hci_conn.c 26.3 KB
Newer Older
1
/*
L
Linus Torvalds 已提交
2
   BlueZ - Bluetooth protocol stack for Linux
3
   Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
L
Linus Torvalds 已提交
4 5 6 7 8 9 10 11 12 13 14

   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>

   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License version 2 as
   published by the Free Software Foundation;

   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 16 17
   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
L
Linus Torvalds 已提交
18 19
   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

20 21
   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
L
Linus Torvalds 已提交
22 23 24 25 26
   SOFTWARE IS DISCLAIMED.
*/

/* Bluetooth HCI connection handling. */

27
#include <linux/export.h>
L
Linus Torvalds 已提交
28 29 30 31

#include <net/bluetooth/bluetooth.h>
#include <net/bluetooth/hci_core.h>

32
#include "smp.h"
33 34
#include "a2mp.h"

35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52
struct sco_param {
	u16 pkt_type;
	u16 max_latency;
};

static const struct sco_param sco_param_cvsd[] = {
	{ EDR_ESCO_MASK & ~ESCO_2EV3, 0x000a }, /* S3 */
	{ EDR_ESCO_MASK & ~ESCO_2EV3, 0x0007 }, /* S2 */
	{ EDR_ESCO_MASK | ESCO_EV3,   0x0007 }, /* S1 */
	{ EDR_ESCO_MASK | ESCO_HV3,   0xffff }, /* D1 */
	{ EDR_ESCO_MASK | ESCO_HV1,   0xffff }, /* D0 */
};

static const struct sco_param sco_param_wideband[] = {
	{ EDR_ESCO_MASK & ~ESCO_2EV3, 0x000d }, /* T2 */
	{ EDR_ESCO_MASK | ESCO_EV3,   0x0008 }, /* T1 */
};

53
static void hci_le_create_connection_cancel(struct hci_conn *conn)
V
Ville Tervo 已提交
54 55 56 57
{
	hci_send_cmd(conn->hdev, HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL);
}

58
static void hci_acl_create_connection(struct hci_conn *conn)
L
Linus Torvalds 已提交
59 60 61 62 63
{
	struct hci_dev *hdev = conn->hdev;
	struct inquiry_entry *ie;
	struct hci_cp_create_conn cp;

64
	BT_DBG("hcon %p", conn);
L
Linus Torvalds 已提交
65 66

	conn->state = BT_CONNECT;
67
	conn->out = true;
68

L
Linus Torvalds 已提交
69 70
	conn->link_mode = HCI_LM_MASTER;

71 72
	conn->attempt++;

73 74
	conn->link_policy = hdev->link_policy;

L
Linus Torvalds 已提交
75 76 77 78
	memset(&cp, 0, sizeof(cp));
	bacpy(&cp.bdaddr, &conn->dst);
	cp.pscan_rep_mode = 0x02;

A
Andrei Emeltchenko 已提交
79 80
	ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
	if (ie) {
81 82 83 84
		if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
			cp.pscan_rep_mode = ie->data.pscan_rep_mode;
			cp.pscan_mode     = ie->data.pscan_mode;
			cp.clock_offset   = ie->data.clock_offset |
85
					    __constant_cpu_to_le16(0x8000);
86 87
		}

L
Linus Torvalds 已提交
88
		memcpy(conn->dev_class, ie->data.dev_class, 3);
89 90
		if (ie->data.ssp_mode > 0)
			set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
L
Linus Torvalds 已提交
91 92
	}

93
	cp.pkt_type = cpu_to_le16(conn->pkt_type);
L
Linus Torvalds 已提交
94
	if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
95
		cp.role_switch = 0x01;
L
Linus Torvalds 已提交
96
	else
97
		cp.role_switch = 0x00;
98

99
	hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
L
Linus Torvalds 已提交
100 101
}

102
static void hci_acl_create_connection_cancel(struct hci_conn *conn)
103 104 105
{
	struct hci_cp_create_conn_cancel cp;

106
	BT_DBG("hcon %p", conn);
107

108
	if (conn->hdev->hci_ver < BLUETOOTH_VER_1_2)
109 110 111
		return;

	bacpy(&cp.bdaddr, &conn->dst);
112
	hci_send_cmd(conn->hdev, HCI_OP_CREATE_CONN_CANCEL, sizeof(cp), &cp);
113 114
}

115 116 117 118 119 120 121 122 123 124
static void hci_reject_sco(struct hci_conn *conn)
{
	struct hci_cp_reject_sync_conn_req cp;

	cp.reason = HCI_ERROR_REMOTE_USER_TERM;
	bacpy(&cp.bdaddr, &conn->dst);

	hci_send_cmd(conn->hdev, HCI_OP_REJECT_SYNC_CONN_REQ, sizeof(cp), &cp);
}

A
Andre Guedes 已提交
125
void hci_disconnect(struct hci_conn *conn, __u8 reason)
L
Linus Torvalds 已提交
126 127 128
{
	struct hci_cp_disconnect cp;

129
	BT_DBG("hcon %p", conn);
L
Linus Torvalds 已提交
130 131 132

	conn->state = BT_DISCONN;

133
	cp.handle = cpu_to_le16(conn->handle);
L
Linus Torvalds 已提交
134
	cp.reason = reason;
135
	hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp);
L
Linus Torvalds 已提交
136 137
}

138 139 140 141 142 143 144 145 146 147 148 149 150 151
static void hci_amp_disconn(struct hci_conn *conn, __u8 reason)
{
	struct hci_cp_disconn_phy_link cp;

	BT_DBG("hcon %p", conn);

	conn->state = BT_DISCONN;

	cp.phy_handle = HCI_PHY_HANDLE(conn->handle);
	cp.reason = reason;
	hci_send_cmd(conn->hdev, HCI_OP_DISCONN_PHY_LINK,
		     sizeof(cp), &cp);
}

152
static void hci_add_sco(struct hci_conn *conn, __u16 handle)
L
Linus Torvalds 已提交
153 154 155 156
{
	struct hci_dev *hdev = conn->hdev;
	struct hci_cp_add_sco cp;

157
	BT_DBG("hcon %p", conn);
L
Linus Torvalds 已提交
158 159

	conn->state = BT_CONNECT;
160
	conn->out = true;
L
Linus Torvalds 已提交
161

162 163
	conn->attempt++;

164
	cp.handle   = cpu_to_le16(handle);
165
	cp.pkt_type = cpu_to_le16(conn->pkt_type);
L
Linus Torvalds 已提交
166

167
	hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
L
Linus Torvalds 已提交
168 169
}

170
bool hci_setup_sync(struct hci_conn *conn, __u16 handle)
171 172 173
{
	struct hci_dev *hdev = conn->hdev;
	struct hci_cp_setup_sync_conn cp;
174
	const struct sco_param *param;
175

176
	BT_DBG("hcon %p", conn);
177 178

	conn->state = BT_CONNECT;
179
	conn->out = true;
180

181 182
	conn->attempt++;

183 184
	cp.handle   = cpu_to_le16(handle);

185 186
	cp.tx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
	cp.rx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
187 188 189 190
	cp.voice_setting  = cpu_to_le16(conn->setting);

	switch (conn->setting & SCO_AIRMODE_MASK) {
	case SCO_AIRMODE_TRANSP:
191 192
		if (conn->attempt > ARRAY_SIZE(sco_param_wideband))
			return false;
193
		cp.retrans_effort = 0x02;
194
		param = &sco_param_wideband[conn->attempt - 1];
195 196
		break;
	case SCO_AIRMODE_CVSD:
197 198 199 200
		if (conn->attempt > ARRAY_SIZE(sco_param_cvsd))
			return false;
		cp.retrans_effort = 0x01;
		param = &sco_param_cvsd[conn->attempt - 1];
201
		break;
202 203
	default:
		return false;
204
	}
205

206 207 208 209 210 211 212
	cp.pkt_type = __cpu_to_le16(param->pkt_type);
	cp.max_latency = __cpu_to_le16(param->max_latency);

	if (hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp) < 0)
		return false;

	return true;
213 214
}

215
void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max,
216
			u16 latency, u16 to_multiplier)
217 218 219 220 221 222 223 224 225 226 227
{
	struct hci_cp_le_conn_update cp;
	struct hci_dev *hdev = conn->hdev;

	memset(&cp, 0, sizeof(cp));

	cp.handle		= cpu_to_le16(conn->handle);
	cp.conn_interval_min	= cpu_to_le16(min);
	cp.conn_interval_max	= cpu_to_le16(max);
	cp.conn_latency		= cpu_to_le16(latency);
	cp.supervision_timeout	= cpu_to_le16(to_multiplier);
228 229
	cp.min_ce_len		= __constant_cpu_to_le16(0x0001);
	cp.max_ce_len		= __constant_cpu_to_le16(0x0001);
230 231 232 233

	hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp);
}

234
void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __u8 rand[8],
235
		      __u8 ltk[16])
236 237 238 239
{
	struct hci_dev *hdev = conn->hdev;
	struct hci_cp_le_start_enc cp;

240
	BT_DBG("hcon %p", conn);
241 242 243 244 245 246

	memset(&cp, 0, sizeof(cp));

	cp.handle = cpu_to_le16(conn->handle);
	memcpy(cp.ltk, ltk, sizeof(cp.ltk));
	cp.ediv = ediv;
247
	memcpy(cp.rand, rand, sizeof(cp.rand));
248 249 250 251

	hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp);
}

252 253 254 255 256 257 258 259
/* Device _must_ be locked */
void hci_sco_setup(struct hci_conn *conn, __u8 status)
{
	struct hci_conn *sco = conn->link;

	if (!sco)
		return;

260 261
	BT_DBG("hcon %p", conn);

262 263 264 265 266 267 268 269 270 271 272
	if (!status) {
		if (lmp_esco_capable(conn->hdev))
			hci_setup_sync(sco, conn->handle);
		else
			hci_add_sco(sco, conn->handle);
	} else {
		hci_proto_connect_cfm(sco, status);
		hci_conn_del(sco);
	}
}

273 274 275 276 277 278 279 280
static void hci_conn_disconnect(struct hci_conn *conn)
{
	__u8 reason = hci_proto_disconn_ind(conn);

	switch (conn->type) {
	case AMP_LINK:
		hci_amp_disconn(conn, reason);
		break;
281
	default:
A
Andre Guedes 已提交
282
		hci_disconnect(conn, reason);
283
		break;
284 285 286
	}
}

287
static void hci_conn_timeout(struct work_struct *work)
L
Linus Torvalds 已提交
288
{
289
	struct hci_conn *conn = container_of(work, struct hci_conn,
290
					     disc_work.work);
L
Linus Torvalds 已提交
291

292
	BT_DBG("hcon %p state %s", conn, state_to_string(conn->state));
L
Linus Torvalds 已提交
293 294 295 296

	if (atomic_read(&conn->refcnt))
		return;

297 298
	switch (conn->state) {
	case BT_CONNECT:
299
	case BT_CONNECT2:
V
Ville Tervo 已提交
300 301
		if (conn->out) {
			if (conn->type == ACL_LINK)
302
				hci_acl_create_connection_cancel(conn);
V
Ville Tervo 已提交
303
			else if (conn->type == LE_LINK)
304
				hci_le_create_connection_cancel(conn);
305 306
		} else if (conn->type == SCO_LINK || conn->type == ESCO_LINK) {
			hci_reject_sco(conn);
V
Ville Tervo 已提交
307
		}
308
		break;
309
	case BT_CONFIG:
310
	case BT_CONNECTED:
311
		hci_conn_disconnect(conn);
312 313
		break;
	default:
L
Linus Torvalds 已提交
314
		conn->state = BT_CLOSED;
315 316
		break;
	}
L
Linus Torvalds 已提交
317 318
}

319
/* Enter sniff mode */
320
static void hci_conn_idle(struct work_struct *work)
321
{
322 323
	struct hci_conn *conn = container_of(work, struct hci_conn,
					     idle_work.work);
324 325
	struct hci_dev *hdev = conn->hdev;

326
	BT_DBG("hcon %p mode %d", conn, conn->mode);
327 328 329 330 331 332 333 334 335 336 337 338 339

	if (test_bit(HCI_RAW, &hdev->flags))
		return;

	if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn))
		return;

	if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF))
		return;

	if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
		struct hci_cp_sniff_subrate cp;
		cp.handle             = cpu_to_le16(conn->handle);
340 341 342
		cp.max_latency        = __constant_cpu_to_le16(0);
		cp.min_remote_timeout = __constant_cpu_to_le16(0);
		cp.min_local_timeout  = __constant_cpu_to_le16(0);
343 344 345
		hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
	}

346
	if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
347 348 349 350
		struct hci_cp_sniff_mode cp;
		cp.handle       = cpu_to_le16(conn->handle);
		cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
		cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
351 352
		cp.attempt      = __constant_cpu_to_le16(4);
		cp.timeout      = __constant_cpu_to_le16(1);
353 354 355 356
		hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
	}
}

357
static void hci_conn_auto_accept(struct work_struct *work)
358
{
359 360
	struct hci_conn *conn = container_of(work, struct hci_conn,
					     auto_accept_work.work);
361

362
	hci_send_cmd(conn->hdev, HCI_OP_USER_CONFIRM_REPLY, sizeof(conn->dst),
363
		     &conn->dst);
364 365
}

L
Linus Torvalds 已提交
366 367 368 369
struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
{
	struct hci_conn *conn;

370
	BT_DBG("%s dst %pMR", hdev->name, dst);
L
Linus Torvalds 已提交
371

372
	conn = kzalloc(sizeof(struct hci_conn), GFP_KERNEL);
373
	if (!conn)
L
Linus Torvalds 已提交
374 375 376
		return NULL;

	bacpy(&conn->dst, dst);
377
	bacpy(&conn->src, &hdev->bdaddr);
378 379 380 381
	conn->hdev  = hdev;
	conn->type  = type;
	conn->mode  = HCI_CM_ACTIVE;
	conn->state = BT_OPEN;
382
	conn->auth_type = HCI_AT_GENERAL_BONDING;
383
	conn->io_capability = hdev->io_capability;
384
	conn->remote_auth = 0xff;
385
	conn->key_type = 0xff;
L
Linus Torvalds 已提交
386

387
	set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
388
	conn->disc_timeout = HCI_DISCONN_TIMEOUT;
389

390 391 392 393 394 395
	switch (type) {
	case ACL_LINK:
		conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
		break;
	case SCO_LINK:
		if (lmp_esco_capable(hdev))
396 397
			conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
					(hdev->esco_type & EDR_ESCO_MASK);
398 399 400 401
		else
			conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
		break;
	case ESCO_LINK:
402
		conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
403 404 405
		break;
	}

L
Linus Torvalds 已提交
406
	skb_queue_head_init(&conn->data_q);
407

408
	INIT_LIST_HEAD(&conn->chan_list);
409

410
	INIT_DELAYED_WORK(&conn->disc_work, hci_conn_timeout);
411
	INIT_DELAYED_WORK(&conn->auto_accept_work, hci_conn_auto_accept);
412
	INIT_DELAYED_WORK(&conn->idle_work, hci_conn_idle);
L
Linus Torvalds 已提交
413 414 415 416 417 418

	atomic_set(&conn->refcnt, 0);

	hci_dev_hold(hdev);

	hci_conn_hash_add(hdev, conn);
419
	if (hdev->notify)
L
Linus Torvalds 已提交
420 421
		hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);

422 423
	hci_conn_init_sysfs(conn);

L
Linus Torvalds 已提交
424 425 426 427 428 429 430
	return conn;
}

int hci_conn_del(struct hci_conn *conn)
{
	struct hci_dev *hdev = conn->hdev;

431
	BT_DBG("%s hcon %p handle %d", hdev->name, conn, conn->handle);
L
Linus Torvalds 已提交
432

433
	cancel_delayed_work_sync(&conn->disc_work);
434
	cancel_delayed_work_sync(&conn->auto_accept_work);
435
	cancel_delayed_work_sync(&conn->idle_work);
436

437
	if (conn->type == ACL_LINK) {
L
Linus Torvalds 已提交
438 439 440 441 442 443
		struct hci_conn *sco = conn->link;
		if (sco)
			sco->link = NULL;

		/* Unacked frames */
		hdev->acl_cnt += conn->sent;
444 445 446 447 448
	} else if (conn->type == LE_LINK) {
		if (hdev->le_pkts)
			hdev->le_cnt += conn->sent;
		else
			hdev->acl_cnt += conn->sent;
449 450 451 452
	} else {
		struct hci_conn *acl = conn->link;
		if (acl) {
			acl->link = NULL;
453
			hci_conn_drop(acl);
454
		}
L
Linus Torvalds 已提交
455 456
	}

457
	hci_chan_list_flush(conn);
458

459 460 461
	if (conn->amp_mgr)
		amp_mgr_put(conn->amp_mgr);

L
Linus Torvalds 已提交
462
	hci_conn_hash_del(hdev, conn);
463
	if (hdev->notify)
L
Linus Torvalds 已提交
464
		hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
465

L
Linus Torvalds 已提交
466 467
	skb_queue_purge(&conn->data_q);

468
	hci_conn_del_sysfs(conn);
469

470 471
	hci_dev_put(hdev);

472
	hci_conn_put(conn);
473

L
Linus Torvalds 已提交
474 475 476 477 478 479
	return 0;
}

struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src)
{
	int use_src = bacmp(src, BDADDR_ANY);
480
	struct hci_dev *hdev = NULL, *d;
L
Linus Torvalds 已提交
481

482
	BT_DBG("%pMR -> %pMR", src, dst);
L
Linus Torvalds 已提交
483

484
	read_lock(&hci_dev_list_lock);
L
Linus Torvalds 已提交
485

486
	list_for_each_entry(d, &hci_dev_list, list) {
487
		if (!test_bit(HCI_UP, &d->flags) ||
488
		    test_bit(HCI_RAW, &d->flags) ||
489
		    test_bit(HCI_USER_CHANNEL, &d->dev_flags) ||
490
		    d->dev_type != HCI_BREDR)
L
Linus Torvalds 已提交
491 492
			continue;

493
		/* Simple routing:
L
Linus Torvalds 已提交
494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511
		 *   No source address - find interface with bdaddr != dst
		 *   Source address    - find interface with bdaddr == src
		 */

		if (use_src) {
			if (!bacmp(&d->bdaddr, src)) {
				hdev = d; break;
			}
		} else {
			if (bacmp(&d->bdaddr, dst)) {
				hdev = d; break;
			}
		}
	}

	if (hdev)
		hdev = hci_dev_hold(hdev);

512
	read_unlock(&hci_dev_list_lock);
L
Linus Torvalds 已提交
513 514 515 516
	return hdev;
}
EXPORT_SYMBOL(hci_get_route);

517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 533 534 535 536 537 538 539 540 541 542 543 544 545 546 547 548 549 550 551 552 553 554 555
static void create_le_conn_complete(struct hci_dev *hdev, u8 status)
{
	struct hci_conn *conn;

	if (status == 0)
		return;

	BT_ERR("HCI request failed to create LE connection: status 0x%2.2x",
	       status);

	hci_dev_lock(hdev);

	conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
	if (!conn)
		goto done;

	conn->state = BT_CLOSED;

	mgmt_connect_failed(hdev, &conn->dst, conn->type, conn->dst_type,
			    status);

	hci_proto_connect_cfm(conn, status);

	hci_conn_del(conn);

done:
	hci_dev_unlock(hdev);
}

static int hci_create_le_conn(struct hci_conn *conn)
{
	struct hci_dev *hdev = conn->hdev;
	struct hci_cp_le_create_conn cp;
	struct hci_request req;
	int err;

	hci_req_init(&req, hdev);

	memset(&cp, 0, sizeof(cp));
556 557
	cp.scan_interval = cpu_to_le16(hdev->le_scan_interval);
	cp.scan_window = cpu_to_le16(hdev->le_scan_window);
558 559
	bacpy(&cp.peer_addr, &conn->dst);
	cp.peer_addr_type = conn->dst_type;
560
	cp.own_address_type = conn->src_type;
561 562
	cp.conn_interval_min = cpu_to_le16(hdev->le_conn_min_interval);
	cp.conn_interval_max = cpu_to_le16(hdev->le_conn_max_interval);
563 564 565
	cp.supervision_timeout = __constant_cpu_to_le16(0x002a);
	cp.min_ce_len = __constant_cpu_to_le16(0x0000);
	cp.max_ce_len = __constant_cpu_to_le16(0x0000);
566

567 568 569 570 571 572 573 574 575 576 577
	hci_req_add(&req, HCI_OP_LE_CREATE_CONN, sizeof(cp), &cp);

	err = hci_req_run(&req, create_le_conn_complete);
	if (err) {
		hci_conn_del(conn);
		return err;
	}

	return 0;
}

578 579
static struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,
				    u8 dst_type, u8 sec_level, u8 auth_type)
L
Linus Torvalds 已提交
580
{
581
	struct hci_conn *conn;
582
	int err;
L
Linus Torvalds 已提交
583

584
	if (test_bit(HCI_ADVERTISING, &hdev->flags))
585 586
		return ERR_PTR(-ENOTSUPP);

A
Andre Guedes 已提交
587 588 589 590 591 592 593 594 595
	/* Some devices send ATT messages as soon as the physical link is
	 * established. To be able to handle these ATT messages, the user-
	 * space first establishes the connection and then starts the pairing
	 * process.
	 *
	 * So if a hci_conn object already exists for the following connection
	 * attempt, we simply update pending_sec_level and auth_type fields
	 * and return the object found.
	 */
596
	conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, dst);
A
Andre Guedes 已提交
597 598 599 600 601
	if (conn) {
		conn->pending_sec_level = sec_level;
		conn->auth_type = auth_type;
		goto done;
	}
602

A
Andre Guedes 已提交
603 604 605 606 607 608
	/* Since the controller supports only one LE connection attempt at a
	 * time, we return -EBUSY if there is any connection attempt running.
	 */
	conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
	if (conn)
		return ERR_PTR(-EBUSY);
609

A
Andre Guedes 已提交
610 611 612
	conn = hci_conn_add(hdev, LE_LINK, dst);
	if (!conn)
		return ERR_PTR(-ENOMEM);
613

614 615 616 617
	if (dst_type == BDADDR_LE_PUBLIC)
		conn->dst_type = ADDR_LE_DEV_PUBLIC;
	else
		conn->dst_type = ADDR_LE_DEV_RANDOM;
618

619
	conn->src_type = hdev->own_addr_type;
620

A
Andre Guedes 已提交
621 622 623 624
	conn->state = BT_CONNECT;
	conn->out = true;
	conn->link_mode |= HCI_LM_MASTER;
	conn->sec_level = BT_SECURITY_LOW;
625 626
	conn->pending_sec_level = sec_level;
	conn->auth_type = auth_type;
627

A
Andre Guedes 已提交
628 629 630
	err = hci_create_le_conn(conn);
	if (err)
		return ERR_PTR(err);
V
Ville Tervo 已提交
631

A
Andre Guedes 已提交
632 633
done:
	hci_conn_hold(conn);
634
	return conn;
635
}
V
Ville Tervo 已提交
636

637 638
static struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst,
						u8 sec_level, u8 auth_type)
L
Linus Torvalds 已提交
639 640
{
	struct hci_conn *acl;
V
Ville Tervo 已提交
641

642 643 644
	if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
		return ERR_PTR(-ENOTSUPP);

A
Andrei Emeltchenko 已提交
645 646 647 648
	acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
	if (!acl) {
		acl = hci_conn_add(hdev, ACL_LINK, dst);
		if (!acl)
649
			return ERR_PTR(-ENOMEM);
L
Linus Torvalds 已提交
650 651 652 653
	}

	hci_conn_hold(acl);

654
	if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
655 656
		acl->sec_level = BT_SECURITY_LOW;
		acl->pending_sec_level = sec_level;
657
		acl->auth_type = auth_type;
658
		hci_acl_create_connection(acl);
659
	}
L
Linus Torvalds 已提交
660

661 662 663
	return acl;
}

664 665
struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type, bdaddr_t *dst,
				 __u16 setting)
666 667 668 669
{
	struct hci_conn *acl;
	struct hci_conn *sco;

670
	acl = hci_connect_acl(hdev, dst, BT_SECURITY_LOW, HCI_AT_NO_BONDING);
671
	if (IS_ERR(acl))
672
		return acl;
L
Linus Torvalds 已提交
673

A
Andrei Emeltchenko 已提交
674 675 676 677
	sco = hci_conn_hash_lookup_ba(hdev, type, dst);
	if (!sco) {
		sco = hci_conn_add(hdev, type, dst);
		if (!sco) {
678
			hci_conn_drop(acl);
679
			return ERR_PTR(-ENOMEM);
L
Linus Torvalds 已提交
680
		}
681
	}
L
Linus Torvalds 已提交
682

683 684
	acl->link = sco;
	sco->link = acl;
L
Linus Torvalds 已提交
685

686
	hci_conn_hold(sco);
L
Linus Torvalds 已提交
687

688 689
	sco->setting = setting;

690
	if (acl->state == BT_CONNECTED &&
691
	    (sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
692
		set_bit(HCI_CONN_POWER_SAVE, &acl->flags);
693
		hci_conn_enter_active_mode(acl, BT_POWER_FORCE_ACTIVE_ON);
694

695
		if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->flags)) {
696
			/* defer SCO setup until mode change completed */
697
			set_bit(HCI_CONN_SCO_SETUP_PEND, &acl->flags);
698 699 700 701
			return sco;
		}

		hci_sco_setup(acl, 0x00);
702
	}
703 704

	return sco;
L
Linus Torvalds 已提交
705 706
}

707 708 709 710
/* Create SCO, ACL or LE connection. */
struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst,
			     __u8 dst_type, __u8 sec_level, __u8 auth_type)
{
711
	BT_DBG("%s dst %pMR type 0x%x", hdev->name, dst, type);
712

713 714
	switch (type) {
	case LE_LINK:
715
		return hci_connect_le(hdev, dst, dst_type, sec_level, auth_type);
716
	case ACL_LINK:
717
		return hci_connect_acl(hdev, dst, sec_level, auth_type);
718
	}
719

720
	return ERR_PTR(-EINVAL);
721 722
}

723 724 725
/* Check link security requirement */
int hci_conn_check_link_mode(struct hci_conn *conn)
{
726
	BT_DBG("hcon %p", conn);
727

728
	if (hci_conn_ssp_enabled(conn) && !(conn->link_mode & HCI_LM_ENCRYPT))
729 730 731 732 733
		return 0;

	return 1;
}

L
Linus Torvalds 已提交
734
/* Authenticate remote device */
735
static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
L
Linus Torvalds 已提交
736
{
737
	BT_DBG("hcon %p", conn);
L
Linus Torvalds 已提交
738

739 740 741
	if (conn->pending_sec_level > sec_level)
		sec_level = conn->pending_sec_level;

742
	if (sec_level > conn->sec_level)
743
		conn->pending_sec_level = sec_level;
744
	else if (conn->link_mode & HCI_LM_AUTH)
L
Linus Torvalds 已提交
745 746
		return 1;

747 748 749
	/* Make sure we preserve an existing MITM requirement*/
	auth_type |= (conn->auth_type & 0x01);

750 751
	conn->auth_type = auth_type;

752
	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
L
Linus Torvalds 已提交
753
		struct hci_cp_auth_requested cp;
754 755 756 757

		/* encrypt must be pending if auth is also pending */
		set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);

758
		cp.handle = cpu_to_le16(conn->handle);
759
		hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
760
			     sizeof(cp), &cp);
761
		if (conn->key_type != 0xff)
762
			set_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
L
Linus Torvalds 已提交
763
	}
764

L
Linus Torvalds 已提交
765 766 767
	return 0;
}

768 769 770
/* Encrypt the the link */
static void hci_conn_encrypt(struct hci_conn *conn)
{
771
	BT_DBG("hcon %p", conn);
772

773
	if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
774 775 776 777
		struct hci_cp_set_conn_encrypt cp;
		cp.handle  = cpu_to_le16(conn->handle);
		cp.encrypt = 0x01;
		hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
778
			     &cp);
779 780 781
	}
}

782
/* Enable security */
783
int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
L
Linus Torvalds 已提交
784
{
785
	BT_DBG("hcon %p", conn);
L
Linus Torvalds 已提交
786

787 788 789
	if (conn->type == LE_LINK)
		return smp_conn_security(conn, sec_level);

790
	/* For sdp we don't need the link key. */
791 792 793
	if (sec_level == BT_SECURITY_SDP)
		return 1;

794 795
	/* For non 2.1 devices and low security level we don't need the link
	   key. */
796
	if (sec_level == BT_SECURITY_LOW && !hci_conn_ssp_enabled(conn))
797
		return 1;
798

799 800 801 802 803 804
	/* For other security levels we need the link key. */
	if (!(conn->link_mode & HCI_LM_AUTH))
		goto auth;

	/* An authenticated combination key has sufficient security for any
	   security level. */
805
	if (conn->key_type == HCI_LK_AUTH_COMBINATION_P192)
806 807 808 809
		goto encrypt;

	/* An unauthenticated combination key has sufficient security for
	   security level 1 and 2. */
810
	if (conn->key_type == HCI_LK_UNAUTH_COMBINATION_P192 &&
811
	    (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW))
812 813 814 815 816 817 818
		goto encrypt;

	/* A combination key has always sufficient security for the security
	   levels 1 or 2. High security level requires the combination key
	   is generated using maximum PIN code length (16).
	   For pre 2.1 units. */
	if (conn->key_type == HCI_LK_COMBINATION &&
819
	    (sec_level != BT_SECURITY_HIGH || conn->pin_length == 16))
820 821 822
		goto encrypt;

auth:
823
	if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags))
L
Linus Torvalds 已提交
824 825
		return 0;

826 827
	if (!hci_conn_auth(conn, sec_level, auth_type))
		return 0;
828 829 830 831

encrypt:
	if (conn->link_mode & HCI_LM_ENCRYPT)
		return 1;
832

833
	hci_conn_encrypt(conn);
L
Linus Torvalds 已提交
834 835
	return 0;
}
836
EXPORT_SYMBOL(hci_conn_security);
L
Linus Torvalds 已提交
837

838 839 840
/* Check secure link requirement */
int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level)
{
841
	BT_DBG("hcon %p", conn);
842 843 844 845

	if (sec_level != BT_SECURITY_HIGH)
		return 1; /* Accept if non-secure is required */

846
	if (conn->sec_level == BT_SECURITY_HIGH)
847 848 849 850 851 852
		return 1;

	return 0; /* Reject not secure link */
}
EXPORT_SYMBOL(hci_conn_check_secure);

L
Linus Torvalds 已提交
853 854 855
/* Change link key */
int hci_conn_change_link_key(struct hci_conn *conn)
{
856
	BT_DBG("hcon %p", conn);
L
Linus Torvalds 已提交
857

858
	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
L
Linus Torvalds 已提交
859
		struct hci_cp_change_conn_link_key cp;
860
		cp.handle = cpu_to_le16(conn->handle);
861
		hci_send_cmd(conn->hdev, HCI_OP_CHANGE_CONN_LINK_KEY,
862
			     sizeof(cp), &cp);
L
Linus Torvalds 已提交
863
	}
864

L
Linus Torvalds 已提交
865 866 867 868
	return 0;
}

/* Switch role */
869
int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
L
Linus Torvalds 已提交
870
{
871
	BT_DBG("hcon %p", conn);
L
Linus Torvalds 已提交
872 873 874 875

	if (!role && conn->link_mode & HCI_LM_MASTER)
		return 1;

876
	if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->flags)) {
L
Linus Torvalds 已提交
877 878 879
		struct hci_cp_switch_role cp;
		bacpy(&cp.bdaddr, &conn->dst);
		cp.role = role;
880
		hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
L
Linus Torvalds 已提交
881
	}
882

L
Linus Torvalds 已提交
883 884 885 886
	return 0;
}
EXPORT_SYMBOL(hci_conn_switch_role);

887
/* Enter active mode */
888
void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
889 890 891
{
	struct hci_dev *hdev = conn->hdev;

892
	BT_DBG("hcon %p mode %d", conn, conn->mode);
893 894 895 896

	if (test_bit(HCI_RAW, &hdev->flags))
		return;

897 898 899
	if (conn->mode != HCI_CM_SNIFF)
		goto timer;

900
	if (!test_bit(HCI_CONN_POWER_SAVE, &conn->flags) && !force_active)
901 902
		goto timer;

903
	if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
904
		struct hci_cp_exit_sniff_mode cp;
905
		cp.handle = cpu_to_le16(conn->handle);
906
		hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
907 908 909 910
	}

timer:
	if (hdev->idle_timeout > 0)
911 912
		queue_delayed_work(hdev->workqueue, &conn->idle_work,
				   msecs_to_jiffies(hdev->idle_timeout));
913 914
}

L
Linus Torvalds 已提交
915 916 917 918
/* Drop all connection on the device */
void hci_conn_hash_flush(struct hci_dev *hdev)
{
	struct hci_conn_hash *h = &hdev->conn_hash;
919
	struct hci_conn *c, *n;
L
Linus Torvalds 已提交
920 921 922

	BT_DBG("hdev %s", hdev->name);

923
	list_for_each_entry_safe(c, n, &h->list, list) {
L
Linus Torvalds 已提交
924 925
		c->state = BT_CLOSED;

926
		hci_proto_disconn_cfm(c, HCI_ERROR_LOCAL_HOST_TERM);
L
Linus Torvalds 已提交
927 928 929 930
		hci_conn_del(c);
	}
}

931 932 933 934 935 936 937 938 939 940 941
/* Check pending connect attempts */
void hci_conn_check_pending(struct hci_dev *hdev)
{
	struct hci_conn *conn;

	BT_DBG("hdev %s", hdev->name);

	hci_dev_lock(hdev);

	conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
	if (conn)
942
		hci_acl_create_connection(conn);
943 944 945 946

	hci_dev_unlock(hdev);
}

L
Linus Torvalds 已提交
947 948
int hci_get_conn_list(void __user *arg)
{
949
	struct hci_conn *c;
L
Linus Torvalds 已提交
950 951 952 953 954 955 956 957 958 959 960 961 962
	struct hci_conn_list_req req, *cl;
	struct hci_conn_info *ci;
	struct hci_dev *hdev;
	int n = 0, size, err;

	if (copy_from_user(&req, arg, sizeof(req)))
		return -EFAULT;

	if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
		return -EINVAL;

	size = sizeof(req) + req.conn_num * sizeof(*ci);

A
Andrei Emeltchenko 已提交
963 964
	cl = kmalloc(size, GFP_KERNEL);
	if (!cl)
L
Linus Torvalds 已提交
965 966
		return -ENOMEM;

A
Andrei Emeltchenko 已提交
967 968
	hdev = hci_dev_get(req.dev_id);
	if (!hdev) {
L
Linus Torvalds 已提交
969 970 971 972 973 974
		kfree(cl);
		return -ENODEV;
	}

	ci = cl->conn_info;

975
	hci_dev_lock(hdev);
976
	list_for_each_entry(c, &hdev->conn_hash.list, list) {
L
Linus Torvalds 已提交
977 978 979 980 981 982 983 984 985
		bacpy(&(ci + n)->bdaddr, &c->dst);
		(ci + n)->handle = c->handle;
		(ci + n)->type  = c->type;
		(ci + n)->out   = c->out;
		(ci + n)->state = c->state;
		(ci + n)->link_mode = c->link_mode;
		if (++n >= req.conn_num)
			break;
	}
986
	hci_dev_unlock(hdev);
L
Linus Torvalds 已提交
987 988 989 990 991 992 993 994 995 996 997 998 999 1000 1001 1002 1003 1004 1005 1006 1007 1008 1009

	cl->dev_id = hdev->id;
	cl->conn_num = n;
	size = sizeof(req) + n * sizeof(*ci);

	hci_dev_put(hdev);

	err = copy_to_user(arg, cl, size);
	kfree(cl);

	return err ? -EFAULT : 0;
}

int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
{
	struct hci_conn_info_req req;
	struct hci_conn_info ci;
	struct hci_conn *conn;
	char __user *ptr = arg + sizeof(req);

	if (copy_from_user(&req, arg, sizeof(req)))
		return -EFAULT;

1010
	hci_dev_lock(hdev);
L
Linus Torvalds 已提交
1011 1012 1013 1014 1015 1016 1017 1018 1019
	conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
	if (conn) {
		bacpy(&ci.bdaddr, &conn->dst);
		ci.handle = conn->handle;
		ci.type  = conn->type;
		ci.out   = conn->out;
		ci.state = conn->state;
		ci.link_mode = conn->link_mode;
	}
1020
	hci_dev_unlock(hdev);
L
Linus Torvalds 已提交
1021 1022 1023 1024 1025 1026

	if (!conn)
		return -ENOENT;

	return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
}
1027 1028 1029 1030 1031 1032 1033 1034 1035

int hci_get_auth_info(struct hci_dev *hdev, void __user *arg)
{
	struct hci_auth_info_req req;
	struct hci_conn *conn;

	if (copy_from_user(&req, arg, sizeof(req)))
		return -EFAULT;

1036
	hci_dev_lock(hdev);
1037 1038 1039
	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr);
	if (conn)
		req.type = conn->auth_type;
1040
	hci_dev_unlock(hdev);
1041 1042 1043 1044 1045 1046

	if (!conn)
		return -ENOENT;

	return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0;
}
1047 1048 1049 1050 1051 1052

struct hci_chan *hci_chan_create(struct hci_conn *conn)
{
	struct hci_dev *hdev = conn->hdev;
	struct hci_chan *chan;

1053
	BT_DBG("%s hcon %p", hdev->name, conn);
1054

1055
	chan = kzalloc(sizeof(struct hci_chan), GFP_KERNEL);
1056 1057 1058 1059 1060
	if (!chan)
		return NULL;

	chan->conn = conn;
	skb_queue_head_init(&chan->data_q);
M
Mat Martineau 已提交
1061
	chan->state = BT_CONNECTED;
1062

1063
	list_add_rcu(&chan->list, &conn->chan_list);
1064 1065 1066 1067

	return chan;
}

1068
void hci_chan_del(struct hci_chan *chan)
1069 1070 1071 1072
{
	struct hci_conn *conn = chan->conn;
	struct hci_dev *hdev = conn->hdev;

1073
	BT_DBG("%s hcon %p chan %p", hdev->name, conn, chan);
1074

1075 1076 1077
	list_del_rcu(&chan->list);

	synchronize_rcu();
1078

1079
	hci_conn_drop(conn);
1080

1081 1082 1083 1084
	skb_queue_purge(&chan->data_q);
	kfree(chan);
}

1085
void hci_chan_list_flush(struct hci_conn *conn)
1086
{
1087
	struct hci_chan *chan, *n;
1088

1089
	BT_DBG("hcon %p", conn);
1090

1091
	list_for_each_entry_safe(chan, n, &conn->chan_list, list)
1092 1093
		hci_chan_del(chan);
}
1094 1095 1096 1097 1098 1099 1100 1101 1102 1103 1104 1105 1106 1107 1108 1109 1110 1111 1112 1113 1114 1115 1116 1117 1118 1119 1120 1121 1122 1123 1124 1125

static struct hci_chan *__hci_chan_lookup_handle(struct hci_conn *hcon,
						 __u16 handle)
{
	struct hci_chan *hchan;

	list_for_each_entry(hchan, &hcon->chan_list, list) {
		if (hchan->handle == handle)
			return hchan;
	}

	return NULL;
}

struct hci_chan *hci_chan_lookup_handle(struct hci_dev *hdev, __u16 handle)
{
	struct hci_conn_hash *h = &hdev->conn_hash;
	struct hci_conn *hcon;
	struct hci_chan *hchan = NULL;

	rcu_read_lock();

	list_for_each_entry_rcu(hcon, &h->list, list) {
		hchan = __hci_chan_lookup_handle(hcon, handle);
		if (hchan)
			break;
	}

	rcu_read_unlock();

	return hchan;
}