1 /* 2 BlueZ - Bluetooth protocol stack for Linux 3 Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved. 4 5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com> 6 7 This program is free software; you can redistribute it and/or modify 8 it under the terms of the GNU General Public License version 2 as 9 published by the Free Software Foundation; 10 11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 19 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 22 SOFTWARE IS DISCLAIMED. 23 */ 24 25 /* Bluetooth HCI connection handling. */ 26 27 #include <linux/export.h> 28 #include <linux/debugfs.h> 29 30 #include <net/bluetooth/bluetooth.h> 31 #include <net/bluetooth/hci_core.h> 32 #include <net/bluetooth/l2cap.h> 33 34 #include "hci_request.h" 35 #include "smp.h" 36 #include "a2mp.h" 37 38 struct sco_param { 39 u16 pkt_type; 40 u16 max_latency; 41 u8 retrans_effort; 42 }; 43 44 static const struct sco_param esco_param_cvsd[] = { 45 { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000a, 0x01 }, /* S3 */ 46 { EDR_ESCO_MASK & ~ESCO_2EV3, 0x0007, 0x01 }, /* S2 */ 47 { EDR_ESCO_MASK | ESCO_EV3, 0x0007, 0x01 }, /* S1 */ 48 { EDR_ESCO_MASK | ESCO_HV3, 0xffff, 0x01 }, /* D1 */ 49 { EDR_ESCO_MASK | ESCO_HV1, 0xffff, 0x01 }, /* D0 */ 50 }; 51 52 static const struct sco_param sco_param_cvsd[] = { 53 { EDR_ESCO_MASK | ESCO_HV3, 0xffff, 0xff }, /* D1 */ 54 { EDR_ESCO_MASK | ESCO_HV1, 0xffff, 0xff }, /* D0 */ 55 }; 56 57 static const struct sco_param esco_param_msbc[] = { 58 { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000d, 0x02 }, /* T2 */ 59 { EDR_ESCO_MASK | ESCO_EV3, 0x0008, 0x02 }, /* T1 */ 60 }; 61 62 /* This function requires the caller holds hdev->lock */ 63 static void hci_connect_le_scan_cleanup(struct hci_conn *conn) 64 { 65 struct hci_conn_params *params; 66 struct hci_dev *hdev = conn->hdev; 67 struct smp_irk *irk; 68 bdaddr_t *bdaddr; 69 u8 bdaddr_type; 70 71 bdaddr = &conn->dst; 72 bdaddr_type = conn->dst_type; 73 74 /* Check if we need to convert to identity address */ 75 irk = hci_get_irk(hdev, bdaddr, bdaddr_type); 76 if (irk) { 77 bdaddr = &irk->bdaddr; 78 bdaddr_type = irk->addr_type; 79 } 80 81 params = hci_pend_le_action_lookup(&hdev->pend_le_conns, bdaddr, 82 bdaddr_type); 83 if (!params || !params->explicit_connect) 84 return; 85 86 /* The connection attempt was doing scan for new RPA, and is 87 * in scan phase. If params are not associated with any other 88 * autoconnect action, remove them completely. If they are, just unmark 89 * them as waiting for connection, by clearing explicit_connect field. 90 */ 91 params->explicit_connect = false; 92 93 list_del_init(¶ms->action); 94 95 switch (params->auto_connect) { 96 case HCI_AUTO_CONN_EXPLICIT: 97 hci_conn_params_del(hdev, bdaddr, bdaddr_type); 98 /* return instead of break to avoid duplicate scan update */ 99 return; 100 case HCI_AUTO_CONN_DIRECT: 101 case HCI_AUTO_CONN_ALWAYS: 102 list_add(¶ms->action, &hdev->pend_le_conns); 103 break; 104 case HCI_AUTO_CONN_REPORT: 105 list_add(¶ms->action, &hdev->pend_le_reports); 106 break; 107 default: 108 break; 109 } 110 111 hci_update_background_scan(hdev); 112 } 113 114 static void hci_conn_cleanup(struct hci_conn *conn) 115 { 116 struct hci_dev *hdev = conn->hdev; 117 118 if (test_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags)) 119 hci_conn_params_del(conn->hdev, &conn->dst, conn->dst_type); 120 121 hci_chan_list_flush(conn); 122 123 hci_conn_hash_del(hdev, conn); 124 125 if (conn->type == SCO_LINK || conn->type == ESCO_LINK) { 126 switch (conn->setting & SCO_AIRMODE_MASK) { 127 case SCO_AIRMODE_CVSD: 128 case SCO_AIRMODE_TRANSP: 129 if (hdev->notify) 130 hdev->notify(hdev, HCI_NOTIFY_DISABLE_SCO); 131 break; 132 } 133 } else { 134 if (hdev->notify) 135 hdev->notify(hdev, HCI_NOTIFY_CONN_DEL); 136 } 137 138 hci_conn_del_sysfs(conn); 139 140 debugfs_remove_recursive(conn->debugfs); 141 142 hci_dev_put(hdev); 143 144 hci_conn_put(conn); 145 } 146 147 static void le_scan_cleanup(struct work_struct *work) 148 { 149 struct hci_conn *conn = container_of(work, struct hci_conn, 150 le_scan_cleanup); 151 struct hci_dev *hdev = conn->hdev; 152 struct hci_conn *c = NULL; 153 154 BT_DBG("%s hcon %p", hdev->name, conn); 155 156 hci_dev_lock(hdev); 157 158 /* Check that the hci_conn is still around */ 159 rcu_read_lock(); 160 list_for_each_entry_rcu(c, &hdev->conn_hash.list, list) { 161 if (c == conn) 162 break; 163 } 164 rcu_read_unlock(); 165 166 if (c == conn) { 167 hci_connect_le_scan_cleanup(conn); 168 hci_conn_cleanup(conn); 169 } 170 171 hci_dev_unlock(hdev); 172 hci_dev_put(hdev); 173 hci_conn_put(conn); 174 } 175 176 static void hci_connect_le_scan_remove(struct hci_conn *conn) 177 { 178 BT_DBG("%s hcon %p", conn->hdev->name, conn); 179 180 /* We can't call hci_conn_del/hci_conn_cleanup here since that 181 * could deadlock with another hci_conn_del() call that's holding 182 * hci_dev_lock and doing cancel_delayed_work_sync(&conn->disc_work). 183 * Instead, grab temporary extra references to the hci_dev and 184 * hci_conn and perform the necessary cleanup in a separate work 185 * callback. 186 */ 187 188 hci_dev_hold(conn->hdev); 189 hci_conn_get(conn); 190 191 /* Even though we hold a reference to the hdev, many other 192 * things might get cleaned up meanwhile, including the hdev's 193 * own workqueue, so we can't use that for scheduling. 194 */ 195 schedule_work(&conn->le_scan_cleanup); 196 } 197 198 static void hci_acl_create_connection(struct hci_conn *conn) 199 { 200 struct hci_dev *hdev = conn->hdev; 201 struct inquiry_entry *ie; 202 struct hci_cp_create_conn cp; 203 204 BT_DBG("hcon %p", conn); 205 206 conn->state = BT_CONNECT; 207 conn->out = true; 208 conn->role = HCI_ROLE_MASTER; 209 210 conn->attempt++; 211 212 conn->link_policy = hdev->link_policy; 213 214 memset(&cp, 0, sizeof(cp)); 215 bacpy(&cp.bdaddr, &conn->dst); 216 cp.pscan_rep_mode = 0x02; 217 218 ie = hci_inquiry_cache_lookup(hdev, &conn->dst); 219 if (ie) { 220 if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) { 221 cp.pscan_rep_mode = ie->data.pscan_rep_mode; 222 cp.pscan_mode = ie->data.pscan_mode; 223 cp.clock_offset = ie->data.clock_offset | 224 cpu_to_le16(0x8000); 225 } 226 227 memcpy(conn->dev_class, ie->data.dev_class, 3); 228 } 229 230 cp.pkt_type = cpu_to_le16(conn->pkt_type); 231 if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER)) 232 cp.role_switch = 0x01; 233 else 234 cp.role_switch = 0x00; 235 236 hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp); 237 } 238 239 int hci_disconnect(struct hci_conn *conn, __u8 reason) 240 { 241 BT_DBG("hcon %p", conn); 242 243 /* When we are master of an established connection and it enters 244 * the disconnect timeout, then go ahead and try to read the 245 * current clock offset. Processing of the result is done 246 * within the event handling and hci_clock_offset_evt function. 247 */ 248 if (conn->type == ACL_LINK && conn->role == HCI_ROLE_MASTER && 249 (conn->state == BT_CONNECTED || conn->state == BT_CONFIG)) { 250 struct hci_dev *hdev = conn->hdev; 251 struct hci_cp_read_clock_offset clkoff_cp; 252 253 clkoff_cp.handle = cpu_to_le16(conn->handle); 254 hci_send_cmd(hdev, HCI_OP_READ_CLOCK_OFFSET, sizeof(clkoff_cp), 255 &clkoff_cp); 256 } 257 258 return hci_abort_conn(conn, reason); 259 } 260 261 static void hci_add_sco(struct hci_conn *conn, __u16 handle) 262 { 263 struct hci_dev *hdev = conn->hdev; 264 struct hci_cp_add_sco cp; 265 266 BT_DBG("hcon %p", conn); 267 268 conn->state = BT_CONNECT; 269 conn->out = true; 270 271 conn->attempt++; 272 273 cp.handle = cpu_to_le16(handle); 274 cp.pkt_type = cpu_to_le16(conn->pkt_type); 275 276 hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp); 277 } 278 279 bool hci_setup_sync(struct hci_conn *conn, __u16 handle) 280 { 281 struct hci_dev *hdev = conn->hdev; 282 struct hci_cp_setup_sync_conn cp; 283 const struct sco_param *param; 284 285 BT_DBG("hcon %p", conn); 286 287 conn->state = BT_CONNECT; 288 conn->out = true; 289 290 conn->attempt++; 291 292 cp.handle = cpu_to_le16(handle); 293 294 cp.tx_bandwidth = cpu_to_le32(0x00001f40); 295 cp.rx_bandwidth = cpu_to_le32(0x00001f40); 296 cp.voice_setting = cpu_to_le16(conn->setting); 297 298 switch (conn->setting & SCO_AIRMODE_MASK) { 299 case SCO_AIRMODE_TRANSP: 300 if (conn->attempt > ARRAY_SIZE(esco_param_msbc)) 301 return false; 302 param = &esco_param_msbc[conn->attempt - 1]; 303 break; 304 case SCO_AIRMODE_CVSD: 305 if (lmp_esco_capable(conn->link)) { 306 if (conn->attempt > ARRAY_SIZE(esco_param_cvsd)) 307 return false; 308 param = &esco_param_cvsd[conn->attempt - 1]; 309 } else { 310 if (conn->attempt > ARRAY_SIZE(sco_param_cvsd)) 311 return false; 312 param = &sco_param_cvsd[conn->attempt - 1]; 313 } 314 break; 315 default: 316 return false; 317 } 318 319 cp.retrans_effort = param->retrans_effort; 320 cp.pkt_type = __cpu_to_le16(param->pkt_type); 321 cp.max_latency = __cpu_to_le16(param->max_latency); 322 323 if (hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp) < 0) 324 return false; 325 326 return true; 327 } 328 329 u8 hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max, u16 latency, 330 u16 to_multiplier) 331 { 332 struct hci_dev *hdev = conn->hdev; 333 struct hci_conn_params *params; 334 struct hci_cp_le_conn_update cp; 335 336 hci_dev_lock(hdev); 337 338 params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type); 339 if (params) { 340 params->conn_min_interval = min; 341 params->conn_max_interval = max; 342 params->conn_latency = latency; 343 params->supervision_timeout = to_multiplier; 344 } 345 346 hci_dev_unlock(hdev); 347 348 memset(&cp, 0, sizeof(cp)); 349 cp.handle = cpu_to_le16(conn->handle); 350 cp.conn_interval_min = cpu_to_le16(min); 351 cp.conn_interval_max = cpu_to_le16(max); 352 cp.conn_latency = cpu_to_le16(latency); 353 cp.supervision_timeout = cpu_to_le16(to_multiplier); 354 cp.min_ce_len = cpu_to_le16(0x0000); 355 cp.max_ce_len = cpu_to_le16(0x0000); 356 357 hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp); 358 359 if (params) 360 return 0x01; 361 362 return 0x00; 363 } 364 365 void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __le64 rand, 366 __u8 ltk[16], __u8 key_size) 367 { 368 struct hci_dev *hdev = conn->hdev; 369 struct hci_cp_le_start_enc cp; 370 371 BT_DBG("hcon %p", conn); 372 373 memset(&cp, 0, sizeof(cp)); 374 375 cp.handle = cpu_to_le16(conn->handle); 376 cp.rand = rand; 377 cp.ediv = ediv; 378 memcpy(cp.ltk, ltk, key_size); 379 380 hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp); 381 } 382 383 /* Device _must_ be locked */ 384 void hci_sco_setup(struct hci_conn *conn, __u8 status) 385 { 386 struct hci_conn *sco = conn->link; 387 388 if (!sco) 389 return; 390 391 BT_DBG("hcon %p", conn); 392 393 if (!status) { 394 if (lmp_esco_capable(conn->hdev)) 395 hci_setup_sync(sco, conn->handle); 396 else 397 hci_add_sco(sco, conn->handle); 398 } else { 399 hci_connect_cfm(sco, status); 400 hci_conn_del(sco); 401 } 402 } 403 404 static void hci_conn_timeout(struct work_struct *work) 405 { 406 struct hci_conn *conn = container_of(work, struct hci_conn, 407 disc_work.work); 408 int refcnt = atomic_read(&conn->refcnt); 409 410 BT_DBG("hcon %p state %s", conn, state_to_string(conn->state)); 411 412 WARN_ON(refcnt < 0); 413 414 /* FIXME: It was observed that in pairing failed scenario, refcnt 415 * drops below 0. Probably this is because l2cap_conn_del calls 416 * l2cap_chan_del for each channel, and inside l2cap_chan_del conn is 417 * dropped. After that loop hci_chan_del is called which also drops 418 * conn. For now make sure that ACL is alive if refcnt is higher then 0, 419 * otherwise drop it. 420 */ 421 if (refcnt > 0) 422 return; 423 424 /* LE connections in scanning state need special handling */ 425 if (conn->state == BT_CONNECT && conn->type == LE_LINK && 426 test_bit(HCI_CONN_SCANNING, &conn->flags)) { 427 hci_connect_le_scan_remove(conn); 428 return; 429 } 430 431 hci_abort_conn(conn, hci_proto_disconn_ind(conn)); 432 } 433 434 /* Enter sniff mode */ 435 static void hci_conn_idle(struct work_struct *work) 436 { 437 struct hci_conn *conn = container_of(work, struct hci_conn, 438 idle_work.work); 439 struct hci_dev *hdev = conn->hdev; 440 441 BT_DBG("hcon %p mode %d", conn, conn->mode); 442 443 if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn)) 444 return; 445 446 if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF)) 447 return; 448 449 if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) { 450 struct hci_cp_sniff_subrate cp; 451 cp.handle = cpu_to_le16(conn->handle); 452 cp.max_latency = cpu_to_le16(0); 453 cp.min_remote_timeout = cpu_to_le16(0); 454 cp.min_local_timeout = cpu_to_le16(0); 455 hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp); 456 } 457 458 if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) { 459 struct hci_cp_sniff_mode cp; 460 cp.handle = cpu_to_le16(conn->handle); 461 cp.max_interval = cpu_to_le16(hdev->sniff_max_interval); 462 cp.min_interval = cpu_to_le16(hdev->sniff_min_interval); 463 cp.attempt = cpu_to_le16(4); 464 cp.timeout = cpu_to_le16(1); 465 hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp); 466 } 467 } 468 469 static void hci_conn_auto_accept(struct work_struct *work) 470 { 471 struct hci_conn *conn = container_of(work, struct hci_conn, 472 auto_accept_work.work); 473 474 hci_send_cmd(conn->hdev, HCI_OP_USER_CONFIRM_REPLY, sizeof(conn->dst), 475 &conn->dst); 476 } 477 478 static void le_disable_advertising(struct hci_dev *hdev) 479 { 480 if (ext_adv_capable(hdev)) { 481 struct hci_cp_le_set_ext_adv_enable cp; 482 483 cp.enable = 0x00; 484 cp.num_of_sets = 0x00; 485 486 hci_send_cmd(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE, sizeof(cp), 487 &cp); 488 } else { 489 u8 enable = 0x00; 490 hci_send_cmd(hdev, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), 491 &enable); 492 } 493 } 494 495 static void le_conn_timeout(struct work_struct *work) 496 { 497 struct hci_conn *conn = container_of(work, struct hci_conn, 498 le_conn_timeout.work); 499 struct hci_dev *hdev = conn->hdev; 500 501 BT_DBG(""); 502 503 /* We could end up here due to having done directed advertising, 504 * so clean up the state if necessary. This should however only 505 * happen with broken hardware or if low duty cycle was used 506 * (which doesn't have a timeout of its own). 507 */ 508 if (conn->role == HCI_ROLE_SLAVE) { 509 /* Disable LE Advertising */ 510 le_disable_advertising(hdev); 511 hci_le_conn_failed(conn, HCI_ERROR_ADVERTISING_TIMEOUT); 512 return; 513 } 514 515 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM); 516 } 517 518 struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst, 519 u8 role) 520 { 521 struct hci_conn *conn; 522 523 BT_DBG("%s dst %pMR", hdev->name, dst); 524 525 conn = kzalloc(sizeof(*conn), GFP_KERNEL); 526 if (!conn) 527 return NULL; 528 529 bacpy(&conn->dst, dst); 530 bacpy(&conn->src, &hdev->bdaddr); 531 conn->hdev = hdev; 532 conn->type = type; 533 conn->role = role; 534 conn->mode = HCI_CM_ACTIVE; 535 conn->state = BT_OPEN; 536 conn->auth_type = HCI_AT_GENERAL_BONDING; 537 conn->io_capability = hdev->io_capability; 538 conn->remote_auth = 0xff; 539 conn->key_type = 0xff; 540 conn->rssi = HCI_RSSI_INVALID; 541 conn->tx_power = HCI_TX_POWER_INVALID; 542 conn->max_tx_power = HCI_TX_POWER_INVALID; 543 544 set_bit(HCI_CONN_POWER_SAVE, &conn->flags); 545 conn->disc_timeout = HCI_DISCONN_TIMEOUT; 546 547 /* Set Default Authenticated payload timeout to 30s */ 548 conn->auth_payload_timeout = DEFAULT_AUTH_PAYLOAD_TIMEOUT; 549 550 if (conn->role == HCI_ROLE_MASTER) 551 conn->out = true; 552 553 switch (type) { 554 case ACL_LINK: 555 conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK; 556 break; 557 case LE_LINK: 558 /* conn->src should reflect the local identity address */ 559 hci_copy_identity_address(hdev, &conn->src, &conn->src_type); 560 break; 561 case SCO_LINK: 562 if (lmp_esco_capable(hdev)) 563 conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) | 564 (hdev->esco_type & EDR_ESCO_MASK); 565 else 566 conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK; 567 break; 568 case ESCO_LINK: 569 conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK; 570 break; 571 } 572 573 skb_queue_head_init(&conn->data_q); 574 575 INIT_LIST_HEAD(&conn->chan_list); 576 577 INIT_DELAYED_WORK(&conn->disc_work, hci_conn_timeout); 578 INIT_DELAYED_WORK(&conn->auto_accept_work, hci_conn_auto_accept); 579 INIT_DELAYED_WORK(&conn->idle_work, hci_conn_idle); 580 INIT_DELAYED_WORK(&conn->le_conn_timeout, le_conn_timeout); 581 INIT_WORK(&conn->le_scan_cleanup, le_scan_cleanup); 582 583 atomic_set(&conn->refcnt, 0); 584 585 hci_dev_hold(hdev); 586 587 hci_conn_hash_add(hdev, conn); 588 589 /* The SCO and eSCO connections will only be notified when their 590 * setup has been completed. This is different to ACL links which 591 * can be notified right away. 592 */ 593 if (conn->type != SCO_LINK && conn->type != ESCO_LINK) { 594 if (hdev->notify) 595 hdev->notify(hdev, HCI_NOTIFY_CONN_ADD); 596 } 597 598 hci_conn_init_sysfs(conn); 599 600 return conn; 601 } 602 603 int hci_conn_del(struct hci_conn *conn) 604 { 605 struct hci_dev *hdev = conn->hdev; 606 607 BT_DBG("%s hcon %p handle %d", hdev->name, conn, conn->handle); 608 609 cancel_delayed_work_sync(&conn->disc_work); 610 cancel_delayed_work_sync(&conn->auto_accept_work); 611 cancel_delayed_work_sync(&conn->idle_work); 612 613 if (conn->type == ACL_LINK) { 614 struct hci_conn *sco = conn->link; 615 if (sco) 616 sco->link = NULL; 617 618 /* Unacked frames */ 619 hdev->acl_cnt += conn->sent; 620 } else if (conn->type == LE_LINK) { 621 cancel_delayed_work(&conn->le_conn_timeout); 622 623 if (hdev->le_pkts) 624 hdev->le_cnt += conn->sent; 625 else 626 hdev->acl_cnt += conn->sent; 627 } else { 628 struct hci_conn *acl = conn->link; 629 if (acl) { 630 acl->link = NULL; 631 hci_conn_drop(acl); 632 } 633 } 634 635 if (conn->amp_mgr) 636 amp_mgr_put(conn->amp_mgr); 637 638 skb_queue_purge(&conn->data_q); 639 640 /* Remove the connection from the list and cleanup its remaining 641 * state. This is a separate function since for some cases like 642 * BT_CONNECT_SCAN we *only* want the cleanup part without the 643 * rest of hci_conn_del. 644 */ 645 hci_conn_cleanup(conn); 646 647 return 0; 648 } 649 650 struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src, uint8_t src_type) 651 { 652 int use_src = bacmp(src, BDADDR_ANY); 653 struct hci_dev *hdev = NULL, *d; 654 655 BT_DBG("%pMR -> %pMR", src, dst); 656 657 read_lock(&hci_dev_list_lock); 658 659 list_for_each_entry(d, &hci_dev_list, list) { 660 if (!test_bit(HCI_UP, &d->flags) || 661 hci_dev_test_flag(d, HCI_USER_CHANNEL) || 662 d->dev_type != HCI_PRIMARY) 663 continue; 664 665 /* Simple routing: 666 * No source address - find interface with bdaddr != dst 667 * Source address - find interface with bdaddr == src 668 */ 669 670 if (use_src) { 671 bdaddr_t id_addr; 672 u8 id_addr_type; 673 674 if (src_type == BDADDR_BREDR) { 675 if (!lmp_bredr_capable(d)) 676 continue; 677 bacpy(&id_addr, &d->bdaddr); 678 id_addr_type = BDADDR_BREDR; 679 } else { 680 if (!lmp_le_capable(d)) 681 continue; 682 683 hci_copy_identity_address(d, &id_addr, 684 &id_addr_type); 685 686 /* Convert from HCI to three-value type */ 687 if (id_addr_type == ADDR_LE_DEV_PUBLIC) 688 id_addr_type = BDADDR_LE_PUBLIC; 689 else 690 id_addr_type = BDADDR_LE_RANDOM; 691 } 692 693 if (!bacmp(&id_addr, src) && id_addr_type == src_type) { 694 hdev = d; break; 695 } 696 } else { 697 if (bacmp(&d->bdaddr, dst)) { 698 hdev = d; break; 699 } 700 } 701 } 702 703 if (hdev) 704 hdev = hci_dev_hold(hdev); 705 706 read_unlock(&hci_dev_list_lock); 707 return hdev; 708 } 709 EXPORT_SYMBOL(hci_get_route); 710 711 /* This function requires the caller holds hdev->lock */ 712 void hci_le_conn_failed(struct hci_conn *conn, u8 status) 713 { 714 struct hci_dev *hdev = conn->hdev; 715 struct hci_conn_params *params; 716 717 params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst, 718 conn->dst_type); 719 if (params && params->conn) { 720 hci_conn_drop(params->conn); 721 hci_conn_put(params->conn); 722 params->conn = NULL; 723 } 724 725 conn->state = BT_CLOSED; 726 727 /* If the status indicates successful cancellation of 728 * the attempt (i.e. Unkown Connection Id) there's no point of 729 * notifying failure since we'll go back to keep trying to 730 * connect. The only exception is explicit connect requests 731 * where a timeout + cancel does indicate an actual failure. 732 */ 733 if (status != HCI_ERROR_UNKNOWN_CONN_ID || 734 (params && params->explicit_connect)) 735 mgmt_connect_failed(hdev, &conn->dst, conn->type, 736 conn->dst_type, status); 737 738 hci_connect_cfm(conn, status); 739 740 hci_conn_del(conn); 741 742 /* Since we may have temporarily stopped the background scanning in 743 * favor of connection establishment, we should restart it. 744 */ 745 hci_update_background_scan(hdev); 746 747 /* Re-enable advertising in case this was a failed connection 748 * attempt as a peripheral. 749 */ 750 hci_req_reenable_advertising(hdev); 751 } 752 753 static void create_le_conn_complete(struct hci_dev *hdev, u8 status, u16 opcode) 754 { 755 struct hci_conn *conn; 756 757 hci_dev_lock(hdev); 758 759 conn = hci_lookup_le_connect(hdev); 760 761 if (hdev->adv_instance_cnt) 762 hci_req_resume_adv_instances(hdev); 763 764 if (!status) { 765 hci_connect_le_scan_cleanup(conn); 766 goto done; 767 } 768 769 bt_dev_err(hdev, "request failed to create LE connection: " 770 "status 0x%2.2x", status); 771 772 if (!conn) 773 goto done; 774 775 hci_le_conn_failed(conn, status); 776 777 done: 778 hci_dev_unlock(hdev); 779 } 780 781 static bool conn_use_rpa(struct hci_conn *conn) 782 { 783 struct hci_dev *hdev = conn->hdev; 784 785 return hci_dev_test_flag(hdev, HCI_PRIVACY); 786 } 787 788 static void set_ext_conn_params(struct hci_conn *conn, 789 struct hci_cp_le_ext_conn_param *p) 790 { 791 struct hci_dev *hdev = conn->hdev; 792 793 memset(p, 0, sizeof(*p)); 794 795 p->scan_interval = cpu_to_le16(hdev->le_scan_int_connect); 796 p->scan_window = cpu_to_le16(hdev->le_scan_window_connect); 797 p->conn_interval_min = cpu_to_le16(conn->le_conn_min_interval); 798 p->conn_interval_max = cpu_to_le16(conn->le_conn_max_interval); 799 p->conn_latency = cpu_to_le16(conn->le_conn_latency); 800 p->supervision_timeout = cpu_to_le16(conn->le_supv_timeout); 801 p->min_ce_len = cpu_to_le16(0x0000); 802 p->max_ce_len = cpu_to_le16(0x0000); 803 } 804 805 static void hci_req_add_le_create_conn(struct hci_request *req, 806 struct hci_conn *conn, 807 bdaddr_t *direct_rpa) 808 { 809 struct hci_dev *hdev = conn->hdev; 810 u8 own_addr_type; 811 812 /* If direct address was provided we use it instead of current 813 * address. 814 */ 815 if (direct_rpa) { 816 if (bacmp(&req->hdev->random_addr, direct_rpa)) 817 hci_req_add(req, HCI_OP_LE_SET_RANDOM_ADDR, 6, 818 direct_rpa); 819 820 /* direct address is always RPA */ 821 own_addr_type = ADDR_LE_DEV_RANDOM; 822 } else { 823 /* Update random address, but set require_privacy to false so 824 * that we never connect with an non-resolvable address. 825 */ 826 if (hci_update_random_address(req, false, conn_use_rpa(conn), 827 &own_addr_type)) 828 return; 829 } 830 831 if (use_ext_conn(hdev)) { 832 struct hci_cp_le_ext_create_conn *cp; 833 struct hci_cp_le_ext_conn_param *p; 834 u8 data[sizeof(*cp) + sizeof(*p) * 3]; 835 u32 plen; 836 837 cp = (void *) data; 838 p = (void *) cp->data; 839 840 memset(cp, 0, sizeof(*cp)); 841 842 bacpy(&cp->peer_addr, &conn->dst); 843 cp->peer_addr_type = conn->dst_type; 844 cp->own_addr_type = own_addr_type; 845 846 plen = sizeof(*cp); 847 848 if (scan_1m(hdev)) { 849 cp->phys |= LE_SCAN_PHY_1M; 850 set_ext_conn_params(conn, p); 851 852 p++; 853 plen += sizeof(*p); 854 } 855 856 if (scan_2m(hdev)) { 857 cp->phys |= LE_SCAN_PHY_2M; 858 set_ext_conn_params(conn, p); 859 860 p++; 861 plen += sizeof(*p); 862 } 863 864 if (scan_coded(hdev)) { 865 cp->phys |= LE_SCAN_PHY_CODED; 866 set_ext_conn_params(conn, p); 867 868 plen += sizeof(*p); 869 } 870 871 hci_req_add(req, HCI_OP_LE_EXT_CREATE_CONN, plen, data); 872 873 } else { 874 struct hci_cp_le_create_conn cp; 875 876 memset(&cp, 0, sizeof(cp)); 877 878 cp.scan_interval = cpu_to_le16(hdev->le_scan_int_connect); 879 cp.scan_window = cpu_to_le16(hdev->le_scan_window_connect); 880 881 bacpy(&cp.peer_addr, &conn->dst); 882 cp.peer_addr_type = conn->dst_type; 883 cp.own_address_type = own_addr_type; 884 cp.conn_interval_min = cpu_to_le16(conn->le_conn_min_interval); 885 cp.conn_interval_max = cpu_to_le16(conn->le_conn_max_interval); 886 cp.conn_latency = cpu_to_le16(conn->le_conn_latency); 887 cp.supervision_timeout = cpu_to_le16(conn->le_supv_timeout); 888 cp.min_ce_len = cpu_to_le16(0x0000); 889 cp.max_ce_len = cpu_to_le16(0x0000); 890 891 hci_req_add(req, HCI_OP_LE_CREATE_CONN, sizeof(cp), &cp); 892 } 893 894 conn->state = BT_CONNECT; 895 clear_bit(HCI_CONN_SCANNING, &conn->flags); 896 } 897 898 static void hci_req_directed_advertising(struct hci_request *req, 899 struct hci_conn *conn) 900 { 901 struct hci_dev *hdev = req->hdev; 902 u8 own_addr_type; 903 u8 enable; 904 905 if (ext_adv_capable(hdev)) { 906 struct hci_cp_le_set_ext_adv_params cp; 907 bdaddr_t random_addr; 908 909 /* Set require_privacy to false so that the remote device has a 910 * chance of identifying us. 911 */ 912 if (hci_get_random_address(hdev, false, conn_use_rpa(conn), NULL, 913 &own_addr_type, &random_addr) < 0) 914 return; 915 916 memset(&cp, 0, sizeof(cp)); 917 918 cp.evt_properties = cpu_to_le16(LE_LEGACY_ADV_DIRECT_IND); 919 cp.own_addr_type = own_addr_type; 920 cp.channel_map = hdev->le_adv_channel_map; 921 cp.tx_power = HCI_TX_POWER_INVALID; 922 cp.primary_phy = HCI_ADV_PHY_1M; 923 cp.secondary_phy = HCI_ADV_PHY_1M; 924 cp.handle = 0; /* Use instance 0 for directed adv */ 925 cp.own_addr_type = own_addr_type; 926 cp.peer_addr_type = conn->dst_type; 927 bacpy(&cp.peer_addr, &conn->dst); 928 929 /* As per Core Spec 5.2 Vol 2, PART E, Sec 7.8.53, for 930 * advertising_event_property LE_LEGACY_ADV_DIRECT_IND 931 * does not supports advertising data when the advertising set already 932 * contains some, the controller shall return erroc code 'Invalid 933 * HCI Command Parameters(0x12). 934 * So it is required to remove adv set for handle 0x00. since we use 935 * instance 0 for directed adv. 936 */ 937 __hci_req_remove_ext_adv_instance(req, cp.handle); 938 939 hci_req_add(req, HCI_OP_LE_SET_EXT_ADV_PARAMS, sizeof(cp), &cp); 940 941 if (own_addr_type == ADDR_LE_DEV_RANDOM && 942 bacmp(&random_addr, BDADDR_ANY) && 943 bacmp(&random_addr, &hdev->random_addr)) { 944 struct hci_cp_le_set_adv_set_rand_addr cp; 945 946 memset(&cp, 0, sizeof(cp)); 947 948 cp.handle = 0; 949 bacpy(&cp.bdaddr, &random_addr); 950 951 hci_req_add(req, 952 HCI_OP_LE_SET_ADV_SET_RAND_ADDR, 953 sizeof(cp), &cp); 954 } 955 956 __hci_req_enable_ext_advertising(req, 0x00); 957 } else { 958 struct hci_cp_le_set_adv_param cp; 959 960 /* Clear the HCI_LE_ADV bit temporarily so that the 961 * hci_update_random_address knows that it's safe to go ahead 962 * and write a new random address. The flag will be set back on 963 * as soon as the SET_ADV_ENABLE HCI command completes. 964 */ 965 hci_dev_clear_flag(hdev, HCI_LE_ADV); 966 967 /* Set require_privacy to false so that the remote device has a 968 * chance of identifying us. 969 */ 970 if (hci_update_random_address(req, false, conn_use_rpa(conn), 971 &own_addr_type) < 0) 972 return; 973 974 memset(&cp, 0, sizeof(cp)); 975 976 /* Some controllers might reject command if intervals are not 977 * within range for undirected advertising. 978 * BCM20702A0 is known to be affected by this. 979 */ 980 cp.min_interval = cpu_to_le16(0x0020); 981 cp.max_interval = cpu_to_le16(0x0020); 982 983 cp.type = LE_ADV_DIRECT_IND; 984 cp.own_address_type = own_addr_type; 985 cp.direct_addr_type = conn->dst_type; 986 bacpy(&cp.direct_addr, &conn->dst); 987 cp.channel_map = hdev->le_adv_channel_map; 988 989 hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp); 990 991 enable = 0x01; 992 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), 993 &enable); 994 } 995 996 conn->state = BT_CONNECT; 997 } 998 999 struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst, 1000 u8 dst_type, u8 sec_level, u16 conn_timeout, 1001 u8 role, bdaddr_t *direct_rpa) 1002 { 1003 struct hci_conn_params *params; 1004 struct hci_conn *conn; 1005 struct smp_irk *irk; 1006 struct hci_request req; 1007 int err; 1008 1009 /* This ensures that during disable le_scan address resolution 1010 * will not be disabled if it is followed by le_create_conn 1011 */ 1012 bool rpa_le_conn = true; 1013 1014 /* Let's make sure that le is enabled.*/ 1015 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 1016 if (lmp_le_capable(hdev)) 1017 return ERR_PTR(-ECONNREFUSED); 1018 1019 return ERR_PTR(-EOPNOTSUPP); 1020 } 1021 1022 /* Since the controller supports only one LE connection attempt at a 1023 * time, we return -EBUSY if there is any connection attempt running. 1024 */ 1025 if (hci_lookup_le_connect(hdev)) 1026 return ERR_PTR(-EBUSY); 1027 1028 /* If there's already a connection object but it's not in 1029 * scanning state it means it must already be established, in 1030 * which case we can't do anything else except report a failure 1031 * to connect. 1032 */ 1033 conn = hci_conn_hash_lookup_le(hdev, dst, dst_type); 1034 if (conn && !test_bit(HCI_CONN_SCANNING, &conn->flags)) { 1035 return ERR_PTR(-EBUSY); 1036 } 1037 1038 /* When given an identity address with existing identity 1039 * resolving key, the connection needs to be established 1040 * to a resolvable random address. 1041 * 1042 * Storing the resolvable random address is required here 1043 * to handle connection failures. The address will later 1044 * be resolved back into the original identity address 1045 * from the connect request. 1046 */ 1047 irk = hci_find_irk_by_addr(hdev, dst, dst_type); 1048 if (irk && bacmp(&irk->rpa, BDADDR_ANY)) { 1049 dst = &irk->rpa; 1050 dst_type = ADDR_LE_DEV_RANDOM; 1051 } 1052 1053 if (conn) { 1054 bacpy(&conn->dst, dst); 1055 } else { 1056 conn = hci_conn_add(hdev, LE_LINK, dst, role); 1057 if (!conn) 1058 return ERR_PTR(-ENOMEM); 1059 hci_conn_hold(conn); 1060 conn->pending_sec_level = sec_level; 1061 } 1062 1063 conn->dst_type = dst_type; 1064 conn->sec_level = BT_SECURITY_LOW; 1065 conn->conn_timeout = conn_timeout; 1066 1067 hci_req_init(&req, hdev); 1068 1069 /* Disable advertising if we're active. For master role 1070 * connections most controllers will refuse to connect if 1071 * advertising is enabled, and for slave role connections we 1072 * anyway have to disable it in order to start directed 1073 * advertising. Any registered advertisements will be 1074 * re-enabled after the connection attempt is finished. 1075 */ 1076 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 1077 __hci_req_pause_adv_instances(&req); 1078 1079 /* If requested to connect as slave use directed advertising */ 1080 if (conn->role == HCI_ROLE_SLAVE) { 1081 /* If we're active scanning most controllers are unable 1082 * to initiate advertising. Simply reject the attempt. 1083 */ 1084 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) && 1085 hdev->le_scan_type == LE_SCAN_ACTIVE) { 1086 hci_req_purge(&req); 1087 hci_conn_del(conn); 1088 return ERR_PTR(-EBUSY); 1089 } 1090 1091 hci_req_directed_advertising(&req, conn); 1092 goto create_conn; 1093 } 1094 1095 params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type); 1096 if (params) { 1097 conn->le_conn_min_interval = params->conn_min_interval; 1098 conn->le_conn_max_interval = params->conn_max_interval; 1099 conn->le_conn_latency = params->conn_latency; 1100 conn->le_supv_timeout = params->supervision_timeout; 1101 } else { 1102 conn->le_conn_min_interval = hdev->le_conn_min_interval; 1103 conn->le_conn_max_interval = hdev->le_conn_max_interval; 1104 conn->le_conn_latency = hdev->le_conn_latency; 1105 conn->le_supv_timeout = hdev->le_supv_timeout; 1106 } 1107 1108 /* If controller is scanning, we stop it since some controllers are 1109 * not able to scan and connect at the same time. Also set the 1110 * HCI_LE_SCAN_INTERRUPTED flag so that the command complete 1111 * handler for scan disabling knows to set the correct discovery 1112 * state. 1113 */ 1114 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) { 1115 hci_req_add_le_scan_disable(&req, rpa_le_conn); 1116 hci_dev_set_flag(hdev, HCI_LE_SCAN_INTERRUPTED); 1117 } 1118 1119 hci_req_add_le_create_conn(&req, conn, direct_rpa); 1120 1121 create_conn: 1122 err = hci_req_run(&req, create_le_conn_complete); 1123 if (err) { 1124 hci_conn_del(conn); 1125 1126 if (hdev->adv_instance_cnt) 1127 hci_req_resume_adv_instances(hdev); 1128 1129 return ERR_PTR(err); 1130 } 1131 1132 return conn; 1133 } 1134 1135 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type) 1136 { 1137 struct hci_conn *conn; 1138 1139 conn = hci_conn_hash_lookup_le(hdev, addr, type); 1140 if (!conn) 1141 return false; 1142 1143 if (conn->state != BT_CONNECTED) 1144 return false; 1145 1146 return true; 1147 } 1148 1149 /* This function requires the caller holds hdev->lock */ 1150 static int hci_explicit_conn_params_set(struct hci_dev *hdev, 1151 bdaddr_t *addr, u8 addr_type) 1152 { 1153 struct hci_conn_params *params; 1154 1155 if (is_connected(hdev, addr, addr_type)) 1156 return -EISCONN; 1157 1158 params = hci_conn_params_lookup(hdev, addr, addr_type); 1159 if (!params) { 1160 params = hci_conn_params_add(hdev, addr, addr_type); 1161 if (!params) 1162 return -ENOMEM; 1163 1164 /* If we created new params, mark them to be deleted in 1165 * hci_connect_le_scan_cleanup. It's different case than 1166 * existing disabled params, those will stay after cleanup. 1167 */ 1168 params->auto_connect = HCI_AUTO_CONN_EXPLICIT; 1169 } 1170 1171 /* We're trying to connect, so make sure params are at pend_le_conns */ 1172 if (params->auto_connect == HCI_AUTO_CONN_DISABLED || 1173 params->auto_connect == HCI_AUTO_CONN_REPORT || 1174 params->auto_connect == HCI_AUTO_CONN_EXPLICIT) { 1175 list_del_init(¶ms->action); 1176 list_add(¶ms->action, &hdev->pend_le_conns); 1177 } 1178 1179 params->explicit_connect = true; 1180 1181 BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type, 1182 params->auto_connect); 1183 1184 return 0; 1185 } 1186 1187 /* This function requires the caller holds hdev->lock */ 1188 struct hci_conn *hci_connect_le_scan(struct hci_dev *hdev, bdaddr_t *dst, 1189 u8 dst_type, u8 sec_level, 1190 u16 conn_timeout, 1191 enum conn_reasons conn_reason) 1192 { 1193 struct hci_conn *conn; 1194 1195 /* Let's make sure that le is enabled.*/ 1196 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 1197 if (lmp_le_capable(hdev)) 1198 return ERR_PTR(-ECONNREFUSED); 1199 1200 return ERR_PTR(-EOPNOTSUPP); 1201 } 1202 1203 /* Some devices send ATT messages as soon as the physical link is 1204 * established. To be able to handle these ATT messages, the user- 1205 * space first establishes the connection and then starts the pairing 1206 * process. 1207 * 1208 * So if a hci_conn object already exists for the following connection 1209 * attempt, we simply update pending_sec_level and auth_type fields 1210 * and return the object found. 1211 */ 1212 conn = hci_conn_hash_lookup_le(hdev, dst, dst_type); 1213 if (conn) { 1214 if (conn->pending_sec_level < sec_level) 1215 conn->pending_sec_level = sec_level; 1216 goto done; 1217 } 1218 1219 BT_DBG("requesting refresh of dst_addr"); 1220 1221 conn = hci_conn_add(hdev, LE_LINK, dst, HCI_ROLE_MASTER); 1222 if (!conn) 1223 return ERR_PTR(-ENOMEM); 1224 1225 if (hci_explicit_conn_params_set(hdev, dst, dst_type) < 0) { 1226 hci_conn_del(conn); 1227 return ERR_PTR(-EBUSY); 1228 } 1229 1230 conn->state = BT_CONNECT; 1231 set_bit(HCI_CONN_SCANNING, &conn->flags); 1232 conn->dst_type = dst_type; 1233 conn->sec_level = BT_SECURITY_LOW; 1234 conn->pending_sec_level = sec_level; 1235 conn->conn_timeout = conn_timeout; 1236 conn->conn_reason = conn_reason; 1237 1238 hci_update_background_scan(hdev); 1239 1240 done: 1241 hci_conn_hold(conn); 1242 return conn; 1243 } 1244 1245 struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst, 1246 u8 sec_level, u8 auth_type, 1247 enum conn_reasons conn_reason) 1248 { 1249 struct hci_conn *acl; 1250 1251 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 1252 if (lmp_bredr_capable(hdev)) 1253 return ERR_PTR(-ECONNREFUSED); 1254 1255 return ERR_PTR(-EOPNOTSUPP); 1256 } 1257 1258 acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst); 1259 if (!acl) { 1260 acl = hci_conn_add(hdev, ACL_LINK, dst, HCI_ROLE_MASTER); 1261 if (!acl) 1262 return ERR_PTR(-ENOMEM); 1263 } 1264 1265 hci_conn_hold(acl); 1266 1267 acl->conn_reason = conn_reason; 1268 if (acl->state == BT_OPEN || acl->state == BT_CLOSED) { 1269 acl->sec_level = BT_SECURITY_LOW; 1270 acl->pending_sec_level = sec_level; 1271 acl->auth_type = auth_type; 1272 hci_acl_create_connection(acl); 1273 } 1274 1275 return acl; 1276 } 1277 1278 struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type, bdaddr_t *dst, 1279 __u16 setting) 1280 { 1281 struct hci_conn *acl; 1282 struct hci_conn *sco; 1283 1284 acl = hci_connect_acl(hdev, dst, BT_SECURITY_LOW, HCI_AT_NO_BONDING, 1285 CONN_REASON_SCO_CONNECT); 1286 if (IS_ERR(acl)) 1287 return acl; 1288 1289 sco = hci_conn_hash_lookup_ba(hdev, type, dst); 1290 if (!sco) { 1291 sco = hci_conn_add(hdev, type, dst, HCI_ROLE_MASTER); 1292 if (!sco) { 1293 hci_conn_drop(acl); 1294 return ERR_PTR(-ENOMEM); 1295 } 1296 } 1297 1298 acl->link = sco; 1299 sco->link = acl; 1300 1301 hci_conn_hold(sco); 1302 1303 sco->setting = setting; 1304 1305 if (acl->state == BT_CONNECTED && 1306 (sco->state == BT_OPEN || sco->state == BT_CLOSED)) { 1307 set_bit(HCI_CONN_POWER_SAVE, &acl->flags); 1308 hci_conn_enter_active_mode(acl, BT_POWER_FORCE_ACTIVE_ON); 1309 1310 if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->flags)) { 1311 /* defer SCO setup until mode change completed */ 1312 set_bit(HCI_CONN_SCO_SETUP_PEND, &acl->flags); 1313 return sco; 1314 } 1315 1316 hci_sco_setup(acl, 0x00); 1317 } 1318 1319 return sco; 1320 } 1321 1322 /* Check link security requirement */ 1323 int hci_conn_check_link_mode(struct hci_conn *conn) 1324 { 1325 BT_DBG("hcon %p", conn); 1326 1327 /* In Secure Connections Only mode, it is required that Secure 1328 * Connections is used and the link is encrypted with AES-CCM 1329 * using a P-256 authenticated combination key. 1330 */ 1331 if (hci_dev_test_flag(conn->hdev, HCI_SC_ONLY)) { 1332 if (!hci_conn_sc_enabled(conn) || 1333 !test_bit(HCI_CONN_AES_CCM, &conn->flags) || 1334 conn->key_type != HCI_LK_AUTH_COMBINATION_P256) 1335 return 0; 1336 } 1337 1338 /* AES encryption is required for Level 4: 1339 * 1340 * BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 3, Part C 1341 * page 1319: 1342 * 1343 * 128-bit equivalent strength for link and encryption keys 1344 * required using FIPS approved algorithms (E0 not allowed, 1345 * SAFER+ not allowed, and P-192 not allowed; encryption key 1346 * not shortened) 1347 */ 1348 if (conn->sec_level == BT_SECURITY_FIPS && 1349 !test_bit(HCI_CONN_AES_CCM, &conn->flags)) { 1350 bt_dev_err(conn->hdev, 1351 "Invalid security: Missing AES-CCM usage"); 1352 return 0; 1353 } 1354 1355 if (hci_conn_ssp_enabled(conn) && 1356 !test_bit(HCI_CONN_ENCRYPT, &conn->flags)) 1357 return 0; 1358 1359 return 1; 1360 } 1361 1362 /* Authenticate remote device */ 1363 static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type) 1364 { 1365 BT_DBG("hcon %p", conn); 1366 1367 if (conn->pending_sec_level > sec_level) 1368 sec_level = conn->pending_sec_level; 1369 1370 if (sec_level > conn->sec_level) 1371 conn->pending_sec_level = sec_level; 1372 else if (test_bit(HCI_CONN_AUTH, &conn->flags)) 1373 return 1; 1374 1375 /* Make sure we preserve an existing MITM requirement*/ 1376 auth_type |= (conn->auth_type & 0x01); 1377 1378 conn->auth_type = auth_type; 1379 1380 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) { 1381 struct hci_cp_auth_requested cp; 1382 1383 cp.handle = cpu_to_le16(conn->handle); 1384 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED, 1385 sizeof(cp), &cp); 1386 1387 /* If we're already encrypted set the REAUTH_PEND flag, 1388 * otherwise set the ENCRYPT_PEND. 1389 */ 1390 if (test_bit(HCI_CONN_ENCRYPT, &conn->flags)) 1391 set_bit(HCI_CONN_REAUTH_PEND, &conn->flags); 1392 else 1393 set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags); 1394 } 1395 1396 return 0; 1397 } 1398 1399 /* Encrypt the link */ 1400 static void hci_conn_encrypt(struct hci_conn *conn) 1401 { 1402 BT_DBG("hcon %p", conn); 1403 1404 if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) { 1405 struct hci_cp_set_conn_encrypt cp; 1406 cp.handle = cpu_to_le16(conn->handle); 1407 cp.encrypt = 0x01; 1408 hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp), 1409 &cp); 1410 } 1411 } 1412 1413 /* Enable security */ 1414 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type, 1415 bool initiator) 1416 { 1417 BT_DBG("hcon %p", conn); 1418 1419 if (conn->type == LE_LINK) 1420 return smp_conn_security(conn, sec_level); 1421 1422 /* For sdp we don't need the link key. */ 1423 if (sec_level == BT_SECURITY_SDP) 1424 return 1; 1425 1426 /* For non 2.1 devices and low security level we don't need the link 1427 key. */ 1428 if (sec_level == BT_SECURITY_LOW && !hci_conn_ssp_enabled(conn)) 1429 return 1; 1430 1431 /* For other security levels we need the link key. */ 1432 if (!test_bit(HCI_CONN_AUTH, &conn->flags)) 1433 goto auth; 1434 1435 /* An authenticated FIPS approved combination key has sufficient 1436 * security for security level 4. */ 1437 if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256 && 1438 sec_level == BT_SECURITY_FIPS) 1439 goto encrypt; 1440 1441 /* An authenticated combination key has sufficient security for 1442 security level 3. */ 1443 if ((conn->key_type == HCI_LK_AUTH_COMBINATION_P192 || 1444 conn->key_type == HCI_LK_AUTH_COMBINATION_P256) && 1445 sec_level == BT_SECURITY_HIGH) 1446 goto encrypt; 1447 1448 /* An unauthenticated combination key has sufficient security for 1449 security level 1 and 2. */ 1450 if ((conn->key_type == HCI_LK_UNAUTH_COMBINATION_P192 || 1451 conn->key_type == HCI_LK_UNAUTH_COMBINATION_P256) && 1452 (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW)) 1453 goto encrypt; 1454 1455 /* A combination key has always sufficient security for the security 1456 levels 1 or 2. High security level requires the combination key 1457 is generated using maximum PIN code length (16). 1458 For pre 2.1 units. */ 1459 if (conn->key_type == HCI_LK_COMBINATION && 1460 (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW || 1461 conn->pin_length == 16)) 1462 goto encrypt; 1463 1464 auth: 1465 if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) 1466 return 0; 1467 1468 if (initiator) 1469 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags); 1470 1471 if (!hci_conn_auth(conn, sec_level, auth_type)) 1472 return 0; 1473 1474 encrypt: 1475 if (test_bit(HCI_CONN_ENCRYPT, &conn->flags)) { 1476 /* Ensure that the encryption key size has been read, 1477 * otherwise stall the upper layer responses. 1478 */ 1479 if (!conn->enc_key_size) 1480 return 0; 1481 1482 /* Nothing else needed, all requirements are met */ 1483 return 1; 1484 } 1485 1486 hci_conn_encrypt(conn); 1487 return 0; 1488 } 1489 EXPORT_SYMBOL(hci_conn_security); 1490 1491 /* Check secure link requirement */ 1492 int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level) 1493 { 1494 BT_DBG("hcon %p", conn); 1495 1496 /* Accept if non-secure or higher security level is required */ 1497 if (sec_level != BT_SECURITY_HIGH && sec_level != BT_SECURITY_FIPS) 1498 return 1; 1499 1500 /* Accept if secure or higher security level is already present */ 1501 if (conn->sec_level == BT_SECURITY_HIGH || 1502 conn->sec_level == BT_SECURITY_FIPS) 1503 return 1; 1504 1505 /* Reject not secure link */ 1506 return 0; 1507 } 1508 EXPORT_SYMBOL(hci_conn_check_secure); 1509 1510 /* Switch role */ 1511 int hci_conn_switch_role(struct hci_conn *conn, __u8 role) 1512 { 1513 BT_DBG("hcon %p", conn); 1514 1515 if (role == conn->role) 1516 return 1; 1517 1518 if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->flags)) { 1519 struct hci_cp_switch_role cp; 1520 bacpy(&cp.bdaddr, &conn->dst); 1521 cp.role = role; 1522 hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp); 1523 } 1524 1525 return 0; 1526 } 1527 EXPORT_SYMBOL(hci_conn_switch_role); 1528 1529 /* Enter active mode */ 1530 void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active) 1531 { 1532 struct hci_dev *hdev = conn->hdev; 1533 1534 BT_DBG("hcon %p mode %d", conn, conn->mode); 1535 1536 if (conn->mode != HCI_CM_SNIFF) 1537 goto timer; 1538 1539 if (!test_bit(HCI_CONN_POWER_SAVE, &conn->flags) && !force_active) 1540 goto timer; 1541 1542 if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) { 1543 struct hci_cp_exit_sniff_mode cp; 1544 cp.handle = cpu_to_le16(conn->handle); 1545 hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp); 1546 } 1547 1548 timer: 1549 if (hdev->idle_timeout > 0) 1550 queue_delayed_work(hdev->workqueue, &conn->idle_work, 1551 msecs_to_jiffies(hdev->idle_timeout)); 1552 } 1553 1554 /* Drop all connection on the device */ 1555 void hci_conn_hash_flush(struct hci_dev *hdev) 1556 { 1557 struct hci_conn_hash *h = &hdev->conn_hash; 1558 struct hci_conn *c, *n; 1559 1560 BT_DBG("hdev %s", hdev->name); 1561 1562 list_for_each_entry_safe(c, n, &h->list, list) { 1563 c->state = BT_CLOSED; 1564 1565 hci_disconn_cfm(c, HCI_ERROR_LOCAL_HOST_TERM); 1566 hci_conn_del(c); 1567 } 1568 } 1569 1570 /* Check pending connect attempts */ 1571 void hci_conn_check_pending(struct hci_dev *hdev) 1572 { 1573 struct hci_conn *conn; 1574 1575 BT_DBG("hdev %s", hdev->name); 1576 1577 hci_dev_lock(hdev); 1578 1579 conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2); 1580 if (conn) 1581 hci_acl_create_connection(conn); 1582 1583 hci_dev_unlock(hdev); 1584 } 1585 1586 static u32 get_link_mode(struct hci_conn *conn) 1587 { 1588 u32 link_mode = 0; 1589 1590 if (conn->role == HCI_ROLE_MASTER) 1591 link_mode |= HCI_LM_MASTER; 1592 1593 if (test_bit(HCI_CONN_ENCRYPT, &conn->flags)) 1594 link_mode |= HCI_LM_ENCRYPT; 1595 1596 if (test_bit(HCI_CONN_AUTH, &conn->flags)) 1597 link_mode |= HCI_LM_AUTH; 1598 1599 if (test_bit(HCI_CONN_SECURE, &conn->flags)) 1600 link_mode |= HCI_LM_SECURE; 1601 1602 if (test_bit(HCI_CONN_FIPS, &conn->flags)) 1603 link_mode |= HCI_LM_FIPS; 1604 1605 return link_mode; 1606 } 1607 1608 int hci_get_conn_list(void __user *arg) 1609 { 1610 struct hci_conn *c; 1611 struct hci_conn_list_req req, *cl; 1612 struct hci_conn_info *ci; 1613 struct hci_dev *hdev; 1614 int n = 0, size, err; 1615 1616 if (copy_from_user(&req, arg, sizeof(req))) 1617 return -EFAULT; 1618 1619 if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci)) 1620 return -EINVAL; 1621 1622 size = sizeof(req) + req.conn_num * sizeof(*ci); 1623 1624 cl = kmalloc(size, GFP_KERNEL); 1625 if (!cl) 1626 return -ENOMEM; 1627 1628 hdev = hci_dev_get(req.dev_id); 1629 if (!hdev) { 1630 kfree(cl); 1631 return -ENODEV; 1632 } 1633 1634 ci = cl->conn_info; 1635 1636 hci_dev_lock(hdev); 1637 list_for_each_entry(c, &hdev->conn_hash.list, list) { 1638 bacpy(&(ci + n)->bdaddr, &c->dst); 1639 (ci + n)->handle = c->handle; 1640 (ci + n)->type = c->type; 1641 (ci + n)->out = c->out; 1642 (ci + n)->state = c->state; 1643 (ci + n)->link_mode = get_link_mode(c); 1644 if (++n >= req.conn_num) 1645 break; 1646 } 1647 hci_dev_unlock(hdev); 1648 1649 cl->dev_id = hdev->id; 1650 cl->conn_num = n; 1651 size = sizeof(req) + n * sizeof(*ci); 1652 1653 hci_dev_put(hdev); 1654 1655 err = copy_to_user(arg, cl, size); 1656 kfree(cl); 1657 1658 return err ? -EFAULT : 0; 1659 } 1660 1661 int hci_get_conn_info(struct hci_dev *hdev, void __user *arg) 1662 { 1663 struct hci_conn_info_req req; 1664 struct hci_conn_info ci; 1665 struct hci_conn *conn; 1666 char __user *ptr = arg + sizeof(req); 1667 1668 if (copy_from_user(&req, arg, sizeof(req))) 1669 return -EFAULT; 1670 1671 hci_dev_lock(hdev); 1672 conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr); 1673 if (conn) { 1674 bacpy(&ci.bdaddr, &conn->dst); 1675 ci.handle = conn->handle; 1676 ci.type = conn->type; 1677 ci.out = conn->out; 1678 ci.state = conn->state; 1679 ci.link_mode = get_link_mode(conn); 1680 } 1681 hci_dev_unlock(hdev); 1682 1683 if (!conn) 1684 return -ENOENT; 1685 1686 return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0; 1687 } 1688 1689 int hci_get_auth_info(struct hci_dev *hdev, void __user *arg) 1690 { 1691 struct hci_auth_info_req req; 1692 struct hci_conn *conn; 1693 1694 if (copy_from_user(&req, arg, sizeof(req))) 1695 return -EFAULT; 1696 1697 hci_dev_lock(hdev); 1698 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr); 1699 if (conn) 1700 req.type = conn->auth_type; 1701 hci_dev_unlock(hdev); 1702 1703 if (!conn) 1704 return -ENOENT; 1705 1706 return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0; 1707 } 1708 1709 struct hci_chan *hci_chan_create(struct hci_conn *conn) 1710 { 1711 struct hci_dev *hdev = conn->hdev; 1712 struct hci_chan *chan; 1713 1714 BT_DBG("%s hcon %p", hdev->name, conn); 1715 1716 if (test_bit(HCI_CONN_DROP, &conn->flags)) { 1717 BT_DBG("Refusing to create new hci_chan"); 1718 return NULL; 1719 } 1720 1721 chan = kzalloc(sizeof(*chan), GFP_KERNEL); 1722 if (!chan) 1723 return NULL; 1724 1725 chan->conn = hci_conn_get(conn); 1726 skb_queue_head_init(&chan->data_q); 1727 chan->state = BT_CONNECTED; 1728 1729 list_add_rcu(&chan->list, &conn->chan_list); 1730 1731 return chan; 1732 } 1733 1734 void hci_chan_del(struct hci_chan *chan) 1735 { 1736 struct hci_conn *conn = chan->conn; 1737 struct hci_dev *hdev = conn->hdev; 1738 1739 BT_DBG("%s hcon %p chan %p", hdev->name, conn, chan); 1740 1741 list_del_rcu(&chan->list); 1742 1743 synchronize_rcu(); 1744 1745 /* Prevent new hci_chan's to be created for this hci_conn */ 1746 set_bit(HCI_CONN_DROP, &conn->flags); 1747 1748 hci_conn_put(conn); 1749 1750 skb_queue_purge(&chan->data_q); 1751 kfree(chan); 1752 } 1753 1754 void hci_chan_list_flush(struct hci_conn *conn) 1755 { 1756 struct hci_chan *chan, *n; 1757 1758 BT_DBG("hcon %p", conn); 1759 1760 list_for_each_entry_safe(chan, n, &conn->chan_list, list) 1761 hci_chan_del(chan); 1762 } 1763 1764 static struct hci_chan *__hci_chan_lookup_handle(struct hci_conn *hcon, 1765 __u16 handle) 1766 { 1767 struct hci_chan *hchan; 1768 1769 list_for_each_entry(hchan, &hcon->chan_list, list) { 1770 if (hchan->handle == handle) 1771 return hchan; 1772 } 1773 1774 return NULL; 1775 } 1776 1777 struct hci_chan *hci_chan_lookup_handle(struct hci_dev *hdev, __u16 handle) 1778 { 1779 struct hci_conn_hash *h = &hdev->conn_hash; 1780 struct hci_conn *hcon; 1781 struct hci_chan *hchan = NULL; 1782 1783 rcu_read_lock(); 1784 1785 list_for_each_entry_rcu(hcon, &h->list, list) { 1786 hchan = __hci_chan_lookup_handle(hcon, handle); 1787 if (hchan) 1788 break; 1789 } 1790 1791 rcu_read_unlock(); 1792 1793 return hchan; 1794 } 1795 1796 u32 hci_conn_get_phy(struct hci_conn *conn) 1797 { 1798 u32 phys = 0; 1799 1800 hci_dev_lock(conn->hdev); 1801 1802 /* BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 2, Part B page 471: 1803 * Table 6.2: Packets defined for synchronous, asynchronous, and 1804 * CSB logical transport types. 1805 */ 1806 switch (conn->type) { 1807 case SCO_LINK: 1808 /* SCO logical transport (1 Mb/s): 1809 * HV1, HV2, HV3 and DV. 1810 */ 1811 phys |= BT_PHY_BR_1M_1SLOT; 1812 1813 break; 1814 1815 case ACL_LINK: 1816 /* ACL logical transport (1 Mb/s) ptt=0: 1817 * DH1, DM3, DH3, DM5 and DH5. 1818 */ 1819 phys |= BT_PHY_BR_1M_1SLOT; 1820 1821 if (conn->pkt_type & (HCI_DM3 | HCI_DH3)) 1822 phys |= BT_PHY_BR_1M_3SLOT; 1823 1824 if (conn->pkt_type & (HCI_DM5 | HCI_DH5)) 1825 phys |= BT_PHY_BR_1M_5SLOT; 1826 1827 /* ACL logical transport (2 Mb/s) ptt=1: 1828 * 2-DH1, 2-DH3 and 2-DH5. 1829 */ 1830 if (!(conn->pkt_type & HCI_2DH1)) 1831 phys |= BT_PHY_EDR_2M_1SLOT; 1832 1833 if (!(conn->pkt_type & HCI_2DH3)) 1834 phys |= BT_PHY_EDR_2M_3SLOT; 1835 1836 if (!(conn->pkt_type & HCI_2DH5)) 1837 phys |= BT_PHY_EDR_2M_5SLOT; 1838 1839 /* ACL logical transport (3 Mb/s) ptt=1: 1840 * 3-DH1, 3-DH3 and 3-DH5. 1841 */ 1842 if (!(conn->pkt_type & HCI_3DH1)) 1843 phys |= BT_PHY_EDR_3M_1SLOT; 1844 1845 if (!(conn->pkt_type & HCI_3DH3)) 1846 phys |= BT_PHY_EDR_3M_3SLOT; 1847 1848 if (!(conn->pkt_type & HCI_3DH5)) 1849 phys |= BT_PHY_EDR_3M_5SLOT; 1850 1851 break; 1852 1853 case ESCO_LINK: 1854 /* eSCO logical transport (1 Mb/s): EV3, EV4 and EV5 */ 1855 phys |= BT_PHY_BR_1M_1SLOT; 1856 1857 if (!(conn->pkt_type & (ESCO_EV4 | ESCO_EV5))) 1858 phys |= BT_PHY_BR_1M_3SLOT; 1859 1860 /* eSCO logical transport (2 Mb/s): 2-EV3, 2-EV5 */ 1861 if (!(conn->pkt_type & ESCO_2EV3)) 1862 phys |= BT_PHY_EDR_2M_1SLOT; 1863 1864 if (!(conn->pkt_type & ESCO_2EV5)) 1865 phys |= BT_PHY_EDR_2M_3SLOT; 1866 1867 /* eSCO logical transport (3 Mb/s): 3-EV3, 3-EV5 */ 1868 if (!(conn->pkt_type & ESCO_3EV3)) 1869 phys |= BT_PHY_EDR_3M_1SLOT; 1870 1871 if (!(conn->pkt_type & ESCO_3EV5)) 1872 phys |= BT_PHY_EDR_3M_3SLOT; 1873 1874 break; 1875 1876 case LE_LINK: 1877 if (conn->le_tx_phy & HCI_LE_SET_PHY_1M) 1878 phys |= BT_PHY_LE_1M_TX; 1879 1880 if (conn->le_rx_phy & HCI_LE_SET_PHY_1M) 1881 phys |= BT_PHY_LE_1M_RX; 1882 1883 if (conn->le_tx_phy & HCI_LE_SET_PHY_2M) 1884 phys |= BT_PHY_LE_2M_TX; 1885 1886 if (conn->le_rx_phy & HCI_LE_SET_PHY_2M) 1887 phys |= BT_PHY_LE_2M_RX; 1888 1889 if (conn->le_tx_phy & HCI_LE_SET_PHY_CODED) 1890 phys |= BT_PHY_LE_CODED_TX; 1891 1892 if (conn->le_rx_phy & HCI_LE_SET_PHY_CODED) 1893 phys |= BT_PHY_LE_CODED_RX; 1894 1895 break; 1896 } 1897 1898 hci_dev_unlock(conn->hdev); 1899 1900 return phys; 1901 } 1902