net/bluetooth/hci_conn.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI connection handling. */
  26
  27 #include <linux/export.h>
  28
  29 #include <net/bluetooth/bluetooth.h>
  30 #include <net/bluetooth/hci_core.h>
  31
  32 #include "smp.h"
  33 #include "a2mp.h"
  34
  35 struct sco_param {
  36         u16 pkt_type;
  37         u16 max_latency;
  38 };
  39
  40 static const struct sco_param sco_param_cvsd[] = {
  41         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000a }, /* S3 */
  42         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x0007 }, /* S2 */
  43         { EDR_ESCO_MASK | ESCO_EV3,   0x0007 }, /* S1 */
  44         { EDR_ESCO_MASK | ESCO_HV3,   0xffff }, /* D1 */
  45         { EDR_ESCO_MASK | ESCO_HV1,   0xffff }, /* D0 */
  46 };
  47
  48 static const struct sco_param sco_param_wideband[] = {
  49         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000d }, /* T2 */
  50         { EDR_ESCO_MASK | ESCO_EV3,   0x0008 }, /* T1 */
  51 };
  52
  53 static void hci_le_create_connection_cancel(struct hci_conn *conn)
  54 {
  55         hci_send_cmd(conn->hdev, HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL);
  56 }
  57
  58 static void hci_acl_create_connection(struct hci_conn *conn)
  59 {
  60         struct hci_dev *hdev = conn->hdev;
  61         struct inquiry_entry *ie;
  62         struct hci_cp_create_conn cp;
  63
  64         BT_DBG("hcon %p", conn);
  65
  66         conn->state = BT_CONNECT;
  67         conn->out = true;
  68
  69         conn->link_mode = HCI_LM_MASTER;
  70
  71         conn->attempt++;
  72
  73         conn->link_policy = hdev->link_policy;
  74
  75         memset(&cp, 0, sizeof(cp));
  76         bacpy(&cp.bdaddr, &conn->dst);
  77         cp.pscan_rep_mode = 0x02;
  78
  79         ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
  80         if (ie) {
  81                 if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
  82                         cp.pscan_rep_mode = ie->data.pscan_rep_mode;
  83                         cp.pscan_mode     = ie->data.pscan_mode;
  84                         cp.clock_offset   = ie->data.clock_offset |
  85                                             __constant_cpu_to_le16(0x8000);
  86                 }
  87
  88                 memcpy(conn->dev_class, ie->data.dev_class, 3);
  89                 if (ie->data.ssp_mode > 0)
  90                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
  91         }
  92
  93         cp.pkt_type = cpu_to_le16(conn->pkt_type);
  94         if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
  95                 cp.role_switch = 0x01;
  96         else
  97                 cp.role_switch = 0x00;
  98
  99         hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
 100 }
 101
 102 static void hci_acl_create_connection_cancel(struct hci_conn *conn)
 103 {
 104         struct hci_cp_create_conn_cancel cp;
 105
 106         BT_DBG("hcon %p", conn);
 107
 108         if (conn->hdev->hci_ver < BLUETOOTH_VER_1_2)
 109                 return;
 110
 111         bacpy(&cp.bdaddr, &conn->dst);
 112         hci_send_cmd(conn->hdev, HCI_OP_CREATE_CONN_CANCEL, sizeof(cp), &cp);
 113 }
 114
 115 static void hci_reject_sco(struct hci_conn *conn)
 116 {
 117         struct hci_cp_reject_sync_conn_req cp;
 118
 119         cp.reason = HCI_ERROR_REMOTE_USER_TERM;
 120         bacpy(&cp.bdaddr, &conn->dst);
 121
 122         hci_send_cmd(conn->hdev, HCI_OP_REJECT_SYNC_CONN_REQ, sizeof(cp), &cp);
 123 }
 124
 125 void hci_disconnect(struct hci_conn *conn, __u8 reason)
 126 {
 127         struct hci_cp_disconnect cp;
 128
 129         BT_DBG("hcon %p", conn);
 130
 131         conn->state = BT_DISCONN;
 132
 133         cp.handle = cpu_to_le16(conn->handle);
 134         cp.reason = reason;
 135         hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp);
 136 }
 137
 138 static void hci_amp_disconn(struct hci_conn *conn, __u8 reason)
 139 {
 140         struct hci_cp_disconn_phy_link cp;
 141
 142         BT_DBG("hcon %p", conn);
 143
 144         conn->state = BT_DISCONN;
 145
 146         cp.phy_handle = HCI_PHY_HANDLE(conn->handle);
 147         cp.reason = reason;
 148         hci_send_cmd(conn->hdev, HCI_OP_DISCONN_PHY_LINK,
 149                      sizeof(cp), &cp);
 150 }
 151
 152 static void hci_add_sco(struct hci_conn *conn, __u16 handle)
 153 {
 154         struct hci_dev *hdev = conn->hdev;
 155         struct hci_cp_add_sco cp;
 156
 157         BT_DBG("hcon %p", conn);
 158
 159         conn->state = BT_CONNECT;
 160         conn->out = true;
 161
 162         conn->attempt++;
 163
 164         cp.handle   = cpu_to_le16(handle);
 165         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 166
 167         hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
 168 }
 169
 170 bool hci_setup_sync(struct hci_conn *conn, __u16 handle)
 171 {
 172         struct hci_dev *hdev = conn->hdev;
 173         struct hci_cp_setup_sync_conn cp;
 174         const struct sco_param *param;
 175
 176         BT_DBG("hcon %p", conn);
 177
 178         conn->state = BT_CONNECT;
 179         conn->out = true;
 180
 181         conn->attempt++;
 182
 183         cp.handle   = cpu_to_le16(handle);
 184
 185         cp.tx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
 186         cp.rx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
 187         cp.voice_setting  = cpu_to_le16(conn->setting);
 188
 189         switch (conn->setting & SCO_AIRMODE_MASK) {
 190         case SCO_AIRMODE_TRANSP:
 191                 if (conn->attempt > ARRAY_SIZE(sco_param_wideband))
 192                         return false;
 193                 cp.retrans_effort = 0x02;
 194                 param = &sco_param_wideband[conn->attempt - 1];
 195                 break;
 196         case SCO_AIRMODE_CVSD:
 197                 if (conn->attempt > ARRAY_SIZE(sco_param_cvsd))
 198                         return false;
 199                 cp.retrans_effort = 0x01;
 200                 param = &sco_param_cvsd[conn->attempt - 1];
 201                 break;
 202         default:
 203                 return false;
 204         }
 205
 206         cp.pkt_type = __cpu_to_le16(param->pkt_type);
 207         cp.max_latency = __cpu_to_le16(param->max_latency);
 208
 209         if (hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp) < 0)
 210                 return false;
 211
 212         return true;
 213 }
 214
 215 void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max,
 216                         u16 latency, u16 to_multiplier)
 217 {
 218         struct hci_cp_le_conn_update cp;
 219         struct hci_dev *hdev = conn->hdev;
 220
 221         memset(&cp, 0, sizeof(cp));
 222
 223         cp.handle               = cpu_to_le16(conn->handle);
 224         cp.conn_interval_min    = cpu_to_le16(min);
 225         cp.conn_interval_max    = cpu_to_le16(max);
 226         cp.conn_latency         = cpu_to_le16(latency);
 227         cp.supervision_timeout  = cpu_to_le16(to_multiplier);
 228         cp.min_ce_len           = __constant_cpu_to_le16(0x0000);
 229         cp.max_ce_len           = __constant_cpu_to_le16(0x0000);
 230
 231         hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp);
 232 }
 233
 234 void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __u8 rand[8],
 235                       __u8 ltk[16])
 236 {
 237         struct hci_dev *hdev = conn->hdev;
 238         struct hci_cp_le_start_enc cp;
 239
 240         BT_DBG("hcon %p", conn);
 241
 242         memset(&cp, 0, sizeof(cp));
 243
 244         cp.handle = cpu_to_le16(conn->handle);
 245         memcpy(cp.ltk, ltk, sizeof(cp.ltk));
 246         cp.ediv = ediv;
 247         memcpy(cp.rand, rand, sizeof(cp.rand));
 248
 249         hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp);
 250 }
 251
 252 /* Device _must_ be locked */
 253 void hci_sco_setup(struct hci_conn *conn, __u8 status)
 254 {
 255         struct hci_conn *sco = conn->link;
 256
 257         if (!sco)
 258                 return;
 259
 260         BT_DBG("hcon %p", conn);
 261
 262         if (!status) {
 263                 if (lmp_esco_capable(conn->hdev))
 264                         hci_setup_sync(sco, conn->handle);
 265                 else
 266                         hci_add_sco(sco, conn->handle);
 267         } else {
 268                 hci_proto_connect_cfm(sco, status);
 269                 hci_conn_del(sco);
 270         }
 271 }
 272
 273 static void hci_conn_disconnect(struct hci_conn *conn)
 274 {
 275         __u8 reason = hci_proto_disconn_ind(conn);
 276
 277         switch (conn->type) {
 278         case AMP_LINK:
 279                 hci_amp_disconn(conn, reason);
 280                 break;
 281         default:
 282                 hci_disconnect(conn, reason);
 283                 break;
 284         }
 285 }
 286
 287 static void hci_conn_timeout(struct work_struct *work)
 288 {
 289         struct hci_conn *conn = container_of(work, struct hci_conn,
 290                                              disc_work.work);
 291
 292         BT_DBG("hcon %p state %s", conn, state_to_string(conn->state));
 293
 294         if (atomic_read(&conn->refcnt))
 295                 return;
 296
 297         switch (conn->state) {
 298         case BT_CONNECT:
 299         case BT_CONNECT2:
 300                 if (conn->out) {
 301                         if (conn->type == ACL_LINK)
 302                                 hci_acl_create_connection_cancel(conn);
 303                         else if (conn->type == LE_LINK)
 304                                 hci_le_create_connection_cancel(conn);
 305                 } else if (conn->type == SCO_LINK || conn->type == ESCO_LINK) {
 306                         hci_reject_sco(conn);
 307                 }
 308                 break;
 309         case BT_CONFIG:
 310         case BT_CONNECTED:
 311                 hci_conn_disconnect(conn);
 312                 break;
 313         default:
 314                 conn->state = BT_CLOSED;
 315                 break;
 316         }
 317 }
 318
 319 /* Enter sniff mode */
 320 static void hci_conn_idle(struct work_struct *work)
 321 {
 322         struct hci_conn *conn = container_of(work, struct hci_conn,
 323                                              idle_work.work);
 324         struct hci_dev *hdev = conn->hdev;
 325
 326         BT_DBG("hcon %p mode %d", conn, conn->mode);
 327
 328         if (test_bit(HCI_RAW, &hdev->flags))
 329                 return;
 330
 331         if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn))
 332                 return;
 333
 334         if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF))
 335                 return;
 336
 337         if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
 338                 struct hci_cp_sniff_subrate cp;
 339                 cp.handle             = cpu_to_le16(conn->handle);
 340                 cp.max_latency        = __constant_cpu_to_le16(0);
 341                 cp.min_remote_timeout = __constant_cpu_to_le16(0);
 342                 cp.min_local_timeout  = __constant_cpu_to_le16(0);
 343                 hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
 344         }
 345
 346         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
 347                 struct hci_cp_sniff_mode cp;
 348                 cp.handle       = cpu_to_le16(conn->handle);
 349                 cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
 350                 cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
 351                 cp.attempt      = __constant_cpu_to_le16(4);
 352                 cp.timeout      = __constant_cpu_to_le16(1);
 353                 hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
 354         }
 355 }
 356
 357 static void hci_conn_auto_accept(struct work_struct *work)
 358 {
 359         struct hci_conn *conn = container_of(work, struct hci_conn,
 360                                              auto_accept_work.work);
 361
 362         hci_send_cmd(conn->hdev, HCI_OP_USER_CONFIRM_REPLY, sizeof(conn->dst),
 363                      &conn->dst);
 364 }
 365
 366 struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
 367 {
 368         struct hci_conn *conn;
 369
 370         BT_DBG("%s dst %pMR", hdev->name, dst);
 371
 372         conn = kzalloc(sizeof(struct hci_conn), GFP_KERNEL);
 373         if (!conn)
 374                 return NULL;
 375
 376         bacpy(&conn->dst, dst);
 377         bacpy(&conn->src, &hdev->bdaddr);
 378         conn->hdev  = hdev;
 379         conn->type  = type;
 380         conn->mode  = HCI_CM_ACTIVE;
 381         conn->state = BT_OPEN;
 382         conn->auth_type = HCI_AT_GENERAL_BONDING;
 383         conn->io_capability = hdev->io_capability;
 384         conn->remote_auth = 0xff;
 385         conn->key_type = 0xff;
 386
 387         set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
 388         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
 389
 390         switch (type) {
 391         case ACL_LINK:
 392                 conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
 393                 break;
 394         case SCO_LINK:
 395                 if (lmp_esco_capable(hdev))
 396                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
 397                                         (hdev->esco_type & EDR_ESCO_MASK);
 398                 else
 399                         conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
 400                 break;
 401         case ESCO_LINK:
 402                 conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
 403                 break;
 404         }
 405
 406         skb_queue_head_init(&conn->data_q);
 407
 408         INIT_LIST_HEAD(&conn->chan_list);
 409
 410         INIT_DELAYED_WORK(&conn->disc_work, hci_conn_timeout);
 411         INIT_DELAYED_WORK(&conn->auto_accept_work, hci_conn_auto_accept);
 412         INIT_DELAYED_WORK(&conn->idle_work, hci_conn_idle);
 413
 414         atomic_set(&conn->refcnt, 0);
 415
 416         hci_dev_hold(hdev);
 417
 418         hci_conn_hash_add(hdev, conn);
 419         if (hdev->notify)
 420                 hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
 421
 422         hci_conn_init_sysfs(conn);
 423
 424         return conn;
 425 }
 426
 427 int hci_conn_del(struct hci_conn *conn)
 428 {
 429         struct hci_dev *hdev = conn->hdev;
 430
 431         BT_DBG("%s hcon %p handle %d", hdev->name, conn, conn->handle);
 432
 433         cancel_delayed_work_sync(&conn->disc_work);
 434         cancel_delayed_work_sync(&conn->auto_accept_work);
 435         cancel_delayed_work_sync(&conn->idle_work);
 436
 437         if (conn->type == ACL_LINK) {
 438                 struct hci_conn *sco = conn->link;
 439                 if (sco)
 440                         sco->link = NULL;
 441
 442                 /* Unacked frames */
 443                 hdev->acl_cnt += conn->sent;
 444         } else if (conn->type == LE_LINK) {
 445                 if (hdev->le_pkts)
 446                         hdev->le_cnt += conn->sent;
 447                 else
 448                         hdev->acl_cnt += conn->sent;
 449         } else {
 450                 struct hci_conn *acl = conn->link;
 451                 if (acl) {
 452                         acl->link = NULL;
 453                         hci_conn_drop(acl);
 454                 }
 455         }
 456
 457         hci_chan_list_flush(conn);
 458
 459         if (conn->amp_mgr)
 460                 amp_mgr_put(conn->amp_mgr);
 461
 462         hci_conn_hash_del(hdev, conn);
 463         if (hdev->notify)
 464                 hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
 465
 466         skb_queue_purge(&conn->data_q);
 467
 468         hci_conn_del_sysfs(conn);
 469
 470         hci_dev_put(hdev);
 471
 472         hci_conn_put(conn);
 473
 474         return 0;
 475 }
 476
 477 struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src)
 478 {
 479         int use_src = bacmp(src, BDADDR_ANY);
 480         struct hci_dev *hdev = NULL, *d;
 481
 482         BT_DBG("%pMR -> %pMR", src, dst);
 483
 484         read_lock(&hci_dev_list_lock);
 485
 486         list_for_each_entry(d, &hci_dev_list, list) {
 487                 if (!test_bit(HCI_UP, &d->flags) ||
 488                     test_bit(HCI_RAW, &d->flags) ||
 489                     test_bit(HCI_USER_CHANNEL, &d->dev_flags) ||
 490                     d->dev_type != HCI_BREDR)
 491                         continue;
 492
 493                 /* Simple routing:
 494                  *   No source address - find interface with bdaddr != dst
 495                  *   Source address    - find interface with bdaddr == src
 496                  */
 497
 498                 if (use_src) {
 499                         if (!bacmp(&d->bdaddr, src)) {
 500                                 hdev = d; break;
 501                         }
 502                 } else {
 503                         if (bacmp(&d->bdaddr, dst)) {
 504                                 hdev = d; break;
 505                         }
 506                 }
 507         }
 508
 509         if (hdev)
 510                 hdev = hci_dev_hold(hdev);
 511
 512         read_unlock(&hci_dev_list_lock);
 513         return hdev;
 514 }
 515 EXPORT_SYMBOL(hci_get_route);
 516
 517 /* This function requires the caller holds hdev->lock */
 518 void hci_le_conn_failed(struct hci_conn *conn, u8 status)
 519 {
 520         struct hci_dev *hdev = conn->hdev;
 521
 522         conn->state = BT_CLOSED;
 523
 524         mgmt_connect_failed(hdev, &conn->dst, conn->type, conn->dst_type,
 525                             status);
 526
 527         hci_proto_connect_cfm(conn, status);
 528
 529         hci_conn_del(conn);
 530 }
 531
 532 static void create_le_conn_complete(struct hci_dev *hdev, u8 status)
 533 {
 534         struct hci_conn *conn;
 535
 536         if (status == 0)
 537                 return;
 538
 539         BT_ERR("HCI request failed to create LE connection: status 0x%2.2x",
 540                status);
 541
 542         hci_dev_lock(hdev);
 543
 544         conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
 545         if (!conn)
 546                 goto done;
 547
 548         hci_le_conn_failed(conn, status);
 549
 550 done:
 551         hci_dev_unlock(hdev);
 552 }
 553
 554 static void hci_req_add_le_create_conn(struct hci_request *req,
 555                                        struct hci_conn *conn)
 556 {
 557         struct hci_cp_le_create_conn cp;
 558         struct hci_dev *hdev = conn->hdev;
 559         u8 own_addr_type;
 560
 561         memset(&cp, 0, sizeof(cp));
 562
 563         /* Update random address, but set require_privacy to false so
 564          * that we never connect with an unresolvable address.
 565          */
 566         if (hci_update_random_address(req, false, &own_addr_type))
 567                 return;
 568
 569         /* Save the address type used for this connnection attempt so we able
 570          * to retrieve this information if we need it.
 571          */
 572         conn->src_type = own_addr_type;
 573
 574         cp.scan_interval = cpu_to_le16(hdev->le_scan_interval);
 575         cp.scan_window = cpu_to_le16(hdev->le_scan_window);
 576         bacpy(&cp.peer_addr, &conn->dst);
 577         cp.peer_addr_type = conn->dst_type;
 578         cp.own_address_type = own_addr_type;
 579         cp.conn_interval_min = cpu_to_le16(conn->le_conn_min_interval);
 580         cp.conn_interval_max = cpu_to_le16(conn->le_conn_max_interval);
 581         cp.supervision_timeout = __constant_cpu_to_le16(0x002a);
 582         cp.min_ce_len = __constant_cpu_to_le16(0x0000);
 583         cp.max_ce_len = __constant_cpu_to_le16(0x0000);
 584
 585         hci_req_add(req, HCI_OP_LE_CREATE_CONN, sizeof(cp), &cp);
 586 }
 587
 588 static void stop_scan_complete(struct hci_dev *hdev, u8 status)
 589 {
 590         struct hci_request req;
 591         struct hci_conn *conn;
 592         int err;
 593
 594         conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
 595         if (!conn)
 596                 return;
 597
 598         if (status) {
 599                 BT_DBG("HCI request failed to stop scanning: status 0x%2.2x",
 600                        status);
 601
 602                 hci_dev_lock(hdev);
 603                 hci_le_conn_failed(conn, status);
 604                 hci_dev_unlock(hdev);
 605                 return;
 606         }
 607
 608         /* Since we may have prematurely stopped discovery procedure, we should
 609          * update discovery state.
 610          */
 611         cancel_delayed_work(&hdev->le_scan_disable);
 612         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
 613
 614         hci_req_init(&req, hdev);
 615
 616         hci_req_add_le_create_conn(&req, conn);
 617
 618         err = hci_req_run(&req, create_le_conn_complete);
 619         if (err) {
 620                 hci_dev_lock(hdev);
 621                 hci_le_conn_failed(conn, HCI_ERROR_MEMORY_EXCEEDED);
 622                 hci_dev_unlock(hdev);
 623                 return;
 624         }
 625 }
 626
 627 struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,
 628                                 u8 dst_type, u8 sec_level, u8 auth_type)
 629 {
 630         struct hci_conn_params *params;
 631         struct hci_conn *conn;
 632         struct smp_irk *irk;
 633         struct hci_request req;
 634         int err;
 635
 636         if (test_bit(HCI_ADVERTISING, &hdev->flags))
 637                 return ERR_PTR(-ENOTSUPP);
 638
 639         /* Some devices send ATT messages as soon as the physical link is
 640          * established. To be able to handle these ATT messages, the user-
 641          * space first establishes the connection and then starts the pairing
 642          * process.
 643          *
 644          * So if a hci_conn object already exists for the following connection
 645          * attempt, we simply update pending_sec_level and auth_type fields
 646          * and return the object found.
 647          */
 648         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, dst);
 649         if (conn) {
 650                 conn->pending_sec_level = sec_level;
 651                 conn->auth_type = auth_type;
 652                 goto done;
 653         }
 654
 655         /* Since the controller supports only one LE connection attempt at a
 656          * time, we return -EBUSY if there is any connection attempt running.
 657          */
 658         conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
 659         if (conn)
 660                 return ERR_PTR(-EBUSY);
 661
 662         /* When given an identity address with existing identity
 663          * resolving key, the connection needs to be established
 664          * to a resolvable random address.
 665          *
 666          * This uses the cached random resolvable address from
 667          * a previous scan. When no cached address is available,
 668          * try connecting to the identity address instead.
 669          *
 670          * Storing the resolvable random address is required here
 671          * to handle connection failures. The address will later
 672          * be resolved back into the original identity address
 673          * from the connect request.
 674          */
 675         irk = hci_find_irk_by_addr(hdev, dst, dst_type);
 676         if (irk && bacmp(&irk->rpa, BDADDR_ANY)) {
 677                 dst = &irk->rpa;
 678                 dst_type = ADDR_LE_DEV_RANDOM;
 679         }
 680
 681         conn = hci_conn_add(hdev, LE_LINK, dst);
 682         if (!conn)
 683                 return ERR_PTR(-ENOMEM);
 684
 685         conn->dst_type = dst_type;
 686
 687         conn->state = BT_CONNECT;
 688         conn->out = true;
 689         conn->link_mode |= HCI_LM_MASTER;
 690         conn->sec_level = BT_SECURITY_LOW;
 691         conn->pending_sec_level = sec_level;
 692         conn->auth_type = auth_type;
 693
 694         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
 695         if (params) {
 696                 conn->le_conn_min_interval = params->conn_min_interval;
 697                 conn->le_conn_max_interval = params->conn_max_interval;
 698         } else {
 699                 conn->le_conn_min_interval = hdev->le_conn_min_interval;
 700                 conn->le_conn_max_interval = hdev->le_conn_max_interval;
 701         }
 702
 703         hci_req_init(&req, hdev);
 704
 705         /* If controller is scanning, we stop it since some controllers are
 706          * not able to scan and connect at the same time.
 707          */
 708         if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
 709                 hci_req_add_le_scan_disable(&req);
 710                 err = hci_req_run(&req, stop_scan_complete);
 711         } else {
 712                 hci_req_add_le_create_conn(&req, conn);
 713                 err = hci_req_run(&req, create_le_conn_complete);
 714         }
 715
 716         if (err) {
 717                 hci_conn_del(conn);
 718                 return ERR_PTR(err);
 719         }
 720
 721 done:
 722         hci_conn_hold(conn);
 723         return conn;
 724 }
 725
 726 struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst,
 727                                  u8 sec_level, u8 auth_type)
 728 {
 729         struct hci_conn *acl;
 730
 731         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 732                 return ERR_PTR(-ENOTSUPP);
 733
 734         acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
 735         if (!acl) {
 736                 acl = hci_conn_add(hdev, ACL_LINK, dst);
 737                 if (!acl)
 738                         return ERR_PTR(-ENOMEM);
 739         }
 740
 741         hci_conn_hold(acl);
 742
 743         if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
 744                 acl->sec_level = BT_SECURITY_LOW;
 745                 acl->pending_sec_level = sec_level;
 746                 acl->auth_type = auth_type;
 747                 hci_acl_create_connection(acl);
 748         }
 749
 750         return acl;
 751 }
 752
 753 struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type, bdaddr_t *dst,
 754                                  __u16 setting)
 755 {
 756         struct hci_conn *acl;
 757         struct hci_conn *sco;
 758
 759         acl = hci_connect_acl(hdev, dst, BT_SECURITY_LOW, HCI_AT_NO_BONDING);
 760         if (IS_ERR(acl))
 761                 return acl;
 762
 763         sco = hci_conn_hash_lookup_ba(hdev, type, dst);
 764         if (!sco) {
 765                 sco = hci_conn_add(hdev, type, dst);
 766                 if (!sco) {
 767                         hci_conn_drop(acl);
 768                         return ERR_PTR(-ENOMEM);
 769                 }
 770         }
 771
 772         acl->link = sco;
 773         sco->link = acl;
 774
 775         hci_conn_hold(sco);
 776
 777         sco->setting = setting;
 778
 779         if (acl->state == BT_CONNECTED &&
 780             (sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
 781                 set_bit(HCI_CONN_POWER_SAVE, &acl->flags);
 782                 hci_conn_enter_active_mode(acl, BT_POWER_FORCE_ACTIVE_ON);
 783
 784                 if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->flags)) {
 785                         /* defer SCO setup until mode change completed */
 786                         set_bit(HCI_CONN_SCO_SETUP_PEND, &acl->flags);
 787                         return sco;
 788                 }
 789
 790                 hci_sco_setup(acl, 0x00);
 791         }
 792
 793         return sco;
 794 }
 795
 796 /* Check link security requirement */
 797 int hci_conn_check_link_mode(struct hci_conn *conn)
 798 {
 799         BT_DBG("hcon %p", conn);
 800
 801         if (hci_conn_ssp_enabled(conn) && !(conn->link_mode & HCI_LM_ENCRYPT))
 802                 return 0;
 803
 804         return 1;
 805 }
 806
 807 /* Authenticate remote device */
 808 static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 809 {
 810         BT_DBG("hcon %p", conn);
 811
 812         if (conn->pending_sec_level > sec_level)
 813                 sec_level = conn->pending_sec_level;
 814
 815         if (sec_level > conn->sec_level)
 816                 conn->pending_sec_level = sec_level;
 817         else if (conn->link_mode & HCI_LM_AUTH)
 818                 return 1;
 819
 820         /* Make sure we preserve an existing MITM requirement*/
 821         auth_type |= (conn->auth_type & 0x01);
 822
 823         conn->auth_type = auth_type;
 824
 825         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
 826                 struct hci_cp_auth_requested cp;
 827
 828                 /* encrypt must be pending if auth is also pending */
 829                 set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
 830
 831                 cp.handle = cpu_to_le16(conn->handle);
 832                 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
 833                              sizeof(cp), &cp);
 834                 if (conn->key_type != 0xff)
 835                         set_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
 836         }
 837
 838         return 0;
 839 }
 840
 841 /* Encrypt the the link */
 842 static void hci_conn_encrypt(struct hci_conn *conn)
 843 {
 844         BT_DBG("hcon %p", conn);
 845
 846         if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
 847                 struct hci_cp_set_conn_encrypt cp;
 848                 cp.handle  = cpu_to_le16(conn->handle);
 849                 cp.encrypt = 0x01;
 850                 hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
 851                              &cp);
 852         }
 853 }
 854
 855 /* Enable security */
 856 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 857 {
 858         BT_DBG("hcon %p", conn);
 859
 860         if (conn->type == LE_LINK)
 861                 return smp_conn_security(conn, sec_level);
 862
 863         /* For sdp we don't need the link key. */
 864         if (sec_level == BT_SECURITY_SDP)
 865                 return 1;
 866
 867         /* For non 2.1 devices and low security level we don't need the link
 868            key. */
 869         if (sec_level == BT_SECURITY_LOW && !hci_conn_ssp_enabled(conn))
 870                 return 1;
 871
 872         /* For other security levels we need the link key. */
 873         if (!(conn->link_mode & HCI_LM_AUTH))
 874                 goto auth;
 875
 876         /* An authenticated FIPS approved combination key has sufficient
 877          * security for security level 4. */
 878         if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256 &&
 879             sec_level == BT_SECURITY_FIPS)
 880                 goto encrypt;
 881
 882         /* An authenticated combination key has sufficient security for
 883            security level 3. */
 884         if ((conn->key_type == HCI_LK_AUTH_COMBINATION_P192 ||
 885              conn->key_type == HCI_LK_AUTH_COMBINATION_P256) &&
 886             sec_level == BT_SECURITY_HIGH)
 887                 goto encrypt;
 888
 889         /* An unauthenticated combination key has sufficient security for
 890            security level 1 and 2. */
 891         if ((conn->key_type == HCI_LK_UNAUTH_COMBINATION_P192 ||
 892              conn->key_type == HCI_LK_UNAUTH_COMBINATION_P256) &&
 893             (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW))
 894                 goto encrypt;
 895
 896         /* A combination key has always sufficient security for the security
 897            levels 1 or 2. High security level requires the combination key
 898            is generated using maximum PIN code length (16).
 899            For pre 2.1 units. */
 900         if (conn->key_type == HCI_LK_COMBINATION &&
 901             (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW ||
 902              conn->pin_length == 16))
 903                 goto encrypt;
 904
 905 auth:
 906         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags))
 907                 return 0;
 908
 909         if (!hci_conn_auth(conn, sec_level, auth_type))
 910                 return 0;
 911
 912 encrypt:
 913         if (conn->link_mode & HCI_LM_ENCRYPT)
 914                 return 1;
 915
 916         hci_conn_encrypt(conn);
 917         return 0;
 918 }
 919 EXPORT_SYMBOL(hci_conn_security);
 920
 921 /* Check secure link requirement */
 922 int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level)
 923 {
 924         BT_DBG("hcon %p", conn);
 925
 926         /* Accept if non-secure or higher security level is required */
 927         if (sec_level != BT_SECURITY_HIGH && sec_level != BT_SECURITY_FIPS)
 928                 return 1;
 929
 930         /* Accept if secure or higher security level is already present */
 931         if (conn->sec_level == BT_SECURITY_HIGH ||
 932             conn->sec_level == BT_SECURITY_FIPS)
 933                 return 1;
 934
 935         /* Reject not secure link */
 936         return 0;
 937 }
 938 EXPORT_SYMBOL(hci_conn_check_secure);
 939
 940 /* Change link key */
 941 int hci_conn_change_link_key(struct hci_conn *conn)
 942 {
 943         BT_DBG("hcon %p", conn);
 944
 945         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
 946                 struct hci_cp_change_conn_link_key cp;
 947                 cp.handle = cpu_to_le16(conn->handle);
 948                 hci_send_cmd(conn->hdev, HCI_OP_CHANGE_CONN_LINK_KEY,
 949                              sizeof(cp), &cp);
 950         }
 951
 952         return 0;
 953 }
 954
 955 /* Switch role */
 956 int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
 957 {
 958         BT_DBG("hcon %p", conn);
 959
 960         if (!role && conn->link_mode & HCI_LM_MASTER)
 961                 return 1;
 962
 963         if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->flags)) {
 964                 struct hci_cp_switch_role cp;
 965                 bacpy(&cp.bdaddr, &conn->dst);
 966                 cp.role = role;
 967                 hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
 968         }
 969
 970         return 0;
 971 }
 972 EXPORT_SYMBOL(hci_conn_switch_role);
 973
 974 /* Enter active mode */
 975 void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
 976 {
 977         struct hci_dev *hdev = conn->hdev;
 978
 979         BT_DBG("hcon %p mode %d", conn, conn->mode);
 980
 981         if (test_bit(HCI_RAW, &hdev->flags))
 982                 return;
 983
 984         if (conn->mode != HCI_CM_SNIFF)
 985                 goto timer;
 986
 987         if (!test_bit(HCI_CONN_POWER_SAVE, &conn->flags) && !force_active)
 988                 goto timer;
 989
 990         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
 991                 struct hci_cp_exit_sniff_mode cp;
 992                 cp.handle = cpu_to_le16(conn->handle);
 993                 hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
 994         }
 995
 996 timer:
 997         if (hdev->idle_timeout > 0)
 998                 queue_delayed_work(hdev->workqueue, &conn->idle_work,
 999                                    msecs_to_jiffies(hdev->idle_timeout));
1000 }
1001
1002 /* Drop all connection on the device */
1003 void hci_conn_hash_flush(struct hci_dev *hdev)
1004 {
1005         struct hci_conn_hash *h = &hdev->conn_hash;
1006         struct hci_conn *c, *n;
1007
1008         BT_DBG("hdev %s", hdev->name);
1009
1010         list_for_each_entry_safe(c, n, &h->list, list) {
1011                 c->state = BT_CLOSED;
1012
1013                 hci_proto_disconn_cfm(c, HCI_ERROR_LOCAL_HOST_TERM);
1014                 hci_conn_del(c);
1015         }
1016 }
1017
1018 /* Check pending connect attempts */
1019 void hci_conn_check_pending(struct hci_dev *hdev)
1020 {
1021         struct hci_conn *conn;
1022
1023         BT_DBG("hdev %s", hdev->name);
1024
1025         hci_dev_lock(hdev);
1026
1027         conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
1028         if (conn)
1029                 hci_acl_create_connection(conn);
1030
1031         hci_dev_unlock(hdev);
1032 }
1033
1034 int hci_get_conn_list(void __user *arg)
1035 {
1036         struct hci_conn *c;
1037         struct hci_conn_list_req req, *cl;
1038         struct hci_conn_info *ci;
1039         struct hci_dev *hdev;
1040         int n = 0, size, err;
1041
1042         if (copy_from_user(&req, arg, sizeof(req)))
1043                 return -EFAULT;
1044
1045         if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
1046                 return -EINVAL;
1047
1048         size = sizeof(req) + req.conn_num * sizeof(*ci);
1049
1050         cl = kmalloc(size, GFP_KERNEL);
1051         if (!cl)
1052                 return -ENOMEM;
1053
1054         hdev = hci_dev_get(req.dev_id);
1055         if (!hdev) {
1056                 kfree(cl);
1057                 return -ENODEV;
1058         }
1059
1060         ci = cl->conn_info;
1061
1062         hci_dev_lock(hdev);
1063         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1064                 bacpy(&(ci + n)->bdaddr, &c->dst);
1065                 (ci + n)->handle = c->handle;
1066                 (ci + n)->type  = c->type;
1067                 (ci + n)->out   = c->out;
1068                 (ci + n)->state = c->state;
1069                 (ci + n)->link_mode = c->link_mode;
1070                 if (++n >= req.conn_num)
1071                         break;
1072         }
1073         hci_dev_unlock(hdev);
1074
1075         cl->dev_id = hdev->id;
1076         cl->conn_num = n;
1077         size = sizeof(req) + n * sizeof(*ci);
1078
1079         hci_dev_put(hdev);
1080
1081         err = copy_to_user(arg, cl, size);
1082         kfree(cl);
1083
1084         return err ? -EFAULT : 0;
1085 }
1086
1087 int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
1088 {
1089         struct hci_conn_info_req req;
1090         struct hci_conn_info ci;
1091         struct hci_conn *conn;
1092         char __user *ptr = arg + sizeof(req);
1093
1094         if (copy_from_user(&req, arg, sizeof(req)))
1095                 return -EFAULT;
1096
1097         hci_dev_lock(hdev);
1098         conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
1099         if (conn) {
1100                 bacpy(&ci.bdaddr, &conn->dst);
1101                 ci.handle = conn->handle;
1102                 ci.type  = conn->type;
1103                 ci.out   = conn->out;
1104                 ci.state = conn->state;
1105                 ci.link_mode = conn->link_mode;
1106         }
1107         hci_dev_unlock(hdev);
1108
1109         if (!conn)
1110                 return -ENOENT;
1111
1112         return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
1113 }
1114
1115 int hci_get_auth_info(struct hci_dev *hdev, void __user *arg)
1116 {
1117         struct hci_auth_info_req req;
1118         struct hci_conn *conn;
1119
1120         if (copy_from_user(&req, arg, sizeof(req)))
1121                 return -EFAULT;
1122
1123         hci_dev_lock(hdev);
1124         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr);
1125         if (conn)
1126                 req.type = conn->auth_type;
1127         hci_dev_unlock(hdev);
1128
1129         if (!conn)
1130                 return -ENOENT;
1131
1132         return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0;
1133 }
1134
1135 struct hci_chan *hci_chan_create(struct hci_conn *conn)
1136 {
1137         struct hci_dev *hdev = conn->hdev;
1138         struct hci_chan *chan;
1139
1140         BT_DBG("%s hcon %p", hdev->name, conn);
1141
1142         chan = kzalloc(sizeof(struct hci_chan), GFP_KERNEL);
1143         if (!chan)
1144                 return NULL;
1145
1146         chan->conn = conn;
1147         skb_queue_head_init(&chan->data_q);
1148         chan->state = BT_CONNECTED;
1149
1150         list_add_rcu(&chan->list, &conn->chan_list);
1151
1152         return chan;
1153 }
1154
1155 void hci_chan_del(struct hci_chan *chan)
1156 {
1157         struct hci_conn *conn = chan->conn;
1158         struct hci_dev *hdev = conn->hdev;
1159
1160         BT_DBG("%s hcon %p chan %p", hdev->name, conn, chan);
1161
1162         list_del_rcu(&chan->list);
1163
1164         synchronize_rcu();
1165
1166         hci_conn_drop(conn);
1167
1168         skb_queue_purge(&chan->data_q);
1169         kfree(chan);
1170 }
1171
1172 void hci_chan_list_flush(struct hci_conn *conn)
1173 {
1174         struct hci_chan *chan, *n;
1175
1176         BT_DBG("hcon %p", conn);
1177
1178         list_for_each_entry_safe(chan, n, &conn->chan_list, list)
1179                 hci_chan_del(chan);
1180 }
1181
1182 static struct hci_chan *__hci_chan_lookup_handle(struct hci_conn *hcon,
1183                                                  __u16 handle)
1184 {
1185         struct hci_chan *hchan;
1186
1187         list_for_each_entry(hchan, &hcon->chan_list, list) {
1188                 if (hchan->handle == handle)
1189                         return hchan;
1190         }
1191
1192         return NULL;
1193 }
1194
1195 struct hci_chan *hci_chan_lookup_handle(struct hci_dev *hdev, __u16 handle)
1196 {
1197         struct hci_conn_hash *h = &hdev->conn_hash;
1198         struct hci_conn *hcon;
1199         struct hci_chan *hchan = NULL;
1200
1201         rcu_read_lock();
1202
1203         list_for_each_entry_rcu(hcon, &h->list, list) {
1204                 hchan = __hci_chan_lookup_handle(hcon, handle);
1205                 if (hchan)
1206                         break;
1207         }
1208
1209         rcu_read_unlock();
1210
1211         return hchan;
1212 }