1 files changed, 116 insertions, 20 deletions

diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index bcd158f40bb..33c4e0cd83b 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -53,11 +53,13 @@ static void hci_le_connect(struct hci_conn *conn)
         conn->state = BT_CONNECT;
         conn->out = 1;
         conn->link_mode |= HCI_LM_MASTER;
+        conn->sec_level = BT_SECURITY_LOW;
 
         memset(&cp, 0, sizeof(cp));
         cp.scan_interval = cpu_to_le16(0x0004);
         cp.scan_window = cpu_to_le16(0x0004);
         bacpy(&cp.peer_addr, &conn->dst);
+        cp.peer_addr_type = conn->dst_type;
         cp.conn_interval_min = cpu_to_le16(0x0008);
         cp.conn_interval_max = cpu_to_le16(0x0100);
         cp.supervision_timeout = cpu_to_le16(0x0064);
@@ -203,6 +205,55 @@ void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max,
 }
 EXPORT_SYMBOL(hci_le_conn_update);
 
+void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __u8 rand[8],
+                                                        __u8 ltk[16])
+{
+        struct hci_dev *hdev = conn->hdev;
+        struct hci_cp_le_start_enc cp;
+
+        BT_DBG("%p", conn);
+
+        memset(&cp, 0, sizeof(cp));
+
+        cp.handle = cpu_to_le16(conn->handle);
+        memcpy(cp.ltk, ltk, sizeof(cp.ltk));
+        cp.ediv = ediv;
+        memcpy(cp.rand, rand, sizeof(rand));
+
+        hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp);
+}
+EXPORT_SYMBOL(hci_le_start_enc);
+
+void hci_le_ltk_reply(struct hci_conn *conn, u8 ltk[16])
+{
+        struct hci_dev *hdev = conn->hdev;
+        struct hci_cp_le_ltk_reply cp;
+
+        BT_DBG("%p", conn);
+
+        memset(&cp, 0, sizeof(cp));
+
+        cp.handle = cpu_to_le16(conn->handle);
+        memcpy(cp.ltk, ltk, sizeof(ltk));
+
+        hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
+}
+EXPORT_SYMBOL(hci_le_ltk_reply);
+
+void hci_le_ltk_neg_reply(struct hci_conn *conn)
+{
+        struct hci_dev *hdev = conn->hdev;
+        struct hci_cp_le_ltk_neg_reply cp;
+
+        BT_DBG("%p", conn);
+
+        memset(&cp, 0, sizeof(cp));
+
+        cp.handle = cpu_to_le16(conn->handle);
+
+        hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(cp), &cp);
+}
+
 /* Device _must_ be locked */
 void hci_sco_setup(struct hci_conn *conn, __u8 status)
 {
@@ -282,7 +333,8 @@ static void hci_conn_auto_accept(unsigned long arg)
         hci_dev_unlock(hdev);
 }
 
-struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
+struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type,
+                                        __u16 pkt_type, bdaddr_t *dst)
 {
         struct hci_conn *conn;
 
@@ -310,14 +362,22 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
                 conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
                 break;
         case SCO_LINK:
-                if (lmp_esco_capable(hdev))
-                        conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
-                                        (hdev->esco_type & EDR_ESCO_MASK);
-                else
-                        conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
-                break;
+                if (!pkt_type)
+                        pkt_type = SCO_ESCO_MASK;
         case ESCO_LINK:
-                conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
+                if (!pkt_type)
+                        pkt_type = ALL_ESCO_MASK;
+                if (lmp_esco_capable(hdev)) {
+                        /* HCI Setup Synchronous Connection Command uses
+                           reverse logic on the EDR_ESCO_MASK bits */
+                        conn->pkt_type = (pkt_type ^ EDR_ESCO_MASK) &
+                                        hdev->esco_type;
+                } else {
+                        /* Legacy HCI Add Sco Connection Command uses a
+                           shifted bitmask */
+                        conn->pkt_type = (pkt_type << 5) & hdev->pkt_type &
+                                        SCO_PTYPE_MASK;
+                }
                 break;
         }
 
@@ -441,7 +501,9 @@ EXPORT_SYMBOL(hci_get_route);
 
 /* Create SCO, ACL or LE connection.
  * Device _must_ be locked */
-struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, __u8 sec_level, __u8 auth_type)
+struct hci_conn *hci_connect(struct hci_dev *hdev, int type,
+                                        __u16 pkt_type, bdaddr_t *dst,
+                                        __u8 sec_level, __u8 auth_type)
 {
         struct hci_conn *acl;
         struct hci_conn *sco;
@@ -450,14 +512,23 @@ struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, __u8
         BT_DBG("%s dst %s", hdev->name, batostr(dst));
 
         if (type == LE_LINK) {
+                struct adv_entry *entry;
+
                 le = hci_conn_hash_lookup_ba(hdev, LE_LINK, dst);
                 if (le)
                         return ERR_PTR(-EBUSY);
-                le = hci_conn_add(hdev, LE_LINK, dst);
+
+                entry = hci_find_adv_entry(hdev, dst);
+                if (!entry)
+                        return ERR_PTR(-EHOSTUNREACH);
+
+                le = hci_conn_add(hdev, LE_LINK, 0, dst);
                 if (!le)
                         return ERR_PTR(-ENOMEM);
-                if (le->state == BT_OPEN)
-                        hci_le_connect(le);
+
+                le->dst_type = entry->bdaddr_type;
+
+                hci_le_connect(le);
 
                 hci_conn_hold(le);
 
@@ -466,7 +537,7 @@ struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, __u8
 
         acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
         if (!acl) {
-                acl = hci_conn_add(hdev, ACL_LINK, dst);
+                acl = hci_conn_add(hdev, ACL_LINK, 0, dst);
                 if (!acl)
                         return NULL;
         }
@@ -485,7 +556,7 @@ struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, __u8
 
         sco = hci_conn_hash_lookup_ba(hdev, type, dst);
         if (!sco) {
-                sco = hci_conn_add(hdev, type, dst);
+                sco = hci_conn_add(hdev, type, pkt_type, dst);
                 if (!sco) {
                         hci_conn_put(acl);
                         return NULL;
@@ -500,7 +571,7 @@ struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, __u8
         if (acl->state == BT_CONNECTED &&
                         (sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
                 acl->power_save = 1;
-                hci_conn_enter_active_mode(acl);
+                hci_conn_enter_active_mode(acl, BT_POWER_FORCE_ACTIVE_ON);
 
                 if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->pend)) {
                         /* defer SCO setup until mode change completed */
@@ -548,9 +619,15 @@ static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 
         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
                 struct hci_cp_auth_requested cp;
+
+                /* encrypt must be pending if auth is also pending */
+                set_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
+
                 cp.handle = cpu_to_le16(conn->handle);
                 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
                                                         sizeof(cp), &cp);
+                if (conn->key_type != 0xff)
+                        set_bit(HCI_CONN_REAUTH_PEND, &conn->pend);
         }
 
         return 0;
@@ -634,9 +711,7 @@ int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level)
         if (sec_level != BT_SECURITY_HIGH)
                 return 1; /* Accept if non-secure is required */
 
-        if (conn->key_type == HCI_LK_AUTH_COMBINATION ||
-                        (conn->key_type == HCI_LK_COMBINATION &&
-                        conn->pin_length == 16))
+        if (conn->sec_level == BT_SECURITY_HIGH)
                 return 1;
 
         return 0; /* Reject not secure link */
@@ -679,7 +754,7 @@ int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
 EXPORT_SYMBOL(hci_conn_switch_role);
 
 /* Enter active mode */
-void hci_conn_enter_active_mode(struct hci_conn *conn)
+void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
 {
         struct hci_dev *hdev = conn->hdev;
 
@@ -688,7 +763,10 @@ void hci_conn_enter_active_mode(struct hci_conn *conn)
         if (test_bit(HCI_RAW, &hdev->flags))
                 return;
 
-        if (conn->mode != HCI_CM_SNIFF || !conn->power_save)
+        if (conn->mode != HCI_CM_SNIFF)
+                goto timer;
+
+        if (!conn->power_save && !force_active)
                 goto timer;
 
         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
@@ -829,6 +907,15 @@ int hci_get_conn_list(void __user *arg)
                 (ci + n)->out   = c->out;
                 (ci + n)->state = c->state;
                 (ci + n)->link_mode = c->link_mode;
+                if (c->type == SCO_LINK) {
+                        (ci + n)->mtu = hdev->sco_mtu;
+                        (ci + n)->cnt = hdev->sco_cnt;
+                        (ci + n)->pkts = hdev->sco_pkts;
+                } else {
+                        (ci + n)->mtu = hdev->acl_mtu;
+                        (ci + n)->cnt = hdev->acl_cnt;
+                        (ci + n)->pkts = hdev->acl_pkts;
+                }
                 if (++n >= req.conn_num)
                         break;
         }
@@ -865,6 +952,15 @@ int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
                 ci.out   = conn->out;
                 ci.state = conn->state;
                 ci.link_mode = conn->link_mode;
+                if (req.type == SCO_LINK) {
+                        ci.mtu = hdev->sco_mtu;
+                        ci.cnt = hdev->sco_cnt;
+                        ci.pkts = hdev->sco_pkts;
+                } else {
+                        ci.mtu = hdev->acl_mtu;
+                        ci.cnt = hdev->acl_cnt;
+                        ci.pkts = hdev->acl_pkts;
+                }
         }
         hci_dev_unlock_bh(hdev);