1 /* 2 BlueZ - Bluetooth protocol stack for Linux 3 Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved. 4 5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com> 6 7 This program is free software; you can redistribute it and/or modify 8 it under the terms of the GNU General Public License version 2 as 9 published by the Free Software Foundation; 10 11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 19 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 22 SOFTWARE IS DISCLAIMED. 23 */ 24 25 /* Bluetooth HCI connection handling. */ 26 27 #include <linux/export.h> 28 29 #include <net/bluetooth/bluetooth.h> 30 #include <net/bluetooth/hci_core.h> 31 #include <net/bluetooth/l2cap.h> 32 33 #include "smp.h" 34 #include "a2mp.h" 35 36 struct sco_param { 37 u16 pkt_type; 38 u16 max_latency; 39 }; 40 41 static const struct sco_param sco_param_cvsd[] = { 42 { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000a }, /* S3 */ 43 { EDR_ESCO_MASK & ~ESCO_2EV3, 0x0007 }, /* S2 */ 44 { EDR_ESCO_MASK | ESCO_EV3, 0x0007 }, /* S1 */ 45 { EDR_ESCO_MASK | ESCO_HV3, 0xffff }, /* D1 */ 46 { EDR_ESCO_MASK | ESCO_HV1, 0xffff }, /* D0 */ 47 }; 48 49 static const struct sco_param sco_param_wideband[] = { 50 { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000d }, /* T2 */ 51 { EDR_ESCO_MASK | ESCO_EV3, 0x0008 }, /* T1 */ 52 }; 53 54 static void hci_le_create_connection_cancel(struct hci_conn *conn) 55 { 56 hci_send_cmd(conn->hdev, HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL); 57 } 58 59 static void hci_acl_create_connection(struct hci_conn *conn) 60 { 61 struct hci_dev *hdev = conn->hdev; 62 struct inquiry_entry *ie; 63 struct hci_cp_create_conn cp; 64 65 BT_DBG("hcon %p", conn); 66 67 conn->state = BT_CONNECT; 68 conn->out = true; 69 70 conn->link_mode = HCI_LM_MASTER; 71 72 conn->attempt++; 73 74 conn->link_policy = hdev->link_policy; 75 76 memset(&cp, 0, sizeof(cp)); 77 bacpy(&cp.bdaddr, &conn->dst); 78 cp.pscan_rep_mode = 0x02; 79 80 ie = hci_inquiry_cache_lookup(hdev, &conn->dst); 81 if (ie) { 82 if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) { 83 cp.pscan_rep_mode = ie->data.pscan_rep_mode; 84 cp.pscan_mode = ie->data.pscan_mode; 85 cp.clock_offset = ie->data.clock_offset | 86 cpu_to_le16(0x8000); 87 } 88 89 memcpy(conn->dev_class, ie->data.dev_class, 3); 90 if (ie->data.ssp_mode > 0) 91 set_bit(HCI_CONN_SSP_ENABLED, &conn->flags); 92 } 93 94 cp.pkt_type = cpu_to_le16(conn->pkt_type); 95 if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER)) 96 cp.role_switch = 0x01; 97 else 98 cp.role_switch = 0x00; 99 100 hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp); 101 } 102 103 static void hci_acl_create_connection_cancel(struct hci_conn *conn) 104 { 105 struct hci_cp_create_conn_cancel cp; 106 107 BT_DBG("hcon %p", conn); 108 109 if (conn->hdev->hci_ver < BLUETOOTH_VER_1_2) 110 return; 111 112 bacpy(&cp.bdaddr, &conn->dst); 113 hci_send_cmd(conn->hdev, HCI_OP_CREATE_CONN_CANCEL, sizeof(cp), &cp); 114 } 115 116 static void hci_reject_sco(struct hci_conn *conn) 117 { 118 struct hci_cp_reject_sync_conn_req cp; 119 120 cp.reason = HCI_ERROR_REMOTE_USER_TERM; 121 bacpy(&cp.bdaddr, &conn->dst); 122 123 hci_send_cmd(conn->hdev, HCI_OP_REJECT_SYNC_CONN_REQ, sizeof(cp), &cp); 124 } 125 126 void hci_disconnect(struct hci_conn *conn, __u8 reason) 127 { 128 struct hci_cp_disconnect cp; 129 130 BT_DBG("hcon %p", conn); 131 132 conn->state = BT_DISCONN; 133 134 cp.handle = cpu_to_le16(conn->handle); 135 cp.reason = reason; 136 hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp); 137 } 138 139 static void hci_amp_disconn(struct hci_conn *conn, __u8 reason) 140 { 141 struct hci_cp_disconn_phy_link cp; 142 143 BT_DBG("hcon %p", conn); 144 145 conn->state = BT_DISCONN; 146 147 cp.phy_handle = HCI_PHY_HANDLE(conn->handle); 148 cp.reason = reason; 149 hci_send_cmd(conn->hdev, HCI_OP_DISCONN_PHY_LINK, 150 sizeof(cp), &cp); 151 } 152 153 static void hci_add_sco(struct hci_conn *conn, __u16 handle) 154 { 155 struct hci_dev *hdev = conn->hdev; 156 struct hci_cp_add_sco cp; 157 158 BT_DBG("hcon %p", conn); 159 160 conn->state = BT_CONNECT; 161 conn->out = true; 162 163 conn->attempt++; 164 165 cp.handle = cpu_to_le16(handle); 166 cp.pkt_type = cpu_to_le16(conn->pkt_type); 167 168 hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp); 169 } 170 171 bool hci_setup_sync(struct hci_conn *conn, __u16 handle) 172 { 173 struct hci_dev *hdev = conn->hdev; 174 struct hci_cp_setup_sync_conn cp; 175 const struct sco_param *param; 176 177 BT_DBG("hcon %p", conn); 178 179 conn->state = BT_CONNECT; 180 conn->out = true; 181 182 conn->attempt++; 183 184 cp.handle = cpu_to_le16(handle); 185 186 cp.tx_bandwidth = cpu_to_le32(0x00001f40); 187 cp.rx_bandwidth = cpu_to_le32(0x00001f40); 188 cp.voice_setting = cpu_to_le16(conn->setting); 189 190 switch (conn->setting & SCO_AIRMODE_MASK) { 191 case SCO_AIRMODE_TRANSP: 192 if (conn->attempt > ARRAY_SIZE(sco_param_wideband)) 193 return false; 194 cp.retrans_effort = 0x02; 195 param = &sco_param_wideband[conn->attempt - 1]; 196 break; 197 case SCO_AIRMODE_CVSD: 198 if (conn->attempt > ARRAY_SIZE(sco_param_cvsd)) 199 return false; 200 cp.retrans_effort = 0x01; 201 param = &sco_param_cvsd[conn->attempt - 1]; 202 break; 203 default: 204 return false; 205 } 206 207 cp.pkt_type = __cpu_to_le16(param->pkt_type); 208 cp.max_latency = __cpu_to_le16(param->max_latency); 209 210 if (hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp) < 0) 211 return false; 212 213 return true; 214 } 215 216 void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max, 217 u16 latency, u16 to_multiplier) 218 { 219 struct hci_cp_le_conn_update cp; 220 struct hci_dev *hdev = conn->hdev; 221 222 memset(&cp, 0, sizeof(cp)); 223 224 cp.handle = cpu_to_le16(conn->handle); 225 cp.conn_interval_min = cpu_to_le16(min); 226 cp.conn_interval_max = cpu_to_le16(max); 227 cp.conn_latency = cpu_to_le16(latency); 228 cp.supervision_timeout = cpu_to_le16(to_multiplier); 229 cp.min_ce_len = cpu_to_le16(0x0000); 230 cp.max_ce_len = cpu_to_le16(0x0000); 231 232 hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp); 233 } 234 235 void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __le64 rand, 236 __u8 ltk[16]) 237 { 238 struct hci_dev *hdev = conn->hdev; 239 struct hci_cp_le_start_enc cp; 240 241 BT_DBG("hcon %p", conn); 242 243 memset(&cp, 0, sizeof(cp)); 244 245 cp.handle = cpu_to_le16(conn->handle); 246 cp.rand = rand; 247 cp.ediv = ediv; 248 memcpy(cp.ltk, ltk, sizeof(cp.ltk)); 249 250 hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp); 251 } 252 253 /* Device _must_ be locked */ 254 void hci_sco_setup(struct hci_conn *conn, __u8 status) 255 { 256 struct hci_conn *sco = conn->link; 257 258 if (!sco) 259 return; 260 261 BT_DBG("hcon %p", conn); 262 263 if (!status) { 264 if (lmp_esco_capable(conn->hdev)) 265 hci_setup_sync(sco, conn->handle); 266 else 267 hci_add_sco(sco, conn->handle); 268 } else { 269 hci_proto_connect_cfm(sco, status); 270 hci_conn_del(sco); 271 } 272 } 273 274 static void hci_conn_disconnect(struct hci_conn *conn) 275 { 276 __u8 reason = hci_proto_disconn_ind(conn); 277 278 switch (conn->type) { 279 case AMP_LINK: 280 hci_amp_disconn(conn, reason); 281 break; 282 default: 283 hci_disconnect(conn, reason); 284 break; 285 } 286 } 287 288 static void hci_conn_timeout(struct work_struct *work) 289 { 290 struct hci_conn *conn = container_of(work, struct hci_conn, 291 disc_work.work); 292 293 BT_DBG("hcon %p state %s", conn, state_to_string(conn->state)); 294 295 if (atomic_read(&conn->refcnt)) 296 return; 297 298 switch (conn->state) { 299 case BT_CONNECT: 300 case BT_CONNECT2: 301 if (conn->out) { 302 if (conn->type == ACL_LINK) 303 hci_acl_create_connection_cancel(conn); 304 else if (conn->type == LE_LINK) 305 hci_le_create_connection_cancel(conn); 306 } else if (conn->type == SCO_LINK || conn->type == ESCO_LINK) { 307 hci_reject_sco(conn); 308 } 309 break; 310 case BT_CONFIG: 311 case BT_CONNECTED: 312 hci_conn_disconnect(conn); 313 break; 314 default: 315 conn->state = BT_CLOSED; 316 break; 317 } 318 } 319 320 /* Enter sniff mode */ 321 static void hci_conn_idle(struct work_struct *work) 322 { 323 struct hci_conn *conn = container_of(work, struct hci_conn, 324 idle_work.work); 325 struct hci_dev *hdev = conn->hdev; 326 327 BT_DBG("hcon %p mode %d", conn, conn->mode); 328 329 if (test_bit(HCI_RAW, &hdev->flags)) 330 return; 331 332 if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn)) 333 return; 334 335 if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF)) 336 return; 337 338 if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) { 339 struct hci_cp_sniff_subrate cp; 340 cp.handle = cpu_to_le16(conn->handle); 341 cp.max_latency = cpu_to_le16(0); 342 cp.min_remote_timeout = cpu_to_le16(0); 343 cp.min_local_timeout = cpu_to_le16(0); 344 hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp); 345 } 346 347 if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) { 348 struct hci_cp_sniff_mode cp; 349 cp.handle = cpu_to_le16(conn->handle); 350 cp.max_interval = cpu_to_le16(hdev->sniff_max_interval); 351 cp.min_interval = cpu_to_le16(hdev->sniff_min_interval); 352 cp.attempt = cpu_to_le16(4); 353 cp.timeout = cpu_to_le16(1); 354 hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp); 355 } 356 } 357 358 static void hci_conn_auto_accept(struct work_struct *work) 359 { 360 struct hci_conn *conn = container_of(work, struct hci_conn, 361 auto_accept_work.work); 362 363 hci_send_cmd(conn->hdev, HCI_OP_USER_CONFIRM_REPLY, sizeof(conn->dst), 364 &conn->dst); 365 } 366 367 static void le_conn_timeout(struct work_struct *work) 368 { 369 struct hci_conn *conn = container_of(work, struct hci_conn, 370 le_conn_timeout.work); 371 struct hci_dev *hdev = conn->hdev; 372 373 BT_DBG(""); 374 375 /* We could end up here due to having done directed advertising, 376 * so clean up the state if necessary. This should however only 377 * happen with broken hardware or if low duty cycle was used 378 * (which doesn't have a timeout of its own). 379 */ 380 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags)) { 381 u8 enable = 0x00; 382 hci_send_cmd(hdev, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), 383 &enable); 384 hci_le_conn_failed(conn, HCI_ERROR_ADVERTISING_TIMEOUT); 385 return; 386 } 387 388 hci_le_create_connection_cancel(conn); 389 } 390 391 struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst) 392 { 393 struct hci_conn *conn; 394 395 BT_DBG("%s dst %pMR", hdev->name, dst); 396 397 conn = kzalloc(sizeof(struct hci_conn), GFP_KERNEL); 398 if (!conn) 399 return NULL; 400 401 bacpy(&conn->dst, dst); 402 bacpy(&conn->src, &hdev->bdaddr); 403 conn->hdev = hdev; 404 conn->type = type; 405 conn->mode = HCI_CM_ACTIVE; 406 conn->state = BT_OPEN; 407 conn->auth_type = HCI_AT_GENERAL_BONDING; 408 conn->io_capability = hdev->io_capability; 409 conn->remote_auth = 0xff; 410 conn->key_type = 0xff; 411 conn->tx_power = HCI_TX_POWER_INVALID; 412 conn->max_tx_power = HCI_TX_POWER_INVALID; 413 414 set_bit(HCI_CONN_POWER_SAVE, &conn->flags); 415 conn->disc_timeout = HCI_DISCONN_TIMEOUT; 416 417 switch (type) { 418 case ACL_LINK: 419 conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK; 420 break; 421 case LE_LINK: 422 /* conn->src should reflect the local identity address */ 423 hci_copy_identity_address(hdev, &conn->src, &conn->src_type); 424 break; 425 case SCO_LINK: 426 if (lmp_esco_capable(hdev)) 427 conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) | 428 (hdev->esco_type & EDR_ESCO_MASK); 429 else 430 conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK; 431 break; 432 case ESCO_LINK: 433 conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK; 434 break; 435 } 436 437 skb_queue_head_init(&conn->data_q); 438 439 INIT_LIST_HEAD(&conn->chan_list); 440 441 INIT_DELAYED_WORK(&conn->disc_work, hci_conn_timeout); 442 INIT_DELAYED_WORK(&conn->auto_accept_work, hci_conn_auto_accept); 443 INIT_DELAYED_WORK(&conn->idle_work, hci_conn_idle); 444 INIT_DELAYED_WORK(&conn->le_conn_timeout, le_conn_timeout); 445 446 atomic_set(&conn->refcnt, 0); 447 448 hci_dev_hold(hdev); 449 450 hci_conn_hash_add(hdev, conn); 451 if (hdev->notify) 452 hdev->notify(hdev, HCI_NOTIFY_CONN_ADD); 453 454 hci_conn_init_sysfs(conn); 455 456 return conn; 457 } 458 459 int hci_conn_del(struct hci_conn *conn) 460 { 461 struct hci_dev *hdev = conn->hdev; 462 463 BT_DBG("%s hcon %p handle %d", hdev->name, conn, conn->handle); 464 465 cancel_delayed_work_sync(&conn->disc_work); 466 cancel_delayed_work_sync(&conn->auto_accept_work); 467 cancel_delayed_work_sync(&conn->idle_work); 468 469 if (conn->type == ACL_LINK) { 470 struct hci_conn *sco = conn->link; 471 if (sco) 472 sco->link = NULL; 473 474 /* Unacked frames */ 475 hdev->acl_cnt += conn->sent; 476 } else if (conn->type == LE_LINK) { 477 cancel_delayed_work_sync(&conn->le_conn_timeout); 478 479 if (hdev->le_pkts) 480 hdev->le_cnt += conn->sent; 481 else 482 hdev->acl_cnt += conn->sent; 483 } else { 484 struct hci_conn *acl = conn->link; 485 if (acl) { 486 acl->link = NULL; 487 hci_conn_drop(acl); 488 } 489 } 490 491 hci_chan_list_flush(conn); 492 493 if (conn->amp_mgr) 494 amp_mgr_put(conn->amp_mgr); 495 496 hci_conn_hash_del(hdev, conn); 497 if (hdev->notify) 498 hdev->notify(hdev, HCI_NOTIFY_CONN_DEL); 499 500 skb_queue_purge(&conn->data_q); 501 502 hci_conn_del_sysfs(conn); 503 504 hci_dev_put(hdev); 505 506 hci_conn_put(conn); 507 508 return 0; 509 } 510 511 struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src) 512 { 513 int use_src = bacmp(src, BDADDR_ANY); 514 struct hci_dev *hdev = NULL, *d; 515 516 BT_DBG("%pMR -> %pMR", src, dst); 517 518 read_lock(&hci_dev_list_lock); 519 520 list_for_each_entry(d, &hci_dev_list, list) { 521 if (!test_bit(HCI_UP, &d->flags) || 522 test_bit(HCI_RAW, &d->flags) || 523 test_bit(HCI_USER_CHANNEL, &d->dev_flags) || 524 d->dev_type != HCI_BREDR) 525 continue; 526 527 /* Simple routing: 528 * No source address - find interface with bdaddr != dst 529 * Source address - find interface with bdaddr == src 530 */ 531 532 if (use_src) { 533 if (!bacmp(&d->bdaddr, src)) { 534 hdev = d; break; 535 } 536 } else { 537 if (bacmp(&d->bdaddr, dst)) { 538 hdev = d; break; 539 } 540 } 541 } 542 543 if (hdev) 544 hdev = hci_dev_hold(hdev); 545 546 read_unlock(&hci_dev_list_lock); 547 return hdev; 548 } 549 EXPORT_SYMBOL(hci_get_route); 550 551 /* This function requires the caller holds hdev->lock */ 552 void hci_le_conn_failed(struct hci_conn *conn, u8 status) 553 { 554 struct hci_dev *hdev = conn->hdev; 555 556 conn->state = BT_CLOSED; 557 558 mgmt_connect_failed(hdev, &conn->dst, conn->type, conn->dst_type, 559 status); 560 561 hci_proto_connect_cfm(conn, status); 562 563 hci_conn_del(conn); 564 565 /* Since we may have temporarily stopped the background scanning in 566 * favor of connection establishment, we should restart it. 567 */ 568 hci_update_background_scan(hdev); 569 570 /* Re-enable advertising in case this was a failed connection 571 * attempt as a peripheral. 572 */ 573 mgmt_reenable_advertising(hdev); 574 } 575 576 static void create_le_conn_complete(struct hci_dev *hdev, u8 status) 577 { 578 struct hci_conn *conn; 579 580 if (status == 0) 581 return; 582 583 BT_ERR("HCI request failed to create LE connection: status 0x%2.2x", 584 status); 585 586 hci_dev_lock(hdev); 587 588 conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT); 589 if (!conn) 590 goto done; 591 592 hci_le_conn_failed(conn, status); 593 594 done: 595 hci_dev_unlock(hdev); 596 } 597 598 static void hci_req_add_le_create_conn(struct hci_request *req, 599 struct hci_conn *conn) 600 { 601 struct hci_cp_le_create_conn cp; 602 struct hci_dev *hdev = conn->hdev; 603 u8 own_addr_type; 604 605 memset(&cp, 0, sizeof(cp)); 606 607 /* Update random address, but set require_privacy to false so 608 * that we never connect with an unresolvable address. 609 */ 610 if (hci_update_random_address(req, false, &own_addr_type)) 611 return; 612 613 /* Save the address type used for this connnection attempt so we able 614 * to retrieve this information if we need it. 615 */ 616 conn->src_type = own_addr_type; 617 618 cp.scan_interval = cpu_to_le16(hdev->le_scan_interval); 619 cp.scan_window = cpu_to_le16(hdev->le_scan_window); 620 bacpy(&cp.peer_addr, &conn->dst); 621 cp.peer_addr_type = conn->dst_type; 622 cp.own_address_type = own_addr_type; 623 cp.conn_interval_min = cpu_to_le16(conn->le_conn_min_interval); 624 cp.conn_interval_max = cpu_to_le16(conn->le_conn_max_interval); 625 cp.supervision_timeout = cpu_to_le16(0x002a); 626 cp.min_ce_len = cpu_to_le16(0x0000); 627 cp.max_ce_len = cpu_to_le16(0x0000); 628 629 hci_req_add(req, HCI_OP_LE_CREATE_CONN, sizeof(cp), &cp); 630 631 conn->state = BT_CONNECT; 632 } 633 634 static void hci_req_directed_advertising(struct hci_request *req, 635 struct hci_conn *conn) 636 { 637 struct hci_dev *hdev = req->hdev; 638 struct hci_cp_le_set_adv_param cp; 639 u8 own_addr_type; 640 u8 enable; 641 642 enable = 0x00; 643 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable); 644 645 /* Clear the HCI_ADVERTISING bit temporarily so that the 646 * hci_update_random_address knows that it's safe to go ahead 647 * and write a new random address. The flag will be set back on 648 * as soon as the SET_ADV_ENABLE HCI command completes. 649 */ 650 clear_bit(HCI_ADVERTISING, &hdev->dev_flags); 651 652 /* Set require_privacy to false so that the remote device has a 653 * chance of identifying us. 654 */ 655 if (hci_update_random_address(req, false, &own_addr_type) < 0) 656 return; 657 658 memset(&cp, 0, sizeof(cp)); 659 cp.type = LE_ADV_DIRECT_IND; 660 cp.own_address_type = own_addr_type; 661 cp.direct_addr_type = conn->dst_type; 662 bacpy(&cp.direct_addr, &conn->dst); 663 cp.channel_map = hdev->le_adv_channel_map; 664 665 hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp); 666 667 enable = 0x01; 668 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable); 669 670 conn->state = BT_CONNECT; 671 } 672 673 struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst, 674 u8 dst_type, u8 sec_level, u8 auth_type) 675 { 676 struct hci_conn_params *params; 677 struct hci_conn *conn; 678 struct smp_irk *irk; 679 struct hci_request req; 680 int err; 681 682 /* Some devices send ATT messages as soon as the physical link is 683 * established. To be able to handle these ATT messages, the user- 684 * space first establishes the connection and then starts the pairing 685 * process. 686 * 687 * So if a hci_conn object already exists for the following connection 688 * attempt, we simply update pending_sec_level and auth_type fields 689 * and return the object found. 690 */ 691 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, dst); 692 if (conn) { 693 conn->pending_sec_level = sec_level; 694 conn->auth_type = auth_type; 695 goto done; 696 } 697 698 /* Since the controller supports only one LE connection attempt at a 699 * time, we return -EBUSY if there is any connection attempt running. 700 */ 701 conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT); 702 if (conn) 703 return ERR_PTR(-EBUSY); 704 705 /* When given an identity address with existing identity 706 * resolving key, the connection needs to be established 707 * to a resolvable random address. 708 * 709 * This uses the cached random resolvable address from 710 * a previous scan. When no cached address is available, 711 * try connecting to the identity address instead. 712 * 713 * Storing the resolvable random address is required here 714 * to handle connection failures. The address will later 715 * be resolved back into the original identity address 716 * from the connect request. 717 */ 718 irk = hci_find_irk_by_addr(hdev, dst, dst_type); 719 if (irk && bacmp(&irk->rpa, BDADDR_ANY)) { 720 dst = &irk->rpa; 721 dst_type = ADDR_LE_DEV_RANDOM; 722 } 723 724 conn = hci_conn_add(hdev, LE_LINK, dst); 725 if (!conn) 726 return ERR_PTR(-ENOMEM); 727 728 conn->dst_type = dst_type; 729 conn->sec_level = BT_SECURITY_LOW; 730 conn->pending_sec_level = sec_level; 731 conn->auth_type = auth_type; 732 733 hci_req_init(&req, hdev); 734 735 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags)) { 736 hci_req_directed_advertising(&req, conn); 737 goto create_conn; 738 } 739 740 conn->out = true; 741 conn->link_mode |= HCI_LM_MASTER; 742 743 params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type); 744 if (params) { 745 conn->le_conn_min_interval = params->conn_min_interval; 746 conn->le_conn_max_interval = params->conn_max_interval; 747 } else { 748 conn->le_conn_min_interval = hdev->le_conn_min_interval; 749 conn->le_conn_max_interval = hdev->le_conn_max_interval; 750 } 751 752 /* If controller is scanning, we stop it since some controllers are 753 * not able to scan and connect at the same time. Also set the 754 * HCI_LE_SCAN_INTERRUPTED flag so that the command complete 755 * handler for scan disabling knows to set the correct discovery 756 * state. 757 */ 758 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) { 759 hci_req_add_le_scan_disable(&req); 760 set_bit(HCI_LE_SCAN_INTERRUPTED, &hdev->dev_flags); 761 } 762 763 hci_req_add_le_create_conn(&req, conn); 764 765 create_conn: 766 err = hci_req_run(&req, create_le_conn_complete); 767 if (err) { 768 hci_conn_del(conn); 769 return ERR_PTR(err); 770 } 771 772 done: 773 hci_conn_hold(conn); 774 return conn; 775 } 776 777 struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst, 778 u8 sec_level, u8 auth_type) 779 { 780 struct hci_conn *acl; 781 782 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) 783 return ERR_PTR(-ENOTSUPP); 784 785 acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst); 786 if (!acl) { 787 acl = hci_conn_add(hdev, ACL_LINK, dst); 788 if (!acl) 789 return ERR_PTR(-ENOMEM); 790 } 791 792 hci_conn_hold(acl); 793 794 if (acl->state == BT_OPEN || acl->state == BT_CLOSED) { 795 acl->sec_level = BT_SECURITY_LOW; 796 acl->pending_sec_level = sec_level; 797 acl->auth_type = auth_type; 798 hci_acl_create_connection(acl); 799 } 800 801 return acl; 802 } 803 804 struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type, bdaddr_t *dst, 805 __u16 setting) 806 { 807 struct hci_conn *acl; 808 struct hci_conn *sco; 809 810 acl = hci_connect_acl(hdev, dst, BT_SECURITY_LOW, HCI_AT_NO_BONDING); 811 if (IS_ERR(acl)) 812 return acl; 813 814 sco = hci_conn_hash_lookup_ba(hdev, type, dst); 815 if (!sco) { 816 sco = hci_conn_add(hdev, type, dst); 817 if (!sco) { 818 hci_conn_drop(acl); 819 return ERR_PTR(-ENOMEM); 820 } 821 } 822 823 acl->link = sco; 824 sco->link = acl; 825 826 hci_conn_hold(sco); 827 828 sco->setting = setting; 829 830 if (acl->state == BT_CONNECTED && 831 (sco->state == BT_OPEN || sco->state == BT_CLOSED)) { 832 set_bit(HCI_CONN_POWER_SAVE, &acl->flags); 833 hci_conn_enter_active_mode(acl, BT_POWER_FORCE_ACTIVE_ON); 834 835 if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->flags)) { 836 /* defer SCO setup until mode change completed */ 837 set_bit(HCI_CONN_SCO_SETUP_PEND, &acl->flags); 838 return sco; 839 } 840 841 hci_sco_setup(acl, 0x00); 842 } 843 844 return sco; 845 } 846 847 /* Check link security requirement */ 848 int hci_conn_check_link_mode(struct hci_conn *conn) 849 { 850 BT_DBG("hcon %p", conn); 851 852 /* In Secure Connections Only mode, it is required that Secure 853 * Connections is used and the link is encrypted with AES-CCM 854 * using a P-256 authenticated combination key. 855 */ 856 if (test_bit(HCI_SC_ONLY, &conn->hdev->flags)) { 857 if (!hci_conn_sc_enabled(conn) || 858 !test_bit(HCI_CONN_AES_CCM, &conn->flags) || 859 conn->key_type != HCI_LK_AUTH_COMBINATION_P256) 860 return 0; 861 } 862 863 if (hci_conn_ssp_enabled(conn) && !(conn->link_mode & HCI_LM_ENCRYPT)) 864 return 0; 865 866 return 1; 867 } 868 869 /* Authenticate remote device */ 870 static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type) 871 { 872 BT_DBG("hcon %p", conn); 873 874 if (conn->pending_sec_level > sec_level) 875 sec_level = conn->pending_sec_level; 876 877 if (sec_level > conn->sec_level) 878 conn->pending_sec_level = sec_level; 879 else if (conn->link_mode & HCI_LM_AUTH) 880 return 1; 881 882 /* Make sure we preserve an existing MITM requirement*/ 883 auth_type |= (conn->auth_type & 0x01); 884 885 conn->auth_type = auth_type; 886 887 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) { 888 struct hci_cp_auth_requested cp; 889 890 cp.handle = cpu_to_le16(conn->handle); 891 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED, 892 sizeof(cp), &cp); 893 894 /* If we're already encrypted set the REAUTH_PEND flag, 895 * otherwise set the ENCRYPT_PEND. 896 */ 897 if (conn->key_type != 0xff) 898 set_bit(HCI_CONN_REAUTH_PEND, &conn->flags); 899 else 900 set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags); 901 } 902 903 return 0; 904 } 905 906 /* Encrypt the the link */ 907 static void hci_conn_encrypt(struct hci_conn *conn) 908 { 909 BT_DBG("hcon %p", conn); 910 911 if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) { 912 struct hci_cp_set_conn_encrypt cp; 913 cp.handle = cpu_to_le16(conn->handle); 914 cp.encrypt = 0x01; 915 hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp), 916 &cp); 917 } 918 } 919 920 /* Enable security */ 921 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type) 922 { 923 BT_DBG("hcon %p", conn); 924 925 if (conn->type == LE_LINK) 926 return smp_conn_security(conn, sec_level); 927 928 /* For sdp we don't need the link key. */ 929 if (sec_level == BT_SECURITY_SDP) 930 return 1; 931 932 /* For non 2.1 devices and low security level we don't need the link 933 key. */ 934 if (sec_level == BT_SECURITY_LOW && !hci_conn_ssp_enabled(conn)) 935 return 1; 936 937 /* For other security levels we need the link key. */ 938 if (!(conn->link_mode & HCI_LM_AUTH)) 939 goto auth; 940 941 /* An authenticated FIPS approved combination key has sufficient 942 * security for security level 4. */ 943 if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256 && 944 sec_level == BT_SECURITY_FIPS) 945 goto encrypt; 946 947 /* An authenticated combination key has sufficient security for 948 security level 3. */ 949 if ((conn->key_type == HCI_LK_AUTH_COMBINATION_P192 || 950 conn->key_type == HCI_LK_AUTH_COMBINATION_P256) && 951 sec_level == BT_SECURITY_HIGH) 952 goto encrypt; 953 954 /* An unauthenticated combination key has sufficient security for 955 security level 1 and 2. */ 956 if ((conn->key_type == HCI_LK_UNAUTH_COMBINATION_P192 || 957 conn->key_type == HCI_LK_UNAUTH_COMBINATION_P256) && 958 (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW)) 959 goto encrypt; 960 961 /* A combination key has always sufficient security for the security 962 levels 1 or 2. High security level requires the combination key 963 is generated using maximum PIN code length (16). 964 For pre 2.1 units. */ 965 if (conn->key_type == HCI_LK_COMBINATION && 966 (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW || 967 conn->pin_length == 16)) 968 goto encrypt; 969 970 auth: 971 if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) 972 return 0; 973 974 if (!hci_conn_auth(conn, sec_level, auth_type)) 975 return 0; 976 977 encrypt: 978 if (conn->link_mode & HCI_LM_ENCRYPT) 979 return 1; 980 981 hci_conn_encrypt(conn); 982 return 0; 983 } 984 EXPORT_SYMBOL(hci_conn_security); 985 986 /* Check secure link requirement */ 987 int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level) 988 { 989 BT_DBG("hcon %p", conn); 990 991 /* Accept if non-secure or higher security level is required */ 992 if (sec_level != BT_SECURITY_HIGH && sec_level != BT_SECURITY_FIPS) 993 return 1; 994 995 /* Accept if secure or higher security level is already present */ 996 if (conn->sec_level == BT_SECURITY_HIGH || 997 conn->sec_level == BT_SECURITY_FIPS) 998 return 1; 999 1000 /* Reject not secure link */ 1001 return 0; 1002 } 1003 EXPORT_SYMBOL(hci_conn_check_secure); 1004 1005 /* Change link key */ 1006 int hci_conn_change_link_key(struct hci_conn *conn) 1007 { 1008 BT_DBG("hcon %p", conn); 1009 1010 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) { 1011 struct hci_cp_change_conn_link_key cp; 1012 cp.handle = cpu_to_le16(conn->handle); 1013 hci_send_cmd(conn->hdev, HCI_OP_CHANGE_CONN_LINK_KEY, 1014 sizeof(cp), &cp); 1015 } 1016 1017 return 0; 1018 } 1019 1020 /* Switch role */ 1021 int hci_conn_switch_role(struct hci_conn *conn, __u8 role) 1022 { 1023 BT_DBG("hcon %p", conn); 1024 1025 if (!role && conn->link_mode & HCI_LM_MASTER) 1026 return 1; 1027 1028 if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->flags)) { 1029 struct hci_cp_switch_role cp; 1030 bacpy(&cp.bdaddr, &conn->dst); 1031 cp.role = role; 1032 hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp); 1033 } 1034 1035 return 0; 1036 } 1037 EXPORT_SYMBOL(hci_conn_switch_role); 1038 1039 /* Enter active mode */ 1040 void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active) 1041 { 1042 struct hci_dev *hdev = conn->hdev; 1043 1044 BT_DBG("hcon %p mode %d", conn, conn->mode); 1045 1046 if (test_bit(HCI_RAW, &hdev->flags)) 1047 return; 1048 1049 if (conn->mode != HCI_CM_SNIFF) 1050 goto timer; 1051 1052 if (!test_bit(HCI_CONN_POWER_SAVE, &conn->flags) && !force_active) 1053 goto timer; 1054 1055 if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) { 1056 struct hci_cp_exit_sniff_mode cp; 1057 cp.handle = cpu_to_le16(conn->handle); 1058 hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp); 1059 } 1060 1061 timer: 1062 if (hdev->idle_timeout > 0) 1063 queue_delayed_work(hdev->workqueue, &conn->idle_work, 1064 msecs_to_jiffies(hdev->idle_timeout)); 1065 } 1066 1067 /* Drop all connection on the device */ 1068 void hci_conn_hash_flush(struct hci_dev *hdev) 1069 { 1070 struct hci_conn_hash *h = &hdev->conn_hash; 1071 struct hci_conn *c, *n; 1072 1073 BT_DBG("hdev %s", hdev->name); 1074 1075 list_for_each_entry_safe(c, n, &h->list, list) { 1076 c->state = BT_CLOSED; 1077 1078 hci_proto_disconn_cfm(c, HCI_ERROR_LOCAL_HOST_TERM); 1079 hci_conn_del(c); 1080 } 1081 } 1082 1083 /* Check pending connect attempts */ 1084 void hci_conn_check_pending(struct hci_dev *hdev) 1085 { 1086 struct hci_conn *conn; 1087 1088 BT_DBG("hdev %s", hdev->name); 1089 1090 hci_dev_lock(hdev); 1091 1092 conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2); 1093 if (conn) 1094 hci_acl_create_connection(conn); 1095 1096 hci_dev_unlock(hdev); 1097 } 1098 1099 int hci_get_conn_list(void __user *arg) 1100 { 1101 struct hci_conn *c; 1102 struct hci_conn_list_req req, *cl; 1103 struct hci_conn_info *ci; 1104 struct hci_dev *hdev; 1105 int n = 0, size, err; 1106 1107 if (copy_from_user(&req, arg, sizeof(req))) 1108 return -EFAULT; 1109 1110 if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci)) 1111 return -EINVAL; 1112 1113 size = sizeof(req) + req.conn_num * sizeof(*ci); 1114 1115 cl = kmalloc(size, GFP_KERNEL); 1116 if (!cl) 1117 return -ENOMEM; 1118 1119 hdev = hci_dev_get(req.dev_id); 1120 if (!hdev) { 1121 kfree(cl); 1122 return -ENODEV; 1123 } 1124 1125 ci = cl->conn_info; 1126 1127 hci_dev_lock(hdev); 1128 list_for_each_entry(c, &hdev->conn_hash.list, list) { 1129 bacpy(&(ci + n)->bdaddr, &c->dst); 1130 (ci + n)->handle = c->handle; 1131 (ci + n)->type = c->type; 1132 (ci + n)->out = c->out; 1133 (ci + n)->state = c->state; 1134 (ci + n)->link_mode = c->link_mode; 1135 if (++n >= req.conn_num) 1136 break; 1137 } 1138 hci_dev_unlock(hdev); 1139 1140 cl->dev_id = hdev->id; 1141 cl->conn_num = n; 1142 size = sizeof(req) + n * sizeof(*ci); 1143 1144 hci_dev_put(hdev); 1145 1146 err = copy_to_user(arg, cl, size); 1147 kfree(cl); 1148 1149 return err ? -EFAULT : 0; 1150 } 1151 1152 int hci_get_conn_info(struct hci_dev *hdev, void __user *arg) 1153 { 1154 struct hci_conn_info_req req; 1155 struct hci_conn_info ci; 1156 struct hci_conn *conn; 1157 char __user *ptr = arg + sizeof(req); 1158 1159 if (copy_from_user(&req, arg, sizeof(req))) 1160 return -EFAULT; 1161 1162 hci_dev_lock(hdev); 1163 conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr); 1164 if (conn) { 1165 bacpy(&ci.bdaddr, &conn->dst); 1166 ci.handle = conn->handle; 1167 ci.type = conn->type; 1168 ci.out = conn->out; 1169 ci.state = conn->state; 1170 ci.link_mode = conn->link_mode; 1171 } 1172 hci_dev_unlock(hdev); 1173 1174 if (!conn) 1175 return -ENOENT; 1176 1177 return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0; 1178 } 1179 1180 int hci_get_auth_info(struct hci_dev *hdev, void __user *arg) 1181 { 1182 struct hci_auth_info_req req; 1183 struct hci_conn *conn; 1184 1185 if (copy_from_user(&req, arg, sizeof(req))) 1186 return -EFAULT; 1187 1188 hci_dev_lock(hdev); 1189 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr); 1190 if (conn) 1191 req.type = conn->auth_type; 1192 hci_dev_unlock(hdev); 1193 1194 if (!conn) 1195 return -ENOENT; 1196 1197 return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0; 1198 } 1199 1200 struct hci_chan *hci_chan_create(struct hci_conn *conn) 1201 { 1202 struct hci_dev *hdev = conn->hdev; 1203 struct hci_chan *chan; 1204 1205 BT_DBG("%s hcon %p", hdev->name, conn); 1206 1207 chan = kzalloc(sizeof(struct hci_chan), GFP_KERNEL); 1208 if (!chan) 1209 return NULL; 1210 1211 chan->conn = conn; 1212 skb_queue_head_init(&chan->data_q); 1213 chan->state = BT_CONNECTED; 1214 1215 list_add_rcu(&chan->list, &conn->chan_list); 1216 1217 return chan; 1218 } 1219 1220 void hci_chan_del(struct hci_chan *chan) 1221 { 1222 struct hci_conn *conn = chan->conn; 1223 struct hci_dev *hdev = conn->hdev; 1224 1225 BT_DBG("%s hcon %p chan %p", hdev->name, conn, chan); 1226 1227 list_del_rcu(&chan->list); 1228 1229 synchronize_rcu(); 1230 1231 hci_conn_drop(conn); 1232 1233 skb_queue_purge(&chan->data_q); 1234 kfree(chan); 1235 } 1236 1237 void hci_chan_list_flush(struct hci_conn *conn) 1238 { 1239 struct hci_chan *chan, *n; 1240 1241 BT_DBG("hcon %p", conn); 1242 1243 list_for_each_entry_safe(chan, n, &conn->chan_list, list) 1244 hci_chan_del(chan); 1245 } 1246 1247 static struct hci_chan *__hci_chan_lookup_handle(struct hci_conn *hcon, 1248 __u16 handle) 1249 { 1250 struct hci_chan *hchan; 1251 1252 list_for_each_entry(hchan, &hcon->chan_list, list) { 1253 if (hchan->handle == handle) 1254 return hchan; 1255 } 1256 1257 return NULL; 1258 } 1259 1260 struct hci_chan *hci_chan_lookup_handle(struct hci_dev *hdev, __u16 handle) 1261 { 1262 struct hci_conn_hash *h = &hdev->conn_hash; 1263 struct hci_conn *hcon; 1264 struct hci_chan *hchan = NULL; 1265 1266 rcu_read_lock(); 1267 1268 list_for_each_entry_rcu(hcon, &h->list, list) { 1269 hchan = __hci_chan_lookup_handle(hcon, handle); 1270 if (hchan) 1271 break; 1272 } 1273 1274 rcu_read_unlock(); 1275 1276 return hchan; 1277 } 1278