net/bluetooth/hci_conn.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI connection handling. */
  26
  27 #include <linux/module.h>
  28
  29 #include <linux/types.h>
  30 #include <linux/errno.h>
  31 #include <linux/kernel.h>
  32 #include <linux/slab.h>
  33 #include <linux/poll.h>
  34 #include <linux/fcntl.h>
  35 #include <linux/init.h>
  36 #include <linux/skbuff.h>
  37 #include <linux/interrupt.h>
  38 #include <linux/notifier.h>
  39 #include <net/sock.h>
  40
  41 #include <asm/system.h>
  42 #include <linux/uaccess.h>
  43 #include <asm/unaligned.h>
  44
  45 #include <net/bluetooth/bluetooth.h>
  46 #include <net/bluetooth/hci_core.h>
  47
  48 static void hci_le_connect(struct hci_conn *conn)
  49 {
  50         struct hci_dev *hdev = conn->hdev;
  51         struct hci_cp_le_create_conn cp;
  52
  53         conn->state = BT_CONNECT;
  54         conn->out = true;
  55         conn->link_mode |= HCI_LM_MASTER;
  56         conn->sec_level = BT_SECURITY_LOW;
  57
  58         memset(&cp, 0, sizeof(cp));
  59         cp.scan_interval = cpu_to_le16(0x0060);
  60         cp.scan_window = cpu_to_le16(0x0030);
  61         bacpy(&cp.peer_addr, &conn->dst);
  62         cp.peer_addr_type = conn->dst_type;
  63         cp.conn_interval_min = cpu_to_le16(0x0028);
  64         cp.conn_interval_max = cpu_to_le16(0x0038);
  65         cp.supervision_timeout = cpu_to_le16(0x002a);
  66         cp.min_ce_len = cpu_to_le16(0x0000);
  67         cp.max_ce_len = cpu_to_le16(0x0000);
  68
  69         hci_send_cmd(hdev, HCI_OP_LE_CREATE_CONN, sizeof(cp), &cp);
  70 }
  71
  72 static void hci_le_connect_cancel(struct hci_conn *conn)
  73 {
  74         hci_send_cmd(conn->hdev, HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL);
  75 }
  76
  77 void hci_acl_connect(struct hci_conn *conn)
  78 {
  79         struct hci_dev *hdev = conn->hdev;
  80         struct inquiry_entry *ie;
  81         struct hci_cp_create_conn cp;
  82
  83         BT_DBG("%p", conn);
  84
  85         conn->state = BT_CONNECT;
  86         conn->out = true;
  87
  88         conn->link_mode = HCI_LM_MASTER;
  89
  90         conn->attempt++;
  91
  92         conn->link_policy = hdev->link_policy;
  93
  94         memset(&cp, 0, sizeof(cp));
  95         bacpy(&cp.bdaddr, &conn->dst);
  96         cp.pscan_rep_mode = 0x02;
  97
  98         ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
  99         if (ie) {
 100                 if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
 101                         cp.pscan_rep_mode = ie->data.pscan_rep_mode;
 102                         cp.pscan_mode     = ie->data.pscan_mode;
 103                         cp.clock_offset   = ie->data.clock_offset |
 104                                                         cpu_to_le16(0x8000);
 105                 }
 106
 107                 memcpy(conn->dev_class, ie->data.dev_class, 3);
 108                 if (ie->data.ssp_mode > 0)
 109                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
 110         }
 111
 112         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 113         if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
 114                 cp.role_switch = 0x01;
 115         else
 116                 cp.role_switch = 0x00;
 117
 118         hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
 119 }
 120
 121 static void hci_acl_connect_cancel(struct hci_conn *conn)
 122 {
 123         struct hci_cp_create_conn_cancel cp;
 124
 125         BT_DBG("%p", conn);
 126
 127         if (conn->hdev->hci_ver < BLUETOOTH_VER_1_2)
 128                 return;
 129
 130         bacpy(&cp.bdaddr, &conn->dst);
 131         hci_send_cmd(conn->hdev, HCI_OP_CREATE_CONN_CANCEL, sizeof(cp), &cp);
 132 }
 133
 134 void hci_acl_disconn(struct hci_conn *conn, __u8 reason)
 135 {
 136         struct hci_cp_disconnect cp;
 137
 138         BT_DBG("%p", conn);
 139
 140         conn->state = BT_DISCONN;
 141
 142         cp.handle = cpu_to_le16(conn->handle);
 143         cp.reason = reason;
 144         hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp);
 145 }
 146
 147 void hci_add_sco(struct hci_conn *conn, __u16 handle)
 148 {
 149         struct hci_dev *hdev = conn->hdev;
 150         struct hci_cp_add_sco cp;
 151
 152         BT_DBG("%p", conn);
 153
 154         conn->state = BT_CONNECT;
 155         conn->out = true;
 156
 157         conn->attempt++;
 158
 159         cp.handle   = cpu_to_le16(handle);
 160         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 161
 162         hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
 163 }
 164
 165 void hci_setup_sync(struct hci_conn *conn, __u16 handle)
 166 {
 167         struct hci_dev *hdev = conn->hdev;
 168         struct hci_cp_setup_sync_conn cp;
 169
 170         BT_DBG("%p", conn);
 171
 172         conn->state = BT_CONNECT;
 173         conn->out = true;
 174
 175         conn->attempt++;
 176
 177         cp.handle   = cpu_to_le16(handle);
 178         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 179
 180         cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
 181         cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
 182         cp.max_latency    = cpu_to_le16(0xffff);
 183         cp.voice_setting  = cpu_to_le16(hdev->voice_setting);
 184         cp.retrans_effort = 0xff;
 185
 186         hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp);
 187 }
 188
 189 void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max,
 190                                         u16 latency, u16 to_multiplier)
 191 {
 192         struct hci_cp_le_conn_update cp;
 193         struct hci_dev *hdev = conn->hdev;
 194
 195         memset(&cp, 0, sizeof(cp));
 196
 197         cp.handle               = cpu_to_le16(conn->handle);
 198         cp.conn_interval_min    = cpu_to_le16(min);
 199         cp.conn_interval_max    = cpu_to_le16(max);
 200         cp.conn_latency         = cpu_to_le16(latency);
 201         cp.supervision_timeout  = cpu_to_le16(to_multiplier);
 202         cp.min_ce_len           = cpu_to_le16(0x0001);
 203         cp.max_ce_len           = cpu_to_le16(0x0001);
 204
 205         hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp);
 206 }
 207 EXPORT_SYMBOL(hci_le_conn_update);
 208
 209 void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __u8 rand[8],
 210                                                         __u8 ltk[16])
 211 {
 212         struct hci_dev *hdev = conn->hdev;
 213         struct hci_cp_le_start_enc cp;
 214
 215         BT_DBG("%p", conn);
 216
 217         memset(&cp, 0, sizeof(cp));
 218
 219         cp.handle = cpu_to_le16(conn->handle);
 220         memcpy(cp.ltk, ltk, sizeof(cp.ltk));
 221         cp.ediv = ediv;
 222         memcpy(cp.rand, rand, sizeof(cp.rand));
 223
 224         hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp);
 225 }
 226 EXPORT_SYMBOL(hci_le_start_enc);
 227
 228 void hci_le_ltk_reply(struct hci_conn *conn, u8 ltk[16])
 229 {
 230         struct hci_dev *hdev = conn->hdev;
 231         struct hci_cp_le_ltk_reply cp;
 232
 233         BT_DBG("%p", conn);
 234
 235         memset(&cp, 0, sizeof(cp));
 236
 237         cp.handle = cpu_to_le16(conn->handle);
 238         memcpy(cp.ltk, ltk, sizeof(ltk));
 239
 240         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
 241 }
 242 EXPORT_SYMBOL(hci_le_ltk_reply);
 243
 244 void hci_le_ltk_neg_reply(struct hci_conn *conn)
 245 {
 246         struct hci_dev *hdev = conn->hdev;
 247         struct hci_cp_le_ltk_neg_reply cp;
 248
 249         BT_DBG("%p", conn);
 250
 251         memset(&cp, 0, sizeof(cp));
 252
 253         cp.handle = cpu_to_le16(conn->handle);
 254
 255         hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(cp), &cp);
 256 }
 257
 258 /* Device _must_ be locked */
 259 void hci_sco_setup(struct hci_conn *conn, __u8 status)
 260 {
 261         struct hci_conn *sco = conn->link;
 262
 263         BT_DBG("%p", conn);
 264
 265         if (!sco)
 266                 return;
 267
 268         if (!status) {
 269                 if (lmp_esco_capable(conn->hdev))
 270                         hci_setup_sync(sco, conn->handle);
 271                 else
 272                         hci_add_sco(sco, conn->handle);
 273         } else {
 274                 hci_proto_connect_cfm(sco, status);
 275                 hci_conn_del(sco);
 276         }
 277 }
 278
 279 static void hci_conn_timeout(struct work_struct *work)
 280 {
 281         struct hci_conn *conn = container_of(work, struct hci_conn,
 282                                                         disc_work.work);
 283         __u8 reason;
 284
 285         BT_DBG("conn %p state %d", conn, conn->state);
 286
 287         if (atomic_read(&conn->refcnt))
 288                 return;
 289
 290         switch (conn->state) {
 291         case BT_CONNECT:
 292         case BT_CONNECT2:
 293                 if (conn->out) {
 294                         if (conn->type == ACL_LINK)
 295                                 hci_acl_connect_cancel(conn);
 296                         else if (conn->type == LE_LINK)
 297                                 hci_le_connect_cancel(conn);
 298                 }
 299                 break;
 300         case BT_CONFIG:
 301         case BT_CONNECTED:
 302                 reason = hci_proto_disconn_ind(conn);
 303                 hci_acl_disconn(conn, reason);
 304                 break;
 305         default:
 306                 conn->state = BT_CLOSED;
 307                 break;
 308         }
 309 }
 310
 311 /* Enter sniff mode */
 312 static void hci_conn_enter_sniff_mode(struct hci_conn *conn)
 313 {
 314         struct hci_dev *hdev = conn->hdev;
 315
 316         BT_DBG("conn %p mode %d", conn, conn->mode);
 317
 318         if (test_bit(HCI_RAW, &hdev->flags))
 319                 return;
 320
 321         if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn))
 322                 return;
 323
 324         if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF))
 325                 return;
 326
 327         if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
 328                 struct hci_cp_sniff_subrate cp;
 329                 cp.handle             = cpu_to_le16(conn->handle);
 330                 cp.max_latency        = cpu_to_le16(0);
 331                 cp.min_remote_timeout = cpu_to_le16(0);
 332                 cp.min_local_timeout  = cpu_to_le16(0);
 333                 hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
 334         }
 335
 336         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
 337                 struct hci_cp_sniff_mode cp;
 338                 cp.handle       = cpu_to_le16(conn->handle);
 339                 cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
 340                 cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
 341                 cp.attempt      = cpu_to_le16(4);
 342                 cp.timeout      = cpu_to_le16(1);
 343                 hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
 344         }
 345 }
 346
 347 static void hci_conn_idle(unsigned long arg)
 348 {
 349         struct hci_conn *conn = (void *) arg;
 350
 351         BT_DBG("conn %p mode %d", conn, conn->mode);
 352
 353         hci_conn_enter_sniff_mode(conn);
 354 }
 355
 356 static void hci_conn_auto_accept(unsigned long arg)
 357 {
 358         struct hci_conn *conn = (void *) arg;
 359         struct hci_dev *hdev = conn->hdev;
 360
 361         hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY, sizeof(conn->dst),
 362                                                                 &conn->dst);
 363 }
 364
 365 struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
 366 {
 367         struct hci_conn *conn;
 368
 369         BT_DBG("%s dst %s", hdev->name, batostr(dst));
 370
 371         conn = kzalloc(sizeof(struct hci_conn), GFP_KERNEL);
 372         if (!conn)
 373                 return NULL;
 374
 375         bacpy(&conn->dst, dst);
 376         conn->hdev  = hdev;
 377         conn->type  = type;
 378         conn->mode  = HCI_CM_ACTIVE;
 379         conn->state = BT_OPEN;
 380         conn->auth_type = HCI_AT_GENERAL_BONDING;
 381         conn->io_capability = hdev->io_capability;
 382         conn->remote_auth = 0xff;
 383         conn->key_type = 0xff;
 384
 385         set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
 386         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
 387
 388         switch (type) {
 389         case ACL_LINK:
 390                 conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
 391                 break;
 392         case SCO_LINK:
 393                 if (lmp_esco_capable(hdev))
 394                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
 395                                         (hdev->esco_type & EDR_ESCO_MASK);
 396                 else
 397                         conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
 398                 break;
 399         case ESCO_LINK:
 400                 conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
 401                 break;
 402         }
 403
 404         skb_queue_head_init(&conn->data_q);
 405
 406         INIT_LIST_HEAD(&conn->chan_list);;
 407
 408         INIT_DELAYED_WORK(&conn->disc_work, hci_conn_timeout);
 409         setup_timer(&conn->idle_timer, hci_conn_idle, (unsigned long)conn);
 410         setup_timer(&conn->auto_accept_timer, hci_conn_auto_accept,
 411                                                         (unsigned long) conn);
 412
 413         atomic_set(&conn->refcnt, 0);
 414
 415         hci_dev_hold(hdev);
 416
 417         hci_conn_hash_add(hdev, conn);
 418         if (hdev->notify)
 419                 hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
 420
 421         atomic_set(&conn->devref, 0);
 422
 423         hci_conn_init_sysfs(conn);
 424
 425         return conn;
 426 }
 427
 428 int hci_conn_del(struct hci_conn *conn)
 429 {
 430         struct hci_dev *hdev = conn->hdev;
 431
 432         BT_DBG("%s conn %p handle %d", hdev->name, conn, conn->handle);
 433
 434         del_timer(&conn->idle_timer);
 435
 436         cancel_delayed_work_sync(&conn->disc_work);
 437
 438         del_timer(&conn->auto_accept_timer);
 439
 440         if (conn->type == ACL_LINK) {
 441                 struct hci_conn *sco = conn->link;
 442                 if (sco)
 443                         sco->link = NULL;
 444
 445                 /* Unacked frames */
 446                 hdev->acl_cnt += conn->sent;
 447         } else if (conn->type == LE_LINK) {
 448                 if (hdev->le_pkts)
 449                         hdev->le_cnt += conn->sent;
 450                 else
 451                         hdev->acl_cnt += conn->sent;
 452         } else {
 453                 struct hci_conn *acl = conn->link;
 454                 if (acl) {
 455                         acl->link = NULL;
 456                         hci_conn_put(acl);
 457                 }
 458         }
 459
 460
 461         hci_chan_list_flush(conn);
 462
 463         hci_conn_hash_del(hdev, conn);
 464         if (hdev->notify)
 465                 hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
 466
 467         skb_queue_purge(&conn->data_q);
 468
 469         hci_conn_put_device(conn);
 470
 471         hci_dev_put(hdev);
 472
 473         if (conn->handle == 0)
 474                 kfree(conn);
 475
 476         return 0;
 477 }
 478
 479 struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src)
 480 {
 481         int use_src = bacmp(src, BDADDR_ANY);
 482         struct hci_dev *hdev = NULL, *d;
 483
 484         BT_DBG("%s -> %s", batostr(src), batostr(dst));
 485
 486         read_lock(&hci_dev_list_lock);
 487
 488         list_for_each_entry(d, &hci_dev_list, list) {
 489                 if (!test_bit(HCI_UP, &d->flags) || test_bit(HCI_RAW, &d->flags))
 490                         continue;
 491
 492                 /* Simple routing:
 493                  *   No source address - find interface with bdaddr != dst
 494                  *   Source address    - find interface with bdaddr == src
 495                  */
 496
 497                 if (use_src) {
 498                         if (!bacmp(&d->bdaddr, src)) {
 499                                 hdev = d; break;
 500                         }
 501                 } else {
 502                         if (bacmp(&d->bdaddr, dst)) {
 503                                 hdev = d; break;
 504                         }
 505                 }
 506         }
 507
 508         if (hdev)
 509                 hdev = hci_dev_hold(hdev);
 510
 511         read_unlock(&hci_dev_list_lock);
 512         return hdev;
 513 }
 514 EXPORT_SYMBOL(hci_get_route);
 515
 516 /* Create SCO, ACL or LE connection.
 517  * Device _must_ be locked */
 518 struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, __u8 sec_level, __u8 auth_type)
 519 {
 520         struct hci_conn *acl;
 521         struct hci_conn *sco;
 522         struct hci_conn *le;
 523
 524         BT_DBG("%s dst %s", hdev->name, batostr(dst));
 525
 526         if (type == LE_LINK) {
 527                 struct adv_entry *entry;
 528
 529                 le = hci_conn_hash_lookup_ba(hdev, LE_LINK, dst);
 530                 if (le)
 531                         return ERR_PTR(-EBUSY);
 532
 533                 entry = hci_find_adv_entry(hdev, dst);
 534                 if (!entry)
 535                         return ERR_PTR(-EHOSTUNREACH);
 536
 537                 le = hci_conn_add(hdev, LE_LINK, dst);
 538                 if (!le)
 539                         return ERR_PTR(-ENOMEM);
 540
 541                 le->dst_type = entry->bdaddr_type;
 542
 543                 hci_le_connect(le);
 544
 545                 hci_conn_hold(le);
 546
 547                 return le;
 548         }
 549
 550         acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
 551         if (!acl) {
 552                 acl = hci_conn_add(hdev, ACL_LINK, dst);
 553                 if (!acl)
 554                         return NULL;
 555         }
 556
 557         hci_conn_hold(acl);
 558
 559         if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
 560                 acl->sec_level = BT_SECURITY_LOW;
 561                 acl->pending_sec_level = sec_level;
 562                 acl->auth_type = auth_type;
 563                 hci_acl_connect(acl);
 564         }
 565
 566         if (type == ACL_LINK)
 567                 return acl;
 568
 569         sco = hci_conn_hash_lookup_ba(hdev, type, dst);
 570         if (!sco) {
 571                 sco = hci_conn_add(hdev, type, dst);
 572                 if (!sco) {
 573                         hci_conn_put(acl);
 574                         return NULL;
 575                 }
 576         }
 577
 578         acl->link = sco;
 579         sco->link = acl;
 580
 581         hci_conn_hold(sco);
 582
 583         if (acl->state == BT_CONNECTED &&
 584                         (sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
 585                 set_bit(HCI_CONN_POWER_SAVE, &acl->flags);
 586                 hci_conn_enter_active_mode(acl, BT_POWER_FORCE_ACTIVE_ON);
 587
 588                 if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->flags)) {
 589                         /* defer SCO setup until mode change completed */
 590                         set_bit(HCI_CONN_SCO_SETUP_PEND, &acl->flags);
 591                         return sco;
 592                 }
 593
 594                 hci_sco_setup(acl, 0x00);
 595         }
 596
 597         return sco;
 598 }
 599 EXPORT_SYMBOL(hci_connect);
 600
 601 /* Check link security requirement */
 602 int hci_conn_check_link_mode(struct hci_conn *conn)
 603 {
 604         BT_DBG("conn %p", conn);
 605
 606         if (hci_conn_ssp_enabled(conn) && !(conn->link_mode & HCI_LM_ENCRYPT))
 607                 return 0;
 608
 609         return 1;
 610 }
 611 EXPORT_SYMBOL(hci_conn_check_link_mode);
 612
 613 /* Authenticate remote device */
 614 static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 615 {
 616         BT_DBG("conn %p", conn);
 617
 618         if (conn->pending_sec_level > sec_level)
 619                 sec_level = conn->pending_sec_level;
 620
 621         if (sec_level > conn->sec_level)
 622                 conn->pending_sec_level = sec_level;
 623         else if (conn->link_mode & HCI_LM_AUTH)
 624                 return 1;
 625
 626         /* Make sure we preserve an existing MITM requirement*/
 627         auth_type |= (conn->auth_type & 0x01);
 628
 629         conn->auth_type = auth_type;
 630
 631         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
 632                 struct hci_cp_auth_requested cp;
 633
 634                 /* encrypt must be pending if auth is also pending */
 635                 set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
 636
 637                 cp.handle = cpu_to_le16(conn->handle);
 638                 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
 639                                                         sizeof(cp), &cp);
 640                 if (conn->key_type != 0xff)
 641                         set_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
 642         }
 643
 644         return 0;
 645 }
 646
 647 /* Encrypt the the link */
 648 static void hci_conn_encrypt(struct hci_conn *conn)
 649 {
 650         BT_DBG("conn %p", conn);
 651
 652         if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
 653                 struct hci_cp_set_conn_encrypt cp;
 654                 cp.handle  = cpu_to_le16(conn->handle);
 655                 cp.encrypt = 0x01;
 656                 hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
 657                                                                         &cp);
 658         }
 659 }
 660
 661 /* Enable security */
 662 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 663 {
 664         BT_DBG("conn %p", conn);
 665
 666         /* For sdp we don't need the link key. */
 667         if (sec_level == BT_SECURITY_SDP)
 668                 return 1;
 669
 670         /* For non 2.1 devices and low security level we don't need the link
 671            key. */
 672         if (sec_level == BT_SECURITY_LOW && !hci_conn_ssp_enabled(conn))
 673                 return 1;
 674
 675         /* For other security levels we need the link key. */
 676         if (!(conn->link_mode & HCI_LM_AUTH))
 677                 goto auth;
 678
 679         /* An authenticated combination key has sufficient security for any
 680            security level. */
 681         if (conn->key_type == HCI_LK_AUTH_COMBINATION)
 682                 goto encrypt;
 683
 684         /* An unauthenticated combination key has sufficient security for
 685            security level 1 and 2. */
 686         if (conn->key_type == HCI_LK_UNAUTH_COMBINATION &&
 687                         (sec_level == BT_SECURITY_MEDIUM ||
 688                         sec_level == BT_SECURITY_LOW))
 689                 goto encrypt;
 690
 691         /* A combination key has always sufficient security for the security
 692            levels 1 or 2. High security level requires the combination key
 693            is generated using maximum PIN code length (16).
 694            For pre 2.1 units. */
 695         if (conn->key_type == HCI_LK_COMBINATION &&
 696                         (sec_level != BT_SECURITY_HIGH ||
 697                         conn->pin_length == 16))
 698                 goto encrypt;
 699
 700 auth:
 701         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags))
 702                 return 0;
 703
 704         if (!hci_conn_auth(conn, sec_level, auth_type))
 705                 return 0;
 706
 707 encrypt:
 708         if (conn->link_mode & HCI_LM_ENCRYPT)
 709                 return 1;
 710
 711         hci_conn_encrypt(conn);
 712         return 0;
 713 }
 714 EXPORT_SYMBOL(hci_conn_security);
 715
 716 /* Check secure link requirement */
 717 int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level)
 718 {
 719         BT_DBG("conn %p", conn);
 720
 721         if (sec_level != BT_SECURITY_HIGH)
 722                 return 1; /* Accept if non-secure is required */
 723
 724         if (conn->sec_level == BT_SECURITY_HIGH)
 725                 return 1;
 726
 727         return 0; /* Reject not secure link */
 728 }
 729 EXPORT_SYMBOL(hci_conn_check_secure);
 730
 731 /* Change link key */
 732 int hci_conn_change_link_key(struct hci_conn *conn)
 733 {
 734         BT_DBG("conn %p", conn);
 735
 736         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
 737                 struct hci_cp_change_conn_link_key cp;
 738                 cp.handle = cpu_to_le16(conn->handle);
 739                 hci_send_cmd(conn->hdev, HCI_OP_CHANGE_CONN_LINK_KEY,
 740                                                         sizeof(cp), &cp);
 741         }
 742
 743         return 0;
 744 }
 745 EXPORT_SYMBOL(hci_conn_change_link_key);
 746
 747 /* Switch role */
 748 int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
 749 {
 750         BT_DBG("conn %p", conn);
 751
 752         if (!role && conn->link_mode & HCI_LM_MASTER)
 753                 return 1;
 754
 755         if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->flags)) {
 756                 struct hci_cp_switch_role cp;
 757                 bacpy(&cp.bdaddr, &conn->dst);
 758                 cp.role = role;
 759                 hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
 760         }
 761
 762         return 0;
 763 }
 764 EXPORT_SYMBOL(hci_conn_switch_role);
 765
 766 /* Enter active mode */
 767 void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
 768 {
 769         struct hci_dev *hdev = conn->hdev;
 770
 771         BT_DBG("conn %p mode %d", conn, conn->mode);
 772
 773         if (test_bit(HCI_RAW, &hdev->flags))
 774                 return;
 775
 776         if (conn->mode != HCI_CM_SNIFF)
 777                 goto timer;
 778
 779         if (!test_bit(HCI_CONN_POWER_SAVE, &conn->flags) && !force_active)
 780                 goto timer;
 781
 782         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
 783                 struct hci_cp_exit_sniff_mode cp;
 784                 cp.handle = cpu_to_le16(conn->handle);
 785                 hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
 786         }
 787
 788 timer:
 789         if (hdev->idle_timeout > 0)
 790                 mod_timer(&conn->idle_timer,
 791                         jiffies + msecs_to_jiffies(hdev->idle_timeout));
 792 }
 793
 794 /* Drop all connection on the device */
 795 void hci_conn_hash_flush(struct hci_dev *hdev)
 796 {
 797         struct hci_conn_hash *h = &hdev->conn_hash;
 798         struct hci_conn *c, *n;
 799
 800         BT_DBG("hdev %s", hdev->name);
 801
 802         list_for_each_entry_safe(c, n, &h->list, list) {
 803                 c->state = BT_CLOSED;
 804
 805                 hci_proto_disconn_cfm(c, HCI_ERROR_LOCAL_HOST_TERM);
 806                 hci_conn_del(c);
 807         }
 808 }
 809
 810 /* Check pending connect attempts */
 811 void hci_conn_check_pending(struct hci_dev *hdev)
 812 {
 813         struct hci_conn *conn;
 814
 815         BT_DBG("hdev %s", hdev->name);
 816
 817         hci_dev_lock(hdev);
 818
 819         conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
 820         if (conn)
 821                 hci_acl_connect(conn);
 822
 823         hci_dev_unlock(hdev);
 824 }
 825
 826 void hci_conn_hold_device(struct hci_conn *conn)
 827 {
 828         atomic_inc(&conn->devref);
 829 }
 830 EXPORT_SYMBOL(hci_conn_hold_device);
 831
 832 void hci_conn_put_device(struct hci_conn *conn)
 833 {
 834         if (atomic_dec_and_test(&conn->devref))
 835                 hci_conn_del_sysfs(conn);
 836 }
 837 EXPORT_SYMBOL(hci_conn_put_device);
 838
 839 int hci_get_conn_list(void __user *arg)
 840 {
 841         register struct hci_conn *c;
 842         struct hci_conn_list_req req, *cl;
 843         struct hci_conn_info *ci;
 844         struct hci_dev *hdev;
 845         int n = 0, size, err;
 846
 847         if (copy_from_user(&req, arg, sizeof(req)))
 848                 return -EFAULT;
 849
 850         if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
 851                 return -EINVAL;
 852
 853         size = sizeof(req) + req.conn_num * sizeof(*ci);
 854
 855         cl = kmalloc(size, GFP_KERNEL);
 856         if (!cl)
 857                 return -ENOMEM;
 858
 859         hdev = hci_dev_get(req.dev_id);
 860         if (!hdev) {
 861                 kfree(cl);
 862                 return -ENODEV;
 863         }
 864
 865         ci = cl->conn_info;
 866
 867         hci_dev_lock(hdev);
 868         list_for_each_entry(c, &hdev->conn_hash.list, list) {
 869                 bacpy(&(ci + n)->bdaddr, &c->dst);
 870                 (ci + n)->handle = c->handle;
 871                 (ci + n)->type  = c->type;
 872                 (ci + n)->out   = c->out;
 873                 (ci + n)->state = c->state;
 874                 (ci + n)->link_mode = c->link_mode;
 875                 if (++n >= req.conn_num)
 876                         break;
 877         }
 878         hci_dev_unlock(hdev);
 879
 880         cl->dev_id = hdev->id;
 881         cl->conn_num = n;
 882         size = sizeof(req) + n * sizeof(*ci);
 883
 884         hci_dev_put(hdev);
 885
 886         err = copy_to_user(arg, cl, size);
 887         kfree(cl);
 888
 889         return err ? -EFAULT : 0;
 890 }
 891
 892 int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
 893 {
 894         struct hci_conn_info_req req;
 895         struct hci_conn_info ci;
 896         struct hci_conn *conn;
 897         char __user *ptr = arg + sizeof(req);
 898
 899         if (copy_from_user(&req, arg, sizeof(req)))
 900                 return -EFAULT;
 901
 902         hci_dev_lock(hdev);
 903         conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
 904         if (conn) {
 905                 bacpy(&ci.bdaddr, &conn->dst);
 906                 ci.handle = conn->handle;
 907                 ci.type  = conn->type;
 908                 ci.out   = conn->out;
 909                 ci.state = conn->state;
 910                 ci.link_mode = conn->link_mode;
 911         }
 912         hci_dev_unlock(hdev);
 913
 914         if (!conn)
 915                 return -ENOENT;
 916
 917         return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
 918 }
 919
 920 int hci_get_auth_info(struct hci_dev *hdev, void __user *arg)
 921 {
 922         struct hci_auth_info_req req;
 923         struct hci_conn *conn;
 924
 925         if (copy_from_user(&req, arg, sizeof(req)))
 926                 return -EFAULT;
 927
 928         hci_dev_lock(hdev);
 929         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr);
 930         if (conn)
 931                 req.type = conn->auth_type;
 932         hci_dev_unlock(hdev);
 933
 934         if (!conn)
 935                 return -ENOENT;
 936
 937         return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0;
 938 }
 939
 940 struct hci_chan *hci_chan_create(struct hci_conn *conn)
 941 {
 942         struct hci_dev *hdev = conn->hdev;
 943         struct hci_chan *chan;
 944
 945         BT_DBG("%s conn %p", hdev->name, conn);
 946
 947         chan = kzalloc(sizeof(struct hci_chan), GFP_KERNEL);
 948         if (!chan)
 949                 return NULL;
 950
 951         chan->conn = conn;
 952         skb_queue_head_init(&chan->data_q);
 953
 954         list_add_rcu(&chan->list, &conn->chan_list);
 955
 956         return chan;
 957 }
 958
 959 int hci_chan_del(struct hci_chan *chan)
 960 {
 961         struct hci_conn *conn = chan->conn;
 962         struct hci_dev *hdev = conn->hdev;
 963
 964         BT_DBG("%s conn %p chan %p", hdev->name, conn, chan);
 965
 966         list_del_rcu(&chan->list);
 967
 968         synchronize_rcu();
 969
 970         skb_queue_purge(&chan->data_q);
 971         kfree(chan);
 972
 973         return 0;
 974 }
 975
 976 void hci_chan_list_flush(struct hci_conn *conn)
 977 {
 978         struct hci_chan *chan;
 979
 980         BT_DBG("conn %p", conn);
 981
 982         list_for_each_entry_rcu(chan, &conn->chan_list, list)
 983                 hci_chan_del(chan);
 984 }