net/bluetooth/hci_conn.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4    Copyright 2023 NXP
   5
   6    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License version 2 as
  10    published by the Free Software Foundation;
  11
  12    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  13    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  14    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  15    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  16    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  17    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  18    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  19    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  20
  21    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  22    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  23    SOFTWARE IS DISCLAIMED.
  24 */
  25
  26 /* Bluetooth HCI connection handling. */
  27
  28 #include <linux/export.h>
  29 #include <linux/debugfs.h>
  30
  31 #include <net/bluetooth/bluetooth.h>
  32 #include <net/bluetooth/hci_core.h>
  33 #include <net/bluetooth/l2cap.h>
  34 #include <net/bluetooth/iso.h>
  35 #include <net/bluetooth/mgmt.h>
  36
  37 #include "hci_request.h"
  38 #include "smp.h"
  39 #include "a2mp.h"
  40 #include "eir.h"
  41
  42 struct sco_param {
  43         u16 pkt_type;
  44         u16 max_latency;
  45         u8  retrans_effort;
  46 };
  47
  48 struct conn_handle_t {
  49         struct hci_conn *conn;
  50         __u16 handle;
  51 };
  52
  53 static const struct sco_param esco_param_cvsd[] = {
  54         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000a,   0x01 }, /* S3 */
  55         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x0007,   0x01 }, /* S2 */
  56         { EDR_ESCO_MASK | ESCO_EV3,   0x0007,   0x01 }, /* S1 */
  57         { EDR_ESCO_MASK | ESCO_HV3,   0xffff,   0x01 }, /* D1 */
  58         { EDR_ESCO_MASK | ESCO_HV1,   0xffff,   0x01 }, /* D0 */
  59 };
  60
  61 static const struct sco_param sco_param_cvsd[] = {
  62         { EDR_ESCO_MASK | ESCO_HV3,   0xffff,   0xff }, /* D1 */
  63         { EDR_ESCO_MASK | ESCO_HV1,   0xffff,   0xff }, /* D0 */
  64 };
  65
  66 static const struct sco_param esco_param_msbc[] = {
  67         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000d,   0x02 }, /* T2 */
  68         { EDR_ESCO_MASK | ESCO_EV3,   0x0008,   0x02 }, /* T1 */
  69 };
  70
  71 /* This function requires the caller holds hdev->lock */
  72 static void hci_connect_le_scan_cleanup(struct hci_conn *conn, u8 status)
  73 {
  74         struct hci_conn_params *params;
  75         struct hci_dev *hdev = conn->hdev;
  76         struct smp_irk *irk;
  77         bdaddr_t *bdaddr;
  78         u8 bdaddr_type;
  79
  80         bdaddr = &conn->dst;
  81         bdaddr_type = conn->dst_type;
  82
  83         /* Check if we need to convert to identity address */
  84         irk = hci_get_irk(hdev, bdaddr, bdaddr_type);
  85         if (irk) {
  86                 bdaddr = &irk->bdaddr;
  87                 bdaddr_type = irk->addr_type;
  88         }
  89
  90         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, bdaddr,
  91                                            bdaddr_type);
  92         if (!params)
  93                 return;
  94
  95         if (params->conn) {
  96                 hci_conn_drop(params->conn);
  97                 hci_conn_put(params->conn);
  98                 params->conn = NULL;
  99         }
 100
 101         if (!params->explicit_connect)
 102                 return;
 103
 104         /* If the status indicates successful cancellation of
 105          * the attempt (i.e. Unknown Connection Id) there's no point of
 106          * notifying failure since we'll go back to keep trying to
 107          * connect. The only exception is explicit connect requests
 108          * where a timeout + cancel does indicate an actual failure.
 109          */
 110         if (status && status != HCI_ERROR_UNKNOWN_CONN_ID)
 111                 mgmt_connect_failed(hdev, &conn->dst, conn->type,
 112                                     conn->dst_type, status);
 113
 114         /* The connection attempt was doing scan for new RPA, and is
 115          * in scan phase. If params are not associated with any other
 116          * autoconnect action, remove them completely. If they are, just unmark
 117          * them as waiting for connection, by clearing explicit_connect field.
 118          */
 119         params->explicit_connect = false;
 120
 121         hci_pend_le_list_del_init(params);
 122
 123         switch (params->auto_connect) {
 124         case HCI_AUTO_CONN_EXPLICIT:
 125                 hci_conn_params_del(hdev, bdaddr, bdaddr_type);
 126                 /* return instead of break to avoid duplicate scan update */
 127                 return;
 128         case HCI_AUTO_CONN_DIRECT:
 129         case HCI_AUTO_CONN_ALWAYS:
 130                 hci_pend_le_list_add(params, &hdev->pend_le_conns);
 131                 break;
 132         case HCI_AUTO_CONN_REPORT:
 133                 hci_pend_le_list_add(params, &hdev->pend_le_reports);
 134                 break;
 135         default:
 136                 break;
 137         }
 138
 139         hci_update_passive_scan(hdev);
 140 }
 141
 142 static void hci_conn_cleanup(struct hci_conn *conn)
 143 {
 144         struct hci_dev *hdev = conn->hdev;
 145
 146         if (test_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags))
 147                 hci_conn_params_del(conn->hdev, &conn->dst, conn->dst_type);
 148
 149         if (test_and_clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
 150                 hci_remove_link_key(hdev, &conn->dst);
 151
 152         hci_chan_list_flush(conn);
 153
 154         hci_conn_hash_del(hdev, conn);
 155
 156         if (conn->cleanup)
 157                 conn->cleanup(conn);
 158
 159         if (conn->type == SCO_LINK || conn->type == ESCO_LINK) {
 160                 switch (conn->setting & SCO_AIRMODE_MASK) {
 161                 case SCO_AIRMODE_CVSD:
 162                 case SCO_AIRMODE_TRANSP:
 163                         if (hdev->notify)
 164                                 hdev->notify(hdev, HCI_NOTIFY_DISABLE_SCO);
 165                         break;
 166                 }
 167         } else {
 168                 if (hdev->notify)
 169                         hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
 170         }
 171
 172         hci_conn_del_sysfs(conn);
 173
 174         debugfs_remove_recursive(conn->debugfs);
 175
 176         hci_dev_put(hdev);
 177
 178         hci_conn_put(conn);
 179 }
 180
 181 static void hci_acl_create_connection(struct hci_conn *conn)
 182 {
 183         struct hci_dev *hdev = conn->hdev;
 184         struct inquiry_entry *ie;
 185         struct hci_cp_create_conn cp;
 186
 187         BT_DBG("hcon %p", conn);
 188
 189         /* Many controllers disallow HCI Create Connection while it is doing
 190          * HCI Inquiry. So we cancel the Inquiry first before issuing HCI Create
 191          * Connection. This may cause the MGMT discovering state to become false
 192          * without user space's request but it is okay since the MGMT Discovery
 193          * APIs do not promise that discovery should be done forever. Instead,
 194          * the user space monitors the status of MGMT discovering and it may
 195          * request for discovery again when this flag becomes false.
 196          */
 197         if (test_bit(HCI_INQUIRY, &hdev->flags)) {
 198                 /* Put this connection to "pending" state so that it will be
 199                  * executed after the inquiry cancel command complete event.
 200                  */
 201                 conn->state = BT_CONNECT2;
 202                 hci_send_cmd(hdev, HCI_OP_INQUIRY_CANCEL, 0, NULL);
 203                 return;
 204         }
 205
 206         conn->state = BT_CONNECT;
 207         conn->out = true;
 208         conn->role = HCI_ROLE_MASTER;
 209
 210         conn->attempt++;
 211
 212         conn->link_policy = hdev->link_policy;
 213
 214         memset(&cp, 0, sizeof(cp));
 215         bacpy(&cp.bdaddr, &conn->dst);
 216         cp.pscan_rep_mode = 0x02;
 217
 218         ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
 219         if (ie) {
 220                 if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
 221                         cp.pscan_rep_mode = ie->data.pscan_rep_mode;
 222                         cp.pscan_mode     = ie->data.pscan_mode;
 223                         cp.clock_offset   = ie->data.clock_offset |
 224                                             cpu_to_le16(0x8000);
 225                 }
 226
 227                 memcpy(conn->dev_class, ie->data.dev_class, 3);
 228         }
 229
 230         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 231         if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
 232                 cp.role_switch = 0x01;
 233         else
 234                 cp.role_switch = 0x00;
 235
 236         hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
 237 }
 238
 239 int hci_disconnect(struct hci_conn *conn, __u8 reason)
 240 {
 241         BT_DBG("hcon %p", conn);
 242
 243         /* When we are central of an established connection and it enters
 244          * the disconnect timeout, then go ahead and try to read the
 245          * current clock offset.  Processing of the result is done
 246          * within the event handling and hci_clock_offset_evt function.
 247          */
 248         if (conn->type == ACL_LINK && conn->role == HCI_ROLE_MASTER &&
 249             (conn->state == BT_CONNECTED || conn->state == BT_CONFIG)) {
 250                 struct hci_dev *hdev = conn->hdev;
 251                 struct hci_cp_read_clock_offset clkoff_cp;
 252
 253                 clkoff_cp.handle = cpu_to_le16(conn->handle);
 254                 hci_send_cmd(hdev, HCI_OP_READ_CLOCK_OFFSET, sizeof(clkoff_cp),
 255                              &clkoff_cp);
 256         }
 257
 258         return hci_abort_conn(conn, reason);
 259 }
 260
 261 static void hci_add_sco(struct hci_conn *conn, __u16 handle)
 262 {
 263         struct hci_dev *hdev = conn->hdev;
 264         struct hci_cp_add_sco cp;
 265
 266         BT_DBG("hcon %p", conn);
 267
 268         conn->state = BT_CONNECT;
 269         conn->out = true;
 270
 271         conn->attempt++;
 272
 273         cp.handle   = cpu_to_le16(handle);
 274         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 275
 276         hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
 277 }
 278
 279 static bool find_next_esco_param(struct hci_conn *conn,
 280                                  const struct sco_param *esco_param, int size)
 281 {
 282         if (!conn->parent)
 283                 return false;
 284
 285         for (; conn->attempt <= size; conn->attempt++) {
 286                 if (lmp_esco_2m_capable(conn->parent) ||
 287                     (esco_param[conn->attempt - 1].pkt_type & ESCO_2EV3))
 288                         break;
 289                 BT_DBG("hcon %p skipped attempt %d, eSCO 2M not supported",
 290                        conn, conn->attempt);
 291         }
 292
 293         return conn->attempt <= size;
 294 }
 295
 296 static int configure_datapath_sync(struct hci_dev *hdev, struct bt_codec *codec)
 297 {
 298         int err;
 299         __u8 vnd_len, *vnd_data = NULL;
 300         struct hci_op_configure_data_path *cmd = NULL;
 301
 302         err = hdev->get_codec_config_data(hdev, ESCO_LINK, codec, &vnd_len,
 303                                           &vnd_data);
 304         if (err < 0)
 305                 goto error;
 306
 307         cmd = kzalloc(sizeof(*cmd) + vnd_len, GFP_KERNEL);
 308         if (!cmd) {
 309                 err = -ENOMEM;
 310                 goto error;
 311         }
 312
 313         err = hdev->get_data_path_id(hdev, &cmd->data_path_id);
 314         if (err < 0)
 315                 goto error;
 316
 317         cmd->vnd_len = vnd_len;
 318         memcpy(cmd->vnd_data, vnd_data, vnd_len);
 319
 320         cmd->direction = 0x00;
 321         __hci_cmd_sync_status(hdev, HCI_CONFIGURE_DATA_PATH,
 322                               sizeof(*cmd) + vnd_len, cmd, HCI_CMD_TIMEOUT);
 323
 324         cmd->direction = 0x01;
 325         err = __hci_cmd_sync_status(hdev, HCI_CONFIGURE_DATA_PATH,
 326                                     sizeof(*cmd) + vnd_len, cmd,
 327                                     HCI_CMD_TIMEOUT);
 328 error:
 329
 330         kfree(cmd);
 331         kfree(vnd_data);
 332         return err;
 333 }
 334
 335 static int hci_enhanced_setup_sync(struct hci_dev *hdev, void *data)
 336 {
 337         struct conn_handle_t *conn_handle = data;
 338         struct hci_conn *conn = conn_handle->conn;
 339         __u16 handle = conn_handle->handle;
 340         struct hci_cp_enhanced_setup_sync_conn cp;
 341         const struct sco_param *param;
 342
 343         kfree(conn_handle);
 344
 345         bt_dev_dbg(hdev, "hcon %p", conn);
 346
 347         /* for offload use case, codec needs to configured before opening SCO */
 348         if (conn->codec.data_path)
 349                 configure_datapath_sync(hdev, &conn->codec);
 350
 351         conn->state = BT_CONNECT;
 352         conn->out = true;
 353
 354         conn->attempt++;
 355
 356         memset(&cp, 0x00, sizeof(cp));
 357
 358         cp.handle   = cpu_to_le16(handle);
 359
 360         cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
 361         cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
 362
 363         switch (conn->codec.id) {
 364         case BT_CODEC_MSBC:
 365                 if (!find_next_esco_param(conn, esco_param_msbc,
 366                                           ARRAY_SIZE(esco_param_msbc)))
 367                         return -EINVAL;
 368
 369                 param = &esco_param_msbc[conn->attempt - 1];
 370                 cp.tx_coding_format.id = 0x05;
 371                 cp.rx_coding_format.id = 0x05;
 372                 cp.tx_codec_frame_size = __cpu_to_le16(60);
 373                 cp.rx_codec_frame_size = __cpu_to_le16(60);
 374                 cp.in_bandwidth = __cpu_to_le32(32000);
 375                 cp.out_bandwidth = __cpu_to_le32(32000);
 376                 cp.in_coding_format.id = 0x04;
 377                 cp.out_coding_format.id = 0x04;
 378                 cp.in_coded_data_size = __cpu_to_le16(16);
 379                 cp.out_coded_data_size = __cpu_to_le16(16);
 380                 cp.in_pcm_data_format = 2;
 381                 cp.out_pcm_data_format = 2;
 382                 cp.in_pcm_sample_payload_msb_pos = 0;
 383                 cp.out_pcm_sample_payload_msb_pos = 0;
 384                 cp.in_data_path = conn->codec.data_path;
 385                 cp.out_data_path = conn->codec.data_path;
 386                 cp.in_transport_unit_size = 1;
 387                 cp.out_transport_unit_size = 1;
 388                 break;
 389
 390         case BT_CODEC_TRANSPARENT:
 391                 if (!find_next_esco_param(conn, esco_param_msbc,
 392                                           ARRAY_SIZE(esco_param_msbc)))
 393                         return false;
 394                 param = &esco_param_msbc[conn->attempt - 1];
 395                 cp.tx_coding_format.id = 0x03;
 396                 cp.rx_coding_format.id = 0x03;
 397                 cp.tx_codec_frame_size = __cpu_to_le16(60);
 398                 cp.rx_codec_frame_size = __cpu_to_le16(60);
 399                 cp.in_bandwidth = __cpu_to_le32(0x1f40);
 400                 cp.out_bandwidth = __cpu_to_le32(0x1f40);
 401                 cp.in_coding_format.id = 0x03;
 402                 cp.out_coding_format.id = 0x03;
 403                 cp.in_coded_data_size = __cpu_to_le16(16);
 404                 cp.out_coded_data_size = __cpu_to_le16(16);
 405                 cp.in_pcm_data_format = 2;
 406                 cp.out_pcm_data_format = 2;
 407                 cp.in_pcm_sample_payload_msb_pos = 0;
 408                 cp.out_pcm_sample_payload_msb_pos = 0;
 409                 cp.in_data_path = conn->codec.data_path;
 410                 cp.out_data_path = conn->codec.data_path;
 411                 cp.in_transport_unit_size = 1;
 412                 cp.out_transport_unit_size = 1;
 413                 break;
 414
 415         case BT_CODEC_CVSD:
 416                 if (conn->parent && lmp_esco_capable(conn->parent)) {
 417                         if (!find_next_esco_param(conn, esco_param_cvsd,
 418                                                   ARRAY_SIZE(esco_param_cvsd)))
 419                                 return -EINVAL;
 420                         param = &esco_param_cvsd[conn->attempt - 1];
 421                 } else {
 422                         if (conn->attempt > ARRAY_SIZE(sco_param_cvsd))
 423                                 return -EINVAL;
 424                         param = &sco_param_cvsd[conn->attempt - 1];
 425                 }
 426                 cp.tx_coding_format.id = 2;
 427                 cp.rx_coding_format.id = 2;
 428                 cp.tx_codec_frame_size = __cpu_to_le16(60);
 429                 cp.rx_codec_frame_size = __cpu_to_le16(60);
 430                 cp.in_bandwidth = __cpu_to_le32(16000);
 431                 cp.out_bandwidth = __cpu_to_le32(16000);
 432                 cp.in_coding_format.id = 4;
 433                 cp.out_coding_format.id = 4;
 434                 cp.in_coded_data_size = __cpu_to_le16(16);
 435                 cp.out_coded_data_size = __cpu_to_le16(16);
 436                 cp.in_pcm_data_format = 2;
 437                 cp.out_pcm_data_format = 2;
 438                 cp.in_pcm_sample_payload_msb_pos = 0;
 439                 cp.out_pcm_sample_payload_msb_pos = 0;
 440                 cp.in_data_path = conn->codec.data_path;
 441                 cp.out_data_path = conn->codec.data_path;
 442                 cp.in_transport_unit_size = 16;
 443                 cp.out_transport_unit_size = 16;
 444                 break;
 445         default:
 446                 return -EINVAL;
 447         }
 448
 449         cp.retrans_effort = param->retrans_effort;
 450         cp.pkt_type = __cpu_to_le16(param->pkt_type);
 451         cp.max_latency = __cpu_to_le16(param->max_latency);
 452
 453         if (hci_send_cmd(hdev, HCI_OP_ENHANCED_SETUP_SYNC_CONN, sizeof(cp), &cp) < 0)
 454                 return -EIO;
 455
 456         return 0;
 457 }
 458
 459 static bool hci_setup_sync_conn(struct hci_conn *conn, __u16 handle)
 460 {
 461         struct hci_dev *hdev = conn->hdev;
 462         struct hci_cp_setup_sync_conn cp;
 463         const struct sco_param *param;
 464
 465         bt_dev_dbg(hdev, "hcon %p", conn);
 466
 467         conn->state = BT_CONNECT;
 468         conn->out = true;
 469
 470         conn->attempt++;
 471
 472         cp.handle   = cpu_to_le16(handle);
 473
 474         cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
 475         cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
 476         cp.voice_setting  = cpu_to_le16(conn->setting);
 477
 478         switch (conn->setting & SCO_AIRMODE_MASK) {
 479         case SCO_AIRMODE_TRANSP:
 480                 if (!find_next_esco_param(conn, esco_param_msbc,
 481                                           ARRAY_SIZE(esco_param_msbc)))
 482                         return false;
 483                 param = &esco_param_msbc[conn->attempt - 1];
 484                 break;
 485         case SCO_AIRMODE_CVSD:
 486                 if (conn->parent && lmp_esco_capable(conn->parent)) {
 487                         if (!find_next_esco_param(conn, esco_param_cvsd,
 488                                                   ARRAY_SIZE(esco_param_cvsd)))
 489                                 return false;
 490                         param = &esco_param_cvsd[conn->attempt - 1];
 491                 } else {
 492                         if (conn->attempt > ARRAY_SIZE(sco_param_cvsd))
 493                                 return false;
 494                         param = &sco_param_cvsd[conn->attempt - 1];
 495                 }
 496                 break;
 497         default:
 498                 return false;
 499         }
 500
 501         cp.retrans_effort = param->retrans_effort;
 502         cp.pkt_type = __cpu_to_le16(param->pkt_type);
 503         cp.max_latency = __cpu_to_le16(param->max_latency);
 504
 505         if (hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp) < 0)
 506                 return false;
 507
 508         return true;
 509 }
 510
 511 bool hci_setup_sync(struct hci_conn *conn, __u16 handle)
 512 {
 513         int result;
 514         struct conn_handle_t *conn_handle;
 515
 516         if (enhanced_sync_conn_capable(conn->hdev)) {
 517                 conn_handle = kzalloc(sizeof(*conn_handle), GFP_KERNEL);
 518
 519                 if (!conn_handle)
 520                         return false;
 521
 522                 conn_handle->conn = conn;
 523                 conn_handle->handle = handle;
 524                 result = hci_cmd_sync_queue(conn->hdev, hci_enhanced_setup_sync,
 525                                             conn_handle, NULL);
 526                 if (result < 0)
 527                         kfree(conn_handle);
 528
 529                 return result == 0;
 530         }
 531
 532         return hci_setup_sync_conn(conn, handle);
 533 }
 534
 535 u8 hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max, u16 latency,
 536                       u16 to_multiplier)
 537 {
 538         struct hci_dev *hdev = conn->hdev;
 539         struct hci_conn_params *params;
 540         struct hci_cp_le_conn_update cp;
 541
 542         hci_dev_lock(hdev);
 543
 544         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
 545         if (params) {
 546                 params->conn_min_interval = min;
 547                 params->conn_max_interval = max;
 548                 params->conn_latency = latency;
 549                 params->supervision_timeout = to_multiplier;
 550         }
 551
 552         hci_dev_unlock(hdev);
 553
 554         memset(&cp, 0, sizeof(cp));
 555         cp.handle               = cpu_to_le16(conn->handle);
 556         cp.conn_interval_min    = cpu_to_le16(min);
 557         cp.conn_interval_max    = cpu_to_le16(max);
 558         cp.conn_latency         = cpu_to_le16(latency);
 559         cp.supervision_timeout  = cpu_to_le16(to_multiplier);
 560         cp.min_ce_len           = cpu_to_le16(0x0000);
 561         cp.max_ce_len           = cpu_to_le16(0x0000);
 562
 563         hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp);
 564
 565         if (params)
 566                 return 0x01;
 567
 568         return 0x00;
 569 }
 570
 571 void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __le64 rand,
 572                       __u8 ltk[16], __u8 key_size)
 573 {
 574         struct hci_dev *hdev = conn->hdev;
 575         struct hci_cp_le_start_enc cp;
 576
 577         BT_DBG("hcon %p", conn);
 578
 579         memset(&cp, 0, sizeof(cp));
 580
 581         cp.handle = cpu_to_le16(conn->handle);
 582         cp.rand = rand;
 583         cp.ediv = ediv;
 584         memcpy(cp.ltk, ltk, key_size);
 585
 586         hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp);
 587 }
 588
 589 /* Device _must_ be locked */
 590 void hci_sco_setup(struct hci_conn *conn, __u8 status)
 591 {
 592         struct hci_link *link;
 593
 594         link = list_first_entry_or_null(&conn->link_list, struct hci_link, list);
 595         if (!link || !link->conn)
 596                 return;
 597
 598         BT_DBG("hcon %p", conn);
 599
 600         if (!status) {
 601                 if (lmp_esco_capable(conn->hdev))
 602                         hci_setup_sync(link->conn, conn->handle);
 603                 else
 604                         hci_add_sco(link->conn, conn->handle);
 605         } else {
 606                 hci_connect_cfm(link->conn, status);
 607                 hci_conn_del(link->conn);
 608         }
 609 }
 610
 611 static void hci_conn_timeout(struct work_struct *work)
 612 {
 613         struct hci_conn *conn = container_of(work, struct hci_conn,
 614                                              disc_work.work);
 615         int refcnt = atomic_read(&conn->refcnt);
 616
 617         BT_DBG("hcon %p state %s", conn, state_to_string(conn->state));
 618
 619         WARN_ON(refcnt < 0);
 620
 621         /* FIXME: It was observed that in pairing failed scenario, refcnt
 622          * drops below 0. Probably this is because l2cap_conn_del calls
 623          * l2cap_chan_del for each channel, and inside l2cap_chan_del conn is
 624          * dropped. After that loop hci_chan_del is called which also drops
 625          * conn. For now make sure that ACL is alive if refcnt is higher then 0,
 626          * otherwise drop it.
 627          */
 628         if (refcnt > 0)
 629                 return;
 630
 631         hci_abort_conn(conn, hci_proto_disconn_ind(conn));
 632 }
 633
 634 /* Enter sniff mode */
 635 static void hci_conn_idle(struct work_struct *work)
 636 {
 637         struct hci_conn *conn = container_of(work, struct hci_conn,
 638                                              idle_work.work);
 639         struct hci_dev *hdev = conn->hdev;
 640
 641         BT_DBG("hcon %p mode %d", conn, conn->mode);
 642
 643         if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn))
 644                 return;
 645
 646         if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF))
 647                 return;
 648
 649         if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
 650                 struct hci_cp_sniff_subrate cp;
 651                 cp.handle             = cpu_to_le16(conn->handle);
 652                 cp.max_latency        = cpu_to_le16(0);
 653                 cp.min_remote_timeout = cpu_to_le16(0);
 654                 cp.min_local_timeout  = cpu_to_le16(0);
 655                 hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
 656         }
 657
 658         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
 659                 struct hci_cp_sniff_mode cp;
 660                 cp.handle       = cpu_to_le16(conn->handle);
 661                 cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
 662                 cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
 663                 cp.attempt      = cpu_to_le16(4);
 664                 cp.timeout      = cpu_to_le16(1);
 665                 hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
 666         }
 667 }
 668
 669 static void hci_conn_auto_accept(struct work_struct *work)
 670 {
 671         struct hci_conn *conn = container_of(work, struct hci_conn,
 672                                              auto_accept_work.work);
 673
 674         hci_send_cmd(conn->hdev, HCI_OP_USER_CONFIRM_REPLY, sizeof(conn->dst),
 675                      &conn->dst);
 676 }
 677
 678 static void le_disable_advertising(struct hci_dev *hdev)
 679 {
 680         if (ext_adv_capable(hdev)) {
 681                 struct hci_cp_le_set_ext_adv_enable cp;
 682
 683                 cp.enable = 0x00;
 684                 cp.num_of_sets = 0x00;
 685
 686                 hci_send_cmd(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE, sizeof(cp),
 687                              &cp);
 688         } else {
 689                 u8 enable = 0x00;
 690                 hci_send_cmd(hdev, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable),
 691                              &enable);
 692         }
 693 }
 694
 695 static void le_conn_timeout(struct work_struct *work)
 696 {
 697         struct hci_conn *conn = container_of(work, struct hci_conn,
 698                                              le_conn_timeout.work);
 699         struct hci_dev *hdev = conn->hdev;
 700
 701         BT_DBG("");
 702
 703         /* We could end up here due to having done directed advertising,
 704          * so clean up the state if necessary. This should however only
 705          * happen with broken hardware or if low duty cycle was used
 706          * (which doesn't have a timeout of its own).
 707          */
 708         if (conn->role == HCI_ROLE_SLAVE) {
 709                 /* Disable LE Advertising */
 710                 le_disable_advertising(hdev);
 711                 hci_dev_lock(hdev);
 712                 hci_conn_failed(conn, HCI_ERROR_ADVERTISING_TIMEOUT);
 713                 hci_dev_unlock(hdev);
 714                 return;
 715         }
 716
 717         hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
 718 }
 719
 720 struct iso_cig_params {
 721         struct hci_cp_le_set_cig_params cp;
 722         struct hci_cis_params cis[0x1f];
 723 };
 724
 725 struct iso_list_data {
 726         union {
 727                 u8  cig;
 728                 u8  big;
 729         };
 730         union {
 731                 u8  cis;
 732                 u8  bis;
 733                 u16 sync_handle;
 734         };
 735         int count;
 736         struct iso_cig_params pdu;
 737         bool big_term;
 738 };
 739
 740 static void bis_list(struct hci_conn *conn, void *data)
 741 {
 742         struct iso_list_data *d = data;
 743
 744         /* Skip if not broadcast/ANY address */
 745         if (bacmp(&conn->dst, BDADDR_ANY))
 746                 return;
 747
 748         if (d->big != conn->iso_qos.bcast.big || d->bis == BT_ISO_QOS_BIS_UNSET ||
 749             d->bis != conn->iso_qos.bcast.bis)
 750                 return;
 751
 752         d->count++;
 753 }
 754
 755 static void find_bis(struct hci_conn *conn, void *data)
 756 {
 757         struct iso_list_data *d = data;
 758
 759         /* Ignore unicast */
 760         if (bacmp(&conn->dst, BDADDR_ANY))
 761                 return;
 762
 763         d->count++;
 764 }
 765
 766 static int terminate_big_sync(struct hci_dev *hdev, void *data)
 767 {
 768         struct iso_list_data *d = data;
 769
 770         bt_dev_dbg(hdev, "big 0x%2.2x bis 0x%2.2x", d->big, d->bis);
 771
 772         hci_remove_ext_adv_instance_sync(hdev, d->bis, NULL);
 773
 774         /* Only terminate BIG if it has been created */
 775         if (!d->big_term)
 776                 return 0;
 777
 778         return hci_le_terminate_big_sync(hdev, d->big,
 779                                          HCI_ERROR_LOCAL_HOST_TERM);
 780 }
 781
 782 static void terminate_big_destroy(struct hci_dev *hdev, void *data, int err)
 783 {
 784         kfree(data);
 785 }
 786
 787 static int hci_le_terminate_big(struct hci_dev *hdev, struct hci_conn *conn)
 788 {
 789         struct iso_list_data *d;
 790         int ret;
 791
 792         bt_dev_dbg(hdev, "big 0x%2.2x bis 0x%2.2x", conn->iso_qos.bcast.big,
 793                    conn->iso_qos.bcast.bis);
 794
 795         d = kzalloc(sizeof(*d), GFP_KERNEL);
 796         if (!d)
 797                 return -ENOMEM;
 798
 799         d->big = conn->iso_qos.bcast.big;
 800         d->bis = conn->iso_qos.bcast.bis;
 801         d->big_term = test_and_clear_bit(HCI_CONN_BIG_CREATED, &conn->flags);
 802
 803         ret = hci_cmd_sync_queue(hdev, terminate_big_sync, d,
 804                                  terminate_big_destroy);
 805         if (ret)
 806                 kfree(d);
 807
 808         return ret;
 809 }
 810
 811 static int big_terminate_sync(struct hci_dev *hdev, void *data)
 812 {
 813         struct iso_list_data *d = data;
 814
 815         bt_dev_dbg(hdev, "big 0x%2.2x sync_handle 0x%4.4x", d->big,
 816                    d->sync_handle);
 817
 818         /* Check if ISO connection is a BIS and terminate BIG if there are
 819          * no other connections using it.
 820          */
 821         hci_conn_hash_list_state(hdev, find_bis, ISO_LINK, BT_CONNECTED, d);
 822         if (d->count)
 823                 return 0;
 824
 825         hci_le_big_terminate_sync(hdev, d->big);
 826
 827         return hci_le_pa_terminate_sync(hdev, d->sync_handle);
 828 }
 829
 830 static int hci_le_big_terminate(struct hci_dev *hdev, u8 big, u16 sync_handle)
 831 {
 832         struct iso_list_data *d;
 833         int ret;
 834
 835         bt_dev_dbg(hdev, "big 0x%2.2x sync_handle 0x%4.4x", big, sync_handle);
 836
 837         d = kzalloc(sizeof(*d), GFP_KERNEL);
 838         if (!d)
 839                 return -ENOMEM;
 840
 841         d->big = big;
 842         d->sync_handle = sync_handle;
 843
 844         ret = hci_cmd_sync_queue(hdev, big_terminate_sync, d,
 845                                  terminate_big_destroy);
 846         if (ret)
 847                 kfree(d);
 848
 849         return ret;
 850 }
 851
 852 /* Cleanup BIS connection
 853  *
 854  * Detects if there any BIS left connected in a BIG
 855  * broadcaster: Remove advertising instance and terminate BIG.
 856  * broadcaster receiver: Teminate BIG sync and terminate PA sync.
 857  */
 858 static void bis_cleanup(struct hci_conn *conn)
 859 {
 860         struct hci_dev *hdev = conn->hdev;
 861         struct hci_conn *bis;
 862
 863         bt_dev_dbg(hdev, "conn %p", conn);
 864
 865         if (conn->role == HCI_ROLE_MASTER) {
 866                 if (!test_and_clear_bit(HCI_CONN_PER_ADV, &conn->flags))
 867                         return;
 868
 869                 /* Check if ISO connection is a BIS and terminate advertising
 870                  * set and BIG if there are no other connections using it.
 871                  */
 872                 bis = hci_conn_hash_lookup_big(hdev, conn->iso_qos.bcast.big);
 873                 if (bis)
 874                         return;
 875
 876                 hci_le_terminate_big(hdev, conn);
 877         } else {
 878                 hci_le_big_terminate(hdev, conn->iso_qos.bcast.big,
 879                                      conn->sync_handle);
 880         }
 881 }
 882
 883 static int remove_cig_sync(struct hci_dev *hdev, void *data)
 884 {
 885         u8 handle = PTR_ERR(data);
 886
 887         return hci_le_remove_cig_sync(hdev, handle);
 888 }
 889
 890 static int hci_le_remove_cig(struct hci_dev *hdev, u8 handle)
 891 {
 892         bt_dev_dbg(hdev, "handle 0x%2.2x", handle);
 893
 894         return hci_cmd_sync_queue(hdev, remove_cig_sync, ERR_PTR(handle), NULL);
 895 }
 896
 897 static void find_cis(struct hci_conn *conn, void *data)
 898 {
 899         struct iso_list_data *d = data;
 900
 901         /* Ignore broadcast or if CIG don't match */
 902         if (!bacmp(&conn->dst, BDADDR_ANY) || d->cig != conn->iso_qos.ucast.cig)
 903                 return;
 904
 905         d->count++;
 906 }
 907
 908 /* Cleanup CIS connection:
 909  *
 910  * Detects if there any CIS left connected in a CIG and remove it.
 911  */
 912 static void cis_cleanup(struct hci_conn *conn)
 913 {
 914         struct hci_dev *hdev = conn->hdev;
 915         struct iso_list_data d;
 916
 917         if (conn->iso_qos.ucast.cig == BT_ISO_QOS_CIG_UNSET)
 918                 return;
 919
 920         memset(&d, 0, sizeof(d));
 921         d.cig = conn->iso_qos.ucast.cig;
 922
 923         /* Check if ISO connection is a CIS and remove CIG if there are
 924          * no other connections using it.
 925          */
 926         hci_conn_hash_list_state(hdev, find_cis, ISO_LINK, BT_BOUND, &d);
 927         hci_conn_hash_list_state(hdev, find_cis, ISO_LINK, BT_CONNECT, &d);
 928         hci_conn_hash_list_state(hdev, find_cis, ISO_LINK, BT_CONNECTED, &d);
 929         if (d.count)
 930                 return;
 931
 932         hci_le_remove_cig(hdev, conn->iso_qos.ucast.cig);
 933 }
 934
 935 static u16 hci_conn_hash_alloc_unset(struct hci_dev *hdev)
 936 {
 937         struct hci_conn_hash *h = &hdev->conn_hash;
 938         struct hci_conn  *c;
 939         u16 handle = HCI_CONN_HANDLE_MAX + 1;
 940
 941         rcu_read_lock();
 942
 943         list_for_each_entry_rcu(c, &h->list, list) {
 944                 /* Find the first unused handle */
 945                 if (handle == 0xffff || c->handle != handle)
 946                         break;
 947                 handle++;
 948         }
 949         rcu_read_unlock();
 950
 951         return handle;
 952 }
 953
 954 struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst,
 955                               u8 role)
 956 {
 957         struct hci_conn *conn;
 958
 959         BT_DBG("%s dst %pMR", hdev->name, dst);
 960
 961         conn = kzalloc(sizeof(*conn), GFP_KERNEL);
 962         if (!conn)
 963                 return NULL;
 964
 965         bacpy(&conn->dst, dst);
 966         bacpy(&conn->src, &hdev->bdaddr);
 967         conn->handle = hci_conn_hash_alloc_unset(hdev);
 968         conn->hdev  = hdev;
 969         conn->type  = type;
 970         conn->role  = role;
 971         conn->mode  = HCI_CM_ACTIVE;
 972         conn->state = BT_OPEN;
 973         conn->auth_type = HCI_AT_GENERAL_BONDING;
 974         conn->io_capability = hdev->io_capability;
 975         conn->remote_auth = 0xff;
 976         conn->key_type = 0xff;
 977         conn->rssi = HCI_RSSI_INVALID;
 978         conn->tx_power = HCI_TX_POWER_INVALID;
 979         conn->max_tx_power = HCI_TX_POWER_INVALID;
 980
 981         set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
 982         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
 983
 984         /* Set Default Authenticated payload timeout to 30s */
 985         conn->auth_payload_timeout = DEFAULT_AUTH_PAYLOAD_TIMEOUT;
 986
 987         if (conn->role == HCI_ROLE_MASTER)
 988                 conn->out = true;
 989
 990         switch (type) {
 991         case ACL_LINK:
 992                 conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
 993                 break;
 994         case LE_LINK:
 995                 /* conn->src should reflect the local identity address */
 996                 hci_copy_identity_address(hdev, &conn->src, &conn->src_type);
 997                 break;
 998         case ISO_LINK:
 999                 /* conn->src should reflect the local identity address */
1000                 hci_copy_identity_address(hdev, &conn->src, &conn->src_type);
1001
1002                 /* set proper cleanup function */
1003                 if (!bacmp(dst, BDADDR_ANY))
1004                         conn->cleanup = bis_cleanup;
1005                 else if (conn->role == HCI_ROLE_MASTER)
1006                         conn->cleanup = cis_cleanup;
1007
1008                 break;
1009         case SCO_LINK:
1010                 if (lmp_esco_capable(hdev))
1011                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
1012                                         (hdev->esco_type & EDR_ESCO_MASK);
1013                 else
1014                         conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
1015                 break;
1016         case ESCO_LINK:
1017                 conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
1018                 break;
1019         }
1020
1021         skb_queue_head_init(&conn->data_q);
1022
1023         INIT_LIST_HEAD(&conn->chan_list);
1024         INIT_LIST_HEAD(&conn->link_list);
1025
1026         INIT_DELAYED_WORK(&conn->disc_work, hci_conn_timeout);
1027         INIT_DELAYED_WORK(&conn->auto_accept_work, hci_conn_auto_accept);
1028         INIT_DELAYED_WORK(&conn->idle_work, hci_conn_idle);
1029         INIT_DELAYED_WORK(&conn->le_conn_timeout, le_conn_timeout);
1030
1031         atomic_set(&conn->refcnt, 0);
1032
1033         hci_dev_hold(hdev);
1034
1035         hci_conn_hash_add(hdev, conn);
1036
1037         /* The SCO and eSCO connections will only be notified when their
1038          * setup has been completed. This is different to ACL links which
1039          * can be notified right away.
1040          */
1041         if (conn->type != SCO_LINK && conn->type != ESCO_LINK) {
1042                 if (hdev->notify)
1043                         hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
1044         }
1045
1046         hci_conn_init_sysfs(conn);
1047
1048         return conn;
1049 }
1050
1051 static void hci_conn_unlink(struct hci_conn *conn)
1052 {
1053         struct hci_dev *hdev = conn->hdev;
1054
1055         bt_dev_dbg(hdev, "hcon %p", conn);
1056
1057         if (!conn->parent) {
1058                 struct hci_link *link, *t;
1059
1060                 list_for_each_entry_safe(link, t, &conn->link_list, list) {
1061                         struct hci_conn *child = link->conn;
1062
1063                         hci_conn_unlink(child);
1064
1065                         /* If hdev is down it means
1066                          * hci_dev_close_sync/hci_conn_hash_flush is in progress
1067                          * and links don't need to be cleanup as all connections
1068                          * would be cleanup.
1069                          */
1070                         if (!test_bit(HCI_UP, &hdev->flags))
1071                                 continue;
1072
1073                         /* Due to race, SCO connection might be not established
1074                          * yet at this point. Delete it now, otherwise it is
1075                          * possible for it to be stuck and can't be deleted.
1076                          */
1077                         if ((child->type == SCO_LINK ||
1078                              child->type == ESCO_LINK) &&
1079                             HCI_CONN_HANDLE_UNSET(child->handle))
1080                                 hci_conn_del(child);
1081                 }
1082
1083                 return;
1084         }
1085
1086         if (!conn->link)
1087                 return;
1088
1089         list_del_rcu(&conn->link->list);
1090         synchronize_rcu();
1091
1092         hci_conn_drop(conn->parent);
1093         hci_conn_put(conn->parent);
1094         conn->parent = NULL;
1095
1096         kfree(conn->link);
1097         conn->link = NULL;
1098 }
1099
1100 void hci_conn_del(struct hci_conn *conn)
1101 {
1102         struct hci_dev *hdev = conn->hdev;
1103
1104         BT_DBG("%s hcon %p handle %d", hdev->name, conn, conn->handle);
1105
1106         hci_conn_unlink(conn);
1107
1108         cancel_delayed_work_sync(&conn->disc_work);
1109         cancel_delayed_work_sync(&conn->auto_accept_work);
1110         cancel_delayed_work_sync(&conn->idle_work);
1111
1112         if (conn->type == ACL_LINK) {
1113                 /* Unacked frames */
1114                 hdev->acl_cnt += conn->sent;
1115         } else if (conn->type == LE_LINK) {
1116                 cancel_delayed_work(&conn->le_conn_timeout);
1117
1118                 if (hdev->le_pkts)
1119                         hdev->le_cnt += conn->sent;
1120                 else
1121                         hdev->acl_cnt += conn->sent;
1122         } else {
1123                 /* Unacked ISO frames */
1124                 if (conn->type == ISO_LINK) {
1125                         if (hdev->iso_pkts)
1126                                 hdev->iso_cnt += conn->sent;
1127                         else if (hdev->le_pkts)
1128                                 hdev->le_cnt += conn->sent;
1129                         else
1130                                 hdev->acl_cnt += conn->sent;
1131                 }
1132         }
1133
1134         if (conn->amp_mgr)
1135                 amp_mgr_put(conn->amp_mgr);
1136
1137         skb_queue_purge(&conn->data_q);
1138
1139         /* Remove the connection from the list and cleanup its remaining
1140          * state. This is a separate function since for some cases like
1141          * BT_CONNECT_SCAN we *only* want the cleanup part without the
1142          * rest of hci_conn_del.
1143          */
1144         hci_conn_cleanup(conn);
1145 }
1146
1147 struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src, uint8_t src_type)
1148 {
1149         int use_src = bacmp(src, BDADDR_ANY);
1150         struct hci_dev *hdev = NULL, *d;
1151
1152         BT_DBG("%pMR -> %pMR", src, dst);
1153
1154         read_lock(&hci_dev_list_lock);
1155
1156         list_for_each_entry(d, &hci_dev_list, list) {
1157                 if (!test_bit(HCI_UP, &d->flags) ||
1158                     hci_dev_test_flag(d, HCI_USER_CHANNEL) ||
1159                     d->dev_type != HCI_PRIMARY)
1160                         continue;
1161
1162                 /* Simple routing:
1163                  *   No source address - find interface with bdaddr != dst
1164                  *   Source address    - find interface with bdaddr == src
1165                  */
1166
1167                 if (use_src) {
1168                         bdaddr_t id_addr;
1169                         u8 id_addr_type;
1170
1171                         if (src_type == BDADDR_BREDR) {
1172                                 if (!lmp_bredr_capable(d))
1173                                         continue;
1174                                 bacpy(&id_addr, &d->bdaddr);
1175                                 id_addr_type = BDADDR_BREDR;
1176                         } else {
1177                                 if (!lmp_le_capable(d))
1178                                         continue;
1179
1180                                 hci_copy_identity_address(d, &id_addr,
1181                                                           &id_addr_type);
1182
1183                                 /* Convert from HCI to three-value type */
1184                                 if (id_addr_type == ADDR_LE_DEV_PUBLIC)
1185                                         id_addr_type = BDADDR_LE_PUBLIC;
1186                                 else
1187                                         id_addr_type = BDADDR_LE_RANDOM;
1188                         }
1189
1190                         if (!bacmp(&id_addr, src) && id_addr_type == src_type) {
1191                                 hdev = d; break;
1192                         }
1193                 } else {
1194                         if (bacmp(&d->bdaddr, dst)) {
1195                                 hdev = d; break;
1196                         }
1197                 }
1198         }
1199
1200         if (hdev)
1201                 hdev = hci_dev_hold(hdev);
1202
1203         read_unlock(&hci_dev_list_lock);
1204         return hdev;
1205 }
1206 EXPORT_SYMBOL(hci_get_route);
1207
1208 /* This function requires the caller holds hdev->lock */
1209 static void hci_le_conn_failed(struct hci_conn *conn, u8 status)
1210 {
1211         struct hci_dev *hdev = conn->hdev;
1212
1213         hci_connect_le_scan_cleanup(conn, status);
1214
1215         /* Enable advertising in case this was a failed connection
1216          * attempt as a peripheral.
1217          */
1218         hci_enable_advertising(hdev);
1219 }
1220
1221 /* This function requires the caller holds hdev->lock */
1222 void hci_conn_failed(struct hci_conn *conn, u8 status)
1223 {
1224         struct hci_dev *hdev = conn->hdev;
1225
1226         bt_dev_dbg(hdev, "status 0x%2.2x", status);
1227
1228         switch (conn->type) {
1229         case LE_LINK:
1230                 hci_le_conn_failed(conn, status);
1231                 break;
1232         case ACL_LINK:
1233                 mgmt_connect_failed(hdev, &conn->dst, conn->type,
1234                                     conn->dst_type, status);
1235                 break;
1236         }
1237
1238         conn->state = BT_CLOSED;
1239         hci_connect_cfm(conn, status);
1240         hci_conn_del(conn);
1241 }
1242
1243 static void create_le_conn_complete(struct hci_dev *hdev, void *data, int err)
1244 {
1245         struct hci_conn *conn;
1246         u16 handle = PTR_ERR(data);
1247
1248         conn = hci_conn_hash_lookup_handle(hdev, handle);
1249         if (!conn)
1250                 return;
1251
1252         bt_dev_dbg(hdev, "err %d", err);
1253
1254         hci_dev_lock(hdev);
1255
1256         if (!err) {
1257                 hci_connect_le_scan_cleanup(conn, 0x00);
1258                 goto done;
1259         }
1260
1261         /* Check if connection is still pending */
1262         if (conn != hci_lookup_le_connect(hdev))
1263                 goto done;
1264
1265         /* Flush to make sure we send create conn cancel command if needed */
1266         flush_delayed_work(&conn->le_conn_timeout);
1267         hci_conn_failed(conn, bt_status(err));
1268
1269 done:
1270         hci_dev_unlock(hdev);
1271 }
1272
1273 static int hci_connect_le_sync(struct hci_dev *hdev, void *data)
1274 {
1275         struct hci_conn *conn;
1276         u16 handle = PTR_ERR(data);
1277
1278         conn = hci_conn_hash_lookup_handle(hdev, handle);
1279         if (!conn)
1280                 return 0;
1281
1282         bt_dev_dbg(hdev, "conn %p", conn);
1283
1284         conn->state = BT_CONNECT;
1285
1286         return hci_le_create_conn_sync(hdev, conn);
1287 }
1288
1289 struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,
1290                                 u8 dst_type, bool dst_resolved, u8 sec_level,
1291                                 u16 conn_timeout, u8 role)
1292 {
1293         struct hci_conn *conn;
1294         struct smp_irk *irk;
1295         int err;
1296
1297         /* Let's make sure that le is enabled.*/
1298         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1299                 if (lmp_le_capable(hdev))
1300                         return ERR_PTR(-ECONNREFUSED);
1301
1302                 return ERR_PTR(-EOPNOTSUPP);
1303         }
1304
1305         /* Since the controller supports only one LE connection attempt at a
1306          * time, we return -EBUSY if there is any connection attempt running.
1307          */
1308         if (hci_lookup_le_connect(hdev))
1309                 return ERR_PTR(-EBUSY);
1310
1311         /* If there's already a connection object but it's not in
1312          * scanning state it means it must already be established, in
1313          * which case we can't do anything else except report a failure
1314          * to connect.
1315          */
1316         conn = hci_conn_hash_lookup_le(hdev, dst, dst_type);
1317         if (conn && !test_bit(HCI_CONN_SCANNING, &conn->flags)) {
1318                 return ERR_PTR(-EBUSY);
1319         }
1320
1321         /* Check if the destination address has been resolved by the controller
1322          * since if it did then the identity address shall be used.
1323          */
1324         if (!dst_resolved) {
1325                 /* When given an identity address with existing identity
1326                  * resolving key, the connection needs to be established
1327                  * to a resolvable random address.
1328                  *
1329                  * Storing the resolvable random address is required here
1330                  * to handle connection failures. The address will later
1331                  * be resolved back into the original identity address
1332                  * from the connect request.
1333                  */
1334                 irk = hci_find_irk_by_addr(hdev, dst, dst_type);
1335                 if (irk && bacmp(&irk->rpa, BDADDR_ANY)) {
1336                         dst = &irk->rpa;
1337                         dst_type = ADDR_LE_DEV_RANDOM;
1338                 }
1339         }
1340
1341         if (conn) {
1342                 bacpy(&conn->dst, dst);
1343         } else {
1344                 conn = hci_conn_add(hdev, LE_LINK, dst, role);
1345                 if (!conn)
1346                         return ERR_PTR(-ENOMEM);
1347                 hci_conn_hold(conn);
1348                 conn->pending_sec_level = sec_level;
1349         }
1350
1351         conn->dst_type = dst_type;
1352         conn->sec_level = BT_SECURITY_LOW;
1353         conn->conn_timeout = conn_timeout;
1354
1355         clear_bit(HCI_CONN_SCANNING, &conn->flags);
1356
1357         err = hci_cmd_sync_queue(hdev, hci_connect_le_sync,
1358                                  ERR_PTR(conn->handle),
1359                                  create_le_conn_complete);
1360         if (err) {
1361                 hci_conn_del(conn);
1362                 return ERR_PTR(err);
1363         }
1364
1365         return conn;
1366 }
1367
1368 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
1369 {
1370         struct hci_conn *conn;
1371
1372         conn = hci_conn_hash_lookup_le(hdev, addr, type);
1373         if (!conn)
1374                 return false;
1375
1376         if (conn->state != BT_CONNECTED)
1377                 return false;
1378
1379         return true;
1380 }
1381
1382 /* This function requires the caller holds hdev->lock */
1383 static int hci_explicit_conn_params_set(struct hci_dev *hdev,
1384                                         bdaddr_t *addr, u8 addr_type)
1385 {
1386         struct hci_conn_params *params;
1387
1388         if (is_connected(hdev, addr, addr_type))
1389                 return -EISCONN;
1390
1391         params = hci_conn_params_lookup(hdev, addr, addr_type);
1392         if (!params) {
1393                 params = hci_conn_params_add(hdev, addr, addr_type);
1394                 if (!params)
1395                         return -ENOMEM;
1396
1397                 /* If we created new params, mark them to be deleted in
1398                  * hci_connect_le_scan_cleanup. It's different case than
1399                  * existing disabled params, those will stay after cleanup.
1400                  */
1401                 params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
1402         }
1403
1404         /* We're trying to connect, so make sure params are at pend_le_conns */
1405         if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
1406             params->auto_connect == HCI_AUTO_CONN_REPORT ||
1407             params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
1408                 hci_pend_le_list_del_init(params);
1409                 hci_pend_le_list_add(params, &hdev->pend_le_conns);
1410         }
1411
1412         params->explicit_connect = true;
1413
1414         BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
1415                params->auto_connect);
1416
1417         return 0;
1418 }
1419
1420 static int qos_set_big(struct hci_dev *hdev, struct bt_iso_qos *qos)
1421 {
1422         struct hci_conn *conn;
1423         u8  big;
1424
1425         /* Allocate a BIG if not set */
1426         if (qos->bcast.big == BT_ISO_QOS_BIG_UNSET) {
1427                 for (big = 0x00; big < 0xef; big++) {
1428
1429                         conn = hci_conn_hash_lookup_big(hdev, big);
1430                         if (!conn)
1431                                 break;
1432                 }
1433
1434                 if (big == 0xef)
1435                         return -EADDRNOTAVAIL;
1436
1437                 /* Update BIG */
1438                 qos->bcast.big = big;
1439         }
1440
1441         return 0;
1442 }
1443
1444 static int qos_set_bis(struct hci_dev *hdev, struct bt_iso_qos *qos)
1445 {
1446         struct hci_conn *conn;
1447         u8  bis;
1448
1449         /* Allocate BIS if not set */
1450         if (qos->bcast.bis == BT_ISO_QOS_BIS_UNSET) {
1451                 /* Find an unused adv set to advertise BIS, skip instance 0x00
1452                  * since it is reserved as general purpose set.
1453                  */
1454                 for (bis = 0x01; bis < hdev->le_num_of_adv_sets;
1455                      bis++) {
1456
1457                         conn = hci_conn_hash_lookup_bis(hdev, BDADDR_ANY, bis);
1458                         if (!conn)
1459                                 break;
1460                 }
1461
1462                 if (bis == hdev->le_num_of_adv_sets)
1463                         return -EADDRNOTAVAIL;
1464
1465                 /* Update BIS */
1466                 qos->bcast.bis = bis;
1467         }
1468
1469         return 0;
1470 }
1471
1472 /* This function requires the caller holds hdev->lock */
1473 static struct hci_conn *hci_add_bis(struct hci_dev *hdev, bdaddr_t *dst,
1474                                     struct bt_iso_qos *qos, __u8 base_len,
1475                                     __u8 *base)
1476 {
1477         struct hci_conn *conn;
1478         int err;
1479
1480         /* Let's make sure that le is enabled.*/
1481         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1482                 if (lmp_le_capable(hdev))
1483                         return ERR_PTR(-ECONNREFUSED);
1484                 return ERR_PTR(-EOPNOTSUPP);
1485         }
1486
1487         err = qos_set_big(hdev, qos);
1488         if (err)
1489                 return ERR_PTR(err);
1490
1491         err = qos_set_bis(hdev, qos);
1492         if (err)
1493                 return ERR_PTR(err);
1494
1495         /* Check if the LE Create BIG command has already been sent */
1496         conn = hci_conn_hash_lookup_per_adv_bis(hdev, dst, qos->bcast.big,
1497                                                 qos->bcast.big);
1498         if (conn)
1499                 return ERR_PTR(-EADDRINUSE);
1500
1501         /* Check BIS settings against other bound BISes, since all
1502          * BISes in a BIG must have the same value for all parameters
1503          */
1504         conn = hci_conn_hash_lookup_big(hdev, qos->bcast.big);
1505
1506         if (conn && (memcmp(qos, &conn->iso_qos, sizeof(*qos)) ||
1507                      base_len != conn->le_per_adv_data_len ||
1508                      memcmp(conn->le_per_adv_data, base, base_len)))
1509                 return ERR_PTR(-EADDRINUSE);
1510
1511         conn = hci_conn_add(hdev, ISO_LINK, dst, HCI_ROLE_MASTER);
1512         if (!conn)
1513                 return ERR_PTR(-ENOMEM);
1514
1515         conn->state = BT_CONNECT;
1516
1517         hci_conn_hold(conn);
1518         return conn;
1519 }
1520
1521 /* This function requires the caller holds hdev->lock */
1522 struct hci_conn *hci_connect_le_scan(struct hci_dev *hdev, bdaddr_t *dst,
1523                                      u8 dst_type, u8 sec_level,
1524                                      u16 conn_timeout,
1525                                      enum conn_reasons conn_reason)
1526 {
1527         struct hci_conn *conn;
1528
1529         /* Let's make sure that le is enabled.*/
1530         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1531                 if (lmp_le_capable(hdev))
1532                         return ERR_PTR(-ECONNREFUSED);
1533
1534                 return ERR_PTR(-EOPNOTSUPP);
1535         }
1536
1537         /* Some devices send ATT messages as soon as the physical link is
1538          * established. To be able to handle these ATT messages, the user-
1539          * space first establishes the connection and then starts the pairing
1540          * process.
1541          *
1542          * So if a hci_conn object already exists for the following connection
1543          * attempt, we simply update pending_sec_level and auth_type fields
1544          * and return the object found.
1545          */
1546         conn = hci_conn_hash_lookup_le(hdev, dst, dst_type);
1547         if (conn) {
1548                 if (conn->pending_sec_level < sec_level)
1549                         conn->pending_sec_level = sec_level;
1550                 goto done;
1551         }
1552
1553         BT_DBG("requesting refresh of dst_addr");
1554
1555         conn = hci_conn_add(hdev, LE_LINK, dst, HCI_ROLE_MASTER);
1556         if (!conn)
1557                 return ERR_PTR(-ENOMEM);
1558
1559         if (hci_explicit_conn_params_set(hdev, dst, dst_type) < 0) {
1560                 hci_conn_del(conn);
1561                 return ERR_PTR(-EBUSY);
1562         }
1563
1564         conn->state = BT_CONNECT;
1565         set_bit(HCI_CONN_SCANNING, &conn->flags);
1566         conn->dst_type = dst_type;
1567         conn->sec_level = BT_SECURITY_LOW;
1568         conn->pending_sec_level = sec_level;
1569         conn->conn_timeout = conn_timeout;
1570         conn->conn_reason = conn_reason;
1571
1572         hci_update_passive_scan(hdev);
1573
1574 done:
1575         hci_conn_hold(conn);
1576         return conn;
1577 }
1578
1579 struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst,
1580                                  u8 sec_level, u8 auth_type,
1581                                  enum conn_reasons conn_reason)
1582 {
1583         struct hci_conn *acl;
1584
1585         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1586                 if (lmp_bredr_capable(hdev))
1587                         return ERR_PTR(-ECONNREFUSED);
1588
1589                 return ERR_PTR(-EOPNOTSUPP);
1590         }
1591
1592         acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
1593         if (!acl) {
1594                 acl = hci_conn_add(hdev, ACL_LINK, dst, HCI_ROLE_MASTER);
1595                 if (!acl)
1596                         return ERR_PTR(-ENOMEM);
1597         }
1598
1599         hci_conn_hold(acl);
1600
1601         acl->conn_reason = conn_reason;
1602         if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
1603                 acl->sec_level = BT_SECURITY_LOW;
1604                 acl->pending_sec_level = sec_level;
1605                 acl->auth_type = auth_type;
1606                 hci_acl_create_connection(acl);
1607         }
1608
1609         return acl;
1610 }
1611
1612 static struct hci_link *hci_conn_link(struct hci_conn *parent,
1613                                       struct hci_conn *conn)
1614 {
1615         struct hci_dev *hdev = parent->hdev;
1616         struct hci_link *link;
1617
1618         bt_dev_dbg(hdev, "parent %p hcon %p", parent, conn);
1619
1620         if (conn->link)
1621                 return conn->link;
1622
1623         if (conn->parent)
1624                 return NULL;
1625
1626         link = kzalloc(sizeof(*link), GFP_KERNEL);
1627         if (!link)
1628                 return NULL;
1629
1630         link->conn = hci_conn_hold(conn);
1631         conn->link = link;
1632         conn->parent = hci_conn_get(parent);
1633
1634         /* Use list_add_tail_rcu append to the list */
1635         list_add_tail_rcu(&link->list, &parent->link_list);
1636
1637         return link;
1638 }
1639
1640 struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type, bdaddr_t *dst,
1641                                  __u16 setting, struct bt_codec *codec)
1642 {
1643         struct hci_conn *acl;
1644         struct hci_conn *sco;
1645         struct hci_link *link;
1646
1647         acl = hci_connect_acl(hdev, dst, BT_SECURITY_LOW, HCI_AT_NO_BONDING,
1648                               CONN_REASON_SCO_CONNECT);
1649         if (IS_ERR(acl))
1650                 return acl;
1651
1652         sco = hci_conn_hash_lookup_ba(hdev, type, dst);
1653         if (!sco) {
1654                 sco = hci_conn_add(hdev, type, dst, HCI_ROLE_MASTER);
1655                 if (!sco) {
1656                         hci_conn_drop(acl);
1657                         return ERR_PTR(-ENOMEM);
1658                 }
1659         }
1660
1661         link = hci_conn_link(acl, sco);
1662         if (!link) {
1663                 hci_conn_drop(acl);
1664                 hci_conn_drop(sco);
1665                 return ERR_PTR(-ENOLINK);
1666         }
1667
1668         sco->setting = setting;
1669         sco->codec = *codec;
1670
1671         if (acl->state == BT_CONNECTED &&
1672             (sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
1673                 set_bit(HCI_CONN_POWER_SAVE, &acl->flags);
1674                 hci_conn_enter_active_mode(acl, BT_POWER_FORCE_ACTIVE_ON);
1675
1676                 if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->flags)) {
1677                         /* defer SCO setup until mode change completed */
1678                         set_bit(HCI_CONN_SCO_SETUP_PEND, &acl->flags);
1679                         return sco;
1680                 }
1681
1682                 hci_sco_setup(acl, 0x00);
1683         }
1684
1685         return sco;
1686 }
1687
1688 static void cis_add(struct iso_list_data *d, struct bt_iso_qos *qos)
1689 {
1690         struct hci_cis_params *cis = &d->pdu.cis[d->pdu.cp.num_cis];
1691
1692         cis->cis_id = qos->ucast.cis;
1693         cis->c_sdu  = cpu_to_le16(qos->ucast.out.sdu);
1694         cis->p_sdu  = cpu_to_le16(qos->ucast.in.sdu);
1695         cis->c_phy  = qos->ucast.out.phy ? qos->ucast.out.phy : qos->ucast.in.phy;
1696         cis->p_phy  = qos->ucast.in.phy ? qos->ucast.in.phy : qos->ucast.out.phy;
1697         cis->c_rtn  = qos->ucast.out.rtn;
1698         cis->p_rtn  = qos->ucast.in.rtn;
1699
1700         d->pdu.cp.num_cis++;
1701 }
1702
1703 static void cis_list(struct hci_conn *conn, void *data)
1704 {
1705         struct iso_list_data *d = data;
1706
1707         /* Skip if broadcast/ANY address */
1708         if (!bacmp(&conn->dst, BDADDR_ANY))
1709                 return;
1710
1711         if (d->cig != conn->iso_qos.ucast.cig || d->cis == BT_ISO_QOS_CIS_UNSET ||
1712             d->cis != conn->iso_qos.ucast.cis)
1713                 return;
1714
1715         d->count++;
1716
1717         if (d->pdu.cp.cig_id == BT_ISO_QOS_CIG_UNSET ||
1718             d->count >= ARRAY_SIZE(d->pdu.cis))
1719                 return;
1720
1721         cis_add(d, &conn->iso_qos);
1722 }
1723
1724 static int hci_le_create_big(struct hci_conn *conn, struct bt_iso_qos *qos)
1725 {
1726         struct hci_dev *hdev = conn->hdev;
1727         struct hci_cp_le_create_big cp;
1728         struct iso_list_data data;
1729
1730         memset(&cp, 0, sizeof(cp));
1731
1732         data.big = qos->bcast.big;
1733         data.bis = qos->bcast.bis;
1734         data.count = 0;
1735
1736         /* Create a BIS for each bound connection */
1737         hci_conn_hash_list_state(hdev, bis_list, ISO_LINK,
1738                                  BT_BOUND, &data);
1739
1740         cp.handle = qos->bcast.big;
1741         cp.adv_handle = qos->bcast.bis;
1742         cp.num_bis  = data.count;
1743         hci_cpu_to_le24(qos->bcast.out.interval, cp.bis.sdu_interval);
1744         cp.bis.sdu = cpu_to_le16(qos->bcast.out.sdu);
1745         cp.bis.latency =  cpu_to_le16(qos->bcast.out.latency);
1746         cp.bis.rtn  = qos->bcast.out.rtn;
1747         cp.bis.phy  = qos->bcast.out.phy;
1748         cp.bis.packing = qos->bcast.packing;
1749         cp.bis.framing = qos->bcast.framing;
1750         cp.bis.encryption = qos->bcast.encryption;
1751         memcpy(cp.bis.bcode, qos->bcast.bcode, sizeof(cp.bis.bcode));
1752
1753         return hci_send_cmd(hdev, HCI_OP_LE_CREATE_BIG, sizeof(cp), &cp);
1754 }
1755
1756 static void set_cig_params_complete(struct hci_dev *hdev, void *data, int err)
1757 {
1758         struct iso_cig_params *pdu = data;
1759
1760         bt_dev_dbg(hdev, "");
1761
1762         if (err)
1763                 bt_dev_err(hdev, "Unable to set CIG parameters: %d", err);
1764
1765         kfree(pdu);
1766 }
1767
1768 static int set_cig_params_sync(struct hci_dev *hdev, void *data)
1769 {
1770         struct iso_cig_params *pdu = data;
1771         u32 plen;
1772
1773         plen = sizeof(pdu->cp) + pdu->cp.num_cis * sizeof(pdu->cis[0]);
1774         return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_CIG_PARAMS, plen, pdu,
1775                                      HCI_CMD_TIMEOUT);
1776 }
1777
1778 static bool hci_le_set_cig_params(struct hci_conn *conn, struct bt_iso_qos *qos)
1779 {
1780         struct hci_dev *hdev = conn->hdev;
1781         struct iso_list_data data;
1782         struct iso_cig_params *pdu;
1783
1784         memset(&data, 0, sizeof(data));
1785
1786         /* Allocate first still reconfigurable CIG if not set */
1787         if (qos->ucast.cig == BT_ISO_QOS_CIG_UNSET) {
1788                 for (data.cig = 0x00; data.cig < 0xf0; data.cig++) {
1789                         data.count = 0;
1790
1791                         hci_conn_hash_list_state(hdev, find_cis, ISO_LINK,
1792                                                  BT_CONNECT, &data);
1793                         if (data.count)
1794                                 continue;
1795
1796                         hci_conn_hash_list_state(hdev, find_cis, ISO_LINK,
1797                                                  BT_CONNECTED, &data);
1798                         if (!data.count)
1799                                 break;
1800                 }
1801
1802                 if (data.cig == 0xf0)
1803                         return false;
1804
1805                 /* Update CIG */
1806                 qos->ucast.cig = data.cig;
1807         }
1808
1809         data.pdu.cp.cig_id = qos->ucast.cig;
1810         hci_cpu_to_le24(qos->ucast.out.interval, data.pdu.cp.c_interval);
1811         hci_cpu_to_le24(qos->ucast.in.interval, data.pdu.cp.p_interval);
1812         data.pdu.cp.sca = qos->ucast.sca;
1813         data.pdu.cp.packing = qos->ucast.packing;
1814         data.pdu.cp.framing = qos->ucast.framing;
1815         data.pdu.cp.c_latency = cpu_to_le16(qos->ucast.out.latency);
1816         data.pdu.cp.p_latency = cpu_to_le16(qos->ucast.in.latency);
1817
1818         if (qos->ucast.cis != BT_ISO_QOS_CIS_UNSET) {
1819                 data.count = 0;
1820                 data.cig = qos->ucast.cig;
1821                 data.cis = qos->ucast.cis;
1822
1823                 hci_conn_hash_list_state(hdev, cis_list, ISO_LINK, BT_BOUND,
1824                                          &data);
1825                 if (data.count)
1826                         return false;
1827
1828                 cis_add(&data, qos);
1829         }
1830
1831         /* Reprogram all CIS(s) with the same CIG */
1832         for (data.cig = qos->ucast.cig, data.cis = 0x00; data.cis < 0x11;
1833              data.cis++) {
1834                 data.count = 0;
1835
1836                 hci_conn_hash_list_state(hdev, cis_list, ISO_LINK, BT_BOUND,
1837                                          &data);
1838                 if (data.count)
1839                         continue;
1840
1841                 /* Allocate a CIS if not set */
1842                 if (qos->ucast.cis == BT_ISO_QOS_CIS_UNSET) {
1843                         /* Update CIS */
1844                         qos->ucast.cis = data.cis;
1845                         cis_add(&data, qos);
1846                 }
1847         }
1848
1849         if (qos->ucast.cis == BT_ISO_QOS_CIS_UNSET || !data.pdu.cp.num_cis)
1850                 return false;
1851
1852         pdu = kmemdup(&data.pdu, sizeof(*pdu), GFP_KERNEL);
1853         if (!pdu)
1854                 return false;
1855
1856         if (hci_cmd_sync_queue(hdev, set_cig_params_sync, pdu,
1857                                set_cig_params_complete) < 0) {
1858                 kfree(pdu);
1859                 return false;
1860         }
1861
1862         return true;
1863 }
1864
1865 struct hci_conn *hci_bind_cis(struct hci_dev *hdev, bdaddr_t *dst,
1866                               __u8 dst_type, struct bt_iso_qos *qos)
1867 {
1868         struct hci_conn *cis;
1869
1870         cis = hci_conn_hash_lookup_cis(hdev, dst, dst_type, qos->ucast.cig,
1871                                        qos->ucast.cis);
1872         if (!cis) {
1873                 cis = hci_conn_add(hdev, ISO_LINK, dst, HCI_ROLE_MASTER);
1874                 if (!cis)
1875                         return ERR_PTR(-ENOMEM);
1876                 cis->cleanup = cis_cleanup;
1877                 cis->dst_type = dst_type;
1878         }
1879
1880         if (cis->state == BT_CONNECTED)
1881                 return cis;
1882
1883         /* Check if CIS has been set and the settings matches */
1884         if (cis->state == BT_BOUND &&
1885             !memcmp(&cis->iso_qos, qos, sizeof(*qos)))
1886                 return cis;
1887
1888         /* Update LINK PHYs according to QoS preference */
1889         cis->le_tx_phy = qos->ucast.out.phy;
1890         cis->le_rx_phy = qos->ucast.in.phy;
1891
1892         /* If output interval is not set use the input interval as it cannot be
1893          * 0x000000.
1894          */
1895         if (!qos->ucast.out.interval)
1896                 qos->ucast.out.interval = qos->ucast.in.interval;
1897
1898         /* If input interval is not set use the output interval as it cannot be
1899          * 0x000000.
1900          */
1901         if (!qos->ucast.in.interval)
1902                 qos->ucast.in.interval = qos->ucast.out.interval;
1903
1904         /* If output latency is not set use the input latency as it cannot be
1905          * 0x0000.
1906          */
1907         if (!qos->ucast.out.latency)
1908                 qos->ucast.out.latency = qos->ucast.in.latency;
1909
1910         /* If input latency is not set use the output latency as it cannot be
1911          * 0x0000.
1912          */
1913         if (!qos->ucast.in.latency)
1914                 qos->ucast.in.latency = qos->ucast.out.latency;
1915
1916         if (!hci_le_set_cig_params(cis, qos)) {
1917                 hci_conn_drop(cis);
1918                 return ERR_PTR(-EINVAL);
1919         }
1920
1921         cis->iso_qos = *qos;
1922         cis->state = BT_BOUND;
1923
1924         return cis;
1925 }
1926
1927 bool hci_iso_setup_path(struct hci_conn *conn)
1928 {
1929         struct hci_dev *hdev = conn->hdev;
1930         struct hci_cp_le_setup_iso_path cmd;
1931
1932         memset(&cmd, 0, sizeof(cmd));
1933
1934         if (conn->iso_qos.ucast.out.sdu) {
1935                 cmd.handle = cpu_to_le16(conn->handle);
1936                 cmd.direction = 0x00; /* Input (Host to Controller) */
1937                 cmd.path = 0x00; /* HCI path if enabled */
1938                 cmd.codec = 0x03; /* Transparent Data */
1939
1940                 if (hci_send_cmd(hdev, HCI_OP_LE_SETUP_ISO_PATH, sizeof(cmd),
1941                                  &cmd) < 0)
1942                         return false;
1943         }
1944
1945         if (conn->iso_qos.ucast.in.sdu) {
1946                 cmd.handle = cpu_to_le16(conn->handle);
1947                 cmd.direction = 0x01; /* Output (Controller to Host) */
1948                 cmd.path = 0x00; /* HCI path if enabled */
1949                 cmd.codec = 0x03; /* Transparent Data */
1950
1951                 if (hci_send_cmd(hdev, HCI_OP_LE_SETUP_ISO_PATH, sizeof(cmd),
1952                                  &cmd) < 0)
1953                         return false;
1954         }
1955
1956         return true;
1957 }
1958
1959 int hci_conn_check_create_cis(struct hci_conn *conn)
1960 {
1961         if (conn->type != ISO_LINK || !bacmp(&conn->dst, BDADDR_ANY))
1962                 return -EINVAL;
1963
1964         if (!conn->parent || conn->parent->state != BT_CONNECTED ||
1965             conn->state != BT_CONNECT || HCI_CONN_HANDLE_UNSET(conn->handle))
1966                 return 1;
1967
1968         return 0;
1969 }
1970
1971 static int hci_create_cis_sync(struct hci_dev *hdev, void *data)
1972 {
1973         return hci_le_create_cis_sync(hdev);
1974 }
1975
1976 int hci_le_create_cis_pending(struct hci_dev *hdev)
1977 {
1978         struct hci_conn *conn;
1979         bool pending = false;
1980
1981         rcu_read_lock();
1982
1983         list_for_each_entry_rcu(conn, &hdev->conn_hash.list, list) {
1984                 if (test_bit(HCI_CONN_CREATE_CIS, &conn->flags)) {
1985                         rcu_read_unlock();
1986                         return -EBUSY;
1987                 }
1988
1989                 if (!hci_conn_check_create_cis(conn))
1990                         pending = true;
1991         }
1992
1993         rcu_read_unlock();
1994
1995         if (!pending)
1996                 return 0;
1997
1998         /* Queue Create CIS */
1999         return hci_cmd_sync_queue(hdev, hci_create_cis_sync, NULL, NULL);
2000 }
2001
2002 static void hci_iso_qos_setup(struct hci_dev *hdev, struct hci_conn *conn,
2003                               struct bt_iso_io_qos *qos, __u8 phy)
2004 {
2005         /* Only set MTU if PHY is enabled */
2006         if (!qos->sdu && qos->phy) {
2007                 if (hdev->iso_mtu > 0)
2008                         qos->sdu = hdev->iso_mtu;
2009                 else if (hdev->le_mtu > 0)
2010                         qos->sdu = hdev->le_mtu;
2011                 else
2012                         qos->sdu = hdev->acl_mtu;
2013         }
2014
2015         /* Use the same PHY as ACL if set to any */
2016         if (qos->phy == BT_ISO_PHY_ANY)
2017                 qos->phy = phy;
2018
2019         /* Use LE ACL connection interval if not set */
2020         if (!qos->interval)
2021                 /* ACL interval unit in 1.25 ms to us */
2022                 qos->interval = conn->le_conn_interval * 1250;
2023
2024         /* Use LE ACL connection latency if not set */
2025         if (!qos->latency)
2026                 qos->latency = conn->le_conn_latency;
2027 }
2028
2029 static int create_big_sync(struct hci_dev *hdev, void *data)
2030 {
2031         struct hci_conn *conn = data;
2032         struct bt_iso_qos *qos = &conn->iso_qos;
2033         u16 interval, sync_interval = 0;
2034         u32 flags = 0;
2035         int err;
2036
2037         if (qos->bcast.out.phy == 0x02)
2038                 flags |= MGMT_ADV_FLAG_SEC_2M;
2039
2040         /* Align intervals */
2041         interval = (qos->bcast.out.interval / 1250) * qos->bcast.sync_factor;
2042
2043         if (qos->bcast.bis)
2044                 sync_interval = interval * 4;
2045
2046         err = hci_start_per_adv_sync(hdev, qos->bcast.bis, conn->le_per_adv_data_len,
2047                                      conn->le_per_adv_data, flags, interval,
2048                                      interval, sync_interval);
2049         if (err)
2050                 return err;
2051
2052         return hci_le_create_big(conn, &conn->iso_qos);
2053 }
2054
2055 static void create_pa_complete(struct hci_dev *hdev, void *data, int err)
2056 {
2057         struct hci_cp_le_pa_create_sync *cp = data;
2058
2059         bt_dev_dbg(hdev, "");
2060
2061         if (err)
2062                 bt_dev_err(hdev, "Unable to create PA: %d", err);
2063
2064         kfree(cp);
2065 }
2066
2067 static int create_pa_sync(struct hci_dev *hdev, void *data)
2068 {
2069         struct hci_cp_le_pa_create_sync *cp = data;
2070         int err;
2071
2072         err = __hci_cmd_sync_status(hdev, HCI_OP_LE_PA_CREATE_SYNC,
2073                                     sizeof(*cp), cp, HCI_CMD_TIMEOUT);
2074         if (err) {
2075                 hci_dev_clear_flag(hdev, HCI_PA_SYNC);
2076                 return err;
2077         }
2078
2079         return hci_update_passive_scan_sync(hdev);
2080 }
2081
2082 int hci_pa_create_sync(struct hci_dev *hdev, bdaddr_t *dst, __u8 dst_type,
2083                        __u8 sid, struct bt_iso_qos *qos)
2084 {
2085         struct hci_cp_le_pa_create_sync *cp;
2086
2087         if (hci_dev_test_and_set_flag(hdev, HCI_PA_SYNC))
2088                 return -EBUSY;
2089
2090         cp = kzalloc(sizeof(*cp), GFP_KERNEL);
2091         if (!cp) {
2092                 hci_dev_clear_flag(hdev, HCI_PA_SYNC);
2093                 return -ENOMEM;
2094         }
2095
2096         cp->options = qos->bcast.options;
2097         cp->sid = sid;
2098         cp->addr_type = dst_type;
2099         bacpy(&cp->addr, dst);
2100         cp->skip = cpu_to_le16(qos->bcast.skip);
2101         cp->sync_timeout = cpu_to_le16(qos->bcast.sync_timeout);
2102         cp->sync_cte_type = qos->bcast.sync_cte_type;
2103
2104         /* Queue start pa_create_sync and scan */
2105         return hci_cmd_sync_queue(hdev, create_pa_sync, cp, create_pa_complete);
2106 }
2107
2108 int hci_le_big_create_sync(struct hci_dev *hdev, struct bt_iso_qos *qos,
2109                            __u16 sync_handle, __u8 num_bis, __u8 bis[])
2110 {
2111         struct _packed {
2112                 struct hci_cp_le_big_create_sync cp;
2113                 __u8  bis[0x11];
2114         } pdu;
2115         int err;
2116
2117         if (num_bis > sizeof(pdu.bis))
2118                 return -EINVAL;
2119
2120         err = qos_set_big(hdev, qos);
2121         if (err)
2122                 return err;
2123
2124         memset(&pdu, 0, sizeof(pdu));
2125         pdu.cp.handle = qos->bcast.big;
2126         pdu.cp.sync_handle = cpu_to_le16(sync_handle);
2127         pdu.cp.encryption = qos->bcast.encryption;
2128         memcpy(pdu.cp.bcode, qos->bcast.bcode, sizeof(pdu.cp.bcode));
2129         pdu.cp.mse = qos->bcast.mse;
2130         pdu.cp.timeout = cpu_to_le16(qos->bcast.timeout);
2131         pdu.cp.num_bis = num_bis;
2132         memcpy(pdu.bis, bis, num_bis);
2133
2134         return hci_send_cmd(hdev, HCI_OP_LE_BIG_CREATE_SYNC,
2135                             sizeof(pdu.cp) + num_bis, &pdu);
2136 }
2137
2138 static void create_big_complete(struct hci_dev *hdev, void *data, int err)
2139 {
2140         struct hci_conn *conn = data;
2141
2142         bt_dev_dbg(hdev, "conn %p", conn);
2143
2144         if (err) {
2145                 bt_dev_err(hdev, "Unable to create BIG: %d", err);
2146                 hci_connect_cfm(conn, err);
2147                 hci_conn_del(conn);
2148         }
2149 }
2150
2151 struct hci_conn *hci_bind_bis(struct hci_dev *hdev, bdaddr_t *dst,
2152                               struct bt_iso_qos *qos,
2153                               __u8 base_len, __u8 *base)
2154 {
2155         struct hci_conn *conn;
2156         __u8 eir[HCI_MAX_PER_AD_LENGTH];
2157
2158         if (base_len && base)
2159                 base_len = eir_append_service_data(eir, 0,  0x1851,
2160                                                    base, base_len);
2161
2162         /* We need hci_conn object using the BDADDR_ANY as dst */
2163         conn = hci_add_bis(hdev, dst, qos, base_len, eir);
2164         if (IS_ERR(conn))
2165                 return conn;
2166
2167         /* Update LINK PHYs according to QoS preference */
2168         conn->le_tx_phy = qos->bcast.out.phy;
2169         conn->le_tx_phy = qos->bcast.out.phy;
2170
2171         /* Add Basic Announcement into Peridic Adv Data if BASE is set */
2172         if (base_len && base) {
2173                 memcpy(conn->le_per_adv_data,  eir, sizeof(eir));
2174                 conn->le_per_adv_data_len = base_len;
2175         }
2176
2177         hci_iso_qos_setup(hdev, conn, &qos->bcast.out,
2178                           conn->le_tx_phy ? conn->le_tx_phy :
2179                           hdev->le_tx_def_phys);
2180
2181         conn->iso_qos = *qos;
2182         conn->state = BT_BOUND;
2183
2184         return conn;
2185 }
2186
2187 static void bis_mark_per_adv(struct hci_conn *conn, void *data)
2188 {
2189         struct iso_list_data *d = data;
2190
2191         /* Skip if not broadcast/ANY address */
2192         if (bacmp(&conn->dst, BDADDR_ANY))
2193                 return;
2194
2195         if (d->big != conn->iso_qos.bcast.big ||
2196             d->bis == BT_ISO_QOS_BIS_UNSET ||
2197             d->bis != conn->iso_qos.bcast.bis)
2198                 return;
2199
2200         set_bit(HCI_CONN_PER_ADV, &conn->flags);
2201 }
2202
2203 struct hci_conn *hci_connect_bis(struct hci_dev *hdev, bdaddr_t *dst,
2204                                  __u8 dst_type, struct bt_iso_qos *qos,
2205                                  __u8 base_len, __u8 *base)
2206 {
2207         struct hci_conn *conn;
2208         int err;
2209         struct iso_list_data data;
2210
2211         conn = hci_bind_bis(hdev, dst, qos, base_len, base);
2212         if (IS_ERR(conn))
2213                 return conn;
2214
2215         data.big = qos->bcast.big;
2216         data.bis = qos->bcast.bis;
2217
2218         /* Set HCI_CONN_PER_ADV for all bound connections, to mark that
2219          * the start periodic advertising and create BIG commands have
2220          * been queued
2221          */
2222         hci_conn_hash_list_state(hdev, bis_mark_per_adv, ISO_LINK,
2223                                  BT_BOUND, &data);
2224
2225         /* Queue start periodic advertising and create BIG */
2226         err = hci_cmd_sync_queue(hdev, create_big_sync, conn,
2227                                  create_big_complete);
2228         if (err < 0) {
2229                 hci_conn_drop(conn);
2230                 return ERR_PTR(err);
2231         }
2232
2233         return conn;
2234 }
2235
2236 struct hci_conn *hci_connect_cis(struct hci_dev *hdev, bdaddr_t *dst,
2237                                  __u8 dst_type, struct bt_iso_qos *qos)
2238 {
2239         struct hci_conn *le;
2240         struct hci_conn *cis;
2241         struct hci_link *link;
2242
2243         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
2244                 le = hci_connect_le(hdev, dst, dst_type, false,
2245                                     BT_SECURITY_LOW,
2246                                     HCI_LE_CONN_TIMEOUT,
2247                                     HCI_ROLE_SLAVE);
2248         else
2249                 le = hci_connect_le_scan(hdev, dst, dst_type,
2250                                          BT_SECURITY_LOW,
2251                                          HCI_LE_CONN_TIMEOUT,
2252                                          CONN_REASON_ISO_CONNECT);
2253         if (IS_ERR(le))
2254                 return le;
2255
2256         hci_iso_qos_setup(hdev, le, &qos->ucast.out,
2257                           le->le_tx_phy ? le->le_tx_phy : hdev->le_tx_def_phys);
2258         hci_iso_qos_setup(hdev, le, &qos->ucast.in,
2259                           le->le_rx_phy ? le->le_rx_phy : hdev->le_rx_def_phys);
2260
2261         cis = hci_bind_cis(hdev, dst, dst_type, qos);
2262         if (IS_ERR(cis)) {
2263                 hci_conn_drop(le);
2264                 return cis;
2265         }
2266
2267         link = hci_conn_link(le, cis);
2268         if (!link) {
2269                 hci_conn_drop(le);
2270                 hci_conn_drop(cis);
2271                 return ERR_PTR(-ENOLINK);
2272         }
2273
2274         cis->state = BT_CONNECT;
2275
2276         hci_le_create_cis_pending(hdev);
2277
2278         return cis;
2279 }
2280
2281 /* Check link security requirement */
2282 int hci_conn_check_link_mode(struct hci_conn *conn)
2283 {
2284         BT_DBG("hcon %p", conn);
2285
2286         /* In Secure Connections Only mode, it is required that Secure
2287          * Connections is used and the link is encrypted with AES-CCM
2288          * using a P-256 authenticated combination key.
2289          */
2290         if (hci_dev_test_flag(conn->hdev, HCI_SC_ONLY)) {
2291                 if (!hci_conn_sc_enabled(conn) ||
2292                     !test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
2293                     conn->key_type != HCI_LK_AUTH_COMBINATION_P256)
2294                         return 0;
2295         }
2296
2297          /* AES encryption is required for Level 4:
2298           *
2299           * BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 3, Part C
2300           * page 1319:
2301           *
2302           * 128-bit equivalent strength for link and encryption keys
2303           * required using FIPS approved algorithms (E0 not allowed,
2304           * SAFER+ not allowed, and P-192 not allowed; encryption key
2305           * not shortened)
2306           */
2307         if (conn->sec_level == BT_SECURITY_FIPS &&
2308             !test_bit(HCI_CONN_AES_CCM, &conn->flags)) {
2309                 bt_dev_err(conn->hdev,
2310                            "Invalid security: Missing AES-CCM usage");
2311                 return 0;
2312         }
2313
2314         if (hci_conn_ssp_enabled(conn) &&
2315             !test_bit(HCI_CONN_ENCRYPT, &conn->flags))
2316                 return 0;
2317
2318         return 1;
2319 }
2320
2321 /* Authenticate remote device */
2322 static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
2323 {
2324         BT_DBG("hcon %p", conn);
2325
2326         if (conn->pending_sec_level > sec_level)
2327                 sec_level = conn->pending_sec_level;
2328
2329         if (sec_level > conn->sec_level)
2330                 conn->pending_sec_level = sec_level;
2331         else if (test_bit(HCI_CONN_AUTH, &conn->flags))
2332                 return 1;
2333
2334         /* Make sure we preserve an existing MITM requirement*/
2335         auth_type |= (conn->auth_type & 0x01);
2336
2337         conn->auth_type = auth_type;
2338
2339         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
2340                 struct hci_cp_auth_requested cp;
2341
2342                 cp.handle = cpu_to_le16(conn->handle);
2343                 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
2344                              sizeof(cp), &cp);
2345
2346                 /* If we're already encrypted set the REAUTH_PEND flag,
2347                  * otherwise set the ENCRYPT_PEND.
2348                  */
2349                 if (test_bit(HCI_CONN_ENCRYPT, &conn->flags))
2350                         set_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
2351                 else
2352                         set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2353         }
2354
2355         return 0;
2356 }
2357
2358 /* Encrypt the link */
2359 static void hci_conn_encrypt(struct hci_conn *conn)
2360 {
2361         BT_DBG("hcon %p", conn);
2362
2363         if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
2364                 struct hci_cp_set_conn_encrypt cp;
2365                 cp.handle  = cpu_to_le16(conn->handle);
2366                 cp.encrypt = 0x01;
2367                 hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2368                              &cp);
2369         }
2370 }
2371
2372 /* Enable security */
2373 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type,
2374                       bool initiator)
2375 {
2376         BT_DBG("hcon %p", conn);
2377
2378         if (conn->type == LE_LINK)
2379                 return smp_conn_security(conn, sec_level);
2380
2381         /* For sdp we don't need the link key. */
2382         if (sec_level == BT_SECURITY_SDP)
2383                 return 1;
2384
2385         /* For non 2.1 devices and low security level we don't need the link
2386            key. */
2387         if (sec_level == BT_SECURITY_LOW && !hci_conn_ssp_enabled(conn))
2388                 return 1;
2389
2390         /* For other security levels we need the link key. */
2391         if (!test_bit(HCI_CONN_AUTH, &conn->flags))
2392                 goto auth;
2393
2394         /* An authenticated FIPS approved combination key has sufficient
2395          * security for security level 4. */
2396         if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256 &&
2397             sec_level == BT_SECURITY_FIPS)
2398                 goto encrypt;
2399
2400         /* An authenticated combination key has sufficient security for
2401            security level 3. */
2402         if ((conn->key_type == HCI_LK_AUTH_COMBINATION_P192 ||
2403              conn->key_type == HCI_LK_AUTH_COMBINATION_P256) &&
2404             sec_level == BT_SECURITY_HIGH)
2405                 goto encrypt;
2406
2407         /* An unauthenticated combination key has sufficient security for
2408            security level 1 and 2. */
2409         if ((conn->key_type == HCI_LK_UNAUTH_COMBINATION_P192 ||
2410              conn->key_type == HCI_LK_UNAUTH_COMBINATION_P256) &&
2411             (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW))
2412                 goto encrypt;
2413
2414         /* A combination key has always sufficient security for the security
2415            levels 1 or 2. High security level requires the combination key
2416            is generated using maximum PIN code length (16).
2417            For pre 2.1 units. */
2418         if (conn->key_type == HCI_LK_COMBINATION &&
2419             (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW ||
2420              conn->pin_length == 16))
2421                 goto encrypt;
2422
2423 auth:
2424         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags))
2425                 return 0;
2426
2427         if (initiator)
2428                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
2429
2430         if (!hci_conn_auth(conn, sec_level, auth_type))
2431                 return 0;
2432
2433 encrypt:
2434         if (test_bit(HCI_CONN_ENCRYPT, &conn->flags)) {
2435                 /* Ensure that the encryption key size has been read,
2436                  * otherwise stall the upper layer responses.
2437                  */
2438                 if (!conn->enc_key_size)
2439                         return 0;
2440
2441                 /* Nothing else needed, all requirements are met */
2442                 return 1;
2443         }
2444
2445         hci_conn_encrypt(conn);
2446         return 0;
2447 }
2448 EXPORT_SYMBOL(hci_conn_security);
2449
2450 /* Check secure link requirement */
2451 int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level)
2452 {
2453         BT_DBG("hcon %p", conn);
2454
2455         /* Accept if non-secure or higher security level is required */
2456         if (sec_level != BT_SECURITY_HIGH && sec_level != BT_SECURITY_FIPS)
2457                 return 1;
2458
2459         /* Accept if secure or higher security level is already present */
2460         if (conn->sec_level == BT_SECURITY_HIGH ||
2461             conn->sec_level == BT_SECURITY_FIPS)
2462                 return 1;
2463
2464         /* Reject not secure link */
2465         return 0;
2466 }
2467 EXPORT_SYMBOL(hci_conn_check_secure);
2468
2469 /* Switch role */
2470 int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
2471 {
2472         BT_DBG("hcon %p", conn);
2473
2474         if (role == conn->role)
2475                 return 1;
2476
2477         if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->flags)) {
2478                 struct hci_cp_switch_role cp;
2479                 bacpy(&cp.bdaddr, &conn->dst);
2480                 cp.role = role;
2481                 hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
2482         }
2483
2484         return 0;
2485 }
2486 EXPORT_SYMBOL(hci_conn_switch_role);
2487
2488 /* Enter active mode */
2489 void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
2490 {
2491         struct hci_dev *hdev = conn->hdev;
2492
2493         BT_DBG("hcon %p mode %d", conn, conn->mode);
2494
2495         if (conn->mode != HCI_CM_SNIFF)
2496                 goto timer;
2497
2498         if (!test_bit(HCI_CONN_POWER_SAVE, &conn->flags) && !force_active)
2499                 goto timer;
2500
2501         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
2502                 struct hci_cp_exit_sniff_mode cp;
2503                 cp.handle = cpu_to_le16(conn->handle);
2504                 hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
2505         }
2506
2507 timer:
2508         if (hdev->idle_timeout > 0)
2509                 queue_delayed_work(hdev->workqueue, &conn->idle_work,
2510                                    msecs_to_jiffies(hdev->idle_timeout));
2511 }
2512
2513 /* Drop all connection on the device */
2514 void hci_conn_hash_flush(struct hci_dev *hdev)
2515 {
2516         struct list_head *head = &hdev->conn_hash.list;
2517         struct hci_conn *conn;
2518
2519         BT_DBG("hdev %s", hdev->name);
2520
2521         /* We should not traverse the list here, because hci_conn_del
2522          * can remove extra links, which may cause the list traversal
2523          * to hit items that have already been released.
2524          */
2525         while ((conn = list_first_entry_or_null(head,
2526                                                 struct hci_conn,
2527                                                 list)) != NULL) {
2528                 conn->state = BT_CLOSED;
2529                 hci_disconn_cfm(conn, HCI_ERROR_LOCAL_HOST_TERM);
2530                 hci_conn_del(conn);
2531         }
2532 }
2533
2534 /* Check pending connect attempts */
2535 void hci_conn_check_pending(struct hci_dev *hdev)
2536 {
2537         struct hci_conn *conn;
2538
2539         BT_DBG("hdev %s", hdev->name);
2540
2541         hci_dev_lock(hdev);
2542
2543         conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
2544         if (conn)
2545                 hci_acl_create_connection(conn);
2546
2547         hci_dev_unlock(hdev);
2548 }
2549
2550 static u32 get_link_mode(struct hci_conn *conn)
2551 {
2552         u32 link_mode = 0;
2553
2554         if (conn->role == HCI_ROLE_MASTER)
2555                 link_mode |= HCI_LM_MASTER;
2556
2557         if (test_bit(HCI_CONN_ENCRYPT, &conn->flags))
2558                 link_mode |= HCI_LM_ENCRYPT;
2559
2560         if (test_bit(HCI_CONN_AUTH, &conn->flags))
2561                 link_mode |= HCI_LM_AUTH;
2562
2563         if (test_bit(HCI_CONN_SECURE, &conn->flags))
2564                 link_mode |= HCI_LM_SECURE;
2565
2566         if (test_bit(HCI_CONN_FIPS, &conn->flags))
2567                 link_mode |= HCI_LM_FIPS;
2568
2569         return link_mode;
2570 }
2571
2572 int hci_get_conn_list(void __user *arg)
2573 {
2574         struct hci_conn *c;
2575         struct hci_conn_list_req req, *cl;
2576         struct hci_conn_info *ci;
2577         struct hci_dev *hdev;
2578         int n = 0, size, err;
2579
2580         if (copy_from_user(&req, arg, sizeof(req)))
2581                 return -EFAULT;
2582
2583         if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
2584                 return -EINVAL;
2585
2586         size = sizeof(req) + req.conn_num * sizeof(*ci);
2587
2588         cl = kmalloc(size, GFP_KERNEL);
2589         if (!cl)
2590                 return -ENOMEM;
2591
2592         hdev = hci_dev_get(req.dev_id);
2593         if (!hdev) {
2594                 kfree(cl);
2595                 return -ENODEV;
2596         }
2597
2598         ci = cl->conn_info;
2599
2600         hci_dev_lock(hdev);
2601         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2602                 bacpy(&(ci + n)->bdaddr, &c->dst);
2603                 (ci + n)->handle = c->handle;
2604                 (ci + n)->type  = c->type;
2605                 (ci + n)->out   = c->out;
2606                 (ci + n)->state = c->state;
2607                 (ci + n)->link_mode = get_link_mode(c);
2608                 if (++n >= req.conn_num)
2609                         break;
2610         }
2611         hci_dev_unlock(hdev);
2612
2613         cl->dev_id = hdev->id;
2614         cl->conn_num = n;
2615         size = sizeof(req) + n * sizeof(*ci);
2616
2617         hci_dev_put(hdev);
2618
2619         err = copy_to_user(arg, cl, size);
2620         kfree(cl);
2621
2622         return err ? -EFAULT : 0;
2623 }
2624
2625 int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
2626 {
2627         struct hci_conn_info_req req;
2628         struct hci_conn_info ci;
2629         struct hci_conn *conn;
2630         char __user *ptr = arg + sizeof(req);
2631
2632         if (copy_from_user(&req, arg, sizeof(req)))
2633                 return -EFAULT;
2634
2635         hci_dev_lock(hdev);
2636         conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
2637         if (conn) {
2638                 bacpy(&ci.bdaddr, &conn->dst);
2639                 ci.handle = conn->handle;
2640                 ci.type  = conn->type;
2641                 ci.out   = conn->out;
2642                 ci.state = conn->state;
2643                 ci.link_mode = get_link_mode(conn);
2644         }
2645         hci_dev_unlock(hdev);
2646
2647         if (!conn)
2648                 return -ENOENT;
2649
2650         return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
2651 }
2652
2653 int hci_get_auth_info(struct hci_dev *hdev, void __user *arg)
2654 {
2655         struct hci_auth_info_req req;
2656         struct hci_conn *conn;
2657
2658         if (copy_from_user(&req, arg, sizeof(req)))
2659                 return -EFAULT;
2660
2661         hci_dev_lock(hdev);
2662         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr);
2663         if (conn)
2664                 req.type = conn->auth_type;
2665         hci_dev_unlock(hdev);
2666
2667         if (!conn)
2668                 return -ENOENT;
2669
2670         return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0;
2671 }
2672
2673 struct hci_chan *hci_chan_create(struct hci_conn *conn)
2674 {
2675         struct hci_dev *hdev = conn->hdev;
2676         struct hci_chan *chan;
2677
2678         BT_DBG("%s hcon %p", hdev->name, conn);
2679
2680         if (test_bit(HCI_CONN_DROP, &conn->flags)) {
2681                 BT_DBG("Refusing to create new hci_chan");
2682                 return NULL;
2683         }
2684
2685         chan = kzalloc(sizeof(*chan), GFP_KERNEL);
2686         if (!chan)
2687                 return NULL;
2688
2689         chan->conn = hci_conn_get(conn);
2690         skb_queue_head_init(&chan->data_q);
2691         chan->state = BT_CONNECTED;
2692
2693         list_add_rcu(&chan->list, &conn->chan_list);
2694
2695         return chan;
2696 }
2697
2698 void hci_chan_del(struct hci_chan *chan)
2699 {
2700         struct hci_conn *conn = chan->conn;
2701         struct hci_dev *hdev = conn->hdev;
2702
2703         BT_DBG("%s hcon %p chan %p", hdev->name, conn, chan);
2704
2705         list_del_rcu(&chan->list);
2706
2707         synchronize_rcu();
2708
2709         /* Prevent new hci_chan's to be created for this hci_conn */
2710         set_bit(HCI_CONN_DROP, &conn->flags);
2711
2712         hci_conn_put(conn);
2713
2714         skb_queue_purge(&chan->data_q);
2715         kfree(chan);
2716 }
2717
2718 void hci_chan_list_flush(struct hci_conn *conn)
2719 {
2720         struct hci_chan *chan, *n;
2721
2722         BT_DBG("hcon %p", conn);
2723
2724         list_for_each_entry_safe(chan, n, &conn->chan_list, list)
2725                 hci_chan_del(chan);
2726 }
2727
2728 static struct hci_chan *__hci_chan_lookup_handle(struct hci_conn *hcon,
2729                                                  __u16 handle)
2730 {
2731         struct hci_chan *hchan;
2732
2733         list_for_each_entry(hchan, &hcon->chan_list, list) {
2734                 if (hchan->handle == handle)
2735                         return hchan;
2736         }
2737
2738         return NULL;
2739 }
2740
2741 struct hci_chan *hci_chan_lookup_handle(struct hci_dev *hdev, __u16 handle)
2742 {
2743         struct hci_conn_hash *h = &hdev->conn_hash;
2744         struct hci_conn *hcon;
2745         struct hci_chan *hchan = NULL;
2746
2747         rcu_read_lock();
2748
2749         list_for_each_entry_rcu(hcon, &h->list, list) {
2750                 hchan = __hci_chan_lookup_handle(hcon, handle);
2751                 if (hchan)
2752                         break;
2753         }
2754
2755         rcu_read_unlock();
2756
2757         return hchan;
2758 }
2759
2760 u32 hci_conn_get_phy(struct hci_conn *conn)
2761 {
2762         u32 phys = 0;
2763
2764         /* BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 2, Part B page 471:
2765          * Table 6.2: Packets defined for synchronous, asynchronous, and
2766          * CPB logical transport types.
2767          */
2768         switch (conn->type) {
2769         case SCO_LINK:
2770                 /* SCO logical transport (1 Mb/s):
2771                  * HV1, HV2, HV3 and DV.
2772                  */
2773                 phys |= BT_PHY_BR_1M_1SLOT;
2774
2775                 break;
2776
2777         case ACL_LINK:
2778                 /* ACL logical transport (1 Mb/s) ptt=0:
2779                  * DH1, DM3, DH3, DM5 and DH5.
2780                  */
2781                 phys |= BT_PHY_BR_1M_1SLOT;
2782
2783                 if (conn->pkt_type & (HCI_DM3 | HCI_DH3))
2784                         phys |= BT_PHY_BR_1M_3SLOT;
2785
2786                 if (conn->pkt_type & (HCI_DM5 | HCI_DH5))
2787                         phys |= BT_PHY_BR_1M_5SLOT;
2788
2789                 /* ACL logical transport (2 Mb/s) ptt=1:
2790                  * 2-DH1, 2-DH3 and 2-DH5.
2791                  */
2792                 if (!(conn->pkt_type & HCI_2DH1))
2793                         phys |= BT_PHY_EDR_2M_1SLOT;
2794
2795                 if (!(conn->pkt_type & HCI_2DH3))
2796                         phys |= BT_PHY_EDR_2M_3SLOT;
2797
2798                 if (!(conn->pkt_type & HCI_2DH5))
2799                         phys |= BT_PHY_EDR_2M_5SLOT;
2800
2801                 /* ACL logical transport (3 Mb/s) ptt=1:
2802                  * 3-DH1, 3-DH3 and 3-DH5.
2803                  */
2804                 if (!(conn->pkt_type & HCI_3DH1))
2805                         phys |= BT_PHY_EDR_3M_1SLOT;
2806
2807                 if (!(conn->pkt_type & HCI_3DH3))
2808                         phys |= BT_PHY_EDR_3M_3SLOT;
2809
2810                 if (!(conn->pkt_type & HCI_3DH5))
2811                         phys |= BT_PHY_EDR_3M_5SLOT;
2812
2813                 break;
2814
2815         case ESCO_LINK:
2816                 /* eSCO logical transport (1 Mb/s): EV3, EV4 and EV5 */
2817                 phys |= BT_PHY_BR_1M_1SLOT;
2818
2819                 if (!(conn->pkt_type & (ESCO_EV4 | ESCO_EV5)))
2820                         phys |= BT_PHY_BR_1M_3SLOT;
2821
2822                 /* eSCO logical transport (2 Mb/s): 2-EV3, 2-EV5 */
2823                 if (!(conn->pkt_type & ESCO_2EV3))
2824                         phys |= BT_PHY_EDR_2M_1SLOT;
2825
2826                 if (!(conn->pkt_type & ESCO_2EV5))
2827                         phys |= BT_PHY_EDR_2M_3SLOT;
2828
2829                 /* eSCO logical transport (3 Mb/s): 3-EV3, 3-EV5 */
2830                 if (!(conn->pkt_type & ESCO_3EV3))
2831                         phys |= BT_PHY_EDR_3M_1SLOT;
2832
2833                 if (!(conn->pkt_type & ESCO_3EV5))
2834                         phys |= BT_PHY_EDR_3M_3SLOT;
2835
2836                 break;
2837
2838         case LE_LINK:
2839                 if (conn->le_tx_phy & HCI_LE_SET_PHY_1M)
2840                         phys |= BT_PHY_LE_1M_TX;
2841
2842                 if (conn->le_rx_phy & HCI_LE_SET_PHY_1M)
2843                         phys |= BT_PHY_LE_1M_RX;
2844
2845                 if (conn->le_tx_phy & HCI_LE_SET_PHY_2M)
2846                         phys |= BT_PHY_LE_2M_TX;
2847
2848                 if (conn->le_rx_phy & HCI_LE_SET_PHY_2M)
2849                         phys |= BT_PHY_LE_2M_RX;
2850
2851                 if (conn->le_tx_phy & HCI_LE_SET_PHY_CODED)
2852                         phys |= BT_PHY_LE_CODED_TX;
2853
2854                 if (conn->le_rx_phy & HCI_LE_SET_PHY_CODED)
2855                         phys |= BT_PHY_LE_CODED_RX;
2856
2857                 break;
2858         }
2859
2860         return phys;
2861 }
2862
2863 static int abort_conn_sync(struct hci_dev *hdev, void *data)
2864 {
2865         struct hci_conn *conn;
2866         u16 handle = PTR_ERR(data);
2867
2868         conn = hci_conn_hash_lookup_handle(hdev, handle);
2869         if (!conn)
2870                 return 0;
2871
2872         return hci_abort_conn_sync(hdev, conn, conn->abort_reason);
2873 }
2874
2875 int hci_abort_conn(struct hci_conn *conn, u8 reason)
2876 {
2877         struct hci_dev *hdev = conn->hdev;
2878
2879         /* If abort_reason has already been set it means the connection is
2880          * already being aborted so don't attempt to overwrite it.
2881          */
2882         if (conn->abort_reason)
2883                 return 0;
2884
2885         bt_dev_dbg(hdev, "handle 0x%2.2x reason 0x%2.2x", conn->handle, reason);
2886
2887         conn->abort_reason = reason;
2888
2889         /* If the connection is pending check the command opcode since that
2890          * might be blocking on hci_cmd_sync_work while waiting its respective
2891          * event so we need to hci_cmd_sync_cancel to cancel it.
2892          *
2893          * hci_connect_le serializes the connection attempts so only one
2894          * connection can be in BT_CONNECT at time.
2895          */
2896         if (conn->state == BT_CONNECT && hdev->req_status == HCI_REQ_PEND) {
2897                 switch (hci_skb_event(hdev->sent_cmd)) {
2898                 case HCI_EV_LE_CONN_COMPLETE:
2899                 case HCI_EV_LE_ENHANCED_CONN_COMPLETE:
2900                 case HCI_EVT_LE_CIS_ESTABLISHED:
2901                         hci_cmd_sync_cancel(hdev, -ECANCELED);
2902                         break;
2903                 }
2904         }
2905
2906         return hci_cmd_sync_queue(hdev, abort_conn_sync, ERR_PTR(conn->handle),
2907                                   NULL);
2908 }