net/bluetooth/hci_conn.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI connection handling. */
  26
  27 #include <linux/export.h>
  28 #include <linux/debugfs.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/l2cap.h>
  33
  34 #include "hci_request.h"
  35 #include "smp.h"
  36 #include "a2mp.h"
  37
  38 struct sco_param {
  39         u16 pkt_type;
  40         u16 max_latency;
  41         u8  retrans_effort;
  42 };
  43
  44 static const struct sco_param esco_param_cvsd[] = {
  45         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000a,   0x01 }, /* S3 */
  46         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x0007,   0x01 }, /* S2 */
  47         { EDR_ESCO_MASK | ESCO_EV3,   0x0007,   0x01 }, /* S1 */
  48         { EDR_ESCO_MASK | ESCO_HV3,   0xffff,   0x01 }, /* D1 */
  49         { EDR_ESCO_MASK | ESCO_HV1,   0xffff,   0x01 }, /* D0 */
  50 };
  51
  52 static const struct sco_param sco_param_cvsd[] = {
  53         { EDR_ESCO_MASK | ESCO_HV3,   0xffff,   0xff }, /* D1 */
  54         { EDR_ESCO_MASK | ESCO_HV1,   0xffff,   0xff }, /* D0 */
  55 };
  56
  57 static const struct sco_param esco_param_msbc[] = {
  58         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000d,   0x02 }, /* T2 */
  59         { EDR_ESCO_MASK | ESCO_EV3,   0x0008,   0x02 }, /* T1 */
  60 };
  61
  62 /* This function requires the caller holds hdev->lock */
  63 static void hci_connect_le_scan_cleanup(struct hci_conn *conn)
  64 {
  65         struct hci_conn_params *params;
  66         struct hci_dev *hdev = conn->hdev;
  67         struct smp_irk *irk;
  68         bdaddr_t *bdaddr;
  69         u8 bdaddr_type;
  70
  71         bdaddr = &conn->dst;
  72         bdaddr_type = conn->dst_type;
  73
  74         /* Check if we need to convert to identity address */
  75         irk = hci_get_irk(hdev, bdaddr, bdaddr_type);
  76         if (irk) {
  77                 bdaddr = &irk->bdaddr;
  78                 bdaddr_type = irk->addr_type;
  79         }
  80
  81         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, bdaddr,
  82                                            bdaddr_type);
  83         if (!params || !params->explicit_connect)
  84                 return;
  85
  86         /* The connection attempt was doing scan for new RPA, and is
  87          * in scan phase. If params are not associated with any other
  88          * autoconnect action, remove them completely. If they are, just unmark
  89          * them as waiting for connection, by clearing explicit_connect field.
  90          */
  91         params->explicit_connect = false;
  92
  93         list_del_init(&params->action);
  94
  95         switch (params->auto_connect) {
  96         case HCI_AUTO_CONN_EXPLICIT:
  97                 hci_conn_params_del(hdev, bdaddr, bdaddr_type);
  98                 /* return instead of break to avoid duplicate scan update */
  99                 return;
 100         case HCI_AUTO_CONN_DIRECT:
 101         case HCI_AUTO_CONN_ALWAYS:
 102                 list_add(&params->action, &hdev->pend_le_conns);
 103                 break;
 104         case HCI_AUTO_CONN_REPORT:
 105                 list_add(&params->action, &hdev->pend_le_reports);
 106                 break;
 107         default:
 108                 break;
 109         }
 110
 111         hci_update_background_scan(hdev);
 112 }
 113
 114 static void hci_conn_cleanup(struct hci_conn *conn)
 115 {
 116         struct hci_dev *hdev = conn->hdev;
 117
 118         if (test_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags))
 119                 hci_conn_params_del(conn->hdev, &conn->dst, conn->dst_type);
 120
 121         hci_chan_list_flush(conn);
 122
 123         hci_conn_hash_del(hdev, conn);
 124
 125         if (conn->type == SCO_LINK || conn->type == ESCO_LINK) {
 126                 switch (conn->setting & SCO_AIRMODE_MASK) {
 127                 case SCO_AIRMODE_CVSD:
 128                 case SCO_AIRMODE_TRANSP:
 129                         if (hdev->notify)
 130                                 hdev->notify(hdev, HCI_NOTIFY_DISABLE_SCO);
 131                         break;
 132                 }
 133         } else {
 134                 if (hdev->notify)
 135                         hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
 136         }
 137
 138         hci_conn_del_sysfs(conn);
 139
 140         debugfs_remove_recursive(conn->debugfs);
 141
 142         hci_dev_put(hdev);
 143
 144         hci_conn_put(conn);
 145 }
 146
 147 static void le_scan_cleanup(struct work_struct *work)
 148 {
 149         struct hci_conn *conn = container_of(work, struct hci_conn,
 150                                              le_scan_cleanup);
 151         struct hci_dev *hdev = conn->hdev;
 152         struct hci_conn *c = NULL;
 153
 154         BT_DBG("%s hcon %p", hdev->name, conn);
 155
 156         hci_dev_lock(hdev);
 157
 158         /* Check that the hci_conn is still around */
 159         rcu_read_lock();
 160         list_for_each_entry_rcu(c, &hdev->conn_hash.list, list) {
 161                 if (c == conn)
 162                         break;
 163         }
 164         rcu_read_unlock();
 165
 166         if (c == conn) {
 167                 hci_connect_le_scan_cleanup(conn);
 168                 hci_conn_cleanup(conn);
 169         }
 170
 171         hci_dev_unlock(hdev);
 172         hci_dev_put(hdev);
 173         hci_conn_put(conn);
 174 }
 175
 176 static void hci_connect_le_scan_remove(struct hci_conn *conn)
 177 {
 178         BT_DBG("%s hcon %p", conn->hdev->name, conn);
 179
 180         /* We can't call hci_conn_del/hci_conn_cleanup here since that
 181          * could deadlock with another hci_conn_del() call that's holding
 182          * hci_dev_lock and doing cancel_delayed_work_sync(&conn->disc_work).
 183          * Instead, grab temporary extra references to the hci_dev and
 184          * hci_conn and perform the necessary cleanup in a separate work
 185          * callback.
 186          */
 187
 188         hci_dev_hold(conn->hdev);
 189         hci_conn_get(conn);
 190
 191         /* Even though we hold a reference to the hdev, many other
 192          * things might get cleaned up meanwhile, including the hdev's
 193          * own workqueue, so we can't use that for scheduling.
 194          */
 195         schedule_work(&conn->le_scan_cleanup);
 196 }
 197
 198 static void hci_acl_create_connection(struct hci_conn *conn)
 199 {
 200         struct hci_dev *hdev = conn->hdev;
 201         struct inquiry_entry *ie;
 202         struct hci_cp_create_conn cp;
 203
 204         BT_DBG("hcon %p", conn);
 205
 206         conn->state = BT_CONNECT;
 207         conn->out = true;
 208         conn->role = HCI_ROLE_MASTER;
 209
 210         conn->attempt++;
 211
 212         conn->link_policy = hdev->link_policy;
 213
 214         memset(&cp, 0, sizeof(cp));
 215         bacpy(&cp.bdaddr, &conn->dst);
 216         cp.pscan_rep_mode = 0x02;
 217
 218         ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
 219         if (ie) {
 220                 if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
 221                         cp.pscan_rep_mode = ie->data.pscan_rep_mode;
 222                         cp.pscan_mode     = ie->data.pscan_mode;
 223                         cp.clock_offset   = ie->data.clock_offset |
 224                                             cpu_to_le16(0x8000);
 225                 }
 226
 227                 memcpy(conn->dev_class, ie->data.dev_class, 3);
 228         }
 229
 230         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 231         if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
 232                 cp.role_switch = 0x01;
 233         else
 234                 cp.role_switch = 0x00;
 235
 236         hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
 237 }
 238
 239 int hci_disconnect(struct hci_conn *conn, __u8 reason)
 240 {
 241         BT_DBG("hcon %p", conn);
 242
 243         /* When we are master of an established connection and it enters
 244          * the disconnect timeout, then go ahead and try to read the
 245          * current clock offset.  Processing of the result is done
 246          * within the event handling and hci_clock_offset_evt function.
 247          */
 248         if (conn->type == ACL_LINK && conn->role == HCI_ROLE_MASTER &&
 249             (conn->state == BT_CONNECTED || conn->state == BT_CONFIG)) {
 250                 struct hci_dev *hdev = conn->hdev;
 251                 struct hci_cp_read_clock_offset clkoff_cp;
 252
 253                 clkoff_cp.handle = cpu_to_le16(conn->handle);
 254                 hci_send_cmd(hdev, HCI_OP_READ_CLOCK_OFFSET, sizeof(clkoff_cp),
 255                              &clkoff_cp);
 256         }
 257
 258         return hci_abort_conn(conn, reason);
 259 }
 260
 261 static void hci_add_sco(struct hci_conn *conn, __u16 handle)
 262 {
 263         struct hci_dev *hdev = conn->hdev;
 264         struct hci_cp_add_sco cp;
 265
 266         BT_DBG("hcon %p", conn);
 267
 268         conn->state = BT_CONNECT;
 269         conn->out = true;
 270
 271         conn->attempt++;
 272
 273         cp.handle   = cpu_to_le16(handle);
 274         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 275
 276         hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
 277 }
 278
 279 bool hci_setup_sync(struct hci_conn *conn, __u16 handle)
 280 {
 281         struct hci_dev *hdev = conn->hdev;
 282         struct hci_cp_setup_sync_conn cp;
 283         const struct sco_param *param;
 284
 285         BT_DBG("hcon %p", conn);
 286
 287         conn->state = BT_CONNECT;
 288         conn->out = true;
 289
 290         conn->attempt++;
 291
 292         cp.handle   = cpu_to_le16(handle);
 293
 294         cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
 295         cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
 296         cp.voice_setting  = cpu_to_le16(conn->setting);
 297
 298         switch (conn->setting & SCO_AIRMODE_MASK) {
 299         case SCO_AIRMODE_TRANSP:
 300                 if (conn->attempt > ARRAY_SIZE(esco_param_msbc))
 301                         return false;
 302                 param = &esco_param_msbc[conn->attempt - 1];
 303                 break;
 304         case SCO_AIRMODE_CVSD:
 305                 if (lmp_esco_capable(conn->link)) {
 306                         if (conn->attempt > ARRAY_SIZE(esco_param_cvsd))
 307                                 return false;
 308                         param = &esco_param_cvsd[conn->attempt - 1];
 309                 } else {
 310                         if (conn->attempt > ARRAY_SIZE(sco_param_cvsd))
 311                                 return false;
 312                         param = &sco_param_cvsd[conn->attempt - 1];
 313                 }
 314                 break;
 315         default:
 316                 return false;
 317         }
 318
 319         cp.retrans_effort = param->retrans_effort;
 320         cp.pkt_type = __cpu_to_le16(param->pkt_type);
 321         cp.max_latency = __cpu_to_le16(param->max_latency);
 322
 323         if (hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp) < 0)
 324                 return false;
 325
 326         return true;
 327 }
 328
 329 u8 hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max, u16 latency,
 330                       u16 to_multiplier)
 331 {
 332         struct hci_dev *hdev = conn->hdev;
 333         struct hci_conn_params *params;
 334         struct hci_cp_le_conn_update cp;
 335
 336         hci_dev_lock(hdev);
 337
 338         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
 339         if (params) {
 340                 params->conn_min_interval = min;
 341                 params->conn_max_interval = max;
 342                 params->conn_latency = latency;
 343                 params->supervision_timeout = to_multiplier;
 344         }
 345
 346         hci_dev_unlock(hdev);
 347
 348         memset(&cp, 0, sizeof(cp));
 349         cp.handle               = cpu_to_le16(conn->handle);
 350         cp.conn_interval_min    = cpu_to_le16(min);
 351         cp.conn_interval_max    = cpu_to_le16(max);
 352         cp.conn_latency         = cpu_to_le16(latency);
 353         cp.supervision_timeout  = cpu_to_le16(to_multiplier);
 354         cp.min_ce_len           = cpu_to_le16(0x0000);
 355         cp.max_ce_len           = cpu_to_le16(0x0000);
 356
 357         hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp);
 358
 359         if (params)
 360                 return 0x01;
 361
 362         return 0x00;
 363 }
 364
 365 void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __le64 rand,
 366                       __u8 ltk[16], __u8 key_size)
 367 {
 368         struct hci_dev *hdev = conn->hdev;
 369         struct hci_cp_le_start_enc cp;
 370
 371         BT_DBG("hcon %p", conn);
 372
 373         memset(&cp, 0, sizeof(cp));
 374
 375         cp.handle = cpu_to_le16(conn->handle);
 376         cp.rand = rand;
 377         cp.ediv = ediv;
 378         memcpy(cp.ltk, ltk, key_size);
 379
 380         hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp);
 381 }
 382
 383 /* Device _must_ be locked */
 384 void hci_sco_setup(struct hci_conn *conn, __u8 status)
 385 {
 386         struct hci_conn *sco = conn->link;
 387
 388         if (!sco)
 389                 return;
 390
 391         BT_DBG("hcon %p", conn);
 392
 393         if (!status) {
 394                 if (lmp_esco_capable(conn->hdev))
 395                         hci_setup_sync(sco, conn->handle);
 396                 else
 397                         hci_add_sco(sco, conn->handle);
 398         } else {
 399                 hci_connect_cfm(sco, status);
 400                 hci_conn_del(sco);
 401         }
 402 }
 403
 404 static void hci_conn_timeout(struct work_struct *work)
 405 {
 406         struct hci_conn *conn = container_of(work, struct hci_conn,
 407                                              disc_work.work);
 408         int refcnt = atomic_read(&conn->refcnt);
 409
 410         BT_DBG("hcon %p state %s", conn, state_to_string(conn->state));
 411
 412         WARN_ON(refcnt < 0);
 413
 414         /* FIXME: It was observed that in pairing failed scenario, refcnt
 415          * drops below 0. Probably this is because l2cap_conn_del calls
 416          * l2cap_chan_del for each channel, and inside l2cap_chan_del conn is
 417          * dropped. After that loop hci_chan_del is called which also drops
 418          * conn. For now make sure that ACL is alive if refcnt is higher then 0,
 419          * otherwise drop it.
 420          */
 421         if (refcnt > 0)
 422                 return;
 423
 424         /* LE connections in scanning state need special handling */
 425         if (conn->state == BT_CONNECT && conn->type == LE_LINK &&
 426             test_bit(HCI_CONN_SCANNING, &conn->flags)) {
 427                 hci_connect_le_scan_remove(conn);
 428                 return;
 429         }
 430
 431         hci_abort_conn(conn, hci_proto_disconn_ind(conn));
 432 }
 433
 434 /* Enter sniff mode */
 435 static void hci_conn_idle(struct work_struct *work)
 436 {
 437         struct hci_conn *conn = container_of(work, struct hci_conn,
 438                                              idle_work.work);
 439         struct hci_dev *hdev = conn->hdev;
 440
 441         BT_DBG("hcon %p mode %d", conn, conn->mode);
 442
 443         if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn))
 444                 return;
 445
 446         if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF))
 447                 return;
 448
 449         if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
 450                 struct hci_cp_sniff_subrate cp;
 451                 cp.handle             = cpu_to_le16(conn->handle);
 452                 cp.max_latency        = cpu_to_le16(0);
 453                 cp.min_remote_timeout = cpu_to_le16(0);
 454                 cp.min_local_timeout  = cpu_to_le16(0);
 455                 hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
 456         }
 457
 458         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
 459                 struct hci_cp_sniff_mode cp;
 460                 cp.handle       = cpu_to_le16(conn->handle);
 461                 cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
 462                 cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
 463                 cp.attempt      = cpu_to_le16(4);
 464                 cp.timeout      = cpu_to_le16(1);
 465                 hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
 466         }
 467 }
 468
 469 static void hci_conn_auto_accept(struct work_struct *work)
 470 {
 471         struct hci_conn *conn = container_of(work, struct hci_conn,
 472                                              auto_accept_work.work);
 473
 474         hci_send_cmd(conn->hdev, HCI_OP_USER_CONFIRM_REPLY, sizeof(conn->dst),
 475                      &conn->dst);
 476 }
 477
 478 static void le_disable_advertising(struct hci_dev *hdev)
 479 {
 480         if (ext_adv_capable(hdev)) {
 481                 struct hci_cp_le_set_ext_adv_enable cp;
 482
 483                 cp.enable = 0x00;
 484                 cp.num_of_sets = 0x00;
 485
 486                 hci_send_cmd(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE, sizeof(cp),
 487                              &cp);
 488         } else {
 489                 u8 enable = 0x00;
 490                 hci_send_cmd(hdev, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable),
 491                              &enable);
 492         }
 493 }
 494
 495 static void le_conn_timeout(struct work_struct *work)
 496 {
 497         struct hci_conn *conn = container_of(work, struct hci_conn,
 498                                              le_conn_timeout.work);
 499         struct hci_dev *hdev = conn->hdev;
 500
 501         BT_DBG("");
 502
 503         /* We could end up here due to having done directed advertising,
 504          * so clean up the state if necessary. This should however only
 505          * happen with broken hardware or if low duty cycle was used
 506          * (which doesn't have a timeout of its own).
 507          */
 508         if (conn->role == HCI_ROLE_SLAVE) {
 509                 /* Disable LE Advertising */
 510                 le_disable_advertising(hdev);
 511                 hci_le_conn_failed(conn, HCI_ERROR_ADVERTISING_TIMEOUT);
 512                 return;
 513         }
 514
 515         hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
 516 }
 517
 518 struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst,
 519                               u8 role)
 520 {
 521         struct hci_conn *conn;
 522
 523         BT_DBG("%s dst %pMR", hdev->name, dst);
 524
 525         conn = kzalloc(sizeof(*conn), GFP_KERNEL);
 526         if (!conn)
 527                 return NULL;
 528
 529         bacpy(&conn->dst, dst);
 530         bacpy(&conn->src, &hdev->bdaddr);
 531         conn->hdev  = hdev;
 532         conn->type  = type;
 533         conn->role  = role;
 534         conn->mode  = HCI_CM_ACTIVE;
 535         conn->state = BT_OPEN;
 536         conn->auth_type = HCI_AT_GENERAL_BONDING;
 537         conn->io_capability = hdev->io_capability;
 538         conn->remote_auth = 0xff;
 539         conn->key_type = 0xff;
 540         conn->rssi = HCI_RSSI_INVALID;
 541         conn->tx_power = HCI_TX_POWER_INVALID;
 542         conn->max_tx_power = HCI_TX_POWER_INVALID;
 543
 544         set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
 545         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
 546
 547         /* Set Default Authenticated payload timeout to 30s */
 548         conn->auth_payload_timeout = DEFAULT_AUTH_PAYLOAD_TIMEOUT;
 549
 550         if (conn->role == HCI_ROLE_MASTER)
 551                 conn->out = true;
 552
 553         switch (type) {
 554         case ACL_LINK:
 555                 conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
 556                 break;
 557         case LE_LINK:
 558                 /* conn->src should reflect the local identity address */
 559                 hci_copy_identity_address(hdev, &conn->src, &conn->src_type);
 560                 break;
 561         case SCO_LINK:
 562                 if (lmp_esco_capable(hdev))
 563                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
 564                                         (hdev->esco_type & EDR_ESCO_MASK);
 565                 else
 566                         conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
 567                 break;
 568         case ESCO_LINK:
 569                 conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
 570                 break;
 571         }
 572
 573         skb_queue_head_init(&conn->data_q);
 574
 575         INIT_LIST_HEAD(&conn->chan_list);
 576
 577         INIT_DELAYED_WORK(&conn->disc_work, hci_conn_timeout);
 578         INIT_DELAYED_WORK(&conn->auto_accept_work, hci_conn_auto_accept);
 579         INIT_DELAYED_WORK(&conn->idle_work, hci_conn_idle);
 580         INIT_DELAYED_WORK(&conn->le_conn_timeout, le_conn_timeout);
 581         INIT_WORK(&conn->le_scan_cleanup, le_scan_cleanup);
 582
 583         atomic_set(&conn->refcnt, 0);
 584
 585         hci_dev_hold(hdev);
 586
 587         hci_conn_hash_add(hdev, conn);
 588
 589         /* The SCO and eSCO connections will only be notified when their
 590          * setup has been completed. This is different to ACL links which
 591          * can be notified right away.
 592          */
 593         if (conn->type != SCO_LINK && conn->type != ESCO_LINK) {
 594                 if (hdev->notify)
 595                         hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
 596         }
 597
 598         hci_conn_init_sysfs(conn);
 599
 600         return conn;
 601 }
 602
 603 int hci_conn_del(struct hci_conn *conn)
 604 {
 605         struct hci_dev *hdev = conn->hdev;
 606
 607         BT_DBG("%s hcon %p handle %d", hdev->name, conn, conn->handle);
 608
 609         cancel_delayed_work_sync(&conn->disc_work);
 610         cancel_delayed_work_sync(&conn->auto_accept_work);
 611         cancel_delayed_work_sync(&conn->idle_work);
 612
 613         if (conn->type == ACL_LINK) {
 614                 struct hci_conn *sco = conn->link;
 615                 if (sco)
 616                         sco->link = NULL;
 617
 618                 /* Unacked frames */
 619                 hdev->acl_cnt += conn->sent;
 620         } else if (conn->type == LE_LINK) {
 621                 cancel_delayed_work(&conn->le_conn_timeout);
 622
 623                 if (hdev->le_pkts)
 624                         hdev->le_cnt += conn->sent;
 625                 else
 626                         hdev->acl_cnt += conn->sent;
 627         } else {
 628                 struct hci_conn *acl = conn->link;
 629                 if (acl) {
 630                         acl->link = NULL;
 631                         hci_conn_drop(acl);
 632                 }
 633         }
 634
 635         if (conn->amp_mgr)
 636                 amp_mgr_put(conn->amp_mgr);
 637
 638         skb_queue_purge(&conn->data_q);
 639
 640         /* Remove the connection from the list and cleanup its remaining
 641          * state. This is a separate function since for some cases like
 642          * BT_CONNECT_SCAN we *only* want the cleanup part without the
 643          * rest of hci_conn_del.
 644          */
 645         hci_conn_cleanup(conn);
 646
 647         return 0;
 648 }
 649
 650 struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src, uint8_t src_type)
 651 {
 652         int use_src = bacmp(src, BDADDR_ANY);
 653         struct hci_dev *hdev = NULL, *d;
 654
 655         BT_DBG("%pMR -> %pMR", src, dst);
 656
 657         read_lock(&hci_dev_list_lock);
 658
 659         list_for_each_entry(d, &hci_dev_list, list) {
 660                 if (!test_bit(HCI_UP, &d->flags) ||
 661                     hci_dev_test_flag(d, HCI_USER_CHANNEL) ||
 662                     d->dev_type != HCI_PRIMARY)
 663                         continue;
 664
 665                 /* Simple routing:
 666                  *   No source address - find interface with bdaddr != dst
 667                  *   Source address    - find interface with bdaddr == src
 668                  */
 669
 670                 if (use_src) {
 671                         bdaddr_t id_addr;
 672                         u8 id_addr_type;
 673
 674                         if (src_type == BDADDR_BREDR) {
 675                                 if (!lmp_bredr_capable(d))
 676                                         continue;
 677                                 bacpy(&id_addr, &d->bdaddr);
 678                                 id_addr_type = BDADDR_BREDR;
 679                         } else {
 680                                 if (!lmp_le_capable(d))
 681                                         continue;
 682
 683                                 hci_copy_identity_address(d, &id_addr,
 684                                                           &id_addr_type);
 685
 686                                 /* Convert from HCI to three-value type */
 687                                 if (id_addr_type == ADDR_LE_DEV_PUBLIC)
 688                                         id_addr_type = BDADDR_LE_PUBLIC;
 689                                 else
 690                                         id_addr_type = BDADDR_LE_RANDOM;
 691                         }
 692
 693                         if (!bacmp(&id_addr, src) && id_addr_type == src_type) {
 694                                 hdev = d; break;
 695                         }
 696                 } else {
 697                         if (bacmp(&d->bdaddr, dst)) {
 698                                 hdev = d; break;
 699                         }
 700                 }
 701         }
 702
 703         if (hdev)
 704                 hdev = hci_dev_hold(hdev);
 705
 706         read_unlock(&hci_dev_list_lock);
 707         return hdev;
 708 }
 709 EXPORT_SYMBOL(hci_get_route);
 710
 711 /* This function requires the caller holds hdev->lock */
 712 void hci_le_conn_failed(struct hci_conn *conn, u8 status)
 713 {
 714         struct hci_dev *hdev = conn->hdev;
 715         struct hci_conn_params *params;
 716
 717         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
 718                                            conn->dst_type);
 719         if (params && params->conn) {
 720                 hci_conn_drop(params->conn);
 721                 hci_conn_put(params->conn);
 722                 params->conn = NULL;
 723         }
 724
 725         conn->state = BT_CLOSED;
 726
 727         /* If the status indicates successful cancellation of
 728          * the attempt (i.e. Unkown Connection Id) there's no point of
 729          * notifying failure since we'll go back to keep trying to
 730          * connect. The only exception is explicit connect requests
 731          * where a timeout + cancel does indicate an actual failure.
 732          */
 733         if (status != HCI_ERROR_UNKNOWN_CONN_ID ||
 734             (params && params->explicit_connect))
 735                 mgmt_connect_failed(hdev, &conn->dst, conn->type,
 736                                     conn->dst_type, status);
 737
 738         hci_connect_cfm(conn, status);
 739
 740         hci_conn_del(conn);
 741
 742         /* Since we may have temporarily stopped the background scanning in
 743          * favor of connection establishment, we should restart it.
 744          */
 745         hci_update_background_scan(hdev);
 746
 747         /* Re-enable advertising in case this was a failed connection
 748          * attempt as a peripheral.
 749          */
 750         hci_req_reenable_advertising(hdev);
 751 }
 752
 753 static void create_le_conn_complete(struct hci_dev *hdev, u8 status, u16 opcode)
 754 {
 755         struct hci_conn *conn;
 756
 757         hci_dev_lock(hdev);
 758
 759         conn = hci_lookup_le_connect(hdev);
 760
 761         if (hdev->adv_instance_cnt)
 762                 hci_req_resume_adv_instances(hdev);
 763
 764         if (!status) {
 765                 hci_connect_le_scan_cleanup(conn);
 766                 goto done;
 767         }
 768
 769         bt_dev_err(hdev, "request failed to create LE connection: "
 770                    "status 0x%2.2x", status);
 771
 772         if (!conn)
 773                 goto done;
 774
 775         hci_le_conn_failed(conn, status);
 776
 777 done:
 778         hci_dev_unlock(hdev);
 779 }
 780
 781 static bool conn_use_rpa(struct hci_conn *conn)
 782 {
 783         struct hci_dev *hdev = conn->hdev;
 784
 785         return hci_dev_test_flag(hdev, HCI_PRIVACY);
 786 }
 787
 788 static void set_ext_conn_params(struct hci_conn *conn,
 789                                 struct hci_cp_le_ext_conn_param *p)
 790 {
 791         struct hci_dev *hdev = conn->hdev;
 792
 793         memset(p, 0, sizeof(*p));
 794
 795         p->scan_interval = cpu_to_le16(hdev->le_scan_int_connect);
 796         p->scan_window = cpu_to_le16(hdev->le_scan_window_connect);
 797         p->conn_interval_min = cpu_to_le16(conn->le_conn_min_interval);
 798         p->conn_interval_max = cpu_to_le16(conn->le_conn_max_interval);
 799         p->conn_latency = cpu_to_le16(conn->le_conn_latency);
 800         p->supervision_timeout = cpu_to_le16(conn->le_supv_timeout);
 801         p->min_ce_len = cpu_to_le16(0x0000);
 802         p->max_ce_len = cpu_to_le16(0x0000);
 803 }
 804
 805 static void hci_req_add_le_create_conn(struct hci_request *req,
 806                                        struct hci_conn *conn,
 807                                        bdaddr_t *direct_rpa)
 808 {
 809         struct hci_dev *hdev = conn->hdev;
 810         u8 own_addr_type;
 811
 812         /* If direct address was provided we use it instead of current
 813          * address.
 814          */
 815         if (direct_rpa) {
 816                 if (bacmp(&req->hdev->random_addr, direct_rpa))
 817                         hci_req_add(req, HCI_OP_LE_SET_RANDOM_ADDR, 6,
 818                                                                 direct_rpa);
 819
 820                 /* direct address is always RPA */
 821                 own_addr_type = ADDR_LE_DEV_RANDOM;
 822         } else {
 823                 /* Update random address, but set require_privacy to false so
 824                  * that we never connect with an non-resolvable address.
 825                  */
 826                 if (hci_update_random_address(req, false, conn_use_rpa(conn),
 827                                               &own_addr_type))
 828                         return;
 829         }
 830
 831         if (use_ext_conn(hdev)) {
 832                 struct hci_cp_le_ext_create_conn *cp;
 833                 struct hci_cp_le_ext_conn_param *p;
 834                 u8 data[sizeof(*cp) + sizeof(*p) * 3];
 835                 u32 plen;
 836
 837                 cp = (void *) data;
 838                 p = (void *) cp->data;
 839
 840                 memset(cp, 0, sizeof(*cp));
 841
 842                 bacpy(&cp->peer_addr, &conn->dst);
 843                 cp->peer_addr_type = conn->dst_type;
 844                 cp->own_addr_type = own_addr_type;
 845
 846                 plen = sizeof(*cp);
 847
 848                 if (scan_1m(hdev)) {
 849                         cp->phys |= LE_SCAN_PHY_1M;
 850                         set_ext_conn_params(conn, p);
 851
 852                         p++;
 853                         plen += sizeof(*p);
 854                 }
 855
 856                 if (scan_2m(hdev)) {
 857                         cp->phys |= LE_SCAN_PHY_2M;
 858                         set_ext_conn_params(conn, p);
 859
 860                         p++;
 861                         plen += sizeof(*p);
 862                 }
 863
 864                 if (scan_coded(hdev)) {
 865                         cp->phys |= LE_SCAN_PHY_CODED;
 866                         set_ext_conn_params(conn, p);
 867
 868                         plen += sizeof(*p);
 869                 }
 870
 871                 hci_req_add(req, HCI_OP_LE_EXT_CREATE_CONN, plen, data);
 872
 873         } else {
 874                 struct hci_cp_le_create_conn cp;
 875
 876                 memset(&cp, 0, sizeof(cp));
 877
 878                 cp.scan_interval = cpu_to_le16(hdev->le_scan_int_connect);
 879                 cp.scan_window = cpu_to_le16(hdev->le_scan_window_connect);
 880
 881                 bacpy(&cp.peer_addr, &conn->dst);
 882                 cp.peer_addr_type = conn->dst_type;
 883                 cp.own_address_type = own_addr_type;
 884                 cp.conn_interval_min = cpu_to_le16(conn->le_conn_min_interval);
 885                 cp.conn_interval_max = cpu_to_le16(conn->le_conn_max_interval);
 886                 cp.conn_latency = cpu_to_le16(conn->le_conn_latency);
 887                 cp.supervision_timeout = cpu_to_le16(conn->le_supv_timeout);
 888                 cp.min_ce_len = cpu_to_le16(0x0000);
 889                 cp.max_ce_len = cpu_to_le16(0x0000);
 890
 891                 hci_req_add(req, HCI_OP_LE_CREATE_CONN, sizeof(cp), &cp);
 892         }
 893
 894         conn->state = BT_CONNECT;
 895         clear_bit(HCI_CONN_SCANNING, &conn->flags);
 896 }
 897
 898 static void hci_req_directed_advertising(struct hci_request *req,
 899                                          struct hci_conn *conn)
 900 {
 901         struct hci_dev *hdev = req->hdev;
 902         u8 own_addr_type;
 903         u8 enable;
 904
 905         if (ext_adv_capable(hdev)) {
 906                 struct hci_cp_le_set_ext_adv_params cp;
 907                 bdaddr_t random_addr;
 908
 909                 /* Set require_privacy to false so that the remote device has a
 910                  * chance of identifying us.
 911                  */
 912                 if (hci_get_random_address(hdev, false, conn_use_rpa(conn), NULL,
 913                                            &own_addr_type, &random_addr) < 0)
 914                         return;
 915
 916                 memset(&cp, 0, sizeof(cp));
 917
 918                 cp.evt_properties = cpu_to_le16(LE_LEGACY_ADV_DIRECT_IND);
 919                 cp.own_addr_type = own_addr_type;
 920                 cp.channel_map = hdev->le_adv_channel_map;
 921                 cp.tx_power = HCI_TX_POWER_INVALID;
 922                 cp.primary_phy = HCI_ADV_PHY_1M;
 923                 cp.secondary_phy = HCI_ADV_PHY_1M;
 924                 cp.handle = 0; /* Use instance 0 for directed adv */
 925                 cp.own_addr_type = own_addr_type;
 926                 cp.peer_addr_type = conn->dst_type;
 927                 bacpy(&cp.peer_addr, &conn->dst);
 928
 929                 /* As per Core Spec 5.2 Vol 2, PART E, Sec 7.8.53, for
 930                  * advertising_event_property LE_LEGACY_ADV_DIRECT_IND
 931                  * does not supports advertising data when the advertising set already
 932                  * contains some, the controller shall return erroc code 'Invalid
 933                  * HCI Command Parameters(0x12).
 934                  * So it is required to remove adv set for handle 0x00. since we use
 935                  * instance 0 for directed adv.
 936                  */
 937                 __hci_req_remove_ext_adv_instance(req, cp.handle);
 938
 939                 hci_req_add(req, HCI_OP_LE_SET_EXT_ADV_PARAMS, sizeof(cp), &cp);
 940
 941                 if (own_addr_type == ADDR_LE_DEV_RANDOM &&
 942                     bacmp(&random_addr, BDADDR_ANY) &&
 943                     bacmp(&random_addr, &hdev->random_addr)) {
 944                         struct hci_cp_le_set_adv_set_rand_addr cp;
 945
 946                         memset(&cp, 0, sizeof(cp));
 947
 948                         cp.handle = 0;
 949                         bacpy(&cp.bdaddr, &random_addr);
 950
 951                         hci_req_add(req,
 952                                     HCI_OP_LE_SET_ADV_SET_RAND_ADDR,
 953                                     sizeof(cp), &cp);
 954                 }
 955
 956                 __hci_req_enable_ext_advertising(req, 0x00);
 957         } else {
 958                 struct hci_cp_le_set_adv_param cp;
 959
 960                 /* Clear the HCI_LE_ADV bit temporarily so that the
 961                  * hci_update_random_address knows that it's safe to go ahead
 962                  * and write a new random address. The flag will be set back on
 963                  * as soon as the SET_ADV_ENABLE HCI command completes.
 964                  */
 965                 hci_dev_clear_flag(hdev, HCI_LE_ADV);
 966
 967                 /* Set require_privacy to false so that the remote device has a
 968                  * chance of identifying us.
 969                  */
 970                 if (hci_update_random_address(req, false, conn_use_rpa(conn),
 971                                               &own_addr_type) < 0)
 972                         return;
 973
 974                 memset(&cp, 0, sizeof(cp));
 975
 976                 /* Some controllers might reject command if intervals are not
 977                  * within range for undirected advertising.
 978                  * BCM20702A0 is known to be affected by this.
 979                  */
 980                 cp.min_interval = cpu_to_le16(0x0020);
 981                 cp.max_interval = cpu_to_le16(0x0020);
 982
 983                 cp.type = LE_ADV_DIRECT_IND;
 984                 cp.own_address_type = own_addr_type;
 985                 cp.direct_addr_type = conn->dst_type;
 986                 bacpy(&cp.direct_addr, &conn->dst);
 987                 cp.channel_map = hdev->le_adv_channel_map;
 988
 989                 hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
 990
 991                 enable = 0x01;
 992                 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable),
 993                             &enable);
 994         }
 995
 996         conn->state = BT_CONNECT;
 997 }
 998
 999 struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,
1000                                 u8 dst_type, u8 sec_level, u16 conn_timeout,
1001                                 u8 role, bdaddr_t *direct_rpa)
1002 {
1003         struct hci_conn_params *params;
1004         struct hci_conn *conn;
1005         struct smp_irk *irk;
1006         struct hci_request req;
1007         int err;
1008
1009         /* This ensures that during disable le_scan address resolution
1010          * will not be disabled if it is followed by le_create_conn
1011          */
1012         bool rpa_le_conn = true;
1013
1014         /* Let's make sure that le is enabled.*/
1015         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1016                 if (lmp_le_capable(hdev))
1017                         return ERR_PTR(-ECONNREFUSED);
1018
1019                 return ERR_PTR(-EOPNOTSUPP);
1020         }
1021
1022         /* Since the controller supports only one LE connection attempt at a
1023          * time, we return -EBUSY if there is any connection attempt running.
1024          */
1025         if (hci_lookup_le_connect(hdev))
1026                 return ERR_PTR(-EBUSY);
1027
1028         /* If there's already a connection object but it's not in
1029          * scanning state it means it must already be established, in
1030          * which case we can't do anything else except report a failure
1031          * to connect.
1032          */
1033         conn = hci_conn_hash_lookup_le(hdev, dst, dst_type);
1034         if (conn && !test_bit(HCI_CONN_SCANNING, &conn->flags)) {
1035                 return ERR_PTR(-EBUSY);
1036         }
1037
1038         /* When given an identity address with existing identity
1039          * resolving key, the connection needs to be established
1040          * to a resolvable random address.
1041          *
1042          * Storing the resolvable random address is required here
1043          * to handle connection failures. The address will later
1044          * be resolved back into the original identity address
1045          * from the connect request.
1046          */
1047         irk = hci_find_irk_by_addr(hdev, dst, dst_type);
1048         if (irk && bacmp(&irk->rpa, BDADDR_ANY)) {
1049                 dst = &irk->rpa;
1050                 dst_type = ADDR_LE_DEV_RANDOM;
1051         }
1052
1053         if (conn) {
1054                 bacpy(&conn->dst, dst);
1055         } else {
1056                 conn = hci_conn_add(hdev, LE_LINK, dst, role);
1057                 if (!conn)
1058                         return ERR_PTR(-ENOMEM);
1059                 hci_conn_hold(conn);
1060                 conn->pending_sec_level = sec_level;
1061         }
1062
1063         conn->dst_type = dst_type;
1064         conn->sec_level = BT_SECURITY_LOW;
1065         conn->conn_timeout = conn_timeout;
1066
1067         hci_req_init(&req, hdev);
1068
1069         /* Disable advertising if we're active. For master role
1070          * connections most controllers will refuse to connect if
1071          * advertising is enabled, and for slave role connections we
1072          * anyway have to disable it in order to start directed
1073          * advertising. Any registered advertisements will be
1074          * re-enabled after the connection attempt is finished.
1075          */
1076         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1077                 __hci_req_pause_adv_instances(&req);
1078
1079         /* If requested to connect as slave use directed advertising */
1080         if (conn->role == HCI_ROLE_SLAVE) {
1081                 /* If we're active scanning most controllers are unable
1082                  * to initiate advertising. Simply reject the attempt.
1083                  */
1084                 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
1085                     hdev->le_scan_type == LE_SCAN_ACTIVE) {
1086                         hci_req_purge(&req);
1087                         hci_conn_del(conn);
1088                         return ERR_PTR(-EBUSY);
1089                 }
1090
1091                 hci_req_directed_advertising(&req, conn);
1092                 goto create_conn;
1093         }
1094
1095         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
1096         if (params) {
1097                 conn->le_conn_min_interval = params->conn_min_interval;
1098                 conn->le_conn_max_interval = params->conn_max_interval;
1099                 conn->le_conn_latency = params->conn_latency;
1100                 conn->le_supv_timeout = params->supervision_timeout;
1101         } else {
1102                 conn->le_conn_min_interval = hdev->le_conn_min_interval;
1103                 conn->le_conn_max_interval = hdev->le_conn_max_interval;
1104                 conn->le_conn_latency = hdev->le_conn_latency;
1105                 conn->le_supv_timeout = hdev->le_supv_timeout;
1106         }
1107
1108         /* If controller is scanning, we stop it since some controllers are
1109          * not able to scan and connect at the same time. Also set the
1110          * HCI_LE_SCAN_INTERRUPTED flag so that the command complete
1111          * handler for scan disabling knows to set the correct discovery
1112          * state.
1113          */
1114         if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
1115                 hci_req_add_le_scan_disable(&req, rpa_le_conn);
1116                 hci_dev_set_flag(hdev, HCI_LE_SCAN_INTERRUPTED);
1117         }
1118
1119         hci_req_add_le_create_conn(&req, conn, direct_rpa);
1120
1121 create_conn:
1122         err = hci_req_run(&req, create_le_conn_complete);
1123         if (err) {
1124                 hci_conn_del(conn);
1125
1126                 if (hdev->adv_instance_cnt)
1127                         hci_req_resume_adv_instances(hdev);
1128
1129                 return ERR_PTR(err);
1130         }
1131
1132         return conn;
1133 }
1134
1135 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
1136 {
1137         struct hci_conn *conn;
1138
1139         conn = hci_conn_hash_lookup_le(hdev, addr, type);
1140         if (!conn)
1141                 return false;
1142
1143         if (conn->state != BT_CONNECTED)
1144                 return false;
1145
1146         return true;
1147 }
1148
1149 /* This function requires the caller holds hdev->lock */
1150 static int hci_explicit_conn_params_set(struct hci_dev *hdev,
1151                                         bdaddr_t *addr, u8 addr_type)
1152 {
1153         struct hci_conn_params *params;
1154
1155         if (is_connected(hdev, addr, addr_type))
1156                 return -EISCONN;
1157
1158         params = hci_conn_params_lookup(hdev, addr, addr_type);
1159         if (!params) {
1160                 params = hci_conn_params_add(hdev, addr, addr_type);
1161                 if (!params)
1162                         return -ENOMEM;
1163
1164                 /* If we created new params, mark them to be deleted in
1165                  * hci_connect_le_scan_cleanup. It's different case than
1166                  * existing disabled params, those will stay after cleanup.
1167                  */
1168                 params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
1169         }
1170
1171         /* We're trying to connect, so make sure params are at pend_le_conns */
1172         if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
1173             params->auto_connect == HCI_AUTO_CONN_REPORT ||
1174             params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
1175                 list_del_init(&params->action);
1176                 list_add(&params->action, &hdev->pend_le_conns);
1177         }
1178
1179         params->explicit_connect = true;
1180
1181         BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
1182                params->auto_connect);
1183
1184         return 0;
1185 }
1186
1187 /* This function requires the caller holds hdev->lock */
1188 struct hci_conn *hci_connect_le_scan(struct hci_dev *hdev, bdaddr_t *dst,
1189                                      u8 dst_type, u8 sec_level,
1190                                      u16 conn_timeout,
1191                                      enum conn_reasons conn_reason)
1192 {
1193         struct hci_conn *conn;
1194
1195         /* Let's make sure that le is enabled.*/
1196         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1197                 if (lmp_le_capable(hdev))
1198                         return ERR_PTR(-ECONNREFUSED);
1199
1200                 return ERR_PTR(-EOPNOTSUPP);
1201         }
1202
1203         /* Some devices send ATT messages as soon as the physical link is
1204          * established. To be able to handle these ATT messages, the user-
1205          * space first establishes the connection and then starts the pairing
1206          * process.
1207          *
1208          * So if a hci_conn object already exists for the following connection
1209          * attempt, we simply update pending_sec_level and auth_type fields
1210          * and return the object found.
1211          */
1212         conn = hci_conn_hash_lookup_le(hdev, dst, dst_type);
1213         if (conn) {
1214                 if (conn->pending_sec_level < sec_level)
1215                         conn->pending_sec_level = sec_level;
1216                 goto done;
1217         }
1218
1219         BT_DBG("requesting refresh of dst_addr");
1220
1221         conn = hci_conn_add(hdev, LE_LINK, dst, HCI_ROLE_MASTER);
1222         if (!conn)
1223                 return ERR_PTR(-ENOMEM);
1224
1225         if (hci_explicit_conn_params_set(hdev, dst, dst_type) < 0) {
1226                 hci_conn_del(conn);
1227                 return ERR_PTR(-EBUSY);
1228         }
1229
1230         conn->state = BT_CONNECT;
1231         set_bit(HCI_CONN_SCANNING, &conn->flags);
1232         conn->dst_type = dst_type;
1233         conn->sec_level = BT_SECURITY_LOW;
1234         conn->pending_sec_level = sec_level;
1235         conn->conn_timeout = conn_timeout;
1236         conn->conn_reason = conn_reason;
1237
1238         hci_update_background_scan(hdev);
1239
1240 done:
1241         hci_conn_hold(conn);
1242         return conn;
1243 }
1244
1245 struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst,
1246                                  u8 sec_level, u8 auth_type,
1247                                  enum conn_reasons conn_reason)
1248 {
1249         struct hci_conn *acl;
1250
1251         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1252                 if (lmp_bredr_capable(hdev))
1253                         return ERR_PTR(-ECONNREFUSED);
1254
1255                 return ERR_PTR(-EOPNOTSUPP);
1256         }
1257
1258         acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
1259         if (!acl) {
1260                 acl = hci_conn_add(hdev, ACL_LINK, dst, HCI_ROLE_MASTER);
1261                 if (!acl)
1262                         return ERR_PTR(-ENOMEM);
1263         }
1264
1265         hci_conn_hold(acl);
1266
1267         acl->conn_reason = conn_reason;
1268         if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
1269                 acl->sec_level = BT_SECURITY_LOW;
1270                 acl->pending_sec_level = sec_level;
1271                 acl->auth_type = auth_type;
1272                 hci_acl_create_connection(acl);
1273         }
1274
1275         return acl;
1276 }
1277
1278 struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type, bdaddr_t *dst,
1279                                  __u16 setting)
1280 {
1281         struct hci_conn *acl;
1282         struct hci_conn *sco;
1283
1284         acl = hci_connect_acl(hdev, dst, BT_SECURITY_LOW, HCI_AT_NO_BONDING,
1285                               CONN_REASON_SCO_CONNECT);
1286         if (IS_ERR(acl))
1287                 return acl;
1288
1289         sco = hci_conn_hash_lookup_ba(hdev, type, dst);
1290         if (!sco) {
1291                 sco = hci_conn_add(hdev, type, dst, HCI_ROLE_MASTER);
1292                 if (!sco) {
1293                         hci_conn_drop(acl);
1294                         return ERR_PTR(-ENOMEM);
1295                 }
1296         }
1297
1298         acl->link = sco;
1299         sco->link = acl;
1300
1301         hci_conn_hold(sco);
1302
1303         sco->setting = setting;
1304
1305         if (acl->state == BT_CONNECTED &&
1306             (sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
1307                 set_bit(HCI_CONN_POWER_SAVE, &acl->flags);
1308                 hci_conn_enter_active_mode(acl, BT_POWER_FORCE_ACTIVE_ON);
1309
1310                 if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->flags)) {
1311                         /* defer SCO setup until mode change completed */
1312                         set_bit(HCI_CONN_SCO_SETUP_PEND, &acl->flags);
1313                         return sco;
1314                 }
1315
1316                 hci_sco_setup(acl, 0x00);
1317         }
1318
1319         return sco;
1320 }
1321
1322 /* Check link security requirement */
1323 int hci_conn_check_link_mode(struct hci_conn *conn)
1324 {
1325         BT_DBG("hcon %p", conn);
1326
1327         /* In Secure Connections Only mode, it is required that Secure
1328          * Connections is used and the link is encrypted with AES-CCM
1329          * using a P-256 authenticated combination key.
1330          */
1331         if (hci_dev_test_flag(conn->hdev, HCI_SC_ONLY)) {
1332                 if (!hci_conn_sc_enabled(conn) ||
1333                     !test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
1334                     conn->key_type != HCI_LK_AUTH_COMBINATION_P256)
1335                         return 0;
1336         }
1337
1338          /* AES encryption is required for Level 4:
1339           *
1340           * BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 3, Part C
1341           * page 1319:
1342           *
1343           * 128-bit equivalent strength for link and encryption keys
1344           * required using FIPS approved algorithms (E0 not allowed,
1345           * SAFER+ not allowed, and P-192 not allowed; encryption key
1346           * not shortened)
1347           */
1348         if (conn->sec_level == BT_SECURITY_FIPS &&
1349             !test_bit(HCI_CONN_AES_CCM, &conn->flags)) {
1350                 bt_dev_err(conn->hdev,
1351                            "Invalid security: Missing AES-CCM usage");
1352                 return 0;
1353         }
1354
1355         if (hci_conn_ssp_enabled(conn) &&
1356             !test_bit(HCI_CONN_ENCRYPT, &conn->flags))
1357                 return 0;
1358
1359         return 1;
1360 }
1361
1362 /* Authenticate remote device */
1363 static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
1364 {
1365         BT_DBG("hcon %p", conn);
1366
1367         if (conn->pending_sec_level > sec_level)
1368                 sec_level = conn->pending_sec_level;
1369
1370         if (sec_level > conn->sec_level)
1371                 conn->pending_sec_level = sec_level;
1372         else if (test_bit(HCI_CONN_AUTH, &conn->flags))
1373                 return 1;
1374
1375         /* Make sure we preserve an existing MITM requirement*/
1376         auth_type |= (conn->auth_type & 0x01);
1377
1378         conn->auth_type = auth_type;
1379
1380         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
1381                 struct hci_cp_auth_requested cp;
1382
1383                 cp.handle = cpu_to_le16(conn->handle);
1384                 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
1385                              sizeof(cp), &cp);
1386
1387                 /* If we're already encrypted set the REAUTH_PEND flag,
1388                  * otherwise set the ENCRYPT_PEND.
1389                  */
1390                 if (test_bit(HCI_CONN_ENCRYPT, &conn->flags))
1391                         set_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
1392                 else
1393                         set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
1394         }
1395
1396         return 0;
1397 }
1398
1399 /* Encrypt the link */
1400 static void hci_conn_encrypt(struct hci_conn *conn)
1401 {
1402         BT_DBG("hcon %p", conn);
1403
1404         if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
1405                 struct hci_cp_set_conn_encrypt cp;
1406                 cp.handle  = cpu_to_le16(conn->handle);
1407                 cp.encrypt = 0x01;
1408                 hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
1409                              &cp);
1410         }
1411 }
1412
1413 /* Enable security */
1414 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type,
1415                       bool initiator)
1416 {
1417         BT_DBG("hcon %p", conn);
1418
1419         if (conn->type == LE_LINK)
1420                 return smp_conn_security(conn, sec_level);
1421
1422         /* For sdp we don't need the link key. */
1423         if (sec_level == BT_SECURITY_SDP)
1424                 return 1;
1425
1426         /* For non 2.1 devices and low security level we don't need the link
1427            key. */
1428         if (sec_level == BT_SECURITY_LOW && !hci_conn_ssp_enabled(conn))
1429                 return 1;
1430
1431         /* For other security levels we need the link key. */
1432         if (!test_bit(HCI_CONN_AUTH, &conn->flags))
1433                 goto auth;
1434
1435         /* An authenticated FIPS approved combination key has sufficient
1436          * security for security level 4. */
1437         if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256 &&
1438             sec_level == BT_SECURITY_FIPS)
1439                 goto encrypt;
1440
1441         /* An authenticated combination key has sufficient security for
1442            security level 3. */
1443         if ((conn->key_type == HCI_LK_AUTH_COMBINATION_P192 ||
1444              conn->key_type == HCI_LK_AUTH_COMBINATION_P256) &&
1445             sec_level == BT_SECURITY_HIGH)
1446                 goto encrypt;
1447
1448         /* An unauthenticated combination key has sufficient security for
1449            security level 1 and 2. */
1450         if ((conn->key_type == HCI_LK_UNAUTH_COMBINATION_P192 ||
1451              conn->key_type == HCI_LK_UNAUTH_COMBINATION_P256) &&
1452             (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW))
1453                 goto encrypt;
1454
1455         /* A combination key has always sufficient security for the security
1456            levels 1 or 2. High security level requires the combination key
1457            is generated using maximum PIN code length (16).
1458            For pre 2.1 units. */
1459         if (conn->key_type == HCI_LK_COMBINATION &&
1460             (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW ||
1461              conn->pin_length == 16))
1462                 goto encrypt;
1463
1464 auth:
1465         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags))
1466                 return 0;
1467
1468         if (initiator)
1469                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
1470
1471         if (!hci_conn_auth(conn, sec_level, auth_type))
1472                 return 0;
1473
1474 encrypt:
1475         if (test_bit(HCI_CONN_ENCRYPT, &conn->flags)) {
1476                 /* Ensure that the encryption key size has been read,
1477                  * otherwise stall the upper layer responses.
1478                  */
1479                 if (!conn->enc_key_size)
1480                         return 0;
1481
1482                 /* Nothing else needed, all requirements are met */
1483                 return 1;
1484         }
1485
1486         hci_conn_encrypt(conn);
1487         return 0;
1488 }
1489 EXPORT_SYMBOL(hci_conn_security);
1490
1491 /* Check secure link requirement */
1492 int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level)
1493 {
1494         BT_DBG("hcon %p", conn);
1495
1496         /* Accept if non-secure or higher security level is required */
1497         if (sec_level != BT_SECURITY_HIGH && sec_level != BT_SECURITY_FIPS)
1498                 return 1;
1499
1500         /* Accept if secure or higher security level is already present */
1501         if (conn->sec_level == BT_SECURITY_HIGH ||
1502             conn->sec_level == BT_SECURITY_FIPS)
1503                 return 1;
1504
1505         /* Reject not secure link */
1506         return 0;
1507 }
1508 EXPORT_SYMBOL(hci_conn_check_secure);
1509
1510 /* Switch role */
1511 int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
1512 {
1513         BT_DBG("hcon %p", conn);
1514
1515         if (role == conn->role)
1516                 return 1;
1517
1518         if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->flags)) {
1519                 struct hci_cp_switch_role cp;
1520                 bacpy(&cp.bdaddr, &conn->dst);
1521                 cp.role = role;
1522                 hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
1523         }
1524
1525         return 0;
1526 }
1527 EXPORT_SYMBOL(hci_conn_switch_role);
1528
1529 /* Enter active mode */
1530 void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
1531 {
1532         struct hci_dev *hdev = conn->hdev;
1533
1534         BT_DBG("hcon %p mode %d", conn, conn->mode);
1535
1536         if (conn->mode != HCI_CM_SNIFF)
1537                 goto timer;
1538
1539         if (!test_bit(HCI_CONN_POWER_SAVE, &conn->flags) && !force_active)
1540                 goto timer;
1541
1542         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
1543                 struct hci_cp_exit_sniff_mode cp;
1544                 cp.handle = cpu_to_le16(conn->handle);
1545                 hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
1546         }
1547
1548 timer:
1549         if (hdev->idle_timeout > 0)
1550                 queue_delayed_work(hdev->workqueue, &conn->idle_work,
1551                                    msecs_to_jiffies(hdev->idle_timeout));
1552 }
1553
1554 /* Drop all connection on the device */
1555 void hci_conn_hash_flush(struct hci_dev *hdev)
1556 {
1557         struct hci_conn_hash *h = &hdev->conn_hash;
1558         struct hci_conn *c, *n;
1559
1560         BT_DBG("hdev %s", hdev->name);
1561
1562         list_for_each_entry_safe(c, n, &h->list, list) {
1563                 c->state = BT_CLOSED;
1564
1565                 hci_disconn_cfm(c, HCI_ERROR_LOCAL_HOST_TERM);
1566                 hci_conn_del(c);
1567         }
1568 }
1569
1570 /* Check pending connect attempts */
1571 void hci_conn_check_pending(struct hci_dev *hdev)
1572 {
1573         struct hci_conn *conn;
1574
1575         BT_DBG("hdev %s", hdev->name);
1576
1577         hci_dev_lock(hdev);
1578
1579         conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
1580         if (conn)
1581                 hci_acl_create_connection(conn);
1582
1583         hci_dev_unlock(hdev);
1584 }
1585
1586 static u32 get_link_mode(struct hci_conn *conn)
1587 {
1588         u32 link_mode = 0;
1589
1590         if (conn->role == HCI_ROLE_MASTER)
1591                 link_mode |= HCI_LM_MASTER;
1592
1593         if (test_bit(HCI_CONN_ENCRYPT, &conn->flags))
1594                 link_mode |= HCI_LM_ENCRYPT;
1595
1596         if (test_bit(HCI_CONN_AUTH, &conn->flags))
1597                 link_mode |= HCI_LM_AUTH;
1598
1599         if (test_bit(HCI_CONN_SECURE, &conn->flags))
1600                 link_mode |= HCI_LM_SECURE;
1601
1602         if (test_bit(HCI_CONN_FIPS, &conn->flags))
1603                 link_mode |= HCI_LM_FIPS;
1604
1605         return link_mode;
1606 }
1607
1608 int hci_get_conn_list(void __user *arg)
1609 {
1610         struct hci_conn *c;
1611         struct hci_conn_list_req req, *cl;
1612         struct hci_conn_info *ci;
1613         struct hci_dev *hdev;
1614         int n = 0, size, err;
1615
1616         if (copy_from_user(&req, arg, sizeof(req)))
1617                 return -EFAULT;
1618
1619         if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
1620                 return -EINVAL;
1621
1622         size = sizeof(req) + req.conn_num * sizeof(*ci);
1623
1624         cl = kmalloc(size, GFP_KERNEL);
1625         if (!cl)
1626                 return -ENOMEM;
1627
1628         hdev = hci_dev_get(req.dev_id);
1629         if (!hdev) {
1630                 kfree(cl);
1631                 return -ENODEV;
1632         }
1633
1634         ci = cl->conn_info;
1635
1636         hci_dev_lock(hdev);
1637         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1638                 bacpy(&(ci + n)->bdaddr, &c->dst);
1639                 (ci + n)->handle = c->handle;
1640                 (ci + n)->type  = c->type;
1641                 (ci + n)->out   = c->out;
1642                 (ci + n)->state = c->state;
1643                 (ci + n)->link_mode = get_link_mode(c);
1644                 if (++n >= req.conn_num)
1645                         break;
1646         }
1647         hci_dev_unlock(hdev);
1648
1649         cl->dev_id = hdev->id;
1650         cl->conn_num = n;
1651         size = sizeof(req) + n * sizeof(*ci);
1652
1653         hci_dev_put(hdev);
1654
1655         err = copy_to_user(arg, cl, size);
1656         kfree(cl);
1657
1658         return err ? -EFAULT : 0;
1659 }
1660
1661 int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
1662 {
1663         struct hci_conn_info_req req;
1664         struct hci_conn_info ci;
1665         struct hci_conn *conn;
1666         char __user *ptr = arg + sizeof(req);
1667
1668         if (copy_from_user(&req, arg, sizeof(req)))
1669                 return -EFAULT;
1670
1671         hci_dev_lock(hdev);
1672         conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
1673         if (conn) {
1674                 bacpy(&ci.bdaddr, &conn->dst);
1675                 ci.handle = conn->handle;
1676                 ci.type  = conn->type;
1677                 ci.out   = conn->out;
1678                 ci.state = conn->state;
1679                 ci.link_mode = get_link_mode(conn);
1680         }
1681         hci_dev_unlock(hdev);
1682
1683         if (!conn)
1684                 return -ENOENT;
1685
1686         return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
1687 }
1688
1689 int hci_get_auth_info(struct hci_dev *hdev, void __user *arg)
1690 {
1691         struct hci_auth_info_req req;
1692         struct hci_conn *conn;
1693
1694         if (copy_from_user(&req, arg, sizeof(req)))
1695                 return -EFAULT;
1696
1697         hci_dev_lock(hdev);
1698         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr);
1699         if (conn)
1700                 req.type = conn->auth_type;
1701         hci_dev_unlock(hdev);
1702
1703         if (!conn)
1704                 return -ENOENT;
1705
1706         return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0;
1707 }
1708
1709 struct hci_chan *hci_chan_create(struct hci_conn *conn)
1710 {
1711         struct hci_dev *hdev = conn->hdev;
1712         struct hci_chan *chan;
1713
1714         BT_DBG("%s hcon %p", hdev->name, conn);
1715
1716         if (test_bit(HCI_CONN_DROP, &conn->flags)) {
1717                 BT_DBG("Refusing to create new hci_chan");
1718                 return NULL;
1719         }
1720
1721         chan = kzalloc(sizeof(*chan), GFP_KERNEL);
1722         if (!chan)
1723                 return NULL;
1724
1725         chan->conn = hci_conn_get(conn);
1726         skb_queue_head_init(&chan->data_q);
1727         chan->state = BT_CONNECTED;
1728
1729         list_add_rcu(&chan->list, &conn->chan_list);
1730
1731         return chan;
1732 }
1733
1734 void hci_chan_del(struct hci_chan *chan)
1735 {
1736         struct hci_conn *conn = chan->conn;
1737         struct hci_dev *hdev = conn->hdev;
1738
1739         BT_DBG("%s hcon %p chan %p", hdev->name, conn, chan);
1740
1741         list_del_rcu(&chan->list);
1742
1743         synchronize_rcu();
1744
1745         /* Prevent new hci_chan's to be created for this hci_conn */
1746         set_bit(HCI_CONN_DROP, &conn->flags);
1747
1748         hci_conn_put(conn);
1749
1750         skb_queue_purge(&chan->data_q);
1751         kfree(chan);
1752 }
1753
1754 void hci_chan_list_flush(struct hci_conn *conn)
1755 {
1756         struct hci_chan *chan, *n;
1757
1758         BT_DBG("hcon %p", conn);
1759
1760         list_for_each_entry_safe(chan, n, &conn->chan_list, list)
1761                 hci_chan_del(chan);
1762 }
1763
1764 static struct hci_chan *__hci_chan_lookup_handle(struct hci_conn *hcon,
1765                                                  __u16 handle)
1766 {
1767         struct hci_chan *hchan;
1768
1769         list_for_each_entry(hchan, &hcon->chan_list, list) {
1770                 if (hchan->handle == handle)
1771                         return hchan;
1772         }
1773
1774         return NULL;
1775 }
1776
1777 struct hci_chan *hci_chan_lookup_handle(struct hci_dev *hdev, __u16 handle)
1778 {
1779         struct hci_conn_hash *h = &hdev->conn_hash;
1780         struct hci_conn *hcon;
1781         struct hci_chan *hchan = NULL;
1782
1783         rcu_read_lock();
1784
1785         list_for_each_entry_rcu(hcon, &h->list, list) {
1786                 hchan = __hci_chan_lookup_handle(hcon, handle);
1787                 if (hchan)
1788                         break;
1789         }
1790
1791         rcu_read_unlock();
1792
1793         return hchan;
1794 }
1795
1796 u32 hci_conn_get_phy(struct hci_conn *conn)
1797 {
1798         u32 phys = 0;
1799
1800         hci_dev_lock(conn->hdev);
1801
1802         /* BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 2, Part B page 471:
1803          * Table 6.2: Packets defined for synchronous, asynchronous, and
1804          * CSB logical transport types.
1805          */
1806         switch (conn->type) {
1807         case SCO_LINK:
1808                 /* SCO logical transport (1 Mb/s):
1809                  * HV1, HV2, HV3 and DV.
1810                  */
1811                 phys |= BT_PHY_BR_1M_1SLOT;
1812
1813                 break;
1814
1815         case ACL_LINK:
1816                 /* ACL logical transport (1 Mb/s) ptt=0:
1817                  * DH1, DM3, DH3, DM5 and DH5.
1818                  */
1819                 phys |= BT_PHY_BR_1M_1SLOT;
1820
1821                 if (conn->pkt_type & (HCI_DM3 | HCI_DH3))
1822                         phys |= BT_PHY_BR_1M_3SLOT;
1823
1824                 if (conn->pkt_type & (HCI_DM5 | HCI_DH5))
1825                         phys |= BT_PHY_BR_1M_5SLOT;
1826
1827                 /* ACL logical transport (2 Mb/s) ptt=1:
1828                  * 2-DH1, 2-DH3 and 2-DH5.
1829                  */
1830                 if (!(conn->pkt_type & HCI_2DH1))
1831                         phys |= BT_PHY_EDR_2M_1SLOT;
1832
1833                 if (!(conn->pkt_type & HCI_2DH3))
1834                         phys |= BT_PHY_EDR_2M_3SLOT;
1835
1836                 if (!(conn->pkt_type & HCI_2DH5))
1837                         phys |= BT_PHY_EDR_2M_5SLOT;
1838
1839                 /* ACL logical transport (3 Mb/s) ptt=1:
1840                  * 3-DH1, 3-DH3 and 3-DH5.
1841                  */
1842                 if (!(conn->pkt_type & HCI_3DH1))
1843                         phys |= BT_PHY_EDR_3M_1SLOT;
1844
1845                 if (!(conn->pkt_type & HCI_3DH3))
1846                         phys |= BT_PHY_EDR_3M_3SLOT;
1847
1848                 if (!(conn->pkt_type & HCI_3DH5))
1849                         phys |= BT_PHY_EDR_3M_5SLOT;
1850
1851                 break;
1852
1853         case ESCO_LINK:
1854                 /* eSCO logical transport (1 Mb/s): EV3, EV4 and EV5 */
1855                 phys |= BT_PHY_BR_1M_1SLOT;
1856
1857                 if (!(conn->pkt_type & (ESCO_EV4 | ESCO_EV5)))
1858                         phys |= BT_PHY_BR_1M_3SLOT;
1859
1860                 /* eSCO logical transport (2 Mb/s): 2-EV3, 2-EV5 */
1861                 if (!(conn->pkt_type & ESCO_2EV3))
1862                         phys |= BT_PHY_EDR_2M_1SLOT;
1863
1864                 if (!(conn->pkt_type & ESCO_2EV5))
1865                         phys |= BT_PHY_EDR_2M_3SLOT;
1866
1867                 /* eSCO logical transport (3 Mb/s): 3-EV3, 3-EV5 */
1868                 if (!(conn->pkt_type & ESCO_3EV3))
1869                         phys |= BT_PHY_EDR_3M_1SLOT;
1870
1871                 if (!(conn->pkt_type & ESCO_3EV5))
1872                         phys |= BT_PHY_EDR_3M_3SLOT;
1873
1874                 break;
1875
1876         case LE_LINK:
1877                 if (conn->le_tx_phy & HCI_LE_SET_PHY_1M)
1878                         phys |= BT_PHY_LE_1M_TX;
1879
1880                 if (conn->le_rx_phy & HCI_LE_SET_PHY_1M)
1881                         phys |= BT_PHY_LE_1M_RX;
1882
1883                 if (conn->le_tx_phy & HCI_LE_SET_PHY_2M)
1884                         phys |= BT_PHY_LE_2M_TX;
1885
1886                 if (conn->le_rx_phy & HCI_LE_SET_PHY_2M)
1887                         phys |= BT_PHY_LE_2M_RX;
1888
1889                 if (conn->le_tx_phy & HCI_LE_SET_PHY_CODED)
1890                         phys |= BT_PHY_LE_CODED_TX;
1891
1892                 if (conn->le_rx_phy & HCI_LE_SET_PHY_CODED)
1893                         phys |= BT_PHY_LE_CODED_RX;
1894
1895                 break;
1896         }
1897
1898         hci_dev_unlock(conn->hdev);
1899
1900         return phys;
1901 }