1 /*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
4
5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22 SOFTWARE IS DISCLAIMED.
23 */
24
25 /* Bluetooth HCI connection handling. */
26
27 #include <linux/export.h>
28 #include <linux/debugfs.h>
29
30 #include <net/bluetooth/bluetooth.h>
31 #include <net/bluetooth/hci_core.h>
32 #include <net/bluetooth/l2cap.h>
33
34 #include "hci_request.h"
35 #include "smp.h"
36 #include "a2mp.h"
37
38 struct sco_param {
39 u16 pkt_type;
40 u16 max_latency;
41 u8 retrans_effort;
42 };
43
44 static const struct sco_param esco_param_cvsd[] = {
45 { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000a, 0x01 }, /* S3 */
46 { EDR_ESCO_MASK & ~ESCO_2EV3, 0x0007, 0x01 }, /* S2 */
47 { EDR_ESCO_MASK | ESCO_EV3, 0x0007, 0x01 }, /* S1 */
48 { EDR_ESCO_MASK | ESCO_HV3, 0xffff, 0x01 }, /* D1 */
49 { EDR_ESCO_MASK | ESCO_HV1, 0xffff, 0x01 }, /* D0 */
50 };
51
52 static const struct sco_param sco_param_cvsd[] = {
53 { EDR_ESCO_MASK | ESCO_HV3, 0xffff, 0xff }, /* D1 */
54 { EDR_ESCO_MASK | ESCO_HV1, 0xffff, 0xff }, /* D0 */
55 };
56
57 static const struct sco_param esco_param_msbc[] = {
58 { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000d, 0x02 }, /* T2 */
59 { EDR_ESCO_MASK | ESCO_EV3, 0x0008, 0x02 }, /* T1 */
60 };
61
62 /* This function requires the caller holds hdev->lock */
hci_connect_le_scan_cleanup(struct hci_conn * conn)63 static void hci_connect_le_scan_cleanup(struct hci_conn *conn)
64 {
65 struct hci_conn_params *params;
66 struct hci_dev *hdev = conn->hdev;
67 struct smp_irk *irk;
68 bdaddr_t *bdaddr;
69 u8 bdaddr_type;
70
71 bdaddr = &conn->dst;
72 bdaddr_type = conn->dst_type;
73
74 /* Check if we need to convert to identity address */
75 irk = hci_get_irk(hdev, bdaddr, bdaddr_type);
76 if (irk) {
77 bdaddr = &irk->bdaddr;
78 bdaddr_type = irk->addr_type;
79 }
80
81 params = hci_pend_le_action_lookup(&hdev->pend_le_conns, bdaddr,
82 bdaddr_type);
83 if (!params || !params->explicit_connect)
84 return;
85
86 /* The connection attempt was doing scan for new RPA, and is
87 * in scan phase. If params are not associated with any other
88 * autoconnect action, remove them completely. If they are, just unmark
89 * them as waiting for connection, by clearing explicit_connect field.
90 */
91 params->explicit_connect = false;
92
93 list_del_init(¶ms->action);
94
95 switch (params->auto_connect) {
96 case HCI_AUTO_CONN_EXPLICIT:
97 hci_conn_params_del(hdev, bdaddr, bdaddr_type);
98 /* return instead of break to avoid duplicate scan update */
99 return;
100 case HCI_AUTO_CONN_DIRECT:
101 case HCI_AUTO_CONN_ALWAYS:
102 list_add(¶ms->action, &hdev->pend_le_conns);
103 break;
104 case HCI_AUTO_CONN_REPORT:
105 list_add(¶ms->action, &hdev->pend_le_reports);
106 break;
107 default:
108 break;
109 }
110
111 hci_update_background_scan(hdev);
112 }
113
hci_conn_cleanup(struct hci_conn * conn)114 static void hci_conn_cleanup(struct hci_conn *conn)
115 {
116 struct hci_dev *hdev = conn->hdev;
117
118 if (test_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags))
119 hci_conn_params_del(conn->hdev, &conn->dst, conn->dst_type);
120
121 hci_chan_list_flush(conn);
122
123 hci_conn_hash_del(hdev, conn);
124
125 if (conn->type == SCO_LINK || conn->type == ESCO_LINK) {
126 switch (conn->setting & SCO_AIRMODE_MASK) {
127 case SCO_AIRMODE_CVSD:
128 case SCO_AIRMODE_TRANSP:
129 if (hdev->notify)
130 hdev->notify(hdev, HCI_NOTIFY_DISABLE_SCO);
131 break;
132 }
133 } else {
134 if (hdev->notify)
135 hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
136 }
137
138 hci_conn_del_sysfs(conn);
139
140 debugfs_remove_recursive(conn->debugfs);
141
142 hci_dev_put(hdev);
143
144 hci_conn_put(conn);
145 }
146
le_scan_cleanup(struct work_struct * work)147 static void le_scan_cleanup(struct work_struct *work)
148 {
149 struct hci_conn *conn = container_of(work, struct hci_conn,
150 le_scan_cleanup);
151 struct hci_dev *hdev = conn->hdev;
152 struct hci_conn *c = NULL;
153
154 BT_DBG("%s hcon %p", hdev->name, conn);
155
156 hci_dev_lock(hdev);
157
158 /* Check that the hci_conn is still around */
159 rcu_read_lock();
160 list_for_each_entry_rcu(c, &hdev->conn_hash.list, list) {
161 if (c == conn)
162 break;
163 }
164 rcu_read_unlock();
165
166 if (c == conn) {
167 hci_connect_le_scan_cleanup(conn);
168 hci_conn_cleanup(conn);
169 }
170
171 hci_dev_unlock(hdev);
172 hci_dev_put(hdev);
173 hci_conn_put(conn);
174 }
175
hci_connect_le_scan_remove(struct hci_conn * conn)176 static void hci_connect_le_scan_remove(struct hci_conn *conn)
177 {
178 BT_DBG("%s hcon %p", conn->hdev->name, conn);
179
180 /* We can't call hci_conn_del/hci_conn_cleanup here since that
181 * could deadlock with another hci_conn_del() call that's holding
182 * hci_dev_lock and doing cancel_delayed_work_sync(&conn->disc_work).
183 * Instead, grab temporary extra references to the hci_dev and
184 * hci_conn and perform the necessary cleanup in a separate work
185 * callback.
186 */
187
188 hci_dev_hold(conn->hdev);
189 hci_conn_get(conn);
190
191 /* Even though we hold a reference to the hdev, many other
192 * things might get cleaned up meanwhile, including the hdev's
193 * own workqueue, so we can't use that for scheduling.
194 */
195 schedule_work(&conn->le_scan_cleanup);
196 }
197
hci_acl_create_connection(struct hci_conn * conn)198 static void hci_acl_create_connection(struct hci_conn *conn)
199 {
200 struct hci_dev *hdev = conn->hdev;
201 struct inquiry_entry *ie;
202 struct hci_cp_create_conn cp;
203
204 BT_DBG("hcon %p", conn);
205
206 conn->state = BT_CONNECT;
207 conn->out = true;
208 conn->role = HCI_ROLE_MASTER;
209
210 conn->attempt++;
211
212 conn->link_policy = hdev->link_policy;
213
214 memset(&cp, 0, sizeof(cp));
215 bacpy(&cp.bdaddr, &conn->dst);
216 cp.pscan_rep_mode = 0x02;
217
218 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
219 if (ie) {
220 if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
221 cp.pscan_rep_mode = ie->data.pscan_rep_mode;
222 cp.pscan_mode = ie->data.pscan_mode;
223 cp.clock_offset = ie->data.clock_offset |
224 cpu_to_le16(0x8000);
225 }
226
227 memcpy(conn->dev_class, ie->data.dev_class, 3);
228 }
229
230 cp.pkt_type = cpu_to_le16(conn->pkt_type);
231 if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
232 cp.role_switch = 0x01;
233 else
234 cp.role_switch = 0x00;
235
236 hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
237 }
238
hci_disconnect(struct hci_conn * conn,__u8 reason)239 int hci_disconnect(struct hci_conn *conn, __u8 reason)
240 {
241 BT_DBG("hcon %p", conn);
242
243 /* When we are master of an established connection and it enters
244 * the disconnect timeout, then go ahead and try to read the
245 * current clock offset. Processing of the result is done
246 * within the event handling and hci_clock_offset_evt function.
247 */
248 if (conn->type == ACL_LINK && conn->role == HCI_ROLE_MASTER &&
249 (conn->state == BT_CONNECTED || conn->state == BT_CONFIG)) {
250 struct hci_dev *hdev = conn->hdev;
251 struct hci_cp_read_clock_offset clkoff_cp;
252
253 clkoff_cp.handle = cpu_to_le16(conn->handle);
254 hci_send_cmd(hdev, HCI_OP_READ_CLOCK_OFFSET, sizeof(clkoff_cp),
255 &clkoff_cp);
256 }
257
258 return hci_abort_conn(conn, reason);
259 }
260
hci_add_sco(struct hci_conn * conn,__u16 handle)261 static void hci_add_sco(struct hci_conn *conn, __u16 handle)
262 {
263 struct hci_dev *hdev = conn->hdev;
264 struct hci_cp_add_sco cp;
265
266 BT_DBG("hcon %p", conn);
267
268 conn->state = BT_CONNECT;
269 conn->out = true;
270
271 conn->attempt++;
272
273 cp.handle = cpu_to_le16(handle);
274 cp.pkt_type = cpu_to_le16(conn->pkt_type);
275
276 hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
277 }
278
hci_setup_sync(struct hci_conn * conn,__u16 handle)279 bool hci_setup_sync(struct hci_conn *conn, __u16 handle)
280 {
281 struct hci_dev *hdev = conn->hdev;
282 struct hci_cp_setup_sync_conn cp;
283 const struct sco_param *param;
284
285 BT_DBG("hcon %p", conn);
286
287 conn->state = BT_CONNECT;
288 conn->out = true;
289
290 conn->attempt++;
291
292 cp.handle = cpu_to_le16(handle);
293
294 cp.tx_bandwidth = cpu_to_le32(0x00001f40);
295 cp.rx_bandwidth = cpu_to_le32(0x00001f40);
296 cp.voice_setting = cpu_to_le16(conn->setting);
297
298 switch (conn->setting & SCO_AIRMODE_MASK) {
299 case SCO_AIRMODE_TRANSP:
300 if (conn->attempt > ARRAY_SIZE(esco_param_msbc))
301 return false;
302 param = &esco_param_msbc[conn->attempt - 1];
303 break;
304 case SCO_AIRMODE_CVSD:
305 if (lmp_esco_capable(conn->link)) {
306 if (conn->attempt > ARRAY_SIZE(esco_param_cvsd))
307 return false;
308 param = &esco_param_cvsd[conn->attempt - 1];
309 } else {
310 if (conn->attempt > ARRAY_SIZE(sco_param_cvsd))
311 return false;
312 param = &sco_param_cvsd[conn->attempt - 1];
313 }
314 break;
315 default:
316 return false;
317 }
318
319 cp.retrans_effort = param->retrans_effort;
320 cp.pkt_type = __cpu_to_le16(param->pkt_type);
321 cp.max_latency = __cpu_to_le16(param->max_latency);
322
323 if (hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp) < 0)
324 return false;
325
326 return true;
327 }
328
hci_le_conn_update(struct hci_conn * conn,u16 min,u16 max,u16 latency,u16 to_multiplier)329 u8 hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max, u16 latency,
330 u16 to_multiplier)
331 {
332 struct hci_dev *hdev = conn->hdev;
333 struct hci_conn_params *params;
334 struct hci_cp_le_conn_update cp;
335
336 hci_dev_lock(hdev);
337
338 params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
339 if (params) {
340 params->conn_min_interval = min;
341 params->conn_max_interval = max;
342 params->conn_latency = latency;
343 params->supervision_timeout = to_multiplier;
344 }
345
346 hci_dev_unlock(hdev);
347
348 memset(&cp, 0, sizeof(cp));
349 cp.handle = cpu_to_le16(conn->handle);
350 cp.conn_interval_min = cpu_to_le16(min);
351 cp.conn_interval_max = cpu_to_le16(max);
352 cp.conn_latency = cpu_to_le16(latency);
353 cp.supervision_timeout = cpu_to_le16(to_multiplier);
354 cp.min_ce_len = cpu_to_le16(0x0000);
355 cp.max_ce_len = cpu_to_le16(0x0000);
356
357 hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp);
358
359 if (params)
360 return 0x01;
361
362 return 0x00;
363 }
364
hci_le_start_enc(struct hci_conn * conn,__le16 ediv,__le64 rand,__u8 ltk[16],__u8 key_size)365 void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __le64 rand,
366 __u8 ltk[16], __u8 key_size)
367 {
368 struct hci_dev *hdev = conn->hdev;
369 struct hci_cp_le_start_enc cp;
370
371 BT_DBG("hcon %p", conn);
372
373 memset(&cp, 0, sizeof(cp));
374
375 cp.handle = cpu_to_le16(conn->handle);
376 cp.rand = rand;
377 cp.ediv = ediv;
378 memcpy(cp.ltk, ltk, key_size);
379
380 hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp);
381 }
382
383 /* Device _must_ be locked */
hci_sco_setup(struct hci_conn * conn,__u8 status)384 void hci_sco_setup(struct hci_conn *conn, __u8 status)
385 {
386 struct hci_conn *sco = conn->link;
387
388 if (!sco)
389 return;
390
391 BT_DBG("hcon %p", conn);
392
393 if (!status) {
394 if (lmp_esco_capable(conn->hdev))
395 hci_setup_sync(sco, conn->handle);
396 else
397 hci_add_sco(sco, conn->handle);
398 } else {
399 hci_connect_cfm(sco, status);
400 hci_conn_del(sco);
401 }
402 }
403
hci_conn_timeout(struct work_struct * work)404 static void hci_conn_timeout(struct work_struct *work)
405 {
406 struct hci_conn *conn = container_of(work, struct hci_conn,
407 disc_work.work);
408 int refcnt = atomic_read(&conn->refcnt);
409
410 BT_DBG("hcon %p state %s", conn, state_to_string(conn->state));
411
412 WARN_ON(refcnt < 0);
413
414 /* FIXME: It was observed that in pairing failed scenario, refcnt
415 * drops below 0. Probably this is because l2cap_conn_del calls
416 * l2cap_chan_del for each channel, and inside l2cap_chan_del conn is
417 * dropped. After that loop hci_chan_del is called which also drops
418 * conn. For now make sure that ACL is alive if refcnt is higher then 0,
419 * otherwise drop it.
420 */
421 if (refcnt > 0)
422 return;
423
424 /* LE connections in scanning state need special handling */
425 if (conn->state == BT_CONNECT && conn->type == LE_LINK &&
426 test_bit(HCI_CONN_SCANNING, &conn->flags)) {
427 hci_connect_le_scan_remove(conn);
428 return;
429 }
430
431 hci_abort_conn(conn, hci_proto_disconn_ind(conn));
432 }
433
434 /* Enter sniff mode */
hci_conn_idle(struct work_struct * work)435 static void hci_conn_idle(struct work_struct *work)
436 {
437 struct hci_conn *conn = container_of(work, struct hci_conn,
438 idle_work.work);
439 struct hci_dev *hdev = conn->hdev;
440
441 BT_DBG("hcon %p mode %d", conn, conn->mode);
442
443 if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn))
444 return;
445
446 if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF))
447 return;
448
449 if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
450 struct hci_cp_sniff_subrate cp;
451 cp.handle = cpu_to_le16(conn->handle);
452 cp.max_latency = cpu_to_le16(0);
453 cp.min_remote_timeout = cpu_to_le16(0);
454 cp.min_local_timeout = cpu_to_le16(0);
455 hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
456 }
457
458 if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
459 struct hci_cp_sniff_mode cp;
460 cp.handle = cpu_to_le16(conn->handle);
461 cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
462 cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
463 cp.attempt = cpu_to_le16(4);
464 cp.timeout = cpu_to_le16(1);
465 hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
466 }
467 }
468
hci_conn_auto_accept(struct work_struct * work)469 static void hci_conn_auto_accept(struct work_struct *work)
470 {
471 struct hci_conn *conn = container_of(work, struct hci_conn,
472 auto_accept_work.work);
473
474 hci_send_cmd(conn->hdev, HCI_OP_USER_CONFIRM_REPLY, sizeof(conn->dst),
475 &conn->dst);
476 }
477
le_disable_advertising(struct hci_dev * hdev)478 static void le_disable_advertising(struct hci_dev *hdev)
479 {
480 if (ext_adv_capable(hdev)) {
481 struct hci_cp_le_set_ext_adv_enable cp;
482
483 cp.enable = 0x00;
484 cp.num_of_sets = 0x00;
485
486 hci_send_cmd(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE, sizeof(cp),
487 &cp);
488 } else {
489 u8 enable = 0x00;
490 hci_send_cmd(hdev, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable),
491 &enable);
492 }
493 }
494
le_conn_timeout(struct work_struct * work)495 static void le_conn_timeout(struct work_struct *work)
496 {
497 struct hci_conn *conn = container_of(work, struct hci_conn,
498 le_conn_timeout.work);
499 struct hci_dev *hdev = conn->hdev;
500
501 BT_DBG("");
502
503 /* We could end up here due to having done directed advertising,
504 * so clean up the state if necessary. This should however only
505 * happen with broken hardware or if low duty cycle was used
506 * (which doesn't have a timeout of its own).
507 */
508 if (conn->role == HCI_ROLE_SLAVE) {
509 /* Disable LE Advertising */
510 le_disable_advertising(hdev);
511 hci_le_conn_failed(conn, HCI_ERROR_ADVERTISING_TIMEOUT);
512 return;
513 }
514
515 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
516 }
517
hci_conn_add(struct hci_dev * hdev,int type,bdaddr_t * dst,u8 role)518 struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst,
519 u8 role)
520 {
521 struct hci_conn *conn;
522
523 BT_DBG("%s dst %pMR", hdev->name, dst);
524
525 conn = kzalloc(sizeof(*conn), GFP_KERNEL);
526 if (!conn)
527 return NULL;
528
529 bacpy(&conn->dst, dst);
530 bacpy(&conn->src, &hdev->bdaddr);
531 conn->hdev = hdev;
532 conn->type = type;
533 conn->role = role;
534 conn->mode = HCI_CM_ACTIVE;
535 conn->state = BT_OPEN;
536 conn->auth_type = HCI_AT_GENERAL_BONDING;
537 conn->io_capability = hdev->io_capability;
538 conn->remote_auth = 0xff;
539 conn->key_type = 0xff;
540 conn->rssi = HCI_RSSI_INVALID;
541 conn->tx_power = HCI_TX_POWER_INVALID;
542 conn->max_tx_power = HCI_TX_POWER_INVALID;
543
544 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
545 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
546
547 /* Set Default Authenticated payload timeout to 30s */
548 conn->auth_payload_timeout = DEFAULT_AUTH_PAYLOAD_TIMEOUT;
549
550 if (conn->role == HCI_ROLE_MASTER)
551 conn->out = true;
552
553 switch (type) {
554 case ACL_LINK:
555 conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
556 break;
557 case LE_LINK:
558 /* conn->src should reflect the local identity address */
559 hci_copy_identity_address(hdev, &conn->src, &conn->src_type);
560 break;
561 case SCO_LINK:
562 if (lmp_esco_capable(hdev))
563 conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
564 (hdev->esco_type & EDR_ESCO_MASK);
565 else
566 conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
567 break;
568 case ESCO_LINK:
569 conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
570 break;
571 }
572
573 skb_queue_head_init(&conn->data_q);
574
575 INIT_LIST_HEAD(&conn->chan_list);
576
577 INIT_DELAYED_WORK(&conn->disc_work, hci_conn_timeout);
578 INIT_DELAYED_WORK(&conn->auto_accept_work, hci_conn_auto_accept);
579 INIT_DELAYED_WORK(&conn->idle_work, hci_conn_idle);
580 INIT_DELAYED_WORK(&conn->le_conn_timeout, le_conn_timeout);
581 INIT_WORK(&conn->le_scan_cleanup, le_scan_cleanup);
582
583 atomic_set(&conn->refcnt, 0);
584
585 hci_dev_hold(hdev);
586
587 hci_conn_hash_add(hdev, conn);
588
589 /* The SCO and eSCO connections will only be notified when their
590 * setup has been completed. This is different to ACL links which
591 * can be notified right away.
592 */
593 if (conn->type != SCO_LINK && conn->type != ESCO_LINK) {
594 if (hdev->notify)
595 hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
596 }
597
598 hci_conn_init_sysfs(conn);
599
600 return conn;
601 }
602
hci_conn_del(struct hci_conn * conn)603 int hci_conn_del(struct hci_conn *conn)
604 {
605 struct hci_dev *hdev = conn->hdev;
606
607 BT_DBG("%s hcon %p handle %d", hdev->name, conn, conn->handle);
608
609 cancel_delayed_work_sync(&conn->disc_work);
610 cancel_delayed_work_sync(&conn->auto_accept_work);
611 cancel_delayed_work_sync(&conn->idle_work);
612
613 if (conn->type == ACL_LINK) {
614 struct hci_conn *sco = conn->link;
615 if (sco)
616 sco->link = NULL;
617
618 /* Unacked frames */
619 hdev->acl_cnt += conn->sent;
620 } else if (conn->type == LE_LINK) {
621 cancel_delayed_work(&conn->le_conn_timeout);
622
623 if (hdev->le_pkts)
624 hdev->le_cnt += conn->sent;
625 else
626 hdev->acl_cnt += conn->sent;
627 } else {
628 struct hci_conn *acl = conn->link;
629 if (acl) {
630 acl->link = NULL;
631 hci_conn_drop(acl);
632 }
633 }
634
635 if (conn->amp_mgr)
636 amp_mgr_put(conn->amp_mgr);
637
638 skb_queue_purge(&conn->data_q);
639
640 /* Remove the connection from the list and cleanup its remaining
641 * state. This is a separate function since for some cases like
642 * BT_CONNECT_SCAN we *only* want the cleanup part without the
643 * rest of hci_conn_del.
644 */
645 hci_conn_cleanup(conn);
646
647 return 0;
648 }
649
hci_get_route(bdaddr_t * dst,bdaddr_t * src,uint8_t src_type)650 struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src, uint8_t src_type)
651 {
652 int use_src = bacmp(src, BDADDR_ANY);
653 struct hci_dev *hdev = NULL, *d;
654
655 BT_DBG("%pMR -> %pMR", src, dst);
656
657 read_lock(&hci_dev_list_lock);
658
659 list_for_each_entry(d, &hci_dev_list, list) {
660 if (!test_bit(HCI_UP, &d->flags) ||
661 hci_dev_test_flag(d, HCI_USER_CHANNEL) ||
662 d->dev_type != HCI_PRIMARY)
663 continue;
664
665 /* Simple routing:
666 * No source address - find interface with bdaddr != dst
667 * Source address - find interface with bdaddr == src
668 */
669
670 if (use_src) {
671 bdaddr_t id_addr;
672 u8 id_addr_type;
673
674 if (src_type == BDADDR_BREDR) {
675 if (!lmp_bredr_capable(d))
676 continue;
677 bacpy(&id_addr, &d->bdaddr);
678 id_addr_type = BDADDR_BREDR;
679 } else {
680 if (!lmp_le_capable(d))
681 continue;
682
683 hci_copy_identity_address(d, &id_addr,
684 &id_addr_type);
685
686 /* Convert from HCI to three-value type */
687 if (id_addr_type == ADDR_LE_DEV_PUBLIC)
688 id_addr_type = BDADDR_LE_PUBLIC;
689 else
690 id_addr_type = BDADDR_LE_RANDOM;
691 }
692
693 if (!bacmp(&id_addr, src) && id_addr_type == src_type) {
694 hdev = d; break;
695 }
696 } else {
697 if (bacmp(&d->bdaddr, dst)) {
698 hdev = d; break;
699 }
700 }
701 }
702
703 if (hdev)
704 hdev = hci_dev_hold(hdev);
705
706 read_unlock(&hci_dev_list_lock);
707 return hdev;
708 }
709 EXPORT_SYMBOL(hci_get_route);
710
711 /* This function requires the caller holds hdev->lock */
hci_le_conn_failed(struct hci_conn * conn,u8 status)712 void hci_le_conn_failed(struct hci_conn *conn, u8 status)
713 {
714 struct hci_dev *hdev = conn->hdev;
715 struct hci_conn_params *params;
716
717 params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
718 conn->dst_type);
719 if (params && params->conn) {
720 hci_conn_drop(params->conn);
721 hci_conn_put(params->conn);
722 params->conn = NULL;
723 }
724
725 conn->state = BT_CLOSED;
726
727 /* If the status indicates successful cancellation of
728 * the attempt (i.e. Unkown Connection Id) there's no point of
729 * notifying failure since we'll go back to keep trying to
730 * connect. The only exception is explicit connect requests
731 * where a timeout + cancel does indicate an actual failure.
732 */
733 if (status != HCI_ERROR_UNKNOWN_CONN_ID ||
734 (params && params->explicit_connect))
735 mgmt_connect_failed(hdev, &conn->dst, conn->type,
736 conn->dst_type, status);
737
738 hci_connect_cfm(conn, status);
739
740 hci_conn_del(conn);
741
742 /* Since we may have temporarily stopped the background scanning in
743 * favor of connection establishment, we should restart it.
744 */
745 hci_update_background_scan(hdev);
746
747 /* Re-enable advertising in case this was a failed connection
748 * attempt as a peripheral.
749 */
750 hci_req_reenable_advertising(hdev);
751 }
752
create_le_conn_complete(struct hci_dev * hdev,u8 status,u16 opcode)753 static void create_le_conn_complete(struct hci_dev *hdev, u8 status, u16 opcode)
754 {
755 struct hci_conn *conn;
756
757 hci_dev_lock(hdev);
758
759 conn = hci_lookup_le_connect(hdev);
760
761 if (!status) {
762 hci_connect_le_scan_cleanup(conn);
763 goto done;
764 }
765
766 bt_dev_err(hdev, "request failed to create LE connection: "
767 "status 0x%2.2x", status);
768
769 if (!conn)
770 goto done;
771
772 hci_le_conn_failed(conn, status);
773
774 done:
775 hci_dev_unlock(hdev);
776 }
777
conn_use_rpa(struct hci_conn * conn)778 static bool conn_use_rpa(struct hci_conn *conn)
779 {
780 struct hci_dev *hdev = conn->hdev;
781
782 return hci_dev_test_flag(hdev, HCI_PRIVACY);
783 }
784
set_ext_conn_params(struct hci_conn * conn,struct hci_cp_le_ext_conn_param * p)785 static void set_ext_conn_params(struct hci_conn *conn,
786 struct hci_cp_le_ext_conn_param *p)
787 {
788 struct hci_dev *hdev = conn->hdev;
789
790 memset(p, 0, sizeof(*p));
791
792 p->scan_interval = cpu_to_le16(hdev->le_scan_int_connect);
793 p->scan_window = cpu_to_le16(hdev->le_scan_window_connect);
794 p->conn_interval_min = cpu_to_le16(conn->le_conn_min_interval);
795 p->conn_interval_max = cpu_to_le16(conn->le_conn_max_interval);
796 p->conn_latency = cpu_to_le16(conn->le_conn_latency);
797 p->supervision_timeout = cpu_to_le16(conn->le_supv_timeout);
798 p->min_ce_len = cpu_to_le16(0x0000);
799 p->max_ce_len = cpu_to_le16(0x0000);
800 }
801
hci_req_add_le_create_conn(struct hci_request * req,struct hci_conn * conn,bdaddr_t * direct_rpa)802 static void hci_req_add_le_create_conn(struct hci_request *req,
803 struct hci_conn *conn,
804 bdaddr_t *direct_rpa)
805 {
806 struct hci_dev *hdev = conn->hdev;
807 u8 own_addr_type;
808
809 /* If direct address was provided we use it instead of current
810 * address.
811 */
812 if (direct_rpa) {
813 if (bacmp(&req->hdev->random_addr, direct_rpa))
814 hci_req_add(req, HCI_OP_LE_SET_RANDOM_ADDR, 6,
815 direct_rpa);
816
817 /* direct address is always RPA */
818 own_addr_type = ADDR_LE_DEV_RANDOM;
819 } else {
820 /* Update random address, but set require_privacy to false so
821 * that we never connect with an non-resolvable address.
822 */
823 if (hci_update_random_address(req, false, conn_use_rpa(conn),
824 &own_addr_type))
825 return;
826 }
827
828 if (use_ext_conn(hdev)) {
829 struct hci_cp_le_ext_create_conn *cp;
830 struct hci_cp_le_ext_conn_param *p;
831 u8 data[sizeof(*cp) + sizeof(*p) * 3];
832 u32 plen;
833
834 cp = (void *) data;
835 p = (void *) cp->data;
836
837 memset(cp, 0, sizeof(*cp));
838
839 bacpy(&cp->peer_addr, &conn->dst);
840 cp->peer_addr_type = conn->dst_type;
841 cp->own_addr_type = own_addr_type;
842
843 plen = sizeof(*cp);
844
845 if (scan_1m(hdev)) {
846 cp->phys |= LE_SCAN_PHY_1M;
847 set_ext_conn_params(conn, p);
848
849 p++;
850 plen += sizeof(*p);
851 }
852
853 if (scan_2m(hdev)) {
854 cp->phys |= LE_SCAN_PHY_2M;
855 set_ext_conn_params(conn, p);
856
857 p++;
858 plen += sizeof(*p);
859 }
860
861 if (scan_coded(hdev)) {
862 cp->phys |= LE_SCAN_PHY_CODED;
863 set_ext_conn_params(conn, p);
864
865 plen += sizeof(*p);
866 }
867
868 hci_req_add(req, HCI_OP_LE_EXT_CREATE_CONN, plen, data);
869
870 } else {
871 struct hci_cp_le_create_conn cp;
872
873 memset(&cp, 0, sizeof(cp));
874
875 cp.scan_interval = cpu_to_le16(hdev->le_scan_int_connect);
876 cp.scan_window = cpu_to_le16(hdev->le_scan_window_connect);
877
878 bacpy(&cp.peer_addr, &conn->dst);
879 cp.peer_addr_type = conn->dst_type;
880 cp.own_address_type = own_addr_type;
881 cp.conn_interval_min = cpu_to_le16(conn->le_conn_min_interval);
882 cp.conn_interval_max = cpu_to_le16(conn->le_conn_max_interval);
883 cp.conn_latency = cpu_to_le16(conn->le_conn_latency);
884 cp.supervision_timeout = cpu_to_le16(conn->le_supv_timeout);
885 cp.min_ce_len = cpu_to_le16(0x0000);
886 cp.max_ce_len = cpu_to_le16(0x0000);
887
888 hci_req_add(req, HCI_OP_LE_CREATE_CONN, sizeof(cp), &cp);
889 }
890
891 conn->state = BT_CONNECT;
892 clear_bit(HCI_CONN_SCANNING, &conn->flags);
893 }
894
hci_req_directed_advertising(struct hci_request * req,struct hci_conn * conn)895 static void hci_req_directed_advertising(struct hci_request *req,
896 struct hci_conn *conn)
897 {
898 struct hci_dev *hdev = req->hdev;
899 u8 own_addr_type;
900 u8 enable;
901
902 if (ext_adv_capable(hdev)) {
903 struct hci_cp_le_set_ext_adv_params cp;
904 bdaddr_t random_addr;
905
906 /* Set require_privacy to false so that the remote device has a
907 * chance of identifying us.
908 */
909 if (hci_get_random_address(hdev, false, conn_use_rpa(conn), NULL,
910 &own_addr_type, &random_addr) < 0)
911 return;
912
913 memset(&cp, 0, sizeof(cp));
914
915 cp.evt_properties = cpu_to_le16(LE_LEGACY_ADV_DIRECT_IND);
916 cp.own_addr_type = own_addr_type;
917 cp.channel_map = hdev->le_adv_channel_map;
918 cp.tx_power = HCI_TX_POWER_INVALID;
919 cp.primary_phy = HCI_ADV_PHY_1M;
920 cp.secondary_phy = HCI_ADV_PHY_1M;
921 cp.handle = 0; /* Use instance 0 for directed adv */
922 cp.own_addr_type = own_addr_type;
923 cp.peer_addr_type = conn->dst_type;
924 bacpy(&cp.peer_addr, &conn->dst);
925
926 /* As per Core Spec 5.2 Vol 2, PART E, Sec 7.8.53, for
927 * advertising_event_property LE_LEGACY_ADV_DIRECT_IND
928 * does not supports advertising data when the advertising set already
929 * contains some, the controller shall return erroc code 'Invalid
930 * HCI Command Parameters(0x12).
931 * So it is required to remove adv set for handle 0x00. since we use
932 * instance 0 for directed adv.
933 */
934 __hci_req_remove_ext_adv_instance(req, cp.handle);
935
936 hci_req_add(req, HCI_OP_LE_SET_EXT_ADV_PARAMS, sizeof(cp), &cp);
937
938 if (own_addr_type == ADDR_LE_DEV_RANDOM &&
939 bacmp(&random_addr, BDADDR_ANY) &&
940 bacmp(&random_addr, &hdev->random_addr)) {
941 struct hci_cp_le_set_adv_set_rand_addr cp;
942
943 memset(&cp, 0, sizeof(cp));
944
945 cp.handle = 0;
946 bacpy(&cp.bdaddr, &random_addr);
947
948 hci_req_add(req,
949 HCI_OP_LE_SET_ADV_SET_RAND_ADDR,
950 sizeof(cp), &cp);
951 }
952
953 __hci_req_enable_ext_advertising(req, 0x00);
954 } else {
955 struct hci_cp_le_set_adv_param cp;
956
957 /* Clear the HCI_LE_ADV bit temporarily so that the
958 * hci_update_random_address knows that it's safe to go ahead
959 * and write a new random address. The flag will be set back on
960 * as soon as the SET_ADV_ENABLE HCI command completes.
961 */
962 hci_dev_clear_flag(hdev, HCI_LE_ADV);
963
964 /* Set require_privacy to false so that the remote device has a
965 * chance of identifying us.
966 */
967 if (hci_update_random_address(req, false, conn_use_rpa(conn),
968 &own_addr_type) < 0)
969 return;
970
971 memset(&cp, 0, sizeof(cp));
972
973 /* Some controllers might reject command if intervals are not
974 * within range for undirected advertising.
975 * BCM20702A0 is known to be affected by this.
976 */
977 cp.min_interval = cpu_to_le16(0x0020);
978 cp.max_interval = cpu_to_le16(0x0020);
979
980 cp.type = LE_ADV_DIRECT_IND;
981 cp.own_address_type = own_addr_type;
982 cp.direct_addr_type = conn->dst_type;
983 bacpy(&cp.direct_addr, &conn->dst);
984 cp.channel_map = hdev->le_adv_channel_map;
985
986 hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
987
988 enable = 0x01;
989 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable),
990 &enable);
991 }
992
993 conn->state = BT_CONNECT;
994 }
995
hci_connect_le(struct hci_dev * hdev,bdaddr_t * dst,u8 dst_type,u8 sec_level,u16 conn_timeout,u8 role,bdaddr_t * direct_rpa)996 struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,
997 u8 dst_type, u8 sec_level, u16 conn_timeout,
998 u8 role, bdaddr_t *direct_rpa)
999 {
1000 struct hci_conn_params *params;
1001 struct hci_conn *conn;
1002 struct smp_irk *irk;
1003 struct hci_request req;
1004 int err;
1005
1006 /* This ensures that during disable le_scan address resolution
1007 * will not be disabled if it is followed by le_create_conn
1008 */
1009 bool rpa_le_conn = true;
1010
1011 /* Let's make sure that le is enabled.*/
1012 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1013 if (lmp_le_capable(hdev))
1014 return ERR_PTR(-ECONNREFUSED);
1015
1016 return ERR_PTR(-EOPNOTSUPP);
1017 }
1018
1019 /* Since the controller supports only one LE connection attempt at a
1020 * time, we return -EBUSY if there is any connection attempt running.
1021 */
1022 if (hci_lookup_le_connect(hdev))
1023 return ERR_PTR(-EBUSY);
1024
1025 /* If there's already a connection object but it's not in
1026 * scanning state it means it must already be established, in
1027 * which case we can't do anything else except report a failure
1028 * to connect.
1029 */
1030 conn = hci_conn_hash_lookup_le(hdev, dst, dst_type);
1031 if (conn && !test_bit(HCI_CONN_SCANNING, &conn->flags)) {
1032 return ERR_PTR(-EBUSY);
1033 }
1034
1035 /* When given an identity address with existing identity
1036 * resolving key, the connection needs to be established
1037 * to a resolvable random address.
1038 *
1039 * Storing the resolvable random address is required here
1040 * to handle connection failures. The address will later
1041 * be resolved back into the original identity address
1042 * from the connect request.
1043 */
1044 irk = hci_find_irk_by_addr(hdev, dst, dst_type);
1045 if (irk && bacmp(&irk->rpa, BDADDR_ANY)) {
1046 dst = &irk->rpa;
1047 dst_type = ADDR_LE_DEV_RANDOM;
1048 }
1049
1050 if (conn) {
1051 bacpy(&conn->dst, dst);
1052 } else {
1053 conn = hci_conn_add(hdev, LE_LINK, dst, role);
1054 if (!conn)
1055 return ERR_PTR(-ENOMEM);
1056 hci_conn_hold(conn);
1057 conn->pending_sec_level = sec_level;
1058 }
1059
1060 conn->dst_type = dst_type;
1061 conn->sec_level = BT_SECURITY_LOW;
1062 conn->conn_timeout = conn_timeout;
1063
1064 hci_req_init(&req, hdev);
1065
1066 /* Disable advertising if we're active. For master role
1067 * connections most controllers will refuse to connect if
1068 * advertising is enabled, and for slave role connections we
1069 * anyway have to disable it in order to start directed
1070 * advertising.
1071 */
1072 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1073 __hci_req_disable_advertising(&req);
1074
1075 /* If requested to connect as slave use directed advertising */
1076 if (conn->role == HCI_ROLE_SLAVE) {
1077 /* If we're active scanning most controllers are unable
1078 * to initiate advertising. Simply reject the attempt.
1079 */
1080 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
1081 hdev->le_scan_type == LE_SCAN_ACTIVE) {
1082 hci_req_purge(&req);
1083 hci_conn_del(conn);
1084 return ERR_PTR(-EBUSY);
1085 }
1086
1087 hci_req_directed_advertising(&req, conn);
1088 goto create_conn;
1089 }
1090
1091 params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
1092 if (params) {
1093 conn->le_conn_min_interval = params->conn_min_interval;
1094 conn->le_conn_max_interval = params->conn_max_interval;
1095 conn->le_conn_latency = params->conn_latency;
1096 conn->le_supv_timeout = params->supervision_timeout;
1097 } else {
1098 conn->le_conn_min_interval = hdev->le_conn_min_interval;
1099 conn->le_conn_max_interval = hdev->le_conn_max_interval;
1100 conn->le_conn_latency = hdev->le_conn_latency;
1101 conn->le_supv_timeout = hdev->le_supv_timeout;
1102 }
1103
1104 /* If controller is scanning, we stop it since some controllers are
1105 * not able to scan and connect at the same time. Also set the
1106 * HCI_LE_SCAN_INTERRUPTED flag so that the command complete
1107 * handler for scan disabling knows to set the correct discovery
1108 * state.
1109 */
1110 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
1111 hci_req_add_le_scan_disable(&req, rpa_le_conn);
1112 hci_dev_set_flag(hdev, HCI_LE_SCAN_INTERRUPTED);
1113 }
1114
1115 hci_req_add_le_create_conn(&req, conn, direct_rpa);
1116
1117 create_conn:
1118 err = hci_req_run(&req, create_le_conn_complete);
1119 if (err) {
1120 hci_conn_del(conn);
1121 return ERR_PTR(err);
1122 }
1123
1124 return conn;
1125 }
1126
is_connected(struct hci_dev * hdev,bdaddr_t * addr,u8 type)1127 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
1128 {
1129 struct hci_conn *conn;
1130
1131 conn = hci_conn_hash_lookup_le(hdev, addr, type);
1132 if (!conn)
1133 return false;
1134
1135 if (conn->state != BT_CONNECTED)
1136 return false;
1137
1138 return true;
1139 }
1140
1141 /* This function requires the caller holds hdev->lock */
hci_explicit_conn_params_set(struct hci_dev * hdev,bdaddr_t * addr,u8 addr_type)1142 static int hci_explicit_conn_params_set(struct hci_dev *hdev,
1143 bdaddr_t *addr, u8 addr_type)
1144 {
1145 struct hci_conn_params *params;
1146
1147 if (is_connected(hdev, addr, addr_type))
1148 return -EISCONN;
1149
1150 params = hci_conn_params_lookup(hdev, addr, addr_type);
1151 if (!params) {
1152 params = hci_conn_params_add(hdev, addr, addr_type);
1153 if (!params)
1154 return -ENOMEM;
1155
1156 /* If we created new params, mark them to be deleted in
1157 * hci_connect_le_scan_cleanup. It's different case than
1158 * existing disabled params, those will stay after cleanup.
1159 */
1160 params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
1161 }
1162
1163 /* We're trying to connect, so make sure params are at pend_le_conns */
1164 if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
1165 params->auto_connect == HCI_AUTO_CONN_REPORT ||
1166 params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
1167 list_del_init(¶ms->action);
1168 list_add(¶ms->action, &hdev->pend_le_conns);
1169 }
1170
1171 params->explicit_connect = true;
1172
1173 BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
1174 params->auto_connect);
1175
1176 return 0;
1177 }
1178
1179 /* This function requires the caller holds hdev->lock */
hci_connect_le_scan(struct hci_dev * hdev,bdaddr_t * dst,u8 dst_type,u8 sec_level,u16 conn_timeout,enum conn_reasons conn_reason)1180 struct hci_conn *hci_connect_le_scan(struct hci_dev *hdev, bdaddr_t *dst,
1181 u8 dst_type, u8 sec_level,
1182 u16 conn_timeout,
1183 enum conn_reasons conn_reason)
1184 {
1185 struct hci_conn *conn;
1186
1187 /* Let's make sure that le is enabled.*/
1188 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1189 if (lmp_le_capable(hdev))
1190 return ERR_PTR(-ECONNREFUSED);
1191
1192 return ERR_PTR(-EOPNOTSUPP);
1193 }
1194
1195 /* Some devices send ATT messages as soon as the physical link is
1196 * established. To be able to handle these ATT messages, the user-
1197 * space first establishes the connection and then starts the pairing
1198 * process.
1199 *
1200 * So if a hci_conn object already exists for the following connection
1201 * attempt, we simply update pending_sec_level and auth_type fields
1202 * and return the object found.
1203 */
1204 conn = hci_conn_hash_lookup_le(hdev, dst, dst_type);
1205 if (conn) {
1206 if (conn->pending_sec_level < sec_level)
1207 conn->pending_sec_level = sec_level;
1208 goto done;
1209 }
1210
1211 BT_DBG("requesting refresh of dst_addr");
1212
1213 conn = hci_conn_add(hdev, LE_LINK, dst, HCI_ROLE_MASTER);
1214 if (!conn)
1215 return ERR_PTR(-ENOMEM);
1216
1217 if (hci_explicit_conn_params_set(hdev, dst, dst_type) < 0) {
1218 hci_conn_del(conn);
1219 return ERR_PTR(-EBUSY);
1220 }
1221
1222 conn->state = BT_CONNECT;
1223 set_bit(HCI_CONN_SCANNING, &conn->flags);
1224 conn->dst_type = dst_type;
1225 conn->sec_level = BT_SECURITY_LOW;
1226 conn->pending_sec_level = sec_level;
1227 conn->conn_timeout = conn_timeout;
1228 conn->conn_reason = conn_reason;
1229
1230 hci_update_background_scan(hdev);
1231
1232 done:
1233 hci_conn_hold(conn);
1234 return conn;
1235 }
1236
hci_connect_acl(struct hci_dev * hdev,bdaddr_t * dst,u8 sec_level,u8 auth_type,enum conn_reasons conn_reason)1237 struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst,
1238 u8 sec_level, u8 auth_type,
1239 enum conn_reasons conn_reason)
1240 {
1241 struct hci_conn *acl;
1242
1243 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1244 if (lmp_bredr_capable(hdev))
1245 return ERR_PTR(-ECONNREFUSED);
1246
1247 return ERR_PTR(-EOPNOTSUPP);
1248 }
1249
1250 acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
1251 if (!acl) {
1252 acl = hci_conn_add(hdev, ACL_LINK, dst, HCI_ROLE_MASTER);
1253 if (!acl)
1254 return ERR_PTR(-ENOMEM);
1255 }
1256
1257 hci_conn_hold(acl);
1258
1259 acl->conn_reason = conn_reason;
1260 if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
1261 acl->sec_level = BT_SECURITY_LOW;
1262 acl->pending_sec_level = sec_level;
1263 acl->auth_type = auth_type;
1264 hci_acl_create_connection(acl);
1265 }
1266
1267 return acl;
1268 }
1269
hci_connect_sco(struct hci_dev * hdev,int type,bdaddr_t * dst,__u16 setting)1270 struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type, bdaddr_t *dst,
1271 __u16 setting)
1272 {
1273 struct hci_conn *acl;
1274 struct hci_conn *sco;
1275
1276 acl = hci_connect_acl(hdev, dst, BT_SECURITY_LOW, HCI_AT_NO_BONDING,
1277 CONN_REASON_SCO_CONNECT);
1278 if (IS_ERR(acl))
1279 return acl;
1280
1281 sco = hci_conn_hash_lookup_ba(hdev, type, dst);
1282 if (!sco) {
1283 sco = hci_conn_add(hdev, type, dst, HCI_ROLE_MASTER);
1284 if (!sco) {
1285 hci_conn_drop(acl);
1286 return ERR_PTR(-ENOMEM);
1287 }
1288 }
1289
1290 acl->link = sco;
1291 sco->link = acl;
1292
1293 hci_conn_hold(sco);
1294
1295 sco->setting = setting;
1296
1297 if (acl->state == BT_CONNECTED &&
1298 (sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
1299 set_bit(HCI_CONN_POWER_SAVE, &acl->flags);
1300 hci_conn_enter_active_mode(acl, BT_POWER_FORCE_ACTIVE_ON);
1301
1302 if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->flags)) {
1303 /* defer SCO setup until mode change completed */
1304 set_bit(HCI_CONN_SCO_SETUP_PEND, &acl->flags);
1305 return sco;
1306 }
1307
1308 hci_sco_setup(acl, 0x00);
1309 }
1310
1311 return sco;
1312 }
1313
1314 /* Check link security requirement */
hci_conn_check_link_mode(struct hci_conn * conn)1315 int hci_conn_check_link_mode(struct hci_conn *conn)
1316 {
1317 BT_DBG("hcon %p", conn);
1318
1319 /* In Secure Connections Only mode, it is required that Secure
1320 * Connections is used and the link is encrypted with AES-CCM
1321 * using a P-256 authenticated combination key.
1322 */
1323 if (hci_dev_test_flag(conn->hdev, HCI_SC_ONLY)) {
1324 if (!hci_conn_sc_enabled(conn) ||
1325 !test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
1326 conn->key_type != HCI_LK_AUTH_COMBINATION_P256)
1327 return 0;
1328 }
1329
1330 /* AES encryption is required for Level 4:
1331 *
1332 * BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 3, Part C
1333 * page 1319:
1334 *
1335 * 128-bit equivalent strength for link and encryption keys
1336 * required using FIPS approved algorithms (E0 not allowed,
1337 * SAFER+ not allowed, and P-192 not allowed; encryption key
1338 * not shortened)
1339 */
1340 if (conn->sec_level == BT_SECURITY_FIPS &&
1341 !test_bit(HCI_CONN_AES_CCM, &conn->flags)) {
1342 bt_dev_err(conn->hdev,
1343 "Invalid security: Missing AES-CCM usage");
1344 return 0;
1345 }
1346
1347 if (hci_conn_ssp_enabled(conn) &&
1348 !test_bit(HCI_CONN_ENCRYPT, &conn->flags))
1349 return 0;
1350
1351 return 1;
1352 }
1353
1354 /* Authenticate remote device */
hci_conn_auth(struct hci_conn * conn,__u8 sec_level,__u8 auth_type)1355 static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
1356 {
1357 BT_DBG("hcon %p", conn);
1358
1359 if (conn->pending_sec_level > sec_level)
1360 sec_level = conn->pending_sec_level;
1361
1362 if (sec_level > conn->sec_level)
1363 conn->pending_sec_level = sec_level;
1364 else if (test_bit(HCI_CONN_AUTH, &conn->flags))
1365 return 1;
1366
1367 /* Make sure we preserve an existing MITM requirement*/
1368 auth_type |= (conn->auth_type & 0x01);
1369
1370 conn->auth_type = auth_type;
1371
1372 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
1373 struct hci_cp_auth_requested cp;
1374
1375 cp.handle = cpu_to_le16(conn->handle);
1376 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
1377 sizeof(cp), &cp);
1378
1379 /* If we're already encrypted set the REAUTH_PEND flag,
1380 * otherwise set the ENCRYPT_PEND.
1381 */
1382 if (test_bit(HCI_CONN_ENCRYPT, &conn->flags))
1383 set_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
1384 else
1385 set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
1386 }
1387
1388 return 0;
1389 }
1390
1391 /* Encrypt the link */
hci_conn_encrypt(struct hci_conn * conn)1392 static void hci_conn_encrypt(struct hci_conn *conn)
1393 {
1394 BT_DBG("hcon %p", conn);
1395
1396 if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
1397 struct hci_cp_set_conn_encrypt cp;
1398 cp.handle = cpu_to_le16(conn->handle);
1399 cp.encrypt = 0x01;
1400 hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
1401 &cp);
1402 }
1403 }
1404
1405 /* Enable security */
hci_conn_security(struct hci_conn * conn,__u8 sec_level,__u8 auth_type,bool initiator)1406 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type,
1407 bool initiator)
1408 {
1409 BT_DBG("hcon %p", conn);
1410
1411 if (conn->type == LE_LINK)
1412 return smp_conn_security(conn, sec_level);
1413
1414 /* For sdp we don't need the link key. */
1415 if (sec_level == BT_SECURITY_SDP)
1416 return 1;
1417
1418 /* For non 2.1 devices and low security level we don't need the link
1419 key. */
1420 if (sec_level == BT_SECURITY_LOW && !hci_conn_ssp_enabled(conn))
1421 return 1;
1422
1423 /* For other security levels we need the link key. */
1424 if (!test_bit(HCI_CONN_AUTH, &conn->flags))
1425 goto auth;
1426
1427 /* An authenticated FIPS approved combination key has sufficient
1428 * security for security level 4. */
1429 if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256 &&
1430 sec_level == BT_SECURITY_FIPS)
1431 goto encrypt;
1432
1433 /* An authenticated combination key has sufficient security for
1434 security level 3. */
1435 if ((conn->key_type == HCI_LK_AUTH_COMBINATION_P192 ||
1436 conn->key_type == HCI_LK_AUTH_COMBINATION_P256) &&
1437 sec_level == BT_SECURITY_HIGH)
1438 goto encrypt;
1439
1440 /* An unauthenticated combination key has sufficient security for
1441 security level 1 and 2. */
1442 if ((conn->key_type == HCI_LK_UNAUTH_COMBINATION_P192 ||
1443 conn->key_type == HCI_LK_UNAUTH_COMBINATION_P256) &&
1444 (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW))
1445 goto encrypt;
1446
1447 /* A combination key has always sufficient security for the security
1448 levels 1 or 2. High security level requires the combination key
1449 is generated using maximum PIN code length (16).
1450 For pre 2.1 units. */
1451 if (conn->key_type == HCI_LK_COMBINATION &&
1452 (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW ||
1453 conn->pin_length == 16))
1454 goto encrypt;
1455
1456 auth:
1457 if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags))
1458 return 0;
1459
1460 if (initiator)
1461 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
1462
1463 if (!hci_conn_auth(conn, sec_level, auth_type))
1464 return 0;
1465
1466 encrypt:
1467 if (test_bit(HCI_CONN_ENCRYPT, &conn->flags)) {
1468 /* Ensure that the encryption key size has been read,
1469 * otherwise stall the upper layer responses.
1470 */
1471 if (!conn->enc_key_size)
1472 return 0;
1473
1474 /* Nothing else needed, all requirements are met */
1475 return 1;
1476 }
1477
1478 hci_conn_encrypt(conn);
1479 return 0;
1480 }
1481 EXPORT_SYMBOL(hci_conn_security);
1482
1483 /* Check secure link requirement */
hci_conn_check_secure(struct hci_conn * conn,__u8 sec_level)1484 int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level)
1485 {
1486 BT_DBG("hcon %p", conn);
1487
1488 /* Accept if non-secure or higher security level is required */
1489 if (sec_level != BT_SECURITY_HIGH && sec_level != BT_SECURITY_FIPS)
1490 return 1;
1491
1492 /* Accept if secure or higher security level is already present */
1493 if (conn->sec_level == BT_SECURITY_HIGH ||
1494 conn->sec_level == BT_SECURITY_FIPS)
1495 return 1;
1496
1497 /* Reject not secure link */
1498 return 0;
1499 }
1500 EXPORT_SYMBOL(hci_conn_check_secure);
1501
1502 /* Switch role */
hci_conn_switch_role(struct hci_conn * conn,__u8 role)1503 int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
1504 {
1505 BT_DBG("hcon %p", conn);
1506
1507 if (role == conn->role)
1508 return 1;
1509
1510 if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->flags)) {
1511 struct hci_cp_switch_role cp;
1512 bacpy(&cp.bdaddr, &conn->dst);
1513 cp.role = role;
1514 hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
1515 }
1516
1517 return 0;
1518 }
1519 EXPORT_SYMBOL(hci_conn_switch_role);
1520
1521 /* Enter active mode */
hci_conn_enter_active_mode(struct hci_conn * conn,__u8 force_active)1522 void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
1523 {
1524 struct hci_dev *hdev = conn->hdev;
1525
1526 BT_DBG("hcon %p mode %d", conn, conn->mode);
1527
1528 if (conn->mode != HCI_CM_SNIFF)
1529 goto timer;
1530
1531 if (!test_bit(HCI_CONN_POWER_SAVE, &conn->flags) && !force_active)
1532 goto timer;
1533
1534 if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
1535 struct hci_cp_exit_sniff_mode cp;
1536 cp.handle = cpu_to_le16(conn->handle);
1537 hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
1538 }
1539
1540 timer:
1541 if (hdev->idle_timeout > 0)
1542 queue_delayed_work(hdev->workqueue, &conn->idle_work,
1543 msecs_to_jiffies(hdev->idle_timeout));
1544 }
1545
1546 /* Drop all connection on the device */
hci_conn_hash_flush(struct hci_dev * hdev)1547 void hci_conn_hash_flush(struct hci_dev *hdev)
1548 {
1549 struct hci_conn_hash *h = &hdev->conn_hash;
1550 struct hci_conn *c, *n;
1551
1552 BT_DBG("hdev %s", hdev->name);
1553
1554 list_for_each_entry_safe(c, n, &h->list, list) {
1555 c->state = BT_CLOSED;
1556
1557 hci_disconn_cfm(c, HCI_ERROR_LOCAL_HOST_TERM);
1558 hci_conn_del(c);
1559 }
1560 }
1561
1562 /* Check pending connect attempts */
hci_conn_check_pending(struct hci_dev * hdev)1563 void hci_conn_check_pending(struct hci_dev *hdev)
1564 {
1565 struct hci_conn *conn;
1566
1567 BT_DBG("hdev %s", hdev->name);
1568
1569 hci_dev_lock(hdev);
1570
1571 conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
1572 if (conn)
1573 hci_acl_create_connection(conn);
1574
1575 hci_dev_unlock(hdev);
1576 }
1577
get_link_mode(struct hci_conn * conn)1578 static u32 get_link_mode(struct hci_conn *conn)
1579 {
1580 u32 link_mode = 0;
1581
1582 if (conn->role == HCI_ROLE_MASTER)
1583 link_mode |= HCI_LM_MASTER;
1584
1585 if (test_bit(HCI_CONN_ENCRYPT, &conn->flags))
1586 link_mode |= HCI_LM_ENCRYPT;
1587
1588 if (test_bit(HCI_CONN_AUTH, &conn->flags))
1589 link_mode |= HCI_LM_AUTH;
1590
1591 if (test_bit(HCI_CONN_SECURE, &conn->flags))
1592 link_mode |= HCI_LM_SECURE;
1593
1594 if (test_bit(HCI_CONN_FIPS, &conn->flags))
1595 link_mode |= HCI_LM_FIPS;
1596
1597 return link_mode;
1598 }
1599
hci_get_conn_list(void __user * arg)1600 int hci_get_conn_list(void __user *arg)
1601 {
1602 struct hci_conn *c;
1603 struct hci_conn_list_req req, *cl;
1604 struct hci_conn_info *ci;
1605 struct hci_dev *hdev;
1606 int n = 0, size, err;
1607
1608 if (copy_from_user(&req, arg, sizeof(req)))
1609 return -EFAULT;
1610
1611 if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
1612 return -EINVAL;
1613
1614 size = sizeof(req) + req.conn_num * sizeof(*ci);
1615
1616 cl = kmalloc(size, GFP_KERNEL);
1617 if (!cl)
1618 return -ENOMEM;
1619
1620 hdev = hci_dev_get(req.dev_id);
1621 if (!hdev) {
1622 kfree(cl);
1623 return -ENODEV;
1624 }
1625
1626 ci = cl->conn_info;
1627
1628 hci_dev_lock(hdev);
1629 list_for_each_entry(c, &hdev->conn_hash.list, list) {
1630 bacpy(&(ci + n)->bdaddr, &c->dst);
1631 (ci + n)->handle = c->handle;
1632 (ci + n)->type = c->type;
1633 (ci + n)->out = c->out;
1634 (ci + n)->state = c->state;
1635 (ci + n)->link_mode = get_link_mode(c);
1636 if (++n >= req.conn_num)
1637 break;
1638 }
1639 hci_dev_unlock(hdev);
1640
1641 cl->dev_id = hdev->id;
1642 cl->conn_num = n;
1643 size = sizeof(req) + n * sizeof(*ci);
1644
1645 hci_dev_put(hdev);
1646
1647 err = copy_to_user(arg, cl, size);
1648 kfree(cl);
1649
1650 return err ? -EFAULT : 0;
1651 }
1652
hci_get_conn_info(struct hci_dev * hdev,void __user * arg)1653 int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
1654 {
1655 struct hci_conn_info_req req;
1656 struct hci_conn_info ci;
1657 struct hci_conn *conn;
1658 char __user *ptr = arg + sizeof(req);
1659
1660 if (copy_from_user(&req, arg, sizeof(req)))
1661 return -EFAULT;
1662
1663 hci_dev_lock(hdev);
1664 conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
1665 if (conn) {
1666 bacpy(&ci.bdaddr, &conn->dst);
1667 ci.handle = conn->handle;
1668 ci.type = conn->type;
1669 ci.out = conn->out;
1670 ci.state = conn->state;
1671 ci.link_mode = get_link_mode(conn);
1672 }
1673 hci_dev_unlock(hdev);
1674
1675 if (!conn)
1676 return -ENOENT;
1677
1678 return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
1679 }
1680
hci_get_auth_info(struct hci_dev * hdev,void __user * arg)1681 int hci_get_auth_info(struct hci_dev *hdev, void __user *arg)
1682 {
1683 struct hci_auth_info_req req;
1684 struct hci_conn *conn;
1685
1686 if (copy_from_user(&req, arg, sizeof(req)))
1687 return -EFAULT;
1688
1689 hci_dev_lock(hdev);
1690 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr);
1691 if (conn)
1692 req.type = conn->auth_type;
1693 hci_dev_unlock(hdev);
1694
1695 if (!conn)
1696 return -ENOENT;
1697
1698 return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0;
1699 }
1700
hci_chan_create(struct hci_conn * conn)1701 struct hci_chan *hci_chan_create(struct hci_conn *conn)
1702 {
1703 struct hci_dev *hdev = conn->hdev;
1704 struct hci_chan *chan;
1705
1706 BT_DBG("%s hcon %p", hdev->name, conn);
1707
1708 if (test_bit(HCI_CONN_DROP, &conn->flags)) {
1709 BT_DBG("Refusing to create new hci_chan");
1710 return NULL;
1711 }
1712
1713 chan = kzalloc(sizeof(*chan), GFP_KERNEL);
1714 if (!chan)
1715 return NULL;
1716
1717 chan->conn = hci_conn_get(conn);
1718 skb_queue_head_init(&chan->data_q);
1719 chan->state = BT_CONNECTED;
1720
1721 list_add_rcu(&chan->list, &conn->chan_list);
1722
1723 return chan;
1724 }
1725
hci_chan_del(struct hci_chan * chan)1726 void hci_chan_del(struct hci_chan *chan)
1727 {
1728 struct hci_conn *conn = chan->conn;
1729 struct hci_dev *hdev = conn->hdev;
1730
1731 BT_DBG("%s hcon %p chan %p", hdev->name, conn, chan);
1732
1733 list_del_rcu(&chan->list);
1734
1735 synchronize_rcu();
1736
1737 /* Prevent new hci_chan's to be created for this hci_conn */
1738 set_bit(HCI_CONN_DROP, &conn->flags);
1739
1740 hci_conn_put(conn);
1741
1742 skb_queue_purge(&chan->data_q);
1743 kfree(chan);
1744 }
1745
hci_chan_list_flush(struct hci_conn * conn)1746 void hci_chan_list_flush(struct hci_conn *conn)
1747 {
1748 struct hci_chan *chan, *n;
1749
1750 BT_DBG("hcon %p", conn);
1751
1752 list_for_each_entry_safe(chan, n, &conn->chan_list, list)
1753 hci_chan_del(chan);
1754 }
1755
__hci_chan_lookup_handle(struct hci_conn * hcon,__u16 handle)1756 static struct hci_chan *__hci_chan_lookup_handle(struct hci_conn *hcon,
1757 __u16 handle)
1758 {
1759 struct hci_chan *hchan;
1760
1761 list_for_each_entry(hchan, &hcon->chan_list, list) {
1762 if (hchan->handle == handle)
1763 return hchan;
1764 }
1765
1766 return NULL;
1767 }
1768
hci_chan_lookup_handle(struct hci_dev * hdev,__u16 handle)1769 struct hci_chan *hci_chan_lookup_handle(struct hci_dev *hdev, __u16 handle)
1770 {
1771 struct hci_conn_hash *h = &hdev->conn_hash;
1772 struct hci_conn *hcon;
1773 struct hci_chan *hchan = NULL;
1774
1775 rcu_read_lock();
1776
1777 list_for_each_entry_rcu(hcon, &h->list, list) {
1778 hchan = __hci_chan_lookup_handle(hcon, handle);
1779 if (hchan)
1780 break;
1781 }
1782
1783 rcu_read_unlock();
1784
1785 return hchan;
1786 }
1787
hci_conn_get_phy(struct hci_conn * conn)1788 u32 hci_conn_get_phy(struct hci_conn *conn)
1789 {
1790 u32 phys = 0;
1791
1792 hci_dev_lock(conn->hdev);
1793
1794 /* BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 2, Part B page 471:
1795 * Table 6.2: Packets defined for synchronous, asynchronous, and
1796 * CSB logical transport types.
1797 */
1798 switch (conn->type) {
1799 case SCO_LINK:
1800 /* SCO logical transport (1 Mb/s):
1801 * HV1, HV2, HV3 and DV.
1802 */
1803 phys |= BT_PHY_BR_1M_1SLOT;
1804
1805 break;
1806
1807 case ACL_LINK:
1808 /* ACL logical transport (1 Mb/s) ptt=0:
1809 * DH1, DM3, DH3, DM5 and DH5.
1810 */
1811 phys |= BT_PHY_BR_1M_1SLOT;
1812
1813 if (conn->pkt_type & (HCI_DM3 | HCI_DH3))
1814 phys |= BT_PHY_BR_1M_3SLOT;
1815
1816 if (conn->pkt_type & (HCI_DM5 | HCI_DH5))
1817 phys |= BT_PHY_BR_1M_5SLOT;
1818
1819 /* ACL logical transport (2 Mb/s) ptt=1:
1820 * 2-DH1, 2-DH3 and 2-DH5.
1821 */
1822 if (!(conn->pkt_type & HCI_2DH1))
1823 phys |= BT_PHY_EDR_2M_1SLOT;
1824
1825 if (!(conn->pkt_type & HCI_2DH3))
1826 phys |= BT_PHY_EDR_2M_3SLOT;
1827
1828 if (!(conn->pkt_type & HCI_2DH5))
1829 phys |= BT_PHY_EDR_2M_5SLOT;
1830
1831 /* ACL logical transport (3 Mb/s) ptt=1:
1832 * 3-DH1, 3-DH3 and 3-DH5.
1833 */
1834 if (!(conn->pkt_type & HCI_3DH1))
1835 phys |= BT_PHY_EDR_3M_1SLOT;
1836
1837 if (!(conn->pkt_type & HCI_3DH3))
1838 phys |= BT_PHY_EDR_3M_3SLOT;
1839
1840 if (!(conn->pkt_type & HCI_3DH5))
1841 phys |= BT_PHY_EDR_3M_5SLOT;
1842
1843 break;
1844
1845 case ESCO_LINK:
1846 /* eSCO logical transport (1 Mb/s): EV3, EV4 and EV5 */
1847 phys |= BT_PHY_BR_1M_1SLOT;
1848
1849 if (!(conn->pkt_type & (ESCO_EV4 | ESCO_EV5)))
1850 phys |= BT_PHY_BR_1M_3SLOT;
1851
1852 /* eSCO logical transport (2 Mb/s): 2-EV3, 2-EV5 */
1853 if (!(conn->pkt_type & ESCO_2EV3))
1854 phys |= BT_PHY_EDR_2M_1SLOT;
1855
1856 if (!(conn->pkt_type & ESCO_2EV5))
1857 phys |= BT_PHY_EDR_2M_3SLOT;
1858
1859 /* eSCO logical transport (3 Mb/s): 3-EV3, 3-EV5 */
1860 if (!(conn->pkt_type & ESCO_3EV3))
1861 phys |= BT_PHY_EDR_3M_1SLOT;
1862
1863 if (!(conn->pkt_type & ESCO_3EV5))
1864 phys |= BT_PHY_EDR_3M_3SLOT;
1865
1866 break;
1867
1868 case LE_LINK:
1869 if (conn->le_tx_phy & HCI_LE_SET_PHY_1M)
1870 phys |= BT_PHY_LE_1M_TX;
1871
1872 if (conn->le_rx_phy & HCI_LE_SET_PHY_1M)
1873 phys |= BT_PHY_LE_1M_RX;
1874
1875 if (conn->le_tx_phy & HCI_LE_SET_PHY_2M)
1876 phys |= BT_PHY_LE_2M_TX;
1877
1878 if (conn->le_rx_phy & HCI_LE_SET_PHY_2M)
1879 phys |= BT_PHY_LE_2M_RX;
1880
1881 if (conn->le_tx_phy & HCI_LE_SET_PHY_CODED)
1882 phys |= BT_PHY_LE_CODED_TX;
1883
1884 if (conn->le_rx_phy & HCI_LE_SET_PHY_CODED)
1885 phys |= BT_PHY_LE_CODED_RX;
1886
1887 break;
1888 }
1889
1890 hci_dev_unlock(conn->hdev);
1891
1892 return phys;
1893 }
1894
