net/bluetooth/hci_conn.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI connection handling. */
  26
  27 #include <linux/export.h>
  28
  29 #include <net/bluetooth/bluetooth.h>
  30 #include <net/bluetooth/hci_core.h>
  31
  32 #include "smp.h"
  33 #include "a2mp.h"
  34
  35 struct sco_param {
  36         u16 pkt_type;
  37         u16 max_latency;
  38 };
  39
  40 static const struct sco_param sco_param_cvsd[] = {
  41         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000a }, /* S3 */
  42         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x0007 }, /* S2 */
  43         { EDR_ESCO_MASK | ESCO_EV3,   0x0007 }, /* S1 */
  44         { EDR_ESCO_MASK | ESCO_HV3,   0xffff }, /* D1 */
  45         { EDR_ESCO_MASK | ESCO_HV1,   0xffff }, /* D0 */
  46 };
  47
  48 static const struct sco_param sco_param_wideband[] = {
  49         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000d }, /* T2 */
  50         { EDR_ESCO_MASK | ESCO_EV3,   0x0008 }, /* T1 */
  51 };
  52
  53 static void hci_le_create_connection_cancel(struct hci_conn *conn)
  54 {
  55         hci_send_cmd(conn->hdev, HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL);
  56 }
  57
  58 static void hci_acl_create_connection(struct hci_conn *conn)
  59 {
  60         struct hci_dev *hdev = conn->hdev;
  61         struct inquiry_entry *ie;
  62         struct hci_cp_create_conn cp;
  63
  64         BT_DBG("hcon %p", conn);
  65
  66         conn->state = BT_CONNECT;
  67         conn->out = true;
  68
  69         conn->link_mode = HCI_LM_MASTER;
  70
  71         conn->attempt++;
  72
  73         conn->link_policy = hdev->link_policy;
  74
  75         memset(&cp, 0, sizeof(cp));
  76         bacpy(&cp.bdaddr, &conn->dst);
  77         cp.pscan_rep_mode = 0x02;
  78
  79         ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
  80         if (ie) {
  81                 if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
  82                         cp.pscan_rep_mode = ie->data.pscan_rep_mode;
  83                         cp.pscan_mode     = ie->data.pscan_mode;
  84                         cp.clock_offset   = ie->data.clock_offset |
  85                                             __constant_cpu_to_le16(0x8000);
  86                 }
  87
  88                 memcpy(conn->dev_class, ie->data.dev_class, 3);
  89                 if (ie->data.ssp_mode > 0)
  90                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
  91         }
  92
  93         cp.pkt_type = cpu_to_le16(conn->pkt_type);
  94         if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
  95                 cp.role_switch = 0x01;
  96         else
  97                 cp.role_switch = 0x00;
  98
  99         hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
 100 }
 101
 102 static void hci_acl_create_connection_cancel(struct hci_conn *conn)
 103 {
 104         struct hci_cp_create_conn_cancel cp;
 105
 106         BT_DBG("hcon %p", conn);
 107
 108         if (conn->hdev->hci_ver < BLUETOOTH_VER_1_2)
 109                 return;
 110
 111         bacpy(&cp.bdaddr, &conn->dst);
 112         hci_send_cmd(conn->hdev, HCI_OP_CREATE_CONN_CANCEL, sizeof(cp), &cp);
 113 }
 114
 115 static void hci_reject_sco(struct hci_conn *conn)
 116 {
 117         struct hci_cp_reject_sync_conn_req cp;
 118
 119         cp.reason = HCI_ERROR_REMOTE_USER_TERM;
 120         bacpy(&cp.bdaddr, &conn->dst);
 121
 122         hci_send_cmd(conn->hdev, HCI_OP_REJECT_SYNC_CONN_REQ, sizeof(cp), &cp);
 123 }
 124
 125 void hci_disconnect(struct hci_conn *conn, __u8 reason)
 126 {
 127         struct hci_cp_disconnect cp;
 128
 129         BT_DBG("hcon %p", conn);
 130
 131         conn->state = BT_DISCONN;
 132
 133         cp.handle = cpu_to_le16(conn->handle);
 134         cp.reason = reason;
 135         hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp);
 136 }
 137
 138 static void hci_amp_disconn(struct hci_conn *conn, __u8 reason)
 139 {
 140         struct hci_cp_disconn_phy_link cp;
 141
 142         BT_DBG("hcon %p", conn);
 143
 144         conn->state = BT_DISCONN;
 145
 146         cp.phy_handle = HCI_PHY_HANDLE(conn->handle);
 147         cp.reason = reason;
 148         hci_send_cmd(conn->hdev, HCI_OP_DISCONN_PHY_LINK,
 149                      sizeof(cp), &cp);
 150 }
 151
 152 static void hci_add_sco(struct hci_conn *conn, __u16 handle)
 153 {
 154         struct hci_dev *hdev = conn->hdev;
 155         struct hci_cp_add_sco cp;
 156
 157         BT_DBG("hcon %p", conn);
 158
 159         conn->state = BT_CONNECT;
 160         conn->out = true;
 161
 162         conn->attempt++;
 163
 164         cp.handle   = cpu_to_le16(handle);
 165         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 166
 167         hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
 168 }
 169
 170 bool hci_setup_sync(struct hci_conn *conn, __u16 handle)
 171 {
 172         struct hci_dev *hdev = conn->hdev;
 173         struct hci_cp_setup_sync_conn cp;
 174         const struct sco_param *param;
 175
 176         BT_DBG("hcon %p", conn);
 177
 178         conn->state = BT_CONNECT;
 179         conn->out = true;
 180
 181         conn->attempt++;
 182
 183         cp.handle   = cpu_to_le16(handle);
 184
 185         cp.tx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
 186         cp.rx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
 187         cp.voice_setting  = cpu_to_le16(conn->setting);
 188
 189         switch (conn->setting & SCO_AIRMODE_MASK) {
 190         case SCO_AIRMODE_TRANSP:
 191                 if (conn->attempt > ARRAY_SIZE(sco_param_wideband))
 192                         return false;
 193                 cp.retrans_effort = 0x02;
 194                 param = &sco_param_wideband[conn->attempt - 1];
 195                 break;
 196         case SCO_AIRMODE_CVSD:
 197                 if (conn->attempt > ARRAY_SIZE(sco_param_cvsd))
 198                         return false;
 199                 cp.retrans_effort = 0x01;
 200                 param = &sco_param_cvsd[conn->attempt - 1];
 201                 break;
 202         default:
 203                 return false;
 204         }
 205
 206         cp.pkt_type = __cpu_to_le16(param->pkt_type);
 207         cp.max_latency = __cpu_to_le16(param->max_latency);
 208
 209         if (hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp) < 0)
 210                 return false;
 211
 212         return true;
 213 }
 214
 215 void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max,
 216                         u16 latency, u16 to_multiplier)
 217 {
 218         struct hci_cp_le_conn_update cp;
 219         struct hci_dev *hdev = conn->hdev;
 220
 221         memset(&cp, 0, sizeof(cp));
 222
 223         cp.handle               = cpu_to_le16(conn->handle);
 224         cp.conn_interval_min    = cpu_to_le16(min);
 225         cp.conn_interval_max    = cpu_to_le16(max);
 226         cp.conn_latency         = cpu_to_le16(latency);
 227         cp.supervision_timeout  = cpu_to_le16(to_multiplier);
 228         cp.min_ce_len           = __constant_cpu_to_le16(0x0001);
 229         cp.max_ce_len           = __constant_cpu_to_le16(0x0001);
 230
 231         hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp);
 232 }
 233
 234 void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __u8 rand[8],
 235                       __u8 ltk[16])
 236 {
 237         struct hci_dev *hdev = conn->hdev;
 238         struct hci_cp_le_start_enc cp;
 239
 240         BT_DBG("hcon %p", conn);
 241
 242         memset(&cp, 0, sizeof(cp));
 243
 244         cp.handle = cpu_to_le16(conn->handle);
 245         memcpy(cp.ltk, ltk, sizeof(cp.ltk));
 246         cp.ediv = ediv;
 247         memcpy(cp.rand, rand, sizeof(cp.rand));
 248
 249         hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp);
 250 }
 251
 252 /* Device _must_ be locked */
 253 void hci_sco_setup(struct hci_conn *conn, __u8 status)
 254 {
 255         struct hci_conn *sco = conn->link;
 256
 257         if (!sco)
 258                 return;
 259
 260         BT_DBG("hcon %p", conn);
 261
 262         if (!status) {
 263                 if (lmp_esco_capable(conn->hdev))
 264                         hci_setup_sync(sco, conn->handle);
 265                 else
 266                         hci_add_sco(sco, conn->handle);
 267         } else {
 268                 hci_proto_connect_cfm(sco, status);
 269                 hci_conn_del(sco);
 270         }
 271 }
 272
 273 static void hci_conn_disconnect(struct hci_conn *conn)
 274 {
 275         __u8 reason = hci_proto_disconn_ind(conn);
 276
 277         switch (conn->type) {
 278         case AMP_LINK:
 279                 hci_amp_disconn(conn, reason);
 280                 break;
 281         default:
 282                 hci_disconnect(conn, reason);
 283                 break;
 284         }
 285 }
 286
 287 static void hci_conn_timeout(struct work_struct *work)
 288 {
 289         struct hci_conn *conn = container_of(work, struct hci_conn,
 290                                              disc_work.work);
 291
 292         BT_DBG("hcon %p state %s", conn, state_to_string(conn->state));
 293
 294         if (atomic_read(&conn->refcnt))
 295                 return;
 296
 297         switch (conn->state) {
 298         case BT_CONNECT:
 299         case BT_CONNECT2:
 300                 if (conn->out) {
 301                         if (conn->type == ACL_LINK)
 302                                 hci_acl_create_connection_cancel(conn);
 303                         else if (conn->type == LE_LINK)
 304                                 hci_le_create_connection_cancel(conn);
 305                 } else if (conn->type == SCO_LINK || conn->type == ESCO_LINK) {
 306                         hci_reject_sco(conn);
 307                 }
 308                 break;
 309         case BT_CONFIG:
 310         case BT_CONNECTED:
 311                 hci_conn_disconnect(conn);
 312                 break;
 313         default:
 314                 conn->state = BT_CLOSED;
 315                 break;
 316         }
 317 }
 318
 319 /* Enter sniff mode */
 320 static void hci_conn_enter_sniff_mode(struct hci_conn *conn)
 321 {
 322         struct hci_dev *hdev = conn->hdev;
 323
 324         BT_DBG("hcon %p mode %d", conn, conn->mode);
 325
 326         if (test_bit(HCI_RAW, &hdev->flags))
 327                 return;
 328
 329         if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn))
 330                 return;
 331
 332         if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF))
 333                 return;
 334
 335         if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
 336                 struct hci_cp_sniff_subrate cp;
 337                 cp.handle             = cpu_to_le16(conn->handle);
 338                 cp.max_latency        = __constant_cpu_to_le16(0);
 339                 cp.min_remote_timeout = __constant_cpu_to_le16(0);
 340                 cp.min_local_timeout  = __constant_cpu_to_le16(0);
 341                 hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
 342         }
 343
 344         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
 345                 struct hci_cp_sniff_mode cp;
 346                 cp.handle       = cpu_to_le16(conn->handle);
 347                 cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
 348                 cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
 349                 cp.attempt      = __constant_cpu_to_le16(4);
 350                 cp.timeout      = __constant_cpu_to_le16(1);
 351                 hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
 352         }
 353 }
 354
 355 static void hci_conn_idle(unsigned long arg)
 356 {
 357         struct hci_conn *conn = (void *) arg;
 358
 359         BT_DBG("hcon %p mode %d", conn, conn->mode);
 360
 361         hci_conn_enter_sniff_mode(conn);
 362 }
 363
 364 static void hci_conn_auto_accept(unsigned long arg)
 365 {
 366         struct hci_conn *conn = (void *) arg;
 367         struct hci_dev *hdev = conn->hdev;
 368
 369         hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY, sizeof(conn->dst),
 370                      &conn->dst);
 371 }
 372
 373 struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
 374 {
 375         struct hci_conn *conn;
 376
 377         BT_DBG("%s dst %pMR", hdev->name, dst);
 378
 379         conn = kzalloc(sizeof(struct hci_conn), GFP_KERNEL);
 380         if (!conn)
 381                 return NULL;
 382
 383         bacpy(&conn->dst, dst);
 384         bacpy(&conn->src, &hdev->bdaddr);
 385         conn->hdev  = hdev;
 386         conn->type  = type;
 387         conn->mode  = HCI_CM_ACTIVE;
 388         conn->state = BT_OPEN;
 389         conn->auth_type = HCI_AT_GENERAL_BONDING;
 390         conn->io_capability = hdev->io_capability;
 391         conn->remote_auth = 0xff;
 392         conn->key_type = 0xff;
 393
 394         set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
 395         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
 396
 397         switch (type) {
 398         case ACL_LINK:
 399                 conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
 400                 break;
 401         case SCO_LINK:
 402                 if (lmp_esco_capable(hdev))
 403                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
 404                                         (hdev->esco_type & EDR_ESCO_MASK);
 405                 else
 406                         conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
 407                 break;
 408         case ESCO_LINK:
 409                 conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
 410                 break;
 411         }
 412
 413         skb_queue_head_init(&conn->data_q);
 414
 415         INIT_LIST_HEAD(&conn->chan_list);
 416
 417         INIT_DELAYED_WORK(&conn->disc_work, hci_conn_timeout);
 418         setup_timer(&conn->idle_timer, hci_conn_idle, (unsigned long)conn);
 419         setup_timer(&conn->auto_accept_timer, hci_conn_auto_accept,
 420                     (unsigned long) conn);
 421
 422         atomic_set(&conn->refcnt, 0);
 423
 424         hci_dev_hold(hdev);
 425
 426         hci_conn_hash_add(hdev, conn);
 427         if (hdev->notify)
 428                 hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
 429
 430         hci_conn_init_sysfs(conn);
 431
 432         return conn;
 433 }
 434
 435 int hci_conn_del(struct hci_conn *conn)
 436 {
 437         struct hci_dev *hdev = conn->hdev;
 438
 439         BT_DBG("%s hcon %p handle %d", hdev->name, conn, conn->handle);
 440
 441         del_timer(&conn->idle_timer);
 442
 443         cancel_delayed_work_sync(&conn->disc_work);
 444
 445         del_timer(&conn->auto_accept_timer);
 446
 447         if (conn->type == ACL_LINK) {
 448                 struct hci_conn *sco = conn->link;
 449                 if (sco)
 450                         sco->link = NULL;
 451
 452                 /* Unacked frames */
 453                 hdev->acl_cnt += conn->sent;
 454         } else if (conn->type == LE_LINK) {
 455                 if (hdev->le_pkts)
 456                         hdev->le_cnt += conn->sent;
 457                 else
 458                         hdev->acl_cnt += conn->sent;
 459         } else {
 460                 struct hci_conn *acl = conn->link;
 461                 if (acl) {
 462                         acl->link = NULL;
 463                         hci_conn_drop(acl);
 464                 }
 465         }
 466
 467         hci_chan_list_flush(conn);
 468
 469         if (conn->amp_mgr)
 470                 amp_mgr_put(conn->amp_mgr);
 471
 472         hci_conn_hash_del(hdev, conn);
 473         if (hdev->notify)
 474                 hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
 475
 476         skb_queue_purge(&conn->data_q);
 477
 478         hci_conn_del_sysfs(conn);
 479
 480         hci_dev_put(hdev);
 481
 482         hci_conn_put(conn);
 483
 484         return 0;
 485 }
 486
 487 struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src)
 488 {
 489         int use_src = bacmp(src, BDADDR_ANY);
 490         struct hci_dev *hdev = NULL, *d;
 491
 492         BT_DBG("%pMR -> %pMR", src, dst);
 493
 494         read_lock(&hci_dev_list_lock);
 495
 496         list_for_each_entry(d, &hci_dev_list, list) {
 497                 if (!test_bit(HCI_UP, &d->flags) ||
 498                     test_bit(HCI_RAW, &d->flags) ||
 499                     test_bit(HCI_USER_CHANNEL, &d->dev_flags) ||
 500                     d->dev_type != HCI_BREDR)
 501                         continue;
 502
 503                 /* Simple routing:
 504                  *   No source address - find interface with bdaddr != dst
 505                  *   Source address    - find interface with bdaddr == src
 506                  */
 507
 508                 if (use_src) {
 509                         if (!bacmp(&d->bdaddr, src)) {
 510                                 hdev = d; break;
 511                         }
 512                 } else {
 513                         if (bacmp(&d->bdaddr, dst)) {
 514                                 hdev = d; break;
 515                         }
 516                 }
 517         }
 518
 519         if (hdev)
 520                 hdev = hci_dev_hold(hdev);
 521
 522         read_unlock(&hci_dev_list_lock);
 523         return hdev;
 524 }
 525 EXPORT_SYMBOL(hci_get_route);
 526
 527 static void create_le_conn_complete(struct hci_dev *hdev, u8 status)
 528 {
 529         struct hci_conn *conn;
 530
 531         if (status == 0)
 532                 return;
 533
 534         BT_ERR("HCI request failed to create LE connection: status 0x%2.2x",
 535                status);
 536
 537         hci_dev_lock(hdev);
 538
 539         conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
 540         if (!conn)
 541                 goto done;
 542
 543         conn->state = BT_CLOSED;
 544
 545         mgmt_connect_failed(hdev, &conn->dst, conn->type, conn->dst_type,
 546                             status);
 547
 548         hci_proto_connect_cfm(conn, status);
 549
 550         hci_conn_del(conn);
 551
 552 done:
 553         hci_dev_unlock(hdev);
 554 }
 555
 556 static int hci_create_le_conn(struct hci_conn *conn)
 557 {
 558         struct hci_dev *hdev = conn->hdev;
 559         struct hci_cp_le_create_conn cp;
 560         struct hci_request req;
 561         int err;
 562
 563         hci_req_init(&req, hdev);
 564
 565         memset(&cp, 0, sizeof(cp));
 566         cp.scan_interval = cpu_to_le16(hdev->le_scan_interval);
 567         cp.scan_window = cpu_to_le16(hdev->le_scan_window);
 568         bacpy(&cp.peer_addr, &conn->dst);
 569         cp.peer_addr_type = conn->dst_type;
 570         cp.own_address_type = conn->src_type;
 571         cp.conn_interval_min = __constant_cpu_to_le16(0x0028);
 572         cp.conn_interval_max = __constant_cpu_to_le16(0x0038);
 573         cp.supervision_timeout = __constant_cpu_to_le16(0x002a);
 574         cp.min_ce_len = __constant_cpu_to_le16(0x0000);
 575         cp.max_ce_len = __constant_cpu_to_le16(0x0000);
 576         hci_req_add(&req, HCI_OP_LE_CREATE_CONN, sizeof(cp), &cp);
 577
 578         err = hci_req_run(&req, create_le_conn_complete);
 579         if (err) {
 580                 hci_conn_del(conn);
 581                 return err;
 582         }
 583
 584         return 0;
 585 }
 586
 587 static struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,
 588                                     u8 dst_type, u8 sec_level, u8 auth_type)
 589 {
 590         struct hci_conn *conn;
 591         int err;
 592
 593         if (test_bit(HCI_ADVERTISING, &hdev->flags))
 594                 return ERR_PTR(-ENOTSUPP);
 595
 596         /* Some devices send ATT messages as soon as the physical link is
 597          * established. To be able to handle these ATT messages, the user-
 598          * space first establishes the connection and then starts the pairing
 599          * process.
 600          *
 601          * So if a hci_conn object already exists for the following connection
 602          * attempt, we simply update pending_sec_level and auth_type fields
 603          * and return the object found.
 604          */
 605         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, dst);
 606         if (conn) {
 607                 conn->pending_sec_level = sec_level;
 608                 conn->auth_type = auth_type;
 609                 goto done;
 610         }
 611
 612         /* Since the controller supports only one LE connection attempt at a
 613          * time, we return -EBUSY if there is any connection attempt running.
 614          */
 615         conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
 616         if (conn)
 617                 return ERR_PTR(-EBUSY);
 618
 619         conn = hci_conn_add(hdev, LE_LINK, dst);
 620         if (!conn)
 621                 return ERR_PTR(-ENOMEM);
 622
 623         if (dst_type == BDADDR_LE_PUBLIC)
 624                 conn->dst_type = ADDR_LE_DEV_PUBLIC;
 625         else
 626                 conn->dst_type = ADDR_LE_DEV_RANDOM;
 627
 628         if (bacmp(&conn->src, BDADDR_ANY)) {
 629                 conn->src_type = ADDR_LE_DEV_PUBLIC;
 630         } else {
 631                 bacpy(&conn->src, &hdev->static_addr);
 632                 conn->src_type = ADDR_LE_DEV_RANDOM;
 633         }
 634
 635         conn->state = BT_CONNECT;
 636         conn->out = true;
 637         conn->link_mode |= HCI_LM_MASTER;
 638         conn->sec_level = BT_SECURITY_LOW;
 639         conn->pending_sec_level = sec_level;
 640         conn->auth_type = auth_type;
 641
 642         err = hci_create_le_conn(conn);
 643         if (err)
 644                 return ERR_PTR(err);
 645
 646 done:
 647         hci_conn_hold(conn);
 648         return conn;
 649 }
 650
 651 static struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst,
 652                                                 u8 sec_level, u8 auth_type)
 653 {
 654         struct hci_conn *acl;
 655
 656         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 657                 return ERR_PTR(-ENOTSUPP);
 658
 659         acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
 660         if (!acl) {
 661                 acl = hci_conn_add(hdev, ACL_LINK, dst);
 662                 if (!acl)
 663                         return ERR_PTR(-ENOMEM);
 664         }
 665
 666         hci_conn_hold(acl);
 667
 668         if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
 669                 acl->sec_level = BT_SECURITY_LOW;
 670                 acl->pending_sec_level = sec_level;
 671                 acl->auth_type = auth_type;
 672                 hci_acl_create_connection(acl);
 673         }
 674
 675         return acl;
 676 }
 677
 678 struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type, bdaddr_t *dst,
 679                                  __u16 setting)
 680 {
 681         struct hci_conn *acl;
 682         struct hci_conn *sco;
 683
 684         acl = hci_connect_acl(hdev, dst, BT_SECURITY_LOW, HCI_AT_NO_BONDING);
 685         if (IS_ERR(acl))
 686                 return acl;
 687
 688         sco = hci_conn_hash_lookup_ba(hdev, type, dst);
 689         if (!sco) {
 690                 sco = hci_conn_add(hdev, type, dst);
 691                 if (!sco) {
 692                         hci_conn_drop(acl);
 693                         return ERR_PTR(-ENOMEM);
 694                 }
 695         }
 696
 697         acl->link = sco;
 698         sco->link = acl;
 699
 700         hci_conn_hold(sco);
 701
 702         sco->setting = setting;
 703
 704         if (acl->state == BT_CONNECTED &&
 705             (sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
 706                 set_bit(HCI_CONN_POWER_SAVE, &acl->flags);
 707                 hci_conn_enter_active_mode(acl, BT_POWER_FORCE_ACTIVE_ON);
 708
 709                 if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->flags)) {
 710                         /* defer SCO setup until mode change completed */
 711                         set_bit(HCI_CONN_SCO_SETUP_PEND, &acl->flags);
 712                         return sco;
 713                 }
 714
 715                 hci_sco_setup(acl, 0x00);
 716         }
 717
 718         return sco;
 719 }
 720
 721 /* Create SCO, ACL or LE connection. */
 722 struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst,
 723                              __u8 dst_type, __u8 sec_level, __u8 auth_type)
 724 {
 725         BT_DBG("%s dst %pMR type 0x%x", hdev->name, dst, type);
 726
 727         switch (type) {
 728         case LE_LINK:
 729                 return hci_connect_le(hdev, dst, dst_type, sec_level, auth_type);
 730         case ACL_LINK:
 731                 return hci_connect_acl(hdev, dst, sec_level, auth_type);
 732         }
 733
 734         return ERR_PTR(-EINVAL);
 735 }
 736
 737 /* Check link security requirement */
 738 int hci_conn_check_link_mode(struct hci_conn *conn)
 739 {
 740         BT_DBG("hcon %p", conn);
 741
 742         if (hci_conn_ssp_enabled(conn) && !(conn->link_mode & HCI_LM_ENCRYPT))
 743                 return 0;
 744
 745         return 1;
 746 }
 747
 748 /* Authenticate remote device */
 749 static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 750 {
 751         BT_DBG("hcon %p", conn);
 752
 753         if (conn->pending_sec_level > sec_level)
 754                 sec_level = conn->pending_sec_level;
 755
 756         if (sec_level > conn->sec_level)
 757                 conn->pending_sec_level = sec_level;
 758         else if (conn->link_mode & HCI_LM_AUTH)
 759                 return 1;
 760
 761         /* Make sure we preserve an existing MITM requirement*/
 762         auth_type |= (conn->auth_type & 0x01);
 763
 764         conn->auth_type = auth_type;
 765
 766         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
 767                 struct hci_cp_auth_requested cp;
 768
 769                 /* encrypt must be pending if auth is also pending */
 770                 set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
 771
 772                 cp.handle = cpu_to_le16(conn->handle);
 773                 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
 774                              sizeof(cp), &cp);
 775                 if (conn->key_type != 0xff)
 776                         set_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
 777         }
 778
 779         return 0;
 780 }
 781
 782 /* Encrypt the the link */
 783 static void hci_conn_encrypt(struct hci_conn *conn)
 784 {
 785         BT_DBG("hcon %p", conn);
 786
 787         if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
 788                 struct hci_cp_set_conn_encrypt cp;
 789                 cp.handle  = cpu_to_le16(conn->handle);
 790                 cp.encrypt = 0x01;
 791                 hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
 792                              &cp);
 793         }
 794 }
 795
 796 /* Enable security */
 797 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 798 {
 799         BT_DBG("hcon %p", conn);
 800
 801         if (conn->type == LE_LINK)
 802                 return smp_conn_security(conn, sec_level);
 803
 804         /* For sdp we don't need the link key. */
 805         if (sec_level == BT_SECURITY_SDP)
 806                 return 1;
 807
 808         /* For non 2.1 devices and low security level we don't need the link
 809            key. */
 810         if (sec_level == BT_SECURITY_LOW && !hci_conn_ssp_enabled(conn))
 811                 return 1;
 812
 813         /* For other security levels we need the link key. */
 814         if (!(conn->link_mode & HCI_LM_AUTH))
 815                 goto auth;
 816
 817         /* An authenticated combination key has sufficient security for any
 818            security level. */
 819         if (conn->key_type == HCI_LK_AUTH_COMBINATION)
 820                 goto encrypt;
 821
 822         /* An unauthenticated combination key has sufficient security for
 823            security level 1 and 2. */
 824         if (conn->key_type == HCI_LK_UNAUTH_COMBINATION &&
 825             (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW))
 826                 goto encrypt;
 827
 828         /* A combination key has always sufficient security for the security
 829            levels 1 or 2. High security level requires the combination key
 830            is generated using maximum PIN code length (16).
 831            For pre 2.1 units. */
 832         if (conn->key_type == HCI_LK_COMBINATION &&
 833             (sec_level != BT_SECURITY_HIGH || conn->pin_length == 16))
 834                 goto encrypt;
 835
 836 auth:
 837         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags))
 838                 return 0;
 839
 840         if (!hci_conn_auth(conn, sec_level, auth_type))
 841                 return 0;
 842
 843 encrypt:
 844         if (conn->link_mode & HCI_LM_ENCRYPT)
 845                 return 1;
 846
 847         hci_conn_encrypt(conn);
 848         return 0;
 849 }
 850 EXPORT_SYMBOL(hci_conn_security);
 851
 852 /* Check secure link requirement */
 853 int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level)
 854 {
 855         BT_DBG("hcon %p", conn);
 856
 857         if (sec_level != BT_SECURITY_HIGH)
 858                 return 1; /* Accept if non-secure is required */
 859
 860         if (conn->sec_level == BT_SECURITY_HIGH)
 861                 return 1;
 862
 863         return 0; /* Reject not secure link */
 864 }
 865 EXPORT_SYMBOL(hci_conn_check_secure);
 866
 867 /* Change link key */
 868 int hci_conn_change_link_key(struct hci_conn *conn)
 869 {
 870         BT_DBG("hcon %p", conn);
 871
 872         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
 873                 struct hci_cp_change_conn_link_key cp;
 874                 cp.handle = cpu_to_le16(conn->handle);
 875                 hci_send_cmd(conn->hdev, HCI_OP_CHANGE_CONN_LINK_KEY,
 876                              sizeof(cp), &cp);
 877         }
 878
 879         return 0;
 880 }
 881
 882 /* Switch role */
 883 int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
 884 {
 885         BT_DBG("hcon %p", conn);
 886
 887         if (!role && conn->link_mode & HCI_LM_MASTER)
 888                 return 1;
 889
 890         if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->flags)) {
 891                 struct hci_cp_switch_role cp;
 892                 bacpy(&cp.bdaddr, &conn->dst);
 893                 cp.role = role;
 894                 hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
 895         }
 896
 897         return 0;
 898 }
 899 EXPORT_SYMBOL(hci_conn_switch_role);
 900
 901 /* Enter active mode */
 902 void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
 903 {
 904         struct hci_dev *hdev = conn->hdev;
 905
 906         BT_DBG("hcon %p mode %d", conn, conn->mode);
 907
 908         if (test_bit(HCI_RAW, &hdev->flags))
 909                 return;
 910
 911         if (conn->mode != HCI_CM_SNIFF)
 912                 goto timer;
 913
 914         if (!test_bit(HCI_CONN_POWER_SAVE, &conn->flags) && !force_active)
 915                 goto timer;
 916
 917         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
 918                 struct hci_cp_exit_sniff_mode cp;
 919                 cp.handle = cpu_to_le16(conn->handle);
 920                 hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
 921         }
 922
 923 timer:
 924         if (hdev->idle_timeout > 0)
 925                 mod_timer(&conn->idle_timer,
 926                           jiffies + msecs_to_jiffies(hdev->idle_timeout));
 927 }
 928
 929 /* Drop all connection on the device */
 930 void hci_conn_hash_flush(struct hci_dev *hdev)
 931 {
 932         struct hci_conn_hash *h = &hdev->conn_hash;
 933         struct hci_conn *c, *n;
 934
 935         BT_DBG("hdev %s", hdev->name);
 936
 937         list_for_each_entry_safe(c, n, &h->list, list) {
 938                 c->state = BT_CLOSED;
 939
 940                 hci_proto_disconn_cfm(c, HCI_ERROR_LOCAL_HOST_TERM);
 941                 hci_conn_del(c);
 942         }
 943 }
 944
 945 /* Check pending connect attempts */
 946 void hci_conn_check_pending(struct hci_dev *hdev)
 947 {
 948         struct hci_conn *conn;
 949
 950         BT_DBG("hdev %s", hdev->name);
 951
 952         hci_dev_lock(hdev);
 953
 954         conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
 955         if (conn)
 956                 hci_acl_create_connection(conn);
 957
 958         hci_dev_unlock(hdev);
 959 }
 960
 961 int hci_get_conn_list(void __user *arg)
 962 {
 963         struct hci_conn *c;
 964         struct hci_conn_list_req req, *cl;
 965         struct hci_conn_info *ci;
 966         struct hci_dev *hdev;
 967         int n = 0, size, err;
 968
 969         if (copy_from_user(&req, arg, sizeof(req)))
 970                 return -EFAULT;
 971
 972         if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
 973                 return -EINVAL;
 974
 975         size = sizeof(req) + req.conn_num * sizeof(*ci);
 976
 977         cl = kmalloc(size, GFP_KERNEL);
 978         if (!cl)
 979                 return -ENOMEM;
 980
 981         hdev = hci_dev_get(req.dev_id);
 982         if (!hdev) {
 983                 kfree(cl);
 984                 return -ENODEV;
 985         }
 986
 987         ci = cl->conn_info;
 988
 989         hci_dev_lock(hdev);
 990         list_for_each_entry(c, &hdev->conn_hash.list, list) {
 991                 bacpy(&(ci + n)->bdaddr, &c->dst);
 992                 (ci + n)->handle = c->handle;
 993                 (ci + n)->type  = c->type;
 994                 (ci + n)->out   = c->out;
 995                 (ci + n)->state = c->state;
 996                 (ci + n)->link_mode = c->link_mode;
 997                 if (++n >= req.conn_num)
 998                         break;
 999         }
1000         hci_dev_unlock(hdev);
1001
1002         cl->dev_id = hdev->id;
1003         cl->conn_num = n;
1004         size = sizeof(req) + n * sizeof(*ci);
1005
1006         hci_dev_put(hdev);
1007
1008         err = copy_to_user(arg, cl, size);
1009         kfree(cl);
1010
1011         return err ? -EFAULT : 0;
1012 }
1013
1014 int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
1015 {
1016         struct hci_conn_info_req req;
1017         struct hci_conn_info ci;
1018         struct hci_conn *conn;
1019         char __user *ptr = arg + sizeof(req);
1020
1021         if (copy_from_user(&req, arg, sizeof(req)))
1022                 return -EFAULT;
1023
1024         hci_dev_lock(hdev);
1025         conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
1026         if (conn) {
1027                 bacpy(&ci.bdaddr, &conn->dst);
1028                 ci.handle = conn->handle;
1029                 ci.type  = conn->type;
1030                 ci.out   = conn->out;
1031                 ci.state = conn->state;
1032                 ci.link_mode = conn->link_mode;
1033         }
1034         hci_dev_unlock(hdev);
1035
1036         if (!conn)
1037                 return -ENOENT;
1038
1039         return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
1040 }
1041
1042 int hci_get_auth_info(struct hci_dev *hdev, void __user *arg)
1043 {
1044         struct hci_auth_info_req req;
1045         struct hci_conn *conn;
1046
1047         if (copy_from_user(&req, arg, sizeof(req)))
1048                 return -EFAULT;
1049
1050         hci_dev_lock(hdev);
1051         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr);
1052         if (conn)
1053                 req.type = conn->auth_type;
1054         hci_dev_unlock(hdev);
1055
1056         if (!conn)
1057                 return -ENOENT;
1058
1059         return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0;
1060 }
1061
1062 struct hci_chan *hci_chan_create(struct hci_conn *conn)
1063 {
1064         struct hci_dev *hdev = conn->hdev;
1065         struct hci_chan *chan;
1066
1067         BT_DBG("%s hcon %p", hdev->name, conn);
1068
1069         chan = kzalloc(sizeof(struct hci_chan), GFP_KERNEL);
1070         if (!chan)
1071                 return NULL;
1072
1073         chan->conn = conn;
1074         skb_queue_head_init(&chan->data_q);
1075         chan->state = BT_CONNECTED;
1076
1077         list_add_rcu(&chan->list, &conn->chan_list);
1078
1079         return chan;
1080 }
1081
1082 void hci_chan_del(struct hci_chan *chan)
1083 {
1084         struct hci_conn *conn = chan->conn;
1085         struct hci_dev *hdev = conn->hdev;
1086
1087         BT_DBG("%s hcon %p chan %p", hdev->name, conn, chan);
1088
1089         list_del_rcu(&chan->list);
1090
1091         synchronize_rcu();
1092
1093         hci_conn_drop(conn);
1094
1095         skb_queue_purge(&chan->data_q);
1096         kfree(chan);
1097 }
1098
1099 void hci_chan_list_flush(struct hci_conn *conn)
1100 {
1101         struct hci_chan *chan, *n;
1102
1103         BT_DBG("hcon %p", conn);
1104
1105         list_for_each_entry_safe(chan, n, &conn->chan_list, list)
1106                 hci_chan_del(chan);
1107 }
1108
1109 static struct hci_chan *__hci_chan_lookup_handle(struct hci_conn *hcon,
1110                                                  __u16 handle)
1111 {
1112         struct hci_chan *hchan;
1113
1114         list_for_each_entry(hchan, &hcon->chan_list, list) {
1115                 if (hchan->handle == handle)
1116                         return hchan;
1117         }
1118
1119         return NULL;
1120 }
1121
1122 struct hci_chan *hci_chan_lookup_handle(struct hci_dev *hdev, __u16 handle)
1123 {
1124         struct hci_conn_hash *h = &hdev->conn_hash;
1125         struct hci_conn *hcon;
1126         struct hci_chan *hchan = NULL;
1127
1128         rcu_read_lock();
1129
1130         list_for_each_entry_rcu(hcon, &h->list, list) {
1131                 hchan = __hci_chan_lookup_handle(hcon, handle);
1132                 if (hchan)
1133                         break;
1134         }
1135
1136         rcu_read_unlock();
1137
1138         return hchan;
1139 }