net/bluetooth/hci_conn.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI connection handling. */
  26
  27 #include <linux/export.h>
  28 #include <linux/debugfs.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/l2cap.h>
  33 #include <net/bluetooth/iso.h>
  34 #include <net/bluetooth/mgmt.h>
  35
  36 #include "hci_request.h"
  37 #include "smp.h"
  38 #include "a2mp.h"
  39 #include "eir.h"
  40
  41 struct sco_param {
  42         u16 pkt_type;
  43         u16 max_latency;
  44         u8  retrans_effort;
  45 };
  46
  47 struct conn_handle_t {
  48         struct hci_conn *conn;
  49         __u16 handle;
  50 };
  51
  52 static const struct sco_param esco_param_cvsd[] = {
  53         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000a,   0x01 }, /* S3 */
  54         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x0007,   0x01 }, /* S2 */
  55         { EDR_ESCO_MASK | ESCO_EV3,   0x0007,   0x01 }, /* S1 */
  56         { EDR_ESCO_MASK | ESCO_HV3,   0xffff,   0x01 }, /* D1 */
  57         { EDR_ESCO_MASK | ESCO_HV1,   0xffff,   0x01 }, /* D0 */
  58 };
  59
  60 static const struct sco_param sco_param_cvsd[] = {
  61         { EDR_ESCO_MASK | ESCO_HV3,   0xffff,   0xff }, /* D1 */
  62         { EDR_ESCO_MASK | ESCO_HV1,   0xffff,   0xff }, /* D0 */
  63 };
  64
  65 static const struct sco_param esco_param_msbc[] = {
  66         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000d,   0x02 }, /* T2 */
  67         { EDR_ESCO_MASK | ESCO_EV3,   0x0008,   0x02 }, /* T1 */
  68 };
  69
  70 /* This function requires the caller holds hdev->lock */
  71 static void hci_connect_le_scan_cleanup(struct hci_conn *conn, u8 status)
  72 {
  73         struct hci_conn_params *params;
  74         struct hci_dev *hdev = conn->hdev;
  75         struct smp_irk *irk;
  76         bdaddr_t *bdaddr;
  77         u8 bdaddr_type;
  78
  79         bdaddr = &conn->dst;
  80         bdaddr_type = conn->dst_type;
  81
  82         /* Check if we need to convert to identity address */
  83         irk = hci_get_irk(hdev, bdaddr, bdaddr_type);
  84         if (irk) {
  85                 bdaddr = &irk->bdaddr;
  86                 bdaddr_type = irk->addr_type;
  87         }
  88
  89         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, bdaddr,
  90                                            bdaddr_type);
  91         if (!params)
  92                 return;
  93
  94         if (params->conn) {
  95                 hci_conn_drop(params->conn);
  96                 hci_conn_put(params->conn);
  97                 params->conn = NULL;
  98         }
  99
 100         if (!params->explicit_connect)
 101                 return;
 102
 103         /* If the status indicates successful cancellation of
 104          * the attempt (i.e. Unknown Connection Id) there's no point of
 105          * notifying failure since we'll go back to keep trying to
 106          * connect. The only exception is explicit connect requests
 107          * where a timeout + cancel does indicate an actual failure.
 108          */
 109         if (status && status != HCI_ERROR_UNKNOWN_CONN_ID)
 110                 mgmt_connect_failed(hdev, &conn->dst, conn->type,
 111                                     conn->dst_type, status);
 112
 113         /* The connection attempt was doing scan for new RPA, and is
 114          * in scan phase. If params are not associated with any other
 115          * autoconnect action, remove them completely. If they are, just unmark
 116          * them as waiting for connection, by clearing explicit_connect field.
 117          */
 118         params->explicit_connect = false;
 119
 120         list_del_init(&params->action);
 121
 122         switch (params->auto_connect) {
 123         case HCI_AUTO_CONN_EXPLICIT:
 124                 hci_conn_params_del(hdev, bdaddr, bdaddr_type);
 125                 /* return instead of break to avoid duplicate scan update */
 126                 return;
 127         case HCI_AUTO_CONN_DIRECT:
 128         case HCI_AUTO_CONN_ALWAYS:
 129                 list_add(&params->action, &hdev->pend_le_conns);
 130                 break;
 131         case HCI_AUTO_CONN_REPORT:
 132                 list_add(&params->action, &hdev->pend_le_reports);
 133                 break;
 134         default:
 135                 break;
 136         }
 137
 138         hci_update_passive_scan(hdev);
 139 }
 140
 141 static void hci_conn_cleanup(struct hci_conn *conn)
 142 {
 143         struct hci_dev *hdev = conn->hdev;
 144
 145         if (test_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags))
 146                 hci_conn_params_del(conn->hdev, &conn->dst, conn->dst_type);
 147
 148         if (test_and_clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
 149                 hci_remove_link_key(hdev, &conn->dst);
 150
 151         hci_chan_list_flush(conn);
 152
 153         hci_conn_hash_del(hdev, conn);
 154
 155         if (conn->cleanup)
 156                 conn->cleanup(conn);
 157
 158         if (conn->type == SCO_LINK || conn->type == ESCO_LINK) {
 159                 switch (conn->setting & SCO_AIRMODE_MASK) {
 160                 case SCO_AIRMODE_CVSD:
 161                 case SCO_AIRMODE_TRANSP:
 162                         if (hdev->notify)
 163                                 hdev->notify(hdev, HCI_NOTIFY_DISABLE_SCO);
 164                         break;
 165                 }
 166         } else {
 167                 if (hdev->notify)
 168                         hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
 169         }
 170
 171         hci_conn_del_sysfs(conn);
 172
 173         debugfs_remove_recursive(conn->debugfs);
 174
 175         hci_dev_put(hdev);
 176
 177         hci_conn_put(conn);
 178 }
 179
 180 static void le_scan_cleanup(struct work_struct *work)
 181 {
 182         struct hci_conn *conn = container_of(work, struct hci_conn,
 183                                              le_scan_cleanup);
 184         struct hci_dev *hdev = conn->hdev;
 185         struct hci_conn *c = NULL;
 186
 187         BT_DBG("%s hcon %p", hdev->name, conn);
 188
 189         hci_dev_lock(hdev);
 190
 191         /* Check that the hci_conn is still around */
 192         rcu_read_lock();
 193         list_for_each_entry_rcu(c, &hdev->conn_hash.list, list) {
 194                 if (c == conn)
 195                         break;
 196         }
 197         rcu_read_unlock();
 198
 199         if (c == conn) {
 200                 hci_connect_le_scan_cleanup(conn, 0x00);
 201                 hci_conn_cleanup(conn);
 202         }
 203
 204         hci_dev_unlock(hdev);
 205         hci_dev_put(hdev);
 206         hci_conn_put(conn);
 207 }
 208
 209 static void hci_connect_le_scan_remove(struct hci_conn *conn)
 210 {
 211         BT_DBG("%s hcon %p", conn->hdev->name, conn);
 212
 213         /* We can't call hci_conn_del/hci_conn_cleanup here since that
 214          * could deadlock with another hci_conn_del() call that's holding
 215          * hci_dev_lock and doing cancel_delayed_work_sync(&conn->disc_work).
 216          * Instead, grab temporary extra references to the hci_dev and
 217          * hci_conn and perform the necessary cleanup in a separate work
 218          * callback.
 219          */
 220
 221         hci_dev_hold(conn->hdev);
 222         hci_conn_get(conn);
 223
 224         /* Even though we hold a reference to the hdev, many other
 225          * things might get cleaned up meanwhile, including the hdev's
 226          * own workqueue, so we can't use that for scheduling.
 227          */
 228         schedule_work(&conn->le_scan_cleanup);
 229 }
 230
 231 static void hci_acl_create_connection(struct hci_conn *conn)
 232 {
 233         struct hci_dev *hdev = conn->hdev;
 234         struct inquiry_entry *ie;
 235         struct hci_cp_create_conn cp;
 236
 237         BT_DBG("hcon %p", conn);
 238
 239         /* Many controllers disallow HCI Create Connection while it is doing
 240          * HCI Inquiry. So we cancel the Inquiry first before issuing HCI Create
 241          * Connection. This may cause the MGMT discovering state to become false
 242          * without user space's request but it is okay since the MGMT Discovery
 243          * APIs do not promise that discovery should be done forever. Instead,
 244          * the user space monitors the status of MGMT discovering and it may
 245          * request for discovery again when this flag becomes false.
 246          */
 247         if (test_bit(HCI_INQUIRY, &hdev->flags)) {
 248                 /* Put this connection to "pending" state so that it will be
 249                  * executed after the inquiry cancel command complete event.
 250                  */
 251                 conn->state = BT_CONNECT2;
 252                 hci_send_cmd(hdev, HCI_OP_INQUIRY_CANCEL, 0, NULL);
 253                 return;
 254         }
 255
 256         conn->state = BT_CONNECT;
 257         conn->out = true;
 258         conn->role = HCI_ROLE_MASTER;
 259
 260         conn->attempt++;
 261
 262         conn->link_policy = hdev->link_policy;
 263
 264         memset(&cp, 0, sizeof(cp));
 265         bacpy(&cp.bdaddr, &conn->dst);
 266         cp.pscan_rep_mode = 0x02;
 267
 268         ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
 269         if (ie) {
 270                 if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
 271                         cp.pscan_rep_mode = ie->data.pscan_rep_mode;
 272                         cp.pscan_mode     = ie->data.pscan_mode;
 273                         cp.clock_offset   = ie->data.clock_offset |
 274                                             cpu_to_le16(0x8000);
 275                 }
 276
 277                 memcpy(conn->dev_class, ie->data.dev_class, 3);
 278         }
 279
 280         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 281         if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
 282                 cp.role_switch = 0x01;
 283         else
 284                 cp.role_switch = 0x00;
 285
 286         hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
 287 }
 288
 289 int hci_disconnect(struct hci_conn *conn, __u8 reason)
 290 {
 291         BT_DBG("hcon %p", conn);
 292
 293         /* When we are central of an established connection and it enters
 294          * the disconnect timeout, then go ahead and try to read the
 295          * current clock offset.  Processing of the result is done
 296          * within the event handling and hci_clock_offset_evt function.
 297          */
 298         if (conn->type == ACL_LINK && conn->role == HCI_ROLE_MASTER &&
 299             (conn->state == BT_CONNECTED || conn->state == BT_CONFIG)) {
 300                 struct hci_dev *hdev = conn->hdev;
 301                 struct hci_cp_read_clock_offset clkoff_cp;
 302
 303                 clkoff_cp.handle = cpu_to_le16(conn->handle);
 304                 hci_send_cmd(hdev, HCI_OP_READ_CLOCK_OFFSET, sizeof(clkoff_cp),
 305                              &clkoff_cp);
 306         }
 307
 308         return hci_abort_conn(conn, reason);
 309 }
 310
 311 static void hci_add_sco(struct hci_conn *conn, __u16 handle)
 312 {
 313         struct hci_dev *hdev = conn->hdev;
 314         struct hci_cp_add_sco cp;
 315
 316         BT_DBG("hcon %p", conn);
 317
 318         conn->state = BT_CONNECT;
 319         conn->out = true;
 320
 321         conn->attempt++;
 322
 323         cp.handle   = cpu_to_le16(handle);
 324         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 325
 326         hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
 327 }
 328
 329 static bool find_next_esco_param(struct hci_conn *conn,
 330                                  const struct sco_param *esco_param, int size)
 331 {
 332         for (; conn->attempt <= size; conn->attempt++) {
 333                 if (lmp_esco_2m_capable(conn->link) ||
 334                     (esco_param[conn->attempt - 1].pkt_type & ESCO_2EV3))
 335                         break;
 336                 BT_DBG("hcon %p skipped attempt %d, eSCO 2M not supported",
 337                        conn, conn->attempt);
 338         }
 339
 340         return conn->attempt <= size;
 341 }
 342
 343 static int configure_datapath_sync(struct hci_dev *hdev, struct bt_codec *codec)
 344 {
 345         int err;
 346         __u8 vnd_len, *vnd_data = NULL;
 347         struct hci_op_configure_data_path *cmd = NULL;
 348
 349         err = hdev->get_codec_config_data(hdev, ESCO_LINK, codec, &vnd_len,
 350                                           &vnd_data);
 351         if (err < 0)
 352                 goto error;
 353
 354         cmd = kzalloc(sizeof(*cmd) + vnd_len, GFP_KERNEL);
 355         if (!cmd) {
 356                 err = -ENOMEM;
 357                 goto error;
 358         }
 359
 360         err = hdev->get_data_path_id(hdev, &cmd->data_path_id);
 361         if (err < 0)
 362                 goto error;
 363
 364         cmd->vnd_len = vnd_len;
 365         memcpy(cmd->vnd_data, vnd_data, vnd_len);
 366
 367         cmd->direction = 0x00;
 368         __hci_cmd_sync_status(hdev, HCI_CONFIGURE_DATA_PATH,
 369                               sizeof(*cmd) + vnd_len, cmd, HCI_CMD_TIMEOUT);
 370
 371         cmd->direction = 0x01;
 372         err = __hci_cmd_sync_status(hdev, HCI_CONFIGURE_DATA_PATH,
 373                                     sizeof(*cmd) + vnd_len, cmd,
 374                                     HCI_CMD_TIMEOUT);
 375 error:
 376
 377         kfree(cmd);
 378         kfree(vnd_data);
 379         return err;
 380 }
 381
 382 static int hci_enhanced_setup_sync(struct hci_dev *hdev, void *data)
 383 {
 384         struct conn_handle_t *conn_handle = data;
 385         struct hci_conn *conn = conn_handle->conn;
 386         __u16 handle = conn_handle->handle;
 387         struct hci_cp_enhanced_setup_sync_conn cp;
 388         const struct sco_param *param;
 389
 390         kfree(conn_handle);
 391
 392         bt_dev_dbg(hdev, "hcon %p", conn);
 393
 394         /* for offload use case, codec needs to configured before opening SCO */
 395         if (conn->codec.data_path)
 396                 configure_datapath_sync(hdev, &conn->codec);
 397
 398         conn->state = BT_CONNECT;
 399         conn->out = true;
 400
 401         conn->attempt++;
 402
 403         memset(&cp, 0x00, sizeof(cp));
 404
 405         cp.handle   = cpu_to_le16(handle);
 406
 407         cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
 408         cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
 409
 410         switch (conn->codec.id) {
 411         case BT_CODEC_MSBC:
 412                 if (!find_next_esco_param(conn, esco_param_msbc,
 413                                           ARRAY_SIZE(esco_param_msbc)))
 414                         return -EINVAL;
 415
 416                 param = &esco_param_msbc[conn->attempt - 1];
 417                 cp.tx_coding_format.id = 0x05;
 418                 cp.rx_coding_format.id = 0x05;
 419                 cp.tx_codec_frame_size = __cpu_to_le16(60);
 420                 cp.rx_codec_frame_size = __cpu_to_le16(60);
 421                 cp.in_bandwidth = __cpu_to_le32(32000);
 422                 cp.out_bandwidth = __cpu_to_le32(32000);
 423                 cp.in_coding_format.id = 0x04;
 424                 cp.out_coding_format.id = 0x04;
 425                 cp.in_coded_data_size = __cpu_to_le16(16);
 426                 cp.out_coded_data_size = __cpu_to_le16(16);
 427                 cp.in_pcm_data_format = 2;
 428                 cp.out_pcm_data_format = 2;
 429                 cp.in_pcm_sample_payload_msb_pos = 0;
 430                 cp.out_pcm_sample_payload_msb_pos = 0;
 431                 cp.in_data_path = conn->codec.data_path;
 432                 cp.out_data_path = conn->codec.data_path;
 433                 cp.in_transport_unit_size = 1;
 434                 cp.out_transport_unit_size = 1;
 435                 break;
 436
 437         case BT_CODEC_TRANSPARENT:
 438                 if (!find_next_esco_param(conn, esco_param_msbc,
 439                                           ARRAY_SIZE(esco_param_msbc)))
 440                         return false;
 441                 param = &esco_param_msbc[conn->attempt - 1];
 442                 cp.tx_coding_format.id = 0x03;
 443                 cp.rx_coding_format.id = 0x03;
 444                 cp.tx_codec_frame_size = __cpu_to_le16(60);
 445                 cp.rx_codec_frame_size = __cpu_to_le16(60);
 446                 cp.in_bandwidth = __cpu_to_le32(0x1f40);
 447                 cp.out_bandwidth = __cpu_to_le32(0x1f40);
 448                 cp.in_coding_format.id = 0x03;
 449                 cp.out_coding_format.id = 0x03;
 450                 cp.in_coded_data_size = __cpu_to_le16(16);
 451                 cp.out_coded_data_size = __cpu_to_le16(16);
 452                 cp.in_pcm_data_format = 2;
 453                 cp.out_pcm_data_format = 2;
 454                 cp.in_pcm_sample_payload_msb_pos = 0;
 455                 cp.out_pcm_sample_payload_msb_pos = 0;
 456                 cp.in_data_path = conn->codec.data_path;
 457                 cp.out_data_path = conn->codec.data_path;
 458                 cp.in_transport_unit_size = 1;
 459                 cp.out_transport_unit_size = 1;
 460                 break;
 461
 462         case BT_CODEC_CVSD:
 463                 if (lmp_esco_capable(conn->link)) {
 464                         if (!find_next_esco_param(conn, esco_param_cvsd,
 465                                                   ARRAY_SIZE(esco_param_cvsd)))
 466                                 return -EINVAL;
 467                         param = &esco_param_cvsd[conn->attempt - 1];
 468                 } else {
 469                         if (conn->attempt > ARRAY_SIZE(sco_param_cvsd))
 470                                 return -EINVAL;
 471                         param = &sco_param_cvsd[conn->attempt - 1];
 472                 }
 473                 cp.tx_coding_format.id = 2;
 474                 cp.rx_coding_format.id = 2;
 475                 cp.tx_codec_frame_size = __cpu_to_le16(60);
 476                 cp.rx_codec_frame_size = __cpu_to_le16(60);
 477                 cp.in_bandwidth = __cpu_to_le32(16000);
 478                 cp.out_bandwidth = __cpu_to_le32(16000);
 479                 cp.in_coding_format.id = 4;
 480                 cp.out_coding_format.id = 4;
 481                 cp.in_coded_data_size = __cpu_to_le16(16);
 482                 cp.out_coded_data_size = __cpu_to_le16(16);
 483                 cp.in_pcm_data_format = 2;
 484                 cp.out_pcm_data_format = 2;
 485                 cp.in_pcm_sample_payload_msb_pos = 0;
 486                 cp.out_pcm_sample_payload_msb_pos = 0;
 487                 cp.in_data_path = conn->codec.data_path;
 488                 cp.out_data_path = conn->codec.data_path;
 489                 cp.in_transport_unit_size = 16;
 490                 cp.out_transport_unit_size = 16;
 491                 break;
 492         default:
 493                 return -EINVAL;
 494         }
 495
 496         cp.retrans_effort = param->retrans_effort;
 497         cp.pkt_type = __cpu_to_le16(param->pkt_type);
 498         cp.max_latency = __cpu_to_le16(param->max_latency);
 499
 500         if (hci_send_cmd(hdev, HCI_OP_ENHANCED_SETUP_SYNC_CONN, sizeof(cp), &cp) < 0)
 501                 return -EIO;
 502
 503         return 0;
 504 }
 505
 506 static bool hci_setup_sync_conn(struct hci_conn *conn, __u16 handle)
 507 {
 508         struct hci_dev *hdev = conn->hdev;
 509         struct hci_cp_setup_sync_conn cp;
 510         const struct sco_param *param;
 511
 512         bt_dev_dbg(hdev, "hcon %p", conn);
 513
 514         conn->state = BT_CONNECT;
 515         conn->out = true;
 516
 517         conn->attempt++;
 518
 519         cp.handle   = cpu_to_le16(handle);
 520
 521         cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
 522         cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
 523         cp.voice_setting  = cpu_to_le16(conn->setting);
 524
 525         switch (conn->setting & SCO_AIRMODE_MASK) {
 526         case SCO_AIRMODE_TRANSP:
 527                 if (!find_next_esco_param(conn, esco_param_msbc,
 528                                           ARRAY_SIZE(esco_param_msbc)))
 529                         return false;
 530                 param = &esco_param_msbc[conn->attempt - 1];
 531                 break;
 532         case SCO_AIRMODE_CVSD:
 533                 if (lmp_esco_capable(conn->link)) {
 534                         if (!find_next_esco_param(conn, esco_param_cvsd,
 535                                                   ARRAY_SIZE(esco_param_cvsd)))
 536                                 return false;
 537                         param = &esco_param_cvsd[conn->attempt - 1];
 538                 } else {
 539                         if (conn->attempt > ARRAY_SIZE(sco_param_cvsd))
 540                                 return false;
 541                         param = &sco_param_cvsd[conn->attempt - 1];
 542                 }
 543                 break;
 544         default:
 545                 return false;
 546         }
 547
 548         cp.retrans_effort = param->retrans_effort;
 549         cp.pkt_type = __cpu_to_le16(param->pkt_type);
 550         cp.max_latency = __cpu_to_le16(param->max_latency);
 551
 552         if (hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp) < 0)
 553                 return false;
 554
 555         return true;
 556 }
 557
 558 bool hci_setup_sync(struct hci_conn *conn, __u16 handle)
 559 {
 560         int result;
 561         struct conn_handle_t *conn_handle;
 562
 563         if (enhanced_sync_conn_capable(conn->hdev)) {
 564                 conn_handle = kzalloc(sizeof(*conn_handle), GFP_KERNEL);
 565
 566                 if (!conn_handle)
 567                         return false;
 568
 569                 conn_handle->conn = conn;
 570                 conn_handle->handle = handle;
 571                 result = hci_cmd_sync_queue(conn->hdev, hci_enhanced_setup_sync,
 572                                             conn_handle, NULL);
 573                 if (result < 0)
 574                         kfree(conn_handle);
 575
 576                 return result == 0;
 577         }
 578
 579         return hci_setup_sync_conn(conn, handle);
 580 }
 581
 582 u8 hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max, u16 latency,
 583                       u16 to_multiplier)
 584 {
 585         struct hci_dev *hdev = conn->hdev;
 586         struct hci_conn_params *params;
 587         struct hci_cp_le_conn_update cp;
 588
 589         hci_dev_lock(hdev);
 590
 591         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
 592         if (params) {
 593                 params->conn_min_interval = min;
 594                 params->conn_max_interval = max;
 595                 params->conn_latency = latency;
 596                 params->supervision_timeout = to_multiplier;
 597         }
 598
 599         hci_dev_unlock(hdev);
 600
 601         memset(&cp, 0, sizeof(cp));
 602         cp.handle               = cpu_to_le16(conn->handle);
 603         cp.conn_interval_min    = cpu_to_le16(min);
 604         cp.conn_interval_max    = cpu_to_le16(max);
 605         cp.conn_latency         = cpu_to_le16(latency);
 606         cp.supervision_timeout  = cpu_to_le16(to_multiplier);
 607         cp.min_ce_len           = cpu_to_le16(0x0000);
 608         cp.max_ce_len           = cpu_to_le16(0x0000);
 609
 610         hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp);
 611
 612         if (params)
 613                 return 0x01;
 614
 615         return 0x00;
 616 }
 617
 618 void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __le64 rand,
 619                       __u8 ltk[16], __u8 key_size)
 620 {
 621         struct hci_dev *hdev = conn->hdev;
 622         struct hci_cp_le_start_enc cp;
 623
 624         BT_DBG("hcon %p", conn);
 625
 626         memset(&cp, 0, sizeof(cp));
 627
 628         cp.handle = cpu_to_le16(conn->handle);
 629         cp.rand = rand;
 630         cp.ediv = ediv;
 631         memcpy(cp.ltk, ltk, key_size);
 632
 633         hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp);
 634 }
 635
 636 /* Device _must_ be locked */
 637 void hci_sco_setup(struct hci_conn *conn, __u8 status)
 638 {
 639         struct hci_conn *sco = conn->link;
 640
 641         if (!sco)
 642                 return;
 643
 644         BT_DBG("hcon %p", conn);
 645
 646         if (!status) {
 647                 if (lmp_esco_capable(conn->hdev))
 648                         hci_setup_sync(sco, conn->handle);
 649                 else
 650                         hci_add_sco(sco, conn->handle);
 651         } else {
 652                 hci_connect_cfm(sco, status);
 653                 hci_conn_del(sco);
 654         }
 655 }
 656
 657 static void hci_conn_timeout(struct work_struct *work)
 658 {
 659         struct hci_conn *conn = container_of(work, struct hci_conn,
 660                                              disc_work.work);
 661         int refcnt = atomic_read(&conn->refcnt);
 662
 663         BT_DBG("hcon %p state %s", conn, state_to_string(conn->state));
 664
 665         WARN_ON(refcnt < 0);
 666
 667         /* FIXME: It was observed that in pairing failed scenario, refcnt
 668          * drops below 0. Probably this is because l2cap_conn_del calls
 669          * l2cap_chan_del for each channel, and inside l2cap_chan_del conn is
 670          * dropped. After that loop hci_chan_del is called which also drops
 671          * conn. For now make sure that ACL is alive if refcnt is higher then 0,
 672          * otherwise drop it.
 673          */
 674         if (refcnt > 0)
 675                 return;
 676
 677         /* LE connections in scanning state need special handling */
 678         if (conn->state == BT_CONNECT && conn->type == LE_LINK &&
 679             test_bit(HCI_CONN_SCANNING, &conn->flags)) {
 680                 hci_connect_le_scan_remove(conn);
 681                 return;
 682         }
 683
 684         hci_abort_conn(conn, hci_proto_disconn_ind(conn));
 685 }
 686
 687 /* Enter sniff mode */
 688 static void hci_conn_idle(struct work_struct *work)
 689 {
 690         struct hci_conn *conn = container_of(work, struct hci_conn,
 691                                              idle_work.work);
 692         struct hci_dev *hdev = conn->hdev;
 693
 694         BT_DBG("hcon %p mode %d", conn, conn->mode);
 695
 696         if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn))
 697                 return;
 698
 699         if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF))
 700                 return;
 701
 702         if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
 703                 struct hci_cp_sniff_subrate cp;
 704                 cp.handle             = cpu_to_le16(conn->handle);
 705                 cp.max_latency        = cpu_to_le16(0);
 706                 cp.min_remote_timeout = cpu_to_le16(0);
 707                 cp.min_local_timeout  = cpu_to_le16(0);
 708                 hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
 709         }
 710
 711         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
 712                 struct hci_cp_sniff_mode cp;
 713                 cp.handle       = cpu_to_le16(conn->handle);
 714                 cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
 715                 cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
 716                 cp.attempt      = cpu_to_le16(4);
 717                 cp.timeout      = cpu_to_le16(1);
 718                 hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
 719         }
 720 }
 721
 722 static void hci_conn_auto_accept(struct work_struct *work)
 723 {
 724         struct hci_conn *conn = container_of(work, struct hci_conn,
 725                                              auto_accept_work.work);
 726
 727         hci_send_cmd(conn->hdev, HCI_OP_USER_CONFIRM_REPLY, sizeof(conn->dst),
 728                      &conn->dst);
 729 }
 730
 731 static void le_disable_advertising(struct hci_dev *hdev)
 732 {
 733         if (ext_adv_capable(hdev)) {
 734                 struct hci_cp_le_set_ext_adv_enable cp;
 735
 736                 cp.enable = 0x00;
 737                 cp.num_of_sets = 0x00;
 738
 739                 hci_send_cmd(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE, sizeof(cp),
 740                              &cp);
 741         } else {
 742                 u8 enable = 0x00;
 743                 hci_send_cmd(hdev, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable),
 744                              &enable);
 745         }
 746 }
 747
 748 static void le_conn_timeout(struct work_struct *work)
 749 {
 750         struct hci_conn *conn = container_of(work, struct hci_conn,
 751                                              le_conn_timeout.work);
 752         struct hci_dev *hdev = conn->hdev;
 753
 754         BT_DBG("");
 755
 756         /* We could end up here due to having done directed advertising,
 757          * so clean up the state if necessary. This should however only
 758          * happen with broken hardware or if low duty cycle was used
 759          * (which doesn't have a timeout of its own).
 760          */
 761         if (conn->role == HCI_ROLE_SLAVE) {
 762                 /* Disable LE Advertising */
 763                 le_disable_advertising(hdev);
 764                 hci_dev_lock(hdev);
 765                 hci_conn_failed(conn, HCI_ERROR_ADVERTISING_TIMEOUT);
 766                 hci_dev_unlock(hdev);
 767                 return;
 768         }
 769
 770         hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
 771 }
 772
 773 struct iso_cig_params {
 774         struct hci_cp_le_set_cig_params cp;
 775         struct hci_cis_params cis[0x1f];
 776 };
 777
 778 struct iso_list_data {
 779         union {
 780                 u8  cig;
 781                 u8  big;
 782         };
 783         union {
 784                 u8  cis;
 785                 u8  bis;
 786                 u16 sync_handle;
 787         };
 788         int count;
 789         struct iso_cig_params pdu;
 790 };
 791
 792 static void bis_list(struct hci_conn *conn, void *data)
 793 {
 794         struct iso_list_data *d = data;
 795
 796         /* Skip if not broadcast/ANY address */
 797         if (bacmp(&conn->dst, BDADDR_ANY))
 798                 return;
 799
 800         if (d->big != conn->iso_qos.big || d->bis == BT_ISO_QOS_BIS_UNSET ||
 801             d->bis != conn->iso_qos.bis)
 802                 return;
 803
 804         d->count++;
 805 }
 806
 807 static void find_bis(struct hci_conn *conn, void *data)
 808 {
 809         struct iso_list_data *d = data;
 810
 811         /* Ignore unicast */
 812         if (bacmp(&conn->dst, BDADDR_ANY))
 813                 return;
 814
 815         d->count++;
 816 }
 817
 818 static int terminate_big_sync(struct hci_dev *hdev, void *data)
 819 {
 820         struct iso_list_data *d = data;
 821
 822         bt_dev_dbg(hdev, "big 0x%2.2x bis 0x%2.2x", d->big, d->bis);
 823
 824         hci_remove_ext_adv_instance_sync(hdev, d->bis, NULL);
 825
 826         /* Check if ISO connection is a BIS and terminate BIG if there are
 827          * no other connections using it.
 828          */
 829         hci_conn_hash_list_state(hdev, find_bis, ISO_LINK, BT_CONNECTED, d);
 830         if (d->count)
 831                 return 0;
 832
 833         return hci_le_terminate_big_sync(hdev, d->big,
 834                                          HCI_ERROR_LOCAL_HOST_TERM);
 835 }
 836
 837 static void terminate_big_destroy(struct hci_dev *hdev, void *data, int err)
 838 {
 839         kfree(data);
 840 }
 841
 842 static int hci_le_terminate_big(struct hci_dev *hdev, u8 big, u8 bis)
 843 {
 844         struct iso_list_data *d;
 845         int ret;
 846
 847         bt_dev_dbg(hdev, "big 0x%2.2x bis 0x%2.2x", big, bis);
 848
 849         d = kmalloc(sizeof(*d), GFP_KERNEL);
 850         if (!d)
 851                 return -ENOMEM;
 852
 853         memset(d, 0, sizeof(*d));
 854         d->big = big;
 855         d->bis = bis;
 856
 857         ret = hci_cmd_sync_queue(hdev, terminate_big_sync, d,
 858                                  terminate_big_destroy);
 859         if (ret)
 860                 kfree(d);
 861
 862         return ret;
 863 }
 864
 865 static int big_terminate_sync(struct hci_dev *hdev, void *data)
 866 {
 867         struct iso_list_data *d = data;
 868
 869         bt_dev_dbg(hdev, "big 0x%2.2x sync_handle 0x%4.4x", d->big,
 870                    d->sync_handle);
 871
 872         /* Check if ISO connection is a BIS and terminate BIG if there are
 873          * no other connections using it.
 874          */
 875         hci_conn_hash_list_state(hdev, find_bis, ISO_LINK, BT_CONNECTED, d);
 876         if (d->count)
 877                 return 0;
 878
 879         hci_le_big_terminate_sync(hdev, d->big);
 880
 881         return hci_le_pa_terminate_sync(hdev, d->sync_handle);
 882 }
 883
 884 static int hci_le_big_terminate(struct hci_dev *hdev, u8 big, u16 sync_handle)
 885 {
 886         struct iso_list_data *d;
 887         int ret;
 888
 889         bt_dev_dbg(hdev, "big 0x%2.2x sync_handle 0x%4.4x", big, sync_handle);
 890
 891         d = kmalloc(sizeof(*d), GFP_KERNEL);
 892         if (!d)
 893                 return -ENOMEM;
 894
 895         memset(d, 0, sizeof(*d));
 896         d->big = big;
 897         d->sync_handle = sync_handle;
 898
 899         ret = hci_cmd_sync_queue(hdev, big_terminate_sync, d,
 900                                  terminate_big_destroy);
 901         if (ret)
 902                 kfree(d);
 903
 904         return ret;
 905 }
 906
 907 /* Cleanup BIS connection
 908  *
 909  * Detects if there any BIS left connected in a BIG
 910  * broadcaster: Remove advertising instance and terminate BIG.
 911  * broadcaster receiver: Teminate BIG sync and terminate PA sync.
 912  */
 913 static void bis_cleanup(struct hci_conn *conn)
 914 {
 915         struct hci_dev *hdev = conn->hdev;
 916
 917         bt_dev_dbg(hdev, "conn %p", conn);
 918
 919         if (conn->role == HCI_ROLE_MASTER) {
 920                 if (!test_and_clear_bit(HCI_CONN_PER_ADV, &conn->flags))
 921                         return;
 922
 923                 hci_le_terminate_big(hdev, conn->iso_qos.big,
 924                                      conn->iso_qos.bis);
 925         } else {
 926                 hci_le_big_terminate(hdev, conn->iso_qos.big,
 927                                      conn->sync_handle);
 928         }
 929 }
 930
 931 static int remove_cig_sync(struct hci_dev *hdev, void *data)
 932 {
 933         u8 handle = PTR_ERR(data);
 934
 935         return hci_le_remove_cig_sync(hdev, handle);
 936 }
 937
 938 static int hci_le_remove_cig(struct hci_dev *hdev, u8 handle)
 939 {
 940         bt_dev_dbg(hdev, "handle 0x%2.2x", handle);
 941
 942         return hci_cmd_sync_queue(hdev, remove_cig_sync, ERR_PTR(handle), NULL);
 943 }
 944
 945 static void find_cis(struct hci_conn *conn, void *data)
 946 {
 947         struct iso_list_data *d = data;
 948
 949         /* Ignore broadcast */
 950         if (!bacmp(&conn->dst, BDADDR_ANY))
 951                 return;
 952
 953         d->count++;
 954 }
 955
 956 /* Cleanup CIS connection:
 957  *
 958  * Detects if there any CIS left connected in a CIG and remove it.
 959  */
 960 static void cis_cleanup(struct hci_conn *conn)
 961 {
 962         struct hci_dev *hdev = conn->hdev;
 963         struct iso_list_data d;
 964
 965         memset(&d, 0, sizeof(d));
 966         d.cig = conn->iso_qos.cig;
 967
 968         /* Check if ISO connection is a CIS and remove CIG if there are
 969          * no other connections using it.
 970          */
 971         hci_conn_hash_list_state(hdev, find_cis, ISO_LINK, BT_BOUND, &d);
 972         hci_conn_hash_list_state(hdev, find_cis, ISO_LINK, BT_CONNECT, &d);
 973         hci_conn_hash_list_state(hdev, find_cis, ISO_LINK, BT_CONNECTED, &d);
 974         if (d.count)
 975                 return;
 976
 977         hci_le_remove_cig(hdev, conn->iso_qos.cig);
 978 }
 979
 980 struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst,
 981                               u8 role)
 982 {
 983         struct hci_conn *conn;
 984
 985         BT_DBG("%s dst %pMR", hdev->name, dst);
 986
 987         conn = kzalloc(sizeof(*conn), GFP_KERNEL);
 988         if (!conn)
 989                 return NULL;
 990
 991         bacpy(&conn->dst, dst);
 992         bacpy(&conn->src, &hdev->bdaddr);
 993         conn->handle = HCI_CONN_HANDLE_UNSET;
 994         conn->hdev  = hdev;
 995         conn->type  = type;
 996         conn->role  = role;
 997         conn->mode  = HCI_CM_ACTIVE;
 998         conn->state = BT_OPEN;
 999         conn->auth_type = HCI_AT_GENERAL_BONDING;
1000         conn->io_capability = hdev->io_capability;
1001         conn->remote_auth = 0xff;
1002         conn->key_type = 0xff;
1003         conn->rssi = HCI_RSSI_INVALID;
1004         conn->tx_power = HCI_TX_POWER_INVALID;
1005         conn->max_tx_power = HCI_TX_POWER_INVALID;
1006
1007         set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
1008         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
1009
1010         /* Set Default Authenticated payload timeout to 30s */
1011         conn->auth_payload_timeout = DEFAULT_AUTH_PAYLOAD_TIMEOUT;
1012
1013         if (conn->role == HCI_ROLE_MASTER)
1014                 conn->out = true;
1015
1016         switch (type) {
1017         case ACL_LINK:
1018                 conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
1019                 break;
1020         case LE_LINK:
1021                 /* conn->src should reflect the local identity address */
1022                 hci_copy_identity_address(hdev, &conn->src, &conn->src_type);
1023                 break;
1024         case ISO_LINK:
1025                 /* conn->src should reflect the local identity address */
1026                 hci_copy_identity_address(hdev, &conn->src, &conn->src_type);
1027
1028                 /* set proper cleanup function */
1029                 if (!bacmp(dst, BDADDR_ANY))
1030                         conn->cleanup = bis_cleanup;
1031                 else if (conn->role == HCI_ROLE_MASTER)
1032                         conn->cleanup = cis_cleanup;
1033
1034                 break;
1035         case SCO_LINK:
1036                 if (lmp_esco_capable(hdev))
1037                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
1038                                         (hdev->esco_type & EDR_ESCO_MASK);
1039                 else
1040                         conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
1041                 break;
1042         case ESCO_LINK:
1043                 conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
1044                 break;
1045         }
1046
1047         skb_queue_head_init(&conn->data_q);
1048
1049         INIT_LIST_HEAD(&conn->chan_list);
1050
1051         INIT_DELAYED_WORK(&conn->disc_work, hci_conn_timeout);
1052         INIT_DELAYED_WORK(&conn->auto_accept_work, hci_conn_auto_accept);
1053         INIT_DELAYED_WORK(&conn->idle_work, hci_conn_idle);
1054         INIT_DELAYED_WORK(&conn->le_conn_timeout, le_conn_timeout);
1055         INIT_WORK(&conn->le_scan_cleanup, le_scan_cleanup);
1056
1057         atomic_set(&conn->refcnt, 0);
1058
1059         hci_dev_hold(hdev);
1060
1061         hci_conn_hash_add(hdev, conn);
1062
1063         /* The SCO and eSCO connections will only be notified when their
1064          * setup has been completed. This is different to ACL links which
1065          * can be notified right away.
1066          */
1067         if (conn->type != SCO_LINK && conn->type != ESCO_LINK) {
1068                 if (hdev->notify)
1069                         hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
1070         }
1071
1072         hci_conn_init_sysfs(conn);
1073
1074         return conn;
1075 }
1076
1077 static bool hci_conn_unlink(struct hci_conn *conn)
1078 {
1079         if (!conn->link)
1080                 return false;
1081
1082         conn->link->link = NULL;
1083         conn->link = NULL;
1084
1085         return true;
1086 }
1087
1088 int hci_conn_del(struct hci_conn *conn)
1089 {
1090         struct hci_dev *hdev = conn->hdev;
1091
1092         BT_DBG("%s hcon %p handle %d", hdev->name, conn, conn->handle);
1093
1094         cancel_delayed_work_sync(&conn->disc_work);
1095         cancel_delayed_work_sync(&conn->auto_accept_work);
1096         cancel_delayed_work_sync(&conn->idle_work);
1097
1098         if (conn->type == ACL_LINK) {
1099                 struct hci_conn *link = conn->link;
1100
1101                 if (link) {
1102                         hci_conn_unlink(conn);
1103                         /* Due to race, SCO connection might be not established
1104                          * yet at this point. Delete it now, otherwise it is
1105                          * possible for it to be stuck and can't be deleted.
1106                          */
1107                         if (link->handle == HCI_CONN_HANDLE_UNSET)
1108                                 hci_conn_del(link);
1109                 }
1110
1111                 /* Unacked frames */
1112                 hdev->acl_cnt += conn->sent;
1113         } else if (conn->type == LE_LINK) {
1114                 cancel_delayed_work(&conn->le_conn_timeout);
1115
1116                 if (hdev->le_pkts)
1117                         hdev->le_cnt += conn->sent;
1118                 else
1119                         hdev->acl_cnt += conn->sent;
1120         } else {
1121                 struct hci_conn *acl = conn->link;
1122
1123                 if (acl) {
1124                         hci_conn_unlink(conn);
1125                         hci_conn_drop(acl);
1126                 }
1127
1128                 /* Unacked ISO frames */
1129                 if (conn->type == ISO_LINK) {
1130                         if (hdev->iso_pkts)
1131                                 hdev->iso_cnt += conn->sent;
1132                         else if (hdev->le_pkts)
1133                                 hdev->le_cnt += conn->sent;
1134                         else
1135                                 hdev->acl_cnt += conn->sent;
1136                 }
1137         }
1138
1139         if (conn->amp_mgr)
1140                 amp_mgr_put(conn->amp_mgr);
1141
1142         skb_queue_purge(&conn->data_q);
1143
1144         /* Remove the connection from the list and cleanup its remaining
1145          * state. This is a separate function since for some cases like
1146          * BT_CONNECT_SCAN we *only* want the cleanup part without the
1147          * rest of hci_conn_del.
1148          */
1149         hci_conn_cleanup(conn);
1150
1151         return 0;
1152 }
1153
1154 struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src, uint8_t src_type)
1155 {
1156         int use_src = bacmp(src, BDADDR_ANY);
1157         struct hci_dev *hdev = NULL, *d;
1158
1159         BT_DBG("%pMR -> %pMR", src, dst);
1160
1161         read_lock(&hci_dev_list_lock);
1162
1163         list_for_each_entry(d, &hci_dev_list, list) {
1164                 if (!test_bit(HCI_UP, &d->flags) ||
1165                     hci_dev_test_flag(d, HCI_USER_CHANNEL) ||
1166                     d->dev_type != HCI_PRIMARY)
1167                         continue;
1168
1169                 /* Simple routing:
1170                  *   No source address - find interface with bdaddr != dst
1171                  *   Source address    - find interface with bdaddr == src
1172                  */
1173
1174                 if (use_src) {
1175                         bdaddr_t id_addr;
1176                         u8 id_addr_type;
1177
1178                         if (src_type == BDADDR_BREDR) {
1179                                 if (!lmp_bredr_capable(d))
1180                                         continue;
1181                                 bacpy(&id_addr, &d->bdaddr);
1182                                 id_addr_type = BDADDR_BREDR;
1183                         } else {
1184                                 if (!lmp_le_capable(d))
1185                                         continue;
1186
1187                                 hci_copy_identity_address(d, &id_addr,
1188                                                           &id_addr_type);
1189
1190                                 /* Convert from HCI to three-value type */
1191                                 if (id_addr_type == ADDR_LE_DEV_PUBLIC)
1192                                         id_addr_type = BDADDR_LE_PUBLIC;
1193                                 else
1194                                         id_addr_type = BDADDR_LE_RANDOM;
1195                         }
1196
1197                         if (!bacmp(&id_addr, src) && id_addr_type == src_type) {
1198                                 hdev = d; break;
1199                         }
1200                 } else {
1201                         if (bacmp(&d->bdaddr, dst)) {
1202                                 hdev = d; break;
1203                         }
1204                 }
1205         }
1206
1207         if (hdev)
1208                 hdev = hci_dev_hold(hdev);
1209
1210         read_unlock(&hci_dev_list_lock);
1211         return hdev;
1212 }
1213 EXPORT_SYMBOL(hci_get_route);
1214
1215 /* This function requires the caller holds hdev->lock */
1216 static void hci_le_conn_failed(struct hci_conn *conn, u8 status)
1217 {
1218         struct hci_dev *hdev = conn->hdev;
1219
1220         hci_connect_le_scan_cleanup(conn, status);
1221
1222         /* Enable advertising in case this was a failed connection
1223          * attempt as a peripheral.
1224          */
1225         hci_enable_advertising(hdev);
1226 }
1227
1228 /* This function requires the caller holds hdev->lock */
1229 void hci_conn_failed(struct hci_conn *conn, u8 status)
1230 {
1231         struct hci_dev *hdev = conn->hdev;
1232
1233         bt_dev_dbg(hdev, "status 0x%2.2x", status);
1234
1235         switch (conn->type) {
1236         case LE_LINK:
1237                 hci_le_conn_failed(conn, status);
1238                 break;
1239         case ACL_LINK:
1240                 mgmt_connect_failed(hdev, &conn->dst, conn->type,
1241                                     conn->dst_type, status);
1242                 break;
1243         }
1244
1245         conn->state = BT_CLOSED;
1246         hci_connect_cfm(conn, status);
1247         hci_conn_del(conn);
1248 }
1249
1250 static void create_le_conn_complete(struct hci_dev *hdev, void *data, int err)
1251 {
1252         struct hci_conn *conn = data;
1253
1254         bt_dev_dbg(hdev, "err %d", err);
1255
1256         hci_dev_lock(hdev);
1257
1258         if (!err) {
1259                 hci_connect_le_scan_cleanup(conn, 0x00);
1260                 goto done;
1261         }
1262
1263         /* Check if connection is still pending */
1264         if (conn != hci_lookup_le_connect(hdev))
1265                 goto done;
1266
1267         hci_conn_failed(conn, bt_status(err));
1268
1269 done:
1270         hci_dev_unlock(hdev);
1271 }
1272
1273 static int hci_connect_le_sync(struct hci_dev *hdev, void *data)
1274 {
1275         struct hci_conn *conn = data;
1276
1277         bt_dev_dbg(hdev, "conn %p", conn);
1278
1279         return hci_le_create_conn_sync(hdev, conn);
1280 }
1281
1282 struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,
1283                                 u8 dst_type, bool dst_resolved, u8 sec_level,
1284                                 u16 conn_timeout, u8 role)
1285 {
1286         struct hci_conn *conn;
1287         struct smp_irk *irk;
1288         int err;
1289
1290         /* Let's make sure that le is enabled.*/
1291         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1292                 if (lmp_le_capable(hdev))
1293                         return ERR_PTR(-ECONNREFUSED);
1294
1295                 return ERR_PTR(-EOPNOTSUPP);
1296         }
1297
1298         /* Since the controller supports only one LE connection attempt at a
1299          * time, we return -EBUSY if there is any connection attempt running.
1300          */
1301         if (hci_lookup_le_connect(hdev))
1302                 return ERR_PTR(-EBUSY);
1303
1304         /* If there's already a connection object but it's not in
1305          * scanning state it means it must already be established, in
1306          * which case we can't do anything else except report a failure
1307          * to connect.
1308          */
1309         conn = hci_conn_hash_lookup_le(hdev, dst, dst_type);
1310         if (conn && !test_bit(HCI_CONN_SCANNING, &conn->flags)) {
1311                 return ERR_PTR(-EBUSY);
1312         }
1313
1314         /* Check if the destination address has been resolved by the controller
1315          * since if it did then the identity address shall be used.
1316          */
1317         if (!dst_resolved) {
1318                 /* When given an identity address with existing identity
1319                  * resolving key, the connection needs to be established
1320                  * to a resolvable random address.
1321                  *
1322                  * Storing the resolvable random address is required here
1323                  * to handle connection failures. The address will later
1324                  * be resolved back into the original identity address
1325                  * from the connect request.
1326                  */
1327                 irk = hci_find_irk_by_addr(hdev, dst, dst_type);
1328                 if (irk && bacmp(&irk->rpa, BDADDR_ANY)) {
1329                         dst = &irk->rpa;
1330                         dst_type = ADDR_LE_DEV_RANDOM;
1331                 }
1332         }
1333
1334         if (conn) {
1335                 bacpy(&conn->dst, dst);
1336         } else {
1337                 conn = hci_conn_add(hdev, LE_LINK, dst, role);
1338                 if (!conn)
1339                         return ERR_PTR(-ENOMEM);
1340                 hci_conn_hold(conn);
1341                 conn->pending_sec_level = sec_level;
1342         }
1343
1344         conn->dst_type = dst_type;
1345         conn->sec_level = BT_SECURITY_LOW;
1346         conn->conn_timeout = conn_timeout;
1347
1348         conn->state = BT_CONNECT;
1349         clear_bit(HCI_CONN_SCANNING, &conn->flags);
1350
1351         err = hci_cmd_sync_queue(hdev, hci_connect_le_sync, conn,
1352                                  create_le_conn_complete);
1353         if (err) {
1354                 hci_conn_del(conn);
1355                 return ERR_PTR(err);
1356         }
1357
1358         return conn;
1359 }
1360
1361 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
1362 {
1363         struct hci_conn *conn;
1364
1365         conn = hci_conn_hash_lookup_le(hdev, addr, type);
1366         if (!conn)
1367                 return false;
1368
1369         if (conn->state != BT_CONNECTED)
1370                 return false;
1371
1372         return true;
1373 }
1374
1375 /* This function requires the caller holds hdev->lock */
1376 static int hci_explicit_conn_params_set(struct hci_dev *hdev,
1377                                         bdaddr_t *addr, u8 addr_type)
1378 {
1379         struct hci_conn_params *params;
1380
1381         if (is_connected(hdev, addr, addr_type))
1382                 return -EISCONN;
1383
1384         params = hci_conn_params_lookup(hdev, addr, addr_type);
1385         if (!params) {
1386                 params = hci_conn_params_add(hdev, addr, addr_type);
1387                 if (!params)
1388                         return -ENOMEM;
1389
1390                 /* If we created new params, mark them to be deleted in
1391                  * hci_connect_le_scan_cleanup. It's different case than
1392                  * existing disabled params, those will stay after cleanup.
1393                  */
1394                 params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
1395         }
1396
1397         /* We're trying to connect, so make sure params are at pend_le_conns */
1398         if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
1399             params->auto_connect == HCI_AUTO_CONN_REPORT ||
1400             params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
1401                 list_del_init(&params->action);
1402                 list_add(&params->action, &hdev->pend_le_conns);
1403         }
1404
1405         params->explicit_connect = true;
1406
1407         BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
1408                params->auto_connect);
1409
1410         return 0;
1411 }
1412
1413 static int qos_set_big(struct hci_dev *hdev, struct bt_iso_qos *qos)
1414 {
1415         struct iso_list_data data;
1416
1417         /* Allocate a BIG if not set */
1418         if (qos->big == BT_ISO_QOS_BIG_UNSET) {
1419                 for (data.big = 0x00; data.big < 0xef; data.big++) {
1420                         data.count = 0;
1421                         data.bis = 0xff;
1422
1423                         hci_conn_hash_list_state(hdev, bis_list, ISO_LINK,
1424                                                  BT_BOUND, &data);
1425                         if (!data.count)
1426                                 break;
1427                 }
1428
1429                 if (data.big == 0xef)
1430                         return -EADDRNOTAVAIL;
1431
1432                 /* Update BIG */
1433                 qos->big = data.big;
1434         }
1435
1436         return 0;
1437 }
1438
1439 static int qos_set_bis(struct hci_dev *hdev, struct bt_iso_qos *qos)
1440 {
1441         struct iso_list_data data;
1442
1443         /* Allocate BIS if not set */
1444         if (qos->bis == BT_ISO_QOS_BIS_UNSET) {
1445                 /* Find an unused adv set to advertise BIS, skip instance 0x00
1446                  * since it is reserved as general purpose set.
1447                  */
1448                 for (data.bis = 0x01; data.bis < hdev->le_num_of_adv_sets;
1449                      data.bis++) {
1450                         data.count = 0;
1451
1452                         hci_conn_hash_list_state(hdev, bis_list, ISO_LINK,
1453                                                  BT_BOUND, &data);
1454                         if (!data.count)
1455                                 break;
1456                 }
1457
1458                 if (data.bis == hdev->le_num_of_adv_sets)
1459                         return -EADDRNOTAVAIL;
1460
1461                 /* Update BIS */
1462                 qos->bis = data.bis;
1463         }
1464
1465         return 0;
1466 }
1467
1468 /* This function requires the caller holds hdev->lock */
1469 static struct hci_conn *hci_add_bis(struct hci_dev *hdev, bdaddr_t *dst,
1470                                     struct bt_iso_qos *qos)
1471 {
1472         struct hci_conn *conn;
1473         struct iso_list_data data;
1474         int err;
1475
1476         /* Let's make sure that le is enabled.*/
1477         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1478                 if (lmp_le_capable(hdev))
1479                         return ERR_PTR(-ECONNREFUSED);
1480                 return ERR_PTR(-EOPNOTSUPP);
1481         }
1482
1483         err = qos_set_big(hdev, qos);
1484         if (err)
1485                 return ERR_PTR(err);
1486
1487         err = qos_set_bis(hdev, qos);
1488         if (err)
1489                 return ERR_PTR(err);
1490
1491         data.big = qos->big;
1492         data.bis = qos->bis;
1493         data.count = 0;
1494
1495         /* Check if there is already a matching BIG/BIS */
1496         hci_conn_hash_list_state(hdev, bis_list, ISO_LINK, BT_BOUND, &data);
1497         if (data.count)
1498                 return ERR_PTR(-EADDRINUSE);
1499
1500         conn = hci_conn_hash_lookup_bis(hdev, dst, qos->big, qos->bis);
1501         if (conn)
1502                 return ERR_PTR(-EADDRINUSE);
1503
1504         conn = hci_conn_add(hdev, ISO_LINK, dst, HCI_ROLE_MASTER);
1505         if (!conn)
1506                 return ERR_PTR(-ENOMEM);
1507
1508         set_bit(HCI_CONN_PER_ADV, &conn->flags);
1509         conn->state = BT_CONNECT;
1510
1511         hci_conn_hold(conn);
1512         return conn;
1513 }
1514
1515 /* This function requires the caller holds hdev->lock */
1516 struct hci_conn *hci_connect_le_scan(struct hci_dev *hdev, bdaddr_t *dst,
1517                                      u8 dst_type, u8 sec_level,
1518                                      u16 conn_timeout,
1519                                      enum conn_reasons conn_reason)
1520 {
1521         struct hci_conn *conn;
1522
1523         /* Let's make sure that le is enabled.*/
1524         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1525                 if (lmp_le_capable(hdev))
1526                         return ERR_PTR(-ECONNREFUSED);
1527
1528                 return ERR_PTR(-EOPNOTSUPP);
1529         }
1530
1531         /* Some devices send ATT messages as soon as the physical link is
1532          * established. To be able to handle these ATT messages, the user-
1533          * space first establishes the connection and then starts the pairing
1534          * process.
1535          *
1536          * So if a hci_conn object already exists for the following connection
1537          * attempt, we simply update pending_sec_level and auth_type fields
1538          * and return the object found.
1539          */
1540         conn = hci_conn_hash_lookup_le(hdev, dst, dst_type);
1541         if (conn) {
1542                 if (conn->pending_sec_level < sec_level)
1543                         conn->pending_sec_level = sec_level;
1544                 goto done;
1545         }
1546
1547         BT_DBG("requesting refresh of dst_addr");
1548
1549         conn = hci_conn_add(hdev, LE_LINK, dst, HCI_ROLE_MASTER);
1550         if (!conn)
1551                 return ERR_PTR(-ENOMEM);
1552
1553         if (hci_explicit_conn_params_set(hdev, dst, dst_type) < 0) {
1554                 hci_conn_del(conn);
1555                 return ERR_PTR(-EBUSY);
1556         }
1557
1558         conn->state = BT_CONNECT;
1559         set_bit(HCI_CONN_SCANNING, &conn->flags);
1560         conn->dst_type = dst_type;
1561         conn->sec_level = BT_SECURITY_LOW;
1562         conn->pending_sec_level = sec_level;
1563         conn->conn_timeout = conn_timeout;
1564         conn->conn_reason = conn_reason;
1565
1566         hci_update_passive_scan(hdev);
1567
1568 done:
1569         hci_conn_hold(conn);
1570         return conn;
1571 }
1572
1573 struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst,
1574                                  u8 sec_level, u8 auth_type,
1575                                  enum conn_reasons conn_reason)
1576 {
1577         struct hci_conn *acl;
1578
1579         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1580                 if (lmp_bredr_capable(hdev))
1581                         return ERR_PTR(-ECONNREFUSED);
1582
1583                 return ERR_PTR(-EOPNOTSUPP);
1584         }
1585
1586         acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
1587         if (!acl) {
1588                 acl = hci_conn_add(hdev, ACL_LINK, dst, HCI_ROLE_MASTER);
1589                 if (!acl)
1590                         return ERR_PTR(-ENOMEM);
1591         }
1592
1593         hci_conn_hold(acl);
1594
1595         acl->conn_reason = conn_reason;
1596         if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
1597                 acl->sec_level = BT_SECURITY_LOW;
1598                 acl->pending_sec_level = sec_level;
1599                 acl->auth_type = auth_type;
1600                 hci_acl_create_connection(acl);
1601         }
1602
1603         return acl;
1604 }
1605
1606 struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type, bdaddr_t *dst,
1607                                  __u16 setting, struct bt_codec *codec)
1608 {
1609         struct hci_conn *acl;
1610         struct hci_conn *sco;
1611
1612         acl = hci_connect_acl(hdev, dst, BT_SECURITY_LOW, HCI_AT_NO_BONDING,
1613                               CONN_REASON_SCO_CONNECT);
1614         if (IS_ERR(acl))
1615                 return acl;
1616
1617         sco = hci_conn_hash_lookup_ba(hdev, type, dst);
1618         if (!sco) {
1619                 sco = hci_conn_add(hdev, type, dst, HCI_ROLE_MASTER);
1620                 if (!sco) {
1621                         hci_conn_drop(acl);
1622                         return ERR_PTR(-ENOMEM);
1623                 }
1624         }
1625
1626         acl->link = sco;
1627         sco->link = acl;
1628
1629         hci_conn_hold(sco);
1630
1631         sco->setting = setting;
1632         sco->codec = *codec;
1633
1634         if (acl->state == BT_CONNECTED &&
1635             (sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
1636                 set_bit(HCI_CONN_POWER_SAVE, &acl->flags);
1637                 hci_conn_enter_active_mode(acl, BT_POWER_FORCE_ACTIVE_ON);
1638
1639                 if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->flags)) {
1640                         /* defer SCO setup until mode change completed */
1641                         set_bit(HCI_CONN_SCO_SETUP_PEND, &acl->flags);
1642                         return sco;
1643                 }
1644
1645                 hci_sco_setup(acl, 0x00);
1646         }
1647
1648         return sco;
1649 }
1650
1651 static void cis_add(struct iso_list_data *d, struct bt_iso_qos *qos)
1652 {
1653         struct hci_cis_params *cis = &d->pdu.cis[d->pdu.cp.num_cis];
1654
1655         cis->cis_id = qos->cis;
1656         cis->c_sdu  = cpu_to_le16(qos->out.sdu);
1657         cis->p_sdu  = cpu_to_le16(qos->in.sdu);
1658         cis->c_phy  = qos->out.phy ? qos->out.phy : qos->in.phy;
1659         cis->p_phy  = qos->in.phy ? qos->in.phy : qos->out.phy;
1660         cis->c_rtn  = qos->out.rtn;
1661         cis->p_rtn  = qos->in.rtn;
1662
1663         d->pdu.cp.num_cis++;
1664 }
1665
1666 static void cis_list(struct hci_conn *conn, void *data)
1667 {
1668         struct iso_list_data *d = data;
1669
1670         /* Skip if broadcast/ANY address */
1671         if (!bacmp(&conn->dst, BDADDR_ANY))
1672                 return;
1673
1674         if (d->cig != conn->iso_qos.cig || d->cis == BT_ISO_QOS_CIS_UNSET ||
1675             d->cis != conn->iso_qos.cis)
1676                 return;
1677
1678         d->count++;
1679
1680         if (d->pdu.cp.cig_id == BT_ISO_QOS_CIG_UNSET ||
1681             d->count >= ARRAY_SIZE(d->pdu.cis))
1682                 return;
1683
1684         cis_add(d, &conn->iso_qos);
1685 }
1686
1687 static int hci_le_create_big(struct hci_conn *conn, struct bt_iso_qos *qos)
1688 {
1689         struct hci_dev *hdev = conn->hdev;
1690         struct hci_cp_le_create_big cp;
1691
1692         memset(&cp, 0, sizeof(cp));
1693
1694         cp.handle = qos->big;
1695         cp.adv_handle = qos->bis;
1696         cp.num_bis  = 0x01;
1697         hci_cpu_to_le24(qos->out.interval, cp.bis.sdu_interval);
1698         cp.bis.sdu = cpu_to_le16(qos->out.sdu);
1699         cp.bis.latency =  cpu_to_le16(qos->out.latency);
1700         cp.bis.rtn  = qos->out.rtn;
1701         cp.bis.phy  = qos->out.phy;
1702         cp.bis.packing = qos->packing;
1703         cp.bis.framing = qos->framing;
1704         cp.bis.encryption = 0x00;
1705         memset(&cp.bis.bcode, 0, sizeof(cp.bis.bcode));
1706
1707         return hci_send_cmd(hdev, HCI_OP_LE_CREATE_BIG, sizeof(cp), &cp);
1708 }
1709
1710 static void set_cig_params_complete(struct hci_dev *hdev, void *data, int err)
1711 {
1712         struct iso_cig_params *pdu = data;
1713
1714         bt_dev_dbg(hdev, "");
1715
1716         if (err)
1717                 bt_dev_err(hdev, "Unable to set CIG parameters: %d", err);
1718
1719         kfree(pdu);
1720 }
1721
1722 static int set_cig_params_sync(struct hci_dev *hdev, void *data)
1723 {
1724         struct iso_cig_params *pdu = data;
1725         u32 plen;
1726
1727         plen = sizeof(pdu->cp) + pdu->cp.num_cis * sizeof(pdu->cis[0]);
1728         return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_CIG_PARAMS, plen, pdu,
1729                                      HCI_CMD_TIMEOUT);
1730 }
1731
1732 static bool hci_le_set_cig_params(struct hci_conn *conn, struct bt_iso_qos *qos)
1733 {
1734         struct hci_dev *hdev = conn->hdev;
1735         struct iso_list_data data;
1736         struct iso_cig_params *pdu;
1737
1738         memset(&data, 0, sizeof(data));
1739
1740         /* Allocate a CIG if not set */
1741         if (qos->cig == BT_ISO_QOS_CIG_UNSET) {
1742                 for (data.cig = 0x00; data.cig < 0xff; data.cig++) {
1743                         data.count = 0;
1744                         data.cis = 0xff;
1745
1746                         hci_conn_hash_list_state(hdev, cis_list, ISO_LINK,
1747                                                  BT_BOUND, &data);
1748                         if (data.count)
1749                                 continue;
1750
1751                         hci_conn_hash_list_state(hdev, cis_list, ISO_LINK,
1752                                                  BT_CONNECTED, &data);
1753                         if (!data.count)
1754                                 break;
1755                 }
1756
1757                 if (data.cig == 0xff)
1758                         return false;
1759
1760                 /* Update CIG */
1761                 qos->cig = data.cig;
1762         }
1763
1764         data.pdu.cp.cig_id = qos->cig;
1765         hci_cpu_to_le24(qos->out.interval, data.pdu.cp.c_interval);
1766         hci_cpu_to_le24(qos->in.interval, data.pdu.cp.p_interval);
1767         data.pdu.cp.sca = qos->sca;
1768         data.pdu.cp.packing = qos->packing;
1769         data.pdu.cp.framing = qos->framing;
1770         data.pdu.cp.c_latency = cpu_to_le16(qos->out.latency);
1771         data.pdu.cp.p_latency = cpu_to_le16(qos->in.latency);
1772
1773         if (qos->cis != BT_ISO_QOS_CIS_UNSET) {
1774                 data.count = 0;
1775                 data.cig = qos->cig;
1776                 data.cis = qos->cis;
1777
1778                 hci_conn_hash_list_state(hdev, cis_list, ISO_LINK, BT_BOUND,
1779                                          &data);
1780                 if (data.count)
1781                         return false;
1782
1783                 cis_add(&data, qos);
1784         }
1785
1786         /* Reprogram all CIS(s) with the same CIG */
1787         for (data.cig = qos->cig, data.cis = 0x00; data.cis < 0x11;
1788              data.cis++) {
1789                 data.count = 0;
1790
1791                 hci_conn_hash_list_state(hdev, cis_list, ISO_LINK, BT_BOUND,
1792                                          &data);
1793                 if (data.count)
1794                         continue;
1795
1796                 /* Allocate a CIS if not set */
1797                 if (qos->cis == BT_ISO_QOS_CIS_UNSET) {
1798                         /* Update CIS */
1799                         qos->cis = data.cis;
1800                         cis_add(&data, qos);
1801                 }
1802         }
1803
1804         if (qos->cis == BT_ISO_QOS_CIS_UNSET || !data.pdu.cp.num_cis)
1805                 return false;
1806
1807         pdu = kzalloc(sizeof(*pdu), GFP_KERNEL);
1808         if (!pdu)
1809                 return false;
1810
1811         memcpy(pdu, &data.pdu, sizeof(*pdu));
1812
1813         if (hci_cmd_sync_queue(hdev, set_cig_params_sync, pdu,
1814                                set_cig_params_complete) < 0) {
1815                 kfree(pdu);
1816                 return false;
1817         }
1818
1819         return true;
1820 }
1821
1822 struct hci_conn *hci_bind_cis(struct hci_dev *hdev, bdaddr_t *dst,
1823                               __u8 dst_type, struct bt_iso_qos *qos)
1824 {
1825         struct hci_conn *cis;
1826
1827         cis = hci_conn_hash_lookup_cis(hdev, dst, dst_type);
1828         if (!cis) {
1829                 cis = hci_conn_add(hdev, ISO_LINK, dst, HCI_ROLE_MASTER);
1830                 if (!cis)
1831                         return ERR_PTR(-ENOMEM);
1832                 cis->cleanup = cis_cleanup;
1833                 cis->dst_type = dst_type;
1834         }
1835
1836         if (cis->state == BT_CONNECTED)
1837                 return cis;
1838
1839         /* Check if CIS has been set and the settings matches */
1840         if (cis->state == BT_BOUND &&
1841             !memcmp(&cis->iso_qos, qos, sizeof(*qos)))
1842                 return cis;
1843
1844         /* Update LINK PHYs according to QoS preference */
1845         cis->le_tx_phy = qos->out.phy;
1846         cis->le_rx_phy = qos->in.phy;
1847
1848         /* If output interval is not set use the input interval as it cannot be
1849          * 0x000000.
1850          */
1851         if (!qos->out.interval)
1852                 qos->out.interval = qos->in.interval;
1853
1854         /* If input interval is not set use the output interval as it cannot be
1855          * 0x000000.
1856          */
1857         if (!qos->in.interval)
1858                 qos->in.interval = qos->out.interval;
1859
1860         /* If output latency is not set use the input latency as it cannot be
1861          * 0x0000.
1862          */
1863         if (!qos->out.latency)
1864                 qos->out.latency = qos->in.latency;
1865
1866         /* If input latency is not set use the output latency as it cannot be
1867          * 0x0000.
1868          */
1869         if (!qos->in.latency)
1870                 qos->in.latency = qos->out.latency;
1871
1872         if (!hci_le_set_cig_params(cis, qos)) {
1873                 hci_conn_drop(cis);
1874                 return ERR_PTR(-EINVAL);
1875         }
1876
1877         cis->iso_qos = *qos;
1878         cis->state = BT_BOUND;
1879
1880         return cis;
1881 }
1882
1883 bool hci_iso_setup_path(struct hci_conn *conn)
1884 {
1885         struct hci_dev *hdev = conn->hdev;
1886         struct hci_cp_le_setup_iso_path cmd;
1887
1888         memset(&cmd, 0, sizeof(cmd));
1889
1890         if (conn->iso_qos.out.sdu) {
1891                 cmd.handle = cpu_to_le16(conn->handle);
1892                 cmd.direction = 0x00; /* Input (Host to Controller) */
1893                 cmd.path = 0x00; /* HCI path if enabled */
1894                 cmd.codec = 0x03; /* Transparent Data */
1895
1896                 if (hci_send_cmd(hdev, HCI_OP_LE_SETUP_ISO_PATH, sizeof(cmd),
1897                                  &cmd) < 0)
1898                         return false;
1899         }
1900
1901         if (conn->iso_qos.in.sdu) {
1902                 cmd.handle = cpu_to_le16(conn->handle);
1903                 cmd.direction = 0x01; /* Output (Controller to Host) */
1904                 cmd.path = 0x00; /* HCI path if enabled */
1905                 cmd.codec = 0x03; /* Transparent Data */
1906
1907                 if (hci_send_cmd(hdev, HCI_OP_LE_SETUP_ISO_PATH, sizeof(cmd),
1908                                  &cmd) < 0)
1909                         return false;
1910         }
1911
1912         return true;
1913 }
1914
1915 static int hci_create_cis_sync(struct hci_dev *hdev, void *data)
1916 {
1917         struct {
1918                 struct hci_cp_le_create_cis cp;
1919                 struct hci_cis cis[0x1f];
1920         } cmd;
1921         struct hci_conn *conn = data;
1922         u8 cig;
1923
1924         memset(&cmd, 0, sizeof(cmd));
1925         cmd.cis[0].acl_handle = cpu_to_le16(conn->link->handle);
1926         cmd.cis[0].cis_handle = cpu_to_le16(conn->handle);
1927         cmd.cp.num_cis++;
1928         cig = conn->iso_qos.cig;
1929
1930         hci_dev_lock(hdev);
1931
1932         rcu_read_lock();
1933
1934         list_for_each_entry_rcu(conn, &hdev->conn_hash.list, list) {
1935                 struct hci_cis *cis = &cmd.cis[cmd.cp.num_cis];
1936
1937                 if (conn == data || conn->type != ISO_LINK ||
1938                     conn->state == BT_CONNECTED || conn->iso_qos.cig != cig)
1939                         continue;
1940
1941                 /* Check if all CIS(s) belonging to a CIG are ready */
1942                 if (!conn->link || conn->link->state != BT_CONNECTED ||
1943                     conn->state != BT_CONNECT) {
1944                         cmd.cp.num_cis = 0;
1945                         break;
1946                 }
1947
1948                 /* Group all CIS with state BT_CONNECT since the spec don't
1949                  * allow to send them individually:
1950                  *
1951                  * BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 4, Part E
1952                  * page 2566:
1953                  *
1954                  * If the Host issues this command before all the
1955                  * HCI_LE_CIS_Established events from the previous use of the
1956                  * command have been generated, the Controller shall return the
1957                  * error code Command Disallowed (0x0C).
1958                  */
1959                 cis->acl_handle = cpu_to_le16(conn->link->handle);
1960                 cis->cis_handle = cpu_to_le16(conn->handle);
1961                 cmd.cp.num_cis++;
1962         }
1963
1964         rcu_read_unlock();
1965
1966         hci_dev_unlock(hdev);
1967
1968         if (!cmd.cp.num_cis)
1969                 return 0;
1970
1971         return hci_send_cmd(hdev, HCI_OP_LE_CREATE_CIS, sizeof(cmd.cp) +
1972                             sizeof(cmd.cis[0]) * cmd.cp.num_cis, &cmd);
1973 }
1974
1975 int hci_le_create_cis(struct hci_conn *conn)
1976 {
1977         struct hci_conn *cis;
1978         struct hci_dev *hdev = conn->hdev;
1979         int err;
1980
1981         switch (conn->type) {
1982         case LE_LINK:
1983                 if (!conn->link || conn->state != BT_CONNECTED)
1984                         return -EINVAL;
1985                 cis = conn->link;
1986                 break;
1987         case ISO_LINK:
1988                 cis = conn;
1989                 break;
1990         default:
1991                 return -EINVAL;
1992         }
1993
1994         if (cis->state == BT_CONNECT)
1995                 return 0;
1996
1997         /* Queue Create CIS */
1998         err = hci_cmd_sync_queue(hdev, hci_create_cis_sync, cis, NULL);
1999         if (err)
2000                 return err;
2001
2002         cis->state = BT_CONNECT;
2003
2004         return 0;
2005 }
2006
2007 static void hci_iso_qos_setup(struct hci_dev *hdev, struct hci_conn *conn,
2008                               struct bt_iso_io_qos *qos, __u8 phy)
2009 {
2010         /* Only set MTU if PHY is enabled */
2011         if (!qos->sdu && qos->phy) {
2012                 if (hdev->iso_mtu > 0)
2013                         qos->sdu = hdev->iso_mtu;
2014                 else if (hdev->le_mtu > 0)
2015                         qos->sdu = hdev->le_mtu;
2016                 else
2017                         qos->sdu = hdev->acl_mtu;
2018         }
2019
2020         /* Use the same PHY as ACL if set to any */
2021         if (qos->phy == BT_ISO_PHY_ANY)
2022                 qos->phy = phy;
2023
2024         /* Use LE ACL connection interval if not set */
2025         if (!qos->interval)
2026                 /* ACL interval unit in 1.25 ms to us */
2027                 qos->interval = conn->le_conn_interval * 1250;
2028
2029         /* Use LE ACL connection latency if not set */
2030         if (!qos->latency)
2031                 qos->latency = conn->le_conn_latency;
2032 }
2033
2034 static void hci_bind_bis(struct hci_conn *conn,
2035                          struct bt_iso_qos *qos)
2036 {
2037         /* Update LINK PHYs according to QoS preference */
2038         conn->le_tx_phy = qos->out.phy;
2039         conn->le_tx_phy = qos->out.phy;
2040         conn->iso_qos = *qos;
2041         conn->state = BT_BOUND;
2042 }
2043
2044 static int create_big_sync(struct hci_dev *hdev, void *data)
2045 {
2046         struct hci_conn *conn = data;
2047         struct bt_iso_qos *qos = &conn->iso_qos;
2048         u16 interval, sync_interval = 0;
2049         u32 flags = 0;
2050         int err;
2051
2052         if (qos->out.phy == 0x02)
2053                 flags |= MGMT_ADV_FLAG_SEC_2M;
2054
2055         /* Align intervals */
2056         interval = qos->out.interval / 1250;
2057
2058         if (qos->bis)
2059                 sync_interval = qos->sync_interval * 1600;
2060
2061         err = hci_start_per_adv_sync(hdev, qos->bis, conn->le_per_adv_data_len,
2062                                      conn->le_per_adv_data, flags, interval,
2063                                      interval, sync_interval);
2064         if (err)
2065                 return err;
2066
2067         return hci_le_create_big(conn, &conn->iso_qos);
2068 }
2069
2070 static void create_pa_complete(struct hci_dev *hdev, void *data, int err)
2071 {
2072         struct hci_cp_le_pa_create_sync *cp = data;
2073
2074         bt_dev_dbg(hdev, "");
2075
2076         if (err)
2077                 bt_dev_err(hdev, "Unable to create PA: %d", err);
2078
2079         kfree(cp);
2080 }
2081
2082 static int create_pa_sync(struct hci_dev *hdev, void *data)
2083 {
2084         struct hci_cp_le_pa_create_sync *cp = data;
2085         int err;
2086
2087         err = __hci_cmd_sync_status(hdev, HCI_OP_LE_PA_CREATE_SYNC,
2088                                     sizeof(*cp), cp, HCI_CMD_TIMEOUT);
2089         if (err) {
2090                 hci_dev_clear_flag(hdev, HCI_PA_SYNC);
2091                 return err;
2092         }
2093
2094         return hci_update_passive_scan_sync(hdev);
2095 }
2096
2097 int hci_pa_create_sync(struct hci_dev *hdev, bdaddr_t *dst, __u8 dst_type,
2098                        __u8 sid)
2099 {
2100         struct hci_cp_le_pa_create_sync *cp;
2101
2102         if (hci_dev_test_and_set_flag(hdev, HCI_PA_SYNC))
2103                 return -EBUSY;
2104
2105         cp = kmalloc(sizeof(*cp), GFP_KERNEL);
2106         if (!cp) {
2107                 hci_dev_clear_flag(hdev, HCI_PA_SYNC);
2108                 return -ENOMEM;
2109         }
2110
2111         /* Convert from ISO socket address type to HCI address type  */
2112         if (dst_type == BDADDR_LE_PUBLIC)
2113                 dst_type = ADDR_LE_DEV_PUBLIC;
2114         else
2115                 dst_type = ADDR_LE_DEV_RANDOM;
2116
2117         memset(cp, 0, sizeof(*cp));
2118         cp->sid = sid;
2119         cp->addr_type = dst_type;
2120         bacpy(&cp->addr, dst);
2121
2122         /* Queue start pa_create_sync and scan */
2123         return hci_cmd_sync_queue(hdev, create_pa_sync, cp, create_pa_complete);
2124 }
2125
2126 int hci_le_big_create_sync(struct hci_dev *hdev, struct bt_iso_qos *qos,
2127                            __u16 sync_handle, __u8 num_bis, __u8 bis[])
2128 {
2129         struct _packed {
2130                 struct hci_cp_le_big_create_sync cp;
2131                 __u8  bis[0x11];
2132         } pdu;
2133         int err;
2134
2135         if (num_bis > sizeof(pdu.bis))
2136                 return -EINVAL;
2137
2138         err = qos_set_big(hdev, qos);
2139         if (err)
2140                 return err;
2141
2142         memset(&pdu, 0, sizeof(pdu));
2143         pdu.cp.handle = qos->big;
2144         pdu.cp.sync_handle = cpu_to_le16(sync_handle);
2145         pdu.cp.num_bis = num_bis;
2146         memcpy(pdu.bis, bis, num_bis);
2147
2148         return hci_send_cmd(hdev, HCI_OP_LE_BIG_CREATE_SYNC,
2149                             sizeof(pdu.cp) + num_bis, &pdu);
2150 }
2151
2152 static void create_big_complete(struct hci_dev *hdev, void *data, int err)
2153 {
2154         struct hci_conn *conn = data;
2155
2156         bt_dev_dbg(hdev, "conn %p", conn);
2157
2158         if (err) {
2159                 bt_dev_err(hdev, "Unable to create BIG: %d", err);
2160                 hci_connect_cfm(conn, err);
2161                 hci_conn_del(conn);
2162         }
2163 }
2164
2165 struct hci_conn *hci_connect_bis(struct hci_dev *hdev, bdaddr_t *dst,
2166                                  __u8 dst_type, struct bt_iso_qos *qos,
2167                                  __u8 base_len, __u8 *base)
2168 {
2169         struct hci_conn *conn;
2170         int err;
2171
2172         /* We need hci_conn object using the BDADDR_ANY as dst */
2173         conn = hci_add_bis(hdev, dst, qos);
2174         if (IS_ERR(conn))
2175                 return conn;
2176
2177         hci_bind_bis(conn, qos);
2178
2179         /* Add Basic Announcement into Peridic Adv Data if BASE is set */
2180         if (base_len && base) {
2181                 base_len = eir_append_service_data(conn->le_per_adv_data, 0,
2182                                                    0x1851, base, base_len);
2183                 conn->le_per_adv_data_len = base_len;
2184         }
2185
2186         /* Queue start periodic advertising and create BIG */
2187         err = hci_cmd_sync_queue(hdev, create_big_sync, conn,
2188                                  create_big_complete);
2189         if (err < 0) {
2190                 hci_conn_drop(conn);
2191                 return ERR_PTR(err);
2192         }
2193
2194         hci_iso_qos_setup(hdev, conn, &qos->out,
2195                           conn->le_tx_phy ? conn->le_tx_phy :
2196                           hdev->le_tx_def_phys);
2197
2198         return conn;
2199 }
2200
2201 struct hci_conn *hci_connect_cis(struct hci_dev *hdev, bdaddr_t *dst,
2202                                  __u8 dst_type, struct bt_iso_qos *qos)
2203 {
2204         struct hci_conn *le;
2205         struct hci_conn *cis;
2206
2207         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
2208                 le = hci_connect_le(hdev, dst, dst_type, false,
2209                                     BT_SECURITY_LOW,
2210                                     HCI_LE_CONN_TIMEOUT,
2211                                     HCI_ROLE_SLAVE);
2212         else
2213                 le = hci_connect_le_scan(hdev, dst, dst_type,
2214                                          BT_SECURITY_LOW,
2215                                          HCI_LE_CONN_TIMEOUT,
2216                                          CONN_REASON_ISO_CONNECT);
2217         if (IS_ERR(le))
2218                 return le;
2219
2220         hci_iso_qos_setup(hdev, le, &qos->out,
2221                           le->le_tx_phy ? le->le_tx_phy : hdev->le_tx_def_phys);
2222         hci_iso_qos_setup(hdev, le, &qos->in,
2223                           le->le_rx_phy ? le->le_rx_phy : hdev->le_rx_def_phys);
2224
2225         cis = hci_bind_cis(hdev, dst, dst_type, qos);
2226         if (IS_ERR(cis)) {
2227                 hci_conn_drop(le);
2228                 return cis;
2229         }
2230
2231         le->link = cis;
2232         cis->link = le;
2233
2234         hci_conn_hold(cis);
2235
2236         /* If LE is already connected and CIS handle is already set proceed to
2237          * Create CIS immediately.
2238          */
2239         if (le->state == BT_CONNECTED && cis->handle != HCI_CONN_HANDLE_UNSET)
2240                 hci_le_create_cis(le);
2241
2242         return cis;
2243 }
2244
2245 /* Check link security requirement */
2246 int hci_conn_check_link_mode(struct hci_conn *conn)
2247 {
2248         BT_DBG("hcon %p", conn);
2249
2250         /* In Secure Connections Only mode, it is required that Secure
2251          * Connections is used and the link is encrypted with AES-CCM
2252          * using a P-256 authenticated combination key.
2253          */
2254         if (hci_dev_test_flag(conn->hdev, HCI_SC_ONLY)) {
2255                 if (!hci_conn_sc_enabled(conn) ||
2256                     !test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
2257                     conn->key_type != HCI_LK_AUTH_COMBINATION_P256)
2258                         return 0;
2259         }
2260
2261          /* AES encryption is required for Level 4:
2262           *
2263           * BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 3, Part C
2264           * page 1319:
2265           *
2266           * 128-bit equivalent strength for link and encryption keys
2267           * required using FIPS approved algorithms (E0 not allowed,
2268           * SAFER+ not allowed, and P-192 not allowed; encryption key
2269           * not shortened)
2270           */
2271         if (conn->sec_level == BT_SECURITY_FIPS &&
2272             !test_bit(HCI_CONN_AES_CCM, &conn->flags)) {
2273                 bt_dev_err(conn->hdev,
2274                            "Invalid security: Missing AES-CCM usage");
2275                 return 0;
2276         }
2277
2278         if (hci_conn_ssp_enabled(conn) &&
2279             !test_bit(HCI_CONN_ENCRYPT, &conn->flags))
2280                 return 0;
2281
2282         return 1;
2283 }
2284
2285 /* Authenticate remote device */
2286 static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
2287 {
2288         BT_DBG("hcon %p", conn);
2289
2290         if (conn->pending_sec_level > sec_level)
2291                 sec_level = conn->pending_sec_level;
2292
2293         if (sec_level > conn->sec_level)
2294                 conn->pending_sec_level = sec_level;
2295         else if (test_bit(HCI_CONN_AUTH, &conn->flags))
2296                 return 1;
2297
2298         /* Make sure we preserve an existing MITM requirement*/
2299         auth_type |= (conn->auth_type & 0x01);
2300
2301         conn->auth_type = auth_type;
2302
2303         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
2304                 struct hci_cp_auth_requested cp;
2305
2306                 cp.handle = cpu_to_le16(conn->handle);
2307                 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
2308                              sizeof(cp), &cp);
2309
2310                 /* If we're already encrypted set the REAUTH_PEND flag,
2311                  * otherwise set the ENCRYPT_PEND.
2312                  */
2313                 if (test_bit(HCI_CONN_ENCRYPT, &conn->flags))
2314                         set_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
2315                 else
2316                         set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2317         }
2318
2319         return 0;
2320 }
2321
2322 /* Encrypt the link */
2323 static void hci_conn_encrypt(struct hci_conn *conn)
2324 {
2325         BT_DBG("hcon %p", conn);
2326
2327         if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
2328                 struct hci_cp_set_conn_encrypt cp;
2329                 cp.handle  = cpu_to_le16(conn->handle);
2330                 cp.encrypt = 0x01;
2331                 hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2332                              &cp);
2333         }
2334 }
2335
2336 /* Enable security */
2337 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type,
2338                       bool initiator)
2339 {
2340         BT_DBG("hcon %p", conn);
2341
2342         if (conn->type == LE_LINK)
2343                 return smp_conn_security(conn, sec_level);
2344
2345         /* For sdp we don't need the link key. */
2346         if (sec_level == BT_SECURITY_SDP)
2347                 return 1;
2348
2349         /* For non 2.1 devices and low security level we don't need the link
2350            key. */
2351         if (sec_level == BT_SECURITY_LOW && !hci_conn_ssp_enabled(conn))
2352                 return 1;
2353
2354         /* For other security levels we need the link key. */
2355         if (!test_bit(HCI_CONN_AUTH, &conn->flags))
2356                 goto auth;
2357
2358         /* An authenticated FIPS approved combination key has sufficient
2359          * security for security level 4. */
2360         if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256 &&
2361             sec_level == BT_SECURITY_FIPS)
2362                 goto encrypt;
2363
2364         /* An authenticated combination key has sufficient security for
2365            security level 3. */
2366         if ((conn->key_type == HCI_LK_AUTH_COMBINATION_P192 ||
2367              conn->key_type == HCI_LK_AUTH_COMBINATION_P256) &&
2368             sec_level == BT_SECURITY_HIGH)
2369                 goto encrypt;
2370
2371         /* An unauthenticated combination key has sufficient security for
2372            security level 1 and 2. */
2373         if ((conn->key_type == HCI_LK_UNAUTH_COMBINATION_P192 ||
2374              conn->key_type == HCI_LK_UNAUTH_COMBINATION_P256) &&
2375             (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW))
2376                 goto encrypt;
2377
2378         /* A combination key has always sufficient security for the security
2379            levels 1 or 2. High security level requires the combination key
2380            is generated using maximum PIN code length (16).
2381            For pre 2.1 units. */
2382         if (conn->key_type == HCI_LK_COMBINATION &&
2383             (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW ||
2384              conn->pin_length == 16))
2385                 goto encrypt;
2386
2387 auth:
2388         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags))
2389                 return 0;
2390
2391         if (initiator)
2392                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
2393
2394         if (!hci_conn_auth(conn, sec_level, auth_type))
2395                 return 0;
2396
2397 encrypt:
2398         if (test_bit(HCI_CONN_ENCRYPT, &conn->flags)) {
2399                 /* Ensure that the encryption key size has been read,
2400                  * otherwise stall the upper layer responses.
2401                  */
2402                 if (!conn->enc_key_size)
2403                         return 0;
2404
2405                 /* Nothing else needed, all requirements are met */
2406                 return 1;
2407         }
2408
2409         hci_conn_encrypt(conn);
2410         return 0;
2411 }
2412 EXPORT_SYMBOL(hci_conn_security);
2413
2414 /* Check secure link requirement */
2415 int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level)
2416 {
2417         BT_DBG("hcon %p", conn);
2418
2419         /* Accept if non-secure or higher security level is required */
2420         if (sec_level != BT_SECURITY_HIGH && sec_level != BT_SECURITY_FIPS)
2421                 return 1;
2422
2423         /* Accept if secure or higher security level is already present */
2424         if (conn->sec_level == BT_SECURITY_HIGH ||
2425             conn->sec_level == BT_SECURITY_FIPS)
2426                 return 1;
2427
2428         /* Reject not secure link */
2429         return 0;
2430 }
2431 EXPORT_SYMBOL(hci_conn_check_secure);
2432
2433 /* Switch role */
2434 int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
2435 {
2436         BT_DBG("hcon %p", conn);
2437
2438         if (role == conn->role)
2439                 return 1;
2440
2441         if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->flags)) {
2442                 struct hci_cp_switch_role cp;
2443                 bacpy(&cp.bdaddr, &conn->dst);
2444                 cp.role = role;
2445                 hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
2446         }
2447
2448         return 0;
2449 }
2450 EXPORT_SYMBOL(hci_conn_switch_role);
2451
2452 /* Enter active mode */
2453 void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
2454 {
2455         struct hci_dev *hdev = conn->hdev;
2456
2457         BT_DBG("hcon %p mode %d", conn, conn->mode);
2458
2459         if (conn->mode != HCI_CM_SNIFF)
2460                 goto timer;
2461
2462         if (!test_bit(HCI_CONN_POWER_SAVE, &conn->flags) && !force_active)
2463                 goto timer;
2464
2465         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
2466                 struct hci_cp_exit_sniff_mode cp;
2467                 cp.handle = cpu_to_le16(conn->handle);
2468                 hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
2469         }
2470
2471 timer:
2472         if (hdev->idle_timeout > 0)
2473                 queue_delayed_work(hdev->workqueue, &conn->idle_work,
2474                                    msecs_to_jiffies(hdev->idle_timeout));
2475 }
2476
2477 /* Drop all connection on the device */
2478 void hci_conn_hash_flush(struct hci_dev *hdev)
2479 {
2480         struct hci_conn_hash *h = &hdev->conn_hash;
2481         struct hci_conn *c, *n;
2482
2483         BT_DBG("hdev %s", hdev->name);
2484
2485         list_for_each_entry_safe(c, n, &h->list, list) {
2486                 c->state = BT_CLOSED;
2487
2488                 hci_disconn_cfm(c, HCI_ERROR_LOCAL_HOST_TERM);
2489
2490                 /* Unlink before deleting otherwise it is possible that
2491                  * hci_conn_del removes the link which may cause the list to
2492                  * contain items already freed.
2493                  */
2494                 hci_conn_unlink(c);
2495                 hci_conn_del(c);
2496         }
2497 }
2498
2499 /* Check pending connect attempts */
2500 void hci_conn_check_pending(struct hci_dev *hdev)
2501 {
2502         struct hci_conn *conn;
2503
2504         BT_DBG("hdev %s", hdev->name);
2505
2506         hci_dev_lock(hdev);
2507
2508         conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
2509         if (conn)
2510                 hci_acl_create_connection(conn);
2511
2512         hci_dev_unlock(hdev);
2513 }
2514
2515 static u32 get_link_mode(struct hci_conn *conn)
2516 {
2517         u32 link_mode = 0;
2518
2519         if (conn->role == HCI_ROLE_MASTER)
2520                 link_mode |= HCI_LM_MASTER;
2521
2522         if (test_bit(HCI_CONN_ENCRYPT, &conn->flags))
2523                 link_mode |= HCI_LM_ENCRYPT;
2524
2525         if (test_bit(HCI_CONN_AUTH, &conn->flags))
2526                 link_mode |= HCI_LM_AUTH;
2527
2528         if (test_bit(HCI_CONN_SECURE, &conn->flags))
2529                 link_mode |= HCI_LM_SECURE;
2530
2531         if (test_bit(HCI_CONN_FIPS, &conn->flags))
2532                 link_mode |= HCI_LM_FIPS;
2533
2534         return link_mode;
2535 }
2536
2537 int hci_get_conn_list(void __user *arg)
2538 {
2539         struct hci_conn *c;
2540         struct hci_conn_list_req req, *cl;
2541         struct hci_conn_info *ci;
2542         struct hci_dev *hdev;
2543         int n = 0, size, err;
2544
2545         if (copy_from_user(&req, arg, sizeof(req)))
2546                 return -EFAULT;
2547
2548         if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
2549                 return -EINVAL;
2550
2551         size = sizeof(req) + req.conn_num * sizeof(*ci);
2552
2553         cl = kmalloc(size, GFP_KERNEL);
2554         if (!cl)
2555                 return -ENOMEM;
2556
2557         hdev = hci_dev_get(req.dev_id);
2558         if (!hdev) {
2559                 kfree(cl);
2560                 return -ENODEV;
2561         }
2562
2563         ci = cl->conn_info;
2564
2565         hci_dev_lock(hdev);
2566         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2567                 bacpy(&(ci + n)->bdaddr, &c->dst);
2568                 (ci + n)->handle = c->handle;
2569                 (ci + n)->type  = c->type;
2570                 (ci + n)->out   = c->out;
2571                 (ci + n)->state = c->state;
2572                 (ci + n)->link_mode = get_link_mode(c);
2573                 if (++n >= req.conn_num)
2574                         break;
2575         }
2576         hci_dev_unlock(hdev);
2577
2578         cl->dev_id = hdev->id;
2579         cl->conn_num = n;
2580         size = sizeof(req) + n * sizeof(*ci);
2581
2582         hci_dev_put(hdev);
2583
2584         err = copy_to_user(arg, cl, size);
2585         kfree(cl);
2586
2587         return err ? -EFAULT : 0;
2588 }
2589
2590 int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
2591 {
2592         struct hci_conn_info_req req;
2593         struct hci_conn_info ci;
2594         struct hci_conn *conn;
2595         char __user *ptr = arg + sizeof(req);
2596
2597         if (copy_from_user(&req, arg, sizeof(req)))
2598                 return -EFAULT;
2599
2600         hci_dev_lock(hdev);
2601         conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
2602         if (conn) {
2603                 bacpy(&ci.bdaddr, &conn->dst);
2604                 ci.handle = conn->handle;
2605                 ci.type  = conn->type;
2606                 ci.out   = conn->out;
2607                 ci.state = conn->state;
2608                 ci.link_mode = get_link_mode(conn);
2609         }
2610         hci_dev_unlock(hdev);
2611
2612         if (!conn)
2613                 return -ENOENT;
2614
2615         return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
2616 }
2617
2618 int hci_get_auth_info(struct hci_dev *hdev, void __user *arg)
2619 {
2620         struct hci_auth_info_req req;
2621         struct hci_conn *conn;
2622
2623         if (copy_from_user(&req, arg, sizeof(req)))
2624                 return -EFAULT;
2625
2626         hci_dev_lock(hdev);
2627         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr);
2628         if (conn)
2629                 req.type = conn->auth_type;
2630         hci_dev_unlock(hdev);
2631
2632         if (!conn)
2633                 return -ENOENT;
2634
2635         return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0;
2636 }
2637
2638 struct hci_chan *hci_chan_create(struct hci_conn *conn)
2639 {
2640         struct hci_dev *hdev = conn->hdev;
2641         struct hci_chan *chan;
2642
2643         BT_DBG("%s hcon %p", hdev->name, conn);
2644
2645         if (test_bit(HCI_CONN_DROP, &conn->flags)) {
2646                 BT_DBG("Refusing to create new hci_chan");
2647                 return NULL;
2648         }
2649
2650         chan = kzalloc(sizeof(*chan), GFP_KERNEL);
2651         if (!chan)
2652                 return NULL;
2653
2654         chan->conn = hci_conn_get(conn);
2655         skb_queue_head_init(&chan->data_q);
2656         chan->state = BT_CONNECTED;
2657
2658         list_add_rcu(&chan->list, &conn->chan_list);
2659
2660         return chan;
2661 }
2662
2663 void hci_chan_del(struct hci_chan *chan)
2664 {
2665         struct hci_conn *conn = chan->conn;
2666         struct hci_dev *hdev = conn->hdev;
2667
2668         BT_DBG("%s hcon %p chan %p", hdev->name, conn, chan);
2669
2670         list_del_rcu(&chan->list);
2671
2672         synchronize_rcu();
2673
2674         /* Prevent new hci_chan's to be created for this hci_conn */
2675         set_bit(HCI_CONN_DROP, &conn->flags);
2676
2677         hci_conn_put(conn);
2678
2679         skb_queue_purge(&chan->data_q);
2680         kfree(chan);
2681 }
2682
2683 void hci_chan_list_flush(struct hci_conn *conn)
2684 {
2685         struct hci_chan *chan, *n;
2686
2687         BT_DBG("hcon %p", conn);
2688
2689         list_for_each_entry_safe(chan, n, &conn->chan_list, list)
2690                 hci_chan_del(chan);
2691 }
2692
2693 static struct hci_chan *__hci_chan_lookup_handle(struct hci_conn *hcon,
2694                                                  __u16 handle)
2695 {
2696         struct hci_chan *hchan;
2697
2698         list_for_each_entry(hchan, &hcon->chan_list, list) {
2699                 if (hchan->handle == handle)
2700                         return hchan;
2701         }
2702
2703         return NULL;
2704 }
2705
2706 struct hci_chan *hci_chan_lookup_handle(struct hci_dev *hdev, __u16 handle)
2707 {
2708         struct hci_conn_hash *h = &hdev->conn_hash;
2709         struct hci_conn *hcon;
2710         struct hci_chan *hchan = NULL;
2711
2712         rcu_read_lock();
2713
2714         list_for_each_entry_rcu(hcon, &h->list, list) {
2715                 hchan = __hci_chan_lookup_handle(hcon, handle);
2716                 if (hchan)
2717                         break;
2718         }
2719
2720         rcu_read_unlock();
2721
2722         return hchan;
2723 }
2724
2725 u32 hci_conn_get_phy(struct hci_conn *conn)
2726 {
2727         u32 phys = 0;
2728
2729         /* BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 2, Part B page 471:
2730          * Table 6.2: Packets defined for synchronous, asynchronous, and
2731          * CPB logical transport types.
2732          */
2733         switch (conn->type) {
2734         case SCO_LINK:
2735                 /* SCO logical transport (1 Mb/s):
2736                  * HV1, HV2, HV3 and DV.
2737                  */
2738                 phys |= BT_PHY_BR_1M_1SLOT;
2739
2740                 break;
2741
2742         case ACL_LINK:
2743                 /* ACL logical transport (1 Mb/s) ptt=0:
2744                  * DH1, DM3, DH3, DM5 and DH5.
2745                  */
2746                 phys |= BT_PHY_BR_1M_1SLOT;
2747
2748                 if (conn->pkt_type & (HCI_DM3 | HCI_DH3))
2749                         phys |= BT_PHY_BR_1M_3SLOT;
2750
2751                 if (conn->pkt_type & (HCI_DM5 | HCI_DH5))
2752                         phys |= BT_PHY_BR_1M_5SLOT;
2753
2754                 /* ACL logical transport (2 Mb/s) ptt=1:
2755                  * 2-DH1, 2-DH3 and 2-DH5.
2756                  */
2757                 if (!(conn->pkt_type & HCI_2DH1))
2758                         phys |= BT_PHY_EDR_2M_1SLOT;
2759
2760                 if (!(conn->pkt_type & HCI_2DH3))
2761                         phys |= BT_PHY_EDR_2M_3SLOT;
2762
2763                 if (!(conn->pkt_type & HCI_2DH5))
2764                         phys |= BT_PHY_EDR_2M_5SLOT;
2765
2766                 /* ACL logical transport (3 Mb/s) ptt=1:
2767                  * 3-DH1, 3-DH3 and 3-DH5.
2768                  */
2769                 if (!(conn->pkt_type & HCI_3DH1))
2770                         phys |= BT_PHY_EDR_3M_1SLOT;
2771
2772                 if (!(conn->pkt_type & HCI_3DH3))
2773                         phys |= BT_PHY_EDR_3M_3SLOT;
2774
2775                 if (!(conn->pkt_type & HCI_3DH5))
2776                         phys |= BT_PHY_EDR_3M_5SLOT;
2777
2778                 break;
2779
2780         case ESCO_LINK:
2781                 /* eSCO logical transport (1 Mb/s): EV3, EV4 and EV5 */
2782                 phys |= BT_PHY_BR_1M_1SLOT;
2783
2784                 if (!(conn->pkt_type & (ESCO_EV4 | ESCO_EV5)))
2785                         phys |= BT_PHY_BR_1M_3SLOT;
2786
2787                 /* eSCO logical transport (2 Mb/s): 2-EV3, 2-EV5 */
2788                 if (!(conn->pkt_type & ESCO_2EV3))
2789                         phys |= BT_PHY_EDR_2M_1SLOT;
2790
2791                 if (!(conn->pkt_type & ESCO_2EV5))
2792                         phys |= BT_PHY_EDR_2M_3SLOT;
2793
2794                 /* eSCO logical transport (3 Mb/s): 3-EV3, 3-EV5 */
2795                 if (!(conn->pkt_type & ESCO_3EV3))
2796                         phys |= BT_PHY_EDR_3M_1SLOT;
2797
2798                 if (!(conn->pkt_type & ESCO_3EV5))
2799                         phys |= BT_PHY_EDR_3M_3SLOT;
2800
2801                 break;
2802
2803         case LE_LINK:
2804                 if (conn->le_tx_phy & HCI_LE_SET_PHY_1M)
2805                         phys |= BT_PHY_LE_1M_TX;
2806
2807                 if (conn->le_rx_phy & HCI_LE_SET_PHY_1M)
2808                         phys |= BT_PHY_LE_1M_RX;
2809
2810                 if (conn->le_tx_phy & HCI_LE_SET_PHY_2M)
2811                         phys |= BT_PHY_LE_2M_TX;
2812
2813                 if (conn->le_rx_phy & HCI_LE_SET_PHY_2M)
2814                         phys |= BT_PHY_LE_2M_RX;
2815
2816                 if (conn->le_tx_phy & HCI_LE_SET_PHY_CODED)
2817                         phys |= BT_PHY_LE_CODED_TX;
2818
2819                 if (conn->le_rx_phy & HCI_LE_SET_PHY_CODED)
2820                         phys |= BT_PHY_LE_CODED_RX;
2821
2822                 break;
2823         }
2824
2825         return phys;
2826 }
2827
2828 int hci_abort_conn(struct hci_conn *conn, u8 reason)
2829 {
2830         int r = 0;
2831
2832         if (test_and_set_bit(HCI_CONN_CANCEL, &conn->flags))
2833                 return 0;
2834
2835         switch (conn->state) {
2836         case BT_CONNECTED:
2837         case BT_CONFIG:
2838                 if (conn->type == AMP_LINK) {
2839                         struct hci_cp_disconn_phy_link cp;
2840
2841                         cp.phy_handle = HCI_PHY_HANDLE(conn->handle);
2842                         cp.reason = reason;
2843                         r = hci_send_cmd(conn->hdev, HCI_OP_DISCONN_PHY_LINK,
2844                                          sizeof(cp), &cp);
2845                 } else {
2846                         struct hci_cp_disconnect dc;
2847
2848                         dc.handle = cpu_to_le16(conn->handle);
2849                         dc.reason = reason;
2850                         r = hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT,
2851                                          sizeof(dc), &dc);
2852                 }
2853
2854                 conn->state = BT_DISCONN;
2855
2856                 break;
2857         case BT_CONNECT:
2858                 if (conn->type == LE_LINK) {
2859                         if (test_bit(HCI_CONN_SCANNING, &conn->flags))
2860                                 break;
2861                         r = hci_send_cmd(conn->hdev,
2862                                          HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL);
2863                 } else if (conn->type == ACL_LINK) {
2864                         if (conn->hdev->hci_ver < BLUETOOTH_VER_1_2)
2865                                 break;
2866                         r = hci_send_cmd(conn->hdev,
2867                                          HCI_OP_CREATE_CONN_CANCEL,
2868                                          6, &conn->dst);
2869                 }
2870                 break;
2871         case BT_CONNECT2:
2872                 if (conn->type == ACL_LINK) {
2873                         struct hci_cp_reject_conn_req rej;
2874
2875                         bacpy(&rej.bdaddr, &conn->dst);
2876                         rej.reason = reason;
2877
2878                         r = hci_send_cmd(conn->hdev,
2879                                          HCI_OP_REJECT_CONN_REQ,
2880                                          sizeof(rej), &rej);
2881                 } else if (conn->type == SCO_LINK || conn->type == ESCO_LINK) {
2882                         struct hci_cp_reject_sync_conn_req rej;
2883
2884                         bacpy(&rej.bdaddr, &conn->dst);
2885
2886                         /* SCO rejection has its own limited set of
2887                          * allowed error values (0x0D-0x0F) which isn't
2888                          * compatible with most values passed to this
2889                          * function. To be safe hard-code one of the
2890                          * values that's suitable for SCO.
2891                          */
2892                         rej.reason = HCI_ERROR_REJ_LIMITED_RESOURCES;
2893
2894                         r = hci_send_cmd(conn->hdev,
2895                                          HCI_OP_REJECT_SYNC_CONN_REQ,
2896                                          sizeof(rej), &rej);
2897                 }
2898                 break;
2899         default:
2900                 conn->state = BT_CLOSED;
2901                 break;
2902         }
2903
2904         return r;
2905 }