net/bluetooth/hci_conn.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI connection handling. */
  26
  27 #include <linux/module.h>
  28
  29 #include <linux/types.h>
  30 #include <linux/errno.h>
  31 #include <linux/kernel.h>
  32 #include <linux/slab.h>
  33 #include <linux/poll.h>
  34 #include <linux/fcntl.h>
  35 #include <linux/init.h>
  36 #include <linux/skbuff.h>
  37 #include <linux/interrupt.h>
  38 #include <linux/notifier.h>
  39 #include <net/sock.h>
  40
  41 #include <asm/system.h>
  42 #include <linux/uaccess.h>
  43 #include <asm/unaligned.h>
  44
  45 #include <net/bluetooth/bluetooth.h>
  46 #include <net/bluetooth/hci_core.h>
  47 #include <net/bluetooth/smp.h>
  48
  49 static void hci_le_connect(struct hci_conn *conn)
  50 {
  51         struct hci_dev *hdev = conn->hdev;
  52         struct hci_cp_le_create_conn cp;
  53
  54         conn->state = BT_CONNECT;
  55         conn->out = 1;
  56         conn->link_mode |= HCI_LM_MASTER;
  57         conn->sec_level = BT_SECURITY_LOW;
  58
  59         memset(&cp, 0, sizeof(cp));
  60         cp.scan_interval = cpu_to_le16(0x0060);
  61         cp.scan_window = cpu_to_le16(0x0030);
  62         bacpy(&cp.peer_addr, &conn->dst);
  63         cp.peer_addr_type = conn->dst_type;
  64         cp.conn_interval_min = cpu_to_le16(0x0028);
  65         cp.conn_interval_max = cpu_to_le16(0x0038);
  66         cp.supervision_timeout = cpu_to_le16(0x002a);
  67         cp.min_ce_len = cpu_to_le16(0x0000);
  68         cp.max_ce_len = cpu_to_le16(0x0000);
  69
  70         hci_send_cmd(hdev, HCI_OP_LE_CREATE_CONN, sizeof(cp), &cp);
  71 }
  72
  73 static void hci_le_connect_cancel(struct hci_conn *conn)
  74 {
  75         hci_send_cmd(conn->hdev, HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL);
  76 }
  77
  78 void hci_acl_connect(struct hci_conn *conn)
  79 {
  80         struct hci_dev *hdev = conn->hdev;
  81         struct inquiry_entry *ie;
  82         struct hci_cp_create_conn cp;
  83
  84         BT_DBG("%p", conn);
  85
  86         conn->state = BT_CONNECT;
  87         conn->out = 1;
  88
  89         conn->link_mode = HCI_LM_MASTER;
  90
  91         conn->attempt++;
  92
  93         conn->link_policy = hdev->link_policy;
  94
  95         memset(&cp, 0, sizeof(cp));
  96         bacpy(&cp.bdaddr, &conn->dst);
  97         cp.pscan_rep_mode = 0x02;
  98
  99         ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
 100         if (ie) {
 101                 if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
 102                         cp.pscan_rep_mode = ie->data.pscan_rep_mode;
 103                         cp.pscan_mode     = ie->data.pscan_mode;
 104                         cp.clock_offset   = ie->data.clock_offset |
 105                                                         cpu_to_le16(0x8000);
 106                 }
 107
 108                 memcpy(conn->dev_class, ie->data.dev_class, 3);
 109                 conn->ssp_mode = ie->data.ssp_mode;
 110         }
 111
 112         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 113         if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
 114                 cp.role_switch = 0x01;
 115         else
 116                 cp.role_switch = 0x00;
 117
 118         hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
 119 }
 120
 121 static void hci_acl_connect_cancel(struct hci_conn *conn)
 122 {
 123         struct hci_cp_create_conn_cancel cp;
 124
 125         BT_DBG("%p", conn);
 126
 127         if (conn->hdev->hci_ver < 2)
 128                 return;
 129
 130         bacpy(&cp.bdaddr, &conn->dst);
 131         hci_send_cmd(conn->hdev, HCI_OP_CREATE_CONN_CANCEL, sizeof(cp), &cp);
 132 }
 133
 134 void hci_acl_disconn(struct hci_conn *conn, __u8 reason)
 135 {
 136         struct hci_cp_disconnect cp;
 137
 138         BT_DBG("%p", conn);
 139
 140         conn->state = BT_DISCONN;
 141
 142         cp.handle = cpu_to_le16(conn->handle);
 143         cp.reason = reason;
 144         hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp);
 145 }
 146
 147 void hci_add_sco(struct hci_conn *conn, __u16 handle)
 148 {
 149         struct hci_dev *hdev = conn->hdev;
 150         struct hci_cp_add_sco cp;
 151
 152         BT_DBG("%p", conn);
 153
 154         conn->state = BT_CONNECT;
 155         conn->out = 1;
 156
 157         conn->attempt++;
 158
 159         cp.handle   = cpu_to_le16(handle);
 160         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 161
 162         hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
 163 }
 164
 165 void hci_setup_sync(struct hci_conn *conn, __u16 handle)
 166 {
 167         struct hci_dev *hdev = conn->hdev;
 168         struct hci_cp_setup_sync_conn cp;
 169
 170         BT_DBG("%p", conn);
 171
 172         conn->state = BT_CONNECT;
 173         conn->out = 1;
 174
 175         conn->attempt++;
 176
 177         cp.handle   = cpu_to_le16(handle);
 178         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 179
 180         cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
 181         cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
 182         cp.max_latency    = cpu_to_le16(0xffff);
 183         cp.voice_setting  = cpu_to_le16(hdev->voice_setting);
 184         cp.retrans_effort = 0xff;
 185
 186         hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp);
 187 }
 188
 189 void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max,
 190                                         u16 latency, u16 to_multiplier)
 191 {
 192         struct hci_cp_le_conn_update cp;
 193         struct hci_dev *hdev = conn->hdev;
 194
 195         memset(&cp, 0, sizeof(cp));
 196
 197         cp.handle               = cpu_to_le16(conn->handle);
 198         cp.conn_interval_min    = cpu_to_le16(min);
 199         cp.conn_interval_max    = cpu_to_le16(max);
 200         cp.conn_latency         = cpu_to_le16(latency);
 201         cp.supervision_timeout  = cpu_to_le16(to_multiplier);
 202         cp.min_ce_len           = cpu_to_le16(0x0001);
 203         cp.max_ce_len           = cpu_to_le16(0x0001);
 204
 205         hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp);
 206 }
 207 EXPORT_SYMBOL(hci_le_conn_update);
 208
 209 void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __u8 rand[8],
 210                                                         __u8 ltk[16])
 211 {
 212         struct hci_dev *hdev = conn->hdev;
 213         struct hci_cp_le_start_enc cp;
 214
 215         BT_DBG("%p", conn);
 216
 217         memset(&cp, 0, sizeof(cp));
 218
 219         cp.handle = cpu_to_le16(conn->handle);
 220         memcpy(cp.ltk, ltk, sizeof(cp.ltk));
 221         cp.ediv = ediv;
 222         memcpy(cp.rand, rand, sizeof(cp.rand));
 223
 224         hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp);
 225 }
 226 EXPORT_SYMBOL(hci_le_start_enc);
 227
 228 void hci_le_ltk_reply(struct hci_conn *conn, u8 ltk[16])
 229 {
 230         struct hci_dev *hdev = conn->hdev;
 231         struct hci_cp_le_ltk_reply cp;
 232
 233         BT_DBG("%p", conn);
 234
 235         memset(&cp, 0, sizeof(cp));
 236
 237         cp.handle = cpu_to_le16(conn->handle);
 238         memcpy(cp.ltk, ltk, sizeof(ltk));
 239
 240         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
 241 }
 242 EXPORT_SYMBOL(hci_le_ltk_reply);
 243
 244 void hci_le_ltk_neg_reply(struct hci_conn *conn)
 245 {
 246         struct hci_dev *hdev = conn->hdev;
 247         struct hci_cp_le_ltk_neg_reply cp;
 248
 249         BT_DBG("%p", conn);
 250
 251         memset(&cp, 0, sizeof(cp));
 252
 253         cp.handle = cpu_to_le16(conn->handle);
 254
 255         hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(cp), &cp);
 256 }
 257
 258 /* Device _must_ be locked */
 259 void hci_sco_setup(struct hci_conn *conn, __u8 status)
 260 {
 261         struct hci_conn *sco = conn->link;
 262
 263         BT_DBG("%p", conn);
 264
 265         if (!sco)
 266                 return;
 267
 268         if (!status) {
 269                 if (lmp_esco_capable(conn->hdev))
 270                         hci_setup_sync(sco, conn->handle);
 271                 else
 272                         hci_add_sco(sco, conn->handle);
 273         } else {
 274                 hci_proto_connect_cfm(sco, status);
 275                 hci_conn_del(sco);
 276         }
 277 }
 278
 279 static void hci_conn_timeout(unsigned long arg)
 280 {
 281         struct hci_conn *conn = (void *) arg;
 282         struct hci_dev *hdev = conn->hdev;
 283         __u8 reason;
 284
 285         BT_DBG("conn %p state %d", conn, conn->state);
 286
 287         if (atomic_read(&conn->refcnt))
 288                 return;
 289
 290         hci_dev_lock(hdev);
 291
 292         switch (conn->state) {
 293         case BT_CONNECT:
 294         case BT_CONNECT2:
 295                 if (conn->out) {
 296                         if (conn->type == ACL_LINK)
 297                                 hci_acl_connect_cancel(conn);
 298                         else if (conn->type == LE_LINK)
 299                                 hci_le_connect_cancel(conn);
 300                 }
 301                 break;
 302         case BT_CONFIG:
 303         case BT_CONNECTED:
 304                 reason = hci_proto_disconn_ind(conn);
 305                 hci_acl_disconn(conn, reason);
 306                 break;
 307         default:
 308                 conn->state = BT_CLOSED;
 309                 break;
 310         }
 311
 312         hci_dev_unlock(hdev);
 313 }
 314
 315 static void hci_conn_idle(unsigned long arg)
 316 {
 317         struct hci_conn *conn = (void *) arg;
 318
 319         BT_DBG("conn %p mode %d", conn, conn->mode);
 320
 321         hci_conn_enter_sniff_mode(conn);
 322 }
 323
 324 static void hci_conn_auto_accept(unsigned long arg)
 325 {
 326         struct hci_conn *conn = (void *) arg;
 327         struct hci_dev *hdev = conn->hdev;
 328
 329         hci_dev_lock(hdev);
 330
 331         hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY, sizeof(conn->dst),
 332                                                                 &conn->dst);
 333
 334         hci_dev_unlock(hdev);
 335 }
 336
 337 struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
 338 {
 339         struct hci_conn *conn;
 340
 341         BT_DBG("%s dst %s", hdev->name, batostr(dst));
 342
 343         conn = kzalloc(sizeof(struct hci_conn), GFP_ATOMIC);
 344         if (!conn)
 345                 return NULL;
 346
 347         bacpy(&conn->dst, dst);
 348         conn->hdev  = hdev;
 349         conn->type  = type;
 350         conn->mode  = HCI_CM_ACTIVE;
 351         conn->state = BT_OPEN;
 352         conn->auth_type = HCI_AT_GENERAL_BONDING;
 353         conn->io_capability = hdev->io_capability;
 354         conn->remote_auth = 0xff;
 355         conn->key_type = 0xff;
 356
 357         conn->power_save = 1;
 358         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
 359
 360         switch (type) {
 361         case ACL_LINK:
 362                 conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
 363                 break;
 364         case SCO_LINK:
 365                 if (lmp_esco_capable(hdev))
 366                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
 367                                         (hdev->esco_type & EDR_ESCO_MASK);
 368                 else
 369                         conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
 370                 break;
 371         case ESCO_LINK:
 372                 conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
 373                 break;
 374         }
 375
 376         skb_queue_head_init(&conn->data_q);
 377
 378         setup_timer(&conn->disc_timer, hci_conn_timeout, (unsigned long)conn);
 379         setup_timer(&conn->idle_timer, hci_conn_idle, (unsigned long)conn);
 380         setup_timer(&conn->auto_accept_timer, hci_conn_auto_accept,
 381                                                         (unsigned long) conn);
 382
 383         atomic_set(&conn->refcnt, 0);
 384
 385         hci_dev_hold(hdev);
 386
 387         tasklet_disable(&hdev->tx_task);
 388
 389         hci_conn_hash_add(hdev, conn);
 390         if (hdev->notify)
 391                 hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
 392
 393         atomic_set(&conn->devref, 0);
 394
 395         hci_conn_init_sysfs(conn);
 396
 397         tasklet_enable(&hdev->tx_task);
 398
 399         return conn;
 400 }
 401
 402 int hci_conn_del(struct hci_conn *conn)
 403 {
 404         struct hci_dev *hdev = conn->hdev;
 405
 406         BT_DBG("%s conn %p handle %d", hdev->name, conn, conn->handle);
 407
 408         del_timer(&conn->idle_timer);
 409
 410         del_timer(&conn->disc_timer);
 411
 412         del_timer(&conn->auto_accept_timer);
 413
 414         if (conn->type == ACL_LINK) {
 415                 struct hci_conn *sco = conn->link;
 416                 if (sco)
 417                         sco->link = NULL;
 418
 419                 /* Unacked frames */
 420                 hdev->acl_cnt += conn->sent;
 421         } else if (conn->type == LE_LINK) {
 422                 if (hdev->le_pkts)
 423                         hdev->le_cnt += conn->sent;
 424                 else
 425                         hdev->acl_cnt += conn->sent;
 426         } else {
 427                 struct hci_conn *acl = conn->link;
 428                 if (acl) {
 429                         acl->link = NULL;
 430                         hci_conn_put(acl);
 431                 }
 432         }
 433
 434         tasklet_disable(&hdev->tx_task);
 435
 436         hci_conn_hash_del(hdev, conn);
 437         if (hdev->notify)
 438                 hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
 439
 440         tasklet_enable(&hdev->tx_task);
 441
 442         skb_queue_purge(&conn->data_q);
 443
 444         hci_conn_put_device(conn);
 445
 446         hci_dev_put(hdev);
 447
 448         if (conn->handle == 0)
 449                 kfree(conn);
 450
 451         return 0;
 452 }
 453
 454 struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src)
 455 {
 456         int use_src = bacmp(src, BDADDR_ANY);
 457         struct hci_dev *hdev = NULL;
 458         struct list_head *p;
 459
 460         BT_DBG("%s -> %s", batostr(src), batostr(dst));
 461
 462         read_lock_bh(&hci_dev_list_lock);
 463
 464         list_for_each(p, &hci_dev_list) {
 465                 struct hci_dev *d = list_entry(p, struct hci_dev, list);
 466
 467                 if (!test_bit(HCI_UP, &d->flags) || test_bit(HCI_RAW, &d->flags))
 468                         continue;
 469
 470                 /* Simple routing:
 471                  *   No source address - find interface with bdaddr != dst
 472                  *   Source address    - find interface with bdaddr == src
 473                  */
 474
 475                 if (use_src) {
 476                         if (!bacmp(&d->bdaddr, src)) {
 477                                 hdev = d; break;
 478                         }
 479                 } else {
 480                         if (bacmp(&d->bdaddr, dst)) {
 481                                 hdev = d; break;
 482                         }
 483                 }
 484         }
 485
 486         if (hdev)
 487                 hdev = hci_dev_hold(hdev);
 488
 489         read_unlock_bh(&hci_dev_list_lock);
 490         return hdev;
 491 }
 492 EXPORT_SYMBOL(hci_get_route);
 493
 494 /* Create SCO, ACL or LE connection.
 495  * Device _must_ be locked */
 496 struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, __u8 sec_level, __u8 auth_type)
 497 {
 498         struct hci_conn *acl;
 499         struct hci_conn *sco;
 500         struct hci_conn *le;
 501
 502         BT_DBG("%s dst %s", hdev->name, batostr(dst));
 503
 504         if (type == LE_LINK) {
 505                 struct adv_entry *entry;
 506
 507                 le = hci_conn_hash_lookup_ba(hdev, LE_LINK, dst);
 508                 if (le)
 509                         return ERR_PTR(-EBUSY);
 510
 511                 entry = hci_find_adv_entry(hdev, dst);
 512                 if (!entry)
 513                         return ERR_PTR(-EHOSTUNREACH);
 514
 515                 le = hci_conn_add(hdev, LE_LINK, dst);
 516                 if (!le)
 517                         return ERR_PTR(-ENOMEM);
 518
 519                 le->dst_type = entry->bdaddr_type;
 520
 521                 hci_le_connect(le);
 522
 523                 hci_conn_hold(le);
 524
 525                 return le;
 526         }
 527
 528         acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
 529         if (!acl) {
 530                 acl = hci_conn_add(hdev, ACL_LINK, dst);
 531                 if (!acl)
 532                         return NULL;
 533         }
 534
 535         hci_conn_hold(acl);
 536
 537         if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
 538                 acl->sec_level = BT_SECURITY_LOW;
 539                 acl->pending_sec_level = sec_level;
 540                 acl->auth_type = auth_type;
 541                 hci_acl_connect(acl);
 542         }
 543
 544         if (type == ACL_LINK)
 545                 return acl;
 546
 547         sco = hci_conn_hash_lookup_ba(hdev, type, dst);
 548         if (!sco) {
 549                 sco = hci_conn_add(hdev, type, dst);
 550                 if (!sco) {
 551                         hci_conn_put(acl);
 552                         return NULL;
 553                 }
 554         }
 555
 556         acl->link = sco;
 557         sco->link = acl;
 558
 559         hci_conn_hold(sco);
 560
 561         if (acl->state == BT_CONNECTED &&
 562                         (sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
 563                 acl->power_save = 1;
 564                 hci_conn_enter_active_mode(acl, BT_POWER_FORCE_ACTIVE_ON);
 565
 566                 if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->pend)) {
 567                         /* defer SCO setup until mode change completed */
 568                         set_bit(HCI_CONN_SCO_SETUP_PEND, &acl->pend);
 569                         return sco;
 570                 }
 571
 572                 hci_sco_setup(acl, 0x00);
 573         }
 574
 575         return sco;
 576 }
 577 EXPORT_SYMBOL(hci_connect);
 578
 579 /* Check link security requirement */
 580 int hci_conn_check_link_mode(struct hci_conn *conn)
 581 {
 582         BT_DBG("conn %p", conn);
 583
 584         if (conn->ssp_mode > 0 && conn->hdev->ssp_mode > 0 &&
 585                                         !(conn->link_mode & HCI_LM_ENCRYPT))
 586                 return 0;
 587
 588         return 1;
 589 }
 590 EXPORT_SYMBOL(hci_conn_check_link_mode);
 591
 592 /* Authenticate remote device */
 593 static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 594 {
 595         BT_DBG("conn %p", conn);
 596
 597         if (conn->pending_sec_level > sec_level)
 598                 sec_level = conn->pending_sec_level;
 599
 600         if (sec_level > conn->sec_level)
 601                 conn->pending_sec_level = sec_level;
 602         else if (conn->link_mode & HCI_LM_AUTH)
 603                 return 1;
 604
 605         /* Make sure we preserve an existing MITM requirement*/
 606         auth_type |= (conn->auth_type & 0x01);
 607
 608         conn->auth_type = auth_type;
 609
 610         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
 611                 struct hci_cp_auth_requested cp;
 612
 613                 /* encrypt must be pending if auth is also pending */
 614                 set_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
 615
 616                 cp.handle = cpu_to_le16(conn->handle);
 617                 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
 618                                                         sizeof(cp), &cp);
 619                 if (conn->key_type != 0xff)
 620                         set_bit(HCI_CONN_REAUTH_PEND, &conn->pend);
 621         }
 622
 623         return 0;
 624 }
 625
 626 /* Encrypt the the link */
 627 static void hci_conn_encrypt(struct hci_conn *conn)
 628 {
 629         BT_DBG("conn %p", conn);
 630
 631         if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend)) {
 632                 struct hci_cp_set_conn_encrypt cp;
 633                 cp.handle  = cpu_to_le16(conn->handle);
 634                 cp.encrypt = 0x01;
 635                 hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
 636                                                                         &cp);
 637         }
 638 }
 639
 640 /* Enable security */
 641 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 642 {
 643         BT_DBG("conn %p", conn);
 644
 645 #ifdef CONFIG_BT_L2CAP
 646         if (conn->type == LE_LINK)
 647                 return smp_conn_security(conn, sec_level);
 648 #endif
 649
 650         /* For sdp we don't need the link key. */
 651         if (sec_level == BT_SECURITY_SDP)
 652                 return 1;
 653
 654         /* For non 2.1 devices and low security level we don't need the link
 655            key. */
 656         if (sec_level == BT_SECURITY_LOW &&
 657                                 (!conn->ssp_mode || !conn->hdev->ssp_mode))
 658                 return 1;
 659
 660         /* For other security levels we need the link key. */
 661         if (!(conn->link_mode & HCI_LM_AUTH))
 662                 goto auth;
 663
 664         /* An authenticated combination key has sufficient security for any
 665            security level. */
 666         if (conn->key_type == HCI_LK_AUTH_COMBINATION)
 667                 goto encrypt;
 668
 669         /* An unauthenticated combination key has sufficient security for
 670            security level 1 and 2. */
 671         if (conn->key_type == HCI_LK_UNAUTH_COMBINATION &&
 672                         (sec_level == BT_SECURITY_MEDIUM ||
 673                         sec_level == BT_SECURITY_LOW))
 674                 goto encrypt;
 675
 676         /* A combination key has always sufficient security for the security
 677            levels 1 or 2. High security level requires the combination key
 678            is generated using maximum PIN code length (16).
 679            For pre 2.1 units. */
 680         if (conn->key_type == HCI_LK_COMBINATION &&
 681                         (sec_level != BT_SECURITY_HIGH ||
 682                         conn->pin_length == 16))
 683                 goto encrypt;
 684
 685 auth:
 686         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend))
 687                 return 0;
 688
 689         if (!hci_conn_auth(conn, sec_level, auth_type))
 690                 return 0;
 691
 692 encrypt:
 693         if (conn->link_mode & HCI_LM_ENCRYPT)
 694                 return 1;
 695
 696         hci_conn_encrypt(conn);
 697         return 0;
 698 }
 699 EXPORT_SYMBOL(hci_conn_security);
 700
 701 /* Check secure link requirement */
 702 int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level)
 703 {
 704         BT_DBG("conn %p", conn);
 705
 706         if (sec_level != BT_SECURITY_HIGH)
 707                 return 1; /* Accept if non-secure is required */
 708
 709         if (conn->sec_level == BT_SECURITY_HIGH)
 710                 return 1;
 711
 712         return 0; /* Reject not secure link */
 713 }
 714 EXPORT_SYMBOL(hci_conn_check_secure);
 715
 716 /* Change link key */
 717 int hci_conn_change_link_key(struct hci_conn *conn)
 718 {
 719         BT_DBG("conn %p", conn);
 720
 721         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
 722                 struct hci_cp_change_conn_link_key cp;
 723                 cp.handle = cpu_to_le16(conn->handle);
 724                 hci_send_cmd(conn->hdev, HCI_OP_CHANGE_CONN_LINK_KEY,
 725                                                         sizeof(cp), &cp);
 726         }
 727
 728         return 0;
 729 }
 730 EXPORT_SYMBOL(hci_conn_change_link_key);
 731
 732 /* Switch role */
 733 int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
 734 {
 735         BT_DBG("conn %p", conn);
 736
 737         if (!role && conn->link_mode & HCI_LM_MASTER)
 738                 return 1;
 739
 740         if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->pend)) {
 741                 struct hci_cp_switch_role cp;
 742                 bacpy(&cp.bdaddr, &conn->dst);
 743                 cp.role = role;
 744                 hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
 745         }
 746
 747         return 0;
 748 }
 749 EXPORT_SYMBOL(hci_conn_switch_role);
 750
 751 /* Enter active mode */
 752 void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
 753 {
 754         struct hci_dev *hdev = conn->hdev;
 755
 756         BT_DBG("conn %p mode %d", conn, conn->mode);
 757
 758         if (test_bit(HCI_RAW, &hdev->flags))
 759                 return;
 760
 761         if (conn->mode != HCI_CM_SNIFF)
 762                 goto timer;
 763
 764         if (!conn->power_save && !force_active)
 765                 goto timer;
 766
 767         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
 768                 struct hci_cp_exit_sniff_mode cp;
 769                 cp.handle = cpu_to_le16(conn->handle);
 770                 hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
 771         }
 772
 773 timer:
 774         if (hdev->idle_timeout > 0)
 775                 mod_timer(&conn->idle_timer,
 776                         jiffies + msecs_to_jiffies(hdev->idle_timeout));
 777 }
 778
 779 /* Enter sniff mode */
 780 void hci_conn_enter_sniff_mode(struct hci_conn *conn)
 781 {
 782         struct hci_dev *hdev = conn->hdev;
 783
 784         BT_DBG("conn %p mode %d", conn, conn->mode);
 785
 786         if (test_bit(HCI_RAW, &hdev->flags))
 787                 return;
 788
 789         if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn))
 790                 return;
 791
 792         if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF))
 793                 return;
 794
 795         if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
 796                 struct hci_cp_sniff_subrate cp;
 797                 cp.handle             = cpu_to_le16(conn->handle);
 798                 cp.max_latency        = cpu_to_le16(0);
 799                 cp.min_remote_timeout = cpu_to_le16(0);
 800                 cp.min_local_timeout  = cpu_to_le16(0);
 801                 hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
 802         }
 803
 804         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
 805                 struct hci_cp_sniff_mode cp;
 806                 cp.handle       = cpu_to_le16(conn->handle);
 807                 cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
 808                 cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
 809                 cp.attempt      = cpu_to_le16(4);
 810                 cp.timeout      = cpu_to_le16(1);
 811                 hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
 812         }
 813 }
 814
 815 /* Drop all connection on the device */
 816 void hci_conn_hash_flush(struct hci_dev *hdev)
 817 {
 818         struct hci_conn_hash *h = &hdev->conn_hash;
 819         struct list_head *p;
 820
 821         BT_DBG("hdev %s", hdev->name);
 822
 823         p = h->list.next;
 824         while (p != &h->list) {
 825                 struct hci_conn *c;
 826
 827                 c = list_entry(p, struct hci_conn, list);
 828                 p = p->next;
 829
 830                 c->state = BT_CLOSED;
 831
 832                 hci_proto_disconn_cfm(c, 0x16);
 833                 hci_conn_del(c);
 834         }
 835 }
 836
 837 /* Check pending connect attempts */
 838 void hci_conn_check_pending(struct hci_dev *hdev)
 839 {
 840         struct hci_conn *conn;
 841
 842         BT_DBG("hdev %s", hdev->name);
 843
 844         hci_dev_lock(hdev);
 845
 846         conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
 847         if (conn)
 848                 hci_acl_connect(conn);
 849
 850         hci_dev_unlock(hdev);
 851 }
 852
 853 void hci_conn_hold_device(struct hci_conn *conn)
 854 {
 855         atomic_inc(&conn->devref);
 856 }
 857 EXPORT_SYMBOL(hci_conn_hold_device);
 858
 859 void hci_conn_put_device(struct hci_conn *conn)
 860 {
 861         if (atomic_dec_and_test(&conn->devref))
 862                 hci_conn_del_sysfs(conn);
 863 }
 864 EXPORT_SYMBOL(hci_conn_put_device);
 865
 866 int hci_get_conn_list(void __user *arg)
 867 {
 868         struct hci_conn_list_req req, *cl;
 869         struct hci_conn_info *ci;
 870         struct hci_dev *hdev;
 871         struct list_head *p;
 872         int n = 0, size, err;
 873
 874         if (copy_from_user(&req, arg, sizeof(req)))
 875                 return -EFAULT;
 876
 877         if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
 878                 return -EINVAL;
 879
 880         size = sizeof(req) + req.conn_num * sizeof(*ci);
 881
 882         cl = kmalloc(size, GFP_KERNEL);
 883         if (!cl)
 884                 return -ENOMEM;
 885
 886         hdev = hci_dev_get(req.dev_id);
 887         if (!hdev) {
 888                 kfree(cl);
 889                 return -ENODEV;
 890         }
 891
 892         ci = cl->conn_info;
 893
 894         hci_dev_lock_bh(hdev);
 895         list_for_each(p, &hdev->conn_hash.list) {
 896                 register struct hci_conn *c;
 897                 c = list_entry(p, struct hci_conn, list);
 898
 899                 bacpy(&(ci + n)->bdaddr, &c->dst);
 900                 (ci + n)->handle = c->handle;
 901                 (ci + n)->type  = c->type;
 902                 (ci + n)->out   = c->out;
 903                 (ci + n)->state = c->state;
 904                 (ci + n)->link_mode = c->link_mode;
 905                 if (++n >= req.conn_num)
 906                         break;
 907         }
 908         hci_dev_unlock_bh(hdev);
 909
 910         cl->dev_id = hdev->id;
 911         cl->conn_num = n;
 912         size = sizeof(req) + n * sizeof(*ci);
 913
 914         hci_dev_put(hdev);
 915
 916         err = copy_to_user(arg, cl, size);
 917         kfree(cl);
 918
 919         return err ? -EFAULT : 0;
 920 }
 921
 922 int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
 923 {
 924         struct hci_conn_info_req req;
 925         struct hci_conn_info ci;
 926         struct hci_conn *conn;
 927         char __user *ptr = arg + sizeof(req);
 928
 929         if (copy_from_user(&req, arg, sizeof(req)))
 930                 return -EFAULT;
 931
 932         hci_dev_lock_bh(hdev);
 933         conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
 934         if (conn) {
 935                 bacpy(&ci.bdaddr, &conn->dst);
 936                 ci.handle = conn->handle;
 937                 ci.type  = conn->type;
 938                 ci.out   = conn->out;
 939                 ci.state = conn->state;
 940                 ci.link_mode = conn->link_mode;
 941         }
 942         hci_dev_unlock_bh(hdev);
 943
 944         if (!conn)
 945                 return -ENOENT;
 946
 947         return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
 948 }
 949
 950 int hci_get_auth_info(struct hci_dev *hdev, void __user *arg)
 951 {
 952         struct hci_auth_info_req req;
 953         struct hci_conn *conn;
 954
 955         if (copy_from_user(&req, arg, sizeof(req)))
 956                 return -EFAULT;
 957
 958         hci_dev_lock_bh(hdev);
 959         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr);
 960         if (conn)
 961                 req.type = conn->auth_type;
 962         hci_dev_unlock_bh(hdev);
 963
 964         if (!conn)
 965                 return -ENOENT;
 966
 967         return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0;
 968 }