1 /* 2 BlueZ - Bluetooth protocol stack for Linux 3 Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved. 4 5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com> 6 7 This program is free software; you can redistribute it and/or modify 8 it under the terms of the GNU General Public License version 2 as 9 published by the Free Software Foundation; 10 11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 19 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 22 SOFTWARE IS DISCLAIMED. 23 */ 24 25 /* Bluetooth HCI connection handling. */ 26 27 #include <linux/export.h> 28 #include <linux/debugfs.h> 29 30 #include <net/bluetooth/bluetooth.h> 31 #include <net/bluetooth/hci_core.h> 32 #include <net/bluetooth/l2cap.h> 33 34 #include "hci_request.h" 35 #include "smp.h" 36 #include "a2mp.h" 37 38 struct sco_param { 39 u16 pkt_type; 40 u16 max_latency; 41 u8 retrans_effort; 42 }; 43 44 static const struct sco_param esco_param_cvsd[] = { 45 { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000a, 0x01 }, /* S3 */ 46 { EDR_ESCO_MASK & ~ESCO_2EV3, 0x0007, 0x01 }, /* S2 */ 47 { EDR_ESCO_MASK | ESCO_EV3, 0x0007, 0x01 }, /* S1 */ 48 { EDR_ESCO_MASK | ESCO_HV3, 0xffff, 0x01 }, /* D1 */ 49 { EDR_ESCO_MASK | ESCO_HV1, 0xffff, 0x01 }, /* D0 */ 50 }; 51 52 static const struct sco_param sco_param_cvsd[] = { 53 { EDR_ESCO_MASK | ESCO_HV3, 0xffff, 0xff }, /* D1 */ 54 { EDR_ESCO_MASK | ESCO_HV1, 0xffff, 0xff }, /* D0 */ 55 }; 56 57 static const struct sco_param esco_param_msbc[] = { 58 { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000d, 0x02 }, /* T2 */ 59 { EDR_ESCO_MASK | ESCO_EV3, 0x0008, 0x02 }, /* T1 */ 60 }; 61 62 /* This function requires the caller holds hdev->lock */ 63 static void hci_connect_le_scan_cleanup(struct hci_conn *conn) 64 { 65 struct hci_conn_params *params; 66 struct hci_dev *hdev = conn->hdev; 67 struct smp_irk *irk; 68 bdaddr_t *bdaddr; 69 u8 bdaddr_type; 70 71 bdaddr = &conn->dst; 72 bdaddr_type = conn->dst_type; 73 74 /* Check if we need to convert to identity address */ 75 irk = hci_get_irk(hdev, bdaddr, bdaddr_type); 76 if (irk) { 77 bdaddr = &irk->bdaddr; 78 bdaddr_type = irk->addr_type; 79 } 80 81 params = hci_pend_le_action_lookup(&hdev->pend_le_conns, bdaddr, 82 bdaddr_type); 83 if (!params || !params->explicit_connect) 84 return; 85 86 /* The connection attempt was doing scan for new RPA, and is 87 * in scan phase. If params are not associated with any other 88 * autoconnect action, remove them completely. If they are, just unmark 89 * them as waiting for connection, by clearing explicit_connect field. 90 */ 91 params->explicit_connect = false; 92 93 list_del_init(¶ms->action); 94 95 switch (params->auto_connect) { 96 case HCI_AUTO_CONN_EXPLICIT: 97 hci_conn_params_del(hdev, bdaddr, bdaddr_type); 98 /* return instead of break to avoid duplicate scan update */ 99 return; 100 case HCI_AUTO_CONN_DIRECT: 101 case HCI_AUTO_CONN_ALWAYS: 102 list_add(¶ms->action, &hdev->pend_le_conns); 103 break; 104 case HCI_AUTO_CONN_REPORT: 105 list_add(¶ms->action, &hdev->pend_le_reports); 106 break; 107 default: 108 break; 109 } 110 111 hci_update_background_scan(hdev); 112 } 113 114 static void hci_conn_cleanup(struct hci_conn *conn) 115 { 116 struct hci_dev *hdev = conn->hdev; 117 118 if (test_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags)) 119 hci_conn_params_del(conn->hdev, &conn->dst, conn->dst_type); 120 121 hci_chan_list_flush(conn); 122 123 hci_conn_hash_del(hdev, conn); 124 125 if (hdev->notify) 126 hdev->notify(hdev, HCI_NOTIFY_CONN_DEL); 127 128 hci_conn_del_sysfs(conn); 129 130 debugfs_remove_recursive(conn->debugfs); 131 132 hci_dev_put(hdev); 133 134 hci_conn_put(conn); 135 } 136 137 static void le_scan_cleanup(struct work_struct *work) 138 { 139 struct hci_conn *conn = container_of(work, struct hci_conn, 140 le_scan_cleanup); 141 struct hci_dev *hdev = conn->hdev; 142 struct hci_conn *c = NULL; 143 144 BT_DBG("%s hcon %p", hdev->name, conn); 145 146 hci_dev_lock(hdev); 147 148 /* Check that the hci_conn is still around */ 149 rcu_read_lock(); 150 list_for_each_entry_rcu(c, &hdev->conn_hash.list, list) { 151 if (c == conn) 152 break; 153 } 154 rcu_read_unlock(); 155 156 if (c == conn) { 157 hci_connect_le_scan_cleanup(conn); 158 hci_conn_cleanup(conn); 159 } 160 161 hci_dev_unlock(hdev); 162 hci_dev_put(hdev); 163 hci_conn_put(conn); 164 } 165 166 static void hci_connect_le_scan_remove(struct hci_conn *conn) 167 { 168 BT_DBG("%s hcon %p", conn->hdev->name, conn); 169 170 /* We can't call hci_conn_del/hci_conn_cleanup here since that 171 * could deadlock with another hci_conn_del() call that's holding 172 * hci_dev_lock and doing cancel_delayed_work_sync(&conn->disc_work). 173 * Instead, grab temporary extra references to the hci_dev and 174 * hci_conn and perform the necessary cleanup in a separate work 175 * callback. 176 */ 177 178 hci_dev_hold(conn->hdev); 179 hci_conn_get(conn); 180 181 schedule_work(&conn->le_scan_cleanup); 182 } 183 184 static void hci_acl_create_connection(struct hci_conn *conn) 185 { 186 struct hci_dev *hdev = conn->hdev; 187 struct inquiry_entry *ie; 188 struct hci_cp_create_conn cp; 189 190 BT_DBG("hcon %p", conn); 191 192 conn->state = BT_CONNECT; 193 conn->out = true; 194 conn->role = HCI_ROLE_MASTER; 195 196 conn->attempt++; 197 198 conn->link_policy = hdev->link_policy; 199 200 memset(&cp, 0, sizeof(cp)); 201 bacpy(&cp.bdaddr, &conn->dst); 202 cp.pscan_rep_mode = 0x02; 203 204 ie = hci_inquiry_cache_lookup(hdev, &conn->dst); 205 if (ie) { 206 if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) { 207 cp.pscan_rep_mode = ie->data.pscan_rep_mode; 208 cp.pscan_mode = ie->data.pscan_mode; 209 cp.clock_offset = ie->data.clock_offset | 210 cpu_to_le16(0x8000); 211 } 212 213 memcpy(conn->dev_class, ie->data.dev_class, 3); 214 if (ie->data.ssp_mode > 0) 215 set_bit(HCI_CONN_SSP_ENABLED, &conn->flags); 216 } 217 218 cp.pkt_type = cpu_to_le16(conn->pkt_type); 219 if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER)) 220 cp.role_switch = 0x01; 221 else 222 cp.role_switch = 0x00; 223 224 hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp); 225 } 226 227 int hci_disconnect(struct hci_conn *conn, __u8 reason) 228 { 229 BT_DBG("hcon %p", conn); 230 231 /* When we are master of an established connection and it enters 232 * the disconnect timeout, then go ahead and try to read the 233 * current clock offset. Processing of the result is done 234 * within the event handling and hci_clock_offset_evt function. 235 */ 236 if (conn->type == ACL_LINK && conn->role == HCI_ROLE_MASTER && 237 (conn->state == BT_CONNECTED || conn->state == BT_CONFIG)) { 238 struct hci_dev *hdev = conn->hdev; 239 struct hci_cp_read_clock_offset clkoff_cp; 240 241 clkoff_cp.handle = cpu_to_le16(conn->handle); 242 hci_send_cmd(hdev, HCI_OP_READ_CLOCK_OFFSET, sizeof(clkoff_cp), 243 &clkoff_cp); 244 } 245 246 return hci_abort_conn(conn, reason); 247 } 248 249 static void hci_add_sco(struct hci_conn *conn, __u16 handle) 250 { 251 struct hci_dev *hdev = conn->hdev; 252 struct hci_cp_add_sco cp; 253 254 BT_DBG("hcon %p", conn); 255 256 conn->state = BT_CONNECT; 257 conn->out = true; 258 259 conn->attempt++; 260 261 cp.handle = cpu_to_le16(handle); 262 cp.pkt_type = cpu_to_le16(conn->pkt_type); 263 264 hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp); 265 } 266 267 bool hci_setup_sync(struct hci_conn *conn, __u16 handle) 268 { 269 struct hci_dev *hdev = conn->hdev; 270 struct hci_cp_setup_sync_conn cp; 271 const struct sco_param *param; 272 273 BT_DBG("hcon %p", conn); 274 275 conn->state = BT_CONNECT; 276 conn->out = true; 277 278 conn->attempt++; 279 280 cp.handle = cpu_to_le16(handle); 281 282 cp.tx_bandwidth = cpu_to_le32(0x00001f40); 283 cp.rx_bandwidth = cpu_to_le32(0x00001f40); 284 cp.voice_setting = cpu_to_le16(conn->setting); 285 286 switch (conn->setting & SCO_AIRMODE_MASK) { 287 case SCO_AIRMODE_TRANSP: 288 if (conn->attempt > ARRAY_SIZE(esco_param_msbc)) 289 return false; 290 param = &esco_param_msbc[conn->attempt - 1]; 291 break; 292 case SCO_AIRMODE_CVSD: 293 if (lmp_esco_capable(conn->link)) { 294 if (conn->attempt > ARRAY_SIZE(esco_param_cvsd)) 295 return false; 296 param = &esco_param_cvsd[conn->attempt - 1]; 297 } else { 298 if (conn->attempt > ARRAY_SIZE(sco_param_cvsd)) 299 return false; 300 param = &sco_param_cvsd[conn->attempt - 1]; 301 } 302 break; 303 default: 304 return false; 305 } 306 307 cp.retrans_effort = param->retrans_effort; 308 cp.pkt_type = __cpu_to_le16(param->pkt_type); 309 cp.max_latency = __cpu_to_le16(param->max_latency); 310 311 if (hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp) < 0) 312 return false; 313 314 return true; 315 } 316 317 u8 hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max, u16 latency, 318 u16 to_multiplier) 319 { 320 struct hci_dev *hdev = conn->hdev; 321 struct hci_conn_params *params; 322 struct hci_cp_le_conn_update cp; 323 324 hci_dev_lock(hdev); 325 326 params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type); 327 if (params) { 328 params->conn_min_interval = min; 329 params->conn_max_interval = max; 330 params->conn_latency = latency; 331 params->supervision_timeout = to_multiplier; 332 } 333 334 hci_dev_unlock(hdev); 335 336 memset(&cp, 0, sizeof(cp)); 337 cp.handle = cpu_to_le16(conn->handle); 338 cp.conn_interval_min = cpu_to_le16(min); 339 cp.conn_interval_max = cpu_to_le16(max); 340 cp.conn_latency = cpu_to_le16(latency); 341 cp.supervision_timeout = cpu_to_le16(to_multiplier); 342 cp.min_ce_len = cpu_to_le16(0x0000); 343 cp.max_ce_len = cpu_to_le16(0x0000); 344 345 hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp); 346 347 if (params) 348 return 0x01; 349 350 return 0x00; 351 } 352 353 void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __le64 rand, 354 __u8 ltk[16], __u8 key_size) 355 { 356 struct hci_dev *hdev = conn->hdev; 357 struct hci_cp_le_start_enc cp; 358 359 BT_DBG("hcon %p", conn); 360 361 memset(&cp, 0, sizeof(cp)); 362 363 cp.handle = cpu_to_le16(conn->handle); 364 cp.rand = rand; 365 cp.ediv = ediv; 366 memcpy(cp.ltk, ltk, key_size); 367 368 hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp); 369 } 370 371 /* Device _must_ be locked */ 372 void hci_sco_setup(struct hci_conn *conn, __u8 status) 373 { 374 struct hci_conn *sco = conn->link; 375 376 if (!sco) 377 return; 378 379 BT_DBG("hcon %p", conn); 380 381 if (!status) { 382 if (lmp_esco_capable(conn->hdev)) 383 hci_setup_sync(sco, conn->handle); 384 else 385 hci_add_sco(sco, conn->handle); 386 } else { 387 hci_connect_cfm(sco, status); 388 hci_conn_del(sco); 389 } 390 } 391 392 static void hci_conn_timeout(struct work_struct *work) 393 { 394 struct hci_conn *conn = container_of(work, struct hci_conn, 395 disc_work.work); 396 int refcnt = atomic_read(&conn->refcnt); 397 398 BT_DBG("hcon %p state %s", conn, state_to_string(conn->state)); 399 400 WARN_ON(refcnt < 0); 401 402 /* FIXME: It was observed that in pairing failed scenario, refcnt 403 * drops below 0. Probably this is because l2cap_conn_del calls 404 * l2cap_chan_del for each channel, and inside l2cap_chan_del conn is 405 * dropped. After that loop hci_chan_del is called which also drops 406 * conn. For now make sure that ACL is alive if refcnt is higher then 0, 407 * otherwise drop it. 408 */ 409 if (refcnt > 0) 410 return; 411 412 /* LE connections in scanning state need special handling */ 413 if (conn->state == BT_CONNECT && conn->type == LE_LINK && 414 test_bit(HCI_CONN_SCANNING, &conn->flags)) { 415 hci_connect_le_scan_remove(conn); 416 return; 417 } 418 419 hci_abort_conn(conn, hci_proto_disconn_ind(conn)); 420 } 421 422 /* Enter sniff mode */ 423 static void hci_conn_idle(struct work_struct *work) 424 { 425 struct hci_conn *conn = container_of(work, struct hci_conn, 426 idle_work.work); 427 struct hci_dev *hdev = conn->hdev; 428 429 BT_DBG("hcon %p mode %d", conn, conn->mode); 430 431 if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn)) 432 return; 433 434 if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF)) 435 return; 436 437 if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) { 438 struct hci_cp_sniff_subrate cp; 439 cp.handle = cpu_to_le16(conn->handle); 440 cp.max_latency = cpu_to_le16(0); 441 cp.min_remote_timeout = cpu_to_le16(0); 442 cp.min_local_timeout = cpu_to_le16(0); 443 hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp); 444 } 445 446 if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) { 447 struct hci_cp_sniff_mode cp; 448 cp.handle = cpu_to_le16(conn->handle); 449 cp.max_interval = cpu_to_le16(hdev->sniff_max_interval); 450 cp.min_interval = cpu_to_le16(hdev->sniff_min_interval); 451 cp.attempt = cpu_to_le16(4); 452 cp.timeout = cpu_to_le16(1); 453 hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp); 454 } 455 } 456 457 static void hci_conn_auto_accept(struct work_struct *work) 458 { 459 struct hci_conn *conn = container_of(work, struct hci_conn, 460 auto_accept_work.work); 461 462 hci_send_cmd(conn->hdev, HCI_OP_USER_CONFIRM_REPLY, sizeof(conn->dst), 463 &conn->dst); 464 } 465 466 static void le_conn_timeout(struct work_struct *work) 467 { 468 struct hci_conn *conn = container_of(work, struct hci_conn, 469 le_conn_timeout.work); 470 struct hci_dev *hdev = conn->hdev; 471 472 BT_DBG(""); 473 474 /* We could end up here due to having done directed advertising, 475 * so clean up the state if necessary. This should however only 476 * happen with broken hardware or if low duty cycle was used 477 * (which doesn't have a timeout of its own). 478 */ 479 if (conn->role == HCI_ROLE_SLAVE) { 480 u8 enable = 0x00; 481 hci_send_cmd(hdev, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), 482 &enable); 483 hci_le_conn_failed(conn, HCI_ERROR_ADVERTISING_TIMEOUT); 484 return; 485 } 486 487 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM); 488 } 489 490 struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst, 491 u8 role) 492 { 493 struct hci_conn *conn; 494 495 BT_DBG("%s dst %pMR", hdev->name, dst); 496 497 conn = kzalloc(sizeof(*conn), GFP_KERNEL); 498 if (!conn) 499 return NULL; 500 501 bacpy(&conn->dst, dst); 502 bacpy(&conn->src, &hdev->bdaddr); 503 conn->hdev = hdev; 504 conn->type = type; 505 conn->role = role; 506 conn->mode = HCI_CM_ACTIVE; 507 conn->state = BT_OPEN; 508 conn->auth_type = HCI_AT_GENERAL_BONDING; 509 conn->io_capability = hdev->io_capability; 510 conn->remote_auth = 0xff; 511 conn->key_type = 0xff; 512 conn->rssi = HCI_RSSI_INVALID; 513 conn->tx_power = HCI_TX_POWER_INVALID; 514 conn->max_tx_power = HCI_TX_POWER_INVALID; 515 516 set_bit(HCI_CONN_POWER_SAVE, &conn->flags); 517 conn->disc_timeout = HCI_DISCONN_TIMEOUT; 518 519 if (conn->role == HCI_ROLE_MASTER) 520 conn->out = true; 521 522 switch (type) { 523 case ACL_LINK: 524 conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK; 525 break; 526 case LE_LINK: 527 /* conn->src should reflect the local identity address */ 528 hci_copy_identity_address(hdev, &conn->src, &conn->src_type); 529 break; 530 case SCO_LINK: 531 if (lmp_esco_capable(hdev)) 532 conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) | 533 (hdev->esco_type & EDR_ESCO_MASK); 534 else 535 conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK; 536 break; 537 case ESCO_LINK: 538 conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK; 539 break; 540 } 541 542 skb_queue_head_init(&conn->data_q); 543 544 INIT_LIST_HEAD(&conn->chan_list); 545 546 INIT_DELAYED_WORK(&conn->disc_work, hci_conn_timeout); 547 INIT_DELAYED_WORK(&conn->auto_accept_work, hci_conn_auto_accept); 548 INIT_DELAYED_WORK(&conn->idle_work, hci_conn_idle); 549 INIT_DELAYED_WORK(&conn->le_conn_timeout, le_conn_timeout); 550 INIT_WORK(&conn->le_scan_cleanup, le_scan_cleanup); 551 552 atomic_set(&conn->refcnt, 0); 553 554 hci_dev_hold(hdev); 555 556 hci_conn_hash_add(hdev, conn); 557 if (hdev->notify) 558 hdev->notify(hdev, HCI_NOTIFY_CONN_ADD); 559 560 hci_conn_init_sysfs(conn); 561 562 return conn; 563 } 564 565 int hci_conn_del(struct hci_conn *conn) 566 { 567 struct hci_dev *hdev = conn->hdev; 568 569 BT_DBG("%s hcon %p handle %d", hdev->name, conn, conn->handle); 570 571 cancel_delayed_work_sync(&conn->disc_work); 572 cancel_delayed_work_sync(&conn->auto_accept_work); 573 cancel_delayed_work_sync(&conn->idle_work); 574 575 if (conn->type == ACL_LINK) { 576 struct hci_conn *sco = conn->link; 577 if (sco) 578 sco->link = NULL; 579 580 /* Unacked frames */ 581 hdev->acl_cnt += conn->sent; 582 } else if (conn->type == LE_LINK) { 583 cancel_delayed_work(&conn->le_conn_timeout); 584 585 if (hdev->le_pkts) 586 hdev->le_cnt += conn->sent; 587 else 588 hdev->acl_cnt += conn->sent; 589 } else { 590 struct hci_conn *acl = conn->link; 591 if (acl) { 592 acl->link = NULL; 593 hci_conn_drop(acl); 594 } 595 } 596 597 if (conn->amp_mgr) 598 amp_mgr_put(conn->amp_mgr); 599 600 skb_queue_purge(&conn->data_q); 601 602 /* Remove the connection from the list and cleanup its remaining 603 * state. This is a separate function since for some cases like 604 * BT_CONNECT_SCAN we *only* want the cleanup part without the 605 * rest of hci_conn_del. 606 */ 607 hci_conn_cleanup(conn); 608 609 return 0; 610 } 611 612 struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src) 613 { 614 int use_src = bacmp(src, BDADDR_ANY); 615 struct hci_dev *hdev = NULL, *d; 616 617 BT_DBG("%pMR -> %pMR", src, dst); 618 619 read_lock(&hci_dev_list_lock); 620 621 list_for_each_entry(d, &hci_dev_list, list) { 622 if (!test_bit(HCI_UP, &d->flags) || 623 hci_dev_test_flag(d, HCI_USER_CHANNEL) || 624 d->dev_type != HCI_BREDR) 625 continue; 626 627 /* Simple routing: 628 * No source address - find interface with bdaddr != dst 629 * Source address - find interface with bdaddr == src 630 */ 631 632 if (use_src) { 633 if (!bacmp(&d->bdaddr, src)) { 634 hdev = d; break; 635 } 636 } else { 637 if (bacmp(&d->bdaddr, dst)) { 638 hdev = d; break; 639 } 640 } 641 } 642 643 if (hdev) 644 hdev = hci_dev_hold(hdev); 645 646 read_unlock(&hci_dev_list_lock); 647 return hdev; 648 } 649 EXPORT_SYMBOL(hci_get_route); 650 651 /* This function requires the caller holds hdev->lock */ 652 void hci_le_conn_failed(struct hci_conn *conn, u8 status) 653 { 654 struct hci_dev *hdev = conn->hdev; 655 struct hci_conn_params *params; 656 657 params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst, 658 conn->dst_type); 659 if (params && params->conn) { 660 hci_conn_drop(params->conn); 661 hci_conn_put(params->conn); 662 params->conn = NULL; 663 } 664 665 conn->state = BT_CLOSED; 666 667 mgmt_connect_failed(hdev, &conn->dst, conn->type, conn->dst_type, 668 status); 669 670 hci_connect_cfm(conn, status); 671 672 hci_conn_del(conn); 673 674 /* Since we may have temporarily stopped the background scanning in 675 * favor of connection establishment, we should restart it. 676 */ 677 hci_update_background_scan(hdev); 678 679 /* Re-enable advertising in case this was a failed connection 680 * attempt as a peripheral. 681 */ 682 mgmt_reenable_advertising(hdev); 683 } 684 685 static void create_le_conn_complete(struct hci_dev *hdev, u8 status, u16 opcode) 686 { 687 struct hci_conn *conn; 688 689 hci_dev_lock(hdev); 690 691 conn = hci_lookup_le_connect(hdev); 692 693 if (!status) { 694 hci_connect_le_scan_cleanup(conn); 695 goto done; 696 } 697 698 BT_ERR("HCI request failed to create LE connection: status 0x%2.2x", 699 status); 700 701 if (!conn) 702 goto done; 703 704 hci_le_conn_failed(conn, status); 705 706 done: 707 hci_dev_unlock(hdev); 708 } 709 710 static void hci_req_add_le_create_conn(struct hci_request *req, 711 struct hci_conn *conn) 712 { 713 struct hci_cp_le_create_conn cp; 714 struct hci_dev *hdev = conn->hdev; 715 u8 own_addr_type; 716 717 memset(&cp, 0, sizeof(cp)); 718 719 /* Update random address, but set require_privacy to false so 720 * that we never connect with an non-resolvable address. 721 */ 722 if (hci_update_random_address(req, false, &own_addr_type)) 723 return; 724 725 cp.scan_interval = cpu_to_le16(hdev->le_scan_interval); 726 cp.scan_window = cpu_to_le16(hdev->le_scan_window); 727 bacpy(&cp.peer_addr, &conn->dst); 728 cp.peer_addr_type = conn->dst_type; 729 cp.own_address_type = own_addr_type; 730 cp.conn_interval_min = cpu_to_le16(conn->le_conn_min_interval); 731 cp.conn_interval_max = cpu_to_le16(conn->le_conn_max_interval); 732 cp.conn_latency = cpu_to_le16(conn->le_conn_latency); 733 cp.supervision_timeout = cpu_to_le16(conn->le_supv_timeout); 734 cp.min_ce_len = cpu_to_le16(0x0000); 735 cp.max_ce_len = cpu_to_le16(0x0000); 736 737 hci_req_add(req, HCI_OP_LE_CREATE_CONN, sizeof(cp), &cp); 738 739 conn->state = BT_CONNECT; 740 clear_bit(HCI_CONN_SCANNING, &conn->flags); 741 } 742 743 static void hci_req_directed_advertising(struct hci_request *req, 744 struct hci_conn *conn) 745 { 746 struct hci_dev *hdev = req->hdev; 747 struct hci_cp_le_set_adv_param cp; 748 u8 own_addr_type; 749 u8 enable; 750 751 /* Clear the HCI_LE_ADV bit temporarily so that the 752 * hci_update_random_address knows that it's safe to go ahead 753 * and write a new random address. The flag will be set back on 754 * as soon as the SET_ADV_ENABLE HCI command completes. 755 */ 756 hci_dev_clear_flag(hdev, HCI_LE_ADV); 757 758 /* Set require_privacy to false so that the remote device has a 759 * chance of identifying us. 760 */ 761 if (hci_update_random_address(req, false, &own_addr_type) < 0) 762 return; 763 764 memset(&cp, 0, sizeof(cp)); 765 cp.type = LE_ADV_DIRECT_IND; 766 cp.own_address_type = own_addr_type; 767 cp.direct_addr_type = conn->dst_type; 768 bacpy(&cp.direct_addr, &conn->dst); 769 cp.channel_map = hdev->le_adv_channel_map; 770 771 hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp); 772 773 enable = 0x01; 774 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable); 775 776 conn->state = BT_CONNECT; 777 } 778 779 struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst, 780 u8 dst_type, u8 sec_level, u16 conn_timeout, 781 u8 role) 782 { 783 struct hci_conn_params *params; 784 struct hci_conn *conn, *conn_unfinished; 785 struct smp_irk *irk; 786 struct hci_request req; 787 int err; 788 789 /* Let's make sure that le is enabled.*/ 790 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 791 if (lmp_le_capable(hdev)) 792 return ERR_PTR(-ECONNREFUSED); 793 794 return ERR_PTR(-EOPNOTSUPP); 795 } 796 797 /* Some devices send ATT messages as soon as the physical link is 798 * established. To be able to handle these ATT messages, the user- 799 * space first establishes the connection and then starts the pairing 800 * process. 801 * 802 * So if a hci_conn object already exists for the following connection 803 * attempt, we simply update pending_sec_level and auth_type fields 804 * and return the object found. 805 */ 806 conn = hci_conn_hash_lookup_le(hdev, dst, dst_type); 807 conn_unfinished = NULL; 808 if (conn) { 809 if (conn->state == BT_CONNECT && 810 test_bit(HCI_CONN_SCANNING, &conn->flags)) { 811 BT_DBG("will continue unfinished conn %pMR", dst); 812 conn_unfinished = conn; 813 } else { 814 if (conn->pending_sec_level < sec_level) 815 conn->pending_sec_level = sec_level; 816 goto done; 817 } 818 } 819 820 /* Since the controller supports only one LE connection attempt at a 821 * time, we return -EBUSY if there is any connection attempt running. 822 */ 823 if (hci_lookup_le_connect(hdev)) 824 return ERR_PTR(-EBUSY); 825 826 /* When given an identity address with existing identity 827 * resolving key, the connection needs to be established 828 * to a resolvable random address. 829 * 830 * Storing the resolvable random address is required here 831 * to handle connection failures. The address will later 832 * be resolved back into the original identity address 833 * from the connect request. 834 */ 835 irk = hci_find_irk_by_addr(hdev, dst, dst_type); 836 if (irk && bacmp(&irk->rpa, BDADDR_ANY)) { 837 dst = &irk->rpa; 838 dst_type = ADDR_LE_DEV_RANDOM; 839 } 840 841 if (conn_unfinished) { 842 conn = conn_unfinished; 843 bacpy(&conn->dst, dst); 844 } else { 845 conn = hci_conn_add(hdev, LE_LINK, dst, role); 846 } 847 848 if (!conn) 849 return ERR_PTR(-ENOMEM); 850 851 conn->dst_type = dst_type; 852 conn->sec_level = BT_SECURITY_LOW; 853 conn->conn_timeout = conn_timeout; 854 855 if (!conn_unfinished) 856 conn->pending_sec_level = sec_level; 857 858 hci_req_init(&req, hdev); 859 860 /* Disable advertising if we're active. For master role 861 * connections most controllers will refuse to connect if 862 * advertising is enabled, and for slave role connections we 863 * anyway have to disable it in order to start directed 864 * advertising. 865 */ 866 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) { 867 u8 enable = 0x00; 868 hci_req_add(&req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), 869 &enable); 870 } 871 872 /* If requested to connect as slave use directed advertising */ 873 if (conn->role == HCI_ROLE_SLAVE) { 874 /* If we're active scanning most controllers are unable 875 * to initiate advertising. Simply reject the attempt. 876 */ 877 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) && 878 hdev->le_scan_type == LE_SCAN_ACTIVE) { 879 skb_queue_purge(&req.cmd_q); 880 hci_conn_del(conn); 881 return ERR_PTR(-EBUSY); 882 } 883 884 hci_req_directed_advertising(&req, conn); 885 goto create_conn; 886 } 887 888 params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type); 889 if (params) { 890 conn->le_conn_min_interval = params->conn_min_interval; 891 conn->le_conn_max_interval = params->conn_max_interval; 892 conn->le_conn_latency = params->conn_latency; 893 conn->le_supv_timeout = params->supervision_timeout; 894 } else { 895 conn->le_conn_min_interval = hdev->le_conn_min_interval; 896 conn->le_conn_max_interval = hdev->le_conn_max_interval; 897 conn->le_conn_latency = hdev->le_conn_latency; 898 conn->le_supv_timeout = hdev->le_supv_timeout; 899 } 900 901 /* If controller is scanning, we stop it since some controllers are 902 * not able to scan and connect at the same time. Also set the 903 * HCI_LE_SCAN_INTERRUPTED flag so that the command complete 904 * handler for scan disabling knows to set the correct discovery 905 * state. 906 */ 907 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) { 908 hci_req_add_le_scan_disable(&req); 909 hci_dev_set_flag(hdev, HCI_LE_SCAN_INTERRUPTED); 910 } 911 912 hci_req_add_le_create_conn(&req, conn); 913 914 create_conn: 915 err = hci_req_run(&req, create_le_conn_complete); 916 if (err) { 917 hci_conn_del(conn); 918 return ERR_PTR(err); 919 } 920 921 done: 922 /* If this is continuation of connect started by hci_connect_le_scan, 923 * it already called hci_conn_hold and calling it again would mess the 924 * counter. 925 */ 926 if (!conn_unfinished) 927 hci_conn_hold(conn); 928 929 return conn; 930 } 931 932 static void hci_connect_le_scan_complete(struct hci_dev *hdev, u8 status, 933 u16 opcode) 934 { 935 struct hci_conn *conn; 936 937 if (!status) 938 return; 939 940 BT_ERR("Failed to add device to auto conn whitelist: status 0x%2.2x", 941 status); 942 943 hci_dev_lock(hdev); 944 945 conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT); 946 if (conn) 947 hci_le_conn_failed(conn, status); 948 949 hci_dev_unlock(hdev); 950 } 951 952 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type) 953 { 954 struct hci_conn *conn; 955 956 conn = hci_conn_hash_lookup_le(hdev, addr, type); 957 if (!conn) 958 return false; 959 960 if (conn->state != BT_CONNECTED) 961 return false; 962 963 return true; 964 } 965 966 /* This function requires the caller holds hdev->lock */ 967 static int hci_explicit_conn_params_set(struct hci_request *req, 968 bdaddr_t *addr, u8 addr_type) 969 { 970 struct hci_dev *hdev = req->hdev; 971 struct hci_conn_params *params; 972 973 if (is_connected(hdev, addr, addr_type)) 974 return -EISCONN; 975 976 params = hci_conn_params_lookup(hdev, addr, addr_type); 977 if (!params) { 978 params = hci_conn_params_add(hdev, addr, addr_type); 979 if (!params) 980 return -ENOMEM; 981 982 /* If we created new params, mark them to be deleted in 983 * hci_connect_le_scan_cleanup. It's different case than 984 * existing disabled params, those will stay after cleanup. 985 */ 986 params->auto_connect = HCI_AUTO_CONN_EXPLICIT; 987 } 988 989 /* We're trying to connect, so make sure params are at pend_le_conns */ 990 if (params->auto_connect == HCI_AUTO_CONN_DISABLED || 991 params->auto_connect == HCI_AUTO_CONN_REPORT || 992 params->auto_connect == HCI_AUTO_CONN_EXPLICIT) { 993 list_del_init(¶ms->action); 994 list_add(¶ms->action, &hdev->pend_le_conns); 995 } 996 997 params->explicit_connect = true; 998 __hci_update_background_scan(req); 999 1000 BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type, 1001 params->auto_connect); 1002 1003 return 0; 1004 } 1005 1006 /* This function requires the caller holds hdev->lock */ 1007 struct hci_conn *hci_connect_le_scan(struct hci_dev *hdev, bdaddr_t *dst, 1008 u8 dst_type, u8 sec_level, 1009 u16 conn_timeout, u8 role) 1010 { 1011 struct hci_conn *conn; 1012 struct hci_request req; 1013 int err; 1014 1015 /* Let's make sure that le is enabled.*/ 1016 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 1017 if (lmp_le_capable(hdev)) 1018 return ERR_PTR(-ECONNREFUSED); 1019 1020 return ERR_PTR(-EOPNOTSUPP); 1021 } 1022 1023 /* Some devices send ATT messages as soon as the physical link is 1024 * established. To be able to handle these ATT messages, the user- 1025 * space first establishes the connection and then starts the pairing 1026 * process. 1027 * 1028 * So if a hci_conn object already exists for the following connection 1029 * attempt, we simply update pending_sec_level and auth_type fields 1030 * and return the object found. 1031 */ 1032 conn = hci_conn_hash_lookup_le(hdev, dst, dst_type); 1033 if (conn) { 1034 if (conn->pending_sec_level < sec_level) 1035 conn->pending_sec_level = sec_level; 1036 goto done; 1037 } 1038 1039 BT_DBG("requesting refresh of dst_addr"); 1040 1041 conn = hci_conn_add(hdev, LE_LINK, dst, role); 1042 if (!conn) 1043 return ERR_PTR(-ENOMEM); 1044 1045 hci_req_init(&req, hdev); 1046 1047 if (hci_explicit_conn_params_set(&req, dst, dst_type) < 0) 1048 return ERR_PTR(-EBUSY); 1049 1050 conn->state = BT_CONNECT; 1051 set_bit(HCI_CONN_SCANNING, &conn->flags); 1052 1053 err = hci_req_run(&req, hci_connect_le_scan_complete); 1054 if (err && err != -ENODATA) { 1055 hci_conn_del(conn); 1056 return ERR_PTR(err); 1057 } 1058 1059 conn->dst_type = dst_type; 1060 conn->sec_level = BT_SECURITY_LOW; 1061 conn->pending_sec_level = sec_level; 1062 conn->conn_timeout = conn_timeout; 1063 1064 done: 1065 hci_conn_hold(conn); 1066 return conn; 1067 } 1068 1069 struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst, 1070 u8 sec_level, u8 auth_type) 1071 { 1072 struct hci_conn *acl; 1073 1074 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 1075 if (lmp_bredr_capable(hdev)) 1076 return ERR_PTR(-ECONNREFUSED); 1077 1078 return ERR_PTR(-EOPNOTSUPP); 1079 } 1080 1081 acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst); 1082 if (!acl) { 1083 acl = hci_conn_add(hdev, ACL_LINK, dst, HCI_ROLE_MASTER); 1084 if (!acl) 1085 return ERR_PTR(-ENOMEM); 1086 } 1087 1088 hci_conn_hold(acl); 1089 1090 if (acl->state == BT_OPEN || acl->state == BT_CLOSED) { 1091 acl->sec_level = BT_SECURITY_LOW; 1092 acl->pending_sec_level = sec_level; 1093 acl->auth_type = auth_type; 1094 hci_acl_create_connection(acl); 1095 } 1096 1097 return acl; 1098 } 1099 1100 struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type, bdaddr_t *dst, 1101 __u16 setting) 1102 { 1103 struct hci_conn *acl; 1104 struct hci_conn *sco; 1105 1106 acl = hci_connect_acl(hdev, dst, BT_SECURITY_LOW, HCI_AT_NO_BONDING); 1107 if (IS_ERR(acl)) 1108 return acl; 1109 1110 sco = hci_conn_hash_lookup_ba(hdev, type, dst); 1111 if (!sco) { 1112 sco = hci_conn_add(hdev, type, dst, HCI_ROLE_MASTER); 1113 if (!sco) { 1114 hci_conn_drop(acl); 1115 return ERR_PTR(-ENOMEM); 1116 } 1117 } 1118 1119 acl->link = sco; 1120 sco->link = acl; 1121 1122 hci_conn_hold(sco); 1123 1124 sco->setting = setting; 1125 1126 if (acl->state == BT_CONNECTED && 1127 (sco->state == BT_OPEN || sco->state == BT_CLOSED)) { 1128 set_bit(HCI_CONN_POWER_SAVE, &acl->flags); 1129 hci_conn_enter_active_mode(acl, BT_POWER_FORCE_ACTIVE_ON); 1130 1131 if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->flags)) { 1132 /* defer SCO setup until mode change completed */ 1133 set_bit(HCI_CONN_SCO_SETUP_PEND, &acl->flags); 1134 return sco; 1135 } 1136 1137 hci_sco_setup(acl, 0x00); 1138 } 1139 1140 return sco; 1141 } 1142 1143 /* Check link security requirement */ 1144 int hci_conn_check_link_mode(struct hci_conn *conn) 1145 { 1146 BT_DBG("hcon %p", conn); 1147 1148 /* In Secure Connections Only mode, it is required that Secure 1149 * Connections is used and the link is encrypted with AES-CCM 1150 * using a P-256 authenticated combination key. 1151 */ 1152 if (hci_dev_test_flag(conn->hdev, HCI_SC_ONLY)) { 1153 if (!hci_conn_sc_enabled(conn) || 1154 !test_bit(HCI_CONN_AES_CCM, &conn->flags) || 1155 conn->key_type != HCI_LK_AUTH_COMBINATION_P256) 1156 return 0; 1157 } 1158 1159 if (hci_conn_ssp_enabled(conn) && 1160 !test_bit(HCI_CONN_ENCRYPT, &conn->flags)) 1161 return 0; 1162 1163 return 1; 1164 } 1165 1166 /* Authenticate remote device */ 1167 static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type) 1168 { 1169 BT_DBG("hcon %p", conn); 1170 1171 if (conn->pending_sec_level > sec_level) 1172 sec_level = conn->pending_sec_level; 1173 1174 if (sec_level > conn->sec_level) 1175 conn->pending_sec_level = sec_level; 1176 else if (test_bit(HCI_CONN_AUTH, &conn->flags)) 1177 return 1; 1178 1179 /* Make sure we preserve an existing MITM requirement*/ 1180 auth_type |= (conn->auth_type & 0x01); 1181 1182 conn->auth_type = auth_type; 1183 1184 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) { 1185 struct hci_cp_auth_requested cp; 1186 1187 cp.handle = cpu_to_le16(conn->handle); 1188 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED, 1189 sizeof(cp), &cp); 1190 1191 /* If we're already encrypted set the REAUTH_PEND flag, 1192 * otherwise set the ENCRYPT_PEND. 1193 */ 1194 if (test_bit(HCI_CONN_ENCRYPT, &conn->flags)) 1195 set_bit(HCI_CONN_REAUTH_PEND, &conn->flags); 1196 else 1197 set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags); 1198 } 1199 1200 return 0; 1201 } 1202 1203 /* Encrypt the the link */ 1204 static void hci_conn_encrypt(struct hci_conn *conn) 1205 { 1206 BT_DBG("hcon %p", conn); 1207 1208 if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) { 1209 struct hci_cp_set_conn_encrypt cp; 1210 cp.handle = cpu_to_le16(conn->handle); 1211 cp.encrypt = 0x01; 1212 hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp), 1213 &cp); 1214 } 1215 } 1216 1217 /* Enable security */ 1218 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type, 1219 bool initiator) 1220 { 1221 BT_DBG("hcon %p", conn); 1222 1223 if (conn->type == LE_LINK) 1224 return smp_conn_security(conn, sec_level); 1225 1226 /* For sdp we don't need the link key. */ 1227 if (sec_level == BT_SECURITY_SDP) 1228 return 1; 1229 1230 /* For non 2.1 devices and low security level we don't need the link 1231 key. */ 1232 if (sec_level == BT_SECURITY_LOW && !hci_conn_ssp_enabled(conn)) 1233 return 1; 1234 1235 /* For other security levels we need the link key. */ 1236 if (!test_bit(HCI_CONN_AUTH, &conn->flags)) 1237 goto auth; 1238 1239 /* An authenticated FIPS approved combination key has sufficient 1240 * security for security level 4. */ 1241 if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256 && 1242 sec_level == BT_SECURITY_FIPS) 1243 goto encrypt; 1244 1245 /* An authenticated combination key has sufficient security for 1246 security level 3. */ 1247 if ((conn->key_type == HCI_LK_AUTH_COMBINATION_P192 || 1248 conn->key_type == HCI_LK_AUTH_COMBINATION_P256) && 1249 sec_level == BT_SECURITY_HIGH) 1250 goto encrypt; 1251 1252 /* An unauthenticated combination key has sufficient security for 1253 security level 1 and 2. */ 1254 if ((conn->key_type == HCI_LK_UNAUTH_COMBINATION_P192 || 1255 conn->key_type == HCI_LK_UNAUTH_COMBINATION_P256) && 1256 (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW)) 1257 goto encrypt; 1258 1259 /* A combination key has always sufficient security for the security 1260 levels 1 or 2. High security level requires the combination key 1261 is generated using maximum PIN code length (16). 1262 For pre 2.1 units. */ 1263 if (conn->key_type == HCI_LK_COMBINATION && 1264 (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW || 1265 conn->pin_length == 16)) 1266 goto encrypt; 1267 1268 auth: 1269 if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) 1270 return 0; 1271 1272 if (initiator) 1273 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags); 1274 1275 if (!hci_conn_auth(conn, sec_level, auth_type)) 1276 return 0; 1277 1278 encrypt: 1279 if (test_bit(HCI_CONN_ENCRYPT, &conn->flags)) 1280 return 1; 1281 1282 hci_conn_encrypt(conn); 1283 return 0; 1284 } 1285 EXPORT_SYMBOL(hci_conn_security); 1286 1287 /* Check secure link requirement */ 1288 int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level) 1289 { 1290 BT_DBG("hcon %p", conn); 1291 1292 /* Accept if non-secure or higher security level is required */ 1293 if (sec_level != BT_SECURITY_HIGH && sec_level != BT_SECURITY_FIPS) 1294 return 1; 1295 1296 /* Accept if secure or higher security level is already present */ 1297 if (conn->sec_level == BT_SECURITY_HIGH || 1298 conn->sec_level == BT_SECURITY_FIPS) 1299 return 1; 1300 1301 /* Reject not secure link */ 1302 return 0; 1303 } 1304 EXPORT_SYMBOL(hci_conn_check_secure); 1305 1306 /* Switch role */ 1307 int hci_conn_switch_role(struct hci_conn *conn, __u8 role) 1308 { 1309 BT_DBG("hcon %p", conn); 1310 1311 if (role == conn->role) 1312 return 1; 1313 1314 if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->flags)) { 1315 struct hci_cp_switch_role cp; 1316 bacpy(&cp.bdaddr, &conn->dst); 1317 cp.role = role; 1318 hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp); 1319 } 1320 1321 return 0; 1322 } 1323 EXPORT_SYMBOL(hci_conn_switch_role); 1324 1325 /* Enter active mode */ 1326 void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active) 1327 { 1328 struct hci_dev *hdev = conn->hdev; 1329 1330 BT_DBG("hcon %p mode %d", conn, conn->mode); 1331 1332 if (conn->mode != HCI_CM_SNIFF) 1333 goto timer; 1334 1335 if (!test_bit(HCI_CONN_POWER_SAVE, &conn->flags) && !force_active) 1336 goto timer; 1337 1338 if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) { 1339 struct hci_cp_exit_sniff_mode cp; 1340 cp.handle = cpu_to_le16(conn->handle); 1341 hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp); 1342 } 1343 1344 timer: 1345 if (hdev->idle_timeout > 0) 1346 queue_delayed_work(hdev->workqueue, &conn->idle_work, 1347 msecs_to_jiffies(hdev->idle_timeout)); 1348 } 1349 1350 /* Drop all connection on the device */ 1351 void hci_conn_hash_flush(struct hci_dev *hdev) 1352 { 1353 struct hci_conn_hash *h = &hdev->conn_hash; 1354 struct hci_conn *c, *n; 1355 1356 BT_DBG("hdev %s", hdev->name); 1357 1358 list_for_each_entry_safe(c, n, &h->list, list) { 1359 c->state = BT_CLOSED; 1360 1361 hci_disconn_cfm(c, HCI_ERROR_LOCAL_HOST_TERM); 1362 hci_conn_del(c); 1363 } 1364 } 1365 1366 /* Check pending connect attempts */ 1367 void hci_conn_check_pending(struct hci_dev *hdev) 1368 { 1369 struct hci_conn *conn; 1370 1371 BT_DBG("hdev %s", hdev->name); 1372 1373 hci_dev_lock(hdev); 1374 1375 conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2); 1376 if (conn) 1377 hci_acl_create_connection(conn); 1378 1379 hci_dev_unlock(hdev); 1380 } 1381 1382 static u32 get_link_mode(struct hci_conn *conn) 1383 { 1384 u32 link_mode = 0; 1385 1386 if (conn->role == HCI_ROLE_MASTER) 1387 link_mode |= HCI_LM_MASTER; 1388 1389 if (test_bit(HCI_CONN_ENCRYPT, &conn->flags)) 1390 link_mode |= HCI_LM_ENCRYPT; 1391 1392 if (test_bit(HCI_CONN_AUTH, &conn->flags)) 1393 link_mode |= HCI_LM_AUTH; 1394 1395 if (test_bit(HCI_CONN_SECURE, &conn->flags)) 1396 link_mode |= HCI_LM_SECURE; 1397 1398 if (test_bit(HCI_CONN_FIPS, &conn->flags)) 1399 link_mode |= HCI_LM_FIPS; 1400 1401 return link_mode; 1402 } 1403 1404 int hci_get_conn_list(void __user *arg) 1405 { 1406 struct hci_conn *c; 1407 struct hci_conn_list_req req, *cl; 1408 struct hci_conn_info *ci; 1409 struct hci_dev *hdev; 1410 int n = 0, size, err; 1411 1412 if (copy_from_user(&req, arg, sizeof(req))) 1413 return -EFAULT; 1414 1415 if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci)) 1416 return -EINVAL; 1417 1418 size = sizeof(req) + req.conn_num * sizeof(*ci); 1419 1420 cl = kmalloc(size, GFP_KERNEL); 1421 if (!cl) 1422 return -ENOMEM; 1423 1424 hdev = hci_dev_get(req.dev_id); 1425 if (!hdev) { 1426 kfree(cl); 1427 return -ENODEV; 1428 } 1429 1430 ci = cl->conn_info; 1431 1432 hci_dev_lock(hdev); 1433 list_for_each_entry(c, &hdev->conn_hash.list, list) { 1434 bacpy(&(ci + n)->bdaddr, &c->dst); 1435 (ci + n)->handle = c->handle; 1436 (ci + n)->type = c->type; 1437 (ci + n)->out = c->out; 1438 (ci + n)->state = c->state; 1439 (ci + n)->link_mode = get_link_mode(c); 1440 if (++n >= req.conn_num) 1441 break; 1442 } 1443 hci_dev_unlock(hdev); 1444 1445 cl->dev_id = hdev->id; 1446 cl->conn_num = n; 1447 size = sizeof(req) + n * sizeof(*ci); 1448 1449 hci_dev_put(hdev); 1450 1451 err = copy_to_user(arg, cl, size); 1452 kfree(cl); 1453 1454 return err ? -EFAULT : 0; 1455 } 1456 1457 int hci_get_conn_info(struct hci_dev *hdev, void __user *arg) 1458 { 1459 struct hci_conn_info_req req; 1460 struct hci_conn_info ci; 1461 struct hci_conn *conn; 1462 char __user *ptr = arg + sizeof(req); 1463 1464 if (copy_from_user(&req, arg, sizeof(req))) 1465 return -EFAULT; 1466 1467 hci_dev_lock(hdev); 1468 conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr); 1469 if (conn) { 1470 bacpy(&ci.bdaddr, &conn->dst); 1471 ci.handle = conn->handle; 1472 ci.type = conn->type; 1473 ci.out = conn->out; 1474 ci.state = conn->state; 1475 ci.link_mode = get_link_mode(conn); 1476 } 1477 hci_dev_unlock(hdev); 1478 1479 if (!conn) 1480 return -ENOENT; 1481 1482 return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0; 1483 } 1484 1485 int hci_get_auth_info(struct hci_dev *hdev, void __user *arg) 1486 { 1487 struct hci_auth_info_req req; 1488 struct hci_conn *conn; 1489 1490 if (copy_from_user(&req, arg, sizeof(req))) 1491 return -EFAULT; 1492 1493 hci_dev_lock(hdev); 1494 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr); 1495 if (conn) 1496 req.type = conn->auth_type; 1497 hci_dev_unlock(hdev); 1498 1499 if (!conn) 1500 return -ENOENT; 1501 1502 return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0; 1503 } 1504 1505 struct hci_chan *hci_chan_create(struct hci_conn *conn) 1506 { 1507 struct hci_dev *hdev = conn->hdev; 1508 struct hci_chan *chan; 1509 1510 BT_DBG("%s hcon %p", hdev->name, conn); 1511 1512 if (test_bit(HCI_CONN_DROP, &conn->flags)) { 1513 BT_DBG("Refusing to create new hci_chan"); 1514 return NULL; 1515 } 1516 1517 chan = kzalloc(sizeof(*chan), GFP_KERNEL); 1518 if (!chan) 1519 return NULL; 1520 1521 chan->conn = hci_conn_get(conn); 1522 skb_queue_head_init(&chan->data_q); 1523 chan->state = BT_CONNECTED; 1524 1525 list_add_rcu(&chan->list, &conn->chan_list); 1526 1527 return chan; 1528 } 1529 1530 void hci_chan_del(struct hci_chan *chan) 1531 { 1532 struct hci_conn *conn = chan->conn; 1533 struct hci_dev *hdev = conn->hdev; 1534 1535 BT_DBG("%s hcon %p chan %p", hdev->name, conn, chan); 1536 1537 list_del_rcu(&chan->list); 1538 1539 synchronize_rcu(); 1540 1541 /* Prevent new hci_chan's to be created for this hci_conn */ 1542 set_bit(HCI_CONN_DROP, &conn->flags); 1543 1544 hci_conn_put(conn); 1545 1546 skb_queue_purge(&chan->data_q); 1547 kfree(chan); 1548 } 1549 1550 void hci_chan_list_flush(struct hci_conn *conn) 1551 { 1552 struct hci_chan *chan, *n; 1553 1554 BT_DBG("hcon %p", conn); 1555 1556 list_for_each_entry_safe(chan, n, &conn->chan_list, list) 1557 hci_chan_del(chan); 1558 } 1559 1560 static struct hci_chan *__hci_chan_lookup_handle(struct hci_conn *hcon, 1561 __u16 handle) 1562 { 1563 struct hci_chan *hchan; 1564 1565 list_for_each_entry(hchan, &hcon->chan_list, list) { 1566 if (hchan->handle == handle) 1567 return hchan; 1568 } 1569 1570 return NULL; 1571 } 1572 1573 struct hci_chan *hci_chan_lookup_handle(struct hci_dev *hdev, __u16 handle) 1574 { 1575 struct hci_conn_hash *h = &hdev->conn_hash; 1576 struct hci_conn *hcon; 1577 struct hci_chan *hchan = NULL; 1578 1579 rcu_read_lock(); 1580 1581 list_for_each_entry_rcu(hcon, &h->list, list) { 1582 hchan = __hci_chan_lookup_handle(hcon, handle); 1583 if (hchan) 1584 break; 1585 } 1586 1587 rcu_read_unlock(); 1588 1589 return hchan; 1590 } 1591