forked from ~ljy/RK356X_SDK_RELEASE

blame | history | patch | commit | commitdiff
hc
2024-10-22 8ac6c7a54ed1b98d142dce24b11c6de6a1e239a5 
 kernel/net/bluetooth/hci_event.c
....@@ -35,6 +35,7 @@
3535 #include "a2mp.h"
3636 #include "amp.h"
3737 #include "smp.h"
38
+#include "msft.h"
3839 
3940 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
4041 		 "\x00\x00\x00\x00\x00\x00\x00\x00"
....@@ -594,6 +595,51 @@
594595 		memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
595596 }
596597 
598
+static void hci_cc_read_auth_payload_timeout(struct hci_dev *hdev,
599
+					     struct sk_buff *skb)
600
+{
601
+	struct hci_rp_read_auth_payload_to *rp = (void *)skb->data;
602
+	struct hci_conn *conn;
603
+
604
+	BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
605
+
606
+	if (rp->status)
607
+		return;
608
+
609
+	hci_dev_lock(hdev);
610
+
611
+	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
612
+	if (conn)
613
+		conn->auth_payload_timeout = __le16_to_cpu(rp->timeout);
614
+
615
+	hci_dev_unlock(hdev);
616
+}
617
+
618
+static void hci_cc_write_auth_payload_timeout(struct hci_dev *hdev,
619
+					      struct sk_buff *skb)
620
+{
621
+	struct hci_rp_write_auth_payload_to *rp = (void *)skb->data;
622
+	struct hci_conn *conn;
623
+	void *sent;
624
+
625
+	BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
626
+
627
+	if (rp->status)
628
+		return;
629
+
630
+	sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_PAYLOAD_TO);
631
+	if (!sent)
632
+		return;
633
+
634
+	hci_dev_lock(hdev);
635
+
636
+	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
637
+	if (conn)
638
+		conn->auth_payload_timeout = get_unaligned_le16(sent + 2);
639
+
640
+	hci_dev_unlock(hdev);
641
+}
642
+
597643 static void hci_cc_read_local_features(struct hci_dev *hdev,
598644 				       struct sk_buff *skb)
599645 {
....@@ -714,6 +760,23 @@
714760 
715761 	if (hci_dev_test_flag(hdev, HCI_SETUP))
716762 		bacpy(&hdev->setup_addr, &rp->bdaddr);
763
+}
764
+
765
+static void hci_cc_read_local_pairing_opts(struct hci_dev *hdev,
766
+					   struct sk_buff *skb)
767
+{
768
+	struct hci_rp_read_local_pairing_opts *rp = (void *) skb->data;
769
+
770
+	BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
771
+
772
+	if (rp->status)
773
+		return;
774
+
775
+	if (hci_dev_test_flag(hdev, HCI_SETUP) ||
776
+	    hci_dev_test_flag(hdev, HCI_CONFIG)) {
777
+		hdev->pairing_opts = rp->pairing_opts;
778
+		hdev->max_enc_key_size = rp->max_key_size;
779
+	}
717780 }
718781 
719782 static void hci_cc_read_page_scan_activity(struct hci_dev *hdev,
....@@ -869,6 +932,37 @@
869932 		return;
870933 
871934 	hdev->inq_tx_power = rp->tx_power;
935
+}
936
+
937
+static void hci_cc_read_def_err_data_reporting(struct hci_dev *hdev,
938
+					       struct sk_buff *skb)
939
+{
940
+	struct hci_rp_read_def_err_data_reporting *rp = (void *)skb->data;
941
+
942
+	BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
943
+
944
+	if (rp->status)
945
+		return;
946
+
947
+	hdev->err_data_reporting = rp->err_data_reporting;
948
+}
949
+
950
+static void hci_cc_write_def_err_data_reporting(struct hci_dev *hdev,
951
+						struct sk_buff *skb)
952
+{
953
+	__u8 status = *((__u8 *)skb->data);
954
+	struct hci_cp_write_def_err_data_reporting *cp;
955
+
956
+	BT_DBG("%s status 0x%2.2x", hdev->name, status);
957
+
958
+	if (status)
959
+		return;
960
+
961
+	cp = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_ERR_DATA_REPORTING);
962
+	if (!cp)
963
+		return;
964
+
965
+	hdev->err_data_reporting = cp->err_data_reporting;
872966 }
873967 
874968 static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
....@@ -1470,6 +1564,45 @@
14701564 
14711565 	hdev->le_def_tx_len = le16_to_cpu(sent->tx_len);
14721566 	hdev->le_def_tx_time = le16_to_cpu(sent->tx_time);
1567
+}
1568
+
1569
+static void hci_cc_le_add_to_resolv_list(struct hci_dev *hdev,
1570
+					 struct sk_buff *skb)
1571
+{
1572
+	struct hci_cp_le_add_to_resolv_list *sent;
1573
+	__u8 status = *((__u8 *) skb->data);
1574
+
1575
+	BT_DBG("%s status 0x%2.2x", hdev->name, status);
1576
+
1577
+	if (status)
1578
+		return;
1579
+
1580
+	sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_RESOLV_LIST);
1581
+	if (!sent)
1582
+		return;
1583
+
1584
+	hci_bdaddr_list_add_with_irk(&hdev->le_resolv_list, &sent->bdaddr,
1585
+				sent->bdaddr_type, sent->peer_irk,
1586
+				sent->local_irk);
1587
+}
1588
+
1589
+static void hci_cc_le_del_from_resolv_list(struct hci_dev *hdev,
1590
+					  struct sk_buff *skb)
1591
+{
1592
+	struct hci_cp_le_del_from_resolv_list *sent;
1593
+	__u8 status = *((__u8 *) skb->data);
1594
+
1595
+	BT_DBG("%s status 0x%2.2x", hdev->name, status);
1596
+
1597
+	if (status)
1598
+		return;
1599
+
1600
+	sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_RESOLV_LIST);
1601
+	if (!sent)
1602
+		return;
1603
+
1604
+	hci_bdaddr_list_del_with_irk(&hdev->le_resolv_list, &sent->bdaddr,
1605
+			    sent->bdaddr_type);
14731606 }
14741607 
14751608 static void hci_cc_le_clear_resolv_list(struct hci_dev *hdev,
....@@ -2136,9 +2269,21 @@
21362269 	hci_dev_lock(hdev);
21372270 
21382271 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2139
-	if (conn)
2272
+	if (conn) {
2273
+		u8 type = conn->type;
2274
+
21402275 		mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
21412276 				       conn->dst_type, status);
2277
+
2278
+		/* If the disconnection failed for any reason, the upper layer
2279
+		 * does not retry to disconnect in current implementation.
2280
+		 * Hence, we need to do some basic cleanup here and re-enable
2281
+		 * advertising if necessary.
2282
+		 */
2283
+		hci_conn_del(conn);
2284
+		if (type == LE_LINK)
2285
+			hci_req_reenable_advertising(hdev);
2286
+	}
21422287 
21432288 	hci_dev_unlock(hdev);
21442289 }
....@@ -2153,6 +2298,22 @@
21532298 				       peer_addr_type);
21542299 	if (!conn)
21552300 		return;
2301
+
2302
+	/* When using controller based address resolution, then the new
2303
+	 * address types 0x02 and 0x03 are used. These types need to be
2304
+	 * converted back into either public address or random address type
2305
+	 */
2306
+	if (use_ll_privacy(hdev) &&
2307
+	    hci_dev_test_flag(hdev, HCI_LL_RPA_RESOLUTION)) {
2308
+		switch (own_address_type) {
2309
+		case ADDR_LE_DEV_PUBLIC_RESOLVED:
2310
+			own_address_type = ADDR_LE_DEV_PUBLIC;
2311
+			break;
2312
+		case ADDR_LE_DEV_RANDOM_RESOLVED:
2313
+			own_address_type = ADDR_LE_DEV_RANDOM;
2314
+			break;
2315
+		}
2316
+	}
21562317 
21572318 	/* Store the initiator and responder address information which
21582319 	 * is needed for SMP. These values will not change during the
....@@ -2416,14 +2577,36 @@
24162577 
24172578 	conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
24182579 	if (!conn) {
2419
-		if (ev->link_type != SCO_LINK)
2420
-			goto unlock;
2580
+		/* Connection may not exist if auto-connected. Check the bredr
2581
+		 * allowlist to see if this device is allowed to auto connect.
2582
+		 * If link is an ACL type, create a connection class
2583
+		 * automatically.
2584
+		 *
2585
+		 * Auto-connect will only occur if the event filter is
2586
+		 * programmed with a given address. Right now, event filter is
2587
+		 * only used during suspend.
2588
+		 */
2589
+		if (ev->link_type == ACL_LINK &&
2590
+		    hci_bdaddr_list_lookup_with_flags(&hdev->whitelist,
2591
+						      &ev->bdaddr,
2592
+						      BDADDR_BREDR)) {
2593
+			conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr,
2594
+					    HCI_ROLE_SLAVE);
2595
+			if (!conn) {
2596
+				bt_dev_err(hdev, "no memory for new conn");
2597
+				goto unlock;
2598
+			}
2599
+		} else {
2600
+			if (ev->link_type != SCO_LINK)
2601
+				goto unlock;
24212602 
2422
-		conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
2423
-		if (!conn)
2424
-			goto unlock;
2603
+			conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK,
2604
+						       &ev->bdaddr);
2605
+			if (!conn)
2606
+				goto unlock;
24252607 
2426
-		conn->type = SCO_LINK;
2608
+			conn->type = SCO_LINK;
2609
+		}
24272610 	}
24282611 
24292612 	if (!ev->status) {
....@@ -2481,8 +2664,16 @@
24812664 	if (ev->status) {
24822665 		hci_connect_cfm(conn, ev->status);
24832666 		hci_conn_del(conn);
2484
-	} else if (ev->link_type != ACL_LINK)
2667
+	} else if (ev->link_type == SCO_LINK) {
2668
+		switch (conn->setting & SCO_AIRMODE_MASK) {
2669
+		case SCO_AIRMODE_CVSD:
2670
+			if (hdev->notify)
2671
+				hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_CVSD);
2672
+			break;
2673
+		}
2674
+
24852675 		hci_connect_cfm(conn, ev->status);
2676
+	}
24862677 
24872678 unlock:
24882679 	hci_dev_unlock(hdev);
....@@ -2530,10 +2721,10 @@
25302721 	 */
25312722 	if (hci_dev_test_flag(hdev, HCI_MGMT) &&
25322723 	    !hci_dev_test_flag(hdev, HCI_CONNECTABLE) &&
2533
-	    !hci_bdaddr_list_lookup(&hdev->whitelist, &ev->bdaddr,
2534
-				    BDADDR_BREDR)) {
2535
-		    hci_reject_conn(hdev, &ev->bdaddr);
2536
-		    return;
2724
+	    !hci_bdaddr_list_lookup_with_flags(&hdev->whitelist, &ev->bdaddr,
2725
+					       BDADDR_BREDR)) {
2726
+		hci_reject_conn(hdev, &ev->bdaddr);
2727
+		return;
25372728 	}
25382729 
25392730 	/* Connection accepted */
....@@ -2568,9 +2759,9 @@
25682759 		bacpy(&cp.bdaddr, &ev->bdaddr);
25692760 
25702761 		if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
2571
-			cp.role = 0x00; /* Become master */
2762
+			cp.role = 0x00; /* Become central */
25722763 		else
2573
-			cp.role = 0x01; /* Remain slave */
2764
+			cp.role = 0x01; /* Remain peripheral */
25742765 
25752766 		hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
25762767 	} else if (!(flags & HCI_PROTO_DEFER)) {
....@@ -2658,7 +2849,7 @@
26582849 		case HCI_AUTO_CONN_LINK_LOSS:
26592850 			if (ev->reason != HCI_ERROR_CONNECTION_TIMEOUT)
26602851 				break;
2661
-			/* Fall through */
2852
+			fallthrough;
26622853 
26632854 		case HCI_AUTO_CONN_DIRECT:
26642855 		case HCI_AUTO_CONN_ALWAYS:
....@@ -2676,6 +2867,14 @@
26762867 
26772868 	hci_disconn_cfm(conn, ev->reason);
26782869 	hci_conn_del(conn);
2870
+
2871
+	/* The suspend notifier is waiting for all devices to disconnect so
2872
+	 * clear the bit from pending tasks and inform the wait queue.
2873
+	 */
2874
+	if (list_empty(&hdev->conn_hash.list) &&
2875
+	    test_and_clear_bit(SUSPEND_DISCONNECTING, hdev->suspend_tasks)) {
2876
+		wake_up(&hdev->suspend_wait_q);
2877
+	}
26792878 
26802879 	/* Re-enable advertising if necessary, since it might
26812880 	 * have been disabled by the connection. From the
....@@ -2829,14 +3028,14 @@
28293028 	if (!conn)
28303029 		goto unlock;
28313030 
2832
-	/* If we fail to read the encryption key size, assume maximum
2833
-	 * (which is the same we do also when this HCI command isn't
2834
-	 * supported.
3031
+	/* While unexpected, the read_enc_key_size command may fail. The most
3032
+	 * secure approach is to then assume the key size is 0 to force a
3033
+	 * disconnection.
28353034 	 */
28363035 	if (rp->status) {
28373036 		bt_dev_err(hdev, "failed to read key size for handle %u",
28383037 			   handle);
2839
-		conn->enc_key_size = HCI_LINK_KEY_SIZE;
3038
+		conn->enc_key_size = 0;
28403039 	} else {
28413040 		conn->enc_key_size = rp->key_size;
28423041 	}
....@@ -2933,6 +3132,25 @@
29333132 		}
29343133 
29353134 		goto unlock;
3135
+	}
3136
+
3137
+	/* Set the default Authenticated Payload Timeout after
3138
+	 * an LE Link is established. As per Core Spec v5.0, Vol 2, Part B
3139
+	 * Section 3.3, the HCI command WRITE_AUTH_PAYLOAD_TIMEOUT should be
3140
+	 * sent when the link is active and Encryption is enabled, the conn
3141
+	 * type can be either LE or ACL and controller must support LMP Ping.
3142
+	 * Ensure for AES-CCM encryption as well.
3143
+	 */
3144
+	if (test_bit(HCI_CONN_ENCRYPT, &conn->flags) &&
3145
+	    test_bit(HCI_CONN_AES_CCM, &conn->flags) &&
3146
+	    ((conn->type == ACL_LINK && lmp_ping_capable(hdev)) ||
3147
+	     (conn->type == LE_LINK && (hdev->le_features[0] & HCI_LE_PING)))) {
3148
+		struct hci_cp_write_auth_payload_to cp;
3149
+
3150
+		cp.handle = cpu_to_le16(conn->handle);
3151
+		cp.timeout = cpu_to_le16(hdev->auth_payload_timeout);
3152
+		hci_send_cmd(conn->hdev, HCI_OP_WRITE_AUTH_PAYLOAD_TO,
3153
+			     sizeof(cp), &cp);
29363154 	}
29373155 
29383156 notify:
....@@ -3123,6 +3341,14 @@
31233341 		hci_cc_write_sc_support(hdev, skb);
31243342 		break;
31253343 
3344
+	case HCI_OP_READ_AUTH_PAYLOAD_TO:
3345
+		hci_cc_read_auth_payload_timeout(hdev, skb);
3346
+		break;
3347
+
3348
+	case HCI_OP_WRITE_AUTH_PAYLOAD_TO:
3349
+		hci_cc_write_auth_payload_timeout(hdev, skb);
3350
+		break;
3351
+
31263352 	case HCI_OP_READ_LOCAL_VERSION:
31273353 		hci_cc_read_local_version(hdev, skb);
31283354 		break;
....@@ -3145,6 +3371,10 @@
31453371 
31463372 	case HCI_OP_READ_BD_ADDR:
31473373 		hci_cc_read_bd_addr(hdev, skb);
3374
+		break;
3375
+
3376
+	case HCI_OP_READ_LOCAL_PAIRING_OPTS:
3377
+		hci_cc_read_local_pairing_opts(hdev, skb);
31483378 		break;
31493379 
31503380 	case HCI_OP_READ_PAGE_SCAN_ACTIVITY:
....@@ -3181,6 +3411,14 @@
31813411 
31823412 	case HCI_OP_READ_INQ_RSP_TX_POWER:
31833413 		hci_cc_read_inq_rsp_tx_power(hdev, skb);
3414
+		break;
3415
+
3416
+	case HCI_OP_READ_DEF_ERR_DATA_REPORTING:
3417
+		hci_cc_read_def_err_data_reporting(hdev, skb);
3418
+		break;
3419
+
3420
+	case HCI_OP_WRITE_DEF_ERR_DATA_REPORTING:
3421
+		hci_cc_write_def_err_data_reporting(hdev, skb);
31843422 		break;
31853423 
31863424 	case HCI_OP_PIN_CODE_REPLY:
....@@ -3269,6 +3507,14 @@
32693507 
32703508 	case HCI_OP_LE_WRITE_DEF_DATA_LEN:
32713509 		hci_cc_le_write_def_data_len(hdev, skb);
3510
+		break;
3511
+
3512
+	case HCI_OP_LE_ADD_TO_RESOLV_LIST:
3513
+		hci_cc_le_add_to_resolv_list(hdev, skb);
3514
+		break;
3515
+
3516
+	case HCI_OP_LE_DEL_FROM_RESOLV_LIST:
3517
+		hci_cc_le_del_from_resolv_list(hdev, skb);
32723518 		break;
32733519 
32743520 	case HCI_OP_LE_CLEAR_RESOLV_LIST:
....@@ -3513,8 +3759,8 @@
35133759 		return;
35143760 	}
35153761 
3516
-	if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
3517
-	    ev->num_hndl * sizeof(struct hci_comp_pkts_info)) {
3762
+	if (skb->len < sizeof(*ev) ||
3763
+	    skb->len < struct_size(ev, handles, ev->num_hndl)) {
35183764 		BT_DBG("%s bad parameters", hdev->name);
35193765 		return;
35203766 	}
....@@ -3601,8 +3847,8 @@
36013847 		return;
36023848 	}
36033849 
3604
-	if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
3605
-	    ev->num_hndl * sizeof(struct hci_comp_blocks_info)) {
3850
+	if (skb->len < sizeof(*ev) ||
3851
+	    skb->len < struct_size(ev, handles, ev->num_hndl)) {
36063852 		BT_DBG("%s bad parameters", hdev->name);
36073853 		return;
36083854 	}
....@@ -4058,6 +4304,19 @@
40584304 	struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
40594305 	struct hci_conn *conn;
40604306 
4307
+	switch (ev->link_type) {
4308
+	case SCO_LINK:
4309
+	case ESCO_LINK:
4310
+		break;
4311
+	default:
4312
+		/* As per Core 5.3 Vol 4 Part E 7.7.35 (p.2219), Link_Type
4313
+		 * for HCI_Synchronous_Connection_Complete is limited to
4314
+		 * either SCO or eSCO
4315
+		 */
4316
+		bt_dev_err(hdev, "Ignoring connect complete event for invalid link type");
4317
+		return;
4318
+	}
4319
+
40614320 	BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
40624321 
40634322 	hci_dev_lock(hdev);
....@@ -4120,10 +4379,23 @@
41204379 			if (hci_setup_sync(conn, conn->link->handle))
41214380 				goto unlock;
41224381 		}
4123
-		/* fall through */
4382
+		fallthrough;
41244383 
41254384 	default:
41264385 		conn->state = BT_CLOSED;
4386
+		break;
4387
+	}
4388
+
4389
+	bt_dev_dbg(hdev, "SCO connected with air mode: %02x", ev->air_mode);
4390
+
4391
+	switch (ev->air_mode) {
4392
+	case 0x02:
4393
+		if (hdev->notify)
4394
+			hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_CVSD);
4395
+		break;
4396
+	case 0x03:
4397
+		if (hdev->notify)
4398
+			hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_TRANSP);
41274399 		break;
41284400 	}
41294401 
....@@ -4449,6 +4721,16 @@
44494721 		    conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
44504722 		    (loc_mitm || rem_mitm)) {
44514723 			BT_DBG("Confirming auto-accept as acceptor");
4724
+			confirm_hint = 1;
4725
+			goto confirm;
4726
+		}
4727
+
4728
+		/* If there already exists link key in local host, leave the
4729
+		 * decision to user space since the remote device could be
4730
+		 * legitimate or malicious.
4731
+		 */
4732
+		if (hci_find_link_key(hdev, &ev->bdaddr)) {
4733
+			bt_dev_dbg(hdev, "Local host already has link key");
44524734 			confirm_hint = 1;
44534735 			goto confirm;
44544736 		}
....@@ -4792,8 +5074,9 @@
47925074 	hci_dev_lock(hdev);
47935075 
47945076 	hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4795
-	if (hcon) {
5077
+	if (hcon && hcon->type == AMP_LINK) {
47965078 		hcon->state = BT_CLOSED;
5079
+		hci_disconn_cfm(hcon, ev->reason);
47975080 		hci_conn_del(hcon);
47985081 	}
47995082 
....@@ -4883,7 +5166,7 @@
48835166 		conn->dst_type = bdaddr_type;
48845167 
48855168 		/* If we didn't have a hci_conn object previously
4886
-		 * but we're in master role this must be something
5169
+		 * but we're in central role this must be something
48875170 		 * initiated using a white list. Since white list based
48885171 		 * connections are not "first class citizens" we don't
48895172 		 * have full tracking of them. Therefore, we go ahead
....@@ -4953,31 +5236,27 @@
49535236 	hci_debugfs_create_conn(conn);
49545237 	hci_conn_add_sysfs(conn);
49555238 
4956
-	if (!status) {
4957
-		/* The remote features procedure is defined for master
4958
-		 * role only. So only in case of an initiated connection
4959
-		 * request the remote features.
4960
-		 *
4961
-		 * If the local controller supports slave-initiated features
4962
-		 * exchange, then requesting the remote features in slave
4963
-		 * role is possible. Otherwise just transition into the
4964
-		 * connected state without requesting the remote features.
4965
-		 */
4966
-		if (conn->out ||
4967
-		    (hdev->le_features[0] & HCI_LE_SLAVE_FEATURES)) {
4968
-			struct hci_cp_le_read_remote_features cp;
5239
+	/* The remote features procedure is defined for master
5240
+	 * role only. So only in case of an initiated connection
5241
+	 * request the remote features.
5242
+	 *
5243
+	 * If the local controller supports slave-initiated features
5244
+	 * exchange, then requesting the remote features in slave
5245
+	 * role is possible. Otherwise just transition into the
5246
+	 * connected state without requesting the remote features.
5247
+	 */
5248
+	if (conn->out ||
5249
+	    (hdev->le_features[0] & HCI_LE_SLAVE_FEATURES)) {
5250
+		struct hci_cp_le_read_remote_features cp;
49695251 
4970
-			cp.handle = __cpu_to_le16(conn->handle);
5252
+		cp.handle = __cpu_to_le16(conn->handle);
49715253 
4972
-			hci_send_cmd(hdev, HCI_OP_LE_READ_REMOTE_FEATURES,
4973
-				     sizeof(cp), &cp);
5254
+		hci_send_cmd(hdev, HCI_OP_LE_READ_REMOTE_FEATURES,
5255
+			     sizeof(cp), &cp);
49745256 
4975
-			hci_conn_hold(conn);
4976
-		} else {
4977
-			conn->state = BT_CONNECTED;
4978
-			hci_connect_cfm(conn, status);
4979
-		}
5257
+		hci_conn_hold(conn);
49805258 	} else {
5259
+		conn->state = BT_CONNECTED;
49815260 		hci_connect_cfm(conn, status);
49825261 	}
49835262 
....@@ -5022,6 +5301,11 @@
50225301 			     le16_to_cpu(ev->interval),
50235302 			     le16_to_cpu(ev->latency),
50245303 			     le16_to_cpu(ev->supervision_timeout));
5304
+
5305
+	if (use_ll_privacy(hdev) &&
5306
+	    hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY) &&
5307
+	    hci_dev_test_flag(hdev, HCI_LL_RPA_RESOLUTION))
5308
+		hci_req_disable_address_resolution(hdev);
50255309 }
50265310 
50275311 static void hci_le_ext_adv_term_evt(struct hci_dev *hdev, struct sk_buff *skb)
....@@ -5107,7 +5391,9 @@
51075391 	/* Most controller will fail if we try to create new connections
51085392 	 * while we have an existing one in slave role.
51095393 	 */
5110
-	if (hdev->conn_hash.le_num_slave > 0)
5394
+	if (hdev->conn_hash.le_num_slave > 0 &&
5395
+	    (!test_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks) ||
5396
+	     !(hdev->le_states[3] & 0x10)))
51115397 		return NULL;
51125398 
51135399 	/* If we're not connectable only connect devices that we have in
....@@ -5131,7 +5417,7 @@
51315417 		case HCI_AUTO_CONN_ALWAYS:
51325418 			/* Devices advertising with ADV_IND or ADV_DIRECT_IND
51335419 			 * are triggering a connection attempt. This means
5134
-			 * that incoming connectioms from slave device are
5420
+			 * that incoming connections from slave device are
51355421 			 * accepted and also outgoing connections to slave
51365422 			 * devices are established when found.
51375423 			 */
....@@ -5142,7 +5428,7 @@
51425428 	}
51435429 
51445430 	conn = hci_connect_le(hdev, addr, addr_type, BT_SECURITY_LOW,
5145
-			      HCI_LE_AUTOCONN_TIMEOUT, HCI_ROLE_MASTER,
5431
+			      hdev->def_le_autoconnect_timeout, HCI_ROLE_MASTER,
51465432 			      direct_rpa);
51475433 	if (!IS_ERR(conn)) {
51485434 		/* If HCI_AUTO_CONN_EXPLICIT is set, conn is already owned
....@@ -5186,7 +5472,7 @@
51865472 	struct hci_conn *conn;
51875473 	bool match;
51885474 	u32 flags;
5189
-	u8 *ptr, real_len;
5475
+	u8 *ptr;
51905476 
51915477 	switch (type) {
51925478 	case LE_ADV_IND:
....@@ -5217,13 +5503,10 @@
52175503 			break;
52185504 	}
52195505 
5220
-	real_len = ptr - data;
5221
-
5222
-	/* Adjust for actual length */
5223
-	if (len != real_len) {
5224
-		bt_dev_err_ratelimited(hdev, "advertising data len corrected");
5225
-		len = real_len;
5226
-	}
5506
+	/* Adjust for actual length. This handles the case when remote
5507
+	 * device is advertising with incorrect data length.
5508
+	 */
5509
+	len = ptr - data;
52275510 
52285511 	/* If the direct address is present, then this report is from
52295512 	 * a LE Direct Advertising Report event. In that case it is
....@@ -5275,14 +5558,15 @@
52755558 
52765559 	/* Passive scanning shouldn't trigger any device found events,
52775560 	 * except for devices marked as CONN_REPORT for which we do send
5278
-	 * device found events.
5561
+	 * device found events, or advertisement monitoring requested.
52795562 	 */
52805563 	if (hdev->le_scan_type == LE_SCAN_PASSIVE) {
52815564 		if (type == LE_ADV_DIRECT_IND)
52825565 			return;
52835566 
52845567 		if (!hci_pend_le_action_lookup(&hdev->pend_le_reports,
5285
-					       bdaddr, bdaddr_type))
5568
+					       bdaddr, bdaddr_type) &&
5569
+		    idr_is_empty(&hdev->adv_monitors_idr))
52865570 			return;
52875571 
52885572 		if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND)
....@@ -5412,7 +5696,7 @@
54125696 	hci_dev_unlock(hdev);
54135697 }
54145698 
5415
-static u8 ext_evt_type_to_legacy(u16 evt_type)
5699
+static u8 ext_evt_type_to_legacy(struct hci_dev *hdev, u16 evt_type)
54165700 {
54175701 	if (evt_type & LE_EXT_ADV_LEGACY_PDU) {
54185702 		switch (evt_type) {
....@@ -5429,10 +5713,7 @@
54295713 			return LE_ADV_SCAN_RSP;
54305714 		}
54315715 
5432
-		BT_ERR_RATELIMITED("Unknown advertising packet type: 0x%02x",
5433
-				   evt_type);
5434
-
5435
-		return LE_ADV_INVALID;
5716
+		goto invalid;
54365717 	}
54375718 
54385719 	if (evt_type & LE_EXT_ADV_CONN_IND) {
....@@ -5452,8 +5733,9 @@
54525733 	    evt_type & LE_EXT_ADV_DIRECT_IND)
54535734 		return LE_ADV_NONCONN_IND;
54545735 
5455
-	BT_ERR_RATELIMITED("Unknown advertising packet type: 0x%02x",
5456
-				   evt_type);
5736
+invalid:
5737
+	bt_dev_err_ratelimited(hdev, "Unknown advertising packet type: 0x%02x",
5738
+			       evt_type);
54575739 
54585740 	return LE_ADV_INVALID;
54595741 }
....@@ -5471,7 +5753,7 @@
54715753 		u16 evt_type;
54725754 
54735755 		evt_type = __le16_to_cpu(ev->evt_type);
5474
-		legacy_evt_type = ext_evt_type_to_legacy(evt_type);
5756
+		legacy_evt_type = ext_evt_type_to_legacy(hdev, evt_type);
54755757 		if (legacy_evt_type != LE_ADV_INVALID) {
54765758 			process_adv_report(hdev, legacy_evt_type, &ev->bdaddr,
54775759 					   ev->bdaddr_type, NULL, 0, ev->rssi,
....@@ -5479,7 +5761,7 @@
54795761 					   !(evt_type & LE_EXT_ADV_LEGACY_PDU));
54805762 		}
54815763 
5482
-		ptr += sizeof(*ev) + ev->length + 1;
5764
+		ptr += sizeof(*ev) + ev->length;
54835765 	}
54845766 
54855767 	hci_dev_unlock(hdev);
....@@ -5681,6 +5963,29 @@
56815963 	hci_dev_unlock(hdev);
56825964 }
56835965 
5966
+static void hci_le_phy_update_evt(struct hci_dev *hdev, struct sk_buff *skb)
5967
+{
5968
+	struct hci_ev_le_phy_update_complete *ev = (void *) skb->data;
5969
+	struct hci_conn *conn;
5970
+
5971
+	BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5972
+
5973
+	if (ev->status)
5974
+		return;
5975
+
5976
+	hci_dev_lock(hdev);
5977
+
5978
+	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5979
+	if (!conn)
5980
+		goto unlock;
5981
+
5982
+	conn->le_tx_phy = ev->tx_phy;
5983
+	conn->le_rx_phy = ev->rx_phy;
5984
+
5985
+unlock:
5986
+	hci_dev_unlock(hdev);
5987
+}
5988
+
56845989 static void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
56855990 {
56865991 	struct hci_ev_le_meta *le_ev = (void *) skb->data;
....@@ -5714,6 +6019,10 @@
57146019 
57156020 	case HCI_EV_LE_DIRECT_ADV_REPORT:
57166021 		hci_le_direct_adv_report_evt(hdev, skb);
6022
+		break;
6023
+
6024
+	case HCI_EV_LE_PHY_UPDATE_COMPLETE:
6025
+		hci_le_phy_update_evt(hdev, skb);
57176026 		break;
57186027 
57196028 	case HCI_EV_LE_EXT_ADV_REPORT:
....@@ -5785,6 +6094,75 @@
57856094 	return true;
57866095 }
57876096 
6097
+static void hci_store_wake_reason(struct hci_dev *hdev, u8 event,
6098
+				  struct sk_buff *skb)
6099
+{
6100
+	struct hci_ev_le_advertising_info *adv;
6101
+	struct hci_ev_le_direct_adv_info *direct_adv;
6102
+	struct hci_ev_le_ext_adv_report *ext_adv;
6103
+	const struct hci_ev_conn_complete *conn_complete = (void *)skb->data;
6104
+	const struct hci_ev_conn_request *conn_request = (void *)skb->data;
6105
+
6106
+	hci_dev_lock(hdev);
6107
+
6108
+	/* If we are currently suspended and this is the first BT event seen,
6109
+	 * save the wake reason associated with the event.
6110
+	 */
6111
+	if (!hdev->suspended || hdev->wake_reason)
6112
+		goto unlock;
6113
+
6114
+	/* Default to remote wake. Values for wake_reason are documented in the
6115
+	 * Bluez mgmt api docs.
6116
+	 */
6117
+	hdev->wake_reason = MGMT_WAKE_REASON_REMOTE_WAKE;
6118
+
6119
+	/* Once configured for remote wakeup, we should only wake up for
6120
+	 * reconnections. It's useful to see which device is waking us up so
6121
+	 * keep track of the bdaddr of the connection event that woke us up.
6122
+	 */
6123
+	if (event == HCI_EV_CONN_REQUEST) {
6124
+		bacpy(&hdev->wake_addr, &conn_complete->bdaddr);
6125
+		hdev->wake_addr_type = BDADDR_BREDR;
6126
+	} else if (event == HCI_EV_CONN_COMPLETE) {
6127
+		bacpy(&hdev->wake_addr, &conn_request->bdaddr);
6128
+		hdev->wake_addr_type = BDADDR_BREDR;
6129
+	} else if (event == HCI_EV_LE_META) {
6130
+		struct hci_ev_le_meta *le_ev = (void *)skb->data;
6131
+		u8 subevent = le_ev->subevent;
6132
+		u8 *ptr = &skb->data[sizeof(*le_ev)];
6133
+		u8 num_reports = *ptr;
6134
+
6135
+		if ((subevent == HCI_EV_LE_ADVERTISING_REPORT ||
6136
+		     subevent == HCI_EV_LE_DIRECT_ADV_REPORT ||
6137
+		     subevent == HCI_EV_LE_EXT_ADV_REPORT) &&
6138
+		    num_reports) {
6139
+			adv = (void *)(ptr + 1);
6140
+			direct_adv = (void *)(ptr + 1);
6141
+			ext_adv = (void *)(ptr + 1);
6142
+
6143
+			switch (subevent) {
6144
+			case HCI_EV_LE_ADVERTISING_REPORT:
6145
+				bacpy(&hdev->wake_addr, &adv->bdaddr);
6146
+				hdev->wake_addr_type = adv->bdaddr_type;
6147
+				break;
6148
+			case HCI_EV_LE_DIRECT_ADV_REPORT:
6149
+				bacpy(&hdev->wake_addr, &direct_adv->bdaddr);
6150
+				hdev->wake_addr_type = direct_adv->bdaddr_type;
6151
+				break;
6152
+			case HCI_EV_LE_EXT_ADV_REPORT:
6153
+				bacpy(&hdev->wake_addr, &ext_adv->bdaddr);
6154
+				hdev->wake_addr_type = ext_adv->bdaddr_type;
6155
+				break;
6156
+			}
6157
+		}
6158
+	} else {
6159
+		hdev->wake_reason = MGMT_WAKE_REASON_UNEXPECTED;
6160
+	}
6161
+
6162
+unlock:
6163
+	hci_dev_unlock(hdev);
6164
+}
6165
+
57886166 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
57896167 {
57906168 	struct hci_event_hdr *hdr = (void *) skb->data;
....@@ -5817,6 +6195,9 @@
58176195 		orig_skb = skb_clone(skb, GFP_KERNEL);
58186196 
58196197 	skb_pull(skb, HCI_EVENT_HDR_SIZE);
6198
+
6199
+	/* Store wake reason if we're suspended */
6200
+	hci_store_wake_reason(hdev, event, skb);
58206201 
58216202 	switch (event) {
58226203 	case HCI_EV_INQUIRY_COMPLETE:
....@@ -5995,6 +6376,10 @@
59956376 		hci_num_comp_blocks_evt(hdev, skb);
59966377 		break;
59976378 
6379
+	case HCI_EV_VENDOR:
6380
+		msft_vendor_evt(hdev, skb);
6381
+		break;
6382
+
59986383 	default:
59996384 		BT_DBG("%s event 0x%2.2x", hdev->name, event);
60006385 		break;