net/bluetooth/hci_conn.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI connection handling. */
  26
  27 #include <linux/module.h>
  28
  29 #include <linux/types.h>
  30 #include <linux/errno.h>
  31 #include <linux/kernel.h>
  32 #include <linux/slab.h>
  33 #include <linux/poll.h>
  34 #include <linux/fcntl.h>
  35 #include <linux/init.h>
  36 #include <linux/skbuff.h>
  37 #include <linux/interrupt.h>
  38 #include <linux/notifier.h>
  39 #include <net/sock.h>
  40
  41 #include <asm/system.h>
  42 #include <linux/uaccess.h>
  43 #include <asm/unaligned.h>
  44
  45 #include <net/bluetooth/bluetooth.h>
  46 #include <net/bluetooth/hci_core.h>
  47 #include <net/bluetooth/smp.h>
  48
  49 static void hci_le_connect(struct hci_conn *conn)
  50 {
  51         struct hci_dev *hdev = conn->hdev;
  52         struct hci_cp_le_create_conn cp;
  53
  54         conn->state = BT_CONNECT;
  55         conn->out = 1;
  56         conn->link_mode |= HCI_LM_MASTER;
  57         conn->sec_level = BT_SECURITY_LOW;
  58
  59         memset(&cp, 0, sizeof(cp));
  60         cp.scan_interval = cpu_to_le16(0x0060);
  61         cp.scan_window = cpu_to_le16(0x0030);
  62         bacpy(&cp.peer_addr, &conn->dst);
  63         cp.peer_addr_type = conn->dst_type;
  64         cp.conn_interval_min = cpu_to_le16(0x0028);
  65         cp.conn_interval_max = cpu_to_le16(0x0038);
  66         cp.supervision_timeout = cpu_to_le16(0x002a);
  67         cp.min_ce_len = cpu_to_le16(0x0000);
  68         cp.max_ce_len = cpu_to_le16(0x0000);
  69
  70         hci_send_cmd(hdev, HCI_OP_LE_CREATE_CONN, sizeof(cp), &cp);
  71 }
  72
  73 static void hci_le_connect_cancel(struct hci_conn *conn)
  74 {
  75         hci_send_cmd(conn->hdev, HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL);
  76 }
  77
  78 void hci_acl_connect(struct hci_conn *conn)
  79 {
  80         struct hci_dev *hdev = conn->hdev;
  81         struct inquiry_entry *ie;
  82         struct hci_cp_create_conn cp;
  83
  84         BT_DBG("%p", conn);
  85
  86         conn->state = BT_CONNECT;
  87         conn->out = 1;
  88
  89         conn->link_mode = HCI_LM_MASTER;
  90
  91         conn->attempt++;
  92
  93         conn->link_policy = hdev->link_policy;
  94
  95         memset(&cp, 0, sizeof(cp));
  96         bacpy(&cp.bdaddr, &conn->dst);
  97         cp.pscan_rep_mode = 0x02;
  98
  99         ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
 100         if (ie) {
 101                 if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
 102                         cp.pscan_rep_mode = ie->data.pscan_rep_mode;
 103                         cp.pscan_mode     = ie->data.pscan_mode;
 104                         cp.clock_offset   = ie->data.clock_offset |
 105                                                         cpu_to_le16(0x8000);
 106                 }
 107
 108                 memcpy(conn->dev_class, ie->data.dev_class, 3);
 109                 conn->ssp_mode = ie->data.ssp_mode;
 110         }
 111
 112         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 113         if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
 114                 cp.role_switch = 0x01;
 115         else
 116                 cp.role_switch = 0x00;
 117
 118         hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
 119 }
 120
 121 static void hci_acl_connect_cancel(struct hci_conn *conn)
 122 {
 123         struct hci_cp_create_conn_cancel cp;
 124
 125         BT_DBG("%p", conn);
 126
 127         if (conn->hdev->hci_ver < 2)
 128                 return;
 129
 130         bacpy(&cp.bdaddr, &conn->dst);
 131         hci_send_cmd(conn->hdev, HCI_OP_CREATE_CONN_CANCEL, sizeof(cp), &cp);
 132 }
 133
 134 void hci_acl_disconn(struct hci_conn *conn, __u8 reason)
 135 {
 136         struct hci_cp_disconnect cp;
 137
 138         BT_DBG("%p", conn);
 139
 140         conn->state = BT_DISCONN;
 141
 142         cp.handle = cpu_to_le16(conn->handle);
 143         cp.reason = reason;
 144         hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp);
 145 }
 146
 147 void hci_add_sco(struct hci_conn *conn, __u16 handle)
 148 {
 149         struct hci_dev *hdev = conn->hdev;
 150         struct hci_cp_add_sco cp;
 151
 152         BT_DBG("%p", conn);
 153
 154         conn->state = BT_CONNECT;
 155         conn->out = 1;
 156
 157         conn->attempt++;
 158
 159         cp.handle   = cpu_to_le16(handle);
 160         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 161
 162         hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
 163 }
 164
 165 void hci_setup_sync(struct hci_conn *conn, __u16 handle)
 166 {
 167         struct hci_dev *hdev = conn->hdev;
 168         struct hci_cp_setup_sync_conn cp;
 169
 170         BT_DBG("%p", conn);
 171
 172         conn->state = BT_CONNECT;
 173         conn->out = 1;
 174
 175         conn->attempt++;
 176
 177         cp.handle   = cpu_to_le16(handle);
 178         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 179
 180         cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
 181         cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
 182         cp.max_latency    = cpu_to_le16(0xffff);
 183         cp.voice_setting  = cpu_to_le16(hdev->voice_setting);
 184         cp.retrans_effort = 0xff;
 185
 186         hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp);
 187 }
 188
 189 void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max,
 190                                         u16 latency, u16 to_multiplier)
 191 {
 192         struct hci_cp_le_conn_update cp;
 193         struct hci_dev *hdev = conn->hdev;
 194
 195         memset(&cp, 0, sizeof(cp));
 196
 197         cp.handle               = cpu_to_le16(conn->handle);
 198         cp.conn_interval_min    = cpu_to_le16(min);
 199         cp.conn_interval_max    = cpu_to_le16(max);
 200         cp.conn_latency         = cpu_to_le16(latency);
 201         cp.supervision_timeout  = cpu_to_le16(to_multiplier);
 202         cp.min_ce_len           = cpu_to_le16(0x0001);
 203         cp.max_ce_len           = cpu_to_le16(0x0001);
 204
 205         hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp);
 206 }
 207 EXPORT_SYMBOL(hci_le_conn_update);
 208
 209 void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __u8 rand[8],
 210                                                         __u8 ltk[16])
 211 {
 212         struct hci_dev *hdev = conn->hdev;
 213         struct hci_cp_le_start_enc cp;
 214
 215         BT_DBG("%p", conn);
 216
 217         memset(&cp, 0, sizeof(cp));
 218
 219         cp.handle = cpu_to_le16(conn->handle);
 220         memcpy(cp.ltk, ltk, sizeof(cp.ltk));
 221         cp.ediv = ediv;
 222         memcpy(cp.rand, rand, sizeof(cp.rand));
 223
 224         hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp);
 225 }
 226 EXPORT_SYMBOL(hci_le_start_enc);
 227
 228 void hci_le_ltk_reply(struct hci_conn *conn, u8 ltk[16])
 229 {
 230         struct hci_dev *hdev = conn->hdev;
 231         struct hci_cp_le_ltk_reply cp;
 232
 233         BT_DBG("%p", conn);
 234
 235         memset(&cp, 0, sizeof(cp));
 236
 237         cp.handle = cpu_to_le16(conn->handle);
 238         memcpy(cp.ltk, ltk, sizeof(ltk));
 239
 240         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
 241 }
 242 EXPORT_SYMBOL(hci_le_ltk_reply);
 243
 244 void hci_le_ltk_neg_reply(struct hci_conn *conn)
 245 {
 246         struct hci_dev *hdev = conn->hdev;
 247         struct hci_cp_le_ltk_neg_reply cp;
 248
 249         BT_DBG("%p", conn);
 250
 251         memset(&cp, 0, sizeof(cp));
 252
 253         cp.handle = cpu_to_le16(conn->handle);
 254
 255         hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(cp), &cp);
 256 }
 257
 258 /* Device _must_ be locked */
 259 void hci_sco_setup(struct hci_conn *conn, __u8 status)
 260 {
 261         struct hci_conn *sco = conn->link;
 262
 263         BT_DBG("%p", conn);
 264
 265         if (!sco)
 266                 return;
 267
 268         if (!status) {
 269                 if (lmp_esco_capable(conn->hdev))
 270                         hci_setup_sync(sco, conn->handle);
 271                 else
 272                         hci_add_sco(sco, conn->handle);
 273         } else {
 274                 hci_proto_connect_cfm(sco, status);
 275                 hci_conn_del(sco);
 276         }
 277 }
 278
 279 static void hci_conn_timeout(unsigned long arg)
 280 {
 281         struct hci_conn *conn = (void *) arg;
 282         struct hci_dev *hdev = conn->hdev;
 283         __u8 reason;
 284
 285         BT_DBG("conn %p state %d", conn, conn->state);
 286
 287         if (atomic_read(&conn->refcnt))
 288                 return;
 289
 290         hci_dev_lock(hdev);
 291
 292         switch (conn->state) {
 293         case BT_CONNECT:
 294         case BT_CONNECT2:
 295                 if (conn->out) {
 296                         if (conn->type == ACL_LINK)
 297                                 hci_acl_connect_cancel(conn);
 298                         else if (conn->type == LE_LINK)
 299                                 hci_le_connect_cancel(conn);
 300                 }
 301                 break;
 302         case BT_CONFIG:
 303         case BT_CONNECTED:
 304                 reason = hci_proto_disconn_ind(conn);
 305                 hci_acl_disconn(conn, reason);
 306                 break;
 307         default:
 308                 conn->state = BT_CLOSED;
 309                 break;
 310         }
 311
 312         hci_dev_unlock(hdev);
 313 }
 314
 315 static void hci_conn_idle(unsigned long arg)
 316 {
 317         struct hci_conn *conn = (void *) arg;
 318
 319         BT_DBG("conn %p mode %d", conn, conn->mode);
 320
 321         hci_conn_enter_sniff_mode(conn);
 322 }
 323
 324 static void hci_conn_auto_accept(unsigned long arg)
 325 {
 326         struct hci_conn *conn = (void *) arg;
 327         struct hci_dev *hdev = conn->hdev;
 328
 329         hci_dev_lock(hdev);
 330
 331         hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY, sizeof(conn->dst),
 332                                                                 &conn->dst);
 333
 334         hci_dev_unlock(hdev);
 335 }
 336
 337 struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
 338 {
 339         struct hci_conn *conn;
 340
 341         BT_DBG("%s dst %s", hdev->name, batostr(dst));
 342
 343         conn = kzalloc(sizeof(struct hci_conn), GFP_ATOMIC);
 344         if (!conn)
 345                 return NULL;
 346
 347         bacpy(&conn->dst, dst);
 348         conn->hdev  = hdev;
 349         conn->type  = type;
 350         conn->mode  = HCI_CM_ACTIVE;
 351         conn->state = BT_OPEN;
 352         conn->auth_type = HCI_AT_GENERAL_BONDING;
 353         conn->io_capability = hdev->io_capability;
 354         conn->remote_auth = 0xff;
 355         conn->key_type = 0xff;
 356
 357         conn->power_save = 1;
 358         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
 359
 360         switch (type) {
 361         case ACL_LINK:
 362                 conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
 363                 break;
 364         case SCO_LINK:
 365                 if (lmp_esco_capable(hdev))
 366                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
 367                                         (hdev->esco_type & EDR_ESCO_MASK);
 368                 else
 369                         conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
 370                 break;
 371         case ESCO_LINK:
 372                 conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
 373                 break;
 374         }
 375
 376         skb_queue_head_init(&conn->data_q);
 377
 378         setup_timer(&conn->disc_timer, hci_conn_timeout, (unsigned long)conn);
 379         setup_timer(&conn->idle_timer, hci_conn_idle, (unsigned long)conn);
 380         setup_timer(&conn->auto_accept_timer, hci_conn_auto_accept,
 381                                                         (unsigned long) conn);
 382
 383         atomic_set(&conn->refcnt, 0);
 384
 385         hci_dev_hold(hdev);
 386
 387         tasklet_disable(&hdev->tx_task);
 388
 389         hci_conn_hash_add(hdev, conn);
 390         if (hdev->notify)
 391                 hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
 392
 393         atomic_set(&conn->devref, 0);
 394
 395         hci_conn_init_sysfs(conn);
 396
 397         tasklet_enable(&hdev->tx_task);
 398
 399         return conn;
 400 }
 401
 402 int hci_conn_del(struct hci_conn *conn)
 403 {
 404         struct hci_dev *hdev = conn->hdev;
 405
 406         BT_DBG("%s conn %p handle %d", hdev->name, conn, conn->handle);
 407
 408         del_timer(&conn->idle_timer);
 409
 410         del_timer(&conn->disc_timer);
 411
 412         del_timer(&conn->auto_accept_timer);
 413
 414         if (conn->type == ACL_LINK) {
 415                 struct hci_conn *sco = conn->link;
 416                 if (sco)
 417                         sco->link = NULL;
 418
 419                 /* Unacked frames */
 420                 hdev->acl_cnt += conn->sent;
 421         } else if (conn->type == LE_LINK) {
 422                 if (hdev->le_pkts)
 423                         hdev->le_cnt += conn->sent;
 424                 else
 425                         hdev->acl_cnt += conn->sent;
 426         } else {
 427                 struct hci_conn *acl = conn->link;
 428                 if (acl) {
 429                         acl->link = NULL;
 430                         hci_conn_put(acl);
 431                 }
 432         }
 433
 434         tasklet_disable(&hdev->tx_task);
 435
 436         hci_conn_hash_del(hdev, conn);
 437         if (hdev->notify)
 438                 hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
 439
 440         tasklet_enable(&hdev->tx_task);
 441
 442         skb_queue_purge(&conn->data_q);
 443
 444         hci_conn_put_device(conn);
 445
 446         hci_dev_put(hdev);
 447
 448         if (conn->handle == 0)
 449                 kfree(conn);
 450
 451         return 0;
 452 }
 453
 454 struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src)
 455 {
 456         int use_src = bacmp(src, BDADDR_ANY);
 457         struct hci_dev *hdev = NULL;
 458         struct list_head *p;
 459
 460         BT_DBG("%s -> %s", batostr(src), batostr(dst));
 461
 462         read_lock_bh(&hci_dev_list_lock);
 463
 464         list_for_each(p, &hci_dev_list) {
 465                 struct hci_dev *d = list_entry(p, struct hci_dev, list);
 466
 467                 if (!test_bit(HCI_UP, &d->flags) || test_bit(HCI_RAW, &d->flags))
 468                         continue;
 469
 470                 /* Simple routing:
 471                  *   No source address - find interface with bdaddr != dst
 472                  *   Source address    - find interface with bdaddr == src
 473                  */
 474
 475                 if (use_src) {
 476                         if (!bacmp(&d->bdaddr, src)) {
 477                                 hdev = d; break;
 478                         }
 479                 } else {
 480                         if (bacmp(&d->bdaddr, dst)) {
 481                                 hdev = d; break;
 482                         }
 483                 }
 484         }
 485
 486         if (hdev)
 487                 hdev = hci_dev_hold(hdev);
 488
 489         read_unlock_bh(&hci_dev_list_lock);
 490         return hdev;
 491 }
 492 EXPORT_SYMBOL(hci_get_route);
 493
 494 /* Create SCO, ACL or LE connection.
 495  * Device _must_ be locked */
 496 struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, __u8 sec_level, __u8 auth_type)
 497 {
 498         struct hci_conn *acl;
 499         struct hci_conn *sco;
 500         struct hci_conn *le;
 501
 502         BT_DBG("%s dst %s", hdev->name, batostr(dst));
 503
 504         if (type == LE_LINK) {
 505                 struct adv_entry *entry;
 506
 507                 le = hci_conn_hash_lookup_ba(hdev, LE_LINK, dst);
 508                 if (le)
 509                         return ERR_PTR(-EBUSY);
 510
 511                 entry = hci_find_adv_entry(hdev, dst);
 512                 if (!entry)
 513                         return ERR_PTR(-EHOSTUNREACH);
 514
 515                 le = hci_conn_add(hdev, LE_LINK, dst);
 516                 if (!le)
 517                         return ERR_PTR(-ENOMEM);
 518
 519                 le->dst_type = entry->bdaddr_type;
 520
 521                 hci_le_connect(le);
 522
 523                 hci_conn_hold(le);
 524
 525                 return le;
 526         }
 527
 528         acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
 529         if (!acl) {
 530                 acl = hci_conn_add(hdev, ACL_LINK, dst);
 531                 if (!acl)
 532                         return NULL;
 533         }
 534
 535         hci_conn_hold(acl);
 536
 537         if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
 538                 acl->sec_level = BT_SECURITY_LOW;
 539                 acl->pending_sec_level = sec_level;
 540                 acl->auth_type = auth_type;
 541                 hci_acl_connect(acl);
 542         }
 543
 544         if (type == ACL_LINK)
 545                 return acl;
 546
 547         sco = hci_conn_hash_lookup_ba(hdev, type, dst);
 548         if (!sco) {
 549                 sco = hci_conn_add(hdev, type, dst);
 550                 if (!sco) {
 551                         hci_conn_put(acl);
 552                         return NULL;
 553                 }
 554         }
 555
 556         acl->link = sco;
 557         sco->link = acl;
 558
 559         hci_conn_hold(sco);
 560
 561         if (acl->state == BT_CONNECTED &&
 562                         (sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
 563                 acl->power_save = 1;
 564                 hci_conn_enter_active_mode(acl, BT_POWER_FORCE_ACTIVE_ON);
 565
 566                 if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->pend)) {
 567                         /* defer SCO setup until mode change completed */
 568                         set_bit(HCI_CONN_SCO_SETUP_PEND, &acl->pend);
 569                         return sco;
 570                 }
 571
 572                 hci_sco_setup(acl, 0x00);
 573         }
 574
 575         return sco;
 576 }
 577 EXPORT_SYMBOL(hci_connect);
 578
 579 /* Check link security requirement */
 580 int hci_conn_check_link_mode(struct hci_conn *conn)
 581 {
 582         BT_DBG("conn %p", conn);
 583
 584         if (conn->ssp_mode > 0 && conn->hdev->ssp_mode > 0 &&
 585                                         !(conn->link_mode & HCI_LM_ENCRYPT))
 586                 return 0;
 587
 588         return 1;
 589 }
 590 EXPORT_SYMBOL(hci_conn_check_link_mode);
 591
 592 /* Authenticate remote device */
 593 static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 594 {
 595         BT_DBG("conn %p", conn);
 596
 597         if (conn->pending_sec_level > sec_level)
 598                 sec_level = conn->pending_sec_level;
 599
 600         if (sec_level > conn->sec_level)
 601                 conn->pending_sec_level = sec_level;
 602         else if (conn->link_mode & HCI_LM_AUTH)
 603                 return 1;
 604
 605         /* Make sure we preserve an existing MITM requirement*/
 606         auth_type |= (conn->auth_type & 0x01);
 607
 608         conn->auth_type = auth_type;
 609
 610         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
 611                 struct hci_cp_auth_requested cp;
 612
 613                 cp.handle = cpu_to_le16(conn->handle);
 614                 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
 615                                                         sizeof(cp), &cp);
 616
 617                 /* If we're already encrypted set the REAUTH_PEND flag,
 618                  * otherwise set the ENCRYPT_PEND.
 619                  */
 620                 if (conn->link_mode & HCI_LM_ENCRYPT)
 621                         set_bit(HCI_CONN_REAUTH_PEND, &conn->pend);
 622                 else
 623                         set_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
 624         }
 625
 626         return 0;
 627 }
 628
 629 /* Encrypt the the link */
 630 static void hci_conn_encrypt(struct hci_conn *conn)
 631 {
 632         BT_DBG("conn %p", conn);
 633
 634         if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend)) {
 635                 struct hci_cp_set_conn_encrypt cp;
 636                 cp.handle  = cpu_to_le16(conn->handle);
 637                 cp.encrypt = 0x01;
 638                 hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
 639                                                                         &cp);
 640         }
 641 }
 642
 643 /* Enable security */
 644 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 645 {
 646         BT_DBG("conn %p", conn);
 647
 648 #ifdef CONFIG_BT_L2CAP
 649         if (conn->type == LE_LINK)
 650                 return smp_conn_security(conn, sec_level);
 651 #endif
 652
 653         /* For sdp we don't need the link key. */
 654         if (sec_level == BT_SECURITY_SDP)
 655                 return 1;
 656
 657         /* For non 2.1 devices and low security level we don't need the link
 658            key. */
 659         if (sec_level == BT_SECURITY_LOW &&
 660                                 (!conn->ssp_mode || !conn->hdev->ssp_mode))
 661                 return 1;
 662
 663         /* For other security levels we need the link key. */
 664         if (!(conn->link_mode & HCI_LM_AUTH))
 665                 goto auth;
 666
 667         /* An authenticated combination key has sufficient security for any
 668            security level. */
 669         if (conn->key_type == HCI_LK_AUTH_COMBINATION)
 670                 goto encrypt;
 671
 672         /* An unauthenticated combination key has sufficient security for
 673            security level 1 and 2. */
 674         if (conn->key_type == HCI_LK_UNAUTH_COMBINATION &&
 675                         (sec_level == BT_SECURITY_MEDIUM ||
 676                         sec_level == BT_SECURITY_LOW))
 677                 goto encrypt;
 678
 679         /* A combination key has always sufficient security for the security
 680            levels 1 or 2. High security level requires the combination key
 681            is generated using maximum PIN code length (16).
 682            For pre 2.1 units. */
 683         if (conn->key_type == HCI_LK_COMBINATION &&
 684                         (sec_level != BT_SECURITY_HIGH ||
 685                         conn->pin_length == 16))
 686                 goto encrypt;
 687
 688 auth:
 689         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend))
 690                 return 0;
 691
 692         if (!hci_conn_auth(conn, sec_level, auth_type))
 693                 return 0;
 694
 695 encrypt:
 696         if (conn->link_mode & HCI_LM_ENCRYPT)
 697                 return 1;
 698
 699         hci_conn_encrypt(conn);
 700         return 0;
 701 }
 702 EXPORT_SYMBOL(hci_conn_security);
 703
 704 /* Check secure link requirement */
 705 int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level)
 706 {
 707         BT_DBG("conn %p", conn);
 708
 709         if (sec_level != BT_SECURITY_HIGH)
 710                 return 1; /* Accept if non-secure is required */
 711
 712         if (conn->sec_level == BT_SECURITY_HIGH)
 713                 return 1;
 714
 715         return 0; /* Reject not secure link */
 716 }
 717 EXPORT_SYMBOL(hci_conn_check_secure);
 718
 719 /* Change link key */
 720 int hci_conn_change_link_key(struct hci_conn *conn)
 721 {
 722         BT_DBG("conn %p", conn);
 723
 724         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
 725                 struct hci_cp_change_conn_link_key cp;
 726                 cp.handle = cpu_to_le16(conn->handle);
 727                 hci_send_cmd(conn->hdev, HCI_OP_CHANGE_CONN_LINK_KEY,
 728                                                         sizeof(cp), &cp);
 729         }
 730
 731         return 0;
 732 }
 733 EXPORT_SYMBOL(hci_conn_change_link_key);
 734
 735 /* Switch role */
 736 int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
 737 {
 738         BT_DBG("conn %p", conn);
 739
 740         if (!role && conn->link_mode & HCI_LM_MASTER)
 741                 return 1;
 742
 743         if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->pend)) {
 744                 struct hci_cp_switch_role cp;
 745                 bacpy(&cp.bdaddr, &conn->dst);
 746                 cp.role = role;
 747                 hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
 748         }
 749
 750         return 0;
 751 }
 752 EXPORT_SYMBOL(hci_conn_switch_role);
 753
 754 /* Enter active mode */
 755 void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
 756 {
 757         struct hci_dev *hdev = conn->hdev;
 758
 759         BT_DBG("conn %p mode %d", conn, conn->mode);
 760
 761         if (test_bit(HCI_RAW, &hdev->flags))
 762                 return;
 763
 764         if (conn->mode != HCI_CM_SNIFF)
 765                 goto timer;
 766
 767         if (!conn->power_save && !force_active)
 768                 goto timer;
 769
 770         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
 771                 struct hci_cp_exit_sniff_mode cp;
 772                 cp.handle = cpu_to_le16(conn->handle);
 773                 hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
 774         }
 775
 776 timer:
 777         if (hdev->idle_timeout > 0)
 778                 mod_timer(&conn->idle_timer,
 779                         jiffies + msecs_to_jiffies(hdev->idle_timeout));
 780 }
 781
 782 /* Enter sniff mode */
 783 void hci_conn_enter_sniff_mode(struct hci_conn *conn)
 784 {
 785         struct hci_dev *hdev = conn->hdev;
 786
 787         BT_DBG("conn %p mode %d", conn, conn->mode);
 788
 789         if (test_bit(HCI_RAW, &hdev->flags))
 790                 return;
 791
 792         if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn))
 793                 return;
 794
 795         if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF))
 796                 return;
 797
 798         if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
 799                 struct hci_cp_sniff_subrate cp;
 800                 cp.handle             = cpu_to_le16(conn->handle);
 801                 cp.max_latency        = cpu_to_le16(0);
 802                 cp.min_remote_timeout = cpu_to_le16(0);
 803                 cp.min_local_timeout  = cpu_to_le16(0);
 804                 hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
 805         }
 806
 807         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
 808                 struct hci_cp_sniff_mode cp;
 809                 cp.handle       = cpu_to_le16(conn->handle);
 810                 cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
 811                 cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
 812                 cp.attempt      = cpu_to_le16(4);
 813                 cp.timeout      = cpu_to_le16(1);
 814                 hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
 815         }
 816 }
 817
 818 /* Drop all connection on the device */
 819 void hci_conn_hash_flush(struct hci_dev *hdev)
 820 {
 821         struct hci_conn_hash *h = &hdev->conn_hash;
 822         struct list_head *p;
 823
 824         BT_DBG("hdev %s", hdev->name);
 825
 826         p = h->list.next;
 827         while (p != &h->list) {
 828                 struct hci_conn *c;
 829
 830                 c = list_entry(p, struct hci_conn, list);
 831                 p = p->next;
 832
 833                 c->state = BT_CLOSED;
 834
 835                 hci_proto_disconn_cfm(c, 0x16);
 836                 hci_conn_del(c);
 837         }
 838 }
 839
 840 /* Check pending connect attempts */
 841 void hci_conn_check_pending(struct hci_dev *hdev)
 842 {
 843         struct hci_conn *conn;
 844
 845         BT_DBG("hdev %s", hdev->name);
 846
 847         hci_dev_lock(hdev);
 848
 849         conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
 850         if (conn)
 851                 hci_acl_connect(conn);
 852
 853         hci_dev_unlock(hdev);
 854 }
 855
 856 void hci_conn_hold_device(struct hci_conn *conn)
 857 {
 858         atomic_inc(&conn->devref);
 859 }
 860 EXPORT_SYMBOL(hci_conn_hold_device);
 861
 862 void hci_conn_put_device(struct hci_conn *conn)
 863 {
 864         if (atomic_dec_and_test(&conn->devref))
 865                 hci_conn_del_sysfs(conn);
 866 }
 867 EXPORT_SYMBOL(hci_conn_put_device);
 868
 869 int hci_get_conn_list(void __user *arg)
 870 {
 871         struct hci_conn_list_req req, *cl;
 872         struct hci_conn_info *ci;
 873         struct hci_dev *hdev;
 874         struct list_head *p;
 875         int n = 0, size, err;
 876
 877         if (copy_from_user(&req, arg, sizeof(req)))
 878                 return -EFAULT;
 879
 880         if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
 881                 return -EINVAL;
 882
 883         size = sizeof(req) + req.conn_num * sizeof(*ci);
 884
 885         cl = kmalloc(size, GFP_KERNEL);
 886         if (!cl)
 887                 return -ENOMEM;
 888
 889         hdev = hci_dev_get(req.dev_id);
 890         if (!hdev) {
 891                 kfree(cl);
 892                 return -ENODEV;
 893         }
 894
 895         ci = cl->conn_info;
 896
 897         hci_dev_lock_bh(hdev);
 898         list_for_each(p, &hdev->conn_hash.list) {
 899                 register struct hci_conn *c;
 900                 c = list_entry(p, struct hci_conn, list);
 901
 902                 bacpy(&(ci + n)->bdaddr, &c->dst);
 903                 (ci + n)->handle = c->handle;
 904                 (ci + n)->type  = c->type;
 905                 (ci + n)->out   = c->out;
 906                 (ci + n)->state = c->state;
 907                 (ci + n)->link_mode = c->link_mode;
 908                 if (++n >= req.conn_num)
 909                         break;
 910         }
 911         hci_dev_unlock_bh(hdev);
 912
 913         cl->dev_id = hdev->id;
 914         cl->conn_num = n;
 915         size = sizeof(req) + n * sizeof(*ci);
 916
 917         hci_dev_put(hdev);
 918
 919         err = copy_to_user(arg, cl, size);
 920         kfree(cl);
 921
 922         return err ? -EFAULT : 0;
 923 }
 924
 925 int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
 926 {
 927         struct hci_conn_info_req req;
 928         struct hci_conn_info ci;
 929         struct hci_conn *conn;
 930         char __user *ptr = arg + sizeof(req);
 931
 932         if (copy_from_user(&req, arg, sizeof(req)))
 933                 return -EFAULT;
 934
 935         hci_dev_lock_bh(hdev);
 936         conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
 937         if (conn) {
 938                 bacpy(&ci.bdaddr, &conn->dst);
 939                 ci.handle = conn->handle;
 940                 ci.type  = conn->type;
 941                 ci.out   = conn->out;
 942                 ci.state = conn->state;
 943                 ci.link_mode = conn->link_mode;
 944         }
 945         hci_dev_unlock_bh(hdev);
 946
 947         if (!conn)
 948                 return -ENOENT;
 949
 950         return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
 951 }
 952
 953 int hci_get_auth_info(struct hci_dev *hdev, void __user *arg)
 954 {
 955         struct hci_auth_info_req req;
 956         struct hci_conn *conn;
 957
 958         if (copy_from_user(&req, arg, sizeof(req)))
 959                 return -EFAULT;
 960
 961         hci_dev_lock_bh(hdev);
 962         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr);
 963         if (conn)
 964                 req.type = conn->auth_type;
 965         hci_dev_unlock_bh(hdev);
 966
 967         if (!conn)
 968                 return -ENOENT;
 969
 970         return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0;
 971 }