[linux-2.6-block.git] / net / bluetooth / hci_conn.c

/*
   BlueZ - Bluetooth protocol stack for Linux
   Copyright (C) 2000-2001 Qualcomm Incorporated

   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>

   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License version 2 as
   published by the Free Software Foundation;

   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
   SOFTWARE IS DISCLAIMED.
*/

/* Bluetooth HCI connection handling. */

#include <linux/module.h>

#include <linux/types.h>
#include <linux/errno.h>
#include <linux/kernel.h>
#include <linux/slab.h>
#include <linux/poll.h>
#include <linux/fcntl.h>
#include <linux/init.h>
#include <linux/skbuff.h>
#include <linux/interrupt.h>
#include <linux/notifier.h>
#include <net/sock.h>

#include <asm/system.h>
#include <asm/uaccess.h>
#include <asm/unaligned.h>

#include <net/bluetooth/bluetooth.h>
#include <net/bluetooth/hci_core.h>

#ifndef CONFIG_BT_HCI_CORE_DEBUG
#undef  BT_DBG
#define BT_DBG(D...)
#endif

void hci_acl_connect(struct hci_conn *conn)
{
	struct hci_dev *hdev = conn->hdev;
	struct inquiry_entry *ie;
	struct hci_cp_create_conn cp;

	BT_DBG("%p", conn);

	conn->state = BT_CONNECT;
	conn->out   = 1;
	conn->link_mode = HCI_LM_MASTER;

	conn->attempt++;

	memset(&cp, 0, sizeof(cp));
	bacpy(&cp.bdaddr, &conn->dst);
	cp.pscan_rep_mode = 0x02;

	if ((ie = hci_inquiry_cache_lookup(hdev, &conn->dst)) &&
			inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
		cp.pscan_rep_mode = ie->data.pscan_rep_mode;
		cp.pscan_mode     = ie->data.pscan_mode;
		cp.clock_offset   = ie->data.clock_offset | cpu_to_le16(0x8000);
		memcpy(conn->dev_class, ie->data.dev_class, 3);
	}

	cp.pkt_type = cpu_to_le16(hdev->pkt_type & ACL_PTYPE_MASK);
	if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
		cp.role_switch = 0x01;
	else
		cp.role_switch = 0x00;

	hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
}

static void hci_acl_connect_cancel(struct hci_conn *conn)
{
	struct hci_cp_create_conn_cancel cp;

	BT_DBG("%p", conn);

	if (conn->hdev->hci_ver < 2)
		return;

	bacpy(&cp.bdaddr, &conn->dst);
	hci_send_cmd(conn->hdev, HCI_OP_CREATE_CONN_CANCEL, sizeof(cp), &cp);
}

void hci_acl_disconn(struct hci_conn *conn, __u8 reason)
{
	struct hci_cp_disconnect cp;

	BT_DBG("%p", conn);

	conn->state = BT_DISCONN;

	cp.handle = cpu_to_le16(conn->handle);
	cp.reason = reason;
	hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp);
}

void hci_add_sco(struct hci_conn *conn, __u16 handle)
{
	struct hci_dev *hdev = conn->hdev;
	struct hci_cp_add_sco cp;

	BT_DBG("%p", conn);

	conn->state = BT_CONNECT;
	conn->out = 1;

	cp.handle   = cpu_to_le16(handle);
	cp.pkt_type = cpu_to_le16(hdev->pkt_type & SCO_PTYPE_MASK);

	hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
}

void hci_setup_sync(struct hci_conn *conn, __u16 handle)
{
	struct hci_dev *hdev = conn->hdev;
	struct hci_cp_setup_sync_conn cp;

	BT_DBG("%p", conn);

	conn->state = BT_CONNECT;
	conn->out = 1;

	cp.handle   = cpu_to_le16(handle);
	cp.pkt_type = cpu_to_le16(hdev->esco_type);

	cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
	cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
	cp.max_latency    = cpu_to_le16(0xffff);
	cp.voice_setting  = cpu_to_le16(hdev->voice_setting);
	cp.retrans_effort = 0xff;

	hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp);
}

static void hci_conn_timeout(unsigned long arg)
{
	struct hci_conn *conn = (void *) arg;
	struct hci_dev *hdev = conn->hdev;

	BT_DBG("conn %p state %d", conn, conn->state);

	if (atomic_read(&conn->refcnt))
		return;

	hci_dev_lock(hdev);

	switch (conn->state) {
	case BT_CONNECT:
		if (conn->type == ACL_LINK)
			hci_acl_connect_cancel(conn);
		else
			hci_acl_disconn(conn, 0x13);
		break;
	case BT_CONNECTED:
		hci_acl_disconn(conn, 0x13);
		break;
	default:
		conn->state = BT_CLOSED;
		break;
	}

	hci_dev_unlock(hdev);
}

static void hci_conn_idle(unsigned long arg)
{
	struct hci_conn *conn = (void *) arg;

	BT_DBG("conn %p mode %d", conn, conn->mode);

	hci_conn_enter_sniff_mode(conn);
}

struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
{
	struct hci_conn *conn;

	BT_DBG("%s dst %s", hdev->name, batostr(dst));

	conn = kzalloc(sizeof(struct hci_conn), GFP_ATOMIC);
	if (!conn)
		return NULL;

	bacpy(&conn->dst, dst);
	conn->hdev   = hdev;
	conn->type   = type;
	conn->mode   = HCI_CM_ACTIVE;
	conn->state  = BT_OPEN;

	conn->power_save = 1;

	skb_queue_head_init(&conn->data_q);

	setup_timer(&conn->disc_timer, hci_conn_timeout, (unsigned long)conn);
	setup_timer(&conn->idle_timer, hci_conn_idle, (unsigned long)conn);

	atomic_set(&conn->refcnt, 0);

	hci_dev_hold(hdev);

	tasklet_disable(&hdev->tx_task);

	hci_conn_hash_add(hdev, conn);
	if (hdev->notify)
		hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);

	hci_conn_add_sysfs(conn);

	tasklet_enable(&hdev->tx_task);

	return conn;
}

int hci_conn_del(struct hci_conn *conn)
{
	struct hci_dev *hdev = conn->hdev;

	BT_DBG("%s conn %p handle %d", hdev->name, conn, conn->handle);

	del_timer(&conn->idle_timer);

	del_timer(&conn->disc_timer);

	if (conn->type == ACL_LINK) {
		struct hci_conn *sco = conn->link;
		if (sco)
			sco->link = NULL;

		/* Unacked frames */
		hdev->acl_cnt += conn->sent;
	} else {
		struct hci_conn *acl = conn->link;
		if (acl) {
			acl->link = NULL;
			hci_conn_put(acl);
		}
	}

	tasklet_disable(&hdev->tx_task);
	hci_conn_hash_del(hdev, conn);
	if (hdev->notify)
		hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
	tasklet_enable(&hdev->tx_task);
	skb_queue_purge(&conn->data_q);
	hci_conn_del_sysfs(conn);

	return 0;
}

struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src)
{
	int use_src = bacmp(src, BDADDR_ANY);
	struct hci_dev *hdev = NULL;
	struct list_head *p;

	BT_DBG("%s -> %s", batostr(src), batostr(dst));

	read_lock_bh(&hci_dev_list_lock);

	list_for_each(p, &hci_dev_list) {
		struct hci_dev *d = list_entry(p, struct hci_dev, list);

		if (!test_bit(HCI_UP, &d->flags) || test_bit(HCI_RAW, &d->flags))
			continue;

		/* Simple routing:
		 *   No source address - find interface with bdaddr != dst
		 *   Source address    - find interface with bdaddr == src
		 */

		if (use_src) {
			if (!bacmp(&d->bdaddr, src)) {
				hdev = d; break;
			}
		} else {
			if (bacmp(&d->bdaddr, dst)) {
				hdev = d; break;
			}
		}
	}

	if (hdev)
		hdev = hci_dev_hold(hdev);

	read_unlock_bh(&hci_dev_list_lock);
	return hdev;
}
EXPORT_SYMBOL(hci_get_route);

/* Create SCO or ACL connection.
 * Device _must_ be locked */
struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst)
{
	struct hci_conn *acl;
	struct hci_conn *sco;

	BT_DBG("%s dst %s", hdev->name, batostr(dst));

	if (!(acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst))) {
		if (!(acl = hci_conn_add(hdev, ACL_LINK, dst)))
			return NULL;
	}

	hci_conn_hold(acl);

	if (acl->state == BT_OPEN || acl->state == BT_CLOSED)
		hci_acl_connect(acl);

	if (type == ACL_LINK)
		return acl;

	if (!(sco = hci_conn_hash_lookup_ba(hdev, type, dst))) {
		if (!(sco = hci_conn_add(hdev, type, dst))) {
			hci_conn_put(acl);
			return NULL;
		}
	}

	acl->link = sco;
	sco->link = acl;

	hci_conn_hold(sco);

	if (acl->state == BT_CONNECTED &&
			(sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
		if (lmp_esco_capable(hdev))
			hci_setup_sync(sco, acl->handle);
		else
			hci_add_sco(sco, acl->handle);
	}

	return sco;
}
EXPORT_SYMBOL(hci_connect);

/* Authenticate remote device */
int hci_conn_auth(struct hci_conn *conn)
{
	BT_DBG("conn %p", conn);

	if (conn->link_mode & HCI_LM_AUTH)
		return 1;

	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
		struct hci_cp_auth_requested cp;
		cp.handle = cpu_to_le16(conn->handle);
		hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
	}
	return 0;
}
EXPORT_SYMBOL(hci_conn_auth);

/* Enable encryption */
int hci_conn_encrypt(struct hci_conn *conn)
{
	BT_DBG("conn %p", conn);

	if (conn->link_mode & HCI_LM_ENCRYPT)
		return 1;

	if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend))
		return 0;

	if (hci_conn_auth(conn)) {
		struct hci_cp_set_conn_encrypt cp;
		cp.handle  = cpu_to_le16(conn->handle);
		cp.encrypt = 1;
		hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp), &cp);
	}
	return 0;
}
EXPORT_SYMBOL(hci_conn_encrypt);

/* Change link key */
int hci_conn_change_link_key(struct hci_conn *conn)
{
	BT_DBG("conn %p", conn);

	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
		struct hci_cp_change_conn_link_key cp;
		cp.handle = cpu_to_le16(conn->handle);
		hci_send_cmd(conn->hdev, HCI_OP_CHANGE_CONN_LINK_KEY, sizeof(cp), &cp);
	}
	return 0;
}
EXPORT_SYMBOL(hci_conn_change_link_key);

/* Switch role */
int hci_conn_switch_role(struct hci_conn *conn, uint8_t role)
{
	BT_DBG("conn %p", conn);

	if (!role && conn->link_mode & HCI_LM_MASTER)
		return 1;

	if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->pend)) {
		struct hci_cp_switch_role cp;
		bacpy(&cp.bdaddr, &conn->dst);
		cp.role = role;
		hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
	}
	return 0;
}
EXPORT_SYMBOL(hci_conn_switch_role);

/* Enter active mode */
void hci_conn_enter_active_mode(struct hci_conn *conn)
{
	struct hci_dev *hdev = conn->hdev;

	BT_DBG("conn %p mode %d", conn, conn->mode);

	if (test_bit(HCI_RAW, &hdev->flags))
		return;

	if (conn->mode != HCI_CM_SNIFF || !conn->power_save)
		goto timer;

	if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
		struct hci_cp_exit_sniff_mode cp;
		cp.handle = cpu_to_le16(conn->handle);
		hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
	}

timer:
	if (hdev->idle_timeout > 0)
		mod_timer(&conn->idle_timer,
			jiffies + msecs_to_jiffies(hdev->idle_timeout));
}

/* Enter sniff mode */
void hci_conn_enter_sniff_mode(struct hci_conn *conn)
{
	struct hci_dev *hdev = conn->hdev;

	BT_DBG("conn %p mode %d", conn, conn->mode);

	if (test_bit(HCI_RAW, &hdev->flags))
		return;

	if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn))
		return;

	if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF))
		return;

	if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
		struct hci_cp_sniff_subrate cp;
		cp.handle             = cpu_to_le16(conn->handle);
		cp.max_latency        = cpu_to_le16(0);
		cp.min_remote_timeout = cpu_to_le16(0);
		cp.min_local_timeout  = cpu_to_le16(0);
		hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
	}

	if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
		struct hci_cp_sniff_mode cp;
		cp.handle       = cpu_to_le16(conn->handle);
		cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
		cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
		cp.attempt      = cpu_to_le16(4);
		cp.timeout      = cpu_to_le16(1);
		hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
	}
}

/* Drop all connection on the device */
void hci_conn_hash_flush(struct hci_dev *hdev)
{
	struct hci_conn_hash *h = &hdev->conn_hash;
	struct list_head *p;

	BT_DBG("hdev %s", hdev->name);

	p = h->list.next;
	while (p != &h->list) {
		struct hci_conn *c;

		c = list_entry(p, struct hci_conn, list);
		p = p->next;

		c->state = BT_CLOSED;

		hci_proto_disconn_ind(c, 0x16);
		hci_conn_del(c);
	}
}

/* Check pending connect attempts */
void hci_conn_check_pending(struct hci_dev *hdev)
{
	struct hci_conn *conn;

	BT_DBG("hdev %s", hdev->name);

	hci_dev_lock(hdev);

	conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
	if (conn)
		hci_acl_connect(conn);

	hci_dev_unlock(hdev);
}

int hci_get_conn_list(void __user *arg)
{
	struct hci_conn_list_req req, *cl;
	struct hci_conn_info *ci;
	struct hci_dev *hdev;
	struct list_head *p;
	int n = 0, size, err;

	if (copy_from_user(&req, arg, sizeof(req)))
		return -EFAULT;

	if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
		return -EINVAL;

	size = sizeof(req) + req.conn_num * sizeof(*ci);

	if (!(cl = kmalloc(size, GFP_KERNEL)))
		return -ENOMEM;

	if (!(hdev = hci_dev_get(req.dev_id))) {
		kfree(cl);
		return -ENODEV;
	}

	ci = cl->conn_info;

	hci_dev_lock_bh(hdev);
	list_for_each(p, &hdev->conn_hash.list) {
		register struct hci_conn *c;
		c = list_entry(p, struct hci_conn, list);

		bacpy(&(ci + n)->bdaddr, &c->dst);
		(ci + n)->handle = c->handle;
		(ci + n)->type  = c->type;
		(ci + n)->out   = c->out;
		(ci + n)->state = c->state;
		(ci + n)->link_mode = c->link_mode;
		if (++n >= req.conn_num)
			break;
	}
	hci_dev_unlock_bh(hdev);

	cl->dev_id = hdev->id;
	cl->conn_num = n;
	size = sizeof(req) + n * sizeof(*ci);

	hci_dev_put(hdev);

	err = copy_to_user(arg, cl, size);
	kfree(cl);

	return err ? -EFAULT : 0;
}

int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
{
	struct hci_conn_info_req req;
	struct hci_conn_info ci;
	struct hci_conn *conn;
	char __user *ptr = arg + sizeof(req);

	if (copy_from_user(&req, arg, sizeof(req)))
		return -EFAULT;

	hci_dev_lock_bh(hdev);
	conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
	if (conn) {
		bacpy(&ci.bdaddr, &conn->dst);
		ci.handle = conn->handle;
		ci.type  = conn->type;
		ci.out   = conn->out;
		ci.state = conn->state;
		ci.link_mode = conn->link_mode;
	}
	hci_dev_unlock_bh(hdev);

	if (!conn)
		return -ENOENT;

	return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
}
Commit	Line	Data
8e87d142	1	/*
1da177e4 LT	2	BlueZ - Bluetooth protocol stack for Linux
	3	Copyright (C) 2000-2001 Qualcomm Incorporated
	4
	5	Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
	6
	7	This program is free software; you can redistribute it and/or modify
	8	it under the terms of the GNU General Public License version 2 as
	9	published by the Free Software Foundation;
	10
	11	THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
	12	OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
	13	FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
	14	IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142 YH	15	CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
	16	WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
	17	ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4 LT	18	OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
1da177e4 LT	19
8e87d142 YH	20	ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
8e87d142 YH	21	COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4 LT	22	SOFTWARE IS DISCLAIMED.
	23	*/
	24
	25	/* Bluetooth HCI connection handling. */
	26
1da177e4 LT	27	#include <linux/module.h>
	28
	29	#include <linux/types.h>
	30	#include <linux/errno.h>
	31	#include <linux/kernel.h>
1da177e4 LT	32	#include <linux/slab.h>
	33	#include <linux/poll.h>
	34	#include <linux/fcntl.h>
	35	#include <linux/init.h>
	36	#include <linux/skbuff.h>
	37	#include <linux/interrupt.h>
	38	#include <linux/notifier.h>
	39	#include <net/sock.h>
	40
	41	#include <asm/system.h>
	42	#include <asm/uaccess.h>
	43	#include <asm/unaligned.h>
	44
	45	#include <net/bluetooth/bluetooth.h>
	46	#include <net/bluetooth/hci_core.h>
	47
	48	#ifndef CONFIG_BT_HCI_CORE_DEBUG
	49	#undef BT_DBG
	50	#define BT_DBG(D...)
	51	#endif
	52
4c67bc74	53	void hci_acl_connect(struct hci_conn *conn)
1da177e4 LT	54	{
	55	struct hci_dev *hdev = conn->hdev;
	56	struct inquiry_entry *ie;
	57	struct hci_cp_create_conn cp;
	58
	59	BT_DBG("%p", conn);
	60
	61	conn->state = BT_CONNECT;
	62	conn->out = 1;
	63	conn->link_mode = HCI_LM_MASTER;
	64
4c67bc74 MH	65	conn->attempt++;
4c67bc74 MH	66
1da177e4 LT	67	memset(&cp, 0, sizeof(cp));
	68	bacpy(&cp.bdaddr, &conn->dst);
	69	cp.pscan_rep_mode = 0x02;
	70
	71	if ((ie = hci_inquiry_cache_lookup(hdev, &conn->dst)) &&
	72	inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
	73	cp.pscan_rep_mode = ie->data.pscan_rep_mode;
	74	cp.pscan_mode = ie->data.pscan_mode;
aca3192c	75	cp.clock_offset = ie->data.clock_offset \| cpu_to_le16(0x8000);
1da177e4 LT	76	memcpy(conn->dev_class, ie->data.dev_class, 3);
	77	}
	78
aca3192c	79	cp.pkt_type = cpu_to_le16(hdev->pkt_type & ACL_PTYPE_MASK);
1da177e4	80	if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
b6a0dc82	81	cp.role_switch = 0x01;
1da177e4	82	else
b6a0dc82	83	cp.role_switch = 0x00;
4c67bc74	84
a9de9248	85	hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
1da177e4 LT	86	}
1da177e4 LT	87
6ac59344 MH	88	static void hci_acl_connect_cancel(struct hci_conn *conn)
	89	{
	90	struct hci_cp_create_conn_cancel cp;
	91
	92	BT_DBG("%p", conn);
	93
	94	if (conn->hdev->hci_ver < 2)
	95	return;
	96
	97	bacpy(&cp.bdaddr, &conn->dst);
a9de9248	98	hci_send_cmd(conn->hdev, HCI_OP_CREATE_CONN_CANCEL, sizeof(cp), &cp);
6ac59344 MH	99	}
6ac59344 MH	100
1da177e4 LT	101	void hci_acl_disconn(struct hci_conn *conn, __u8 reason)
	102	{
	103	struct hci_cp_disconnect cp;
	104
	105	BT_DBG("%p", conn);
	106
	107	conn->state = BT_DISCONN;
	108
aca3192c	109	cp.handle = cpu_to_le16(conn->handle);
1da177e4	110	cp.reason = reason;
a9de9248	111	hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp);
1da177e4 LT	112	}
	113
	114	void hci_add_sco(struct hci_conn *conn, __u16 handle)
	115	{
	116	struct hci_dev *hdev = conn->hdev;
	117	struct hci_cp_add_sco cp;
	118
	119	BT_DBG("%p", conn);
	120
	121	conn->state = BT_CONNECT;
	122	conn->out = 1;
	123
aca3192c	124	cp.handle = cpu_to_le16(handle);
5b7f9909	125	cp.pkt_type = cpu_to_le16(hdev->pkt_type & SCO_PTYPE_MASK);
1da177e4	126
a9de9248	127	hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
1da177e4 LT	128	}
1da177e4 LT	129
b6a0dc82 MH	130	void hci_setup_sync(struct hci_conn *conn, __u16 handle)
	131	{
	132	struct hci_dev *hdev = conn->hdev;
	133	struct hci_cp_setup_sync_conn cp;
	134
	135	BT_DBG("%p", conn);
	136
	137	conn->state = BT_CONNECT;
	138	conn->out = 1;
	139
	140	cp.handle = cpu_to_le16(handle);
	141	cp.pkt_type = cpu_to_le16(hdev->esco_type);
	142
	143	cp.tx_bandwidth = cpu_to_le32(0x00001f40);
	144	cp.rx_bandwidth = cpu_to_le32(0x00001f40);
	145	cp.max_latency = cpu_to_le16(0xffff);
	146	cp.voice_setting = cpu_to_le16(hdev->voice_setting);
	147	cp.retrans_effort = 0xff;
	148
	149	hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp);
	150	}
	151
1da177e4 LT	152	static void hci_conn_timeout(unsigned long arg)
1da177e4 LT	153	{
04837f64 MH	154	struct hci_conn conn = (void ) arg;
04837f64 MH	155	struct hci_dev *hdev = conn->hdev;
1da177e4 LT	156
	157	BT_DBG("conn %p state %d", conn, conn->state);
	158
	159	if (atomic_read(&conn->refcnt))
	160	return;
	161
	162	hci_dev_lock(hdev);
6ac59344 MH	163
	164	switch (conn->state) {
	165	case BT_CONNECT:
b6a0dc82 MH	166	if (conn->type == ACL_LINK)
	167	hci_acl_connect_cancel(conn);
	168	else
	169	hci_acl_disconn(conn, 0x13);
6ac59344	170	break;
8e87d142	171	case BT_CONNECTED:
1da177e4	172	hci_acl_disconn(conn, 0x13);
6ac59344 MH	173	break;
6ac59344 MH	174	default:
1da177e4	175	conn->state = BT_CLOSED;
6ac59344 MH	176	break;
	177	}
	178
1da177e4	179	hci_dev_unlock(hdev);
1da177e4 LT	180	}
1da177e4 LT	181
04837f64	182	static void hci_conn_idle(unsigned long arg)
1da177e4	183	{
04837f64 MH	184	struct hci_conn conn = (void ) arg;
	185
	186	BT_DBG("conn %p mode %d", conn, conn->mode);
	187
	188	hci_conn_enter_sniff_mode(conn);
1da177e4 LT	189	}
	190
	191	struct hci_conn hci_conn_add(struct hci_dev hdev, int type, bdaddr_t *dst)
	192	{
	193	struct hci_conn *conn;
	194
	195	BT_DBG("%s dst %s", hdev->name, batostr(dst));
	196
04837f64 MH	197	conn = kzalloc(sizeof(struct hci_conn), GFP_ATOMIC);
04837f64 MH	198	if (!conn)
1da177e4	199	return NULL;
1da177e4 LT	200
1da177e4 LT	201	bacpy(&conn->dst, dst);
1da177e4	202	conn->hdev = hdev;
04837f64 MH	203	conn->type = type;
04837f64 MH	204	conn->mode = HCI_CM_ACTIVE;
1da177e4 LT	205	conn->state = BT_OPEN;
1da177e4 LT	206
04837f64 MH	207	conn->power_save = 1;
04837f64 MH	208
1da177e4	209	skb_queue_head_init(&conn->data_q);
04837f64	210
b24b8a24 PE	211	setup_timer(&conn->disc_timer, hci_conn_timeout, (unsigned long)conn);
b24b8a24 PE	212	setup_timer(&conn->idle_timer, hci_conn_idle, (unsigned long)conn);
1da177e4 LT	213
	214	atomic_set(&conn->refcnt, 0);
	215
	216	hci_dev_hold(hdev);
	217
	218	tasklet_disable(&hdev->tx_task);
	219
	220	hci_conn_hash_add(hdev, conn);
	221	if (hdev->notify)
	222	hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
	223
b219e3ac MH	224	hci_conn_add_sysfs(conn);
b219e3ac MH	225
1da177e4 LT	226	tasklet_enable(&hdev->tx_task);
	227
	228	return conn;
	229	}
	230
	231	int hci_conn_del(struct hci_conn *conn)
	232	{
	233	struct hci_dev *hdev = conn->hdev;
	234
	235	BT_DBG("%s conn %p handle %d", hdev->name, conn, conn->handle);
	236
04837f64 MH	237	del_timer(&conn->idle_timer);
	238
	239	del_timer(&conn->disc_timer);
1da177e4	240
5b7f9909	241	if (conn->type == ACL_LINK) {
1da177e4 LT	242	struct hci_conn *sco = conn->link;
	243	if (sco)
	244	sco->link = NULL;
	245
	246	/* Unacked frames */
	247	hdev->acl_cnt += conn->sent;
5b7f9909 MH	248	} else {
	249	struct hci_conn *acl = conn->link;
	250	if (acl) {
	251	acl->link = NULL;
	252	hci_conn_put(acl);
	253	}
1da177e4 LT	254	}
	255
	256	tasklet_disable(&hdev->tx_task);
1da177e4 LT	257	hci_conn_hash_del(hdev, conn);
	258	if (hdev->notify)
	259	hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
1da177e4	260	tasklet_enable(&hdev->tx_task);
1da177e4	261	skb_queue_purge(&conn->data_q);
38b7da09	262	hci_conn_del_sysfs(conn);
1da177e4	263
1da177e4 LT	264	return 0;
	265	}
	266
	267	struct hci_dev hci_get_route(bdaddr_t dst, bdaddr_t *src)
	268	{
	269	int use_src = bacmp(src, BDADDR_ANY);
	270	struct hci_dev *hdev = NULL;
	271	struct list_head *p;
	272
	273	BT_DBG("%s -> %s", batostr(src), batostr(dst));
	274
	275	read_lock_bh(&hci_dev_list_lock);
	276
	277	list_for_each(p, &hci_dev_list) {
	278	struct hci_dev *d = list_entry(p, struct hci_dev, list);
	279
	280	if (!test_bit(HCI_UP, &d->flags) \|\| test_bit(HCI_RAW, &d->flags))
	281	continue;
	282
8e87d142	283	/* Simple routing:
1da177e4 LT	284	* No source address - find interface with bdaddr != dst
	285	* Source address - find interface with bdaddr == src
	286	*/
	287
	288	if (use_src) {
	289	if (!bacmp(&d->bdaddr, src)) {
	290	hdev = d; break;
	291	}
	292	} else {
	293	if (bacmp(&d->bdaddr, dst)) {
	294	hdev = d; break;
	295	}
	296	}
	297	}
	298
	299	if (hdev)
	300	hdev = hci_dev_hold(hdev);
	301
	302	read_unlock_bh(&hci_dev_list_lock);
	303	return hdev;
	304	}
	305	EXPORT_SYMBOL(hci_get_route);
	306
	307	/* Create SCO or ACL connection.
	308	* Device _must_ be locked */
5b7f9909	309	struct hci_conn hci_connect(struct hci_dev hdev, int type, bdaddr_t *dst)
1da177e4 LT	310	{
1da177e4 LT	311	struct hci_conn *acl;
5b7f9909	312	struct hci_conn *sco;
1da177e4 LT	313
	314	BT_DBG("%s dst %s", hdev->name, batostr(dst));
	315
	316	if (!(acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst))) {
	317	if (!(acl = hci_conn_add(hdev, ACL_LINK, dst)))
	318	return NULL;
	319	}
	320
	321	hci_conn_hold(acl);
	322
	323	if (acl->state == BT_OPEN \|\| acl->state == BT_CLOSED)
	324	hci_acl_connect(acl);
	325
5b7f9909 MH	326	if (type == ACL_LINK)
5b7f9909 MH	327	return acl;
1da177e4	328
5b7f9909 MH	329	if (!(sco = hci_conn_hash_lookup_ba(hdev, type, dst))) {
	330	if (!(sco = hci_conn_add(hdev, type, dst))) {
	331	hci_conn_put(acl);
	332	return NULL;
1da177e4	333	}
5b7f9909	334	}
1da177e4	335
5b7f9909 MH	336	acl->link = sco;
5b7f9909 MH	337	sco->link = acl;
1da177e4	338
5b7f9909	339	hci_conn_hold(sco);
1da177e4	340
5b7f9909	341	if (acl->state == BT_CONNECTED &&
b6a0dc82 MH	342	(sco->state == BT_OPEN \|\| sco->state == BT_CLOSED)) {
	343	if (lmp_esco_capable(hdev))
	344	hci_setup_sync(sco, acl->handle);
	345	else
	346	hci_add_sco(sco, acl->handle);
	347	}
5b7f9909 MH	348
5b7f9909 MH	349	return sco;
1da177e4 LT	350	}
	351	EXPORT_SYMBOL(hci_connect);
	352
	353	/* Authenticate remote device */
	354	int hci_conn_auth(struct hci_conn *conn)
	355	{
	356	BT_DBG("conn %p", conn);
	357
	358	if (conn->link_mode & HCI_LM_AUTH)
	359	return 1;
	360
	361	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
	362	struct hci_cp_auth_requested cp;
aca3192c	363	cp.handle = cpu_to_le16(conn->handle);
a9de9248	364	hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
1da177e4 LT	365	}
	366	return 0;
	367	}
	368	EXPORT_SYMBOL(hci_conn_auth);
	369
	370	/* Enable encryption */
	371	int hci_conn_encrypt(struct hci_conn *conn)
	372	{
	373	BT_DBG("conn %p", conn);
	374
	375	if (conn->link_mode & HCI_LM_ENCRYPT)
	376	return 1;
	377
	378	if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend))
	379	return 0;
	380
	381	if (hci_conn_auth(conn)) {
	382	struct hci_cp_set_conn_encrypt cp;
aca3192c	383	cp.handle = cpu_to_le16(conn->handle);
8e87d142	384	cp.encrypt = 1;
a9de9248	385	hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp), &cp);
1da177e4 LT	386	}
	387	return 0;
	388	}
	389	EXPORT_SYMBOL(hci_conn_encrypt);
	390
	391	/* Change link key */
	392	int hci_conn_change_link_key(struct hci_conn *conn)
	393	{
	394	BT_DBG("conn %p", conn);
	395
	396	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
	397	struct hci_cp_change_conn_link_key cp;
aca3192c	398	cp.handle = cpu_to_le16(conn->handle);
a9de9248	399	hci_send_cmd(conn->hdev, HCI_OP_CHANGE_CONN_LINK_KEY, sizeof(cp), &cp);
1da177e4 LT	400	}
	401	return 0;
	402	}
	403	EXPORT_SYMBOL(hci_conn_change_link_key);
	404
	405	/* Switch role */
	406	int hci_conn_switch_role(struct hci_conn *conn, uint8_t role)
	407	{
	408	BT_DBG("conn %p", conn);
	409
	410	if (!role && conn->link_mode & HCI_LM_MASTER)
	411	return 1;
	412
	413	if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->pend)) {
	414	struct hci_cp_switch_role cp;
	415	bacpy(&cp.bdaddr, &conn->dst);
	416	cp.role = role;
a9de9248	417	hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
1da177e4 LT	418	}
	419	return 0;
	420	}
	421	EXPORT_SYMBOL(hci_conn_switch_role);
	422
04837f64 MH	423	/* Enter active mode */
	424	void hci_conn_enter_active_mode(struct hci_conn *conn)
	425	{
	426	struct hci_dev *hdev = conn->hdev;
	427
	428	BT_DBG("conn %p mode %d", conn, conn->mode);
	429
	430	if (test_bit(HCI_RAW, &hdev->flags))
	431	return;
	432
	433	if (conn->mode != HCI_CM_SNIFF \|\| !conn->power_save)
	434	goto timer;
	435
	436	if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
	437	struct hci_cp_exit_sniff_mode cp;
aca3192c	438	cp.handle = cpu_to_le16(conn->handle);
a9de9248	439	hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
04837f64 MH	440	}
	441
	442	timer:
	443	if (hdev->idle_timeout > 0)
	444	mod_timer(&conn->idle_timer,
	445	jiffies + msecs_to_jiffies(hdev->idle_timeout));
	446	}
	447
	448	/* Enter sniff mode */
	449	void hci_conn_enter_sniff_mode(struct hci_conn *conn)
	450	{
	451	struct hci_dev *hdev = conn->hdev;
	452
	453	BT_DBG("conn %p mode %d", conn, conn->mode);
	454
	455	if (test_bit(HCI_RAW, &hdev->flags))
	456	return;
	457
	458	if (!lmp_sniff_capable(hdev) \|\| !lmp_sniff_capable(conn))
	459	return;
	460
	461	if (conn->mode != HCI_CM_ACTIVE \|\| !(conn->link_policy & HCI_LP_SNIFF))
	462	return;
	463
	464	if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
	465	struct hci_cp_sniff_subrate cp;
aca3192c YH	466	cp.handle = cpu_to_le16(conn->handle);
	467	cp.max_latency = cpu_to_le16(0);
	468	cp.min_remote_timeout = cpu_to_le16(0);
	469	cp.min_local_timeout = cpu_to_le16(0);
a9de9248	470	hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
04837f64 MH	471	}
	472
	473	if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
	474	struct hci_cp_sniff_mode cp;
aca3192c YH	475	cp.handle = cpu_to_le16(conn->handle);
	476	cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
	477	cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
	478	cp.attempt = cpu_to_le16(4);
	479	cp.timeout = cpu_to_le16(1);
a9de9248	480	hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
04837f64 MH	481	}
	482	}
	483
1da177e4 LT	484	/* Drop all connection on the device */
	485	void hci_conn_hash_flush(struct hci_dev *hdev)
	486	{
	487	struct hci_conn_hash *h = &hdev->conn_hash;
	488	struct list_head *p;
	489
	490	BT_DBG("hdev %s", hdev->name);
	491
	492	p = h->list.next;
	493	while (p != &h->list) {
	494	struct hci_conn *c;
	495
	496	c = list_entry(p, struct hci_conn, list);
	497	p = p->next;
	498
	499	c->state = BT_CLOSED;
	500
	501	hci_proto_disconn_ind(c, 0x16);
	502	hci_conn_del(c);
	503	}
	504	}
	505
a9de9248 MH	506	/* Check pending connect attempts */
	507	void hci_conn_check_pending(struct hci_dev *hdev)
	508	{
	509	struct hci_conn *conn;
	510
	511	BT_DBG("hdev %s", hdev->name);
	512
	513	hci_dev_lock(hdev);
	514
	515	conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
	516	if (conn)
	517	hci_acl_connect(conn);
	518
	519	hci_dev_unlock(hdev);
	520	}
	521
1da177e4 LT	522	int hci_get_conn_list(void __user *arg)
	523	{
	524	struct hci_conn_list_req req, *cl;
	525	struct hci_conn_info *ci;
	526	struct hci_dev *hdev;
	527	struct list_head *p;
	528	int n = 0, size, err;
	529
	530	if (copy_from_user(&req, arg, sizeof(req)))
	531	return -EFAULT;
	532
	533	if (!req.conn_num \|\| req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
	534	return -EINVAL;
	535
	536	size = sizeof(req) + req.conn_num * sizeof(*ci);
	537
12fe2c58	538	if (!(cl = kmalloc(size, GFP_KERNEL)))
1da177e4 LT	539	return -ENOMEM;
	540
	541	if (!(hdev = hci_dev_get(req.dev_id))) {
	542	kfree(cl);
	543	return -ENODEV;
	544	}
	545
	546	ci = cl->conn_info;
	547
	548	hci_dev_lock_bh(hdev);
	549	list_for_each(p, &hdev->conn_hash.list) {
	550	register struct hci_conn *c;
	551	c = list_entry(p, struct hci_conn, list);
	552
	553	bacpy(&(ci + n)->bdaddr, &c->dst);
	554	(ci + n)->handle = c->handle;
	555	(ci + n)->type = c->type;
	556	(ci + n)->out = c->out;
	557	(ci + n)->state = c->state;
	558	(ci + n)->link_mode = c->link_mode;
	559	if (++n >= req.conn_num)
	560	break;
	561	}
	562	hci_dev_unlock_bh(hdev);
	563
	564	cl->dev_id = hdev->id;
	565	cl->conn_num = n;
	566	size = sizeof(req) + n * sizeof(*ci);
	567
	568	hci_dev_put(hdev);
	569
	570	err = copy_to_user(arg, cl, size);
	571	kfree(cl);
	572
	573	return err ? -EFAULT : 0;
	574	}
	575
	576	int hci_get_conn_info(struct hci_dev hdev, void __user arg)
	577	{
	578	struct hci_conn_info_req req;
	579	struct hci_conn_info ci;
	580	struct hci_conn *conn;
	581	char __user *ptr = arg + sizeof(req);
	582
	583	if (copy_from_user(&req, arg, sizeof(req)))
	584	return -EFAULT;
	585
	586	hci_dev_lock_bh(hdev);
	587	conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
	588	if (conn) {
	589	bacpy(&ci.bdaddr, &conn->dst);
	590	ci.handle = conn->handle;
	591	ci.type = conn->type;
	592	ci.out = conn->out;
	593	ci.state = conn->state;
	594	ci.link_mode = conn->link_mode;
	595	}
	596	hci_dev_unlock_bh(hdev);
	597
	598	if (!conn)
	599	return -ENOENT;
	600
	601	return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
	602	}