net/bluetooth/hci_conn.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI connection handling. */
  26
  27 #include <linux/export.h>
  28 #include <linux/debugfs.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/l2cap.h>
  33 #include <net/bluetooth/iso.h>
  34 #include <net/bluetooth/mgmt.h>
  35
  36 #include "hci_request.h"
  37 #include "smp.h"
  38 #include "a2mp.h"
  39 #include "eir.h"
  40
  41 struct sco_param {
  42         u16 pkt_type;
  43         u16 max_latency;
  44         u8  retrans_effort;
  45 };
  46
  47 struct conn_handle_t {
  48         struct hci_conn *conn;
  49         __u16 handle;
  50 };
  51
  52 static const struct sco_param esco_param_cvsd[] = {
  53         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000a,   0x01 }, /* S3 */
  54         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x0007,   0x01 }, /* S2 */
  55         { EDR_ESCO_MASK | ESCO_EV3,   0x0007,   0x01 }, /* S1 */
  56         { EDR_ESCO_MASK | ESCO_HV3,   0xffff,   0x01 }, /* D1 */
  57         { EDR_ESCO_MASK | ESCO_HV1,   0xffff,   0x01 }, /* D0 */
  58 };
  59
  60 static const struct sco_param sco_param_cvsd[] = {
  61         { EDR_ESCO_MASK | ESCO_HV3,   0xffff,   0xff }, /* D1 */
  62         { EDR_ESCO_MASK | ESCO_HV1,   0xffff,   0xff }, /* D0 */
  63 };
  64
  65 static const struct sco_param esco_param_msbc[] = {
  66         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000d,   0x02 }, /* T2 */
  67         { EDR_ESCO_MASK | ESCO_EV3,   0x0008,   0x02 }, /* T1 */
  68 };
  69
  70 /* This function requires the caller holds hdev->lock */
  71 static void hci_connect_le_scan_cleanup(struct hci_conn *conn)
  72 {
  73         struct hci_conn_params *params;
  74         struct hci_dev *hdev = conn->hdev;
  75         struct smp_irk *irk;
  76         bdaddr_t *bdaddr;
  77         u8 bdaddr_type;
  78
  79         bdaddr = &conn->dst;
  80         bdaddr_type = conn->dst_type;
  81
  82         /* Check if we need to convert to identity address */
  83         irk = hci_get_irk(hdev, bdaddr, bdaddr_type);
  84         if (irk) {
  85                 bdaddr = &irk->bdaddr;
  86                 bdaddr_type = irk->addr_type;
  87         }
  88
  89         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, bdaddr,
  90                                            bdaddr_type);
  91         if (!params || !params->explicit_connect)
  92                 return;
  93
  94         /* The connection attempt was doing scan for new RPA, and is
  95          * in scan phase. If params are not associated with any other
  96          * autoconnect action, remove them completely. If they are, just unmark
  97          * them as waiting for connection, by clearing explicit_connect field.
  98          */
  99         params->explicit_connect = false;
 100
 101         list_del_init(&params->action);
 102
 103         switch (params->auto_connect) {
 104         case HCI_AUTO_CONN_EXPLICIT:
 105                 hci_conn_params_del(hdev, bdaddr, bdaddr_type);
 106                 /* return instead of break to avoid duplicate scan update */
 107                 return;
 108         case HCI_AUTO_CONN_DIRECT:
 109         case HCI_AUTO_CONN_ALWAYS:
 110                 list_add(&params->action, &hdev->pend_le_conns);
 111                 break;
 112         case HCI_AUTO_CONN_REPORT:
 113                 list_add(&params->action, &hdev->pend_le_reports);
 114                 break;
 115         default:
 116                 break;
 117         }
 118
 119         hci_update_passive_scan(hdev);
 120 }
 121
 122 static void hci_conn_cleanup(struct hci_conn *conn)
 123 {
 124         struct hci_dev *hdev = conn->hdev;
 125
 126         if (test_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags))
 127                 hci_conn_params_del(conn->hdev, &conn->dst, conn->dst_type);
 128
 129         if (test_and_clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
 130                 hci_remove_link_key(hdev, &conn->dst);
 131
 132         hci_chan_list_flush(conn);
 133
 134         hci_conn_hash_del(hdev, conn);
 135
 136         if (conn->cleanup)
 137                 conn->cleanup(conn);
 138
 139         if (conn->type == SCO_LINK || conn->type == ESCO_LINK) {
 140                 switch (conn->setting & SCO_AIRMODE_MASK) {
 141                 case SCO_AIRMODE_CVSD:
 142                 case SCO_AIRMODE_TRANSP:
 143                         if (hdev->notify)
 144                                 hdev->notify(hdev, HCI_NOTIFY_DISABLE_SCO);
 145                         break;
 146                 }
 147         } else {
 148                 if (hdev->notify)
 149                         hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
 150         }
 151
 152         hci_conn_del_sysfs(conn);
 153
 154         debugfs_remove_recursive(conn->debugfs);
 155
 156         hci_dev_put(hdev);
 157
 158         hci_conn_put(conn);
 159 }
 160
 161 static void le_scan_cleanup(struct work_struct *work)
 162 {
 163         struct hci_conn *conn = container_of(work, struct hci_conn,
 164                                              le_scan_cleanup);
 165         struct hci_dev *hdev = conn->hdev;
 166         struct hci_conn *c = NULL;
 167
 168         BT_DBG("%s hcon %p", hdev->name, conn);
 169
 170         hci_dev_lock(hdev);
 171
 172         /* Check that the hci_conn is still around */
 173         rcu_read_lock();
 174         list_for_each_entry_rcu(c, &hdev->conn_hash.list, list) {
 175                 if (c == conn)
 176                         break;
 177         }
 178         rcu_read_unlock();
 179
 180         if (c == conn) {
 181                 hci_connect_le_scan_cleanup(conn);
 182                 hci_conn_cleanup(conn);
 183         }
 184
 185         hci_dev_unlock(hdev);
 186         hci_dev_put(hdev);
 187         hci_conn_put(conn);
 188 }
 189
 190 static void hci_connect_le_scan_remove(struct hci_conn *conn)
 191 {
 192         BT_DBG("%s hcon %p", conn->hdev->name, conn);
 193
 194         /* We can't call hci_conn_del/hci_conn_cleanup here since that
 195          * could deadlock with another hci_conn_del() call that's holding
 196          * hci_dev_lock and doing cancel_delayed_work_sync(&conn->disc_work).
 197          * Instead, grab temporary extra references to the hci_dev and
 198          * hci_conn and perform the necessary cleanup in a separate work
 199          * callback.
 200          */
 201
 202         hci_dev_hold(conn->hdev);
 203         hci_conn_get(conn);
 204
 205         /* Even though we hold a reference to the hdev, many other
 206          * things might get cleaned up meanwhile, including the hdev's
 207          * own workqueue, so we can't use that for scheduling.
 208          */
 209         schedule_work(&conn->le_scan_cleanup);
 210 }
 211
 212 static void hci_acl_create_connection(struct hci_conn *conn)
 213 {
 214         struct hci_dev *hdev = conn->hdev;
 215         struct inquiry_entry *ie;
 216         struct hci_cp_create_conn cp;
 217
 218         BT_DBG("hcon %p", conn);
 219
 220         /* Many controllers disallow HCI Create Connection while it is doing
 221          * HCI Inquiry. So we cancel the Inquiry first before issuing HCI Create
 222          * Connection. This may cause the MGMT discovering state to become false
 223          * without user space's request but it is okay since the MGMT Discovery
 224          * APIs do not promise that discovery should be done forever. Instead,
 225          * the user space monitors the status of MGMT discovering and it may
 226          * request for discovery again when this flag becomes false.
 227          */
 228         if (test_bit(HCI_INQUIRY, &hdev->flags)) {
 229                 /* Put this connection to "pending" state so that it will be
 230                  * executed after the inquiry cancel command complete event.
 231                  */
 232                 conn->state = BT_CONNECT2;
 233                 hci_send_cmd(hdev, HCI_OP_INQUIRY_CANCEL, 0, NULL);
 234                 return;
 235         }
 236
 237         conn->state = BT_CONNECT;
 238         conn->out = true;
 239         conn->role = HCI_ROLE_MASTER;
 240
 241         conn->attempt++;
 242
 243         conn->link_policy = hdev->link_policy;
 244
 245         memset(&cp, 0, sizeof(cp));
 246         bacpy(&cp.bdaddr, &conn->dst);
 247         cp.pscan_rep_mode = 0x02;
 248
 249         ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
 250         if (ie) {
 251                 if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
 252                         cp.pscan_rep_mode = ie->data.pscan_rep_mode;
 253                         cp.pscan_mode     = ie->data.pscan_mode;
 254                         cp.clock_offset   = ie->data.clock_offset |
 255                                             cpu_to_le16(0x8000);
 256                 }
 257
 258                 memcpy(conn->dev_class, ie->data.dev_class, 3);
 259         }
 260
 261         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 262         if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
 263                 cp.role_switch = 0x01;
 264         else
 265                 cp.role_switch = 0x00;
 266
 267         hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
 268 }
 269
 270 int hci_disconnect(struct hci_conn *conn, __u8 reason)
 271 {
 272         BT_DBG("hcon %p", conn);
 273
 274         /* When we are central of an established connection and it enters
 275          * the disconnect timeout, then go ahead and try to read the
 276          * current clock offset.  Processing of the result is done
 277          * within the event handling and hci_clock_offset_evt function.
 278          */
 279         if (conn->type == ACL_LINK && conn->role == HCI_ROLE_MASTER &&
 280             (conn->state == BT_CONNECTED || conn->state == BT_CONFIG)) {
 281                 struct hci_dev *hdev = conn->hdev;
 282                 struct hci_cp_read_clock_offset clkoff_cp;
 283
 284                 clkoff_cp.handle = cpu_to_le16(conn->handle);
 285                 hci_send_cmd(hdev, HCI_OP_READ_CLOCK_OFFSET, sizeof(clkoff_cp),
 286                              &clkoff_cp);
 287         }
 288
 289         return hci_abort_conn(conn, reason);
 290 }
 291
 292 static void hci_add_sco(struct hci_conn *conn, __u16 handle)
 293 {
 294         struct hci_dev *hdev = conn->hdev;
 295         struct hci_cp_add_sco cp;
 296
 297         BT_DBG("hcon %p", conn);
 298
 299         conn->state = BT_CONNECT;
 300         conn->out = true;
 301
 302         conn->attempt++;
 303
 304         cp.handle   = cpu_to_le16(handle);
 305         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 306
 307         hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
 308 }
 309
 310 static bool find_next_esco_param(struct hci_conn *conn,
 311                                  const struct sco_param *esco_param, int size)
 312 {
 313         for (; conn->attempt <= size; conn->attempt++) {
 314                 if (lmp_esco_2m_capable(conn->link) ||
 315                     (esco_param[conn->attempt - 1].pkt_type & ESCO_2EV3))
 316                         break;
 317                 BT_DBG("hcon %p skipped attempt %d, eSCO 2M not supported",
 318                        conn, conn->attempt);
 319         }
 320
 321         return conn->attempt <= size;
 322 }
 323
 324 static int configure_datapath_sync(struct hci_dev *hdev, struct bt_codec *codec)
 325 {
 326         int err;
 327         __u8 vnd_len, *vnd_data = NULL;
 328         struct hci_op_configure_data_path *cmd = NULL;
 329
 330         err = hdev->get_codec_config_data(hdev, ESCO_LINK, codec, &vnd_len,
 331                                           &vnd_data);
 332         if (err < 0)
 333                 goto error;
 334
 335         cmd = kzalloc(sizeof(*cmd) + vnd_len, GFP_KERNEL);
 336         if (!cmd) {
 337                 err = -ENOMEM;
 338                 goto error;
 339         }
 340
 341         err = hdev->get_data_path_id(hdev, &cmd->data_path_id);
 342         if (err < 0)
 343                 goto error;
 344
 345         cmd->vnd_len = vnd_len;
 346         memcpy(cmd->vnd_data, vnd_data, vnd_len);
 347
 348         cmd->direction = 0x00;
 349         __hci_cmd_sync_status(hdev, HCI_CONFIGURE_DATA_PATH,
 350                               sizeof(*cmd) + vnd_len, cmd, HCI_CMD_TIMEOUT);
 351
 352         cmd->direction = 0x01;
 353         err = __hci_cmd_sync_status(hdev, HCI_CONFIGURE_DATA_PATH,
 354                                     sizeof(*cmd) + vnd_len, cmd,
 355                                     HCI_CMD_TIMEOUT);
 356 error:
 357
 358         kfree(cmd);
 359         kfree(vnd_data);
 360         return err;
 361 }
 362
 363 static int hci_enhanced_setup_sync(struct hci_dev *hdev, void *data)
 364 {
 365         struct conn_handle_t *conn_handle = data;
 366         struct hci_conn *conn = conn_handle->conn;
 367         __u16 handle = conn_handle->handle;
 368         struct hci_cp_enhanced_setup_sync_conn cp;
 369         const struct sco_param *param;
 370
 371         kfree(conn_handle);
 372
 373         bt_dev_dbg(hdev, "hcon %p", conn);
 374
 375         /* for offload use case, codec needs to configured before opening SCO */
 376         if (conn->codec.data_path)
 377                 configure_datapath_sync(hdev, &conn->codec);
 378
 379         conn->state = BT_CONNECT;
 380         conn->out = true;
 381
 382         conn->attempt++;
 383
 384         memset(&cp, 0x00, sizeof(cp));
 385
 386         cp.handle   = cpu_to_le16(handle);
 387
 388         cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
 389         cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
 390
 391         switch (conn->codec.id) {
 392         case BT_CODEC_MSBC:
 393                 if (!find_next_esco_param(conn, esco_param_msbc,
 394                                           ARRAY_SIZE(esco_param_msbc)))
 395                         return -EINVAL;
 396
 397                 param = &esco_param_msbc[conn->attempt - 1];
 398                 cp.tx_coding_format.id = 0x05;
 399                 cp.rx_coding_format.id = 0x05;
 400                 cp.tx_codec_frame_size = __cpu_to_le16(60);
 401                 cp.rx_codec_frame_size = __cpu_to_le16(60);
 402                 cp.in_bandwidth = __cpu_to_le32(32000);
 403                 cp.out_bandwidth = __cpu_to_le32(32000);
 404                 cp.in_coding_format.id = 0x04;
 405                 cp.out_coding_format.id = 0x04;
 406                 cp.in_coded_data_size = __cpu_to_le16(16);
 407                 cp.out_coded_data_size = __cpu_to_le16(16);
 408                 cp.in_pcm_data_format = 2;
 409                 cp.out_pcm_data_format = 2;
 410                 cp.in_pcm_sample_payload_msb_pos = 0;
 411                 cp.out_pcm_sample_payload_msb_pos = 0;
 412                 cp.in_data_path = conn->codec.data_path;
 413                 cp.out_data_path = conn->codec.data_path;
 414                 cp.in_transport_unit_size = 1;
 415                 cp.out_transport_unit_size = 1;
 416                 break;
 417
 418         case BT_CODEC_TRANSPARENT:
 419                 if (!find_next_esco_param(conn, esco_param_msbc,
 420                                           ARRAY_SIZE(esco_param_msbc)))
 421                         return false;
 422                 param = &esco_param_msbc[conn->attempt - 1];
 423                 cp.tx_coding_format.id = 0x03;
 424                 cp.rx_coding_format.id = 0x03;
 425                 cp.tx_codec_frame_size = __cpu_to_le16(60);
 426                 cp.rx_codec_frame_size = __cpu_to_le16(60);
 427                 cp.in_bandwidth = __cpu_to_le32(0x1f40);
 428                 cp.out_bandwidth = __cpu_to_le32(0x1f40);
 429                 cp.in_coding_format.id = 0x03;
 430                 cp.out_coding_format.id = 0x03;
 431                 cp.in_coded_data_size = __cpu_to_le16(16);
 432                 cp.out_coded_data_size = __cpu_to_le16(16);
 433                 cp.in_pcm_data_format = 2;
 434                 cp.out_pcm_data_format = 2;
 435                 cp.in_pcm_sample_payload_msb_pos = 0;
 436                 cp.out_pcm_sample_payload_msb_pos = 0;
 437                 cp.in_data_path = conn->codec.data_path;
 438                 cp.out_data_path = conn->codec.data_path;
 439                 cp.in_transport_unit_size = 1;
 440                 cp.out_transport_unit_size = 1;
 441                 break;
 442
 443         case BT_CODEC_CVSD:
 444                 if (lmp_esco_capable(conn->link)) {
 445                         if (!find_next_esco_param(conn, esco_param_cvsd,
 446                                                   ARRAY_SIZE(esco_param_cvsd)))
 447                                 return -EINVAL;
 448                         param = &esco_param_cvsd[conn->attempt - 1];
 449                 } else {
 450                         if (conn->attempt > ARRAY_SIZE(sco_param_cvsd))
 451                                 return -EINVAL;
 452                         param = &sco_param_cvsd[conn->attempt - 1];
 453                 }
 454                 cp.tx_coding_format.id = 2;
 455                 cp.rx_coding_format.id = 2;
 456                 cp.tx_codec_frame_size = __cpu_to_le16(60);
 457                 cp.rx_codec_frame_size = __cpu_to_le16(60);
 458                 cp.in_bandwidth = __cpu_to_le32(16000);
 459                 cp.out_bandwidth = __cpu_to_le32(16000);
 460                 cp.in_coding_format.id = 4;
 461                 cp.out_coding_format.id = 4;
 462                 cp.in_coded_data_size = __cpu_to_le16(16);
 463                 cp.out_coded_data_size = __cpu_to_le16(16);
 464                 cp.in_pcm_data_format = 2;
 465                 cp.out_pcm_data_format = 2;
 466                 cp.in_pcm_sample_payload_msb_pos = 0;
 467                 cp.out_pcm_sample_payload_msb_pos = 0;
 468                 cp.in_data_path = conn->codec.data_path;
 469                 cp.out_data_path = conn->codec.data_path;
 470                 cp.in_transport_unit_size = 16;
 471                 cp.out_transport_unit_size = 16;
 472                 break;
 473         default:
 474                 return -EINVAL;
 475         }
 476
 477         cp.retrans_effort = param->retrans_effort;
 478         cp.pkt_type = __cpu_to_le16(param->pkt_type);
 479         cp.max_latency = __cpu_to_le16(param->max_latency);
 480
 481         if (hci_send_cmd(hdev, HCI_OP_ENHANCED_SETUP_SYNC_CONN, sizeof(cp), &cp) < 0)
 482                 return -EIO;
 483
 484         return 0;
 485 }
 486
 487 static bool hci_setup_sync_conn(struct hci_conn *conn, __u16 handle)
 488 {
 489         struct hci_dev *hdev = conn->hdev;
 490         struct hci_cp_setup_sync_conn cp;
 491         const struct sco_param *param;
 492
 493         bt_dev_dbg(hdev, "hcon %p", conn);
 494
 495         conn->state = BT_CONNECT;
 496         conn->out = true;
 497
 498         conn->attempt++;
 499
 500         cp.handle   = cpu_to_le16(handle);
 501
 502         cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
 503         cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
 504         cp.voice_setting  = cpu_to_le16(conn->setting);
 505
 506         switch (conn->setting & SCO_AIRMODE_MASK) {
 507         case SCO_AIRMODE_TRANSP:
 508                 if (!find_next_esco_param(conn, esco_param_msbc,
 509                                           ARRAY_SIZE(esco_param_msbc)))
 510                         return false;
 511                 param = &esco_param_msbc[conn->attempt - 1];
 512                 break;
 513         case SCO_AIRMODE_CVSD:
 514                 if (lmp_esco_capable(conn->link)) {
 515                         if (!find_next_esco_param(conn, esco_param_cvsd,
 516                                                   ARRAY_SIZE(esco_param_cvsd)))
 517                                 return false;
 518                         param = &esco_param_cvsd[conn->attempt - 1];
 519                 } else {
 520                         if (conn->attempt > ARRAY_SIZE(sco_param_cvsd))
 521                                 return false;
 522                         param = &sco_param_cvsd[conn->attempt - 1];
 523                 }
 524                 break;
 525         default:
 526                 return false;
 527         }
 528
 529         cp.retrans_effort = param->retrans_effort;
 530         cp.pkt_type = __cpu_to_le16(param->pkt_type);
 531         cp.max_latency = __cpu_to_le16(param->max_latency);
 532
 533         if (hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp) < 0)
 534                 return false;
 535
 536         return true;
 537 }
 538
 539 bool hci_setup_sync(struct hci_conn *conn, __u16 handle)
 540 {
 541         int result;
 542         struct conn_handle_t *conn_handle;
 543
 544         if (enhanced_sync_conn_capable(conn->hdev)) {
 545                 conn_handle = kzalloc(sizeof(*conn_handle), GFP_KERNEL);
 546
 547                 if (!conn_handle)
 548                         return false;
 549
 550                 conn_handle->conn = conn;
 551                 conn_handle->handle = handle;
 552                 result = hci_cmd_sync_queue(conn->hdev, hci_enhanced_setup_sync,
 553                                             conn_handle, NULL);
 554                 if (result < 0)
 555                         kfree(conn_handle);
 556
 557                 return result == 0;
 558         }
 559
 560         return hci_setup_sync_conn(conn, handle);
 561 }
 562
 563 u8 hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max, u16 latency,
 564                       u16 to_multiplier)
 565 {
 566         struct hci_dev *hdev = conn->hdev;
 567         struct hci_conn_params *params;
 568         struct hci_cp_le_conn_update cp;
 569
 570         hci_dev_lock(hdev);
 571
 572         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
 573         if (params) {
 574                 params->conn_min_interval = min;
 575                 params->conn_max_interval = max;
 576                 params->conn_latency = latency;
 577                 params->supervision_timeout = to_multiplier;
 578         }
 579
 580         hci_dev_unlock(hdev);
 581
 582         memset(&cp, 0, sizeof(cp));
 583         cp.handle               = cpu_to_le16(conn->handle);
 584         cp.conn_interval_min    = cpu_to_le16(min);
 585         cp.conn_interval_max    = cpu_to_le16(max);
 586         cp.conn_latency         = cpu_to_le16(latency);
 587         cp.supervision_timeout  = cpu_to_le16(to_multiplier);
 588         cp.min_ce_len           = cpu_to_le16(0x0000);
 589         cp.max_ce_len           = cpu_to_le16(0x0000);
 590
 591         hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp);
 592
 593         if (params)
 594                 return 0x01;
 595
 596         return 0x00;
 597 }
 598
 599 void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __le64 rand,
 600                       __u8 ltk[16], __u8 key_size)
 601 {
 602         struct hci_dev *hdev = conn->hdev;
 603         struct hci_cp_le_start_enc cp;
 604
 605         BT_DBG("hcon %p", conn);
 606
 607         memset(&cp, 0, sizeof(cp));
 608
 609         cp.handle = cpu_to_le16(conn->handle);
 610         cp.rand = rand;
 611         cp.ediv = ediv;
 612         memcpy(cp.ltk, ltk, key_size);
 613
 614         hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp);
 615 }
 616
 617 /* Device _must_ be locked */
 618 void hci_sco_setup(struct hci_conn *conn, __u8 status)
 619 {
 620         struct hci_conn *sco = conn->link;
 621
 622         if (!sco)
 623                 return;
 624
 625         BT_DBG("hcon %p", conn);
 626
 627         if (!status) {
 628                 if (lmp_esco_capable(conn->hdev))
 629                         hci_setup_sync(sco, conn->handle);
 630                 else
 631                         hci_add_sco(sco, conn->handle);
 632         } else {
 633                 hci_connect_cfm(sco, status);
 634                 hci_conn_del(sco);
 635         }
 636 }
 637
 638 static void hci_conn_timeout(struct work_struct *work)
 639 {
 640         struct hci_conn *conn = container_of(work, struct hci_conn,
 641                                              disc_work.work);
 642         int refcnt = atomic_read(&conn->refcnt);
 643
 644         BT_DBG("hcon %p state %s", conn, state_to_string(conn->state));
 645
 646         WARN_ON(refcnt < 0);
 647
 648         /* FIXME: It was observed that in pairing failed scenario, refcnt
 649          * drops below 0. Probably this is because l2cap_conn_del calls
 650          * l2cap_chan_del for each channel, and inside l2cap_chan_del conn is
 651          * dropped. After that loop hci_chan_del is called which also drops
 652          * conn. For now make sure that ACL is alive if refcnt is higher then 0,
 653          * otherwise drop it.
 654          */
 655         if (refcnt > 0)
 656                 return;
 657
 658         /* LE connections in scanning state need special handling */
 659         if (conn->state == BT_CONNECT && conn->type == LE_LINK &&
 660             test_bit(HCI_CONN_SCANNING, &conn->flags)) {
 661                 hci_connect_le_scan_remove(conn);
 662                 return;
 663         }
 664
 665         hci_abort_conn(conn, hci_proto_disconn_ind(conn));
 666 }
 667
 668 /* Enter sniff mode */
 669 static void hci_conn_idle(struct work_struct *work)
 670 {
 671         struct hci_conn *conn = container_of(work, struct hci_conn,
 672                                              idle_work.work);
 673         struct hci_dev *hdev = conn->hdev;
 674
 675         BT_DBG("hcon %p mode %d", conn, conn->mode);
 676
 677         if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn))
 678                 return;
 679
 680         if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF))
 681                 return;
 682
 683         if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
 684                 struct hci_cp_sniff_subrate cp;
 685                 cp.handle             = cpu_to_le16(conn->handle);
 686                 cp.max_latency        = cpu_to_le16(0);
 687                 cp.min_remote_timeout = cpu_to_le16(0);
 688                 cp.min_local_timeout  = cpu_to_le16(0);
 689                 hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
 690         }
 691
 692         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
 693                 struct hci_cp_sniff_mode cp;
 694                 cp.handle       = cpu_to_le16(conn->handle);
 695                 cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
 696                 cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
 697                 cp.attempt      = cpu_to_le16(4);
 698                 cp.timeout      = cpu_to_le16(1);
 699                 hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
 700         }
 701 }
 702
 703 static void hci_conn_auto_accept(struct work_struct *work)
 704 {
 705         struct hci_conn *conn = container_of(work, struct hci_conn,
 706                                              auto_accept_work.work);
 707
 708         hci_send_cmd(conn->hdev, HCI_OP_USER_CONFIRM_REPLY, sizeof(conn->dst),
 709                      &conn->dst);
 710 }
 711
 712 static void le_disable_advertising(struct hci_dev *hdev)
 713 {
 714         if (ext_adv_capable(hdev)) {
 715                 struct hci_cp_le_set_ext_adv_enable cp;
 716
 717                 cp.enable = 0x00;
 718                 cp.num_of_sets = 0x00;
 719
 720                 hci_send_cmd(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE, sizeof(cp),
 721                              &cp);
 722         } else {
 723                 u8 enable = 0x00;
 724                 hci_send_cmd(hdev, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable),
 725                              &enable);
 726         }
 727 }
 728
 729 static void le_conn_timeout(struct work_struct *work)
 730 {
 731         struct hci_conn *conn = container_of(work, struct hci_conn,
 732                                              le_conn_timeout.work);
 733         struct hci_dev *hdev = conn->hdev;
 734
 735         BT_DBG("");
 736
 737         /* We could end up here due to having done directed advertising,
 738          * so clean up the state if necessary. This should however only
 739          * happen with broken hardware or if low duty cycle was used
 740          * (which doesn't have a timeout of its own).
 741          */
 742         if (conn->role == HCI_ROLE_SLAVE) {
 743                 /* Disable LE Advertising */
 744                 le_disable_advertising(hdev);
 745                 hci_dev_lock(hdev);
 746                 hci_conn_failed(conn, HCI_ERROR_ADVERTISING_TIMEOUT);
 747                 hci_dev_unlock(hdev);
 748                 return;
 749         }
 750
 751         hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
 752 }
 753
 754 struct iso_list_data {
 755         union {
 756                 u8  cig;
 757                 u8  big;
 758         };
 759         union {
 760                 u8  cis;
 761                 u8  bis;
 762                 u16 sync_handle;
 763         };
 764         int count;
 765         struct {
 766                 struct hci_cp_le_set_cig_params cp;
 767                 struct hci_cis_params cis[0x11];
 768         } pdu;
 769 };
 770
 771 static void bis_list(struct hci_conn *conn, void *data)
 772 {
 773         struct iso_list_data *d = data;
 774
 775         /* Skip if not broadcast/ANY address */
 776         if (bacmp(&conn->dst, BDADDR_ANY))
 777                 return;
 778
 779         if (d->big != conn->iso_qos.big || d->bis == BT_ISO_QOS_BIS_UNSET ||
 780             d->bis != conn->iso_qos.bis)
 781                 return;
 782
 783         d->count++;
 784 }
 785
 786 static void find_bis(struct hci_conn *conn, void *data)
 787 {
 788         struct iso_list_data *d = data;
 789
 790         /* Ignore unicast */
 791         if (bacmp(&conn->dst, BDADDR_ANY))
 792                 return;
 793
 794         d->count++;
 795 }
 796
 797 static int terminate_big_sync(struct hci_dev *hdev, void *data)
 798 {
 799         struct iso_list_data *d = data;
 800
 801         bt_dev_dbg(hdev, "big 0x%2.2x bis 0x%2.2x", d->big, d->bis);
 802
 803         hci_remove_ext_adv_instance_sync(hdev, d->bis, NULL);
 804
 805         /* Check if ISO connection is a BIS and terminate BIG if there are
 806          * no other connections using it.
 807          */
 808         hci_conn_hash_list_state(hdev, find_bis, ISO_LINK, BT_CONNECTED, d);
 809         if (d->count)
 810                 return 0;
 811
 812         return hci_le_terminate_big_sync(hdev, d->big,
 813                                          HCI_ERROR_LOCAL_HOST_TERM);
 814 }
 815
 816 static void terminate_big_destroy(struct hci_dev *hdev, void *data, int err)
 817 {
 818         kfree(data);
 819 }
 820
 821 static int hci_le_terminate_big(struct hci_dev *hdev, u8 big, u8 bis)
 822 {
 823         struct iso_list_data *d;
 824
 825         bt_dev_dbg(hdev, "big 0x%2.2x bis 0x%2.2x", big, bis);
 826
 827         d = kmalloc(sizeof(*d), GFP_KERNEL);
 828         if (!d)
 829                 return -ENOMEM;
 830
 831         memset(d, 0, sizeof(*d));
 832         d->big = big;
 833         d->bis = bis;
 834
 835         return hci_cmd_sync_queue(hdev, terminate_big_sync, d,
 836                                   terminate_big_destroy);
 837 }
 838
 839 static int big_terminate_sync(struct hci_dev *hdev, void *data)
 840 {
 841         struct iso_list_data *d = data;
 842
 843         bt_dev_dbg(hdev, "big 0x%2.2x sync_handle 0x%4.4x", d->big,
 844                    d->sync_handle);
 845
 846         /* Check if ISO connection is a BIS and terminate BIG if there are
 847          * no other connections using it.
 848          */
 849         hci_conn_hash_list_state(hdev, find_bis, ISO_LINK, BT_CONNECTED, d);
 850         if (d->count)
 851                 return 0;
 852
 853         hci_le_big_terminate_sync(hdev, d->big);
 854
 855         return hci_le_pa_terminate_sync(hdev, d->sync_handle);
 856 }
 857
 858 static int hci_le_big_terminate(struct hci_dev *hdev, u8 big, u16 sync_handle)
 859 {
 860         struct iso_list_data *d;
 861
 862         bt_dev_dbg(hdev, "big 0x%2.2x sync_handle 0x%4.4x", big, sync_handle);
 863
 864         d = kmalloc(sizeof(*d), GFP_KERNEL);
 865         if (!d)
 866                 return -ENOMEM;
 867
 868         memset(d, 0, sizeof(*d));
 869         d->big = big;
 870         d->sync_handle = sync_handle;
 871
 872         return hci_cmd_sync_queue(hdev, big_terminate_sync, d,
 873                                   terminate_big_destroy);
 874 }
 875
 876 /* Cleanup BIS connection
 877  *
 878  * Detects if there any BIS left connected in a BIG
 879  * broadcaster: Remove advertising instance and terminate BIG.
 880  * broadcaster receiver: Teminate BIG sync and terminate PA sync.
 881  */
 882 static void bis_cleanup(struct hci_conn *conn)
 883 {
 884         struct hci_dev *hdev = conn->hdev;
 885
 886         bt_dev_dbg(hdev, "conn %p", conn);
 887
 888         if (conn->role == HCI_ROLE_MASTER) {
 889                 if (!test_and_clear_bit(HCI_CONN_PER_ADV, &conn->flags))
 890                         return;
 891
 892                 hci_le_terminate_big(hdev, conn->iso_qos.big,
 893                                      conn->iso_qos.bis);
 894         } else {
 895                 hci_le_big_terminate(hdev, conn->iso_qos.big,
 896                                      conn->sync_handle);
 897         }
 898 }
 899
 900 static int remove_cig_sync(struct hci_dev *hdev, void *data)
 901 {
 902         u8 handle = PTR_ERR(data);
 903
 904         return hci_le_remove_cig_sync(hdev, handle);
 905 }
 906
 907 static int hci_le_remove_cig(struct hci_dev *hdev, u8 handle)
 908 {
 909         bt_dev_dbg(hdev, "handle 0x%2.2x", handle);
 910
 911         return hci_cmd_sync_queue(hdev, remove_cig_sync, ERR_PTR(handle), NULL);
 912 }
 913
 914 static void find_cis(struct hci_conn *conn, void *data)
 915 {
 916         struct iso_list_data *d = data;
 917
 918         /* Ignore broadcast */
 919         if (!bacmp(&conn->dst, BDADDR_ANY))
 920                 return;
 921
 922         d->count++;
 923 }
 924
 925 /* Cleanup CIS connection:
 926  *
 927  * Detects if there any CIS left connected in a CIG and remove it.
 928  */
 929 static void cis_cleanup(struct hci_conn *conn)
 930 {
 931         struct hci_dev *hdev = conn->hdev;
 932         struct iso_list_data d;
 933
 934         memset(&d, 0, sizeof(d));
 935         d.cig = conn->iso_qos.cig;
 936
 937         /* Check if ISO connection is a CIS and remove CIG if there are
 938          * no other connections using it.
 939          */
 940         hci_conn_hash_list_state(hdev, find_cis, ISO_LINK, BT_CONNECTED, &d);
 941         if (d.count)
 942                 return;
 943
 944         hci_le_remove_cig(hdev, conn->iso_qos.cig);
 945 }
 946
 947 struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst,
 948                               u8 role)
 949 {
 950         struct hci_conn *conn;
 951
 952         BT_DBG("%s dst %pMR", hdev->name, dst);
 953
 954         conn = kzalloc(sizeof(*conn), GFP_KERNEL);
 955         if (!conn)
 956                 return NULL;
 957
 958         bacpy(&conn->dst, dst);
 959         bacpy(&conn->src, &hdev->bdaddr);
 960         conn->handle = HCI_CONN_HANDLE_UNSET;
 961         conn->hdev  = hdev;
 962         conn->type  = type;
 963         conn->role  = role;
 964         conn->mode  = HCI_CM_ACTIVE;
 965         conn->state = BT_OPEN;
 966         conn->auth_type = HCI_AT_GENERAL_BONDING;
 967         conn->io_capability = hdev->io_capability;
 968         conn->remote_auth = 0xff;
 969         conn->key_type = 0xff;
 970         conn->rssi = HCI_RSSI_INVALID;
 971         conn->tx_power = HCI_TX_POWER_INVALID;
 972         conn->max_tx_power = HCI_TX_POWER_INVALID;
 973
 974         set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
 975         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
 976
 977         /* Set Default Authenticated payload timeout to 30s */
 978         conn->auth_payload_timeout = DEFAULT_AUTH_PAYLOAD_TIMEOUT;
 979
 980         if (conn->role == HCI_ROLE_MASTER)
 981                 conn->out = true;
 982
 983         switch (type) {
 984         case ACL_LINK:
 985                 conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
 986                 break;
 987         case LE_LINK:
 988                 /* conn->src should reflect the local identity address */
 989                 hci_copy_identity_address(hdev, &conn->src, &conn->src_type);
 990                 break;
 991         case ISO_LINK:
 992                 /* conn->src should reflect the local identity address */
 993                 hci_copy_identity_address(hdev, &conn->src, &conn->src_type);
 994
 995                 /* set proper cleanup function */
 996                 if (!bacmp(dst, BDADDR_ANY))
 997                         conn->cleanup = bis_cleanup;
 998                 else if (conn->role == HCI_ROLE_MASTER)
 999                         conn->cleanup = cis_cleanup;
1000
1001                 break;
1002         case SCO_LINK:
1003                 if (lmp_esco_capable(hdev))
1004                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
1005                                         (hdev->esco_type & EDR_ESCO_MASK);
1006                 else
1007                         conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
1008                 break;
1009         case ESCO_LINK:
1010                 conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
1011                 break;
1012         }
1013
1014         skb_queue_head_init(&conn->data_q);
1015
1016         INIT_LIST_HEAD(&conn->chan_list);
1017
1018         INIT_DELAYED_WORK(&conn->disc_work, hci_conn_timeout);
1019         INIT_DELAYED_WORK(&conn->auto_accept_work, hci_conn_auto_accept);
1020         INIT_DELAYED_WORK(&conn->idle_work, hci_conn_idle);
1021         INIT_DELAYED_WORK(&conn->le_conn_timeout, le_conn_timeout);
1022         INIT_WORK(&conn->le_scan_cleanup, le_scan_cleanup);
1023
1024         atomic_set(&conn->refcnt, 0);
1025
1026         hci_dev_hold(hdev);
1027
1028         hci_conn_hash_add(hdev, conn);
1029
1030         /* The SCO and eSCO connections will only be notified when their
1031          * setup has been completed. This is different to ACL links which
1032          * can be notified right away.
1033          */
1034         if (conn->type != SCO_LINK && conn->type != ESCO_LINK) {
1035                 if (hdev->notify)
1036                         hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
1037         }
1038
1039         hci_conn_init_sysfs(conn);
1040
1041         return conn;
1042 }
1043
1044 int hci_conn_del(struct hci_conn *conn)
1045 {
1046         struct hci_dev *hdev = conn->hdev;
1047
1048         BT_DBG("%s hcon %p handle %d", hdev->name, conn, conn->handle);
1049
1050         cancel_delayed_work_sync(&conn->disc_work);
1051         cancel_delayed_work_sync(&conn->auto_accept_work);
1052         cancel_delayed_work_sync(&conn->idle_work);
1053
1054         if (conn->type == ACL_LINK) {
1055                 struct hci_conn *sco = conn->link;
1056                 if (sco)
1057                         sco->link = NULL;
1058
1059                 /* Unacked frames */
1060                 hdev->acl_cnt += conn->sent;
1061         } else if (conn->type == LE_LINK) {
1062                 cancel_delayed_work(&conn->le_conn_timeout);
1063
1064                 if (hdev->le_pkts)
1065                         hdev->le_cnt += conn->sent;
1066                 else
1067                         hdev->acl_cnt += conn->sent;
1068         } else {
1069                 struct hci_conn *acl = conn->link;
1070
1071                 if (acl) {
1072                         acl->link = NULL;
1073                         hci_conn_drop(acl);
1074                 }
1075
1076                 /* Unacked ISO frames */
1077                 if (conn->type == ISO_LINK) {
1078                         if (hdev->iso_pkts)
1079                                 hdev->iso_cnt += conn->sent;
1080                         else if (hdev->le_pkts)
1081                                 hdev->le_cnt += conn->sent;
1082                         else
1083                                 hdev->acl_cnt += conn->sent;
1084                 }
1085         }
1086
1087         if (conn->amp_mgr)
1088                 amp_mgr_put(conn->amp_mgr);
1089
1090         skb_queue_purge(&conn->data_q);
1091
1092         /* Remove the connection from the list and cleanup its remaining
1093          * state. This is a separate function since for some cases like
1094          * BT_CONNECT_SCAN we *only* want the cleanup part without the
1095          * rest of hci_conn_del.
1096          */
1097         hci_conn_cleanup(conn);
1098
1099         return 0;
1100 }
1101
1102 struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src, uint8_t src_type)
1103 {
1104         int use_src = bacmp(src, BDADDR_ANY);
1105         struct hci_dev *hdev = NULL, *d;
1106
1107         BT_DBG("%pMR -> %pMR", src, dst);
1108
1109         read_lock(&hci_dev_list_lock);
1110
1111         list_for_each_entry(d, &hci_dev_list, list) {
1112                 if (!test_bit(HCI_UP, &d->flags) ||
1113                     hci_dev_test_flag(d, HCI_USER_CHANNEL) ||
1114                     d->dev_type != HCI_PRIMARY)
1115                         continue;
1116
1117                 /* Simple routing:
1118                  *   No source address - find interface with bdaddr != dst
1119                  *   Source address    - find interface with bdaddr == src
1120                  */
1121
1122                 if (use_src) {
1123                         bdaddr_t id_addr;
1124                         u8 id_addr_type;
1125
1126                         if (src_type == BDADDR_BREDR) {
1127                                 if (!lmp_bredr_capable(d))
1128                                         continue;
1129                                 bacpy(&id_addr, &d->bdaddr);
1130                                 id_addr_type = BDADDR_BREDR;
1131                         } else {
1132                                 if (!lmp_le_capable(d))
1133                                         continue;
1134
1135                                 hci_copy_identity_address(d, &id_addr,
1136                                                           &id_addr_type);
1137
1138                                 /* Convert from HCI to three-value type */
1139                                 if (id_addr_type == ADDR_LE_DEV_PUBLIC)
1140                                         id_addr_type = BDADDR_LE_PUBLIC;
1141                                 else
1142                                         id_addr_type = BDADDR_LE_RANDOM;
1143                         }
1144
1145                         if (!bacmp(&id_addr, src) && id_addr_type == src_type) {
1146                                 hdev = d; break;
1147                         }
1148                 } else {
1149                         if (bacmp(&d->bdaddr, dst)) {
1150                                 hdev = d; break;
1151                         }
1152                 }
1153         }
1154
1155         if (hdev)
1156                 hdev = hci_dev_hold(hdev);
1157
1158         read_unlock(&hci_dev_list_lock);
1159         return hdev;
1160 }
1161 EXPORT_SYMBOL(hci_get_route);
1162
1163 /* This function requires the caller holds hdev->lock */
1164 static void hci_le_conn_failed(struct hci_conn *conn, u8 status)
1165 {
1166         struct hci_dev *hdev = conn->hdev;
1167         struct hci_conn_params *params;
1168
1169         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
1170                                            conn->dst_type);
1171         if (params && params->conn) {
1172                 hci_conn_drop(params->conn);
1173                 hci_conn_put(params->conn);
1174                 params->conn = NULL;
1175         }
1176
1177         /* If the status indicates successful cancellation of
1178          * the attempt (i.e. Unknown Connection Id) there's no point of
1179          * notifying failure since we'll go back to keep trying to
1180          * connect. The only exception is explicit connect requests
1181          * where a timeout + cancel does indicate an actual failure.
1182          */
1183         if (status != HCI_ERROR_UNKNOWN_CONN_ID ||
1184             (params && params->explicit_connect))
1185                 mgmt_connect_failed(hdev, &conn->dst, conn->type,
1186                                     conn->dst_type, status);
1187
1188         /* Since we may have temporarily stopped the background scanning in
1189          * favor of connection establishment, we should restart it.
1190          */
1191         hci_update_passive_scan(hdev);
1192
1193         /* Enable advertising in case this was a failed connection
1194          * attempt as a peripheral.
1195          */
1196         hci_enable_advertising(hdev);
1197 }
1198
1199 /* This function requires the caller holds hdev->lock */
1200 void hci_conn_failed(struct hci_conn *conn, u8 status)
1201 {
1202         struct hci_dev *hdev = conn->hdev;
1203
1204         bt_dev_dbg(hdev, "status 0x%2.2x", status);
1205
1206         switch (conn->type) {
1207         case LE_LINK:
1208                 hci_le_conn_failed(conn, status);
1209                 break;
1210         case ACL_LINK:
1211                 mgmt_connect_failed(hdev, &conn->dst, conn->type,
1212                                     conn->dst_type, status);
1213                 break;
1214         }
1215
1216         conn->state = BT_CLOSED;
1217         hci_connect_cfm(conn, status);
1218         hci_conn_del(conn);
1219 }
1220
1221 static void create_le_conn_complete(struct hci_dev *hdev, void *data, int err)
1222 {
1223         struct hci_conn *conn = data;
1224
1225         hci_dev_lock(hdev);
1226
1227         if (!err) {
1228                 hci_connect_le_scan_cleanup(conn);
1229                 goto done;
1230         }
1231
1232         bt_dev_err(hdev, "request failed to create LE connection: err %d", err);
1233
1234         /* Check if connection is still pending */
1235         if (conn != hci_lookup_le_connect(hdev))
1236                 goto done;
1237
1238         hci_conn_failed(conn, bt_status(err));
1239
1240 done:
1241         hci_dev_unlock(hdev);
1242 }
1243
1244 static int hci_connect_le_sync(struct hci_dev *hdev, void *data)
1245 {
1246         struct hci_conn *conn = data;
1247
1248         bt_dev_dbg(hdev, "conn %p", conn);
1249
1250         return hci_le_create_conn_sync(hdev, conn);
1251 }
1252
1253 struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,
1254                                 u8 dst_type, bool dst_resolved, u8 sec_level,
1255                                 u16 conn_timeout, u8 role)
1256 {
1257         struct hci_conn *conn;
1258         struct smp_irk *irk;
1259         int err;
1260
1261         /* Let's make sure that le is enabled.*/
1262         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1263                 if (lmp_le_capable(hdev))
1264                         return ERR_PTR(-ECONNREFUSED);
1265
1266                 return ERR_PTR(-EOPNOTSUPP);
1267         }
1268
1269         /* Since the controller supports only one LE connection attempt at a
1270          * time, we return -EBUSY if there is any connection attempt running.
1271          */
1272         if (hci_lookup_le_connect(hdev))
1273                 return ERR_PTR(-EBUSY);
1274
1275         /* If there's already a connection object but it's not in
1276          * scanning state it means it must already be established, in
1277          * which case we can't do anything else except report a failure
1278          * to connect.
1279          */
1280         conn = hci_conn_hash_lookup_le(hdev, dst, dst_type);
1281         if (conn && !test_bit(HCI_CONN_SCANNING, &conn->flags)) {
1282                 return ERR_PTR(-EBUSY);
1283         }
1284
1285         /* Check if the destination address has been resolved by the controller
1286          * since if it did then the identity address shall be used.
1287          */
1288         if (!dst_resolved) {
1289                 /* When given an identity address with existing identity
1290                  * resolving key, the connection needs to be established
1291                  * to a resolvable random address.
1292                  *
1293                  * Storing the resolvable random address is required here
1294                  * to handle connection failures. The address will later
1295                  * be resolved back into the original identity address
1296                  * from the connect request.
1297                  */
1298                 irk = hci_find_irk_by_addr(hdev, dst, dst_type);
1299                 if (irk && bacmp(&irk->rpa, BDADDR_ANY)) {
1300                         dst = &irk->rpa;
1301                         dst_type = ADDR_LE_DEV_RANDOM;
1302                 }
1303         }
1304
1305         if (conn) {
1306                 bacpy(&conn->dst, dst);
1307         } else {
1308                 conn = hci_conn_add(hdev, LE_LINK, dst, role);
1309                 if (!conn)
1310                         return ERR_PTR(-ENOMEM);
1311                 hci_conn_hold(conn);
1312                 conn->pending_sec_level = sec_level;
1313         }
1314
1315         conn->dst_type = dst_type;
1316         conn->sec_level = BT_SECURITY_LOW;
1317         conn->conn_timeout = conn_timeout;
1318
1319         conn->state = BT_CONNECT;
1320         clear_bit(HCI_CONN_SCANNING, &conn->flags);
1321
1322         err = hci_cmd_sync_queue(hdev, hci_connect_le_sync, conn,
1323                                  create_le_conn_complete);
1324         if (err) {
1325                 hci_conn_del(conn);
1326                 return ERR_PTR(err);
1327         }
1328
1329         return conn;
1330 }
1331
1332 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
1333 {
1334         struct hci_conn *conn;
1335
1336         conn = hci_conn_hash_lookup_le(hdev, addr, type);
1337         if (!conn)
1338                 return false;
1339
1340         if (conn->state != BT_CONNECTED)
1341                 return false;
1342
1343         return true;
1344 }
1345
1346 /* This function requires the caller holds hdev->lock */
1347 static int hci_explicit_conn_params_set(struct hci_dev *hdev,
1348                                         bdaddr_t *addr, u8 addr_type)
1349 {
1350         struct hci_conn_params *params;
1351
1352         if (is_connected(hdev, addr, addr_type))
1353                 return -EISCONN;
1354
1355         params = hci_conn_params_lookup(hdev, addr, addr_type);
1356         if (!params) {
1357                 params = hci_conn_params_add(hdev, addr, addr_type);
1358                 if (!params)
1359                         return -ENOMEM;
1360
1361                 /* If we created new params, mark them to be deleted in
1362                  * hci_connect_le_scan_cleanup. It's different case than
1363                  * existing disabled params, those will stay after cleanup.
1364                  */
1365                 params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
1366         }
1367
1368         /* We're trying to connect, so make sure params are at pend_le_conns */
1369         if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
1370             params->auto_connect == HCI_AUTO_CONN_REPORT ||
1371             params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
1372                 list_del_init(&params->action);
1373                 list_add(&params->action, &hdev->pend_le_conns);
1374         }
1375
1376         params->explicit_connect = true;
1377
1378         BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
1379                params->auto_connect);
1380
1381         return 0;
1382 }
1383
1384 static int qos_set_big(struct hci_dev *hdev, struct bt_iso_qos *qos)
1385 {
1386         struct iso_list_data data;
1387
1388         /* Allocate a BIG if not set */
1389         if (qos->big == BT_ISO_QOS_BIG_UNSET) {
1390                 for (data.big = 0x00; data.big < 0xef; data.big++) {
1391                         data.count = 0;
1392                         data.bis = 0xff;
1393
1394                         hci_conn_hash_list_state(hdev, bis_list, ISO_LINK,
1395                                                  BT_BOUND, &data);
1396                         if (!data.count)
1397                                 break;
1398                 }
1399
1400                 if (data.big == 0xef)
1401                         return -EADDRNOTAVAIL;
1402
1403                 /* Update BIG */
1404                 qos->big = data.big;
1405         }
1406
1407         return 0;
1408 }
1409
1410 static int qos_set_bis(struct hci_dev *hdev, struct bt_iso_qos *qos)
1411 {
1412         struct iso_list_data data;
1413
1414         /* Allocate BIS if not set */
1415         if (qos->bis == BT_ISO_QOS_BIS_UNSET) {
1416                 /* Find an unused adv set to advertise BIS, skip instance 0x00
1417                  * since it is reserved as general purpose set.
1418                  */
1419                 for (data.bis = 0x01; data.bis < hdev->le_num_of_adv_sets;
1420                      data.bis++) {
1421                         data.count = 0;
1422
1423                         hci_conn_hash_list_state(hdev, bis_list, ISO_LINK,
1424                                                  BT_BOUND, &data);
1425                         if (!data.count)
1426                                 break;
1427                 }
1428
1429                 if (data.bis == hdev->le_num_of_adv_sets)
1430                         return -EADDRNOTAVAIL;
1431
1432                 /* Update BIS */
1433                 qos->bis = data.bis;
1434         }
1435
1436         return 0;
1437 }
1438
1439 /* This function requires the caller holds hdev->lock */
1440 static struct hci_conn *hci_add_bis(struct hci_dev *hdev, bdaddr_t *dst,
1441                                     struct bt_iso_qos *qos)
1442 {
1443         struct hci_conn *conn;
1444         struct iso_list_data data;
1445         int err;
1446
1447         /* Let's make sure that le is enabled.*/
1448         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1449                 if (lmp_le_capable(hdev))
1450                         return ERR_PTR(-ECONNREFUSED);
1451                 return ERR_PTR(-EOPNOTSUPP);
1452         }
1453
1454         err = qos_set_big(hdev, qos);
1455         if (err)
1456                 return ERR_PTR(err);
1457
1458         err = qos_set_bis(hdev, qos);
1459         if (err)
1460                 return ERR_PTR(err);
1461
1462         data.big = qos->big;
1463         data.bis = qos->bis;
1464         data.count = 0;
1465
1466         /* Check if there is already a matching BIG/BIS */
1467         hci_conn_hash_list_state(hdev, bis_list, ISO_LINK, BT_BOUND, &data);
1468         if (data.count)
1469                 return ERR_PTR(-EADDRINUSE);
1470
1471         conn = hci_conn_hash_lookup_bis(hdev, dst, qos->big, qos->bis);
1472         if (conn)
1473                 return ERR_PTR(-EADDRINUSE);
1474
1475         conn = hci_conn_add(hdev, ISO_LINK, dst, HCI_ROLE_MASTER);
1476         if (!conn)
1477                 return ERR_PTR(-ENOMEM);
1478
1479         set_bit(HCI_CONN_PER_ADV, &conn->flags);
1480         conn->state = BT_CONNECT;
1481
1482         hci_conn_hold(conn);
1483         return conn;
1484 }
1485
1486 /* This function requires the caller holds hdev->lock */
1487 struct hci_conn *hci_connect_le_scan(struct hci_dev *hdev, bdaddr_t *dst,
1488                                      u8 dst_type, u8 sec_level,
1489                                      u16 conn_timeout,
1490                                      enum conn_reasons conn_reason)
1491 {
1492         struct hci_conn *conn;
1493
1494         /* Let's make sure that le is enabled.*/
1495         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1496                 if (lmp_le_capable(hdev))
1497                         return ERR_PTR(-ECONNREFUSED);
1498
1499                 return ERR_PTR(-EOPNOTSUPP);
1500         }
1501
1502         /* Some devices send ATT messages as soon as the physical link is
1503          * established. To be able to handle these ATT messages, the user-
1504          * space first establishes the connection and then starts the pairing
1505          * process.
1506          *
1507          * So if a hci_conn object already exists for the following connection
1508          * attempt, we simply update pending_sec_level and auth_type fields
1509          * and return the object found.
1510          */
1511         conn = hci_conn_hash_lookup_le(hdev, dst, dst_type);
1512         if (conn) {
1513                 if (conn->pending_sec_level < sec_level)
1514                         conn->pending_sec_level = sec_level;
1515                 goto done;
1516         }
1517
1518         BT_DBG("requesting refresh of dst_addr");
1519
1520         conn = hci_conn_add(hdev, LE_LINK, dst, HCI_ROLE_MASTER);
1521         if (!conn)
1522                 return ERR_PTR(-ENOMEM);
1523
1524         if (hci_explicit_conn_params_set(hdev, dst, dst_type) < 0) {
1525                 hci_conn_del(conn);
1526                 return ERR_PTR(-EBUSY);
1527         }
1528
1529         conn->state = BT_CONNECT;
1530         set_bit(HCI_CONN_SCANNING, &conn->flags);
1531         conn->dst_type = dst_type;
1532         conn->sec_level = BT_SECURITY_LOW;
1533         conn->pending_sec_level = sec_level;
1534         conn->conn_timeout = conn_timeout;
1535         conn->conn_reason = conn_reason;
1536
1537         hci_update_passive_scan(hdev);
1538
1539 done:
1540         hci_conn_hold(conn);
1541         return conn;
1542 }
1543
1544 struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst,
1545                                  u8 sec_level, u8 auth_type,
1546                                  enum conn_reasons conn_reason)
1547 {
1548         struct hci_conn *acl;
1549
1550         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1551                 if (lmp_bredr_capable(hdev))
1552                         return ERR_PTR(-ECONNREFUSED);
1553
1554                 return ERR_PTR(-EOPNOTSUPP);
1555         }
1556
1557         acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
1558         if (!acl) {
1559                 acl = hci_conn_add(hdev, ACL_LINK, dst, HCI_ROLE_MASTER);
1560                 if (!acl)
1561                         return ERR_PTR(-ENOMEM);
1562         }
1563
1564         hci_conn_hold(acl);
1565
1566         acl->conn_reason = conn_reason;
1567         if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
1568                 acl->sec_level = BT_SECURITY_LOW;
1569                 acl->pending_sec_level = sec_level;
1570                 acl->auth_type = auth_type;
1571                 hci_acl_create_connection(acl);
1572         }
1573
1574         return acl;
1575 }
1576
1577 struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type, bdaddr_t *dst,
1578                                  __u16 setting, struct bt_codec *codec)
1579 {
1580         struct hci_conn *acl;
1581         struct hci_conn *sco;
1582
1583         acl = hci_connect_acl(hdev, dst, BT_SECURITY_LOW, HCI_AT_NO_BONDING,
1584                               CONN_REASON_SCO_CONNECT);
1585         if (IS_ERR(acl))
1586                 return acl;
1587
1588         sco = hci_conn_hash_lookup_ba(hdev, type, dst);
1589         if (!sco) {
1590                 sco = hci_conn_add(hdev, type, dst, HCI_ROLE_MASTER);
1591                 if (!sco) {
1592                         hci_conn_drop(acl);
1593                         return ERR_PTR(-ENOMEM);
1594                 }
1595         }
1596
1597         acl->link = sco;
1598         sco->link = acl;
1599
1600         hci_conn_hold(sco);
1601
1602         sco->setting = setting;
1603         sco->codec = *codec;
1604
1605         if (acl->state == BT_CONNECTED &&
1606             (sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
1607                 set_bit(HCI_CONN_POWER_SAVE, &acl->flags);
1608                 hci_conn_enter_active_mode(acl, BT_POWER_FORCE_ACTIVE_ON);
1609
1610                 if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->flags)) {
1611                         /* defer SCO setup until mode change completed */
1612                         set_bit(HCI_CONN_SCO_SETUP_PEND, &acl->flags);
1613                         return sco;
1614                 }
1615
1616                 hci_sco_setup(acl, 0x00);
1617         }
1618
1619         return sco;
1620 }
1621
1622 static void cis_add(struct iso_list_data *d, struct bt_iso_qos *qos)
1623 {
1624         struct hci_cis_params *cis = &d->pdu.cis[d->pdu.cp.num_cis];
1625
1626         cis->cis_id = qos->cis;
1627         cis->c_sdu  = cpu_to_le16(qos->out.sdu);
1628         cis->p_sdu  = cpu_to_le16(qos->in.sdu);
1629         cis->c_phy  = qos->out.phy ? qos->out.phy : qos->in.phy;
1630         cis->p_phy  = qos->in.phy ? qos->in.phy : qos->out.phy;
1631         cis->c_rtn  = qos->out.rtn;
1632         cis->p_rtn  = qos->in.rtn;
1633
1634         d->pdu.cp.num_cis++;
1635 }
1636
1637 static void cis_list(struct hci_conn *conn, void *data)
1638 {
1639         struct iso_list_data *d = data;
1640
1641         /* Skip if broadcast/ANY address */
1642         if (!bacmp(&conn->dst, BDADDR_ANY))
1643                 return;
1644
1645         if (d->cig != conn->iso_qos.cig || d->cis == BT_ISO_QOS_CIS_UNSET ||
1646             d->cis != conn->iso_qos.cis)
1647                 return;
1648
1649         d->count++;
1650
1651         if (d->pdu.cp.cig_id == BT_ISO_QOS_CIG_UNSET ||
1652             d->count >= ARRAY_SIZE(d->pdu.cis))
1653                 return;
1654
1655         cis_add(d, &conn->iso_qos);
1656 }
1657
1658 static int hci_le_create_big(struct hci_conn *conn, struct bt_iso_qos *qos)
1659 {
1660         struct hci_dev *hdev = conn->hdev;
1661         struct hci_cp_le_create_big cp;
1662
1663         memset(&cp, 0, sizeof(cp));
1664
1665         cp.handle = qos->big;
1666         cp.adv_handle = qos->bis;
1667         cp.num_bis  = 0x01;
1668         hci_cpu_to_le24(qos->out.interval, cp.bis.sdu_interval);
1669         cp.bis.sdu = cpu_to_le16(qos->out.sdu);
1670         cp.bis.latency =  cpu_to_le16(qos->out.latency);
1671         cp.bis.rtn  = qos->out.rtn;
1672         cp.bis.phy  = qos->out.phy;
1673         cp.bis.packing = qos->packing;
1674         cp.bis.framing = qos->framing;
1675         cp.bis.encryption = 0x00;
1676         memset(&cp.bis.bcode, 0, sizeof(cp.bis.bcode));
1677
1678         return hci_send_cmd(hdev, HCI_OP_LE_CREATE_BIG, sizeof(cp), &cp);
1679 }
1680
1681 static bool hci_le_set_cig_params(struct hci_conn *conn, struct bt_iso_qos *qos)
1682 {
1683         struct hci_dev *hdev = conn->hdev;
1684         struct iso_list_data data;
1685
1686         memset(&data, 0, sizeof(data));
1687
1688         /* Allocate a CIG if not set */
1689         if (qos->cig == BT_ISO_QOS_CIG_UNSET) {
1690                 for (data.cig = 0x00; data.cig < 0xff; data.cig++) {
1691                         data.count = 0;
1692                         data.cis = 0xff;
1693
1694                         hci_conn_hash_list_state(hdev, cis_list, ISO_LINK,
1695                                                  BT_BOUND, &data);
1696                         if (data.count)
1697                                 continue;
1698
1699                         hci_conn_hash_list_state(hdev, cis_list, ISO_LINK,
1700                                                  BT_CONNECTED, &data);
1701                         if (!data.count)
1702                                 break;
1703                 }
1704
1705                 if (data.cig == 0xff)
1706                         return false;
1707
1708                 /* Update CIG */
1709                 qos->cig = data.cig;
1710         }
1711
1712         data.pdu.cp.cig_id = qos->cig;
1713         hci_cpu_to_le24(qos->out.interval, data.pdu.cp.c_interval);
1714         hci_cpu_to_le24(qos->in.interval, data.pdu.cp.p_interval);
1715         data.pdu.cp.sca = qos->sca;
1716         data.pdu.cp.packing = qos->packing;
1717         data.pdu.cp.framing = qos->framing;
1718         data.pdu.cp.c_latency = cpu_to_le16(qos->out.latency);
1719         data.pdu.cp.p_latency = cpu_to_le16(qos->in.latency);
1720
1721         if (qos->cis != BT_ISO_QOS_CIS_UNSET) {
1722                 data.count = 0;
1723                 data.cig = qos->cig;
1724                 data.cis = qos->cis;
1725
1726                 hci_conn_hash_list_state(hdev, cis_list, ISO_LINK, BT_BOUND,
1727                                          &data);
1728                 if (data.count)
1729                         return false;
1730
1731                 cis_add(&data, qos);
1732         }
1733
1734         /* Reprogram all CIS(s) with the same CIG */
1735         for (data.cig = qos->cig, data.cis = 0x00; data.cis < 0x11;
1736              data.cis++) {
1737                 data.count = 0;
1738
1739                 hci_conn_hash_list_state(hdev, cis_list, ISO_LINK, BT_BOUND,
1740                                          &data);
1741                 if (data.count)
1742                         continue;
1743
1744                 /* Allocate a CIS if not set */
1745                 if (qos->cis == BT_ISO_QOS_CIS_UNSET) {
1746                         /* Update CIS */
1747                         qos->cis = data.cis;
1748                         cis_add(&data, qos);
1749                 }
1750         }
1751
1752         if (qos->cis == BT_ISO_QOS_CIS_UNSET || !data.pdu.cp.num_cis)
1753                 return false;
1754
1755         if (hci_send_cmd(hdev, HCI_OP_LE_SET_CIG_PARAMS,
1756                          sizeof(data.pdu.cp) +
1757                          (data.pdu.cp.num_cis * sizeof(*data.pdu.cis)),
1758                          &data.pdu) < 0)
1759                 return false;
1760
1761         return true;
1762 }
1763
1764 struct hci_conn *hci_bind_cis(struct hci_dev *hdev, bdaddr_t *dst,
1765                               __u8 dst_type, struct bt_iso_qos *qos)
1766 {
1767         struct hci_conn *cis;
1768
1769         cis = hci_conn_hash_lookup_cis(hdev, dst, dst_type);
1770         if (!cis) {
1771                 cis = hci_conn_add(hdev, ISO_LINK, dst, HCI_ROLE_MASTER);
1772                 if (!cis)
1773                         return ERR_PTR(-ENOMEM);
1774                 cis->cleanup = cis_cleanup;
1775                 cis->dst_type = dst_type;
1776         }
1777
1778         if (cis->state == BT_CONNECTED)
1779                 return cis;
1780
1781         /* Check if CIS has been set and the settings matches */
1782         if (cis->state == BT_BOUND &&
1783             !memcmp(&cis->iso_qos, qos, sizeof(*qos)))
1784                 return cis;
1785
1786         /* Update LINK PHYs according to QoS preference */
1787         cis->le_tx_phy = qos->out.phy;
1788         cis->le_rx_phy = qos->in.phy;
1789
1790         /* If output interval is not set use the input interval as it cannot be
1791          * 0x000000.
1792          */
1793         if (!qos->out.interval)
1794                 qos->out.interval = qos->in.interval;
1795
1796         /* If input interval is not set use the output interval as it cannot be
1797          * 0x000000.
1798          */
1799         if (!qos->in.interval)
1800                 qos->in.interval = qos->out.interval;
1801
1802         /* If output latency is not set use the input latency as it cannot be
1803          * 0x0000.
1804          */
1805         if (!qos->out.latency)
1806                 qos->out.latency = qos->in.latency;
1807
1808         /* If input latency is not set use the output latency as it cannot be
1809          * 0x0000.
1810          */
1811         if (!qos->in.latency)
1812                 qos->in.latency = qos->out.latency;
1813
1814         if (!hci_le_set_cig_params(cis, qos)) {
1815                 hci_conn_drop(cis);
1816                 return ERR_PTR(-EINVAL);
1817         }
1818
1819         cis->iso_qos = *qos;
1820         cis->state = BT_BOUND;
1821
1822         return cis;
1823 }
1824
1825 bool hci_iso_setup_path(struct hci_conn *conn)
1826 {
1827         struct hci_dev *hdev = conn->hdev;
1828         struct hci_cp_le_setup_iso_path cmd;
1829
1830         memset(&cmd, 0, sizeof(cmd));
1831
1832         if (conn->iso_qos.out.sdu) {
1833                 cmd.handle = cpu_to_le16(conn->handle);
1834                 cmd.direction = 0x00; /* Input (Host to Controller) */
1835                 cmd.path = 0x00; /* HCI path if enabled */
1836                 cmd.codec = 0x03; /* Transparent Data */
1837
1838                 if (hci_send_cmd(hdev, HCI_OP_LE_SETUP_ISO_PATH, sizeof(cmd),
1839                                  &cmd) < 0)
1840                         return false;
1841         }
1842
1843         if (conn->iso_qos.in.sdu) {
1844                 cmd.handle = cpu_to_le16(conn->handle);
1845                 cmd.direction = 0x01; /* Output (Controller to Host) */
1846                 cmd.path = 0x00; /* HCI path if enabled */
1847                 cmd.codec = 0x03; /* Transparent Data */
1848
1849                 if (hci_send_cmd(hdev, HCI_OP_LE_SETUP_ISO_PATH, sizeof(cmd),
1850                                  &cmd) < 0)
1851                         return false;
1852         }
1853
1854         return true;
1855 }
1856
1857 static int hci_create_cis_sync(struct hci_dev *hdev, void *data)
1858 {
1859         struct {
1860                 struct hci_cp_le_create_cis cp;
1861                 struct hci_cis cis[0x1f];
1862         } cmd;
1863         struct hci_conn *conn = data;
1864         u8 cig;
1865
1866         memset(&cmd, 0, sizeof(cmd));
1867         cmd.cis[0].acl_handle = cpu_to_le16(conn->link->handle);
1868         cmd.cis[0].cis_handle = cpu_to_le16(conn->handle);
1869         cmd.cp.num_cis++;
1870         cig = conn->iso_qos.cig;
1871
1872         hci_dev_lock(hdev);
1873
1874         rcu_read_lock();
1875
1876         list_for_each_entry_rcu(conn, &hdev->conn_hash.list, list) {
1877                 struct hci_cis *cis = &cmd.cis[cmd.cp.num_cis];
1878
1879                 if (conn == data || conn->type != ISO_LINK ||
1880                     conn->state == BT_CONNECTED || conn->iso_qos.cig != cig)
1881                         continue;
1882
1883                 /* Check if all CIS(s) belonging to a CIG are ready */
1884                 if (conn->link->state != BT_CONNECTED ||
1885                     conn->state != BT_CONNECT) {
1886                         cmd.cp.num_cis = 0;
1887                         break;
1888                 }
1889
1890                 /* Group all CIS with state BT_CONNECT since the spec don't
1891                  * allow to send them individually:
1892                  *
1893                  * BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 4, Part E
1894                  * page 2566:
1895                  *
1896                  * If the Host issues this command before all the
1897                  * HCI_LE_CIS_Established events from the previous use of the
1898                  * command have been generated, the Controller shall return the
1899                  * error code Command Disallowed (0x0C).
1900                  */
1901                 cis->acl_handle = cpu_to_le16(conn->link->handle);
1902                 cis->cis_handle = cpu_to_le16(conn->handle);
1903                 cmd.cp.num_cis++;
1904         }
1905
1906         rcu_read_unlock();
1907
1908         hci_dev_unlock(hdev);
1909
1910         if (!cmd.cp.num_cis)
1911                 return 0;
1912
1913         return hci_send_cmd(hdev, HCI_OP_LE_CREATE_CIS, sizeof(cmd.cp) +
1914                             sizeof(cmd.cis[0]) * cmd.cp.num_cis, &cmd);
1915 }
1916
1917 int hci_le_create_cis(struct hci_conn *conn)
1918 {
1919         struct hci_conn *cis;
1920         struct hci_dev *hdev = conn->hdev;
1921         int err;
1922
1923         switch (conn->type) {
1924         case LE_LINK:
1925                 if (!conn->link || conn->state != BT_CONNECTED)
1926                         return -EINVAL;
1927                 cis = conn->link;
1928                 break;
1929         case ISO_LINK:
1930                 cis = conn;
1931                 break;
1932         default:
1933                 return -EINVAL;
1934         }
1935
1936         if (cis->state == BT_CONNECT)
1937                 return 0;
1938
1939         /* Queue Create CIS */
1940         err = hci_cmd_sync_queue(hdev, hci_create_cis_sync, cis, NULL);
1941         if (err)
1942                 return err;
1943
1944         cis->state = BT_CONNECT;
1945
1946         return 0;
1947 }
1948
1949 static void hci_iso_qos_setup(struct hci_dev *hdev, struct hci_conn *conn,
1950                               struct bt_iso_io_qos *qos, __u8 phy)
1951 {
1952         /* Only set MTU if PHY is enabled */
1953         if (!qos->sdu && qos->phy) {
1954                 if (hdev->iso_mtu > 0)
1955                         qos->sdu = hdev->iso_mtu;
1956                 else if (hdev->le_mtu > 0)
1957                         qos->sdu = hdev->le_mtu;
1958                 else
1959                         qos->sdu = hdev->acl_mtu;
1960         }
1961
1962         /* Use the same PHY as ACL if set to any */
1963         if (qos->phy == BT_ISO_PHY_ANY)
1964                 qos->phy = phy;
1965
1966         /* Use LE ACL connection interval if not set */
1967         if (!qos->interval)
1968                 /* ACL interval unit in 1.25 ms to us */
1969                 qos->interval = conn->le_conn_interval * 1250;
1970
1971         /* Use LE ACL connection latency if not set */
1972         if (!qos->latency)
1973                 qos->latency = conn->le_conn_latency;
1974 }
1975
1976 static struct hci_conn *hci_bind_bis(struct hci_conn *conn,
1977                                      struct bt_iso_qos *qos)
1978 {
1979         /* Update LINK PHYs according to QoS preference */
1980         conn->le_tx_phy = qos->out.phy;
1981         conn->le_tx_phy = qos->out.phy;
1982         conn->iso_qos = *qos;
1983         conn->state = BT_BOUND;
1984
1985         return conn;
1986 }
1987
1988 static int create_big_sync(struct hci_dev *hdev, void *data)
1989 {
1990         struct hci_conn *conn = data;
1991         struct bt_iso_qos *qos = &conn->iso_qos;
1992         u16 interval, sync_interval = 0;
1993         u32 flags = 0;
1994         int err;
1995
1996         if (qos->out.phy == 0x02)
1997                 flags |= MGMT_ADV_FLAG_SEC_2M;
1998
1999         /* Align intervals */
2000         interval = qos->out.interval / 1250;
2001
2002         if (qos->bis)
2003                 sync_interval = qos->sync_interval * 1600;
2004
2005         err = hci_start_per_adv_sync(hdev, qos->bis, conn->le_per_adv_data_len,
2006                                      conn->le_per_adv_data, flags, interval,
2007                                      interval, sync_interval);
2008         if (err)
2009                 return err;
2010
2011         return hci_le_create_big(conn, &conn->iso_qos);
2012 }
2013
2014 static void create_pa_complete(struct hci_dev *hdev, void *data, int err)
2015 {
2016         struct hci_cp_le_pa_create_sync *cp = data;
2017
2018         bt_dev_dbg(hdev, "");
2019
2020         if (err)
2021                 bt_dev_err(hdev, "Unable to create PA: %d", err);
2022
2023         kfree(cp);
2024 }
2025
2026 static int create_pa_sync(struct hci_dev *hdev, void *data)
2027 {
2028         struct hci_cp_le_pa_create_sync *cp = data;
2029         int err;
2030
2031         err = __hci_cmd_sync_status(hdev, HCI_OP_LE_PA_CREATE_SYNC,
2032                                     sizeof(*cp), cp, HCI_CMD_TIMEOUT);
2033         if (err) {
2034                 hci_dev_clear_flag(hdev, HCI_PA_SYNC);
2035                 return err;
2036         }
2037
2038         return hci_update_passive_scan_sync(hdev);
2039 }
2040
2041 int hci_pa_create_sync(struct hci_dev *hdev, bdaddr_t *dst, __u8 dst_type,
2042                        __u8 sid)
2043 {
2044         struct hci_cp_le_pa_create_sync *cp;
2045
2046         if (hci_dev_test_and_set_flag(hdev, HCI_PA_SYNC))
2047                 return -EBUSY;
2048
2049         cp = kmalloc(sizeof(*cp), GFP_KERNEL);
2050         if (!cp) {
2051                 hci_dev_clear_flag(hdev, HCI_PA_SYNC);
2052                 return -ENOMEM;
2053         }
2054
2055         /* Convert from ISO socket address type to HCI address type  */
2056         if (dst_type == BDADDR_LE_PUBLIC)
2057                 dst_type = ADDR_LE_DEV_PUBLIC;
2058         else
2059                 dst_type = ADDR_LE_DEV_RANDOM;
2060
2061         memset(cp, 0, sizeof(*cp));
2062         cp->sid = sid;
2063         cp->addr_type = dst_type;
2064         bacpy(&cp->addr, dst);
2065
2066         /* Queue start pa_create_sync and scan */
2067         return hci_cmd_sync_queue(hdev, create_pa_sync, cp, create_pa_complete);
2068 }
2069
2070 int hci_le_big_create_sync(struct hci_dev *hdev, struct bt_iso_qos *qos,
2071                            __u16 sync_handle, __u8 num_bis, __u8 bis[])
2072 {
2073         struct _packed {
2074                 struct hci_cp_le_big_create_sync cp;
2075                 __u8  bis[0x11];
2076         } pdu;
2077         int err;
2078
2079         if (num_bis > sizeof(pdu.bis))
2080                 return -EINVAL;
2081
2082         err = qos_set_big(hdev, qos);
2083         if (err)
2084                 return err;
2085
2086         memset(&pdu, 0, sizeof(pdu));
2087         pdu.cp.handle = qos->big;
2088         pdu.cp.sync_handle = cpu_to_le16(sync_handle);
2089         pdu.cp.num_bis = num_bis;
2090         memcpy(pdu.bis, bis, num_bis);
2091
2092         return hci_send_cmd(hdev, HCI_OP_LE_BIG_CREATE_SYNC,
2093                             sizeof(pdu.cp) + num_bis, &pdu);
2094 }
2095
2096 static void create_big_complete(struct hci_dev *hdev, void *data, int err)
2097 {
2098         struct hci_conn *conn = data;
2099
2100         bt_dev_dbg(hdev, "conn %p", conn);
2101
2102         if (err) {
2103                 bt_dev_err(hdev, "Unable to create BIG: %d", err);
2104                 hci_connect_cfm(conn, err);
2105                 hci_conn_del(conn);
2106         }
2107 }
2108
2109 struct hci_conn *hci_connect_bis(struct hci_dev *hdev, bdaddr_t *dst,
2110                                  __u8 dst_type, struct bt_iso_qos *qos,
2111                                  __u8 base_len, __u8 *base)
2112 {
2113         struct hci_conn *conn;
2114         int err;
2115
2116         /* We need hci_conn object using the BDADDR_ANY as dst */
2117         conn = hci_add_bis(hdev, dst, qos);
2118         if (IS_ERR(conn))
2119                 return conn;
2120
2121         conn = hci_bind_bis(conn, qos);
2122         if (!conn) {
2123                 hci_conn_drop(conn);
2124                 return ERR_PTR(-ENOMEM);
2125         }
2126
2127         /* Add Basic Announcement into Peridic Adv Data if BASE is set */
2128         if (base_len && base) {
2129                 base_len = eir_append_service_data(conn->le_per_adv_data, 0,
2130                                                    0x1851, base, base_len);
2131                 conn->le_per_adv_data_len = base_len;
2132         }
2133
2134         /* Queue start periodic advertising and create BIG */
2135         err = hci_cmd_sync_queue(hdev, create_big_sync, conn,
2136                                  create_big_complete);
2137         if (err < 0) {
2138                 hci_conn_drop(conn);
2139                 return ERR_PTR(err);
2140         }
2141
2142         hci_iso_qos_setup(hdev, conn, &qos->out,
2143                           conn->le_tx_phy ? conn->le_tx_phy :
2144                           hdev->le_tx_def_phys);
2145
2146         return conn;
2147 }
2148
2149 struct hci_conn *hci_connect_cis(struct hci_dev *hdev, bdaddr_t *dst,
2150                                  __u8 dst_type, struct bt_iso_qos *qos)
2151 {
2152         struct hci_conn *le;
2153         struct hci_conn *cis;
2154
2155         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
2156                 le = hci_connect_le(hdev, dst, dst_type, false,
2157                                     BT_SECURITY_LOW,
2158                                     HCI_LE_CONN_TIMEOUT,
2159                                     HCI_ROLE_SLAVE);
2160         else
2161                 le = hci_connect_le_scan(hdev, dst, dst_type,
2162                                          BT_SECURITY_LOW,
2163                                          HCI_LE_CONN_TIMEOUT,
2164                                          CONN_REASON_ISO_CONNECT);
2165         if (IS_ERR(le))
2166                 return le;
2167
2168         hci_iso_qos_setup(hdev, le, &qos->out,
2169                           le->le_tx_phy ? le->le_tx_phy : hdev->le_tx_def_phys);
2170         hci_iso_qos_setup(hdev, le, &qos->in,
2171                           le->le_rx_phy ? le->le_rx_phy : hdev->le_rx_def_phys);
2172
2173         cis = hci_bind_cis(hdev, dst, dst_type, qos);
2174         if (IS_ERR(cis)) {
2175                 hci_conn_drop(le);
2176                 return cis;
2177         }
2178
2179         le->link = cis;
2180         cis->link = le;
2181
2182         hci_conn_hold(cis);
2183
2184         /* If LE is already connected and CIS handle is already set proceed to
2185          * Create CIS immediately.
2186          */
2187         if (le->state == BT_CONNECTED && cis->handle != HCI_CONN_HANDLE_UNSET)
2188                 hci_le_create_cis(le);
2189
2190         return cis;
2191 }
2192
2193 /* Check link security requirement */
2194 int hci_conn_check_link_mode(struct hci_conn *conn)
2195 {
2196         BT_DBG("hcon %p", conn);
2197
2198         /* In Secure Connections Only mode, it is required that Secure
2199          * Connections is used and the link is encrypted with AES-CCM
2200          * using a P-256 authenticated combination key.
2201          */
2202         if (hci_dev_test_flag(conn->hdev, HCI_SC_ONLY)) {
2203                 if (!hci_conn_sc_enabled(conn) ||
2204                     !test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
2205                     conn->key_type != HCI_LK_AUTH_COMBINATION_P256)
2206                         return 0;
2207         }
2208
2209          /* AES encryption is required for Level 4:
2210           *
2211           * BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 3, Part C
2212           * page 1319:
2213           *
2214           * 128-bit equivalent strength for link and encryption keys
2215           * required using FIPS approved algorithms (E0 not allowed,
2216           * SAFER+ not allowed, and P-192 not allowed; encryption key
2217           * not shortened)
2218           */
2219         if (conn->sec_level == BT_SECURITY_FIPS &&
2220             !test_bit(HCI_CONN_AES_CCM, &conn->flags)) {
2221                 bt_dev_err(conn->hdev,
2222                            "Invalid security: Missing AES-CCM usage");
2223                 return 0;
2224         }
2225
2226         if (hci_conn_ssp_enabled(conn) &&
2227             !test_bit(HCI_CONN_ENCRYPT, &conn->flags))
2228                 return 0;
2229
2230         return 1;
2231 }
2232
2233 /* Authenticate remote device */
2234 static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
2235 {
2236         BT_DBG("hcon %p", conn);
2237
2238         if (conn->pending_sec_level > sec_level)
2239                 sec_level = conn->pending_sec_level;
2240
2241         if (sec_level > conn->sec_level)
2242                 conn->pending_sec_level = sec_level;
2243         else if (test_bit(HCI_CONN_AUTH, &conn->flags))
2244                 return 1;
2245
2246         /* Make sure we preserve an existing MITM requirement*/
2247         auth_type |= (conn->auth_type & 0x01);
2248
2249         conn->auth_type = auth_type;
2250
2251         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
2252                 struct hci_cp_auth_requested cp;
2253
2254                 cp.handle = cpu_to_le16(conn->handle);
2255                 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
2256                              sizeof(cp), &cp);
2257
2258                 /* If we're already encrypted set the REAUTH_PEND flag,
2259                  * otherwise set the ENCRYPT_PEND.
2260                  */
2261                 if (test_bit(HCI_CONN_ENCRYPT, &conn->flags))
2262                         set_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
2263                 else
2264                         set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2265         }
2266
2267         return 0;
2268 }
2269
2270 /* Encrypt the link */
2271 static void hci_conn_encrypt(struct hci_conn *conn)
2272 {
2273         BT_DBG("hcon %p", conn);
2274
2275         if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
2276                 struct hci_cp_set_conn_encrypt cp;
2277                 cp.handle  = cpu_to_le16(conn->handle);
2278                 cp.encrypt = 0x01;
2279                 hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2280                              &cp);
2281         }
2282 }
2283
2284 /* Enable security */
2285 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type,
2286                       bool initiator)
2287 {
2288         BT_DBG("hcon %p", conn);
2289
2290         if (conn->type == LE_LINK)
2291                 return smp_conn_security(conn, sec_level);
2292
2293         /* For sdp we don't need the link key. */
2294         if (sec_level == BT_SECURITY_SDP)
2295                 return 1;
2296
2297         /* For non 2.1 devices and low security level we don't need the link
2298            key. */
2299         if (sec_level == BT_SECURITY_LOW && !hci_conn_ssp_enabled(conn))
2300                 return 1;
2301
2302         /* For other security levels we need the link key. */
2303         if (!test_bit(HCI_CONN_AUTH, &conn->flags))
2304                 goto auth;
2305
2306         /* An authenticated FIPS approved combination key has sufficient
2307          * security for security level 4. */
2308         if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256 &&
2309             sec_level == BT_SECURITY_FIPS)
2310                 goto encrypt;
2311
2312         /* An authenticated combination key has sufficient security for
2313            security level 3. */
2314         if ((conn->key_type == HCI_LK_AUTH_COMBINATION_P192 ||
2315              conn->key_type == HCI_LK_AUTH_COMBINATION_P256) &&
2316             sec_level == BT_SECURITY_HIGH)
2317                 goto encrypt;
2318
2319         /* An unauthenticated combination key has sufficient security for
2320            security level 1 and 2. */
2321         if ((conn->key_type == HCI_LK_UNAUTH_COMBINATION_P192 ||
2322              conn->key_type == HCI_LK_UNAUTH_COMBINATION_P256) &&
2323             (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW))
2324                 goto encrypt;
2325
2326         /* A combination key has always sufficient security for the security
2327            levels 1 or 2. High security level requires the combination key
2328            is generated using maximum PIN code length (16).
2329            For pre 2.1 units. */
2330         if (conn->key_type == HCI_LK_COMBINATION &&
2331             (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW ||
2332              conn->pin_length == 16))
2333                 goto encrypt;
2334
2335 auth:
2336         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags))
2337                 return 0;
2338
2339         if (initiator)
2340                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
2341
2342         if (!hci_conn_auth(conn, sec_level, auth_type))
2343                 return 0;
2344
2345 encrypt:
2346         if (test_bit(HCI_CONN_ENCRYPT, &conn->flags)) {
2347                 /* Ensure that the encryption key size has been read,
2348                  * otherwise stall the upper layer responses.
2349                  */
2350                 if (!conn->enc_key_size)
2351                         return 0;
2352
2353                 /* Nothing else needed, all requirements are met */
2354                 return 1;
2355         }
2356
2357         hci_conn_encrypt(conn);
2358         return 0;
2359 }
2360 EXPORT_SYMBOL(hci_conn_security);
2361
2362 /* Check secure link requirement */
2363 int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level)
2364 {
2365         BT_DBG("hcon %p", conn);
2366
2367         /* Accept if non-secure or higher security level is required */
2368         if (sec_level != BT_SECURITY_HIGH && sec_level != BT_SECURITY_FIPS)
2369                 return 1;
2370
2371         /* Accept if secure or higher security level is already present */
2372         if (conn->sec_level == BT_SECURITY_HIGH ||
2373             conn->sec_level == BT_SECURITY_FIPS)
2374                 return 1;
2375
2376         /* Reject not secure link */
2377         return 0;
2378 }
2379 EXPORT_SYMBOL(hci_conn_check_secure);
2380
2381 /* Switch role */
2382 int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
2383 {
2384         BT_DBG("hcon %p", conn);
2385
2386         if (role == conn->role)
2387                 return 1;
2388
2389         if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->flags)) {
2390                 struct hci_cp_switch_role cp;
2391                 bacpy(&cp.bdaddr, &conn->dst);
2392                 cp.role = role;
2393                 hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
2394         }
2395
2396         return 0;
2397 }
2398 EXPORT_SYMBOL(hci_conn_switch_role);
2399
2400 /* Enter active mode */
2401 void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
2402 {
2403         struct hci_dev *hdev = conn->hdev;
2404
2405         BT_DBG("hcon %p mode %d", conn, conn->mode);
2406
2407         if (conn->mode != HCI_CM_SNIFF)
2408                 goto timer;
2409
2410         if (!test_bit(HCI_CONN_POWER_SAVE, &conn->flags) && !force_active)
2411                 goto timer;
2412
2413         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
2414                 struct hci_cp_exit_sniff_mode cp;
2415                 cp.handle = cpu_to_le16(conn->handle);
2416                 hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
2417         }
2418
2419 timer:
2420         if (hdev->idle_timeout > 0)
2421                 queue_delayed_work(hdev->workqueue, &conn->idle_work,
2422                                    msecs_to_jiffies(hdev->idle_timeout));
2423 }
2424
2425 /* Drop all connection on the device */
2426 void hci_conn_hash_flush(struct hci_dev *hdev)
2427 {
2428         struct hci_conn_hash *h = &hdev->conn_hash;
2429         struct hci_conn *c, *n;
2430
2431         BT_DBG("hdev %s", hdev->name);
2432
2433         list_for_each_entry_safe(c, n, &h->list, list) {
2434                 c->state = BT_CLOSED;
2435
2436                 hci_disconn_cfm(c, HCI_ERROR_LOCAL_HOST_TERM);
2437                 hci_conn_del(c);
2438         }
2439 }
2440
2441 /* Check pending connect attempts */
2442 void hci_conn_check_pending(struct hci_dev *hdev)
2443 {
2444         struct hci_conn *conn;
2445
2446         BT_DBG("hdev %s", hdev->name);
2447
2448         hci_dev_lock(hdev);
2449
2450         conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
2451         if (conn)
2452                 hci_acl_create_connection(conn);
2453
2454         hci_dev_unlock(hdev);
2455 }
2456
2457 static u32 get_link_mode(struct hci_conn *conn)
2458 {
2459         u32 link_mode = 0;
2460
2461         if (conn->role == HCI_ROLE_MASTER)
2462                 link_mode |= HCI_LM_MASTER;
2463
2464         if (test_bit(HCI_CONN_ENCRYPT, &conn->flags))
2465                 link_mode |= HCI_LM_ENCRYPT;
2466
2467         if (test_bit(HCI_CONN_AUTH, &conn->flags))
2468                 link_mode |= HCI_LM_AUTH;
2469
2470         if (test_bit(HCI_CONN_SECURE, &conn->flags))
2471                 link_mode |= HCI_LM_SECURE;
2472
2473         if (test_bit(HCI_CONN_FIPS, &conn->flags))
2474                 link_mode |= HCI_LM_FIPS;
2475
2476         return link_mode;
2477 }
2478
2479 int hci_get_conn_list(void __user *arg)
2480 {
2481         struct hci_conn *c;
2482         struct hci_conn_list_req req, *cl;
2483         struct hci_conn_info *ci;
2484         struct hci_dev *hdev;
2485         int n = 0, size, err;
2486
2487         if (copy_from_user(&req, arg, sizeof(req)))
2488                 return -EFAULT;
2489
2490         if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
2491                 return -EINVAL;
2492
2493         size = sizeof(req) + req.conn_num * sizeof(*ci);
2494
2495         cl = kmalloc(size, GFP_KERNEL);
2496         if (!cl)
2497                 return -ENOMEM;
2498
2499         hdev = hci_dev_get(req.dev_id);
2500         if (!hdev) {
2501                 kfree(cl);
2502                 return -ENODEV;
2503         }
2504
2505         ci = cl->conn_info;
2506
2507         hci_dev_lock(hdev);
2508         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2509                 bacpy(&(ci + n)->bdaddr, &c->dst);
2510                 (ci + n)->handle = c->handle;
2511                 (ci + n)->type  = c->type;
2512                 (ci + n)->out   = c->out;
2513                 (ci + n)->state = c->state;
2514                 (ci + n)->link_mode = get_link_mode(c);
2515                 if (++n >= req.conn_num)
2516                         break;
2517         }
2518         hci_dev_unlock(hdev);
2519
2520         cl->dev_id = hdev->id;
2521         cl->conn_num = n;
2522         size = sizeof(req) + n * sizeof(*ci);
2523
2524         hci_dev_put(hdev);
2525
2526         err = copy_to_user(arg, cl, size);
2527         kfree(cl);
2528
2529         return err ? -EFAULT : 0;
2530 }
2531
2532 int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
2533 {
2534         struct hci_conn_info_req req;
2535         struct hci_conn_info ci;
2536         struct hci_conn *conn;
2537         char __user *ptr = arg + sizeof(req);
2538
2539         if (copy_from_user(&req, arg, sizeof(req)))
2540                 return -EFAULT;
2541
2542         hci_dev_lock(hdev);
2543         conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
2544         if (conn) {
2545                 bacpy(&ci.bdaddr, &conn->dst);
2546                 ci.handle = conn->handle;
2547                 ci.type  = conn->type;
2548                 ci.out   = conn->out;
2549                 ci.state = conn->state;
2550                 ci.link_mode = get_link_mode(conn);
2551         }
2552         hci_dev_unlock(hdev);
2553
2554         if (!conn)
2555                 return -ENOENT;
2556
2557         return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
2558 }
2559
2560 int hci_get_auth_info(struct hci_dev *hdev, void __user *arg)
2561 {
2562         struct hci_auth_info_req req;
2563         struct hci_conn *conn;
2564
2565         if (copy_from_user(&req, arg, sizeof(req)))
2566                 return -EFAULT;
2567
2568         hci_dev_lock(hdev);
2569         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr);
2570         if (conn)
2571                 req.type = conn->auth_type;
2572         hci_dev_unlock(hdev);
2573
2574         if (!conn)
2575                 return -ENOENT;
2576
2577         return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0;
2578 }
2579
2580 struct hci_chan *hci_chan_create(struct hci_conn *conn)
2581 {
2582         struct hci_dev *hdev = conn->hdev;
2583         struct hci_chan *chan;
2584
2585         BT_DBG("%s hcon %p", hdev->name, conn);
2586
2587         if (test_bit(HCI_CONN_DROP, &conn->flags)) {
2588                 BT_DBG("Refusing to create new hci_chan");
2589                 return NULL;
2590         }
2591
2592         chan = kzalloc(sizeof(*chan), GFP_KERNEL);
2593         if (!chan)
2594                 return NULL;
2595
2596         chan->conn = hci_conn_get(conn);
2597         skb_queue_head_init(&chan->data_q);
2598         chan->state = BT_CONNECTED;
2599
2600         list_add_rcu(&chan->list, &conn->chan_list);
2601
2602         return chan;
2603 }
2604
2605 void hci_chan_del(struct hci_chan *chan)
2606 {
2607         struct hci_conn *conn = chan->conn;
2608         struct hci_dev *hdev = conn->hdev;
2609
2610         BT_DBG("%s hcon %p chan %p", hdev->name, conn, chan);
2611
2612         list_del_rcu(&chan->list);
2613
2614         synchronize_rcu();
2615
2616         /* Prevent new hci_chan's to be created for this hci_conn */
2617         set_bit(HCI_CONN_DROP, &conn->flags);
2618
2619         hci_conn_put(conn);
2620
2621         skb_queue_purge(&chan->data_q);
2622         kfree(chan);
2623 }
2624
2625 void hci_chan_list_flush(struct hci_conn *conn)
2626 {
2627         struct hci_chan *chan, *n;
2628
2629         BT_DBG("hcon %p", conn);
2630
2631         list_for_each_entry_safe(chan, n, &conn->chan_list, list)
2632                 hci_chan_del(chan);
2633 }
2634
2635 static struct hci_chan *__hci_chan_lookup_handle(struct hci_conn *hcon,
2636                                                  __u16 handle)
2637 {
2638         struct hci_chan *hchan;
2639
2640         list_for_each_entry(hchan, &hcon->chan_list, list) {
2641                 if (hchan->handle == handle)
2642                         return hchan;
2643         }
2644
2645         return NULL;
2646 }
2647
2648 struct hci_chan *hci_chan_lookup_handle(struct hci_dev *hdev, __u16 handle)
2649 {
2650         struct hci_conn_hash *h = &hdev->conn_hash;
2651         struct hci_conn *hcon;
2652         struct hci_chan *hchan = NULL;
2653
2654         rcu_read_lock();
2655
2656         list_for_each_entry_rcu(hcon, &h->list, list) {
2657                 hchan = __hci_chan_lookup_handle(hcon, handle);
2658                 if (hchan)
2659                         break;
2660         }
2661
2662         rcu_read_unlock();
2663
2664         return hchan;
2665 }
2666
2667 u32 hci_conn_get_phy(struct hci_conn *conn)
2668 {
2669         u32 phys = 0;
2670
2671         /* BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 2, Part B page 471:
2672          * Table 6.2: Packets defined for synchronous, asynchronous, and
2673          * CPB logical transport types.
2674          */
2675         switch (conn->type) {
2676         case SCO_LINK:
2677                 /* SCO logical transport (1 Mb/s):
2678                  * HV1, HV2, HV3 and DV.
2679                  */
2680                 phys |= BT_PHY_BR_1M_1SLOT;
2681
2682                 break;
2683
2684         case ACL_LINK:
2685                 /* ACL logical transport (1 Mb/s) ptt=0:
2686                  * DH1, DM3, DH3, DM5 and DH5.
2687                  */
2688                 phys |= BT_PHY_BR_1M_1SLOT;
2689
2690                 if (conn->pkt_type & (HCI_DM3 | HCI_DH3))
2691                         phys |= BT_PHY_BR_1M_3SLOT;
2692
2693                 if (conn->pkt_type & (HCI_DM5 | HCI_DH5))
2694                         phys |= BT_PHY_BR_1M_5SLOT;
2695
2696                 /* ACL logical transport (2 Mb/s) ptt=1:
2697                  * 2-DH1, 2-DH3 and 2-DH5.
2698                  */
2699                 if (!(conn->pkt_type & HCI_2DH1))
2700                         phys |= BT_PHY_EDR_2M_1SLOT;
2701
2702                 if (!(conn->pkt_type & HCI_2DH3))
2703                         phys |= BT_PHY_EDR_2M_3SLOT;
2704
2705                 if (!(conn->pkt_type & HCI_2DH5))
2706                         phys |= BT_PHY_EDR_2M_5SLOT;
2707
2708                 /* ACL logical transport (3 Mb/s) ptt=1:
2709                  * 3-DH1, 3-DH3 and 3-DH5.
2710                  */
2711                 if (!(conn->pkt_type & HCI_3DH1))
2712                         phys |= BT_PHY_EDR_3M_1SLOT;
2713
2714                 if (!(conn->pkt_type & HCI_3DH3))
2715                         phys |= BT_PHY_EDR_3M_3SLOT;
2716
2717                 if (!(conn->pkt_type & HCI_3DH5))
2718                         phys |= BT_PHY_EDR_3M_5SLOT;
2719
2720                 break;
2721
2722         case ESCO_LINK:
2723                 /* eSCO logical transport (1 Mb/s): EV3, EV4 and EV5 */
2724                 phys |= BT_PHY_BR_1M_1SLOT;
2725
2726                 if (!(conn->pkt_type & (ESCO_EV4 | ESCO_EV5)))
2727                         phys |= BT_PHY_BR_1M_3SLOT;
2728
2729                 /* eSCO logical transport (2 Mb/s): 2-EV3, 2-EV5 */
2730                 if (!(conn->pkt_type & ESCO_2EV3))
2731                         phys |= BT_PHY_EDR_2M_1SLOT;
2732
2733                 if (!(conn->pkt_type & ESCO_2EV5))
2734                         phys |= BT_PHY_EDR_2M_3SLOT;
2735
2736                 /* eSCO logical transport (3 Mb/s): 3-EV3, 3-EV5 */
2737                 if (!(conn->pkt_type & ESCO_3EV3))
2738                         phys |= BT_PHY_EDR_3M_1SLOT;
2739
2740                 if (!(conn->pkt_type & ESCO_3EV5))
2741                         phys |= BT_PHY_EDR_3M_3SLOT;
2742
2743                 break;
2744
2745         case LE_LINK:
2746                 if (conn->le_tx_phy & HCI_LE_SET_PHY_1M)
2747                         phys |= BT_PHY_LE_1M_TX;
2748
2749                 if (conn->le_rx_phy & HCI_LE_SET_PHY_1M)
2750                         phys |= BT_PHY_LE_1M_RX;
2751
2752                 if (conn->le_tx_phy & HCI_LE_SET_PHY_2M)
2753                         phys |= BT_PHY_LE_2M_TX;
2754
2755                 if (conn->le_rx_phy & HCI_LE_SET_PHY_2M)
2756                         phys |= BT_PHY_LE_2M_RX;
2757
2758                 if (conn->le_tx_phy & HCI_LE_SET_PHY_CODED)
2759                         phys |= BT_PHY_LE_CODED_TX;
2760
2761                 if (conn->le_rx_phy & HCI_LE_SET_PHY_CODED)
2762                         phys |= BT_PHY_LE_CODED_RX;
2763
2764                 break;
2765         }
2766
2767         return phys;
2768 }
2769
2770 int hci_abort_conn(struct hci_conn *conn, u8 reason)
2771 {
2772         int r = 0;
2773
2774         switch (conn->state) {
2775         case BT_CONNECTED:
2776         case BT_CONFIG:
2777                 if (conn->type == AMP_LINK) {
2778                         struct hci_cp_disconn_phy_link cp;
2779
2780                         cp.phy_handle = HCI_PHY_HANDLE(conn->handle);
2781                         cp.reason = reason;
2782                         r = hci_send_cmd(conn->hdev, HCI_OP_DISCONN_PHY_LINK,
2783                                          sizeof(cp), &cp);
2784                 } else {
2785                         struct hci_cp_disconnect dc;
2786
2787                         dc.handle = cpu_to_le16(conn->handle);
2788                         dc.reason = reason;
2789                         r = hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT,
2790                                          sizeof(dc), &dc);
2791                 }
2792
2793                 conn->state = BT_DISCONN;
2794
2795                 break;
2796         case BT_CONNECT:
2797                 if (conn->type == LE_LINK) {
2798                         if (test_bit(HCI_CONN_SCANNING, &conn->flags))
2799                                 break;
2800                         r = hci_send_cmd(conn->hdev,
2801                                          HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL);
2802                 } else if (conn->type == ACL_LINK) {
2803                         if (conn->hdev->hci_ver < BLUETOOTH_VER_1_2)
2804                                 break;
2805                         r = hci_send_cmd(conn->hdev,
2806                                          HCI_OP_CREATE_CONN_CANCEL,
2807                                          6, &conn->dst);
2808                 }
2809                 break;
2810         case BT_CONNECT2:
2811                 if (conn->type == ACL_LINK) {
2812                         struct hci_cp_reject_conn_req rej;
2813
2814                         bacpy(&rej.bdaddr, &conn->dst);
2815                         rej.reason = reason;
2816
2817                         r = hci_send_cmd(conn->hdev,
2818                                          HCI_OP_REJECT_CONN_REQ,
2819                                          sizeof(rej), &rej);
2820                 } else if (conn->type == SCO_LINK || conn->type == ESCO_LINK) {
2821                         struct hci_cp_reject_sync_conn_req rej;
2822
2823                         bacpy(&rej.bdaddr, &conn->dst);
2824
2825                         /* SCO rejection has its own limited set of
2826                          * allowed error values (0x0D-0x0F) which isn't
2827                          * compatible with most values passed to this
2828                          * function. To be safe hard-code one of the
2829                          * values that's suitable for SCO.
2830                          */
2831                         rej.reason = HCI_ERROR_REJ_LIMITED_RESOURCES;
2832
2833                         r = hci_send_cmd(conn->hdev,
2834                                          HCI_OP_REJECT_SYNC_CONN_REQ,
2835                                          sizeof(rej), &rej);
2836                 }
2837                 break;
2838         default:
2839                 conn->state = BT_CLOSED;
2840                 break;
2841         }
2842
2843         return r;
2844 }