net/bluetooth/hci_conn.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI connection handling. */
  26
  27 #include <linux/export.h>
  28
  29 #include <net/bluetooth/bluetooth.h>
  30 #include <net/bluetooth/hci_core.h>
  31
  32 #include "smp.h"
  33 #include "a2mp.h"
  34
  35 struct sco_param {
  36         u16 pkt_type;
  37         u16 max_latency;
  38 };
  39
  40 static const struct sco_param sco_param_cvsd[] = {
  41         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000a }, /* S3 */
  42         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x0007 }, /* S2 */
  43         { EDR_ESCO_MASK | ESCO_EV3,   0x0007 }, /* S1 */
  44         { EDR_ESCO_MASK | ESCO_HV3,   0xffff }, /* D1 */
  45         { EDR_ESCO_MASK | ESCO_HV1,   0xffff }, /* D0 */
  46 };
  47
  48 static const struct sco_param sco_param_wideband[] = {
  49         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000d }, /* T2 */
  50         { EDR_ESCO_MASK | ESCO_EV3,   0x0008 }, /* T1 */
  51 };
  52
  53 static void hci_le_create_connection_cancel(struct hci_conn *conn)
  54 {
  55         hci_send_cmd(conn->hdev, HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL);
  56 }
  57
  58 static void hci_acl_create_connection(struct hci_conn *conn)
  59 {
  60         struct hci_dev *hdev = conn->hdev;
  61         struct inquiry_entry *ie;
  62         struct hci_cp_create_conn cp;
  63
  64         BT_DBG("hcon %p", conn);
  65
  66         conn->state = BT_CONNECT;
  67         conn->out = true;
  68
  69         conn->link_mode = HCI_LM_MASTER;
  70
  71         conn->attempt++;
  72
  73         conn->link_policy = hdev->link_policy;
  74
  75         memset(&cp, 0, sizeof(cp));
  76         bacpy(&cp.bdaddr, &conn->dst);
  77         cp.pscan_rep_mode = 0x02;
  78
  79         ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
  80         if (ie) {
  81                 if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
  82                         cp.pscan_rep_mode = ie->data.pscan_rep_mode;
  83                         cp.pscan_mode     = ie->data.pscan_mode;
  84                         cp.clock_offset   = ie->data.clock_offset |
  85                                             __constant_cpu_to_le16(0x8000);
  86                 }
  87
  88                 memcpy(conn->dev_class, ie->data.dev_class, 3);
  89                 if (ie->data.ssp_mode > 0)
  90                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
  91         }
  92
  93         cp.pkt_type = cpu_to_le16(conn->pkt_type);
  94         if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
  95                 cp.role_switch = 0x01;
  96         else
  97                 cp.role_switch = 0x00;
  98
  99         hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
 100 }
 101
 102 static void hci_acl_create_connection_cancel(struct hci_conn *conn)
 103 {
 104         struct hci_cp_create_conn_cancel cp;
 105
 106         BT_DBG("hcon %p", conn);
 107
 108         if (conn->hdev->hci_ver < BLUETOOTH_VER_1_2)
 109                 return;
 110
 111         bacpy(&cp.bdaddr, &conn->dst);
 112         hci_send_cmd(conn->hdev, HCI_OP_CREATE_CONN_CANCEL, sizeof(cp), &cp);
 113 }
 114
 115 static void hci_reject_sco(struct hci_conn *conn)
 116 {
 117         struct hci_cp_reject_sync_conn_req cp;
 118
 119         cp.reason = HCI_ERROR_REMOTE_USER_TERM;
 120         bacpy(&cp.bdaddr, &conn->dst);
 121
 122         hci_send_cmd(conn->hdev, HCI_OP_REJECT_SYNC_CONN_REQ, sizeof(cp), &cp);
 123 }
 124
 125 void hci_disconnect(struct hci_conn *conn, __u8 reason)
 126 {
 127         struct hci_cp_disconnect cp;
 128
 129         BT_DBG("hcon %p", conn);
 130
 131         conn->state = BT_DISCONN;
 132
 133         cp.handle = cpu_to_le16(conn->handle);
 134         cp.reason = reason;
 135         hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp);
 136 }
 137
 138 static void hci_amp_disconn(struct hci_conn *conn, __u8 reason)
 139 {
 140         struct hci_cp_disconn_phy_link cp;
 141
 142         BT_DBG("hcon %p", conn);
 143
 144         conn->state = BT_DISCONN;
 145
 146         cp.phy_handle = HCI_PHY_HANDLE(conn->handle);
 147         cp.reason = reason;
 148         hci_send_cmd(conn->hdev, HCI_OP_DISCONN_PHY_LINK,
 149                      sizeof(cp), &cp);
 150 }
 151
 152 static void hci_add_sco(struct hci_conn *conn, __u16 handle)
 153 {
 154         struct hci_dev *hdev = conn->hdev;
 155         struct hci_cp_add_sco cp;
 156
 157         BT_DBG("hcon %p", conn);
 158
 159         conn->state = BT_CONNECT;
 160         conn->out = true;
 161
 162         conn->attempt++;
 163
 164         cp.handle   = cpu_to_le16(handle);
 165         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 166
 167         hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
 168 }
 169
 170 bool hci_setup_sync(struct hci_conn *conn, __u16 handle)
 171 {
 172         struct hci_dev *hdev = conn->hdev;
 173         struct hci_cp_setup_sync_conn cp;
 174         const struct sco_param *param;
 175
 176         BT_DBG("hcon %p", conn);
 177
 178         conn->state = BT_CONNECT;
 179         conn->out = true;
 180
 181         conn->attempt++;
 182
 183         cp.handle   = cpu_to_le16(handle);
 184
 185         cp.tx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
 186         cp.rx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
 187         cp.voice_setting  = cpu_to_le16(conn->setting);
 188
 189         switch (conn->setting & SCO_AIRMODE_MASK) {
 190         case SCO_AIRMODE_TRANSP:
 191                 if (conn->attempt > ARRAY_SIZE(sco_param_wideband))
 192                         return false;
 193                 cp.retrans_effort = 0x02;
 194                 param = &sco_param_wideband[conn->attempt - 1];
 195                 break;
 196         case SCO_AIRMODE_CVSD:
 197                 if (conn->attempt > ARRAY_SIZE(sco_param_cvsd))
 198                         return false;
 199                 cp.retrans_effort = 0x01;
 200                 param = &sco_param_cvsd[conn->attempt - 1];
 201                 break;
 202         default:
 203                 return false;
 204         }
 205
 206         cp.pkt_type = __cpu_to_le16(param->pkt_type);
 207         cp.max_latency = __cpu_to_le16(param->max_latency);
 208
 209         if (hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp) < 0)
 210                 return false;
 211
 212         return true;
 213 }
 214
 215 void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max,
 216                         u16 latency, u16 to_multiplier)
 217 {
 218         struct hci_cp_le_conn_update cp;
 219         struct hci_dev *hdev = conn->hdev;
 220
 221         memset(&cp, 0, sizeof(cp));
 222
 223         cp.handle               = cpu_to_le16(conn->handle);
 224         cp.conn_interval_min    = cpu_to_le16(min);
 225         cp.conn_interval_max    = cpu_to_le16(max);
 226         cp.conn_latency         = cpu_to_le16(latency);
 227         cp.supervision_timeout  = cpu_to_le16(to_multiplier);
 228         cp.min_ce_len           = __constant_cpu_to_le16(0x0000);
 229         cp.max_ce_len           = __constant_cpu_to_le16(0x0000);
 230
 231         hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp);
 232 }
 233
 234 void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __le64 rand,
 235                       __u8 ltk[16])
 236 {
 237         struct hci_dev *hdev = conn->hdev;
 238         struct hci_cp_le_start_enc cp;
 239
 240         BT_DBG("hcon %p", conn);
 241
 242         memset(&cp, 0, sizeof(cp));
 243
 244         cp.handle = cpu_to_le16(conn->handle);
 245         cp.rand = rand;
 246         cp.ediv = ediv;
 247         memcpy(cp.ltk, ltk, sizeof(cp.ltk));
 248
 249         hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp);
 250 }
 251
 252 /* Device _must_ be locked */
 253 void hci_sco_setup(struct hci_conn *conn, __u8 status)
 254 {
 255         struct hci_conn *sco = conn->link;
 256
 257         if (!sco)
 258                 return;
 259
 260         BT_DBG("hcon %p", conn);
 261
 262         if (!status) {
 263                 if (lmp_esco_capable(conn->hdev))
 264                         hci_setup_sync(sco, conn->handle);
 265                 else
 266                         hci_add_sco(sco, conn->handle);
 267         } else {
 268                 hci_proto_connect_cfm(sco, status);
 269                 hci_conn_del(sco);
 270         }
 271 }
 272
 273 static void hci_conn_disconnect(struct hci_conn *conn)
 274 {
 275         __u8 reason = hci_proto_disconn_ind(conn);
 276
 277         switch (conn->type) {
 278         case AMP_LINK:
 279                 hci_amp_disconn(conn, reason);
 280                 break;
 281         default:
 282                 hci_disconnect(conn, reason);
 283                 break;
 284         }
 285 }
 286
 287 static void hci_conn_timeout(struct work_struct *work)
 288 {
 289         struct hci_conn *conn = container_of(work, struct hci_conn,
 290                                              disc_work.work);
 291
 292         BT_DBG("hcon %p state %s", conn, state_to_string(conn->state));
 293
 294         if (atomic_read(&conn->refcnt))
 295                 return;
 296
 297         switch (conn->state) {
 298         case BT_CONNECT:
 299         case BT_CONNECT2:
 300                 if (conn->out) {
 301                         if (conn->type == ACL_LINK)
 302                                 hci_acl_create_connection_cancel(conn);
 303                         else if (conn->type == LE_LINK)
 304                                 hci_le_create_connection_cancel(conn);
 305                 } else if (conn->type == SCO_LINK || conn->type == ESCO_LINK) {
 306                         hci_reject_sco(conn);
 307                 }
 308                 break;
 309         case BT_CONFIG:
 310         case BT_CONNECTED:
 311                 hci_conn_disconnect(conn);
 312                 break;
 313         default:
 314                 conn->state = BT_CLOSED;
 315                 break;
 316         }
 317 }
 318
 319 /* Enter sniff mode */
 320 static void hci_conn_idle(struct work_struct *work)
 321 {
 322         struct hci_conn *conn = container_of(work, struct hci_conn,
 323                                              idle_work.work);
 324         struct hci_dev *hdev = conn->hdev;
 325
 326         BT_DBG("hcon %p mode %d", conn, conn->mode);
 327
 328         if (test_bit(HCI_RAW, &hdev->flags))
 329                 return;
 330
 331         if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn))
 332                 return;
 333
 334         if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF))
 335                 return;
 336
 337         if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
 338                 struct hci_cp_sniff_subrate cp;
 339                 cp.handle             = cpu_to_le16(conn->handle);
 340                 cp.max_latency        = __constant_cpu_to_le16(0);
 341                 cp.min_remote_timeout = __constant_cpu_to_le16(0);
 342                 cp.min_local_timeout  = __constant_cpu_to_le16(0);
 343                 hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
 344         }
 345
 346         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
 347                 struct hci_cp_sniff_mode cp;
 348                 cp.handle       = cpu_to_le16(conn->handle);
 349                 cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
 350                 cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
 351                 cp.attempt      = __constant_cpu_to_le16(4);
 352                 cp.timeout      = __constant_cpu_to_le16(1);
 353                 hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
 354         }
 355 }
 356
 357 static void hci_conn_auto_accept(struct work_struct *work)
 358 {
 359         struct hci_conn *conn = container_of(work, struct hci_conn,
 360                                              auto_accept_work.work);
 361
 362         hci_send_cmd(conn->hdev, HCI_OP_USER_CONFIRM_REPLY, sizeof(conn->dst),
 363                      &conn->dst);
 364 }
 365
 366 static void le_conn_timeout(struct work_struct *work)
 367 {
 368         struct hci_conn *conn = container_of(work, struct hci_conn,
 369                                              le_conn_timeout.work);
 370
 371         BT_DBG("");
 372
 373         hci_le_create_connection_cancel(conn);
 374 }
 375
 376 struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
 377 {
 378         struct hci_conn *conn;
 379
 380         BT_DBG("%s dst %pMR", hdev->name, dst);
 381
 382         conn = kzalloc(sizeof(struct hci_conn), GFP_KERNEL);
 383         if (!conn)
 384                 return NULL;
 385
 386         bacpy(&conn->dst, dst);
 387         bacpy(&conn->src, &hdev->bdaddr);
 388         conn->hdev  = hdev;
 389         conn->type  = type;
 390         conn->mode  = HCI_CM_ACTIVE;
 391         conn->state = BT_OPEN;
 392         conn->auth_type = HCI_AT_GENERAL_BONDING;
 393         conn->io_capability = hdev->io_capability;
 394         conn->remote_auth = 0xff;
 395         conn->key_type = 0xff;
 396
 397         set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
 398         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
 399
 400         switch (type) {
 401         case ACL_LINK:
 402                 conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
 403                 break;
 404         case SCO_LINK:
 405                 if (lmp_esco_capable(hdev))
 406                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
 407                                         (hdev->esco_type & EDR_ESCO_MASK);
 408                 else
 409                         conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
 410                 break;
 411         case ESCO_LINK:
 412                 conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
 413                 break;
 414         }
 415
 416         skb_queue_head_init(&conn->data_q);
 417
 418         INIT_LIST_HEAD(&conn->chan_list);
 419
 420         INIT_DELAYED_WORK(&conn->disc_work, hci_conn_timeout);
 421         INIT_DELAYED_WORK(&conn->auto_accept_work, hci_conn_auto_accept);
 422         INIT_DELAYED_WORK(&conn->idle_work, hci_conn_idle);
 423         INIT_DELAYED_WORK(&conn->le_conn_timeout, le_conn_timeout);
 424
 425         atomic_set(&conn->refcnt, 0);
 426
 427         hci_dev_hold(hdev);
 428
 429         hci_conn_hash_add(hdev, conn);
 430         if (hdev->notify)
 431                 hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
 432
 433         hci_conn_init_sysfs(conn);
 434
 435         return conn;
 436 }
 437
 438 int hci_conn_del(struct hci_conn *conn)
 439 {
 440         struct hci_dev *hdev = conn->hdev;
 441
 442         BT_DBG("%s hcon %p handle %d", hdev->name, conn, conn->handle);
 443
 444         cancel_delayed_work_sync(&conn->disc_work);
 445         cancel_delayed_work_sync(&conn->auto_accept_work);
 446         cancel_delayed_work_sync(&conn->idle_work);
 447
 448         if (conn->type == ACL_LINK) {
 449                 struct hci_conn *sco = conn->link;
 450                 if (sco)
 451                         sco->link = NULL;
 452
 453                 /* Unacked frames */
 454                 hdev->acl_cnt += conn->sent;
 455         } else if (conn->type == LE_LINK) {
 456                 cancel_delayed_work_sync(&conn->le_conn_timeout);
 457
 458                 if (hdev->le_pkts)
 459                         hdev->le_cnt += conn->sent;
 460                 else
 461                         hdev->acl_cnt += conn->sent;
 462         } else {
 463                 struct hci_conn *acl = conn->link;
 464                 if (acl) {
 465                         acl->link = NULL;
 466                         hci_conn_drop(acl);
 467                 }
 468         }
 469
 470         hci_chan_list_flush(conn);
 471
 472         if (conn->amp_mgr)
 473                 amp_mgr_put(conn->amp_mgr);
 474
 475         hci_conn_hash_del(hdev, conn);
 476         if (hdev->notify)
 477                 hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
 478
 479         skb_queue_purge(&conn->data_q);
 480
 481         hci_conn_del_sysfs(conn);
 482
 483         hci_dev_put(hdev);
 484
 485         hci_conn_put(conn);
 486
 487         return 0;
 488 }
 489
 490 struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src)
 491 {
 492         int use_src = bacmp(src, BDADDR_ANY);
 493         struct hci_dev *hdev = NULL, *d;
 494
 495         BT_DBG("%pMR -> %pMR", src, dst);
 496
 497         read_lock(&hci_dev_list_lock);
 498
 499         list_for_each_entry(d, &hci_dev_list, list) {
 500                 if (!test_bit(HCI_UP, &d->flags) ||
 501                     test_bit(HCI_RAW, &d->flags) ||
 502                     test_bit(HCI_USER_CHANNEL, &d->dev_flags) ||
 503                     d->dev_type != HCI_BREDR)
 504                         continue;
 505
 506                 /* Simple routing:
 507                  *   No source address - find interface with bdaddr != dst
 508                  *   Source address    - find interface with bdaddr == src
 509                  */
 510
 511                 if (use_src) {
 512                         if (!bacmp(&d->bdaddr, src)) {
 513                                 hdev = d; break;
 514                         }
 515                 } else {
 516                         if (bacmp(&d->bdaddr, dst)) {
 517                                 hdev = d; break;
 518                         }
 519                 }
 520         }
 521
 522         if (hdev)
 523                 hdev = hci_dev_hold(hdev);
 524
 525         read_unlock(&hci_dev_list_lock);
 526         return hdev;
 527 }
 528 EXPORT_SYMBOL(hci_get_route);
 529
 530 /* This function requires the caller holds hdev->lock */
 531 void hci_le_conn_failed(struct hci_conn *conn, u8 status)
 532 {
 533         struct hci_dev *hdev = conn->hdev;
 534
 535         conn->state = BT_CLOSED;
 536
 537         mgmt_connect_failed(hdev, &conn->dst, conn->type, conn->dst_type,
 538                             status);
 539
 540         hci_proto_connect_cfm(conn, status);
 541
 542         hci_conn_del(conn);
 543
 544         /* Since we may have temporarily stopped the background scanning in
 545          * favor of connection establishment, we should restart it.
 546          */
 547         hci_update_background_scan(hdev);
 548 }
 549
 550 static void create_le_conn_complete(struct hci_dev *hdev, u8 status)
 551 {
 552         struct hci_conn *conn;
 553
 554         if (status == 0)
 555                 return;
 556
 557         BT_ERR("HCI request failed to create LE connection: status 0x%2.2x",
 558                status);
 559
 560         hci_dev_lock(hdev);
 561
 562         conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
 563         if (!conn)
 564                 goto done;
 565
 566         hci_le_conn_failed(conn, status);
 567
 568 done:
 569         hci_dev_unlock(hdev);
 570 }
 571
 572 static void hci_req_add_le_create_conn(struct hci_request *req,
 573                                        struct hci_conn *conn)
 574 {
 575         struct hci_cp_le_create_conn cp;
 576         struct hci_dev *hdev = conn->hdev;
 577         u8 own_addr_type;
 578
 579         memset(&cp, 0, sizeof(cp));
 580
 581         /* Update random address, but set require_privacy to false so
 582          * that we never connect with an unresolvable address.
 583          */
 584         if (hci_update_random_address(req, false, &own_addr_type))
 585                 return;
 586
 587         /* Save the address type used for this connnection attempt so we able
 588          * to retrieve this information if we need it.
 589          */
 590         conn->src_type = own_addr_type;
 591
 592         cp.scan_interval = cpu_to_le16(hdev->le_scan_interval);
 593         cp.scan_window = cpu_to_le16(hdev->le_scan_window);
 594         bacpy(&cp.peer_addr, &conn->dst);
 595         cp.peer_addr_type = conn->dst_type;
 596         cp.own_address_type = own_addr_type;
 597         cp.conn_interval_min = cpu_to_le16(conn->le_conn_min_interval);
 598         cp.conn_interval_max = cpu_to_le16(conn->le_conn_max_interval);
 599         cp.supervision_timeout = __constant_cpu_to_le16(0x002a);
 600         cp.min_ce_len = __constant_cpu_to_le16(0x0000);
 601         cp.max_ce_len = __constant_cpu_to_le16(0x0000);
 602
 603         hci_req_add(req, HCI_OP_LE_CREATE_CONN, sizeof(cp), &cp);
 604
 605         conn->state = BT_CONNECT;
 606 }
 607
 608 static void stop_scan_complete(struct hci_dev *hdev, u8 status)
 609 {
 610         struct hci_request req;
 611         struct hci_conn *conn;
 612         int err;
 613
 614         conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
 615         if (!conn)
 616                 return;
 617
 618         if (status) {
 619                 BT_DBG("HCI request failed to stop scanning: status 0x%2.2x",
 620                        status);
 621
 622                 hci_dev_lock(hdev);
 623                 hci_le_conn_failed(conn, status);
 624                 hci_dev_unlock(hdev);
 625                 return;
 626         }
 627
 628         /* Since we may have prematurely stopped discovery procedure, we should
 629          * update discovery state.
 630          */
 631         cancel_delayed_work(&hdev->le_scan_disable);
 632         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
 633
 634         hci_req_init(&req, hdev);
 635
 636         hci_req_add_le_create_conn(&req, conn);
 637
 638         err = hci_req_run(&req, create_le_conn_complete);
 639         if (err) {
 640                 hci_dev_lock(hdev);
 641                 hci_le_conn_failed(conn, HCI_ERROR_MEMORY_EXCEEDED);
 642                 hci_dev_unlock(hdev);
 643                 return;
 644         }
 645 }
 646
 647 struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,
 648                                 u8 dst_type, u8 sec_level, u8 auth_type)
 649 {
 650         struct hci_conn_params *params;
 651         struct hci_conn *conn;
 652         struct smp_irk *irk;
 653         struct hci_request req;
 654         int err;
 655
 656         if (test_bit(HCI_ADVERTISING, &hdev->flags))
 657                 return ERR_PTR(-ENOTSUPP);
 658
 659         /* Some devices send ATT messages as soon as the physical link is
 660          * established. To be able to handle these ATT messages, the user-
 661          * space first establishes the connection and then starts the pairing
 662          * process.
 663          *
 664          * So if a hci_conn object already exists for the following connection
 665          * attempt, we simply update pending_sec_level and auth_type fields
 666          * and return the object found.
 667          */
 668         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, dst);
 669         if (conn) {
 670                 conn->pending_sec_level = sec_level;
 671                 conn->auth_type = auth_type;
 672                 goto done;
 673         }
 674
 675         /* Since the controller supports only one LE connection attempt at a
 676          * time, we return -EBUSY if there is any connection attempt running.
 677          */
 678         conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
 679         if (conn)
 680                 return ERR_PTR(-EBUSY);
 681
 682         /* When given an identity address with existing identity
 683          * resolving key, the connection needs to be established
 684          * to a resolvable random address.
 685          *
 686          * This uses the cached random resolvable address from
 687          * a previous scan. When no cached address is available,
 688          * try connecting to the identity address instead.
 689          *
 690          * Storing the resolvable random address is required here
 691          * to handle connection failures. The address will later
 692          * be resolved back into the original identity address
 693          * from the connect request.
 694          */
 695         irk = hci_find_irk_by_addr(hdev, dst, dst_type);
 696         if (irk && bacmp(&irk->rpa, BDADDR_ANY)) {
 697                 dst = &irk->rpa;
 698                 dst_type = ADDR_LE_DEV_RANDOM;
 699         }
 700
 701         conn = hci_conn_add(hdev, LE_LINK, dst);
 702         if (!conn)
 703                 return ERR_PTR(-ENOMEM);
 704
 705         conn->dst_type = dst_type;
 706
 707         conn->out = true;
 708         conn->link_mode |= HCI_LM_MASTER;
 709         conn->sec_level = BT_SECURITY_LOW;
 710         conn->pending_sec_level = sec_level;
 711         conn->auth_type = auth_type;
 712
 713         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
 714         if (params) {
 715                 conn->le_conn_min_interval = params->conn_min_interval;
 716                 conn->le_conn_max_interval = params->conn_max_interval;
 717         } else {
 718                 conn->le_conn_min_interval = hdev->le_conn_min_interval;
 719                 conn->le_conn_max_interval = hdev->le_conn_max_interval;
 720         }
 721
 722         hci_req_init(&req, hdev);
 723
 724         /* If controller is scanning, we stop it since some controllers are
 725          * not able to scan and connect at the same time.
 726          */
 727         if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
 728                 hci_req_add_le_scan_disable(&req);
 729                 err = hci_req_run(&req, stop_scan_complete);
 730         } else {
 731                 hci_req_add_le_create_conn(&req, conn);
 732                 err = hci_req_run(&req, create_le_conn_complete);
 733         }
 734
 735         if (err) {
 736                 hci_conn_del(conn);
 737                 return ERR_PTR(err);
 738         }
 739
 740 done:
 741         hci_conn_hold(conn);
 742         return conn;
 743 }
 744
 745 struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst,
 746                                  u8 sec_level, u8 auth_type)
 747 {
 748         struct hci_conn *acl;
 749
 750         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 751                 return ERR_PTR(-ENOTSUPP);
 752
 753         acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
 754         if (!acl) {
 755                 acl = hci_conn_add(hdev, ACL_LINK, dst);
 756                 if (!acl)
 757                         return ERR_PTR(-ENOMEM);
 758         }
 759
 760         hci_conn_hold(acl);
 761
 762         if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
 763                 acl->sec_level = BT_SECURITY_LOW;
 764                 acl->pending_sec_level = sec_level;
 765                 acl->auth_type = auth_type;
 766                 hci_acl_create_connection(acl);
 767         }
 768
 769         return acl;
 770 }
 771
 772 struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type, bdaddr_t *dst,
 773                                  __u16 setting)
 774 {
 775         struct hci_conn *acl;
 776         struct hci_conn *sco;
 777
 778         acl = hci_connect_acl(hdev, dst, BT_SECURITY_LOW, HCI_AT_NO_BONDING);
 779         if (IS_ERR(acl))
 780                 return acl;
 781
 782         sco = hci_conn_hash_lookup_ba(hdev, type, dst);
 783         if (!sco) {
 784                 sco = hci_conn_add(hdev, type, dst);
 785                 if (!sco) {
 786                         hci_conn_drop(acl);
 787                         return ERR_PTR(-ENOMEM);
 788                 }
 789         }
 790
 791         acl->link = sco;
 792         sco->link = acl;
 793
 794         hci_conn_hold(sco);
 795
 796         sco->setting = setting;
 797
 798         if (acl->state == BT_CONNECTED &&
 799             (sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
 800                 set_bit(HCI_CONN_POWER_SAVE, &acl->flags);
 801                 hci_conn_enter_active_mode(acl, BT_POWER_FORCE_ACTIVE_ON);
 802
 803                 if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->flags)) {
 804                         /* defer SCO setup until mode change completed */
 805                         set_bit(HCI_CONN_SCO_SETUP_PEND, &acl->flags);
 806                         return sco;
 807                 }
 808
 809                 hci_sco_setup(acl, 0x00);
 810         }
 811
 812         return sco;
 813 }
 814
 815 /* Check link security requirement */
 816 int hci_conn_check_link_mode(struct hci_conn *conn)
 817 {
 818         BT_DBG("hcon %p", conn);
 819
 820         if (hci_conn_ssp_enabled(conn) && !(conn->link_mode & HCI_LM_ENCRYPT))
 821                 return 0;
 822
 823         return 1;
 824 }
 825
 826 /* Authenticate remote device */
 827 static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 828 {
 829         BT_DBG("hcon %p", conn);
 830
 831         if (conn->pending_sec_level > sec_level)
 832                 sec_level = conn->pending_sec_level;
 833
 834         if (sec_level > conn->sec_level)
 835                 conn->pending_sec_level = sec_level;
 836         else if (conn->link_mode & HCI_LM_AUTH)
 837                 return 1;
 838
 839         /* Make sure we preserve an existing MITM requirement*/
 840         auth_type |= (conn->auth_type & 0x01);
 841
 842         conn->auth_type = auth_type;
 843
 844         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
 845                 struct hci_cp_auth_requested cp;
 846
 847                 /* encrypt must be pending if auth is also pending */
 848                 set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
 849
 850                 cp.handle = cpu_to_le16(conn->handle);
 851                 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
 852                              sizeof(cp), &cp);
 853                 if (conn->key_type != 0xff)
 854                         set_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
 855         }
 856
 857         return 0;
 858 }
 859
 860 /* Encrypt the the link */
 861 static void hci_conn_encrypt(struct hci_conn *conn)
 862 {
 863         BT_DBG("hcon %p", conn);
 864
 865         if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
 866                 struct hci_cp_set_conn_encrypt cp;
 867                 cp.handle  = cpu_to_le16(conn->handle);
 868                 cp.encrypt = 0x01;
 869                 hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
 870                              &cp);
 871         }
 872 }
 873
 874 /* Enable security */
 875 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 876 {
 877         BT_DBG("hcon %p", conn);
 878
 879         if (conn->type == LE_LINK)
 880                 return smp_conn_security(conn, sec_level);
 881
 882         /* For sdp we don't need the link key. */
 883         if (sec_level == BT_SECURITY_SDP)
 884                 return 1;
 885
 886         /* For non 2.1 devices and low security level we don't need the link
 887            key. */
 888         if (sec_level == BT_SECURITY_LOW && !hci_conn_ssp_enabled(conn))
 889                 return 1;
 890
 891         /* For other security levels we need the link key. */
 892         if (!(conn->link_mode & HCI_LM_AUTH))
 893                 goto auth;
 894
 895         /* An authenticated FIPS approved combination key has sufficient
 896          * security for security level 4. */
 897         if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256 &&
 898             sec_level == BT_SECURITY_FIPS)
 899                 goto encrypt;
 900
 901         /* An authenticated combination key has sufficient security for
 902            security level 3. */
 903         if ((conn->key_type == HCI_LK_AUTH_COMBINATION_P192 ||
 904              conn->key_type == HCI_LK_AUTH_COMBINATION_P256) &&
 905             sec_level == BT_SECURITY_HIGH)
 906                 goto encrypt;
 907
 908         /* An unauthenticated combination key has sufficient security for
 909            security level 1 and 2. */
 910         if ((conn->key_type == HCI_LK_UNAUTH_COMBINATION_P192 ||
 911              conn->key_type == HCI_LK_UNAUTH_COMBINATION_P256) &&
 912             (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW))
 913                 goto encrypt;
 914
 915         /* A combination key has always sufficient security for the security
 916            levels 1 or 2. High security level requires the combination key
 917            is generated using maximum PIN code length (16).
 918            For pre 2.1 units. */
 919         if (conn->key_type == HCI_LK_COMBINATION &&
 920             (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW ||
 921              conn->pin_length == 16))
 922                 goto encrypt;
 923
 924 auth:
 925         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags))
 926                 return 0;
 927
 928         if (!hci_conn_auth(conn, sec_level, auth_type))
 929                 return 0;
 930
 931 encrypt:
 932         if (conn->link_mode & HCI_LM_ENCRYPT)
 933                 return 1;
 934
 935         hci_conn_encrypt(conn);
 936         return 0;
 937 }
 938 EXPORT_SYMBOL(hci_conn_security);
 939
 940 /* Check secure link requirement */
 941 int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level)
 942 {
 943         BT_DBG("hcon %p", conn);
 944
 945         /* Accept if non-secure or higher security level is required */
 946         if (sec_level != BT_SECURITY_HIGH && sec_level != BT_SECURITY_FIPS)
 947                 return 1;
 948
 949         /* Accept if secure or higher security level is already present */
 950         if (conn->sec_level == BT_SECURITY_HIGH ||
 951             conn->sec_level == BT_SECURITY_FIPS)
 952                 return 1;
 953
 954         /* Reject not secure link */
 955         return 0;
 956 }
 957 EXPORT_SYMBOL(hci_conn_check_secure);
 958
 959 /* Change link key */
 960 int hci_conn_change_link_key(struct hci_conn *conn)
 961 {
 962         BT_DBG("hcon %p", conn);
 963
 964         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
 965                 struct hci_cp_change_conn_link_key cp;
 966                 cp.handle = cpu_to_le16(conn->handle);
 967                 hci_send_cmd(conn->hdev, HCI_OP_CHANGE_CONN_LINK_KEY,
 968                              sizeof(cp), &cp);
 969         }
 970
 971         return 0;
 972 }
 973
 974 /* Switch role */
 975 int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
 976 {
 977         BT_DBG("hcon %p", conn);
 978
 979         if (!role && conn->link_mode & HCI_LM_MASTER)
 980                 return 1;
 981
 982         if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->flags)) {
 983                 struct hci_cp_switch_role cp;
 984                 bacpy(&cp.bdaddr, &conn->dst);
 985                 cp.role = role;
 986                 hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
 987         }
 988
 989         return 0;
 990 }
 991 EXPORT_SYMBOL(hci_conn_switch_role);
 992
 993 /* Enter active mode */
 994 void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
 995 {
 996         struct hci_dev *hdev = conn->hdev;
 997
 998         BT_DBG("hcon %p mode %d", conn, conn->mode);
 999
1000         if (test_bit(HCI_RAW, &hdev->flags))
1001                 return;
1002
1003         if (conn->mode != HCI_CM_SNIFF)
1004                 goto timer;
1005
1006         if (!test_bit(HCI_CONN_POWER_SAVE, &conn->flags) && !force_active)
1007                 goto timer;
1008
1009         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
1010                 struct hci_cp_exit_sniff_mode cp;
1011                 cp.handle = cpu_to_le16(conn->handle);
1012                 hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
1013         }
1014
1015 timer:
1016         if (hdev->idle_timeout > 0)
1017                 queue_delayed_work(hdev->workqueue, &conn->idle_work,
1018                                    msecs_to_jiffies(hdev->idle_timeout));
1019 }
1020
1021 /* Drop all connection on the device */
1022 void hci_conn_hash_flush(struct hci_dev *hdev)
1023 {
1024         struct hci_conn_hash *h = &hdev->conn_hash;
1025         struct hci_conn *c, *n;
1026
1027         BT_DBG("hdev %s", hdev->name);
1028
1029         list_for_each_entry_safe(c, n, &h->list, list) {
1030                 c->state = BT_CLOSED;
1031
1032                 hci_proto_disconn_cfm(c, HCI_ERROR_LOCAL_HOST_TERM);
1033                 hci_conn_del(c);
1034         }
1035 }
1036
1037 /* Check pending connect attempts */
1038 void hci_conn_check_pending(struct hci_dev *hdev)
1039 {
1040         struct hci_conn *conn;
1041
1042         BT_DBG("hdev %s", hdev->name);
1043
1044         hci_dev_lock(hdev);
1045
1046         conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
1047         if (conn)
1048                 hci_acl_create_connection(conn);
1049
1050         hci_dev_unlock(hdev);
1051 }
1052
1053 int hci_get_conn_list(void __user *arg)
1054 {
1055         struct hci_conn *c;
1056         struct hci_conn_list_req req, *cl;
1057         struct hci_conn_info *ci;
1058         struct hci_dev *hdev;
1059         int n = 0, size, err;
1060
1061         if (copy_from_user(&req, arg, sizeof(req)))
1062                 return -EFAULT;
1063
1064         if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
1065                 return -EINVAL;
1066
1067         size = sizeof(req) + req.conn_num * sizeof(*ci);
1068
1069         cl = kmalloc(size, GFP_KERNEL);
1070         if (!cl)
1071                 return -ENOMEM;
1072
1073         hdev = hci_dev_get(req.dev_id);
1074         if (!hdev) {
1075                 kfree(cl);
1076                 return -ENODEV;
1077         }
1078
1079         ci = cl->conn_info;
1080
1081         hci_dev_lock(hdev);
1082         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1083                 bacpy(&(ci + n)->bdaddr, &c->dst);
1084                 (ci + n)->handle = c->handle;
1085                 (ci + n)->type  = c->type;
1086                 (ci + n)->out   = c->out;
1087                 (ci + n)->state = c->state;
1088                 (ci + n)->link_mode = c->link_mode;
1089                 if (++n >= req.conn_num)
1090                         break;
1091         }
1092         hci_dev_unlock(hdev);
1093
1094         cl->dev_id = hdev->id;
1095         cl->conn_num = n;
1096         size = sizeof(req) + n * sizeof(*ci);
1097
1098         hci_dev_put(hdev);
1099
1100         err = copy_to_user(arg, cl, size);
1101         kfree(cl);
1102
1103         return err ? -EFAULT : 0;
1104 }
1105
1106 int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
1107 {
1108         struct hci_conn_info_req req;
1109         struct hci_conn_info ci;
1110         struct hci_conn *conn;
1111         char __user *ptr = arg + sizeof(req);
1112
1113         if (copy_from_user(&req, arg, sizeof(req)))
1114                 return -EFAULT;
1115
1116         hci_dev_lock(hdev);
1117         conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
1118         if (conn) {
1119                 bacpy(&ci.bdaddr, &conn->dst);
1120                 ci.handle = conn->handle;
1121                 ci.type  = conn->type;
1122                 ci.out   = conn->out;
1123                 ci.state = conn->state;
1124                 ci.link_mode = conn->link_mode;
1125         }
1126         hci_dev_unlock(hdev);
1127
1128         if (!conn)
1129                 return -ENOENT;
1130
1131         return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
1132 }
1133
1134 int hci_get_auth_info(struct hci_dev *hdev, void __user *arg)
1135 {
1136         struct hci_auth_info_req req;
1137         struct hci_conn *conn;
1138
1139         if (copy_from_user(&req, arg, sizeof(req)))
1140                 return -EFAULT;
1141
1142         hci_dev_lock(hdev);
1143         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr);
1144         if (conn)
1145                 req.type = conn->auth_type;
1146         hci_dev_unlock(hdev);
1147
1148         if (!conn)
1149                 return -ENOENT;
1150
1151         return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0;
1152 }
1153
1154 struct hci_chan *hci_chan_create(struct hci_conn *conn)
1155 {
1156         struct hci_dev *hdev = conn->hdev;
1157         struct hci_chan *chan;
1158
1159         BT_DBG("%s hcon %p", hdev->name, conn);
1160
1161         chan = kzalloc(sizeof(struct hci_chan), GFP_KERNEL);
1162         if (!chan)
1163                 return NULL;
1164
1165         chan->conn = conn;
1166         skb_queue_head_init(&chan->data_q);
1167         chan->state = BT_CONNECTED;
1168
1169         list_add_rcu(&chan->list, &conn->chan_list);
1170
1171         return chan;
1172 }
1173
1174 void hci_chan_del(struct hci_chan *chan)
1175 {
1176         struct hci_conn *conn = chan->conn;
1177         struct hci_dev *hdev = conn->hdev;
1178
1179         BT_DBG("%s hcon %p chan %p", hdev->name, conn, chan);
1180
1181         list_del_rcu(&chan->list);
1182
1183         synchronize_rcu();
1184
1185         hci_conn_drop(conn);
1186
1187         skb_queue_purge(&chan->data_q);
1188         kfree(chan);
1189 }
1190
1191 void hci_chan_list_flush(struct hci_conn *conn)
1192 {
1193         struct hci_chan *chan, *n;
1194
1195         BT_DBG("hcon %p", conn);
1196
1197         list_for_each_entry_safe(chan, n, &conn->chan_list, list)
1198                 hci_chan_del(chan);
1199 }
1200
1201 static struct hci_chan *__hci_chan_lookup_handle(struct hci_conn *hcon,
1202                                                  __u16 handle)
1203 {
1204         struct hci_chan *hchan;
1205
1206         list_for_each_entry(hchan, &hcon->chan_list, list) {
1207                 if (hchan->handle == handle)
1208                         return hchan;
1209         }
1210
1211         return NULL;
1212 }
1213
1214 struct hci_chan *hci_chan_lookup_handle(struct hci_dev *hdev, __u16 handle)
1215 {
1216         struct hci_conn_hash *h = &hdev->conn_hash;
1217         struct hci_conn *hcon;
1218         struct hci_chan *hchan = NULL;
1219
1220         rcu_read_lock();
1221
1222         list_for_each_entry_rcu(hcon, &h->list, list) {
1223                 hchan = __hci_chan_lookup_handle(hcon, handle);
1224                 if (hchan)
1225                         break;
1226         }
1227
1228         rcu_read_unlock();
1229
1230         return hchan;
1231 }