1/*
2   BlueZ - Bluetooth protocol stack for Linux
3   Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
4
5   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
6
7   This program is free software; you can redistribute it and/or modify
8   it under the terms of the GNU General Public License version 2 as
9   published by the Free Software Foundation;
10
11   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
20   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22   SOFTWARE IS DISCLAIMED.
23*/
24
25/* Bluetooth HCI connection handling. */
26
27#include <linux/export.h>
28#include <linux/debugfs.h>
29
30#include <net/bluetooth/bluetooth.h>
31#include <net/bluetooth/hci_core.h>
32#include <net/bluetooth/l2cap.h>
33
34#include "hci_request.h"
35#include "smp.h"
36#include "a2mp.h"
37
38struct sco_param {
39	u16 pkt_type;
40	u16 max_latency;
41	u8  retrans_effort;
42};
43
44static const struct sco_param esco_param_cvsd[] = {
45	{ EDR_ESCO_MASK & ~ESCO_2EV3, 0x000a,	0x01 }, /* S3 */
46	{ EDR_ESCO_MASK & ~ESCO_2EV3, 0x0007,	0x01 }, /* S2 */
47	{ EDR_ESCO_MASK | ESCO_EV3,   0x0007,	0x01 }, /* S1 */
48	{ EDR_ESCO_MASK | ESCO_HV3,   0xffff,	0x01 }, /* D1 */
49	{ EDR_ESCO_MASK | ESCO_HV1,   0xffff,	0x01 }, /* D0 */
50};
51
52static const struct sco_param sco_param_cvsd[] = {
53	{ EDR_ESCO_MASK | ESCO_HV3,   0xffff,	0xff }, /* D1 */
54	{ EDR_ESCO_MASK | ESCO_HV1,   0xffff,	0xff }, /* D0 */
55};
56
57static const struct sco_param esco_param_msbc[] = {
58	{ EDR_ESCO_MASK & ~ESCO_2EV3, 0x000d,	0x02 }, /* T2 */
59	{ EDR_ESCO_MASK | ESCO_EV3,   0x0008,	0x02 }, /* T1 */
60};
61
62/* This function requires the caller holds hdev->lock */
63static void hci_connect_le_scan_cleanup(struct hci_conn *conn)
64{
65	struct hci_conn_params *params;
66	struct hci_dev *hdev = conn->hdev;
67	struct smp_irk *irk;
68	bdaddr_t *bdaddr;
69	u8 bdaddr_type;
70
71	bdaddr = &conn->dst;
72	bdaddr_type = conn->dst_type;
73
74	/* Check if we need to convert to identity address */
75	irk = hci_get_irk(hdev, bdaddr, bdaddr_type);
76	if (irk) {
77		bdaddr = &irk->bdaddr;
78		bdaddr_type = irk->addr_type;
79	}
80
81	params = hci_pend_le_action_lookup(&hdev->pend_le_conns, bdaddr,
82					   bdaddr_type);
83	if (!params || !params->explicit_connect)
84		return;
85
86	/* The connection attempt was doing scan for new RPA, and is
87	 * in scan phase. If params are not associated with any other
88	 * autoconnect action, remove them completely. If they are, just unmark
89	 * them as waiting for connection, by clearing explicit_connect field.
90	 */
91	params->explicit_connect = false;
92
93	list_del_init(&params->action);
94
95	switch (params->auto_connect) {
96	case HCI_AUTO_CONN_EXPLICIT:
97		hci_conn_params_del(hdev, bdaddr, bdaddr_type);
98		/* return instead of break to avoid duplicate scan update */
99		return;
100	case HCI_AUTO_CONN_DIRECT:
101	case HCI_AUTO_CONN_ALWAYS:
102		list_add(&params->action, &hdev->pend_le_conns);
103		break;
104	case HCI_AUTO_CONN_REPORT:
105		list_add(&params->action, &hdev->pend_le_reports);
106		break;
107	default:
108		break;
109	}
110
111	hci_update_background_scan(hdev);
112}
113
114static void hci_conn_cleanup(struct hci_conn *conn)
115{
116	struct hci_dev *hdev = conn->hdev;
117
118	if (test_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags))
119		hci_conn_params_del(conn->hdev, &conn->dst, conn->dst_type);
120
121	hci_chan_list_flush(conn);
122
123	hci_conn_hash_del(hdev, conn);
124
125	if (conn->type == SCO_LINK || conn->type == ESCO_LINK) {
126		switch (conn->setting & SCO_AIRMODE_MASK) {
127		case SCO_AIRMODE_CVSD:
128		case SCO_AIRMODE_TRANSP:
129			if (hdev->notify)
130				hdev->notify(hdev, HCI_NOTIFY_DISABLE_SCO);
131			break;
132		}
133	} else {
134		if (hdev->notify)
135			hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
136	}
137
138	debugfs_remove_recursive(conn->debugfs);
139
140	hci_conn_del_sysfs(conn);
141
142	hci_dev_put(hdev);
143}
144
145static void le_scan_cleanup(struct work_struct *work)
146{
147	struct hci_conn *conn = container_of(work, struct hci_conn,
148					     le_scan_cleanup);
149	struct hci_dev *hdev = conn->hdev;
150	struct hci_conn *c = NULL;
151
152	BT_DBG("%s hcon %p", hdev->name, conn);
153
154	hci_dev_lock(hdev);
155
156	/* Check that the hci_conn is still around */
157	rcu_read_lock();
158	list_for_each_entry_rcu(c, &hdev->conn_hash.list, list) {
159		if (c == conn)
160			break;
161	}
162	rcu_read_unlock();
163
164	if (c == conn) {
165		hci_connect_le_scan_cleanup(conn);
166		hci_conn_cleanup(conn);
167	}
168
169	hci_dev_unlock(hdev);
170	hci_dev_put(hdev);
171	hci_conn_put(conn);
172}
173
174static void hci_connect_le_scan_remove(struct hci_conn *conn)
175{
176	BT_DBG("%s hcon %p", conn->hdev->name, conn);
177
178	/* We can't call hci_conn_del/hci_conn_cleanup here since that
179	 * could deadlock with another hci_conn_del() call that's holding
180	 * hci_dev_lock and doing cancel_delayed_work_sync(&conn->disc_work).
181	 * Instead, grab temporary extra references to the hci_dev and
182	 * hci_conn and perform the necessary cleanup in a separate work
183	 * callback.
184	 */
185
186	hci_dev_hold(conn->hdev);
187	hci_conn_get(conn);
188
189	/* Even though we hold a reference to the hdev, many other
190	 * things might get cleaned up meanwhile, including the hdev's
191	 * own workqueue, so we can't use that for scheduling.
192	 */
193	schedule_work(&conn->le_scan_cleanup);
194}
195
196static void hci_acl_create_connection(struct hci_conn *conn)
197{
198	struct hci_dev *hdev = conn->hdev;
199	struct inquiry_entry *ie;
200	struct hci_cp_create_conn cp;
201
202	BT_DBG("hcon %p", conn);
203
204	conn->state = BT_CONNECT;
205	conn->out = true;
206	conn->role = HCI_ROLE_MASTER;
207
208	conn->attempt++;
209
210	conn->link_policy = hdev->link_policy;
211
212	memset(&cp, 0, sizeof(cp));
213	bacpy(&cp.bdaddr, &conn->dst);
214	cp.pscan_rep_mode = 0x02;
215
216	ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
217	if (ie) {
218		if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
219			cp.pscan_rep_mode = ie->data.pscan_rep_mode;
220			cp.pscan_mode     = ie->data.pscan_mode;
221			cp.clock_offset   = ie->data.clock_offset |
222					    cpu_to_le16(0x8000);
223		}
224
225		memcpy(conn->dev_class, ie->data.dev_class, 3);
226	}
227
228	cp.pkt_type = cpu_to_le16(conn->pkt_type);
229	if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
230		cp.role_switch = 0x01;
231	else
232		cp.role_switch = 0x00;
233
234	hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
235}
236
237int hci_disconnect(struct hci_conn *conn, __u8 reason)
238{
239	BT_DBG("hcon %p", conn);
240
241	/* When we are central of an established connection and it enters
242	 * the disconnect timeout, then go ahead and try to read the
243	 * current clock offset.  Processing of the result is done
244	 * within the event handling and hci_clock_offset_evt function.
245	 */
246	if (conn->type == ACL_LINK && conn->role == HCI_ROLE_MASTER &&
247	    (conn->state == BT_CONNECTED || conn->state == BT_CONFIG)) {
248		struct hci_dev *hdev = conn->hdev;
249		struct hci_cp_read_clock_offset clkoff_cp;
250
251		clkoff_cp.handle = cpu_to_le16(conn->handle);
252		hci_send_cmd(hdev, HCI_OP_READ_CLOCK_OFFSET, sizeof(clkoff_cp),
253			     &clkoff_cp);
254	}
255
256	return hci_abort_conn(conn, reason);
257}
258
259static void hci_add_sco(struct hci_conn *conn, __u16 handle)
260{
261	struct hci_dev *hdev = conn->hdev;
262	struct hci_cp_add_sco cp;
263
264	BT_DBG("hcon %p", conn);
265
266	conn->state = BT_CONNECT;
267	conn->out = true;
268
269	conn->attempt++;
270
271	cp.handle   = cpu_to_le16(handle);
272	cp.pkt_type = cpu_to_le16(conn->pkt_type);
273
274	hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
275}
276
277bool hci_setup_sync(struct hci_conn *conn, __u16 handle)
278{
279	struct hci_dev *hdev = conn->hdev;
280	struct hci_cp_setup_sync_conn cp;
281	const struct sco_param *param;
282
283	BT_DBG("hcon %p", conn);
284
285	conn->state = BT_CONNECT;
286	conn->out = true;
287
288	conn->attempt++;
289
290	cp.handle   = cpu_to_le16(handle);
291
292	cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
293	cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
294	cp.voice_setting  = cpu_to_le16(conn->setting);
295
296	switch (conn->setting & SCO_AIRMODE_MASK) {
297	case SCO_AIRMODE_TRANSP:
298		if (conn->attempt > ARRAY_SIZE(esco_param_msbc))
299			return false;
300		param = &esco_param_msbc[conn->attempt - 1];
301		break;
302	case SCO_AIRMODE_CVSD:
303		if (lmp_esco_capable(conn->link)) {
304			if (conn->attempt > ARRAY_SIZE(esco_param_cvsd))
305				return false;
306			param = &esco_param_cvsd[conn->attempt - 1];
307		} else {
308			if (conn->attempt > ARRAY_SIZE(sco_param_cvsd))
309				return false;
310			param = &sco_param_cvsd[conn->attempt - 1];
311		}
312		break;
313	default:
314		return false;
315	}
316
317	cp.retrans_effort = param->retrans_effort;
318	cp.pkt_type = __cpu_to_le16(param->pkt_type);
319	cp.max_latency = __cpu_to_le16(param->max_latency);
320
321	if (hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp) < 0)
322		return false;
323
324	return true;
325}
326
327u8 hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max, u16 latency,
328		      u16 to_multiplier)
329{
330	struct hci_dev *hdev = conn->hdev;
331	struct hci_conn_params *params;
332	struct hci_cp_le_conn_update cp;
333
334	hci_dev_lock(hdev);
335
336	params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
337	if (params) {
338		params->conn_min_interval = min;
339		params->conn_max_interval = max;
340		params->conn_latency = latency;
341		params->supervision_timeout = to_multiplier;
342	}
343
344	hci_dev_unlock(hdev);
345
346	memset(&cp, 0, sizeof(cp));
347	cp.handle		= cpu_to_le16(conn->handle);
348	cp.conn_interval_min	= cpu_to_le16(min);
349	cp.conn_interval_max	= cpu_to_le16(max);
350	cp.conn_latency		= cpu_to_le16(latency);
351	cp.supervision_timeout	= cpu_to_le16(to_multiplier);
352	cp.min_ce_len		= cpu_to_le16(0x0000);
353	cp.max_ce_len		= cpu_to_le16(0x0000);
354
355	hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp);
356
357	if (params)
358		return 0x01;
359
360	return 0x00;
361}
362
363void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __le64 rand,
364		      __u8 ltk[16], __u8 key_size)
365{
366	struct hci_dev *hdev = conn->hdev;
367	struct hci_cp_le_start_enc cp;
368
369	BT_DBG("hcon %p", conn);
370
371	memset(&cp, 0, sizeof(cp));
372
373	cp.handle = cpu_to_le16(conn->handle);
374	cp.rand = rand;
375	cp.ediv = ediv;
376	memcpy(cp.ltk, ltk, key_size);
377
378	hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp);
379}
380
381/* Device _must_ be locked */
382void hci_sco_setup(struct hci_conn *conn, __u8 status)
383{
384	struct hci_conn *sco = conn->link;
385
386	if (!sco)
387		return;
388
389	BT_DBG("hcon %p", conn);
390
391	if (!status) {
392		if (lmp_esco_capable(conn->hdev))
393			hci_setup_sync(sco, conn->handle);
394		else
395			hci_add_sco(sco, conn->handle);
396	} else {
397		hci_connect_cfm(sco, status);
398		hci_conn_del(sco);
399	}
400}
401
402static void hci_conn_timeout(struct work_struct *work)
403{
404	struct hci_conn *conn = container_of(work, struct hci_conn,
405					     disc_work.work);
406	int refcnt = atomic_read(&conn->refcnt);
407
408	BT_DBG("hcon %p state %s", conn, state_to_string(conn->state));
409
410	WARN_ON(refcnt < 0);
411
412	/* FIXME: It was observed that in pairing failed scenario, refcnt
413	 * drops below 0. Probably this is because l2cap_conn_del calls
414	 * l2cap_chan_del for each channel, and inside l2cap_chan_del conn is
415	 * dropped. After that loop hci_chan_del is called which also drops
416	 * conn. For now make sure that ACL is alive if refcnt is higher then 0,
417	 * otherwise drop it.
418	 */
419	if (refcnt > 0)
420		return;
421
422	/* LE connections in scanning state need special handling */
423	if (conn->state == BT_CONNECT && conn->type == LE_LINK &&
424	    test_bit(HCI_CONN_SCANNING, &conn->flags)) {
425		hci_connect_le_scan_remove(conn);
426		return;
427	}
428
429	hci_abort_conn(conn, hci_proto_disconn_ind(conn));
430}
431
432/* Enter sniff mode */
433static void hci_conn_idle(struct work_struct *work)
434{
435	struct hci_conn *conn = container_of(work, struct hci_conn,
436					     idle_work.work);
437	struct hci_dev *hdev = conn->hdev;
438
439	BT_DBG("hcon %p mode %d", conn, conn->mode);
440
441	if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn))
442		return;
443
444	if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF))
445		return;
446
447	if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
448		struct hci_cp_sniff_subrate cp;
449		cp.handle             = cpu_to_le16(conn->handle);
450		cp.max_latency        = cpu_to_le16(0);
451		cp.min_remote_timeout = cpu_to_le16(0);
452		cp.min_local_timeout  = cpu_to_le16(0);
453		hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
454	}
455
456	if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
457		struct hci_cp_sniff_mode cp;
458		cp.handle       = cpu_to_le16(conn->handle);
459		cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
460		cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
461		cp.attempt      = cpu_to_le16(4);
462		cp.timeout      = cpu_to_le16(1);
463		hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
464	}
465}
466
467static void hci_conn_auto_accept(struct work_struct *work)
468{
469	struct hci_conn *conn = container_of(work, struct hci_conn,
470					     auto_accept_work.work);
471
472	hci_send_cmd(conn->hdev, HCI_OP_USER_CONFIRM_REPLY, sizeof(conn->dst),
473		     &conn->dst);
474}
475
476static void le_disable_advertising(struct hci_dev *hdev)
477{
478	if (ext_adv_capable(hdev)) {
479		struct hci_cp_le_set_ext_adv_enable cp;
480
481		cp.enable = 0x00;
482		cp.num_of_sets = 0x00;
483
484		hci_send_cmd(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE, sizeof(cp),
485			     &cp);
486	} else {
487		u8 enable = 0x00;
488		hci_send_cmd(hdev, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable),
489			     &enable);
490	}
491}
492
493static void le_conn_timeout(struct work_struct *work)
494{
495	struct hci_conn *conn = container_of(work, struct hci_conn,
496					     le_conn_timeout.work);
497	struct hci_dev *hdev = conn->hdev;
498
499	BT_DBG("");
500
501	/* We could end up here due to having done directed advertising,
502	 * so clean up the state if necessary. This should however only
503	 * happen with broken hardware or if low duty cycle was used
504	 * (which doesn't have a timeout of its own).
505	 */
506	if (conn->role == HCI_ROLE_SLAVE) {
507		/* Disable LE Advertising */
508		le_disable_advertising(hdev);
509		hci_dev_lock(hdev);
510		hci_le_conn_failed(conn, HCI_ERROR_ADVERTISING_TIMEOUT);
511		hci_dev_unlock(hdev);
512		return;
513	}
514
515	hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
516}
517
518struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst,
519			      u8 role)
520{
521	struct hci_conn *conn;
522
523	BT_DBG("%s dst %pMR", hdev->name, dst);
524
525	conn = kzalloc(sizeof(*conn), GFP_KERNEL);
526	if (!conn)
527		return NULL;
528
529	bacpy(&conn->dst, dst);
530	bacpy(&conn->src, &hdev->bdaddr);
531	conn->hdev  = hdev;
532	conn->type  = type;
533	conn->role  = role;
534	conn->mode  = HCI_CM_ACTIVE;
535	conn->state = BT_OPEN;
536	conn->auth_type = HCI_AT_GENERAL_BONDING;
537	conn->io_capability = hdev->io_capability;
538	conn->remote_auth = 0xff;
539	conn->key_type = 0xff;
540	conn->rssi = HCI_RSSI_INVALID;
541	conn->tx_power = HCI_TX_POWER_INVALID;
542	conn->max_tx_power = HCI_TX_POWER_INVALID;
543
544	set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
545	conn->disc_timeout = HCI_DISCONN_TIMEOUT;
546
547	/* Set Default Authenticated payload timeout to 30s */
548	conn->auth_payload_timeout = DEFAULT_AUTH_PAYLOAD_TIMEOUT;
549
550	if (conn->role == HCI_ROLE_MASTER)
551		conn->out = true;
552
553	switch (type) {
554	case ACL_LINK:
555		conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
556		break;
557	case LE_LINK:
558		/* conn->src should reflect the local identity address */
559		hci_copy_identity_address(hdev, &conn->src, &conn->src_type);
560		break;
561	case SCO_LINK:
562		if (lmp_esco_capable(hdev))
563			conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
564					(hdev->esco_type & EDR_ESCO_MASK);
565		else
566			conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
567		break;
568	case ESCO_LINK:
569		conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
570		break;
571	}
572
573	skb_queue_head_init(&conn->data_q);
574
575	INIT_LIST_HEAD(&conn->chan_list);
576
577	INIT_DELAYED_WORK(&conn->disc_work, hci_conn_timeout);
578	INIT_DELAYED_WORK(&conn->auto_accept_work, hci_conn_auto_accept);
579	INIT_DELAYED_WORK(&conn->idle_work, hci_conn_idle);
580	INIT_DELAYED_WORK(&conn->le_conn_timeout, le_conn_timeout);
581	INIT_WORK(&conn->le_scan_cleanup, le_scan_cleanup);
582
583	atomic_set(&conn->refcnt, 0);
584
585	hci_dev_hold(hdev);
586
587	hci_conn_hash_add(hdev, conn);
588
589	/* The SCO and eSCO connections will only be notified when their
590	 * setup has been completed. This is different to ACL links which
591	 * can be notified right away.
592	 */
593	if (conn->type != SCO_LINK && conn->type != ESCO_LINK) {
594		if (hdev->notify)
595			hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
596	}
597
598	hci_conn_init_sysfs(conn);
599
600	return conn;
601}
602
603int hci_conn_del(struct hci_conn *conn)
604{
605	struct hci_dev *hdev = conn->hdev;
606
607	BT_DBG("%s hcon %p handle %d", hdev->name, conn, conn->handle);
608
609	cancel_delayed_work_sync(&conn->disc_work);
610	cancel_delayed_work_sync(&conn->auto_accept_work);
611	cancel_delayed_work_sync(&conn->idle_work);
612
613	if (conn->type == ACL_LINK) {
614		struct hci_conn *sco = conn->link;
615		if (sco)
616			sco->link = NULL;
617
618		/* Unacked frames */
619		hdev->acl_cnt += conn->sent;
620	} else if (conn->type == LE_LINK) {
621		cancel_delayed_work(&conn->le_conn_timeout);
622
623		if (hdev->le_pkts)
624			hdev->le_cnt += conn->sent;
625		else
626			hdev->acl_cnt += conn->sent;
627	} else {
628		struct hci_conn *acl = conn->link;
629		if (acl) {
630			acl->link = NULL;
631			hci_conn_drop(acl);
632		}
633	}
634
635	if (conn->amp_mgr)
636		amp_mgr_put(conn->amp_mgr);
637
638	skb_queue_purge(&conn->data_q);
639
640	/* Remove the connection from the list and cleanup its remaining
641	 * state. This is a separate function since for some cases like
642	 * BT_CONNECT_SCAN we *only* want the cleanup part without the
643	 * rest of hci_conn_del.
644	 */
645	hci_conn_cleanup(conn);
646
647	return 0;
648}
649
650struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src, uint8_t src_type)
651{
652	int use_src = bacmp(src, BDADDR_ANY);
653	struct hci_dev *hdev = NULL, *d;
654
655	BT_DBG("%pMR -> %pMR", src, dst);
656
657	read_lock(&hci_dev_list_lock);
658
659	list_for_each_entry(d, &hci_dev_list, list) {
660		if (!test_bit(HCI_UP, &d->flags) ||
661		    hci_dev_test_flag(d, HCI_USER_CHANNEL) ||
662		    d->dev_type != HCI_PRIMARY)
663			continue;
664
665		/* Simple routing:
666		 *   No source address - find interface with bdaddr != dst
667		 *   Source address    - find interface with bdaddr == src
668		 */
669
670		if (use_src) {
671			bdaddr_t id_addr;
672			u8 id_addr_type;
673
674			if (src_type == BDADDR_BREDR) {
675				if (!lmp_bredr_capable(d))
676					continue;
677				bacpy(&id_addr, &d->bdaddr);
678				id_addr_type = BDADDR_BREDR;
679			} else {
680				if (!lmp_le_capable(d))
681					continue;
682
683				hci_copy_identity_address(d, &id_addr,
684							  &id_addr_type);
685
686				/* Convert from HCI to three-value type */
687				if (id_addr_type == ADDR_LE_DEV_PUBLIC)
688					id_addr_type = BDADDR_LE_PUBLIC;
689				else
690					id_addr_type = BDADDR_LE_RANDOM;
691			}
692
693			if (!bacmp(&id_addr, src) && id_addr_type == src_type) {
694				hdev = d; break;
695			}
696		} else {
697			if (bacmp(&d->bdaddr, dst)) {
698				hdev = d; break;
699			}
700		}
701	}
702
703	if (hdev)
704		hdev = hci_dev_hold(hdev);
705
706	read_unlock(&hci_dev_list_lock);
707	return hdev;
708}
709EXPORT_SYMBOL(hci_get_route);
710
711/* This function requires the caller holds hdev->lock */
712void hci_le_conn_failed(struct hci_conn *conn, u8 status)
713{
714	struct hci_dev *hdev = conn->hdev;
715	struct hci_conn_params *params;
716
717	params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
718					   conn->dst_type);
719	if (params && params->conn) {
720		hci_conn_drop(params->conn);
721		hci_conn_put(params->conn);
722		params->conn = NULL;
723	}
724
725	conn->state = BT_CLOSED;
726
727	/* If the status indicates successful cancellation of
728	 * the attempt (i.e. Unkown Connection Id) there's no point of
729	 * notifying failure since we'll go back to keep trying to
730	 * connect. The only exception is explicit connect requests
731	 * where a timeout + cancel does indicate an actual failure.
732	 */
733	if (status != HCI_ERROR_UNKNOWN_CONN_ID ||
734	    (params && params->explicit_connect))
735		mgmt_connect_failed(hdev, &conn->dst, conn->type,
736				    conn->dst_type, status);
737
738	hci_connect_cfm(conn, status);
739
740	hci_conn_del(conn);
741
742	/* Since we may have temporarily stopped the background scanning in
743	 * favor of connection establishment, we should restart it.
744	 */
745	hci_update_background_scan(hdev);
746
747	/* Re-enable advertising in case this was a failed connection
748	 * attempt as a peripheral.
749	 */
750	hci_req_reenable_advertising(hdev);
751}
752
753static void create_le_conn_complete(struct hci_dev *hdev, u8 status, u16 opcode)
754{
755	struct hci_conn *conn;
756
757	hci_dev_lock(hdev);
758
759	conn = hci_lookup_le_connect(hdev);
760
761	if (!status) {
762		hci_connect_le_scan_cleanup(conn);
763		goto done;
764	}
765
766	bt_dev_err(hdev, "request failed to create LE connection: "
767		   "status 0x%2.2x", status);
768
769	if (!conn)
770		goto done;
771
772	hci_le_conn_failed(conn, status);
773
774done:
775	hci_dev_unlock(hdev);
776}
777
778static bool conn_use_rpa(struct hci_conn *conn)
779{
780	struct hci_dev *hdev = conn->hdev;
781
782	return hci_dev_test_flag(hdev, HCI_PRIVACY);
783}
784
785static void set_ext_conn_params(struct hci_conn *conn,
786				struct hci_cp_le_ext_conn_param *p)
787{
788	struct hci_dev *hdev = conn->hdev;
789
790	memset(p, 0, sizeof(*p));
791
792	p->scan_interval = cpu_to_le16(hdev->le_scan_int_connect);
793	p->scan_window = cpu_to_le16(hdev->le_scan_window_connect);
794	p->conn_interval_min = cpu_to_le16(conn->le_conn_min_interval);
795	p->conn_interval_max = cpu_to_le16(conn->le_conn_max_interval);
796	p->conn_latency = cpu_to_le16(conn->le_conn_latency);
797	p->supervision_timeout = cpu_to_le16(conn->le_supv_timeout);
798	p->min_ce_len = cpu_to_le16(0x0000);
799	p->max_ce_len = cpu_to_le16(0x0000);
800}
801
802static void hci_req_add_le_create_conn(struct hci_request *req,
803				       struct hci_conn *conn,
804				       bdaddr_t *direct_rpa)
805{
806	struct hci_dev *hdev = conn->hdev;
807	u8 own_addr_type;
808
809	/* If direct address was provided we use it instead of current
810	 * address.
811	 */
812	if (direct_rpa) {
813		if (bacmp(&req->hdev->random_addr, direct_rpa))
814			hci_req_add(req, HCI_OP_LE_SET_RANDOM_ADDR, 6,
815								direct_rpa);
816
817		/* direct address is always RPA */
818		own_addr_type = ADDR_LE_DEV_RANDOM;
819	} else {
820		/* Update random address, but set require_privacy to false so
821		 * that we never connect with an non-resolvable address.
822		 */
823		if (hci_update_random_address(req, false, conn_use_rpa(conn),
824					      &own_addr_type))
825			return;
826	}
827
828	if (use_ext_conn(hdev)) {
829		struct hci_cp_le_ext_create_conn *cp;
830		struct hci_cp_le_ext_conn_param *p;
831		u8 data[sizeof(*cp) + sizeof(*p) * 3];
832		u32 plen;
833
834		cp = (void *) data;
835		p = (void *) cp->data;
836
837		memset(cp, 0, sizeof(*cp));
838
839		bacpy(&cp->peer_addr, &conn->dst);
840		cp->peer_addr_type = conn->dst_type;
841		cp->own_addr_type = own_addr_type;
842
843		plen = sizeof(*cp);
844
845		if (scan_1m(hdev)) {
846			cp->phys |= LE_SCAN_PHY_1M;
847			set_ext_conn_params(conn, p);
848
849			p++;
850			plen += sizeof(*p);
851		}
852
853		if (scan_2m(hdev)) {
854			cp->phys |= LE_SCAN_PHY_2M;
855			set_ext_conn_params(conn, p);
856
857			p++;
858			plen += sizeof(*p);
859		}
860
861		if (scan_coded(hdev)) {
862			cp->phys |= LE_SCAN_PHY_CODED;
863			set_ext_conn_params(conn, p);
864
865			plen += sizeof(*p);
866		}
867
868		hci_req_add(req, HCI_OP_LE_EXT_CREATE_CONN, plen, data);
869
870	} else {
871		struct hci_cp_le_create_conn cp;
872
873		memset(&cp, 0, sizeof(cp));
874
875		cp.scan_interval = cpu_to_le16(hdev->le_scan_int_connect);
876		cp.scan_window = cpu_to_le16(hdev->le_scan_window_connect);
877
878		bacpy(&cp.peer_addr, &conn->dst);
879		cp.peer_addr_type = conn->dst_type;
880		cp.own_address_type = own_addr_type;
881		cp.conn_interval_min = cpu_to_le16(conn->le_conn_min_interval);
882		cp.conn_interval_max = cpu_to_le16(conn->le_conn_max_interval);
883		cp.conn_latency = cpu_to_le16(conn->le_conn_latency);
884		cp.supervision_timeout = cpu_to_le16(conn->le_supv_timeout);
885		cp.min_ce_len = cpu_to_le16(0x0000);
886		cp.max_ce_len = cpu_to_le16(0x0000);
887
888		hci_req_add(req, HCI_OP_LE_CREATE_CONN, sizeof(cp), &cp);
889	}
890
891	conn->state = BT_CONNECT;
892	clear_bit(HCI_CONN_SCANNING, &conn->flags);
893}
894
895static void hci_req_directed_advertising(struct hci_request *req,
896					 struct hci_conn *conn)
897{
898	struct hci_dev *hdev = req->hdev;
899	u8 own_addr_type;
900	u8 enable;
901
902	if (ext_adv_capable(hdev)) {
903		struct hci_cp_le_set_ext_adv_params cp;
904		bdaddr_t random_addr;
905
906		/* Set require_privacy to false so that the remote device has a
907		 * chance of identifying us.
908		 */
909		if (hci_get_random_address(hdev, false, conn_use_rpa(conn), NULL,
910					   &own_addr_type, &random_addr) < 0)
911			return;
912
913		memset(&cp, 0, sizeof(cp));
914
915		cp.evt_properties = cpu_to_le16(LE_LEGACY_ADV_DIRECT_IND);
916		cp.own_addr_type = own_addr_type;
917		cp.channel_map = hdev->le_adv_channel_map;
918		cp.tx_power = HCI_TX_POWER_INVALID;
919		cp.primary_phy = HCI_ADV_PHY_1M;
920		cp.secondary_phy = HCI_ADV_PHY_1M;
921		cp.handle = 0; /* Use instance 0 for directed adv */
922		cp.own_addr_type = own_addr_type;
923		cp.peer_addr_type = conn->dst_type;
924		bacpy(&cp.peer_addr, &conn->dst);
925
926		/* As per Core Spec 5.2 Vol 2, PART E, Sec 7.8.53, for
927		 * advertising_event_property LE_LEGACY_ADV_DIRECT_IND
928		 * does not supports advertising data when the advertising set already
929		 * contains some, the controller shall return erroc code 'Invalid
930		 * HCI Command Parameters(0x12).
931		 * So it is required to remove adv set for handle 0x00. since we use
932		 * instance 0 for directed adv.
933		 */
934		__hci_req_remove_ext_adv_instance(req, cp.handle);
935
936		hci_req_add(req, HCI_OP_LE_SET_EXT_ADV_PARAMS, sizeof(cp), &cp);
937
938		if (own_addr_type == ADDR_LE_DEV_RANDOM &&
939		    bacmp(&random_addr, BDADDR_ANY) &&
940		    bacmp(&random_addr, &hdev->random_addr)) {
941			struct hci_cp_le_set_adv_set_rand_addr cp;
942
943			memset(&cp, 0, sizeof(cp));
944
945			cp.handle = 0;
946			bacpy(&cp.bdaddr, &random_addr);
947
948			hci_req_add(req,
949				    HCI_OP_LE_SET_ADV_SET_RAND_ADDR,
950				    sizeof(cp), &cp);
951		}
952
953		__hci_req_enable_ext_advertising(req, 0x00);
954	} else {
955		struct hci_cp_le_set_adv_param cp;
956
957		/* Clear the HCI_LE_ADV bit temporarily so that the
958		 * hci_update_random_address knows that it's safe to go ahead
959		 * and write a new random address. The flag will be set back on
960		 * as soon as the SET_ADV_ENABLE HCI command completes.
961		 */
962		hci_dev_clear_flag(hdev, HCI_LE_ADV);
963
964		/* Set require_privacy to false so that the remote device has a
965		 * chance of identifying us.
966		 */
967		if (hci_update_random_address(req, false, conn_use_rpa(conn),
968					      &own_addr_type) < 0)
969			return;
970
971		memset(&cp, 0, sizeof(cp));
972
973		/* Some controllers might reject command if intervals are not
974		 * within range for undirected advertising.
975		 * BCM20702A0 is known to be affected by this.
976		 */
977		cp.min_interval = cpu_to_le16(0x0020);
978		cp.max_interval = cpu_to_le16(0x0020);
979
980		cp.type = LE_ADV_DIRECT_IND;
981		cp.own_address_type = own_addr_type;
982		cp.direct_addr_type = conn->dst_type;
983		bacpy(&cp.direct_addr, &conn->dst);
984		cp.channel_map = hdev->le_adv_channel_map;
985
986		hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
987
988		enable = 0x01;
989		hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable),
990			    &enable);
991	}
992
993	conn->state = BT_CONNECT;
994}
995
996struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,
997				u8 dst_type, u8 sec_level, u16 conn_timeout,
998				u8 role, bdaddr_t *direct_rpa)
999{
1000	struct hci_conn_params *params;
1001	struct hci_conn *conn;
1002	struct smp_irk *irk;
1003	struct hci_request req;
1004	int err;
1005
1006	/* This ensures that during disable le_scan address resolution
1007	 * will not be disabled if it is followed by le_create_conn
1008	 */
1009	bool rpa_le_conn = true;
1010
1011	/* Let's make sure that le is enabled.*/
1012	if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1013		if (lmp_le_capable(hdev))
1014			return ERR_PTR(-ECONNREFUSED);
1015
1016		return ERR_PTR(-EOPNOTSUPP);
1017	}
1018
1019	/* Since the controller supports only one LE connection attempt at a
1020	 * time, we return -EBUSY if there is any connection attempt running.
1021	 */
1022	if (hci_lookup_le_connect(hdev))
1023		return ERR_PTR(-EBUSY);
1024
1025	/* If there's already a connection object but it's not in
1026	 * scanning state it means it must already be established, in
1027	 * which case we can't do anything else except report a failure
1028	 * to connect.
1029	 */
1030	conn = hci_conn_hash_lookup_le(hdev, dst, dst_type);
1031	if (conn && !test_bit(HCI_CONN_SCANNING, &conn->flags)) {
1032		return ERR_PTR(-EBUSY);
1033	}
1034
1035	/* When given an identity address with existing identity
1036	 * resolving key, the connection needs to be established
1037	 * to a resolvable random address.
1038	 *
1039	 * Storing the resolvable random address is required here
1040	 * to handle connection failures. The address will later
1041	 * be resolved back into the original identity address
1042	 * from the connect request.
1043	 */
1044	irk = hci_find_irk_by_addr(hdev, dst, dst_type);
1045	if (irk && bacmp(&irk->rpa, BDADDR_ANY)) {
1046		dst = &irk->rpa;
1047		dst_type = ADDR_LE_DEV_RANDOM;
1048	}
1049
1050	if (conn) {
1051		bacpy(&conn->dst, dst);
1052	} else {
1053		conn = hci_conn_add(hdev, LE_LINK, dst, role);
1054		if (!conn)
1055			return ERR_PTR(-ENOMEM);
1056		hci_conn_hold(conn);
1057		conn->pending_sec_level = sec_level;
1058	}
1059
1060	conn->dst_type = dst_type;
1061	conn->sec_level = BT_SECURITY_LOW;
1062	conn->conn_timeout = conn_timeout;
1063
1064	hci_req_init(&req, hdev);
1065
1066	/* Disable advertising if we're active. For central role
1067	 * connections most controllers will refuse to connect if
1068	 * advertising is enabled, and for peripheral role connections we
1069	 * anyway have to disable it in order to start directed
1070	 * advertising.
1071	 */
1072	if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1073		 __hci_req_disable_advertising(&req);
1074
1075	/* If requested to connect as peripheral use directed advertising */
1076	if (conn->role == HCI_ROLE_SLAVE) {
1077		/* If we're active scanning most controllers are unable
1078		 * to initiate advertising. Simply reject the attempt.
1079		 */
1080		if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
1081		    hdev->le_scan_type == LE_SCAN_ACTIVE) {
1082			hci_req_purge(&req);
1083			hci_conn_del(conn);
1084			return ERR_PTR(-EBUSY);
1085		}
1086
1087		hci_req_directed_advertising(&req, conn);
1088		goto create_conn;
1089	}
1090
1091	params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
1092	if (params) {
1093		conn->le_conn_min_interval = params->conn_min_interval;
1094		conn->le_conn_max_interval = params->conn_max_interval;
1095		conn->le_conn_latency = params->conn_latency;
1096		conn->le_supv_timeout = params->supervision_timeout;
1097	} else {
1098		conn->le_conn_min_interval = hdev->le_conn_min_interval;
1099		conn->le_conn_max_interval = hdev->le_conn_max_interval;
1100		conn->le_conn_latency = hdev->le_conn_latency;
1101		conn->le_supv_timeout = hdev->le_supv_timeout;
1102	}
1103
1104	/* If controller is scanning, we stop it since some controllers are
1105	 * not able to scan and connect at the same time. Also set the
1106	 * HCI_LE_SCAN_INTERRUPTED flag so that the command complete
1107	 * handler for scan disabling knows to set the correct discovery
1108	 * state.
1109	 */
1110	if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
1111		hci_req_add_le_scan_disable(&req, rpa_le_conn);
1112		hci_dev_set_flag(hdev, HCI_LE_SCAN_INTERRUPTED);
1113	}
1114
1115	hci_req_add_le_create_conn(&req, conn, direct_rpa);
1116
1117create_conn:
1118	err = hci_req_run(&req, create_le_conn_complete);
1119	if (err) {
1120		hci_conn_del(conn);
1121		return ERR_PTR(err);
1122	}
1123
1124	return conn;
1125}
1126
1127static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
1128{
1129	struct hci_conn *conn;
1130
1131	conn = hci_conn_hash_lookup_le(hdev, addr, type);
1132	if (!conn)
1133		return false;
1134
1135	if (conn->state != BT_CONNECTED)
1136		return false;
1137
1138	return true;
1139}
1140
1141/* This function requires the caller holds hdev->lock */
1142static int hci_explicit_conn_params_set(struct hci_dev *hdev,
1143					bdaddr_t *addr, u8 addr_type)
1144{
1145	struct hci_conn_params *params;
1146
1147	if (is_connected(hdev, addr, addr_type))
1148		return -EISCONN;
1149
1150	params = hci_conn_params_lookup(hdev, addr, addr_type);
1151	if (!params) {
1152		params = hci_conn_params_add(hdev, addr, addr_type);
1153		if (!params)
1154			return -ENOMEM;
1155
1156		/* If we created new params, mark them to be deleted in
1157		 * hci_connect_le_scan_cleanup. It's different case than
1158		 * existing disabled params, those will stay after cleanup.
1159		 */
1160		params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
1161	}
1162
1163	/* We're trying to connect, so make sure params are at pend_le_conns */
1164	if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
1165	    params->auto_connect == HCI_AUTO_CONN_REPORT ||
1166	    params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
1167		list_del_init(&params->action);
1168		list_add(&params->action, &hdev->pend_le_conns);
1169	}
1170
1171	params->explicit_connect = true;
1172
1173	BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
1174	       params->auto_connect);
1175
1176	return 0;
1177}
1178
1179/* This function requires the caller holds hdev->lock */
1180struct hci_conn *hci_connect_le_scan(struct hci_dev *hdev, bdaddr_t *dst,
1181				     u8 dst_type, u8 sec_level,
1182				     u16 conn_timeout,
1183				     enum conn_reasons conn_reason)
1184{
1185	struct hci_conn *conn;
1186
1187	/* Let's make sure that le is enabled.*/
1188	if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1189		if (lmp_le_capable(hdev))
1190			return ERR_PTR(-ECONNREFUSED);
1191
1192		return ERR_PTR(-EOPNOTSUPP);
1193	}
1194
1195	/* Some devices send ATT messages as soon as the physical link is
1196	 * established. To be able to handle these ATT messages, the user-
1197	 * space first establishes the connection and then starts the pairing
1198	 * process.
1199	 *
1200	 * So if a hci_conn object already exists for the following connection
1201	 * attempt, we simply update pending_sec_level and auth_type fields
1202	 * and return the object found.
1203	 */
1204	conn = hci_conn_hash_lookup_le(hdev, dst, dst_type);
1205	if (conn) {
1206		if (conn->pending_sec_level < sec_level)
1207			conn->pending_sec_level = sec_level;
1208		goto done;
1209	}
1210
1211	BT_DBG("requesting refresh of dst_addr");
1212
1213	conn = hci_conn_add(hdev, LE_LINK, dst, HCI_ROLE_MASTER);
1214	if (!conn)
1215		return ERR_PTR(-ENOMEM);
1216
1217	if (hci_explicit_conn_params_set(hdev, dst, dst_type) < 0) {
1218		hci_conn_del(conn);
1219		return ERR_PTR(-EBUSY);
1220	}
1221
1222	conn->state = BT_CONNECT;
1223	set_bit(HCI_CONN_SCANNING, &conn->flags);
1224	conn->dst_type = dst_type;
1225	conn->sec_level = BT_SECURITY_LOW;
1226	conn->pending_sec_level = sec_level;
1227	conn->conn_timeout = conn_timeout;
1228	conn->conn_reason = conn_reason;
1229
1230	hci_update_background_scan(hdev);
1231
1232done:
1233	hci_conn_hold(conn);
1234	return conn;
1235}
1236
1237struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst,
1238				 u8 sec_level, u8 auth_type,
1239				 enum conn_reasons conn_reason)
1240{
1241	struct hci_conn *acl;
1242
1243	if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1244		if (lmp_bredr_capable(hdev))
1245			return ERR_PTR(-ECONNREFUSED);
1246
1247		return ERR_PTR(-EOPNOTSUPP);
1248	}
1249
1250	/* Reject outgoing connection to device with same BD ADDR against
1251	 * CVE-2020-26555
1252	 */
1253	if (!bacmp(&hdev->bdaddr, dst)) {
1254		bt_dev_dbg(hdev, "Reject connection with same BD_ADDR %pMR\n",
1255			   dst);
1256		return ERR_PTR(-ECONNREFUSED);
1257	}
1258
1259	acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
1260	if (!acl) {
1261		acl = hci_conn_add(hdev, ACL_LINK, dst, HCI_ROLE_MASTER);
1262		if (!acl)
1263			return ERR_PTR(-ENOMEM);
1264	}
1265
1266	hci_conn_hold(acl);
1267
1268	acl->conn_reason = conn_reason;
1269	if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
1270		acl->sec_level = BT_SECURITY_LOW;
1271		acl->pending_sec_level = sec_level;
1272		acl->auth_type = auth_type;
1273		hci_acl_create_connection(acl);
1274	}
1275
1276	return acl;
1277}
1278
1279struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type, bdaddr_t *dst,
1280				 __u16 setting)
1281{
1282	struct hci_conn *acl;
1283	struct hci_conn *sco;
1284
1285	acl = hci_connect_acl(hdev, dst, BT_SECURITY_LOW, HCI_AT_NO_BONDING,
1286			      CONN_REASON_SCO_CONNECT);
1287	if (IS_ERR(acl))
1288		return acl;
1289
1290	sco = hci_conn_hash_lookup_ba(hdev, type, dst);
1291	if (!sco) {
1292		sco = hci_conn_add(hdev, type, dst, HCI_ROLE_MASTER);
1293		if (!sco) {
1294			hci_conn_drop(acl);
1295			return ERR_PTR(-ENOMEM);
1296		}
1297	}
1298
1299	acl->link = sco;
1300	sco->link = acl;
1301
1302	hci_conn_hold(sco);
1303
1304	sco->setting = setting;
1305
1306	if (acl->state == BT_CONNECTED &&
1307	    (sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
1308		set_bit(HCI_CONN_POWER_SAVE, &acl->flags);
1309		hci_conn_enter_active_mode(acl, BT_POWER_FORCE_ACTIVE_ON);
1310
1311		if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->flags)) {
1312			/* defer SCO setup until mode change completed */
1313			set_bit(HCI_CONN_SCO_SETUP_PEND, &acl->flags);
1314			return sco;
1315		}
1316
1317		hci_sco_setup(acl, 0x00);
1318	}
1319
1320	return sco;
1321}
1322
1323/* Check link security requirement */
1324int hci_conn_check_link_mode(struct hci_conn *conn)
1325{
1326	BT_DBG("hcon %p", conn);
1327
1328	/* In Secure Connections Only mode, it is required that Secure
1329	 * Connections is used and the link is encrypted with AES-CCM
1330	 * using a P-256 authenticated combination key.
1331	 */
1332	if (hci_dev_test_flag(conn->hdev, HCI_SC_ONLY)) {
1333		if (!hci_conn_sc_enabled(conn) ||
1334		    !test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
1335		    conn->key_type != HCI_LK_AUTH_COMBINATION_P256)
1336			return 0;
1337	}
1338
1339	 /* AES encryption is required for Level 4:
1340	  *
1341	  * BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 3, Part C
1342	  * page 1319:
1343	  *
1344	  * 128-bit equivalent strength for link and encryption keys
1345	  * required using FIPS approved algorithms (E0 not allowed,
1346	  * SAFER+ not allowed, and P-192 not allowed; encryption key
1347	  * not shortened)
1348	  */
1349	if (conn->sec_level == BT_SECURITY_FIPS &&
1350	    !test_bit(HCI_CONN_AES_CCM, &conn->flags)) {
1351		bt_dev_err(conn->hdev,
1352			   "Invalid security: Missing AES-CCM usage");
1353		return 0;
1354	}
1355
1356	if (hci_conn_ssp_enabled(conn) &&
1357	    !test_bit(HCI_CONN_ENCRYPT, &conn->flags))
1358		return 0;
1359
1360	return 1;
1361}
1362
1363/* Authenticate remote device */
1364static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
1365{
1366	BT_DBG("hcon %p", conn);
1367
1368	if (conn->pending_sec_level > sec_level)
1369		sec_level = conn->pending_sec_level;
1370
1371	if (sec_level > conn->sec_level)
1372		conn->pending_sec_level = sec_level;
1373	else if (test_bit(HCI_CONN_AUTH, &conn->flags))
1374		return 1;
1375
1376	/* Make sure we preserve an existing MITM requirement*/
1377	auth_type |= (conn->auth_type & 0x01);
1378
1379	conn->auth_type = auth_type;
1380
1381	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
1382		struct hci_cp_auth_requested cp;
1383
1384		cp.handle = cpu_to_le16(conn->handle);
1385		hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
1386			     sizeof(cp), &cp);
1387
1388		/* Set the ENCRYPT_PEND to trigger encryption after
1389		 * authentication.
1390		 */
1391		if (!test_bit(HCI_CONN_ENCRYPT, &conn->flags))
1392			set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
1393	}
1394
1395	return 0;
1396}
1397
1398/* Encrypt the link */
1399static void hci_conn_encrypt(struct hci_conn *conn)
1400{
1401	BT_DBG("hcon %p", conn);
1402
1403	if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
1404		struct hci_cp_set_conn_encrypt cp;
1405		cp.handle  = cpu_to_le16(conn->handle);
1406		cp.encrypt = 0x01;
1407		hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
1408			     &cp);
1409	}
1410}
1411
1412/* Enable security */
1413int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type,
1414		      bool initiator)
1415{
1416	BT_DBG("hcon %p", conn);
1417
1418	if (conn->type == LE_LINK)
1419		return smp_conn_security(conn, sec_level);
1420
1421	/* For sdp we don't need the link key. */
1422	if (sec_level == BT_SECURITY_SDP)
1423		return 1;
1424
1425	/* For non 2.1 devices and low security level we don't need the link
1426	   key. */
1427	if (sec_level == BT_SECURITY_LOW && !hci_conn_ssp_enabled(conn))
1428		return 1;
1429
1430	/* For other security levels we need the link key. */
1431	if (!test_bit(HCI_CONN_AUTH, &conn->flags))
1432		goto auth;
1433
1434	switch (conn->key_type) {
1435	case HCI_LK_AUTH_COMBINATION_P256:
1436		/* An authenticated FIPS approved combination key has
1437		 * sufficient security for security level 4 or lower.
1438		 */
1439		if (sec_level <= BT_SECURITY_FIPS)
1440			goto encrypt;
1441		break;
1442	case HCI_LK_AUTH_COMBINATION_P192:
1443		/* An authenticated combination key has sufficient security for
1444		 * security level 3 or lower.
1445		 */
1446		if (sec_level <= BT_SECURITY_HIGH)
1447			goto encrypt;
1448		break;
1449	case HCI_LK_UNAUTH_COMBINATION_P192:
1450	case HCI_LK_UNAUTH_COMBINATION_P256:
1451		/* An unauthenticated combination key has sufficient security
1452		 * for security level 2 or lower.
1453		 */
1454		if (sec_level <= BT_SECURITY_MEDIUM)
1455			goto encrypt;
1456		break;
1457	case HCI_LK_COMBINATION:
1458		/* A combination key has always sufficient security for the
1459		 * security levels 2 or lower. High security level requires the
1460		 * combination key is generated using maximum PIN code length
1461		 * (16). For pre 2.1 units.
1462		 */
1463		if (sec_level <= BT_SECURITY_MEDIUM || conn->pin_length == 16)
1464			goto encrypt;
1465		break;
1466	default:
1467		break;
1468	}
1469
1470auth:
1471	if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags))
1472		return 0;
1473
1474	if (initiator)
1475		set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
1476
1477	if (!hci_conn_auth(conn, sec_level, auth_type))
1478		return 0;
1479
1480encrypt:
1481	if (test_bit(HCI_CONN_ENCRYPT, &conn->flags)) {
1482		/* Ensure that the encryption key size has been read,
1483		 * otherwise stall the upper layer responses.
1484		 */
1485		if (!conn->enc_key_size)
1486			return 0;
1487
1488		/* Nothing else needed, all requirements are met */
1489		return 1;
1490	}
1491
1492	hci_conn_encrypt(conn);
1493	return 0;
1494}
1495EXPORT_SYMBOL(hci_conn_security);
1496
1497/* Check secure link requirement */
1498int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level)
1499{
1500	BT_DBG("hcon %p", conn);
1501
1502	/* Accept if non-secure or higher security level is required */
1503	if (sec_level != BT_SECURITY_HIGH && sec_level != BT_SECURITY_FIPS)
1504		return 1;
1505
1506	/* Accept if secure or higher security level is already present */
1507	if (conn->sec_level == BT_SECURITY_HIGH ||
1508	    conn->sec_level == BT_SECURITY_FIPS)
1509		return 1;
1510
1511	/* Reject not secure link */
1512	return 0;
1513}
1514EXPORT_SYMBOL(hci_conn_check_secure);
1515
1516/* Switch role */
1517int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
1518{
1519	BT_DBG("hcon %p", conn);
1520
1521	if (role == conn->role)
1522		return 1;
1523
1524	if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->flags)) {
1525		struct hci_cp_switch_role cp;
1526		bacpy(&cp.bdaddr, &conn->dst);
1527		cp.role = role;
1528		hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
1529	}
1530
1531	return 0;
1532}
1533EXPORT_SYMBOL(hci_conn_switch_role);
1534
1535/* Enter active mode */
1536void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
1537{
1538	struct hci_dev *hdev = conn->hdev;
1539
1540	BT_DBG("hcon %p mode %d", conn, conn->mode);
1541
1542	if (conn->mode != HCI_CM_SNIFF)
1543		goto timer;
1544
1545	if (!test_bit(HCI_CONN_POWER_SAVE, &conn->flags) && !force_active)
1546		goto timer;
1547
1548	if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
1549		struct hci_cp_exit_sniff_mode cp;
1550		cp.handle = cpu_to_le16(conn->handle);
1551		hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
1552	}
1553
1554timer:
1555	if (hdev->idle_timeout > 0)
1556		queue_delayed_work(hdev->workqueue, &conn->idle_work,
1557				   msecs_to_jiffies(hdev->idle_timeout));
1558}
1559
1560/* Drop all connection on the device */
1561void hci_conn_hash_flush(struct hci_dev *hdev)
1562{
1563	struct hci_conn_hash *h = &hdev->conn_hash;
1564	struct hci_conn *c, *n;
1565
1566	BT_DBG("hdev %s", hdev->name);
1567
1568	list_for_each_entry_safe(c, n, &h->list, list) {
1569		c->state = BT_CLOSED;
1570
1571		hci_disconn_cfm(c, HCI_ERROR_LOCAL_HOST_TERM);
1572		hci_conn_del(c);
1573	}
1574}
1575
1576/* Check pending connect attempts */
1577void hci_conn_check_pending(struct hci_dev *hdev)
1578{
1579	struct hci_conn *conn;
1580
1581	BT_DBG("hdev %s", hdev->name);
1582
1583	hci_dev_lock(hdev);
1584
1585	conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
1586	if (conn)
1587		hci_acl_create_connection(conn);
1588
1589	hci_dev_unlock(hdev);
1590}
1591
1592static u32 get_link_mode(struct hci_conn *conn)
1593{
1594	u32 link_mode = 0;
1595
1596	if (conn->role == HCI_ROLE_MASTER)
1597		link_mode |= HCI_LM_MASTER;
1598
1599	if (test_bit(HCI_CONN_ENCRYPT, &conn->flags))
1600		link_mode |= HCI_LM_ENCRYPT;
1601
1602	if (test_bit(HCI_CONN_AUTH, &conn->flags))
1603		link_mode |= HCI_LM_AUTH;
1604
1605	if (test_bit(HCI_CONN_SECURE, &conn->flags))
1606		link_mode |= HCI_LM_SECURE;
1607
1608	if (test_bit(HCI_CONN_FIPS, &conn->flags))
1609		link_mode |= HCI_LM_FIPS;
1610
1611	return link_mode;
1612}
1613
1614int hci_get_conn_list(void __user *arg)
1615{
1616	struct hci_conn *c;
1617	struct hci_conn_list_req req, *cl;
1618	struct hci_conn_info *ci;
1619	struct hci_dev *hdev;
1620	int n = 0, size, err;
1621
1622	if (copy_from_user(&req, arg, sizeof(req)))
1623		return -EFAULT;
1624
1625	if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
1626		return -EINVAL;
1627
1628	size = sizeof(req) + req.conn_num * sizeof(*ci);
1629
1630	cl = kmalloc(size, GFP_KERNEL);
1631	if (!cl)
1632		return -ENOMEM;
1633
1634	hdev = hci_dev_get(req.dev_id);
1635	if (!hdev) {
1636		kfree(cl);
1637		return -ENODEV;
1638	}
1639
1640	ci = cl->conn_info;
1641
1642	hci_dev_lock(hdev);
1643	list_for_each_entry(c, &hdev->conn_hash.list, list) {
1644		bacpy(&(ci + n)->bdaddr, &c->dst);
1645		(ci + n)->handle = c->handle;
1646		(ci + n)->type  = c->type;
1647		(ci + n)->out   = c->out;
1648		(ci + n)->state = c->state;
1649		(ci + n)->link_mode = get_link_mode(c);
1650		if (++n >= req.conn_num)
1651			break;
1652	}
1653	hci_dev_unlock(hdev);
1654
1655	cl->dev_id = hdev->id;
1656	cl->conn_num = n;
1657	size = sizeof(req) + n * sizeof(*ci);
1658
1659	hci_dev_put(hdev);
1660
1661	err = copy_to_user(arg, cl, size);
1662	kfree(cl);
1663
1664	return err ? -EFAULT : 0;
1665}
1666
1667int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
1668{
1669	struct hci_conn_info_req req;
1670	struct hci_conn_info ci;
1671	struct hci_conn *conn;
1672	char __user *ptr = arg + sizeof(req);
1673
1674	if (copy_from_user(&req, arg, sizeof(req)))
1675		return -EFAULT;
1676
1677	hci_dev_lock(hdev);
1678	conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
1679	if (conn) {
1680		bacpy(&ci.bdaddr, &conn->dst);
1681		ci.handle = conn->handle;
1682		ci.type  = conn->type;
1683		ci.out   = conn->out;
1684		ci.state = conn->state;
1685		ci.link_mode = get_link_mode(conn);
1686	}
1687	hci_dev_unlock(hdev);
1688
1689	if (!conn)
1690		return -ENOENT;
1691
1692	return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
1693}
1694
1695int hci_get_auth_info(struct hci_dev *hdev, void __user *arg)
1696{
1697	struct hci_auth_info_req req;
1698	struct hci_conn *conn;
1699
1700	if (copy_from_user(&req, arg, sizeof(req)))
1701		return -EFAULT;
1702
1703	hci_dev_lock(hdev);
1704	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr);
1705	if (conn)
1706		req.type = conn->auth_type;
1707	hci_dev_unlock(hdev);
1708
1709	if (!conn)
1710		return -ENOENT;
1711
1712	return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0;
1713}
1714
1715struct hci_chan *hci_chan_create(struct hci_conn *conn)
1716{
1717	struct hci_dev *hdev = conn->hdev;
1718	struct hci_chan *chan;
1719
1720	BT_DBG("%s hcon %p", hdev->name, conn);
1721
1722	if (test_bit(HCI_CONN_DROP, &conn->flags)) {
1723		BT_DBG("Refusing to create new hci_chan");
1724		return NULL;
1725	}
1726
1727	chan = kzalloc(sizeof(*chan), GFP_KERNEL);
1728	if (!chan)
1729		return NULL;
1730
1731	chan->conn = hci_conn_get(conn);
1732	skb_queue_head_init(&chan->data_q);
1733	chan->state = BT_CONNECTED;
1734
1735	list_add_rcu(&chan->list, &conn->chan_list);
1736
1737	return chan;
1738}
1739
1740void hci_chan_del(struct hci_chan *chan)
1741{
1742	struct hci_conn *conn = chan->conn;
1743	struct hci_dev *hdev = conn->hdev;
1744
1745	BT_DBG("%s hcon %p chan %p", hdev->name, conn, chan);
1746
1747	list_del_rcu(&chan->list);
1748
1749	synchronize_rcu();
1750
1751	/* Prevent new hci_chan's to be created for this hci_conn */
1752	set_bit(HCI_CONN_DROP, &conn->flags);
1753
1754	hci_conn_put(conn);
1755
1756	skb_queue_purge(&chan->data_q);
1757	kfree(chan);
1758}
1759
1760void hci_chan_list_flush(struct hci_conn *conn)
1761{
1762	struct hci_chan *chan, *n;
1763
1764	BT_DBG("hcon %p", conn);
1765
1766	list_for_each_entry_safe(chan, n, &conn->chan_list, list)
1767		hci_chan_del(chan);
1768}
1769
1770static struct hci_chan *__hci_chan_lookup_handle(struct hci_conn *hcon,
1771						 __u16 handle)
1772{
1773	struct hci_chan *hchan;
1774
1775	list_for_each_entry(hchan, &hcon->chan_list, list) {
1776		if (hchan->handle == handle)
1777			return hchan;
1778	}
1779
1780	return NULL;
1781}
1782
1783struct hci_chan *hci_chan_lookup_handle(struct hci_dev *hdev, __u16 handle)
1784{
1785	struct hci_conn_hash *h = &hdev->conn_hash;
1786	struct hci_conn *hcon;
1787	struct hci_chan *hchan = NULL;
1788
1789	rcu_read_lock();
1790
1791	list_for_each_entry_rcu(hcon, &h->list, list) {
1792		hchan = __hci_chan_lookup_handle(hcon, handle);
1793		if (hchan)
1794			break;
1795	}
1796
1797	rcu_read_unlock();
1798
1799	return hchan;
1800}
1801
1802u32 hci_conn_get_phy(struct hci_conn *conn)
1803{
1804	u32 phys = 0;
1805
1806	/* BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 2, Part B page 471:
1807	 * Table 6.2: Packets defined for synchronous, asynchronous, and
1808	 * CSB logical transport types.
1809	 */
1810	switch (conn->type) {
1811	case SCO_LINK:
1812		/* SCO logical transport (1 Mb/s):
1813		 * HV1, HV2, HV3 and DV.
1814		 */
1815		phys |= BT_PHY_BR_1M_1SLOT;
1816
1817		break;
1818
1819	case ACL_LINK:
1820		/* ACL logical transport (1 Mb/s) ptt=0:
1821		 * DH1, DM3, DH3, DM5 and DH5.
1822		 */
1823		phys |= BT_PHY_BR_1M_1SLOT;
1824
1825		if (conn->pkt_type & (HCI_DM3 | HCI_DH3))
1826			phys |= BT_PHY_BR_1M_3SLOT;
1827
1828		if (conn->pkt_type & (HCI_DM5 | HCI_DH5))
1829			phys |= BT_PHY_BR_1M_5SLOT;
1830
1831		/* ACL logical transport (2 Mb/s) ptt=1:
1832		 * 2-DH1, 2-DH3 and 2-DH5.
1833		 */
1834		if (!(conn->pkt_type & HCI_2DH1))
1835			phys |= BT_PHY_EDR_2M_1SLOT;
1836
1837		if (!(conn->pkt_type & HCI_2DH3))
1838			phys |= BT_PHY_EDR_2M_3SLOT;
1839
1840		if (!(conn->pkt_type & HCI_2DH5))
1841			phys |= BT_PHY_EDR_2M_5SLOT;
1842
1843		/* ACL logical transport (3 Mb/s) ptt=1:
1844		 * 3-DH1, 3-DH3 and 3-DH5.
1845		 */
1846		if (!(conn->pkt_type & HCI_3DH1))
1847			phys |= BT_PHY_EDR_3M_1SLOT;
1848
1849		if (!(conn->pkt_type & HCI_3DH3))
1850			phys |= BT_PHY_EDR_3M_3SLOT;
1851
1852		if (!(conn->pkt_type & HCI_3DH5))
1853			phys |= BT_PHY_EDR_3M_5SLOT;
1854
1855		break;
1856
1857	case ESCO_LINK:
1858		/* eSCO logical transport (1 Mb/s): EV3, EV4 and EV5 */
1859		phys |= BT_PHY_BR_1M_1SLOT;
1860
1861		if (!(conn->pkt_type & (ESCO_EV4 | ESCO_EV5)))
1862			phys |= BT_PHY_BR_1M_3SLOT;
1863
1864		/* eSCO logical transport (2 Mb/s): 2-EV3, 2-EV5 */
1865		if (!(conn->pkt_type & ESCO_2EV3))
1866			phys |= BT_PHY_EDR_2M_1SLOT;
1867
1868		if (!(conn->pkt_type & ESCO_2EV5))
1869			phys |= BT_PHY_EDR_2M_3SLOT;
1870
1871		/* eSCO logical transport (3 Mb/s): 3-EV3, 3-EV5 */
1872		if (!(conn->pkt_type & ESCO_3EV3))
1873			phys |= BT_PHY_EDR_3M_1SLOT;
1874
1875		if (!(conn->pkt_type & ESCO_3EV5))
1876			phys |= BT_PHY_EDR_3M_3SLOT;
1877
1878		break;
1879
1880	case LE_LINK:
1881		if (conn->le_tx_phy & HCI_LE_SET_PHY_1M)
1882			phys |= BT_PHY_LE_1M_TX;
1883
1884		if (conn->le_rx_phy & HCI_LE_SET_PHY_1M)
1885			phys |= BT_PHY_LE_1M_RX;
1886
1887		if (conn->le_tx_phy & HCI_LE_SET_PHY_2M)
1888			phys |= BT_PHY_LE_2M_TX;
1889
1890		if (conn->le_rx_phy & HCI_LE_SET_PHY_2M)
1891			phys |= BT_PHY_LE_2M_RX;
1892
1893		if (conn->le_tx_phy & HCI_LE_SET_PHY_CODED)
1894			phys |= BT_PHY_LE_CODED_TX;
1895
1896		if (conn->le_rx_phy & HCI_LE_SET_PHY_CODED)
1897			phys |= BT_PHY_LE_CODED_RX;
1898
1899		break;
1900	}
1901
1902	return phys;
1903}
1904