1	/*
2	BlueZ - Bluetooth protocol stack for Linux
3	Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
4	Copyright 2023-2024 NXP
5
6	Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
7
8	This program is free software; you can redistribute it and/or modify
9	it under the terms of the GNU General Public License version 2 as
10	published by the Free Software Foundation;
11
12	THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
13	OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
14	FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
15	IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
16	CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
17	WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
18	ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
19	OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20
21	ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
22	COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
23	SOFTWARE IS DISCLAIMED.
24	*/
25
26	/* Bluetooth HCI connection handling. */
27
28	#include <linux/export.h>
29	#include <linux/debugfs.h>
30	#include <linux/errqueue.h>
31
32	#include <net/bluetooth/bluetooth.h>
33	#include <net/bluetooth/hci_core.h>
34	#include <net/bluetooth/l2cap.h>
35	#include <net/bluetooth/iso.h>
36	#include <net/bluetooth/mgmt.h>
37
38	#include "smp.h"
39	#include "eir.h"
40
41	struct sco_param {
42	u16 pkt_type;
43	u16 max_latency;
44	u8 retrans_effort;
45	};
46
47	struct conn_handle_t {
48	struct hci_conn *conn;
49	__u16 handle;
50	};
51
52	static const struct sco_param esco_param_cvsd[] = {
53	{ EDR_ESCO_MASK & ~ESCO_2EV3, 0x000a, 0x01 }, /* S3 */
54	{ EDR_ESCO_MASK & ~ESCO_2EV3, 0x0007, 0x01 }, /* S2 */
55	{ EDR_ESCO_MASK | ESCO_EV3, 0x0007, 0x01 }, /* S1 */
56	{ EDR_ESCO_MASK | ESCO_HV3, 0xffff, 0x01 }, /* D1 */
57	{ EDR_ESCO_MASK | ESCO_HV1, 0xffff, 0x01 }, /* D0 */
58	};
59
60	static const struct sco_param sco_param_cvsd[] = {
61	{ EDR_ESCO_MASK | ESCO_HV3, 0xffff, 0xff }, /* D1 */
62	{ EDR_ESCO_MASK | ESCO_HV1, 0xffff, 0xff }, /* D0 */
63	};
64
65	static const struct sco_param esco_param_msbc[] = {
66	{ EDR_ESCO_MASK & ~ESCO_2EV3, 0x000d, 0x02 }, /* T2 */
67	{ EDR_ESCO_MASK | ESCO_EV3, 0x0008, 0x02 }, /* T1 */
68	};
69
70	/* This function requires the caller holds hdev->lock */
71	void hci_connect_le_scan_cleanup(struct hci_conn *conn, u8 status)
72	{
73	struct hci_conn_params *params;
74	struct hci_dev *hdev = conn->hdev;
75	struct smp_irk *irk;
76	bdaddr_t *bdaddr;
77	u8 bdaddr_type;
78
79	bdaddr = &conn->dst;
80	bdaddr_type = conn->dst_type;
81
82	/* Check if we need to convert to identity address */
83	irk = hci_get_irk(hdev, bdaddr, addr_type: bdaddr_type);
84	if (irk) {
85	bdaddr = &irk->bdaddr;
86	bdaddr_type = irk->addr_type;
87	}
88
89	params = hci_pend_le_action_lookup(list: &hdev->pend_le_conns, addr: bdaddr,
90	addr_type: bdaddr_type);
91	if (!params)
92	return;
93
94	if (params->conn) {
95	hci_conn_drop(conn: params->conn);
96	hci_conn_put(conn: params->conn);
97	params->conn = NULL;
98	}
99
100	if (!params->explicit_connect)
101	return;
102
103	/* If the status indicates successful cancellation of
104	* the attempt (i.e. Unknown Connection Id) there's no point of
105	* notifying failure since we'll go back to keep trying to
106	* connect. The only exception is explicit connect requests
107	* where a timeout + cancel does indicate an actual failure.
108	*/
109	if (status && status != HCI_ERROR_UNKNOWN_CONN_ID)
110	mgmt_connect_failed(hdev, conn, status);
111
112	/* The connection attempt was doing scan for new RPA, and is
113	* in scan phase. If params are not associated with any other
114	* autoconnect action, remove them completely. If they are, just unmark
115	* them as waiting for connection, by clearing explicit_connect field.
116	*/
117	params->explicit_connect = false;
118
119	hci_pend_le_list_del_init(param: params);
120
121	switch (params->auto_connect) {
122	case HCI_AUTO_CONN_EXPLICIT:
123	hci_conn_params_del(hdev, addr: bdaddr, addr_type: bdaddr_type);
124	/* return instead of break to avoid duplicate scan update */
125	return;
126	case HCI_AUTO_CONN_DIRECT:
127	case HCI_AUTO_CONN_ALWAYS:
128	hci_pend_le_list_add(param: params, list: &hdev->pend_le_conns);
129	break;
130	case HCI_AUTO_CONN_REPORT:
131	hci_pend_le_list_add(param: params, list: &hdev->pend_le_reports);
132	break;
133	default:
134	break;
135	}
136
137	hci_update_passive_scan(hdev);
138	}
139
140	static void hci_conn_cleanup(struct hci_conn *conn)
141	{
142	struct hci_dev *hdev = conn->hdev;
143
144	if (test_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags))
145	hci_conn_params_del(hdev: conn->hdev, addr: &conn->dst, addr_type: conn->dst_type);
146
147	if (test_and_clear_bit(nr: HCI_CONN_FLUSH_KEY, addr: &conn->flags))
148	hci_remove_link_key(hdev, bdaddr: &conn->dst);
149
150	hci_chan_list_flush(conn);
151
152	if (HCI_CONN_HANDLE_UNSET(conn->handle))
153	ida_free(&hdev->unset_handle_ida, id: conn->handle);
154
155	if (conn->cleanup)
156	conn->cleanup(conn);
157
158	if (conn->type == SCO_LINK || conn->type == ESCO_LINK) {
159	switch (conn->setting & SCO_AIRMODE_MASK) {
160	case SCO_AIRMODE_CVSD:
161	case SCO_AIRMODE_TRANSP:
162	if (hdev->notify)
163	hdev->notify(hdev, HCI_NOTIFY_DISABLE_SCO);
164	break;
165	}
166	} else {
167	if (hdev->notify)
168	hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
169	}
170
171	debugfs_remove_recursive(dentry: conn->debugfs);
172
173	hci_conn_del_sysfs(conn);
174
175	hci_dev_put(d: hdev);
176	}
177
178	int hci_disconnect(struct hci_conn *conn, __u8 reason)
179	{
180	BT_DBG("hcon %p", conn);
181
182	/* When we are central of an established connection and it enters
183	* the disconnect timeout, then go ahead and try to read the
184	* current clock offset. Processing of the result is done
185	* within the event handling and hci_clock_offset_evt function.
186	*/
187	if (conn->type == ACL_LINK && conn->role == HCI_ROLE_MASTER &&
188	(conn->state == BT_CONNECTED || conn->state == BT_CONFIG)) {
189	struct hci_dev *hdev = conn->hdev;
190	struct hci_cp_read_clock_offset clkoff_cp;
191
192	clkoff_cp.handle = cpu_to_le16(conn->handle);
193	hci_send_cmd(hdev, HCI_OP_READ_CLOCK_OFFSET, plen: sizeof(clkoff_cp),
194	param: &clkoff_cp);
195	}
196
197	return hci_abort_conn(conn, reason);
198	}
199
200	static void hci_add_sco(struct hci_conn *conn, __u16 handle)
201	{
202	struct hci_dev *hdev = conn->hdev;
203	struct hci_cp_add_sco cp;
204
205	BT_DBG("hcon %p", conn);
206
207	conn->state = BT_CONNECT;
208	conn->out = true;
209
210	conn->attempt++;
211
212	cp.handle = cpu_to_le16(handle);
213	cp.pkt_type = cpu_to_le16(conn->pkt_type);
214
215	hci_send_cmd(hdev, HCI_OP_ADD_SCO, plen: sizeof(cp), param: &cp);
216	}
217
218	static bool find_next_esco_param(struct hci_conn *conn,
219	const struct sco_param *esco_param, int size)
220	{
221	if (!conn->parent)
222	return false;
223
224	for (; conn->attempt <= size; conn->attempt++) {
225	if (lmp_esco_2m_capable(conn->parent) ||
226	(esco_param[conn->attempt - 1].pkt_type & ESCO_2EV3))
227	break;
228	BT_DBG("hcon %p skipped attempt %d, eSCO 2M not supported",
229	conn, conn->attempt);
230	}
231
232	return conn->attempt <= size;
233	}
234
235	static int configure_datapath_sync(struct hci_dev *hdev, struct bt_codec *codec)
236	{
237	int err;
238	__u8 vnd_len, *vnd_data = NULL;
239	struct hci_op_configure_data_path *cmd = NULL;
240
241	/* Do not take below 2 checks as error since the 1st means user do not
242	* want to use HFP offload mode and the 2nd means the vendor controller
243	* do not need to send below HCI command for offload mode.
244	*/
245	if (!codec->data_path || !hdev->get_codec_config_data)
246	return 0;
247
248	err = hdev->get_codec_config_data(hdev, ESCO_LINK, codec, &vnd_len,
249	&vnd_data);
250	if (err < 0)
251	goto error;
252
253	cmd = kzalloc(sizeof(*cmd) + vnd_len, GFP_KERNEL);
254	if (!cmd) {
255	err = -ENOMEM;
256	goto error;
257	}
258
259	err = hdev->get_data_path_id(hdev, &cmd->data_path_id);
260	if (err < 0)
261	goto error;
262
263	cmd->vnd_len = vnd_len;
264	memcpy(cmd->vnd_data, vnd_data, vnd_len);
265
266	cmd->direction = 0x00;
267	__hci_cmd_sync_status(hdev, HCI_CONFIGURE_DATA_PATH,
268	plen: sizeof(*cmd) + vnd_len, param: cmd, HCI_CMD_TIMEOUT);
269
270	cmd->direction = 0x01;
271	err = __hci_cmd_sync_status(hdev, HCI_CONFIGURE_DATA_PATH,
272	plen: sizeof(*cmd) + vnd_len, param: cmd,
273	HCI_CMD_TIMEOUT);
274	error:
275
276	kfree(objp: cmd);
277	kfree(objp: vnd_data);
278	return err;
279	}
280
281	static int hci_enhanced_setup_sync(struct hci_dev *hdev, void *data)
282	{
283	struct conn_handle_t *conn_handle = data;
284	struct hci_conn *conn = conn_handle->conn;
285	__u16 handle = conn_handle->handle;
286	struct hci_cp_enhanced_setup_sync_conn cp;
287	const struct sco_param *param;
288
289	kfree(objp: conn_handle);
290
291	if (!hci_conn_valid(hdev, conn))
292	return -ECANCELED;
293
294	bt_dev_dbg(hdev, "hcon %p", conn);
295
296	configure_datapath_sync(hdev, codec: &conn->codec);
297
298	conn->state = BT_CONNECT;
299	conn->out = true;
300
301	conn->attempt++;
302
303	memset(&cp, 0x00, sizeof(cp));
304
305	cp.handle = cpu_to_le16(handle);
306
307	cp.tx_bandwidth = cpu_to_le32(0x00001f40);
308	cp.rx_bandwidth = cpu_to_le32(0x00001f40);
309
310	switch (conn->codec.id) {
311	case BT_CODEC_MSBC:
312	if (!find_next_esco_param(conn, esco_param: esco_param_msbc,
313	ARRAY_SIZE(esco_param_msbc)))
314	return -EINVAL;
315
316	param = &esco_param_msbc[conn->attempt - 1];
317	cp.tx_coding_format.id = 0x05;
318	cp.rx_coding_format.id = 0x05;
319	cp.tx_codec_frame_size = __cpu_to_le16(60);
320	cp.rx_codec_frame_size = __cpu_to_le16(60);
321	cp.in_bandwidth = __cpu_to_le32(32000);
322	cp.out_bandwidth = __cpu_to_le32(32000);
323	cp.in_coding_format.id = 0x04;
324	cp.out_coding_format.id = 0x04;
325	cp.in_coded_data_size = __cpu_to_le16(16);
326	cp.out_coded_data_size = __cpu_to_le16(16);
327	cp.in_pcm_data_format = 2;
328	cp.out_pcm_data_format = 2;
329	cp.in_pcm_sample_payload_msb_pos = 0;
330	cp.out_pcm_sample_payload_msb_pos = 0;
331	cp.in_data_path = conn->codec.data_path;
332	cp.out_data_path = conn->codec.data_path;
333	cp.in_transport_unit_size = 1;
334	cp.out_transport_unit_size = 1;
335	break;
336
337	case BT_CODEC_TRANSPARENT:
338	if (!find_next_esco_param(conn, esco_param: esco_param_msbc,
339	ARRAY_SIZE(esco_param_msbc)))
340	return -EINVAL;
341
342	param = &esco_param_msbc[conn->attempt - 1];
343	cp.tx_coding_format.id = 0x03;
344	cp.rx_coding_format.id = 0x03;
345	cp.tx_codec_frame_size = __cpu_to_le16(60);
346	cp.rx_codec_frame_size = __cpu_to_le16(60);
347	cp.in_bandwidth = __cpu_to_le32(0x1f40);
348	cp.out_bandwidth = __cpu_to_le32(0x1f40);
349	cp.in_coding_format.id = 0x03;
350	cp.out_coding_format.id = 0x03;
351	cp.in_coded_data_size = __cpu_to_le16(16);
352	cp.out_coded_data_size = __cpu_to_le16(16);
353	cp.in_pcm_data_format = 2;
354	cp.out_pcm_data_format = 2;
355	cp.in_pcm_sample_payload_msb_pos = 0;
356	cp.out_pcm_sample_payload_msb_pos = 0;
357	cp.in_data_path = conn->codec.data_path;
358	cp.out_data_path = conn->codec.data_path;
359	cp.in_transport_unit_size = 1;
360	cp.out_transport_unit_size = 1;
361	break;
362
363	case BT_CODEC_CVSD:
364	if (conn->parent && lmp_esco_capable(conn->parent)) {
365	if (!find_next_esco_param(conn, esco_param: esco_param_cvsd,
366	ARRAY_SIZE(esco_param_cvsd)))
367	return -EINVAL;
368	param = &esco_param_cvsd[conn->attempt - 1];
369	} else {
370	if (conn->attempt > ARRAY_SIZE(sco_param_cvsd))
371	return -EINVAL;
372	param = &sco_param_cvsd[conn->attempt - 1];
373	}
374	cp.tx_coding_format.id = 2;
375	cp.rx_coding_format.id = 2;
376	cp.tx_codec_frame_size = __cpu_to_le16(60);
377	cp.rx_codec_frame_size = __cpu_to_le16(60);
378	cp.in_bandwidth = __cpu_to_le32(16000);
379	cp.out_bandwidth = __cpu_to_le32(16000);
380	cp.in_coding_format.id = 4;
381	cp.out_coding_format.id = 4;
382	cp.in_coded_data_size = __cpu_to_le16(16);
383	cp.out_coded_data_size = __cpu_to_le16(16);
384	cp.in_pcm_data_format = 2;
385	cp.out_pcm_data_format = 2;
386	cp.in_pcm_sample_payload_msb_pos = 0;
387	cp.out_pcm_sample_payload_msb_pos = 0;
388	cp.in_data_path = conn->codec.data_path;
389	cp.out_data_path = conn->codec.data_path;
390	cp.in_transport_unit_size = 16;
391	cp.out_transport_unit_size = 16;
392	break;
393	default:
394	return -EINVAL;
395	}
396
397	cp.retrans_effort = param->retrans_effort;
398	cp.pkt_type = __cpu_to_le16(param->pkt_type);
399	cp.max_latency = __cpu_to_le16(param->max_latency);
400
401	if (hci_send_cmd(hdev, HCI_OP_ENHANCED_SETUP_SYNC_CONN, plen: sizeof(cp), param: &cp) < 0)
402	return -EIO;
403
404	return 0;
405	}
406
407	static bool hci_setup_sync_conn(struct hci_conn *conn, __u16 handle)
408	{
409	struct hci_dev *hdev = conn->hdev;
410	struct hci_cp_setup_sync_conn cp;
411	const struct sco_param *param;
412
413	bt_dev_dbg(hdev, "hcon %p", conn);
414
415	conn->state = BT_CONNECT;
416	conn->out = true;
417
418	conn->attempt++;
419
420	cp.handle = cpu_to_le16(handle);
421
422	cp.tx_bandwidth = cpu_to_le32(0x00001f40);
423	cp.rx_bandwidth = cpu_to_le32(0x00001f40);
424	cp.voice_setting = cpu_to_le16(conn->setting);
425
426	switch (conn->setting & SCO_AIRMODE_MASK) {
427	case SCO_AIRMODE_TRANSP:
428	if (!find_next_esco_param(conn, esco_param: esco_param_msbc,
429	ARRAY_SIZE(esco_param_msbc)))
430	return false;
431	param = &esco_param_msbc[conn->attempt - 1];
432	break;
433	case SCO_AIRMODE_CVSD:
434	if (conn->parent && lmp_esco_capable(conn->parent)) {
435	if (!find_next_esco_param(conn, esco_param: esco_param_cvsd,
436	ARRAY_SIZE(esco_param_cvsd)))
437	return false;
438	param = &esco_param_cvsd[conn->attempt - 1];
439	} else {
440	if (conn->attempt > ARRAY_SIZE(sco_param_cvsd))
441	return false;
442	param = &sco_param_cvsd[conn->attempt - 1];
443	}
444	break;
445	default:
446	return false;
447	}
448
449	cp.retrans_effort = param->retrans_effort;
450	cp.pkt_type = __cpu_to_le16(param->pkt_type);
451	cp.max_latency = __cpu_to_le16(param->max_latency);
452
453	if (hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, plen: sizeof(cp), param: &cp) < 0)
454	return false;
455
456	return true;
457	}
458
459	bool hci_setup_sync(struct hci_conn *conn, __u16 handle)
460	{
461	int result;
462	struct conn_handle_t *conn_handle;
463
464	if (enhanced_sync_conn_capable(conn->hdev)) {
465	conn_handle = kzalloc(sizeof(*conn_handle), GFP_KERNEL);
466
467	if (!conn_handle)
468	return false;
469
470	conn_handle->conn = conn;
471	conn_handle->handle = handle;
472	result = hci_cmd_sync_queue(hdev: conn->hdev, func: hci_enhanced_setup_sync,
473	data: conn_handle, NULL);
474	if (result < 0)
475	kfree(objp: conn_handle);
476
477	return result == 0;
478	}
479
480	return hci_setup_sync_conn(conn, handle);
481	}
482
483	u8 hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max, u16 latency,
484	u16 to_multiplier)
485	{
486	struct hci_dev *hdev = conn->hdev;
487	struct hci_conn_params *params;
488	struct hci_cp_le_conn_update cp;
489
490	hci_dev_lock(hdev);
491
492	params = hci_conn_params_lookup(hdev, addr: &conn->dst, addr_type: conn->dst_type);
493	if (params) {
494	params->conn_min_interval = min;
495	params->conn_max_interval = max;
496	params->conn_latency = latency;
497	params->supervision_timeout = to_multiplier;
498	}
499
500	hci_dev_unlock(hdev);
501
502	memset(&cp, 0, sizeof(cp));
503	cp.handle = cpu_to_le16(conn->handle);
504	cp.conn_interval_min = cpu_to_le16(min);
505	cp.conn_interval_max = cpu_to_le16(max);
506	cp.conn_latency = cpu_to_le16(latency);
507	cp.supervision_timeout = cpu_to_le16(to_multiplier);
508	cp.min_ce_len = cpu_to_le16(0x0000);
509	cp.max_ce_len = cpu_to_le16(0x0000);
510
511	hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, plen: sizeof(cp), param: &cp);
512
513	if (params)
514	return 0x01;
515
516	return 0x00;
517	}
518
519	void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __le64 rand,
520	__u8 ltk[16], __u8 key_size)
521	{
522	struct hci_dev *hdev = conn->hdev;
523	struct hci_cp_le_start_enc cp;
524
525	BT_DBG("hcon %p", conn);
526
527	memset(&cp, 0, sizeof(cp));
528
529	cp.handle = cpu_to_le16(conn->handle);
530	cp.rand = rand;
531	cp.ediv = ediv;
532	memcpy(cp.ltk, ltk, key_size);
533
534	hci_send_cmd(hdev, HCI_OP_LE_START_ENC, plen: sizeof(cp), param: &cp);
535	}
536
537	/* Device _must_ be locked */
538	void hci_sco_setup(struct hci_conn *conn, __u8 status)
539	{
540	struct hci_link *link;
541
542	link = list_first_entry_or_null(&conn->link_list, struct hci_link, list);
543	if (!link || !link->conn)
544	return;
545
546	BT_DBG("hcon %p", conn);
547
548	if (!status) {
549	if (lmp_esco_capable(conn->hdev))
550	hci_setup_sync(conn: link->conn, handle: conn->handle);
551	else
552	hci_add_sco(conn: link->conn, handle: conn->handle);
553	} else {
554	hci_connect_cfm(conn: link->conn, status);
555	hci_conn_del(conn: link->conn);
556	}
557	}
558
559	static void hci_conn_timeout(struct work_struct *work)
560	{
561	struct hci_conn *conn = container_of(work, struct hci_conn,
562	disc_work.work);
563	int refcnt = atomic_read(v: &conn->refcnt);
564
565	BT_DBG("hcon %p state %s", conn, state_to_string(conn->state));
566
567	WARN_ON(refcnt < 0);
568
569	/* FIXME: It was observed that in pairing failed scenario, refcnt
570	* drops below 0. Probably this is because l2cap_conn_del calls
571	* l2cap_chan_del for each channel, and inside l2cap_chan_del conn is
572	* dropped. After that loop hci_chan_del is called which also drops
573	* conn. For now make sure that ACL is alive if refcnt is higher then 0,
574	* otherwise drop it.
575	*/
576	if (refcnt > 0)
577	return;
578
579	hci_abort_conn(conn, reason: hci_proto_disconn_ind(conn));
580	}
581
582	/* Enter sniff mode */
583	static void hci_conn_idle(struct work_struct *work)
584	{
585	struct hci_conn *conn = container_of(work, struct hci_conn,
586	idle_work.work);
587	struct hci_dev *hdev = conn->hdev;
588
589	BT_DBG("hcon %p mode %d", conn, conn->mode);
590
591	if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn))
592	return;
593
594	if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF))
595	return;
596
597	if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
598	struct hci_cp_sniff_subrate cp;
599	cp.handle = cpu_to_le16(conn->handle);
600	cp.max_latency = cpu_to_le16(0);
601	cp.min_remote_timeout = cpu_to_le16(0);
602	cp.min_local_timeout = cpu_to_le16(0);
603	hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, plen: sizeof(cp), param: &cp);
604	}
605
606	if (!test_and_set_bit(nr: HCI_CONN_MODE_CHANGE_PEND, addr: &conn->flags)) {
607	struct hci_cp_sniff_mode cp;
608	cp.handle = cpu_to_le16(conn->handle);
609	cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
610	cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
611	cp.attempt = cpu_to_le16(4);
612	cp.timeout = cpu_to_le16(1);
613	hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, plen: sizeof(cp), param: &cp);
614	}
615	}
616
617	static void hci_conn_auto_accept(struct work_struct *work)
618	{
619	struct hci_conn *conn = container_of(work, struct hci_conn,
620	auto_accept_work.work);
621
622	hci_send_cmd(hdev: conn->hdev, HCI_OP_USER_CONFIRM_REPLY, plen: sizeof(conn->dst),
623	param: &conn->dst);
624	}
625
626	static void le_disable_advertising(struct hci_dev *hdev)
627	{
628	if (ext_adv_capable(hdev)) {
629	struct hci_cp_le_set_ext_adv_enable cp;
630
631	cp.enable = 0x00;
632	cp.num_of_sets = 0x00;
633
634	hci_send_cmd(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE, plen: sizeof(cp),
635	param: &cp);
636	} else {
637	u8 enable = 0x00;
638	hci_send_cmd(hdev, HCI_OP_LE_SET_ADV_ENABLE, plen: sizeof(enable),
639	param: &enable);
640	}
641	}
642
643	static void le_conn_timeout(struct work_struct *work)
644	{
645	struct hci_conn *conn = container_of(work, struct hci_conn,
646	le_conn_timeout.work);
647	struct hci_dev *hdev = conn->hdev;
648
649	BT_DBG("");
650
651	/* We could end up here due to having done directed advertising,
652	* so clean up the state if necessary. This should however only
653	* happen with broken hardware or if low duty cycle was used
654	* (which doesn't have a timeout of its own).
655	*/
656	if (conn->role == HCI_ROLE_SLAVE) {
657	/* Disable LE Advertising */
658	le_disable_advertising(hdev);
659	hci_dev_lock(hdev);
660	hci_conn_failed(conn, HCI_ERROR_ADVERTISING_TIMEOUT);
661	hci_dev_unlock(hdev);
662	return;
663	}
664
665	hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
666	}
667
668	struct iso_list_data {
669	union {
670	u8 cig;
671	u8 big;
672	};
673	union {
674	u8 cis;
675	u8 bis;
676	u16 sync_handle;
677	};
678	int count;
679	bool big_term;
680	bool pa_sync_term;
681	bool big_sync_term;
682	};
683
684	static void bis_list(struct hci_conn *conn, void *data)
685	{
686	struct iso_list_data *d = data;
687
688	/* Skip if not broadcast/ANY address */
689	if (bacmp(ba1: &conn->dst, BDADDR_ANY))
690	return;
691
692	if (d->big != conn->iso_qos.bcast.big || d->bis == BT_ISO_QOS_BIS_UNSET ||
693	d->bis != conn->iso_qos.bcast.bis)
694	return;
695
696	d->count++;
697	}
698
699	static int terminate_big_sync(struct hci_dev *hdev, void *data)
700	{
701	struct iso_list_data *d = data;
702
703	bt_dev_dbg(hdev, "big 0x%2.2x bis 0x%2.2x", d->big, d->bis);
704
705	hci_disable_per_advertising_sync(hdev, instance: d->bis);
706	hci_remove_ext_adv_instance_sync(hdev, instance: d->bis, NULL);
707
708	/* Only terminate BIG if it has been created */
709	if (!d->big_term)
710	return 0;
711
712	return hci_le_terminate_big_sync(hdev, handle: d->big,
713	HCI_ERROR_LOCAL_HOST_TERM);
714	}
715
716	static void terminate_big_destroy(struct hci_dev *hdev, void *data, int err)
717	{
718	kfree(objp: data);
719	}
720
721	static int hci_le_terminate_big(struct hci_dev *hdev, struct hci_conn *conn)
722	{
723	struct iso_list_data *d;
724	int ret;
725
726	bt_dev_dbg(hdev, "big 0x%2.2x bis 0x%2.2x", conn->iso_qos.bcast.big,
727	conn->iso_qos.bcast.bis);
728
729	d = kzalloc(sizeof(*d), GFP_KERNEL);
730	if (!d)
731	return -ENOMEM;
732
733	d->big = conn->iso_qos.bcast.big;
734	d->bis = conn->iso_qos.bcast.bis;
735	d->big_term = test_and_clear_bit(nr: HCI_CONN_BIG_CREATED, addr: &conn->flags);
736
737	ret = hci_cmd_sync_queue(hdev, func: terminate_big_sync, data: d,
738	destroy: terminate_big_destroy);
739	if (ret)
740	kfree(objp: d);
741
742	return ret;
743	}
744
745	static int big_terminate_sync(struct hci_dev *hdev, void *data)
746	{
747	struct iso_list_data *d = data;
748
749	bt_dev_dbg(hdev, "big 0x%2.2x sync_handle 0x%4.4x", d->big,
750	d->sync_handle);
751
752	if (d->big_sync_term)
753	hci_le_big_terminate_sync(hdev, handle: d->big);
754
755	if (d->pa_sync_term)
756	return hci_le_pa_terminate_sync(hdev, handle: d->sync_handle);
757
758	return 0;
759	}
760
761	static void find_bis(struct hci_conn *conn, void *data)
762	{
763	struct iso_list_data *d = data;
764
765	/* Ignore if BIG doesn't match */
766	if (d->big != conn->iso_qos.bcast.big)
767	return;
768
769	d->count++;
770	}
771
772	static int hci_le_big_terminate(struct hci_dev *hdev, struct hci_conn *conn)
773	{
774	struct iso_list_data *d;
775	int ret;
776
777	bt_dev_dbg(hdev, "hcon %p big 0x%2.2x sync_handle 0x%4.4x", conn,
778	conn->iso_qos.bcast.big, conn->sync_handle);
779
780	d = kzalloc(sizeof(*d), GFP_KERNEL);
781	if (!d)
782	return -ENOMEM;
783
784	d->big = conn->iso_qos.bcast.big;
785	d->sync_handle = conn->sync_handle;
786
787	if (conn->type == PA_LINK &&
788	test_and_clear_bit(nr: HCI_CONN_PA_SYNC, addr: &conn->flags)) {
789	hci_conn_hash_list_flag(hdev, func: find_bis, PA_LINK,
790	flag: HCI_CONN_PA_SYNC, data: d);
791
792	if (!d->count)
793	d->pa_sync_term = true;
794
795	d->count = 0;
796	}
797
798	if (test_and_clear_bit(nr: HCI_CONN_BIG_SYNC, addr: &conn->flags)) {
799	hci_conn_hash_list_flag(hdev, func: find_bis, BIS_LINK,
800	flag: HCI_CONN_BIG_SYNC, data: d);
801
802	if (!d->count)
803	d->big_sync_term = true;
804	}
805
806	if (!d->pa_sync_term && !d->big_sync_term)
807	return 0;
808
809	ret = hci_cmd_sync_queue(hdev, func: big_terminate_sync, data: d,
810	destroy: terminate_big_destroy);
811	if (ret)
812	kfree(objp: d);
813
814	return ret;
815	}
816
817	/* Cleanup BIS connection
818	*
819	* Detects if there any BIS left connected in a BIG
820	* broadcaster: Remove advertising instance and terminate BIG.
821	* broadcaster receiver: Terminate BIG sync and terminate PA sync.
822	*/
823	static void bis_cleanup(struct hci_conn *conn)
824	{
825	struct hci_dev *hdev = conn->hdev;
826	struct hci_conn *bis;
827
828	bt_dev_dbg(hdev, "conn %p", conn);
829
830	if (conn->role == HCI_ROLE_MASTER) {
831	if (!test_and_clear_bit(nr: HCI_CONN_PER_ADV, addr: &conn->flags))
832	return;
833
834	/* Check if ISO connection is a BIS and terminate advertising
835	* set and BIG if there are no other connections using it.
836	*/
837	bis = hci_conn_hash_lookup_big_state(hdev,
838	handle: conn->iso_qos.bcast.big,
839	state: BT_CONNECTED,
840	HCI_ROLE_MASTER);
841	if (bis)
842	return;
843
844	bis = hci_conn_hash_lookup_big_state(hdev,
845	handle: conn->iso_qos.bcast.big,
846	state: BT_CONNECT,
847	HCI_ROLE_MASTER);
848	if (bis)
849	return;
850
851	bis = hci_conn_hash_lookup_big_state(hdev,
852	handle: conn->iso_qos.bcast.big,
853	state: BT_OPEN,
854	HCI_ROLE_MASTER);
855	if (bis)
856	return;
857
858	hci_le_terminate_big(hdev, conn);
859	} else {
860	hci_le_big_terminate(hdev, conn);
861	}
862	}
863
864	static int remove_cig_sync(struct hci_dev *hdev, void *data)
865	{
866	u8 handle = PTR_UINT(data);
867
868	return hci_le_remove_cig_sync(hdev, handle);
869	}
870
871	static int hci_le_remove_cig(struct hci_dev *hdev, u8 handle)
872	{
873	bt_dev_dbg(hdev, "handle 0x%2.2x", handle);
874
875	return hci_cmd_sync_queue(hdev, func: remove_cig_sync, UINT_PTR(handle),
876	NULL);
877	}
878
879	static void find_cis(struct hci_conn *conn, void *data)
880	{
881	struct iso_list_data *d = data;
882
883	/* Ignore broadcast or if CIG don't match */
884	if (!bacmp(ba1: &conn->dst, BDADDR_ANY) || d->cig != conn->iso_qos.ucast.cig)
885	return;
886
887	d->count++;
888	}
889
890	/* Cleanup CIS connection:
891	*
892	* Detects if there any CIS left connected in a CIG and remove it.
893	*/
894	static void cis_cleanup(struct hci_conn *conn)
895	{
896	struct hci_dev *hdev = conn->hdev;
897	struct iso_list_data d;
898
899	if (conn->iso_qos.ucast.cig == BT_ISO_QOS_CIG_UNSET)
900	return;
901
902	memset(&d, 0, sizeof(d));
903	d.cig = conn->iso_qos.ucast.cig;
904
905	/* Check if ISO connection is a CIS and remove CIG if there are
906	* no other connections using it.
907	*/
908	hci_conn_hash_list_state(hdev, func: find_cis, CIS_LINK, state: BT_BOUND, data: &d);
909	hci_conn_hash_list_state(hdev, func: find_cis, CIS_LINK, state: BT_CONNECT,
910	data: &d);
911	hci_conn_hash_list_state(hdev, func: find_cis, CIS_LINK, state: BT_CONNECTED,
912	data: &d);
913	if (d.count)
914	return;
915
916	hci_le_remove_cig(hdev, handle: conn->iso_qos.ucast.cig);
917	}
918
919	static int hci_conn_hash_alloc_unset(struct hci_dev *hdev)
920	{
921	return ida_alloc_range(&hdev->unset_handle_ida, HCI_CONN_HANDLE_MAX + 1,
922	U16_MAX, GFP_ATOMIC);
923	}
924
925	static struct hci_conn *__hci_conn_add(struct hci_dev *hdev, int type,
926	bdaddr_t *dst, u8 dst_type,
927	u8 role, u16 handle)
928	{
929	struct hci_conn *conn;
930	struct smp_irk *irk = NULL;
931
932	switch (type) {
933	case ACL_LINK:
934	if (!hdev->acl_mtu)
935	return ERR_PTR(error: -ECONNREFUSED);
936	break;
937	case CIS_LINK:
938	case BIS_LINK:
939	case PA_LINK:
940	if (!hdev->iso_mtu)
941	return ERR_PTR(error: -ECONNREFUSED);
942	irk = hci_get_irk(hdev, bdaddr: dst, addr_type: dst_type);
943	break;
944	case LE_LINK:
945	if (hdev->le_mtu && hdev->le_mtu < HCI_MIN_LE_MTU)
946	return ERR_PTR(error: -ECONNREFUSED);
947	if (!hdev->le_mtu && hdev->acl_mtu < HCI_MIN_LE_MTU)
948	return ERR_PTR(error: -ECONNREFUSED);
949	irk = hci_get_irk(hdev, bdaddr: dst, addr_type: dst_type);
950	break;
951	case SCO_LINK:
952	case ESCO_LINK:
953	if (!hdev->sco_pkts)
954	/* Controller does not support SCO or eSCO over HCI */
955	return ERR_PTR(error: -ECONNREFUSED);
956	break;
957	default:
958	return ERR_PTR(error: -ECONNREFUSED);
959	}
960
961	bt_dev_dbg(hdev, "dst %pMR handle 0x%4.4x", dst, handle);
962
963	conn = kzalloc(sizeof(*conn), GFP_KERNEL);
964	if (!conn)
965	return ERR_PTR(error: -ENOMEM);
966
967	/* If and IRK exists use its identity address */
968	if (!irk) {
969	bacpy(dst: &conn->dst, src: dst);
970	conn->dst_type = dst_type;
971	} else {
972	bacpy(dst: &conn->dst, src: &irk->bdaddr);
973	conn->dst_type = irk->addr_type;
974	}
975
976	bacpy(dst: &conn->src, src: &hdev->bdaddr);
977	conn->handle = handle;
978	conn->hdev = hdev;
979	conn->type = type;
980	conn->role = role;
981	conn->mode = HCI_CM_ACTIVE;
982	conn->state = BT_OPEN;
983	conn->auth_type = HCI_AT_GENERAL_BONDING;
984	conn->io_capability = hdev->io_capability;
985	conn->remote_auth = 0xff;
986	conn->key_type = 0xff;
987	conn->rssi = HCI_RSSI_INVALID;
988	conn->tx_power = HCI_TX_POWER_INVALID;
989	conn->max_tx_power = HCI_TX_POWER_INVALID;
990	conn->sync_handle = HCI_SYNC_HANDLE_INVALID;
991	conn->sid = HCI_SID_INVALID;
992
993	set_bit(nr: HCI_CONN_POWER_SAVE, addr: &conn->flags);
994	conn->disc_timeout = HCI_DISCONN_TIMEOUT;
995
996	/* Set Default Authenticated payload timeout to 30s */
997	conn->auth_payload_timeout = DEFAULT_AUTH_PAYLOAD_TIMEOUT;
998
999	if (conn->role == HCI_ROLE_MASTER)
1000	conn->out = true;
1001
1002	switch (type) {
1003	case ACL_LINK:
1004	conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
1005	conn->mtu = hdev->acl_mtu;
1006	break;
1007	case LE_LINK:
1008	/* conn->src should reflect the local identity address */
1009	hci_copy_identity_address(hdev, bdaddr: &conn->src, bdaddr_type: &conn->src_type);
1010	conn->mtu = hdev->le_mtu ? hdev->le_mtu : hdev->acl_mtu;
1011	break;
1012	case CIS_LINK:
1013	/* conn->src should reflect the local identity address */
1014	hci_copy_identity_address(hdev, bdaddr: &conn->src, bdaddr_type: &conn->src_type);
1015
1016	if (conn->role == HCI_ROLE_MASTER)
1017	conn->cleanup = cis_cleanup;
1018
1019	conn->mtu = hdev->iso_mtu;
1020	break;
1021	case PA_LINK:
1022	case BIS_LINK:
1023	/* conn->src should reflect the local identity address */
1024	hci_copy_identity_address(hdev, bdaddr: &conn->src, bdaddr_type: &conn->src_type);
1025	conn->cleanup = bis_cleanup;
1026	conn->mtu = hdev->iso_mtu;
1027	break;
1028	case SCO_LINK:
1029	if (lmp_esco_capable(hdev))
1030	conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
1031	(hdev->esco_type & EDR_ESCO_MASK);
1032	else
1033	conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
1034
1035	conn->mtu = hdev->sco_mtu;
1036	break;
1037	case ESCO_LINK:
1038	conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
1039	conn->mtu = hdev->sco_mtu;
1040	break;
1041	}
1042
1043	skb_queue_head_init(list: &conn->data_q);
1044	skb_queue_head_init(list: &conn->tx_q.queue);
1045
1046	INIT_LIST_HEAD(list: &conn->chan_list);
1047	INIT_LIST_HEAD(list: &conn->link_list);
1048
1049	INIT_DELAYED_WORK(&conn->disc_work, hci_conn_timeout);
1050	INIT_DELAYED_WORK(&conn->auto_accept_work, hci_conn_auto_accept);
1051	INIT_DELAYED_WORK(&conn->idle_work, hci_conn_idle);
1052	INIT_DELAYED_WORK(&conn->le_conn_timeout, le_conn_timeout);
1053
1054	atomic_set(v: &conn->refcnt, i: 0);
1055
1056	hci_dev_hold(d: hdev);
1057
1058	hci_conn_hash_add(hdev, c: conn);
1059
1060	/* The SCO and eSCO connections will only be notified when their
1061	* setup has been completed. This is different to ACL links which
1062	* can be notified right away.
1063	*/
1064	if (conn->type != SCO_LINK && conn->type != ESCO_LINK) {
1065	if (hdev->notify)
1066	hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
1067	}
1068
1069	hci_conn_init_sysfs(conn);
1070	return conn;
1071	}
1072
1073	struct hci_conn *hci_conn_add_unset(struct hci_dev *hdev, int type,
1074	bdaddr_t *dst, u8 dst_type, u8 role)
1075	{
1076	int handle;
1077
1078	bt_dev_dbg(hdev, "dst %pMR", dst);
1079
1080	handle = hci_conn_hash_alloc_unset(hdev);
1081	if (unlikely(handle < 0))
1082	return ERR_PTR(error: -ECONNREFUSED);
1083
1084	return __hci_conn_add(hdev, type, dst, dst_type, role, handle);
1085	}
1086
1087	struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst,
1088	u8 dst_type, u8 role, u16 handle)
1089	{
1090	if (handle > HCI_CONN_HANDLE_MAX)
1091	return ERR_PTR(error: -EINVAL);
1092
1093	return __hci_conn_add(hdev, type, dst, dst_type, role, handle);
1094	}
1095
1096	static void hci_conn_cleanup_child(struct hci_conn *conn, u8 reason)
1097	{
1098	if (!reason)
1099	reason = HCI_ERROR_REMOTE_USER_TERM;
1100
1101	/* Due to race, SCO/ISO conn might be not established yet at this point,
1102	* and nothing else will clean it up. In other cases it is done via HCI
1103	* events.
1104	*/
1105	switch (conn->type) {
1106	case SCO_LINK:
1107	case ESCO_LINK:
1108	if (HCI_CONN_HANDLE_UNSET(conn->handle))
1109	hci_conn_failed(conn, status: reason);
1110	break;
1111	case CIS_LINK:
1112	case BIS_LINK:
1113	case PA_LINK:
1114	if ((conn->state != BT_CONNECTED &&
1115	!test_bit(HCI_CONN_CREATE_CIS, &conn->flags)) ||
1116	test_bit(HCI_CONN_BIG_CREATED, &conn->flags))
1117	hci_conn_failed(conn, status: reason);
1118	break;
1119	}
1120	}
1121
1122	static void hci_conn_unlink(struct hci_conn *conn)
1123	{
1124	struct hci_dev *hdev = conn->hdev;
1125
1126	bt_dev_dbg(hdev, "hcon %p", conn);
1127
1128	if (!conn->parent) {
1129	struct hci_link *link, *t;
1130
1131	list_for_each_entry_safe(link, t, &conn->link_list, list) {
1132	struct hci_conn *child = link->conn;
1133
1134	hci_conn_unlink(conn: child);
1135
1136	/* If hdev is down it means
1137	* hci_dev_close_sync/hci_conn_hash_flush is in progress
1138	* and links don't need to be cleanup as all connections
1139	* would be cleanup.
1140	*/
1141	if (!test_bit(HCI_UP, &hdev->flags))
1142	continue;
1143
1144	hci_conn_cleanup_child(conn: child, reason: conn->abort_reason);
1145	}
1146
1147	return;
1148	}
1149
1150	if (!conn->link)
1151	return;
1152
1153	list_del_rcu(entry: &conn->link->list);
1154	synchronize_rcu();
1155
1156	hci_conn_drop(conn: conn->parent);
1157	hci_conn_put(conn: conn->parent);
1158	conn->parent = NULL;
1159
1160	kfree(objp: conn->link);
1161	conn->link = NULL;
1162	}
1163
1164	void hci_conn_del(struct hci_conn *conn)
1165	{
1166	struct hci_dev *hdev = conn->hdev;
1167
1168	BT_DBG("%s hcon %p handle %d", hdev->name, conn, conn->handle);
1169
1170	hci_conn_unlink(conn);
1171
1172	disable_delayed_work_sync(dwork: &conn->disc_work);
1173	disable_delayed_work_sync(dwork: &conn->auto_accept_work);
1174	disable_delayed_work_sync(dwork: &conn->idle_work);
1175
1176	/* Remove the connection from the list so unacked logic can detect when
1177	* a certain pool is not being utilized.
1178	*/
1179	hci_conn_hash_del(hdev, c: conn);
1180
1181	/* Handle unacked frames:
1182	*
1183	* - In case there are no connection, or if restoring the buffers
1184	* considered in transist would overflow, restore all buffers to the
1185	* pool.
1186	* - Otherwise restore just the buffers considered in transit for the
1187	* hci_conn
1188	*/
1189	switch (conn->type) {
1190	case ACL_LINK:
1191	if (!hci_conn_num(hdev, ACL_LINK) ||
1192	hdev->acl_cnt + conn->sent > hdev->acl_pkts)
1193	hdev->acl_cnt = hdev->acl_pkts;
1194	else
1195	hdev->acl_cnt += conn->sent;
1196	break;
1197	case LE_LINK:
1198	cancel_delayed_work(dwork: &conn->le_conn_timeout);
1199
1200	if (hdev->le_pkts) {
1201	if (!hci_conn_num(hdev, LE_LINK) ||
1202	hdev->le_cnt + conn->sent > hdev->le_pkts)
1203	hdev->le_cnt = hdev->le_pkts;
1204	else
1205	hdev->le_cnt += conn->sent;
1206	} else {
1207	if ((!hci_conn_num(hdev, LE_LINK) &&
1208	!hci_conn_num(hdev, ACL_LINK)) ||
1209	hdev->acl_cnt + conn->sent > hdev->acl_pkts)
1210	hdev->acl_cnt = hdev->acl_pkts;
1211	else
1212	hdev->acl_cnt += conn->sent;
1213	}
1214	break;
1215	case CIS_LINK:
1216	case BIS_LINK:
1217	case PA_LINK:
1218	if (!hci_iso_count(hdev) ||
1219	hdev->iso_cnt + conn->sent > hdev->iso_pkts)
1220	hdev->iso_cnt = hdev->iso_pkts;
1221	else
1222	hdev->iso_cnt += conn->sent;
1223	break;
1224	}
1225
1226	skb_queue_purge(list: &conn->data_q);
1227	skb_queue_purge(list: &conn->tx_q.queue);
1228
1229	/* Remove the connection from the list and cleanup its remaining
1230	* state. This is a separate function since for some cases like
1231	* BT_CONNECT_SCAN we *only* want the cleanup part without the
1232	* rest of hci_conn_del.
1233	*/
1234	hci_conn_cleanup(conn);
1235
1236	/* Dequeue callbacks using connection pointer as data */
1237	hci_cmd_sync_dequeue(hdev, NULL, data: conn, NULL);
1238	}
1239
1240	struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src, uint8_t src_type)
1241	{
1242	int use_src = bacmp(ba1: src, BDADDR_ANY);
1243	struct hci_dev *hdev = NULL, *d;
1244
1245	BT_DBG("%pMR -> %pMR", src, dst);
1246
1247	read_lock(&hci_dev_list_lock);
1248
1249	list_for_each_entry(d, &hci_dev_list, list) {
1250	if (!test_bit(HCI_UP, &d->flags) ||
1251	hci_dev_test_flag(d, HCI_USER_CHANNEL))
1252	continue;
1253
1254	/* Simple routing:
1255	* No source address - find interface with bdaddr != dst
1256	* Source address - find interface with bdaddr == src
1257	*/
1258
1259	if (use_src) {
1260	bdaddr_t id_addr;
1261	u8 id_addr_type;
1262
1263	if (src_type == BDADDR_BREDR) {
1264	if (!lmp_bredr_capable(d))
1265	continue;
1266	bacpy(dst: &id_addr, src: &d->bdaddr);
1267	id_addr_type = BDADDR_BREDR;
1268	} else {
1269	if (!lmp_le_capable(d))
1270	continue;
1271
1272	hci_copy_identity_address(hdev: d, bdaddr: &id_addr,
1273	bdaddr_type: &id_addr_type);
1274
1275	/* Convert from HCI to three-value type */
1276	if (id_addr_type == ADDR_LE_DEV_PUBLIC)
1277	id_addr_type = BDADDR_LE_PUBLIC;
1278	else
1279	id_addr_type = BDADDR_LE_RANDOM;
1280	}
1281
1282	if (!bacmp(ba1: &id_addr, ba2: src) && id_addr_type == src_type) {
1283	hdev = d; break;
1284	}
1285	} else {
1286	if (bacmp(ba1: &d->bdaddr, ba2: dst)) {
1287	hdev = d; break;
1288	}
1289	}
1290	}
1291
1292	if (hdev)
1293	hdev = hci_dev_hold(d: hdev);
1294
1295	read_unlock(&hci_dev_list_lock);
1296	return hdev;
1297	}
1298	EXPORT_SYMBOL(hci_get_route);
1299
1300	/* This function requires the caller holds hdev->lock */
1301	static void hci_le_conn_failed(struct hci_conn *conn, u8 status)
1302	{
1303	struct hci_dev *hdev = conn->hdev;
1304
1305	hci_connect_le_scan_cleanup(conn, status);
1306
1307	/* Enable advertising in case this was a failed connection
1308	* attempt as a peripheral.
1309	*/
1310	hci_enable_advertising(hdev);
1311	}
1312
1313	/* This function requires the caller holds hdev->lock */
1314	void hci_conn_failed(struct hci_conn *conn, u8 status)
1315	{
1316	struct hci_dev *hdev = conn->hdev;
1317
1318	bt_dev_dbg(hdev, "status 0x%2.2x", status);
1319
1320	switch (conn->type) {
1321	case LE_LINK:
1322	hci_le_conn_failed(conn, status);
1323	break;
1324	case ACL_LINK:
1325	mgmt_connect_failed(hdev, conn, status);
1326	break;
1327	}
1328
1329	/* In case of BIG/PA sync failed, clear conn flags so that
1330	* the conns will be correctly cleaned up by ISO layer
1331	*/
1332	test_and_clear_bit(nr: HCI_CONN_BIG_SYNC_FAILED, addr: &conn->flags);
1333	test_and_clear_bit(nr: HCI_CONN_PA_SYNC_FAILED, addr: &conn->flags);
1334
1335	conn->state = BT_CLOSED;
1336	hci_connect_cfm(conn, status);
1337	hci_conn_del(conn);
1338	}
1339
1340	/* This function requires the caller holds hdev->lock */
1341	u8 hci_conn_set_handle(struct hci_conn *conn, u16 handle)
1342	{
1343	struct hci_dev *hdev = conn->hdev;
1344
1345	bt_dev_dbg(hdev, "hcon %p handle 0x%4.4x", conn, handle);
1346
1347	if (conn->handle == handle)
1348	return 0;
1349
1350	if (handle > HCI_CONN_HANDLE_MAX) {
1351	bt_dev_err(hdev, "Invalid handle: 0x%4.4x > 0x%4.4x",
1352	handle, HCI_CONN_HANDLE_MAX);
1353	return HCI_ERROR_INVALID_PARAMETERS;
1354	}
1355
1356	/* If abort_reason has been sent it means the connection is being
1357	* aborted and the handle shall not be changed.
1358	*/
1359	if (conn->abort_reason)
1360	return conn->abort_reason;
1361
1362	if (HCI_CONN_HANDLE_UNSET(conn->handle))
1363	ida_free(&hdev->unset_handle_ida, id: conn->handle);
1364
1365	conn->handle = handle;
1366
1367	return 0;
1368	}
1369
1370	struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,
1371	u8 dst_type, bool dst_resolved, u8 sec_level,
1372	u16 conn_timeout, u8 role, u8 phy, u8 sec_phy)
1373	{
1374	struct hci_conn *conn;
1375	struct smp_irk *irk;
1376	int err;
1377
1378	/* Let's make sure that le is enabled.*/
1379	if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1380	if (lmp_le_capable(hdev))
1381	return ERR_PTR(error: -ECONNREFUSED);
1382
1383	return ERR_PTR(error: -EOPNOTSUPP);
1384	}
1385
1386	/* Since the controller supports only one LE connection attempt at a
1387	* time, we return -EBUSY if there is any connection attempt running.
1388	*/
1389	if (hci_lookup_le_connect(hdev))
1390	return ERR_PTR(error: -EBUSY);
1391
1392	/* If there's already a connection object but it's not in
1393	* scanning state it means it must already be established, in
1394	* which case we can't do anything else except report a failure
1395	* to connect.
1396	*/
1397	conn = hci_conn_hash_lookup_le(hdev, ba: dst, ba_type: dst_type);
1398	if (conn && !test_bit(HCI_CONN_SCANNING, &conn->flags)) {
1399	return ERR_PTR(error: -EBUSY);
1400	}
1401
1402	/* Check if the destination address has been resolved by the controller
1403	* since if it did then the identity address shall be used.
1404	*/
1405	if (!dst_resolved) {
1406	/* When given an identity address with existing identity
1407	* resolving key, the connection needs to be established
1408	* to a resolvable random address.
1409	*
1410	* Storing the resolvable random address is required here
1411	* to handle connection failures. The address will later
1412	* be resolved back into the original identity address
1413	* from the connect request.
1414	*/
1415	irk = hci_find_irk_by_addr(hdev, bdaddr: dst, addr_type: dst_type);
1416	if (irk && bacmp(ba1: &irk->rpa, BDADDR_ANY)) {
1417	dst = &irk->rpa;
1418	dst_type = ADDR_LE_DEV_RANDOM;
1419	}
1420	}
1421
1422	if (conn) {
1423	bacpy(dst: &conn->dst, src: dst);
1424	} else {
1425	conn = hci_conn_add_unset(hdev, LE_LINK, dst, dst_type, role);
1426	if (IS_ERR(ptr: conn))
1427	return conn;
1428	hci_conn_hold(conn);
1429	conn->pending_sec_level = sec_level;
1430	}
1431
1432	conn->sec_level = BT_SECURITY_LOW;
1433	conn->conn_timeout = conn_timeout;
1434	conn->le_adv_phy = phy;
1435	conn->le_adv_sec_phy = sec_phy;
1436
1437	err = hci_connect_le_sync(hdev, conn);
1438	if (err) {
1439	hci_conn_del(conn);
1440	return ERR_PTR(error: err);
1441	}
1442
1443	return conn;
1444	}
1445
1446	static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
1447	{
1448	struct hci_conn *conn;
1449
1450	conn = hci_conn_hash_lookup_le(hdev, ba: addr, ba_type: type);
1451	if (!conn)
1452	return false;
1453
1454	if (conn->state != BT_CONNECTED)
1455	return false;
1456
1457	return true;
1458	}
1459
1460	/* This function requires the caller holds hdev->lock */
1461	static int hci_explicit_conn_params_set(struct hci_dev *hdev,
1462	bdaddr_t *addr, u8 addr_type)
1463	{
1464	struct hci_conn_params *params;
1465
1466	if (is_connected(hdev, addr, type: addr_type))
1467	return -EISCONN;
1468
1469	params = hci_conn_params_lookup(hdev, addr, addr_type);
1470	if (!params) {
1471	params = hci_conn_params_add(hdev, addr, addr_type);
1472	if (!params)
1473	return -ENOMEM;
1474
1475	/* If we created new params, mark them to be deleted in
1476	* hci_connect_le_scan_cleanup. It's different case than
1477	* existing disabled params, those will stay after cleanup.
1478	*/
1479	params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
1480	}
1481
1482	/* We're trying to connect, so make sure params are at pend_le_conns */
1483	if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
1484	params->auto_connect == HCI_AUTO_CONN_REPORT ||
1485	params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
1486	hci_pend_le_list_del_init(param: params);
1487	hci_pend_le_list_add(param: params, list: &hdev->pend_le_conns);
1488	}
1489
1490	params->explicit_connect = true;
1491
1492	BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
1493	params->auto_connect);
1494
1495	return 0;
1496	}
1497
1498	static int qos_set_big(struct hci_dev *hdev, struct bt_iso_qos *qos)
1499	{
1500	struct hci_conn *conn;
1501	u8 big;
1502
1503	/* Allocate a BIG if not set */
1504	if (qos->bcast.big == BT_ISO_QOS_BIG_UNSET) {
1505	for (big = 0x00; big < 0xef; big++) {
1506
1507	conn = hci_conn_hash_lookup_big(hdev, handle: big);
1508	if (!conn)
1509	break;
1510	}
1511
1512	if (big == 0xef)
1513	return -EADDRNOTAVAIL;
1514
1515	/* Update BIG */
1516	qos->bcast.big = big;
1517	}
1518
1519	return 0;
1520	}
1521
1522	static int qos_set_bis(struct hci_dev *hdev, struct bt_iso_qos *qos)
1523	{
1524	struct hci_conn *conn;
1525	u8 bis;
1526
1527	/* Allocate BIS if not set */
1528	if (qos->bcast.bis == BT_ISO_QOS_BIS_UNSET) {
1529	if (qos->bcast.big != BT_ISO_QOS_BIG_UNSET) {
1530	conn = hci_conn_hash_lookup_big(hdev, handle: qos->bcast.big);
1531
1532	if (conn) {
1533	/* If the BIG handle is already matched to an advertising
1534	* handle, do not allocate a new one.
1535	*/
1536	qos->bcast.bis = conn->iso_qos.bcast.bis;
1537	return 0;
1538	}
1539	}
1540
1541	/* Find an unused adv set to advertise BIS, skip instance 0x00
1542	* since it is reserved as general purpose set.
1543	*/
1544	for (bis = 0x01; bis < hdev->le_num_of_adv_sets;
1545	bis++) {
1546
1547	conn = hci_conn_hash_lookup_bis(hdev, BDADDR_ANY, bis);
1548	if (!conn)
1549	break;
1550	}
1551
1552	if (bis == hdev->le_num_of_adv_sets)
1553	return -EADDRNOTAVAIL;
1554
1555	/* Update BIS */
1556	qos->bcast.bis = bis;
1557	}
1558
1559	return 0;
1560	}
1561
1562	/* This function requires the caller holds hdev->lock */
1563	static struct hci_conn *hci_add_bis(struct hci_dev *hdev, bdaddr_t *dst,
1564	__u8 sid, struct bt_iso_qos *qos,
1565	__u8 base_len, __u8 *base, u16 timeout)
1566	{
1567	struct hci_conn *conn;
1568	int err;
1569
1570	/* Let's make sure that le is enabled.*/
1571	if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1572	if (lmp_le_capable(hdev))
1573	return ERR_PTR(error: -ECONNREFUSED);
1574	return ERR_PTR(error: -EOPNOTSUPP);
1575	}
1576
1577	err = qos_set_big(hdev, qos);
1578	if (err)
1579	return ERR_PTR(error: err);
1580
1581	err = qos_set_bis(hdev, qos);
1582	if (err)
1583	return ERR_PTR(error: err);
1584
1585	/* Check if the LE Create BIG command has already been sent */
1586	conn = hci_conn_hash_lookup_per_adv_bis(hdev, ba: dst, big: qos->bcast.big,
1587	bis: qos->bcast.big);
1588	if (conn)
1589	return ERR_PTR(error: -EADDRINUSE);
1590
1591	/* Check BIS settings against other bound BISes, since all
1592	* BISes in a BIG must have the same value for all parameters
1593	*/
1594	conn = hci_conn_hash_lookup_big(hdev, handle: qos->bcast.big);
1595
1596	if (conn && (memcmp(p: qos, q: &conn->iso_qos, size: sizeof(*qos)) ||
1597	base_len != conn->le_per_adv_data_len ||
1598	memcmp(p: conn->le_per_adv_data, q: base, size: base_len)))
1599	return ERR_PTR(error: -EADDRINUSE);
1600
1601	conn = hci_conn_add_unset(hdev, BIS_LINK, dst, dst_type: 0, HCI_ROLE_MASTER);
1602	if (IS_ERR(ptr: conn))
1603	return conn;
1604
1605	conn->state = BT_CONNECT;
1606	conn->sid = sid;
1607	conn->conn_timeout = timeout;
1608
1609	hci_conn_hold(conn);
1610	return conn;
1611	}
1612
1613	/* This function requires the caller holds hdev->lock */
1614	struct hci_conn *hci_connect_le_scan(struct hci_dev *hdev, bdaddr_t *dst,
1615	u8 dst_type, u8 sec_level,
1616	u16 conn_timeout,
1617	enum conn_reasons conn_reason)
1618	{
1619	struct hci_conn *conn;
1620
1621	/* Let's make sure that le is enabled.*/
1622	if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1623	if (lmp_le_capable(hdev))
1624	return ERR_PTR(error: -ECONNREFUSED);
1625
1626	return ERR_PTR(error: -EOPNOTSUPP);
1627	}
1628
1629	/* Some devices send ATT messages as soon as the physical link is
1630	* established. To be able to handle these ATT messages, the user-
1631	* space first establishes the connection and then starts the pairing
1632	* process.
1633	*
1634	* So if a hci_conn object already exists for the following connection
1635	* attempt, we simply update pending_sec_level and auth_type fields
1636	* and return the object found.
1637	*/
1638	conn = hci_conn_hash_lookup_le(hdev, ba: dst, ba_type: dst_type);
1639	if (conn) {
1640	if (conn->pending_sec_level < sec_level)
1641	conn->pending_sec_level = sec_level;
1642	goto done;
1643	}
1644
1645	BT_DBG("requesting refresh of dst_addr");
1646
1647	conn = hci_conn_add_unset(hdev, LE_LINK, dst, dst_type,
1648	HCI_ROLE_MASTER);
1649	if (IS_ERR(ptr: conn))
1650	return conn;
1651
1652	if (hci_explicit_conn_params_set(hdev, addr: dst, addr_type: dst_type) < 0) {
1653	hci_conn_del(conn);
1654	return ERR_PTR(error: -EBUSY);
1655	}
1656
1657	conn->state = BT_CONNECT;
1658	set_bit(nr: HCI_CONN_SCANNING, addr: &conn->flags);
1659	conn->sec_level = BT_SECURITY_LOW;
1660	conn->pending_sec_level = sec_level;
1661	conn->conn_timeout = conn_timeout;
1662	conn->conn_reason = conn_reason;
1663
1664	hci_update_passive_scan(hdev);
1665
1666	done:
1667	hci_conn_hold(conn);
1668	return conn;
1669	}
1670
1671	struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst,
1672	u8 sec_level, u8 auth_type,
1673	enum conn_reasons conn_reason, u16 timeout)
1674	{
1675	struct hci_conn *acl;
1676
1677	if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1678	if (lmp_bredr_capable(hdev))
1679	return ERR_PTR(error: -ECONNREFUSED);
1680
1681	return ERR_PTR(error: -EOPNOTSUPP);
1682	}
1683
1684	/* Reject outgoing connection to device with same BD ADDR against
1685	* CVE-2020-26555
1686	*/
1687	if (!bacmp(ba1: &hdev->bdaddr, ba2: dst)) {
1688	bt_dev_dbg(hdev, "Reject connection with same BD_ADDR %pMR\n",
1689	dst);
1690	return ERR_PTR(error: -ECONNREFUSED);
1691	}
1692
1693	acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, ba: dst);
1694	if (!acl) {
1695	acl = hci_conn_add_unset(hdev, ACL_LINK, dst, dst_type: 0,
1696	HCI_ROLE_MASTER);
1697	if (IS_ERR(ptr: acl))
1698	return acl;
1699	}
1700
1701	hci_conn_hold(conn: acl);
1702
1703	acl->conn_reason = conn_reason;
1704	if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
1705	int err;
1706
1707	acl->sec_level = BT_SECURITY_LOW;
1708	acl->pending_sec_level = sec_level;
1709	acl->auth_type = auth_type;
1710	acl->conn_timeout = timeout;
1711
1712	err = hci_connect_acl_sync(hdev, conn: acl);
1713	if (err) {
1714	hci_conn_del(conn: acl);
1715	return ERR_PTR(error: err);
1716	}
1717	}
1718
1719	return acl;
1720	}
1721
1722	static struct hci_link *hci_conn_link(struct hci_conn *parent,
1723	struct hci_conn *conn)
1724	{
1725	struct hci_dev *hdev = parent->hdev;
1726	struct hci_link *link;
1727
1728	bt_dev_dbg(hdev, "parent %p hcon %p", parent, conn);
1729
1730	if (conn->link)
1731	return conn->link;
1732
1733	if (conn->parent)
1734	return NULL;
1735
1736	link = kzalloc(sizeof(*link), GFP_KERNEL);
1737	if (!link)
1738	return NULL;
1739
1740	link->conn = hci_conn_hold(conn);
1741	conn->link = link;
1742	conn->parent = hci_conn_get(conn: parent);
1743
1744	/* Use list_add_tail_rcu append to the list */
1745	list_add_tail_rcu(new: &link->list, head: &parent->link_list);
1746
1747	return link;
1748	}
1749
1750	struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type, bdaddr_t *dst,
1751	__u16 setting, struct bt_codec *codec,
1752	u16 timeout)
1753	{
1754	struct hci_conn *acl;
1755	struct hci_conn *sco;
1756	struct hci_link *link;
1757
1758	acl = hci_connect_acl(hdev, dst, BT_SECURITY_LOW, HCI_AT_NO_BONDING,
1759	conn_reason: CONN_REASON_SCO_CONNECT, timeout);
1760	if (IS_ERR(ptr: acl))
1761	return acl;
1762
1763	sco = hci_conn_hash_lookup_ba(hdev, type, ba: dst);
1764	if (!sco) {
1765	sco = hci_conn_add_unset(hdev, type, dst, dst_type: 0, HCI_ROLE_MASTER);
1766	if (IS_ERR(ptr: sco)) {
1767	hci_conn_drop(conn: acl);
1768	return sco;
1769	}
1770	}
1771
1772	link = hci_conn_link(parent: acl, conn: sco);
1773	if (!link) {
1774	hci_conn_drop(conn: acl);
1775	hci_conn_drop(conn: sco);
1776	return ERR_PTR(error: -ENOLINK);
1777	}
1778
1779	sco->setting = setting;
1780	sco->codec = *codec;
1781
1782	if (acl->state == BT_CONNECTED &&
1783	(sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
1784	set_bit(nr: HCI_CONN_POWER_SAVE, addr: &acl->flags);
1785	hci_conn_enter_active_mode(conn: acl, BT_POWER_FORCE_ACTIVE_ON);
1786
1787	if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->flags)) {
1788	/* defer SCO setup until mode change completed */
1789	set_bit(nr: HCI_CONN_SCO_SETUP_PEND, addr: &acl->flags);
1790	return sco;
1791	}
1792
1793	hci_sco_setup(conn: acl, status: 0x00);
1794	}
1795
1796	return sco;
1797	}
1798
1799	static int hci_le_create_big(struct hci_conn *conn, struct bt_iso_qos *qos)
1800	{
1801	struct hci_dev *hdev = conn->hdev;
1802	struct hci_cp_le_create_big cp;
1803	struct iso_list_data data;
1804
1805	memset(&cp, 0, sizeof(cp));
1806
1807	data.big = qos->bcast.big;
1808	data.bis = qos->bcast.bis;
1809	data.count = 0;
1810
1811	/* Create a BIS for each bound connection */
1812	hci_conn_hash_list_state(hdev, func: bis_list, BIS_LINK,
1813	state: BT_BOUND, data: &data);
1814
1815	cp.handle = qos->bcast.big;
1816	cp.adv_handle = qos->bcast.bis;
1817	cp.num_bis = data.count;
1818	hci_cpu_to_le24(val: qos->bcast.out.interval, dst: cp.bis.sdu_interval);
1819	cp.bis.sdu = cpu_to_le16(qos->bcast.out.sdu);
1820	cp.bis.latency = cpu_to_le16(qos->bcast.out.latency);
1821	cp.bis.rtn = qos->bcast.out.rtn;
1822	cp.bis.phy = qos->bcast.out.phy;
1823	cp.bis.packing = qos->bcast.packing;
1824	cp.bis.framing = qos->bcast.framing;
1825	cp.bis.encryption = qos->bcast.encryption;
1826	memcpy(cp.bis.bcode, qos->bcast.bcode, sizeof(cp.bis.bcode));
1827
1828	return hci_send_cmd(hdev, HCI_OP_LE_CREATE_BIG, plen: sizeof(cp), param: &cp);
1829	}
1830
1831	static int set_cig_params_sync(struct hci_dev *hdev, void *data)
1832	{
1833	DEFINE_FLEX(struct hci_cp_le_set_cig_params, pdu, cis, num_cis, 0x1f);
1834	u8 cig_id = PTR_UINT(data);
1835	struct hci_conn *conn;
1836	struct bt_iso_qos *qos;
1837	u8 aux_num_cis = 0;
1838	u8 cis_id;
1839
1840	conn = hci_conn_hash_lookup_cig(hdev, handle: cig_id);
1841	if (!conn)
1842	return 0;
1843
1844	qos = &conn->iso_qos;
1845	pdu->cig_id = cig_id;
1846	hci_cpu_to_le24(val: qos->ucast.out.interval, dst: pdu->c_interval);
1847	hci_cpu_to_le24(val: qos->ucast.in.interval, dst: pdu->p_interval);
1848	pdu->sca = qos->ucast.sca;
1849	pdu->packing = qos->ucast.packing;
1850	pdu->framing = qos->ucast.framing;
1851	pdu->c_latency = cpu_to_le16(qos->ucast.out.latency);
1852	pdu->p_latency = cpu_to_le16(qos->ucast.in.latency);
1853
1854	/* Reprogram all CIS(s) with the same CIG, valid range are:
1855	* num_cis: 0x00 to 0x1F
1856	* cis_id: 0x00 to 0xEF
1857	*/
1858	for (cis_id = 0x00; cis_id < 0xf0 &&
1859	aux_num_cis < pdu->num_cis; cis_id++) {
1860	struct hci_cis_params *cis;
1861
1862	conn = hci_conn_hash_lookup_cis(hdev, NULL, ba_type: 0, cig: cig_id, id: cis_id);
1863	if (!conn)
1864	continue;
1865
1866	qos = &conn->iso_qos;
1867
1868	cis = &pdu->cis[aux_num_cis++];
1869	cis->cis_id = cis_id;
1870	cis->c_sdu = cpu_to_le16(conn->iso_qos.ucast.out.sdu);
1871	cis->p_sdu = cpu_to_le16(conn->iso_qos.ucast.in.sdu);
1872	cis->c_phy = qos->ucast.out.phy ? qos->ucast.out.phy :
1873	qos->ucast.in.phy;
1874	cis->p_phy = qos->ucast.in.phy ? qos->ucast.in.phy :
1875	qos->ucast.out.phy;
1876	cis->c_rtn = qos->ucast.out.rtn;
1877	cis->p_rtn = qos->ucast.in.rtn;
1878	}
1879	pdu->num_cis = aux_num_cis;
1880
1881	if (!pdu->num_cis)
1882	return 0;
1883
1884	return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_CIG_PARAMS,
1885	struct_size(pdu, cis, pdu->num_cis),
1886	param: pdu, HCI_CMD_TIMEOUT);
1887	}
1888
1889	static bool hci_le_set_cig_params(struct hci_conn *conn, struct bt_iso_qos *qos)
1890	{
1891	struct hci_dev *hdev = conn->hdev;
1892	struct iso_list_data data;
1893
1894	memset(&data, 0, sizeof(data));
1895
1896	/* Allocate first still reconfigurable CIG if not set */
1897	if (qos->ucast.cig == BT_ISO_QOS_CIG_UNSET) {
1898	for (data.cig = 0x00; data.cig < 0xf0; data.cig++) {
1899	data.count = 0;
1900
1901	hci_conn_hash_list_state(hdev, func: find_cis, CIS_LINK,
1902	state: BT_CONNECT, data: &data);
1903	if (data.count)
1904	continue;
1905
1906	hci_conn_hash_list_state(hdev, func: find_cis, CIS_LINK,
1907	state: BT_CONNECTED, data: &data);
1908	if (!data.count)
1909	break;
1910	}
1911
1912	if (data.cig == 0xf0)
1913	return false;
1914
1915	/* Update CIG */
1916	qos->ucast.cig = data.cig;
1917	}
1918
1919	if (qos->ucast.cis != BT_ISO_QOS_CIS_UNSET) {
1920	if (hci_conn_hash_lookup_cis(hdev, NULL, ba_type: 0, cig: qos->ucast.cig,
1921	id: qos->ucast.cis))
1922	return false;
1923	goto done;
1924	}
1925
1926	/* Allocate first available CIS if not set */
1927	for (data.cig = qos->ucast.cig, data.cis = 0x00; data.cis < 0xf0;
1928	data.cis++) {
1929	if (!hci_conn_hash_lookup_cis(hdev, NULL, ba_type: 0, cig: data.cig,
1930	id: data.cis)) {
1931	/* Update CIS */
1932	qos->ucast.cis = data.cis;
1933	break;
1934	}
1935	}
1936
1937	if (qos->ucast.cis == BT_ISO_QOS_CIS_UNSET)
1938	return false;
1939
1940	done:
1941	if (hci_cmd_sync_queue(hdev, func: set_cig_params_sync,
1942	UINT_PTR(qos->ucast.cig), NULL) < 0)
1943	return false;
1944
1945	return true;
1946	}
1947
1948	struct hci_conn *hci_bind_cis(struct hci_dev *hdev, bdaddr_t *dst,
1949	__u8 dst_type, struct bt_iso_qos *qos,
1950	u16 timeout)
1951	{
1952	struct hci_conn *cis;
1953
1954	cis = hci_conn_hash_lookup_cis(hdev, ba: dst, ba_type: dst_type, cig: qos->ucast.cig,
1955	id: qos->ucast.cis);
1956	if (!cis) {
1957	cis = hci_conn_add_unset(hdev, CIS_LINK, dst, dst_type,
1958	HCI_ROLE_MASTER);
1959	if (IS_ERR(ptr: cis))
1960	return cis;
1961	cis->cleanup = cis_cleanup;
1962	cis->dst_type = dst_type;
1963	cis->iso_qos.ucast.cig = BT_ISO_QOS_CIG_UNSET;
1964	cis->iso_qos.ucast.cis = BT_ISO_QOS_CIS_UNSET;
1965	cis->conn_timeout = timeout;
1966	}
1967
1968	if (cis->state == BT_CONNECTED)
1969	return cis;
1970
1971	/* Check if CIS has been set and the settings matches */
1972	if (cis->state == BT_BOUND &&
1973	!memcmp(p: &cis->iso_qos, q: qos, size: sizeof(*qos)))
1974	return cis;
1975
1976	/* Update LINK PHYs according to QoS preference */
1977	cis->le_tx_phy = qos->ucast.out.phy;
1978	cis->le_rx_phy = qos->ucast.in.phy;
1979
1980	/* If output interval is not set use the input interval as it cannot be
1981	* 0x000000.
1982	*/
1983	if (!qos->ucast.out.interval)
1984	qos->ucast.out.interval = qos->ucast.in.interval;
1985
1986	/* If input interval is not set use the output interval as it cannot be
1987	* 0x000000.
1988	*/
1989	if (!qos->ucast.in.interval)
1990	qos->ucast.in.interval = qos->ucast.out.interval;
1991
1992	/* If output latency is not set use the input latency as it cannot be
1993	* 0x0000.
1994	*/
1995	if (!qos->ucast.out.latency)
1996	qos->ucast.out.latency = qos->ucast.in.latency;
1997
1998	/* If input latency is not set use the output latency as it cannot be
1999	* 0x0000.
2000	*/
2001	if (!qos->ucast.in.latency)
2002	qos->ucast.in.latency = qos->ucast.out.latency;
2003
2004	if (!hci_le_set_cig_params(conn: cis, qos)) {
2005	hci_conn_drop(conn: cis);
2006	return ERR_PTR(error: -EINVAL);
2007	}
2008
2009	hci_conn_hold(conn: cis);
2010
2011	cis->iso_qos = *qos;
2012	cis->state = BT_BOUND;
2013
2014	return cis;
2015	}
2016
2017	bool hci_iso_setup_path(struct hci_conn *conn)
2018	{
2019	struct hci_dev *hdev = conn->hdev;
2020	struct hci_cp_le_setup_iso_path cmd;
2021
2022	memset(&cmd, 0, sizeof(cmd));
2023
2024	if (conn->iso_qos.ucast.out.sdu) {
2025	cmd.handle = cpu_to_le16(conn->handle);
2026	cmd.direction = 0x00; /* Input (Host to Controller) */
2027	cmd.path = 0x00; /* HCI path if enabled */
2028	cmd.codec = 0x03; /* Transparent Data */
2029
2030	if (hci_send_cmd(hdev, HCI_OP_LE_SETUP_ISO_PATH, plen: sizeof(cmd),
2031	param: &cmd) < 0)
2032	return false;
2033	}
2034
2035	if (conn->iso_qos.ucast.in.sdu) {
2036	cmd.handle = cpu_to_le16(conn->handle);
2037	cmd.direction = 0x01; /* Output (Controller to Host) */
2038	cmd.path = 0x00; /* HCI path if enabled */
2039	cmd.codec = 0x03; /* Transparent Data */
2040
2041	if (hci_send_cmd(hdev, HCI_OP_LE_SETUP_ISO_PATH, plen: sizeof(cmd),
2042	param: &cmd) < 0)
2043	return false;
2044	}
2045
2046	return true;
2047	}
2048
2049	int hci_conn_check_create_cis(struct hci_conn *conn)
2050	{
2051	if (conn->type != CIS_LINK)
2052	return -EINVAL;
2053
2054	if (!conn->parent || conn->parent->state != BT_CONNECTED ||
2055	conn->state != BT_CONNECT || HCI_CONN_HANDLE_UNSET(conn->handle))
2056	return 1;
2057
2058	return 0;
2059	}
2060
2061	static int hci_create_cis_sync(struct hci_dev *hdev, void *data)
2062	{
2063	return hci_le_create_cis_sync(hdev);
2064	}
2065
2066	int hci_le_create_cis_pending(struct hci_dev *hdev)
2067	{
2068	struct hci_conn *conn;
2069	bool pending = false;
2070
2071	rcu_read_lock();
2072
2073	list_for_each_entry_rcu(conn, &hdev->conn_hash.list, list) {
2074	if (test_bit(HCI_CONN_CREATE_CIS, &conn->flags)) {
2075	rcu_read_unlock();
2076	return -EBUSY;
2077	}
2078
2079	if (!hci_conn_check_create_cis(conn))
2080	pending = true;
2081	}
2082
2083	rcu_read_unlock();
2084
2085	if (!pending)
2086	return 0;
2087
2088	/* Queue Create CIS */
2089	return hci_cmd_sync_queue(hdev, func: hci_create_cis_sync, NULL, NULL);
2090	}
2091
2092	static void hci_iso_qos_setup(struct hci_dev *hdev, struct hci_conn *conn,
2093	struct bt_iso_io_qos *qos, __u8 phy)
2094	{
2095	/* Only set MTU if PHY is enabled */
2096	if (!qos->sdu && qos->phy)
2097	qos->sdu = conn->mtu;
2098
2099	/* Use the same PHY as ACL if set to any */
2100	if (qos->phy == BT_ISO_PHY_ANY)
2101	qos->phy = phy;
2102
2103	/* Use LE ACL connection interval if not set */
2104	if (!qos->interval)
2105	/* ACL interval unit in 1.25 ms to us */
2106	qos->interval = conn->le_conn_interval * 1250;
2107
2108	/* Use LE ACL connection latency if not set */
2109	if (!qos->latency)
2110	qos->latency = conn->le_conn_latency;
2111	}
2112
2113	static int create_big_sync(struct hci_dev *hdev, void *data)
2114	{
2115	struct hci_conn *conn = data;
2116	struct bt_iso_qos *qos = &conn->iso_qos;
2117	u16 interval, sync_interval = 0;
2118	u32 flags = 0;
2119	int err;
2120
2121	if (qos->bcast.out.phy == 0x02)
2122	flags |= MGMT_ADV_FLAG_SEC_2M;
2123
2124	/* Align intervals */
2125	interval = (qos->bcast.out.interval / 1250) * qos->bcast.sync_factor;
2126
2127	if (qos->bcast.bis)
2128	sync_interval = interval * 4;
2129
2130	err = hci_start_per_adv_sync(hdev, instance: qos->bcast.bis, sid: conn->sid,
2131	data_len: conn->le_per_adv_data_len,
2132	data: conn->le_per_adv_data, flags, min_interval: interval,
2133	max_interval: interval, sync_interval);
2134	if (err)
2135	return err;
2136
2137	return hci_le_create_big(conn, qos: &conn->iso_qos);
2138	}
2139
2140	struct hci_conn *hci_pa_create_sync(struct hci_dev *hdev, bdaddr_t *dst,
2141	__u8 dst_type, __u8 sid,
2142	struct bt_iso_qos *qos)
2143	{
2144	struct hci_conn *conn;
2145
2146	bt_dev_dbg(hdev, "dst %pMR type %d sid %d", dst, dst_type, sid);
2147
2148	conn = hci_conn_add_unset(hdev, PA_LINK, dst, dst_type, HCI_ROLE_SLAVE);
2149	if (IS_ERR(ptr: conn))
2150	return conn;
2151
2152	conn->iso_qos = *qos;
2153	conn->sid = sid;
2154	conn->state = BT_LISTEN;
2155	conn->conn_timeout = msecs_to_jiffies(m: qos->bcast.sync_timeout * 10);
2156
2157	hci_conn_hold(conn);
2158
2159	hci_connect_pa_sync(hdev, conn);
2160
2161	return conn;
2162	}
2163
2164	int hci_conn_big_create_sync(struct hci_dev *hdev, struct hci_conn *hcon,
2165	struct bt_iso_qos *qos, __u16 sync_handle,
2166	__u8 num_bis, __u8 bis[])
2167	{
2168	int err;
2169
2170	if (num_bis < 0x01 || num_bis > ISO_MAX_NUM_BIS)
2171	return -EINVAL;
2172
2173	err = qos_set_big(hdev, qos);
2174	if (err)
2175	return err;
2176
2177	if (hcon) {
2178	/* Update hcon QoS */
2179	hcon->iso_qos = *qos;
2180
2181	hcon->num_bis = num_bis;
2182	memcpy(hcon->bis, bis, num_bis);
2183	hcon->conn_timeout = msecs_to_jiffies(m: qos->bcast.timeout * 10);
2184	}
2185
2186	return hci_connect_big_sync(hdev, conn: hcon);
2187	}
2188
2189	static void create_big_complete(struct hci_dev *hdev, void *data, int err)
2190	{
2191	struct hci_conn *conn = data;
2192
2193	bt_dev_dbg(hdev, "conn %p", conn);
2194
2195	if (err) {
2196	bt_dev_err(hdev, "Unable to create BIG: %d", err);
2197	hci_connect_cfm(conn, status: err);
2198	hci_conn_del(conn);
2199	}
2200	}
2201
2202	struct hci_conn *hci_bind_bis(struct hci_dev *hdev, bdaddr_t *dst, __u8 sid,
2203	struct bt_iso_qos *qos,
2204	__u8 base_len, __u8 *base, u16 timeout)
2205	{
2206	struct hci_conn *conn;
2207	struct hci_conn *parent;
2208	__u8 eir[HCI_MAX_PER_AD_LENGTH];
2209	struct hci_link *link;
2210
2211	/* Look for any BIS that is open for rebinding */
2212	conn = hci_conn_hash_lookup_big_state(hdev, handle: qos->bcast.big, state: BT_OPEN,
2213	HCI_ROLE_MASTER);
2214	if (conn) {
2215	memcpy(qos, &conn->iso_qos, sizeof(*qos));
2216	conn->state = BT_CONNECTED;
2217	return conn;
2218	}
2219
2220	if (base_len && base)
2221	base_len = eir_append_service_data(eir, eir_len: 0, uuid: 0x1851,
2222	data: base, data_len: base_len);
2223
2224	/* We need hci_conn object using the BDADDR_ANY as dst */
2225	conn = hci_add_bis(hdev, dst, sid, qos, base_len, base: eir, timeout);
2226	if (IS_ERR(ptr: conn))
2227	return conn;
2228
2229	/* Update LINK PHYs according to QoS preference */
2230	conn->le_tx_phy = qos->bcast.out.phy;
2231	conn->le_tx_phy = qos->bcast.out.phy;
2232
2233	/* Add Basic Announcement into Peridic Adv Data if BASE is set */
2234	if (base_len && base) {
2235	memcpy(conn->le_per_adv_data, eir, sizeof(eir));
2236	conn->le_per_adv_data_len = base_len;
2237	}
2238
2239	hci_iso_qos_setup(hdev, conn, qos: &qos->bcast.out,
2240	phy: conn->le_tx_phy ? conn->le_tx_phy :
2241	hdev->le_tx_def_phys);
2242
2243	conn->iso_qos = *qos;
2244	conn->state = BT_BOUND;
2245
2246	/* Link BISes together */
2247	parent = hci_conn_hash_lookup_big(hdev,
2248	handle: conn->iso_qos.bcast.big);
2249	if (parent && parent != conn) {
2250	link = hci_conn_link(parent, conn);
2251	hci_conn_drop(conn);
2252	if (!link)
2253	return ERR_PTR(error: -ENOLINK);
2254	}
2255
2256	return conn;
2257	}
2258
2259	int hci_past_bis(struct hci_conn *conn, bdaddr_t *dst, __u8 dst_type)
2260	{
2261	struct hci_conn *le;
2262
2263	/* Lookup existing LE connection to rebind to */
2264	le = hci_conn_hash_lookup_le(hdev: conn->hdev, ba: dst, ba_type: dst_type);
2265	if (!le)
2266	return -EINVAL;
2267
2268	return hci_past_sync(conn, le);
2269	}
2270
2271	static void bis_mark_per_adv(struct hci_conn *conn, void *data)
2272	{
2273	struct iso_list_data *d = data;
2274
2275	/* Skip if not broadcast/ANY address */
2276	if (bacmp(ba1: &conn->dst, BDADDR_ANY))
2277	return;
2278
2279	if (d->big != conn->iso_qos.bcast.big ||
2280	d->bis == BT_ISO_QOS_BIS_UNSET ||
2281	d->bis != conn->iso_qos.bcast.bis)
2282	return;
2283
2284	set_bit(nr: HCI_CONN_PER_ADV, addr: &conn->flags);
2285	}
2286
2287	struct hci_conn *hci_connect_bis(struct hci_dev *hdev, bdaddr_t *dst,
2288	__u8 dst_type, __u8 sid,
2289	struct bt_iso_qos *qos,
2290	__u8 base_len, __u8 *base, u16 timeout)
2291	{
2292	struct hci_conn *conn;
2293	int err;
2294	struct iso_list_data data;
2295
2296	conn = hci_bind_bis(hdev, dst, sid, qos, base_len, base, timeout);
2297	if (IS_ERR(ptr: conn))
2298	return conn;
2299
2300	if (conn->state == BT_CONNECTED)
2301	return conn;
2302
2303	/* Check if SID needs to be allocated then search for the first
2304	* available.
2305	*/
2306	if (conn->sid == HCI_SID_INVALID) {
2307	u8 sid;
2308
2309	for (sid = 0; sid <= 0x0f; sid++) {
2310	if (!hci_find_adv_sid(hdev, sid)) {
2311	conn->sid = sid;
2312	break;
2313	}
2314	}
2315	}
2316
2317	data.big = qos->bcast.big;
2318	data.bis = qos->bcast.bis;
2319
2320	/* Set HCI_CONN_PER_ADV for all bound connections, to mark that
2321	* the start periodic advertising and create BIG commands have
2322	* been queued
2323	*/
2324	hci_conn_hash_list_state(hdev, func: bis_mark_per_adv, BIS_LINK,
2325	state: BT_BOUND, data: &data);
2326
2327	/* Queue start periodic advertising and create BIG */
2328	err = hci_cmd_sync_queue(hdev, func: create_big_sync, data: conn,
2329	destroy: create_big_complete);
2330	if (err < 0) {
2331	hci_conn_drop(conn);
2332	return ERR_PTR(error: err);
2333	}
2334
2335	return conn;
2336	}
2337
2338	struct hci_conn *hci_connect_cis(struct hci_dev *hdev, bdaddr_t *dst,
2339	__u8 dst_type, struct bt_iso_qos *qos,
2340	u16 timeout)
2341	{
2342	struct hci_conn *le;
2343	struct hci_conn *cis;
2344	struct hci_link *link;
2345
2346	if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
2347	le = hci_connect_le(hdev, dst, dst_type, dst_resolved: false,
2348	BT_SECURITY_LOW,
2349	HCI_LE_CONN_TIMEOUT,
2350	HCI_ROLE_SLAVE, phy: 0, sec_phy: 0);
2351	else
2352	le = hci_connect_le_scan(hdev, dst, dst_type,
2353	BT_SECURITY_LOW,
2354	HCI_LE_CONN_TIMEOUT,
2355	conn_reason: CONN_REASON_ISO_CONNECT);
2356	if (IS_ERR(ptr: le))
2357	return le;
2358
2359	hci_iso_qos_setup(hdev, conn: le, qos: &qos->ucast.out,
2360	phy: le->le_tx_phy ? le->le_tx_phy : hdev->le_tx_def_phys);
2361	hci_iso_qos_setup(hdev, conn: le, qos: &qos->ucast.in,
2362	phy: le->le_rx_phy ? le->le_rx_phy : hdev->le_rx_def_phys);
2363
2364	cis = hci_bind_cis(hdev, dst, dst_type, qos, timeout);
2365	if (IS_ERR(ptr: cis)) {
2366	hci_conn_drop(conn: le);
2367	return cis;
2368	}
2369
2370	link = hci_conn_link(parent: le, conn: cis);
2371	hci_conn_drop(conn: cis);
2372	if (!link) {
2373	hci_conn_drop(conn: le);
2374	return ERR_PTR(error: -ENOLINK);
2375	}
2376
2377	cis->state = BT_CONNECT;
2378
2379	hci_le_create_cis_pending(hdev);
2380
2381	return cis;
2382	}
2383
2384	/* Check link security requirement */
2385	int hci_conn_check_link_mode(struct hci_conn *conn)
2386	{
2387	BT_DBG("hcon %p", conn);
2388
2389	/* In Secure Connections Only mode, it is required that Secure
2390	* Connections is used and the link is encrypted with AES-CCM
2391	* using a P-256 authenticated combination key.
2392	*/
2393	if (hci_dev_test_flag(conn->hdev, HCI_SC_ONLY)) {
2394	if (!hci_conn_sc_enabled(conn) ||
2395	!test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
2396	conn->key_type != HCI_LK_AUTH_COMBINATION_P256)
2397	return 0;
2398	}
2399
2400	/* AES encryption is required for Level 4:
2401	*
2402	* BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 3, Part C
2403	* page 1319:
2404	*
2405	* 128-bit equivalent strength for link and encryption keys
2406	* required using FIPS approved algorithms (E0 not allowed,
2407	* SAFER+ not allowed, and P-192 not allowed; encryption key
2408	* not shortened)
2409	*/
2410	if (conn->sec_level == BT_SECURITY_FIPS &&
2411	!test_bit(HCI_CONN_AES_CCM, &conn->flags)) {
2412	bt_dev_err(conn->hdev,
2413	"Invalid security: Missing AES-CCM usage");
2414	return 0;
2415	}
2416
2417	if (hci_conn_ssp_enabled(conn) &&
2418	!test_bit(HCI_CONN_ENCRYPT, &conn->flags))
2419	return 0;
2420
2421	return 1;
2422	}
2423
2424	/* Authenticate remote device */
2425	static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
2426	{
2427	BT_DBG("hcon %p", conn);
2428
2429	if (conn->pending_sec_level > sec_level)
2430	sec_level = conn->pending_sec_level;
2431
2432	if (sec_level > conn->sec_level)
2433	conn->pending_sec_level = sec_level;
2434	else if (test_bit(HCI_CONN_AUTH, &conn->flags))
2435	return 1;
2436
2437	/* Make sure we preserve an existing MITM requirement*/
2438	auth_type |= (conn->auth_type & 0x01);
2439
2440	conn->auth_type = auth_type;
2441
2442	if (!test_and_set_bit(nr: HCI_CONN_AUTH_PEND, addr: &conn->flags)) {
2443	struct hci_cp_auth_requested cp;
2444
2445	cp.handle = cpu_to_le16(conn->handle);
2446	hci_send_cmd(hdev: conn->hdev, HCI_OP_AUTH_REQUESTED,
2447	plen: sizeof(cp), param: &cp);
2448
2449	/* Set the ENCRYPT_PEND to trigger encryption after
2450	* authentication.
2451	*/
2452	if (!test_bit(HCI_CONN_ENCRYPT, &conn->flags))
2453	set_bit(nr: HCI_CONN_ENCRYPT_PEND, addr: &conn->flags);
2454	}
2455
2456	return 0;
2457	}
2458
2459	/* Encrypt the link */
2460	static void hci_conn_encrypt(struct hci_conn *conn)
2461	{
2462	BT_DBG("hcon %p", conn);
2463
2464	if (!test_and_set_bit(nr: HCI_CONN_ENCRYPT_PEND, addr: &conn->flags)) {
2465	struct hci_cp_set_conn_encrypt cp;
2466	cp.handle = cpu_to_le16(conn->handle);
2467	cp.encrypt = 0x01;
2468	hci_send_cmd(hdev: conn->hdev, HCI_OP_SET_CONN_ENCRYPT, plen: sizeof(cp),
2469	param: &cp);
2470	}
2471	}
2472
2473	/* Enable security */
2474	int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type,
2475	bool initiator)
2476	{
2477	BT_DBG("hcon %p", conn);
2478
2479	if (conn->type == LE_LINK)
2480	return smp_conn_security(hcon: conn, sec_level);
2481
2482	/* For sdp we don't need the link key. */
2483	if (sec_level == BT_SECURITY_SDP)
2484	return 1;
2485
2486	/* For non 2.1 devices and low security level we don't need the link
2487	key. */
2488	if (sec_level == BT_SECURITY_LOW && !hci_conn_ssp_enabled(conn))
2489	return 1;
2490
2491	/* For other security levels we need the link key. */
2492	if (!test_bit(HCI_CONN_AUTH, &conn->flags))
2493	goto auth;
2494
2495	switch (conn->key_type) {
2496	case HCI_LK_AUTH_COMBINATION_P256:
2497	/* An authenticated FIPS approved combination key has
2498	* sufficient security for security level 4 or lower.
2499	*/
2500	if (sec_level <= BT_SECURITY_FIPS)
2501	goto encrypt;
2502	break;
2503	case HCI_LK_AUTH_COMBINATION_P192:
2504	/* An authenticated combination key has sufficient security for
2505	* security level 3 or lower.
2506	*/
2507	if (sec_level <= BT_SECURITY_HIGH)
2508	goto encrypt;
2509	break;
2510	case HCI_LK_UNAUTH_COMBINATION_P192:
2511	case HCI_LK_UNAUTH_COMBINATION_P256:
2512	/* An unauthenticated combination key has sufficient security
2513	* for security level 2 or lower.
2514	*/
2515	if (sec_level <= BT_SECURITY_MEDIUM)
2516	goto encrypt;
2517	break;
2518	case HCI_LK_COMBINATION:
2519	/* A combination key has always sufficient security for the
2520	* security levels 2 or lower. High security level requires the
2521	* combination key is generated using maximum PIN code length
2522	* (16). For pre 2.1 units.
2523	*/
2524	if (sec_level <= BT_SECURITY_MEDIUM || conn->pin_length == 16)
2525	goto encrypt;
2526	break;
2527	default:
2528	break;
2529	}
2530
2531	auth:
2532	if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags))
2533	return 0;
2534
2535	if (initiator)
2536	set_bit(nr: HCI_CONN_AUTH_INITIATOR, addr: &conn->flags);
2537
2538	if (!hci_conn_auth(conn, sec_level, auth_type))
2539	return 0;
2540
2541	encrypt:
2542	if (test_bit(HCI_CONN_ENCRYPT, &conn->flags)) {
2543	/* Ensure that the encryption key size has been read,
2544	* otherwise stall the upper layer responses.
2545	*/
2546	if (!conn->enc_key_size)
2547	return 0;
2548
2549	/* Nothing else needed, all requirements are met */
2550	return 1;
2551	}
2552
2553	hci_conn_encrypt(conn);
2554	return 0;
2555	}
2556	EXPORT_SYMBOL(hci_conn_security);
2557
2558	/* Check secure link requirement */
2559	int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level)
2560	{
2561	BT_DBG("hcon %p", conn);
2562
2563	/* Accept if non-secure or higher security level is required */
2564	if (sec_level != BT_SECURITY_HIGH && sec_level != BT_SECURITY_FIPS)
2565	return 1;
2566
2567	/* Accept if secure or higher security level is already present */
2568	if (conn->sec_level == BT_SECURITY_HIGH ||
2569	conn->sec_level == BT_SECURITY_FIPS)
2570	return 1;
2571
2572	/* Reject not secure link */
2573	return 0;
2574	}
2575	EXPORT_SYMBOL(hci_conn_check_secure);
2576
2577	/* Switch role */
2578	int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
2579	{
2580	BT_DBG("hcon %p", conn);
2581
2582	if (role == conn->role)
2583	return 1;
2584
2585	if (!test_and_set_bit(nr: HCI_CONN_RSWITCH_PEND, addr: &conn->flags)) {
2586	struct hci_cp_switch_role cp;
2587	bacpy(dst: &cp.bdaddr, src: &conn->dst);
2588	cp.role = role;
2589	hci_send_cmd(hdev: conn->hdev, HCI_OP_SWITCH_ROLE, plen: sizeof(cp), param: &cp);
2590	}
2591
2592	return 0;
2593	}
2594	EXPORT_SYMBOL(hci_conn_switch_role);
2595
2596	/* Enter active mode */
2597	void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
2598	{
2599	struct hci_dev *hdev = conn->hdev;
2600
2601	BT_DBG("hcon %p mode %d", conn, conn->mode);
2602
2603	if (conn->mode != HCI_CM_SNIFF)
2604	goto timer;
2605
2606	if (!test_bit(HCI_CONN_POWER_SAVE, &conn->flags) && !force_active)
2607	goto timer;
2608
2609	if (!test_and_set_bit(nr: HCI_CONN_MODE_CHANGE_PEND, addr: &conn->flags)) {
2610	struct hci_cp_exit_sniff_mode cp;
2611	cp.handle = cpu_to_le16(conn->handle);
2612	hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, plen: sizeof(cp), param: &cp);
2613	}
2614
2615	timer:
2616	if (hdev->idle_timeout > 0)
2617	queue_delayed_work(wq: hdev->workqueue, dwork: &conn->idle_work,
2618	delay: msecs_to_jiffies(m: hdev->idle_timeout));
2619	}
2620
2621	/* Drop all connection on the device */
2622	void hci_conn_hash_flush(struct hci_dev *hdev)
2623	{
2624	struct list_head *head = &hdev->conn_hash.list;
2625	struct hci_conn *conn;
2626
2627	BT_DBG("hdev %s", hdev->name);
2628
2629	/* We should not traverse the list here, because hci_conn_del
2630	* can remove extra links, which may cause the list traversal
2631	* to hit items that have already been released.
2632	*/
2633	while ((conn = list_first_entry_or_null(head,
2634	struct hci_conn,
2635	list)) != NULL) {
2636	conn->state = BT_CLOSED;
2637	hci_disconn_cfm(conn, HCI_ERROR_LOCAL_HOST_TERM);
2638	hci_conn_del(conn);
2639	}
2640	}
2641
2642	static u32 get_link_mode(struct hci_conn *conn)
2643	{
2644	u32 link_mode = 0;
2645
2646	if (conn->role == HCI_ROLE_MASTER)
2647	link_mode |= HCI_LM_MASTER;
2648
2649	if (test_bit(HCI_CONN_ENCRYPT, &conn->flags))
2650	link_mode |= HCI_LM_ENCRYPT;
2651
2652	if (test_bit(HCI_CONN_AUTH, &conn->flags))
2653	link_mode |= HCI_LM_AUTH;
2654
2655	if (test_bit(HCI_CONN_SECURE, &conn->flags))
2656	link_mode |= HCI_LM_SECURE;
2657
2658	if (test_bit(HCI_CONN_FIPS, &conn->flags))
2659	link_mode |= HCI_LM_FIPS;
2660
2661	return link_mode;
2662	}
2663
2664	int hci_get_conn_list(void __user *arg)
2665	{
2666	struct hci_conn *c;
2667	struct hci_conn_list_req req, *cl;
2668	struct hci_conn_info *ci;
2669	struct hci_dev *hdev;
2670	int n = 0, size, err;
2671
2672	if (copy_from_user(to: &req, from: arg, n: sizeof(req)))
2673	return -EFAULT;
2674
2675	if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
2676	return -EINVAL;
2677
2678	size = sizeof(req) + req.conn_num * sizeof(*ci);
2679
2680	cl = kmalloc(size, GFP_KERNEL);
2681	if (!cl)
2682	return -ENOMEM;
2683
2684	hdev = hci_dev_get(index: req.dev_id);
2685	if (!hdev) {
2686	kfree(objp: cl);
2687	return -ENODEV;
2688	}
2689
2690	ci = cl->conn_info;
2691
2692	hci_dev_lock(hdev);
2693	list_for_each_entry(c, &hdev->conn_hash.list, list) {
2694	bacpy(dst: &(ci + n)->bdaddr, src: &c->dst);
2695	(ci + n)->handle = c->handle;
2696	(ci + n)->type = c->type;
2697	(ci + n)->out = c->out;
2698	(ci + n)->state = c->state;
2699	(ci + n)->link_mode = get_link_mode(conn: c);
2700	if (++n >= req.conn_num)
2701	break;
2702	}
2703	hci_dev_unlock(hdev);
2704
2705	cl->dev_id = hdev->id;
2706	cl->conn_num = n;
2707	size = sizeof(req) + n * sizeof(*ci);
2708
2709	hci_dev_put(d: hdev);
2710
2711	err = copy_to_user(to: arg, from: cl, n: size);
2712	kfree(objp: cl);
2713
2714	return err ? -EFAULT : 0;
2715	}
2716
2717	int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
2718	{
2719	struct hci_conn_info_req req;
2720	struct hci_conn_info ci;
2721	struct hci_conn *conn;
2722	char __user *ptr = arg + sizeof(req);
2723
2724	if (copy_from_user(to: &req, from: arg, n: sizeof(req)))
2725	return -EFAULT;
2726
2727	hci_dev_lock(hdev);
2728	conn = hci_conn_hash_lookup_ba(hdev, type: req.type, ba: &req.bdaddr);
2729	if (conn) {
2730	bacpy(dst: &ci.bdaddr, src: &conn->dst);
2731	ci.handle = conn->handle;
2732	ci.type = conn->type;
2733	ci.out = conn->out;
2734	ci.state = conn->state;
2735	ci.link_mode = get_link_mode(conn);
2736	}
2737	hci_dev_unlock(hdev);
2738
2739	if (!conn)
2740	return -ENOENT;
2741
2742	return copy_to_user(to: ptr, from: &ci, n: sizeof(ci)) ? -EFAULT : 0;
2743	}
2744
2745	int hci_get_auth_info(struct hci_dev *hdev, void __user *arg)
2746	{
2747	struct hci_auth_info_req req;
2748	struct hci_conn *conn;
2749
2750	if (copy_from_user(to: &req, from: arg, n: sizeof(req)))
2751	return -EFAULT;
2752
2753	hci_dev_lock(hdev);
2754	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, ba: &req.bdaddr);
2755	if (conn)
2756	req.type = conn->auth_type;
2757	hci_dev_unlock(hdev);
2758
2759	if (!conn)
2760	return -ENOENT;
2761
2762	return copy_to_user(to: arg, from: &req, n: sizeof(req)) ? -EFAULT : 0;
2763	}
2764
2765	struct hci_chan *hci_chan_create(struct hci_conn *conn)
2766	{
2767	struct hci_dev *hdev = conn->hdev;
2768	struct hci_chan *chan;
2769
2770	BT_DBG("%s hcon %p", hdev->name, conn);
2771
2772	if (test_bit(HCI_CONN_DROP, &conn->flags)) {
2773	BT_DBG("Refusing to create new hci_chan");
2774	return NULL;
2775	}
2776
2777	chan = kzalloc(sizeof(*chan), GFP_KERNEL);
2778	if (!chan)
2779	return NULL;
2780
2781	chan->conn = hci_conn_get(conn);
2782	skb_queue_head_init(list: &chan->data_q);
2783	chan->state = BT_CONNECTED;
2784
2785	list_add_rcu(new: &chan->list, head: &conn->chan_list);
2786
2787	return chan;
2788	}
2789
2790	void hci_chan_del(struct hci_chan *chan)
2791	{
2792	struct hci_conn *conn = chan->conn;
2793	struct hci_dev *hdev = conn->hdev;
2794
2795	BT_DBG("%s hcon %p chan %p", hdev->name, conn, chan);
2796
2797	list_del_rcu(entry: &chan->list);
2798
2799	synchronize_rcu();
2800
2801	/* Prevent new hci_chan's to be created for this hci_conn */
2802	set_bit(nr: HCI_CONN_DROP, addr: &conn->flags);
2803
2804	hci_conn_put(conn);
2805
2806	skb_queue_purge(list: &chan->data_q);
2807	kfree(objp: chan);
2808	}
2809
2810	void hci_chan_list_flush(struct hci_conn *conn)
2811	{
2812	struct hci_chan *chan, *n;
2813
2814	BT_DBG("hcon %p", conn);
2815
2816	list_for_each_entry_safe(chan, n, &conn->chan_list, list)
2817	hci_chan_del(chan);
2818	}
2819
2820	static struct hci_chan *__hci_chan_lookup_handle(struct hci_conn *hcon,
2821	__u16 handle)
2822	{
2823	struct hci_chan *hchan;
2824
2825	list_for_each_entry(hchan, &hcon->chan_list, list) {
2826	if (hchan->handle == handle)
2827	return hchan;
2828	}
2829
2830	return NULL;
2831	}
2832
2833	struct hci_chan *hci_chan_lookup_handle(struct hci_dev *hdev, __u16 handle)
2834	{
2835	struct hci_conn_hash *h = &hdev->conn_hash;
2836	struct hci_conn *hcon;
2837	struct hci_chan *hchan = NULL;
2838
2839	rcu_read_lock();
2840
2841	list_for_each_entry_rcu(hcon, &h->list, list) {
2842	hchan = __hci_chan_lookup_handle(hcon, handle);
2843	if (hchan)
2844	break;
2845	}
2846
2847	rcu_read_unlock();
2848
2849	return hchan;
2850	}
2851
2852	u32 hci_conn_get_phy(struct hci_conn *conn)
2853	{
2854	u32 phys = 0;
2855
2856	/* BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 2, Part B page 471:
2857	* Table 6.2: Packets defined for synchronous, asynchronous, and
2858	* CPB logical transport types.
2859	*/
2860	switch (conn->type) {
2861	case SCO_LINK:
2862	/* SCO logical transport (1 Mb/s):
2863	* HV1, HV2, HV3 and DV.
2864	*/
2865	phys |= BT_PHY_BR_1M_1SLOT;
2866
2867	break;
2868
2869	case ACL_LINK:
2870	/* ACL logical transport (1 Mb/s) ptt=0:
2871	* DH1, DM3, DH3, DM5 and DH5.
2872	*/
2873	phys |= BT_PHY_BR_1M_1SLOT;
2874
2875	if (conn->pkt_type & (HCI_DM3 | HCI_DH3))
2876	phys |= BT_PHY_BR_1M_3SLOT;
2877
2878	if (conn->pkt_type & (HCI_DM5 | HCI_DH5))
2879	phys |= BT_PHY_BR_1M_5SLOT;
2880
2881	/* ACL logical transport (2 Mb/s) ptt=1:
2882	* 2-DH1, 2-DH3 and 2-DH5.
2883	*/
2884	if (!(conn->pkt_type & HCI_2DH1))
2885	phys |= BT_PHY_EDR_2M_1SLOT;
2886
2887	if (!(conn->pkt_type & HCI_2DH3))
2888	phys |= BT_PHY_EDR_2M_3SLOT;
2889
2890	if (!(conn->pkt_type & HCI_2DH5))
2891	phys |= BT_PHY_EDR_2M_5SLOT;
2892
2893	/* ACL logical transport (3 Mb/s) ptt=1:
2894	* 3-DH1, 3-DH3 and 3-DH5.
2895	*/
2896	if (!(conn->pkt_type & HCI_3DH1))
2897	phys |= BT_PHY_EDR_3M_1SLOT;
2898
2899	if (!(conn->pkt_type & HCI_3DH3))
2900	phys |= BT_PHY_EDR_3M_3SLOT;
2901
2902	if (!(conn->pkt_type & HCI_3DH5))
2903	phys |= BT_PHY_EDR_3M_5SLOT;
2904
2905	break;
2906
2907	case ESCO_LINK:
2908	/* eSCO logical transport (1 Mb/s): EV3, EV4 and EV5 */
2909	phys |= BT_PHY_BR_1M_1SLOT;
2910
2911	if (!(conn->pkt_type & (ESCO_EV4 | ESCO_EV5)))
2912	phys |= BT_PHY_BR_1M_3SLOT;
2913
2914	/* eSCO logical transport (2 Mb/s): 2-EV3, 2-EV5 */
2915	if (!(conn->pkt_type & ESCO_2EV3))
2916	phys |= BT_PHY_EDR_2M_1SLOT;
2917
2918	if (!(conn->pkt_type & ESCO_2EV5))
2919	phys |= BT_PHY_EDR_2M_3SLOT;
2920
2921	/* eSCO logical transport (3 Mb/s): 3-EV3, 3-EV5 */
2922	if (!(conn->pkt_type & ESCO_3EV3))
2923	phys |= BT_PHY_EDR_3M_1SLOT;
2924
2925	if (!(conn->pkt_type & ESCO_3EV5))
2926	phys |= BT_PHY_EDR_3M_3SLOT;
2927
2928	break;
2929
2930	case LE_LINK:
2931	if (conn->le_tx_phy & HCI_LE_SET_PHY_1M)
2932	phys |= BT_PHY_LE_1M_TX;
2933
2934	if (conn->le_rx_phy & HCI_LE_SET_PHY_1M)
2935	phys |= BT_PHY_LE_1M_RX;
2936
2937	if (conn->le_tx_phy & HCI_LE_SET_PHY_2M)
2938	phys |= BT_PHY_LE_2M_TX;
2939
2940	if (conn->le_rx_phy & HCI_LE_SET_PHY_2M)
2941	phys |= BT_PHY_LE_2M_RX;
2942
2943	if (conn->le_tx_phy & HCI_LE_SET_PHY_CODED)
2944	phys |= BT_PHY_LE_CODED_TX;
2945
2946	if (conn->le_rx_phy & HCI_LE_SET_PHY_CODED)
2947	phys |= BT_PHY_LE_CODED_RX;
2948
2949	break;
2950	}
2951
2952	return phys;
2953	}
2954
2955	static int abort_conn_sync(struct hci_dev *hdev, void *data)
2956	{
2957	struct hci_conn *conn = data;
2958
2959	if (!hci_conn_valid(hdev, conn))
2960	return -ECANCELED;
2961
2962	return hci_abort_conn_sync(hdev, conn, reason: conn->abort_reason);
2963	}
2964
2965	int hci_abort_conn(struct hci_conn *conn, u8 reason)
2966	{
2967	struct hci_dev *hdev = conn->hdev;
2968
2969	/* If abort_reason has already been set it means the connection is
2970	* already being aborted so don't attempt to overwrite it.
2971	*/
2972	if (conn->abort_reason)
2973	return 0;
2974
2975	bt_dev_dbg(hdev, "handle 0x%2.2x reason 0x%2.2x", conn->handle, reason);
2976
2977	conn->abort_reason = reason;
2978
2979	/* If the connection is pending check the command opcode since that
2980	* might be blocking on hci_cmd_sync_work while waiting its respective
2981	* event so we need to hci_cmd_sync_cancel to cancel it.
2982	*
2983	* hci_connect_le serializes the connection attempts so only one
2984	* connection can be in BT_CONNECT at time.
2985	*/
2986	if (conn->state == BT_CONNECT && hdev->req_status == HCI_REQ_PEND) {
2987	switch (hci_skb_event(hdev->sent_cmd)) {
2988	case HCI_EV_CONN_COMPLETE:
2989	case HCI_EV_LE_CONN_COMPLETE:
2990	case HCI_EV_LE_ENHANCED_CONN_COMPLETE:
2991	case HCI_EVT_LE_CIS_ESTABLISHED:
2992	hci_cmd_sync_cancel(hdev, ECANCELED);
2993	break;
2994	}
2995	/* Cancel connect attempt if still queued/pending */
2996	} else if (!hci_cancel_connect_sync(hdev, conn)) {
2997	return 0;
2998	}
2999
3000	/* Run immediately if on cmd_sync_work since this may be called
3001	* as a result to MGMT_OP_DISCONNECT/MGMT_OP_UNPAIR which does
3002	* already queue its callback on cmd_sync_work.
3003	*/
3004	return hci_cmd_sync_run_once(hdev, func: abort_conn_sync, data: conn, NULL);
3005	}
3006
3007	void hci_setup_tx_timestamp(struct sk_buff *skb, size_t key_offset,
3008	const struct sockcm_cookie *sockc)
3009	{
3010	struct sock *sk = skb ? skb->sk : NULL;
3011	int key;
3012
3013	/* This shall be called on a single skb of those generated by user
3014	* sendmsg(), and only when the sendmsg() does not return error to
3015	* user. This is required for keeping the tskey that increments here in
3016	* sync with possible sendmsg() counting by user.
3017	*
3018	* Stream sockets shall set key_offset to sendmsg() length in bytes
3019	* and call with the last fragment, others to 1 and first fragment.
3020	*/
3021
3022	if (!skb || !sockc || !sk || !key_offset)
3023	return;
3024
3025	sock_tx_timestamp(sk, sockc, tx_flags: &skb_shinfo(skb)->tx_flags);
3026
3027	if (sk->sk_type == SOCK_STREAM)
3028	key = atomic_add_return(i: key_offset, v: &sk->sk_tskey);
3029
3030	if (sockc->tsflags & SOF_TIMESTAMPING_OPT_ID &&
3031	sockc->tsflags & SOF_TIMESTAMPING_TX_RECORD_MASK) {
3032	if (sockc->tsflags & SOCKCM_FLAG_TS_OPT_ID) {
3033	skb_shinfo(skb)->tskey = sockc->ts_opt_id;
3034	} else {
3035	if (sk->sk_type != SOCK_STREAM)
3036	key = atomic_inc_return(v: &sk->sk_tskey);
3037	skb_shinfo(skb)->tskey = key - 1;
3038	}
3039	}
3040	}
3041
3042	void hci_conn_tx_queue(struct hci_conn *conn, struct sk_buff *skb)
3043	{
3044	struct tx_queue *comp = &conn->tx_q;
3045	bool track = false;
3046
3047	/* Emit SND now, ie. just before sending to driver */
3048	if (skb_shinfo(skb)->tx_flags & SKBTX_SW_TSTAMP)
3049	__skb_tstamp_tx(orig_skb: skb, NULL, NULL, sk: skb->sk, tstype: SCM_TSTAMP_SND);
3050
3051	/* COMPLETION tstamp is emitted for tracked skb later in Number of
3052	* Completed Packets event. Available only for flow controlled cases.
3053	*
3054	* TODO: SCO support without flowctl (needs to be done in drivers)
3055	*/
3056	switch (conn->type) {
3057	case CIS_LINK:
3058	case BIS_LINK:
3059	case PA_LINK:
3060	case ACL_LINK:
3061	case LE_LINK:
3062	break;
3063	case SCO_LINK:
3064	case ESCO_LINK:
3065	if (!hci_dev_test_flag(conn->hdev, HCI_SCO_FLOWCTL))
3066	return;
3067	break;
3068	default:
3069	return;
3070	}
3071
3072	if (skb->sk && (skb_shinfo(skb)->tx_flags & SKBTX_COMPLETION_TSTAMP))
3073	track = true;
3074
3075	/* If nothing is tracked, just count extra skbs at the queue head */
3076	if (!track && !comp->tracked) {
3077	comp->extra++;
3078	return;
3079	}
3080
3081	if (track) {
3082	skb = skb_clone_sk(skb);
3083	if (!skb)
3084	goto count_only;
3085
3086	comp->tracked++;
3087	} else {
3088	skb = skb_clone(skb, GFP_KERNEL);
3089	if (!skb)
3090	goto count_only;
3091	}
3092
3093	skb_queue_tail(list: &comp->queue, newsk: skb);
3094	return;
3095
3096	count_only:
3097	/* Stop tracking skbs, and only count. This will not emit timestamps for
3098	* the packets, but if we get here something is more seriously wrong.
3099	*/
3100	comp->tracked = 0;
3101	comp->extra += skb_queue_len(list_: &comp->queue) + 1;
3102	skb_queue_purge(list: &comp->queue);
3103	}
3104
3105	void hci_conn_tx_dequeue(struct hci_conn *conn)
3106	{
3107	struct tx_queue *comp = &conn->tx_q;
3108	struct sk_buff *skb;
3109
3110	/* If there are tracked skbs, the counted extra go before dequeuing real
3111	* skbs, to keep ordering. When nothing is tracked, the ordering doesn't
3112	* matter so dequeue real skbs first to get rid of them ASAP.
3113	*/
3114	if (comp->extra && (comp->tracked || skb_queue_empty(list: &comp->queue))) {
3115	comp->extra--;
3116	return;
3117	}
3118
3119	skb = skb_dequeue(list: &comp->queue);
3120	if (!skb)
3121	return;
3122
3123	if (skb->sk) {
3124	comp->tracked--;
3125	__skb_tstamp_tx(orig_skb: skb, NULL, NULL, sk: skb->sk,
3126	tstype: SCM_TSTAMP_COMPLETION);
3127	}
3128
3129	kfree_skb(skb);
3130	}
3131
3132	u8 *hci_conn_key_enc_size(struct hci_conn *conn)
3133	{
3134	if (conn->type == ACL_LINK) {
3135	struct link_key *key;
3136
3137	key = hci_find_link_key(hdev: conn->hdev, bdaddr: &conn->dst);
3138	if (!key)
3139	return NULL;
3140
3141	return &key->pin_len;
3142	} else if (conn->type == LE_LINK) {
3143	struct smp_ltk *ltk;
3144
3145	ltk = hci_find_ltk(hdev: conn->hdev, bdaddr: &conn->dst, addr_type: conn->dst_type,
3146	role: conn->role);
3147	if (!ltk)
3148	return NULL;
3149
3150	return &ltk->enc_size;
3151	}
3152
3153	return NULL;
3154	}
3155
3156	int hci_ethtool_ts_info(unsigned int index, int sk_proto,
3157	struct kernel_ethtool_ts_info *info)
3158	{
3159	struct hci_dev *hdev;
3160
3161	hdev = hci_dev_get(index);
3162	if (!hdev)
3163	return -ENODEV;
3164
3165	info->so_timestamping =
3166	SOF_TIMESTAMPING_RX_SOFTWARE |
3167	SOF_TIMESTAMPING_SOFTWARE;
3168	info->phc_index = -1;
3169	info->tx_types = BIT(HWTSTAMP_TX_OFF);
3170	info->rx_filters = BIT(HWTSTAMP_FILTER_NONE);
3171
3172	switch (sk_proto) {
3173	case BTPROTO_ISO:
3174	case BTPROTO_L2CAP:
3175	info->so_timestamping |= SOF_TIMESTAMPING_TX_SOFTWARE;
3176	info->so_timestamping |= SOF_TIMESTAMPING_TX_COMPLETION;
3177	break;
3178	case BTPROTO_SCO:
3179	info->so_timestamping |= SOF_TIMESTAMPING_TX_SOFTWARE;
3180	if (hci_dev_test_flag(hdev, HCI_SCO_FLOWCTL))
3181	info->so_timestamping |= SOF_TIMESTAMPING_TX_COMPLETION;
3182	break;
3183	}
3184
3185	hci_dev_put(d: hdev);
3186	return 0;
3187	}
3188