE, hci_le_conn_complete_evt,
7118	sizeof(struct hci_ev_le_conn_complete)),
7119	/* [0x02 = HCI_EV_LE_ADVERTISING_REPORT] */
7120	HCI_LE_EV_VL(HCI_EV_LE_ADVERTISING_REPORT, hci_le_adv_report_evt,
7121	sizeof(struct hci_ev_le_advertising_report),
7122	HCI_MAX_EVENT_SIZE),
7123	/* [0x03 = HCI_EV_LE_CONN_UPDATE_COMPLETE] */
7124	HCI_LE_EV(HCI_EV_LE_CONN_UPDATE_COMPLETE,
7125	hci_le_conn_update_complete_evt,
7126	sizeof(struct hci_ev_le_conn_update_complete)),
7127	/* [0x04 = HCI_EV_LE_REMOTE_FEAT_COMPLETE] */
7128	HCI_LE_EV(HCI_EV_LE_REMOTE_FEAT_COMPLETE,
7129	hci_le_remote_feat_complete_evt,
7130	sizeof(struct hci_ev_le_remote_feat_complete)),
7131	/* [0x05 = HCI_EV_LE_LTK_REQ] */
7132	HCI_LE_EV(HCI_EV_LE_LTK_REQ, hci_le_ltk_request_evt,
7133	sizeof(struct hci_ev_le_ltk_req)),
7134	/* [0x06 = HCI_EV_LE_REMOTE_CONN_PARAM_REQ] */
7135	HCI_LE_EV(HCI_EV_LE_REMOTE_CONN_PARAM_REQ,
7136	hci_le_remote_conn_param_req_evt,
7137	sizeof(struct hci_ev_le_remote_conn_param_req)),
7138	/* [0x0a = HCI_EV_LE_ENHANCED_CONN_COMPLETE] */
7139	HCI_LE_EV(HCI_EV_LE_ENHANCED_CONN_COMPLETE,
7140	hci_le_enh_conn_complete_evt,
7141	sizeof(struct hci_ev_le_enh_conn_complete)),
7142	/* [0x0b = HCI_EV_LE_DIRECT_ADV_REPORT] */
7143	HCI_LE_EV_VL(HCI_EV_LE_DIRECT_ADV_REPORT, hci_le_direct_adv_report_evt,
7144	sizeof(struct hci_ev_le_direct_adv_report),
7145	HCI_MAX_EVENT_SIZE),
7146	/* [0x0c = HCI_EV_LE_PHY_UPDATE_COMPLETE] */
7147	HCI_LE_EV(HCI_EV_LE_PHY_UPDATE_COMPLETE, hci_le_phy_update_evt,
7148	sizeof(struct hci_ev_le_phy_update_complete)),
7149	/* [0x0d = HCI_EV_LE_EXT_ADV_REPORT] */
7150	HCI_LE_EV_VL(HCI_EV_LE_EXT_ADV_REPORT, hci_le_ext_adv_report_evt,
7151	sizeof(struct hci_ev_le_ext_adv_report),
7152	HCI_MAX_EVENT_SIZE),
7153	/* [0x0e = HCI_EV_LE_PA_SYNC_ESTABLISHED] */
7154	HCI_LE_EV(HCI_EV_LE_PA_SYNC_ESTABLISHED,
7155	hci_le_pa_sync_estabilished_evt,
7156	sizeof(struct hci_ev_le_pa_sync_established)),
7157	/* [0x0f = HCI_EV_LE_PER_ADV_REPORT] */
7158	HCI_LE_EV_VL(HCI_EV_LE_PER_ADV_REPORT,
7159	hci_le_per_adv_report_evt,
7160	sizeof(struct hci_ev_le_per_adv_report),
7161	HCI_MAX_EVENT_SIZE),
7162	/* [0x12 = HCI_EV_LE_EXT_ADV_SET_TERM] */
7163	HCI_LE_EV(HCI_EV_LE_EXT_ADV_SET_TERM, hci_le_ext_adv_term_evt,
7164	sizeof(struct hci_evt_le_ext_adv_set_term)),
7165	/* [0x19 = HCI_EVT_LE_CIS_ESTABLISHED] */
7166	HCI_LE_EV(HCI_EVT_LE_CIS_ESTABLISHED, hci_le_cis_estabilished_evt,
7167	sizeof(struct hci_evt_le_cis_established)),
7168	/* [0x1a = HCI_EVT_LE_CIS_REQ] */
7169	HCI_LE_EV(HCI_EVT_LE_CIS_REQ, hci_le_cis_req_evt,
7170	sizeof(struct hci_evt_le_cis_req)),
7171	/* [0x1b = HCI_EVT_LE_CREATE_BIG_COMPLETE] */
7172	HCI_LE_EV_VL(HCI_EVT_LE_CREATE_BIG_COMPLETE,
7173	hci_le_create_big_complete_evt,
7174	sizeof(struct hci_evt_le_create_big_complete),
7175	HCI_MAX_EVENT_SIZE),
7176	/* [0x1d = HCI_EV_LE_BIG_SYNC_ESTABILISHED] */
7177	HCI_LE_EV_VL(HCI_EVT_LE_BIG_SYNC_ESTABILISHED,
7178	hci_le_big_sync_established_evt,
7179	sizeof(struct hci_evt_le_big_sync_estabilished),
7180	HCI_MAX_EVENT_SIZE),
7181	/* [0x22 = HCI_EVT_LE_BIG_INFO_ADV_REPORT] */
7182	HCI_LE_EV_VL(HCI_EVT_LE_BIG_INFO_ADV_REPORT,
7183	hci_le_big_info_adv_report_evt,
7184	sizeof(struct hci_evt_le_big_info_adv_report),
7185	HCI_MAX_EVENT_SIZE),
7186	};
7187
7188	static void hci_le_meta_evt(struct hci_dev *hdev, void *data,
7189	struct sk_buff *skb, u16 *opcode, u8 *status,
7190	hci_req_complete_t *req_complete,
7191	hci_req_complete_skb_t *req_complete_skb)
7192	{
7193	struct hci_ev_le_meta *ev = data;
7194	const struct hci_le_ev *subev;
7195
7196	bt_dev_dbg(hdev, "subevent 0x%2.2x", ev->subevent);
7197
7198	/* Only match event if command OGF is for LE */
7199	if (hdev->req_skb &&
7200	hci_opcode_ogf(hci_skb_opcode(hdev->req_skb)) == 0x08 &&
7201	hci_skb_event(hdev->req_skb) == ev->subevent) {
7202	*opcode = hci_skb_opcode(hdev->req_skb);
7203	hci_req_cmd_complete(hdev, opcode: *opcode, status: 0x00, req_complete,
7204	req_complete_skb);
7205	}
7206
7207	subev = &hci_le_ev_table[ev->subevent];
7208	if (!subev->func)
7209	return;
7210
7211	if (skb->len < subev->min_len) {
7212	bt_dev_err(hdev, "unexpected subevent 0x%2.2x length: %u < %u",
7213	ev->subevent, skb->len, subev->min_len);
7214	return;
7215	}
7216
7217	/* Just warn if the length is over max_len size it still be
7218	* possible to partially parse the event so leave to callback to
7219	* decide if that is acceptable.
7220	*/
7221	if (skb->len > subev->max_len)
7222	bt_dev_warn(hdev, "unexpected subevent 0x%2.2x length: %u > %u",
7223	ev->subevent, skb->len, subev->max_len);
7224	data = hci_le_ev_skb_pull(hdev, skb, ev: ev->subevent, len: subev->min_len);
7225	if (!data)
7226	return;
7227
7228	subev->func(hdev, data, skb);
7229	}
7230
7231	static bool hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode,
7232	u8 event, struct sk_buff *skb)
7233	{
7234	struct hci_ev_cmd_complete *ev;
7235	struct hci_event_hdr *hdr;
7236
7237	if (!skb)
7238	return false;
7239
7240	hdr = hci_ev_skb_pull(hdev, skb, ev: event, len: sizeof(*hdr));
7241	if (!hdr)
7242	return false;
7243
7244	if (event) {
7245	if (hdr->evt != event)
7246	return false;
7247	return true;
7248	}
7249
7250	/* Check if request ended in Command Status - no way to retrieve
7251	* any extra parameters in this case.
7252	*/
7253	if (hdr->evt == HCI_EV_CMD_STATUS)
7254	return false;
7255
7256	if (hdr->evt != HCI_EV_CMD_COMPLETE) {
7257	bt_dev_err(hdev, "last event is not cmd complete (0x%2.2x)",
7258	hdr->evt);
7259	return false;
7260	}
7261
7262	ev = hci_cc_skb_pull(hdev, skb, op: opcode, len: sizeof(*ev));
7263	if (!ev)
7264	return false;
7265
7266	if (opcode != __le16_to_cpu(ev->opcode)) {
7267	BT_DBG("opcode doesn't match (0x%2.2x != 0x%2.2x)", opcode,
7268	__le16_to_cpu(ev->opcode));
7269	return false;
7270	}
7271
7272	return true;
7273	}
7274
7275	static void hci_store_wake_reason(struct hci_dev *hdev, u8 event,
7276	struct sk_buff *skb)
7277	{
7278	struct hci_ev_le_advertising_info *adv;
7279	struct hci_ev_le_direct_adv_info *direct_adv;
7280	struct hci_ev_le_ext_adv_info *ext_adv;
7281	const struct hci_ev_conn_complete *conn_complete = (void *)skb->data;
7282	const struct hci_ev_conn_request *conn_request = (void *)skb->data;
7283
7284	hci_dev_lock(hdev);
7285
7286	/* If we are currently suspended and this is the first BT event seen,
7287	* save the wake reason associated with the event.
7288	*/
7289	if (!hdev->suspended || hdev->wake_reason)
7290	goto unlock;
7291
7292	/* Default to remote wake. Values for wake_reason are documented in the
7293	* Bluez mgmt api docs.
7294	*/
7295	hdev->wake_reason = MGMT_WAKE_REASON_REMOTE_WAKE;
7296
7297	/* Once configured for remote wakeup, we should only wake up for
7298	* reconnections. It's useful to see which device is waking us up so
7299	* keep track of the bdaddr of the connection event that woke us up.
7300	*/
7301	if (event == HCI_EV_CONN_REQUEST) {
7302	bacpy(dst: &hdev->wake_addr, src: &conn_request->bdaddr);
7303	hdev->wake_addr_type = BDADDR_BREDR;
7304	} else if (event == HCI_EV_CONN_COMPLETE) {
7305	bacpy(dst: &hdev->wake_addr, src: &conn_complete->bdaddr);
7306	hdev->wake_addr_type = BDADDR_BREDR;
7307	} else if (event == HCI_EV_LE_META) {
7308	struct hci_ev_le_meta *le_ev = (void *)skb->data;
7309	u8 subevent = le_ev->subevent;
7310	u8 *ptr = &skb->data[sizeof(*le_ev)];
7311	u8 num_reports = *ptr;
7312
7313	if ((subevent == HCI_EV_LE_ADVERTISING_REPORT ||
7314	subevent == HCI_EV_LE_DIRECT_ADV_REPORT ||
7315	subevent == HCI_EV_LE_EXT_ADV_REPORT) &&
7316	num_reports) {
7317	adv = (void *)(ptr + 1);
7318	direct_adv = (void *)(ptr + 1);
7319	ext_adv = (void *)(ptr + 1);
7320
7321	switch (subevent) {
7322	case HCI_EV_LE_ADVERTISING_REPORT:
7323	bacpy(dst: &hdev->wake_addr, src: &adv->bdaddr);
7324	hdev->wake_addr_type = adv->bdaddr_type;
7325	break;
7326	case HCI_EV_LE_DIRECT_ADV_REPORT:
7327	bacpy(dst: &hdev->wake_addr, src: &direct_adv->bdaddr);
7328	hdev->wake_addr_type = direct_adv->bdaddr_type;
7329	break;
7330	case HCI_EV_LE_EXT_ADV_REPORT:
7331	bacpy(dst: &hdev->wake_addr, src: &ext_adv->bdaddr);
7332	hdev->wake_addr_type = ext_adv->bdaddr_type;
7333	break;
7334	}
7335	}
7336	} else {
7337	hdev->wake_reason = MGMT_WAKE_REASON_UNEXPECTED;
7338	}
7339
7340	unlock:
7341	hci_dev_unlock(hdev);
7342	}
7343
7344	#define HCI_EV_VL(_op, _func, _min_len, _max_len) \
7345	[_op] = { \
7346	.req = false, \
7347	.func = _func, \
7348	.min_len = _min_len, \
7349	.max_len = _max_len, \
7350	}
7351
7352	#define HCI_EV(_op, _func, _len) \
7353	HCI_EV_VL(_op, _func, _len, _len)
7354
7355	#define HCI_EV_STATUS(_op, _func) \
7356	HCI_EV(_op, _func, sizeof(struct hci_ev_status))
7357
7358	#define HCI_EV_REQ_VL(_op, _func, _min_len, _max_len) \
7359	[_op] = { \
7360	.req = true, \
7361	.func_req = _func, \
7362	.min_len = _min_len, \
7363	.max_len = _max_len, \
7364	}
7365
7366	#define HCI_EV_REQ(_op, _func, _len) \
7367	HCI_EV_REQ_VL(_op, _func, _len, _len)
7368
7369	/* Entries in this table shall have their position according to the event opcode
7370	* they handle so the use of the macros above is recommend since it does attempt
7371	* to initialize at its proper index using Designated Initializers that way
7372	* events without a callback function don't have entered.
7373	*/
7374	static const struct hci_ev {
7375	bool req;
7376	union {
7377	void (*func)(struct hci_dev *hdev, void *data,
7378	struct sk_buff *skb);
7379	void (*func_req)(struct hci_dev *hdev, void *data,
7380	struct sk_buff *skb, u16 *opcode, u8 *status,
7381	hci_req_complete_t *req_complete,
7382	hci_req_complete_skb_t *req_complete_skb);
7383	};
7384	u16 min_len;
7385	u16 max_len;
7386	} hci_ev_table[U8_MAX + 1] = {
7387	/* [0x01 = HCI_EV_INQUIRY_COMPLETE] */
7388	HCI_EV_STATUS(HCI_EV_INQUIRY_COMPLETE, hci_inquiry_complete_evt),
7389	/* [0x02 = HCI_EV_INQUIRY_RESULT] */
7390	HCI_EV_VL(HCI_EV_INQUIRY_RESULT, hci_inquiry_result_evt,
7391	sizeof(struct hci_ev_inquiry_result), HCI_MAX_EVENT_SIZE),
7392	/* [0x03 = HCI_EV_CONN_COMPLETE] */
7393	HCI_EV(HCI_EV_CONN_COMPLETE, hci_conn_complete_evt,
7394	sizeof(struct hci_ev_conn_complete)),
7395	/* [0x04 = HCI_EV_CONN_REQUEST] */
7396	HCI_EV(HCI_EV_CONN_REQUEST, hci_conn_request_evt,
7397	sizeof(struct hci_ev_conn_request)),
7398	/* [0x05 = HCI_EV_DISCONN_COMPLETE] */
7399	HCI_EV(HCI_EV_DISCONN_COMPLETE, hci_disconn_complete_evt,
7400	sizeof(struct hci_ev_disconn_complete)),
7401	/* [0x06 = HCI_EV_AUTH_COMPLETE] */
7402	HCI_EV(HCI_EV_AUTH_COMPLETE, hci_auth_complete_evt,
7403	sizeof(struct hci_ev_auth_complete)),
7404	/* [0x07 = HCI_EV_REMOTE_NAME] */
7405	HCI_EV(HCI_EV_REMOTE_NAME, hci_remote_name_evt,
7406	sizeof(struct hci_ev_remote_name)),
7407	/* [0x08 = HCI_EV_ENCRYPT_CHANGE] */
7408	HCI_EV(HCI_EV_ENCRYPT_CHANGE, hci_encrypt_change_evt,
7409	sizeof(struct hci_ev_encrypt_change)),
7410	/* [0x09 = HCI_EV_CHANGE_LINK_KEY_COMPLETE] */
7411	HCI_EV(HCI_EV_CHANGE_LINK_KEY_COMPLETE,
7412	hci_change_link_key_complete_evt,
7413	sizeof(struct hci_ev_change_link_key_complete)),
7414	/* [0x0b = HCI_EV_REMOTE_FEATURES] */
7415	HCI_EV(HCI_EV_REMOTE_FEATURES, hci_remote_features_evt,
7416	sizeof(struct hci_ev_remote_features)),
7417	/* [0x0e = HCI_EV_CMD_COMPLETE] */
7418	HCI_EV_REQ_VL(HCI_EV_CMD_COMPLETE, hci_cmd_complete_evt,
7419	sizeof(struct hci_ev_cmd_complete), HCI_MAX_EVENT_SIZE),
7420	/* [0x0f = HCI_EV_CMD_STATUS] */
7421	HCI_EV_REQ(HCI_EV_CMD_STATUS, hci_cmd_status_evt,
7422	sizeof(struct hci_ev_cmd_status)),
7423	/* [0x10 = HCI_EV_CMD_STATUS] */
7424	HCI_EV(HCI_EV_HARDWARE_ERROR, hci_hardware_error_evt,
7425	sizeof(struct hci_ev_hardware_error)),
7426	/* [0x12 = HCI_EV_ROLE_CHANGE] */
7427	HCI_EV(HCI_EV_ROLE_CHANGE, hci_role_change_evt,
7428	sizeof(struct hci_ev_role_change)),
7429	/* [0x13 = HCI_EV_NUM_COMP_PKTS] */
7430	HCI_EV_VL(HCI_EV_NUM_COMP_PKTS, hci_num_comp_pkts_evt,
7431	sizeof(struct hci_ev_num_comp_pkts), HCI_MAX_EVENT_SIZE),
7432	/* [0x14 = HCI_EV_MODE_CHANGE] */
7433	HCI_EV(HCI_EV_MODE_CHANGE, hci_mode_change_evt,
7434	sizeof(struct hci_ev_mode_change)),
7435	/* [0x16 = HCI_EV_PIN_CODE_REQ] */
7436	HCI_EV(HCI_EV_PIN_CODE_REQ, hci_pin_code_request_evt,
7437	sizeof(struct hci_ev_pin_code_req)),
7438	/* [0x17 = HCI_EV_LINK_KEY_REQ] */
7439	HCI_EV(HCI_EV_LINK_KEY_REQ, hci_link_key_request_evt,
7440	sizeof(struct hci_ev_link_key_req)),
7441	/* [0x18 = HCI_EV_LINK_KEY_NOTIFY] */
7442	HCI_EV(HCI_EV_LINK_KEY_NOTIFY, hci_link_key_notify_evt,
7443	sizeof(struct hci_ev_link_key_notify)),
7444	/* [0x1c = HCI_EV_CLOCK_OFFSET] */
7445	HCI_EV(HCI_EV_CLOCK_OFFSET, hci_clock_offset_evt,
7446	sizeof(struct hci_ev_clock_offset)),
7447	/* [0x1d = HCI_EV_PKT_TYPE_CHANGE] */
7448	HCI_EV(HCI_EV_PKT_TYPE_CHANGE, hci_pkt_type_change_evt,
7449	sizeof(struct hci_ev_pkt_type_change)),
7450	/* [0x20 = HCI_EV_PSCAN_REP_MODE] */
7451	HCI_EV(HCI_EV_PSCAN_REP_MODE, hci_pscan_rep_mode_evt,
7452	sizeof(struct hci_ev_pscan_rep_mode)),
7453	/* [0x22 = HCI_EV_INQUIRY_RESULT_WITH_RSSI] */
7454	HCI_EV_VL(HCI_EV_INQUIRY_RESULT_WITH_RSSI,
7455	hci_inquiry_result_with_rssi_evt,
7456	sizeof(struct hci_ev_inquiry_result_rssi),
7457	HCI_MAX_EVENT_SIZE),
7458	/* [0x23 = HCI_EV_REMOTE_EXT_FEATURES] */
7459	HCI_EV(HCI_EV_REMOTE_EXT_FEATURES, hci_remote_ext_features_evt,
7460	sizeof(struct hci_ev_remote_ext_features)),
7461	/* [0x2c = HCI_EV_SYNC_CONN_COMPLETE] */
7462	HCI_EV(HCI_EV_SYNC_CONN_COMPLETE, hci_sync_conn_complete_evt,
7463	sizeof(struct hci_ev_sync_conn_complete)),
7464	/* [0x2d = HCI_EV_EXTENDED_INQUIRY_RESULT] */
7465	HCI_EV_VL(HCI_EV_EXTENDED_INQUIRY_RESULT,
7466	hci_extended_inquiry_result_evt,
7467	sizeof(struct hci_ev_ext_inquiry_result), HCI_MAX_EVENT_SIZE),
7468	/* [0x30 = HCI_EV_KEY_REFRESH_COMPLETE] */
7469	HCI_EV(HCI_EV_KEY_REFRESH_COMPLETE, hci_key_refresh_complete_evt,
7470	sizeof(struct hci_ev_key_refresh_complete)),
7471	/* [0x31 = HCI_EV_IO_CAPA_REQUEST] */
7472	HCI_EV(HCI_EV_IO_CAPA_REQUEST, hci_io_capa_request_evt,
7473	sizeof(struct hci_ev_io_capa_request)),
7474	/* [0x32 = HCI_EV_IO_CAPA_REPLY] */
7475	HCI_EV(HCI_EV_IO_CAPA_REPLY, hci_io_capa_reply_evt,
7476	sizeof(struct hci_ev_io_capa_reply)),
7477	/* [0x33 = HCI_EV_USER_CONFIRM_REQUEST] */
7478	HCI_EV(HCI_EV_USER_CONFIRM_REQUEST, hci_user_confirm_request_evt,
7479	sizeof(struct hci_ev_user_confirm_req)),
7480	/* [0x34 = HCI_EV_USER_PASSKEY_REQUEST] */
7481	HCI_EV(HCI_EV_USER_PASSKEY_REQUEST, hci_user_passkey_request_evt,
7482	sizeof(struct hci_ev_user_passkey_req)),
7483	/* [0x35 = HCI_EV_REMOTE_OOB_DATA_REQUEST] */
7484	HCI_EV(HCI_EV_REMOTE_OOB_DATA_REQUEST, hci_remote_oob_data_request_evt,
7485	sizeof(struct hci_ev_remote_oob_data_request)),
7486	/* [0x36 = HCI_EV_SIMPLE_PAIR_COMPLETE] */
7487	HCI_EV(HCI_EV_SIMPLE_PAIR_COMPLETE, hci_simple_pair_complete_evt,
7488	sizeof(struct hci_ev_simple_pair_complete)),
7489	/* [0x3b = HCI_EV_USER_PASSKEY_NOTIFY] */
7490	HCI_EV(HCI_EV_USER_PASSKEY_NOTIFY, hci_user_passkey_notify_evt,
7491	sizeof(struct hci_ev_user_passkey_notify)),
7492	/* [0x3c = HCI_EV_KEYPRESS_NOTIFY] */
7493	HCI_EV(HCI_EV_KEYPRESS_NOTIFY, hci_keypress_notify_evt,
7494	sizeof(struct hci_ev_keypress_notify)),
7495	/* [0x3d = HCI_EV_REMOTE_HOST_FEATURES] */
7496	HCI_EV(HCI_EV_REMOTE_HOST_FEATURES, hci_remote_host_features_evt,
7497	sizeof(struct hci_ev_remote_host_features)),
7498	/* [0x3e = HCI_EV_LE_META] */
7499	HCI_EV_REQ_VL(HCI_EV_LE_META, hci_le_meta_evt,
7500	sizeof(struct hci_ev_le_meta), HCI_MAX_EVENT_SIZE),
7501	/* [0x48 = HCI_EV_NUM_COMP_BLOCKS] */
7502	HCI_EV(HCI_EV_NUM_COMP_BLOCKS, hci_num_comp_blocks_evt,
7503	sizeof(struct hci_ev_num_comp_blocks)),
7504	/* [0xff = HCI_EV_VENDOR] */
7505	HCI_EV_VL(HCI_EV_VENDOR, msft_vendor_evt, 0, HCI_MAX_EVENT_SIZE),
7506	};
7507
7508	static void hci_event_func(struct hci_dev *hdev, u8 event, struct sk_buff *skb,
7509	u16 *opcode, u8 *status,
7510	hci_req_complete_t *req_complete,
7511	hci_req_complete_skb_t *req_complete_skb)
7512	{
7513	const struct hci_ev *ev = &hci_ev_table[event];
7514	void *data;
7515
7516	if (!ev->func)
7517	return;
7518
7519	if (skb->len < ev->min_len) {
7520	bt_dev_err(hdev, "unexpected event 0x%2.2x length: %u < %u",
7521	event, skb->len, ev->min_len);
7522	return;
7523	}
7524
7525	/* Just warn if the length is over max_len size it still be
7526	* possible to partially parse the event so leave to callback to
7527	* decide if that is acceptable.
7528	*/
7529	if (skb->len > ev->max_len)
7530	bt_dev_warn_ratelimited(hdev,
7531	"unexpected event 0x%2.2x length: %u > %u",
7532	event, skb->len, ev->max_len);
7533
7534	data = hci_ev_skb_pull(hdev, skb, ev: event, len: ev->min_len);
7535	if (!data)
7536	return;
7537
7538	if (ev->req)
7539	ev->func_req(hdev, data, skb, opcode, status, req_complete,
7540	req_complete_skb);
7541	else
7542	ev->func(hdev, data, skb);
7543	}
7544
7545	void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
7546	{
7547	struct hci_event_hdr *hdr = (void *) skb->data;
7548	hci_req_complete_t req_complete = NULL;
7549	hci_req_complete_skb_t req_complete_skb = NULL;
7550	struct sk_buff *orig_skb = NULL;
7551	u8 status = 0, event, req_evt = 0;
7552	u16 opcode = HCI_OP_NOP;
7553
7554	if (skb->len < sizeof(*hdr)) {
7555	bt_dev_err(hdev, "Malformed HCI Event");
7556	goto done;
7557	}
7558
7559	kfree_skb(skb: hdev->recv_event);
7560	hdev->recv_event = skb_clone(skb, GFP_KERNEL);
7561
7562	event = hdr->evt;
7563	if (!event) {
7564	bt_dev_warn(hdev, "Received unexpected HCI Event 0x%2.2x",
7565	event);
7566	goto done;
7567	}
7568
7569	/* Only match event if command OGF is not for LE */
7570	if (hdev->req_skb &&
7571	hci_opcode_ogf(hci_skb_opcode(hdev->req_skb)) != 0x08 &&
7572	hci_skb_event(hdev->req_skb) == event) {
7573	hci_req_cmd_complete(hdev, hci_skb_opcode(hdev->req_skb),
7574	status, req_complete: &req_complete, req_complete_skb: &req_complete_skb);
7575	req_evt = event;
7576	}
7577
7578	/* If it looks like we might end up having to call
7579	* req_complete_skb, store a pristine copy of the skb since the
7580	* various handlers may modify the original one through
7581	* skb_pull() calls, etc.
7582	*/
7583	if (req_complete_skb || event == HCI_EV_CMD_STATUS ||
7584	event == HCI_EV_CMD_COMPLETE)
7585	orig_skb = skb_clone(skb, GFP_KERNEL);
7586
7587	skb_pull(skb, HCI_EVENT_HDR_SIZE);
7588
7589	/* Store wake reason if we're suspended */
7590	hci_store_wake_reason(hdev, event, skb);
7591
7592	bt_dev_dbg(hdev, "event 0x%2.2x", event);
7593
7594	hci_event_func(hdev, event, skb, opcode: &opcode, status: &status, req_complete: &req_complete,
7595	req_complete_skb: &req_complete_skb);
7596
7597	if (req_complete) {
7598	req_complete(hdev, status, opcode);
7599	} else if (req_complete_skb) {
7600	if (!hci_get_cmd_complete(hdev, opcode, event: req_evt, skb: orig_skb)) {
7601	kfree_skb(skb: orig_skb);
7602	orig_skb = NULL;
7603	}
7604	req_complete_skb(hdev, status, opcode, orig_skb);
7605	}
7606
7607	done:
7608	kfree_skb(skb: orig_skb);
7609	kfree_skb(skb);
7610	hdev->stat.evt_rx++;
7611	}
7612