net/bluetooth/hci_conn.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI connection handling. */
  26
  27 #include <linux/export.h>
  28
  29 #include <net/bluetooth/bluetooth.h>
  30 #include <net/bluetooth/hci_core.h>
  31
  32 static void hci_le_connect(struct hci_conn *conn)
  33 {
  34         struct hci_dev *hdev = conn->hdev;
  35         struct hci_cp_le_create_conn cp;
  36
  37         conn->state = BT_CONNECT;
  38         conn->out = true;
  39         conn->link_mode |= HCI_LM_MASTER;
  40         conn->sec_level = BT_SECURITY_LOW;
  41
  42         memset(&cp, 0, sizeof(cp));
  43         cp.scan_interval = cpu_to_le16(0x0060);
  44         cp.scan_window = cpu_to_le16(0x0030);
  45         bacpy(&cp.peer_addr, &conn->dst);
  46         cp.peer_addr_type = conn->dst_type;
  47         cp.conn_interval_min = cpu_to_le16(0x0028);
  48         cp.conn_interval_max = cpu_to_le16(0x0038);
  49         cp.supervision_timeout = cpu_to_le16(0x002a);
  50         cp.min_ce_len = cpu_to_le16(0x0000);
  51         cp.max_ce_len = cpu_to_le16(0x0000);
  52
  53         hci_send_cmd(hdev, HCI_OP_LE_CREATE_CONN, sizeof(cp), &cp);
  54 }
  55
  56 static void hci_le_connect_cancel(struct hci_conn *conn)
  57 {
  58         hci_send_cmd(conn->hdev, HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL);
  59 }
  60
  61 void hci_acl_connect(struct hci_conn *conn)
  62 {
  63         struct hci_dev *hdev = conn->hdev;
  64         struct inquiry_entry *ie;
  65         struct hci_cp_create_conn cp;
  66
  67         BT_DBG("hcon %p", conn);
  68
  69         conn->state = BT_CONNECT;
  70         conn->out = true;
  71
  72         conn->link_mode = HCI_LM_MASTER;
  73
  74         conn->attempt++;
  75
  76         conn->link_policy = hdev->link_policy;
  77
  78         memset(&cp, 0, sizeof(cp));
  79         bacpy(&cp.bdaddr, &conn->dst);
  80         cp.pscan_rep_mode = 0x02;
  81
  82         ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
  83         if (ie) {
  84                 if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
  85                         cp.pscan_rep_mode = ie->data.pscan_rep_mode;
  86                         cp.pscan_mode     = ie->data.pscan_mode;
  87                         cp.clock_offset   = ie->data.clock_offset |
  88                                                         cpu_to_le16(0x8000);
  89                 }
  90
  91                 memcpy(conn->dev_class, ie->data.dev_class, 3);
  92                 if (ie->data.ssp_mode > 0)
  93                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
  94         }
  95
  96         cp.pkt_type = cpu_to_le16(conn->pkt_type);
  97         if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
  98                 cp.role_switch = 0x01;
  99         else
 100                 cp.role_switch = 0x00;
 101
 102         hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
 103 }
 104
 105 static void hci_acl_connect_cancel(struct hci_conn *conn)
 106 {
 107         struct hci_cp_create_conn_cancel cp;
 108
 109         BT_DBG("%p", conn);
 110
 111         if (conn->hdev->hci_ver < BLUETOOTH_VER_1_2)
 112                 return;
 113
 114         bacpy(&cp.bdaddr, &conn->dst);
 115         hci_send_cmd(conn->hdev, HCI_OP_CREATE_CONN_CANCEL, sizeof(cp), &cp);
 116 }
 117
 118 void hci_acl_disconn(struct hci_conn *conn, __u8 reason)
 119 {
 120         struct hci_cp_disconnect cp;
 121
 122         BT_DBG("%p", conn);
 123
 124         conn->state = BT_DISCONN;
 125
 126         cp.handle = cpu_to_le16(conn->handle);
 127         cp.reason = reason;
 128         hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp);
 129 }
 130
 131 void hci_add_sco(struct hci_conn *conn, __u16 handle)
 132 {
 133         struct hci_dev *hdev = conn->hdev;
 134         struct hci_cp_add_sco cp;
 135
 136         BT_DBG("%p", conn);
 137
 138         conn->state = BT_CONNECT;
 139         conn->out = true;
 140
 141         conn->attempt++;
 142
 143         cp.handle   = cpu_to_le16(handle);
 144         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 145
 146         hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
 147 }
 148
 149 void hci_setup_sync(struct hci_conn *conn, __u16 handle)
 150 {
 151         struct hci_dev *hdev = conn->hdev;
 152         struct hci_cp_setup_sync_conn cp;
 153
 154         BT_DBG("%p", conn);
 155
 156         conn->state = BT_CONNECT;
 157         conn->out = true;
 158
 159         conn->attempt++;
 160
 161         cp.handle   = cpu_to_le16(handle);
 162         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 163
 164         cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
 165         cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
 166         cp.max_latency    = cpu_to_le16(0xffff);
 167         cp.voice_setting  = cpu_to_le16(hdev->voice_setting);
 168         cp.retrans_effort = 0xff;
 169
 170         hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp);
 171 }
 172
 173 void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max,
 174                         u16 latency, u16 to_multiplier)
 175 {
 176         struct hci_cp_le_conn_update cp;
 177         struct hci_dev *hdev = conn->hdev;
 178
 179         memset(&cp, 0, sizeof(cp));
 180
 181         cp.handle               = cpu_to_le16(conn->handle);
 182         cp.conn_interval_min    = cpu_to_le16(min);
 183         cp.conn_interval_max    = cpu_to_le16(max);
 184         cp.conn_latency         = cpu_to_le16(latency);
 185         cp.supervision_timeout  = cpu_to_le16(to_multiplier);
 186         cp.min_ce_len           = cpu_to_le16(0x0001);
 187         cp.max_ce_len           = cpu_to_le16(0x0001);
 188
 189         hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp);
 190 }
 191 EXPORT_SYMBOL(hci_le_conn_update);
 192
 193 void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __u8 rand[8],
 194                       __u8 ltk[16])
 195 {
 196         struct hci_dev *hdev = conn->hdev;
 197         struct hci_cp_le_start_enc cp;
 198
 199         BT_DBG("%p", conn);
 200
 201         memset(&cp, 0, sizeof(cp));
 202
 203         cp.handle = cpu_to_le16(conn->handle);
 204         memcpy(cp.ltk, ltk, sizeof(cp.ltk));
 205         cp.ediv = ediv;
 206         memcpy(cp.rand, rand, sizeof(cp.rand));
 207
 208         hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp);
 209 }
 210 EXPORT_SYMBOL(hci_le_start_enc);
 211
 212 /* Device _must_ be locked */
 213 void hci_sco_setup(struct hci_conn *conn, __u8 status)
 214 {
 215         struct hci_conn *sco = conn->link;
 216
 217         BT_DBG("%p", conn);
 218
 219         if (!sco)
 220                 return;
 221
 222         if (!status) {
 223                 if (lmp_esco_capable(conn->hdev))
 224                         hci_setup_sync(sco, conn->handle);
 225                 else
 226                         hci_add_sco(sco, conn->handle);
 227         } else {
 228                 hci_proto_connect_cfm(sco, status);
 229                 hci_conn_del(sco);
 230         }
 231 }
 232
 233 static void hci_conn_timeout(struct work_struct *work)
 234 {
 235         struct hci_conn *conn = container_of(work, struct hci_conn,
 236                                              disc_work.work);
 237         __u8 reason;
 238
 239         BT_DBG("conn %p state %s", conn, state_to_string(conn->state));
 240
 241         if (atomic_read(&conn->refcnt))
 242                 return;
 243
 244         switch (conn->state) {
 245         case BT_CONNECT:
 246         case BT_CONNECT2:
 247                 if (conn->out) {
 248                         if (conn->type == ACL_LINK)
 249                                 hci_acl_connect_cancel(conn);
 250                         else if (conn->type == LE_LINK)
 251                                 hci_le_connect_cancel(conn);
 252                 }
 253                 break;
 254         case BT_CONFIG:
 255         case BT_CONNECTED:
 256                 reason = hci_proto_disconn_ind(conn);
 257                 hci_acl_disconn(conn, reason);
 258                 break;
 259         default:
 260                 conn->state = BT_CLOSED;
 261                 break;
 262         }
 263 }
 264
 265 /* Enter sniff mode */
 266 static void hci_conn_enter_sniff_mode(struct hci_conn *conn)
 267 {
 268         struct hci_dev *hdev = conn->hdev;
 269
 270         BT_DBG("conn %p mode %d", conn, conn->mode);
 271
 272         if (test_bit(HCI_RAW, &hdev->flags))
 273                 return;
 274
 275         if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn))
 276                 return;
 277
 278         if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF))
 279                 return;
 280
 281         if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
 282                 struct hci_cp_sniff_subrate cp;
 283                 cp.handle             = cpu_to_le16(conn->handle);
 284                 cp.max_latency        = cpu_to_le16(0);
 285                 cp.min_remote_timeout = cpu_to_le16(0);
 286                 cp.min_local_timeout  = cpu_to_le16(0);
 287                 hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
 288         }
 289
 290         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
 291                 struct hci_cp_sniff_mode cp;
 292                 cp.handle       = cpu_to_le16(conn->handle);
 293                 cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
 294                 cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
 295                 cp.attempt      = cpu_to_le16(4);
 296                 cp.timeout      = cpu_to_le16(1);
 297                 hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
 298         }
 299 }
 300
 301 static void hci_conn_idle(unsigned long arg)
 302 {
 303         struct hci_conn *conn = (void *) arg;
 304
 305         BT_DBG("conn %p mode %d", conn, conn->mode);
 306
 307         hci_conn_enter_sniff_mode(conn);
 308 }
 309
 310 static void hci_conn_auto_accept(unsigned long arg)
 311 {
 312         struct hci_conn *conn = (void *) arg;
 313         struct hci_dev *hdev = conn->hdev;
 314
 315         hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY, sizeof(conn->dst),
 316                      &conn->dst);
 317 }
 318
 319 struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
 320 {
 321         struct hci_conn *conn;
 322
 323         BT_DBG("%s dst %s", hdev->name, batostr(dst));
 324
 325         conn = kzalloc(sizeof(struct hci_conn), GFP_KERNEL);
 326         if (!conn)
 327                 return NULL;
 328
 329         bacpy(&conn->dst, dst);
 330         conn->hdev  = hdev;
 331         conn->type  = type;
 332         conn->mode  = HCI_CM_ACTIVE;
 333         conn->state = BT_OPEN;
 334         conn->auth_type = HCI_AT_GENERAL_BONDING;
 335         conn->io_capability = hdev->io_capability;
 336         conn->remote_auth = 0xff;
 337         conn->key_type = 0xff;
 338
 339         set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
 340         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
 341
 342         switch (type) {
 343         case ACL_LINK:
 344                 conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
 345                 break;
 346         case SCO_LINK:
 347                 if (lmp_esco_capable(hdev))
 348                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
 349                                         (hdev->esco_type & EDR_ESCO_MASK);
 350                 else
 351                         conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
 352                 break;
 353         case ESCO_LINK:
 354                 conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
 355                 break;
 356         }
 357
 358         skb_queue_head_init(&conn->data_q);
 359
 360         INIT_LIST_HEAD(&conn->chan_list);
 361
 362         INIT_DELAYED_WORK(&conn->disc_work, hci_conn_timeout);
 363         setup_timer(&conn->idle_timer, hci_conn_idle, (unsigned long)conn);
 364         setup_timer(&conn->auto_accept_timer, hci_conn_auto_accept,
 365                     (unsigned long) conn);
 366
 367         atomic_set(&conn->refcnt, 0);
 368
 369         hci_dev_hold(hdev);
 370
 371         hci_conn_hash_add(hdev, conn);
 372         if (hdev->notify)
 373                 hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
 374
 375         atomic_set(&conn->devref, 0);
 376
 377         hci_conn_init_sysfs(conn);
 378
 379         return conn;
 380 }
 381
 382 int hci_conn_del(struct hci_conn *conn)
 383 {
 384         struct hci_dev *hdev = conn->hdev;
 385
 386         BT_DBG("%s conn %p handle %d", hdev->name, conn, conn->handle);
 387
 388         del_timer(&conn->idle_timer);
 389
 390         cancel_delayed_work_sync(&conn->disc_work);
 391
 392         del_timer(&conn->auto_accept_timer);
 393
 394         if (conn->type == ACL_LINK) {
 395                 struct hci_conn *sco = conn->link;
 396                 if (sco)
 397                         sco->link = NULL;
 398
 399                 /* Unacked frames */
 400                 hdev->acl_cnt += conn->sent;
 401         } else if (conn->type == LE_LINK) {
 402                 if (hdev->le_pkts)
 403                         hdev->le_cnt += conn->sent;
 404                 else
 405                         hdev->acl_cnt += conn->sent;
 406         } else {
 407                 struct hci_conn *acl = conn->link;
 408                 if (acl) {
 409                         acl->link = NULL;
 410                         hci_conn_put(acl);
 411                 }
 412         }
 413
 414         hci_chan_list_flush(conn);
 415
 416         hci_conn_hash_del(hdev, conn);
 417         if (hdev->notify)
 418                 hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
 419
 420         skb_queue_purge(&conn->data_q);
 421
 422         hci_conn_put_device(conn);
 423
 424         hci_dev_put(hdev);
 425
 426         if (conn->handle == 0)
 427                 kfree(conn);
 428
 429         return 0;
 430 }
 431
 432 struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src)
 433 {
 434         int use_src = bacmp(src, BDADDR_ANY);
 435         struct hci_dev *hdev = NULL, *d;
 436
 437         BT_DBG("%s -> %s", batostr(src), batostr(dst));
 438
 439         read_lock(&hci_dev_list_lock);
 440
 441         list_for_each_entry(d, &hci_dev_list, list) {
 442                 if (!test_bit(HCI_UP, &d->flags) ||
 443                     test_bit(HCI_RAW, &d->flags))
 444                         continue;
 445
 446                 /* Simple routing:
 447                  *   No source address - find interface with bdaddr != dst
 448                  *   Source address    - find interface with bdaddr == src
 449                  */
 450
 451                 if (use_src) {
 452                         if (!bacmp(&d->bdaddr, src)) {
 453                                 hdev = d; break;
 454                         }
 455                 } else {
 456                         if (bacmp(&d->bdaddr, dst)) {
 457                                 hdev = d; break;
 458                         }
 459                 }
 460         }
 461
 462         if (hdev)
 463                 hdev = hci_dev_hold(hdev);
 464
 465         read_unlock(&hci_dev_list_lock);
 466         return hdev;
 467 }
 468 EXPORT_SYMBOL(hci_get_route);
 469
 470 /* Create SCO, ACL or LE connection.
 471  * Device _must_ be locked */
 472 struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst,
 473                              __u8 dst_type, __u8 sec_level, __u8 auth_type)
 474 {
 475         struct hci_conn *acl;
 476         struct hci_conn *sco;
 477         struct hci_conn *le;
 478
 479         BT_DBG("%s dst %s", hdev->name, batostr(dst));
 480
 481         if (type == LE_LINK) {
 482                 le = hci_conn_hash_lookup_ba(hdev, LE_LINK, dst);
 483                 if (!le) {
 484                         le = hci_conn_add(hdev, LE_LINK, dst);
 485                         if (!le)
 486                                 return ERR_PTR(-ENOMEM);
 487
 488                         le->dst_type = bdaddr_to_le(dst_type);
 489                         hci_le_connect(le);
 490                 }
 491
 492                 le->pending_sec_level = sec_level;
 493                 le->auth_type = auth_type;
 494
 495                 hci_conn_hold(le);
 496
 497                 return le;
 498         }
 499
 500         acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
 501         if (!acl) {
 502                 acl = hci_conn_add(hdev, ACL_LINK, dst);
 503                 if (!acl)
 504                         return ERR_PTR(-ENOMEM);
 505         }
 506
 507         hci_conn_hold(acl);
 508
 509         if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
 510                 acl->sec_level = BT_SECURITY_LOW;
 511                 acl->pending_sec_level = sec_level;
 512                 acl->auth_type = auth_type;
 513                 hci_acl_connect(acl);
 514         }
 515
 516         if (type == ACL_LINK)
 517                 return acl;
 518
 519         sco = hci_conn_hash_lookup_ba(hdev, type, dst);
 520         if (!sco) {
 521                 sco = hci_conn_add(hdev, type, dst);
 522                 if (!sco) {
 523                         hci_conn_put(acl);
 524                         return ERR_PTR(-ENOMEM);
 525                 }
 526         }
 527
 528         acl->link = sco;
 529         sco->link = acl;
 530
 531         hci_conn_hold(sco);
 532
 533         if (acl->state == BT_CONNECTED &&
 534             (sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
 535                 set_bit(HCI_CONN_POWER_SAVE, &acl->flags);
 536                 hci_conn_enter_active_mode(acl, BT_POWER_FORCE_ACTIVE_ON);
 537
 538                 if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->flags)) {
 539                         /* defer SCO setup until mode change completed */
 540                         set_bit(HCI_CONN_SCO_SETUP_PEND, &acl->flags);
 541                         return sco;
 542                 }
 543
 544                 hci_sco_setup(acl, 0x00);
 545         }
 546
 547         return sco;
 548 }
 549 EXPORT_SYMBOL(hci_connect);
 550
 551 /* Check link security requirement */
 552 int hci_conn_check_link_mode(struct hci_conn *conn)
 553 {
 554         BT_DBG("conn %p", conn);
 555
 556         if (hci_conn_ssp_enabled(conn) && !(conn->link_mode & HCI_LM_ENCRYPT))
 557                 return 0;
 558
 559         return 1;
 560 }
 561 EXPORT_SYMBOL(hci_conn_check_link_mode);
 562
 563 /* Authenticate remote device */
 564 static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 565 {
 566         BT_DBG("conn %p", conn);
 567
 568         if (conn->pending_sec_level > sec_level)
 569                 sec_level = conn->pending_sec_level;
 570
 571         if (sec_level > conn->sec_level)
 572                 conn->pending_sec_level = sec_level;
 573         else if (conn->link_mode & HCI_LM_AUTH)
 574                 return 1;
 575
 576         /* Make sure we preserve an existing MITM requirement*/
 577         auth_type |= (conn->auth_type & 0x01);
 578
 579         conn->auth_type = auth_type;
 580
 581         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
 582                 struct hci_cp_auth_requested cp;
 583
 584                 /* encrypt must be pending if auth is also pending */
 585                 set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
 586
 587                 cp.handle = cpu_to_le16(conn->handle);
 588                 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
 589                              sizeof(cp), &cp);
 590                 if (conn->key_type != 0xff)
 591                         set_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
 592         }
 593
 594         return 0;
 595 }
 596
 597 /* Encrypt the the link */
 598 static void hci_conn_encrypt(struct hci_conn *conn)
 599 {
 600         BT_DBG("conn %p", conn);
 601
 602         if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
 603                 struct hci_cp_set_conn_encrypt cp;
 604                 cp.handle  = cpu_to_le16(conn->handle);
 605                 cp.encrypt = 0x01;
 606                 hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
 607                              &cp);
 608         }
 609 }
 610
 611 /* Enable security */
 612 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 613 {
 614         BT_DBG("conn %p", conn);
 615
 616         /* For sdp we don't need the link key. */
 617         if (sec_level == BT_SECURITY_SDP)
 618                 return 1;
 619
 620         /* For non 2.1 devices and low security level we don't need the link
 621            key. */
 622         if (sec_level == BT_SECURITY_LOW && !hci_conn_ssp_enabled(conn))
 623                 return 1;
 624
 625         /* For other security levels we need the link key. */
 626         if (!(conn->link_mode & HCI_LM_AUTH))
 627                 goto auth;
 628
 629         /* An authenticated combination key has sufficient security for any
 630            security level. */
 631         if (conn->key_type == HCI_LK_AUTH_COMBINATION)
 632                 goto encrypt;
 633
 634         /* An unauthenticated combination key has sufficient security for
 635            security level 1 and 2. */
 636         if (conn->key_type == HCI_LK_UNAUTH_COMBINATION &&
 637             (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW))
 638                 goto encrypt;
 639
 640         /* A combination key has always sufficient security for the security
 641            levels 1 or 2. High security level requires the combination key
 642            is generated using maximum PIN code length (16).
 643            For pre 2.1 units. */
 644         if (conn->key_type == HCI_LK_COMBINATION &&
 645             (sec_level != BT_SECURITY_HIGH || conn->pin_length == 16))
 646                 goto encrypt;
 647
 648 auth:
 649         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags))
 650                 return 0;
 651
 652         if (!hci_conn_auth(conn, sec_level, auth_type))
 653                 return 0;
 654
 655 encrypt:
 656         if (conn->link_mode & HCI_LM_ENCRYPT)
 657                 return 1;
 658
 659         hci_conn_encrypt(conn);
 660         return 0;
 661 }
 662 EXPORT_SYMBOL(hci_conn_security);
 663
 664 /* Check secure link requirement */
 665 int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level)
 666 {
 667         BT_DBG("conn %p", conn);
 668
 669         if (sec_level != BT_SECURITY_HIGH)
 670                 return 1; /* Accept if non-secure is required */
 671
 672         if (conn->sec_level == BT_SECURITY_HIGH)
 673                 return 1;
 674
 675         return 0; /* Reject not secure link */
 676 }
 677 EXPORT_SYMBOL(hci_conn_check_secure);
 678
 679 /* Change link key */
 680 int hci_conn_change_link_key(struct hci_conn *conn)
 681 {
 682         BT_DBG("conn %p", conn);
 683
 684         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
 685                 struct hci_cp_change_conn_link_key cp;
 686                 cp.handle = cpu_to_le16(conn->handle);
 687                 hci_send_cmd(conn->hdev, HCI_OP_CHANGE_CONN_LINK_KEY,
 688                              sizeof(cp), &cp);
 689         }
 690
 691         return 0;
 692 }
 693 EXPORT_SYMBOL(hci_conn_change_link_key);
 694
 695 /* Switch role */
 696 int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
 697 {
 698         BT_DBG("conn %p", conn);
 699
 700         if (!role && conn->link_mode & HCI_LM_MASTER)
 701                 return 1;
 702
 703         if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->flags)) {
 704                 struct hci_cp_switch_role cp;
 705                 bacpy(&cp.bdaddr, &conn->dst);
 706                 cp.role = role;
 707                 hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
 708         }
 709
 710         return 0;
 711 }
 712 EXPORT_SYMBOL(hci_conn_switch_role);
 713
 714 /* Enter active mode */
 715 void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
 716 {
 717         struct hci_dev *hdev = conn->hdev;
 718
 719         BT_DBG("conn %p mode %d", conn, conn->mode);
 720
 721         if (test_bit(HCI_RAW, &hdev->flags))
 722                 return;
 723
 724         if (conn->mode != HCI_CM_SNIFF)
 725                 goto timer;
 726
 727         if (!test_bit(HCI_CONN_POWER_SAVE, &conn->flags) && !force_active)
 728                 goto timer;
 729
 730         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
 731                 struct hci_cp_exit_sniff_mode cp;
 732                 cp.handle = cpu_to_le16(conn->handle);
 733                 hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
 734         }
 735
 736 timer:
 737         if (hdev->idle_timeout > 0)
 738                 mod_timer(&conn->idle_timer,
 739                           jiffies + msecs_to_jiffies(hdev->idle_timeout));
 740 }
 741
 742 /* Drop all connection on the device */
 743 void hci_conn_hash_flush(struct hci_dev *hdev)
 744 {
 745         struct hci_conn_hash *h = &hdev->conn_hash;
 746         struct hci_conn *c, *n;
 747
 748         BT_DBG("hdev %s", hdev->name);
 749
 750         list_for_each_entry_safe(c, n, &h->list, list) {
 751                 c->state = BT_CLOSED;
 752
 753                 hci_proto_disconn_cfm(c, HCI_ERROR_LOCAL_HOST_TERM);
 754                 hci_conn_del(c);
 755         }
 756 }
 757
 758 /* Check pending connect attempts */
 759 void hci_conn_check_pending(struct hci_dev *hdev)
 760 {
 761         struct hci_conn *conn;
 762
 763         BT_DBG("hdev %s", hdev->name);
 764
 765         hci_dev_lock(hdev);
 766
 767         conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
 768         if (conn)
 769                 hci_acl_connect(conn);
 770
 771         hci_dev_unlock(hdev);
 772 }
 773
 774 void hci_conn_hold_device(struct hci_conn *conn)
 775 {
 776         atomic_inc(&conn->devref);
 777 }
 778 EXPORT_SYMBOL(hci_conn_hold_device);
 779
 780 void hci_conn_put_device(struct hci_conn *conn)
 781 {
 782         if (atomic_dec_and_test(&conn->devref))
 783                 hci_conn_del_sysfs(conn);
 784 }
 785 EXPORT_SYMBOL(hci_conn_put_device);
 786
 787 int hci_get_conn_list(void __user *arg)
 788 {
 789         struct hci_conn *c;
 790         struct hci_conn_list_req req, *cl;
 791         struct hci_conn_info *ci;
 792         struct hci_dev *hdev;
 793         int n = 0, size, err;
 794
 795         if (copy_from_user(&req, arg, sizeof(req)))
 796                 return -EFAULT;
 797
 798         if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
 799                 return -EINVAL;
 800
 801         size = sizeof(req) + req.conn_num * sizeof(*ci);
 802
 803         cl = kmalloc(size, GFP_KERNEL);
 804         if (!cl)
 805                 return -ENOMEM;
 806
 807         hdev = hci_dev_get(req.dev_id);
 808         if (!hdev) {
 809                 kfree(cl);
 810                 return -ENODEV;
 811         }
 812
 813         ci = cl->conn_info;
 814
 815         hci_dev_lock(hdev);
 816         list_for_each_entry(c, &hdev->conn_hash.list, list) {
 817                 bacpy(&(ci + n)->bdaddr, &c->dst);
 818                 (ci + n)->handle = c->handle;
 819                 (ci + n)->type  = c->type;
 820                 (ci + n)->out   = c->out;
 821                 (ci + n)->state = c->state;
 822                 (ci + n)->link_mode = c->link_mode;
 823                 if (++n >= req.conn_num)
 824                         break;
 825         }
 826         hci_dev_unlock(hdev);
 827
 828         cl->dev_id = hdev->id;
 829         cl->conn_num = n;
 830         size = sizeof(req) + n * sizeof(*ci);
 831
 832         hci_dev_put(hdev);
 833
 834         err = copy_to_user(arg, cl, size);
 835         kfree(cl);
 836
 837         return err ? -EFAULT : 0;
 838 }
 839
 840 int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
 841 {
 842         struct hci_conn_info_req req;
 843         struct hci_conn_info ci;
 844         struct hci_conn *conn;
 845         char __user *ptr = arg + sizeof(req);
 846
 847         if (copy_from_user(&req, arg, sizeof(req)))
 848                 return -EFAULT;
 849
 850         hci_dev_lock(hdev);
 851         conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
 852         if (conn) {
 853                 bacpy(&ci.bdaddr, &conn->dst);
 854                 ci.handle = conn->handle;
 855                 ci.type  = conn->type;
 856                 ci.out   = conn->out;
 857                 ci.state = conn->state;
 858                 ci.link_mode = conn->link_mode;
 859         }
 860         hci_dev_unlock(hdev);
 861
 862         if (!conn)
 863                 return -ENOENT;
 864
 865         return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
 866 }
 867
 868 int hci_get_auth_info(struct hci_dev *hdev, void __user *arg)
 869 {
 870         struct hci_auth_info_req req;
 871         struct hci_conn *conn;
 872
 873         if (copy_from_user(&req, arg, sizeof(req)))
 874                 return -EFAULT;
 875
 876         hci_dev_lock(hdev);
 877         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr);
 878         if (conn)
 879                 req.type = conn->auth_type;
 880         hci_dev_unlock(hdev);
 881
 882         if (!conn)
 883                 return -ENOENT;
 884
 885         return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0;
 886 }
 887
 888 struct hci_chan *hci_chan_create(struct hci_conn *conn)
 889 {
 890         struct hci_dev *hdev = conn->hdev;
 891         struct hci_chan *chan;
 892
 893         BT_DBG("%s conn %p", hdev->name, conn);
 894
 895         chan = kzalloc(sizeof(struct hci_chan), GFP_KERNEL);
 896         if (!chan)
 897                 return NULL;
 898
 899         chan->conn = conn;
 900         skb_queue_head_init(&chan->data_q);
 901
 902         list_add_rcu(&chan->list, &conn->chan_list);
 903
 904         return chan;
 905 }
 906
 907 int hci_chan_del(struct hci_chan *chan)
 908 {
 909         struct hci_conn *conn = chan->conn;
 910         struct hci_dev *hdev = conn->hdev;
 911
 912         BT_DBG("%s conn %p chan %p", hdev->name, conn, chan);
 913
 914         list_del_rcu(&chan->list);
 915
 916         synchronize_rcu();
 917
 918         skb_queue_purge(&chan->data_q);
 919         kfree(chan);
 920
 921         return 0;
 922 }
 923
 924 void hci_chan_list_flush(struct hci_conn *conn)
 925 {
 926         struct hci_chan *chan, *n;
 927
 928         BT_DBG("conn %p", conn);
 929
 930         list_for_each_entry_safe(chan, n, &conn->chan_list, list)
 931                 hci_chan_del(chan);
 932 }