net/bluetooth/hci_conn.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI connection handling. */
  26
  27 #include <linux/export.h>
  28 #include <linux/debugfs.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/l2cap.h>
  33
  34 #include "hci_request.h"
  35 #include "smp.h"
  36 #include "a2mp.h"
  37
  38 struct sco_param {
  39         u16 pkt_type;
  40         u16 max_latency;
  41         u8  retrans_effort;
  42 };
  43
  44 static const struct sco_param esco_param_cvsd[] = {
  45         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000a,   0x01 }, /* S3 */
  46         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x0007,   0x01 }, /* S2 */
  47         { EDR_ESCO_MASK | ESCO_EV3,   0x0007,   0x01 }, /* S1 */
  48         { EDR_ESCO_MASK | ESCO_HV3,   0xffff,   0x01 }, /* D1 */
  49         { EDR_ESCO_MASK | ESCO_HV1,   0xffff,   0x01 }, /* D0 */
  50 };
  51
  52 static const struct sco_param sco_param_cvsd[] = {
  53         { EDR_ESCO_MASK | ESCO_HV3,   0xffff,   0xff }, /* D1 */
  54         { EDR_ESCO_MASK | ESCO_HV1,   0xffff,   0xff }, /* D0 */
  55 };
  56
  57 static const struct sco_param esco_param_msbc[] = {
  58         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000d,   0x02 }, /* T2 */
  59         { EDR_ESCO_MASK | ESCO_EV3,   0x0008,   0x02 }, /* T1 */
  60 };
  61
  62 /* This function requires the caller holds hdev->lock */
  63 static void hci_connect_le_scan_cleanup(struct hci_conn *conn)
  64 {
  65         struct hci_conn_params *params;
  66         struct hci_dev *hdev = conn->hdev;
  67         struct smp_irk *irk;
  68         bdaddr_t *bdaddr;
  69         u8 bdaddr_type;
  70
  71         bdaddr = &conn->dst;
  72         bdaddr_type = conn->dst_type;
  73
  74         /* Check if we need to convert to identity address */
  75         irk = hci_get_irk(hdev, bdaddr, bdaddr_type);
  76         if (irk) {
  77                 bdaddr = &irk->bdaddr;
  78                 bdaddr_type = irk->addr_type;
  79         }
  80
  81         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, bdaddr,
  82                                            bdaddr_type);
  83         if (!params || !params->explicit_connect)
  84                 return;
  85
  86         /* The connection attempt was doing scan for new RPA, and is
  87          * in scan phase. If params are not associated with any other
  88          * autoconnect action, remove them completely. If they are, just unmark
  89          * them as waiting for connection, by clearing explicit_connect field.
  90          */
  91         params->explicit_connect = false;
  92
  93         list_del_init(&params->action);
  94
  95         switch (params->auto_connect) {
  96         case HCI_AUTO_CONN_EXPLICIT:
  97                 hci_conn_params_del(hdev, bdaddr, bdaddr_type);
  98                 /* return instead of break to avoid duplicate scan update */
  99                 return;
 100         case HCI_AUTO_CONN_DIRECT:
 101         case HCI_AUTO_CONN_ALWAYS:
 102                 list_add(&params->action, &hdev->pend_le_conns);
 103                 break;
 104         case HCI_AUTO_CONN_REPORT:
 105                 list_add(&params->action, &hdev->pend_le_reports);
 106                 break;
 107         default:
 108                 break;
 109         }
 110
 111         hci_update_background_scan(hdev);
 112 }
 113
 114 static void hci_conn_cleanup(struct hci_conn *conn)
 115 {
 116         struct hci_dev *hdev = conn->hdev;
 117
 118         if (test_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags))
 119                 hci_conn_params_del(conn->hdev, &conn->dst, conn->dst_type);
 120
 121         hci_chan_list_flush(conn);
 122
 123         hci_conn_hash_del(hdev, conn);
 124
 125         if (conn->type == SCO_LINK || conn->type == ESCO_LINK) {
 126                 switch (conn->setting & SCO_AIRMODE_MASK) {
 127                 case SCO_AIRMODE_CVSD:
 128                 case SCO_AIRMODE_TRANSP:
 129                         if (hdev->notify)
 130                                 hdev->notify(hdev, HCI_NOTIFY_DISABLE_SCO);
 131                         break;
 132                 }
 133         } else {
 134                 if (hdev->notify)
 135                         hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
 136         }
 137
 138         hci_conn_del_sysfs(conn);
 139
 140         debugfs_remove_recursive(conn->debugfs);
 141
 142         hci_dev_put(hdev);
 143
 144         hci_conn_put(conn);
 145 }
 146
 147 static void le_scan_cleanup(struct work_struct *work)
 148 {
 149         struct hci_conn *conn = container_of(work, struct hci_conn,
 150                                              le_scan_cleanup);
 151         struct hci_dev *hdev = conn->hdev;
 152         struct hci_conn *c = NULL;
 153
 154         BT_DBG("%s hcon %p", hdev->name, conn);
 155
 156         hci_dev_lock(hdev);
 157
 158         /* Check that the hci_conn is still around */
 159         rcu_read_lock();
 160         list_for_each_entry_rcu(c, &hdev->conn_hash.list, list) {
 161                 if (c == conn)
 162                         break;
 163         }
 164         rcu_read_unlock();
 165
 166         if (c == conn) {
 167                 hci_connect_le_scan_cleanup(conn);
 168                 hci_conn_cleanup(conn);
 169         }
 170
 171         hci_dev_unlock(hdev);
 172         hci_dev_put(hdev);
 173         hci_conn_put(conn);
 174 }
 175
 176 static void hci_connect_le_scan_remove(struct hci_conn *conn)
 177 {
 178         BT_DBG("%s hcon %p", conn->hdev->name, conn);
 179
 180         /* We can't call hci_conn_del/hci_conn_cleanup here since that
 181          * could deadlock with another hci_conn_del() call that's holding
 182          * hci_dev_lock and doing cancel_delayed_work_sync(&conn->disc_work).
 183          * Instead, grab temporary extra references to the hci_dev and
 184          * hci_conn and perform the necessary cleanup in a separate work
 185          * callback.
 186          */
 187
 188         hci_dev_hold(conn->hdev);
 189         hci_conn_get(conn);
 190
 191         /* Even though we hold a reference to the hdev, many other
 192          * things might get cleaned up meanwhile, including the hdev's
 193          * own workqueue, so we can't use that for scheduling.
 194          */
 195         schedule_work(&conn->le_scan_cleanup);
 196 }
 197
 198 static void hci_acl_create_connection(struct hci_conn *conn)
 199 {
 200         struct hci_dev *hdev = conn->hdev;
 201         struct inquiry_entry *ie;
 202         struct hci_cp_create_conn cp;
 203
 204         BT_DBG("hcon %p", conn);
 205
 206         conn->state = BT_CONNECT;
 207         conn->out = true;
 208         conn->role = HCI_ROLE_MASTER;
 209
 210         conn->attempt++;
 211
 212         conn->link_policy = hdev->link_policy;
 213
 214         memset(&cp, 0, sizeof(cp));
 215         bacpy(&cp.bdaddr, &conn->dst);
 216         cp.pscan_rep_mode = 0x02;
 217
 218         ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
 219         if (ie) {
 220                 if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
 221                         cp.pscan_rep_mode = ie->data.pscan_rep_mode;
 222                         cp.pscan_mode     = ie->data.pscan_mode;
 223                         cp.clock_offset   = ie->data.clock_offset |
 224                                             cpu_to_le16(0x8000);
 225                 }
 226
 227                 memcpy(conn->dev_class, ie->data.dev_class, 3);
 228         }
 229
 230         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 231         if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
 232                 cp.role_switch = 0x01;
 233         else
 234                 cp.role_switch = 0x00;
 235
 236         hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
 237 }
 238
 239 int hci_disconnect(struct hci_conn *conn, __u8 reason)
 240 {
 241         BT_DBG("hcon %p", conn);
 242
 243         /* When we are master of an established connection and it enters
 244          * the disconnect timeout, then go ahead and try to read the
 245          * current clock offset.  Processing of the result is done
 246          * within the event handling and hci_clock_offset_evt function.
 247          */
 248         if (conn->type == ACL_LINK && conn->role == HCI_ROLE_MASTER &&
 249             (conn->state == BT_CONNECTED || conn->state == BT_CONFIG)) {
 250                 struct hci_dev *hdev = conn->hdev;
 251                 struct hci_cp_read_clock_offset clkoff_cp;
 252
 253                 clkoff_cp.handle = cpu_to_le16(conn->handle);
 254                 hci_send_cmd(hdev, HCI_OP_READ_CLOCK_OFFSET, sizeof(clkoff_cp),
 255                              &clkoff_cp);
 256         }
 257
 258         return hci_abort_conn(conn, reason);
 259 }
 260
 261 static void hci_add_sco(struct hci_conn *conn, __u16 handle)
 262 {
 263         struct hci_dev *hdev = conn->hdev;
 264         struct hci_cp_add_sco cp;
 265
 266         BT_DBG("hcon %p", conn);
 267
 268         conn->state = BT_CONNECT;
 269         conn->out = true;
 270
 271         conn->attempt++;
 272
 273         cp.handle   = cpu_to_le16(handle);
 274         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 275
 276         hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
 277 }
 278
 279 bool hci_setup_sync(struct hci_conn *conn, __u16 handle)
 280 {
 281         struct hci_dev *hdev = conn->hdev;
 282         struct hci_cp_setup_sync_conn cp;
 283         const struct sco_param *param;
 284
 285         BT_DBG("hcon %p", conn);
 286
 287         conn->state = BT_CONNECT;
 288         conn->out = true;
 289
 290         conn->attempt++;
 291
 292         cp.handle   = cpu_to_le16(handle);
 293
 294         cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
 295         cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
 296         cp.voice_setting  = cpu_to_le16(conn->setting);
 297
 298         switch (conn->setting & SCO_AIRMODE_MASK) {
 299         case SCO_AIRMODE_TRANSP:
 300                 if (conn->attempt > ARRAY_SIZE(esco_param_msbc))
 301                         return false;
 302                 param = &esco_param_msbc[conn->attempt - 1];
 303                 break;
 304         case SCO_AIRMODE_CVSD:
 305                 if (lmp_esco_capable(conn->link)) {
 306                         if (conn->attempt > ARRAY_SIZE(esco_param_cvsd))
 307                                 return false;
 308                         param = &esco_param_cvsd[conn->attempt - 1];
 309                 } else {
 310                         if (conn->attempt > ARRAY_SIZE(sco_param_cvsd))
 311                                 return false;
 312                         param = &sco_param_cvsd[conn->attempt - 1];
 313                 }
 314                 break;
 315         default:
 316                 return false;
 317         }
 318
 319         cp.retrans_effort = param->retrans_effort;
 320         cp.pkt_type = __cpu_to_le16(param->pkt_type);
 321         cp.max_latency = __cpu_to_le16(param->max_latency);
 322
 323         if (hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp) < 0)
 324                 return false;
 325
 326         return true;
 327 }
 328
 329 u8 hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max, u16 latency,
 330                       u16 to_multiplier)
 331 {
 332         struct hci_dev *hdev = conn->hdev;
 333         struct hci_conn_params *params;
 334         struct hci_cp_le_conn_update cp;
 335
 336         hci_dev_lock(hdev);
 337
 338         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
 339         if (params) {
 340                 params->conn_min_interval = min;
 341                 params->conn_max_interval = max;
 342                 params->conn_latency = latency;
 343                 params->supervision_timeout = to_multiplier;
 344         }
 345
 346         hci_dev_unlock(hdev);
 347
 348         memset(&cp, 0, sizeof(cp));
 349         cp.handle               = cpu_to_le16(conn->handle);
 350         cp.conn_interval_min    = cpu_to_le16(min);
 351         cp.conn_interval_max    = cpu_to_le16(max);
 352         cp.conn_latency         = cpu_to_le16(latency);
 353         cp.supervision_timeout  = cpu_to_le16(to_multiplier);
 354         cp.min_ce_len           = cpu_to_le16(0x0000);
 355         cp.max_ce_len           = cpu_to_le16(0x0000);
 356
 357         hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp);
 358
 359         if (params)
 360                 return 0x01;
 361
 362         return 0x00;
 363 }
 364
 365 void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __le64 rand,
 366                       __u8 ltk[16], __u8 key_size)
 367 {
 368         struct hci_dev *hdev = conn->hdev;
 369         struct hci_cp_le_start_enc cp;
 370
 371         BT_DBG("hcon %p", conn);
 372
 373         memset(&cp, 0, sizeof(cp));
 374
 375         cp.handle = cpu_to_le16(conn->handle);
 376         cp.rand = rand;
 377         cp.ediv = ediv;
 378         memcpy(cp.ltk, ltk, key_size);
 379
 380         hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp);
 381 }
 382
 383 /* Device _must_ be locked */
 384 void hci_sco_setup(struct hci_conn *conn, __u8 status)
 385 {
 386         struct hci_conn *sco = conn->link;
 387
 388         if (!sco)
 389                 return;
 390
 391         BT_DBG("hcon %p", conn);
 392
 393         if (!status) {
 394                 if (lmp_esco_capable(conn->hdev))
 395                         hci_setup_sync(sco, conn->handle);
 396                 else
 397                         hci_add_sco(sco, conn->handle);
 398         } else {
 399                 hci_connect_cfm(sco, status);
 400                 hci_conn_del(sco);
 401         }
 402 }
 403
 404 static void hci_conn_timeout(struct work_struct *work)
 405 {
 406         struct hci_conn *conn = container_of(work, struct hci_conn,
 407                                              disc_work.work);
 408         int refcnt = atomic_read(&conn->refcnt);
 409
 410         BT_DBG("hcon %p state %s", conn, state_to_string(conn->state));
 411
 412         WARN_ON(refcnt < 0);
 413
 414         /* FIXME: It was observed that in pairing failed scenario, refcnt
 415          * drops below 0. Probably this is because l2cap_conn_del calls
 416          * l2cap_chan_del for each channel, and inside l2cap_chan_del conn is
 417          * dropped. After that loop hci_chan_del is called which also drops
 418          * conn. For now make sure that ACL is alive if refcnt is higher then 0,
 419          * otherwise drop it.
 420          */
 421         if (refcnt > 0)
 422                 return;
 423
 424         /* LE connections in scanning state need special handling */
 425         if (conn->state == BT_CONNECT && conn->type == LE_LINK &&
 426             test_bit(HCI_CONN_SCANNING, &conn->flags)) {
 427                 hci_connect_le_scan_remove(conn);
 428                 return;
 429         }
 430
 431         hci_abort_conn(conn, hci_proto_disconn_ind(conn));
 432 }
 433
 434 /* Enter sniff mode */
 435 static void hci_conn_idle(struct work_struct *work)
 436 {
 437         struct hci_conn *conn = container_of(work, struct hci_conn,
 438                                              idle_work.work);
 439         struct hci_dev *hdev = conn->hdev;
 440
 441         BT_DBG("hcon %p mode %d", conn, conn->mode);
 442
 443         if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn))
 444                 return;
 445
 446         if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF))
 447                 return;
 448
 449         if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
 450                 struct hci_cp_sniff_subrate cp;
 451                 cp.handle             = cpu_to_le16(conn->handle);
 452                 cp.max_latency        = cpu_to_le16(0);
 453                 cp.min_remote_timeout = cpu_to_le16(0);
 454                 cp.min_local_timeout  = cpu_to_le16(0);
 455                 hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
 456         }
 457
 458         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
 459                 struct hci_cp_sniff_mode cp;
 460                 cp.handle       = cpu_to_le16(conn->handle);
 461                 cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
 462                 cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
 463                 cp.attempt      = cpu_to_le16(4);
 464                 cp.timeout      = cpu_to_le16(1);
 465                 hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
 466         }
 467 }
 468
 469 static void hci_conn_auto_accept(struct work_struct *work)
 470 {
 471         struct hci_conn *conn = container_of(work, struct hci_conn,
 472                                              auto_accept_work.work);
 473
 474         hci_send_cmd(conn->hdev, HCI_OP_USER_CONFIRM_REPLY, sizeof(conn->dst),
 475                      &conn->dst);
 476 }
 477
 478 static void le_disable_advertising(struct hci_dev *hdev)
 479 {
 480         if (ext_adv_capable(hdev)) {
 481                 struct hci_cp_le_set_ext_adv_enable cp;
 482
 483                 cp.enable = 0x00;
 484                 cp.num_of_sets = 0x00;
 485
 486                 hci_send_cmd(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE, sizeof(cp),
 487                              &cp);
 488         } else {
 489                 u8 enable = 0x00;
 490                 hci_send_cmd(hdev, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable),
 491                              &enable);
 492         }
 493 }
 494
 495 static void le_conn_timeout(struct work_struct *work)
 496 {
 497         struct hci_conn *conn = container_of(work, struct hci_conn,
 498                                              le_conn_timeout.work);
 499         struct hci_dev *hdev = conn->hdev;
 500
 501         BT_DBG("");
 502
 503         /* We could end up here due to having done directed advertising,
 504          * so clean up the state if necessary. This should however only
 505          * happen with broken hardware or if low duty cycle was used
 506          * (which doesn't have a timeout of its own).
 507          */
 508         if (conn->role == HCI_ROLE_SLAVE) {
 509                 /* Disable LE Advertising */
 510                 le_disable_advertising(hdev);
 511                 hci_le_conn_failed(conn, HCI_ERROR_ADVERTISING_TIMEOUT);
 512                 return;
 513         }
 514
 515         hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
 516 }
 517
 518 struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst,
 519                               u8 role)
 520 {
 521         struct hci_conn *conn;
 522
 523         BT_DBG("%s dst %pMR", hdev->name, dst);
 524
 525         conn = kzalloc(sizeof(*conn), GFP_KERNEL);
 526         if (!conn)
 527                 return NULL;
 528
 529         bacpy(&conn->dst, dst);
 530         bacpy(&conn->src, &hdev->bdaddr);
 531         conn->hdev  = hdev;
 532         conn->type  = type;
 533         conn->role  = role;
 534         conn->mode  = HCI_CM_ACTIVE;
 535         conn->state = BT_OPEN;
 536         conn->auth_type = HCI_AT_GENERAL_BONDING;
 537         conn->io_capability = hdev->io_capability;
 538         conn->remote_auth = 0xff;
 539         conn->key_type = 0xff;
 540         conn->rssi = HCI_RSSI_INVALID;
 541         conn->tx_power = HCI_TX_POWER_INVALID;
 542         conn->max_tx_power = HCI_TX_POWER_INVALID;
 543
 544         set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
 545         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
 546
 547         /* Set Default Authenticated payload timeout to 30s */
 548         conn->auth_payload_timeout = DEFAULT_AUTH_PAYLOAD_TIMEOUT;
 549
 550         if (conn->role == HCI_ROLE_MASTER)
 551                 conn->out = true;
 552
 553         switch (type) {
 554         case ACL_LINK:
 555                 conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
 556                 break;
 557         case LE_LINK:
 558                 /* conn->src should reflect the local identity address */
 559                 hci_copy_identity_address(hdev, &conn->src, &conn->src_type);
 560                 break;
 561         case SCO_LINK:
 562                 if (lmp_esco_capable(hdev))
 563                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
 564                                         (hdev->esco_type & EDR_ESCO_MASK);
 565                 else
 566                         conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
 567                 break;
 568         case ESCO_LINK:
 569                 conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
 570                 break;
 571         }
 572
 573         skb_queue_head_init(&conn->data_q);
 574
 575         INIT_LIST_HEAD(&conn->chan_list);
 576
 577         INIT_DELAYED_WORK(&conn->disc_work, hci_conn_timeout);
 578         INIT_DELAYED_WORK(&conn->auto_accept_work, hci_conn_auto_accept);
 579         INIT_DELAYED_WORK(&conn->idle_work, hci_conn_idle);
 580         INIT_DELAYED_WORK(&conn->le_conn_timeout, le_conn_timeout);
 581         INIT_WORK(&conn->le_scan_cleanup, le_scan_cleanup);
 582
 583         atomic_set(&conn->refcnt, 0);
 584
 585         hci_dev_hold(hdev);
 586
 587         hci_conn_hash_add(hdev, conn);
 588
 589         /* The SCO and eSCO connections will only be notified when their
 590          * setup has been completed. This is different to ACL links which
 591          * can be notified right away.
 592          */
 593         if (conn->type != SCO_LINK && conn->type != ESCO_LINK) {
 594                 if (hdev->notify)
 595                         hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
 596         }
 597
 598         hci_conn_init_sysfs(conn);
 599
 600         return conn;
 601 }
 602
 603 int hci_conn_del(struct hci_conn *conn)
 604 {
 605         struct hci_dev *hdev = conn->hdev;
 606
 607         BT_DBG("%s hcon %p handle %d", hdev->name, conn, conn->handle);
 608
 609         cancel_delayed_work_sync(&conn->disc_work);
 610         cancel_delayed_work_sync(&conn->auto_accept_work);
 611         cancel_delayed_work_sync(&conn->idle_work);
 612
 613         if (conn->type == ACL_LINK) {
 614                 struct hci_conn *sco = conn->link;
 615                 if (sco)
 616                         sco->link = NULL;
 617
 618                 /* Unacked frames */
 619                 hdev->acl_cnt += conn->sent;
 620         } else if (conn->type == LE_LINK) {
 621                 cancel_delayed_work(&conn->le_conn_timeout);
 622
 623                 if (hdev->le_pkts)
 624                         hdev->le_cnt += conn->sent;
 625                 else
 626                         hdev->acl_cnt += conn->sent;
 627         } else {
 628                 struct hci_conn *acl = conn->link;
 629                 if (acl) {
 630                         acl->link = NULL;
 631                         hci_conn_drop(acl);
 632                 }
 633         }
 634
 635         if (conn->amp_mgr)
 636                 amp_mgr_put(conn->amp_mgr);
 637
 638         skb_queue_purge(&conn->data_q);
 639
 640         /* Remove the connection from the list and cleanup its remaining
 641          * state. This is a separate function since for some cases like
 642          * BT_CONNECT_SCAN we *only* want the cleanup part without the
 643          * rest of hci_conn_del.
 644          */
 645         hci_conn_cleanup(conn);
 646
 647         return 0;
 648 }
 649
 650 struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src, uint8_t src_type)
 651 {
 652         int use_src = bacmp(src, BDADDR_ANY);
 653         struct hci_dev *hdev = NULL, *d;
 654
 655         BT_DBG("%pMR -> %pMR", src, dst);
 656
 657         read_lock(&hci_dev_list_lock);
 658
 659         list_for_each_entry(d, &hci_dev_list, list) {
 660                 if (!test_bit(HCI_UP, &d->flags) ||
 661                     hci_dev_test_flag(d, HCI_USER_CHANNEL) ||
 662                     d->dev_type != HCI_PRIMARY)
 663                         continue;
 664
 665                 /* Simple routing:
 666                  *   No source address - find interface with bdaddr != dst
 667                  *   Source address    - find interface with bdaddr == src
 668                  */
 669
 670                 if (use_src) {
 671                         bdaddr_t id_addr;
 672                         u8 id_addr_type;
 673
 674                         if (src_type == BDADDR_BREDR) {
 675                                 if (!lmp_bredr_capable(d))
 676                                         continue;
 677                                 bacpy(&id_addr, &d->bdaddr);
 678                                 id_addr_type = BDADDR_BREDR;
 679                         } else {
 680                                 if (!lmp_le_capable(d))
 681                                         continue;
 682
 683                                 hci_copy_identity_address(d, &id_addr,
 684                                                           &id_addr_type);
 685
 686                                 /* Convert from HCI to three-value type */
 687                                 if (id_addr_type == ADDR_LE_DEV_PUBLIC)
 688                                         id_addr_type = BDADDR_LE_PUBLIC;
 689                                 else
 690                                         id_addr_type = BDADDR_LE_RANDOM;
 691                         }
 692
 693                         if (!bacmp(&id_addr, src) && id_addr_type == src_type) {
 694                                 hdev = d; break;
 695                         }
 696                 } else {
 697                         if (bacmp(&d->bdaddr, dst)) {
 698                                 hdev = d; break;
 699                         }
 700                 }
 701         }
 702
 703         if (hdev)
 704                 hdev = hci_dev_hold(hdev);
 705
 706         read_unlock(&hci_dev_list_lock);
 707         return hdev;
 708 }
 709 EXPORT_SYMBOL(hci_get_route);
 710
 711 /* This function requires the caller holds hdev->lock */
 712 void hci_le_conn_failed(struct hci_conn *conn, u8 status)
 713 {
 714         struct hci_dev *hdev = conn->hdev;
 715         struct hci_conn_params *params;
 716
 717         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
 718                                            conn->dst_type);
 719         if (params && params->conn) {
 720                 hci_conn_drop(params->conn);
 721                 hci_conn_put(params->conn);
 722                 params->conn = NULL;
 723         }
 724
 725         conn->state = BT_CLOSED;
 726
 727         /* If the status indicates successful cancellation of
 728          * the attempt (i.e. Unkown Connection Id) there's no point of
 729          * notifying failure since we'll go back to keep trying to
 730          * connect. The only exception is explicit connect requests
 731          * where a timeout + cancel does indicate an actual failure.
 732          */
 733         if (status != HCI_ERROR_UNKNOWN_CONN_ID ||
 734             (params && params->explicit_connect))
 735                 mgmt_connect_failed(hdev, &conn->dst, conn->type,
 736                                     conn->dst_type, status);
 737
 738         hci_connect_cfm(conn, status);
 739
 740         hci_conn_del(conn);
 741
 742         /* Since we may have temporarily stopped the background scanning in
 743          * favor of connection establishment, we should restart it.
 744          */
 745         hci_update_background_scan(hdev);
 746
 747         /* Re-enable advertising in case this was a failed connection
 748          * attempt as a peripheral.
 749          */
 750         hci_req_reenable_advertising(hdev);
 751 }
 752
 753 static void create_le_conn_complete(struct hci_dev *hdev, u8 status, u16 opcode)
 754 {
 755         struct hci_conn *conn;
 756
 757         hci_dev_lock(hdev);
 758
 759         conn = hci_lookup_le_connect(hdev);
 760
 761         if (!status) {
 762                 hci_connect_le_scan_cleanup(conn);
 763                 goto done;
 764         }
 765
 766         bt_dev_err(hdev, "request failed to create LE connection: "
 767                    "status 0x%2.2x", status);
 768
 769         if (!conn)
 770                 goto done;
 771
 772         hci_le_conn_failed(conn, status);
 773
 774 done:
 775         hci_dev_unlock(hdev);
 776 }
 777
 778 static bool conn_use_rpa(struct hci_conn *conn)
 779 {
 780         struct hci_dev *hdev = conn->hdev;
 781
 782         return hci_dev_test_flag(hdev, HCI_PRIVACY);
 783 }
 784
 785 static void set_ext_conn_params(struct hci_conn *conn,
 786                                 struct hci_cp_le_ext_conn_param *p)
 787 {
 788         struct hci_dev *hdev = conn->hdev;
 789
 790         memset(p, 0, sizeof(*p));
 791
 792         p->scan_interval = cpu_to_le16(hdev->le_scan_int_connect);
 793         p->scan_window = cpu_to_le16(hdev->le_scan_window_connect);
 794         p->conn_interval_min = cpu_to_le16(conn->le_conn_min_interval);
 795         p->conn_interval_max = cpu_to_le16(conn->le_conn_max_interval);
 796         p->conn_latency = cpu_to_le16(conn->le_conn_latency);
 797         p->supervision_timeout = cpu_to_le16(conn->le_supv_timeout);
 798         p->min_ce_len = cpu_to_le16(0x0000);
 799         p->max_ce_len = cpu_to_le16(0x0000);
 800 }
 801
 802 static void hci_req_add_le_create_conn(struct hci_request *req,
 803                                        struct hci_conn *conn,
 804                                        bdaddr_t *direct_rpa)
 805 {
 806         struct hci_dev *hdev = conn->hdev;
 807         u8 own_addr_type;
 808
 809         /* If direct address was provided we use it instead of current
 810          * address.
 811          */
 812         if (direct_rpa) {
 813                 if (bacmp(&req->hdev->random_addr, direct_rpa))
 814                         hci_req_add(req, HCI_OP_LE_SET_RANDOM_ADDR, 6,
 815                                                                 direct_rpa);
 816
 817                 /* direct address is always RPA */
 818                 own_addr_type = ADDR_LE_DEV_RANDOM;
 819         } else {
 820                 /* Update random address, but set require_privacy to false so
 821                  * that we never connect with an non-resolvable address.
 822                  */
 823                 if (hci_update_random_address(req, false, conn_use_rpa(conn),
 824                                               &own_addr_type))
 825                         return;
 826         }
 827
 828         if (use_ext_conn(hdev)) {
 829                 struct hci_cp_le_ext_create_conn *cp;
 830                 struct hci_cp_le_ext_conn_param *p;
 831                 u8 data[sizeof(*cp) + sizeof(*p) * 3];
 832                 u32 plen;
 833
 834                 cp = (void *) data;
 835                 p = (void *) cp->data;
 836
 837                 memset(cp, 0, sizeof(*cp));
 838
 839                 bacpy(&cp->peer_addr, &conn->dst);
 840                 cp->peer_addr_type = conn->dst_type;
 841                 cp->own_addr_type = own_addr_type;
 842
 843                 plen = sizeof(*cp);
 844
 845                 if (scan_1m(hdev)) {
 846                         cp->phys |= LE_SCAN_PHY_1M;
 847                         set_ext_conn_params(conn, p);
 848
 849                         p++;
 850                         plen += sizeof(*p);
 851                 }
 852
 853                 if (scan_2m(hdev)) {
 854                         cp->phys |= LE_SCAN_PHY_2M;
 855                         set_ext_conn_params(conn, p);
 856
 857                         p++;
 858                         plen += sizeof(*p);
 859                 }
 860
 861                 if (scan_coded(hdev)) {
 862                         cp->phys |= LE_SCAN_PHY_CODED;
 863                         set_ext_conn_params(conn, p);
 864
 865                         plen += sizeof(*p);
 866                 }
 867
 868                 hci_req_add(req, HCI_OP_LE_EXT_CREATE_CONN, plen, data);
 869
 870         } else {
 871                 struct hci_cp_le_create_conn cp;
 872
 873                 memset(&cp, 0, sizeof(cp));
 874
 875                 cp.scan_interval = cpu_to_le16(hdev->le_scan_int_connect);
 876                 cp.scan_window = cpu_to_le16(hdev->le_scan_window_connect);
 877
 878                 bacpy(&cp.peer_addr, &conn->dst);
 879                 cp.peer_addr_type = conn->dst_type;
 880                 cp.own_address_type = own_addr_type;
 881                 cp.conn_interval_min = cpu_to_le16(conn->le_conn_min_interval);
 882                 cp.conn_interval_max = cpu_to_le16(conn->le_conn_max_interval);
 883                 cp.conn_latency = cpu_to_le16(conn->le_conn_latency);
 884                 cp.supervision_timeout = cpu_to_le16(conn->le_supv_timeout);
 885                 cp.min_ce_len = cpu_to_le16(0x0000);
 886                 cp.max_ce_len = cpu_to_le16(0x0000);
 887
 888                 hci_req_add(req, HCI_OP_LE_CREATE_CONN, sizeof(cp), &cp);
 889         }
 890
 891         conn->state = BT_CONNECT;
 892         clear_bit(HCI_CONN_SCANNING, &conn->flags);
 893 }
 894
 895 static void hci_req_directed_advertising(struct hci_request *req,
 896                                          struct hci_conn *conn)
 897 {
 898         struct hci_dev *hdev = req->hdev;
 899         u8 own_addr_type;
 900         u8 enable;
 901
 902         if (ext_adv_capable(hdev)) {
 903                 struct hci_cp_le_set_ext_adv_params cp;
 904                 bdaddr_t random_addr;
 905
 906                 /* Set require_privacy to false so that the remote device has a
 907                  * chance of identifying us.
 908                  */
 909                 if (hci_get_random_address(hdev, false, conn_use_rpa(conn), NULL,
 910                                            &own_addr_type, &random_addr) < 0)
 911                         return;
 912
 913                 memset(&cp, 0, sizeof(cp));
 914
 915                 cp.evt_properties = cpu_to_le16(LE_LEGACY_ADV_DIRECT_IND);
 916                 cp.own_addr_type = own_addr_type;
 917                 cp.channel_map = hdev->le_adv_channel_map;
 918                 cp.tx_power = HCI_TX_POWER_INVALID;
 919                 cp.primary_phy = HCI_ADV_PHY_1M;
 920                 cp.secondary_phy = HCI_ADV_PHY_1M;
 921                 cp.handle = 0; /* Use instance 0 for directed adv */
 922                 cp.own_addr_type = own_addr_type;
 923                 cp.peer_addr_type = conn->dst_type;
 924                 bacpy(&cp.peer_addr, &conn->dst);
 925
 926                 /* As per Core Spec 5.2 Vol 2, PART E, Sec 7.8.53, for
 927                  * advertising_event_property LE_LEGACY_ADV_DIRECT_IND
 928                  * does not supports advertising data when the advertising set already
 929                  * contains some, the controller shall return erroc code 'Invalid
 930                  * HCI Command Parameters(0x12).
 931                  * So it is required to remove adv set for handle 0x00. since we use
 932                  * instance 0 for directed adv.
 933                  */
 934                 __hci_req_remove_ext_adv_instance(req, cp.handle);
 935
 936                 hci_req_add(req, HCI_OP_LE_SET_EXT_ADV_PARAMS, sizeof(cp), &cp);
 937
 938                 if (own_addr_type == ADDR_LE_DEV_RANDOM &&
 939                     bacmp(&random_addr, BDADDR_ANY) &&
 940                     bacmp(&random_addr, &hdev->random_addr)) {
 941                         struct hci_cp_le_set_adv_set_rand_addr cp;
 942
 943                         memset(&cp, 0, sizeof(cp));
 944
 945                         cp.handle = 0;
 946                         bacpy(&cp.bdaddr, &random_addr);
 947
 948                         hci_req_add(req,
 949                                     HCI_OP_LE_SET_ADV_SET_RAND_ADDR,
 950                                     sizeof(cp), &cp);
 951                 }
 952
 953                 __hci_req_enable_ext_advertising(req, 0x00);
 954         } else {
 955                 struct hci_cp_le_set_adv_param cp;
 956
 957                 /* Clear the HCI_LE_ADV bit temporarily so that the
 958                  * hci_update_random_address knows that it's safe to go ahead
 959                  * and write a new random address. The flag will be set back on
 960                  * as soon as the SET_ADV_ENABLE HCI command completes.
 961                  */
 962                 hci_dev_clear_flag(hdev, HCI_LE_ADV);
 963
 964                 /* Set require_privacy to false so that the remote device has a
 965                  * chance of identifying us.
 966                  */
 967                 if (hci_update_random_address(req, false, conn_use_rpa(conn),
 968                                               &own_addr_type) < 0)
 969                         return;
 970
 971                 memset(&cp, 0, sizeof(cp));
 972
 973                 /* Some controllers might reject command if intervals are not
 974                  * within range for undirected advertising.
 975                  * BCM20702A0 is known to be affected by this.
 976                  */
 977                 cp.min_interval = cpu_to_le16(0x0020);
 978                 cp.max_interval = cpu_to_le16(0x0020);
 979
 980                 cp.type = LE_ADV_DIRECT_IND;
 981                 cp.own_address_type = own_addr_type;
 982                 cp.direct_addr_type = conn->dst_type;
 983                 bacpy(&cp.direct_addr, &conn->dst);
 984                 cp.channel_map = hdev->le_adv_channel_map;
 985
 986                 hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
 987
 988                 enable = 0x01;
 989                 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable),
 990                             &enable);
 991         }
 992
 993         conn->state = BT_CONNECT;
 994 }
 995
 996 struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,
 997                                 u8 dst_type, u8 sec_level, u16 conn_timeout,
 998                                 u8 role, bdaddr_t *direct_rpa)
 999 {
1000         struct hci_conn_params *params;
1001         struct hci_conn *conn;
1002         struct smp_irk *irk;
1003         struct hci_request req;
1004         int err;
1005
1006         /* This ensures that during disable le_scan address resolution
1007          * will not be disabled if it is followed by le_create_conn
1008          */
1009         bool rpa_le_conn = true;
1010
1011         /* Let's make sure that le is enabled.*/
1012         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1013                 if (lmp_le_capable(hdev))
1014                         return ERR_PTR(-ECONNREFUSED);
1015
1016                 return ERR_PTR(-EOPNOTSUPP);
1017         }
1018
1019         /* Since the controller supports only one LE connection attempt at a
1020          * time, we return -EBUSY if there is any connection attempt running.
1021          */
1022         if (hci_lookup_le_connect(hdev))
1023                 return ERR_PTR(-EBUSY);
1024
1025         /* If there's already a connection object but it's not in
1026          * scanning state it means it must already be established, in
1027          * which case we can't do anything else except report a failure
1028          * to connect.
1029          */
1030         conn = hci_conn_hash_lookup_le(hdev, dst, dst_type);
1031         if (conn && !test_bit(HCI_CONN_SCANNING, &conn->flags)) {
1032                 return ERR_PTR(-EBUSY);
1033         }
1034
1035         /* When given an identity address with existing identity
1036          * resolving key, the connection needs to be established
1037          * to a resolvable random address.
1038          *
1039          * Storing the resolvable random address is required here
1040          * to handle connection failures. The address will later
1041          * be resolved back into the original identity address
1042          * from the connect request.
1043          */
1044         irk = hci_find_irk_by_addr(hdev, dst, dst_type);
1045         if (irk && bacmp(&irk->rpa, BDADDR_ANY)) {
1046                 dst = &irk->rpa;
1047                 dst_type = ADDR_LE_DEV_RANDOM;
1048         }
1049
1050         if (conn) {
1051                 bacpy(&conn->dst, dst);
1052         } else {
1053                 conn = hci_conn_add(hdev, LE_LINK, dst, role);
1054                 if (!conn)
1055                         return ERR_PTR(-ENOMEM);
1056                 hci_conn_hold(conn);
1057                 conn->pending_sec_level = sec_level;
1058         }
1059
1060         conn->dst_type = dst_type;
1061         conn->sec_level = BT_SECURITY_LOW;
1062         conn->conn_timeout = conn_timeout;
1063
1064         hci_req_init(&req, hdev);
1065
1066         /* Disable advertising if we're active. For master role
1067          * connections most controllers will refuse to connect if
1068          * advertising is enabled, and for slave role connections we
1069          * anyway have to disable it in order to start directed
1070          * advertising.
1071          */
1072         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1073                  __hci_req_disable_advertising(&req);
1074
1075         /* If requested to connect as slave use directed advertising */
1076         if (conn->role == HCI_ROLE_SLAVE) {
1077                 /* If we're active scanning most controllers are unable
1078                  * to initiate advertising. Simply reject the attempt.
1079                  */
1080                 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
1081                     hdev->le_scan_type == LE_SCAN_ACTIVE) {
1082                         hci_req_purge(&req);
1083                         hci_conn_del(conn);
1084                         return ERR_PTR(-EBUSY);
1085                 }
1086
1087                 hci_req_directed_advertising(&req, conn);
1088                 goto create_conn;
1089         }
1090
1091         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
1092         if (params) {
1093                 conn->le_conn_min_interval = params->conn_min_interval;
1094                 conn->le_conn_max_interval = params->conn_max_interval;
1095                 conn->le_conn_latency = params->conn_latency;
1096                 conn->le_supv_timeout = params->supervision_timeout;
1097         } else {
1098                 conn->le_conn_min_interval = hdev->le_conn_min_interval;
1099                 conn->le_conn_max_interval = hdev->le_conn_max_interval;
1100                 conn->le_conn_latency = hdev->le_conn_latency;
1101                 conn->le_supv_timeout = hdev->le_supv_timeout;
1102         }
1103
1104         /* If controller is scanning, we stop it since some controllers are
1105          * not able to scan and connect at the same time. Also set the
1106          * HCI_LE_SCAN_INTERRUPTED flag so that the command complete
1107          * handler for scan disabling knows to set the correct discovery
1108          * state.
1109          */
1110         if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
1111                 hci_req_add_le_scan_disable(&req, rpa_le_conn);
1112                 hci_dev_set_flag(hdev, HCI_LE_SCAN_INTERRUPTED);
1113         }
1114
1115         hci_req_add_le_create_conn(&req, conn, direct_rpa);
1116
1117 create_conn:
1118         err = hci_req_run(&req, create_le_conn_complete);
1119         if (err) {
1120                 hci_conn_del(conn);
1121                 return ERR_PTR(err);
1122         }
1123
1124         return conn;
1125 }
1126
1127 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
1128 {
1129         struct hci_conn *conn;
1130
1131         conn = hci_conn_hash_lookup_le(hdev, addr, type);
1132         if (!conn)
1133                 return false;
1134
1135         if (conn->state != BT_CONNECTED)
1136                 return false;
1137
1138         return true;
1139 }
1140
1141 /* This function requires the caller holds hdev->lock */
1142 static int hci_explicit_conn_params_set(struct hci_dev *hdev,
1143                                         bdaddr_t *addr, u8 addr_type)
1144 {
1145         struct hci_conn_params *params;
1146
1147         if (is_connected(hdev, addr, addr_type))
1148                 return -EISCONN;
1149
1150         params = hci_conn_params_lookup(hdev, addr, addr_type);
1151         if (!params) {
1152                 params = hci_conn_params_add(hdev, addr, addr_type);
1153                 if (!params)
1154                         return -ENOMEM;
1155
1156                 /* If we created new params, mark them to be deleted in
1157                  * hci_connect_le_scan_cleanup. It's different case than
1158                  * existing disabled params, those will stay after cleanup.
1159                  */
1160                 params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
1161         }
1162
1163         /* We're trying to connect, so make sure params are at pend_le_conns */
1164         if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
1165             params->auto_connect == HCI_AUTO_CONN_REPORT ||
1166             params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
1167                 list_del_init(&params->action);
1168                 list_add(&params->action, &hdev->pend_le_conns);
1169         }
1170
1171         params->explicit_connect = true;
1172
1173         BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
1174                params->auto_connect);
1175
1176         return 0;
1177 }
1178
1179 /* This function requires the caller holds hdev->lock */
1180 struct hci_conn *hci_connect_le_scan(struct hci_dev *hdev, bdaddr_t *dst,
1181                                      u8 dst_type, u8 sec_level,
1182                                      u16 conn_timeout,
1183                                      enum conn_reasons conn_reason)
1184 {
1185         struct hci_conn *conn;
1186
1187         /* Let's make sure that le is enabled.*/
1188         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1189                 if (lmp_le_capable(hdev))
1190                         return ERR_PTR(-ECONNREFUSED);
1191
1192                 return ERR_PTR(-EOPNOTSUPP);
1193         }
1194
1195         /* Some devices send ATT messages as soon as the physical link is
1196          * established. To be able to handle these ATT messages, the user-
1197          * space first establishes the connection and then starts the pairing
1198          * process.
1199          *
1200          * So if a hci_conn object already exists for the following connection
1201          * attempt, we simply update pending_sec_level and auth_type fields
1202          * and return the object found.
1203          */
1204         conn = hci_conn_hash_lookup_le(hdev, dst, dst_type);
1205         if (conn) {
1206                 if (conn->pending_sec_level < sec_level)
1207                         conn->pending_sec_level = sec_level;
1208                 goto done;
1209         }
1210
1211         BT_DBG("requesting refresh of dst_addr");
1212
1213         conn = hci_conn_add(hdev, LE_LINK, dst, HCI_ROLE_MASTER);
1214         if (!conn)
1215                 return ERR_PTR(-ENOMEM);
1216
1217         if (hci_explicit_conn_params_set(hdev, dst, dst_type) < 0) {
1218                 hci_conn_del(conn);
1219                 return ERR_PTR(-EBUSY);
1220         }
1221
1222         conn->state = BT_CONNECT;
1223         set_bit(HCI_CONN_SCANNING, &conn->flags);
1224         conn->dst_type = dst_type;
1225         conn->sec_level = BT_SECURITY_LOW;
1226         conn->pending_sec_level = sec_level;
1227         conn->conn_timeout = conn_timeout;
1228         conn->conn_reason = conn_reason;
1229
1230         hci_update_background_scan(hdev);
1231
1232 done:
1233         hci_conn_hold(conn);
1234         return conn;
1235 }
1236
1237 struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst,
1238                                  u8 sec_level, u8 auth_type,
1239                                  enum conn_reasons conn_reason)
1240 {
1241         struct hci_conn *acl;
1242
1243         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1244                 if (lmp_bredr_capable(hdev))
1245                         return ERR_PTR(-ECONNREFUSED);
1246
1247                 return ERR_PTR(-EOPNOTSUPP);
1248         }
1249
1250         acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
1251         if (!acl) {
1252                 acl = hci_conn_add(hdev, ACL_LINK, dst, HCI_ROLE_MASTER);
1253                 if (!acl)
1254                         return ERR_PTR(-ENOMEM);
1255         }
1256
1257         hci_conn_hold(acl);
1258
1259         acl->conn_reason = conn_reason;
1260         if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
1261                 acl->sec_level = BT_SECURITY_LOW;
1262                 acl->pending_sec_level = sec_level;
1263                 acl->auth_type = auth_type;
1264                 hci_acl_create_connection(acl);
1265         }
1266
1267         return acl;
1268 }
1269
1270 struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type, bdaddr_t *dst,
1271                                  __u16 setting)
1272 {
1273         struct hci_conn *acl;
1274         struct hci_conn *sco;
1275
1276         acl = hci_connect_acl(hdev, dst, BT_SECURITY_LOW, HCI_AT_NO_BONDING,
1277                               CONN_REASON_SCO_CONNECT);
1278         if (IS_ERR(acl))
1279                 return acl;
1280
1281         sco = hci_conn_hash_lookup_ba(hdev, type, dst);
1282         if (!sco) {
1283                 sco = hci_conn_add(hdev, type, dst, HCI_ROLE_MASTER);
1284                 if (!sco) {
1285                         hci_conn_drop(acl);
1286                         return ERR_PTR(-ENOMEM);
1287                 }
1288         }
1289
1290         acl->link = sco;
1291         sco->link = acl;
1292
1293         hci_conn_hold(sco);
1294
1295         sco->setting = setting;
1296
1297         if (acl->state == BT_CONNECTED &&
1298             (sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
1299                 set_bit(HCI_CONN_POWER_SAVE, &acl->flags);
1300                 hci_conn_enter_active_mode(acl, BT_POWER_FORCE_ACTIVE_ON);
1301
1302                 if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->flags)) {
1303                         /* defer SCO setup until mode change completed */
1304                         set_bit(HCI_CONN_SCO_SETUP_PEND, &acl->flags);
1305                         return sco;
1306                 }
1307
1308                 hci_sco_setup(acl, 0x00);
1309         }
1310
1311         return sco;
1312 }
1313
1314 /* Check link security requirement */
1315 int hci_conn_check_link_mode(struct hci_conn *conn)
1316 {
1317         BT_DBG("hcon %p", conn);
1318
1319         /* In Secure Connections Only mode, it is required that Secure
1320          * Connections is used and the link is encrypted with AES-CCM
1321          * using a P-256 authenticated combination key.
1322          */
1323         if (hci_dev_test_flag(conn->hdev, HCI_SC_ONLY)) {
1324                 if (!hci_conn_sc_enabled(conn) ||
1325                     !test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
1326                     conn->key_type != HCI_LK_AUTH_COMBINATION_P256)
1327                         return 0;
1328         }
1329
1330          /* AES encryption is required for Level 4:
1331           *
1332           * BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 3, Part C
1333           * page 1319:
1334           *
1335           * 128-bit equivalent strength for link and encryption keys
1336           * required using FIPS approved algorithms (E0 not allowed,
1337           * SAFER+ not allowed, and P-192 not allowed; encryption key
1338           * not shortened)
1339           */
1340         if (conn->sec_level == BT_SECURITY_FIPS &&
1341             !test_bit(HCI_CONN_AES_CCM, &conn->flags)) {
1342                 bt_dev_err(conn->hdev,
1343                            "Invalid security: Missing AES-CCM usage");
1344                 return 0;
1345         }
1346
1347         if (hci_conn_ssp_enabled(conn) &&
1348             !test_bit(HCI_CONN_ENCRYPT, &conn->flags))
1349                 return 0;
1350
1351         return 1;
1352 }
1353
1354 /* Authenticate remote device */
1355 static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
1356 {
1357         BT_DBG("hcon %p", conn);
1358
1359         if (conn->pending_sec_level > sec_level)
1360                 sec_level = conn->pending_sec_level;
1361
1362         if (sec_level > conn->sec_level)
1363                 conn->pending_sec_level = sec_level;
1364         else if (test_bit(HCI_CONN_AUTH, &conn->flags))
1365                 return 1;
1366
1367         /* Make sure we preserve an existing MITM requirement*/
1368         auth_type |= (conn->auth_type & 0x01);
1369
1370         conn->auth_type = auth_type;
1371
1372         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
1373                 struct hci_cp_auth_requested cp;
1374
1375                 cp.handle = cpu_to_le16(conn->handle);
1376                 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
1377                              sizeof(cp), &cp);
1378
1379                 /* If we're already encrypted set the REAUTH_PEND flag,
1380                  * otherwise set the ENCRYPT_PEND.
1381                  */
1382                 if (test_bit(HCI_CONN_ENCRYPT, &conn->flags))
1383                         set_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
1384                 else
1385                         set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
1386         }
1387
1388         return 0;
1389 }
1390
1391 /* Encrypt the link */
1392 static void hci_conn_encrypt(struct hci_conn *conn)
1393 {
1394         BT_DBG("hcon %p", conn);
1395
1396         if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
1397                 struct hci_cp_set_conn_encrypt cp;
1398                 cp.handle  = cpu_to_le16(conn->handle);
1399                 cp.encrypt = 0x01;
1400                 hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
1401                              &cp);
1402         }
1403 }
1404
1405 /* Enable security */
1406 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type,
1407                       bool initiator)
1408 {
1409         BT_DBG("hcon %p", conn);
1410
1411         if (conn->type == LE_LINK)
1412                 return smp_conn_security(conn, sec_level);
1413
1414         /* For sdp we don't need the link key. */
1415         if (sec_level == BT_SECURITY_SDP)
1416                 return 1;
1417
1418         /* For non 2.1 devices and low security level we don't need the link
1419            key. */
1420         if (sec_level == BT_SECURITY_LOW && !hci_conn_ssp_enabled(conn))
1421                 return 1;
1422
1423         /* For other security levels we need the link key. */
1424         if (!test_bit(HCI_CONN_AUTH, &conn->flags))
1425                 goto auth;
1426
1427         /* An authenticated FIPS approved combination key has sufficient
1428          * security for security level 4. */
1429         if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256 &&
1430             sec_level == BT_SECURITY_FIPS)
1431                 goto encrypt;
1432
1433         /* An authenticated combination key has sufficient security for
1434            security level 3. */
1435         if ((conn->key_type == HCI_LK_AUTH_COMBINATION_P192 ||
1436              conn->key_type == HCI_LK_AUTH_COMBINATION_P256) &&
1437             sec_level == BT_SECURITY_HIGH)
1438                 goto encrypt;
1439
1440         /* An unauthenticated combination key has sufficient security for
1441            security level 1 and 2. */
1442         if ((conn->key_type == HCI_LK_UNAUTH_COMBINATION_P192 ||
1443              conn->key_type == HCI_LK_UNAUTH_COMBINATION_P256) &&
1444             (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW))
1445                 goto encrypt;
1446
1447         /* A combination key has always sufficient security for the security
1448            levels 1 or 2. High security level requires the combination key
1449            is generated using maximum PIN code length (16).
1450            For pre 2.1 units. */
1451         if (conn->key_type == HCI_LK_COMBINATION &&
1452             (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW ||
1453              conn->pin_length == 16))
1454                 goto encrypt;
1455
1456 auth:
1457         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags))
1458                 return 0;
1459
1460         if (initiator)
1461                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
1462
1463         if (!hci_conn_auth(conn, sec_level, auth_type))
1464                 return 0;
1465
1466 encrypt:
1467         if (test_bit(HCI_CONN_ENCRYPT, &conn->flags)) {
1468                 /* Ensure that the encryption key size has been read,
1469                  * otherwise stall the upper layer responses.
1470                  */
1471                 if (!conn->enc_key_size)
1472                         return 0;
1473
1474                 /* Nothing else needed, all requirements are met */
1475                 return 1;
1476         }
1477
1478         hci_conn_encrypt(conn);
1479         return 0;
1480 }
1481 EXPORT_SYMBOL(hci_conn_security);
1482
1483 /* Check secure link requirement */
1484 int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level)
1485 {
1486         BT_DBG("hcon %p", conn);
1487
1488         /* Accept if non-secure or higher security level is required */
1489         if (sec_level != BT_SECURITY_HIGH && sec_level != BT_SECURITY_FIPS)
1490                 return 1;
1491
1492         /* Accept if secure or higher security level is already present */
1493         if (conn->sec_level == BT_SECURITY_HIGH ||
1494             conn->sec_level == BT_SECURITY_FIPS)
1495                 return 1;
1496
1497         /* Reject not secure link */
1498         return 0;
1499 }
1500 EXPORT_SYMBOL(hci_conn_check_secure);
1501
1502 /* Switch role */
1503 int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
1504 {
1505         BT_DBG("hcon %p", conn);
1506
1507         if (role == conn->role)
1508                 return 1;
1509
1510         if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->flags)) {
1511                 struct hci_cp_switch_role cp;
1512                 bacpy(&cp.bdaddr, &conn->dst);
1513                 cp.role = role;
1514                 hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
1515         }
1516
1517         return 0;
1518 }
1519 EXPORT_SYMBOL(hci_conn_switch_role);
1520
1521 /* Enter active mode */
1522 void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
1523 {
1524         struct hci_dev *hdev = conn->hdev;
1525
1526         BT_DBG("hcon %p mode %d", conn, conn->mode);
1527
1528         if (conn->mode != HCI_CM_SNIFF)
1529                 goto timer;
1530
1531         if (!test_bit(HCI_CONN_POWER_SAVE, &conn->flags) && !force_active)
1532                 goto timer;
1533
1534         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
1535                 struct hci_cp_exit_sniff_mode cp;
1536                 cp.handle = cpu_to_le16(conn->handle);
1537                 hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
1538         }
1539
1540 timer:
1541         if (hdev->idle_timeout > 0)
1542                 queue_delayed_work(hdev->workqueue, &conn->idle_work,
1543                                    msecs_to_jiffies(hdev->idle_timeout));
1544 }
1545
1546 /* Drop all connection on the device */
1547 void hci_conn_hash_flush(struct hci_dev *hdev)
1548 {
1549         struct hci_conn_hash *h = &hdev->conn_hash;
1550         struct hci_conn *c, *n;
1551
1552         BT_DBG("hdev %s", hdev->name);
1553
1554         list_for_each_entry_safe(c, n, &h->list, list) {
1555                 c->state = BT_CLOSED;
1556
1557                 hci_disconn_cfm(c, HCI_ERROR_LOCAL_HOST_TERM);
1558                 hci_conn_del(c);
1559         }
1560 }
1561
1562 /* Check pending connect attempts */
1563 void hci_conn_check_pending(struct hci_dev *hdev)
1564 {
1565         struct hci_conn *conn;
1566
1567         BT_DBG("hdev %s", hdev->name);
1568
1569         hci_dev_lock(hdev);
1570
1571         conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
1572         if (conn)
1573                 hci_acl_create_connection(conn);
1574
1575         hci_dev_unlock(hdev);
1576 }
1577
1578 static u32 get_link_mode(struct hci_conn *conn)
1579 {
1580         u32 link_mode = 0;
1581
1582         if (conn->role == HCI_ROLE_MASTER)
1583                 link_mode |= HCI_LM_MASTER;
1584
1585         if (test_bit(HCI_CONN_ENCRYPT, &conn->flags))
1586                 link_mode |= HCI_LM_ENCRYPT;
1587
1588         if (test_bit(HCI_CONN_AUTH, &conn->flags))
1589                 link_mode |= HCI_LM_AUTH;
1590
1591         if (test_bit(HCI_CONN_SECURE, &conn->flags))
1592                 link_mode |= HCI_LM_SECURE;
1593
1594         if (test_bit(HCI_CONN_FIPS, &conn->flags))
1595                 link_mode |= HCI_LM_FIPS;
1596
1597         return link_mode;
1598 }
1599
1600 int hci_get_conn_list(void __user *arg)
1601 {
1602         struct hci_conn *c;
1603         struct hci_conn_list_req req, *cl;
1604         struct hci_conn_info *ci;
1605         struct hci_dev *hdev;
1606         int n = 0, size, err;
1607
1608         if (copy_from_user(&req, arg, sizeof(req)))
1609                 return -EFAULT;
1610
1611         if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
1612                 return -EINVAL;
1613
1614         size = sizeof(req) + req.conn_num * sizeof(*ci);
1615
1616         cl = kmalloc(size, GFP_KERNEL);
1617         if (!cl)
1618                 return -ENOMEM;
1619
1620         hdev = hci_dev_get(req.dev_id);
1621         if (!hdev) {
1622                 kfree(cl);
1623                 return -ENODEV;
1624         }
1625
1626         ci = cl->conn_info;
1627
1628         hci_dev_lock(hdev);
1629         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1630                 bacpy(&(ci + n)->bdaddr, &c->dst);
1631                 (ci + n)->handle = c->handle;
1632                 (ci + n)->type  = c->type;
1633                 (ci + n)->out   = c->out;
1634                 (ci + n)->state = c->state;
1635                 (ci + n)->link_mode = get_link_mode(c);
1636                 if (++n >= req.conn_num)
1637                         break;
1638         }
1639         hci_dev_unlock(hdev);
1640
1641         cl->dev_id = hdev->id;
1642         cl->conn_num = n;
1643         size = sizeof(req) + n * sizeof(*ci);
1644
1645         hci_dev_put(hdev);
1646
1647         err = copy_to_user(arg, cl, size);
1648         kfree(cl);
1649
1650         return err ? -EFAULT : 0;
1651 }
1652
1653 int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
1654 {
1655         struct hci_conn_info_req req;
1656         struct hci_conn_info ci;
1657         struct hci_conn *conn;
1658         char __user *ptr = arg + sizeof(req);
1659
1660         if (copy_from_user(&req, arg, sizeof(req)))
1661                 return -EFAULT;
1662
1663         hci_dev_lock(hdev);
1664         conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
1665         if (conn) {
1666                 bacpy(&ci.bdaddr, &conn->dst);
1667                 ci.handle = conn->handle;
1668                 ci.type  = conn->type;
1669                 ci.out   = conn->out;
1670                 ci.state = conn->state;
1671                 ci.link_mode = get_link_mode(conn);
1672         }
1673         hci_dev_unlock(hdev);
1674
1675         if (!conn)
1676                 return -ENOENT;
1677
1678         return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
1679 }
1680
1681 int hci_get_auth_info(struct hci_dev *hdev, void __user *arg)
1682 {
1683         struct hci_auth_info_req req;
1684         struct hci_conn *conn;
1685
1686         if (copy_from_user(&req, arg, sizeof(req)))
1687                 return -EFAULT;
1688
1689         hci_dev_lock(hdev);
1690         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr);
1691         if (conn)
1692                 req.type = conn->auth_type;
1693         hci_dev_unlock(hdev);
1694
1695         if (!conn)
1696                 return -ENOENT;
1697
1698         return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0;
1699 }
1700
1701 struct hci_chan *hci_chan_create(struct hci_conn *conn)
1702 {
1703         struct hci_dev *hdev = conn->hdev;
1704         struct hci_chan *chan;
1705
1706         BT_DBG("%s hcon %p", hdev->name, conn);
1707
1708         if (test_bit(HCI_CONN_DROP, &conn->flags)) {
1709                 BT_DBG("Refusing to create new hci_chan");
1710                 return NULL;
1711         }
1712
1713         chan = kzalloc(sizeof(*chan), GFP_KERNEL);
1714         if (!chan)
1715                 return NULL;
1716
1717         chan->conn = hci_conn_get(conn);
1718         skb_queue_head_init(&chan->data_q);
1719         chan->state = BT_CONNECTED;
1720
1721         list_add_rcu(&chan->list, &conn->chan_list);
1722
1723         return chan;
1724 }
1725
1726 void hci_chan_del(struct hci_chan *chan)
1727 {
1728         struct hci_conn *conn = chan->conn;
1729         struct hci_dev *hdev = conn->hdev;
1730
1731         BT_DBG("%s hcon %p chan %p", hdev->name, conn, chan);
1732
1733         list_del_rcu(&chan->list);
1734
1735         synchronize_rcu();
1736
1737         /* Prevent new hci_chan's to be created for this hci_conn */
1738         set_bit(HCI_CONN_DROP, &conn->flags);
1739
1740         hci_conn_put(conn);
1741
1742         skb_queue_purge(&chan->data_q);
1743         kfree(chan);
1744 }
1745
1746 void hci_chan_list_flush(struct hci_conn *conn)
1747 {
1748         struct hci_chan *chan, *n;
1749
1750         BT_DBG("hcon %p", conn);
1751
1752         list_for_each_entry_safe(chan, n, &conn->chan_list, list)
1753                 hci_chan_del(chan);
1754 }
1755
1756 static struct hci_chan *__hci_chan_lookup_handle(struct hci_conn *hcon,
1757                                                  __u16 handle)
1758 {
1759         struct hci_chan *hchan;
1760
1761         list_for_each_entry(hchan, &hcon->chan_list, list) {
1762                 if (hchan->handle == handle)
1763                         return hchan;
1764         }
1765
1766         return NULL;
1767 }
1768
1769 struct hci_chan *hci_chan_lookup_handle(struct hci_dev *hdev, __u16 handle)
1770 {
1771         struct hci_conn_hash *h = &hdev->conn_hash;
1772         struct hci_conn *hcon;
1773         struct hci_chan *hchan = NULL;
1774
1775         rcu_read_lock();
1776
1777         list_for_each_entry_rcu(hcon, &h->list, list) {
1778                 hchan = __hci_chan_lookup_handle(hcon, handle);
1779                 if (hchan)
1780                         break;
1781         }
1782
1783         rcu_read_unlock();
1784
1785         return hchan;
1786 }
1787
1788 u32 hci_conn_get_phy(struct hci_conn *conn)
1789 {
1790         u32 phys = 0;
1791
1792         hci_dev_lock(conn->hdev);
1793
1794         /* BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 2, Part B page 471:
1795          * Table 6.2: Packets defined for synchronous, asynchronous, and
1796          * CSB logical transport types.
1797          */
1798         switch (conn->type) {
1799         case SCO_LINK:
1800                 /* SCO logical transport (1 Mb/s):
1801                  * HV1, HV2, HV3 and DV.
1802                  */
1803                 phys |= BT_PHY_BR_1M_1SLOT;
1804
1805                 break;
1806
1807         case ACL_LINK:
1808                 /* ACL logical transport (1 Mb/s) ptt=0:
1809                  * DH1, DM3, DH3, DM5 and DH5.
1810                  */
1811                 phys |= BT_PHY_BR_1M_1SLOT;
1812
1813                 if (conn->pkt_type & (HCI_DM3 | HCI_DH3))
1814                         phys |= BT_PHY_BR_1M_3SLOT;
1815
1816                 if (conn->pkt_type & (HCI_DM5 | HCI_DH5))
1817                         phys |= BT_PHY_BR_1M_5SLOT;
1818
1819                 /* ACL logical transport (2 Mb/s) ptt=1:
1820                  * 2-DH1, 2-DH3 and 2-DH5.
1821                  */
1822                 if (!(conn->pkt_type & HCI_2DH1))
1823                         phys |= BT_PHY_EDR_2M_1SLOT;
1824
1825                 if (!(conn->pkt_type & HCI_2DH3))
1826                         phys |= BT_PHY_EDR_2M_3SLOT;
1827
1828                 if (!(conn->pkt_type & HCI_2DH5))
1829                         phys |= BT_PHY_EDR_2M_5SLOT;
1830
1831                 /* ACL logical transport (3 Mb/s) ptt=1:
1832                  * 3-DH1, 3-DH3 and 3-DH5.
1833                  */
1834                 if (!(conn->pkt_type & HCI_3DH1))
1835                         phys |= BT_PHY_EDR_3M_1SLOT;
1836
1837                 if (!(conn->pkt_type & HCI_3DH3))
1838                         phys |= BT_PHY_EDR_3M_3SLOT;
1839
1840                 if (!(conn->pkt_type & HCI_3DH5))
1841                         phys |= BT_PHY_EDR_3M_5SLOT;
1842
1843                 break;
1844
1845         case ESCO_LINK:
1846                 /* eSCO logical transport (1 Mb/s): EV3, EV4 and EV5 */
1847                 phys |= BT_PHY_BR_1M_1SLOT;
1848
1849                 if (!(conn->pkt_type & (ESCO_EV4 | ESCO_EV5)))
1850                         phys |= BT_PHY_BR_1M_3SLOT;
1851
1852                 /* eSCO logical transport (2 Mb/s): 2-EV3, 2-EV5 */
1853                 if (!(conn->pkt_type & ESCO_2EV3))
1854                         phys |= BT_PHY_EDR_2M_1SLOT;
1855
1856                 if (!(conn->pkt_type & ESCO_2EV5))
1857                         phys |= BT_PHY_EDR_2M_3SLOT;
1858
1859                 /* eSCO logical transport (3 Mb/s): 3-EV3, 3-EV5 */
1860                 if (!(conn->pkt_type & ESCO_3EV3))
1861                         phys |= BT_PHY_EDR_3M_1SLOT;
1862
1863                 if (!(conn->pkt_type & ESCO_3EV5))
1864                         phys |= BT_PHY_EDR_3M_3SLOT;
1865
1866                 break;
1867
1868         case LE_LINK:
1869                 if (conn->le_tx_phy & HCI_LE_SET_PHY_1M)
1870                         phys |= BT_PHY_LE_1M_TX;
1871
1872                 if (conn->le_rx_phy & HCI_LE_SET_PHY_1M)
1873                         phys |= BT_PHY_LE_1M_RX;
1874
1875                 if (conn->le_tx_phy & HCI_LE_SET_PHY_2M)
1876                         phys |= BT_PHY_LE_2M_TX;
1877
1878                 if (conn->le_rx_phy & HCI_LE_SET_PHY_2M)
1879                         phys |= BT_PHY_LE_2M_RX;
1880
1881                 if (conn->le_tx_phy & HCI_LE_SET_PHY_CODED)
1882                         phys |= BT_PHY_LE_CODED_TX;
1883
1884                 if (conn->le_rx_phy & HCI_LE_SET_PHY_CODED)
1885                         phys |= BT_PHY_LE_CODED_RX;
1886
1887                 break;
1888         }
1889
1890         hci_dev_unlock(conn->hdev);
1891
1892         return phys;
1893 }