[linux-block.git] / net / bluetooth / hci_conn.c

/*
   BlueZ - Bluetooth protocol stack for Linux
   Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.

   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>

   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License version 2 as
   published by the Free Software Foundation;

   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
   SOFTWARE IS DISCLAIMED.
*/

/* Bluetooth HCI connection handling. */

#include <linux/module.h>

#include <linux/types.h>
#include <linux/errno.h>
#include <linux/kernel.h>
#include <linux/slab.h>
#include <linux/poll.h>
#include <linux/fcntl.h>
#include <linux/init.h>
#include <linux/skbuff.h>
#include <linux/interrupt.h>
#include <linux/notifier.h>
#include <net/sock.h>

#include <asm/system.h>
#include <asm/uaccess.h>
#include <asm/unaligned.h>

#include <net/bluetooth/bluetooth.h>
#include <net/bluetooth/hci_core.h>

void hci_acl_connect(struct hci_conn *conn)
{
	struct hci_dev *hdev = conn->hdev;
	struct inquiry_entry *ie;
	struct hci_cp_create_conn cp;

	BT_DBG("%p", conn);

	conn->state = BT_CONNECT;
	conn->out = 1;

	conn->link_mode = HCI_LM_MASTER;

	conn->attempt++;

	conn->link_policy = hdev->link_policy;

	memset(&cp, 0, sizeof(cp));
	bacpy(&cp.bdaddr, &conn->dst);
	cp.pscan_rep_mode = 0x02;

	if ((ie = hci_inquiry_cache_lookup(hdev, &conn->dst))) {
		if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
			cp.pscan_rep_mode = ie->data.pscan_rep_mode;
			cp.pscan_mode     = ie->data.pscan_mode;
			cp.clock_offset   = ie->data.clock_offset |
							cpu_to_le16(0x8000);
		}

		memcpy(conn->dev_class, ie->data.dev_class, 3);
		conn->ssp_mode = ie->data.ssp_mode;
	}

	cp.pkt_type = cpu_to_le16(conn->pkt_type);
	if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
		cp.role_switch = 0x01;
	else
		cp.role_switch = 0x00;

	hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
}

static void hci_acl_connect_cancel(struct hci_conn *conn)
{
	struct hci_cp_create_conn_cancel cp;

	BT_DBG("%p", conn);

	if (conn->hdev->hci_ver < 2)
		return;

	bacpy(&cp.bdaddr, &conn->dst);
	hci_send_cmd(conn->hdev, HCI_OP_CREATE_CONN_CANCEL, sizeof(cp), &cp);
}

void hci_acl_disconn(struct hci_conn *conn, __u8 reason)
{
	struct hci_cp_disconnect cp;

	BT_DBG("%p", conn);

	conn->state = BT_DISCONN;

	cp.handle = cpu_to_le16(conn->handle);
	cp.reason = reason;
	hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp);
}

void hci_add_sco(struct hci_conn *conn, __u16 handle)
{
	struct hci_dev *hdev = conn->hdev;
	struct hci_cp_add_sco cp;

	BT_DBG("%p", conn);

	conn->state = BT_CONNECT;
	conn->out = 1;

	conn->attempt++;

	cp.handle   = cpu_to_le16(handle);
	cp.pkt_type = cpu_to_le16(conn->pkt_type);

	hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
}

void hci_setup_sync(struct hci_conn *conn, __u16 handle)
{
	struct hci_dev *hdev = conn->hdev;
	struct hci_cp_setup_sync_conn cp;

	BT_DBG("%p", conn);

	conn->state = BT_CONNECT;
	conn->out = 1;

	conn->attempt++;

	cp.handle   = cpu_to_le16(handle);
	cp.pkt_type = cpu_to_le16(conn->pkt_type);

	cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
	cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
	cp.max_latency    = cpu_to_le16(0xffff);
	cp.voice_setting  = cpu_to_le16(hdev->voice_setting);
	cp.retrans_effort = 0xff;

	hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp);
}

static void hci_conn_timeout(unsigned long arg)
{
	struct hci_conn *conn = (void *) arg;
	struct hci_dev *hdev = conn->hdev;
	__u8 reason;

	BT_DBG("conn %p state %d", conn, conn->state);

	if (atomic_read(&conn->refcnt))
		return;

	hci_dev_lock(hdev);

	switch (conn->state) {
	case BT_CONNECT:
	case BT_CONNECT2:
		if (conn->type == ACL_LINK && conn->out)
			hci_acl_connect_cancel(conn);
		break;
	case BT_CONFIG:
	case BT_CONNECTED:
		reason = hci_proto_disconn_ind(conn);
		hci_acl_disconn(conn, reason);
		break;
	default:
		conn->state = BT_CLOSED;
		break;
	}

	hci_dev_unlock(hdev);
}

static void hci_conn_idle(unsigned long arg)
{
	struct hci_conn *conn = (void *) arg;

	BT_DBG("conn %p mode %d", conn, conn->mode);

	hci_conn_enter_sniff_mode(conn);
}

struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
{
	struct hci_conn *conn;

	BT_DBG("%s dst %s", hdev->name, batostr(dst));

	conn = kzalloc(sizeof(struct hci_conn), GFP_ATOMIC);
	if (!conn)
		return NULL;

	bacpy(&conn->dst, dst);
	conn->hdev  = hdev;
	conn->type  = type;
	conn->mode  = HCI_CM_ACTIVE;
	conn->state = BT_OPEN;
	conn->auth_type = HCI_AT_GENERAL_BONDING;

	conn->power_save = 1;
	conn->disc_timeout = HCI_DISCONN_TIMEOUT;

	switch (type) {
	case ACL_LINK:
		conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
		break;
	case SCO_LINK:
		if (lmp_esco_capable(hdev))
			conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
					(hdev->esco_type & EDR_ESCO_MASK);
		else
			conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
		break;
	case ESCO_LINK:
		conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
		break;
	}

	skb_queue_head_init(&conn->data_q);

	setup_timer(&conn->disc_timer, hci_conn_timeout, (unsigned long)conn);
	setup_timer(&conn->idle_timer, hci_conn_idle, (unsigned long)conn);

	atomic_set(&conn->refcnt, 0);

	hci_dev_hold(hdev);

	tasklet_disable(&hdev->tx_task);

	hci_conn_hash_add(hdev, conn);
	if (hdev->notify)
		hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);

	atomic_set(&conn->devref, 0);

	hci_conn_init_sysfs(conn);

	tasklet_enable(&hdev->tx_task);

	return conn;
}

int hci_conn_del(struct hci_conn *conn)
{
	struct hci_dev *hdev = conn->hdev;

	BT_DBG("%s conn %p handle %d", hdev->name, conn, conn->handle);

	del_timer(&conn->idle_timer);

	del_timer(&conn->disc_timer);

	if (conn->type == ACL_LINK) {
		struct hci_conn *sco = conn->link;
		if (sco)
			sco->link = NULL;

		/* Unacked frames */
		hdev->acl_cnt += conn->sent;
	} else {
		struct hci_conn *acl = conn->link;
		if (acl) {
			acl->link = NULL;
			hci_conn_put(acl);
		}
	}

	tasklet_disable(&hdev->tx_task);

	hci_conn_hash_del(hdev, conn);
	if (hdev->notify)
		hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);

	tasklet_enable(&hdev->tx_task);

	skb_queue_purge(&conn->data_q);

	hci_conn_put_device(conn);

	hci_dev_put(hdev);

	return 0;
}

struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src)
{
	int use_src = bacmp(src, BDADDR_ANY);
	struct hci_dev *hdev = NULL;
	struct list_head *p;

	BT_DBG("%s -> %s", batostr(src), batostr(dst));

	read_lock_bh(&hci_dev_list_lock);

	list_for_each(p, &hci_dev_list) {
		struct hci_dev *d = list_entry(p, struct hci_dev, list);

		if (!test_bit(HCI_UP, &d->flags) || test_bit(HCI_RAW, &d->flags))
			continue;

		/* Simple routing:
		 *   No source address - find interface with bdaddr != dst
		 *   Source address    - find interface with bdaddr == src
		 */

		if (use_src) {
			if (!bacmp(&d->bdaddr, src)) {
				hdev = d; break;
			}
		} else {
			if (bacmp(&d->bdaddr, dst)) {
				hdev = d; break;
			}
		}
	}

	if (hdev)
		hdev = hci_dev_hold(hdev);

	read_unlock_bh(&hci_dev_list_lock);
	return hdev;
}
EXPORT_SYMBOL(hci_get_route);

/* Create SCO or ACL connection.
 * Device _must_ be locked */
struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, __u8 sec_level, __u8 auth_type)
{
	struct hci_conn *acl;
	struct hci_conn *sco;

	BT_DBG("%s dst %s", hdev->name, batostr(dst));

	if (!(acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst))) {
		if (!(acl = hci_conn_add(hdev, ACL_LINK, dst)))
			return NULL;
	}

	hci_conn_hold(acl);

	if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
		acl->sec_level = sec_level;
		acl->auth_type = auth_type;
		hci_acl_connect(acl);
	} else {
		if (acl->sec_level < sec_level)
			acl->sec_level = sec_level;
		if (acl->auth_type < auth_type)
			acl->auth_type = auth_type;
	}

	if (type == ACL_LINK)
		return acl;

	if (!(sco = hci_conn_hash_lookup_ba(hdev, type, dst))) {
		if (!(sco = hci_conn_add(hdev, type, dst))) {
			hci_conn_put(acl);
			return NULL;
		}
	}

	acl->link = sco;
	sco->link = acl;

	hci_conn_hold(sco);

	if (acl->state == BT_CONNECTED &&
			(sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
		acl->power_save = 1;
		hci_conn_enter_active_mode(acl);

		if (lmp_esco_capable(hdev))
			hci_setup_sync(sco, acl->handle);
		else
			hci_add_sco(sco, acl->handle);
	}

	return sco;
}
EXPORT_SYMBOL(hci_connect);

/* Check link security requirement */
int hci_conn_check_link_mode(struct hci_conn *conn)
{
	BT_DBG("conn %p", conn);

	if (conn->ssp_mode > 0 && conn->hdev->ssp_mode > 0 &&
					!(conn->link_mode & HCI_LM_ENCRYPT))
		return 0;

	return 1;
}
EXPORT_SYMBOL(hci_conn_check_link_mode);

/* Authenticate remote device */
static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
{
	BT_DBG("conn %p", conn);

	if (sec_level > conn->sec_level)
		conn->sec_level = sec_level;
	else if (conn->link_mode & HCI_LM_AUTH)
		return 1;

	conn->auth_type = auth_type;

	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
		struct hci_cp_auth_requested cp;
		cp.handle = cpu_to_le16(conn->handle);
		hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
							sizeof(cp), &cp);
	}

	return 0;
}

/* Enable security */
int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
{
	BT_DBG("conn %p", conn);

	if (sec_level == BT_SECURITY_SDP)
		return 1;

	if (sec_level == BT_SECURITY_LOW &&
				(!conn->ssp_mode || !conn->hdev->ssp_mode))
		return 1;

	if (conn->link_mode & HCI_LM_ENCRYPT)
		return hci_conn_auth(conn, sec_level, auth_type);

	if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend))
		return 0;

	if (hci_conn_auth(conn, sec_level, auth_type)) {
		struct hci_cp_set_conn_encrypt cp;
		cp.handle  = cpu_to_le16(conn->handle);
		cp.encrypt = 1;
		hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT,
							sizeof(cp), &cp);
	}

	return 0;
}
EXPORT_SYMBOL(hci_conn_security);

/* Change link key */
int hci_conn_change_link_key(struct hci_conn *conn)
{
	BT_DBG("conn %p", conn);

	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
		struct hci_cp_change_conn_link_key cp;
		cp.handle = cpu_to_le16(conn->handle);
		hci_send_cmd(conn->hdev, HCI_OP_CHANGE_CONN_LINK_KEY,
							sizeof(cp), &cp);
	}

	return 0;
}
EXPORT_SYMBOL(hci_conn_change_link_key);

/* Switch role */
int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
{
	BT_DBG("conn %p", conn);

	if (!role && conn->link_mode & HCI_LM_MASTER)
		return 1;

	if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->pend)) {
		struct hci_cp_switch_role cp;
		bacpy(&cp.bdaddr, &conn->dst);
		cp.role = role;
		hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
	}

	return 0;
}
EXPORT_SYMBOL(hci_conn_switch_role);

/* Enter active mode */
void hci_conn_enter_active_mode(struct hci_conn *conn)
{
	struct hci_dev *hdev = conn->hdev;

	BT_DBG("conn %p mode %d", conn, conn->mode);

	if (test_bit(HCI_RAW, &hdev->flags))
		return;

	if (conn->mode != HCI_CM_SNIFF || !conn->power_save)
		goto timer;

	if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
		struct hci_cp_exit_sniff_mode cp;
		cp.handle = cpu_to_le16(conn->handle);
		hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
	}

timer:
	if (hdev->idle_timeout > 0)
		mod_timer(&conn->idle_timer,
			jiffies + msecs_to_jiffies(hdev->idle_timeout));
}

/* Enter sniff mode */
void hci_conn_enter_sniff_mode(struct hci_conn *conn)
{
	struct hci_dev *hdev = conn->hdev;

	BT_DBG("conn %p mode %d", conn, conn->mode);

	if (test_bit(HCI_RAW, &hdev->flags))
		return;

	if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn))
		return;

	if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF))
		return;

	if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
		struct hci_cp_sniff_subrate cp;
		cp.handle             = cpu_to_le16(conn->handle);
		cp.max_latency        = cpu_to_le16(0);
		cp.min_remote_timeout = cpu_to_le16(0);
		cp.min_local_timeout  = cpu_to_le16(0);
		hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
	}

	if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
		struct hci_cp_sniff_mode cp;
		cp.handle       = cpu_to_le16(conn->handle);
		cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
		cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
		cp.attempt      = cpu_to_le16(4);
		cp.timeout      = cpu_to_le16(1);
		hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
	}
}

/* Drop all connection on the device */
void hci_conn_hash_flush(struct hci_dev *hdev)
{
	struct hci_conn_hash *h = &hdev->conn_hash;
	struct list_head *p;

	BT_DBG("hdev %s", hdev->name);

	p = h->list.next;
	while (p != &h->list) {
		struct hci_conn *c;

		c = list_entry(p, struct hci_conn, list);
		p = p->next;

		c->state = BT_CLOSED;

		hci_proto_disconn_cfm(c, 0x16);
		hci_conn_del(c);
	}
}

/* Check pending connect attempts */
void hci_conn_check_pending(struct hci_dev *hdev)
{
	struct hci_conn *conn;

	BT_DBG("hdev %s", hdev->name);

	hci_dev_lock(hdev);

	conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
	if (conn)
		hci_acl_connect(conn);

	hci_dev_unlock(hdev);
}

void hci_conn_hold_device(struct hci_conn *conn)
{
	atomic_inc(&conn->devref);
}
EXPORT_SYMBOL(hci_conn_hold_device);

void hci_conn_put_device(struct hci_conn *conn)
{
	if (atomic_dec_and_test(&conn->devref))
		hci_conn_del_sysfs(conn);
}
EXPORT_SYMBOL(hci_conn_put_device);

int hci_get_conn_list(void __user *arg)
{
	struct hci_conn_list_req req, *cl;
	struct hci_conn_info *ci;
	struct hci_dev *hdev;
	struct list_head *p;
	int n = 0, size, err;

	if (copy_from_user(&req, arg, sizeof(req)))
		return -EFAULT;

	if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
		return -EINVAL;

	size = sizeof(req) + req.conn_num * sizeof(*ci);

	if (!(cl = kmalloc(size, GFP_KERNEL)))
		return -ENOMEM;

	if (!(hdev = hci_dev_get(req.dev_id))) {
		kfree(cl);
		return -ENODEV;
	}

	ci = cl->conn_info;

	hci_dev_lock_bh(hdev);
	list_for_each(p, &hdev->conn_hash.list) {
		register struct hci_conn *c;
		c = list_entry(p, struct hci_conn, list);

		bacpy(&(ci + n)->bdaddr, &c->dst);
		(ci + n)->handle = c->handle;
		(ci + n)->type  = c->type;
		(ci + n)->out   = c->out;
		(ci + n)->state = c->state;
		(ci + n)->link_mode = c->link_mode;
		if (++n >= req.conn_num)
			break;
	}
	hci_dev_unlock_bh(hdev);

	cl->dev_id = hdev->id;
	cl->conn_num = n;
	size = sizeof(req) + n * sizeof(*ci);

	hci_dev_put(hdev);

	err = copy_to_user(arg, cl, size);
	kfree(cl);

	return err ? -EFAULT : 0;
}

int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
{
	struct hci_conn_info_req req;
	struct hci_conn_info ci;
	struct hci_conn *conn;
	char __user *ptr = arg + sizeof(req);

	if (copy_from_user(&req, arg, sizeof(req)))
		return -EFAULT;

	hci_dev_lock_bh(hdev);
	conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
	if (conn) {
		bacpy(&ci.bdaddr, &conn->dst);
		ci.handle = conn->handle;
		ci.type  = conn->type;
		ci.out   = conn->out;
		ci.state = conn->state;
		ci.link_mode = conn->link_mode;
	}
	hci_dev_unlock_bh(hdev);

	if (!conn)
		return -ENOENT;

	return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
}

int hci_get_auth_info(struct hci_dev *hdev, void __user *arg)
{
	struct hci_auth_info_req req;
	struct hci_conn *conn;

	if (copy_from_user(&req, arg, sizeof(req)))
		return -EFAULT;

	hci_dev_lock_bh(hdev);
	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr);
	if (conn)
		req.type = conn->auth_type;
	hci_dev_unlock_bh(hdev);

	if (!conn)
		return -ENOENT;

	return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0;
}
Commit	Line	Data
8e87d142	1	/*
1da177e4	2	BlueZ - Bluetooth protocol stack for Linux
2d0a0346	3	Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
1da177e4 LT	4
	5	Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
	6
	7	This program is free software; you can redistribute it and/or modify
	8	it under the terms of the GNU General Public License version 2 as
	9	published by the Free Software Foundation;
	10
	11	THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
	12	OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
	13	FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
	14	IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142 YH	15	CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
	16	WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
	17	ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4 LT	18	OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
1da177e4 LT	19
8e87d142 YH	20	ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
8e87d142 YH	21	COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4 LT	22	SOFTWARE IS DISCLAIMED.
	23	*/
	24
	25	/* Bluetooth HCI connection handling. */
	26
1da177e4 LT	27	#include <linux/module.h>
	28
	29	#include <linux/types.h>
	30	#include <linux/errno.h>
	31	#include <linux/kernel.h>
1da177e4 LT	32	#include <linux/slab.h>
	33	#include <linux/poll.h>
	34	#include <linux/fcntl.h>
	35	#include <linux/init.h>
	36	#include <linux/skbuff.h>
	37	#include <linux/interrupt.h>
	38	#include <linux/notifier.h>
	39	#include <net/sock.h>
	40
	41	#include <asm/system.h>
	42	#include <asm/uaccess.h>
	43	#include <asm/unaligned.h>
	44
	45	#include <net/bluetooth/bluetooth.h>
	46	#include <net/bluetooth/hci_core.h>
	47
4c67bc74	48	void hci_acl_connect(struct hci_conn *conn)
1da177e4 LT	49	{
	50	struct hci_dev *hdev = conn->hdev;
	51	struct inquiry_entry *ie;
	52	struct hci_cp_create_conn cp;
	53
	54	BT_DBG("%p", conn);
	55
	56	conn->state = BT_CONNECT;
a8746417 MH	57	conn->out = 1;
a8746417 MH	58
1da177e4 LT	59	conn->link_mode = HCI_LM_MASTER;
1da177e4 LT	60
4c67bc74 MH	61	conn->attempt++;
4c67bc74 MH	62
e4e8e37c MH	63	conn->link_policy = hdev->link_policy;
e4e8e37c MH	64
1da177e4 LT	65	memset(&cp, 0, sizeof(cp));
	66	bacpy(&cp.bdaddr, &conn->dst);
	67	cp.pscan_rep_mode = 0x02;
	68
41a96212 MH	69	if ((ie = hci_inquiry_cache_lookup(hdev, &conn->dst))) {
	70	if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
	71	cp.pscan_rep_mode = ie->data.pscan_rep_mode;
	72	cp.pscan_mode = ie->data.pscan_mode;
	73	cp.clock_offset = ie->data.clock_offset \|
	74	cpu_to_le16(0x8000);
	75	}
	76
1da177e4	77	memcpy(conn->dev_class, ie->data.dev_class, 3);
41a96212	78	conn->ssp_mode = ie->data.ssp_mode;
1da177e4 LT	79	}
1da177e4 LT	80
a8746417	81	cp.pkt_type = cpu_to_le16(conn->pkt_type);
1da177e4	82	if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
b6a0dc82	83	cp.role_switch = 0x01;
1da177e4	84	else
b6a0dc82	85	cp.role_switch = 0x00;
4c67bc74	86
a9de9248	87	hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
1da177e4 LT	88	}
1da177e4 LT	89
6ac59344 MH	90	static void hci_acl_connect_cancel(struct hci_conn *conn)
	91	{
	92	struct hci_cp_create_conn_cancel cp;
	93
	94	BT_DBG("%p", conn);
	95
	96	if (conn->hdev->hci_ver < 2)
	97	return;
	98
	99	bacpy(&cp.bdaddr, &conn->dst);
a9de9248	100	hci_send_cmd(conn->hdev, HCI_OP_CREATE_CONN_CANCEL, sizeof(cp), &cp);
6ac59344 MH	101	}
6ac59344 MH	102
1da177e4 LT	103	void hci_acl_disconn(struct hci_conn *conn, __u8 reason)
	104	{
	105	struct hci_cp_disconnect cp;
	106
	107	BT_DBG("%p", conn);
	108
	109	conn->state = BT_DISCONN;
	110
aca3192c	111	cp.handle = cpu_to_le16(conn->handle);
1da177e4	112	cp.reason = reason;
a9de9248	113	hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp);
1da177e4 LT	114	}
	115
	116	void hci_add_sco(struct hci_conn *conn, __u16 handle)
	117	{
	118	struct hci_dev *hdev = conn->hdev;
	119	struct hci_cp_add_sco cp;
	120
	121	BT_DBG("%p", conn);
	122
	123	conn->state = BT_CONNECT;
	124	conn->out = 1;
	125
efc7688b MH	126	conn->attempt++;
efc7688b MH	127
aca3192c	128	cp.handle = cpu_to_le16(handle);
a8746417	129	cp.pkt_type = cpu_to_le16(conn->pkt_type);
1da177e4	130
a9de9248	131	hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
1da177e4 LT	132	}
1da177e4 LT	133
b6a0dc82 MH	134	void hci_setup_sync(struct hci_conn *conn, __u16 handle)
	135	{
	136	struct hci_dev *hdev = conn->hdev;
	137	struct hci_cp_setup_sync_conn cp;
	138
	139	BT_DBG("%p", conn);
	140
	141	conn->state = BT_CONNECT;
	142	conn->out = 1;
	143
efc7688b MH	144	conn->attempt++;
efc7688b MH	145
b6a0dc82	146	cp.handle = cpu_to_le16(handle);
a8746417	147	cp.pkt_type = cpu_to_le16(conn->pkt_type);
b6a0dc82 MH	148
	149	cp.tx_bandwidth = cpu_to_le32(0x00001f40);
	150	cp.rx_bandwidth = cpu_to_le32(0x00001f40);
	151	cp.max_latency = cpu_to_le16(0xffff);
	152	cp.voice_setting = cpu_to_le16(hdev->voice_setting);
	153	cp.retrans_effort = 0xff;
	154
	155	hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp);
	156	}
	157
1da177e4 LT	158	static void hci_conn_timeout(unsigned long arg)
1da177e4 LT	159	{
04837f64 MH	160	struct hci_conn conn = (void ) arg;
04837f64 MH	161	struct hci_dev *hdev = conn->hdev;
2950f21a	162	__u8 reason;
1da177e4 LT	163
	164	BT_DBG("conn %p state %d", conn, conn->state);
	165
	166	if (atomic_read(&conn->refcnt))
	167	return;
	168
	169	hci_dev_lock(hdev);
6ac59344 MH	170
	171	switch (conn->state) {
	172	case BT_CONNECT:
769be974	173	case BT_CONNECT2:
1b0336bb	174	if (conn->type == ACL_LINK && conn->out)
b6a0dc82	175	hci_acl_connect_cancel(conn);
6ac59344	176	break;
769be974	177	case BT_CONFIG:
8e87d142	178	case BT_CONNECTED:
2950f21a MH	179	reason = hci_proto_disconn_ind(conn);
2950f21a MH	180	hci_acl_disconn(conn, reason);
6ac59344 MH	181	break;
6ac59344 MH	182	default:
1da177e4	183	conn->state = BT_CLOSED;
6ac59344 MH	184	break;
	185	}
	186
1da177e4	187	hci_dev_unlock(hdev);
1da177e4 LT	188	}
1da177e4 LT	189
04837f64	190	static void hci_conn_idle(unsigned long arg)
1da177e4	191	{
04837f64 MH	192	struct hci_conn conn = (void ) arg;
	193
	194	BT_DBG("conn %p mode %d", conn, conn->mode);
	195
	196	hci_conn_enter_sniff_mode(conn);
1da177e4 LT	197	}
	198
	199	struct hci_conn hci_conn_add(struct hci_dev hdev, int type, bdaddr_t *dst)
	200	{
	201	struct hci_conn *conn;
	202
	203	BT_DBG("%s dst %s", hdev->name, batostr(dst));
	204
04837f64 MH	205	conn = kzalloc(sizeof(struct hci_conn), GFP_ATOMIC);
04837f64 MH	206	if (!conn)
1da177e4	207	return NULL;
1da177e4 LT	208
1da177e4 LT	209	bacpy(&conn->dst, dst);
a8746417 MH	210	conn->hdev = hdev;
	211	conn->type = type;
	212	conn->mode = HCI_CM_ACTIVE;
	213	conn->state = BT_OPEN;
93f19c9f	214	conn->auth_type = HCI_AT_GENERAL_BONDING;
1da177e4	215
04837f64	216	conn->power_save = 1;
052b30b0	217	conn->disc_timeout = HCI_DISCONN_TIMEOUT;
04837f64	218
a8746417 MH	219	switch (type) {
	220	case ACL_LINK:
	221	conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
	222	break;
	223	case SCO_LINK:
	224	if (lmp_esco_capable(hdev))
efc7688b MH	225	conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) \|
efc7688b MH	226	(hdev->esco_type & EDR_ESCO_MASK);
a8746417 MH	227	else
	228	conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
	229	break;
	230	case ESCO_LINK:
efc7688b	231	conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
a8746417 MH	232	break;
	233	}
	234
1da177e4	235	skb_queue_head_init(&conn->data_q);
04837f64	236
b24b8a24 PE	237	setup_timer(&conn->disc_timer, hci_conn_timeout, (unsigned long)conn);
b24b8a24 PE	238	setup_timer(&conn->idle_timer, hci_conn_idle, (unsigned long)conn);
1da177e4 LT	239
	240	atomic_set(&conn->refcnt, 0);
	241
	242	hci_dev_hold(hdev);
	243
	244	tasklet_disable(&hdev->tx_task);
	245
	246	hci_conn_hash_add(hdev, conn);
	247	if (hdev->notify)
	248	hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
	249
9eba32b8 MH	250	atomic_set(&conn->devref, 0);
9eba32b8 MH	251
a67e899c MH	252	hci_conn_init_sysfs(conn);
a67e899c MH	253
1da177e4 LT	254	tasklet_enable(&hdev->tx_task);
	255
	256	return conn;
	257	}
	258
	259	int hci_conn_del(struct hci_conn *conn)
	260	{
	261	struct hci_dev *hdev = conn->hdev;
	262
	263	BT_DBG("%s conn %p handle %d", hdev->name, conn, conn->handle);
	264
04837f64 MH	265	del_timer(&conn->idle_timer);
	266
	267	del_timer(&conn->disc_timer);
1da177e4	268
5b7f9909	269	if (conn->type == ACL_LINK) {
1da177e4 LT	270	struct hci_conn *sco = conn->link;
	271	if (sco)
	272	sco->link = NULL;
	273
	274	/* Unacked frames */
	275	hdev->acl_cnt += conn->sent;
5b7f9909 MH	276	} else {
	277	struct hci_conn *acl = conn->link;
	278	if (acl) {
	279	acl->link = NULL;
	280	hci_conn_put(acl);
	281	}
1da177e4 LT	282	}
	283
	284	tasklet_disable(&hdev->tx_task);
7d0db0a3	285
1da177e4 LT	286	hci_conn_hash_del(hdev, conn);
	287	if (hdev->notify)
	288	hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
7d0db0a3	289
1da177e4	290	tasklet_enable(&hdev->tx_task);
7d0db0a3	291
1da177e4	292	skb_queue_purge(&conn->data_q);
1da177e4	293
9eba32b8	294	hci_conn_put_device(conn);
2ae9a6be	295
384943ec MH	296	hci_dev_put(hdev);
384943ec MH	297
1da177e4 LT	298	return 0;
	299	}
	300
	301	struct hci_dev hci_get_route(bdaddr_t dst, bdaddr_t *src)
	302	{
	303	int use_src = bacmp(src, BDADDR_ANY);
	304	struct hci_dev *hdev = NULL;
	305	struct list_head *p;
	306
	307	BT_DBG("%s -> %s", batostr(src), batostr(dst));
	308
	309	read_lock_bh(&hci_dev_list_lock);
	310
	311	list_for_each(p, &hci_dev_list) {
	312	struct hci_dev *d = list_entry(p, struct hci_dev, list);
	313
	314	if (!test_bit(HCI_UP, &d->flags) \|\| test_bit(HCI_RAW, &d->flags))
	315	continue;
	316
8e87d142	317	/* Simple routing:
1da177e4 LT	318	* No source address - find interface with bdaddr != dst
	319	* Source address - find interface with bdaddr == src
	320	*/
	321
	322	if (use_src) {
	323	if (!bacmp(&d->bdaddr, src)) {
	324	hdev = d; break;
	325	}
	326	} else {
	327	if (bacmp(&d->bdaddr, dst)) {
	328	hdev = d; break;
	329	}
	330	}
	331	}
	332
	333	if (hdev)
	334	hdev = hci_dev_hold(hdev);
	335
	336	read_unlock_bh(&hci_dev_list_lock);
	337	return hdev;
	338	}
	339	EXPORT_SYMBOL(hci_get_route);
	340
	341	/* Create SCO or ACL connection.
	342	* Device _must_ be locked */
8c1b2355	343	struct hci_conn hci_connect(struct hci_dev hdev, int type, bdaddr_t *dst, __u8 sec_level, __u8 auth_type)
1da177e4 LT	344	{
1da177e4 LT	345	struct hci_conn *acl;
5b7f9909	346	struct hci_conn *sco;
1da177e4 LT	347
	348	BT_DBG("%s dst %s", hdev->name, batostr(dst));
	349
	350	if (!(acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst))) {
	351	if (!(acl = hci_conn_add(hdev, ACL_LINK, dst)))
	352	return NULL;
	353	}
	354
	355	hci_conn_hold(acl);
	356
09ab6f4c	357	if (acl->state == BT_OPEN \|\| acl->state == BT_CLOSED) {
8c1b2355	358	acl->sec_level = sec_level;
09ab6f4c	359	acl->auth_type = auth_type;
1da177e4	360	hci_acl_connect(acl);
04530982 VT	361	} else {
	362	if (acl->sec_level < sec_level)
	363	acl->sec_level = sec_level;
	364	if (acl->auth_type < auth_type)
	365	acl->auth_type = auth_type;
09ab6f4c	366	}
1da177e4	367
5b7f9909 MH	368	if (type == ACL_LINK)
5b7f9909 MH	369	return acl;
1da177e4	370
5b7f9909 MH	371	if (!(sco = hci_conn_hash_lookup_ba(hdev, type, dst))) {
	372	if (!(sco = hci_conn_add(hdev, type, dst))) {
	373	hci_conn_put(acl);
	374	return NULL;
1da177e4	375	}
5b7f9909	376	}
1da177e4	377
5b7f9909 MH	378	acl->link = sco;
5b7f9909 MH	379	sco->link = acl;
1da177e4	380
5b7f9909	381	hci_conn_hold(sco);
1da177e4	382
5b7f9909	383	if (acl->state == BT_CONNECTED &&
b6a0dc82	384	(sco->state == BT_OPEN \|\| sco->state == BT_CLOSED)) {
c390216b NP	385	acl->power_save = 1;
	386	hci_conn_enter_active_mode(acl);
	387
b6a0dc82 MH	388	if (lmp_esco_capable(hdev))
	389	hci_setup_sync(sco, acl->handle);
	390	else
	391	hci_add_sco(sco, acl->handle);
	392	}
5b7f9909 MH	393
5b7f9909 MH	394	return sco;
1da177e4 LT	395	}
	396	EXPORT_SYMBOL(hci_connect);
	397
e7c29cb1 MH	398	/* Check link security requirement */
	399	int hci_conn_check_link_mode(struct hci_conn *conn)
	400	{
	401	BT_DBG("conn %p", conn);
	402
	403	if (conn->ssp_mode > 0 && conn->hdev->ssp_mode > 0 &&
	404	!(conn->link_mode & HCI_LM_ENCRYPT))
	405	return 0;
	406
	407	return 1;
	408	}
	409	EXPORT_SYMBOL(hci_conn_check_link_mode);
	410
1da177e4	411	/* Authenticate remote device */
0684e5f9	412	static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
1da177e4 LT	413	{
	414	BT_DBG("conn %p", conn);
	415
96a31833	416	if (sec_level > conn->sec_level)
0684e5f9	417	conn->sec_level = sec_level;
96a31833	418	else if (conn->link_mode & HCI_LM_AUTH)
1da177e4 LT	419	return 1;
1da177e4 LT	420
96a31833 MH	421	conn->auth_type = auth_type;
96a31833 MH	422
1da177e4 LT	423	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
1da177e4 LT	424	struct hci_cp_auth_requested cp;
aca3192c	425	cp.handle = cpu_to_le16(conn->handle);
40be492f MH	426	hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
40be492f MH	427	sizeof(cp), &cp);
1da177e4	428	}
8c1b2355	429
1da177e4 LT	430	return 0;
1da177e4 LT	431	}
1da177e4	432
8c1b2355	433	/* Enable security */
0684e5f9	434	int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
1da177e4 LT	435	{
	436	BT_DBG("conn %p", conn);
	437
8c1b2355 MH	438	if (sec_level == BT_SECURITY_SDP)
	439	return 1;
	440
3fdca1e1 MH	441	if (sec_level == BT_SECURITY_LOW &&
	442	(!conn->ssp_mode \|\| !conn->hdev->ssp_mode))
	443	return 1;
8c1b2355	444
1da177e4	445	if (conn->link_mode & HCI_LM_ENCRYPT)
0684e5f9	446	return hci_conn_auth(conn, sec_level, auth_type);
1da177e4 LT	447
	448	if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend))
	449	return 0;
	450
0684e5f9	451	if (hci_conn_auth(conn, sec_level, auth_type)) {
1da177e4	452	struct hci_cp_set_conn_encrypt cp;
aca3192c	453	cp.handle = cpu_to_le16(conn->handle);
8e87d142	454	cp.encrypt = 1;
40be492f MH	455	hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT,
40be492f MH	456	sizeof(cp), &cp);
1da177e4	457	}
8c1b2355	458
1da177e4 LT	459	return 0;
1da177e4 LT	460	}
8c1b2355	461	EXPORT_SYMBOL(hci_conn_security);
1da177e4 LT	462
	463	/* Change link key */
	464	int hci_conn_change_link_key(struct hci_conn *conn)
	465	{
	466	BT_DBG("conn %p", conn);
	467
	468	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
	469	struct hci_cp_change_conn_link_key cp;
aca3192c	470	cp.handle = cpu_to_le16(conn->handle);
40be492f MH	471	hci_send_cmd(conn->hdev, HCI_OP_CHANGE_CONN_LINK_KEY,
40be492f MH	472	sizeof(cp), &cp);
1da177e4	473	}
8c1b2355	474
1da177e4 LT	475	return 0;
	476	}
	477	EXPORT_SYMBOL(hci_conn_change_link_key);
	478
	479	/* Switch role */
8c1b2355	480	int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
1da177e4 LT	481	{
	482	BT_DBG("conn %p", conn);
	483
	484	if (!role && conn->link_mode & HCI_LM_MASTER)
	485	return 1;
	486
	487	if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->pend)) {
	488	struct hci_cp_switch_role cp;
	489	bacpy(&cp.bdaddr, &conn->dst);
	490	cp.role = role;
a9de9248	491	hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
1da177e4	492	}
8c1b2355	493
1da177e4 LT	494	return 0;
	495	}
	496	EXPORT_SYMBOL(hci_conn_switch_role);
	497
04837f64 MH	498	/* Enter active mode */
	499	void hci_conn_enter_active_mode(struct hci_conn *conn)
	500	{
	501	struct hci_dev *hdev = conn->hdev;
	502
	503	BT_DBG("conn %p mode %d", conn, conn->mode);
	504
	505	if (test_bit(HCI_RAW, &hdev->flags))
	506	return;
	507
	508	if (conn->mode != HCI_CM_SNIFF \|\| !conn->power_save)
	509	goto timer;
	510
	511	if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
	512	struct hci_cp_exit_sniff_mode cp;
aca3192c	513	cp.handle = cpu_to_le16(conn->handle);
a9de9248	514	hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
04837f64 MH	515	}
	516
	517	timer:
	518	if (hdev->idle_timeout > 0)
	519	mod_timer(&conn->idle_timer,
	520	jiffies + msecs_to_jiffies(hdev->idle_timeout));
	521	}
	522
	523	/* Enter sniff mode */
	524	void hci_conn_enter_sniff_mode(struct hci_conn *conn)
	525	{
	526	struct hci_dev *hdev = conn->hdev;
	527
	528	BT_DBG("conn %p mode %d", conn, conn->mode);
	529
	530	if (test_bit(HCI_RAW, &hdev->flags))
	531	return;
	532
	533	if (!lmp_sniff_capable(hdev) \|\| !lmp_sniff_capable(conn))
	534	return;
	535
	536	if (conn->mode != HCI_CM_ACTIVE \|\| !(conn->link_policy & HCI_LP_SNIFF))
	537	return;
	538
	539	if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
	540	struct hci_cp_sniff_subrate cp;
aca3192c YH	541	cp.handle = cpu_to_le16(conn->handle);
	542	cp.max_latency = cpu_to_le16(0);
	543	cp.min_remote_timeout = cpu_to_le16(0);
	544	cp.min_local_timeout = cpu_to_le16(0);
a9de9248	545	hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
04837f64 MH	546	}
	547
	548	if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
	549	struct hci_cp_sniff_mode cp;
aca3192c YH	550	cp.handle = cpu_to_le16(conn->handle);
	551	cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
	552	cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
	553	cp.attempt = cpu_to_le16(4);
	554	cp.timeout = cpu_to_le16(1);
a9de9248	555	hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
04837f64 MH	556	}
	557	}
	558
1da177e4 LT	559	/* Drop all connection on the device */
	560	void hci_conn_hash_flush(struct hci_dev *hdev)
	561	{
	562	struct hci_conn_hash *h = &hdev->conn_hash;
	563	struct list_head *p;
	564
	565	BT_DBG("hdev %s", hdev->name);
	566
	567	p = h->list.next;
	568	while (p != &h->list) {
	569	struct hci_conn *c;
	570
	571	c = list_entry(p, struct hci_conn, list);
	572	p = p->next;
	573
	574	c->state = BT_CLOSED;
	575
2950f21a	576	hci_proto_disconn_cfm(c, 0x16);
1da177e4 LT	577	hci_conn_del(c);
	578	}
	579	}
	580
a9de9248 MH	581	/* Check pending connect attempts */
	582	void hci_conn_check_pending(struct hci_dev *hdev)
	583	{
	584	struct hci_conn *conn;
	585
	586	BT_DBG("hdev %s", hdev->name);
	587
	588	hci_dev_lock(hdev);
	589
	590	conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
	591	if (conn)
	592	hci_acl_connect(conn);
	593
	594	hci_dev_unlock(hdev);
	595	}
	596
9eba32b8 MH	597	void hci_conn_hold_device(struct hci_conn *conn)
	598	{
	599	atomic_inc(&conn->devref);
	600	}
	601	EXPORT_SYMBOL(hci_conn_hold_device);
	602
	603	void hci_conn_put_device(struct hci_conn *conn)
	604	{
	605	if (atomic_dec_and_test(&conn->devref))
	606	hci_conn_del_sysfs(conn);
	607	}
	608	EXPORT_SYMBOL(hci_conn_put_device);
	609
1da177e4 LT	610	int hci_get_conn_list(void __user *arg)
	611	{
	612	struct hci_conn_list_req req, *cl;
	613	struct hci_conn_info *ci;
	614	struct hci_dev *hdev;
	615	struct list_head *p;
	616	int n = 0, size, err;
	617
	618	if (copy_from_user(&req, arg, sizeof(req)))
	619	return -EFAULT;
	620
	621	if (!req.conn_num \|\| req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
	622	return -EINVAL;
	623
	624	size = sizeof(req) + req.conn_num * sizeof(*ci);
	625
12fe2c58	626	if (!(cl = kmalloc(size, GFP_KERNEL)))
1da177e4 LT	627	return -ENOMEM;
	628
	629	if (!(hdev = hci_dev_get(req.dev_id))) {
	630	kfree(cl);
	631	return -ENODEV;
	632	}
	633
	634	ci = cl->conn_info;
	635
	636	hci_dev_lock_bh(hdev);
	637	list_for_each(p, &hdev->conn_hash.list) {
	638	register struct hci_conn *c;
	639	c = list_entry(p, struct hci_conn, list);
	640
	641	bacpy(&(ci + n)->bdaddr, &c->dst);
	642	(ci + n)->handle = c->handle;
	643	(ci + n)->type = c->type;
	644	(ci + n)->out = c->out;
	645	(ci + n)->state = c->state;
	646	(ci + n)->link_mode = c->link_mode;
	647	if (++n >= req.conn_num)
	648	break;
	649	}
	650	hci_dev_unlock_bh(hdev);
	651
	652	cl->dev_id = hdev->id;
	653	cl->conn_num = n;
	654	size = sizeof(req) + n * sizeof(*ci);
	655
	656	hci_dev_put(hdev);
	657
	658	err = copy_to_user(arg, cl, size);
	659	kfree(cl);
	660
	661	return err ? -EFAULT : 0;
	662	}
	663
	664	int hci_get_conn_info(struct hci_dev hdev, void __user arg)
	665	{
	666	struct hci_conn_info_req req;
	667	struct hci_conn_info ci;
	668	struct hci_conn *conn;
	669	char __user *ptr = arg + sizeof(req);
	670
	671	if (copy_from_user(&req, arg, sizeof(req)))
	672	return -EFAULT;
	673
	674	hci_dev_lock_bh(hdev);
	675	conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
	676	if (conn) {
	677	bacpy(&ci.bdaddr, &conn->dst);
	678	ci.handle = conn->handle;
	679	ci.type = conn->type;
	680	ci.out = conn->out;
	681	ci.state = conn->state;
	682	ci.link_mode = conn->link_mode;
	683	}
	684	hci_dev_unlock_bh(hdev);
	685
	686	if (!conn)
	687	return -ENOENT;
	688
	689	return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
	690	}
40be492f MH	691
	692	int hci_get_auth_info(struct hci_dev hdev, void __user arg)
	693	{
	694	struct hci_auth_info_req req;
	695	struct hci_conn *conn;
	696
	697	if (copy_from_user(&req, arg, sizeof(req)))
	698	return -EFAULT;
	699
	700	hci_dev_lock_bh(hdev);
	701	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr);
	702	if (conn)
	703	req.type = conn->auth_type;
	704	hci_dev_unlock_bh(hdev);
	705
	706	if (!conn)
	707	return -ENOENT;
	708
	709	return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0;
	710	}