net/bluetooth/hci_conn.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI connection handling. */
  26
  27 #include <linux/export.h>
  28 #include <linux/debugfs.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/l2cap.h>
  33
  34 #include "hci_request.h"
  35 #include "smp.h"
  36 #include "a2mp.h"
  37
  38 struct sco_param {
  39         u16 pkt_type;
  40         u16 max_latency;
  41         u8  retrans_effort;
  42 };
  43
  44 static const struct sco_param esco_param_cvsd[] = {
  45         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000a,   0x01 }, /* S3 */
  46         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x0007,   0x01 }, /* S2 */
  47         { EDR_ESCO_MASK | ESCO_EV3,   0x0007,   0x01 }, /* S1 */
  48         { EDR_ESCO_MASK | ESCO_HV3,   0xffff,   0x01 }, /* D1 */
  49         { EDR_ESCO_MASK | ESCO_HV1,   0xffff,   0x01 }, /* D0 */
  50 };
  51
  52 static const struct sco_param sco_param_cvsd[] = {
  53         { EDR_ESCO_MASK | ESCO_HV3,   0xffff,   0xff }, /* D1 */
  54         { EDR_ESCO_MASK | ESCO_HV1,   0xffff,   0xff }, /* D0 */
  55 };
  56
  57 static const struct sco_param esco_param_msbc[] = {
  58         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000d,   0x02 }, /* T2 */
  59         { EDR_ESCO_MASK | ESCO_EV3,   0x0008,   0x02 }, /* T1 */
  60 };
  61
  62 static void hci_le_create_connection_cancel(struct hci_conn *conn)
  63 {
  64         hci_send_cmd(conn->hdev, HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL);
  65 }
  66
  67 /* This function requires the caller holds hdev->lock */
  68 static void hci_connect_le_scan_cleanup(struct hci_conn *conn)
  69 {
  70         struct hci_conn_params *params;
  71         struct smp_irk *irk;
  72         bdaddr_t *bdaddr;
  73         u8 bdaddr_type;
  74
  75         bdaddr = &conn->dst;
  76         bdaddr_type = conn->dst_type;
  77
  78         /* Check if we need to convert to identity address */
  79         irk = hci_get_irk(conn->hdev, bdaddr, bdaddr_type);
  80         if (irk) {
  81                 bdaddr = &irk->bdaddr;
  82                 bdaddr_type = irk->addr_type;
  83         }
  84
  85         params = hci_explicit_connect_lookup(conn->hdev, bdaddr, bdaddr_type);
  86         if (!params)
  87                 return;
  88
  89         /* The connection attempt was doing scan for new RPA, and is
  90          * in scan phase. If params are not associated with any other
  91          * autoconnect action, remove them completely. If they are, just unmark
  92          * them as waiting for connection, by clearing explicit_connect field.
  93          */
  94         if (params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
  95                 hci_conn_params_del(conn->hdev, bdaddr, bdaddr_type);
  96         } else {
  97                 params->explicit_connect = false;
  98                 hci_update_background_scan(conn->hdev);
  99         }
 100 }
 101
 102 static void hci_conn_cleanup(struct hci_conn *conn)
 103 {
 104         struct hci_dev *hdev = conn->hdev;
 105
 106         if (test_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags))
 107                 hci_conn_params_del(conn->hdev, &conn->dst, conn->dst_type);
 108
 109         hci_chan_list_flush(conn);
 110
 111         hci_conn_hash_del(hdev, conn);
 112
 113         if (hdev->notify)
 114                 hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
 115
 116         hci_conn_del_sysfs(conn);
 117
 118         debugfs_remove_recursive(conn->debugfs);
 119
 120         hci_dev_put(hdev);
 121
 122         hci_conn_put(conn);
 123 }
 124
 125 /* This function requires the caller holds hdev->lock */
 126 static void hci_connect_le_scan_remove(struct hci_conn *conn)
 127 {
 128         hci_connect_le_scan_cleanup(conn);
 129
 130         /* We can't call hci_conn_del here since that would deadlock
 131          * with trying to call cancel_delayed_work_sync(&conn->disc_work).
 132          * Instead, call just hci_conn_cleanup() which contains the bare
 133          * minimum cleanup operations needed for a connection in this
 134          * state.
 135          */
 136         hci_conn_cleanup(conn);
 137 }
 138
 139 static void hci_acl_create_connection(struct hci_conn *conn)
 140 {
 141         struct hci_dev *hdev = conn->hdev;
 142         struct inquiry_entry *ie;
 143         struct hci_cp_create_conn cp;
 144
 145         BT_DBG("hcon %p", conn);
 146
 147         conn->state = BT_CONNECT;
 148         conn->out = true;
 149         conn->role = HCI_ROLE_MASTER;
 150
 151         conn->attempt++;
 152
 153         conn->link_policy = hdev->link_policy;
 154
 155         memset(&cp, 0, sizeof(cp));
 156         bacpy(&cp.bdaddr, &conn->dst);
 157         cp.pscan_rep_mode = 0x02;
 158
 159         ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
 160         if (ie) {
 161                 if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
 162                         cp.pscan_rep_mode = ie->data.pscan_rep_mode;
 163                         cp.pscan_mode     = ie->data.pscan_mode;
 164                         cp.clock_offset   = ie->data.clock_offset |
 165                                             cpu_to_le16(0x8000);
 166                 }
 167
 168                 memcpy(conn->dev_class, ie->data.dev_class, 3);
 169                 if (ie->data.ssp_mode > 0)
 170                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
 171         }
 172
 173         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 174         if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
 175                 cp.role_switch = 0x01;
 176         else
 177                 cp.role_switch = 0x00;
 178
 179         hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
 180 }
 181
 182 static void hci_acl_create_connection_cancel(struct hci_conn *conn)
 183 {
 184         struct hci_cp_create_conn_cancel cp;
 185
 186         BT_DBG("hcon %p", conn);
 187
 188         if (conn->hdev->hci_ver < BLUETOOTH_VER_1_2)
 189                 return;
 190
 191         bacpy(&cp.bdaddr, &conn->dst);
 192         hci_send_cmd(conn->hdev, HCI_OP_CREATE_CONN_CANCEL, sizeof(cp), &cp);
 193 }
 194
 195 static void hci_reject_sco(struct hci_conn *conn)
 196 {
 197         struct hci_cp_reject_sync_conn_req cp;
 198
 199         cp.reason = HCI_ERROR_REJ_LIMITED_RESOURCES;
 200         bacpy(&cp.bdaddr, &conn->dst);
 201
 202         hci_send_cmd(conn->hdev, HCI_OP_REJECT_SYNC_CONN_REQ, sizeof(cp), &cp);
 203 }
 204
 205 int hci_disconnect(struct hci_conn *conn, __u8 reason)
 206 {
 207         struct hci_cp_disconnect cp;
 208
 209         BT_DBG("hcon %p", conn);
 210
 211         /* When we are master of an established connection and it enters
 212          * the disconnect timeout, then go ahead and try to read the
 213          * current clock offset.  Processing of the result is done
 214          * within the event handling and hci_clock_offset_evt function.
 215          */
 216         if (conn->type == ACL_LINK && conn->role == HCI_ROLE_MASTER) {
 217                 struct hci_dev *hdev = conn->hdev;
 218                 struct hci_cp_read_clock_offset clkoff_cp;
 219
 220                 clkoff_cp.handle = cpu_to_le16(conn->handle);
 221                 hci_send_cmd(hdev, HCI_OP_READ_CLOCK_OFFSET, sizeof(clkoff_cp),
 222                              &clkoff_cp);
 223         }
 224
 225         conn->state = BT_DISCONN;
 226
 227         cp.handle = cpu_to_le16(conn->handle);
 228         cp.reason = reason;
 229         return hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp);
 230 }
 231
 232 static void hci_amp_disconn(struct hci_conn *conn)
 233 {
 234         struct hci_cp_disconn_phy_link cp;
 235
 236         BT_DBG("hcon %p", conn);
 237
 238         conn->state = BT_DISCONN;
 239
 240         cp.phy_handle = HCI_PHY_HANDLE(conn->handle);
 241         cp.reason = hci_proto_disconn_ind(conn);
 242         hci_send_cmd(conn->hdev, HCI_OP_DISCONN_PHY_LINK,
 243                      sizeof(cp), &cp);
 244 }
 245
 246 static void hci_add_sco(struct hci_conn *conn, __u16 handle)
 247 {
 248         struct hci_dev *hdev = conn->hdev;
 249         struct hci_cp_add_sco cp;
 250
 251         BT_DBG("hcon %p", conn);
 252
 253         conn->state = BT_CONNECT;
 254         conn->out = true;
 255
 256         conn->attempt++;
 257
 258         cp.handle   = cpu_to_le16(handle);
 259         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 260
 261         hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
 262 }
 263
 264 bool hci_setup_sync(struct hci_conn *conn, __u16 handle)
 265 {
 266         struct hci_dev *hdev = conn->hdev;
 267         struct hci_cp_setup_sync_conn cp;
 268         const struct sco_param *param;
 269
 270         BT_DBG("hcon %p", conn);
 271
 272         conn->state = BT_CONNECT;
 273         conn->out = true;
 274
 275         conn->attempt++;
 276
 277         cp.handle   = cpu_to_le16(handle);
 278
 279         cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
 280         cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
 281         cp.voice_setting  = cpu_to_le16(conn->setting);
 282
 283         switch (conn->setting & SCO_AIRMODE_MASK) {
 284         case SCO_AIRMODE_TRANSP:
 285                 if (conn->attempt > ARRAY_SIZE(esco_param_msbc))
 286                         return false;
 287                 param = &esco_param_msbc[conn->attempt - 1];
 288                 break;
 289         case SCO_AIRMODE_CVSD:
 290                 if (lmp_esco_capable(conn->link)) {
 291                         if (conn->attempt > ARRAY_SIZE(esco_param_cvsd))
 292                                 return false;
 293                         param = &esco_param_cvsd[conn->attempt - 1];
 294                 } else {
 295                         if (conn->attempt > ARRAY_SIZE(sco_param_cvsd))
 296                                 return false;
 297                         param = &sco_param_cvsd[conn->attempt - 1];
 298                 }
 299                 break;
 300         default:
 301                 return false;
 302         }
 303
 304         cp.retrans_effort = param->retrans_effort;
 305         cp.pkt_type = __cpu_to_le16(param->pkt_type);
 306         cp.max_latency = __cpu_to_le16(param->max_latency);
 307
 308         if (hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp) < 0)
 309                 return false;
 310
 311         return true;
 312 }
 313
 314 u8 hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max, u16 latency,
 315                       u16 to_multiplier)
 316 {
 317         struct hci_dev *hdev = conn->hdev;
 318         struct hci_conn_params *params;
 319         struct hci_cp_le_conn_update cp;
 320
 321         hci_dev_lock(hdev);
 322
 323         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
 324         if (params) {
 325                 params->conn_min_interval = min;
 326                 params->conn_max_interval = max;
 327                 params->conn_latency = latency;
 328                 params->supervision_timeout = to_multiplier;
 329         }
 330
 331         hci_dev_unlock(hdev);
 332
 333         memset(&cp, 0, sizeof(cp));
 334         cp.handle               = cpu_to_le16(conn->handle);
 335         cp.conn_interval_min    = cpu_to_le16(min);
 336         cp.conn_interval_max    = cpu_to_le16(max);
 337         cp.conn_latency         = cpu_to_le16(latency);
 338         cp.supervision_timeout  = cpu_to_le16(to_multiplier);
 339         cp.min_ce_len           = cpu_to_le16(0x0000);
 340         cp.max_ce_len           = cpu_to_le16(0x0000);
 341
 342         hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp);
 343
 344         if (params)
 345                 return 0x01;
 346
 347         return 0x00;
 348 }
 349
 350 void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __le64 rand,
 351                       __u8 ltk[16], __u8 key_size)
 352 {
 353         struct hci_dev *hdev = conn->hdev;
 354         struct hci_cp_le_start_enc cp;
 355
 356         BT_DBG("hcon %p", conn);
 357
 358         memset(&cp, 0, sizeof(cp));
 359
 360         cp.handle = cpu_to_le16(conn->handle);
 361         cp.rand = rand;
 362         cp.ediv = ediv;
 363         memcpy(cp.ltk, ltk, key_size);
 364
 365         hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp);
 366 }
 367
 368 /* Device _must_ be locked */
 369 void hci_sco_setup(struct hci_conn *conn, __u8 status)
 370 {
 371         struct hci_conn *sco = conn->link;
 372
 373         if (!sco)
 374                 return;
 375
 376         BT_DBG("hcon %p", conn);
 377
 378         if (!status) {
 379                 if (lmp_esco_capable(conn->hdev))
 380                         hci_setup_sync(sco, conn->handle);
 381                 else
 382                         hci_add_sco(sco, conn->handle);
 383         } else {
 384                 hci_connect_cfm(sco, status);
 385                 hci_conn_del(sco);
 386         }
 387 }
 388
 389 static void hci_conn_timeout(struct work_struct *work)
 390 {
 391         struct hci_conn *conn = container_of(work, struct hci_conn,
 392                                              disc_work.work);
 393         int refcnt = atomic_read(&conn->refcnt);
 394
 395         BT_DBG("hcon %p state %s", conn, state_to_string(conn->state));
 396
 397         WARN_ON(refcnt < 0);
 398
 399         /* FIXME: It was observed that in pairing failed scenario, refcnt
 400          * drops below 0. Probably this is because l2cap_conn_del calls
 401          * l2cap_chan_del for each channel, and inside l2cap_chan_del conn is
 402          * dropped. After that loop hci_chan_del is called which also drops
 403          * conn. For now make sure that ACL is alive if refcnt is higher then 0,
 404          * otherwise drop it.
 405          */
 406         if (refcnt > 0)
 407                 return;
 408
 409         switch (conn->state) {
 410         case BT_CONNECT:
 411         case BT_CONNECT2:
 412                 if (conn->out) {
 413                         if (conn->type == ACL_LINK)
 414                                 hci_acl_create_connection_cancel(conn);
 415                         else if (conn->type == LE_LINK) {
 416                                 if (test_bit(HCI_CONN_SCANNING, &conn->flags))
 417                                         hci_connect_le_scan_remove(conn);
 418                                 else
 419                                         hci_le_create_connection_cancel(conn);
 420                         }
 421                 } else if (conn->type == SCO_LINK || conn->type == ESCO_LINK) {
 422                         hci_reject_sco(conn);
 423                 }
 424                 break;
 425         case BT_CONFIG:
 426         case BT_CONNECTED:
 427                 if (conn->type == AMP_LINK) {
 428                         hci_amp_disconn(conn);
 429                 } else {
 430                         __u8 reason = hci_proto_disconn_ind(conn);
 431                         hci_disconnect(conn, reason);
 432                 }
 433                 break;
 434         default:
 435                 conn->state = BT_CLOSED;
 436                 break;
 437         }
 438 }
 439
 440 /* Enter sniff mode */
 441 static void hci_conn_idle(struct work_struct *work)
 442 {
 443         struct hci_conn *conn = container_of(work, struct hci_conn,
 444                                              idle_work.work);
 445         struct hci_dev *hdev = conn->hdev;
 446
 447         BT_DBG("hcon %p mode %d", conn, conn->mode);
 448
 449         if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn))
 450                 return;
 451
 452         if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF))
 453                 return;
 454
 455         if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
 456                 struct hci_cp_sniff_subrate cp;
 457                 cp.handle             = cpu_to_le16(conn->handle);
 458                 cp.max_latency        = cpu_to_le16(0);
 459                 cp.min_remote_timeout = cpu_to_le16(0);
 460                 cp.min_local_timeout  = cpu_to_le16(0);
 461                 hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
 462         }
 463
 464         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
 465                 struct hci_cp_sniff_mode cp;
 466                 cp.handle       = cpu_to_le16(conn->handle);
 467                 cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
 468                 cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
 469                 cp.attempt      = cpu_to_le16(4);
 470                 cp.timeout      = cpu_to_le16(1);
 471                 hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
 472         }
 473 }
 474
 475 static void hci_conn_auto_accept(struct work_struct *work)
 476 {
 477         struct hci_conn *conn = container_of(work, struct hci_conn,
 478                                              auto_accept_work.work);
 479
 480         hci_send_cmd(conn->hdev, HCI_OP_USER_CONFIRM_REPLY, sizeof(conn->dst),
 481                      &conn->dst);
 482 }
 483
 484 static void le_conn_timeout(struct work_struct *work)
 485 {
 486         struct hci_conn *conn = container_of(work, struct hci_conn,
 487                                              le_conn_timeout.work);
 488         struct hci_dev *hdev = conn->hdev;
 489
 490         BT_DBG("");
 491
 492         /* We could end up here due to having done directed advertising,
 493          * so clean up the state if necessary. This should however only
 494          * happen with broken hardware or if low duty cycle was used
 495          * (which doesn't have a timeout of its own).
 496          */
 497         if (conn->role == HCI_ROLE_SLAVE) {
 498                 u8 enable = 0x00;
 499                 hci_send_cmd(hdev, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable),
 500                              &enable);
 501                 hci_le_conn_failed(conn, HCI_ERROR_ADVERTISING_TIMEOUT);
 502                 return;
 503         }
 504
 505         hci_le_create_connection_cancel(conn);
 506 }
 507
 508 struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst,
 509                               u8 role)
 510 {
 511         struct hci_conn *conn;
 512
 513         BT_DBG("%s dst %pMR", hdev->name, dst);
 514
 515         conn = kzalloc(sizeof(*conn), GFP_KERNEL);
 516         if (!conn)
 517                 return NULL;
 518
 519         bacpy(&conn->dst, dst);
 520         bacpy(&conn->src, &hdev->bdaddr);
 521         conn->hdev  = hdev;
 522         conn->type  = type;
 523         conn->role  = role;
 524         conn->mode  = HCI_CM_ACTIVE;
 525         conn->state = BT_OPEN;
 526         conn->auth_type = HCI_AT_GENERAL_BONDING;
 527         conn->io_capability = hdev->io_capability;
 528         conn->remote_auth = 0xff;
 529         conn->key_type = 0xff;
 530         conn->rssi = HCI_RSSI_INVALID;
 531         conn->tx_power = HCI_TX_POWER_INVALID;
 532         conn->max_tx_power = HCI_TX_POWER_INVALID;
 533
 534         set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
 535         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
 536
 537         if (conn->role == HCI_ROLE_MASTER)
 538                 conn->out = true;
 539
 540         switch (type) {
 541         case ACL_LINK:
 542                 conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
 543                 break;
 544         case LE_LINK:
 545                 /* conn->src should reflect the local identity address */
 546                 hci_copy_identity_address(hdev, &conn->src, &conn->src_type);
 547                 break;
 548         case SCO_LINK:
 549                 if (lmp_esco_capable(hdev))
 550                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
 551                                         (hdev->esco_type & EDR_ESCO_MASK);
 552                 else
 553                         conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
 554                 break;
 555         case ESCO_LINK:
 556                 conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
 557                 break;
 558         }
 559
 560         skb_queue_head_init(&conn->data_q);
 561
 562         INIT_LIST_HEAD(&conn->chan_list);
 563
 564         INIT_DELAYED_WORK(&conn->disc_work, hci_conn_timeout);
 565         INIT_DELAYED_WORK(&conn->auto_accept_work, hci_conn_auto_accept);
 566         INIT_DELAYED_WORK(&conn->idle_work, hci_conn_idle);
 567         INIT_DELAYED_WORK(&conn->le_conn_timeout, le_conn_timeout);
 568
 569         atomic_set(&conn->refcnt, 0);
 570
 571         hci_dev_hold(hdev);
 572
 573         hci_conn_hash_add(hdev, conn);
 574         if (hdev->notify)
 575                 hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
 576
 577         hci_conn_init_sysfs(conn);
 578
 579         return conn;
 580 }
 581
 582 int hci_conn_del(struct hci_conn *conn)
 583 {
 584         struct hci_dev *hdev = conn->hdev;
 585
 586         BT_DBG("%s hcon %p handle %d", hdev->name, conn, conn->handle);
 587
 588         cancel_delayed_work_sync(&conn->disc_work);
 589         cancel_delayed_work_sync(&conn->auto_accept_work);
 590         cancel_delayed_work_sync(&conn->idle_work);
 591
 592         if (conn->type == ACL_LINK) {
 593                 struct hci_conn *sco = conn->link;
 594                 if (sco)
 595                         sco->link = NULL;
 596
 597                 /* Unacked frames */
 598                 hdev->acl_cnt += conn->sent;
 599         } else if (conn->type == LE_LINK) {
 600                 cancel_delayed_work(&conn->le_conn_timeout);
 601
 602                 if (hdev->le_pkts)
 603                         hdev->le_cnt += conn->sent;
 604                 else
 605                         hdev->acl_cnt += conn->sent;
 606         } else {
 607                 struct hci_conn *acl = conn->link;
 608                 if (acl) {
 609                         acl->link = NULL;
 610                         hci_conn_drop(acl);
 611                 }
 612         }
 613
 614         if (conn->amp_mgr)
 615                 amp_mgr_put(conn->amp_mgr);
 616
 617         skb_queue_purge(&conn->data_q);
 618
 619         /* Remove the connection from the list and cleanup its remaining
 620          * state. This is a separate function since for some cases like
 621          * BT_CONNECT_SCAN we *only* want the cleanup part without the
 622          * rest of hci_conn_del.
 623          */
 624         hci_conn_cleanup(conn);
 625
 626         return 0;
 627 }
 628
 629 struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src)
 630 {
 631         int use_src = bacmp(src, BDADDR_ANY);
 632         struct hci_dev *hdev = NULL, *d;
 633
 634         BT_DBG("%pMR -> %pMR", src, dst);
 635
 636         read_lock(&hci_dev_list_lock);
 637
 638         list_for_each_entry(d, &hci_dev_list, list) {
 639                 if (!test_bit(HCI_UP, &d->flags) ||
 640                     hci_dev_test_flag(d, HCI_USER_CHANNEL) ||
 641                     d->dev_type != HCI_BREDR)
 642                         continue;
 643
 644                 /* Simple routing:
 645                  *   No source address - find interface with bdaddr != dst
 646                  *   Source address    - find interface with bdaddr == src
 647                  */
 648
 649                 if (use_src) {
 650                         if (!bacmp(&d->bdaddr, src)) {
 651                                 hdev = d; break;
 652                         }
 653                 } else {
 654                         if (bacmp(&d->bdaddr, dst)) {
 655                                 hdev = d; break;
 656                         }
 657                 }
 658         }
 659
 660         if (hdev)
 661                 hdev = hci_dev_hold(hdev);
 662
 663         read_unlock(&hci_dev_list_lock);
 664         return hdev;
 665 }
 666 EXPORT_SYMBOL(hci_get_route);
 667
 668 /* This function requires the caller holds hdev->lock */
 669 void hci_le_conn_failed(struct hci_conn *conn, u8 status)
 670 {
 671         struct hci_dev *hdev = conn->hdev;
 672         struct hci_conn_params *params;
 673
 674         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
 675                                            conn->dst_type);
 676         if (params && params->conn) {
 677                 hci_conn_drop(params->conn);
 678                 hci_conn_put(params->conn);
 679                 params->conn = NULL;
 680         }
 681
 682         conn->state = BT_CLOSED;
 683
 684         mgmt_connect_failed(hdev, &conn->dst, conn->type, conn->dst_type,
 685                             status);
 686
 687         hci_connect_cfm(conn, status);
 688
 689         hci_conn_del(conn);
 690
 691         /* Since we may have temporarily stopped the background scanning in
 692          * favor of connection establishment, we should restart it.
 693          */
 694         hci_update_background_scan(hdev);
 695
 696         /* Re-enable advertising in case this was a failed connection
 697          * attempt as a peripheral.
 698          */
 699         mgmt_reenable_advertising(hdev);
 700 }
 701
 702 static void create_le_conn_complete(struct hci_dev *hdev, u8 status, u16 opcode)
 703 {
 704         struct hci_conn *conn;
 705
 706         hci_dev_lock(hdev);
 707
 708         conn = hci_lookup_le_connect(hdev);
 709
 710         if (!status) {
 711                 hci_connect_le_scan_cleanup(conn);
 712                 goto done;
 713         }
 714
 715         BT_ERR("HCI request failed to create LE connection: status 0x%2.2x",
 716                status);
 717
 718         if (!conn)
 719                 goto done;
 720
 721         hci_le_conn_failed(conn, status);
 722
 723 done:
 724         hci_dev_unlock(hdev);
 725 }
 726
 727 static void hci_req_add_le_create_conn(struct hci_request *req,
 728                                        struct hci_conn *conn)
 729 {
 730         struct hci_cp_le_create_conn cp;
 731         struct hci_dev *hdev = conn->hdev;
 732         u8 own_addr_type;
 733
 734         memset(&cp, 0, sizeof(cp));
 735
 736         /* Update random address, but set require_privacy to false so
 737          * that we never connect with an non-resolvable address.
 738          */
 739         if (hci_update_random_address(req, false, &own_addr_type))
 740                 return;
 741
 742         cp.scan_interval = cpu_to_le16(hdev->le_scan_interval);
 743         cp.scan_window = cpu_to_le16(hdev->le_scan_window);
 744         bacpy(&cp.peer_addr, &conn->dst);
 745         cp.peer_addr_type = conn->dst_type;
 746         cp.own_address_type = own_addr_type;
 747         cp.conn_interval_min = cpu_to_le16(conn->le_conn_min_interval);
 748         cp.conn_interval_max = cpu_to_le16(conn->le_conn_max_interval);
 749         cp.conn_latency = cpu_to_le16(conn->le_conn_latency);
 750         cp.supervision_timeout = cpu_to_le16(conn->le_supv_timeout);
 751         cp.min_ce_len = cpu_to_le16(0x0000);
 752         cp.max_ce_len = cpu_to_le16(0x0000);
 753
 754         hci_req_add(req, HCI_OP_LE_CREATE_CONN, sizeof(cp), &cp);
 755
 756         conn->state = BT_CONNECT;
 757         clear_bit(HCI_CONN_SCANNING, &conn->flags);
 758 }
 759
 760 static void hci_req_directed_advertising(struct hci_request *req,
 761                                          struct hci_conn *conn)
 762 {
 763         struct hci_dev *hdev = req->hdev;
 764         struct hci_cp_le_set_adv_param cp;
 765         u8 own_addr_type;
 766         u8 enable;
 767
 768         /* Clear the HCI_LE_ADV bit temporarily so that the
 769          * hci_update_random_address knows that it's safe to go ahead
 770          * and write a new random address. The flag will be set back on
 771          * as soon as the SET_ADV_ENABLE HCI command completes.
 772          */
 773         hci_dev_clear_flag(hdev, HCI_LE_ADV);
 774
 775         /* Set require_privacy to false so that the remote device has a
 776          * chance of identifying us.
 777          */
 778         if (hci_update_random_address(req, false, &own_addr_type) < 0)
 779                 return;
 780
 781         memset(&cp, 0, sizeof(cp));
 782         cp.type = LE_ADV_DIRECT_IND;
 783         cp.own_address_type = own_addr_type;
 784         cp.direct_addr_type = conn->dst_type;
 785         bacpy(&cp.direct_addr, &conn->dst);
 786         cp.channel_map = hdev->le_adv_channel_map;
 787
 788         hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
 789
 790         enable = 0x01;
 791         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
 792
 793         conn->state = BT_CONNECT;
 794 }
 795
 796 struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,
 797                                 u8 dst_type, u8 sec_level, u16 conn_timeout,
 798                                 u8 role)
 799 {
 800         struct hci_conn_params *params;
 801         struct hci_conn *conn, *conn_unfinished;
 802         struct smp_irk *irk;
 803         struct hci_request req;
 804         int err;
 805
 806         /* Let's make sure that le is enabled.*/
 807         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
 808                 if (lmp_le_capable(hdev))
 809                         return ERR_PTR(-ECONNREFUSED);
 810
 811                 return ERR_PTR(-EOPNOTSUPP);
 812         }
 813
 814         /* Some devices send ATT messages as soon as the physical link is
 815          * established. To be able to handle these ATT messages, the user-
 816          * space first establishes the connection and then starts the pairing
 817          * process.
 818          *
 819          * So if a hci_conn object already exists for the following connection
 820          * attempt, we simply update pending_sec_level and auth_type fields
 821          * and return the object found.
 822          */
 823         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, dst);
 824         conn_unfinished = NULL;
 825         if (conn) {
 826                 if (conn->state == BT_CONNECT &&
 827                     test_bit(HCI_CONN_SCANNING, &conn->flags)) {
 828                         BT_DBG("will continue unfinished conn %pMR", dst);
 829                         conn_unfinished = conn;
 830                 } else {
 831                         if (conn->pending_sec_level < sec_level)
 832                                 conn->pending_sec_level = sec_level;
 833                         goto done;
 834                 }
 835         }
 836
 837         /* Since the controller supports only one LE connection attempt at a
 838          * time, we return -EBUSY if there is any connection attempt running.
 839          */
 840         if (hci_lookup_le_connect(hdev))
 841                 return ERR_PTR(-EBUSY);
 842
 843         /* When given an identity address with existing identity
 844          * resolving key, the connection needs to be established
 845          * to a resolvable random address.
 846          *
 847          * Storing the resolvable random address is required here
 848          * to handle connection failures. The address will later
 849          * be resolved back into the original identity address
 850          * from the connect request.
 851          */
 852         irk = hci_find_irk_by_addr(hdev, dst, dst_type);
 853         if (irk && bacmp(&irk->rpa, BDADDR_ANY)) {
 854                 dst = &irk->rpa;
 855                 dst_type = ADDR_LE_DEV_RANDOM;
 856         }
 857
 858         if (conn_unfinished) {
 859                 conn = conn_unfinished;
 860                 bacpy(&conn->dst, dst);
 861         } else {
 862                 conn = hci_conn_add(hdev, LE_LINK, dst, role);
 863         }
 864
 865         if (!conn)
 866                 return ERR_PTR(-ENOMEM);
 867
 868         conn->dst_type = dst_type;
 869         conn->sec_level = BT_SECURITY_LOW;
 870         conn->conn_timeout = conn_timeout;
 871
 872         if (!conn_unfinished)
 873                 conn->pending_sec_level = sec_level;
 874
 875         hci_req_init(&req, hdev);
 876
 877         /* Disable advertising if we're active. For master role
 878          * connections most controllers will refuse to connect if
 879          * advertising is enabled, and for slave role connections we
 880          * anyway have to disable it in order to start directed
 881          * advertising.
 882          */
 883         if (hci_dev_test_flag(hdev, HCI_LE_ADV)) {
 884                 u8 enable = 0x00;
 885                 hci_req_add(&req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable),
 886                             &enable);
 887         }
 888
 889         /* If requested to connect as slave use directed advertising */
 890         if (conn->role == HCI_ROLE_SLAVE) {
 891                 /* If we're active scanning most controllers are unable
 892                  * to initiate advertising. Simply reject the attempt.
 893                  */
 894                 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
 895                     hdev->le_scan_type == LE_SCAN_ACTIVE) {
 896                         skb_queue_purge(&req.cmd_q);
 897                         hci_conn_del(conn);
 898                         return ERR_PTR(-EBUSY);
 899                 }
 900
 901                 hci_req_directed_advertising(&req, conn);
 902                 goto create_conn;
 903         }
 904
 905         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
 906         if (params) {
 907                 conn->le_conn_min_interval = params->conn_min_interval;
 908                 conn->le_conn_max_interval = params->conn_max_interval;
 909                 conn->le_conn_latency = params->conn_latency;
 910                 conn->le_supv_timeout = params->supervision_timeout;
 911         } else {
 912                 conn->le_conn_min_interval = hdev->le_conn_min_interval;
 913                 conn->le_conn_max_interval = hdev->le_conn_max_interval;
 914                 conn->le_conn_latency = hdev->le_conn_latency;
 915                 conn->le_supv_timeout = hdev->le_supv_timeout;
 916         }
 917
 918         /* If controller is scanning, we stop it since some controllers are
 919          * not able to scan and connect at the same time. Also set the
 920          * HCI_LE_SCAN_INTERRUPTED flag so that the command complete
 921          * handler for scan disabling knows to set the correct discovery
 922          * state.
 923          */
 924         if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
 925                 hci_req_add_le_scan_disable(&req);
 926                 hci_dev_set_flag(hdev, HCI_LE_SCAN_INTERRUPTED);
 927         }
 928
 929         hci_req_add_le_create_conn(&req, conn);
 930
 931 create_conn:
 932         err = hci_req_run(&req, create_le_conn_complete);
 933         if (err) {
 934                 hci_conn_del(conn);
 935                 return ERR_PTR(err);
 936         }
 937
 938 done:
 939         /* If this is continuation of connect started by hci_connect_le_scan,
 940          * it already called hci_conn_hold and calling it again would mess the
 941          * counter.
 942          */
 943         if (!conn_unfinished)
 944                 hci_conn_hold(conn);
 945
 946         return conn;
 947 }
 948
 949 static void hci_connect_le_scan_complete(struct hci_dev *hdev, u8 status,
 950                                          u16 opcode)
 951 {
 952         struct hci_conn *conn;
 953
 954         if (!status)
 955                 return;
 956
 957         BT_ERR("Failed to add device to auto conn whitelist: status 0x%2.2x",
 958                status);
 959
 960         hci_dev_lock(hdev);
 961
 962         conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
 963         if (conn)
 964                 hci_le_conn_failed(conn, status);
 965
 966         hci_dev_unlock(hdev);
 967 }
 968
 969 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
 970 {
 971         struct hci_conn *conn;
 972
 973         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
 974         if (!conn)
 975                 return false;
 976
 977         if (conn->dst_type != type)
 978                 return false;
 979
 980         if (conn->state != BT_CONNECTED)
 981                 return false;
 982
 983         return true;
 984 }
 985
 986 /* This function requires the caller holds hdev->lock */
 987 static int hci_explicit_conn_params_set(struct hci_request *req,
 988                                         bdaddr_t *addr, u8 addr_type)
 989 {
 990         struct hci_dev *hdev = req->hdev;
 991         struct hci_conn_params *params;
 992
 993         if (is_connected(hdev, addr, addr_type))
 994                 return -EISCONN;
 995
 996         params = hci_conn_params_add(hdev, addr, addr_type);
 997         if (!params)
 998                 return -EIO;
 999
1000         /* If we created new params, or existing params were marked as disabled,
1001          * mark them to be used just once to connect.
1002          */
1003         if (params->auto_connect == HCI_AUTO_CONN_DISABLED) {
1004                 params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
1005                 list_del_init(&params->action);
1006                 list_add(&params->action, &hdev->pend_le_conns);
1007         }
1008
1009         params->explicit_connect = true;
1010         __hci_update_background_scan(req);
1011
1012         BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
1013                params->auto_connect);
1014
1015         return 0;
1016 }
1017
1018 /* This function requires the caller holds hdev->lock */
1019 struct hci_conn *hci_connect_le_scan(struct hci_dev *hdev, bdaddr_t *dst,
1020                                      u8 dst_type, u8 sec_level,
1021                                      u16 conn_timeout, u8 role)
1022 {
1023         struct hci_conn *conn;
1024         struct hci_request req;
1025         int err;
1026
1027         /* Let's make sure that le is enabled.*/
1028         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1029                 if (lmp_le_capable(hdev))
1030                         return ERR_PTR(-ECONNREFUSED);
1031
1032                 return ERR_PTR(-EOPNOTSUPP);
1033         }
1034
1035         /* Some devices send ATT messages as soon as the physical link is
1036          * established. To be able to handle these ATT messages, the user-
1037          * space first establishes the connection and then starts the pairing
1038          * process.
1039          *
1040          * So if a hci_conn object already exists for the following connection
1041          * attempt, we simply update pending_sec_level and auth_type fields
1042          * and return the object found.
1043          */
1044         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, dst);
1045         if (conn) {
1046                 if (conn->pending_sec_level < sec_level)
1047                         conn->pending_sec_level = sec_level;
1048                 goto done;
1049         }
1050
1051         BT_DBG("requesting refresh of dst_addr");
1052
1053         conn = hci_conn_add(hdev, LE_LINK, dst, role);
1054         if (!conn)
1055                 return ERR_PTR(-ENOMEM);
1056
1057         hci_req_init(&req, hdev);
1058
1059         if (hci_explicit_conn_params_set(&req, dst, dst_type) < 0)
1060                 return ERR_PTR(-EBUSY);
1061
1062         conn->state = BT_CONNECT;
1063         set_bit(HCI_CONN_SCANNING, &conn->flags);
1064
1065         err = hci_req_run(&req, hci_connect_le_scan_complete);
1066         if (err && err != -ENODATA) {
1067                 hci_conn_del(conn);
1068                 return ERR_PTR(err);
1069         }
1070
1071         conn->dst_type = dst_type;
1072         conn->sec_level = BT_SECURITY_LOW;
1073         conn->pending_sec_level = sec_level;
1074         conn->conn_timeout = conn_timeout;
1075
1076 done:
1077         hci_conn_hold(conn);
1078         return conn;
1079 }
1080
1081 struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst,
1082                                  u8 sec_level, u8 auth_type)
1083 {
1084         struct hci_conn *acl;
1085
1086         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1087                 if (lmp_bredr_capable(hdev))
1088                         return ERR_PTR(-ECONNREFUSED);
1089
1090                 return ERR_PTR(-EOPNOTSUPP);
1091         }
1092
1093         acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
1094         if (!acl) {
1095                 acl = hci_conn_add(hdev, ACL_LINK, dst, HCI_ROLE_MASTER);
1096                 if (!acl)
1097                         return ERR_PTR(-ENOMEM);
1098         }
1099
1100         hci_conn_hold(acl);
1101
1102         if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
1103                 acl->sec_level = BT_SECURITY_LOW;
1104                 acl->pending_sec_level = sec_level;
1105                 acl->auth_type = auth_type;
1106                 hci_acl_create_connection(acl);
1107         }
1108
1109         return acl;
1110 }
1111
1112 struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type, bdaddr_t *dst,
1113                                  __u16 setting)
1114 {
1115         struct hci_conn *acl;
1116         struct hci_conn *sco;
1117
1118         acl = hci_connect_acl(hdev, dst, BT_SECURITY_LOW, HCI_AT_NO_BONDING);
1119         if (IS_ERR(acl))
1120                 return acl;
1121
1122         sco = hci_conn_hash_lookup_ba(hdev, type, dst);
1123         if (!sco) {
1124                 sco = hci_conn_add(hdev, type, dst, HCI_ROLE_MASTER);
1125                 if (!sco) {
1126                         hci_conn_drop(acl);
1127                         return ERR_PTR(-ENOMEM);
1128                 }
1129         }
1130
1131         acl->link = sco;
1132         sco->link = acl;
1133
1134         hci_conn_hold(sco);
1135
1136         sco->setting = setting;
1137
1138         if (acl->state == BT_CONNECTED &&
1139             (sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
1140                 set_bit(HCI_CONN_POWER_SAVE, &acl->flags);
1141                 hci_conn_enter_active_mode(acl, BT_POWER_FORCE_ACTIVE_ON);
1142
1143                 if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->flags)) {
1144                         /* defer SCO setup until mode change completed */
1145                         set_bit(HCI_CONN_SCO_SETUP_PEND, &acl->flags);
1146                         return sco;
1147                 }
1148
1149                 hci_sco_setup(acl, 0x00);
1150         }
1151
1152         return sco;
1153 }
1154
1155 /* Check link security requirement */
1156 int hci_conn_check_link_mode(struct hci_conn *conn)
1157 {
1158         BT_DBG("hcon %p", conn);
1159
1160         /* In Secure Connections Only mode, it is required that Secure
1161          * Connections is used and the link is encrypted with AES-CCM
1162          * using a P-256 authenticated combination key.
1163          */
1164         if (hci_dev_test_flag(conn->hdev, HCI_SC_ONLY)) {
1165                 if (!hci_conn_sc_enabled(conn) ||
1166                     !test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
1167                     conn->key_type != HCI_LK_AUTH_COMBINATION_P256)
1168                         return 0;
1169         }
1170
1171         if (hci_conn_ssp_enabled(conn) &&
1172             !test_bit(HCI_CONN_ENCRYPT, &conn->flags))
1173                 return 0;
1174
1175         return 1;
1176 }
1177
1178 /* Authenticate remote device */
1179 static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
1180 {
1181         BT_DBG("hcon %p", conn);
1182
1183         if (conn->pending_sec_level > sec_level)
1184                 sec_level = conn->pending_sec_level;
1185
1186         if (sec_level > conn->sec_level)
1187                 conn->pending_sec_level = sec_level;
1188         else if (test_bit(HCI_CONN_AUTH, &conn->flags))
1189                 return 1;
1190
1191         /* Make sure we preserve an existing MITM requirement*/
1192         auth_type |= (conn->auth_type & 0x01);
1193
1194         conn->auth_type = auth_type;
1195
1196         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
1197                 struct hci_cp_auth_requested cp;
1198
1199                 cp.handle = cpu_to_le16(conn->handle);
1200                 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
1201                              sizeof(cp), &cp);
1202
1203                 /* If we're already encrypted set the REAUTH_PEND flag,
1204                  * otherwise set the ENCRYPT_PEND.
1205                  */
1206                 if (test_bit(HCI_CONN_ENCRYPT, &conn->flags))
1207                         set_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
1208                 else
1209                         set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
1210         }
1211
1212         return 0;
1213 }
1214
1215 /* Encrypt the the link */
1216 static void hci_conn_encrypt(struct hci_conn *conn)
1217 {
1218         BT_DBG("hcon %p", conn);
1219
1220         if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
1221                 struct hci_cp_set_conn_encrypt cp;
1222                 cp.handle  = cpu_to_le16(conn->handle);
1223                 cp.encrypt = 0x01;
1224                 hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
1225                              &cp);
1226         }
1227 }
1228
1229 /* Enable security */
1230 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type,
1231                       bool initiator)
1232 {
1233         BT_DBG("hcon %p", conn);
1234
1235         if (conn->type == LE_LINK)
1236                 return smp_conn_security(conn, sec_level);
1237
1238         /* For sdp we don't need the link key. */
1239         if (sec_level == BT_SECURITY_SDP)
1240                 return 1;
1241
1242         /* For non 2.1 devices and low security level we don't need the link
1243            key. */
1244         if (sec_level == BT_SECURITY_LOW && !hci_conn_ssp_enabled(conn))
1245                 return 1;
1246
1247         /* For other security levels we need the link key. */
1248         if (!test_bit(HCI_CONN_AUTH, &conn->flags))
1249                 goto auth;
1250
1251         /* An authenticated FIPS approved combination key has sufficient
1252          * security for security level 4. */
1253         if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256 &&
1254             sec_level == BT_SECURITY_FIPS)
1255                 goto encrypt;
1256
1257         /* An authenticated combination key has sufficient security for
1258            security level 3. */
1259         if ((conn->key_type == HCI_LK_AUTH_COMBINATION_P192 ||
1260              conn->key_type == HCI_LK_AUTH_COMBINATION_P256) &&
1261             sec_level == BT_SECURITY_HIGH)
1262                 goto encrypt;
1263
1264         /* An unauthenticated combination key has sufficient security for
1265            security level 1 and 2. */
1266         if ((conn->key_type == HCI_LK_UNAUTH_COMBINATION_P192 ||
1267              conn->key_type == HCI_LK_UNAUTH_COMBINATION_P256) &&
1268             (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW))
1269                 goto encrypt;
1270
1271         /* A combination key has always sufficient security for the security
1272            levels 1 or 2. High security level requires the combination key
1273            is generated using maximum PIN code length (16).
1274            For pre 2.1 units. */
1275         if (conn->key_type == HCI_LK_COMBINATION &&
1276             (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW ||
1277              conn->pin_length == 16))
1278                 goto encrypt;
1279
1280 auth:
1281         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags))
1282                 return 0;
1283
1284         if (initiator)
1285                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
1286
1287         if (!hci_conn_auth(conn, sec_level, auth_type))
1288                 return 0;
1289
1290 encrypt:
1291         if (test_bit(HCI_CONN_ENCRYPT, &conn->flags))
1292                 return 1;
1293
1294         hci_conn_encrypt(conn);
1295         return 0;
1296 }
1297 EXPORT_SYMBOL(hci_conn_security);
1298
1299 /* Check secure link requirement */
1300 int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level)
1301 {
1302         BT_DBG("hcon %p", conn);
1303
1304         /* Accept if non-secure or higher security level is required */
1305         if (sec_level != BT_SECURITY_HIGH && sec_level != BT_SECURITY_FIPS)
1306                 return 1;
1307
1308         /* Accept if secure or higher security level is already present */
1309         if (conn->sec_level == BT_SECURITY_HIGH ||
1310             conn->sec_level == BT_SECURITY_FIPS)
1311                 return 1;
1312
1313         /* Reject not secure link */
1314         return 0;
1315 }
1316 EXPORT_SYMBOL(hci_conn_check_secure);
1317
1318 /* Switch role */
1319 int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
1320 {
1321         BT_DBG("hcon %p", conn);
1322
1323         if (role == conn->role)
1324                 return 1;
1325
1326         if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->flags)) {
1327                 struct hci_cp_switch_role cp;
1328                 bacpy(&cp.bdaddr, &conn->dst);
1329                 cp.role = role;
1330                 hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
1331         }
1332
1333         return 0;
1334 }
1335 EXPORT_SYMBOL(hci_conn_switch_role);
1336
1337 /* Enter active mode */
1338 void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
1339 {
1340         struct hci_dev *hdev = conn->hdev;
1341
1342         BT_DBG("hcon %p mode %d", conn, conn->mode);
1343
1344         if (conn->mode != HCI_CM_SNIFF)
1345                 goto timer;
1346
1347         if (!test_bit(HCI_CONN_POWER_SAVE, &conn->flags) && !force_active)
1348                 goto timer;
1349
1350         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
1351                 struct hci_cp_exit_sniff_mode cp;
1352                 cp.handle = cpu_to_le16(conn->handle);
1353                 hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
1354         }
1355
1356 timer:
1357         if (hdev->idle_timeout > 0)
1358                 queue_delayed_work(hdev->workqueue, &conn->idle_work,
1359                                    msecs_to_jiffies(hdev->idle_timeout));
1360 }
1361
1362 /* Drop all connection on the device */
1363 void hci_conn_hash_flush(struct hci_dev *hdev)
1364 {
1365         struct hci_conn_hash *h = &hdev->conn_hash;
1366         struct hci_conn *c, *n;
1367
1368         BT_DBG("hdev %s", hdev->name);
1369
1370         list_for_each_entry_safe(c, n, &h->list, list) {
1371                 c->state = BT_CLOSED;
1372
1373                 hci_disconn_cfm(c, HCI_ERROR_LOCAL_HOST_TERM);
1374                 hci_conn_del(c);
1375         }
1376 }
1377
1378 /* Check pending connect attempts */
1379 void hci_conn_check_pending(struct hci_dev *hdev)
1380 {
1381         struct hci_conn *conn;
1382
1383         BT_DBG("hdev %s", hdev->name);
1384
1385         hci_dev_lock(hdev);
1386
1387         conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
1388         if (conn)
1389                 hci_acl_create_connection(conn);
1390
1391         hci_dev_unlock(hdev);
1392 }
1393
1394 static u32 get_link_mode(struct hci_conn *conn)
1395 {
1396         u32 link_mode = 0;
1397
1398         if (conn->role == HCI_ROLE_MASTER)
1399                 link_mode |= HCI_LM_MASTER;
1400
1401         if (test_bit(HCI_CONN_ENCRYPT, &conn->flags))
1402                 link_mode |= HCI_LM_ENCRYPT;
1403
1404         if (test_bit(HCI_CONN_AUTH, &conn->flags))
1405                 link_mode |= HCI_LM_AUTH;
1406
1407         if (test_bit(HCI_CONN_SECURE, &conn->flags))
1408                 link_mode |= HCI_LM_SECURE;
1409
1410         if (test_bit(HCI_CONN_FIPS, &conn->flags))
1411                 link_mode |= HCI_LM_FIPS;
1412
1413         return link_mode;
1414 }
1415
1416 int hci_get_conn_list(void __user *arg)
1417 {
1418         struct hci_conn *c;
1419         struct hci_conn_list_req req, *cl;
1420         struct hci_conn_info *ci;
1421         struct hci_dev *hdev;
1422         int n = 0, size, err;
1423
1424         if (copy_from_user(&req, arg, sizeof(req)))
1425                 return -EFAULT;
1426
1427         if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
1428                 return -EINVAL;
1429
1430         size = sizeof(req) + req.conn_num * sizeof(*ci);
1431
1432         cl = kmalloc(size, GFP_KERNEL);
1433         if (!cl)
1434                 return -ENOMEM;
1435
1436         hdev = hci_dev_get(req.dev_id);
1437         if (!hdev) {
1438                 kfree(cl);
1439                 return -ENODEV;
1440         }
1441
1442         ci = cl->conn_info;
1443
1444         hci_dev_lock(hdev);
1445         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1446                 bacpy(&(ci + n)->bdaddr, &c->dst);
1447                 (ci + n)->handle = c->handle;
1448                 (ci + n)->type  = c->type;
1449                 (ci + n)->out   = c->out;
1450                 (ci + n)->state = c->state;
1451                 (ci + n)->link_mode = get_link_mode(c);
1452                 if (++n >= req.conn_num)
1453                         break;
1454         }
1455         hci_dev_unlock(hdev);
1456
1457         cl->dev_id = hdev->id;
1458         cl->conn_num = n;
1459         size = sizeof(req) + n * sizeof(*ci);
1460
1461         hci_dev_put(hdev);
1462
1463         err = copy_to_user(arg, cl, size);
1464         kfree(cl);
1465
1466         return err ? -EFAULT : 0;
1467 }
1468
1469 int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
1470 {
1471         struct hci_conn_info_req req;
1472         struct hci_conn_info ci;
1473         struct hci_conn *conn;
1474         char __user *ptr = arg + sizeof(req);
1475
1476         if (copy_from_user(&req, arg, sizeof(req)))
1477                 return -EFAULT;
1478
1479         hci_dev_lock(hdev);
1480         conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
1481         if (conn) {
1482                 bacpy(&ci.bdaddr, &conn->dst);
1483                 ci.handle = conn->handle;
1484                 ci.type  = conn->type;
1485                 ci.out   = conn->out;
1486                 ci.state = conn->state;
1487                 ci.link_mode = get_link_mode(conn);
1488         }
1489         hci_dev_unlock(hdev);
1490
1491         if (!conn)
1492                 return -ENOENT;
1493
1494         return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
1495 }
1496
1497 int hci_get_auth_info(struct hci_dev *hdev, void __user *arg)
1498 {
1499         struct hci_auth_info_req req;
1500         struct hci_conn *conn;
1501
1502         if (copy_from_user(&req, arg, sizeof(req)))
1503                 return -EFAULT;
1504
1505         hci_dev_lock(hdev);
1506         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr);
1507         if (conn)
1508                 req.type = conn->auth_type;
1509         hci_dev_unlock(hdev);
1510
1511         if (!conn)
1512                 return -ENOENT;
1513
1514         return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0;
1515 }
1516
1517 struct hci_chan *hci_chan_create(struct hci_conn *conn)
1518 {
1519         struct hci_dev *hdev = conn->hdev;
1520         struct hci_chan *chan;
1521
1522         BT_DBG("%s hcon %p", hdev->name, conn);
1523
1524         if (test_bit(HCI_CONN_DROP, &conn->flags)) {
1525                 BT_DBG("Refusing to create new hci_chan");
1526                 return NULL;
1527         }
1528
1529         chan = kzalloc(sizeof(*chan), GFP_KERNEL);
1530         if (!chan)
1531                 return NULL;
1532
1533         chan->conn = hci_conn_get(conn);
1534         skb_queue_head_init(&chan->data_q);
1535         chan->state = BT_CONNECTED;
1536
1537         list_add_rcu(&chan->list, &conn->chan_list);
1538
1539         return chan;
1540 }
1541
1542 void hci_chan_del(struct hci_chan *chan)
1543 {
1544         struct hci_conn *conn = chan->conn;
1545         struct hci_dev *hdev = conn->hdev;
1546
1547         BT_DBG("%s hcon %p chan %p", hdev->name, conn, chan);
1548
1549         list_del_rcu(&chan->list);
1550
1551         synchronize_rcu();
1552
1553         /* Prevent new hci_chan's to be created for this hci_conn */
1554         set_bit(HCI_CONN_DROP, &conn->flags);
1555
1556         hci_conn_put(conn);
1557
1558         skb_queue_purge(&chan->data_q);
1559         kfree(chan);
1560 }
1561
1562 void hci_chan_list_flush(struct hci_conn *conn)
1563 {
1564         struct hci_chan *chan, *n;
1565
1566         BT_DBG("hcon %p", conn);
1567
1568         list_for_each_entry_safe(chan, n, &conn->chan_list, list)
1569                 hci_chan_del(chan);
1570 }
1571
1572 static struct hci_chan *__hci_chan_lookup_handle(struct hci_conn *hcon,
1573                                                  __u16 handle)
1574 {
1575         struct hci_chan *hchan;
1576
1577         list_for_each_entry(hchan, &hcon->chan_list, list) {
1578                 if (hchan->handle == handle)
1579                         return hchan;
1580         }
1581
1582         return NULL;
1583 }
1584
1585 struct hci_chan *hci_chan_lookup_handle(struct hci_dev *hdev, __u16 handle)
1586 {
1587         struct hci_conn_hash *h = &hdev->conn_hash;
1588         struct hci_conn *hcon;
1589         struct hci_chan *hchan = NULL;
1590
1591         rcu_read_lock();
1592
1593         list_for_each_entry_rcu(hcon, &h->list, list) {
1594                 hchan = __hci_chan_lookup_handle(hcon, handle);
1595                 if (hchan)
1596                         break;
1597         }
1598
1599         rcu_read_unlock();
1600
1601         return hchan;
1602 }