2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22 SOFTWARE IS DISCLAIMED.
25 /* Bluetooth HCI connection handling. */
27 #include <linux/export.h>
29 #include <net/bluetooth/bluetooth.h>
30 #include <net/bluetooth/hci_core.h>
31 #include <net/bluetooth/l2cap.h>
41 static const struct sco_param sco_param_cvsd
[] = {
42 { EDR_ESCO_MASK
& ~ESCO_2EV3
, 0x000a }, /* S3 */
43 { EDR_ESCO_MASK
& ~ESCO_2EV3
, 0x0007 }, /* S2 */
44 { EDR_ESCO_MASK
| ESCO_EV3
, 0x0007 }, /* S1 */
45 { EDR_ESCO_MASK
| ESCO_HV3
, 0xffff }, /* D1 */
46 { EDR_ESCO_MASK
| ESCO_HV1
, 0xffff }, /* D0 */
49 static const struct sco_param sco_param_wideband
[] = {
50 { EDR_ESCO_MASK
& ~ESCO_2EV3
, 0x000d }, /* T2 */
51 { EDR_ESCO_MASK
| ESCO_EV3
, 0x0008 }, /* T1 */
54 static void hci_le_create_connection_cancel(struct hci_conn
*conn
)
56 hci_send_cmd(conn
->hdev
, HCI_OP_LE_CREATE_CONN_CANCEL
, 0, NULL
);
59 static void hci_acl_create_connection(struct hci_conn
*conn
)
61 struct hci_dev
*hdev
= conn
->hdev
;
62 struct inquiry_entry
*ie
;
63 struct hci_cp_create_conn cp
;
65 BT_DBG("hcon %p", conn
);
67 conn
->state
= BT_CONNECT
;
70 set_bit(HCI_CONN_MASTER
, &conn
->flags
);
74 conn
->link_policy
= hdev
->link_policy
;
76 memset(&cp
, 0, sizeof(cp
));
77 bacpy(&cp
.bdaddr
, &conn
->dst
);
78 cp
.pscan_rep_mode
= 0x02;
80 ie
= hci_inquiry_cache_lookup(hdev
, &conn
->dst
);
82 if (inquiry_entry_age(ie
) <= INQUIRY_ENTRY_AGE_MAX
) {
83 cp
.pscan_rep_mode
= ie
->data
.pscan_rep_mode
;
84 cp
.pscan_mode
= ie
->data
.pscan_mode
;
85 cp
.clock_offset
= ie
->data
.clock_offset
|
89 memcpy(conn
->dev_class
, ie
->data
.dev_class
, 3);
90 if (ie
->data
.ssp_mode
> 0)
91 set_bit(HCI_CONN_SSP_ENABLED
, &conn
->flags
);
94 cp
.pkt_type
= cpu_to_le16(conn
->pkt_type
);
95 if (lmp_rswitch_capable(hdev
) && !(hdev
->link_mode
& HCI_LM_MASTER
))
96 cp
.role_switch
= 0x01;
98 cp
.role_switch
= 0x00;
100 hci_send_cmd(hdev
, HCI_OP_CREATE_CONN
, sizeof(cp
), &cp
);
103 static void hci_acl_create_connection_cancel(struct hci_conn
*conn
)
105 struct hci_cp_create_conn_cancel cp
;
107 BT_DBG("hcon %p", conn
);
109 if (conn
->hdev
->hci_ver
< BLUETOOTH_VER_1_2
)
112 bacpy(&cp
.bdaddr
, &conn
->dst
);
113 hci_send_cmd(conn
->hdev
, HCI_OP_CREATE_CONN_CANCEL
, sizeof(cp
), &cp
);
116 static void hci_reject_sco(struct hci_conn
*conn
)
118 struct hci_cp_reject_sync_conn_req cp
;
120 cp
.reason
= HCI_ERROR_REMOTE_USER_TERM
;
121 bacpy(&cp
.bdaddr
, &conn
->dst
);
123 hci_send_cmd(conn
->hdev
, HCI_OP_REJECT_SYNC_CONN_REQ
, sizeof(cp
), &cp
);
126 void hci_disconnect(struct hci_conn
*conn
, __u8 reason
)
128 struct hci_cp_disconnect cp
;
130 BT_DBG("hcon %p", conn
);
132 conn
->state
= BT_DISCONN
;
134 cp
.handle
= cpu_to_le16(conn
->handle
);
136 hci_send_cmd(conn
->hdev
, HCI_OP_DISCONNECT
, sizeof(cp
), &cp
);
139 static void hci_amp_disconn(struct hci_conn
*conn
)
141 struct hci_cp_disconn_phy_link cp
;
143 BT_DBG("hcon %p", conn
);
145 conn
->state
= BT_DISCONN
;
147 cp
.phy_handle
= HCI_PHY_HANDLE(conn
->handle
);
148 cp
.reason
= hci_proto_disconn_ind(conn
);
149 hci_send_cmd(conn
->hdev
, HCI_OP_DISCONN_PHY_LINK
,
153 static void hci_add_sco(struct hci_conn
*conn
, __u16 handle
)
155 struct hci_dev
*hdev
= conn
->hdev
;
156 struct hci_cp_add_sco cp
;
158 BT_DBG("hcon %p", conn
);
160 conn
->state
= BT_CONNECT
;
165 cp
.handle
= cpu_to_le16(handle
);
166 cp
.pkt_type
= cpu_to_le16(conn
->pkt_type
);
168 hci_send_cmd(hdev
, HCI_OP_ADD_SCO
, sizeof(cp
), &cp
);
171 bool hci_setup_sync(struct hci_conn
*conn
, __u16 handle
)
173 struct hci_dev
*hdev
= conn
->hdev
;
174 struct hci_cp_setup_sync_conn cp
;
175 const struct sco_param
*param
;
177 BT_DBG("hcon %p", conn
);
179 conn
->state
= BT_CONNECT
;
184 cp
.handle
= cpu_to_le16(handle
);
186 cp
.tx_bandwidth
= cpu_to_le32(0x00001f40);
187 cp
.rx_bandwidth
= cpu_to_le32(0x00001f40);
188 cp
.voice_setting
= cpu_to_le16(conn
->setting
);
190 switch (conn
->setting
& SCO_AIRMODE_MASK
) {
191 case SCO_AIRMODE_TRANSP
:
192 if (conn
->attempt
> ARRAY_SIZE(sco_param_wideband
))
194 cp
.retrans_effort
= 0x02;
195 param
= &sco_param_wideband
[conn
->attempt
- 1];
197 case SCO_AIRMODE_CVSD
:
198 if (conn
->attempt
> ARRAY_SIZE(sco_param_cvsd
))
200 cp
.retrans_effort
= 0x01;
201 param
= &sco_param_cvsd
[conn
->attempt
- 1];
207 cp
.pkt_type
= __cpu_to_le16(param
->pkt_type
);
208 cp
.max_latency
= __cpu_to_le16(param
->max_latency
);
210 if (hci_send_cmd(hdev
, HCI_OP_SETUP_SYNC_CONN
, sizeof(cp
), &cp
) < 0)
216 u8
hci_le_conn_update(struct hci_conn
*conn
, u16 min
, u16 max
, u16 latency
,
219 struct hci_dev
*hdev
= conn
->hdev
;
220 struct hci_conn_params
*params
;
221 struct hci_cp_le_conn_update cp
;
225 params
= hci_conn_params_lookup(hdev
, &conn
->dst
, conn
->dst_type
);
227 params
->conn_min_interval
= min
;
228 params
->conn_max_interval
= max
;
229 params
->conn_latency
= latency
;
230 params
->supervision_timeout
= to_multiplier
;
233 hci_dev_unlock(hdev
);
235 memset(&cp
, 0, sizeof(cp
));
236 cp
.handle
= cpu_to_le16(conn
->handle
);
237 cp
.conn_interval_min
= cpu_to_le16(min
);
238 cp
.conn_interval_max
= cpu_to_le16(max
);
239 cp
.conn_latency
= cpu_to_le16(latency
);
240 cp
.supervision_timeout
= cpu_to_le16(to_multiplier
);
241 cp
.min_ce_len
= cpu_to_le16(0x0000);
242 cp
.max_ce_len
= cpu_to_le16(0x0000);
244 hci_send_cmd(hdev
, HCI_OP_LE_CONN_UPDATE
, sizeof(cp
), &cp
);
252 void hci_le_start_enc(struct hci_conn
*conn
, __le16 ediv
, __le64 rand
,
255 struct hci_dev
*hdev
= conn
->hdev
;
256 struct hci_cp_le_start_enc cp
;
258 BT_DBG("hcon %p", conn
);
260 memset(&cp
, 0, sizeof(cp
));
262 cp
.handle
= cpu_to_le16(conn
->handle
);
265 memcpy(cp
.ltk
, ltk
, sizeof(cp
.ltk
));
267 hci_send_cmd(hdev
, HCI_OP_LE_START_ENC
, sizeof(cp
), &cp
);
270 /* Device _must_ be locked */
271 void hci_sco_setup(struct hci_conn
*conn
, __u8 status
)
273 struct hci_conn
*sco
= conn
->link
;
278 BT_DBG("hcon %p", conn
);
281 if (lmp_esco_capable(conn
->hdev
))
282 hci_setup_sync(sco
, conn
->handle
);
284 hci_add_sco(sco
, conn
->handle
);
286 hci_proto_connect_cfm(sco
, status
);
291 static void hci_conn_timeout(struct work_struct
*work
)
293 struct hci_conn
*conn
= container_of(work
, struct hci_conn
,
295 int refcnt
= atomic_read(&conn
->refcnt
);
297 BT_DBG("hcon %p state %s", conn
, state_to_string(conn
->state
));
301 /* FIXME: It was observed that in pairing failed scenario, refcnt
302 * drops below 0. Probably this is because l2cap_conn_del calls
303 * l2cap_chan_del for each channel, and inside l2cap_chan_del conn is
304 * dropped. After that loop hci_chan_del is called which also drops
305 * conn. For now make sure that ACL is alive if refcnt is higher then 0,
311 switch (conn
->state
) {
315 if (conn
->type
== ACL_LINK
)
316 hci_acl_create_connection_cancel(conn
);
317 else if (conn
->type
== LE_LINK
)
318 hci_le_create_connection_cancel(conn
);
319 } else if (conn
->type
== SCO_LINK
|| conn
->type
== ESCO_LINK
) {
320 hci_reject_sco(conn
);
325 if (conn
->type
== AMP_LINK
) {
326 hci_amp_disconn(conn
);
328 __u8 reason
= hci_proto_disconn_ind(conn
);
330 /* When we are master of an established connection
331 * and it enters the disconnect timeout, then go
332 * ahead and try to read the current clock offset.
334 * Processing of the result is done within the
335 * event handling and hci_clock_offset_evt function.
337 if (conn
->type
== ACL_LINK
&&
338 test_bit(HCI_CONN_MASTER
, &conn
->flags
)) {
339 struct hci_dev
*hdev
= conn
->hdev
;
340 struct hci_cp_read_clock_offset cp
;
342 cp
.handle
= cpu_to_le16(conn
->handle
);
344 hci_send_cmd(hdev
, HCI_OP_READ_CLOCK_OFFSET
,
348 hci_disconnect(conn
, reason
);
352 conn
->state
= BT_CLOSED
;
357 /* Enter sniff mode */
358 static void hci_conn_idle(struct work_struct
*work
)
360 struct hci_conn
*conn
= container_of(work
, struct hci_conn
,
362 struct hci_dev
*hdev
= conn
->hdev
;
364 BT_DBG("hcon %p mode %d", conn
, conn
->mode
);
366 if (!lmp_sniff_capable(hdev
) || !lmp_sniff_capable(conn
))
369 if (conn
->mode
!= HCI_CM_ACTIVE
|| !(conn
->link_policy
& HCI_LP_SNIFF
))
372 if (lmp_sniffsubr_capable(hdev
) && lmp_sniffsubr_capable(conn
)) {
373 struct hci_cp_sniff_subrate cp
;
374 cp
.handle
= cpu_to_le16(conn
->handle
);
375 cp
.max_latency
= cpu_to_le16(0);
376 cp
.min_remote_timeout
= cpu_to_le16(0);
377 cp
.min_local_timeout
= cpu_to_le16(0);
378 hci_send_cmd(hdev
, HCI_OP_SNIFF_SUBRATE
, sizeof(cp
), &cp
);
381 if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND
, &conn
->flags
)) {
382 struct hci_cp_sniff_mode cp
;
383 cp
.handle
= cpu_to_le16(conn
->handle
);
384 cp
.max_interval
= cpu_to_le16(hdev
->sniff_max_interval
);
385 cp
.min_interval
= cpu_to_le16(hdev
->sniff_min_interval
);
386 cp
.attempt
= cpu_to_le16(4);
387 cp
.timeout
= cpu_to_le16(1);
388 hci_send_cmd(hdev
, HCI_OP_SNIFF_MODE
, sizeof(cp
), &cp
);
392 static void hci_conn_auto_accept(struct work_struct
*work
)
394 struct hci_conn
*conn
= container_of(work
, struct hci_conn
,
395 auto_accept_work
.work
);
397 hci_send_cmd(conn
->hdev
, HCI_OP_USER_CONFIRM_REPLY
, sizeof(conn
->dst
),
401 static void le_conn_timeout(struct work_struct
*work
)
403 struct hci_conn
*conn
= container_of(work
, struct hci_conn
,
404 le_conn_timeout
.work
);
405 struct hci_dev
*hdev
= conn
->hdev
;
409 /* We could end up here due to having done directed advertising,
410 * so clean up the state if necessary. This should however only
411 * happen with broken hardware or if low duty cycle was used
412 * (which doesn't have a timeout of its own).
414 if (test_bit(HCI_ADVERTISING
, &hdev
->dev_flags
)) {
416 hci_send_cmd(hdev
, HCI_OP_LE_SET_ADV_ENABLE
, sizeof(enable
),
418 hci_le_conn_failed(conn
, HCI_ERROR_ADVERTISING_TIMEOUT
);
422 hci_le_create_connection_cancel(conn
);
425 struct hci_conn
*hci_conn_add(struct hci_dev
*hdev
, int type
, bdaddr_t
*dst
)
427 struct hci_conn
*conn
;
429 BT_DBG("%s dst %pMR", hdev
->name
, dst
);
431 conn
= kzalloc(sizeof(struct hci_conn
), GFP_KERNEL
);
435 bacpy(&conn
->dst
, dst
);
436 bacpy(&conn
->src
, &hdev
->bdaddr
);
439 conn
->mode
= HCI_CM_ACTIVE
;
440 conn
->state
= BT_OPEN
;
441 conn
->auth_type
= HCI_AT_GENERAL_BONDING
;
442 conn
->io_capability
= hdev
->io_capability
;
443 conn
->remote_auth
= 0xff;
444 conn
->key_type
= 0xff;
445 conn
->tx_power
= HCI_TX_POWER_INVALID
;
446 conn
->max_tx_power
= HCI_TX_POWER_INVALID
;
448 set_bit(HCI_CONN_POWER_SAVE
, &conn
->flags
);
449 conn
->disc_timeout
= HCI_DISCONN_TIMEOUT
;
453 conn
->pkt_type
= hdev
->pkt_type
& ACL_PTYPE_MASK
;
456 /* conn->src should reflect the local identity address */
457 hci_copy_identity_address(hdev
, &conn
->src
, &conn
->src_type
);
460 if (lmp_esco_capable(hdev
))
461 conn
->pkt_type
= (hdev
->esco_type
& SCO_ESCO_MASK
) |
462 (hdev
->esco_type
& EDR_ESCO_MASK
);
464 conn
->pkt_type
= hdev
->pkt_type
& SCO_PTYPE_MASK
;
467 conn
->pkt_type
= hdev
->esco_type
& ~EDR_ESCO_MASK
;
471 skb_queue_head_init(&conn
->data_q
);
473 INIT_LIST_HEAD(&conn
->chan_list
);
475 INIT_DELAYED_WORK(&conn
->disc_work
, hci_conn_timeout
);
476 INIT_DELAYED_WORK(&conn
->auto_accept_work
, hci_conn_auto_accept
);
477 INIT_DELAYED_WORK(&conn
->idle_work
, hci_conn_idle
);
478 INIT_DELAYED_WORK(&conn
->le_conn_timeout
, le_conn_timeout
);
480 atomic_set(&conn
->refcnt
, 0);
484 hci_conn_hash_add(hdev
, conn
);
486 hdev
->notify(hdev
, HCI_NOTIFY_CONN_ADD
);
488 hci_conn_init_sysfs(conn
);
493 int hci_conn_del(struct hci_conn
*conn
)
495 struct hci_dev
*hdev
= conn
->hdev
;
497 BT_DBG("%s hcon %p handle %d", hdev
->name
, conn
, conn
->handle
);
499 cancel_delayed_work_sync(&conn
->disc_work
);
500 cancel_delayed_work_sync(&conn
->auto_accept_work
);
501 cancel_delayed_work_sync(&conn
->idle_work
);
503 if (conn
->type
== ACL_LINK
) {
504 struct hci_conn
*sco
= conn
->link
;
509 hdev
->acl_cnt
+= conn
->sent
;
510 } else if (conn
->type
== LE_LINK
) {
511 cancel_delayed_work_sync(&conn
->le_conn_timeout
);
514 hdev
->le_cnt
+= conn
->sent
;
516 hdev
->acl_cnt
+= conn
->sent
;
518 struct hci_conn
*acl
= conn
->link
;
525 hci_chan_list_flush(conn
);
528 amp_mgr_put(conn
->amp_mgr
);
530 hci_conn_hash_del(hdev
, conn
);
532 hdev
->notify(hdev
, HCI_NOTIFY_CONN_DEL
);
534 skb_queue_purge(&conn
->data_q
);
536 hci_conn_del_sysfs(conn
);
545 struct hci_dev
*hci_get_route(bdaddr_t
*dst
, bdaddr_t
*src
)
547 int use_src
= bacmp(src
, BDADDR_ANY
);
548 struct hci_dev
*hdev
= NULL
, *d
;
550 BT_DBG("%pMR -> %pMR", src
, dst
);
552 read_lock(&hci_dev_list_lock
);
554 list_for_each_entry(d
, &hci_dev_list
, list
) {
555 if (!test_bit(HCI_UP
, &d
->flags
) ||
556 test_bit(HCI_USER_CHANNEL
, &d
->dev_flags
) ||
557 d
->dev_type
!= HCI_BREDR
)
561 * No source address - find interface with bdaddr != dst
562 * Source address - find interface with bdaddr == src
566 if (!bacmp(&d
->bdaddr
, src
)) {
570 if (bacmp(&d
->bdaddr
, dst
)) {
577 hdev
= hci_dev_hold(hdev
);
579 read_unlock(&hci_dev_list_lock
);
582 EXPORT_SYMBOL(hci_get_route
);
584 /* This function requires the caller holds hdev->lock */
585 void hci_le_conn_failed(struct hci_conn
*conn
, u8 status
)
587 struct hci_dev
*hdev
= conn
->hdev
;
589 conn
->state
= BT_CLOSED
;
591 mgmt_connect_failed(hdev
, &conn
->dst
, conn
->type
, conn
->dst_type
,
594 hci_proto_connect_cfm(conn
, status
);
598 /* Since we may have temporarily stopped the background scanning in
599 * favor of connection establishment, we should restart it.
601 hci_update_background_scan(hdev
);
603 /* Re-enable advertising in case this was a failed connection
604 * attempt as a peripheral.
606 mgmt_reenable_advertising(hdev
);
609 static void create_le_conn_complete(struct hci_dev
*hdev
, u8 status
)
611 struct hci_conn
*conn
;
616 BT_ERR("HCI request failed to create LE connection: status 0x%2.2x",
621 conn
= hci_conn_hash_lookup_state(hdev
, LE_LINK
, BT_CONNECT
);
625 hci_le_conn_failed(conn
, status
);
628 hci_dev_unlock(hdev
);
631 static void hci_req_add_le_create_conn(struct hci_request
*req
,
632 struct hci_conn
*conn
)
634 struct hci_cp_le_create_conn cp
;
635 struct hci_dev
*hdev
= conn
->hdev
;
638 memset(&cp
, 0, sizeof(cp
));
640 /* Update random address, but set require_privacy to false so
641 * that we never connect with an unresolvable address.
643 if (hci_update_random_address(req
, false, &own_addr_type
))
646 cp
.scan_interval
= cpu_to_le16(hdev
->le_scan_interval
);
647 cp
.scan_window
= cpu_to_le16(hdev
->le_scan_window
);
648 bacpy(&cp
.peer_addr
, &conn
->dst
);
649 cp
.peer_addr_type
= conn
->dst_type
;
650 cp
.own_address_type
= own_addr_type
;
651 cp
.conn_interval_min
= cpu_to_le16(conn
->le_conn_min_interval
);
652 cp
.conn_interval_max
= cpu_to_le16(conn
->le_conn_max_interval
);
653 cp
.conn_latency
= cpu_to_le16(conn
->le_conn_latency
);
654 cp
.supervision_timeout
= cpu_to_le16(conn
->le_supv_timeout
);
655 cp
.min_ce_len
= cpu_to_le16(0x0000);
656 cp
.max_ce_len
= cpu_to_le16(0x0000);
658 hci_req_add(req
, HCI_OP_LE_CREATE_CONN
, sizeof(cp
), &cp
);
660 conn
->state
= BT_CONNECT
;
663 static void hci_req_directed_advertising(struct hci_request
*req
,
664 struct hci_conn
*conn
)
666 struct hci_dev
*hdev
= req
->hdev
;
667 struct hci_cp_le_set_adv_param cp
;
672 hci_req_add(req
, HCI_OP_LE_SET_ADV_ENABLE
, sizeof(enable
), &enable
);
674 /* Clear the HCI_ADVERTISING bit temporarily so that the
675 * hci_update_random_address knows that it's safe to go ahead
676 * and write a new random address. The flag will be set back on
677 * as soon as the SET_ADV_ENABLE HCI command completes.
679 clear_bit(HCI_ADVERTISING
, &hdev
->dev_flags
);
681 /* Set require_privacy to false so that the remote device has a
682 * chance of identifying us.
684 if (hci_update_random_address(req
, false, &own_addr_type
) < 0)
687 memset(&cp
, 0, sizeof(cp
));
688 cp
.type
= LE_ADV_DIRECT_IND
;
689 cp
.own_address_type
= own_addr_type
;
690 cp
.direct_addr_type
= conn
->dst_type
;
691 bacpy(&cp
.direct_addr
, &conn
->dst
);
692 cp
.channel_map
= hdev
->le_adv_channel_map
;
694 hci_req_add(req
, HCI_OP_LE_SET_ADV_PARAM
, sizeof(cp
), &cp
);
697 hci_req_add(req
, HCI_OP_LE_SET_ADV_ENABLE
, sizeof(enable
), &enable
);
699 conn
->state
= BT_CONNECT
;
702 struct hci_conn
*hci_connect_le(struct hci_dev
*hdev
, bdaddr_t
*dst
,
703 u8 dst_type
, u8 sec_level
, u16 conn_timeout
)
705 struct hci_conn_params
*params
;
706 struct hci_conn
*conn
;
708 struct hci_request req
;
711 /* Some devices send ATT messages as soon as the physical link is
712 * established. To be able to handle these ATT messages, the user-
713 * space first establishes the connection and then starts the pairing
716 * So if a hci_conn object already exists for the following connection
717 * attempt, we simply update pending_sec_level and auth_type fields
718 * and return the object found.
720 conn
= hci_conn_hash_lookup_ba(hdev
, LE_LINK
, dst
);
722 conn
->pending_sec_level
= sec_level
;
726 /* Since the controller supports only one LE connection attempt at a
727 * time, we return -EBUSY if there is any connection attempt running.
729 conn
= hci_conn_hash_lookup_state(hdev
, LE_LINK
, BT_CONNECT
);
731 return ERR_PTR(-EBUSY
);
733 /* When given an identity address with existing identity
734 * resolving key, the connection needs to be established
735 * to a resolvable random address.
737 * This uses the cached random resolvable address from
738 * a previous scan. When no cached address is available,
739 * try connecting to the identity address instead.
741 * Storing the resolvable random address is required here
742 * to handle connection failures. The address will later
743 * be resolved back into the original identity address
744 * from the connect request.
746 irk
= hci_find_irk_by_addr(hdev
, dst
, dst_type
);
747 if (irk
&& bacmp(&irk
->rpa
, BDADDR_ANY
)) {
749 dst_type
= ADDR_LE_DEV_RANDOM
;
752 conn
= hci_conn_add(hdev
, LE_LINK
, dst
);
754 return ERR_PTR(-ENOMEM
);
756 conn
->dst_type
= dst_type
;
757 conn
->sec_level
= BT_SECURITY_LOW
;
758 conn
->pending_sec_level
= sec_level
;
759 conn
->conn_timeout
= conn_timeout
;
761 hci_req_init(&req
, hdev
);
763 if (test_bit(HCI_ADVERTISING
, &hdev
->dev_flags
)) {
764 hci_req_directed_advertising(&req
, conn
);
769 set_bit(HCI_CONN_MASTER
, &conn
->flags
);
771 params
= hci_conn_params_lookup(hdev
, &conn
->dst
, conn
->dst_type
);
773 conn
->le_conn_min_interval
= params
->conn_min_interval
;
774 conn
->le_conn_max_interval
= params
->conn_max_interval
;
775 conn
->le_conn_latency
= params
->conn_latency
;
776 conn
->le_supv_timeout
= params
->supervision_timeout
;
778 conn
->le_conn_min_interval
= hdev
->le_conn_min_interval
;
779 conn
->le_conn_max_interval
= hdev
->le_conn_max_interval
;
780 conn
->le_conn_latency
= hdev
->le_conn_latency
;
781 conn
->le_supv_timeout
= hdev
->le_supv_timeout
;
784 /* If controller is scanning, we stop it since some controllers are
785 * not able to scan and connect at the same time. Also set the
786 * HCI_LE_SCAN_INTERRUPTED flag so that the command complete
787 * handler for scan disabling knows to set the correct discovery
790 if (test_bit(HCI_LE_SCAN
, &hdev
->dev_flags
)) {
791 hci_req_add_le_scan_disable(&req
);
792 set_bit(HCI_LE_SCAN_INTERRUPTED
, &hdev
->dev_flags
);
795 hci_req_add_le_create_conn(&req
, conn
);
798 err
= hci_req_run(&req
, create_le_conn_complete
);
809 struct hci_conn
*hci_connect_acl(struct hci_dev
*hdev
, bdaddr_t
*dst
,
810 u8 sec_level
, u8 auth_type
)
812 struct hci_conn
*acl
;
814 if (!test_bit(HCI_BREDR_ENABLED
, &hdev
->dev_flags
))
815 return ERR_PTR(-ENOTSUPP
);
817 acl
= hci_conn_hash_lookup_ba(hdev
, ACL_LINK
, dst
);
819 acl
= hci_conn_add(hdev
, ACL_LINK
, dst
);
821 return ERR_PTR(-ENOMEM
);
826 if (acl
->state
== BT_OPEN
|| acl
->state
== BT_CLOSED
) {
827 acl
->sec_level
= BT_SECURITY_LOW
;
828 acl
->pending_sec_level
= sec_level
;
829 acl
->auth_type
= auth_type
;
830 hci_acl_create_connection(acl
);
836 struct hci_conn
*hci_connect_sco(struct hci_dev
*hdev
, int type
, bdaddr_t
*dst
,
839 struct hci_conn
*acl
;
840 struct hci_conn
*sco
;
842 acl
= hci_connect_acl(hdev
, dst
, BT_SECURITY_LOW
, HCI_AT_NO_BONDING
);
846 sco
= hci_conn_hash_lookup_ba(hdev
, type
, dst
);
848 sco
= hci_conn_add(hdev
, type
, dst
);
851 return ERR_PTR(-ENOMEM
);
860 sco
->setting
= setting
;
862 if (acl
->state
== BT_CONNECTED
&&
863 (sco
->state
== BT_OPEN
|| sco
->state
== BT_CLOSED
)) {
864 set_bit(HCI_CONN_POWER_SAVE
, &acl
->flags
);
865 hci_conn_enter_active_mode(acl
, BT_POWER_FORCE_ACTIVE_ON
);
867 if (test_bit(HCI_CONN_MODE_CHANGE_PEND
, &acl
->flags
)) {
868 /* defer SCO setup until mode change completed */
869 set_bit(HCI_CONN_SCO_SETUP_PEND
, &acl
->flags
);
873 hci_sco_setup(acl
, 0x00);
879 /* Check link security requirement */
880 int hci_conn_check_link_mode(struct hci_conn
*conn
)
882 BT_DBG("hcon %p", conn
);
884 /* In Secure Connections Only mode, it is required that Secure
885 * Connections is used and the link is encrypted with AES-CCM
886 * using a P-256 authenticated combination key.
888 if (test_bit(HCI_SC_ONLY
, &conn
->hdev
->flags
)) {
889 if (!hci_conn_sc_enabled(conn
) ||
890 !test_bit(HCI_CONN_AES_CCM
, &conn
->flags
) ||
891 conn
->key_type
!= HCI_LK_AUTH_COMBINATION_P256
)
895 if (hci_conn_ssp_enabled(conn
) &&
896 !test_bit(HCI_CONN_ENCRYPT
, &conn
->flags
))
902 /* Authenticate remote device */
903 static int hci_conn_auth(struct hci_conn
*conn
, __u8 sec_level
, __u8 auth_type
)
905 BT_DBG("hcon %p", conn
);
907 if (conn
->pending_sec_level
> sec_level
)
908 sec_level
= conn
->pending_sec_level
;
910 if (sec_level
> conn
->sec_level
)
911 conn
->pending_sec_level
= sec_level
;
912 else if (test_bit(HCI_CONN_AUTH
, &conn
->flags
))
915 /* Make sure we preserve an existing MITM requirement*/
916 auth_type
|= (conn
->auth_type
& 0x01);
918 conn
->auth_type
= auth_type
;
920 if (!test_and_set_bit(HCI_CONN_AUTH_PEND
, &conn
->flags
)) {
921 struct hci_cp_auth_requested cp
;
923 cp
.handle
= cpu_to_le16(conn
->handle
);
924 hci_send_cmd(conn
->hdev
, HCI_OP_AUTH_REQUESTED
,
927 /* If we're already encrypted set the REAUTH_PEND flag,
928 * otherwise set the ENCRYPT_PEND.
930 if (test_bit(HCI_CONN_ENCRYPT
, &conn
->flags
))
931 set_bit(HCI_CONN_REAUTH_PEND
, &conn
->flags
);
933 set_bit(HCI_CONN_ENCRYPT_PEND
, &conn
->flags
);
939 /* Encrypt the the link */
940 static void hci_conn_encrypt(struct hci_conn
*conn
)
942 BT_DBG("hcon %p", conn
);
944 if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND
, &conn
->flags
)) {
945 struct hci_cp_set_conn_encrypt cp
;
946 cp
.handle
= cpu_to_le16(conn
->handle
);
948 hci_send_cmd(conn
->hdev
, HCI_OP_SET_CONN_ENCRYPT
, sizeof(cp
),
953 /* Enable security */
954 int hci_conn_security(struct hci_conn
*conn
, __u8 sec_level
, __u8 auth_type
)
956 BT_DBG("hcon %p", conn
);
958 if (conn
->type
== LE_LINK
)
959 return smp_conn_security(conn
, sec_level
);
961 /* For sdp we don't need the link key. */
962 if (sec_level
== BT_SECURITY_SDP
)
965 /* For non 2.1 devices and low security level we don't need the link
967 if (sec_level
== BT_SECURITY_LOW
&& !hci_conn_ssp_enabled(conn
))
970 /* For other security levels we need the link key. */
971 if (!test_bit(HCI_CONN_AUTH
, &conn
->flags
))
974 /* An authenticated FIPS approved combination key has sufficient
975 * security for security level 4. */
976 if (conn
->key_type
== HCI_LK_AUTH_COMBINATION_P256
&&
977 sec_level
== BT_SECURITY_FIPS
)
980 /* An authenticated combination key has sufficient security for
982 if ((conn
->key_type
== HCI_LK_AUTH_COMBINATION_P192
||
983 conn
->key_type
== HCI_LK_AUTH_COMBINATION_P256
) &&
984 sec_level
== BT_SECURITY_HIGH
)
987 /* An unauthenticated combination key has sufficient security for
988 security level 1 and 2. */
989 if ((conn
->key_type
== HCI_LK_UNAUTH_COMBINATION_P192
||
990 conn
->key_type
== HCI_LK_UNAUTH_COMBINATION_P256
) &&
991 (sec_level
== BT_SECURITY_MEDIUM
|| sec_level
== BT_SECURITY_LOW
))
994 /* A combination key has always sufficient security for the security
995 levels 1 or 2. High security level requires the combination key
996 is generated using maximum PIN code length (16).
997 For pre 2.1 units. */
998 if (conn
->key_type
== HCI_LK_COMBINATION
&&
999 (sec_level
== BT_SECURITY_MEDIUM
|| sec_level
== BT_SECURITY_LOW
||
1000 conn
->pin_length
== 16))
1004 if (test_bit(HCI_CONN_ENCRYPT_PEND
, &conn
->flags
))
1007 if (!hci_conn_auth(conn
, sec_level
, auth_type
))
1011 if (test_bit(HCI_CONN_ENCRYPT
, &conn
->flags
))
1014 hci_conn_encrypt(conn
);
1017 EXPORT_SYMBOL(hci_conn_security
);
1019 /* Check secure link requirement */
1020 int hci_conn_check_secure(struct hci_conn
*conn
, __u8 sec_level
)
1022 BT_DBG("hcon %p", conn
);
1024 /* Accept if non-secure or higher security level is required */
1025 if (sec_level
!= BT_SECURITY_HIGH
&& sec_level
!= BT_SECURITY_FIPS
)
1028 /* Accept if secure or higher security level is already present */
1029 if (conn
->sec_level
== BT_SECURITY_HIGH
||
1030 conn
->sec_level
== BT_SECURITY_FIPS
)
1033 /* Reject not secure link */
1036 EXPORT_SYMBOL(hci_conn_check_secure
);
1038 /* Change link key */
1039 int hci_conn_change_link_key(struct hci_conn
*conn
)
1041 BT_DBG("hcon %p", conn
);
1043 if (!test_and_set_bit(HCI_CONN_AUTH_PEND
, &conn
->flags
)) {
1044 struct hci_cp_change_conn_link_key cp
;
1045 cp
.handle
= cpu_to_le16(conn
->handle
);
1046 hci_send_cmd(conn
->hdev
, HCI_OP_CHANGE_CONN_LINK_KEY
,
1054 int hci_conn_switch_role(struct hci_conn
*conn
, __u8 role
)
1056 BT_DBG("hcon %p", conn
);
1058 if (!role
&& test_bit(HCI_CONN_MASTER
, &conn
->flags
))
1061 if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND
, &conn
->flags
)) {
1062 struct hci_cp_switch_role cp
;
1063 bacpy(&cp
.bdaddr
, &conn
->dst
);
1065 hci_send_cmd(conn
->hdev
, HCI_OP_SWITCH_ROLE
, sizeof(cp
), &cp
);
1070 EXPORT_SYMBOL(hci_conn_switch_role
);
1072 /* Enter active mode */
1073 void hci_conn_enter_active_mode(struct hci_conn
*conn
, __u8 force_active
)
1075 struct hci_dev
*hdev
= conn
->hdev
;
1077 BT_DBG("hcon %p mode %d", conn
, conn
->mode
);
1079 if (conn
->mode
!= HCI_CM_SNIFF
)
1082 if (!test_bit(HCI_CONN_POWER_SAVE
, &conn
->flags
) && !force_active
)
1085 if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND
, &conn
->flags
)) {
1086 struct hci_cp_exit_sniff_mode cp
;
1087 cp
.handle
= cpu_to_le16(conn
->handle
);
1088 hci_send_cmd(hdev
, HCI_OP_EXIT_SNIFF_MODE
, sizeof(cp
), &cp
);
1092 if (hdev
->idle_timeout
> 0)
1093 queue_delayed_work(hdev
->workqueue
, &conn
->idle_work
,
1094 msecs_to_jiffies(hdev
->idle_timeout
));
1097 /* Drop all connection on the device */
1098 void hci_conn_hash_flush(struct hci_dev
*hdev
)
1100 struct hci_conn_hash
*h
= &hdev
->conn_hash
;
1101 struct hci_conn
*c
, *n
;
1103 BT_DBG("hdev %s", hdev
->name
);
1105 list_for_each_entry_safe(c
, n
, &h
->list
, list
) {
1106 c
->state
= BT_CLOSED
;
1108 hci_proto_disconn_cfm(c
, HCI_ERROR_LOCAL_HOST_TERM
);
1113 /* Check pending connect attempts */
1114 void hci_conn_check_pending(struct hci_dev
*hdev
)
1116 struct hci_conn
*conn
;
1118 BT_DBG("hdev %s", hdev
->name
);
1122 conn
= hci_conn_hash_lookup_state(hdev
, ACL_LINK
, BT_CONNECT2
);
1124 hci_acl_create_connection(conn
);
1126 hci_dev_unlock(hdev
);
1129 static u32
get_link_mode(struct hci_conn
*conn
)
1133 if (test_bit(HCI_CONN_MASTER
, &conn
->flags
))
1134 link_mode
|= HCI_LM_MASTER
;
1136 if (test_bit(HCI_CONN_ENCRYPT
, &conn
->flags
))
1137 link_mode
|= HCI_LM_ENCRYPT
;
1139 if (test_bit(HCI_CONN_AUTH
, &conn
->flags
))
1140 link_mode
|= HCI_LM_AUTH
;
1142 if (test_bit(HCI_CONN_SECURE
, &conn
->flags
))
1143 link_mode
|= HCI_LM_SECURE
;
1145 if (test_bit(HCI_CONN_FIPS
, &conn
->flags
))
1146 link_mode
|= HCI_LM_FIPS
;
1151 int hci_get_conn_list(void __user
*arg
)
1154 struct hci_conn_list_req req
, *cl
;
1155 struct hci_conn_info
*ci
;
1156 struct hci_dev
*hdev
;
1157 int n
= 0, size
, err
;
1159 if (copy_from_user(&req
, arg
, sizeof(req
)))
1162 if (!req
.conn_num
|| req
.conn_num
> (PAGE_SIZE
* 2) / sizeof(*ci
))
1165 size
= sizeof(req
) + req
.conn_num
* sizeof(*ci
);
1167 cl
= kmalloc(size
, GFP_KERNEL
);
1171 hdev
= hci_dev_get(req
.dev_id
);
1180 list_for_each_entry(c
, &hdev
->conn_hash
.list
, list
) {
1181 bacpy(&(ci
+ n
)->bdaddr
, &c
->dst
);
1182 (ci
+ n
)->handle
= c
->handle
;
1183 (ci
+ n
)->type
= c
->type
;
1184 (ci
+ n
)->out
= c
->out
;
1185 (ci
+ n
)->state
= c
->state
;
1186 (ci
+ n
)->link_mode
= get_link_mode(c
);
1187 if (++n
>= req
.conn_num
)
1190 hci_dev_unlock(hdev
);
1192 cl
->dev_id
= hdev
->id
;
1194 size
= sizeof(req
) + n
* sizeof(*ci
);
1198 err
= copy_to_user(arg
, cl
, size
);
1201 return err
? -EFAULT
: 0;
1204 int hci_get_conn_info(struct hci_dev
*hdev
, void __user
*arg
)
1206 struct hci_conn_info_req req
;
1207 struct hci_conn_info ci
;
1208 struct hci_conn
*conn
;
1209 char __user
*ptr
= arg
+ sizeof(req
);
1211 if (copy_from_user(&req
, arg
, sizeof(req
)))
1215 conn
= hci_conn_hash_lookup_ba(hdev
, req
.type
, &req
.bdaddr
);
1217 bacpy(&ci
.bdaddr
, &conn
->dst
);
1218 ci
.handle
= conn
->handle
;
1219 ci
.type
= conn
->type
;
1221 ci
.state
= conn
->state
;
1222 ci
.link_mode
= get_link_mode(conn
);
1224 hci_dev_unlock(hdev
);
1229 return copy_to_user(ptr
, &ci
, sizeof(ci
)) ? -EFAULT
: 0;
1232 int hci_get_auth_info(struct hci_dev
*hdev
, void __user
*arg
)
1234 struct hci_auth_info_req req
;
1235 struct hci_conn
*conn
;
1237 if (copy_from_user(&req
, arg
, sizeof(req
)))
1241 conn
= hci_conn_hash_lookup_ba(hdev
, ACL_LINK
, &req
.bdaddr
);
1243 req
.type
= conn
->auth_type
;
1244 hci_dev_unlock(hdev
);
1249 return copy_to_user(arg
, &req
, sizeof(req
)) ? -EFAULT
: 0;
1252 struct hci_chan
*hci_chan_create(struct hci_conn
*conn
)
1254 struct hci_dev
*hdev
= conn
->hdev
;
1255 struct hci_chan
*chan
;
1257 BT_DBG("%s hcon %p", hdev
->name
, conn
);
1259 chan
= kzalloc(sizeof(struct hci_chan
), GFP_KERNEL
);
1264 skb_queue_head_init(&chan
->data_q
);
1265 chan
->state
= BT_CONNECTED
;
1267 list_add_rcu(&chan
->list
, &conn
->chan_list
);
1272 void hci_chan_del(struct hci_chan
*chan
)
1274 struct hci_conn
*conn
= chan
->conn
;
1275 struct hci_dev
*hdev
= conn
->hdev
;
1277 BT_DBG("%s hcon %p chan %p", hdev
->name
, conn
, chan
);
1279 list_del_rcu(&chan
->list
);
1283 hci_conn_drop(conn
);
1285 skb_queue_purge(&chan
->data_q
);
1289 void hci_chan_list_flush(struct hci_conn
*conn
)
1291 struct hci_chan
*chan
, *n
;
1293 BT_DBG("hcon %p", conn
);
1295 list_for_each_entry_safe(chan
, n
, &conn
->chan_list
, list
)
1299 static struct hci_chan
*__hci_chan_lookup_handle(struct hci_conn
*hcon
,
1302 struct hci_chan
*hchan
;
1304 list_for_each_entry(hchan
, &hcon
->chan_list
, list
) {
1305 if (hchan
->handle
== handle
)
1312 struct hci_chan
*hci_chan_lookup_handle(struct hci_dev
*hdev
, __u16 handle
)
1314 struct hci_conn_hash
*h
= &hdev
->conn_hash
;
1315 struct hci_conn
*hcon
;
1316 struct hci_chan
*hchan
= NULL
;
1320 list_for_each_entry_rcu(hcon
, &h
->list
, list
) {
1321 hchan
= __hci_chan_lookup_handle(hcon
, handle
);