Bluetooth: mgmt: Fix return value of add/remove_uuid
[linux-2.6.git] / net / bluetooth / hci_conn.c
1 /*
2    BlueZ - Bluetooth protocol stack for Linux
3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
4
5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
6
7    This program is free software; you can redistribute it and/or modify
8    it under the terms of the GNU General Public License version 2 as
9    published by the Free Software Foundation;
10
11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22    SOFTWARE IS DISCLAIMED.
23 */
24
25 /* Bluetooth HCI connection handling. */
26
27 #include <linux/module.h>
28
29 #include <linux/types.h>
30 #include <linux/errno.h>
31 #include <linux/kernel.h>
32 #include <linux/slab.h>
33 #include <linux/poll.h>
34 #include <linux/fcntl.h>
35 #include <linux/init.h>
36 #include <linux/skbuff.h>
37 #include <linux/interrupt.h>
38 #include <net/sock.h>
39
40 #include <asm/system.h>
41 #include <linux/uaccess.h>
42 #include <asm/unaligned.h>
43
44 #include <net/bluetooth/bluetooth.h>
45 #include <net/bluetooth/hci_core.h>
46
47 static void hci_le_connect(struct hci_conn *conn)
48 {
49         struct hci_dev *hdev = conn->hdev;
50         struct hci_cp_le_create_conn cp;
51
52         conn->state = BT_CONNECT;
53         conn->out = true;
54         conn->link_mode |= HCI_LM_MASTER;
55         conn->sec_level = BT_SECURITY_LOW;
56
57         memset(&cp, 0, sizeof(cp));
58         cp.scan_interval = cpu_to_le16(0x0060);
59         cp.scan_window = cpu_to_le16(0x0030);
60         bacpy(&cp.peer_addr, &conn->dst);
61         cp.peer_addr_type = conn->dst_type;
62         cp.conn_interval_min = cpu_to_le16(0x0028);
63         cp.conn_interval_max = cpu_to_le16(0x0038);
64         cp.supervision_timeout = cpu_to_le16(0x002a);
65         cp.min_ce_len = cpu_to_le16(0x0000);
66         cp.max_ce_len = cpu_to_le16(0x0000);
67
68         hci_send_cmd(hdev, HCI_OP_LE_CREATE_CONN, sizeof(cp), &cp);
69 }
70
71 static void hci_le_connect_cancel(struct hci_conn *conn)
72 {
73         hci_send_cmd(conn->hdev, HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL);
74 }
75
76 void hci_acl_connect(struct hci_conn *conn)
77 {
78         struct hci_dev *hdev = conn->hdev;
79         struct inquiry_entry *ie;
80         struct hci_cp_create_conn cp;
81
82         BT_DBG("hcon %p", conn);
83
84         conn->state = BT_CONNECT;
85         conn->out = true;
86
87         conn->link_mode = HCI_LM_MASTER;
88
89         conn->attempt++;
90
91         conn->link_policy = hdev->link_policy;
92
93         memset(&cp, 0, sizeof(cp));
94         bacpy(&cp.bdaddr, &conn->dst);
95         cp.pscan_rep_mode = 0x02;
96
97         ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
98         if (ie) {
99                 if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
100                         cp.pscan_rep_mode = ie->data.pscan_rep_mode;
101                         cp.pscan_mode     = ie->data.pscan_mode;
102                         cp.clock_offset   = ie->data.clock_offset |
103                                                         cpu_to_le16(0x8000);
104                 }
105
106                 memcpy(conn->dev_class, ie->data.dev_class, 3);
107                 if (ie->data.ssp_mode > 0)
108                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
109         }
110
111         cp.pkt_type = cpu_to_le16(conn->pkt_type);
112         if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
113                 cp.role_switch = 0x01;
114         else
115                 cp.role_switch = 0x00;
116
117         hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
118 }
119
120 static void hci_acl_connect_cancel(struct hci_conn *conn)
121 {
122         struct hci_cp_create_conn_cancel cp;
123
124         BT_DBG("%p", conn);
125
126         if (conn->hdev->hci_ver < BLUETOOTH_VER_1_2)
127                 return;
128
129         bacpy(&cp.bdaddr, &conn->dst);
130         hci_send_cmd(conn->hdev, HCI_OP_CREATE_CONN_CANCEL, sizeof(cp), &cp);
131 }
132
133 void hci_acl_disconn(struct hci_conn *conn, __u8 reason)
134 {
135         struct hci_cp_disconnect cp;
136
137         BT_DBG("%p", conn);
138
139         conn->state = BT_DISCONN;
140
141         cp.handle = cpu_to_le16(conn->handle);
142         cp.reason = reason;
143         hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp);
144 }
145
146 void hci_add_sco(struct hci_conn *conn, __u16 handle)
147 {
148         struct hci_dev *hdev = conn->hdev;
149         struct hci_cp_add_sco cp;
150
151         BT_DBG("%p", conn);
152
153         conn->state = BT_CONNECT;
154         conn->out = true;
155
156         conn->attempt++;
157
158         cp.handle   = cpu_to_le16(handle);
159         cp.pkt_type = cpu_to_le16(conn->pkt_type);
160
161         hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
162 }
163
164 void hci_setup_sync(struct hci_conn *conn, __u16 handle)
165 {
166         struct hci_dev *hdev = conn->hdev;
167         struct hci_cp_setup_sync_conn cp;
168
169         BT_DBG("%p", conn);
170
171         conn->state = BT_CONNECT;
172         conn->out = true;
173
174         conn->attempt++;
175
176         cp.handle   = cpu_to_le16(handle);
177         cp.pkt_type = cpu_to_le16(conn->pkt_type);
178
179         cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
180         cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
181         cp.max_latency    = cpu_to_le16(0xffff);
182         cp.voice_setting  = cpu_to_le16(hdev->voice_setting);
183         cp.retrans_effort = 0xff;
184
185         hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp);
186 }
187
188 void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max,
189                                         u16 latency, u16 to_multiplier)
190 {
191         struct hci_cp_le_conn_update cp;
192         struct hci_dev *hdev = conn->hdev;
193
194         memset(&cp, 0, sizeof(cp));
195
196         cp.handle               = cpu_to_le16(conn->handle);
197         cp.conn_interval_min    = cpu_to_le16(min);
198         cp.conn_interval_max    = cpu_to_le16(max);
199         cp.conn_latency         = cpu_to_le16(latency);
200         cp.supervision_timeout  = cpu_to_le16(to_multiplier);
201         cp.min_ce_len           = cpu_to_le16(0x0001);
202         cp.max_ce_len           = cpu_to_le16(0x0001);
203
204         hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp);
205 }
206 EXPORT_SYMBOL(hci_le_conn_update);
207
208 void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __u8 rand[8],
209                                                         __u8 ltk[16])
210 {
211         struct hci_dev *hdev = conn->hdev;
212         struct hci_cp_le_start_enc cp;
213
214         BT_DBG("%p", conn);
215
216         memset(&cp, 0, sizeof(cp));
217
218         cp.handle = cpu_to_le16(conn->handle);
219         memcpy(cp.ltk, ltk, sizeof(cp.ltk));
220         cp.ediv = ediv;
221         memcpy(cp.rand, rand, sizeof(cp.rand));
222
223         hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp);
224 }
225 EXPORT_SYMBOL(hci_le_start_enc);
226
227 void hci_le_ltk_reply(struct hci_conn *conn, u8 ltk[16])
228 {
229         struct hci_dev *hdev = conn->hdev;
230         struct hci_cp_le_ltk_reply cp;
231
232         BT_DBG("%p", conn);
233
234         memset(&cp, 0, sizeof(cp));
235
236         cp.handle = cpu_to_le16(conn->handle);
237         memcpy(cp.ltk, ltk, sizeof(ltk));
238
239         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
240 }
241 EXPORT_SYMBOL(hci_le_ltk_reply);
242
243 void hci_le_ltk_neg_reply(struct hci_conn *conn)
244 {
245         struct hci_dev *hdev = conn->hdev;
246         struct hci_cp_le_ltk_neg_reply cp;
247
248         BT_DBG("%p", conn);
249
250         memset(&cp, 0, sizeof(cp));
251
252         cp.handle = cpu_to_le16(conn->handle);
253
254         hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(cp), &cp);
255 }
256
257 /* Device _must_ be locked */
258 void hci_sco_setup(struct hci_conn *conn, __u8 status)
259 {
260         struct hci_conn *sco = conn->link;
261
262         BT_DBG("%p", conn);
263
264         if (!sco)
265                 return;
266
267         if (!status) {
268                 if (lmp_esco_capable(conn->hdev))
269                         hci_setup_sync(sco, conn->handle);
270                 else
271                         hci_add_sco(sco, conn->handle);
272         } else {
273                 hci_proto_connect_cfm(sco, status);
274                 hci_conn_del(sco);
275         }
276 }
277
278 static void hci_conn_timeout(struct work_struct *work)
279 {
280         struct hci_conn *conn = container_of(work, struct hci_conn,
281                                                         disc_work.work);
282         __u8 reason;
283
284         BT_DBG("conn %p state %s", conn, state_to_string(conn->state));
285
286         if (atomic_read(&conn->refcnt))
287                 return;
288
289         switch (conn->state) {
290         case BT_CONNECT:
291         case BT_CONNECT2:
292                 if (conn->out) {
293                         if (conn->type == ACL_LINK)
294                                 hci_acl_connect_cancel(conn);
295                         else if (conn->type == LE_LINK)
296                                 hci_le_connect_cancel(conn);
297                 }
298                 break;
299         case BT_CONFIG:
300         case BT_CONNECTED:
301                 reason = hci_proto_disconn_ind(conn);
302                 hci_acl_disconn(conn, reason);
303                 break;
304         default:
305                 conn->state = BT_CLOSED;
306                 break;
307         }
308 }
309
310 /* Enter sniff mode */
311 static void hci_conn_enter_sniff_mode(struct hci_conn *conn)
312 {
313         struct hci_dev *hdev = conn->hdev;
314
315         BT_DBG("conn %p mode %d", conn, conn->mode);
316
317         if (test_bit(HCI_RAW, &hdev->flags))
318                 return;
319
320         if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn))
321                 return;
322
323         if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF))
324                 return;
325
326         if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
327                 struct hci_cp_sniff_subrate cp;
328                 cp.handle             = cpu_to_le16(conn->handle);
329                 cp.max_latency        = cpu_to_le16(0);
330                 cp.min_remote_timeout = cpu_to_le16(0);
331                 cp.min_local_timeout  = cpu_to_le16(0);
332                 hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
333         }
334
335         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
336                 struct hci_cp_sniff_mode cp;
337                 cp.handle       = cpu_to_le16(conn->handle);
338                 cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
339                 cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
340                 cp.attempt      = cpu_to_le16(4);
341                 cp.timeout      = cpu_to_le16(1);
342                 hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
343         }
344 }
345
346 static void hci_conn_idle(unsigned long arg)
347 {
348         struct hci_conn *conn = (void *) arg;
349
350         BT_DBG("conn %p mode %d", conn, conn->mode);
351
352         hci_conn_enter_sniff_mode(conn);
353 }
354
355 static void hci_conn_auto_accept(unsigned long arg)
356 {
357         struct hci_conn *conn = (void *) arg;
358         struct hci_dev *hdev = conn->hdev;
359
360         hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY, sizeof(conn->dst),
361                                                                 &conn->dst);
362 }
363
364 struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
365 {
366         struct hci_conn *conn;
367
368         BT_DBG("%s dst %s", hdev->name, batostr(dst));
369
370         conn = kzalloc(sizeof(struct hci_conn), GFP_KERNEL);
371         if (!conn)
372                 return NULL;
373
374         bacpy(&conn->dst, dst);
375         conn->hdev  = hdev;
376         conn->type  = type;
377         conn->mode  = HCI_CM_ACTIVE;
378         conn->state = BT_OPEN;
379         conn->auth_type = HCI_AT_GENERAL_BONDING;
380         conn->io_capability = hdev->io_capability;
381         conn->remote_auth = 0xff;
382         conn->key_type = 0xff;
383
384         set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
385         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
386
387         switch (type) {
388         case ACL_LINK:
389                 conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
390                 break;
391         case SCO_LINK:
392                 if (lmp_esco_capable(hdev))
393                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
394                                         (hdev->esco_type & EDR_ESCO_MASK);
395                 else
396                         conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
397                 break;
398         case ESCO_LINK:
399                 conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
400                 break;
401         }
402
403         skb_queue_head_init(&conn->data_q);
404
405         INIT_LIST_HEAD(&conn->chan_list);
406
407         INIT_DELAYED_WORK(&conn->disc_work, hci_conn_timeout);
408         setup_timer(&conn->idle_timer, hci_conn_idle, (unsigned long)conn);
409         setup_timer(&conn->auto_accept_timer, hci_conn_auto_accept,
410                                                         (unsigned long) conn);
411
412         atomic_set(&conn->refcnt, 0);
413
414         hci_dev_hold(hdev);
415
416         hci_conn_hash_add(hdev, conn);
417         if (hdev->notify)
418                 hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
419
420         atomic_set(&conn->devref, 0);
421
422         hci_conn_init_sysfs(conn);
423
424         return conn;
425 }
426
427 int hci_conn_del(struct hci_conn *conn)
428 {
429         struct hci_dev *hdev = conn->hdev;
430
431         BT_DBG("%s conn %p handle %d", hdev->name, conn, conn->handle);
432
433         del_timer(&conn->idle_timer);
434
435         cancel_delayed_work_sync(&conn->disc_work);
436
437         del_timer(&conn->auto_accept_timer);
438
439         if (conn->type == ACL_LINK) {
440                 struct hci_conn *sco = conn->link;
441                 if (sco)
442                         sco->link = NULL;
443
444                 /* Unacked frames */
445                 hdev->acl_cnt += conn->sent;
446         } else if (conn->type == LE_LINK) {
447                 if (hdev->le_pkts)
448                         hdev->le_cnt += conn->sent;
449                 else
450                         hdev->acl_cnt += conn->sent;
451         } else {
452                 struct hci_conn *acl = conn->link;
453                 if (acl) {
454                         acl->link = NULL;
455                         hci_conn_put(acl);
456                 }
457         }
458
459
460         hci_chan_list_flush(conn);
461
462         hci_conn_hash_del(hdev, conn);
463         if (hdev->notify)
464                 hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
465
466         skb_queue_purge(&conn->data_q);
467
468         hci_conn_put_device(conn);
469
470         hci_dev_put(hdev);
471
472         if (conn->handle == 0)
473                 kfree(conn);
474
475         return 0;
476 }
477
478 struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src)
479 {
480         int use_src = bacmp(src, BDADDR_ANY);
481         struct hci_dev *hdev = NULL, *d;
482
483         BT_DBG("%s -> %s", batostr(src), batostr(dst));
484
485         read_lock(&hci_dev_list_lock);
486
487         list_for_each_entry(d, &hci_dev_list, list) {
488                 if (!test_bit(HCI_UP, &d->flags) || test_bit(HCI_RAW, &d->flags))
489                         continue;
490
491                 /* Simple routing:
492                  *   No source address - find interface with bdaddr != dst
493                  *   Source address    - find interface with bdaddr == src
494                  */
495
496                 if (use_src) {
497                         if (!bacmp(&d->bdaddr, src)) {
498                                 hdev = d; break;
499                         }
500                 } else {
501                         if (bacmp(&d->bdaddr, dst)) {
502                                 hdev = d; break;
503                         }
504                 }
505         }
506
507         if (hdev)
508                 hdev = hci_dev_hold(hdev);
509
510         read_unlock(&hci_dev_list_lock);
511         return hdev;
512 }
513 EXPORT_SYMBOL(hci_get_route);
514
515 /* Create SCO, ACL or LE connection.
516  * Device _must_ be locked */
517 struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, __u8 sec_level, __u8 auth_type)
518 {
519         struct hci_conn *acl;
520         struct hci_conn *sco;
521         struct hci_conn *le;
522
523         BT_DBG("%s dst %s", hdev->name, batostr(dst));
524
525         if (type == LE_LINK) {
526                 struct adv_entry *entry;
527
528                 le = hci_conn_hash_lookup_ba(hdev, LE_LINK, dst);
529                 if (le)
530                         return ERR_PTR(-EBUSY);
531
532                 entry = hci_find_adv_entry(hdev, dst);
533                 if (!entry)
534                         return ERR_PTR(-EHOSTUNREACH);
535
536                 le = hci_conn_add(hdev, LE_LINK, dst);
537                 if (!le)
538                         return ERR_PTR(-ENOMEM);
539
540                 le->dst_type = entry->bdaddr_type;
541
542                 hci_le_connect(le);
543
544                 hci_conn_hold(le);
545
546                 return le;
547         }
548
549         acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
550         if (!acl) {
551                 acl = hci_conn_add(hdev, ACL_LINK, dst);
552                 if (!acl)
553                         return ERR_PTR(-ENOMEM);
554         }
555
556         hci_conn_hold(acl);
557
558         if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
559                 acl->sec_level = BT_SECURITY_LOW;
560                 acl->pending_sec_level = sec_level;
561                 acl->auth_type = auth_type;
562                 hci_acl_connect(acl);
563         }
564
565         if (type == ACL_LINK)
566                 return acl;
567
568         sco = hci_conn_hash_lookup_ba(hdev, type, dst);
569         if (!sco) {
570                 sco = hci_conn_add(hdev, type, dst);
571                 if (!sco) {
572                         hci_conn_put(acl);
573                         return ERR_PTR(-ENOMEM);
574                 }
575         }
576
577         acl->link = sco;
578         sco->link = acl;
579
580         hci_conn_hold(sco);
581
582         if (acl->state == BT_CONNECTED &&
583                         (sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
584                 set_bit(HCI_CONN_POWER_SAVE, &acl->flags);
585                 hci_conn_enter_active_mode(acl, BT_POWER_FORCE_ACTIVE_ON);
586
587                 if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->flags)) {
588                         /* defer SCO setup until mode change completed */
589                         set_bit(HCI_CONN_SCO_SETUP_PEND, &acl->flags);
590                         return sco;
591                 }
592
593                 hci_sco_setup(acl, 0x00);
594         }
595
596         return sco;
597 }
598 EXPORT_SYMBOL(hci_connect);
599
600 /* Check link security requirement */
601 int hci_conn_check_link_mode(struct hci_conn *conn)
602 {
603         BT_DBG("conn %p", conn);
604
605         if (hci_conn_ssp_enabled(conn) && !(conn->link_mode & HCI_LM_ENCRYPT))
606                 return 0;
607
608         return 1;
609 }
610 EXPORT_SYMBOL(hci_conn_check_link_mode);
611
612 /* Authenticate remote device */
613 static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
614 {
615         BT_DBG("conn %p", conn);
616
617         if (conn->pending_sec_level > sec_level)
618                 sec_level = conn->pending_sec_level;
619
620         if (sec_level > conn->sec_level)
621                 conn->pending_sec_level = sec_level;
622         else if (conn->link_mode & HCI_LM_AUTH)
623                 return 1;
624
625         /* Make sure we preserve an existing MITM requirement*/
626         auth_type |= (conn->auth_type & 0x01);
627
628         conn->auth_type = auth_type;
629
630         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
631                 struct hci_cp_auth_requested cp;
632
633                 /* encrypt must be pending if auth is also pending */
634                 set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
635
636                 cp.handle = cpu_to_le16(conn->handle);
637                 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
638                                                         sizeof(cp), &cp);
639                 if (conn->key_type != 0xff)
640                         set_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
641         }
642
643         return 0;
644 }
645
646 /* Encrypt the the link */
647 static void hci_conn_encrypt(struct hci_conn *conn)
648 {
649         BT_DBG("conn %p", conn);
650
651         if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
652                 struct hci_cp_set_conn_encrypt cp;
653                 cp.handle  = cpu_to_le16(conn->handle);
654                 cp.encrypt = 0x01;
655                 hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
656                                                                         &cp);
657         }
658 }
659
660 /* Enable security */
661 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
662 {
663         BT_DBG("conn %p", conn);
664
665         /* For sdp we don't need the link key. */
666         if (sec_level == BT_SECURITY_SDP)
667                 return 1;
668
669         /* For non 2.1 devices and low security level we don't need the link
670            key. */
671         if (sec_level == BT_SECURITY_LOW && !hci_conn_ssp_enabled(conn))
672                 return 1;
673
674         /* For other security levels we need the link key. */
675         if (!(conn->link_mode & HCI_LM_AUTH))
676                 goto auth;
677
678         /* An authenticated combination key has sufficient security for any
679            security level. */
680         if (conn->key_type == HCI_LK_AUTH_COMBINATION)
681                 goto encrypt;
682
683         /* An unauthenticated combination key has sufficient security for
684            security level 1 and 2. */
685         if (conn->key_type == HCI_LK_UNAUTH_COMBINATION &&
686                         (sec_level == BT_SECURITY_MEDIUM ||
687                         sec_level == BT_SECURITY_LOW))
688                 goto encrypt;
689
690         /* A combination key has always sufficient security for the security
691            levels 1 or 2. High security level requires the combination key
692            is generated using maximum PIN code length (16).
693            For pre 2.1 units. */
694         if (conn->key_type == HCI_LK_COMBINATION &&
695                         (sec_level != BT_SECURITY_HIGH ||
696                         conn->pin_length == 16))
697                 goto encrypt;
698
699 auth:
700         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags))
701                 return 0;
702
703         if (!hci_conn_auth(conn, sec_level, auth_type))
704                 return 0;
705
706 encrypt:
707         if (conn->link_mode & HCI_LM_ENCRYPT)
708                 return 1;
709
710         hci_conn_encrypt(conn);
711         return 0;
712 }
713 EXPORT_SYMBOL(hci_conn_security);
714
715 /* Check secure link requirement */
716 int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level)
717 {
718         BT_DBG("conn %p", conn);
719
720         if (sec_level != BT_SECURITY_HIGH)
721                 return 1; /* Accept if non-secure is required */
722
723         if (conn->sec_level == BT_SECURITY_HIGH)
724                 return 1;
725
726         return 0; /* Reject not secure link */
727 }
728 EXPORT_SYMBOL(hci_conn_check_secure);
729
730 /* Change link key */
731 int hci_conn_change_link_key(struct hci_conn *conn)
732 {
733         BT_DBG("conn %p", conn);
734
735         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
736                 struct hci_cp_change_conn_link_key cp;
737                 cp.handle = cpu_to_le16(conn->handle);
738                 hci_send_cmd(conn->hdev, HCI_OP_CHANGE_CONN_LINK_KEY,
739                                                         sizeof(cp), &cp);
740         }
741
742         return 0;
743 }
744 EXPORT_SYMBOL(hci_conn_change_link_key);
745
746 /* Switch role */
747 int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
748 {
749         BT_DBG("conn %p", conn);
750
751         if (!role && conn->link_mode & HCI_LM_MASTER)
752                 return 1;
753
754         if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->flags)) {
755                 struct hci_cp_switch_role cp;
756                 bacpy(&cp.bdaddr, &conn->dst);
757                 cp.role = role;
758                 hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
759         }
760
761         return 0;
762 }
763 EXPORT_SYMBOL(hci_conn_switch_role);
764
765 /* Enter active mode */
766 void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
767 {
768         struct hci_dev *hdev = conn->hdev;
769
770         BT_DBG("conn %p mode %d", conn, conn->mode);
771
772         if (test_bit(HCI_RAW, &hdev->flags))
773                 return;
774
775         if (conn->mode != HCI_CM_SNIFF)
776                 goto timer;
777
778         if (!test_bit(HCI_CONN_POWER_SAVE, &conn->flags) && !force_active)
779                 goto timer;
780
781         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
782                 struct hci_cp_exit_sniff_mode cp;
783                 cp.handle = cpu_to_le16(conn->handle);
784                 hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
785         }
786
787 timer:
788         if (hdev->idle_timeout > 0)
789                 mod_timer(&conn->idle_timer,
790                         jiffies + msecs_to_jiffies(hdev->idle_timeout));
791 }
792
793 /* Drop all connection on the device */
794 void hci_conn_hash_flush(struct hci_dev *hdev)
795 {
796         struct hci_conn_hash *h = &hdev->conn_hash;
797         struct hci_conn *c, *n;
798
799         BT_DBG("hdev %s", hdev->name);
800
801         list_for_each_entry_safe(c, n, &h->list, list) {
802                 c->state = BT_CLOSED;
803
804                 hci_proto_disconn_cfm(c, HCI_ERROR_LOCAL_HOST_TERM);
805                 hci_conn_del(c);
806         }
807 }
808
809 /* Check pending connect attempts */
810 void hci_conn_check_pending(struct hci_dev *hdev)
811 {
812         struct hci_conn *conn;
813
814         BT_DBG("hdev %s", hdev->name);
815
816         hci_dev_lock(hdev);
817
818         conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
819         if (conn)
820                 hci_acl_connect(conn);
821
822         hci_dev_unlock(hdev);
823 }
824
825 void hci_conn_hold_device(struct hci_conn *conn)
826 {
827         atomic_inc(&conn->devref);
828 }
829 EXPORT_SYMBOL(hci_conn_hold_device);
830
831 void hci_conn_put_device(struct hci_conn *conn)
832 {
833         if (atomic_dec_and_test(&conn->devref))
834                 hci_conn_del_sysfs(conn);
835 }
836 EXPORT_SYMBOL(hci_conn_put_device);
837
838 int hci_get_conn_list(void __user *arg)
839 {
840         register struct hci_conn *c;
841         struct hci_conn_list_req req, *cl;
842         struct hci_conn_info *ci;
843         struct hci_dev *hdev;
844         int n = 0, size, err;
845
846         if (copy_from_user(&req, arg, sizeof(req)))
847                 return -EFAULT;
848
849         if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
850                 return -EINVAL;
851
852         size = sizeof(req) + req.conn_num * sizeof(*ci);
853
854         cl = kmalloc(size, GFP_KERNEL);
855         if (!cl)
856                 return -ENOMEM;
857
858         hdev = hci_dev_get(req.dev_id);
859         if (!hdev) {
860                 kfree(cl);
861                 return -ENODEV;
862         }
863
864         ci = cl->conn_info;
865
866         hci_dev_lock(hdev);
867         list_for_each_entry(c, &hdev->conn_hash.list, list) {
868                 bacpy(&(ci + n)->bdaddr, &c->dst);
869                 (ci + n)->handle = c->handle;
870                 (ci + n)->type  = c->type;
871                 (ci + n)->out   = c->out;
872                 (ci + n)->state = c->state;
873                 (ci + n)->link_mode = c->link_mode;
874                 if (++n >= req.conn_num)
875                         break;
876         }
877         hci_dev_unlock(hdev);
878
879         cl->dev_id = hdev->id;
880         cl->conn_num = n;
881         size = sizeof(req) + n * sizeof(*ci);
882
883         hci_dev_put(hdev);
884
885         err = copy_to_user(arg, cl, size);
886         kfree(cl);
887
888         return err ? -EFAULT : 0;
889 }
890
891 int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
892 {
893         struct hci_conn_info_req req;
894         struct hci_conn_info ci;
895         struct hci_conn *conn;
896         char __user *ptr = arg + sizeof(req);
897
898         if (copy_from_user(&req, arg, sizeof(req)))
899                 return -EFAULT;
900
901         hci_dev_lock(hdev);
902         conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
903         if (conn) {
904                 bacpy(&ci.bdaddr, &conn->dst);
905                 ci.handle = conn->handle;
906                 ci.type  = conn->type;
907                 ci.out   = conn->out;
908                 ci.state = conn->state;
909                 ci.link_mode = conn->link_mode;
910         }
911         hci_dev_unlock(hdev);
912
913         if (!conn)
914                 return -ENOENT;
915
916         return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
917 }
918
919 int hci_get_auth_info(struct hci_dev *hdev, void __user *arg)
920 {
921         struct hci_auth_info_req req;
922         struct hci_conn *conn;
923
924         if (copy_from_user(&req, arg, sizeof(req)))
925                 return -EFAULT;
926
927         hci_dev_lock(hdev);
928         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr);
929         if (conn)
930                 req.type = conn->auth_type;
931         hci_dev_unlock(hdev);
932
933         if (!conn)
934                 return -ENOENT;
935
936         return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0;
937 }
938
939 struct hci_chan *hci_chan_create(struct hci_conn *conn)
940 {
941         struct hci_dev *hdev = conn->hdev;
942         struct hci_chan *chan;
943
944         BT_DBG("%s conn %p", hdev->name, conn);
945
946         chan = kzalloc(sizeof(struct hci_chan), GFP_KERNEL);
947         if (!chan)
948                 return NULL;
949
950         chan->conn = conn;
951         skb_queue_head_init(&chan->data_q);
952
953         list_add_rcu(&chan->list, &conn->chan_list);
954
955         return chan;
956 }
957
958 int hci_chan_del(struct hci_chan *chan)
959 {
960         struct hci_conn *conn = chan->conn;
961         struct hci_dev *hdev = conn->hdev;
962
963         BT_DBG("%s conn %p chan %p", hdev->name, conn, chan);
964
965         list_del_rcu(&chan->list);
966
967         synchronize_rcu();
968
969         skb_queue_purge(&chan->data_q);
970         kfree(chan);
971
972         return 0;
973 }
974
975 void hci_chan_list_flush(struct hci_conn *conn)
976 {
977         struct hci_chan *chan, *n;
978
979         BT_DBG("conn %p", conn);
980
981         list_for_each_entry_safe(chan, n, &conn->chan_list, list)
982                 hci_chan_del(chan);
983 }