net/bluetooth/hci_conn.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI connection handling. */
  26
  27 #include <linux/export.h>
  28 #include <linux/debugfs.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/l2cap.h>
  33 #include <net/bluetooth/iso.h>
  34 #include <net/bluetooth/mgmt.h>
  35
  36 #include "hci_request.h"
  37 #include "smp.h"
  38 #include "a2mp.h"
  39 #include "eir.h"
  40
  41 struct sco_param {
  42         u16 pkt_type;
  43         u16 max_latency;
  44         u8  retrans_effort;
  45 };
  46
  47 struct conn_handle_t {
  48         struct hci_conn *conn;
  49         __u16 handle;
  50 };
  51
  52 static const struct sco_param esco_param_cvsd[] = {
  53         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000a,   0x01 }, /* S3 */
  54         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x0007,   0x01 }, /* S2 */
  55         { EDR_ESCO_MASK | ESCO_EV3,   0x0007,   0x01 }, /* S1 */
  56         { EDR_ESCO_MASK | ESCO_HV3,   0xffff,   0x01 }, /* D1 */
  57         { EDR_ESCO_MASK | ESCO_HV1,   0xffff,   0x01 }, /* D0 */
  58 };
  59
  60 static const struct sco_param sco_param_cvsd[] = {
  61         { EDR_ESCO_MASK | ESCO_HV3,   0xffff,   0xff }, /* D1 */
  62         { EDR_ESCO_MASK | ESCO_HV1,   0xffff,   0xff }, /* D0 */
  63 };
  64
  65 static const struct sco_param esco_param_msbc[] = {
  66         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000d,   0x02 }, /* T2 */
  67         { EDR_ESCO_MASK | ESCO_EV3,   0x0008,   0x02 }, /* T1 */
  68 };
  69
  70 /* This function requires the caller holds hdev->lock */
  71 static void hci_connect_le_scan_cleanup(struct hci_conn *conn)
  72 {
  73         struct hci_conn_params *params;
  74         struct hci_dev *hdev = conn->hdev;
  75         struct smp_irk *irk;
  76         bdaddr_t *bdaddr;
  77         u8 bdaddr_type;
  78
  79         bdaddr = &conn->dst;
  80         bdaddr_type = conn->dst_type;
  81
  82         /* Check if we need to convert to identity address */
  83         irk = hci_get_irk(hdev, bdaddr, bdaddr_type);
  84         if (irk) {
  85                 bdaddr = &irk->bdaddr;
  86                 bdaddr_type = irk->addr_type;
  87         }
  88
  89         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, bdaddr,
  90                                            bdaddr_type);
  91         if (!params || !params->explicit_connect)
  92                 return;
  93
  94         /* The connection attempt was doing scan for new RPA, and is
  95          * in scan phase. If params are not associated with any other
  96          * autoconnect action, remove them completely. If they are, just unmark
  97          * them as waiting for connection, by clearing explicit_connect field.
  98          */
  99         params->explicit_connect = false;
 100
 101         list_del_init(&params->action);
 102
 103         switch (params->auto_connect) {
 104         case HCI_AUTO_CONN_EXPLICIT:
 105                 hci_conn_params_del(hdev, bdaddr, bdaddr_type);
 106                 /* return instead of break to avoid duplicate scan update */
 107                 return;
 108         case HCI_AUTO_CONN_DIRECT:
 109         case HCI_AUTO_CONN_ALWAYS:
 110                 list_add(&params->action, &hdev->pend_le_conns);
 111                 break;
 112         case HCI_AUTO_CONN_REPORT:
 113                 list_add(&params->action, &hdev->pend_le_reports);
 114                 break;
 115         default:
 116                 break;
 117         }
 118
 119         hci_update_passive_scan(hdev);
 120 }
 121
 122 static void hci_conn_cleanup(struct hci_conn *conn)
 123 {
 124         struct hci_dev *hdev = conn->hdev;
 125
 126         if (test_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags))
 127                 hci_conn_params_del(conn->hdev, &conn->dst, conn->dst_type);
 128
 129         if (test_and_clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
 130                 hci_remove_link_key(hdev, &conn->dst);
 131
 132         hci_chan_list_flush(conn);
 133
 134         hci_conn_hash_del(hdev, conn);
 135
 136         if (conn->cleanup)
 137                 conn->cleanup(conn);
 138
 139         if (conn->type == SCO_LINK || conn->type == ESCO_LINK) {
 140                 switch (conn->setting & SCO_AIRMODE_MASK) {
 141                 case SCO_AIRMODE_CVSD:
 142                 case SCO_AIRMODE_TRANSP:
 143                         if (hdev->notify)
 144                                 hdev->notify(hdev, HCI_NOTIFY_DISABLE_SCO);
 145                         break;
 146                 }
 147         } else {
 148                 if (hdev->notify)
 149                         hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
 150         }
 151
 152         hci_conn_del_sysfs(conn);
 153
 154         debugfs_remove_recursive(conn->debugfs);
 155
 156         hci_dev_put(hdev);
 157
 158         hci_conn_put(conn);
 159 }
 160
 161 static void le_scan_cleanup(struct work_struct *work)
 162 {
 163         struct hci_conn *conn = container_of(work, struct hci_conn,
 164                                              le_scan_cleanup);
 165         struct hci_dev *hdev = conn->hdev;
 166         struct hci_conn *c = NULL;
 167
 168         BT_DBG("%s hcon %p", hdev->name, conn);
 169
 170         hci_dev_lock(hdev);
 171
 172         /* Check that the hci_conn is still around */
 173         rcu_read_lock();
 174         list_for_each_entry_rcu(c, &hdev->conn_hash.list, list) {
 175                 if (c == conn)
 176                         break;
 177         }
 178         rcu_read_unlock();
 179
 180         if (c == conn) {
 181                 hci_connect_le_scan_cleanup(conn);
 182                 hci_conn_cleanup(conn);
 183         }
 184
 185         hci_dev_unlock(hdev);
 186         hci_dev_put(hdev);
 187         hci_conn_put(conn);
 188 }
 189
 190 static void hci_connect_le_scan_remove(struct hci_conn *conn)
 191 {
 192         BT_DBG("%s hcon %p", conn->hdev->name, conn);
 193
 194         /* We can't call hci_conn_del/hci_conn_cleanup here since that
 195          * could deadlock with another hci_conn_del() call that's holding
 196          * hci_dev_lock and doing cancel_delayed_work_sync(&conn->disc_work).
 197          * Instead, grab temporary extra references to the hci_dev and
 198          * hci_conn and perform the necessary cleanup in a separate work
 199          * callback.
 200          */
 201
 202         hci_dev_hold(conn->hdev);
 203         hci_conn_get(conn);
 204
 205         /* Even though we hold a reference to the hdev, many other
 206          * things might get cleaned up meanwhile, including the hdev's
 207          * own workqueue, so we can't use that for scheduling.
 208          */
 209         schedule_work(&conn->le_scan_cleanup);
 210 }
 211
 212 static void hci_acl_create_connection(struct hci_conn *conn)
 213 {
 214         struct hci_dev *hdev = conn->hdev;
 215         struct inquiry_entry *ie;
 216         struct hci_cp_create_conn cp;
 217
 218         BT_DBG("hcon %p", conn);
 219
 220         /* Many controllers disallow HCI Create Connection while it is doing
 221          * HCI Inquiry. So we cancel the Inquiry first before issuing HCI Create
 222          * Connection. This may cause the MGMT discovering state to become false
 223          * without user space's request but it is okay since the MGMT Discovery
 224          * APIs do not promise that discovery should be done forever. Instead,
 225          * the user space monitors the status of MGMT discovering and it may
 226          * request for discovery again when this flag becomes false.
 227          */
 228         if (test_bit(HCI_INQUIRY, &hdev->flags)) {
 229                 /* Put this connection to "pending" state so that it will be
 230                  * executed after the inquiry cancel command complete event.
 231                  */
 232                 conn->state = BT_CONNECT2;
 233                 hci_send_cmd(hdev, HCI_OP_INQUIRY_CANCEL, 0, NULL);
 234                 return;
 235         }
 236
 237         conn->state = BT_CONNECT;
 238         conn->out = true;
 239         conn->role = HCI_ROLE_MASTER;
 240
 241         conn->attempt++;
 242
 243         conn->link_policy = hdev->link_policy;
 244
 245         memset(&cp, 0, sizeof(cp));
 246         bacpy(&cp.bdaddr, &conn->dst);
 247         cp.pscan_rep_mode = 0x02;
 248
 249         ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
 250         if (ie) {
 251                 if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
 252                         cp.pscan_rep_mode = ie->data.pscan_rep_mode;
 253                         cp.pscan_mode     = ie->data.pscan_mode;
 254                         cp.clock_offset   = ie->data.clock_offset |
 255                                             cpu_to_le16(0x8000);
 256                 }
 257
 258                 memcpy(conn->dev_class, ie->data.dev_class, 3);
 259         }
 260
 261         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 262         if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
 263                 cp.role_switch = 0x01;
 264         else
 265                 cp.role_switch = 0x00;
 266
 267         hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
 268 }
 269
 270 int hci_disconnect(struct hci_conn *conn, __u8 reason)
 271 {
 272         BT_DBG("hcon %p", conn);
 273
 274         /* When we are central of an established connection and it enters
 275          * the disconnect timeout, then go ahead and try to read the
 276          * current clock offset.  Processing of the result is done
 277          * within the event handling and hci_clock_offset_evt function.
 278          */
 279         if (conn->type == ACL_LINK && conn->role == HCI_ROLE_MASTER &&
 280             (conn->state == BT_CONNECTED || conn->state == BT_CONFIG)) {
 281                 struct hci_dev *hdev = conn->hdev;
 282                 struct hci_cp_read_clock_offset clkoff_cp;
 283
 284                 clkoff_cp.handle = cpu_to_le16(conn->handle);
 285                 hci_send_cmd(hdev, HCI_OP_READ_CLOCK_OFFSET, sizeof(clkoff_cp),
 286                              &clkoff_cp);
 287         }
 288
 289         return hci_abort_conn(conn, reason);
 290 }
 291
 292 static void hci_add_sco(struct hci_conn *conn, __u16 handle)
 293 {
 294         struct hci_dev *hdev = conn->hdev;
 295         struct hci_cp_add_sco cp;
 296
 297         BT_DBG("hcon %p", conn);
 298
 299         conn->state = BT_CONNECT;
 300         conn->out = true;
 301
 302         conn->attempt++;
 303
 304         cp.handle   = cpu_to_le16(handle);
 305         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 306
 307         hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
 308 }
 309
 310 static bool find_next_esco_param(struct hci_conn *conn,
 311                                  const struct sco_param *esco_param, int size)
 312 {
 313         for (; conn->attempt <= size; conn->attempt++) {
 314                 if (lmp_esco_2m_capable(conn->link) ||
 315                     (esco_param[conn->attempt - 1].pkt_type & ESCO_2EV3))
 316                         break;
 317                 BT_DBG("hcon %p skipped attempt %d, eSCO 2M not supported",
 318                        conn, conn->attempt);
 319         }
 320
 321         return conn->attempt <= size;
 322 }
 323
 324 static int configure_datapath_sync(struct hci_dev *hdev, struct bt_codec *codec)
 325 {
 326         int err;
 327         __u8 vnd_len, *vnd_data = NULL;
 328         struct hci_op_configure_data_path *cmd = NULL;
 329
 330         err = hdev->get_codec_config_data(hdev, ESCO_LINK, codec, &vnd_len,
 331                                           &vnd_data);
 332         if (err < 0)
 333                 goto error;
 334
 335         cmd = kzalloc(sizeof(*cmd) + vnd_len, GFP_KERNEL);
 336         if (!cmd) {
 337                 err = -ENOMEM;
 338                 goto error;
 339         }
 340
 341         err = hdev->get_data_path_id(hdev, &cmd->data_path_id);
 342         if (err < 0)
 343                 goto error;
 344
 345         cmd->vnd_len = vnd_len;
 346         memcpy(cmd->vnd_data, vnd_data, vnd_len);
 347
 348         cmd->direction = 0x00;
 349         __hci_cmd_sync_status(hdev, HCI_CONFIGURE_DATA_PATH,
 350                               sizeof(*cmd) + vnd_len, cmd, HCI_CMD_TIMEOUT);
 351
 352         cmd->direction = 0x01;
 353         err = __hci_cmd_sync_status(hdev, HCI_CONFIGURE_DATA_PATH,
 354                                     sizeof(*cmd) + vnd_len, cmd,
 355                                     HCI_CMD_TIMEOUT);
 356 error:
 357
 358         kfree(cmd);
 359         kfree(vnd_data);
 360         return err;
 361 }
 362
 363 static int hci_enhanced_setup_sync(struct hci_dev *hdev, void *data)
 364 {
 365         struct conn_handle_t *conn_handle = data;
 366         struct hci_conn *conn = conn_handle->conn;
 367         __u16 handle = conn_handle->handle;
 368         struct hci_cp_enhanced_setup_sync_conn cp;
 369         const struct sco_param *param;
 370
 371         kfree(conn_handle);
 372
 373         bt_dev_dbg(hdev, "hcon %p", conn);
 374
 375         /* for offload use case, codec needs to configured before opening SCO */
 376         if (conn->codec.data_path)
 377                 configure_datapath_sync(hdev, &conn->codec);
 378
 379         conn->state = BT_CONNECT;
 380         conn->out = true;
 381
 382         conn->attempt++;
 383
 384         memset(&cp, 0x00, sizeof(cp));
 385
 386         cp.handle   = cpu_to_le16(handle);
 387
 388         cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
 389         cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
 390
 391         switch (conn->codec.id) {
 392         case BT_CODEC_MSBC:
 393                 if (!find_next_esco_param(conn, esco_param_msbc,
 394                                           ARRAY_SIZE(esco_param_msbc)))
 395                         return -EINVAL;
 396
 397                 param = &esco_param_msbc[conn->attempt - 1];
 398                 cp.tx_coding_format.id = 0x05;
 399                 cp.rx_coding_format.id = 0x05;
 400                 cp.tx_codec_frame_size = __cpu_to_le16(60);
 401                 cp.rx_codec_frame_size = __cpu_to_le16(60);
 402                 cp.in_bandwidth = __cpu_to_le32(32000);
 403                 cp.out_bandwidth = __cpu_to_le32(32000);
 404                 cp.in_coding_format.id = 0x04;
 405                 cp.out_coding_format.id = 0x04;
 406                 cp.in_coded_data_size = __cpu_to_le16(16);
 407                 cp.out_coded_data_size = __cpu_to_le16(16);
 408                 cp.in_pcm_data_format = 2;
 409                 cp.out_pcm_data_format = 2;
 410                 cp.in_pcm_sample_payload_msb_pos = 0;
 411                 cp.out_pcm_sample_payload_msb_pos = 0;
 412                 cp.in_data_path = conn->codec.data_path;
 413                 cp.out_data_path = conn->codec.data_path;
 414                 cp.in_transport_unit_size = 1;
 415                 cp.out_transport_unit_size = 1;
 416                 break;
 417
 418         case BT_CODEC_TRANSPARENT:
 419                 if (!find_next_esco_param(conn, esco_param_msbc,
 420                                           ARRAY_SIZE(esco_param_msbc)))
 421                         return false;
 422                 param = &esco_param_msbc[conn->attempt - 1];
 423                 cp.tx_coding_format.id = 0x03;
 424                 cp.rx_coding_format.id = 0x03;
 425                 cp.tx_codec_frame_size = __cpu_to_le16(60);
 426                 cp.rx_codec_frame_size = __cpu_to_le16(60);
 427                 cp.in_bandwidth = __cpu_to_le32(0x1f40);
 428                 cp.out_bandwidth = __cpu_to_le32(0x1f40);
 429                 cp.in_coding_format.id = 0x03;
 430                 cp.out_coding_format.id = 0x03;
 431                 cp.in_coded_data_size = __cpu_to_le16(16);
 432                 cp.out_coded_data_size = __cpu_to_le16(16);
 433                 cp.in_pcm_data_format = 2;
 434                 cp.out_pcm_data_format = 2;
 435                 cp.in_pcm_sample_payload_msb_pos = 0;
 436                 cp.out_pcm_sample_payload_msb_pos = 0;
 437                 cp.in_data_path = conn->codec.data_path;
 438                 cp.out_data_path = conn->codec.data_path;
 439                 cp.in_transport_unit_size = 1;
 440                 cp.out_transport_unit_size = 1;
 441                 break;
 442
 443         case BT_CODEC_CVSD:
 444                 if (lmp_esco_capable(conn->link)) {
 445                         if (!find_next_esco_param(conn, esco_param_cvsd,
 446                                                   ARRAY_SIZE(esco_param_cvsd)))
 447                                 return -EINVAL;
 448                         param = &esco_param_cvsd[conn->attempt - 1];
 449                 } else {
 450                         if (conn->attempt > ARRAY_SIZE(sco_param_cvsd))
 451                                 return -EINVAL;
 452                         param = &sco_param_cvsd[conn->attempt - 1];
 453                 }
 454                 cp.tx_coding_format.id = 2;
 455                 cp.rx_coding_format.id = 2;
 456                 cp.tx_codec_frame_size = __cpu_to_le16(60);
 457                 cp.rx_codec_frame_size = __cpu_to_le16(60);
 458                 cp.in_bandwidth = __cpu_to_le32(16000);
 459                 cp.out_bandwidth = __cpu_to_le32(16000);
 460                 cp.in_coding_format.id = 4;
 461                 cp.out_coding_format.id = 4;
 462                 cp.in_coded_data_size = __cpu_to_le16(16);
 463                 cp.out_coded_data_size = __cpu_to_le16(16);
 464                 cp.in_pcm_data_format = 2;
 465                 cp.out_pcm_data_format = 2;
 466                 cp.in_pcm_sample_payload_msb_pos = 0;
 467                 cp.out_pcm_sample_payload_msb_pos = 0;
 468                 cp.in_data_path = conn->codec.data_path;
 469                 cp.out_data_path = conn->codec.data_path;
 470                 cp.in_transport_unit_size = 16;
 471                 cp.out_transport_unit_size = 16;
 472                 break;
 473         default:
 474                 return -EINVAL;
 475         }
 476
 477         cp.retrans_effort = param->retrans_effort;
 478         cp.pkt_type = __cpu_to_le16(param->pkt_type);
 479         cp.max_latency = __cpu_to_le16(param->max_latency);
 480
 481         if (hci_send_cmd(hdev, HCI_OP_ENHANCED_SETUP_SYNC_CONN, sizeof(cp), &cp) < 0)
 482                 return -EIO;
 483
 484         return 0;
 485 }
 486
 487 static bool hci_setup_sync_conn(struct hci_conn *conn, __u16 handle)
 488 {
 489         struct hci_dev *hdev = conn->hdev;
 490         struct hci_cp_setup_sync_conn cp;
 491         const struct sco_param *param;
 492
 493         bt_dev_dbg(hdev, "hcon %p", conn);
 494
 495         conn->state = BT_CONNECT;
 496         conn->out = true;
 497
 498         conn->attempt++;
 499
 500         cp.handle   = cpu_to_le16(handle);
 501
 502         cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
 503         cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
 504         cp.voice_setting  = cpu_to_le16(conn->setting);
 505
 506         switch (conn->setting & SCO_AIRMODE_MASK) {
 507         case SCO_AIRMODE_TRANSP:
 508                 if (!find_next_esco_param(conn, esco_param_msbc,
 509                                           ARRAY_SIZE(esco_param_msbc)))
 510                         return false;
 511                 param = &esco_param_msbc[conn->attempt - 1];
 512                 break;
 513         case SCO_AIRMODE_CVSD:
 514                 if (lmp_esco_capable(conn->link)) {
 515                         if (!find_next_esco_param(conn, esco_param_cvsd,
 516                                                   ARRAY_SIZE(esco_param_cvsd)))
 517                                 return false;
 518                         param = &esco_param_cvsd[conn->attempt - 1];
 519                 } else {
 520                         if (conn->attempt > ARRAY_SIZE(sco_param_cvsd))
 521                                 return false;
 522                         param = &sco_param_cvsd[conn->attempt - 1];
 523                 }
 524                 break;
 525         default:
 526                 return false;
 527         }
 528
 529         cp.retrans_effort = param->retrans_effort;
 530         cp.pkt_type = __cpu_to_le16(param->pkt_type);
 531         cp.max_latency = __cpu_to_le16(param->max_latency);
 532
 533         if (hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp) < 0)
 534                 return false;
 535
 536         return true;
 537 }
 538
 539 bool hci_setup_sync(struct hci_conn *conn, __u16 handle)
 540 {
 541         int result;
 542         struct conn_handle_t *conn_handle;
 543
 544         if (enhanced_sync_conn_capable(conn->hdev)) {
 545                 conn_handle = kzalloc(sizeof(*conn_handle), GFP_KERNEL);
 546
 547                 if (!conn_handle)
 548                         return false;
 549
 550                 conn_handle->conn = conn;
 551                 conn_handle->handle = handle;
 552                 result = hci_cmd_sync_queue(conn->hdev, hci_enhanced_setup_sync,
 553                                             conn_handle, NULL);
 554                 if (result < 0)
 555                         kfree(conn_handle);
 556
 557                 return result == 0;
 558         }
 559
 560         return hci_setup_sync_conn(conn, handle);
 561 }
 562
 563 u8 hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max, u16 latency,
 564                       u16 to_multiplier)
 565 {
 566         struct hci_dev *hdev = conn->hdev;
 567         struct hci_conn_params *params;
 568         struct hci_cp_le_conn_update cp;
 569
 570         hci_dev_lock(hdev);
 571
 572         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
 573         if (params) {
 574                 params->conn_min_interval = min;
 575                 params->conn_max_interval = max;
 576                 params->conn_latency = latency;
 577                 params->supervision_timeout = to_multiplier;
 578         }
 579
 580         hci_dev_unlock(hdev);
 581
 582         memset(&cp, 0, sizeof(cp));
 583         cp.handle               = cpu_to_le16(conn->handle);
 584         cp.conn_interval_min    = cpu_to_le16(min);
 585         cp.conn_interval_max    = cpu_to_le16(max);
 586         cp.conn_latency         = cpu_to_le16(latency);
 587         cp.supervision_timeout  = cpu_to_le16(to_multiplier);
 588         cp.min_ce_len           = cpu_to_le16(0x0000);
 589         cp.max_ce_len           = cpu_to_le16(0x0000);
 590
 591         hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp);
 592
 593         if (params)
 594                 return 0x01;
 595
 596         return 0x00;
 597 }
 598
 599 void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __le64 rand,
 600                       __u8 ltk[16], __u8 key_size)
 601 {
 602         struct hci_dev *hdev = conn->hdev;
 603         struct hci_cp_le_start_enc cp;
 604
 605         BT_DBG("hcon %p", conn);
 606
 607         memset(&cp, 0, sizeof(cp));
 608
 609         cp.handle = cpu_to_le16(conn->handle);
 610         cp.rand = rand;
 611         cp.ediv = ediv;
 612         memcpy(cp.ltk, ltk, key_size);
 613
 614         hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp);
 615 }
 616
 617 /* Device _must_ be locked */
 618 void hci_sco_setup(struct hci_conn *conn, __u8 status)
 619 {
 620         struct hci_conn *sco = conn->link;
 621
 622         if (!sco)
 623                 return;
 624
 625         BT_DBG("hcon %p", conn);
 626
 627         if (!status) {
 628                 if (lmp_esco_capable(conn->hdev))
 629                         hci_setup_sync(sco, conn->handle);
 630                 else
 631                         hci_add_sco(sco, conn->handle);
 632         } else {
 633                 hci_connect_cfm(sco, status);
 634                 hci_conn_del(sco);
 635         }
 636 }
 637
 638 static void hci_conn_timeout(struct work_struct *work)
 639 {
 640         struct hci_conn *conn = container_of(work, struct hci_conn,
 641                                              disc_work.work);
 642         int refcnt = atomic_read(&conn->refcnt);
 643
 644         BT_DBG("hcon %p state %s", conn, state_to_string(conn->state));
 645
 646         WARN_ON(refcnt < 0);
 647
 648         /* FIXME: It was observed that in pairing failed scenario, refcnt
 649          * drops below 0. Probably this is because l2cap_conn_del calls
 650          * l2cap_chan_del for each channel, and inside l2cap_chan_del conn is
 651          * dropped. After that loop hci_chan_del is called which also drops
 652          * conn. For now make sure that ACL is alive if refcnt is higher then 0,
 653          * otherwise drop it.
 654          */
 655         if (refcnt > 0)
 656                 return;
 657
 658         /* LE connections in scanning state need special handling */
 659         if (conn->state == BT_CONNECT && conn->type == LE_LINK &&
 660             test_bit(HCI_CONN_SCANNING, &conn->flags)) {
 661                 hci_connect_le_scan_remove(conn);
 662                 return;
 663         }
 664
 665         hci_abort_conn(conn, hci_proto_disconn_ind(conn));
 666 }
 667
 668 /* Enter sniff mode */
 669 static void hci_conn_idle(struct work_struct *work)
 670 {
 671         struct hci_conn *conn = container_of(work, struct hci_conn,
 672                                              idle_work.work);
 673         struct hci_dev *hdev = conn->hdev;
 674
 675         BT_DBG("hcon %p mode %d", conn, conn->mode);
 676
 677         if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn))
 678                 return;
 679
 680         if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF))
 681                 return;
 682
 683         if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
 684                 struct hci_cp_sniff_subrate cp;
 685                 cp.handle             = cpu_to_le16(conn->handle);
 686                 cp.max_latency        = cpu_to_le16(0);
 687                 cp.min_remote_timeout = cpu_to_le16(0);
 688                 cp.min_local_timeout  = cpu_to_le16(0);
 689                 hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
 690         }
 691
 692         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
 693                 struct hci_cp_sniff_mode cp;
 694                 cp.handle       = cpu_to_le16(conn->handle);
 695                 cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
 696                 cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
 697                 cp.attempt      = cpu_to_le16(4);
 698                 cp.timeout      = cpu_to_le16(1);
 699                 hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
 700         }
 701 }
 702
 703 static void hci_conn_auto_accept(struct work_struct *work)
 704 {
 705         struct hci_conn *conn = container_of(work, struct hci_conn,
 706                                              auto_accept_work.work);
 707
 708         hci_send_cmd(conn->hdev, HCI_OP_USER_CONFIRM_REPLY, sizeof(conn->dst),
 709                      &conn->dst);
 710 }
 711
 712 static void le_disable_advertising(struct hci_dev *hdev)
 713 {
 714         if (ext_adv_capable(hdev)) {
 715                 struct hci_cp_le_set_ext_adv_enable cp;
 716
 717                 cp.enable = 0x00;
 718                 cp.num_of_sets = 0x00;
 719
 720                 hci_send_cmd(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE, sizeof(cp),
 721                              &cp);
 722         } else {
 723                 u8 enable = 0x00;
 724                 hci_send_cmd(hdev, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable),
 725                              &enable);
 726         }
 727 }
 728
 729 static void le_conn_timeout(struct work_struct *work)
 730 {
 731         struct hci_conn *conn = container_of(work, struct hci_conn,
 732                                              le_conn_timeout.work);
 733         struct hci_dev *hdev = conn->hdev;
 734
 735         BT_DBG("");
 736
 737         /* We could end up here due to having done directed advertising,
 738          * so clean up the state if necessary. This should however only
 739          * happen with broken hardware or if low duty cycle was used
 740          * (which doesn't have a timeout of its own).
 741          */
 742         if (conn->role == HCI_ROLE_SLAVE) {
 743                 /* Disable LE Advertising */
 744                 le_disable_advertising(hdev);
 745                 hci_dev_lock(hdev);
 746                 hci_conn_failed(conn, HCI_ERROR_ADVERTISING_TIMEOUT);
 747                 hci_dev_unlock(hdev);
 748                 return;
 749         }
 750
 751         hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
 752 }
 753
 754 struct iso_list_data {
 755         union {
 756                 u8  cig;
 757                 u8  big;
 758         };
 759         union {
 760                 u8  cis;
 761                 u8  bis;
 762                 u16 sync_handle;
 763         };
 764         int count;
 765         struct {
 766                 struct hci_cp_le_set_cig_params cp;
 767                 struct hci_cis_params cis[0x11];
 768         } pdu;
 769 };
 770
 771 static void bis_list(struct hci_conn *conn, void *data)
 772 {
 773         struct iso_list_data *d = data;
 774
 775         /* Skip if not broadcast/ANY address */
 776         if (bacmp(&conn->dst, BDADDR_ANY))
 777                 return;
 778
 779         if (d->big != conn->iso_qos.big || d->bis == BT_ISO_QOS_BIS_UNSET ||
 780             d->bis != conn->iso_qos.bis)
 781                 return;
 782
 783         d->count++;
 784 }
 785
 786 static void find_bis(struct hci_conn *conn, void *data)
 787 {
 788         struct iso_list_data *d = data;
 789
 790         /* Ignore unicast */
 791         if (bacmp(&conn->dst, BDADDR_ANY))
 792                 return;
 793
 794         d->count++;
 795 }
 796
 797 static int terminate_big_sync(struct hci_dev *hdev, void *data)
 798 {
 799         struct iso_list_data *d = data;
 800
 801         bt_dev_dbg(hdev, "big 0x%2.2x bis 0x%2.2x", d->big, d->bis);
 802
 803         hci_remove_ext_adv_instance_sync(hdev, d->bis, NULL);
 804
 805         /* Check if ISO connection is a BIS and terminate BIG if there are
 806          * no other connections using it.
 807          */
 808         hci_conn_hash_list_state(hdev, find_bis, ISO_LINK, BT_CONNECTED, d);
 809         if (d->count)
 810                 return 0;
 811
 812         return hci_le_terminate_big_sync(hdev, d->big,
 813                                          HCI_ERROR_LOCAL_HOST_TERM);
 814 }
 815
 816 static void terminate_big_destroy(struct hci_dev *hdev, void *data, int err)
 817 {
 818         kfree(data);
 819 }
 820
 821 static int hci_le_terminate_big(struct hci_dev *hdev, u8 big, u8 bis)
 822 {
 823         struct iso_list_data *d;
 824
 825         bt_dev_dbg(hdev, "big 0x%2.2x bis 0x%2.2x", big, bis);
 826
 827         d = kmalloc(sizeof(*d), GFP_KERNEL);
 828         if (!d)
 829                 return -ENOMEM;
 830
 831         memset(d, 0, sizeof(*d));
 832         d->big = big;
 833         d->bis = bis;
 834
 835         return hci_cmd_sync_queue(hdev, terminate_big_sync, d,
 836                                   terminate_big_destroy);
 837 }
 838
 839 static int big_terminate_sync(struct hci_dev *hdev, void *data)
 840 {
 841         struct iso_list_data *d = data;
 842
 843         bt_dev_dbg(hdev, "big 0x%2.2x sync_handle 0x%4.4x", d->big,
 844                    d->sync_handle);
 845
 846         /* Check if ISO connection is a BIS and terminate BIG if there are
 847          * no other connections using it.
 848          */
 849         hci_conn_hash_list_state(hdev, find_bis, ISO_LINK, BT_CONNECTED, d);
 850         if (d->count)
 851                 return 0;
 852
 853         hci_le_big_terminate_sync(hdev, d->big);
 854
 855         return hci_le_pa_terminate_sync(hdev, d->sync_handle);
 856 }
 857
 858 static int hci_le_big_terminate(struct hci_dev *hdev, u8 big, u16 sync_handle)
 859 {
 860         struct iso_list_data *d;
 861
 862         bt_dev_dbg(hdev, "big 0x%2.2x sync_handle 0x%4.4x", big, sync_handle);
 863
 864         d = kmalloc(sizeof(*d), GFP_KERNEL);
 865         if (!d)
 866                 return -ENOMEM;
 867
 868         memset(d, 0, sizeof(*d));
 869         d->big = big;
 870         d->sync_handle = sync_handle;
 871
 872         return hci_cmd_sync_queue(hdev, big_terminate_sync, d,
 873                                   terminate_big_destroy);
 874 }
 875
 876 /* Cleanup BIS connection
 877  *
 878  * Detects if there any BIS left connected in a BIG
 879  * broadcaster: Remove advertising instance and terminate BIG.
 880  * broadcaster receiver: Teminate BIG sync and terminate PA sync.
 881  */
 882 static void bis_cleanup(struct hci_conn *conn)
 883 {
 884         struct hci_dev *hdev = conn->hdev;
 885
 886         bt_dev_dbg(hdev, "conn %p", conn);
 887
 888         if (conn->role == HCI_ROLE_MASTER) {
 889                 if (!test_and_clear_bit(HCI_CONN_PER_ADV, &conn->flags))
 890                         return;
 891
 892                 hci_le_terminate_big(hdev, conn->iso_qos.big,
 893                                      conn->iso_qos.bis);
 894         } else {
 895                 hci_le_big_terminate(hdev, conn->iso_qos.big,
 896                                      conn->sync_handle);
 897         }
 898 }
 899
 900 static int remove_cig_sync(struct hci_dev *hdev, void *data)
 901 {
 902         u8 handle = PTR_ERR(data);
 903
 904         return hci_le_remove_cig_sync(hdev, handle);
 905 }
 906
 907 static int hci_le_remove_cig(struct hci_dev *hdev, u8 handle)
 908 {
 909         bt_dev_dbg(hdev, "handle 0x%2.2x", handle);
 910
 911         return hci_cmd_sync_queue(hdev, remove_cig_sync, ERR_PTR(handle), NULL);
 912 }
 913
 914 static void find_cis(struct hci_conn *conn, void *data)
 915 {
 916         struct iso_list_data *d = data;
 917
 918         /* Ignore broadcast */
 919         if (!bacmp(&conn->dst, BDADDR_ANY))
 920                 return;
 921
 922         d->count++;
 923 }
 924
 925 /* Cleanup CIS connection:
 926  *
 927  * Detects if there any CIS left connected in a CIG and remove it.
 928  */
 929 static void cis_cleanup(struct hci_conn *conn)
 930 {
 931         struct hci_dev *hdev = conn->hdev;
 932         struct iso_list_data d;
 933
 934         memset(&d, 0, sizeof(d));
 935         d.cig = conn->iso_qos.cig;
 936
 937         /* Check if ISO connection is a CIS and remove CIG if there are
 938          * no other connections using it.
 939          */
 940         hci_conn_hash_list_state(hdev, find_cis, ISO_LINK, BT_CONNECTED, &d);
 941         if (d.count)
 942                 return;
 943
 944         hci_le_remove_cig(hdev, conn->iso_qos.cig);
 945 }
 946
 947 struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst,
 948                               u8 role)
 949 {
 950         struct hci_conn *conn;
 951
 952         BT_DBG("%s dst %pMR", hdev->name, dst);
 953
 954         conn = kzalloc(sizeof(*conn), GFP_KERNEL);
 955         if (!conn)
 956                 return NULL;
 957
 958         bacpy(&conn->dst, dst);
 959         bacpy(&conn->src, &hdev->bdaddr);
 960         conn->handle = HCI_CONN_HANDLE_UNSET;
 961         conn->hdev  = hdev;
 962         conn->type  = type;
 963         conn->role  = role;
 964         conn->mode  = HCI_CM_ACTIVE;
 965         conn->state = BT_OPEN;
 966         conn->auth_type = HCI_AT_GENERAL_BONDING;
 967         conn->io_capability = hdev->io_capability;
 968         conn->remote_auth = 0xff;
 969         conn->key_type = 0xff;
 970         conn->rssi = HCI_RSSI_INVALID;
 971         conn->tx_power = HCI_TX_POWER_INVALID;
 972         conn->max_tx_power = HCI_TX_POWER_INVALID;
 973
 974         set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
 975         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
 976
 977         /* Set Default Authenticated payload timeout to 30s */
 978         conn->auth_payload_timeout = DEFAULT_AUTH_PAYLOAD_TIMEOUT;
 979
 980         if (conn->role == HCI_ROLE_MASTER)
 981                 conn->out = true;
 982
 983         switch (type) {
 984         case ACL_LINK:
 985                 conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
 986                 break;
 987         case LE_LINK:
 988                 /* conn->src should reflect the local identity address */
 989                 hci_copy_identity_address(hdev, &conn->src, &conn->src_type);
 990                 break;
 991         case ISO_LINK:
 992                 /* conn->src should reflect the local identity address */
 993                 hci_copy_identity_address(hdev, &conn->src, &conn->src_type);
 994
 995                 /* set proper cleanup function */
 996                 if (!bacmp(dst, BDADDR_ANY))
 997                         conn->cleanup = bis_cleanup;
 998                 else if (conn->role == HCI_ROLE_MASTER)
 999                         conn->cleanup = cis_cleanup;
1000
1001                 break;
1002         case SCO_LINK:
1003                 if (lmp_esco_capable(hdev))
1004                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
1005                                         (hdev->esco_type & EDR_ESCO_MASK);
1006                 else
1007                         conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
1008                 break;
1009         case ESCO_LINK:
1010                 conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
1011                 break;
1012         }
1013
1014         skb_queue_head_init(&conn->data_q);
1015
1016         INIT_LIST_HEAD(&conn->chan_list);
1017
1018         INIT_DELAYED_WORK(&conn->disc_work, hci_conn_timeout);
1019         INIT_DELAYED_WORK(&conn->auto_accept_work, hci_conn_auto_accept);
1020         INIT_DELAYED_WORK(&conn->idle_work, hci_conn_idle);
1021         INIT_DELAYED_WORK(&conn->le_conn_timeout, le_conn_timeout);
1022         INIT_WORK(&conn->le_scan_cleanup, le_scan_cleanup);
1023
1024         atomic_set(&conn->refcnt, 0);
1025
1026         hci_dev_hold(hdev);
1027
1028         hci_conn_hash_add(hdev, conn);
1029
1030         /* The SCO and eSCO connections will only be notified when their
1031          * setup has been completed. This is different to ACL links which
1032          * can be notified right away.
1033          */
1034         if (conn->type != SCO_LINK && conn->type != ESCO_LINK) {
1035                 if (hdev->notify)
1036                         hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
1037         }
1038
1039         hci_conn_init_sysfs(conn);
1040
1041         return conn;
1042 }
1043
1044 int hci_conn_del(struct hci_conn *conn)
1045 {
1046         struct hci_dev *hdev = conn->hdev;
1047
1048         BT_DBG("%s hcon %p handle %d", hdev->name, conn, conn->handle);
1049
1050         cancel_delayed_work_sync(&conn->disc_work);
1051         cancel_delayed_work_sync(&conn->auto_accept_work);
1052         cancel_delayed_work_sync(&conn->idle_work);
1053
1054         if (conn->type == ACL_LINK) {
1055                 struct hci_conn *sco = conn->link;
1056                 if (sco)
1057                         sco->link = NULL;
1058
1059                 /* Unacked frames */
1060                 hdev->acl_cnt += conn->sent;
1061         } else if (conn->type == LE_LINK) {
1062                 cancel_delayed_work(&conn->le_conn_timeout);
1063
1064                 if (hdev->le_pkts)
1065                         hdev->le_cnt += conn->sent;
1066                 else
1067                         hdev->acl_cnt += conn->sent;
1068         } else {
1069                 struct hci_conn *acl = conn->link;
1070                 if (acl) {
1071                         acl->link = NULL;
1072                         hci_conn_drop(acl);
1073                 }
1074         }
1075
1076         if (conn->amp_mgr)
1077                 amp_mgr_put(conn->amp_mgr);
1078
1079         skb_queue_purge(&conn->data_q);
1080
1081         /* Remove the connection from the list and cleanup its remaining
1082          * state. This is a separate function since for some cases like
1083          * BT_CONNECT_SCAN we *only* want the cleanup part without the
1084          * rest of hci_conn_del.
1085          */
1086         hci_conn_cleanup(conn);
1087
1088         return 0;
1089 }
1090
1091 struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src, uint8_t src_type)
1092 {
1093         int use_src = bacmp(src, BDADDR_ANY);
1094         struct hci_dev *hdev = NULL, *d;
1095
1096         BT_DBG("%pMR -> %pMR", src, dst);
1097
1098         read_lock(&hci_dev_list_lock);
1099
1100         list_for_each_entry(d, &hci_dev_list, list) {
1101                 if (!test_bit(HCI_UP, &d->flags) ||
1102                     hci_dev_test_flag(d, HCI_USER_CHANNEL) ||
1103                     d->dev_type != HCI_PRIMARY)
1104                         continue;
1105
1106                 /* Simple routing:
1107                  *   No source address - find interface with bdaddr != dst
1108                  *   Source address    - find interface with bdaddr == src
1109                  */
1110
1111                 if (use_src) {
1112                         bdaddr_t id_addr;
1113                         u8 id_addr_type;
1114
1115                         if (src_type == BDADDR_BREDR) {
1116                                 if (!lmp_bredr_capable(d))
1117                                         continue;
1118                                 bacpy(&id_addr, &d->bdaddr);
1119                                 id_addr_type = BDADDR_BREDR;
1120                         } else {
1121                                 if (!lmp_le_capable(d))
1122                                         continue;
1123
1124                                 hci_copy_identity_address(d, &id_addr,
1125                                                           &id_addr_type);
1126
1127                                 /* Convert from HCI to three-value type */
1128                                 if (id_addr_type == ADDR_LE_DEV_PUBLIC)
1129                                         id_addr_type = BDADDR_LE_PUBLIC;
1130                                 else
1131                                         id_addr_type = BDADDR_LE_RANDOM;
1132                         }
1133
1134                         if (!bacmp(&id_addr, src) && id_addr_type == src_type) {
1135                                 hdev = d; break;
1136                         }
1137                 } else {
1138                         if (bacmp(&d->bdaddr, dst)) {
1139                                 hdev = d; break;
1140                         }
1141                 }
1142         }
1143
1144         if (hdev)
1145                 hdev = hci_dev_hold(hdev);
1146
1147         read_unlock(&hci_dev_list_lock);
1148         return hdev;
1149 }
1150 EXPORT_SYMBOL(hci_get_route);
1151
1152 /* This function requires the caller holds hdev->lock */
1153 static void hci_le_conn_failed(struct hci_conn *conn, u8 status)
1154 {
1155         struct hci_dev *hdev = conn->hdev;
1156         struct hci_conn_params *params;
1157
1158         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
1159                                            conn->dst_type);
1160         if (params && params->conn) {
1161                 hci_conn_drop(params->conn);
1162                 hci_conn_put(params->conn);
1163                 params->conn = NULL;
1164         }
1165
1166         /* If the status indicates successful cancellation of
1167          * the attempt (i.e. Unknown Connection Id) there's no point of
1168          * notifying failure since we'll go back to keep trying to
1169          * connect. The only exception is explicit connect requests
1170          * where a timeout + cancel does indicate an actual failure.
1171          */
1172         if (status != HCI_ERROR_UNKNOWN_CONN_ID ||
1173             (params && params->explicit_connect))
1174                 mgmt_connect_failed(hdev, &conn->dst, conn->type,
1175                                     conn->dst_type, status);
1176
1177         /* Since we may have temporarily stopped the background scanning in
1178          * favor of connection establishment, we should restart it.
1179          */
1180         hci_update_passive_scan(hdev);
1181
1182         /* Enable advertising in case this was a failed connection
1183          * attempt as a peripheral.
1184          */
1185         hci_enable_advertising(hdev);
1186 }
1187
1188 /* This function requires the caller holds hdev->lock */
1189 void hci_conn_failed(struct hci_conn *conn, u8 status)
1190 {
1191         struct hci_dev *hdev = conn->hdev;
1192
1193         bt_dev_dbg(hdev, "status 0x%2.2x", status);
1194
1195         switch (conn->type) {
1196         case LE_LINK:
1197                 hci_le_conn_failed(conn, status);
1198                 break;
1199         case ACL_LINK:
1200                 mgmt_connect_failed(hdev, &conn->dst, conn->type,
1201                                     conn->dst_type, status);
1202                 break;
1203         }
1204
1205         conn->state = BT_CLOSED;
1206         hci_connect_cfm(conn, status);
1207         hci_conn_del(conn);
1208 }
1209
1210 static void create_le_conn_complete(struct hci_dev *hdev, void *data, int err)
1211 {
1212         struct hci_conn *conn = data;
1213
1214         hci_dev_lock(hdev);
1215
1216         if (!err) {
1217                 hci_connect_le_scan_cleanup(conn);
1218                 goto done;
1219         }
1220
1221         bt_dev_err(hdev, "request failed to create LE connection: err %d", err);
1222
1223         /* Check if connection is still pending */
1224         if (conn != hci_lookup_le_connect(hdev))
1225                 goto done;
1226
1227         hci_conn_failed(conn, bt_status(err));
1228
1229 done:
1230         hci_dev_unlock(hdev);
1231 }
1232
1233 static int hci_connect_le_sync(struct hci_dev *hdev, void *data)
1234 {
1235         struct hci_conn *conn = data;
1236
1237         bt_dev_dbg(hdev, "conn %p", conn);
1238
1239         return hci_le_create_conn_sync(hdev, conn);
1240 }
1241
1242 struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,
1243                                 u8 dst_type, bool dst_resolved, u8 sec_level,
1244                                 u16 conn_timeout, u8 role)
1245 {
1246         struct hci_conn *conn;
1247         struct smp_irk *irk;
1248         int err;
1249
1250         /* Let's make sure that le is enabled.*/
1251         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1252                 if (lmp_le_capable(hdev))
1253                         return ERR_PTR(-ECONNREFUSED);
1254
1255                 return ERR_PTR(-EOPNOTSUPP);
1256         }
1257
1258         /* Since the controller supports only one LE connection attempt at a
1259          * time, we return -EBUSY if there is any connection attempt running.
1260          */
1261         if (hci_lookup_le_connect(hdev))
1262                 return ERR_PTR(-EBUSY);
1263
1264         /* If there's already a connection object but it's not in
1265          * scanning state it means it must already be established, in
1266          * which case we can't do anything else except report a failure
1267          * to connect.
1268          */
1269         conn = hci_conn_hash_lookup_le(hdev, dst, dst_type);
1270         if (conn && !test_bit(HCI_CONN_SCANNING, &conn->flags)) {
1271                 return ERR_PTR(-EBUSY);
1272         }
1273
1274         /* Check if the destination address has been resolved by the controller
1275          * since if it did then the identity address shall be used.
1276          */
1277         if (!dst_resolved) {
1278                 /* When given an identity address with existing identity
1279                  * resolving key, the connection needs to be established
1280                  * to a resolvable random address.
1281                  *
1282                  * Storing the resolvable random address is required here
1283                  * to handle connection failures. The address will later
1284                  * be resolved back into the original identity address
1285                  * from the connect request.
1286                  */
1287                 irk = hci_find_irk_by_addr(hdev, dst, dst_type);
1288                 if (irk && bacmp(&irk->rpa, BDADDR_ANY)) {
1289                         dst = &irk->rpa;
1290                         dst_type = ADDR_LE_DEV_RANDOM;
1291                 }
1292         }
1293
1294         if (conn) {
1295                 bacpy(&conn->dst, dst);
1296         } else {
1297                 conn = hci_conn_add(hdev, LE_LINK, dst, role);
1298                 if (!conn)
1299                         return ERR_PTR(-ENOMEM);
1300                 hci_conn_hold(conn);
1301                 conn->pending_sec_level = sec_level;
1302         }
1303
1304         conn->dst_type = dst_type;
1305         conn->sec_level = BT_SECURITY_LOW;
1306         conn->conn_timeout = conn_timeout;
1307
1308         conn->state = BT_CONNECT;
1309         clear_bit(HCI_CONN_SCANNING, &conn->flags);
1310
1311         err = hci_cmd_sync_queue(hdev, hci_connect_le_sync, conn,
1312                                  create_le_conn_complete);
1313         if (err) {
1314                 hci_conn_del(conn);
1315                 return ERR_PTR(err);
1316         }
1317
1318         return conn;
1319 }
1320
1321 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
1322 {
1323         struct hci_conn *conn;
1324
1325         conn = hci_conn_hash_lookup_le(hdev, addr, type);
1326         if (!conn)
1327                 return false;
1328
1329         if (conn->state != BT_CONNECTED)
1330                 return false;
1331
1332         return true;
1333 }
1334
1335 /* This function requires the caller holds hdev->lock */
1336 static int hci_explicit_conn_params_set(struct hci_dev *hdev,
1337                                         bdaddr_t *addr, u8 addr_type)
1338 {
1339         struct hci_conn_params *params;
1340
1341         if (is_connected(hdev, addr, addr_type))
1342                 return -EISCONN;
1343
1344         params = hci_conn_params_lookup(hdev, addr, addr_type);
1345         if (!params) {
1346                 params = hci_conn_params_add(hdev, addr, addr_type);
1347                 if (!params)
1348                         return -ENOMEM;
1349
1350                 /* If we created new params, mark them to be deleted in
1351                  * hci_connect_le_scan_cleanup. It's different case than
1352                  * existing disabled params, those will stay after cleanup.
1353                  */
1354                 params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
1355         }
1356
1357         /* We're trying to connect, so make sure params are at pend_le_conns */
1358         if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
1359             params->auto_connect == HCI_AUTO_CONN_REPORT ||
1360             params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
1361                 list_del_init(&params->action);
1362                 list_add(&params->action, &hdev->pend_le_conns);
1363         }
1364
1365         params->explicit_connect = true;
1366
1367         BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
1368                params->auto_connect);
1369
1370         return 0;
1371 }
1372
1373 static int qos_set_big(struct hci_dev *hdev, struct bt_iso_qos *qos)
1374 {
1375         struct iso_list_data data;
1376
1377         /* Allocate a BIG if not set */
1378         if (qos->big == BT_ISO_QOS_BIG_UNSET) {
1379                 for (data.big = 0x00; data.big < 0xef; data.big++) {
1380                         data.count = 0;
1381                         data.bis = 0xff;
1382
1383                         hci_conn_hash_list_state(hdev, bis_list, ISO_LINK,
1384                                                  BT_BOUND, &data);
1385                         if (!data.count)
1386                                 break;
1387                 }
1388
1389                 if (data.big == 0xef)
1390                         return -EADDRNOTAVAIL;
1391
1392                 /* Update BIG */
1393                 qos->big = data.big;
1394         }
1395
1396         return 0;
1397 }
1398
1399 static int qos_set_bis(struct hci_dev *hdev, struct bt_iso_qos *qos)
1400 {
1401         struct iso_list_data data;
1402
1403         /* Allocate BIS if not set */
1404         if (qos->bis == BT_ISO_QOS_BIS_UNSET) {
1405                 /* Find an unused adv set to advertise BIS, skip instance 0x00
1406                  * since it is reserved as general purpose set.
1407                  */
1408                 for (data.bis = 0x01; data.bis < hdev->le_num_of_adv_sets;
1409                      data.bis++) {
1410                         data.count = 0;
1411
1412                         hci_conn_hash_list_state(hdev, bis_list, ISO_LINK,
1413                                                  BT_BOUND, &data);
1414                         if (!data.count)
1415                                 break;
1416                 }
1417
1418                 if (data.bis == hdev->le_num_of_adv_sets)
1419                         return -EADDRNOTAVAIL;
1420
1421                 /* Update BIS */
1422                 qos->bis = data.bis;
1423         }
1424
1425         return 0;
1426 }
1427
1428 /* This function requires the caller holds hdev->lock */
1429 static struct hci_conn *hci_add_bis(struct hci_dev *hdev, bdaddr_t *dst,
1430                                     struct bt_iso_qos *qos)
1431 {
1432         struct hci_conn *conn;
1433         struct iso_list_data data;
1434         int err;
1435
1436         /* Let's make sure that le is enabled.*/
1437         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1438                 if (lmp_le_capable(hdev))
1439                         return ERR_PTR(-ECONNREFUSED);
1440                 return ERR_PTR(-EOPNOTSUPP);
1441         }
1442
1443         err = qos_set_big(hdev, qos);
1444         if (err)
1445                 return ERR_PTR(err);
1446
1447         err = qos_set_bis(hdev, qos);
1448         if (err)
1449                 return ERR_PTR(err);
1450
1451         data.big = qos->big;
1452         data.bis = qos->bis;
1453         data.count = 0;
1454
1455         /* Check if there is already a matching BIG/BIS */
1456         hci_conn_hash_list_state(hdev, bis_list, ISO_LINK, BT_BOUND, &data);
1457         if (data.count)
1458                 return ERR_PTR(-EADDRINUSE);
1459
1460         conn = hci_conn_hash_lookup_bis(hdev, dst, qos->big, qos->bis);
1461         if (conn)
1462                 return ERR_PTR(-EADDRINUSE);
1463
1464         conn = hci_conn_add(hdev, ISO_LINK, dst, HCI_ROLE_MASTER);
1465         if (!conn)
1466                 return ERR_PTR(-ENOMEM);
1467
1468         set_bit(HCI_CONN_PER_ADV, &conn->flags);
1469         conn->state = BT_CONNECT;
1470
1471         hci_conn_hold(conn);
1472         return conn;
1473 }
1474
1475 /* This function requires the caller holds hdev->lock */
1476 struct hci_conn *hci_connect_le_scan(struct hci_dev *hdev, bdaddr_t *dst,
1477                                      u8 dst_type, u8 sec_level,
1478                                      u16 conn_timeout,
1479                                      enum conn_reasons conn_reason)
1480 {
1481         struct hci_conn *conn;
1482
1483         /* Let's make sure that le is enabled.*/
1484         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1485                 if (lmp_le_capable(hdev))
1486                         return ERR_PTR(-ECONNREFUSED);
1487
1488                 return ERR_PTR(-EOPNOTSUPP);
1489         }
1490
1491         /* Some devices send ATT messages as soon as the physical link is
1492          * established. To be able to handle these ATT messages, the user-
1493          * space first establishes the connection and then starts the pairing
1494          * process.
1495          *
1496          * So if a hci_conn object already exists for the following connection
1497          * attempt, we simply update pending_sec_level and auth_type fields
1498          * and return the object found.
1499          */
1500         conn = hci_conn_hash_lookup_le(hdev, dst, dst_type);
1501         if (conn) {
1502                 if (conn->pending_sec_level < sec_level)
1503                         conn->pending_sec_level = sec_level;
1504                 goto done;
1505         }
1506
1507         BT_DBG("requesting refresh of dst_addr");
1508
1509         conn = hci_conn_add(hdev, LE_LINK, dst, HCI_ROLE_MASTER);
1510         if (!conn)
1511                 return ERR_PTR(-ENOMEM);
1512
1513         if (hci_explicit_conn_params_set(hdev, dst, dst_type) < 0) {
1514                 hci_conn_del(conn);
1515                 return ERR_PTR(-EBUSY);
1516         }
1517
1518         conn->state = BT_CONNECT;
1519         set_bit(HCI_CONN_SCANNING, &conn->flags);
1520         conn->dst_type = dst_type;
1521         conn->sec_level = BT_SECURITY_LOW;
1522         conn->pending_sec_level = sec_level;
1523         conn->conn_timeout = conn_timeout;
1524         conn->conn_reason = conn_reason;
1525
1526         hci_update_passive_scan(hdev);
1527
1528 done:
1529         hci_conn_hold(conn);
1530         return conn;
1531 }
1532
1533 struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst,
1534                                  u8 sec_level, u8 auth_type,
1535                                  enum conn_reasons conn_reason)
1536 {
1537         struct hci_conn *acl;
1538
1539         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1540                 if (lmp_bredr_capable(hdev))
1541                         return ERR_PTR(-ECONNREFUSED);
1542
1543                 return ERR_PTR(-EOPNOTSUPP);
1544         }
1545
1546         acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
1547         if (!acl) {
1548                 acl = hci_conn_add(hdev, ACL_LINK, dst, HCI_ROLE_MASTER);
1549                 if (!acl)
1550                         return ERR_PTR(-ENOMEM);
1551         }
1552
1553         hci_conn_hold(acl);
1554
1555         acl->conn_reason = conn_reason;
1556         if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
1557                 acl->sec_level = BT_SECURITY_LOW;
1558                 acl->pending_sec_level = sec_level;
1559                 acl->auth_type = auth_type;
1560                 hci_acl_create_connection(acl);
1561         }
1562
1563         return acl;
1564 }
1565
1566 struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type, bdaddr_t *dst,
1567                                  __u16 setting, struct bt_codec *codec)
1568 {
1569         struct hci_conn *acl;
1570         struct hci_conn *sco;
1571
1572         acl = hci_connect_acl(hdev, dst, BT_SECURITY_LOW, HCI_AT_NO_BONDING,
1573                               CONN_REASON_SCO_CONNECT);
1574         if (IS_ERR(acl))
1575                 return acl;
1576
1577         sco = hci_conn_hash_lookup_ba(hdev, type, dst);
1578         if (!sco) {
1579                 sco = hci_conn_add(hdev, type, dst, HCI_ROLE_MASTER);
1580                 if (!sco) {
1581                         hci_conn_drop(acl);
1582                         return ERR_PTR(-ENOMEM);
1583                 }
1584         }
1585
1586         acl->link = sco;
1587         sco->link = acl;
1588
1589         hci_conn_hold(sco);
1590
1591         sco->setting = setting;
1592         sco->codec = *codec;
1593
1594         if (acl->state == BT_CONNECTED &&
1595             (sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
1596                 set_bit(HCI_CONN_POWER_SAVE, &acl->flags);
1597                 hci_conn_enter_active_mode(acl, BT_POWER_FORCE_ACTIVE_ON);
1598
1599                 if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->flags)) {
1600                         /* defer SCO setup until mode change completed */
1601                         set_bit(HCI_CONN_SCO_SETUP_PEND, &acl->flags);
1602                         return sco;
1603                 }
1604
1605                 hci_sco_setup(acl, 0x00);
1606         }
1607
1608         return sco;
1609 }
1610
1611 static void cis_add(struct iso_list_data *d, struct bt_iso_qos *qos)
1612 {
1613         struct hci_cis_params *cis = &d->pdu.cis[d->pdu.cp.num_cis];
1614
1615         cis->cis_id = qos->cis;
1616         cis->c_sdu  = cpu_to_le16(qos->out.sdu);
1617         cis->p_sdu  = cpu_to_le16(qos->in.sdu);
1618         cis->c_phy  = qos->out.phy ? qos->out.phy : qos->in.phy;
1619         cis->p_phy  = qos->in.phy ? qos->in.phy : qos->out.phy;
1620         cis->c_rtn  = qos->out.rtn;
1621         cis->p_rtn  = qos->in.rtn;
1622
1623         d->pdu.cp.num_cis++;
1624 }
1625
1626 static void cis_list(struct hci_conn *conn, void *data)
1627 {
1628         struct iso_list_data *d = data;
1629
1630         /* Skip if broadcast/ANY address */
1631         if (!bacmp(&conn->dst, BDADDR_ANY))
1632                 return;
1633
1634         if (d->cig != conn->iso_qos.cig || d->cis == BT_ISO_QOS_CIS_UNSET ||
1635             d->cis != conn->iso_qos.cis)
1636                 return;
1637
1638         d->count++;
1639
1640         if (d->pdu.cp.cig_id == BT_ISO_QOS_CIG_UNSET ||
1641             d->count >= ARRAY_SIZE(d->pdu.cis))
1642                 return;
1643
1644         cis_add(d, &conn->iso_qos);
1645 }
1646
1647 static int hci_le_create_big(struct hci_conn *conn, struct bt_iso_qos *qos)
1648 {
1649         struct hci_dev *hdev = conn->hdev;
1650         struct hci_cp_le_create_big cp;
1651
1652         memset(&cp, 0, sizeof(cp));
1653
1654         cp.handle = qos->big;
1655         cp.adv_handle = qos->bis;
1656         cp.num_bis  = 0x01;
1657         hci_cpu_to_le24(qos->out.interval, cp.bis.sdu_interval);
1658         cp.bis.sdu = cpu_to_le16(qos->out.sdu);
1659         cp.bis.latency =  cpu_to_le16(qos->out.latency);
1660         cp.bis.rtn  = qos->out.rtn;
1661         cp.bis.phy  = qos->out.phy;
1662         cp.bis.packing = qos->packing;
1663         cp.bis.framing = qos->framing;
1664         cp.bis.encryption = 0x00;
1665         memset(&cp.bis.bcode, 0, sizeof(cp.bis.bcode));
1666
1667         return hci_send_cmd(hdev, HCI_OP_LE_CREATE_BIG, sizeof(cp), &cp);
1668 }
1669
1670 static bool hci_le_set_cig_params(struct hci_conn *conn, struct bt_iso_qos *qos)
1671 {
1672         struct hci_dev *hdev = conn->hdev;
1673         struct iso_list_data data;
1674
1675         memset(&data, 0, sizeof(data));
1676
1677         /* Allocate a CIG if not set */
1678         if (qos->cig == BT_ISO_QOS_CIG_UNSET) {
1679                 for (data.cig = 0x00; data.cig < 0xff; data.cig++) {
1680                         data.count = 0;
1681                         data.cis = 0xff;
1682
1683                         hci_conn_hash_list_state(hdev, cis_list, ISO_LINK,
1684                                                  BT_BOUND, &data);
1685                         if (data.count)
1686                                 continue;
1687
1688                         hci_conn_hash_list_state(hdev, cis_list, ISO_LINK,
1689                                                  BT_CONNECTED, &data);
1690                         if (!data.count)
1691                                 break;
1692                 }
1693
1694                 if (data.cig == 0xff)
1695                         return false;
1696
1697                 /* Update CIG */
1698                 qos->cig = data.cig;
1699         }
1700
1701         data.pdu.cp.cig_id = qos->cig;
1702         hci_cpu_to_le24(qos->out.interval, data.pdu.cp.c_interval);
1703         hci_cpu_to_le24(qos->in.interval, data.pdu.cp.p_interval);
1704         data.pdu.cp.sca = qos->sca;
1705         data.pdu.cp.packing = qos->packing;
1706         data.pdu.cp.framing = qos->framing;
1707         data.pdu.cp.c_latency = cpu_to_le16(qos->out.latency);
1708         data.pdu.cp.p_latency = cpu_to_le16(qos->in.latency);
1709
1710         if (qos->cis != BT_ISO_QOS_CIS_UNSET) {
1711                 data.count = 0;
1712                 data.cig = qos->cig;
1713                 data.cis = qos->cis;
1714
1715                 hci_conn_hash_list_state(hdev, cis_list, ISO_LINK, BT_BOUND,
1716                                          &data);
1717                 if (data.count)
1718                         return false;
1719
1720                 cis_add(&data, qos);
1721         }
1722
1723         /* Reprogram all CIS(s) with the same CIG */
1724         for (data.cig = qos->cig, data.cis = 0x00; data.cis < 0x11;
1725              data.cis++) {
1726                 data.count = 0;
1727
1728                 hci_conn_hash_list_state(hdev, cis_list, ISO_LINK, BT_BOUND,
1729                                          &data);
1730                 if (data.count)
1731                         continue;
1732
1733                 /* Allocate a CIS if not set */
1734                 if (qos->cis == BT_ISO_QOS_CIS_UNSET) {
1735                         /* Update CIS */
1736                         qos->cis = data.cis;
1737                         cis_add(&data, qos);
1738                 }
1739         }
1740
1741         if (qos->cis == BT_ISO_QOS_CIS_UNSET || !data.pdu.cp.num_cis)
1742                 return false;
1743
1744         if (hci_send_cmd(hdev, HCI_OP_LE_SET_CIG_PARAMS,
1745                          sizeof(data.pdu.cp) +
1746                          (data.pdu.cp.num_cis * sizeof(*data.pdu.cis)),
1747                          &data.pdu) < 0)
1748                 return false;
1749
1750         return true;
1751 }
1752
1753 struct hci_conn *hci_bind_cis(struct hci_dev *hdev, bdaddr_t *dst,
1754                               __u8 dst_type, struct bt_iso_qos *qos)
1755 {
1756         struct hci_conn *cis;
1757
1758         cis = hci_conn_hash_lookup_cis(hdev, dst, dst_type);
1759         if (!cis) {
1760                 cis = hci_conn_add(hdev, ISO_LINK, dst, HCI_ROLE_MASTER);
1761                 if (!cis)
1762                         return ERR_PTR(-ENOMEM);
1763                 cis->cleanup = cis_cleanup;
1764         }
1765
1766         if (cis->state == BT_CONNECTED)
1767                 return cis;
1768
1769         /* Check if CIS has been set and the settings matches */
1770         if (cis->state == BT_BOUND &&
1771             !memcmp(&cis->iso_qos, qos, sizeof(*qos)))
1772                 return cis;
1773
1774         /* Update LINK PHYs according to QoS preference */
1775         cis->le_tx_phy = qos->out.phy;
1776         cis->le_rx_phy = qos->in.phy;
1777
1778         /* If output interval is not set use the input interval as it cannot be
1779          * 0x000000.
1780          */
1781         if (!qos->out.interval)
1782                 qos->out.interval = qos->in.interval;
1783
1784         /* If input interval is not set use the output interval as it cannot be
1785          * 0x000000.
1786          */
1787         if (!qos->in.interval)
1788                 qos->in.interval = qos->out.interval;
1789
1790         /* If output latency is not set use the input latency as it cannot be
1791          * 0x0000.
1792          */
1793         if (!qos->out.latency)
1794                 qos->out.latency = qos->in.latency;
1795
1796         /* If input latency is not set use the output latency as it cannot be
1797          * 0x0000.
1798          */
1799         if (!qos->in.latency)
1800                 qos->in.latency = qos->out.latency;
1801
1802         if (!hci_le_set_cig_params(cis, qos)) {
1803                 hci_conn_drop(cis);
1804                 return ERR_PTR(-EINVAL);
1805         }
1806
1807         cis->iso_qos = *qos;
1808         cis->state = BT_BOUND;
1809
1810         return cis;
1811 }
1812
1813 bool hci_iso_setup_path(struct hci_conn *conn)
1814 {
1815         struct hci_dev *hdev = conn->hdev;
1816         struct hci_cp_le_setup_iso_path cmd;
1817
1818         memset(&cmd, 0, sizeof(cmd));
1819
1820         if (conn->iso_qos.out.sdu) {
1821                 cmd.handle = cpu_to_le16(conn->handle);
1822                 cmd.direction = 0x00; /* Input (Host to Controller) */
1823                 cmd.path = 0x00; /* HCI path if enabled */
1824                 cmd.codec = 0x03; /* Transparent Data */
1825
1826                 if (hci_send_cmd(hdev, HCI_OP_LE_SETUP_ISO_PATH, sizeof(cmd),
1827                                  &cmd) < 0)
1828                         return false;
1829         }
1830
1831         if (conn->iso_qos.in.sdu) {
1832                 cmd.handle = cpu_to_le16(conn->handle);
1833                 cmd.direction = 0x01; /* Output (Controller to Host) */
1834                 cmd.path = 0x00; /* HCI path if enabled */
1835                 cmd.codec = 0x03; /* Transparent Data */
1836
1837                 if (hci_send_cmd(hdev, HCI_OP_LE_SETUP_ISO_PATH, sizeof(cmd),
1838                                  &cmd) < 0)
1839                         return false;
1840         }
1841
1842         return true;
1843 }
1844
1845 static int hci_create_cis_sync(struct hci_dev *hdev, void *data)
1846 {
1847         struct {
1848                 struct hci_cp_le_create_cis cp;
1849                 struct hci_cis cis[0x1f];
1850         } cmd;
1851         struct hci_conn *conn = data;
1852         u8 cig;
1853
1854         memset(&cmd, 0, sizeof(cmd));
1855         cmd.cis[0].acl_handle = cpu_to_le16(conn->link->handle);
1856         cmd.cis[0].cis_handle = cpu_to_le16(conn->handle);
1857         cmd.cp.num_cis++;
1858         cig = conn->iso_qos.cig;
1859
1860         hci_dev_lock(hdev);
1861
1862         rcu_read_lock();
1863
1864         list_for_each_entry_rcu(conn, &hdev->conn_hash.list, list) {
1865                 struct hci_cis *cis = &cmd.cis[cmd.cp.num_cis];
1866
1867                 if (conn == data || conn->type != ISO_LINK ||
1868                     conn->state == BT_CONNECTED || conn->iso_qos.cig != cig)
1869                         continue;
1870
1871                 /* Check if all CIS(s) belonging to a CIG are ready */
1872                 if (conn->link->state != BT_CONNECTED ||
1873                     conn->state != BT_CONNECT) {
1874                         cmd.cp.num_cis = 0;
1875                         break;
1876                 }
1877
1878                 /* Group all CIS with state BT_CONNECT since the spec don't
1879                  * allow to send them individually:
1880                  *
1881                  * BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 4, Part E
1882                  * page 2566:
1883                  *
1884                  * If the Host issues this command before all the
1885                  * HCI_LE_CIS_Established events from the previous use of the
1886                  * command have been generated, the Controller shall return the
1887                  * error code Command Disallowed (0x0C).
1888                  */
1889                 cis->acl_handle = cpu_to_le16(conn->link->handle);
1890                 cis->cis_handle = cpu_to_le16(conn->handle);
1891                 cmd.cp.num_cis++;
1892         }
1893
1894         rcu_read_unlock();
1895
1896         hci_dev_unlock(hdev);
1897
1898         if (!cmd.cp.num_cis)
1899                 return 0;
1900
1901         return hci_send_cmd(hdev, HCI_OP_LE_CREATE_CIS, sizeof(cmd.cp) +
1902                             sizeof(cmd.cis[0]) * cmd.cp.num_cis, &cmd);
1903 }
1904
1905 int hci_le_create_cis(struct hci_conn *conn)
1906 {
1907         struct hci_conn *cis;
1908         struct hci_dev *hdev = conn->hdev;
1909         int err;
1910
1911         switch (conn->type) {
1912         case LE_LINK:
1913                 if (!conn->link || conn->state != BT_CONNECTED)
1914                         return -EINVAL;
1915                 cis = conn->link;
1916                 break;
1917         case ISO_LINK:
1918                 cis = conn;
1919                 break;
1920         default:
1921                 return -EINVAL;
1922         }
1923
1924         if (cis->state == BT_CONNECT)
1925                 return 0;
1926
1927         /* Queue Create CIS */
1928         err = hci_cmd_sync_queue(hdev, hci_create_cis_sync, cis, NULL);
1929         if (err)
1930                 return err;
1931
1932         cis->state = BT_CONNECT;
1933
1934         return 0;
1935 }
1936
1937 static void hci_iso_qos_setup(struct hci_dev *hdev, struct hci_conn *conn,
1938                               struct bt_iso_io_qos *qos, __u8 phy)
1939 {
1940         /* Only set MTU if PHY is enabled */
1941         if (!qos->sdu && qos->phy) {
1942                 if (hdev->iso_mtu > 0)
1943                         qos->sdu = hdev->iso_mtu;
1944                 else if (hdev->le_mtu > 0)
1945                         qos->sdu = hdev->le_mtu;
1946                 else
1947                         qos->sdu = hdev->acl_mtu;
1948         }
1949
1950         /* Use the same PHY as ACL if set to any */
1951         if (qos->phy == BT_ISO_PHY_ANY)
1952                 qos->phy = phy;
1953
1954         /* Use LE ACL connection interval if not set */
1955         if (!qos->interval)
1956                 /* ACL interval unit in 1.25 ms to us */
1957                 qos->interval = conn->le_conn_interval * 1250;
1958
1959         /* Use LE ACL connection latency if not set */
1960         if (!qos->latency)
1961                 qos->latency = conn->le_conn_latency;
1962 }
1963
1964 static struct hci_conn *hci_bind_bis(struct hci_conn *conn,
1965                                      struct bt_iso_qos *qos)
1966 {
1967         /* Update LINK PHYs according to QoS preference */
1968         conn->le_tx_phy = qos->out.phy;
1969         conn->le_tx_phy = qos->out.phy;
1970         conn->iso_qos = *qos;
1971         conn->state = BT_BOUND;
1972
1973         return conn;
1974 }
1975
1976 static int create_big_sync(struct hci_dev *hdev, void *data)
1977 {
1978         struct hci_conn *conn = data;
1979         struct bt_iso_qos *qos = &conn->iso_qos;
1980         u16 interval, sync_interval = 0;
1981         u32 flags = 0;
1982         int err;
1983
1984         if (qos->out.phy == 0x02)
1985                 flags |= MGMT_ADV_FLAG_SEC_2M;
1986
1987         /* Align intervals */
1988         interval = qos->out.interval / 1250;
1989
1990         if (qos->bis)
1991                 sync_interval = qos->sync_interval * 1600;
1992
1993         err = hci_start_per_adv_sync(hdev, qos->bis, conn->le_per_adv_data_len,
1994                                      conn->le_per_adv_data, flags, interval,
1995                                      interval, sync_interval);
1996         if (err)
1997                 return err;
1998
1999         return hci_le_create_big(conn, &conn->iso_qos);
2000 }
2001
2002 static void create_pa_complete(struct hci_dev *hdev, void *data, int err)
2003 {
2004         struct hci_cp_le_pa_create_sync *cp = data;
2005
2006         bt_dev_dbg(hdev, "");
2007
2008         if (err)
2009                 bt_dev_err(hdev, "Unable to create PA: %d", err);
2010
2011         kfree(cp);
2012 }
2013
2014 static int create_pa_sync(struct hci_dev *hdev, void *data)
2015 {
2016         struct hci_cp_le_pa_create_sync *cp = data;
2017         int err;
2018
2019         err = __hci_cmd_sync_status(hdev, HCI_OP_LE_PA_CREATE_SYNC,
2020                                     sizeof(*cp), cp, HCI_CMD_TIMEOUT);
2021         if (err) {
2022                 hci_dev_clear_flag(hdev, HCI_PA_SYNC);
2023                 return err;
2024         }
2025
2026         return hci_update_passive_scan_sync(hdev);
2027 }
2028
2029 int hci_pa_create_sync(struct hci_dev *hdev, bdaddr_t *dst, __u8 dst_type,
2030                        __u8 sid)
2031 {
2032         struct hci_cp_le_pa_create_sync *cp;
2033
2034         if (hci_dev_test_and_set_flag(hdev, HCI_PA_SYNC))
2035                 return -EBUSY;
2036
2037         cp = kmalloc(sizeof(*cp), GFP_KERNEL);
2038         if (!cp) {
2039                 hci_dev_clear_flag(hdev, HCI_PA_SYNC);
2040                 return -ENOMEM;
2041         }
2042
2043         /* Convert from ISO socket address type to HCI address type  */
2044         if (dst_type == BDADDR_LE_PUBLIC)
2045                 dst_type = ADDR_LE_DEV_PUBLIC;
2046         else
2047                 dst_type = ADDR_LE_DEV_RANDOM;
2048
2049         memset(cp, 0, sizeof(*cp));
2050         cp->sid = sid;
2051         cp->addr_type = dst_type;
2052         bacpy(&cp->addr, dst);
2053
2054         /* Queue start pa_create_sync and scan */
2055         return hci_cmd_sync_queue(hdev, create_pa_sync, cp, create_pa_complete);
2056 }
2057
2058 int hci_le_big_create_sync(struct hci_dev *hdev, struct bt_iso_qos *qos,
2059                            __u16 sync_handle, __u8 num_bis, __u8 bis[])
2060 {
2061         struct _packed {
2062                 struct hci_cp_le_big_create_sync cp;
2063                 __u8  bis[0x11];
2064         } pdu;
2065         int err;
2066
2067         if (num_bis > sizeof(pdu.bis))
2068                 return -EINVAL;
2069
2070         err = qos_set_big(hdev, qos);
2071         if (err)
2072                 return err;
2073
2074         memset(&pdu, 0, sizeof(pdu));
2075         pdu.cp.handle = qos->big;
2076         pdu.cp.sync_handle = cpu_to_le16(sync_handle);
2077         pdu.cp.num_bis = num_bis;
2078         memcpy(pdu.bis, bis, num_bis);
2079
2080         return hci_send_cmd(hdev, HCI_OP_LE_BIG_CREATE_SYNC,
2081                             sizeof(pdu.cp) + num_bis, &pdu);
2082 }
2083
2084 static void create_big_complete(struct hci_dev *hdev, void *data, int err)
2085 {
2086         struct hci_conn *conn = data;
2087
2088         bt_dev_dbg(hdev, "conn %p", conn);
2089
2090         if (err) {
2091                 bt_dev_err(hdev, "Unable to create BIG: %d", err);
2092                 hci_connect_cfm(conn, err);
2093                 hci_conn_del(conn);
2094         }
2095 }
2096
2097 struct hci_conn *hci_connect_bis(struct hci_dev *hdev, bdaddr_t *dst,
2098                                  __u8 dst_type, struct bt_iso_qos *qos,
2099                                  __u8 base_len, __u8 *base)
2100 {
2101         struct hci_conn *conn;
2102         int err;
2103
2104         /* We need hci_conn object using the BDADDR_ANY as dst */
2105         conn = hci_add_bis(hdev, dst, qos);
2106         if (IS_ERR(conn))
2107                 return conn;
2108
2109         conn = hci_bind_bis(conn, qos);
2110         if (!conn) {
2111                 hci_conn_drop(conn);
2112                 return ERR_PTR(-ENOMEM);
2113         }
2114
2115         /* Add Basic Announcement into Peridic Adv Data if BASE is set */
2116         if (base_len && base) {
2117                 base_len = eir_append_service_data(conn->le_per_adv_data, 0,
2118                                                    0x1851, base, base_len);
2119                 conn->le_per_adv_data_len = base_len;
2120         }
2121
2122         /* Queue start periodic advertising and create BIG */
2123         err = hci_cmd_sync_queue(hdev, create_big_sync, conn,
2124                                  create_big_complete);
2125         if (err < 0) {
2126                 hci_conn_drop(conn);
2127                 return ERR_PTR(err);
2128         }
2129
2130         hci_iso_qos_setup(hdev, conn, &qos->out,
2131                           conn->le_tx_phy ? conn->le_tx_phy :
2132                           hdev->le_tx_def_phys);
2133
2134         return conn;
2135 }
2136
2137 struct hci_conn *hci_connect_cis(struct hci_dev *hdev, bdaddr_t *dst,
2138                                  __u8 dst_type, struct bt_iso_qos *qos)
2139 {
2140         struct hci_conn *le;
2141         struct hci_conn *cis;
2142
2143         /* Convert from ISO socket address type to HCI address type  */
2144         if (dst_type == BDADDR_LE_PUBLIC)
2145                 dst_type = ADDR_LE_DEV_PUBLIC;
2146         else
2147                 dst_type = ADDR_LE_DEV_RANDOM;
2148
2149         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
2150                 le = hci_connect_le(hdev, dst, dst_type, false,
2151                                     BT_SECURITY_LOW,
2152                                     HCI_LE_CONN_TIMEOUT,
2153                                     HCI_ROLE_SLAVE);
2154         else
2155                 le = hci_connect_le_scan(hdev, dst, dst_type,
2156                                          BT_SECURITY_LOW,
2157                                          HCI_LE_CONN_TIMEOUT,
2158                                          CONN_REASON_ISO_CONNECT);
2159         if (IS_ERR(le))
2160                 return le;
2161
2162         hci_iso_qos_setup(hdev, le, &qos->out,
2163                           le->le_tx_phy ? le->le_tx_phy : hdev->le_tx_def_phys);
2164         hci_iso_qos_setup(hdev, le, &qos->in,
2165                           le->le_rx_phy ? le->le_rx_phy : hdev->le_rx_def_phys);
2166
2167         cis = hci_bind_cis(hdev, dst, dst_type, qos);
2168         if (IS_ERR(cis)) {
2169                 hci_conn_drop(le);
2170                 return cis;
2171         }
2172
2173         le->link = cis;
2174         cis->link = le;
2175
2176         hci_conn_hold(cis);
2177
2178         /* If LE is already connected and CIS handle is already set proceed to
2179          * Create CIS immediately.
2180          */
2181         if (le->state == BT_CONNECTED && cis->handle != HCI_CONN_HANDLE_UNSET)
2182                 hci_le_create_cis(le);
2183
2184         return cis;
2185 }
2186
2187 /* Check link security requirement */
2188 int hci_conn_check_link_mode(struct hci_conn *conn)
2189 {
2190         BT_DBG("hcon %p", conn);
2191
2192         /* In Secure Connections Only mode, it is required that Secure
2193          * Connections is used and the link is encrypted with AES-CCM
2194          * using a P-256 authenticated combination key.
2195          */
2196         if (hci_dev_test_flag(conn->hdev, HCI_SC_ONLY)) {
2197                 if (!hci_conn_sc_enabled(conn) ||
2198                     !test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
2199                     conn->key_type != HCI_LK_AUTH_COMBINATION_P256)
2200                         return 0;
2201         }
2202
2203          /* AES encryption is required for Level 4:
2204           *
2205           * BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 3, Part C
2206           * page 1319:
2207           *
2208           * 128-bit equivalent strength for link and encryption keys
2209           * required using FIPS approved algorithms (E0 not allowed,
2210           * SAFER+ not allowed, and P-192 not allowed; encryption key
2211           * not shortened)
2212           */
2213         if (conn->sec_level == BT_SECURITY_FIPS &&
2214             !test_bit(HCI_CONN_AES_CCM, &conn->flags)) {
2215                 bt_dev_err(conn->hdev,
2216                            "Invalid security: Missing AES-CCM usage");
2217                 return 0;
2218         }
2219
2220         if (hci_conn_ssp_enabled(conn) &&
2221             !test_bit(HCI_CONN_ENCRYPT, &conn->flags))
2222                 return 0;
2223
2224         return 1;
2225 }
2226
2227 /* Authenticate remote device */
2228 static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
2229 {
2230         BT_DBG("hcon %p", conn);
2231
2232         if (conn->pending_sec_level > sec_level)
2233                 sec_level = conn->pending_sec_level;
2234
2235         if (sec_level > conn->sec_level)
2236                 conn->pending_sec_level = sec_level;
2237         else if (test_bit(HCI_CONN_AUTH, &conn->flags))
2238                 return 1;
2239
2240         /* Make sure we preserve an existing MITM requirement*/
2241         auth_type |= (conn->auth_type & 0x01);
2242
2243         conn->auth_type = auth_type;
2244
2245         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
2246                 struct hci_cp_auth_requested cp;
2247
2248                 cp.handle = cpu_to_le16(conn->handle);
2249                 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
2250                              sizeof(cp), &cp);
2251
2252                 /* If we're already encrypted set the REAUTH_PEND flag,
2253                  * otherwise set the ENCRYPT_PEND.
2254                  */
2255                 if (test_bit(HCI_CONN_ENCRYPT, &conn->flags))
2256                         set_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
2257                 else
2258                         set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2259         }
2260
2261         return 0;
2262 }
2263
2264 /* Encrypt the link */
2265 static void hci_conn_encrypt(struct hci_conn *conn)
2266 {
2267         BT_DBG("hcon %p", conn);
2268
2269         if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
2270                 struct hci_cp_set_conn_encrypt cp;
2271                 cp.handle  = cpu_to_le16(conn->handle);
2272                 cp.encrypt = 0x01;
2273                 hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2274                              &cp);
2275         }
2276 }
2277
2278 /* Enable security */
2279 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type,
2280                       bool initiator)
2281 {
2282         BT_DBG("hcon %p", conn);
2283
2284         if (conn->type == LE_LINK)
2285                 return smp_conn_security(conn, sec_level);
2286
2287         /* For sdp we don't need the link key. */
2288         if (sec_level == BT_SECURITY_SDP)
2289                 return 1;
2290
2291         /* For non 2.1 devices and low security level we don't need the link
2292            key. */
2293         if (sec_level == BT_SECURITY_LOW && !hci_conn_ssp_enabled(conn))
2294                 return 1;
2295
2296         /* For other security levels we need the link key. */
2297         if (!test_bit(HCI_CONN_AUTH, &conn->flags))
2298                 goto auth;
2299
2300         /* An authenticated FIPS approved combination key has sufficient
2301          * security for security level 4. */
2302         if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256 &&
2303             sec_level == BT_SECURITY_FIPS)
2304                 goto encrypt;
2305
2306         /* An authenticated combination key has sufficient security for
2307            security level 3. */
2308         if ((conn->key_type == HCI_LK_AUTH_COMBINATION_P192 ||
2309              conn->key_type == HCI_LK_AUTH_COMBINATION_P256) &&
2310             sec_level == BT_SECURITY_HIGH)
2311                 goto encrypt;
2312
2313         /* An unauthenticated combination key has sufficient security for
2314            security level 1 and 2. */
2315         if ((conn->key_type == HCI_LK_UNAUTH_COMBINATION_P192 ||
2316              conn->key_type == HCI_LK_UNAUTH_COMBINATION_P256) &&
2317             (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW))
2318                 goto encrypt;
2319
2320         /* A combination key has always sufficient security for the security
2321            levels 1 or 2. High security level requires the combination key
2322            is generated using maximum PIN code length (16).
2323            For pre 2.1 units. */
2324         if (conn->key_type == HCI_LK_COMBINATION &&
2325             (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW ||
2326              conn->pin_length == 16))
2327                 goto encrypt;
2328
2329 auth:
2330         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags))
2331                 return 0;
2332
2333         if (initiator)
2334                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
2335
2336         if (!hci_conn_auth(conn, sec_level, auth_type))
2337                 return 0;
2338
2339 encrypt:
2340         if (test_bit(HCI_CONN_ENCRYPT, &conn->flags)) {
2341                 /* Ensure that the encryption key size has been read,
2342                  * otherwise stall the upper layer responses.
2343                  */
2344                 if (!conn->enc_key_size)
2345                         return 0;
2346
2347                 /* Nothing else needed, all requirements are met */
2348                 return 1;
2349         }
2350
2351         hci_conn_encrypt(conn);
2352         return 0;
2353 }
2354 EXPORT_SYMBOL(hci_conn_security);
2355
2356 /* Check secure link requirement */
2357 int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level)
2358 {
2359         BT_DBG("hcon %p", conn);
2360
2361         /* Accept if non-secure or higher security level is required */
2362         if (sec_level != BT_SECURITY_HIGH && sec_level != BT_SECURITY_FIPS)
2363                 return 1;
2364
2365         /* Accept if secure or higher security level is already present */
2366         if (conn->sec_level == BT_SECURITY_HIGH ||
2367             conn->sec_level == BT_SECURITY_FIPS)
2368                 return 1;
2369
2370         /* Reject not secure link */
2371         return 0;
2372 }
2373 EXPORT_SYMBOL(hci_conn_check_secure);
2374
2375 /* Switch role */
2376 int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
2377 {
2378         BT_DBG("hcon %p", conn);
2379
2380         if (role == conn->role)
2381                 return 1;
2382
2383         if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->flags)) {
2384                 struct hci_cp_switch_role cp;
2385                 bacpy(&cp.bdaddr, &conn->dst);
2386                 cp.role = role;
2387                 hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
2388         }
2389
2390         return 0;
2391 }
2392 EXPORT_SYMBOL(hci_conn_switch_role);
2393
2394 /* Enter active mode */
2395 void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
2396 {
2397         struct hci_dev *hdev = conn->hdev;
2398
2399         BT_DBG("hcon %p mode %d", conn, conn->mode);
2400
2401         if (conn->mode != HCI_CM_SNIFF)
2402                 goto timer;
2403
2404         if (!test_bit(HCI_CONN_POWER_SAVE, &conn->flags) && !force_active)
2405                 goto timer;
2406
2407         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
2408                 struct hci_cp_exit_sniff_mode cp;
2409                 cp.handle = cpu_to_le16(conn->handle);
2410                 hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
2411         }
2412
2413 timer:
2414         if (hdev->idle_timeout > 0)
2415                 queue_delayed_work(hdev->workqueue, &conn->idle_work,
2416                                    msecs_to_jiffies(hdev->idle_timeout));
2417 }
2418
2419 /* Drop all connection on the device */
2420 void hci_conn_hash_flush(struct hci_dev *hdev)
2421 {
2422         struct hci_conn_hash *h = &hdev->conn_hash;
2423         struct hci_conn *c, *n;
2424
2425         BT_DBG("hdev %s", hdev->name);
2426
2427         list_for_each_entry_safe(c, n, &h->list, list) {
2428                 c->state = BT_CLOSED;
2429
2430                 hci_disconn_cfm(c, HCI_ERROR_LOCAL_HOST_TERM);
2431                 hci_conn_del(c);
2432         }
2433 }
2434
2435 /* Check pending connect attempts */
2436 void hci_conn_check_pending(struct hci_dev *hdev)
2437 {
2438         struct hci_conn *conn;
2439
2440         BT_DBG("hdev %s", hdev->name);
2441
2442         hci_dev_lock(hdev);
2443
2444         conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
2445         if (conn)
2446                 hci_acl_create_connection(conn);
2447
2448         hci_dev_unlock(hdev);
2449 }
2450
2451 static u32 get_link_mode(struct hci_conn *conn)
2452 {
2453         u32 link_mode = 0;
2454
2455         if (conn->role == HCI_ROLE_MASTER)
2456                 link_mode |= HCI_LM_MASTER;
2457
2458         if (test_bit(HCI_CONN_ENCRYPT, &conn->flags))
2459                 link_mode |= HCI_LM_ENCRYPT;
2460
2461         if (test_bit(HCI_CONN_AUTH, &conn->flags))
2462                 link_mode |= HCI_LM_AUTH;
2463
2464         if (test_bit(HCI_CONN_SECURE, &conn->flags))
2465                 link_mode |= HCI_LM_SECURE;
2466
2467         if (test_bit(HCI_CONN_FIPS, &conn->flags))
2468                 link_mode |= HCI_LM_FIPS;
2469
2470         return link_mode;
2471 }
2472
2473 int hci_get_conn_list(void __user *arg)
2474 {
2475         struct hci_conn *c;
2476         struct hci_conn_list_req req, *cl;
2477         struct hci_conn_info *ci;
2478         struct hci_dev *hdev;
2479         int n = 0, size, err;
2480
2481         if (copy_from_user(&req, arg, sizeof(req)))
2482                 return -EFAULT;
2483
2484         if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
2485                 return -EINVAL;
2486
2487         size = sizeof(req) + req.conn_num * sizeof(*ci);
2488
2489         cl = kmalloc(size, GFP_KERNEL);
2490         if (!cl)
2491                 return -ENOMEM;
2492
2493         hdev = hci_dev_get(req.dev_id);
2494         if (!hdev) {
2495                 kfree(cl);
2496                 return -ENODEV;
2497         }
2498
2499         ci = cl->conn_info;
2500
2501         hci_dev_lock(hdev);
2502         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2503                 bacpy(&(ci + n)->bdaddr, &c->dst);
2504                 (ci + n)->handle = c->handle;
2505                 (ci + n)->type  = c->type;
2506                 (ci + n)->out   = c->out;
2507                 (ci + n)->state = c->state;
2508                 (ci + n)->link_mode = get_link_mode(c);
2509                 if (++n >= req.conn_num)
2510                         break;
2511         }
2512         hci_dev_unlock(hdev);
2513
2514         cl->dev_id = hdev->id;
2515         cl->conn_num = n;
2516         size = sizeof(req) + n * sizeof(*ci);
2517
2518         hci_dev_put(hdev);
2519
2520         err = copy_to_user(arg, cl, size);
2521         kfree(cl);
2522
2523         return err ? -EFAULT : 0;
2524 }
2525
2526 int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
2527 {
2528         struct hci_conn_info_req req;
2529         struct hci_conn_info ci;
2530         struct hci_conn *conn;
2531         char __user *ptr = arg + sizeof(req);
2532
2533         if (copy_from_user(&req, arg, sizeof(req)))
2534                 return -EFAULT;
2535
2536         hci_dev_lock(hdev);
2537         conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
2538         if (conn) {
2539                 bacpy(&ci.bdaddr, &conn->dst);
2540                 ci.handle = conn->handle;
2541                 ci.type  = conn->type;
2542                 ci.out   = conn->out;
2543                 ci.state = conn->state;
2544                 ci.link_mode = get_link_mode(conn);
2545         }
2546         hci_dev_unlock(hdev);
2547
2548         if (!conn)
2549                 return -ENOENT;
2550
2551         return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
2552 }
2553
2554 int hci_get_auth_info(struct hci_dev *hdev, void __user *arg)
2555 {
2556         struct hci_auth_info_req req;
2557         struct hci_conn *conn;
2558
2559         if (copy_from_user(&req, arg, sizeof(req)))
2560                 return -EFAULT;
2561
2562         hci_dev_lock(hdev);
2563         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr);
2564         if (conn)
2565                 req.type = conn->auth_type;
2566         hci_dev_unlock(hdev);
2567
2568         if (!conn)
2569                 return -ENOENT;
2570
2571         return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0;
2572 }
2573
2574 struct hci_chan *hci_chan_create(struct hci_conn *conn)
2575 {
2576         struct hci_dev *hdev = conn->hdev;
2577         struct hci_chan *chan;
2578
2579         BT_DBG("%s hcon %p", hdev->name, conn);
2580
2581         if (test_bit(HCI_CONN_DROP, &conn->flags)) {
2582                 BT_DBG("Refusing to create new hci_chan");
2583                 return NULL;
2584         }
2585
2586         chan = kzalloc(sizeof(*chan), GFP_KERNEL);
2587         if (!chan)
2588                 return NULL;
2589
2590         chan->conn = hci_conn_get(conn);
2591         skb_queue_head_init(&chan->data_q);
2592         chan->state = BT_CONNECTED;
2593
2594         list_add_rcu(&chan->list, &conn->chan_list);
2595
2596         return chan;
2597 }
2598
2599 void hci_chan_del(struct hci_chan *chan)
2600 {
2601         struct hci_conn *conn = chan->conn;
2602         struct hci_dev *hdev = conn->hdev;
2603
2604         BT_DBG("%s hcon %p chan %p", hdev->name, conn, chan);
2605
2606         list_del_rcu(&chan->list);
2607
2608         synchronize_rcu();
2609
2610         /* Prevent new hci_chan's to be created for this hci_conn */
2611         set_bit(HCI_CONN_DROP, &conn->flags);
2612
2613         hci_conn_put(conn);
2614
2615         skb_queue_purge(&chan->data_q);
2616         kfree(chan);
2617 }
2618
2619 void hci_chan_list_flush(struct hci_conn *conn)
2620 {
2621         struct hci_chan *chan, *n;
2622
2623         BT_DBG("hcon %p", conn);
2624
2625         list_for_each_entry_safe(chan, n, &conn->chan_list, list)
2626                 hci_chan_del(chan);
2627 }
2628
2629 static struct hci_chan *__hci_chan_lookup_handle(struct hci_conn *hcon,
2630                                                  __u16 handle)
2631 {
2632         struct hci_chan *hchan;
2633
2634         list_for_each_entry(hchan, &hcon->chan_list, list) {
2635                 if (hchan->handle == handle)
2636                         return hchan;
2637         }
2638
2639         return NULL;
2640 }
2641
2642 struct hci_chan *hci_chan_lookup_handle(struct hci_dev *hdev, __u16 handle)
2643 {
2644         struct hci_conn_hash *h = &hdev->conn_hash;
2645         struct hci_conn *hcon;
2646         struct hci_chan *hchan = NULL;
2647
2648         rcu_read_lock();
2649
2650         list_for_each_entry_rcu(hcon, &h->list, list) {
2651                 hchan = __hci_chan_lookup_handle(hcon, handle);
2652                 if (hchan)
2653                         break;
2654         }
2655
2656         rcu_read_unlock();
2657
2658         return hchan;
2659 }
2660
2661 u32 hci_conn_get_phy(struct hci_conn *conn)
2662 {
2663         u32 phys = 0;
2664
2665         /* BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 2, Part B page 471:
2666          * Table 6.2: Packets defined for synchronous, asynchronous, and
2667          * CPB logical transport types.
2668          */
2669         switch (conn->type) {
2670         case SCO_LINK:
2671                 /* SCO logical transport (1 Mb/s):
2672                  * HV1, HV2, HV3 and DV.
2673                  */
2674                 phys |= BT_PHY_BR_1M_1SLOT;
2675
2676                 break;
2677
2678         case ACL_LINK:
2679                 /* ACL logical transport (1 Mb/s) ptt=0:
2680                  * DH1, DM3, DH3, DM5 and DH5.
2681                  */
2682                 phys |= BT_PHY_BR_1M_1SLOT;
2683
2684                 if (conn->pkt_type & (HCI_DM3 | HCI_DH3))
2685                         phys |= BT_PHY_BR_1M_3SLOT;
2686
2687                 if (conn->pkt_type & (HCI_DM5 | HCI_DH5))
2688                         phys |= BT_PHY_BR_1M_5SLOT;
2689
2690                 /* ACL logical transport (2 Mb/s) ptt=1:
2691                  * 2-DH1, 2-DH3 and 2-DH5.
2692                  */
2693                 if (!(conn->pkt_type & HCI_2DH1))
2694                         phys |= BT_PHY_EDR_2M_1SLOT;
2695
2696                 if (!(conn->pkt_type & HCI_2DH3))
2697                         phys |= BT_PHY_EDR_2M_3SLOT;
2698
2699                 if (!(conn->pkt_type & HCI_2DH5))
2700                         phys |= BT_PHY_EDR_2M_5SLOT;
2701
2702                 /* ACL logical transport (3 Mb/s) ptt=1:
2703                  * 3-DH1, 3-DH3 and 3-DH5.
2704                  */
2705                 if (!(conn->pkt_type & HCI_3DH1))
2706                         phys |= BT_PHY_EDR_3M_1SLOT;
2707
2708                 if (!(conn->pkt_type & HCI_3DH3))
2709                         phys |= BT_PHY_EDR_3M_3SLOT;
2710
2711                 if (!(conn->pkt_type & HCI_3DH5))
2712                         phys |= BT_PHY_EDR_3M_5SLOT;
2713
2714                 break;
2715
2716         case ESCO_LINK:
2717                 /* eSCO logical transport (1 Mb/s): EV3, EV4 and EV5 */
2718                 phys |= BT_PHY_BR_1M_1SLOT;
2719
2720                 if (!(conn->pkt_type & (ESCO_EV4 | ESCO_EV5)))
2721                         phys |= BT_PHY_BR_1M_3SLOT;
2722
2723                 /* eSCO logical transport (2 Mb/s): 2-EV3, 2-EV5 */
2724                 if (!(conn->pkt_type & ESCO_2EV3))
2725                         phys |= BT_PHY_EDR_2M_1SLOT;
2726
2727                 if (!(conn->pkt_type & ESCO_2EV5))
2728                         phys |= BT_PHY_EDR_2M_3SLOT;
2729
2730                 /* eSCO logical transport (3 Mb/s): 3-EV3, 3-EV5 */
2731                 if (!(conn->pkt_type & ESCO_3EV3))
2732                         phys |= BT_PHY_EDR_3M_1SLOT;
2733
2734                 if (!(conn->pkt_type & ESCO_3EV5))
2735                         phys |= BT_PHY_EDR_3M_3SLOT;
2736
2737                 break;
2738
2739         case LE_LINK:
2740                 if (conn->le_tx_phy & HCI_LE_SET_PHY_1M)
2741                         phys |= BT_PHY_LE_1M_TX;
2742
2743                 if (conn->le_rx_phy & HCI_LE_SET_PHY_1M)
2744                         phys |= BT_PHY_LE_1M_RX;
2745
2746                 if (conn->le_tx_phy & HCI_LE_SET_PHY_2M)
2747                         phys |= BT_PHY_LE_2M_TX;
2748
2749                 if (conn->le_rx_phy & HCI_LE_SET_PHY_2M)
2750                         phys |= BT_PHY_LE_2M_RX;
2751
2752                 if (conn->le_tx_phy & HCI_LE_SET_PHY_CODED)
2753                         phys |= BT_PHY_LE_CODED_TX;
2754
2755                 if (conn->le_rx_phy & HCI_LE_SET_PHY_CODED)
2756                         phys |= BT_PHY_LE_CODED_RX;
2757
2758                 break;
2759         }
2760
2761         return phys;
2762 }
2763
2764 int hci_abort_conn(struct hci_conn *conn, u8 reason)
2765 {
2766         int r = 0;
2767
2768         switch (conn->state) {
2769         case BT_CONNECTED:
2770         case BT_CONFIG:
2771                 if (conn->type == AMP_LINK) {
2772                         struct hci_cp_disconn_phy_link cp;
2773
2774                         cp.phy_handle = HCI_PHY_HANDLE(conn->handle);
2775                         cp.reason = reason;
2776                         r = hci_send_cmd(conn->hdev, HCI_OP_DISCONN_PHY_LINK,
2777                                          sizeof(cp), &cp);
2778                 } else {
2779                         struct hci_cp_disconnect dc;
2780
2781                         dc.handle = cpu_to_le16(conn->handle);
2782                         dc.reason = reason;
2783                         r = hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT,
2784                                          sizeof(dc), &dc);
2785                 }
2786
2787                 conn->state = BT_DISCONN;
2788
2789                 break;
2790         case BT_CONNECT:
2791                 if (conn->type == LE_LINK) {
2792                         if (test_bit(HCI_CONN_SCANNING, &conn->flags))
2793                                 break;
2794                         r = hci_send_cmd(conn->hdev,
2795                                          HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL);
2796                 } else if (conn->type == ACL_LINK) {
2797                         if (conn->hdev->hci_ver < BLUETOOTH_VER_1_2)
2798                                 break;
2799                         r = hci_send_cmd(conn->hdev,
2800                                          HCI_OP_CREATE_CONN_CANCEL,
2801                                          6, &conn->dst);
2802                 }
2803                 break;
2804         case BT_CONNECT2:
2805                 if (conn->type == ACL_LINK) {
2806                         struct hci_cp_reject_conn_req rej;
2807
2808                         bacpy(&rej.bdaddr, &conn->dst);
2809                         rej.reason = reason;
2810
2811                         r = hci_send_cmd(conn->hdev,
2812                                          HCI_OP_REJECT_CONN_REQ,
2813                                          sizeof(rej), &rej);
2814                 } else if (conn->type == SCO_LINK || conn->type == ESCO_LINK) {
2815                         struct hci_cp_reject_sync_conn_req rej;
2816
2817                         bacpy(&rej.bdaddr, &conn->dst);
2818
2819                         /* SCO rejection has its own limited set of
2820                          * allowed error values (0x0D-0x0F) which isn't
2821                          * compatible with most values passed to this
2822                          * function. To be safe hard-code one of the
2823                          * values that's suitable for SCO.
2824                          */
2825                         rej.reason = HCI_ERROR_REJ_LIMITED_RESOURCES;
2826
2827                         r = hci_send_cmd(conn->hdev,
2828                                          HCI_OP_REJECT_SYNC_CONN_REQ,
2829                                          sizeof(rej), &rej);
2830                 }
2831                 break;
2832         default:
2833                 conn->state = BT_CLOSED;
2834                 break;
2835         }
2836
2837         return r;
2838 }