1 /* 2 BlueZ - Bluetooth protocol stack for Linux 3 Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved. 4 5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com> 6 7 This program is free software; you can redistribute it and/or modify 8 it under the terms of the GNU General Public License version 2 as 9 published by the Free Software Foundation; 10 11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 19 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 22 SOFTWARE IS DISCLAIMED. 23 */ 24 25 /* Bluetooth HCI connection handling. */ 26 27 #include <linux/module.h> 28 29 #include <linux/types.h> 30 #include <linux/errno.h> 31 #include <linux/kernel.h> 32 #include <linux/slab.h> 33 #include <linux/poll.h> 34 #include <linux/fcntl.h> 35 #include <linux/init.h> 36 #include <linux/skbuff.h> 37 #include <linux/interrupt.h> 38 #include <linux/notifier.h> 39 #include <net/sock.h> 40 41 #include <asm/system.h> 42 #include <linux/uaccess.h> 43 #include <asm/unaligned.h> 44 45 #include <net/bluetooth/bluetooth.h> 46 #include <net/bluetooth/hci_core.h> 47 48 static void hci_le_connect(struct hci_conn *conn) 49 { 50 struct hci_dev *hdev = conn->hdev; 51 struct hci_cp_le_create_conn cp; 52 53 conn->state = BT_CONNECT; 54 conn->out = 1; 55 conn->link_mode |= HCI_LM_MASTER; 56 conn->sec_level = BT_SECURITY_LOW; 57 58 memset(&cp, 0, sizeof(cp)); 59 cp.scan_interval = cpu_to_le16(0x0060); 60 cp.scan_window = cpu_to_le16(0x0030); 61 bacpy(&cp.peer_addr, &conn->dst); 62 cp.peer_addr_type = conn->dst_type; 63 cp.conn_interval_min = cpu_to_le16(0x0028); 64 cp.conn_interval_max = cpu_to_le16(0x0038); 65 cp.supervision_timeout = cpu_to_le16(0x002a); 66 cp.min_ce_len = cpu_to_le16(0x0000); 67 cp.max_ce_len = cpu_to_le16(0x0000); 68 69 hci_send_cmd(hdev, HCI_OP_LE_CREATE_CONN, sizeof(cp), &cp); 70 } 71 72 static void hci_le_connect_cancel(struct hci_conn *conn) 73 { 74 hci_send_cmd(conn->hdev, HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL); 75 } 76 77 void hci_acl_connect(struct hci_conn *conn) 78 { 79 struct hci_dev *hdev = conn->hdev; 80 struct inquiry_entry *ie; 81 struct hci_cp_create_conn cp; 82 83 BT_DBG("%p", conn); 84 85 conn->state = BT_CONNECT; 86 conn->out = 1; 87 88 conn->link_mode = HCI_LM_MASTER; 89 90 conn->attempt++; 91 92 conn->link_policy = hdev->link_policy; 93 94 memset(&cp, 0, sizeof(cp)); 95 bacpy(&cp.bdaddr, &conn->dst); 96 cp.pscan_rep_mode = 0x02; 97 98 ie = hci_inquiry_cache_lookup(hdev, &conn->dst); 99 if (ie) { 100 if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) { 101 cp.pscan_rep_mode = ie->data.pscan_rep_mode; 102 cp.pscan_mode = ie->data.pscan_mode; 103 cp.clock_offset = ie->data.clock_offset | 104 cpu_to_le16(0x8000); 105 } 106 107 memcpy(conn->dev_class, ie->data.dev_class, 3); 108 conn->ssp_mode = ie->data.ssp_mode; 109 } 110 111 cp.pkt_type = cpu_to_le16(conn->pkt_type); 112 if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER)) 113 cp.role_switch = 0x01; 114 else 115 cp.role_switch = 0x00; 116 117 hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp); 118 } 119 120 static void hci_acl_connect_cancel(struct hci_conn *conn) 121 { 122 struct hci_cp_create_conn_cancel cp; 123 124 BT_DBG("%p", conn); 125 126 if (conn->hdev->hci_ver < BLUETOOTH_VER_1_2) 127 return; 128 129 bacpy(&cp.bdaddr, &conn->dst); 130 hci_send_cmd(conn->hdev, HCI_OP_CREATE_CONN_CANCEL, sizeof(cp), &cp); 131 } 132 133 void hci_acl_disconn(struct hci_conn *conn, __u8 reason) 134 { 135 struct hci_cp_disconnect cp; 136 137 BT_DBG("%p", conn); 138 139 conn->state = BT_DISCONN; 140 141 cp.handle = cpu_to_le16(conn->handle); 142 cp.reason = reason; 143 hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp); 144 } 145 146 void hci_add_sco(struct hci_conn *conn, __u16 handle) 147 { 148 struct hci_dev *hdev = conn->hdev; 149 struct hci_cp_add_sco cp; 150 151 BT_DBG("%p", conn); 152 153 conn->state = BT_CONNECT; 154 conn->out = 1; 155 156 conn->attempt++; 157 158 cp.handle = cpu_to_le16(handle); 159 cp.pkt_type = cpu_to_le16(conn->pkt_type); 160 161 hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp); 162 } 163 164 void hci_setup_sync(struct hci_conn *conn, __u16 handle) 165 { 166 struct hci_dev *hdev = conn->hdev; 167 struct hci_cp_setup_sync_conn cp; 168 169 BT_DBG("%p", conn); 170 171 conn->state = BT_CONNECT; 172 conn->out = 1; 173 174 conn->attempt++; 175 176 cp.handle = cpu_to_le16(handle); 177 cp.pkt_type = cpu_to_le16(conn->pkt_type); 178 179 cp.tx_bandwidth = cpu_to_le32(0x00001f40); 180 cp.rx_bandwidth = cpu_to_le32(0x00001f40); 181 cp.max_latency = cpu_to_le16(0xffff); 182 cp.voice_setting = cpu_to_le16(hdev->voice_setting); 183 cp.retrans_effort = 0xff; 184 185 hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp); 186 } 187 188 void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max, 189 u16 latency, u16 to_multiplier) 190 { 191 struct hci_cp_le_conn_update cp; 192 struct hci_dev *hdev = conn->hdev; 193 194 memset(&cp, 0, sizeof(cp)); 195 196 cp.handle = cpu_to_le16(conn->handle); 197 cp.conn_interval_min = cpu_to_le16(min); 198 cp.conn_interval_max = cpu_to_le16(max); 199 cp.conn_latency = cpu_to_le16(latency); 200 cp.supervision_timeout = cpu_to_le16(to_multiplier); 201 cp.min_ce_len = cpu_to_le16(0x0001); 202 cp.max_ce_len = cpu_to_le16(0x0001); 203 204 hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp); 205 } 206 EXPORT_SYMBOL(hci_le_conn_update); 207 208 void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __u8 rand[8], 209 __u8 ltk[16]) 210 { 211 struct hci_dev *hdev = conn->hdev; 212 struct hci_cp_le_start_enc cp; 213 214 BT_DBG("%p", conn); 215 216 memset(&cp, 0, sizeof(cp)); 217 218 cp.handle = cpu_to_le16(conn->handle); 219 memcpy(cp.ltk, ltk, sizeof(cp.ltk)); 220 cp.ediv = ediv; 221 memcpy(cp.rand, rand, sizeof(cp.rand)); 222 223 hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp); 224 } 225 EXPORT_SYMBOL(hci_le_start_enc); 226 227 void hci_le_ltk_reply(struct hci_conn *conn, u8 ltk[16]) 228 { 229 struct hci_dev *hdev = conn->hdev; 230 struct hci_cp_le_ltk_reply cp; 231 232 BT_DBG("%p", conn); 233 234 memset(&cp, 0, sizeof(cp)); 235 236 cp.handle = cpu_to_le16(conn->handle); 237 memcpy(cp.ltk, ltk, sizeof(ltk)); 238 239 hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp); 240 } 241 EXPORT_SYMBOL(hci_le_ltk_reply); 242 243 void hci_le_ltk_neg_reply(struct hci_conn *conn) 244 { 245 struct hci_dev *hdev = conn->hdev; 246 struct hci_cp_le_ltk_neg_reply cp; 247 248 BT_DBG("%p", conn); 249 250 memset(&cp, 0, sizeof(cp)); 251 252 cp.handle = cpu_to_le16(conn->handle); 253 254 hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(cp), &cp); 255 } 256 257 /* Device _must_ be locked */ 258 void hci_sco_setup(struct hci_conn *conn, __u8 status) 259 { 260 struct hci_conn *sco = conn->link; 261 262 BT_DBG("%p", conn); 263 264 if (!sco) 265 return; 266 267 if (!status) { 268 if (lmp_esco_capable(conn->hdev)) 269 hci_setup_sync(sco, conn->handle); 270 else 271 hci_add_sco(sco, conn->handle); 272 } else { 273 hci_proto_connect_cfm(sco, status); 274 hci_conn_del(sco); 275 } 276 } 277 278 static void hci_conn_timeout(struct work_struct *work) 279 { 280 struct hci_conn *conn = container_of(work, struct hci_conn, 281 disc_work.work); 282 struct hci_dev *hdev = conn->hdev; 283 __u8 reason; 284 285 BT_DBG("conn %p state %d", conn, conn->state); 286 287 if (atomic_read(&conn->refcnt)) 288 return; 289 290 hci_dev_lock(hdev); 291 292 switch (conn->state) { 293 case BT_CONNECT: 294 case BT_CONNECT2: 295 if (conn->out) { 296 if (conn->type == ACL_LINK) 297 hci_acl_connect_cancel(conn); 298 else if (conn->type == LE_LINK) 299 hci_le_connect_cancel(conn); 300 } 301 break; 302 case BT_CONFIG: 303 case BT_CONNECTED: 304 reason = hci_proto_disconn_ind(conn); 305 hci_acl_disconn(conn, reason); 306 break; 307 default: 308 conn->state = BT_CLOSED; 309 break; 310 } 311 312 hci_dev_unlock(hdev); 313 } 314 315 /* Enter sniff mode */ 316 static void hci_conn_enter_sniff_mode(struct hci_conn *conn) 317 { 318 struct hci_dev *hdev = conn->hdev; 319 320 BT_DBG("conn %p mode %d", conn, conn->mode); 321 322 if (test_bit(HCI_RAW, &hdev->flags)) 323 return; 324 325 if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn)) 326 return; 327 328 if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF)) 329 return; 330 331 if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) { 332 struct hci_cp_sniff_subrate cp; 333 cp.handle = cpu_to_le16(conn->handle); 334 cp.max_latency = cpu_to_le16(0); 335 cp.min_remote_timeout = cpu_to_le16(0); 336 cp.min_local_timeout = cpu_to_le16(0); 337 hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp); 338 } 339 340 if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) { 341 struct hci_cp_sniff_mode cp; 342 cp.handle = cpu_to_le16(conn->handle); 343 cp.max_interval = cpu_to_le16(hdev->sniff_max_interval); 344 cp.min_interval = cpu_to_le16(hdev->sniff_min_interval); 345 cp.attempt = cpu_to_le16(4); 346 cp.timeout = cpu_to_le16(1); 347 hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp); 348 } 349 } 350 351 static void hci_conn_idle(unsigned long arg) 352 { 353 struct hci_conn *conn = (void *) arg; 354 355 BT_DBG("conn %p mode %d", conn, conn->mode); 356 357 hci_conn_enter_sniff_mode(conn); 358 } 359 360 static void hci_conn_auto_accept(unsigned long arg) 361 { 362 struct hci_conn *conn = (void *) arg; 363 struct hci_dev *hdev = conn->hdev; 364 365 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY, sizeof(conn->dst), 366 &conn->dst); 367 } 368 369 struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst) 370 { 371 struct hci_conn *conn; 372 373 BT_DBG("%s dst %s", hdev->name, batostr(dst)); 374 375 conn = kzalloc(sizeof(struct hci_conn), GFP_ATOMIC); 376 if (!conn) 377 return NULL; 378 379 bacpy(&conn->dst, dst); 380 conn->hdev = hdev; 381 conn->type = type; 382 conn->mode = HCI_CM_ACTIVE; 383 conn->state = BT_OPEN; 384 conn->auth_type = HCI_AT_GENERAL_BONDING; 385 conn->io_capability = hdev->io_capability; 386 conn->remote_auth = 0xff; 387 conn->key_type = 0xff; 388 389 conn->power_save = 1; 390 conn->disc_timeout = HCI_DISCONN_TIMEOUT; 391 392 switch (type) { 393 case ACL_LINK: 394 conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK; 395 break; 396 case SCO_LINK: 397 if (lmp_esco_capable(hdev)) 398 conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) | 399 (hdev->esco_type & EDR_ESCO_MASK); 400 else 401 conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK; 402 break; 403 case ESCO_LINK: 404 conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK; 405 break; 406 } 407 408 skb_queue_head_init(&conn->data_q); 409 410 INIT_LIST_HEAD(&conn->chan_list);; 411 412 INIT_DELAYED_WORK(&conn->disc_work, hci_conn_timeout); 413 setup_timer(&conn->idle_timer, hci_conn_idle, (unsigned long)conn); 414 setup_timer(&conn->auto_accept_timer, hci_conn_auto_accept, 415 (unsigned long) conn); 416 417 atomic_set(&conn->refcnt, 0); 418 419 hci_dev_hold(hdev); 420 421 hci_conn_hash_add(hdev, conn); 422 if (hdev->notify) 423 hdev->notify(hdev, HCI_NOTIFY_CONN_ADD); 424 425 atomic_set(&conn->devref, 0); 426 427 hci_conn_init_sysfs(conn); 428 429 return conn; 430 } 431 432 int hci_conn_del(struct hci_conn *conn) 433 { 434 struct hci_dev *hdev = conn->hdev; 435 436 BT_DBG("%s conn %p handle %d", hdev->name, conn, conn->handle); 437 438 del_timer(&conn->idle_timer); 439 440 cancel_delayed_work_sync(&conn->disc_work); 441 442 del_timer(&conn->auto_accept_timer); 443 444 if (conn->type == ACL_LINK) { 445 struct hci_conn *sco = conn->link; 446 if (sco) 447 sco->link = NULL; 448 449 /* Unacked frames */ 450 hdev->acl_cnt += conn->sent; 451 } else if (conn->type == LE_LINK) { 452 if (hdev->le_pkts) 453 hdev->le_cnt += conn->sent; 454 else 455 hdev->acl_cnt += conn->sent; 456 } else { 457 struct hci_conn *acl = conn->link; 458 if (acl) { 459 acl->link = NULL; 460 hci_conn_put(acl); 461 } 462 } 463 464 465 hci_chan_list_flush(conn); 466 467 hci_conn_hash_del(hdev, conn); 468 if (hdev->notify) 469 hdev->notify(hdev, HCI_NOTIFY_CONN_DEL); 470 471 skb_queue_purge(&conn->data_q); 472 473 hci_conn_put_device(conn); 474 475 hci_dev_put(hdev); 476 477 if (conn->handle == 0) 478 kfree(conn); 479 480 return 0; 481 } 482 483 struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src) 484 { 485 int use_src = bacmp(src, BDADDR_ANY); 486 struct hci_dev *hdev = NULL, *d; 487 488 BT_DBG("%s -> %s", batostr(src), batostr(dst)); 489 490 read_lock(&hci_dev_list_lock); 491 492 list_for_each_entry(d, &hci_dev_list, list) { 493 if (!test_bit(HCI_UP, &d->flags) || test_bit(HCI_RAW, &d->flags)) 494 continue; 495 496 /* Simple routing: 497 * No source address - find interface with bdaddr != dst 498 * Source address - find interface with bdaddr == src 499 */ 500 501 if (use_src) { 502 if (!bacmp(&d->bdaddr, src)) { 503 hdev = d; break; 504 } 505 } else { 506 if (bacmp(&d->bdaddr, dst)) { 507 hdev = d; break; 508 } 509 } 510 } 511 512 if (hdev) 513 hdev = hci_dev_hold(hdev); 514 515 read_unlock(&hci_dev_list_lock); 516 return hdev; 517 } 518 EXPORT_SYMBOL(hci_get_route); 519 520 /* Create SCO, ACL or LE connection. 521 * Device _must_ be locked */ 522 struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, __u8 sec_level, __u8 auth_type) 523 { 524 struct hci_conn *acl; 525 struct hci_conn *sco; 526 struct hci_conn *le; 527 528 BT_DBG("%s dst %s", hdev->name, batostr(dst)); 529 530 if (type == LE_LINK) { 531 struct adv_entry *entry; 532 533 le = hci_conn_hash_lookup_ba(hdev, LE_LINK, dst); 534 if (le) 535 return ERR_PTR(-EBUSY); 536 537 entry = hci_find_adv_entry(hdev, dst); 538 if (!entry) 539 return ERR_PTR(-EHOSTUNREACH); 540 541 le = hci_conn_add(hdev, LE_LINK, dst); 542 if (!le) 543 return ERR_PTR(-ENOMEM); 544 545 le->dst_type = entry->bdaddr_type; 546 547 hci_le_connect(le); 548 549 hci_conn_hold(le); 550 551 return le; 552 } 553 554 acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst); 555 if (!acl) { 556 acl = hci_conn_add(hdev, ACL_LINK, dst); 557 if (!acl) 558 return NULL; 559 } 560 561 hci_conn_hold(acl); 562 563 if (acl->state == BT_OPEN || acl->state == BT_CLOSED) { 564 acl->sec_level = BT_SECURITY_LOW; 565 acl->pending_sec_level = sec_level; 566 acl->auth_type = auth_type; 567 hci_acl_connect(acl); 568 } 569 570 if (type == ACL_LINK) 571 return acl; 572 573 sco = hci_conn_hash_lookup_ba(hdev, type, dst); 574 if (!sco) { 575 sco = hci_conn_add(hdev, type, dst); 576 if (!sco) { 577 hci_conn_put(acl); 578 return NULL; 579 } 580 } 581 582 acl->link = sco; 583 sco->link = acl; 584 585 hci_conn_hold(sco); 586 587 if (acl->state == BT_CONNECTED && 588 (sco->state == BT_OPEN || sco->state == BT_CLOSED)) { 589 acl->power_save = 1; 590 hci_conn_enter_active_mode(acl, BT_POWER_FORCE_ACTIVE_ON); 591 592 if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->pend)) { 593 /* defer SCO setup until mode change completed */ 594 set_bit(HCI_CONN_SCO_SETUP_PEND, &acl->pend); 595 return sco; 596 } 597 598 hci_sco_setup(acl, 0x00); 599 } 600 601 return sco; 602 } 603 EXPORT_SYMBOL(hci_connect); 604 605 /* Check link security requirement */ 606 int hci_conn_check_link_mode(struct hci_conn *conn) 607 { 608 BT_DBG("conn %p", conn); 609 610 if (conn->ssp_mode > 0 && conn->hdev->ssp_mode > 0 && 611 !(conn->link_mode & HCI_LM_ENCRYPT)) 612 return 0; 613 614 return 1; 615 } 616 EXPORT_SYMBOL(hci_conn_check_link_mode); 617 618 /* Authenticate remote device */ 619 static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type) 620 { 621 BT_DBG("conn %p", conn); 622 623 if (conn->pending_sec_level > sec_level) 624 sec_level = conn->pending_sec_level; 625 626 if (sec_level > conn->sec_level) 627 conn->pending_sec_level = sec_level; 628 else if (conn->link_mode & HCI_LM_AUTH) 629 return 1; 630 631 /* Make sure we preserve an existing MITM requirement*/ 632 auth_type |= (conn->auth_type & 0x01); 633 634 conn->auth_type = auth_type; 635 636 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) { 637 struct hci_cp_auth_requested cp; 638 639 /* encrypt must be pending if auth is also pending */ 640 set_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend); 641 642 cp.handle = cpu_to_le16(conn->handle); 643 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED, 644 sizeof(cp), &cp); 645 if (conn->key_type != 0xff) 646 set_bit(HCI_CONN_REAUTH_PEND, &conn->pend); 647 } 648 649 return 0; 650 } 651 652 /* Encrypt the the link */ 653 static void hci_conn_encrypt(struct hci_conn *conn) 654 { 655 BT_DBG("conn %p", conn); 656 657 if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend)) { 658 struct hci_cp_set_conn_encrypt cp; 659 cp.handle = cpu_to_le16(conn->handle); 660 cp.encrypt = 0x01; 661 hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp), 662 &cp); 663 } 664 } 665 666 /* Enable security */ 667 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type) 668 { 669 BT_DBG("conn %p", conn); 670 671 /* For sdp we don't need the link key. */ 672 if (sec_level == BT_SECURITY_SDP) 673 return 1; 674 675 /* For non 2.1 devices and low security level we don't need the link 676 key. */ 677 if (sec_level == BT_SECURITY_LOW && 678 (!conn->ssp_mode || !conn->hdev->ssp_mode)) 679 return 1; 680 681 /* For other security levels we need the link key. */ 682 if (!(conn->link_mode & HCI_LM_AUTH)) 683 goto auth; 684 685 /* An authenticated combination key has sufficient security for any 686 security level. */ 687 if (conn->key_type == HCI_LK_AUTH_COMBINATION) 688 goto encrypt; 689 690 /* An unauthenticated combination key has sufficient security for 691 security level 1 and 2. */ 692 if (conn->key_type == HCI_LK_UNAUTH_COMBINATION && 693 (sec_level == BT_SECURITY_MEDIUM || 694 sec_level == BT_SECURITY_LOW)) 695 goto encrypt; 696 697 /* A combination key has always sufficient security for the security 698 levels 1 or 2. High security level requires the combination key 699 is generated using maximum PIN code length (16). 700 For pre 2.1 units. */ 701 if (conn->key_type == HCI_LK_COMBINATION && 702 (sec_level != BT_SECURITY_HIGH || 703 conn->pin_length == 16)) 704 goto encrypt; 705 706 auth: 707 if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend)) 708 return 0; 709 710 if (!hci_conn_auth(conn, sec_level, auth_type)) 711 return 0; 712 713 encrypt: 714 if (conn->link_mode & HCI_LM_ENCRYPT) 715 return 1; 716 717 hci_conn_encrypt(conn); 718 return 0; 719 } 720 EXPORT_SYMBOL(hci_conn_security); 721 722 /* Check secure link requirement */ 723 int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level) 724 { 725 BT_DBG("conn %p", conn); 726 727 if (sec_level != BT_SECURITY_HIGH) 728 return 1; /* Accept if non-secure is required */ 729 730 if (conn->sec_level == BT_SECURITY_HIGH) 731 return 1; 732 733 return 0; /* Reject not secure link */ 734 } 735 EXPORT_SYMBOL(hci_conn_check_secure); 736 737 /* Change link key */ 738 int hci_conn_change_link_key(struct hci_conn *conn) 739 { 740 BT_DBG("conn %p", conn); 741 742 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) { 743 struct hci_cp_change_conn_link_key cp; 744 cp.handle = cpu_to_le16(conn->handle); 745 hci_send_cmd(conn->hdev, HCI_OP_CHANGE_CONN_LINK_KEY, 746 sizeof(cp), &cp); 747 } 748 749 return 0; 750 } 751 EXPORT_SYMBOL(hci_conn_change_link_key); 752 753 /* Switch role */ 754 int hci_conn_switch_role(struct hci_conn *conn, __u8 role) 755 { 756 BT_DBG("conn %p", conn); 757 758 if (!role && conn->link_mode & HCI_LM_MASTER) 759 return 1; 760 761 if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->pend)) { 762 struct hci_cp_switch_role cp; 763 bacpy(&cp.bdaddr, &conn->dst); 764 cp.role = role; 765 hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp); 766 } 767 768 return 0; 769 } 770 EXPORT_SYMBOL(hci_conn_switch_role); 771 772 /* Enter active mode */ 773 void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active) 774 { 775 struct hci_dev *hdev = conn->hdev; 776 777 BT_DBG("conn %p mode %d", conn, conn->mode); 778 779 if (test_bit(HCI_RAW, &hdev->flags)) 780 return; 781 782 if (conn->mode != HCI_CM_SNIFF) 783 goto timer; 784 785 if (!conn->power_save && !force_active) 786 goto timer; 787 788 if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) { 789 struct hci_cp_exit_sniff_mode cp; 790 cp.handle = cpu_to_le16(conn->handle); 791 hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp); 792 } 793 794 timer: 795 if (hdev->idle_timeout > 0) 796 mod_timer(&conn->idle_timer, 797 jiffies + msecs_to_jiffies(hdev->idle_timeout)); 798 } 799 800 /* Drop all connection on the device */ 801 void hci_conn_hash_flush(struct hci_dev *hdev) 802 { 803 struct hci_conn_hash *h = &hdev->conn_hash; 804 struct hci_conn *c; 805 806 BT_DBG("hdev %s", hdev->name); 807 808 list_for_each_entry_rcu(c, &h->list, list) { 809 c->state = BT_CLOSED; 810 811 hci_proto_disconn_cfm(c, HCI_ERROR_LOCAL_HOST_TERM); 812 hci_conn_del(c); 813 } 814 } 815 816 /* Check pending connect attempts */ 817 void hci_conn_check_pending(struct hci_dev *hdev) 818 { 819 struct hci_conn *conn; 820 821 BT_DBG("hdev %s", hdev->name); 822 823 hci_dev_lock(hdev); 824 825 conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2); 826 if (conn) 827 hci_acl_connect(conn); 828 829 hci_dev_unlock(hdev); 830 } 831 832 void hci_conn_hold_device(struct hci_conn *conn) 833 { 834 atomic_inc(&conn->devref); 835 } 836 EXPORT_SYMBOL(hci_conn_hold_device); 837 838 void hci_conn_put_device(struct hci_conn *conn) 839 { 840 if (atomic_dec_and_test(&conn->devref)) 841 hci_conn_del_sysfs(conn); 842 } 843 EXPORT_SYMBOL(hci_conn_put_device); 844 845 int hci_get_conn_list(void __user *arg) 846 { 847 register struct hci_conn *c; 848 struct hci_conn_list_req req, *cl; 849 struct hci_conn_info *ci; 850 struct hci_dev *hdev; 851 int n = 0, size, err; 852 853 if (copy_from_user(&req, arg, sizeof(req))) 854 return -EFAULT; 855 856 if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci)) 857 return -EINVAL; 858 859 size = sizeof(req) + req.conn_num * sizeof(*ci); 860 861 cl = kmalloc(size, GFP_KERNEL); 862 if (!cl) 863 return -ENOMEM; 864 865 hdev = hci_dev_get(req.dev_id); 866 if (!hdev) { 867 kfree(cl); 868 return -ENODEV; 869 } 870 871 ci = cl->conn_info; 872 873 hci_dev_lock(hdev); 874 list_for_each_entry(c, &hdev->conn_hash.list, list) { 875 bacpy(&(ci + n)->bdaddr, &c->dst); 876 (ci + n)->handle = c->handle; 877 (ci + n)->type = c->type; 878 (ci + n)->out = c->out; 879 (ci + n)->state = c->state; 880 (ci + n)->link_mode = c->link_mode; 881 if (++n >= req.conn_num) 882 break; 883 } 884 hci_dev_unlock(hdev); 885 886 cl->dev_id = hdev->id; 887 cl->conn_num = n; 888 size = sizeof(req) + n * sizeof(*ci); 889 890 hci_dev_put(hdev); 891 892 err = copy_to_user(arg, cl, size); 893 kfree(cl); 894 895 return err ? -EFAULT : 0; 896 } 897 898 int hci_get_conn_info(struct hci_dev *hdev, void __user *arg) 899 { 900 struct hci_conn_info_req req; 901 struct hci_conn_info ci; 902 struct hci_conn *conn; 903 char __user *ptr = arg + sizeof(req); 904 905 if (copy_from_user(&req, arg, sizeof(req))) 906 return -EFAULT; 907 908 hci_dev_lock(hdev); 909 conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr); 910 if (conn) { 911 bacpy(&ci.bdaddr, &conn->dst); 912 ci.handle = conn->handle; 913 ci.type = conn->type; 914 ci.out = conn->out; 915 ci.state = conn->state; 916 ci.link_mode = conn->link_mode; 917 } 918 hci_dev_unlock(hdev); 919 920 if (!conn) 921 return -ENOENT; 922 923 return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0; 924 } 925 926 int hci_get_auth_info(struct hci_dev *hdev, void __user *arg) 927 { 928 struct hci_auth_info_req req; 929 struct hci_conn *conn; 930 931 if (copy_from_user(&req, arg, sizeof(req))) 932 return -EFAULT; 933 934 hci_dev_lock(hdev); 935 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr); 936 if (conn) 937 req.type = conn->auth_type; 938 hci_dev_unlock(hdev); 939 940 if (!conn) 941 return -ENOENT; 942 943 return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0; 944 } 945 946 struct hci_chan *hci_chan_create(struct hci_conn *conn) 947 { 948 struct hci_dev *hdev = conn->hdev; 949 struct hci_chan *chan; 950 951 BT_DBG("%s conn %p", hdev->name, conn); 952 953 chan = kzalloc(sizeof(struct hci_chan), GFP_ATOMIC); 954 if (!chan) 955 return NULL; 956 957 chan->conn = conn; 958 skb_queue_head_init(&chan->data_q); 959 960 list_add_rcu(&chan->list, &conn->chan_list); 961 962 return chan; 963 } 964 965 int hci_chan_del(struct hci_chan *chan) 966 { 967 struct hci_conn *conn = chan->conn; 968 struct hci_dev *hdev = conn->hdev; 969 970 BT_DBG("%s conn %p chan %p", hdev->name, conn, chan); 971 972 list_del_rcu(&chan->list); 973 974 synchronize_rcu(); 975 976 skb_queue_purge(&chan->data_q); 977 kfree(chan); 978 979 return 0; 980 } 981 982 void hci_chan_list_flush(struct hci_conn *conn) 983 { 984 struct hci_chan *chan; 985 986 BT_DBG("conn %p", conn); 987 988 list_for_each_entry_rcu(chan, &conn->chan_list, list) 989 hci_chan_del(chan); 990 } 991