1 /* 2 BlueZ - Bluetooth protocol stack for Linux 3 Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved. 4 5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com> 6 7 This program is free software; you can redistribute it and/or modify 8 it under the terms of the GNU General Public License version 2 as 9 published by the Free Software Foundation; 10 11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 19 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 22 SOFTWARE IS DISCLAIMED. 23 */ 24 25 /* Bluetooth HCI connection handling. */ 26 27 #include <linux/export.h> 28 29 #include <net/bluetooth/bluetooth.h> 30 #include <net/bluetooth/hci_core.h> 31 #include <net/bluetooth/a2mp.h> 32 #include <net/bluetooth/smp.h> 33 34 static void hci_le_create_connection(struct hci_conn *conn) 35 { 36 struct hci_dev *hdev = conn->hdev; 37 struct hci_cp_le_create_conn cp; 38 39 conn->state = BT_CONNECT; 40 conn->out = true; 41 conn->link_mode |= HCI_LM_MASTER; 42 conn->sec_level = BT_SECURITY_LOW; 43 44 memset(&cp, 0, sizeof(cp)); 45 cp.scan_interval = __constant_cpu_to_le16(0x0060); 46 cp.scan_window = __constant_cpu_to_le16(0x0030); 47 bacpy(&cp.peer_addr, &conn->dst); 48 cp.peer_addr_type = conn->dst_type; 49 cp.conn_interval_min = __constant_cpu_to_le16(0x0028); 50 cp.conn_interval_max = __constant_cpu_to_le16(0x0038); 51 cp.supervision_timeout = __constant_cpu_to_le16(0x002a); 52 cp.min_ce_len = __constant_cpu_to_le16(0x0000); 53 cp.max_ce_len = __constant_cpu_to_le16(0x0000); 54 55 hci_send_cmd(hdev, HCI_OP_LE_CREATE_CONN, sizeof(cp), &cp); 56 } 57 58 static void hci_le_create_connection_cancel(struct hci_conn *conn) 59 { 60 hci_send_cmd(conn->hdev, HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL); 61 } 62 63 static void hci_acl_create_connection(struct hci_conn *conn) 64 { 65 struct hci_dev *hdev = conn->hdev; 66 struct inquiry_entry *ie; 67 struct hci_cp_create_conn cp; 68 69 BT_DBG("hcon %p", conn); 70 71 conn->state = BT_CONNECT; 72 conn->out = true; 73 74 conn->link_mode = HCI_LM_MASTER; 75 76 conn->attempt++; 77 78 conn->link_policy = hdev->link_policy; 79 80 memset(&cp, 0, sizeof(cp)); 81 bacpy(&cp.bdaddr, &conn->dst); 82 cp.pscan_rep_mode = 0x02; 83 84 ie = hci_inquiry_cache_lookup(hdev, &conn->dst); 85 if (ie) { 86 if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) { 87 cp.pscan_rep_mode = ie->data.pscan_rep_mode; 88 cp.pscan_mode = ie->data.pscan_mode; 89 cp.clock_offset = ie->data.clock_offset | 90 __constant_cpu_to_le16(0x8000); 91 } 92 93 memcpy(conn->dev_class, ie->data.dev_class, 3); 94 if (ie->data.ssp_mode > 0) 95 set_bit(HCI_CONN_SSP_ENABLED, &conn->flags); 96 } 97 98 cp.pkt_type = cpu_to_le16(conn->pkt_type); 99 if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER)) 100 cp.role_switch = 0x01; 101 else 102 cp.role_switch = 0x00; 103 104 hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp); 105 } 106 107 static void hci_acl_create_connection_cancel(struct hci_conn *conn) 108 { 109 struct hci_cp_create_conn_cancel cp; 110 111 BT_DBG("hcon %p", conn); 112 113 if (conn->hdev->hci_ver < BLUETOOTH_VER_1_2) 114 return; 115 116 bacpy(&cp.bdaddr, &conn->dst); 117 hci_send_cmd(conn->hdev, HCI_OP_CREATE_CONN_CANCEL, sizeof(cp), &cp); 118 } 119 120 void hci_acl_disconn(struct hci_conn *conn, __u8 reason) 121 { 122 struct hci_cp_disconnect cp; 123 124 BT_DBG("hcon %p", conn); 125 126 conn->state = BT_DISCONN; 127 128 cp.handle = cpu_to_le16(conn->handle); 129 cp.reason = reason; 130 hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp); 131 } 132 133 static void hci_add_sco(struct hci_conn *conn, __u16 handle) 134 { 135 struct hci_dev *hdev = conn->hdev; 136 struct hci_cp_add_sco cp; 137 138 BT_DBG("hcon %p", conn); 139 140 conn->state = BT_CONNECT; 141 conn->out = true; 142 143 conn->attempt++; 144 145 cp.handle = cpu_to_le16(handle); 146 cp.pkt_type = cpu_to_le16(conn->pkt_type); 147 148 hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp); 149 } 150 151 void hci_setup_sync(struct hci_conn *conn, __u16 handle) 152 { 153 struct hci_dev *hdev = conn->hdev; 154 struct hci_cp_setup_sync_conn cp; 155 156 BT_DBG("hcon %p", conn); 157 158 conn->state = BT_CONNECT; 159 conn->out = true; 160 161 conn->attempt++; 162 163 cp.handle = cpu_to_le16(handle); 164 cp.pkt_type = cpu_to_le16(conn->pkt_type); 165 166 cp.tx_bandwidth = __constant_cpu_to_le32(0x00001f40); 167 cp.rx_bandwidth = __constant_cpu_to_le32(0x00001f40); 168 cp.max_latency = __constant_cpu_to_le16(0xffff); 169 cp.voice_setting = cpu_to_le16(hdev->voice_setting); 170 cp.retrans_effort = 0xff; 171 172 hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp); 173 } 174 175 void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max, 176 u16 latency, u16 to_multiplier) 177 { 178 struct hci_cp_le_conn_update cp; 179 struct hci_dev *hdev = conn->hdev; 180 181 memset(&cp, 0, sizeof(cp)); 182 183 cp.handle = cpu_to_le16(conn->handle); 184 cp.conn_interval_min = cpu_to_le16(min); 185 cp.conn_interval_max = cpu_to_le16(max); 186 cp.conn_latency = cpu_to_le16(latency); 187 cp.supervision_timeout = cpu_to_le16(to_multiplier); 188 cp.min_ce_len = __constant_cpu_to_le16(0x0001); 189 cp.max_ce_len = __constant_cpu_to_le16(0x0001); 190 191 hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp); 192 } 193 194 void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __u8 rand[8], 195 __u8 ltk[16]) 196 { 197 struct hci_dev *hdev = conn->hdev; 198 struct hci_cp_le_start_enc cp; 199 200 BT_DBG("hcon %p", conn); 201 202 memset(&cp, 0, sizeof(cp)); 203 204 cp.handle = cpu_to_le16(conn->handle); 205 memcpy(cp.ltk, ltk, sizeof(cp.ltk)); 206 cp.ediv = ediv; 207 memcpy(cp.rand, rand, sizeof(cp.rand)); 208 209 hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp); 210 } 211 212 /* Device _must_ be locked */ 213 void hci_sco_setup(struct hci_conn *conn, __u8 status) 214 { 215 struct hci_conn *sco = conn->link; 216 217 if (!sco) 218 return; 219 220 BT_DBG("hcon %p", conn); 221 222 if (!status) { 223 if (lmp_esco_capable(conn->hdev)) 224 hci_setup_sync(sco, conn->handle); 225 else 226 hci_add_sco(sco, conn->handle); 227 } else { 228 hci_proto_connect_cfm(sco, status); 229 hci_conn_del(sco); 230 } 231 } 232 233 static void hci_conn_timeout(struct work_struct *work) 234 { 235 struct hci_conn *conn = container_of(work, struct hci_conn, 236 disc_work.work); 237 __u8 reason; 238 239 BT_DBG("hcon %p state %s", conn, state_to_string(conn->state)); 240 241 if (atomic_read(&conn->refcnt)) 242 return; 243 244 switch (conn->state) { 245 case BT_CONNECT: 246 case BT_CONNECT2: 247 if (conn->out) { 248 if (conn->type == ACL_LINK) 249 hci_acl_create_connection_cancel(conn); 250 else if (conn->type == LE_LINK) 251 hci_le_create_connection_cancel(conn); 252 } 253 break; 254 case BT_CONFIG: 255 case BT_CONNECTED: 256 reason = hci_proto_disconn_ind(conn); 257 hci_acl_disconn(conn, reason); 258 break; 259 default: 260 conn->state = BT_CLOSED; 261 break; 262 } 263 } 264 265 /* Enter sniff mode */ 266 static void hci_conn_enter_sniff_mode(struct hci_conn *conn) 267 { 268 struct hci_dev *hdev = conn->hdev; 269 270 BT_DBG("hcon %p mode %d", conn, conn->mode); 271 272 if (test_bit(HCI_RAW, &hdev->flags)) 273 return; 274 275 if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn)) 276 return; 277 278 if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF)) 279 return; 280 281 if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) { 282 struct hci_cp_sniff_subrate cp; 283 cp.handle = cpu_to_le16(conn->handle); 284 cp.max_latency = __constant_cpu_to_le16(0); 285 cp.min_remote_timeout = __constant_cpu_to_le16(0); 286 cp.min_local_timeout = __constant_cpu_to_le16(0); 287 hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp); 288 } 289 290 if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) { 291 struct hci_cp_sniff_mode cp; 292 cp.handle = cpu_to_le16(conn->handle); 293 cp.max_interval = cpu_to_le16(hdev->sniff_max_interval); 294 cp.min_interval = cpu_to_le16(hdev->sniff_min_interval); 295 cp.attempt = __constant_cpu_to_le16(4); 296 cp.timeout = __constant_cpu_to_le16(1); 297 hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp); 298 } 299 } 300 301 static void hci_conn_idle(unsigned long arg) 302 { 303 struct hci_conn *conn = (void *) arg; 304 305 BT_DBG("hcon %p mode %d", conn, conn->mode); 306 307 hci_conn_enter_sniff_mode(conn); 308 } 309 310 static void hci_conn_auto_accept(unsigned long arg) 311 { 312 struct hci_conn *conn = (void *) arg; 313 struct hci_dev *hdev = conn->hdev; 314 315 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY, sizeof(conn->dst), 316 &conn->dst); 317 } 318 319 struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst) 320 { 321 struct hci_conn *conn; 322 323 BT_DBG("%s dst %s", hdev->name, batostr(dst)); 324 325 conn = kzalloc(sizeof(struct hci_conn), GFP_KERNEL); 326 if (!conn) 327 return NULL; 328 329 bacpy(&conn->dst, dst); 330 conn->hdev = hdev; 331 conn->type = type; 332 conn->mode = HCI_CM_ACTIVE; 333 conn->state = BT_OPEN; 334 conn->auth_type = HCI_AT_GENERAL_BONDING; 335 conn->io_capability = hdev->io_capability; 336 conn->remote_auth = 0xff; 337 conn->key_type = 0xff; 338 339 set_bit(HCI_CONN_POWER_SAVE, &conn->flags); 340 conn->disc_timeout = HCI_DISCONN_TIMEOUT; 341 342 switch (type) { 343 case ACL_LINK: 344 conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK; 345 break; 346 case SCO_LINK: 347 if (lmp_esco_capable(hdev)) 348 conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) | 349 (hdev->esco_type & EDR_ESCO_MASK); 350 else 351 conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK; 352 break; 353 case ESCO_LINK: 354 conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK; 355 break; 356 } 357 358 skb_queue_head_init(&conn->data_q); 359 360 INIT_LIST_HEAD(&conn->chan_list); 361 362 INIT_DELAYED_WORK(&conn->disc_work, hci_conn_timeout); 363 setup_timer(&conn->idle_timer, hci_conn_idle, (unsigned long)conn); 364 setup_timer(&conn->auto_accept_timer, hci_conn_auto_accept, 365 (unsigned long) conn); 366 367 atomic_set(&conn->refcnt, 0); 368 369 hci_dev_hold(hdev); 370 371 hci_conn_hash_add(hdev, conn); 372 if (hdev->notify) 373 hdev->notify(hdev, HCI_NOTIFY_CONN_ADD); 374 375 atomic_set(&conn->devref, 0); 376 377 hci_conn_init_sysfs(conn); 378 379 return conn; 380 } 381 382 int hci_conn_del(struct hci_conn *conn) 383 { 384 struct hci_dev *hdev = conn->hdev; 385 386 BT_DBG("%s hcon %p handle %d", hdev->name, conn, conn->handle); 387 388 del_timer(&conn->idle_timer); 389 390 cancel_delayed_work_sync(&conn->disc_work); 391 392 del_timer(&conn->auto_accept_timer); 393 394 if (conn->type == ACL_LINK) { 395 struct hci_conn *sco = conn->link; 396 if (sco) 397 sco->link = NULL; 398 399 /* Unacked frames */ 400 hdev->acl_cnt += conn->sent; 401 } else if (conn->type == LE_LINK) { 402 if (hdev->le_pkts) 403 hdev->le_cnt += conn->sent; 404 else 405 hdev->acl_cnt += conn->sent; 406 } else { 407 struct hci_conn *acl = conn->link; 408 if (acl) { 409 acl->link = NULL; 410 hci_conn_put(acl); 411 } 412 } 413 414 hci_chan_list_flush(conn); 415 416 if (conn->amp_mgr) 417 amp_mgr_put(conn->amp_mgr); 418 419 hci_conn_hash_del(hdev, conn); 420 if (hdev->notify) 421 hdev->notify(hdev, HCI_NOTIFY_CONN_DEL); 422 423 skb_queue_purge(&conn->data_q); 424 425 hci_conn_put_device(conn); 426 427 hci_dev_put(hdev); 428 429 if (conn->handle == 0) 430 kfree(conn); 431 432 return 0; 433 } 434 435 struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src) 436 { 437 int use_src = bacmp(src, BDADDR_ANY); 438 struct hci_dev *hdev = NULL, *d; 439 440 BT_DBG("%s -> %s", batostr(src), batostr(dst)); 441 442 read_lock(&hci_dev_list_lock); 443 444 list_for_each_entry(d, &hci_dev_list, list) { 445 if (!test_bit(HCI_UP, &d->flags) || 446 test_bit(HCI_RAW, &d->flags) || 447 d->dev_type != HCI_BREDR) 448 continue; 449 450 /* Simple routing: 451 * No source address - find interface with bdaddr != dst 452 * Source address - find interface with bdaddr == src 453 */ 454 455 if (use_src) { 456 if (!bacmp(&d->bdaddr, src)) { 457 hdev = d; break; 458 } 459 } else { 460 if (bacmp(&d->bdaddr, dst)) { 461 hdev = d; break; 462 } 463 } 464 } 465 466 if (hdev) 467 hdev = hci_dev_hold(hdev); 468 469 read_unlock(&hci_dev_list_lock); 470 return hdev; 471 } 472 EXPORT_SYMBOL(hci_get_route); 473 474 static struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst, 475 u8 dst_type, u8 sec_level, u8 auth_type) 476 { 477 struct hci_conn *le; 478 479 le = hci_conn_hash_lookup_ba(hdev, LE_LINK, dst); 480 if (!le) { 481 le = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT); 482 if (le) 483 return ERR_PTR(-EBUSY); 484 485 le = hci_conn_add(hdev, LE_LINK, dst); 486 if (!le) 487 return ERR_PTR(-ENOMEM); 488 489 le->dst_type = bdaddr_to_le(dst_type); 490 hci_le_create_connection(le); 491 } 492 493 le->pending_sec_level = sec_level; 494 le->auth_type = auth_type; 495 496 hci_conn_hold(le); 497 498 return le; 499 } 500 501 static struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst, 502 u8 sec_level, u8 auth_type) 503 { 504 struct hci_conn *acl; 505 506 acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst); 507 if (!acl) { 508 acl = hci_conn_add(hdev, ACL_LINK, dst); 509 if (!acl) 510 return ERR_PTR(-ENOMEM); 511 } 512 513 hci_conn_hold(acl); 514 515 if (acl->state == BT_OPEN || acl->state == BT_CLOSED) { 516 acl->sec_level = BT_SECURITY_LOW; 517 acl->pending_sec_level = sec_level; 518 acl->auth_type = auth_type; 519 hci_acl_create_connection(acl); 520 } 521 522 return acl; 523 } 524 525 static struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type, 526 bdaddr_t *dst, u8 sec_level, u8 auth_type) 527 { 528 struct hci_conn *acl; 529 struct hci_conn *sco; 530 531 acl = hci_connect_acl(hdev, dst, sec_level, auth_type); 532 if (IS_ERR(acl)) 533 return acl; 534 535 sco = hci_conn_hash_lookup_ba(hdev, type, dst); 536 if (!sco) { 537 sco = hci_conn_add(hdev, type, dst); 538 if (!sco) { 539 hci_conn_put(acl); 540 return ERR_PTR(-ENOMEM); 541 } 542 } 543 544 acl->link = sco; 545 sco->link = acl; 546 547 hci_conn_hold(sco); 548 549 if (acl->state == BT_CONNECTED && 550 (sco->state == BT_OPEN || sco->state == BT_CLOSED)) { 551 set_bit(HCI_CONN_POWER_SAVE, &acl->flags); 552 hci_conn_enter_active_mode(acl, BT_POWER_FORCE_ACTIVE_ON); 553 554 if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->flags)) { 555 /* defer SCO setup until mode change completed */ 556 set_bit(HCI_CONN_SCO_SETUP_PEND, &acl->flags); 557 return sco; 558 } 559 560 hci_sco_setup(acl, 0x00); 561 } 562 563 return sco; 564 } 565 566 /* Create SCO, ACL or LE connection. */ 567 struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, 568 __u8 dst_type, __u8 sec_level, __u8 auth_type) 569 { 570 BT_DBG("%s dst %s type 0x%x", hdev->name, batostr(dst), type); 571 572 switch (type) { 573 case LE_LINK: 574 return hci_connect_le(hdev, dst, dst_type, sec_level, auth_type); 575 case ACL_LINK: 576 return hci_connect_acl(hdev, dst, sec_level, auth_type); 577 case SCO_LINK: 578 case ESCO_LINK: 579 return hci_connect_sco(hdev, type, dst, sec_level, auth_type); 580 } 581 582 return ERR_PTR(-EINVAL); 583 } 584 585 /* Check link security requirement */ 586 int hci_conn_check_link_mode(struct hci_conn *conn) 587 { 588 BT_DBG("hcon %p", conn); 589 590 if (hci_conn_ssp_enabled(conn) && !(conn->link_mode & HCI_LM_ENCRYPT)) 591 return 0; 592 593 return 1; 594 } 595 596 /* Authenticate remote device */ 597 static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type) 598 { 599 BT_DBG("hcon %p", conn); 600 601 if (conn->pending_sec_level > sec_level) 602 sec_level = conn->pending_sec_level; 603 604 if (sec_level > conn->sec_level) 605 conn->pending_sec_level = sec_level; 606 else if (conn->link_mode & HCI_LM_AUTH) 607 return 1; 608 609 /* Make sure we preserve an existing MITM requirement*/ 610 auth_type |= (conn->auth_type & 0x01); 611 612 conn->auth_type = auth_type; 613 614 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) { 615 struct hci_cp_auth_requested cp; 616 617 /* encrypt must be pending if auth is also pending */ 618 set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags); 619 620 cp.handle = cpu_to_le16(conn->handle); 621 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED, 622 sizeof(cp), &cp); 623 if (conn->key_type != 0xff) 624 set_bit(HCI_CONN_REAUTH_PEND, &conn->flags); 625 } 626 627 return 0; 628 } 629 630 /* Encrypt the the link */ 631 static void hci_conn_encrypt(struct hci_conn *conn) 632 { 633 BT_DBG("hcon %p", conn); 634 635 if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) { 636 struct hci_cp_set_conn_encrypt cp; 637 cp.handle = cpu_to_le16(conn->handle); 638 cp.encrypt = 0x01; 639 hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp), 640 &cp); 641 } 642 } 643 644 /* Enable security */ 645 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type) 646 { 647 BT_DBG("hcon %p", conn); 648 649 if (conn->type == LE_LINK) 650 return smp_conn_security(conn, sec_level); 651 652 /* For sdp we don't need the link key. */ 653 if (sec_level == BT_SECURITY_SDP) 654 return 1; 655 656 /* For non 2.1 devices and low security level we don't need the link 657 key. */ 658 if (sec_level == BT_SECURITY_LOW && !hci_conn_ssp_enabled(conn)) 659 return 1; 660 661 /* For other security levels we need the link key. */ 662 if (!(conn->link_mode & HCI_LM_AUTH)) 663 goto auth; 664 665 /* An authenticated combination key has sufficient security for any 666 security level. */ 667 if (conn->key_type == HCI_LK_AUTH_COMBINATION) 668 goto encrypt; 669 670 /* An unauthenticated combination key has sufficient security for 671 security level 1 and 2. */ 672 if (conn->key_type == HCI_LK_UNAUTH_COMBINATION && 673 (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW)) 674 goto encrypt; 675 676 /* A combination key has always sufficient security for the security 677 levels 1 or 2. High security level requires the combination key 678 is generated using maximum PIN code length (16). 679 For pre 2.1 units. */ 680 if (conn->key_type == HCI_LK_COMBINATION && 681 (sec_level != BT_SECURITY_HIGH || conn->pin_length == 16)) 682 goto encrypt; 683 684 auth: 685 if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) 686 return 0; 687 688 if (!hci_conn_auth(conn, sec_level, auth_type)) 689 return 0; 690 691 encrypt: 692 if (conn->link_mode & HCI_LM_ENCRYPT) 693 return 1; 694 695 hci_conn_encrypt(conn); 696 return 0; 697 } 698 EXPORT_SYMBOL(hci_conn_security); 699 700 /* Check secure link requirement */ 701 int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level) 702 { 703 BT_DBG("hcon %p", conn); 704 705 if (sec_level != BT_SECURITY_HIGH) 706 return 1; /* Accept if non-secure is required */ 707 708 if (conn->sec_level == BT_SECURITY_HIGH) 709 return 1; 710 711 return 0; /* Reject not secure link */ 712 } 713 EXPORT_SYMBOL(hci_conn_check_secure); 714 715 /* Change link key */ 716 int hci_conn_change_link_key(struct hci_conn *conn) 717 { 718 BT_DBG("hcon %p", conn); 719 720 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) { 721 struct hci_cp_change_conn_link_key cp; 722 cp.handle = cpu_to_le16(conn->handle); 723 hci_send_cmd(conn->hdev, HCI_OP_CHANGE_CONN_LINK_KEY, 724 sizeof(cp), &cp); 725 } 726 727 return 0; 728 } 729 730 /* Switch role */ 731 int hci_conn_switch_role(struct hci_conn *conn, __u8 role) 732 { 733 BT_DBG("hcon %p", conn); 734 735 if (!role && conn->link_mode & HCI_LM_MASTER) 736 return 1; 737 738 if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->flags)) { 739 struct hci_cp_switch_role cp; 740 bacpy(&cp.bdaddr, &conn->dst); 741 cp.role = role; 742 hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp); 743 } 744 745 return 0; 746 } 747 EXPORT_SYMBOL(hci_conn_switch_role); 748 749 /* Enter active mode */ 750 void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active) 751 { 752 struct hci_dev *hdev = conn->hdev; 753 754 BT_DBG("hcon %p mode %d", conn, conn->mode); 755 756 if (test_bit(HCI_RAW, &hdev->flags)) 757 return; 758 759 if (conn->mode != HCI_CM_SNIFF) 760 goto timer; 761 762 if (!test_bit(HCI_CONN_POWER_SAVE, &conn->flags) && !force_active) 763 goto timer; 764 765 if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) { 766 struct hci_cp_exit_sniff_mode cp; 767 cp.handle = cpu_to_le16(conn->handle); 768 hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp); 769 } 770 771 timer: 772 if (hdev->idle_timeout > 0) 773 mod_timer(&conn->idle_timer, 774 jiffies + msecs_to_jiffies(hdev->idle_timeout)); 775 } 776 777 /* Drop all connection on the device */ 778 void hci_conn_hash_flush(struct hci_dev *hdev) 779 { 780 struct hci_conn_hash *h = &hdev->conn_hash; 781 struct hci_conn *c, *n; 782 783 BT_DBG("hdev %s", hdev->name); 784 785 list_for_each_entry_safe(c, n, &h->list, list) { 786 c->state = BT_CLOSED; 787 788 hci_proto_disconn_cfm(c, HCI_ERROR_LOCAL_HOST_TERM); 789 hci_conn_del(c); 790 } 791 } 792 793 /* Check pending connect attempts */ 794 void hci_conn_check_pending(struct hci_dev *hdev) 795 { 796 struct hci_conn *conn; 797 798 BT_DBG("hdev %s", hdev->name); 799 800 hci_dev_lock(hdev); 801 802 conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2); 803 if (conn) 804 hci_acl_create_connection(conn); 805 806 hci_dev_unlock(hdev); 807 } 808 809 void hci_conn_hold_device(struct hci_conn *conn) 810 { 811 atomic_inc(&conn->devref); 812 } 813 EXPORT_SYMBOL(hci_conn_hold_device); 814 815 void hci_conn_put_device(struct hci_conn *conn) 816 { 817 if (atomic_dec_and_test(&conn->devref)) 818 hci_conn_del_sysfs(conn); 819 } 820 EXPORT_SYMBOL(hci_conn_put_device); 821 822 int hci_get_conn_list(void __user *arg) 823 { 824 struct hci_conn *c; 825 struct hci_conn_list_req req, *cl; 826 struct hci_conn_info *ci; 827 struct hci_dev *hdev; 828 int n = 0, size, err; 829 830 if (copy_from_user(&req, arg, sizeof(req))) 831 return -EFAULT; 832 833 if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci)) 834 return -EINVAL; 835 836 size = sizeof(req) + req.conn_num * sizeof(*ci); 837 838 cl = kmalloc(size, GFP_KERNEL); 839 if (!cl) 840 return -ENOMEM; 841 842 hdev = hci_dev_get(req.dev_id); 843 if (!hdev) { 844 kfree(cl); 845 return -ENODEV; 846 } 847 848 ci = cl->conn_info; 849 850 hci_dev_lock(hdev); 851 list_for_each_entry(c, &hdev->conn_hash.list, list) { 852 bacpy(&(ci + n)->bdaddr, &c->dst); 853 (ci + n)->handle = c->handle; 854 (ci + n)->type = c->type; 855 (ci + n)->out = c->out; 856 (ci + n)->state = c->state; 857 (ci + n)->link_mode = c->link_mode; 858 if (++n >= req.conn_num) 859 break; 860 } 861 hci_dev_unlock(hdev); 862 863 cl->dev_id = hdev->id; 864 cl->conn_num = n; 865 size = sizeof(req) + n * sizeof(*ci); 866 867 hci_dev_put(hdev); 868 869 err = copy_to_user(arg, cl, size); 870 kfree(cl); 871 872 return err ? -EFAULT : 0; 873 } 874 875 int hci_get_conn_info(struct hci_dev *hdev, void __user *arg) 876 { 877 struct hci_conn_info_req req; 878 struct hci_conn_info ci; 879 struct hci_conn *conn; 880 char __user *ptr = arg + sizeof(req); 881 882 if (copy_from_user(&req, arg, sizeof(req))) 883 return -EFAULT; 884 885 hci_dev_lock(hdev); 886 conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr); 887 if (conn) { 888 bacpy(&ci.bdaddr, &conn->dst); 889 ci.handle = conn->handle; 890 ci.type = conn->type; 891 ci.out = conn->out; 892 ci.state = conn->state; 893 ci.link_mode = conn->link_mode; 894 } 895 hci_dev_unlock(hdev); 896 897 if (!conn) 898 return -ENOENT; 899 900 return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0; 901 } 902 903 int hci_get_auth_info(struct hci_dev *hdev, void __user *arg) 904 { 905 struct hci_auth_info_req req; 906 struct hci_conn *conn; 907 908 if (copy_from_user(&req, arg, sizeof(req))) 909 return -EFAULT; 910 911 hci_dev_lock(hdev); 912 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr); 913 if (conn) 914 req.type = conn->auth_type; 915 hci_dev_unlock(hdev); 916 917 if (!conn) 918 return -ENOENT; 919 920 return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0; 921 } 922 923 struct hci_chan *hci_chan_create(struct hci_conn *conn) 924 { 925 struct hci_dev *hdev = conn->hdev; 926 struct hci_chan *chan; 927 928 BT_DBG("%s hcon %p", hdev->name, conn); 929 930 chan = kzalloc(sizeof(struct hci_chan), GFP_KERNEL); 931 if (!chan) 932 return NULL; 933 934 chan->conn = conn; 935 skb_queue_head_init(&chan->data_q); 936 937 list_add_rcu(&chan->list, &conn->chan_list); 938 939 return chan; 940 } 941 942 void hci_chan_del(struct hci_chan *chan) 943 { 944 struct hci_conn *conn = chan->conn; 945 struct hci_dev *hdev = conn->hdev; 946 947 BT_DBG("%s hcon %p chan %p", hdev->name, conn, chan); 948 949 list_del_rcu(&chan->list); 950 951 synchronize_rcu(); 952 953 skb_queue_purge(&chan->data_q); 954 kfree(chan); 955 } 956 957 void hci_chan_list_flush(struct hci_conn *conn) 958 { 959 struct hci_chan *chan, *n; 960 961 BT_DBG("hcon %p", conn); 962 963 list_for_each_entry_safe(chan, n, &conn->chan_list, list) 964 hci_chan_del(chan); 965 } 966