[thirdparty/kernel/stable.git] / net / bluetooth / hci_conn.c

/*
   BlueZ - Bluetooth protocol stack for Linux
   Copyright (C) 2000-2001 Qualcomm Incorporated

   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>

   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License version 2 as
   published by the Free Software Foundation;

   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
   SOFTWARE IS DISCLAIMED.
*/

/* Bluetooth HCI connection handling. */

#include <linux/module.h>

#include <linux/types.h>
#include <linux/errno.h>
#include <linux/kernel.h>
#include <linux/slab.h>
#include <linux/poll.h>
#include <linux/fcntl.h>
#include <linux/init.h>
#include <linux/skbuff.h>
#include <linux/interrupt.h>
#include <linux/notifier.h>
#include <net/sock.h>

#include <asm/system.h>
#include <asm/uaccess.h>
#include <asm/unaligned.h>

#include <net/bluetooth/bluetooth.h>
#include <net/bluetooth/hci_core.h>

#ifndef CONFIG_BT_HCI_CORE_DEBUG
#undef  BT_DBG
#define BT_DBG(D...)
#endif

void hci_acl_connect(struct hci_conn *conn)
{
	struct hci_dev *hdev = conn->hdev;
	struct inquiry_entry *ie;
	struct hci_cp_create_conn cp;

	BT_DBG("%p", conn);

	conn->state = BT_CONNECT;
	conn->out   = 1;
	conn->link_mode = HCI_LM_MASTER;

	conn->attempt++;

	memset(&cp, 0, sizeof(cp));
	bacpy(&cp.bdaddr, &conn->dst);
	cp.pscan_rep_mode = 0x02;

	if ((ie = hci_inquiry_cache_lookup(hdev, &conn->dst)) &&
			inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
		cp.pscan_rep_mode = ie->data.pscan_rep_mode;
		cp.pscan_mode     = ie->data.pscan_mode;
		cp.clock_offset   = ie->data.clock_offset | cpu_to_le16(0x8000);
		memcpy(conn->dev_class, ie->data.dev_class, 3);
	}

	cp.pkt_type = cpu_to_le16(hdev->pkt_type & ACL_PTYPE_MASK);
	if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
		cp.role_switch	= 0x01;
	else
		cp.role_switch	= 0x00;

	hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
}

static void hci_acl_connect_cancel(struct hci_conn *conn)
{
	struct hci_cp_create_conn_cancel cp;

	BT_DBG("%p", conn);

	if (conn->hdev->hci_ver < 2)
		return;

	bacpy(&cp.bdaddr, &conn->dst);
	hci_send_cmd(conn->hdev, HCI_OP_CREATE_CONN_CANCEL, sizeof(cp), &cp);
}

void hci_acl_disconn(struct hci_conn *conn, __u8 reason)
{
	struct hci_cp_disconnect cp;

	BT_DBG("%p", conn);

	conn->state = BT_DISCONN;

	cp.handle = cpu_to_le16(conn->handle);
	cp.reason = reason;
	hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp);
}

void hci_add_sco(struct hci_conn *conn, __u16 handle)
{
	struct hci_dev *hdev = conn->hdev;
	struct hci_cp_add_sco cp;

	BT_DBG("%p", conn);

	conn->state = BT_CONNECT;
	conn->out = 1;

	cp.handle   = cpu_to_le16(handle);
	cp.pkt_type = cpu_to_le16(hdev->pkt_type & SCO_PTYPE_MASK);

	hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
}

static void hci_conn_timeout(unsigned long arg)
{
	struct hci_conn *conn = (void *) arg;
	struct hci_dev *hdev = conn->hdev;

	BT_DBG("conn %p state %d", conn, conn->state);

	if (atomic_read(&conn->refcnt))
		return;

	hci_dev_lock(hdev);

	switch (conn->state) {
	case BT_CONNECT:
		hci_acl_connect_cancel(conn);
		break;
	case BT_CONNECTED:
		hci_acl_disconn(conn, 0x13);
		break;
	default:
		conn->state = BT_CLOSED;
		break;
	}

	hci_dev_unlock(hdev);
}

static void hci_conn_idle(unsigned long arg)
{
	struct hci_conn *conn = (void *) arg;

	BT_DBG("conn %p mode %d", conn, conn->mode);

	hci_conn_enter_sniff_mode(conn);
}

struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
{
	struct hci_conn *conn;

	BT_DBG("%s dst %s", hdev->name, batostr(dst));

	conn = kzalloc(sizeof(struct hci_conn), GFP_ATOMIC);
	if (!conn)
		return NULL;

	bacpy(&conn->dst, dst);
	conn->hdev   = hdev;
	conn->type   = type;
	conn->mode   = HCI_CM_ACTIVE;
	conn->state  = BT_OPEN;

	conn->power_save = 1;

	skb_queue_head_init(&conn->data_q);

	init_timer(&conn->disc_timer);
	conn->disc_timer.function = hci_conn_timeout;
	conn->disc_timer.data = (unsigned long) conn;

	init_timer(&conn->idle_timer);
	conn->idle_timer.function = hci_conn_idle;
	conn->idle_timer.data = (unsigned long) conn;

	atomic_set(&conn->refcnt, 0);

	hci_dev_hold(hdev);

	tasklet_disable(&hdev->tx_task);

	hci_conn_hash_add(hdev, conn);
	if (hdev->notify)
		hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);

	hci_conn_add_sysfs(conn);

	tasklet_enable(&hdev->tx_task);

	return conn;
}

int hci_conn_del(struct hci_conn *conn)
{
	struct hci_dev *hdev = conn->hdev;

	BT_DBG("%s conn %p handle %d", hdev->name, conn, conn->handle);

	del_timer(&conn->idle_timer);

	del_timer(&conn->disc_timer);

	if (conn->type == ACL_LINK) {
		struct hci_conn *sco = conn->link;
		if (sco)
			sco->link = NULL;

		/* Unacked frames */
		hdev->acl_cnt += conn->sent;
	} else {
		struct hci_conn *acl = conn->link;
		if (acl) {
			acl->link = NULL;
			hci_conn_put(acl);
		}
	}

	tasklet_disable(&hdev->tx_task);

	hci_conn_del_sysfs(conn);

	hci_conn_hash_del(hdev, conn);
	if (hdev->notify)
		hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);

	tasklet_enable(&hdev->tx_task);

	skb_queue_purge(&conn->data_q);

	hci_dev_put(hdev);

	/* will free via device release */
	put_device(&conn->dev);

	return 0;
}

struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src)
{
	int use_src = bacmp(src, BDADDR_ANY);
	struct hci_dev *hdev = NULL;
	struct list_head *p;

	BT_DBG("%s -> %s", batostr(src), batostr(dst));

	read_lock_bh(&hci_dev_list_lock);

	list_for_each(p, &hci_dev_list) {
		struct hci_dev *d = list_entry(p, struct hci_dev, list);

		if (!test_bit(HCI_UP, &d->flags) || test_bit(HCI_RAW, &d->flags))
			continue;

		/* Simple routing:
		 *   No source address - find interface with bdaddr != dst
		 *   Source address    - find interface with bdaddr == src
		 */

		if (use_src) {
			if (!bacmp(&d->bdaddr, src)) {
				hdev = d; break;
			}
		} else {
			if (bacmp(&d->bdaddr, dst)) {
				hdev = d; break;
			}
		}
	}

	if (hdev)
		hdev = hci_dev_hold(hdev);

	read_unlock_bh(&hci_dev_list_lock);
	return hdev;
}
EXPORT_SYMBOL(hci_get_route);

/* Create SCO or ACL connection.
 * Device _must_ be locked */
struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst)
{
	struct hci_conn *acl;
	struct hci_conn *sco;

	BT_DBG("%s dst %s", hdev->name, batostr(dst));

	if (!(acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst))) {
		if (!(acl = hci_conn_add(hdev, ACL_LINK, dst)))
			return NULL;
	}

	hci_conn_hold(acl);

	if (acl->state == BT_OPEN || acl->state == BT_CLOSED)
		hci_acl_connect(acl);

	if (type == ACL_LINK)
		return acl;

	if (!(sco = hci_conn_hash_lookup_ba(hdev, type, dst))) {
		if (!(sco = hci_conn_add(hdev, type, dst))) {
			hci_conn_put(acl);
			return NULL;
		}
	}

	acl->link = sco;
	sco->link = acl;

	hci_conn_hold(sco);

	if (acl->state == BT_CONNECTED &&
			(sco->state == BT_OPEN || sco->state == BT_CLOSED))
		hci_add_sco(sco, acl->handle);

	return sco;
}
EXPORT_SYMBOL(hci_connect);

/* Authenticate remote device */
int hci_conn_auth(struct hci_conn *conn)
{
	BT_DBG("conn %p", conn);

	if (conn->link_mode & HCI_LM_AUTH)
		return 1;

	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
		struct hci_cp_auth_requested cp;
		cp.handle = cpu_to_le16(conn->handle);
		hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
	}
	return 0;
}
EXPORT_SYMBOL(hci_conn_auth);

/* Enable encryption */
int hci_conn_encrypt(struct hci_conn *conn)
{
	BT_DBG("conn %p", conn);

	if (conn->link_mode & HCI_LM_ENCRYPT)
		return 1;

	if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend))
		return 0;

	if (hci_conn_auth(conn)) {
		struct hci_cp_set_conn_encrypt cp;
		cp.handle  = cpu_to_le16(conn->handle);
		cp.encrypt = 1;
		hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp), &cp);
	}
	return 0;
}
EXPORT_SYMBOL(hci_conn_encrypt);

/* Change link key */
int hci_conn_change_link_key(struct hci_conn *conn)
{
	BT_DBG("conn %p", conn);

	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
		struct hci_cp_change_conn_link_key cp;
		cp.handle = cpu_to_le16(conn->handle);
		hci_send_cmd(conn->hdev, HCI_OP_CHANGE_CONN_LINK_KEY, sizeof(cp), &cp);
	}
	return 0;
}
EXPORT_SYMBOL(hci_conn_change_link_key);

/* Switch role */
int hci_conn_switch_role(struct hci_conn *conn, uint8_t role)
{
	BT_DBG("conn %p", conn);

	if (!role && conn->link_mode & HCI_LM_MASTER)
		return 1;

	if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->pend)) {
		struct hci_cp_switch_role cp;
		bacpy(&cp.bdaddr, &conn->dst);
		cp.role = role;
		hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
	}
	return 0;
}
EXPORT_SYMBOL(hci_conn_switch_role);

/* Enter active mode */
void hci_conn_enter_active_mode(struct hci_conn *conn)
{
	struct hci_dev *hdev = conn->hdev;

	BT_DBG("conn %p mode %d", conn, conn->mode);

	if (test_bit(HCI_RAW, &hdev->flags))
		return;

	if (conn->mode != HCI_CM_SNIFF || !conn->power_save)
		goto timer;

	if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
		struct hci_cp_exit_sniff_mode cp;
		cp.handle = cpu_to_le16(conn->handle);
		hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
	}

timer:
	if (hdev->idle_timeout > 0)
		mod_timer(&conn->idle_timer,
			jiffies + msecs_to_jiffies(hdev->idle_timeout));
}

/* Enter sniff mode */
void hci_conn_enter_sniff_mode(struct hci_conn *conn)
{
	struct hci_dev *hdev = conn->hdev;

	BT_DBG("conn %p mode %d", conn, conn->mode);

	if (test_bit(HCI_RAW, &hdev->flags))
		return;

	if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn))
		return;

	if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF))
		return;

	if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
		struct hci_cp_sniff_subrate cp;
		cp.handle             = cpu_to_le16(conn->handle);
		cp.max_latency        = cpu_to_le16(0);
		cp.min_remote_timeout = cpu_to_le16(0);
		cp.min_local_timeout  = cpu_to_le16(0);
		hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
	}

	if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
		struct hci_cp_sniff_mode cp;
		cp.handle       = cpu_to_le16(conn->handle);
		cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
		cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
		cp.attempt      = cpu_to_le16(4);
		cp.timeout      = cpu_to_le16(1);
		hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
	}
}

/* Drop all connection on the device */
void hci_conn_hash_flush(struct hci_dev *hdev)
{
	struct hci_conn_hash *h = &hdev->conn_hash;
	struct list_head *p;

	BT_DBG("hdev %s", hdev->name);

	p = h->list.next;
	while (p != &h->list) {
		struct hci_conn *c;

		c = list_entry(p, struct hci_conn, list);
		p = p->next;

		c->state = BT_CLOSED;

		hci_proto_disconn_ind(c, 0x16);
		hci_conn_del(c);
	}
}

/* Check pending connect attempts */
void hci_conn_check_pending(struct hci_dev *hdev)
{
	struct hci_conn *conn;

	BT_DBG("hdev %s", hdev->name);

	hci_dev_lock(hdev);

	conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
	if (conn)
		hci_acl_connect(conn);

	hci_dev_unlock(hdev);
}

int hci_get_conn_list(void __user *arg)
{
	struct hci_conn_list_req req, *cl;
	struct hci_conn_info *ci;
	struct hci_dev *hdev;
	struct list_head *p;
	int n = 0, size, err;

	if (copy_from_user(&req, arg, sizeof(req)))
		return -EFAULT;

	if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
		return -EINVAL;

	size = sizeof(req) + req.conn_num * sizeof(*ci);

	if (!(cl = kmalloc(size, GFP_KERNEL)))
		return -ENOMEM;

	if (!(hdev = hci_dev_get(req.dev_id))) {
		kfree(cl);
		return -ENODEV;
	}

	ci = cl->conn_info;

	hci_dev_lock_bh(hdev);
	list_for_each(p, &hdev->conn_hash.list) {
		register struct hci_conn *c;
		c = list_entry(p, struct hci_conn, list);

		bacpy(&(ci + n)->bdaddr, &c->dst);
		(ci + n)->handle = c->handle;
		(ci + n)->type  = c->type;
		(ci + n)->out   = c->out;
		(ci + n)->state = c->state;
		(ci + n)->link_mode = c->link_mode;
		if (++n >= req.conn_num)
			break;
	}
	hci_dev_unlock_bh(hdev);

	cl->dev_id = hdev->id;
	cl->conn_num = n;
	size = sizeof(req) + n * sizeof(*ci);

	hci_dev_put(hdev);

	err = copy_to_user(arg, cl, size);
	kfree(cl);

	return err ? -EFAULT : 0;
}

int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
{
	struct hci_conn_info_req req;
	struct hci_conn_info ci;
	struct hci_conn *conn;
	char __user *ptr = arg + sizeof(req);

	if (copy_from_user(&req, arg, sizeof(req)))
		return -EFAULT;

	hci_dev_lock_bh(hdev);
	conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
	if (conn) {
		bacpy(&ci.bdaddr, &conn->dst);
		ci.handle = conn->handle;
		ci.type  = conn->type;
		ci.out   = conn->out;
		ci.state = conn->state;
		ci.link_mode = conn->link_mode;
	}
	hci_dev_unlock_bh(hdev);

	if (!conn)
		return -ENOENT;

	return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
}
Commit	Line	Data
8e87d142	1	/*
1da177e4 LT	2	BlueZ - Bluetooth protocol stack for Linux
	3	Copyright (C) 2000-2001 Qualcomm Incorporated
	4
	5	Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
	6
	7	This program is free software; you can redistribute it and/or modify
	8	it under the terms of the GNU General Public License version 2 as
	9	published by the Free Software Foundation;
	10
	11	THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
	12	OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
	13	FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
	14	IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142 YH	15	CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
	16	WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
	17	ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4 LT	18	OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
1da177e4 LT	19
8e87d142 YH	20	ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
8e87d142 YH	21	COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4 LT	22	SOFTWARE IS DISCLAIMED.
	23	*/
	24
	25	/* Bluetooth HCI connection handling. */
	26
1da177e4 LT	27	#include <linux/module.h>
	28
	29	#include <linux/types.h>
	30	#include <linux/errno.h>
	31	#include <linux/kernel.h>
1da177e4 LT	32	#include <linux/slab.h>
	33	#include <linux/poll.h>
	34	#include <linux/fcntl.h>
	35	#include <linux/init.h>
	36	#include <linux/skbuff.h>
	37	#include <linux/interrupt.h>
	38	#include <linux/notifier.h>
	39	#include <net/sock.h>
	40
	41	#include <asm/system.h>
	42	#include <asm/uaccess.h>
	43	#include <asm/unaligned.h>
	44
	45	#include <net/bluetooth/bluetooth.h>
	46	#include <net/bluetooth/hci_core.h>
	47
	48	#ifndef CONFIG_BT_HCI_CORE_DEBUG
	49	#undef BT_DBG
	50	#define BT_DBG(D...)
	51	#endif
	52
4c67bc74	53	void hci_acl_connect(struct hci_conn *conn)
1da177e4 LT	54	{
	55	struct hci_dev *hdev = conn->hdev;
	56	struct inquiry_entry *ie;
	57	struct hci_cp_create_conn cp;
	58
	59	BT_DBG("%p", conn);
	60
	61	conn->state = BT_CONNECT;
	62	conn->out = 1;
	63	conn->link_mode = HCI_LM_MASTER;
	64
4c67bc74 MH	65	conn->attempt++;
4c67bc74 MH	66
1da177e4 LT	67	memset(&cp, 0, sizeof(cp));
	68	bacpy(&cp.bdaddr, &conn->dst);
	69	cp.pscan_rep_mode = 0x02;
	70
	71	if ((ie = hci_inquiry_cache_lookup(hdev, &conn->dst)) &&
	72	inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
	73	cp.pscan_rep_mode = ie->data.pscan_rep_mode;
	74	cp.pscan_mode = ie->data.pscan_mode;
aca3192c	75	cp.clock_offset = ie->data.clock_offset \| cpu_to_le16(0x8000);
1da177e4 LT	76	memcpy(conn->dev_class, ie->data.dev_class, 3);
	77	}
	78
aca3192c	79	cp.pkt_type = cpu_to_le16(hdev->pkt_type & ACL_PTYPE_MASK);
1da177e4 LT	80	if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
	81	cp.role_switch = 0x01;
	82	else
	83	cp.role_switch = 0x00;
4c67bc74	84
a9de9248	85	hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
1da177e4 LT	86	}
1da177e4 LT	87
6ac59344 MH	88	static void hci_acl_connect_cancel(struct hci_conn *conn)
	89	{
	90	struct hci_cp_create_conn_cancel cp;
	91
	92	BT_DBG("%p", conn);
	93
	94	if (conn->hdev->hci_ver < 2)
	95	return;
	96
	97	bacpy(&cp.bdaddr, &conn->dst);
a9de9248	98	hci_send_cmd(conn->hdev, HCI_OP_CREATE_CONN_CANCEL, sizeof(cp), &cp);
6ac59344 MH	99	}
6ac59344 MH	100
1da177e4 LT	101	void hci_acl_disconn(struct hci_conn *conn, __u8 reason)
	102	{
	103	struct hci_cp_disconnect cp;
	104
	105	BT_DBG("%p", conn);
	106
	107	conn->state = BT_DISCONN;
	108
aca3192c	109	cp.handle = cpu_to_le16(conn->handle);
1da177e4	110	cp.reason = reason;
a9de9248	111	hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp);
1da177e4 LT	112	}
	113
	114	void hci_add_sco(struct hci_conn *conn, __u16 handle)
	115	{
	116	struct hci_dev *hdev = conn->hdev;
	117	struct hci_cp_add_sco cp;
	118
	119	BT_DBG("%p", conn);
	120
	121	conn->state = BT_CONNECT;
	122	conn->out = 1;
	123
aca3192c	124	cp.handle = cpu_to_le16(handle);
5b7f9909	125	cp.pkt_type = cpu_to_le16(hdev->pkt_type & SCO_PTYPE_MASK);
1da177e4	126
a9de9248	127	hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
1da177e4 LT	128	}
	129
	130	static void hci_conn_timeout(unsigned long arg)
	131	{
04837f64 MH	132	struct hci_conn conn = (void ) arg;
04837f64 MH	133	struct hci_dev *hdev = conn->hdev;
1da177e4 LT	134
	135	BT_DBG("conn %p state %d", conn, conn->state);
	136
	137	if (atomic_read(&conn->refcnt))
	138	return;
	139
	140	hci_dev_lock(hdev);
6ac59344 MH	141
	142	switch (conn->state) {
	143	case BT_CONNECT:
	144	hci_acl_connect_cancel(conn);
	145	break;
8e87d142	146	case BT_CONNECTED:
1da177e4	147	hci_acl_disconn(conn, 0x13);
6ac59344 MH	148	break;
6ac59344 MH	149	default:
1da177e4	150	conn->state = BT_CLOSED;
6ac59344 MH	151	break;
	152	}
	153
1da177e4	154	hci_dev_unlock(hdev);
1da177e4 LT	155	}
1da177e4 LT	156
04837f64	157	static void hci_conn_idle(unsigned long arg)
1da177e4	158	{
04837f64 MH	159	struct hci_conn conn = (void ) arg;
	160
	161	BT_DBG("conn %p mode %d", conn, conn->mode);
	162
	163	hci_conn_enter_sniff_mode(conn);
1da177e4 LT	164	}
	165
	166	struct hci_conn hci_conn_add(struct hci_dev hdev, int type, bdaddr_t *dst)
	167	{
	168	struct hci_conn *conn;
	169
	170	BT_DBG("%s dst %s", hdev->name, batostr(dst));
	171
04837f64 MH	172	conn = kzalloc(sizeof(struct hci_conn), GFP_ATOMIC);
04837f64 MH	173	if (!conn)
1da177e4	174	return NULL;
1da177e4 LT	175
1da177e4 LT	176	bacpy(&conn->dst, dst);
1da177e4	177	conn->hdev = hdev;
04837f64 MH	178	conn->type = type;
04837f64 MH	179	conn->mode = HCI_CM_ACTIVE;
1da177e4 LT	180	conn->state = BT_OPEN;
1da177e4 LT	181
04837f64 MH	182	conn->power_save = 1;
04837f64 MH	183
1da177e4	184	skb_queue_head_init(&conn->data_q);
04837f64 MH	185
	186	init_timer(&conn->disc_timer);
	187	conn->disc_timer.function = hci_conn_timeout;
	188	conn->disc_timer.data = (unsigned long) conn;
	189
	190	init_timer(&conn->idle_timer);
	191	conn->idle_timer.function = hci_conn_idle;
	192	conn->idle_timer.data = (unsigned long) conn;
1da177e4 LT	193
	194	atomic_set(&conn->refcnt, 0);
	195
	196	hci_dev_hold(hdev);
	197
	198	tasklet_disable(&hdev->tx_task);
	199
	200	hci_conn_hash_add(hdev, conn);
	201	if (hdev->notify)
	202	hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
	203
b219e3ac MH	204	hci_conn_add_sysfs(conn);
b219e3ac MH	205
1da177e4 LT	206	tasklet_enable(&hdev->tx_task);
	207
	208	return conn;
	209	}
	210
	211	int hci_conn_del(struct hci_conn *conn)
	212	{
	213	struct hci_dev *hdev = conn->hdev;
	214
	215	BT_DBG("%s conn %p handle %d", hdev->name, conn, conn->handle);
	216
04837f64 MH	217	del_timer(&conn->idle_timer);
	218
	219	del_timer(&conn->disc_timer);
1da177e4	220
5b7f9909	221	if (conn->type == ACL_LINK) {
1da177e4 LT	222	struct hci_conn *sco = conn->link;
	223	if (sco)
	224	sco->link = NULL;
	225
	226	/* Unacked frames */
	227	hdev->acl_cnt += conn->sent;
5b7f9909 MH	228	} else {
	229	struct hci_conn *acl = conn->link;
	230	if (acl) {
	231	acl->link = NULL;
	232	hci_conn_put(acl);
	233	}
1da177e4 LT	234	}
	235
	236	tasklet_disable(&hdev->tx_task);
	237
b219e3ac MH	238	hci_conn_del_sysfs(conn);
b219e3ac MH	239
1da177e4 LT	240	hci_conn_hash_del(hdev, conn);
	241	if (hdev->notify)
	242	hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
	243
	244	tasklet_enable(&hdev->tx_task);
	245
	246	skb_queue_purge(&conn->data_q);
	247
	248	hci_dev_put(hdev);
	249
b219e3ac MH	250	/* will free via device release */
	251	put_device(&conn->dev);
	252
1da177e4 LT	253	return 0;
	254	}
	255
	256	struct hci_dev hci_get_route(bdaddr_t dst, bdaddr_t *src)
	257	{
	258	int use_src = bacmp(src, BDADDR_ANY);
	259	struct hci_dev *hdev = NULL;
	260	struct list_head *p;
	261
	262	BT_DBG("%s -> %s", batostr(src), batostr(dst));
	263
	264	read_lock_bh(&hci_dev_list_lock);
	265
	266	list_for_each(p, &hci_dev_list) {
	267	struct hci_dev *d = list_entry(p, struct hci_dev, list);
	268
	269	if (!test_bit(HCI_UP, &d->flags) \|\| test_bit(HCI_RAW, &d->flags))
	270	continue;
	271
8e87d142	272	/* Simple routing:
1da177e4 LT	273	* No source address - find interface with bdaddr != dst
	274	* Source address - find interface with bdaddr == src
	275	*/
	276
	277	if (use_src) {
	278	if (!bacmp(&d->bdaddr, src)) {
	279	hdev = d; break;
	280	}
	281	} else {
	282	if (bacmp(&d->bdaddr, dst)) {
	283	hdev = d; break;
	284	}
	285	}
	286	}
	287
	288	if (hdev)
	289	hdev = hci_dev_hold(hdev);
	290
	291	read_unlock_bh(&hci_dev_list_lock);
	292	return hdev;
	293	}
	294	EXPORT_SYMBOL(hci_get_route);
	295
	296	/* Create SCO or ACL connection.
	297	* Device _must_ be locked */
5b7f9909	298	struct hci_conn hci_connect(struct hci_dev hdev, int type, bdaddr_t *dst)
1da177e4 LT	299	{
1da177e4 LT	300	struct hci_conn *acl;
5b7f9909	301	struct hci_conn *sco;
1da177e4 LT	302
	303	BT_DBG("%s dst %s", hdev->name, batostr(dst));
	304
	305	if (!(acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst))) {
	306	if (!(acl = hci_conn_add(hdev, ACL_LINK, dst)))
	307	return NULL;
	308	}
	309
	310	hci_conn_hold(acl);
	311
	312	if (acl->state == BT_OPEN \|\| acl->state == BT_CLOSED)
	313	hci_acl_connect(acl);
	314
5b7f9909 MH	315	if (type == ACL_LINK)
5b7f9909 MH	316	return acl;
1da177e4	317
5b7f9909 MH	318	if (!(sco = hci_conn_hash_lookup_ba(hdev, type, dst))) {
	319	if (!(sco = hci_conn_add(hdev, type, dst))) {
	320	hci_conn_put(acl);
	321	return NULL;
1da177e4	322	}
5b7f9909	323	}
1da177e4	324
5b7f9909 MH	325	acl->link = sco;
5b7f9909 MH	326	sco->link = acl;
1da177e4	327
5b7f9909	328	hci_conn_hold(sco);
1da177e4	329
5b7f9909 MH	330	if (acl->state == BT_CONNECTED &&
	331	(sco->state == BT_OPEN \|\| sco->state == BT_CLOSED))
	332	hci_add_sco(sco, acl->handle);
	333
	334	return sco;
1da177e4 LT	335	}
	336	EXPORT_SYMBOL(hci_connect);
	337
	338	/* Authenticate remote device */
	339	int hci_conn_auth(struct hci_conn *conn)
	340	{
	341	BT_DBG("conn %p", conn);
	342
	343	if (conn->link_mode & HCI_LM_AUTH)
	344	return 1;
	345
	346	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
	347	struct hci_cp_auth_requested cp;
aca3192c	348	cp.handle = cpu_to_le16(conn->handle);
a9de9248	349	hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
1da177e4 LT	350	}
	351	return 0;
	352	}
	353	EXPORT_SYMBOL(hci_conn_auth);
	354
	355	/* Enable encryption */
	356	int hci_conn_encrypt(struct hci_conn *conn)
	357	{
	358	BT_DBG("conn %p", conn);
	359
	360	if (conn->link_mode & HCI_LM_ENCRYPT)
	361	return 1;
	362
	363	if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend))
	364	return 0;
	365
	366	if (hci_conn_auth(conn)) {
	367	struct hci_cp_set_conn_encrypt cp;
aca3192c	368	cp.handle = cpu_to_le16(conn->handle);
8e87d142	369	cp.encrypt = 1;
a9de9248	370	hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp), &cp);
1da177e4 LT	371	}
	372	return 0;
	373	}
	374	EXPORT_SYMBOL(hci_conn_encrypt);
	375
	376	/* Change link key */
	377	int hci_conn_change_link_key(struct hci_conn *conn)
	378	{
	379	BT_DBG("conn %p", conn);
	380
	381	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
	382	struct hci_cp_change_conn_link_key cp;
aca3192c	383	cp.handle = cpu_to_le16(conn->handle);
a9de9248	384	hci_send_cmd(conn->hdev, HCI_OP_CHANGE_CONN_LINK_KEY, sizeof(cp), &cp);
1da177e4 LT	385	}
	386	return 0;
	387	}
	388	EXPORT_SYMBOL(hci_conn_change_link_key);
	389
	390	/* Switch role */
	391	int hci_conn_switch_role(struct hci_conn *conn, uint8_t role)
	392	{
	393	BT_DBG("conn %p", conn);
	394
	395	if (!role && conn->link_mode & HCI_LM_MASTER)
	396	return 1;
	397
	398	if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->pend)) {
	399	struct hci_cp_switch_role cp;
	400	bacpy(&cp.bdaddr, &conn->dst);
	401	cp.role = role;
a9de9248	402	hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
1da177e4 LT	403	}
	404	return 0;
	405	}
	406	EXPORT_SYMBOL(hci_conn_switch_role);
	407
04837f64 MH	408	/* Enter active mode */
	409	void hci_conn_enter_active_mode(struct hci_conn *conn)
	410	{
	411	struct hci_dev *hdev = conn->hdev;
	412
	413	BT_DBG("conn %p mode %d", conn, conn->mode);
	414
	415	if (test_bit(HCI_RAW, &hdev->flags))
	416	return;
	417
	418	if (conn->mode != HCI_CM_SNIFF \|\| !conn->power_save)
	419	goto timer;
	420
	421	if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
	422	struct hci_cp_exit_sniff_mode cp;
aca3192c	423	cp.handle = cpu_to_le16(conn->handle);
a9de9248	424	hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
04837f64 MH	425	}
	426
	427	timer:
	428	if (hdev->idle_timeout > 0)
	429	mod_timer(&conn->idle_timer,
	430	jiffies + msecs_to_jiffies(hdev->idle_timeout));
	431	}
	432
	433	/* Enter sniff mode */
	434	void hci_conn_enter_sniff_mode(struct hci_conn *conn)
	435	{
	436	struct hci_dev *hdev = conn->hdev;
	437
	438	BT_DBG("conn %p mode %d", conn, conn->mode);
	439
	440	if (test_bit(HCI_RAW, &hdev->flags))
	441	return;
	442
	443	if (!lmp_sniff_capable(hdev) \|\| !lmp_sniff_capable(conn))
	444	return;
	445
	446	if (conn->mode != HCI_CM_ACTIVE \|\| !(conn->link_policy & HCI_LP_SNIFF))
	447	return;
	448
	449	if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
	450	struct hci_cp_sniff_subrate cp;
aca3192c YH	451	cp.handle = cpu_to_le16(conn->handle);
	452	cp.max_latency = cpu_to_le16(0);
	453	cp.min_remote_timeout = cpu_to_le16(0);
	454	cp.min_local_timeout = cpu_to_le16(0);
a9de9248	455	hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
04837f64 MH	456	}
	457
	458	if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
	459	struct hci_cp_sniff_mode cp;
aca3192c YH	460	cp.handle = cpu_to_le16(conn->handle);
	461	cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
	462	cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
	463	cp.attempt = cpu_to_le16(4);
	464	cp.timeout = cpu_to_le16(1);
a9de9248	465	hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
04837f64 MH	466	}
	467	}
	468
1da177e4 LT	469	/* Drop all connection on the device */
	470	void hci_conn_hash_flush(struct hci_dev *hdev)
	471	{
	472	struct hci_conn_hash *h = &hdev->conn_hash;
	473	struct list_head *p;
	474
	475	BT_DBG("hdev %s", hdev->name);
	476
	477	p = h->list.next;
	478	while (p != &h->list) {
	479	struct hci_conn *c;
	480
	481	c = list_entry(p, struct hci_conn, list);
	482	p = p->next;
	483
	484	c->state = BT_CLOSED;
	485
	486	hci_proto_disconn_ind(c, 0x16);
	487	hci_conn_del(c);
	488	}
	489	}
	490
a9de9248 MH	491	/* Check pending connect attempts */
	492	void hci_conn_check_pending(struct hci_dev *hdev)
	493	{
	494	struct hci_conn *conn;
	495
	496	BT_DBG("hdev %s", hdev->name);
	497
	498	hci_dev_lock(hdev);
	499
	500	conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
	501	if (conn)
	502	hci_acl_connect(conn);
	503
	504	hci_dev_unlock(hdev);
	505	}
	506
1da177e4 LT	507	int hci_get_conn_list(void __user *arg)
	508	{
	509	struct hci_conn_list_req req, *cl;
	510	struct hci_conn_info *ci;
	511	struct hci_dev *hdev;
	512	struct list_head *p;
	513	int n = 0, size, err;
	514
	515	if (copy_from_user(&req, arg, sizeof(req)))
	516	return -EFAULT;
	517
	518	if (!req.conn_num \|\| req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
	519	return -EINVAL;
	520
	521	size = sizeof(req) + req.conn_num * sizeof(*ci);
	522
12fe2c58	523	if (!(cl = kmalloc(size, GFP_KERNEL)))
1da177e4 LT	524	return -ENOMEM;
	525
	526	if (!(hdev = hci_dev_get(req.dev_id))) {
	527	kfree(cl);
	528	return -ENODEV;
	529	}
	530
	531	ci = cl->conn_info;
	532
	533	hci_dev_lock_bh(hdev);
	534	list_for_each(p, &hdev->conn_hash.list) {
	535	register struct hci_conn *c;
	536	c = list_entry(p, struct hci_conn, list);
	537
	538	bacpy(&(ci + n)->bdaddr, &c->dst);
	539	(ci + n)->handle = c->handle;
	540	(ci + n)->type = c->type;
	541	(ci + n)->out = c->out;
	542	(ci + n)->state = c->state;
	543	(ci + n)->link_mode = c->link_mode;
	544	if (++n >= req.conn_num)
	545	break;
	546	}
	547	hci_dev_unlock_bh(hdev);
	548
	549	cl->dev_id = hdev->id;
	550	cl->conn_num = n;
	551	size = sizeof(req) + n * sizeof(*ci);
	552
	553	hci_dev_put(hdev);
	554
	555	err = copy_to_user(arg, cl, size);
	556	kfree(cl);
	557
	558	return err ? -EFAULT : 0;
	559	}
	560
	561	int hci_get_conn_info(struct hci_dev hdev, void __user arg)
	562	{
	563	struct hci_conn_info_req req;
	564	struct hci_conn_info ci;
	565	struct hci_conn *conn;
	566	char __user *ptr = arg + sizeof(req);
	567
	568	if (copy_from_user(&req, arg, sizeof(req)))
	569	return -EFAULT;
	570
	571	hci_dev_lock_bh(hdev);
	572	conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
	573	if (conn) {
	574	bacpy(&ci.bdaddr, &conn->dst);
	575	ci.handle = conn->handle;
	576	ci.type = conn->type;
	577	ci.out = conn->out;
	578	ci.state = conn->state;
	579	ci.link_mode = conn->link_mode;
	580	}
	581	hci_dev_unlock_bh(hdev);
	582
	583	if (!conn)
	584	return -ENOENT;
	585
	586	return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
	587	}