net/bluetooth/hci_conn.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI connection handling. */
  26
  27 #include <linux/module.h>
  28
  29 #include <linux/types.h>
  30 #include <linux/errno.h>
  31 #include <linux/kernel.h>
  32 #include <linux/slab.h>
  33 #include <linux/poll.h>
  34 #include <linux/fcntl.h>
  35 #include <linux/init.h>
  36 #include <linux/skbuff.h>
  37 #include <linux/interrupt.h>
  38 #include <linux/notifier.h>
  39 #include <net/sock.h>
  40
  41 #include <asm/system.h>
  42 #include <linux/uaccess.h>
  43 #include <asm/unaligned.h>
  44
  45 #include <net/bluetooth/bluetooth.h>
  46 #include <net/bluetooth/hci_core.h>
  47 #include <net/bluetooth/smp.h>
  48
  49 static void hci_le_connect(struct hci_conn *conn)
  50 {
  51         struct hci_dev *hdev = conn->hdev;
  52         struct hci_cp_le_create_conn cp;
  53
  54         conn->state = BT_CONNECT;
  55         conn->out = 1;
  56         conn->link_mode |= HCI_LM_MASTER;
  57         conn->sec_level = BT_SECURITY_LOW;
  58
  59         memset(&cp, 0, sizeof(cp));
  60         cp.scan_interval = cpu_to_le16(0x0060);
  61         cp.scan_window = cpu_to_le16(0x0030);
  62         bacpy(&cp.peer_addr, &conn->dst);
  63         cp.peer_addr_type = conn->dst_type;
  64         cp.conn_interval_min = cpu_to_le16(0x0028);
  65         cp.conn_interval_max = cpu_to_le16(0x0038);
  66         cp.supervision_timeout = cpu_to_le16(0x002a);
  67         cp.min_ce_len = cpu_to_le16(0x0000);
  68         cp.max_ce_len = cpu_to_le16(0x0000);
  69
  70         hci_send_cmd(hdev, HCI_OP_LE_CREATE_CONN, sizeof(cp), &cp);
  71 }
  72
  73 static void hci_le_connect_cancel(struct hci_conn *conn)
  74 {
  75         hci_send_cmd(conn->hdev, HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL);
  76 }
  77
  78 void hci_acl_connect(struct hci_conn *conn)
  79 {
  80         struct hci_dev *hdev = conn->hdev;
  81         struct inquiry_entry *ie;
  82         struct hci_cp_create_conn cp;
  83
  84         BT_DBG("%p", conn);
  85
  86         conn->state = BT_CONNECT;
  87         conn->out = 1;
  88
  89         conn->link_mode = HCI_LM_MASTER;
  90
  91         conn->attempt++;
  92
  93         conn->link_policy = hdev->link_policy;
  94
  95         memset(&cp, 0, sizeof(cp));
  96         bacpy(&cp.bdaddr, &conn->dst);
  97         cp.pscan_rep_mode = 0x02;
  98
  99         ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
 100         if (ie) {
 101                 if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
 102                         cp.pscan_rep_mode = ie->data.pscan_rep_mode;
 103                         cp.pscan_mode     = ie->data.pscan_mode;
 104                         cp.clock_offset   = ie->data.clock_offset |
 105                                                         cpu_to_le16(0x8000);
 106                 }
 107
 108                 memcpy(conn->dev_class, ie->data.dev_class, 3);
 109                 conn->ssp_mode = ie->data.ssp_mode;
 110         }
 111
 112         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 113         if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
 114                 cp.role_switch = 0x01;
 115         else
 116                 cp.role_switch = 0x00;
 117
 118         hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
 119 }
 120
 121 static void hci_acl_connect_cancel(struct hci_conn *conn)
 122 {
 123         struct hci_cp_create_conn_cancel cp;
 124
 125         BT_DBG("%p", conn);
 126
 127         if (conn->hdev->hci_ver < 2)
 128                 return;
 129
 130         bacpy(&cp.bdaddr, &conn->dst);
 131         hci_send_cmd(conn->hdev, HCI_OP_CREATE_CONN_CANCEL, sizeof(cp), &cp);
 132 }
 133
 134 void hci_acl_disconn(struct hci_conn *conn, __u8 reason)
 135 {
 136         struct hci_cp_disconnect cp;
 137
 138         BT_DBG("%p", conn);
 139
 140         conn->state = BT_DISCONN;
 141
 142         cp.handle = cpu_to_le16(conn->handle);
 143         cp.reason = reason;
 144         hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp);
 145 }
 146
 147 void hci_add_sco(struct hci_conn *conn, __u16 handle)
 148 {
 149         struct hci_dev *hdev = conn->hdev;
 150         struct hci_cp_add_sco cp;
 151
 152         BT_DBG("%p", conn);
 153
 154         conn->state = BT_CONNECT;
 155         conn->out = 1;
 156
 157         conn->attempt++;
 158
 159         cp.handle   = cpu_to_le16(handle);
 160         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 161
 162         hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
 163 }
 164
 165 void hci_setup_sync(struct hci_conn *conn, __u16 handle)
 166 {
 167         struct hci_dev *hdev = conn->hdev;
 168         struct hci_cp_setup_sync_conn cp;
 169
 170         BT_DBG("%p", conn);
 171
 172         conn->state = BT_CONNECT;
 173         conn->out = 1;
 174
 175         conn->attempt++;
 176
 177         cp.handle   = cpu_to_le16(handle);
 178         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 179
 180         cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
 181         cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
 182         cp.max_latency    = cpu_to_le16(0xffff);
 183         cp.voice_setting  = cpu_to_le16(hdev->voice_setting);
 184         cp.retrans_effort = 0xff;
 185
 186         hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp);
 187 }
 188
 189 void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max,
 190                                         u16 latency, u16 to_multiplier)
 191 {
 192         struct hci_cp_le_conn_update cp;
 193         struct hci_dev *hdev = conn->hdev;
 194
 195         memset(&cp, 0, sizeof(cp));
 196
 197         cp.handle               = cpu_to_le16(conn->handle);
 198         cp.conn_interval_min    = cpu_to_le16(min);
 199         cp.conn_interval_max    = cpu_to_le16(max);
 200         cp.conn_latency         = cpu_to_le16(latency);
 201         cp.supervision_timeout  = cpu_to_le16(to_multiplier);
 202         cp.min_ce_len           = cpu_to_le16(0x0001);
 203         cp.max_ce_len           = cpu_to_le16(0x0001);
 204
 205         hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp);
 206 }
 207 EXPORT_SYMBOL(hci_le_conn_update);
 208
 209 void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __u8 rand[8],
 210                                                         __u8 ltk[16])
 211 {
 212         struct hci_dev *hdev = conn->hdev;
 213         struct hci_cp_le_start_enc cp;
 214
 215         BT_DBG("%p", conn);
 216
 217         memset(&cp, 0, sizeof(cp));
 218
 219         cp.handle = cpu_to_le16(conn->handle);
 220         memcpy(cp.ltk, ltk, sizeof(cp.ltk));
 221         cp.ediv = ediv;
 222         memcpy(cp.rand, rand, sizeof(cp.rand));
 223
 224         hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp);
 225 }
 226 EXPORT_SYMBOL(hci_le_start_enc);
 227
 228 void hci_le_ltk_neg_reply(struct hci_conn *conn)
 229 {
 230         struct hci_dev *hdev = conn->hdev;
 231         struct hci_cp_le_ltk_neg_reply cp;
 232
 233         BT_DBG("%p", conn);
 234
 235         memset(&cp, 0, sizeof(cp));
 236
 237         cp.handle = cpu_to_le16(conn->handle);
 238
 239         hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(cp), &cp);
 240 }
 241
 242 /* Device _must_ be locked */
 243 void hci_sco_setup(struct hci_conn *conn, __u8 status)
 244 {
 245         struct hci_conn *sco = conn->link;
 246
 247         BT_DBG("%p", conn);
 248
 249         if (!sco)
 250                 return;
 251
 252         if (!status) {
 253                 if (lmp_esco_capable(conn->hdev))
 254                         hci_setup_sync(sco, conn->handle);
 255                 else
 256                         hci_add_sco(sco, conn->handle);
 257         } else {
 258                 hci_proto_connect_cfm(sco, status);
 259                 hci_conn_del(sco);
 260         }
 261 }
 262
 263 static void hci_conn_timeout(unsigned long arg)
 264 {
 265         struct hci_conn *conn = (void *) arg;
 266         struct hci_dev *hdev = conn->hdev;
 267         __u8 reason;
 268
 269         BT_DBG("conn %p state %d", conn, conn->state);
 270
 271         if (atomic_read(&conn->refcnt))
 272                 return;
 273
 274         hci_dev_lock(hdev);
 275
 276         switch (conn->state) {
 277         case BT_CONNECT:
 278         case BT_CONNECT2:
 279                 if (conn->out) {
 280                         if (conn->type == ACL_LINK)
 281                                 hci_acl_connect_cancel(conn);
 282                         else if (conn->type == LE_LINK)
 283                                 hci_le_connect_cancel(conn);
 284                 }
 285                 break;
 286         case BT_CONFIG:
 287         case BT_CONNECTED:
 288                 reason = hci_proto_disconn_ind(conn);
 289                 hci_acl_disconn(conn, reason);
 290                 break;
 291         default:
 292                 conn->state = BT_CLOSED;
 293                 break;
 294         }
 295
 296         hci_dev_unlock(hdev);
 297 }
 298
 299 static void hci_conn_idle(unsigned long arg)
 300 {
 301         struct hci_conn *conn = (void *) arg;
 302
 303         BT_DBG("conn %p mode %d", conn, conn->mode);
 304
 305         hci_conn_enter_sniff_mode(conn);
 306 }
 307
 308 static void hci_conn_auto_accept(unsigned long arg)
 309 {
 310         struct hci_conn *conn = (void *) arg;
 311         struct hci_dev *hdev = conn->hdev;
 312
 313         hci_dev_lock(hdev);
 314
 315         hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY, sizeof(conn->dst),
 316                                                                 &conn->dst);
 317
 318         hci_dev_unlock(hdev);
 319 }
 320
 321 struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
 322 {
 323         struct hci_conn *conn;
 324
 325         BT_DBG("%s dst %s", hdev->name, batostr(dst));
 326
 327         conn = kzalloc(sizeof(struct hci_conn), GFP_ATOMIC);
 328         if (!conn)
 329                 return NULL;
 330
 331         bacpy(&conn->dst, dst);
 332         conn->hdev  = hdev;
 333         conn->type  = type;
 334         conn->mode  = HCI_CM_ACTIVE;
 335         conn->state = BT_OPEN;
 336         conn->auth_type = HCI_AT_GENERAL_BONDING;
 337         conn->io_capability = hdev->io_capability;
 338         conn->remote_auth = 0xff;
 339         conn->key_type = 0xff;
 340
 341         conn->power_save = 1;
 342         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
 343
 344         switch (type) {
 345         case ACL_LINK:
 346                 conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
 347                 break;
 348         case SCO_LINK:
 349                 if (lmp_esco_capable(hdev))
 350                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
 351                                         (hdev->esco_type & EDR_ESCO_MASK);
 352                 else
 353                         conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
 354                 break;
 355         case ESCO_LINK:
 356                 conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
 357                 break;
 358         }
 359
 360         skb_queue_head_init(&conn->data_q);
 361
 362         setup_timer(&conn->disc_timer, hci_conn_timeout, (unsigned long)conn);
 363         setup_timer(&conn->idle_timer, hci_conn_idle, (unsigned long)conn);
 364         setup_timer(&conn->auto_accept_timer, hci_conn_auto_accept,
 365                                                         (unsigned long) conn);
 366
 367         atomic_set(&conn->refcnt, 0);
 368
 369         hci_dev_hold(hdev);
 370
 371         tasklet_disable(&hdev->tx_task);
 372
 373         hci_conn_hash_add(hdev, conn);
 374         if (hdev->notify)
 375                 hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
 376
 377         atomic_set(&conn->devref, 0);
 378
 379         hci_conn_init_sysfs(conn);
 380
 381         tasklet_enable(&hdev->tx_task);
 382
 383         return conn;
 384 }
 385
 386 int hci_conn_del(struct hci_conn *conn)
 387 {
 388         struct hci_dev *hdev = conn->hdev;
 389
 390         BT_DBG("%s conn %p handle %d", hdev->name, conn, conn->handle);
 391
 392         del_timer(&conn->idle_timer);
 393
 394         del_timer(&conn->disc_timer);
 395
 396         del_timer(&conn->auto_accept_timer);
 397
 398         if (conn->type == ACL_LINK) {
 399                 struct hci_conn *sco = conn->link;
 400                 if (sco)
 401                         sco->link = NULL;
 402
 403                 /* Unacked frames */
 404                 hdev->acl_cnt += conn->sent;
 405         } else if (conn->type == LE_LINK) {
 406                 if (hdev->le_pkts)
 407                         hdev->le_cnt += conn->sent;
 408                 else
 409                         hdev->acl_cnt += conn->sent;
 410         } else {
 411                 struct hci_conn *acl = conn->link;
 412                 if (acl) {
 413                         acl->link = NULL;
 414                         hci_conn_put(acl);
 415                 }
 416         }
 417
 418         tasklet_disable(&hdev->tx_task);
 419
 420         hci_conn_hash_del(hdev, conn);
 421         if (hdev->notify)
 422                 hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
 423
 424         tasklet_enable(&hdev->tx_task);
 425
 426         skb_queue_purge(&conn->data_q);
 427
 428         hci_conn_put_device(conn);
 429
 430         hci_dev_put(hdev);
 431
 432         if (conn->handle == 0)
 433                 kfree(conn);
 434
 435         return 0;
 436 }
 437
 438 struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src)
 439 {
 440         int use_src = bacmp(src, BDADDR_ANY);
 441         struct hci_dev *hdev = NULL;
 442         struct list_head *p;
 443
 444         BT_DBG("%s -> %s", batostr(src), batostr(dst));
 445
 446         read_lock_bh(&hci_dev_list_lock);
 447
 448         list_for_each(p, &hci_dev_list) {
 449                 struct hci_dev *d = list_entry(p, struct hci_dev, list);
 450
 451                 if (!test_bit(HCI_UP, &d->flags) || test_bit(HCI_RAW, &d->flags))
 452                         continue;
 453
 454                 /* Simple routing:
 455                  *   No source address - find interface with bdaddr != dst
 456                  *   Source address    - find interface with bdaddr == src
 457                  */
 458
 459                 if (use_src) {
 460                         if (!bacmp(&d->bdaddr, src)) {
 461                                 hdev = d; break;
 462                         }
 463                 } else {
 464                         if (bacmp(&d->bdaddr, dst)) {
 465                                 hdev = d; break;
 466                         }
 467                 }
 468         }
 469
 470         if (hdev)
 471                 hdev = hci_dev_hold(hdev);
 472
 473         read_unlock_bh(&hci_dev_list_lock);
 474         return hdev;
 475 }
 476 EXPORT_SYMBOL(hci_get_route);
 477
 478 /* Create SCO, ACL or LE connection.
 479  * Device _must_ be locked */
 480 struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, __u8 sec_level, __u8 auth_type)
 481 {
 482         struct hci_conn *acl;
 483         struct hci_conn *sco;
 484         struct hci_conn *le;
 485
 486         BT_DBG("%s dst %s", hdev->name, batostr(dst));
 487
 488         if (type == LE_LINK) {
 489                 struct adv_entry *entry;
 490
 491                 le = hci_conn_hash_lookup_ba(hdev, LE_LINK, dst);
 492                 if (le)
 493                         return ERR_PTR(-EBUSY);
 494
 495                 entry = hci_find_adv_entry(hdev, dst);
 496                 if (!entry)
 497                         return ERR_PTR(-EHOSTUNREACH);
 498
 499                 le = hci_conn_add(hdev, LE_LINK, dst);
 500                 if (!le)
 501                         return ERR_PTR(-ENOMEM);
 502
 503                 le->dst_type = entry->bdaddr_type;
 504
 505                 hci_le_connect(le);
 506
 507                 hci_conn_hold(le);
 508
 509                 return le;
 510         }
 511
 512         acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
 513         if (!acl) {
 514                 acl = hci_conn_add(hdev, ACL_LINK, dst);
 515                 if (!acl)
 516                         return NULL;
 517         }
 518
 519         hci_conn_hold(acl);
 520
 521         if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
 522                 acl->sec_level = BT_SECURITY_LOW;
 523                 acl->pending_sec_level = sec_level;
 524                 acl->auth_type = auth_type;
 525                 hci_acl_connect(acl);
 526         }
 527
 528         if (type == ACL_LINK)
 529                 return acl;
 530
 531         sco = hci_conn_hash_lookup_ba(hdev, type, dst);
 532         if (!sco) {
 533                 sco = hci_conn_add(hdev, type, dst);
 534                 if (!sco) {
 535                         hci_conn_put(acl);
 536                         return NULL;
 537                 }
 538         }
 539
 540         acl->link = sco;
 541         sco->link = acl;
 542
 543         hci_conn_hold(sco);
 544
 545         if (acl->state == BT_CONNECTED &&
 546                         (sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
 547                 acl->power_save = 1;
 548                 hci_conn_enter_active_mode(acl, BT_POWER_FORCE_ACTIVE_ON);
 549
 550                 if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->pend)) {
 551                         /* defer SCO setup until mode change completed */
 552                         set_bit(HCI_CONN_SCO_SETUP_PEND, &acl->pend);
 553                         return sco;
 554                 }
 555
 556                 hci_sco_setup(acl, 0x00);
 557         }
 558
 559         return sco;
 560 }
 561 EXPORT_SYMBOL(hci_connect);
 562
 563 /* Check link security requirement */
 564 int hci_conn_check_link_mode(struct hci_conn *conn)
 565 {
 566         BT_DBG("conn %p", conn);
 567
 568         if (conn->ssp_mode > 0 && conn->hdev->ssp_mode > 0 &&
 569                                         !(conn->link_mode & HCI_LM_ENCRYPT))
 570                 return 0;
 571
 572         return 1;
 573 }
 574 EXPORT_SYMBOL(hci_conn_check_link_mode);
 575
 576 /* Authenticate remote device */
 577 static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 578 {
 579         BT_DBG("conn %p", conn);
 580
 581         if (conn->pending_sec_level > sec_level)
 582                 sec_level = conn->pending_sec_level;
 583
 584         if (sec_level > conn->sec_level)
 585                 conn->pending_sec_level = sec_level;
 586         else if (conn->link_mode & HCI_LM_AUTH)
 587                 return 1;
 588
 589         /* Make sure we preserve an existing MITM requirement*/
 590         auth_type |= (conn->auth_type & 0x01);
 591
 592         conn->auth_type = auth_type;
 593
 594         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
 595                 struct hci_cp_auth_requested cp;
 596
 597                 cp.handle = cpu_to_le16(conn->handle);
 598                 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
 599                                                         sizeof(cp), &cp);
 600
 601                 /* If we're already encrypted set the REAUTH_PEND flag,
 602                  * otherwise set the ENCRYPT_PEND.
 603                  */
 604                 if (conn->link_mode & HCI_LM_ENCRYPT)
 605                         set_bit(HCI_CONN_REAUTH_PEND, &conn->pend);
 606                 else
 607                         set_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
 608         }
 609
 610         return 0;
 611 }
 612
 613 /* Encrypt the the link */
 614 static void hci_conn_encrypt(struct hci_conn *conn)
 615 {
 616         BT_DBG("conn %p", conn);
 617
 618         if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend)) {
 619                 struct hci_cp_set_conn_encrypt cp;
 620                 cp.handle  = cpu_to_le16(conn->handle);
 621                 cp.encrypt = 0x01;
 622                 hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
 623                                                                         &cp);
 624         }
 625 }
 626
 627 /* Enable security */
 628 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 629 {
 630         BT_DBG("conn %p", conn);
 631
 632 #ifdef CONFIG_BT_L2CAP
 633         if (conn->type == LE_LINK)
 634                 return smp_conn_security(conn, sec_level);
 635 #endif
 636
 637         /* For sdp we don't need the link key. */
 638         if (sec_level == BT_SECURITY_SDP)
 639                 return 1;
 640
 641         /* For non 2.1 devices and low security level we don't need the link
 642            key. */
 643         if (sec_level == BT_SECURITY_LOW &&
 644                                 (!conn->ssp_mode || !conn->hdev->ssp_mode))
 645                 return 1;
 646
 647         /* For other security levels we need the link key. */
 648         if (!(conn->link_mode & HCI_LM_AUTH))
 649                 goto auth;
 650
 651         /* An authenticated combination key has sufficient security for any
 652            security level. */
 653         if (conn->key_type == HCI_LK_AUTH_COMBINATION)
 654                 goto encrypt;
 655
 656         /* An unauthenticated combination key has sufficient security for
 657            security level 1 and 2. */
 658         if (conn->key_type == HCI_LK_UNAUTH_COMBINATION &&
 659                         (sec_level == BT_SECURITY_MEDIUM ||
 660                         sec_level == BT_SECURITY_LOW))
 661                 goto encrypt;
 662
 663         /* A combination key has always sufficient security for the security
 664            levels 1 or 2. High security level requires the combination key
 665            is generated using maximum PIN code length (16).
 666            For pre 2.1 units. */
 667         if (conn->key_type == HCI_LK_COMBINATION &&
 668                         (sec_level != BT_SECURITY_HIGH ||
 669                         conn->pin_length == 16))
 670                 goto encrypt;
 671
 672 auth:
 673         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend))
 674                 return 0;
 675
 676         if (!hci_conn_auth(conn, sec_level, auth_type))
 677                 return 0;
 678
 679 encrypt:
 680         if (conn->link_mode & HCI_LM_ENCRYPT)
 681                 return 1;
 682
 683         hci_conn_encrypt(conn);
 684         return 0;
 685 }
 686 EXPORT_SYMBOL(hci_conn_security);
 687
 688 /* Check secure link requirement */
 689 int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level)
 690 {
 691         BT_DBG("conn %p", conn);
 692
 693         if (sec_level != BT_SECURITY_HIGH)
 694                 return 1; /* Accept if non-secure is required */
 695
 696         if (conn->sec_level == BT_SECURITY_HIGH)
 697                 return 1;
 698
 699         return 0; /* Reject not secure link */
 700 }
 701 EXPORT_SYMBOL(hci_conn_check_secure);
 702
 703 /* Change link key */
 704 int hci_conn_change_link_key(struct hci_conn *conn)
 705 {
 706         BT_DBG("conn %p", conn);
 707
 708         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
 709                 struct hci_cp_change_conn_link_key cp;
 710                 cp.handle = cpu_to_le16(conn->handle);
 711                 hci_send_cmd(conn->hdev, HCI_OP_CHANGE_CONN_LINK_KEY,
 712                                                         sizeof(cp), &cp);
 713         }
 714
 715         return 0;
 716 }
 717 EXPORT_SYMBOL(hci_conn_change_link_key);
 718
 719 /* Switch role */
 720 int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
 721 {
 722         BT_DBG("conn %p", conn);
 723
 724         if (!role && conn->link_mode & HCI_LM_MASTER)
 725                 return 1;
 726
 727         if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->pend)) {
 728                 struct hci_cp_switch_role cp;
 729                 bacpy(&cp.bdaddr, &conn->dst);
 730                 cp.role = role;
 731                 hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
 732         }
 733
 734         return 0;
 735 }
 736 EXPORT_SYMBOL(hci_conn_switch_role);
 737
 738 /* Enter active mode */
 739 void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
 740 {
 741         struct hci_dev *hdev = conn->hdev;
 742
 743         BT_DBG("conn %p mode %d", conn, conn->mode);
 744
 745         if (test_bit(HCI_RAW, &hdev->flags))
 746                 return;
 747
 748         if (conn->mode != HCI_CM_SNIFF)
 749                 goto timer;
 750
 751         if (!conn->power_save && !force_active)
 752                 goto timer;
 753
 754         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
 755                 struct hci_cp_exit_sniff_mode cp;
 756                 cp.handle = cpu_to_le16(conn->handle);
 757                 hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
 758         }
 759
 760 timer:
 761         if (hdev->idle_timeout > 0)
 762                 mod_timer(&conn->idle_timer,
 763                         jiffies + msecs_to_jiffies(hdev->idle_timeout));
 764 }
 765
 766 /* Enter sniff mode */
 767 void hci_conn_enter_sniff_mode(struct hci_conn *conn)
 768 {
 769         struct hci_dev *hdev = conn->hdev;
 770
 771         BT_DBG("conn %p mode %d", conn, conn->mode);
 772
 773         if (test_bit(HCI_RAW, &hdev->flags))
 774                 return;
 775
 776         if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn))
 777                 return;
 778
 779         if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF))
 780                 return;
 781
 782         if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
 783                 struct hci_cp_sniff_subrate cp;
 784                 cp.handle             = cpu_to_le16(conn->handle);
 785                 cp.max_latency        = cpu_to_le16(0);
 786                 cp.min_remote_timeout = cpu_to_le16(0);
 787                 cp.min_local_timeout  = cpu_to_le16(0);
 788                 hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
 789         }
 790
 791         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
 792                 struct hci_cp_sniff_mode cp;
 793                 cp.handle       = cpu_to_le16(conn->handle);
 794                 cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
 795                 cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
 796                 cp.attempt      = cpu_to_le16(4);
 797                 cp.timeout      = cpu_to_le16(1);
 798                 hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
 799         }
 800 }
 801
 802 /* Drop all connection on the device */
 803 void hci_conn_hash_flush(struct hci_dev *hdev)
 804 {
 805         struct hci_conn_hash *h = &hdev->conn_hash;
 806         struct list_head *p;
 807
 808         BT_DBG("hdev %s", hdev->name);
 809
 810         p = h->list.next;
 811         while (p != &h->list) {
 812                 struct hci_conn *c;
 813
 814                 c = list_entry(p, struct hci_conn, list);
 815                 p = p->next;
 816
 817                 c->state = BT_CLOSED;
 818
 819                 hci_proto_disconn_cfm(c, 0x16);
 820                 hci_conn_del(c);
 821         }
 822 }
 823
 824 /* Check pending connect attempts */
 825 void hci_conn_check_pending(struct hci_dev *hdev)
 826 {
 827         struct hci_conn *conn;
 828
 829         BT_DBG("hdev %s", hdev->name);
 830
 831         hci_dev_lock(hdev);
 832
 833         conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
 834         if (conn)
 835                 hci_acl_connect(conn);
 836
 837         hci_dev_unlock(hdev);
 838 }
 839
 840 void hci_conn_hold_device(struct hci_conn *conn)
 841 {
 842         atomic_inc(&conn->devref);
 843 }
 844 EXPORT_SYMBOL(hci_conn_hold_device);
 845
 846 void hci_conn_put_device(struct hci_conn *conn)
 847 {
 848         if (atomic_dec_and_test(&conn->devref))
 849                 hci_conn_del_sysfs(conn);
 850 }
 851 EXPORT_SYMBOL(hci_conn_put_device);
 852
 853 int hci_get_conn_list(void __user *arg)
 854 {
 855         struct hci_conn_list_req req, *cl;
 856         struct hci_conn_info *ci;
 857         struct hci_dev *hdev;
 858         struct list_head *p;
 859         int n = 0, size, err;
 860
 861         if (copy_from_user(&req, arg, sizeof(req)))
 862                 return -EFAULT;
 863
 864         if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
 865                 return -EINVAL;
 866
 867         size = sizeof(req) + req.conn_num * sizeof(*ci);
 868
 869         cl = kmalloc(size, GFP_KERNEL);
 870         if (!cl)
 871                 return -ENOMEM;
 872
 873         hdev = hci_dev_get(req.dev_id);
 874         if (!hdev) {
 875                 kfree(cl);
 876                 return -ENODEV;
 877         }
 878
 879         ci = cl->conn_info;
 880
 881         hci_dev_lock_bh(hdev);
 882         list_for_each(p, &hdev->conn_hash.list) {
 883                 register struct hci_conn *c;
 884                 c = list_entry(p, struct hci_conn, list);
 885
 886                 bacpy(&(ci + n)->bdaddr, &c->dst);
 887                 (ci + n)->handle = c->handle;
 888                 (ci + n)->type  = c->type;
 889                 (ci + n)->out   = c->out;
 890                 (ci + n)->state = c->state;
 891                 (ci + n)->link_mode = c->link_mode;
 892                 if (++n >= req.conn_num)
 893                         break;
 894         }
 895         hci_dev_unlock_bh(hdev);
 896
 897         cl->dev_id = hdev->id;
 898         cl->conn_num = n;
 899         size = sizeof(req) + n * sizeof(*ci);
 900
 901         hci_dev_put(hdev);
 902
 903         err = copy_to_user(arg, cl, size);
 904         kfree(cl);
 905
 906         return err ? -EFAULT : 0;
 907 }
 908
 909 int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
 910 {
 911         struct hci_conn_info_req req;
 912         struct hci_conn_info ci;
 913         struct hci_conn *conn;
 914         char __user *ptr = arg + sizeof(req);
 915
 916         if (copy_from_user(&req, arg, sizeof(req)))
 917                 return -EFAULT;
 918
 919         hci_dev_lock_bh(hdev);
 920         conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
 921         if (conn) {
 922                 bacpy(&ci.bdaddr, &conn->dst);
 923                 ci.handle = conn->handle;
 924                 ci.type  = conn->type;
 925                 ci.out   = conn->out;
 926                 ci.state = conn->state;
 927                 ci.link_mode = conn->link_mode;
 928         }
 929         hci_dev_unlock_bh(hdev);
 930
 931         if (!conn)
 932                 return -ENOENT;
 933
 934         return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
 935 }
 936
 937 int hci_get_auth_info(struct hci_dev *hdev, void __user *arg)
 938 {
 939         struct hci_auth_info_req req;
 940         struct hci_conn *conn;
 941
 942         if (copy_from_user(&req, arg, sizeof(req)))
 943                 return -EFAULT;
 944
 945         hci_dev_lock_bh(hdev);
 946         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr);
 947         if (conn)
 948                 req.type = conn->auth_type;
 949         hci_dev_unlock_bh(hdev);
 950
 951         if (!conn)
 952                 return -ENOENT;
 953
 954         return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0;
 955 }