hci_conn.c revision dfc94dbdb999154dc2ff44e6011a4912c0b29e88
1/* 2 BlueZ - Bluetooth protocol stack for Linux 3 Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved. 4 5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com> 6 7 This program is free software; you can redistribute it and/or modify 8 it under the terms of the GNU General Public License version 2 as 9 published by the Free Software Foundation; 10 11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 19 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 22 SOFTWARE IS DISCLAIMED. 23*/ 24 25/* Bluetooth HCI connection handling. */ 26 27#include <linux/export.h> 28 29#include <net/bluetooth/bluetooth.h> 30#include <net/bluetooth/hci_core.h> 31#include <net/bluetooth/a2mp.h> 32 33static void hci_le_connect(struct hci_conn *conn) 34{ 35 struct hci_dev *hdev = conn->hdev; 36 struct hci_cp_le_create_conn cp; 37 38 conn->state = BT_CONNECT; 39 conn->out = true; 40 conn->link_mode |= HCI_LM_MASTER; 41 conn->sec_level = BT_SECURITY_LOW; 42 43 memset(&cp, 0, sizeof(cp)); 44 cp.scan_interval = __constant_cpu_to_le16(0x0060); 45 cp.scan_window = __constant_cpu_to_le16(0x0030); 46 bacpy(&cp.peer_addr, &conn->dst); 47 cp.peer_addr_type = conn->dst_type; 48 cp.conn_interval_min = __constant_cpu_to_le16(0x0028); 49 cp.conn_interval_max = __constant_cpu_to_le16(0x0038); 50 cp.supervision_timeout = __constant_cpu_to_le16(0x002a); 51 cp.min_ce_len = __constant_cpu_to_le16(0x0000); 52 cp.max_ce_len = __constant_cpu_to_le16(0x0000); 53 54 hci_send_cmd(hdev, HCI_OP_LE_CREATE_CONN, sizeof(cp), &cp); 55} 56 57static void hci_le_connect_cancel(struct hci_conn *conn) 58{ 59 hci_send_cmd(conn->hdev, HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL); 60} 61 62void hci_acl_connect(struct hci_conn *conn) 63{ 64 struct hci_dev *hdev = conn->hdev; 65 struct inquiry_entry *ie; 66 struct hci_cp_create_conn cp; 67 68 BT_DBG("hcon %p", conn); 69 70 conn->state = BT_CONNECT; 71 conn->out = true; 72 73 conn->link_mode = HCI_LM_MASTER; 74 75 conn->attempt++; 76 77 conn->link_policy = hdev->link_policy; 78 79 memset(&cp, 0, sizeof(cp)); 80 bacpy(&cp.bdaddr, &conn->dst); 81 cp.pscan_rep_mode = 0x02; 82 83 ie = hci_inquiry_cache_lookup(hdev, &conn->dst); 84 if (ie) { 85 if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) { 86 cp.pscan_rep_mode = ie->data.pscan_rep_mode; 87 cp.pscan_mode = ie->data.pscan_mode; 88 cp.clock_offset = ie->data.clock_offset | 89 __constant_cpu_to_le16(0x8000); 90 } 91 92 memcpy(conn->dev_class, ie->data.dev_class, 3); 93 if (ie->data.ssp_mode > 0) 94 set_bit(HCI_CONN_SSP_ENABLED, &conn->flags); 95 } 96 97 cp.pkt_type = cpu_to_le16(conn->pkt_type); 98 if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER)) 99 cp.role_switch = 0x01; 100 else 101 cp.role_switch = 0x00; 102 103 hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp); 104} 105 106static void hci_acl_connect_cancel(struct hci_conn *conn) 107{ 108 struct hci_cp_create_conn_cancel cp; 109 110 BT_DBG("%p", conn); 111 112 if (conn->hdev->hci_ver < BLUETOOTH_VER_1_2) 113 return; 114 115 bacpy(&cp.bdaddr, &conn->dst); 116 hci_send_cmd(conn->hdev, HCI_OP_CREATE_CONN_CANCEL, sizeof(cp), &cp); 117} 118 119void hci_acl_disconn(struct hci_conn *conn, __u8 reason) 120{ 121 struct hci_cp_disconnect cp; 122 123 BT_DBG("%p", conn); 124 125 conn->state = BT_DISCONN; 126 127 cp.handle = cpu_to_le16(conn->handle); 128 cp.reason = reason; 129 hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp); 130} 131 132void hci_add_sco(struct hci_conn *conn, __u16 handle) 133{ 134 struct hci_dev *hdev = conn->hdev; 135 struct hci_cp_add_sco cp; 136 137 BT_DBG("%p", conn); 138 139 conn->state = BT_CONNECT; 140 conn->out = true; 141 142 conn->attempt++; 143 144 cp.handle = cpu_to_le16(handle); 145 cp.pkt_type = cpu_to_le16(conn->pkt_type); 146 147 hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp); 148} 149 150void hci_setup_sync(struct hci_conn *conn, __u16 handle) 151{ 152 struct hci_dev *hdev = conn->hdev; 153 struct hci_cp_setup_sync_conn cp; 154 155 BT_DBG("%p", conn); 156 157 conn->state = BT_CONNECT; 158 conn->out = true; 159 160 conn->attempt++; 161 162 cp.handle = cpu_to_le16(handle); 163 cp.pkt_type = cpu_to_le16(conn->pkt_type); 164 165 cp.tx_bandwidth = __constant_cpu_to_le32(0x00001f40); 166 cp.rx_bandwidth = __constant_cpu_to_le32(0x00001f40); 167 cp.max_latency = __constant_cpu_to_le16(0xffff); 168 cp.voice_setting = cpu_to_le16(hdev->voice_setting); 169 cp.retrans_effort = 0xff; 170 171 hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp); 172} 173 174void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max, 175 u16 latency, u16 to_multiplier) 176{ 177 struct hci_cp_le_conn_update cp; 178 struct hci_dev *hdev = conn->hdev; 179 180 memset(&cp, 0, sizeof(cp)); 181 182 cp.handle = cpu_to_le16(conn->handle); 183 cp.conn_interval_min = cpu_to_le16(min); 184 cp.conn_interval_max = cpu_to_le16(max); 185 cp.conn_latency = cpu_to_le16(latency); 186 cp.supervision_timeout = cpu_to_le16(to_multiplier); 187 cp.min_ce_len = __constant_cpu_to_le16(0x0001); 188 cp.max_ce_len = __constant_cpu_to_le16(0x0001); 189 190 hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp); 191} 192 193void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __u8 rand[8], 194 __u8 ltk[16]) 195{ 196 struct hci_dev *hdev = conn->hdev; 197 struct hci_cp_le_start_enc cp; 198 199 BT_DBG("%p", conn); 200 201 memset(&cp, 0, sizeof(cp)); 202 203 cp.handle = cpu_to_le16(conn->handle); 204 memcpy(cp.ltk, ltk, sizeof(cp.ltk)); 205 cp.ediv = ediv; 206 memcpy(cp.rand, rand, sizeof(cp.rand)); 207 208 hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp); 209} 210 211/* Device _must_ be locked */ 212void hci_sco_setup(struct hci_conn *conn, __u8 status) 213{ 214 struct hci_conn *sco = conn->link; 215 216 BT_DBG("%p", conn); 217 218 if (!sco) 219 return; 220 221 if (!status) { 222 if (lmp_esco_capable(conn->hdev)) 223 hci_setup_sync(sco, conn->handle); 224 else 225 hci_add_sco(sco, conn->handle); 226 } else { 227 hci_proto_connect_cfm(sco, status); 228 hci_conn_del(sco); 229 } 230} 231 232static void hci_conn_timeout(struct work_struct *work) 233{ 234 struct hci_conn *conn = container_of(work, struct hci_conn, 235 disc_work.work); 236 __u8 reason; 237 238 BT_DBG("conn %p state %s", conn, state_to_string(conn->state)); 239 240 if (atomic_read(&conn->refcnt)) 241 return; 242 243 switch (conn->state) { 244 case BT_CONNECT: 245 case BT_CONNECT2: 246 if (conn->out) { 247 if (conn->type == ACL_LINK) 248 hci_acl_connect_cancel(conn); 249 else if (conn->type == LE_LINK) 250 hci_le_connect_cancel(conn); 251 } 252 break; 253 case BT_CONFIG: 254 case BT_CONNECTED: 255 reason = hci_proto_disconn_ind(conn); 256 hci_acl_disconn(conn, reason); 257 break; 258 default: 259 conn->state = BT_CLOSED; 260 break; 261 } 262} 263 264/* Enter sniff mode */ 265static void hci_conn_enter_sniff_mode(struct hci_conn *conn) 266{ 267 struct hci_dev *hdev = conn->hdev; 268 269 BT_DBG("conn %p mode %d", conn, conn->mode); 270 271 if (test_bit(HCI_RAW, &hdev->flags)) 272 return; 273 274 if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn)) 275 return; 276 277 if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF)) 278 return; 279 280 if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) { 281 struct hci_cp_sniff_subrate cp; 282 cp.handle = cpu_to_le16(conn->handle); 283 cp.max_latency = __constant_cpu_to_le16(0); 284 cp.min_remote_timeout = __constant_cpu_to_le16(0); 285 cp.min_local_timeout = __constant_cpu_to_le16(0); 286 hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp); 287 } 288 289 if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) { 290 struct hci_cp_sniff_mode cp; 291 cp.handle = cpu_to_le16(conn->handle); 292 cp.max_interval = cpu_to_le16(hdev->sniff_max_interval); 293 cp.min_interval = cpu_to_le16(hdev->sniff_min_interval); 294 cp.attempt = __constant_cpu_to_le16(4); 295 cp.timeout = __constant_cpu_to_le16(1); 296 hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp); 297 } 298} 299 300static void hci_conn_idle(unsigned long arg) 301{ 302 struct hci_conn *conn = (void *) arg; 303 304 BT_DBG("conn %p mode %d", conn, conn->mode); 305 306 hci_conn_enter_sniff_mode(conn); 307} 308 309static void hci_conn_auto_accept(unsigned long arg) 310{ 311 struct hci_conn *conn = (void *) arg; 312 struct hci_dev *hdev = conn->hdev; 313 314 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY, sizeof(conn->dst), 315 &conn->dst); 316} 317 318struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst) 319{ 320 struct hci_conn *conn; 321 322 BT_DBG("%s dst %s", hdev->name, batostr(dst)); 323 324 conn = kzalloc(sizeof(struct hci_conn), GFP_KERNEL); 325 if (!conn) 326 return NULL; 327 328 bacpy(&conn->dst, dst); 329 conn->hdev = hdev; 330 conn->type = type; 331 conn->mode = HCI_CM_ACTIVE; 332 conn->state = BT_OPEN; 333 conn->auth_type = HCI_AT_GENERAL_BONDING; 334 conn->io_capability = hdev->io_capability; 335 conn->remote_auth = 0xff; 336 conn->key_type = 0xff; 337 338 set_bit(HCI_CONN_POWER_SAVE, &conn->flags); 339 conn->disc_timeout = HCI_DISCONN_TIMEOUT; 340 341 switch (type) { 342 case ACL_LINK: 343 conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK; 344 break; 345 case SCO_LINK: 346 if (lmp_esco_capable(hdev)) 347 conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) | 348 (hdev->esco_type & EDR_ESCO_MASK); 349 else 350 conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK; 351 break; 352 case ESCO_LINK: 353 conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK; 354 break; 355 } 356 357 skb_queue_head_init(&conn->data_q); 358 359 INIT_LIST_HEAD(&conn->chan_list); 360 361 INIT_DELAYED_WORK(&conn->disc_work, hci_conn_timeout); 362 setup_timer(&conn->idle_timer, hci_conn_idle, (unsigned long)conn); 363 setup_timer(&conn->auto_accept_timer, hci_conn_auto_accept, 364 (unsigned long) conn); 365 366 atomic_set(&conn->refcnt, 0); 367 368 hci_dev_hold(hdev); 369 370 hci_conn_hash_add(hdev, conn); 371 if (hdev->notify) 372 hdev->notify(hdev, HCI_NOTIFY_CONN_ADD); 373 374 atomic_set(&conn->devref, 0); 375 376 hci_conn_init_sysfs(conn); 377 378 return conn; 379} 380 381int hci_conn_del(struct hci_conn *conn) 382{ 383 struct hci_dev *hdev = conn->hdev; 384 385 BT_DBG("%s conn %p handle %d", hdev->name, conn, conn->handle); 386 387 del_timer(&conn->idle_timer); 388 389 cancel_delayed_work_sync(&conn->disc_work); 390 391 del_timer(&conn->auto_accept_timer); 392 393 if (conn->type == ACL_LINK) { 394 struct hci_conn *sco = conn->link; 395 if (sco) 396 sco->link = NULL; 397 398 /* Unacked frames */ 399 hdev->acl_cnt += conn->sent; 400 } else if (conn->type == LE_LINK) { 401 if (hdev->le_pkts) 402 hdev->le_cnt += conn->sent; 403 else 404 hdev->acl_cnt += conn->sent; 405 } else { 406 struct hci_conn *acl = conn->link; 407 if (acl) { 408 acl->link = NULL; 409 hci_conn_put(acl); 410 } 411 } 412 413 hci_chan_list_flush(conn); 414 415 if (conn->amp_mgr) 416 amp_mgr_put(conn->amp_mgr); 417 418 hci_conn_hash_del(hdev, conn); 419 if (hdev->notify) 420 hdev->notify(hdev, HCI_NOTIFY_CONN_DEL); 421 422 skb_queue_purge(&conn->data_q); 423 424 hci_conn_put_device(conn); 425 426 hci_dev_put(hdev); 427 428 if (conn->handle == 0) 429 kfree(conn); 430 431 return 0; 432} 433 434struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src) 435{ 436 int use_src = bacmp(src, BDADDR_ANY); 437 struct hci_dev *hdev = NULL, *d; 438 439 BT_DBG("%s -> %s", batostr(src), batostr(dst)); 440 441 read_lock(&hci_dev_list_lock); 442 443 list_for_each_entry(d, &hci_dev_list, list) { 444 if (!test_bit(HCI_UP, &d->flags) || 445 test_bit(HCI_RAW, &d->flags)) 446 continue; 447 448 /* Simple routing: 449 * No source address - find interface with bdaddr != dst 450 * Source address - find interface with bdaddr == src 451 */ 452 453 if (use_src) { 454 if (!bacmp(&d->bdaddr, src)) { 455 hdev = d; break; 456 } 457 } else { 458 if (bacmp(&d->bdaddr, dst)) { 459 hdev = d; break; 460 } 461 } 462 } 463 464 if (hdev) 465 hdev = hci_dev_hold(hdev); 466 467 read_unlock(&hci_dev_list_lock); 468 return hdev; 469} 470EXPORT_SYMBOL(hci_get_route); 471 472/* Create SCO, ACL or LE connection. 473 * Device _must_ be locked */ 474struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, 475 __u8 dst_type, __u8 sec_level, __u8 auth_type) 476{ 477 struct hci_conn *acl; 478 struct hci_conn *sco; 479 struct hci_conn *le; 480 481 BT_DBG("%s dst %s", hdev->name, batostr(dst)); 482 483 if (type == LE_LINK) { 484 le = hci_conn_hash_lookup_ba(hdev, LE_LINK, dst); 485 if (!le) { 486 le = hci_conn_hash_lookup_state(hdev, LE_LINK, 487 BT_CONNECT); 488 if (le) 489 return ERR_PTR(-EBUSY); 490 491 le = hci_conn_add(hdev, LE_LINK, dst); 492 if (!le) 493 return ERR_PTR(-ENOMEM); 494 495 le->dst_type = bdaddr_to_le(dst_type); 496 hci_le_connect(le); 497 } 498 499 le->pending_sec_level = sec_level; 500 le->auth_type = auth_type; 501 502 hci_conn_hold(le); 503 504 return le; 505 } 506 507 acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst); 508 if (!acl) { 509 acl = hci_conn_add(hdev, ACL_LINK, dst); 510 if (!acl) 511 return ERR_PTR(-ENOMEM); 512 } 513 514 hci_conn_hold(acl); 515 516 if (acl->state == BT_OPEN || acl->state == BT_CLOSED) { 517 acl->sec_level = BT_SECURITY_LOW; 518 acl->pending_sec_level = sec_level; 519 acl->auth_type = auth_type; 520 hci_acl_connect(acl); 521 } 522 523 if (type == ACL_LINK) 524 return acl; 525 526 sco = hci_conn_hash_lookup_ba(hdev, type, dst); 527 if (!sco) { 528 sco = hci_conn_add(hdev, type, dst); 529 if (!sco) { 530 hci_conn_put(acl); 531 return ERR_PTR(-ENOMEM); 532 } 533 } 534 535 acl->link = sco; 536 sco->link = acl; 537 538 hci_conn_hold(sco); 539 540 if (acl->state == BT_CONNECTED && 541 (sco->state == BT_OPEN || sco->state == BT_CLOSED)) { 542 set_bit(HCI_CONN_POWER_SAVE, &acl->flags); 543 hci_conn_enter_active_mode(acl, BT_POWER_FORCE_ACTIVE_ON); 544 545 if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->flags)) { 546 /* defer SCO setup until mode change completed */ 547 set_bit(HCI_CONN_SCO_SETUP_PEND, &acl->flags); 548 return sco; 549 } 550 551 hci_sco_setup(acl, 0x00); 552 } 553 554 return sco; 555} 556 557/* Check link security requirement */ 558int hci_conn_check_link_mode(struct hci_conn *conn) 559{ 560 BT_DBG("conn %p", conn); 561 562 if (hci_conn_ssp_enabled(conn) && !(conn->link_mode & HCI_LM_ENCRYPT)) 563 return 0; 564 565 return 1; 566} 567 568/* Authenticate remote device */ 569static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type) 570{ 571 BT_DBG("conn %p", conn); 572 573 if (conn->pending_sec_level > sec_level) 574 sec_level = conn->pending_sec_level; 575 576 if (sec_level > conn->sec_level) 577 conn->pending_sec_level = sec_level; 578 else if (conn->link_mode & HCI_LM_AUTH) 579 return 1; 580 581 /* Make sure we preserve an existing MITM requirement*/ 582 auth_type |= (conn->auth_type & 0x01); 583 584 conn->auth_type = auth_type; 585 586 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) { 587 struct hci_cp_auth_requested cp; 588 589 /* encrypt must be pending if auth is also pending */ 590 set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags); 591 592 cp.handle = cpu_to_le16(conn->handle); 593 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED, 594 sizeof(cp), &cp); 595 if (conn->key_type != 0xff) 596 set_bit(HCI_CONN_REAUTH_PEND, &conn->flags); 597 } 598 599 return 0; 600} 601 602/* Encrypt the the link */ 603static void hci_conn_encrypt(struct hci_conn *conn) 604{ 605 BT_DBG("conn %p", conn); 606 607 if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) { 608 struct hci_cp_set_conn_encrypt cp; 609 cp.handle = cpu_to_le16(conn->handle); 610 cp.encrypt = 0x01; 611 hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp), 612 &cp); 613 } 614} 615 616/* Enable security */ 617int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type) 618{ 619 BT_DBG("conn %p", conn); 620 621 /* For sdp we don't need the link key. */ 622 if (sec_level == BT_SECURITY_SDP) 623 return 1; 624 625 /* For non 2.1 devices and low security level we don't need the link 626 key. */ 627 if (sec_level == BT_SECURITY_LOW && !hci_conn_ssp_enabled(conn)) 628 return 1; 629 630 /* For other security levels we need the link key. */ 631 if (!(conn->link_mode & HCI_LM_AUTH)) 632 goto auth; 633 634 /* An authenticated combination key has sufficient security for any 635 security level. */ 636 if (conn->key_type == HCI_LK_AUTH_COMBINATION) 637 goto encrypt; 638 639 /* An unauthenticated combination key has sufficient security for 640 security level 1 and 2. */ 641 if (conn->key_type == HCI_LK_UNAUTH_COMBINATION && 642 (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW)) 643 goto encrypt; 644 645 /* A combination key has always sufficient security for the security 646 levels 1 or 2. High security level requires the combination key 647 is generated using maximum PIN code length (16). 648 For pre 2.1 units. */ 649 if (conn->key_type == HCI_LK_COMBINATION && 650 (sec_level != BT_SECURITY_HIGH || conn->pin_length == 16)) 651 goto encrypt; 652 653auth: 654 if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) 655 return 0; 656 657 if (!hci_conn_auth(conn, sec_level, auth_type)) 658 return 0; 659 660encrypt: 661 if (conn->link_mode & HCI_LM_ENCRYPT) 662 return 1; 663 664 hci_conn_encrypt(conn); 665 return 0; 666} 667EXPORT_SYMBOL(hci_conn_security); 668 669/* Check secure link requirement */ 670int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level) 671{ 672 BT_DBG("conn %p", conn); 673 674 if (sec_level != BT_SECURITY_HIGH) 675 return 1; /* Accept if non-secure is required */ 676 677 if (conn->sec_level == BT_SECURITY_HIGH) 678 return 1; 679 680 return 0; /* Reject not secure link */ 681} 682EXPORT_SYMBOL(hci_conn_check_secure); 683 684/* Change link key */ 685int hci_conn_change_link_key(struct hci_conn *conn) 686{ 687 BT_DBG("conn %p", conn); 688 689 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) { 690 struct hci_cp_change_conn_link_key cp; 691 cp.handle = cpu_to_le16(conn->handle); 692 hci_send_cmd(conn->hdev, HCI_OP_CHANGE_CONN_LINK_KEY, 693 sizeof(cp), &cp); 694 } 695 696 return 0; 697} 698 699/* Switch role */ 700int hci_conn_switch_role(struct hci_conn *conn, __u8 role) 701{ 702 BT_DBG("conn %p", conn); 703 704 if (!role && conn->link_mode & HCI_LM_MASTER) 705 return 1; 706 707 if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->flags)) { 708 struct hci_cp_switch_role cp; 709 bacpy(&cp.bdaddr, &conn->dst); 710 cp.role = role; 711 hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp); 712 } 713 714 return 0; 715} 716EXPORT_SYMBOL(hci_conn_switch_role); 717 718/* Enter active mode */ 719void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active) 720{ 721 struct hci_dev *hdev = conn->hdev; 722 723 BT_DBG("conn %p mode %d", conn, conn->mode); 724 725 if (test_bit(HCI_RAW, &hdev->flags)) 726 return; 727 728 if (conn->mode != HCI_CM_SNIFF) 729 goto timer; 730 731 if (!test_bit(HCI_CONN_POWER_SAVE, &conn->flags) && !force_active) 732 goto timer; 733 734 if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) { 735 struct hci_cp_exit_sniff_mode cp; 736 cp.handle = cpu_to_le16(conn->handle); 737 hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp); 738 } 739 740timer: 741 if (hdev->idle_timeout > 0) 742 mod_timer(&conn->idle_timer, 743 jiffies + msecs_to_jiffies(hdev->idle_timeout)); 744} 745 746/* Drop all connection on the device */ 747void hci_conn_hash_flush(struct hci_dev *hdev) 748{ 749 struct hci_conn_hash *h = &hdev->conn_hash; 750 struct hci_conn *c, *n; 751 752 BT_DBG("hdev %s", hdev->name); 753 754 list_for_each_entry_safe(c, n, &h->list, list) { 755 c->state = BT_CLOSED; 756 757 hci_proto_disconn_cfm(c, HCI_ERROR_LOCAL_HOST_TERM); 758 hci_conn_del(c); 759 } 760} 761 762/* Check pending connect attempts */ 763void hci_conn_check_pending(struct hci_dev *hdev) 764{ 765 struct hci_conn *conn; 766 767 BT_DBG("hdev %s", hdev->name); 768 769 hci_dev_lock(hdev); 770 771 conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2); 772 if (conn) 773 hci_acl_connect(conn); 774 775 hci_dev_unlock(hdev); 776} 777 778void hci_conn_hold_device(struct hci_conn *conn) 779{ 780 atomic_inc(&conn->devref); 781} 782EXPORT_SYMBOL(hci_conn_hold_device); 783 784void hci_conn_put_device(struct hci_conn *conn) 785{ 786 if (atomic_dec_and_test(&conn->devref)) 787 hci_conn_del_sysfs(conn); 788} 789EXPORT_SYMBOL(hci_conn_put_device); 790 791int hci_get_conn_list(void __user *arg) 792{ 793 struct hci_conn *c; 794 struct hci_conn_list_req req, *cl; 795 struct hci_conn_info *ci; 796 struct hci_dev *hdev; 797 int n = 0, size, err; 798 799 if (copy_from_user(&req, arg, sizeof(req))) 800 return -EFAULT; 801 802 if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci)) 803 return -EINVAL; 804 805 size = sizeof(req) + req.conn_num * sizeof(*ci); 806 807 cl = kmalloc(size, GFP_KERNEL); 808 if (!cl) 809 return -ENOMEM; 810 811 hdev = hci_dev_get(req.dev_id); 812 if (!hdev) { 813 kfree(cl); 814 return -ENODEV; 815 } 816 817 ci = cl->conn_info; 818 819 hci_dev_lock(hdev); 820 list_for_each_entry(c, &hdev->conn_hash.list, list) { 821 bacpy(&(ci + n)->bdaddr, &c->dst); 822 (ci + n)->handle = c->handle; 823 (ci + n)->type = c->type; 824 (ci + n)->out = c->out; 825 (ci + n)->state = c->state; 826 (ci + n)->link_mode = c->link_mode; 827 if (++n >= req.conn_num) 828 break; 829 } 830 hci_dev_unlock(hdev); 831 832 cl->dev_id = hdev->id; 833 cl->conn_num = n; 834 size = sizeof(req) + n * sizeof(*ci); 835 836 hci_dev_put(hdev); 837 838 err = copy_to_user(arg, cl, size); 839 kfree(cl); 840 841 return err ? -EFAULT : 0; 842} 843 844int hci_get_conn_info(struct hci_dev *hdev, void __user *arg) 845{ 846 struct hci_conn_info_req req; 847 struct hci_conn_info ci; 848 struct hci_conn *conn; 849 char __user *ptr = arg + sizeof(req); 850 851 if (copy_from_user(&req, arg, sizeof(req))) 852 return -EFAULT; 853 854 hci_dev_lock(hdev); 855 conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr); 856 if (conn) { 857 bacpy(&ci.bdaddr, &conn->dst); 858 ci.handle = conn->handle; 859 ci.type = conn->type; 860 ci.out = conn->out; 861 ci.state = conn->state; 862 ci.link_mode = conn->link_mode; 863 } 864 hci_dev_unlock(hdev); 865 866 if (!conn) 867 return -ENOENT; 868 869 return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0; 870} 871 872int hci_get_auth_info(struct hci_dev *hdev, void __user *arg) 873{ 874 struct hci_auth_info_req req; 875 struct hci_conn *conn; 876 877 if (copy_from_user(&req, arg, sizeof(req))) 878 return -EFAULT; 879 880 hci_dev_lock(hdev); 881 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr); 882 if (conn) 883 req.type = conn->auth_type; 884 hci_dev_unlock(hdev); 885 886 if (!conn) 887 return -ENOENT; 888 889 return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0; 890} 891 892struct hci_chan *hci_chan_create(struct hci_conn *conn) 893{ 894 struct hci_dev *hdev = conn->hdev; 895 struct hci_chan *chan; 896 897 BT_DBG("%s conn %p", hdev->name, conn); 898 899 chan = kzalloc(sizeof(struct hci_chan), GFP_KERNEL); 900 if (!chan) 901 return NULL; 902 903 chan->conn = conn; 904 skb_queue_head_init(&chan->data_q); 905 906 list_add_rcu(&chan->list, &conn->chan_list); 907 908 return chan; 909} 910 911int hci_chan_del(struct hci_chan *chan) 912{ 913 struct hci_conn *conn = chan->conn; 914 struct hci_dev *hdev = conn->hdev; 915 916 BT_DBG("%s conn %p chan %p", hdev->name, conn, chan); 917 918 list_del_rcu(&chan->list); 919 920 synchronize_rcu(); 921 922 skb_queue_purge(&chan->data_q); 923 kfree(chan); 924 925 return 0; 926} 927 928void hci_chan_list_flush(struct hci_conn *conn) 929{ 930 struct hci_chan *chan, *n; 931 932 BT_DBG("conn %p", conn); 933 934 list_for_each_entry_safe(chan, n, &conn->chan_list, list) 935 hci_chan_del(chan); 936} 937