projects / deliverable / linux.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge branch 'slab/urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/penberg...
[deliverable/linux.git] / net / bluetooth / hci_conn.c
1 /*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
4
5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22 SOFTWARE IS DISCLAIMED.
23 */
24
25 /* Bluetooth HCI connection handling. */
26
27 #include <linux/export.h>
28
29 #include <net/bluetooth/bluetooth.h>
30 #include <net/bluetooth/hci_core.h>
31 #include <net/bluetooth/l2cap.h>
32
33 #include "smp.h"
34 #include "a2mp.h"
35
36 struct sco_param {
37 u16 pkt_type;
38 u16 max_latency;
39 };
40
41 static const struct sco_param sco_param_cvsd[] = {
42 { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000a }, /* S3 */
43 { EDR_ESCO_MASK & ~ESCO_2EV3, 0x0007 }, /* S2 */
44 { EDR_ESCO_MASK | ESCO_EV3, 0x0007 }, /* S1 */
45 { EDR_ESCO_MASK | ESCO_HV3, 0xffff }, /* D1 */
46 { EDR_ESCO_MASK | ESCO_HV1, 0xffff }, /* D0 */
47 };
48
49 static const struct sco_param sco_param_wideband[] = {
50 { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000d }, /* T2 */
51 { EDR_ESCO_MASK | ESCO_EV3, 0x0008 }, /* T1 */
52 };
53
54 static void hci_le_create_connection_cancel(struct hci_conn *conn)
55 {
56 hci_send_cmd(conn->hdev, HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL);
57 }
58
59 static void hci_acl_create_connection(struct hci_conn *conn)
60 {
61 struct hci_dev *hdev = conn->hdev;
62 struct inquiry_entry *ie;
63 struct hci_cp_create_conn cp;
64
65 BT_DBG("hcon %p", conn);
66
67 conn->state = BT_CONNECT;
68 conn->out = true;
69
70 conn->link_mode = HCI_LM_MASTER;
71
72 conn->attempt++;
73
74 conn->link_policy = hdev->link_policy;
75
76 memset(&cp, 0, sizeof(cp));
77 bacpy(&cp.bdaddr, &conn->dst);
78 cp.pscan_rep_mode = 0x02;
79
80 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
81 if (ie) {
82 if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
83 cp.pscan_rep_mode = ie->data.pscan_rep_mode;
84 cp.pscan_mode = ie->data.pscan_mode;
85 cp.clock_offset = ie->data.clock_offset |
86 cpu_to_le16(0x8000);
87 }
88
89 memcpy(conn->dev_class, ie->data.dev_class, 3);
90 if (ie->data.ssp_mode > 0)
91 set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
92 }
93
94 cp.pkt_type = cpu_to_le16(conn->pkt_type);
95 if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
96 cp.role_switch = 0x01;
97 else
98 cp.role_switch = 0x00;
99
100 hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
101 }
102
103 static void hci_acl_create_connection_cancel(struct hci_conn *conn)
104 {
105 struct hci_cp_create_conn_cancel cp;
106
107 BT_DBG("hcon %p", conn);
108
109 if (conn->hdev->hci_ver < BLUETOOTH_VER_1_2)
110 return;
111
112 bacpy(&cp.bdaddr, &conn->dst);
113 hci_send_cmd(conn->hdev, HCI_OP_CREATE_CONN_CANCEL, sizeof(cp), &cp);
114 }
115
116 static void hci_reject_sco(struct hci_conn *conn)
117 {
118 struct hci_cp_reject_sync_conn_req cp;
119
120 cp.reason = HCI_ERROR_REMOTE_USER_TERM;
121 bacpy(&cp.bdaddr, &conn->dst);
122
123 hci_send_cmd(conn->hdev, HCI_OP_REJECT_SYNC_CONN_REQ, sizeof(cp), &cp);
124 }
125
126 void hci_disconnect(struct hci_conn *conn, __u8 reason)
127 {
128 struct hci_cp_disconnect cp;
129
130 BT_DBG("hcon %p", conn);
131
132 conn->state = BT_DISCONN;
133
134 cp.handle = cpu_to_le16(conn->handle);
135 cp.reason = reason;
136 hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp);
137 }
138
139 static void hci_amp_disconn(struct hci_conn *conn, __u8 reason)
140 {
141 struct hci_cp_disconn_phy_link cp;
142
143 BT_DBG("hcon %p", conn);
144
145 conn->state = BT_DISCONN;
146
147 cp.phy_handle = HCI_PHY_HANDLE(conn->handle);
148 cp.reason = reason;
149 hci_send_cmd(conn->hdev, HCI_OP_DISCONN_PHY_LINK,
150 sizeof(cp), &cp);
151 }
152
153 static void hci_add_sco(struct hci_conn *conn, __u16 handle)
154 {
155 struct hci_dev *hdev = conn->hdev;
156 struct hci_cp_add_sco cp;
157
158 BT_DBG("hcon %p", conn);
159
160 conn->state = BT_CONNECT;
161 conn->out = true;
162
163 conn->attempt++;
164
165 cp.handle = cpu_to_le16(handle);
166 cp.pkt_type = cpu_to_le16(conn->pkt_type);
167
168 hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
169 }
170
171 bool hci_setup_sync(struct hci_conn *conn, __u16 handle)
172 {
173 struct hci_dev *hdev = conn->hdev;
174 struct hci_cp_setup_sync_conn cp;
175 const struct sco_param *param;
176
177 BT_DBG("hcon %p", conn);
178
179 conn->state = BT_CONNECT;
180 conn->out = true;
181
182 conn->attempt++;
183
184 cp.handle = cpu_to_le16(handle);
185
186 cp.tx_bandwidth = cpu_to_le32(0x00001f40);
187 cp.rx_bandwidth = cpu_to_le32(0x00001f40);
188 cp.voice_setting = cpu_to_le16(conn->setting);
189
190 switch (conn->setting & SCO_AIRMODE_MASK) {
191 case SCO_AIRMODE_TRANSP:
192 if (conn->attempt > ARRAY_SIZE(sco_param_wideband))
193 return false;
194 cp.retrans_effort = 0x02;
195 param = &sco_param_wideband[conn->attempt - 1];
196 break;
197 case SCO_AIRMODE_CVSD:
198 if (conn->attempt > ARRAY_SIZE(sco_param_cvsd))
199 return false;
200 cp.retrans_effort = 0x01;
201 param = &sco_param_cvsd[conn->attempt - 1];
202 break;
203 default:
204 return false;
205 }
206
207 cp.pkt_type = __cpu_to_le16(param->pkt_type);
208 cp.max_latency = __cpu_to_le16(param->max_latency);
209
210 if (hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp) < 0)
211 return false;
212
213 return true;
214 }
215
216 void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max,
217 u16 latency, u16 to_multiplier)
218 {
219 struct hci_cp_le_conn_update cp;
220 struct hci_dev *hdev = conn->hdev;
221
222 memset(&cp, 0, sizeof(cp));
223
224 cp.handle = cpu_to_le16(conn->handle);
225 cp.conn_interval_min = cpu_to_le16(min);
226 cp.conn_interval_max = cpu_to_le16(max);
227 cp.conn_latency = cpu_to_le16(latency);
228 cp.supervision_timeout = cpu_to_le16(to_multiplier);
229 cp.min_ce_len = cpu_to_le16(0x0000);
230 cp.max_ce_len = cpu_to_le16(0x0000);
231
232 hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp);
233 }
234
235 void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __le64 rand,
236 __u8 ltk[16])
237 {
238 struct hci_dev *hdev = conn->hdev;
239 struct hci_cp_le_start_enc cp;
240
241 BT_DBG("hcon %p", conn);
242
243 memset(&cp, 0, sizeof(cp));
244
245 cp.handle = cpu_to_le16(conn->handle);
246 cp.rand = rand;
247 cp.ediv = ediv;
248 memcpy(cp.ltk, ltk, sizeof(cp.ltk));
249
250 hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp);
251 }
252
253 /* Device _must_ be locked */
254 void hci_sco_setup(struct hci_conn *conn, __u8 status)
255 {
256 struct hci_conn *sco = conn->link;
257
258 if (!sco)
259 return;
260
261 BT_DBG("hcon %p", conn);
262
263 if (!status) {
264 if (lmp_esco_capable(conn->hdev))
265 hci_setup_sync(sco, conn->handle);
266 else
267 hci_add_sco(sco, conn->handle);
268 } else {
269 hci_proto_connect_cfm(sco, status);
270 hci_conn_del(sco);
271 }
272 }
273
274 static void hci_conn_disconnect(struct hci_conn *conn)
275 {
276 __u8 reason = hci_proto_disconn_ind(conn);
277
278 switch (conn->type) {
279 case AMP_LINK:
280 hci_amp_disconn(conn, reason);
281 break;
282 default:
283 hci_disconnect(conn, reason);
284 break;
285 }
286 }
287
288 static void hci_conn_timeout(struct work_struct *work)
289 {
290 struct hci_conn *conn = container_of(work, struct hci_conn,
291 disc_work.work);
292
293 BT_DBG("hcon %p state %s", conn, state_to_string(conn->state));
294
295 if (atomic_read(&conn->refcnt))
296 return;
297
298 switch (conn->state) {
299 case BT_CONNECT:
300 case BT_CONNECT2:
301 if (conn->out) {
302 if (conn->type == ACL_LINK)
303 hci_acl_create_connection_cancel(conn);
304 else if (conn->type == LE_LINK)
305 hci_le_create_connection_cancel(conn);
306 } else if (conn->type == SCO_LINK || conn->type == ESCO_LINK) {
307 hci_reject_sco(conn);
308 }
309 break;
310 case BT_CONFIG:
311 case BT_CONNECTED:
312 hci_conn_disconnect(conn);
313 break;
314 default:
315 conn->state = BT_CLOSED;
316 break;
317 }
318 }
319
320 /* Enter sniff mode */
321 static void hci_conn_idle(struct work_struct *work)
322 {
323 struct hci_conn *conn = container_of(work, struct hci_conn,
324 idle_work.work);
325 struct hci_dev *hdev = conn->hdev;
326
327 BT_DBG("hcon %p mode %d", conn, conn->mode);
328
329 if (test_bit(HCI_RAW, &hdev->flags))
330 return;
331
332 if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn))
333 return;
334
335 if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF))
336 return;
337
338 if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
339 struct hci_cp_sniff_subrate cp;
340 cp.handle = cpu_to_le16(conn->handle);
341 cp.max_latency = cpu_to_le16(0);
342 cp.min_remote_timeout = cpu_to_le16(0);
343 cp.min_local_timeout = cpu_to_le16(0);
344 hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
345 }
346
347 if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
348 struct hci_cp_sniff_mode cp;
349 cp.handle = cpu_to_le16(conn->handle);
350 cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
351 cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
352 cp.attempt = cpu_to_le16(4);
353 cp.timeout = cpu_to_le16(1);
354 hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
355 }
356 }
357
358 static void hci_conn_auto_accept(struct work_struct *work)
359 {
360 struct hci_conn *conn = container_of(work, struct hci_conn,
361 auto_accept_work.work);
362
363 hci_send_cmd(conn->hdev, HCI_OP_USER_CONFIRM_REPLY, sizeof(conn->dst),
364 &conn->dst);
365 }
366
367 static void le_conn_timeout(struct work_struct *work)
368 {
369 struct hci_conn *conn = container_of(work, struct hci_conn,
370 le_conn_timeout.work);
371 struct hci_dev *hdev = conn->hdev;
372
373 BT_DBG("");
374
375 /* We could end up here due to having done directed advertising,
376 * so clean up the state if necessary. This should however only
377 * happen with broken hardware or if low duty cycle was used
378 * (which doesn't have a timeout of its own).
379 */
380 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
381 u8 enable = 0x00;
382 hci_send_cmd(hdev, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable),
383 &enable);
384 hci_le_conn_failed(conn, HCI_ERROR_ADVERTISING_TIMEOUT);
385 return;
386 }
387
388 hci_le_create_connection_cancel(conn);
389 }
390
391 struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
392 {
393 struct hci_conn *conn;
394
395 BT_DBG("%s dst %pMR", hdev->name, dst);
396
397 conn = kzalloc(sizeof(struct hci_conn), GFP_KERNEL);
398 if (!conn)
399 return NULL;
400
401 bacpy(&conn->dst, dst);
402 bacpy(&conn->src, &hdev->bdaddr);
403 conn->hdev = hdev;
404 conn->type = type;
405 conn->mode = HCI_CM_ACTIVE;
406 conn->state = BT_OPEN;
407 conn->auth_type = HCI_AT_GENERAL_BONDING;
408 conn->io_capability = hdev->io_capability;
409 conn->remote_auth = 0xff;
410 conn->key_type = 0xff;
411 conn->tx_power = HCI_TX_POWER_INVALID;
412 conn->max_tx_power = HCI_TX_POWER_INVALID;
413
414 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
415 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
416
417 switch (type) {
418 case ACL_LINK:
419 conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
420 break;
421 case LE_LINK:
422 /* conn->src should reflect the local identity address */
423 hci_copy_identity_address(hdev, &conn->src, &conn->src_type);
424 break;
425 case SCO_LINK:
426 if (lmp_esco_capable(hdev))
427 conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
428 (hdev->esco_type & EDR_ESCO_MASK);
429 else
430 conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
431 break;
432 case ESCO_LINK:
433 conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
434 break;
435 }
436
437 skb_queue_head_init(&conn->data_q);
438
439 INIT_LIST_HEAD(&conn->chan_list);
440
441 INIT_DELAYED_WORK(&conn->disc_work, hci_conn_timeout);
442 INIT_DELAYED_WORK(&conn->auto_accept_work, hci_conn_auto_accept);
443 INIT_DELAYED_WORK(&conn->idle_work, hci_conn_idle);
444 INIT_DELAYED_WORK(&conn->le_conn_timeout, le_conn_timeout);
445
446 atomic_set(&conn->refcnt, 0);
447
448 hci_dev_hold(hdev);
449
450 hci_conn_hash_add(hdev, conn);
451 if (hdev->notify)
452 hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
453
454 hci_conn_init_sysfs(conn);
455
456 return conn;
457 }
458
459 int hci_conn_del(struct hci_conn *conn)
460 {
461 struct hci_dev *hdev = conn->hdev;
462
463 BT_DBG("%s hcon %p handle %d", hdev->name, conn, conn->handle);
464
465 cancel_delayed_work_sync(&conn->disc_work);
466 cancel_delayed_work_sync(&conn->auto_accept_work);
467 cancel_delayed_work_sync(&conn->idle_work);
468
469 if (conn->type == ACL_LINK) {
470 struct hci_conn *sco = conn->link;
471 if (sco)
472 sco->link = NULL;
473
474 /* Unacked frames */
475 hdev->acl_cnt += conn->sent;
476 } else if (conn->type == LE_LINK) {
477 cancel_delayed_work_sync(&conn->le_conn_timeout);
478
479 if (hdev->le_pkts)
480 hdev->le_cnt += conn->sent;
481 else
482 hdev->acl_cnt += conn->sent;
483 } else {
484 struct hci_conn *acl = conn->link;
485 if (acl) {
486 acl->link = NULL;
487 hci_conn_drop(acl);
488 }
489 }
490
491 hci_chan_list_flush(conn);
492
493 if (conn->amp_mgr)
494 amp_mgr_put(conn->amp_mgr);
495
496 hci_conn_hash_del(hdev, conn);
497 if (hdev->notify)
498 hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
499
500 skb_queue_purge(&conn->data_q);
501
502 hci_conn_del_sysfs(conn);
503
504 hci_dev_put(hdev);
505
506 hci_conn_put(conn);
507
508 return 0;
509 }
510
511 struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src)
512 {
513 int use_src = bacmp(src, BDADDR_ANY);
514 struct hci_dev *hdev = NULL, *d;
515
516 BT_DBG("%pMR -> %pMR", src, dst);
517
518 read_lock(&hci_dev_list_lock);
519
520 list_for_each_entry(d, &hci_dev_list, list) {
521 if (!test_bit(HCI_UP, &d->flags) ||
522 test_bit(HCI_RAW, &d->flags) ||
523 test_bit(HCI_USER_CHANNEL, &d->dev_flags) ||
524 d->dev_type != HCI_BREDR)
525 continue;
526
527 /* Simple routing:
528 * No source address - find interface with bdaddr != dst
529 * Source address - find interface with bdaddr == src
530 */
531
532 if (use_src) {
533 if (!bacmp(&d->bdaddr, src)) {
534 hdev = d; break;
535 }
536 } else {
537 if (bacmp(&d->bdaddr, dst)) {
538 hdev = d; break;
539 }
540 }
541 }
542
543 if (hdev)
544 hdev = hci_dev_hold(hdev);
545
546 read_unlock(&hci_dev_list_lock);
547 return hdev;
548 }
549 EXPORT_SYMBOL(hci_get_route);
550
551 /* This function requires the caller holds hdev->lock */
552 void hci_le_conn_failed(struct hci_conn *conn, u8 status)
553 {
554 struct hci_dev *hdev = conn->hdev;
555
556 conn->state = BT_CLOSED;
557
558 mgmt_connect_failed(hdev, &conn->dst, conn->type, conn->dst_type,
559 status);
560
561 hci_proto_connect_cfm(conn, status);
562
563 hci_conn_del(conn);
564
565 /* Since we may have temporarily stopped the background scanning in
566 * favor of connection establishment, we should restart it.
567 */
568 hci_update_background_scan(hdev);
569
570 /* Re-enable advertising in case this was a failed connection
571 * attempt as a peripheral.
572 */
573 mgmt_reenable_advertising(hdev);
574 }
575
576 static void create_le_conn_complete(struct hci_dev *hdev, u8 status)
577 {
578 struct hci_conn *conn;
579
580 if (status == 0)
581 return;
582
583 BT_ERR("HCI request failed to create LE connection: status 0x%2.2x",
584 status);
585
586 hci_dev_lock(hdev);
587
588 conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
589 if (!conn)
590 goto done;
591
592 hci_le_conn_failed(conn, status);
593
594 done:
595 hci_dev_unlock(hdev);
596 }
597
598 static void hci_req_add_le_create_conn(struct hci_request *req,
599 struct hci_conn *conn)
600 {
601 struct hci_cp_le_create_conn cp;
602 struct hci_dev *hdev = conn->hdev;
603 u8 own_addr_type;
604
605 memset(&cp, 0, sizeof(cp));
606
607 /* Update random address, but set require_privacy to false so
608 * that we never connect with an unresolvable address.
609 */
610 if (hci_update_random_address(req, false, &own_addr_type))
611 return;
612
613 cp.scan_interval = cpu_to_le16(hdev->le_scan_interval);
614 cp.scan_window = cpu_to_le16(hdev->le_scan_window);
615 bacpy(&cp.peer_addr, &conn->dst);
616 cp.peer_addr_type = conn->dst_type;
617 cp.own_address_type = own_addr_type;
618 cp.conn_interval_min = cpu_to_le16(conn->le_conn_min_interval);
619 cp.conn_interval_max = cpu_to_le16(conn->le_conn_max_interval);
620 cp.supervision_timeout = cpu_to_le16(0x002a);
621 cp.min_ce_len = cpu_to_le16(0x0000);
622 cp.max_ce_len = cpu_to_le16(0x0000);
623
624 hci_req_add(req, HCI_OP_LE_CREATE_CONN, sizeof(cp), &cp);
625
626 conn->state = BT_CONNECT;
627 }
628
629 static void hci_req_directed_advertising(struct hci_request *req,
630 struct hci_conn *conn)
631 {
632 struct hci_dev *hdev = req->hdev;
633 struct hci_cp_le_set_adv_param cp;
634 u8 own_addr_type;
635 u8 enable;
636
637 enable = 0x00;
638 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
639
640 /* Clear the HCI_ADVERTISING bit temporarily so that the
641 * hci_update_random_address knows that it's safe to go ahead
642 * and write a new random address. The flag will be set back on
643 * as soon as the SET_ADV_ENABLE HCI command completes.
644 */
645 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
646
647 /* Set require_privacy to false so that the remote device has a
648 * chance of identifying us.
649 */
650 if (hci_update_random_address(req, false, &own_addr_type) < 0)
651 return;
652
653 memset(&cp, 0, sizeof(cp));
654 cp.type = LE_ADV_DIRECT_IND;
655 cp.own_address_type = own_addr_type;
656 cp.direct_addr_type = conn->dst_type;
657 bacpy(&cp.direct_addr, &conn->dst);
658 cp.channel_map = hdev->le_adv_channel_map;
659
660 hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
661
662 enable = 0x01;
663 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
664
665 conn->state = BT_CONNECT;
666 }
667
668 struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,
669 u8 dst_type, u8 sec_level, u8 auth_type)
670 {
671 struct hci_conn_params *params;
672 struct hci_conn *conn;
673 struct smp_irk *irk;
674 struct hci_request req;
675 int err;
676
677 /* Some devices send ATT messages as soon as the physical link is
678 * established. To be able to handle these ATT messages, the user-
679 * space first establishes the connection and then starts the pairing
680 * process.
681 *
682 * So if a hci_conn object already exists for the following connection
683 * attempt, we simply update pending_sec_level and auth_type fields
684 * and return the object found.
685 */
686 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, dst);
687 if (conn) {
688 conn->pending_sec_level = sec_level;
689 conn->auth_type = auth_type;
690 goto done;
691 }
692
693 /* Since the controller supports only one LE connection attempt at a
694 * time, we return -EBUSY if there is any connection attempt running.
695 */
696 conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
697 if (conn)
698 return ERR_PTR(-EBUSY);
699
700 /* When given an identity address with existing identity
701 * resolving key, the connection needs to be established
702 * to a resolvable random address.
703 *
704 * This uses the cached random resolvable address from
705 * a previous scan. When no cached address is available,
706 * try connecting to the identity address instead.
707 *
708 * Storing the resolvable random address is required here
709 * to handle connection failures. The address will later
710 * be resolved back into the original identity address
711 * from the connect request.
712 */
713 irk = hci_find_irk_by_addr(hdev, dst, dst_type);
714 if (irk && bacmp(&irk->rpa, BDADDR_ANY)) {
715 dst = &irk->rpa;
716 dst_type = ADDR_LE_DEV_RANDOM;
717 }
718
719 conn = hci_conn_add(hdev, LE_LINK, dst);
720 if (!conn)
721 return ERR_PTR(-ENOMEM);
722
723 conn->dst_type = dst_type;
724 conn->sec_level = BT_SECURITY_LOW;
725 conn->pending_sec_level = sec_level;
726 conn->auth_type = auth_type;
727
728 hci_req_init(&req, hdev);
729
730 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
731 hci_req_directed_advertising(&req, conn);
732 goto create_conn;
733 }
734
735 conn->out = true;
736 conn->link_mode |= HCI_LM_MASTER;
737
738 params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
739 if (params) {
740 conn->le_conn_min_interval = params->conn_min_interval;
741 conn->le_conn_max_interval = params->conn_max_interval;
742 } else {
743 conn->le_conn_min_interval = hdev->le_conn_min_interval;
744 conn->le_conn_max_interval = hdev->le_conn_max_interval;
745 }
746
747 /* If controller is scanning, we stop it since some controllers are
748 * not able to scan and connect at the same time. Also set the
749 * HCI_LE_SCAN_INTERRUPTED flag so that the command complete
750 * handler for scan disabling knows to set the correct discovery
751 * state.
752 */
753 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
754 hci_req_add_le_scan_disable(&req);
755 set_bit(HCI_LE_SCAN_INTERRUPTED, &hdev->dev_flags);
756 }
757
758 hci_req_add_le_create_conn(&req, conn);
759
760 create_conn:
761 err = hci_req_run(&req, create_le_conn_complete);
762 if (err) {
763 hci_conn_del(conn);
764 return ERR_PTR(err);
765 }
766
767 done:
768 hci_conn_hold(conn);
769 return conn;
770 }
771
772 struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst,
773 u8 sec_level, u8 auth_type)
774 {
775 struct hci_conn *acl;
776
777 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
778 return ERR_PTR(-ENOTSUPP);
779
780 acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
781 if (!acl) {
782 acl = hci_conn_add(hdev, ACL_LINK, dst);
783 if (!acl)
784 return ERR_PTR(-ENOMEM);
785 }
786
787 hci_conn_hold(acl);
788
789 if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
790 acl->sec_level = BT_SECURITY_LOW;
791 acl->pending_sec_level = sec_level;
792 acl->auth_type = auth_type;
793 hci_acl_create_connection(acl);
794 }
795
796 return acl;
797 }
798
799 struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type, bdaddr_t *dst,
800 __u16 setting)
801 {
802 struct hci_conn *acl;
803 struct hci_conn *sco;
804
805 acl = hci_connect_acl(hdev, dst, BT_SECURITY_LOW, HCI_AT_NO_BONDING);
806 if (IS_ERR(acl))
807 return acl;
808
809 sco = hci_conn_hash_lookup_ba(hdev, type, dst);
810 if (!sco) {
811 sco = hci_conn_add(hdev, type, dst);
812 if (!sco) {
813 hci_conn_drop(acl);
814 return ERR_PTR(-ENOMEM);
815 }
816 }
817
818 acl->link = sco;
819 sco->link = acl;
820
821 hci_conn_hold(sco);
822
823 sco->setting = setting;
824
825 if (acl->state == BT_CONNECTED &&
826 (sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
827 set_bit(HCI_CONN_POWER_SAVE, &acl->flags);
828 hci_conn_enter_active_mode(acl, BT_POWER_FORCE_ACTIVE_ON);
829
830 if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->flags)) {
831 /* defer SCO setup until mode change completed */
832 set_bit(HCI_CONN_SCO_SETUP_PEND, &acl->flags);
833 return sco;
834 }
835
836 hci_sco_setup(acl, 0x00);
837 }
838
839 return sco;
840 }
841
842 /* Check link security requirement */
843 int hci_conn_check_link_mode(struct hci_conn *conn)
844 {
845 BT_DBG("hcon %p", conn);
846
847 /* In Secure Connections Only mode, it is required that Secure
848 * Connections is used and the link is encrypted with AES-CCM
849 * using a P-256 authenticated combination key.
850 */
851 if (test_bit(HCI_SC_ONLY, &conn->hdev->flags)) {
852 if (!hci_conn_sc_enabled(conn) ||
853 !test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
854 conn->key_type != HCI_LK_AUTH_COMBINATION_P256)
855 return 0;
856 }
857
858 if (hci_conn_ssp_enabled(conn) && !(conn->link_mode & HCI_LM_ENCRYPT))
859 return 0;
860
861 return 1;
862 }
863
864 /* Authenticate remote device */
865 static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
866 {
867 BT_DBG("hcon %p", conn);
868
869 if (conn->pending_sec_level > sec_level)
870 sec_level = conn->pending_sec_level;
871
872 if (sec_level > conn->sec_level)
873 conn->pending_sec_level = sec_level;
874 else if (conn->link_mode & HCI_LM_AUTH)
875 return 1;
876
877 /* Make sure we preserve an existing MITM requirement*/
878 auth_type |= (conn->auth_type & 0x01);
879
880 conn->auth_type = auth_type;
881
882 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
883 struct hci_cp_auth_requested cp;
884
885 cp.handle = cpu_to_le16(conn->handle);
886 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
887 sizeof(cp), &cp);
888
889 /* If we're already encrypted set the REAUTH_PEND flag,
890 * otherwise set the ENCRYPT_PEND.
891 */
892 if (conn->link_mode & HCI_LM_ENCRYPT)
893 set_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
894 else
895 set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
896 }
897
898 return 0;
899 }
900
901 /* Encrypt the the link */
902 static void hci_conn_encrypt(struct hci_conn *conn)
903 {
904 BT_DBG("hcon %p", conn);
905
906 if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
907 struct hci_cp_set_conn_encrypt cp;
908 cp.handle = cpu_to_le16(conn->handle);
909 cp.encrypt = 0x01;
910 hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
911 &cp);
912 }
913 }
914
915 /* Enable security */
916 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
917 {
918 BT_DBG("hcon %p", conn);
919
920 if (conn->type == LE_LINK)
921 return smp_conn_security(conn, sec_level);
922
923 /* For sdp we don't need the link key. */
924 if (sec_level == BT_SECURITY_SDP)
925 return 1;
926
927 /* For non 2.1 devices and low security level we don't need the link
928 key. */
929 if (sec_level == BT_SECURITY_LOW && !hci_conn_ssp_enabled(conn))
930 return 1;
931
932 /* For other security levels we need the link key. */
933 if (!(conn->link_mode & HCI_LM_AUTH))
934 goto auth;
935
936 /* An authenticated FIPS approved combination key has sufficient
937 * security for security level 4. */
938 if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256 &&
939 sec_level == BT_SECURITY_FIPS)
940 goto encrypt;
941
942 /* An authenticated combination key has sufficient security for
943 security level 3. */
944 if ((conn->key_type == HCI_LK_AUTH_COMBINATION_P192 ||
945 conn->key_type == HCI_LK_AUTH_COMBINATION_P256) &&
946 sec_level == BT_SECURITY_HIGH)
947 goto encrypt;
948
949 /* An unauthenticated combination key has sufficient security for
950 security level 1 and 2. */
951 if ((conn->key_type == HCI_LK_UNAUTH_COMBINATION_P192 ||
952 conn->key_type == HCI_LK_UNAUTH_COMBINATION_P256) &&
953 (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW))
954 goto encrypt;
955
956 /* A combination key has always sufficient security for the security
957 levels 1 or 2. High security level requires the combination key
958 is generated using maximum PIN code length (16).
959 For pre 2.1 units. */
960 if (conn->key_type == HCI_LK_COMBINATION &&
961 (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW ||
962 conn->pin_length == 16))
963 goto encrypt;
964
965 auth:
966 if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags))
967 return 0;
968
969 if (!hci_conn_auth(conn, sec_level, auth_type))
970 return 0;
971
972 encrypt:
973 if (conn->link_mode & HCI_LM_ENCRYPT)
974 return 1;
975
976 hci_conn_encrypt(conn);
977 return 0;
978 }
979 EXPORT_SYMBOL(hci_conn_security);
980
981 /* Check secure link requirement */
982 int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level)
983 {
984 BT_DBG("hcon %p", conn);
985
986 /* Accept if non-secure or higher security level is required */
987 if (sec_level != BT_SECURITY_HIGH && sec_level != BT_SECURITY_FIPS)
988 return 1;
989
990 /* Accept if secure or higher security level is already present */
991 if (conn->sec_level == BT_SECURITY_HIGH ||
992 conn->sec_level == BT_SECURITY_FIPS)
993 return 1;
994
995 /* Reject not secure link */
996 return 0;
997 }
998 EXPORT_SYMBOL(hci_conn_check_secure);
999
1000 /* Change link key */
1001 int hci_conn_change_link_key(struct hci_conn *conn)
1002 {
1003 BT_DBG("hcon %p", conn);
1004
1005 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
1006 struct hci_cp_change_conn_link_key cp;
1007 cp.handle = cpu_to_le16(conn->handle);
1008 hci_send_cmd(conn->hdev, HCI_OP_CHANGE_CONN_LINK_KEY,
1009 sizeof(cp), &cp);
1010 }
1011
1012 return 0;
1013 }
1014
1015 /* Switch role */
1016 int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
1017 {
1018 BT_DBG("hcon %p", conn);
1019
1020 if (!role && conn->link_mode & HCI_LM_MASTER)
1021 return 1;
1022
1023 if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->flags)) {
1024 struct hci_cp_switch_role cp;
1025 bacpy(&cp.bdaddr, &conn->dst);
1026 cp.role = role;
1027 hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
1028 }
1029
1030 return 0;
1031 }
1032 EXPORT_SYMBOL(hci_conn_switch_role);
1033
1034 /* Enter active mode */
1035 void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
1036 {
1037 struct hci_dev *hdev = conn->hdev;
1038
1039 BT_DBG("hcon %p mode %d", conn, conn->mode);
1040
1041 if (test_bit(HCI_RAW, &hdev->flags))
1042 return;
1043
1044 if (conn->mode != HCI_CM_SNIFF)
1045 goto timer;
1046
1047 if (!test_bit(HCI_CONN_POWER_SAVE, &conn->flags) && !force_active)
1048 goto timer;
1049
1050 if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
1051 struct hci_cp_exit_sniff_mode cp;
1052 cp.handle = cpu_to_le16(conn->handle);
1053 hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
1054 }
1055
1056 timer:
1057 if (hdev->idle_timeout > 0)
1058 queue_delayed_work(hdev->workqueue, &conn->idle_work,
1059 msecs_to_jiffies(hdev->idle_timeout));
1060 }
1061
1062 /* Drop all connection on the device */
1063 void hci_conn_hash_flush(struct hci_dev *hdev)
1064 {
1065 struct hci_conn_hash *h = &hdev->conn_hash;
1066 struct hci_conn *c, *n;
1067
1068 BT_DBG("hdev %s", hdev->name);
1069
1070 list_for_each_entry_safe(c, n, &h->list, list) {
1071 c->state = BT_CLOSED;
1072
1073 hci_proto_disconn_cfm(c, HCI_ERROR_LOCAL_HOST_TERM);
1074 hci_conn_del(c);
1075 }
1076 }
1077
1078 /* Check pending connect attempts */
1079 void hci_conn_check_pending(struct hci_dev *hdev)
1080 {
1081 struct hci_conn *conn;
1082
1083 BT_DBG("hdev %s", hdev->name);
1084
1085 hci_dev_lock(hdev);
1086
1087 conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
1088 if (conn)
1089 hci_acl_create_connection(conn);
1090
1091 hci_dev_unlock(hdev);
1092 }
1093
1094 int hci_get_conn_list(void __user *arg)
1095 {
1096 struct hci_conn *c;
1097 struct hci_conn_list_req req, *cl;
1098 struct hci_conn_info *ci;
1099 struct hci_dev *hdev;
1100 int n = 0, size, err;
1101
1102 if (copy_from_user(&req, arg, sizeof(req)))
1103 return -EFAULT;
1104
1105 if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
1106 return -EINVAL;
1107
1108 size = sizeof(req) + req.conn_num * sizeof(*ci);
1109
1110 cl = kmalloc(size, GFP_KERNEL);
1111 if (!cl)
1112 return -ENOMEM;
1113
1114 hdev = hci_dev_get(req.dev_id);
1115 if (!hdev) {
1116 kfree(cl);
1117 return -ENODEV;
1118 }
1119
1120 ci = cl->conn_info;
1121
1122 hci_dev_lock(hdev);
1123 list_for_each_entry(c, &hdev->conn_hash.list, list) {
1124 bacpy(&(ci + n)->bdaddr, &c->dst);
1125 (ci + n)->handle = c->handle;
1126 (ci + n)->type = c->type;
1127 (ci + n)->out = c->out;
1128 (ci + n)->state = c->state;
1129 (ci + n)->link_mode = c->link_mode;
1130 if (++n >= req.conn_num)
1131 break;
1132 }
1133 hci_dev_unlock(hdev);
1134
1135 cl->dev_id = hdev->id;
1136 cl->conn_num = n;
1137 size = sizeof(req) + n * sizeof(*ci);
1138
1139 hci_dev_put(hdev);
1140
1141 err = copy_to_user(arg, cl, size);
1142 kfree(cl);
1143
1144 return err ? -EFAULT : 0;
1145 }
1146
1147 int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
1148 {
1149 struct hci_conn_info_req req;
1150 struct hci_conn_info ci;
1151 struct hci_conn *conn;
1152 char __user *ptr = arg + sizeof(req);
1153
1154 if (copy_from_user(&req, arg, sizeof(req)))
1155 return -EFAULT;
1156
1157 hci_dev_lock(hdev);
1158 conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
1159 if (conn) {
1160 bacpy(&ci.bdaddr, &conn->dst);
1161 ci.handle = conn->handle;
1162 ci.type = conn->type;
1163 ci.out = conn->out;
1164 ci.state = conn->state;
1165 ci.link_mode = conn->link_mode;
1166 }
1167 hci_dev_unlock(hdev);
1168
1169 if (!conn)
1170 return -ENOENT;
1171
1172 return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
1173 }
1174
1175 int hci_get_auth_info(struct hci_dev *hdev, void __user *arg)
1176 {
1177 struct hci_auth_info_req req;
1178 struct hci_conn *conn;
1179
1180 if (copy_from_user(&req, arg, sizeof(req)))
1181 return -EFAULT;
1182
1183 hci_dev_lock(hdev);
1184 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr);
1185 if (conn)
1186 req.type = conn->auth_type;
1187 hci_dev_unlock(hdev);
1188
1189 if (!conn)
1190 return -ENOENT;
1191
1192 return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0;
1193 }
1194
1195 struct hci_chan *hci_chan_create(struct hci_conn *conn)
1196 {
1197 struct hci_dev *hdev = conn->hdev;
1198 struct hci_chan *chan;
1199
1200 BT_DBG("%s hcon %p", hdev->name, conn);
1201
1202 chan = kzalloc(sizeof(struct hci_chan), GFP_KERNEL);
1203 if (!chan)
1204 return NULL;
1205
1206 chan->conn = conn;
1207 skb_queue_head_init(&chan->data_q);
1208 chan->state = BT_CONNECTED;
1209
1210 list_add_rcu(&chan->list, &conn->chan_list);
1211
1212 return chan;
1213 }
1214
1215 void hci_chan_del(struct hci_chan *chan)
1216 {
1217 struct hci_conn *conn = chan->conn;
1218 struct hci_dev *hdev = conn->hdev;
1219
1220 BT_DBG("%s hcon %p chan %p", hdev->name, conn, chan);
1221
1222 list_del_rcu(&chan->list);
1223
1224 synchronize_rcu();
1225
1226 hci_conn_drop(conn);
1227
1228 skb_queue_purge(&chan->data_q);
1229 kfree(chan);
1230 }
1231
1232 void hci_chan_list_flush(struct hci_conn *conn)
1233 {
1234 struct hci_chan *chan, *n;
1235
1236 BT_DBG("hcon %p", conn);
1237
1238 list_for_each_entry_safe(chan, n, &conn->chan_list, list)
1239 hci_chan_del(chan);
1240 }
1241
1242 static struct hci_chan *__hci_chan_lookup_handle(struct hci_conn *hcon,
1243 __u16 handle)
1244 {
1245 struct hci_chan *hchan;
1246
1247 list_for_each_entry(hchan, &hcon->chan_list, list) {
1248 if (hchan->handle == handle)
1249 return hchan;
1250 }
1251
1252 return NULL;
1253 }
1254
1255 struct hci_chan *hci_chan_lookup_handle(struct hci_dev *hdev, __u16 handle)
1256 {
1257 struct hci_conn_hash *h = &hdev->conn_hash;
1258 struct hci_conn *hcon;
1259 struct hci_chan *hchan = NULL;
1260
1261 rcu_read_lock();
1262
1263 list_for_each_entry_rcu(hcon, &h->list, list) {
1264 hchan = __hci_chan_lookup_handle(hcon, handle);
1265 if (hchan)
1266 break;
1267 }
1268
1269 rcu_read_unlock();
1270
1271 return hchan;
1272 }
Linux kernel - Deliverables
This page took 0.109048 seconds and 6 git commands to generate.