projects / linux-block.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: ISO: Add support for connecting multiple BISes
[linux-block.git] / net / bluetooth / hci_conn.c
CommitLineData
8e87d142 1/*
1da177e4 2 BlueZ - Bluetooth protocol stack for Linux
2d0a0346 3 Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
0fe8c8d0 4 Copyright 2023 NXP
1da177e4
LT		 5
6 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License version 2 as
10 published by the Free Software Foundation;
11
12 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
13 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
14 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
15 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 16 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
17 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
18 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 19 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20
8e87d142
YH		 21 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
22 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 23 SOFTWARE IS DISCLAIMED.
24*/
25
26/* Bluetooth HCI connection handling. */
27
8c520a59 28#include <linux/export.h>
23b9ceb7 29#include <linux/debugfs.h>
1da177e4
LT		 30
31#include <net/bluetooth/bluetooth.h>
32#include <net/bluetooth/hci_core.h>
4bc58f51 33#include <net/bluetooth/l2cap.h>
eca0ae4a
LAD		 34#include <net/bluetooth/iso.h>
35#include <net/bluetooth/mgmt.h>
1da177e4 36
0857dd3b 37#include "hci_request.h"
ac4b7236 38#include "smp.h"
7024728e 39#include "a2mp.h"
eca0ae4a 40#include "eir.h"
7024728e 41
2dea632f
FD		 42struct sco_param {
43 u16 pkt_type;
44 u16 max_latency;
c7da5797 45 u8 retrans_effort;
2dea632f
FD		 46};
47
e07a06b4
BG		 48struct conn_handle_t {
49 struct hci_conn *conn;
50 __u16 handle;
51};
52
48e68ff5 53static const struct sco_param esco_param_cvsd[] = {
c7da5797
JH		 54 { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000a, 0x01 }, /* S3 */
55 { EDR_ESCO_MASK & ~ESCO_2EV3, 0x0007, 0x01 }, /* S2 */
56 { EDR_ESCO_MASK | ESCO_EV3, 0x0007, 0x01 }, /* S1 */
57 { EDR_ESCO_MASK | ESCO_HV3, 0xffff, 0x01 }, /* D1 */
58 { EDR_ESCO_MASK | ESCO_HV1, 0xffff, 0x01 }, /* D0 */
2dea632f
FD		 59};
60
48e68ff5 61static const struct sco_param sco_param_cvsd[] = {
c7da5797
JH		 62 { EDR_ESCO_MASK | ESCO_HV3, 0xffff, 0xff }, /* D1 */
63 { EDR_ESCO_MASK | ESCO_HV1, 0xffff, 0xff }, /* D0 */
48e68ff5
BT		 64};
65
565766b0 66static const struct sco_param esco_param_msbc[] = {
c7da5797
JH		 67 { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000d, 0x02 }, /* T2 */
68 { EDR_ESCO_MASK | ESCO_EV3, 0x0008, 0x02 }, /* T1 */
2dea632f
FD		 69};
70
f75113a2 71/* This function requires the caller holds hdev->lock */
19cf60bf 72static void hci_connect_le_scan_cleanup(struct hci_conn *conn, u8 status)
f75113a2
JP		 73{
74 struct hci_conn_params *params;
b5c2b621 75 struct hci_dev *hdev = conn->hdev;
f75113a2
JP		 76 struct smp_irk *irk;
77 bdaddr_t *bdaddr;
78 u8 bdaddr_type;
79
80 bdaddr = &conn->dst;
81 bdaddr_type = conn->dst_type;
82
83 /* Check if we need to convert to identity address */
b5c2b621 84 irk = hci_get_irk(hdev, bdaddr, bdaddr_type);
f75113a2
JP		 85 if (irk) {
86 bdaddr = &irk->bdaddr;
87 bdaddr_type = irk->addr_type;
88 }
89
17bc08f0
JH		 90 params = hci_pend_le_action_lookup(&hdev->pend_le_conns, bdaddr,
91 bdaddr_type);
19cf60bf 92 if (!params)
f75113a2
JP		 93 return;
94
19cf60bf
LAD		 95 if (params->conn) {
96 hci_conn_drop(params->conn);
97 hci_conn_put(params->conn);
98 params->conn = NULL;
99 }
100
101 if (!params->explicit_connect)
102 return;
103
104 /* If the status indicates successful cancellation of
105 * the attempt (i.e. Unknown Connection Id) there's no point of
106 * notifying failure since we'll go back to keep trying to
107 * connect. The only exception is explicit connect requests
108 * where a timeout + cancel does indicate an actual failure.
109 */
110 if (status && status != HCI_ERROR_UNKNOWN_CONN_ID)
111 mgmt_connect_failed(hdev, &conn->dst, conn->type,
112 conn->dst_type, status);
113
f75113a2
JP		 114 /* The connection attempt was doing scan for new RPA, and is
115 * in scan phase. If params are not associated with any other
116 * autoconnect action, remove them completely. If they are, just unmark
117 * them as waiting for connection, by clearing explicit_connect field.
118 */
9ad3e6ff
JH		 119 params->explicit_connect = false;
120
195ef75e 121 hci_pend_le_list_del_init(params);
9ad3e6ff
JH		 122
123 switch (params->auto_connect) {
124 case HCI_AUTO_CONN_EXPLICIT:
b5c2b621 125 hci_conn_params_del(hdev, bdaddr, bdaddr_type);
9ad3e6ff
JH		 126 /* return instead of break to avoid duplicate scan update */
127 return;
128 case HCI_AUTO_CONN_DIRECT:
129 case HCI_AUTO_CONN_ALWAYS:
195ef75e 130 hci_pend_le_list_add(params, &hdev->pend_le_conns);
9ad3e6ff
JH		 131 break;
132 case HCI_AUTO_CONN_REPORT:
195ef75e 133 hci_pend_le_list_add(params, &hdev->pend_le_reports);
9ad3e6ff
JH		 134 break;
135 default:
136 break;
168b8a25 137 }
9ad3e6ff 138
5bee2fd6 139 hci_update_passive_scan(hdev);
f75113a2
JP		 140}
141
b958f9a3
JH		 142static void hci_conn_cleanup(struct hci_conn *conn)
143{
144 struct hci_dev *hdev = conn->hdev;
145
146 if (test_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags))
147 hci_conn_params_del(conn->hdev, &conn->dst, conn->dst_type);
148
629f66aa
AM		 149 if (test_and_clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
150 hci_remove_link_key(hdev, &conn->dst);
151
b958f9a3
JH		 152 hci_chan_list_flush(conn);
153
154 hci_conn_hash_del(hdev, conn);
155
26afbd82
LAD		 156 if (conn->cleanup)
157 conn->cleanup(conn);
158
1f8330ea
SN		 159 if (conn->type == SCO_LINK || conn->type == ESCO_LINK) {
160 switch (conn->setting & SCO_AIRMODE_MASK) {
161 case SCO_AIRMODE_CVSD:
162 case SCO_AIRMODE_TRANSP:
163 if (hdev->notify)
164 hdev->notify(hdev, HCI_NOTIFY_DISABLE_SCO);
165 break;
166 }
167 } else {
168 if (hdev->notify)
169 hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
170 }
b958f9a3
JH		 171
172 hci_conn_del_sysfs(conn);
173
174 debugfs_remove_recursive(conn->debugfs);
175
176 hci_dev_put(hdev);
177
178 hci_conn_put(conn);
179}
180
8ce783dc 181static void le_scan_cleanup(struct work_struct *work)
f75113a2 182{
8ce783dc
JH		 183 struct hci_conn *conn = container_of(work, struct hci_conn,
184 le_scan_cleanup);
185 struct hci_dev *hdev = conn->hdev;
186 struct hci_conn *c = NULL;
187
188 BT_DBG("%s hcon %p", hdev->name, conn);
189
190 hci_dev_lock(hdev);
191
192 /* Check that the hci_conn is still around */
193 rcu_read_lock();
194 list_for_each_entry_rcu(c, &hdev->conn_hash.list, list) {
195 if (c == conn)
196 break;
197 }
198 rcu_read_unlock();
199
200 if (c == conn) {
19cf60bf 201 hci_connect_le_scan_cleanup(conn, 0x00);
8ce783dc
JH		 202 hci_conn_cleanup(conn);
203 }
204
205 hci_dev_unlock(hdev);
206 hci_dev_put(hdev);
207 hci_conn_put(conn);
208}
f75113a2 209
8ce783dc
JH		 210static void hci_connect_le_scan_remove(struct hci_conn *conn)
211{
212 BT_DBG("%s hcon %p", conn->hdev->name, conn);
213
214 /* We can't call hci_conn_del/hci_conn_cleanup here since that
215 * could deadlock with another hci_conn_del() call that's holding
216 * hci_dev_lock and doing cancel_delayed_work_sync(&conn->disc_work).
217 * Instead, grab temporary extra references to the hci_dev and
218 * hci_conn and perform the necessary cleanup in a separate work
219 * callback.
b958f9a3 220 */
8ce783dc
JH		 221
222 hci_dev_hold(conn->hdev);
223 hci_conn_get(conn);
224
0ebc1818
JH		 225 /* Even though we hold a reference to the hdev, many other
226 * things might get cleaned up meanwhile, including the hdev's
227 * own workqueue, so we can't use that for scheduling.
228 */
8ce783dc 229 schedule_work(&conn->le_scan_cleanup);
f75113a2
JP		 230}
231
1aef8669 232static void hci_acl_create_connection(struct hci_conn *conn)
1da177e4
LT		 233{
234 struct hci_dev *hdev = conn->hdev;
235 struct inquiry_entry *ie;
236 struct hci_cp_create_conn cp;
237
42d2d87c 238 BT_DBG("hcon %p", conn);
1da177e4 239
89e65975
SS		 240 /* Many controllers disallow HCI Create Connection while it is doing
241 * HCI Inquiry. So we cancel the Inquiry first before issuing HCI Create
242 * Connection. This may cause the MGMT discovering state to become false
243 * without user space's request but it is okay since the MGMT Discovery
244 * APIs do not promise that discovery should be done forever. Instead,
245 * the user space monitors the status of MGMT discovering and it may
246 * request for discovery again when this flag becomes false.
247 */
248 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
249 /* Put this connection to "pending" state so that it will be
250 * executed after the inquiry cancel command complete event.
251 */
252 conn->state = BT_CONNECT2;
253 hci_send_cmd(hdev, HCI_OP_INQUIRY_CANCEL, 0, NULL);
254 return;
255 }
256
1da177e4 257 conn->state = BT_CONNECT;
a0c808b3 258 conn->out = true;
40bef302 259 conn->role = HCI_ROLE_MASTER;
1da177e4 260
4c67bc74
MH		 261 conn->attempt++;
262
e4e8e37c
MH		 263 conn->link_policy = hdev->link_policy;
264
1da177e4
LT		 265 memset(&cp, 0, sizeof(cp));
266 bacpy(&cp.bdaddr, &conn->dst);
267 cp.pscan_rep_mode = 0x02;
268
70f23020
AE		 269 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
270 if (ie) {
41a96212
MH		 271 if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
272 cp.pscan_rep_mode = ie->data.pscan_rep_mode;
273 cp.pscan_mode = ie->data.pscan_mode;
274 cp.clock_offset = ie->data.clock_offset |
dcf4adbf 275 cpu_to_le16(0x8000);
41a96212
MH		 276 }
277
1da177e4
LT		 278 memcpy(conn->dev_class, ie->data.dev_class, 3);
279 }
280
a8746417 281 cp.pkt_type = cpu_to_le16(conn->pkt_type);
1da177e4 282 if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
b6a0dc82 283 cp.role_switch = 0x01;
1da177e4 284 else
b6a0dc82 285 cp.role_switch = 0x00;
4c67bc74 286
a9de9248 287 hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
1da177e4
LT		 288}
289
e3b679d5 290int hci_disconnect(struct hci_conn *conn, __u8 reason)
1da177e4 291{
38b3fef1 292 BT_DBG("hcon %p", conn);
1da177e4 293
74be523c 294 /* When we are central of an established connection and it enters
839035a7
JH		 295 * the disconnect timeout, then go ahead and try to read the
296 * current clock offset. Processing of the result is done
297 * within the event handling and hci_clock_offset_evt function.
298 */
88d07feb
JH		 299 if (conn->type == ACL_LINK && conn->role == HCI_ROLE_MASTER &&
300 (conn->state == BT_CONNECTED || conn->state == BT_CONFIG)) {
839035a7 301 struct hci_dev *hdev = conn->hdev;
4f639ede 302 struct hci_cp_read_clock_offset clkoff_cp;
839035a7 303
4f639ede
FF		 304 clkoff_cp.handle = cpu_to_le16(conn->handle);
305 hci_send_cmd(hdev, HCI_OP_READ_CLOCK_OFFSET, sizeof(clkoff_cp),
306 &clkoff_cp);
839035a7
JH		 307 }
308
88d07feb 309 return hci_abort_conn(conn, reason);
1da177e4
LT		 310}
311
57f5d0d1 312static void hci_add_sco(struct hci_conn *conn, __u16 handle)
1da177e4
LT		 313{
314 struct hci_dev *hdev = conn->hdev;
315 struct hci_cp_add_sco cp;
316
38b3fef1 317 BT_DBG("hcon %p", conn);
1da177e4
LT		 318
319 conn->state = BT_CONNECT;
a0c808b3 320 conn->out = true;
1da177e4 321
efc7688b
MH		 322 conn->attempt++;
323
aca3192c 324 cp.handle = cpu_to_le16(handle);
a8746417 325 cp.pkt_type = cpu_to_le16(conn->pkt_type);
1da177e4 326
a9de9248 327 hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
1da177e4
LT		 328}
329
8b1c324c
YL		 330static bool find_next_esco_param(struct hci_conn *conn,
331 const struct sco_param *esco_param, int size)
332{
06149746
LAD		 333 if (!conn->parent)
334 return false;
335
8b1c324c 336 for (; conn->attempt <= size; conn->attempt++) {
06149746 337 if (lmp_esco_2m_capable(conn->parent) ||
8b1c324c
YL		 338 (esco_param[conn->attempt - 1].pkt_type & ESCO_2EV3))
339 break;
340 BT_DBG("hcon %p skipped attempt %d, eSCO 2M not supported",
341 conn, conn->attempt);
342 }
343
344 return conn->attempt <= size;
345}
346
e07a06b4 347static int configure_datapath_sync(struct hci_dev *hdev, struct bt_codec *codec)
b2af264a 348{
e07a06b4
BG		 349 int err;
350 __u8 vnd_len, *vnd_data = NULL;
351 struct hci_op_configure_data_path *cmd = NULL;
352
353 err = hdev->get_codec_config_data(hdev, ESCO_LINK, codec, &vnd_len,
354 &vnd_data);
355 if (err < 0)
356 goto error;
357
358 cmd = kzalloc(sizeof(*cmd) + vnd_len, GFP_KERNEL);
359 if (!cmd) {
360 err = -ENOMEM;
361 goto error;
362 }
363
364 err = hdev->get_data_path_id(hdev, &cmd->data_path_id);
365 if (err < 0)
366 goto error;
367
368 cmd->vnd_len = vnd_len;
369 memcpy(cmd->vnd_data, vnd_data, vnd_len);
370
371 cmd->direction = 0x00;
372 __hci_cmd_sync_status(hdev, HCI_CONFIGURE_DATA_PATH,
373 sizeof(*cmd) + vnd_len, cmd, HCI_CMD_TIMEOUT);
374
375 cmd->direction = 0x01;
376 err = __hci_cmd_sync_status(hdev, HCI_CONFIGURE_DATA_PATH,
377 sizeof(*cmd) + vnd_len, cmd,
378 HCI_CMD_TIMEOUT);
379error:
380
381 kfree(cmd);
382 kfree(vnd_data);
383 return err;
384}
385
386static int hci_enhanced_setup_sync(struct hci_dev *hdev, void *data)
387{
388 struct conn_handle_t *conn_handle = data;
389 struct hci_conn *conn = conn_handle->conn;
390 __u16 handle = conn_handle->handle;
b2af264a
K		 391 struct hci_cp_enhanced_setup_sync_conn cp;
392 const struct sco_param *param;
393
e07a06b4
BG		 394 kfree(conn_handle);
395
b2af264a
K		 396 bt_dev_dbg(hdev, "hcon %p", conn);
397
9798fbde
K		 398 /* for offload use case, codec needs to configured before opening SCO */
399 if (conn->codec.data_path)
e07a06b4 400 configure_datapath_sync(hdev, &conn->codec);
9798fbde 401
b2af264a
K		 402 conn->state = BT_CONNECT;
403 conn->out = true;
404
405 conn->attempt++;
406
407 memset(&cp, 0x00, sizeof(cp));
408
409 cp.handle = cpu_to_le16(handle);
410
411 cp.tx_bandwidth = cpu_to_le32(0x00001f40);
412 cp.rx_bandwidth = cpu_to_le32(0x00001f40);
413
414 switch (conn->codec.id) {
904c139a
K		 415 case BT_CODEC_MSBC:
416 if (!find_next_esco_param(conn, esco_param_msbc,
417 ARRAY_SIZE(esco_param_msbc)))
e07a06b4 418 return -EINVAL;
904c139a
K		 419
420 param = &esco_param_msbc[conn->attempt - 1];
421 cp.tx_coding_format.id = 0x05;
422 cp.rx_coding_format.id = 0x05;
423 cp.tx_codec_frame_size = __cpu_to_le16(60);
424 cp.rx_codec_frame_size = __cpu_to_le16(60);
425 cp.in_bandwidth = __cpu_to_le32(32000);
426 cp.out_bandwidth = __cpu_to_le32(32000);
427 cp.in_coding_format.id = 0x04;
428 cp.out_coding_format.id = 0x04;
429 cp.in_coded_data_size = __cpu_to_le16(16);
430 cp.out_coded_data_size = __cpu_to_le16(16);
431 cp.in_pcm_data_format = 2;
432 cp.out_pcm_data_format = 2;
433 cp.in_pcm_sample_payload_msb_pos = 0;
434 cp.out_pcm_sample_payload_msb_pos = 0;
435 cp.in_data_path = conn->codec.data_path;
436 cp.out_data_path = conn->codec.data_path;
437 cp.in_transport_unit_size = 1;
438 cp.out_transport_unit_size = 1;
439 break;
440
b2af264a
K		 441 case BT_CODEC_TRANSPARENT:
442 if (!find_next_esco_param(conn, esco_param_msbc,
443 ARRAY_SIZE(esco_param_msbc)))
444 return false;
445 param = &esco_param_msbc[conn->attempt - 1];
446 cp.tx_coding_format.id = 0x03;
447 cp.rx_coding_format.id = 0x03;
448 cp.tx_codec_frame_size = __cpu_to_le16(60);
449 cp.rx_codec_frame_size = __cpu_to_le16(60);
450 cp.in_bandwidth = __cpu_to_le32(0x1f40);
451 cp.out_bandwidth = __cpu_to_le32(0x1f40);
452 cp.in_coding_format.id = 0x03;
453 cp.out_coding_format.id = 0x03;
454 cp.in_coded_data_size = __cpu_to_le16(16);
455 cp.out_coded_data_size = __cpu_to_le16(16);
456 cp.in_pcm_data_format = 2;
457 cp.out_pcm_data_format = 2;
458 cp.in_pcm_sample_payload_msb_pos = 0;
459 cp.out_pcm_sample_payload_msb_pos = 0;
460 cp.in_data_path = conn->codec.data_path;
461 cp.out_data_path = conn->codec.data_path;
462 cp.in_transport_unit_size = 1;
463 cp.out_transport_unit_size = 1;
464 break;
465
466 case BT_CODEC_CVSD:
06149746 467 if (conn->parent && lmp_esco_capable(conn->parent)) {
b2af264a
K		 468 if (!find_next_esco_param(conn, esco_param_cvsd,
469 ARRAY_SIZE(esco_param_cvsd)))
e07a06b4 470 return -EINVAL;
b2af264a
K		 471 param = &esco_param_cvsd[conn->attempt - 1];
472 } else {
473 if (conn->attempt > ARRAY_SIZE(sco_param_cvsd))
e07a06b4 474 return -EINVAL;
b2af264a
K		 475 param = &sco_param_cvsd[conn->attempt - 1];
476 }
477 cp.tx_coding_format.id = 2;
478 cp.rx_coding_format.id = 2;
479 cp.tx_codec_frame_size = __cpu_to_le16(60);
480 cp.rx_codec_frame_size = __cpu_to_le16(60);
481 cp.in_bandwidth = __cpu_to_le32(16000);
482 cp.out_bandwidth = __cpu_to_le32(16000);
483 cp.in_coding_format.id = 4;
484 cp.out_coding_format.id = 4;
485 cp.in_coded_data_size = __cpu_to_le16(16);
486 cp.out_coded_data_size = __cpu_to_le16(16);
487 cp.in_pcm_data_format = 2;
488 cp.out_pcm_data_format = 2;
489 cp.in_pcm_sample_payload_msb_pos = 0;
490 cp.out_pcm_sample_payload_msb_pos = 0;
491 cp.in_data_path = conn->codec.data_path;
492 cp.out_data_path = conn->codec.data_path;
493 cp.in_transport_unit_size = 16;
494 cp.out_transport_unit_size = 16;
495 break;
496 default:
e07a06b4 497 return -EINVAL;
b2af264a
K		 498 }
499
500 cp.retrans_effort = param->retrans_effort;
501 cp.pkt_type = __cpu_to_le16(param->pkt_type);
502 cp.max_latency = __cpu_to_le16(param->max_latency);
503
504 if (hci_send_cmd(hdev, HCI_OP_ENHANCED_SETUP_SYNC_CONN, sizeof(cp), &cp) < 0)
e07a06b4 505 return -EIO;
b2af264a 506
e07a06b4 507 return 0;
b2af264a
K		 508}
509
510static bool hci_setup_sync_conn(struct hci_conn *conn, __u16 handle)
b6a0dc82
MH		 511{
512 struct hci_dev *hdev = conn->hdev;
513 struct hci_cp_setup_sync_conn cp;
2dea632f 514 const struct sco_param *param;
b6a0dc82 515
b2af264a 516 bt_dev_dbg(hdev, "hcon %p", conn);
b6a0dc82
MH		 517
518 conn->state = BT_CONNECT;
a0c808b3 519 conn->out = true;
b6a0dc82 520
efc7688b
MH		 521 conn->attempt++;
522
b6a0dc82 523 cp.handle = cpu_to_le16(handle);
b6a0dc82 524
dcf4adbf
JP		 525 cp.tx_bandwidth = cpu_to_le32(0x00001f40);
526 cp.rx_bandwidth = cpu_to_le32(0x00001f40);
10c62ddc
FD		 527 cp.voice_setting = cpu_to_le16(conn->setting);
528
529 switch (conn->setting & SCO_AIRMODE_MASK) {
530 case SCO_AIRMODE_TRANSP:
8b1c324c
YL		 531 if (!find_next_esco_param(conn, esco_param_msbc,
532 ARRAY_SIZE(esco_param_msbc)))
2dea632f 533 return false;
565766b0 534 param = &esco_param_msbc[conn->attempt - 1];
10c62ddc
FD		 535 break;
536 case SCO_AIRMODE_CVSD:
06149746 537 if (conn->parent && lmp_esco_capable(conn->parent)) {
8b1c324c
YL		 538 if (!find_next_esco_param(conn, esco_param_cvsd,
539 ARRAY_SIZE(esco_param_cvsd)))
48e68ff5 540 return false;
48e68ff5
BT		 541 param = &esco_param_cvsd[conn->attempt - 1];
542 } else {
543 if (conn->attempt > ARRAY_SIZE(sco_param_cvsd))
544 return false;
48e68ff5
BT		 545 param = &sco_param_cvsd[conn->attempt - 1];
546 }
10c62ddc 547 break;
2dea632f
FD		 548 default:
549 return false;
10c62ddc 550 }
b6a0dc82 551
c7da5797 552 cp.retrans_effort = param->retrans_effort;
2dea632f
FD		 553 cp.pkt_type = __cpu_to_le16(param->pkt_type);
554 cp.max_latency = __cpu_to_le16(param->max_latency);
555
556 if (hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp) < 0)
557 return false;
558
559 return true;
b6a0dc82
MH		 560}
561
b2af264a
K		 562bool hci_setup_sync(struct hci_conn *conn, __u16 handle)
563{
e07a06b4
BG		 564 int result;
565 struct conn_handle_t *conn_handle;
566
567 if (enhanced_sync_conn_capable(conn->hdev)) {
568 conn_handle = kzalloc(sizeof(*conn_handle), GFP_KERNEL);
569
570 if (!conn_handle)
571 return false;
572
573 conn_handle->conn = conn;
574 conn_handle->handle = handle;
575 result = hci_cmd_sync_queue(conn->hdev, hci_enhanced_setup_sync,
576 conn_handle, NULL);
577 if (result < 0)
578 kfree(conn_handle);
579
580 return result == 0;
581 }
b2af264a
K		 582
583 return hci_setup_sync_conn(conn, handle);
584}
585
7d6ca693
JH		 586u8 hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max, u16 latency,
587 u16 to_multiplier)
2ce603eb 588{
2ce603eb 589 struct hci_dev *hdev = conn->hdev;
f044eb05
MH		 590 struct hci_conn_params *params;
591 struct hci_cp_le_conn_update cp;
2ce603eb 592
f044eb05 593 hci_dev_lock(hdev);
2ce603eb 594
f044eb05
MH		 595 params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
596 if (params) {
597 params->conn_min_interval = min;
598 params->conn_max_interval = max;
599 params->conn_latency = latency;
600 params->supervision_timeout = to_multiplier;
601 }
602
603 hci_dev_unlock(hdev);
604
605 memset(&cp, 0, sizeof(cp));
2ce603eb
CT		 606 cp.handle = cpu_to_le16(conn->handle);
607 cp.conn_interval_min = cpu_to_le16(min);
608 cp.conn_interval_max = cpu_to_le16(max);
609 cp.conn_latency = cpu_to_le16(latency);
610 cp.supervision_timeout = cpu_to_le16(to_multiplier);
dcf4adbf
JP		 611 cp.min_ce_len = cpu_to_le16(0x0000);
612 cp.max_ce_len = cpu_to_le16(0x0000);
2ce603eb
CT		 613
614 hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp);
7d6ca693
JH		 615
616 if (params)
617 return 0x01;
618
619 return 0x00;
2ce603eb 620}
2ce603eb 621
fe39c7b2 622void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __le64 rand,
8b76ce34 623 __u8 ltk[16], __u8 key_size)
a7a595f6
VCG		 624{
625 struct hci_dev *hdev = conn->hdev;
626 struct hci_cp_le_start_enc cp;
627
38b3fef1 628 BT_DBG("hcon %p", conn);
a7a595f6
VCG		 629
630 memset(&cp, 0, sizeof(cp));
631
632 cp.handle = cpu_to_le16(conn->handle);
fe39c7b2 633 cp.rand = rand;
a7a595f6 634 cp.ediv = ediv;
8b76ce34 635 memcpy(cp.ltk, ltk, key_size);
a7a595f6
VCG		 636
637 hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp);
638}
a7a595f6 639
e73439d8
MH		 640/* Device _must_ be locked */
641void hci_sco_setup(struct hci_conn *conn, __u8 status)
642{
06149746 643 struct hci_link *link;
e73439d8 644
06149746
LAD		 645 link = list_first_entry_or_null(&conn->link_list, struct hci_link, list);
646 if (!link || !link->conn)
e73439d8
MH		 647 return;
648
38b3fef1
AE		 649 BT_DBG("hcon %p", conn);
650
e73439d8
MH		 651 if (!status) {
652 if (lmp_esco_capable(conn->hdev))
06149746 653 hci_setup_sync(link->conn, conn->handle);
e73439d8 654 else
06149746 655 hci_add_sco(link->conn, conn->handle);
e73439d8 656 } else {
06149746
LAD		 657 hci_connect_cfm(link->conn, status);
658 hci_conn_del(link->conn);
e73439d8
MH		 659 }
660}
661
19c40e3b 662static void hci_conn_timeout(struct work_struct *work)
1da177e4 663{
19c40e3b 664 struct hci_conn *conn = container_of(work, struct hci_conn,
5974e4c4 665 disc_work.work);
1d56dc4f 666 int refcnt = atomic_read(&conn->refcnt);
1da177e4 667
38b3fef1 668 BT_DBG("hcon %p state %s", conn, state_to_string(conn->state));
1da177e4 669
1d56dc4f
LR		 670 WARN_ON(refcnt < 0);
671
672 /* FIXME: It was observed that in pairing failed scenario, refcnt
673 * drops below 0. Probably this is because l2cap_conn_del calls
674 * l2cap_chan_del for each channel, and inside l2cap_chan_del conn is
675 * dropped. After that loop hci_chan_del is called which also drops
676 * conn. For now make sure that ACL is alive if refcnt is higher then 0,
677 * otherwise drop it.
678 */
679 if (refcnt > 0)
1da177e4
LT		 680 return;
681
89e0ccc8
JH		 682 /* LE connections in scanning state need special handling */
683 if (conn->state == BT_CONNECT && conn->type == LE_LINK &&
684 test_bit(HCI_CONN_SCANNING, &conn->flags)) {
685 hci_connect_le_scan_remove(conn);
686 return;
6ac59344 687 }
89e0ccc8
JH		 688
689 hci_abort_conn(conn, hci_proto_disconn_ind(conn));
1da177e4
LT		 690}
691
416dc94b 692/* Enter sniff mode */
a74a84f6 693static void hci_conn_idle(struct work_struct *work)
416dc94b 694{
a74a84f6
JH		 695 struct hci_conn *conn = container_of(work, struct hci_conn,
696 idle_work.work);
416dc94b
GP		 697 struct hci_dev *hdev = conn->hdev;
698
38b3fef1 699 BT_DBG("hcon %p mode %d", conn, conn->mode);
416dc94b 700
416dc94b
GP		 701 if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn))
702 return;
703
704 if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF))
705 return;
706
707 if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
708 struct hci_cp_sniff_subrate cp;
709 cp.handle = cpu_to_le16(conn->handle);
dcf4adbf
JP		 710 cp.max_latency = cpu_to_le16(0);
711 cp.min_remote_timeout = cpu_to_le16(0);
712 cp.min_local_timeout = cpu_to_le16(0);
416dc94b
GP		 713 hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
714 }
715
51a8efd7 716 if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
416dc94b
GP		 717 struct hci_cp_sniff_mode cp;
718 cp.handle = cpu_to_le16(conn->handle);
719 cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
720 cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
dcf4adbf
JP		 721 cp.attempt = cpu_to_le16(4);
722 cp.timeout = cpu_to_le16(1);
416dc94b
GP		 723 hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
724 }
725}
726
7bc18d9d 727static void hci_conn_auto_accept(struct work_struct *work)
9f61656a 728{
7bc18d9d
JH		 729 struct hci_conn *conn = container_of(work, struct hci_conn,
730 auto_accept_work.work);
9f61656a 731
7bc18d9d 732 hci_send_cmd(conn->hdev, HCI_OP_USER_CONFIRM_REPLY, sizeof(conn->dst),
5974e4c4 733 &conn->dst);
9f61656a
JH		 734}
735
c3bed4de
SN		 736static void le_disable_advertising(struct hci_dev *hdev)
737{
738 if (ext_adv_capable(hdev)) {
739 struct hci_cp_le_set_ext_adv_enable cp;
740
741 cp.enable = 0x00;
742 cp.num_of_sets = 0x00;
743
744 hci_send_cmd(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE, sizeof(cp),
745 &cp);
746 } else {
747 u8 enable = 0x00;
748 hci_send_cmd(hdev, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable),
749 &enable);
750 }
751}
752
9489eca4
JH		 753static void le_conn_timeout(struct work_struct *work)
754{
755 struct hci_conn *conn = container_of(work, struct hci_conn,
756 le_conn_timeout.work);
3c857757 757 struct hci_dev *hdev = conn->hdev;
9489eca4
JH		 758
759 BT_DBG("");
760
3c857757
JH		 761 /* We could end up here due to having done directed advertising,
762 * so clean up the state if necessary. This should however only
763 * happen with broken hardware or if low duty cycle was used
764 * (which doesn't have a timeout of its own).
765 */
0b1db38c 766 if (conn->role == HCI_ROLE_SLAVE) {
c3bed4de
SN		 767 /* Disable LE Advertising */
768 le_disable_advertising(hdev);
9fa6b4cd 769 hci_dev_lock(hdev);
9b3628d7 770 hci_conn_failed(conn, HCI_ERROR_ADVERTISING_TIMEOUT);
9fa6b4cd 771 hci_dev_unlock(hdev);
3c857757
JH		 772 return;
773 }
774
89e0ccc8 775 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
9489eca4
JH		 776}
777
6b9545dc
PV		 778struct iso_cig_params {
779 struct hci_cp_le_set_cig_params cp;
780 struct hci_cis_params cis[0x1f];
781};
782
eca0ae4a
LAD		 783struct iso_list_data {
784 union {
785 u8 cig;
786 u8 big;
787 };
788 union {
789 u8 cis;
790 u8 bis;
791 u16 sync_handle;
792 };
793 int count;
6b9545dc 794 struct iso_cig_params pdu;
a0bfde16 795 bool big_term;
eca0ae4a
LAD		 796};
797
798static void bis_list(struct hci_conn *conn, void *data)
799{
800 struct iso_list_data *d = data;
801
802 /* Skip if not broadcast/ANY address */
803 if (bacmp(&conn->dst, BDADDR_ANY))
804 return;
805
0fe8c8d0
IT		 806 if (d->big != conn->iso_qos.bcast.big || d->bis == BT_ISO_QOS_BIS_UNSET ||
807 d->bis != conn->iso_qos.bcast.bis)
eca0ae4a
LAD		 808 return;
809
810 d->count++;
811}
812
813static void find_bis(struct hci_conn *conn, void *data)
814{
815 struct iso_list_data *d = data;
816
817 /* Ignore unicast */
818 if (bacmp(&conn->dst, BDADDR_ANY))
819 return;
820
821 d->count++;
822}
823
824static int terminate_big_sync(struct hci_dev *hdev, void *data)
825{
826 struct iso_list_data *d = data;
827
828 bt_dev_dbg(hdev, "big 0x%2.2x bis 0x%2.2x", d->big, d->bis);
829
830 hci_remove_ext_adv_instance_sync(hdev, d->bis, NULL);
831
a0bfde16
IT		 832 /* Only terminate BIG if it has been created */
833 if (!d->big_term)
eca0ae4a
LAD		 834 return 0;
835
836 return hci_le_terminate_big_sync(hdev, d->big,
837 HCI_ERROR_LOCAL_HOST_TERM);
838}
839
840static void terminate_big_destroy(struct hci_dev *hdev, void *data, int err)
841{
842 kfree(data);
843}
844
a0bfde16 845static int hci_le_terminate_big(struct hci_dev *hdev, struct hci_conn *conn)
eca0ae4a
LAD		 846{
847 struct iso_list_data *d;
3aa21311 848 int ret;
eca0ae4a 849
a0bfde16
IT		 850 bt_dev_dbg(hdev, "big 0x%2.2x bis 0x%2.2x", conn->iso_qos.bcast.big,
851 conn->iso_qos.bcast.bis);
eca0ae4a 852
3958e877 853 d = kzalloc(sizeof(*d), GFP_KERNEL);
eca0ae4a
LAD		 854 if (!d)
855 return -ENOMEM;
856
a0bfde16
IT		 857 d->big = conn->iso_qos.bcast.big;
858 d->bis = conn->iso_qos.bcast.bis;
859 d->big_term = test_and_clear_bit(HCI_CONN_BIG_CREATED, &conn->flags);
eca0ae4a 860
3aa21311
ZS		 861 ret = hci_cmd_sync_queue(hdev, terminate_big_sync, d,
862 terminate_big_destroy);
863 if (ret)
864 kfree(d);
865
866 return ret;
eca0ae4a
LAD		 867}
868
869static int big_terminate_sync(struct hci_dev *hdev, void *data)
870{
871 struct iso_list_data *d = data;
872
873 bt_dev_dbg(hdev, "big 0x%2.2x sync_handle 0x%4.4x", d->big,
874 d->sync_handle);
875
876 /* Check if ISO connection is a BIS and terminate BIG if there are
877 * no other connections using it.
878 */
879 hci_conn_hash_list_state(hdev, find_bis, ISO_LINK, BT_CONNECTED, d);
880 if (d->count)
881 return 0;
882
883 hci_le_big_terminate_sync(hdev, d->big);
884
885 return hci_le_pa_terminate_sync(hdev, d->sync_handle);
886}
887
888static int hci_le_big_terminate(struct hci_dev *hdev, u8 big, u16 sync_handle)
889{
890 struct iso_list_data *d;
3aa21311 891 int ret;
eca0ae4a
LAD		 892
893 bt_dev_dbg(hdev, "big 0x%2.2x sync_handle 0x%4.4x", big, sync_handle);
894
3958e877 895 d = kzalloc(sizeof(*d), GFP_KERNEL);
eca0ae4a
LAD		 896 if (!d)
897 return -ENOMEM;
898
eca0ae4a
LAD		 899 d->big = big;
900 d->sync_handle = sync_handle;
901
3aa21311
ZS		 902 ret = hci_cmd_sync_queue(hdev, big_terminate_sync, d,
903 terminate_big_destroy);
904 if (ret)
905 kfree(d);
906
907 return ret;
eca0ae4a
LAD		 908}
909
910/* Cleanup BIS connection
911 *
912 * Detects if there any BIS left connected in a BIG
913 * broadcaster: Remove advertising instance and terminate BIG.
914 * broadcaster receiver: Teminate BIG sync and terminate PA sync.
915 */
916static void bis_cleanup(struct hci_conn *conn)
917{
918 struct hci_dev *hdev = conn->hdev;
a0bfde16 919 struct hci_conn *bis;
eca0ae4a
LAD		 920
921 bt_dev_dbg(hdev, "conn %p", conn);
922
923 if (conn->role == HCI_ROLE_MASTER) {
924 if (!test_and_clear_bit(HCI_CONN_PER_ADV, &conn->flags))
925 return;
926
a0bfde16
IT		 927 /* Check if ISO connection is a BIS and terminate advertising
928 * set and BIG if there are no other connections using it.
929 */
930 bis = hci_conn_hash_lookup_bis(hdev, BDADDR_ANY,
931 conn->iso_qos.bcast.big,
932 conn->iso_qos.bcast.bis);
933 if (bis)
934 return;
935
936 hci_le_terminate_big(hdev, conn);
eca0ae4a 937 } else {
0fe8c8d0 938 hci_le_big_terminate(hdev, conn->iso_qos.bcast.big,
eca0ae4a
LAD		 939 conn->sync_handle);
940 }
941}
942
943static int remove_cig_sync(struct hci_dev *hdev, void *data)
944{
945 u8 handle = PTR_ERR(data);
946
947 return hci_le_remove_cig_sync(hdev, handle);
948}
949
950static int hci_le_remove_cig(struct hci_dev *hdev, u8 handle)
951{
952 bt_dev_dbg(hdev, "handle 0x%2.2x", handle);
953
954 return hci_cmd_sync_queue(hdev, remove_cig_sync, ERR_PTR(handle), NULL);
955}
956
957static void find_cis(struct hci_conn *conn, void *data)
958{
959 struct iso_list_data *d = data;
960
31c5f916
PV		 961 /* Ignore broadcast or if CIG don't match */
962 if (!bacmp(&conn->dst, BDADDR_ANY) || d->cig != conn->iso_qos.ucast.cig)
eca0ae4a
LAD		 963 return;
964
965 d->count++;
966}
967
968/* Cleanup CIS connection:
969 *
970 * Detects if there any CIS left connected in a CIG and remove it.
971 */
972static void cis_cleanup(struct hci_conn *conn)
973{
974 struct hci_dev *hdev = conn->hdev;
975 struct iso_list_data d;
976
31c5f916
PV		 977 if (conn->iso_qos.ucast.cig == BT_ISO_QOS_CIG_UNSET)
978 return;
979
eca0ae4a 980 memset(&d, 0, sizeof(d));
0fe8c8d0 981 d.cig = conn->iso_qos.ucast.cig;
eca0ae4a
LAD		 982
983 /* Check if ISO connection is a CIS and remove CIG if there are
984 * no other connections using it.
985 */
6c242c64
PV		 986 hci_conn_hash_list_state(hdev, find_cis, ISO_LINK, BT_BOUND, &d);
987 hci_conn_hash_list_state(hdev, find_cis, ISO_LINK, BT_CONNECT, &d);
eca0ae4a
LAD		 988 hci_conn_hash_list_state(hdev, find_cis, ISO_LINK, BT_CONNECTED, &d);
989 if (d.count)
990 return;
991
0fe8c8d0 992 hci_le_remove_cig(hdev, conn->iso_qos.ucast.cig);
eca0ae4a
LAD		 993}
994
a5c4e309
JH		 995struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst,
996 u8 role)
1da177e4
LT		 997{
998 struct hci_conn *conn;
999
6ed93dc6 1000 BT_DBG("%s dst %pMR", hdev->name, dst);
1da177e4 1001
27f70f3e 1002 conn = kzalloc(sizeof(*conn), GFP_KERNEL);
04837f64 1003 if (!conn)
1da177e4 1004 return NULL;
1da177e4
LT		 1005
1006 bacpy(&conn->dst, dst);
662e8820 1007 bacpy(&conn->src, &hdev->bdaddr);
d5ebaa7c 1008 conn->handle = HCI_CONN_HANDLE_UNSET;
a8746417
MH		 1009 conn->hdev = hdev;
1010 conn->type = type;
a5c4e309 1011 conn->role = role;
a8746417
MH		 1012 conn->mode = HCI_CM_ACTIVE;
1013 conn->state = BT_OPEN;
93f19c9f 1014 conn->auth_type = HCI_AT_GENERAL_BONDING;
17fa4b9d 1015 conn->io_capability = hdev->io_capability;
a9583556 1016 conn->remote_auth = 0xff;
13d39315 1017 conn->key_type = 0xff;
ebf86aa3 1018 conn->rssi = HCI_RSSI_INVALID;
5a134fae 1019 conn->tx_power = HCI_TX_POWER_INVALID;
d0455ed9 1020 conn->max_tx_power = HCI_TX_POWER_INVALID;
1da177e4 1021
58a681ef 1022 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
052b30b0 1023 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
04837f64 1024
302975cb
SRK		 1025 /* Set Default Authenticated payload timeout to 30s */
1026 conn->auth_payload_timeout = DEFAULT_AUTH_PAYLOAD_TIMEOUT;
1027
a5c4e309
JH		 1028 if (conn->role == HCI_ROLE_MASTER)
1029 conn->out = true;
1030
a8746417
MH		 1031 switch (type) {
1032 case ACL_LINK:
1033 conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
1034 break;
9c84d1da 1035 case LE_LINK:
eca0ae4a
LAD		 1036 /* conn->src should reflect the local identity address */
1037 hci_copy_identity_address(hdev, &conn->src, &conn->src_type);
1038 break;
26afbd82 1039 case ISO_LINK:
9c84d1da
JH		 1040 /* conn->src should reflect the local identity address */
1041 hci_copy_identity_address(hdev, &conn->src, &conn->src_type);
eca0ae4a
LAD		 1042
1043 /* set proper cleanup function */
1044 if (!bacmp(dst, BDADDR_ANY))
1045 conn->cleanup = bis_cleanup;
1046 else if (conn->role == HCI_ROLE_MASTER)
1047 conn->cleanup = cis_cleanup;
1048
9c84d1da 1049 break;
a8746417
MH		 1050 case SCO_LINK:
1051 if (lmp_esco_capable(hdev))
efc7688b
MH		 1052 conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
1053 (hdev->esco_type & EDR_ESCO_MASK);
a8746417
MH		 1054 else
1055 conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
1056 break;
1057 case ESCO_LINK:
efc7688b 1058 conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
a8746417
MH		 1059 break;
1060 }
1061
1da177e4 1062 skb_queue_head_init(&conn->data_q);
04837f64 1063
70c1f20b 1064 INIT_LIST_HEAD(&conn->chan_list);
06149746 1065 INIT_LIST_HEAD(&conn->link_list);
73d80deb 1066
19c40e3b 1067 INIT_DELAYED_WORK(&conn->disc_work, hci_conn_timeout);
7bc18d9d 1068 INIT_DELAYED_WORK(&conn->auto_accept_work, hci_conn_auto_accept);
a74a84f6 1069 INIT_DELAYED_WORK(&conn->idle_work, hci_conn_idle);
9489eca4 1070 INIT_DELAYED_WORK(&conn->le_conn_timeout, le_conn_timeout);
8ce783dc 1071 INIT_WORK(&conn->le_scan_cleanup, le_scan_cleanup);
1da177e4
LT		 1072
1073 atomic_set(&conn->refcnt, 0);
1074
1075 hci_dev_hold(hdev);
1076
1da177e4 1077 hci_conn_hash_add(hdev, conn);
1f8330ea
SN		 1078
1079 /* The SCO and eSCO connections will only be notified when their
1080 * setup has been completed. This is different to ACL links which
1081 * can be notified right away.
1082 */
1083 if (conn->type != SCO_LINK && conn->type != ESCO_LINK) {
1084 if (hdev->notify)
1085 hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
1086 }
1da177e4 1087
a67e899c
MH		 1088 hci_conn_init_sysfs(conn);
1089
1da177e4
LT		 1090 return conn;
1091}
1092
06149746 1093static void hci_conn_unlink(struct hci_conn *conn)
5dc7d23e 1094{
06149746
LAD		 1095 struct hci_dev *hdev = conn->hdev;
1096
1097 bt_dev_dbg(hdev, "hcon %p", conn);
1098
1099 if (!conn->parent) {
1100 struct hci_link *link, *t;
1101
ca1fd42e
RL		 1102 list_for_each_entry_safe(link, t, &conn->link_list, list) {
1103 struct hci_conn *child = link->conn;
1104
1105 hci_conn_unlink(child);
1106
a2ac591c
RL		 1107 /* If hdev is down it means
1108 * hci_dev_close_sync/hci_conn_hash_flush is in progress
1109 * and links don't need to be cleanup as all connections
1110 * would be cleanup.
1111 */
1112 if (!test_bit(HCI_UP, &hdev->flags))
1113 continue;
1114
ca1fd42e
RL		 1115 /* Due to race, SCO connection might be not established
1116 * yet at this point. Delete it now, otherwise it is
1117 * possible for it to be stuck and can't be deleted.
1118 */
a2904d28
RL		 1119 if ((child->type == SCO_LINK ||
1120 child->type == ESCO_LINK) &&
1121 child->handle == HCI_CONN_HANDLE_UNSET)
ca1fd42e
RL		 1122 hci_conn_del(child);
1123 }
06149746
LAD		 1124
1125 return;
1126 }
1127
5dc7d23e 1128 if (!conn->link)
06149746 1129 return;
5dc7d23e 1130
06149746
LAD		 1131 list_del_rcu(&conn->link->list);
1132 synchronize_rcu();
1133
a2904d28 1134 hci_conn_drop(conn->parent);
2910431a
RL		 1135 hci_conn_put(conn->parent);
1136 conn->parent = NULL;
1137
06149746 1138 kfree(conn->link);
5dc7d23e 1139 conn->link = NULL;
5dc7d23e
LAD		 1140}
1141
a2ac591c 1142void hci_conn_del(struct hci_conn *conn)
1da177e4
LT		 1143{
1144 struct hci_dev *hdev = conn->hdev;
1145
38b3fef1 1146 BT_DBG("%s hcon %p handle %d", hdev->name, conn, conn->handle);
1da177e4 1147
a2904d28
RL		 1148 hci_conn_unlink(conn);
1149
19c40e3b 1150 cancel_delayed_work_sync(&conn->disc_work);
7bc18d9d 1151 cancel_delayed_work_sync(&conn->auto_accept_work);
a74a84f6 1152 cancel_delayed_work_sync(&conn->idle_work);
9f61656a 1153
5b7f9909 1154 if (conn->type == ACL_LINK) {
1da177e4
LT		 1155 /* Unacked frames */
1156 hdev->acl_cnt += conn->sent;
6ed58ec5 1157 } else if (conn->type == LE_LINK) {
980ffc0a 1158 cancel_delayed_work(&conn->le_conn_timeout);
9489eca4 1159
6ed58ec5
VT		 1160 if (hdev->le_pkts)
1161 hdev->le_cnt += conn->sent;
1162 else
1163 hdev->acl_cnt += conn->sent;
5b7f9909 1164 } else {
5638d9ea
LAD		 1165 /* Unacked ISO frames */
1166 if (conn->type == ISO_LINK) {
1167 if (hdev->iso_pkts)
1168 hdev->iso_cnt += conn->sent;
1169 else if (hdev->le_pkts)
1170 hdev->le_cnt += conn->sent;
1171 else
1172 hdev->acl_cnt += conn->sent;
1173 }
1da177e4
LT		 1174 }
1175
9740e49d
AE		 1176 if (conn->amp_mgr)
1177 amp_mgr_put(conn->amp_mgr);
1178
1da177e4 1179 skb_queue_purge(&conn->data_q);
1da177e4 1180
b958f9a3
JH		 1181 /* Remove the connection from the list and cleanup its remaining
1182 * state. This is a separate function since for some cases like
1183 * BT_CONNECT_SCAN we *only* want the cleanup part without the
1184 * rest of hci_conn_del.
1185 */
1186 hci_conn_cleanup(conn);
1da177e4
LT		 1187}
1188
39385cb5 1189struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src, uint8_t src_type)
1da177e4
LT		 1190{
1191 int use_src = bacmp(src, BDADDR_ANY);
8035ded4 1192 struct hci_dev *hdev = NULL, *d;
1da177e4 1193
6ed93dc6 1194 BT_DBG("%pMR -> %pMR", src, dst);
1da177e4 1195
f20d09d5 1196 read_lock(&hci_dev_list_lock);
1da177e4 1197
8035ded4 1198 list_for_each_entry(d, &hci_dev_list, list) {
8fc9ced3 1199 if (!test_bit(HCI_UP, &d->flags) ||
d7a5a11d 1200 hci_dev_test_flag(d, HCI_USER_CHANNEL) ||
ca8bee5d 1201 d->dev_type != HCI_PRIMARY)
1da177e4
LT		 1202 continue;
1203
8e87d142 1204 /* Simple routing:
1da177e4
LT		 1205 * No source address - find interface with bdaddr != dst
1206 * Source address - find interface with bdaddr == src
1207 */
1208
1209 if (use_src) {
39385cb5
JH		 1210 bdaddr_t id_addr;
1211 u8 id_addr_type;
1212
1213 if (src_type == BDADDR_BREDR) {
1214 if (!lmp_bredr_capable(d))
1215 continue;
1216 bacpy(&id_addr, &d->bdaddr);
1217 id_addr_type = BDADDR_BREDR;
1218 } else {
1219 if (!lmp_le_capable(d))
1220 continue;
1221
1222 hci_copy_identity_address(d, &id_addr,
1223 &id_addr_type);
1224
1225 /* Convert from HCI to three-value type */
1226 if (id_addr_type == ADDR_LE_DEV_PUBLIC)
1227 id_addr_type = BDADDR_LE_PUBLIC;
1228 else
1229 id_addr_type = BDADDR_LE_RANDOM;
1230 }
1231
1232 if (!bacmp(&id_addr, src) && id_addr_type == src_type) {
1da177e4
LT		 1233 hdev = d; break;
1234 }
1235 } else {
1236 if (bacmp(&d->bdaddr, dst)) {
1237 hdev = d; break;
1238 }
1239 }
1240 }
1241
1242 if (hdev)
1243 hdev = hci_dev_hold(hdev);
1244
f20d09d5 1245 read_unlock(&hci_dev_list_lock);
1da177e4
LT		 1246 return hdev;
1247}
1248EXPORT_SYMBOL(hci_get_route);
1249
9bb3c01f 1250/* This function requires the caller holds hdev->lock */
9b3628d7 1251static void hci_le_conn_failed(struct hci_conn *conn, u8 status)
9bb3c01f
AG		 1252{
1253 struct hci_dev *hdev = conn->hdev;
f161dd41 1254
19cf60bf 1255 hci_connect_le_scan_cleanup(conn, status);
3c857757 1256
abfeea47 1257 /* Enable advertising in case this was a failed connection
3c857757
JH		 1258 * attempt as a peripheral.
1259 */
abfeea47 1260 hci_enable_advertising(hdev);
9bb3c01f
AG		 1261}
1262
9b3628d7
LAD		 1263/* This function requires the caller holds hdev->lock */
1264void hci_conn_failed(struct hci_conn *conn, u8 status)
1265{
1266 struct hci_dev *hdev = conn->hdev;
1267
1268 bt_dev_dbg(hdev, "status 0x%2.2x", status);
1269
1270 switch (conn->type) {
1271 case LE_LINK:
1272 hci_le_conn_failed(conn, status);
1273 break;
1274 case ACL_LINK:
1275 mgmt_connect_failed(hdev, &conn->dst, conn->type,
1276 conn->dst_type, status);
1277 break;
1278 }
1279
1280 conn->state = BT_CLOSED;
1281 hci_connect_cfm(conn, status);
1282 hci_conn_del(conn);
1283}
1284
8e8b92ee 1285static void create_le_conn_complete(struct hci_dev *hdev, void *data, int err)
1d399ae5 1286{
8e8b92ee 1287 struct hci_conn *conn = data;
1d399ae5 1288
b62e7220
LAD		 1289 bt_dev_dbg(hdev, "err %d", err);
1290
28a667c9
JP		 1291 hci_dev_lock(hdev);
1292
8e8b92ee 1293 if (!err) {
19cf60bf 1294 hci_connect_le_scan_cleanup(conn, 0x00);
28a667c9
JP		 1295 goto done;
1296 }
1d399ae5 1297
c9f73a21
LAD		 1298 /* Check if connection is still pending */
1299 if (conn != hci_lookup_le_connect(hdev))
1d399ae5
AG		 1300 goto done;
1301
5cd39700
AP		 1302 /* Flush to make sure we send create conn cancel command if needed */
1303 flush_delayed_work(&conn->le_conn_timeout);
a86ddbff 1304 hci_conn_failed(conn, bt_status(err));
1d399ae5
AG		 1305
1306done:
1307 hci_dev_unlock(hdev);
1308}
1309
8e8b92ee 1310static int hci_connect_le_sync(struct hci_dev *hdev, void *data)
3c857757 1311{
8e8b92ee 1312 struct hci_conn *conn = data;
075e40b7 1313
8e8b92ee 1314 bt_dev_dbg(hdev, "conn %p", conn);
3c857757 1315
8e8b92ee 1316 return hci_le_create_conn_sync(hdev, conn);
3c857757
JH		 1317}
1318
04a6c589 1319struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,
d850bf08 1320 u8 dst_type, bool dst_resolved, u8 sec_level,
8e8b92ee 1321 u16 conn_timeout, u8 role)
1da177e4 1322{
e2caced4 1323 struct hci_conn *conn;
1ebfcc1f 1324 struct smp_irk *irk;
1d399ae5 1325 int err;
1da177e4 1326
152d386e 1327 /* Let's make sure that le is enabled.*/
d7a5a11d 1328 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
152d386e
LR		 1329 if (lmp_le_capable(hdev))
1330 return ERR_PTR(-ECONNREFUSED);
1331
1332 return ERR_PTR(-EOPNOTSUPP);
1333 }
1334
658aead9
JH		 1335 /* Since the controller supports only one LE connection attempt at a
1336 * time, we return -EBUSY if there is any connection attempt running.
1337 */
1338 if (hci_lookup_le_connect(hdev))
1339 return ERR_PTR(-EBUSY);
1340
e2caced4
JH		 1341 /* If there's already a connection object but it's not in
1342 * scanning state it means it must already be established, in
1343 * which case we can't do anything else except report a failure
1344 * to connect.
620ad521 1345 */
9d4c1cc1 1346 conn = hci_conn_hash_lookup_le(hdev, dst, dst_type);
e2caced4
JH		 1347 if (conn && !test_bit(HCI_CONN_SCANNING, &conn->flags)) {
1348 return ERR_PTR(-EBUSY);
620ad521 1349 }
dfc94dbd 1350
d850bf08
LAD		 1351 /* Check if the destination address has been resolved by the controller
1352 * since if it did then the identity address shall be used.
edb4b466 1353 */
d850bf08
LAD		 1354 if (!dst_resolved) {
1355 /* When given an identity address with existing identity
1356 * resolving key, the connection needs to be established
1357 * to a resolvable random address.
1358 *
1359 * Storing the resolvable random address is required here
1360 * to handle connection failures. The address will later
1361 * be resolved back into the original identity address
1362 * from the connect request.
1363 */
1364 irk = hci_find_irk_by_addr(hdev, dst, dst_type);
1365 if (irk && bacmp(&irk->rpa, BDADDR_ANY)) {
1366 dst = &irk->rpa;
1367 dst_type = ADDR_LE_DEV_RANDOM;
1368 }
1ebfcc1f
JH		 1369 }
1370
e2caced4 1371 if (conn) {
28a667c9
JP		 1372 bacpy(&conn->dst, dst);
1373 } else {
1374 conn = hci_conn_add(hdev, LE_LINK, dst, role);
e2caced4
JH		 1375 if (!conn)
1376 return ERR_PTR(-ENOMEM);
1377 hci_conn_hold(conn);
1378 conn->pending_sec_level = sec_level;
28a667c9
JP		 1379 }
1380
1ebfcc1f 1381 conn->dst_type = dst_type;
620ad521 1382 conn->sec_level = BT_SECURITY_LOW;
09ae260b 1383 conn->conn_timeout = conn_timeout;
4292f1f3 1384
8e8b92ee
LAD		 1385 conn->state = BT_CONNECT;
1386 clear_bit(HCI_CONN_SCANNING, &conn->flags);
81ad6fd9 1387
8e8b92ee
LAD		 1388 err = hci_cmd_sync_queue(hdev, hci_connect_le_sync, conn,
1389 create_le_conn_complete);
2acf3d90
AG		 1390 if (err) {
1391 hci_conn_del(conn);
620ad521 1392 return ERR_PTR(err);
2acf3d90 1393 }
fcd89c09 1394
f1e5d547 1395 return conn;
d04aef4c 1396}
fcd89c09 1397
f75113a2
JP		 1398static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
1399{
1400 struct hci_conn *conn;
1401
9d4c1cc1 1402 conn = hci_conn_hash_lookup_le(hdev, addr, type);
f75113a2
JP		 1403 if (!conn)
1404 return false;
1405
f75113a2
JP		 1406 if (conn->state != BT_CONNECTED)
1407 return false;
1408
1409 return true;
1410}
1411
1412/* This function requires the caller holds hdev->lock */
84235d22 1413static int hci_explicit_conn_params_set(struct hci_dev *hdev,
f75113a2
JP		 1414 bdaddr_t *addr, u8 addr_type)
1415{
f75113a2
JP		 1416 struct hci_conn_params *params;
1417
1418 if (is_connected(hdev, addr, addr_type))
1419 return -EISCONN;
1420
5157b8a5
JP		 1421 params = hci_conn_params_lookup(hdev, addr, addr_type);
1422 if (!params) {
1423 params = hci_conn_params_add(hdev, addr, addr_type);
1424 if (!params)
1425 return -ENOMEM;
1426
1427 /* If we created new params, mark them to be deleted in
1428 * hci_connect_le_scan_cleanup. It's different case than
1429 * existing disabled params, those will stay after cleanup.
1430 */
1431 params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
1432 }
f75113a2 1433
5157b8a5 1434 /* We're trying to connect, so make sure params are at pend_le_conns */
49c50922 1435 if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
5157b8a5
JP		 1436 params->auto_connect == HCI_AUTO_CONN_REPORT ||
1437 params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
195ef75e
PV		 1438 hci_pend_le_list_del_init(params);
1439 hci_pend_le_list_add(params, &hdev->pend_le_conns);
f75113a2
JP		 1440 }
1441
1442 params->explicit_connect = true;
f75113a2
JP		 1443
1444 BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
1445 params->auto_connect);
1446
1447 return 0;
1448}
1449
eca0ae4a
LAD		 1450static int qos_set_big(struct hci_dev *hdev, struct bt_iso_qos *qos)
1451{
1452 struct iso_list_data data;
1453
1454 /* Allocate a BIG if not set */
0fe8c8d0 1455 if (qos->bcast.big == BT_ISO_QOS_BIG_UNSET) {
eca0ae4a
LAD		 1456 for (data.big = 0x00; data.big < 0xef; data.big++) {
1457 data.count = 0;
1458 data.bis = 0xff;
1459
1460 hci_conn_hash_list_state(hdev, bis_list, ISO_LINK,
1461 BT_BOUND, &data);
1462 if (!data.count)
1463 break;
1464 }
1465
1466 if (data.big == 0xef)
1467 return -EADDRNOTAVAIL;
1468
1469 /* Update BIG */
0fe8c8d0 1470 qos->bcast.big = data.big;
eca0ae4a
LAD		 1471 }
1472
1473 return 0;
1474}
1475
1476static int qos_set_bis(struct hci_dev *hdev, struct bt_iso_qos *qos)
1477{
1478 struct iso_list_data data;
1479
1480 /* Allocate BIS if not set */
0fe8c8d0 1481 if (qos->bcast.bis == BT_ISO_QOS_BIS_UNSET) {
eca0ae4a
LAD		 1482 /* Find an unused adv set to advertise BIS, skip instance 0x00
1483 * since it is reserved as general purpose set.
1484 */
1485 for (data.bis = 0x01; data.bis < hdev->le_num_of_adv_sets;
1486 data.bis++) {
1487 data.count = 0;
1488
1489 hci_conn_hash_list_state(hdev, bis_list, ISO_LINK,
1490 BT_BOUND, &data);
1491 if (!data.count)
1492 break;
1493 }
1494
1495 if (data.bis == hdev->le_num_of_adv_sets)
1496 return -EADDRNOTAVAIL;
1497
1498 /* Update BIS */
0fe8c8d0 1499 qos->bcast.bis = data.bis;
eca0ae4a
LAD		 1500 }
1501
1502 return 0;
1503}
1504
1505/* This function requires the caller holds hdev->lock */
1506static struct hci_conn *hci_add_bis(struct hci_dev *hdev, bdaddr_t *dst,
a0bfde16
IT		 1507 struct bt_iso_qos *qos, __u8 base_len,
1508 __u8 *base)
eca0ae4a
LAD		 1509{
1510 struct hci_conn *conn;
eca0ae4a
LAD		 1511 int err;
1512
1513 /* Let's make sure that le is enabled.*/
1514 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1515 if (lmp_le_capable(hdev))
1516 return ERR_PTR(-ECONNREFUSED);
1517 return ERR_PTR(-EOPNOTSUPP);
1518 }
1519
1520 err = qos_set_big(hdev, qos);
1521 if (err)
1522 return ERR_PTR(err);
1523
1524 err = qos_set_bis(hdev, qos);
1525 if (err)
1526 return ERR_PTR(err);
1527
a0bfde16
IT		 1528 /* Check if the LE Create BIG command has already been sent */
1529 conn = hci_conn_hash_lookup_per_adv_bis(hdev, dst, qos->bcast.big,
1530 qos->bcast.big);
1531 if (conn)
eca0ae4a
LAD		 1532 return ERR_PTR(-EADDRINUSE);
1533
a0bfde16
IT		 1534 /* Check BIS settings against other bound BISes, since all
1535 * BISes in a BIG must have the same value for all parameters
1536 */
1537 conn = hci_conn_hash_lookup_bis(hdev, dst, qos->bcast.big,
1538 qos->bcast.bis);
1539
1540 if (conn && (memcmp(qos, &conn->iso_qos, sizeof(*qos)) ||
1541 base_len != conn->le_per_adv_data_len ||
1542 memcmp(conn->le_per_adv_data, base, base_len)))
eca0ae4a
LAD		 1543 return ERR_PTR(-EADDRINUSE);
1544
1545 conn = hci_conn_add(hdev, ISO_LINK, dst, HCI_ROLE_MASTER);
1546 if (!conn)
1547 return ERR_PTR(-ENOMEM);
1548
eca0ae4a
LAD		 1549 conn->state = BT_CONNECT;
1550
1551 hci_conn_hold(conn);
1552 return conn;
1553}
1554
f75113a2
JP		 1555/* This function requires the caller holds hdev->lock */
1556struct hci_conn *hci_connect_le_scan(struct hci_dev *hdev, bdaddr_t *dst,
1557 u8 dst_type, u8 sec_level,
76b13996
MM		 1558 u16 conn_timeout,
1559 enum conn_reasons conn_reason)
f75113a2
JP		 1560{
1561 struct hci_conn *conn;
f75113a2
JP		 1562
1563 /* Let's make sure that le is enabled.*/
1564 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1565 if (lmp_le_capable(hdev))
1566 return ERR_PTR(-ECONNREFUSED);
1567
1568 return ERR_PTR(-EOPNOTSUPP);
1569 }
1570
1571 /* Some devices send ATT messages as soon as the physical link is
1572 * established. To be able to handle these ATT messages, the user-
1573 * space first establishes the connection and then starts the pairing
1574 * process.
1575 *
1576 * So if a hci_conn object already exists for the following connection
1577 * attempt, we simply update pending_sec_level and auth_type fields
1578 * and return the object found.
1579 */
9d4c1cc1 1580 conn = hci_conn_hash_lookup_le(hdev, dst, dst_type);
f75113a2
JP		 1581 if (conn) {
1582 if (conn->pending_sec_level < sec_level)
1583 conn->pending_sec_level = sec_level;
1584 goto done;
1585 }
1586
1587 BT_DBG("requesting refresh of dst_addr");
1588
0ad06aa6 1589 conn = hci_conn_add(hdev, LE_LINK, dst, HCI_ROLE_MASTER);
f75113a2
JP		 1590 if (!conn)
1591 return ERR_PTR(-ENOMEM);
1592
d088337c
NE		 1593 if (hci_explicit_conn_params_set(hdev, dst, dst_type) < 0) {
1594 hci_conn_del(conn);
f75113a2 1595 return ERR_PTR(-EBUSY);
d088337c 1596 }
f75113a2
JP		 1597
1598 conn->state = BT_CONNECT;
1599 set_bit(HCI_CONN_SCANNING, &conn->flags);
f75113a2
JP		 1600 conn->dst_type = dst_type;
1601 conn->sec_level = BT_SECURITY_LOW;
1602 conn->pending_sec_level = sec_level;
1603 conn->conn_timeout = conn_timeout;
76b13996 1604 conn->conn_reason = conn_reason;
f75113a2 1605
5bee2fd6 1606 hci_update_passive_scan(hdev);
84235d22 1607
f75113a2
JP		 1608done:
1609 hci_conn_hold(conn);
1610 return conn;
1611}
1612
04a6c589 1613struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst,
76b13996
MM		 1614 u8 sec_level, u8 auth_type,
1615 enum conn_reasons conn_reason)
1da177e4
LT		 1616{
1617 struct hci_conn *acl;
fcd89c09 1618
d7a5a11d 1619 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
c411110e
LR		 1620 if (lmp_bredr_capable(hdev))
1621 return ERR_PTR(-ECONNREFUSED);
1622
beb19e4c 1623 return ERR_PTR(-EOPNOTSUPP);
c411110e 1624 }
56f87901 1625
70f23020
AE		 1626 acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
1627 if (!acl) {
a5c4e309 1628 acl = hci_conn_add(hdev, ACL_LINK, dst, HCI_ROLE_MASTER);
70f23020 1629 if (!acl)
48c7aba9 1630 return ERR_PTR(-ENOMEM);
1da177e4
LT		 1631 }
1632
1633 hci_conn_hold(acl);
1634
76b13996 1635 acl->conn_reason = conn_reason;
09ab6f4c 1636 if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
765c2a96
JH		 1637 acl->sec_level = BT_SECURITY_LOW;
1638 acl->pending_sec_level = sec_level;
09ab6f4c 1639 acl->auth_type = auth_type;
1aef8669 1640 hci_acl_create_connection(acl);
09ab6f4c 1641 }
1da177e4 1642
db474275
VCG		 1643 return acl;
1644}
1645
06149746
LAD		 1646static struct hci_link *hci_conn_link(struct hci_conn *parent,
1647 struct hci_conn *conn)
1648{
1649 struct hci_dev *hdev = parent->hdev;
1650 struct hci_link *link;
1651
1652 bt_dev_dbg(hdev, "parent %p hcon %p", parent, conn);
1653
1654 if (conn->link)
1655 return conn->link;
1656
1657 if (conn->parent)
1658 return NULL;
1659
1660 link = kzalloc(sizeof(*link), GFP_KERNEL);
1661 if (!link)
1662 return NULL;
1663
1664 link->conn = hci_conn_hold(conn);
1665 conn->link = link;
1666 conn->parent = hci_conn_get(parent);
1667
1668 /* Use list_add_tail_rcu append to the list */
1669 list_add_tail_rcu(&link->list, &parent->link_list);
1670
1671 return link;
1672}
1673
10c62ddc 1674struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type, bdaddr_t *dst,
b2af264a 1675 __u16 setting, struct bt_codec *codec)
db474275
VCG		 1676{
1677 struct hci_conn *acl;
1678 struct hci_conn *sco;
06149746 1679 struct hci_link *link;
db474275 1680
76b13996
MM		 1681 acl = hci_connect_acl(hdev, dst, BT_SECURITY_LOW, HCI_AT_NO_BONDING,
1682 CONN_REASON_SCO_CONNECT);
db474275 1683 if (IS_ERR(acl))
5b7f9909 1684 return acl;
1da177e4 1685
70f23020
AE		 1686 sco = hci_conn_hash_lookup_ba(hdev, type, dst);
1687 if (!sco) {
a5c4e309 1688 sco = hci_conn_add(hdev, type, dst, HCI_ROLE_MASTER);
70f23020 1689 if (!sco) {
76a68ba0 1690 hci_conn_drop(acl);
48c7aba9 1691 return ERR_PTR(-ENOMEM);
1da177e4 1692 }
5b7f9909 1693 }
1da177e4 1694
06149746
LAD		 1695 link = hci_conn_link(acl, sco);
1696 if (!link) {
1697 hci_conn_drop(acl);
1698 hci_conn_drop(sco);
b4066eb0 1699 return ERR_PTR(-ENOLINK);
06149746 1700 }
1da177e4 1701
10c62ddc 1702 sco->setting = setting;
b2af264a 1703 sco->codec = *codec;
10c62ddc 1704
5b7f9909 1705 if (acl->state == BT_CONNECTED &&
5974e4c4 1706 (sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
58a681ef 1707 set_bit(HCI_CONN_POWER_SAVE, &acl->flags);
14b12d0b 1708 hci_conn_enter_active_mode(acl, BT_POWER_FORCE_ACTIVE_ON);
c390216b 1709
51a8efd7 1710 if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->flags)) {
e73439d8 1711 /* defer SCO setup until mode change completed */
51a8efd7 1712 set_bit(HCI_CONN_SCO_SETUP_PEND, &acl->flags);
e73439d8
MH		 1713 return sco;
1714 }
1715
1716 hci_sco_setup(acl, 0x00);
b6a0dc82 1717 }
5b7f9909
MH		 1718
1719 return sco;
1da177e4 1720}
1da177e4 1721
26afbd82
LAD		 1722static void cis_add(struct iso_list_data *d, struct bt_iso_qos *qos)
1723{
1724 struct hci_cis_params *cis = &d->pdu.cis[d->pdu.cp.num_cis];
1725
0fe8c8d0
IT		 1726 cis->cis_id = qos->ucast.cis;
1727 cis->c_sdu = cpu_to_le16(qos->ucast.out.sdu);
1728 cis->p_sdu = cpu_to_le16(qos->ucast.in.sdu);
1729 cis->c_phy = qos->ucast.out.phy ? qos->ucast.out.phy : qos->ucast.in.phy;
1730 cis->p_phy = qos->ucast.in.phy ? qos->ucast.in.phy : qos->ucast.out.phy;
1731 cis->c_rtn = qos->ucast.out.rtn;
1732 cis->p_rtn = qos->ucast.in.rtn;
26afbd82
LAD		 1733
1734 d->pdu.cp.num_cis++;
1735}
1736
1737static void cis_list(struct hci_conn *conn, void *data)
1738{
1739 struct iso_list_data *d = data;
1740
eca0ae4a
LAD		 1741 /* Skip if broadcast/ANY address */
1742 if (!bacmp(&conn->dst, BDADDR_ANY))
1743 return;
1744
0fe8c8d0
IT		 1745 if (d->cig != conn->iso_qos.ucast.cig || d->cis == BT_ISO_QOS_CIS_UNSET ||
1746 d->cis != conn->iso_qos.ucast.cis)
26afbd82
LAD		 1747 return;
1748
1749 d->count++;
1750
1751 if (d->pdu.cp.cig_id == BT_ISO_QOS_CIG_UNSET ||
1752 d->count >= ARRAY_SIZE(d->pdu.cis))
1753 return;
1754
1755 cis_add(d, &conn->iso_qos);
1756}
1757
eca0ae4a
LAD		 1758static int hci_le_create_big(struct hci_conn *conn, struct bt_iso_qos *qos)
1759{
1760 struct hci_dev *hdev = conn->hdev;
1761 struct hci_cp_le_create_big cp;
a0bfde16 1762 struct iso_list_data data;
eca0ae4a
LAD		 1763
1764 memset(&cp, 0, sizeof(cp));
1765
a0bfde16
IT		 1766 data.big = qos->bcast.big;
1767 data.bis = qos->bcast.bis;
1768 data.count = 0;
1769
1770 /* Create a BIS for each bound connection */
1771 hci_conn_hash_list_state(hdev, bis_list, ISO_LINK,
1772 BT_BOUND, &data);
1773
0fe8c8d0
IT		 1774 cp.handle = qos->bcast.big;
1775 cp.adv_handle = qos->bcast.bis;
a0bfde16 1776 cp.num_bis = data.count;
0fe8c8d0
IT		 1777 hci_cpu_to_le24(qos->bcast.out.interval, cp.bis.sdu_interval);
1778 cp.bis.sdu = cpu_to_le16(qos->bcast.out.sdu);
1779 cp.bis.latency = cpu_to_le16(qos->bcast.out.latency);
1780 cp.bis.rtn = qos->bcast.out.rtn;
1781 cp.bis.phy = qos->bcast.out.phy;
1782 cp.bis.packing = qos->bcast.packing;
1783 cp.bis.framing = qos->bcast.framing;
1784 cp.bis.encryption = qos->bcast.encryption;
1785 memcpy(cp.bis.bcode, qos->bcast.bcode, sizeof(cp.bis.bcode));
eca0ae4a
LAD		 1786
1787 return hci_send_cmd(hdev, HCI_OP_LE_CREATE_BIG, sizeof(cp), &cp);
1788}
1789
6b9545dc
PV		 1790static void set_cig_params_complete(struct hci_dev *hdev, void *data, int err)
1791{
1792 struct iso_cig_params *pdu = data;
1793
1794 bt_dev_dbg(hdev, "");
1795
1796 if (err)
1797 bt_dev_err(hdev, "Unable to set CIG parameters: %d", err);
1798
1799 kfree(pdu);
1800}
1801
1802static int set_cig_params_sync(struct hci_dev *hdev, void *data)
1803{
1804 struct iso_cig_params *pdu = data;
1805 u32 plen;
1806
1807 plen = sizeof(pdu->cp) + pdu->cp.num_cis * sizeof(pdu->cis[0]);
1808 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_CIG_PARAMS, plen, pdu,
1809 HCI_CMD_TIMEOUT);
1810}
1811
26afbd82
LAD		 1812static bool hci_le_set_cig_params(struct hci_conn *conn, struct bt_iso_qos *qos)
1813{
1814 struct hci_dev *hdev = conn->hdev;
1815 struct iso_list_data data;
6b9545dc 1816 struct iso_cig_params *pdu;
26afbd82
LAD		 1817
1818 memset(&data, 0, sizeof(data));
1819
e6a7a46b 1820 /* Allocate first still reconfigurable CIG if not set */
0fe8c8d0 1821 if (qos->ucast.cig == BT_ISO_QOS_CIG_UNSET) {
e6a7a46b 1822 for (data.cig = 0x00; data.cig < 0xf0; data.cig++) {
26afbd82 1823 data.count = 0;
26afbd82 1824
e6a7a46b
PV		 1825 hci_conn_hash_list_state(hdev, find_cis, ISO_LINK,
1826 BT_CONNECT, &data);
26afbd82
LAD		 1827 if (data.count)
1828 continue;
1829
e6a7a46b 1830 hci_conn_hash_list_state(hdev, find_cis, ISO_LINK,
26afbd82
LAD		 1831 BT_CONNECTED, &data);
1832 if (!data.count)
1833 break;
1834 }
1835
e6a7a46b 1836 if (data.cig == 0xf0)
26afbd82
LAD		 1837 return false;
1838
1839 /* Update CIG */
0fe8c8d0 1840 qos->ucast.cig = data.cig;
26afbd82
LAD		 1841 }
1842
0fe8c8d0
IT		 1843 data.pdu.cp.cig_id = qos->ucast.cig;
1844 hci_cpu_to_le24(qos->ucast.out.interval, data.pdu.cp.c_interval);
1845 hci_cpu_to_le24(qos->ucast.in.interval, data.pdu.cp.p_interval);
1846 data.pdu.cp.sca = qos->ucast.sca;
1847 data.pdu.cp.packing = qos->ucast.packing;
1848 data.pdu.cp.framing = qos->ucast.framing;
1849 data.pdu.cp.c_latency = cpu_to_le16(qos->ucast.out.latency);
1850 data.pdu.cp.p_latency = cpu_to_le16(qos->ucast.in.latency);
26afbd82 1851
0fe8c8d0 1852 if (qos->ucast.cis != BT_ISO_QOS_CIS_UNSET) {
26afbd82 1853 data.count = 0;
0fe8c8d0
IT		 1854 data.cig = qos->ucast.cig;
1855 data.cis = qos->ucast.cis;
26afbd82
LAD		 1856
1857 hci_conn_hash_list_state(hdev, cis_list, ISO_LINK, BT_BOUND,
1858 &data);
1859 if (data.count)
1860 return false;
1861
1862 cis_add(&data, qos);
1863 }
1864
1865 /* Reprogram all CIS(s) with the same CIG */
0fe8c8d0 1866 for (data.cig = qos->ucast.cig, data.cis = 0x00; data.cis < 0x11;
26afbd82
LAD		 1867 data.cis++) {
1868 data.count = 0;
1869
1870 hci_conn_hash_list_state(hdev, cis_list, ISO_LINK, BT_BOUND,
1871 &data);
1872 if (data.count)
1873 continue;
1874
1875 /* Allocate a CIS if not set */
0fe8c8d0 1876 if (qos->ucast.cis == BT_ISO_QOS_CIS_UNSET) {
26afbd82 1877 /* Update CIS */
0fe8c8d0 1878 qos->ucast.cis = data.cis;
26afbd82
LAD		 1879 cis_add(&data, qos);
1880 }
1881 }
1882
0fe8c8d0 1883 if (qos->ucast.cis == BT_ISO_QOS_CIS_UNSET || !data.pdu.cp.num_cis)
26afbd82
LAD		 1884 return false;
1885
5b6d345d 1886 pdu = kmemdup(&data.pdu, sizeof(*pdu), GFP_KERNEL);
6b9545dc 1887 if (!pdu)
26afbd82
LAD		 1888 return false;
1889
6b9545dc
PV		 1890 if (hci_cmd_sync_queue(hdev, set_cig_params_sync, pdu,
1891 set_cig_params_complete) < 0) {
1892 kfree(pdu);
1893 return false;
1894 }
1895
26afbd82
LAD		 1896 return true;
1897}
1898
26afbd82
LAD		 1899struct hci_conn *hci_bind_cis(struct hci_dev *hdev, bdaddr_t *dst,
1900 __u8 dst_type, struct bt_iso_qos *qos)
1901{
1902 struct hci_conn *cis;
1903
c14516fa
LAD		 1904 cis = hci_conn_hash_lookup_cis(hdev, dst, dst_type, qos->ucast.cig,
1905 qos->ucast.cis);
26afbd82
LAD		 1906 if (!cis) {
1907 cis = hci_conn_add(hdev, ISO_LINK, dst, HCI_ROLE_MASTER);
1908 if (!cis)
1909 return ERR_PTR(-ENOMEM);
1910 cis->cleanup = cis_cleanup;
b36a234d 1911 cis->dst_type = dst_type;
26afbd82
LAD		 1912 }
1913
1914 if (cis->state == BT_CONNECTED)
1915 return cis;
1916
1917 /* Check if CIS has been set and the settings matches */
1918 if (cis->state == BT_BOUND &&
1919 !memcmp(&cis->iso_qos, qos, sizeof(*qos)))
1920 return cis;
1921
1922 /* Update LINK PHYs according to QoS preference */
0fe8c8d0
IT		 1923 cis->le_tx_phy = qos->ucast.out.phy;
1924 cis->le_rx_phy = qos->ucast.in.phy;
26afbd82
LAD		 1925
1926 /* If output interval is not set use the input interval as it cannot be
1927 * 0x000000.
1928 */
0fe8c8d0
IT		 1929 if (!qos->ucast.out.interval)
1930 qos->ucast.out.interval = qos->ucast.in.interval;
26afbd82
LAD		 1931
1932 /* If input interval is not set use the output interval as it cannot be
1933 * 0x000000.
1934 */
0fe8c8d0
IT		 1935 if (!qos->ucast.in.interval)
1936 qos->ucast.in.interval = qos->ucast.out.interval;
26afbd82
LAD		 1937
1938 /* If output latency is not set use the input latency as it cannot be
1939 * 0x0000.
1940 */
0fe8c8d0
IT		 1941 if (!qos->ucast.out.latency)
1942 qos->ucast.out.latency = qos->ucast.in.latency;
26afbd82
LAD		 1943
1944 /* If input latency is not set use the output latency as it cannot be
1945 * 0x0000.
1946 */
0fe8c8d0
IT		 1947 if (!qos->ucast.in.latency)
1948 qos->ucast.in.latency = qos->ucast.out.latency;
26afbd82 1949
26afbd82
LAD		 1950 if (!hci_le_set_cig_params(cis, qos)) {
1951 hci_conn_drop(cis);
1952 return ERR_PTR(-EINVAL);
1953 }
1954
1955 cis->iso_qos = *qos;
1956 cis->state = BT_BOUND;
1957
1958 return cis;
1959}
1960
1961bool hci_iso_setup_path(struct hci_conn *conn)
1962{
1963 struct hci_dev *hdev = conn->hdev;
1964 struct hci_cp_le_setup_iso_path cmd;
1965
1966 memset(&cmd, 0, sizeof(cmd));
1967
0fe8c8d0 1968 if (conn->iso_qos.ucast.out.sdu) {
26afbd82
LAD		 1969 cmd.handle = cpu_to_le16(conn->handle);
1970 cmd.direction = 0x00; /* Input (Host to Controller) */
1971 cmd.path = 0x00; /* HCI path if enabled */
1972 cmd.codec = 0x03; /* Transparent Data */
1973
1974 if (hci_send_cmd(hdev, HCI_OP_LE_SETUP_ISO_PATH, sizeof(cmd),
1975 &cmd) < 0)
1976 return false;
1977 }
1978
0fe8c8d0 1979 if (conn->iso_qos.ucast.in.sdu) {
26afbd82
LAD		 1980 cmd.handle = cpu_to_le16(conn->handle);
1981 cmd.direction = 0x01; /* Output (Controller to Host) */
1982 cmd.path = 0x00; /* HCI path if enabled */
1983 cmd.codec = 0x03; /* Transparent Data */
1984
1985 if (hci_send_cmd(hdev, HCI_OP_LE_SETUP_ISO_PATH, sizeof(cmd),
1986 &cmd) < 0)
1987 return false;
1988 }
1989
1990 return true;
1991}
1992
1993static int hci_create_cis_sync(struct hci_dev *hdev, void *data)
1994{
c09b80be 1995 return hci_le_create_cis_sync(hdev, data);
26afbd82
LAD		 1996}
1997
1998int hci_le_create_cis(struct hci_conn *conn)
1999{
2000 struct hci_conn *cis;
06149746 2001 struct hci_link *link, *t;
26afbd82
LAD		 2002 struct hci_dev *hdev = conn->hdev;
2003 int err;
2004
06149746
LAD		 2005 bt_dev_dbg(hdev, "hcon %p", conn);
2006
26afbd82
LAD		 2007 switch (conn->type) {
2008 case LE_LINK:
06149746 2009 if (conn->state != BT_CONNECTED || list_empty(&conn->link_list))
26afbd82 2010 return -EINVAL;
06149746
LAD		 2011
2012 cis = NULL;
2013
2014 /* hci_conn_link uses list_add_tail_rcu so the list is in
2015 * the same order as the connections are requested.
2016 */
2017 list_for_each_entry_safe(link, t, &conn->link_list, list) {
2018 if (link->conn->state == BT_BOUND) {
2019 err = hci_le_create_cis(link->conn);
2020 if (err)
2021 return err;
2022
2023 cis = link->conn;
2024 }
2025 }
2026
2027 return cis ? 0 : -EINVAL;
26afbd82
LAD		 2028 case ISO_LINK:
2029 cis = conn;
2030 break;
2031 default:
2032 return -EINVAL;
2033 }
2034
2035 if (cis->state == BT_CONNECT)
2036 return 0;
2037
2038 /* Queue Create CIS */
2039 err = hci_cmd_sync_queue(hdev, hci_create_cis_sync, cis, NULL);
2040 if (err)
2041 return err;
2042
2043 cis->state = BT_CONNECT;
2044
2045 return 0;
2046}
2047
2048static void hci_iso_qos_setup(struct hci_dev *hdev, struct hci_conn *conn,
2049 struct bt_iso_io_qos *qos, __u8 phy)
2050{
2051 /* Only set MTU if PHY is enabled */
2052 if (!qos->sdu && qos->phy) {
2053 if (hdev->iso_mtu > 0)
2054 qos->sdu = hdev->iso_mtu;
2055 else if (hdev->le_mtu > 0)
2056 qos->sdu = hdev->le_mtu;
2057 else
2058 qos->sdu = hdev->acl_mtu;
2059 }
2060
2061 /* Use the same PHY as ACL if set to any */
2062 if (qos->phy == BT_ISO_PHY_ANY)
2063 qos->phy = phy;
2064
2065 /* Use LE ACL connection interval if not set */
2066 if (!qos->interval)
2067 /* ACL interval unit in 1.25 ms to us */
2068 qos->interval = conn->le_conn_interval * 1250;
2069
2070 /* Use LE ACL connection latency if not set */
2071 if (!qos->latency)
2072 qos->latency = conn->le_conn_latency;
2073}
2074
eca0ae4a
LAD		 2075static int create_big_sync(struct hci_dev *hdev, void *data)
2076{
2077 struct hci_conn *conn = data;
2078 struct bt_iso_qos *qos = &conn->iso_qos;
2079 u16 interval, sync_interval = 0;
2080 u32 flags = 0;
2081 int err;
2082
0fe8c8d0 2083 if (qos->bcast.out.phy == 0x02)
eca0ae4a
LAD		 2084 flags |= MGMT_ADV_FLAG_SEC_2M;
2085
2086 /* Align intervals */
14f0dcec 2087 interval = (qos->bcast.out.interval / 1250) * qos->bcast.sync_factor;
eca0ae4a 2088
0fe8c8d0 2089 if (qos->bcast.bis)
14f0dcec 2090 sync_interval = interval * 4;
eca0ae4a 2091
0fe8c8d0 2092 err = hci_start_per_adv_sync(hdev, qos->bcast.bis, conn->le_per_adv_data_len,
eca0ae4a
LAD		 2093 conn->le_per_adv_data, flags, interval,
2094 interval, sync_interval);
2095 if (err)
2096 return err;
2097
2098 return hci_le_create_big(conn, &conn->iso_qos);
2099}
2100
2101static void create_pa_complete(struct hci_dev *hdev, void *data, int err)
2102{
2103 struct hci_cp_le_pa_create_sync *cp = data;
2104
2105 bt_dev_dbg(hdev, "");
2106
2107 if (err)
2108 bt_dev_err(hdev, "Unable to create PA: %d", err);
2109
2110 kfree(cp);
2111}
2112
2113static int create_pa_sync(struct hci_dev *hdev, void *data)
2114{
2115 struct hci_cp_le_pa_create_sync *cp = data;
2116 int err;
2117
2118 err = __hci_cmd_sync_status(hdev, HCI_OP_LE_PA_CREATE_SYNC,
2119 sizeof(*cp), cp, HCI_CMD_TIMEOUT);
2120 if (err) {
2121 hci_dev_clear_flag(hdev, HCI_PA_SYNC);
2122 return err;
2123 }
2124
2125 return hci_update_passive_scan_sync(hdev);
2126}
2127
2128int hci_pa_create_sync(struct hci_dev *hdev, bdaddr_t *dst, __u8 dst_type,
0fe8c8d0 2129 __u8 sid, struct bt_iso_qos *qos)
eca0ae4a
LAD		 2130{
2131 struct hci_cp_le_pa_create_sync *cp;
2132
2133 if (hci_dev_test_and_set_flag(hdev, HCI_PA_SYNC))
2134 return -EBUSY;
2135
37224a29 2136 cp = kzalloc(sizeof(*cp), GFP_KERNEL);
eca0ae4a
LAD		 2137 if (!cp) {
2138 hci_dev_clear_flag(hdev, HCI_PA_SYNC);
2139 return -ENOMEM;
2140 }
2141
0fe8c8d0 2142 cp->options = qos->bcast.options;
eca0ae4a
LAD		 2143 cp->sid = sid;
2144 cp->addr_type = dst_type;
2145 bacpy(&cp->addr, dst);
0fe8c8d0
IT		 2146 cp->skip = cpu_to_le16(qos->bcast.skip);
2147 cp->sync_timeout = cpu_to_le16(qos->bcast.sync_timeout);
2148 cp->sync_cte_type = qos->bcast.sync_cte_type;
eca0ae4a
LAD		 2149
2150 /* Queue start pa_create_sync and scan */
2151 return hci_cmd_sync_queue(hdev, create_pa_sync, cp, create_pa_complete);
2152}
2153
2154int hci_le_big_create_sync(struct hci_dev *hdev, struct bt_iso_qos *qos,
2155 __u16 sync_handle, __u8 num_bis, __u8 bis[])
2156{
2157 struct _packed {
2158 struct hci_cp_le_big_create_sync cp;
2159 __u8 bis[0x11];
2160 } pdu;
2161 int err;
2162
2163 if (num_bis > sizeof(pdu.bis))
2164 return -EINVAL;
2165
2166 err = qos_set_big(hdev, qos);
2167 if (err)
2168 return err;
2169
2170 memset(&pdu, 0, sizeof(pdu));
0fe8c8d0 2171 pdu.cp.handle = qos->bcast.big;
eca0ae4a 2172 pdu.cp.sync_handle = cpu_to_le16(sync_handle);
0fe8c8d0
IT		 2173 pdu.cp.encryption = qos->bcast.encryption;
2174 memcpy(pdu.cp.bcode, qos->bcast.bcode, sizeof(pdu.cp.bcode));
2175 pdu.cp.mse = qos->bcast.mse;
2176 pdu.cp.timeout = cpu_to_le16(qos->bcast.timeout);
eca0ae4a
LAD		 2177 pdu.cp.num_bis = num_bis;
2178 memcpy(pdu.bis, bis, num_bis);
2179
2180 return hci_send_cmd(hdev, HCI_OP_LE_BIG_CREATE_SYNC,
2181 sizeof(pdu.cp) + num_bis, &pdu);
2182}
2183
2184static void create_big_complete(struct hci_dev *hdev, void *data, int err)
2185{
2186 struct hci_conn *conn = data;
2187
2188 bt_dev_dbg(hdev, "conn %p", conn);
2189
2190 if (err) {
2191 bt_dev_err(hdev, "Unable to create BIG: %d", err);
2192 hci_connect_cfm(conn, err);
2193 hci_conn_del(conn);
2194 }
2195}
2196
a0bfde16
IT		 2197struct hci_conn *hci_bind_bis(struct hci_dev *hdev, bdaddr_t *dst,
2198 struct bt_iso_qos *qos,
2199 __u8 base_len, __u8 *base)
eca0ae4a
LAD		 2200{
2201 struct hci_conn *conn;
a0bfde16
IT		 2202 __u8 eir[HCI_MAX_PER_AD_LENGTH];
2203
2204 if (base_len && base)
2205 base_len = eir_append_service_data(eir, 0, 0x1851,
2206 base, base_len);
eca0ae4a
LAD		 2207
2208 /* We need hci_conn object using the BDADDR_ANY as dst */
a0bfde16 2209 conn = hci_add_bis(hdev, dst, qos, base_len, eir);
eca0ae4a
LAD		 2210 if (IS_ERR(conn))
2211 return conn;
2212
a0bfde16
IT		 2213 /* Update LINK PHYs according to QoS preference */
2214 conn->le_tx_phy = qos->bcast.out.phy;
2215 conn->le_tx_phy = qos->bcast.out.phy;
eca0ae4a
LAD		 2216
2217 /* Add Basic Announcement into Peridic Adv Data if BASE is set */
2218 if (base_len && base) {
a0bfde16 2219 memcpy(conn->le_per_adv_data, eir, sizeof(eir));
eca0ae4a
LAD		 2220 conn->le_per_adv_data_len = base_len;
2221 }
2222
a0bfde16
IT		 2223 hci_iso_qos_setup(hdev, conn, &qos->bcast.out,
2224 conn->le_tx_phy ? conn->le_tx_phy :
2225 hdev->le_tx_def_phys);
2226
2227 conn->iso_qos = *qos;
2228 conn->state = BT_BOUND;
2229
2230 return conn;
2231}
2232
2233static void bis_mark_per_adv(struct hci_conn *conn, void *data)
2234{
2235 struct iso_list_data *d = data;
2236
2237 /* Skip if not broadcast/ANY address */
2238 if (bacmp(&conn->dst, BDADDR_ANY))
2239 return;
2240
2241 if (d->big != conn->iso_qos.bcast.big ||
2242 d->bis == BT_ISO_QOS_BIS_UNSET ||
2243 d->bis != conn->iso_qos.bcast.bis)
2244 return;
2245
2246 set_bit(HCI_CONN_PER_ADV, &conn->flags);
2247}
2248
2249struct hci_conn *hci_connect_bis(struct hci_dev *hdev, bdaddr_t *dst,
2250 __u8 dst_type, struct bt_iso_qos *qos,
2251 __u8 base_len, __u8 *base)
2252{
2253 struct hci_conn *conn;
2254 int err;
2255 struct iso_list_data data;
2256
2257 conn = hci_bind_bis(hdev, dst, qos, base_len, base);
2258 if (IS_ERR(conn))
2259 return conn;
2260
2261 data.big = qos->bcast.big;
2262 data.bis = qos->bcast.bis;
2263
2264 /* Set HCI_CONN_PER_ADV for all bound connections, to mark that
2265 * the start periodic advertising and create BIG commands have
2266 * been queued
2267 */
2268 hci_conn_hash_list_state(hdev, bis_mark_per_adv, ISO_LINK,
2269 BT_BOUND, &data);
2270
eca0ae4a
LAD		 2271 /* Queue start periodic advertising and create BIG */
2272 err = hci_cmd_sync_queue(hdev, create_big_sync, conn,
2273 create_big_complete);
2274 if (err < 0) {
2275 hci_conn_drop(conn);
2276 return ERR_PTR(err);
2277 }
2278
eca0ae4a
LAD		 2279 return conn;
2280}
2281
26afbd82
LAD		 2282struct hci_conn *hci_connect_cis(struct hci_dev *hdev, bdaddr_t *dst,
2283 __u8 dst_type, struct bt_iso_qos *qos)
2284{
2285 struct hci_conn *le;
2286 struct hci_conn *cis;
06149746 2287 struct hci_link *link;
26afbd82 2288
26afbd82
LAD		 2289 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
2290 le = hci_connect_le(hdev, dst, dst_type, false,
2291 BT_SECURITY_LOW,
2292 HCI_LE_CONN_TIMEOUT,
2293 HCI_ROLE_SLAVE);
2294 else
2295 le = hci_connect_le_scan(hdev, dst, dst_type,
2296 BT_SECURITY_LOW,
2297 HCI_LE_CONN_TIMEOUT,
2298 CONN_REASON_ISO_CONNECT);
2299 if (IS_ERR(le))
2300 return le;
2301
0fe8c8d0 2302 hci_iso_qos_setup(hdev, le, &qos->ucast.out,
26afbd82 2303 le->le_tx_phy ? le->le_tx_phy : hdev->le_tx_def_phys);
0fe8c8d0 2304 hci_iso_qos_setup(hdev, le, &qos->ucast.in,
26afbd82
LAD		 2305 le->le_rx_phy ? le->le_rx_phy : hdev->le_rx_def_phys);
2306
2307 cis = hci_bind_cis(hdev, dst, dst_type, qos);
2308 if (IS_ERR(cis)) {
2309 hci_conn_drop(le);
2310 return cis;
2311 }
2312
06149746
LAD		 2313 link = hci_conn_link(le, cis);
2314 if (!link) {
2315 hci_conn_drop(le);
2316 hci_conn_drop(cis);
b4066eb0 2317 return ERR_PTR(-ENOLINK);
06149746 2318 }
26afbd82
LAD		 2319
2320 /* If LE is already connected and CIS handle is already set proceed to
2321 * Create CIS immediately.
2322 */
2323 if (le->state == BT_CONNECTED && cis->handle != HCI_CONN_HANDLE_UNSET)
06149746 2324 hci_le_create_cis(cis);
26afbd82
LAD		 2325
2326 return cis;
2327}
2328
e7c29cb1
MH		 2329/* Check link security requirement */
2330int hci_conn_check_link_mode(struct hci_conn *conn)
2331{
38b3fef1 2332 BT_DBG("hcon %p", conn);
e7c29cb1 2333
40b552aa
MH		 2334 /* In Secure Connections Only mode, it is required that Secure
2335 * Connections is used and the link is encrypted with AES-CCM
2336 * using a P-256 authenticated combination key.
2337 */
d7a5a11d 2338 if (hci_dev_test_flag(conn->hdev, HCI_SC_ONLY)) {
40b552aa
MH		 2339 if (!hci_conn_sc_enabled(conn) ||
2340 !test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
2341 conn->key_type != HCI_LK_AUTH_COMBINATION_P256)
2342 return 0;
2343 }
2344
8746f135
LAD		 2345 /* AES encryption is required for Level 4:
2346 *
2347 * BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 3, Part C
2348 * page 1319:
2349 *
2350 * 128-bit equivalent strength for link and encryption keys
2351 * required using FIPS approved algorithms (E0 not allowed,
2352 * SAFER+ not allowed, and P-192 not allowed; encryption key
2353 * not shortened)
2354 */
2355 if (conn->sec_level == BT_SECURITY_FIPS &&
2356 !test_bit(HCI_CONN_AES_CCM, &conn->flags)) {
2357 bt_dev_err(conn->hdev,
2358 "Invalid security: Missing AES-CCM usage");
2359 return 0;
2360 }
2361
4dae2798
JH		 2362 if (hci_conn_ssp_enabled(conn) &&
2363 !test_bit(HCI_CONN_ENCRYPT, &conn->flags))
e7c29cb1
MH		 2364 return 0;
2365
2366 return 1;
2367}
e7c29cb1 2368
1da177e4 2369/* Authenticate remote device */
0684e5f9 2370static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
1da177e4 2371{
38b3fef1 2372 BT_DBG("hcon %p", conn);
1da177e4 2373
765c2a96
JH		 2374 if (conn->pending_sec_level > sec_level)
2375 sec_level = conn->pending_sec_level;
2376
96a31833 2377 if (sec_level > conn->sec_level)
765c2a96 2378 conn->pending_sec_level = sec_level;
4dae2798 2379 else if (test_bit(HCI_CONN_AUTH, &conn->flags))
1da177e4
LT		 2380 return 1;
2381
65cf686e
JH		 2382 /* Make sure we preserve an existing MITM requirement*/
2383 auth_type |= (conn->auth_type & 0x01);
2384
96a31833
MH		 2385 conn->auth_type = auth_type;
2386
51a8efd7 2387 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
1da177e4 2388 struct hci_cp_auth_requested cp;
b7d05bad 2389
aca3192c 2390 cp.handle = cpu_to_le16(conn->handle);
40be492f 2391 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
5974e4c4 2392 sizeof(cp), &cp);
09da1f34
JH		 2393
2394 /* If we're already encrypted set the REAUTH_PEND flag,
2395 * otherwise set the ENCRYPT_PEND.
2396 */
4dae2798 2397 if (test_bit(HCI_CONN_ENCRYPT, &conn->flags))
51a8efd7 2398 set_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
09da1f34
JH		 2399 else
2400 set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
1da177e4 2401 }
8c1b2355 2402
1da177e4
LT		 2403 return 0;
2404}
1da177e4 2405
bb6d6895 2406/* Encrypt the link */
13d39315
WR		 2407static void hci_conn_encrypt(struct hci_conn *conn)
2408{
38b3fef1 2409 BT_DBG("hcon %p", conn);
13d39315 2410
51a8efd7 2411 if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
13d39315
WR		 2412 struct hci_cp_set_conn_encrypt cp;
2413 cp.handle = cpu_to_le16(conn->handle);
2414 cp.encrypt = 0x01;
2415 hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
5974e4c4 2416 &cp);
13d39315
WR		 2417 }
2418}
2419
8c1b2355 2420/* Enable security */
e7cafc45
JH		 2421int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type,
2422 bool initiator)
1da177e4 2423{
38b3fef1 2424 BT_DBG("hcon %p", conn);
1da177e4 2425
d8343f12
VCG		 2426 if (conn->type == LE_LINK)
2427 return smp_conn_security(conn, sec_level);
2428
13d39315 2429 /* For sdp we don't need the link key. */
8c1b2355
MH		 2430 if (sec_level == BT_SECURITY_SDP)
2431 return 1;
2432
13d39315
WR		 2433 /* For non 2.1 devices and low security level we don't need the link
2434 key. */
aa64a8b5 2435 if (sec_level == BT_SECURITY_LOW && !hci_conn_ssp_enabled(conn))
3fdca1e1 2436 return 1;
8c1b2355 2437
13d39315 2438 /* For other security levels we need the link key. */
4dae2798 2439 if (!test_bit(HCI_CONN_AUTH, &conn->flags))
13d39315
WR		 2440 goto auth;
2441
7b5a9241
MH		 2442 /* An authenticated FIPS approved combination key has sufficient
2443 * security for security level 4. */
2444 if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256 &&
2445 sec_level == BT_SECURITY_FIPS)
2446 goto encrypt;
2447
2448 /* An authenticated combination key has sufficient security for
2449 security level 3. */
2450 if ((conn->key_type == HCI_LK_AUTH_COMBINATION_P192 ||
2451 conn->key_type == HCI_LK_AUTH_COMBINATION_P256) &&
2452 sec_level == BT_SECURITY_HIGH)
13d39315
WR		 2453 goto encrypt;
2454
2455 /* An unauthenticated combination key has sufficient security for
2456 security level 1 and 2. */
66138ce8
MH		 2457 if ((conn->key_type == HCI_LK_UNAUTH_COMBINATION_P192 ||
2458 conn->key_type == HCI_LK_UNAUTH_COMBINATION_P256) &&
5974e4c4 2459 (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW))
13d39315
WR		 2460 goto encrypt;
2461
2462 /* A combination key has always sufficient security for the security
2463 levels 1 or 2. High security level requires the combination key
2464 is generated using maximum PIN code length (16).
2465 For pre 2.1 units. */
2466 if (conn->key_type == HCI_LK_COMBINATION &&
7b5a9241
MH		 2467 (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW ||
2468 conn->pin_length == 16))
13d39315
WR		 2469 goto encrypt;
2470
2471auth:
51a8efd7 2472 if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags))
1da177e4
LT		 2473 return 0;
2474
977f8fce
JH		 2475 if (initiator)
2476 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
2477
6fdf658c
LAD		 2478 if (!hci_conn_auth(conn, sec_level, auth_type))
2479 return 0;
13d39315
WR		 2480
2481encrypt:
693cd8ce
MH		 2482 if (test_bit(HCI_CONN_ENCRYPT, &conn->flags)) {
2483 /* Ensure that the encryption key size has been read,
2484 * otherwise stall the upper layer responses.
2485 */
2486 if (!conn->enc_key_size)
2487 return 0;
2488
2489 /* Nothing else needed, all requirements are met */
13d39315 2490 return 1;
693cd8ce 2491 }
8c1b2355 2492
13d39315 2493 hci_conn_encrypt(conn);
1da177e4
LT		 2494 return 0;
2495}
8c1b2355 2496EXPORT_SYMBOL(hci_conn_security);
1da177e4 2497
b3b1b061
WR		 2498/* Check secure link requirement */
2499int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level)
2500{
38b3fef1 2501 BT_DBG("hcon %p", conn);
b3b1b061 2502
9cb2e030
MH		 2503 /* Accept if non-secure or higher security level is required */
2504 if (sec_level != BT_SECURITY_HIGH && sec_level != BT_SECURITY_FIPS)
2505 return 1;
b3b1b061 2506
9cb2e030
MH		 2507 /* Accept if secure or higher security level is already present */
2508 if (conn->sec_level == BT_SECURITY_HIGH ||
2509 conn->sec_level == BT_SECURITY_FIPS)
b3b1b061
WR		 2510 return 1;
2511
9cb2e030
MH		 2512 /* Reject not secure link */
2513 return 0;
b3b1b061
WR		 2514}
2515EXPORT_SYMBOL(hci_conn_check_secure);
2516
1da177e4 2517/* Switch role */
8c1b2355 2518int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
1da177e4 2519{
38b3fef1 2520 BT_DBG("hcon %p", conn);
1da177e4 2521
40bef302 2522 if (role == conn->role)
1da177e4
LT		 2523 return 1;
2524
51a8efd7 2525 if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->flags)) {
1da177e4
LT		 2526 struct hci_cp_switch_role cp;
2527 bacpy(&cp.bdaddr, &conn->dst);
2528 cp.role = role;
a9de9248 2529 hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
1da177e4 2530 }
8c1b2355 2531
1da177e4
LT		 2532 return 0;
2533}
2534EXPORT_SYMBOL(hci_conn_switch_role);
2535
04837f64 2536/* Enter active mode */
14b12d0b 2537void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
04837f64
MH		 2538{
2539 struct hci_dev *hdev = conn->hdev;
2540
38b3fef1 2541 BT_DBG("hcon %p mode %d", conn, conn->mode);
04837f64 2542
14b12d0b
JG		 2543 if (conn->mode != HCI_CM_SNIFF)
2544 goto timer;
2545
58a681ef 2546 if (!test_bit(HCI_CONN_POWER_SAVE, &conn->flags) && !force_active)
04837f64
MH		 2547 goto timer;
2548
51a8efd7 2549 if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
04837f64 2550 struct hci_cp_exit_sniff_mode cp;
aca3192c 2551 cp.handle = cpu_to_le16(conn->handle);
a9de9248 2552 hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
04837f64
MH		 2553 }
2554
2555timer:
2556 if (hdev->idle_timeout > 0)
a74a84f6
JH		 2557 queue_delayed_work(hdev->workqueue, &conn->idle_work,
2558 msecs_to_jiffies(hdev->idle_timeout));
04837f64
MH		 2559}
2560
1da177e4
LT		 2561/* Drop all connection on the device */
2562void hci_conn_hash_flush(struct hci_dev *hdev)
2563{
a2ac591c
RL		 2564 struct list_head *head = &hdev->conn_hash.list;
2565 struct hci_conn *conn;
1da177e4
LT		 2566
2567 BT_DBG("hdev %s", hdev->name);
2568
a2ac591c
RL		 2569 /* We should not traverse the list here, because hci_conn_del
2570 * can remove extra links, which may cause the list traversal
2571 * to hit items that have already been released.
2572 */
2573 while ((conn = list_first_entry_or_null(head,
2574 struct hci_conn,
2575 list)) != NULL) {
2576 conn->state = BT_CLOSED;
2577 hci_disconn_cfm(conn, HCI_ERROR_LOCAL_HOST_TERM);
a2ac591c 2578 hci_conn_del(conn);
1da177e4
LT		 2579 }
2580}
2581
a9de9248
MH		 2582/* Check pending connect attempts */
2583void hci_conn_check_pending(struct hci_dev *hdev)
2584{
2585 struct hci_conn *conn;
2586
2587 BT_DBG("hdev %s", hdev->name);
2588
2589 hci_dev_lock(hdev);
2590
2591 conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
2592 if (conn)
1aef8669 2593 hci_acl_create_connection(conn);
a9de9248
MH		 2594
2595 hci_dev_unlock(hdev);
2596}
2597
4dae2798
JH		 2598static u32 get_link_mode(struct hci_conn *conn)
2599{
2600 u32 link_mode = 0;
2601
40bef302 2602 if (conn->role == HCI_ROLE_MASTER)
4dae2798
JH		 2603 link_mode |= HCI_LM_MASTER;
2604
2605 if (test_bit(HCI_CONN_ENCRYPT, &conn->flags))
2606 link_mode |= HCI_LM_ENCRYPT;
2607
2608 if (test_bit(HCI_CONN_AUTH, &conn->flags))
2609 link_mode |= HCI_LM_AUTH;
2610
2611 if (test_bit(HCI_CONN_SECURE, &conn->flags))
2612 link_mode |= HCI_LM_SECURE;
2613
2614 if (test_bit(HCI_CONN_FIPS, &conn->flags))
2615 link_mode |= HCI_LM_FIPS;
2616
2617 return link_mode;
2618}
2619
1da177e4
LT		 2620int hci_get_conn_list(void __user *arg)
2621{
fc5fef61 2622 struct hci_conn *c;
1da177e4
LT		 2623 struct hci_conn_list_req req, *cl;
2624 struct hci_conn_info *ci;
2625 struct hci_dev *hdev;
1da177e4
LT		 2626 int n = 0, size, err;
2627
2628 if (copy_from_user(&req, arg, sizeof(req)))
2629 return -EFAULT;
2630
2631 if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
2632 return -EINVAL;
2633
2634 size = sizeof(req) + req.conn_num * sizeof(*ci);
2635
70f23020
AE		 2636 cl = kmalloc(size, GFP_KERNEL);
2637 if (!cl)
1da177e4
LT		 2638 return -ENOMEM;
2639
70f23020
AE		 2640 hdev = hci_dev_get(req.dev_id);
2641 if (!hdev) {
1da177e4
LT		 2642 kfree(cl);
2643 return -ENODEV;
2644 }
2645
2646 ci = cl->conn_info;
2647
09fd0de5 2648 hci_dev_lock(hdev);
8035ded4 2649 list_for_each_entry(c, &hdev->conn_hash.list, list) {
1da177e4
LT		 2650 bacpy(&(ci + n)->bdaddr, &c->dst);
2651 (ci + n)->handle = c->handle;
2652 (ci + n)->type = c->type;
2653 (ci + n)->out = c->out;
2654 (ci + n)->state = c->state;
4dae2798 2655 (ci + n)->link_mode = get_link_mode(c);
1da177e4
LT		 2656 if (++n >= req.conn_num)
2657 break;
2658 }
09fd0de5 2659 hci_dev_unlock(hdev);
1da177e4
LT		 2660
2661 cl->dev_id = hdev->id;
2662 cl->conn_num = n;
2663 size = sizeof(req) + n * sizeof(*ci);
2664
2665 hci_dev_put(hdev);
2666
2667 err = copy_to_user(arg, cl, size);
2668 kfree(cl);
2669
2670 return err ? -EFAULT : 0;
2671}
2672
2673int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
2674{
2675 struct hci_conn_info_req req;
2676 struct hci_conn_info ci;
2677 struct hci_conn *conn;
2678 char __user *ptr = arg + sizeof(req);
2679
2680 if (copy_from_user(&req, arg, sizeof(req)))
2681 return -EFAULT;
2682
09fd0de5 2683 hci_dev_lock(hdev);
1da177e4
LT		 2684 conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
2685 if (conn) {
2686 bacpy(&ci.bdaddr, &conn->dst);
2687 ci.handle = conn->handle;
2688 ci.type = conn->type;
2689 ci.out = conn->out;
2690 ci.state = conn->state;
4dae2798 2691 ci.link_mode = get_link_mode(conn);
1da177e4 2692 }
09fd0de5 2693 hci_dev_unlock(hdev);
1da177e4
LT		 2694
2695 if (!conn)
2696 return -ENOENT;
2697
2698 return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
2699}
40be492f
MH		 2700
2701int hci_get_auth_info(struct hci_dev *hdev, void __user *arg)
2702{
2703 struct hci_auth_info_req req;
2704 struct hci_conn *conn;
2705
2706 if (copy_from_user(&req, arg, sizeof(req)))
2707 return -EFAULT;
2708
09fd0de5 2709 hci_dev_lock(hdev);
40be492f
MH		 2710 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr);
2711 if (conn)
2712 req.type = conn->auth_type;
09fd0de5 2713 hci_dev_unlock(hdev);
40be492f
MH		 2714
2715 if (!conn)
2716 return -ENOENT;
2717
2718 return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0;
2719}
73d80deb
LAD		 2720
2721struct hci_chan *hci_chan_create(struct hci_conn *conn)
2722{
2723 struct hci_dev *hdev = conn->hdev;
2724 struct hci_chan *chan;
2725
38b3fef1 2726 BT_DBG("%s hcon %p", hdev->name, conn);
73d80deb 2727
f94b665d
JH		 2728 if (test_bit(HCI_CONN_DROP, &conn->flags)) {
2729 BT_DBG("Refusing to create new hci_chan");
2730 return NULL;
2731 }
2732
27f70f3e 2733 chan = kzalloc(sizeof(*chan), GFP_KERNEL);
73d80deb
LAD		 2734 if (!chan)
2735 return NULL;
2736
6c388d32 2737 chan->conn = hci_conn_get(conn);
73d80deb 2738 skb_queue_head_init(&chan->data_q);
168df8e5 2739 chan->state = BT_CONNECTED;
73d80deb 2740
8192edef 2741 list_add_rcu(&chan->list, &conn->chan_list);
73d80deb
LAD		 2742
2743 return chan;
2744}
2745
9472007c 2746void hci_chan_del(struct hci_chan *chan)
73d80deb
LAD		 2747{
2748 struct hci_conn *conn = chan->conn;
2749 struct hci_dev *hdev = conn->hdev;
2750
38b3fef1 2751 BT_DBG("%s hcon %p chan %p", hdev->name, conn, chan);
73d80deb 2752
8192edef
GP		 2753 list_del_rcu(&chan->list);
2754
2755 synchronize_rcu();
73d80deb 2756
bcbb655a 2757 /* Prevent new hci_chan's to be created for this hci_conn */
f94b665d 2758 set_bit(HCI_CONN_DROP, &conn->flags);
b3ff670a 2759
6c388d32 2760 hci_conn_put(conn);
e9b02748 2761
73d80deb
LAD		 2762 skb_queue_purge(&chan->data_q);
2763 kfree(chan);
73d80deb
LAD		 2764}
2765
2c33c06a 2766void hci_chan_list_flush(struct hci_conn *conn)
73d80deb 2767{
2a5a5ec6 2768 struct hci_chan *chan, *n;
73d80deb 2769
38b3fef1 2770 BT_DBG("hcon %p", conn);
73d80deb 2771
2a5a5ec6 2772 list_for_each_entry_safe(chan, n, &conn->chan_list, list)
73d80deb
LAD		 2773 hci_chan_del(chan);
2774}
42c4e53e
AE		 2775
2776static struct hci_chan *__hci_chan_lookup_handle(struct hci_conn *hcon,
2777 __u16 handle)
2778{
2779 struct hci_chan *hchan;
2780
2781 list_for_each_entry(hchan, &hcon->chan_list, list) {
2782 if (hchan->handle == handle)
2783 return hchan;
2784 }
2785
2786 return NULL;
2787}
2788
2789struct hci_chan *hci_chan_lookup_handle(struct hci_dev *hdev, __u16 handle)
2790{
2791 struct hci_conn_hash *h = &hdev->conn_hash;
2792 struct hci_conn *hcon;
2793 struct hci_chan *hchan = NULL;
2794
2795 rcu_read_lock();
2796
2797 list_for_each_entry_rcu(hcon, &h->list, list) {
2798 hchan = __hci_chan_lookup_handle(hcon, handle);
2799 if (hchan)
2800 break;
2801 }
2802
2803 rcu_read_unlock();
2804
2805 return hchan;
2806}
eab2404b
LAD		 2807
2808u32 hci_conn_get_phy(struct hci_conn *conn)
2809{
2810 u32 phys = 0;
2811
eab2404b
LAD		 2812 /* BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 2, Part B page 471:
2813 * Table 6.2: Packets defined for synchronous, asynchronous, and
6397729b 2814 * CPB logical transport types.
eab2404b
LAD		 2815 */
2816 switch (conn->type) {
2817 case SCO_LINK:
2818 /* SCO logical transport (1 Mb/s):
2819 * HV1, HV2, HV3 and DV.
2820 */
2821 phys |= BT_PHY_BR_1M_1SLOT;
2822
2823 break;
2824
2825 case ACL_LINK:
2826 /* ACL logical transport (1 Mb/s) ptt=0:
2827 * DH1, DM3, DH3, DM5 and DH5.
2828 */
2829 phys |= BT_PHY_BR_1M_1SLOT;
2830
2831 if (conn->pkt_type & (HCI_DM3 | HCI_DH3))
2832 phys |= BT_PHY_BR_1M_3SLOT;
2833
2834 if (conn->pkt_type & (HCI_DM5 | HCI_DH5))
2835 phys |= BT_PHY_BR_1M_5SLOT;
2836
2837 /* ACL logical transport (2 Mb/s) ptt=1:
2838 * 2-DH1, 2-DH3 and 2-DH5.
2839 */
2840 if (!(conn->pkt_type & HCI_2DH1))
2841 phys |= BT_PHY_EDR_2M_1SLOT;
2842
2843 if (!(conn->pkt_type & HCI_2DH3))
2844 phys |= BT_PHY_EDR_2M_3SLOT;
2845
2846 if (!(conn->pkt_type & HCI_2DH5))
2847 phys |= BT_PHY_EDR_2M_5SLOT;
2848
2849 /* ACL logical transport (3 Mb/s) ptt=1:
2850 * 3-DH1, 3-DH3 and 3-DH5.
2851 */
2852 if (!(conn->pkt_type & HCI_3DH1))
2853 phys |= BT_PHY_EDR_3M_1SLOT;
2854
2855 if (!(conn->pkt_type & HCI_3DH3))
2856 phys |= BT_PHY_EDR_3M_3SLOT;
2857
2858 if (!(conn->pkt_type & HCI_3DH5))
2859 phys |= BT_PHY_EDR_3M_5SLOT;
2860
2861 break;
2862
2863 case ESCO_LINK:
2864 /* eSCO logical transport (1 Mb/s): EV3, EV4 and EV5 */
2865 phys |= BT_PHY_BR_1M_1SLOT;
2866
2867 if (!(conn->pkt_type & (ESCO_EV4 | ESCO_EV5)))
2868 phys |= BT_PHY_BR_1M_3SLOT;
2869
2870 /* eSCO logical transport (2 Mb/s): 2-EV3, 2-EV5 */
2871 if (!(conn->pkt_type & ESCO_2EV3))
2872 phys |= BT_PHY_EDR_2M_1SLOT;
2873
2874 if (!(conn->pkt_type & ESCO_2EV5))
2875 phys |= BT_PHY_EDR_2M_3SLOT;
2876
2877 /* eSCO logical transport (3 Mb/s): 3-EV3, 3-EV5 */
2878 if (!(conn->pkt_type & ESCO_3EV3))
2879 phys |= BT_PHY_EDR_3M_1SLOT;
2880
2881 if (!(conn->pkt_type & ESCO_3EV5))
2882 phys |= BT_PHY_EDR_3M_3SLOT;
2883
2884 break;
2885
2886 case LE_LINK:
2887 if (conn->le_tx_phy & HCI_LE_SET_PHY_1M)
2888 phys |= BT_PHY_LE_1M_TX;
2889
2890 if (conn->le_rx_phy & HCI_LE_SET_PHY_1M)
2891 phys |= BT_PHY_LE_1M_RX;
2892
2893 if (conn->le_tx_phy & HCI_LE_SET_PHY_2M)
2894 phys |= BT_PHY_LE_2M_TX;
2895
2896 if (conn->le_rx_phy & HCI_LE_SET_PHY_2M)
2897 phys |= BT_PHY_LE_2M_RX;
2898
2899 if (conn->le_tx_phy & HCI_LE_SET_PHY_CODED)
2900 phys |= BT_PHY_LE_CODED_TX;
2901
2902 if (conn->le_rx_phy & HCI_LE_SET_PHY_CODED)
2903 phys |= BT_PHY_LE_CODED_RX;
2904
2905 break;
2906 }
2907
eab2404b
LAD		 2908 return phys;
2909}
1a942de0
BG		 2910
2911int hci_abort_conn(struct hci_conn *conn, u8 reason)
2912{
2913 int r = 0;
2914
b62e7220
LAD		 2915 if (test_and_set_bit(HCI_CONN_CANCEL, &conn->flags))
2916 return 0;
2917
1a942de0
BG		 2918 switch (conn->state) {
2919 case BT_CONNECTED:
2920 case BT_CONFIG:
2921 if (conn->type == AMP_LINK) {
2922 struct hci_cp_disconn_phy_link cp;
2923
2924 cp.phy_handle = HCI_PHY_HANDLE(conn->handle);
2925 cp.reason = reason;
2926 r = hci_send_cmd(conn->hdev, HCI_OP_DISCONN_PHY_LINK,
2927 sizeof(cp), &cp);
2928 } else {
2929 struct hci_cp_disconnect dc;
2930
2931 dc.handle = cpu_to_le16(conn->handle);
2932 dc.reason = reason;
2933 r = hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT,
2934 sizeof(dc), &dc);
2935 }
2936
2937 conn->state = BT_DISCONN;
2938
2939 break;
2940 case BT_CONNECT:
2941 if (conn->type == LE_LINK) {
2942 if (test_bit(HCI_CONN_SCANNING, &conn->flags))
2943 break;
2944 r = hci_send_cmd(conn->hdev,
2945 HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL);
2946 } else if (conn->type == ACL_LINK) {
2947 if (conn->hdev->hci_ver < BLUETOOTH_VER_1_2)
2948 break;
2949 r = hci_send_cmd(conn->hdev,
2950 HCI_OP_CREATE_CONN_CANCEL,
2951 6, &conn->dst);
2952 }
2953 break;
2954 case BT_CONNECT2:
2955 if (conn->type == ACL_LINK) {
2956 struct hci_cp_reject_conn_req rej;
2957
2958 bacpy(&rej.bdaddr, &conn->dst);
2959 rej.reason = reason;
2960
2961 r = hci_send_cmd(conn->hdev,
2962 HCI_OP_REJECT_CONN_REQ,
2963 sizeof(rej), &rej);
2964 } else if (conn->type == SCO_LINK || conn->type == ESCO_LINK) {
2965 struct hci_cp_reject_sync_conn_req rej;
2966
2967 bacpy(&rej.bdaddr, &conn->dst);
2968
2969 /* SCO rejection has its own limited set of
2970 * allowed error values (0x0D-0x0F) which isn't
2971 * compatible with most values passed to this
2972 * function. To be safe hard-code one of the
2973 * values that's suitable for SCO.
2974 */
2975 rej.reason = HCI_ERROR_REJ_LIMITED_RESOURCES;
2976
2977 r = hci_send_cmd(conn->hdev,
2978 HCI_OP_REJECT_SYNC_CONN_REQ,
2979 sizeof(rej), &rej);
2980 }
2981 break;
2982 default:
2983 conn->state = BT_CLOSED;
2984 break;
2985 }
2986
2987 return r;
2988}
Linux 6.x block layer and io_uring tree(s)