2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22 SOFTWARE IS DISCLAIMED.
25 /* Bluetooth HCI connection handling. */
27 #include <linux/module.h>
29 #include <linux/types.h>
30 #include <linux/errno.h>
31 #include <linux/kernel.h>
32 #include <linux/slab.h>
33 #include <linux/poll.h>
34 #include <linux/fcntl.h>
35 #include <linux/init.h>
36 #include <linux/skbuff.h>
37 #include <linux/interrupt.h>
38 #include <linux/notifier.h>
41 #include <asm/system.h>
42 #include <asm/uaccess.h>
43 #include <asm/unaligned.h>
45 #include <net/bluetooth/bluetooth.h>
46 #include <net/bluetooth/hci_core.h>
48 void hci_acl_connect(struct hci_conn *conn)
50 struct hci_dev *hdev = conn->hdev;
51 struct inquiry_entry *ie;
52 struct hci_cp_create_conn cp;
56 conn->state = BT_CONNECT;
59 conn->link_mode = HCI_LM_MASTER;
63 conn->link_policy = hdev->link_policy;
65 memset(&cp, 0, sizeof(cp));
66 bacpy(&cp.bdaddr, &conn->dst);
67 cp.pscan_rep_mode = 0x02;
69 if ((ie = hci_inquiry_cache_lookup(hdev, &conn->dst))) {
70 if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
71 cp.pscan_rep_mode = ie->data.pscan_rep_mode;
72 cp.pscan_mode = ie->data.pscan_mode;
73 cp.clock_offset = ie->data.clock_offset |
77 memcpy(conn->dev_class, ie->data.dev_class, 3);
78 conn->ssp_mode = ie->data.ssp_mode;
81 cp.pkt_type = cpu_to_le16(conn->pkt_type);
82 if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
83 cp.role_switch = 0x01;
85 cp.role_switch = 0x00;
87 hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
90 static void hci_acl_connect_cancel(struct hci_conn *conn)
92 struct hci_cp_create_conn_cancel cp;
96 if (conn->hdev->hci_ver < 2)
99 bacpy(&cp.bdaddr, &conn->dst);
100 hci_send_cmd(conn->hdev, HCI_OP_CREATE_CONN_CANCEL, sizeof(cp), &cp);
103 void hci_acl_disconn(struct hci_conn *conn, __u8 reason)
105 struct hci_cp_disconnect cp;
109 conn->state = BT_DISCONN;
111 cp.handle = cpu_to_le16(conn->handle);
113 hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp);
116 void hci_add_sco(struct hci_conn *conn, __u16 handle)
118 struct hci_dev *hdev = conn->hdev;
119 struct hci_cp_add_sco cp;
123 conn->state = BT_CONNECT;
128 cp.handle = cpu_to_le16(handle);
129 cp.pkt_type = cpu_to_le16(conn->pkt_type);
131 hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
134 void hci_setup_sync(struct hci_conn *conn, __u16 handle)
136 struct hci_dev *hdev = conn->hdev;
137 struct hci_cp_setup_sync_conn cp;
141 conn->state = BT_CONNECT;
146 cp.handle = cpu_to_le16(handle);
147 cp.pkt_type = cpu_to_le16(conn->pkt_type);
149 cp.tx_bandwidth = cpu_to_le32(0x00001f40);
150 cp.rx_bandwidth = cpu_to_le32(0x00001f40);
151 cp.max_latency = cpu_to_le16(0xffff);
152 cp.voice_setting = cpu_to_le16(hdev->voice_setting);
153 cp.retrans_effort = 0xff;
155 hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp);
158 static void hci_conn_timeout(unsigned long arg)
160 struct hci_conn *conn = (void *) arg;
161 struct hci_dev *hdev = conn->hdev;
163 BT_DBG("conn %p state %d", conn, conn->state);
165 if (atomic_read(&conn->refcnt))
170 switch (conn->state) {
173 if (conn->type == ACL_LINK)
174 hci_acl_connect_cancel(conn);
176 hci_acl_disconn(conn, 0x13);
180 hci_acl_disconn(conn, 0x13);
183 conn->state = BT_CLOSED;
187 hci_dev_unlock(hdev);
190 static void hci_conn_idle(unsigned long arg)
192 struct hci_conn *conn = (void *) arg;
194 BT_DBG("conn %p mode %d", conn, conn->mode);
196 hci_conn_enter_sniff_mode(conn);
199 struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
201 struct hci_conn *conn;
203 BT_DBG("%s dst %s", hdev->name, batostr(dst));
205 conn = kzalloc(sizeof(struct hci_conn), GFP_ATOMIC);
209 bacpy(&conn->dst, dst);
212 conn->mode = HCI_CM_ACTIVE;
213 conn->state = BT_OPEN;
215 conn->power_save = 1;
219 conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
222 if (lmp_esco_capable(hdev))
223 conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
224 (hdev->esco_type & EDR_ESCO_MASK);
226 conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
229 conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
233 skb_queue_head_init(&conn->data_q);
235 setup_timer(&conn->disc_timer, hci_conn_timeout, (unsigned long)conn);
236 setup_timer(&conn->idle_timer, hci_conn_idle, (unsigned long)conn);
238 atomic_set(&conn->refcnt, 0);
242 tasklet_disable(&hdev->tx_task);
244 hci_conn_hash_add(hdev, conn);
246 hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
248 tasklet_enable(&hdev->tx_task);
253 int hci_conn_del(struct hci_conn *conn)
255 struct hci_dev *hdev = conn->hdev;
257 BT_DBG("%s conn %p handle %d", hdev->name, conn, conn->handle);
259 del_timer(&conn->idle_timer);
261 del_timer(&conn->disc_timer);
263 if (conn->type == ACL_LINK) {
264 struct hci_conn *sco = conn->link;
269 hdev->acl_cnt += conn->sent;
271 struct hci_conn *acl = conn->link;
278 tasklet_disable(&hdev->tx_task);
280 hci_conn_hash_del(hdev, conn);
282 hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
284 tasklet_enable(&hdev->tx_task);
286 skb_queue_purge(&conn->data_q);
291 struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src)
293 int use_src = bacmp(src, BDADDR_ANY);
294 struct hci_dev *hdev = NULL;
297 BT_DBG("%s -> %s", batostr(src), batostr(dst));
299 read_lock_bh(&hci_dev_list_lock);
301 list_for_each(p, &hci_dev_list) {
302 struct hci_dev *d = list_entry(p, struct hci_dev, list);
304 if (!test_bit(HCI_UP, &d->flags) || test_bit(HCI_RAW, &d->flags))
308 * No source address - find interface with bdaddr != dst
309 * Source address - find interface with bdaddr == src
313 if (!bacmp(&d->bdaddr, src)) {
317 if (bacmp(&d->bdaddr, dst)) {
324 hdev = hci_dev_hold(hdev);
326 read_unlock_bh(&hci_dev_list_lock);
329 EXPORT_SYMBOL(hci_get_route);
331 /* Create SCO or ACL connection.
332 * Device _must_ be locked */
333 struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, __u8 sec_level, __u8 auth_type)
335 struct hci_conn *acl;
336 struct hci_conn *sco;
338 BT_DBG("%s dst %s", hdev->name, batostr(dst));
340 if (!(acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst))) {
341 if (!(acl = hci_conn_add(hdev, ACL_LINK, dst)))
347 if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
348 acl->sec_level = sec_level;
349 acl->auth_type = auth_type;
350 hci_acl_connect(acl);
353 if (type == ACL_LINK)
356 if (!(sco = hci_conn_hash_lookup_ba(hdev, type, dst))) {
357 if (!(sco = hci_conn_add(hdev, type, dst))) {
368 if (acl->state == BT_CONNECTED &&
369 (sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
370 if (lmp_esco_capable(hdev))
371 hci_setup_sync(sco, acl->handle);
373 hci_add_sco(sco, acl->handle);
378 EXPORT_SYMBOL(hci_connect);
380 /* Check link security requirement */
381 int hci_conn_check_link_mode(struct hci_conn *conn)
383 BT_DBG("conn %p", conn);
385 if (conn->ssp_mode > 0 && conn->hdev->ssp_mode > 0 &&
386 !(conn->link_mode & HCI_LM_ENCRYPT))
391 EXPORT_SYMBOL(hci_conn_check_link_mode);
393 /* Authenticate remote device */
394 static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
396 BT_DBG("conn %p", conn);
398 if (sec_level > conn->sec_level) {
399 conn->sec_level = sec_level;
400 conn->auth_type = auth_type;
401 } else if (conn->link_mode & HCI_LM_AUTH)
404 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
405 struct hci_cp_auth_requested cp;
406 cp.handle = cpu_to_le16(conn->handle);
407 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
414 /* Enable security */
415 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
417 BT_DBG("conn %p", conn);
419 if (conn->auth_type == 0xff)
420 conn->auth_type = auth_type;
422 if (sec_level == BT_SECURITY_SDP)
425 if (sec_level == BT_SECURITY_LOW) {
426 if (conn->ssp_mode > 0 && conn->hdev->ssp_mode > 0)
427 return hci_conn_auth(conn, sec_level, auth_type);
432 if (conn->link_mode & HCI_LM_ENCRYPT)
433 return hci_conn_auth(conn, sec_level, auth_type);
435 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend))
438 if (hci_conn_auth(conn, sec_level, auth_type)) {
439 struct hci_cp_set_conn_encrypt cp;
440 cp.handle = cpu_to_le16(conn->handle);
442 hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT,
448 EXPORT_SYMBOL(hci_conn_security);
450 /* Change link key */
451 int hci_conn_change_link_key(struct hci_conn *conn)
453 BT_DBG("conn %p", conn);
455 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
456 struct hci_cp_change_conn_link_key cp;
457 cp.handle = cpu_to_le16(conn->handle);
458 hci_send_cmd(conn->hdev, HCI_OP_CHANGE_CONN_LINK_KEY,
464 EXPORT_SYMBOL(hci_conn_change_link_key);
467 int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
469 BT_DBG("conn %p", conn);
471 if (!role && conn->link_mode & HCI_LM_MASTER)
474 if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->pend)) {
475 struct hci_cp_switch_role cp;
476 bacpy(&cp.bdaddr, &conn->dst);
478 hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
483 EXPORT_SYMBOL(hci_conn_switch_role);
485 /* Enter active mode */
486 void hci_conn_enter_active_mode(struct hci_conn *conn)
488 struct hci_dev *hdev = conn->hdev;
490 BT_DBG("conn %p mode %d", conn, conn->mode);
492 if (test_bit(HCI_RAW, &hdev->flags))
495 if (conn->mode != HCI_CM_SNIFF || !conn->power_save)
498 if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
499 struct hci_cp_exit_sniff_mode cp;
500 cp.handle = cpu_to_le16(conn->handle);
501 hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
505 if (hdev->idle_timeout > 0)
506 mod_timer(&conn->idle_timer,
507 jiffies + msecs_to_jiffies(hdev->idle_timeout));
510 /* Enter sniff mode */
511 void hci_conn_enter_sniff_mode(struct hci_conn *conn)
513 struct hci_dev *hdev = conn->hdev;
515 BT_DBG("conn %p mode %d", conn, conn->mode);
517 if (test_bit(HCI_RAW, &hdev->flags))
520 if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn))
523 if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF))
526 if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
527 struct hci_cp_sniff_subrate cp;
528 cp.handle = cpu_to_le16(conn->handle);
529 cp.max_latency = cpu_to_le16(0);
530 cp.min_remote_timeout = cpu_to_le16(0);
531 cp.min_local_timeout = cpu_to_le16(0);
532 hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
535 if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
536 struct hci_cp_sniff_mode cp;
537 cp.handle = cpu_to_le16(conn->handle);
538 cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
539 cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
540 cp.attempt = cpu_to_le16(4);
541 cp.timeout = cpu_to_le16(1);
542 hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
546 /* Drop all connection on the device */
547 void hci_conn_hash_flush(struct hci_dev *hdev)
549 struct hci_conn_hash *h = &hdev->conn_hash;
552 BT_DBG("hdev %s", hdev->name);
555 while (p != &h->list) {
558 c = list_entry(p, struct hci_conn, list);
561 c->state = BT_CLOSED;
563 hci_conn_del_sysfs(c);
565 hci_proto_disconn_ind(c, 0x16);
570 /* Check pending connect attempts */
571 void hci_conn_check_pending(struct hci_dev *hdev)
573 struct hci_conn *conn;
575 BT_DBG("hdev %s", hdev->name);
579 conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
581 hci_acl_connect(conn);
583 hci_dev_unlock(hdev);
586 int hci_get_conn_list(void __user *arg)
588 struct hci_conn_list_req req, *cl;
589 struct hci_conn_info *ci;
590 struct hci_dev *hdev;
592 int n = 0, size, err;
594 if (copy_from_user(&req, arg, sizeof(req)))
597 if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
600 size = sizeof(req) + req.conn_num * sizeof(*ci);
602 if (!(cl = kmalloc(size, GFP_KERNEL)))
605 if (!(hdev = hci_dev_get(req.dev_id))) {
612 hci_dev_lock_bh(hdev);
613 list_for_each(p, &hdev->conn_hash.list) {
614 register struct hci_conn *c;
615 c = list_entry(p, struct hci_conn, list);
617 bacpy(&(ci + n)->bdaddr, &c->dst);
618 (ci + n)->handle = c->handle;
619 (ci + n)->type = c->type;
620 (ci + n)->out = c->out;
621 (ci + n)->state = c->state;
622 (ci + n)->link_mode = c->link_mode;
623 if (++n >= req.conn_num)
626 hci_dev_unlock_bh(hdev);
628 cl->dev_id = hdev->id;
630 size = sizeof(req) + n * sizeof(*ci);
634 err = copy_to_user(arg, cl, size);
637 return err ? -EFAULT : 0;
640 int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
642 struct hci_conn_info_req req;
643 struct hci_conn_info ci;
644 struct hci_conn *conn;
645 char __user *ptr = arg + sizeof(req);
647 if (copy_from_user(&req, arg, sizeof(req)))
650 hci_dev_lock_bh(hdev);
651 conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
653 bacpy(&ci.bdaddr, &conn->dst);
654 ci.handle = conn->handle;
655 ci.type = conn->type;
657 ci.state = conn->state;
658 ci.link_mode = conn->link_mode;
660 hci_dev_unlock_bh(hdev);
665 return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
668 int hci_get_auth_info(struct hci_dev *hdev, void __user *arg)
670 struct hci_auth_info_req req;
671 struct hci_conn *conn;
673 if (copy_from_user(&req, arg, sizeof(req)))
676 hci_dev_lock_bh(hdev);
677 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr);
679 req.type = conn->auth_type;
680 hci_dev_unlock_bh(hdev);
685 return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0;