[net-next-2.6.git] / net / bluetooth / hci_conn.c

/*
   BlueZ - Bluetooth protocol stack for Linux
   Copyright (C) 2000-2001 Qualcomm Incorporated

   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>

   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License version 2 as
   published by the Free Software Foundation;

   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
   SOFTWARE IS DISCLAIMED.
*/

/* Bluetooth HCI connection handling. */

#include <linux/module.h>

#include <linux/types.h>
#include <linux/errno.h>
#include <linux/kernel.h>
#include <linux/slab.h>
#include <linux/poll.h>
#include <linux/fcntl.h>
#include <linux/init.h>
#include <linux/skbuff.h>
#include <linux/interrupt.h>
#include <linux/notifier.h>
#include <net/sock.h>

#include <asm/system.h>
#include <asm/uaccess.h>
#include <asm/unaligned.h>

#include <net/bluetooth/bluetooth.h>
#include <net/bluetooth/hci_core.h>

void hci_acl_connect(struct hci_conn *conn)
{
	struct hci_dev *hdev = conn->hdev;
	struct inquiry_entry *ie;
	struct hci_cp_create_conn cp;

	BT_DBG("%p", conn);

	conn->state = BT_CONNECT;
	conn->out = 1;

	conn->link_mode = HCI_LM_MASTER;

	conn->attempt++;

	conn->link_policy = hdev->link_policy;

	memset(&cp, 0, sizeof(cp));
	bacpy(&cp.bdaddr, &conn->dst);
	cp.pscan_rep_mode = 0x02;

	if ((ie = hci_inquiry_cache_lookup(hdev, &conn->dst))) {
		if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
			cp.pscan_rep_mode = ie->data.pscan_rep_mode;
			cp.pscan_mode     = ie->data.pscan_mode;
			cp.clock_offset   = ie->data.clock_offset |
							cpu_to_le16(0x8000);
		}

		memcpy(conn->dev_class, ie->data.dev_class, 3);
		conn->ssp_mode = ie->data.ssp_mode;
	}

	cp.pkt_type = cpu_to_le16(conn->pkt_type);
	if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
		cp.role_switch = 0x01;
	else
		cp.role_switch = 0x00;

	hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
}

static void hci_acl_connect_cancel(struct hci_conn *conn)
{
	struct hci_cp_create_conn_cancel cp;

	BT_DBG("%p", conn);

	if (conn->hdev->hci_ver < 2)
		return;

	bacpy(&cp.bdaddr, &conn->dst);
	hci_send_cmd(conn->hdev, HCI_OP_CREATE_CONN_CANCEL, sizeof(cp), &cp);
}

void hci_acl_disconn(struct hci_conn *conn, __u8 reason)
{
	struct hci_cp_disconnect cp;

	BT_DBG("%p", conn);

	conn->state = BT_DISCONN;

	cp.handle = cpu_to_le16(conn->handle);
	cp.reason = reason;
	hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp);
}

void hci_add_sco(struct hci_conn *conn, __u16 handle)
{
	struct hci_dev *hdev = conn->hdev;
	struct hci_cp_add_sco cp;

	BT_DBG("%p", conn);

	conn->state = BT_CONNECT;
	conn->out = 1;

	conn->attempt++;

	cp.handle   = cpu_to_le16(handle);
	cp.pkt_type = cpu_to_le16(conn->pkt_type);

	hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
}

void hci_setup_sync(struct hci_conn *conn, __u16 handle)
{
	struct hci_dev *hdev = conn->hdev;
	struct hci_cp_setup_sync_conn cp;

	BT_DBG("%p", conn);

	conn->state = BT_CONNECT;
	conn->out = 1;

	conn->attempt++;

	cp.handle   = cpu_to_le16(handle);
	cp.pkt_type = cpu_to_le16(conn->pkt_type);

	cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
	cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
	cp.max_latency    = cpu_to_le16(0xffff);
	cp.voice_setting  = cpu_to_le16(hdev->voice_setting);
	cp.retrans_effort = 0xff;

	hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp);
}

static void hci_conn_timeout(unsigned long arg)
{
	struct hci_conn *conn = (void *) arg;
	struct hci_dev *hdev = conn->hdev;
	__u8 reason;

	BT_DBG("conn %p state %d", conn, conn->state);

	if (atomic_read(&conn->refcnt))
		return;

	hci_dev_lock(hdev);

	switch (conn->state) {
	case BT_CONNECT:
	case BT_CONNECT2:
		if (conn->type == ACL_LINK && conn->out)
			hci_acl_connect_cancel(conn);
		break;
	case BT_CONFIG:
	case BT_CONNECTED:
		reason = hci_proto_disconn_ind(conn);
		hci_acl_disconn(conn, reason);
		break;
	default:
		conn->state = BT_CLOSED;
		break;
	}

	hci_dev_unlock(hdev);
}

static void hci_conn_idle(unsigned long arg)
{
	struct hci_conn *conn = (void *) arg;

	BT_DBG("conn %p mode %d", conn, conn->mode);

	hci_conn_enter_sniff_mode(conn);
}

struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
{
	struct hci_conn *conn;

	BT_DBG("%s dst %s", hdev->name, batostr(dst));

	conn = kzalloc(sizeof(struct hci_conn), GFP_ATOMIC);
	if (!conn)
		return NULL;

	bacpy(&conn->dst, dst);
	conn->hdev  = hdev;
	conn->type  = type;
	conn->mode  = HCI_CM_ACTIVE;
	conn->state = BT_OPEN;
	conn->auth_type = HCI_AT_GENERAL_BONDING;

	conn->power_save = 1;
	conn->disc_timeout = HCI_DISCONN_TIMEOUT;

	switch (type) {
	case ACL_LINK:
		conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
		break;
	case SCO_LINK:
		if (lmp_esco_capable(hdev))
			conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
					(hdev->esco_type & EDR_ESCO_MASK);
		else
			conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
		break;
	case ESCO_LINK:
		conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
		break;
	}

	skb_queue_head_init(&conn->data_q);

	setup_timer(&conn->disc_timer, hci_conn_timeout, (unsigned long)conn);
	setup_timer(&conn->idle_timer, hci_conn_idle, (unsigned long)conn);

	atomic_set(&conn->refcnt, 0);

	hci_dev_hold(hdev);

	tasklet_disable(&hdev->tx_task);

	hci_conn_hash_add(hdev, conn);
	if (hdev->notify)
		hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);

	atomic_set(&conn->devref, 0);

	hci_conn_init_sysfs(conn);

	tasklet_enable(&hdev->tx_task);

	return conn;
}

int hci_conn_del(struct hci_conn *conn)
{
	struct hci_dev *hdev = conn->hdev;

	BT_DBG("%s conn %p handle %d", hdev->name, conn, conn->handle);

	del_timer(&conn->idle_timer);

	del_timer(&conn->disc_timer);

	if (conn->type == ACL_LINK) {
		struct hci_conn *sco = conn->link;
		if (sco)
			sco->link = NULL;

		/* Unacked frames */
		hdev->acl_cnt += conn->sent;
	} else {
		struct hci_conn *acl = conn->link;
		if (acl) {
			acl->link = NULL;
			hci_conn_put(acl);
		}
	}

	tasklet_disable(&hdev->tx_task);

	hci_conn_hash_del(hdev, conn);
	if (hdev->notify)
		hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);

	tasklet_enable(&hdev->tx_task);

	skb_queue_purge(&conn->data_q);

	hci_conn_put_device(conn);

	hci_dev_put(hdev);

	return 0;
}

struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src)
{
	int use_src = bacmp(src, BDADDR_ANY);
	struct hci_dev *hdev = NULL;
	struct list_head *p;

	BT_DBG("%s -> %s", batostr(src), batostr(dst));

	read_lock_bh(&hci_dev_list_lock);

	list_for_each(p, &hci_dev_list) {
		struct hci_dev *d = list_entry(p, struct hci_dev, list);

		if (!test_bit(HCI_UP, &d->flags) || test_bit(HCI_RAW, &d->flags))
			continue;

		/* Simple routing:
		 *   No source address - find interface with bdaddr != dst
		 *   Source address    - find interface with bdaddr == src
		 */

		if (use_src) {
			if (!bacmp(&d->bdaddr, src)) {
				hdev = d; break;
			}
		} else {
			if (bacmp(&d->bdaddr, dst)) {
				hdev = d; break;
			}
		}
	}

	if (hdev)
		hdev = hci_dev_hold(hdev);

	read_unlock_bh(&hci_dev_list_lock);
	return hdev;
}
EXPORT_SYMBOL(hci_get_route);

/* Create SCO or ACL connection.
 * Device _must_ be locked */
struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, __u8 sec_level, __u8 auth_type)
{
	struct hci_conn *acl;
	struct hci_conn *sco;

	BT_DBG("%s dst %s", hdev->name, batostr(dst));

	if (!(acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst))) {
		if (!(acl = hci_conn_add(hdev, ACL_LINK, dst)))
			return NULL;
	}

	hci_conn_hold(acl);

	if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
		acl->sec_level = sec_level;
		acl->auth_type = auth_type;
		hci_acl_connect(acl);
	}

	if (type == ACL_LINK)
		return acl;

	if (!(sco = hci_conn_hash_lookup_ba(hdev, type, dst))) {
		if (!(sco = hci_conn_add(hdev, type, dst))) {
			hci_conn_put(acl);
			return NULL;
		}
	}

	acl->link = sco;
	sco->link = acl;

	hci_conn_hold(sco);

	if (acl->state == BT_CONNECTED &&
			(sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
		acl->power_save = 1;
		hci_conn_enter_active_mode(acl);

		if (lmp_esco_capable(hdev))
			hci_setup_sync(sco, acl->handle);
		else
			hci_add_sco(sco, acl->handle);
	}

	return sco;
}
EXPORT_SYMBOL(hci_connect);

/* Check link security requirement */
int hci_conn_check_link_mode(struct hci_conn *conn)
{
	BT_DBG("conn %p", conn);

	if (conn->ssp_mode > 0 && conn->hdev->ssp_mode > 0 &&
					!(conn->link_mode & HCI_LM_ENCRYPT))
		return 0;

	return 1;
}
EXPORT_SYMBOL(hci_conn_check_link_mode);

/* Authenticate remote device */
static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
{
	BT_DBG("conn %p", conn);

	if (sec_level > conn->sec_level)
		conn->sec_level = sec_level;
	else if (conn->link_mode & HCI_LM_AUTH)
		return 1;

	conn->auth_type = auth_type;

	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
		struct hci_cp_auth_requested cp;
		cp.handle = cpu_to_le16(conn->handle);
		hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
							sizeof(cp), &cp);
	}

	return 0;
}

/* Enable security */
int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
{
	BT_DBG("conn %p", conn);

	if (sec_level == BT_SECURITY_SDP)
		return 1;

	if (sec_level == BT_SECURITY_LOW &&
				(!conn->ssp_mode || !conn->hdev->ssp_mode))
		return 1;

	if (conn->link_mode & HCI_LM_ENCRYPT)
		return hci_conn_auth(conn, sec_level, auth_type);

	if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend))
		return 0;

	if (hci_conn_auth(conn, sec_level, auth_type)) {
		struct hci_cp_set_conn_encrypt cp;
		cp.handle  = cpu_to_le16(conn->handle);
		cp.encrypt = 1;
		hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT,
							sizeof(cp), &cp);
	}

	return 0;
}
EXPORT_SYMBOL(hci_conn_security);

/* Change link key */
int hci_conn_change_link_key(struct hci_conn *conn)
{
	BT_DBG("conn %p", conn);

	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
		struct hci_cp_change_conn_link_key cp;
		cp.handle = cpu_to_le16(conn->handle);
		hci_send_cmd(conn->hdev, HCI_OP_CHANGE_CONN_LINK_KEY,
							sizeof(cp), &cp);
	}

	return 0;
}
EXPORT_SYMBOL(hci_conn_change_link_key);

/* Switch role */
int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
{
	BT_DBG("conn %p", conn);

	if (!role && conn->link_mode & HCI_LM_MASTER)
		return 1;

	if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->pend)) {
		struct hci_cp_switch_role cp;
		bacpy(&cp.bdaddr, &conn->dst);
		cp.role = role;
		hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
	}

	return 0;
}
EXPORT_SYMBOL(hci_conn_switch_role);

/* Enter active mode */
void hci_conn_enter_active_mode(struct hci_conn *conn)
{
	struct hci_dev *hdev = conn->hdev;

	BT_DBG("conn %p mode %d", conn, conn->mode);

	if (test_bit(HCI_RAW, &hdev->flags))
		return;

	if (conn->mode != HCI_CM_SNIFF || !conn->power_save)
		goto timer;

	if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
		struct hci_cp_exit_sniff_mode cp;
		cp.handle = cpu_to_le16(conn->handle);
		hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
	}

timer:
	if (hdev->idle_timeout > 0)
		mod_timer(&conn->idle_timer,
			jiffies + msecs_to_jiffies(hdev->idle_timeout));
}

/* Enter sniff mode */
void hci_conn_enter_sniff_mode(struct hci_conn *conn)
{
	struct hci_dev *hdev = conn->hdev;

	BT_DBG("conn %p mode %d", conn, conn->mode);

	if (test_bit(HCI_RAW, &hdev->flags))
		return;

	if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn))
		return;

	if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF))
		return;

	if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
		struct hci_cp_sniff_subrate cp;
		cp.handle             = cpu_to_le16(conn->handle);
		cp.max_latency        = cpu_to_le16(0);
		cp.min_remote_timeout = cpu_to_le16(0);
		cp.min_local_timeout  = cpu_to_le16(0);
		hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
	}

	if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
		struct hci_cp_sniff_mode cp;
		cp.handle       = cpu_to_le16(conn->handle);
		cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
		cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
		cp.attempt      = cpu_to_le16(4);
		cp.timeout      = cpu_to_le16(1);
		hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
	}
}

/* Drop all connection on the device */
void hci_conn_hash_flush(struct hci_dev *hdev)
{
	struct hci_conn_hash *h = &hdev->conn_hash;
	struct list_head *p;

	BT_DBG("hdev %s", hdev->name);

	p = h->list.next;
	while (p != &h->list) {
		struct hci_conn *c;

		c = list_entry(p, struct hci_conn, list);
		p = p->next;

		c->state = BT_CLOSED;

		hci_proto_disconn_cfm(c, 0x16);
		hci_conn_del(c);
	}
}

/* Check pending connect attempts */
void hci_conn_check_pending(struct hci_dev *hdev)
{
	struct hci_conn *conn;

	BT_DBG("hdev %s", hdev->name);

	hci_dev_lock(hdev);

	conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
	if (conn)
		hci_acl_connect(conn);

	hci_dev_unlock(hdev);
}

void hci_conn_hold_device(struct hci_conn *conn)
{
	atomic_inc(&conn->devref);
}
EXPORT_SYMBOL(hci_conn_hold_device);

void hci_conn_put_device(struct hci_conn *conn)
{
	if (atomic_dec_and_test(&conn->devref))
		hci_conn_del_sysfs(conn);
}
EXPORT_SYMBOL(hci_conn_put_device);

int hci_get_conn_list(void __user *arg)
{
	struct hci_conn_list_req req, *cl;
	struct hci_conn_info *ci;
	struct hci_dev *hdev;
	struct list_head *p;
	int n = 0, size, err;

	if (copy_from_user(&req, arg, sizeof(req)))
		return -EFAULT;

	if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
		return -EINVAL;

	size = sizeof(req) + req.conn_num * sizeof(*ci);

	if (!(cl = kmalloc(size, GFP_KERNEL)))
		return -ENOMEM;

	if (!(hdev = hci_dev_get(req.dev_id))) {
		kfree(cl);
		return -ENODEV;
	}

	ci = cl->conn_info;

	hci_dev_lock_bh(hdev);
	list_for_each(p, &hdev->conn_hash.list) {
		register struct hci_conn *c;
		c = list_entry(p, struct hci_conn, list);

		bacpy(&(ci + n)->bdaddr, &c->dst);
		(ci + n)->handle = c->handle;
		(ci + n)->type  = c->type;
		(ci + n)->out   = c->out;
		(ci + n)->state = c->state;
		(ci + n)->link_mode = c->link_mode;
		if (++n >= req.conn_num)
			break;
	}
	hci_dev_unlock_bh(hdev);

	cl->dev_id = hdev->id;
	cl->conn_num = n;
	size = sizeof(req) + n * sizeof(*ci);

	hci_dev_put(hdev);

	err = copy_to_user(arg, cl, size);
	kfree(cl);

	return err ? -EFAULT : 0;
}

int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
{
	struct hci_conn_info_req req;
	struct hci_conn_info ci;
	struct hci_conn *conn;
	char __user *ptr = arg + sizeof(req);

	if (copy_from_user(&req, arg, sizeof(req)))
		return -EFAULT;

	hci_dev_lock_bh(hdev);
	conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
	if (conn) {
		bacpy(&ci.bdaddr, &conn->dst);
		ci.handle = conn->handle;
		ci.type  = conn->type;
		ci.out   = conn->out;
		ci.state = conn->state;
		ci.link_mode = conn->link_mode;
	}
	hci_dev_unlock_bh(hdev);

	if (!conn)
		return -ENOENT;

	return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
}

int hci_get_auth_info(struct hci_dev *hdev, void __user *arg)
{
	struct hci_auth_info_req req;
	struct hci_conn *conn;

	if (copy_from_user(&req, arg, sizeof(req)))
		return -EFAULT;

	hci_dev_lock_bh(hdev);
	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr);
	if (conn)
		req.type = conn->auth_type;
	hci_dev_unlock_bh(hdev);

	if (!conn)
		return -ENOENT;

	return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0;
}
Commit	Line	Data
8e87d142	1	/*
1da177e4 LT	2	BlueZ - Bluetooth protocol stack for Linux
	3	Copyright (C) 2000-2001 Qualcomm Incorporated
	4
	5	Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
	6
	7	This program is free software; you can redistribute it and/or modify
	8	it under the terms of the GNU General Public License version 2 as
	9	published by the Free Software Foundation;
	10
	11	THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
	12	OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
	13	FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
	14	IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142 YH	15	CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
	16	WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
	17	ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4 LT	18	OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
1da177e4 LT	19
8e87d142 YH	20	ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
8e87d142 YH	21	COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4 LT	22	SOFTWARE IS DISCLAIMED.
	23	*/
	24
	25	/* Bluetooth HCI connection handling. */
	26
1da177e4 LT	27	#include <linux/module.h>
	28
	29	#include <linux/types.h>
	30	#include <linux/errno.h>
	31	#include <linux/kernel.h>
1da177e4 LT	32	#include <linux/slab.h>
	33	#include <linux/poll.h>
	34	#include <linux/fcntl.h>
	35	#include <linux/init.h>
	36	#include <linux/skbuff.h>
	37	#include <linux/interrupt.h>
	38	#include <linux/notifier.h>
	39	#include <net/sock.h>
	40
	41	#include <asm/system.h>
	42	#include <asm/uaccess.h>
	43	#include <asm/unaligned.h>
	44
	45	#include <net/bluetooth/bluetooth.h>
	46	#include <net/bluetooth/hci_core.h>
	47
4c67bc74	48	void hci_acl_connect(struct hci_conn *conn)
1da177e4 LT	49	{
	50	struct hci_dev *hdev = conn->hdev;
	51	struct inquiry_entry *ie;
	52	struct hci_cp_create_conn cp;
	53
	54	BT_DBG("%p", conn);
	55
	56	conn->state = BT_CONNECT;
a8746417 MH	57	conn->out = 1;
a8746417 MH	58
1da177e4 LT	59	conn->link_mode = HCI_LM_MASTER;
1da177e4 LT	60
4c67bc74 MH	61	conn->attempt++;
4c67bc74 MH	62
e4e8e37c MH	63	conn->link_policy = hdev->link_policy;
e4e8e37c MH	64
1da177e4 LT	65	memset(&cp, 0, sizeof(cp));
	66	bacpy(&cp.bdaddr, &conn->dst);
	67	cp.pscan_rep_mode = 0x02;
	68
41a96212 MH	69	if ((ie = hci_inquiry_cache_lookup(hdev, &conn->dst))) {
	70	if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
	71	cp.pscan_rep_mode = ie->data.pscan_rep_mode;
	72	cp.pscan_mode = ie->data.pscan_mode;
	73	cp.clock_offset = ie->data.clock_offset \|
	74	cpu_to_le16(0x8000);
	75	}
	76
1da177e4	77	memcpy(conn->dev_class, ie->data.dev_class, 3);
41a96212	78	conn->ssp_mode = ie->data.ssp_mode;
1da177e4 LT	79	}
1da177e4 LT	80
a8746417	81	cp.pkt_type = cpu_to_le16(conn->pkt_type);
1da177e4	82	if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
b6a0dc82	83	cp.role_switch = 0x01;
1da177e4	84	else
b6a0dc82	85	cp.role_switch = 0x00;
4c67bc74	86
a9de9248	87	hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
1da177e4 LT	88	}
1da177e4 LT	89
6ac59344 MH	90	static void hci_acl_connect_cancel(struct hci_conn *conn)
	91	{
	92	struct hci_cp_create_conn_cancel cp;
	93
	94	BT_DBG("%p", conn);
	95
	96	if (conn->hdev->hci_ver < 2)
	97	return;
	98
	99	bacpy(&cp.bdaddr, &conn->dst);
a9de9248	100	hci_send_cmd(conn->hdev, HCI_OP_CREATE_CONN_CANCEL, sizeof(cp), &cp);
6ac59344 MH	101	}
6ac59344 MH	102
1da177e4 LT	103	void hci_acl_disconn(struct hci_conn *conn, __u8 reason)
	104	{
	105	struct hci_cp_disconnect cp;
	106
	107	BT_DBG("%p", conn);
	108
	109	conn->state = BT_DISCONN;
	110
aca3192c	111	cp.handle = cpu_to_le16(conn->handle);
1da177e4	112	cp.reason = reason;
a9de9248	113	hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp);
1da177e4 LT	114	}
	115
	116	void hci_add_sco(struct hci_conn *conn, __u16 handle)
	117	{
	118	struct hci_dev *hdev = conn->hdev;
	119	struct hci_cp_add_sco cp;
	120
	121	BT_DBG("%p", conn);
	122
	123	conn->state = BT_CONNECT;
	124	conn->out = 1;
	125
efc7688b MH	126	conn->attempt++;
efc7688b MH	127
aca3192c	128	cp.handle = cpu_to_le16(handle);
a8746417	129	cp.pkt_type = cpu_to_le16(conn->pkt_type);
1da177e4	130
a9de9248	131	hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
1da177e4 LT	132	}
1da177e4 LT	133
b6a0dc82 MH	134	void hci_setup_sync(struct hci_conn *conn, __u16 handle)
	135	{
	136	struct hci_dev *hdev = conn->hdev;
	137	struct hci_cp_setup_sync_conn cp;
	138
	139	BT_DBG("%p", conn);
	140
	141	conn->state = BT_CONNECT;
	142	conn->out = 1;
	143
efc7688b MH	144	conn->attempt++;
efc7688b MH	145
b6a0dc82	146	cp.handle = cpu_to_le16(handle);
a8746417	147	cp.pkt_type = cpu_to_le16(conn->pkt_type);
b6a0dc82 MH	148
	149	cp.tx_bandwidth = cpu_to_le32(0x00001f40);
	150	cp.rx_bandwidth = cpu_to_le32(0x00001f40);
	151	cp.max_latency = cpu_to_le16(0xffff);
	152	cp.voice_setting = cpu_to_le16(hdev->voice_setting);
	153	cp.retrans_effort = 0xff;
	154
	155	hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp);
	156	}
	157
1da177e4 LT	158	static void hci_conn_timeout(unsigned long arg)
1da177e4 LT	159	{
04837f64 MH	160	struct hci_conn conn = (void ) arg;
04837f64 MH	161	struct hci_dev *hdev = conn->hdev;
2950f21a	162	__u8 reason;
1da177e4 LT	163
	164	BT_DBG("conn %p state %d", conn, conn->state);
	165
	166	if (atomic_read(&conn->refcnt))
	167	return;
	168
	169	hci_dev_lock(hdev);
6ac59344 MH	170
	171	switch (conn->state) {
	172	case BT_CONNECT:
769be974	173	case BT_CONNECT2:
1b0336bb	174	if (conn->type == ACL_LINK && conn->out)
b6a0dc82	175	hci_acl_connect_cancel(conn);
6ac59344	176	break;
769be974	177	case BT_CONFIG:
8e87d142	178	case BT_CONNECTED:
2950f21a MH	179	reason = hci_proto_disconn_ind(conn);
2950f21a MH	180	hci_acl_disconn(conn, reason);
6ac59344 MH	181	break;
6ac59344 MH	182	default:
1da177e4	183	conn->state = BT_CLOSED;
6ac59344 MH	184	break;
	185	}
	186
1da177e4	187	hci_dev_unlock(hdev);
1da177e4 LT	188	}
1da177e4 LT	189
04837f64	190	static void hci_conn_idle(unsigned long arg)
1da177e4	191	{
04837f64 MH	192	struct hci_conn conn = (void ) arg;
	193
	194	BT_DBG("conn %p mode %d", conn, conn->mode);
	195
	196	hci_conn_enter_sniff_mode(conn);
1da177e4 LT	197	}
	198
	199	struct hci_conn hci_conn_add(struct hci_dev hdev, int type, bdaddr_t *dst)
	200	{
	201	struct hci_conn *conn;
	202
	203	BT_DBG("%s dst %s", hdev->name, batostr(dst));
	204
04837f64 MH	205	conn = kzalloc(sizeof(struct hci_conn), GFP_ATOMIC);
04837f64 MH	206	if (!conn)
1da177e4	207	return NULL;
1da177e4 LT	208
1da177e4 LT	209	bacpy(&conn->dst, dst);
a8746417 MH	210	conn->hdev = hdev;
	211	conn->type = type;
	212	conn->mode = HCI_CM_ACTIVE;
	213	conn->state = BT_OPEN;
93f19c9f	214	conn->auth_type = HCI_AT_GENERAL_BONDING;
1da177e4	215
04837f64	216	conn->power_save = 1;
052b30b0	217	conn->disc_timeout = HCI_DISCONN_TIMEOUT;
04837f64	218
a8746417 MH	219	switch (type) {
	220	case ACL_LINK:
	221	conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
	222	break;
	223	case SCO_LINK:
	224	if (lmp_esco_capable(hdev))
efc7688b MH	225	conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) \|
efc7688b MH	226	(hdev->esco_type & EDR_ESCO_MASK);
a8746417 MH	227	else
	228	conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
	229	break;
	230	case ESCO_LINK:
efc7688b	231	conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
a8746417 MH	232	break;
	233	}
	234
1da177e4	235	skb_queue_head_init(&conn->data_q);
04837f64	236
b24b8a24 PE	237	setup_timer(&conn->disc_timer, hci_conn_timeout, (unsigned long)conn);
b24b8a24 PE	238	setup_timer(&conn->idle_timer, hci_conn_idle, (unsigned long)conn);
1da177e4 LT	239
	240	atomic_set(&conn->refcnt, 0);
	241
	242	hci_dev_hold(hdev);
	243
	244	tasklet_disable(&hdev->tx_task);
	245
	246	hci_conn_hash_add(hdev, conn);
	247	if (hdev->notify)
	248	hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
	249
9eba32b8 MH	250	atomic_set(&conn->devref, 0);
9eba32b8 MH	251
a67e899c MH	252	hci_conn_init_sysfs(conn);
a67e899c MH	253
1da177e4 LT	254	tasklet_enable(&hdev->tx_task);
	255
	256	return conn;
	257	}
	258
	259	int hci_conn_del(struct hci_conn *conn)
	260	{
	261	struct hci_dev *hdev = conn->hdev;
	262
	263	BT_DBG("%s conn %p handle %d", hdev->name, conn, conn->handle);
	264
04837f64 MH	265	del_timer(&conn->idle_timer);
	266
	267	del_timer(&conn->disc_timer);
1da177e4	268
5b7f9909	269	if (conn->type == ACL_LINK) {
1da177e4 LT	270	struct hci_conn *sco = conn->link;
	271	if (sco)
	272	sco->link = NULL;
	273
	274	/* Unacked frames */
	275	hdev->acl_cnt += conn->sent;
5b7f9909 MH	276	} else {
	277	struct hci_conn *acl = conn->link;
	278	if (acl) {
	279	acl->link = NULL;
	280	hci_conn_put(acl);
	281	}
1da177e4 LT	282	}
	283
	284	tasklet_disable(&hdev->tx_task);
7d0db0a3	285
1da177e4 LT	286	hci_conn_hash_del(hdev, conn);
	287	if (hdev->notify)
	288	hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
7d0db0a3	289
1da177e4	290	tasklet_enable(&hdev->tx_task);
7d0db0a3	291
1da177e4	292	skb_queue_purge(&conn->data_q);
1da177e4	293
9eba32b8	294	hci_conn_put_device(conn);
2ae9a6be	295
384943ec MH	296	hci_dev_put(hdev);
384943ec MH	297
1da177e4 LT	298	return 0;
	299	}
	300
	301	struct hci_dev hci_get_route(bdaddr_t dst, bdaddr_t *src)
	302	{
	303	int use_src = bacmp(src, BDADDR_ANY);
	304	struct hci_dev *hdev = NULL;
	305	struct list_head *p;
	306
	307	BT_DBG("%s -> %s", batostr(src), batostr(dst));
	308
	309	read_lock_bh(&hci_dev_list_lock);
	310
	311	list_for_each(p, &hci_dev_list) {
	312	struct hci_dev *d = list_entry(p, struct hci_dev, list);
	313
	314	if (!test_bit(HCI_UP, &d->flags) \|\| test_bit(HCI_RAW, &d->flags))
	315	continue;
	316
8e87d142	317	/* Simple routing:
1da177e4 LT	318	* No source address - find interface with bdaddr != dst
	319	* Source address - find interface with bdaddr == src
	320	*/
	321
	322	if (use_src) {
	323	if (!bacmp(&d->bdaddr, src)) {
	324	hdev = d; break;
	325	}
	326	} else {
	327	if (bacmp(&d->bdaddr, dst)) {
	328	hdev = d; break;
	329	}
	330	}
	331	}
	332
	333	if (hdev)
	334	hdev = hci_dev_hold(hdev);
	335
	336	read_unlock_bh(&hci_dev_list_lock);
	337	return hdev;
	338	}
	339	EXPORT_SYMBOL(hci_get_route);
	340
	341	/* Create SCO or ACL connection.
	342	* Device _must_ be locked */
8c1b2355	343	struct hci_conn hci_connect(struct hci_dev hdev, int type, bdaddr_t *dst, __u8 sec_level, __u8 auth_type)
1da177e4 LT	344	{
1da177e4 LT	345	struct hci_conn *acl;
5b7f9909	346	struct hci_conn *sco;
1da177e4 LT	347
	348	BT_DBG("%s dst %s", hdev->name, batostr(dst));
	349
	350	if (!(acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst))) {
	351	if (!(acl = hci_conn_add(hdev, ACL_LINK, dst)))
	352	return NULL;
	353	}
	354
	355	hci_conn_hold(acl);
	356
09ab6f4c	357	if (acl->state == BT_OPEN \|\| acl->state == BT_CLOSED) {
8c1b2355	358	acl->sec_level = sec_level;
09ab6f4c	359	acl->auth_type = auth_type;
1da177e4	360	hci_acl_connect(acl);
09ab6f4c	361	}
1da177e4	362
5b7f9909 MH	363	if (type == ACL_LINK)
5b7f9909 MH	364	return acl;
1da177e4	365
5b7f9909 MH	366	if (!(sco = hci_conn_hash_lookup_ba(hdev, type, dst))) {
	367	if (!(sco = hci_conn_add(hdev, type, dst))) {
	368	hci_conn_put(acl);
	369	return NULL;
1da177e4	370	}
5b7f9909	371	}
1da177e4	372
5b7f9909 MH	373	acl->link = sco;
5b7f9909 MH	374	sco->link = acl;
1da177e4	375
5b7f9909	376	hci_conn_hold(sco);
1da177e4	377
5b7f9909	378	if (acl->state == BT_CONNECTED &&
b6a0dc82	379	(sco->state == BT_OPEN \|\| sco->state == BT_CLOSED)) {
c390216b NP	380	acl->power_save = 1;
	381	hci_conn_enter_active_mode(acl);
	382
b6a0dc82 MH	383	if (lmp_esco_capable(hdev))
	384	hci_setup_sync(sco, acl->handle);
	385	else
	386	hci_add_sco(sco, acl->handle);
	387	}
5b7f9909 MH	388
5b7f9909 MH	389	return sco;
1da177e4 LT	390	}
	391	EXPORT_SYMBOL(hci_connect);
	392
e7c29cb1 MH	393	/* Check link security requirement */
	394	int hci_conn_check_link_mode(struct hci_conn *conn)
	395	{
	396	BT_DBG("conn %p", conn);
	397
	398	if (conn->ssp_mode > 0 && conn->hdev->ssp_mode > 0 &&
	399	!(conn->link_mode & HCI_LM_ENCRYPT))
	400	return 0;
	401
	402	return 1;
	403	}
	404	EXPORT_SYMBOL(hci_conn_check_link_mode);
	405
1da177e4	406	/* Authenticate remote device */
0684e5f9	407	static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
1da177e4 LT	408	{
	409	BT_DBG("conn %p", conn);
	410
96a31833	411	if (sec_level > conn->sec_level)
0684e5f9	412	conn->sec_level = sec_level;
96a31833	413	else if (conn->link_mode & HCI_LM_AUTH)
1da177e4 LT	414	return 1;
1da177e4 LT	415
96a31833 MH	416	conn->auth_type = auth_type;
96a31833 MH	417
1da177e4 LT	418	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
1da177e4 LT	419	struct hci_cp_auth_requested cp;
aca3192c	420	cp.handle = cpu_to_le16(conn->handle);
40be492f MH	421	hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
40be492f MH	422	sizeof(cp), &cp);
1da177e4	423	}
8c1b2355	424
1da177e4 LT	425	return 0;
1da177e4 LT	426	}
1da177e4	427
8c1b2355	428	/* Enable security */
0684e5f9	429	int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
1da177e4 LT	430	{
	431	BT_DBG("conn %p", conn);
	432
8c1b2355 MH	433	if (sec_level == BT_SECURITY_SDP)
	434	return 1;
	435
3fdca1e1 MH	436	if (sec_level == BT_SECURITY_LOW &&
	437	(!conn->ssp_mode \|\| !conn->hdev->ssp_mode))
	438	return 1;
8c1b2355	439
1da177e4	440	if (conn->link_mode & HCI_LM_ENCRYPT)
0684e5f9	441	return hci_conn_auth(conn, sec_level, auth_type);
1da177e4 LT	442
	443	if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend))
	444	return 0;
	445
0684e5f9	446	if (hci_conn_auth(conn, sec_level, auth_type)) {
1da177e4	447	struct hci_cp_set_conn_encrypt cp;
aca3192c	448	cp.handle = cpu_to_le16(conn->handle);
8e87d142	449	cp.encrypt = 1;
40be492f MH	450	hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT,
40be492f MH	451	sizeof(cp), &cp);
1da177e4	452	}
8c1b2355	453
1da177e4 LT	454	return 0;
1da177e4 LT	455	}
8c1b2355	456	EXPORT_SYMBOL(hci_conn_security);
1da177e4 LT	457
	458	/* Change link key */
	459	int hci_conn_change_link_key(struct hci_conn *conn)
	460	{
	461	BT_DBG("conn %p", conn);
	462
	463	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
	464	struct hci_cp_change_conn_link_key cp;
aca3192c	465	cp.handle = cpu_to_le16(conn->handle);
40be492f MH	466	hci_send_cmd(conn->hdev, HCI_OP_CHANGE_CONN_LINK_KEY,
40be492f MH	467	sizeof(cp), &cp);
1da177e4	468	}
8c1b2355	469
1da177e4 LT	470	return 0;
	471	}
	472	EXPORT_SYMBOL(hci_conn_change_link_key);
	473
	474	/* Switch role */
8c1b2355	475	int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
1da177e4 LT	476	{
	477	BT_DBG("conn %p", conn);
	478
	479	if (!role && conn->link_mode & HCI_LM_MASTER)
	480	return 1;
	481
	482	if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->pend)) {
	483	struct hci_cp_switch_role cp;
	484	bacpy(&cp.bdaddr, &conn->dst);
	485	cp.role = role;
a9de9248	486	hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
1da177e4	487	}
8c1b2355	488
1da177e4 LT	489	return 0;
	490	}
	491	EXPORT_SYMBOL(hci_conn_switch_role);
	492
04837f64 MH	493	/* Enter active mode */
	494	void hci_conn_enter_active_mode(struct hci_conn *conn)
	495	{
	496	struct hci_dev *hdev = conn->hdev;
	497
	498	BT_DBG("conn %p mode %d", conn, conn->mode);
	499
	500	if (test_bit(HCI_RAW, &hdev->flags))
	501	return;
	502
	503	if (conn->mode != HCI_CM_SNIFF \|\| !conn->power_save)
	504	goto timer;
	505
	506	if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
	507	struct hci_cp_exit_sniff_mode cp;
aca3192c	508	cp.handle = cpu_to_le16(conn->handle);
a9de9248	509	hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
04837f64 MH	510	}
	511
	512	timer:
	513	if (hdev->idle_timeout > 0)
	514	mod_timer(&conn->idle_timer,
	515	jiffies + msecs_to_jiffies(hdev->idle_timeout));
	516	}
	517
	518	/* Enter sniff mode */
	519	void hci_conn_enter_sniff_mode(struct hci_conn *conn)
	520	{
	521	struct hci_dev *hdev = conn->hdev;
	522
	523	BT_DBG("conn %p mode %d", conn, conn->mode);
	524
	525	if (test_bit(HCI_RAW, &hdev->flags))
	526	return;
	527
	528	if (!lmp_sniff_capable(hdev) \|\| !lmp_sniff_capable(conn))
	529	return;
	530
	531	if (conn->mode != HCI_CM_ACTIVE \|\| !(conn->link_policy & HCI_LP_SNIFF))
	532	return;
	533
	534	if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
	535	struct hci_cp_sniff_subrate cp;
aca3192c YH	536	cp.handle = cpu_to_le16(conn->handle);
	537	cp.max_latency = cpu_to_le16(0);
	538	cp.min_remote_timeout = cpu_to_le16(0);
	539	cp.min_local_timeout = cpu_to_le16(0);
a9de9248	540	hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
04837f64 MH	541	}
	542
	543	if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
	544	struct hci_cp_sniff_mode cp;
aca3192c YH	545	cp.handle = cpu_to_le16(conn->handle);
	546	cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
	547	cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
	548	cp.attempt = cpu_to_le16(4);
	549	cp.timeout = cpu_to_le16(1);
a9de9248	550	hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
04837f64 MH	551	}
	552	}
	553
1da177e4 LT	554	/* Drop all connection on the device */
	555	void hci_conn_hash_flush(struct hci_dev *hdev)
	556	{
	557	struct hci_conn_hash *h = &hdev->conn_hash;
	558	struct list_head *p;
	559
	560	BT_DBG("hdev %s", hdev->name);
	561
	562	p = h->list.next;
	563	while (p != &h->list) {
	564	struct hci_conn *c;
	565
	566	c = list_entry(p, struct hci_conn, list);
	567	p = p->next;
	568
	569	c->state = BT_CLOSED;
	570
2950f21a	571	hci_proto_disconn_cfm(c, 0x16);
1da177e4 LT	572	hci_conn_del(c);
	573	}
	574	}
	575
a9de9248 MH	576	/* Check pending connect attempts */
	577	void hci_conn_check_pending(struct hci_dev *hdev)
	578	{
	579	struct hci_conn *conn;
	580
	581	BT_DBG("hdev %s", hdev->name);
	582
	583	hci_dev_lock(hdev);
	584
	585	conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
	586	if (conn)
	587	hci_acl_connect(conn);
	588
	589	hci_dev_unlock(hdev);
	590	}
	591
9eba32b8 MH	592	void hci_conn_hold_device(struct hci_conn *conn)
	593	{
	594	atomic_inc(&conn->devref);
	595	}
	596	EXPORT_SYMBOL(hci_conn_hold_device);
	597
	598	void hci_conn_put_device(struct hci_conn *conn)
	599	{
	600	if (atomic_dec_and_test(&conn->devref))
	601	hci_conn_del_sysfs(conn);
	602	}
	603	EXPORT_SYMBOL(hci_conn_put_device);
	604
1da177e4 LT	605	int hci_get_conn_list(void __user *arg)
	606	{
	607	struct hci_conn_list_req req, *cl;
	608	struct hci_conn_info *ci;
	609	struct hci_dev *hdev;
	610	struct list_head *p;
	611	int n = 0, size, err;
	612
	613	if (copy_from_user(&req, arg, sizeof(req)))
	614	return -EFAULT;
	615
	616	if (!req.conn_num \|\| req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
	617	return -EINVAL;
	618
	619	size = sizeof(req) + req.conn_num * sizeof(*ci);
	620
12fe2c58	621	if (!(cl = kmalloc(size, GFP_KERNEL)))
1da177e4 LT	622	return -ENOMEM;
	623
	624	if (!(hdev = hci_dev_get(req.dev_id))) {
	625	kfree(cl);
	626	return -ENODEV;
	627	}
	628
	629	ci = cl->conn_info;
	630
	631	hci_dev_lock_bh(hdev);
	632	list_for_each(p, &hdev->conn_hash.list) {
	633	register struct hci_conn *c;
	634	c = list_entry(p, struct hci_conn, list);
	635
	636	bacpy(&(ci + n)->bdaddr, &c->dst);
	637	(ci + n)->handle = c->handle;
	638	(ci + n)->type = c->type;
	639	(ci + n)->out = c->out;
	640	(ci + n)->state = c->state;
	641	(ci + n)->link_mode = c->link_mode;
	642	if (++n >= req.conn_num)
	643	break;
	644	}
	645	hci_dev_unlock_bh(hdev);
	646
	647	cl->dev_id = hdev->id;
	648	cl->conn_num = n;
	649	size = sizeof(req) + n * sizeof(*ci);
	650
	651	hci_dev_put(hdev);
	652
	653	err = copy_to_user(arg, cl, size);
	654	kfree(cl);
	655
	656	return err ? -EFAULT : 0;
	657	}
	658
	659	int hci_get_conn_info(struct hci_dev hdev, void __user arg)
	660	{
	661	struct hci_conn_info_req req;
	662	struct hci_conn_info ci;
	663	struct hci_conn *conn;
	664	char __user *ptr = arg + sizeof(req);
	665
	666	if (copy_from_user(&req, arg, sizeof(req)))
	667	return -EFAULT;
	668
	669	hci_dev_lock_bh(hdev);
	670	conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
	671	if (conn) {
	672	bacpy(&ci.bdaddr, &conn->dst);
	673	ci.handle = conn->handle;
	674	ci.type = conn->type;
	675	ci.out = conn->out;
	676	ci.state = conn->state;
	677	ci.link_mode = conn->link_mode;
	678	}
	679	hci_dev_unlock_bh(hdev);
	680
	681	if (!conn)
	682	return -ENOENT;
	683
	684	return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
	685	}
40be492f MH	686
	687	int hci_get_auth_info(struct hci_dev hdev, void __user arg)
	688	{
	689	struct hci_auth_info_req req;
	690	struct hci_conn *conn;
	691
	692	if (copy_from_user(&req, arg, sizeof(req)))
	693	return -EFAULT;
	694
	695	hci_dev_lock_bh(hdev);
	696	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr);
	697	if (conn)
	698	req.type = conn->auth_type;
	699	hci_dev_unlock_bh(hdev);
	700
	701	if (!conn)
	702	return -ENOENT;
	703
	704	return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0;
	705	}