net/bluetooth/hci_conn.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI connection handling. */
  26
  27 #include <linux/export.h>
  28
  29 #include <net/bluetooth/bluetooth.h>
  30 #include <net/bluetooth/hci_core.h>
  31 #include <net/bluetooth/a2mp.h>
  32 #include <net/bluetooth/smp.h>
  33
  34 struct sco_param {
  35         u16 pkt_type;
  36         u16 max_latency;
  37 };
  38
  39 static const struct sco_param sco_param_cvsd[] = {
  40         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000a }, /* S3 */
  41         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x0007 }, /* S2 */
  42         { EDR_ESCO_MASK | ESCO_EV3,   0x0007 }, /* S1 */
  43         { EDR_ESCO_MASK | ESCO_HV3,   0xffff }, /* D1 */
  44         { EDR_ESCO_MASK | ESCO_HV1,   0xffff }, /* D0 */
  45 };
  46
  47 static const struct sco_param sco_param_wideband[] = {
  48         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000d }, /* T2 */
  49         { EDR_ESCO_MASK | ESCO_EV3,   0x0008 }, /* T1 */
  50 };
  51
  52 static void hci_le_create_connection(struct hci_conn *conn)
  53 {
  54         struct hci_dev *hdev = conn->hdev;
  55         struct hci_cp_le_create_conn cp;
  56
  57         conn->state = BT_CONNECT;
  58         conn->out = true;
  59         conn->link_mode |= HCI_LM_MASTER;
  60         conn->sec_level = BT_SECURITY_LOW;
  61
  62         memset(&cp, 0, sizeof(cp));
  63         cp.scan_interval = __constant_cpu_to_le16(0x0060);
  64         cp.scan_window = __constant_cpu_to_le16(0x0030);
  65         bacpy(&cp.peer_addr, &conn->dst);
  66         cp.peer_addr_type = conn->dst_type;
  67         cp.conn_interval_min = __constant_cpu_to_le16(0x0028);
  68         cp.conn_interval_max = __constant_cpu_to_le16(0x0038);
  69         cp.supervision_timeout = __constant_cpu_to_le16(0x002a);
  70         cp.min_ce_len = __constant_cpu_to_le16(0x0000);
  71         cp.max_ce_len = __constant_cpu_to_le16(0x0000);
  72
  73         hci_send_cmd(hdev, HCI_OP_LE_CREATE_CONN, sizeof(cp), &cp);
  74 }
  75
  76 static void hci_le_create_connection_cancel(struct hci_conn *conn)
  77 {
  78         hci_send_cmd(conn->hdev, HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL);
  79 }
  80
  81 static void hci_acl_create_connection(struct hci_conn *conn)
  82 {
  83         struct hci_dev *hdev = conn->hdev;
  84         struct inquiry_entry *ie;
  85         struct hci_cp_create_conn cp;
  86
  87         BT_DBG("hcon %p", conn);
  88
  89         conn->state = BT_CONNECT;
  90         conn->out = true;
  91
  92         conn->link_mode = HCI_LM_MASTER;
  93
  94         conn->attempt++;
  95
  96         conn->link_policy = hdev->link_policy;
  97
  98         memset(&cp, 0, sizeof(cp));
  99         bacpy(&cp.bdaddr, &conn->dst);
 100         cp.pscan_rep_mode = 0x02;
 101
 102         ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
 103         if (ie) {
 104                 if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
 105                         cp.pscan_rep_mode = ie->data.pscan_rep_mode;
 106                         cp.pscan_mode     = ie->data.pscan_mode;
 107                         cp.clock_offset   = ie->data.clock_offset |
 108                                             __constant_cpu_to_le16(0x8000);
 109                 }
 110
 111                 memcpy(conn->dev_class, ie->data.dev_class, 3);
 112                 if (ie->data.ssp_mode > 0)
 113                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
 114         }
 115
 116         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 117         if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
 118                 cp.role_switch = 0x01;
 119         else
 120                 cp.role_switch = 0x00;
 121
 122         hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
 123 }
 124
 125 static void hci_acl_create_connection_cancel(struct hci_conn *conn)
 126 {
 127         struct hci_cp_create_conn_cancel cp;
 128
 129         BT_DBG("hcon %p", conn);
 130
 131         if (conn->hdev->hci_ver < BLUETOOTH_VER_1_2)
 132                 return;
 133
 134         bacpy(&cp.bdaddr, &conn->dst);
 135         hci_send_cmd(conn->hdev, HCI_OP_CREATE_CONN_CANCEL, sizeof(cp), &cp);
 136 }
 137
 138 static void hci_reject_sco(struct hci_conn *conn)
 139 {
 140         struct hci_cp_reject_sync_conn_req cp;
 141
 142         cp.reason = HCI_ERROR_REMOTE_USER_TERM;
 143         bacpy(&cp.bdaddr, &conn->dst);
 144
 145         hci_send_cmd(conn->hdev, HCI_OP_REJECT_SYNC_CONN_REQ, sizeof(cp), &cp);
 146 }
 147
 148 void hci_disconnect(struct hci_conn *conn, __u8 reason)
 149 {
 150         struct hci_cp_disconnect cp;
 151
 152         BT_DBG("hcon %p", conn);
 153
 154         conn->state = BT_DISCONN;
 155
 156         cp.handle = cpu_to_le16(conn->handle);
 157         cp.reason = reason;
 158         hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp);
 159 }
 160
 161 static void hci_amp_disconn(struct hci_conn *conn, __u8 reason)
 162 {
 163         struct hci_cp_disconn_phy_link cp;
 164
 165         BT_DBG("hcon %p", conn);
 166
 167         conn->state = BT_DISCONN;
 168
 169         cp.phy_handle = HCI_PHY_HANDLE(conn->handle);
 170         cp.reason = reason;
 171         hci_send_cmd(conn->hdev, HCI_OP_DISCONN_PHY_LINK,
 172                      sizeof(cp), &cp);
 173 }
 174
 175 static void hci_add_sco(struct hci_conn *conn, __u16 handle)
 176 {
 177         struct hci_dev *hdev = conn->hdev;
 178         struct hci_cp_add_sco cp;
 179
 180         BT_DBG("hcon %p", conn);
 181
 182         conn->state = BT_CONNECT;
 183         conn->out = true;
 184
 185         conn->attempt++;
 186
 187         cp.handle   = cpu_to_le16(handle);
 188         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 189
 190         hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
 191 }
 192
 193 bool hci_setup_sync(struct hci_conn *conn, __u16 handle)
 194 {
 195         struct hci_dev *hdev = conn->hdev;
 196         struct hci_cp_setup_sync_conn cp;
 197         const struct sco_param *param;
 198
 199         BT_DBG("hcon %p", conn);
 200
 201         conn->state = BT_CONNECT;
 202         conn->out = true;
 203
 204         conn->attempt++;
 205
 206         cp.handle   = cpu_to_le16(handle);
 207
 208         cp.tx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
 209         cp.rx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
 210         cp.voice_setting  = cpu_to_le16(conn->setting);
 211
 212         switch (conn->setting & SCO_AIRMODE_MASK) {
 213         case SCO_AIRMODE_TRANSP:
 214                 if (conn->attempt > ARRAY_SIZE(sco_param_wideband))
 215                         return false;
 216                 cp.retrans_effort = 0x02;
 217                 param = &sco_param_wideband[conn->attempt - 1];
 218                 break;
 219         case SCO_AIRMODE_CVSD:
 220                 if (conn->attempt > ARRAY_SIZE(sco_param_cvsd))
 221                         return false;
 222                 cp.retrans_effort = 0x01;
 223                 param = &sco_param_cvsd[conn->attempt - 1];
 224                 break;
 225         default:
 226                 return false;
 227         }
 228
 229         cp.pkt_type = __cpu_to_le16(param->pkt_type);
 230         cp.max_latency = __cpu_to_le16(param->max_latency);
 231
 232         if (hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp) < 0)
 233                 return false;
 234
 235         return true;
 236 }
 237
 238 void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max,
 239                         u16 latency, u16 to_multiplier)
 240 {
 241         struct hci_cp_le_conn_update cp;
 242         struct hci_dev *hdev = conn->hdev;
 243
 244         memset(&cp, 0, sizeof(cp));
 245
 246         cp.handle               = cpu_to_le16(conn->handle);
 247         cp.conn_interval_min    = cpu_to_le16(min);
 248         cp.conn_interval_max    = cpu_to_le16(max);
 249         cp.conn_latency         = cpu_to_le16(latency);
 250         cp.supervision_timeout  = cpu_to_le16(to_multiplier);
 251         cp.min_ce_len           = __constant_cpu_to_le16(0x0001);
 252         cp.max_ce_len           = __constant_cpu_to_le16(0x0001);
 253
 254         hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp);
 255 }
 256
 257 void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __u8 rand[8],
 258                       __u8 ltk[16])
 259 {
 260         struct hci_dev *hdev = conn->hdev;
 261         struct hci_cp_le_start_enc cp;
 262
 263         BT_DBG("hcon %p", conn);
 264
 265         memset(&cp, 0, sizeof(cp));
 266
 267         cp.handle = cpu_to_le16(conn->handle);
 268         memcpy(cp.ltk, ltk, sizeof(cp.ltk));
 269         cp.ediv = ediv;
 270         memcpy(cp.rand, rand, sizeof(cp.rand));
 271
 272         hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp);
 273 }
 274
 275 /* Device _must_ be locked */
 276 void hci_sco_setup(struct hci_conn *conn, __u8 status)
 277 {
 278         struct hci_conn *sco = conn->link;
 279
 280         if (!sco)
 281                 return;
 282
 283         BT_DBG("hcon %p", conn);
 284
 285         if (!status) {
 286                 if (lmp_esco_capable(conn->hdev))
 287                         hci_setup_sync(sco, conn->handle);
 288                 else
 289                         hci_add_sco(sco, conn->handle);
 290         } else {
 291                 hci_proto_connect_cfm(sco, status);
 292                 hci_conn_del(sco);
 293         }
 294 }
 295
 296 static void hci_conn_disconnect(struct hci_conn *conn)
 297 {
 298         __u8 reason = hci_proto_disconn_ind(conn);
 299
 300         switch (conn->type) {
 301         case AMP_LINK:
 302                 hci_amp_disconn(conn, reason);
 303                 break;
 304         default:
 305                 hci_disconnect(conn, reason);
 306                 break;
 307         }
 308 }
 309
 310 static void hci_conn_timeout(struct work_struct *work)
 311 {
 312         struct hci_conn *conn = container_of(work, struct hci_conn,
 313                                              disc_work.work);
 314
 315         BT_DBG("hcon %p state %s", conn, state_to_string(conn->state));
 316
 317         if (atomic_read(&conn->refcnt))
 318                 return;
 319
 320         switch (conn->state) {
 321         case BT_CONNECT:
 322         case BT_CONNECT2:
 323                 if (conn->out) {
 324                         if (conn->type == ACL_LINK)
 325                                 hci_acl_create_connection_cancel(conn);
 326                         else if (conn->type == LE_LINK)
 327                                 hci_le_create_connection_cancel(conn);
 328                 } else if (conn->type == SCO_LINK || conn->type == ESCO_LINK) {
 329                         hci_reject_sco(conn);
 330                 }
 331                 break;
 332         case BT_CONFIG:
 333         case BT_CONNECTED:
 334                 hci_conn_disconnect(conn);
 335                 break;
 336         default:
 337                 conn->state = BT_CLOSED;
 338                 break;
 339         }
 340 }
 341
 342 /* Enter sniff mode */
 343 static void hci_conn_enter_sniff_mode(struct hci_conn *conn)
 344 {
 345         struct hci_dev *hdev = conn->hdev;
 346
 347         BT_DBG("hcon %p mode %d", conn, conn->mode);
 348
 349         if (test_bit(HCI_RAW, &hdev->flags))
 350                 return;
 351
 352         if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn))
 353                 return;
 354
 355         if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF))
 356                 return;
 357
 358         if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
 359                 struct hci_cp_sniff_subrate cp;
 360                 cp.handle             = cpu_to_le16(conn->handle);
 361                 cp.max_latency        = __constant_cpu_to_le16(0);
 362                 cp.min_remote_timeout = __constant_cpu_to_le16(0);
 363                 cp.min_local_timeout  = __constant_cpu_to_le16(0);
 364                 hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
 365         }
 366
 367         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
 368                 struct hci_cp_sniff_mode cp;
 369                 cp.handle       = cpu_to_le16(conn->handle);
 370                 cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
 371                 cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
 372                 cp.attempt      = __constant_cpu_to_le16(4);
 373                 cp.timeout      = __constant_cpu_to_le16(1);
 374                 hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
 375         }
 376 }
 377
 378 static void hci_conn_idle(unsigned long arg)
 379 {
 380         struct hci_conn *conn = (void *) arg;
 381
 382         BT_DBG("hcon %p mode %d", conn, conn->mode);
 383
 384         hci_conn_enter_sniff_mode(conn);
 385 }
 386
 387 static void hci_conn_auto_accept(unsigned long arg)
 388 {
 389         struct hci_conn *conn = (void *) arg;
 390         struct hci_dev *hdev = conn->hdev;
 391
 392         hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY, sizeof(conn->dst),
 393                      &conn->dst);
 394 }
 395
 396 struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
 397 {
 398         struct hci_conn *conn;
 399
 400         BT_DBG("%s dst %pMR", hdev->name, dst);
 401
 402         conn = kzalloc(sizeof(struct hci_conn), GFP_KERNEL);
 403         if (!conn)
 404                 return NULL;
 405
 406         bacpy(&conn->dst, dst);
 407         conn->hdev  = hdev;
 408         conn->type  = type;
 409         conn->mode  = HCI_CM_ACTIVE;
 410         conn->state = BT_OPEN;
 411         conn->auth_type = HCI_AT_GENERAL_BONDING;
 412         conn->io_capability = hdev->io_capability;
 413         conn->remote_auth = 0xff;
 414         conn->key_type = 0xff;
 415
 416         set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
 417         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
 418
 419         switch (type) {
 420         case ACL_LINK:
 421                 conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
 422                 break;
 423         case SCO_LINK:
 424                 if (lmp_esco_capable(hdev))
 425                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
 426                                         (hdev->esco_type & EDR_ESCO_MASK);
 427                 else
 428                         conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
 429                 break;
 430         case ESCO_LINK:
 431                 conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
 432                 break;
 433         }
 434
 435         skb_queue_head_init(&conn->data_q);
 436
 437         INIT_LIST_HEAD(&conn->chan_list);
 438
 439         INIT_DELAYED_WORK(&conn->disc_work, hci_conn_timeout);
 440         setup_timer(&conn->idle_timer, hci_conn_idle, (unsigned long)conn);
 441         setup_timer(&conn->auto_accept_timer, hci_conn_auto_accept,
 442                     (unsigned long) conn);
 443
 444         atomic_set(&conn->refcnt, 0);
 445
 446         hci_dev_hold(hdev);
 447
 448         hci_conn_hash_add(hdev, conn);
 449         if (hdev->notify)
 450                 hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
 451
 452         hci_conn_init_sysfs(conn);
 453
 454         return conn;
 455 }
 456
 457 int hci_conn_del(struct hci_conn *conn)
 458 {
 459         struct hci_dev *hdev = conn->hdev;
 460
 461         BT_DBG("%s hcon %p handle %d", hdev->name, conn, conn->handle);
 462
 463         del_timer(&conn->idle_timer);
 464
 465         cancel_delayed_work_sync(&conn->disc_work);
 466
 467         del_timer(&conn->auto_accept_timer);
 468
 469         if (conn->type == ACL_LINK) {
 470                 struct hci_conn *sco = conn->link;
 471                 if (sco)
 472                         sco->link = NULL;
 473
 474                 /* Unacked frames */
 475                 hdev->acl_cnt += conn->sent;
 476         } else if (conn->type == LE_LINK) {
 477                 if (hdev->le_pkts)
 478                         hdev->le_cnt += conn->sent;
 479                 else
 480                         hdev->acl_cnt += conn->sent;
 481         } else {
 482                 struct hci_conn *acl = conn->link;
 483                 if (acl) {
 484                         acl->link = NULL;
 485                         hci_conn_drop(acl);
 486                 }
 487         }
 488
 489         hci_chan_list_flush(conn);
 490
 491         if (conn->amp_mgr)
 492                 amp_mgr_put(conn->amp_mgr);
 493
 494         hci_conn_hash_del(hdev, conn);
 495         if (hdev->notify)
 496                 hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
 497
 498         skb_queue_purge(&conn->data_q);
 499
 500         hci_conn_del_sysfs(conn);
 501
 502         hci_dev_put(hdev);
 503
 504         hci_conn_put(conn);
 505
 506         return 0;
 507 }
 508
 509 struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src)
 510 {
 511         int use_src = bacmp(src, BDADDR_ANY);
 512         struct hci_dev *hdev = NULL, *d;
 513
 514         BT_DBG("%pMR -> %pMR", src, dst);
 515
 516         read_lock(&hci_dev_list_lock);
 517
 518         list_for_each_entry(d, &hci_dev_list, list) {
 519                 if (!test_bit(HCI_UP, &d->flags) ||
 520                     test_bit(HCI_RAW, &d->flags) ||
 521                     d->dev_type != HCI_BREDR)
 522                         continue;
 523
 524                 /* Simple routing:
 525                  *   No source address - find interface with bdaddr != dst
 526                  *   Source address    - find interface with bdaddr == src
 527                  */
 528
 529                 if (use_src) {
 530                         if (!bacmp(&d->bdaddr, src)) {
 531                                 hdev = d; break;
 532                         }
 533                 } else {
 534                         if (bacmp(&d->bdaddr, dst)) {
 535                                 hdev = d; break;
 536                         }
 537                 }
 538         }
 539
 540         if (hdev)
 541                 hdev = hci_dev_hold(hdev);
 542
 543         read_unlock(&hci_dev_list_lock);
 544         return hdev;
 545 }
 546 EXPORT_SYMBOL(hci_get_route);
 547
 548 static struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,
 549                                     u8 dst_type, u8 sec_level, u8 auth_type)
 550 {
 551         struct hci_conn *le;
 552
 553         if (test_bit(HCI_LE_PERIPHERAL, &hdev->flags))
 554                 return ERR_PTR(-ENOTSUPP);
 555
 556         le = hci_conn_hash_lookup_ba(hdev, LE_LINK, dst);
 557         if (!le) {
 558                 le = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
 559                 if (le)
 560                         return ERR_PTR(-EBUSY);
 561
 562                 le = hci_conn_add(hdev, LE_LINK, dst);
 563                 if (!le)
 564                         return ERR_PTR(-ENOMEM);
 565
 566                 le->dst_type = bdaddr_to_le(dst_type);
 567                 hci_le_create_connection(le);
 568         }
 569
 570         le->pending_sec_level = sec_level;
 571         le->auth_type = auth_type;
 572
 573         hci_conn_hold(le);
 574
 575         return le;
 576 }
 577
 578 static struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst,
 579                                                 u8 sec_level, u8 auth_type)
 580 {
 581         struct hci_conn *acl;
 582
 583         acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
 584         if (!acl) {
 585                 acl = hci_conn_add(hdev, ACL_LINK, dst);
 586                 if (!acl)
 587                         return ERR_PTR(-ENOMEM);
 588         }
 589
 590         hci_conn_hold(acl);
 591
 592         if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
 593                 acl->sec_level = BT_SECURITY_LOW;
 594                 acl->pending_sec_level = sec_level;
 595                 acl->auth_type = auth_type;
 596                 hci_acl_create_connection(acl);
 597         }
 598
 599         return acl;
 600 }
 601
 602 struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type, bdaddr_t *dst,
 603                                  __u16 setting)
 604 {
 605         struct hci_conn *acl;
 606         struct hci_conn *sco;
 607
 608         acl = hci_connect_acl(hdev, dst, BT_SECURITY_LOW, HCI_AT_NO_BONDING);
 609         if (IS_ERR(acl))
 610                 return acl;
 611
 612         sco = hci_conn_hash_lookup_ba(hdev, type, dst);
 613         if (!sco) {
 614                 sco = hci_conn_add(hdev, type, dst);
 615                 if (!sco) {
 616                         hci_conn_drop(acl);
 617                         return ERR_PTR(-ENOMEM);
 618                 }
 619         }
 620
 621         acl->link = sco;
 622         sco->link = acl;
 623
 624         hci_conn_hold(sco);
 625
 626         sco->setting = setting;
 627
 628         if (acl->state == BT_CONNECTED &&
 629             (sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
 630                 set_bit(HCI_CONN_POWER_SAVE, &acl->flags);
 631                 hci_conn_enter_active_mode(acl, BT_POWER_FORCE_ACTIVE_ON);
 632
 633                 if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->flags)) {
 634                         /* defer SCO setup until mode change completed */
 635                         set_bit(HCI_CONN_SCO_SETUP_PEND, &acl->flags);
 636                         return sco;
 637                 }
 638
 639                 hci_sco_setup(acl, 0x00);
 640         }
 641
 642         return sco;
 643 }
 644
 645 /* Create SCO, ACL or LE connection. */
 646 struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst,
 647                              __u8 dst_type, __u8 sec_level, __u8 auth_type)
 648 {
 649         BT_DBG("%s dst %pMR type 0x%x", hdev->name, dst, type);
 650
 651         switch (type) {
 652         case LE_LINK:
 653                 return hci_connect_le(hdev, dst, dst_type, sec_level, auth_type);
 654         case ACL_LINK:
 655                 return hci_connect_acl(hdev, dst, sec_level, auth_type);
 656         }
 657
 658         return ERR_PTR(-EINVAL);
 659 }
 660
 661 /* Check link security requirement */
 662 int hci_conn_check_link_mode(struct hci_conn *conn)
 663 {
 664         BT_DBG("hcon %p", conn);
 665
 666         if (hci_conn_ssp_enabled(conn) && !(conn->link_mode & HCI_LM_ENCRYPT))
 667                 return 0;
 668
 669         return 1;
 670 }
 671
 672 /* Authenticate remote device */
 673 static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 674 {
 675         BT_DBG("hcon %p", conn);
 676
 677         if (conn->pending_sec_level > sec_level)
 678                 sec_level = conn->pending_sec_level;
 679
 680         if (sec_level > conn->sec_level)
 681                 conn->pending_sec_level = sec_level;
 682         else if (conn->link_mode & HCI_LM_AUTH)
 683                 return 1;
 684
 685         /* Make sure we preserve an existing MITM requirement*/
 686         auth_type |= (conn->auth_type & 0x01);
 687
 688         conn->auth_type = auth_type;
 689
 690         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
 691                 struct hci_cp_auth_requested cp;
 692
 693                 /* encrypt must be pending if auth is also pending */
 694                 set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
 695
 696                 cp.handle = cpu_to_le16(conn->handle);
 697                 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
 698                              sizeof(cp), &cp);
 699                 if (conn->key_type != 0xff)
 700                         set_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
 701         }
 702
 703         return 0;
 704 }
 705
 706 /* Encrypt the the link */
 707 static void hci_conn_encrypt(struct hci_conn *conn)
 708 {
 709         BT_DBG("hcon %p", conn);
 710
 711         if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
 712                 struct hci_cp_set_conn_encrypt cp;
 713                 cp.handle  = cpu_to_le16(conn->handle);
 714                 cp.encrypt = 0x01;
 715                 hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
 716                              &cp);
 717         }
 718 }
 719
 720 /* Enable security */
 721 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 722 {
 723         BT_DBG("hcon %p", conn);
 724
 725         if (conn->type == LE_LINK)
 726                 return smp_conn_security(conn, sec_level);
 727
 728         /* For sdp we don't need the link key. */
 729         if (sec_level == BT_SECURITY_SDP)
 730                 return 1;
 731
 732         /* For non 2.1 devices and low security level we don't need the link
 733            key. */
 734         if (sec_level == BT_SECURITY_LOW && !hci_conn_ssp_enabled(conn))
 735                 return 1;
 736
 737         /* For other security levels we need the link key. */
 738         if (!(conn->link_mode & HCI_LM_AUTH))
 739                 goto auth;
 740
 741         /* An authenticated combination key has sufficient security for any
 742            security level. */
 743         if (conn->key_type == HCI_LK_AUTH_COMBINATION)
 744                 goto encrypt;
 745
 746         /* An unauthenticated combination key has sufficient security for
 747            security level 1 and 2. */
 748         if (conn->key_type == HCI_LK_UNAUTH_COMBINATION &&
 749             (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW))
 750                 goto encrypt;
 751
 752         /* A combination key has always sufficient security for the security
 753            levels 1 or 2. High security level requires the combination key
 754            is generated using maximum PIN code length (16).
 755            For pre 2.1 units. */
 756         if (conn->key_type == HCI_LK_COMBINATION &&
 757             (sec_level != BT_SECURITY_HIGH || conn->pin_length == 16))
 758                 goto encrypt;
 759
 760 auth:
 761         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags))
 762                 return 0;
 763
 764         if (!hci_conn_auth(conn, sec_level, auth_type))
 765                 return 0;
 766
 767 encrypt:
 768         if (conn->link_mode & HCI_LM_ENCRYPT)
 769                 return 1;
 770
 771         hci_conn_encrypt(conn);
 772         return 0;
 773 }
 774 EXPORT_SYMBOL(hci_conn_security);
 775
 776 /* Check secure link requirement */
 777 int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level)
 778 {
 779         BT_DBG("hcon %p", conn);
 780
 781         if (sec_level != BT_SECURITY_HIGH)
 782                 return 1; /* Accept if non-secure is required */
 783
 784         if (conn->sec_level == BT_SECURITY_HIGH)
 785                 return 1;
 786
 787         return 0; /* Reject not secure link */
 788 }
 789 EXPORT_SYMBOL(hci_conn_check_secure);
 790
 791 /* Change link key */
 792 int hci_conn_change_link_key(struct hci_conn *conn)
 793 {
 794         BT_DBG("hcon %p", conn);
 795
 796         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
 797                 struct hci_cp_change_conn_link_key cp;
 798                 cp.handle = cpu_to_le16(conn->handle);
 799                 hci_send_cmd(conn->hdev, HCI_OP_CHANGE_CONN_LINK_KEY,
 800                              sizeof(cp), &cp);
 801         }
 802
 803         return 0;
 804 }
 805
 806 /* Switch role */
 807 int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
 808 {
 809         BT_DBG("hcon %p", conn);
 810
 811         if (!role && conn->link_mode & HCI_LM_MASTER)
 812                 return 1;
 813
 814         if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->flags)) {
 815                 struct hci_cp_switch_role cp;
 816                 bacpy(&cp.bdaddr, &conn->dst);
 817                 cp.role = role;
 818                 hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
 819         }
 820
 821         return 0;
 822 }
 823 EXPORT_SYMBOL(hci_conn_switch_role);
 824
 825 /* Enter active mode */
 826 void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
 827 {
 828         struct hci_dev *hdev = conn->hdev;
 829
 830         BT_DBG("hcon %p mode %d", conn, conn->mode);
 831
 832         if (test_bit(HCI_RAW, &hdev->flags))
 833                 return;
 834
 835         if (conn->mode != HCI_CM_SNIFF)
 836                 goto timer;
 837
 838         if (!test_bit(HCI_CONN_POWER_SAVE, &conn->flags) && !force_active)
 839                 goto timer;
 840
 841         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
 842                 struct hci_cp_exit_sniff_mode cp;
 843                 cp.handle = cpu_to_le16(conn->handle);
 844                 hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
 845         }
 846
 847 timer:
 848         if (hdev->idle_timeout > 0)
 849                 mod_timer(&conn->idle_timer,
 850                           jiffies + msecs_to_jiffies(hdev->idle_timeout));
 851 }
 852
 853 /* Drop all connection on the device */
 854 void hci_conn_hash_flush(struct hci_dev *hdev)
 855 {
 856         struct hci_conn_hash *h = &hdev->conn_hash;
 857         struct hci_conn *c, *n;
 858
 859         BT_DBG("hdev %s", hdev->name);
 860
 861         list_for_each_entry_safe(c, n, &h->list, list) {
 862                 c->state = BT_CLOSED;
 863
 864                 hci_proto_disconn_cfm(c, HCI_ERROR_LOCAL_HOST_TERM);
 865                 hci_conn_del(c);
 866         }
 867 }
 868
 869 /* Check pending connect attempts */
 870 void hci_conn_check_pending(struct hci_dev *hdev)
 871 {
 872         struct hci_conn *conn;
 873
 874         BT_DBG("hdev %s", hdev->name);
 875
 876         hci_dev_lock(hdev);
 877
 878         conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
 879         if (conn)
 880                 hci_acl_create_connection(conn);
 881
 882         hci_dev_unlock(hdev);
 883 }
 884
 885 int hci_get_conn_list(void __user *arg)
 886 {
 887         struct hci_conn *c;
 888         struct hci_conn_list_req req, *cl;
 889         struct hci_conn_info *ci;
 890         struct hci_dev *hdev;
 891         int n = 0, size, err;
 892
 893         if (copy_from_user(&req, arg, sizeof(req)))
 894                 return -EFAULT;
 895
 896         if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
 897                 return -EINVAL;
 898
 899         size = sizeof(req) + req.conn_num * sizeof(*ci);
 900
 901         cl = kmalloc(size, GFP_KERNEL);
 902         if (!cl)
 903                 return -ENOMEM;
 904
 905         hdev = hci_dev_get(req.dev_id);
 906         if (!hdev) {
 907                 kfree(cl);
 908                 return -ENODEV;
 909         }
 910
 911         ci = cl->conn_info;
 912
 913         hci_dev_lock(hdev);
 914         list_for_each_entry(c, &hdev->conn_hash.list, list) {
 915                 bacpy(&(ci + n)->bdaddr, &c->dst);
 916                 (ci + n)->handle = c->handle;
 917                 (ci + n)->type  = c->type;
 918                 (ci + n)->out   = c->out;
 919                 (ci + n)->state = c->state;
 920                 (ci + n)->link_mode = c->link_mode;
 921                 if (++n >= req.conn_num)
 922                         break;
 923         }
 924         hci_dev_unlock(hdev);
 925
 926         cl->dev_id = hdev->id;
 927         cl->conn_num = n;
 928         size = sizeof(req) + n * sizeof(*ci);
 929
 930         hci_dev_put(hdev);
 931
 932         err = copy_to_user(arg, cl, size);
 933         kfree(cl);
 934
 935         return err ? -EFAULT : 0;
 936 }
 937
 938 int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
 939 {
 940         struct hci_conn_info_req req;
 941         struct hci_conn_info ci;
 942         struct hci_conn *conn;
 943         char __user *ptr = arg + sizeof(req);
 944
 945         if (copy_from_user(&req, arg, sizeof(req)))
 946                 return -EFAULT;
 947
 948         hci_dev_lock(hdev);
 949         conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
 950         if (conn) {
 951                 bacpy(&ci.bdaddr, &conn->dst);
 952                 ci.handle = conn->handle;
 953                 ci.type  = conn->type;
 954                 ci.out   = conn->out;
 955                 ci.state = conn->state;
 956                 ci.link_mode = conn->link_mode;
 957         }
 958         hci_dev_unlock(hdev);
 959
 960         if (!conn)
 961                 return -ENOENT;
 962
 963         return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
 964 }
 965
 966 int hci_get_auth_info(struct hci_dev *hdev, void __user *arg)
 967 {
 968         struct hci_auth_info_req req;
 969         struct hci_conn *conn;
 970
 971         if (copy_from_user(&req, arg, sizeof(req)))
 972                 return -EFAULT;
 973
 974         hci_dev_lock(hdev);
 975         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr);
 976         if (conn)
 977                 req.type = conn->auth_type;
 978         hci_dev_unlock(hdev);
 979
 980         if (!conn)
 981                 return -ENOENT;
 982
 983         return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0;
 984 }
 985
 986 struct hci_chan *hci_chan_create(struct hci_conn *conn)
 987 {
 988         struct hci_dev *hdev = conn->hdev;
 989         struct hci_chan *chan;
 990
 991         BT_DBG("%s hcon %p", hdev->name, conn);
 992
 993         chan = kzalloc(sizeof(struct hci_chan), GFP_KERNEL);
 994         if (!chan)
 995                 return NULL;
 996
 997         chan->conn = conn;
 998         skb_queue_head_init(&chan->data_q);
 999         chan->state = BT_CONNECTED;
1000
1001         list_add_rcu(&chan->list, &conn->chan_list);
1002
1003         return chan;
1004 }
1005
1006 void hci_chan_del(struct hci_chan *chan)
1007 {
1008         struct hci_conn *conn = chan->conn;
1009         struct hci_dev *hdev = conn->hdev;
1010
1011         BT_DBG("%s hcon %p chan %p", hdev->name, conn, chan);
1012
1013         list_del_rcu(&chan->list);
1014
1015         synchronize_rcu();
1016
1017         hci_conn_drop(conn);
1018
1019         skb_queue_purge(&chan->data_q);
1020         kfree(chan);
1021 }
1022
1023 void hci_chan_list_flush(struct hci_conn *conn)
1024 {
1025         struct hci_chan *chan, *n;
1026
1027         BT_DBG("hcon %p", conn);
1028
1029         list_for_each_entry_safe(chan, n, &conn->chan_list, list)
1030                 hci_chan_del(chan);
1031 }
1032
1033 static struct hci_chan *__hci_chan_lookup_handle(struct hci_conn *hcon,
1034                                                  __u16 handle)
1035 {
1036         struct hci_chan *hchan;
1037
1038         list_for_each_entry(hchan, &hcon->chan_list, list) {
1039                 if (hchan->handle == handle)
1040                         return hchan;
1041         }
1042
1043         return NULL;
1044 }
1045
1046 struct hci_chan *hci_chan_lookup_handle(struct hci_dev *hdev, __u16 handle)
1047 {
1048         struct hci_conn_hash *h = &hdev->conn_hash;
1049         struct hci_conn *hcon;
1050         struct hci_chan *hchan = NULL;
1051
1052         rcu_read_lock();
1053
1054         list_for_each_entry_rcu(hcon, &h->list, list) {
1055                 hchan = __hci_chan_lookup_handle(hcon, handle);
1056                 if (hchan)
1057                         break;
1058         }
1059
1060         rcu_read_unlock();
1061
1062         return hchan;
1063 }