net/bluetooth/hci_conn.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI connection handling. */
  26
  27 #include <linux/module.h>
  28
  29 #include <linux/types.h>
  30 #include <linux/errno.h>
  31 #include <linux/kernel.h>
  32 #include <linux/slab.h>
  33 #include <linux/poll.h>
  34 #include <linux/fcntl.h>
  35 #include <linux/init.h>
  36 #include <linux/skbuff.h>
  37 #include <linux/interrupt.h>
  38 #include <net/sock.h>
  39
  40 #include <asm/system.h>
  41 #include <linux/uaccess.h>
  42 #include <asm/unaligned.h>
  43
  44 #include <net/bluetooth/bluetooth.h>
  45 #include <net/bluetooth/hci_core.h>
  46
  47 static void hci_le_connect(struct hci_conn *conn)
  48 {
  49         struct hci_dev *hdev = conn->hdev;
  50         struct hci_cp_le_create_conn cp;
  51
  52         conn->state = BT_CONNECT;
  53         conn->out = true;
  54         conn->link_mode |= HCI_LM_MASTER;
  55         conn->sec_level = BT_SECURITY_LOW;
  56
  57         memset(&cp, 0, sizeof(cp));
  58         cp.scan_interval = cpu_to_le16(0x0060);
  59         cp.scan_window = cpu_to_le16(0x0030);
  60         bacpy(&cp.peer_addr, &conn->dst);
  61         cp.peer_addr_type = conn->dst_type;
  62         cp.conn_interval_min = cpu_to_le16(0x0028);
  63         cp.conn_interval_max = cpu_to_le16(0x0038);
  64         cp.supervision_timeout = cpu_to_le16(0x002a);
  65         cp.min_ce_len = cpu_to_le16(0x0000);
  66         cp.max_ce_len = cpu_to_le16(0x0000);
  67
  68         hci_send_cmd(hdev, HCI_OP_LE_CREATE_CONN, sizeof(cp), &cp);
  69 }
  70
  71 static void hci_le_connect_cancel(struct hci_conn *conn)
  72 {
  73         hci_send_cmd(conn->hdev, HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL);
  74 }
  75
  76 void hci_acl_connect(struct hci_conn *conn)
  77 {
  78         struct hci_dev *hdev = conn->hdev;
  79         struct inquiry_entry *ie;
  80         struct hci_cp_create_conn cp;
  81
  82         BT_DBG("hcon %p", conn);
  83
  84         conn->state = BT_CONNECT;
  85         conn->out = true;
  86
  87         conn->link_mode = HCI_LM_MASTER;
  88
  89         conn->attempt++;
  90
  91         conn->link_policy = hdev->link_policy;
  92
  93         memset(&cp, 0, sizeof(cp));
  94         bacpy(&cp.bdaddr, &conn->dst);
  95         cp.pscan_rep_mode = 0x02;
  96
  97         ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
  98         if (ie) {
  99                 if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
 100                         cp.pscan_rep_mode = ie->data.pscan_rep_mode;
 101                         cp.pscan_mode     = ie->data.pscan_mode;
 102                         cp.clock_offset   = ie->data.clock_offset |
 103                                                         cpu_to_le16(0x8000);
 104                 }
 105
 106                 memcpy(conn->dev_class, ie->data.dev_class, 3);
 107                 if (ie->data.ssp_mode > 0)
 108                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
 109         }
 110
 111         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 112         if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
 113                 cp.role_switch = 0x01;
 114         else
 115                 cp.role_switch = 0x00;
 116
 117         hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
 118 }
 119
 120 static void hci_acl_connect_cancel(struct hci_conn *conn)
 121 {
 122         struct hci_cp_create_conn_cancel cp;
 123
 124         BT_DBG("%p", conn);
 125
 126         if (conn->hdev->hci_ver < BLUETOOTH_VER_1_2)
 127                 return;
 128
 129         bacpy(&cp.bdaddr, &conn->dst);
 130         hci_send_cmd(conn->hdev, HCI_OP_CREATE_CONN_CANCEL, sizeof(cp), &cp);
 131 }
 132
 133 void hci_acl_disconn(struct hci_conn *conn, __u8 reason)
 134 {
 135         struct hci_cp_disconnect cp;
 136
 137         BT_DBG("%p", conn);
 138
 139         conn->state = BT_DISCONN;
 140
 141         cp.handle = cpu_to_le16(conn->handle);
 142         cp.reason = reason;
 143         hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp);
 144 }
 145
 146 void hci_add_sco(struct hci_conn *conn, __u16 handle)
 147 {
 148         struct hci_dev *hdev = conn->hdev;
 149         struct hci_cp_add_sco cp;
 150
 151         BT_DBG("%p", conn);
 152
 153         conn->state = BT_CONNECT;
 154         conn->out = true;
 155
 156         conn->attempt++;
 157
 158         cp.handle   = cpu_to_le16(handle);
 159         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 160
 161         hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
 162 }
 163
 164 void hci_setup_sync(struct hci_conn *conn, __u16 handle)
 165 {
 166         struct hci_dev *hdev = conn->hdev;
 167         struct hci_cp_setup_sync_conn cp;
 168
 169         BT_DBG("%p", conn);
 170
 171         conn->state = BT_CONNECT;
 172         conn->out = true;
 173
 174         conn->attempt++;
 175
 176         cp.handle   = cpu_to_le16(handle);
 177         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 178
 179         cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
 180         cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
 181         cp.max_latency    = cpu_to_le16(0xffff);
 182         cp.voice_setting  = cpu_to_le16(hdev->voice_setting);
 183         cp.retrans_effort = 0xff;
 184
 185         hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp);
 186 }
 187
 188 void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max,
 189                                         u16 latency, u16 to_multiplier)
 190 {
 191         struct hci_cp_le_conn_update cp;
 192         struct hci_dev *hdev = conn->hdev;
 193
 194         memset(&cp, 0, sizeof(cp));
 195
 196         cp.handle               = cpu_to_le16(conn->handle);
 197         cp.conn_interval_min    = cpu_to_le16(min);
 198         cp.conn_interval_max    = cpu_to_le16(max);
 199         cp.conn_latency         = cpu_to_le16(latency);
 200         cp.supervision_timeout  = cpu_to_le16(to_multiplier);
 201         cp.min_ce_len           = cpu_to_le16(0x0001);
 202         cp.max_ce_len           = cpu_to_le16(0x0001);
 203
 204         hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp);
 205 }
 206 EXPORT_SYMBOL(hci_le_conn_update);
 207
 208 void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __u8 rand[8],
 209                                                         __u8 ltk[16])
 210 {
 211         struct hci_dev *hdev = conn->hdev;
 212         struct hci_cp_le_start_enc cp;
 213
 214         BT_DBG("%p", conn);
 215
 216         memset(&cp, 0, sizeof(cp));
 217
 218         cp.handle = cpu_to_le16(conn->handle);
 219         memcpy(cp.ltk, ltk, sizeof(cp.ltk));
 220         cp.ediv = ediv;
 221         memcpy(cp.rand, rand, sizeof(cp.rand));
 222
 223         hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp);
 224 }
 225 EXPORT_SYMBOL(hci_le_start_enc);
 226
 227 void hci_le_ltk_reply(struct hci_conn *conn, u8 ltk[16])
 228 {
 229         struct hci_dev *hdev = conn->hdev;
 230         struct hci_cp_le_ltk_reply cp;
 231
 232         BT_DBG("%p", conn);
 233
 234         memset(&cp, 0, sizeof(cp));
 235
 236         cp.handle = cpu_to_le16(conn->handle);
 237         memcpy(cp.ltk, ltk, sizeof(ltk));
 238
 239         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
 240 }
 241 EXPORT_SYMBOL(hci_le_ltk_reply);
 242
 243 void hci_le_ltk_neg_reply(struct hci_conn *conn)
 244 {
 245         struct hci_dev *hdev = conn->hdev;
 246         struct hci_cp_le_ltk_neg_reply cp;
 247
 248         BT_DBG("%p", conn);
 249
 250         memset(&cp, 0, sizeof(cp));
 251
 252         cp.handle = cpu_to_le16(conn->handle);
 253
 254         hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(cp), &cp);
 255 }
 256
 257 /* Device _must_ be locked */
 258 void hci_sco_setup(struct hci_conn *conn, __u8 status)
 259 {
 260         struct hci_conn *sco = conn->link;
 261
 262         BT_DBG("%p", conn);
 263
 264         if (!sco)
 265                 return;
 266
 267         if (!status) {
 268                 if (lmp_esco_capable(conn->hdev))
 269                         hci_setup_sync(sco, conn->handle);
 270                 else
 271                         hci_add_sco(sco, conn->handle);
 272         } else {
 273                 hci_proto_connect_cfm(sco, status);
 274                 hci_conn_del(sco);
 275         }
 276 }
 277
 278 static void hci_conn_timeout(struct work_struct *work)
 279 {
 280         struct hci_conn *conn = container_of(work, struct hci_conn,
 281                                                         disc_work.work);
 282         __u8 reason;
 283
 284         BT_DBG("conn %p state %s", conn, state_to_string(conn->state));
 285
 286         if (atomic_read(&conn->refcnt))
 287                 return;
 288
 289         switch (conn->state) {
 290         case BT_CONNECT:
 291         case BT_CONNECT2:
 292                 if (conn->out) {
 293                         if (conn->type == ACL_LINK)
 294                                 hci_acl_connect_cancel(conn);
 295                         else if (conn->type == LE_LINK)
 296                                 hci_le_connect_cancel(conn);
 297                 }
 298                 break;
 299         case BT_CONFIG:
 300         case BT_CONNECTED:
 301                 reason = hci_proto_disconn_ind(conn);
 302                 hci_acl_disconn(conn, reason);
 303                 break;
 304         default:
 305                 conn->state = BT_CLOSED;
 306                 break;
 307         }
 308 }
 309
 310 /* Enter sniff mode */
 311 static void hci_conn_enter_sniff_mode(struct hci_conn *conn)
 312 {
 313         struct hci_dev *hdev = conn->hdev;
 314
 315         BT_DBG("conn %p mode %d", conn, conn->mode);
 316
 317         if (test_bit(HCI_RAW, &hdev->flags))
 318                 return;
 319
 320         if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn))
 321                 return;
 322
 323         if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF))
 324                 return;
 325
 326         if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
 327                 struct hci_cp_sniff_subrate cp;
 328                 cp.handle             = cpu_to_le16(conn->handle);
 329                 cp.max_latency        = cpu_to_le16(0);
 330                 cp.min_remote_timeout = cpu_to_le16(0);
 331                 cp.min_local_timeout  = cpu_to_le16(0);
 332                 hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
 333         }
 334
 335         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
 336                 struct hci_cp_sniff_mode cp;
 337                 cp.handle       = cpu_to_le16(conn->handle);
 338                 cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
 339                 cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
 340                 cp.attempt      = cpu_to_le16(4);
 341                 cp.timeout      = cpu_to_le16(1);
 342                 hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
 343         }
 344 }
 345
 346 static void hci_conn_idle(unsigned long arg)
 347 {
 348         struct hci_conn *conn = (void *) arg;
 349
 350         BT_DBG("conn %p mode %d", conn, conn->mode);
 351
 352         hci_conn_enter_sniff_mode(conn);
 353 }
 354
 355 static void hci_conn_auto_accept(unsigned long arg)
 356 {
 357         struct hci_conn *conn = (void *) arg;
 358         struct hci_dev *hdev = conn->hdev;
 359
 360         hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY, sizeof(conn->dst),
 361                                                                 &conn->dst);
 362 }
 363
 364 struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
 365 {
 366         struct hci_conn *conn;
 367
 368         BT_DBG("%s dst %s", hdev->name, batostr(dst));
 369
 370         conn = kzalloc(sizeof(struct hci_conn), GFP_KERNEL);
 371         if (!conn)
 372                 return NULL;
 373
 374         bacpy(&conn->dst, dst);
 375         conn->hdev  = hdev;
 376         conn->type  = type;
 377         conn->mode  = HCI_CM_ACTIVE;
 378         conn->state = BT_OPEN;
 379         conn->auth_type = HCI_AT_GENERAL_BONDING;
 380         conn->io_capability = hdev->io_capability;
 381         conn->remote_auth = 0xff;
 382         conn->key_type = 0xff;
 383
 384         set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
 385         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
 386
 387         switch (type) {
 388         case ACL_LINK:
 389                 conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
 390                 break;
 391         case SCO_LINK:
 392                 if (lmp_esco_capable(hdev))
 393                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
 394                                         (hdev->esco_type & EDR_ESCO_MASK);
 395                 else
 396                         conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
 397                 break;
 398         case ESCO_LINK:
 399                 conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
 400                 break;
 401         }
 402
 403         skb_queue_head_init(&conn->data_q);
 404
 405         INIT_LIST_HEAD(&conn->chan_list);
 406
 407         INIT_DELAYED_WORK(&conn->disc_work, hci_conn_timeout);
 408         setup_timer(&conn->idle_timer, hci_conn_idle, (unsigned long)conn);
 409         setup_timer(&conn->auto_accept_timer, hci_conn_auto_accept,
 410                                                         (unsigned long) conn);
 411
 412         atomic_set(&conn->refcnt, 0);
 413
 414         hci_dev_hold(hdev);
 415
 416         hci_conn_hash_add(hdev, conn);
 417         if (hdev->notify)
 418                 hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
 419
 420         atomic_set(&conn->devref, 0);
 421
 422         hci_conn_init_sysfs(conn);
 423
 424         return conn;
 425 }
 426
 427 int hci_conn_del(struct hci_conn *conn)
 428 {
 429         struct hci_dev *hdev = conn->hdev;
 430
 431         BT_DBG("%s conn %p handle %d", hdev->name, conn, conn->handle);
 432
 433         del_timer(&conn->idle_timer);
 434
 435         cancel_delayed_work_sync(&conn->disc_work);
 436
 437         del_timer(&conn->auto_accept_timer);
 438
 439         if (conn->type == ACL_LINK) {
 440                 struct hci_conn *sco = conn->link;
 441                 if (sco)
 442                         sco->link = NULL;
 443
 444                 /* Unacked frames */
 445                 hdev->acl_cnt += conn->sent;
 446         } else if (conn->type == LE_LINK) {
 447                 if (hdev->le_pkts)
 448                         hdev->le_cnt += conn->sent;
 449                 else
 450                         hdev->acl_cnt += conn->sent;
 451         } else {
 452                 struct hci_conn *acl = conn->link;
 453                 if (acl) {
 454                         acl->link = NULL;
 455                         hci_conn_put(acl);
 456                 }
 457         }
 458
 459
 460         hci_chan_list_flush(conn);
 461
 462         hci_conn_hash_del(hdev, conn);
 463         if (hdev->notify)
 464                 hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
 465
 466         skb_queue_purge(&conn->data_q);
 467
 468         hci_conn_put_device(conn);
 469
 470         hci_dev_put(hdev);
 471
 472         if (conn->handle == 0)
 473                 kfree(conn);
 474
 475         return 0;
 476 }
 477
 478 struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src)
 479 {
 480         int use_src = bacmp(src, BDADDR_ANY);
 481         struct hci_dev *hdev = NULL, *d;
 482
 483         BT_DBG("%s -> %s", batostr(src), batostr(dst));
 484
 485         read_lock(&hci_dev_list_lock);
 486
 487         list_for_each_entry(d, &hci_dev_list, list) {
 488                 if (!test_bit(HCI_UP, &d->flags) || test_bit(HCI_RAW, &d->flags))
 489                         continue;
 490
 491                 /* Simple routing:
 492                  *   No source address - find interface with bdaddr != dst
 493                  *   Source address    - find interface with bdaddr == src
 494                  */
 495
 496                 if (use_src) {
 497                         if (!bacmp(&d->bdaddr, src)) {
 498                                 hdev = d; break;
 499                         }
 500                 } else {
 501                         if (bacmp(&d->bdaddr, dst)) {
 502                                 hdev = d; break;
 503                         }
 504                 }
 505         }
 506
 507         if (hdev)
 508                 hdev = hci_dev_hold(hdev);
 509
 510         read_unlock(&hci_dev_list_lock);
 511         return hdev;
 512 }
 513 EXPORT_SYMBOL(hci_get_route);
 514
 515 /* Create SCO, ACL or LE connection.
 516  * Device _must_ be locked */
 517 struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, __u8 sec_level, __u8 auth_type)
 518 {
 519         struct hci_conn *acl;
 520         struct hci_conn *sco;
 521         struct hci_conn *le;
 522
 523         BT_DBG("%s dst %s", hdev->name, batostr(dst));
 524
 525         if (type == LE_LINK) {
 526                 struct adv_entry *entry;
 527
 528                 le = hci_conn_hash_lookup_ba(hdev, LE_LINK, dst);
 529                 if (le)
 530                         return ERR_PTR(-EBUSY);
 531
 532                 entry = hci_find_adv_entry(hdev, dst);
 533                 if (!entry)
 534                         return ERR_PTR(-EHOSTUNREACH);
 535
 536                 le = hci_conn_add(hdev, LE_LINK, dst);
 537                 if (!le)
 538                         return ERR_PTR(-ENOMEM);
 539
 540                 le->dst_type = entry->bdaddr_type;
 541
 542                 hci_le_connect(le);
 543
 544                 hci_conn_hold(le);
 545
 546                 return le;
 547         }
 548
 549         acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
 550         if (!acl) {
 551                 acl = hci_conn_add(hdev, ACL_LINK, dst);
 552                 if (!acl)
 553                         return ERR_PTR(-ENOMEM);
 554         }
 555
 556         hci_conn_hold(acl);
 557
 558         if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
 559                 acl->sec_level = BT_SECURITY_LOW;
 560                 acl->pending_sec_level = sec_level;
 561                 acl->auth_type = auth_type;
 562                 hci_acl_connect(acl);
 563         }
 564
 565         if (type == ACL_LINK)
 566                 return acl;
 567
 568         sco = hci_conn_hash_lookup_ba(hdev, type, dst);
 569         if (!sco) {
 570                 sco = hci_conn_add(hdev, type, dst);
 571                 if (!sco) {
 572                         hci_conn_put(acl);
 573                         return ERR_PTR(-ENOMEM);
 574                 }
 575         }
 576
 577         acl->link = sco;
 578         sco->link = acl;
 579
 580         hci_conn_hold(sco);
 581
 582         if (acl->state == BT_CONNECTED &&
 583                         (sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
 584                 set_bit(HCI_CONN_POWER_SAVE, &acl->flags);
 585                 hci_conn_enter_active_mode(acl, BT_POWER_FORCE_ACTIVE_ON);
 586
 587                 if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->flags)) {
 588                         /* defer SCO setup until mode change completed */
 589                         set_bit(HCI_CONN_SCO_SETUP_PEND, &acl->flags);
 590                         return sco;
 591                 }
 592
 593                 hci_sco_setup(acl, 0x00);
 594         }
 595
 596         return sco;
 597 }
 598 EXPORT_SYMBOL(hci_connect);
 599
 600 /* Check link security requirement */
 601 int hci_conn_check_link_mode(struct hci_conn *conn)
 602 {
 603         BT_DBG("conn %p", conn);
 604
 605         if (hci_conn_ssp_enabled(conn) && !(conn->link_mode & HCI_LM_ENCRYPT))
 606                 return 0;
 607
 608         return 1;
 609 }
 610 EXPORT_SYMBOL(hci_conn_check_link_mode);
 611
 612 /* Authenticate remote device */
 613 static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 614 {
 615         BT_DBG("conn %p", conn);
 616
 617         if (conn->pending_sec_level > sec_level)
 618                 sec_level = conn->pending_sec_level;
 619
 620         if (sec_level > conn->sec_level)
 621                 conn->pending_sec_level = sec_level;
 622         else if (conn->link_mode & HCI_LM_AUTH)
 623                 return 1;
 624
 625         /* Make sure we preserve an existing MITM requirement*/
 626         auth_type |= (conn->auth_type & 0x01);
 627
 628         conn->auth_type = auth_type;
 629
 630         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
 631                 struct hci_cp_auth_requested cp;
 632
 633                 /* encrypt must be pending if auth is also pending */
 634                 set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
 635
 636                 cp.handle = cpu_to_le16(conn->handle);
 637                 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
 638                                                         sizeof(cp), &cp);
 639                 if (conn->key_type != 0xff)
 640                         set_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
 641         }
 642
 643         return 0;
 644 }
 645
 646 /* Encrypt the the link */
 647 static void hci_conn_encrypt(struct hci_conn *conn)
 648 {
 649         BT_DBG("conn %p", conn);
 650
 651         if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
 652                 struct hci_cp_set_conn_encrypt cp;
 653                 cp.handle  = cpu_to_le16(conn->handle);
 654                 cp.encrypt = 0x01;
 655                 hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
 656                                                                         &cp);
 657         }
 658 }
 659
 660 /* Enable security */
 661 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 662 {
 663         BT_DBG("conn %p", conn);
 664
 665         /* For sdp we don't need the link key. */
 666         if (sec_level == BT_SECURITY_SDP)
 667                 return 1;
 668
 669         /* For non 2.1 devices and low security level we don't need the link
 670            key. */
 671         if (sec_level == BT_SECURITY_LOW && !hci_conn_ssp_enabled(conn))
 672                 return 1;
 673
 674         /* For other security levels we need the link key. */
 675         if (!(conn->link_mode & HCI_LM_AUTH))
 676                 goto auth;
 677
 678         /* An authenticated combination key has sufficient security for any
 679            security level. */
 680         if (conn->key_type == HCI_LK_AUTH_COMBINATION)
 681                 goto encrypt;
 682
 683         /* An unauthenticated combination key has sufficient security for
 684            security level 1 and 2. */
 685         if (conn->key_type == HCI_LK_UNAUTH_COMBINATION &&
 686                         (sec_level == BT_SECURITY_MEDIUM ||
 687                         sec_level == BT_SECURITY_LOW))
 688                 goto encrypt;
 689
 690         /* A combination key has always sufficient security for the security
 691            levels 1 or 2. High security level requires the combination key
 692            is generated using maximum PIN code length (16).
 693            For pre 2.1 units. */
 694         if (conn->key_type == HCI_LK_COMBINATION &&
 695                         (sec_level != BT_SECURITY_HIGH ||
 696                         conn->pin_length == 16))
 697                 goto encrypt;
 698
 699 auth:
 700         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags))
 701                 return 0;
 702
 703         if (!hci_conn_auth(conn, sec_level, auth_type))
 704                 return 0;
 705
 706 encrypt:
 707         if (conn->link_mode & HCI_LM_ENCRYPT)
 708                 return 1;
 709
 710         hci_conn_encrypt(conn);
 711         return 0;
 712 }
 713 EXPORT_SYMBOL(hci_conn_security);
 714
 715 /* Check secure link requirement */
 716 int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level)
 717 {
 718         BT_DBG("conn %p", conn);
 719
 720         if (sec_level != BT_SECURITY_HIGH)
 721                 return 1; /* Accept if non-secure is required */
 722
 723         if (conn->sec_level == BT_SECURITY_HIGH)
 724                 return 1;
 725
 726         return 0; /* Reject not secure link */
 727 }
 728 EXPORT_SYMBOL(hci_conn_check_secure);
 729
 730 /* Change link key */
 731 int hci_conn_change_link_key(struct hci_conn *conn)
 732 {
 733         BT_DBG("conn %p", conn);
 734
 735         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
 736                 struct hci_cp_change_conn_link_key cp;
 737                 cp.handle = cpu_to_le16(conn->handle);
 738                 hci_send_cmd(conn->hdev, HCI_OP_CHANGE_CONN_LINK_KEY,
 739                                                         sizeof(cp), &cp);
 740         }
 741
 742         return 0;
 743 }
 744 EXPORT_SYMBOL(hci_conn_change_link_key);
 745
 746 /* Switch role */
 747 int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
 748 {
 749         BT_DBG("conn %p", conn);
 750
 751         if (!role && conn->link_mode & HCI_LM_MASTER)
 752                 return 1;
 753
 754         if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->flags)) {
 755                 struct hci_cp_switch_role cp;
 756                 bacpy(&cp.bdaddr, &conn->dst);
 757                 cp.role = role;
 758                 hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
 759         }
 760
 761         return 0;
 762 }
 763 EXPORT_SYMBOL(hci_conn_switch_role);
 764
 765 /* Enter active mode */
 766 void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
 767 {
 768         struct hci_dev *hdev = conn->hdev;
 769
 770         BT_DBG("conn %p mode %d", conn, conn->mode);
 771
 772         if (test_bit(HCI_RAW, &hdev->flags))
 773                 return;
 774
 775         if (conn->mode != HCI_CM_SNIFF)
 776                 goto timer;
 777
 778         if (!test_bit(HCI_CONN_POWER_SAVE, &conn->flags) && !force_active)
 779                 goto timer;
 780
 781         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
 782                 struct hci_cp_exit_sniff_mode cp;
 783                 cp.handle = cpu_to_le16(conn->handle);
 784                 hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
 785         }
 786
 787 timer:
 788         if (hdev->idle_timeout > 0)
 789                 mod_timer(&conn->idle_timer,
 790                         jiffies + msecs_to_jiffies(hdev->idle_timeout));
 791 }
 792
 793 /* Drop all connection on the device */
 794 void hci_conn_hash_flush(struct hci_dev *hdev)
 795 {
 796         struct hci_conn_hash *h = &hdev->conn_hash;
 797         struct hci_conn *c, *n;
 798
 799         BT_DBG("hdev %s", hdev->name);
 800
 801         list_for_each_entry_safe(c, n, &h->list, list) {
 802                 c->state = BT_CLOSED;
 803
 804                 hci_proto_disconn_cfm(c, HCI_ERROR_LOCAL_HOST_TERM);
 805                 hci_conn_del(c);
 806         }
 807 }
 808
 809 /* Check pending connect attempts */
 810 void hci_conn_check_pending(struct hci_dev *hdev)
 811 {
 812         struct hci_conn *conn;
 813
 814         BT_DBG("hdev %s", hdev->name);
 815
 816         hci_dev_lock(hdev);
 817
 818         conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
 819         if (conn)
 820                 hci_acl_connect(conn);
 821
 822         hci_dev_unlock(hdev);
 823 }
 824
 825 void hci_conn_hold_device(struct hci_conn *conn)
 826 {
 827         atomic_inc(&conn->devref);
 828 }
 829 EXPORT_SYMBOL(hci_conn_hold_device);
 830
 831 void hci_conn_put_device(struct hci_conn *conn)
 832 {
 833         if (atomic_dec_and_test(&conn->devref))
 834                 hci_conn_del_sysfs(conn);
 835 }
 836 EXPORT_SYMBOL(hci_conn_put_device);
 837
 838 int hci_get_conn_list(void __user *arg)
 839 {
 840         register struct hci_conn *c;
 841         struct hci_conn_list_req req, *cl;
 842         struct hci_conn_info *ci;
 843         struct hci_dev *hdev;
 844         int n = 0, size, err;
 845
 846         if (copy_from_user(&req, arg, sizeof(req)))
 847                 return -EFAULT;
 848
 849         if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
 850                 return -EINVAL;
 851
 852         size = sizeof(req) + req.conn_num * sizeof(*ci);
 853
 854         cl = kmalloc(size, GFP_KERNEL);
 855         if (!cl)
 856                 return -ENOMEM;
 857
 858         hdev = hci_dev_get(req.dev_id);
 859         if (!hdev) {
 860                 kfree(cl);
 861                 return -ENODEV;
 862         }
 863
 864         ci = cl->conn_info;
 865
 866         hci_dev_lock(hdev);
 867         list_for_each_entry(c, &hdev->conn_hash.list, list) {
 868                 bacpy(&(ci + n)->bdaddr, &c->dst);
 869                 (ci + n)->handle = c->handle;
 870                 (ci + n)->type  = c->type;
 871                 (ci + n)->out   = c->out;
 872                 (ci + n)->state = c->state;
 873                 (ci + n)->link_mode = c->link_mode;
 874                 if (++n >= req.conn_num)
 875                         break;
 876         }
 877         hci_dev_unlock(hdev);
 878
 879         cl->dev_id = hdev->id;
 880         cl->conn_num = n;
 881         size = sizeof(req) + n * sizeof(*ci);
 882
 883         hci_dev_put(hdev);
 884
 885         err = copy_to_user(arg, cl, size);
 886         kfree(cl);
 887
 888         return err ? -EFAULT : 0;
 889 }
 890
 891 int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
 892 {
 893         struct hci_conn_info_req req;
 894         struct hci_conn_info ci;
 895         struct hci_conn *conn;
 896         char __user *ptr = arg + sizeof(req);
 897
 898         if (copy_from_user(&req, arg, sizeof(req)))
 899                 return -EFAULT;
 900
 901         hci_dev_lock(hdev);
 902         conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
 903         if (conn) {
 904                 bacpy(&ci.bdaddr, &conn->dst);
 905                 ci.handle = conn->handle;
 906                 ci.type  = conn->type;
 907                 ci.out   = conn->out;
 908                 ci.state = conn->state;
 909                 ci.link_mode = conn->link_mode;
 910         }
 911         hci_dev_unlock(hdev);
 912
 913         if (!conn)
 914                 return -ENOENT;
 915
 916         return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
 917 }
 918
 919 int hci_get_auth_info(struct hci_dev *hdev, void __user *arg)
 920 {
 921         struct hci_auth_info_req req;
 922         struct hci_conn *conn;
 923
 924         if (copy_from_user(&req, arg, sizeof(req)))
 925                 return -EFAULT;
 926
 927         hci_dev_lock(hdev);
 928         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr);
 929         if (conn)
 930                 req.type = conn->auth_type;
 931         hci_dev_unlock(hdev);
 932
 933         if (!conn)
 934                 return -ENOENT;
 935
 936         return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0;
 937 }
 938
 939 struct hci_chan *hci_chan_create(struct hci_conn *conn)
 940 {
 941         struct hci_dev *hdev = conn->hdev;
 942         struct hci_chan *chan;
 943
 944         BT_DBG("%s conn %p", hdev->name, conn);
 945
 946         chan = kzalloc(sizeof(struct hci_chan), GFP_KERNEL);
 947         if (!chan)
 948                 return NULL;
 949
 950         chan->conn = conn;
 951         skb_queue_head_init(&chan->data_q);
 952
 953         list_add_rcu(&chan->list, &conn->chan_list);
 954
 955         return chan;
 956 }
 957
 958 int hci_chan_del(struct hci_chan *chan)
 959 {
 960         struct hci_conn *conn = chan->conn;
 961         struct hci_dev *hdev = conn->hdev;
 962
 963         BT_DBG("%s conn %p chan %p", hdev->name, conn, chan);
 964
 965         list_del_rcu(&chan->list);
 966
 967         synchronize_rcu();
 968
 969         skb_queue_purge(&chan->data_q);
 970         kfree(chan);
 971
 972         return 0;
 973 }
 974
 975 void hci_chan_list_flush(struct hci_conn *conn)
 976 {
 977         struct hci_chan *chan, *n;
 978
 979         BT_DBG("conn %p", conn);
 980
 981         list_for_each_entry_safe(chan, n, &conn->chan_list, list)
 982                 hci_chan_del(chan);
 983 }