hci_conn.c revision 09fd0de5bd8f8ef3317e5365f92f1a13dcd89aa9
1/* 2 BlueZ - Bluetooth protocol stack for Linux 3 Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved. 4 5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com> 6 7 This program is free software; you can redistribute it and/or modify 8 it under the terms of the GNU General Public License version 2 as 9 published by the Free Software Foundation; 10 11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 19 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 22 SOFTWARE IS DISCLAIMED. 23*/ 24 25/* Bluetooth HCI connection handling. */ 26 27#include <linux/module.h> 28 29#include <linux/types.h> 30#include <linux/errno.h> 31#include <linux/kernel.h> 32#include <linux/slab.h> 33#include <linux/poll.h> 34#include <linux/fcntl.h> 35#include <linux/init.h> 36#include <linux/skbuff.h> 37#include <linux/interrupt.h> 38#include <linux/notifier.h> 39#include <net/sock.h> 40 41#include <asm/system.h> 42#include <linux/uaccess.h> 43#include <asm/unaligned.h> 44 45#include <net/bluetooth/bluetooth.h> 46#include <net/bluetooth/hci_core.h> 47 48static void hci_le_connect(struct hci_conn *conn) 49{ 50 struct hci_dev *hdev = conn->hdev; 51 struct hci_cp_le_create_conn cp; 52 53 conn->state = BT_CONNECT; 54 conn->out = 1; 55 conn->link_mode |= HCI_LM_MASTER; 56 conn->sec_level = BT_SECURITY_LOW; 57 58 memset(&cp, 0, sizeof(cp)); 59 cp.scan_interval = cpu_to_le16(0x0060); 60 cp.scan_window = cpu_to_le16(0x0030); 61 bacpy(&cp.peer_addr, &conn->dst); 62 cp.peer_addr_type = conn->dst_type; 63 cp.conn_interval_min = cpu_to_le16(0x0028); 64 cp.conn_interval_max = cpu_to_le16(0x0038); 65 cp.supervision_timeout = cpu_to_le16(0x002a); 66 cp.min_ce_len = cpu_to_le16(0x0000); 67 cp.max_ce_len = cpu_to_le16(0x0000); 68 69 hci_send_cmd(hdev, HCI_OP_LE_CREATE_CONN, sizeof(cp), &cp); 70} 71 72static void hci_le_connect_cancel(struct hci_conn *conn) 73{ 74 hci_send_cmd(conn->hdev, HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL); 75} 76 77void hci_acl_connect(struct hci_conn *conn) 78{ 79 struct hci_dev *hdev = conn->hdev; 80 struct inquiry_entry *ie; 81 struct hci_cp_create_conn cp; 82 83 BT_DBG("%p", conn); 84 85 conn->state = BT_CONNECT; 86 conn->out = 1; 87 88 conn->link_mode = HCI_LM_MASTER; 89 90 conn->attempt++; 91 92 conn->link_policy = hdev->link_policy; 93 94 memset(&cp, 0, sizeof(cp)); 95 bacpy(&cp.bdaddr, &conn->dst); 96 cp.pscan_rep_mode = 0x02; 97 98 ie = hci_inquiry_cache_lookup(hdev, &conn->dst); 99 if (ie) { 100 if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) { 101 cp.pscan_rep_mode = ie->data.pscan_rep_mode; 102 cp.pscan_mode = ie->data.pscan_mode; 103 cp.clock_offset = ie->data.clock_offset | 104 cpu_to_le16(0x8000); 105 } 106 107 memcpy(conn->dev_class, ie->data.dev_class, 3); 108 conn->ssp_mode = ie->data.ssp_mode; 109 } 110 111 cp.pkt_type = cpu_to_le16(conn->pkt_type); 112 if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER)) 113 cp.role_switch = 0x01; 114 else 115 cp.role_switch = 0x00; 116 117 hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp); 118} 119 120static void hci_acl_connect_cancel(struct hci_conn *conn) 121{ 122 struct hci_cp_create_conn_cancel cp; 123 124 BT_DBG("%p", conn); 125 126 if (conn->hdev->hci_ver < BLUETOOTH_VER_1_2) 127 return; 128 129 bacpy(&cp.bdaddr, &conn->dst); 130 hci_send_cmd(conn->hdev, HCI_OP_CREATE_CONN_CANCEL, sizeof(cp), &cp); 131} 132 133void hci_acl_disconn(struct hci_conn *conn, __u8 reason) 134{ 135 struct hci_cp_disconnect cp; 136 137 BT_DBG("%p", conn); 138 139 conn->state = BT_DISCONN; 140 141 cp.handle = cpu_to_le16(conn->handle); 142 cp.reason = reason; 143 hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp); 144} 145 146void hci_add_sco(struct hci_conn *conn, __u16 handle) 147{ 148 struct hci_dev *hdev = conn->hdev; 149 struct hci_cp_add_sco cp; 150 151 BT_DBG("%p", conn); 152 153 conn->state = BT_CONNECT; 154 conn->out = 1; 155 156 conn->attempt++; 157 158 cp.handle = cpu_to_le16(handle); 159 cp.pkt_type = cpu_to_le16(conn->pkt_type); 160 161 hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp); 162} 163 164void hci_setup_sync(struct hci_conn *conn, __u16 handle) 165{ 166 struct hci_dev *hdev = conn->hdev; 167 struct hci_cp_setup_sync_conn cp; 168 169 BT_DBG("%p", conn); 170 171 conn->state = BT_CONNECT; 172 conn->out = 1; 173 174 conn->attempt++; 175 176 cp.handle = cpu_to_le16(handle); 177 cp.pkt_type = cpu_to_le16(conn->pkt_type); 178 179 cp.tx_bandwidth = cpu_to_le32(0x00001f40); 180 cp.rx_bandwidth = cpu_to_le32(0x00001f40); 181 cp.max_latency = cpu_to_le16(0xffff); 182 cp.voice_setting = cpu_to_le16(hdev->voice_setting); 183 cp.retrans_effort = 0xff; 184 185 hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp); 186} 187 188void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max, 189 u16 latency, u16 to_multiplier) 190{ 191 struct hci_cp_le_conn_update cp; 192 struct hci_dev *hdev = conn->hdev; 193 194 memset(&cp, 0, sizeof(cp)); 195 196 cp.handle = cpu_to_le16(conn->handle); 197 cp.conn_interval_min = cpu_to_le16(min); 198 cp.conn_interval_max = cpu_to_le16(max); 199 cp.conn_latency = cpu_to_le16(latency); 200 cp.supervision_timeout = cpu_to_le16(to_multiplier); 201 cp.min_ce_len = cpu_to_le16(0x0001); 202 cp.max_ce_len = cpu_to_le16(0x0001); 203 204 hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp); 205} 206EXPORT_SYMBOL(hci_le_conn_update); 207 208void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __u8 rand[8], 209 __u8 ltk[16]) 210{ 211 struct hci_dev *hdev = conn->hdev; 212 struct hci_cp_le_start_enc cp; 213 214 BT_DBG("%p", conn); 215 216 memset(&cp, 0, sizeof(cp)); 217 218 cp.handle = cpu_to_le16(conn->handle); 219 memcpy(cp.ltk, ltk, sizeof(cp.ltk)); 220 cp.ediv = ediv; 221 memcpy(cp.rand, rand, sizeof(cp.rand)); 222 223 hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp); 224} 225EXPORT_SYMBOL(hci_le_start_enc); 226 227void hci_le_ltk_reply(struct hci_conn *conn, u8 ltk[16]) 228{ 229 struct hci_dev *hdev = conn->hdev; 230 struct hci_cp_le_ltk_reply cp; 231 232 BT_DBG("%p", conn); 233 234 memset(&cp, 0, sizeof(cp)); 235 236 cp.handle = cpu_to_le16(conn->handle); 237 memcpy(cp.ltk, ltk, sizeof(ltk)); 238 239 hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp); 240} 241EXPORT_SYMBOL(hci_le_ltk_reply); 242 243void hci_le_ltk_neg_reply(struct hci_conn *conn) 244{ 245 struct hci_dev *hdev = conn->hdev; 246 struct hci_cp_le_ltk_neg_reply cp; 247 248 BT_DBG("%p", conn); 249 250 memset(&cp, 0, sizeof(cp)); 251 252 cp.handle = cpu_to_le16(conn->handle); 253 254 hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(cp), &cp); 255} 256 257/* Device _must_ be locked */ 258void hci_sco_setup(struct hci_conn *conn, __u8 status) 259{ 260 struct hci_conn *sco = conn->link; 261 262 BT_DBG("%p", conn); 263 264 if (!sco) 265 return; 266 267 if (!status) { 268 if (lmp_esco_capable(conn->hdev)) 269 hci_setup_sync(sco, conn->handle); 270 else 271 hci_add_sco(sco, conn->handle); 272 } else { 273 hci_proto_connect_cfm(sco, status); 274 hci_conn_del(sco); 275 } 276} 277 278static void hci_conn_timeout(unsigned long arg) 279{ 280 struct hci_conn *conn = (void *) arg; 281 struct hci_dev *hdev = conn->hdev; 282 __u8 reason; 283 284 BT_DBG("conn %p state %d", conn, conn->state); 285 286 if (atomic_read(&conn->refcnt)) 287 return; 288 289 hci_dev_lock(hdev); 290 291 switch (conn->state) { 292 case BT_CONNECT: 293 case BT_CONNECT2: 294 if (conn->out) { 295 if (conn->type == ACL_LINK) 296 hci_acl_connect_cancel(conn); 297 else if (conn->type == LE_LINK) 298 hci_le_connect_cancel(conn); 299 } 300 break; 301 case BT_CONFIG: 302 case BT_CONNECTED: 303 reason = hci_proto_disconn_ind(conn); 304 hci_acl_disconn(conn, reason); 305 break; 306 default: 307 conn->state = BT_CLOSED; 308 break; 309 } 310 311 hci_dev_unlock(hdev); 312} 313 314/* Enter sniff mode */ 315static void hci_conn_enter_sniff_mode(struct hci_conn *conn) 316{ 317 struct hci_dev *hdev = conn->hdev; 318 319 BT_DBG("conn %p mode %d", conn, conn->mode); 320 321 if (test_bit(HCI_RAW, &hdev->flags)) 322 return; 323 324 if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn)) 325 return; 326 327 if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF)) 328 return; 329 330 if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) { 331 struct hci_cp_sniff_subrate cp; 332 cp.handle = cpu_to_le16(conn->handle); 333 cp.max_latency = cpu_to_le16(0); 334 cp.min_remote_timeout = cpu_to_le16(0); 335 cp.min_local_timeout = cpu_to_le16(0); 336 hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp); 337 } 338 339 if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) { 340 struct hci_cp_sniff_mode cp; 341 cp.handle = cpu_to_le16(conn->handle); 342 cp.max_interval = cpu_to_le16(hdev->sniff_max_interval); 343 cp.min_interval = cpu_to_le16(hdev->sniff_min_interval); 344 cp.attempt = cpu_to_le16(4); 345 cp.timeout = cpu_to_le16(1); 346 hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp); 347 } 348} 349 350static void hci_conn_idle(unsigned long arg) 351{ 352 struct hci_conn *conn = (void *) arg; 353 354 BT_DBG("conn %p mode %d", conn, conn->mode); 355 356 hci_conn_enter_sniff_mode(conn); 357} 358 359static void hci_conn_auto_accept(unsigned long arg) 360{ 361 struct hci_conn *conn = (void *) arg; 362 struct hci_dev *hdev = conn->hdev; 363 364 hci_dev_lock(hdev); 365 366 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY, sizeof(conn->dst), 367 &conn->dst); 368 369 hci_dev_unlock(hdev); 370} 371 372struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst) 373{ 374 struct hci_conn *conn; 375 376 BT_DBG("%s dst %s", hdev->name, batostr(dst)); 377 378 conn = kzalloc(sizeof(struct hci_conn), GFP_ATOMIC); 379 if (!conn) 380 return NULL; 381 382 bacpy(&conn->dst, dst); 383 conn->hdev = hdev; 384 conn->type = type; 385 conn->mode = HCI_CM_ACTIVE; 386 conn->state = BT_OPEN; 387 conn->auth_type = HCI_AT_GENERAL_BONDING; 388 conn->io_capability = hdev->io_capability; 389 conn->remote_auth = 0xff; 390 conn->key_type = 0xff; 391 392 conn->power_save = 1; 393 conn->disc_timeout = HCI_DISCONN_TIMEOUT; 394 395 switch (type) { 396 case ACL_LINK: 397 conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK; 398 break; 399 case SCO_LINK: 400 if (lmp_esco_capable(hdev)) 401 conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) | 402 (hdev->esco_type & EDR_ESCO_MASK); 403 else 404 conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK; 405 break; 406 case ESCO_LINK: 407 conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK; 408 break; 409 } 410 411 skb_queue_head_init(&conn->data_q); 412 413 INIT_LIST_HEAD(&conn->chan_list);; 414 415 setup_timer(&conn->disc_timer, hci_conn_timeout, (unsigned long)conn); 416 setup_timer(&conn->idle_timer, hci_conn_idle, (unsigned long)conn); 417 setup_timer(&conn->auto_accept_timer, hci_conn_auto_accept, 418 (unsigned long) conn); 419 420 atomic_set(&conn->refcnt, 0); 421 422 hci_dev_hold(hdev); 423 424 tasklet_disable(&hdev->tx_task); 425 426 hci_conn_hash_add(hdev, conn); 427 if (hdev->notify) 428 hdev->notify(hdev, HCI_NOTIFY_CONN_ADD); 429 430 atomic_set(&conn->devref, 0); 431 432 hci_conn_init_sysfs(conn); 433 434 tasklet_enable(&hdev->tx_task); 435 436 return conn; 437} 438 439int hci_conn_del(struct hci_conn *conn) 440{ 441 struct hci_dev *hdev = conn->hdev; 442 443 BT_DBG("%s conn %p handle %d", hdev->name, conn, conn->handle); 444 445 del_timer(&conn->idle_timer); 446 447 del_timer(&conn->disc_timer); 448 449 del_timer(&conn->auto_accept_timer); 450 451 if (conn->type == ACL_LINK) { 452 struct hci_conn *sco = conn->link; 453 if (sco) 454 sco->link = NULL; 455 456 /* Unacked frames */ 457 hdev->acl_cnt += conn->sent; 458 } else if (conn->type == LE_LINK) { 459 if (hdev->le_pkts) 460 hdev->le_cnt += conn->sent; 461 else 462 hdev->acl_cnt += conn->sent; 463 } else { 464 struct hci_conn *acl = conn->link; 465 if (acl) { 466 acl->link = NULL; 467 hci_conn_put(acl); 468 } 469 } 470 471 tasklet_disable(&hdev->tx_task); 472 473 hci_chan_list_flush(conn); 474 475 hci_conn_hash_del(hdev, conn); 476 if (hdev->notify) 477 hdev->notify(hdev, HCI_NOTIFY_CONN_DEL); 478 479 tasklet_enable(&hdev->tx_task); 480 481 skb_queue_purge(&conn->data_q); 482 483 hci_conn_put_device(conn); 484 485 hci_dev_put(hdev); 486 487 if (conn->handle == 0) 488 kfree(conn); 489 490 return 0; 491} 492 493struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src) 494{ 495 int use_src = bacmp(src, BDADDR_ANY); 496 struct hci_dev *hdev = NULL, *d; 497 498 BT_DBG("%s -> %s", batostr(src), batostr(dst)); 499 500 read_lock_bh(&hci_dev_list_lock); 501 502 list_for_each_entry(d, &hci_dev_list, list) { 503 if (!test_bit(HCI_UP, &d->flags) || test_bit(HCI_RAW, &d->flags)) 504 continue; 505 506 /* Simple routing: 507 * No source address - find interface with bdaddr != dst 508 * Source address - find interface with bdaddr == src 509 */ 510 511 if (use_src) { 512 if (!bacmp(&d->bdaddr, src)) { 513 hdev = d; break; 514 } 515 } else { 516 if (bacmp(&d->bdaddr, dst)) { 517 hdev = d; break; 518 } 519 } 520 } 521 522 if (hdev) 523 hdev = hci_dev_hold(hdev); 524 525 read_unlock_bh(&hci_dev_list_lock); 526 return hdev; 527} 528EXPORT_SYMBOL(hci_get_route); 529 530/* Create SCO, ACL or LE connection. 531 * Device _must_ be locked */ 532struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, __u8 sec_level, __u8 auth_type) 533{ 534 struct hci_conn *acl; 535 struct hci_conn *sco; 536 struct hci_conn *le; 537 538 BT_DBG("%s dst %s", hdev->name, batostr(dst)); 539 540 if (type == LE_LINK) { 541 struct adv_entry *entry; 542 543 le = hci_conn_hash_lookup_ba(hdev, LE_LINK, dst); 544 if (le) 545 return ERR_PTR(-EBUSY); 546 547 entry = hci_find_adv_entry(hdev, dst); 548 if (!entry) 549 return ERR_PTR(-EHOSTUNREACH); 550 551 le = hci_conn_add(hdev, LE_LINK, dst); 552 if (!le) 553 return ERR_PTR(-ENOMEM); 554 555 le->dst_type = entry->bdaddr_type; 556 557 hci_le_connect(le); 558 559 hci_conn_hold(le); 560 561 return le; 562 } 563 564 acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst); 565 if (!acl) { 566 acl = hci_conn_add(hdev, ACL_LINK, dst); 567 if (!acl) 568 return NULL; 569 } 570 571 hci_conn_hold(acl); 572 573 if (acl->state == BT_OPEN || acl->state == BT_CLOSED) { 574 acl->sec_level = BT_SECURITY_LOW; 575 acl->pending_sec_level = sec_level; 576 acl->auth_type = auth_type; 577 hci_acl_connect(acl); 578 } 579 580 if (type == ACL_LINK) 581 return acl; 582 583 sco = hci_conn_hash_lookup_ba(hdev, type, dst); 584 if (!sco) { 585 sco = hci_conn_add(hdev, type, dst); 586 if (!sco) { 587 hci_conn_put(acl); 588 return NULL; 589 } 590 } 591 592 acl->link = sco; 593 sco->link = acl; 594 595 hci_conn_hold(sco); 596 597 if (acl->state == BT_CONNECTED && 598 (sco->state == BT_OPEN || sco->state == BT_CLOSED)) { 599 acl->power_save = 1; 600 hci_conn_enter_active_mode(acl, BT_POWER_FORCE_ACTIVE_ON); 601 602 if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->pend)) { 603 /* defer SCO setup until mode change completed */ 604 set_bit(HCI_CONN_SCO_SETUP_PEND, &acl->pend); 605 return sco; 606 } 607 608 hci_sco_setup(acl, 0x00); 609 } 610 611 return sco; 612} 613EXPORT_SYMBOL(hci_connect); 614 615/* Check link security requirement */ 616int hci_conn_check_link_mode(struct hci_conn *conn) 617{ 618 BT_DBG("conn %p", conn); 619 620 if (conn->ssp_mode > 0 && conn->hdev->ssp_mode > 0 && 621 !(conn->link_mode & HCI_LM_ENCRYPT)) 622 return 0; 623 624 return 1; 625} 626EXPORT_SYMBOL(hci_conn_check_link_mode); 627 628/* Authenticate remote device */ 629static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type) 630{ 631 BT_DBG("conn %p", conn); 632 633 if (conn->pending_sec_level > sec_level) 634 sec_level = conn->pending_sec_level; 635 636 if (sec_level > conn->sec_level) 637 conn->pending_sec_level = sec_level; 638 else if (conn->link_mode & HCI_LM_AUTH) 639 return 1; 640 641 /* Make sure we preserve an existing MITM requirement*/ 642 auth_type |= (conn->auth_type & 0x01); 643 644 conn->auth_type = auth_type; 645 646 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) { 647 struct hci_cp_auth_requested cp; 648 cp.handle = cpu_to_le16(conn->handle); 649 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED, 650 sizeof(cp), &cp); 651 if (conn->key_type != 0xff) 652 set_bit(HCI_CONN_REAUTH_PEND, &conn->pend); 653 } 654 655 return 0; 656} 657 658/* Encrypt the the link */ 659static void hci_conn_encrypt(struct hci_conn *conn) 660{ 661 BT_DBG("conn %p", conn); 662 663 if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend)) { 664 struct hci_cp_set_conn_encrypt cp; 665 cp.handle = cpu_to_le16(conn->handle); 666 cp.encrypt = 0x01; 667 hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp), 668 &cp); 669 } 670} 671 672/* Enable security */ 673int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type) 674{ 675 BT_DBG("conn %p", conn); 676 677 /* For sdp we don't need the link key. */ 678 if (sec_level == BT_SECURITY_SDP) 679 return 1; 680 681 /* For non 2.1 devices and low security level we don't need the link 682 key. */ 683 if (sec_level == BT_SECURITY_LOW && 684 (!conn->ssp_mode || !conn->hdev->ssp_mode)) 685 return 1; 686 687 /* For other security levels we need the link key. */ 688 if (!(conn->link_mode & HCI_LM_AUTH)) 689 goto auth; 690 691 /* An authenticated combination key has sufficient security for any 692 security level. */ 693 if (conn->key_type == HCI_LK_AUTH_COMBINATION) 694 goto encrypt; 695 696 /* An unauthenticated combination key has sufficient security for 697 security level 1 and 2. */ 698 if (conn->key_type == HCI_LK_UNAUTH_COMBINATION && 699 (sec_level == BT_SECURITY_MEDIUM || 700 sec_level == BT_SECURITY_LOW)) 701 goto encrypt; 702 703 /* A combination key has always sufficient security for the security 704 levels 1 or 2. High security level requires the combination key 705 is generated using maximum PIN code length (16). 706 For pre 2.1 units. */ 707 if (conn->key_type == HCI_LK_COMBINATION && 708 (sec_level != BT_SECURITY_HIGH || 709 conn->pin_length == 16)) 710 goto encrypt; 711 712auth: 713 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend)) 714 return 0; 715 716 if (!hci_conn_auth(conn, sec_level, auth_type)) 717 return 0; 718 719encrypt: 720 if (conn->link_mode & HCI_LM_ENCRYPT) 721 return 1; 722 723 hci_conn_encrypt(conn); 724 return 0; 725} 726EXPORT_SYMBOL(hci_conn_security); 727 728/* Check secure link requirement */ 729int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level) 730{ 731 BT_DBG("conn %p", conn); 732 733 if (sec_level != BT_SECURITY_HIGH) 734 return 1; /* Accept if non-secure is required */ 735 736 if (conn->sec_level == BT_SECURITY_HIGH) 737 return 1; 738 739 return 0; /* Reject not secure link */ 740} 741EXPORT_SYMBOL(hci_conn_check_secure); 742 743/* Change link key */ 744int hci_conn_change_link_key(struct hci_conn *conn) 745{ 746 BT_DBG("conn %p", conn); 747 748 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) { 749 struct hci_cp_change_conn_link_key cp; 750 cp.handle = cpu_to_le16(conn->handle); 751 hci_send_cmd(conn->hdev, HCI_OP_CHANGE_CONN_LINK_KEY, 752 sizeof(cp), &cp); 753 } 754 755 return 0; 756} 757EXPORT_SYMBOL(hci_conn_change_link_key); 758 759/* Switch role */ 760int hci_conn_switch_role(struct hci_conn *conn, __u8 role) 761{ 762 BT_DBG("conn %p", conn); 763 764 if (!role && conn->link_mode & HCI_LM_MASTER) 765 return 1; 766 767 if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->pend)) { 768 struct hci_cp_switch_role cp; 769 bacpy(&cp.bdaddr, &conn->dst); 770 cp.role = role; 771 hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp); 772 } 773 774 return 0; 775} 776EXPORT_SYMBOL(hci_conn_switch_role); 777 778/* Enter active mode */ 779void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active) 780{ 781 struct hci_dev *hdev = conn->hdev; 782 783 BT_DBG("conn %p mode %d", conn, conn->mode); 784 785 if (test_bit(HCI_RAW, &hdev->flags)) 786 return; 787 788 if (conn->mode != HCI_CM_SNIFF) 789 goto timer; 790 791 if (!conn->power_save && !force_active) 792 goto timer; 793 794 if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) { 795 struct hci_cp_exit_sniff_mode cp; 796 cp.handle = cpu_to_le16(conn->handle); 797 hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp); 798 } 799 800timer: 801 if (hdev->idle_timeout > 0) 802 mod_timer(&conn->idle_timer, 803 jiffies + msecs_to_jiffies(hdev->idle_timeout)); 804} 805 806/* Drop all connection on the device */ 807void hci_conn_hash_flush(struct hci_dev *hdev) 808{ 809 struct hci_conn_hash *h = &hdev->conn_hash; 810 struct hci_conn *c; 811 812 BT_DBG("hdev %s", hdev->name); 813 814 list_for_each_entry(c, &h->list, list) { 815 c->state = BT_CLOSED; 816 817 hci_proto_disconn_cfm(c, HCI_ERROR_LOCAL_HOST_TERM); 818 hci_conn_del(c); 819 } 820} 821 822/* Check pending connect attempts */ 823void hci_conn_check_pending(struct hci_dev *hdev) 824{ 825 struct hci_conn *conn; 826 827 BT_DBG("hdev %s", hdev->name); 828 829 hci_dev_lock(hdev); 830 831 conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2); 832 if (conn) 833 hci_acl_connect(conn); 834 835 hci_dev_unlock(hdev); 836} 837 838void hci_conn_hold_device(struct hci_conn *conn) 839{ 840 atomic_inc(&conn->devref); 841} 842EXPORT_SYMBOL(hci_conn_hold_device); 843 844void hci_conn_put_device(struct hci_conn *conn) 845{ 846 if (atomic_dec_and_test(&conn->devref)) 847 hci_conn_del_sysfs(conn); 848} 849EXPORT_SYMBOL(hci_conn_put_device); 850 851int hci_get_conn_list(void __user *arg) 852{ 853 register struct hci_conn *c; 854 struct hci_conn_list_req req, *cl; 855 struct hci_conn_info *ci; 856 struct hci_dev *hdev; 857 int n = 0, size, err; 858 859 if (copy_from_user(&req, arg, sizeof(req))) 860 return -EFAULT; 861 862 if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci)) 863 return -EINVAL; 864 865 size = sizeof(req) + req.conn_num * sizeof(*ci); 866 867 cl = kmalloc(size, GFP_KERNEL); 868 if (!cl) 869 return -ENOMEM; 870 871 hdev = hci_dev_get(req.dev_id); 872 if (!hdev) { 873 kfree(cl); 874 return -ENODEV; 875 } 876 877 ci = cl->conn_info; 878 879 hci_dev_lock(hdev); 880 list_for_each_entry(c, &hdev->conn_hash.list, list) { 881 bacpy(&(ci + n)->bdaddr, &c->dst); 882 (ci + n)->handle = c->handle; 883 (ci + n)->type = c->type; 884 (ci + n)->out = c->out; 885 (ci + n)->state = c->state; 886 (ci + n)->link_mode = c->link_mode; 887 if (++n >= req.conn_num) 888 break; 889 } 890 hci_dev_unlock(hdev); 891 892 cl->dev_id = hdev->id; 893 cl->conn_num = n; 894 size = sizeof(req) + n * sizeof(*ci); 895 896 hci_dev_put(hdev); 897 898 err = copy_to_user(arg, cl, size); 899 kfree(cl); 900 901 return err ? -EFAULT : 0; 902} 903 904int hci_get_conn_info(struct hci_dev *hdev, void __user *arg) 905{ 906 struct hci_conn_info_req req; 907 struct hci_conn_info ci; 908 struct hci_conn *conn; 909 char __user *ptr = arg + sizeof(req); 910 911 if (copy_from_user(&req, arg, sizeof(req))) 912 return -EFAULT; 913 914 hci_dev_lock(hdev); 915 conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr); 916 if (conn) { 917 bacpy(&ci.bdaddr, &conn->dst); 918 ci.handle = conn->handle; 919 ci.type = conn->type; 920 ci.out = conn->out; 921 ci.state = conn->state; 922 ci.link_mode = conn->link_mode; 923 } 924 hci_dev_unlock(hdev); 925 926 if (!conn) 927 return -ENOENT; 928 929 return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0; 930} 931 932int hci_get_auth_info(struct hci_dev *hdev, void __user *arg) 933{ 934 struct hci_auth_info_req req; 935 struct hci_conn *conn; 936 937 if (copy_from_user(&req, arg, sizeof(req))) 938 return -EFAULT; 939 940 hci_dev_lock(hdev); 941 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr); 942 if (conn) 943 req.type = conn->auth_type; 944 hci_dev_unlock(hdev); 945 946 if (!conn) 947 return -ENOENT; 948 949 return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0; 950} 951 952struct hci_chan *hci_chan_create(struct hci_conn *conn) 953{ 954 struct hci_dev *hdev = conn->hdev; 955 struct hci_chan *chan; 956 957 BT_DBG("%s conn %p", hdev->name, conn); 958 959 chan = kzalloc(sizeof(struct hci_chan), GFP_ATOMIC); 960 if (!chan) 961 return NULL; 962 963 chan->conn = conn; 964 skb_queue_head_init(&chan->data_q); 965 966 tasklet_disable(&hdev->tx_task); 967 list_add(&conn->chan_list, &chan->list); 968 tasklet_enable(&hdev->tx_task); 969 970 return chan; 971} 972 973int hci_chan_del(struct hci_chan *chan) 974{ 975 struct hci_conn *conn = chan->conn; 976 struct hci_dev *hdev = conn->hdev; 977 978 BT_DBG("%s conn %p chan %p", hdev->name, conn, chan); 979 980 tasklet_disable(&hdev->tx_task); 981 list_del(&chan->list); 982 tasklet_enable(&hdev->tx_task); 983 984 skb_queue_purge(&chan->data_q); 985 kfree(chan); 986 987 return 0; 988} 989 990void hci_chan_list_flush(struct hci_conn *conn) 991{ 992 struct hci_chan *chan, *tmp; 993 994 BT_DBG("conn %p", conn); 995 996 list_for_each_entry_safe(chan, tmp, &conn->chan_list, list) 997 hci_chan_del(chan); 998} 999