1 /* 2 BlueZ - Bluetooth protocol stack for Linux 3 Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved. 4 Copyright 2023-2024 NXP 5 6 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com> 7 8 This program is free software; you can redistribute it and/or modify 9 it under the terms of the GNU General Public License version 2 as 10 published by the Free Software Foundation; 11 12 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 13 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 14 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 15 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 16 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 17 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 18 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 19 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 20 21 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 22 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 23 SOFTWARE IS DISCLAIMED. 24 */ 25 26 /* Bluetooth HCI connection handling. */ 27 28 #include <linux/export.h> 29 #include <linux/debugfs.h> 30 #include <linux/errqueue.h> 31 32 #include <net/bluetooth/bluetooth.h> 33 #include <net/bluetooth/hci_core.h> 34 #include <net/bluetooth/l2cap.h> 35 #include <net/bluetooth/iso.h> 36 #include <net/bluetooth/mgmt.h> 37 38 #include "smp.h" 39 #include "eir.h" 40 41 struct sco_param { 42 u16 pkt_type; 43 u16 max_latency; 44 u8 retrans_effort; 45 }; 46 47 struct conn_handle_t { 48 struct hci_conn *conn; 49 __u16 handle; 50 }; 51 52 static const struct sco_param esco_param_cvsd[] = { 53 { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000a, 0x01 }, /* S3 */ 54 { EDR_ESCO_MASK & ~ESCO_2EV3, 0x0007, 0x01 }, /* S2 */ 55 { EDR_ESCO_MASK | ESCO_EV3, 0x0007, 0x01 }, /* S1 */ 56 { EDR_ESCO_MASK | ESCO_HV3, 0xffff, 0x01 }, /* D1 */ 57 { EDR_ESCO_MASK | ESCO_HV1, 0xffff, 0x01 }, /* D0 */ 58 }; 59 60 static const struct sco_param sco_param_cvsd[] = { 61 { EDR_ESCO_MASK | ESCO_HV3, 0xffff, 0xff }, /* D1 */ 62 { EDR_ESCO_MASK | ESCO_HV1, 0xffff, 0xff }, /* D0 */ 63 }; 64 65 static const struct sco_param esco_param_msbc[] = { 66 { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000d, 0x02 }, /* T2 */ 67 { EDR_ESCO_MASK | ESCO_EV3, 0x0008, 0x02 }, /* T1 */ 68 }; 69 70 /* This function requires the caller holds hdev->lock */ 71 void hci_connect_le_scan_cleanup(struct hci_conn *conn, u8 status) 72 { 73 struct hci_conn_params *params; 74 struct hci_dev *hdev = conn->hdev; 75 struct smp_irk *irk; 76 bdaddr_t *bdaddr; 77 u8 bdaddr_type; 78 79 bdaddr = &conn->dst; 80 bdaddr_type = conn->dst_type; 81 82 /* Check if we need to convert to identity address */ 83 irk = hci_get_irk(hdev, bdaddr, bdaddr_type); 84 if (irk) { 85 bdaddr = &irk->bdaddr; 86 bdaddr_type = irk->addr_type; 87 } 88 89 params = hci_pend_le_action_lookup(&hdev->pend_le_conns, bdaddr, 90 bdaddr_type); 91 if (!params) 92 return; 93 94 if (params->conn) { 95 hci_conn_drop(params->conn); 96 hci_conn_put(params->conn); 97 params->conn = NULL; 98 } 99 100 if (!params->explicit_connect) 101 return; 102 103 /* If the status indicates successful cancellation of 104 * the attempt (i.e. Unknown Connection Id) there's no point of 105 * notifying failure since we'll go back to keep trying to 106 * connect. The only exception is explicit connect requests 107 * where a timeout + cancel does indicate an actual failure. 108 */ 109 if (status && status != HCI_ERROR_UNKNOWN_CONN_ID) 110 mgmt_connect_failed(hdev, conn, status); 111 112 /* The connection attempt was doing scan for new RPA, and is 113 * in scan phase. If params are not associated with any other 114 * autoconnect action, remove them completely. If they are, just unmark 115 * them as waiting for connection, by clearing explicit_connect field. 116 */ 117 params->explicit_connect = false; 118 119 hci_pend_le_list_del_init(params); 120 121 switch (params->auto_connect) { 122 case HCI_AUTO_CONN_EXPLICIT: 123 hci_conn_params_del(hdev, bdaddr, bdaddr_type); 124 /* return instead of break to avoid duplicate scan update */ 125 return; 126 case HCI_AUTO_CONN_DIRECT: 127 case HCI_AUTO_CONN_ALWAYS: 128 hci_pend_le_list_add(params, &hdev->pend_le_conns); 129 break; 130 case HCI_AUTO_CONN_REPORT: 131 hci_pend_le_list_add(params, &hdev->pend_le_reports); 132 break; 133 default: 134 break; 135 } 136 137 hci_update_passive_scan(hdev); 138 } 139 140 static void hci_conn_cleanup(struct hci_conn *conn) 141 { 142 struct hci_dev *hdev = conn->hdev; 143 144 if (test_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags)) 145 hci_conn_params_del(conn->hdev, &conn->dst, conn->dst_type); 146 147 if (test_and_clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags)) 148 hci_remove_link_key(hdev, &conn->dst); 149 150 hci_chan_list_flush(conn); 151 152 hci_conn_hash_del(hdev, conn); 153 154 if (HCI_CONN_HANDLE_UNSET(conn->handle)) 155 ida_free(&hdev->unset_handle_ida, conn->handle); 156 157 if (conn->cleanup) 158 conn->cleanup(conn); 159 160 if (conn->type == SCO_LINK || conn->type == ESCO_LINK) { 161 switch (conn->setting & SCO_AIRMODE_MASK) { 162 case SCO_AIRMODE_CVSD: 163 case SCO_AIRMODE_TRANSP: 164 if (hdev->notify) 165 hdev->notify(hdev, HCI_NOTIFY_DISABLE_SCO); 166 break; 167 } 168 } else { 169 if (hdev->notify) 170 hdev->notify(hdev, HCI_NOTIFY_CONN_DEL); 171 } 172 173 debugfs_remove_recursive(conn->debugfs); 174 175 hci_conn_del_sysfs(conn); 176 177 hci_dev_put(hdev); 178 } 179 180 int hci_disconnect(struct hci_conn *conn, __u8 reason) 181 { 182 BT_DBG("hcon %p", conn); 183 184 /* When we are central of an established connection and it enters 185 * the disconnect timeout, then go ahead and try to read the 186 * current clock offset. Processing of the result is done 187 * within the event handling and hci_clock_offset_evt function. 188 */ 189 if (conn->type == ACL_LINK && conn->role == HCI_ROLE_MASTER && 190 (conn->state == BT_CONNECTED || conn->state == BT_CONFIG)) { 191 struct hci_dev *hdev = conn->hdev; 192 struct hci_cp_read_clock_offset clkoff_cp; 193 194 clkoff_cp.handle = cpu_to_le16(conn->handle); 195 hci_send_cmd(hdev, HCI_OP_READ_CLOCK_OFFSET, sizeof(clkoff_cp), 196 &clkoff_cp); 197 } 198 199 return hci_abort_conn(conn, reason); 200 } 201 202 static void hci_add_sco(struct hci_conn *conn, __u16 handle) 203 { 204 struct hci_dev *hdev = conn->hdev; 205 struct hci_cp_add_sco cp; 206 207 BT_DBG("hcon %p", conn); 208 209 conn->state = BT_CONNECT; 210 conn->out = true; 211 212 conn->attempt++; 213 214 cp.handle = cpu_to_le16(handle); 215 cp.pkt_type = cpu_to_le16(conn->pkt_type); 216 217 hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp); 218 } 219 220 static bool find_next_esco_param(struct hci_conn *conn, 221 const struct sco_param *esco_param, int size) 222 { 223 if (!conn->parent) 224 return false; 225 226 for (; conn->attempt <= size; conn->attempt++) { 227 if (lmp_esco_2m_capable(conn->parent) || 228 (esco_param[conn->attempt - 1].pkt_type & ESCO_2EV3)) 229 break; 230 BT_DBG("hcon %p skipped attempt %d, eSCO 2M not supported", 231 conn, conn->attempt); 232 } 233 234 return conn->attempt <= size; 235 } 236 237 static int configure_datapath_sync(struct hci_dev *hdev, struct bt_codec *codec) 238 { 239 int err; 240 __u8 vnd_len, *vnd_data = NULL; 241 struct hci_op_configure_data_path *cmd = NULL; 242 243 /* Do not take below 2 checks as error since the 1st means user do not 244 * want to use HFP offload mode and the 2nd means the vendor controller 245 * do not need to send below HCI command for offload mode. 246 */ 247 if (!codec->data_path || !hdev->get_codec_config_data) 248 return 0; 249 250 err = hdev->get_codec_config_data(hdev, ESCO_LINK, codec, &vnd_len, 251 &vnd_data); 252 if (err < 0) 253 goto error; 254 255 cmd = kzalloc(sizeof(*cmd) + vnd_len, GFP_KERNEL); 256 if (!cmd) { 257 err = -ENOMEM; 258 goto error; 259 } 260 261 err = hdev->get_data_path_id(hdev, &cmd->data_path_id); 262 if (err < 0) 263 goto error; 264 265 cmd->vnd_len = vnd_len; 266 memcpy(cmd->vnd_data, vnd_data, vnd_len); 267 268 cmd->direction = 0x00; 269 __hci_cmd_sync_status(hdev, HCI_CONFIGURE_DATA_PATH, 270 sizeof(*cmd) + vnd_len, cmd, HCI_CMD_TIMEOUT); 271 272 cmd->direction = 0x01; 273 err = __hci_cmd_sync_status(hdev, HCI_CONFIGURE_DATA_PATH, 274 sizeof(*cmd) + vnd_len, cmd, 275 HCI_CMD_TIMEOUT); 276 error: 277 278 kfree(cmd); 279 kfree(vnd_data); 280 return err; 281 } 282 283 static int hci_enhanced_setup_sync(struct hci_dev *hdev, void *data) 284 { 285 struct conn_handle_t *conn_handle = data; 286 struct hci_conn *conn = conn_handle->conn; 287 __u16 handle = conn_handle->handle; 288 struct hci_cp_enhanced_setup_sync_conn cp; 289 const struct sco_param *param; 290 291 kfree(conn_handle); 292 293 if (!hci_conn_valid(hdev, conn)) 294 return -ECANCELED; 295 296 bt_dev_dbg(hdev, "hcon %p", conn); 297 298 configure_datapath_sync(hdev, &conn->codec); 299 300 conn->state = BT_CONNECT; 301 conn->out = true; 302 303 conn->attempt++; 304 305 memset(&cp, 0x00, sizeof(cp)); 306 307 cp.handle = cpu_to_le16(handle); 308 309 cp.tx_bandwidth = cpu_to_le32(0x00001f40); 310 cp.rx_bandwidth = cpu_to_le32(0x00001f40); 311 312 switch (conn->codec.id) { 313 case BT_CODEC_MSBC: 314 if (!find_next_esco_param(conn, esco_param_msbc, 315 ARRAY_SIZE(esco_param_msbc))) 316 return -EINVAL; 317 318 param = &esco_param_msbc[conn->attempt - 1]; 319 cp.tx_coding_format.id = 0x05; 320 cp.rx_coding_format.id = 0x05; 321 cp.tx_codec_frame_size = __cpu_to_le16(60); 322 cp.rx_codec_frame_size = __cpu_to_le16(60); 323 cp.in_bandwidth = __cpu_to_le32(32000); 324 cp.out_bandwidth = __cpu_to_le32(32000); 325 cp.in_coding_format.id = 0x04; 326 cp.out_coding_format.id = 0x04; 327 cp.in_coded_data_size = __cpu_to_le16(16); 328 cp.out_coded_data_size = __cpu_to_le16(16); 329 cp.in_pcm_data_format = 2; 330 cp.out_pcm_data_format = 2; 331 cp.in_pcm_sample_payload_msb_pos = 0; 332 cp.out_pcm_sample_payload_msb_pos = 0; 333 cp.in_data_path = conn->codec.data_path; 334 cp.out_data_path = conn->codec.data_path; 335 cp.in_transport_unit_size = 1; 336 cp.out_transport_unit_size = 1; 337 break; 338 339 case BT_CODEC_TRANSPARENT: 340 if (!find_next_esco_param(conn, esco_param_msbc, 341 ARRAY_SIZE(esco_param_msbc))) 342 return false; 343 param = &esco_param_msbc[conn->attempt - 1]; 344 cp.tx_coding_format.id = 0x03; 345 cp.rx_coding_format.id = 0x03; 346 cp.tx_codec_frame_size = __cpu_to_le16(60); 347 cp.rx_codec_frame_size = __cpu_to_le16(60); 348 cp.in_bandwidth = __cpu_to_le32(0x1f40); 349 cp.out_bandwidth = __cpu_to_le32(0x1f40); 350 cp.in_coding_format.id = 0x03; 351 cp.out_coding_format.id = 0x03; 352 cp.in_coded_data_size = __cpu_to_le16(16); 353 cp.out_coded_data_size = __cpu_to_le16(16); 354 cp.in_pcm_data_format = 2; 355 cp.out_pcm_data_format = 2; 356 cp.in_pcm_sample_payload_msb_pos = 0; 357 cp.out_pcm_sample_payload_msb_pos = 0; 358 cp.in_data_path = conn->codec.data_path; 359 cp.out_data_path = conn->codec.data_path; 360 cp.in_transport_unit_size = 1; 361 cp.out_transport_unit_size = 1; 362 break; 363 364 case BT_CODEC_CVSD: 365 if (conn->parent && lmp_esco_capable(conn->parent)) { 366 if (!find_next_esco_param(conn, esco_param_cvsd, 367 ARRAY_SIZE(esco_param_cvsd))) 368 return -EINVAL; 369 param = &esco_param_cvsd[conn->attempt - 1]; 370 } else { 371 if (conn->attempt > ARRAY_SIZE(sco_param_cvsd)) 372 return -EINVAL; 373 param = &sco_param_cvsd[conn->attempt - 1]; 374 } 375 cp.tx_coding_format.id = 2; 376 cp.rx_coding_format.id = 2; 377 cp.tx_codec_frame_size = __cpu_to_le16(60); 378 cp.rx_codec_frame_size = __cpu_to_le16(60); 379 cp.in_bandwidth = __cpu_to_le32(16000); 380 cp.out_bandwidth = __cpu_to_le32(16000); 381 cp.in_coding_format.id = 4; 382 cp.out_coding_format.id = 4; 383 cp.in_coded_data_size = __cpu_to_le16(16); 384 cp.out_coded_data_size = __cpu_to_le16(16); 385 cp.in_pcm_data_format = 2; 386 cp.out_pcm_data_format = 2; 387 cp.in_pcm_sample_payload_msb_pos = 0; 388 cp.out_pcm_sample_payload_msb_pos = 0; 389 cp.in_data_path = conn->codec.data_path; 390 cp.out_data_path = conn->codec.data_path; 391 cp.in_transport_unit_size = 16; 392 cp.out_transport_unit_size = 16; 393 break; 394 default: 395 return -EINVAL; 396 } 397 398 cp.retrans_effort = param->retrans_effort; 399 cp.pkt_type = __cpu_to_le16(param->pkt_type); 400 cp.max_latency = __cpu_to_le16(param->max_latency); 401 402 if (hci_send_cmd(hdev, HCI_OP_ENHANCED_SETUP_SYNC_CONN, sizeof(cp), &cp) < 0) 403 return -EIO; 404 405 return 0; 406 } 407 408 static bool hci_setup_sync_conn(struct hci_conn *conn, __u16 handle) 409 { 410 struct hci_dev *hdev = conn->hdev; 411 struct hci_cp_setup_sync_conn cp; 412 const struct sco_param *param; 413 414 bt_dev_dbg(hdev, "hcon %p", conn); 415 416 conn->state = BT_CONNECT; 417 conn->out = true; 418 419 conn->attempt++; 420 421 cp.handle = cpu_to_le16(handle); 422 423 cp.tx_bandwidth = cpu_to_le32(0x00001f40); 424 cp.rx_bandwidth = cpu_to_le32(0x00001f40); 425 cp.voice_setting = cpu_to_le16(conn->setting); 426 427 switch (conn->setting & SCO_AIRMODE_MASK) { 428 case SCO_AIRMODE_TRANSP: 429 if (!find_next_esco_param(conn, esco_param_msbc, 430 ARRAY_SIZE(esco_param_msbc))) 431 return false; 432 param = &esco_param_msbc[conn->attempt - 1]; 433 break; 434 case SCO_AIRMODE_CVSD: 435 if (conn->parent && lmp_esco_capable(conn->parent)) { 436 if (!find_next_esco_param(conn, esco_param_cvsd, 437 ARRAY_SIZE(esco_param_cvsd))) 438 return false; 439 param = &esco_param_cvsd[conn->attempt - 1]; 440 } else { 441 if (conn->attempt > ARRAY_SIZE(sco_param_cvsd)) 442 return false; 443 param = &sco_param_cvsd[conn->attempt - 1]; 444 } 445 break; 446 default: 447 return false; 448 } 449 450 cp.retrans_effort = param->retrans_effort; 451 cp.pkt_type = __cpu_to_le16(param->pkt_type); 452 cp.max_latency = __cpu_to_le16(param->max_latency); 453 454 if (hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp) < 0) 455 return false; 456 457 return true; 458 } 459 460 bool hci_setup_sync(struct hci_conn *conn, __u16 handle) 461 { 462 int result; 463 struct conn_handle_t *conn_handle; 464 465 if (enhanced_sync_conn_capable(conn->hdev)) { 466 conn_handle = kzalloc(sizeof(*conn_handle), GFP_KERNEL); 467 468 if (!conn_handle) 469 return false; 470 471 conn_handle->conn = conn; 472 conn_handle->handle = handle; 473 result = hci_cmd_sync_queue(conn->hdev, hci_enhanced_setup_sync, 474 conn_handle, NULL); 475 if (result < 0) 476 kfree(conn_handle); 477 478 return result == 0; 479 } 480 481 return hci_setup_sync_conn(conn, handle); 482 } 483 484 u8 hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max, u16 latency, 485 u16 to_multiplier) 486 { 487 struct hci_dev *hdev = conn->hdev; 488 struct hci_conn_params *params; 489 struct hci_cp_le_conn_update cp; 490 491 hci_dev_lock(hdev); 492 493 params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type); 494 if (params) { 495 params->conn_min_interval = min; 496 params->conn_max_interval = max; 497 params->conn_latency = latency; 498 params->supervision_timeout = to_multiplier; 499 } 500 501 hci_dev_unlock(hdev); 502 503 memset(&cp, 0, sizeof(cp)); 504 cp.handle = cpu_to_le16(conn->handle); 505 cp.conn_interval_min = cpu_to_le16(min); 506 cp.conn_interval_max = cpu_to_le16(max); 507 cp.conn_latency = cpu_to_le16(latency); 508 cp.supervision_timeout = cpu_to_le16(to_multiplier); 509 cp.min_ce_len = cpu_to_le16(0x0000); 510 cp.max_ce_len = cpu_to_le16(0x0000); 511 512 hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp); 513 514 if (params) 515 return 0x01; 516 517 return 0x00; 518 } 519 520 void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __le64 rand, 521 __u8 ltk[16], __u8 key_size) 522 { 523 struct hci_dev *hdev = conn->hdev; 524 struct hci_cp_le_start_enc cp; 525 526 BT_DBG("hcon %p", conn); 527 528 memset(&cp, 0, sizeof(cp)); 529 530 cp.handle = cpu_to_le16(conn->handle); 531 cp.rand = rand; 532 cp.ediv = ediv; 533 memcpy(cp.ltk, ltk, key_size); 534 535 hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp); 536 } 537 538 /* Device _must_ be locked */ 539 void hci_sco_setup(struct hci_conn *conn, __u8 status) 540 { 541 struct hci_link *link; 542 543 link = list_first_entry_or_null(&conn->link_list, struct hci_link, list); 544 if (!link || !link->conn) 545 return; 546 547 BT_DBG("hcon %p", conn); 548 549 if (!status) { 550 if (lmp_esco_capable(conn->hdev)) 551 hci_setup_sync(link->conn, conn->handle); 552 else 553 hci_add_sco(link->conn, conn->handle); 554 } else { 555 hci_connect_cfm(link->conn, status); 556 hci_conn_del(link->conn); 557 } 558 } 559 560 static void hci_conn_timeout(struct work_struct *work) 561 { 562 struct hci_conn *conn = container_of(work, struct hci_conn, 563 disc_work.work); 564 int refcnt = atomic_read(&conn->refcnt); 565 566 BT_DBG("hcon %p state %s", conn, state_to_string(conn->state)); 567 568 WARN_ON(refcnt < 0); 569 570 /* FIXME: It was observed that in pairing failed scenario, refcnt 571 * drops below 0. Probably this is because l2cap_conn_del calls 572 * l2cap_chan_del for each channel, and inside l2cap_chan_del conn is 573 * dropped. After that loop hci_chan_del is called which also drops 574 * conn. For now make sure that ACL is alive if refcnt is higher then 0, 575 * otherwise drop it. 576 */ 577 if (refcnt > 0) 578 return; 579 580 hci_abort_conn(conn, hci_proto_disconn_ind(conn)); 581 } 582 583 /* Enter sniff mode */ 584 static void hci_conn_idle(struct work_struct *work) 585 { 586 struct hci_conn *conn = container_of(work, struct hci_conn, 587 idle_work.work); 588 struct hci_dev *hdev = conn->hdev; 589 590 BT_DBG("hcon %p mode %d", conn, conn->mode); 591 592 if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn)) 593 return; 594 595 if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF)) 596 return; 597 598 if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) { 599 struct hci_cp_sniff_subrate cp; 600 cp.handle = cpu_to_le16(conn->handle); 601 cp.max_latency = cpu_to_le16(0); 602 cp.min_remote_timeout = cpu_to_le16(0); 603 cp.min_local_timeout = cpu_to_le16(0); 604 hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp); 605 } 606 607 if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) { 608 struct hci_cp_sniff_mode cp; 609 cp.handle = cpu_to_le16(conn->handle); 610 cp.max_interval = cpu_to_le16(hdev->sniff_max_interval); 611 cp.min_interval = cpu_to_le16(hdev->sniff_min_interval); 612 cp.attempt = cpu_to_le16(4); 613 cp.timeout = cpu_to_le16(1); 614 hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp); 615 } 616 } 617 618 static void hci_conn_auto_accept(struct work_struct *work) 619 { 620 struct hci_conn *conn = container_of(work, struct hci_conn, 621 auto_accept_work.work); 622 623 hci_send_cmd(conn->hdev, HCI_OP_USER_CONFIRM_REPLY, sizeof(conn->dst), 624 &conn->dst); 625 } 626 627 static void le_disable_advertising(struct hci_dev *hdev) 628 { 629 if (ext_adv_capable(hdev)) { 630 struct hci_cp_le_set_ext_adv_enable cp; 631 632 cp.enable = 0x00; 633 cp.num_of_sets = 0x00; 634 635 hci_send_cmd(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE, sizeof(cp), 636 &cp); 637 } else { 638 u8 enable = 0x00; 639 hci_send_cmd(hdev, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), 640 &enable); 641 } 642 } 643 644 static void le_conn_timeout(struct work_struct *work) 645 { 646 struct hci_conn *conn = container_of(work, struct hci_conn, 647 le_conn_timeout.work); 648 struct hci_dev *hdev = conn->hdev; 649 650 BT_DBG(""); 651 652 /* We could end up here due to having done directed advertising, 653 * so clean up the state if necessary. This should however only 654 * happen with broken hardware or if low duty cycle was used 655 * (which doesn't have a timeout of its own). 656 */ 657 if (conn->role == HCI_ROLE_SLAVE) { 658 /* Disable LE Advertising */ 659 le_disable_advertising(hdev); 660 hci_dev_lock(hdev); 661 hci_conn_failed(conn, HCI_ERROR_ADVERTISING_TIMEOUT); 662 hci_dev_unlock(hdev); 663 return; 664 } 665 666 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM); 667 } 668 669 struct iso_list_data { 670 union { 671 u8 cig; 672 u8 big; 673 }; 674 union { 675 u8 cis; 676 u8 bis; 677 u16 sync_handle; 678 }; 679 int count; 680 bool big_term; 681 bool pa_sync_term; 682 bool big_sync_term; 683 }; 684 685 static void bis_list(struct hci_conn *conn, void *data) 686 { 687 struct iso_list_data *d = data; 688 689 /* Skip if not broadcast/ANY address */ 690 if (bacmp(&conn->dst, BDADDR_ANY)) 691 return; 692 693 if (d->big != conn->iso_qos.bcast.big || d->bis == BT_ISO_QOS_BIS_UNSET || 694 d->bis != conn->iso_qos.bcast.bis) 695 return; 696 697 d->count++; 698 } 699 700 static int terminate_big_sync(struct hci_dev *hdev, void *data) 701 { 702 struct iso_list_data *d = data; 703 704 bt_dev_dbg(hdev, "big 0x%2.2x bis 0x%2.2x", d->big, d->bis); 705 706 hci_disable_per_advertising_sync(hdev, d->bis); 707 hci_remove_ext_adv_instance_sync(hdev, d->bis, NULL); 708 709 /* Only terminate BIG if it has been created */ 710 if (!d->big_term) 711 return 0; 712 713 return hci_le_terminate_big_sync(hdev, d->big, 714 HCI_ERROR_LOCAL_HOST_TERM); 715 } 716 717 static void terminate_big_destroy(struct hci_dev *hdev, void *data, int err) 718 { 719 kfree(data); 720 } 721 722 static int hci_le_terminate_big(struct hci_dev *hdev, struct hci_conn *conn) 723 { 724 struct iso_list_data *d; 725 int ret; 726 727 bt_dev_dbg(hdev, "big 0x%2.2x bis 0x%2.2x", conn->iso_qos.bcast.big, 728 conn->iso_qos.bcast.bis); 729 730 d = kzalloc(sizeof(*d), GFP_KERNEL); 731 if (!d) 732 return -ENOMEM; 733 734 d->big = conn->iso_qos.bcast.big; 735 d->bis = conn->iso_qos.bcast.bis; 736 d->big_term = test_and_clear_bit(HCI_CONN_BIG_CREATED, &conn->flags); 737 738 ret = hci_cmd_sync_queue(hdev, terminate_big_sync, d, 739 terminate_big_destroy); 740 if (ret) 741 kfree(d); 742 743 return ret; 744 } 745 746 static int big_terminate_sync(struct hci_dev *hdev, void *data) 747 { 748 struct iso_list_data *d = data; 749 750 bt_dev_dbg(hdev, "big 0x%2.2x sync_handle 0x%4.4x", d->big, 751 d->sync_handle); 752 753 if (d->big_sync_term) 754 hci_le_big_terminate_sync(hdev, d->big); 755 756 if (d->pa_sync_term) 757 return hci_le_pa_terminate_sync(hdev, d->sync_handle); 758 759 return 0; 760 } 761 762 static void find_bis(struct hci_conn *conn, void *data) 763 { 764 struct iso_list_data *d = data; 765 766 /* Ignore if BIG doesn't match */ 767 if (d->big != conn->iso_qos.bcast.big) 768 return; 769 770 d->count++; 771 } 772 773 static int hci_le_big_terminate(struct hci_dev *hdev, u8 big, struct hci_conn *conn) 774 { 775 struct iso_list_data *d; 776 int ret; 777 778 bt_dev_dbg(hdev, "big 0x%2.2x sync_handle 0x%4.4x", big, conn->sync_handle); 779 780 d = kzalloc(sizeof(*d), GFP_KERNEL); 781 if (!d) 782 return -ENOMEM; 783 784 d->big = big; 785 d->sync_handle = conn->sync_handle; 786 787 if (test_and_clear_bit(HCI_CONN_PA_SYNC, &conn->flags)) { 788 hci_conn_hash_list_flag(hdev, find_bis, ISO_LINK, 789 HCI_CONN_PA_SYNC, d); 790 791 if (!d->count) 792 d->pa_sync_term = true; 793 794 d->count = 0; 795 } 796 797 if (test_and_clear_bit(HCI_CONN_BIG_SYNC, &conn->flags)) { 798 hci_conn_hash_list_flag(hdev, find_bis, ISO_LINK, 799 HCI_CONN_BIG_SYNC, d); 800 801 if (!d->count) 802 d->big_sync_term = true; 803 } 804 805 ret = hci_cmd_sync_queue(hdev, big_terminate_sync, d, 806 terminate_big_destroy); 807 if (ret) 808 kfree(d); 809 810 return ret; 811 } 812 813 /* Cleanup BIS connection 814 * 815 * Detects if there any BIS left connected in a BIG 816 * broadcaster: Remove advertising instance and terminate BIG. 817 * broadcaster receiver: Teminate BIG sync and terminate PA sync. 818 */ 819 static void bis_cleanup(struct hci_conn *conn) 820 { 821 struct hci_dev *hdev = conn->hdev; 822 struct hci_conn *bis; 823 824 bt_dev_dbg(hdev, "conn %p", conn); 825 826 if (conn->role == HCI_ROLE_MASTER) { 827 if (!test_and_clear_bit(HCI_CONN_PER_ADV, &conn->flags)) 828 return; 829 830 /* Check if ISO connection is a BIS and terminate advertising 831 * set and BIG if there are no other connections using it. 832 */ 833 bis = hci_conn_hash_lookup_big(hdev, conn->iso_qos.bcast.big); 834 if (bis) 835 return; 836 837 hci_le_terminate_big(hdev, conn); 838 } else { 839 hci_le_big_terminate(hdev, conn->iso_qos.bcast.big, 840 conn); 841 } 842 } 843 844 static int remove_cig_sync(struct hci_dev *hdev, void *data) 845 { 846 u8 handle = PTR_UINT(data); 847 848 return hci_le_remove_cig_sync(hdev, handle); 849 } 850 851 static int hci_le_remove_cig(struct hci_dev *hdev, u8 handle) 852 { 853 bt_dev_dbg(hdev, "handle 0x%2.2x", handle); 854 855 return hci_cmd_sync_queue(hdev, remove_cig_sync, UINT_PTR(handle), 856 NULL); 857 } 858 859 static void find_cis(struct hci_conn *conn, void *data) 860 { 861 struct iso_list_data *d = data; 862 863 /* Ignore broadcast or if CIG don't match */ 864 if (!bacmp(&conn->dst, BDADDR_ANY) || d->cig != conn->iso_qos.ucast.cig) 865 return; 866 867 d->count++; 868 } 869 870 /* Cleanup CIS connection: 871 * 872 * Detects if there any CIS left connected in a CIG and remove it. 873 */ 874 static void cis_cleanup(struct hci_conn *conn) 875 { 876 struct hci_dev *hdev = conn->hdev; 877 struct iso_list_data d; 878 879 if (conn->iso_qos.ucast.cig == BT_ISO_QOS_CIG_UNSET) 880 return; 881 882 memset(&d, 0, sizeof(d)); 883 d.cig = conn->iso_qos.ucast.cig; 884 885 /* Check if ISO connection is a CIS and remove CIG if there are 886 * no other connections using it. 887 */ 888 hci_conn_hash_list_state(hdev, find_cis, ISO_LINK, BT_BOUND, &d); 889 hci_conn_hash_list_state(hdev, find_cis, ISO_LINK, BT_CONNECT, &d); 890 hci_conn_hash_list_state(hdev, find_cis, ISO_LINK, BT_CONNECTED, &d); 891 if (d.count) 892 return; 893 894 hci_le_remove_cig(hdev, conn->iso_qos.ucast.cig); 895 } 896 897 static int hci_conn_hash_alloc_unset(struct hci_dev *hdev) 898 { 899 return ida_alloc_range(&hdev->unset_handle_ida, HCI_CONN_HANDLE_MAX + 1, 900 U16_MAX, GFP_ATOMIC); 901 } 902 903 static struct hci_conn *__hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst, 904 u8 role, u16 handle) 905 { 906 struct hci_conn *conn; 907 908 switch (type) { 909 case ACL_LINK: 910 if (!hdev->acl_mtu) 911 return ERR_PTR(-ECONNREFUSED); 912 break; 913 case ISO_LINK: 914 if (hdev->iso_mtu) 915 /* Dedicated ISO Buffer exists */ 916 break; 917 fallthrough; 918 case LE_LINK: 919 if (hdev->le_mtu && hdev->le_mtu < HCI_MIN_LE_MTU) 920 return ERR_PTR(-ECONNREFUSED); 921 if (!hdev->le_mtu && hdev->acl_mtu < HCI_MIN_LE_MTU) 922 return ERR_PTR(-ECONNREFUSED); 923 break; 924 case SCO_LINK: 925 case ESCO_LINK: 926 if (!hdev->sco_pkts) 927 /* Controller does not support SCO or eSCO over HCI */ 928 return ERR_PTR(-ECONNREFUSED); 929 break; 930 default: 931 return ERR_PTR(-ECONNREFUSED); 932 } 933 934 bt_dev_dbg(hdev, "dst %pMR handle 0x%4.4x", dst, handle); 935 936 conn = kzalloc(sizeof(*conn), GFP_KERNEL); 937 if (!conn) 938 return ERR_PTR(-ENOMEM); 939 940 bacpy(&conn->dst, dst); 941 bacpy(&conn->src, &hdev->bdaddr); 942 conn->handle = handle; 943 conn->hdev = hdev; 944 conn->type = type; 945 conn->role = role; 946 conn->mode = HCI_CM_ACTIVE; 947 conn->state = BT_OPEN; 948 conn->auth_type = HCI_AT_GENERAL_BONDING; 949 conn->io_capability = hdev->io_capability; 950 conn->remote_auth = 0xff; 951 conn->key_type = 0xff; 952 conn->rssi = HCI_RSSI_INVALID; 953 conn->tx_power = HCI_TX_POWER_INVALID; 954 conn->max_tx_power = HCI_TX_POWER_INVALID; 955 conn->sync_handle = HCI_SYNC_HANDLE_INVALID; 956 conn->sid = HCI_SID_INVALID; 957 958 set_bit(HCI_CONN_POWER_SAVE, &conn->flags); 959 conn->disc_timeout = HCI_DISCONN_TIMEOUT; 960 961 /* Set Default Authenticated payload timeout to 30s */ 962 conn->auth_payload_timeout = DEFAULT_AUTH_PAYLOAD_TIMEOUT; 963 964 if (conn->role == HCI_ROLE_MASTER) 965 conn->out = true; 966 967 switch (type) { 968 case ACL_LINK: 969 conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK; 970 conn->mtu = hdev->acl_mtu; 971 break; 972 case LE_LINK: 973 /* conn->src should reflect the local identity address */ 974 hci_copy_identity_address(hdev, &conn->src, &conn->src_type); 975 conn->mtu = hdev->le_mtu ? hdev->le_mtu : hdev->acl_mtu; 976 break; 977 case ISO_LINK: 978 /* conn->src should reflect the local identity address */ 979 hci_copy_identity_address(hdev, &conn->src, &conn->src_type); 980 981 /* set proper cleanup function */ 982 if (!bacmp(dst, BDADDR_ANY)) 983 conn->cleanup = bis_cleanup; 984 else if (conn->role == HCI_ROLE_MASTER) 985 conn->cleanup = cis_cleanup; 986 987 conn->mtu = hdev->iso_mtu ? hdev->iso_mtu : 988 hdev->le_mtu ? hdev->le_mtu : hdev->acl_mtu; 989 break; 990 case SCO_LINK: 991 if (lmp_esco_capable(hdev)) 992 conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) | 993 (hdev->esco_type & EDR_ESCO_MASK); 994 else 995 conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK; 996 997 conn->mtu = hdev->sco_mtu; 998 break; 999 case ESCO_LINK: 1000 conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK; 1001 conn->mtu = hdev->sco_mtu; 1002 break; 1003 } 1004 1005 skb_queue_head_init(&conn->data_q); 1006 skb_queue_head_init(&conn->tx_q.queue); 1007 1008 INIT_LIST_HEAD(&conn->chan_list); 1009 INIT_LIST_HEAD(&conn->link_list); 1010 1011 INIT_DELAYED_WORK(&conn->disc_work, hci_conn_timeout); 1012 INIT_DELAYED_WORK(&conn->auto_accept_work, hci_conn_auto_accept); 1013 INIT_DELAYED_WORK(&conn->idle_work, hci_conn_idle); 1014 INIT_DELAYED_WORK(&conn->le_conn_timeout, le_conn_timeout); 1015 1016 atomic_set(&conn->refcnt, 0); 1017 1018 hci_dev_hold(hdev); 1019 1020 hci_conn_hash_add(hdev, conn); 1021 1022 /* The SCO and eSCO connections will only be notified when their 1023 * setup has been completed. This is different to ACL links which 1024 * can be notified right away. 1025 */ 1026 if (conn->type != SCO_LINK && conn->type != ESCO_LINK) { 1027 if (hdev->notify) 1028 hdev->notify(hdev, HCI_NOTIFY_CONN_ADD); 1029 } 1030 1031 hci_conn_init_sysfs(conn); 1032 1033 return conn; 1034 } 1035 1036 struct hci_conn *hci_conn_add_unset(struct hci_dev *hdev, int type, 1037 bdaddr_t *dst, u8 role) 1038 { 1039 int handle; 1040 1041 bt_dev_dbg(hdev, "dst %pMR", dst); 1042 1043 handle = hci_conn_hash_alloc_unset(hdev); 1044 if (unlikely(handle < 0)) 1045 return ERR_PTR(-ECONNREFUSED); 1046 1047 return __hci_conn_add(hdev, type, dst, role, handle); 1048 } 1049 1050 struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst, 1051 u8 role, u16 handle) 1052 { 1053 if (handle > HCI_CONN_HANDLE_MAX) 1054 return ERR_PTR(-EINVAL); 1055 1056 return __hci_conn_add(hdev, type, dst, role, handle); 1057 } 1058 1059 static void hci_conn_cleanup_child(struct hci_conn *conn, u8 reason) 1060 { 1061 if (!reason) 1062 reason = HCI_ERROR_REMOTE_USER_TERM; 1063 1064 /* Due to race, SCO/ISO conn might be not established yet at this point, 1065 * and nothing else will clean it up. In other cases it is done via HCI 1066 * events. 1067 */ 1068 switch (conn->type) { 1069 case SCO_LINK: 1070 case ESCO_LINK: 1071 if (HCI_CONN_HANDLE_UNSET(conn->handle)) 1072 hci_conn_failed(conn, reason); 1073 break; 1074 case ISO_LINK: 1075 if ((conn->state != BT_CONNECTED && 1076 !test_bit(HCI_CONN_CREATE_CIS, &conn->flags)) || 1077 test_bit(HCI_CONN_BIG_CREATED, &conn->flags)) 1078 hci_conn_failed(conn, reason); 1079 break; 1080 } 1081 } 1082 1083 static void hci_conn_unlink(struct hci_conn *conn) 1084 { 1085 struct hci_dev *hdev = conn->hdev; 1086 1087 bt_dev_dbg(hdev, "hcon %p", conn); 1088 1089 if (!conn->parent) { 1090 struct hci_link *link, *t; 1091 1092 list_for_each_entry_safe(link, t, &conn->link_list, list) { 1093 struct hci_conn *child = link->conn; 1094 1095 hci_conn_unlink(child); 1096 1097 /* If hdev is down it means 1098 * hci_dev_close_sync/hci_conn_hash_flush is in progress 1099 * and links don't need to be cleanup as all connections 1100 * would be cleanup. 1101 */ 1102 if (!test_bit(HCI_UP, &hdev->flags)) 1103 continue; 1104 1105 hci_conn_cleanup_child(child, conn->abort_reason); 1106 } 1107 1108 return; 1109 } 1110 1111 if (!conn->link) 1112 return; 1113 1114 list_del_rcu(&conn->link->list); 1115 synchronize_rcu(); 1116 1117 hci_conn_drop(conn->parent); 1118 hci_conn_put(conn->parent); 1119 conn->parent = NULL; 1120 1121 kfree(conn->link); 1122 conn->link = NULL; 1123 } 1124 1125 void hci_conn_del(struct hci_conn *conn) 1126 { 1127 struct hci_dev *hdev = conn->hdev; 1128 1129 BT_DBG("%s hcon %p handle %d", hdev->name, conn, conn->handle); 1130 1131 hci_conn_unlink(conn); 1132 1133 disable_delayed_work_sync(&conn->disc_work); 1134 disable_delayed_work_sync(&conn->auto_accept_work); 1135 disable_delayed_work_sync(&conn->idle_work); 1136 1137 if (conn->type == ACL_LINK) { 1138 /* Unacked frames */ 1139 hdev->acl_cnt += conn->sent; 1140 } else if (conn->type == LE_LINK) { 1141 cancel_delayed_work(&conn->le_conn_timeout); 1142 1143 if (hdev->le_pkts) 1144 hdev->le_cnt += conn->sent; 1145 else 1146 hdev->acl_cnt += conn->sent; 1147 } else { 1148 /* Unacked ISO frames */ 1149 if (conn->type == ISO_LINK) { 1150 if (hdev->iso_pkts) 1151 hdev->iso_cnt += conn->sent; 1152 else if (hdev->le_pkts) 1153 hdev->le_cnt += conn->sent; 1154 else 1155 hdev->acl_cnt += conn->sent; 1156 } 1157 } 1158 1159 skb_queue_purge(&conn->data_q); 1160 skb_queue_purge(&conn->tx_q.queue); 1161 1162 /* Remove the connection from the list and cleanup its remaining 1163 * state. This is a separate function since for some cases like 1164 * BT_CONNECT_SCAN we *only* want the cleanup part without the 1165 * rest of hci_conn_del. 1166 */ 1167 hci_conn_cleanup(conn); 1168 1169 /* Dequeue callbacks using connection pointer as data */ 1170 hci_cmd_sync_dequeue(hdev, NULL, conn, NULL); 1171 } 1172 1173 struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src, uint8_t src_type) 1174 { 1175 int use_src = bacmp(src, BDADDR_ANY); 1176 struct hci_dev *hdev = NULL, *d; 1177 1178 BT_DBG("%pMR -> %pMR", src, dst); 1179 1180 read_lock(&hci_dev_list_lock); 1181 1182 list_for_each_entry(d, &hci_dev_list, list) { 1183 if (!test_bit(HCI_UP, &d->flags) || 1184 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 1185 continue; 1186 1187 /* Simple routing: 1188 * No source address - find interface with bdaddr != dst 1189 * Source address - find interface with bdaddr == src 1190 */ 1191 1192 if (use_src) { 1193 bdaddr_t id_addr; 1194 u8 id_addr_type; 1195 1196 if (src_type == BDADDR_BREDR) { 1197 if (!lmp_bredr_capable(d)) 1198 continue; 1199 bacpy(&id_addr, &d->bdaddr); 1200 id_addr_type = BDADDR_BREDR; 1201 } else { 1202 if (!lmp_le_capable(d)) 1203 continue; 1204 1205 hci_copy_identity_address(d, &id_addr, 1206 &id_addr_type); 1207 1208 /* Convert from HCI to three-value type */ 1209 if (id_addr_type == ADDR_LE_DEV_PUBLIC) 1210 id_addr_type = BDADDR_LE_PUBLIC; 1211 else 1212 id_addr_type = BDADDR_LE_RANDOM; 1213 } 1214 1215 if (!bacmp(&id_addr, src) && id_addr_type == src_type) { 1216 hdev = d; break; 1217 } 1218 } else { 1219 if (bacmp(&d->bdaddr, dst)) { 1220 hdev = d; break; 1221 } 1222 } 1223 } 1224 1225 if (hdev) 1226 hdev = hci_dev_hold(hdev); 1227 1228 read_unlock(&hci_dev_list_lock); 1229 return hdev; 1230 } 1231 EXPORT_SYMBOL(hci_get_route); 1232 1233 /* This function requires the caller holds hdev->lock */ 1234 static void hci_le_conn_failed(struct hci_conn *conn, u8 status) 1235 { 1236 struct hci_dev *hdev = conn->hdev; 1237 1238 hci_connect_le_scan_cleanup(conn, status); 1239 1240 /* Enable advertising in case this was a failed connection 1241 * attempt as a peripheral. 1242 */ 1243 hci_enable_advertising(hdev); 1244 } 1245 1246 /* This function requires the caller holds hdev->lock */ 1247 void hci_conn_failed(struct hci_conn *conn, u8 status) 1248 { 1249 struct hci_dev *hdev = conn->hdev; 1250 1251 bt_dev_dbg(hdev, "status 0x%2.2x", status); 1252 1253 switch (conn->type) { 1254 case LE_LINK: 1255 hci_le_conn_failed(conn, status); 1256 break; 1257 case ACL_LINK: 1258 mgmt_connect_failed(hdev, conn, status); 1259 break; 1260 } 1261 1262 /* In case of BIG/PA sync failed, clear conn flags so that 1263 * the conns will be correctly cleaned up by ISO layer 1264 */ 1265 test_and_clear_bit(HCI_CONN_BIG_SYNC_FAILED, &conn->flags); 1266 test_and_clear_bit(HCI_CONN_PA_SYNC_FAILED, &conn->flags); 1267 1268 conn->state = BT_CLOSED; 1269 hci_connect_cfm(conn, status); 1270 hci_conn_del(conn); 1271 } 1272 1273 /* This function requires the caller holds hdev->lock */ 1274 u8 hci_conn_set_handle(struct hci_conn *conn, u16 handle) 1275 { 1276 struct hci_dev *hdev = conn->hdev; 1277 1278 bt_dev_dbg(hdev, "hcon %p handle 0x%4.4x", conn, handle); 1279 1280 if (conn->handle == handle) 1281 return 0; 1282 1283 if (handle > HCI_CONN_HANDLE_MAX) { 1284 bt_dev_err(hdev, "Invalid handle: 0x%4.4x > 0x%4.4x", 1285 handle, HCI_CONN_HANDLE_MAX); 1286 return HCI_ERROR_INVALID_PARAMETERS; 1287 } 1288 1289 /* If abort_reason has been sent it means the connection is being 1290 * aborted and the handle shall not be changed. 1291 */ 1292 if (conn->abort_reason) 1293 return conn->abort_reason; 1294 1295 if (HCI_CONN_HANDLE_UNSET(conn->handle)) 1296 ida_free(&hdev->unset_handle_ida, conn->handle); 1297 1298 conn->handle = handle; 1299 1300 return 0; 1301 } 1302 1303 struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst, 1304 u8 dst_type, bool dst_resolved, u8 sec_level, 1305 u16 conn_timeout, u8 role, u8 phy, u8 sec_phy) 1306 { 1307 struct hci_conn *conn; 1308 struct smp_irk *irk; 1309 int err; 1310 1311 /* Let's make sure that le is enabled.*/ 1312 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 1313 if (lmp_le_capable(hdev)) 1314 return ERR_PTR(-ECONNREFUSED); 1315 1316 return ERR_PTR(-EOPNOTSUPP); 1317 } 1318 1319 /* Since the controller supports only one LE connection attempt at a 1320 * time, we return -EBUSY if there is any connection attempt running. 1321 */ 1322 if (hci_lookup_le_connect(hdev)) 1323 return ERR_PTR(-EBUSY); 1324 1325 /* If there's already a connection object but it's not in 1326 * scanning state it means it must already be established, in 1327 * which case we can't do anything else except report a failure 1328 * to connect. 1329 */ 1330 conn = hci_conn_hash_lookup_le(hdev, dst, dst_type); 1331 if (conn && !test_bit(HCI_CONN_SCANNING, &conn->flags)) { 1332 return ERR_PTR(-EBUSY); 1333 } 1334 1335 /* Check if the destination address has been resolved by the controller 1336 * since if it did then the identity address shall be used. 1337 */ 1338 if (!dst_resolved) { 1339 /* When given an identity address with existing identity 1340 * resolving key, the connection needs to be established 1341 * to a resolvable random address. 1342 * 1343 * Storing the resolvable random address is required here 1344 * to handle connection failures. The address will later 1345 * be resolved back into the original identity address 1346 * from the connect request. 1347 */ 1348 irk = hci_find_irk_by_addr(hdev, dst, dst_type); 1349 if (irk && bacmp(&irk->rpa, BDADDR_ANY)) { 1350 dst = &irk->rpa; 1351 dst_type = ADDR_LE_DEV_RANDOM; 1352 } 1353 } 1354 1355 if (conn) { 1356 bacpy(&conn->dst, dst); 1357 } else { 1358 conn = hci_conn_add_unset(hdev, LE_LINK, dst, role); 1359 if (IS_ERR(conn)) 1360 return conn; 1361 hci_conn_hold(conn); 1362 conn->pending_sec_level = sec_level; 1363 } 1364 1365 conn->dst_type = dst_type; 1366 conn->sec_level = BT_SECURITY_LOW; 1367 conn->conn_timeout = conn_timeout; 1368 conn->le_adv_phy = phy; 1369 conn->le_adv_sec_phy = sec_phy; 1370 1371 err = hci_connect_le_sync(hdev, conn); 1372 if (err) { 1373 hci_conn_del(conn); 1374 return ERR_PTR(err); 1375 } 1376 1377 return conn; 1378 } 1379 1380 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type) 1381 { 1382 struct hci_conn *conn; 1383 1384 conn = hci_conn_hash_lookup_le(hdev, addr, type); 1385 if (!conn) 1386 return false; 1387 1388 if (conn->state != BT_CONNECTED) 1389 return false; 1390 1391 return true; 1392 } 1393 1394 /* This function requires the caller holds hdev->lock */ 1395 static int hci_explicit_conn_params_set(struct hci_dev *hdev, 1396 bdaddr_t *addr, u8 addr_type) 1397 { 1398 struct hci_conn_params *params; 1399 1400 if (is_connected(hdev, addr, addr_type)) 1401 return -EISCONN; 1402 1403 params = hci_conn_params_lookup(hdev, addr, addr_type); 1404 if (!params) { 1405 params = hci_conn_params_add(hdev, addr, addr_type); 1406 if (!params) 1407 return -ENOMEM; 1408 1409 /* If we created new params, mark them to be deleted in 1410 * hci_connect_le_scan_cleanup. It's different case than 1411 * existing disabled params, those will stay after cleanup. 1412 */ 1413 params->auto_connect = HCI_AUTO_CONN_EXPLICIT; 1414 } 1415 1416 /* We're trying to connect, so make sure params are at pend_le_conns */ 1417 if (params->auto_connect == HCI_AUTO_CONN_DISABLED || 1418 params->auto_connect == HCI_AUTO_CONN_REPORT || 1419 params->auto_connect == HCI_AUTO_CONN_EXPLICIT) { 1420 hci_pend_le_list_del_init(params); 1421 hci_pend_le_list_add(params, &hdev->pend_le_conns); 1422 } 1423 1424 params->explicit_connect = true; 1425 1426 BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type, 1427 params->auto_connect); 1428 1429 return 0; 1430 } 1431 1432 static int qos_set_big(struct hci_dev *hdev, struct bt_iso_qos *qos) 1433 { 1434 struct hci_conn *conn; 1435 u8 big; 1436 1437 /* Allocate a BIG if not set */ 1438 if (qos->bcast.big == BT_ISO_QOS_BIG_UNSET) { 1439 for (big = 0x00; big < 0xef; big++) { 1440 1441 conn = hci_conn_hash_lookup_big(hdev, big); 1442 if (!conn) 1443 break; 1444 } 1445 1446 if (big == 0xef) 1447 return -EADDRNOTAVAIL; 1448 1449 /* Update BIG */ 1450 qos->bcast.big = big; 1451 } 1452 1453 return 0; 1454 } 1455 1456 static int qos_set_bis(struct hci_dev *hdev, struct bt_iso_qos *qos) 1457 { 1458 struct hci_conn *conn; 1459 u8 bis; 1460 1461 /* Allocate BIS if not set */ 1462 if (qos->bcast.bis == BT_ISO_QOS_BIS_UNSET) { 1463 if (qos->bcast.big != BT_ISO_QOS_BIG_UNSET) { 1464 conn = hci_conn_hash_lookup_big(hdev, qos->bcast.big); 1465 1466 if (conn) { 1467 /* If the BIG handle is already matched to an advertising 1468 * handle, do not allocate a new one. 1469 */ 1470 qos->bcast.bis = conn->iso_qos.bcast.bis; 1471 return 0; 1472 } 1473 } 1474 1475 /* Find an unused adv set to advertise BIS, skip instance 0x00 1476 * since it is reserved as general purpose set. 1477 */ 1478 for (bis = 0x01; bis < hdev->le_num_of_adv_sets; 1479 bis++) { 1480 1481 conn = hci_conn_hash_lookup_bis(hdev, BDADDR_ANY, bis); 1482 if (!conn) 1483 break; 1484 } 1485 1486 if (bis == hdev->le_num_of_adv_sets) 1487 return -EADDRNOTAVAIL; 1488 1489 /* Update BIS */ 1490 qos->bcast.bis = bis; 1491 } 1492 1493 return 0; 1494 } 1495 1496 /* This function requires the caller holds hdev->lock */ 1497 static struct hci_conn *hci_add_bis(struct hci_dev *hdev, bdaddr_t *dst, 1498 struct bt_iso_qos *qos, __u8 base_len, 1499 __u8 *base) 1500 { 1501 struct hci_conn *conn; 1502 int err; 1503 1504 /* Let's make sure that le is enabled.*/ 1505 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 1506 if (lmp_le_capable(hdev)) 1507 return ERR_PTR(-ECONNREFUSED); 1508 return ERR_PTR(-EOPNOTSUPP); 1509 } 1510 1511 err = qos_set_big(hdev, qos); 1512 if (err) 1513 return ERR_PTR(err); 1514 1515 err = qos_set_bis(hdev, qos); 1516 if (err) 1517 return ERR_PTR(err); 1518 1519 /* Check if the LE Create BIG command has already been sent */ 1520 conn = hci_conn_hash_lookup_per_adv_bis(hdev, dst, qos->bcast.big, 1521 qos->bcast.big); 1522 if (conn) 1523 return ERR_PTR(-EADDRINUSE); 1524 1525 /* Check BIS settings against other bound BISes, since all 1526 * BISes in a BIG must have the same value for all parameters 1527 */ 1528 conn = hci_conn_hash_lookup_big(hdev, qos->bcast.big); 1529 1530 if (conn && (memcmp(qos, &conn->iso_qos, sizeof(*qos)) || 1531 base_len != conn->le_per_adv_data_len || 1532 memcmp(conn->le_per_adv_data, base, base_len))) 1533 return ERR_PTR(-EADDRINUSE); 1534 1535 conn = hci_conn_add_unset(hdev, ISO_LINK, dst, HCI_ROLE_MASTER); 1536 if (IS_ERR(conn)) 1537 return conn; 1538 1539 conn->state = BT_CONNECT; 1540 1541 hci_conn_hold(conn); 1542 return conn; 1543 } 1544 1545 /* This function requires the caller holds hdev->lock */ 1546 struct hci_conn *hci_connect_le_scan(struct hci_dev *hdev, bdaddr_t *dst, 1547 u8 dst_type, u8 sec_level, 1548 u16 conn_timeout, 1549 enum conn_reasons conn_reason) 1550 { 1551 struct hci_conn *conn; 1552 1553 /* Let's make sure that le is enabled.*/ 1554 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 1555 if (lmp_le_capable(hdev)) 1556 return ERR_PTR(-ECONNREFUSED); 1557 1558 return ERR_PTR(-EOPNOTSUPP); 1559 } 1560 1561 /* Some devices send ATT messages as soon as the physical link is 1562 * established. To be able to handle these ATT messages, the user- 1563 * space first establishes the connection and then starts the pairing 1564 * process. 1565 * 1566 * So if a hci_conn object already exists for the following connection 1567 * attempt, we simply update pending_sec_level and auth_type fields 1568 * and return the object found. 1569 */ 1570 conn = hci_conn_hash_lookup_le(hdev, dst, dst_type); 1571 if (conn) { 1572 if (conn->pending_sec_level < sec_level) 1573 conn->pending_sec_level = sec_level; 1574 goto done; 1575 } 1576 1577 BT_DBG("requesting refresh of dst_addr"); 1578 1579 conn = hci_conn_add_unset(hdev, LE_LINK, dst, HCI_ROLE_MASTER); 1580 if (IS_ERR(conn)) 1581 return conn; 1582 1583 if (hci_explicit_conn_params_set(hdev, dst, dst_type) < 0) { 1584 hci_conn_del(conn); 1585 return ERR_PTR(-EBUSY); 1586 } 1587 1588 conn->state = BT_CONNECT; 1589 set_bit(HCI_CONN_SCANNING, &conn->flags); 1590 conn->dst_type = dst_type; 1591 conn->sec_level = BT_SECURITY_LOW; 1592 conn->pending_sec_level = sec_level; 1593 conn->conn_timeout = conn_timeout; 1594 conn->conn_reason = conn_reason; 1595 1596 hci_update_passive_scan(hdev); 1597 1598 done: 1599 hci_conn_hold(conn); 1600 return conn; 1601 } 1602 1603 struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst, 1604 u8 sec_level, u8 auth_type, 1605 enum conn_reasons conn_reason, u16 timeout) 1606 { 1607 struct hci_conn *acl; 1608 1609 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 1610 if (lmp_bredr_capable(hdev)) 1611 return ERR_PTR(-ECONNREFUSED); 1612 1613 return ERR_PTR(-EOPNOTSUPP); 1614 } 1615 1616 /* Reject outgoing connection to device with same BD ADDR against 1617 * CVE-2020-26555 1618 */ 1619 if (!bacmp(&hdev->bdaddr, dst)) { 1620 bt_dev_dbg(hdev, "Reject connection with same BD_ADDR %pMR\n", 1621 dst); 1622 return ERR_PTR(-ECONNREFUSED); 1623 } 1624 1625 acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst); 1626 if (!acl) { 1627 acl = hci_conn_add_unset(hdev, ACL_LINK, dst, HCI_ROLE_MASTER); 1628 if (IS_ERR(acl)) 1629 return acl; 1630 } 1631 1632 hci_conn_hold(acl); 1633 1634 acl->conn_reason = conn_reason; 1635 if (acl->state == BT_OPEN || acl->state == BT_CLOSED) { 1636 int err; 1637 1638 acl->sec_level = BT_SECURITY_LOW; 1639 acl->pending_sec_level = sec_level; 1640 acl->auth_type = auth_type; 1641 acl->conn_timeout = timeout; 1642 1643 err = hci_connect_acl_sync(hdev, acl); 1644 if (err) { 1645 hci_conn_del(acl); 1646 return ERR_PTR(err); 1647 } 1648 } 1649 1650 return acl; 1651 } 1652 1653 static struct hci_link *hci_conn_link(struct hci_conn *parent, 1654 struct hci_conn *conn) 1655 { 1656 struct hci_dev *hdev = parent->hdev; 1657 struct hci_link *link; 1658 1659 bt_dev_dbg(hdev, "parent %p hcon %p", parent, conn); 1660 1661 if (conn->link) 1662 return conn->link; 1663 1664 if (conn->parent) 1665 return NULL; 1666 1667 link = kzalloc(sizeof(*link), GFP_KERNEL); 1668 if (!link) 1669 return NULL; 1670 1671 link->conn = hci_conn_hold(conn); 1672 conn->link = link; 1673 conn->parent = hci_conn_get(parent); 1674 1675 /* Use list_add_tail_rcu append to the list */ 1676 list_add_tail_rcu(&link->list, &parent->link_list); 1677 1678 return link; 1679 } 1680 1681 struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type, bdaddr_t *dst, 1682 __u16 setting, struct bt_codec *codec, 1683 u16 timeout) 1684 { 1685 struct hci_conn *acl; 1686 struct hci_conn *sco; 1687 struct hci_link *link; 1688 1689 acl = hci_connect_acl(hdev, dst, BT_SECURITY_LOW, HCI_AT_NO_BONDING, 1690 CONN_REASON_SCO_CONNECT, timeout); 1691 if (IS_ERR(acl)) 1692 return acl; 1693 1694 sco = hci_conn_hash_lookup_ba(hdev, type, dst); 1695 if (!sco) { 1696 sco = hci_conn_add_unset(hdev, type, dst, HCI_ROLE_MASTER); 1697 if (IS_ERR(sco)) { 1698 hci_conn_drop(acl); 1699 return sco; 1700 } 1701 } 1702 1703 link = hci_conn_link(acl, sco); 1704 if (!link) { 1705 hci_conn_drop(acl); 1706 hci_conn_drop(sco); 1707 return ERR_PTR(-ENOLINK); 1708 } 1709 1710 sco->setting = setting; 1711 sco->codec = *codec; 1712 1713 if (acl->state == BT_CONNECTED && 1714 (sco->state == BT_OPEN || sco->state == BT_CLOSED)) { 1715 set_bit(HCI_CONN_POWER_SAVE, &acl->flags); 1716 hci_conn_enter_active_mode(acl, BT_POWER_FORCE_ACTIVE_ON); 1717 1718 if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->flags)) { 1719 /* defer SCO setup until mode change completed */ 1720 set_bit(HCI_CONN_SCO_SETUP_PEND, &acl->flags); 1721 return sco; 1722 } 1723 1724 hci_sco_setup(acl, 0x00); 1725 } 1726 1727 return sco; 1728 } 1729 1730 static int hci_le_create_big(struct hci_conn *conn, struct bt_iso_qos *qos) 1731 { 1732 struct hci_dev *hdev = conn->hdev; 1733 struct hci_cp_le_create_big cp; 1734 struct iso_list_data data; 1735 1736 memset(&cp, 0, sizeof(cp)); 1737 1738 data.big = qos->bcast.big; 1739 data.bis = qos->bcast.bis; 1740 data.count = 0; 1741 1742 /* Create a BIS for each bound connection */ 1743 hci_conn_hash_list_state(hdev, bis_list, ISO_LINK, 1744 BT_BOUND, &data); 1745 1746 cp.handle = qos->bcast.big; 1747 cp.adv_handle = qos->bcast.bis; 1748 cp.num_bis = data.count; 1749 hci_cpu_to_le24(qos->bcast.out.interval, cp.bis.sdu_interval); 1750 cp.bis.sdu = cpu_to_le16(qos->bcast.out.sdu); 1751 cp.bis.latency = cpu_to_le16(qos->bcast.out.latency); 1752 cp.bis.rtn = qos->bcast.out.rtn; 1753 cp.bis.phy = qos->bcast.out.phy; 1754 cp.bis.packing = qos->bcast.packing; 1755 cp.bis.framing = qos->bcast.framing; 1756 cp.bis.encryption = qos->bcast.encryption; 1757 memcpy(cp.bis.bcode, qos->bcast.bcode, sizeof(cp.bis.bcode)); 1758 1759 return hci_send_cmd(hdev, HCI_OP_LE_CREATE_BIG, sizeof(cp), &cp); 1760 } 1761 1762 static int set_cig_params_sync(struct hci_dev *hdev, void *data) 1763 { 1764 DEFINE_FLEX(struct hci_cp_le_set_cig_params, pdu, cis, num_cis, 0x1f); 1765 u8 cig_id = PTR_UINT(data); 1766 struct hci_conn *conn; 1767 struct bt_iso_qos *qos; 1768 u8 aux_num_cis = 0; 1769 u8 cis_id; 1770 1771 conn = hci_conn_hash_lookup_cig(hdev, cig_id); 1772 if (!conn) 1773 return 0; 1774 1775 qos = &conn->iso_qos; 1776 pdu->cig_id = cig_id; 1777 hci_cpu_to_le24(qos->ucast.out.interval, pdu->c_interval); 1778 hci_cpu_to_le24(qos->ucast.in.interval, pdu->p_interval); 1779 pdu->sca = qos->ucast.sca; 1780 pdu->packing = qos->ucast.packing; 1781 pdu->framing = qos->ucast.framing; 1782 pdu->c_latency = cpu_to_le16(qos->ucast.out.latency); 1783 pdu->p_latency = cpu_to_le16(qos->ucast.in.latency); 1784 1785 /* Reprogram all CIS(s) with the same CIG, valid range are: 1786 * num_cis: 0x00 to 0x1F 1787 * cis_id: 0x00 to 0xEF 1788 */ 1789 for (cis_id = 0x00; cis_id < 0xf0 && 1790 aux_num_cis < pdu->num_cis; cis_id++) { 1791 struct hci_cis_params *cis; 1792 1793 conn = hci_conn_hash_lookup_cis(hdev, NULL, 0, cig_id, cis_id); 1794 if (!conn) 1795 continue; 1796 1797 qos = &conn->iso_qos; 1798 1799 cis = &pdu->cis[aux_num_cis++]; 1800 cis->cis_id = cis_id; 1801 cis->c_sdu = cpu_to_le16(conn->iso_qos.ucast.out.sdu); 1802 cis->p_sdu = cpu_to_le16(conn->iso_qos.ucast.in.sdu); 1803 cis->c_phy = qos->ucast.out.phy ? qos->ucast.out.phy : 1804 qos->ucast.in.phy; 1805 cis->p_phy = qos->ucast.in.phy ? qos->ucast.in.phy : 1806 qos->ucast.out.phy; 1807 cis->c_rtn = qos->ucast.out.rtn; 1808 cis->p_rtn = qos->ucast.in.rtn; 1809 } 1810 pdu->num_cis = aux_num_cis; 1811 1812 if (!pdu->num_cis) 1813 return 0; 1814 1815 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_CIG_PARAMS, 1816 struct_size(pdu, cis, pdu->num_cis), 1817 pdu, HCI_CMD_TIMEOUT); 1818 } 1819 1820 static bool hci_le_set_cig_params(struct hci_conn *conn, struct bt_iso_qos *qos) 1821 { 1822 struct hci_dev *hdev = conn->hdev; 1823 struct iso_list_data data; 1824 1825 memset(&data, 0, sizeof(data)); 1826 1827 /* Allocate first still reconfigurable CIG if not set */ 1828 if (qos->ucast.cig == BT_ISO_QOS_CIG_UNSET) { 1829 for (data.cig = 0x00; data.cig < 0xf0; data.cig++) { 1830 data.count = 0; 1831 1832 hci_conn_hash_list_state(hdev, find_cis, ISO_LINK, 1833 BT_CONNECT, &data); 1834 if (data.count) 1835 continue; 1836 1837 hci_conn_hash_list_state(hdev, find_cis, ISO_LINK, 1838 BT_CONNECTED, &data); 1839 if (!data.count) 1840 break; 1841 } 1842 1843 if (data.cig == 0xf0) 1844 return false; 1845 1846 /* Update CIG */ 1847 qos->ucast.cig = data.cig; 1848 } 1849 1850 if (qos->ucast.cis != BT_ISO_QOS_CIS_UNSET) { 1851 if (hci_conn_hash_lookup_cis(hdev, NULL, 0, qos->ucast.cig, 1852 qos->ucast.cis)) 1853 return false; 1854 goto done; 1855 } 1856 1857 /* Allocate first available CIS if not set */ 1858 for (data.cig = qos->ucast.cig, data.cis = 0x00; data.cis < 0xf0; 1859 data.cis++) { 1860 if (!hci_conn_hash_lookup_cis(hdev, NULL, 0, data.cig, 1861 data.cis)) { 1862 /* Update CIS */ 1863 qos->ucast.cis = data.cis; 1864 break; 1865 } 1866 } 1867 1868 if (qos->ucast.cis == BT_ISO_QOS_CIS_UNSET) 1869 return false; 1870 1871 done: 1872 if (hci_cmd_sync_queue(hdev, set_cig_params_sync, 1873 UINT_PTR(qos->ucast.cig), NULL) < 0) 1874 return false; 1875 1876 return true; 1877 } 1878 1879 struct hci_conn *hci_bind_cis(struct hci_dev *hdev, bdaddr_t *dst, 1880 __u8 dst_type, struct bt_iso_qos *qos) 1881 { 1882 struct hci_conn *cis; 1883 1884 cis = hci_conn_hash_lookup_cis(hdev, dst, dst_type, qos->ucast.cig, 1885 qos->ucast.cis); 1886 if (!cis) { 1887 cis = hci_conn_add_unset(hdev, ISO_LINK, dst, HCI_ROLE_MASTER); 1888 if (IS_ERR(cis)) 1889 return cis; 1890 cis->cleanup = cis_cleanup; 1891 cis->dst_type = dst_type; 1892 cis->iso_qos.ucast.cig = BT_ISO_QOS_CIG_UNSET; 1893 cis->iso_qos.ucast.cis = BT_ISO_QOS_CIS_UNSET; 1894 } 1895 1896 if (cis->state == BT_CONNECTED) 1897 return cis; 1898 1899 /* Check if CIS has been set and the settings matches */ 1900 if (cis->state == BT_BOUND && 1901 !memcmp(&cis->iso_qos, qos, sizeof(*qos))) 1902 return cis; 1903 1904 /* Update LINK PHYs according to QoS preference */ 1905 cis->le_tx_phy = qos->ucast.out.phy; 1906 cis->le_rx_phy = qos->ucast.in.phy; 1907 1908 /* If output interval is not set use the input interval as it cannot be 1909 * 0x000000. 1910 */ 1911 if (!qos->ucast.out.interval) 1912 qos->ucast.out.interval = qos->ucast.in.interval; 1913 1914 /* If input interval is not set use the output interval as it cannot be 1915 * 0x000000. 1916 */ 1917 if (!qos->ucast.in.interval) 1918 qos->ucast.in.interval = qos->ucast.out.interval; 1919 1920 /* If output latency is not set use the input latency as it cannot be 1921 * 0x0000. 1922 */ 1923 if (!qos->ucast.out.latency) 1924 qos->ucast.out.latency = qos->ucast.in.latency; 1925 1926 /* If input latency is not set use the output latency as it cannot be 1927 * 0x0000. 1928 */ 1929 if (!qos->ucast.in.latency) 1930 qos->ucast.in.latency = qos->ucast.out.latency; 1931 1932 if (!hci_le_set_cig_params(cis, qos)) { 1933 hci_conn_drop(cis); 1934 return ERR_PTR(-EINVAL); 1935 } 1936 1937 hci_conn_hold(cis); 1938 1939 cis->iso_qos = *qos; 1940 cis->state = BT_BOUND; 1941 1942 return cis; 1943 } 1944 1945 bool hci_iso_setup_path(struct hci_conn *conn) 1946 { 1947 struct hci_dev *hdev = conn->hdev; 1948 struct hci_cp_le_setup_iso_path cmd; 1949 1950 memset(&cmd, 0, sizeof(cmd)); 1951 1952 if (conn->iso_qos.ucast.out.sdu) { 1953 cmd.handle = cpu_to_le16(conn->handle); 1954 cmd.direction = 0x00; /* Input (Host to Controller) */ 1955 cmd.path = 0x00; /* HCI path if enabled */ 1956 cmd.codec = 0x03; /* Transparent Data */ 1957 1958 if (hci_send_cmd(hdev, HCI_OP_LE_SETUP_ISO_PATH, sizeof(cmd), 1959 &cmd) < 0) 1960 return false; 1961 } 1962 1963 if (conn->iso_qos.ucast.in.sdu) { 1964 cmd.handle = cpu_to_le16(conn->handle); 1965 cmd.direction = 0x01; /* Output (Controller to Host) */ 1966 cmd.path = 0x00; /* HCI path if enabled */ 1967 cmd.codec = 0x03; /* Transparent Data */ 1968 1969 if (hci_send_cmd(hdev, HCI_OP_LE_SETUP_ISO_PATH, sizeof(cmd), 1970 &cmd) < 0) 1971 return false; 1972 } 1973 1974 return true; 1975 } 1976 1977 int hci_conn_check_create_cis(struct hci_conn *conn) 1978 { 1979 if (conn->type != ISO_LINK || !bacmp(&conn->dst, BDADDR_ANY)) 1980 return -EINVAL; 1981 1982 if (!conn->parent || conn->parent->state != BT_CONNECTED || 1983 conn->state != BT_CONNECT || HCI_CONN_HANDLE_UNSET(conn->handle)) 1984 return 1; 1985 1986 return 0; 1987 } 1988 1989 static int hci_create_cis_sync(struct hci_dev *hdev, void *data) 1990 { 1991 return hci_le_create_cis_sync(hdev); 1992 } 1993 1994 int hci_le_create_cis_pending(struct hci_dev *hdev) 1995 { 1996 struct hci_conn *conn; 1997 bool pending = false; 1998 1999 rcu_read_lock(); 2000 2001 list_for_each_entry_rcu(conn, &hdev->conn_hash.list, list) { 2002 if (test_bit(HCI_CONN_CREATE_CIS, &conn->flags)) { 2003 rcu_read_unlock(); 2004 return -EBUSY; 2005 } 2006 2007 if (!hci_conn_check_create_cis(conn)) 2008 pending = true; 2009 } 2010 2011 rcu_read_unlock(); 2012 2013 if (!pending) 2014 return 0; 2015 2016 /* Queue Create CIS */ 2017 return hci_cmd_sync_queue(hdev, hci_create_cis_sync, NULL, NULL); 2018 } 2019 2020 static void hci_iso_qos_setup(struct hci_dev *hdev, struct hci_conn *conn, 2021 struct bt_iso_io_qos *qos, __u8 phy) 2022 { 2023 /* Only set MTU if PHY is enabled */ 2024 if (!qos->sdu && qos->phy) 2025 qos->sdu = conn->mtu; 2026 2027 /* Use the same PHY as ACL if set to any */ 2028 if (qos->phy == BT_ISO_PHY_ANY) 2029 qos->phy = phy; 2030 2031 /* Use LE ACL connection interval if not set */ 2032 if (!qos->interval) 2033 /* ACL interval unit in 1.25 ms to us */ 2034 qos->interval = conn->le_conn_interval * 1250; 2035 2036 /* Use LE ACL connection latency if not set */ 2037 if (!qos->latency) 2038 qos->latency = conn->le_conn_latency; 2039 } 2040 2041 static int create_big_sync(struct hci_dev *hdev, void *data) 2042 { 2043 struct hci_conn *conn = data; 2044 struct bt_iso_qos *qos = &conn->iso_qos; 2045 u16 interval, sync_interval = 0; 2046 u32 flags = 0; 2047 int err; 2048 2049 if (qos->bcast.out.phy == 0x02) 2050 flags |= MGMT_ADV_FLAG_SEC_2M; 2051 2052 /* Align intervals */ 2053 interval = (qos->bcast.out.interval / 1250) * qos->bcast.sync_factor; 2054 2055 if (qos->bcast.bis) 2056 sync_interval = interval * 4; 2057 2058 err = hci_start_per_adv_sync(hdev, qos->bcast.bis, conn->le_per_adv_data_len, 2059 conn->le_per_adv_data, flags, interval, 2060 interval, sync_interval); 2061 if (err) 2062 return err; 2063 2064 return hci_le_create_big(conn, &conn->iso_qos); 2065 } 2066 2067 static void create_pa_complete(struct hci_dev *hdev, void *data, int err) 2068 { 2069 bt_dev_dbg(hdev, ""); 2070 2071 if (err) 2072 bt_dev_err(hdev, "Unable to create PA: %d", err); 2073 } 2074 2075 static bool hci_conn_check_create_pa_sync(struct hci_conn *conn) 2076 { 2077 if (conn->type != ISO_LINK || conn->sid == HCI_SID_INVALID) 2078 return false; 2079 2080 return true; 2081 } 2082 2083 static int create_pa_sync(struct hci_dev *hdev, void *data) 2084 { 2085 struct hci_cp_le_pa_create_sync cp = {0}; 2086 struct hci_conn *conn; 2087 int err = 0; 2088 2089 hci_dev_lock(hdev); 2090 2091 rcu_read_lock(); 2092 2093 /* The spec allows only one pending LE Periodic Advertising Create 2094 * Sync command at a time. If the command is pending now, don't do 2095 * anything. We check for pending connections after each PA Sync 2096 * Established event. 2097 * 2098 * BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 4, Part E 2099 * page 2493: 2100 * 2101 * If the Host issues this command when another HCI_LE_Periodic_ 2102 * Advertising_Create_Sync command is pending, the Controller shall 2103 * return the error code Command Disallowed (0x0C). 2104 */ 2105 list_for_each_entry_rcu(conn, &hdev->conn_hash.list, list) { 2106 if (test_bit(HCI_CONN_CREATE_PA_SYNC, &conn->flags)) 2107 goto unlock; 2108 } 2109 2110 list_for_each_entry_rcu(conn, &hdev->conn_hash.list, list) { 2111 if (hci_conn_check_create_pa_sync(conn)) { 2112 struct bt_iso_qos *qos = &conn->iso_qos; 2113 2114 cp.options = qos->bcast.options; 2115 cp.sid = conn->sid; 2116 cp.addr_type = conn->dst_type; 2117 bacpy(&cp.addr, &conn->dst); 2118 cp.skip = cpu_to_le16(qos->bcast.skip); 2119 cp.sync_timeout = cpu_to_le16(qos->bcast.sync_timeout); 2120 cp.sync_cte_type = qos->bcast.sync_cte_type; 2121 2122 break; 2123 } 2124 } 2125 2126 unlock: 2127 rcu_read_unlock(); 2128 2129 hci_dev_unlock(hdev); 2130 2131 if (bacmp(&cp.addr, BDADDR_ANY)) { 2132 hci_dev_set_flag(hdev, HCI_PA_SYNC); 2133 set_bit(HCI_CONN_CREATE_PA_SYNC, &conn->flags); 2134 2135 err = __hci_cmd_sync_status(hdev, HCI_OP_LE_PA_CREATE_SYNC, 2136 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 2137 if (!err) 2138 err = hci_update_passive_scan_sync(hdev); 2139 2140 if (err) { 2141 hci_dev_clear_flag(hdev, HCI_PA_SYNC); 2142 clear_bit(HCI_CONN_CREATE_PA_SYNC, &conn->flags); 2143 } 2144 } 2145 2146 return err; 2147 } 2148 2149 int hci_pa_create_sync_pending(struct hci_dev *hdev) 2150 { 2151 /* Queue start pa_create_sync and scan */ 2152 return hci_cmd_sync_queue(hdev, create_pa_sync, 2153 NULL, create_pa_complete); 2154 } 2155 2156 struct hci_conn *hci_pa_create_sync(struct hci_dev *hdev, bdaddr_t *dst, 2157 __u8 dst_type, __u8 sid, 2158 struct bt_iso_qos *qos) 2159 { 2160 struct hci_conn *conn; 2161 2162 conn = hci_conn_add_unset(hdev, ISO_LINK, dst, HCI_ROLE_SLAVE); 2163 if (IS_ERR(conn)) 2164 return conn; 2165 2166 conn->iso_qos = *qos; 2167 conn->dst_type = dst_type; 2168 conn->sid = sid; 2169 conn->state = BT_LISTEN; 2170 2171 hci_conn_hold(conn); 2172 2173 hci_pa_create_sync_pending(hdev); 2174 2175 return conn; 2176 } 2177 2178 static bool hci_conn_check_create_big_sync(struct hci_conn *conn) 2179 { 2180 if (!conn->num_bis) 2181 return false; 2182 2183 return true; 2184 } 2185 2186 static void big_create_sync_complete(struct hci_dev *hdev, void *data, int err) 2187 { 2188 bt_dev_dbg(hdev, ""); 2189 2190 if (err) 2191 bt_dev_err(hdev, "Unable to create BIG sync: %d", err); 2192 } 2193 2194 static int big_create_sync(struct hci_dev *hdev, void *data) 2195 { 2196 DEFINE_FLEX(struct hci_cp_le_big_create_sync, pdu, bis, num_bis, 0x11); 2197 struct hci_conn *conn; 2198 2199 rcu_read_lock(); 2200 2201 pdu->num_bis = 0; 2202 2203 /* The spec allows only one pending LE BIG Create Sync command at 2204 * a time. If the command is pending now, don't do anything. We 2205 * check for pending connections after each BIG Sync Established 2206 * event. 2207 * 2208 * BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 4, Part E 2209 * page 2586: 2210 * 2211 * If the Host sends this command when the Controller is in the 2212 * process of synchronizing to any BIG, i.e. the HCI_LE_BIG_Sync_ 2213 * Established event has not been generated, the Controller shall 2214 * return the error code Command Disallowed (0x0C). 2215 */ 2216 list_for_each_entry_rcu(conn, &hdev->conn_hash.list, list) { 2217 if (test_bit(HCI_CONN_CREATE_BIG_SYNC, &conn->flags)) 2218 goto unlock; 2219 } 2220 2221 list_for_each_entry_rcu(conn, &hdev->conn_hash.list, list) { 2222 if (hci_conn_check_create_big_sync(conn)) { 2223 struct bt_iso_qos *qos = &conn->iso_qos; 2224 2225 set_bit(HCI_CONN_CREATE_BIG_SYNC, &conn->flags); 2226 2227 pdu->handle = qos->bcast.big; 2228 pdu->sync_handle = cpu_to_le16(conn->sync_handle); 2229 pdu->encryption = qos->bcast.encryption; 2230 memcpy(pdu->bcode, qos->bcast.bcode, 2231 sizeof(pdu->bcode)); 2232 pdu->mse = qos->bcast.mse; 2233 pdu->timeout = cpu_to_le16(qos->bcast.timeout); 2234 pdu->num_bis = conn->num_bis; 2235 memcpy(pdu->bis, conn->bis, conn->num_bis); 2236 2237 break; 2238 } 2239 } 2240 2241 unlock: 2242 rcu_read_unlock(); 2243 2244 if (!pdu->num_bis) 2245 return 0; 2246 2247 return hci_send_cmd(hdev, HCI_OP_LE_BIG_CREATE_SYNC, 2248 struct_size(pdu, bis, pdu->num_bis), pdu); 2249 } 2250 2251 int hci_le_big_create_sync_pending(struct hci_dev *hdev) 2252 { 2253 /* Queue big_create_sync */ 2254 return hci_cmd_sync_queue_once(hdev, big_create_sync, 2255 NULL, big_create_sync_complete); 2256 } 2257 2258 int hci_le_big_create_sync(struct hci_dev *hdev, struct hci_conn *hcon, 2259 struct bt_iso_qos *qos, 2260 __u16 sync_handle, __u8 num_bis, __u8 bis[]) 2261 { 2262 int err; 2263 2264 if (num_bis < 0x01 || num_bis > ISO_MAX_NUM_BIS) 2265 return -EINVAL; 2266 2267 err = qos_set_big(hdev, qos); 2268 if (err) 2269 return err; 2270 2271 if (hcon) { 2272 /* Update hcon QoS */ 2273 hcon->iso_qos = *qos; 2274 2275 hcon->num_bis = num_bis; 2276 memcpy(hcon->bis, bis, num_bis); 2277 } 2278 2279 return hci_le_big_create_sync_pending(hdev); 2280 } 2281 2282 static void create_big_complete(struct hci_dev *hdev, void *data, int err) 2283 { 2284 struct hci_conn *conn = data; 2285 2286 bt_dev_dbg(hdev, "conn %p", conn); 2287 2288 if (err) { 2289 bt_dev_err(hdev, "Unable to create BIG: %d", err); 2290 hci_connect_cfm(conn, err); 2291 hci_conn_del(conn); 2292 } 2293 } 2294 2295 struct hci_conn *hci_bind_bis(struct hci_dev *hdev, bdaddr_t *dst, 2296 struct bt_iso_qos *qos, 2297 __u8 base_len, __u8 *base) 2298 { 2299 struct hci_conn *conn; 2300 struct hci_conn *parent; 2301 __u8 eir[HCI_MAX_PER_AD_LENGTH]; 2302 struct hci_link *link; 2303 2304 /* Look for any BIS that is open for rebinding */ 2305 conn = hci_conn_hash_lookup_big_state(hdev, qos->bcast.big, BT_OPEN); 2306 if (conn) { 2307 memcpy(qos, &conn->iso_qos, sizeof(*qos)); 2308 conn->state = BT_CONNECTED; 2309 return conn; 2310 } 2311 2312 if (base_len && base) 2313 base_len = eir_append_service_data(eir, 0, 0x1851, 2314 base, base_len); 2315 2316 /* We need hci_conn object using the BDADDR_ANY as dst */ 2317 conn = hci_add_bis(hdev, dst, qos, base_len, eir); 2318 if (IS_ERR(conn)) 2319 return conn; 2320 2321 /* Update LINK PHYs according to QoS preference */ 2322 conn->le_tx_phy = qos->bcast.out.phy; 2323 conn->le_tx_phy = qos->bcast.out.phy; 2324 2325 /* Add Basic Announcement into Peridic Adv Data if BASE is set */ 2326 if (base_len && base) { 2327 memcpy(conn->le_per_adv_data, eir, sizeof(eir)); 2328 conn->le_per_adv_data_len = base_len; 2329 } 2330 2331 hci_iso_qos_setup(hdev, conn, &qos->bcast.out, 2332 conn->le_tx_phy ? conn->le_tx_phy : 2333 hdev->le_tx_def_phys); 2334 2335 conn->iso_qos = *qos; 2336 conn->state = BT_BOUND; 2337 2338 /* Link BISes together */ 2339 parent = hci_conn_hash_lookup_big(hdev, 2340 conn->iso_qos.bcast.big); 2341 if (parent && parent != conn) { 2342 link = hci_conn_link(parent, conn); 2343 hci_conn_drop(conn); 2344 if (!link) 2345 return ERR_PTR(-ENOLINK); 2346 } 2347 2348 return conn; 2349 } 2350 2351 static void bis_mark_per_adv(struct hci_conn *conn, void *data) 2352 { 2353 struct iso_list_data *d = data; 2354 2355 /* Skip if not broadcast/ANY address */ 2356 if (bacmp(&conn->dst, BDADDR_ANY)) 2357 return; 2358 2359 if (d->big != conn->iso_qos.bcast.big || 2360 d->bis == BT_ISO_QOS_BIS_UNSET || 2361 d->bis != conn->iso_qos.bcast.bis) 2362 return; 2363 2364 set_bit(HCI_CONN_PER_ADV, &conn->flags); 2365 } 2366 2367 struct hci_conn *hci_connect_bis(struct hci_dev *hdev, bdaddr_t *dst, 2368 __u8 dst_type, struct bt_iso_qos *qos, 2369 __u8 base_len, __u8 *base) 2370 { 2371 struct hci_conn *conn; 2372 int err; 2373 struct iso_list_data data; 2374 2375 conn = hci_bind_bis(hdev, dst, qos, base_len, base); 2376 if (IS_ERR(conn)) 2377 return conn; 2378 2379 if (conn->state == BT_CONNECTED) 2380 return conn; 2381 2382 data.big = qos->bcast.big; 2383 data.bis = qos->bcast.bis; 2384 2385 /* Set HCI_CONN_PER_ADV for all bound connections, to mark that 2386 * the start periodic advertising and create BIG commands have 2387 * been queued 2388 */ 2389 hci_conn_hash_list_state(hdev, bis_mark_per_adv, ISO_LINK, 2390 BT_BOUND, &data); 2391 2392 /* Queue start periodic advertising and create BIG */ 2393 err = hci_cmd_sync_queue(hdev, create_big_sync, conn, 2394 create_big_complete); 2395 if (err < 0) { 2396 hci_conn_drop(conn); 2397 return ERR_PTR(err); 2398 } 2399 2400 return conn; 2401 } 2402 2403 struct hci_conn *hci_connect_cis(struct hci_dev *hdev, bdaddr_t *dst, 2404 __u8 dst_type, struct bt_iso_qos *qos) 2405 { 2406 struct hci_conn *le; 2407 struct hci_conn *cis; 2408 struct hci_link *link; 2409 2410 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) 2411 le = hci_connect_le(hdev, dst, dst_type, false, 2412 BT_SECURITY_LOW, 2413 HCI_LE_CONN_TIMEOUT, 2414 HCI_ROLE_SLAVE, 0, 0); 2415 else 2416 le = hci_connect_le_scan(hdev, dst, dst_type, 2417 BT_SECURITY_LOW, 2418 HCI_LE_CONN_TIMEOUT, 2419 CONN_REASON_ISO_CONNECT); 2420 if (IS_ERR(le)) 2421 return le; 2422 2423 hci_iso_qos_setup(hdev, le, &qos->ucast.out, 2424 le->le_tx_phy ? le->le_tx_phy : hdev->le_tx_def_phys); 2425 hci_iso_qos_setup(hdev, le, &qos->ucast.in, 2426 le->le_rx_phy ? le->le_rx_phy : hdev->le_rx_def_phys); 2427 2428 cis = hci_bind_cis(hdev, dst, dst_type, qos); 2429 if (IS_ERR(cis)) { 2430 hci_conn_drop(le); 2431 return cis; 2432 } 2433 2434 link = hci_conn_link(le, cis); 2435 hci_conn_drop(cis); 2436 if (!link) { 2437 hci_conn_drop(le); 2438 return ERR_PTR(-ENOLINK); 2439 } 2440 2441 cis->state = BT_CONNECT; 2442 2443 hci_le_create_cis_pending(hdev); 2444 2445 return cis; 2446 } 2447 2448 /* Check link security requirement */ 2449 int hci_conn_check_link_mode(struct hci_conn *conn) 2450 { 2451 BT_DBG("hcon %p", conn); 2452 2453 /* In Secure Connections Only mode, it is required that Secure 2454 * Connections is used and the link is encrypted with AES-CCM 2455 * using a P-256 authenticated combination key. 2456 */ 2457 if (hci_dev_test_flag(conn->hdev, HCI_SC_ONLY)) { 2458 if (!hci_conn_sc_enabled(conn) || 2459 !test_bit(HCI_CONN_AES_CCM, &conn->flags) || 2460 conn->key_type != HCI_LK_AUTH_COMBINATION_P256) 2461 return 0; 2462 } 2463 2464 /* AES encryption is required for Level 4: 2465 * 2466 * BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 3, Part C 2467 * page 1319: 2468 * 2469 * 128-bit equivalent strength for link and encryption keys 2470 * required using FIPS approved algorithms (E0 not allowed, 2471 * SAFER+ not allowed, and P-192 not allowed; encryption key 2472 * not shortened) 2473 */ 2474 if (conn->sec_level == BT_SECURITY_FIPS && 2475 !test_bit(HCI_CONN_AES_CCM, &conn->flags)) { 2476 bt_dev_err(conn->hdev, 2477 "Invalid security: Missing AES-CCM usage"); 2478 return 0; 2479 } 2480 2481 if (hci_conn_ssp_enabled(conn) && 2482 !test_bit(HCI_CONN_ENCRYPT, &conn->flags)) 2483 return 0; 2484 2485 return 1; 2486 } 2487 2488 /* Authenticate remote device */ 2489 static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type) 2490 { 2491 BT_DBG("hcon %p", conn); 2492 2493 if (conn->pending_sec_level > sec_level) 2494 sec_level = conn->pending_sec_level; 2495 2496 if (sec_level > conn->sec_level) 2497 conn->pending_sec_level = sec_level; 2498 else if (test_bit(HCI_CONN_AUTH, &conn->flags)) 2499 return 1; 2500 2501 /* Make sure we preserve an existing MITM requirement*/ 2502 auth_type |= (conn->auth_type & 0x01); 2503 2504 conn->auth_type = auth_type; 2505 2506 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) { 2507 struct hci_cp_auth_requested cp; 2508 2509 cp.handle = cpu_to_le16(conn->handle); 2510 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED, 2511 sizeof(cp), &cp); 2512 2513 /* Set the ENCRYPT_PEND to trigger encryption after 2514 * authentication. 2515 */ 2516 if (!test_bit(HCI_CONN_ENCRYPT, &conn->flags)) 2517 set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags); 2518 } 2519 2520 return 0; 2521 } 2522 2523 /* Encrypt the link */ 2524 static void hci_conn_encrypt(struct hci_conn *conn) 2525 { 2526 BT_DBG("hcon %p", conn); 2527 2528 if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) { 2529 struct hci_cp_set_conn_encrypt cp; 2530 cp.handle = cpu_to_le16(conn->handle); 2531 cp.encrypt = 0x01; 2532 hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp), 2533 &cp); 2534 } 2535 } 2536 2537 /* Enable security */ 2538 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type, 2539 bool initiator) 2540 { 2541 BT_DBG("hcon %p", conn); 2542 2543 if (conn->type == LE_LINK) 2544 return smp_conn_security(conn, sec_level); 2545 2546 /* For sdp we don't need the link key. */ 2547 if (sec_level == BT_SECURITY_SDP) 2548 return 1; 2549 2550 /* For non 2.1 devices and low security level we don't need the link 2551 key. */ 2552 if (sec_level == BT_SECURITY_LOW && !hci_conn_ssp_enabled(conn)) 2553 return 1; 2554 2555 /* For other security levels we need the link key. */ 2556 if (!test_bit(HCI_CONN_AUTH, &conn->flags)) 2557 goto auth; 2558 2559 switch (conn->key_type) { 2560 case HCI_LK_AUTH_COMBINATION_P256: 2561 /* An authenticated FIPS approved combination key has 2562 * sufficient security for security level 4 or lower. 2563 */ 2564 if (sec_level <= BT_SECURITY_FIPS) 2565 goto encrypt; 2566 break; 2567 case HCI_LK_AUTH_COMBINATION_P192: 2568 /* An authenticated combination key has sufficient security for 2569 * security level 3 or lower. 2570 */ 2571 if (sec_level <= BT_SECURITY_HIGH) 2572 goto encrypt; 2573 break; 2574 case HCI_LK_UNAUTH_COMBINATION_P192: 2575 case HCI_LK_UNAUTH_COMBINATION_P256: 2576 /* An unauthenticated combination key has sufficient security 2577 * for security level 2 or lower. 2578 */ 2579 if (sec_level <= BT_SECURITY_MEDIUM) 2580 goto encrypt; 2581 break; 2582 case HCI_LK_COMBINATION: 2583 /* A combination key has always sufficient security for the 2584 * security levels 2 or lower. High security level requires the 2585 * combination key is generated using maximum PIN code length 2586 * (16). For pre 2.1 units. 2587 */ 2588 if (sec_level <= BT_SECURITY_MEDIUM || conn->pin_length == 16) 2589 goto encrypt; 2590 break; 2591 default: 2592 break; 2593 } 2594 2595 auth: 2596 if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) 2597 return 0; 2598 2599 if (initiator) 2600 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags); 2601 2602 if (!hci_conn_auth(conn, sec_level, auth_type)) 2603 return 0; 2604 2605 encrypt: 2606 if (test_bit(HCI_CONN_ENCRYPT, &conn->flags)) { 2607 /* Ensure that the encryption key size has been read, 2608 * otherwise stall the upper layer responses. 2609 */ 2610 if (!conn->enc_key_size) 2611 return 0; 2612 2613 /* Nothing else needed, all requirements are met */ 2614 return 1; 2615 } 2616 2617 hci_conn_encrypt(conn); 2618 return 0; 2619 } 2620 EXPORT_SYMBOL(hci_conn_security); 2621 2622 /* Check secure link requirement */ 2623 int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level) 2624 { 2625 BT_DBG("hcon %p", conn); 2626 2627 /* Accept if non-secure or higher security level is required */ 2628 if (sec_level != BT_SECURITY_HIGH && sec_level != BT_SECURITY_FIPS) 2629 return 1; 2630 2631 /* Accept if secure or higher security level is already present */ 2632 if (conn->sec_level == BT_SECURITY_HIGH || 2633 conn->sec_level == BT_SECURITY_FIPS) 2634 return 1; 2635 2636 /* Reject not secure link */ 2637 return 0; 2638 } 2639 EXPORT_SYMBOL(hci_conn_check_secure); 2640 2641 /* Switch role */ 2642 int hci_conn_switch_role(struct hci_conn *conn, __u8 role) 2643 { 2644 BT_DBG("hcon %p", conn); 2645 2646 if (role == conn->role) 2647 return 1; 2648 2649 if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->flags)) { 2650 struct hci_cp_switch_role cp; 2651 bacpy(&cp.bdaddr, &conn->dst); 2652 cp.role = role; 2653 hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp); 2654 } 2655 2656 return 0; 2657 } 2658 EXPORT_SYMBOL(hci_conn_switch_role); 2659 2660 /* Enter active mode */ 2661 void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active) 2662 { 2663 struct hci_dev *hdev = conn->hdev; 2664 2665 BT_DBG("hcon %p mode %d", conn, conn->mode); 2666 2667 if (conn->mode != HCI_CM_SNIFF) 2668 goto timer; 2669 2670 if (!test_bit(HCI_CONN_POWER_SAVE, &conn->flags) && !force_active) 2671 goto timer; 2672 2673 if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) { 2674 struct hci_cp_exit_sniff_mode cp; 2675 cp.handle = cpu_to_le16(conn->handle); 2676 hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp); 2677 } 2678 2679 timer: 2680 if (hdev->idle_timeout > 0) 2681 queue_delayed_work(hdev->workqueue, &conn->idle_work, 2682 msecs_to_jiffies(hdev->idle_timeout)); 2683 } 2684 2685 /* Drop all connection on the device */ 2686 void hci_conn_hash_flush(struct hci_dev *hdev) 2687 { 2688 struct list_head *head = &hdev->conn_hash.list; 2689 struct hci_conn *conn; 2690 2691 BT_DBG("hdev %s", hdev->name); 2692 2693 /* We should not traverse the list here, because hci_conn_del 2694 * can remove extra links, which may cause the list traversal 2695 * to hit items that have already been released. 2696 */ 2697 while ((conn = list_first_entry_or_null(head, 2698 struct hci_conn, 2699 list)) != NULL) { 2700 conn->state = BT_CLOSED; 2701 hci_disconn_cfm(conn, HCI_ERROR_LOCAL_HOST_TERM); 2702 hci_conn_del(conn); 2703 } 2704 } 2705 2706 static u32 get_link_mode(struct hci_conn *conn) 2707 { 2708 u32 link_mode = 0; 2709 2710 if (conn->role == HCI_ROLE_MASTER) 2711 link_mode |= HCI_LM_MASTER; 2712 2713 if (test_bit(HCI_CONN_ENCRYPT, &conn->flags)) 2714 link_mode |= HCI_LM_ENCRYPT; 2715 2716 if (test_bit(HCI_CONN_AUTH, &conn->flags)) 2717 link_mode |= HCI_LM_AUTH; 2718 2719 if (test_bit(HCI_CONN_SECURE, &conn->flags)) 2720 link_mode |= HCI_LM_SECURE; 2721 2722 if (test_bit(HCI_CONN_FIPS, &conn->flags)) 2723 link_mode |= HCI_LM_FIPS; 2724 2725 return link_mode; 2726 } 2727 2728 int hci_get_conn_list(void __user *arg) 2729 { 2730 struct hci_conn *c; 2731 struct hci_conn_list_req req, *cl; 2732 struct hci_conn_info *ci; 2733 struct hci_dev *hdev; 2734 int n = 0, size, err; 2735 2736 if (copy_from_user(&req, arg, sizeof(req))) 2737 return -EFAULT; 2738 2739 if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci)) 2740 return -EINVAL; 2741 2742 size = sizeof(req) + req.conn_num * sizeof(*ci); 2743 2744 cl = kmalloc(size, GFP_KERNEL); 2745 if (!cl) 2746 return -ENOMEM; 2747 2748 hdev = hci_dev_get(req.dev_id); 2749 if (!hdev) { 2750 kfree(cl); 2751 return -ENODEV; 2752 } 2753 2754 ci = cl->conn_info; 2755 2756 hci_dev_lock(hdev); 2757 list_for_each_entry(c, &hdev->conn_hash.list, list) { 2758 bacpy(&(ci + n)->bdaddr, &c->dst); 2759 (ci + n)->handle = c->handle; 2760 (ci + n)->type = c->type; 2761 (ci + n)->out = c->out; 2762 (ci + n)->state = c->state; 2763 (ci + n)->link_mode = get_link_mode(c); 2764 if (++n >= req.conn_num) 2765 break; 2766 } 2767 hci_dev_unlock(hdev); 2768 2769 cl->dev_id = hdev->id; 2770 cl->conn_num = n; 2771 size = sizeof(req) + n * sizeof(*ci); 2772 2773 hci_dev_put(hdev); 2774 2775 err = copy_to_user(arg, cl, size); 2776 kfree(cl); 2777 2778 return err ? -EFAULT : 0; 2779 } 2780 2781 int hci_get_conn_info(struct hci_dev *hdev, void __user *arg) 2782 { 2783 struct hci_conn_info_req req; 2784 struct hci_conn_info ci; 2785 struct hci_conn *conn; 2786 char __user *ptr = arg + sizeof(req); 2787 2788 if (copy_from_user(&req, arg, sizeof(req))) 2789 return -EFAULT; 2790 2791 hci_dev_lock(hdev); 2792 conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr); 2793 if (conn) { 2794 bacpy(&ci.bdaddr, &conn->dst); 2795 ci.handle = conn->handle; 2796 ci.type = conn->type; 2797 ci.out = conn->out; 2798 ci.state = conn->state; 2799 ci.link_mode = get_link_mode(conn); 2800 } 2801 hci_dev_unlock(hdev); 2802 2803 if (!conn) 2804 return -ENOENT; 2805 2806 return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0; 2807 } 2808 2809 int hci_get_auth_info(struct hci_dev *hdev, void __user *arg) 2810 { 2811 struct hci_auth_info_req req; 2812 struct hci_conn *conn; 2813 2814 if (copy_from_user(&req, arg, sizeof(req))) 2815 return -EFAULT; 2816 2817 hci_dev_lock(hdev); 2818 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr); 2819 if (conn) 2820 req.type = conn->auth_type; 2821 hci_dev_unlock(hdev); 2822 2823 if (!conn) 2824 return -ENOENT; 2825 2826 return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0; 2827 } 2828 2829 struct hci_chan *hci_chan_create(struct hci_conn *conn) 2830 { 2831 struct hci_dev *hdev = conn->hdev; 2832 struct hci_chan *chan; 2833 2834 BT_DBG("%s hcon %p", hdev->name, conn); 2835 2836 if (test_bit(HCI_CONN_DROP, &conn->flags)) { 2837 BT_DBG("Refusing to create new hci_chan"); 2838 return NULL; 2839 } 2840 2841 chan = kzalloc(sizeof(*chan), GFP_KERNEL); 2842 if (!chan) 2843 return NULL; 2844 2845 chan->conn = hci_conn_get(conn); 2846 skb_queue_head_init(&chan->data_q); 2847 chan->state = BT_CONNECTED; 2848 2849 list_add_rcu(&chan->list, &conn->chan_list); 2850 2851 return chan; 2852 } 2853 2854 void hci_chan_del(struct hci_chan *chan) 2855 { 2856 struct hci_conn *conn = chan->conn; 2857 struct hci_dev *hdev = conn->hdev; 2858 2859 BT_DBG("%s hcon %p chan %p", hdev->name, conn, chan); 2860 2861 list_del_rcu(&chan->list); 2862 2863 synchronize_rcu(); 2864 2865 /* Prevent new hci_chan's to be created for this hci_conn */ 2866 set_bit(HCI_CONN_DROP, &conn->flags); 2867 2868 hci_conn_put(conn); 2869 2870 skb_queue_purge(&chan->data_q); 2871 kfree(chan); 2872 } 2873 2874 void hci_chan_list_flush(struct hci_conn *conn) 2875 { 2876 struct hci_chan *chan, *n; 2877 2878 BT_DBG("hcon %p", conn); 2879 2880 list_for_each_entry_safe(chan, n, &conn->chan_list, list) 2881 hci_chan_del(chan); 2882 } 2883 2884 static struct hci_chan *__hci_chan_lookup_handle(struct hci_conn *hcon, 2885 __u16 handle) 2886 { 2887 struct hci_chan *hchan; 2888 2889 list_for_each_entry(hchan, &hcon->chan_list, list) { 2890 if (hchan->handle == handle) 2891 return hchan; 2892 } 2893 2894 return NULL; 2895 } 2896 2897 struct hci_chan *hci_chan_lookup_handle(struct hci_dev *hdev, __u16 handle) 2898 { 2899 struct hci_conn_hash *h = &hdev->conn_hash; 2900 struct hci_conn *hcon; 2901 struct hci_chan *hchan = NULL; 2902 2903 rcu_read_lock(); 2904 2905 list_for_each_entry_rcu(hcon, &h->list, list) { 2906 hchan = __hci_chan_lookup_handle(hcon, handle); 2907 if (hchan) 2908 break; 2909 } 2910 2911 rcu_read_unlock(); 2912 2913 return hchan; 2914 } 2915 2916 u32 hci_conn_get_phy(struct hci_conn *conn) 2917 { 2918 u32 phys = 0; 2919 2920 /* BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 2, Part B page 471: 2921 * Table 6.2: Packets defined for synchronous, asynchronous, and 2922 * CPB logical transport types. 2923 */ 2924 switch (conn->type) { 2925 case SCO_LINK: 2926 /* SCO logical transport (1 Mb/s): 2927 * HV1, HV2, HV3 and DV. 2928 */ 2929 phys |= BT_PHY_BR_1M_1SLOT; 2930 2931 break; 2932 2933 case ACL_LINK: 2934 /* ACL logical transport (1 Mb/s) ptt=0: 2935 * DH1, DM3, DH3, DM5 and DH5. 2936 */ 2937 phys |= BT_PHY_BR_1M_1SLOT; 2938 2939 if (conn->pkt_type & (HCI_DM3 | HCI_DH3)) 2940 phys |= BT_PHY_BR_1M_3SLOT; 2941 2942 if (conn->pkt_type & (HCI_DM5 | HCI_DH5)) 2943 phys |= BT_PHY_BR_1M_5SLOT; 2944 2945 /* ACL logical transport (2 Mb/s) ptt=1: 2946 * 2-DH1, 2-DH3 and 2-DH5. 2947 */ 2948 if (!(conn->pkt_type & HCI_2DH1)) 2949 phys |= BT_PHY_EDR_2M_1SLOT; 2950 2951 if (!(conn->pkt_type & HCI_2DH3)) 2952 phys |= BT_PHY_EDR_2M_3SLOT; 2953 2954 if (!(conn->pkt_type & HCI_2DH5)) 2955 phys |= BT_PHY_EDR_2M_5SLOT; 2956 2957 /* ACL logical transport (3 Mb/s) ptt=1: 2958 * 3-DH1, 3-DH3 and 3-DH5. 2959 */ 2960 if (!(conn->pkt_type & HCI_3DH1)) 2961 phys |= BT_PHY_EDR_3M_1SLOT; 2962 2963 if (!(conn->pkt_type & HCI_3DH3)) 2964 phys |= BT_PHY_EDR_3M_3SLOT; 2965 2966 if (!(conn->pkt_type & HCI_3DH5)) 2967 phys |= BT_PHY_EDR_3M_5SLOT; 2968 2969 break; 2970 2971 case ESCO_LINK: 2972 /* eSCO logical transport (1 Mb/s): EV3, EV4 and EV5 */ 2973 phys |= BT_PHY_BR_1M_1SLOT; 2974 2975 if (!(conn->pkt_type & (ESCO_EV4 | ESCO_EV5))) 2976 phys |= BT_PHY_BR_1M_3SLOT; 2977 2978 /* eSCO logical transport (2 Mb/s): 2-EV3, 2-EV5 */ 2979 if (!(conn->pkt_type & ESCO_2EV3)) 2980 phys |= BT_PHY_EDR_2M_1SLOT; 2981 2982 if (!(conn->pkt_type & ESCO_2EV5)) 2983 phys |= BT_PHY_EDR_2M_3SLOT; 2984 2985 /* eSCO logical transport (3 Mb/s): 3-EV3, 3-EV5 */ 2986 if (!(conn->pkt_type & ESCO_3EV3)) 2987 phys |= BT_PHY_EDR_3M_1SLOT; 2988 2989 if (!(conn->pkt_type & ESCO_3EV5)) 2990 phys |= BT_PHY_EDR_3M_3SLOT; 2991 2992 break; 2993 2994 case LE_LINK: 2995 if (conn->le_tx_phy & HCI_LE_SET_PHY_1M) 2996 phys |= BT_PHY_LE_1M_TX; 2997 2998 if (conn->le_rx_phy & HCI_LE_SET_PHY_1M) 2999 phys |= BT_PHY_LE_1M_RX; 3000 3001 if (conn->le_tx_phy & HCI_LE_SET_PHY_2M) 3002 phys |= BT_PHY_LE_2M_TX; 3003 3004 if (conn->le_rx_phy & HCI_LE_SET_PHY_2M) 3005 phys |= BT_PHY_LE_2M_RX; 3006 3007 if (conn->le_tx_phy & HCI_LE_SET_PHY_CODED) 3008 phys |= BT_PHY_LE_CODED_TX; 3009 3010 if (conn->le_rx_phy & HCI_LE_SET_PHY_CODED) 3011 phys |= BT_PHY_LE_CODED_RX; 3012 3013 break; 3014 } 3015 3016 return phys; 3017 } 3018 3019 static int abort_conn_sync(struct hci_dev *hdev, void *data) 3020 { 3021 struct hci_conn *conn = data; 3022 3023 if (!hci_conn_valid(hdev, conn)) 3024 return -ECANCELED; 3025 3026 return hci_abort_conn_sync(hdev, conn, conn->abort_reason); 3027 } 3028 3029 int hci_abort_conn(struct hci_conn *conn, u8 reason) 3030 { 3031 struct hci_dev *hdev = conn->hdev; 3032 3033 /* If abort_reason has already been set it means the connection is 3034 * already being aborted so don't attempt to overwrite it. 3035 */ 3036 if (conn->abort_reason) 3037 return 0; 3038 3039 bt_dev_dbg(hdev, "handle 0x%2.2x reason 0x%2.2x", conn->handle, reason); 3040 3041 conn->abort_reason = reason; 3042 3043 /* If the connection is pending check the command opcode since that 3044 * might be blocking on hci_cmd_sync_work while waiting its respective 3045 * event so we need to hci_cmd_sync_cancel to cancel it. 3046 * 3047 * hci_connect_le serializes the connection attempts so only one 3048 * connection can be in BT_CONNECT at time. 3049 */ 3050 if (conn->state == BT_CONNECT && hdev->req_status == HCI_REQ_PEND) { 3051 switch (hci_skb_event(hdev->sent_cmd)) { 3052 case HCI_EV_CONN_COMPLETE: 3053 case HCI_EV_LE_CONN_COMPLETE: 3054 case HCI_EV_LE_ENHANCED_CONN_COMPLETE: 3055 case HCI_EVT_LE_CIS_ESTABLISHED: 3056 hci_cmd_sync_cancel(hdev, ECANCELED); 3057 break; 3058 } 3059 /* Cancel connect attempt if still queued/pending */ 3060 } else if (!hci_cancel_connect_sync(hdev, conn)) { 3061 return 0; 3062 } 3063 3064 /* Run immediately if on cmd_sync_work since this may be called 3065 * as a result to MGMT_OP_DISCONNECT/MGMT_OP_UNPAIR which does 3066 * already queue its callback on cmd_sync_work. 3067 */ 3068 return hci_cmd_sync_run_once(hdev, abort_conn_sync, conn, NULL); 3069 } 3070 3071 void hci_setup_tx_timestamp(struct sk_buff *skb, size_t key_offset, 3072 const struct sockcm_cookie *sockc) 3073 { 3074 struct sock *sk = skb ? skb->sk : NULL; 3075 3076 /* This shall be called on a single skb of those generated by user 3077 * sendmsg(), and only when the sendmsg() does not return error to 3078 * user. This is required for keeping the tskey that increments here in 3079 * sync with possible sendmsg() counting by user. 3080 * 3081 * Stream sockets shall set key_offset to sendmsg() length in bytes 3082 * and call with the last fragment, others to 1 and first fragment. 3083 */ 3084 3085 if (!skb || !sockc || !sk || !key_offset) 3086 return; 3087 3088 sock_tx_timestamp(sk, sockc, &skb_shinfo(skb)->tx_flags); 3089 3090 if (sockc->tsflags & SOF_TIMESTAMPING_OPT_ID && 3091 sockc->tsflags & SOF_TIMESTAMPING_TX_RECORD_MASK) { 3092 if (sockc->tsflags & SOCKCM_FLAG_TS_OPT_ID) { 3093 skb_shinfo(skb)->tskey = sockc->ts_opt_id; 3094 } else { 3095 int key = atomic_add_return(key_offset, &sk->sk_tskey); 3096 3097 skb_shinfo(skb)->tskey = key - 1; 3098 } 3099 } 3100 } 3101 3102 void hci_conn_tx_queue(struct hci_conn *conn, struct sk_buff *skb) 3103 { 3104 struct tx_queue *comp = &conn->tx_q; 3105 bool track = false; 3106 3107 /* Emit SND now, ie. just before sending to driver */ 3108 if (skb_shinfo(skb)->tx_flags & SKBTX_SW_TSTAMP) 3109 __skb_tstamp_tx(skb, NULL, NULL, skb->sk, SCM_TSTAMP_SND); 3110 3111 /* COMPLETION tstamp is emitted for tracked skb later in Number of 3112 * Completed Packets event. Available only for flow controlled cases. 3113 * 3114 * TODO: SCO support without flowctl (needs to be done in drivers) 3115 */ 3116 switch (conn->type) { 3117 case ISO_LINK: 3118 case ACL_LINK: 3119 case LE_LINK: 3120 break; 3121 case SCO_LINK: 3122 case ESCO_LINK: 3123 if (!hci_dev_test_flag(conn->hdev, HCI_SCO_FLOWCTL)) 3124 return; 3125 break; 3126 default: 3127 return; 3128 } 3129 3130 if (skb->sk && (skb_shinfo(skb)->tx_flags & SKBTX_COMPLETION_TSTAMP)) 3131 track = true; 3132 3133 /* If nothing is tracked, just count extra skbs at the queue head */ 3134 if (!track && !comp->tracked) { 3135 comp->extra++; 3136 return; 3137 } 3138 3139 if (track) { 3140 skb = skb_clone_sk(skb); 3141 if (!skb) 3142 goto count_only; 3143 3144 comp->tracked++; 3145 } else { 3146 skb = skb_clone(skb, GFP_KERNEL); 3147 if (!skb) 3148 goto count_only; 3149 } 3150 3151 skb_queue_tail(&comp->queue, skb); 3152 return; 3153 3154 count_only: 3155 /* Stop tracking skbs, and only count. This will not emit timestamps for 3156 * the packets, but if we get here something is more seriously wrong. 3157 */ 3158 comp->tracked = 0; 3159 comp->extra += skb_queue_len(&comp->queue) + 1; 3160 skb_queue_purge(&comp->queue); 3161 } 3162 3163 void hci_conn_tx_dequeue(struct hci_conn *conn) 3164 { 3165 struct tx_queue *comp = &conn->tx_q; 3166 struct sk_buff *skb; 3167 3168 /* If there are tracked skbs, the counted extra go before dequeuing real 3169 * skbs, to keep ordering. When nothing is tracked, the ordering doesn't 3170 * matter so dequeue real skbs first to get rid of them ASAP. 3171 */ 3172 if (comp->extra && (comp->tracked || skb_queue_empty(&comp->queue))) { 3173 comp->extra--; 3174 return; 3175 } 3176 3177 skb = skb_dequeue(&comp->queue); 3178 if (!skb) 3179 return; 3180 3181 if (skb->sk) { 3182 comp->tracked--; 3183 __skb_tstamp_tx(skb, NULL, NULL, skb->sk, 3184 SCM_TSTAMP_COMPLETION); 3185 } 3186 3187 kfree_skb(skb); 3188 } 3189