[thirdparty/kernel/stable.git] / net / bluetooth / hci_conn.c

/*
   BlueZ - Bluetooth protocol stack for Linux
   Copyright (C) 2000-2001 Qualcomm Incorporated

   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>

   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License version 2 as
   published by the Free Software Foundation;

   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
   SOFTWARE IS DISCLAIMED.
*/

/* Bluetooth HCI connection handling. */

#include <linux/module.h>

#include <linux/types.h>
#include <linux/errno.h>
#include <linux/kernel.h>
#include <linux/slab.h>
#include <linux/poll.h>
#include <linux/fcntl.h>
#include <linux/init.h>
#include <linux/skbuff.h>
#include <linux/interrupt.h>
#include <linux/notifier.h>
#include <net/sock.h>

#include <asm/system.h>
#include <asm/uaccess.h>
#include <asm/unaligned.h>

#include <net/bluetooth/bluetooth.h>
#include <net/bluetooth/hci_core.h>

#ifndef CONFIG_BT_HCI_CORE_DEBUG
#undef  BT_DBG
#define BT_DBG(D...)
#endif

void hci_acl_connect(struct hci_conn *conn)
{
	struct hci_dev *hdev = conn->hdev;
	struct inquiry_entry *ie;
	struct hci_cp_create_conn cp;

	BT_DBG("%p", conn);

	conn->state = BT_CONNECT;
	conn->out   = 1;
	conn->link_mode = HCI_LM_MASTER;

	conn->attempt++;

	memset(&cp, 0, sizeof(cp));
	bacpy(&cp.bdaddr, &conn->dst);
	cp.pscan_rep_mode = 0x02;

	if ((ie = hci_inquiry_cache_lookup(hdev, &conn->dst)) &&
			inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
		cp.pscan_rep_mode = ie->data.pscan_rep_mode;
		cp.pscan_mode     = ie->data.pscan_mode;
		cp.clock_offset   = ie->data.clock_offset | __cpu_to_le16(0x8000);
		memcpy(conn->dev_class, ie->data.dev_class, 3);
	}

	cp.pkt_type = __cpu_to_le16(hdev->pkt_type & ACL_PTYPE_MASK);
	if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
		cp.role_switch	= 0x01;
	else
		cp.role_switch	= 0x00;

	hci_send_cmd(hdev, OGF_LINK_CTL, OCF_CREATE_CONN, sizeof(cp), &cp);
}

static void hci_acl_connect_cancel(struct hci_conn *conn)
{
	struct hci_cp_create_conn_cancel cp;

	BT_DBG("%p", conn);

	if (conn->hdev->hci_ver < 2)
		return;

	bacpy(&cp.bdaddr, &conn->dst);
	hci_send_cmd(conn->hdev, OGF_LINK_CTL,
				OCF_CREATE_CONN_CANCEL, sizeof(cp), &cp);
}

void hci_acl_disconn(struct hci_conn *conn, __u8 reason)
{
	struct hci_cp_disconnect cp;

	BT_DBG("%p", conn);

	conn->state = BT_DISCONN;

	cp.handle = __cpu_to_le16(conn->handle);
	cp.reason = reason;
	hci_send_cmd(conn->hdev, OGF_LINK_CTL,
				OCF_DISCONNECT, sizeof(cp), &cp);
}

void hci_add_sco(struct hci_conn *conn, __u16 handle)
{
	struct hci_dev *hdev = conn->hdev;
	struct hci_cp_add_sco cp;

	BT_DBG("%p", conn);

	conn->state = BT_CONNECT;
	conn->out = 1;

	cp.pkt_type = __cpu_to_le16(hdev->pkt_type & SCO_PTYPE_MASK);
	cp.handle   = __cpu_to_le16(handle);

	hci_send_cmd(hdev, OGF_LINK_CTL, OCF_ADD_SCO, sizeof(cp), &cp);
}

static void hci_conn_timeout(unsigned long arg)
{
	struct hci_conn *conn = (void *) arg;
	struct hci_dev *hdev = conn->hdev;

	BT_DBG("conn %p state %d", conn, conn->state);

	if (atomic_read(&conn->refcnt))
		return;

	hci_dev_lock(hdev);

	switch (conn->state) {
	case BT_CONNECT:
		hci_acl_connect_cancel(conn);
		break;
	case BT_CONNECTED:
		hci_acl_disconn(conn, 0x13);
		break;
	default:
		conn->state = BT_CLOSED;
		break;
	}

	hci_dev_unlock(hdev);
}

static void hci_conn_idle(unsigned long arg)
{
	struct hci_conn *conn = (void *) arg;

	BT_DBG("conn %p mode %d", conn, conn->mode);

	hci_conn_enter_sniff_mode(conn);
}

struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
{
	struct hci_conn *conn;

	BT_DBG("%s dst %s", hdev->name, batostr(dst));

	conn = kzalloc(sizeof(struct hci_conn), GFP_ATOMIC);
	if (!conn)
		return NULL;

	bacpy(&conn->dst, dst);
	conn->hdev   = hdev;
	conn->type   = type;
	conn->mode   = HCI_CM_ACTIVE;
	conn->state  = BT_OPEN;

	conn->power_save = 1;

	skb_queue_head_init(&conn->data_q);

	init_timer(&conn->disc_timer);
	conn->disc_timer.function = hci_conn_timeout;
	conn->disc_timer.data = (unsigned long) conn;

	init_timer(&conn->idle_timer);
	conn->idle_timer.function = hci_conn_idle;
	conn->idle_timer.data = (unsigned long) conn;

	atomic_set(&conn->refcnt, 0);

	hci_dev_hold(hdev);

	tasklet_disable(&hdev->tx_task);

	hci_conn_hash_add(hdev, conn);
	if (hdev->notify)
		hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);

	hci_conn_add_sysfs(conn);

	tasklet_enable(&hdev->tx_task);

	return conn;
}

int hci_conn_del(struct hci_conn *conn)
{
	struct hci_dev *hdev = conn->hdev;

	BT_DBG("%s conn %p handle %d", hdev->name, conn, conn->handle);

	del_timer(&conn->idle_timer);

	del_timer(&conn->disc_timer);

	if (conn->type == SCO_LINK) {
		struct hci_conn *acl = conn->link;
		if (acl) {
			acl->link = NULL;
			hci_conn_put(acl);
		}
	} else {
		struct hci_conn *sco = conn->link;
		if (sco)
			sco->link = NULL;

		/* Unacked frames */
		hdev->acl_cnt += conn->sent;
	}

	tasklet_disable(&hdev->tx_task);

	hci_conn_del_sysfs(conn);

	hci_conn_hash_del(hdev, conn);
	if (hdev->notify)
		hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);

	tasklet_enable(&hdev->tx_task);

	skb_queue_purge(&conn->data_q);

	hci_dev_put(hdev);

	/* will free via device release */
	put_device(&conn->dev);

	return 0;
}

struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src)
{
	int use_src = bacmp(src, BDADDR_ANY);
	struct hci_dev *hdev = NULL;
	struct list_head *p;

	BT_DBG("%s -> %s", batostr(src), batostr(dst));

	read_lock_bh(&hci_dev_list_lock);

	list_for_each(p, &hci_dev_list) {
		struct hci_dev *d = list_entry(p, struct hci_dev, list);

		if (!test_bit(HCI_UP, &d->flags) || test_bit(HCI_RAW, &d->flags))
			continue;

		/* Simple routing:
		 *   No source address - find interface with bdaddr != dst
		 *   Source address    - find interface with bdaddr == src
		 */

		if (use_src) {
			if (!bacmp(&d->bdaddr, src)) {
				hdev = d; break;
			}
		} else {
			if (bacmp(&d->bdaddr, dst)) {
				hdev = d; break;
			}
		}
	}

	if (hdev)
		hdev = hci_dev_hold(hdev);

	read_unlock_bh(&hci_dev_list_lock);
	return hdev;
}
EXPORT_SYMBOL(hci_get_route);

/* Create SCO or ACL connection.
 * Device _must_ be locked */
struct hci_conn * hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst)
{
	struct hci_conn *acl;

	BT_DBG("%s dst %s", hdev->name, batostr(dst));

	if (!(acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst))) {
		if (!(acl = hci_conn_add(hdev, ACL_LINK, dst)))
			return NULL;
	}

	hci_conn_hold(acl);

	if (acl->state == BT_OPEN || acl->state == BT_CLOSED)
		hci_acl_connect(acl);

	if (type == SCO_LINK) {
		struct hci_conn *sco;

		if (!(sco = hci_conn_hash_lookup_ba(hdev, SCO_LINK, dst))) {
			if (!(sco = hci_conn_add(hdev, SCO_LINK, dst))) {
				hci_conn_put(acl);
				return NULL;
			}
		}
		acl->link = sco;
		sco->link = acl;

		hci_conn_hold(sco);

		if (acl->state == BT_CONNECTED &&
				(sco->state == BT_OPEN || sco->state == BT_CLOSED))
			hci_add_sco(sco, acl->handle);

		return sco;
	} else {
		return acl;
	}
}
EXPORT_SYMBOL(hci_connect);

/* Authenticate remote device */
int hci_conn_auth(struct hci_conn *conn)
{
	BT_DBG("conn %p", conn);

	if (conn->link_mode & HCI_LM_AUTH)
		return 1;

	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
		struct hci_cp_auth_requested cp;
		cp.handle = __cpu_to_le16(conn->handle);
		hci_send_cmd(conn->hdev, OGF_LINK_CTL, OCF_AUTH_REQUESTED, sizeof(cp), &cp);
	}
	return 0;
}
EXPORT_SYMBOL(hci_conn_auth);

/* Enable encryption */
int hci_conn_encrypt(struct hci_conn *conn)
{
	BT_DBG("conn %p", conn);

	if (conn->link_mode & HCI_LM_ENCRYPT)
		return 1;

	if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend))
		return 0;

	if (hci_conn_auth(conn)) {
		struct hci_cp_set_conn_encrypt cp;
		cp.handle  = __cpu_to_le16(conn->handle);
		cp.encrypt = 1;
		hci_send_cmd(conn->hdev, OGF_LINK_CTL, OCF_SET_CONN_ENCRYPT, sizeof(cp), &cp);
	}
	return 0;
}
EXPORT_SYMBOL(hci_conn_encrypt);

/* Change link key */
int hci_conn_change_link_key(struct hci_conn *conn)
{
	BT_DBG("conn %p", conn);

	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
		struct hci_cp_change_conn_link_key cp;
		cp.handle = __cpu_to_le16(conn->handle);
		hci_send_cmd(conn->hdev, OGF_LINK_CTL, OCF_CHANGE_CONN_LINK_KEY, sizeof(cp), &cp);
	}
	return 0;
}
EXPORT_SYMBOL(hci_conn_change_link_key);

/* Switch role */
int hci_conn_switch_role(struct hci_conn *conn, uint8_t role)
{
	BT_DBG("conn %p", conn);

	if (!role && conn->link_mode & HCI_LM_MASTER)
		return 1;

	if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->pend)) {
		struct hci_cp_switch_role cp;
		bacpy(&cp.bdaddr, &conn->dst);
		cp.role = role;
		hci_send_cmd(conn->hdev, OGF_LINK_POLICY, OCF_SWITCH_ROLE, sizeof(cp), &cp);
	}
	return 0;
}
EXPORT_SYMBOL(hci_conn_switch_role);

/* Enter active mode */
void hci_conn_enter_active_mode(struct hci_conn *conn)
{
	struct hci_dev *hdev = conn->hdev;

	BT_DBG("conn %p mode %d", conn, conn->mode);

	if (test_bit(HCI_RAW, &hdev->flags))
		return;

	if (conn->mode != HCI_CM_SNIFF || !conn->power_save)
		goto timer;

	if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
		struct hci_cp_exit_sniff_mode cp;
		cp.handle = __cpu_to_le16(conn->handle);
		hci_send_cmd(hdev, OGF_LINK_POLICY,
				OCF_EXIT_SNIFF_MODE, sizeof(cp), &cp);
	}

timer:
	if (hdev->idle_timeout > 0)
		mod_timer(&conn->idle_timer,
			jiffies + msecs_to_jiffies(hdev->idle_timeout));
}

/* Enter sniff mode */
void hci_conn_enter_sniff_mode(struct hci_conn *conn)
{
	struct hci_dev *hdev = conn->hdev;

	BT_DBG("conn %p mode %d", conn, conn->mode);

	if (test_bit(HCI_RAW, &hdev->flags))
		return;

	if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn))
		return;

	if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF))
		return;

	if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
		struct hci_cp_sniff_subrate cp;
		cp.handle             = __cpu_to_le16(conn->handle);
		cp.max_latency        = __constant_cpu_to_le16(0);
		cp.min_remote_timeout = __constant_cpu_to_le16(0);
		cp.min_local_timeout  = __constant_cpu_to_le16(0);
		hci_send_cmd(hdev, OGF_LINK_POLICY,
				OCF_SNIFF_SUBRATE, sizeof(cp), &cp);
	}

	if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
		struct hci_cp_sniff_mode cp;
		cp.handle       = __cpu_to_le16(conn->handle);
		cp.max_interval = __cpu_to_le16(hdev->sniff_max_interval);
		cp.min_interval = __cpu_to_le16(hdev->sniff_min_interval);
		cp.attempt      = __constant_cpu_to_le16(4);
		cp.timeout      = __constant_cpu_to_le16(1);
		hci_send_cmd(hdev, OGF_LINK_POLICY,
				OCF_SNIFF_MODE, sizeof(cp), &cp);
	}
}

/* Drop all connection on the device */
void hci_conn_hash_flush(struct hci_dev *hdev)
{
	struct hci_conn_hash *h = &hdev->conn_hash;
	struct list_head *p;

	BT_DBG("hdev %s", hdev->name);

	p = h->list.next;
	while (p != &h->list) {
		struct hci_conn *c;

		c = list_entry(p, struct hci_conn, list);
		p = p->next;

		c->state = BT_CLOSED;

		hci_proto_disconn_ind(c, 0x16);
		hci_conn_del(c);
	}
}

int hci_get_conn_list(void __user *arg)
{
	struct hci_conn_list_req req, *cl;
	struct hci_conn_info *ci;
	struct hci_dev *hdev;
	struct list_head *p;
	int n = 0, size, err;

	if (copy_from_user(&req, arg, sizeof(req)))
		return -EFAULT;

	if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
		return -EINVAL;

	size = sizeof(req) + req.conn_num * sizeof(*ci);

	if (!(cl = kmalloc(size, GFP_KERNEL)))
		return -ENOMEM;

	if (!(hdev = hci_dev_get(req.dev_id))) {
		kfree(cl);
		return -ENODEV;
	}

	ci = cl->conn_info;

	hci_dev_lock_bh(hdev);
	list_for_each(p, &hdev->conn_hash.list) {
		register struct hci_conn *c;
		c = list_entry(p, struct hci_conn, list);

		bacpy(&(ci + n)->bdaddr, &c->dst);
		(ci + n)->handle = c->handle;
		(ci + n)->type  = c->type;
		(ci + n)->out   = c->out;
		(ci + n)->state = c->state;
		(ci + n)->link_mode = c->link_mode;
		if (++n >= req.conn_num)
			break;
	}
	hci_dev_unlock_bh(hdev);

	cl->dev_id = hdev->id;
	cl->conn_num = n;
	size = sizeof(req) + n * sizeof(*ci);

	hci_dev_put(hdev);

	err = copy_to_user(arg, cl, size);
	kfree(cl);

	return err ? -EFAULT : 0;
}

int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
{
	struct hci_conn_info_req req;
	struct hci_conn_info ci;
	struct hci_conn *conn;
	char __user *ptr = arg + sizeof(req);

	if (copy_from_user(&req, arg, sizeof(req)))
		return -EFAULT;

	hci_dev_lock_bh(hdev);
	conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
	if (conn) {
		bacpy(&ci.bdaddr, &conn->dst);
		ci.handle = conn->handle;
		ci.type  = conn->type;
		ci.out   = conn->out;
		ci.state = conn->state;
		ci.link_mode = conn->link_mode;
	}
	hci_dev_unlock_bh(hdev);

	if (!conn)
		return -ENOENT;

	return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
}
Commit	Line	Data
8e87d142	1	/*
1da177e4 LT	2	BlueZ - Bluetooth protocol stack for Linux
	3	Copyright (C) 2000-2001 Qualcomm Incorporated
	4
	5	Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
	6
	7	This program is free software; you can redistribute it and/or modify
	8	it under the terms of the GNU General Public License version 2 as
	9	published by the Free Software Foundation;
	10
	11	THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
	12	OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
	13	FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
	14	IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142 YH	15	CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
	16	WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
	17	ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4 LT	18	OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
1da177e4 LT	19
8e87d142 YH	20	ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
8e87d142 YH	21	COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4 LT	22	SOFTWARE IS DISCLAIMED.
	23	*/
	24
	25	/* Bluetooth HCI connection handling. */
	26
1da177e4 LT	27	#include <linux/module.h>
	28
	29	#include <linux/types.h>
	30	#include <linux/errno.h>
	31	#include <linux/kernel.h>
1da177e4 LT	32	#include <linux/slab.h>
	33	#include <linux/poll.h>
	34	#include <linux/fcntl.h>
	35	#include <linux/init.h>
	36	#include <linux/skbuff.h>
	37	#include <linux/interrupt.h>
	38	#include <linux/notifier.h>
	39	#include <net/sock.h>
	40
	41	#include <asm/system.h>
	42	#include <asm/uaccess.h>
	43	#include <asm/unaligned.h>
	44
	45	#include <net/bluetooth/bluetooth.h>
	46	#include <net/bluetooth/hci_core.h>
	47
	48	#ifndef CONFIG_BT_HCI_CORE_DEBUG
	49	#undef BT_DBG
	50	#define BT_DBG(D...)
	51	#endif
	52
4c67bc74	53	void hci_acl_connect(struct hci_conn *conn)
1da177e4 LT	54	{
	55	struct hci_dev *hdev = conn->hdev;
	56	struct inquiry_entry *ie;
	57	struct hci_cp_create_conn cp;
	58
	59	BT_DBG("%p", conn);
	60
	61	conn->state = BT_CONNECT;
	62	conn->out = 1;
	63	conn->link_mode = HCI_LM_MASTER;
	64
4c67bc74 MH	65	conn->attempt++;
4c67bc74 MH	66
1da177e4 LT	67	memset(&cp, 0, sizeof(cp));
	68	bacpy(&cp.bdaddr, &conn->dst);
	69	cp.pscan_rep_mode = 0x02;
	70
	71	if ((ie = hci_inquiry_cache_lookup(hdev, &conn->dst)) &&
	72	inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
	73	cp.pscan_rep_mode = ie->data.pscan_rep_mode;
	74	cp.pscan_mode = ie->data.pscan_mode;
	75	cp.clock_offset = ie->data.clock_offset \| __cpu_to_le16(0x8000);
	76	memcpy(conn->dev_class, ie->data.dev_class, 3);
	77	}
	78
	79	cp.pkt_type = __cpu_to_le16(hdev->pkt_type & ACL_PTYPE_MASK);
	80	if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
	81	cp.role_switch = 0x01;
	82	else
	83	cp.role_switch = 0x00;
4c67bc74	84
1da177e4 LT	85	hci_send_cmd(hdev, OGF_LINK_CTL, OCF_CREATE_CONN, sizeof(cp), &cp);
	86	}
	87
6ac59344 MH	88	static void hci_acl_connect_cancel(struct hci_conn *conn)
	89	{
	90	struct hci_cp_create_conn_cancel cp;
	91
	92	BT_DBG("%p", conn);
	93
	94	if (conn->hdev->hci_ver < 2)
	95	return;
	96
	97	bacpy(&cp.bdaddr, &conn->dst);
	98	hci_send_cmd(conn->hdev, OGF_LINK_CTL,
	99	OCF_CREATE_CONN_CANCEL, sizeof(cp), &cp);
	100	}
	101
1da177e4 LT	102	void hci_acl_disconn(struct hci_conn *conn, __u8 reason)
	103	{
	104	struct hci_cp_disconnect cp;
	105
	106	BT_DBG("%p", conn);
	107
	108	conn->state = BT_DISCONN;
	109
	110	cp.handle = __cpu_to_le16(conn->handle);
	111	cp.reason = reason;
6ac59344 MH	112	hci_send_cmd(conn->hdev, OGF_LINK_CTL,
6ac59344 MH	113	OCF_DISCONNECT, sizeof(cp), &cp);
1da177e4 LT	114	}
	115
	116	void hci_add_sco(struct hci_conn *conn, __u16 handle)
	117	{
	118	struct hci_dev *hdev = conn->hdev;
	119	struct hci_cp_add_sco cp;
	120
	121	BT_DBG("%p", conn);
	122
	123	conn->state = BT_CONNECT;
	124	conn->out = 1;
	125
	126	cp.pkt_type = __cpu_to_le16(hdev->pkt_type & SCO_PTYPE_MASK);
	127	cp.handle = __cpu_to_le16(handle);
	128
	129	hci_send_cmd(hdev, OGF_LINK_CTL, OCF_ADD_SCO, sizeof(cp), &cp);
	130	}
	131
	132	static void hci_conn_timeout(unsigned long arg)
	133	{
04837f64 MH	134	struct hci_conn conn = (void ) arg;
04837f64 MH	135	struct hci_dev *hdev = conn->hdev;
1da177e4 LT	136
	137	BT_DBG("conn %p state %d", conn, conn->state);
	138
	139	if (atomic_read(&conn->refcnt))
	140	return;
	141
	142	hci_dev_lock(hdev);
6ac59344 MH	143
	144	switch (conn->state) {
	145	case BT_CONNECT:
	146	hci_acl_connect_cancel(conn);
	147	break;
8e87d142	148	case BT_CONNECTED:
1da177e4	149	hci_acl_disconn(conn, 0x13);
6ac59344 MH	150	break;
6ac59344 MH	151	default:
1da177e4	152	conn->state = BT_CLOSED;
6ac59344 MH	153	break;
	154	}
	155
1da177e4	156	hci_dev_unlock(hdev);
1da177e4 LT	157	}
1da177e4 LT	158
04837f64	159	static void hci_conn_idle(unsigned long arg)
1da177e4	160	{
04837f64 MH	161	struct hci_conn conn = (void ) arg;
	162
	163	BT_DBG("conn %p mode %d", conn, conn->mode);
	164
	165	hci_conn_enter_sniff_mode(conn);
1da177e4 LT	166	}
	167
	168	struct hci_conn hci_conn_add(struct hci_dev hdev, int type, bdaddr_t *dst)
	169	{
	170	struct hci_conn *conn;
	171
	172	BT_DBG("%s dst %s", hdev->name, batostr(dst));
	173
04837f64 MH	174	conn = kzalloc(sizeof(struct hci_conn), GFP_ATOMIC);
04837f64 MH	175	if (!conn)
1da177e4	176	return NULL;
1da177e4 LT	177
1da177e4 LT	178	bacpy(&conn->dst, dst);
1da177e4	179	conn->hdev = hdev;
04837f64 MH	180	conn->type = type;
04837f64 MH	181	conn->mode = HCI_CM_ACTIVE;
1da177e4 LT	182	conn->state = BT_OPEN;
1da177e4 LT	183
04837f64 MH	184	conn->power_save = 1;
04837f64 MH	185
1da177e4	186	skb_queue_head_init(&conn->data_q);
04837f64 MH	187
	188	init_timer(&conn->disc_timer);
	189	conn->disc_timer.function = hci_conn_timeout;
	190	conn->disc_timer.data = (unsigned long) conn;
	191
	192	init_timer(&conn->idle_timer);
	193	conn->idle_timer.function = hci_conn_idle;
	194	conn->idle_timer.data = (unsigned long) conn;
1da177e4 LT	195
	196	atomic_set(&conn->refcnt, 0);
	197
	198	hci_dev_hold(hdev);
	199
	200	tasklet_disable(&hdev->tx_task);
	201
	202	hci_conn_hash_add(hdev, conn);
	203	if (hdev->notify)
	204	hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
	205
b219e3ac MH	206	hci_conn_add_sysfs(conn);
b219e3ac MH	207
1da177e4 LT	208	tasklet_enable(&hdev->tx_task);
	209
	210	return conn;
	211	}
	212
	213	int hci_conn_del(struct hci_conn *conn)
	214	{
	215	struct hci_dev *hdev = conn->hdev;
	216
	217	BT_DBG("%s conn %p handle %d", hdev->name, conn, conn->handle);
	218
04837f64 MH	219	del_timer(&conn->idle_timer);
	220
	221	del_timer(&conn->disc_timer);
1da177e4 LT	222
	223	if (conn->type == SCO_LINK) {
	224	struct hci_conn *acl = conn->link;
	225	if (acl) {
	226	acl->link = NULL;
	227	hci_conn_put(acl);
	228	}
	229	} else {
	230	struct hci_conn *sco = conn->link;
	231	if (sco)
	232	sco->link = NULL;
	233
	234	/* Unacked frames */
	235	hdev->acl_cnt += conn->sent;
	236	}
	237
	238	tasklet_disable(&hdev->tx_task);
	239
b219e3ac MH	240	hci_conn_del_sysfs(conn);
b219e3ac MH	241
1da177e4 LT	242	hci_conn_hash_del(hdev, conn);
	243	if (hdev->notify)
	244	hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
	245
	246	tasklet_enable(&hdev->tx_task);
	247
	248	skb_queue_purge(&conn->data_q);
	249
	250	hci_dev_put(hdev);
	251
b219e3ac MH	252	/* will free via device release */
	253	put_device(&conn->dev);
	254
1da177e4 LT	255	return 0;
	256	}
	257
	258	struct hci_dev hci_get_route(bdaddr_t dst, bdaddr_t *src)
	259	{
	260	int use_src = bacmp(src, BDADDR_ANY);
	261	struct hci_dev *hdev = NULL;
	262	struct list_head *p;
	263
	264	BT_DBG("%s -> %s", batostr(src), batostr(dst));
	265
	266	read_lock_bh(&hci_dev_list_lock);
	267
	268	list_for_each(p, &hci_dev_list) {
	269	struct hci_dev *d = list_entry(p, struct hci_dev, list);
	270
	271	if (!test_bit(HCI_UP, &d->flags) \|\| test_bit(HCI_RAW, &d->flags))
	272	continue;
	273
8e87d142	274	/* Simple routing:
1da177e4 LT	275	* No source address - find interface with bdaddr != dst
	276	* Source address - find interface with bdaddr == src
	277	*/
	278
	279	if (use_src) {
	280	if (!bacmp(&d->bdaddr, src)) {
	281	hdev = d; break;
	282	}
	283	} else {
	284	if (bacmp(&d->bdaddr, dst)) {
	285	hdev = d; break;
	286	}
	287	}
	288	}
	289
	290	if (hdev)
	291	hdev = hci_dev_hold(hdev);
	292
	293	read_unlock_bh(&hci_dev_list_lock);
	294	return hdev;
	295	}
	296	EXPORT_SYMBOL(hci_get_route);
	297
	298	/* Create SCO or ACL connection.
	299	* Device _must_ be locked */
	300	struct hci_conn * hci_connect(struct hci_dev hdev, int type, bdaddr_t dst)
	301	{
	302	struct hci_conn *acl;
	303
	304	BT_DBG("%s dst %s", hdev->name, batostr(dst));
	305
	306	if (!(acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst))) {
	307	if (!(acl = hci_conn_add(hdev, ACL_LINK, dst)))
	308	return NULL;
	309	}
	310
	311	hci_conn_hold(acl);
	312
	313	if (acl->state == BT_OPEN \|\| acl->state == BT_CLOSED)
	314	hci_acl_connect(acl);
	315
	316	if (type == SCO_LINK) {
	317	struct hci_conn *sco;
	318
	319	if (!(sco = hci_conn_hash_lookup_ba(hdev, SCO_LINK, dst))) {
	320	if (!(sco = hci_conn_add(hdev, SCO_LINK, dst))) {
	321	hci_conn_put(acl);
	322	return NULL;
	323	}
	324	}
	325	acl->link = sco;
	326	sco->link = acl;
	327
	328	hci_conn_hold(sco);
	329
8e87d142	330	if (acl->state == BT_CONNECTED &&
1da177e4 LT	331	(sco->state == BT_OPEN \|\| sco->state == BT_CLOSED))
	332	hci_add_sco(sco, acl->handle);
	333
	334	return sco;
	335	} else {
	336	return acl;
	337	}
	338	}
	339	EXPORT_SYMBOL(hci_connect);
	340
	341	/* Authenticate remote device */
	342	int hci_conn_auth(struct hci_conn *conn)
	343	{
	344	BT_DBG("conn %p", conn);
	345
	346	if (conn->link_mode & HCI_LM_AUTH)
	347	return 1;
	348
	349	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
	350	struct hci_cp_auth_requested cp;
	351	cp.handle = __cpu_to_le16(conn->handle);
	352	hci_send_cmd(conn->hdev, OGF_LINK_CTL, OCF_AUTH_REQUESTED, sizeof(cp), &cp);
	353	}
	354	return 0;
	355	}
	356	EXPORT_SYMBOL(hci_conn_auth);
	357
	358	/* Enable encryption */
	359	int hci_conn_encrypt(struct hci_conn *conn)
	360	{
	361	BT_DBG("conn %p", conn);
	362
	363	if (conn->link_mode & HCI_LM_ENCRYPT)
	364	return 1;
	365
	366	if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend))
	367	return 0;
	368
	369	if (hci_conn_auth(conn)) {
	370	struct hci_cp_set_conn_encrypt cp;
	371	cp.handle = __cpu_to_le16(conn->handle);
8e87d142	372	cp.encrypt = 1;
1da177e4 LT	373	hci_send_cmd(conn->hdev, OGF_LINK_CTL, OCF_SET_CONN_ENCRYPT, sizeof(cp), &cp);
	374	}
	375	return 0;
	376	}
	377	EXPORT_SYMBOL(hci_conn_encrypt);
	378
	379	/* Change link key */
	380	int hci_conn_change_link_key(struct hci_conn *conn)
	381	{
	382	BT_DBG("conn %p", conn);
	383
	384	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
	385	struct hci_cp_change_conn_link_key cp;
	386	cp.handle = __cpu_to_le16(conn->handle);
	387	hci_send_cmd(conn->hdev, OGF_LINK_CTL, OCF_CHANGE_CONN_LINK_KEY, sizeof(cp), &cp);
	388	}
	389	return 0;
	390	}
	391	EXPORT_SYMBOL(hci_conn_change_link_key);
	392
	393	/* Switch role */
	394	int hci_conn_switch_role(struct hci_conn *conn, uint8_t role)
	395	{
	396	BT_DBG("conn %p", conn);
	397
	398	if (!role && conn->link_mode & HCI_LM_MASTER)
	399	return 1;
	400
	401	if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->pend)) {
	402	struct hci_cp_switch_role cp;
	403	bacpy(&cp.bdaddr, &conn->dst);
	404	cp.role = role;
	405	hci_send_cmd(conn->hdev, OGF_LINK_POLICY, OCF_SWITCH_ROLE, sizeof(cp), &cp);
	406	}
	407	return 0;
	408	}
	409	EXPORT_SYMBOL(hci_conn_switch_role);
	410
04837f64 MH	411	/* Enter active mode */
	412	void hci_conn_enter_active_mode(struct hci_conn *conn)
	413	{
	414	struct hci_dev *hdev = conn->hdev;
	415
	416	BT_DBG("conn %p mode %d", conn, conn->mode);
	417
	418	if (test_bit(HCI_RAW, &hdev->flags))
	419	return;
	420
	421	if (conn->mode != HCI_CM_SNIFF \|\| !conn->power_save)
	422	goto timer;
	423
	424	if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
	425	struct hci_cp_exit_sniff_mode cp;
	426	cp.handle = __cpu_to_le16(conn->handle);
	427	hci_send_cmd(hdev, OGF_LINK_POLICY,
	428	OCF_EXIT_SNIFF_MODE, sizeof(cp), &cp);
	429	}
	430
	431	timer:
	432	if (hdev->idle_timeout > 0)
	433	mod_timer(&conn->idle_timer,
	434	jiffies + msecs_to_jiffies(hdev->idle_timeout));
	435	}
	436
	437	/* Enter sniff mode */
	438	void hci_conn_enter_sniff_mode(struct hci_conn *conn)
	439	{
	440	struct hci_dev *hdev = conn->hdev;
	441
	442	BT_DBG("conn %p mode %d", conn, conn->mode);
	443
	444	if (test_bit(HCI_RAW, &hdev->flags))
	445	return;
	446
	447	if (!lmp_sniff_capable(hdev) \|\| !lmp_sniff_capable(conn))
	448	return;
	449
	450	if (conn->mode != HCI_CM_ACTIVE \|\| !(conn->link_policy & HCI_LP_SNIFF))
	451	return;
	452
	453	if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
	454	struct hci_cp_sniff_subrate cp;
	455	cp.handle = __cpu_to_le16(conn->handle);
	456	cp.max_latency = __constant_cpu_to_le16(0);
	457	cp.min_remote_timeout = __constant_cpu_to_le16(0);
	458	cp.min_local_timeout = __constant_cpu_to_le16(0);
	459	hci_send_cmd(hdev, OGF_LINK_POLICY,
	460	OCF_SNIFF_SUBRATE, sizeof(cp), &cp);
	461	}
	462
	463	if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
	464	struct hci_cp_sniff_mode cp;
	465	cp.handle = __cpu_to_le16(conn->handle);
	466	cp.max_interval = __cpu_to_le16(hdev->sniff_max_interval);
	467	cp.min_interval = __cpu_to_le16(hdev->sniff_min_interval);
	468	cp.attempt = __constant_cpu_to_le16(4);
	469	cp.timeout = __constant_cpu_to_le16(1);
	470	hci_send_cmd(hdev, OGF_LINK_POLICY,
	471	OCF_SNIFF_MODE, sizeof(cp), &cp);
	472	}
	473	}
	474
1da177e4 LT	475	/* Drop all connection on the device */
	476	void hci_conn_hash_flush(struct hci_dev *hdev)
	477	{
	478	struct hci_conn_hash *h = &hdev->conn_hash;
	479	struct list_head *p;
	480
	481	BT_DBG("hdev %s", hdev->name);
	482
	483	p = h->list.next;
	484	while (p != &h->list) {
	485	struct hci_conn *c;
	486
	487	c = list_entry(p, struct hci_conn, list);
	488	p = p->next;
	489
	490	c->state = BT_CLOSED;
	491
	492	hci_proto_disconn_ind(c, 0x16);
	493	hci_conn_del(c);
	494	}
	495	}
	496
	497	int hci_get_conn_list(void __user *arg)
	498	{
	499	struct hci_conn_list_req req, *cl;
	500	struct hci_conn_info *ci;
	501	struct hci_dev *hdev;
	502	struct list_head *p;
	503	int n = 0, size, err;
	504
	505	if (copy_from_user(&req, arg, sizeof(req)))
	506	return -EFAULT;
	507
	508	if (!req.conn_num \|\| req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
	509	return -EINVAL;
	510
	511	size = sizeof(req) + req.conn_num * sizeof(*ci);
	512
12fe2c58	513	if (!(cl = kmalloc(size, GFP_KERNEL)))
1da177e4 LT	514	return -ENOMEM;
	515
	516	if (!(hdev = hci_dev_get(req.dev_id))) {
	517	kfree(cl);
	518	return -ENODEV;
	519	}
	520
	521	ci = cl->conn_info;
	522
	523	hci_dev_lock_bh(hdev);
	524	list_for_each(p, &hdev->conn_hash.list) {
	525	register struct hci_conn *c;
	526	c = list_entry(p, struct hci_conn, list);
	527
	528	bacpy(&(ci + n)->bdaddr, &c->dst);
	529	(ci + n)->handle = c->handle;
	530	(ci + n)->type = c->type;
	531	(ci + n)->out = c->out;
	532	(ci + n)->state = c->state;
	533	(ci + n)->link_mode = c->link_mode;
	534	if (++n >= req.conn_num)
	535	break;
	536	}
	537	hci_dev_unlock_bh(hdev);
	538
	539	cl->dev_id = hdev->id;
	540	cl->conn_num = n;
	541	size = sizeof(req) + n * sizeof(*ci);
	542
	543	hci_dev_put(hdev);
	544
	545	err = copy_to_user(arg, cl, size);
	546	kfree(cl);
	547
	548	return err ? -EFAULT : 0;
	549	}
	550
	551	int hci_get_conn_info(struct hci_dev hdev, void __user arg)
	552	{
	553	struct hci_conn_info_req req;
	554	struct hci_conn_info ci;
	555	struct hci_conn *conn;
	556	char __user *ptr = arg + sizeof(req);
	557
	558	if (copy_from_user(&req, arg, sizeof(req)))
	559	return -EFAULT;
	560
	561	hci_dev_lock_bh(hdev);
	562	conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
	563	if (conn) {
	564	bacpy(&ci.bdaddr, &conn->dst);
	565	ci.handle = conn->handle;
	566	ci.type = conn->type;
	567	ci.out = conn->out;
	568	ci.state = conn->state;
	569	ci.link_mode = conn->link_mode;
	570	}
	571	hci_dev_unlock_bh(hdev);
	572
	573	if (!conn)
	574	return -ENOENT;
	575
	576	return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
	577	}