net/bluetooth/hci_conn.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI connection handling. */
  26
  27 #include <linux/export.h>
  28
  29 #include <net/bluetooth/bluetooth.h>
  30 #include <net/bluetooth/hci_core.h>
  31
  32 #include "smp.h"
  33 #include "a2mp.h"
  34
  35 struct sco_param {
  36         u16 pkt_type;
  37         u16 max_latency;
  38 };
  39
  40 static const struct sco_param sco_param_cvsd[] = {
  41         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000a }, /* S3 */
  42         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x0007 }, /* S2 */
  43         { EDR_ESCO_MASK | ESCO_EV3,   0x0007 }, /* S1 */
  44         { EDR_ESCO_MASK | ESCO_HV3,   0xffff }, /* D1 */
  45         { EDR_ESCO_MASK | ESCO_HV1,   0xffff }, /* D0 */
  46 };
  47
  48 static const struct sco_param sco_param_wideband[] = {
  49         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000d }, /* T2 */
  50         { EDR_ESCO_MASK | ESCO_EV3,   0x0008 }, /* T1 */
  51 };
  52
  53 static void hci_le_create_connection_cancel(struct hci_conn *conn)
  54 {
  55         hci_send_cmd(conn->hdev, HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL);
  56 }
  57
  58 static void hci_acl_create_connection(struct hci_conn *conn)
  59 {
  60         struct hci_dev *hdev = conn->hdev;
  61         struct inquiry_entry *ie;
  62         struct hci_cp_create_conn cp;
  63
  64         BT_DBG("hcon %p", conn);
  65
  66         conn->state = BT_CONNECT;
  67         conn->out = true;
  68
  69         conn->link_mode = HCI_LM_MASTER;
  70
  71         conn->attempt++;
  72
  73         conn->link_policy = hdev->link_policy;
  74
  75         memset(&cp, 0, sizeof(cp));
  76         bacpy(&cp.bdaddr, &conn->dst);
  77         cp.pscan_rep_mode = 0x02;
  78
  79         ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
  80         if (ie) {
  81                 if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
  82                         cp.pscan_rep_mode = ie->data.pscan_rep_mode;
  83                         cp.pscan_mode     = ie->data.pscan_mode;
  84                         cp.clock_offset   = ie->data.clock_offset |
  85                                             __constant_cpu_to_le16(0x8000);
  86                 }
  87
  88                 memcpy(conn->dev_class, ie->data.dev_class, 3);
  89                 if (ie->data.ssp_mode > 0)
  90                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
  91         }
  92
  93         cp.pkt_type = cpu_to_le16(conn->pkt_type);
  94         if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
  95                 cp.role_switch = 0x01;
  96         else
  97                 cp.role_switch = 0x00;
  98
  99         hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
 100 }
 101
 102 static void hci_acl_create_connection_cancel(struct hci_conn *conn)
 103 {
 104         struct hci_cp_create_conn_cancel cp;
 105
 106         BT_DBG("hcon %p", conn);
 107
 108         if (conn->hdev->hci_ver < BLUETOOTH_VER_1_2)
 109                 return;
 110
 111         bacpy(&cp.bdaddr, &conn->dst);
 112         hci_send_cmd(conn->hdev, HCI_OP_CREATE_CONN_CANCEL, sizeof(cp), &cp);
 113 }
 114
 115 static void hci_reject_sco(struct hci_conn *conn)
 116 {
 117         struct hci_cp_reject_sync_conn_req cp;
 118
 119         cp.reason = HCI_ERROR_REMOTE_USER_TERM;
 120         bacpy(&cp.bdaddr, &conn->dst);
 121
 122         hci_send_cmd(conn->hdev, HCI_OP_REJECT_SYNC_CONN_REQ, sizeof(cp), &cp);
 123 }
 124
 125 void hci_disconnect(struct hci_conn *conn, __u8 reason)
 126 {
 127         struct hci_cp_disconnect cp;
 128
 129         BT_DBG("hcon %p", conn);
 130
 131         conn->state = BT_DISCONN;
 132
 133         cp.handle = cpu_to_le16(conn->handle);
 134         cp.reason = reason;
 135         hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp);
 136 }
 137
 138 static void hci_amp_disconn(struct hci_conn *conn, __u8 reason)
 139 {
 140         struct hci_cp_disconn_phy_link cp;
 141
 142         BT_DBG("hcon %p", conn);
 143
 144         conn->state = BT_DISCONN;
 145
 146         cp.phy_handle = HCI_PHY_HANDLE(conn->handle);
 147         cp.reason = reason;
 148         hci_send_cmd(conn->hdev, HCI_OP_DISCONN_PHY_LINK,
 149                      sizeof(cp), &cp);
 150 }
 151
 152 static void hci_add_sco(struct hci_conn *conn, __u16 handle)
 153 {
 154         struct hci_dev *hdev = conn->hdev;
 155         struct hci_cp_add_sco cp;
 156
 157         BT_DBG("hcon %p", conn);
 158
 159         conn->state = BT_CONNECT;
 160         conn->out = true;
 161
 162         conn->attempt++;
 163
 164         cp.handle   = cpu_to_le16(handle);
 165         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 166
 167         hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
 168 }
 169
 170 bool hci_setup_sync(struct hci_conn *conn, __u16 handle)
 171 {
 172         struct hci_dev *hdev = conn->hdev;
 173         struct hci_cp_setup_sync_conn cp;
 174         const struct sco_param *param;
 175
 176         BT_DBG("hcon %p", conn);
 177
 178         conn->state = BT_CONNECT;
 179         conn->out = true;
 180
 181         conn->attempt++;
 182
 183         cp.handle   = cpu_to_le16(handle);
 184
 185         cp.tx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
 186         cp.rx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
 187         cp.voice_setting  = cpu_to_le16(conn->setting);
 188
 189         switch (conn->setting & SCO_AIRMODE_MASK) {
 190         case SCO_AIRMODE_TRANSP:
 191                 if (conn->attempt > ARRAY_SIZE(sco_param_wideband))
 192                         return false;
 193                 cp.retrans_effort = 0x02;
 194                 param = &sco_param_wideband[conn->attempt - 1];
 195                 break;
 196         case SCO_AIRMODE_CVSD:
 197                 if (conn->attempt > ARRAY_SIZE(sco_param_cvsd))
 198                         return false;
 199                 cp.retrans_effort = 0x01;
 200                 param = &sco_param_cvsd[conn->attempt - 1];
 201                 break;
 202         default:
 203                 return false;
 204         }
 205
 206         cp.pkt_type = __cpu_to_le16(param->pkt_type);
 207         cp.max_latency = __cpu_to_le16(param->max_latency);
 208
 209         if (hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp) < 0)
 210                 return false;
 211
 212         return true;
 213 }
 214
 215 void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max,
 216                         u16 latency, u16 to_multiplier)
 217 {
 218         struct hci_cp_le_conn_update cp;
 219         struct hci_dev *hdev = conn->hdev;
 220
 221         memset(&cp, 0, sizeof(cp));
 222
 223         cp.handle               = cpu_to_le16(conn->handle);
 224         cp.conn_interval_min    = cpu_to_le16(min);
 225         cp.conn_interval_max    = cpu_to_le16(max);
 226         cp.conn_latency         = cpu_to_le16(latency);
 227         cp.supervision_timeout  = cpu_to_le16(to_multiplier);
 228         cp.min_ce_len           = __constant_cpu_to_le16(0x0000);
 229         cp.max_ce_len           = __constant_cpu_to_le16(0x0000);
 230
 231         hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp);
 232 }
 233
 234 void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __u8 rand[8],
 235                       __u8 ltk[16])
 236 {
 237         struct hci_dev *hdev = conn->hdev;
 238         struct hci_cp_le_start_enc cp;
 239
 240         BT_DBG("hcon %p", conn);
 241
 242         memset(&cp, 0, sizeof(cp));
 243
 244         cp.handle = cpu_to_le16(conn->handle);
 245         memcpy(cp.ltk, ltk, sizeof(cp.ltk));
 246         cp.ediv = ediv;
 247         memcpy(cp.rand, rand, sizeof(cp.rand));
 248
 249         hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp);
 250 }
 251
 252 /* Device _must_ be locked */
 253 void hci_sco_setup(struct hci_conn *conn, __u8 status)
 254 {
 255         struct hci_conn *sco = conn->link;
 256
 257         if (!sco)
 258                 return;
 259
 260         BT_DBG("hcon %p", conn);
 261
 262         if (!status) {
 263                 if (lmp_esco_capable(conn->hdev))
 264                         hci_setup_sync(sco, conn->handle);
 265                 else
 266                         hci_add_sco(sco, conn->handle);
 267         } else {
 268                 hci_proto_connect_cfm(sco, status);
 269                 hci_conn_del(sco);
 270         }
 271 }
 272
 273 static void hci_conn_disconnect(struct hci_conn *conn)
 274 {
 275         __u8 reason = hci_proto_disconn_ind(conn);
 276
 277         switch (conn->type) {
 278         case AMP_LINK:
 279                 hci_amp_disconn(conn, reason);
 280                 break;
 281         default:
 282                 hci_disconnect(conn, reason);
 283                 break;
 284         }
 285 }
 286
 287 static void hci_conn_timeout(struct work_struct *work)
 288 {
 289         struct hci_conn *conn = container_of(work, struct hci_conn,
 290                                              disc_work.work);
 291
 292         BT_DBG("hcon %p state %s", conn, state_to_string(conn->state));
 293
 294         if (atomic_read(&conn->refcnt))
 295                 return;
 296
 297         switch (conn->state) {
 298         case BT_CONNECT:
 299         case BT_CONNECT2:
 300                 if (conn->out) {
 301                         if (conn->type == ACL_LINK)
 302                                 hci_acl_create_connection_cancel(conn);
 303                         else if (conn->type == LE_LINK)
 304                                 hci_le_create_connection_cancel(conn);
 305                 } else if (conn->type == SCO_LINK || conn->type == ESCO_LINK) {
 306                         hci_reject_sco(conn);
 307                 }
 308                 break;
 309         case BT_CONFIG:
 310         case BT_CONNECTED:
 311                 hci_conn_disconnect(conn);
 312                 break;
 313         default:
 314                 conn->state = BT_CLOSED;
 315                 break;
 316         }
 317 }
 318
 319 /* Enter sniff mode */
 320 static void hci_conn_idle(struct work_struct *work)
 321 {
 322         struct hci_conn *conn = container_of(work, struct hci_conn,
 323                                              idle_work.work);
 324         struct hci_dev *hdev = conn->hdev;
 325
 326         BT_DBG("hcon %p mode %d", conn, conn->mode);
 327
 328         if (test_bit(HCI_RAW, &hdev->flags))
 329                 return;
 330
 331         if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn))
 332                 return;
 333
 334         if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF))
 335                 return;
 336
 337         if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
 338                 struct hci_cp_sniff_subrate cp;
 339                 cp.handle             = cpu_to_le16(conn->handle);
 340                 cp.max_latency        = __constant_cpu_to_le16(0);
 341                 cp.min_remote_timeout = __constant_cpu_to_le16(0);
 342                 cp.min_local_timeout  = __constant_cpu_to_le16(0);
 343                 hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
 344         }
 345
 346         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
 347                 struct hci_cp_sniff_mode cp;
 348                 cp.handle       = cpu_to_le16(conn->handle);
 349                 cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
 350                 cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
 351                 cp.attempt      = __constant_cpu_to_le16(4);
 352                 cp.timeout      = __constant_cpu_to_le16(1);
 353                 hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
 354         }
 355 }
 356
 357 static void hci_conn_auto_accept(struct work_struct *work)
 358 {
 359         struct hci_conn *conn = container_of(work, struct hci_conn,
 360                                              auto_accept_work.work);
 361
 362         hci_send_cmd(conn->hdev, HCI_OP_USER_CONFIRM_REPLY, sizeof(conn->dst),
 363                      &conn->dst);
 364 }
 365
 366 struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
 367 {
 368         struct hci_conn *conn;
 369
 370         BT_DBG("%s dst %pMR", hdev->name, dst);
 371
 372         conn = kzalloc(sizeof(struct hci_conn), GFP_KERNEL);
 373         if (!conn)
 374                 return NULL;
 375
 376         bacpy(&conn->dst, dst);
 377         bacpy(&conn->src, &hdev->bdaddr);
 378         conn->hdev  = hdev;
 379         conn->type  = type;
 380         conn->mode  = HCI_CM_ACTIVE;
 381         conn->state = BT_OPEN;
 382         conn->auth_type = HCI_AT_GENERAL_BONDING;
 383         conn->io_capability = hdev->io_capability;
 384         conn->remote_auth = 0xff;
 385         conn->key_type = 0xff;
 386
 387         set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
 388         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
 389
 390         switch (type) {
 391         case ACL_LINK:
 392                 conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
 393                 break;
 394         case SCO_LINK:
 395                 if (lmp_esco_capable(hdev))
 396                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
 397                                         (hdev->esco_type & EDR_ESCO_MASK);
 398                 else
 399                         conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
 400                 break;
 401         case ESCO_LINK:
 402                 conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
 403                 break;
 404         }
 405
 406         skb_queue_head_init(&conn->data_q);
 407
 408         INIT_LIST_HEAD(&conn->chan_list);
 409
 410         INIT_DELAYED_WORK(&conn->disc_work, hci_conn_timeout);
 411         INIT_DELAYED_WORK(&conn->auto_accept_work, hci_conn_auto_accept);
 412         INIT_DELAYED_WORK(&conn->idle_work, hci_conn_idle);
 413
 414         atomic_set(&conn->refcnt, 0);
 415
 416         hci_dev_hold(hdev);
 417
 418         hci_conn_hash_add(hdev, conn);
 419         if (hdev->notify)
 420                 hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
 421
 422         hci_conn_init_sysfs(conn);
 423
 424         return conn;
 425 }
 426
 427 int hci_conn_del(struct hci_conn *conn)
 428 {
 429         struct hci_dev *hdev = conn->hdev;
 430
 431         BT_DBG("%s hcon %p handle %d", hdev->name, conn, conn->handle);
 432
 433         cancel_delayed_work_sync(&conn->disc_work);
 434         cancel_delayed_work_sync(&conn->auto_accept_work);
 435         cancel_delayed_work_sync(&conn->idle_work);
 436
 437         if (conn->type == ACL_LINK) {
 438                 struct hci_conn *sco = conn->link;
 439                 if (sco)
 440                         sco->link = NULL;
 441
 442                 /* Unacked frames */
 443                 hdev->acl_cnt += conn->sent;
 444         } else if (conn->type == LE_LINK) {
 445                 if (hdev->le_pkts)
 446                         hdev->le_cnt += conn->sent;
 447                 else
 448                         hdev->acl_cnt += conn->sent;
 449         } else {
 450                 struct hci_conn *acl = conn->link;
 451                 if (acl) {
 452                         acl->link = NULL;
 453                         hci_conn_drop(acl);
 454                 }
 455         }
 456
 457         hci_chan_list_flush(conn);
 458
 459         if (conn->amp_mgr)
 460                 amp_mgr_put(conn->amp_mgr);
 461
 462         hci_conn_hash_del(hdev, conn);
 463         if (hdev->notify)
 464                 hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
 465
 466         skb_queue_purge(&conn->data_q);
 467
 468         hci_conn_del_sysfs(conn);
 469
 470         hci_dev_put(hdev);
 471
 472         hci_conn_put(conn);
 473
 474         return 0;
 475 }
 476
 477 struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src)
 478 {
 479         int use_src = bacmp(src, BDADDR_ANY);
 480         struct hci_dev *hdev = NULL, *d;
 481
 482         BT_DBG("%pMR -> %pMR", src, dst);
 483
 484         read_lock(&hci_dev_list_lock);
 485
 486         list_for_each_entry(d, &hci_dev_list, list) {
 487                 if (!test_bit(HCI_UP, &d->flags) ||
 488                     test_bit(HCI_RAW, &d->flags) ||
 489                     test_bit(HCI_USER_CHANNEL, &d->dev_flags) ||
 490                     d->dev_type != HCI_BREDR)
 491                         continue;
 492
 493                 /* Simple routing:
 494                  *   No source address - find interface with bdaddr != dst
 495                  *   Source address    - find interface with bdaddr == src
 496                  */
 497
 498                 if (use_src) {
 499                         if (!bacmp(&d->bdaddr, src)) {
 500                                 hdev = d; break;
 501                         }
 502                 } else {
 503                         if (bacmp(&d->bdaddr, dst)) {
 504                                 hdev = d; break;
 505                         }
 506                 }
 507         }
 508
 509         if (hdev)
 510                 hdev = hci_dev_hold(hdev);
 511
 512         read_unlock(&hci_dev_list_lock);
 513         return hdev;
 514 }
 515 EXPORT_SYMBOL(hci_get_route);
 516
 517 /* This function requires the caller holds hdev->lock */
 518 void hci_le_conn_failed(struct hci_conn *conn, u8 status)
 519 {
 520         struct hci_dev *hdev = conn->hdev;
 521
 522         conn->state = BT_CLOSED;
 523
 524         mgmt_connect_failed(hdev, &conn->dst, conn->type, conn->dst_type,
 525                             status);
 526
 527         hci_proto_connect_cfm(conn, status);
 528
 529         hci_conn_del(conn);
 530
 531         /* Since we may have temporarily stopped the background scanning in
 532          * favor of connection establishment, we should restart it.
 533          */
 534         hci_update_background_scan(hdev);
 535 }
 536
 537 static void create_le_conn_complete(struct hci_dev *hdev, u8 status)
 538 {
 539         struct hci_conn *conn;
 540
 541         if (status == 0)
 542                 return;
 543
 544         BT_ERR("HCI request failed to create LE connection: status 0x%2.2x",
 545                status);
 546
 547         hci_dev_lock(hdev);
 548
 549         conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
 550         if (!conn)
 551                 goto done;
 552
 553         hci_le_conn_failed(conn, status);
 554
 555 done:
 556         hci_dev_unlock(hdev);
 557 }
 558
 559 static void hci_req_add_le_create_conn(struct hci_request *req,
 560                                        struct hci_conn *conn)
 561 {
 562         struct hci_cp_le_create_conn cp;
 563         struct hci_dev *hdev = conn->hdev;
 564         u8 own_addr_type;
 565
 566         memset(&cp, 0, sizeof(cp));
 567
 568         /* Update random address, but set require_privacy to false so
 569          * that we never connect with an unresolvable address.
 570          */
 571         if (hci_update_random_address(req, false, &own_addr_type))
 572                 return;
 573
 574         /* Save the address type used for this connnection attempt so we able
 575          * to retrieve this information if we need it.
 576          */
 577         conn->src_type = own_addr_type;
 578
 579         cp.scan_interval = cpu_to_le16(hdev->le_scan_interval);
 580         cp.scan_window = cpu_to_le16(hdev->le_scan_window);
 581         bacpy(&cp.peer_addr, &conn->dst);
 582         cp.peer_addr_type = conn->dst_type;
 583         cp.own_address_type = own_addr_type;
 584         cp.conn_interval_min = cpu_to_le16(conn->le_conn_min_interval);
 585         cp.conn_interval_max = cpu_to_le16(conn->le_conn_max_interval);
 586         cp.supervision_timeout = __constant_cpu_to_le16(0x002a);
 587         cp.min_ce_len = __constant_cpu_to_le16(0x0000);
 588         cp.max_ce_len = __constant_cpu_to_le16(0x0000);
 589
 590         hci_req_add(req, HCI_OP_LE_CREATE_CONN, sizeof(cp), &cp);
 591 }
 592
 593 static void stop_scan_complete(struct hci_dev *hdev, u8 status)
 594 {
 595         struct hci_request req;
 596         struct hci_conn *conn;
 597         int err;
 598
 599         conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
 600         if (!conn)
 601                 return;
 602
 603         if (status) {
 604                 BT_DBG("HCI request failed to stop scanning: status 0x%2.2x",
 605                        status);
 606
 607                 hci_dev_lock(hdev);
 608                 hci_le_conn_failed(conn, status);
 609                 hci_dev_unlock(hdev);
 610                 return;
 611         }
 612
 613         /* Since we may have prematurely stopped discovery procedure, we should
 614          * update discovery state.
 615          */
 616         cancel_delayed_work(&hdev->le_scan_disable);
 617         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
 618
 619         hci_req_init(&req, hdev);
 620
 621         hci_req_add_le_create_conn(&req, conn);
 622
 623         err = hci_req_run(&req, create_le_conn_complete);
 624         if (err) {
 625                 hci_dev_lock(hdev);
 626                 hci_le_conn_failed(conn, HCI_ERROR_MEMORY_EXCEEDED);
 627                 hci_dev_unlock(hdev);
 628                 return;
 629         }
 630 }
 631
 632 struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,
 633                                 u8 dst_type, u8 sec_level, u8 auth_type)
 634 {
 635         struct hci_conn_params *params;
 636         struct hci_conn *conn;
 637         struct smp_irk *irk;
 638         struct hci_request req;
 639         int err;
 640
 641         if (test_bit(HCI_ADVERTISING, &hdev->flags))
 642                 return ERR_PTR(-ENOTSUPP);
 643
 644         /* Some devices send ATT messages as soon as the physical link is
 645          * established. To be able to handle these ATT messages, the user-
 646          * space first establishes the connection and then starts the pairing
 647          * process.
 648          *
 649          * So if a hci_conn object already exists for the following connection
 650          * attempt, we simply update pending_sec_level and auth_type fields
 651          * and return the object found.
 652          */
 653         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, dst);
 654         if (conn) {
 655                 conn->pending_sec_level = sec_level;
 656                 conn->auth_type = auth_type;
 657                 goto done;
 658         }
 659
 660         /* Since the controller supports only one LE connection attempt at a
 661          * time, we return -EBUSY if there is any connection attempt running.
 662          */
 663         conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
 664         if (conn)
 665                 return ERR_PTR(-EBUSY);
 666
 667         /* When given an identity address with existing identity
 668          * resolving key, the connection needs to be established
 669          * to a resolvable random address.
 670          *
 671          * This uses the cached random resolvable address from
 672          * a previous scan. When no cached address is available,
 673          * try connecting to the identity address instead.
 674          *
 675          * Storing the resolvable random address is required here
 676          * to handle connection failures. The address will later
 677          * be resolved back into the original identity address
 678          * from the connect request.
 679          */
 680         irk = hci_find_irk_by_addr(hdev, dst, dst_type);
 681         if (irk && bacmp(&irk->rpa, BDADDR_ANY)) {
 682                 dst = &irk->rpa;
 683                 dst_type = ADDR_LE_DEV_RANDOM;
 684         }
 685
 686         conn = hci_conn_add(hdev, LE_LINK, dst);
 687         if (!conn)
 688                 return ERR_PTR(-ENOMEM);
 689
 690         conn->dst_type = dst_type;
 691
 692         conn->state = BT_CONNECT;
 693         conn->out = true;
 694         conn->link_mode |= HCI_LM_MASTER;
 695         conn->sec_level = BT_SECURITY_LOW;
 696         conn->pending_sec_level = sec_level;
 697         conn->auth_type = auth_type;
 698
 699         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
 700         if (params) {
 701                 conn->le_conn_min_interval = params->conn_min_interval;
 702                 conn->le_conn_max_interval = params->conn_max_interval;
 703         } else {
 704                 conn->le_conn_min_interval = hdev->le_conn_min_interval;
 705                 conn->le_conn_max_interval = hdev->le_conn_max_interval;
 706         }
 707
 708         hci_req_init(&req, hdev);
 709
 710         /* If controller is scanning, we stop it since some controllers are
 711          * not able to scan and connect at the same time.
 712          */
 713         if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
 714                 hci_req_add_le_scan_disable(&req);
 715                 err = hci_req_run(&req, stop_scan_complete);
 716         } else {
 717                 hci_req_add_le_create_conn(&req, conn);
 718                 err = hci_req_run(&req, create_le_conn_complete);
 719         }
 720
 721         if (err) {
 722                 hci_conn_del(conn);
 723                 return ERR_PTR(err);
 724         }
 725
 726 done:
 727         hci_conn_hold(conn);
 728         return conn;
 729 }
 730
 731 struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst,
 732                                  u8 sec_level, u8 auth_type)
 733 {
 734         struct hci_conn *acl;
 735
 736         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 737                 return ERR_PTR(-ENOTSUPP);
 738
 739         acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
 740         if (!acl) {
 741                 acl = hci_conn_add(hdev, ACL_LINK, dst);
 742                 if (!acl)
 743                         return ERR_PTR(-ENOMEM);
 744         }
 745
 746         hci_conn_hold(acl);
 747
 748         if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
 749                 acl->sec_level = BT_SECURITY_LOW;
 750                 acl->pending_sec_level = sec_level;
 751                 acl->auth_type = auth_type;
 752                 hci_acl_create_connection(acl);
 753         }
 754
 755         return acl;
 756 }
 757
 758 struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type, bdaddr_t *dst,
 759                                  __u16 setting)
 760 {
 761         struct hci_conn *acl;
 762         struct hci_conn *sco;
 763
 764         acl = hci_connect_acl(hdev, dst, BT_SECURITY_LOW, HCI_AT_NO_BONDING);
 765         if (IS_ERR(acl))
 766                 return acl;
 767
 768         sco = hci_conn_hash_lookup_ba(hdev, type, dst);
 769         if (!sco) {
 770                 sco = hci_conn_add(hdev, type, dst);
 771                 if (!sco) {
 772                         hci_conn_drop(acl);
 773                         return ERR_PTR(-ENOMEM);
 774                 }
 775         }
 776
 777         acl->link = sco;
 778         sco->link = acl;
 779
 780         hci_conn_hold(sco);
 781
 782         sco->setting = setting;
 783
 784         if (acl->state == BT_CONNECTED &&
 785             (sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
 786                 set_bit(HCI_CONN_POWER_SAVE, &acl->flags);
 787                 hci_conn_enter_active_mode(acl, BT_POWER_FORCE_ACTIVE_ON);
 788
 789                 if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->flags)) {
 790                         /* defer SCO setup until mode change completed */
 791                         set_bit(HCI_CONN_SCO_SETUP_PEND, &acl->flags);
 792                         return sco;
 793                 }
 794
 795                 hci_sco_setup(acl, 0x00);
 796         }
 797
 798         return sco;
 799 }
 800
 801 /* Check link security requirement */
 802 int hci_conn_check_link_mode(struct hci_conn *conn)
 803 {
 804         BT_DBG("hcon %p", conn);
 805
 806         if (hci_conn_ssp_enabled(conn) && !(conn->link_mode & HCI_LM_ENCRYPT))
 807                 return 0;
 808
 809         return 1;
 810 }
 811
 812 /* Authenticate remote device */
 813 static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 814 {
 815         BT_DBG("hcon %p", conn);
 816
 817         if (conn->pending_sec_level > sec_level)
 818                 sec_level = conn->pending_sec_level;
 819
 820         if (sec_level > conn->sec_level)
 821                 conn->pending_sec_level = sec_level;
 822         else if (conn->link_mode & HCI_LM_AUTH)
 823                 return 1;
 824
 825         /* Make sure we preserve an existing MITM requirement*/
 826         auth_type |= (conn->auth_type & 0x01);
 827
 828         conn->auth_type = auth_type;
 829
 830         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
 831                 struct hci_cp_auth_requested cp;
 832
 833                 /* encrypt must be pending if auth is also pending */
 834                 set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
 835
 836                 cp.handle = cpu_to_le16(conn->handle);
 837                 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
 838                              sizeof(cp), &cp);
 839                 if (conn->key_type != 0xff)
 840                         set_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
 841         }
 842
 843         return 0;
 844 }
 845
 846 /* Encrypt the the link */
 847 static void hci_conn_encrypt(struct hci_conn *conn)
 848 {
 849         BT_DBG("hcon %p", conn);
 850
 851         if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
 852                 struct hci_cp_set_conn_encrypt cp;
 853                 cp.handle  = cpu_to_le16(conn->handle);
 854                 cp.encrypt = 0x01;
 855                 hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
 856                              &cp);
 857         }
 858 }
 859
 860 /* Enable security */
 861 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 862 {
 863         BT_DBG("hcon %p", conn);
 864
 865         if (conn->type == LE_LINK)
 866                 return smp_conn_security(conn, sec_level);
 867
 868         /* For sdp we don't need the link key. */
 869         if (sec_level == BT_SECURITY_SDP)
 870                 return 1;
 871
 872         /* For non 2.1 devices and low security level we don't need the link
 873            key. */
 874         if (sec_level == BT_SECURITY_LOW && !hci_conn_ssp_enabled(conn))
 875                 return 1;
 876
 877         /* For other security levels we need the link key. */
 878         if (!(conn->link_mode & HCI_LM_AUTH))
 879                 goto auth;
 880
 881         /* An authenticated FIPS approved combination key has sufficient
 882          * security for security level 4. */
 883         if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256 &&
 884             sec_level == BT_SECURITY_FIPS)
 885                 goto encrypt;
 886
 887         /* An authenticated combination key has sufficient security for
 888            security level 3. */
 889         if ((conn->key_type == HCI_LK_AUTH_COMBINATION_P192 ||
 890              conn->key_type == HCI_LK_AUTH_COMBINATION_P256) &&
 891             sec_level == BT_SECURITY_HIGH)
 892                 goto encrypt;
 893
 894         /* An unauthenticated combination key has sufficient security for
 895            security level 1 and 2. */
 896         if ((conn->key_type == HCI_LK_UNAUTH_COMBINATION_P192 ||
 897              conn->key_type == HCI_LK_UNAUTH_COMBINATION_P256) &&
 898             (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW))
 899                 goto encrypt;
 900
 901         /* A combination key has always sufficient security for the security
 902            levels 1 or 2. High security level requires the combination key
 903            is generated using maximum PIN code length (16).
 904            For pre 2.1 units. */
 905         if (conn->key_type == HCI_LK_COMBINATION &&
 906             (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW ||
 907              conn->pin_length == 16))
 908                 goto encrypt;
 909
 910 auth:
 911         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags))
 912                 return 0;
 913
 914         if (!hci_conn_auth(conn, sec_level, auth_type))
 915                 return 0;
 916
 917 encrypt:
 918         if (conn->link_mode & HCI_LM_ENCRYPT)
 919                 return 1;
 920
 921         hci_conn_encrypt(conn);
 922         return 0;
 923 }
 924 EXPORT_SYMBOL(hci_conn_security);
 925
 926 /* Check secure link requirement */
 927 int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level)
 928 {
 929         BT_DBG("hcon %p", conn);
 930
 931         /* Accept if non-secure or higher security level is required */
 932         if (sec_level != BT_SECURITY_HIGH && sec_level != BT_SECURITY_FIPS)
 933                 return 1;
 934
 935         /* Accept if secure or higher security level is already present */
 936         if (conn->sec_level == BT_SECURITY_HIGH ||
 937             conn->sec_level == BT_SECURITY_FIPS)
 938                 return 1;
 939
 940         /* Reject not secure link */
 941         return 0;
 942 }
 943 EXPORT_SYMBOL(hci_conn_check_secure);
 944
 945 /* Change link key */
 946 int hci_conn_change_link_key(struct hci_conn *conn)
 947 {
 948         BT_DBG("hcon %p", conn);
 949
 950         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
 951                 struct hci_cp_change_conn_link_key cp;
 952                 cp.handle = cpu_to_le16(conn->handle);
 953                 hci_send_cmd(conn->hdev, HCI_OP_CHANGE_CONN_LINK_KEY,
 954                              sizeof(cp), &cp);
 955         }
 956
 957         return 0;
 958 }
 959
 960 /* Switch role */
 961 int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
 962 {
 963         BT_DBG("hcon %p", conn);
 964
 965         if (!role && conn->link_mode & HCI_LM_MASTER)
 966                 return 1;
 967
 968         if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->flags)) {
 969                 struct hci_cp_switch_role cp;
 970                 bacpy(&cp.bdaddr, &conn->dst);
 971                 cp.role = role;
 972                 hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
 973         }
 974
 975         return 0;
 976 }
 977 EXPORT_SYMBOL(hci_conn_switch_role);
 978
 979 /* Enter active mode */
 980 void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
 981 {
 982         struct hci_dev *hdev = conn->hdev;
 983
 984         BT_DBG("hcon %p mode %d", conn, conn->mode);
 985
 986         if (test_bit(HCI_RAW, &hdev->flags))
 987                 return;
 988
 989         if (conn->mode != HCI_CM_SNIFF)
 990                 goto timer;
 991
 992         if (!test_bit(HCI_CONN_POWER_SAVE, &conn->flags) && !force_active)
 993                 goto timer;
 994
 995         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
 996                 struct hci_cp_exit_sniff_mode cp;
 997                 cp.handle = cpu_to_le16(conn->handle);
 998                 hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
 999         }
1000
1001 timer:
1002         if (hdev->idle_timeout > 0)
1003                 queue_delayed_work(hdev->workqueue, &conn->idle_work,
1004                                    msecs_to_jiffies(hdev->idle_timeout));
1005 }
1006
1007 /* Drop all connection on the device */
1008 void hci_conn_hash_flush(struct hci_dev *hdev)
1009 {
1010         struct hci_conn_hash *h = &hdev->conn_hash;
1011         struct hci_conn *c, *n;
1012
1013         BT_DBG("hdev %s", hdev->name);
1014
1015         list_for_each_entry_safe(c, n, &h->list, list) {
1016                 c->state = BT_CLOSED;
1017
1018                 hci_proto_disconn_cfm(c, HCI_ERROR_LOCAL_HOST_TERM);
1019                 hci_conn_del(c);
1020         }
1021 }
1022
1023 /* Check pending connect attempts */
1024 void hci_conn_check_pending(struct hci_dev *hdev)
1025 {
1026         struct hci_conn *conn;
1027
1028         BT_DBG("hdev %s", hdev->name);
1029
1030         hci_dev_lock(hdev);
1031
1032         conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
1033         if (conn)
1034                 hci_acl_create_connection(conn);
1035
1036         hci_dev_unlock(hdev);
1037 }
1038
1039 int hci_get_conn_list(void __user *arg)
1040 {
1041         struct hci_conn *c;
1042         struct hci_conn_list_req req, *cl;
1043         struct hci_conn_info *ci;
1044         struct hci_dev *hdev;
1045         int n = 0, size, err;
1046
1047         if (copy_from_user(&req, arg, sizeof(req)))
1048                 return -EFAULT;
1049
1050         if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
1051                 return -EINVAL;
1052
1053         size = sizeof(req) + req.conn_num * sizeof(*ci);
1054
1055         cl = kmalloc(size, GFP_KERNEL);
1056         if (!cl)
1057                 return -ENOMEM;
1058
1059         hdev = hci_dev_get(req.dev_id);
1060         if (!hdev) {
1061                 kfree(cl);
1062                 return -ENODEV;
1063         }
1064
1065         ci = cl->conn_info;
1066
1067         hci_dev_lock(hdev);
1068         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1069                 bacpy(&(ci + n)->bdaddr, &c->dst);
1070                 (ci + n)->handle = c->handle;
1071                 (ci + n)->type  = c->type;
1072                 (ci + n)->out   = c->out;
1073                 (ci + n)->state = c->state;
1074                 (ci + n)->link_mode = c->link_mode;
1075                 if (++n >= req.conn_num)
1076                         break;
1077         }
1078         hci_dev_unlock(hdev);
1079
1080         cl->dev_id = hdev->id;
1081         cl->conn_num = n;
1082         size = sizeof(req) + n * sizeof(*ci);
1083
1084         hci_dev_put(hdev);
1085
1086         err = copy_to_user(arg, cl, size);
1087         kfree(cl);
1088
1089         return err ? -EFAULT : 0;
1090 }
1091
1092 int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
1093 {
1094         struct hci_conn_info_req req;
1095         struct hci_conn_info ci;
1096         struct hci_conn *conn;
1097         char __user *ptr = arg + sizeof(req);
1098
1099         if (copy_from_user(&req, arg, sizeof(req)))
1100                 return -EFAULT;
1101
1102         hci_dev_lock(hdev);
1103         conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
1104         if (conn) {
1105                 bacpy(&ci.bdaddr, &conn->dst);
1106                 ci.handle = conn->handle;
1107                 ci.type  = conn->type;
1108                 ci.out   = conn->out;
1109                 ci.state = conn->state;
1110                 ci.link_mode = conn->link_mode;
1111         }
1112         hci_dev_unlock(hdev);
1113
1114         if (!conn)
1115                 return -ENOENT;
1116
1117         return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
1118 }
1119
1120 int hci_get_auth_info(struct hci_dev *hdev, void __user *arg)
1121 {
1122         struct hci_auth_info_req req;
1123         struct hci_conn *conn;
1124
1125         if (copy_from_user(&req, arg, sizeof(req)))
1126                 return -EFAULT;
1127
1128         hci_dev_lock(hdev);
1129         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr);
1130         if (conn)
1131                 req.type = conn->auth_type;
1132         hci_dev_unlock(hdev);
1133
1134         if (!conn)
1135                 return -ENOENT;
1136
1137         return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0;
1138 }
1139
1140 struct hci_chan *hci_chan_create(struct hci_conn *conn)
1141 {
1142         struct hci_dev *hdev = conn->hdev;
1143         struct hci_chan *chan;
1144
1145         BT_DBG("%s hcon %p", hdev->name, conn);
1146
1147         chan = kzalloc(sizeof(struct hci_chan), GFP_KERNEL);
1148         if (!chan)
1149                 return NULL;
1150
1151         chan->conn = conn;
1152         skb_queue_head_init(&chan->data_q);
1153         chan->state = BT_CONNECTED;
1154
1155         list_add_rcu(&chan->list, &conn->chan_list);
1156
1157         return chan;
1158 }
1159
1160 void hci_chan_del(struct hci_chan *chan)
1161 {
1162         struct hci_conn *conn = chan->conn;
1163         struct hci_dev *hdev = conn->hdev;
1164
1165         BT_DBG("%s hcon %p chan %p", hdev->name, conn, chan);
1166
1167         list_del_rcu(&chan->list);
1168
1169         synchronize_rcu();
1170
1171         hci_conn_drop(conn);
1172
1173         skb_queue_purge(&chan->data_q);
1174         kfree(chan);
1175 }
1176
1177 void hci_chan_list_flush(struct hci_conn *conn)
1178 {
1179         struct hci_chan *chan, *n;
1180
1181         BT_DBG("hcon %p", conn);
1182
1183         list_for_each_entry_safe(chan, n, &conn->chan_list, list)
1184                 hci_chan_del(chan);
1185 }
1186
1187 static struct hci_chan *__hci_chan_lookup_handle(struct hci_conn *hcon,
1188                                                  __u16 handle)
1189 {
1190         struct hci_chan *hchan;
1191
1192         list_for_each_entry(hchan, &hcon->chan_list, list) {
1193                 if (hchan->handle == handle)
1194                         return hchan;
1195         }
1196
1197         return NULL;
1198 }
1199
1200 struct hci_chan *hci_chan_lookup_handle(struct hci_dev *hdev, __u16 handle)
1201 {
1202         struct hci_conn_hash *h = &hdev->conn_hash;
1203         struct hci_conn *hcon;
1204         struct hci_chan *hchan = NULL;
1205
1206         rcu_read_lock();
1207
1208         list_for_each_entry_rcu(hcon, &h->list, list) {
1209                 hchan = __hci_chan_lookup_handle(hcon, handle);
1210                 if (hchan)
1211                         break;
1212         }
1213
1214         rcu_read_unlock();
1215
1216         return hchan;
1217 }