net/bluetooth/hci_conn.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI connection handling. */
  26
  27 #include <linux/export.h>
  28
  29 #include <net/bluetooth/bluetooth.h>
  30 #include <net/bluetooth/hci_core.h>
  31 #include <net/bluetooth/a2mp.h>
  32 #include <net/bluetooth/smp.h>
  33
  34 static void hci_le_create_connection(struct hci_conn *conn)
  35 {
  36         struct hci_dev *hdev = conn->hdev;
  37         struct hci_cp_le_create_conn cp;
  38
  39         conn->state = BT_CONNECT;
  40         conn->out = true;
  41         conn->link_mode |= HCI_LM_MASTER;
  42         conn->sec_level = BT_SECURITY_LOW;
  43
  44         memset(&cp, 0, sizeof(cp));
  45         cp.scan_interval = __constant_cpu_to_le16(0x0060);
  46         cp.scan_window = __constant_cpu_to_le16(0x0030);
  47         bacpy(&cp.peer_addr, &conn->dst);
  48         cp.peer_addr_type = conn->dst_type;
  49         cp.conn_interval_min = __constant_cpu_to_le16(0x0028);
  50         cp.conn_interval_max = __constant_cpu_to_le16(0x0038);
  51         cp.supervision_timeout = __constant_cpu_to_le16(0x002a);
  52         cp.min_ce_len = __constant_cpu_to_le16(0x0000);
  53         cp.max_ce_len = __constant_cpu_to_le16(0x0000);
  54
  55         hci_send_cmd(hdev, HCI_OP_LE_CREATE_CONN, sizeof(cp), &cp);
  56 }
  57
  58 static void hci_le_create_connection_cancel(struct hci_conn *conn)
  59 {
  60         hci_send_cmd(conn->hdev, HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL);
  61 }
  62
  63 static void hci_acl_create_connection(struct hci_conn *conn)
  64 {
  65         struct hci_dev *hdev = conn->hdev;
  66         struct inquiry_entry *ie;
  67         struct hci_cp_create_conn cp;
  68
  69         BT_DBG("hcon %p", conn);
  70
  71         conn->state = BT_CONNECT;
  72         conn->out = true;
  73
  74         conn->link_mode = HCI_LM_MASTER;
  75
  76         conn->attempt++;
  77
  78         conn->link_policy = hdev->link_policy;
  79
  80         memset(&cp, 0, sizeof(cp));
  81         bacpy(&cp.bdaddr, &conn->dst);
  82         cp.pscan_rep_mode = 0x02;
  83
  84         ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
  85         if (ie) {
  86                 if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
  87                         cp.pscan_rep_mode = ie->data.pscan_rep_mode;
  88                         cp.pscan_mode     = ie->data.pscan_mode;
  89                         cp.clock_offset   = ie->data.clock_offset |
  90                                             __constant_cpu_to_le16(0x8000);
  91                 }
  92
  93                 memcpy(conn->dev_class, ie->data.dev_class, 3);
  94                 if (ie->data.ssp_mode > 0)
  95                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
  96         }
  97
  98         cp.pkt_type = cpu_to_le16(conn->pkt_type);
  99         if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
 100                 cp.role_switch = 0x01;
 101         else
 102                 cp.role_switch = 0x00;
 103
 104         hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
 105 }
 106
 107 static void hci_acl_create_connection_cancel(struct hci_conn *conn)
 108 {
 109         struct hci_cp_create_conn_cancel cp;
 110
 111         BT_DBG("hcon %p", conn);
 112
 113         if (conn->hdev->hci_ver < BLUETOOTH_VER_1_2)
 114                 return;
 115
 116         bacpy(&cp.bdaddr, &conn->dst);
 117         hci_send_cmd(conn->hdev, HCI_OP_CREATE_CONN_CANCEL, sizeof(cp), &cp);
 118 }
 119
 120 static void hci_reject_sco(struct hci_conn *conn)
 121 {
 122         struct hci_cp_reject_sync_conn_req cp;
 123
 124         cp.reason = HCI_ERROR_REMOTE_USER_TERM;
 125         bacpy(&cp.bdaddr, &conn->dst);
 126
 127         hci_send_cmd(conn->hdev, HCI_OP_REJECT_SYNC_CONN_REQ, sizeof(cp), &cp);
 128 }
 129
 130 void hci_disconnect(struct hci_conn *conn, __u8 reason)
 131 {
 132         struct hci_cp_disconnect cp;
 133
 134         BT_DBG("hcon %p", conn);
 135
 136         conn->state = BT_DISCONN;
 137
 138         cp.handle = cpu_to_le16(conn->handle);
 139         cp.reason = reason;
 140         hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp);
 141 }
 142
 143 static void hci_amp_disconn(struct hci_conn *conn, __u8 reason)
 144 {
 145         struct hci_cp_disconn_phy_link cp;
 146
 147         BT_DBG("hcon %p", conn);
 148
 149         conn->state = BT_DISCONN;
 150
 151         cp.phy_handle = HCI_PHY_HANDLE(conn->handle);
 152         cp.reason = reason;
 153         hci_send_cmd(conn->hdev, HCI_OP_DISCONN_PHY_LINK,
 154                      sizeof(cp), &cp);
 155 }
 156
 157 static void hci_add_sco(struct hci_conn *conn, __u16 handle)
 158 {
 159         struct hci_dev *hdev = conn->hdev;
 160         struct hci_cp_add_sco cp;
 161
 162         BT_DBG("hcon %p", conn);
 163
 164         conn->state = BT_CONNECT;
 165         conn->out = true;
 166
 167         conn->attempt++;
 168
 169         cp.handle   = cpu_to_le16(handle);
 170         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 171
 172         hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
 173 }
 174
 175 void hci_setup_sync(struct hci_conn *conn, __u16 handle)
 176 {
 177         struct hci_dev *hdev = conn->hdev;
 178         struct hci_cp_setup_sync_conn cp;
 179
 180         BT_DBG("hcon %p", conn);
 181
 182         conn->state = BT_CONNECT;
 183         conn->out = true;
 184
 185         conn->attempt++;
 186
 187         cp.handle   = cpu_to_le16(handle);
 188         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 189
 190         cp.tx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
 191         cp.rx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
 192         cp.max_latency    = __constant_cpu_to_le16(0xffff);
 193         cp.voice_setting  = cpu_to_le16(hdev->voice_setting);
 194         cp.retrans_effort = 0xff;
 195
 196         hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp);
 197 }
 198
 199 void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max,
 200                         u16 latency, u16 to_multiplier)
 201 {
 202         struct hci_cp_le_conn_update cp;
 203         struct hci_dev *hdev = conn->hdev;
 204
 205         memset(&cp, 0, sizeof(cp));
 206
 207         cp.handle               = cpu_to_le16(conn->handle);
 208         cp.conn_interval_min    = cpu_to_le16(min);
 209         cp.conn_interval_max    = cpu_to_le16(max);
 210         cp.conn_latency         = cpu_to_le16(latency);
 211         cp.supervision_timeout  = cpu_to_le16(to_multiplier);
 212         cp.min_ce_len           = __constant_cpu_to_le16(0x0001);
 213         cp.max_ce_len           = __constant_cpu_to_le16(0x0001);
 214
 215         hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp);
 216 }
 217
 218 void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __u8 rand[8],
 219                       __u8 ltk[16])
 220 {
 221         struct hci_dev *hdev = conn->hdev;
 222         struct hci_cp_le_start_enc cp;
 223
 224         BT_DBG("hcon %p", conn);
 225
 226         memset(&cp, 0, sizeof(cp));
 227
 228         cp.handle = cpu_to_le16(conn->handle);
 229         memcpy(cp.ltk, ltk, sizeof(cp.ltk));
 230         cp.ediv = ediv;
 231         memcpy(cp.rand, rand, sizeof(cp.rand));
 232
 233         hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp);
 234 }
 235
 236 /* Device _must_ be locked */
 237 void hci_sco_setup(struct hci_conn *conn, __u8 status)
 238 {
 239         struct hci_conn *sco = conn->link;
 240
 241         if (!sco)
 242                 return;
 243
 244         BT_DBG("hcon %p", conn);
 245
 246         if (!status) {
 247                 if (lmp_esco_capable(conn->hdev))
 248                         hci_setup_sync(sco, conn->handle);
 249                 else
 250                         hci_add_sco(sco, conn->handle);
 251         } else {
 252                 hci_proto_connect_cfm(sco, status);
 253                 hci_conn_del(sco);
 254         }
 255 }
 256
 257 static void hci_conn_disconnect(struct hci_conn *conn)
 258 {
 259         __u8 reason = hci_proto_disconn_ind(conn);
 260
 261         switch (conn->type) {
 262         case AMP_LINK:
 263                 hci_amp_disconn(conn, reason);
 264                 break;
 265         default:
 266                 hci_disconnect(conn, reason);
 267                 break;
 268         }
 269 }
 270
 271 static void hci_conn_timeout(struct work_struct *work)
 272 {
 273         struct hci_conn *conn = container_of(work, struct hci_conn,
 274                                              disc_work.work);
 275
 276         BT_DBG("hcon %p state %s", conn, state_to_string(conn->state));
 277
 278         if (atomic_read(&conn->refcnt))
 279                 return;
 280
 281         switch (conn->state) {
 282         case BT_CONNECT:
 283         case BT_CONNECT2:
 284                 if (conn->out) {
 285                         if (conn->type == ACL_LINK)
 286                                 hci_acl_create_connection_cancel(conn);
 287                         else if (conn->type == LE_LINK)
 288                                 hci_le_create_connection_cancel(conn);
 289                 } else if (conn->type == SCO_LINK || conn->type == ESCO_LINK) {
 290                         hci_reject_sco(conn);
 291                 }
 292                 break;
 293         case BT_CONFIG:
 294         case BT_CONNECTED:
 295                 hci_conn_disconnect(conn);
 296                 break;
 297         default:
 298                 conn->state = BT_CLOSED;
 299                 break;
 300         }
 301 }
 302
 303 /* Enter sniff mode */
 304 static void hci_conn_enter_sniff_mode(struct hci_conn *conn)
 305 {
 306         struct hci_dev *hdev = conn->hdev;
 307
 308         BT_DBG("hcon %p mode %d", conn, conn->mode);
 309
 310         if (test_bit(HCI_RAW, &hdev->flags))
 311                 return;
 312
 313         if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn))
 314                 return;
 315
 316         if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF))
 317                 return;
 318
 319         if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
 320                 struct hci_cp_sniff_subrate cp;
 321                 cp.handle             = cpu_to_le16(conn->handle);
 322                 cp.max_latency        = __constant_cpu_to_le16(0);
 323                 cp.min_remote_timeout = __constant_cpu_to_le16(0);
 324                 cp.min_local_timeout  = __constant_cpu_to_le16(0);
 325                 hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
 326         }
 327
 328         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
 329                 struct hci_cp_sniff_mode cp;
 330                 cp.handle       = cpu_to_le16(conn->handle);
 331                 cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
 332                 cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
 333                 cp.attempt      = __constant_cpu_to_le16(4);
 334                 cp.timeout      = __constant_cpu_to_le16(1);
 335                 hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
 336         }
 337 }
 338
 339 static void hci_conn_idle(unsigned long arg)
 340 {
 341         struct hci_conn *conn = (void *) arg;
 342
 343         BT_DBG("hcon %p mode %d", conn, conn->mode);
 344
 345         hci_conn_enter_sniff_mode(conn);
 346 }
 347
 348 static void hci_conn_auto_accept(unsigned long arg)
 349 {
 350         struct hci_conn *conn = (void *) arg;
 351         struct hci_dev *hdev = conn->hdev;
 352
 353         hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY, sizeof(conn->dst),
 354                      &conn->dst);
 355 }
 356
 357 struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
 358 {
 359         struct hci_conn *conn;
 360
 361         BT_DBG("%s dst %pMR", hdev->name, dst);
 362
 363         conn = kzalloc(sizeof(struct hci_conn), GFP_KERNEL);
 364         if (!conn)
 365                 return NULL;
 366
 367         bacpy(&conn->dst, dst);
 368         conn->hdev  = hdev;
 369         conn->type  = type;
 370         conn->mode  = HCI_CM_ACTIVE;
 371         conn->state = BT_OPEN;
 372         conn->auth_type = HCI_AT_GENERAL_BONDING;
 373         conn->io_capability = hdev->io_capability;
 374         conn->remote_auth = 0xff;
 375         conn->key_type = 0xff;
 376
 377         set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
 378         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
 379
 380         switch (type) {
 381         case ACL_LINK:
 382                 conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
 383                 break;
 384         case SCO_LINK:
 385                 if (lmp_esco_capable(hdev))
 386                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
 387                                         (hdev->esco_type & EDR_ESCO_MASK);
 388                 else
 389                         conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
 390                 break;
 391         case ESCO_LINK:
 392                 conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
 393                 break;
 394         }
 395
 396         skb_queue_head_init(&conn->data_q);
 397
 398         INIT_LIST_HEAD(&conn->chan_list);
 399
 400         INIT_DELAYED_WORK(&conn->disc_work, hci_conn_timeout);
 401         setup_timer(&conn->idle_timer, hci_conn_idle, (unsigned long)conn);
 402         setup_timer(&conn->auto_accept_timer, hci_conn_auto_accept,
 403                     (unsigned long) conn);
 404
 405         atomic_set(&conn->refcnt, 0);
 406
 407         hci_dev_hold(hdev);
 408
 409         hci_conn_hash_add(hdev, conn);
 410         if (hdev->notify)
 411                 hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
 412
 413         hci_conn_init_sysfs(conn);
 414
 415         return conn;
 416 }
 417
 418 int hci_conn_del(struct hci_conn *conn)
 419 {
 420         struct hci_dev *hdev = conn->hdev;
 421
 422         BT_DBG("%s hcon %p handle %d", hdev->name, conn, conn->handle);
 423
 424         del_timer(&conn->idle_timer);
 425
 426         cancel_delayed_work_sync(&conn->disc_work);
 427
 428         del_timer(&conn->auto_accept_timer);
 429
 430         if (conn->type == ACL_LINK) {
 431                 struct hci_conn *sco = conn->link;
 432                 if (sco)
 433                         sco->link = NULL;
 434
 435                 /* Unacked frames */
 436                 hdev->acl_cnt += conn->sent;
 437         } else if (conn->type == LE_LINK) {
 438                 if (hdev->le_pkts)
 439                         hdev->le_cnt += conn->sent;
 440                 else
 441                         hdev->acl_cnt += conn->sent;
 442         } else {
 443                 struct hci_conn *acl = conn->link;
 444                 if (acl) {
 445                         acl->link = NULL;
 446                         hci_conn_drop(acl);
 447                 }
 448         }
 449
 450         hci_chan_list_flush(conn);
 451
 452         if (conn->amp_mgr)
 453                 amp_mgr_put(conn->amp_mgr);
 454
 455         hci_conn_hash_del(hdev, conn);
 456         if (hdev->notify)
 457                 hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
 458
 459         skb_queue_purge(&conn->data_q);
 460
 461         hci_conn_del_sysfs(conn);
 462
 463         hci_dev_put(hdev);
 464
 465         hci_conn_put(conn);
 466
 467         return 0;
 468 }
 469
 470 struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src)
 471 {
 472         int use_src = bacmp(src, BDADDR_ANY);
 473         struct hci_dev *hdev = NULL, *d;
 474
 475         BT_DBG("%pMR -> %pMR", src, dst);
 476
 477         read_lock(&hci_dev_list_lock);
 478
 479         list_for_each_entry(d, &hci_dev_list, list) {
 480                 if (!test_bit(HCI_UP, &d->flags) ||
 481                     test_bit(HCI_RAW, &d->flags) ||
 482                     d->dev_type != HCI_BREDR)
 483                         continue;
 484
 485                 /* Simple routing:
 486                  *   No source address - find interface with bdaddr != dst
 487                  *   Source address    - find interface with bdaddr == src
 488                  */
 489
 490                 if (use_src) {
 491                         if (!bacmp(&d->bdaddr, src)) {
 492                                 hdev = d; break;
 493                         }
 494                 } else {
 495                         if (bacmp(&d->bdaddr, dst)) {
 496                                 hdev = d; break;
 497                         }
 498                 }
 499         }
 500
 501         if (hdev)
 502                 hdev = hci_dev_hold(hdev);
 503
 504         read_unlock(&hci_dev_list_lock);
 505         return hdev;
 506 }
 507 EXPORT_SYMBOL(hci_get_route);
 508
 509 static struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,
 510                                     u8 dst_type, u8 sec_level, u8 auth_type)
 511 {
 512         struct hci_conn *le;
 513
 514         if (test_bit(HCI_LE_PERIPHERAL, &hdev->flags))
 515                 return ERR_PTR(-ENOTSUPP);
 516
 517         le = hci_conn_hash_lookup_ba(hdev, LE_LINK, dst);
 518         if (!le) {
 519                 le = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
 520                 if (le)
 521                         return ERR_PTR(-EBUSY);
 522
 523                 le = hci_conn_add(hdev, LE_LINK, dst);
 524                 if (!le)
 525                         return ERR_PTR(-ENOMEM);
 526
 527                 le->dst_type = bdaddr_to_le(dst_type);
 528                 hci_le_create_connection(le);
 529         }
 530
 531         le->pending_sec_level = sec_level;
 532         le->auth_type = auth_type;
 533
 534         hci_conn_hold(le);
 535
 536         return le;
 537 }
 538
 539 static struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst,
 540                                                 u8 sec_level, u8 auth_type)
 541 {
 542         struct hci_conn *acl;
 543
 544         acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
 545         if (!acl) {
 546                 acl = hci_conn_add(hdev, ACL_LINK, dst);
 547                 if (!acl)
 548                         return ERR_PTR(-ENOMEM);
 549         }
 550
 551         hci_conn_hold(acl);
 552
 553         if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
 554                 acl->sec_level = BT_SECURITY_LOW;
 555                 acl->pending_sec_level = sec_level;
 556                 acl->auth_type = auth_type;
 557                 hci_acl_create_connection(acl);
 558         }
 559
 560         return acl;
 561 }
 562
 563 static struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type,
 564                                 bdaddr_t *dst, u8 sec_level, u8 auth_type)
 565 {
 566         struct hci_conn *acl;
 567         struct hci_conn *sco;
 568
 569         acl = hci_connect_acl(hdev, dst, sec_level, auth_type);
 570         if (IS_ERR(acl))
 571                 return acl;
 572
 573         sco = hci_conn_hash_lookup_ba(hdev, type, dst);
 574         if (!sco) {
 575                 sco = hci_conn_add(hdev, type, dst);
 576                 if (!sco) {
 577                         hci_conn_drop(acl);
 578                         return ERR_PTR(-ENOMEM);
 579                 }
 580         }
 581
 582         acl->link = sco;
 583         sco->link = acl;
 584
 585         hci_conn_hold(sco);
 586
 587         if (acl->state == BT_CONNECTED &&
 588             (sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
 589                 set_bit(HCI_CONN_POWER_SAVE, &acl->flags);
 590                 hci_conn_enter_active_mode(acl, BT_POWER_FORCE_ACTIVE_ON);
 591
 592                 if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->flags)) {
 593                         /* defer SCO setup until mode change completed */
 594                         set_bit(HCI_CONN_SCO_SETUP_PEND, &acl->flags);
 595                         return sco;
 596                 }
 597
 598                 hci_sco_setup(acl, 0x00);
 599         }
 600
 601         return sco;
 602 }
 603
 604 /* Create SCO, ACL or LE connection. */
 605 struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst,
 606                              __u8 dst_type, __u8 sec_level, __u8 auth_type)
 607 {
 608         BT_DBG("%s dst %pMR type 0x%x", hdev->name, dst, type);
 609
 610         switch (type) {
 611         case LE_LINK:
 612                 return hci_connect_le(hdev, dst, dst_type, sec_level, auth_type);
 613         case ACL_LINK:
 614                 return hci_connect_acl(hdev, dst, sec_level, auth_type);
 615         case SCO_LINK:
 616         case ESCO_LINK:
 617                 return hci_connect_sco(hdev, type, dst, sec_level, auth_type);
 618         }
 619
 620         return ERR_PTR(-EINVAL);
 621 }
 622
 623 /* Check link security requirement */
 624 int hci_conn_check_link_mode(struct hci_conn *conn)
 625 {
 626         BT_DBG("hcon %p", conn);
 627
 628         if (hci_conn_ssp_enabled(conn) && !(conn->link_mode & HCI_LM_ENCRYPT))
 629                 return 0;
 630
 631         return 1;
 632 }
 633
 634 /* Authenticate remote device */
 635 static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 636 {
 637         BT_DBG("hcon %p", conn);
 638
 639         if (conn->pending_sec_level > sec_level)
 640                 sec_level = conn->pending_sec_level;
 641
 642         if (sec_level > conn->sec_level)
 643                 conn->pending_sec_level = sec_level;
 644         else if (conn->link_mode & HCI_LM_AUTH)
 645                 return 1;
 646
 647         /* Make sure we preserve an existing MITM requirement*/
 648         auth_type |= (conn->auth_type & 0x01);
 649
 650         conn->auth_type = auth_type;
 651
 652         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
 653                 struct hci_cp_auth_requested cp;
 654
 655                 /* encrypt must be pending if auth is also pending */
 656                 set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
 657
 658                 cp.handle = cpu_to_le16(conn->handle);
 659                 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
 660                              sizeof(cp), &cp);
 661                 if (conn->key_type != 0xff)
 662                         set_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
 663         }
 664
 665         return 0;
 666 }
 667
 668 /* Encrypt the the link */
 669 static void hci_conn_encrypt(struct hci_conn *conn)
 670 {
 671         BT_DBG("hcon %p", conn);
 672
 673         if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
 674                 struct hci_cp_set_conn_encrypt cp;
 675                 cp.handle  = cpu_to_le16(conn->handle);
 676                 cp.encrypt = 0x01;
 677                 hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
 678                              &cp);
 679         }
 680 }
 681
 682 /* Enable security */
 683 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 684 {
 685         BT_DBG("hcon %p", conn);
 686
 687         if (conn->type == LE_LINK)
 688                 return smp_conn_security(conn, sec_level);
 689
 690         /* For sdp we don't need the link key. */
 691         if (sec_level == BT_SECURITY_SDP)
 692                 return 1;
 693
 694         /* For non 2.1 devices and low security level we don't need the link
 695            key. */
 696         if (sec_level == BT_SECURITY_LOW && !hci_conn_ssp_enabled(conn))
 697                 return 1;
 698
 699         /* For other security levels we need the link key. */
 700         if (!(conn->link_mode & HCI_LM_AUTH))
 701                 goto auth;
 702
 703         /* An authenticated combination key has sufficient security for any
 704            security level. */
 705         if (conn->key_type == HCI_LK_AUTH_COMBINATION)
 706                 goto encrypt;
 707
 708         /* An unauthenticated combination key has sufficient security for
 709            security level 1 and 2. */
 710         if (conn->key_type == HCI_LK_UNAUTH_COMBINATION &&
 711             (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW))
 712                 goto encrypt;
 713
 714         /* A combination key has always sufficient security for the security
 715            levels 1 or 2. High security level requires the combination key
 716            is generated using maximum PIN code length (16).
 717            For pre 2.1 units. */
 718         if (conn->key_type == HCI_LK_COMBINATION &&
 719             (sec_level != BT_SECURITY_HIGH || conn->pin_length == 16))
 720                 goto encrypt;
 721
 722 auth:
 723         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags))
 724                 return 0;
 725
 726         if (!hci_conn_auth(conn, sec_level, auth_type))
 727                 return 0;
 728
 729 encrypt:
 730         if (conn->link_mode & HCI_LM_ENCRYPT)
 731                 return 1;
 732
 733         hci_conn_encrypt(conn);
 734         return 0;
 735 }
 736 EXPORT_SYMBOL(hci_conn_security);
 737
 738 /* Check secure link requirement */
 739 int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level)
 740 {
 741         BT_DBG("hcon %p", conn);
 742
 743         if (sec_level != BT_SECURITY_HIGH)
 744                 return 1; /* Accept if non-secure is required */
 745
 746         if (conn->sec_level == BT_SECURITY_HIGH)
 747                 return 1;
 748
 749         return 0; /* Reject not secure link */
 750 }
 751 EXPORT_SYMBOL(hci_conn_check_secure);
 752
 753 /* Change link key */
 754 int hci_conn_change_link_key(struct hci_conn *conn)
 755 {
 756         BT_DBG("hcon %p", conn);
 757
 758         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
 759                 struct hci_cp_change_conn_link_key cp;
 760                 cp.handle = cpu_to_le16(conn->handle);
 761                 hci_send_cmd(conn->hdev, HCI_OP_CHANGE_CONN_LINK_KEY,
 762                              sizeof(cp), &cp);
 763         }
 764
 765         return 0;
 766 }
 767
 768 /* Switch role */
 769 int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
 770 {
 771         BT_DBG("hcon %p", conn);
 772
 773         if (!role && conn->link_mode & HCI_LM_MASTER)
 774                 return 1;
 775
 776         if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->flags)) {
 777                 struct hci_cp_switch_role cp;
 778                 bacpy(&cp.bdaddr, &conn->dst);
 779                 cp.role = role;
 780                 hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
 781         }
 782
 783         return 0;
 784 }
 785 EXPORT_SYMBOL(hci_conn_switch_role);
 786
 787 /* Enter active mode */
 788 void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
 789 {
 790         struct hci_dev *hdev = conn->hdev;
 791
 792         BT_DBG("hcon %p mode %d", conn, conn->mode);
 793
 794         if (test_bit(HCI_RAW, &hdev->flags))
 795                 return;
 796
 797         if (conn->mode != HCI_CM_SNIFF)
 798                 goto timer;
 799
 800         if (!test_bit(HCI_CONN_POWER_SAVE, &conn->flags) && !force_active)
 801                 goto timer;
 802
 803         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
 804                 struct hci_cp_exit_sniff_mode cp;
 805                 cp.handle = cpu_to_le16(conn->handle);
 806                 hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
 807         }
 808
 809 timer:
 810         if (hdev->idle_timeout > 0)
 811                 mod_timer(&conn->idle_timer,
 812                           jiffies + msecs_to_jiffies(hdev->idle_timeout));
 813 }
 814
 815 /* Drop all connection on the device */
 816 void hci_conn_hash_flush(struct hci_dev *hdev)
 817 {
 818         struct hci_conn_hash *h = &hdev->conn_hash;
 819         struct hci_conn *c, *n;
 820
 821         BT_DBG("hdev %s", hdev->name);
 822
 823         list_for_each_entry_safe(c, n, &h->list, list) {
 824                 c->state = BT_CLOSED;
 825
 826                 hci_proto_disconn_cfm(c, HCI_ERROR_LOCAL_HOST_TERM);
 827                 hci_conn_del(c);
 828         }
 829 }
 830
 831 /* Check pending connect attempts */
 832 void hci_conn_check_pending(struct hci_dev *hdev)
 833 {
 834         struct hci_conn *conn;
 835
 836         BT_DBG("hdev %s", hdev->name);
 837
 838         hci_dev_lock(hdev);
 839
 840         conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
 841         if (conn)
 842                 hci_acl_create_connection(conn);
 843
 844         hci_dev_unlock(hdev);
 845 }
 846
 847 int hci_get_conn_list(void __user *arg)
 848 {
 849         struct hci_conn *c;
 850         struct hci_conn_list_req req, *cl;
 851         struct hci_conn_info *ci;
 852         struct hci_dev *hdev;
 853         int n = 0, size, err;
 854
 855         if (copy_from_user(&req, arg, sizeof(req)))
 856                 return -EFAULT;
 857
 858         if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
 859                 return -EINVAL;
 860
 861         size = sizeof(req) + req.conn_num * sizeof(*ci);
 862
 863         cl = kmalloc(size, GFP_KERNEL);
 864         if (!cl)
 865                 return -ENOMEM;
 866
 867         hdev = hci_dev_get(req.dev_id);
 868         if (!hdev) {
 869                 kfree(cl);
 870                 return -ENODEV;
 871         }
 872
 873         ci = cl->conn_info;
 874
 875         hci_dev_lock(hdev);
 876         list_for_each_entry(c, &hdev->conn_hash.list, list) {
 877                 bacpy(&(ci + n)->bdaddr, &c->dst);
 878                 (ci + n)->handle = c->handle;
 879                 (ci + n)->type  = c->type;
 880                 (ci + n)->out   = c->out;
 881                 (ci + n)->state = c->state;
 882                 (ci + n)->link_mode = c->link_mode;
 883                 if (++n >= req.conn_num)
 884                         break;
 885         }
 886         hci_dev_unlock(hdev);
 887
 888         cl->dev_id = hdev->id;
 889         cl->conn_num = n;
 890         size = sizeof(req) + n * sizeof(*ci);
 891
 892         hci_dev_put(hdev);
 893
 894         err = copy_to_user(arg, cl, size);
 895         kfree(cl);
 896
 897         return err ? -EFAULT : 0;
 898 }
 899
 900 int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
 901 {
 902         struct hci_conn_info_req req;
 903         struct hci_conn_info ci;
 904         struct hci_conn *conn;
 905         char __user *ptr = arg + sizeof(req);
 906
 907         if (copy_from_user(&req, arg, sizeof(req)))
 908                 return -EFAULT;
 909
 910         hci_dev_lock(hdev);
 911         conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
 912         if (conn) {
 913                 bacpy(&ci.bdaddr, &conn->dst);
 914                 ci.handle = conn->handle;
 915                 ci.type  = conn->type;
 916                 ci.out   = conn->out;
 917                 ci.state = conn->state;
 918                 ci.link_mode = conn->link_mode;
 919         }
 920         hci_dev_unlock(hdev);
 921
 922         if (!conn)
 923                 return -ENOENT;
 924
 925         return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
 926 }
 927
 928 int hci_get_auth_info(struct hci_dev *hdev, void __user *arg)
 929 {
 930         struct hci_auth_info_req req;
 931         struct hci_conn *conn;
 932
 933         if (copy_from_user(&req, arg, sizeof(req)))
 934                 return -EFAULT;
 935
 936         hci_dev_lock(hdev);
 937         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr);
 938         if (conn)
 939                 req.type = conn->auth_type;
 940         hci_dev_unlock(hdev);
 941
 942         if (!conn)
 943                 return -ENOENT;
 944
 945         return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0;
 946 }
 947
 948 struct hci_chan *hci_chan_create(struct hci_conn *conn)
 949 {
 950         struct hci_dev *hdev = conn->hdev;
 951         struct hci_chan *chan;
 952
 953         BT_DBG("%s hcon %p", hdev->name, conn);
 954
 955         chan = kzalloc(sizeof(struct hci_chan), GFP_KERNEL);
 956         if (!chan)
 957                 return NULL;
 958
 959         chan->conn = conn;
 960         skb_queue_head_init(&chan->data_q);
 961         chan->state = BT_CONNECTED;
 962
 963         list_add_rcu(&chan->list, &conn->chan_list);
 964
 965         return chan;
 966 }
 967
 968 void hci_chan_del(struct hci_chan *chan)
 969 {
 970         struct hci_conn *conn = chan->conn;
 971         struct hci_dev *hdev = conn->hdev;
 972
 973         BT_DBG("%s hcon %p chan %p", hdev->name, conn, chan);
 974
 975         list_del_rcu(&chan->list);
 976
 977         synchronize_rcu();
 978
 979         hci_conn_drop(conn);
 980
 981         skb_queue_purge(&chan->data_q);
 982         kfree(chan);
 983 }
 984
 985 void hci_chan_list_flush(struct hci_conn *conn)
 986 {
 987         struct hci_chan *chan, *n;
 988
 989         BT_DBG("hcon %p", conn);
 990
 991         list_for_each_entry_safe(chan, n, &conn->chan_list, list)
 992                 hci_chan_del(chan);
 993 }
 994
 995 static struct hci_chan *__hci_chan_lookup_handle(struct hci_conn *hcon,
 996                                                  __u16 handle)
 997 {
 998         struct hci_chan *hchan;
 999
1000         list_for_each_entry(hchan, &hcon->chan_list, list) {
1001                 if (hchan->handle == handle)
1002                         return hchan;
1003         }
1004
1005         return NULL;
1006 }
1007
1008 struct hci_chan *hci_chan_lookup_handle(struct hci_dev *hdev, __u16 handle)
1009 {
1010         struct hci_conn_hash *h = &hdev->conn_hash;
1011         struct hci_conn *hcon;
1012         struct hci_chan *hchan = NULL;
1013
1014         rcu_read_lock();
1015
1016         list_for_each_entry_rcu(hcon, &h->list, list) {
1017                 hchan = __hci_chan_lookup_handle(hcon, handle);
1018                 if (hchan)
1019                         break;
1020         }
1021
1022         rcu_read_unlock();
1023
1024         return hchan;
1025 }