[mirror_ubuntu-bionic-kernel.git] / net / bluetooth / hci_conn.c

/*
   BlueZ - Bluetooth protocol stack for Linux
   Copyright (C) 2000-2001 Qualcomm Incorporated

   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>

   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License version 2 as
   published by the Free Software Foundation;

   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
   SOFTWARE IS DISCLAIMED.
*/

/* Bluetooth HCI connection handling. */

#include <linux/module.h>

#include <linux/types.h>
#include <linux/errno.h>
#include <linux/kernel.h>
#include <linux/slab.h>
#include <linux/poll.h>
#include <linux/fcntl.h>
#include <linux/init.h>
#include <linux/skbuff.h>
#include <linux/interrupt.h>
#include <linux/notifier.h>
#include <net/sock.h>

#include <asm/system.h>
#include <asm/uaccess.h>
#include <asm/unaligned.h>

#include <net/bluetooth/bluetooth.h>
#include <net/bluetooth/hci_core.h>

#ifndef CONFIG_BT_HCI_CORE_DEBUG
#undef  BT_DBG
#define BT_DBG(D...)
#endif

void hci_acl_connect(struct hci_conn *conn)
{
	struct hci_dev *hdev = conn->hdev;
	struct inquiry_entry *ie;
	struct hci_cp_create_conn cp;

	BT_DBG("%p", conn);

	conn->state = BT_CONNECT;
	conn->out   = 1;
	conn->link_mode = HCI_LM_MASTER;

	conn->attempt++;

	memset(&cp, 0, sizeof(cp));
	bacpy(&cp.bdaddr, &conn->dst);
	cp.pscan_rep_mode = 0x02;

	if ((ie = hci_inquiry_cache_lookup(hdev, &conn->dst)) &&
			inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
		cp.pscan_rep_mode = ie->data.pscan_rep_mode;
		cp.pscan_mode     = ie->data.pscan_mode;
		cp.clock_offset   = ie->data.clock_offset | cpu_to_le16(0x8000);
		memcpy(conn->dev_class, ie->data.dev_class, 3);
	}

	cp.pkt_type = cpu_to_le16(hdev->pkt_type & ACL_PTYPE_MASK);
	if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
		cp.role_switch = 0x01;
	else
		cp.role_switch = 0x00;

	hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
}

static void hci_acl_connect_cancel(struct hci_conn *conn)
{
	struct hci_cp_create_conn_cancel cp;

	BT_DBG("%p", conn);

	if (conn->hdev->hci_ver < 2)
		return;

	bacpy(&cp.bdaddr, &conn->dst);
	hci_send_cmd(conn->hdev, HCI_OP_CREATE_CONN_CANCEL, sizeof(cp), &cp);
}

void hci_acl_disconn(struct hci_conn *conn, __u8 reason)
{
	struct hci_cp_disconnect cp;

	BT_DBG("%p", conn);

	conn->state = BT_DISCONN;

	cp.handle = cpu_to_le16(conn->handle);
	cp.reason = reason;
	hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp);
}

void hci_add_sco(struct hci_conn *conn, __u16 handle)
{
	struct hci_dev *hdev = conn->hdev;
	struct hci_cp_add_sco cp;

	BT_DBG("%p", conn);

	conn->state = BT_CONNECT;
	conn->out = 1;

	cp.handle   = cpu_to_le16(handle);
	cp.pkt_type = cpu_to_le16(hdev->pkt_type & SCO_PTYPE_MASK);

	hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
}

void hci_setup_sync(struct hci_conn *conn, __u16 handle)
{
	struct hci_dev *hdev = conn->hdev;
	struct hci_cp_setup_sync_conn cp;

	BT_DBG("%p", conn);

	conn->state = BT_CONNECT;
	conn->out = 1;

	cp.handle   = cpu_to_le16(handle);
	cp.pkt_type = cpu_to_le16(hdev->esco_type);

	cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
	cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
	cp.max_latency    = cpu_to_le16(0xffff);
	cp.voice_setting  = cpu_to_le16(hdev->voice_setting);
	cp.retrans_effort = 0xff;

	hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp);
}

static void hci_conn_timeout(unsigned long arg)
{
	struct hci_conn *conn = (void *) arg;
	struct hci_dev *hdev = conn->hdev;

	BT_DBG("conn %p state %d", conn, conn->state);

	if (atomic_read(&conn->refcnt))
		return;

	hci_dev_lock(hdev);

	switch (conn->state) {
	case BT_CONNECT:
		if (conn->type == ACL_LINK)
			hci_acl_connect_cancel(conn);
		else
			hci_acl_disconn(conn, 0x13);
		break;
	case BT_CONNECTED:
		hci_acl_disconn(conn, 0x13);
		break;
	default:
		conn->state = BT_CLOSED;
		break;
	}

	hci_dev_unlock(hdev);
}

static void hci_conn_idle(unsigned long arg)
{
	struct hci_conn *conn = (void *) arg;

	BT_DBG("conn %p mode %d", conn, conn->mode);

	hci_conn_enter_sniff_mode(conn);
}

struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
{
	struct hci_conn *conn;

	BT_DBG("%s dst %s", hdev->name, batostr(dst));

	conn = kzalloc(sizeof(struct hci_conn), GFP_ATOMIC);
	if (!conn)
		return NULL;

	bacpy(&conn->dst, dst);
	conn->hdev   = hdev;
	conn->type   = type;
	conn->mode   = HCI_CM_ACTIVE;
	conn->state  = BT_OPEN;

	conn->power_save = 1;

	skb_queue_head_init(&conn->data_q);

	setup_timer(&conn->disc_timer, hci_conn_timeout, (unsigned long)conn);
	setup_timer(&conn->idle_timer, hci_conn_idle, (unsigned long)conn);

	atomic_set(&conn->refcnt, 0);

	hci_dev_hold(hdev);

	tasklet_disable(&hdev->tx_task);

	hci_conn_hash_add(hdev, conn);
	if (hdev->notify)
		hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);

	hci_conn_add_sysfs(conn);

	tasklet_enable(&hdev->tx_task);

	return conn;
}

int hci_conn_del(struct hci_conn *conn)
{
	struct hci_dev *hdev = conn->hdev;

	BT_DBG("%s conn %p handle %d", hdev->name, conn, conn->handle);

	del_timer(&conn->idle_timer);

	del_timer(&conn->disc_timer);

	if (conn->type == ACL_LINK) {
		struct hci_conn *sco = conn->link;
		if (sco)
			sco->link = NULL;

		/* Unacked frames */
		hdev->acl_cnt += conn->sent;
	} else {
		struct hci_conn *acl = conn->link;
		if (acl) {
			acl->link = NULL;
			hci_conn_put(acl);
		}
	}

	tasklet_disable(&hdev->tx_task);
	hci_conn_hash_del(hdev, conn);
	if (hdev->notify)
		hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
	tasklet_enable(&hdev->tx_task);
	skb_queue_purge(&conn->data_q);
	hci_conn_del_sysfs(conn);
	hci_dev_put(hdev);

	return 0;
}

struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src)
{
	int use_src = bacmp(src, BDADDR_ANY);
	struct hci_dev *hdev = NULL;
	struct list_head *p;

	BT_DBG("%s -> %s", batostr(src), batostr(dst));

	read_lock_bh(&hci_dev_list_lock);

	list_for_each(p, &hci_dev_list) {
		struct hci_dev *d = list_entry(p, struct hci_dev, list);

		if (!test_bit(HCI_UP, &d->flags) || test_bit(HCI_RAW, &d->flags))
			continue;

		/* Simple routing:
		 *   No source address - find interface with bdaddr != dst
		 *   Source address    - find interface with bdaddr == src
		 */

		if (use_src) {
			if (!bacmp(&d->bdaddr, src)) {
				hdev = d; break;
			}
		} else {
			if (bacmp(&d->bdaddr, dst)) {
				hdev = d; break;
			}
		}
	}

	if (hdev)
		hdev = hci_dev_hold(hdev);

	read_unlock_bh(&hci_dev_list_lock);
	return hdev;
}
EXPORT_SYMBOL(hci_get_route);

/* Create SCO or ACL connection.
 * Device _must_ be locked */
struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst)
{
	struct hci_conn *acl;
	struct hci_conn *sco;

	BT_DBG("%s dst %s", hdev->name, batostr(dst));

	if (!(acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst))) {
		if (!(acl = hci_conn_add(hdev, ACL_LINK, dst)))
			return NULL;
	}

	hci_conn_hold(acl);

	if (acl->state == BT_OPEN || acl->state == BT_CLOSED)
		hci_acl_connect(acl);

	if (type == ACL_LINK)
		return acl;

	if (!(sco = hci_conn_hash_lookup_ba(hdev, type, dst))) {
		if (!(sco = hci_conn_add(hdev, type, dst))) {
			hci_conn_put(acl);
			return NULL;
		}
	}

	acl->link = sco;
	sco->link = acl;

	hci_conn_hold(sco);

	if (acl->state == BT_CONNECTED &&
			(sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
		if (lmp_esco_capable(hdev))
			hci_setup_sync(sco, acl->handle);
		else
			hci_add_sco(sco, acl->handle);
	}

	return sco;
}
EXPORT_SYMBOL(hci_connect);

/* Authenticate remote device */
int hci_conn_auth(struct hci_conn *conn)
{
	BT_DBG("conn %p", conn);

	if (conn->link_mode & HCI_LM_AUTH)
		return 1;

	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
		struct hci_cp_auth_requested cp;
		cp.handle = cpu_to_le16(conn->handle);
		hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
	}
	return 0;
}
EXPORT_SYMBOL(hci_conn_auth);

/* Enable encryption */
int hci_conn_encrypt(struct hci_conn *conn)
{
	BT_DBG("conn %p", conn);

	if (conn->link_mode & HCI_LM_ENCRYPT)
		return 1;

	if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend))
		return 0;

	if (hci_conn_auth(conn)) {
		struct hci_cp_set_conn_encrypt cp;
		cp.handle  = cpu_to_le16(conn->handle);
		cp.encrypt = 1;
		hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp), &cp);
	}
	return 0;
}
EXPORT_SYMBOL(hci_conn_encrypt);

/* Change link key */
int hci_conn_change_link_key(struct hci_conn *conn)
{
	BT_DBG("conn %p", conn);

	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
		struct hci_cp_change_conn_link_key cp;
		cp.handle = cpu_to_le16(conn->handle);
		hci_send_cmd(conn->hdev, HCI_OP_CHANGE_CONN_LINK_KEY, sizeof(cp), &cp);
	}
	return 0;
}
EXPORT_SYMBOL(hci_conn_change_link_key);

/* Switch role */
int hci_conn_switch_role(struct hci_conn *conn, uint8_t role)
{
	BT_DBG("conn %p", conn);

	if (!role && conn->link_mode & HCI_LM_MASTER)
		return 1;

	if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->pend)) {
		struct hci_cp_switch_role cp;
		bacpy(&cp.bdaddr, &conn->dst);
		cp.role = role;
		hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
	}
	return 0;
}
EXPORT_SYMBOL(hci_conn_switch_role);

/* Enter active mode */
void hci_conn_enter_active_mode(struct hci_conn *conn)
{
	struct hci_dev *hdev = conn->hdev;

	BT_DBG("conn %p mode %d", conn, conn->mode);

	if (test_bit(HCI_RAW, &hdev->flags))
		return;

	if (conn->mode != HCI_CM_SNIFF || !conn->power_save)
		goto timer;

	if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
		struct hci_cp_exit_sniff_mode cp;
		cp.handle = cpu_to_le16(conn->handle);
		hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
	}

timer:
	if (hdev->idle_timeout > 0)
		mod_timer(&conn->idle_timer,
			jiffies + msecs_to_jiffies(hdev->idle_timeout));
}

/* Enter sniff mode */
void hci_conn_enter_sniff_mode(struct hci_conn *conn)
{
	struct hci_dev *hdev = conn->hdev;

	BT_DBG("conn %p mode %d", conn, conn->mode);

	if (test_bit(HCI_RAW, &hdev->flags))
		return;

	if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn))
		return;

	if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF))
		return;

	if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
		struct hci_cp_sniff_subrate cp;
		cp.handle             = cpu_to_le16(conn->handle);
		cp.max_latency        = cpu_to_le16(0);
		cp.min_remote_timeout = cpu_to_le16(0);
		cp.min_local_timeout  = cpu_to_le16(0);
		hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
	}

	if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
		struct hci_cp_sniff_mode cp;
		cp.handle       = cpu_to_le16(conn->handle);
		cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
		cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
		cp.attempt      = cpu_to_le16(4);
		cp.timeout      = cpu_to_le16(1);
		hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
	}
}

/* Drop all connection on the device */
void hci_conn_hash_flush(struct hci_dev *hdev)
{
	struct hci_conn_hash *h = &hdev->conn_hash;
	struct list_head *p;

	BT_DBG("hdev %s", hdev->name);

	p = h->list.next;
	while (p != &h->list) {
		struct hci_conn *c;

		c = list_entry(p, struct hci_conn, list);
		p = p->next;

		c->state = BT_CLOSED;

		hci_proto_disconn_ind(c, 0x16);
		hci_conn_del(c);
	}
}

/* Check pending connect attempts */
void hci_conn_check_pending(struct hci_dev *hdev)
{
	struct hci_conn *conn;

	BT_DBG("hdev %s", hdev->name);

	hci_dev_lock(hdev);

	conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
	if (conn)
		hci_acl_connect(conn);

	hci_dev_unlock(hdev);
}

int hci_get_conn_list(void __user *arg)
{
	struct hci_conn_list_req req, *cl;
	struct hci_conn_info *ci;
	struct hci_dev *hdev;
	struct list_head *p;
	int n = 0, size, err;

	if (copy_from_user(&req, arg, sizeof(req)))
		return -EFAULT;

	if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
		return -EINVAL;

	size = sizeof(req) + req.conn_num * sizeof(*ci);

	if (!(cl = kmalloc(size, GFP_KERNEL)))
		return -ENOMEM;

	if (!(hdev = hci_dev_get(req.dev_id))) {
		kfree(cl);
		return -ENODEV;
	}

	ci = cl->conn_info;

	hci_dev_lock_bh(hdev);
	list_for_each(p, &hdev->conn_hash.list) {
		register struct hci_conn *c;
		c = list_entry(p, struct hci_conn, list);

		bacpy(&(ci + n)->bdaddr, &c->dst);
		(ci + n)->handle = c->handle;
		(ci + n)->type  = c->type;
		(ci + n)->out   = c->out;
		(ci + n)->state = c->state;
		(ci + n)->link_mode = c->link_mode;
		if (++n >= req.conn_num)
			break;
	}
	hci_dev_unlock_bh(hdev);

	cl->dev_id = hdev->id;
	cl->conn_num = n;
	size = sizeof(req) + n * sizeof(*ci);

	hci_dev_put(hdev);

	err = copy_to_user(arg, cl, size);
	kfree(cl);

	return err ? -EFAULT : 0;
}

int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
{
	struct hci_conn_info_req req;
	struct hci_conn_info ci;
	struct hci_conn *conn;
	char __user *ptr = arg + sizeof(req);

	if (copy_from_user(&req, arg, sizeof(req)))
		return -EFAULT;

	hci_dev_lock_bh(hdev);
	conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
	if (conn) {
		bacpy(&ci.bdaddr, &conn->dst);
		ci.handle = conn->handle;
		ci.type  = conn->type;
		ci.out   = conn->out;
		ci.state = conn->state;
		ci.link_mode = conn->link_mode;
	}
	hci_dev_unlock_bh(hdev);

	if (!conn)
		return -ENOENT;

	return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
}
Commit	Line	Data
8e87d142	1	/*
1da177e4 LT	2	BlueZ - Bluetooth protocol stack for Linux
	3	Copyright (C) 2000-2001 Qualcomm Incorporated
	4
	5	Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
	6
	7	This program is free software; you can redistribute it and/or modify
	8	it under the terms of the GNU General Public License version 2 as
	9	published by the Free Software Foundation;
	10
	11	THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
	12	OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
	13	FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
	14	IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142 YH	15	CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
	16	WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
	17	ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4 LT	18	OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
1da177e4 LT	19
8e87d142 YH	20	ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
8e87d142 YH	21	COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4 LT	22	SOFTWARE IS DISCLAIMED.
	23	*/
	24
	25	/* Bluetooth HCI connection handling. */
	26
1da177e4 LT	27	#include <linux/module.h>
	28
	29	#include <linux/types.h>
	30	#include <linux/errno.h>
	31	#include <linux/kernel.h>
1da177e4 LT	32	#include <linux/slab.h>
	33	#include <linux/poll.h>
	34	#include <linux/fcntl.h>
	35	#include <linux/init.h>
	36	#include <linux/skbuff.h>
	37	#include <linux/interrupt.h>
	38	#include <linux/notifier.h>
	39	#include <net/sock.h>
	40
	41	#include <asm/system.h>
	42	#include <asm/uaccess.h>
	43	#include <asm/unaligned.h>
	44
	45	#include <net/bluetooth/bluetooth.h>
	46	#include <net/bluetooth/hci_core.h>
	47
	48	#ifndef CONFIG_BT_HCI_CORE_DEBUG
	49	#undef BT_DBG
	50	#define BT_DBG(D...)
	51	#endif
	52
4c67bc74	53	void hci_acl_connect(struct hci_conn *conn)
1da177e4 LT	54	{
	55	struct hci_dev *hdev = conn->hdev;
	56	struct inquiry_entry *ie;
	57	struct hci_cp_create_conn cp;
	58
	59	BT_DBG("%p", conn);
	60
	61	conn->state = BT_CONNECT;
	62	conn->out = 1;
	63	conn->link_mode = HCI_LM_MASTER;
	64
4c67bc74 MH	65	conn->attempt++;
4c67bc74 MH	66
1da177e4 LT	67	memset(&cp, 0, sizeof(cp));
	68	bacpy(&cp.bdaddr, &conn->dst);
	69	cp.pscan_rep_mode = 0x02;
	70
	71	if ((ie = hci_inquiry_cache_lookup(hdev, &conn->dst)) &&
	72	inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
	73	cp.pscan_rep_mode = ie->data.pscan_rep_mode;
	74	cp.pscan_mode = ie->data.pscan_mode;
aca3192c	75	cp.clock_offset = ie->data.clock_offset \| cpu_to_le16(0x8000);
1da177e4 LT	76	memcpy(conn->dev_class, ie->data.dev_class, 3);
	77	}
	78
aca3192c	79	cp.pkt_type = cpu_to_le16(hdev->pkt_type & ACL_PTYPE_MASK);
1da177e4	80	if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
b6a0dc82	81	cp.role_switch = 0x01;
1da177e4	82	else
b6a0dc82	83	cp.role_switch = 0x00;
4c67bc74	84
a9de9248	85	hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
1da177e4 LT	86	}
1da177e4 LT	87
6ac59344 MH	88	static void hci_acl_connect_cancel(struct hci_conn *conn)
	89	{
	90	struct hci_cp_create_conn_cancel cp;
	91
	92	BT_DBG("%p", conn);
	93
	94	if (conn->hdev->hci_ver < 2)
	95	return;
	96
	97	bacpy(&cp.bdaddr, &conn->dst);
a9de9248	98	hci_send_cmd(conn->hdev, HCI_OP_CREATE_CONN_CANCEL, sizeof(cp), &cp);
6ac59344 MH	99	}
6ac59344 MH	100
1da177e4 LT	101	void hci_acl_disconn(struct hci_conn *conn, __u8 reason)
	102	{
	103	struct hci_cp_disconnect cp;
	104
	105	BT_DBG("%p", conn);
	106
	107	conn->state = BT_DISCONN;
	108
aca3192c	109	cp.handle = cpu_to_le16(conn->handle);
1da177e4	110	cp.reason = reason;
a9de9248	111	hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp);
1da177e4 LT	112	}
	113
	114	void hci_add_sco(struct hci_conn *conn, __u16 handle)
	115	{
	116	struct hci_dev *hdev = conn->hdev;
	117	struct hci_cp_add_sco cp;
	118
	119	BT_DBG("%p", conn);
	120
	121	conn->state = BT_CONNECT;
	122	conn->out = 1;
	123
aca3192c	124	cp.handle = cpu_to_le16(handle);
5b7f9909	125	cp.pkt_type = cpu_to_le16(hdev->pkt_type & SCO_PTYPE_MASK);
1da177e4	126
a9de9248	127	hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
1da177e4 LT	128	}
1da177e4 LT	129
b6a0dc82 MH	130	void hci_setup_sync(struct hci_conn *conn, __u16 handle)
	131	{
	132	struct hci_dev *hdev = conn->hdev;
	133	struct hci_cp_setup_sync_conn cp;
	134
	135	BT_DBG("%p", conn);
	136
	137	conn->state = BT_CONNECT;
	138	conn->out = 1;
	139
	140	cp.handle = cpu_to_le16(handle);
	141	cp.pkt_type = cpu_to_le16(hdev->esco_type);
	142
	143	cp.tx_bandwidth = cpu_to_le32(0x00001f40);
	144	cp.rx_bandwidth = cpu_to_le32(0x00001f40);
	145	cp.max_latency = cpu_to_le16(0xffff);
	146	cp.voice_setting = cpu_to_le16(hdev->voice_setting);
	147	cp.retrans_effort = 0xff;
	148
	149	hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp);
	150	}
	151
1da177e4 LT	152	static void hci_conn_timeout(unsigned long arg)
1da177e4 LT	153	{
04837f64 MH	154	struct hci_conn conn = (void ) arg;
04837f64 MH	155	struct hci_dev *hdev = conn->hdev;
1da177e4 LT	156
	157	BT_DBG("conn %p state %d", conn, conn->state);
	158
	159	if (atomic_read(&conn->refcnt))
	160	return;
	161
	162	hci_dev_lock(hdev);
6ac59344 MH	163
	164	switch (conn->state) {
	165	case BT_CONNECT:
b6a0dc82 MH	166	if (conn->type == ACL_LINK)
	167	hci_acl_connect_cancel(conn);
	168	else
	169	hci_acl_disconn(conn, 0x13);
6ac59344	170	break;
8e87d142	171	case BT_CONNECTED:
1da177e4	172	hci_acl_disconn(conn, 0x13);
6ac59344 MH	173	break;
6ac59344 MH	174	default:
1da177e4	175	conn->state = BT_CLOSED;
6ac59344 MH	176	break;
	177	}
	178
1da177e4	179	hci_dev_unlock(hdev);
1da177e4 LT	180	}
1da177e4 LT	181
04837f64	182	static void hci_conn_idle(unsigned long arg)
1da177e4	183	{
04837f64 MH	184	struct hci_conn conn = (void ) arg;
	185
	186	BT_DBG("conn %p mode %d", conn, conn->mode);
	187
	188	hci_conn_enter_sniff_mode(conn);
1da177e4 LT	189	}
	190
	191	struct hci_conn hci_conn_add(struct hci_dev hdev, int type, bdaddr_t *dst)
	192	{
	193	struct hci_conn *conn;
	194
	195	BT_DBG("%s dst %s", hdev->name, batostr(dst));
	196
04837f64 MH	197	conn = kzalloc(sizeof(struct hci_conn), GFP_ATOMIC);
04837f64 MH	198	if (!conn)
1da177e4	199	return NULL;
1da177e4 LT	200
1da177e4 LT	201	bacpy(&conn->dst, dst);
1da177e4	202	conn->hdev = hdev;
04837f64 MH	203	conn->type = type;
04837f64 MH	204	conn->mode = HCI_CM_ACTIVE;
1da177e4 LT	205	conn->state = BT_OPEN;
1da177e4 LT	206
04837f64 MH	207	conn->power_save = 1;
04837f64 MH	208
1da177e4	209	skb_queue_head_init(&conn->data_q);
04837f64	210
b24b8a24 PE	211	setup_timer(&conn->disc_timer, hci_conn_timeout, (unsigned long)conn);
b24b8a24 PE	212	setup_timer(&conn->idle_timer, hci_conn_idle, (unsigned long)conn);
1da177e4 LT	213
	214	atomic_set(&conn->refcnt, 0);
	215
	216	hci_dev_hold(hdev);
	217
	218	tasklet_disable(&hdev->tx_task);
	219
	220	hci_conn_hash_add(hdev, conn);
	221	if (hdev->notify)
	222	hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
	223
b219e3ac MH	224	hci_conn_add_sysfs(conn);
b219e3ac MH	225
1da177e4 LT	226	tasklet_enable(&hdev->tx_task);
	227
	228	return conn;
	229	}
	230
	231	int hci_conn_del(struct hci_conn *conn)
	232	{
	233	struct hci_dev *hdev = conn->hdev;
	234
	235	BT_DBG("%s conn %p handle %d", hdev->name, conn, conn->handle);
	236
04837f64 MH	237	del_timer(&conn->idle_timer);
	238
	239	del_timer(&conn->disc_timer);
1da177e4	240
5b7f9909	241	if (conn->type == ACL_LINK) {
1da177e4 LT	242	struct hci_conn *sco = conn->link;
	243	if (sco)
	244	sco->link = NULL;
	245
	246	/* Unacked frames */
	247	hdev->acl_cnt += conn->sent;
5b7f9909 MH	248	} else {
	249	struct hci_conn *acl = conn->link;
	250	if (acl) {
	251	acl->link = NULL;
	252	hci_conn_put(acl);
	253	}
1da177e4 LT	254	}
	255
	256	tasklet_disable(&hdev->tx_task);
1da177e4 LT	257	hci_conn_hash_del(hdev, conn);
	258	if (hdev->notify)
	259	hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
1da177e4	260	tasklet_enable(&hdev->tx_task);
1da177e4	261	skb_queue_purge(&conn->data_q);
38b7da09	262	hci_conn_del_sysfs(conn);
1da177e4 LT	263	hci_dev_put(hdev);
1da177e4 LT	264
1da177e4 LT	265	return 0;
	266	}
	267
	268	struct hci_dev hci_get_route(bdaddr_t dst, bdaddr_t *src)
	269	{
	270	int use_src = bacmp(src, BDADDR_ANY);
	271	struct hci_dev *hdev = NULL;
	272	struct list_head *p;
	273
	274	BT_DBG("%s -> %s", batostr(src), batostr(dst));
	275
	276	read_lock_bh(&hci_dev_list_lock);
	277
	278	list_for_each(p, &hci_dev_list) {
	279	struct hci_dev *d = list_entry(p, struct hci_dev, list);
	280
	281	if (!test_bit(HCI_UP, &d->flags) \|\| test_bit(HCI_RAW, &d->flags))
	282	continue;
	283
8e87d142	284	/* Simple routing:
1da177e4 LT	285	* No source address - find interface with bdaddr != dst
	286	* Source address - find interface with bdaddr == src
	287	*/
	288
	289	if (use_src) {
	290	if (!bacmp(&d->bdaddr, src)) {
	291	hdev = d; break;
	292	}
	293	} else {
	294	if (bacmp(&d->bdaddr, dst)) {
	295	hdev = d; break;
	296	}
	297	}
	298	}
	299
	300	if (hdev)
	301	hdev = hci_dev_hold(hdev);
	302
	303	read_unlock_bh(&hci_dev_list_lock);
	304	return hdev;
	305	}
	306	EXPORT_SYMBOL(hci_get_route);
	307
	308	/* Create SCO or ACL connection.
	309	* Device _must_ be locked */
5b7f9909	310	struct hci_conn hci_connect(struct hci_dev hdev, int type, bdaddr_t *dst)
1da177e4 LT	311	{
1da177e4 LT	312	struct hci_conn *acl;
5b7f9909	313	struct hci_conn *sco;
1da177e4 LT	314
	315	BT_DBG("%s dst %s", hdev->name, batostr(dst));
	316
	317	if (!(acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst))) {
	318	if (!(acl = hci_conn_add(hdev, ACL_LINK, dst)))
	319	return NULL;
	320	}
	321
	322	hci_conn_hold(acl);
	323
	324	if (acl->state == BT_OPEN \|\| acl->state == BT_CLOSED)
	325	hci_acl_connect(acl);
	326
5b7f9909 MH	327	if (type == ACL_LINK)
5b7f9909 MH	328	return acl;
1da177e4	329
5b7f9909 MH	330	if (!(sco = hci_conn_hash_lookup_ba(hdev, type, dst))) {
	331	if (!(sco = hci_conn_add(hdev, type, dst))) {
	332	hci_conn_put(acl);
	333	return NULL;
1da177e4	334	}
5b7f9909	335	}
1da177e4	336
5b7f9909 MH	337	acl->link = sco;
5b7f9909 MH	338	sco->link = acl;
1da177e4	339
5b7f9909	340	hci_conn_hold(sco);
1da177e4	341
5b7f9909	342	if (acl->state == BT_CONNECTED &&
b6a0dc82 MH	343	(sco->state == BT_OPEN \|\| sco->state == BT_CLOSED)) {
	344	if (lmp_esco_capable(hdev))
	345	hci_setup_sync(sco, acl->handle);
	346	else
	347	hci_add_sco(sco, acl->handle);
	348	}
5b7f9909 MH	349
5b7f9909 MH	350	return sco;
1da177e4 LT	351	}
	352	EXPORT_SYMBOL(hci_connect);
	353
	354	/* Authenticate remote device */
	355	int hci_conn_auth(struct hci_conn *conn)
	356	{
	357	BT_DBG("conn %p", conn);
	358
	359	if (conn->link_mode & HCI_LM_AUTH)
	360	return 1;
	361
	362	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
	363	struct hci_cp_auth_requested cp;
aca3192c	364	cp.handle = cpu_to_le16(conn->handle);
a9de9248	365	hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
1da177e4 LT	366	}
	367	return 0;
	368	}
	369	EXPORT_SYMBOL(hci_conn_auth);
	370
	371	/* Enable encryption */
	372	int hci_conn_encrypt(struct hci_conn *conn)
	373	{
	374	BT_DBG("conn %p", conn);
	375
	376	if (conn->link_mode & HCI_LM_ENCRYPT)
	377	return 1;
	378
	379	if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend))
	380	return 0;
	381
	382	if (hci_conn_auth(conn)) {
	383	struct hci_cp_set_conn_encrypt cp;
aca3192c	384	cp.handle = cpu_to_le16(conn->handle);
8e87d142	385	cp.encrypt = 1;
a9de9248	386	hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp), &cp);
1da177e4 LT	387	}
	388	return 0;
	389	}
	390	EXPORT_SYMBOL(hci_conn_encrypt);
	391
	392	/* Change link key */
	393	int hci_conn_change_link_key(struct hci_conn *conn)
	394	{
	395	BT_DBG("conn %p", conn);
	396
	397	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
	398	struct hci_cp_change_conn_link_key cp;
aca3192c	399	cp.handle = cpu_to_le16(conn->handle);
a9de9248	400	hci_send_cmd(conn->hdev, HCI_OP_CHANGE_CONN_LINK_KEY, sizeof(cp), &cp);
1da177e4 LT	401	}
	402	return 0;
	403	}
	404	EXPORT_SYMBOL(hci_conn_change_link_key);
	405
	406	/* Switch role */
	407	int hci_conn_switch_role(struct hci_conn *conn, uint8_t role)
	408	{
	409	BT_DBG("conn %p", conn);
	410
	411	if (!role && conn->link_mode & HCI_LM_MASTER)
	412	return 1;
	413
	414	if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->pend)) {
	415	struct hci_cp_switch_role cp;
	416	bacpy(&cp.bdaddr, &conn->dst);
	417	cp.role = role;
a9de9248	418	hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
1da177e4 LT	419	}
	420	return 0;
	421	}
	422	EXPORT_SYMBOL(hci_conn_switch_role);
	423
04837f64 MH	424	/* Enter active mode */
	425	void hci_conn_enter_active_mode(struct hci_conn *conn)
	426	{
	427	struct hci_dev *hdev = conn->hdev;
	428
	429	BT_DBG("conn %p mode %d", conn, conn->mode);
	430
	431	if (test_bit(HCI_RAW, &hdev->flags))
	432	return;
	433
	434	if (conn->mode != HCI_CM_SNIFF \|\| !conn->power_save)
	435	goto timer;
	436
	437	if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
	438	struct hci_cp_exit_sniff_mode cp;
aca3192c	439	cp.handle = cpu_to_le16(conn->handle);
a9de9248	440	hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
04837f64 MH	441	}
	442
	443	timer:
	444	if (hdev->idle_timeout > 0)
	445	mod_timer(&conn->idle_timer,
	446	jiffies + msecs_to_jiffies(hdev->idle_timeout));
	447	}
	448
	449	/* Enter sniff mode */
	450	void hci_conn_enter_sniff_mode(struct hci_conn *conn)
	451	{
	452	struct hci_dev *hdev = conn->hdev;
	453
	454	BT_DBG("conn %p mode %d", conn, conn->mode);
	455
	456	if (test_bit(HCI_RAW, &hdev->flags))
	457	return;
	458
	459	if (!lmp_sniff_capable(hdev) \|\| !lmp_sniff_capable(conn))
	460	return;
	461
	462	if (conn->mode != HCI_CM_ACTIVE \|\| !(conn->link_policy & HCI_LP_SNIFF))
	463	return;
	464
	465	if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
	466	struct hci_cp_sniff_subrate cp;
aca3192c YH	467	cp.handle = cpu_to_le16(conn->handle);
	468	cp.max_latency = cpu_to_le16(0);
	469	cp.min_remote_timeout = cpu_to_le16(0);
	470	cp.min_local_timeout = cpu_to_le16(0);
a9de9248	471	hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
04837f64 MH	472	}
	473
	474	if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
	475	struct hci_cp_sniff_mode cp;
aca3192c YH	476	cp.handle = cpu_to_le16(conn->handle);
	477	cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
	478	cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
	479	cp.attempt = cpu_to_le16(4);
	480	cp.timeout = cpu_to_le16(1);
a9de9248	481	hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
04837f64 MH	482	}
	483	}
	484
1da177e4 LT	485	/* Drop all connection on the device */
	486	void hci_conn_hash_flush(struct hci_dev *hdev)
	487	{
	488	struct hci_conn_hash *h = &hdev->conn_hash;
	489	struct list_head *p;
	490
	491	BT_DBG("hdev %s", hdev->name);
	492
	493	p = h->list.next;
	494	while (p != &h->list) {
	495	struct hci_conn *c;
	496
	497	c = list_entry(p, struct hci_conn, list);
	498	p = p->next;
	499
	500	c->state = BT_CLOSED;
	501
	502	hci_proto_disconn_ind(c, 0x16);
	503	hci_conn_del(c);
	504	}
	505	}
	506
a9de9248 MH	507	/* Check pending connect attempts */
	508	void hci_conn_check_pending(struct hci_dev *hdev)
	509	{
	510	struct hci_conn *conn;
	511
	512	BT_DBG("hdev %s", hdev->name);
	513
	514	hci_dev_lock(hdev);
	515
	516	conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
	517	if (conn)
	518	hci_acl_connect(conn);
	519
	520	hci_dev_unlock(hdev);
	521	}
	522
1da177e4 LT	523	int hci_get_conn_list(void __user *arg)
	524	{
	525	struct hci_conn_list_req req, *cl;
	526	struct hci_conn_info *ci;
	527	struct hci_dev *hdev;
	528	struct list_head *p;
	529	int n = 0, size, err;
	530
	531	if (copy_from_user(&req, arg, sizeof(req)))
	532	return -EFAULT;
	533
	534	if (!req.conn_num \|\| req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
	535	return -EINVAL;
	536
	537	size = sizeof(req) + req.conn_num * sizeof(*ci);
	538
12fe2c58	539	if (!(cl = kmalloc(size, GFP_KERNEL)))
1da177e4 LT	540	return -ENOMEM;
	541
	542	if (!(hdev = hci_dev_get(req.dev_id))) {
	543	kfree(cl);
	544	return -ENODEV;
	545	}
	546
	547	ci = cl->conn_info;
	548
	549	hci_dev_lock_bh(hdev);
	550	list_for_each(p, &hdev->conn_hash.list) {
	551	register struct hci_conn *c;
	552	c = list_entry(p, struct hci_conn, list);
	553
	554	bacpy(&(ci + n)->bdaddr, &c->dst);
	555	(ci + n)->handle = c->handle;
	556	(ci + n)->type = c->type;
	557	(ci + n)->out = c->out;
	558	(ci + n)->state = c->state;
	559	(ci + n)->link_mode = c->link_mode;
	560	if (++n >= req.conn_num)
	561	break;
	562	}
	563	hci_dev_unlock_bh(hdev);
	564
	565	cl->dev_id = hdev->id;
	566	cl->conn_num = n;
	567	size = sizeof(req) + n * sizeof(*ci);
	568
	569	hci_dev_put(hdev);
	570
	571	err = copy_to_user(arg, cl, size);
	572	kfree(cl);
	573
	574	return err ? -EFAULT : 0;
	575	}
	576
	577	int hci_get_conn_info(struct hci_dev hdev, void __user arg)
	578	{
	579	struct hci_conn_info_req req;
	580	struct hci_conn_info ci;
	581	struct hci_conn *conn;
	582	char __user *ptr = arg + sizeof(req);
	583
	584	if (copy_from_user(&req, arg, sizeof(req)))
	585	return -EFAULT;
	586
	587	hci_dev_lock_bh(hdev);
	588	conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
	589	if (conn) {
	590	bacpy(&ci.bdaddr, &conn->dst);
	591	ci.handle = conn->handle;
	592	ci.type = conn->type;
	593	ci.out = conn->out;
	594	ci.state = conn->state;
	595	ci.link_mode = conn->link_mode;
	596	}
	597	hci_dev_unlock_bh(hdev);
	598
	599	if (!conn)
	600	return -ENOENT;
	601
	602	return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
	603	}