net/bluetooth/hci_conn.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI connection handling. */
  26
  27 #include <linux/export.h>
  28
  29 #include <net/bluetooth/bluetooth.h>
  30 #include <net/bluetooth/hci_core.h>
  31
  32 #include "smp.h"
  33 #include "a2mp.h"
  34
  35 struct sco_param {
  36         u16 pkt_type;
  37         u16 max_latency;
  38 };
  39
  40 static const struct sco_param sco_param_cvsd[] = {
  41         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000a }, /* S3 */
  42         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x0007 }, /* S2 */
  43         { EDR_ESCO_MASK | ESCO_EV3,   0x0007 }, /* S1 */
  44         { EDR_ESCO_MASK | ESCO_HV3,   0xffff }, /* D1 */
  45         { EDR_ESCO_MASK | ESCO_HV1,   0xffff }, /* D0 */
  46 };
  47
  48 static const struct sco_param sco_param_wideband[] = {
  49         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000d }, /* T2 */
  50         { EDR_ESCO_MASK | ESCO_EV3,   0x0008 }, /* T1 */
  51 };
  52
  53 static void hci_le_create_connection_cancel(struct hci_conn *conn)
  54 {
  55         hci_send_cmd(conn->hdev, HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL);
  56 }
  57
  58 static void hci_acl_create_connection(struct hci_conn *conn)
  59 {
  60         struct hci_dev *hdev = conn->hdev;
  61         struct inquiry_entry *ie;
  62         struct hci_cp_create_conn cp;
  63
  64         BT_DBG("hcon %p", conn);
  65
  66         conn->state = BT_CONNECT;
  67         conn->out = true;
  68
  69         conn->link_mode = HCI_LM_MASTER;
  70
  71         conn->attempt++;
  72
  73         conn->link_policy = hdev->link_policy;
  74
  75         memset(&cp, 0, sizeof(cp));
  76         bacpy(&cp.bdaddr, &conn->dst);
  77         cp.pscan_rep_mode = 0x02;
  78
  79         ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
  80         if (ie) {
  81                 if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
  82                         cp.pscan_rep_mode = ie->data.pscan_rep_mode;
  83                         cp.pscan_mode     = ie->data.pscan_mode;
  84                         cp.clock_offset   = ie->data.clock_offset |
  85                                             __constant_cpu_to_le16(0x8000);
  86                 }
  87
  88                 memcpy(conn->dev_class, ie->data.dev_class, 3);
  89                 if (ie->data.ssp_mode > 0)
  90                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
  91         }
  92
  93         cp.pkt_type = cpu_to_le16(conn->pkt_type);
  94         if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
  95                 cp.role_switch = 0x01;
  96         else
  97                 cp.role_switch = 0x00;
  98
  99         hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
 100 }
 101
 102 static void hci_acl_create_connection_cancel(struct hci_conn *conn)
 103 {
 104         struct hci_cp_create_conn_cancel cp;
 105
 106         BT_DBG("hcon %p", conn);
 107
 108         if (conn->hdev->hci_ver < BLUETOOTH_VER_1_2)
 109                 return;
 110
 111         bacpy(&cp.bdaddr, &conn->dst);
 112         hci_send_cmd(conn->hdev, HCI_OP_CREATE_CONN_CANCEL, sizeof(cp), &cp);
 113 }
 114
 115 static void hci_reject_sco(struct hci_conn *conn)
 116 {
 117         struct hci_cp_reject_sync_conn_req cp;
 118
 119         cp.reason = HCI_ERROR_REMOTE_USER_TERM;
 120         bacpy(&cp.bdaddr, &conn->dst);
 121
 122         hci_send_cmd(conn->hdev, HCI_OP_REJECT_SYNC_CONN_REQ, sizeof(cp), &cp);
 123 }
 124
 125 void hci_disconnect(struct hci_conn *conn, __u8 reason)
 126 {
 127         struct hci_cp_disconnect cp;
 128
 129         BT_DBG("hcon %p", conn);
 130
 131         conn->state = BT_DISCONN;
 132
 133         cp.handle = cpu_to_le16(conn->handle);
 134         cp.reason = reason;
 135         hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp);
 136 }
 137
 138 static void hci_amp_disconn(struct hci_conn *conn, __u8 reason)
 139 {
 140         struct hci_cp_disconn_phy_link cp;
 141
 142         BT_DBG("hcon %p", conn);
 143
 144         conn->state = BT_DISCONN;
 145
 146         cp.phy_handle = HCI_PHY_HANDLE(conn->handle);
 147         cp.reason = reason;
 148         hci_send_cmd(conn->hdev, HCI_OP_DISCONN_PHY_LINK,
 149                      sizeof(cp), &cp);
 150 }
 151
 152 static void hci_add_sco(struct hci_conn *conn, __u16 handle)
 153 {
 154         struct hci_dev *hdev = conn->hdev;
 155         struct hci_cp_add_sco cp;
 156
 157         BT_DBG("hcon %p", conn);
 158
 159         conn->state = BT_CONNECT;
 160         conn->out = true;
 161
 162         conn->attempt++;
 163
 164         cp.handle   = cpu_to_le16(handle);
 165         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 166
 167         hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
 168 }
 169
 170 bool hci_setup_sync(struct hci_conn *conn, __u16 handle)
 171 {
 172         struct hci_dev *hdev = conn->hdev;
 173         struct hci_cp_setup_sync_conn cp;
 174         const struct sco_param *param;
 175
 176         BT_DBG("hcon %p", conn);
 177
 178         conn->state = BT_CONNECT;
 179         conn->out = true;
 180
 181         conn->attempt++;
 182
 183         cp.handle   = cpu_to_le16(handle);
 184
 185         cp.tx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
 186         cp.rx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
 187         cp.voice_setting  = cpu_to_le16(conn->setting);
 188
 189         switch (conn->setting & SCO_AIRMODE_MASK) {
 190         case SCO_AIRMODE_TRANSP:
 191                 if (conn->attempt > ARRAY_SIZE(sco_param_wideband))
 192                         return false;
 193                 cp.retrans_effort = 0x02;
 194                 param = &sco_param_wideband[conn->attempt - 1];
 195                 break;
 196         case SCO_AIRMODE_CVSD:
 197                 if (conn->attempt > ARRAY_SIZE(sco_param_cvsd))
 198                         return false;
 199                 cp.retrans_effort = 0x01;
 200                 param = &sco_param_cvsd[conn->attempt - 1];
 201                 break;
 202         default:
 203                 return false;
 204         }
 205
 206         cp.pkt_type = __cpu_to_le16(param->pkt_type);
 207         cp.max_latency = __cpu_to_le16(param->max_latency);
 208
 209         if (hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp) < 0)
 210                 return false;
 211
 212         return true;
 213 }
 214
 215 void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max,
 216                         u16 latency, u16 to_multiplier)
 217 {
 218         struct hci_cp_le_conn_update cp;
 219         struct hci_dev *hdev = conn->hdev;
 220
 221         memset(&cp, 0, sizeof(cp));
 222
 223         cp.handle               = cpu_to_le16(conn->handle);
 224         cp.conn_interval_min    = cpu_to_le16(min);
 225         cp.conn_interval_max    = cpu_to_le16(max);
 226         cp.conn_latency         = cpu_to_le16(latency);
 227         cp.supervision_timeout  = cpu_to_le16(to_multiplier);
 228         cp.min_ce_len           = __constant_cpu_to_le16(0x0000);
 229         cp.max_ce_len           = __constant_cpu_to_le16(0x0000);
 230
 231         hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp);
 232 }
 233
 234 void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __u8 rand[8],
 235                       __u8 ltk[16])
 236 {
 237         struct hci_dev *hdev = conn->hdev;
 238         struct hci_cp_le_start_enc cp;
 239
 240         BT_DBG("hcon %p", conn);
 241
 242         memset(&cp, 0, sizeof(cp));
 243
 244         cp.handle = cpu_to_le16(conn->handle);
 245         memcpy(cp.ltk, ltk, sizeof(cp.ltk));
 246         cp.ediv = ediv;
 247         memcpy(cp.rand, rand, sizeof(cp.rand));
 248
 249         hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp);
 250 }
 251
 252 /* Device _must_ be locked */
 253 void hci_sco_setup(struct hci_conn *conn, __u8 status)
 254 {
 255         struct hci_conn *sco = conn->link;
 256
 257         if (!sco)
 258                 return;
 259
 260         BT_DBG("hcon %p", conn);
 261
 262         if (!status) {
 263                 if (lmp_esco_capable(conn->hdev))
 264                         hci_setup_sync(sco, conn->handle);
 265                 else
 266                         hci_add_sco(sco, conn->handle);
 267         } else {
 268                 hci_proto_connect_cfm(sco, status);
 269                 hci_conn_del(sco);
 270         }
 271 }
 272
 273 static void hci_conn_disconnect(struct hci_conn *conn)
 274 {
 275         __u8 reason = hci_proto_disconn_ind(conn);
 276
 277         switch (conn->type) {
 278         case AMP_LINK:
 279                 hci_amp_disconn(conn, reason);
 280                 break;
 281         default:
 282                 hci_disconnect(conn, reason);
 283                 break;
 284         }
 285 }
 286
 287 static void hci_conn_timeout(struct work_struct *work)
 288 {
 289         struct hci_conn *conn = container_of(work, struct hci_conn,
 290                                              disc_work.work);
 291
 292         BT_DBG("hcon %p state %s", conn, state_to_string(conn->state));
 293
 294         if (atomic_read(&conn->refcnt))
 295                 return;
 296
 297         switch (conn->state) {
 298         case BT_CONNECT:
 299         case BT_CONNECT2:
 300                 if (conn->out) {
 301                         if (conn->type == ACL_LINK)
 302                                 hci_acl_create_connection_cancel(conn);
 303                         else if (conn->type == LE_LINK)
 304                                 hci_le_create_connection_cancel(conn);
 305                 } else if (conn->type == SCO_LINK || conn->type == ESCO_LINK) {
 306                         hci_reject_sco(conn);
 307                 }
 308                 break;
 309         case BT_CONFIG:
 310         case BT_CONNECTED:
 311                 hci_conn_disconnect(conn);
 312                 break;
 313         default:
 314                 conn->state = BT_CLOSED;
 315                 break;
 316         }
 317 }
 318
 319 /* Enter sniff mode */
 320 static void hci_conn_idle(struct work_struct *work)
 321 {
 322         struct hci_conn *conn = container_of(work, struct hci_conn,
 323                                              idle_work.work);
 324         struct hci_dev *hdev = conn->hdev;
 325
 326         BT_DBG("hcon %p mode %d", conn, conn->mode);
 327
 328         if (test_bit(HCI_RAW, &hdev->flags))
 329                 return;
 330
 331         if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn))
 332                 return;
 333
 334         if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF))
 335                 return;
 336
 337         if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
 338                 struct hci_cp_sniff_subrate cp;
 339                 cp.handle             = cpu_to_le16(conn->handle);
 340                 cp.max_latency        = __constant_cpu_to_le16(0);
 341                 cp.min_remote_timeout = __constant_cpu_to_le16(0);
 342                 cp.min_local_timeout  = __constant_cpu_to_le16(0);
 343                 hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
 344         }
 345
 346         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
 347                 struct hci_cp_sniff_mode cp;
 348                 cp.handle       = cpu_to_le16(conn->handle);
 349                 cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
 350                 cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
 351                 cp.attempt      = __constant_cpu_to_le16(4);
 352                 cp.timeout      = __constant_cpu_to_le16(1);
 353                 hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
 354         }
 355 }
 356
 357 static void hci_conn_auto_accept(struct work_struct *work)
 358 {
 359         struct hci_conn *conn = container_of(work, struct hci_conn,
 360                                              auto_accept_work.work);
 361
 362         hci_send_cmd(conn->hdev, HCI_OP_USER_CONFIRM_REPLY, sizeof(conn->dst),
 363                      &conn->dst);
 364 }
 365
 366 struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
 367 {
 368         struct hci_conn *conn;
 369
 370         BT_DBG("%s dst %pMR", hdev->name, dst);
 371
 372         conn = kzalloc(sizeof(struct hci_conn), GFP_KERNEL);
 373         if (!conn)
 374                 return NULL;
 375
 376         bacpy(&conn->dst, dst);
 377         bacpy(&conn->src, &hdev->bdaddr);
 378         conn->hdev  = hdev;
 379         conn->type  = type;
 380         conn->mode  = HCI_CM_ACTIVE;
 381         conn->state = BT_OPEN;
 382         conn->auth_type = HCI_AT_GENERAL_BONDING;
 383         conn->io_capability = hdev->io_capability;
 384         conn->remote_auth = 0xff;
 385         conn->key_type = 0xff;
 386
 387         set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
 388         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
 389
 390         switch (type) {
 391         case ACL_LINK:
 392                 conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
 393                 break;
 394         case SCO_LINK:
 395                 if (lmp_esco_capable(hdev))
 396                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
 397                                         (hdev->esco_type & EDR_ESCO_MASK);
 398                 else
 399                         conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
 400                 break;
 401         case ESCO_LINK:
 402                 conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
 403                 break;
 404         }
 405
 406         skb_queue_head_init(&conn->data_q);
 407
 408         INIT_LIST_HEAD(&conn->chan_list);
 409
 410         INIT_DELAYED_WORK(&conn->disc_work, hci_conn_timeout);
 411         INIT_DELAYED_WORK(&conn->auto_accept_work, hci_conn_auto_accept);
 412         INIT_DELAYED_WORK(&conn->idle_work, hci_conn_idle);
 413
 414         atomic_set(&conn->refcnt, 0);
 415
 416         hci_dev_hold(hdev);
 417
 418         hci_conn_hash_add(hdev, conn);
 419         if (hdev->notify)
 420                 hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
 421
 422         hci_conn_init_sysfs(conn);
 423
 424         return conn;
 425 }
 426
 427 int hci_conn_del(struct hci_conn *conn)
 428 {
 429         struct hci_dev *hdev = conn->hdev;
 430
 431         BT_DBG("%s hcon %p handle %d", hdev->name, conn, conn->handle);
 432
 433         cancel_delayed_work_sync(&conn->disc_work);
 434         cancel_delayed_work_sync(&conn->auto_accept_work);
 435         cancel_delayed_work_sync(&conn->idle_work);
 436
 437         if (conn->type == ACL_LINK) {
 438                 struct hci_conn *sco = conn->link;
 439                 if (sco)
 440                         sco->link = NULL;
 441
 442                 /* Unacked frames */
 443                 hdev->acl_cnt += conn->sent;
 444         } else if (conn->type == LE_LINK) {
 445                 if (hdev->le_pkts)
 446                         hdev->le_cnt += conn->sent;
 447                 else
 448                         hdev->acl_cnt += conn->sent;
 449         } else {
 450                 struct hci_conn *acl = conn->link;
 451                 if (acl) {
 452                         acl->link = NULL;
 453                         hci_conn_drop(acl);
 454                 }
 455         }
 456
 457         hci_chan_list_flush(conn);
 458
 459         if (conn->amp_mgr)
 460                 amp_mgr_put(conn->amp_mgr);
 461
 462         hci_conn_hash_del(hdev, conn);
 463         if (hdev->notify)
 464                 hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
 465
 466         skb_queue_purge(&conn->data_q);
 467
 468         hci_conn_del_sysfs(conn);
 469
 470         hci_dev_put(hdev);
 471
 472         hci_conn_put(conn);
 473
 474         return 0;
 475 }
 476
 477 struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src)
 478 {
 479         int use_src = bacmp(src, BDADDR_ANY);
 480         struct hci_dev *hdev = NULL, *d;
 481
 482         BT_DBG("%pMR -> %pMR", src, dst);
 483
 484         read_lock(&hci_dev_list_lock);
 485
 486         list_for_each_entry(d, &hci_dev_list, list) {
 487                 if (!test_bit(HCI_UP, &d->flags) ||
 488                     test_bit(HCI_RAW, &d->flags) ||
 489                     test_bit(HCI_USER_CHANNEL, &d->dev_flags) ||
 490                     d->dev_type != HCI_BREDR)
 491                         continue;
 492
 493                 /* Simple routing:
 494                  *   No source address - find interface with bdaddr != dst
 495                  *   Source address    - find interface with bdaddr == src
 496                  */
 497
 498                 if (use_src) {
 499                         if (!bacmp(&d->bdaddr, src)) {
 500                                 hdev = d; break;
 501                         }
 502                 } else {
 503                         if (bacmp(&d->bdaddr, dst)) {
 504                                 hdev = d; break;
 505                         }
 506                 }
 507         }
 508
 509         if (hdev)
 510                 hdev = hci_dev_hold(hdev);
 511
 512         read_unlock(&hci_dev_list_lock);
 513         return hdev;
 514 }
 515 EXPORT_SYMBOL(hci_get_route);
 516
 517 /* This function requires the caller holds hdev->lock */
 518 static void le_conn_failed(struct hci_conn *conn, u8 status)
 519 {
 520         struct hci_dev *hdev = conn->hdev;
 521
 522         conn->state = BT_CLOSED;
 523
 524         mgmt_connect_failed(hdev, &conn->dst, conn->type, conn->dst_type,
 525                             status);
 526
 527         hci_proto_connect_cfm(conn, status);
 528
 529         hci_conn_del(conn);
 530 }
 531
 532 static void create_le_conn_complete(struct hci_dev *hdev, u8 status)
 533 {
 534         struct hci_conn *conn;
 535
 536         if (status == 0)
 537                 return;
 538
 539         BT_ERR("HCI request failed to create LE connection: status 0x%2.2x",
 540                status);
 541
 542         hci_dev_lock(hdev);
 543
 544         conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
 545         if (!conn)
 546                 goto done;
 547
 548         le_conn_failed(conn, status);
 549
 550 done:
 551         hci_dev_unlock(hdev);
 552 }
 553
 554 static int hci_create_le_conn(struct hci_conn *conn)
 555 {
 556         struct hci_dev *hdev = conn->hdev;
 557         struct hci_cp_le_create_conn cp;
 558         struct hci_request req;
 559         u8 own_addr_type;
 560         int err;
 561
 562         hci_req_init(&req, hdev);
 563
 564         memset(&cp, 0, sizeof(cp));
 565
 566         err = hci_update_random_address(&req, &own_addr_type);
 567         if (err < 0)
 568                 return err;
 569
 570         cp.scan_interval = cpu_to_le16(hdev->le_scan_interval);
 571         cp.scan_window = cpu_to_le16(hdev->le_scan_window);
 572         bacpy(&cp.peer_addr, &conn->dst);
 573         cp.peer_addr_type = conn->dst_type;
 574         cp.own_address_type = own_addr_type;
 575         cp.conn_interval_min = cpu_to_le16(conn->le_conn_min_interval);
 576         cp.conn_interval_max = cpu_to_le16(conn->le_conn_max_interval);
 577         cp.supervision_timeout = __constant_cpu_to_le16(0x002a);
 578         cp.min_ce_len = __constant_cpu_to_le16(0x0000);
 579         cp.max_ce_len = __constant_cpu_to_le16(0x0000);
 580
 581         hci_req_add(&req, HCI_OP_LE_CREATE_CONN, sizeof(cp), &cp);
 582
 583         err = hci_req_run(&req, create_le_conn_complete);
 584         if (err) {
 585                 hci_conn_del(conn);
 586                 return err;
 587         }
 588
 589         return 0;
 590 }
 591
 592 static struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,
 593                                     u8 dst_type, u8 sec_level, u8 auth_type)
 594 {
 595         struct hci_conn_params *params;
 596         struct hci_conn *conn;
 597         struct smp_irk *irk;
 598         int err;
 599
 600         if (test_bit(HCI_ADVERTISING, &hdev->flags))
 601                 return ERR_PTR(-ENOTSUPP);
 602
 603         /* Some devices send ATT messages as soon as the physical link is
 604          * established. To be able to handle these ATT messages, the user-
 605          * space first establishes the connection and then starts the pairing
 606          * process.
 607          *
 608          * So if a hci_conn object already exists for the following connection
 609          * attempt, we simply update pending_sec_level and auth_type fields
 610          * and return the object found.
 611          */
 612         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, dst);
 613         if (conn) {
 614                 conn->pending_sec_level = sec_level;
 615                 conn->auth_type = auth_type;
 616                 goto done;
 617         }
 618
 619         /* Since the controller supports only one LE connection attempt at a
 620          * time, we return -EBUSY if there is any connection attempt running.
 621          */
 622         conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
 623         if (conn)
 624                 return ERR_PTR(-EBUSY);
 625
 626         /* Convert from L2CAP channel address type to HCI address type */
 627         if (dst_type == BDADDR_LE_PUBLIC)
 628                 dst_type = ADDR_LE_DEV_PUBLIC;
 629         else
 630                 dst_type = ADDR_LE_DEV_RANDOM;
 631
 632         /* When given an identity address with existing identity
 633          * resolving key, the connection needs to be established
 634          * to a resolvable random address.
 635          *
 636          * This uses the cached random resolvable address from
 637          * a previous scan. When no cached address is available,
 638          * try connecting to the identity address instead.
 639          *
 640          * Storing the resolvable random address is required here
 641          * to handle connection failures. The address will later
 642          * be resolved back into the original identity address
 643          * from the connect request.
 644          */
 645         irk = hci_find_irk_by_addr(hdev, dst, dst_type);
 646         if (irk && bacmp(&irk->rpa, BDADDR_ANY)) {
 647                 dst = &irk->rpa;
 648                 dst_type = ADDR_LE_DEV_RANDOM;
 649         }
 650
 651         conn = hci_conn_add(hdev, LE_LINK, dst);
 652         if (!conn)
 653                 return ERR_PTR(-ENOMEM);
 654
 655         conn->dst_type = dst_type;
 656         conn->src_type = hdev->own_addr_type;
 657
 658         conn->state = BT_CONNECT;
 659         conn->out = true;
 660         conn->link_mode |= HCI_LM_MASTER;
 661         conn->sec_level = BT_SECURITY_LOW;
 662         conn->pending_sec_level = sec_level;
 663         conn->auth_type = auth_type;
 664
 665         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
 666         if (params) {
 667                 conn->le_conn_min_interval = params->conn_min_interval;
 668                 conn->le_conn_max_interval = params->conn_max_interval;
 669         } else {
 670                 conn->le_conn_min_interval = hdev->le_conn_min_interval;
 671                 conn->le_conn_max_interval = hdev->le_conn_max_interval;
 672         }
 673
 674         err = hci_create_le_conn(conn);
 675         if (err)
 676                 return ERR_PTR(err);
 677
 678 done:
 679         hci_conn_hold(conn);
 680         return conn;
 681 }
 682
 683 static struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst,
 684                                                 u8 sec_level, u8 auth_type)
 685 {
 686         struct hci_conn *acl;
 687
 688         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 689                 return ERR_PTR(-ENOTSUPP);
 690
 691         acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
 692         if (!acl) {
 693                 acl = hci_conn_add(hdev, ACL_LINK, dst);
 694                 if (!acl)
 695                         return ERR_PTR(-ENOMEM);
 696         }
 697
 698         hci_conn_hold(acl);
 699
 700         if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
 701                 acl->sec_level = BT_SECURITY_LOW;
 702                 acl->pending_sec_level = sec_level;
 703                 acl->auth_type = auth_type;
 704                 hci_acl_create_connection(acl);
 705         }
 706
 707         return acl;
 708 }
 709
 710 struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type, bdaddr_t *dst,
 711                                  __u16 setting)
 712 {
 713         struct hci_conn *acl;
 714         struct hci_conn *sco;
 715
 716         acl = hci_connect_acl(hdev, dst, BT_SECURITY_LOW, HCI_AT_NO_BONDING);
 717         if (IS_ERR(acl))
 718                 return acl;
 719
 720         sco = hci_conn_hash_lookup_ba(hdev, type, dst);
 721         if (!sco) {
 722                 sco = hci_conn_add(hdev, type, dst);
 723                 if (!sco) {
 724                         hci_conn_drop(acl);
 725                         return ERR_PTR(-ENOMEM);
 726                 }
 727         }
 728
 729         acl->link = sco;
 730         sco->link = acl;
 731
 732         hci_conn_hold(sco);
 733
 734         sco->setting = setting;
 735
 736         if (acl->state == BT_CONNECTED &&
 737             (sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
 738                 set_bit(HCI_CONN_POWER_SAVE, &acl->flags);
 739                 hci_conn_enter_active_mode(acl, BT_POWER_FORCE_ACTIVE_ON);
 740
 741                 if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->flags)) {
 742                         /* defer SCO setup until mode change completed */
 743                         set_bit(HCI_CONN_SCO_SETUP_PEND, &acl->flags);
 744                         return sco;
 745                 }
 746
 747                 hci_sco_setup(acl, 0x00);
 748         }
 749
 750         return sco;
 751 }
 752
 753 /* Create SCO, ACL or LE connection. */
 754 struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst,
 755                              __u8 dst_type, __u8 sec_level, __u8 auth_type)
 756 {
 757         BT_DBG("%s dst %pMR type 0x%x", hdev->name, dst, type);
 758
 759         switch (type) {
 760         case LE_LINK:
 761                 return hci_connect_le(hdev, dst, dst_type, sec_level, auth_type);
 762         case ACL_LINK:
 763                 return hci_connect_acl(hdev, dst, sec_level, auth_type);
 764         }
 765
 766         return ERR_PTR(-EINVAL);
 767 }
 768
 769 /* Check link security requirement */
 770 int hci_conn_check_link_mode(struct hci_conn *conn)
 771 {
 772         BT_DBG("hcon %p", conn);
 773
 774         if (hci_conn_ssp_enabled(conn) && !(conn->link_mode & HCI_LM_ENCRYPT))
 775                 return 0;
 776
 777         return 1;
 778 }
 779
 780 /* Authenticate remote device */
 781 static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 782 {
 783         BT_DBG("hcon %p", conn);
 784
 785         if (conn->pending_sec_level > sec_level)
 786                 sec_level = conn->pending_sec_level;
 787
 788         if (sec_level > conn->sec_level)
 789                 conn->pending_sec_level = sec_level;
 790         else if (conn->link_mode & HCI_LM_AUTH)
 791                 return 1;
 792
 793         /* Make sure we preserve an existing MITM requirement*/
 794         auth_type |= (conn->auth_type & 0x01);
 795
 796         conn->auth_type = auth_type;
 797
 798         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
 799                 struct hci_cp_auth_requested cp;
 800
 801                 /* encrypt must be pending if auth is also pending */
 802                 set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
 803
 804                 cp.handle = cpu_to_le16(conn->handle);
 805                 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
 806                              sizeof(cp), &cp);
 807                 if (conn->key_type != 0xff)
 808                         set_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
 809         }
 810
 811         return 0;
 812 }
 813
 814 /* Encrypt the the link */
 815 static void hci_conn_encrypt(struct hci_conn *conn)
 816 {
 817         BT_DBG("hcon %p", conn);
 818
 819         if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
 820                 struct hci_cp_set_conn_encrypt cp;
 821                 cp.handle  = cpu_to_le16(conn->handle);
 822                 cp.encrypt = 0x01;
 823                 hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
 824                              &cp);
 825         }
 826 }
 827
 828 /* Enable security */
 829 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 830 {
 831         BT_DBG("hcon %p", conn);
 832
 833         if (conn->type == LE_LINK)
 834                 return smp_conn_security(conn, sec_level);
 835
 836         /* For sdp we don't need the link key. */
 837         if (sec_level == BT_SECURITY_SDP)
 838                 return 1;
 839
 840         /* For non 2.1 devices and low security level we don't need the link
 841            key. */
 842         if (sec_level == BT_SECURITY_LOW && !hci_conn_ssp_enabled(conn))
 843                 return 1;
 844
 845         /* For other security levels we need the link key. */
 846         if (!(conn->link_mode & HCI_LM_AUTH))
 847                 goto auth;
 848
 849         /* An authenticated FIPS approved combination key has sufficient
 850          * security for security level 4. */
 851         if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256 &&
 852             sec_level == BT_SECURITY_FIPS)
 853                 goto encrypt;
 854
 855         /* An authenticated combination key has sufficient security for
 856            security level 3. */
 857         if ((conn->key_type == HCI_LK_AUTH_COMBINATION_P192 ||
 858              conn->key_type == HCI_LK_AUTH_COMBINATION_P256) &&
 859             sec_level == BT_SECURITY_HIGH)
 860                 goto encrypt;
 861
 862         /* An unauthenticated combination key has sufficient security for
 863            security level 1 and 2. */
 864         if ((conn->key_type == HCI_LK_UNAUTH_COMBINATION_P192 ||
 865              conn->key_type == HCI_LK_UNAUTH_COMBINATION_P256) &&
 866             (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW))
 867                 goto encrypt;
 868
 869         /* A combination key has always sufficient security for the security
 870            levels 1 or 2. High security level requires the combination key
 871            is generated using maximum PIN code length (16).
 872            For pre 2.1 units. */
 873         if (conn->key_type == HCI_LK_COMBINATION &&
 874             (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW ||
 875              conn->pin_length == 16))
 876                 goto encrypt;
 877
 878 auth:
 879         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags))
 880                 return 0;
 881
 882         if (!hci_conn_auth(conn, sec_level, auth_type))
 883                 return 0;
 884
 885 encrypt:
 886         if (conn->link_mode & HCI_LM_ENCRYPT)
 887                 return 1;
 888
 889         hci_conn_encrypt(conn);
 890         return 0;
 891 }
 892 EXPORT_SYMBOL(hci_conn_security);
 893
 894 /* Check secure link requirement */
 895 int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level)
 896 {
 897         BT_DBG("hcon %p", conn);
 898
 899         /* Accept if non-secure or higher security level is required */
 900         if (sec_level != BT_SECURITY_HIGH && sec_level != BT_SECURITY_FIPS)
 901                 return 1;
 902
 903         /* Accept if secure or higher security level is already present */
 904         if (conn->sec_level == BT_SECURITY_HIGH ||
 905             conn->sec_level == BT_SECURITY_FIPS)
 906                 return 1;
 907
 908         /* Reject not secure link */
 909         return 0;
 910 }
 911 EXPORT_SYMBOL(hci_conn_check_secure);
 912
 913 /* Change link key */
 914 int hci_conn_change_link_key(struct hci_conn *conn)
 915 {
 916         BT_DBG("hcon %p", conn);
 917
 918         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
 919                 struct hci_cp_change_conn_link_key cp;
 920                 cp.handle = cpu_to_le16(conn->handle);
 921                 hci_send_cmd(conn->hdev, HCI_OP_CHANGE_CONN_LINK_KEY,
 922                              sizeof(cp), &cp);
 923         }
 924
 925         return 0;
 926 }
 927
 928 /* Switch role */
 929 int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
 930 {
 931         BT_DBG("hcon %p", conn);
 932
 933         if (!role && conn->link_mode & HCI_LM_MASTER)
 934                 return 1;
 935
 936         if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->flags)) {
 937                 struct hci_cp_switch_role cp;
 938                 bacpy(&cp.bdaddr, &conn->dst);
 939                 cp.role = role;
 940                 hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
 941         }
 942
 943         return 0;
 944 }
 945 EXPORT_SYMBOL(hci_conn_switch_role);
 946
 947 /* Enter active mode */
 948 void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
 949 {
 950         struct hci_dev *hdev = conn->hdev;
 951
 952         BT_DBG("hcon %p mode %d", conn, conn->mode);
 953
 954         if (test_bit(HCI_RAW, &hdev->flags))
 955                 return;
 956
 957         if (conn->mode != HCI_CM_SNIFF)
 958                 goto timer;
 959
 960         if (!test_bit(HCI_CONN_POWER_SAVE, &conn->flags) && !force_active)
 961                 goto timer;
 962
 963         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
 964                 struct hci_cp_exit_sniff_mode cp;
 965                 cp.handle = cpu_to_le16(conn->handle);
 966                 hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
 967         }
 968
 969 timer:
 970         if (hdev->idle_timeout > 0)
 971                 queue_delayed_work(hdev->workqueue, &conn->idle_work,
 972                                    msecs_to_jiffies(hdev->idle_timeout));
 973 }
 974
 975 /* Drop all connection on the device */
 976 void hci_conn_hash_flush(struct hci_dev *hdev)
 977 {
 978         struct hci_conn_hash *h = &hdev->conn_hash;
 979         struct hci_conn *c, *n;
 980
 981         BT_DBG("hdev %s", hdev->name);
 982
 983         list_for_each_entry_safe(c, n, &h->list, list) {
 984                 c->state = BT_CLOSED;
 985
 986                 hci_proto_disconn_cfm(c, HCI_ERROR_LOCAL_HOST_TERM);
 987                 hci_conn_del(c);
 988         }
 989 }
 990
 991 /* Check pending connect attempts */
 992 void hci_conn_check_pending(struct hci_dev *hdev)
 993 {
 994         struct hci_conn *conn;
 995
 996         BT_DBG("hdev %s", hdev->name);
 997
 998         hci_dev_lock(hdev);
 999
1000         conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
1001         if (conn)
1002                 hci_acl_create_connection(conn);
1003
1004         hci_dev_unlock(hdev);
1005 }
1006
1007 int hci_get_conn_list(void __user *arg)
1008 {
1009         struct hci_conn *c;
1010         struct hci_conn_list_req req, *cl;
1011         struct hci_conn_info *ci;
1012         struct hci_dev *hdev;
1013         int n = 0, size, err;
1014
1015         if (copy_from_user(&req, arg, sizeof(req)))
1016                 return -EFAULT;
1017
1018         if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
1019                 return -EINVAL;
1020
1021         size = sizeof(req) + req.conn_num * sizeof(*ci);
1022
1023         cl = kmalloc(size, GFP_KERNEL);
1024         if (!cl)
1025                 return -ENOMEM;
1026
1027         hdev = hci_dev_get(req.dev_id);
1028         if (!hdev) {
1029                 kfree(cl);
1030                 return -ENODEV;
1031         }
1032
1033         ci = cl->conn_info;
1034
1035         hci_dev_lock(hdev);
1036         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1037                 bacpy(&(ci + n)->bdaddr, &c->dst);
1038                 (ci + n)->handle = c->handle;
1039                 (ci + n)->type  = c->type;
1040                 (ci + n)->out   = c->out;
1041                 (ci + n)->state = c->state;
1042                 (ci + n)->link_mode = c->link_mode;
1043                 if (++n >= req.conn_num)
1044                         break;
1045         }
1046         hci_dev_unlock(hdev);
1047
1048         cl->dev_id = hdev->id;
1049         cl->conn_num = n;
1050         size = sizeof(req) + n * sizeof(*ci);
1051
1052         hci_dev_put(hdev);
1053
1054         err = copy_to_user(arg, cl, size);
1055         kfree(cl);
1056
1057         return err ? -EFAULT : 0;
1058 }
1059
1060 int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
1061 {
1062         struct hci_conn_info_req req;
1063         struct hci_conn_info ci;
1064         struct hci_conn *conn;
1065         char __user *ptr = arg + sizeof(req);
1066
1067         if (copy_from_user(&req, arg, sizeof(req)))
1068                 return -EFAULT;
1069
1070         hci_dev_lock(hdev);
1071         conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
1072         if (conn) {
1073                 bacpy(&ci.bdaddr, &conn->dst);
1074                 ci.handle = conn->handle;
1075                 ci.type  = conn->type;
1076                 ci.out   = conn->out;
1077                 ci.state = conn->state;
1078                 ci.link_mode = conn->link_mode;
1079         }
1080         hci_dev_unlock(hdev);
1081
1082         if (!conn)
1083                 return -ENOENT;
1084
1085         return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
1086 }
1087
1088 int hci_get_auth_info(struct hci_dev *hdev, void __user *arg)
1089 {
1090         struct hci_auth_info_req req;
1091         struct hci_conn *conn;
1092
1093         if (copy_from_user(&req, arg, sizeof(req)))
1094                 return -EFAULT;
1095
1096         hci_dev_lock(hdev);
1097         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr);
1098         if (conn)
1099                 req.type = conn->auth_type;
1100         hci_dev_unlock(hdev);
1101
1102         if (!conn)
1103                 return -ENOENT;
1104
1105         return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0;
1106 }
1107
1108 struct hci_chan *hci_chan_create(struct hci_conn *conn)
1109 {
1110         struct hci_dev *hdev = conn->hdev;
1111         struct hci_chan *chan;
1112
1113         BT_DBG("%s hcon %p", hdev->name, conn);
1114
1115         chan = kzalloc(sizeof(struct hci_chan), GFP_KERNEL);
1116         if (!chan)
1117                 return NULL;
1118
1119         chan->conn = conn;
1120         skb_queue_head_init(&chan->data_q);
1121         chan->state = BT_CONNECTED;
1122
1123         list_add_rcu(&chan->list, &conn->chan_list);
1124
1125         return chan;
1126 }
1127
1128 void hci_chan_del(struct hci_chan *chan)
1129 {
1130         struct hci_conn *conn = chan->conn;
1131         struct hci_dev *hdev = conn->hdev;
1132
1133         BT_DBG("%s hcon %p chan %p", hdev->name, conn, chan);
1134
1135         list_del_rcu(&chan->list);
1136
1137         synchronize_rcu();
1138
1139         hci_conn_drop(conn);
1140
1141         skb_queue_purge(&chan->data_q);
1142         kfree(chan);
1143 }
1144
1145 void hci_chan_list_flush(struct hci_conn *conn)
1146 {
1147         struct hci_chan *chan, *n;
1148
1149         BT_DBG("hcon %p", conn);
1150
1151         list_for_each_entry_safe(chan, n, &conn->chan_list, list)
1152                 hci_chan_del(chan);
1153 }
1154
1155 static struct hci_chan *__hci_chan_lookup_handle(struct hci_conn *hcon,
1156                                                  __u16 handle)
1157 {
1158         struct hci_chan *hchan;
1159
1160         list_for_each_entry(hchan, &hcon->chan_list, list) {
1161                 if (hchan->handle == handle)
1162                         return hchan;
1163         }
1164
1165         return NULL;
1166 }
1167
1168 struct hci_chan *hci_chan_lookup_handle(struct hci_dev *hdev, __u16 handle)
1169 {
1170         struct hci_conn_hash *h = &hdev->conn_hash;
1171         struct hci_conn *hcon;
1172         struct hci_chan *hchan = NULL;
1173
1174         rcu_read_lock();
1175
1176         list_for_each_entry_rcu(hcon, &h->list, list) {
1177                 hchan = __hci_chan_lookup_handle(hcon, handle);
1178                 if (hchan)
1179                         break;
1180         }
1181
1182         rcu_read_unlock();
1183
1184         return hchan;
1185 }