1 /*
2    BlueZ - Bluetooth protocol stack for Linux
3 
4    Copyright (C) 2014 Intel Corporation
5 
6    This program is free software; you can redistribute it and/or modify
7    it under the terms of the GNU General Public License version 2 as
8    published by the Free Software Foundation;
9 
10    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
11    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
12    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
13    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
14    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
15    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18 
19    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
20    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
21    SOFTWARE IS DISCLAIMED.
22 */
23 
24 #include <net/bluetooth/bluetooth.h>
25 #include <net/bluetooth/hci_core.h>
26 
27 #include "smp.h"
28 #include "hci_request.h"
29 
hci_req_init(struct hci_request * req,struct hci_dev * hdev)30 void hci_req_init(struct hci_request *req, struct hci_dev *hdev)
31 {
32 	skb_queue_head_init(&req->cmd_q);
33 	req->hdev = hdev;
34 	req->err = 0;
35 }
36 
req_run(struct hci_request * req,hci_req_complete_t complete,hci_req_complete_skb_t complete_skb)37 static int req_run(struct hci_request *req, hci_req_complete_t complete,
38 		   hci_req_complete_skb_t complete_skb)
39 {
40 	struct hci_dev *hdev = req->hdev;
41 	struct sk_buff *skb;
42 	unsigned long flags;
43 
44 	BT_DBG("length %u", skb_queue_len(&req->cmd_q));
45 
46 	/* If an error occurred during request building, remove all HCI
47 	 * commands queued on the HCI request queue.
48 	 */
49 	if (req->err) {
50 		skb_queue_purge(&req->cmd_q);
51 		return req->err;
52 	}
53 
54 	/* Do not allow empty requests */
55 	if (skb_queue_empty(&req->cmd_q))
56 		return -ENODATA;
57 
58 	skb = skb_peek_tail(&req->cmd_q);
59 	bt_cb(skb)->hci.req_complete = complete;
60 	bt_cb(skb)->hci.req_complete_skb = complete_skb;
61 
62 	spin_lock_irqsave(&hdev->cmd_q.lock, flags);
63 	skb_queue_splice_tail(&req->cmd_q, &hdev->cmd_q);
64 	spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
65 
66 	queue_work(hdev->workqueue, &hdev->cmd_work);
67 
68 	return 0;
69 }
70 
hci_req_run(struct hci_request * req,hci_req_complete_t complete)71 int hci_req_run(struct hci_request *req, hci_req_complete_t complete)
72 {
73 	return req_run(req, complete, NULL);
74 }
75 
hci_req_run_skb(struct hci_request * req,hci_req_complete_skb_t complete)76 int hci_req_run_skb(struct hci_request *req, hci_req_complete_skb_t complete)
77 {
78 	return req_run(req, NULL, complete);
79 }
80 
hci_prepare_cmd(struct hci_dev * hdev,u16 opcode,u32 plen,const void * param)81 struct sk_buff *hci_prepare_cmd(struct hci_dev *hdev, u16 opcode, u32 plen,
82 				const void *param)
83 {
84 	int len = HCI_COMMAND_HDR_SIZE + plen;
85 	struct hci_command_hdr *hdr;
86 	struct sk_buff *skb;
87 
88 	skb = bt_skb_alloc(len, GFP_ATOMIC);
89 	if (!skb)
90 		return NULL;
91 
92 	hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
93 	hdr->opcode = cpu_to_le16(opcode);
94 	hdr->plen   = plen;
95 
96 	if (plen)
97 		memcpy(skb_put(skb, plen), param, plen);
98 
99 	BT_DBG("skb len %d", skb->len);
100 
101 	bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
102 	bt_cb(skb)->hci.opcode = opcode;
103 
104 	return skb;
105 }
106 
107 /* Queue a command to an asynchronous HCI request */
hci_req_add_ev(struct hci_request * req,u16 opcode,u32 plen,const void * param,u8 event)108 void hci_req_add_ev(struct hci_request *req, u16 opcode, u32 plen,
109 		    const void *param, u8 event)
110 {
111 	struct hci_dev *hdev = req->hdev;
112 	struct sk_buff *skb;
113 
114 	BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
115 
116 	/* If an error occurred during request building, there is no point in
117 	 * queueing the HCI command. We can simply return.
118 	 */
119 	if (req->err)
120 		return;
121 
122 	skb = hci_prepare_cmd(hdev, opcode, plen, param);
123 	if (!skb) {
124 		BT_ERR("%s no memory for command (opcode 0x%4.4x)",
125 		       hdev->name, opcode);
126 		req->err = -ENOMEM;
127 		return;
128 	}
129 
130 	if (skb_queue_empty(&req->cmd_q))
131 		bt_cb(skb)->hci.req_start = true;
132 
133 	bt_cb(skb)->hci.req_event = event;
134 
135 	skb_queue_tail(&req->cmd_q, skb);
136 }
137 
hci_req_add(struct hci_request * req,u16 opcode,u32 plen,const void * param)138 void hci_req_add(struct hci_request *req, u16 opcode, u32 plen,
139 		 const void *param)
140 {
141 	hci_req_add_ev(req, opcode, plen, param, 0);
142 }
143 
hci_req_add_le_scan_disable(struct hci_request * req)144 void hci_req_add_le_scan_disable(struct hci_request *req)
145 {
146 	struct hci_cp_le_set_scan_enable cp;
147 
148 	memset(&cp, 0, sizeof(cp));
149 	cp.enable = LE_SCAN_DISABLE;
150 	hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
151 }
152 
add_to_white_list(struct hci_request * req,struct hci_conn_params * params)153 static void add_to_white_list(struct hci_request *req,
154 			      struct hci_conn_params *params)
155 {
156 	struct hci_cp_le_add_to_white_list cp;
157 
158 	cp.bdaddr_type = params->addr_type;
159 	bacpy(&cp.bdaddr, &params->addr);
160 
161 	hci_req_add(req, HCI_OP_LE_ADD_TO_WHITE_LIST, sizeof(cp), &cp);
162 }
163 
update_white_list(struct hci_request * req)164 static u8 update_white_list(struct hci_request *req)
165 {
166 	struct hci_dev *hdev = req->hdev;
167 	struct hci_conn_params *params;
168 	struct bdaddr_list *b;
169 	uint8_t white_list_entries = 0;
170 
171 	/* Go through the current white list programmed into the
172 	 * controller one by one and check if that address is still
173 	 * in the list of pending connections or list of devices to
174 	 * report. If not present in either list, then queue the
175 	 * command to remove it from the controller.
176 	 */
177 	list_for_each_entry(b, &hdev->le_white_list, list) {
178 		/* If the device is neither in pend_le_conns nor
179 		 * pend_le_reports then remove it from the whitelist.
180 		 */
181 		if (!hci_pend_le_action_lookup(&hdev->pend_le_conns,
182 					       &b->bdaddr, b->bdaddr_type) &&
183 		    !hci_pend_le_action_lookup(&hdev->pend_le_reports,
184 					       &b->bdaddr, b->bdaddr_type)) {
185 			struct hci_cp_le_del_from_white_list cp;
186 
187 			cp.bdaddr_type = b->bdaddr_type;
188 			bacpy(&cp.bdaddr, &b->bdaddr);
189 
190 			hci_req_add(req, HCI_OP_LE_DEL_FROM_WHITE_LIST,
191 				    sizeof(cp), &cp);
192 			continue;
193 		}
194 
195 		if (hci_find_irk_by_addr(hdev, &b->bdaddr, b->bdaddr_type)) {
196 			/* White list can not be used with RPAs */
197 			return 0x00;
198 		}
199 
200 		white_list_entries++;
201 	}
202 
203 	/* Since all no longer valid white list entries have been
204 	 * removed, walk through the list of pending connections
205 	 * and ensure that any new device gets programmed into
206 	 * the controller.
207 	 *
208 	 * If the list of the devices is larger than the list of
209 	 * available white list entries in the controller, then
210 	 * just abort and return filer policy value to not use the
211 	 * white list.
212 	 */
213 	list_for_each_entry(params, &hdev->pend_le_conns, action) {
214 		if (hci_bdaddr_list_lookup(&hdev->le_white_list,
215 					   &params->addr, params->addr_type))
216 			continue;
217 
218 		if (white_list_entries >= hdev->le_white_list_size) {
219 			/* Select filter policy to accept all advertising */
220 			return 0x00;
221 		}
222 
223 		if (hci_find_irk_by_addr(hdev, &params->addr,
224 					 params->addr_type)) {
225 			/* White list can not be used with RPAs */
226 			return 0x00;
227 		}
228 
229 		white_list_entries++;
230 		add_to_white_list(req, params);
231 	}
232 
233 	/* After adding all new pending connections, walk through
234 	 * the list of pending reports and also add these to the
235 	 * white list if there is still space.
236 	 */
237 	list_for_each_entry(params, &hdev->pend_le_reports, action) {
238 		if (hci_bdaddr_list_lookup(&hdev->le_white_list,
239 					   &params->addr, params->addr_type))
240 			continue;
241 
242 		if (white_list_entries >= hdev->le_white_list_size) {
243 			/* Select filter policy to accept all advertising */
244 			return 0x00;
245 		}
246 
247 		if (hci_find_irk_by_addr(hdev, &params->addr,
248 					 params->addr_type)) {
249 			/* White list can not be used with RPAs */
250 			return 0x00;
251 		}
252 
253 		white_list_entries++;
254 		add_to_white_list(req, params);
255 	}
256 
257 	/* Select filter policy to use white list */
258 	return 0x01;
259 }
260 
hci_req_add_le_passive_scan(struct hci_request * req)261 void hci_req_add_le_passive_scan(struct hci_request *req)
262 {
263 	struct hci_cp_le_set_scan_param param_cp;
264 	struct hci_cp_le_set_scan_enable enable_cp;
265 	struct hci_dev *hdev = req->hdev;
266 	u8 own_addr_type;
267 	u8 filter_policy;
268 
269 	/* Set require_privacy to false since no SCAN_REQ are send
270 	 * during passive scanning. Not using an non-resolvable address
271 	 * here is important so that peer devices using direct
272 	 * advertising with our address will be correctly reported
273 	 * by the controller.
274 	 */
275 	if (hci_update_random_address(req, false, &own_addr_type))
276 		return;
277 
278 	/* Adding or removing entries from the white list must
279 	 * happen before enabling scanning. The controller does
280 	 * not allow white list modification while scanning.
281 	 */
282 	filter_policy = update_white_list(req);
283 
284 	/* When the controller is using random resolvable addresses and
285 	 * with that having LE privacy enabled, then controllers with
286 	 * Extended Scanner Filter Policies support can now enable support
287 	 * for handling directed advertising.
288 	 *
289 	 * So instead of using filter polices 0x00 (no whitelist)
290 	 * and 0x01 (whitelist enabled) use the new filter policies
291 	 * 0x02 (no whitelist) and 0x03 (whitelist enabled).
292 	 */
293 	if (hci_dev_test_flag(hdev, HCI_PRIVACY) &&
294 	    (hdev->le_features[0] & HCI_LE_EXT_SCAN_POLICY))
295 		filter_policy |= 0x02;
296 
297 	memset(&param_cp, 0, sizeof(param_cp));
298 	param_cp.type = LE_SCAN_PASSIVE;
299 	param_cp.interval = cpu_to_le16(hdev->le_scan_interval);
300 	param_cp.window = cpu_to_le16(hdev->le_scan_window);
301 	param_cp.own_address_type = own_addr_type;
302 	param_cp.filter_policy = filter_policy;
303 	hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
304 		    &param_cp);
305 
306 	memset(&enable_cp, 0, sizeof(enable_cp));
307 	enable_cp.enable = LE_SCAN_ENABLE;
308 	enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
309 	hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
310 		    &enable_cp);
311 }
312 
set_random_addr(struct hci_request * req,bdaddr_t * rpa)313 static void set_random_addr(struct hci_request *req, bdaddr_t *rpa)
314 {
315 	struct hci_dev *hdev = req->hdev;
316 
317 	/* If we're advertising or initiating an LE connection we can't
318 	 * go ahead and change the random address at this time. This is
319 	 * because the eventual initiator address used for the
320 	 * subsequently created connection will be undefined (some
321 	 * controllers use the new address and others the one we had
322 	 * when the operation started).
323 	 *
324 	 * In this kind of scenario skip the update and let the random
325 	 * address be updated at the next cycle.
326 	 */
327 	if (hci_dev_test_flag(hdev, HCI_LE_ADV) ||
328 	    hci_lookup_le_connect(hdev)) {
329 		BT_DBG("Deferring random address update");
330 		hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
331 		return;
332 	}
333 
334 	hci_req_add(req, HCI_OP_LE_SET_RANDOM_ADDR, 6, rpa);
335 }
336 
hci_update_random_address(struct hci_request * req,bool require_privacy,u8 * own_addr_type)337 int hci_update_random_address(struct hci_request *req, bool require_privacy,
338 			      u8 *own_addr_type)
339 {
340 	struct hci_dev *hdev = req->hdev;
341 	int err;
342 
343 	/* If privacy is enabled use a resolvable private address. If
344 	 * current RPA has expired or there is something else than
345 	 * the current RPA in use, then generate a new one.
346 	 */
347 	if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
348 		int to;
349 
350 		*own_addr_type = ADDR_LE_DEV_RANDOM;
351 
352 		if (!hci_dev_test_and_clear_flag(hdev, HCI_RPA_EXPIRED) &&
353 		    !bacmp(&hdev->random_addr, &hdev->rpa))
354 			return 0;
355 
356 		err = smp_generate_rpa(hdev, hdev->irk, &hdev->rpa);
357 		if (err < 0) {
358 			BT_ERR("%s failed to generate new RPA", hdev->name);
359 			return err;
360 		}
361 
362 		set_random_addr(req, &hdev->rpa);
363 
364 		to = msecs_to_jiffies(hdev->rpa_timeout * 1000);
365 		queue_delayed_work(hdev->workqueue, &hdev->rpa_expired, to);
366 
367 		return 0;
368 	}
369 
370 	/* In case of required privacy without resolvable private address,
371 	 * use an non-resolvable private address. This is useful for active
372 	 * scanning and non-connectable advertising.
373 	 */
374 	if (require_privacy) {
375 		bdaddr_t nrpa;
376 
377 		while (true) {
378 			/* The non-resolvable private address is generated
379 			 * from random six bytes with the two most significant
380 			 * bits cleared.
381 			 */
382 			get_random_bytes(&nrpa, 6);
383 			nrpa.b[5] &= 0x3f;
384 
385 			/* The non-resolvable private address shall not be
386 			 * equal to the public address.
387 			 */
388 			if (bacmp(&hdev->bdaddr, &nrpa))
389 				break;
390 		}
391 
392 		*own_addr_type = ADDR_LE_DEV_RANDOM;
393 		set_random_addr(req, &nrpa);
394 		return 0;
395 	}
396 
397 	/* If forcing static address is in use or there is no public
398 	 * address use the static address as random address (but skip
399 	 * the HCI command if the current random address is already the
400 	 * static one.
401 	 *
402 	 * In case BR/EDR has been disabled on a dual-mode controller
403 	 * and a static address has been configured, then use that
404 	 * address instead of the public BR/EDR address.
405 	 */
406 	if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
407 	    !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
408 	    (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
409 	     bacmp(&hdev->static_addr, BDADDR_ANY))) {
410 		*own_addr_type = ADDR_LE_DEV_RANDOM;
411 		if (bacmp(&hdev->static_addr, &hdev->random_addr))
412 			hci_req_add(req, HCI_OP_LE_SET_RANDOM_ADDR, 6,
413 				    &hdev->static_addr);
414 		return 0;
415 	}
416 
417 	/* Neither privacy nor static address is being used so use a
418 	 * public address.
419 	 */
420 	*own_addr_type = ADDR_LE_DEV_PUBLIC;
421 
422 	return 0;
423 }
424 
disconnected_whitelist_entries(struct hci_dev * hdev)425 static bool disconnected_whitelist_entries(struct hci_dev *hdev)
426 {
427 	struct bdaddr_list *b;
428 
429 	list_for_each_entry(b, &hdev->whitelist, list) {
430 		struct hci_conn *conn;
431 
432 		conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &b->bdaddr);
433 		if (!conn)
434 			return true;
435 
436 		if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
437 			return true;
438 	}
439 
440 	return false;
441 }
442 
__hci_update_page_scan(struct hci_request * req)443 void __hci_update_page_scan(struct hci_request *req)
444 {
445 	struct hci_dev *hdev = req->hdev;
446 	u8 scan;
447 
448 	if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
449 		return;
450 
451 	if (!hdev_is_powered(hdev))
452 		return;
453 
454 	if (mgmt_powering_down(hdev))
455 		return;
456 
457 	if (hci_dev_test_flag(hdev, HCI_CONNECTABLE) ||
458 	    disconnected_whitelist_entries(hdev))
459 		scan = SCAN_PAGE;
460 	else
461 		scan = SCAN_DISABLED;
462 
463 	if (test_bit(HCI_PSCAN, &hdev->flags) == !!(scan & SCAN_PAGE))
464 		return;
465 
466 	if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
467 		scan |= SCAN_INQUIRY;
468 
469 	hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
470 }
471 
hci_update_page_scan(struct hci_dev * hdev)472 void hci_update_page_scan(struct hci_dev *hdev)
473 {
474 	struct hci_request req;
475 
476 	hci_req_init(&req, hdev);
477 	__hci_update_page_scan(&req);
478 	hci_req_run(&req, NULL);
479 }
480 
481 /* This function controls the background scanning based on hdev->pend_le_conns
482  * list. If there are pending LE connection we start the background scanning,
483  * otherwise we stop it.
484  *
485  * This function requires the caller holds hdev->lock.
486  */
__hci_update_background_scan(struct hci_request * req)487 void __hci_update_background_scan(struct hci_request *req)
488 {
489 	struct hci_dev *hdev = req->hdev;
490 
491 	if (!test_bit(HCI_UP, &hdev->flags) ||
492 	    test_bit(HCI_INIT, &hdev->flags) ||
493 	    hci_dev_test_flag(hdev, HCI_SETUP) ||
494 	    hci_dev_test_flag(hdev, HCI_CONFIG) ||
495 	    hci_dev_test_flag(hdev, HCI_AUTO_OFF) ||
496 	    hci_dev_test_flag(hdev, HCI_UNREGISTER))
497 		return;
498 
499 	/* No point in doing scanning if LE support hasn't been enabled */
500 	if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
501 		return;
502 
503 	/* If discovery is active don't interfere with it */
504 	if (hdev->discovery.state != DISCOVERY_STOPPED)
505 		return;
506 
507 	/* Reset RSSI and UUID filters when starting background scanning
508 	 * since these filters are meant for service discovery only.
509 	 *
510 	 * The Start Discovery and Start Service Discovery operations
511 	 * ensure to set proper values for RSSI threshold and UUID
512 	 * filter list. So it is safe to just reset them here.
513 	 */
514 	hci_discovery_filter_clear(hdev);
515 
516 	if (list_empty(&hdev->pend_le_conns) &&
517 	    list_empty(&hdev->pend_le_reports)) {
518 		/* If there is no pending LE connections or devices
519 		 * to be scanned for, we should stop the background
520 		 * scanning.
521 		 */
522 
523 		/* If controller is not scanning we are done. */
524 		if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
525 			return;
526 
527 		hci_req_add_le_scan_disable(req);
528 
529 		BT_DBG("%s stopping background scanning", hdev->name);
530 	} else {
531 		/* If there is at least one pending LE connection, we should
532 		 * keep the background scan running.
533 		 */
534 
535 		/* If controller is connecting, we should not start scanning
536 		 * since some controllers are not able to scan and connect at
537 		 * the same time.
538 		 */
539 		if (hci_lookup_le_connect(hdev))
540 			return;
541 
542 		/* If controller is currently scanning, we stop it to ensure we
543 		 * don't miss any advertising (due to duplicates filter).
544 		 */
545 		if (hci_dev_test_flag(hdev, HCI_LE_SCAN))
546 			hci_req_add_le_scan_disable(req);
547 
548 		hci_req_add_le_passive_scan(req);
549 
550 		BT_DBG("%s starting background scanning", hdev->name);
551 	}
552 }
553 
update_background_scan_complete(struct hci_dev * hdev,u8 status,u16 opcode)554 static void update_background_scan_complete(struct hci_dev *hdev, u8 status,
555 					    u16 opcode)
556 {
557 	if (status)
558 		BT_DBG("HCI request failed to update background scanning: "
559 		       "status 0x%2.2x", status);
560 }
561 
hci_update_background_scan(struct hci_dev * hdev)562 void hci_update_background_scan(struct hci_dev *hdev)
563 {
564 	int err;
565 	struct hci_request req;
566 
567 	hci_req_init(&req, hdev);
568 
569 	__hci_update_background_scan(&req);
570 
571 	err = hci_req_run(&req, update_background_scan_complete);
572 	if (err && err != -ENODATA)
573 		BT_ERR("Failed to run HCI request: err %d", err);
574 }
575 
__hci_abort_conn(struct hci_request * req,struct hci_conn * conn,u8 reason)576 void __hci_abort_conn(struct hci_request *req, struct hci_conn *conn,
577 		      u8 reason)
578 {
579 	switch (conn->state) {
580 	case BT_CONNECTED:
581 	case BT_CONFIG:
582 		if (conn->type == AMP_LINK) {
583 			struct hci_cp_disconn_phy_link cp;
584 
585 			cp.phy_handle = HCI_PHY_HANDLE(conn->handle);
586 			cp.reason = reason;
587 			hci_req_add(req, HCI_OP_DISCONN_PHY_LINK, sizeof(cp),
588 				    &cp);
589 		} else {
590 			struct hci_cp_disconnect dc;
591 
592 			dc.handle = cpu_to_le16(conn->handle);
593 			dc.reason = reason;
594 			hci_req_add(req, HCI_OP_DISCONNECT, sizeof(dc), &dc);
595 		}
596 
597 		conn->state = BT_DISCONN;
598 
599 		break;
600 	case BT_CONNECT:
601 		if (conn->type == LE_LINK) {
602 			if (test_bit(HCI_CONN_SCANNING, &conn->flags))
603 				break;
604 			hci_req_add(req, HCI_OP_LE_CREATE_CONN_CANCEL,
605 				    0, NULL);
606 		} else if (conn->type == ACL_LINK) {
607 			if (req->hdev->hci_ver < BLUETOOTH_VER_1_2)
608 				break;
609 			hci_req_add(req, HCI_OP_CREATE_CONN_CANCEL,
610 				    6, &conn->dst);
611 		}
612 		break;
613 	case BT_CONNECT2:
614 		if (conn->type == ACL_LINK) {
615 			struct hci_cp_reject_conn_req rej;
616 
617 			bacpy(&rej.bdaddr, &conn->dst);
618 			rej.reason = reason;
619 
620 			hci_req_add(req, HCI_OP_REJECT_CONN_REQ,
621 				    sizeof(rej), &rej);
622 		} else if (conn->type == SCO_LINK || conn->type == ESCO_LINK) {
623 			struct hci_cp_reject_sync_conn_req rej;
624 
625 			bacpy(&rej.bdaddr, &conn->dst);
626 
627 			/* SCO rejection has its own limited set of
628 			 * allowed error values (0x0D-0x0F) which isn't
629 			 * compatible with most values passed to this
630 			 * function. To be safe hard-code one of the
631 			 * values that's suitable for SCO.
632 			 */
633 			rej.reason = HCI_ERROR_REMOTE_LOW_RESOURCES;
634 
635 			hci_req_add(req, HCI_OP_REJECT_SYNC_CONN_REQ,
636 				    sizeof(rej), &rej);
637 		}
638 		break;
639 	default:
640 		conn->state = BT_CLOSED;
641 		break;
642 	}
643 }
644 
abort_conn_complete(struct hci_dev * hdev,u8 status,u16 opcode)645 static void abort_conn_complete(struct hci_dev *hdev, u8 status, u16 opcode)
646 {
647 	if (status)
648 		BT_DBG("Failed to abort connection: status 0x%2.2x", status);
649 }
650 
hci_abort_conn(struct hci_conn * conn,u8 reason)651 int hci_abort_conn(struct hci_conn *conn, u8 reason)
652 {
653 	struct hci_request req;
654 	int err;
655 
656 	hci_req_init(&req, conn->hdev);
657 
658 	__hci_abort_conn(&req, conn, reason);
659 
660 	err = hci_req_run(&req, abort_conn_complete);
661 	if (err && err != -ENODATA) {
662 		BT_ERR("Failed to run HCI request: err %d", err);
663 		return err;
664 	}
665 
666 	return 0;
667 }
668