net/bluetooth/hci_conn.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <[email protected]>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI connection handling. */
  26
  27 #include <linux/export.h>
  28 #include <linux/debugfs.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/l2cap.h>
  33
  34 #include "hci_request.h"
  35 #include "smp.h"
  36 #include "a2mp.h"
  37
  38 struct sco_param {
  39         u16 pkt_type;
  40         u16 max_latency;
  41         u8  retrans_effort;
  42 };
  43
  44 static const struct sco_param esco_param_cvsd[] = {
  45         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000a,   0x01 }, /* S3 */
  46         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x0007,   0x01 }, /* S2 */
  47         { EDR_ESCO_MASK | ESCO_EV3,   0x0007,   0x01 }, /* S1 */
  48         { EDR_ESCO_MASK | ESCO_HV3,   0xffff,   0x01 }, /* D1 */
  49         { EDR_ESCO_MASK | ESCO_HV1,   0xffff,   0x01 }, /* D0 */
  50 };
  51
  52 static const struct sco_param sco_param_cvsd[] = {
  53         { EDR_ESCO_MASK | ESCO_HV3,   0xffff,   0xff }, /* D1 */
  54         { EDR_ESCO_MASK | ESCO_HV1,   0xffff,   0xff }, /* D0 */
  55 };
  56
  57 static const struct sco_param esco_param_msbc[] = {
  58         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000d,   0x02 }, /* T2 */
  59         { EDR_ESCO_MASK | ESCO_EV3,   0x0008,   0x02 }, /* T1 */
  60 };
  61
  62 /* This function requires the caller holds hdev->lock */
  63 static void hci_connect_le_scan_cleanup(struct hci_conn *conn)
  64 {
  65         struct hci_conn_params *params;
  66         struct hci_dev *hdev = conn->hdev;
  67         struct smp_irk *irk;
  68         bdaddr_t *bdaddr;
  69         u8 bdaddr_type;
  70
  71         bdaddr = &conn->dst;
  72         bdaddr_type = conn->dst_type;
  73
  74         /* Check if we need to convert to identity address */
  75         irk = hci_get_irk(hdev, bdaddr, bdaddr_type);
  76         if (irk) {
  77                 bdaddr = &irk->bdaddr;
  78                 bdaddr_type = irk->addr_type;
  79         }
  80
  81         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, bdaddr,
  82                                            bdaddr_type);
  83         if (!params || !params->explicit_connect)
  84                 return;
  85
  86         /* The connection attempt was doing scan for new RPA, and is
  87          * in scan phase. If params are not associated with any other
  88          * autoconnect action, remove them completely. If they are, just unmark
  89          * them as waiting for connection, by clearing explicit_connect field.
  90          */
  91         params->explicit_connect = false;
  92
  93         list_del_init(&params->action);
  94
  95         switch (params->auto_connect) {
  96         case HCI_AUTO_CONN_EXPLICIT:
  97                 hci_conn_params_del(hdev, bdaddr, bdaddr_type);
  98                 /* return instead of break to avoid duplicate scan update */
  99                 return;
 100         case HCI_AUTO_CONN_DIRECT:
 101         case HCI_AUTO_CONN_ALWAYS:
 102                 list_add(&params->action, &hdev->pend_le_conns);
 103                 break;
 104         case HCI_AUTO_CONN_REPORT:
 105                 list_add(&params->action, &hdev->pend_le_reports);
 106                 break;
 107         default:
 108                 break;
 109         }
 110
 111         hci_update_background_scan(hdev);
 112 }
 113
 114 static void hci_conn_cleanup(struct hci_conn *conn)
 115 {
 116         struct hci_dev *hdev = conn->hdev;
 117
 118         if (test_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags))
 119                 hci_conn_params_del(conn->hdev, &conn->dst, conn->dst_type);
 120
 121         hci_chan_list_flush(conn);
 122
 123         hci_conn_hash_del(hdev, conn);
 124
 125         if (conn->type == SCO_LINK || conn->type == ESCO_LINK) {
 126                 switch (conn->setting & SCO_AIRMODE_MASK) {
 127                 case SCO_AIRMODE_CVSD:
 128                 case SCO_AIRMODE_TRANSP:
 129                         if (hdev->notify)
 130                                 hdev->notify(hdev, HCI_NOTIFY_DISABLE_SCO);
 131                         break;
 132                 }
 133         } else {
 134                 if (hdev->notify)
 135                         hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
 136         }
 137
 138         hci_conn_del_sysfs(conn);
 139
 140         debugfs_remove_recursive(conn->debugfs);
 141
 142         hci_dev_put(hdev);
 143
 144         hci_conn_put(conn);
 145 }
 146
 147 static void le_scan_cleanup(struct work_struct *work)
 148 {
 149         struct hci_conn *conn = container_of(work, struct hci_conn,
 150                                              le_scan_cleanup);
 151         struct hci_dev *hdev = conn->hdev;
 152         struct hci_conn *c = NULL;
 153
 154         BT_DBG("%s hcon %p", hdev->name, conn);
 155
 156         hci_dev_lock(hdev);
 157
 158         /* Check that the hci_conn is still around */
 159         rcu_read_lock();
 160         list_for_each_entry_rcu(c, &hdev->conn_hash.list, list) {
 161                 if (c == conn)
 162                         break;
 163         }
 164         rcu_read_unlock();
 165
 166         if (c == conn) {
 167                 hci_connect_le_scan_cleanup(conn);
 168                 hci_conn_cleanup(conn);
 169         }
 170
 171         hci_dev_unlock(hdev);
 172         hci_dev_put(hdev);
 173         hci_conn_put(conn);
 174 }
 175
 176 static void hci_connect_le_scan_remove(struct hci_conn *conn)
 177 {
 178         BT_DBG("%s hcon %p", conn->hdev->name, conn);
 179
 180         /* We can't call hci_conn_del/hci_conn_cleanup here since that
 181          * could deadlock with another hci_conn_del() call that's holding
 182          * hci_dev_lock and doing cancel_delayed_work_sync(&conn->disc_work).
 183          * Instead, grab temporary extra references to the hci_dev and
 184          * hci_conn and perform the necessary cleanup in a separate work
 185          * callback.
 186          */
 187
 188         hci_dev_hold(conn->hdev);
 189         hci_conn_get(conn);
 190
 191         /* Even though we hold a reference to the hdev, many other
 192          * things might get cleaned up meanwhile, including the hdev's
 193          * own workqueue, so we can't use that for scheduling.
 194          */
 195         schedule_work(&conn->le_scan_cleanup);
 196 }
 197
 198 static void hci_acl_create_connection(struct hci_conn *conn)
 199 {
 200         struct hci_dev *hdev = conn->hdev;
 201         struct inquiry_entry *ie;
 202         struct hci_cp_create_conn cp;
 203
 204         BT_DBG("hcon %p", conn);
 205
 206         conn->state = BT_CONNECT;
 207         conn->out = true;
 208         conn->role = HCI_ROLE_MASTER;
 209
 210         conn->attempt++;
 211
 212         conn->link_policy = hdev->link_policy;
 213
 214         memset(&cp, 0, sizeof(cp));
 215         bacpy(&cp.bdaddr, &conn->dst);
 216         cp.pscan_rep_mode = 0x02;
 217
 218         ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
 219         if (ie) {
 220                 if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
 221                         cp.pscan_rep_mode = ie->data.pscan_rep_mode;
 222                         cp.pscan_mode     = ie->data.pscan_mode;
 223                         cp.clock_offset   = ie->data.clock_offset |
 224                                             cpu_to_le16(0x8000);
 225                 }
 226
 227                 memcpy(conn->dev_class, ie->data.dev_class, 3);
 228         }
 229
 230         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 231         if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
 232                 cp.role_switch = 0x01;
 233         else
 234                 cp.role_switch = 0x00;
 235
 236         hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
 237 }
 238
 239 int hci_disconnect(struct hci_conn *conn, __u8 reason)
 240 {
 241         BT_DBG("hcon %p", conn);
 242
 243         /* When we are master of an established connection and it enters
 244          * the disconnect timeout, then go ahead and try to read the
 245          * current clock offset.  Processing of the result is done
 246          * within the event handling and hci_clock_offset_evt function.
 247          */
 248         if (conn->type == ACL_LINK && conn->role == HCI_ROLE_MASTER &&
 249             (conn->state == BT_CONNECTED || conn->state == BT_CONFIG)) {
 250                 struct hci_dev *hdev = conn->hdev;
 251                 struct hci_cp_read_clock_offset clkoff_cp;
 252
 253                 clkoff_cp.handle = cpu_to_le16(conn->handle);
 254                 hci_send_cmd(hdev, HCI_OP_READ_CLOCK_OFFSET, sizeof(clkoff_cp),
 255                              &clkoff_cp);
 256         }
 257
 258         return hci_abort_conn(conn, reason);
 259 }
 260
 261 static void hci_add_sco(struct hci_conn *conn, __u16 handle)
 262 {
 263         struct hci_dev *hdev = conn->hdev;
 264         struct hci_cp_add_sco cp;
 265
 266         BT_DBG("hcon %p", conn);
 267
 268         conn->state = BT_CONNECT;
 269         conn->out = true;
 270
 271         conn->attempt++;
 272
 273         cp.handle   = cpu_to_le16(handle);
 274         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 275
 276         hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
 277 }
 278
 279 bool hci_setup_sync(struct hci_conn *conn, __u16 handle)
 280 {
 281         struct hci_dev *hdev = conn->hdev;
 282         struct hci_cp_setup_sync_conn cp;
 283         const struct sco_param *param;
 284
 285         BT_DBG("hcon %p", conn);
 286
 287         conn->state = BT_CONNECT;
 288         conn->out = true;
 289
 290         conn->attempt++;
 291
 292         cp.handle   = cpu_to_le16(handle);
 293
 294         cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
 295         cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
 296         cp.voice_setting  = cpu_to_le16(conn->setting);
 297
 298         switch (conn->setting & SCO_AIRMODE_MASK) {
 299         case SCO_AIRMODE_TRANSP:
 300                 if (conn->attempt > ARRAY_SIZE(esco_param_msbc))
 301                         return false;
 302                 param = &esco_param_msbc[conn->attempt - 1];
 303                 break;
 304         case SCO_AIRMODE_CVSD:
 305                 if (lmp_esco_capable(conn->link)) {
 306                         if (conn->attempt > ARRAY_SIZE(esco_param_cvsd))
 307                                 return false;
 308                         param = &esco_param_cvsd[conn->attempt - 1];
 309                 } else {
 310                         if (conn->attempt > ARRAY_SIZE(sco_param_cvsd))
 311                                 return false;
 312                         param = &sco_param_cvsd[conn->attempt - 1];
 313                 }
 314                 break;
 315         default:
 316                 return false;
 317         }
 318
 319         cp.retrans_effort = param->retrans_effort;
 320         cp.pkt_type = __cpu_to_le16(param->pkt_type);
 321         cp.max_latency = __cpu_to_le16(param->max_latency);
 322
 323         if (hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp) < 0)
 324                 return false;
 325
 326         return true;
 327 }
 328
 329 u8 hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max, u16 latency,
 330                       u16 to_multiplier)
 331 {
 332         struct hci_dev *hdev = conn->hdev;
 333         struct hci_conn_params *params;
 334         struct hci_cp_le_conn_update cp;
 335
 336         hci_dev_lock(hdev);
 337
 338         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
 339         if (params) {
 340                 params->conn_min_interval = min;
 341                 params->conn_max_interval = max;
 342                 params->conn_latency = latency;
 343                 params->supervision_timeout = to_multiplier;
 344         }
 345
 346         hci_dev_unlock(hdev);
 347
 348         memset(&cp, 0, sizeof(cp));
 349         cp.handle               = cpu_to_le16(conn->handle);
 350         cp.conn_interval_min    = cpu_to_le16(min);
 351         cp.conn_interval_max    = cpu_to_le16(max);
 352         cp.conn_latency         = cpu_to_le16(latency);
 353         cp.supervision_timeout  = cpu_to_le16(to_multiplier);
 354         cp.min_ce_len           = cpu_to_le16(0x0000);
 355         cp.max_ce_len           = cpu_to_le16(0x0000);
 356
 357         hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp);
 358
 359         if (params)
 360                 return 0x01;
 361
 362         return 0x00;
 363 }
 364
 365 void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __le64 rand,
 366                       __u8 ltk[16], __u8 key_size)
 367 {
 368         struct hci_dev *hdev = conn->hdev;
 369         struct hci_cp_le_start_enc cp;
 370
 371         BT_DBG("hcon %p", conn);
 372
 373         memset(&cp, 0, sizeof(cp));
 374
 375         cp.handle = cpu_to_le16(conn->handle);
 376         cp.rand = rand;
 377         cp.ediv = ediv;
 378         memcpy(cp.ltk, ltk, key_size);
 379
 380         hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp);
 381 }
 382
 383 /* Device _must_ be locked */
 384 void hci_sco_setup(struct hci_conn *conn, __u8 status)
 385 {
 386         struct hci_conn *sco = conn->link;
 387
 388         if (!sco)
 389                 return;
 390
 391         BT_DBG("hcon %p", conn);
 392
 393         if (!status) {
 394                 if (lmp_esco_capable(conn->hdev))
 395                         hci_setup_sync(sco, conn->handle);
 396                 else
 397                         hci_add_sco(sco, conn->handle);
 398         } else {
 399                 hci_connect_cfm(sco, status);
 400                 hci_conn_del(sco);
 401         }
 402 }
 403
 404 static void hci_conn_timeout(struct work_struct *work)
 405 {
 406         struct hci_conn *conn = container_of(work, struct hci_conn,
 407                                              disc_work.work);
 408         int refcnt = atomic_read(&conn->refcnt);
 409
 410         BT_DBG("hcon %p state %s", conn, state_to_string(conn->state));
 411
 412         WARN_ON(refcnt < 0);
 413
 414         /* FIXME: It was observed that in pairing failed scenario, refcnt
 415          * drops below 0. Probably this is because l2cap_conn_del calls
 416          * l2cap_chan_del for each channel, and inside l2cap_chan_del conn is
 417          * dropped. After that loop hci_chan_del is called which also drops
 418          * conn. For now make sure that ACL is alive if refcnt is higher then 0,
 419          * otherwise drop it.
 420          */
 421         if (refcnt > 0)
 422                 return;
 423
 424         /* LE connections in scanning state need special handling */
 425         if (conn->state == BT_CONNECT && conn->type == LE_LINK &&
 426             test_bit(HCI_CONN_SCANNING, &conn->flags)) {
 427                 hci_connect_le_scan_remove(conn);
 428                 return;
 429         }
 430
 431         hci_abort_conn(conn, hci_proto_disconn_ind(conn));
 432 }
 433
 434 /* Enter sniff mode */
 435 static void hci_conn_idle(struct work_struct *work)
 436 {
 437         struct hci_conn *conn = container_of(work, struct hci_conn,
 438                                              idle_work.work);
 439         struct hci_dev *hdev = conn->hdev;
 440
 441         BT_DBG("hcon %p mode %d", conn, conn->mode);
 442
 443         if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn))
 444                 return;
 445
 446         if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF))
 447                 return;
 448
 449         if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
 450                 struct hci_cp_sniff_subrate cp;
 451                 cp.handle             = cpu_to_le16(conn->handle);
 452                 cp.max_latency        = cpu_to_le16(0);
 453                 cp.min_remote_timeout = cpu_to_le16(0);
 454                 cp.min_local_timeout  = cpu_to_le16(0);
 455                 hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
 456         }
 457
 458         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
 459                 struct hci_cp_sniff_mode cp;
 460                 cp.handle       = cpu_to_le16(conn->handle);
 461                 cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
 462                 cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
 463                 cp.attempt      = cpu_to_le16(4);
 464                 cp.timeout      = cpu_to_le16(1);
 465                 hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
 466         }
 467 }
 468
 469 static void hci_conn_auto_accept(struct work_struct *work)
 470 {
 471         struct hci_conn *conn = container_of(work, struct hci_conn,
 472                                              auto_accept_work.work);
 473
 474         hci_send_cmd(conn->hdev, HCI_OP_USER_CONFIRM_REPLY, sizeof(conn->dst),
 475                      &conn->dst);
 476 }
 477
 478 static void le_disable_advertising(struct hci_dev *hdev)
 479 {
 480         if (ext_adv_capable(hdev)) {
 481                 struct hci_cp_le_set_ext_adv_enable cp;
 482
 483                 cp.enable = 0x00;
 484                 cp.num_of_sets = 0x00;
 485
 486                 hci_send_cmd(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE, sizeof(cp),
 487                              &cp);
 488         } else {
 489                 u8 enable = 0x00;
 490                 hci_send_cmd(hdev, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable),
 491                              &enable);
 492         }
 493 }
 494
 495 static void le_conn_timeout(struct work_struct *work)
 496 {
 497         struct hci_conn *conn = container_of(work, struct hci_conn,
 498                                              le_conn_timeout.work);
 499         struct hci_dev *hdev = conn->hdev;
 500
 501         BT_DBG("");
 502
 503         /* We could end up here due to having done directed advertising,
 504          * so clean up the state if necessary. This should however only
 505          * happen with broken hardware or if low duty cycle was used
 506          * (which doesn't have a timeout of its own).
 507          */
 508         if (conn->role == HCI_ROLE_SLAVE) {
 509                 /* Disable LE Advertising */
 510                 le_disable_advertising(hdev);
 511                 hci_le_conn_failed(conn, HCI_ERROR_ADVERTISING_TIMEOUT);
 512                 return;
 513         }
 514
 515         hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
 516 }
 517
 518 struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst,
 519                               u8 role)
 520 {
 521         struct hci_conn *conn;
 522
 523         BT_DBG("%s dst %pMR", hdev->name, dst);
 524
 525         conn = kzalloc(sizeof(*conn), GFP_KERNEL);
 526         if (!conn)
 527                 return NULL;
 528
 529         bacpy(&conn->dst, dst);
 530         bacpy(&conn->src, &hdev->bdaddr);
 531         conn->hdev  = hdev;
 532         conn->type  = type;
 533         conn->role  = role;
 534         conn->mode  = HCI_CM_ACTIVE;
 535         conn->state = BT_OPEN;
 536         conn->auth_type = HCI_AT_GENERAL_BONDING;
 537         conn->io_capability = hdev->io_capability;
 538         conn->remote_auth = 0xff;
 539         conn->key_type = 0xff;
 540         conn->rssi = HCI_RSSI_INVALID;
 541         conn->tx_power = HCI_TX_POWER_INVALID;
 542         conn->max_tx_power = HCI_TX_POWER_INVALID;
 543
 544         set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
 545         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
 546
 547         /* Set Default Authenticated payload timeout to 30s */
 548         conn->auth_payload_timeout = DEFAULT_AUTH_PAYLOAD_TIMEOUT;
 549
 550         if (conn->role == HCI_ROLE_MASTER)
 551                 conn->out = true;
 552
 553         switch (type) {
 554         case ACL_LINK:
 555                 conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
 556                 break;
 557         case LE_LINK:
 558                 /* conn->src should reflect the local identity address */
 559                 hci_copy_identity_address(hdev, &conn->src, &conn->src_type);
 560                 break;
 561         case SCO_LINK:
 562                 if (lmp_esco_capable(hdev))
 563                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
 564                                         (hdev->esco_type & EDR_ESCO_MASK);
 565                 else
 566                         conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
 567                 break;
 568         case ESCO_LINK:
 569                 conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
 570                 break;
 571         }
 572
 573         skb_queue_head_init(&conn->data_q);
 574
 575         INIT_LIST_HEAD(&conn->chan_list);
 576
 577         INIT_DELAYED_WORK(&conn->disc_work, hci_conn_timeout);
 578         INIT_DELAYED_WORK(&conn->auto_accept_work, hci_conn_auto_accept);
 579         INIT_DELAYED_WORK(&conn->idle_work, hci_conn_idle);
 580         INIT_DELAYED_WORK(&conn->le_conn_timeout, le_conn_timeout);
 581         INIT_WORK(&conn->le_scan_cleanup, le_scan_cleanup);
 582
 583         atomic_set(&conn->refcnt, 0);
 584
 585         hci_dev_hold(hdev);
 586
 587         hci_conn_hash_add(hdev, conn);
 588
 589         /* The SCO and eSCO connections will only be notified when their
 590          * setup has been completed. This is different to ACL links which
 591          * can be notified right away.
 592          */
 593         if (conn->type != SCO_LINK && conn->type != ESCO_LINK) {
 594                 if (hdev->notify)
 595                         hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
 596         }
 597
 598         hci_conn_init_sysfs(conn);
 599
 600         return conn;
 601 }
 602
 603 int hci_conn_del(struct hci_conn *conn)
 604 {
 605         struct hci_dev *hdev = conn->hdev;
 606
 607         BT_DBG("%s hcon %p handle %d", hdev->name, conn, conn->handle);
 608
 609         cancel_delayed_work_sync(&conn->disc_work);
 610         cancel_delayed_work_sync(&conn->auto_accept_work);
 611         cancel_delayed_work_sync(&conn->idle_work);
 612
 613         if (conn->type == ACL_LINK) {
 614                 struct hci_conn *sco = conn->link;
 615                 if (sco)
 616                         sco->link = NULL;
 617
 618                 /* Unacked frames */
 619                 hdev->acl_cnt += conn->sent;
 620         } else if (conn->type == LE_LINK) {
 621                 cancel_delayed_work(&conn->le_conn_timeout);
 622
 623                 if (hdev->le_pkts)
 624                         hdev->le_cnt += conn->sent;
 625                 else
 626                         hdev->acl_cnt += conn->sent;
 627         } else {
 628                 struct hci_conn *acl = conn->link;
 629                 if (acl) {
 630                         acl->link = NULL;
 631                         hci_conn_drop(acl);
 632                 }
 633         }
 634
 635         if (conn->amp_mgr)
 636                 amp_mgr_put(conn->amp_mgr);
 637
 638         skb_queue_purge(&conn->data_q);
 639
 640         /* Remove the connection from the list and cleanup its remaining
 641          * state. This is a separate function since for some cases like
 642          * BT_CONNECT_SCAN we *only* want the cleanup part without the
 643          * rest of hci_conn_del.
 644          */
 645         hci_conn_cleanup(conn);
 646
 647         return 0;
 648 }
 649
 650 struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src, uint8_t src_type)
 651 {
 652         int use_src = bacmp(src, BDADDR_ANY);
 653         struct hci_dev *hdev = NULL, *d;
 654
 655         BT_DBG("%pMR -> %pMR", src, dst);
 656
 657         read_lock(&hci_dev_list_lock);
 658
 659         list_for_each_entry(d, &hci_dev_list, list) {
 660                 if (!test_bit(HCI_UP, &d->flags) ||
 661                     hci_dev_test_flag(d, HCI_USER_CHANNEL) ||
 662                     d->dev_type != HCI_PRIMARY)
 663                         continue;
 664
 665                 /* Simple routing:
 666                  *   No source address - find interface with bdaddr != dst
 667                  *   Source address    - find interface with bdaddr == src
 668                  */
 669
 670                 if (use_src) {
 671                         bdaddr_t id_addr;
 672                         u8 id_addr_type;
 673
 674                         if (src_type == BDADDR_BREDR) {
 675                                 if (!lmp_bredr_capable(d))
 676                                         continue;
 677                                 bacpy(&id_addr, &d->bdaddr);
 678                                 id_addr_type = BDADDR_BREDR;
 679                         } else {
 680                                 if (!lmp_le_capable(d))
 681                                         continue;
 682
 683                                 hci_copy_identity_address(d, &id_addr,
 684                                                           &id_addr_type);
 685
 686                                 /* Convert from HCI to three-value type */
 687                                 if (id_addr_type == ADDR_LE_DEV_PUBLIC)
 688                                         id_addr_type = BDADDR_LE_PUBLIC;
 689                                 else
 690                                         id_addr_type = BDADDR_LE_RANDOM;
 691                         }
 692
 693                         if (!bacmp(&id_addr, src) && id_addr_type == src_type) {
 694                                 hdev = d; break;
 695                         }
 696                 } else {
 697                         if (bacmp(&d->bdaddr, dst)) {
 698                                 hdev = d; break;
 699                         }
 700                 }
 701         }
 702
 703         if (hdev)
 704                 hdev = hci_dev_hold(hdev);
 705
 706         read_unlock(&hci_dev_list_lock);
 707         return hdev;
 708 }
 709 EXPORT_SYMBOL(hci_get_route);
 710
 711 /* This function requires the caller holds hdev->lock */
 712 void hci_le_conn_failed(struct hci_conn *conn, u8 status)
 713 {
 714         struct hci_dev *hdev = conn->hdev;
 715         struct hci_conn_params *params;
 716
 717         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
 718                                            conn->dst_type);
 719         if (params && params->conn) {
 720                 hci_conn_drop(params->conn);
 721                 hci_conn_put(params->conn);
 722                 params->conn = NULL;
 723         }
 724
 725         conn->state = BT_CLOSED;
 726
 727         /* If the status indicates successful cancellation of
 728          * the attempt (i.e. Unkown Connection Id) there's no point of
 729          * notifying failure since we'll go back to keep trying to
 730          * connect. The only exception is explicit connect requests
 731          * where a timeout + cancel does indicate an actual failure.
 732          */
 733         if (status != HCI_ERROR_UNKNOWN_CONN_ID ||
 734             (params && params->explicit_connect))
 735                 mgmt_connect_failed(hdev, &conn->dst, conn->type,
 736                                     conn->dst_type, status);
 737
 738         hci_connect_cfm(conn, status);
 739
 740         hci_conn_del(conn);
 741
 742         /* Since we may have temporarily stopped the background scanning in
 743          * favor of connection establishment, we should restart it.
 744          */
 745         hci_update_background_scan(hdev);
 746
 747         /* Re-enable advertising in case this was a failed connection
 748          * attempt as a peripheral.
 749          */
 750         hci_req_reenable_advertising(hdev);
 751 }
 752
 753 static void create_le_conn_complete(struct hci_dev *hdev, u8 status, u16 opcode)
 754 {
 755         struct hci_conn *conn;
 756
 757         hci_dev_lock(hdev);
 758
 759         conn = hci_lookup_le_connect(hdev);
 760
 761         if (!status) {
 762                 hci_connect_le_scan_cleanup(conn);
 763                 goto done;
 764         }
 765
 766         bt_dev_err(hdev, "request failed to create LE connection: "
 767                    "status 0x%2.2x", status);
 768
 769         if (!conn)
 770                 goto done;
 771
 772         hci_le_conn_failed(conn, status);
 773
 774 done:
 775         hci_dev_unlock(hdev);
 776 }
 777
 778 static bool conn_use_rpa(struct hci_conn *conn)
 779 {
 780         struct hci_dev *hdev = conn->hdev;
 781
 782         return hci_dev_test_flag(hdev, HCI_PRIVACY);
 783 }
 784
 785 static void set_ext_conn_params(struct hci_conn *conn,
 786                                 struct hci_cp_le_ext_conn_param *p)
 787 {
 788         struct hci_dev *hdev = conn->hdev;
 789
 790         memset(p, 0, sizeof(*p));
 791
 792         /* Set window to be the same value as the interval to
 793          * enable continuous scanning.
 794          */
 795         p->scan_interval = cpu_to_le16(hdev->le_scan_interval);
 796         p->scan_window = p->scan_interval;
 797         p->conn_interval_min = cpu_to_le16(conn->le_conn_min_interval);
 798         p->conn_interval_max = cpu_to_le16(conn->le_conn_max_interval);
 799         p->conn_latency = cpu_to_le16(conn->le_conn_latency);
 800         p->supervision_timeout = cpu_to_le16(conn->le_supv_timeout);
 801         p->min_ce_len = cpu_to_le16(0x0000);
 802         p->max_ce_len = cpu_to_le16(0x0000);
 803 }
 804
 805 static void hci_req_add_le_create_conn(struct hci_request *req,
 806                                        struct hci_conn *conn,
 807                                        bdaddr_t *direct_rpa)
 808 {
 809         struct hci_dev *hdev = conn->hdev;
 810         u8 own_addr_type;
 811
 812         /* If direct address was provided we use it instead of current
 813          * address.
 814          */
 815         if (direct_rpa) {
 816                 if (bacmp(&req->hdev->random_addr, direct_rpa))
 817                         hci_req_add(req, HCI_OP_LE_SET_RANDOM_ADDR, 6,
 818                                                                 direct_rpa);
 819
 820                 /* direct address is always RPA */
 821                 own_addr_type = ADDR_LE_DEV_RANDOM;
 822         } else {
 823                 /* Update random address, but set require_privacy to false so
 824                  * that we never connect with an non-resolvable address.
 825                  */
 826                 if (hci_update_random_address(req, false, conn_use_rpa(conn),
 827                                               &own_addr_type))
 828                         return;
 829         }
 830
 831         if (use_ext_conn(hdev)) {
 832                 struct hci_cp_le_ext_create_conn *cp;
 833                 struct hci_cp_le_ext_conn_param *p;
 834                 u8 data[sizeof(*cp) + sizeof(*p) * 3];
 835                 u32 plen;
 836
 837                 cp = (void *) data;
 838                 p = (void *) cp->data;
 839
 840                 memset(cp, 0, sizeof(*cp));
 841
 842                 bacpy(&cp->peer_addr, &conn->dst);
 843                 cp->peer_addr_type = conn->dst_type;
 844                 cp->own_addr_type = own_addr_type;
 845
 846                 plen = sizeof(*cp);
 847
 848                 if (scan_1m(hdev)) {
 849                         cp->phys |= LE_SCAN_PHY_1M;
 850                         set_ext_conn_params(conn, p);
 851
 852                         p++;
 853                         plen += sizeof(*p);
 854                 }
 855
 856                 if (scan_2m(hdev)) {
 857                         cp->phys |= LE_SCAN_PHY_2M;
 858                         set_ext_conn_params(conn, p);
 859
 860                         p++;
 861                         plen += sizeof(*p);
 862                 }
 863
 864                 if (scan_coded(hdev)) {
 865                         cp->phys |= LE_SCAN_PHY_CODED;
 866                         set_ext_conn_params(conn, p);
 867
 868                         plen += sizeof(*p);
 869                 }
 870
 871                 hci_req_add(req, HCI_OP_LE_EXT_CREATE_CONN, plen, data);
 872
 873         } else {
 874                 struct hci_cp_le_create_conn cp;
 875
 876                 memset(&cp, 0, sizeof(cp));
 877
 878                 /* Set window to be the same value as the interval to enable
 879                  * continuous scanning.
 880                  */
 881                 cp.scan_interval = cpu_to_le16(hdev->le_scan_interval);
 882                 cp.scan_window = cp.scan_interval;
 883
 884                 bacpy(&cp.peer_addr, &conn->dst);
 885                 cp.peer_addr_type = conn->dst_type;
 886                 cp.own_address_type = own_addr_type;
 887                 cp.conn_interval_min = cpu_to_le16(conn->le_conn_min_interval);
 888                 cp.conn_interval_max = cpu_to_le16(conn->le_conn_max_interval);
 889                 cp.conn_latency = cpu_to_le16(conn->le_conn_latency);
 890                 cp.supervision_timeout = cpu_to_le16(conn->le_supv_timeout);
 891                 cp.min_ce_len = cpu_to_le16(0x0000);
 892                 cp.max_ce_len = cpu_to_le16(0x0000);
 893
 894                 hci_req_add(req, HCI_OP_LE_CREATE_CONN, sizeof(cp), &cp);
 895         }
 896
 897         conn->state = BT_CONNECT;
 898         clear_bit(HCI_CONN_SCANNING, &conn->flags);
 899 }
 900
 901 static void hci_req_directed_advertising(struct hci_request *req,
 902                                          struct hci_conn *conn)
 903 {
 904         struct hci_dev *hdev = req->hdev;
 905         u8 own_addr_type;
 906         u8 enable;
 907
 908         if (ext_adv_capable(hdev)) {
 909                 struct hci_cp_le_set_ext_adv_params cp;
 910                 bdaddr_t random_addr;
 911
 912                 /* Set require_privacy to false so that the remote device has a
 913                  * chance of identifying us.
 914                  */
 915                 if (hci_get_random_address(hdev, false, conn_use_rpa(conn), NULL,
 916                                            &own_addr_type, &random_addr) < 0)
 917                         return;
 918
 919                 memset(&cp, 0, sizeof(cp));
 920
 921                 cp.evt_properties = cpu_to_le16(LE_LEGACY_ADV_DIRECT_IND);
 922                 cp.own_addr_type = own_addr_type;
 923                 cp.channel_map = hdev->le_adv_channel_map;
 924                 cp.tx_power = HCI_TX_POWER_INVALID;
 925                 cp.primary_phy = HCI_ADV_PHY_1M;
 926                 cp.secondary_phy = HCI_ADV_PHY_1M;
 927                 cp.handle = 0; /* Use instance 0 for directed adv */
 928                 cp.own_addr_type = own_addr_type;
 929                 cp.peer_addr_type = conn->dst_type;
 930                 bacpy(&cp.peer_addr, &conn->dst);
 931
 932                 /* As per Core Spec 5.2 Vol 2, PART E, Sec 7.8.53, for
 933                  * advertising_event_property LE_LEGACY_ADV_DIRECT_IND
 934                  * does not supports advertising data when the advertising set already
 935                  * contains some, the controller shall return erroc code 'Invalid
 936                  * HCI Command Parameters(0x12).
 937                  * So it is required to remove adv set for handle 0x00. since we use
 938                  * instance 0 for directed adv.
 939                  */
 940                 hci_req_add(req, HCI_OP_LE_REMOVE_ADV_SET, sizeof(cp.handle), &cp.handle);
 941
 942                 hci_req_add(req, HCI_OP_LE_SET_EXT_ADV_PARAMS, sizeof(cp), &cp);
 943
 944                 if (own_addr_type == ADDR_LE_DEV_RANDOM &&
 945                     bacmp(&random_addr, BDADDR_ANY) &&
 946                     bacmp(&random_addr, &hdev->random_addr)) {
 947                         struct hci_cp_le_set_adv_set_rand_addr cp;
 948
 949                         memset(&cp, 0, sizeof(cp));
 950
 951                         cp.handle = 0;
 952                         bacpy(&cp.bdaddr, &random_addr);
 953
 954                         hci_req_add(req,
 955                                     HCI_OP_LE_SET_ADV_SET_RAND_ADDR,
 956                                     sizeof(cp), &cp);
 957                 }
 958
 959                 __hci_req_enable_ext_advertising(req, 0x00);
 960         } else {
 961                 struct hci_cp_le_set_adv_param cp;
 962
 963                 /* Clear the HCI_LE_ADV bit temporarily so that the
 964                  * hci_update_random_address knows that it's safe to go ahead
 965                  * and write a new random address. The flag will be set back on
 966                  * as soon as the SET_ADV_ENABLE HCI command completes.
 967                  */
 968                 hci_dev_clear_flag(hdev, HCI_LE_ADV);
 969
 970                 /* Set require_privacy to false so that the remote device has a
 971                  * chance of identifying us.
 972                  */
 973                 if (hci_update_random_address(req, false, conn_use_rpa(conn),
 974                                               &own_addr_type) < 0)
 975                         return;
 976
 977                 memset(&cp, 0, sizeof(cp));
 978
 979                 /* Some controllers might reject command if intervals are not
 980                  * within range for undirected advertising.
 981                  * BCM20702A0 is known to be affected by this.
 982                  */
 983                 cp.min_interval = cpu_to_le16(0x0020);
 984                 cp.max_interval = cpu_to_le16(0x0020);
 985
 986                 cp.type = LE_ADV_DIRECT_IND;
 987                 cp.own_address_type = own_addr_type;
 988                 cp.direct_addr_type = conn->dst_type;
 989                 bacpy(&cp.direct_addr, &conn->dst);
 990                 cp.channel_map = hdev->le_adv_channel_map;
 991
 992                 hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
 993
 994                 enable = 0x01;
 995                 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable),
 996                             &enable);
 997         }
 998
 999         conn->state = BT_CONNECT;
1000 }
1001
1002 struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,
1003                                 u8 dst_type, u8 sec_level, u16 conn_timeout,
1004                                 u8 role, bdaddr_t *direct_rpa)
1005 {
1006         struct hci_conn_params *params;
1007         struct hci_conn *conn;
1008         struct smp_irk *irk;
1009         struct hci_request req;
1010         int err;
1011
1012         /* Let's make sure that le is enabled.*/
1013         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1014                 if (lmp_le_capable(hdev))
1015                         return ERR_PTR(-ECONNREFUSED);
1016
1017                 return ERR_PTR(-EOPNOTSUPP);
1018         }
1019
1020         /* Since the controller supports only one LE connection attempt at a
1021          * time, we return -EBUSY if there is any connection attempt running.
1022          */
1023         if (hci_lookup_le_connect(hdev))
1024                 return ERR_PTR(-EBUSY);
1025
1026         /* If there's already a connection object but it's not in
1027          * scanning state it means it must already be established, in
1028          * which case we can't do anything else except report a failure
1029          * to connect.
1030          */
1031         conn = hci_conn_hash_lookup_le(hdev, dst, dst_type);
1032         if (conn && !test_bit(HCI_CONN_SCANNING, &conn->flags)) {
1033                 return ERR_PTR(-EBUSY);
1034         }
1035
1036         /* When given an identity address with existing identity
1037          * resolving key, the connection needs to be established
1038          * to a resolvable random address.
1039          *
1040          * Storing the resolvable random address is required here
1041          * to handle connection failures. The address will later
1042          * be resolved back into the original identity address
1043          * from the connect request.
1044          */
1045         irk = hci_find_irk_by_addr(hdev, dst, dst_type);
1046         if (irk && bacmp(&irk->rpa, BDADDR_ANY)) {
1047                 dst = &irk->rpa;
1048                 dst_type = ADDR_LE_DEV_RANDOM;
1049         }
1050
1051         if (conn) {
1052                 bacpy(&conn->dst, dst);
1053         } else {
1054                 conn = hci_conn_add(hdev, LE_LINK, dst, role);
1055                 if (!conn)
1056                         return ERR_PTR(-ENOMEM);
1057                 hci_conn_hold(conn);
1058                 conn->pending_sec_level = sec_level;
1059         }
1060
1061         conn->dst_type = dst_type;
1062         conn->sec_level = BT_SECURITY_LOW;
1063         conn->conn_timeout = conn_timeout;
1064
1065         hci_req_init(&req, hdev);
1066
1067         /* Disable advertising if we're active. For master role
1068          * connections most controllers will refuse to connect if
1069          * advertising is enabled, and for slave role connections we
1070          * anyway have to disable it in order to start directed
1071          * advertising.
1072          */
1073         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1074                  __hci_req_disable_advertising(&req);
1075
1076         /* If requested to connect as slave use directed advertising */
1077         if (conn->role == HCI_ROLE_SLAVE) {
1078                 /* If we're active scanning most controllers are unable
1079                  * to initiate advertising. Simply reject the attempt.
1080                  */
1081                 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
1082                     hdev->le_scan_type == LE_SCAN_ACTIVE) {
1083                         hci_req_purge(&req);
1084                         hci_conn_del(conn);
1085                         return ERR_PTR(-EBUSY);
1086                 }
1087
1088                 hci_req_directed_advertising(&req, conn);
1089                 goto create_conn;
1090         }
1091
1092         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
1093         if (params) {
1094                 conn->le_conn_min_interval = params->conn_min_interval;
1095                 conn->le_conn_max_interval = params->conn_max_interval;
1096                 conn->le_conn_latency = params->conn_latency;
1097                 conn->le_supv_timeout = params->supervision_timeout;
1098         } else {
1099                 conn->le_conn_min_interval = hdev->le_conn_min_interval;
1100                 conn->le_conn_max_interval = hdev->le_conn_max_interval;
1101                 conn->le_conn_latency = hdev->le_conn_latency;
1102                 conn->le_supv_timeout = hdev->le_supv_timeout;
1103         }
1104
1105         /* If controller is scanning, we stop it since some controllers are
1106          * not able to scan and connect at the same time. Also set the
1107          * HCI_LE_SCAN_INTERRUPTED flag so that the command complete
1108          * handler for scan disabling knows to set the correct discovery
1109          * state.
1110          */
1111         if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
1112                 hci_req_add_le_scan_disable(&req);
1113                 hci_dev_set_flag(hdev, HCI_LE_SCAN_INTERRUPTED);
1114         }
1115
1116         hci_req_add_le_create_conn(&req, conn, direct_rpa);
1117
1118 create_conn:
1119         err = hci_req_run(&req, create_le_conn_complete);
1120         if (err) {
1121                 hci_conn_del(conn);
1122                 return ERR_PTR(err);
1123         }
1124
1125         return conn;
1126 }
1127
1128 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
1129 {
1130         struct hci_conn *conn;
1131
1132         conn = hci_conn_hash_lookup_le(hdev, addr, type);
1133         if (!conn)
1134                 return false;
1135
1136         if (conn->state != BT_CONNECTED)
1137                 return false;
1138
1139         return true;
1140 }
1141
1142 /* This function requires the caller holds hdev->lock */
1143 static int hci_explicit_conn_params_set(struct hci_dev *hdev,
1144                                         bdaddr_t *addr, u8 addr_type)
1145 {
1146         struct hci_conn_params *params;
1147
1148         if (is_connected(hdev, addr, addr_type))
1149                 return -EISCONN;
1150
1151         params = hci_conn_params_lookup(hdev, addr, addr_type);
1152         if (!params) {
1153                 params = hci_conn_params_add(hdev, addr, addr_type);
1154                 if (!params)
1155                         return -ENOMEM;
1156
1157                 /* If we created new params, mark them to be deleted in
1158                  * hci_connect_le_scan_cleanup. It's different case than
1159                  * existing disabled params, those will stay after cleanup.
1160                  */
1161                 params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
1162         }
1163
1164         /* We're trying to connect, so make sure params are at pend_le_conns */
1165         if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
1166             params->auto_connect == HCI_AUTO_CONN_REPORT ||
1167             params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
1168                 list_del_init(&params->action);
1169                 list_add(&params->action, &hdev->pend_le_conns);
1170         }
1171
1172         params->explicit_connect = true;
1173
1174         BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
1175                params->auto_connect);
1176
1177         return 0;
1178 }
1179
1180 /* This function requires the caller holds hdev->lock */
1181 struct hci_conn *hci_connect_le_scan(struct hci_dev *hdev, bdaddr_t *dst,
1182                                      u8 dst_type, u8 sec_level,
1183                                      u16 conn_timeout)
1184 {
1185         struct hci_conn *conn;
1186
1187         /* Let's make sure that le is enabled.*/
1188         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1189                 if (lmp_le_capable(hdev))
1190                         return ERR_PTR(-ECONNREFUSED);
1191
1192                 return ERR_PTR(-EOPNOTSUPP);
1193         }
1194
1195         /* Some devices send ATT messages as soon as the physical link is
1196          * established. To be able to handle these ATT messages, the user-
1197          * space first establishes the connection and then starts the pairing
1198          * process.
1199          *
1200          * So if a hci_conn object already exists for the following connection
1201          * attempt, we simply update pending_sec_level and auth_type fields
1202          * and return the object found.
1203          */
1204         conn = hci_conn_hash_lookup_le(hdev, dst, dst_type);
1205         if (conn) {
1206                 if (conn->pending_sec_level < sec_level)
1207                         conn->pending_sec_level = sec_level;
1208                 goto done;
1209         }
1210
1211         BT_DBG("requesting refresh of dst_addr");
1212
1213         conn = hci_conn_add(hdev, LE_LINK, dst, HCI_ROLE_MASTER);
1214         if (!conn)
1215                 return ERR_PTR(-ENOMEM);
1216
1217         if (hci_explicit_conn_params_set(hdev, dst, dst_type) < 0) {
1218                 hci_conn_del(conn);
1219                 return ERR_PTR(-EBUSY);
1220         }
1221
1222         conn->state = BT_CONNECT;
1223         set_bit(HCI_CONN_SCANNING, &conn->flags);
1224         conn->dst_type = dst_type;
1225         conn->sec_level = BT_SECURITY_LOW;
1226         conn->pending_sec_level = sec_level;
1227         conn->conn_timeout = conn_timeout;
1228
1229         hci_update_background_scan(hdev);
1230
1231 done:
1232         hci_conn_hold(conn);
1233         return conn;
1234 }
1235
1236 struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst,
1237                                  u8 sec_level, u8 auth_type)
1238 {
1239         struct hci_conn *acl;
1240
1241         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1242                 if (lmp_bredr_capable(hdev))
1243                         return ERR_PTR(-ECONNREFUSED);
1244
1245                 return ERR_PTR(-EOPNOTSUPP);
1246         }
1247
1248         acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
1249         if (!acl) {
1250                 acl = hci_conn_add(hdev, ACL_LINK, dst, HCI_ROLE_MASTER);
1251                 if (!acl)
1252                         return ERR_PTR(-ENOMEM);
1253         }
1254
1255         hci_conn_hold(acl);
1256
1257         if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
1258                 acl->sec_level = BT_SECURITY_LOW;
1259                 acl->pending_sec_level = sec_level;
1260                 acl->auth_type = auth_type;
1261                 hci_acl_create_connection(acl);
1262         }
1263
1264         return acl;
1265 }
1266
1267 struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type, bdaddr_t *dst,
1268                                  __u16 setting)
1269 {
1270         struct hci_conn *acl;
1271         struct hci_conn *sco;
1272
1273         acl = hci_connect_acl(hdev, dst, BT_SECURITY_LOW, HCI_AT_NO_BONDING);
1274         if (IS_ERR(acl))
1275                 return acl;
1276
1277         sco = hci_conn_hash_lookup_ba(hdev, type, dst);
1278         if (!sco) {
1279                 sco = hci_conn_add(hdev, type, dst, HCI_ROLE_MASTER);
1280                 if (!sco) {
1281                         hci_conn_drop(acl);
1282                         return ERR_PTR(-ENOMEM);
1283                 }
1284         }
1285
1286         acl->link = sco;
1287         sco->link = acl;
1288
1289         hci_conn_hold(sco);
1290
1291         sco->setting = setting;
1292
1293         if (acl->state == BT_CONNECTED &&
1294             (sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
1295                 set_bit(HCI_CONN_POWER_SAVE, &acl->flags);
1296                 hci_conn_enter_active_mode(acl, BT_POWER_FORCE_ACTIVE_ON);
1297
1298                 if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->flags)) {
1299                         /* defer SCO setup until mode change completed */
1300                         set_bit(HCI_CONN_SCO_SETUP_PEND, &acl->flags);
1301                         return sco;
1302                 }
1303
1304                 hci_sco_setup(acl, 0x00);
1305         }
1306
1307         return sco;
1308 }
1309
1310 /* Check link security requirement */
1311 int hci_conn_check_link_mode(struct hci_conn *conn)
1312 {
1313         BT_DBG("hcon %p", conn);
1314
1315         /* In Secure Connections Only mode, it is required that Secure
1316          * Connections is used and the link is encrypted with AES-CCM
1317          * using a P-256 authenticated combination key.
1318          */
1319         if (hci_dev_test_flag(conn->hdev, HCI_SC_ONLY)) {
1320                 if (!hci_conn_sc_enabled(conn) ||
1321                     !test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
1322                     conn->key_type != HCI_LK_AUTH_COMBINATION_P256)
1323                         return 0;
1324         }
1325
1326         if (hci_conn_ssp_enabled(conn) &&
1327             !test_bit(HCI_CONN_ENCRYPT, &conn->flags))
1328                 return 0;
1329
1330         return 1;
1331 }
1332
1333 /* Authenticate remote device */
1334 static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
1335 {
1336         BT_DBG("hcon %p", conn);
1337
1338         if (conn->pending_sec_level > sec_level)
1339                 sec_level = conn->pending_sec_level;
1340
1341         if (sec_level > conn->sec_level)
1342                 conn->pending_sec_level = sec_level;
1343         else if (test_bit(HCI_CONN_AUTH, &conn->flags))
1344                 return 1;
1345
1346         /* Make sure we preserve an existing MITM requirement*/
1347         auth_type |= (conn->auth_type & 0x01);
1348
1349         conn->auth_type = auth_type;
1350
1351         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
1352                 struct hci_cp_auth_requested cp;
1353
1354                 cp.handle = cpu_to_le16(conn->handle);
1355                 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
1356                              sizeof(cp), &cp);
1357
1358                 /* If we're already encrypted set the REAUTH_PEND flag,
1359                  * otherwise set the ENCRYPT_PEND.
1360                  */
1361                 if (test_bit(HCI_CONN_ENCRYPT, &conn->flags))
1362                         set_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
1363                 else
1364                         set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
1365         }
1366
1367         return 0;
1368 }
1369
1370 /* Encrypt the the link */
1371 static void hci_conn_encrypt(struct hci_conn *conn)
1372 {
1373         BT_DBG("hcon %p", conn);
1374
1375         if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
1376                 struct hci_cp_set_conn_encrypt cp;
1377                 cp.handle  = cpu_to_le16(conn->handle);
1378                 cp.encrypt = 0x01;
1379                 hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
1380                              &cp);
1381         }
1382 }
1383
1384 /* Enable security */
1385 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type,
1386                       bool initiator)
1387 {
1388         BT_DBG("hcon %p", conn);
1389
1390         if (conn->type == LE_LINK)
1391                 return smp_conn_security(conn, sec_level);
1392
1393         /* For sdp we don't need the link key. */
1394         if (sec_level == BT_SECURITY_SDP)
1395                 return 1;
1396
1397         /* For non 2.1 devices and low security level we don't need the link
1398            key. */
1399         if (sec_level == BT_SECURITY_LOW && !hci_conn_ssp_enabled(conn))
1400                 return 1;
1401
1402         /* For other security levels we need the link key. */
1403         if (!test_bit(HCI_CONN_AUTH, &conn->flags))
1404                 goto auth;
1405
1406         /* An authenticated FIPS approved combination key has sufficient
1407          * security for security level 4. */
1408         if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256 &&
1409             sec_level == BT_SECURITY_FIPS)
1410                 goto encrypt;
1411
1412         /* An authenticated combination key has sufficient security for
1413            security level 3. */
1414         if ((conn->key_type == HCI_LK_AUTH_COMBINATION_P192 ||
1415              conn->key_type == HCI_LK_AUTH_COMBINATION_P256) &&
1416             sec_level == BT_SECURITY_HIGH)
1417                 goto encrypt;
1418
1419         /* An unauthenticated combination key has sufficient security for
1420            security level 1 and 2. */
1421         if ((conn->key_type == HCI_LK_UNAUTH_COMBINATION_P192 ||
1422              conn->key_type == HCI_LK_UNAUTH_COMBINATION_P256) &&
1423             (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW))
1424                 goto encrypt;
1425
1426         /* A combination key has always sufficient security for the security
1427            levels 1 or 2. High security level requires the combination key
1428            is generated using maximum PIN code length (16).
1429            For pre 2.1 units. */
1430         if (conn->key_type == HCI_LK_COMBINATION &&
1431             (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW ||
1432              conn->pin_length == 16))
1433                 goto encrypt;
1434
1435 auth:
1436         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags))
1437                 return 0;
1438
1439         if (initiator)
1440                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
1441
1442         if (!hci_conn_auth(conn, sec_level, auth_type))
1443                 return 0;
1444
1445 encrypt:
1446         if (test_bit(HCI_CONN_ENCRYPT, &conn->flags)) {
1447                 /* Ensure that the encryption key size has been read,
1448                  * otherwise stall the upper layer responses.
1449                  */
1450                 if (!conn->enc_key_size)
1451                         return 0;
1452
1453                 /* Nothing else needed, all requirements are met */
1454                 return 1;
1455         }
1456
1457         hci_conn_encrypt(conn);
1458         return 0;
1459 }
1460 EXPORT_SYMBOL(hci_conn_security);
1461
1462 /* Check secure link requirement */
1463 int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level)
1464 {
1465         BT_DBG("hcon %p", conn);
1466
1467         /* Accept if non-secure or higher security level is required */
1468         if (sec_level != BT_SECURITY_HIGH && sec_level != BT_SECURITY_FIPS)
1469                 return 1;
1470
1471         /* Accept if secure or higher security level is already present */
1472         if (conn->sec_level == BT_SECURITY_HIGH ||
1473             conn->sec_level == BT_SECURITY_FIPS)
1474                 return 1;
1475
1476         /* Reject not secure link */
1477         return 0;
1478 }
1479 EXPORT_SYMBOL(hci_conn_check_secure);
1480
1481 /* Switch role */
1482 int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
1483 {
1484         BT_DBG("hcon %p", conn);
1485
1486         if (role == conn->role)
1487                 return 1;
1488
1489         if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->flags)) {
1490                 struct hci_cp_switch_role cp;
1491                 bacpy(&cp.bdaddr, &conn->dst);
1492                 cp.role = role;
1493                 hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
1494         }
1495
1496         return 0;
1497 }
1498 EXPORT_SYMBOL(hci_conn_switch_role);
1499
1500 /* Enter active mode */
1501 void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
1502 {
1503         struct hci_dev *hdev = conn->hdev;
1504
1505         BT_DBG("hcon %p mode %d", conn, conn->mode);
1506
1507         if (conn->mode != HCI_CM_SNIFF)
1508                 goto timer;
1509
1510         if (!test_bit(HCI_CONN_POWER_SAVE, &conn->flags) && !force_active)
1511                 goto timer;
1512
1513         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
1514                 struct hci_cp_exit_sniff_mode cp;
1515                 cp.handle = cpu_to_le16(conn->handle);
1516                 hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
1517         }
1518
1519 timer:
1520         if (hdev->idle_timeout > 0)
1521                 queue_delayed_work(hdev->workqueue, &conn->idle_work,
1522                                    msecs_to_jiffies(hdev->idle_timeout));
1523 }
1524
1525 /* Drop all connection on the device */
1526 void hci_conn_hash_flush(struct hci_dev *hdev)
1527 {
1528         struct hci_conn_hash *h = &hdev->conn_hash;
1529         struct hci_conn *c, *n;
1530
1531         BT_DBG("hdev %s", hdev->name);
1532
1533         list_for_each_entry_safe(c, n, &h->list, list) {
1534                 c->state = BT_CLOSED;
1535
1536                 hci_disconn_cfm(c, HCI_ERROR_LOCAL_HOST_TERM);
1537                 hci_conn_del(c);
1538         }
1539 }
1540
1541 /* Check pending connect attempts */
1542 void hci_conn_check_pending(struct hci_dev *hdev)
1543 {
1544         struct hci_conn *conn;
1545
1546         BT_DBG("hdev %s", hdev->name);
1547
1548         hci_dev_lock(hdev);
1549
1550         conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
1551         if (conn)
1552                 hci_acl_create_connection(conn);
1553
1554         hci_dev_unlock(hdev);
1555 }
1556
1557 static u32 get_link_mode(struct hci_conn *conn)
1558 {
1559         u32 link_mode = 0;
1560
1561         if (conn->role == HCI_ROLE_MASTER)
1562                 link_mode |= HCI_LM_MASTER;
1563
1564         if (test_bit(HCI_CONN_ENCRYPT, &conn->flags))
1565                 link_mode |= HCI_LM_ENCRYPT;
1566
1567         if (test_bit(HCI_CONN_AUTH, &conn->flags))
1568                 link_mode |= HCI_LM_AUTH;
1569
1570         if (test_bit(HCI_CONN_SECURE, &conn->flags))
1571                 link_mode |= HCI_LM_SECURE;
1572
1573         if (test_bit(HCI_CONN_FIPS, &conn->flags))
1574                 link_mode |= HCI_LM_FIPS;
1575
1576         return link_mode;
1577 }
1578
1579 int hci_get_conn_list(void __user *arg)
1580 {
1581         struct hci_conn *c;
1582         struct hci_conn_list_req req, *cl;
1583         struct hci_conn_info *ci;
1584         struct hci_dev *hdev;
1585         int n = 0, size, err;
1586
1587         if (copy_from_user(&req, arg, sizeof(req)))
1588                 return -EFAULT;
1589
1590         if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
1591                 return -EINVAL;
1592
1593         size = sizeof(req) + req.conn_num * sizeof(*ci);
1594
1595         cl = kmalloc(size, GFP_KERNEL);
1596         if (!cl)
1597                 return -ENOMEM;
1598
1599         hdev = hci_dev_get(req.dev_id);
1600         if (!hdev) {
1601                 kfree(cl);
1602                 return -ENODEV;
1603         }
1604
1605         ci = cl->conn_info;
1606
1607         hci_dev_lock(hdev);
1608         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1609                 bacpy(&(ci + n)->bdaddr, &c->dst);
1610                 (ci + n)->handle = c->handle;
1611                 (ci + n)->type  = c->type;
1612                 (ci + n)->out   = c->out;
1613                 (ci + n)->state = c->state;
1614                 (ci + n)->link_mode = get_link_mode(c);
1615                 if (++n >= req.conn_num)
1616                         break;
1617         }
1618         hci_dev_unlock(hdev);
1619
1620         cl->dev_id = hdev->id;
1621         cl->conn_num = n;
1622         size = sizeof(req) + n * sizeof(*ci);
1623
1624         hci_dev_put(hdev);
1625
1626         err = copy_to_user(arg, cl, size);
1627         kfree(cl);
1628
1629         return err ? -EFAULT : 0;
1630 }
1631
1632 int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
1633 {
1634         struct hci_conn_info_req req;
1635         struct hci_conn_info ci;
1636         struct hci_conn *conn;
1637         char __user *ptr = arg + sizeof(req);
1638
1639         if (copy_from_user(&req, arg, sizeof(req)))
1640                 return -EFAULT;
1641
1642         hci_dev_lock(hdev);
1643         conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
1644         if (conn) {
1645                 bacpy(&ci.bdaddr, &conn->dst);
1646                 ci.handle = conn->handle;
1647                 ci.type  = conn->type;
1648                 ci.out   = conn->out;
1649                 ci.state = conn->state;
1650                 ci.link_mode = get_link_mode(conn);
1651         }
1652         hci_dev_unlock(hdev);
1653
1654         if (!conn)
1655                 return -ENOENT;
1656
1657         return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
1658 }
1659
1660 int hci_get_auth_info(struct hci_dev *hdev, void __user *arg)
1661 {
1662         struct hci_auth_info_req req;
1663         struct hci_conn *conn;
1664
1665         if (copy_from_user(&req, arg, sizeof(req)))
1666                 return -EFAULT;
1667
1668         hci_dev_lock(hdev);
1669         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr);
1670         if (conn)
1671                 req.type = conn->auth_type;
1672         hci_dev_unlock(hdev);
1673
1674         if (!conn)
1675                 return -ENOENT;
1676
1677         return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0;
1678 }
1679
1680 struct hci_chan *hci_chan_create(struct hci_conn *conn)
1681 {
1682         struct hci_dev *hdev = conn->hdev;
1683         struct hci_chan *chan;
1684
1685         BT_DBG("%s hcon %p", hdev->name, conn);
1686
1687         if (test_bit(HCI_CONN_DROP, &conn->flags)) {
1688                 BT_DBG("Refusing to create new hci_chan");
1689                 return NULL;
1690         }
1691
1692         chan = kzalloc(sizeof(*chan), GFP_KERNEL);
1693         if (!chan)
1694                 return NULL;
1695
1696         chan->conn = hci_conn_get(conn);
1697         skb_queue_head_init(&chan->data_q);
1698         chan->state = BT_CONNECTED;
1699
1700         list_add_rcu(&chan->list, &conn->chan_list);
1701
1702         return chan;
1703 }
1704
1705 void hci_chan_del(struct hci_chan *chan)
1706 {
1707         struct hci_conn *conn = chan->conn;
1708         struct hci_dev *hdev = conn->hdev;
1709
1710         BT_DBG("%s hcon %p chan %p", hdev->name, conn, chan);
1711
1712         list_del_rcu(&chan->list);
1713
1714         synchronize_rcu();
1715
1716         /* Prevent new hci_chan's to be created for this hci_conn */
1717         set_bit(HCI_CONN_DROP, &conn->flags);
1718
1719         hci_conn_put(conn);
1720
1721         skb_queue_purge(&chan->data_q);
1722         kfree(chan);
1723 }
1724
1725 void hci_chan_list_flush(struct hci_conn *conn)
1726 {
1727         struct hci_chan *chan, *n;
1728
1729         BT_DBG("hcon %p", conn);
1730
1731         list_for_each_entry_safe(chan, n, &conn->chan_list, list)
1732                 hci_chan_del(chan);
1733 }
1734
1735 static struct hci_chan *__hci_chan_lookup_handle(struct hci_conn *hcon,
1736                                                  __u16 handle)
1737 {
1738         struct hci_chan *hchan;
1739
1740         list_for_each_entry(hchan, &hcon->chan_list, list) {
1741                 if (hchan->handle == handle)
1742                         return hchan;
1743         }
1744
1745         return NULL;
1746 }
1747
1748 struct hci_chan *hci_chan_lookup_handle(struct hci_dev *hdev, __u16 handle)
1749 {
1750         struct hci_conn_hash *h = &hdev->conn_hash;
1751         struct hci_conn *hcon;
1752         struct hci_chan *hchan = NULL;
1753
1754         rcu_read_lock();
1755
1756         list_for_each_entry_rcu(hcon, &h->list, list) {
1757                 hchan = __hci_chan_lookup_handle(hcon, handle);
1758                 if (hchan)
1759                         break;
1760         }
1761
1762         rcu_read_unlock();
1763
1764         return hchan;
1765 }
1766
1767 u32 hci_conn_get_phy(struct hci_conn *conn)
1768 {
1769         u32 phys = 0;
1770
1771         hci_dev_lock(conn->hdev);
1772
1773         /* BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 2, Part B page 471:
1774          * Table 6.2: Packets defined for synchronous, asynchronous, and
1775          * CSB logical transport types.
1776          */
1777         switch (conn->type) {
1778         case SCO_LINK:
1779                 /* SCO logical transport (1 Mb/s):
1780                  * HV1, HV2, HV3 and DV.
1781                  */
1782                 phys |= BT_PHY_BR_1M_1SLOT;
1783
1784                 break;
1785
1786         case ACL_LINK:
1787                 /* ACL logical transport (1 Mb/s) ptt=0:
1788                  * DH1, DM3, DH3, DM5 and DH5.
1789                  */
1790                 phys |= BT_PHY_BR_1M_1SLOT;
1791
1792                 if (conn->pkt_type & (HCI_DM3 | HCI_DH3))
1793                         phys |= BT_PHY_BR_1M_3SLOT;
1794
1795                 if (conn->pkt_type & (HCI_DM5 | HCI_DH5))
1796                         phys |= BT_PHY_BR_1M_5SLOT;
1797
1798                 /* ACL logical transport (2 Mb/s) ptt=1:
1799                  * 2-DH1, 2-DH3 and 2-DH5.
1800                  */
1801                 if (!(conn->pkt_type & HCI_2DH1))
1802                         phys |= BT_PHY_EDR_2M_1SLOT;
1803
1804                 if (!(conn->pkt_type & HCI_2DH3))
1805                         phys |= BT_PHY_EDR_2M_3SLOT;
1806
1807                 if (!(conn->pkt_type & HCI_2DH5))
1808                         phys |= BT_PHY_EDR_2M_5SLOT;
1809
1810                 /* ACL logical transport (3 Mb/s) ptt=1:
1811                  * 3-DH1, 3-DH3 and 3-DH5.
1812                  */
1813                 if (!(conn->pkt_type & HCI_3DH1))
1814                         phys |= BT_PHY_EDR_3M_1SLOT;
1815
1816                 if (!(conn->pkt_type & HCI_3DH3))
1817                         phys |= BT_PHY_EDR_3M_3SLOT;
1818
1819                 if (!(conn->pkt_type & HCI_3DH5))
1820                         phys |= BT_PHY_EDR_3M_5SLOT;
1821
1822                 break;
1823
1824         case ESCO_LINK:
1825                 /* eSCO logical transport (1 Mb/s): EV3, EV4 and EV5 */
1826                 phys |= BT_PHY_BR_1M_1SLOT;
1827
1828                 if (!(conn->pkt_type & (ESCO_EV4 | ESCO_EV5)))
1829                         phys |= BT_PHY_BR_1M_3SLOT;
1830
1831                 /* eSCO logical transport (2 Mb/s): 2-EV3, 2-EV5 */
1832                 if (!(conn->pkt_type & ESCO_2EV3))
1833                         phys |= BT_PHY_EDR_2M_1SLOT;
1834
1835                 if (!(conn->pkt_type & ESCO_2EV5))
1836                         phys |= BT_PHY_EDR_2M_3SLOT;
1837
1838                 /* eSCO logical transport (3 Mb/s): 3-EV3, 3-EV5 */
1839                 if (!(conn->pkt_type & ESCO_3EV3))
1840                         phys |= BT_PHY_EDR_3M_1SLOT;
1841
1842                 if (!(conn->pkt_type & ESCO_3EV5))
1843                         phys |= BT_PHY_EDR_3M_3SLOT;
1844
1845                 break;
1846
1847         case LE_LINK:
1848                 if (conn->le_tx_phy & HCI_LE_SET_PHY_1M)
1849                         phys |= BT_PHY_LE_1M_TX;
1850
1851                 if (conn->le_rx_phy & HCI_LE_SET_PHY_1M)
1852                         phys |= BT_PHY_LE_1M_RX;
1853
1854                 if (conn->le_tx_phy & HCI_LE_SET_PHY_2M)
1855                         phys |= BT_PHY_LE_2M_TX;
1856
1857                 if (conn->le_rx_phy & HCI_LE_SET_PHY_2M)
1858                         phys |= BT_PHY_LE_2M_RX;
1859
1860                 if (conn->le_tx_phy & HCI_LE_SET_PHY_CODED)
1861                         phys |= BT_PHY_LE_CODED_TX;
1862
1863                 if (conn->le_rx_phy & HCI_LE_SET_PHY_CODED)
1864                         phys |= BT_PHY_LE_CODED_RX;
1865
1866                 break;
1867         }
1868
1869         hci_dev_unlock(conn->hdev);
1870
1871         return phys;
1872 }