net/bluetooth/hci_conn.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI connection handling. */
  26
  27 #include <linux/export.h>
  28 #include <linux/debugfs.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/l2cap.h>
  33
  34 #include "hci_request.h"
  35 #include "smp.h"
  36 #include "a2mp.h"
  37
  38 struct sco_param {
  39         u16 pkt_type;
  40         u16 max_latency;
  41         u8  retrans_effort;
  42 };
  43
  44 static const struct sco_param esco_param_cvsd[] = {
  45         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000a,   0x01 }, /* S3 */
  46         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x0007,   0x01 }, /* S2 */
  47         { EDR_ESCO_MASK | ESCO_EV3,   0x0007,   0x01 }, /* S1 */
  48         { EDR_ESCO_MASK | ESCO_HV3,   0xffff,   0x01 }, /* D1 */
  49         { EDR_ESCO_MASK | ESCO_HV1,   0xffff,   0x01 }, /* D0 */
  50 };
  51
  52 static const struct sco_param sco_param_cvsd[] = {
  53         { EDR_ESCO_MASK | ESCO_HV3,   0xffff,   0xff }, /* D1 */
  54         { EDR_ESCO_MASK | ESCO_HV1,   0xffff,   0xff }, /* D0 */
  55 };
  56
  57 static const struct sco_param esco_param_msbc[] = {
  58         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000d,   0x02 }, /* T2 */
  59         { EDR_ESCO_MASK | ESCO_EV3,   0x0008,   0x02 }, /* T1 */
  60 };
  61
  62 /* This function requires the caller holds hdev->lock */
  63 static void hci_connect_le_scan_cleanup(struct hci_conn *conn)
  64 {
  65         struct hci_conn_params *params;
  66         struct hci_dev *hdev = conn->hdev;
  67         struct smp_irk *irk;
  68         bdaddr_t *bdaddr;
  69         u8 bdaddr_type;
  70
  71         bdaddr = &conn->dst;
  72         bdaddr_type = conn->dst_type;
  73
  74         /* Check if we need to convert to identity address */
  75         irk = hci_get_irk(hdev, bdaddr, bdaddr_type);
  76         if (irk) {
  77                 bdaddr = &irk->bdaddr;
  78                 bdaddr_type = irk->addr_type;
  79         }
  80
  81         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, bdaddr,
  82                                            bdaddr_type);
  83         if (!params || !params->explicit_connect)
  84                 return;
  85
  86         /* The connection attempt was doing scan for new RPA, and is
  87          * in scan phase. If params are not associated with any other
  88          * autoconnect action, remove them completely. If they are, just unmark
  89          * them as waiting for connection, by clearing explicit_connect field.
  90          */
  91         params->explicit_connect = false;
  92
  93         list_del_init(&params->action);
  94
  95         switch (params->auto_connect) {
  96         case HCI_AUTO_CONN_EXPLICIT:
  97                 hci_conn_params_del(hdev, bdaddr, bdaddr_type);
  98                 /* return instead of break to avoid duplicate scan update */
  99                 return;
 100         case HCI_AUTO_CONN_DIRECT:
 101         case HCI_AUTO_CONN_ALWAYS:
 102                 list_add(&params->action, &hdev->pend_le_conns);
 103                 break;
 104         case HCI_AUTO_CONN_REPORT:
 105                 list_add(&params->action, &hdev->pend_le_reports);
 106                 break;
 107         default:
 108                 break;
 109         }
 110
 111         hci_update_background_scan(hdev);
 112 }
 113
 114 static void hci_conn_cleanup(struct hci_conn *conn)
 115 {
 116         struct hci_dev *hdev = conn->hdev;
 117
 118         if (test_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags))
 119                 hci_conn_params_del(conn->hdev, &conn->dst, conn->dst_type);
 120
 121         hci_chan_list_flush(conn);
 122
 123         hci_conn_hash_del(hdev, conn);
 124
 125         if (conn->type == SCO_LINK || conn->type == ESCO_LINK) {
 126                 switch (conn->setting & SCO_AIRMODE_MASK) {
 127                 case SCO_AIRMODE_CVSD:
 128                 case SCO_AIRMODE_TRANSP:
 129                         if (hdev->notify)
 130                                 hdev->notify(hdev, HCI_NOTIFY_DISABLE_SCO);
 131                         break;
 132                 }
 133         } else {
 134                 if (hdev->notify)
 135                         hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
 136         }
 137
 138         debugfs_remove_recursive(conn->debugfs);
 139
 140         hci_conn_del_sysfs(conn);
 141
 142         hci_dev_put(hdev);
 143 }
 144
 145 static void le_scan_cleanup(struct work_struct *work)
 146 {
 147         struct hci_conn *conn = container_of(work, struct hci_conn,
 148                                              le_scan_cleanup);
 149         struct hci_dev *hdev = conn->hdev;
 150         struct hci_conn *c = NULL;
 151
 152         BT_DBG("%s hcon %p", hdev->name, conn);
 153
 154         hci_dev_lock(hdev);
 155
 156         /* Check that the hci_conn is still around */
 157         rcu_read_lock();
 158         list_for_each_entry_rcu(c, &hdev->conn_hash.list, list) {
 159                 if (c == conn)
 160                         break;
 161         }
 162         rcu_read_unlock();
 163
 164         if (c == conn) {
 165                 hci_connect_le_scan_cleanup(conn);
 166                 hci_conn_cleanup(conn);
 167         }
 168
 169         hci_dev_unlock(hdev);
 170         hci_dev_put(hdev);
 171         hci_conn_put(conn);
 172 }
 173
 174 static void hci_connect_le_scan_remove(struct hci_conn *conn)
 175 {
 176         BT_DBG("%s hcon %p", conn->hdev->name, conn);
 177
 178         /* We can't call hci_conn_del/hci_conn_cleanup here since that
 179          * could deadlock with another hci_conn_del() call that's holding
 180          * hci_dev_lock and doing cancel_delayed_work_sync(&conn->disc_work).
 181          * Instead, grab temporary extra references to the hci_dev and
 182          * hci_conn and perform the necessary cleanup in a separate work
 183          * callback.
 184          */
 185
 186         hci_dev_hold(conn->hdev);
 187         hci_conn_get(conn);
 188
 189         /* Even though we hold a reference to the hdev, many other
 190          * things might get cleaned up meanwhile, including the hdev's
 191          * own workqueue, so we can't use that for scheduling.
 192          */
 193         schedule_work(&conn->le_scan_cleanup);
 194 }
 195
 196 static void hci_acl_create_connection(struct hci_conn *conn)
 197 {
 198         struct hci_dev *hdev = conn->hdev;
 199         struct inquiry_entry *ie;
 200         struct hci_cp_create_conn cp;
 201
 202         BT_DBG("hcon %p", conn);
 203
 204         conn->state = BT_CONNECT;
 205         conn->out = true;
 206         conn->role = HCI_ROLE_MASTER;
 207
 208         conn->attempt++;
 209
 210         conn->link_policy = hdev->link_policy;
 211
 212         memset(&cp, 0, sizeof(cp));
 213         bacpy(&cp.bdaddr, &conn->dst);
 214         cp.pscan_rep_mode = 0x02;
 215
 216         ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
 217         if (ie) {
 218                 if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
 219                         cp.pscan_rep_mode = ie->data.pscan_rep_mode;
 220                         cp.pscan_mode     = ie->data.pscan_mode;
 221                         cp.clock_offset   = ie->data.clock_offset |
 222                                             cpu_to_le16(0x8000);
 223                 }
 224
 225                 memcpy(conn->dev_class, ie->data.dev_class, 3);
 226         }
 227
 228         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 229         if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
 230                 cp.role_switch = 0x01;
 231         else
 232                 cp.role_switch = 0x00;
 233
 234         hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
 235 }
 236
 237 int hci_disconnect(struct hci_conn *conn, __u8 reason)
 238 {
 239         BT_DBG("hcon %p", conn);
 240
 241         /* When we are central of an established connection and it enters
 242          * the disconnect timeout, then go ahead and try to read the
 243          * current clock offset.  Processing of the result is done
 244          * within the event handling and hci_clock_offset_evt function.
 245          */
 246         if (conn->type == ACL_LINK && conn->role == HCI_ROLE_MASTER &&
 247             (conn->state == BT_CONNECTED || conn->state == BT_CONFIG)) {
 248                 struct hci_dev *hdev = conn->hdev;
 249                 struct hci_cp_read_clock_offset clkoff_cp;
 250
 251                 clkoff_cp.handle = cpu_to_le16(conn->handle);
 252                 hci_send_cmd(hdev, HCI_OP_READ_CLOCK_OFFSET, sizeof(clkoff_cp),
 253                              &clkoff_cp);
 254         }
 255
 256         return hci_abort_conn(conn, reason);
 257 }
 258
 259 static void hci_add_sco(struct hci_conn *conn, __u16 handle)
 260 {
 261         struct hci_dev *hdev = conn->hdev;
 262         struct hci_cp_add_sco cp;
 263
 264         BT_DBG("hcon %p", conn);
 265
 266         conn->state = BT_CONNECT;
 267         conn->out = true;
 268
 269         conn->attempt++;
 270
 271         cp.handle   = cpu_to_le16(handle);
 272         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 273
 274         hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
 275 }
 276
 277 bool hci_setup_sync(struct hci_conn *conn, __u16 handle)
 278 {
 279         struct hci_dev *hdev = conn->hdev;
 280         struct hci_cp_setup_sync_conn cp;
 281         const struct sco_param *param;
 282
 283         BT_DBG("hcon %p", conn);
 284
 285         conn->state = BT_CONNECT;
 286         conn->out = true;
 287
 288         conn->attempt++;
 289
 290         cp.handle   = cpu_to_le16(handle);
 291
 292         cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
 293         cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
 294         cp.voice_setting  = cpu_to_le16(conn->setting);
 295
 296         switch (conn->setting & SCO_AIRMODE_MASK) {
 297         case SCO_AIRMODE_TRANSP:
 298                 if (conn->attempt > ARRAY_SIZE(esco_param_msbc))
 299                         return false;
 300                 param = &esco_param_msbc[conn->attempt - 1];
 301                 break;
 302         case SCO_AIRMODE_CVSD:
 303                 if (lmp_esco_capable(conn->link)) {
 304                         if (conn->attempt > ARRAY_SIZE(esco_param_cvsd))
 305                                 return false;
 306                         param = &esco_param_cvsd[conn->attempt - 1];
 307                 } else {
 308                         if (conn->attempt > ARRAY_SIZE(sco_param_cvsd))
 309                                 return false;
 310                         param = &sco_param_cvsd[conn->attempt - 1];
 311                 }
 312                 break;
 313         default:
 314                 return false;
 315         }
 316
 317         cp.retrans_effort = param->retrans_effort;
 318         cp.pkt_type = __cpu_to_le16(param->pkt_type);
 319         cp.max_latency = __cpu_to_le16(param->max_latency);
 320
 321         if (hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp) < 0)
 322                 return false;
 323
 324         return true;
 325 }
 326
 327 u8 hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max, u16 latency,
 328                       u16 to_multiplier)
 329 {
 330         struct hci_dev *hdev = conn->hdev;
 331         struct hci_conn_params *params;
 332         struct hci_cp_le_conn_update cp;
 333
 334         hci_dev_lock(hdev);
 335
 336         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
 337         if (params) {
 338                 params->conn_min_interval = min;
 339                 params->conn_max_interval = max;
 340                 params->conn_latency = latency;
 341                 params->supervision_timeout = to_multiplier;
 342         }
 343
 344         hci_dev_unlock(hdev);
 345
 346         memset(&cp, 0, sizeof(cp));
 347         cp.handle               = cpu_to_le16(conn->handle);
 348         cp.conn_interval_min    = cpu_to_le16(min);
 349         cp.conn_interval_max    = cpu_to_le16(max);
 350         cp.conn_latency         = cpu_to_le16(latency);
 351         cp.supervision_timeout  = cpu_to_le16(to_multiplier);
 352         cp.min_ce_len           = cpu_to_le16(0x0000);
 353         cp.max_ce_len           = cpu_to_le16(0x0000);
 354
 355         hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp);
 356
 357         if (params)
 358                 return 0x01;
 359
 360         return 0x00;
 361 }
 362
 363 void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __le64 rand,
 364                       __u8 ltk[16], __u8 key_size)
 365 {
 366         struct hci_dev *hdev = conn->hdev;
 367         struct hci_cp_le_start_enc cp;
 368
 369         BT_DBG("hcon %p", conn);
 370
 371         memset(&cp, 0, sizeof(cp));
 372
 373         cp.handle = cpu_to_le16(conn->handle);
 374         cp.rand = rand;
 375         cp.ediv = ediv;
 376         memcpy(cp.ltk, ltk, key_size);
 377
 378         hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp);
 379 }
 380
 381 /* Device _must_ be locked */
 382 void hci_sco_setup(struct hci_conn *conn, __u8 status)
 383 {
 384         struct hci_conn *sco = conn->link;
 385
 386         if (!sco)
 387                 return;
 388
 389         BT_DBG("hcon %p", conn);
 390
 391         if (!status) {
 392                 if (lmp_esco_capable(conn->hdev))
 393                         hci_setup_sync(sco, conn->handle);
 394                 else
 395                         hci_add_sco(sco, conn->handle);
 396         } else {
 397                 hci_connect_cfm(sco, status);
 398                 hci_conn_del(sco);
 399         }
 400 }
 401
 402 static void hci_conn_timeout(struct work_struct *work)
 403 {
 404         struct hci_conn *conn = container_of(work, struct hci_conn,
 405                                              disc_work.work);
 406         int refcnt = atomic_read(&conn->refcnt);
 407
 408         BT_DBG("hcon %p state %s", conn, state_to_string(conn->state));
 409
 410         WARN_ON(refcnt < 0);
 411
 412         /* FIXME: It was observed that in pairing failed scenario, refcnt
 413          * drops below 0. Probably this is because l2cap_conn_del calls
 414          * l2cap_chan_del for each channel, and inside l2cap_chan_del conn is
 415          * dropped. After that loop hci_chan_del is called which also drops
 416          * conn. For now make sure that ACL is alive if refcnt is higher then 0,
 417          * otherwise drop it.
 418          */
 419         if (refcnt > 0)
 420                 return;
 421
 422         /* LE connections in scanning state need special handling */
 423         if (conn->state == BT_CONNECT && conn->type == LE_LINK &&
 424             test_bit(HCI_CONN_SCANNING, &conn->flags)) {
 425                 hci_connect_le_scan_remove(conn);
 426                 return;
 427         }
 428
 429         hci_abort_conn(conn, hci_proto_disconn_ind(conn));
 430 }
 431
 432 /* Enter sniff mode */
 433 static void hci_conn_idle(struct work_struct *work)
 434 {
 435         struct hci_conn *conn = container_of(work, struct hci_conn,
 436                                              idle_work.work);
 437         struct hci_dev *hdev = conn->hdev;
 438
 439         BT_DBG("hcon %p mode %d", conn, conn->mode);
 440
 441         if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn))
 442                 return;
 443
 444         if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF))
 445                 return;
 446
 447         if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
 448                 struct hci_cp_sniff_subrate cp;
 449                 cp.handle             = cpu_to_le16(conn->handle);
 450                 cp.max_latency        = cpu_to_le16(0);
 451                 cp.min_remote_timeout = cpu_to_le16(0);
 452                 cp.min_local_timeout  = cpu_to_le16(0);
 453                 hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
 454         }
 455
 456         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
 457                 struct hci_cp_sniff_mode cp;
 458                 cp.handle       = cpu_to_le16(conn->handle);
 459                 cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
 460                 cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
 461                 cp.attempt      = cpu_to_le16(4);
 462                 cp.timeout      = cpu_to_le16(1);
 463                 hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
 464         }
 465 }
 466
 467 static void hci_conn_auto_accept(struct work_struct *work)
 468 {
 469         struct hci_conn *conn = container_of(work, struct hci_conn,
 470                                              auto_accept_work.work);
 471
 472         hci_send_cmd(conn->hdev, HCI_OP_USER_CONFIRM_REPLY, sizeof(conn->dst),
 473                      &conn->dst);
 474 }
 475
 476 static void le_disable_advertising(struct hci_dev *hdev)
 477 {
 478         if (ext_adv_capable(hdev)) {
 479                 struct hci_cp_le_set_ext_adv_enable cp;
 480
 481                 cp.enable = 0x00;
 482                 cp.num_of_sets = 0x00;
 483
 484                 hci_send_cmd(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE, sizeof(cp),
 485                              &cp);
 486         } else {
 487                 u8 enable = 0x00;
 488                 hci_send_cmd(hdev, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable),
 489                              &enable);
 490         }
 491 }
 492
 493 static void le_conn_timeout(struct work_struct *work)
 494 {
 495         struct hci_conn *conn = container_of(work, struct hci_conn,
 496                                              le_conn_timeout.work);
 497         struct hci_dev *hdev = conn->hdev;
 498
 499         BT_DBG("");
 500
 501         /* We could end up here due to having done directed advertising,
 502          * so clean up the state if necessary. This should however only
 503          * happen with broken hardware or if low duty cycle was used
 504          * (which doesn't have a timeout of its own).
 505          */
 506         if (conn->role == HCI_ROLE_SLAVE) {
 507                 /* Disable LE Advertising */
 508                 le_disable_advertising(hdev);
 509                 hci_dev_lock(hdev);
 510                 hci_le_conn_failed(conn, HCI_ERROR_ADVERTISING_TIMEOUT);
 511                 hci_dev_unlock(hdev);
 512                 return;
 513         }
 514
 515         hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
 516 }
 517
 518 struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst,
 519                               u8 role)
 520 {
 521         struct hci_conn *conn;
 522
 523         BT_DBG("%s dst %pMR", hdev->name, dst);
 524
 525         conn = kzalloc(sizeof(*conn), GFP_KERNEL);
 526         if (!conn)
 527                 return NULL;
 528
 529         bacpy(&conn->dst, dst);
 530         bacpy(&conn->src, &hdev->bdaddr);
 531         conn->hdev  = hdev;
 532         conn->type  = type;
 533         conn->role  = role;
 534         conn->mode  = HCI_CM_ACTIVE;
 535         conn->state = BT_OPEN;
 536         conn->auth_type = HCI_AT_GENERAL_BONDING;
 537         conn->io_capability = hdev->io_capability;
 538         conn->remote_auth = 0xff;
 539         conn->key_type = 0xff;
 540         conn->rssi = HCI_RSSI_INVALID;
 541         conn->tx_power = HCI_TX_POWER_INVALID;
 542         conn->max_tx_power = HCI_TX_POWER_INVALID;
 543
 544         set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
 545         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
 546
 547         /* Set Default Authenticated payload timeout to 30s */
 548         conn->auth_payload_timeout = DEFAULT_AUTH_PAYLOAD_TIMEOUT;
 549
 550         if (conn->role == HCI_ROLE_MASTER)
 551                 conn->out = true;
 552
 553         switch (type) {
 554         case ACL_LINK:
 555                 conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
 556                 break;
 557         case LE_LINK:
 558                 /* conn->src should reflect the local identity address */
 559                 hci_copy_identity_address(hdev, &conn->src, &conn->src_type);
 560                 break;
 561         case SCO_LINK:
 562                 if (lmp_esco_capable(hdev))
 563                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
 564                                         (hdev->esco_type & EDR_ESCO_MASK);
 565                 else
 566                         conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
 567                 break;
 568         case ESCO_LINK:
 569                 conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
 570                 break;
 571         }
 572
 573         skb_queue_head_init(&conn->data_q);
 574
 575         INIT_LIST_HEAD(&conn->chan_list);
 576
 577         INIT_DELAYED_WORK(&conn->disc_work, hci_conn_timeout);
 578         INIT_DELAYED_WORK(&conn->auto_accept_work, hci_conn_auto_accept);
 579         INIT_DELAYED_WORK(&conn->idle_work, hci_conn_idle);
 580         INIT_DELAYED_WORK(&conn->le_conn_timeout, le_conn_timeout);
 581         INIT_WORK(&conn->le_scan_cleanup, le_scan_cleanup);
 582
 583         atomic_set(&conn->refcnt, 0);
 584
 585         hci_dev_hold(hdev);
 586
 587         hci_conn_hash_add(hdev, conn);
 588
 589         /* The SCO and eSCO connections will only be notified when their
 590          * setup has been completed. This is different to ACL links which
 591          * can be notified right away.
 592          */
 593         if (conn->type != SCO_LINK && conn->type != ESCO_LINK) {
 594                 if (hdev->notify)
 595                         hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
 596         }
 597
 598         hci_conn_init_sysfs(conn);
 599
 600         return conn;
 601 }
 602
 603 int hci_conn_del(struct hci_conn *conn)
 604 {
 605         struct hci_dev *hdev = conn->hdev;
 606
 607         BT_DBG("%s hcon %p handle %d", hdev->name, conn, conn->handle);
 608
 609         cancel_delayed_work_sync(&conn->disc_work);
 610         cancel_delayed_work_sync(&conn->auto_accept_work);
 611         cancel_delayed_work_sync(&conn->idle_work);
 612
 613         if (conn->type == ACL_LINK) {
 614                 struct hci_conn *sco = conn->link;
 615                 if (sco)
 616                         sco->link = NULL;
 617
 618                 /* Unacked frames */
 619                 hdev->acl_cnt += conn->sent;
 620         } else if (conn->type == LE_LINK) {
 621                 cancel_delayed_work(&conn->le_conn_timeout);
 622
 623                 if (hdev->le_pkts)
 624                         hdev->le_cnt += conn->sent;
 625                 else
 626                         hdev->acl_cnt += conn->sent;
 627         } else {
 628                 struct hci_conn *acl = conn->link;
 629                 if (acl) {
 630                         acl->link = NULL;
 631                         hci_conn_drop(acl);
 632                 }
 633         }
 634
 635         if (conn->amp_mgr)
 636                 amp_mgr_put(conn->amp_mgr);
 637
 638         skb_queue_purge(&conn->data_q);
 639
 640         /* Remove the connection from the list and cleanup its remaining
 641          * state. This is a separate function since for some cases like
 642          * BT_CONNECT_SCAN we *only* want the cleanup part without the
 643          * rest of hci_conn_del.
 644          */
 645         hci_conn_cleanup(conn);
 646
 647         return 0;
 648 }
 649
 650 struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src, uint8_t src_type)
 651 {
 652         int use_src = bacmp(src, BDADDR_ANY);
 653         struct hci_dev *hdev = NULL, *d;
 654
 655         BT_DBG("%pMR -> %pMR", src, dst);
 656
 657         read_lock(&hci_dev_list_lock);
 658
 659         list_for_each_entry(d, &hci_dev_list, list) {
 660                 if (!test_bit(HCI_UP, &d->flags) ||
 661                     hci_dev_test_flag(d, HCI_USER_CHANNEL) ||
 662                     d->dev_type != HCI_PRIMARY)
 663                         continue;
 664
 665                 /* Simple routing:
 666                  *   No source address - find interface with bdaddr != dst
 667                  *   Source address    - find interface with bdaddr == src
 668                  */
 669
 670                 if (use_src) {
 671                         bdaddr_t id_addr;
 672                         u8 id_addr_type;
 673
 674                         if (src_type == BDADDR_BREDR) {
 675                                 if (!lmp_bredr_capable(d))
 676                                         continue;
 677                                 bacpy(&id_addr, &d->bdaddr);
 678                                 id_addr_type = BDADDR_BREDR;
 679                         } else {
 680                                 if (!lmp_le_capable(d))
 681                                         continue;
 682
 683                                 hci_copy_identity_address(d, &id_addr,
 684                                                           &id_addr_type);
 685
 686                                 /* Convert from HCI to three-value type */
 687                                 if (id_addr_type == ADDR_LE_DEV_PUBLIC)
 688                                         id_addr_type = BDADDR_LE_PUBLIC;
 689                                 else
 690                                         id_addr_type = BDADDR_LE_RANDOM;
 691                         }
 692
 693                         if (!bacmp(&id_addr, src) && id_addr_type == src_type) {
 694                                 hdev = d; break;
 695                         }
 696                 } else {
 697                         if (bacmp(&d->bdaddr, dst)) {
 698                                 hdev = d; break;
 699                         }
 700                 }
 701         }
 702
 703         if (hdev)
 704                 hdev = hci_dev_hold(hdev);
 705
 706         read_unlock(&hci_dev_list_lock);
 707         return hdev;
 708 }
 709 EXPORT_SYMBOL(hci_get_route);
 710
 711 /* This function requires the caller holds hdev->lock */
 712 void hci_le_conn_failed(struct hci_conn *conn, u8 status)
 713 {
 714         struct hci_dev *hdev = conn->hdev;
 715         struct hci_conn_params *params;
 716
 717         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
 718                                            conn->dst_type);
 719         if (params && params->conn) {
 720                 hci_conn_drop(params->conn);
 721                 hci_conn_put(params->conn);
 722                 params->conn = NULL;
 723         }
 724
 725         conn->state = BT_CLOSED;
 726
 727         /* If the status indicates successful cancellation of
 728          * the attempt (i.e. Unkown Connection Id) there's no point of
 729          * notifying failure since we'll go back to keep trying to
 730          * connect. The only exception is explicit connect requests
 731          * where a timeout + cancel does indicate an actual failure.
 732          */
 733         if (status != HCI_ERROR_UNKNOWN_CONN_ID ||
 734             (params && params->explicit_connect))
 735                 mgmt_connect_failed(hdev, &conn->dst, conn->type,
 736                                     conn->dst_type, status);
 737
 738         hci_connect_cfm(conn, status);
 739
 740         hci_conn_del(conn);
 741
 742         /* Since we may have temporarily stopped the background scanning in
 743          * favor of connection establishment, we should restart it.
 744          */
 745         hci_update_background_scan(hdev);
 746
 747         /* Re-enable advertising in case this was a failed connection
 748          * attempt as a peripheral.
 749          */
 750         hci_req_reenable_advertising(hdev);
 751 }
 752
 753 static void create_le_conn_complete(struct hci_dev *hdev, u8 status, u16 opcode)
 754 {
 755         struct hci_conn *conn;
 756
 757         hci_dev_lock(hdev);
 758
 759         conn = hci_lookup_le_connect(hdev);
 760
 761         if (!status) {
 762                 hci_connect_le_scan_cleanup(conn);
 763                 goto done;
 764         }
 765
 766         bt_dev_err(hdev, "request failed to create LE connection: "
 767                    "status 0x%2.2x", status);
 768
 769         if (!conn)
 770                 goto done;
 771
 772         hci_le_conn_failed(conn, status);
 773
 774 done:
 775         hci_dev_unlock(hdev);
 776 }
 777
 778 static bool conn_use_rpa(struct hci_conn *conn)
 779 {
 780         struct hci_dev *hdev = conn->hdev;
 781
 782         return hci_dev_test_flag(hdev, HCI_PRIVACY);
 783 }
 784
 785 static void set_ext_conn_params(struct hci_conn *conn,
 786                                 struct hci_cp_le_ext_conn_param *p)
 787 {
 788         struct hci_dev *hdev = conn->hdev;
 789
 790         memset(p, 0, sizeof(*p));
 791
 792         p->scan_interval = cpu_to_le16(hdev->le_scan_int_connect);
 793         p->scan_window = cpu_to_le16(hdev->le_scan_window_connect);
 794         p->conn_interval_min = cpu_to_le16(conn->le_conn_min_interval);
 795         p->conn_interval_max = cpu_to_le16(conn->le_conn_max_interval);
 796         p->conn_latency = cpu_to_le16(conn->le_conn_latency);
 797         p->supervision_timeout = cpu_to_le16(conn->le_supv_timeout);
 798         p->min_ce_len = cpu_to_le16(0x0000);
 799         p->max_ce_len = cpu_to_le16(0x0000);
 800 }
 801
 802 static void hci_req_add_le_create_conn(struct hci_request *req,
 803                                        struct hci_conn *conn,
 804                                        bdaddr_t *direct_rpa)
 805 {
 806         struct hci_dev *hdev = conn->hdev;
 807         u8 own_addr_type;
 808
 809         /* If direct address was provided we use it instead of current
 810          * address.
 811          */
 812         if (direct_rpa) {
 813                 if (bacmp(&req->hdev->random_addr, direct_rpa))
 814                         hci_req_add(req, HCI_OP_LE_SET_RANDOM_ADDR, 6,
 815                                                                 direct_rpa);
 816
 817                 /* direct address is always RPA */
 818                 own_addr_type = ADDR_LE_DEV_RANDOM;
 819         } else {
 820                 /* Update random address, but set require_privacy to false so
 821                  * that we never connect with an non-resolvable address.
 822                  */
 823                 if (hci_update_random_address(req, false, conn_use_rpa(conn),
 824                                               &own_addr_type))
 825                         return;
 826         }
 827
 828         if (use_ext_conn(hdev)) {
 829                 struct hci_cp_le_ext_create_conn *cp;
 830                 struct hci_cp_le_ext_conn_param *p;
 831                 u8 data[sizeof(*cp) + sizeof(*p) * 3];
 832                 u32 plen;
 833
 834                 cp = (void *) data;
 835                 p = (void *) cp->data;
 836
 837                 memset(cp, 0, sizeof(*cp));
 838
 839                 bacpy(&cp->peer_addr, &conn->dst);
 840                 cp->peer_addr_type = conn->dst_type;
 841                 cp->own_addr_type = own_addr_type;
 842
 843                 plen = sizeof(*cp);
 844
 845                 if (scan_1m(hdev)) {
 846                         cp->phys |= LE_SCAN_PHY_1M;
 847                         set_ext_conn_params(conn, p);
 848
 849                         p++;
 850                         plen += sizeof(*p);
 851                 }
 852
 853                 if (scan_2m(hdev)) {
 854                         cp->phys |= LE_SCAN_PHY_2M;
 855                         set_ext_conn_params(conn, p);
 856
 857                         p++;
 858                         plen += sizeof(*p);
 859                 }
 860
 861                 if (scan_coded(hdev)) {
 862                         cp->phys |= LE_SCAN_PHY_CODED;
 863                         set_ext_conn_params(conn, p);
 864
 865                         plen += sizeof(*p);
 866                 }
 867
 868                 hci_req_add(req, HCI_OP_LE_EXT_CREATE_CONN, plen, data);
 869
 870         } else {
 871                 struct hci_cp_le_create_conn cp;
 872
 873                 memset(&cp, 0, sizeof(cp));
 874
 875                 cp.scan_interval = cpu_to_le16(hdev->le_scan_int_connect);
 876                 cp.scan_window = cpu_to_le16(hdev->le_scan_window_connect);
 877
 878                 bacpy(&cp.peer_addr, &conn->dst);
 879                 cp.peer_addr_type = conn->dst_type;
 880                 cp.own_address_type = own_addr_type;
 881                 cp.conn_interval_min = cpu_to_le16(conn->le_conn_min_interval);
 882                 cp.conn_interval_max = cpu_to_le16(conn->le_conn_max_interval);
 883                 cp.conn_latency = cpu_to_le16(conn->le_conn_latency);
 884                 cp.supervision_timeout = cpu_to_le16(conn->le_supv_timeout);
 885                 cp.min_ce_len = cpu_to_le16(0x0000);
 886                 cp.max_ce_len = cpu_to_le16(0x0000);
 887
 888                 hci_req_add(req, HCI_OP_LE_CREATE_CONN, sizeof(cp), &cp);
 889         }
 890
 891         conn->state = BT_CONNECT;
 892         clear_bit(HCI_CONN_SCANNING, &conn->flags);
 893 }
 894
 895 static void hci_req_directed_advertising(struct hci_request *req,
 896                                          struct hci_conn *conn)
 897 {
 898         struct hci_dev *hdev = req->hdev;
 899         u8 own_addr_type;
 900         u8 enable;
 901
 902         if (ext_adv_capable(hdev)) {
 903                 struct hci_cp_le_set_ext_adv_params cp;
 904                 bdaddr_t random_addr;
 905
 906                 /* Set require_privacy to false so that the remote device has a
 907                  * chance of identifying us.
 908                  */
 909                 if (hci_get_random_address(hdev, false, conn_use_rpa(conn), NULL,
 910                                            &own_addr_type, &random_addr) < 0)
 911                         return;
 912
 913                 memset(&cp, 0, sizeof(cp));
 914
 915                 cp.evt_properties = cpu_to_le16(LE_LEGACY_ADV_DIRECT_IND);
 916                 cp.own_addr_type = own_addr_type;
 917                 cp.channel_map = hdev->le_adv_channel_map;
 918                 cp.tx_power = HCI_TX_POWER_INVALID;
 919                 cp.primary_phy = HCI_ADV_PHY_1M;
 920                 cp.secondary_phy = HCI_ADV_PHY_1M;
 921                 cp.handle = 0; /* Use instance 0 for directed adv */
 922                 cp.own_addr_type = own_addr_type;
 923                 cp.peer_addr_type = conn->dst_type;
 924                 bacpy(&cp.peer_addr, &conn->dst);
 925
 926                 /* As per Core Spec 5.2 Vol 2, PART E, Sec 7.8.53, for
 927                  * advertising_event_property LE_LEGACY_ADV_DIRECT_IND
 928                  * does not supports advertising data when the advertising set already
 929                  * contains some, the controller shall return erroc code 'Invalid
 930                  * HCI Command Parameters(0x12).
 931                  * So it is required to remove adv set for handle 0x00. since we use
 932                  * instance 0 for directed adv.
 933                  */
 934                 __hci_req_remove_ext_adv_instance(req, cp.handle);
 935
 936                 hci_req_add(req, HCI_OP_LE_SET_EXT_ADV_PARAMS, sizeof(cp), &cp);
 937
 938                 if (own_addr_type == ADDR_LE_DEV_RANDOM &&
 939                     bacmp(&random_addr, BDADDR_ANY) &&
 940                     bacmp(&random_addr, &hdev->random_addr)) {
 941                         struct hci_cp_le_set_adv_set_rand_addr cp;
 942
 943                         memset(&cp, 0, sizeof(cp));
 944
 945                         cp.handle = 0;
 946                         bacpy(&cp.bdaddr, &random_addr);
 947
 948                         hci_req_add(req,
 949                                     HCI_OP_LE_SET_ADV_SET_RAND_ADDR,
 950                                     sizeof(cp), &cp);
 951                 }
 952
 953                 __hci_req_enable_ext_advertising(req, 0x00);
 954         } else {
 955                 struct hci_cp_le_set_adv_param cp;
 956
 957                 /* Clear the HCI_LE_ADV bit temporarily so that the
 958                  * hci_update_random_address knows that it's safe to go ahead
 959                  * and write a new random address. The flag will be set back on
 960                  * as soon as the SET_ADV_ENABLE HCI command completes.
 961                  */
 962                 hci_dev_clear_flag(hdev, HCI_LE_ADV);
 963
 964                 /* Set require_privacy to false so that the remote device has a
 965                  * chance of identifying us.
 966                  */
 967                 if (hci_update_random_address(req, false, conn_use_rpa(conn),
 968                                               &own_addr_type) < 0)
 969                         return;
 970
 971                 memset(&cp, 0, sizeof(cp));
 972
 973                 /* Some controllers might reject command if intervals are not
 974                  * within range for undirected advertising.
 975                  * BCM20702A0 is known to be affected by this.
 976                  */
 977                 cp.min_interval = cpu_to_le16(0x0020);
 978                 cp.max_interval = cpu_to_le16(0x0020);
 979
 980                 cp.type = LE_ADV_DIRECT_IND;
 981                 cp.own_address_type = own_addr_type;
 982                 cp.direct_addr_type = conn->dst_type;
 983                 bacpy(&cp.direct_addr, &conn->dst);
 984                 cp.channel_map = hdev->le_adv_channel_map;
 985
 986                 hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
 987
 988                 enable = 0x01;
 989                 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable),
 990                             &enable);
 991         }
 992
 993         conn->state = BT_CONNECT;
 994 }
 995
 996 struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,
 997                                 u8 dst_type, u8 sec_level, u16 conn_timeout,
 998                                 u8 role, bdaddr_t *direct_rpa)
 999 {
1000         struct hci_conn_params *params;
1001         struct hci_conn *conn;
1002         struct smp_irk *irk;
1003         struct hci_request req;
1004         int err;
1005
1006         /* This ensures that during disable le_scan address resolution
1007          * will not be disabled if it is followed by le_create_conn
1008          */
1009         bool rpa_le_conn = true;
1010
1011         /* Let's make sure that le is enabled.*/
1012         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1013                 if (lmp_le_capable(hdev))
1014                         return ERR_PTR(-ECONNREFUSED);
1015
1016                 return ERR_PTR(-EOPNOTSUPP);
1017         }
1018
1019         /* Since the controller supports only one LE connection attempt at a
1020          * time, we return -EBUSY if there is any connection attempt running.
1021          */
1022         if (hci_lookup_le_connect(hdev))
1023                 return ERR_PTR(-EBUSY);
1024
1025         /* If there's already a connection object but it's not in
1026          * scanning state it means it must already be established, in
1027          * which case we can't do anything else except report a failure
1028          * to connect.
1029          */
1030         conn = hci_conn_hash_lookup_le(hdev, dst, dst_type);
1031         if (conn && !test_bit(HCI_CONN_SCANNING, &conn->flags)) {
1032                 return ERR_PTR(-EBUSY);
1033         }
1034
1035         /* When given an identity address with existing identity
1036          * resolving key, the connection needs to be established
1037          * to a resolvable random address.
1038          *
1039          * Storing the resolvable random address is required here
1040          * to handle connection failures. The address will later
1041          * be resolved back into the original identity address
1042          * from the connect request.
1043          */
1044         irk = hci_find_irk_by_addr(hdev, dst, dst_type);
1045         if (irk && bacmp(&irk->rpa, BDADDR_ANY)) {
1046                 dst = &irk->rpa;
1047                 dst_type = ADDR_LE_DEV_RANDOM;
1048         }
1049
1050         if (conn) {
1051                 bacpy(&conn->dst, dst);
1052         } else {
1053                 conn = hci_conn_add(hdev, LE_LINK, dst, role);
1054                 if (!conn)
1055                         return ERR_PTR(-ENOMEM);
1056                 hci_conn_hold(conn);
1057                 conn->pending_sec_level = sec_level;
1058         }
1059
1060         conn->dst_type = dst_type;
1061         conn->sec_level = BT_SECURITY_LOW;
1062         conn->conn_timeout = conn_timeout;
1063
1064         hci_req_init(&req, hdev);
1065
1066         /* Disable advertising if we're active. For central role
1067          * connections most controllers will refuse to connect if
1068          * advertising is enabled, and for peripheral role connections we
1069          * anyway have to disable it in order to start directed
1070          * advertising.
1071          */
1072         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1073                  __hci_req_disable_advertising(&req);
1074
1075         /* If requested to connect as peripheral use directed advertising */
1076         if (conn->role == HCI_ROLE_SLAVE) {
1077                 /* If we're active scanning most controllers are unable
1078                  * to initiate advertising. Simply reject the attempt.
1079                  */
1080                 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
1081                     hdev->le_scan_type == LE_SCAN_ACTIVE) {
1082                         hci_req_purge(&req);
1083                         hci_conn_del(conn);
1084                         return ERR_PTR(-EBUSY);
1085                 }
1086
1087                 hci_req_directed_advertising(&req, conn);
1088                 goto create_conn;
1089         }
1090
1091         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
1092         if (params) {
1093                 conn->le_conn_min_interval = params->conn_min_interval;
1094                 conn->le_conn_max_interval = params->conn_max_interval;
1095                 conn->le_conn_latency = params->conn_latency;
1096                 conn->le_supv_timeout = params->supervision_timeout;
1097         } else {
1098                 conn->le_conn_min_interval = hdev->le_conn_min_interval;
1099                 conn->le_conn_max_interval = hdev->le_conn_max_interval;
1100                 conn->le_conn_latency = hdev->le_conn_latency;
1101                 conn->le_supv_timeout = hdev->le_supv_timeout;
1102         }
1103
1104         /* If controller is scanning, we stop it since some controllers are
1105          * not able to scan and connect at the same time. Also set the
1106          * HCI_LE_SCAN_INTERRUPTED flag so that the command complete
1107          * handler for scan disabling knows to set the correct discovery
1108          * state.
1109          */
1110         if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
1111                 hci_req_add_le_scan_disable(&req, rpa_le_conn);
1112                 hci_dev_set_flag(hdev, HCI_LE_SCAN_INTERRUPTED);
1113         }
1114
1115         hci_req_add_le_create_conn(&req, conn, direct_rpa);
1116
1117 create_conn:
1118         err = hci_req_run(&req, create_le_conn_complete);
1119         if (err) {
1120                 hci_conn_del(conn);
1121                 return ERR_PTR(err);
1122         }
1123
1124         return conn;
1125 }
1126
1127 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
1128 {
1129         struct hci_conn *conn;
1130
1131         conn = hci_conn_hash_lookup_le(hdev, addr, type);
1132         if (!conn)
1133                 return false;
1134
1135         if (conn->state != BT_CONNECTED)
1136                 return false;
1137
1138         return true;
1139 }
1140
1141 /* This function requires the caller holds hdev->lock */
1142 static int hci_explicit_conn_params_set(struct hci_dev *hdev,
1143                                         bdaddr_t *addr, u8 addr_type)
1144 {
1145         struct hci_conn_params *params;
1146
1147         if (is_connected(hdev, addr, addr_type))
1148                 return -EISCONN;
1149
1150         params = hci_conn_params_lookup(hdev, addr, addr_type);
1151         if (!params) {
1152                 params = hci_conn_params_add(hdev, addr, addr_type);
1153                 if (!params)
1154                         return -ENOMEM;
1155
1156                 /* If we created new params, mark them to be deleted in
1157                  * hci_connect_le_scan_cleanup. It's different case than
1158                  * existing disabled params, those will stay after cleanup.
1159                  */
1160                 params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
1161         }
1162
1163         /* We're trying to connect, so make sure params are at pend_le_conns */
1164         if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
1165             params->auto_connect == HCI_AUTO_CONN_REPORT ||
1166             params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
1167                 list_del_init(&params->action);
1168                 list_add(&params->action, &hdev->pend_le_conns);
1169         }
1170
1171         params->explicit_connect = true;
1172
1173         BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
1174                params->auto_connect);
1175
1176         return 0;
1177 }
1178
1179 /* This function requires the caller holds hdev->lock */
1180 struct hci_conn *hci_connect_le_scan(struct hci_dev *hdev, bdaddr_t *dst,
1181                                      u8 dst_type, u8 sec_level,
1182                                      u16 conn_timeout,
1183                                      enum conn_reasons conn_reason)
1184 {
1185         struct hci_conn *conn;
1186
1187         /* Let's make sure that le is enabled.*/
1188         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1189                 if (lmp_le_capable(hdev))
1190                         return ERR_PTR(-ECONNREFUSED);
1191
1192                 return ERR_PTR(-EOPNOTSUPP);
1193         }
1194
1195         /* Some devices send ATT messages as soon as the physical link is
1196          * established. To be able to handle these ATT messages, the user-
1197          * space first establishes the connection and then starts the pairing
1198          * process.
1199          *
1200          * So if a hci_conn object already exists for the following connection
1201          * attempt, we simply update pending_sec_level and auth_type fields
1202          * and return the object found.
1203          */
1204         conn = hci_conn_hash_lookup_le(hdev, dst, dst_type);
1205         if (conn) {
1206                 if (conn->pending_sec_level < sec_level)
1207                         conn->pending_sec_level = sec_level;
1208                 goto done;
1209         }
1210
1211         BT_DBG("requesting refresh of dst_addr");
1212
1213         conn = hci_conn_add(hdev, LE_LINK, dst, HCI_ROLE_MASTER);
1214         if (!conn)
1215                 return ERR_PTR(-ENOMEM);
1216
1217         if (hci_explicit_conn_params_set(hdev, dst, dst_type) < 0) {
1218                 hci_conn_del(conn);
1219                 return ERR_PTR(-EBUSY);
1220         }
1221
1222         conn->state = BT_CONNECT;
1223         set_bit(HCI_CONN_SCANNING, &conn->flags);
1224         conn->dst_type = dst_type;
1225         conn->sec_level = BT_SECURITY_LOW;
1226         conn->pending_sec_level = sec_level;
1227         conn->conn_timeout = conn_timeout;
1228         conn->conn_reason = conn_reason;
1229
1230         hci_update_background_scan(hdev);
1231
1232 done:
1233         hci_conn_hold(conn);
1234         return conn;
1235 }
1236
1237 struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst,
1238                                  u8 sec_level, u8 auth_type,
1239                                  enum conn_reasons conn_reason)
1240 {
1241         struct hci_conn *acl;
1242
1243         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1244                 if (lmp_bredr_capable(hdev))
1245                         return ERR_PTR(-ECONNREFUSED);
1246
1247                 return ERR_PTR(-EOPNOTSUPP);
1248         }
1249
1250         /* Reject outgoing connection to device with same BD ADDR against
1251          * CVE-2020-26555
1252          */
1253         if (!bacmp(&hdev->bdaddr, dst)) {
1254                 bt_dev_dbg(hdev, "Reject connection with same BD_ADDR %pMR\n",
1255                            dst);
1256                 return ERR_PTR(-ECONNREFUSED);
1257         }
1258
1259         acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
1260         if (!acl) {
1261                 acl = hci_conn_add(hdev, ACL_LINK, dst, HCI_ROLE_MASTER);
1262                 if (!acl)
1263                         return ERR_PTR(-ENOMEM);
1264         }
1265
1266         hci_conn_hold(acl);
1267
1268         acl->conn_reason = conn_reason;
1269         if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
1270                 acl->sec_level = BT_SECURITY_LOW;
1271                 acl->pending_sec_level = sec_level;
1272                 acl->auth_type = auth_type;
1273                 hci_acl_create_connection(acl);
1274         }
1275
1276         return acl;
1277 }
1278
1279 struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type, bdaddr_t *dst,
1280                                  __u16 setting)
1281 {
1282         struct hci_conn *acl;
1283         struct hci_conn *sco;
1284
1285         acl = hci_connect_acl(hdev, dst, BT_SECURITY_LOW, HCI_AT_NO_BONDING,
1286                               CONN_REASON_SCO_CONNECT);
1287         if (IS_ERR(acl))
1288                 return acl;
1289
1290         sco = hci_conn_hash_lookup_ba(hdev, type, dst);
1291         if (!sco) {
1292                 sco = hci_conn_add(hdev, type, dst, HCI_ROLE_MASTER);
1293                 if (!sco) {
1294                         hci_conn_drop(acl);
1295                         return ERR_PTR(-ENOMEM);
1296                 }
1297         }
1298
1299         acl->link = sco;
1300         sco->link = acl;
1301
1302         hci_conn_hold(sco);
1303
1304         sco->setting = setting;
1305
1306         if (acl->state == BT_CONNECTED &&
1307             (sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
1308                 set_bit(HCI_CONN_POWER_SAVE, &acl->flags);
1309                 hci_conn_enter_active_mode(acl, BT_POWER_FORCE_ACTIVE_ON);
1310
1311                 if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->flags)) {
1312                         /* defer SCO setup until mode change completed */
1313                         set_bit(HCI_CONN_SCO_SETUP_PEND, &acl->flags);
1314                         return sco;
1315                 }
1316
1317                 hci_sco_setup(acl, 0x00);
1318         }
1319
1320         return sco;
1321 }
1322
1323 /* Check link security requirement */
1324 int hci_conn_check_link_mode(struct hci_conn *conn)
1325 {
1326         BT_DBG("hcon %p", conn);
1327
1328         /* In Secure Connections Only mode, it is required that Secure
1329          * Connections is used and the link is encrypted with AES-CCM
1330          * using a P-256 authenticated combination key.
1331          */
1332         if (hci_dev_test_flag(conn->hdev, HCI_SC_ONLY)) {
1333                 if (!hci_conn_sc_enabled(conn) ||
1334                     !test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
1335                     conn->key_type != HCI_LK_AUTH_COMBINATION_P256)
1336                         return 0;
1337         }
1338
1339          /* AES encryption is required for Level 4:
1340           *
1341           * BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 3, Part C
1342           * page 1319:
1343           *
1344           * 128-bit equivalent strength for link and encryption keys
1345           * required using FIPS approved algorithms (E0 not allowed,
1346           * SAFER+ not allowed, and P-192 not allowed; encryption key
1347           * not shortened)
1348           */
1349         if (conn->sec_level == BT_SECURITY_FIPS &&
1350             !test_bit(HCI_CONN_AES_CCM, &conn->flags)) {
1351                 bt_dev_err(conn->hdev,
1352                            "Invalid security: Missing AES-CCM usage");
1353                 return 0;
1354         }
1355
1356         if (hci_conn_ssp_enabled(conn) &&
1357             !test_bit(HCI_CONN_ENCRYPT, &conn->flags))
1358                 return 0;
1359
1360         return 1;
1361 }
1362
1363 /* Authenticate remote device */
1364 static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
1365 {
1366         BT_DBG("hcon %p", conn);
1367
1368         if (conn->pending_sec_level > sec_level)
1369                 sec_level = conn->pending_sec_level;
1370
1371         if (sec_level > conn->sec_level)
1372                 conn->pending_sec_level = sec_level;
1373         else if (test_bit(HCI_CONN_AUTH, &conn->flags))
1374                 return 1;
1375
1376         /* Make sure we preserve an existing MITM requirement*/
1377         auth_type |= (conn->auth_type & 0x01);
1378
1379         conn->auth_type = auth_type;
1380
1381         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
1382                 struct hci_cp_auth_requested cp;
1383
1384                 cp.handle = cpu_to_le16(conn->handle);
1385                 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
1386                              sizeof(cp), &cp);
1387
1388                 /* Set the ENCRYPT_PEND to trigger encryption after
1389                  * authentication.
1390                  */
1391                 if (!test_bit(HCI_CONN_ENCRYPT, &conn->flags))
1392                         set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
1393         }
1394
1395         return 0;
1396 }
1397
1398 /* Encrypt the link */
1399 static void hci_conn_encrypt(struct hci_conn *conn)
1400 {
1401         BT_DBG("hcon %p", conn);
1402
1403         if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
1404                 struct hci_cp_set_conn_encrypt cp;
1405                 cp.handle  = cpu_to_le16(conn->handle);
1406                 cp.encrypt = 0x01;
1407                 hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
1408                              &cp);
1409         }
1410 }
1411
1412 /* Enable security */
1413 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type,
1414                       bool initiator)
1415 {
1416         BT_DBG("hcon %p", conn);
1417
1418         if (conn->type == LE_LINK)
1419                 return smp_conn_security(conn, sec_level);
1420
1421         /* For sdp we don't need the link key. */
1422         if (sec_level == BT_SECURITY_SDP)
1423                 return 1;
1424
1425         /* For non 2.1 devices and low security level we don't need the link
1426            key. */
1427         if (sec_level == BT_SECURITY_LOW && !hci_conn_ssp_enabled(conn))
1428                 return 1;
1429
1430         /* For other security levels we need the link key. */
1431         if (!test_bit(HCI_CONN_AUTH, &conn->flags))
1432                 goto auth;
1433
1434         switch (conn->key_type) {
1435         case HCI_LK_AUTH_COMBINATION_P256:
1436                 /* An authenticated FIPS approved combination key has
1437                  * sufficient security for security level 4 or lower.
1438                  */
1439                 if (sec_level <= BT_SECURITY_FIPS)
1440                         goto encrypt;
1441                 break;
1442         case HCI_LK_AUTH_COMBINATION_P192:
1443                 /* An authenticated combination key has sufficient security for
1444                  * security level 3 or lower.
1445                  */
1446                 if (sec_level <= BT_SECURITY_HIGH)
1447                         goto encrypt;
1448                 break;
1449         case HCI_LK_UNAUTH_COMBINATION_P192:
1450         case HCI_LK_UNAUTH_COMBINATION_P256:
1451                 /* An unauthenticated combination key has sufficient security
1452                  * for security level 2 or lower.
1453                  */
1454                 if (sec_level <= BT_SECURITY_MEDIUM)
1455                         goto encrypt;
1456                 break;
1457         case HCI_LK_COMBINATION:
1458                 /* A combination key has always sufficient security for the
1459                  * security levels 2 or lower. High security level requires the
1460                  * combination key is generated using maximum PIN code length
1461                  * (16). For pre 2.1 units.
1462                  */
1463                 if (sec_level <= BT_SECURITY_MEDIUM || conn->pin_length == 16)
1464                         goto encrypt;
1465                 break;
1466         default:
1467                 break;
1468         }
1469
1470 auth:
1471         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags))
1472                 return 0;
1473
1474         if (initiator)
1475                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
1476
1477         if (!hci_conn_auth(conn, sec_level, auth_type))
1478                 return 0;
1479
1480 encrypt:
1481         if (test_bit(HCI_CONN_ENCRYPT, &conn->flags)) {
1482                 /* Ensure that the encryption key size has been read,
1483                  * otherwise stall the upper layer responses.
1484                  */
1485                 if (!conn->enc_key_size)
1486                         return 0;
1487
1488                 /* Nothing else needed, all requirements are met */
1489                 return 1;
1490         }
1491
1492         hci_conn_encrypt(conn);
1493         return 0;
1494 }
1495 EXPORT_SYMBOL(hci_conn_security);
1496
1497 /* Check secure link requirement */
1498 int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level)
1499 {
1500         BT_DBG("hcon %p", conn);
1501
1502         /* Accept if non-secure or higher security level is required */
1503         if (sec_level != BT_SECURITY_HIGH && sec_level != BT_SECURITY_FIPS)
1504                 return 1;
1505
1506         /* Accept if secure or higher security level is already present */
1507         if (conn->sec_level == BT_SECURITY_HIGH ||
1508             conn->sec_level == BT_SECURITY_FIPS)
1509                 return 1;
1510
1511         /* Reject not secure link */
1512         return 0;
1513 }
1514 EXPORT_SYMBOL(hci_conn_check_secure);
1515
1516 /* Switch role */
1517 int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
1518 {
1519         BT_DBG("hcon %p", conn);
1520
1521         if (role == conn->role)
1522                 return 1;
1523
1524         if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->flags)) {
1525                 struct hci_cp_switch_role cp;
1526                 bacpy(&cp.bdaddr, &conn->dst);
1527                 cp.role = role;
1528                 hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
1529         }
1530
1531         return 0;
1532 }
1533 EXPORT_SYMBOL(hci_conn_switch_role);
1534
1535 /* Enter active mode */
1536 void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
1537 {
1538         struct hci_dev *hdev = conn->hdev;
1539
1540         BT_DBG("hcon %p mode %d", conn, conn->mode);
1541
1542         if (conn->mode != HCI_CM_SNIFF)
1543                 goto timer;
1544
1545         if (!test_bit(HCI_CONN_POWER_SAVE, &conn->flags) && !force_active)
1546                 goto timer;
1547
1548         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
1549                 struct hci_cp_exit_sniff_mode cp;
1550                 cp.handle = cpu_to_le16(conn->handle);
1551                 hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
1552         }
1553
1554 timer:
1555         if (hdev->idle_timeout > 0)
1556                 queue_delayed_work(hdev->workqueue, &conn->idle_work,
1557                                    msecs_to_jiffies(hdev->idle_timeout));
1558 }
1559
1560 /* Drop all connection on the device */
1561 void hci_conn_hash_flush(struct hci_dev *hdev)
1562 {
1563         struct hci_conn_hash *h = &hdev->conn_hash;
1564         struct hci_conn *c, *n;
1565
1566         BT_DBG("hdev %s", hdev->name);
1567
1568         list_for_each_entry_safe(c, n, &h->list, list) {
1569                 c->state = BT_CLOSED;
1570
1571                 hci_disconn_cfm(c, HCI_ERROR_LOCAL_HOST_TERM);
1572                 hci_conn_del(c);
1573         }
1574 }
1575
1576 /* Check pending connect attempts */
1577 void hci_conn_check_pending(struct hci_dev *hdev)
1578 {
1579         struct hci_conn *conn;
1580
1581         BT_DBG("hdev %s", hdev->name);
1582
1583         hci_dev_lock(hdev);
1584
1585         conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
1586         if (conn)
1587                 hci_acl_create_connection(conn);
1588
1589         hci_dev_unlock(hdev);
1590 }
1591
1592 static u32 get_link_mode(struct hci_conn *conn)
1593 {
1594         u32 link_mode = 0;
1595
1596         if (conn->role == HCI_ROLE_MASTER)
1597                 link_mode |= HCI_LM_MASTER;
1598
1599         if (test_bit(HCI_CONN_ENCRYPT, &conn->flags))
1600                 link_mode |= HCI_LM_ENCRYPT;
1601
1602         if (test_bit(HCI_CONN_AUTH, &conn->flags))
1603                 link_mode |= HCI_LM_AUTH;
1604
1605         if (test_bit(HCI_CONN_SECURE, &conn->flags))
1606                 link_mode |= HCI_LM_SECURE;
1607
1608         if (test_bit(HCI_CONN_FIPS, &conn->flags))
1609                 link_mode |= HCI_LM_FIPS;
1610
1611         return link_mode;
1612 }
1613
1614 int hci_get_conn_list(void __user *arg)
1615 {
1616         struct hci_conn *c;
1617         struct hci_conn_list_req req, *cl;
1618         struct hci_conn_info *ci;
1619         struct hci_dev *hdev;
1620         int n = 0, size, err;
1621
1622         if (copy_from_user(&req, arg, sizeof(req)))
1623                 return -EFAULT;
1624
1625         if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
1626                 return -EINVAL;
1627
1628         size = sizeof(req) + req.conn_num * sizeof(*ci);
1629
1630         cl = kmalloc(size, GFP_KERNEL);
1631         if (!cl)
1632                 return -ENOMEM;
1633
1634         hdev = hci_dev_get(req.dev_id);
1635         if (!hdev) {
1636                 kfree(cl);
1637                 return -ENODEV;
1638         }
1639
1640         ci = cl->conn_info;
1641
1642         hci_dev_lock(hdev);
1643         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1644                 bacpy(&(ci + n)->bdaddr, &c->dst);
1645                 (ci + n)->handle = c->handle;
1646                 (ci + n)->type  = c->type;
1647                 (ci + n)->out   = c->out;
1648                 (ci + n)->state = c->state;
1649                 (ci + n)->link_mode = get_link_mode(c);
1650                 if (++n >= req.conn_num)
1651                         break;
1652         }
1653         hci_dev_unlock(hdev);
1654
1655         cl->dev_id = hdev->id;
1656         cl->conn_num = n;
1657         size = sizeof(req) + n * sizeof(*ci);
1658
1659         hci_dev_put(hdev);
1660
1661         err = copy_to_user(arg, cl, size);
1662         kfree(cl);
1663
1664         return err ? -EFAULT : 0;
1665 }
1666
1667 int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
1668 {
1669         struct hci_conn_info_req req;
1670         struct hci_conn_info ci;
1671         struct hci_conn *conn;
1672         char __user *ptr = arg + sizeof(req);
1673
1674         if (copy_from_user(&req, arg, sizeof(req)))
1675                 return -EFAULT;
1676
1677         hci_dev_lock(hdev);
1678         conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
1679         if (conn) {
1680                 bacpy(&ci.bdaddr, &conn->dst);
1681                 ci.handle = conn->handle;
1682                 ci.type  = conn->type;
1683                 ci.out   = conn->out;
1684                 ci.state = conn->state;
1685                 ci.link_mode = get_link_mode(conn);
1686         }
1687         hci_dev_unlock(hdev);
1688
1689         if (!conn)
1690                 return -ENOENT;
1691
1692         return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
1693 }
1694
1695 int hci_get_auth_info(struct hci_dev *hdev, void __user *arg)
1696 {
1697         struct hci_auth_info_req req;
1698         struct hci_conn *conn;
1699
1700         if (copy_from_user(&req, arg, sizeof(req)))
1701                 return -EFAULT;
1702
1703         hci_dev_lock(hdev);
1704         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr);
1705         if (conn)
1706                 req.type = conn->auth_type;
1707         hci_dev_unlock(hdev);
1708
1709         if (!conn)
1710                 return -ENOENT;
1711
1712         return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0;
1713 }
1714
1715 struct hci_chan *hci_chan_create(struct hci_conn *conn)
1716 {
1717         struct hci_dev *hdev = conn->hdev;
1718         struct hci_chan *chan;
1719
1720         BT_DBG("%s hcon %p", hdev->name, conn);
1721
1722         if (test_bit(HCI_CONN_DROP, &conn->flags)) {
1723                 BT_DBG("Refusing to create new hci_chan");
1724                 return NULL;
1725         }
1726
1727         chan = kzalloc(sizeof(*chan), GFP_KERNEL);
1728         if (!chan)
1729                 return NULL;
1730
1731         chan->conn = hci_conn_get(conn);
1732         skb_queue_head_init(&chan->data_q);
1733         chan->state = BT_CONNECTED;
1734
1735         list_add_rcu(&chan->list, &conn->chan_list);
1736
1737         return chan;
1738 }
1739
1740 void hci_chan_del(struct hci_chan *chan)
1741 {
1742         struct hci_conn *conn = chan->conn;
1743         struct hci_dev *hdev = conn->hdev;
1744
1745         BT_DBG("%s hcon %p chan %p", hdev->name, conn, chan);
1746
1747         list_del_rcu(&chan->list);
1748
1749         synchronize_rcu();
1750
1751         /* Prevent new hci_chan's to be created for this hci_conn */
1752         set_bit(HCI_CONN_DROP, &conn->flags);
1753
1754         hci_conn_put(conn);
1755
1756         skb_queue_purge(&chan->data_q);
1757         kfree(chan);
1758 }
1759
1760 void hci_chan_list_flush(struct hci_conn *conn)
1761 {
1762         struct hci_chan *chan, *n;
1763
1764         BT_DBG("hcon %p", conn);
1765
1766         list_for_each_entry_safe(chan, n, &conn->chan_list, list)
1767                 hci_chan_del(chan);
1768 }
1769
1770 static struct hci_chan *__hci_chan_lookup_handle(struct hci_conn *hcon,
1771                                                  __u16 handle)
1772 {
1773         struct hci_chan *hchan;
1774
1775         list_for_each_entry(hchan, &hcon->chan_list, list) {
1776                 if (hchan->handle == handle)
1777                         return hchan;
1778         }
1779
1780         return NULL;
1781 }
1782
1783 struct hci_chan *hci_chan_lookup_handle(struct hci_dev *hdev, __u16 handle)
1784 {
1785         struct hci_conn_hash *h = &hdev->conn_hash;
1786         struct hci_conn *hcon;
1787         struct hci_chan *hchan = NULL;
1788
1789         rcu_read_lock();
1790
1791         list_for_each_entry_rcu(hcon, &h->list, list) {
1792                 hchan = __hci_chan_lookup_handle(hcon, handle);
1793                 if (hchan)
1794                         break;
1795         }
1796
1797         rcu_read_unlock();
1798
1799         return hchan;
1800 }
1801
1802 u32 hci_conn_get_phy(struct hci_conn *conn)
1803 {
1804         u32 phys = 0;
1805
1806         /* BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 2, Part B page 471:
1807          * Table 6.2: Packets defined for synchronous, asynchronous, and
1808          * CSB logical transport types.
1809          */
1810         switch (conn->type) {
1811         case SCO_LINK:
1812                 /* SCO logical transport (1 Mb/s):
1813                  * HV1, HV2, HV3 and DV.
1814                  */
1815                 phys |= BT_PHY_BR_1M_1SLOT;
1816
1817                 break;
1818
1819         case ACL_LINK:
1820                 /* ACL logical transport (1 Mb/s) ptt=0:
1821                  * DH1, DM3, DH3, DM5 and DH5.
1822                  */
1823                 phys |= BT_PHY_BR_1M_1SLOT;
1824
1825                 if (conn->pkt_type & (HCI_DM3 | HCI_DH3))
1826                         phys |= BT_PHY_BR_1M_3SLOT;
1827
1828                 if (conn->pkt_type & (HCI_DM5 | HCI_DH5))
1829                         phys |= BT_PHY_BR_1M_5SLOT;
1830
1831                 /* ACL logical transport (2 Mb/s) ptt=1:
1832                  * 2-DH1, 2-DH3 and 2-DH5.
1833                  */
1834                 if (!(conn->pkt_type & HCI_2DH1))
1835                         phys |= BT_PHY_EDR_2M_1SLOT;
1836
1837                 if (!(conn->pkt_type & HCI_2DH3))
1838                         phys |= BT_PHY_EDR_2M_3SLOT;
1839
1840                 if (!(conn->pkt_type & HCI_2DH5))
1841                         phys |= BT_PHY_EDR_2M_5SLOT;
1842
1843                 /* ACL logical transport (3 Mb/s) ptt=1:
1844                  * 3-DH1, 3-DH3 and 3-DH5.
1845                  */
1846                 if (!(conn->pkt_type & HCI_3DH1))
1847                         phys |= BT_PHY_EDR_3M_1SLOT;
1848
1849                 if (!(conn->pkt_type & HCI_3DH3))
1850                         phys |= BT_PHY_EDR_3M_3SLOT;
1851
1852                 if (!(conn->pkt_type & HCI_3DH5))
1853                         phys |= BT_PHY_EDR_3M_5SLOT;
1854
1855                 break;
1856
1857         case ESCO_LINK:
1858                 /* eSCO logical transport (1 Mb/s): EV3, EV4 and EV5 */
1859                 phys |= BT_PHY_BR_1M_1SLOT;
1860
1861                 if (!(conn->pkt_type & (ESCO_EV4 | ESCO_EV5)))
1862                         phys |= BT_PHY_BR_1M_3SLOT;
1863
1864                 /* eSCO logical transport (2 Mb/s): 2-EV3, 2-EV5 */
1865                 if (!(conn->pkt_type & ESCO_2EV3))
1866                         phys |= BT_PHY_EDR_2M_1SLOT;
1867
1868                 if (!(conn->pkt_type & ESCO_2EV5))
1869                         phys |= BT_PHY_EDR_2M_3SLOT;
1870
1871                 /* eSCO logical transport (3 Mb/s): 3-EV3, 3-EV5 */
1872                 if (!(conn->pkt_type & ESCO_3EV3))
1873                         phys |= BT_PHY_EDR_3M_1SLOT;
1874
1875                 if (!(conn->pkt_type & ESCO_3EV5))
1876                         phys |= BT_PHY_EDR_3M_3SLOT;
1877
1878                 break;
1879
1880         case LE_LINK:
1881                 if (conn->le_tx_phy & HCI_LE_SET_PHY_1M)
1882                         phys |= BT_PHY_LE_1M_TX;
1883
1884                 if (conn->le_rx_phy & HCI_LE_SET_PHY_1M)
1885                         phys |= BT_PHY_LE_1M_RX;
1886
1887                 if (conn->le_tx_phy & HCI_LE_SET_PHY_2M)
1888                         phys |= BT_PHY_LE_2M_TX;
1889
1890                 if (conn->le_rx_phy & HCI_LE_SET_PHY_2M)
1891                         phys |= BT_PHY_LE_2M_RX;
1892
1893                 if (conn->le_tx_phy & HCI_LE_SET_PHY_CODED)
1894                         phys |= BT_PHY_LE_CODED_TX;
1895
1896                 if (conn->le_rx_phy & HCI_LE_SET_PHY_CODED)
1897                         phys |= BT_PHY_LE_CODED_RX;
1898
1899                 break;
1900         }
1901
1902         return phys;
1903 }