2    BlueZ - Bluetooth protocol stack for Linux
3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
57 		bt_dev_err(hdev, "Malformed Event: 0x%2.2x", ev);  in hci_ev_skb_pull()
69 		bt_dev_err(hdev, "Malformed Command Complete: 0x%4.4x", op);  in hci_cc_skb_pull()
81 		bt_dev_err(hdev, "Malformed LE Event: 0x%2.2x", ev);  in hci_le_ev_skb_pull()
89 	struct hci_ev_status *rp = data;  in hci_cc_inquiry_cancel()  local
91 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_inquiry_cancel()
100 	if (rp->status == HCI_ERROR_COMMAND_DISALLOWED && !test_bit(HCI_INQUIRY, &hdev->flags)) {  in hci_cc_inquiry_cancel()
102 		rp->status = 0x00;  in hci_cc_inquiry_cancel()
105 	if (rp->status)  in hci_cc_inquiry_cancel()
106 		return rp->status;  in hci_cc_inquiry_cancel()
108 	clear_bit(HCI_INQUIRY, &hdev->flags);  in hci_cc_inquiry_cancel()
110 	wake_up_bit(&hdev->flags, HCI_INQUIRY);  in hci_cc_inquiry_cancel()
117 	    hdev->le_scan_type != LE_SCAN_ACTIVE)  in hci_cc_inquiry_cancel()
121 	return rp->status;  in hci_cc_inquiry_cancel()
127 	struct hci_ev_status *rp = data;  in hci_cc_periodic_inq()  local
129 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_periodic_inq()
131 	if (rp->status)  in hci_cc_periodic_inq()
132 		return rp->status;  in hci_cc_periodic_inq()
136 	return rp->status;  in hci_cc_periodic_inq()
142 	struct hci_ev_status *rp = data;  in hci_cc_exit_periodic_inq()  local
144 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_exit_periodic_inq()
146 	if (rp->status)  in hci_cc_exit_periodic_inq()
147 		return rp->status;  in hci_cc_exit_periodic_inq()
151 	return rp->status;  in hci_cc_exit_periodic_inq()
157 	struct hci_ev_status *rp = data;  in hci_cc_remote_name_req_cancel()  local
159 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_remote_name_req_cancel()
161 	return rp->status;  in hci_cc_remote_name_req_cancel()
167 	struct hci_rp_role_discovery *rp = data;  in hci_cc_role_discovery()  local
170 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_role_discovery()
172 	if (rp->status)  in hci_cc_role_discovery()
173 		return rp->status;  in hci_cc_role_discovery()
177 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));  in hci_cc_role_discovery()
179 		conn->role = rp->role;  in hci_cc_role_discovery()
183 	return rp->status;  in hci_cc_role_discovery()
189 	struct hci_rp_read_link_policy *rp = data;  in hci_cc_read_link_policy()  local
192 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_read_link_policy()
194 	if (rp->status)  in hci_cc_read_link_policy()
195 		return rp->status;  in hci_cc_read_link_policy()
199 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));  in hci_cc_read_link_policy()
201 		conn->link_policy = __le16_to_cpu(rp->policy);  in hci_cc_read_link_policy()
205 	return rp->status;  in hci_cc_read_link_policy()
211 	struct hci_rp_write_link_policy *rp = data;  in hci_cc_write_link_policy()  local
215 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_write_link_policy()
217 	if (rp->status)  in hci_cc_write_link_policy()
218 		return rp->status;  in hci_cc_write_link_policy()
222 		return rp->status;  in hci_cc_write_link_policy()
226 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));  in hci_cc_write_link_policy()
228 		conn->link_policy = get_unaligned_le16(sent + 2);  in hci_cc_write_link_policy()
232 	return rp->status;  in hci_cc_write_link_policy()
238 	struct hci_rp_read_def_link_policy *rp = data;  in hci_cc_read_def_link_policy()  local
240 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_read_def_link_policy()
242 	if (rp->status)  in hci_cc_read_def_link_policy()
243 		return rp->status;  in hci_cc_read_def_link_policy()
245 	hdev->link_policy = __le16_to_cpu(rp->policy);  in hci_cc_read_def_link_policy()
247 	return rp->status;  in hci_cc_read_def_link_policy()
253 	struct hci_ev_status *rp = data;  in hci_cc_write_def_link_policy()  local
256 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_write_def_link_policy()
258 	if (rp->status)  in hci_cc_write_def_link_policy()
259 		return rp->status;  in hci_cc_write_def_link_policy()
263 		return rp->status;  in hci_cc_write_def_link_policy()
265 	hdev->link_policy = get_unaligned_le16(sent);  in hci_cc_write_def_link_policy()
267 	return rp->status;  in hci_cc_write_def_link_policy()
272 	struct hci_ev_status *rp = data;  in hci_cc_reset()  local
274 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_reset()
276 	clear_bit(HCI_RESET, &hdev->flags);  in hci_cc_reset()
278 	if (rp->status)  in hci_cc_reset()
279 		return rp->status;  in hci_cc_reset()
281 	/* Reset all non-persistent flags */  in hci_cc_reset()
286 	hdev->inq_tx_power = HCI_TX_POWER_INVALID;  in hci_cc_reset()
287 	hdev->adv_tx_power = HCI_TX_POWER_INVALID;  in hci_cc_reset()
289 	memset(hdev->adv_data, 0, sizeof(hdev->adv_data));  in hci_cc_reset()
290 	hdev->adv_data_len = 0;  in hci_cc_reset()
292 	memset(hdev->scan_rsp_data, 0, sizeof(hdev->scan_rsp_data));  in hci_cc_reset()
293 	hdev->scan_rsp_data_len = 0;  in hci_cc_reset()
295 	hdev->le_scan_type = LE_SCAN_PASSIVE;  in hci_cc_reset()
297 	hdev->ssp_debug_mode = 0;  in hci_cc_reset()
299 	hci_bdaddr_list_clear(&hdev->le_accept_list);  in hci_cc_reset()
300 	hci_bdaddr_list_clear(&hdev->le_resolv_list);  in hci_cc_reset()
302 	return rp->status;  in hci_cc_reset()
308 	struct hci_rp_read_stored_link_key *rp = data;  in hci_cc_read_stored_link_key()  local
311 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_read_stored_link_key()
315 		return rp->status;  in hci_cc_read_stored_link_key()
317 	if (!rp->status && sent->read_all == 0x01) {  in hci_cc_read_stored_link_key()
318 		hdev->stored_max_keys = le16_to_cpu(rp->max_keys);  in hci_cc_read_stored_link_key()
319 		hdev->stored_num_keys = le16_to_cpu(rp->num_keys);  in hci_cc_read_stored_link_key()
322 	return rp->status;  in hci_cc_read_stored_link_key()
328 	struct hci_rp_delete_stored_link_key *rp = data;  in hci_cc_delete_stored_link_key()  local
331 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_delete_stored_link_key()
333 	if (rp->status)  in hci_cc_delete_stored_link_key()
334 		return rp->status;  in hci_cc_delete_stored_link_key()
336 	num_keys = le16_to_cpu(rp->num_keys);  in hci_cc_delete_stored_link_key()
338 	if (num_keys <= hdev->stored_num_keys)  in hci_cc_delete_stored_link_key()
339 		hdev->stored_num_keys -= num_keys;  in hci_cc_delete_stored_link_key()
341 		hdev->stored_num_keys = 0;  in hci_cc_delete_stored_link_key()
343 	return rp->status;  in hci_cc_delete_stored_link_key()
349 	struct hci_ev_status *rp = data;  in hci_cc_write_local_name()  local
352 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_write_local_name()
356 		return rp->status;  in hci_cc_write_local_name()
361 		mgmt_set_local_name_complete(hdev, sent, rp->status);  in hci_cc_write_local_name()
362 	else if (!rp->status)  in hci_cc_write_local_name()
363 		memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);  in hci_cc_write_local_name()
367 	return rp->status;  in hci_cc_write_local_name()
373 	struct hci_rp_read_local_name *rp = data;  in hci_cc_read_local_name()  local
375 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_read_local_name()
377 	if (rp->status)  in hci_cc_read_local_name()
378 		return rp->status;  in hci_cc_read_local_name()
382 		memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);  in hci_cc_read_local_name()
384 	return rp->status;  in hci_cc_read_local_name()
390 	struct hci_ev_status *rp = data;  in hci_cc_write_auth_enable()  local
393 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_write_auth_enable()
397 		return rp->status;  in hci_cc_write_auth_enable()
401 	if (!rp->status) {  in hci_cc_write_auth_enable()
405 			set_bit(HCI_AUTH, &hdev->flags);  in hci_cc_write_auth_enable()
407 			clear_bit(HCI_AUTH, &hdev->flags);  in hci_cc_write_auth_enable()
411 		mgmt_auth_enable_complete(hdev, rp->status);  in hci_cc_write_auth_enable()
415 	return rp->status;  in hci_cc_write_auth_enable()
421 	struct hci_ev_status *rp = data;  in hci_cc_write_encrypt_mode()  local
425 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_write_encrypt_mode()
427 	if (rp->status)  in hci_cc_write_encrypt_mode()
428 		return rp->status;  in hci_cc_write_encrypt_mode()
432 		return rp->status;  in hci_cc_write_encrypt_mode()
437 		set_bit(HCI_ENCRYPT, &hdev->flags);  in hci_cc_write_encrypt_mode()
439 		clear_bit(HCI_ENCRYPT, &hdev->flags);  in hci_cc_write_encrypt_mode()
441 	return rp->status;  in hci_cc_write_encrypt_mode()
447 	struct hci_ev_status *rp = data;  in hci_cc_write_scan_enable()  local
451 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_write_scan_enable()
455 		return rp->status;  in hci_cc_write_scan_enable()
461 	if (rp->status) {  in hci_cc_write_scan_enable()
462 		hdev->discov_timeout = 0;  in hci_cc_write_scan_enable()
467 		set_bit(HCI_ISCAN, &hdev->flags);  in hci_cc_write_scan_enable()
469 		clear_bit(HCI_ISCAN, &hdev->flags);  in hci_cc_write_scan_enable()
472 		set_bit(HCI_PSCAN, &hdev->flags);  in hci_cc_write_scan_enable()
474 		clear_bit(HCI_PSCAN, &hdev->flags);  in hci_cc_write_scan_enable()
479 	return rp->status;  in hci_cc_write_scan_enable()
485 	struct hci_ev_status *rp = data;  in hci_cc_set_event_filter()  local
489 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_set_event_filter()
491 	if (rp->status)  in hci_cc_set_event_filter()
492 		return rp->status;  in hci_cc_set_event_filter()
496 		return rp->status;  in hci_cc_set_event_filter()
500 	if (cp->flt_type == HCI_FLT_CLEAR_ALL)  in hci_cc_set_event_filter()
505 	return rp->status;  in hci_cc_set_event_filter()
511 	struct hci_rp_read_class_of_dev *rp = data;  in hci_cc_read_class_of_dev()  local
516 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_read_class_of_dev()
518 	if (rp->status)  in hci_cc_read_class_of_dev()
519 		return rp->status;  in hci_cc_read_class_of_dev()
521 	memcpy(hdev->dev_class, rp->dev_class, 3);  in hci_cc_read_class_of_dev()
523 	bt_dev_dbg(hdev, "class 0x%.2x%.2x%.2x", hdev->dev_class[2],  in hci_cc_read_class_of_dev()
524 		   hdev->dev_class[1], hdev->dev_class[0]);  in hci_cc_read_class_of_dev()
526 	return rp->status;  in hci_cc_read_class_of_dev()
532 	struct hci_ev_status *rp = data;  in hci_cc_write_class_of_dev()  local
535 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_write_class_of_dev()
539 		return rp->status;  in hci_cc_write_class_of_dev()
543 	if (!rp->status)  in hci_cc_write_class_of_dev()
544 		memcpy(hdev->dev_class, sent, 3);  in hci_cc_write_class_of_dev()
547 		mgmt_set_class_of_dev_complete(hdev, sent, rp->status);  in hci_cc_write_class_of_dev()
551 	return rp->status;  in hci_cc_write_class_of_dev()
557 	struct hci_rp_read_voice_setting *rp = data;  in hci_cc_read_voice_setting()  local
560 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_read_voice_setting()
562 	if (rp->status)  in hci_cc_read_voice_setting()
563 		return rp->status;  in hci_cc_read_voice_setting()
565 	setting = __le16_to_cpu(rp->voice_setting);  in hci_cc_read_voice_setting()
567 	if (hdev->voice_setting == setting)  in hci_cc_read_voice_setting()
568 		return rp->status;  in hci_cc_read_voice_setting()
570 	hdev->voice_setting = setting;  in hci_cc_read_voice_setting()
572 	bt_dev_dbg(hdev, "voice setting 0x%4.4x", setting);  in hci_cc_read_voice_setting()
574 	if (hdev->notify)  in hci_cc_read_voice_setting()
575 		hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);  in hci_cc_read_voice_setting()
577 	return rp->status;  in hci_cc_read_voice_setting()
583 	struct hci_ev_status *rp = data;  in hci_cc_write_voice_setting()  local
587 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_write_voice_setting()
589 	if (rp->status)  in hci_cc_write_voice_setting()
590 		return rp->status;  in hci_cc_write_voice_setting()
594 		return rp->status;  in hci_cc_write_voice_setting()
598 	if (hdev->voice_setting == setting)  in hci_cc_write_voice_setting()
599 		return rp->status;  in hci_cc_write_voice_setting()
601 	hdev->voice_setting = setting;  in hci_cc_write_voice_setting()
603 	bt_dev_dbg(hdev, "voice setting 0x%4.4x", setting);  in hci_cc_write_voice_setting()
605 	if (hdev->notify)  in hci_cc_write_voice_setting()
606 		hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);  in hci_cc_write_voice_setting()
608 	return rp->status;  in hci_cc_write_voice_setting()
614 	struct hci_rp_read_num_supported_iac *rp = data;  in hci_cc_read_num_supported_iac()  local
616 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_read_num_supported_iac()
618 	if (rp->status)  in hci_cc_read_num_supported_iac()
619 		return rp->status;  in hci_cc_read_num_supported_iac()
621 	hdev->num_iac = rp->num_iac;  in hci_cc_read_num_supported_iac()
623 	bt_dev_dbg(hdev, "num iac %d", hdev->num_iac);  in hci_cc_read_num_supported_iac()
625 	return rp->status;  in hci_cc_read_num_supported_iac()
631 	struct hci_ev_status *rp = data;  in hci_cc_write_ssp_mode()  local
634 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_write_ssp_mode()
638 		return rp->status;  in hci_cc_write_ssp_mode()
642 	if (!rp->status) {  in hci_cc_write_ssp_mode()
643 		if (sent->mode)  in hci_cc_write_ssp_mode()
644 			hdev->features[1][0] |= LMP_HOST_SSP;  in hci_cc_write_ssp_mode()
646 			hdev->features[1][0] &= ~LMP_HOST_SSP;  in hci_cc_write_ssp_mode()
649 	if (!rp->status) {  in hci_cc_write_ssp_mode()
650 		if (sent->mode)  in hci_cc_write_ssp_mode()
658 	return rp->status;  in hci_cc_write_ssp_mode()
664 	struct hci_ev_status *rp = data;  in hci_cc_write_sc_support()  local
667 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_write_sc_support()
671 		return rp->status;  in hci_cc_write_sc_support()
675 	if (!rp->status) {  in hci_cc_write_sc_support()
676 		if (sent->support)  in hci_cc_write_sc_support()
677 			hdev->features[1][0] |= LMP_HOST_SC;  in hci_cc_write_sc_support()
679 			hdev->features[1][0] &= ~LMP_HOST_SC;  in hci_cc_write_sc_support()
682 	if (!hci_dev_test_flag(hdev, HCI_MGMT) && !rp->status) {  in hci_cc_write_sc_support()
683 		if (sent->support)  in hci_cc_write_sc_support()
691 	return rp->status;  in hci_cc_write_sc_support()
697 	struct hci_rp_read_local_version *rp = data;  in hci_cc_read_local_version()  local
699 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_read_local_version()
701 	if (rp->status)  in hci_cc_read_local_version()
702 		return rp->status;  in hci_cc_read_local_version()
706 		hdev->hci_ver = rp->hci_ver;  in hci_cc_read_local_version()
707 		hdev->hci_rev = __le16_to_cpu(rp->hci_rev);  in hci_cc_read_local_version()
708 		hdev->lmp_ver = rp->lmp_ver;  in hci_cc_read_local_version()
709 		hdev->manufacturer = __le16_to_cpu(rp->manufacturer);  in hci_cc_read_local_version()
710 		hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);  in hci_cc_read_local_version()
713 	return rp->status;  in hci_cc_read_local_version()
719 	struct hci_rp_read_enc_key_size *rp = data;  in hci_cc_read_enc_key_size()  local
722 	u8 status = rp->status;  in hci_cc_read_enc_key_size()
724 	bt_dev_dbg(hdev, "status 0x%2.2x", status);  in hci_cc_read_enc_key_size()
726 	handle = le16_to_cpu(rp->handle);  in hci_cc_read_enc_key_size()
743 		conn->enc_key_size = 0;  in hci_cc_read_enc_key_size()
745 		conn->enc_key_size = rp->key_size;  in hci_cc_read_enc_key_size()
748 		if (conn->enc_key_size < hdev->min_enc_key_size) {  in hci_cc_read_enc_key_size()
749 			/* As slave role, the conn->state has been set to  in hci_cc_read_enc_key_size()
752 			 * nothing with the non-zero status.  in hci_cc_read_enc_key_size()
758 			clear_bit(HCI_CONN_ENCRYPT, &conn->flags);  in hci_cc_read_enc_key_size()
759 			clear_bit(HCI_CONN_AES_CCM, &conn->flags);  in hci_cc_read_enc_key_size()
774 	struct hci_rp_read_local_commands *rp = data;  in hci_cc_read_local_commands()  local
776 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_read_local_commands()
778 	if (rp->status)  in hci_cc_read_local_commands()
779 		return rp->status;  in hci_cc_read_local_commands()
783 		memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));  in hci_cc_read_local_commands()
785 	return rp->status;  in hci_cc_read_local_commands()
791 	struct hci_rp_read_auth_payload_to *rp = data;  in hci_cc_read_auth_payload_timeout()  local
794 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_read_auth_payload_timeout()
796 	if (rp->status)  in hci_cc_read_auth_payload_timeout()
797 		return rp->status;  in hci_cc_read_auth_payload_timeout()
801 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));  in hci_cc_read_auth_payload_timeout()
803 		conn->auth_payload_timeout = __le16_to_cpu(rp->timeout);  in hci_cc_read_auth_payload_timeout()
807 	return rp->status;  in hci_cc_read_auth_payload_timeout()
813 	struct hci_rp_write_auth_payload_to *rp = data;  in hci_cc_write_auth_payload_timeout()  local
817 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_write_auth_payload_timeout()
821 		return rp->status;  in hci_cc_write_auth_payload_timeout()
825 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));  in hci_cc_write_auth_payload_timeout()
827 		rp->status = 0xff;  in hci_cc_write_auth_payload_timeout()
831 	if (!rp->status)  in hci_cc_write_auth_payload_timeout()
832 		conn->auth_payload_timeout = get_unaligned_le16(sent + 2);  in hci_cc_write_auth_payload_timeout()
837 	return rp->status;  in hci_cc_write_auth_payload_timeout()
843 	struct hci_rp_read_local_features *rp = data;  in hci_cc_read_local_features()  local
845 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_read_local_features()
847 	if (rp->status)  in hci_cc_read_local_features()
848 		return rp->status;  in hci_cc_read_local_features()
850 	memcpy(hdev->features, rp->features, 8);  in hci_cc_read_local_features()
855 	if (hdev->features[0][0] & LMP_3SLOT)  in hci_cc_read_local_features()
856 		hdev->pkt_type |= (HCI_DM3 | HCI_DH3);  in hci_cc_read_local_features()
858 	if (hdev->features[0][0] & LMP_5SLOT)  in hci_cc_read_local_features()
859 		hdev->pkt_type |= (HCI_DM5 | HCI_DH5);  in hci_cc_read_local_features()
861 	if (hdev->features[0][1] & LMP_HV2) {  in hci_cc_read_local_features()
862 		hdev->pkt_type  |= (HCI_HV2);  in hci_cc_read_local_features()
863 		hdev->esco_type |= (ESCO_HV2);  in hci_cc_read_local_features()
866 	if (hdev->features[0][1] & LMP_HV3) {  in hci_cc_read_local_features()
867 		hdev->pkt_type  |= (HCI_HV3);  in hci_cc_read_local_features()
868 		hdev->esco_type |= (ESCO_HV3);  in hci_cc_read_local_features()
872 		hdev->esco_type |= (ESCO_EV3);  in hci_cc_read_local_features()
874 	if (hdev->features[0][4] & LMP_EV4)  in hci_cc_read_local_features()
875 		hdev->esco_type |= (ESCO_EV4);  in hci_cc_read_local_features()
877 	if (hdev->features[0][4] & LMP_EV5)  in hci_cc_read_local_features()
878 		hdev->esco_type |= (ESCO_EV5);  in hci_cc_read_local_features()
880 	if (hdev->features[0][5] & LMP_EDR_ESCO_2M)  in hci_cc_read_local_features()
881 		hdev->esco_type |= (ESCO_2EV3);  in hci_cc_read_local_features()
883 	if (hdev->features[0][5] & LMP_EDR_ESCO_3M)  in hci_cc_read_local_features()
884 		hdev->esco_type |= (ESCO_3EV3);  in hci_cc_read_local_features()
886 	if (hdev->features[0][5] & LMP_EDR_3S_ESCO)  in hci_cc_read_local_features()
887 		hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);  in hci_cc_read_local_features()
889 	return rp->status;  in hci_cc_read_local_features()
895 	struct hci_rp_read_local_ext_features *rp = data;  in hci_cc_read_local_ext_features()  local
897 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_read_local_ext_features()
899 	if (rp->status)  in hci_cc_read_local_ext_features()
900 		return rp->status;  in hci_cc_read_local_ext_features()
902 	if (hdev->max_page < rp->max_page) {  in hci_cc_read_local_ext_features()
904 			     &hdev->quirks))  in hci_cc_read_local_ext_features()
907 			hdev->max_page = rp->max_page;  in hci_cc_read_local_ext_features()
910 	if (rp->page < HCI_MAX_PAGES)  in hci_cc_read_local_ext_features()
911 		memcpy(hdev->features[rp->page], rp->features, 8);  in hci_cc_read_local_ext_features()
913 	return rp->status;  in hci_cc_read_local_ext_features()
919 	struct hci_rp_read_buffer_size *rp = data;  in hci_cc_read_buffer_size()  local
921 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_read_buffer_size()
923 	if (rp->status)  in hci_cc_read_buffer_size()
924 		return rp->status;  in hci_cc_read_buffer_size()
926 	hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);  in hci_cc_read_buffer_size()
927 	hdev->sco_mtu  = rp->sco_mtu;  in hci_cc_read_buffer_size()
928 	hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);  in hci_cc_read_buffer_size()
929 	hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);  in hci_cc_read_buffer_size()
931 	if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {  in hci_cc_read_buffer_size()
932 		hdev->sco_mtu  = 64;  in hci_cc_read_buffer_size()
933 		hdev->sco_pkts = 8;  in hci_cc_read_buffer_size()
936 	hdev->acl_cnt = hdev->acl_pkts;  in hci_cc_read_buffer_size()
937 	hdev->sco_cnt = hdev->sco_pkts;  in hci_cc_read_buffer_size()
939 	BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,  in hci_cc_read_buffer_size()
940 	       hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);  in hci_cc_read_buffer_size()
942 	if (!hdev->acl_mtu || !hdev->acl_pkts)  in hci_cc_read_buffer_size()
945 	return rp->status;  in hci_cc_read_buffer_size()
951 	struct hci_rp_read_bd_addr *rp = data;  in hci_cc_read_bd_addr()  local
953 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_read_bd_addr()
955 	if (rp->status)  in hci_cc_read_bd_addr()
956 		return rp->status;  in hci_cc_read_bd_addr()
958 	if (test_bit(HCI_INIT, &hdev->flags))  in hci_cc_read_bd_addr()
959 		bacpy(&hdev->bdaddr, &rp->bdaddr);  in hci_cc_read_bd_addr()
962 		bacpy(&hdev->setup_addr, &rp->bdaddr);  in hci_cc_read_bd_addr()
964 	return rp->status;  in hci_cc_read_bd_addr()
970 	struct hci_rp_read_local_pairing_opts *rp = data;  in hci_cc_read_local_pairing_opts()  local
972 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_read_local_pairing_opts()
974 	if (rp->status)  in hci_cc_read_local_pairing_opts()
975 		return rp->status;  in hci_cc_read_local_pairing_opts()
979 		hdev->pairing_opts = rp->pairing_opts;  in hci_cc_read_local_pairing_opts()
980 		hdev->max_enc_key_size = rp->max_key_size;  in hci_cc_read_local_pairing_opts()
983 	return rp->status;  in hci_cc_read_local_pairing_opts()
989 	struct hci_rp_read_page_scan_activity *rp = data;  in hci_cc_read_page_scan_activity()  local
991 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_read_page_scan_activity()
993 	if (rp->status)  in hci_cc_read_page_scan_activity()
994 		return rp->status;  in hci_cc_read_page_scan_activity()
996 	if (test_bit(HCI_INIT, &hdev->flags)) {  in hci_cc_read_page_scan_activity()
997 		hdev->page_scan_interval = __le16_to_cpu(rp->interval);  in hci_cc_read_page_scan_activity()
998 		hdev->page_scan_window = __le16_to_cpu(rp->window);  in hci_cc_read_page_scan_activity()
1001 	return rp->status;  in hci_cc_read_page_scan_activity()
1007 	struct hci_ev_status *rp = data;  in hci_cc_write_page_scan_activity()  local
1010 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_write_page_scan_activity()
1012 	if (rp->status)  in hci_cc_write_page_scan_activity()
1013 		return rp->status;  in hci_cc_write_page_scan_activity()
1017 		return rp->status;  in hci_cc_write_page_scan_activity()
1019 	hdev->page_scan_interval = __le16_to_cpu(sent->interval);  in hci_cc_write_page_scan_activity()
1020 	hdev->page_scan_window = __le16_to_cpu(sent->window);  in hci_cc_write_page_scan_activity()
1022 	return rp->status;  in hci_cc_write_page_scan_activity()
1028 	struct hci_rp_read_page_scan_type *rp = data;  in hci_cc_read_page_scan_type()  local
1030 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_read_page_scan_type()
1032 	if (rp->status)  in hci_cc_read_page_scan_type()
1033 		return rp->status;  in hci_cc_read_page_scan_type()
1035 	if (test_bit(HCI_INIT, &hdev->flags))  in hci_cc_read_page_scan_type()
1036 		hdev->page_scan_type = rp->type;  in hci_cc_read_page_scan_type()
1038 	return rp->status;  in hci_cc_read_page_scan_type()
1044 	struct hci_ev_status *rp = data;  in hci_cc_write_page_scan_type()  local
1047 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_write_page_scan_type()
1049 	if (rp->status)  in hci_cc_write_page_scan_type()
1050 		return rp->status;  in hci_cc_write_page_scan_type()
1054 		hdev->page_scan_type = *type;  in hci_cc_write_page_scan_type()
1056 	return rp->status;  in hci_cc_write_page_scan_type()
1062 	struct hci_rp_read_clock *rp = data;  in hci_cc_read_clock()  local
1066 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_read_clock()
1068 	if (rp->status)  in hci_cc_read_clock()
1069 		return rp->status;  in hci_cc_read_clock()
1077 	if (cp->which == 0x00) {  in hci_cc_read_clock()
1078 		hdev->clock = le32_to_cpu(rp->clock);  in hci_cc_read_clock()
1082 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));  in hci_cc_read_clock()
1084 		conn->clock = le32_to_cpu(rp->clock);  in hci_cc_read_clock()
1085 		conn->clock_accuracy = le16_to_cpu(rp->accuracy);  in hci_cc_read_clock()
1090 	return rp->status;  in hci_cc_read_clock()
1096 	struct hci_rp_read_inq_rsp_tx_power *rp = data;  in hci_cc_read_inq_rsp_tx_power()  local
1098 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_read_inq_rsp_tx_power()
1100 	if (rp->status)  in hci_cc_read_inq_rsp_tx_power()
1101 		return rp->status;  in hci_cc_read_inq_rsp_tx_power()
1103 	hdev->inq_tx_power = rp->tx_power;  in hci_cc_read_inq_rsp_tx_power()
1105 	return rp->status;  in hci_cc_read_inq_rsp_tx_power()
1111 	struct hci_rp_read_def_err_data_reporting *rp = data;  in hci_cc_read_def_err_data_reporting()  local
1113 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_read_def_err_data_reporting()
1115 	if (rp->status)  in hci_cc_read_def_err_data_reporting()
1116 		return rp->status;  in hci_cc_read_def_err_data_reporting()
1118 	hdev->err_data_reporting = rp->err_data_reporting;  in hci_cc_read_def_err_data_reporting()
1120 	return rp->status;  in hci_cc_read_def_err_data_reporting()
1126 	struct hci_ev_status *rp = data;  in hci_cc_write_def_err_data_reporting()  local
1129 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_write_def_err_data_reporting()
1131 	if (rp->status)  in hci_cc_write_def_err_data_reporting()
1132 		return rp->status;  in hci_cc_write_def_err_data_reporting()
1136 		return rp->status;  in hci_cc_write_def_err_data_reporting()
1138 	hdev->err_data_reporting = cp->err_data_reporting;  in hci_cc_write_def_err_data_reporting()
1140 	return rp->status;  in hci_cc_write_def_err_data_reporting()
1146 	struct hci_rp_pin_code_reply *rp = data;  in hci_cc_pin_code_reply()  local
1150 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_pin_code_reply()
1155 		mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);  in hci_cc_pin_code_reply()
1157 	if (rp->status)  in hci_cc_pin_code_reply()
1164 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);  in hci_cc_pin_code_reply()
1166 		conn->pin_length = cp->pin_len;  in hci_cc_pin_code_reply()
1170 	return rp->status;  in hci_cc_pin_code_reply()
1176 	struct hci_rp_pin_code_neg_reply *rp = data;  in hci_cc_pin_code_neg_reply()  local
1178 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_pin_code_neg_reply()
1183 		mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,  in hci_cc_pin_code_neg_reply()
1184 						 rp->status);  in hci_cc_pin_code_neg_reply()
1188 	return rp->status;  in hci_cc_pin_code_neg_reply()
1194 	struct hci_rp_le_read_buffer_size *rp = data;  in hci_cc_le_read_buffer_size()  local
1196 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_le_read_buffer_size()
1198 	if (rp->status)  in hci_cc_le_read_buffer_size()
1199 		return rp->status;  in hci_cc_le_read_buffer_size()
1201 	hdev->le_mtu = __le16_to_cpu(rp->le_mtu);  in hci_cc_le_read_buffer_size()
1202 	hdev->le_pkts = rp->le_max_pkt;  in hci_cc_le_read_buffer_size()
1204 	hdev->le_cnt = hdev->le_pkts;  in hci_cc_le_read_buffer_size()
1206 	BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);  in hci_cc_le_read_buffer_size()
1208 	if (hdev->le_mtu && hdev->le_mtu < HCI_MIN_LE_MTU)  in hci_cc_le_read_buffer_size()
1211 	return rp->status;  in hci_cc_le_read_buffer_size()
1217 	struct hci_rp_le_read_local_features *rp = data;  in hci_cc_le_read_local_features()  local
1219 	BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);  in hci_cc_le_read_local_features()
1221 	if (rp->status)  in hci_cc_le_read_local_features()
1222 		return rp->status;  in hci_cc_le_read_local_features()
1224 	memcpy(hdev->le_features, rp->features, 8);  in hci_cc_le_read_local_features()
1226 	return rp->status;  in hci_cc_le_read_local_features()
1232 	struct hci_rp_le_read_adv_tx_power *rp = data;  in hci_cc_le_read_adv_tx_power()  local
1234 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_le_read_adv_tx_power()
1236 	if (rp->status)  in hci_cc_le_read_adv_tx_power()
1237 		return rp->status;  in hci_cc_le_read_adv_tx_power()
1239 	hdev->adv_tx_power = rp->tx_power;  in hci_cc_le_read_adv_tx_power()
1241 	return rp->status;  in hci_cc_le_read_adv_tx_power()
1247 	struct hci_rp_user_confirm_reply *rp = data;  in hci_cc_user_confirm_reply()  local
1249 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_user_confirm_reply()
1254 		mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,  in hci_cc_user_confirm_reply()
1255 						 rp->status);  in hci_cc_user_confirm_reply()
1259 	return rp->status;  in hci_cc_user_confirm_reply()
1265 	struct hci_rp_user_confirm_reply *rp = data;  in hci_cc_user_confirm_neg_reply()  local
1267 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_user_confirm_neg_reply()
1272 		mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,  in hci_cc_user_confirm_neg_reply()
1273 						     ACL_LINK, 0, rp->status);  in hci_cc_user_confirm_neg_reply()
1277 	return rp->status;  in hci_cc_user_confirm_neg_reply()
1283 	struct hci_rp_user_confirm_reply *rp = data;  in hci_cc_user_passkey_reply()  local
1285 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_user_passkey_reply()
1290 		mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,  in hci_cc_user_passkey_reply()
1291 						 0, rp->status);  in hci_cc_user_passkey_reply()
1295 	return rp->status;  in hci_cc_user_passkey_reply()
1301 	struct hci_rp_user_confirm_reply *rp = data;  in hci_cc_user_passkey_neg_reply()  local
1303 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_user_passkey_neg_reply()
1308 		mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,  in hci_cc_user_passkey_neg_reply()
1309 						     ACL_LINK, 0, rp->status);  in hci_cc_user_passkey_neg_reply()
1313 	return rp->status;  in hci_cc_user_passkey_neg_reply()
1319 	struct hci_rp_read_local_oob_data *rp = data;  in hci_cc_read_local_oob_data()  local
1321 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_read_local_oob_data()
1323 	return rp->status;  in hci_cc_read_local_oob_data()
1329 	struct hci_rp_read_local_oob_ext_data *rp = data;  in hci_cc_read_local_oob_ext_data()  local
1331 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_read_local_oob_ext_data()
1333 	return rp->status;  in hci_cc_read_local_oob_ext_data()
1339 	struct hci_ev_status *rp = data;  in hci_cc_le_set_random_addr()  local
1342 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_le_set_random_addr()
1344 	if (rp->status)  in hci_cc_le_set_random_addr()
1345 		return rp->status;  in hci_cc_le_set_random_addr()
1349 		return rp->status;  in hci_cc_le_set_random_addr()
1353 	bacpy(&hdev->random_addr, sent);  in hci_cc_le_set_random_addr()
1355 	if (!bacmp(&hdev->rpa, sent)) {  in hci_cc_le_set_random_addr()
1357 		queue_delayed_work(hdev->workqueue, &hdev->rpa_expired,  in hci_cc_le_set_random_addr()
1358 				   secs_to_jiffies(hdev->rpa_timeout));  in hci_cc_le_set_random_addr()
1363 	return rp->status;  in hci_cc_le_set_random_addr()
1369 	struct hci_ev_status *rp = data;  in hci_cc_le_set_default_phy()  local
1372 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_le_set_default_phy()
1374 	if (rp->status)  in hci_cc_le_set_default_phy()
1375 		return rp->status;  in hci_cc_le_set_default_phy()
1379 		return rp->status;  in hci_cc_le_set_default_phy()
1383 	hdev->le_tx_def_phys = cp->tx_phys;  in hci_cc_le_set_default_phy()
1384 	hdev->le_rx_def_phys = cp->rx_phys;  in hci_cc_le_set_default_phy()
1388 	return rp->status;  in hci_cc_le_set_default_phy()
1394 	struct hci_ev_status *rp = data;  in hci_cc_le_set_adv_set_random_addr()  local
1398 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_le_set_adv_set_random_addr()
1400 	if (rp->status)  in hci_cc_le_set_adv_set_random_addr()
1401 		return rp->status;  in hci_cc_le_set_adv_set_random_addr()
1406 	 * non-extended adverting.  in hci_cc_le_set_adv_set_random_addr()
1408 	if (!cp || !cp->handle)  in hci_cc_le_set_adv_set_random_addr()
1409 		return rp->status;  in hci_cc_le_set_adv_set_random_addr()
1413 	adv = hci_find_adv_instance(hdev, cp->handle);  in hci_cc_le_set_adv_set_random_addr()
1415 		bacpy(&adv->random_addr, &cp->bdaddr);  in hci_cc_le_set_adv_set_random_addr()
1416 		if (!bacmp(&hdev->rpa, &cp->bdaddr)) {  in hci_cc_le_set_adv_set_random_addr()
1417 			adv->rpa_expired = false;  in hci_cc_le_set_adv_set_random_addr()
1418 			queue_delayed_work(hdev->workqueue,  in hci_cc_le_set_adv_set_random_addr()
1419 					   &adv->rpa_expired_cb,  in hci_cc_le_set_adv_set_random_addr()
1420 					   secs_to_jiffies(hdev->rpa_timeout));  in hci_cc_le_set_adv_set_random_addr()
1426 	return rp->status;  in hci_cc_le_set_adv_set_random_addr()
1432 	struct hci_ev_status *rp = data;  in hci_cc_le_remove_adv_set()  local
1436 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_le_remove_adv_set()
1438 	if (rp->status)  in hci_cc_le_remove_adv_set()
1439 		return rp->status;  in hci_cc_le_remove_adv_set()
1443 		return rp->status;  in hci_cc_le_remove_adv_set()
1449 		mgmt_advertising_removed(hci_skb_sk(hdev->sent_cmd), hdev,  in hci_cc_le_remove_adv_set()
1454 	return rp->status;  in hci_cc_le_remove_adv_set()
1460 	struct hci_ev_status *rp = data;  in hci_cc_le_clear_adv_sets()  local
1464 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_le_clear_adv_sets()
1466 	if (rp->status)  in hci_cc_le_clear_adv_sets()
1467 		return rp->status;  in hci_cc_le_clear_adv_sets()
1470 		return rp->status;  in hci_cc_le_clear_adv_sets()
1474 	list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) {  in hci_cc_le_clear_adv_sets()
1475 		u8 instance = adv->instance;  in hci_cc_le_clear_adv_sets()
1479 			mgmt_advertising_removed(hci_skb_sk(hdev->sent_cmd),  in hci_cc_le_clear_adv_sets()
1485 	return rp->status;  in hci_cc_le_clear_adv_sets()
1491 	struct hci_rp_le_read_transmit_power *rp = data;  in hci_cc_le_read_transmit_power()  local
1493 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_le_read_transmit_power()
1495 	if (rp->status)  in hci_cc_le_read_transmit_power()
1496 		return rp->status;  in hci_cc_le_read_transmit_power()
1498 	hdev->min_le_tx_power = rp->min_le_tx_power;  in hci_cc_le_read_transmit_power()
1499 	hdev->max_le_tx_power = rp->max_le_tx_power;  in hci_cc_le_read_transmit_power()
1501 	return rp->status;  in hci_cc_le_read_transmit_power()
1507 	struct hci_ev_status *rp = data;  in hci_cc_le_set_privacy_mode()  local
1511 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_le_set_privacy_mode()
1513 	if (rp->status)  in hci_cc_le_set_privacy_mode()
1514 		return rp->status;  in hci_cc_le_set_privacy_mode()
1518 		return rp->status;  in hci_cc_le_set_privacy_mode()
1522 	params = hci_conn_params_lookup(hdev, &cp->bdaddr, cp->bdaddr_type);  in hci_cc_le_set_privacy_mode()
1524 		WRITE_ONCE(params->privacy_mode, cp->mode);  in hci_cc_le_set_privacy_mode()
1528 	return rp->status;  in hci_cc_le_set_privacy_mode()
1534 	struct hci_ev_status *rp = data;  in hci_cc_le_set_adv_enable()  local
1537 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_le_set_adv_enable()
1539 	if (rp->status)  in hci_cc_le_set_adv_enable()
1540 		return rp->status;  in hci_cc_le_set_adv_enable()
1544 		return rp->status;  in hci_cc_le_set_adv_enable()
1558 			queue_delayed_work(hdev->workqueue,  in hci_cc_le_set_adv_enable()
1559 					   &conn->le_conn_timeout,  in hci_cc_le_set_adv_enable()
1560 					   conn->conn_timeout);  in hci_cc_le_set_adv_enable()
1567 	return rp->status;  in hci_cc_le_set_adv_enable()
1576 	struct hci_ev_status *rp = data;  in hci_cc_le_set_ext_adv_enable()  local
1578 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_le_set_ext_adv_enable()
1580 	if (rp->status)  in hci_cc_le_set_ext_adv_enable()
1581 		return rp->status;  in hci_cc_le_set_ext_adv_enable()
1585 		return rp->status;  in hci_cc_le_set_ext_adv_enable()
1587 	set = (void *)cp->data;  in hci_cc_le_set_ext_adv_enable()
1591 	if (cp->num_of_sets)  in hci_cc_le_set_ext_adv_enable()
1592 		adv = hci_find_adv_instance(hdev, set->handle);  in hci_cc_le_set_ext_adv_enable()
1594 	if (cp->enable) {  in hci_cc_le_set_ext_adv_enable()
1599 		if (adv && !adv->periodic)  in hci_cc_le_set_ext_adv_enable()
1600 			adv->enabled = true;  in hci_cc_le_set_ext_adv_enable()
1604 			queue_delayed_work(hdev->workqueue,  in hci_cc_le_set_ext_adv_enable()
1605 					   &conn->le_conn_timeout,  in hci_cc_le_set_ext_adv_enable()
1606 					   conn->conn_timeout);  in hci_cc_le_set_ext_adv_enable()
1608 		if (cp->num_of_sets) {  in hci_cc_le_set_ext_adv_enable()
1610 				adv->enabled = false;  in hci_cc_le_set_ext_adv_enable()
1615 			list_for_each_entry_safe(adv, n, &hdev->adv_instances,  in hci_cc_le_set_ext_adv_enable()
1617 				if (adv->enabled)  in hci_cc_le_set_ext_adv_enable()
1622 			list_for_each_entry_safe(adv, n, &hdev->adv_instances,  in hci_cc_le_set_ext_adv_enable()
1624 				adv->enabled = false;  in hci_cc_le_set_ext_adv_enable()
1632 	return rp->status;  in hci_cc_le_set_ext_adv_enable()
1639 	struct hci_ev_status *rp = data;  in hci_cc_le_set_scan_param()  local
1641 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_le_set_scan_param()
1643 	if (rp->status)  in hci_cc_le_set_scan_param()
1644 		return rp->status;  in hci_cc_le_set_scan_param()
1648 		return rp->status;  in hci_cc_le_set_scan_param()
1652 	hdev->le_scan_type = cp->type;  in hci_cc_le_set_scan_param()
1656 	return rp->status;  in hci_cc_le_set_scan_param()
1663 	struct hci_ev_status *rp = data;  in hci_cc_le_set_ext_scan_param()  local
1666 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_le_set_ext_scan_param()
1668 	if (rp->status)  in hci_cc_le_set_ext_scan_param()
1669 		return rp->status;  in hci_cc_le_set_ext_scan_param()
1673 		return rp->status;  in hci_cc_le_set_ext_scan_param()
1675 	phy_param = (void *)cp->data;  in hci_cc_le_set_ext_scan_param()
1679 	hdev->le_scan_type = phy_param->type;  in hci_cc_le_set_ext_scan_param()
1683 	return rp->status;  in hci_cc_le_set_ext_scan_param()
1688 	struct discovery_state *d = &hdev->discovery;  in has_pending_adv_report()
1690 	return bacmp(&d->last_adv_addr, BDADDR_ANY);  in has_pending_adv_report()
1695 	struct discovery_state *d = &hdev->discovery;  in clear_pending_adv_report()
1697 	bacpy(&d->last_adv_addr, BDADDR_ANY);  in clear_pending_adv_report()
1698 	d->last_adv_data_len = 0;  in clear_pending_adv_report()
1705 	struct discovery_state *d = &hdev->discovery;  in store_pending_adv_report()
1710 	bacpy(&d->last_adv_addr, bdaddr);  in store_pending_adv_report()
1711 	d->last_adv_addr_type = bdaddr_type;  in store_pending_adv_report()
1712 	d->last_adv_rssi = rssi;  in store_pending_adv_report()
1713 	d->last_adv_flags = flags;  in store_pending_adv_report()
1714 	memcpy(d->last_adv_data, data, len);  in store_pending_adv_report()
1715 	d->last_adv_data_len = len;  in store_pending_adv_report()
1725 		if (hdev->le_scan_type == LE_SCAN_ACTIVE)  in le_set_scan_enable_complete()
1737 			struct discovery_state *d = &hdev->discovery;  in le_set_scan_enable_complete()
1739 			mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,  in le_set_scan_enable_complete()
1740 					  d->last_adv_addr_type, NULL,  in le_set_scan_enable_complete()
1741 					  d->last_adv_rssi, d->last_adv_flags,  in le_set_scan_enable_complete()
1742 					  d->last_adv_data,  in le_set_scan_enable_complete()
1743 					  d->last_adv_data_len, NULL, 0, 0);  in le_set_scan_enable_complete()
1749 		cancel_delayed_work(&hdev->le_scan_disable);  in le_set_scan_enable_complete()
1760 			 hdev->discovery.state == DISCOVERY_FINDING)  in le_set_scan_enable_complete()
1761 			queue_work(hdev->workqueue, &hdev->reenable_adv_work);  in le_set_scan_enable_complete()
1778 	struct hci_ev_status *rp = data;  in hci_cc_le_set_scan_enable()  local
1780 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_le_set_scan_enable()
1782 	if (rp->status)  in hci_cc_le_set_scan_enable()
1783 		return rp->status;  in hci_cc_le_set_scan_enable()
1787 		return rp->status;  in hci_cc_le_set_scan_enable()
1789 	le_set_scan_enable_complete(hdev, cp->enable);  in hci_cc_le_set_scan_enable()
1791 	return rp->status;  in hci_cc_le_set_scan_enable()
1798 	struct hci_ev_status *rp = data;  in hci_cc_le_set_ext_scan_enable()  local
1800 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_le_set_ext_scan_enable()
1802 	if (rp->status)  in hci_cc_le_set_ext_scan_enable()
1803 		return rp->status;  in hci_cc_le_set_ext_scan_enable()
1807 		return rp->status;  in hci_cc_le_set_ext_scan_enable()
1809 	le_set_scan_enable_complete(hdev, cp->enable);  in hci_cc_le_set_ext_scan_enable()
1811 	return rp->status;  in hci_cc_le_set_ext_scan_enable()
1817 	struct hci_rp_le_read_num_supported_adv_sets *rp = data;  in hci_cc_le_read_num_adv_sets()  local
1819 	bt_dev_dbg(hdev, "status 0x%2.2x No of Adv sets %u", rp->status,  in hci_cc_le_read_num_adv_sets()
1820 		   rp->num_of_sets);  in hci_cc_le_read_num_adv_sets()
1822 	if (rp->status)  in hci_cc_le_read_num_adv_sets()
1823 		return rp->status;  in hci_cc_le_read_num_adv_sets()
1825 	hdev->le_num_of_adv_sets = rp->num_of_sets;  in hci_cc_le_read_num_adv_sets()
1827 	return rp->status;  in hci_cc_le_read_num_adv_sets()
1833 	struct hci_rp_le_read_accept_list_size *rp = data;  in hci_cc_le_read_accept_list_size()  local
1835 	bt_dev_dbg(hdev, "status 0x%2.2x size %u", rp->status, rp->size);  in hci_cc_le_read_accept_list_size()
1837 	if (rp->status)  in hci_cc_le_read_accept_list_size()
1838 		return rp->status;  in hci_cc_le_read_accept_list_size()
1840 	hdev->le_accept_list_size = rp->size;  in hci_cc_le_read_accept_list_size()
1842 	return rp->status;  in hci_cc_le_read_accept_list_size()
1848 	struct hci_ev_status *rp = data;  in hci_cc_le_clear_accept_list()  local
1850 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_le_clear_accept_list()
1852 	if (rp->status)  in hci_cc_le_clear_accept_list()
1853 		return rp->status;  in hci_cc_le_clear_accept_list()
1856 	hci_bdaddr_list_clear(&hdev->le_accept_list);  in hci_cc_le_clear_accept_list()
1859 	return rp->status;  in hci_cc_le_clear_accept_list()
1866 	struct hci_ev_status *rp = data;  in hci_cc_le_add_to_accept_list()  local
1868 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_le_add_to_accept_list()
1870 	if (rp->status)  in hci_cc_le_add_to_accept_list()
1871 		return rp->status;  in hci_cc_le_add_to_accept_list()
1875 		return rp->status;  in hci_cc_le_add_to_accept_list()
1878 	hci_bdaddr_list_add(&hdev->le_accept_list, &sent->bdaddr,  in hci_cc_le_add_to_accept_list()
1879 			    sent->bdaddr_type);  in hci_cc_le_add_to_accept_list()
1882 	return rp->status;  in hci_cc_le_add_to_accept_list()
1889 	struct hci_ev_status *rp = data;  in hci_cc_le_del_from_accept_list()  local
1891 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_le_del_from_accept_list()
1893 	if (rp->status)  in hci_cc_le_del_from_accept_list()
1894 		return rp->status;  in hci_cc_le_del_from_accept_list()
1898 		return rp->status;  in hci_cc_le_del_from_accept_list()
1901 	hci_bdaddr_list_del(&hdev->le_accept_list, &sent->bdaddr,  in hci_cc_le_del_from_accept_list()
1902 			    sent->bdaddr_type);  in hci_cc_le_del_from_accept_list()
1905 	return rp->status;  in hci_cc_le_del_from_accept_list()
1911 	struct hci_rp_le_read_supported_states *rp = data;  in hci_cc_le_read_supported_states()  local
1913 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_le_read_supported_states()
1915 	if (rp->status)  in hci_cc_le_read_supported_states()
1916 		return rp->status;  in hci_cc_le_read_supported_states()
1918 	memcpy(hdev->le_states, rp->le_states, 8);  in hci_cc_le_read_supported_states()
1920 	return rp->status;  in hci_cc_le_read_supported_states()
1926 	struct hci_rp_le_read_def_data_len *rp = data;  in hci_cc_le_read_def_data_len()  local
1928 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_le_read_def_data_len()
1930 	if (rp->status)  in hci_cc_le_read_def_data_len()
1931 		return rp->status;  in hci_cc_le_read_def_data_len()
1933 	hdev->le_def_tx_len = le16_to_cpu(rp->tx_len);  in hci_cc_le_read_def_data_len()
1934 	hdev->le_def_tx_time = le16_to_cpu(rp->tx_time);  in hci_cc_le_read_def_data_len()
1936 	return rp->status;  in hci_cc_le_read_def_data_len()
1943 	struct hci_ev_status *rp = data;  in hci_cc_le_write_def_data_len()  local
1945 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_le_write_def_data_len()
1947 	if (rp->status)  in hci_cc_le_write_def_data_len()
1948 		return rp->status;  in hci_cc_le_write_def_data_len()
1952 		return rp->status;  in hci_cc_le_write_def_data_len()
1954 	hdev->le_def_tx_len = le16_to_cpu(sent->tx_len);  in hci_cc_le_write_def_data_len()
1955 	hdev->le_def_tx_time = le16_to_cpu(sent->tx_time);  in hci_cc_le_write_def_data_len()
1957 	return rp->status;  in hci_cc_le_write_def_data_len()
1964 	struct hci_ev_status *rp = data;  in hci_cc_le_add_to_resolv_list()  local
1966 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_le_add_to_resolv_list()
1968 	if (rp->status)  in hci_cc_le_add_to_resolv_list()
1969 		return rp->status;  in hci_cc_le_add_to_resolv_list()
1973 		return rp->status;  in hci_cc_le_add_to_resolv_list()
1976 	hci_bdaddr_list_add_with_irk(&hdev->le_resolv_list, &sent->bdaddr,  in hci_cc_le_add_to_resolv_list()
1977 				sent->bdaddr_type, sent->peer_irk,  in hci_cc_le_add_to_resolv_list()
1978 				sent->local_irk);  in hci_cc_le_add_to_resolv_list()
1981 	return rp->status;  in hci_cc_le_add_to_resolv_list()
1988 	struct hci_ev_status *rp = data;  in hci_cc_le_del_from_resolv_list()  local
1990 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_le_del_from_resolv_list()
1992 	if (rp->status)  in hci_cc_le_del_from_resolv_list()
1993 		return rp->status;  in hci_cc_le_del_from_resolv_list()
1997 		return rp->status;  in hci_cc_le_del_from_resolv_list()
2000 	hci_bdaddr_list_del_with_irk(&hdev->le_resolv_list, &sent->bdaddr,  in hci_cc_le_del_from_resolv_list()
2001 			    sent->bdaddr_type);  in hci_cc_le_del_from_resolv_list()
2004 	return rp->status;  in hci_cc_le_del_from_resolv_list()
2010 	struct hci_ev_status *rp = data;  in hci_cc_le_clear_resolv_list()  local
2012 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_le_clear_resolv_list()
2014 	if (rp->status)  in hci_cc_le_clear_resolv_list()
2015 		return rp->status;  in hci_cc_le_clear_resolv_list()
2018 	hci_bdaddr_list_clear(&hdev->le_resolv_list);  in hci_cc_le_clear_resolv_list()
2021 	return rp->status;  in hci_cc_le_clear_resolv_list()
2027 	struct hci_rp_le_read_resolv_list_size *rp = data;  in hci_cc_le_read_resolv_list_size()  local
2029 	bt_dev_dbg(hdev, "status 0x%2.2x size %u", rp->status, rp->size);  in hci_cc_le_read_resolv_list_size()
2031 	if (rp->status)  in hci_cc_le_read_resolv_list_size()
2032 		return rp->status;  in hci_cc_le_read_resolv_list_size()
2034 	hdev->le_resolv_list_size = rp->size;  in hci_cc_le_read_resolv_list_size()
2036 	return rp->status;  in hci_cc_le_read_resolv_list_size()
2042 	struct hci_ev_status *rp = data;  in hci_cc_le_set_addr_resolution_enable()  local
2045 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_le_set_addr_resolution_enable()
2047 	if (rp->status)  in hci_cc_le_set_addr_resolution_enable()
2048 		return rp->status;  in hci_cc_le_set_addr_resolution_enable()
2052 		return rp->status;  in hci_cc_le_set_addr_resolution_enable()
2063 	return rp->status;  in hci_cc_le_set_addr_resolution_enable()
2069 	struct hci_rp_le_read_max_data_len *rp = data;  in hci_cc_le_read_max_data_len()  local
2071 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_le_read_max_data_len()
2073 	if (rp->status)  in hci_cc_le_read_max_data_len()
2074 		return rp->status;  in hci_cc_le_read_max_data_len()
2076 	hdev->le_max_tx_len = le16_to_cpu(rp->tx_len);  in hci_cc_le_read_max_data_len()
2077 	hdev->le_max_tx_time = le16_to_cpu(rp->tx_time);  in hci_cc_le_read_max_data_len()
2078 	hdev->le_max_rx_len = le16_to_cpu(rp->rx_len);  in hci_cc_le_read_max_data_len()
2079 	hdev->le_max_rx_time = le16_to_cpu(rp->rx_time);  in hci_cc_le_read_max_data_len()
2081 	return rp->status;  in hci_cc_le_read_max_data_len()
2088 	struct hci_ev_status *rp = data;  in hci_cc_write_le_host_supported()  local
2090 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_write_le_host_supported()
2092 	if (rp->status)  in hci_cc_write_le_host_supported()
2093 		return rp->status;  in hci_cc_write_le_host_supported()
2097 		return rp->status;  in hci_cc_write_le_host_supported()
2101 	if (sent->le) {  in hci_cc_write_le_host_supported()
2102 		hdev->features[1][0] |= LMP_HOST_LE;  in hci_cc_write_le_host_supported()
2105 		hdev->features[1][0] &= ~LMP_HOST_LE;  in hci_cc_write_le_host_supported()
2110 	if (sent->simul)  in hci_cc_write_le_host_supported()
2111 		hdev->features[1][0] |= LMP_HOST_LE_BREDR;  in hci_cc_write_le_host_supported()
2113 		hdev->features[1][0] &= ~LMP_HOST_LE_BREDR;  in hci_cc_write_le_host_supported()
2117 	return rp->status;  in hci_cc_write_le_host_supported()
2124 	struct hci_ev_status *rp = data;  in hci_cc_set_adv_param()  local
2126 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_set_adv_param()
2128 	if (rp->status)  in hci_cc_set_adv_param()
2129 		return rp->status;  in hci_cc_set_adv_param()
2133 		return rp->status;  in hci_cc_set_adv_param()
2136 	hdev->adv_addr_type = cp->own_address_type;  in hci_cc_set_adv_param()
2139 	return rp->status;  in hci_cc_set_adv_param()
2145 	struct hci_rp_read_rssi *rp = data;  in hci_cc_read_rssi()  local
2148 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_read_rssi()
2150 	if (rp->status)  in hci_cc_read_rssi()
2151 		return rp->status;  in hci_cc_read_rssi()
2155 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));  in hci_cc_read_rssi()
2157 		conn->rssi = rp->rssi;  in hci_cc_read_rssi()
2161 	return rp->status;  in hci_cc_read_rssi()
2168 	struct hci_rp_read_tx_power *rp = data;  in hci_cc_read_tx_power()  local
2171 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_read_tx_power()
2173 	if (rp->status)  in hci_cc_read_tx_power()
2174 		return rp->status;  in hci_cc_read_tx_power()
2178 		return rp->status;  in hci_cc_read_tx_power()
2182 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));  in hci_cc_read_tx_power()
2186 	switch (sent->type) {  in hci_cc_read_tx_power()
2188 		conn->tx_power = rp->tx_power;  in hci_cc_read_tx_power()
2191 		conn->max_tx_power = rp->tx_power;  in hci_cc_read_tx_power()
2197 	return rp->status;  in hci_cc_read_tx_power()
2203 	struct hci_ev_status *rp = data;  in hci_cc_write_ssp_debug_mode()  local
2206 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_write_ssp_debug_mode()
2208 	if (rp->status)  in hci_cc_write_ssp_debug_mode()
2209 		return rp->status;  in hci_cc_write_ssp_debug_mode()
2213 		hdev->ssp_debug_mode = *mode;  in hci_cc_write_ssp_debug_mode()
2215 	return rp->status;  in hci_cc_write_ssp_debug_mode()
2220 	bt_dev_dbg(hdev, "status 0x%2.2x", status);  in hci_cs_inquiry()
2226 		set_bit(HCI_INQUIRY, &hdev->flags);  in hci_cs_inquiry()
2234 	bt_dev_dbg(hdev, "status 0x%2.2x", status);  in hci_cs_create_conn()
2242 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);  in hci_cs_create_conn()
2244 	bt_dev_dbg(hdev, "bdaddr %pMR hcon %p", &cp->bdaddr, conn);  in hci_cs_create_conn()
2247 		if (conn && conn->state == BT_CONNECT) {  in hci_cs_create_conn()
2248 			conn->state = BT_CLOSED;  in hci_cs_create_conn()
2254 			conn = hci_conn_add_unset(hdev, ACL_LINK, &cp->bdaddr,  in hci_cs_create_conn()
2271 	bt_dev_dbg(hdev, "status 0x%2.2x", status);  in hci_cs_add_sco()
2280 	handle = __le16_to_cpu(cp->handle);  in hci_cs_add_sco()
2282 	bt_dev_dbg(hdev, "handle 0x%4.4x", handle);  in hci_cs_add_sco()
2288 		link = list_first_entry_or_null(&acl->link_list,  in hci_cs_add_sco()
2290 		if (link && link->conn) {  in hci_cs_add_sco()
2291 			link->conn->state = BT_CLOSED;  in hci_cs_add_sco()
2293 			hci_connect_cfm(link->conn, status);  in hci_cs_add_sco()
2294 			hci_conn_del(link->conn);  in hci_cs_add_sco()
2306 	bt_dev_dbg(hdev, "status 0x%2.2x", status);  in hci_cs_auth_requested()
2317 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));  in hci_cs_auth_requested()
2319 		if (conn->state == BT_CONFIG) {  in hci_cs_auth_requested()
2333 	bt_dev_dbg(hdev, "status 0x%2.2x", status);  in hci_cs_set_conn_encrypt()
2344 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));  in hci_cs_set_conn_encrypt()
2346 		if (conn->state == BT_CONFIG) {  in hci_cs_set_conn_encrypt()
2358 	if (conn->state != BT_CONFIG || !conn->out)  in hci_outgoing_auth_needed()
2361 	if (conn->pending_sec_level == BT_SECURITY_SDP)  in hci_outgoing_auth_needed()
2364 	/* Only request authentication for SSP connections or non-SSP  in hci_outgoing_auth_needed()
2368 	if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&  in hci_outgoing_auth_needed()
2369 	    conn->pending_sec_level != BT_SECURITY_FIPS &&  in hci_outgoing_auth_needed()
2370 	    conn->pending_sec_level != BT_SECURITY_HIGH &&  in hci_outgoing_auth_needed()
2371 	    conn->pending_sec_level != BT_SECURITY_MEDIUM)  in hci_outgoing_auth_needed()
2384 	bacpy(&cp.bdaddr, &e->data.bdaddr);  in hci_resolve_name()
2385 	cp.pscan_rep_mode = e->data.pscan_rep_mode;  in hci_resolve_name()
2386 	cp.pscan_mode = e->data.pscan_mode;  in hci_resolve_name()
2387 	cp.clock_offset = e->data.clock_offset;  in hci_resolve_name()
2394 	struct discovery_state *discov = &hdev->discovery;  in hci_resolve_next_name()
2397 	if (list_empty(&discov->resolve))  in hci_resolve_next_name()
2401 	if (time_after(jiffies, discov->name_resolve_timeout)) {  in hci_resolve_next_name()
2411 		e->name_state = NAME_PENDING;  in hci_resolve_next_name()
2421 	struct discovery_state *discov = &hdev->discovery;  in hci_check_pending_name()
2429 	if (conn && (conn->state == BT_CONFIG || conn->state == BT_CONNECTED))  in hci_check_pending_name()
2432 	if (discov->state == DISCOVERY_STOPPED)  in hci_check_pending_name()
2435 	if (discov->state == DISCOVERY_STOPPING)  in hci_check_pending_name()
2438 	if (discov->state != DISCOVERY_RESOLVING)  in hci_check_pending_name()
2449 	list_del(&e->list);  in hci_check_pending_name()
2451 	e->name_state = name ? NAME_KNOWN : NAME_NOT_KNOWN;  in hci_check_pending_name()
2452 	mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00, e->data.rssi,  in hci_check_pending_name()
2467 	bt_dev_dbg(hdev, "status 0x%2.2x", status);  in hci_cs_remote_name_req()
2480 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);  in hci_cs_remote_name_req()
2483 		hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);  in hci_cs_remote_name_req()
2491 	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {  in hci_cs_remote_name_req()
2494 		set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);  in hci_cs_remote_name_req()
2496 		auth_cp.handle = __cpu_to_le16(conn->handle);  in hci_cs_remote_name_req()
2510 	bt_dev_dbg(hdev, "status 0x%2.2x", status);  in hci_cs_read_remote_features()
2521 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));  in hci_cs_read_remote_features()
2523 		if (conn->state == BT_CONFIG) {  in hci_cs_read_remote_features()
2537 	bt_dev_dbg(hdev, "status 0x%2.2x", status);  in hci_cs_read_remote_ext_features()
2548 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));  in hci_cs_read_remote_ext_features()
2550 		if (conn->state == BT_CONFIG) {  in hci_cs_read_remote_ext_features()
2565 	bt_dev_dbg(hdev, "handle 0x%4.4x status 0x%2.2x", handle, status);  in hci_setup_sync_conn_status()
2571 		link = list_first_entry_or_null(&acl->link_list,  in hci_setup_sync_conn_status()
2573 		if (link && link->conn) {  in hci_setup_sync_conn_status()
2574 			link->conn->state = BT_CLOSED;  in hci_setup_sync_conn_status()
2576 			hci_connect_cfm(link->conn, status);  in hci_setup_sync_conn_status()
2577 			hci_conn_del(link->conn);  in hci_setup_sync_conn_status()
2588 	bt_dev_dbg(hdev, "status 0x%2.2x", status);  in hci_cs_setup_sync_conn()
2597 	hci_setup_sync_conn_status(hdev, __le16_to_cpu(cp->handle), status);  in hci_cs_setup_sync_conn()
2604 	bt_dev_dbg(hdev, "status 0x%2.2x", status);  in hci_cs_enhanced_setup_sync_conn()
2613 	hci_setup_sync_conn_status(hdev, __le16_to_cpu(cp->handle), status);  in hci_cs_enhanced_setup_sync_conn()
2621 	bt_dev_dbg(hdev, "status 0x%2.2x", status);  in hci_cs_sniff_mode()
2632 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));  in hci_cs_sniff_mode()
2634 		clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);  in hci_cs_sniff_mode()
2636 		if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))  in hci_cs_sniff_mode()
2648 	bt_dev_dbg(hdev, "status 0x%2.2x", status);  in hci_cs_exit_sniff_mode()
2659 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));  in hci_cs_exit_sniff_mode()
2661 		clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);  in hci_cs_exit_sniff_mode()
2663 		if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))  in hci_cs_exit_sniff_mode()
2677 	bt_dev_dbg(hdev, "status 0x%2.2x", status);  in hci_cs_disconnect()
2682 	if (!status && !hdev->suspended)  in hci_cs_disconnect()
2691 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));  in hci_cs_disconnect()
2696 		mgmt_disconnect_failed(hdev, &conn->dst, conn->type,  in hci_cs_disconnect()
2697 				       conn->dst_type, status);  in hci_cs_disconnect()
2699 		if (conn->type == LE_LINK && conn->role == HCI_ROLE_SLAVE) {  in hci_cs_disconnect()
2700 			hdev->cur_adv_instance = conn->adv_instance;  in hci_cs_disconnect()
2710 	mgmt_conn = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags);  in hci_cs_disconnect()
2712 	if (conn->type == ACL_LINK) {  in hci_cs_disconnect()
2713 		if (test_and_clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags))  in hci_cs_disconnect()
2714 			hci_remove_link_key(hdev, &conn->dst);  in hci_cs_disconnect()
2717 	params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);  in hci_cs_disconnect()
2719 		switch (params->auto_connect) {  in hci_cs_disconnect()
2721 			if (cp->reason != HCI_ERROR_CONNECTION_TIMEOUT)  in hci_cs_disconnect()
2728 			hci_pend_le_list_add(params, &hdev->pend_le_conns);  in hci_cs_disconnect()
2736 	mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type,  in hci_cs_disconnect()
2737 				 cp->reason, mgmt_conn);  in hci_cs_disconnect()
2739 	hci_disconn_cfm(conn, cp->reason);  in hci_cs_disconnect()
2744 	 * Hence, we need to do some basic cleanup here and re-enable  in hci_cs_disconnect()
2791 	conn->init_addr_type = own_address_type;  in cs_le_create_conn()
2793 		bacpy(&conn->init_addr, &hdev->random_addr);  in cs_le_create_conn()
2795 		bacpy(&conn->init_addr, &hdev->bdaddr);  in cs_le_create_conn()
2797 	conn->resp_addr_type = peer_addr_type;  in cs_le_create_conn()
2798 	bacpy(&conn->resp_addr, peer_addr);  in cs_le_create_conn()
2805 	bt_dev_dbg(hdev, "status 0x%2.2x", status);  in hci_cs_le_create_conn()
2820 	cs_le_create_conn(hdev, &cp->peer_addr, cp->peer_addr_type,  in hci_cs_le_create_conn()
2821 			  cp->own_address_type, cp->filter_policy);  in hci_cs_le_create_conn()
2830 	bt_dev_dbg(hdev, "status 0x%2.2x", status);  in hci_cs_le_ext_create_conn()
2845 	cs_le_create_conn(hdev, &cp->peer_addr, cp->peer_addr_type,  in hci_cs_le_ext_create_conn()
2846 			  cp->own_addr_type, cp->filter_policy);  in hci_cs_le_ext_create_conn()
2856 	bt_dev_dbg(hdev, "status 0x%2.2x", status);  in hci_cs_le_read_remote_features()
2867 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));  in hci_cs_le_read_remote_features()
2869 		if (conn->state == BT_CONFIG) {  in hci_cs_le_read_remote_features()
2883 	bt_dev_dbg(hdev, "status 0x%2.2x", status);  in hci_cs_le_start_enc()
2894 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));  in hci_cs_le_start_enc()
2898 	if (conn->state != BT_CONNECTED)  in hci_cs_le_start_enc()
2913 	BT_DBG("%s status 0x%2.2x", hdev->name, status);  in hci_cs_switch_role()
2924 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);  in hci_cs_switch_role()
2926 		clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);  in hci_cs_switch_role()
2935 	struct discovery_state *discov = &hdev->discovery;  in hci_inquiry_complete_evt()
2938 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);  in hci_inquiry_complete_evt()
2940 	if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))  in hci_inquiry_complete_evt()
2944 	wake_up_bit(&hdev->flags, HCI_INQUIRY);  in hci_inquiry_complete_evt()
2951 	if (discov->state != DISCOVERY_FINDING)  in hci_inquiry_complete_evt()
2954 	if (list_empty(&discov->resolve)) {  in hci_inquiry_complete_evt()
2963 		    !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))  in hci_inquiry_complete_evt()
2970 		e->name_state = NAME_PENDING;  in hci_inquiry_complete_evt()
2972 		discov->name_resolve_timeout = jiffies + NAME_RESOLVE_DURATION;  in hci_inquiry_complete_evt()
2982 		    !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))  in hci_inquiry_complete_evt()
2998 			     flex_array_size(ev, info, ev->num)))  in hci_inquiry_result_evt()
3001 	bt_dev_dbg(hdev, "num %d", ev->num);  in hci_inquiry_result_evt()
3003 	if (!ev->num)  in hci_inquiry_result_evt()
3011 	for (i = 0; i < ev->num; i++) {  in hci_inquiry_result_evt()
3012 		struct inquiry_info *info = &ev->info[i];  in hci_inquiry_result_evt()
3015 		bacpy(&data.bdaddr, &info->bdaddr);  in hci_inquiry_result_evt()
3016 		data.pscan_rep_mode	= info->pscan_rep_mode;  in hci_inquiry_result_evt()
3017 		data.pscan_period_mode	= info->pscan_period_mode;  in hci_inquiry_result_evt()
3018 		data.pscan_mode		= info->pscan_mode;  in hci_inquiry_result_evt()
3019 		memcpy(data.dev_class, info->dev_class, 3);  in hci_inquiry_result_evt()
3020 		data.clock_offset	= info->clock_offset;  in hci_inquiry_result_evt()
3026 		mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,  in hci_inquiry_result_evt()
3027 				  info->dev_class, HCI_RSSI_INVALID,  in hci_inquiry_result_evt()
3039 	u8 status = ev->status;  in hci_conn_complete_evt()
3041 	bt_dev_dbg(hdev, "status 0x%2.2x", status);  in hci_conn_complete_evt()
3045 	conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);  in hci_conn_complete_evt()
3050 		if (ev->status)  in hci_conn_complete_evt()
3053 		/* Connection may not exist if auto-connected. Check the bredr  in hci_conn_complete_evt()
3058 		 * Auto-connect will only occur if the event filter is  in hci_conn_complete_evt()
3062 		if (ev->link_type == ACL_LINK &&  in hci_conn_complete_evt()
3063 		    hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,  in hci_conn_complete_evt()
3064 						      &ev->bdaddr,  in hci_conn_complete_evt()
3066 			conn = hci_conn_add_unset(hdev, ev->link_type,  in hci_conn_complete_evt()
3067 						  &ev->bdaddr, HCI_ROLE_SLAVE);  in hci_conn_complete_evt()
3073 			if (ev->link_type != SCO_LINK)  in hci_conn_complete_evt()
3077 						       &ev->bdaddr);  in hci_conn_complete_evt()
3081 			conn->type = SCO_LINK;  in hci_conn_complete_evt()
3091 	if (!HCI_CONN_HANDLE_UNSET(conn->handle)) {  in hci_conn_complete_evt()
3097 		status = hci_conn_set_handle(conn, __le16_to_cpu(ev->handle));  in hci_conn_complete_evt()
3101 		if (conn->type == ACL_LINK) {  in hci_conn_complete_evt()
3102 			conn->state = BT_CONFIG;  in hci_conn_complete_evt()
3105 			if (!conn->out && !hci_conn_ssp_enabled(conn) &&  in hci_conn_complete_evt()
3106 			    !hci_find_link_key(hdev, &ev->bdaddr))  in hci_conn_complete_evt()
3107 				conn->disc_timeout = HCI_PAIRING_TIMEOUT;  in hci_conn_complete_evt()
3109 				conn->disc_timeout = HCI_DISCONN_TIMEOUT;  in hci_conn_complete_evt()
3111 			conn->state = BT_CONNECTED;  in hci_conn_complete_evt()
3116 		if (test_bit(HCI_AUTH, &hdev->flags))  in hci_conn_complete_evt()
3117 			set_bit(HCI_CONN_AUTH, &conn->flags);  in hci_conn_complete_evt()
3119 		if (test_bit(HCI_ENCRYPT, &hdev->flags))  in hci_conn_complete_evt()
3120 			set_bit(HCI_CONN_ENCRYPT, &conn->flags);  in hci_conn_complete_evt()
3123 		if (ev->encr_mode == 1 && !test_bit(HCI_CONN_ENCRYPT, &conn->flags) &&  in hci_conn_complete_evt()
3124 		    ev->link_type == ACL_LINK) {  in hci_conn_complete_evt()
3128 			key = hci_find_link_key(hdev, &ev->bdaddr);  in hci_conn_complete_evt()
3130 				set_bit(HCI_CONN_ENCRYPT, &conn->flags);  in hci_conn_complete_evt()
3133 					conn->enc_key_size = HCI_LINK_KEY_SIZE;  in hci_conn_complete_evt()
3135 					cp.handle = cpu_to_le16(conn->handle);  in hci_conn_complete_evt()
3139 						conn->enc_key_size = HCI_LINK_KEY_SIZE;  in hci_conn_complete_evt()
3143 				hci_encrypt_cfm(conn, ev->status);  in hci_conn_complete_evt()
3148 		if (conn->type == ACL_LINK) {  in hci_conn_complete_evt()
3150 			cp.handle = ev->handle;  in hci_conn_complete_evt()
3158 		if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {  in hci_conn_complete_evt()
3160 			cp.handle = ev->handle;  in hci_conn_complete_evt()
3161 			cp.pkt_type = cpu_to_le16(conn->pkt_type);  in hci_conn_complete_evt()
3167 	if (conn->type == ACL_LINK)  in hci_conn_complete_evt()
3168 		hci_sco_setup(conn, ev->status);  in hci_conn_complete_evt()
3173 	} else if (ev->link_type == SCO_LINK) {  in hci_conn_complete_evt()
3174 		switch (conn->setting & SCO_AIRMODE_MASK) {  in hci_conn_complete_evt()
3176 			if (hdev->notify)  in hci_conn_complete_evt()
3177 				hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_CVSD);  in hci_conn_complete_evt()
3201 	int mask = hdev->link_mode;  in hci_conn_request_evt()
3206 	bt_dev_dbg(hdev, "bdaddr %pMR type 0x%x", &ev->bdaddr, ev->link_type);  in hci_conn_request_evt()
3209 	 * CVE-2020-26555  in hci_conn_request_evt()
3211 	if (hdev && !bacmp(&hdev->bdaddr, &ev->bdaddr)) {  in hci_conn_request_evt()
3213 			   &ev->bdaddr);  in hci_conn_request_evt()
3214 		hci_reject_conn(hdev, &ev->bdaddr);  in hci_conn_request_evt()
3218 	mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,  in hci_conn_request_evt()
3222 		hci_reject_conn(hdev, &ev->bdaddr);  in hci_conn_request_evt()
3228 	if (hci_bdaddr_list_lookup(&hdev->reject_list, &ev->bdaddr,  in hci_conn_request_evt()
3230 		hci_reject_conn(hdev, &ev->bdaddr);  in hci_conn_request_evt()
3240 	    !hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, &ev->bdaddr,  in hci_conn_request_evt()
3242 		hci_reject_conn(hdev, &ev->bdaddr);  in hci_conn_request_evt()
3248 	ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);  in hci_conn_request_evt()
3250 		memcpy(ie->data.dev_class, ev->dev_class, 3);  in hci_conn_request_evt()
3252 	conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,  in hci_conn_request_evt()
3253 			&ev->bdaddr);  in hci_conn_request_evt()
3255 		conn = hci_conn_add_unset(hdev, ev->link_type, &ev->bdaddr,  in hci_conn_request_evt()
3263 	memcpy(conn->dev_class, ev->dev_class, 3);  in hci_conn_request_evt()
3267 	if (ev->link_type == ACL_LINK ||  in hci_conn_request_evt()
3270 		conn->state = BT_CONNECT;  in hci_conn_request_evt()
3272 		bacpy(&cp.bdaddr, &ev->bdaddr);  in hci_conn_request_evt()
3282 		conn->state = BT_CONNECT;  in hci_conn_request_evt()
3284 		bacpy(&cp.bdaddr, &ev->bdaddr);  in hci_conn_request_evt()
3285 		cp.pkt_type = cpu_to_le16(conn->pkt_type);  in hci_conn_request_evt()
3290 		cp.content_format = cpu_to_le16(hdev->voice_setting);  in hci_conn_request_evt()
3296 		conn->state = BT_CONNECT2;  in hci_conn_request_evt()
3330 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);  in hci_disconn_complete_evt()
3334 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));  in hci_disconn_complete_evt()
3338 	if (ev->status) {  in hci_disconn_complete_evt()
3339 		mgmt_disconnect_failed(hdev, &conn->dst, conn->type,  in hci_disconn_complete_evt()
3340 				       conn->dst_type, ev->status);  in hci_disconn_complete_evt()
3344 	conn->state = BT_CLOSED;  in hci_disconn_complete_evt()
3346 	mgmt_connected = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags);  in hci_disconn_complete_evt()
3348 	if (test_bit(HCI_CONN_AUTH_FAILURE, &conn->flags))  in hci_disconn_complete_evt()
3351 		reason = hci_to_mgmt_reason(ev->reason);  in hci_disconn_complete_evt()
3353 	mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type,  in hci_disconn_complete_evt()
3356 	if (conn->type == ACL_LINK) {  in hci_disconn_complete_evt()
3357 		if (test_and_clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags))  in hci_disconn_complete_evt()
3358 			hci_remove_link_key(hdev, &conn->dst);  in hci_disconn_complete_evt()
3363 	/* Re-enable passive scanning if disconnected device is marked  in hci_disconn_complete_evt()
3364 	 * as auto-connectable.  in hci_disconn_complete_evt()
3366 	if (conn->type == LE_LINK) {  in hci_disconn_complete_evt()
3367 		params = hci_conn_params_lookup(hdev, &conn->dst,  in hci_disconn_complete_evt()
3368 						conn->dst_type);  in hci_disconn_complete_evt()
3370 			switch (params->auto_connect) {  in hci_disconn_complete_evt()
3372 				if (ev->reason != HCI_ERROR_CONNECTION_TIMEOUT)  in hci_disconn_complete_evt()
3380 						     &hdev->pend_le_conns);  in hci_disconn_complete_evt()
3390 	hci_disconn_cfm(conn, ev->reason);  in hci_disconn_complete_evt()
3392 	/* Re-enable advertising if necessary, since it might  in hci_disconn_complete_evt()
3402 	if (conn->type == LE_LINK && conn->role == HCI_ROLE_SLAVE) {  in hci_disconn_complete_evt()
3403 		hdev->cur_adv_instance = conn->adv_instance;  in hci_disconn_complete_evt()
3419 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);  in hci_auth_complete_evt()
3423 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));  in hci_auth_complete_evt()
3427 	if (!ev->status) {  in hci_auth_complete_evt()
3428 		clear_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);  in hci_auth_complete_evt()
3429 		set_bit(HCI_CONN_AUTH, &conn->flags);  in hci_auth_complete_evt()
3430 		conn->sec_level = conn->pending_sec_level;  in hci_auth_complete_evt()
3432 		if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)  in hci_auth_complete_evt()
3433 			set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);  in hci_auth_complete_evt()
3435 		mgmt_auth_failed(conn, ev->status);  in hci_auth_complete_evt()
3438 	clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);  in hci_auth_complete_evt()
3440 	if (conn->state == BT_CONFIG) {  in hci_auth_complete_evt()
3441 		if (!ev->status && hci_conn_ssp_enabled(conn)) {  in hci_auth_complete_evt()
3443 			cp.handle  = ev->handle;  in hci_auth_complete_evt()
3448 			conn->state = BT_CONNECTED;  in hci_auth_complete_evt()
3449 			hci_connect_cfm(conn, ev->status);  in hci_auth_complete_evt()
3453 		hci_auth_cfm(conn, ev->status);  in hci_auth_complete_evt()
3456 		conn->disc_timeout = HCI_DISCONN_TIMEOUT;  in hci_auth_complete_evt()
3460 	if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {  in hci_auth_complete_evt()
3461 		if (!ev->status) {  in hci_auth_complete_evt()
3463 			cp.handle  = ev->handle;  in hci_auth_complete_evt()
3468 			clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);  in hci_auth_complete_evt()
3469 			hci_encrypt_cfm(conn, ev->status);  in hci_auth_complete_evt()
3483 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);  in hci_remote_name_evt()
3487 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);  in hci_remote_name_evt()
3492 	if (ev->status == 0)  in hci_remote_name_evt()
3493 		hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,  in hci_remote_name_evt()
3494 				       strnlen(ev->name, HCI_MAX_NAME_LENGTH));  in hci_remote_name_evt()
3496 		hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);  in hci_remote_name_evt()
3505 	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {  in hci_remote_name_evt()
3508 		set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);  in hci_remote_name_evt()
3510 		cp.handle = __cpu_to_le16(conn->handle);  in hci_remote_name_evt()
3524 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);  in hci_encrypt_change_evt()
3528 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));  in hci_encrypt_change_evt()
3532 	if (!ev->status) {  in hci_encrypt_change_evt()
3533 		if (ev->encrypt) {  in hci_encrypt_change_evt()
3535 			set_bit(HCI_CONN_AUTH, &conn->flags);  in hci_encrypt_change_evt()
3536 			set_bit(HCI_CONN_ENCRYPT, &conn->flags);  in hci_encrypt_change_evt()
3537 			conn->sec_level = conn->pending_sec_level;  in hci_encrypt_change_evt()
3539 			/* P-256 authentication key implies FIPS */  in hci_encrypt_change_evt()
3540 			if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256)  in hci_encrypt_change_evt()
3541 				set_bit(HCI_CONN_FIPS, &conn->flags);  in hci_encrypt_change_evt()
3543 			if ((conn->type == ACL_LINK && ev->encrypt == 0x02) ||  in hci_encrypt_change_evt()
3544 			    conn->type == LE_LINK)  in hci_encrypt_change_evt()
3545 				set_bit(HCI_CONN_AES_CCM, &conn->flags);  in hci_encrypt_change_evt()
3547 			clear_bit(HCI_CONN_ENCRYPT, &conn->flags);  in hci_encrypt_change_evt()
3548 			clear_bit(HCI_CONN_AES_CCM, &conn->flags);  in hci_encrypt_change_evt()
3555 	if (ev->status && conn->type == LE_LINK) {  in hci_encrypt_change_evt()
3560 	clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);  in hci_encrypt_change_evt()
3564 		ev->status = HCI_ERROR_AUTH_FAILURE;  in hci_encrypt_change_evt()
3566 	if (ev->status && conn->state == BT_CONNECTED) {  in hci_encrypt_change_evt()
3567 		if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)  in hci_encrypt_change_evt()
3568 			set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);  in hci_encrypt_change_evt()
3573 		hci_encrypt_cfm(conn, ev->status);  in hci_encrypt_change_evt()
3580 	if (!ev->status && ev->encrypt && conn->type == ACL_LINK) {  in hci_encrypt_change_evt()
3588 			conn->enc_key_size = HCI_LINK_KEY_SIZE;  in hci_encrypt_change_evt()
3592 		cp.handle = cpu_to_le16(conn->handle);  in hci_encrypt_change_evt()
3596 			conn->enc_key_size = HCI_LINK_KEY_SIZE;  in hci_encrypt_change_evt()
3607 		     &hdev->quirks))  in hci_encrypt_change_evt()
3615 	 * Ensure for AES-CCM encryption as well.  in hci_encrypt_change_evt()
3617 	if (test_bit(HCI_CONN_ENCRYPT, &conn->flags) &&  in hci_encrypt_change_evt()
3618 	    test_bit(HCI_CONN_AES_CCM, &conn->flags) &&  in hci_encrypt_change_evt()
3619 	    ((conn->type == ACL_LINK && lmp_ping_capable(hdev)) ||  in hci_encrypt_change_evt()
3620 	     (conn->type == LE_LINK && (hdev->le_features[0] & HCI_LE_PING)))) {  in hci_encrypt_change_evt()
3623 		cp.handle = cpu_to_le16(conn->handle);  in hci_encrypt_change_evt()
3624 		cp.timeout = cpu_to_le16(hdev->auth_payload_timeout);  in hci_encrypt_change_evt()
3625 		if (hci_send_cmd(conn->hdev, HCI_OP_WRITE_AUTH_PAYLOAD_TO,  in hci_encrypt_change_evt()
3631 	hci_encrypt_cfm(conn, ev->status);  in hci_encrypt_change_evt()
3643 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);  in hci_change_link_key_complete_evt()
3647 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));  in hci_change_link_key_complete_evt()
3649 		if (!ev->status)  in hci_change_link_key_complete_evt()
3650 			set_bit(HCI_CONN_SECURE, &conn->flags);  in hci_change_link_key_complete_evt()
3652 		clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);  in hci_change_link_key_complete_evt()
3654 		hci_key_change_cfm(conn, ev->status);  in hci_change_link_key_complete_evt()
3666 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);  in hci_remote_features_evt()
3670 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));  in hci_remote_features_evt()
3674 	if (!ev->status)  in hci_remote_features_evt()
3675 		memcpy(conn->features[0], ev->features, 8);  in hci_remote_features_evt()
3677 	if (conn->state != BT_CONFIG)  in hci_remote_features_evt()
3680 	if (!ev->status && lmp_ext_feat_capable(hdev) &&  in hci_remote_features_evt()
3683 		cp.handle = ev->handle;  in hci_remote_features_evt()
3690 	if (!ev->status) {  in hci_remote_features_evt()
3693 		bacpy(&cp.bdaddr, &conn->dst);  in hci_remote_features_evt()
3701 		conn->state = BT_CONNECTED;  in hci_remote_features_evt()
3702 		hci_connect_cfm(conn, ev->status);  in hci_remote_features_evt()
3712 	cancel_delayed_work(&hdev->cmd_timer);  in handle_cmd_cnt_and_timer()
3715 	if (!test_bit(HCI_RESET, &hdev->flags)) {  in handle_cmd_cnt_and_timer()
3717 			cancel_delayed_work(&hdev->ncmd_timer);  in handle_cmd_cnt_and_timer()
3718 			atomic_set(&hdev->cmd_cnt, 1);  in handle_cmd_cnt_and_timer()
3721 				queue_delayed_work(hdev->workqueue, &hdev->ncmd_timer,  in handle_cmd_cnt_and_timer()
3731 	struct hci_rp_le_read_buffer_size_v2 *rp = data;  in hci_cc_le_read_buffer_size_v2()  local
3733 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_le_read_buffer_size_v2()
3735 	if (rp->status)  in hci_cc_le_read_buffer_size_v2()
3736 		return rp->status;  in hci_cc_le_read_buffer_size_v2()
3738 	hdev->le_mtu   = __le16_to_cpu(rp->acl_mtu);  in hci_cc_le_read_buffer_size_v2()
3739 	hdev->le_pkts  = rp->acl_max_pkt;  in hci_cc_le_read_buffer_size_v2()
3740 	hdev->iso_mtu  = __le16_to_cpu(rp->iso_mtu);  in hci_cc_le_read_buffer_size_v2()
3741 	hdev->iso_pkts = rp->iso_max_pkt;  in hci_cc_le_read_buffer_size_v2()
3743 	hdev->le_cnt  = hdev->le_pkts;  in hci_cc_le_read_buffer_size_v2()
3744 	hdev->iso_cnt = hdev->iso_pkts;  in hci_cc_le_read_buffer_size_v2()
3746 	BT_DBG("%s acl mtu %d:%d iso mtu %d:%d", hdev->name, hdev->acl_mtu,  in hci_cc_le_read_buffer_size_v2()
3747 	       hdev->acl_pkts, hdev->iso_mtu, hdev->iso_pkts);  in hci_cc_le_read_buffer_size_v2()
3749 	if (hdev->le_mtu && hdev->le_mtu < HCI_MIN_LE_MTU)  in hci_cc_le_read_buffer_size_v2()
3752 	return rp->status;  in hci_cc_le_read_buffer_size_v2()
3759 	lockdep_assert_held(&hdev->lock);  in hci_unbound_cis_failed()
3761 	list_for_each_entry_safe(conn, tmp, &hdev->conn_hash.list, list) {  in hci_unbound_cis_failed()
3762 		if (conn->type != ISO_LINK || !bacmp(&conn->dst, BDADDR_ANY) ||  in hci_unbound_cis_failed()
3763 		    conn->state == BT_OPEN || conn->iso_qos.ucast.cig != cig)  in hci_unbound_cis_failed()
3766 		if (HCI_CONN_HANDLE_UNSET(conn->handle))  in hci_unbound_cis_failed()
3774 	struct hci_rp_le_set_cig_params *rp = data;  in hci_cc_le_set_cig_params()  local
3777 	u8 status = rp->status;  in hci_cc_le_set_cig_params()
3781 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_le_set_cig_params()
3784 	if (!rp->status && (!cp || rp->num_handles != cp->num_cis ||  in hci_cc_le_set_cig_params()
3785 			    rp->cig_id != cp->cig_id)) {  in hci_cc_le_set_cig_params()
3794 	 * If the Status return parameter is non-zero, then the state of the CIG  in hci_cc_le_set_cig_params()
3800 		hci_unbound_cis_failed(hdev, rp->cig_id, status);  in hci_cc_le_set_cig_params()
3811 	for (i = 0; i < rp->num_handles; ++i) {  in hci_cc_le_set_cig_params()
3812 		conn = hci_conn_hash_lookup_cis(hdev, NULL, 0, rp->cig_id,  in hci_cc_le_set_cig_params()
3813 						cp->cis[i].cis_id);  in hci_cc_le_set_cig_params()
3814 		if (!conn || !bacmp(&conn->dst, BDADDR_ANY))  in hci_cc_le_set_cig_params()
3817 		if (conn->state != BT_BOUND && conn->state != BT_CONNECT)  in hci_cc_le_set_cig_params()
3820 		if (hci_conn_set_handle(conn, __le16_to_cpu(rp->handle[i])))  in hci_cc_le_set_cig_params()
3823 		if (conn->state == BT_CONNECT)  in hci_cc_le_set_cig_params()
3833 	return rp->status;  in hci_cc_le_set_cig_params()
3839 	struct hci_rp_le_setup_iso_path *rp = data;  in hci_cc_le_setup_iso_path()  local
3843 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_le_setup_iso_path()
3847 		return rp->status;  in hci_cc_le_setup_iso_path()
3851 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));  in hci_cc_le_setup_iso_path()
3855 	if (rp->status) {  in hci_cc_le_setup_iso_path()
3856 		hci_connect_cfm(conn, rp->status);  in hci_cc_le_setup_iso_path()
3861 	switch (cp->direction) {  in hci_cc_le_setup_iso_path()
3865 		if (conn->iso_qos.ucast.out.sdu && !conn->iso_qos.ucast.in.sdu)  in hci_cc_le_setup_iso_path()
3866 			hci_connect_cfm(conn, rp->status);  in hci_cc_le_setup_iso_path()
3870 		/* Confirm connection since conn->iso_qos is always configured  in hci_cc_le_setup_iso_path()
3873 		hci_connect_cfm(conn, rp->status);  in hci_cc_le_setup_iso_path()
3876 		if (!rp->status && test_bit(HCI_CONN_BIG_SYNC, &conn->flags))  in hci_cc_le_setup_iso_path()
3884 	return rp->status;  in hci_cc_le_setup_iso_path()
3889 	bt_dev_dbg(hdev, "status 0x%2.2x", status);  in hci_cs_le_create_big()
3895 	struct hci_ev_status *rp = data;  in hci_cc_set_per_adv_param()  local
3898 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_set_per_adv_param()
3900 	if (rp->status)  in hci_cc_set_per_adv_param()
3901 		return rp->status;  in hci_cc_set_per_adv_param()
3905 		return rp->status;  in hci_cc_set_per_adv_param()
3908 	return rp->status;  in hci_cc_set_per_adv_param()
3914 	struct hci_ev_status *rp = data;  in hci_cc_le_set_per_adv_enable()  local
3919 	bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);  in hci_cc_le_set_per_adv_enable()
3921 	if (rp->status)  in hci_cc_le_set_per_adv_enable()
3922 		return rp->status;  in hci_cc_le_set_per_adv_enable()
3926 		return rp->status;  in hci_cc_le_set_per_adv_enable()
3930 	adv = hci_find_adv_instance(hdev, cp->handle);  in hci_cc_le_set_per_adv_enable()
3932 	if (cp->enable) {  in hci_cc_le_set_per_adv_enable()
3936 			adv->enabled = true;  in hci_cc_le_set_per_adv_enable()
3943 		list_for_each_entry_safe(adv, n, &hdev->adv_instances,  in hci_cc_le_set_per_adv_enable()
3945 			if (adv->periodic && adv->enabled)  in hci_cc_le_set_per_adv_enable()
3958 	return rp->status;  in hci_cc_le_set_per_adv_enable()
4147 	if (skb->len < cc->min_len) {  in hci_cc_func()
4148 		bt_dev_err(hdev, "unexpected cc 0x%4.4x length: %u < %u",  in hci_cc_func()
4149 			   cc->op, skb->len, cc->min_len);  in hci_cc_func()
4157 	if (skb->len > cc->max_len)  in hci_cc_func()
4158 		bt_dev_warn(hdev, "unexpected cc 0x%4.4x length: %u > %u",  in hci_cc_func()
4159 			    cc->op, skb->len, cc->max_len);  in hci_cc_func()
4161 	data = hci_cc_skb_pull(hdev, skb, cc->op, cc->min_len);  in hci_cc_func()
4165 	return cc->func(hdev, data, skb);  in hci_cc_func()
4176 	*opcode = __le16_to_cpu(ev->opcode);  in hci_cmd_complete_evt()
4178 	bt_dev_dbg(hdev, "opcode 0x%4.4x", *opcode);  in hci_cmd_complete_evt()
4195 		*status = skb->data[0];  in hci_cmd_complete_evt()
4198 	handle_cmd_cnt_and_timer(hdev, ev->ncmd);  in hci_cmd_complete_evt()
4205 			   "unexpected event for opcode 0x%4.4x", *opcode);  in hci_cmd_complete_evt()
4209 	if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))  in hci_cmd_complete_evt()
4210 		queue_work(hdev->workqueue, &hdev->cmd_work);  in hci_cmd_complete_evt()
4219 	bt_dev_dbg(hdev, "status 0x%2.2x", status);  in hci_cs_le_create_cis()
4231 	for (i = 0; cp->num_cis; cp->num_cis--, i++) {  in hci_cs_le_create_cis()
4235 		handle = __le16_to_cpu(cp->cis[i].cis_handle);  in hci_cs_le_create_cis()
4240 					       &conn->flags))  in hci_cs_le_create_cis()
4242 			conn->state = BT_CLOSED;  in hci_cs_le_create_cis()
4296 	*opcode = __le16_to_cpu(ev->opcode);  in hci_cmd_status_evt()
4297 	*status = ev->status;  in hci_cmd_status_evt()
4299 	bt_dev_dbg(hdev, "opcode 0x%4.4x", *opcode);  in hci_cmd_status_evt()
4303 			hci_cs_table[i].func(hdev, ev->status);  in hci_cmd_status_evt()
4308 	handle_cmd_cnt_and_timer(hdev, ev->ncmd);  in hci_cmd_status_evt()
4316 	if (ev->status || (hdev->req_skb && !hci_skb_event(hdev->req_skb))) {  in hci_cmd_status_evt()
4317 		hci_req_cmd_complete(hdev, *opcode, ev->status, req_complete,  in hci_cmd_status_evt()
4320 			bt_dev_err(hdev, "unexpected event for opcode 0x%4.4x",  in hci_cmd_status_evt()
4326 	if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))  in hci_cmd_status_evt()
4327 		queue_work(hdev->workqueue, &hdev->cmd_work);  in hci_cmd_status_evt()
4335 	bt_dev_dbg(hdev, "code 0x%2.2x", ev->code);  in hci_hardware_error_evt()
4337 	hdev->hw_error_code = ev->code;  in hci_hardware_error_evt()
4339 	queue_work(hdev->req_workqueue, &hdev->error_reset);  in hci_hardware_error_evt()
4348 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);  in hci_role_change_evt()
4352 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);  in hci_role_change_evt()
4354 		if (!ev->status)  in hci_role_change_evt()
4355 			conn->role = ev->role;  in hci_role_change_evt()
4357 		clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);  in hci_role_change_evt()
4359 		hci_role_switch_cfm(conn, ev->status, ev->role);  in hci_role_change_evt()
4372 			     flex_array_size(ev, handles, ev->num)))  in hci_num_comp_pkts_evt()
4375 	bt_dev_dbg(hdev, "num %d", ev->num);  in hci_num_comp_pkts_evt()
4377 	for (i = 0; i < ev->num; i++) {  in hci_num_comp_pkts_evt()
4378 		struct hci_comp_pkts_info *info = &ev->handles[i];  in hci_num_comp_pkts_evt()
4382 		handle = __le16_to_cpu(info->handle);  in hci_num_comp_pkts_evt()
4383 		count  = __le16_to_cpu(info->count);  in hci_num_comp_pkts_evt()
4389 		conn->sent -= count;  in hci_num_comp_pkts_evt()
4391 		switch (conn->type) {  in hci_num_comp_pkts_evt()
4393 			hdev->acl_cnt += count;  in hci_num_comp_pkts_evt()
4394 			if (hdev->acl_cnt > hdev->acl_pkts)  in hci_num_comp_pkts_evt()
4395 				hdev->acl_cnt = hdev->acl_pkts;  in hci_num_comp_pkts_evt()
4399 			if (hdev->le_pkts) {  in hci_num_comp_pkts_evt()
4400 				hdev->le_cnt += count;  in hci_num_comp_pkts_evt()
4401 				if (hdev->le_cnt > hdev->le_pkts)  in hci_num_comp_pkts_evt()
4402 					hdev->le_cnt = hdev->le_pkts;  in hci_num_comp_pkts_evt()
4404 				hdev->acl_cnt += count;  in hci_num_comp_pkts_evt()
4405 				if (hdev->acl_cnt > hdev->acl_pkts)  in hci_num_comp_pkts_evt()
4406 					hdev->acl_cnt = hdev->acl_pkts;  in hci_num_comp_pkts_evt()
4411 			hdev->sco_cnt += count;  in hci_num_comp_pkts_evt()
4412 			if (hdev->sco_cnt > hdev->sco_pkts)  in hci_num_comp_pkts_evt()
4413 				hdev->sco_cnt = hdev->sco_pkts;  in hci_num_comp_pkts_evt()
4417 			if (hdev->iso_pkts) {  in hci_num_comp_pkts_evt()
4418 				hdev->iso_cnt += count;  in hci_num_comp_pkts_evt()
4419 				if (hdev->iso_cnt > hdev->iso_pkts)  in hci_num_comp_pkts_evt()
4420 					hdev->iso_cnt = hdev->iso_pkts;  in hci_num_comp_pkts_evt()
4421 			} else if (hdev->le_pkts) {  in hci_num_comp_pkts_evt()
4422 				hdev->le_cnt += count;  in hci_num_comp_pkts_evt()
4423 				if (hdev->le_cnt > hdev->le_pkts)  in hci_num_comp_pkts_evt()
4424 					hdev->le_cnt = hdev->le_pkts;  in hci_num_comp_pkts_evt()
4426 				hdev->acl_cnt += count;  in hci_num_comp_pkts_evt()
4427 				if (hdev->acl_cnt > hdev->acl_pkts)  in hci_num_comp_pkts_evt()
4428 					hdev->acl_cnt = hdev->acl_pkts;  in hci_num_comp_pkts_evt()
4434 				   conn->type, conn);  in hci_num_comp_pkts_evt()
4439 	queue_work(hdev->workqueue, &hdev->tx_work);  in hci_num_comp_pkts_evt()
4448 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);  in hci_mode_change_evt()
4452 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));  in hci_mode_change_evt()
4454 		conn->mode = ev->mode;  in hci_mode_change_evt()
4457 					&conn->flags)) {  in hci_mode_change_evt()
4458 			if (conn->mode == HCI_CM_ACTIVE)  in hci_mode_change_evt()
4459 				set_bit(HCI_CONN_POWER_SAVE, &conn->flags);  in hci_mode_change_evt()
4461 				clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);  in hci_mode_change_evt()
4464 		if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))  in hci_mode_change_evt()
4465 			hci_sco_setup(conn, ev->status);  in hci_mode_change_evt()
4481 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);  in hci_pin_code_request_evt()
4485 	if (conn->state == BT_CONNECTED) {  in hci_pin_code_request_evt()
4487 		conn->disc_timeout = HCI_PAIRING_TIMEOUT;  in hci_pin_code_request_evt()
4492 	    !test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags)) {  in hci_pin_code_request_evt()
4494 			     sizeof(ev->bdaddr), &ev->bdaddr);  in hci_pin_code_request_evt()
4498 		if (conn->pending_sec_level == BT_SECURITY_HIGH)  in hci_pin_code_request_evt()
4503 		mgmt_pin_code_request(hdev, &ev->bdaddr, secure);  in hci_pin_code_request_evt()
4515 	conn->pin_length = pin_len;  in conn_set_key()
4516 	conn->key_type = key_type;  in conn_set_key()
4525 			conn->pending_sec_level = BT_SECURITY_HIGH;  in conn_set_key()
4527 			conn->pending_sec_level = BT_SECURITY_MEDIUM;  in conn_set_key()
4531 		conn->pending_sec_level = BT_SECURITY_MEDIUM;  in conn_set_key()
4534 		conn->pending_sec_level = BT_SECURITY_HIGH;  in conn_set_key()
4537 		conn->pending_sec_level = BT_SECURITY_FIPS;  in conn_set_key()
4557 	key = hci_find_link_key(hdev, &ev->bdaddr);  in hci_link_key_request_evt()
4559 		bt_dev_dbg(hdev, "link key not found for %pMR", &ev->bdaddr);  in hci_link_key_request_evt()
4563 	bt_dev_dbg(hdev, "found key type %u for %pMR", key->type, &ev->bdaddr);  in hci_link_key_request_evt()
4565 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);  in hci_link_key_request_evt()
4567 		clear_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);  in hci_link_key_request_evt()
4569 		if ((key->type == HCI_LK_UNAUTH_COMBINATION_P192 ||  in hci_link_key_request_evt()
4570 		     key->type == HCI_LK_UNAUTH_COMBINATION_P256) &&  in hci_link_key_request_evt()
4571 		    conn->auth_type != 0xff && (conn->auth_type & 0x01)) {  in hci_link_key_request_evt()
4576 		if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&  in hci_link_key_request_evt()
4577 		    (conn->pending_sec_level == BT_SECURITY_HIGH ||  in hci_link_key_request_evt()
4578 		     conn->pending_sec_level == BT_SECURITY_FIPS)) {  in hci_link_key_request_evt()
4583 		conn_set_key(conn, key->type, key->pin_len);  in hci_link_key_request_evt()
4586 	bacpy(&cp.bdaddr, &ev->bdaddr);  in hci_link_key_request_evt()
4587 	memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);  in hci_link_key_request_evt()
4596 	hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);  in hci_link_key_request_evt()
4613 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);  in hci_link_key_notify_evt()
4617 	/* Ignore NULL link key against CVE-2020-26555 */  in hci_link_key_notify_evt()
4618 	if (!crypto_memneq(ev->link_key, ZERO_KEY, HCI_LINK_KEY_SIZE)) {  in hci_link_key_notify_evt()
4620 			   &ev->bdaddr);  in hci_link_key_notify_evt()
4627 	conn->disc_timeout = HCI_DISCONN_TIMEOUT;  in hci_link_key_notify_evt()
4630 	set_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);  in hci_link_key_notify_evt()
4631 	conn_set_key(conn, ev->key_type, conn->pin_length);  in hci_link_key_notify_evt()
4636 	key = hci_add_link_key(hdev, conn, &ev->bdaddr, ev->link_key,  in hci_link_key_notify_evt()
4637 			        ev->key_type, pin_len, &persistent);  in hci_link_key_notify_evt()
4644 	if (ev->key_type == HCI_LK_CHANGED_COMBINATION)  in hci_link_key_notify_evt()
4645 		conn_set_key(conn, key->type, key->pin_len);  in hci_link_key_notify_evt()
4654 	if (key->type == HCI_LK_DEBUG_COMBINATION &&  in hci_link_key_notify_evt()
4656 		list_del_rcu(&key->list);  in hci_link_key_notify_evt()
4662 		clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags);  in hci_link_key_notify_evt()
4664 		set_bit(HCI_CONN_FLUSH_KEY, &conn->flags);  in hci_link_key_notify_evt()
4676 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);  in hci_clock_offset_evt()
4680 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));  in hci_clock_offset_evt()
4681 	if (conn && !ev->status) {  in hci_clock_offset_evt()
4684 		ie = hci_inquiry_cache_lookup(hdev, &conn->dst);  in hci_clock_offset_evt()
4686 			ie->data.clock_offset = ev->clock_offset;  in hci_clock_offset_evt()
4687 			ie->timestamp = jiffies;  in hci_clock_offset_evt()
4700 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);  in hci_pkt_type_change_evt()
4704 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));  in hci_pkt_type_change_evt()
4705 	if (conn && !ev->status)  in hci_pkt_type_change_evt()
4706 		conn->pkt_type = __le16_to_cpu(ev->pkt_type);  in hci_pkt_type_change_evt()
4721 	ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);  in hci_pscan_rep_mode_evt()
4723 		ie->data.pscan_rep_mode = ev->pscan_rep_mode;  in hci_pscan_rep_mode_evt()
4724 		ie->timestamp = jiffies;  in hci_pscan_rep_mode_evt()
4737 	bt_dev_dbg(hdev, "num_rsp %d", ev->num);  in hci_inquiry_result_with_rssi_evt()
4739 	if (!ev->num)  in hci_inquiry_result_with_rssi_evt()
4747 	if (skb->len == array_size(ev->num,  in hci_inquiry_result_with_rssi_evt()
4751 		for (i = 0; i < ev->num; i++) {  in hci_inquiry_result_with_rssi_evt()
4758 				bt_dev_err(hdev, "Malformed HCI Event: 0x%2.2x",  in hci_inquiry_result_with_rssi_evt()
4763 			bacpy(&data.bdaddr, &info->bdaddr);  in hci_inquiry_result_with_rssi_evt()
4764 			data.pscan_rep_mode	= info->pscan_rep_mode;  in hci_inquiry_result_with_rssi_evt()
4765 			data.pscan_period_mode	= info->pscan_period_mode;  in hci_inquiry_result_with_rssi_evt()
4766 			data.pscan_mode		= info->pscan_mode;  in hci_inquiry_result_with_rssi_evt()
4767 			memcpy(data.dev_class, info->dev_class, 3);  in hci_inquiry_result_with_rssi_evt()
4768 			data.clock_offset	= info->clock_offset;  in hci_inquiry_result_with_rssi_evt()
4769 			data.rssi		= info->rssi;  in hci_inquiry_result_with_rssi_evt()
4774 			mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,  in hci_inquiry_result_with_rssi_evt()
4775 					  info->dev_class, info->rssi,  in hci_inquiry_result_with_rssi_evt()
4778 	} else if (skb->len == array_size(ev->num,  in hci_inquiry_result_with_rssi_evt()
4782 		for (i = 0; i < ev->num; i++) {  in hci_inquiry_result_with_rssi_evt()
4789 				bt_dev_err(hdev, "Malformed HCI Event: 0x%2.2x",  in hci_inquiry_result_with_rssi_evt()
4794 			bacpy(&data.bdaddr, &info->bdaddr);  in hci_inquiry_result_with_rssi_evt()
4795 			data.pscan_rep_mode	= info->pscan_rep_mode;  in hci_inquiry_result_with_rssi_evt()
4796 			data.pscan_period_mode	= info->pscan_period_mode;  in hci_inquiry_result_with_rssi_evt()
4798 			memcpy(data.dev_class, info->dev_class, 3);  in hci_inquiry_result_with_rssi_evt()
4799 			data.clock_offset	= info->clock_offset;  in hci_inquiry_result_with_rssi_evt()
4800 			data.rssi		= info->rssi;  in hci_inquiry_result_with_rssi_evt()
4805 			mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,  in hci_inquiry_result_with_rssi_evt()
4806 					  info->dev_class, info->rssi,  in hci_inquiry_result_with_rssi_evt()
4810 		bt_dev_err(hdev, "Malformed HCI Event: 0x%2.2x",  in hci_inquiry_result_with_rssi_evt()
4823 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);  in hci_remote_ext_features_evt()
4827 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));  in hci_remote_ext_features_evt()
4831 	if (ev->page < HCI_MAX_PAGES)  in hci_remote_ext_features_evt()
4832 		memcpy(conn->features[ev->page], ev->features, 8);  in hci_remote_ext_features_evt()
4834 	if (!ev->status && ev->page == 0x01) {  in hci_remote_ext_features_evt()
4837 		ie = hci_inquiry_cache_lookup(hdev, &conn->dst);  in hci_remote_ext_features_evt()
4839 			ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);  in hci_remote_ext_features_evt()
4841 		if (ev->features[0] & LMP_HOST_SSP) {  in hci_remote_ext_features_evt()
4842 			set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);  in hci_remote_ext_features_evt()
4852 			clear_bit(HCI_CONN_SSP_ENABLED, &conn->flags);  in hci_remote_ext_features_evt()
4855 		if (ev->features[0] & LMP_HOST_SC)  in hci_remote_ext_features_evt()
4856 			set_bit(HCI_CONN_SC_ENABLED, &conn->flags);  in hci_remote_ext_features_evt()
4859 	if (conn->state != BT_CONFIG)  in hci_remote_ext_features_evt()
4862 	if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {  in hci_remote_ext_features_evt()
4865 		bacpy(&cp.bdaddr, &conn->dst);  in hci_remote_ext_features_evt()
4873 		conn->state = BT_CONNECTED;  in hci_remote_ext_features_evt()
4874 		hci_connect_cfm(conn, ev->status);  in hci_remote_ext_features_evt()
4887 	u8 status = ev->status;  in hci_sync_conn_complete_evt()
4889 	switch (ev->link_type) {  in hci_sync_conn_complete_evt()
4902 	bt_dev_dbg(hdev, "status 0x%2.2x", status);  in hci_sync_conn_complete_evt()
4906 	conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);  in hci_sync_conn_complete_evt()
4908 		if (ev->link_type == ESCO_LINK)  in hci_sync_conn_complete_evt()
4920 		conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);  in hci_sync_conn_complete_evt()
4931 	if (!HCI_CONN_HANDLE_UNSET(conn->handle)) {  in hci_sync_conn_complete_evt()
4938 		status = hci_conn_set_handle(conn, __le16_to_cpu(ev->handle));  in hci_sync_conn_complete_evt()
4940 			conn->state = BT_CLOSED;  in hci_sync_conn_complete_evt()
4944 		conn->state  = BT_CONNECTED;  in hci_sync_conn_complete_evt()
4945 		conn->type   = ev->link_type;  in hci_sync_conn_complete_evt()
4959 		if (conn->out) {  in hci_sync_conn_complete_evt()
4960 			conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |  in hci_sync_conn_complete_evt()
4961 					(hdev->esco_type & EDR_ESCO_MASK);  in hci_sync_conn_complete_evt()
4962 			if (hci_setup_sync(conn, conn->parent->handle))  in hci_sync_conn_complete_evt()
4968 		conn->state = BT_CLOSED;  in hci_sync_conn_complete_evt()
4972 	bt_dev_dbg(hdev, "SCO connected with air mode: %02x", ev->air_mode);  in hci_sync_conn_complete_evt()
4974 	 * is zero and non-zero value shall be non-HCI transport data path  in hci_sync_conn_complete_evt()
4976 	if (conn->codec.data_path == 0 && hdev->notify) {  in hci_sync_conn_complete_evt()
4977 		switch (ev->air_mode) {  in hci_sync_conn_complete_evt()
4979 			hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_CVSD);  in hci_sync_conn_complete_evt()
4982 			hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_TRANSP);  in hci_sync_conn_complete_evt()
5021 			     flex_array_size(ev, info, ev->num)))  in hci_extended_inquiry_result_evt()
5024 	bt_dev_dbg(hdev, "num %d", ev->num);  in hci_extended_inquiry_result_evt()
5026 	if (!ev->num)  in hci_extended_inquiry_result_evt()
5034 	for (i = 0; i < ev->num; i++) {  in hci_extended_inquiry_result_evt()
5035 		struct extended_inquiry_info *info = &ev->info[i];  in hci_extended_inquiry_result_evt()
5039 		bacpy(&data.bdaddr, &info->bdaddr);  in hci_extended_inquiry_result_evt()
5040 		data.pscan_rep_mode	= info->pscan_rep_mode;  in hci_extended_inquiry_result_evt()
5041 		data.pscan_period_mode	= info->pscan_period_mode;  in hci_extended_inquiry_result_evt()
5043 		memcpy(data.dev_class, info->dev_class, 3);  in hci_extended_inquiry_result_evt()
5044 		data.clock_offset	= info->clock_offset;  in hci_extended_inquiry_result_evt()
5045 		data.rssi		= info->rssi;  in hci_extended_inquiry_result_evt()
5049 			name_known = eir_get_data(info->data,  in hci_extended_inquiry_result_evt()
5050 						  sizeof(info->data),  in hci_extended_inquiry_result_evt()
5057 		eir_len = eir_get_length(info->data, sizeof(info->data));  in hci_extended_inquiry_result_evt()
5059 		mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,  in hci_extended_inquiry_result_evt()
5060 				  info->dev_class, info->rssi,  in hci_extended_inquiry_result_evt()
5061 				  flags, info->data, eir_len, NULL, 0, 0);  in hci_extended_inquiry_result_evt()
5073 	bt_dev_dbg(hdev, "status 0x%2.2x handle 0x%4.4x", ev->status,  in hci_key_refresh_complete_evt()
5074 		   __le16_to_cpu(ev->handle));  in hci_key_refresh_complete_evt()
5078 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));  in hci_key_refresh_complete_evt()
5085 	if (conn->type != LE_LINK)  in hci_key_refresh_complete_evt()
5088 	if (!ev->status)  in hci_key_refresh_complete_evt()
5089 		conn->sec_level = conn->pending_sec_level;  in hci_key_refresh_complete_evt()
5091 	clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);  in hci_key_refresh_complete_evt()
5093 	if (ev->status && conn->state == BT_CONNECTED) {  in hci_key_refresh_complete_evt()
5099 	if (conn->state == BT_CONFIG) {  in hci_key_refresh_complete_evt()
5100 		if (!ev->status)  in hci_key_refresh_complete_evt()
5101 			conn->state = BT_CONNECTED;  in hci_key_refresh_complete_evt()
5103 		hci_connect_cfm(conn, ev->status);  in hci_key_refresh_complete_evt()
5106 		hci_auth_cfm(conn, ev->status);  in hci_key_refresh_complete_evt()
5109 		conn->disc_timeout = HCI_DISCONN_TIMEOUT;  in hci_key_refresh_complete_evt()
5119 	/* If remote requests no-bonding follow that lead */  in hci_get_auth_req()
5120 	if (conn->remote_auth == HCI_AT_NO_BONDING ||  in hci_get_auth_req()
5121 	    conn->remote_auth == HCI_AT_NO_BONDING_MITM)  in hci_get_auth_req()
5122 		return conn->remote_auth | (conn->auth_type & 0x01);  in hci_get_auth_req()
5127 	if (conn->remote_cap != HCI_IO_NO_INPUT_OUTPUT &&  in hci_get_auth_req()
5128 	    conn->io_capability != HCI_IO_NO_INPUT_OUTPUT)  in hci_get_auth_req()
5129 		return conn->remote_auth | 0x01;  in hci_get_auth_req()
5132 	return (conn->remote_auth & ~0x01) | (conn->auth_type & 0x01);  in hci_get_auth_req()
5137 	struct hci_dev *hdev = conn->hdev;  in bredr_oob_data_present()
5140 	data = hci_find_remote_oob_data(hdev, &conn->dst, BDADDR_BREDR);  in bredr_oob_data_present()
5152 			return data->present;  in bredr_oob_data_present()
5155 		 * the P-256 values are required. If they are not  in bredr_oob_data_present()
5159 		if (!crypto_memneq(data->rand256, ZERO_KEY, 16) ||  in bredr_oob_data_present()
5160 		    !crypto_memneq(data->hash256, ZERO_KEY, 16))  in bredr_oob_data_present()
5168 	 * P-192 data values are present.  in bredr_oob_data_present()
5170 	if (!crypto_memneq(data->rand192, ZERO_KEY, 16) ||  in bredr_oob_data_present()
5171 	    !crypto_memneq(data->hash192, ZERO_KEY, 16))  in bredr_oob_data_present()
5187 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);  in hci_io_capa_request_evt()
5192 	set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);  in hci_io_capa_request_evt()
5203 	    test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags) ||  in hci_io_capa_request_evt()
5204 	    (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {  in hci_io_capa_request_evt()
5207 		bacpy(&cp.bdaddr, &ev->bdaddr);  in hci_io_capa_request_evt()
5210 		cp.capability = (conn->io_capability == 0x04) ?  in hci_io_capa_request_evt()
5211 				HCI_IO_DISPLAY_YESNO : conn->io_capability;  in hci_io_capa_request_evt()
5214 		if (conn->remote_auth == 0xff) {  in hci_io_capa_request_evt()
5216 			 * except for the no-bonding case.  in hci_io_capa_request_evt()
5218 			if (conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&  in hci_io_capa_request_evt()
5219 			    conn->auth_type != HCI_AT_NO_BONDING)  in hci_io_capa_request_evt()
5220 				conn->auth_type |= 0x01;  in hci_io_capa_request_evt()
5222 			conn->auth_type = hci_get_auth_req(conn);  in hci_io_capa_request_evt()
5225 		/* If we're not bondable, force one of the non-bondable  in hci_io_capa_request_evt()
5229 			conn->auth_type &= HCI_AT_NO_BONDING_MITM;  in hci_io_capa_request_evt()
5231 		cp.authentication = conn->auth_type;  in hci_io_capa_request_evt()
5239 		bacpy(&cp.bdaddr, &ev->bdaddr);  in hci_io_capa_request_evt()
5260 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);  in hci_io_capa_reply_evt()
5264 	conn->remote_cap = ev->capability;  in hci_io_capa_reply_evt()
5265 	conn->remote_auth = ev->authentication;  in hci_io_capa_reply_evt()
5285 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);  in hci_user_confirm_request_evt()
5289 	loc_mitm = (conn->auth_type & 0x01);  in hci_user_confirm_request_evt()
5290 	rem_mitm = (conn->remote_auth & 0x01);  in hci_user_confirm_request_evt()
5295 	 * necessarily match conn->auth_type.  in hci_user_confirm_request_evt()
5297 	if (conn->pending_sec_level > BT_SECURITY_MEDIUM &&  in hci_user_confirm_request_evt()
5298 	    conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {  in hci_user_confirm_request_evt()
5301 			     sizeof(ev->bdaddr), &ev->bdaddr);  in hci_user_confirm_request_evt()
5306 	if ((!loc_mitm || conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) &&  in hci_user_confirm_request_evt()
5307 	    (!rem_mitm || conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)) {  in hci_user_confirm_request_evt()
5313 		if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&  in hci_user_confirm_request_evt()
5314 		    conn->io_capability != HCI_IO_NO_INPUT_OUTPUT) {  in hci_user_confirm_request_evt()
5315 			bt_dev_dbg(hdev, "Confirming auto-accept as acceptor");  in hci_user_confirm_request_evt()
5324 		if (hci_find_link_key(hdev, &ev->bdaddr)) {  in hci_user_confirm_request_evt()
5330 		BT_DBG("Auto-accept of user confirmation with %ums delay",  in hci_user_confirm_request_evt()
5331 		       hdev->auto_accept_delay);  in hci_user_confirm_request_evt()
5333 		if (hdev->auto_accept_delay > 0) {  in hci_user_confirm_request_evt()
5334 			int delay = msecs_to_jiffies(hdev->auto_accept_delay);  in hci_user_confirm_request_evt()
5335 			queue_delayed_work(conn->hdev->workqueue,  in hci_user_confirm_request_evt()
5336 					   &conn->auto_accept_work, delay);  in hci_user_confirm_request_evt()
5341 			     sizeof(ev->bdaddr), &ev->bdaddr);  in hci_user_confirm_request_evt()
5346 	mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0,  in hci_user_confirm_request_evt()
5347 				  le32_to_cpu(ev->passkey), confirm_hint);  in hci_user_confirm_request_evt()
5361 		mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);  in hci_user_passkey_request_evt()
5372 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);  in hci_user_passkey_notify_evt()
5376 	conn->passkey_notify = __le32_to_cpu(ev->passkey);  in hci_user_passkey_notify_evt()
5377 	conn->passkey_entered = 0;  in hci_user_passkey_notify_evt()
5380 		mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,  in hci_user_passkey_notify_evt()
5381 					 conn->dst_type, conn->passkey_notify,  in hci_user_passkey_notify_evt()
5382 					 conn->passkey_entered);  in hci_user_passkey_notify_evt()
5393 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);  in hci_keypress_notify_evt()
5397 	switch (ev->type) {  in hci_keypress_notify_evt()
5399 		conn->passkey_entered = 0;  in hci_keypress_notify_evt()
5403 		conn->passkey_entered++;  in hci_keypress_notify_evt()
5407 		conn->passkey_entered--;  in hci_keypress_notify_evt()
5411 		conn->passkey_entered = 0;  in hci_keypress_notify_evt()
5419 		mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,  in hci_keypress_notify_evt()
5420 					 conn->dst_type, conn->passkey_notify,  in hci_keypress_notify_evt()
5421 					 conn->passkey_entered);  in hci_keypress_notify_evt()
5434 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);  in hci_simple_pair_complete_evt()
5439 	conn->remote_auth = 0xff;  in hci_simple_pair_complete_evt()
5446 	if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status)  in hci_simple_pair_complete_evt()
5447 		mgmt_auth_failed(conn, ev->status);  in hci_simple_pair_complete_evt()
5466 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);  in hci_remote_host_features_evt()
5468 		memcpy(conn->features[1], ev->features, 8);  in hci_remote_host_features_evt()
5470 	ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);  in hci_remote_host_features_evt()
5472 		ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);  in hci_remote_host_features_evt()
5490 	data = hci_find_remote_oob_data(hdev, &ev->bdaddr, BDADDR_BREDR);  in hci_remote_oob_data_request_evt()
5494 		bacpy(&cp.bdaddr, &ev->bdaddr);  in hci_remote_oob_data_request_evt()
5503 		bacpy(&cp.bdaddr, &ev->bdaddr);  in hci_remote_oob_data_request_evt()
5508 			memcpy(cp.hash192, data->hash192, sizeof(cp.hash192));  in hci_remote_oob_data_request_evt()
5509 			memcpy(cp.rand192, data->rand192, sizeof(cp.rand192));  in hci_remote_oob_data_request_evt()
5511 		memcpy(cp.hash256, data->hash256, sizeof(cp.hash256));  in hci_remote_oob_data_request_evt()
5512 		memcpy(cp.rand256, data->rand256, sizeof(cp.rand256));  in hci_remote_oob_data_request_evt()
5519 		bacpy(&cp.bdaddr, &ev->bdaddr);  in hci_remote_oob_data_request_evt()
5520 		memcpy(cp.hash, data->hash192, sizeof(cp.hash));  in hci_remote_oob_data_request_evt()
5521 		memcpy(cp.rand, data->rand192, sizeof(cp.rand));  in hci_remote_oob_data_request_evt()
5534 	if (conn->out) {  in le_conn_update_addr()
5535 		conn->dst_type = bdaddr_type;  in le_conn_update_addr()
5536 		conn->resp_addr_type = bdaddr_type;  in le_conn_update_addr()
5537 		bacpy(&conn->resp_addr, bdaddr);  in le_conn_update_addr()
5540 		 * used instead or hdev->rpa.  in le_conn_update_addr()
5543 			conn->init_addr_type = ADDR_LE_DEV_RANDOM;  in le_conn_update_addr()
5544 			bacpy(&conn->init_addr, local_rpa);  in le_conn_update_addr()
5545 		} else if (hci_dev_test_flag(conn->hdev, HCI_PRIVACY)) {  in le_conn_update_addr()
5546 			conn->init_addr_type = ADDR_LE_DEV_RANDOM;  in le_conn_update_addr()
5547 			bacpy(&conn->init_addr, &conn->hdev->rpa);  in le_conn_update_addr()
5549 			hci_copy_identity_address(conn->hdev, &conn->init_addr,  in le_conn_update_addr()
5550 						  &conn->init_addr_type);  in le_conn_update_addr()
5553 		conn->resp_addr_type = conn->hdev->adv_addr_type;  in le_conn_update_addr()
5555 		 * used instead or hdev->rpa.  in le_conn_update_addr()
5558 			conn->resp_addr_type = ADDR_LE_DEV_RANDOM;  in le_conn_update_addr()
5559 			bacpy(&conn->resp_addr, local_rpa);  in le_conn_update_addr()
5560 		} else if (conn->hdev->adv_addr_type == ADDR_LE_DEV_RANDOM) {  in le_conn_update_addr()
5564 			if (!ext_adv_capable(conn->hdev))  in le_conn_update_addr()
5565 				bacpy(&conn->resp_addr,  in le_conn_update_addr()
5566 				      &conn->hdev->random_addr);  in le_conn_update_addr()
5568 			bacpy(&conn->resp_addr, &conn->hdev->bdaddr);  in le_conn_update_addr()
5571 		conn->init_addr_type = bdaddr_type;  in le_conn_update_addr()
5572 		bacpy(&conn->init_addr, bdaddr);  in le_conn_update_addr()
5579 		conn->le_conn_min_interval = conn->hdev->le_conn_min_interval;  in le_conn_update_addr()
5580 		conn->le_conn_max_interval = conn->hdev->le_conn_max_interval;  in le_conn_update_addr()
5616 		conn->dst_type = bdaddr_type;  in le_conn_complete_evt()
5626 		if (conn->out) {  in le_conn_complete_evt()
5627 			conn->resp_addr_type = bdaddr_type;  in le_conn_complete_evt()
5628 			bacpy(&conn->resp_addr, bdaddr);  in le_conn_complete_evt()
5630 				conn->init_addr_type = ADDR_LE_DEV_RANDOM;  in le_conn_complete_evt()
5631 				bacpy(&conn->init_addr, &hdev->rpa);  in le_conn_complete_evt()
5634 							  &conn->init_addr,  in le_conn_complete_evt()
5635 							  &conn->init_addr_type);  in le_conn_complete_evt()
5639 		cancel_delayed_work(&conn->le_conn_timeout);  in le_conn_complete_evt()
5648 	if (!HCI_CONN_HANDLE_UNSET(conn->handle)) {  in le_conn_complete_evt()
5664 	irk = hci_get_irk(hdev, &conn->dst, conn->dst_type);  in le_conn_complete_evt()
5666 		bacpy(&conn->dst, &irk->bdaddr);  in le_conn_complete_evt()
5667 		conn->dst_type = irk->addr_type;  in le_conn_complete_evt()
5670 	conn->dst_type = ev_bdaddr_type(hdev, conn->dst_type, NULL);  in le_conn_complete_evt()
5680 	if (test_bit(HCI_CONN_CANCEL, &conn->flags)) {  in le_conn_complete_evt()
5685 	if (conn->dst_type == ADDR_LE_DEV_PUBLIC)  in le_conn_complete_evt()
5691 	if (hci_bdaddr_list_lookup(&hdev->reject_list, &conn->dst, addr_type)) {  in le_conn_complete_evt()
5698 	conn->sec_level = BT_SECURITY_LOW;  in le_conn_complete_evt()
5699 	conn->state = BT_CONFIG;  in le_conn_complete_evt()
5702 	 * when sotfware rotation is in use so it can be re-enabled when  in le_conn_complete_evt()
5706 		conn->adv_instance = hdev->cur_adv_instance;  in le_conn_complete_evt()
5708 	conn->le_conn_interval = interval;  in le_conn_complete_evt()
5709 	conn->le_conn_latency = latency;  in le_conn_complete_evt()
5710 	conn->le_supv_timeout = supervision_timeout;  in le_conn_complete_evt()
5719 	 * If the local controller supports peripheral-initiated features  in le_conn_complete_evt()
5724 	if (conn->out ||  in le_conn_complete_evt()
5725 	    (hdev->le_features[0] & HCI_LE_PERIPHERAL_FEATURES)) {  in le_conn_complete_evt()
5728 		cp.handle = __cpu_to_le16(conn->handle);  in le_conn_complete_evt()
5735 		conn->state = BT_CONNECTED;  in le_conn_complete_evt()
5739 	params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,  in le_conn_complete_evt()
5740 					   conn->dst_type);  in le_conn_complete_evt()
5743 		if (params->conn) {  in le_conn_complete_evt()
5744 			hci_conn_drop(params->conn);  in le_conn_complete_evt()
5745 			hci_conn_put(params->conn);  in le_conn_complete_evt()
5746 			params->conn = NULL;  in le_conn_complete_evt()
5760 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);  in hci_le_conn_complete_evt()
5762 	le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,  in hci_le_conn_complete_evt()
5763 			     NULL, ev->role, le16_to_cpu(ev->handle),  in hci_le_conn_complete_evt()
5764 			     le16_to_cpu(ev->interval),  in hci_le_conn_complete_evt()
5765 			     le16_to_cpu(ev->latency),  in hci_le_conn_complete_evt()
5766 			     le16_to_cpu(ev->supervision_timeout));  in hci_le_conn_complete_evt()
5774 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);  in hci_le_enh_conn_complete_evt()
5776 	le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,  in hci_le_enh_conn_complete_evt()
5777 			     &ev->local_rpa, ev->role, le16_to_cpu(ev->handle),  in hci_le_enh_conn_complete_evt()
5778 			     le16_to_cpu(ev->interval),  in hci_le_enh_conn_complete_evt()
5779 			     le16_to_cpu(ev->latency),  in hci_le_enh_conn_complete_evt()
5780 			     le16_to_cpu(ev->supervision_timeout));  in hci_le_enh_conn_complete_evt()
5790 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);  in hci_le_ext_adv_term_evt()
5799 	if (ev->status == HCI_ERROR_CANCELLED_BY_HOST) {  in hci_le_ext_adv_term_evt()
5806 	adv = hci_find_adv_instance(hdev, ev->handle);  in hci_le_ext_adv_term_evt()
5808 	if (ev->status) {  in hci_le_ext_adv_term_evt()
5813 		hci_remove_adv_instance(hdev, ev->handle);  in hci_le_ext_adv_term_evt()
5814 		mgmt_advertising_removed(NULL, hdev, ev->handle);  in hci_le_ext_adv_term_evt()
5816 		list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) {  in hci_le_ext_adv_term_evt()
5817 			if (adv->enabled)  in hci_le_ext_adv_term_evt()
5827 		adv->enabled = false;  in hci_le_ext_adv_term_evt()
5829 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->conn_handle));  in hci_le_ext_adv_term_evt()
5832 		 * instance can be re-enabled when disconnected.  in hci_le_ext_adv_term_evt()
5834 		conn->adv_instance = ev->handle;  in hci_le_ext_adv_term_evt()
5836 		if (hdev->adv_addr_type != ADDR_LE_DEV_RANDOM ||  in hci_le_ext_adv_term_evt()
5837 		    bacmp(&conn->resp_addr, BDADDR_ANY))  in hci_le_ext_adv_term_evt()
5840 		if (!ev->handle) {  in hci_le_ext_adv_term_evt()
5841 			bacpy(&conn->resp_addr, &hdev->random_addr);  in hci_le_ext_adv_term_evt()
5846 			bacpy(&conn->resp_addr, &adv->random_addr);  in hci_le_ext_adv_term_evt()
5859 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);  in hci_le_conn_update_complete_evt()
5861 	if (ev->status)  in hci_le_conn_update_complete_evt()
5866 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));  in hci_le_conn_update_complete_evt()
5868 		conn->le_conn_interval = le16_to_cpu(ev->interval);  in hci_le_conn_update_complete_evt()
5869 		conn->le_conn_latency = le16_to_cpu(ev->latency);  in hci_le_conn_update_complete_evt()
5870 		conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);  in hci_le_conn_update_complete_evt()
5876 /* This function requires the caller holds hdev->lock */
5890 	if (hci_bdaddr_list_lookup(&hdev->reject_list, addr, addr_type) ||  in check_pending_le_conn()
5891 	    hdev->suspended)  in check_pending_le_conn()
5897 	if (hdev->conn_hash.le_num_peripheral > 0 &&  in check_pending_le_conn()
5898 	    (!test_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks) ||  in check_pending_le_conn()
5899 	     !(hdev->le_states[3] & 0x10)))  in check_pending_le_conn()
5905 	params = hci_pend_le_action_lookup(&hdev->pend_le_conns, addr,  in check_pending_le_conn()
5910 	if (!params->explicit_connect) {  in check_pending_le_conn()
5911 		switch (params->auto_connect) {  in check_pending_le_conn()
5934 			      BT_SECURITY_LOW, hdev->def_le_autoconnect_timeout,  in check_pending_le_conn()
5946 		if (!params->explicit_connect)  in check_pending_le_conn()
5947 			params->conn = hci_conn_get(conn);  in check_pending_le_conn()
5953 	case -EBUSY:  in check_pending_le_conn()
5954 		/* If hci_connect() returns -EBUSY it means there is already  in check_pending_le_conn()
5973 	struct discovery_state *d = &hdev->discovery;  in process_adv_report()
5989 				       "type: 0x%02x", type);  in process_adv_report()
6013 	len = ptr - data;  in process_adv_report()
6040 		if (!smp_irk_matches(hdev, hdev->irk, direct_addr))  in process_adv_report()
6047 		bdaddr = &irk->bdaddr;  in process_adv_report()
6048 		bdaddr_type = irk->addr_type;  in process_adv_report()
6065 		memcpy(conn->le_adv_data, data, len);  in process_adv_report()
6066 		conn->le_adv_data_len = len;  in process_adv_report()
6085 	if (hdev->le_scan_type == LE_SCAN_PASSIVE) {  in process_adv_report()
6089 		if (!hci_pend_le_action_lookup(&hdev->pend_le_reports,  in process_adv_report()
6091 		    idr_is_empty(&hdev->adv_monitors_idr))  in process_adv_report()
6133 	match = (!bacmp(bdaddr, &d->last_adv_addr) &&  in process_adv_report()
6134 		 bdaddr_type == d->last_adv_addr_type);  in process_adv_report()
6143 			mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,  in process_adv_report()
6144 					  d->last_adv_addr_type, NULL,  in process_adv_report()
6145 					  d->last_adv_rssi, d->last_adv_flags,  in process_adv_report()
6146 					  d->last_adv_data,  in process_adv_report()
6147 					  d->last_adv_data_len, NULL, 0, 0);  in process_adv_report()
6172 	mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,  in process_adv_report()
6173 			  d->last_adv_addr_type, NULL, rssi, d->last_adv_flags,  in process_adv_report()
6174 			  d->last_adv_data, d->last_adv_data_len, data, len, 0);  in process_adv_report()
6184 	if (!ev->num)  in hci_le_adv_report_evt()
6189 	while (ev->num--) {  in hci_le_adv_report_evt()
6200 					info->length + 1))  in hci_le_adv_report_evt()
6203 		if (info->length <= max_adv_len(hdev)) {  in hci_le_adv_report_evt()
6204 			rssi = info->data[info->length];  in hci_le_adv_report_evt()
6205 			process_adv_report(hdev, info->type, &info->bdaddr,  in hci_le_adv_report_evt()
6206 					   info->bdaddr_type, NULL, 0, rssi,  in hci_le_adv_report_evt()
6207 					   info->data, info->length, false,  in hci_le_adv_report_evt()
6255 	bt_dev_err_ratelimited(hdev, "Unknown advertising packet type: 0x%02x",  in ext_evt_type_to_legacy()
6267 	if (!ev->num)  in hci_le_ext_adv_report_evt()
6272 	while (ev->num--) {  in hci_le_ext_adv_report_evt()
6283 					info->length))  in hci_le_ext_adv_report_evt()
6286 		evt_type = __le16_to_cpu(info->type) & LE_EXT_ADV_EVT_TYPE_MASK;  in hci_le_ext_adv_report_evt()
6289 			process_adv_report(hdev, legacy_evt_type, &info->bdaddr,  in hci_le_ext_adv_report_evt()
6290 					   info->bdaddr_type, NULL, 0,  in hci_le_ext_adv_report_evt()
6291 					   info->rssi, info->data, info->length,  in hci_le_ext_adv_report_evt()
6314 	int mask = hdev->link_mode;  in hci_le_pa_sync_estabilished_evt()
6318 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);  in hci_le_pa_sync_estabilished_evt()
6324 	mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ISO_LINK, &flags);  in hci_le_pa_sync_estabilished_evt()
6326 		hci_le_pa_term_sync(hdev, ev->handle);  in hci_le_pa_sync_estabilished_evt()
6333 	if (ev->status) {  in hci_le_pa_sync_estabilished_evt()
6341 		set_bit(HCI_CONN_PA_SYNC_FAILED, &pa_sync->flags);  in hci_le_pa_sync_estabilished_evt()
6344 		hci_connect_cfm(pa_sync, ev->status);  in hci_le_pa_sync_estabilished_evt()
6355 	int mask = hdev->link_mode;  in hci_le_per_adv_report_evt()
6358 	bt_dev_dbg(hdev, "sync_handle 0x%4.4x", le16_to_cpu(ev->sync_handle));  in hci_le_per_adv_report_evt()
6364 		hci_le_pa_term_sync(hdev, ev->sync_handle);  in hci_le_per_adv_report_evt()
6375 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);  in hci_le_remote_feat_complete_evt()
6379 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));  in hci_le_remote_feat_complete_evt()
6381 		if (!ev->status)  in hci_le_remote_feat_complete_evt()
6382 			memcpy(conn->features[0], ev->features, 8);  in hci_le_remote_feat_complete_evt()
6384 		if (conn->state == BT_CONFIG) {  in hci_le_remote_feat_complete_evt()
6387 			/* If the local controller supports peripheral-initiated  in hci_le_remote_feat_complete_evt()
6396 			if (!conn->out && ev->status == HCI_ERROR_UNSUPPORTED_REMOTE_FEATURE &&  in hci_le_remote_feat_complete_evt()
6397 			    (hdev->le_features[0] & HCI_LE_PERIPHERAL_FEATURES))  in hci_le_remote_feat_complete_evt()
6400 				status = ev->status;  in hci_le_remote_feat_complete_evt()
6402 			conn->state = BT_CONNECTED;  in hci_le_remote_feat_complete_evt()
6420 	bt_dev_dbg(hdev, "handle 0x%4.4x", __le16_to_cpu(ev->handle));  in hci_le_ltk_request_evt()
6424 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));  in hci_le_ltk_request_evt()
6428 	ltk = hci_find_ltk(hdev, &conn->dst, conn->dst_type, conn->role);  in hci_le_ltk_request_evt()
6434 		if (ev->ediv || ev->rand)  in hci_le_ltk_request_evt()
6437 		/* For non-SC keys check that EDiv and Rand match */  in hci_le_ltk_request_evt()
6438 		if (ev->ediv != ltk->ediv || ev->rand != ltk->rand)  in hci_le_ltk_request_evt()
6442 	memcpy(cp.ltk, ltk->val, ltk->enc_size);  in hci_le_ltk_request_evt()
6443 	memset(cp.ltk + ltk->enc_size, 0, sizeof(cp.ltk) - ltk->enc_size);  in hci_le_ltk_request_evt()
6444 	cp.handle = cpu_to_le16(conn->handle);  in hci_le_ltk_request_evt()
6446 	conn->pending_sec_level = smp_ltk_sec_level(ltk);  in hci_le_ltk_request_evt()
6448 	conn->enc_key_size = ltk->enc_size;  in hci_le_ltk_request_evt()
6455 	 * distribute the keys. Later, security can be re-established  in hci_le_ltk_request_evt()
6458 	if (ltk->type == SMP_STK) {  in hci_le_ltk_request_evt()
6459 		set_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);  in hci_le_ltk_request_evt()
6460 		list_del_rcu(&ltk->list);  in hci_le_ltk_request_evt()
6463 		clear_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);  in hci_le_ltk_request_evt()
6471 	neg.handle = ev->handle;  in hci_le_ltk_request_evt()
6496 	bt_dev_dbg(hdev, "handle 0x%4.4x", __le16_to_cpu(ev->handle));  in hci_le_remote_conn_param_req_evt()
6498 	handle = le16_to_cpu(ev->handle);  in hci_le_remote_conn_param_req_evt()
6499 	min = le16_to_cpu(ev->interval_min);  in hci_le_remote_conn_param_req_evt()
6500 	max = le16_to_cpu(ev->interval_max);  in hci_le_remote_conn_param_req_evt()
6501 	latency = le16_to_cpu(ev->latency);  in hci_le_remote_conn_param_req_evt()
6502 	timeout = le16_to_cpu(ev->timeout);  in hci_le_remote_conn_param_req_evt()
6505 	if (!hcon || hcon->state != BT_CONNECTED)  in hci_le_remote_conn_param_req_evt()
6509 	if (max > hcon->le_conn_max_interval)  in hci_le_remote_conn_param_req_evt()
6517 	if (hcon->role == HCI_ROLE_MASTER) {  in hci_le_remote_conn_param_req_evt()
6523 		params = hci_conn_params_lookup(hdev, &hcon->dst,  in hci_le_remote_conn_param_req_evt()
6524 						hcon->dst_type);  in hci_le_remote_conn_param_req_evt()
6526 			params->conn_min_interval = min;  in hci_le_remote_conn_param_req_evt()
6527 			params->conn_max_interval = max;  in hci_le_remote_conn_param_req_evt()
6528 			params->conn_latency = latency;  in hci_le_remote_conn_param_req_evt()
6529 			params->supervision_timeout = timeout;  in hci_le_remote_conn_param_req_evt()
6537 		mgmt_new_conn_param(hdev, &hcon->dst, hcon->dst_type,  in hci_le_remote_conn_param_req_evt()
6541 	cp.handle = ev->handle;  in hci_le_remote_conn_param_req_evt()
6542 	cp.interval_min = ev->interval_min;  in hci_le_remote_conn_param_req_evt()
6543 	cp.interval_max = ev->interval_max;  in hci_le_remote_conn_param_req_evt()
6544 	cp.latency = ev->latency;  in hci_le_remote_conn_param_req_evt()
6545 	cp.timeout = ev->timeout;  in hci_le_remote_conn_param_req_evt()
6560 				flex_array_size(ev, info, ev->num)))  in hci_le_direct_adv_report_evt()
6563 	if (!ev->num)  in hci_le_direct_adv_report_evt()
6568 	for (i = 0; i < ev->num; i++) {  in hci_le_direct_adv_report_evt()
6569 		struct hci_ev_le_direct_adv_info *info = &ev->info[i];  in hci_le_direct_adv_report_evt()
6571 		process_adv_report(hdev, info->type, &info->bdaddr,  in hci_le_direct_adv_report_evt()
6572 				   info->bdaddr_type, &info->direct_addr,  in hci_le_direct_adv_report_evt()
6573 				   info->direct_addr_type, info->rssi, NULL, 0,  in hci_le_direct_adv_report_evt()
6586 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);  in hci_le_phy_update_evt()
6588 	if (ev->status)  in hci_le_phy_update_evt()
6593 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));  in hci_le_phy_update_evt()
6597 	conn->le_tx_phy = ev->tx_phy;  in hci_le_phy_update_evt()
6598 	conn->le_rx_phy = ev->rx_phy;  in hci_le_phy_update_evt()
6611 	u16 handle = __le16_to_cpu(ev->handle);  in hci_le_cis_estabilished_evt()
6614 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);  in hci_le_cis_estabilished_evt()
6621 			   "Unable to find connection with handle 0x%4.4x",  in hci_le_cis_estabilished_evt()
6626 	if (conn->type != ISO_LINK) {  in hci_le_cis_estabilished_evt()
6628 			   "Invalid connection link type handle 0x%4.4x",  in hci_le_cis_estabilished_evt()
6633 	qos = &conn->iso_qos;  in hci_le_cis_estabilished_evt()
6635 	pending = test_and_clear_bit(HCI_CONN_CREATE_CIS, &conn->flags);  in hci_le_cis_estabilished_evt()
6642 	 * SDU_Interval = (CIG_Sync_Delay + (FT) x ISO_Interval) -  in hci_le_cis_estabilished_evt()
6645 	c_sdu_interval = (get_unaligned_le24(ev->cig_sync_delay) +  in hci_le_cis_estabilished_evt()
6646 			 (ev->c_ft * le16_to_cpu(ev->interval) * 1250)) -  in hci_le_cis_estabilished_evt()
6647 			get_unaligned_le24(ev->c_latency);  in hci_le_cis_estabilished_evt()
6648 	p_sdu_interval = (get_unaligned_le24(ev->cig_sync_delay) +  in hci_le_cis_estabilished_evt()
6649 			 (ev->p_ft * le16_to_cpu(ev->interval) * 1250)) -  in hci_le_cis_estabilished_evt()
6650 			get_unaligned_le24(ev->p_latency);  in hci_le_cis_estabilished_evt()
6652 	switch (conn->role) {  in hci_le_cis_estabilished_evt()
6654 		qos->ucast.in.interval = c_sdu_interval;  in hci_le_cis_estabilished_evt()
6655 		qos->ucast.out.interval = p_sdu_interval;  in hci_le_cis_estabilished_evt()
6657 		qos->ucast.in.latency =  in hci_le_cis_estabilished_evt()
6658 			DIV_ROUND_CLOSEST(get_unaligned_le24(ev->c_latency),  in hci_le_cis_estabilished_evt()
6660 		qos->ucast.out.latency =  in hci_le_cis_estabilished_evt()
6661 			DIV_ROUND_CLOSEST(get_unaligned_le24(ev->p_latency),  in hci_le_cis_estabilished_evt()
6663 		qos->ucast.in.sdu = le16_to_cpu(ev->c_mtu);  in hci_le_cis_estabilished_evt()
6664 		qos->ucast.out.sdu = le16_to_cpu(ev->p_mtu);  in hci_le_cis_estabilished_evt()
6665 		qos->ucast.in.phy = ev->c_phy;  in hci_le_cis_estabilished_evt()
6666 		qos->ucast.out.phy = ev->p_phy;  in hci_le_cis_estabilished_evt()
6669 		qos->ucast.in.interval = p_sdu_interval;  in hci_le_cis_estabilished_evt()
6670 		qos->ucast.out.interval = c_sdu_interval;  in hci_le_cis_estabilished_evt()
6672 		qos->ucast.out.latency =  in hci_le_cis_estabilished_evt()
6673 			DIV_ROUND_CLOSEST(get_unaligned_le24(ev->c_latency),  in hci_le_cis_estabilished_evt()
6675 		qos->ucast.in.latency =  in hci_le_cis_estabilished_evt()
6676 			DIV_ROUND_CLOSEST(get_unaligned_le24(ev->p_latency),  in hci_le_cis_estabilished_evt()
6678 		qos->ucast.out.sdu = le16_to_cpu(ev->c_mtu);  in hci_le_cis_estabilished_evt()
6679 		qos->ucast.in.sdu = le16_to_cpu(ev->p_mtu);  in hci_le_cis_estabilished_evt()
6680 		qos->ucast.out.phy = ev->c_phy;  in hci_le_cis_estabilished_evt()
6681 		qos->ucast.in.phy = ev->p_phy;  in hci_le_cis_estabilished_evt()
6685 	if (!ev->status) {  in hci_le_cis_estabilished_evt()
6686 		conn->state = BT_CONNECTED;  in hci_le_cis_estabilished_evt()
6693 	conn->state = BT_CLOSED;  in hci_le_cis_estabilished_evt()
6694 	hci_connect_cfm(conn, ev->status);  in hci_le_cis_estabilished_evt()
6732 	acl_handle = __le16_to_cpu(ev->acl_handle);  in hci_le_cis_req_evt()
6733 	cis_handle = __le16_to_cpu(ev->cis_handle);  in hci_le_cis_req_evt()
6735 	bt_dev_dbg(hdev, "acl 0x%4.4x handle 0x%4.4x cig 0x%2.2x cis 0x%2.2x",  in hci_le_cis_req_evt()
6736 		   acl_handle, cis_handle, ev->cig_id, ev->cis_id);  in hci_le_cis_req_evt()
6744 	mask = hci_proto_connect_ind(hdev, &acl->dst, ISO_LINK, &flags);  in hci_le_cis_req_evt()
6746 		hci_le_reject_cis(hdev, ev->cis_handle);  in hci_le_cis_req_evt()
6752 		cis = hci_conn_add(hdev, ISO_LINK, &acl->dst, HCI_ROLE_SLAVE,  in hci_le_cis_req_evt()
6755 			hci_le_reject_cis(hdev, ev->cis_handle);  in hci_le_cis_req_evt()
6760 	cis->iso_qos.ucast.cig = ev->cig_id;  in hci_le_cis_req_evt()
6761 	cis->iso_qos.ucast.cis = ev->cis_id;  in hci_le_cis_req_evt()
6764 		hci_le_accept_cis(hdev, ev->cis_handle);  in hci_le_cis_req_evt()
6766 		cis->state = BT_CONNECT2;  in hci_le_cis_req_evt()
6789 	BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);  in hci_le_create_big_complete_evt()
6792 				flex_array_size(ev, bis_handle, ev->num_bis)))  in hci_le_create_big_complete_evt()
6798 	while ((conn = hci_conn_hash_lookup_big_state(hdev, ev->handle,  in hci_le_create_big_complete_evt()
6800 		if (ev->status) {  in hci_le_create_big_complete_evt()
6801 			hci_connect_cfm(conn, ev->status);  in hci_le_create_big_complete_evt()
6807 					__le16_to_cpu(ev->bis_handle[i++])))  in hci_le_create_big_complete_evt()
6810 		conn->state = BT_CONNECTED;  in hci_le_create_big_complete_evt()
6811 		set_bit(HCI_CONN_BIG_CREATED, &conn->flags);  in hci_le_create_big_complete_evt()
6817 	if (!ev->status && !i)  in hci_le_create_big_complete_evt()
6824 				   UINT_PTR(ev->handle), NULL);  in hci_le_create_big_complete_evt()
6837 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);  in hci_le_big_sync_established_evt()
6840 				flex_array_size(ev, bis, ev->num_bis)))  in hci_le_big_sync_established_evt()
6845 	if (!ev->status) {  in hci_le_big_sync_established_evt()
6846 		pa_sync = hci_conn_hash_lookup_pa_sync_big_handle(hdev, ev->handle);  in hci_le_big_sync_established_evt()
6851 			set_bit(HCI_CONN_BIG_SYNC, &pa_sync->flags);  in hci_le_big_sync_established_evt()
6854 	for (i = 0; i < ev->num_bis; i++) {  in hci_le_big_sync_established_evt()
6855 		u16 handle = le16_to_cpu(ev->bis[i]);  in hci_le_big_sync_established_evt()
6870 		if (ev->status != 0x42)  in hci_le_big_sync_established_evt()
6872 			set_bit(HCI_CONN_PA_SYNC, &bis->flags);  in hci_le_big_sync_established_evt()
6874 		bis->iso_qos.bcast.big = ev->handle;  in hci_le_big_sync_established_evt()
6876 		memcpy(&interval, ev->latency, sizeof(ev->latency));  in hci_le_big_sync_established_evt()
6877 		bis->iso_qos.bcast.in.interval = le32_to_cpu(interval);  in hci_le_big_sync_established_evt()
6879 		bis->iso_qos.bcast.in.latency = le16_to_cpu(ev->interval) * 125 / 100;  in hci_le_big_sync_established_evt()
6880 		bis->iso_qos.bcast.in.sdu = le16_to_cpu(ev->max_pdu);  in hci_le_big_sync_established_evt()
6882 		if (!ev->status) {  in hci_le_big_sync_established_evt()
6883 			bis->state = BT_CONNECTED;  in hci_le_big_sync_established_evt()
6884 			set_bit(HCI_CONN_BIG_SYNC, &bis->flags);  in hci_le_big_sync_established_evt()
6894 	if (ev->status)  in hci_le_big_sync_established_evt()
6895 		for (i = 0; i < ev->num_bis; i++) {  in hci_le_big_sync_established_evt()
6896 			u16 handle = le16_to_cpu(ev->bis[i]);  in hci_le_big_sync_established_evt()
6902 			set_bit(HCI_CONN_BIG_SYNC_FAILED, &bis->flags);  in hci_le_big_sync_established_evt()
6903 			hci_connect_cfm(bis, ev->status);  in hci_le_big_sync_established_evt()
6913 	int mask = hdev->link_mode;  in hci_le_big_info_adv_report_evt()
6917 	bt_dev_dbg(hdev, "sync_handle 0x%4.4x", le16_to_cpu(ev->sync_handle));  in hci_le_big_info_adv_report_evt()
6923 		hci_le_pa_term_sync(hdev, ev->sync_handle);  in hci_le_big_info_adv_report_evt()
6932 			le16_to_cpu(ev->sync_handle));  in hci_le_big_info_adv_report_evt()
6944 	pa_sync->sync_handle = le16_to_cpu(ev->sync_handle);  in hci_le_big_info_adv_report_evt()
6945 	set_bit(HCI_CONN_PA_SYNC, &pa_sync->flags);  in hci_le_big_info_adv_report_evt()
7060 	bt_dev_dbg(hdev, "subevent 0x%2.2x", ev->subevent);  in hci_le_meta_evt()
7063 	if (hdev->req_skb &&  in hci_le_meta_evt()
7064 	    hci_opcode_ogf(hci_skb_opcode(hdev->req_skb)) == 0x08 &&  in hci_le_meta_evt()
7065 	    hci_skb_event(hdev->req_skb) == ev->subevent) {  in hci_le_meta_evt()
7066 		*opcode = hci_skb_opcode(hdev->req_skb);  in hci_le_meta_evt()
7071 	subev = &hci_le_ev_table[ev->subevent];  in hci_le_meta_evt()
7072 	if (!subev->func)  in hci_le_meta_evt()
7075 	if (skb->len < subev->min_len) {  in hci_le_meta_evt()
7076 		bt_dev_err(hdev, "unexpected subevent 0x%2.2x length: %u < %u",  in hci_le_meta_evt()
7077 			   ev->subevent, skb->len, subev->min_len);  in hci_le_meta_evt()
7085 	if (skb->len > subev->max_len)  in hci_le_meta_evt()
7086 		bt_dev_warn(hdev, "unexpected subevent 0x%2.2x length: %u > %u",  in hci_le_meta_evt()
7087 			    ev->subevent, skb->len, subev->max_len);  in hci_le_meta_evt()
7088 	data = hci_le_ev_skb_pull(hdev, skb, ev->subevent, subev->min_len);  in hci_le_meta_evt()
7092 	subev->func(hdev, data, skb);  in hci_le_meta_evt()
7109 		if (hdr->evt != event)  in hci_get_cmd_complete()
7114 	/* Check if request ended in Command Status - no way to retrieve  in hci_get_cmd_complete()
7117 	if (hdr->evt == HCI_EV_CMD_STATUS)  in hci_get_cmd_complete()
7120 	if (hdr->evt != HCI_EV_CMD_COMPLETE) {  in hci_get_cmd_complete()
7121 		bt_dev_err(hdev, "last event is not cmd complete (0x%2.2x)",  in hci_get_cmd_complete()
7122 			   hdr->evt);  in hci_get_cmd_complete()
7130 	if (opcode != __le16_to_cpu(ev->opcode)) {  in hci_get_cmd_complete()
7131 		BT_DBG("opcode doesn't match (0x%2.2x != 0x%2.2x)", opcode,  in hci_get_cmd_complete()
7132 		       __le16_to_cpu(ev->opcode));  in hci_get_cmd_complete()
7145 	const struct hci_ev_conn_complete *conn_complete = (void *)skb->data;  in hci_store_wake_reason()
7146 	const struct hci_ev_conn_request *conn_request = (void *)skb->data;  in hci_store_wake_reason()
7153 	if (!hdev->suspended || hdev->wake_reason)  in hci_store_wake_reason()
7159 	hdev->wake_reason = MGMT_WAKE_REASON_REMOTE_WAKE;  in hci_store_wake_reason()
7166 		bacpy(&hdev->wake_addr, &conn_request->bdaddr);  in hci_store_wake_reason()
7167 		hdev->wake_addr_type = BDADDR_BREDR;  in hci_store_wake_reason()
7169 		bacpy(&hdev->wake_addr, &conn_complete->bdaddr);  in hci_store_wake_reason()
7170 		hdev->wake_addr_type = BDADDR_BREDR;  in hci_store_wake_reason()
7172 		struct hci_ev_le_meta *le_ev = (void *)skb->data;  in hci_store_wake_reason()
7173 		u8 subevent = le_ev->subevent;  in hci_store_wake_reason()
7174 		u8 *ptr = &skb->data[sizeof(*le_ev)];  in hci_store_wake_reason()
7187 				bacpy(&hdev->wake_addr, &adv->bdaddr);  in hci_store_wake_reason()
7188 				hdev->wake_addr_type = adv->bdaddr_type;  in hci_store_wake_reason()
7191 				bacpy(&hdev->wake_addr, &direct_adv->bdaddr);  in hci_store_wake_reason()
7192 				hdev->wake_addr_type = direct_adv->bdaddr_type;  in hci_store_wake_reason()
7195 				bacpy(&hdev->wake_addr, &ext_adv->bdaddr);  in hci_store_wake_reason()
7196 				hdev->wake_addr_type = ext_adv->bdaddr_type;  in hci_store_wake_reason()
7201 		hdev->wake_reason = MGMT_WAKE_REASON_UNEXPECTED;  in hci_store_wake_reason()
7377 	if (!ev->func)  in hci_event_func()
7380 	if (skb->len < ev->min_len) {  in hci_event_func()
7381 		bt_dev_err(hdev, "unexpected event 0x%2.2x length: %u < %u",  in hci_event_func()
7382 			   event, skb->len, ev->min_len);  in hci_event_func()
7390 	if (skb->len > ev->max_len)  in hci_event_func()
7392 					"unexpected event 0x%2.2x length: %u > %u",  in hci_event_func()
7393 					event, skb->len, ev->max_len);  in hci_event_func()
7395 	data = hci_ev_skb_pull(hdev, skb, event, ev->min_len);  in hci_event_func()
7399 	if (ev->req)  in hci_event_func()
7400 		ev->func_req(hdev, data, skb, opcode, status, req_complete,  in hci_event_func()
7403 		ev->func(hdev, data, skb);  in hci_event_func()
7408 	struct hci_event_hdr *hdr = (void *) skb->data;  in hci_event_packet()
7415 	if (skb->len < sizeof(*hdr)) {  in hci_event_packet()
7420 	kfree_skb(hdev->recv_event);  in hci_event_packet()
7421 	hdev->recv_event = skb_clone(skb, GFP_KERNEL);  in hci_event_packet()
7423 	event = hdr->evt;  in hci_event_packet()
7425 		bt_dev_warn(hdev, "Received unexpected HCI Event 0x%2.2x",  in hci_event_packet()
7431 	if (hdev->req_skb &&  in hci_event_packet()
7432 	    hci_opcode_ogf(hci_skb_opcode(hdev->req_skb)) != 0x08 &&  in hci_event_packet()
7433 	    hci_skb_event(hdev->req_skb) == event) {  in hci_event_packet()
7434 		hci_req_cmd_complete(hdev, hci_skb_opcode(hdev->req_skb),  in hci_event_packet()
7453 	bt_dev_dbg(hdev, "event 0x%2.2x", event);  in hci_event_packet()
7471 	hdev->stat.evt_rx++;  in hci_event_packet()