1/* 2 BlueZ - Bluetooth protocol stack for Linux 3 Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved. 4 5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com> 6 7 This program is free software; you can redistribute it and/or modify 8 it under the terms of the GNU General Public License version 2 as 9 published by the Free Software Foundation; 10 11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 19 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 22 SOFTWARE IS DISCLAIMED. 23*/ 24 25/* Bluetooth HCI connection handling. */ 26 27#include <linux/export.h> 28#include <linux/debugfs.h> 29 30#include <net/bluetooth/bluetooth.h> 31#include <net/bluetooth/hci_core.h> 32#include <net/bluetooth/l2cap.h> 33 34#include "hci_request.h" 35#include "smp.h" 36#include "a2mp.h" 37 38struct sco_param { 39 u16 pkt_type; 40 u16 max_latency; 41 u8 retrans_effort; 42}; 43 44static const struct sco_param esco_param_cvsd[] = { 45 { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000a, 0x01 }, /* S3 */ 46 { EDR_ESCO_MASK & ~ESCO_2EV3, 0x0007, 0x01 }, /* S2 */ 47 { EDR_ESCO_MASK | ESCO_EV3, 0x0007, 0x01 }, /* S1 */ 48 { EDR_ESCO_MASK | ESCO_HV3, 0xffff, 0x01 }, /* D1 */ 49 { EDR_ESCO_MASK | ESCO_HV1, 0xffff, 0x01 }, /* D0 */ 50}; 51 52static const struct sco_param sco_param_cvsd[] = { 53 { EDR_ESCO_MASK | ESCO_HV3, 0xffff, 0xff }, /* D1 */ 54 { EDR_ESCO_MASK | ESCO_HV1, 0xffff, 0xff }, /* D0 */ 55}; 56 57static const struct sco_param esco_param_msbc[] = { 58 { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000d, 0x02 }, /* T2 */ 59 { EDR_ESCO_MASK | ESCO_EV3, 0x0008, 0x02 }, /* T1 */ 60}; 61 62/* This function requires the caller holds hdev->lock */ 63static void hci_connect_le_scan_cleanup(struct hci_conn *conn) 64{ 65 struct hci_conn_params *params; 66 struct hci_dev *hdev = conn->hdev; 67 struct smp_irk *irk; 68 bdaddr_t *bdaddr; 69 u8 bdaddr_type; 70 71 bdaddr = &conn->dst; 72 bdaddr_type = conn->dst_type; 73 74 /* Check if we need to convert to identity address */ 75 irk = hci_get_irk(hdev, bdaddr, bdaddr_type); 76 if (irk) { 77 bdaddr = &irk->bdaddr; 78 bdaddr_type = irk->addr_type; 79 } 80 81 params = hci_pend_le_action_lookup(&hdev->pend_le_conns, bdaddr, 82 bdaddr_type); 83 if (!params || !params->explicit_connect) 84 return; 85 86 /* The connection attempt was doing scan for new RPA, and is 87 * in scan phase. If params are not associated with any other 88 * autoconnect action, remove them completely. If they are, just unmark 89 * them as waiting for connection, by clearing explicit_connect field. 90 */ 91 params->explicit_connect = false; 92 93 list_del_init(¶ms->action); 94 95 switch (params->auto_connect) { 96 case HCI_AUTO_CONN_EXPLICIT: 97 hci_conn_params_del(hdev, bdaddr, bdaddr_type); 98 /* return instead of break to avoid duplicate scan update */ 99 return; 100 case HCI_AUTO_CONN_DIRECT: 101 case HCI_AUTO_CONN_ALWAYS: 102 list_add(¶ms->action, &hdev->pend_le_conns); 103 break; 104 case HCI_AUTO_CONN_REPORT: 105 list_add(¶ms->action, &hdev->pend_le_reports); 106 break; 107 default: 108 break; 109 } 110 111 hci_update_background_scan(hdev); 112} 113 114static void hci_conn_cleanup(struct hci_conn *conn) 115{ 116 struct hci_dev *hdev = conn->hdev; 117 118 if (test_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags)) 119 hci_conn_params_del(conn->hdev, &conn->dst, conn->dst_type); 120 121 hci_chan_list_flush(conn); 122 123 hci_conn_hash_del(hdev, conn); 124 125 if (conn->type == SCO_LINK || conn->type == ESCO_LINK) { 126 switch (conn->setting & SCO_AIRMODE_MASK) { 127 case SCO_AIRMODE_CVSD: 128 case SCO_AIRMODE_TRANSP: 129 if (hdev->notify) 130 hdev->notify(hdev, HCI_NOTIFY_DISABLE_SCO); 131 break; 132 } 133 } else { 134 if (hdev->notify) 135 hdev->notify(hdev, HCI_NOTIFY_CONN_DEL); 136 } 137 138 debugfs_remove_recursive(conn->debugfs); 139 140 hci_conn_del_sysfs(conn); 141 142 hci_dev_put(hdev); 143} 144 145static void le_scan_cleanup(struct work_struct *work) 146{ 147 struct hci_conn *conn = container_of(work, struct hci_conn, 148 le_scan_cleanup); 149 struct hci_dev *hdev = conn->hdev; 150 struct hci_conn *c = NULL; 151 152 BT_DBG("%s hcon %p", hdev->name, conn); 153 154 hci_dev_lock(hdev); 155 156 /* Check that the hci_conn is still around */ 157 rcu_read_lock(); 158 list_for_each_entry_rcu(c, &hdev->conn_hash.list, list) { 159 if (c == conn) 160 break; 161 } 162 rcu_read_unlock(); 163 164 if (c == conn) { 165 hci_connect_le_scan_cleanup(conn); 166 hci_conn_cleanup(conn); 167 } 168 169 hci_dev_unlock(hdev); 170 hci_dev_put(hdev); 171 hci_conn_put(conn); 172} 173 174static void hci_connect_le_scan_remove(struct hci_conn *conn) 175{ 176 BT_DBG("%s hcon %p", conn->hdev->name, conn); 177 178 /* We can't call hci_conn_del/hci_conn_cleanup here since that 179 * could deadlock with another hci_conn_del() call that's holding 180 * hci_dev_lock and doing cancel_delayed_work_sync(&conn->disc_work). 181 * Instead, grab temporary extra references to the hci_dev and 182 * hci_conn and perform the necessary cleanup in a separate work 183 * callback. 184 */ 185 186 hci_dev_hold(conn->hdev); 187 hci_conn_get(conn); 188 189 /* Even though we hold a reference to the hdev, many other 190 * things might get cleaned up meanwhile, including the hdev's 191 * own workqueue, so we can't use that for scheduling. 192 */ 193 schedule_work(&conn->le_scan_cleanup); 194} 195 196static void hci_acl_create_connection(struct hci_conn *conn) 197{ 198 struct hci_dev *hdev = conn->hdev; 199 struct inquiry_entry *ie; 200 struct hci_cp_create_conn cp; 201 202 BT_DBG("hcon %p", conn); 203 204 conn->state = BT_CONNECT; 205 conn->out = true; 206 conn->role = HCI_ROLE_MASTER; 207 208 conn->attempt++; 209 210 conn->link_policy = hdev->link_policy; 211 212 memset(&cp, 0, sizeof(cp)); 213 bacpy(&cp.bdaddr, &conn->dst); 214 cp.pscan_rep_mode = 0x02; 215 216 ie = hci_inquiry_cache_lookup(hdev, &conn->dst); 217 if (ie) { 218 if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) { 219 cp.pscan_rep_mode = ie->data.pscan_rep_mode; 220 cp.pscan_mode = ie->data.pscan_mode; 221 cp.clock_offset = ie->data.clock_offset | 222 cpu_to_le16(0x8000); 223 } 224 225 memcpy(conn->dev_class, ie->data.dev_class, 3); 226 } 227 228 cp.pkt_type = cpu_to_le16(conn->pkt_type); 229 if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER)) 230 cp.role_switch = 0x01; 231 else 232 cp.role_switch = 0x00; 233 234 hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp); 235} 236 237int hci_disconnect(struct hci_conn *conn, __u8 reason) 238{ 239 BT_DBG("hcon %p", conn); 240 241 /* When we are central of an established connection and it enters 242 * the disconnect timeout, then go ahead and try to read the 243 * current clock offset. Processing of the result is done 244 * within the event handling and hci_clock_offset_evt function. 245 */ 246 if (conn->type == ACL_LINK && conn->role == HCI_ROLE_MASTER && 247 (conn->state == BT_CONNECTED || conn->state == BT_CONFIG)) { 248 struct hci_dev *hdev = conn->hdev; 249 struct hci_cp_read_clock_offset clkoff_cp; 250 251 clkoff_cp.handle = cpu_to_le16(conn->handle); 252 hci_send_cmd(hdev, HCI_OP_READ_CLOCK_OFFSET, sizeof(clkoff_cp), 253 &clkoff_cp); 254 } 255 256 return hci_abort_conn(conn, reason); 257} 258 259static void hci_add_sco(struct hci_conn *conn, __u16 handle) 260{ 261 struct hci_dev *hdev = conn->hdev; 262 struct hci_cp_add_sco cp; 263 264 BT_DBG("hcon %p", conn); 265 266 conn->state = BT_CONNECT; 267 conn->out = true; 268 269 conn->attempt++; 270 271 cp.handle = cpu_to_le16(handle); 272 cp.pkt_type = cpu_to_le16(conn->pkt_type); 273 274 hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp); 275} 276 277bool hci_setup_sync(struct hci_conn *conn, __u16 handle) 278{ 279 struct hci_dev *hdev = conn->hdev; 280 struct hci_cp_setup_sync_conn cp; 281 const struct sco_param *param; 282 283 BT_DBG("hcon %p", conn); 284 285 conn->state = BT_CONNECT; 286 conn->out = true; 287 288 conn->attempt++; 289 290 cp.handle = cpu_to_le16(handle); 291 292 cp.tx_bandwidth = cpu_to_le32(0x00001f40); 293 cp.rx_bandwidth = cpu_to_le32(0x00001f40); 294 cp.voice_setting = cpu_to_le16(conn->setting); 295 296 switch (conn->setting & SCO_AIRMODE_MASK) { 297 case SCO_AIRMODE_TRANSP: 298 if (conn->attempt > ARRAY_SIZE(esco_param_msbc)) 299 return false; 300 param = &esco_param_msbc[conn->attempt - 1]; 301 break; 302 case SCO_AIRMODE_CVSD: 303 if (lmp_esco_capable(conn->link)) { 304 if (conn->attempt > ARRAY_SIZE(esco_param_cvsd)) 305 return false; 306 param = &esco_param_cvsd[conn->attempt - 1]; 307 } else { 308 if (conn->attempt > ARRAY_SIZE(sco_param_cvsd)) 309 return false; 310 param = &sco_param_cvsd[conn->attempt - 1]; 311 } 312 break; 313 default: 314 return false; 315 } 316 317 cp.retrans_effort = param->retrans_effort; 318 cp.pkt_type = __cpu_to_le16(param->pkt_type); 319 cp.max_latency = __cpu_to_le16(param->max_latency); 320 321 if (hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp) < 0) 322 return false; 323 324 return true; 325} 326 327u8 hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max, u16 latency, 328 u16 to_multiplier) 329{ 330 struct hci_dev *hdev = conn->hdev; 331 struct hci_conn_params *params; 332 struct hci_cp_le_conn_update cp; 333 334 hci_dev_lock(hdev); 335 336 params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type); 337 if (params) { 338 params->conn_min_interval = min; 339 params->conn_max_interval = max; 340 params->conn_latency = latency; 341 params->supervision_timeout = to_multiplier; 342 } 343 344 hci_dev_unlock(hdev); 345 346 memset(&cp, 0, sizeof(cp)); 347 cp.handle = cpu_to_le16(conn->handle); 348 cp.conn_interval_min = cpu_to_le16(min); 349 cp.conn_interval_max = cpu_to_le16(max); 350 cp.conn_latency = cpu_to_le16(latency); 351 cp.supervision_timeout = cpu_to_le16(to_multiplier); 352 cp.min_ce_len = cpu_to_le16(0x0000); 353 cp.max_ce_len = cpu_to_le16(0x0000); 354 355 hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp); 356 357 if (params) 358 return 0x01; 359 360 return 0x00; 361} 362 363void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __le64 rand, 364 __u8 ltk[16], __u8 key_size) 365{ 366 struct hci_dev *hdev = conn->hdev; 367 struct hci_cp_le_start_enc cp; 368 369 BT_DBG("hcon %p", conn); 370 371 memset(&cp, 0, sizeof(cp)); 372 373 cp.handle = cpu_to_le16(conn->handle); 374 cp.rand = rand; 375 cp.ediv = ediv; 376 memcpy(cp.ltk, ltk, key_size); 377 378 hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp); 379} 380 381/* Device _must_ be locked */ 382void hci_sco_setup(struct hci_conn *conn, __u8 status) 383{ 384 struct hci_conn *sco = conn->link; 385 386 if (!sco) 387 return; 388 389 BT_DBG("hcon %p", conn); 390 391 if (!status) { 392 if (lmp_esco_capable(conn->hdev)) 393 hci_setup_sync(sco, conn->handle); 394 else 395 hci_add_sco(sco, conn->handle); 396 } else { 397 hci_connect_cfm(sco, status); 398 hci_conn_del(sco); 399 } 400} 401 402static void hci_conn_timeout(struct work_struct *work) 403{ 404 struct hci_conn *conn = container_of(work, struct hci_conn, 405 disc_work.work); 406 int refcnt = atomic_read(&conn->refcnt); 407 408 BT_DBG("hcon %p state %s", conn, state_to_string(conn->state)); 409 410 WARN_ON(refcnt < 0); 411 412 /* FIXME: It was observed that in pairing failed scenario, refcnt 413 * drops below 0. Probably this is because l2cap_conn_del calls 414 * l2cap_chan_del for each channel, and inside l2cap_chan_del conn is 415 * dropped. After that loop hci_chan_del is called which also drops 416 * conn. For now make sure that ACL is alive if refcnt is higher then 0, 417 * otherwise drop it. 418 */ 419 if (refcnt > 0) 420 return; 421 422 /* LE connections in scanning state need special handling */ 423 if (conn->state == BT_CONNECT && conn->type == LE_LINK && 424 test_bit(HCI_CONN_SCANNING, &conn->flags)) { 425 hci_connect_le_scan_remove(conn); 426 return; 427 } 428 429 hci_abort_conn(conn, hci_proto_disconn_ind(conn)); 430} 431 432/* Enter sniff mode */ 433static void hci_conn_idle(struct work_struct *work) 434{ 435 struct hci_conn *conn = container_of(work, struct hci_conn, 436 idle_work.work); 437 struct hci_dev *hdev = conn->hdev; 438 439 BT_DBG("hcon %p mode %d", conn, conn->mode); 440 441 if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn)) 442 return; 443 444 if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF)) 445 return; 446 447 if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) { 448 struct hci_cp_sniff_subrate cp; 449 cp.handle = cpu_to_le16(conn->handle); 450 cp.max_latency = cpu_to_le16(0); 451 cp.min_remote_timeout = cpu_to_le16(0); 452 cp.min_local_timeout = cpu_to_le16(0); 453 hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp); 454 } 455 456 if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) { 457 struct hci_cp_sniff_mode cp; 458 cp.handle = cpu_to_le16(conn->handle); 459 cp.max_interval = cpu_to_le16(hdev->sniff_max_interval); 460 cp.min_interval = cpu_to_le16(hdev->sniff_min_interval); 461 cp.attempt = cpu_to_le16(4); 462 cp.timeout = cpu_to_le16(1); 463 hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp); 464 } 465} 466 467static void hci_conn_auto_accept(struct work_struct *work) 468{ 469 struct hci_conn *conn = container_of(work, struct hci_conn, 470 auto_accept_work.work); 471 472 hci_send_cmd(conn->hdev, HCI_OP_USER_CONFIRM_REPLY, sizeof(conn->dst), 473 &conn->dst); 474} 475 476static void le_disable_advertising(struct hci_dev *hdev) 477{ 478 if (ext_adv_capable(hdev)) { 479 struct hci_cp_le_set_ext_adv_enable cp; 480 481 cp.enable = 0x00; 482 cp.num_of_sets = 0x00; 483 484 hci_send_cmd(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE, sizeof(cp), 485 &cp); 486 } else { 487 u8 enable = 0x00; 488 hci_send_cmd(hdev, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), 489 &enable); 490 } 491} 492 493static void le_conn_timeout(struct work_struct *work) 494{ 495 struct hci_conn *conn = container_of(work, struct hci_conn, 496 le_conn_timeout.work); 497 struct hci_dev *hdev = conn->hdev; 498 499 BT_DBG(""); 500 501 /* We could end up here due to having done directed advertising, 502 * so clean up the state if necessary. This should however only 503 * happen with broken hardware or if low duty cycle was used 504 * (which doesn't have a timeout of its own). 505 */ 506 if (conn->role == HCI_ROLE_SLAVE) { 507 /* Disable LE Advertising */ 508 le_disable_advertising(hdev); 509 hci_dev_lock(hdev); 510 hci_le_conn_failed(conn, HCI_ERROR_ADVERTISING_TIMEOUT); 511 hci_dev_unlock(hdev); 512 return; 513 } 514 515 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM); 516} 517 518struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst, 519 u8 role) 520{ 521 struct hci_conn *conn; 522 523 BT_DBG("%s dst %pMR", hdev->name, dst); 524 525 conn = kzalloc(sizeof(*conn), GFP_KERNEL); 526 if (!conn) 527 return NULL; 528 529 bacpy(&conn->dst, dst); 530 bacpy(&conn->src, &hdev->bdaddr); 531 conn->hdev = hdev; 532 conn->type = type; 533 conn->role = role; 534 conn->mode = HCI_CM_ACTIVE; 535 conn->state = BT_OPEN; 536 conn->auth_type = HCI_AT_GENERAL_BONDING; 537 conn->io_capability = hdev->io_capability; 538 conn->remote_auth = 0xff; 539 conn->key_type = 0xff; 540 conn->rssi = HCI_RSSI_INVALID; 541 conn->tx_power = HCI_TX_POWER_INVALID; 542 conn->max_tx_power = HCI_TX_POWER_INVALID; 543 544 set_bit(HCI_CONN_POWER_SAVE, &conn->flags); 545 conn->disc_timeout = HCI_DISCONN_TIMEOUT; 546 547 /* Set Default Authenticated payload timeout to 30s */ 548 conn->auth_payload_timeout = DEFAULT_AUTH_PAYLOAD_TIMEOUT; 549 550 if (conn->role == HCI_ROLE_MASTER) 551 conn->out = true; 552 553 switch (type) { 554 case ACL_LINK: 555 conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK; 556 break; 557 case LE_LINK: 558 /* conn->src should reflect the local identity address */ 559 hci_copy_identity_address(hdev, &conn->src, &conn->src_type); 560 break; 561 case SCO_LINK: 562 if (lmp_esco_capable(hdev)) 563 conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) | 564 (hdev->esco_type & EDR_ESCO_MASK); 565 else 566 conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK; 567 break; 568 case ESCO_LINK: 569 conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK; 570 break; 571 } 572 573 skb_queue_head_init(&conn->data_q); 574 575 INIT_LIST_HEAD(&conn->chan_list); 576 577 INIT_DELAYED_WORK(&conn->disc_work, hci_conn_timeout); 578 INIT_DELAYED_WORK(&conn->auto_accept_work, hci_conn_auto_accept); 579 INIT_DELAYED_WORK(&conn->idle_work, hci_conn_idle); 580 INIT_DELAYED_WORK(&conn->le_conn_timeout, le_conn_timeout); 581 INIT_WORK(&conn->le_scan_cleanup, le_scan_cleanup); 582 583 atomic_set(&conn->refcnt, 0); 584 585 hci_dev_hold(hdev); 586 587 hci_conn_hash_add(hdev, conn); 588 589 /* The SCO and eSCO connections will only be notified when their 590 * setup has been completed. This is different to ACL links which 591 * can be notified right away. 592 */ 593 if (conn->type != SCO_LINK && conn->type != ESCO_LINK) { 594 if (hdev->notify) 595 hdev->notify(hdev, HCI_NOTIFY_CONN_ADD); 596 } 597 598 hci_conn_init_sysfs(conn); 599 600 return conn; 601} 602 603int hci_conn_del(struct hci_conn *conn) 604{ 605 struct hci_dev *hdev = conn->hdev; 606 607 BT_DBG("%s hcon %p handle %d", hdev->name, conn, conn->handle); 608 609 cancel_delayed_work_sync(&conn->disc_work); 610 cancel_delayed_work_sync(&conn->auto_accept_work); 611 cancel_delayed_work_sync(&conn->idle_work); 612 613 if (conn->type == ACL_LINK) { 614 struct hci_conn *sco = conn->link; 615 if (sco) 616 sco->link = NULL; 617 618 /* Unacked frames */ 619 hdev->acl_cnt += conn->sent; 620 } else if (conn->type == LE_LINK) { 621 cancel_delayed_work(&conn->le_conn_timeout); 622 623 if (hdev->le_pkts) 624 hdev->le_cnt += conn->sent; 625 else 626 hdev->acl_cnt += conn->sent; 627 } else { 628 struct hci_conn *acl = conn->link; 629 if (acl) { 630 acl->link = NULL; 631 hci_conn_drop(acl); 632 } 633 } 634 635 if (conn->amp_mgr) 636 amp_mgr_put(conn->amp_mgr); 637 638 skb_queue_purge(&conn->data_q); 639 640 /* Remove the connection from the list and cleanup its remaining 641 * state. This is a separate function since for some cases like 642 * BT_CONNECT_SCAN we *only* want the cleanup part without the 643 * rest of hci_conn_del. 644 */ 645 hci_conn_cleanup(conn); 646 647 return 0; 648} 649 650struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src, uint8_t src_type) 651{ 652 int use_src = bacmp(src, BDADDR_ANY); 653 struct hci_dev *hdev = NULL, *d; 654 655 BT_DBG("%pMR -> %pMR", src, dst); 656 657 read_lock(&hci_dev_list_lock); 658 659 list_for_each_entry(d, &hci_dev_list, list) { 660 if (!test_bit(HCI_UP, &d->flags) || 661 hci_dev_test_flag(d, HCI_USER_CHANNEL) || 662 d->dev_type != HCI_PRIMARY) 663 continue; 664 665 /* Simple routing: 666 * No source address - find interface with bdaddr != dst 667 * Source address - find interface with bdaddr == src 668 */ 669 670 if (use_src) { 671 bdaddr_t id_addr; 672 u8 id_addr_type; 673 674 if (src_type == BDADDR_BREDR) { 675 if (!lmp_bredr_capable(d)) 676 continue; 677 bacpy(&id_addr, &d->bdaddr); 678 id_addr_type = BDADDR_BREDR; 679 } else { 680 if (!lmp_le_capable(d)) 681 continue; 682 683 hci_copy_identity_address(d, &id_addr, 684 &id_addr_type); 685 686 /* Convert from HCI to three-value type */ 687 if (id_addr_type == ADDR_LE_DEV_PUBLIC) 688 id_addr_type = BDADDR_LE_PUBLIC; 689 else 690 id_addr_type = BDADDR_LE_RANDOM; 691 } 692 693 if (!bacmp(&id_addr, src) && id_addr_type == src_type) { 694 hdev = d; break; 695 } 696 } else { 697 if (bacmp(&d->bdaddr, dst)) { 698 hdev = d; break; 699 } 700 } 701 } 702 703 if (hdev) 704 hdev = hci_dev_hold(hdev); 705 706 read_unlock(&hci_dev_list_lock); 707 return hdev; 708} 709EXPORT_SYMBOL(hci_get_route); 710 711/* This function requires the caller holds hdev->lock */ 712void hci_le_conn_failed(struct hci_conn *conn, u8 status) 713{ 714 struct hci_dev *hdev = conn->hdev; 715 struct hci_conn_params *params; 716 717 params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst, 718 conn->dst_type); 719 if (params && params->conn) { 720 hci_conn_drop(params->conn); 721 hci_conn_put(params->conn); 722 params->conn = NULL; 723 } 724 725 conn->state = BT_CLOSED; 726 727 /* If the status indicates successful cancellation of 728 * the attempt (i.e. Unkown Connection Id) there's no point of 729 * notifying failure since we'll go back to keep trying to 730 * connect. The only exception is explicit connect requests 731 * where a timeout + cancel does indicate an actual failure. 732 */ 733 if (status != HCI_ERROR_UNKNOWN_CONN_ID || 734 (params && params->explicit_connect)) 735 mgmt_connect_failed(hdev, &conn->dst, conn->type, 736 conn->dst_type, status); 737 738 hci_connect_cfm(conn, status); 739 740 hci_conn_del(conn); 741 742 /* Since we may have temporarily stopped the background scanning in 743 * favor of connection establishment, we should restart it. 744 */ 745 hci_update_background_scan(hdev); 746 747 /* Re-enable advertising in case this was a failed connection 748 * attempt as a peripheral. 749 */ 750 hci_req_reenable_advertising(hdev); 751} 752 753static void create_le_conn_complete(struct hci_dev *hdev, u8 status, u16 opcode) 754{ 755 struct hci_conn *conn; 756 757 hci_dev_lock(hdev); 758 759 conn = hci_lookup_le_connect(hdev); 760 761 if (!status) { 762 hci_connect_le_scan_cleanup(conn); 763 goto done; 764 } 765 766 bt_dev_err(hdev, "request failed to create LE connection: " 767 "status 0x%2.2x", status); 768 769 if (!conn) 770 goto done; 771 772 hci_le_conn_failed(conn, status); 773 774done: 775 hci_dev_unlock(hdev); 776} 777 778static bool conn_use_rpa(struct hci_conn *conn) 779{ 780 struct hci_dev *hdev = conn->hdev; 781 782 return hci_dev_test_flag(hdev, HCI_PRIVACY); 783} 784 785static void set_ext_conn_params(struct hci_conn *conn, 786 struct hci_cp_le_ext_conn_param *p) 787{ 788 struct hci_dev *hdev = conn->hdev; 789 790 memset(p, 0, sizeof(*p)); 791 792 p->scan_interval = cpu_to_le16(hdev->le_scan_int_connect); 793 p->scan_window = cpu_to_le16(hdev->le_scan_window_connect); 794 p->conn_interval_min = cpu_to_le16(conn->le_conn_min_interval); 795 p->conn_interval_max = cpu_to_le16(conn->le_conn_max_interval); 796 p->conn_latency = cpu_to_le16(conn->le_conn_latency); 797 p->supervision_timeout = cpu_to_le16(conn->le_supv_timeout); 798 p->min_ce_len = cpu_to_le16(0x0000); 799 p->max_ce_len = cpu_to_le16(0x0000); 800} 801 802static void hci_req_add_le_create_conn(struct hci_request *req, 803 struct hci_conn *conn, 804 bdaddr_t *direct_rpa) 805{ 806 struct hci_dev *hdev = conn->hdev; 807 u8 own_addr_type; 808 809 /* If direct address was provided we use it instead of current 810 * address. 811 */ 812 if (direct_rpa) { 813 if (bacmp(&req->hdev->random_addr, direct_rpa)) 814 hci_req_add(req, HCI_OP_LE_SET_RANDOM_ADDR, 6, 815 direct_rpa); 816 817 /* direct address is always RPA */ 818 own_addr_type = ADDR_LE_DEV_RANDOM; 819 } else { 820 /* Update random address, but set require_privacy to false so 821 * that we never connect with an non-resolvable address. 822 */ 823 if (hci_update_random_address(req, false, conn_use_rpa(conn), 824 &own_addr_type)) 825 return; 826 } 827 828 if (use_ext_conn(hdev)) { 829 struct hci_cp_le_ext_create_conn *cp; 830 struct hci_cp_le_ext_conn_param *p; 831 u8 data[sizeof(*cp) + sizeof(*p) * 3]; 832 u32 plen; 833 834 cp = (void *) data; 835 p = (void *) cp->data; 836 837 memset(cp, 0, sizeof(*cp)); 838 839 bacpy(&cp->peer_addr, &conn->dst); 840 cp->peer_addr_type = conn->dst_type; 841 cp->own_addr_type = own_addr_type; 842 843 plen = sizeof(*cp); 844 845 if (scan_1m(hdev)) { 846 cp->phys |= LE_SCAN_PHY_1M; 847 set_ext_conn_params(conn, p); 848 849 p++; 850 plen += sizeof(*p); 851 } 852 853 if (scan_2m(hdev)) { 854 cp->phys |= LE_SCAN_PHY_2M; 855 set_ext_conn_params(conn, p); 856 857 p++; 858 plen += sizeof(*p); 859 } 860 861 if (scan_coded(hdev)) { 862 cp->phys |= LE_SCAN_PHY_CODED; 863 set_ext_conn_params(conn, p); 864 865 plen += sizeof(*p); 866 } 867 868 hci_req_add(req, HCI_OP_LE_EXT_CREATE_CONN, plen, data); 869 870 } else { 871 struct hci_cp_le_create_conn cp; 872 873 memset(&cp, 0, sizeof(cp)); 874 875 cp.scan_interval = cpu_to_le16(hdev->le_scan_int_connect); 876 cp.scan_window = cpu_to_le16(hdev->le_scan_window_connect); 877 878 bacpy(&cp.peer_addr, &conn->dst); 879 cp.peer_addr_type = conn->dst_type; 880 cp.own_address_type = own_addr_type; 881 cp.conn_interval_min = cpu_to_le16(conn->le_conn_min_interval); 882 cp.conn_interval_max = cpu_to_le16(conn->le_conn_max_interval); 883 cp.conn_latency = cpu_to_le16(conn->le_conn_latency); 884 cp.supervision_timeout = cpu_to_le16(conn->le_supv_timeout); 885 cp.min_ce_len = cpu_to_le16(0x0000); 886 cp.max_ce_len = cpu_to_le16(0x0000); 887 888 hci_req_add(req, HCI_OP_LE_CREATE_CONN, sizeof(cp), &cp); 889 } 890 891 conn->state = BT_CONNECT; 892 clear_bit(HCI_CONN_SCANNING, &conn->flags); 893} 894 895static void hci_req_directed_advertising(struct hci_request *req, 896 struct hci_conn *conn) 897{ 898 struct hci_dev *hdev = req->hdev; 899 u8 own_addr_type; 900 u8 enable; 901 902 if (ext_adv_capable(hdev)) { 903 struct hci_cp_le_set_ext_adv_params cp; 904 bdaddr_t random_addr; 905 906 /* Set require_privacy to false so that the remote device has a 907 * chance of identifying us. 908 */ 909 if (hci_get_random_address(hdev, false, conn_use_rpa(conn), NULL, 910 &own_addr_type, &random_addr) < 0) 911 return; 912 913 memset(&cp, 0, sizeof(cp)); 914 915 cp.evt_properties = cpu_to_le16(LE_LEGACY_ADV_DIRECT_IND); 916 cp.own_addr_type = own_addr_type; 917 cp.channel_map = hdev->le_adv_channel_map; 918 cp.tx_power = HCI_TX_POWER_INVALID; 919 cp.primary_phy = HCI_ADV_PHY_1M; 920 cp.secondary_phy = HCI_ADV_PHY_1M; 921 cp.handle = 0; /* Use instance 0 for directed adv */ 922 cp.own_addr_type = own_addr_type; 923 cp.peer_addr_type = conn->dst_type; 924 bacpy(&cp.peer_addr, &conn->dst); 925 926 /* As per Core Spec 5.2 Vol 2, PART E, Sec 7.8.53, for 927 * advertising_event_property LE_LEGACY_ADV_DIRECT_IND 928 * does not supports advertising data when the advertising set already 929 * contains some, the controller shall return erroc code 'Invalid 930 * HCI Command Parameters(0x12). 931 * So it is required to remove adv set for handle 0x00. since we use 932 * instance 0 for directed adv. 933 */ 934 __hci_req_remove_ext_adv_instance(req, cp.handle); 935 936 hci_req_add(req, HCI_OP_LE_SET_EXT_ADV_PARAMS, sizeof(cp), &cp); 937 938 if (own_addr_type == ADDR_LE_DEV_RANDOM && 939 bacmp(&random_addr, BDADDR_ANY) && 940 bacmp(&random_addr, &hdev->random_addr)) { 941 struct hci_cp_le_set_adv_set_rand_addr cp; 942 943 memset(&cp, 0, sizeof(cp)); 944 945 cp.handle = 0; 946 bacpy(&cp.bdaddr, &random_addr); 947 948 hci_req_add(req, 949 HCI_OP_LE_SET_ADV_SET_RAND_ADDR, 950 sizeof(cp), &cp); 951 } 952 953 __hci_req_enable_ext_advertising(req, 0x00); 954 } else { 955 struct hci_cp_le_set_adv_param cp; 956 957 /* Clear the HCI_LE_ADV bit temporarily so that the 958 * hci_update_random_address knows that it's safe to go ahead 959 * and write a new random address. The flag will be set back on 960 * as soon as the SET_ADV_ENABLE HCI command completes. 961 */ 962 hci_dev_clear_flag(hdev, HCI_LE_ADV); 963 964 /* Set require_privacy to false so that the remote device has a 965 * chance of identifying us. 966 */ 967 if (hci_update_random_address(req, false, conn_use_rpa(conn), 968 &own_addr_type) < 0) 969 return; 970 971 memset(&cp, 0, sizeof(cp)); 972 973 /* Some controllers might reject command if intervals are not 974 * within range for undirected advertising. 975 * BCM20702A0 is known to be affected by this. 976 */ 977 cp.min_interval = cpu_to_le16(0x0020); 978 cp.max_interval = cpu_to_le16(0x0020); 979 980 cp.type = LE_ADV_DIRECT_IND; 981 cp.own_address_type = own_addr_type; 982 cp.direct_addr_type = conn->dst_type; 983 bacpy(&cp.direct_addr, &conn->dst); 984 cp.channel_map = hdev->le_adv_channel_map; 985 986 hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp); 987 988 enable = 0x01; 989 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), 990 &enable); 991 } 992 993 conn->state = BT_CONNECT; 994} 995 996struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst, 997 u8 dst_type, u8 sec_level, u16 conn_timeout, 998 u8 role, bdaddr_t *direct_rpa) 999{ 1000 struct hci_conn_params *params; 1001 struct hci_conn *conn; 1002 struct smp_irk *irk; 1003 struct hci_request req; 1004 int err; 1005 1006 /* This ensures that during disable le_scan address resolution 1007 * will not be disabled if it is followed by le_create_conn 1008 */ 1009 bool rpa_le_conn = true; 1010 1011 /* Let's make sure that le is enabled.*/ 1012 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 1013 if (lmp_le_capable(hdev)) 1014 return ERR_PTR(-ECONNREFUSED); 1015 1016 return ERR_PTR(-EOPNOTSUPP); 1017 } 1018 1019 /* Since the controller supports only one LE connection attempt at a 1020 * time, we return -EBUSY if there is any connection attempt running. 1021 */ 1022 if (hci_lookup_le_connect(hdev)) 1023 return ERR_PTR(-EBUSY); 1024 1025 /* If there's already a connection object but it's not in 1026 * scanning state it means it must already be established, in 1027 * which case we can't do anything else except report a failure 1028 * to connect. 1029 */ 1030 conn = hci_conn_hash_lookup_le(hdev, dst, dst_type); 1031 if (conn && !test_bit(HCI_CONN_SCANNING, &conn->flags)) { 1032 return ERR_PTR(-EBUSY); 1033 } 1034 1035 /* When given an identity address with existing identity 1036 * resolving key, the connection needs to be established 1037 * to a resolvable random address. 1038 * 1039 * Storing the resolvable random address is required here 1040 * to handle connection failures. The address will later 1041 * be resolved back into the original identity address 1042 * from the connect request. 1043 */ 1044 irk = hci_find_irk_by_addr(hdev, dst, dst_type); 1045 if (irk && bacmp(&irk->rpa, BDADDR_ANY)) { 1046 dst = &irk->rpa; 1047 dst_type = ADDR_LE_DEV_RANDOM; 1048 } 1049 1050 if (conn) { 1051 bacpy(&conn->dst, dst); 1052 } else { 1053 conn = hci_conn_add(hdev, LE_LINK, dst, role); 1054 if (!conn) 1055 return ERR_PTR(-ENOMEM); 1056 hci_conn_hold(conn); 1057 conn->pending_sec_level = sec_level; 1058 } 1059 1060 conn->dst_type = dst_type; 1061 conn->sec_level = BT_SECURITY_LOW; 1062 conn->conn_timeout = conn_timeout; 1063 1064 hci_req_init(&req, hdev); 1065 1066 /* Disable advertising if we're active. For central role 1067 * connections most controllers will refuse to connect if 1068 * advertising is enabled, and for peripheral role connections we 1069 * anyway have to disable it in order to start directed 1070 * advertising. 1071 */ 1072 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 1073 __hci_req_disable_advertising(&req); 1074 1075 /* If requested to connect as peripheral use directed advertising */ 1076 if (conn->role == HCI_ROLE_SLAVE) { 1077 /* If we're active scanning most controllers are unable 1078 * to initiate advertising. Simply reject the attempt. 1079 */ 1080 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) && 1081 hdev->le_scan_type == LE_SCAN_ACTIVE) { 1082 hci_req_purge(&req); 1083 hci_conn_del(conn); 1084 return ERR_PTR(-EBUSY); 1085 } 1086 1087 hci_req_directed_advertising(&req, conn); 1088 goto create_conn; 1089 } 1090 1091 params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type); 1092 if (params) { 1093 conn->le_conn_min_interval = params->conn_min_interval; 1094 conn->le_conn_max_interval = params->conn_max_interval; 1095 conn->le_conn_latency = params->conn_latency; 1096 conn->le_supv_timeout = params->supervision_timeout; 1097 } else { 1098 conn->le_conn_min_interval = hdev->le_conn_min_interval; 1099 conn->le_conn_max_interval = hdev->le_conn_max_interval; 1100 conn->le_conn_latency = hdev->le_conn_latency; 1101 conn->le_supv_timeout = hdev->le_supv_timeout; 1102 } 1103 1104 /* If controller is scanning, we stop it since some controllers are 1105 * not able to scan and connect at the same time. Also set the 1106 * HCI_LE_SCAN_INTERRUPTED flag so that the command complete 1107 * handler for scan disabling knows to set the correct discovery 1108 * state. 1109 */ 1110 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) { 1111 hci_req_add_le_scan_disable(&req, rpa_le_conn); 1112 hci_dev_set_flag(hdev, HCI_LE_SCAN_INTERRUPTED); 1113 } 1114 1115 hci_req_add_le_create_conn(&req, conn, direct_rpa); 1116 1117create_conn: 1118 err = hci_req_run(&req, create_le_conn_complete); 1119 if (err) { 1120 hci_conn_del(conn); 1121 return ERR_PTR(err); 1122 } 1123 1124 return conn; 1125} 1126 1127static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type) 1128{ 1129 struct hci_conn *conn; 1130 1131 conn = hci_conn_hash_lookup_le(hdev, addr, type); 1132 if (!conn) 1133 return false; 1134 1135 if (conn->state != BT_CONNECTED) 1136 return false; 1137 1138 return true; 1139} 1140 1141/* This function requires the caller holds hdev->lock */ 1142static int hci_explicit_conn_params_set(struct hci_dev *hdev, 1143 bdaddr_t *addr, u8 addr_type) 1144{ 1145 struct hci_conn_params *params; 1146 1147 if (is_connected(hdev, addr, addr_type)) 1148 return -EISCONN; 1149 1150 params = hci_conn_params_lookup(hdev, addr, addr_type); 1151 if (!params) { 1152 params = hci_conn_params_add(hdev, addr, addr_type); 1153 if (!params) 1154 return -ENOMEM; 1155 1156 /* If we created new params, mark them to be deleted in 1157 * hci_connect_le_scan_cleanup. It's different case than 1158 * existing disabled params, those will stay after cleanup. 1159 */ 1160 params->auto_connect = HCI_AUTO_CONN_EXPLICIT; 1161 } 1162 1163 /* We're trying to connect, so make sure params are at pend_le_conns */ 1164 if (params->auto_connect == HCI_AUTO_CONN_DISABLED || 1165 params->auto_connect == HCI_AUTO_CONN_REPORT || 1166 params->auto_connect == HCI_AUTO_CONN_EXPLICIT) { 1167 list_del_init(¶ms->action); 1168 list_add(¶ms->action, &hdev->pend_le_conns); 1169 } 1170 1171 params->explicit_connect = true; 1172 1173 BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type, 1174 params->auto_connect); 1175 1176 return 0; 1177} 1178 1179/* This function requires the caller holds hdev->lock */ 1180struct hci_conn *hci_connect_le_scan(struct hci_dev *hdev, bdaddr_t *dst, 1181 u8 dst_type, u8 sec_level, 1182 u16 conn_timeout, 1183 enum conn_reasons conn_reason) 1184{ 1185 struct hci_conn *conn; 1186 1187 /* Let's make sure that le is enabled.*/ 1188 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 1189 if (lmp_le_capable(hdev)) 1190 return ERR_PTR(-ECONNREFUSED); 1191 1192 return ERR_PTR(-EOPNOTSUPP); 1193 } 1194 1195 /* Some devices send ATT messages as soon as the physical link is 1196 * established. To be able to handle these ATT messages, the user- 1197 * space first establishes the connection and then starts the pairing 1198 * process. 1199 * 1200 * So if a hci_conn object already exists for the following connection 1201 * attempt, we simply update pending_sec_level and auth_type fields 1202 * and return the object found. 1203 */ 1204 conn = hci_conn_hash_lookup_le(hdev, dst, dst_type); 1205 if (conn) { 1206 if (conn->pending_sec_level < sec_level) 1207 conn->pending_sec_level = sec_level; 1208 goto done; 1209 } 1210 1211 BT_DBG("requesting refresh of dst_addr"); 1212 1213 conn = hci_conn_add(hdev, LE_LINK, dst, HCI_ROLE_MASTER); 1214 if (!conn) 1215 return ERR_PTR(-ENOMEM); 1216 1217 if (hci_explicit_conn_params_set(hdev, dst, dst_type) < 0) { 1218 hci_conn_del(conn); 1219 return ERR_PTR(-EBUSY); 1220 } 1221 1222 conn->state = BT_CONNECT; 1223 set_bit(HCI_CONN_SCANNING, &conn->flags); 1224 conn->dst_type = dst_type; 1225 conn->sec_level = BT_SECURITY_LOW; 1226 conn->pending_sec_level = sec_level; 1227 conn->conn_timeout = conn_timeout; 1228 conn->conn_reason = conn_reason; 1229 1230 hci_update_background_scan(hdev); 1231 1232done: 1233 hci_conn_hold(conn); 1234 return conn; 1235} 1236 1237struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst, 1238 u8 sec_level, u8 auth_type, 1239 enum conn_reasons conn_reason) 1240{ 1241 struct hci_conn *acl; 1242 1243 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 1244 if (lmp_bredr_capable(hdev)) 1245 return ERR_PTR(-ECONNREFUSED); 1246 1247 return ERR_PTR(-EOPNOTSUPP); 1248 } 1249 1250 /* Reject outgoing connection to device with same BD ADDR against 1251 * CVE-2020-26555 1252 */ 1253 if (!bacmp(&hdev->bdaddr, dst)) { 1254 bt_dev_dbg(hdev, "Reject connection with same BD_ADDR %pMR\n", 1255 dst); 1256 return ERR_PTR(-ECONNREFUSED); 1257 } 1258 1259 acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst); 1260 if (!acl) { 1261 acl = hci_conn_add(hdev, ACL_LINK, dst, HCI_ROLE_MASTER); 1262 if (!acl) 1263 return ERR_PTR(-ENOMEM); 1264 } 1265 1266 hci_conn_hold(acl); 1267 1268 acl->conn_reason = conn_reason; 1269 if (acl->state == BT_OPEN || acl->state == BT_CLOSED) { 1270 acl->sec_level = BT_SECURITY_LOW; 1271 acl->pending_sec_level = sec_level; 1272 acl->auth_type = auth_type; 1273 hci_acl_create_connection(acl); 1274 } 1275 1276 return acl; 1277} 1278 1279struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type, bdaddr_t *dst, 1280 __u16 setting) 1281{ 1282 struct hci_conn *acl; 1283 struct hci_conn *sco; 1284 1285 acl = hci_connect_acl(hdev, dst, BT_SECURITY_LOW, HCI_AT_NO_BONDING, 1286 CONN_REASON_SCO_CONNECT); 1287 if (IS_ERR(acl)) 1288 return acl; 1289 1290 sco = hci_conn_hash_lookup_ba(hdev, type, dst); 1291 if (!sco) { 1292 sco = hci_conn_add(hdev, type, dst, HCI_ROLE_MASTER); 1293 if (!sco) { 1294 hci_conn_drop(acl); 1295 return ERR_PTR(-ENOMEM); 1296 } 1297 } 1298 1299 acl->link = sco; 1300 sco->link = acl; 1301 1302 hci_conn_hold(sco); 1303 1304 sco->setting = setting; 1305 1306 if (acl->state == BT_CONNECTED && 1307 (sco->state == BT_OPEN || sco->state == BT_CLOSED)) { 1308 set_bit(HCI_CONN_POWER_SAVE, &acl->flags); 1309 hci_conn_enter_active_mode(acl, BT_POWER_FORCE_ACTIVE_ON); 1310 1311 if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->flags)) { 1312 /* defer SCO setup until mode change completed */ 1313 set_bit(HCI_CONN_SCO_SETUP_PEND, &acl->flags); 1314 return sco; 1315 } 1316 1317 hci_sco_setup(acl, 0x00); 1318 } 1319 1320 return sco; 1321} 1322 1323/* Check link security requirement */ 1324int hci_conn_check_link_mode(struct hci_conn *conn) 1325{ 1326 BT_DBG("hcon %p", conn); 1327 1328 /* In Secure Connections Only mode, it is required that Secure 1329 * Connections is used and the link is encrypted with AES-CCM 1330 * using a P-256 authenticated combination key. 1331 */ 1332 if (hci_dev_test_flag(conn->hdev, HCI_SC_ONLY)) { 1333 if (!hci_conn_sc_enabled(conn) || 1334 !test_bit(HCI_CONN_AES_CCM, &conn->flags) || 1335 conn->key_type != HCI_LK_AUTH_COMBINATION_P256) 1336 return 0; 1337 } 1338 1339 /* AES encryption is required for Level 4: 1340 * 1341 * BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 3, Part C 1342 * page 1319: 1343 * 1344 * 128-bit equivalent strength for link and encryption keys 1345 * required using FIPS approved algorithms (E0 not allowed, 1346 * SAFER+ not allowed, and P-192 not allowed; encryption key 1347 * not shortened) 1348 */ 1349 if (conn->sec_level == BT_SECURITY_FIPS && 1350 !test_bit(HCI_CONN_AES_CCM, &conn->flags)) { 1351 bt_dev_err(conn->hdev, 1352 "Invalid security: Missing AES-CCM usage"); 1353 return 0; 1354 } 1355 1356 if (hci_conn_ssp_enabled(conn) && 1357 !test_bit(HCI_CONN_ENCRYPT, &conn->flags)) 1358 return 0; 1359 1360 return 1; 1361} 1362 1363/* Authenticate remote device */ 1364static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type) 1365{ 1366 BT_DBG("hcon %p", conn); 1367 1368 if (conn->pending_sec_level > sec_level) 1369 sec_level = conn->pending_sec_level; 1370 1371 if (sec_level > conn->sec_level) 1372 conn->pending_sec_level = sec_level; 1373 else if (test_bit(HCI_CONN_AUTH, &conn->flags)) 1374 return 1; 1375 1376 /* Make sure we preserve an existing MITM requirement*/ 1377 auth_type |= (conn->auth_type & 0x01); 1378 1379 conn->auth_type = auth_type; 1380 1381 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) { 1382 struct hci_cp_auth_requested cp; 1383 1384 cp.handle = cpu_to_le16(conn->handle); 1385 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED, 1386 sizeof(cp), &cp); 1387 1388 /* Set the ENCRYPT_PEND to trigger encryption after 1389 * authentication. 1390 */ 1391 if (!test_bit(HCI_CONN_ENCRYPT, &conn->flags)) 1392 set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags); 1393 } 1394 1395 return 0; 1396} 1397 1398/* Encrypt the link */ 1399static void hci_conn_encrypt(struct hci_conn *conn) 1400{ 1401 BT_DBG("hcon %p", conn); 1402 1403 if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) { 1404 struct hci_cp_set_conn_encrypt cp; 1405 cp.handle = cpu_to_le16(conn->handle); 1406 cp.encrypt = 0x01; 1407 hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp), 1408 &cp); 1409 } 1410} 1411 1412/* Enable security */ 1413int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type, 1414 bool initiator) 1415{ 1416 BT_DBG("hcon %p", conn); 1417 1418 if (conn->type == LE_LINK) 1419 return smp_conn_security(conn, sec_level); 1420 1421 /* For sdp we don't need the link key. */ 1422 if (sec_level == BT_SECURITY_SDP) 1423 return 1; 1424 1425 /* For non 2.1 devices and low security level we don't need the link 1426 key. */ 1427 if (sec_level == BT_SECURITY_LOW && !hci_conn_ssp_enabled(conn)) 1428 return 1; 1429 1430 /* For other security levels we need the link key. */ 1431 if (!test_bit(HCI_CONN_AUTH, &conn->flags)) 1432 goto auth; 1433 1434 switch (conn->key_type) { 1435 case HCI_LK_AUTH_COMBINATION_P256: 1436 /* An authenticated FIPS approved combination key has 1437 * sufficient security for security level 4 or lower. 1438 */ 1439 if (sec_level <= BT_SECURITY_FIPS) 1440 goto encrypt; 1441 break; 1442 case HCI_LK_AUTH_COMBINATION_P192: 1443 /* An authenticated combination key has sufficient security for 1444 * security level 3 or lower. 1445 */ 1446 if (sec_level <= BT_SECURITY_HIGH) 1447 goto encrypt; 1448 break; 1449 case HCI_LK_UNAUTH_COMBINATION_P192: 1450 case HCI_LK_UNAUTH_COMBINATION_P256: 1451 /* An unauthenticated combination key has sufficient security 1452 * for security level 2 or lower. 1453 */ 1454 if (sec_level <= BT_SECURITY_MEDIUM) 1455 goto encrypt; 1456 break; 1457 case HCI_LK_COMBINATION: 1458 /* A combination key has always sufficient security for the 1459 * security levels 2 or lower. High security level requires the 1460 * combination key is generated using maximum PIN code length 1461 * (16). For pre 2.1 units. 1462 */ 1463 if (sec_level <= BT_SECURITY_MEDIUM || conn->pin_length == 16) 1464 goto encrypt; 1465 break; 1466 default: 1467 break; 1468 } 1469 1470auth: 1471 if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) 1472 return 0; 1473 1474 if (initiator) 1475 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags); 1476 1477 if (!hci_conn_auth(conn, sec_level, auth_type)) 1478 return 0; 1479 1480encrypt: 1481 if (test_bit(HCI_CONN_ENCRYPT, &conn->flags)) { 1482 /* Ensure that the encryption key size has been read, 1483 * otherwise stall the upper layer responses. 1484 */ 1485 if (!conn->enc_key_size) 1486 return 0; 1487 1488 /* Nothing else needed, all requirements are met */ 1489 return 1; 1490 } 1491 1492 hci_conn_encrypt(conn); 1493 return 0; 1494} 1495EXPORT_SYMBOL(hci_conn_security); 1496 1497/* Check secure link requirement */ 1498int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level) 1499{ 1500 BT_DBG("hcon %p", conn); 1501 1502 /* Accept if non-secure or higher security level is required */ 1503 if (sec_level != BT_SECURITY_HIGH && sec_level != BT_SECURITY_FIPS) 1504 return 1; 1505 1506 /* Accept if secure or higher security level is already present */ 1507 if (conn->sec_level == BT_SECURITY_HIGH || 1508 conn->sec_level == BT_SECURITY_FIPS) 1509 return 1; 1510 1511 /* Reject not secure link */ 1512 return 0; 1513} 1514EXPORT_SYMBOL(hci_conn_check_secure); 1515 1516/* Switch role */ 1517int hci_conn_switch_role(struct hci_conn *conn, __u8 role) 1518{ 1519 BT_DBG("hcon %p", conn); 1520 1521 if (role == conn->role) 1522 return 1; 1523 1524 if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->flags)) { 1525 struct hci_cp_switch_role cp; 1526 bacpy(&cp.bdaddr, &conn->dst); 1527 cp.role = role; 1528 hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp); 1529 } 1530 1531 return 0; 1532} 1533EXPORT_SYMBOL(hci_conn_switch_role); 1534 1535/* Enter active mode */ 1536void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active) 1537{ 1538 struct hci_dev *hdev = conn->hdev; 1539 1540 BT_DBG("hcon %p mode %d", conn, conn->mode); 1541 1542 if (conn->mode != HCI_CM_SNIFF) 1543 goto timer; 1544 1545 if (!test_bit(HCI_CONN_POWER_SAVE, &conn->flags) && !force_active) 1546 goto timer; 1547 1548 if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) { 1549 struct hci_cp_exit_sniff_mode cp; 1550 cp.handle = cpu_to_le16(conn->handle); 1551 hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp); 1552 } 1553 1554timer: 1555 if (hdev->idle_timeout > 0) 1556 queue_delayed_work(hdev->workqueue, &conn->idle_work, 1557 msecs_to_jiffies(hdev->idle_timeout)); 1558} 1559 1560/* Drop all connection on the device */ 1561void hci_conn_hash_flush(struct hci_dev *hdev) 1562{ 1563 struct hci_conn_hash *h = &hdev->conn_hash; 1564 struct hci_conn *c, *n; 1565 1566 BT_DBG("hdev %s", hdev->name); 1567 1568 list_for_each_entry_safe(c, n, &h->list, list) { 1569 c->state = BT_CLOSED; 1570 1571 hci_disconn_cfm(c, HCI_ERROR_LOCAL_HOST_TERM); 1572 hci_conn_del(c); 1573 } 1574} 1575 1576/* Check pending connect attempts */ 1577void hci_conn_check_pending(struct hci_dev *hdev) 1578{ 1579 struct hci_conn *conn; 1580 1581 BT_DBG("hdev %s", hdev->name); 1582 1583 hci_dev_lock(hdev); 1584 1585 conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2); 1586 if (conn) 1587 hci_acl_create_connection(conn); 1588 1589 hci_dev_unlock(hdev); 1590} 1591 1592static u32 get_link_mode(struct hci_conn *conn) 1593{ 1594 u32 link_mode = 0; 1595 1596 if (conn->role == HCI_ROLE_MASTER) 1597 link_mode |= HCI_LM_MASTER; 1598 1599 if (test_bit(HCI_CONN_ENCRYPT, &conn->flags)) 1600 link_mode |= HCI_LM_ENCRYPT; 1601 1602 if (test_bit(HCI_CONN_AUTH, &conn->flags)) 1603 link_mode |= HCI_LM_AUTH; 1604 1605 if (test_bit(HCI_CONN_SECURE, &conn->flags)) 1606 link_mode |= HCI_LM_SECURE; 1607 1608 if (test_bit(HCI_CONN_FIPS, &conn->flags)) 1609 link_mode |= HCI_LM_FIPS; 1610 1611 return link_mode; 1612} 1613 1614int hci_get_conn_list(void __user *arg) 1615{ 1616 struct hci_conn *c; 1617 struct hci_conn_list_req req, *cl; 1618 struct hci_conn_info *ci; 1619 struct hci_dev *hdev; 1620 int n = 0, size, err; 1621 1622 if (copy_from_user(&req, arg, sizeof(req))) 1623 return -EFAULT; 1624 1625 if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci)) 1626 return -EINVAL; 1627 1628 size = sizeof(req) + req.conn_num * sizeof(*ci); 1629 1630 cl = kmalloc(size, GFP_KERNEL); 1631 if (!cl) 1632 return -ENOMEM; 1633 1634 hdev = hci_dev_get(req.dev_id); 1635 if (!hdev) { 1636 kfree(cl); 1637 return -ENODEV; 1638 } 1639 1640 ci = cl->conn_info; 1641 1642 hci_dev_lock(hdev); 1643 list_for_each_entry(c, &hdev->conn_hash.list, list) { 1644 bacpy(&(ci + n)->bdaddr, &c->dst); 1645 (ci + n)->handle = c->handle; 1646 (ci + n)->type = c->type; 1647 (ci + n)->out = c->out; 1648 (ci + n)->state = c->state; 1649 (ci + n)->link_mode = get_link_mode(c); 1650 if (++n >= req.conn_num) 1651 break; 1652 } 1653 hci_dev_unlock(hdev); 1654 1655 cl->dev_id = hdev->id; 1656 cl->conn_num = n; 1657 size = sizeof(req) + n * sizeof(*ci); 1658 1659 hci_dev_put(hdev); 1660 1661 err = copy_to_user(arg, cl, size); 1662 kfree(cl); 1663 1664 return err ? -EFAULT : 0; 1665} 1666 1667int hci_get_conn_info(struct hci_dev *hdev, void __user *arg) 1668{ 1669 struct hci_conn_info_req req; 1670 struct hci_conn_info ci; 1671 struct hci_conn *conn; 1672 char __user *ptr = arg + sizeof(req); 1673 1674 if (copy_from_user(&req, arg, sizeof(req))) 1675 return -EFAULT; 1676 1677 hci_dev_lock(hdev); 1678 conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr); 1679 if (conn) { 1680 bacpy(&ci.bdaddr, &conn->dst); 1681 ci.handle = conn->handle; 1682 ci.type = conn->type; 1683 ci.out = conn->out; 1684 ci.state = conn->state; 1685 ci.link_mode = get_link_mode(conn); 1686 } 1687 hci_dev_unlock(hdev); 1688 1689 if (!conn) 1690 return -ENOENT; 1691 1692 return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0; 1693} 1694 1695int hci_get_auth_info(struct hci_dev *hdev, void __user *arg) 1696{ 1697 struct hci_auth_info_req req; 1698 struct hci_conn *conn; 1699 1700 if (copy_from_user(&req, arg, sizeof(req))) 1701 return -EFAULT; 1702 1703 hci_dev_lock(hdev); 1704 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr); 1705 if (conn) 1706 req.type = conn->auth_type; 1707 hci_dev_unlock(hdev); 1708 1709 if (!conn) 1710 return -ENOENT; 1711 1712 return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0; 1713} 1714 1715struct hci_chan *hci_chan_create(struct hci_conn *conn) 1716{ 1717 struct hci_dev *hdev = conn->hdev; 1718 struct hci_chan *chan; 1719 1720 BT_DBG("%s hcon %p", hdev->name, conn); 1721 1722 if (test_bit(HCI_CONN_DROP, &conn->flags)) { 1723 BT_DBG("Refusing to create new hci_chan"); 1724 return NULL; 1725 } 1726 1727 chan = kzalloc(sizeof(*chan), GFP_KERNEL); 1728 if (!chan) 1729 return NULL; 1730 1731 chan->conn = hci_conn_get(conn); 1732 skb_queue_head_init(&chan->data_q); 1733 chan->state = BT_CONNECTED; 1734 1735 list_add_rcu(&chan->list, &conn->chan_list); 1736 1737 return chan; 1738} 1739 1740void hci_chan_del(struct hci_chan *chan) 1741{ 1742 struct hci_conn *conn = chan->conn; 1743 struct hci_dev *hdev = conn->hdev; 1744 1745 BT_DBG("%s hcon %p chan %p", hdev->name, conn, chan); 1746 1747 list_del_rcu(&chan->list); 1748 1749 synchronize_rcu(); 1750 1751 /* Prevent new hci_chan's to be created for this hci_conn */ 1752 set_bit(HCI_CONN_DROP, &conn->flags); 1753 1754 hci_conn_put(conn); 1755 1756 skb_queue_purge(&chan->data_q); 1757 kfree(chan); 1758} 1759 1760void hci_chan_list_flush(struct hci_conn *conn) 1761{ 1762 struct hci_chan *chan, *n; 1763 1764 BT_DBG("hcon %p", conn); 1765 1766 list_for_each_entry_safe(chan, n, &conn->chan_list, list) 1767 hci_chan_del(chan); 1768} 1769 1770static struct hci_chan *__hci_chan_lookup_handle(struct hci_conn *hcon, 1771 __u16 handle) 1772{ 1773 struct hci_chan *hchan; 1774 1775 list_for_each_entry(hchan, &hcon->chan_list, list) { 1776 if (hchan->handle == handle) 1777 return hchan; 1778 } 1779 1780 return NULL; 1781} 1782 1783struct hci_chan *hci_chan_lookup_handle(struct hci_dev *hdev, __u16 handle) 1784{ 1785 struct hci_conn_hash *h = &hdev->conn_hash; 1786 struct hci_conn *hcon; 1787 struct hci_chan *hchan = NULL; 1788 1789 rcu_read_lock(); 1790 1791 list_for_each_entry_rcu(hcon, &h->list, list) { 1792 hchan = __hci_chan_lookup_handle(hcon, handle); 1793 if (hchan) 1794 break; 1795 } 1796 1797 rcu_read_unlock(); 1798 1799 return hchan; 1800} 1801 1802u32 hci_conn_get_phy(struct hci_conn *conn) 1803{ 1804 u32 phys = 0; 1805 1806 /* BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 2, Part B page 471: 1807 * Table 6.2: Packets defined for synchronous, asynchronous, and 1808 * CSB logical transport types. 1809 */ 1810 switch (conn->type) { 1811 case SCO_LINK: 1812 /* SCO logical transport (1 Mb/s): 1813 * HV1, HV2, HV3 and DV. 1814 */ 1815 phys |= BT_PHY_BR_1M_1SLOT; 1816 1817 break; 1818 1819 case ACL_LINK: 1820 /* ACL logical transport (1 Mb/s) ptt=0: 1821 * DH1, DM3, DH3, DM5 and DH5. 1822 */ 1823 phys |= BT_PHY_BR_1M_1SLOT; 1824 1825 if (conn->pkt_type & (HCI_DM3 | HCI_DH3)) 1826 phys |= BT_PHY_BR_1M_3SLOT; 1827 1828 if (conn->pkt_type & (HCI_DM5 | HCI_DH5)) 1829 phys |= BT_PHY_BR_1M_5SLOT; 1830 1831 /* ACL logical transport (2 Mb/s) ptt=1: 1832 * 2-DH1, 2-DH3 and 2-DH5. 1833 */ 1834 if (!(conn->pkt_type & HCI_2DH1)) 1835 phys |= BT_PHY_EDR_2M_1SLOT; 1836 1837 if (!(conn->pkt_type & HCI_2DH3)) 1838 phys |= BT_PHY_EDR_2M_3SLOT; 1839 1840 if (!(conn->pkt_type & HCI_2DH5)) 1841 phys |= BT_PHY_EDR_2M_5SLOT; 1842 1843 /* ACL logical transport (3 Mb/s) ptt=1: 1844 * 3-DH1, 3-DH3 and 3-DH5. 1845 */ 1846 if (!(conn->pkt_type & HCI_3DH1)) 1847 phys |= BT_PHY_EDR_3M_1SLOT; 1848 1849 if (!(conn->pkt_type & HCI_3DH3)) 1850 phys |= BT_PHY_EDR_3M_3SLOT; 1851 1852 if (!(conn->pkt_type & HCI_3DH5)) 1853 phys |= BT_PHY_EDR_3M_5SLOT; 1854 1855 break; 1856 1857 case ESCO_LINK: 1858 /* eSCO logical transport (1 Mb/s): EV3, EV4 and EV5 */ 1859 phys |= BT_PHY_BR_1M_1SLOT; 1860 1861 if (!(conn->pkt_type & (ESCO_EV4 | ESCO_EV5))) 1862 phys |= BT_PHY_BR_1M_3SLOT; 1863 1864 /* eSCO logical transport (2 Mb/s): 2-EV3, 2-EV5 */ 1865 if (!(conn->pkt_type & ESCO_2EV3)) 1866 phys |= BT_PHY_EDR_2M_1SLOT; 1867 1868 if (!(conn->pkt_type & ESCO_2EV5)) 1869 phys |= BT_PHY_EDR_2M_3SLOT; 1870 1871 /* eSCO logical transport (3 Mb/s): 3-EV3, 3-EV5 */ 1872 if (!(conn->pkt_type & ESCO_3EV3)) 1873 phys |= BT_PHY_EDR_3M_1SLOT; 1874 1875 if (!(conn->pkt_type & ESCO_3EV5)) 1876 phys |= BT_PHY_EDR_3M_3SLOT; 1877 1878 break; 1879 1880 case LE_LINK: 1881 if (conn->le_tx_phy & HCI_LE_SET_PHY_1M) 1882 phys |= BT_PHY_LE_1M_TX; 1883 1884 if (conn->le_rx_phy & HCI_LE_SET_PHY_1M) 1885 phys |= BT_PHY_LE_1M_RX; 1886 1887 if (conn->le_tx_phy & HCI_LE_SET_PHY_2M) 1888 phys |= BT_PHY_LE_2M_TX; 1889 1890 if (conn->le_rx_phy & HCI_LE_SET_PHY_2M) 1891 phys |= BT_PHY_LE_2M_RX; 1892 1893 if (conn->le_tx_phy & HCI_LE_SET_PHY_CODED) 1894 phys |= BT_PHY_LE_CODED_TX; 1895 1896 if (conn->le_rx_phy & HCI_LE_SET_PHY_CODED) 1897 phys |= BT_PHY_LE_CODED_RX; 1898 1899 break; 1900 } 1901 1902 return phys; 1903} 1904