net/bluetooth/hci_conn.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4    Copyright 2023-2024 NXP
   5
   6    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License version 2 as
  10    published by the Free Software Foundation;
  11
  12    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  13    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  14    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  15    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  16    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  17    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  18    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  19    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  20
  21    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  22    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  23    SOFTWARE IS DISCLAIMED.
  24 */
  25
  26 /* Bluetooth HCI connection handling. */
  27
  28 #include <linux/export.h>
  29 #include <linux/debugfs.h>
  30 #include <linux/errqueue.h>
  31
  32 #include <net/bluetooth/bluetooth.h>
  33 #include <net/bluetooth/hci_core.h>
  34 #include <net/bluetooth/l2cap.h>
  35 #include <net/bluetooth/iso.h>
  36 #include <net/bluetooth/mgmt.h>
  37
  38 #include "smp.h"
  39 #include "eir.h"
  40
  41 struct sco_param {
  42         u16 pkt_type;
  43         u16 max_latency;
  44         u8  retrans_effort;
  45 };
  46
  47 struct conn_handle_t {
  48         struct hci_conn *conn;
  49         __u16 handle;
  50 };
  51
  52 static const struct sco_param esco_param_cvsd[] = {
  53         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000a,   0x01 }, /* S3 */
  54         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x0007,   0x01 }, /* S2 */
  55         { EDR_ESCO_MASK | ESCO_EV3,   0x0007,   0x01 }, /* S1 */
  56         { EDR_ESCO_MASK | ESCO_HV3,   0xffff,   0x01 }, /* D1 */
  57         { EDR_ESCO_MASK | ESCO_HV1,   0xffff,   0x01 }, /* D0 */
  58 };
  59
  60 static const struct sco_param sco_param_cvsd[] = {
  61         { EDR_ESCO_MASK | ESCO_HV3,   0xffff,   0xff }, /* D1 */
  62         { EDR_ESCO_MASK | ESCO_HV1,   0xffff,   0xff }, /* D0 */
  63 };
  64
  65 static const struct sco_param esco_param_msbc[] = {
  66         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000d,   0x02 }, /* T2 */
  67         { EDR_ESCO_MASK | ESCO_EV3,   0x0008,   0x02 }, /* T1 */
  68 };
  69
  70 /* This function requires the caller holds hdev->lock */
  71 void hci_connect_le_scan_cleanup(struct hci_conn *conn, u8 status)
  72 {
  73         struct hci_conn_params *params;
  74         struct hci_dev *hdev = conn->hdev;
  75         struct smp_irk *irk;
  76         bdaddr_t *bdaddr;
  77         u8 bdaddr_type;
  78
  79         bdaddr = &conn->dst;
  80         bdaddr_type = conn->dst_type;
  81
  82         /* Check if we need to convert to identity address */
  83         irk = hci_get_irk(hdev, bdaddr, bdaddr_type);
  84         if (irk) {
  85                 bdaddr = &irk->bdaddr;
  86                 bdaddr_type = irk->addr_type;
  87         }
  88
  89         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, bdaddr,
  90                                            bdaddr_type);
  91         if (!params)
  92                 return;
  93
  94         if (params->conn) {
  95                 hci_conn_drop(params->conn);
  96                 hci_conn_put(params->conn);
  97                 params->conn = NULL;
  98         }
  99
 100         if (!params->explicit_connect)
 101                 return;
 102
 103         /* If the status indicates successful cancellation of
 104          * the attempt (i.e. Unknown Connection Id) there's no point of
 105          * notifying failure since we'll go back to keep trying to
 106          * connect. The only exception is explicit connect requests
 107          * where a timeout + cancel does indicate an actual failure.
 108          */
 109         if (status && status != HCI_ERROR_UNKNOWN_CONN_ID)
 110                 mgmt_connect_failed(hdev, conn, status);
 111
 112         /* The connection attempt was doing scan for new RPA, and is
 113          * in scan phase. If params are not associated with any other
 114          * autoconnect action, remove them completely. If they are, just unmark
 115          * them as waiting for connection, by clearing explicit_connect field.
 116          */
 117         params->explicit_connect = false;
 118
 119         hci_pend_le_list_del_init(params);
 120
 121         switch (params->auto_connect) {
 122         case HCI_AUTO_CONN_EXPLICIT:
 123                 hci_conn_params_del(hdev, bdaddr, bdaddr_type);
 124                 /* return instead of break to avoid duplicate scan update */
 125                 return;
 126         case HCI_AUTO_CONN_DIRECT:
 127         case HCI_AUTO_CONN_ALWAYS:
 128                 hci_pend_le_list_add(params, &hdev->pend_le_conns);
 129                 break;
 130         case HCI_AUTO_CONN_REPORT:
 131                 hci_pend_le_list_add(params, &hdev->pend_le_reports);
 132                 break;
 133         default:
 134                 break;
 135         }
 136
 137         hci_update_passive_scan(hdev);
 138 }
 139
 140 static void hci_conn_cleanup(struct hci_conn *conn)
 141 {
 142         struct hci_dev *hdev = conn->hdev;
 143
 144         if (test_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags))
 145                 hci_conn_params_del(conn->hdev, &conn->dst, conn->dst_type);
 146
 147         if (test_and_clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
 148                 hci_remove_link_key(hdev, &conn->dst);
 149
 150         hci_chan_list_flush(conn);
 151
 152         hci_conn_hash_del(hdev, conn);
 153
 154         if (HCI_CONN_HANDLE_UNSET(conn->handle))
 155                 ida_free(&hdev->unset_handle_ida, conn->handle);
 156
 157         if (conn->cleanup)
 158                 conn->cleanup(conn);
 159
 160         if (conn->type == SCO_LINK || conn->type == ESCO_LINK) {
 161                 switch (conn->setting & SCO_AIRMODE_MASK) {
 162                 case SCO_AIRMODE_CVSD:
 163                 case SCO_AIRMODE_TRANSP:
 164                         if (hdev->notify)
 165                                 hdev->notify(hdev, HCI_NOTIFY_DISABLE_SCO);
 166                         break;
 167                 }
 168         } else {
 169                 if (hdev->notify)
 170                         hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
 171         }
 172
 173         debugfs_remove_recursive(conn->debugfs);
 174
 175         hci_conn_del_sysfs(conn);
 176
 177         hci_dev_put(hdev);
 178 }
 179
 180 int hci_disconnect(struct hci_conn *conn, __u8 reason)
 181 {
 182         BT_DBG("hcon %p", conn);
 183
 184         /* When we are central of an established connection and it enters
 185          * the disconnect timeout, then go ahead and try to read the
 186          * current clock offset.  Processing of the result is done
 187          * within the event handling and hci_clock_offset_evt function.
 188          */
 189         if (conn->type == ACL_LINK && conn->role == HCI_ROLE_MASTER &&
 190             (conn->state == BT_CONNECTED || conn->state == BT_CONFIG)) {
 191                 struct hci_dev *hdev = conn->hdev;
 192                 struct hci_cp_read_clock_offset clkoff_cp;
 193
 194                 clkoff_cp.handle = cpu_to_le16(conn->handle);
 195                 hci_send_cmd(hdev, HCI_OP_READ_CLOCK_OFFSET, sizeof(clkoff_cp),
 196                              &clkoff_cp);
 197         }
 198
 199         return hci_abort_conn(conn, reason);
 200 }
 201
 202 static void hci_add_sco(struct hci_conn *conn, __u16 handle)
 203 {
 204         struct hci_dev *hdev = conn->hdev;
 205         struct hci_cp_add_sco cp;
 206
 207         BT_DBG("hcon %p", conn);
 208
 209         conn->state = BT_CONNECT;
 210         conn->out = true;
 211
 212         conn->attempt++;
 213
 214         cp.handle   = cpu_to_le16(handle);
 215         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 216
 217         hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
 218 }
 219
 220 static bool find_next_esco_param(struct hci_conn *conn,
 221                                  const struct sco_param *esco_param, int size)
 222 {
 223         if (!conn->parent)
 224                 return false;
 225
 226         for (; conn->attempt <= size; conn->attempt++) {
 227                 if (lmp_esco_2m_capable(conn->parent) ||
 228                     (esco_param[conn->attempt - 1].pkt_type & ESCO_2EV3))
 229                         break;
 230                 BT_DBG("hcon %p skipped attempt %d, eSCO 2M not supported",
 231                        conn, conn->attempt);
 232         }
 233
 234         return conn->attempt <= size;
 235 }
 236
 237 static int configure_datapath_sync(struct hci_dev *hdev, struct bt_codec *codec)
 238 {
 239         int err;
 240         __u8 vnd_len, *vnd_data = NULL;
 241         struct hci_op_configure_data_path *cmd = NULL;
 242
 243         /* Do not take below 2 checks as error since the 1st means user do not
 244          * want to use HFP offload mode and the 2nd means the vendor controller
 245          * do not need to send below HCI command for offload mode.
 246          */
 247         if (!codec->data_path || !hdev->get_codec_config_data)
 248                 return 0;
 249
 250         err = hdev->get_codec_config_data(hdev, ESCO_LINK, codec, &vnd_len,
 251                                           &vnd_data);
 252         if (err < 0)
 253                 goto error;
 254
 255         cmd = kzalloc(sizeof(*cmd) + vnd_len, GFP_KERNEL);
 256         if (!cmd) {
 257                 err = -ENOMEM;
 258                 goto error;
 259         }
 260
 261         err = hdev->get_data_path_id(hdev, &cmd->data_path_id);
 262         if (err < 0)
 263                 goto error;
 264
 265         cmd->vnd_len = vnd_len;
 266         memcpy(cmd->vnd_data, vnd_data, vnd_len);
 267
 268         cmd->direction = 0x00;
 269         __hci_cmd_sync_status(hdev, HCI_CONFIGURE_DATA_PATH,
 270                               sizeof(*cmd) + vnd_len, cmd, HCI_CMD_TIMEOUT);
 271
 272         cmd->direction = 0x01;
 273         err = __hci_cmd_sync_status(hdev, HCI_CONFIGURE_DATA_PATH,
 274                                     sizeof(*cmd) + vnd_len, cmd,
 275                                     HCI_CMD_TIMEOUT);
 276 error:
 277
 278         kfree(cmd);
 279         kfree(vnd_data);
 280         return err;
 281 }
 282
 283 static int hci_enhanced_setup_sync(struct hci_dev *hdev, void *data)
 284 {
 285         struct conn_handle_t *conn_handle = data;
 286         struct hci_conn *conn = conn_handle->conn;
 287         __u16 handle = conn_handle->handle;
 288         struct hci_cp_enhanced_setup_sync_conn cp;
 289         const struct sco_param *param;
 290
 291         kfree(conn_handle);
 292
 293         if (!hci_conn_valid(hdev, conn))
 294                 return -ECANCELED;
 295
 296         bt_dev_dbg(hdev, "hcon %p", conn);
 297
 298         configure_datapath_sync(hdev, &conn->codec);
 299
 300         conn->state = BT_CONNECT;
 301         conn->out = true;
 302
 303         conn->attempt++;
 304
 305         memset(&cp, 0x00, sizeof(cp));
 306
 307         cp.handle   = cpu_to_le16(handle);
 308
 309         cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
 310         cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
 311
 312         switch (conn->codec.id) {
 313         case BT_CODEC_MSBC:
 314                 if (!find_next_esco_param(conn, esco_param_msbc,
 315                                           ARRAY_SIZE(esco_param_msbc)))
 316                         return -EINVAL;
 317
 318                 param = &esco_param_msbc[conn->attempt - 1];
 319                 cp.tx_coding_format.id = 0x05;
 320                 cp.rx_coding_format.id = 0x05;
 321                 cp.tx_codec_frame_size = __cpu_to_le16(60);
 322                 cp.rx_codec_frame_size = __cpu_to_le16(60);
 323                 cp.in_bandwidth = __cpu_to_le32(32000);
 324                 cp.out_bandwidth = __cpu_to_le32(32000);
 325                 cp.in_coding_format.id = 0x04;
 326                 cp.out_coding_format.id = 0x04;
 327                 cp.in_coded_data_size = __cpu_to_le16(16);
 328                 cp.out_coded_data_size = __cpu_to_le16(16);
 329                 cp.in_pcm_data_format = 2;
 330                 cp.out_pcm_data_format = 2;
 331                 cp.in_pcm_sample_payload_msb_pos = 0;
 332                 cp.out_pcm_sample_payload_msb_pos = 0;
 333                 cp.in_data_path = conn->codec.data_path;
 334                 cp.out_data_path = conn->codec.data_path;
 335                 cp.in_transport_unit_size = 1;
 336                 cp.out_transport_unit_size = 1;
 337                 break;
 338
 339         case BT_CODEC_TRANSPARENT:
 340                 if (!find_next_esco_param(conn, esco_param_msbc,
 341                                           ARRAY_SIZE(esco_param_msbc)))
 342                         return false;
 343                 param = &esco_param_msbc[conn->attempt - 1];
 344                 cp.tx_coding_format.id = 0x03;
 345                 cp.rx_coding_format.id = 0x03;
 346                 cp.tx_codec_frame_size = __cpu_to_le16(60);
 347                 cp.rx_codec_frame_size = __cpu_to_le16(60);
 348                 cp.in_bandwidth = __cpu_to_le32(0x1f40);
 349                 cp.out_bandwidth = __cpu_to_le32(0x1f40);
 350                 cp.in_coding_format.id = 0x03;
 351                 cp.out_coding_format.id = 0x03;
 352                 cp.in_coded_data_size = __cpu_to_le16(16);
 353                 cp.out_coded_data_size = __cpu_to_le16(16);
 354                 cp.in_pcm_data_format = 2;
 355                 cp.out_pcm_data_format = 2;
 356                 cp.in_pcm_sample_payload_msb_pos = 0;
 357                 cp.out_pcm_sample_payload_msb_pos = 0;
 358                 cp.in_data_path = conn->codec.data_path;
 359                 cp.out_data_path = conn->codec.data_path;
 360                 cp.in_transport_unit_size = 1;
 361                 cp.out_transport_unit_size = 1;
 362                 break;
 363
 364         case BT_CODEC_CVSD:
 365                 if (conn->parent && lmp_esco_capable(conn->parent)) {
 366                         if (!find_next_esco_param(conn, esco_param_cvsd,
 367                                                   ARRAY_SIZE(esco_param_cvsd)))
 368                                 return -EINVAL;
 369                         param = &esco_param_cvsd[conn->attempt - 1];
 370                 } else {
 371                         if (conn->attempt > ARRAY_SIZE(sco_param_cvsd))
 372                                 return -EINVAL;
 373                         param = &sco_param_cvsd[conn->attempt - 1];
 374                 }
 375                 cp.tx_coding_format.id = 2;
 376                 cp.rx_coding_format.id = 2;
 377                 cp.tx_codec_frame_size = __cpu_to_le16(60);
 378                 cp.rx_codec_frame_size = __cpu_to_le16(60);
 379                 cp.in_bandwidth = __cpu_to_le32(16000);
 380                 cp.out_bandwidth = __cpu_to_le32(16000);
 381                 cp.in_coding_format.id = 4;
 382                 cp.out_coding_format.id = 4;
 383                 cp.in_coded_data_size = __cpu_to_le16(16);
 384                 cp.out_coded_data_size = __cpu_to_le16(16);
 385                 cp.in_pcm_data_format = 2;
 386                 cp.out_pcm_data_format = 2;
 387                 cp.in_pcm_sample_payload_msb_pos = 0;
 388                 cp.out_pcm_sample_payload_msb_pos = 0;
 389                 cp.in_data_path = conn->codec.data_path;
 390                 cp.out_data_path = conn->codec.data_path;
 391                 cp.in_transport_unit_size = 16;
 392                 cp.out_transport_unit_size = 16;
 393                 break;
 394         default:
 395                 return -EINVAL;
 396         }
 397
 398         cp.retrans_effort = param->retrans_effort;
 399         cp.pkt_type = __cpu_to_le16(param->pkt_type);
 400         cp.max_latency = __cpu_to_le16(param->max_latency);
 401
 402         if (hci_send_cmd(hdev, HCI_OP_ENHANCED_SETUP_SYNC_CONN, sizeof(cp), &cp) < 0)
 403                 return -EIO;
 404
 405         return 0;
 406 }
 407
 408 static bool hci_setup_sync_conn(struct hci_conn *conn, __u16 handle)
 409 {
 410         struct hci_dev *hdev = conn->hdev;
 411         struct hci_cp_setup_sync_conn cp;
 412         const struct sco_param *param;
 413
 414         bt_dev_dbg(hdev, "hcon %p", conn);
 415
 416         conn->state = BT_CONNECT;
 417         conn->out = true;
 418
 419         conn->attempt++;
 420
 421         cp.handle   = cpu_to_le16(handle);
 422
 423         cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
 424         cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
 425         cp.voice_setting  = cpu_to_le16(conn->setting);
 426
 427         switch (conn->setting & SCO_AIRMODE_MASK) {
 428         case SCO_AIRMODE_TRANSP:
 429                 if (!find_next_esco_param(conn, esco_param_msbc,
 430                                           ARRAY_SIZE(esco_param_msbc)))
 431                         return false;
 432                 param = &esco_param_msbc[conn->attempt - 1];
 433                 break;
 434         case SCO_AIRMODE_CVSD:
 435                 if (conn->parent && lmp_esco_capable(conn->parent)) {
 436                         if (!find_next_esco_param(conn, esco_param_cvsd,
 437                                                   ARRAY_SIZE(esco_param_cvsd)))
 438                                 return false;
 439                         param = &esco_param_cvsd[conn->attempt - 1];
 440                 } else {
 441                         if (conn->attempt > ARRAY_SIZE(sco_param_cvsd))
 442                                 return false;
 443                         param = &sco_param_cvsd[conn->attempt - 1];
 444                 }
 445                 break;
 446         default:
 447                 return false;
 448         }
 449
 450         cp.retrans_effort = param->retrans_effort;
 451         cp.pkt_type = __cpu_to_le16(param->pkt_type);
 452         cp.max_latency = __cpu_to_le16(param->max_latency);
 453
 454         if (hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp) < 0)
 455                 return false;
 456
 457         return true;
 458 }
 459
 460 bool hci_setup_sync(struct hci_conn *conn, __u16 handle)
 461 {
 462         int result;
 463         struct conn_handle_t *conn_handle;
 464
 465         if (enhanced_sync_conn_capable(conn->hdev)) {
 466                 conn_handle = kzalloc(sizeof(*conn_handle), GFP_KERNEL);
 467
 468                 if (!conn_handle)
 469                         return false;
 470
 471                 conn_handle->conn = conn;
 472                 conn_handle->handle = handle;
 473                 result = hci_cmd_sync_queue(conn->hdev, hci_enhanced_setup_sync,
 474                                             conn_handle, NULL);
 475                 if (result < 0)
 476                         kfree(conn_handle);
 477
 478                 return result == 0;
 479         }
 480
 481         return hci_setup_sync_conn(conn, handle);
 482 }
 483
 484 u8 hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max, u16 latency,
 485                       u16 to_multiplier)
 486 {
 487         struct hci_dev *hdev = conn->hdev;
 488         struct hci_conn_params *params;
 489         struct hci_cp_le_conn_update cp;
 490
 491         hci_dev_lock(hdev);
 492
 493         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
 494         if (params) {
 495                 params->conn_min_interval = min;
 496                 params->conn_max_interval = max;
 497                 params->conn_latency = latency;
 498                 params->supervision_timeout = to_multiplier;
 499         }
 500
 501         hci_dev_unlock(hdev);
 502
 503         memset(&cp, 0, sizeof(cp));
 504         cp.handle               = cpu_to_le16(conn->handle);
 505         cp.conn_interval_min    = cpu_to_le16(min);
 506         cp.conn_interval_max    = cpu_to_le16(max);
 507         cp.conn_latency         = cpu_to_le16(latency);
 508         cp.supervision_timeout  = cpu_to_le16(to_multiplier);
 509         cp.min_ce_len           = cpu_to_le16(0x0000);
 510         cp.max_ce_len           = cpu_to_le16(0x0000);
 511
 512         hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp);
 513
 514         if (params)
 515                 return 0x01;
 516
 517         return 0x00;
 518 }
 519
 520 void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __le64 rand,
 521                       __u8 ltk[16], __u8 key_size)
 522 {
 523         struct hci_dev *hdev = conn->hdev;
 524         struct hci_cp_le_start_enc cp;
 525
 526         BT_DBG("hcon %p", conn);
 527
 528         memset(&cp, 0, sizeof(cp));
 529
 530         cp.handle = cpu_to_le16(conn->handle);
 531         cp.rand = rand;
 532         cp.ediv = ediv;
 533         memcpy(cp.ltk, ltk, key_size);
 534
 535         hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp);
 536 }
 537
 538 /* Device _must_ be locked */
 539 void hci_sco_setup(struct hci_conn *conn, __u8 status)
 540 {
 541         struct hci_link *link;
 542
 543         link = list_first_entry_or_null(&conn->link_list, struct hci_link, list);
 544         if (!link || !link->conn)
 545                 return;
 546
 547         BT_DBG("hcon %p", conn);
 548
 549         if (!status) {
 550                 if (lmp_esco_capable(conn->hdev))
 551                         hci_setup_sync(link->conn, conn->handle);
 552                 else
 553                         hci_add_sco(link->conn, conn->handle);
 554         } else {
 555                 hci_connect_cfm(link->conn, status);
 556                 hci_conn_del(link->conn);
 557         }
 558 }
 559
 560 static void hci_conn_timeout(struct work_struct *work)
 561 {
 562         struct hci_conn *conn = container_of(work, struct hci_conn,
 563                                              disc_work.work);
 564         int refcnt = atomic_read(&conn->refcnt);
 565
 566         BT_DBG("hcon %p state %s", conn, state_to_string(conn->state));
 567
 568         WARN_ON(refcnt < 0);
 569
 570         /* FIXME: It was observed that in pairing failed scenario, refcnt
 571          * drops below 0. Probably this is because l2cap_conn_del calls
 572          * l2cap_chan_del for each channel, and inside l2cap_chan_del conn is
 573          * dropped. After that loop hci_chan_del is called which also drops
 574          * conn. For now make sure that ACL is alive if refcnt is higher then 0,
 575          * otherwise drop it.
 576          */
 577         if (refcnt > 0)
 578                 return;
 579
 580         hci_abort_conn(conn, hci_proto_disconn_ind(conn));
 581 }
 582
 583 /* Enter sniff mode */
 584 static void hci_conn_idle(struct work_struct *work)
 585 {
 586         struct hci_conn *conn = container_of(work, struct hci_conn,
 587                                              idle_work.work);
 588         struct hci_dev *hdev = conn->hdev;
 589
 590         BT_DBG("hcon %p mode %d", conn, conn->mode);
 591
 592         if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn))
 593                 return;
 594
 595         if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF))
 596                 return;
 597
 598         if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
 599                 struct hci_cp_sniff_subrate cp;
 600                 cp.handle             = cpu_to_le16(conn->handle);
 601                 cp.max_latency        = cpu_to_le16(0);
 602                 cp.min_remote_timeout = cpu_to_le16(0);
 603                 cp.min_local_timeout  = cpu_to_le16(0);
 604                 hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
 605         }
 606
 607         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
 608                 struct hci_cp_sniff_mode cp;
 609                 cp.handle       = cpu_to_le16(conn->handle);
 610                 cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
 611                 cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
 612                 cp.attempt      = cpu_to_le16(4);
 613                 cp.timeout      = cpu_to_le16(1);
 614                 hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
 615         }
 616 }
 617
 618 static void hci_conn_auto_accept(struct work_struct *work)
 619 {
 620         struct hci_conn *conn = container_of(work, struct hci_conn,
 621                                              auto_accept_work.work);
 622
 623         hci_send_cmd(conn->hdev, HCI_OP_USER_CONFIRM_REPLY, sizeof(conn->dst),
 624                      &conn->dst);
 625 }
 626
 627 static void le_disable_advertising(struct hci_dev *hdev)
 628 {
 629         if (ext_adv_capable(hdev)) {
 630                 struct hci_cp_le_set_ext_adv_enable cp;
 631
 632                 cp.enable = 0x00;
 633                 cp.num_of_sets = 0x00;
 634
 635                 hci_send_cmd(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE, sizeof(cp),
 636                              &cp);
 637         } else {
 638                 u8 enable = 0x00;
 639                 hci_send_cmd(hdev, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable),
 640                              &enable);
 641         }
 642 }
 643
 644 static void le_conn_timeout(struct work_struct *work)
 645 {
 646         struct hci_conn *conn = container_of(work, struct hci_conn,
 647                                              le_conn_timeout.work);
 648         struct hci_dev *hdev = conn->hdev;
 649
 650         BT_DBG("");
 651
 652         /* We could end up here due to having done directed advertising,
 653          * so clean up the state if necessary. This should however only
 654          * happen with broken hardware or if low duty cycle was used
 655          * (which doesn't have a timeout of its own).
 656          */
 657         if (conn->role == HCI_ROLE_SLAVE) {
 658                 /* Disable LE Advertising */
 659                 le_disable_advertising(hdev);
 660                 hci_dev_lock(hdev);
 661                 hci_conn_failed(conn, HCI_ERROR_ADVERTISING_TIMEOUT);
 662                 hci_dev_unlock(hdev);
 663                 return;
 664         }
 665
 666         hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
 667 }
 668
 669 struct iso_list_data {
 670         union {
 671                 u8  cig;
 672                 u8  big;
 673         };
 674         union {
 675                 u8  cis;
 676                 u8  bis;
 677                 u16 sync_handle;
 678         };
 679         int count;
 680         bool big_term;
 681         bool pa_sync_term;
 682         bool big_sync_term;
 683 };
 684
 685 static void bis_list(struct hci_conn *conn, void *data)
 686 {
 687         struct iso_list_data *d = data;
 688
 689         /* Skip if not broadcast/ANY address */
 690         if (bacmp(&conn->dst, BDADDR_ANY))
 691                 return;
 692
 693         if (d->big != conn->iso_qos.bcast.big || d->bis == BT_ISO_QOS_BIS_UNSET ||
 694             d->bis != conn->iso_qos.bcast.bis)
 695                 return;
 696
 697         d->count++;
 698 }
 699
 700 static int terminate_big_sync(struct hci_dev *hdev, void *data)
 701 {
 702         struct iso_list_data *d = data;
 703
 704         bt_dev_dbg(hdev, "big 0x%2.2x bis 0x%2.2x", d->big, d->bis);
 705
 706         hci_disable_per_advertising_sync(hdev, d->bis);
 707         hci_remove_ext_adv_instance_sync(hdev, d->bis, NULL);
 708
 709         /* Only terminate BIG if it has been created */
 710         if (!d->big_term)
 711                 return 0;
 712
 713         return hci_le_terminate_big_sync(hdev, d->big,
 714                                          HCI_ERROR_LOCAL_HOST_TERM);
 715 }
 716
 717 static void terminate_big_destroy(struct hci_dev *hdev, void *data, int err)
 718 {
 719         kfree(data);
 720 }
 721
 722 static int hci_le_terminate_big(struct hci_dev *hdev, struct hci_conn *conn)
 723 {
 724         struct iso_list_data *d;
 725         int ret;
 726
 727         bt_dev_dbg(hdev, "big 0x%2.2x bis 0x%2.2x", conn->iso_qos.bcast.big,
 728                    conn->iso_qos.bcast.bis);
 729
 730         d = kzalloc(sizeof(*d), GFP_KERNEL);
 731         if (!d)
 732                 return -ENOMEM;
 733
 734         d->big = conn->iso_qos.bcast.big;
 735         d->bis = conn->iso_qos.bcast.bis;
 736         d->big_term = test_and_clear_bit(HCI_CONN_BIG_CREATED, &conn->flags);
 737
 738         ret = hci_cmd_sync_queue(hdev, terminate_big_sync, d,
 739                                  terminate_big_destroy);
 740         if (ret)
 741                 kfree(d);
 742
 743         return ret;
 744 }
 745
 746 static int big_terminate_sync(struct hci_dev *hdev, void *data)
 747 {
 748         struct iso_list_data *d = data;
 749
 750         bt_dev_dbg(hdev, "big 0x%2.2x sync_handle 0x%4.4x", d->big,
 751                    d->sync_handle);
 752
 753         if (d->big_sync_term)
 754                 hci_le_big_terminate_sync(hdev, d->big);
 755
 756         if (d->pa_sync_term)
 757                 return hci_le_pa_terminate_sync(hdev, d->sync_handle);
 758
 759         return 0;
 760 }
 761
 762 static void find_bis(struct hci_conn *conn, void *data)
 763 {
 764         struct iso_list_data *d = data;
 765
 766         /* Ignore if BIG doesn't match */
 767         if (d->big != conn->iso_qos.bcast.big)
 768                 return;
 769
 770         d->count++;
 771 }
 772
 773 static int hci_le_big_terminate(struct hci_dev *hdev, u8 big, struct hci_conn *conn)
 774 {
 775         struct iso_list_data *d;
 776         int ret;
 777
 778         bt_dev_dbg(hdev, "big 0x%2.2x sync_handle 0x%4.4x", big, conn->sync_handle);
 779
 780         d = kzalloc(sizeof(*d), GFP_KERNEL);
 781         if (!d)
 782                 return -ENOMEM;
 783
 784         d->big = big;
 785         d->sync_handle = conn->sync_handle;
 786
 787         if (test_and_clear_bit(HCI_CONN_PA_SYNC, &conn->flags)) {
 788                 hci_conn_hash_list_flag(hdev, find_bis, BIS_LINK,
 789                                         HCI_CONN_PA_SYNC, d);
 790
 791                 if (!d->count)
 792                         d->pa_sync_term = true;
 793
 794                 d->count = 0;
 795         }
 796
 797         if (test_and_clear_bit(HCI_CONN_BIG_SYNC, &conn->flags)) {
 798                 hci_conn_hash_list_flag(hdev, find_bis, BIS_LINK,
 799                                         HCI_CONN_BIG_SYNC, d);
 800
 801                 if (!d->count)
 802                         d->big_sync_term = true;
 803         }
 804
 805         ret = hci_cmd_sync_queue(hdev, big_terminate_sync, d,
 806                                  terminate_big_destroy);
 807         if (ret)
 808                 kfree(d);
 809
 810         return ret;
 811 }
 812
 813 /* Cleanup BIS connection
 814  *
 815  * Detects if there any BIS left connected in a BIG
 816  * broadcaster: Remove advertising instance and terminate BIG.
 817  * broadcaster receiver: Teminate BIG sync and terminate PA sync.
 818  */
 819 static void bis_cleanup(struct hci_conn *conn)
 820 {
 821         struct hci_dev *hdev = conn->hdev;
 822         struct hci_conn *bis;
 823
 824         bt_dev_dbg(hdev, "conn %p", conn);
 825
 826         if (conn->role == HCI_ROLE_MASTER) {
 827                 if (!test_and_clear_bit(HCI_CONN_PER_ADV, &conn->flags))
 828                         return;
 829
 830                 /* Check if ISO connection is a BIS and terminate advertising
 831                  * set and BIG if there are no other connections using it.
 832                  */
 833                 bis = hci_conn_hash_lookup_big(hdev, conn->iso_qos.bcast.big);
 834                 if (bis)
 835                         return;
 836
 837                 hci_le_terminate_big(hdev, conn);
 838         } else {
 839                 hci_le_big_terminate(hdev, conn->iso_qos.bcast.big,
 840                                      conn);
 841         }
 842 }
 843
 844 static int remove_cig_sync(struct hci_dev *hdev, void *data)
 845 {
 846         u8 handle = PTR_UINT(data);
 847
 848         return hci_le_remove_cig_sync(hdev, handle);
 849 }
 850
 851 static int hci_le_remove_cig(struct hci_dev *hdev, u8 handle)
 852 {
 853         bt_dev_dbg(hdev, "handle 0x%2.2x", handle);
 854
 855         return hci_cmd_sync_queue(hdev, remove_cig_sync, UINT_PTR(handle),
 856                                   NULL);
 857 }
 858
 859 static void find_cis(struct hci_conn *conn, void *data)
 860 {
 861         struct iso_list_data *d = data;
 862
 863         /* Ignore broadcast or if CIG don't match */
 864         if (!bacmp(&conn->dst, BDADDR_ANY) || d->cig != conn->iso_qos.ucast.cig)
 865                 return;
 866
 867         d->count++;
 868 }
 869
 870 /* Cleanup CIS connection:
 871  *
 872  * Detects if there any CIS left connected in a CIG and remove it.
 873  */
 874 static void cis_cleanup(struct hci_conn *conn)
 875 {
 876         struct hci_dev *hdev = conn->hdev;
 877         struct iso_list_data d;
 878
 879         if (conn->iso_qos.ucast.cig == BT_ISO_QOS_CIG_UNSET)
 880                 return;
 881
 882         memset(&d, 0, sizeof(d));
 883         d.cig = conn->iso_qos.ucast.cig;
 884
 885         /* Check if ISO connection is a CIS and remove CIG if there are
 886          * no other connections using it.
 887          */
 888         hci_conn_hash_list_state(hdev, find_cis, CIS_LINK, BT_BOUND, &d);
 889         hci_conn_hash_list_state(hdev, find_cis, CIS_LINK, BT_CONNECT,
 890                                  &d);
 891         hci_conn_hash_list_state(hdev, find_cis, CIS_LINK, BT_CONNECTED,
 892                                  &d);
 893         if (d.count)
 894                 return;
 895
 896         hci_le_remove_cig(hdev, conn->iso_qos.ucast.cig);
 897 }
 898
 899 static int hci_conn_hash_alloc_unset(struct hci_dev *hdev)
 900 {
 901         return ida_alloc_range(&hdev->unset_handle_ida, HCI_CONN_HANDLE_MAX + 1,
 902                                U16_MAX, GFP_ATOMIC);
 903 }
 904
 905 static struct hci_conn *__hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst,
 906                                        u8 role, u16 handle)
 907 {
 908         struct hci_conn *conn;
 909
 910         switch (type) {
 911         case ACL_LINK:
 912                 if (!hdev->acl_mtu)
 913                         return ERR_PTR(-ECONNREFUSED);
 914                 break;
 915         case CIS_LINK:
 916         case BIS_LINK:
 917                 if (hdev->iso_mtu)
 918                         /* Dedicated ISO Buffer exists */
 919                         break;
 920                 fallthrough;
 921         case LE_LINK:
 922                 if (hdev->le_mtu && hdev->le_mtu < HCI_MIN_LE_MTU)
 923                         return ERR_PTR(-ECONNREFUSED);
 924                 if (!hdev->le_mtu && hdev->acl_mtu < HCI_MIN_LE_MTU)
 925                         return ERR_PTR(-ECONNREFUSED);
 926                 break;
 927         case SCO_LINK:
 928         case ESCO_LINK:
 929                 if (!hdev->sco_pkts)
 930                         /* Controller does not support SCO or eSCO over HCI */
 931                         return ERR_PTR(-ECONNREFUSED);
 932                 break;
 933         default:
 934                 return ERR_PTR(-ECONNREFUSED);
 935         }
 936
 937         bt_dev_dbg(hdev, "dst %pMR handle 0x%4.4x", dst, handle);
 938
 939         conn = kzalloc(sizeof(*conn), GFP_KERNEL);
 940         if (!conn)
 941                 return ERR_PTR(-ENOMEM);
 942
 943         bacpy(&conn->dst, dst);
 944         bacpy(&conn->src, &hdev->bdaddr);
 945         conn->handle = handle;
 946         conn->hdev  = hdev;
 947         conn->type  = type;
 948         conn->role  = role;
 949         conn->mode  = HCI_CM_ACTIVE;
 950         conn->state = BT_OPEN;
 951         conn->auth_type = HCI_AT_GENERAL_BONDING;
 952         conn->io_capability = hdev->io_capability;
 953         conn->remote_auth = 0xff;
 954         conn->key_type = 0xff;
 955         conn->rssi = HCI_RSSI_INVALID;
 956         conn->tx_power = HCI_TX_POWER_INVALID;
 957         conn->max_tx_power = HCI_TX_POWER_INVALID;
 958         conn->sync_handle = HCI_SYNC_HANDLE_INVALID;
 959         conn->sid = HCI_SID_INVALID;
 960
 961         set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
 962         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
 963
 964         /* Set Default Authenticated payload timeout to 30s */
 965         conn->auth_payload_timeout = DEFAULT_AUTH_PAYLOAD_TIMEOUT;
 966
 967         if (conn->role == HCI_ROLE_MASTER)
 968                 conn->out = true;
 969
 970         switch (type) {
 971         case ACL_LINK:
 972                 conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
 973                 conn->mtu = hdev->acl_mtu;
 974                 break;
 975         case LE_LINK:
 976                 /* conn->src should reflect the local identity address */
 977                 hci_copy_identity_address(hdev, &conn->src, &conn->src_type);
 978                 conn->mtu = hdev->le_mtu ? hdev->le_mtu : hdev->acl_mtu;
 979                 break;
 980         case CIS_LINK:
 981         case BIS_LINK:
 982                 /* conn->src should reflect the local identity address */
 983                 hci_copy_identity_address(hdev, &conn->src, &conn->src_type);
 984
 985                 /* set proper cleanup function */
 986                 if (!bacmp(dst, BDADDR_ANY))
 987                         conn->cleanup = bis_cleanup;
 988                 else if (conn->role == HCI_ROLE_MASTER)
 989                         conn->cleanup = cis_cleanup;
 990
 991                 conn->mtu = hdev->iso_mtu ? hdev->iso_mtu :
 992                             hdev->le_mtu ? hdev->le_mtu : hdev->acl_mtu;
 993                 break;
 994         case SCO_LINK:
 995                 if (lmp_esco_capable(hdev))
 996                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
 997                                         (hdev->esco_type & EDR_ESCO_MASK);
 998                 else
 999                         conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
1000
1001                 conn->mtu = hdev->sco_mtu;
1002                 break;
1003         case ESCO_LINK:
1004                 conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
1005                 conn->mtu = hdev->sco_mtu;
1006                 break;
1007         }
1008
1009         skb_queue_head_init(&conn->data_q);
1010         skb_queue_head_init(&conn->tx_q.queue);
1011
1012         INIT_LIST_HEAD(&conn->chan_list);
1013         INIT_LIST_HEAD(&conn->link_list);
1014
1015         INIT_DELAYED_WORK(&conn->disc_work, hci_conn_timeout);
1016         INIT_DELAYED_WORK(&conn->auto_accept_work, hci_conn_auto_accept);
1017         INIT_DELAYED_WORK(&conn->idle_work, hci_conn_idle);
1018         INIT_DELAYED_WORK(&conn->le_conn_timeout, le_conn_timeout);
1019
1020         atomic_set(&conn->refcnt, 0);
1021
1022         hci_dev_hold(hdev);
1023
1024         hci_conn_hash_add(hdev, conn);
1025
1026         /* The SCO and eSCO connections will only be notified when their
1027          * setup has been completed. This is different to ACL links which
1028          * can be notified right away.
1029          */
1030         if (conn->type != SCO_LINK && conn->type != ESCO_LINK) {
1031                 if (hdev->notify)
1032                         hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
1033         }
1034
1035         hci_conn_init_sysfs(conn);
1036
1037         return conn;
1038 }
1039
1040 struct hci_conn *hci_conn_add_unset(struct hci_dev *hdev, int type,
1041                                     bdaddr_t *dst, u8 role)
1042 {
1043         int handle;
1044
1045         bt_dev_dbg(hdev, "dst %pMR", dst);
1046
1047         handle = hci_conn_hash_alloc_unset(hdev);
1048         if (unlikely(handle < 0))
1049                 return ERR_PTR(-ECONNREFUSED);
1050
1051         return __hci_conn_add(hdev, type, dst, role, handle);
1052 }
1053
1054 struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst,
1055                               u8 role, u16 handle)
1056 {
1057         if (handle > HCI_CONN_HANDLE_MAX)
1058                 return ERR_PTR(-EINVAL);
1059
1060         return __hci_conn_add(hdev, type, dst, role, handle);
1061 }
1062
1063 static void hci_conn_cleanup_child(struct hci_conn *conn, u8 reason)
1064 {
1065         if (!reason)
1066                 reason = HCI_ERROR_REMOTE_USER_TERM;
1067
1068         /* Due to race, SCO/ISO conn might be not established yet at this point,
1069          * and nothing else will clean it up. In other cases it is done via HCI
1070          * events.
1071          */
1072         switch (conn->type) {
1073         case SCO_LINK:
1074         case ESCO_LINK:
1075                 if (HCI_CONN_HANDLE_UNSET(conn->handle))
1076                         hci_conn_failed(conn, reason);
1077                 break;
1078         case CIS_LINK:
1079         case BIS_LINK:
1080                 if ((conn->state != BT_CONNECTED &&
1081                     !test_bit(HCI_CONN_CREATE_CIS, &conn->flags)) ||
1082                     test_bit(HCI_CONN_BIG_CREATED, &conn->flags))
1083                         hci_conn_failed(conn, reason);
1084                 break;
1085         }
1086 }
1087
1088 static void hci_conn_unlink(struct hci_conn *conn)
1089 {
1090         struct hci_dev *hdev = conn->hdev;
1091
1092         bt_dev_dbg(hdev, "hcon %p", conn);
1093
1094         if (!conn->parent) {
1095                 struct hci_link *link, *t;
1096
1097                 list_for_each_entry_safe(link, t, &conn->link_list, list) {
1098                         struct hci_conn *child = link->conn;
1099
1100                         hci_conn_unlink(child);
1101
1102                         /* If hdev is down it means
1103                          * hci_dev_close_sync/hci_conn_hash_flush is in progress
1104                          * and links don't need to be cleanup as all connections
1105                          * would be cleanup.
1106                          */
1107                         if (!test_bit(HCI_UP, &hdev->flags))
1108                                 continue;
1109
1110                         hci_conn_cleanup_child(child, conn->abort_reason);
1111                 }
1112
1113                 return;
1114         }
1115
1116         if (!conn->link)
1117                 return;
1118
1119         list_del_rcu(&conn->link->list);
1120         synchronize_rcu();
1121
1122         hci_conn_drop(conn->parent);
1123         hci_conn_put(conn->parent);
1124         conn->parent = NULL;
1125
1126         kfree(conn->link);
1127         conn->link = NULL;
1128 }
1129
1130 void hci_conn_del(struct hci_conn *conn)
1131 {
1132         struct hci_dev *hdev = conn->hdev;
1133
1134         BT_DBG("%s hcon %p handle %d", hdev->name, conn, conn->handle);
1135
1136         hci_conn_unlink(conn);
1137
1138         disable_delayed_work_sync(&conn->disc_work);
1139         disable_delayed_work_sync(&conn->auto_accept_work);
1140         disable_delayed_work_sync(&conn->idle_work);
1141
1142         if (conn->type == ACL_LINK) {
1143                 /* Unacked frames */
1144                 hdev->acl_cnt += conn->sent;
1145         } else if (conn->type == LE_LINK) {
1146                 cancel_delayed_work(&conn->le_conn_timeout);
1147
1148                 if (hdev->le_pkts)
1149                         hdev->le_cnt += conn->sent;
1150                 else
1151                         hdev->acl_cnt += conn->sent;
1152         } else {
1153                 /* Unacked ISO frames */
1154                 if (conn->type == CIS_LINK ||
1155                     conn->type == BIS_LINK) {
1156                         if (hdev->iso_pkts)
1157                                 hdev->iso_cnt += conn->sent;
1158                         else if (hdev->le_pkts)
1159                                 hdev->le_cnt += conn->sent;
1160                         else
1161                                 hdev->acl_cnt += conn->sent;
1162                 }
1163         }
1164
1165         skb_queue_purge(&conn->data_q);
1166         skb_queue_purge(&conn->tx_q.queue);
1167
1168         /* Remove the connection from the list and cleanup its remaining
1169          * state. This is a separate function since for some cases like
1170          * BT_CONNECT_SCAN we *only* want the cleanup part without the
1171          * rest of hci_conn_del.
1172          */
1173         hci_conn_cleanup(conn);
1174
1175         /* Dequeue callbacks using connection pointer as data */
1176         hci_cmd_sync_dequeue(hdev, NULL, conn, NULL);
1177 }
1178
1179 struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src, uint8_t src_type)
1180 {
1181         int use_src = bacmp(src, BDADDR_ANY);
1182         struct hci_dev *hdev = NULL, *d;
1183
1184         BT_DBG("%pMR -> %pMR", src, dst);
1185
1186         read_lock(&hci_dev_list_lock);
1187
1188         list_for_each_entry(d, &hci_dev_list, list) {
1189                 if (!test_bit(HCI_UP, &d->flags) ||
1190                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
1191                         continue;
1192
1193                 /* Simple routing:
1194                  *   No source address - find interface with bdaddr != dst
1195                  *   Source address    - find interface with bdaddr == src
1196                  */
1197
1198                 if (use_src) {
1199                         bdaddr_t id_addr;
1200                         u8 id_addr_type;
1201
1202                         if (src_type == BDADDR_BREDR) {
1203                                 if (!lmp_bredr_capable(d))
1204                                         continue;
1205                                 bacpy(&id_addr, &d->bdaddr);
1206                                 id_addr_type = BDADDR_BREDR;
1207                         } else {
1208                                 if (!lmp_le_capable(d))
1209                                         continue;
1210
1211                                 hci_copy_identity_address(d, &id_addr,
1212                                                           &id_addr_type);
1213
1214                                 /* Convert from HCI to three-value type */
1215                                 if (id_addr_type == ADDR_LE_DEV_PUBLIC)
1216                                         id_addr_type = BDADDR_LE_PUBLIC;
1217                                 else
1218                                         id_addr_type = BDADDR_LE_RANDOM;
1219                         }
1220
1221                         if (!bacmp(&id_addr, src) && id_addr_type == src_type) {
1222                                 hdev = d; break;
1223                         }
1224                 } else {
1225                         if (bacmp(&d->bdaddr, dst)) {
1226                                 hdev = d; break;
1227                         }
1228                 }
1229         }
1230
1231         if (hdev)
1232                 hdev = hci_dev_hold(hdev);
1233
1234         read_unlock(&hci_dev_list_lock);
1235         return hdev;
1236 }
1237 EXPORT_SYMBOL(hci_get_route);
1238
1239 /* This function requires the caller holds hdev->lock */
1240 static void hci_le_conn_failed(struct hci_conn *conn, u8 status)
1241 {
1242         struct hci_dev *hdev = conn->hdev;
1243
1244         hci_connect_le_scan_cleanup(conn, status);
1245
1246         /* Enable advertising in case this was a failed connection
1247          * attempt as a peripheral.
1248          */
1249         hci_enable_advertising(hdev);
1250 }
1251
1252 /* This function requires the caller holds hdev->lock */
1253 void hci_conn_failed(struct hci_conn *conn, u8 status)
1254 {
1255         struct hci_dev *hdev = conn->hdev;
1256
1257         bt_dev_dbg(hdev, "status 0x%2.2x", status);
1258
1259         switch (conn->type) {
1260         case LE_LINK:
1261                 hci_le_conn_failed(conn, status);
1262                 break;
1263         case ACL_LINK:
1264                 mgmt_connect_failed(hdev, conn, status);
1265                 break;
1266         }
1267
1268         /* In case of BIG/PA sync failed, clear conn flags so that
1269          * the conns will be correctly cleaned up by ISO layer
1270          */
1271         test_and_clear_bit(HCI_CONN_BIG_SYNC_FAILED, &conn->flags);
1272         test_and_clear_bit(HCI_CONN_PA_SYNC_FAILED, &conn->flags);
1273
1274         conn->state = BT_CLOSED;
1275         hci_connect_cfm(conn, status);
1276         hci_conn_del(conn);
1277 }
1278
1279 /* This function requires the caller holds hdev->lock */
1280 u8 hci_conn_set_handle(struct hci_conn *conn, u16 handle)
1281 {
1282         struct hci_dev *hdev = conn->hdev;
1283
1284         bt_dev_dbg(hdev, "hcon %p handle 0x%4.4x", conn, handle);
1285
1286         if (conn->handle == handle)
1287                 return 0;
1288
1289         if (handle > HCI_CONN_HANDLE_MAX) {
1290                 bt_dev_err(hdev, "Invalid handle: 0x%4.4x > 0x%4.4x",
1291                            handle, HCI_CONN_HANDLE_MAX);
1292                 return HCI_ERROR_INVALID_PARAMETERS;
1293         }
1294
1295         /* If abort_reason has been sent it means the connection is being
1296          * aborted and the handle shall not be changed.
1297          */
1298         if (conn->abort_reason)
1299                 return conn->abort_reason;
1300
1301         if (HCI_CONN_HANDLE_UNSET(conn->handle))
1302                 ida_free(&hdev->unset_handle_ida, conn->handle);
1303
1304         conn->handle = handle;
1305
1306         return 0;
1307 }
1308
1309 struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,
1310                                 u8 dst_type, bool dst_resolved, u8 sec_level,
1311                                 u16 conn_timeout, u8 role, u8 phy, u8 sec_phy)
1312 {
1313         struct hci_conn *conn;
1314         struct smp_irk *irk;
1315         int err;
1316
1317         /* Let's make sure that le is enabled.*/
1318         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1319                 if (lmp_le_capable(hdev))
1320                         return ERR_PTR(-ECONNREFUSED);
1321
1322                 return ERR_PTR(-EOPNOTSUPP);
1323         }
1324
1325         /* Since the controller supports only one LE connection attempt at a
1326          * time, we return -EBUSY if there is any connection attempt running.
1327          */
1328         if (hci_lookup_le_connect(hdev))
1329                 return ERR_PTR(-EBUSY);
1330
1331         /* If there's already a connection object but it's not in
1332          * scanning state it means it must already be established, in
1333          * which case we can't do anything else except report a failure
1334          * to connect.
1335          */
1336         conn = hci_conn_hash_lookup_le(hdev, dst, dst_type);
1337         if (conn && !test_bit(HCI_CONN_SCANNING, &conn->flags)) {
1338                 return ERR_PTR(-EBUSY);
1339         }
1340
1341         /* Check if the destination address has been resolved by the controller
1342          * since if it did then the identity address shall be used.
1343          */
1344         if (!dst_resolved) {
1345                 /* When given an identity address with existing identity
1346                  * resolving key, the connection needs to be established
1347                  * to a resolvable random address.
1348                  *
1349                  * Storing the resolvable random address is required here
1350                  * to handle connection failures. The address will later
1351                  * be resolved back into the original identity address
1352                  * from the connect request.
1353                  */
1354                 irk = hci_find_irk_by_addr(hdev, dst, dst_type);
1355                 if (irk && bacmp(&irk->rpa, BDADDR_ANY)) {
1356                         dst = &irk->rpa;
1357                         dst_type = ADDR_LE_DEV_RANDOM;
1358                 }
1359         }
1360
1361         if (conn) {
1362                 bacpy(&conn->dst, dst);
1363         } else {
1364                 conn = hci_conn_add_unset(hdev, LE_LINK, dst, role);
1365                 if (IS_ERR(conn))
1366                         return conn;
1367                 hci_conn_hold(conn);
1368                 conn->pending_sec_level = sec_level;
1369         }
1370
1371         conn->dst_type = dst_type;
1372         conn->sec_level = BT_SECURITY_LOW;
1373         conn->conn_timeout = conn_timeout;
1374         conn->le_adv_phy = phy;
1375         conn->le_adv_sec_phy = sec_phy;
1376
1377         err = hci_connect_le_sync(hdev, conn);
1378         if (err) {
1379                 hci_conn_del(conn);
1380                 return ERR_PTR(err);
1381         }
1382
1383         return conn;
1384 }
1385
1386 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
1387 {
1388         struct hci_conn *conn;
1389
1390         conn = hci_conn_hash_lookup_le(hdev, addr, type);
1391         if (!conn)
1392                 return false;
1393
1394         if (conn->state != BT_CONNECTED)
1395                 return false;
1396
1397         return true;
1398 }
1399
1400 /* This function requires the caller holds hdev->lock */
1401 static int hci_explicit_conn_params_set(struct hci_dev *hdev,
1402                                         bdaddr_t *addr, u8 addr_type)
1403 {
1404         struct hci_conn_params *params;
1405
1406         if (is_connected(hdev, addr, addr_type))
1407                 return -EISCONN;
1408
1409         params = hci_conn_params_lookup(hdev, addr, addr_type);
1410         if (!params) {
1411                 params = hci_conn_params_add(hdev, addr, addr_type);
1412                 if (!params)
1413                         return -ENOMEM;
1414
1415                 /* If we created new params, mark them to be deleted in
1416                  * hci_connect_le_scan_cleanup. It's different case than
1417                  * existing disabled params, those will stay after cleanup.
1418                  */
1419                 params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
1420         }
1421
1422         /* We're trying to connect, so make sure params are at pend_le_conns */
1423         if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
1424             params->auto_connect == HCI_AUTO_CONN_REPORT ||
1425             params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
1426                 hci_pend_le_list_del_init(params);
1427                 hci_pend_le_list_add(params, &hdev->pend_le_conns);
1428         }
1429
1430         params->explicit_connect = true;
1431
1432         BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
1433                params->auto_connect);
1434
1435         return 0;
1436 }
1437
1438 static int qos_set_big(struct hci_dev *hdev, struct bt_iso_qos *qos)
1439 {
1440         struct hci_conn *conn;
1441         u8  big;
1442
1443         /* Allocate a BIG if not set */
1444         if (qos->bcast.big == BT_ISO_QOS_BIG_UNSET) {
1445                 for (big = 0x00; big < 0xef; big++) {
1446
1447                         conn = hci_conn_hash_lookup_big(hdev, big);
1448                         if (!conn)
1449                                 break;
1450                 }
1451
1452                 if (big == 0xef)
1453                         return -EADDRNOTAVAIL;
1454
1455                 /* Update BIG */
1456                 qos->bcast.big = big;
1457         }
1458
1459         return 0;
1460 }
1461
1462 static int qos_set_bis(struct hci_dev *hdev, struct bt_iso_qos *qos)
1463 {
1464         struct hci_conn *conn;
1465         u8  bis;
1466
1467         /* Allocate BIS if not set */
1468         if (qos->bcast.bis == BT_ISO_QOS_BIS_UNSET) {
1469                 if (qos->bcast.big != BT_ISO_QOS_BIG_UNSET) {
1470                         conn = hci_conn_hash_lookup_big(hdev, qos->bcast.big);
1471
1472                         if (conn) {
1473                                 /* If the BIG handle is already matched to an advertising
1474                                  * handle, do not allocate a new one.
1475                                  */
1476                                 qos->bcast.bis = conn->iso_qos.bcast.bis;
1477                                 return 0;
1478                         }
1479                 }
1480
1481                 /* Find an unused adv set to advertise BIS, skip instance 0x00
1482                  * since it is reserved as general purpose set.
1483                  */
1484                 for (bis = 0x01; bis < hdev->le_num_of_adv_sets;
1485                      bis++) {
1486
1487                         conn = hci_conn_hash_lookup_bis(hdev, BDADDR_ANY, bis);
1488                         if (!conn)
1489                                 break;
1490                 }
1491
1492                 if (bis == hdev->le_num_of_adv_sets)
1493                         return -EADDRNOTAVAIL;
1494
1495                 /* Update BIS */
1496                 qos->bcast.bis = bis;
1497         }
1498
1499         return 0;
1500 }
1501
1502 /* This function requires the caller holds hdev->lock */
1503 static struct hci_conn *hci_add_bis(struct hci_dev *hdev, bdaddr_t *dst,
1504                                     __u8 sid, struct bt_iso_qos *qos,
1505                                     __u8 base_len, __u8 *base)
1506 {
1507         struct hci_conn *conn;
1508         int err;
1509
1510         /* Let's make sure that le is enabled.*/
1511         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1512                 if (lmp_le_capable(hdev))
1513                         return ERR_PTR(-ECONNREFUSED);
1514                 return ERR_PTR(-EOPNOTSUPP);
1515         }
1516
1517         err = qos_set_big(hdev, qos);
1518         if (err)
1519                 return ERR_PTR(err);
1520
1521         err = qos_set_bis(hdev, qos);
1522         if (err)
1523                 return ERR_PTR(err);
1524
1525         /* Check if the LE Create BIG command has already been sent */
1526         conn = hci_conn_hash_lookup_per_adv_bis(hdev, dst, qos->bcast.big,
1527                                                 qos->bcast.big);
1528         if (conn)
1529                 return ERR_PTR(-EADDRINUSE);
1530
1531         /* Check BIS settings against other bound BISes, since all
1532          * BISes in a BIG must have the same value for all parameters
1533          */
1534         conn = hci_conn_hash_lookup_big(hdev, qos->bcast.big);
1535
1536         if (conn && (memcmp(qos, &conn->iso_qos, sizeof(*qos)) ||
1537                      base_len != conn->le_per_adv_data_len ||
1538                      memcmp(conn->le_per_adv_data, base, base_len)))
1539                 return ERR_PTR(-EADDRINUSE);
1540
1541         conn = hci_conn_add_unset(hdev, BIS_LINK, dst, HCI_ROLE_MASTER);
1542         if (IS_ERR(conn))
1543                 return conn;
1544
1545         conn->state = BT_CONNECT;
1546         conn->sid = sid;
1547
1548         hci_conn_hold(conn);
1549         return conn;
1550 }
1551
1552 /* This function requires the caller holds hdev->lock */
1553 struct hci_conn *hci_connect_le_scan(struct hci_dev *hdev, bdaddr_t *dst,
1554                                      u8 dst_type, u8 sec_level,
1555                                      u16 conn_timeout,
1556                                      enum conn_reasons conn_reason)
1557 {
1558         struct hci_conn *conn;
1559
1560         /* Let's make sure that le is enabled.*/
1561         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1562                 if (lmp_le_capable(hdev))
1563                         return ERR_PTR(-ECONNREFUSED);
1564
1565                 return ERR_PTR(-EOPNOTSUPP);
1566         }
1567
1568         /* Some devices send ATT messages as soon as the physical link is
1569          * established. To be able to handle these ATT messages, the user-
1570          * space first establishes the connection and then starts the pairing
1571          * process.
1572          *
1573          * So if a hci_conn object already exists for the following connection
1574          * attempt, we simply update pending_sec_level and auth_type fields
1575          * and return the object found.
1576          */
1577         conn = hci_conn_hash_lookup_le(hdev, dst, dst_type);
1578         if (conn) {
1579                 if (conn->pending_sec_level < sec_level)
1580                         conn->pending_sec_level = sec_level;
1581                 goto done;
1582         }
1583
1584         BT_DBG("requesting refresh of dst_addr");
1585
1586         conn = hci_conn_add_unset(hdev, LE_LINK, dst, HCI_ROLE_MASTER);
1587         if (IS_ERR(conn))
1588                 return conn;
1589
1590         if (hci_explicit_conn_params_set(hdev, dst, dst_type) < 0) {
1591                 hci_conn_del(conn);
1592                 return ERR_PTR(-EBUSY);
1593         }
1594
1595         conn->state = BT_CONNECT;
1596         set_bit(HCI_CONN_SCANNING, &conn->flags);
1597         conn->dst_type = dst_type;
1598         conn->sec_level = BT_SECURITY_LOW;
1599         conn->pending_sec_level = sec_level;
1600         conn->conn_timeout = conn_timeout;
1601         conn->conn_reason = conn_reason;
1602
1603         hci_update_passive_scan(hdev);
1604
1605 done:
1606         hci_conn_hold(conn);
1607         return conn;
1608 }
1609
1610 struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst,
1611                                  u8 sec_level, u8 auth_type,
1612                                  enum conn_reasons conn_reason, u16 timeout)
1613 {
1614         struct hci_conn *acl;
1615
1616         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1617                 if (lmp_bredr_capable(hdev))
1618                         return ERR_PTR(-ECONNREFUSED);
1619
1620                 return ERR_PTR(-EOPNOTSUPP);
1621         }
1622
1623         /* Reject outgoing connection to device with same BD ADDR against
1624          * CVE-2020-26555
1625          */
1626         if (!bacmp(&hdev->bdaddr, dst)) {
1627                 bt_dev_dbg(hdev, "Reject connection with same BD_ADDR %pMR\n",
1628                            dst);
1629                 return ERR_PTR(-ECONNREFUSED);
1630         }
1631
1632         acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
1633         if (!acl) {
1634                 acl = hci_conn_add_unset(hdev, ACL_LINK, dst, HCI_ROLE_MASTER);
1635                 if (IS_ERR(acl))
1636                         return acl;
1637         }
1638
1639         hci_conn_hold(acl);
1640
1641         acl->conn_reason = conn_reason;
1642         if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
1643                 int err;
1644
1645                 acl->sec_level = BT_SECURITY_LOW;
1646                 acl->pending_sec_level = sec_level;
1647                 acl->auth_type = auth_type;
1648                 acl->conn_timeout = timeout;
1649
1650                 err = hci_connect_acl_sync(hdev, acl);
1651                 if (err) {
1652                         hci_conn_del(acl);
1653                         return ERR_PTR(err);
1654                 }
1655         }
1656
1657         return acl;
1658 }
1659
1660 static struct hci_link *hci_conn_link(struct hci_conn *parent,
1661                                       struct hci_conn *conn)
1662 {
1663         struct hci_dev *hdev = parent->hdev;
1664         struct hci_link *link;
1665
1666         bt_dev_dbg(hdev, "parent %p hcon %p", parent, conn);
1667
1668         if (conn->link)
1669                 return conn->link;
1670
1671         if (conn->parent)
1672                 return NULL;
1673
1674         link = kzalloc(sizeof(*link), GFP_KERNEL);
1675         if (!link)
1676                 return NULL;
1677
1678         link->conn = hci_conn_hold(conn);
1679         conn->link = link;
1680         conn->parent = hci_conn_get(parent);
1681
1682         /* Use list_add_tail_rcu append to the list */
1683         list_add_tail_rcu(&link->list, &parent->link_list);
1684
1685         return link;
1686 }
1687
1688 struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type, bdaddr_t *dst,
1689                                  __u16 setting, struct bt_codec *codec,
1690                                  u16 timeout)
1691 {
1692         struct hci_conn *acl;
1693         struct hci_conn *sco;
1694         struct hci_link *link;
1695
1696         acl = hci_connect_acl(hdev, dst, BT_SECURITY_LOW, HCI_AT_NO_BONDING,
1697                               CONN_REASON_SCO_CONNECT, timeout);
1698         if (IS_ERR(acl))
1699                 return acl;
1700
1701         sco = hci_conn_hash_lookup_ba(hdev, type, dst);
1702         if (!sco) {
1703                 sco = hci_conn_add_unset(hdev, type, dst, HCI_ROLE_MASTER);
1704                 if (IS_ERR(sco)) {
1705                         hci_conn_drop(acl);
1706                         return sco;
1707                 }
1708         }
1709
1710         link = hci_conn_link(acl, sco);
1711         if (!link) {
1712                 hci_conn_drop(acl);
1713                 hci_conn_drop(sco);
1714                 return ERR_PTR(-ENOLINK);
1715         }
1716
1717         sco->setting = setting;
1718         sco->codec = *codec;
1719
1720         if (acl->state == BT_CONNECTED &&
1721             (sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
1722                 set_bit(HCI_CONN_POWER_SAVE, &acl->flags);
1723                 hci_conn_enter_active_mode(acl, BT_POWER_FORCE_ACTIVE_ON);
1724
1725                 if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->flags)) {
1726                         /* defer SCO setup until mode change completed */
1727                         set_bit(HCI_CONN_SCO_SETUP_PEND, &acl->flags);
1728                         return sco;
1729                 }
1730
1731                 hci_sco_setup(acl, 0x00);
1732         }
1733
1734         return sco;
1735 }
1736
1737 static int hci_le_create_big(struct hci_conn *conn, struct bt_iso_qos *qos)
1738 {
1739         struct hci_dev *hdev = conn->hdev;
1740         struct hci_cp_le_create_big cp;
1741         struct iso_list_data data;
1742
1743         memset(&cp, 0, sizeof(cp));
1744
1745         data.big = qos->bcast.big;
1746         data.bis = qos->bcast.bis;
1747         data.count = 0;
1748
1749         /* Create a BIS for each bound connection */
1750         hci_conn_hash_list_state(hdev, bis_list, BIS_LINK,
1751                                  BT_BOUND, &data);
1752
1753         cp.handle = qos->bcast.big;
1754         cp.adv_handle = qos->bcast.bis;
1755         cp.num_bis  = data.count;
1756         hci_cpu_to_le24(qos->bcast.out.interval, cp.bis.sdu_interval);
1757         cp.bis.sdu = cpu_to_le16(qos->bcast.out.sdu);
1758         cp.bis.latency =  cpu_to_le16(qos->bcast.out.latency);
1759         cp.bis.rtn  = qos->bcast.out.rtn;
1760         cp.bis.phy  = qos->bcast.out.phy;
1761         cp.bis.packing = qos->bcast.packing;
1762         cp.bis.framing = qos->bcast.framing;
1763         cp.bis.encryption = qos->bcast.encryption;
1764         memcpy(cp.bis.bcode, qos->bcast.bcode, sizeof(cp.bis.bcode));
1765
1766         return hci_send_cmd(hdev, HCI_OP_LE_CREATE_BIG, sizeof(cp), &cp);
1767 }
1768
1769 static int set_cig_params_sync(struct hci_dev *hdev, void *data)
1770 {
1771         DEFINE_FLEX(struct hci_cp_le_set_cig_params, pdu, cis, num_cis, 0x1f);
1772         u8 cig_id = PTR_UINT(data);
1773         struct hci_conn *conn;
1774         struct bt_iso_qos *qos;
1775         u8 aux_num_cis = 0;
1776         u8 cis_id;
1777
1778         conn = hci_conn_hash_lookup_cig(hdev, cig_id);
1779         if (!conn)
1780                 return 0;
1781
1782         qos = &conn->iso_qos;
1783         pdu->cig_id = cig_id;
1784         hci_cpu_to_le24(qos->ucast.out.interval, pdu->c_interval);
1785         hci_cpu_to_le24(qos->ucast.in.interval, pdu->p_interval);
1786         pdu->sca = qos->ucast.sca;
1787         pdu->packing = qos->ucast.packing;
1788         pdu->framing = qos->ucast.framing;
1789         pdu->c_latency = cpu_to_le16(qos->ucast.out.latency);
1790         pdu->p_latency = cpu_to_le16(qos->ucast.in.latency);
1791
1792         /* Reprogram all CIS(s) with the same CIG, valid range are:
1793          * num_cis: 0x00 to 0x1F
1794          * cis_id: 0x00 to 0xEF
1795          */
1796         for (cis_id = 0x00; cis_id < 0xf0 &&
1797              aux_num_cis < pdu->num_cis; cis_id++) {
1798                 struct hci_cis_params *cis;
1799
1800                 conn = hci_conn_hash_lookup_cis(hdev, NULL, 0, cig_id, cis_id);
1801                 if (!conn)
1802                         continue;
1803
1804                 qos = &conn->iso_qos;
1805
1806                 cis = &pdu->cis[aux_num_cis++];
1807                 cis->cis_id = cis_id;
1808                 cis->c_sdu  = cpu_to_le16(conn->iso_qos.ucast.out.sdu);
1809                 cis->p_sdu  = cpu_to_le16(conn->iso_qos.ucast.in.sdu);
1810                 cis->c_phy  = qos->ucast.out.phy ? qos->ucast.out.phy :
1811                               qos->ucast.in.phy;
1812                 cis->p_phy  = qos->ucast.in.phy ? qos->ucast.in.phy :
1813                               qos->ucast.out.phy;
1814                 cis->c_rtn  = qos->ucast.out.rtn;
1815                 cis->p_rtn  = qos->ucast.in.rtn;
1816         }
1817         pdu->num_cis = aux_num_cis;
1818
1819         if (!pdu->num_cis)
1820                 return 0;
1821
1822         return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_CIG_PARAMS,
1823                                      struct_size(pdu, cis, pdu->num_cis),
1824                                      pdu, HCI_CMD_TIMEOUT);
1825 }
1826
1827 static bool hci_le_set_cig_params(struct hci_conn *conn, struct bt_iso_qos *qos)
1828 {
1829         struct hci_dev *hdev = conn->hdev;
1830         struct iso_list_data data;
1831
1832         memset(&data, 0, sizeof(data));
1833
1834         /* Allocate first still reconfigurable CIG if not set */
1835         if (qos->ucast.cig == BT_ISO_QOS_CIG_UNSET) {
1836                 for (data.cig = 0x00; data.cig < 0xf0; data.cig++) {
1837                         data.count = 0;
1838
1839                         hci_conn_hash_list_state(hdev, find_cis, CIS_LINK,
1840                                                  BT_CONNECT, &data);
1841                         if (data.count)
1842                                 continue;
1843
1844                         hci_conn_hash_list_state(hdev, find_cis, CIS_LINK,
1845                                                  BT_CONNECTED, &data);
1846                         if (!data.count)
1847                                 break;
1848                 }
1849
1850                 if (data.cig == 0xf0)
1851                         return false;
1852
1853                 /* Update CIG */
1854                 qos->ucast.cig = data.cig;
1855         }
1856
1857         if (qos->ucast.cis != BT_ISO_QOS_CIS_UNSET) {
1858                 if (hci_conn_hash_lookup_cis(hdev, NULL, 0, qos->ucast.cig,
1859                                              qos->ucast.cis))
1860                         return false;
1861                 goto done;
1862         }
1863
1864         /* Allocate first available CIS if not set */
1865         for (data.cig = qos->ucast.cig, data.cis = 0x00; data.cis < 0xf0;
1866              data.cis++) {
1867                 if (!hci_conn_hash_lookup_cis(hdev, NULL, 0, data.cig,
1868                                               data.cis)) {
1869                         /* Update CIS */
1870                         qos->ucast.cis = data.cis;
1871                         break;
1872                 }
1873         }
1874
1875         if (qos->ucast.cis == BT_ISO_QOS_CIS_UNSET)
1876                 return false;
1877
1878 done:
1879         if (hci_cmd_sync_queue(hdev, set_cig_params_sync,
1880                                UINT_PTR(qos->ucast.cig), NULL) < 0)
1881                 return false;
1882
1883         return true;
1884 }
1885
1886 struct hci_conn *hci_bind_cis(struct hci_dev *hdev, bdaddr_t *dst,
1887                               __u8 dst_type, struct bt_iso_qos *qos)
1888 {
1889         struct hci_conn *cis;
1890
1891         cis = hci_conn_hash_lookup_cis(hdev, dst, dst_type, qos->ucast.cig,
1892                                        qos->ucast.cis);
1893         if (!cis) {
1894                 cis = hci_conn_add_unset(hdev, CIS_LINK, dst,
1895                                          HCI_ROLE_MASTER);
1896                 if (IS_ERR(cis))
1897                         return cis;
1898                 cis->cleanup = cis_cleanup;
1899                 cis->dst_type = dst_type;
1900                 cis->iso_qos.ucast.cig = BT_ISO_QOS_CIG_UNSET;
1901                 cis->iso_qos.ucast.cis = BT_ISO_QOS_CIS_UNSET;
1902         }
1903
1904         if (cis->state == BT_CONNECTED)
1905                 return cis;
1906
1907         /* Check if CIS has been set and the settings matches */
1908         if (cis->state == BT_BOUND &&
1909             !memcmp(&cis->iso_qos, qos, sizeof(*qos)))
1910                 return cis;
1911
1912         /* Update LINK PHYs according to QoS preference */
1913         cis->le_tx_phy = qos->ucast.out.phy;
1914         cis->le_rx_phy = qos->ucast.in.phy;
1915
1916         /* If output interval is not set use the input interval as it cannot be
1917          * 0x000000.
1918          */
1919         if (!qos->ucast.out.interval)
1920                 qos->ucast.out.interval = qos->ucast.in.interval;
1921
1922         /* If input interval is not set use the output interval as it cannot be
1923          * 0x000000.
1924          */
1925         if (!qos->ucast.in.interval)
1926                 qos->ucast.in.interval = qos->ucast.out.interval;
1927
1928         /* If output latency is not set use the input latency as it cannot be
1929          * 0x0000.
1930          */
1931         if (!qos->ucast.out.latency)
1932                 qos->ucast.out.latency = qos->ucast.in.latency;
1933
1934         /* If input latency is not set use the output latency as it cannot be
1935          * 0x0000.
1936          */
1937         if (!qos->ucast.in.latency)
1938                 qos->ucast.in.latency = qos->ucast.out.latency;
1939
1940         if (!hci_le_set_cig_params(cis, qos)) {
1941                 hci_conn_drop(cis);
1942                 return ERR_PTR(-EINVAL);
1943         }
1944
1945         hci_conn_hold(cis);
1946
1947         cis->iso_qos = *qos;
1948         cis->state = BT_BOUND;
1949
1950         return cis;
1951 }
1952
1953 bool hci_iso_setup_path(struct hci_conn *conn)
1954 {
1955         struct hci_dev *hdev = conn->hdev;
1956         struct hci_cp_le_setup_iso_path cmd;
1957
1958         memset(&cmd, 0, sizeof(cmd));
1959
1960         if (conn->iso_qos.ucast.out.sdu) {
1961                 cmd.handle = cpu_to_le16(conn->handle);
1962                 cmd.direction = 0x00; /* Input (Host to Controller) */
1963                 cmd.path = 0x00; /* HCI path if enabled */
1964                 cmd.codec = 0x03; /* Transparent Data */
1965
1966                 if (hci_send_cmd(hdev, HCI_OP_LE_SETUP_ISO_PATH, sizeof(cmd),
1967                                  &cmd) < 0)
1968                         return false;
1969         }
1970
1971         if (conn->iso_qos.ucast.in.sdu) {
1972                 cmd.handle = cpu_to_le16(conn->handle);
1973                 cmd.direction = 0x01; /* Output (Controller to Host) */
1974                 cmd.path = 0x00; /* HCI path if enabled */
1975                 cmd.codec = 0x03; /* Transparent Data */
1976
1977                 if (hci_send_cmd(hdev, HCI_OP_LE_SETUP_ISO_PATH, sizeof(cmd),
1978                                  &cmd) < 0)
1979                         return false;
1980         }
1981
1982         return true;
1983 }
1984
1985 int hci_conn_check_create_cis(struct hci_conn *conn)
1986 {
1987         if (conn->type != CIS_LINK)
1988                 return -EINVAL;
1989
1990         if (!conn->parent || conn->parent->state != BT_CONNECTED ||
1991             conn->state != BT_CONNECT || HCI_CONN_HANDLE_UNSET(conn->handle))
1992                 return 1;
1993
1994         return 0;
1995 }
1996
1997 static int hci_create_cis_sync(struct hci_dev *hdev, void *data)
1998 {
1999         return hci_le_create_cis_sync(hdev);
2000 }
2001
2002 int hci_le_create_cis_pending(struct hci_dev *hdev)
2003 {
2004         struct hci_conn *conn;
2005         bool pending = false;
2006
2007         rcu_read_lock();
2008
2009         list_for_each_entry_rcu(conn, &hdev->conn_hash.list, list) {
2010                 if (test_bit(HCI_CONN_CREATE_CIS, &conn->flags)) {
2011                         rcu_read_unlock();
2012                         return -EBUSY;
2013                 }
2014
2015                 if (!hci_conn_check_create_cis(conn))
2016                         pending = true;
2017         }
2018
2019         rcu_read_unlock();
2020
2021         if (!pending)
2022                 return 0;
2023
2024         /* Queue Create CIS */
2025         return hci_cmd_sync_queue(hdev, hci_create_cis_sync, NULL, NULL);
2026 }
2027
2028 static void hci_iso_qos_setup(struct hci_dev *hdev, struct hci_conn *conn,
2029                               struct bt_iso_io_qos *qos, __u8 phy)
2030 {
2031         /* Only set MTU if PHY is enabled */
2032         if (!qos->sdu && qos->phy)
2033                 qos->sdu = conn->mtu;
2034
2035         /* Use the same PHY as ACL if set to any */
2036         if (qos->phy == BT_ISO_PHY_ANY)
2037                 qos->phy = phy;
2038
2039         /* Use LE ACL connection interval if not set */
2040         if (!qos->interval)
2041                 /* ACL interval unit in 1.25 ms to us */
2042                 qos->interval = conn->le_conn_interval * 1250;
2043
2044         /* Use LE ACL connection latency if not set */
2045         if (!qos->latency)
2046                 qos->latency = conn->le_conn_latency;
2047 }
2048
2049 static int create_big_sync(struct hci_dev *hdev, void *data)
2050 {
2051         struct hci_conn *conn = data;
2052         struct bt_iso_qos *qos = &conn->iso_qos;
2053         u16 interval, sync_interval = 0;
2054         u32 flags = 0;
2055         int err;
2056
2057         if (qos->bcast.out.phy == 0x02)
2058                 flags |= MGMT_ADV_FLAG_SEC_2M;
2059
2060         /* Align intervals */
2061         interval = (qos->bcast.out.interval / 1250) * qos->bcast.sync_factor;
2062
2063         if (qos->bcast.bis)
2064                 sync_interval = interval * 4;
2065
2066         err = hci_start_per_adv_sync(hdev, qos->bcast.bis, conn->sid,
2067                                      conn->le_per_adv_data_len,
2068                                      conn->le_per_adv_data, flags, interval,
2069                                      interval, sync_interval);
2070         if (err)
2071                 return err;
2072
2073         return hci_le_create_big(conn, &conn->iso_qos);
2074 }
2075
2076 struct hci_conn *hci_pa_create_sync(struct hci_dev *hdev, bdaddr_t *dst,
2077                                     __u8 dst_type, __u8 sid,
2078                                     struct bt_iso_qos *qos)
2079 {
2080         struct hci_conn *conn;
2081
2082         bt_dev_dbg(hdev, "dst %pMR type %d sid %d", dst, dst_type, sid);
2083
2084         conn = hci_conn_add_unset(hdev, BIS_LINK, dst, HCI_ROLE_SLAVE);
2085         if (IS_ERR(conn))
2086                 return conn;
2087
2088         conn->iso_qos = *qos;
2089         conn->dst_type = dst_type;
2090         conn->sid = sid;
2091         conn->state = BT_LISTEN;
2092         conn->conn_timeout = msecs_to_jiffies(qos->bcast.sync_timeout * 10);
2093
2094         hci_conn_hold(conn);
2095
2096         hci_connect_pa_sync(hdev, conn);
2097
2098         return conn;
2099 }
2100
2101 int hci_conn_big_create_sync(struct hci_dev *hdev, struct hci_conn *hcon,
2102                              struct bt_iso_qos *qos, __u16 sync_handle,
2103                              __u8 num_bis, __u8 bis[])
2104 {
2105         int err;
2106
2107         if (num_bis < 0x01 || num_bis > ISO_MAX_NUM_BIS)
2108                 return -EINVAL;
2109
2110         err = qos_set_big(hdev, qos);
2111         if (err)
2112                 return err;
2113
2114         if (hcon) {
2115                 /* Update hcon QoS */
2116                 hcon->iso_qos = *qos;
2117
2118                 hcon->num_bis = num_bis;
2119                 memcpy(hcon->bis, bis, num_bis);
2120                 hcon->conn_timeout = msecs_to_jiffies(qos->bcast.timeout * 10);
2121         }
2122
2123         return hci_connect_big_sync(hdev, hcon);
2124 }
2125
2126 static void create_big_complete(struct hci_dev *hdev, void *data, int err)
2127 {
2128         struct hci_conn *conn = data;
2129
2130         bt_dev_dbg(hdev, "conn %p", conn);
2131
2132         if (err) {
2133                 bt_dev_err(hdev, "Unable to create BIG: %d", err);
2134                 hci_connect_cfm(conn, err);
2135                 hci_conn_del(conn);
2136         }
2137 }
2138
2139 struct hci_conn *hci_bind_bis(struct hci_dev *hdev, bdaddr_t *dst, __u8 sid,
2140                               struct bt_iso_qos *qos,
2141                               __u8 base_len, __u8 *base)
2142 {
2143         struct hci_conn *conn;
2144         struct hci_conn *parent;
2145         __u8 eir[HCI_MAX_PER_AD_LENGTH];
2146         struct hci_link *link;
2147
2148         /* Look for any BIS that is open for rebinding */
2149         conn = hci_conn_hash_lookup_big_state(hdev, qos->bcast.big, BT_OPEN);
2150         if (conn) {
2151                 memcpy(qos, &conn->iso_qos, sizeof(*qos));
2152                 conn->state = BT_CONNECTED;
2153                 return conn;
2154         }
2155
2156         if (base_len && base)
2157                 base_len = eir_append_service_data(eir, 0,  0x1851,
2158                                                    base, base_len);
2159
2160         /* We need hci_conn object using the BDADDR_ANY as dst */
2161         conn = hci_add_bis(hdev, dst, sid, qos, base_len, eir);
2162         if (IS_ERR(conn))
2163                 return conn;
2164
2165         /* Update LINK PHYs according to QoS preference */
2166         conn->le_tx_phy = qos->bcast.out.phy;
2167         conn->le_tx_phy = qos->bcast.out.phy;
2168
2169         /* Add Basic Announcement into Peridic Adv Data if BASE is set */
2170         if (base_len && base) {
2171                 memcpy(conn->le_per_adv_data,  eir, sizeof(eir));
2172                 conn->le_per_adv_data_len = base_len;
2173         }
2174
2175         hci_iso_qos_setup(hdev, conn, &qos->bcast.out,
2176                           conn->le_tx_phy ? conn->le_tx_phy :
2177                           hdev->le_tx_def_phys);
2178
2179         conn->iso_qos = *qos;
2180         conn->state = BT_BOUND;
2181
2182         /* Link BISes together */
2183         parent = hci_conn_hash_lookup_big(hdev,
2184                                           conn->iso_qos.bcast.big);
2185         if (parent && parent != conn) {
2186                 link = hci_conn_link(parent, conn);
2187                 hci_conn_drop(conn);
2188                 if (!link)
2189                         return ERR_PTR(-ENOLINK);
2190         }
2191
2192         return conn;
2193 }
2194
2195 static void bis_mark_per_adv(struct hci_conn *conn, void *data)
2196 {
2197         struct iso_list_data *d = data;
2198
2199         /* Skip if not broadcast/ANY address */
2200         if (bacmp(&conn->dst, BDADDR_ANY))
2201                 return;
2202
2203         if (d->big != conn->iso_qos.bcast.big ||
2204             d->bis == BT_ISO_QOS_BIS_UNSET ||
2205             d->bis != conn->iso_qos.bcast.bis)
2206                 return;
2207
2208         set_bit(HCI_CONN_PER_ADV, &conn->flags);
2209 }
2210
2211 struct hci_conn *hci_connect_bis(struct hci_dev *hdev, bdaddr_t *dst,
2212                                  __u8 dst_type, __u8 sid,
2213                                  struct bt_iso_qos *qos,
2214                                  __u8 base_len, __u8 *base)
2215 {
2216         struct hci_conn *conn;
2217         int err;
2218         struct iso_list_data data;
2219
2220         conn = hci_bind_bis(hdev, dst, sid, qos, base_len, base);
2221         if (IS_ERR(conn))
2222                 return conn;
2223
2224         if (conn->state == BT_CONNECTED)
2225                 return conn;
2226
2227         /* Check if SID needs to be allocated then search for the first
2228          * available.
2229          */
2230         if (conn->sid == HCI_SID_INVALID) {
2231                 u8 sid;
2232
2233                 for (sid = 0; sid <= 0x0f; sid++) {
2234                         if (!hci_find_adv_sid(hdev, sid)) {
2235                                 conn->sid = sid;
2236                                 break;
2237                         }
2238                 }
2239         }
2240
2241         data.big = qos->bcast.big;
2242         data.bis = qos->bcast.bis;
2243
2244         /* Set HCI_CONN_PER_ADV for all bound connections, to mark that
2245          * the start periodic advertising and create BIG commands have
2246          * been queued
2247          */
2248         hci_conn_hash_list_state(hdev, bis_mark_per_adv, BIS_LINK,
2249                                  BT_BOUND, &data);
2250
2251         /* Queue start periodic advertising and create BIG */
2252         err = hci_cmd_sync_queue(hdev, create_big_sync, conn,
2253                                  create_big_complete);
2254         if (err < 0) {
2255                 hci_conn_drop(conn);
2256                 return ERR_PTR(err);
2257         }
2258
2259         return conn;
2260 }
2261
2262 struct hci_conn *hci_connect_cis(struct hci_dev *hdev, bdaddr_t *dst,
2263                                  __u8 dst_type, struct bt_iso_qos *qos)
2264 {
2265         struct hci_conn *le;
2266         struct hci_conn *cis;
2267         struct hci_link *link;
2268
2269         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
2270                 le = hci_connect_le(hdev, dst, dst_type, false,
2271                                     BT_SECURITY_LOW,
2272                                     HCI_LE_CONN_TIMEOUT,
2273                                     HCI_ROLE_SLAVE, 0, 0);
2274         else
2275                 le = hci_connect_le_scan(hdev, dst, dst_type,
2276                                          BT_SECURITY_LOW,
2277                                          HCI_LE_CONN_TIMEOUT,
2278                                          CONN_REASON_ISO_CONNECT);
2279         if (IS_ERR(le))
2280                 return le;
2281
2282         hci_iso_qos_setup(hdev, le, &qos->ucast.out,
2283                           le->le_tx_phy ? le->le_tx_phy : hdev->le_tx_def_phys);
2284         hci_iso_qos_setup(hdev, le, &qos->ucast.in,
2285                           le->le_rx_phy ? le->le_rx_phy : hdev->le_rx_def_phys);
2286
2287         cis = hci_bind_cis(hdev, dst, dst_type, qos);
2288         if (IS_ERR(cis)) {
2289                 hci_conn_drop(le);
2290                 return cis;
2291         }
2292
2293         link = hci_conn_link(le, cis);
2294         hci_conn_drop(cis);
2295         if (!link) {
2296                 hci_conn_drop(le);
2297                 return ERR_PTR(-ENOLINK);
2298         }
2299
2300         cis->state = BT_CONNECT;
2301
2302         hci_le_create_cis_pending(hdev);
2303
2304         return cis;
2305 }
2306
2307 /* Check link security requirement */
2308 int hci_conn_check_link_mode(struct hci_conn *conn)
2309 {
2310         BT_DBG("hcon %p", conn);
2311
2312         /* In Secure Connections Only mode, it is required that Secure
2313          * Connections is used and the link is encrypted with AES-CCM
2314          * using a P-256 authenticated combination key.
2315          */
2316         if (hci_dev_test_flag(conn->hdev, HCI_SC_ONLY)) {
2317                 if (!hci_conn_sc_enabled(conn) ||
2318                     !test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
2319                     conn->key_type != HCI_LK_AUTH_COMBINATION_P256)
2320                         return 0;
2321         }
2322
2323          /* AES encryption is required for Level 4:
2324           *
2325           * BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 3, Part C
2326           * page 1319:
2327           *
2328           * 128-bit equivalent strength for link and encryption keys
2329           * required using FIPS approved algorithms (E0 not allowed,
2330           * SAFER+ not allowed, and P-192 not allowed; encryption key
2331           * not shortened)
2332           */
2333         if (conn->sec_level == BT_SECURITY_FIPS &&
2334             !test_bit(HCI_CONN_AES_CCM, &conn->flags)) {
2335                 bt_dev_err(conn->hdev,
2336                            "Invalid security: Missing AES-CCM usage");
2337                 return 0;
2338         }
2339
2340         if (hci_conn_ssp_enabled(conn) &&
2341             !test_bit(HCI_CONN_ENCRYPT, &conn->flags))
2342                 return 0;
2343
2344         return 1;
2345 }
2346
2347 /* Authenticate remote device */
2348 static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
2349 {
2350         BT_DBG("hcon %p", conn);
2351
2352         if (conn->pending_sec_level > sec_level)
2353                 sec_level = conn->pending_sec_level;
2354
2355         if (sec_level > conn->sec_level)
2356                 conn->pending_sec_level = sec_level;
2357         else if (test_bit(HCI_CONN_AUTH, &conn->flags))
2358                 return 1;
2359
2360         /* Make sure we preserve an existing MITM requirement*/
2361         auth_type |= (conn->auth_type & 0x01);
2362
2363         conn->auth_type = auth_type;
2364
2365         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
2366                 struct hci_cp_auth_requested cp;
2367
2368                 cp.handle = cpu_to_le16(conn->handle);
2369                 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
2370                              sizeof(cp), &cp);
2371
2372                 /* Set the ENCRYPT_PEND to trigger encryption after
2373                  * authentication.
2374                  */
2375                 if (!test_bit(HCI_CONN_ENCRYPT, &conn->flags))
2376                         set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2377         }
2378
2379         return 0;
2380 }
2381
2382 /* Encrypt the link */
2383 static void hci_conn_encrypt(struct hci_conn *conn)
2384 {
2385         BT_DBG("hcon %p", conn);
2386
2387         if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
2388                 struct hci_cp_set_conn_encrypt cp;
2389                 cp.handle  = cpu_to_le16(conn->handle);
2390                 cp.encrypt = 0x01;
2391                 hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2392                              &cp);
2393         }
2394 }
2395
2396 /* Enable security */
2397 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type,
2398                       bool initiator)
2399 {
2400         BT_DBG("hcon %p", conn);
2401
2402         if (conn->type == LE_LINK)
2403                 return smp_conn_security(conn, sec_level);
2404
2405         /* For sdp we don't need the link key. */
2406         if (sec_level == BT_SECURITY_SDP)
2407                 return 1;
2408
2409         /* For non 2.1 devices and low security level we don't need the link
2410            key. */
2411         if (sec_level == BT_SECURITY_LOW && !hci_conn_ssp_enabled(conn))
2412                 return 1;
2413
2414         /* For other security levels we need the link key. */
2415         if (!test_bit(HCI_CONN_AUTH, &conn->flags))
2416                 goto auth;
2417
2418         switch (conn->key_type) {
2419         case HCI_LK_AUTH_COMBINATION_P256:
2420                 /* An authenticated FIPS approved combination key has
2421                  * sufficient security for security level 4 or lower.
2422                  */
2423                 if (sec_level <= BT_SECURITY_FIPS)
2424                         goto encrypt;
2425                 break;
2426         case HCI_LK_AUTH_COMBINATION_P192:
2427                 /* An authenticated combination key has sufficient security for
2428                  * security level 3 or lower.
2429                  */
2430                 if (sec_level <= BT_SECURITY_HIGH)
2431                         goto encrypt;
2432                 break;
2433         case HCI_LK_UNAUTH_COMBINATION_P192:
2434         case HCI_LK_UNAUTH_COMBINATION_P256:
2435                 /* An unauthenticated combination key has sufficient security
2436                  * for security level 2 or lower.
2437                  */
2438                 if (sec_level <= BT_SECURITY_MEDIUM)
2439                         goto encrypt;
2440                 break;
2441         case HCI_LK_COMBINATION:
2442                 /* A combination key has always sufficient security for the
2443                  * security levels 2 or lower. High security level requires the
2444                  * combination key is generated using maximum PIN code length
2445                  * (16). For pre 2.1 units.
2446                  */
2447                 if (sec_level <= BT_SECURITY_MEDIUM || conn->pin_length == 16)
2448                         goto encrypt;
2449                 break;
2450         default:
2451                 break;
2452         }
2453
2454 auth:
2455         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags))
2456                 return 0;
2457
2458         if (initiator)
2459                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
2460
2461         if (!hci_conn_auth(conn, sec_level, auth_type))
2462                 return 0;
2463
2464 encrypt:
2465         if (test_bit(HCI_CONN_ENCRYPT, &conn->flags)) {
2466                 /* Ensure that the encryption key size has been read,
2467                  * otherwise stall the upper layer responses.
2468                  */
2469                 if (!conn->enc_key_size)
2470                         return 0;
2471
2472                 /* Nothing else needed, all requirements are met */
2473                 return 1;
2474         }
2475
2476         hci_conn_encrypt(conn);
2477         return 0;
2478 }
2479 EXPORT_SYMBOL(hci_conn_security);
2480
2481 /* Check secure link requirement */
2482 int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level)
2483 {
2484         BT_DBG("hcon %p", conn);
2485
2486         /* Accept if non-secure or higher security level is required */
2487         if (sec_level != BT_SECURITY_HIGH && sec_level != BT_SECURITY_FIPS)
2488                 return 1;
2489
2490         /* Accept if secure or higher security level is already present */
2491         if (conn->sec_level == BT_SECURITY_HIGH ||
2492             conn->sec_level == BT_SECURITY_FIPS)
2493                 return 1;
2494
2495         /* Reject not secure link */
2496         return 0;
2497 }
2498 EXPORT_SYMBOL(hci_conn_check_secure);
2499
2500 /* Switch role */
2501 int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
2502 {
2503         BT_DBG("hcon %p", conn);
2504
2505         if (role == conn->role)
2506                 return 1;
2507
2508         if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->flags)) {
2509                 struct hci_cp_switch_role cp;
2510                 bacpy(&cp.bdaddr, &conn->dst);
2511                 cp.role = role;
2512                 hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
2513         }
2514
2515         return 0;
2516 }
2517 EXPORT_SYMBOL(hci_conn_switch_role);
2518
2519 /* Enter active mode */
2520 void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
2521 {
2522         struct hci_dev *hdev = conn->hdev;
2523
2524         BT_DBG("hcon %p mode %d", conn, conn->mode);
2525
2526         if (conn->mode != HCI_CM_SNIFF)
2527                 goto timer;
2528
2529         if (!test_bit(HCI_CONN_POWER_SAVE, &conn->flags) && !force_active)
2530                 goto timer;
2531
2532         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
2533                 struct hci_cp_exit_sniff_mode cp;
2534                 cp.handle = cpu_to_le16(conn->handle);
2535                 hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
2536         }
2537
2538 timer:
2539         if (hdev->idle_timeout > 0)
2540                 queue_delayed_work(hdev->workqueue, &conn->idle_work,
2541                                    msecs_to_jiffies(hdev->idle_timeout));
2542 }
2543
2544 /* Drop all connection on the device */
2545 void hci_conn_hash_flush(struct hci_dev *hdev)
2546 {
2547         struct list_head *head = &hdev->conn_hash.list;
2548         struct hci_conn *conn;
2549
2550         BT_DBG("hdev %s", hdev->name);
2551
2552         /* We should not traverse the list here, because hci_conn_del
2553          * can remove extra links, which may cause the list traversal
2554          * to hit items that have already been released.
2555          */
2556         while ((conn = list_first_entry_or_null(head,
2557                                                 struct hci_conn,
2558                                                 list)) != NULL) {
2559                 conn->state = BT_CLOSED;
2560                 hci_disconn_cfm(conn, HCI_ERROR_LOCAL_HOST_TERM);
2561                 hci_conn_del(conn);
2562         }
2563 }
2564
2565 static u32 get_link_mode(struct hci_conn *conn)
2566 {
2567         u32 link_mode = 0;
2568
2569         if (conn->role == HCI_ROLE_MASTER)
2570                 link_mode |= HCI_LM_MASTER;
2571
2572         if (test_bit(HCI_CONN_ENCRYPT, &conn->flags))
2573                 link_mode |= HCI_LM_ENCRYPT;
2574
2575         if (test_bit(HCI_CONN_AUTH, &conn->flags))
2576                 link_mode |= HCI_LM_AUTH;
2577
2578         if (test_bit(HCI_CONN_SECURE, &conn->flags))
2579                 link_mode |= HCI_LM_SECURE;
2580
2581         if (test_bit(HCI_CONN_FIPS, &conn->flags))
2582                 link_mode |= HCI_LM_FIPS;
2583
2584         return link_mode;
2585 }
2586
2587 int hci_get_conn_list(void __user *arg)
2588 {
2589         struct hci_conn *c;
2590         struct hci_conn_list_req req, *cl;
2591         struct hci_conn_info *ci;
2592         struct hci_dev *hdev;
2593         int n = 0, size, err;
2594
2595         if (copy_from_user(&req, arg, sizeof(req)))
2596                 return -EFAULT;
2597
2598         if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
2599                 return -EINVAL;
2600
2601         size = sizeof(req) + req.conn_num * sizeof(*ci);
2602
2603         cl = kmalloc(size, GFP_KERNEL);
2604         if (!cl)
2605                 return -ENOMEM;
2606
2607         hdev = hci_dev_get(req.dev_id);
2608         if (!hdev) {
2609                 kfree(cl);
2610                 return -ENODEV;
2611         }
2612
2613         ci = cl->conn_info;
2614
2615         hci_dev_lock(hdev);
2616         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2617                 bacpy(&(ci + n)->bdaddr, &c->dst);
2618                 (ci + n)->handle = c->handle;
2619                 (ci + n)->type  = c->type;
2620                 (ci + n)->out   = c->out;
2621                 (ci + n)->state = c->state;
2622                 (ci + n)->link_mode = get_link_mode(c);
2623                 if (++n >= req.conn_num)
2624                         break;
2625         }
2626         hci_dev_unlock(hdev);
2627
2628         cl->dev_id = hdev->id;
2629         cl->conn_num = n;
2630         size = sizeof(req) + n * sizeof(*ci);
2631
2632         hci_dev_put(hdev);
2633
2634         err = copy_to_user(arg, cl, size);
2635         kfree(cl);
2636
2637         return err ? -EFAULT : 0;
2638 }
2639
2640 int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
2641 {
2642         struct hci_conn_info_req req;
2643         struct hci_conn_info ci;
2644         struct hci_conn *conn;
2645         char __user *ptr = arg + sizeof(req);
2646
2647         if (copy_from_user(&req, arg, sizeof(req)))
2648                 return -EFAULT;
2649
2650         hci_dev_lock(hdev);
2651         conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
2652         if (conn) {
2653                 bacpy(&ci.bdaddr, &conn->dst);
2654                 ci.handle = conn->handle;
2655                 ci.type  = conn->type;
2656                 ci.out   = conn->out;
2657                 ci.state = conn->state;
2658                 ci.link_mode = get_link_mode(conn);
2659         }
2660         hci_dev_unlock(hdev);
2661
2662         if (!conn)
2663                 return -ENOENT;
2664
2665         return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
2666 }
2667
2668 int hci_get_auth_info(struct hci_dev *hdev, void __user *arg)
2669 {
2670         struct hci_auth_info_req req;
2671         struct hci_conn *conn;
2672
2673         if (copy_from_user(&req, arg, sizeof(req)))
2674                 return -EFAULT;
2675
2676         hci_dev_lock(hdev);
2677         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr);
2678         if (conn)
2679                 req.type = conn->auth_type;
2680         hci_dev_unlock(hdev);
2681
2682         if (!conn)
2683                 return -ENOENT;
2684
2685         return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0;
2686 }
2687
2688 struct hci_chan *hci_chan_create(struct hci_conn *conn)
2689 {
2690         struct hci_dev *hdev = conn->hdev;
2691         struct hci_chan *chan;
2692
2693         BT_DBG("%s hcon %p", hdev->name, conn);
2694
2695         if (test_bit(HCI_CONN_DROP, &conn->flags)) {
2696                 BT_DBG("Refusing to create new hci_chan");
2697                 return NULL;
2698         }
2699
2700         chan = kzalloc(sizeof(*chan), GFP_KERNEL);
2701         if (!chan)
2702                 return NULL;
2703
2704         chan->conn = hci_conn_get(conn);
2705         skb_queue_head_init(&chan->data_q);
2706         chan->state = BT_CONNECTED;
2707
2708         list_add_rcu(&chan->list, &conn->chan_list);
2709
2710         return chan;
2711 }
2712
2713 void hci_chan_del(struct hci_chan *chan)
2714 {
2715         struct hci_conn *conn = chan->conn;
2716         struct hci_dev *hdev = conn->hdev;
2717
2718         BT_DBG("%s hcon %p chan %p", hdev->name, conn, chan);
2719
2720         list_del_rcu(&chan->list);
2721
2722         synchronize_rcu();
2723
2724         /* Prevent new hci_chan's to be created for this hci_conn */
2725         set_bit(HCI_CONN_DROP, &conn->flags);
2726
2727         hci_conn_put(conn);
2728
2729         skb_queue_purge(&chan->data_q);
2730         kfree(chan);
2731 }
2732
2733 void hci_chan_list_flush(struct hci_conn *conn)
2734 {
2735         struct hci_chan *chan, *n;
2736
2737         BT_DBG("hcon %p", conn);
2738
2739         list_for_each_entry_safe(chan, n, &conn->chan_list, list)
2740                 hci_chan_del(chan);
2741 }
2742
2743 static struct hci_chan *__hci_chan_lookup_handle(struct hci_conn *hcon,
2744                                                  __u16 handle)
2745 {
2746         struct hci_chan *hchan;
2747
2748         list_for_each_entry(hchan, &hcon->chan_list, list) {
2749                 if (hchan->handle == handle)
2750                         return hchan;
2751         }
2752
2753         return NULL;
2754 }
2755
2756 struct hci_chan *hci_chan_lookup_handle(struct hci_dev *hdev, __u16 handle)
2757 {
2758         struct hci_conn_hash *h = &hdev->conn_hash;
2759         struct hci_conn *hcon;
2760         struct hci_chan *hchan = NULL;
2761
2762         rcu_read_lock();
2763
2764         list_for_each_entry_rcu(hcon, &h->list, list) {
2765                 hchan = __hci_chan_lookup_handle(hcon, handle);
2766                 if (hchan)
2767                         break;
2768         }
2769
2770         rcu_read_unlock();
2771
2772         return hchan;
2773 }
2774
2775 u32 hci_conn_get_phy(struct hci_conn *conn)
2776 {
2777         u32 phys = 0;
2778
2779         /* BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 2, Part B page 471:
2780          * Table 6.2: Packets defined for synchronous, asynchronous, and
2781          * CPB logical transport types.
2782          */
2783         switch (conn->type) {
2784         case SCO_LINK:
2785                 /* SCO logical transport (1 Mb/s):
2786                  * HV1, HV2, HV3 and DV.
2787                  */
2788                 phys |= BT_PHY_BR_1M_1SLOT;
2789
2790                 break;
2791
2792         case ACL_LINK:
2793                 /* ACL logical transport (1 Mb/s) ptt=0:
2794                  * DH1, DM3, DH3, DM5 and DH5.
2795                  */
2796                 phys |= BT_PHY_BR_1M_1SLOT;
2797
2798                 if (conn->pkt_type & (HCI_DM3 | HCI_DH3))
2799                         phys |= BT_PHY_BR_1M_3SLOT;
2800
2801                 if (conn->pkt_type & (HCI_DM5 | HCI_DH5))
2802                         phys |= BT_PHY_BR_1M_5SLOT;
2803
2804                 /* ACL logical transport (2 Mb/s) ptt=1:
2805                  * 2-DH1, 2-DH3 and 2-DH5.
2806                  */
2807                 if (!(conn->pkt_type & HCI_2DH1))
2808                         phys |= BT_PHY_EDR_2M_1SLOT;
2809
2810                 if (!(conn->pkt_type & HCI_2DH3))
2811                         phys |= BT_PHY_EDR_2M_3SLOT;
2812
2813                 if (!(conn->pkt_type & HCI_2DH5))
2814                         phys |= BT_PHY_EDR_2M_5SLOT;
2815
2816                 /* ACL logical transport (3 Mb/s) ptt=1:
2817                  * 3-DH1, 3-DH3 and 3-DH5.
2818                  */
2819                 if (!(conn->pkt_type & HCI_3DH1))
2820                         phys |= BT_PHY_EDR_3M_1SLOT;
2821
2822                 if (!(conn->pkt_type & HCI_3DH3))
2823                         phys |= BT_PHY_EDR_3M_3SLOT;
2824
2825                 if (!(conn->pkt_type & HCI_3DH5))
2826                         phys |= BT_PHY_EDR_3M_5SLOT;
2827
2828                 break;
2829
2830         case ESCO_LINK:
2831                 /* eSCO logical transport (1 Mb/s): EV3, EV4 and EV5 */
2832                 phys |= BT_PHY_BR_1M_1SLOT;
2833
2834                 if (!(conn->pkt_type & (ESCO_EV4 | ESCO_EV5)))
2835                         phys |= BT_PHY_BR_1M_3SLOT;
2836
2837                 /* eSCO logical transport (2 Mb/s): 2-EV3, 2-EV5 */
2838                 if (!(conn->pkt_type & ESCO_2EV3))
2839                         phys |= BT_PHY_EDR_2M_1SLOT;
2840
2841                 if (!(conn->pkt_type & ESCO_2EV5))
2842                         phys |= BT_PHY_EDR_2M_3SLOT;
2843
2844                 /* eSCO logical transport (3 Mb/s): 3-EV3, 3-EV5 */
2845                 if (!(conn->pkt_type & ESCO_3EV3))
2846                         phys |= BT_PHY_EDR_3M_1SLOT;
2847
2848                 if (!(conn->pkt_type & ESCO_3EV5))
2849                         phys |= BT_PHY_EDR_3M_3SLOT;
2850
2851                 break;
2852
2853         case LE_LINK:
2854                 if (conn->le_tx_phy & HCI_LE_SET_PHY_1M)
2855                         phys |= BT_PHY_LE_1M_TX;
2856
2857                 if (conn->le_rx_phy & HCI_LE_SET_PHY_1M)
2858                         phys |= BT_PHY_LE_1M_RX;
2859
2860                 if (conn->le_tx_phy & HCI_LE_SET_PHY_2M)
2861                         phys |= BT_PHY_LE_2M_TX;
2862
2863                 if (conn->le_rx_phy & HCI_LE_SET_PHY_2M)
2864                         phys |= BT_PHY_LE_2M_RX;
2865
2866                 if (conn->le_tx_phy & HCI_LE_SET_PHY_CODED)
2867                         phys |= BT_PHY_LE_CODED_TX;
2868
2869                 if (conn->le_rx_phy & HCI_LE_SET_PHY_CODED)
2870                         phys |= BT_PHY_LE_CODED_RX;
2871
2872                 break;
2873         }
2874
2875         return phys;
2876 }
2877
2878 static int abort_conn_sync(struct hci_dev *hdev, void *data)
2879 {
2880         struct hci_conn *conn = data;
2881
2882         if (!hci_conn_valid(hdev, conn))
2883                 return -ECANCELED;
2884
2885         return hci_abort_conn_sync(hdev, conn, conn->abort_reason);
2886 }
2887
2888 int hci_abort_conn(struct hci_conn *conn, u8 reason)
2889 {
2890         struct hci_dev *hdev = conn->hdev;
2891
2892         /* If abort_reason has already been set it means the connection is
2893          * already being aborted so don't attempt to overwrite it.
2894          */
2895         if (conn->abort_reason)
2896                 return 0;
2897
2898         bt_dev_dbg(hdev, "handle 0x%2.2x reason 0x%2.2x", conn->handle, reason);
2899
2900         conn->abort_reason = reason;
2901
2902         /* If the connection is pending check the command opcode since that
2903          * might be blocking on hci_cmd_sync_work while waiting its respective
2904          * event so we need to hci_cmd_sync_cancel to cancel it.
2905          *
2906          * hci_connect_le serializes the connection attempts so only one
2907          * connection can be in BT_CONNECT at time.
2908          */
2909         if (conn->state == BT_CONNECT && hdev->req_status == HCI_REQ_PEND) {
2910                 switch (hci_skb_event(hdev->sent_cmd)) {
2911                 case HCI_EV_CONN_COMPLETE:
2912                 case HCI_EV_LE_CONN_COMPLETE:
2913                 case HCI_EV_LE_ENHANCED_CONN_COMPLETE:
2914                 case HCI_EVT_LE_CIS_ESTABLISHED:
2915                         hci_cmd_sync_cancel(hdev, ECANCELED);
2916                         break;
2917                 }
2918         /* Cancel connect attempt if still queued/pending */
2919         } else if (!hci_cancel_connect_sync(hdev, conn)) {
2920                 return 0;
2921         }
2922
2923         /* Run immediately if on cmd_sync_work since this may be called
2924          * as a result to MGMT_OP_DISCONNECT/MGMT_OP_UNPAIR which does
2925          * already queue its callback on cmd_sync_work.
2926          */
2927         return hci_cmd_sync_run_once(hdev, abort_conn_sync, conn, NULL);
2928 }
2929
2930 void hci_setup_tx_timestamp(struct sk_buff *skb, size_t key_offset,
2931                             const struct sockcm_cookie *sockc)
2932 {
2933         struct sock *sk = skb ? skb->sk : NULL;
2934         int key;
2935
2936         /* This shall be called on a single skb of those generated by user
2937          * sendmsg(), and only when the sendmsg() does not return error to
2938          * user. This is required for keeping the tskey that increments here in
2939          * sync with possible sendmsg() counting by user.
2940          *
2941          * Stream sockets shall set key_offset to sendmsg() length in bytes
2942          * and call with the last fragment, others to 1 and first fragment.
2943          */
2944
2945         if (!skb || !sockc || !sk || !key_offset)
2946                 return;
2947
2948         sock_tx_timestamp(sk, sockc, &skb_shinfo(skb)->tx_flags);
2949
2950         if (sk->sk_type == SOCK_STREAM)
2951                 key = atomic_add_return(key_offset, &sk->sk_tskey);
2952
2953         if (sockc->tsflags & SOF_TIMESTAMPING_OPT_ID &&
2954             sockc->tsflags & SOF_TIMESTAMPING_TX_RECORD_MASK) {
2955                 if (sockc->tsflags & SOCKCM_FLAG_TS_OPT_ID) {
2956                         skb_shinfo(skb)->tskey = sockc->ts_opt_id;
2957                 } else {
2958                         if (sk->sk_type != SOCK_STREAM)
2959                                 key = atomic_inc_return(&sk->sk_tskey);
2960                         skb_shinfo(skb)->tskey = key - 1;
2961                 }
2962         }
2963 }
2964
2965 void hci_conn_tx_queue(struct hci_conn *conn, struct sk_buff *skb)
2966 {
2967         struct tx_queue *comp = &conn->tx_q;
2968         bool track = false;
2969
2970         /* Emit SND now, ie. just before sending to driver */
2971         if (skb_shinfo(skb)->tx_flags & SKBTX_SW_TSTAMP)
2972                 __skb_tstamp_tx(skb, NULL, NULL, skb->sk, SCM_TSTAMP_SND);
2973
2974         /* COMPLETION tstamp is emitted for tracked skb later in Number of
2975          * Completed Packets event. Available only for flow controlled cases.
2976          *
2977          * TODO: SCO support without flowctl (needs to be done in drivers)
2978          */
2979         switch (conn->type) {
2980         case CIS_LINK:
2981         case BIS_LINK:
2982         case ACL_LINK:
2983         case LE_LINK:
2984                 break;
2985         case SCO_LINK:
2986         case ESCO_LINK:
2987                 if (!hci_dev_test_flag(conn->hdev, HCI_SCO_FLOWCTL))
2988                         return;
2989                 break;
2990         default:
2991                 return;
2992         }
2993
2994         if (skb->sk && (skb_shinfo(skb)->tx_flags & SKBTX_COMPLETION_TSTAMP))
2995                 track = true;
2996
2997         /* If nothing is tracked, just count extra skbs at the queue head */
2998         if (!track && !comp->tracked) {
2999                 comp->extra++;
3000                 return;
3001         }
3002
3003         if (track) {
3004                 skb = skb_clone_sk(skb);
3005                 if (!skb)
3006                         goto count_only;
3007
3008                 comp->tracked++;
3009         } else {
3010                 skb = skb_clone(skb, GFP_KERNEL);
3011                 if (!skb)
3012                         goto count_only;
3013         }
3014
3015         skb_queue_tail(&comp->queue, skb);
3016         return;
3017
3018 count_only:
3019         /* Stop tracking skbs, and only count. This will not emit timestamps for
3020          * the packets, but if we get here something is more seriously wrong.
3021          */
3022         comp->tracked = 0;
3023         comp->extra += skb_queue_len(&comp->queue) + 1;
3024         skb_queue_purge(&comp->queue);
3025 }
3026
3027 void hci_conn_tx_dequeue(struct hci_conn *conn)
3028 {
3029         struct tx_queue *comp = &conn->tx_q;
3030         struct sk_buff *skb;
3031
3032         /* If there are tracked skbs, the counted extra go before dequeuing real
3033          * skbs, to keep ordering. When nothing is tracked, the ordering doesn't
3034          * matter so dequeue real skbs first to get rid of them ASAP.
3035          */
3036         if (comp->extra && (comp->tracked || skb_queue_empty(&comp->queue))) {
3037                 comp->extra--;
3038                 return;
3039         }
3040
3041         skb = skb_dequeue(&comp->queue);
3042         if (!skb)
3043                 return;
3044
3045         if (skb->sk) {
3046                 comp->tracked--;
3047                 __skb_tstamp_tx(skb, NULL, NULL, skb->sk,
3048                                 SCM_TSTAMP_COMPLETION);
3049         }
3050
3051         kfree_skb(skb);
3052 }
3053
3054 u8 *hci_conn_key_enc_size(struct hci_conn *conn)
3055 {
3056         if (conn->type == ACL_LINK) {
3057                 struct link_key *key;
3058
3059                 key = hci_find_link_key(conn->hdev, &conn->dst);
3060                 if (!key)
3061                         return NULL;
3062
3063                 return &key->pin_len;
3064         } else if (conn->type == LE_LINK) {
3065                 struct smp_ltk *ltk;
3066
3067                 ltk = hci_find_ltk(conn->hdev, &conn->dst, conn->dst_type,
3068                                    conn->role);
3069                 if (!ltk)
3070                         return NULL;
3071
3072                 return &ltk->enc_size;
3073         }
3074
3075         return NULL;
3076 }
3077
3078 int hci_ethtool_ts_info(unsigned int index, int sk_proto,
3079                         struct kernel_ethtool_ts_info *info)
3080 {
3081         struct hci_dev *hdev;
3082
3083         hdev = hci_dev_get(index);
3084         if (!hdev)
3085                 return -ENODEV;
3086
3087         info->so_timestamping =
3088                 SOF_TIMESTAMPING_RX_SOFTWARE |
3089                 SOF_TIMESTAMPING_SOFTWARE;
3090         info->phc_index = -1;
3091         info->tx_types = BIT(HWTSTAMP_TX_OFF);
3092         info->rx_filters = BIT(HWTSTAMP_FILTER_NONE);
3093
3094         switch (sk_proto) {
3095         case BTPROTO_ISO:
3096         case BTPROTO_L2CAP:
3097                 info->so_timestamping |= SOF_TIMESTAMPING_TX_SOFTWARE;
3098                 info->so_timestamping |= SOF_TIMESTAMPING_TX_COMPLETION;
3099                 break;
3100         case BTPROTO_SCO:
3101                 info->so_timestamping |= SOF_TIMESTAMPING_TX_SOFTWARE;
3102                 if (hci_dev_test_flag(hdev, HCI_SCO_FLOWCTL))
3103                         info->so_timestamping |= SOF_TIMESTAMPING_TX_COMPLETION;
3104                 break;
3105         }
3106
3107         hci_dev_put(hdev);
3108         return 0;
3109 }