linux/net/bluetooth/hci_conn.c
<<
>>
Prefs
   1/*
   2   BlueZ - Bluetooth protocol stack for Linux
   3   Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7   This program is free software; you can redistribute it and/or modify
   8   it under the terms of the GNU General Public License version 2 as
   9   published by the Free Software Foundation;
  10
  11   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22   SOFTWARE IS DISCLAIMED.
  23*/
  24
  25/* Bluetooth HCI connection handling. */
  26
  27#include <linux/export.h>
  28
  29#include <net/bluetooth/bluetooth.h>
  30#include <net/bluetooth/hci_core.h>
  31#include <net/bluetooth/a2mp.h>
  32#include <net/bluetooth/smp.h>
  33
  34static void hci_le_create_connection(struct hci_conn *conn)
  35{
  36        struct hci_dev *hdev = conn->hdev;
  37        struct hci_cp_le_create_conn cp;
  38
  39        conn->state = BT_CONNECT;
  40        conn->out = true;
  41        conn->link_mode |= HCI_LM_MASTER;
  42        conn->sec_level = BT_SECURITY_LOW;
  43
  44        memset(&cp, 0, sizeof(cp));
  45        cp.scan_interval = __constant_cpu_to_le16(0x0060);
  46        cp.scan_window = __constant_cpu_to_le16(0x0030);
  47        bacpy(&cp.peer_addr, &conn->dst);
  48        cp.peer_addr_type = conn->dst_type;
  49        cp.conn_interval_min = __constant_cpu_to_le16(0x0028);
  50        cp.conn_interval_max = __constant_cpu_to_le16(0x0038);
  51        cp.supervision_timeout = __constant_cpu_to_le16(0x002a);
  52        cp.min_ce_len = __constant_cpu_to_le16(0x0000);
  53        cp.max_ce_len = __constant_cpu_to_le16(0x0000);
  54
  55        hci_send_cmd(hdev, HCI_OP_LE_CREATE_CONN, sizeof(cp), &cp);
  56}
  57
  58static void hci_le_create_connection_cancel(struct hci_conn *conn)
  59{
  60        hci_send_cmd(conn->hdev, HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL);
  61}
  62
  63static void hci_acl_create_connection(struct hci_conn *conn)
  64{
  65        struct hci_dev *hdev = conn->hdev;
  66        struct inquiry_entry *ie;
  67        struct hci_cp_create_conn cp;
  68
  69        BT_DBG("hcon %p", conn);
  70
  71        conn->state = BT_CONNECT;
  72        conn->out = true;
  73
  74        conn->link_mode = HCI_LM_MASTER;
  75
  76        conn->attempt++;
  77
  78        conn->link_policy = hdev->link_policy;
  79
  80        memset(&cp, 0, sizeof(cp));
  81        bacpy(&cp.bdaddr, &conn->dst);
  82        cp.pscan_rep_mode = 0x02;
  83
  84        ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
  85        if (ie) {
  86                if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
  87                        cp.pscan_rep_mode = ie->data.pscan_rep_mode;
  88                        cp.pscan_mode     = ie->data.pscan_mode;
  89                        cp.clock_offset   = ie->data.clock_offset |
  90                                            __constant_cpu_to_le16(0x8000);
  91                }
  92
  93                memcpy(conn->dev_class, ie->data.dev_class, 3);
  94                if (ie->data.ssp_mode > 0)
  95                        set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
  96        }
  97
  98        cp.pkt_type = cpu_to_le16(conn->pkt_type);
  99        if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
 100                cp.role_switch = 0x01;
 101        else
 102                cp.role_switch = 0x00;
 103
 104        hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
 105}
 106
 107static void hci_acl_create_connection_cancel(struct hci_conn *conn)
 108{
 109        struct hci_cp_create_conn_cancel cp;
 110
 111        BT_DBG("hcon %p", conn);
 112
 113        if (conn->hdev->hci_ver < BLUETOOTH_VER_1_2)
 114                return;
 115
 116        bacpy(&cp.bdaddr, &conn->dst);
 117        hci_send_cmd(conn->hdev, HCI_OP_CREATE_CONN_CANCEL, sizeof(cp), &cp);
 118}
 119
 120void hci_acl_disconn(struct hci_conn *conn, __u8 reason)
 121{
 122        struct hci_cp_disconnect cp;
 123
 124        BT_DBG("hcon %p", conn);
 125
 126        conn->state = BT_DISCONN;
 127
 128        cp.handle = cpu_to_le16(conn->handle);
 129        cp.reason = reason;
 130        hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp);
 131}
 132
 133static void hci_add_sco(struct hci_conn *conn, __u16 handle)
 134{
 135        struct hci_dev *hdev = conn->hdev;
 136        struct hci_cp_add_sco cp;
 137
 138        BT_DBG("hcon %p", conn);
 139
 140        conn->state = BT_CONNECT;
 141        conn->out = true;
 142
 143        conn->attempt++;
 144
 145        cp.handle   = cpu_to_le16(handle);
 146        cp.pkt_type = cpu_to_le16(conn->pkt_type);
 147
 148        hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
 149}
 150
 151void hci_setup_sync(struct hci_conn *conn, __u16 handle)
 152{
 153        struct hci_dev *hdev = conn->hdev;
 154        struct hci_cp_setup_sync_conn cp;
 155
 156        BT_DBG("hcon %p", conn);
 157
 158        conn->state = BT_CONNECT;
 159        conn->out = true;
 160
 161        conn->attempt++;
 162
 163        cp.handle   = cpu_to_le16(handle);
 164        cp.pkt_type = cpu_to_le16(conn->pkt_type);
 165
 166        cp.tx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
 167        cp.rx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
 168        cp.max_latency    = __constant_cpu_to_le16(0xffff);
 169        cp.voice_setting  = cpu_to_le16(hdev->voice_setting);
 170        cp.retrans_effort = 0xff;
 171
 172        hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp);
 173}
 174
 175void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max,
 176                        u16 latency, u16 to_multiplier)
 177{
 178        struct hci_cp_le_conn_update cp;
 179        struct hci_dev *hdev = conn->hdev;
 180
 181        memset(&cp, 0, sizeof(cp));
 182
 183        cp.handle               = cpu_to_le16(conn->handle);
 184        cp.conn_interval_min    = cpu_to_le16(min);
 185        cp.conn_interval_max    = cpu_to_le16(max);
 186        cp.conn_latency         = cpu_to_le16(latency);
 187        cp.supervision_timeout  = cpu_to_le16(to_multiplier);
 188        cp.min_ce_len           = __constant_cpu_to_le16(0x0001);
 189        cp.max_ce_len           = __constant_cpu_to_le16(0x0001);
 190
 191        hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp);
 192}
 193
 194void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __u8 rand[8],
 195                      __u8 ltk[16])
 196{
 197        struct hci_dev *hdev = conn->hdev;
 198        struct hci_cp_le_start_enc cp;
 199
 200        BT_DBG("hcon %p", conn);
 201
 202        memset(&cp, 0, sizeof(cp));
 203
 204        cp.handle = cpu_to_le16(conn->handle);
 205        memcpy(cp.ltk, ltk, sizeof(cp.ltk));
 206        cp.ediv = ediv;
 207        memcpy(cp.rand, rand, sizeof(cp.rand));
 208
 209        hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp);
 210}
 211
 212/* Device _must_ be locked */
 213void hci_sco_setup(struct hci_conn *conn, __u8 status)
 214{
 215        struct hci_conn *sco = conn->link;
 216
 217        if (!sco)
 218                return;
 219
 220        BT_DBG("hcon %p", conn);
 221
 222        if (!status) {
 223                if (lmp_esco_capable(conn->hdev))
 224                        hci_setup_sync(sco, conn->handle);
 225                else
 226                        hci_add_sco(sco, conn->handle);
 227        } else {
 228                hci_proto_connect_cfm(sco, status);
 229                hci_conn_del(sco);
 230        }
 231}
 232
 233static void hci_conn_timeout(struct work_struct *work)
 234{
 235        struct hci_conn *conn = container_of(work, struct hci_conn,
 236                                             disc_work.work);
 237        __u8 reason;
 238
 239        BT_DBG("hcon %p state %s", conn, state_to_string(conn->state));
 240
 241        if (atomic_read(&conn->refcnt))
 242                return;
 243
 244        switch (conn->state) {
 245        case BT_CONNECT:
 246        case BT_CONNECT2:
 247                if (conn->out) {
 248                        if (conn->type == ACL_LINK)
 249                                hci_acl_create_connection_cancel(conn);
 250                        else if (conn->type == LE_LINK)
 251                                hci_le_create_connection_cancel(conn);
 252                }
 253                break;
 254        case BT_CONFIG:
 255        case BT_CONNECTED:
 256                reason = hci_proto_disconn_ind(conn);
 257                hci_acl_disconn(conn, reason);
 258                break;
 259        default:
 260                conn->state = BT_CLOSED;
 261                break;
 262        }
 263}
 264
 265/* Enter sniff mode */
 266static void hci_conn_enter_sniff_mode(struct hci_conn *conn)
 267{
 268        struct hci_dev *hdev = conn->hdev;
 269
 270        BT_DBG("hcon %p mode %d", conn, conn->mode);
 271
 272        if (test_bit(HCI_RAW, &hdev->flags))
 273                return;
 274
 275        if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn))
 276                return;
 277
 278        if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF))
 279                return;
 280
 281        if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
 282                struct hci_cp_sniff_subrate cp;
 283                cp.handle             = cpu_to_le16(conn->handle);
 284                cp.max_latency        = __constant_cpu_to_le16(0);
 285                cp.min_remote_timeout = __constant_cpu_to_le16(0);
 286                cp.min_local_timeout  = __constant_cpu_to_le16(0);
 287                hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
 288        }
 289
 290        if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
 291                struct hci_cp_sniff_mode cp;
 292                cp.handle       = cpu_to_le16(conn->handle);
 293                cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
 294                cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
 295                cp.attempt      = __constant_cpu_to_le16(4);
 296                cp.timeout      = __constant_cpu_to_le16(1);
 297                hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
 298        }
 299}
 300
 301static void hci_conn_idle(unsigned long arg)
 302{
 303        struct hci_conn *conn = (void *) arg;
 304
 305        BT_DBG("hcon %p mode %d", conn, conn->mode);
 306
 307        hci_conn_enter_sniff_mode(conn);
 308}
 309
 310static void hci_conn_auto_accept(unsigned long arg)
 311{
 312        struct hci_conn *conn = (void *) arg;
 313        struct hci_dev *hdev = conn->hdev;
 314
 315        hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY, sizeof(conn->dst),
 316                     &conn->dst);
 317}
 318
 319struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
 320{
 321        struct hci_conn *conn;
 322
 323        BT_DBG("%s dst %s", hdev->name, batostr(dst));
 324
 325        conn = kzalloc(sizeof(struct hci_conn), GFP_KERNEL);
 326        if (!conn)
 327                return NULL;
 328
 329        bacpy(&conn->dst, dst);
 330        conn->hdev  = hdev;
 331        conn->type  = type;
 332        conn->mode  = HCI_CM_ACTIVE;
 333        conn->state = BT_OPEN;
 334        conn->auth_type = HCI_AT_GENERAL_BONDING;
 335        conn->io_capability = hdev->io_capability;
 336        conn->remote_auth = 0xff;
 337        conn->key_type = 0xff;
 338
 339        set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
 340        conn->disc_timeout = HCI_DISCONN_TIMEOUT;
 341
 342        switch (type) {
 343        case ACL_LINK:
 344                conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
 345                break;
 346        case SCO_LINK:
 347                if (lmp_esco_capable(hdev))
 348                        conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
 349                                        (hdev->esco_type & EDR_ESCO_MASK);
 350                else
 351                        conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
 352                break;
 353        case ESCO_LINK:
 354                conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
 355                break;
 356        }
 357
 358        skb_queue_head_init(&conn->data_q);
 359
 360        INIT_LIST_HEAD(&conn->chan_list);
 361
 362        INIT_DELAYED_WORK(&conn->disc_work, hci_conn_timeout);
 363        setup_timer(&conn->idle_timer, hci_conn_idle, (unsigned long)conn);
 364        setup_timer(&conn->auto_accept_timer, hci_conn_auto_accept,
 365                    (unsigned long) conn);
 366
 367        atomic_set(&conn->refcnt, 0);
 368
 369        hci_dev_hold(hdev);
 370
 371        hci_conn_hash_add(hdev, conn);
 372        if (hdev->notify)
 373                hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
 374
 375        atomic_set(&conn->devref, 0);
 376
 377        hci_conn_init_sysfs(conn);
 378
 379        return conn;
 380}
 381
 382int hci_conn_del(struct hci_conn *conn)
 383{
 384        struct hci_dev *hdev = conn->hdev;
 385
 386        BT_DBG("%s hcon %p handle %d", hdev->name, conn, conn->handle);
 387
 388        del_timer(&conn->idle_timer);
 389
 390        cancel_delayed_work_sync(&conn->disc_work);
 391
 392        del_timer(&conn->auto_accept_timer);
 393
 394        if (conn->type == ACL_LINK) {
 395                struct hci_conn *sco = conn->link;
 396                if (sco)
 397                        sco->link = NULL;
 398
 399                /* Unacked frames */
 400                hdev->acl_cnt += conn->sent;
 401        } else if (conn->type == LE_LINK) {
 402                if (hdev->le_pkts)
 403                        hdev->le_cnt += conn->sent;
 404                else
 405                        hdev->acl_cnt += conn->sent;
 406        } else {
 407                struct hci_conn *acl = conn->link;
 408                if (acl) {
 409                        acl->link = NULL;
 410                        hci_conn_put(acl);
 411                }
 412        }
 413
 414        hci_chan_list_flush(conn);
 415
 416        if (conn->amp_mgr)
 417                amp_mgr_put(conn->amp_mgr);
 418
 419        hci_conn_hash_del(hdev, conn);
 420        if (hdev->notify)
 421                hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
 422
 423        skb_queue_purge(&conn->data_q);
 424
 425        hci_conn_put_device(conn);
 426
 427        hci_dev_put(hdev);
 428
 429        if (conn->handle == 0)
 430                kfree(conn);
 431
 432        return 0;
 433}
 434
 435struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src)
 436{
 437        int use_src = bacmp(src, BDADDR_ANY);
 438        struct hci_dev *hdev = NULL, *d;
 439
 440        BT_DBG("%s -> %s", batostr(src), batostr(dst));
 441
 442        read_lock(&hci_dev_list_lock);
 443
 444        list_for_each_entry(d, &hci_dev_list, list) {
 445                if (!test_bit(HCI_UP, &d->flags) ||
 446                    test_bit(HCI_RAW, &d->flags) ||
 447                    d->dev_type != HCI_BREDR)
 448                        continue;
 449
 450                /* Simple routing:
 451                 *   No source address - find interface with bdaddr != dst
 452                 *   Source address    - find interface with bdaddr == src
 453                 */
 454
 455                if (use_src) {
 456                        if (!bacmp(&d->bdaddr, src)) {
 457                                hdev = d; break;
 458                        }
 459                } else {
 460                        if (bacmp(&d->bdaddr, dst)) {
 461                                hdev = d; break;
 462                        }
 463                }
 464        }
 465
 466        if (hdev)
 467                hdev = hci_dev_hold(hdev);
 468
 469        read_unlock(&hci_dev_list_lock);
 470        return hdev;
 471}
 472EXPORT_SYMBOL(hci_get_route);
 473
 474static struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,
 475                                    u8 dst_type, u8 sec_level, u8 auth_type)
 476{
 477        struct hci_conn *le;
 478
 479        le = hci_conn_hash_lookup_ba(hdev, LE_LINK, dst);
 480        if (!le) {
 481                le = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
 482                if (le)
 483                        return ERR_PTR(-EBUSY);
 484
 485                le = hci_conn_add(hdev, LE_LINK, dst);
 486                if (!le)
 487                        return ERR_PTR(-ENOMEM);
 488
 489                le->dst_type = bdaddr_to_le(dst_type);
 490                hci_le_create_connection(le);
 491        }
 492
 493        le->pending_sec_level = sec_level;
 494        le->auth_type = auth_type;
 495
 496        hci_conn_hold(le);
 497
 498        return le;
 499}
 500
 501static struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst,
 502                                                u8 sec_level, u8 auth_type)
 503{
 504        struct hci_conn *acl;
 505
 506        acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
 507        if (!acl) {
 508                acl = hci_conn_add(hdev, ACL_LINK, dst);
 509                if (!acl)
 510                        return ERR_PTR(-ENOMEM);
 511        }
 512
 513        hci_conn_hold(acl);
 514
 515        if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
 516                acl->sec_level = BT_SECURITY_LOW;
 517                acl->pending_sec_level = sec_level;
 518                acl->auth_type = auth_type;
 519                hci_acl_create_connection(acl);
 520        }
 521
 522        return acl;
 523}
 524
 525static struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type,
 526                                bdaddr_t *dst, u8 sec_level, u8 auth_type)
 527{
 528        struct hci_conn *acl;
 529        struct hci_conn *sco;
 530
 531        acl = hci_connect_acl(hdev, dst, sec_level, auth_type);
 532        if (IS_ERR(acl))
 533                return acl;
 534
 535        sco = hci_conn_hash_lookup_ba(hdev, type, dst);
 536        if (!sco) {
 537                sco = hci_conn_add(hdev, type, dst);
 538                if (!sco) {
 539                        hci_conn_put(acl);
 540                        return ERR_PTR(-ENOMEM);
 541                }
 542        }
 543
 544        acl->link = sco;
 545        sco->link = acl;
 546
 547        hci_conn_hold(sco);
 548
 549        if (acl->state == BT_CONNECTED &&
 550            (sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
 551                set_bit(HCI_CONN_POWER_SAVE, &acl->flags);
 552                hci_conn_enter_active_mode(acl, BT_POWER_FORCE_ACTIVE_ON);
 553
 554                if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->flags)) {
 555                        /* defer SCO setup until mode change completed */
 556                        set_bit(HCI_CONN_SCO_SETUP_PEND, &acl->flags);
 557                        return sco;
 558                }
 559
 560                hci_sco_setup(acl, 0x00);
 561        }
 562
 563        return sco;
 564}
 565
 566/* Create SCO, ACL or LE connection. */
 567struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst,
 568                             __u8 dst_type, __u8 sec_level, __u8 auth_type)
 569{
 570        BT_DBG("%s dst %s type 0x%x", hdev->name, batostr(dst), type);
 571
 572        switch (type) {
 573        case LE_LINK:
 574                return hci_connect_le(hdev, dst, dst_type, sec_level, auth_type);
 575        case ACL_LINK:
 576                return hci_connect_acl(hdev, dst, sec_level, auth_type);
 577        case SCO_LINK:
 578        case ESCO_LINK:
 579                return hci_connect_sco(hdev, type, dst, sec_level, auth_type);
 580        }
 581
 582        return ERR_PTR(-EINVAL);
 583}
 584
 585/* Check link security requirement */
 586int hci_conn_check_link_mode(struct hci_conn *conn)
 587{
 588        BT_DBG("hcon %p", conn);
 589
 590        if (hci_conn_ssp_enabled(conn) && !(conn->link_mode & HCI_LM_ENCRYPT))
 591                return 0;
 592
 593        return 1;
 594}
 595
 596/* Authenticate remote device */
 597static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 598{
 599        BT_DBG("hcon %p", conn);
 600
 601        if (conn->pending_sec_level > sec_level)
 602                sec_level = conn->pending_sec_level;
 603
 604        if (sec_level > conn->sec_level)
 605                conn->pending_sec_level = sec_level;
 606        else if (conn->link_mode & HCI_LM_AUTH)
 607                return 1;
 608
 609        /* Make sure we preserve an existing MITM requirement*/
 610        auth_type |= (conn->auth_type & 0x01);
 611
 612        conn->auth_type = auth_type;
 613
 614        if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
 615                struct hci_cp_auth_requested cp;
 616
 617                /* encrypt must be pending if auth is also pending */
 618                set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
 619
 620                cp.handle = cpu_to_le16(conn->handle);
 621                hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
 622                             sizeof(cp), &cp);
 623                if (conn->key_type != 0xff)
 624                        set_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
 625        }
 626
 627        return 0;
 628}
 629
 630/* Encrypt the the link */
 631static void hci_conn_encrypt(struct hci_conn *conn)
 632{
 633        BT_DBG("hcon %p", conn);
 634
 635        if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
 636                struct hci_cp_set_conn_encrypt cp;
 637                cp.handle  = cpu_to_le16(conn->handle);
 638                cp.encrypt = 0x01;
 639                hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
 640                             &cp);
 641        }
 642}
 643
 644/* Enable security */
 645int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 646{
 647        BT_DBG("hcon %p", conn);
 648
 649        if (conn->type == LE_LINK)
 650                return smp_conn_security(conn, sec_level);
 651
 652        /* For sdp we don't need the link key. */
 653        if (sec_level == BT_SECURITY_SDP)
 654                return 1;
 655
 656        /* For non 2.1 devices and low security level we don't need the link
 657           key. */
 658        if (sec_level == BT_SECURITY_LOW && !hci_conn_ssp_enabled(conn))
 659                return 1;
 660
 661        /* For other security levels we need the link key. */
 662        if (!(conn->link_mode & HCI_LM_AUTH))
 663                goto auth;
 664
 665        /* An authenticated combination key has sufficient security for any
 666           security level. */
 667        if (conn->key_type == HCI_LK_AUTH_COMBINATION)
 668                goto encrypt;
 669
 670        /* An unauthenticated combination key has sufficient security for
 671           security level 1 and 2. */
 672        if (conn->key_type == HCI_LK_UNAUTH_COMBINATION &&
 673            (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW))
 674                goto encrypt;
 675
 676        /* A combination key has always sufficient security for the security
 677           levels 1 or 2. High security level requires the combination key
 678           is generated using maximum PIN code length (16).
 679           For pre 2.1 units. */
 680        if (conn->key_type == HCI_LK_COMBINATION &&
 681            (sec_level != BT_SECURITY_HIGH || conn->pin_length == 16))
 682                goto encrypt;
 683
 684auth:
 685        if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags))
 686                return 0;
 687
 688        if (!hci_conn_auth(conn, sec_level, auth_type))
 689                return 0;
 690
 691encrypt:
 692        if (conn->link_mode & HCI_LM_ENCRYPT)
 693                return 1;
 694
 695        hci_conn_encrypt(conn);
 696        return 0;
 697}
 698EXPORT_SYMBOL(hci_conn_security);
 699
 700/* Check secure link requirement */
 701int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level)
 702{
 703        BT_DBG("hcon %p", conn);
 704
 705        if (sec_level != BT_SECURITY_HIGH)
 706                return 1; /* Accept if non-secure is required */
 707
 708        if (conn->sec_level == BT_SECURITY_HIGH)
 709                return 1;
 710
 711        return 0; /* Reject not secure link */
 712}
 713EXPORT_SYMBOL(hci_conn_check_secure);
 714
 715/* Change link key */
 716int hci_conn_change_link_key(struct hci_conn *conn)
 717{
 718        BT_DBG("hcon %p", conn);
 719
 720        if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
 721                struct hci_cp_change_conn_link_key cp;
 722                cp.handle = cpu_to_le16(conn->handle);
 723                hci_send_cmd(conn->hdev, HCI_OP_CHANGE_CONN_LINK_KEY,
 724                             sizeof(cp), &cp);
 725        }
 726
 727        return 0;
 728}
 729
 730/* Switch role */
 731int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
 732{
 733        BT_DBG("hcon %p", conn);
 734
 735        if (!role && conn->link_mode & HCI_LM_MASTER)
 736                return 1;
 737
 738        if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->flags)) {
 739                struct hci_cp_switch_role cp;
 740                bacpy(&cp.bdaddr, &conn->dst);
 741                cp.role = role;
 742                hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
 743        }
 744
 745        return 0;
 746}
 747EXPORT_SYMBOL(hci_conn_switch_role);
 748
 749/* Enter active mode */
 750void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
 751{
 752        struct hci_dev *hdev = conn->hdev;
 753
 754        BT_DBG("hcon %p mode %d", conn, conn->mode);
 755
 756        if (test_bit(HCI_RAW, &hdev->flags))
 757                return;
 758
 759        if (conn->mode != HCI_CM_SNIFF)
 760                goto timer;
 761
 762        if (!test_bit(HCI_CONN_POWER_SAVE, &conn->flags) && !force_active)
 763                goto timer;
 764
 765        if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
 766                struct hci_cp_exit_sniff_mode cp;
 767                cp.handle = cpu_to_le16(conn->handle);
 768                hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
 769        }
 770
 771timer:
 772        if (hdev->idle_timeout > 0)
 773                mod_timer(&conn->idle_timer,
 774                          jiffies + msecs_to_jiffies(hdev->idle_timeout));
 775}
 776
 777/* Drop all connection on the device */
 778void hci_conn_hash_flush(struct hci_dev *hdev)
 779{
 780        struct hci_conn_hash *h = &hdev->conn_hash;
 781        struct hci_conn *c, *n;
 782
 783        BT_DBG("hdev %s", hdev->name);
 784
 785        list_for_each_entry_safe(c, n, &h->list, list) {
 786                c->state = BT_CLOSED;
 787
 788                hci_proto_disconn_cfm(c, HCI_ERROR_LOCAL_HOST_TERM);
 789                hci_conn_del(c);
 790        }
 791}
 792
 793/* Check pending connect attempts */
 794void hci_conn_check_pending(struct hci_dev *hdev)
 795{
 796        struct hci_conn *conn;
 797
 798        BT_DBG("hdev %s", hdev->name);
 799
 800        hci_dev_lock(hdev);
 801
 802        conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
 803        if (conn)
 804                hci_acl_create_connection(conn);
 805
 806        hci_dev_unlock(hdev);
 807}
 808
 809void hci_conn_hold_device(struct hci_conn *conn)
 810{
 811        atomic_inc(&conn->devref);
 812}
 813EXPORT_SYMBOL(hci_conn_hold_device);
 814
 815void hci_conn_put_device(struct hci_conn *conn)
 816{
 817        if (atomic_dec_and_test(&conn->devref))
 818                hci_conn_del_sysfs(conn);
 819}
 820EXPORT_SYMBOL(hci_conn_put_device);
 821
 822int hci_get_conn_list(void __user *arg)
 823{
 824        struct hci_conn *c;
 825        struct hci_conn_list_req req, *cl;
 826        struct hci_conn_info *ci;
 827        struct hci_dev *hdev;
 828        int n = 0, size, err;
 829
 830        if (copy_from_user(&req, arg, sizeof(req)))
 831                return -EFAULT;
 832
 833        if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
 834                return -EINVAL;
 835
 836        size = sizeof(req) + req.conn_num * sizeof(*ci);
 837
 838        cl = kmalloc(size, GFP_KERNEL);
 839        if (!cl)
 840                return -ENOMEM;
 841
 842        hdev = hci_dev_get(req.dev_id);
 843        if (!hdev) {
 844                kfree(cl);
 845                return -ENODEV;
 846        }
 847
 848        ci = cl->conn_info;
 849
 850        hci_dev_lock(hdev);
 851        list_for_each_entry(c, &hdev->conn_hash.list, list) {
 852                bacpy(&(ci + n)->bdaddr, &c->dst);
 853                (ci + n)->handle = c->handle;
 854                (ci + n)->type  = c->type;
 855                (ci + n)->out   = c->out;
 856                (ci + n)->state = c->state;
 857                (ci + n)->link_mode = c->link_mode;
 858                if (++n >= req.conn_num)
 859                        break;
 860        }
 861        hci_dev_unlock(hdev);
 862
 863        cl->dev_id = hdev->id;
 864        cl->conn_num = n;
 865        size = sizeof(req) + n * sizeof(*ci);
 866
 867        hci_dev_put(hdev);
 868
 869        err = copy_to_user(arg, cl, size);
 870        kfree(cl);
 871
 872        return err ? -EFAULT : 0;
 873}
 874
 875int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
 876{
 877        struct hci_conn_info_req req;
 878        struct hci_conn_info ci;
 879        struct hci_conn *conn;
 880        char __user *ptr = arg + sizeof(req);
 881
 882        if (copy_from_user(&req, arg, sizeof(req)))
 883                return -EFAULT;
 884
 885        hci_dev_lock(hdev);
 886        conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
 887        if (conn) {
 888                bacpy(&ci.bdaddr, &conn->dst);
 889                ci.handle = conn->handle;
 890                ci.type  = conn->type;
 891                ci.out   = conn->out;
 892                ci.state = conn->state;
 893                ci.link_mode = conn->link_mode;
 894        }
 895        hci_dev_unlock(hdev);
 896
 897        if (!conn)
 898                return -ENOENT;
 899
 900        return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
 901}
 902
 903int hci_get_auth_info(struct hci_dev *hdev, void __user *arg)
 904{
 905        struct hci_auth_info_req req;
 906        struct hci_conn *conn;
 907
 908        if (copy_from_user(&req, arg, sizeof(req)))
 909                return -EFAULT;
 910
 911        hci_dev_lock(hdev);
 912        conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr);
 913        if (conn)
 914                req.type = conn->auth_type;
 915        hci_dev_unlock(hdev);
 916
 917        if (!conn)
 918                return -ENOENT;
 919
 920        return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0;
 921}
 922
 923struct hci_chan *hci_chan_create(struct hci_conn *conn)
 924{
 925        struct hci_dev *hdev = conn->hdev;
 926        struct hci_chan *chan;
 927
 928        BT_DBG("%s hcon %p", hdev->name, conn);
 929
 930        chan = kzalloc(sizeof(struct hci_chan), GFP_KERNEL);
 931        if (!chan)
 932                return NULL;
 933
 934        chan->conn = conn;
 935        skb_queue_head_init(&chan->data_q);
 936
 937        list_add_rcu(&chan->list, &conn->chan_list);
 938
 939        return chan;
 940}
 941
 942void hci_chan_del(struct hci_chan *chan)
 943{
 944        struct hci_conn *conn = chan->conn;
 945        struct hci_dev *hdev = conn->hdev;
 946
 947        BT_DBG("%s hcon %p chan %p", hdev->name, conn, chan);
 948
 949        list_del_rcu(&chan->list);
 950
 951        synchronize_rcu();
 952
 953        skb_queue_purge(&chan->data_q);
 954        kfree(chan);
 955}
 956
 957void hci_chan_list_flush(struct hci_conn *conn)
 958{
 959        struct hci_chan *chan, *n;
 960
 961        BT_DBG("hcon %p", conn);
 962
 963        list_for_each_entry_safe(chan, n, &conn->chan_list, list)
 964                hci_chan_del(chan);
 965}
 966
lxr.linux.no kindly hosted by Redpill Linpro AS, provider of Linux consulting and operations services since 1995.