1 files changed, 77 insertions, 11 deletions

diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 3163330cd4f1..ea7f031f3b04 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -53,11 +53,13 @@ static void hci_le_connect(struct hci_conn *conn)
         conn->state = BT_CONNECT;
         conn->out = 1;
         conn->link_mode |= HCI_LM_MASTER;
+        conn->sec_level = BT_SECURITY_LOW;
 
         memset(&cp, 0, sizeof(cp));
         cp.scan_interval = cpu_to_le16(0x0004);
         cp.scan_window = cpu_to_le16(0x0004);
         bacpy(&cp.peer_addr, &conn->dst);
+        cp.peer_addr_type = conn->dst_type;
         cp.conn_interval_min = cpu_to_le16(0x0008);
         cp.conn_interval_max = cpu_to_le16(0x0100);
         cp.supervision_timeout = cpu_to_le16(0x0064);
@@ -203,6 +205,55 @@ void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max,
 }
 EXPORT_SYMBOL(hci_le_conn_update);
 
+void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __u8 rand[8],
+                                                        __u8 ltk[16])
+{
+        struct hci_dev *hdev = conn->hdev;
+        struct hci_cp_le_start_enc cp;
+
+        BT_DBG("%p", conn);
+
+        memset(&cp, 0, sizeof(cp));
+
+        cp.handle = cpu_to_le16(conn->handle);
+        memcpy(cp.ltk, ltk, sizeof(cp.ltk));
+        cp.ediv = ediv;
+        memcpy(cp.rand, rand, sizeof(rand));
+
+        hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp);
+}
+EXPORT_SYMBOL(hci_le_start_enc);
+
+void hci_le_ltk_reply(struct hci_conn *conn, u8 ltk[16])
+{
+        struct hci_dev *hdev = conn->hdev;
+        struct hci_cp_le_ltk_reply cp;
+
+        BT_DBG("%p", conn);
+
+        memset(&cp, 0, sizeof(cp));
+
+        cp.handle = cpu_to_le16(conn->handle);
+        memcpy(cp.ltk, ltk, sizeof(ltk));
+
+        hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
+}
+EXPORT_SYMBOL(hci_le_ltk_reply);
+
+void hci_le_ltk_neg_reply(struct hci_conn *conn)
+{
+        struct hci_dev *hdev = conn->hdev;
+        struct hci_cp_le_ltk_neg_reply cp;
+
+        BT_DBG("%p", conn);
+
+        memset(&cp, 0, sizeof(cp));
+
+        cp.handle = cpu_to_le16(conn->handle);
+
+        hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(cp), &cp);
+}
+
 /* Device _must_ be locked */
 void hci_sco_setup(struct hci_conn *conn, __u8 status)
 {
@@ -393,6 +444,9 @@ int hci_conn_del(struct hci_conn *conn)
 
         hci_dev_put(hdev);
 
+        if (conn->handle == 0)
+                kfree(conn);
+
         return 0;
 }
 
@@ -447,14 +501,23 @@ struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, __u8
         BT_DBG("%s dst %s", hdev->name, batostr(dst));
 
         if (type == LE_LINK) {
+                struct adv_entry *entry;
+
                 le = hci_conn_hash_lookup_ba(hdev, LE_LINK, dst);
                 if (le)
                         return ERR_PTR(-EBUSY);
+
+                entry = hci_find_adv_entry(hdev, dst);
+                if (!entry)
+                        return ERR_PTR(-EHOSTUNREACH);
+
                 le = hci_conn_add(hdev, LE_LINK, dst);
                 if (!le)
                         return ERR_PTR(-ENOMEM);
-                if (le->state == BT_OPEN)
-                        hci_le_connect(le);
+
+                le->dst_type = entry->bdaddr_type;
+
+                hci_le_connect(le);
 
                 hci_conn_hold(le);
 
@@ -497,7 +560,7 @@ struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, __u8
         if (acl->state == BT_CONNECTED &&
                         (sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
                 acl->power_save = 1;
-                hci_conn_enter_active_mode(acl);
+                hci_conn_enter_active_mode(acl, BT_POWER_FORCE_ACTIVE_ON);
 
                 if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->pend)) {
                         /* defer SCO setup until mode change completed */
@@ -548,6 +611,8 @@ static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
                 cp.handle = cpu_to_le16(conn->handle);
                 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
                                                         sizeof(cp), &cp);
+                if (conn->key_type != 0xff)
+                        set_bit(HCI_CONN_REAUTH_PEND, &conn->pend);
         }
 
         return 0;
@@ -608,11 +673,11 @@ int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
                 goto encrypt;
 
 auth:
-        if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend))
+        if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend))
                 return 0;
 
-        hci_conn_auth(conn, sec_level, auth_type);
-        return 0;
+        if (!hci_conn_auth(conn, sec_level, auth_type))
+                return 0;
 
 encrypt:
         if (conn->link_mode & HCI_LM_ENCRYPT)
@@ -631,9 +696,7 @@ int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level)
         if (sec_level != BT_SECURITY_HIGH)
                 return 1; /* Accept if non-secure is required */
 
-        if (conn->key_type == HCI_LK_AUTH_COMBINATION ||
-                        (conn->key_type == HCI_LK_COMBINATION &&
-                        conn->pin_length == 16))
+        if (conn->sec_level == BT_SECURITY_HIGH)
                 return 1;
 
         return 0; /* Reject not secure link */
@@ -676,7 +739,7 @@ int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
 EXPORT_SYMBOL(hci_conn_switch_role);
 
 /* Enter active mode */
-void hci_conn_enter_active_mode(struct hci_conn *conn)
+void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
 {
         struct hci_dev *hdev = conn->hdev;
 
@@ -685,7 +748,10 @@ void hci_conn_enter_active_mode(struct hci_conn *conn)
         if (test_bit(HCI_RAW, &hdev->flags))
                 return;
 
-        if (conn->mode != HCI_CM_SNIFF || !conn->power_save)
+        if (conn->mode != HCI_CM_SNIFF)
+                goto timer;
+
+        if (!conn->power_save && !force_active)
                 goto timer;
 
         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {