net/bluetooth/hci_conn.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI connection handling. */
  26
  27 #include <linux/module.h>
  28
  29 #include <linux/types.h>
  30 #include <linux/errno.h>
  31 #include <linux/kernel.h>
  32 #include <linux/slab.h>
  33 #include <linux/poll.h>
  34 #include <linux/fcntl.h>
  35 #include <linux/init.h>
  36 #include <linux/skbuff.h>
  37 #include <linux/interrupt.h>
  38 #include <linux/notifier.h>
  39 #include <net/sock.h>
  40
  41 #include <asm/system.h>
  42 #include <linux/uaccess.h>
  43 #include <asm/unaligned.h>
  44
  45 #include <net/bluetooth/bluetooth.h>
  46 #include <net/bluetooth/hci_core.h>
  47
  48 static void hci_le_connect(struct hci_conn *conn)
  49 {
  50         struct hci_dev *hdev = conn->hdev;
  51         struct hci_cp_le_create_conn cp;
  52
  53         conn->state = BT_CONNECT;
  54         conn->out = 1;
  55         conn->link_mode |= HCI_LM_MASTER;
  56         conn->sec_level = BT_SECURITY_LOW;
  57
  58         memset(&cp, 0, sizeof(cp));
  59         cp.scan_interval = cpu_to_le16(0x0060);
  60         cp.scan_window = cpu_to_le16(0x0030);
  61         bacpy(&cp.peer_addr, &conn->dst);
  62         cp.peer_addr_type = conn->dst_type;
  63         cp.conn_interval_min = cpu_to_le16(0x0028);
  64         cp.conn_interval_max = cpu_to_le16(0x0038);
  65         cp.supervision_timeout = cpu_to_le16(0x002a);
  66         cp.min_ce_len = cpu_to_le16(0x0000);
  67         cp.max_ce_len = cpu_to_le16(0x0000);
  68
  69         hci_send_cmd(hdev, HCI_OP_LE_CREATE_CONN, sizeof(cp), &cp);
  70 }
  71
  72 static void hci_le_connect_cancel(struct hci_conn *conn)
  73 {
  74         hci_send_cmd(conn->hdev, HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL);
  75 }
  76
  77 void hci_acl_connect(struct hci_conn *conn)
  78 {
  79         struct hci_dev *hdev = conn->hdev;
  80         struct inquiry_entry *ie;
  81         struct hci_cp_create_conn cp;
  82
  83         BT_DBG("%p", conn);
  84
  85         conn->state = BT_CONNECT;
  86         conn->out = 1;
  87
  88         conn->link_mode = HCI_LM_MASTER;
  89
  90         conn->attempt++;
  91
  92         conn->link_policy = hdev->link_policy;
  93
  94         memset(&cp, 0, sizeof(cp));
  95         bacpy(&cp.bdaddr, &conn->dst);
  96         cp.pscan_rep_mode = 0x02;
  97
  98         ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
  99         if (ie) {
 100                 if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
 101                         cp.pscan_rep_mode = ie->data.pscan_rep_mode;
 102                         cp.pscan_mode     = ie->data.pscan_mode;
 103                         cp.clock_offset   = ie->data.clock_offset |
 104                                                         cpu_to_le16(0x8000);
 105                 }
 106
 107                 memcpy(conn->dev_class, ie->data.dev_class, 3);
 108                 conn->ssp_mode = ie->data.ssp_mode;
 109         }
 110
 111         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 112         if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
 113                 cp.role_switch = 0x01;
 114         else
 115                 cp.role_switch = 0x00;
 116
 117         hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
 118 }
 119
 120 static void hci_acl_connect_cancel(struct hci_conn *conn)
 121 {
 122         struct hci_cp_create_conn_cancel cp;
 123
 124         BT_DBG("%p", conn);
 125
 126         if (conn->hdev->hci_ver < BLUETOOTH_VER_1_2)
 127                 return;
 128
 129         bacpy(&cp.bdaddr, &conn->dst);
 130         hci_send_cmd(conn->hdev, HCI_OP_CREATE_CONN_CANCEL, sizeof(cp), &cp);
 131 }
 132
 133 void hci_acl_disconn(struct hci_conn *conn, __u8 reason)
 134 {
 135         struct hci_cp_disconnect cp;
 136
 137         BT_DBG("%p", conn);
 138
 139         conn->state = BT_DISCONN;
 140
 141         cp.handle = cpu_to_le16(conn->handle);
 142         cp.reason = reason;
 143         hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp);
 144 }
 145
 146 void hci_add_sco(struct hci_conn *conn, __u16 handle)
 147 {
 148         struct hci_dev *hdev = conn->hdev;
 149         struct hci_cp_add_sco cp;
 150
 151         BT_DBG("%p", conn);
 152
 153         conn->state = BT_CONNECT;
 154         conn->out = 1;
 155
 156         conn->attempt++;
 157
 158         cp.handle   = cpu_to_le16(handle);
 159         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 160
 161         hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
 162 }
 163
 164 void hci_setup_sync(struct hci_conn *conn, __u16 handle)
 165 {
 166         struct hci_dev *hdev = conn->hdev;
 167         struct hci_cp_setup_sync_conn cp;
 168
 169         BT_DBG("%p", conn);
 170
 171         conn->state = BT_CONNECT;
 172         conn->out = 1;
 173
 174         conn->attempt++;
 175
 176         cp.handle   = cpu_to_le16(handle);
 177         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 178
 179         cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
 180         cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
 181         cp.max_latency    = cpu_to_le16(0xffff);
 182         cp.voice_setting  = cpu_to_le16(hdev->voice_setting);
 183         cp.retrans_effort = 0xff;
 184
 185         hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp);
 186 }
 187
 188 void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max,
 189                                         u16 latency, u16 to_multiplier)
 190 {
 191         struct hci_cp_le_conn_update cp;
 192         struct hci_dev *hdev = conn->hdev;
 193
 194         memset(&cp, 0, sizeof(cp));
 195
 196         cp.handle               = cpu_to_le16(conn->handle);
 197         cp.conn_interval_min    = cpu_to_le16(min);
 198         cp.conn_interval_max    = cpu_to_le16(max);
 199         cp.conn_latency         = cpu_to_le16(latency);
 200         cp.supervision_timeout  = cpu_to_le16(to_multiplier);
 201         cp.min_ce_len           = cpu_to_le16(0x0001);
 202         cp.max_ce_len           = cpu_to_le16(0x0001);
 203
 204         hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp);
 205 }
 206 EXPORT_SYMBOL(hci_le_conn_update);
 207
 208 void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __u8 rand[8],
 209                                                         __u8 ltk[16])
 210 {
 211         struct hci_dev *hdev = conn->hdev;
 212         struct hci_cp_le_start_enc cp;
 213
 214         BT_DBG("%p", conn);
 215
 216         memset(&cp, 0, sizeof(cp));
 217
 218         cp.handle = cpu_to_le16(conn->handle);
 219         memcpy(cp.ltk, ltk, sizeof(cp.ltk));
 220         cp.ediv = ediv;
 221         memcpy(cp.rand, rand, sizeof(cp.rand));
 222
 223         hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp);
 224 }
 225 EXPORT_SYMBOL(hci_le_start_enc);
 226
 227 void hci_le_ltk_reply(struct hci_conn *conn, u8 ltk[16])
 228 {
 229         struct hci_dev *hdev = conn->hdev;
 230         struct hci_cp_le_ltk_reply cp;
 231
 232         BT_DBG("%p", conn);
 233
 234         memset(&cp, 0, sizeof(cp));
 235
 236         cp.handle = cpu_to_le16(conn->handle);
 237         memcpy(cp.ltk, ltk, sizeof(ltk));
 238
 239         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
 240 }
 241 EXPORT_SYMBOL(hci_le_ltk_reply);
 242
 243 void hci_le_ltk_neg_reply(struct hci_conn *conn)
 244 {
 245         struct hci_dev *hdev = conn->hdev;
 246         struct hci_cp_le_ltk_neg_reply cp;
 247
 248         BT_DBG("%p", conn);
 249
 250         memset(&cp, 0, sizeof(cp));
 251
 252         cp.handle = cpu_to_le16(conn->handle);
 253
 254         hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(cp), &cp);
 255 }
 256
 257 /* Device _must_ be locked */
 258 void hci_sco_setup(struct hci_conn *conn, __u8 status)
 259 {
 260         struct hci_conn *sco = conn->link;
 261
 262         BT_DBG("%p", conn);
 263
 264         if (!sco)
 265                 return;
 266
 267         if (!status) {
 268                 if (lmp_esco_capable(conn->hdev))
 269                         hci_setup_sync(sco, conn->handle);
 270                 else
 271                         hci_add_sco(sco, conn->handle);
 272         } else {
 273                 hci_proto_connect_cfm(sco, status);
 274                 hci_conn_del(sco);
 275         }
 276 }
 277
 278 static void hci_conn_timeout(struct work_struct *work)
 279 {
 280         struct hci_conn *conn = container_of(work, struct hci_conn,
 281                                                         disc_work.work);
 282         __u8 reason;
 283
 284         BT_DBG("conn %p state %d", conn, conn->state);
 285
 286         if (atomic_read(&conn->refcnt))
 287                 return;
 288
 289         switch (conn->state) {
 290         case BT_CONNECT:
 291         case BT_CONNECT2:
 292                 if (conn->out) {
 293                         if (conn->type == ACL_LINK)
 294                                 hci_acl_connect_cancel(conn);
 295                         else if (conn->type == LE_LINK)
 296                                 hci_le_connect_cancel(conn);
 297                 }
 298                 break;
 299         case BT_CONFIG:
 300         case BT_CONNECTED:
 301                 reason = hci_proto_disconn_ind(conn);
 302                 hci_acl_disconn(conn, reason);
 303                 break;
 304         default:
 305                 conn->state = BT_CLOSED;
 306                 break;
 307         }
 308 }
 309
 310 /* Enter sniff mode */
 311 static void hci_conn_enter_sniff_mode(struct hci_conn *conn)
 312 {
 313         struct hci_dev *hdev = conn->hdev;
 314
 315         BT_DBG("conn %p mode %d", conn, conn->mode);
 316
 317         if (test_bit(HCI_RAW, &hdev->flags))
 318                 return;
 319
 320         if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn))
 321                 return;
 322
 323         if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF))
 324                 return;
 325
 326         if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
 327                 struct hci_cp_sniff_subrate cp;
 328                 cp.handle             = cpu_to_le16(conn->handle);
 329                 cp.max_latency        = cpu_to_le16(0);
 330                 cp.min_remote_timeout = cpu_to_le16(0);
 331                 cp.min_local_timeout  = cpu_to_le16(0);
 332                 hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
 333         }
 334
 335         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
 336                 struct hci_cp_sniff_mode cp;
 337                 cp.handle       = cpu_to_le16(conn->handle);
 338                 cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
 339                 cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
 340                 cp.attempt      = cpu_to_le16(4);
 341                 cp.timeout      = cpu_to_le16(1);
 342                 hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
 343         }
 344 }
 345
 346 static void hci_conn_idle(unsigned long arg)
 347 {
 348         struct hci_conn *conn = (void *) arg;
 349
 350         BT_DBG("conn %p mode %d", conn, conn->mode);
 351
 352         hci_conn_enter_sniff_mode(conn);
 353 }
 354
 355 static void hci_conn_auto_accept(unsigned long arg)
 356 {
 357         struct hci_conn *conn = (void *) arg;
 358         struct hci_dev *hdev = conn->hdev;
 359
 360         hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY, sizeof(conn->dst),
 361                                                                 &conn->dst);
 362 }
 363
 364 struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
 365 {
 366         struct hci_conn *conn;
 367
 368         BT_DBG("%s dst %s", hdev->name, batostr(dst));
 369
 370         conn = kzalloc(sizeof(struct hci_conn), GFP_ATOMIC);
 371         if (!conn)
 372                 return NULL;
 373
 374         bacpy(&conn->dst, dst);
 375         conn->hdev  = hdev;
 376         conn->type  = type;
 377         conn->mode  = HCI_CM_ACTIVE;
 378         conn->state = BT_OPEN;
 379         conn->auth_type = HCI_AT_GENERAL_BONDING;
 380         conn->io_capability = hdev->io_capability;
 381         conn->remote_auth = 0xff;
 382         conn->key_type = 0xff;
 383
 384         conn->power_save = 1;
 385         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
 386
 387         switch (type) {
 388         case ACL_LINK:
 389                 conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
 390                 break;
 391         case SCO_LINK:
 392                 if (lmp_esco_capable(hdev))
 393                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
 394                                         (hdev->esco_type & EDR_ESCO_MASK);
 395                 else
 396                         conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
 397                 break;
 398         case ESCO_LINK:
 399                 conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
 400                 break;
 401         }
 402
 403         skb_queue_head_init(&conn->data_q);
 404
 405         INIT_LIST_HEAD(&conn->chan_list);;
 406
 407         INIT_DELAYED_WORK(&conn->disc_work, hci_conn_timeout);
 408         setup_timer(&conn->idle_timer, hci_conn_idle, (unsigned long)conn);
 409         setup_timer(&conn->auto_accept_timer, hci_conn_auto_accept,
 410                                                         (unsigned long) conn);
 411
 412         atomic_set(&conn->refcnt, 0);
 413
 414         hci_dev_hold(hdev);
 415
 416         hci_conn_hash_add(hdev, conn);
 417         if (hdev->notify)
 418                 hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
 419
 420         atomic_set(&conn->devref, 0);
 421
 422         hci_conn_init_sysfs(conn);
 423
 424         return conn;
 425 }
 426
 427 int hci_conn_del(struct hci_conn *conn)
 428 {
 429         struct hci_dev *hdev = conn->hdev;
 430
 431         BT_DBG("%s conn %p handle %d", hdev->name, conn, conn->handle);
 432
 433         del_timer(&conn->idle_timer);
 434
 435         cancel_delayed_work_sync(&conn->disc_work);
 436
 437         del_timer(&conn->auto_accept_timer);
 438
 439         if (conn->type == ACL_LINK) {
 440                 struct hci_conn *sco = conn->link;
 441                 if (sco)
 442                         sco->link = NULL;
 443
 444                 /* Unacked frames */
 445                 hdev->acl_cnt += conn->sent;
 446         } else if (conn->type == LE_LINK) {
 447                 if (hdev->le_pkts)
 448                         hdev->le_cnt += conn->sent;
 449                 else
 450                         hdev->acl_cnt += conn->sent;
 451         } else {
 452                 struct hci_conn *acl = conn->link;
 453                 if (acl) {
 454                         acl->link = NULL;
 455                         hci_conn_put(acl);
 456                 }
 457         }
 458
 459
 460         hci_chan_list_flush(conn);
 461
 462         hci_conn_hash_del(hdev, conn);
 463         if (hdev->notify)
 464                 hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
 465
 466         skb_queue_purge(&conn->data_q);
 467
 468         hci_conn_put_device(conn);
 469
 470         hci_dev_put(hdev);
 471
 472         if (conn->handle == 0)
 473                 kfree(conn);
 474
 475         return 0;
 476 }
 477
 478 struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src)
 479 {
 480         int use_src = bacmp(src, BDADDR_ANY);
 481         struct hci_dev *hdev = NULL, *d;
 482
 483         BT_DBG("%s -> %s", batostr(src), batostr(dst));
 484
 485         read_lock(&hci_dev_list_lock);
 486
 487         list_for_each_entry(d, &hci_dev_list, list) {
 488                 if (!test_bit(HCI_UP, &d->flags) || test_bit(HCI_RAW, &d->flags))
 489                         continue;
 490
 491                 /* Simple routing:
 492                  *   No source address - find interface with bdaddr != dst
 493                  *   Source address    - find interface with bdaddr == src
 494                  */
 495
 496                 if (use_src) {
 497                         if (!bacmp(&d->bdaddr, src)) {
 498                                 hdev = d; break;
 499                         }
 500                 } else {
 501                         if (bacmp(&d->bdaddr, dst)) {
 502                                 hdev = d; break;
 503                         }
 504                 }
 505         }
 506
 507         if (hdev)
 508                 hdev = hci_dev_hold(hdev);
 509
 510         read_unlock(&hci_dev_list_lock);
 511         return hdev;
 512 }
 513 EXPORT_SYMBOL(hci_get_route);
 514
 515 /* Create SCO, ACL or LE connection.
 516  * Device _must_ be locked */
 517 struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, __u8 sec_level, __u8 auth_type)
 518 {
 519         struct hci_conn *acl;
 520         struct hci_conn *sco;
 521         struct hci_conn *le;
 522
 523         BT_DBG("%s dst %s", hdev->name, batostr(dst));
 524
 525         if (type == LE_LINK) {
 526                 struct adv_entry *entry;
 527
 528                 le = hci_conn_hash_lookup_ba(hdev, LE_LINK, dst);
 529                 if (le)
 530                         return ERR_PTR(-EBUSY);
 531
 532                 entry = hci_find_adv_entry(hdev, dst);
 533                 if (!entry)
 534                         return ERR_PTR(-EHOSTUNREACH);
 535
 536                 le = hci_conn_add(hdev, LE_LINK, dst);
 537                 if (!le)
 538                         return ERR_PTR(-ENOMEM);
 539
 540                 le->dst_type = entry->bdaddr_type;
 541
 542                 hci_le_connect(le);
 543
 544                 hci_conn_hold(le);
 545
 546                 return le;
 547         }
 548
 549         acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
 550         if (!acl) {
 551                 acl = hci_conn_add(hdev, ACL_LINK, dst);
 552                 if (!acl)
 553                         return NULL;
 554         }
 555
 556         hci_conn_hold(acl);
 557
 558         if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
 559                 acl->sec_level = BT_SECURITY_LOW;
 560                 acl->pending_sec_level = sec_level;
 561                 acl->auth_type = auth_type;
 562                 hci_acl_connect(acl);
 563         }
 564
 565         if (type == ACL_LINK)
 566                 return acl;
 567
 568         sco = hci_conn_hash_lookup_ba(hdev, type, dst);
 569         if (!sco) {
 570                 sco = hci_conn_add(hdev, type, dst);
 571                 if (!sco) {
 572                         hci_conn_put(acl);
 573                         return NULL;
 574                 }
 575         }
 576
 577         acl->link = sco;
 578         sco->link = acl;
 579
 580         hci_conn_hold(sco);
 581
 582         if (acl->state == BT_CONNECTED &&
 583                         (sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
 584                 acl->power_save = 1;
 585                 hci_conn_enter_active_mode(acl, BT_POWER_FORCE_ACTIVE_ON);
 586
 587                 if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->pend)) {
 588                         /* defer SCO setup until mode change completed */
 589                         set_bit(HCI_CONN_SCO_SETUP_PEND, &acl->pend);
 590                         return sco;
 591                 }
 592
 593                 hci_sco_setup(acl, 0x00);
 594         }
 595
 596         return sco;
 597 }
 598 EXPORT_SYMBOL(hci_connect);
 599
 600 /* Check link security requirement */
 601 int hci_conn_check_link_mode(struct hci_conn *conn)
 602 {
 603         BT_DBG("conn %p", conn);
 604
 605         if (conn->ssp_mode > 0 && conn->hdev->ssp_mode > 0 &&
 606                                         !(conn->link_mode & HCI_LM_ENCRYPT))
 607                 return 0;
 608
 609         return 1;
 610 }
 611 EXPORT_SYMBOL(hci_conn_check_link_mode);
 612
 613 /* Authenticate remote device */
 614 static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 615 {
 616         BT_DBG("conn %p", conn);
 617
 618         if (conn->pending_sec_level > sec_level)
 619                 sec_level = conn->pending_sec_level;
 620
 621         if (sec_level > conn->sec_level)
 622                 conn->pending_sec_level = sec_level;
 623         else if (conn->link_mode & HCI_LM_AUTH)
 624                 return 1;
 625
 626         /* Make sure we preserve an existing MITM requirement*/
 627         auth_type |= (conn->auth_type & 0x01);
 628
 629         conn->auth_type = auth_type;
 630
 631         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
 632                 struct hci_cp_auth_requested cp;
 633
 634                 /* encrypt must be pending if auth is also pending */
 635                 set_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
 636
 637                 cp.handle = cpu_to_le16(conn->handle);
 638                 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
 639                                                         sizeof(cp), &cp);
 640                 if (conn->key_type != 0xff)
 641                         set_bit(HCI_CONN_REAUTH_PEND, &conn->pend);
 642         }
 643
 644         return 0;
 645 }
 646
 647 /* Encrypt the the link */
 648 static void hci_conn_encrypt(struct hci_conn *conn)
 649 {
 650         BT_DBG("conn %p", conn);
 651
 652         if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend)) {
 653                 struct hci_cp_set_conn_encrypt cp;
 654                 cp.handle  = cpu_to_le16(conn->handle);
 655                 cp.encrypt = 0x01;
 656                 hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
 657                                                                         &cp);
 658         }
 659 }
 660
 661 /* Enable security */
 662 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 663 {
 664         BT_DBG("conn %p", conn);
 665
 666         /* For sdp we don't need the link key. */
 667         if (sec_level == BT_SECURITY_SDP)
 668                 return 1;
 669
 670         /* For non 2.1 devices and low security level we don't need the link
 671            key. */
 672         if (sec_level == BT_SECURITY_LOW &&
 673                                 (!conn->ssp_mode || !conn->hdev->ssp_mode))
 674                 return 1;
 675
 676         /* For other security levels we need the link key. */
 677         if (!(conn->link_mode & HCI_LM_AUTH))
 678                 goto auth;
 679
 680         /* An authenticated combination key has sufficient security for any
 681            security level. */
 682         if (conn->key_type == HCI_LK_AUTH_COMBINATION)
 683                 goto encrypt;
 684
 685         /* An unauthenticated combination key has sufficient security for
 686            security level 1 and 2. */
 687         if (conn->key_type == HCI_LK_UNAUTH_COMBINATION &&
 688                         (sec_level == BT_SECURITY_MEDIUM ||
 689                         sec_level == BT_SECURITY_LOW))
 690                 goto encrypt;
 691
 692         /* A combination key has always sufficient security for the security
 693            levels 1 or 2. High security level requires the combination key
 694            is generated using maximum PIN code length (16).
 695            For pre 2.1 units. */
 696         if (conn->key_type == HCI_LK_COMBINATION &&
 697                         (sec_level != BT_SECURITY_HIGH ||
 698                         conn->pin_length == 16))
 699                 goto encrypt;
 700
 701 auth:
 702         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend))
 703                 return 0;
 704
 705         if (!hci_conn_auth(conn, sec_level, auth_type))
 706                 return 0;
 707
 708 encrypt:
 709         if (conn->link_mode & HCI_LM_ENCRYPT)
 710                 return 1;
 711
 712         hci_conn_encrypt(conn);
 713         return 0;
 714 }
 715 EXPORT_SYMBOL(hci_conn_security);
 716
 717 /* Check secure link requirement */
 718 int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level)
 719 {
 720         BT_DBG("conn %p", conn);
 721
 722         if (sec_level != BT_SECURITY_HIGH)
 723                 return 1; /* Accept if non-secure is required */
 724
 725         if (conn->sec_level == BT_SECURITY_HIGH)
 726                 return 1;
 727
 728         return 0; /* Reject not secure link */
 729 }
 730 EXPORT_SYMBOL(hci_conn_check_secure);
 731
 732 /* Change link key */
 733 int hci_conn_change_link_key(struct hci_conn *conn)
 734 {
 735         BT_DBG("conn %p", conn);
 736
 737         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
 738                 struct hci_cp_change_conn_link_key cp;
 739                 cp.handle = cpu_to_le16(conn->handle);
 740                 hci_send_cmd(conn->hdev, HCI_OP_CHANGE_CONN_LINK_KEY,
 741                                                         sizeof(cp), &cp);
 742         }
 743
 744         return 0;
 745 }
 746 EXPORT_SYMBOL(hci_conn_change_link_key);
 747
 748 /* Switch role */
 749 int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
 750 {
 751         BT_DBG("conn %p", conn);
 752
 753         if (!role && conn->link_mode & HCI_LM_MASTER)
 754                 return 1;
 755
 756         if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->pend)) {
 757                 struct hci_cp_switch_role cp;
 758                 bacpy(&cp.bdaddr, &conn->dst);
 759                 cp.role = role;
 760                 hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
 761         }
 762
 763         return 0;
 764 }
 765 EXPORT_SYMBOL(hci_conn_switch_role);
 766
 767 /* Enter active mode */
 768 void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
 769 {
 770         struct hci_dev *hdev = conn->hdev;
 771
 772         BT_DBG("conn %p mode %d", conn, conn->mode);
 773
 774         if (test_bit(HCI_RAW, &hdev->flags))
 775                 return;
 776
 777         if (conn->mode != HCI_CM_SNIFF)
 778                 goto timer;
 779
 780         if (!conn->power_save && !force_active)
 781                 goto timer;
 782
 783         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
 784                 struct hci_cp_exit_sniff_mode cp;
 785                 cp.handle = cpu_to_le16(conn->handle);
 786                 hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
 787         }
 788
 789 timer:
 790         if (hdev->idle_timeout > 0)
 791                 mod_timer(&conn->idle_timer,
 792                         jiffies + msecs_to_jiffies(hdev->idle_timeout));
 793 }
 794
 795 /* Drop all connection on the device */
 796 void hci_conn_hash_flush(struct hci_dev *hdev)
 797 {
 798         struct hci_conn_hash *h = &hdev->conn_hash;
 799         struct hci_conn *c;
 800
 801         BT_DBG("hdev %s", hdev->name);
 802
 803         list_for_each_entry_rcu(c, &h->list, list) {
 804                 c->state = BT_CLOSED;
 805
 806                 hci_proto_disconn_cfm(c, HCI_ERROR_LOCAL_HOST_TERM);
 807                 hci_conn_del(c);
 808         }
 809 }
 810
 811 /* Check pending connect attempts */
 812 void hci_conn_check_pending(struct hci_dev *hdev)
 813 {
 814         struct hci_conn *conn;
 815
 816         BT_DBG("hdev %s", hdev->name);
 817
 818         hci_dev_lock(hdev);
 819
 820         conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
 821         if (conn)
 822                 hci_acl_connect(conn);
 823
 824         hci_dev_unlock(hdev);
 825 }
 826
 827 void hci_conn_hold_device(struct hci_conn *conn)
 828 {
 829         atomic_inc(&conn->devref);
 830 }
 831 EXPORT_SYMBOL(hci_conn_hold_device);
 832
 833 void hci_conn_put_device(struct hci_conn *conn)
 834 {
 835         if (atomic_dec_and_test(&conn->devref))
 836                 hci_conn_del_sysfs(conn);
 837 }
 838 EXPORT_SYMBOL(hci_conn_put_device);
 839
 840 int hci_get_conn_list(void __user *arg)
 841 {
 842         register struct hci_conn *c;
 843         struct hci_conn_list_req req, *cl;
 844         struct hci_conn_info *ci;
 845         struct hci_dev *hdev;
 846         int n = 0, size, err;
 847
 848         if (copy_from_user(&req, arg, sizeof(req)))
 849                 return -EFAULT;
 850
 851         if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
 852                 return -EINVAL;
 853
 854         size = sizeof(req) + req.conn_num * sizeof(*ci);
 855
 856         cl = kmalloc(size, GFP_KERNEL);
 857         if (!cl)
 858                 return -ENOMEM;
 859
 860         hdev = hci_dev_get(req.dev_id);
 861         if (!hdev) {
 862                 kfree(cl);
 863                 return -ENODEV;
 864         }
 865
 866         ci = cl->conn_info;
 867
 868         hci_dev_lock(hdev);
 869         list_for_each_entry(c, &hdev->conn_hash.list, list) {
 870                 bacpy(&(ci + n)->bdaddr, &c->dst);
 871                 (ci + n)->handle = c->handle;
 872                 (ci + n)->type  = c->type;
 873                 (ci + n)->out   = c->out;
 874                 (ci + n)->state = c->state;
 875                 (ci + n)->link_mode = c->link_mode;
 876                 if (++n >= req.conn_num)
 877                         break;
 878         }
 879         hci_dev_unlock(hdev);
 880
 881         cl->dev_id = hdev->id;
 882         cl->conn_num = n;
 883         size = sizeof(req) + n * sizeof(*ci);
 884
 885         hci_dev_put(hdev);
 886
 887         err = copy_to_user(arg, cl, size);
 888         kfree(cl);
 889
 890         return err ? -EFAULT : 0;
 891 }
 892
 893 int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
 894 {
 895         struct hci_conn_info_req req;
 896         struct hci_conn_info ci;
 897         struct hci_conn *conn;
 898         char __user *ptr = arg + sizeof(req);
 899
 900         if (copy_from_user(&req, arg, sizeof(req)))
 901                 return -EFAULT;
 902
 903         hci_dev_lock(hdev);
 904         conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
 905         if (conn) {
 906                 bacpy(&ci.bdaddr, &conn->dst);
 907                 ci.handle = conn->handle;
 908                 ci.type  = conn->type;
 909                 ci.out   = conn->out;
 910                 ci.state = conn->state;
 911                 ci.link_mode = conn->link_mode;
 912         }
 913         hci_dev_unlock(hdev);
 914
 915         if (!conn)
 916                 return -ENOENT;
 917
 918         return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
 919 }
 920
 921 int hci_get_auth_info(struct hci_dev *hdev, void __user *arg)
 922 {
 923         struct hci_auth_info_req req;
 924         struct hci_conn *conn;
 925
 926         if (copy_from_user(&req, arg, sizeof(req)))
 927                 return -EFAULT;
 928
 929         hci_dev_lock(hdev);
 930         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr);
 931         if (conn)
 932                 req.type = conn->auth_type;
 933         hci_dev_unlock(hdev);
 934
 935         if (!conn)
 936                 return -ENOENT;
 937
 938         return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0;
 939 }
 940
 941 struct hci_chan *hci_chan_create(struct hci_conn *conn)
 942 {
 943         struct hci_dev *hdev = conn->hdev;
 944         struct hci_chan *chan;
 945
 946         BT_DBG("%s conn %p", hdev->name, conn);
 947
 948         chan = kzalloc(sizeof(struct hci_chan), GFP_ATOMIC);
 949         if (!chan)
 950                 return NULL;
 951
 952         chan->conn = conn;
 953         skb_queue_head_init(&chan->data_q);
 954
 955         list_add_rcu(&chan->list, &conn->chan_list);
 956
 957         return chan;
 958 }
 959
 960 int hci_chan_del(struct hci_chan *chan)
 961 {
 962         struct hci_conn *conn = chan->conn;
 963         struct hci_dev *hdev = conn->hdev;
 964
 965         BT_DBG("%s conn %p chan %p", hdev->name, conn, chan);
 966
 967         list_del_rcu(&chan->list);
 968
 969         synchronize_rcu();
 970
 971         skb_queue_purge(&chan->data_q);
 972         kfree(chan);
 973
 974         return 0;
 975 }
 976
 977 void hci_chan_list_flush(struct hci_conn *conn)
 978 {
 979         struct hci_chan *chan;
 980
 981         BT_DBG("conn %p", conn);
 982
 983         list_for_each_entry_rcu(chan, &conn->chan_list, list)
 984                 hci_chan_del(chan);
 985 }