[net-next-2.6.git] / net / bluetooth / hci_conn.c

/*
   BlueZ - Bluetooth protocol stack for Linux
   Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.

   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>

   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License version 2 as
   published by the Free Software Foundation;

   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
   SOFTWARE IS DISCLAIMED.
*/

/* Bluetooth HCI connection handling. */

#include <linux/module.h>

#include <linux/types.h>
#include <linux/errno.h>
#include <linux/kernel.h>
#include <linux/slab.h>
#include <linux/poll.h>
#include <linux/fcntl.h>
#include <linux/init.h>
#include <linux/skbuff.h>
#include <linux/interrupt.h>
#include <linux/notifier.h>
#include <net/sock.h>

#include <asm/system.h>
#include <asm/uaccess.h>
#include <asm/unaligned.h>

#include <net/bluetooth/bluetooth.h>
#include <net/bluetooth/hci_core.h>

void hci_acl_connect(struct hci_conn *conn)
{
	struct hci_dev *hdev = conn->hdev;
	struct inquiry_entry *ie;
	struct hci_cp_create_conn cp;

	BT_DBG("%p", conn);

	conn->state = BT_CONNECT;
	conn->out = 1;

	conn->link_mode = HCI_LM_MASTER;

	conn->attempt++;

	conn->link_policy = hdev->link_policy;

	memset(&cp, 0, sizeof(cp));
	bacpy(&cp.bdaddr, &conn->dst);
	cp.pscan_rep_mode = 0x02;

	if ((ie = hci_inquiry_cache_lookup(hdev, &conn->dst))) {
		if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
			cp.pscan_rep_mode = ie->data.pscan_rep_mode;
			cp.pscan_mode     = ie->data.pscan_mode;
			cp.clock_offset   = ie->data.clock_offset |
							cpu_to_le16(0x8000);
		}

		memcpy(conn->dev_class, ie->data.dev_class, 3);
		conn->ssp_mode = ie->data.ssp_mode;
	}

	cp.pkt_type = cpu_to_le16(conn->pkt_type);
	if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
		cp.role_switch = 0x01;
	else
		cp.role_switch = 0x00;

	hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
}

static void hci_acl_connect_cancel(struct hci_conn *conn)
{
	struct hci_cp_create_conn_cancel cp;

	BT_DBG("%p", conn);

	if (conn->hdev->hci_ver < 2)
		return;

	bacpy(&cp.bdaddr, &conn->dst);
	hci_send_cmd(conn->hdev, HCI_OP_CREATE_CONN_CANCEL, sizeof(cp), &cp);
}

void hci_acl_disconn(struct hci_conn *conn, __u8 reason)
{
	struct hci_cp_disconnect cp;

	BT_DBG("%p", conn);

	conn->state = BT_DISCONN;

	cp.handle = cpu_to_le16(conn->handle);
	cp.reason = reason;
	hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp);
}

void hci_add_sco(struct hci_conn *conn, __u16 handle)
{
	struct hci_dev *hdev = conn->hdev;
	struct hci_cp_add_sco cp;

	BT_DBG("%p", conn);

	conn->state = BT_CONNECT;
	conn->out = 1;

	conn->attempt++;

	cp.handle   = cpu_to_le16(handle);
	cp.pkt_type = cpu_to_le16(conn->pkt_type);

	hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
}

void hci_setup_sync(struct hci_conn *conn, __u16 handle)
{
	struct hci_dev *hdev = conn->hdev;
	struct hci_cp_setup_sync_conn cp;

	BT_DBG("%p", conn);

	conn->state = BT_CONNECT;
	conn->out = 1;

	conn->attempt++;

	cp.handle   = cpu_to_le16(handle);
	cp.pkt_type = cpu_to_le16(conn->pkt_type);

	cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
	cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
	cp.max_latency    = cpu_to_le16(0xffff);
	cp.voice_setting  = cpu_to_le16(hdev->voice_setting);
	cp.retrans_effort = 0xff;

	hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp);
}

/* Device _must_ be locked */
void hci_sco_setup(struct hci_conn *conn, __u8 status)
{
	struct hci_conn *sco = conn->link;

	BT_DBG("%p", conn);

	if (!sco)
		return;

	if (!status) {
		if (lmp_esco_capable(conn->hdev))
			hci_setup_sync(sco, conn->handle);
		else
			hci_add_sco(sco, conn->handle);
	} else {
		hci_proto_connect_cfm(sco, status);
		hci_conn_del(sco);
	}
}

static void hci_conn_timeout(unsigned long arg)
{
	struct hci_conn *conn = (void *) arg;
	struct hci_dev *hdev = conn->hdev;
	__u8 reason;

	BT_DBG("conn %p state %d", conn, conn->state);

	if (atomic_read(&conn->refcnt))
		return;

	hci_dev_lock(hdev);

	switch (conn->state) {
	case BT_CONNECT:
	case BT_CONNECT2:
		if (conn->type == ACL_LINK && conn->out)
			hci_acl_connect_cancel(conn);
		break;
	case BT_CONFIG:
	case BT_CONNECTED:
		reason = hci_proto_disconn_ind(conn);
		hci_acl_disconn(conn, reason);
		break;
	default:
		conn->state = BT_CLOSED;
		break;
	}

	hci_dev_unlock(hdev);
}

static void hci_conn_idle(unsigned long arg)
{
	struct hci_conn *conn = (void *) arg;

	BT_DBG("conn %p mode %d", conn, conn->mode);

	hci_conn_enter_sniff_mode(conn);
}

struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
{
	struct hci_conn *conn;

	BT_DBG("%s dst %s", hdev->name, batostr(dst));

	conn = kzalloc(sizeof(struct hci_conn), GFP_ATOMIC);
	if (!conn)
		return NULL;

	bacpy(&conn->dst, dst);
	conn->hdev  = hdev;
	conn->type  = type;
	conn->mode  = HCI_CM_ACTIVE;
	conn->state = BT_OPEN;
	conn->auth_type = HCI_AT_GENERAL_BONDING;

	conn->power_save = 1;
	conn->disc_timeout = HCI_DISCONN_TIMEOUT;

	switch (type) {
	case ACL_LINK:
		conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
		break;
	case SCO_LINK:
		if (lmp_esco_capable(hdev))
			conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
					(hdev->esco_type & EDR_ESCO_MASK);
		else
			conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
		break;
	case ESCO_LINK:
		conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
		break;
	}

	skb_queue_head_init(&conn->data_q);

	setup_timer(&conn->disc_timer, hci_conn_timeout, (unsigned long)conn);
	setup_timer(&conn->idle_timer, hci_conn_idle, (unsigned long)conn);

	atomic_set(&conn->refcnt, 0);

	hci_dev_hold(hdev);

	tasklet_disable(&hdev->tx_task);

	hci_conn_hash_add(hdev, conn);
	if (hdev->notify)
		hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);

	atomic_set(&conn->devref, 0);

	hci_conn_init_sysfs(conn);

	tasklet_enable(&hdev->tx_task);

	return conn;
}

int hci_conn_del(struct hci_conn *conn)
{
	struct hci_dev *hdev = conn->hdev;

	BT_DBG("%s conn %p handle %d", hdev->name, conn, conn->handle);

	del_timer(&conn->idle_timer);

	del_timer(&conn->disc_timer);

	if (conn->type == ACL_LINK) {
		struct hci_conn *sco = conn->link;
		if (sco)
			sco->link = NULL;

		/* Unacked frames */
		hdev->acl_cnt += conn->sent;
	} else {
		struct hci_conn *acl = conn->link;
		if (acl) {
			acl->link = NULL;
			hci_conn_put(acl);
		}
	}

	tasklet_disable(&hdev->tx_task);

	hci_conn_hash_del(hdev, conn);
	if (hdev->notify)
		hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);

	tasklet_enable(&hdev->tx_task);

	skb_queue_purge(&conn->data_q);

	hci_conn_put_device(conn);

	hci_dev_put(hdev);

	return 0;
}

struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src)
{
	int use_src = bacmp(src, BDADDR_ANY);
	struct hci_dev *hdev = NULL;
	struct list_head *p;

	BT_DBG("%s -> %s", batostr(src), batostr(dst));

	read_lock_bh(&hci_dev_list_lock);

	list_for_each(p, &hci_dev_list) {
		struct hci_dev *d = list_entry(p, struct hci_dev, list);

		if (!test_bit(HCI_UP, &d->flags) || test_bit(HCI_RAW, &d->flags))
			continue;

		/* Simple routing:
		 *   No source address - find interface with bdaddr != dst
		 *   Source address    - find interface with bdaddr == src
		 */

		if (use_src) {
			if (!bacmp(&d->bdaddr, src)) {
				hdev = d; break;
			}
		} else {
			if (bacmp(&d->bdaddr, dst)) {
				hdev = d; break;
			}
		}
	}

	if (hdev)
		hdev = hci_dev_hold(hdev);

	read_unlock_bh(&hci_dev_list_lock);
	return hdev;
}
EXPORT_SYMBOL(hci_get_route);

/* Create SCO or ACL connection.
 * Device _must_ be locked */
struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, __u8 sec_level, __u8 auth_type)
{
	struct hci_conn *acl;
	struct hci_conn *sco;

	BT_DBG("%s dst %s", hdev->name, batostr(dst));

	if (!(acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst))) {
		if (!(acl = hci_conn_add(hdev, ACL_LINK, dst)))
			return NULL;
	}

	hci_conn_hold(acl);

	if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
		acl->sec_level = sec_level;
		acl->auth_type = auth_type;
		hci_acl_connect(acl);
	} else {
		if (acl->sec_level < sec_level)
			acl->sec_level = sec_level;
		if (acl->auth_type < auth_type)
			acl->auth_type = auth_type;
	}

	if (type == ACL_LINK)
		return acl;

	if (!(sco = hci_conn_hash_lookup_ba(hdev, type, dst))) {
		if (!(sco = hci_conn_add(hdev, type, dst))) {
			hci_conn_put(acl);
			return NULL;
		}
	}

	acl->link = sco;
	sco->link = acl;

	hci_conn_hold(sco);

	if (acl->state == BT_CONNECTED &&
			(sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
		acl->power_save = 1;
		hci_conn_enter_active_mode(acl);

		if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->pend)) {
			/* defer SCO setup until mode change completed */
			set_bit(HCI_CONN_SCO_SETUP_PEND, &acl->pend);
			return sco;
		}

		hci_sco_setup(acl, 0x00);
	}

	return sco;
}
EXPORT_SYMBOL(hci_connect);

/* Check link security requirement */
int hci_conn_check_link_mode(struct hci_conn *conn)
{
	BT_DBG("conn %p", conn);

	if (conn->ssp_mode > 0 && conn->hdev->ssp_mode > 0 &&
					!(conn->link_mode & HCI_LM_ENCRYPT))
		return 0;

	return 1;
}
EXPORT_SYMBOL(hci_conn_check_link_mode);

/* Authenticate remote device */
static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
{
	BT_DBG("conn %p", conn);

	if (sec_level > conn->sec_level)
		conn->sec_level = sec_level;
	else if (conn->link_mode & HCI_LM_AUTH)
		return 1;

	conn->auth_type = auth_type;

	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
		struct hci_cp_auth_requested cp;
		cp.handle = cpu_to_le16(conn->handle);
		hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
							sizeof(cp), &cp);
	}

	return 0;
}

/* Enable security */
int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
{
	BT_DBG("conn %p", conn);

	if (sec_level == BT_SECURITY_SDP)
		return 1;

	if (sec_level == BT_SECURITY_LOW &&
				(!conn->ssp_mode || !conn->hdev->ssp_mode))
		return 1;

	if (conn->link_mode & HCI_LM_ENCRYPT)
		return hci_conn_auth(conn, sec_level, auth_type);

	if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend))
		return 0;

	if (hci_conn_auth(conn, sec_level, auth_type)) {
		struct hci_cp_set_conn_encrypt cp;
		cp.handle  = cpu_to_le16(conn->handle);
		cp.encrypt = 1;
		hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT,
							sizeof(cp), &cp);
	}

	return 0;
}
EXPORT_SYMBOL(hci_conn_security);

/* Change link key */
int hci_conn_change_link_key(struct hci_conn *conn)
{
	BT_DBG("conn %p", conn);

	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
		struct hci_cp_change_conn_link_key cp;
		cp.handle = cpu_to_le16(conn->handle);
		hci_send_cmd(conn->hdev, HCI_OP_CHANGE_CONN_LINK_KEY,
							sizeof(cp), &cp);
	}

	return 0;
}
EXPORT_SYMBOL(hci_conn_change_link_key);

/* Switch role */
int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
{
	BT_DBG("conn %p", conn);

	if (!role && conn->link_mode & HCI_LM_MASTER)
		return 1;

	if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->pend)) {
		struct hci_cp_switch_role cp;
		bacpy(&cp.bdaddr, &conn->dst);
		cp.role = role;
		hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
	}

	return 0;
}
EXPORT_SYMBOL(hci_conn_switch_role);

/* Enter active mode */
void hci_conn_enter_active_mode(struct hci_conn *conn)
{
	struct hci_dev *hdev = conn->hdev;

	BT_DBG("conn %p mode %d", conn, conn->mode);

	if (test_bit(HCI_RAW, &hdev->flags))
		return;

	if (conn->mode != HCI_CM_SNIFF || !conn->power_save)
		goto timer;

	if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
		struct hci_cp_exit_sniff_mode cp;
		cp.handle = cpu_to_le16(conn->handle);
		hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
	}

timer:
	if (hdev->idle_timeout > 0)
		mod_timer(&conn->idle_timer,
			jiffies + msecs_to_jiffies(hdev->idle_timeout));
}

/* Enter sniff mode */
void hci_conn_enter_sniff_mode(struct hci_conn *conn)
{
	struct hci_dev *hdev = conn->hdev;

	BT_DBG("conn %p mode %d", conn, conn->mode);

	if (test_bit(HCI_RAW, &hdev->flags))
		return;

	if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn))
		return;

	if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF))
		return;

	if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
		struct hci_cp_sniff_subrate cp;
		cp.handle             = cpu_to_le16(conn->handle);
		cp.max_latency        = cpu_to_le16(0);
		cp.min_remote_timeout = cpu_to_le16(0);
		cp.min_local_timeout  = cpu_to_le16(0);
		hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
	}

	if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
		struct hci_cp_sniff_mode cp;
		cp.handle       = cpu_to_le16(conn->handle);
		cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
		cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
		cp.attempt      = cpu_to_le16(4);
		cp.timeout      = cpu_to_le16(1);
		hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
	}
}

/* Drop all connection on the device */
void hci_conn_hash_flush(struct hci_dev *hdev)
{
	struct hci_conn_hash *h = &hdev->conn_hash;
	struct list_head *p;

	BT_DBG("hdev %s", hdev->name);

	p = h->list.next;
	while (p != &h->list) {
		struct hci_conn *c;

		c = list_entry(p, struct hci_conn, list);
		p = p->next;

		c->state = BT_CLOSED;

		hci_proto_disconn_cfm(c, 0x16);
		hci_conn_del(c);
	}
}

/* Check pending connect attempts */
void hci_conn_check_pending(struct hci_dev *hdev)
{
	struct hci_conn *conn;

	BT_DBG("hdev %s", hdev->name);

	hci_dev_lock(hdev);

	conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
	if (conn)
		hci_acl_connect(conn);

	hci_dev_unlock(hdev);
}

void hci_conn_hold_device(struct hci_conn *conn)
{
	atomic_inc(&conn->devref);
}
EXPORT_SYMBOL(hci_conn_hold_device);

void hci_conn_put_device(struct hci_conn *conn)
{
	if (atomic_dec_and_test(&conn->devref))
		hci_conn_del_sysfs(conn);
}
EXPORT_SYMBOL(hci_conn_put_device);

int hci_get_conn_list(void __user *arg)
{
	struct hci_conn_list_req req, *cl;
	struct hci_conn_info *ci;
	struct hci_dev *hdev;
	struct list_head *p;
	int n = 0, size, err;

	if (copy_from_user(&req, arg, sizeof(req)))
		return -EFAULT;

	if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
		return -EINVAL;

	size = sizeof(req) + req.conn_num * sizeof(*ci);

	if (!(cl = kmalloc(size, GFP_KERNEL)))
		return -ENOMEM;

	if (!(hdev = hci_dev_get(req.dev_id))) {
		kfree(cl);
		return -ENODEV;
	}

	ci = cl->conn_info;

	hci_dev_lock_bh(hdev);
	list_for_each(p, &hdev->conn_hash.list) {
		register struct hci_conn *c;
		c = list_entry(p, struct hci_conn, list);

		bacpy(&(ci + n)->bdaddr, &c->dst);
		(ci + n)->handle = c->handle;
		(ci + n)->type  = c->type;
		(ci + n)->out   = c->out;
		(ci + n)->state = c->state;
		(ci + n)->link_mode = c->link_mode;
		if (++n >= req.conn_num)
			break;
	}
	hci_dev_unlock_bh(hdev);

	cl->dev_id = hdev->id;
	cl->conn_num = n;
	size = sizeof(req) + n * sizeof(*ci);

	hci_dev_put(hdev);

	err = copy_to_user(arg, cl, size);
	kfree(cl);

	return err ? -EFAULT : 0;
}

int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
{
	struct hci_conn_info_req req;
	struct hci_conn_info ci;
	struct hci_conn *conn;
	char __user *ptr = arg + sizeof(req);

	if (copy_from_user(&req, arg, sizeof(req)))
		return -EFAULT;

	hci_dev_lock_bh(hdev);
	conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
	if (conn) {
		bacpy(&ci.bdaddr, &conn->dst);
		ci.handle = conn->handle;
		ci.type  = conn->type;
		ci.out   = conn->out;
		ci.state = conn->state;
		ci.link_mode = conn->link_mode;
	}
	hci_dev_unlock_bh(hdev);

	if (!conn)
		return -ENOENT;

	return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
}

int hci_get_auth_info(struct hci_dev *hdev, void __user *arg)
{
	struct hci_auth_info_req req;
	struct hci_conn *conn;

	if (copy_from_user(&req, arg, sizeof(req)))
		return -EFAULT;

	hci_dev_lock_bh(hdev);
	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr);
	if (conn)
		req.type = conn->auth_type;
	hci_dev_unlock_bh(hdev);

	if (!conn)
		return -ENOENT;

	return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0;
}
Commit	Line	Data
8e87d142	1	/*
1da177e4	2	BlueZ - Bluetooth protocol stack for Linux
2d0a0346	3	Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
1da177e4 LT	4
	5	Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
	6
	7	This program is free software; you can redistribute it and/or modify
	8	it under the terms of the GNU General Public License version 2 as
	9	published by the Free Software Foundation;
	10
	11	THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
	12	OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
	13	FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
	14	IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142 YH	15	CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
	16	WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
	17	ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4 LT	18	OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
1da177e4 LT	19
8e87d142 YH	20	ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
8e87d142 YH	21	COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4 LT	22	SOFTWARE IS DISCLAIMED.
	23	*/
	24
	25	/* Bluetooth HCI connection handling. */
	26
1da177e4 LT	27	#include <linux/module.h>
	28
	29	#include <linux/types.h>
	30	#include <linux/errno.h>
	31	#include <linux/kernel.h>
1da177e4 LT	32	#include <linux/slab.h>
	33	#include <linux/poll.h>
	34	#include <linux/fcntl.h>
	35	#include <linux/init.h>
	36	#include <linux/skbuff.h>
	37	#include <linux/interrupt.h>
	38	#include <linux/notifier.h>
	39	#include <net/sock.h>
	40
	41	#include <asm/system.h>
	42	#include <asm/uaccess.h>
	43	#include <asm/unaligned.h>
	44
	45	#include <net/bluetooth/bluetooth.h>
	46	#include <net/bluetooth/hci_core.h>
	47
4c67bc74	48	void hci_acl_connect(struct hci_conn *conn)
1da177e4 LT	49	{
	50	struct hci_dev *hdev = conn->hdev;
	51	struct inquiry_entry *ie;
	52	struct hci_cp_create_conn cp;
	53
	54	BT_DBG("%p", conn);
	55
	56	conn->state = BT_CONNECT;
a8746417 MH	57	conn->out = 1;
a8746417 MH	58
1da177e4 LT	59	conn->link_mode = HCI_LM_MASTER;
1da177e4 LT	60
4c67bc74 MH	61	conn->attempt++;
4c67bc74 MH	62
e4e8e37c MH	63	conn->link_policy = hdev->link_policy;
e4e8e37c MH	64
1da177e4 LT	65	memset(&cp, 0, sizeof(cp));
	66	bacpy(&cp.bdaddr, &conn->dst);
	67	cp.pscan_rep_mode = 0x02;
	68
41a96212 MH	69	if ((ie = hci_inquiry_cache_lookup(hdev, &conn->dst))) {
	70	if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
	71	cp.pscan_rep_mode = ie->data.pscan_rep_mode;
	72	cp.pscan_mode = ie->data.pscan_mode;
	73	cp.clock_offset = ie->data.clock_offset \|
	74	cpu_to_le16(0x8000);
	75	}
	76
1da177e4	77	memcpy(conn->dev_class, ie->data.dev_class, 3);
41a96212	78	conn->ssp_mode = ie->data.ssp_mode;
1da177e4 LT	79	}
1da177e4 LT	80
a8746417	81	cp.pkt_type = cpu_to_le16(conn->pkt_type);
1da177e4	82	if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
b6a0dc82	83	cp.role_switch = 0x01;
1da177e4	84	else
b6a0dc82	85	cp.role_switch = 0x00;
4c67bc74	86
a9de9248	87	hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
1da177e4 LT	88	}
1da177e4 LT	89
6ac59344 MH	90	static void hci_acl_connect_cancel(struct hci_conn *conn)
	91	{
	92	struct hci_cp_create_conn_cancel cp;
	93
	94	BT_DBG("%p", conn);
	95
	96	if (conn->hdev->hci_ver < 2)
	97	return;
	98
	99	bacpy(&cp.bdaddr, &conn->dst);
a9de9248	100	hci_send_cmd(conn->hdev, HCI_OP_CREATE_CONN_CANCEL, sizeof(cp), &cp);
6ac59344 MH	101	}
6ac59344 MH	102
1da177e4 LT	103	void hci_acl_disconn(struct hci_conn *conn, __u8 reason)
	104	{
	105	struct hci_cp_disconnect cp;
	106
	107	BT_DBG("%p", conn);
	108
	109	conn->state = BT_DISCONN;
	110
aca3192c	111	cp.handle = cpu_to_le16(conn->handle);
1da177e4	112	cp.reason = reason;
a9de9248	113	hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp);
1da177e4 LT	114	}
	115
	116	void hci_add_sco(struct hci_conn *conn, __u16 handle)
	117	{
	118	struct hci_dev *hdev = conn->hdev;
	119	struct hci_cp_add_sco cp;
	120
	121	BT_DBG("%p", conn);
	122
	123	conn->state = BT_CONNECT;
	124	conn->out = 1;
	125
efc7688b MH	126	conn->attempt++;
efc7688b MH	127
aca3192c	128	cp.handle = cpu_to_le16(handle);
a8746417	129	cp.pkt_type = cpu_to_le16(conn->pkt_type);
1da177e4	130
a9de9248	131	hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
1da177e4 LT	132	}
1da177e4 LT	133
b6a0dc82 MH	134	void hci_setup_sync(struct hci_conn *conn, __u16 handle)
	135	{
	136	struct hci_dev *hdev = conn->hdev;
	137	struct hci_cp_setup_sync_conn cp;
	138
	139	BT_DBG("%p", conn);
	140
	141	conn->state = BT_CONNECT;
	142	conn->out = 1;
	143
efc7688b MH	144	conn->attempt++;
efc7688b MH	145
b6a0dc82	146	cp.handle = cpu_to_le16(handle);
a8746417	147	cp.pkt_type = cpu_to_le16(conn->pkt_type);
b6a0dc82 MH	148
	149	cp.tx_bandwidth = cpu_to_le32(0x00001f40);
	150	cp.rx_bandwidth = cpu_to_le32(0x00001f40);
	151	cp.max_latency = cpu_to_le16(0xffff);
	152	cp.voice_setting = cpu_to_le16(hdev->voice_setting);
	153	cp.retrans_effort = 0xff;
	154
	155	hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp);
	156	}
	157
e73439d8 MH	158	/* Device _must_ be locked */
	159	void hci_sco_setup(struct hci_conn *conn, __u8 status)
	160	{
	161	struct hci_conn *sco = conn->link;
	162
	163	BT_DBG("%p", conn);
	164
	165	if (!sco)
	166	return;
	167
	168	if (!status) {
	169	if (lmp_esco_capable(conn->hdev))
	170	hci_setup_sync(sco, conn->handle);
	171	else
	172	hci_add_sco(sco, conn->handle);
	173	} else {
	174	hci_proto_connect_cfm(sco, status);
	175	hci_conn_del(sco);
	176	}
	177	}
	178
1da177e4 LT	179	static void hci_conn_timeout(unsigned long arg)
1da177e4 LT	180	{
04837f64 MH	181	struct hci_conn conn = (void ) arg;
04837f64 MH	182	struct hci_dev *hdev = conn->hdev;
2950f21a	183	__u8 reason;
1da177e4 LT	184
	185	BT_DBG("conn %p state %d", conn, conn->state);
	186
	187	if (atomic_read(&conn->refcnt))
	188	return;
	189
	190	hci_dev_lock(hdev);
6ac59344 MH	191
	192	switch (conn->state) {
	193	case BT_CONNECT:
769be974	194	case BT_CONNECT2:
1b0336bb	195	if (conn->type == ACL_LINK && conn->out)
b6a0dc82	196	hci_acl_connect_cancel(conn);
6ac59344	197	break;
769be974	198	case BT_CONFIG:
8e87d142	199	case BT_CONNECTED:
2950f21a MH	200	reason = hci_proto_disconn_ind(conn);
2950f21a MH	201	hci_acl_disconn(conn, reason);
6ac59344 MH	202	break;
6ac59344 MH	203	default:
1da177e4	204	conn->state = BT_CLOSED;
6ac59344 MH	205	break;
	206	}
	207
1da177e4	208	hci_dev_unlock(hdev);
1da177e4 LT	209	}
1da177e4 LT	210
04837f64	211	static void hci_conn_idle(unsigned long arg)
1da177e4	212	{
04837f64 MH	213	struct hci_conn conn = (void ) arg;
	214
	215	BT_DBG("conn %p mode %d", conn, conn->mode);
	216
	217	hci_conn_enter_sniff_mode(conn);
1da177e4 LT	218	}
	219
	220	struct hci_conn hci_conn_add(struct hci_dev hdev, int type, bdaddr_t *dst)
	221	{
	222	struct hci_conn *conn;
	223
	224	BT_DBG("%s dst %s", hdev->name, batostr(dst));
	225
04837f64 MH	226	conn = kzalloc(sizeof(struct hci_conn), GFP_ATOMIC);
04837f64 MH	227	if (!conn)
1da177e4	228	return NULL;
1da177e4 LT	229
1da177e4 LT	230	bacpy(&conn->dst, dst);
a8746417 MH	231	conn->hdev = hdev;
	232	conn->type = type;
	233	conn->mode = HCI_CM_ACTIVE;
	234	conn->state = BT_OPEN;
93f19c9f	235	conn->auth_type = HCI_AT_GENERAL_BONDING;
1da177e4	236
04837f64	237	conn->power_save = 1;
052b30b0	238	conn->disc_timeout = HCI_DISCONN_TIMEOUT;
04837f64	239
a8746417 MH	240	switch (type) {
	241	case ACL_LINK:
	242	conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
	243	break;
	244	case SCO_LINK:
	245	if (lmp_esco_capable(hdev))
efc7688b MH	246	conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) \|
efc7688b MH	247	(hdev->esco_type & EDR_ESCO_MASK);
a8746417 MH	248	else
	249	conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
	250	break;
	251	case ESCO_LINK:
efc7688b	252	conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
a8746417 MH	253	break;
	254	}
	255
1da177e4	256	skb_queue_head_init(&conn->data_q);
04837f64	257
b24b8a24 PE	258	setup_timer(&conn->disc_timer, hci_conn_timeout, (unsigned long)conn);
b24b8a24 PE	259	setup_timer(&conn->idle_timer, hci_conn_idle, (unsigned long)conn);
1da177e4 LT	260
	261	atomic_set(&conn->refcnt, 0);
	262
	263	hci_dev_hold(hdev);
	264
	265	tasklet_disable(&hdev->tx_task);
	266
	267	hci_conn_hash_add(hdev, conn);
	268	if (hdev->notify)
	269	hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
	270
9eba32b8 MH	271	atomic_set(&conn->devref, 0);
9eba32b8 MH	272
a67e899c MH	273	hci_conn_init_sysfs(conn);
a67e899c MH	274
1da177e4 LT	275	tasklet_enable(&hdev->tx_task);
	276
	277	return conn;
	278	}
	279
	280	int hci_conn_del(struct hci_conn *conn)
	281	{
	282	struct hci_dev *hdev = conn->hdev;
	283
	284	BT_DBG("%s conn %p handle %d", hdev->name, conn, conn->handle);
	285
04837f64 MH	286	del_timer(&conn->idle_timer);
	287
	288	del_timer(&conn->disc_timer);
1da177e4	289
5b7f9909	290	if (conn->type == ACL_LINK) {
1da177e4 LT	291	struct hci_conn *sco = conn->link;
	292	if (sco)
	293	sco->link = NULL;
	294
	295	/* Unacked frames */
	296	hdev->acl_cnt += conn->sent;
5b7f9909 MH	297	} else {
	298	struct hci_conn *acl = conn->link;
	299	if (acl) {
	300	acl->link = NULL;
	301	hci_conn_put(acl);
	302	}
1da177e4 LT	303	}
	304
	305	tasklet_disable(&hdev->tx_task);
7d0db0a3	306
1da177e4 LT	307	hci_conn_hash_del(hdev, conn);
	308	if (hdev->notify)
	309	hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
7d0db0a3	310
1da177e4	311	tasklet_enable(&hdev->tx_task);
7d0db0a3	312
1da177e4	313	skb_queue_purge(&conn->data_q);
1da177e4	314
9eba32b8	315	hci_conn_put_device(conn);
2ae9a6be	316
384943ec MH	317	hci_dev_put(hdev);
384943ec MH	318
1da177e4 LT	319	return 0;
	320	}
	321
	322	struct hci_dev hci_get_route(bdaddr_t dst, bdaddr_t *src)
	323	{
	324	int use_src = bacmp(src, BDADDR_ANY);
	325	struct hci_dev *hdev = NULL;
	326	struct list_head *p;
	327
	328	BT_DBG("%s -> %s", batostr(src), batostr(dst));
	329
	330	read_lock_bh(&hci_dev_list_lock);
	331
	332	list_for_each(p, &hci_dev_list) {
	333	struct hci_dev *d = list_entry(p, struct hci_dev, list);
	334
	335	if (!test_bit(HCI_UP, &d->flags) \|\| test_bit(HCI_RAW, &d->flags))
	336	continue;
	337
8e87d142	338	/* Simple routing:
1da177e4 LT	339	* No source address - find interface with bdaddr != dst
	340	* Source address - find interface with bdaddr == src
	341	*/
	342
	343	if (use_src) {
	344	if (!bacmp(&d->bdaddr, src)) {
	345	hdev = d; break;
	346	}
	347	} else {
	348	if (bacmp(&d->bdaddr, dst)) {
	349	hdev = d; break;
	350	}
	351	}
	352	}
	353
	354	if (hdev)
	355	hdev = hci_dev_hold(hdev);
	356
	357	read_unlock_bh(&hci_dev_list_lock);
	358	return hdev;
	359	}
	360	EXPORT_SYMBOL(hci_get_route);
	361
	362	/* Create SCO or ACL connection.
	363	* Device _must_ be locked */
8c1b2355	364	struct hci_conn hci_connect(struct hci_dev hdev, int type, bdaddr_t *dst, __u8 sec_level, __u8 auth_type)
1da177e4 LT	365	{
1da177e4 LT	366	struct hci_conn *acl;
5b7f9909	367	struct hci_conn *sco;
1da177e4 LT	368
	369	BT_DBG("%s dst %s", hdev->name, batostr(dst));
	370
	371	if (!(acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst))) {
	372	if (!(acl = hci_conn_add(hdev, ACL_LINK, dst)))
	373	return NULL;
	374	}
	375
	376	hci_conn_hold(acl);
	377
09ab6f4c	378	if (acl->state == BT_OPEN \|\| acl->state == BT_CLOSED) {
8c1b2355	379	acl->sec_level = sec_level;
09ab6f4c	380	acl->auth_type = auth_type;
1da177e4	381	hci_acl_connect(acl);
04530982 VT	382	} else {
	383	if (acl->sec_level < sec_level)
	384	acl->sec_level = sec_level;
	385	if (acl->auth_type < auth_type)
	386	acl->auth_type = auth_type;
09ab6f4c	387	}
1da177e4	388
5b7f9909 MH	389	if (type == ACL_LINK)
5b7f9909 MH	390	return acl;
1da177e4	391
5b7f9909 MH	392	if (!(sco = hci_conn_hash_lookup_ba(hdev, type, dst))) {
	393	if (!(sco = hci_conn_add(hdev, type, dst))) {
	394	hci_conn_put(acl);
	395	return NULL;
1da177e4	396	}
5b7f9909	397	}
1da177e4	398
5b7f9909 MH	399	acl->link = sco;
5b7f9909 MH	400	sco->link = acl;
1da177e4	401
5b7f9909	402	hci_conn_hold(sco);
1da177e4	403
5b7f9909	404	if (acl->state == BT_CONNECTED &&
b6a0dc82	405	(sco->state == BT_OPEN \|\| sco->state == BT_CLOSED)) {
c390216b NP	406	acl->power_save = 1;
	407	hci_conn_enter_active_mode(acl);
	408
e73439d8 MH	409	if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->pend)) {
	410	/* defer SCO setup until mode change completed */
	411	set_bit(HCI_CONN_SCO_SETUP_PEND, &acl->pend);
	412	return sco;
	413	}
	414
	415	hci_sco_setup(acl, 0x00);
b6a0dc82	416	}
5b7f9909 MH	417
5b7f9909 MH	418	return sco;
1da177e4 LT	419	}
	420	EXPORT_SYMBOL(hci_connect);
	421
e7c29cb1 MH	422	/* Check link security requirement */
	423	int hci_conn_check_link_mode(struct hci_conn *conn)
	424	{
	425	BT_DBG("conn %p", conn);
	426
	427	if (conn->ssp_mode > 0 && conn->hdev->ssp_mode > 0 &&
	428	!(conn->link_mode & HCI_LM_ENCRYPT))
	429	return 0;
	430
	431	return 1;
	432	}
	433	EXPORT_SYMBOL(hci_conn_check_link_mode);
	434
1da177e4	435	/* Authenticate remote device */
0684e5f9	436	static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
1da177e4 LT	437	{
	438	BT_DBG("conn %p", conn);
	439
96a31833	440	if (sec_level > conn->sec_level)
0684e5f9	441	conn->sec_level = sec_level;
96a31833	442	else if (conn->link_mode & HCI_LM_AUTH)
1da177e4 LT	443	return 1;
1da177e4 LT	444
96a31833 MH	445	conn->auth_type = auth_type;
96a31833 MH	446
1da177e4 LT	447	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
1da177e4 LT	448	struct hci_cp_auth_requested cp;
aca3192c	449	cp.handle = cpu_to_le16(conn->handle);
40be492f MH	450	hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
40be492f MH	451	sizeof(cp), &cp);
1da177e4	452	}
8c1b2355	453
1da177e4 LT	454	return 0;
1da177e4 LT	455	}
1da177e4	456
8c1b2355	457	/* Enable security */
0684e5f9	458	int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
1da177e4 LT	459	{
	460	BT_DBG("conn %p", conn);
	461
8c1b2355 MH	462	if (sec_level == BT_SECURITY_SDP)
	463	return 1;
	464
3fdca1e1 MH	465	if (sec_level == BT_SECURITY_LOW &&
	466	(!conn->ssp_mode \|\| !conn->hdev->ssp_mode))
	467	return 1;
8c1b2355	468
1da177e4	469	if (conn->link_mode & HCI_LM_ENCRYPT)
0684e5f9	470	return hci_conn_auth(conn, sec_level, auth_type);
1da177e4 LT	471
	472	if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend))
	473	return 0;
	474
0684e5f9	475	if (hci_conn_auth(conn, sec_level, auth_type)) {
1da177e4	476	struct hci_cp_set_conn_encrypt cp;
aca3192c	477	cp.handle = cpu_to_le16(conn->handle);
8e87d142	478	cp.encrypt = 1;
40be492f MH	479	hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT,
40be492f MH	480	sizeof(cp), &cp);
1da177e4	481	}
8c1b2355	482
1da177e4 LT	483	return 0;
1da177e4 LT	484	}
8c1b2355	485	EXPORT_SYMBOL(hci_conn_security);
1da177e4 LT	486
	487	/* Change link key */
	488	int hci_conn_change_link_key(struct hci_conn *conn)
	489	{
	490	BT_DBG("conn %p", conn);
	491
	492	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
	493	struct hci_cp_change_conn_link_key cp;
aca3192c	494	cp.handle = cpu_to_le16(conn->handle);
40be492f MH	495	hci_send_cmd(conn->hdev, HCI_OP_CHANGE_CONN_LINK_KEY,
40be492f MH	496	sizeof(cp), &cp);
1da177e4	497	}
8c1b2355	498
1da177e4 LT	499	return 0;
	500	}
	501	EXPORT_SYMBOL(hci_conn_change_link_key);
	502
	503	/* Switch role */
8c1b2355	504	int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
1da177e4 LT	505	{
	506	BT_DBG("conn %p", conn);
	507
	508	if (!role && conn->link_mode & HCI_LM_MASTER)
	509	return 1;
	510
	511	if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->pend)) {
	512	struct hci_cp_switch_role cp;
	513	bacpy(&cp.bdaddr, &conn->dst);
	514	cp.role = role;
a9de9248	515	hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
1da177e4	516	}
8c1b2355	517
1da177e4 LT	518	return 0;
	519	}
	520	EXPORT_SYMBOL(hci_conn_switch_role);
	521
04837f64 MH	522	/* Enter active mode */
	523	void hci_conn_enter_active_mode(struct hci_conn *conn)
	524	{
	525	struct hci_dev *hdev = conn->hdev;
	526
	527	BT_DBG("conn %p mode %d", conn, conn->mode);
	528
	529	if (test_bit(HCI_RAW, &hdev->flags))
	530	return;
	531
	532	if (conn->mode != HCI_CM_SNIFF \|\| !conn->power_save)
	533	goto timer;
	534
	535	if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
	536	struct hci_cp_exit_sniff_mode cp;
aca3192c	537	cp.handle = cpu_to_le16(conn->handle);
a9de9248	538	hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
04837f64 MH	539	}
	540
	541	timer:
	542	if (hdev->idle_timeout > 0)
	543	mod_timer(&conn->idle_timer,
	544	jiffies + msecs_to_jiffies(hdev->idle_timeout));
	545	}
	546
	547	/* Enter sniff mode */
	548	void hci_conn_enter_sniff_mode(struct hci_conn *conn)
	549	{
	550	struct hci_dev *hdev = conn->hdev;
	551
	552	BT_DBG("conn %p mode %d", conn, conn->mode);
	553
	554	if (test_bit(HCI_RAW, &hdev->flags))
	555	return;
	556
	557	if (!lmp_sniff_capable(hdev) \|\| !lmp_sniff_capable(conn))
	558	return;
	559
	560	if (conn->mode != HCI_CM_ACTIVE \|\| !(conn->link_policy & HCI_LP_SNIFF))
	561	return;
	562
	563	if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
	564	struct hci_cp_sniff_subrate cp;
aca3192c YH	565	cp.handle = cpu_to_le16(conn->handle);
	566	cp.max_latency = cpu_to_le16(0);
	567	cp.min_remote_timeout = cpu_to_le16(0);
	568	cp.min_local_timeout = cpu_to_le16(0);
a9de9248	569	hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
04837f64 MH	570	}
	571
	572	if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
	573	struct hci_cp_sniff_mode cp;
aca3192c YH	574	cp.handle = cpu_to_le16(conn->handle);
	575	cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
	576	cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
	577	cp.attempt = cpu_to_le16(4);
	578	cp.timeout = cpu_to_le16(1);
a9de9248	579	hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
04837f64 MH	580	}
	581	}
	582
1da177e4 LT	583	/* Drop all connection on the device */
	584	void hci_conn_hash_flush(struct hci_dev *hdev)
	585	{
	586	struct hci_conn_hash *h = &hdev->conn_hash;
	587	struct list_head *p;
	588
	589	BT_DBG("hdev %s", hdev->name);
	590
	591	p = h->list.next;
	592	while (p != &h->list) {
	593	struct hci_conn *c;
	594
	595	c = list_entry(p, struct hci_conn, list);
	596	p = p->next;
	597
	598	c->state = BT_CLOSED;
	599
2950f21a	600	hci_proto_disconn_cfm(c, 0x16);
1da177e4 LT	601	hci_conn_del(c);
	602	}
	603	}
	604
a9de9248 MH	605	/* Check pending connect attempts */
	606	void hci_conn_check_pending(struct hci_dev *hdev)
	607	{
	608	struct hci_conn *conn;
	609
	610	BT_DBG("hdev %s", hdev->name);
	611
	612	hci_dev_lock(hdev);
	613
	614	conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
	615	if (conn)
	616	hci_acl_connect(conn);
	617
	618	hci_dev_unlock(hdev);
	619	}
	620
9eba32b8 MH	621	void hci_conn_hold_device(struct hci_conn *conn)
	622	{
	623	atomic_inc(&conn->devref);
	624	}
	625	EXPORT_SYMBOL(hci_conn_hold_device);
	626
	627	void hci_conn_put_device(struct hci_conn *conn)
	628	{
	629	if (atomic_dec_and_test(&conn->devref))
	630	hci_conn_del_sysfs(conn);
	631	}
	632	EXPORT_SYMBOL(hci_conn_put_device);
	633
1da177e4 LT	634	int hci_get_conn_list(void __user *arg)
	635	{
	636	struct hci_conn_list_req req, *cl;
	637	struct hci_conn_info *ci;
	638	struct hci_dev *hdev;
	639	struct list_head *p;
	640	int n = 0, size, err;
	641
	642	if (copy_from_user(&req, arg, sizeof(req)))
	643	return -EFAULT;
	644
	645	if (!req.conn_num \|\| req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
	646	return -EINVAL;
	647
	648	size = sizeof(req) + req.conn_num * sizeof(*ci);
	649
12fe2c58	650	if (!(cl = kmalloc(size, GFP_KERNEL)))
1da177e4 LT	651	return -ENOMEM;
	652
	653	if (!(hdev = hci_dev_get(req.dev_id))) {
	654	kfree(cl);
	655	return -ENODEV;
	656	}
	657
	658	ci = cl->conn_info;
	659
	660	hci_dev_lock_bh(hdev);
	661	list_for_each(p, &hdev->conn_hash.list) {
	662	register struct hci_conn *c;
	663	c = list_entry(p, struct hci_conn, list);
	664
	665	bacpy(&(ci + n)->bdaddr, &c->dst);
	666	(ci + n)->handle = c->handle;
	667	(ci + n)->type = c->type;
	668	(ci + n)->out = c->out;
	669	(ci + n)->state = c->state;
	670	(ci + n)->link_mode = c->link_mode;
	671	if (++n >= req.conn_num)
	672	break;
	673	}
	674	hci_dev_unlock_bh(hdev);
	675
	676	cl->dev_id = hdev->id;
	677	cl->conn_num = n;
	678	size = sizeof(req) + n * sizeof(*ci);
	679
	680	hci_dev_put(hdev);
	681
	682	err = copy_to_user(arg, cl, size);
	683	kfree(cl);
	684
	685	return err ? -EFAULT : 0;
	686	}
	687
	688	int hci_get_conn_info(struct hci_dev hdev, void __user arg)
	689	{
	690	struct hci_conn_info_req req;
	691	struct hci_conn_info ci;
	692	struct hci_conn *conn;
	693	char __user *ptr = arg + sizeof(req);
	694
	695	if (copy_from_user(&req, arg, sizeof(req)))
	696	return -EFAULT;
	697
	698	hci_dev_lock_bh(hdev);
	699	conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
	700	if (conn) {
	701	bacpy(&ci.bdaddr, &conn->dst);
	702	ci.handle = conn->handle;
	703	ci.type = conn->type;
	704	ci.out = conn->out;
	705	ci.state = conn->state;
	706	ci.link_mode = conn->link_mode;
	707	}
	708	hci_dev_unlock_bh(hdev);
	709
	710	if (!conn)
	711	return -ENOENT;
	712
	713	return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
	714	}
40be492f MH	715
	716	int hci_get_auth_info(struct hci_dev hdev, void __user arg)
	717	{
	718	struct hci_auth_info_req req;
	719	struct hci_conn *conn;
	720
	721	if (copy_from_user(&req, arg, sizeof(req)))
	722	return -EFAULT;
	723
	724	hci_dev_lock_bh(hdev);
	725	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr);
	726	if (conn)
	727	req.type = conn->auth_type;
	728	hci_dev_unlock_bh(hdev);
	729
	730	if (!conn)
	731	return -ENOENT;
	732
	733	return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0;
	734	}