1	/*
2	BlueZ - Bluetooth protocol stack for Linux
3	Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
4	Copyright 2023-2024 NXP
5
6	Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
7
8	This program is free software; you can redistribute it and/or modify
9	it under the terms of the GNU General Public License version 2 as
10	published by the Free Software Foundation;
11
12	THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
13	OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
14	FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
15	IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
16	CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
17	WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
18	ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
19	OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20
21	ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
22	COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
23	SOFTWARE IS DISCLAIMED.
24	*/
25
26	/* Bluetooth HCI connection handling. */
27
28	#include <linux/export.h>
29	#include <linux/debugfs.h>
30
31	#include <net/bluetooth/bluetooth.h>
32	#include <net/bluetooth/hci_core.h>
33	#include <net/bluetooth/l2cap.h>
34	#include <net/bluetooth/iso.h>
35	#include <net/bluetooth/mgmt.h>
36
37	#include "hci_request.h"
38	#include "smp.h"
39	#include "eir.h"
40
41	struct sco_param {
42	u16 pkt_type;
43	u16 max_latency;
44	u8 retrans_effort;
45	};
46
47	struct conn_handle_t {
48	struct hci_conn *conn;
49	__u16 handle;
50	};
51
52	static const struct sco_param esco_param_cvsd[] = {
53	{ EDR_ESCO_MASK & ~ESCO_2EV3, 0x000a, 0x01 }, /* S3 */
54	{ EDR_ESCO_MASK & ~ESCO_2EV3, 0x0007, 0x01 }, /* S2 */
55	{ EDR_ESCO_MASK | ESCO_EV3, 0x0007, 0x01 }, /* S1 */
56	{ EDR_ESCO_MASK | ESCO_HV3, 0xffff, 0x01 }, /* D1 */
57	{ EDR_ESCO_MASK | ESCO_HV1, 0xffff, 0x01 }, /* D0 */
58	};
59
60	static const struct sco_param sco_param_cvsd[] = {
61	{ EDR_ESCO_MASK | ESCO_HV3, 0xffff, 0xff }, /* D1 */
62	{ EDR_ESCO_MASK | ESCO_HV1, 0xffff, 0xff }, /* D0 */
63	};
64
65	static const struct sco_param esco_param_msbc[] = {
66	{ EDR_ESCO_MASK & ~ESCO_2EV3, 0x000d, 0x02 }, /* T2 */
67	{ EDR_ESCO_MASK | ESCO_EV3, 0x0008, 0x02 }, /* T1 */
68	};
69
70	/* This function requires the caller holds hdev->lock */
71	void hci_connect_le_scan_cleanup(struct hci_conn *conn, u8 status)
72	{
73	struct hci_conn_params *params;
74	struct hci_dev *hdev = conn->hdev;
75	struct smp_irk *irk;
76	bdaddr_t *bdaddr;
77	u8 bdaddr_type;
78
79	bdaddr = &conn->dst;
80	bdaddr_type = conn->dst_type;
81
82	/* Check if we need to convert to identity address */
83	irk = hci_get_irk(hdev, bdaddr, addr_type: bdaddr_type);
84	if (irk) {
85	bdaddr = &irk->bdaddr;
86	bdaddr_type = irk->addr_type;
87	}
88
89	params = hci_pend_le_action_lookup(list: &hdev->pend_le_conns, addr: bdaddr,
90	addr_type: bdaddr_type);
91	if (!params)
92	return;
93
94	if (params->conn) {
95	hci_conn_drop(conn: params->conn);
96	hci_conn_put(conn: params->conn);
97	params->conn = NULL;
98	}
99
100	if (!params->explicit_connect)
101	return;
102
103	/* If the status indicates successful cancellation of
104	* the attempt (i.e. Unknown Connection Id) there's no point of
105	* notifying failure since we'll go back to keep trying to
106	* connect. The only exception is explicit connect requests
107	* where a timeout + cancel does indicate an actual failure.
108	*/
109	if (status && status != HCI_ERROR_UNKNOWN_CONN_ID)
110	mgmt_connect_failed(hdev, bdaddr: &conn->dst, link_type: conn->type,
111	addr_type: conn->dst_type, status);
112
113	/* The connection attempt was doing scan for new RPA, and is
114	* in scan phase. If params are not associated with any other
115	* autoconnect action, remove them completely. If they are, just unmark
116	* them as waiting for connection, by clearing explicit_connect field.
117	*/
118	params->explicit_connect = false;
119
120	hci_pend_le_list_del_init(param: params);
121
122	switch (params->auto_connect) {
123	case HCI_AUTO_CONN_EXPLICIT:
124	hci_conn_params_del(hdev, addr: bdaddr, addr_type: bdaddr_type);
125	/* return instead of break to avoid duplicate scan update */
126	return;
127	case HCI_AUTO_CONN_DIRECT:
128	case HCI_AUTO_CONN_ALWAYS:
129	hci_pend_le_list_add(param: params, list: &hdev->pend_le_conns);
130	break;
131	case HCI_AUTO_CONN_REPORT:
132	hci_pend_le_list_add(param: params, list: &hdev->pend_le_reports);
133	break;
134	default:
135	break;
136	}
137
138	hci_update_passive_scan(hdev);
139	}
140
141	static void hci_conn_cleanup(struct hci_conn *conn)
142	{
143	struct hci_dev *hdev = conn->hdev;
144
145	if (test_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags))
146	hci_conn_params_del(hdev: conn->hdev, addr: &conn->dst, addr_type: conn->dst_type);
147
148	if (test_and_clear_bit(nr: HCI_CONN_FLUSH_KEY, addr: &conn->flags))
149	hci_remove_link_key(hdev, bdaddr: &conn->dst);
150
151	hci_chan_list_flush(conn);
152
153	hci_conn_hash_del(hdev, c: conn);
154
155	if (HCI_CONN_HANDLE_UNSET(conn->handle))
156	ida_free(&hdev->unset_handle_ida, id: conn->handle);
157
158	if (conn->cleanup)
159	conn->cleanup(conn);
160
161	if (conn->type == SCO_LINK || conn->type == ESCO_LINK) {
162	switch (conn->setting & SCO_AIRMODE_MASK) {
163	case SCO_AIRMODE_CVSD:
164	case SCO_AIRMODE_TRANSP:
165	if (hdev->notify)
166	hdev->notify(hdev, HCI_NOTIFY_DISABLE_SCO);
167	break;
168	}
169	} else {
170	if (hdev->notify)
171	hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
172	}
173
174	debugfs_remove_recursive(dentry: conn->debugfs);
175
176	hci_conn_del_sysfs(conn);
177
178	hci_dev_put(d: hdev);
179	}
180
181	int hci_disconnect(struct hci_conn *conn, __u8 reason)
182	{
183	BT_DBG("hcon %p", conn);
184
185	/* When we are central of an established connection and it enters
186	* the disconnect timeout, then go ahead and try to read the
187	* current clock offset. Processing of the result is done
188	* within the event handling and hci_clock_offset_evt function.
189	*/
190	if (conn->type == ACL_LINK && conn->role == HCI_ROLE_MASTER &&
191	(conn->state == BT_CONNECTED || conn->state == BT_CONFIG)) {
192	struct hci_dev *hdev = conn->hdev;
193	struct hci_cp_read_clock_offset clkoff_cp;
194
195	clkoff_cp.handle = cpu_to_le16(conn->handle);
196	hci_send_cmd(hdev, HCI_OP_READ_CLOCK_OFFSET, plen: sizeof(clkoff_cp),
197	param: &clkoff_cp);
198	}
199
200	return hci_abort_conn(conn, reason);
201	}
202
203	static void hci_add_sco(struct hci_conn *conn, __u16 handle)
204	{
205	struct hci_dev *hdev = conn->hdev;
206	struct hci_cp_add_sco cp;
207
208	BT_DBG("hcon %p", conn);
209
210	conn->state = BT_CONNECT;
211	conn->out = true;
212
213	conn->attempt++;
214
215	cp.handle = cpu_to_le16(handle);
216	cp.pkt_type = cpu_to_le16(conn->pkt_type);
217
218	hci_send_cmd(hdev, HCI_OP_ADD_SCO, plen: sizeof(cp), param: &cp);
219	}
220
221	static bool find_next_esco_param(struct hci_conn *conn,
222	const struct sco_param *esco_param, int size)
223	{
224	if (!conn->parent)
225	return false;
226
227	for (; conn->attempt <= size; conn->attempt++) {
228	if (lmp_esco_2m_capable(conn->parent) ||
229	(esco_param[conn->attempt - 1].pkt_type & ESCO_2EV3))
230	break;
231	BT_DBG("hcon %p skipped attempt %d, eSCO 2M not supported",
232	conn, conn->attempt);
233	}
234
235	return conn->attempt <= size;
236	}
237
238	static int configure_datapath_sync(struct hci_dev *hdev, struct bt_codec *codec)
239	{
240	int err;
241	__u8 vnd_len, *vnd_data = NULL;
242	struct hci_op_configure_data_path *cmd = NULL;
243
244	if (!codec->data_path || !hdev->get_codec_config_data)
245	return 0;
246
247	/* Do not take me as error */
248	if (!hdev->get_codec_config_data)
249	return 0;
250
251	err = hdev->get_codec_config_data(hdev, ESCO_LINK, codec, &vnd_len,
252	&vnd_data);
253	if (err < 0)
254	goto error;
255
256	cmd = kzalloc(size: sizeof(*cmd) + vnd_len, GFP_KERNEL);
257	if (!cmd) {
258	err = -ENOMEM;
259	goto error;
260	}
261
262	err = hdev->get_data_path_id(hdev, &cmd->data_path_id);
263	if (err < 0)
264	goto error;
265
266	cmd->vnd_len = vnd_len;
267	memcpy(cmd->vnd_data, vnd_data, vnd_len);
268
269	cmd->direction = 0x00;
270	__hci_cmd_sync_status(hdev, HCI_CONFIGURE_DATA_PATH,
271	plen: sizeof(*cmd) + vnd_len, param: cmd, HCI_CMD_TIMEOUT);
272
273	cmd->direction = 0x01;
274	err = __hci_cmd_sync_status(hdev, HCI_CONFIGURE_DATA_PATH,
275	plen: sizeof(*cmd) + vnd_len, param: cmd,
276	HCI_CMD_TIMEOUT);
277	error:
278
279	kfree(objp: cmd);
280	kfree(objp: vnd_data);
281	return err;
282	}
283
284	static int hci_enhanced_setup_sync(struct hci_dev *hdev, void *data)
285	{
286	struct conn_handle_t *conn_handle = data;
287	struct hci_conn *conn = conn_handle->conn;
288	__u16 handle = conn_handle->handle;
289	struct hci_cp_enhanced_setup_sync_conn cp;
290	const struct sco_param *param;
291
292	kfree(objp: conn_handle);
293
294	bt_dev_dbg(hdev, "hcon %p", conn);
295
296	configure_datapath_sync(hdev, codec: &conn->codec);
297
298	conn->state = BT_CONNECT;
299	conn->out = true;
300
301	conn->attempt++;
302
303	memset(&cp, 0x00, sizeof(cp));
304
305	cp.handle = cpu_to_le16(handle);
306
307	cp.tx_bandwidth = cpu_to_le32(0x00001f40);
308	cp.rx_bandwidth = cpu_to_le32(0x00001f40);
309
310	switch (conn->codec.id) {
311	case BT_CODEC_MSBC:
312	if (!find_next_esco_param(conn, esco_param: esco_param_msbc,
313	ARRAY_SIZE(esco_param_msbc)))
314	return -EINVAL;
315
316	param = &esco_param_msbc[conn->attempt - 1];
317	cp.tx_coding_format.id = 0x05;
318	cp.rx_coding_format.id = 0x05;
319	cp.tx_codec_frame_size = __cpu_to_le16(60);
320	cp.rx_codec_frame_size = __cpu_to_le16(60);
321	cp.in_bandwidth = __cpu_to_le32(32000);
322	cp.out_bandwidth = __cpu_to_le32(32000);
323	cp.in_coding_format.id = 0x04;
324	cp.out_coding_format.id = 0x04;
325	cp.in_coded_data_size = __cpu_to_le16(16);
326	cp.out_coded_data_size = __cpu_to_le16(16);
327	cp.in_pcm_data_format = 2;
328	cp.out_pcm_data_format = 2;
329	cp.in_pcm_sample_payload_msb_pos = 0;
330	cp.out_pcm_sample_payload_msb_pos = 0;
331	cp.in_data_path = conn->codec.data_path;
332	cp.out_data_path = conn->codec.data_path;
333	cp.in_transport_unit_size = 1;
334	cp.out_transport_unit_size = 1;
335	break;
336
337	case BT_CODEC_TRANSPARENT:
338	if (!find_next_esco_param(conn, esco_param: esco_param_msbc,
339	ARRAY_SIZE(esco_param_msbc)))
340	return false;
341	param = &esco_param_msbc[conn->attempt - 1];
342	cp.tx_coding_format.id = 0x03;
343	cp.rx_coding_format.id = 0x03;
344	cp.tx_codec_frame_size = __cpu_to_le16(60);
345	cp.rx_codec_frame_size = __cpu_to_le16(60);
346	cp.in_bandwidth = __cpu_to_le32(0x1f40);
347	cp.out_bandwidth = __cpu_to_le32(0x1f40);
348	cp.in_coding_format.id = 0x03;
349	cp.out_coding_format.id = 0x03;
350	cp.in_coded_data_size = __cpu_to_le16(16);
351	cp.out_coded_data_size = __cpu_to_le16(16);
352	cp.in_pcm_data_format = 2;
353	cp.out_pcm_data_format = 2;
354	cp.in_pcm_sample_payload_msb_pos = 0;
355	cp.out_pcm_sample_payload_msb_pos = 0;
356	cp.in_data_path = conn->codec.data_path;
357	cp.out_data_path = conn->codec.data_path;
358	cp.in_transport_unit_size = 1;
359	cp.out_transport_unit_size = 1;
360	break;
361
362	case BT_CODEC_CVSD:
363	if (conn->parent && lmp_esco_capable(conn->parent)) {
364	if (!find_next_esco_param(conn, esco_param: esco_param_cvsd,
365	ARRAY_SIZE(esco_param_cvsd)))
366	return -EINVAL;
367	param = &esco_param_cvsd[conn->attempt - 1];
368	} else {
369	if (conn->attempt > ARRAY_SIZE(sco_param_cvsd))
370	return -EINVAL;
371	param = &sco_param_cvsd[conn->attempt - 1];
372	}
373	cp.tx_coding_format.id = 2;
374	cp.rx_coding_format.id = 2;
375	cp.tx_codec_frame_size = __cpu_to_le16(60);
376	cp.rx_codec_frame_size = __cpu_to_le16(60);
377	cp.in_bandwidth = __cpu_to_le32(16000);
378	cp.out_bandwidth = __cpu_to_le32(16000);
379	cp.in_coding_format.id = 4;
380	cp.out_coding_format.id = 4;
381	cp.in_coded_data_size = __cpu_to_le16(16);
382	cp.out_coded_data_size = __cpu_to_le16(16);
383	cp.in_pcm_data_format = 2;
384	cp.out_pcm_data_format = 2;
385	cp.in_pcm_sample_payload_msb_pos = 0;
386	cp.out_pcm_sample_payload_msb_pos = 0;
387	cp.in_data_path = conn->codec.data_path;
388	cp.out_data_path = conn->codec.data_path;
389	cp.in_transport_unit_size = 16;
390	cp.out_transport_unit_size = 16;
391	break;
392	default:
393	return -EINVAL;
394	}
395
396	cp.retrans_effort = param->retrans_effort;
397	cp.pkt_type = __cpu_to_le16(param->pkt_type);
398	cp.max_latency = __cpu_to_le16(param->max_latency);
399
400	if (hci_send_cmd(hdev, HCI_OP_ENHANCED_SETUP_SYNC_CONN, plen: sizeof(cp), param: &cp) < 0)
401	return -EIO;
402
403	return 0;
404	}
405
406	static bool hci_setup_sync_conn(struct hci_conn *conn, __u16 handle)
407	{
408	struct hci_dev *hdev = conn->hdev;
409	struct hci_cp_setup_sync_conn cp;
410	const struct sco_param *param;
411
412	bt_dev_dbg(hdev, "hcon %p", conn);
413
414	conn->state = BT_CONNECT;
415	conn->out = true;
416
417	conn->attempt++;
418
419	cp.handle = cpu_to_le16(handle);
420
421	cp.tx_bandwidth = cpu_to_le32(0x00001f40);
422	cp.rx_bandwidth = cpu_to_le32(0x00001f40);
423	cp.voice_setting = cpu_to_le16(conn->setting);
424
425	switch (conn->setting & SCO_AIRMODE_MASK) {
426	case SCO_AIRMODE_TRANSP:
427	if (!find_next_esco_param(conn, esco_param: esco_param_msbc,
428	ARRAY_SIZE(esco_param_msbc)))
429	return false;
430	param = &esco_param_msbc[conn->attempt - 1];
431	break;
432	case SCO_AIRMODE_CVSD:
433	if (conn->parent && lmp_esco_capable(conn->parent)) {
434	if (!find_next_esco_param(conn, esco_param: esco_param_cvsd,
435	ARRAY_SIZE(esco_param_cvsd)))
436	return false;
437	param = &esco_param_cvsd[conn->attempt - 1];
438	} else {
439	if (conn->attempt > ARRAY_SIZE(sco_param_cvsd))
440	return false;
441	param = &sco_param_cvsd[conn->attempt - 1];
442	}
443	break;
444	default:
445	return false;
446	}
447
448	cp.retrans_effort = param->retrans_effort;
449	cp.pkt_type = __cpu_to_le16(param->pkt_type);
450	cp.max_latency = __cpu_to_le16(param->max_latency);
451
452	if (hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, plen: sizeof(cp), param: &cp) < 0)
453	return false;
454
455	return true;
456	}
457
458	bool hci_setup_sync(struct hci_conn *conn, __u16 handle)
459	{
460	int result;
461	struct conn_handle_t *conn_handle;
462
463	if (enhanced_sync_conn_capable(conn->hdev)) {
464	conn_handle = kzalloc(size: sizeof(*conn_handle), GFP_KERNEL);
465
466	if (!conn_handle)
467	return false;
468
469	conn_handle->conn = conn;
470	conn_handle->handle = handle;
471	result = hci_cmd_sync_queue(hdev: conn->hdev, func: hci_enhanced_setup_sync,
472	data: conn_handle, NULL);
473	if (result < 0)
474	kfree(objp: conn_handle);
475
476	return result == 0;
477	}
478
479	return hci_setup_sync_conn(conn, handle);
480	}
481
482	u8 hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max, u16 latency,
483	u16 to_multiplier)
484	{
485	struct hci_dev *hdev = conn->hdev;
486	struct hci_conn_params *params;
487	struct hci_cp_le_conn_update cp;
488
489	hci_dev_lock(hdev);
490
491	params = hci_conn_params_lookup(hdev, addr: &conn->dst, addr_type: conn->dst_type);
492	if (params) {
493	params->conn_min_interval = min;
494	params->conn_max_interval = max;
495	params->conn_latency = latency;
496	params->supervision_timeout = to_multiplier;
497	}
498
499	hci_dev_unlock(hdev);
500
501	memset(&cp, 0, sizeof(cp));
502	cp.handle = cpu_to_le16(conn->handle);
503	cp.conn_interval_min = cpu_to_le16(min);
504	cp.conn_interval_max = cpu_to_le16(max);
505	cp.conn_latency = cpu_to_le16(latency);
506	cp.supervision_timeout = cpu_to_le16(to_multiplier);
507	cp.min_ce_len = cpu_to_le16(0x0000);
508	cp.max_ce_len = cpu_to_le16(0x0000);
509
510	hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, plen: sizeof(cp), param: &cp);
511
512	if (params)
513	return 0x01;
514
515	return 0x00;
516	}
517
518	void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __le64 rand,
519	__u8 ltk[16], __u8 key_size)
520	{
521	struct hci_dev *hdev = conn->hdev;
522	struct hci_cp_le_start_enc cp;
523
524	BT_DBG("hcon %p", conn);
525
526	memset(&cp, 0, sizeof(cp));
527
528	cp.handle = cpu_to_le16(conn->handle);
529	cp.rand = rand;
530	cp.ediv = ediv;
531	memcpy(cp.ltk, ltk, key_size);
532
533	hci_send_cmd(hdev, HCI_OP_LE_START_ENC, plen: sizeof(cp), param: &cp);
534	}
535
536	/* Device _must_ be locked */
537	void hci_sco_setup(struct hci_conn *conn, __u8 status)
538	{
539	struct hci_link *link;
540
541	link = list_first_entry_or_null(&conn->link_list, struct hci_link, list);
542	if (!link || !link->conn)
543	return;
544
545	BT_DBG("hcon %p", conn);
546
547	if (!status) {
548	if (lmp_esco_capable(conn->hdev))
549	hci_setup_sync(conn: link->conn, handle: conn->handle);
550	else
551	hci_add_sco(conn: link->conn, handle: conn->handle);
552	} else {
553	hci_connect_cfm(conn: link->conn, status);
554	hci_conn_del(conn: link->conn);
555	}
556	}
557
558	static void hci_conn_timeout(struct work_struct *work)
559	{
560	struct hci_conn *conn = container_of(work, struct hci_conn,
561	disc_work.work);
562	int refcnt = atomic_read(v: &conn->refcnt);
563
564	BT_DBG("hcon %p state %s", conn, state_to_string(conn->state));
565
566	WARN_ON(refcnt < 0);
567
568	/* FIXME: It was observed that in pairing failed scenario, refcnt
569	* drops below 0. Probably this is because l2cap_conn_del calls
570	* l2cap_chan_del for each channel, and inside l2cap_chan_del conn is
571	* dropped. After that loop hci_chan_del is called which also drops
572	* conn. For now make sure that ACL is alive if refcnt is higher then 0,
573	* otherwise drop it.
574	*/
575	if (refcnt > 0)
576	return;
577
578	hci_abort_conn(conn, reason: hci_proto_disconn_ind(conn));
579	}
580
581	/* Enter sniff mode */
582	static void hci_conn_idle(struct work_struct *work)
583	{
584	struct hci_conn *conn = container_of(work, struct hci_conn,
585	idle_work.work);
586	struct hci_dev *hdev = conn->hdev;
587
588	BT_DBG("hcon %p mode %d", conn, conn->mode);
589
590	if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn))
591	return;
592
593	if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF))
594	return;
595
596	if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
597	struct hci_cp_sniff_subrate cp;
598	cp.handle = cpu_to_le16(conn->handle);
599	cp.max_latency = cpu_to_le16(0);
600	cp.min_remote_timeout = cpu_to_le16(0);
601	cp.min_local_timeout = cpu_to_le16(0);
602	hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, plen: sizeof(cp), param: &cp);
603	}
604
605	if (!test_and_set_bit(nr: HCI_CONN_MODE_CHANGE_PEND, addr: &conn->flags)) {
606	struct hci_cp_sniff_mode cp;
607	cp.handle = cpu_to_le16(conn->handle);
608	cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
609	cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
610	cp.attempt = cpu_to_le16(4);
611	cp.timeout = cpu_to_le16(1);
612	hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, plen: sizeof(cp), param: &cp);
613	}
614	}
615
616	static void hci_conn_auto_accept(struct work_struct *work)
617	{
618	struct hci_conn *conn = container_of(work, struct hci_conn,
619	auto_accept_work.work);
620
621	hci_send_cmd(hdev: conn->hdev, HCI_OP_USER_CONFIRM_REPLY, plen: sizeof(conn->dst),
622	param: &conn->dst);
623	}
624
625	static void le_disable_advertising(struct hci_dev *hdev)
626	{
627	if (ext_adv_capable(hdev)) {
628	struct hci_cp_le_set_ext_adv_enable cp;
629
630	cp.enable = 0x00;
631	cp.num_of_sets = 0x00;
632
633	hci_send_cmd(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE, plen: sizeof(cp),
634	param: &cp);
635	} else {
636	u8 enable = 0x00;
637	hci_send_cmd(hdev, HCI_OP_LE_SET_ADV_ENABLE, plen: sizeof(enable),
638	param: &enable);
639	}
640	}
641
642	static void le_conn_timeout(struct work_struct *work)
643	{
644	struct hci_conn *conn = container_of(work, struct hci_conn,
645	le_conn_timeout.work);
646	struct hci_dev *hdev = conn->hdev;
647
648	BT_DBG("");
649
650	/* We could end up here due to having done directed advertising,
651	* so clean up the state if necessary. This should however only
652	* happen with broken hardware or if low duty cycle was used
653	* (which doesn't have a timeout of its own).
654	*/
655	if (conn->role == HCI_ROLE_SLAVE) {
656	/* Disable LE Advertising */
657	le_disable_advertising(hdev);
658	hci_dev_lock(hdev);
659	hci_conn_failed(conn, HCI_ERROR_ADVERTISING_TIMEOUT);
660	hci_dev_unlock(hdev);
661	return;
662	}
663
664	hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
665	}
666
667	struct iso_cig_params {
668	struct hci_cp_le_set_cig_params cp;
669	struct hci_cis_params cis[0x1f];
670	};
671
672	struct iso_list_data {
673	union {
674	u8 cig;
675	u8 big;
676	};
677	union {
678	u8 cis;
679	u8 bis;
680	u16 sync_handle;
681	};
682	int count;
683	bool big_term;
684	bool pa_sync_term;
685	bool big_sync_term;
686	};
687
688	static void bis_list(struct hci_conn *conn, void *data)
689	{
690	struct iso_list_data *d = data;
691
692	/* Skip if not broadcast/ANY address */
693	if (bacmp(ba1: &conn->dst, BDADDR_ANY))
694	return;
695
696	if (d->big != conn->iso_qos.bcast.big || d->bis == BT_ISO_QOS_BIS_UNSET ||
697	d->bis != conn->iso_qos.bcast.bis)
698	return;
699
700	d->count++;
701	}
702
703	static int terminate_big_sync(struct hci_dev *hdev, void *data)
704	{
705	struct iso_list_data *d = data;
706
707	bt_dev_dbg(hdev, "big 0x%2.2x bis 0x%2.2x", d->big, d->bis);
708
709	hci_disable_per_advertising_sync(hdev, instance: d->bis);
710	hci_remove_ext_adv_instance_sync(hdev, instance: d->bis, NULL);
711
712	/* Only terminate BIG if it has been created */
713	if (!d->big_term)
714	return 0;
715
716	return hci_le_terminate_big_sync(hdev, handle: d->big,
717	HCI_ERROR_LOCAL_HOST_TERM);
718	}
719
720	static void terminate_big_destroy(struct hci_dev *hdev, void *data, int err)
721	{
722	kfree(objp: data);
723	}
724
725	static int hci_le_terminate_big(struct hci_dev *hdev, struct hci_conn *conn)
726	{
727	struct iso_list_data *d;
728	int ret;
729
730	bt_dev_dbg(hdev, "big 0x%2.2x bis 0x%2.2x", conn->iso_qos.bcast.big,
731	conn->iso_qos.bcast.bis);
732
733	d = kzalloc(size: sizeof(*d), GFP_KERNEL);
734	if (!d)
735	return -ENOMEM;
736
737	d->big = conn->iso_qos.bcast.big;
738	d->bis = conn->iso_qos.bcast.bis;
739	d->big_term = test_and_clear_bit(nr: HCI_CONN_BIG_CREATED, addr: &conn->flags);
740
741	ret = hci_cmd_sync_queue(hdev, func: terminate_big_sync, data: d,
742	destroy: terminate_big_destroy);
743	if (ret)
744	kfree(objp: d);
745
746	return ret;
747	}
748
749	static int big_terminate_sync(struct hci_dev *hdev, void *data)
750	{
751	struct iso_list_data *d = data;
752
753	bt_dev_dbg(hdev, "big 0x%2.2x sync_handle 0x%4.4x", d->big,
754	d->sync_handle);
755
756	if (d->big_sync_term)
757	hci_le_big_terminate_sync(hdev, handle: d->big);
758
759	if (d->pa_sync_term)
760	return hci_le_pa_terminate_sync(hdev, handle: d->sync_handle);
761
762	return 0;
763	}
764
765	static void find_bis(struct hci_conn *conn, void *data)
766	{
767	struct iso_list_data *d = data;
768
769	/* Ignore if BIG doesn't match */
770	if (d->big != conn->iso_qos.bcast.big)
771	return;
772
773	d->count++;
774	}
775
776	static int hci_le_big_terminate(struct hci_dev *hdev, u8 big, struct hci_conn *conn)
777	{
778	struct iso_list_data *d;
779	int ret;
780
781	bt_dev_dbg(hdev, "big 0x%2.2x sync_handle 0x%4.4x", big, conn->sync_handle);
782
783	d = kzalloc(size: sizeof(*d), GFP_KERNEL);
784	if (!d)
785	return -ENOMEM;
786
787	memset(d, 0, sizeof(*d));
788	d->big = big;
789	d->sync_handle = conn->sync_handle;
790
791	if (test_and_clear_bit(nr: HCI_CONN_PA_SYNC, addr: &conn->flags)) {
792	hci_conn_hash_list_flag(hdev, func: find_bis, ISO_LINK,
793	flag: HCI_CONN_PA_SYNC, data: d);
794
795	if (!d->count)
796	d->pa_sync_term = true;
797
798	d->count = 0;
799	}
800
801	if (test_and_clear_bit(nr: HCI_CONN_BIG_SYNC, addr: &conn->flags)) {
802	hci_conn_hash_list_flag(hdev, func: find_bis, ISO_LINK,
803	flag: HCI_CONN_BIG_SYNC, data: d);
804
805	if (!d->count)
806	d->big_sync_term = true;
807	}
808
809	ret = hci_cmd_sync_queue(hdev, func: big_terminate_sync, data: d,
810	destroy: terminate_big_destroy);
811	if (ret)
812	kfree(objp: d);
813
814	return ret;
815	}
816
817	/* Cleanup BIS connection
818	*
819	* Detects if there any BIS left connected in a BIG
820	* broadcaster: Remove advertising instance and terminate BIG.
821	* broadcaster receiver: Teminate BIG sync and terminate PA sync.
822	*/
823	static void bis_cleanup(struct hci_conn *conn)
824	{
825	struct hci_dev *hdev = conn->hdev;
826	struct hci_conn *bis;
827
828	bt_dev_dbg(hdev, "conn %p", conn);
829
830	if (conn->role == HCI_ROLE_MASTER) {
831	if (!test_and_clear_bit(nr: HCI_CONN_PER_ADV, addr: &conn->flags))
832	return;
833
834	/* Check if ISO connection is a BIS and terminate advertising
835	* set and BIG if there are no other connections using it.
836	*/
837	bis = hci_conn_hash_lookup_big(hdev, handle: conn->iso_qos.bcast.big);
838	if (bis)
839	return;
840
841	hci_le_terminate_big(hdev, conn);
842	} else {
843	hci_le_big_terminate(hdev, big: conn->iso_qos.bcast.big,
844	conn);
845	}
846	}
847
848	static int remove_cig_sync(struct hci_dev *hdev, void *data)
849	{
850	u8 handle = PTR_UINT(data);
851
852	return hci_le_remove_cig_sync(hdev, handle);
853	}
854
855	static int hci_le_remove_cig(struct hci_dev *hdev, u8 handle)
856	{
857	bt_dev_dbg(hdev, "handle 0x%2.2x", handle);
858
859	return hci_cmd_sync_queue(hdev, func: remove_cig_sync, UINT_PTR(handle),
860	NULL);
861	}
862
863	static void find_cis(struct hci_conn *conn, void *data)
864	{
865	struct iso_list_data *d = data;
866
867	/* Ignore broadcast or if CIG don't match */
868	if (!bacmp(ba1: &conn->dst, BDADDR_ANY) || d->cig != conn->iso_qos.ucast.cig)
869	return;
870
871	d->count++;
872	}
873
874	/* Cleanup CIS connection:
875	*
876	* Detects if there any CIS left connected in a CIG and remove it.
877	*/
878	static void cis_cleanup(struct hci_conn *conn)
879	{
880	struct hci_dev *hdev = conn->hdev;
881	struct iso_list_data d;
882
883	if (conn->iso_qos.ucast.cig == BT_ISO_QOS_CIG_UNSET)
884	return;
885
886	memset(&d, 0, sizeof(d));
887	d.cig = conn->iso_qos.ucast.cig;
888
889	/* Check if ISO connection is a CIS and remove CIG if there are
890	* no other connections using it.
891	*/
892	hci_conn_hash_list_state(hdev, func: find_cis, ISO_LINK, state: BT_BOUND, data: &d);
893	hci_conn_hash_list_state(hdev, func: find_cis, ISO_LINK, state: BT_CONNECT, data: &d);
894	hci_conn_hash_list_state(hdev, func: find_cis, ISO_LINK, state: BT_CONNECTED, data: &d);
895	if (d.count)
896	return;
897
898	hci_le_remove_cig(hdev, handle: conn->iso_qos.ucast.cig);
899	}
900
901	static int hci_conn_hash_alloc_unset(struct hci_dev *hdev)
902	{
903	return ida_alloc_range(&hdev->unset_handle_ida, HCI_CONN_HANDLE_MAX + 1,
904	U16_MAX, GFP_ATOMIC);
905	}
906
907	struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst,
908	u8 role, u16 handle)
909	{
910	struct hci_conn *conn;
911
912	bt_dev_dbg(hdev, "dst %pMR handle 0x%4.4x", dst, handle);
913
914	conn = kzalloc(size: sizeof(*conn), GFP_KERNEL);
915	if (!conn)
916	return NULL;
917
918	bacpy(dst: &conn->dst, src: dst);
919	bacpy(dst: &conn->src, src: &hdev->bdaddr);
920	conn->handle = handle;
921	conn->hdev = hdev;
922	conn->type = type;
923	conn->role = role;
924	conn->mode = HCI_CM_ACTIVE;
925	conn->state = BT_OPEN;
926	conn->auth_type = HCI_AT_GENERAL_BONDING;
927	conn->io_capability = hdev->io_capability;
928	conn->remote_auth = 0xff;
929	conn->key_type = 0xff;
930	conn->rssi = HCI_RSSI_INVALID;
931	conn->tx_power = HCI_TX_POWER_INVALID;
932	conn->max_tx_power = HCI_TX_POWER_INVALID;
933	conn->sync_handle = HCI_SYNC_HANDLE_INVALID;
934
935	set_bit(nr: HCI_CONN_POWER_SAVE, addr: &conn->flags);
936	conn->disc_timeout = HCI_DISCONN_TIMEOUT;
937
938	/* Set Default Authenticated payload timeout to 30s */
939	conn->auth_payload_timeout = DEFAULT_AUTH_PAYLOAD_TIMEOUT;
940
941	if (conn->role == HCI_ROLE_MASTER)
942	conn->out = true;
943
944	switch (type) {
945	case ACL_LINK:
946	conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
947	break;
948	case LE_LINK:
949	/* conn->src should reflect the local identity address */
950	hci_copy_identity_address(hdev, bdaddr: &conn->src, bdaddr_type: &conn->src_type);
951	break;
952	case ISO_LINK:
953	/* conn->src should reflect the local identity address */
954	hci_copy_identity_address(hdev, bdaddr: &conn->src, bdaddr_type: &conn->src_type);
955
956	/* set proper cleanup function */
957	if (!bacmp(ba1: dst, BDADDR_ANY))
958	conn->cleanup = bis_cleanup;
959	else if (conn->role == HCI_ROLE_MASTER)
960	conn->cleanup = cis_cleanup;
961
962	break;
963	case SCO_LINK:
964	if (lmp_esco_capable(hdev))
965	conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
966	(hdev->esco_type & EDR_ESCO_MASK);
967	else
968	conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
969	break;
970	case ESCO_LINK:
971	conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
972	break;
973	}
974
975	skb_queue_head_init(list: &conn->data_q);
976
977	INIT_LIST_HEAD(list: &conn->chan_list);
978	INIT_LIST_HEAD(list: &conn->link_list);
979
980	INIT_DELAYED_WORK(&conn->disc_work, hci_conn_timeout);
981	INIT_DELAYED_WORK(&conn->auto_accept_work, hci_conn_auto_accept);
982	INIT_DELAYED_WORK(&conn->idle_work, hci_conn_idle);
983	INIT_DELAYED_WORK(&conn->le_conn_timeout, le_conn_timeout);
984
985	atomic_set(v: &conn->refcnt, i: 0);
986
987	hci_dev_hold(d: hdev);
988
989	hci_conn_hash_add(hdev, c: conn);
990
991	/* The SCO and eSCO connections will only be notified when their
992	* setup has been completed. This is different to ACL links which
993	* can be notified right away.
994	*/
995	if (conn->type != SCO_LINK && conn->type != ESCO_LINK) {
996	if (hdev->notify)
997	hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
998	}
999
1000	hci_conn_init_sysfs(conn);
1001
1002	return conn;
1003	}
1004
1005	struct hci_conn *hci_conn_add_unset(struct hci_dev *hdev, int type,
1006	bdaddr_t *dst, u8 role)
1007	{
1008	int handle;
1009
1010	bt_dev_dbg(hdev, "dst %pMR", dst);
1011
1012	handle = hci_conn_hash_alloc_unset(hdev);
1013	if (unlikely(handle < 0))
1014	return NULL;
1015
1016	return hci_conn_add(hdev, type, dst, role, handle);
1017	}
1018
1019	static void hci_conn_cleanup_child(struct hci_conn *conn, u8 reason)
1020	{
1021	if (!reason)
1022	reason = HCI_ERROR_REMOTE_USER_TERM;
1023
1024	/* Due to race, SCO/ISO conn might be not established yet at this point,
1025	* and nothing else will clean it up. In other cases it is done via HCI
1026	* events.
1027	*/
1028	switch (conn->type) {
1029	case SCO_LINK:
1030	case ESCO_LINK:
1031	if (HCI_CONN_HANDLE_UNSET(conn->handle))
1032	hci_conn_failed(conn, status: reason);
1033	break;
1034	case ISO_LINK:
1035	if ((conn->state != BT_CONNECTED &&
1036	!test_bit(HCI_CONN_CREATE_CIS, &conn->flags)) ||
1037	test_bit(HCI_CONN_BIG_CREATED, &conn->flags))
1038	hci_conn_failed(conn, status: reason);
1039	break;
1040	}
1041	}
1042
1043	static void hci_conn_unlink(struct hci_conn *conn)
1044	{
1045	struct hci_dev *hdev = conn->hdev;
1046
1047	bt_dev_dbg(hdev, "hcon %p", conn);
1048
1049	if (!conn->parent) {
1050	struct hci_link *link, *t;
1051
1052	list_for_each_entry_safe(link, t, &conn->link_list, list) {
1053	struct hci_conn *child = link->conn;
1054
1055	hci_conn_unlink(conn: child);
1056
1057	/* If hdev is down it means
1058	* hci_dev_close_sync/hci_conn_hash_flush is in progress
1059	* and links don't need to be cleanup as all connections
1060	* would be cleanup.
1061	*/
1062	if (!test_bit(HCI_UP, &hdev->flags))
1063	continue;
1064
1065	hci_conn_cleanup_child(conn: child, reason: conn->abort_reason);
1066	}
1067
1068	return;
1069	}
1070
1071	if (!conn->link)
1072	return;
1073
1074	list_del_rcu(entry: &conn->link->list);
1075	synchronize_rcu();
1076
1077	hci_conn_drop(conn: conn->parent);
1078	hci_conn_put(conn: conn->parent);
1079	conn->parent = NULL;
1080
1081	kfree(objp: conn->link);
1082	conn->link = NULL;
1083	}
1084
1085	void hci_conn_del(struct hci_conn *conn)
1086	{
1087	struct hci_dev *hdev = conn->hdev;
1088
1089	BT_DBG("%s hcon %p handle %d", hdev->name, conn, conn->handle);
1090
1091	hci_conn_unlink(conn);
1092
1093	cancel_delayed_work_sync(dwork: &conn->disc_work);
1094	cancel_delayed_work_sync(dwork: &conn->auto_accept_work);
1095	cancel_delayed_work_sync(dwork: &conn->idle_work);
1096
1097	if (conn->type == ACL_LINK) {
1098	/* Unacked frames */
1099	hdev->acl_cnt += conn->sent;
1100	} else if (conn->type == LE_LINK) {
1101	cancel_delayed_work(dwork: &conn->le_conn_timeout);
1102
1103	if (hdev->le_pkts)
1104	hdev->le_cnt += conn->sent;
1105	else
1106	hdev->acl_cnt += conn->sent;
1107	} else {
1108	/* Unacked ISO frames */
1109	if (conn->type == ISO_LINK) {
1110	if (hdev->iso_pkts)
1111	hdev->iso_cnt += conn->sent;
1112	else if (hdev->le_pkts)
1113	hdev->le_cnt += conn->sent;
1114	else
1115	hdev->acl_cnt += conn->sent;
1116	}
1117	}
1118
1119	skb_queue_purge(list: &conn->data_q);
1120
1121	/* Remove the connection from the list and cleanup its remaining
1122	* state. This is a separate function since for some cases like
1123	* BT_CONNECT_SCAN we *only* want the cleanup part without the
1124	* rest of hci_conn_del.
1125	*/
1126	hci_conn_cleanup(conn);
1127
1128	/* Dequeue callbacks using connection pointer as data */
1129	hci_cmd_sync_dequeue(hdev, NULL, data: conn, NULL);
1130	}
1131
1132	struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src, uint8_t src_type)
1133	{
1134	int use_src = bacmp(ba1: src, BDADDR_ANY);
1135	struct hci_dev *hdev = NULL, *d;
1136
1137	BT_DBG("%pMR -> %pMR", src, dst);
1138
1139	read_lock(&hci_dev_list_lock);
1140
1141	list_for_each_entry(d, &hci_dev_list, list) {
1142	if (!test_bit(HCI_UP, &d->flags) ||
1143	hci_dev_test_flag(d, HCI_USER_CHANNEL) ||
1144	d->dev_type != HCI_PRIMARY)
1145	continue;
1146
1147	/* Simple routing:
1148	* No source address - find interface with bdaddr != dst
1149	* Source address - find interface with bdaddr == src
1150	*/
1151
1152	if (use_src) {
1153	bdaddr_t id_addr;
1154	u8 id_addr_type;
1155
1156	if (src_type == BDADDR_BREDR) {
1157	if (!lmp_bredr_capable(d))
1158	continue;
1159	bacpy(dst: &id_addr, src: &d->bdaddr);
1160	id_addr_type = BDADDR_BREDR;
1161	} else {
1162	if (!lmp_le_capable(d))
1163	continue;
1164
1165	hci_copy_identity_address(hdev: d, bdaddr: &id_addr,
1166	bdaddr_type: &id_addr_type);
1167
1168	/* Convert from HCI to three-value type */
1169	if (id_addr_type == ADDR_LE_DEV_PUBLIC)
1170	id_addr_type = BDADDR_LE_PUBLIC;
1171	else
1172	id_addr_type = BDADDR_LE_RANDOM;
1173	}
1174
1175	if (!bacmp(ba1: &id_addr, ba2: src) && id_addr_type == src_type) {
1176	hdev = d; break;
1177	}
1178	} else {
1179	if (bacmp(ba1: &d->bdaddr, ba2: dst)) {
1180	hdev = d; break;
1181	}
1182	}
1183	}
1184
1185	if (hdev)
1186	hdev = hci_dev_hold(d: hdev);
1187
1188	read_unlock(&hci_dev_list_lock);
1189	return hdev;
1190	}
1191	EXPORT_SYMBOL(hci_get_route);
1192
1193	/* This function requires the caller holds hdev->lock */
1194	static void hci_le_conn_failed(struct hci_conn *conn, u8 status)
1195	{
1196	struct hci_dev *hdev = conn->hdev;
1197
1198	hci_connect_le_scan_cleanup(conn, status);
1199
1200	/* Enable advertising in case this was a failed connection
1201	* attempt as a peripheral.
1202	*/
1203	hci_enable_advertising(hdev);
1204	}
1205
1206	/* This function requires the caller holds hdev->lock */
1207	void hci_conn_failed(struct hci_conn *conn, u8 status)
1208	{
1209	struct hci_dev *hdev = conn->hdev;
1210
1211	bt_dev_dbg(hdev, "status 0x%2.2x", status);
1212
1213	switch (conn->type) {
1214	case LE_LINK:
1215	hci_le_conn_failed(conn, status);
1216	break;
1217	case ACL_LINK:
1218	mgmt_connect_failed(hdev, bdaddr: &conn->dst, link_type: conn->type,
1219	addr_type: conn->dst_type, status);
1220	break;
1221	}
1222
1223	/* In case of BIG/PA sync failed, clear conn flags so that
1224	* the conns will be correctly cleaned up by ISO layer
1225	*/
1226	test_and_clear_bit(nr: HCI_CONN_BIG_SYNC_FAILED, addr: &conn->flags);
1227	test_and_clear_bit(nr: HCI_CONN_PA_SYNC_FAILED, addr: &conn->flags);
1228
1229	conn->state = BT_CLOSED;
1230	hci_connect_cfm(conn, status);
1231	hci_conn_del(conn);
1232	}
1233
1234	/* This function requires the caller holds hdev->lock */
1235	u8 hci_conn_set_handle(struct hci_conn *conn, u16 handle)
1236	{
1237	struct hci_dev *hdev = conn->hdev;
1238
1239	bt_dev_dbg(hdev, "hcon %p handle 0x%4.4x", conn, handle);
1240
1241	if (conn->handle == handle)
1242	return 0;
1243
1244	if (handle > HCI_CONN_HANDLE_MAX) {
1245	bt_dev_err(hdev, "Invalid handle: 0x%4.4x > 0x%4.4x",
1246	handle, HCI_CONN_HANDLE_MAX);
1247	return HCI_ERROR_INVALID_PARAMETERS;
1248	}
1249
1250	/* If abort_reason has been sent it means the connection is being
1251	* aborted and the handle shall not be changed.
1252	*/
1253	if (conn->abort_reason)
1254	return conn->abort_reason;
1255
1256	if (HCI_CONN_HANDLE_UNSET(conn->handle))
1257	ida_free(&hdev->unset_handle_ida, id: conn->handle);
1258
1259	conn->handle = handle;
1260
1261	return 0;
1262	}
1263
1264	struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,
1265	u8 dst_type, bool dst_resolved, u8 sec_level,
1266	u16 conn_timeout, u8 role)
1267	{
1268	struct hci_conn *conn;
1269	struct smp_irk *irk;
1270	int err;
1271
1272	/* Let's make sure that le is enabled.*/
1273	if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1274	if (lmp_le_capable(hdev))
1275	return ERR_PTR(error: -ECONNREFUSED);
1276
1277	return ERR_PTR(error: -EOPNOTSUPP);
1278	}
1279
1280	/* Since the controller supports only one LE connection attempt at a
1281	* time, we return -EBUSY if there is any connection attempt running.
1282	*/
1283	if (hci_lookup_le_connect(hdev))
1284	return ERR_PTR(error: -EBUSY);
1285
1286	/* If there's already a connection object but it's not in
1287	* scanning state it means it must already be established, in
1288	* which case we can't do anything else except report a failure
1289	* to connect.
1290	*/
1291	conn = hci_conn_hash_lookup_le(hdev, ba: dst, ba_type: dst_type);
1292	if (conn && !test_bit(HCI_CONN_SCANNING, &conn->flags)) {
1293	return ERR_PTR(error: -EBUSY);
1294	}
1295
1296	/* Check if the destination address has been resolved by the controller
1297	* since if it did then the identity address shall be used.
1298	*/
1299	if (!dst_resolved) {
1300	/* When given an identity address with existing identity
1301	* resolving key, the connection needs to be established
1302	* to a resolvable random address.
1303	*
1304	* Storing the resolvable random address is required here
1305	* to handle connection failures. The address will later
1306	* be resolved back into the original identity address
1307	* from the connect request.
1308	*/
1309	irk = hci_find_irk_by_addr(hdev, bdaddr: dst, addr_type: dst_type);
1310	if (irk && bacmp(ba1: &irk->rpa, BDADDR_ANY)) {
1311	dst = &irk->rpa;
1312	dst_type = ADDR_LE_DEV_RANDOM;
1313	}
1314	}
1315
1316	if (conn) {
1317	bacpy(dst: &conn->dst, src: dst);
1318	} else {
1319	conn = hci_conn_add_unset(hdev, LE_LINK, dst, role);
1320	if (!conn)
1321	return ERR_PTR(error: -ENOMEM);
1322	hci_conn_hold(conn);
1323	conn->pending_sec_level = sec_level;
1324	}
1325
1326	conn->dst_type = dst_type;
1327	conn->sec_level = BT_SECURITY_LOW;
1328	conn->conn_timeout = conn_timeout;
1329
1330	err = hci_connect_le_sync(hdev, conn);
1331	if (err) {
1332	hci_conn_del(conn);
1333	return ERR_PTR(error: err);
1334	}
1335
1336	return conn;
1337	}
1338
1339	static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
1340	{
1341	struct hci_conn *conn;
1342
1343	conn = hci_conn_hash_lookup_le(hdev, ba: addr, ba_type: type);
1344	if (!conn)
1345	return false;
1346
1347	if (conn->state != BT_CONNECTED)
1348	return false;
1349
1350	return true;
1351	}
1352
1353	/* This function requires the caller holds hdev->lock */
1354	static int hci_explicit_conn_params_set(struct hci_dev *hdev,
1355	bdaddr_t *addr, u8 addr_type)
1356	{
1357	struct hci_conn_params *params;
1358
1359	if (is_connected(hdev, addr, type: addr_type))
1360	return -EISCONN;
1361
1362	params = hci_conn_params_lookup(hdev, addr, addr_type);
1363	if (!params) {
1364	params = hci_conn_params_add(hdev, addr, addr_type);
1365	if (!params)
1366	return -ENOMEM;
1367
1368	/* If we created new params, mark them to be deleted in
1369	* hci_connect_le_scan_cleanup. It's different case than
1370	* existing disabled params, those will stay after cleanup.
1371	*/
1372	params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
1373	}
1374
1375	/* We're trying to connect, so make sure params are at pend_le_conns */
1376	if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
1377	params->auto_connect == HCI_AUTO_CONN_REPORT ||
1378	params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
1379	hci_pend_le_list_del_init(param: params);
1380	hci_pend_le_list_add(param: params, list: &hdev->pend_le_conns);
1381	}
1382
1383	params->explicit_connect = true;
1384
1385	BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
1386	params->auto_connect);
1387
1388	return 0;
1389	}
1390
1391	static int qos_set_big(struct hci_dev *hdev, struct bt_iso_qos *qos)
1392	{
1393	struct hci_conn *conn;
1394	u8 big;
1395
1396	/* Allocate a BIG if not set */
1397	if (qos->bcast.big == BT_ISO_QOS_BIG_UNSET) {
1398	for (big = 0x00; big < 0xef; big++) {
1399
1400	conn = hci_conn_hash_lookup_big(hdev, handle: big);
1401	if (!conn)
1402	break;
1403	}
1404
1405	if (big == 0xef)
1406	return -EADDRNOTAVAIL;
1407
1408	/* Update BIG */
1409	qos->bcast.big = big;
1410	}
1411
1412	return 0;
1413	}
1414
1415	static int qos_set_bis(struct hci_dev *hdev, struct bt_iso_qos *qos)
1416	{
1417	struct hci_conn *conn;
1418	u8 bis;
1419
1420	/* Allocate BIS if not set */
1421	if (qos->bcast.bis == BT_ISO_QOS_BIS_UNSET) {
1422	if (qos->bcast.big != BT_ISO_QOS_BIG_UNSET) {
1423	conn = hci_conn_hash_lookup_big(hdev, handle: qos->bcast.big);
1424
1425	if (conn) {
1426	/* If the BIG handle is already matched to an advertising
1427	* handle, do not allocate a new one.
1428	*/
1429	qos->bcast.bis = conn->iso_qos.bcast.bis;
1430	return 0;
1431	}
1432	}
1433
1434	/* Find an unused adv set to advertise BIS, skip instance 0x00
1435	* since it is reserved as general purpose set.
1436	*/
1437	for (bis = 0x01; bis < hdev->le_num_of_adv_sets;
1438	bis++) {
1439
1440	conn = hci_conn_hash_lookup_bis(hdev, BDADDR_ANY, bis);
1441	if (!conn)
1442	break;
1443	}
1444
1445	if (bis == hdev->le_num_of_adv_sets)
1446	return -EADDRNOTAVAIL;
1447
1448	/* Update BIS */
1449	qos->bcast.bis = bis;
1450	}
1451
1452	return 0;
1453	}
1454
1455	/* This function requires the caller holds hdev->lock */
1456	static struct hci_conn *hci_add_bis(struct hci_dev *hdev, bdaddr_t *dst,
1457	struct bt_iso_qos *qos, __u8 base_len,
1458	__u8 *base)
1459	{
1460	struct hci_conn *conn;
1461	int err;
1462
1463	/* Let's make sure that le is enabled.*/
1464	if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1465	if (lmp_le_capable(hdev))
1466	return ERR_PTR(error: -ECONNREFUSED);
1467	return ERR_PTR(error: -EOPNOTSUPP);
1468	}
1469
1470	err = qos_set_big(hdev, qos);
1471	if (err)
1472	return ERR_PTR(error: err);
1473
1474	err = qos_set_bis(hdev, qos);
1475	if (err)
1476	return ERR_PTR(error: err);
1477
1478	/* Check if the LE Create BIG command has already been sent */
1479	conn = hci_conn_hash_lookup_per_adv_bis(hdev, ba: dst, big: qos->bcast.big,
1480	bis: qos->bcast.big);
1481	if (conn)
1482	return ERR_PTR(error: -EADDRINUSE);
1483
1484	/* Check BIS settings against other bound BISes, since all
1485	* BISes in a BIG must have the same value for all parameters
1486	*/
1487	conn = hci_conn_hash_lookup_big(hdev, handle: qos->bcast.big);
1488
1489	if (conn && (memcmp(p: qos, q: &conn->iso_qos, size: sizeof(*qos)) ||
1490	base_len != conn->le_per_adv_data_len ||
1491	memcmp(p: conn->le_per_adv_data, q: base, size: base_len)))
1492	return ERR_PTR(error: -EADDRINUSE);
1493
1494	conn = hci_conn_add_unset(hdev, ISO_LINK, dst, HCI_ROLE_MASTER);
1495	if (!conn)
1496	return ERR_PTR(error: -ENOMEM);
1497
1498	conn->state = BT_CONNECT;
1499
1500	hci_conn_hold(conn);
1501	return conn;
1502	}
1503
1504	/* This function requires the caller holds hdev->lock */
1505	struct hci_conn *hci_connect_le_scan(struct hci_dev *hdev, bdaddr_t *dst,
1506	u8 dst_type, u8 sec_level,
1507	u16 conn_timeout,
1508	enum conn_reasons conn_reason)
1509	{
1510	struct hci_conn *conn;
1511
1512	/* Let's make sure that le is enabled.*/
1513	if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1514	if (lmp_le_capable(hdev))
1515	return ERR_PTR(error: -ECONNREFUSED);
1516
1517	return ERR_PTR(error: -EOPNOTSUPP);
1518	}
1519
1520	/* Some devices send ATT messages as soon as the physical link is
1521	* established. To be able to handle these ATT messages, the user-
1522	* space first establishes the connection and then starts the pairing
1523	* process.
1524	*
1525	* So if a hci_conn object already exists for the following connection
1526	* attempt, we simply update pending_sec_level and auth_type fields
1527	* and return the object found.
1528	*/
1529	conn = hci_conn_hash_lookup_le(hdev, ba: dst, ba_type: dst_type);
1530	if (conn) {
1531	if (conn->pending_sec_level < sec_level)
1532	conn->pending_sec_level = sec_level;
1533	goto done;
1534	}
1535
1536	BT_DBG("requesting refresh of dst_addr");
1537
1538	conn = hci_conn_add_unset(hdev, LE_LINK, dst, HCI_ROLE_MASTER);
1539	if (!conn)
1540	return ERR_PTR(error: -ENOMEM);
1541
1542	if (hci_explicit_conn_params_set(hdev, addr: dst, addr_type: dst_type) < 0) {
1543	hci_conn_del(conn);
1544	return ERR_PTR(error: -EBUSY);
1545	}
1546
1547	conn->state = BT_CONNECT;
1548	set_bit(nr: HCI_CONN_SCANNING, addr: &conn->flags);
1549	conn->dst_type = dst_type;
1550	conn->sec_level = BT_SECURITY_LOW;
1551	conn->pending_sec_level = sec_level;
1552	conn->conn_timeout = conn_timeout;
1553	conn->conn_reason = conn_reason;
1554
1555	hci_update_passive_scan(hdev);
1556
1557	done:
1558	hci_conn_hold(conn);
1559	return conn;
1560	}
1561
1562	struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst,
1563	u8 sec_level, u8 auth_type,
1564	enum conn_reasons conn_reason, u16 timeout)
1565	{
1566	struct hci_conn *acl;
1567
1568	if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1569	if (lmp_bredr_capable(hdev))
1570	return ERR_PTR(error: -ECONNREFUSED);
1571
1572	return ERR_PTR(error: -EOPNOTSUPP);
1573	}
1574
1575	/* Reject outgoing connection to device with same BD ADDR against
1576	* CVE-2020-26555
1577	*/
1578	if (!bacmp(ba1: &hdev->bdaddr, ba2: dst)) {
1579	bt_dev_dbg(hdev, "Reject connection with same BD_ADDR %pMR\n",
1580	dst);
1581	return ERR_PTR(error: -ECONNREFUSED);
1582	}
1583
1584	acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, ba: dst);
1585	if (!acl) {
1586	acl = hci_conn_add_unset(hdev, ACL_LINK, dst, HCI_ROLE_MASTER);
1587	if (!acl)
1588	return ERR_PTR(error: -ENOMEM);
1589	}
1590
1591	hci_conn_hold(conn: acl);
1592
1593	acl->conn_reason = conn_reason;
1594	if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
1595	int err;
1596
1597	acl->sec_level = BT_SECURITY_LOW;
1598	acl->pending_sec_level = sec_level;
1599	acl->auth_type = auth_type;
1600	acl->conn_timeout = timeout;
1601
1602	err = hci_connect_acl_sync(hdev, conn: acl);
1603	if (err) {
1604	hci_conn_del(conn: acl);
1605	return ERR_PTR(error: err);
1606	}
1607	}
1608
1609	return acl;
1610	}
1611
1612	static struct hci_link *hci_conn_link(struct hci_conn *parent,
1613	struct hci_conn *conn)
1614	{
1615	struct hci_dev *hdev = parent->hdev;
1616	struct hci_link *link;
1617
1618	bt_dev_dbg(hdev, "parent %p hcon %p", parent, conn);
1619
1620	if (conn->link)
1621	return conn->link;
1622
1623	if (conn->parent)
1624	return NULL;
1625
1626	link = kzalloc(size: sizeof(*link), GFP_KERNEL);
1627	if (!link)
1628	return NULL;
1629
1630	link->conn = hci_conn_hold(conn);
1631	conn->link = link;
1632	conn->parent = hci_conn_get(conn: parent);
1633
1634	/* Use list_add_tail_rcu append to the list */
1635	list_add_tail_rcu(new: &link->list, head: &parent->link_list);
1636
1637	return link;
1638	}
1639
1640	struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type, bdaddr_t *dst,
1641	__u16 setting, struct bt_codec *codec,
1642	u16 timeout)
1643	{
1644	struct hci_conn *acl;
1645	struct hci_conn *sco;
1646	struct hci_link *link;
1647
1648	acl = hci_connect_acl(hdev, dst, BT_SECURITY_LOW, HCI_AT_NO_BONDING,
1649	conn_reason: CONN_REASON_SCO_CONNECT, timeout);
1650	if (IS_ERR(ptr: acl))
1651	return acl;
1652
1653	sco = hci_conn_hash_lookup_ba(hdev, type, ba: dst);
1654	if (!sco) {
1655	sco = hci_conn_add_unset(hdev, type, dst, HCI_ROLE_MASTER);
1656	if (!sco) {
1657	hci_conn_drop(conn: acl);
1658	return ERR_PTR(error: -ENOMEM);
1659	}
1660	}
1661
1662	link = hci_conn_link(parent: acl, conn: sco);
1663	if (!link) {
1664	hci_conn_drop(conn: acl);
1665	hci_conn_drop(conn: sco);
1666	return ERR_PTR(error: -ENOLINK);
1667	}
1668
1669	sco->setting = setting;
1670	sco->codec = *codec;
1671
1672	if (acl->state == BT_CONNECTED &&
1673	(sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
1674	set_bit(nr: HCI_CONN_POWER_SAVE, addr: &acl->flags);
1675	hci_conn_enter_active_mode(conn: acl, BT_POWER_FORCE_ACTIVE_ON);
1676
1677	if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->flags)) {
1678	/* defer SCO setup until mode change completed */
1679	set_bit(nr: HCI_CONN_SCO_SETUP_PEND, addr: &acl->flags);
1680	return sco;
1681	}
1682
1683	hci_sco_setup(conn: acl, status: 0x00);
1684	}
1685
1686	return sco;
1687	}
1688
1689	static int hci_le_create_big(struct hci_conn *conn, struct bt_iso_qos *qos)
1690	{
1691	struct hci_dev *hdev = conn->hdev;
1692	struct hci_cp_le_create_big cp;
1693	struct iso_list_data data;
1694
1695	memset(&cp, 0, sizeof(cp));
1696
1697	data.big = qos->bcast.big;
1698	data.bis = qos->bcast.bis;
1699	data.count = 0;
1700
1701	/* Create a BIS for each bound connection */
1702	hci_conn_hash_list_state(hdev, func: bis_list, ISO_LINK,
1703	state: BT_BOUND, data: &data);
1704
1705	cp.handle = qos->bcast.big;
1706	cp.adv_handle = qos->bcast.bis;
1707	cp.num_bis = data.count;
1708	hci_cpu_to_le24(val: qos->bcast.out.interval, dst: cp.bis.sdu_interval);
1709	cp.bis.sdu = cpu_to_le16(qos->bcast.out.sdu);
1710	cp.bis.latency = cpu_to_le16(qos->bcast.out.latency);
1711	cp.bis.rtn = qos->bcast.out.rtn;
1712	cp.bis.phy = qos->bcast.out.phy;
1713	cp.bis.packing = qos->bcast.packing;
1714	cp.bis.framing = qos->bcast.framing;
1715	cp.bis.encryption = qos->bcast.encryption;
1716	memcpy(cp.bis.bcode, qos->bcast.bcode, sizeof(cp.bis.bcode));
1717
1718	return hci_send_cmd(hdev, HCI_OP_LE_CREATE_BIG, plen: sizeof(cp), param: &cp);
1719	}
1720
1721	static int set_cig_params_sync(struct hci_dev *hdev, void *data)
1722	{
1723	u8 cig_id = PTR_UINT(data);
1724	struct hci_conn *conn;
1725	struct bt_iso_qos *qos;
1726	struct iso_cig_params pdu;
1727	u8 cis_id;
1728
1729	conn = hci_conn_hash_lookup_cig(hdev, handle: cig_id);
1730	if (!conn)
1731	return 0;
1732
1733	memset(&pdu, 0, sizeof(pdu));
1734
1735	qos = &conn->iso_qos;
1736	pdu.cp.cig_id = cig_id;
1737	hci_cpu_to_le24(val: qos->ucast.out.interval, dst: pdu.cp.c_interval);
1738	hci_cpu_to_le24(val: qos->ucast.in.interval, dst: pdu.cp.p_interval);
1739	pdu.cp.sca = qos->ucast.sca;
1740	pdu.cp.packing = qos->ucast.packing;
1741	pdu.cp.framing = qos->ucast.framing;
1742	pdu.cp.c_latency = cpu_to_le16(qos->ucast.out.latency);
1743	pdu.cp.p_latency = cpu_to_le16(qos->ucast.in.latency);
1744
1745	/* Reprogram all CIS(s) with the same CIG, valid range are:
1746	* num_cis: 0x00 to 0x1F
1747	* cis_id: 0x00 to 0xEF
1748	*/
1749	for (cis_id = 0x00; cis_id < 0xf0 &&
1750	pdu.cp.num_cis < ARRAY_SIZE(pdu.cis); cis_id++) {
1751	struct hci_cis_params *cis;
1752
1753	conn = hci_conn_hash_lookup_cis(hdev, NULL, ba_type: 0, cig: cig_id, id: cis_id);
1754	if (!conn)
1755	continue;
1756
1757	qos = &conn->iso_qos;
1758
1759	cis = &pdu.cis[pdu.cp.num_cis++];
1760	cis->cis_id = cis_id;
1761	cis->c_sdu = cpu_to_le16(conn->iso_qos.ucast.out.sdu);
1762	cis->p_sdu = cpu_to_le16(conn->iso_qos.ucast.in.sdu);
1763	cis->c_phy = qos->ucast.out.phy ? qos->ucast.out.phy :
1764	qos->ucast.in.phy;
1765	cis->p_phy = qos->ucast.in.phy ? qos->ucast.in.phy :
1766	qos->ucast.out.phy;
1767	cis->c_rtn = qos->ucast.out.rtn;
1768	cis->p_rtn = qos->ucast.in.rtn;
1769	}
1770
1771	if (!pdu.cp.num_cis)
1772	return 0;
1773
1774	return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_CIG_PARAMS,
1775	plen: sizeof(pdu.cp) +
1776	pdu.cp.num_cis * sizeof(pdu.cis[0]), param: &pdu,
1777	HCI_CMD_TIMEOUT);
1778	}
1779
1780	static bool hci_le_set_cig_params(struct hci_conn *conn, struct bt_iso_qos *qos)
1781	{
1782	struct hci_dev *hdev = conn->hdev;
1783	struct iso_list_data data;
1784
1785	memset(&data, 0, sizeof(data));
1786
1787	/* Allocate first still reconfigurable CIG if not set */
1788	if (qos->ucast.cig == BT_ISO_QOS_CIG_UNSET) {
1789	for (data.cig = 0x00; data.cig < 0xf0; data.cig++) {
1790	data.count = 0;
1791
1792	hci_conn_hash_list_state(hdev, func: find_cis, ISO_LINK,
1793	state: BT_CONNECT, data: &data);
1794	if (data.count)
1795	continue;
1796
1797	hci_conn_hash_list_state(hdev, func: find_cis, ISO_LINK,
1798	state: BT_CONNECTED, data: &data);
1799	if (!data.count)
1800	break;
1801	}
1802
1803	if (data.cig == 0xf0)
1804	return false;
1805
1806	/* Update CIG */
1807	qos->ucast.cig = data.cig;
1808	}
1809
1810	if (qos->ucast.cis != BT_ISO_QOS_CIS_UNSET) {
1811	if (hci_conn_hash_lookup_cis(hdev, NULL, ba_type: 0, cig: qos->ucast.cig,
1812	id: qos->ucast.cis))
1813	return false;
1814	goto done;
1815	}
1816
1817	/* Allocate first available CIS if not set */
1818	for (data.cig = qos->ucast.cig, data.cis = 0x00; data.cis < 0xf0;
1819	data.cis++) {
1820	if (!hci_conn_hash_lookup_cis(hdev, NULL, ba_type: 0, cig: data.cig,
1821	id: data.cis)) {
1822	/* Update CIS */
1823	qos->ucast.cis = data.cis;
1824	break;
1825	}
1826	}
1827
1828	if (qos->ucast.cis == BT_ISO_QOS_CIS_UNSET)
1829	return false;
1830
1831	done:
1832	if (hci_cmd_sync_queue(hdev, func: set_cig_params_sync,
1833	UINT_PTR(qos->ucast.cig), NULL) < 0)
1834	return false;
1835
1836	return true;
1837	}
1838
1839	struct hci_conn *hci_bind_cis(struct hci_dev *hdev, bdaddr_t *dst,
1840	__u8 dst_type, struct bt_iso_qos *qos)
1841	{
1842	struct hci_conn *cis;
1843
1844	cis = hci_conn_hash_lookup_cis(hdev, ba: dst, ba_type: dst_type, cig: qos->ucast.cig,
1845	id: qos->ucast.cis);
1846	if (!cis) {
1847	cis = hci_conn_add_unset(hdev, ISO_LINK, dst, HCI_ROLE_MASTER);
1848	if (!cis)
1849	return ERR_PTR(error: -ENOMEM);
1850	cis->cleanup = cis_cleanup;
1851	cis->dst_type = dst_type;
1852	cis->iso_qos.ucast.cig = BT_ISO_QOS_CIG_UNSET;
1853	cis->iso_qos.ucast.cis = BT_ISO_QOS_CIS_UNSET;
1854	}
1855
1856	if (cis->state == BT_CONNECTED)
1857	return cis;
1858
1859	/* Check if CIS has been set and the settings matches */
1860	if (cis->state == BT_BOUND &&
1861	!memcmp(p: &cis->iso_qos, q: qos, size: sizeof(*qos)))
1862	return cis;
1863
1864	/* Update LINK PHYs according to QoS preference */
1865	cis->le_tx_phy = qos->ucast.out.phy;
1866	cis->le_rx_phy = qos->ucast.in.phy;
1867
1868	/* If output interval is not set use the input interval as it cannot be
1869	* 0x000000.
1870	*/
1871	if (!qos->ucast.out.interval)
1872	qos->ucast.out.interval = qos->ucast.in.interval;
1873
1874	/* If input interval is not set use the output interval as it cannot be
1875	* 0x000000.
1876	*/
1877	if (!qos->ucast.in.interval)
1878	qos->ucast.in.interval = qos->ucast.out.interval;
1879
1880	/* If output latency is not set use the input latency as it cannot be
1881	* 0x0000.
1882	*/
1883	if (!qos->ucast.out.latency)
1884	qos->ucast.out.latency = qos->ucast.in.latency;
1885
1886	/* If input latency is not set use the output latency as it cannot be
1887	* 0x0000.
1888	*/
1889	if (!qos->ucast.in.latency)
1890	qos->ucast.in.latency = qos->ucast.out.latency;
1891
1892	if (!hci_le_set_cig_params(conn: cis, qos)) {
1893	hci_conn_drop(conn: cis);
1894	return ERR_PTR(error: -EINVAL);
1895	}
1896
1897	hci_conn_hold(conn: cis);
1898
1899	cis->iso_qos = *qos;
1900	cis->state = BT_BOUND;
1901
1902	return cis;
1903	}
1904
1905	bool hci_iso_setup_path(struct hci_conn *conn)
1906	{
1907	struct hci_dev *hdev = conn->hdev;
1908	struct hci_cp_le_setup_iso_path cmd;
1909
1910	memset(&cmd, 0, sizeof(cmd));
1911
1912	if (conn->iso_qos.ucast.out.sdu) {
1913	cmd.handle = cpu_to_le16(conn->handle);
1914	cmd.direction = 0x00; /* Input (Host to Controller) */
1915	cmd.path = 0x00; /* HCI path if enabled */
1916	cmd.codec = 0x03; /* Transparent Data */
1917
1918	if (hci_send_cmd(hdev, HCI_OP_LE_SETUP_ISO_PATH, plen: sizeof(cmd),
1919	param: &cmd) < 0)
1920	return false;
1921	}
1922
1923	if (conn->iso_qos.ucast.in.sdu) {
1924	cmd.handle = cpu_to_le16(conn->handle);
1925	cmd.direction = 0x01; /* Output (Controller to Host) */
1926	cmd.path = 0x00; /* HCI path if enabled */
1927	cmd.codec = 0x03; /* Transparent Data */
1928
1929	if (hci_send_cmd(hdev, HCI_OP_LE_SETUP_ISO_PATH, plen: sizeof(cmd),
1930	param: &cmd) < 0)
1931	return false;
1932	}
1933
1934	return true;
1935	}
1936
1937	int hci_conn_check_create_cis(struct hci_conn *conn)
1938	{
1939	if (conn->type != ISO_LINK || !bacmp(ba1: &conn->dst, BDADDR_ANY))
1940	return -EINVAL;
1941
1942	if (!conn->parent || conn->parent->state != BT_CONNECTED ||
1943	conn->state != BT_CONNECT || HCI_CONN_HANDLE_UNSET(conn->handle))
1944	return 1;
1945
1946	return 0;
1947	}
1948
1949	static int hci_create_cis_sync(struct hci_dev *hdev, void *data)
1950	{
1951	return hci_le_create_cis_sync(hdev);
1952	}
1953
1954	int hci_le_create_cis_pending(struct hci_dev *hdev)
1955	{
1956	struct hci_conn *conn;
1957	bool pending = false;
1958
1959	rcu_read_lock();
1960
1961	list_for_each_entry_rcu(conn, &hdev->conn_hash.list, list) {
1962	if (test_bit(HCI_CONN_CREATE_CIS, &conn->flags)) {
1963	rcu_read_unlock();
1964	return -EBUSY;
1965	}
1966
1967	if (!hci_conn_check_create_cis(conn))
1968	pending = true;
1969	}
1970
1971	rcu_read_unlock();
1972
1973	if (!pending)
1974	return 0;
1975
1976	/* Queue Create CIS */
1977	return hci_cmd_sync_queue(hdev, func: hci_create_cis_sync, NULL, NULL);
1978	}
1979
1980	static void hci_iso_qos_setup(struct hci_dev *hdev, struct hci_conn *conn,
1981	struct bt_iso_io_qos *qos, __u8 phy)
1982	{
1983	/* Only set MTU if PHY is enabled */
1984	if (!qos->sdu && qos->phy) {
1985	if (hdev->iso_mtu > 0)
1986	qos->sdu = hdev->iso_mtu;
1987	else if (hdev->le_mtu > 0)
1988	qos->sdu = hdev->le_mtu;
1989	else
1990	qos->sdu = hdev->acl_mtu;
1991	}
1992
1993	/* Use the same PHY as ACL if set to any */
1994	if (qos->phy == BT_ISO_PHY_ANY)
1995	qos->phy = phy;
1996
1997	/* Use LE ACL connection interval if not set */
1998	if (!qos->interval)
1999	/* ACL interval unit in 1.25 ms to us */
2000	qos->interval = conn->le_conn_interval * 1250;
2001
2002	/* Use LE ACL connection latency if not set */
2003	if (!qos->latency)
2004	qos->latency = conn->le_conn_latency;
2005	}
2006
2007	static int create_big_sync(struct hci_dev *hdev, void *data)
2008	{
2009	struct hci_conn *conn = data;
2010	struct bt_iso_qos *qos = &conn->iso_qos;
2011	u16 interval, sync_interval = 0;
2012	u32 flags = 0;
2013	int err;
2014
2015	if (qos->bcast.out.phy == 0x02)
2016	flags |= MGMT_ADV_FLAG_SEC_2M;
2017
2018	/* Align intervals */
2019	interval = (qos->bcast.out.interval / 1250) * qos->bcast.sync_factor;
2020
2021	if (qos->bcast.bis)
2022	sync_interval = interval * 4;
2023
2024	err = hci_start_per_adv_sync(hdev, instance: qos->bcast.bis, data_len: conn->le_per_adv_data_len,
2025	data: conn->le_per_adv_data, flags, min_interval: interval,
2026	max_interval: interval, sync_interval);
2027	if (err)
2028	return err;
2029
2030	return hci_le_create_big(conn, qos: &conn->iso_qos);
2031	}
2032
2033	static void create_pa_complete(struct hci_dev *hdev, void *data, int err)
2034	{
2035	struct hci_cp_le_pa_create_sync *cp = data;
2036
2037	bt_dev_dbg(hdev, "");
2038
2039	if (err)
2040	bt_dev_err(hdev, "Unable to create PA: %d", err);
2041
2042	kfree(objp: cp);
2043	}
2044
2045	static int create_pa_sync(struct hci_dev *hdev, void *data)
2046	{
2047	struct hci_cp_le_pa_create_sync *cp = data;
2048	int err;
2049
2050	err = __hci_cmd_sync_status(hdev, HCI_OP_LE_PA_CREATE_SYNC,
2051	plen: sizeof(*cp), param: cp, HCI_CMD_TIMEOUT);
2052	if (err) {
2053	hci_dev_clear_flag(hdev, HCI_PA_SYNC);
2054	return err;
2055	}
2056
2057	return hci_update_passive_scan_sync(hdev);
2058	}
2059
2060	struct hci_conn *hci_pa_create_sync(struct hci_dev *hdev, bdaddr_t *dst,
2061	__u8 dst_type, __u8 sid,
2062	struct bt_iso_qos *qos)
2063	{
2064	struct hci_cp_le_pa_create_sync *cp;
2065	struct hci_conn *conn;
2066	int err;
2067
2068	if (hci_dev_test_and_set_flag(hdev, HCI_PA_SYNC))
2069	return ERR_PTR(error: -EBUSY);
2070
2071	conn = hci_conn_add_unset(hdev, ISO_LINK, dst, HCI_ROLE_SLAVE);
2072	if (!conn)
2073	return ERR_PTR(error: -ENOMEM);
2074
2075	conn->iso_qos = *qos;
2076	conn->state = BT_LISTEN;
2077
2078	hci_conn_hold(conn);
2079
2080	cp = kzalloc(size: sizeof(*cp), GFP_KERNEL);
2081	if (!cp) {
2082	hci_dev_clear_flag(hdev, HCI_PA_SYNC);
2083	hci_conn_drop(conn);
2084	return ERR_PTR(error: -ENOMEM);
2085	}
2086
2087	cp->options = qos->bcast.options;
2088	cp->sid = sid;
2089	cp->addr_type = dst_type;
2090	bacpy(dst: &cp->addr, src: dst);
2091	cp->skip = cpu_to_le16(qos->bcast.skip);
2092	cp->sync_timeout = cpu_to_le16(qos->bcast.sync_timeout);
2093	cp->sync_cte_type = qos->bcast.sync_cte_type;
2094
2095	/* Queue start pa_create_sync and scan */
2096	err = hci_cmd_sync_queue(hdev, func: create_pa_sync, data: cp, destroy: create_pa_complete);
2097	if (err < 0) {
2098	hci_conn_drop(conn);
2099	kfree(objp: cp);
2100	return ERR_PTR(error: err);
2101	}
2102
2103	return conn;
2104	}
2105
2106	int hci_le_big_create_sync(struct hci_dev *hdev, struct hci_conn *hcon,
2107	struct bt_iso_qos *qos,
2108	__u16 sync_handle, __u8 num_bis, __u8 bis[])
2109	{
2110	struct _packed {
2111	struct hci_cp_le_big_create_sync cp;
2112	__u8 bis[0x11];
2113	} pdu;
2114	int err;
2115
2116	if (num_bis < 0x01 || num_bis > sizeof(pdu.bis))
2117	return -EINVAL;
2118
2119	err = qos_set_big(hdev, qos);
2120	if (err)
2121	return err;
2122
2123	if (hcon)
2124	hcon->iso_qos.bcast.big = qos->bcast.big;
2125
2126	memset(&pdu, 0, sizeof(pdu));
2127	pdu.cp.handle = qos->bcast.big;
2128	pdu.cp.sync_handle = cpu_to_le16(sync_handle);
2129	pdu.cp.encryption = qos->bcast.encryption;
2130	memcpy(pdu.cp.bcode, qos->bcast.bcode, sizeof(pdu.cp.bcode));
2131	pdu.cp.mse = qos->bcast.mse;
2132	pdu.cp.timeout = cpu_to_le16(qos->bcast.timeout);
2133	pdu.cp.num_bis = num_bis;
2134	memcpy(pdu.bis, bis, num_bis);
2135
2136	return hci_send_cmd(hdev, HCI_OP_LE_BIG_CREATE_SYNC,
2137	plen: sizeof(pdu.cp) + num_bis, param: &pdu);
2138	}
2139
2140	static void create_big_complete(struct hci_dev *hdev, void *data, int err)
2141	{
2142	struct hci_conn *conn = data;
2143
2144	bt_dev_dbg(hdev, "conn %p", conn);
2145
2146	if (err) {
2147	bt_dev_err(hdev, "Unable to create BIG: %d", err);
2148	hci_connect_cfm(conn, status: err);
2149	hci_conn_del(conn);
2150	}
2151	}
2152
2153	struct hci_conn *hci_bind_bis(struct hci_dev *hdev, bdaddr_t *dst,
2154	struct bt_iso_qos *qos,
2155	__u8 base_len, __u8 *base)
2156	{
2157	struct hci_conn *conn;
2158	struct hci_conn *parent;
2159	__u8 eir[HCI_MAX_PER_AD_LENGTH];
2160	struct hci_link *link;
2161
2162	/* Look for any BIS that is open for rebinding */
2163	conn = hci_conn_hash_lookup_big_state(hdev, handle: qos->bcast.big, state: BT_OPEN);
2164	if (conn) {
2165	memcpy(qos, &conn->iso_qos, sizeof(*qos));
2166	conn->state = BT_CONNECTED;
2167	return conn;
2168	}
2169
2170	if (base_len && base)
2171	base_len = eir_append_service_data(eir, eir_len: 0, uuid: 0x1851,
2172	data: base, data_len: base_len);
2173
2174	/* We need hci_conn object using the BDADDR_ANY as dst */
2175	conn = hci_add_bis(hdev, dst, qos, base_len, base: eir);
2176	if (IS_ERR(ptr: conn))
2177	return conn;
2178
2179	/* Update LINK PHYs according to QoS preference */
2180	conn->le_tx_phy = qos->bcast.out.phy;
2181	conn->le_tx_phy = qos->bcast.out.phy;
2182
2183	/* Add Basic Announcement into Peridic Adv Data if BASE is set */
2184	if (base_len && base) {
2185	memcpy(conn->le_per_adv_data, eir, sizeof(eir));
2186	conn->le_per_adv_data_len = base_len;
2187	}
2188
2189	hci_iso_qos_setup(hdev, conn, qos: &qos->bcast.out,
2190	phy: conn->le_tx_phy ? conn->le_tx_phy :
2191	hdev->le_tx_def_phys);
2192
2193	conn->iso_qos = *qos;
2194	conn->state = BT_BOUND;
2195
2196	/* Link BISes together */
2197	parent = hci_conn_hash_lookup_big(hdev,
2198	handle: conn->iso_qos.bcast.big);
2199	if (parent && parent != conn) {
2200	link = hci_conn_link(parent, conn);
2201	if (!link) {
2202	hci_conn_drop(conn);
2203	return ERR_PTR(error: -ENOLINK);
2204	}
2205
2206	/* Link takes the refcount */
2207	hci_conn_drop(conn);
2208	}
2209
2210	return conn;
2211	}
2212
2213	static void bis_mark_per_adv(struct hci_conn *conn, void *data)
2214	{
2215	struct iso_list_data *d = data;
2216
2217	/* Skip if not broadcast/ANY address */
2218	if (bacmp(ba1: &conn->dst, BDADDR_ANY))
2219	return;
2220
2221	if (d->big != conn->iso_qos.bcast.big ||
2222	d->bis == BT_ISO_QOS_BIS_UNSET ||
2223	d->bis != conn->iso_qos.bcast.bis)
2224	return;
2225
2226	set_bit(nr: HCI_CONN_PER_ADV, addr: &conn->flags);
2227	}
2228
2229	struct hci_conn *hci_connect_bis(struct hci_dev *hdev, bdaddr_t *dst,
2230	__u8 dst_type, struct bt_iso_qos *qos,
2231	__u8 base_len, __u8 *base)
2232	{
2233	struct hci_conn *conn;
2234	int err;
2235	struct iso_list_data data;
2236
2237	conn = hci_bind_bis(hdev, dst, qos, base_len, base);
2238	if (IS_ERR(ptr: conn))
2239	return conn;
2240
2241	if (conn->state == BT_CONNECTED)
2242	return conn;
2243
2244	data.big = qos->bcast.big;
2245	data.bis = qos->bcast.bis;
2246
2247	/* Set HCI_CONN_PER_ADV for all bound connections, to mark that
2248	* the start periodic advertising and create BIG commands have
2249	* been queued
2250	*/
2251	hci_conn_hash_list_state(hdev, func: bis_mark_per_adv, ISO_LINK,
2252	state: BT_BOUND, data: &data);
2253
2254	/* Queue start periodic advertising and create BIG */
2255	err = hci_cmd_sync_queue(hdev, func: create_big_sync, data: conn,
2256	destroy: create_big_complete);
2257	if (err < 0) {
2258	hci_conn_drop(conn);
2259	return ERR_PTR(error: err);
2260	}
2261
2262	return conn;
2263	}
2264
2265	struct hci_conn *hci_connect_cis(struct hci_dev *hdev, bdaddr_t *dst,
2266	__u8 dst_type, struct bt_iso_qos *qos)
2267	{
2268	struct hci_conn *le;
2269	struct hci_conn *cis;
2270	struct hci_link *link;
2271
2272	if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
2273	le = hci_connect_le(hdev, dst, dst_type, dst_resolved: false,
2274	BT_SECURITY_LOW,
2275	HCI_LE_CONN_TIMEOUT,
2276	HCI_ROLE_SLAVE);
2277	else
2278	le = hci_connect_le_scan(hdev, dst, dst_type,
2279	BT_SECURITY_LOW,
2280	HCI_LE_CONN_TIMEOUT,
2281	conn_reason: CONN_REASON_ISO_CONNECT);
2282	if (IS_ERR(ptr: le))
2283	return le;
2284
2285	hci_iso_qos_setup(hdev, conn: le, qos: &qos->ucast.out,
2286	phy: le->le_tx_phy ? le->le_tx_phy : hdev->le_tx_def_phys);
2287	hci_iso_qos_setup(hdev, conn: le, qos: &qos->ucast.in,
2288	phy: le->le_rx_phy ? le->le_rx_phy : hdev->le_rx_def_phys);
2289
2290	cis = hci_bind_cis(hdev, dst, dst_type, qos);
2291	if (IS_ERR(ptr: cis)) {
2292	hci_conn_drop(conn: le);
2293	return cis;
2294	}
2295
2296	link = hci_conn_link(parent: le, conn: cis);
2297	if (!link) {
2298	hci_conn_drop(conn: le);
2299	hci_conn_drop(conn: cis);
2300	return ERR_PTR(error: -ENOLINK);
2301	}
2302
2303	/* Link takes the refcount */
2304	hci_conn_drop(conn: cis);
2305
2306	cis->state = BT_CONNECT;
2307
2308	hci_le_create_cis_pending(hdev);
2309
2310	return cis;
2311	}
2312
2313	/* Check link security requirement */
2314	int hci_conn_check_link_mode(struct hci_conn *conn)
2315	{
2316	BT_DBG("hcon %p", conn);
2317
2318	/* In Secure Connections Only mode, it is required that Secure
2319	* Connections is used and the link is encrypted with AES-CCM
2320	* using a P-256 authenticated combination key.
2321	*/
2322	if (hci_dev_test_flag(conn->hdev, HCI_SC_ONLY)) {
2323	if (!hci_conn_sc_enabled(conn) ||
2324	!test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
2325	conn->key_type != HCI_LK_AUTH_COMBINATION_P256)
2326	return 0;
2327	}
2328
2329	/* AES encryption is required for Level 4:
2330	*
2331	* BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 3, Part C
2332	* page 1319:
2333	*
2334	* 128-bit equivalent strength for link and encryption keys
2335	* required using FIPS approved algorithms (E0 not allowed,
2336	* SAFER+ not allowed, and P-192 not allowed; encryption key
2337	* not shortened)
2338	*/
2339	if (conn->sec_level == BT_SECURITY_FIPS &&
2340	!test_bit(HCI_CONN_AES_CCM, &conn->flags)) {
2341	bt_dev_err(conn->hdev,
2342	"Invalid security: Missing AES-CCM usage");
2343	return 0;
2344	}
2345
2346	if (hci_conn_ssp_enabled(conn) &&
2347	!test_bit(HCI_CONN_ENCRYPT, &conn->flags))
2348	return 0;
2349
2350	return 1;
2351	}
2352
2353	/* Authenticate remote device */
2354	static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
2355	{
2356	BT_DBG("hcon %p", conn);
2357
2358	if (conn->pending_sec_level > sec_level)
2359	sec_level = conn->pending_sec_level;
2360
2361	if (sec_level > conn->sec_level)
2362	conn->pending_sec_level = sec_level;
2363	else if (test_bit(HCI_CONN_AUTH, &conn->flags))
2364	return 1;
2365
2366	/* Make sure we preserve an existing MITM requirement*/
2367	auth_type |= (conn->auth_type & 0x01);
2368
2369	conn->auth_type = auth_type;
2370
2371	if (!test_and_set_bit(nr: HCI_CONN_AUTH_PEND, addr: &conn->flags)) {
2372	struct hci_cp_auth_requested cp;
2373
2374	cp.handle = cpu_to_le16(conn->handle);
2375	hci_send_cmd(hdev: conn->hdev, HCI_OP_AUTH_REQUESTED,
2376	plen: sizeof(cp), param: &cp);
2377
2378	/* Set the ENCRYPT_PEND to trigger encryption after
2379	* authentication.
2380	*/
2381	if (!test_bit(HCI_CONN_ENCRYPT, &conn->flags))
2382	set_bit(nr: HCI_CONN_ENCRYPT_PEND, addr: &conn->flags);
2383	}
2384
2385	return 0;
2386	}
2387
2388	/* Encrypt the link */
2389	static void hci_conn_encrypt(struct hci_conn *conn)
2390	{
2391	BT_DBG("hcon %p", conn);
2392
2393	if (!test_and_set_bit(nr: HCI_CONN_ENCRYPT_PEND, addr: &conn->flags)) {
2394	struct hci_cp_set_conn_encrypt cp;
2395	cp.handle = cpu_to_le16(conn->handle);
2396	cp.encrypt = 0x01;
2397	hci_send_cmd(hdev: conn->hdev, HCI_OP_SET_CONN_ENCRYPT, plen: sizeof(cp),
2398	param: &cp);
2399	}
2400	}
2401
2402	/* Enable security */
2403	int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type,
2404	bool initiator)
2405	{
2406	BT_DBG("hcon %p", conn);
2407
2408	if (conn->type == LE_LINK)
2409	return smp_conn_security(hcon: conn, sec_level);
2410
2411	/* For sdp we don't need the link key. */
2412	if (sec_level == BT_SECURITY_SDP)
2413	return 1;
2414
2415	/* For non 2.1 devices and low security level we don't need the link
2416	key. */
2417	if (sec_level == BT_SECURITY_LOW && !hci_conn_ssp_enabled(conn))
2418	return 1;
2419
2420	/* For other security levels we need the link key. */
2421	if (!test_bit(HCI_CONN_AUTH, &conn->flags))
2422	goto auth;
2423
2424	switch (conn->key_type) {
2425	case HCI_LK_AUTH_COMBINATION_P256:
2426	/* An authenticated FIPS approved combination key has
2427	* sufficient security for security level 4 or lower.
2428	*/
2429	if (sec_level <= BT_SECURITY_FIPS)
2430	goto encrypt;
2431	break;
2432	case HCI_LK_AUTH_COMBINATION_P192:
2433	/* An authenticated combination key has sufficient security for
2434	* security level 3 or lower.
2435	*/
2436	if (sec_level <= BT_SECURITY_HIGH)
2437	goto encrypt;
2438	break;
2439	case HCI_LK_UNAUTH_COMBINATION_P192:
2440	case HCI_LK_UNAUTH_COMBINATION_P256:
2441	/* An unauthenticated combination key has sufficient security
2442	* for security level 2 or lower.
2443	*/
2444	if (sec_level <= BT_SECURITY_MEDIUM)
2445	goto encrypt;
2446	break;
2447	case HCI_LK_COMBINATION:
2448	/* A combination key has always sufficient security for the
2449	* security levels 2 or lower. High security level requires the
2450	* combination key is generated using maximum PIN code length
2451	* (16). For pre 2.1 units.
2452	*/
2453	if (sec_level <= BT_SECURITY_MEDIUM || conn->pin_length == 16)
2454	goto encrypt;
2455	break;
2456	default:
2457	break;
2458	}
2459
2460	auth:
2461	if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags))
2462	return 0;
2463
2464	if (initiator)
2465	set_bit(nr: HCI_CONN_AUTH_INITIATOR, addr: &conn->flags);
2466
2467	if (!hci_conn_auth(conn, sec_level, auth_type))
2468	return 0;
2469
2470	encrypt:
2471	if (test_bit(HCI_CONN_ENCRYPT, &conn->flags)) {
2472	/* Ensure that the encryption key size has been read,
2473	* otherwise stall the upper layer responses.
2474	*/
2475	if (!conn->enc_key_size)
2476	return 0;
2477
2478	/* Nothing else needed, all requirements are met */
2479	return 1;
2480	}
2481
2482	hci_conn_encrypt(conn);
2483	return 0;
2484	}
2485	EXPORT_SYMBOL(hci_conn_security);
2486
2487	/* Check secure link requirement */
2488	int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level)
2489	{
2490	BT_DBG("hcon %p", conn);
2491
2492	/* Accept if non-secure or higher security level is required */
2493	if (sec_level != BT_SECURITY_HIGH && sec_level != BT_SECURITY_FIPS)
2494	return 1;
2495
2496	/* Accept if secure or higher security level is already present */
2497	if (conn->sec_level == BT_SECURITY_HIGH ||
2498	conn->sec_level == BT_SECURITY_FIPS)
2499	return 1;
2500
2501	/* Reject not secure link */
2502	return 0;
2503	}
2504	EXPORT_SYMBOL(hci_conn_check_secure);
2505
2506	/* Switch role */
2507	int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
2508	{
2509	BT_DBG("hcon %p", conn);
2510
2511	if (role == conn->role)
2512	return 1;
2513
2514	if (!test_and_set_bit(nr: HCI_CONN_RSWITCH_PEND, addr: &conn->flags)) {
2515	struct hci_cp_switch_role cp;
2516	bacpy(dst: &cp.bdaddr, src: &conn->dst);
2517	cp.role = role;
2518	hci_send_cmd(hdev: conn->hdev, HCI_OP_SWITCH_ROLE, plen: sizeof(cp), param: &cp);
2519	}
2520
2521	return 0;
2522	}
2523	EXPORT_SYMBOL(hci_conn_switch_role);
2524
2525	/* Enter active mode */
2526	void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
2527	{
2528	struct hci_dev *hdev = conn->hdev;
2529
2530	BT_DBG("hcon %p mode %d", conn, conn->mode);
2531
2532	if (conn->mode != HCI_CM_SNIFF)
2533	goto timer;
2534
2535	if (!test_bit(HCI_CONN_POWER_SAVE, &conn->flags) && !force_active)
2536	goto timer;
2537
2538	if (!test_and_set_bit(nr: HCI_CONN_MODE_CHANGE_PEND, addr: &conn->flags)) {
2539	struct hci_cp_exit_sniff_mode cp;
2540	cp.handle = cpu_to_le16(conn->handle);
2541	hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, plen: sizeof(cp), param: &cp);
2542	}
2543
2544	timer:
2545	if (hdev->idle_timeout > 0)
2546	queue_delayed_work(wq: hdev->workqueue, dwork: &conn->idle_work,
2547	delay: msecs_to_jiffies(m: hdev->idle_timeout));
2548	}
2549
2550	/* Drop all connection on the device */
2551	void hci_conn_hash_flush(struct hci_dev *hdev)
2552	{
2553	struct list_head *head = &hdev->conn_hash.list;
2554	struct hci_conn *conn;
2555
2556	BT_DBG("hdev %s", hdev->name);
2557
2558	/* We should not traverse the list here, because hci_conn_del
2559	* can remove extra links, which may cause the list traversal
2560	* to hit items that have already been released.
2561	*/
2562	while ((conn = list_first_entry_or_null(head,
2563	struct hci_conn,
2564	list)) != NULL) {
2565	conn->state = BT_CLOSED;
2566	hci_disconn_cfm(conn, HCI_ERROR_LOCAL_HOST_TERM);
2567	hci_conn_del(conn);
2568	}
2569	}
2570
2571	static u32 get_link_mode(struct hci_conn *conn)
2572	{
2573	u32 link_mode = 0;
2574
2575	if (conn->role == HCI_ROLE_MASTER)
2576	link_mode |= HCI_LM_MASTER;
2577
2578	if (test_bit(HCI_CONN_ENCRYPT, &conn->flags))
2579	link_mode |= HCI_LM_ENCRYPT;
2580
2581	if (test_bit(HCI_CONN_AUTH, &conn->flags))
2582	link_mode |= HCI_LM_AUTH;
2583
2584	if (test_bit(HCI_CONN_SECURE, &conn->flags))
2585	link_mode |= HCI_LM_SECURE;
2586
2587	if (test_bit(HCI_CONN_FIPS, &conn->flags))
2588	link_mode |= HCI_LM_FIPS;
2589
2590	return link_mode;
2591	}
2592
2593	int hci_get_conn_list(void __user *arg)
2594	{
2595	struct hci_conn *c;
2596	struct hci_conn_list_req req, *cl;
2597	struct hci_conn_info *ci;
2598	struct hci_dev *hdev;
2599	int n = 0, size, err;
2600
2601	if (copy_from_user(to: &req, from: arg, n: sizeof(req)))
2602	return -EFAULT;
2603
2604	if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
2605	return -EINVAL;
2606
2607	size = sizeof(req) + req.conn_num * sizeof(*ci);
2608
2609	cl = kmalloc(size, GFP_KERNEL);
2610	if (!cl)
2611	return -ENOMEM;
2612
2613	hdev = hci_dev_get(index: req.dev_id);
2614	if (!hdev) {
2615	kfree(objp: cl);
2616	return -ENODEV;
2617	}
2618
2619	ci = cl->conn_info;
2620
2621	hci_dev_lock(hdev);
2622	list_for_each_entry(c, &hdev->conn_hash.list, list) {
2623	bacpy(dst: &(ci + n)->bdaddr, src: &c->dst);
2624	(ci + n)->handle = c->handle;
2625	(ci + n)->type = c->type;
2626	(ci + n)->out = c->out;
2627	(ci + n)->state = c->state;
2628	(ci + n)->link_mode = get_link_mode(conn: c);
2629	if (++n >= req.conn_num)
2630	break;
2631	}
2632	hci_dev_unlock(hdev);
2633
2634	cl->dev_id = hdev->id;
2635	cl->conn_num = n;
2636	size = sizeof(req) + n * sizeof(*ci);
2637
2638	hci_dev_put(d: hdev);
2639
2640	err = copy_to_user(to: arg, from: cl, n: size);
2641	kfree(objp: cl);
2642
2643	return err ? -EFAULT : 0;
2644	}
2645
2646	int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
2647	{
2648	struct hci_conn_info_req req;
2649	struct hci_conn_info ci;
2650	struct hci_conn *conn;
2651	char __user *ptr = arg + sizeof(req);
2652
2653	if (copy_from_user(to: &req, from: arg, n: sizeof(req)))
2654	return -EFAULT;
2655
2656	hci_dev_lock(hdev);
2657	conn = hci_conn_hash_lookup_ba(hdev, type: req.type, ba: &req.bdaddr);
2658	if (conn) {
2659	bacpy(dst: &ci.bdaddr, src: &conn->dst);
2660	ci.handle = conn->handle;
2661	ci.type = conn->type;
2662	ci.out = conn->out;
2663	ci.state = conn->state;
2664	ci.link_mode = get_link_mode(conn);
2665	}
2666	hci_dev_unlock(hdev);
2667
2668	if (!conn)
2669	return -ENOENT;
2670
2671	return copy_to_user(to: ptr, from: &ci, n: sizeof(ci)) ? -EFAULT : 0;
2672	}
2673
2674	int hci_get_auth_info(struct hci_dev *hdev, void __user *arg)
2675	{
2676	struct hci_auth_info_req req;
2677	struct hci_conn *conn;
2678
2679	if (copy_from_user(to: &req, from: arg, n: sizeof(req)))
2680	return -EFAULT;
2681
2682	hci_dev_lock(hdev);
2683	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, ba: &req.bdaddr);
2684	if (conn)
2685	req.type = conn->auth_type;
2686	hci_dev_unlock(hdev);
2687
2688	if (!conn)
2689	return -ENOENT;
2690
2691	return copy_to_user(to: arg, from: &req, n: sizeof(req)) ? -EFAULT : 0;
2692	}
2693
2694	struct hci_chan *hci_chan_create(struct hci_conn *conn)
2695	{
2696	struct hci_dev *hdev = conn->hdev;
2697	struct hci_chan *chan;
2698
2699	BT_DBG("%s hcon %p", hdev->name, conn);
2700
2701	if (test_bit(HCI_CONN_DROP, &conn->flags)) {
2702	BT_DBG("Refusing to create new hci_chan");
2703	return NULL;
2704	}
2705
2706	chan = kzalloc(size: sizeof(*chan), GFP_KERNEL);
2707	if (!chan)
2708	return NULL;
2709
2710	chan->conn = hci_conn_get(conn);
2711	skb_queue_head_init(list: &chan->data_q);
2712	chan->state = BT_CONNECTED;
2713
2714	list_add_rcu(new: &chan->list, head: &conn->chan_list);
2715
2716	return chan;
2717	}
2718
2719	void hci_chan_del(struct hci_chan *chan)
2720	{
2721	struct hci_conn *conn = chan->conn;
2722	struct hci_dev *hdev = conn->hdev;
2723
2724	BT_DBG("%s hcon %p chan %p", hdev->name, conn, chan);
2725
2726	list_del_rcu(entry: &chan->list);
2727
2728	synchronize_rcu();
2729
2730	/* Prevent new hci_chan's to be created for this hci_conn */
2731	set_bit(nr: HCI_CONN_DROP, addr: &conn->flags);
2732
2733	hci_conn_put(conn);
2734
2735	skb_queue_purge(list: &chan->data_q);
2736	kfree(objp: chan);
2737	}
2738
2739	void hci_chan_list_flush(struct hci_conn *conn)
2740	{
2741	struct hci_chan *chan, *n;
2742
2743	BT_DBG("hcon %p", conn);
2744
2745	list_for_each_entry_safe(chan, n, &conn->chan_list, list)
2746	hci_chan_del(chan);
2747	}
2748
2749	static struct hci_chan *__hci_chan_lookup_handle(struct hci_conn *hcon,
2750	__u16 handle)
2751	{
2752	struct hci_chan *hchan;
2753
2754	list_for_each_entry(hchan, &hcon->chan_list, list) {
2755	if (hchan->handle == handle)
2756	return hchan;
2757	}
2758
2759	return NULL;
2760	}
2761
2762	struct hci_chan *hci_chan_lookup_handle(struct hci_dev *hdev, __u16 handle)
2763	{
2764	struct hci_conn_hash *h = &hdev->conn_hash;
2765	struct hci_conn *hcon;
2766	struct hci_chan *hchan = NULL;
2767
2768	rcu_read_lock();
2769
2770	list_for_each_entry_rcu(hcon, &h->list, list) {
2771	hchan = __hci_chan_lookup_handle(hcon, handle);
2772	if (hchan)
2773	break;
2774	}
2775
2776	rcu_read_unlock();
2777
2778	return hchan;
2779	}
2780
2781	u32 hci_conn_get_phy(struct hci_conn *conn)
2782	{
2783	u32 phys = 0;
2784
2785	/* BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 2, Part B page 471:
2786	* Table 6.2: Packets defined for synchronous, asynchronous, and
2787	* CPB logical transport types.
2788	*/
2789	switch (conn->type) {
2790	case SCO_LINK:
2791	/* SCO logical transport (1 Mb/s):
2792	* HV1, HV2, HV3 and DV.
2793	*/
2794	phys |= BT_PHY_BR_1M_1SLOT;
2795
2796	break;
2797
2798	case ACL_LINK:
2799	/* ACL logical transport (1 Mb/s) ptt=0:
2800	* DH1, DM3, DH3, DM5 and DH5.
2801	*/
2802	phys |= BT_PHY_BR_1M_1SLOT;
2803
2804	if (conn->pkt_type & (HCI_DM3 | HCI_DH3))
2805	phys |= BT_PHY_BR_1M_3SLOT;
2806
2807	if (conn->pkt_type & (HCI_DM5 | HCI_DH5))
2808	phys |= BT_PHY_BR_1M_5SLOT;
2809
2810	/* ACL logical transport (2 Mb/s) ptt=1:
2811	* 2-DH1, 2-DH3 and 2-DH5.
2812	*/
2813	if (!(conn->pkt_type & HCI_2DH1))
2814	phys |= BT_PHY_EDR_2M_1SLOT;
2815
2816	if (!(conn->pkt_type & HCI_2DH3))
2817	phys |= BT_PHY_EDR_2M_3SLOT;
2818
2819	if (!(conn->pkt_type & HCI_2DH5))
2820	phys |= BT_PHY_EDR_2M_5SLOT;
2821
2822	/* ACL logical transport (3 Mb/s) ptt=1:
2823	* 3-DH1, 3-DH3 and 3-DH5.
2824	*/
2825	if (!(conn->pkt_type & HCI_3DH1))
2826	phys |= BT_PHY_EDR_3M_1SLOT;
2827
2828	if (!(conn->pkt_type & HCI_3DH3))
2829	phys |= BT_PHY_EDR_3M_3SLOT;
2830
2831	if (!(conn->pkt_type & HCI_3DH5))
2832	phys |= BT_PHY_EDR_3M_5SLOT;
2833
2834	break;
2835
2836	case ESCO_LINK:
2837	/* eSCO logical transport (1 Mb/s): EV3, EV4 and EV5 */
2838	phys |= BT_PHY_BR_1M_1SLOT;
2839
2840	if (!(conn->pkt_type & (ESCO_EV4 | ESCO_EV5)))
2841	phys |= BT_PHY_BR_1M_3SLOT;
2842
2843	/* eSCO logical transport (2 Mb/s): 2-EV3, 2-EV5 */
2844	if (!(conn->pkt_type & ESCO_2EV3))
2845	phys |= BT_PHY_EDR_2M_1SLOT;
2846
2847	if (!(conn->pkt_type & ESCO_2EV5))
2848	phys |= BT_PHY_EDR_2M_3SLOT;
2849
2850	/* eSCO logical transport (3 Mb/s): 3-EV3, 3-EV5 */
2851	if (!(conn->pkt_type & ESCO_3EV3))
2852	phys |= BT_PHY_EDR_3M_1SLOT;
2853
2854	if (!(conn->pkt_type & ESCO_3EV5))
2855	phys |= BT_PHY_EDR_3M_3SLOT;
2856
2857	break;
2858
2859	case LE_LINK:
2860	if (conn->le_tx_phy & HCI_LE_SET_PHY_1M)
2861	phys |= BT_PHY_LE_1M_TX;
2862
2863	if (conn->le_rx_phy & HCI_LE_SET_PHY_1M)
2864	phys |= BT_PHY_LE_1M_RX;
2865
2866	if (conn->le_tx_phy & HCI_LE_SET_PHY_2M)
2867	phys |= BT_PHY_LE_2M_TX;
2868
2869	if (conn->le_rx_phy & HCI_LE_SET_PHY_2M)
2870	phys |= BT_PHY_LE_2M_RX;
2871
2872	if (conn->le_tx_phy & HCI_LE_SET_PHY_CODED)
2873	phys |= BT_PHY_LE_CODED_TX;
2874
2875	if (conn->le_rx_phy & HCI_LE_SET_PHY_CODED)
2876	phys |= BT_PHY_LE_CODED_RX;
2877
2878	break;
2879	}
2880
2881	return phys;
2882	}
2883
2884	static int abort_conn_sync(struct hci_dev *hdev, void *data)
2885	{
2886	struct hci_conn *conn = data;
2887
2888	if (!hci_conn_valid(hdev, conn))
2889	return -ECANCELED;
2890
2891	return hci_abort_conn_sync(hdev, conn, reason: conn->abort_reason);
2892	}
2893
2894	int hci_abort_conn(struct hci_conn *conn, u8 reason)
2895	{
2896	struct hci_dev *hdev = conn->hdev;
2897
2898	/* If abort_reason has already been set it means the connection is
2899	* already being aborted so don't attempt to overwrite it.
2900	*/
2901	if (conn->abort_reason)
2902	return 0;
2903
2904	bt_dev_dbg(hdev, "handle 0x%2.2x reason 0x%2.2x", conn->handle, reason);
2905
2906	conn->abort_reason = reason;
2907
2908	/* If the connection is pending check the command opcode since that
2909	* might be blocking on hci_cmd_sync_work while waiting its respective
2910	* event so we need to hci_cmd_sync_cancel to cancel it.
2911	*
2912	* hci_connect_le serializes the connection attempts so only one
2913	* connection can be in BT_CONNECT at time.
2914	*/
2915	if (conn->state == BT_CONNECT && hdev->req_status == HCI_REQ_PEND) {
2916	switch (hci_skb_event(hdev->sent_cmd)) {
2917	case HCI_EV_CONN_COMPLETE:
2918	case HCI_EV_LE_CONN_COMPLETE:
2919	case HCI_EV_LE_ENHANCED_CONN_COMPLETE:
2920	case HCI_EVT_LE_CIS_ESTABLISHED:
2921	hci_cmd_sync_cancel(hdev, ECANCELED);
2922	break;
2923	}
2924	/* Cancel connect attempt if still queued/pending */
2925	} else if (!hci_cancel_connect_sync(hdev, conn)) {
2926	return 0;
2927	}
2928
2929	return hci_cmd_sync_queue_once(hdev, func: abort_conn_sync, data: conn, NULL);
2930	}
2931