[mirror_ubuntu-zesty-kernel.git] / net / bluetooth / hci_conn.c

/*
   BlueZ - Bluetooth protocol stack for Linux
   Copyright (C) 2000-2001 Qualcomm Incorporated

   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>

   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License version 2 as
   published by the Free Software Foundation;

   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
   SOFTWARE IS DISCLAIMED.
*/

/* Bluetooth HCI connection handling. */

#include <linux/module.h>

#include <linux/types.h>
#include <linux/errno.h>
#include <linux/kernel.h>
#include <linux/slab.h>
#include <linux/poll.h>
#include <linux/fcntl.h>
#include <linux/init.h>
#include <linux/skbuff.h>
#include <linux/interrupt.h>
#include <linux/notifier.h>
#include <net/sock.h>

#include <asm/system.h>
#include <asm/uaccess.h>
#include <asm/unaligned.h>

#include <net/bluetooth/bluetooth.h>
#include <net/bluetooth/hci_core.h>

void hci_acl_connect(struct hci_conn *conn)
{
	struct hci_dev *hdev = conn->hdev;
	struct inquiry_entry *ie;
	struct hci_cp_create_conn cp;

	BT_DBG("%p", conn);

	conn->state = BT_CONNECT;
	conn->out = 1;

	conn->link_mode = HCI_LM_MASTER;

	conn->attempt++;

	conn->link_policy = hdev->link_policy;

	memset(&cp, 0, sizeof(cp));
	bacpy(&cp.bdaddr, &conn->dst);
	cp.pscan_rep_mode = 0x02;

	if ((ie = hci_inquiry_cache_lookup(hdev, &conn->dst))) {
		if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
			cp.pscan_rep_mode = ie->data.pscan_rep_mode;
			cp.pscan_mode     = ie->data.pscan_mode;
			cp.clock_offset   = ie->data.clock_offset |
							cpu_to_le16(0x8000);
		}

		memcpy(conn->dev_class, ie->data.dev_class, 3);
		conn->ssp_mode = ie->data.ssp_mode;
	}

	cp.pkt_type = cpu_to_le16(conn->pkt_type);
	if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
		cp.role_switch = 0x01;
	else
		cp.role_switch = 0x00;

	hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
}

static void hci_acl_connect_cancel(struct hci_conn *conn)
{
	struct hci_cp_create_conn_cancel cp;

	BT_DBG("%p", conn);

	if (conn->hdev->hci_ver < 2)
		return;

	bacpy(&cp.bdaddr, &conn->dst);
	hci_send_cmd(conn->hdev, HCI_OP_CREATE_CONN_CANCEL, sizeof(cp), &cp);
}

void hci_acl_disconn(struct hci_conn *conn, __u8 reason)
{
	struct hci_cp_disconnect cp;

	BT_DBG("%p", conn);

	conn->state = BT_DISCONN;

	cp.handle = cpu_to_le16(conn->handle);
	cp.reason = reason;
	hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp);
}

void hci_add_sco(struct hci_conn *conn, __u16 handle)
{
	struct hci_dev *hdev = conn->hdev;
	struct hci_cp_add_sco cp;

	BT_DBG("%p", conn);

	conn->state = BT_CONNECT;
	conn->out = 1;

	conn->attempt++;

	cp.handle   = cpu_to_le16(handle);
	cp.pkt_type = cpu_to_le16(conn->pkt_type);

	hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
}

void hci_setup_sync(struct hci_conn *conn, __u16 handle)
{
	struct hci_dev *hdev = conn->hdev;
	struct hci_cp_setup_sync_conn cp;

	BT_DBG("%p", conn);

	conn->state = BT_CONNECT;
	conn->out = 1;

	conn->attempt++;

	cp.handle   = cpu_to_le16(handle);
	cp.pkt_type = cpu_to_le16(conn->pkt_type);

	cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
	cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
	cp.max_latency    = cpu_to_le16(0xffff);
	cp.voice_setting  = cpu_to_le16(hdev->voice_setting);
	cp.retrans_effort = 0xff;

	hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp);
}

static void hci_conn_timeout(unsigned long arg)
{
	struct hci_conn *conn = (void *) arg;
	struct hci_dev *hdev = conn->hdev;

	BT_DBG("conn %p state %d", conn, conn->state);

	if (atomic_read(&conn->refcnt))
		return;

	hci_dev_lock(hdev);

	switch (conn->state) {
	case BT_CONNECT:
	case BT_CONNECT2:
		if (conn->type == ACL_LINK)
			hci_acl_connect_cancel(conn);
		else
			hci_acl_disconn(conn, 0x13);
		break;
	case BT_CONFIG:
	case BT_CONNECTED:
		hci_acl_disconn(conn, 0x13);
		break;
	default:
		conn->state = BT_CLOSED;
		break;
	}

	hci_dev_unlock(hdev);
}

static void hci_conn_idle(unsigned long arg)
{
	struct hci_conn *conn = (void *) arg;

	BT_DBG("conn %p mode %d", conn, conn->mode);

	hci_conn_enter_sniff_mode(conn);
}

struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
{
	struct hci_conn *conn;

	BT_DBG("%s dst %s", hdev->name, batostr(dst));

	conn = kzalloc(sizeof(struct hci_conn), GFP_ATOMIC);
	if (!conn)
		return NULL;

	bacpy(&conn->dst, dst);
	conn->hdev  = hdev;
	conn->type  = type;
	conn->mode  = HCI_CM_ACTIVE;
	conn->state = BT_OPEN;

	conn->power_save = 1;

	switch (type) {
	case ACL_LINK:
		conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
		break;
	case SCO_LINK:
		if (lmp_esco_capable(hdev))
			conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
					(hdev->esco_type & EDR_ESCO_MASK);
		else
			conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
		break;
	case ESCO_LINK:
		conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
		break;
	}

	skb_queue_head_init(&conn->data_q);

	setup_timer(&conn->disc_timer, hci_conn_timeout, (unsigned long)conn);
	setup_timer(&conn->idle_timer, hci_conn_idle, (unsigned long)conn);

	atomic_set(&conn->refcnt, 0);

	hci_dev_hold(hdev);

	tasklet_disable(&hdev->tx_task);

	hci_conn_hash_add(hdev, conn);
	if (hdev->notify)
		hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);

	tasklet_enable(&hdev->tx_task);

	return conn;
}

int hci_conn_del(struct hci_conn *conn)
{
	struct hci_dev *hdev = conn->hdev;

	BT_DBG("%s conn %p handle %d", hdev->name, conn, conn->handle);

	del_timer(&conn->idle_timer);

	del_timer(&conn->disc_timer);

	if (conn->type == ACL_LINK) {
		struct hci_conn *sco = conn->link;
		if (sco)
			sco->link = NULL;

		/* Unacked frames */
		hdev->acl_cnt += conn->sent;
	} else {
		struct hci_conn *acl = conn->link;
		if (acl) {
			acl->link = NULL;
			hci_conn_put(acl);
		}
	}

	tasklet_disable(&hdev->tx_task);

	hci_conn_hash_del(hdev, conn);
	if (hdev->notify)
		hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);

	tasklet_enable(&hdev->tx_task);

	skb_queue_purge(&conn->data_q);

	return 0;
}

struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src)
{
	int use_src = bacmp(src, BDADDR_ANY);
	struct hci_dev *hdev = NULL;
	struct list_head *p;

	BT_DBG("%s -> %s", batostr(src), batostr(dst));

	read_lock_bh(&hci_dev_list_lock);

	list_for_each(p, &hci_dev_list) {
		struct hci_dev *d = list_entry(p, struct hci_dev, list);

		if (!test_bit(HCI_UP, &d->flags) || test_bit(HCI_RAW, &d->flags))
			continue;

		/* Simple routing:
		 *   No source address - find interface with bdaddr != dst
		 *   Source address    - find interface with bdaddr == src
		 */

		if (use_src) {
			if (!bacmp(&d->bdaddr, src)) {
				hdev = d; break;
			}
		} else {
			if (bacmp(&d->bdaddr, dst)) {
				hdev = d; break;
			}
		}
	}

	if (hdev)
		hdev = hci_dev_hold(hdev);

	read_unlock_bh(&hci_dev_list_lock);
	return hdev;
}
EXPORT_SYMBOL(hci_get_route);

/* Create SCO or ACL connection.
 * Device _must_ be locked */
struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, __u8 sec_level, __u8 auth_type)
{
	struct hci_conn *acl;
	struct hci_conn *sco;

	BT_DBG("%s dst %s", hdev->name, batostr(dst));

	if (!(acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst))) {
		if (!(acl = hci_conn_add(hdev, ACL_LINK, dst)))
			return NULL;
	}

	hci_conn_hold(acl);

	if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
		acl->sec_level = sec_level;
		acl->auth_type = auth_type;
		hci_acl_connect(acl);
	}

	if (type == ACL_LINK)
		return acl;

	if (!(sco = hci_conn_hash_lookup_ba(hdev, type, dst))) {
		if (!(sco = hci_conn_add(hdev, type, dst))) {
			hci_conn_put(acl);
			return NULL;
		}
	}

	acl->link = sco;
	sco->link = acl;

	hci_conn_hold(sco);

	if (acl->state == BT_CONNECTED &&
			(sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
		if (lmp_esco_capable(hdev))
			hci_setup_sync(sco, acl->handle);
		else
			hci_add_sco(sco, acl->handle);
	}

	return sco;
}
EXPORT_SYMBOL(hci_connect);

/* Check link security requirement */
int hci_conn_check_link_mode(struct hci_conn *conn)
{
	BT_DBG("conn %p", conn);

	if (conn->ssp_mode > 0 && conn->hdev->ssp_mode > 0 &&
					!(conn->link_mode & HCI_LM_ENCRYPT))
		return 0;

	return 1;
}
EXPORT_SYMBOL(hci_conn_check_link_mode);

/* Authenticate remote device */
static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level)
{
	BT_DBG("conn %p", conn);

	if (sec_level > conn->sec_level)
		conn->link_mode &= ~HCI_LM_AUTH;

	conn->sec_level = sec_level;

	if (sec_level == BT_SECURITY_HIGH)
		conn->auth_type |= 0x01;

	if (conn->link_mode & HCI_LM_AUTH)
		return 1;

	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
		struct hci_cp_auth_requested cp;
		cp.handle = cpu_to_le16(conn->handle);
		hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
							sizeof(cp), &cp);
	}

	return 0;
}

/* Enable security */
int hci_conn_security(struct hci_conn *conn, __u8 sec_level)
{
	BT_DBG("conn %p", conn);

	if (sec_level == BT_SECURITY_SDP)
		return 1;

	if (sec_level == BT_SECURITY_LOW) {
		if (conn->ssp_mode > 0 && conn->hdev->ssp_mode > 0)
			return hci_conn_auth(conn, sec_level);
		else
			return 1;
	}

	if (conn->link_mode & HCI_LM_ENCRYPT)
		return hci_conn_auth(conn, sec_level);

	if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend))
		return 0;

	if (hci_conn_auth(conn, sec_level)) {
		struct hci_cp_set_conn_encrypt cp;
		cp.handle  = cpu_to_le16(conn->handle);
		cp.encrypt = 1;
		hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT,
							sizeof(cp), &cp);
	}

	return 0;
}
EXPORT_SYMBOL(hci_conn_security);

/* Change link key */
int hci_conn_change_link_key(struct hci_conn *conn)
{
	BT_DBG("conn %p", conn);

	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
		struct hci_cp_change_conn_link_key cp;
		cp.handle = cpu_to_le16(conn->handle);
		hci_send_cmd(conn->hdev, HCI_OP_CHANGE_CONN_LINK_KEY,
							sizeof(cp), &cp);
	}

	return 0;
}
EXPORT_SYMBOL(hci_conn_change_link_key);

/* Switch role */
int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
{
	BT_DBG("conn %p", conn);

	if (!role && conn->link_mode & HCI_LM_MASTER)
		return 1;

	if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->pend)) {
		struct hci_cp_switch_role cp;
		bacpy(&cp.bdaddr, &conn->dst);
		cp.role = role;
		hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
	}

	return 0;
}
EXPORT_SYMBOL(hci_conn_switch_role);

/* Enter active mode */
void hci_conn_enter_active_mode(struct hci_conn *conn)
{
	struct hci_dev *hdev = conn->hdev;

	BT_DBG("conn %p mode %d", conn, conn->mode);

	if (test_bit(HCI_RAW, &hdev->flags))
		return;

	if (conn->mode != HCI_CM_SNIFF || !conn->power_save)
		goto timer;

	if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
		struct hci_cp_exit_sniff_mode cp;
		cp.handle = cpu_to_le16(conn->handle);
		hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
	}

timer:
	if (hdev->idle_timeout > 0)
		mod_timer(&conn->idle_timer,
			jiffies + msecs_to_jiffies(hdev->idle_timeout));
}

/* Enter sniff mode */
void hci_conn_enter_sniff_mode(struct hci_conn *conn)
{
	struct hci_dev *hdev = conn->hdev;

	BT_DBG("conn %p mode %d", conn, conn->mode);

	if (test_bit(HCI_RAW, &hdev->flags))
		return;

	if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn))
		return;

	if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF))
		return;

	if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
		struct hci_cp_sniff_subrate cp;
		cp.handle             = cpu_to_le16(conn->handle);
		cp.max_latency        = cpu_to_le16(0);
		cp.min_remote_timeout = cpu_to_le16(0);
		cp.min_local_timeout  = cpu_to_le16(0);
		hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
	}

	if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
		struct hci_cp_sniff_mode cp;
		cp.handle       = cpu_to_le16(conn->handle);
		cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
		cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
		cp.attempt      = cpu_to_le16(4);
		cp.timeout      = cpu_to_le16(1);
		hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
	}
}

/* Drop all connection on the device */
void hci_conn_hash_flush(struct hci_dev *hdev)
{
	struct hci_conn_hash *h = &hdev->conn_hash;
	struct list_head *p;

	BT_DBG("hdev %s", hdev->name);

	p = h->list.next;
	while (p != &h->list) {
		struct hci_conn *c;

		c = list_entry(p, struct hci_conn, list);
		p = p->next;

		c->state = BT_CLOSED;

		hci_conn_del_sysfs(c);

		hci_proto_disconn_ind(c, 0x16);
		hci_conn_del(c);
	}
}

/* Check pending connect attempts */
void hci_conn_check_pending(struct hci_dev *hdev)
{
	struct hci_conn *conn;

	BT_DBG("hdev %s", hdev->name);

	hci_dev_lock(hdev);

	conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
	if (conn)
		hci_acl_connect(conn);

	hci_dev_unlock(hdev);
}

int hci_get_conn_list(void __user *arg)
{
	struct hci_conn_list_req req, *cl;
	struct hci_conn_info *ci;
	struct hci_dev *hdev;
	struct list_head *p;
	int n = 0, size, err;

	if (copy_from_user(&req, arg, sizeof(req)))
		return -EFAULT;

	if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
		return -EINVAL;

	size = sizeof(req) + req.conn_num * sizeof(*ci);

	if (!(cl = kmalloc(size, GFP_KERNEL)))
		return -ENOMEM;

	if (!(hdev = hci_dev_get(req.dev_id))) {
		kfree(cl);
		return -ENODEV;
	}

	ci = cl->conn_info;

	hci_dev_lock_bh(hdev);
	list_for_each(p, &hdev->conn_hash.list) {
		register struct hci_conn *c;
		c = list_entry(p, struct hci_conn, list);

		bacpy(&(ci + n)->bdaddr, &c->dst);
		(ci + n)->handle = c->handle;
		(ci + n)->type  = c->type;
		(ci + n)->out   = c->out;
		(ci + n)->state = c->state;
		(ci + n)->link_mode = c->link_mode;
		if (++n >= req.conn_num)
			break;
	}
	hci_dev_unlock_bh(hdev);

	cl->dev_id = hdev->id;
	cl->conn_num = n;
	size = sizeof(req) + n * sizeof(*ci);

	hci_dev_put(hdev);

	err = copy_to_user(arg, cl, size);
	kfree(cl);

	return err ? -EFAULT : 0;
}

int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
{
	struct hci_conn_info_req req;
	struct hci_conn_info ci;
	struct hci_conn *conn;
	char __user *ptr = arg + sizeof(req);

	if (copy_from_user(&req, arg, sizeof(req)))
		return -EFAULT;

	hci_dev_lock_bh(hdev);
	conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
	if (conn) {
		bacpy(&ci.bdaddr, &conn->dst);
		ci.handle = conn->handle;
		ci.type  = conn->type;
		ci.out   = conn->out;
		ci.state = conn->state;
		ci.link_mode = conn->link_mode;
	}
	hci_dev_unlock_bh(hdev);

	if (!conn)
		return -ENOENT;

	return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
}

int hci_get_auth_info(struct hci_dev *hdev, void __user *arg)
{
	struct hci_auth_info_req req;
	struct hci_conn *conn;

	if (copy_from_user(&req, arg, sizeof(req)))
		return -EFAULT;

	hci_dev_lock_bh(hdev);
	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr);
	if (conn)
		req.type = conn->auth_type;
	hci_dev_unlock_bh(hdev);

	if (!conn)
		return -ENOENT;

	return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0;
}
Commit	Line	Data
8e87d142	1	/*
1da177e4 LT	2	BlueZ - Bluetooth protocol stack for Linux
	3	Copyright (C) 2000-2001 Qualcomm Incorporated
	4
	5	Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
	6
	7	This program is free software; you can redistribute it and/or modify
	8	it under the terms of the GNU General Public License version 2 as
	9	published by the Free Software Foundation;
	10
	11	THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
	12	OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
	13	FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
	14	IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142 YH	15	CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
	16	WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
	17	ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4 LT	18	OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
1da177e4 LT	19
8e87d142 YH	20	ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
8e87d142 YH	21	COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4 LT	22	SOFTWARE IS DISCLAIMED.
	23	*/
	24
	25	/* Bluetooth HCI connection handling. */
	26
1da177e4 LT	27	#include <linux/module.h>
	28
	29	#include <linux/types.h>
	30	#include <linux/errno.h>
	31	#include <linux/kernel.h>
1da177e4 LT	32	#include <linux/slab.h>
	33	#include <linux/poll.h>
	34	#include <linux/fcntl.h>
	35	#include <linux/init.h>
	36	#include <linux/skbuff.h>
	37	#include <linux/interrupt.h>
	38	#include <linux/notifier.h>
	39	#include <net/sock.h>
	40
	41	#include <asm/system.h>
	42	#include <asm/uaccess.h>
	43	#include <asm/unaligned.h>
	44
	45	#include <net/bluetooth/bluetooth.h>
	46	#include <net/bluetooth/hci_core.h>
	47
4c67bc74	48	void hci_acl_connect(struct hci_conn *conn)
1da177e4 LT	49	{
	50	struct hci_dev *hdev = conn->hdev;
	51	struct inquiry_entry *ie;
	52	struct hci_cp_create_conn cp;
	53
	54	BT_DBG("%p", conn);
	55
	56	conn->state = BT_CONNECT;
a8746417 MH	57	conn->out = 1;
a8746417 MH	58
1da177e4 LT	59	conn->link_mode = HCI_LM_MASTER;
1da177e4 LT	60
4c67bc74 MH	61	conn->attempt++;
4c67bc74 MH	62
e4e8e37c MH	63	conn->link_policy = hdev->link_policy;
e4e8e37c MH	64
1da177e4 LT	65	memset(&cp, 0, sizeof(cp));
	66	bacpy(&cp.bdaddr, &conn->dst);
	67	cp.pscan_rep_mode = 0x02;
	68
41a96212 MH	69	if ((ie = hci_inquiry_cache_lookup(hdev, &conn->dst))) {
	70	if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
	71	cp.pscan_rep_mode = ie->data.pscan_rep_mode;
	72	cp.pscan_mode = ie->data.pscan_mode;
	73	cp.clock_offset = ie->data.clock_offset \|
	74	cpu_to_le16(0x8000);
	75	}
	76
1da177e4	77	memcpy(conn->dev_class, ie->data.dev_class, 3);
41a96212	78	conn->ssp_mode = ie->data.ssp_mode;
1da177e4 LT	79	}
1da177e4 LT	80
a8746417	81	cp.pkt_type = cpu_to_le16(conn->pkt_type);
1da177e4	82	if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
b6a0dc82	83	cp.role_switch = 0x01;
1da177e4	84	else
b6a0dc82	85	cp.role_switch = 0x00;
4c67bc74	86
a9de9248	87	hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
1da177e4 LT	88	}
1da177e4 LT	89
6ac59344 MH	90	static void hci_acl_connect_cancel(struct hci_conn *conn)
	91	{
	92	struct hci_cp_create_conn_cancel cp;
	93
	94	BT_DBG("%p", conn);
	95
	96	if (conn->hdev->hci_ver < 2)
	97	return;
	98
	99	bacpy(&cp.bdaddr, &conn->dst);
a9de9248	100	hci_send_cmd(conn->hdev, HCI_OP_CREATE_CONN_CANCEL, sizeof(cp), &cp);
6ac59344 MH	101	}
6ac59344 MH	102
1da177e4 LT	103	void hci_acl_disconn(struct hci_conn *conn, __u8 reason)
	104	{
	105	struct hci_cp_disconnect cp;
	106
	107	BT_DBG("%p", conn);
	108
	109	conn->state = BT_DISCONN;
	110
aca3192c	111	cp.handle = cpu_to_le16(conn->handle);
1da177e4	112	cp.reason = reason;
a9de9248	113	hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp);
1da177e4 LT	114	}
	115
	116	void hci_add_sco(struct hci_conn *conn, __u16 handle)
	117	{
	118	struct hci_dev *hdev = conn->hdev;
	119	struct hci_cp_add_sco cp;
	120
	121	BT_DBG("%p", conn);
	122
	123	conn->state = BT_CONNECT;
	124	conn->out = 1;
	125
efc7688b MH	126	conn->attempt++;
efc7688b MH	127
aca3192c	128	cp.handle = cpu_to_le16(handle);
a8746417	129	cp.pkt_type = cpu_to_le16(conn->pkt_type);
1da177e4	130
a9de9248	131	hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
1da177e4 LT	132	}
1da177e4 LT	133
b6a0dc82 MH	134	void hci_setup_sync(struct hci_conn *conn, __u16 handle)
	135	{
	136	struct hci_dev *hdev = conn->hdev;
	137	struct hci_cp_setup_sync_conn cp;
	138
	139	BT_DBG("%p", conn);
	140
	141	conn->state = BT_CONNECT;
	142	conn->out = 1;
	143
efc7688b MH	144	conn->attempt++;
efc7688b MH	145
b6a0dc82	146	cp.handle = cpu_to_le16(handle);
a8746417	147	cp.pkt_type = cpu_to_le16(conn->pkt_type);
b6a0dc82 MH	148
	149	cp.tx_bandwidth = cpu_to_le32(0x00001f40);
	150	cp.rx_bandwidth = cpu_to_le32(0x00001f40);
	151	cp.max_latency = cpu_to_le16(0xffff);
	152	cp.voice_setting = cpu_to_le16(hdev->voice_setting);
	153	cp.retrans_effort = 0xff;
	154
	155	hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp);
	156	}
	157
1da177e4 LT	158	static void hci_conn_timeout(unsigned long arg)
1da177e4 LT	159	{
04837f64 MH	160	struct hci_conn conn = (void ) arg;
04837f64 MH	161	struct hci_dev *hdev = conn->hdev;
1da177e4 LT	162
	163	BT_DBG("conn %p state %d", conn, conn->state);
	164
	165	if (atomic_read(&conn->refcnt))
	166	return;
	167
	168	hci_dev_lock(hdev);
6ac59344 MH	169
	170	switch (conn->state) {
	171	case BT_CONNECT:
769be974	172	case BT_CONNECT2:
b6a0dc82 MH	173	if (conn->type == ACL_LINK)
	174	hci_acl_connect_cancel(conn);
	175	else
	176	hci_acl_disconn(conn, 0x13);
6ac59344	177	break;
769be974	178	case BT_CONFIG:
8e87d142	179	case BT_CONNECTED:
1da177e4	180	hci_acl_disconn(conn, 0x13);
6ac59344 MH	181	break;
6ac59344 MH	182	default:
1da177e4	183	conn->state = BT_CLOSED;
6ac59344 MH	184	break;
	185	}
	186
1da177e4	187	hci_dev_unlock(hdev);
1da177e4 LT	188	}
1da177e4 LT	189
04837f64	190	static void hci_conn_idle(unsigned long arg)
1da177e4	191	{
04837f64 MH	192	struct hci_conn conn = (void ) arg;
	193
	194	BT_DBG("conn %p mode %d", conn, conn->mode);
	195
	196	hci_conn_enter_sniff_mode(conn);
1da177e4 LT	197	}
	198
	199	struct hci_conn hci_conn_add(struct hci_dev hdev, int type, bdaddr_t *dst)
	200	{
	201	struct hci_conn *conn;
	202
	203	BT_DBG("%s dst %s", hdev->name, batostr(dst));
	204
04837f64 MH	205	conn = kzalloc(sizeof(struct hci_conn), GFP_ATOMIC);
04837f64 MH	206	if (!conn)
1da177e4	207	return NULL;
1da177e4 LT	208
1da177e4 LT	209	bacpy(&conn->dst, dst);
a8746417 MH	210	conn->hdev = hdev;
	211	conn->type = type;
	212	conn->mode = HCI_CM_ACTIVE;
	213	conn->state = BT_OPEN;
1da177e4	214
04837f64 MH	215	conn->power_save = 1;
04837f64 MH	216
a8746417 MH	217	switch (type) {
	218	case ACL_LINK:
	219	conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
	220	break;
	221	case SCO_LINK:
	222	if (lmp_esco_capable(hdev))
efc7688b MH	223	conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) \|
efc7688b MH	224	(hdev->esco_type & EDR_ESCO_MASK);
a8746417 MH	225	else
	226	conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
	227	break;
	228	case ESCO_LINK:
efc7688b	229	conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
a8746417 MH	230	break;
	231	}
	232
1da177e4	233	skb_queue_head_init(&conn->data_q);
04837f64	234
b24b8a24 PE	235	setup_timer(&conn->disc_timer, hci_conn_timeout, (unsigned long)conn);
b24b8a24 PE	236	setup_timer(&conn->idle_timer, hci_conn_idle, (unsigned long)conn);
1da177e4 LT	237
	238	atomic_set(&conn->refcnt, 0);
	239
	240	hci_dev_hold(hdev);
	241
	242	tasklet_disable(&hdev->tx_task);
	243
	244	hci_conn_hash_add(hdev, conn);
	245	if (hdev->notify)
	246	hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
	247
	248	tasklet_enable(&hdev->tx_task);
	249
	250	return conn;
	251	}
	252
	253	int hci_conn_del(struct hci_conn *conn)
	254	{
	255	struct hci_dev *hdev = conn->hdev;
	256
	257	BT_DBG("%s conn %p handle %d", hdev->name, conn, conn->handle);
	258
04837f64 MH	259	del_timer(&conn->idle_timer);
	260
	261	del_timer(&conn->disc_timer);
1da177e4	262
5b7f9909	263	if (conn->type == ACL_LINK) {
1da177e4 LT	264	struct hci_conn *sco = conn->link;
	265	if (sco)
	266	sco->link = NULL;
	267
	268	/* Unacked frames */
	269	hdev->acl_cnt += conn->sent;
5b7f9909 MH	270	} else {
	271	struct hci_conn *acl = conn->link;
	272	if (acl) {
	273	acl->link = NULL;
	274	hci_conn_put(acl);
	275	}
1da177e4 LT	276	}
	277
	278	tasklet_disable(&hdev->tx_task);
7d0db0a3	279
1da177e4 LT	280	hci_conn_hash_del(hdev, conn);
	281	if (hdev->notify)
	282	hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
7d0db0a3	283
1da177e4	284	tasklet_enable(&hdev->tx_task);
7d0db0a3	285
1da177e4	286	skb_queue_purge(&conn->data_q);
1da177e4	287
1da177e4 LT	288	return 0;
	289	}
	290
	291	struct hci_dev hci_get_route(bdaddr_t dst, bdaddr_t *src)
	292	{
	293	int use_src = bacmp(src, BDADDR_ANY);
	294	struct hci_dev *hdev = NULL;
	295	struct list_head *p;
	296
	297	BT_DBG("%s -> %s", batostr(src), batostr(dst));
	298
	299	read_lock_bh(&hci_dev_list_lock);
	300
	301	list_for_each(p, &hci_dev_list) {
	302	struct hci_dev *d = list_entry(p, struct hci_dev, list);
	303
	304	if (!test_bit(HCI_UP, &d->flags) \|\| test_bit(HCI_RAW, &d->flags))
	305	continue;
	306
8e87d142	307	/* Simple routing:
1da177e4 LT	308	* No source address - find interface with bdaddr != dst
	309	* Source address - find interface with bdaddr == src
	310	*/
	311
	312	if (use_src) {
	313	if (!bacmp(&d->bdaddr, src)) {
	314	hdev = d; break;
	315	}
	316	} else {
	317	if (bacmp(&d->bdaddr, dst)) {
	318	hdev = d; break;
	319	}
	320	}
	321	}
	322
	323	if (hdev)
	324	hdev = hci_dev_hold(hdev);
	325
	326	read_unlock_bh(&hci_dev_list_lock);
	327	return hdev;
	328	}
	329	EXPORT_SYMBOL(hci_get_route);
	330
	331	/* Create SCO or ACL connection.
	332	* Device _must_ be locked */
8c1b2355	333	struct hci_conn hci_connect(struct hci_dev hdev, int type, bdaddr_t *dst, __u8 sec_level, __u8 auth_type)
1da177e4 LT	334	{
1da177e4 LT	335	struct hci_conn *acl;
5b7f9909	336	struct hci_conn *sco;
1da177e4 LT	337
	338	BT_DBG("%s dst %s", hdev->name, batostr(dst));
	339
	340	if (!(acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst))) {
	341	if (!(acl = hci_conn_add(hdev, ACL_LINK, dst)))
	342	return NULL;
	343	}
	344
	345	hci_conn_hold(acl);
	346
09ab6f4c	347	if (acl->state == BT_OPEN \|\| acl->state == BT_CLOSED) {
8c1b2355	348	acl->sec_level = sec_level;
09ab6f4c	349	acl->auth_type = auth_type;
1da177e4	350	hci_acl_connect(acl);
09ab6f4c	351	}
1da177e4	352
5b7f9909 MH	353	if (type == ACL_LINK)
5b7f9909 MH	354	return acl;
1da177e4	355
5b7f9909 MH	356	if (!(sco = hci_conn_hash_lookup_ba(hdev, type, dst))) {
	357	if (!(sco = hci_conn_add(hdev, type, dst))) {
	358	hci_conn_put(acl);
	359	return NULL;
1da177e4	360	}
5b7f9909	361	}
1da177e4	362
5b7f9909 MH	363	acl->link = sco;
5b7f9909 MH	364	sco->link = acl;
1da177e4	365
5b7f9909	366	hci_conn_hold(sco);
1da177e4	367
5b7f9909	368	if (acl->state == BT_CONNECTED &&
b6a0dc82 MH	369	(sco->state == BT_OPEN \|\| sco->state == BT_CLOSED)) {
	370	if (lmp_esco_capable(hdev))
	371	hci_setup_sync(sco, acl->handle);
	372	else
	373	hci_add_sco(sco, acl->handle);
	374	}
5b7f9909 MH	375
5b7f9909 MH	376	return sco;
1da177e4 LT	377	}
	378	EXPORT_SYMBOL(hci_connect);
	379
e7c29cb1 MH	380	/* Check link security requirement */
	381	int hci_conn_check_link_mode(struct hci_conn *conn)
	382	{
	383	BT_DBG("conn %p", conn);
	384
	385	if (conn->ssp_mode > 0 && conn->hdev->ssp_mode > 0 &&
	386	!(conn->link_mode & HCI_LM_ENCRYPT))
	387	return 0;
	388
	389	return 1;
	390	}
	391	EXPORT_SYMBOL(hci_conn_check_link_mode);
	392
1da177e4	393	/* Authenticate remote device */
8c1b2355	394	static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level)
1da177e4 LT	395	{
	396	BT_DBG("conn %p", conn);
	397
8c1b2355 MH	398	if (sec_level > conn->sec_level)
	399	conn->link_mode &= ~HCI_LM_AUTH;
	400
	401	conn->sec_level = sec_level;
	402
	403	if (sec_level == BT_SECURITY_HIGH)
	404	conn->auth_type \|= 0x01;
40be492f	405
1da177e4 LT	406	if (conn->link_mode & HCI_LM_AUTH)
	407	return 1;
	408
	409	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
	410	struct hci_cp_auth_requested cp;
aca3192c	411	cp.handle = cpu_to_le16(conn->handle);
40be492f MH	412	hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
40be492f MH	413	sizeof(cp), &cp);
1da177e4	414	}
8c1b2355	415
1da177e4 LT	416	return 0;
1da177e4 LT	417	}
1da177e4	418
8c1b2355 MH	419	/* Enable security */
8c1b2355 MH	420	int hci_conn_security(struct hci_conn *conn, __u8 sec_level)
1da177e4 LT	421	{
	422	BT_DBG("conn %p", conn);
	423
8c1b2355 MH	424	if (sec_level == BT_SECURITY_SDP)
	425	return 1;
	426
	427	if (sec_level == BT_SECURITY_LOW) {
	428	if (conn->ssp_mode > 0 && conn->hdev->ssp_mode > 0)
	429	return hci_conn_auth(conn, sec_level);
	430	else
	431	return 1;
	432	}
	433
1da177e4	434	if (conn->link_mode & HCI_LM_ENCRYPT)
8c1b2355	435	return hci_conn_auth(conn, sec_level);
1da177e4 LT	436
	437	if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend))
	438	return 0;
	439
8c1b2355	440	if (hci_conn_auth(conn, sec_level)) {
1da177e4	441	struct hci_cp_set_conn_encrypt cp;
aca3192c	442	cp.handle = cpu_to_le16(conn->handle);
8e87d142	443	cp.encrypt = 1;
40be492f MH	444	hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT,
40be492f MH	445	sizeof(cp), &cp);
1da177e4	446	}
8c1b2355	447
1da177e4 LT	448	return 0;
1da177e4 LT	449	}
8c1b2355	450	EXPORT_SYMBOL(hci_conn_security);
1da177e4 LT	451
	452	/* Change link key */
	453	int hci_conn_change_link_key(struct hci_conn *conn)
	454	{
	455	BT_DBG("conn %p", conn);
	456
	457	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
	458	struct hci_cp_change_conn_link_key cp;
aca3192c	459	cp.handle = cpu_to_le16(conn->handle);
40be492f MH	460	hci_send_cmd(conn->hdev, HCI_OP_CHANGE_CONN_LINK_KEY,
40be492f MH	461	sizeof(cp), &cp);
1da177e4	462	}
8c1b2355	463
1da177e4 LT	464	return 0;
	465	}
	466	EXPORT_SYMBOL(hci_conn_change_link_key);
	467
	468	/* Switch role */
8c1b2355	469	int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
1da177e4 LT	470	{
	471	BT_DBG("conn %p", conn);
	472
	473	if (!role && conn->link_mode & HCI_LM_MASTER)
	474	return 1;
	475
	476	if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->pend)) {
	477	struct hci_cp_switch_role cp;
	478	bacpy(&cp.bdaddr, &conn->dst);
	479	cp.role = role;
a9de9248	480	hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
1da177e4	481	}
8c1b2355	482
1da177e4 LT	483	return 0;
	484	}
	485	EXPORT_SYMBOL(hci_conn_switch_role);
	486
04837f64 MH	487	/* Enter active mode */
	488	void hci_conn_enter_active_mode(struct hci_conn *conn)
	489	{
	490	struct hci_dev *hdev = conn->hdev;
	491
	492	BT_DBG("conn %p mode %d", conn, conn->mode);
	493
	494	if (test_bit(HCI_RAW, &hdev->flags))
	495	return;
	496
	497	if (conn->mode != HCI_CM_SNIFF \|\| !conn->power_save)
	498	goto timer;
	499
	500	if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
	501	struct hci_cp_exit_sniff_mode cp;
aca3192c	502	cp.handle = cpu_to_le16(conn->handle);
a9de9248	503	hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
04837f64 MH	504	}
	505
	506	timer:
	507	if (hdev->idle_timeout > 0)
	508	mod_timer(&conn->idle_timer,
	509	jiffies + msecs_to_jiffies(hdev->idle_timeout));
	510	}
	511
	512	/* Enter sniff mode */
	513	void hci_conn_enter_sniff_mode(struct hci_conn *conn)
	514	{
	515	struct hci_dev *hdev = conn->hdev;
	516
	517	BT_DBG("conn %p mode %d", conn, conn->mode);
	518
	519	if (test_bit(HCI_RAW, &hdev->flags))
	520	return;
	521
	522	if (!lmp_sniff_capable(hdev) \|\| !lmp_sniff_capable(conn))
	523	return;
	524
	525	if (conn->mode != HCI_CM_ACTIVE \|\| !(conn->link_policy & HCI_LP_SNIFF))
	526	return;
	527
	528	if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
	529	struct hci_cp_sniff_subrate cp;
aca3192c YH	530	cp.handle = cpu_to_le16(conn->handle);
	531	cp.max_latency = cpu_to_le16(0);
	532	cp.min_remote_timeout = cpu_to_le16(0);
	533	cp.min_local_timeout = cpu_to_le16(0);
a9de9248	534	hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
04837f64 MH	535	}
	536
	537	if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
	538	struct hci_cp_sniff_mode cp;
aca3192c YH	539	cp.handle = cpu_to_le16(conn->handle);
	540	cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
	541	cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
	542	cp.attempt = cpu_to_le16(4);
	543	cp.timeout = cpu_to_le16(1);
a9de9248	544	hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
04837f64 MH	545	}
	546	}
	547
1da177e4 LT	548	/* Drop all connection on the device */
	549	void hci_conn_hash_flush(struct hci_dev *hdev)
	550	{
	551	struct hci_conn_hash *h = &hdev->conn_hash;
	552	struct list_head *p;
	553
	554	BT_DBG("hdev %s", hdev->name);
	555
	556	p = h->list.next;
	557	while (p != &h->list) {
	558	struct hci_conn *c;
	559
	560	c = list_entry(p, struct hci_conn, list);
	561	p = p->next;
	562
	563	c->state = BT_CLOSED;
	564
7d0db0a3 MH	565	hci_conn_del_sysfs(c);
7d0db0a3 MH	566
1da177e4 LT	567	hci_proto_disconn_ind(c, 0x16);
	568	hci_conn_del(c);
	569	}
	570	}
	571
a9de9248 MH	572	/* Check pending connect attempts */
	573	void hci_conn_check_pending(struct hci_dev *hdev)
	574	{
	575	struct hci_conn *conn;
	576
	577	BT_DBG("hdev %s", hdev->name);
	578
	579	hci_dev_lock(hdev);
	580
	581	conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
	582	if (conn)
	583	hci_acl_connect(conn);
	584
	585	hci_dev_unlock(hdev);
	586	}
	587
1da177e4 LT	588	int hci_get_conn_list(void __user *arg)
	589	{
	590	struct hci_conn_list_req req, *cl;
	591	struct hci_conn_info *ci;
	592	struct hci_dev *hdev;
	593	struct list_head *p;
	594	int n = 0, size, err;
	595
	596	if (copy_from_user(&req, arg, sizeof(req)))
	597	return -EFAULT;
	598
	599	if (!req.conn_num \|\| req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
	600	return -EINVAL;
	601
	602	size = sizeof(req) + req.conn_num * sizeof(*ci);
	603
12fe2c58	604	if (!(cl = kmalloc(size, GFP_KERNEL)))
1da177e4 LT	605	return -ENOMEM;
	606
	607	if (!(hdev = hci_dev_get(req.dev_id))) {
	608	kfree(cl);
	609	return -ENODEV;
	610	}
	611
	612	ci = cl->conn_info;
	613
	614	hci_dev_lock_bh(hdev);
	615	list_for_each(p, &hdev->conn_hash.list) {
	616	register struct hci_conn *c;
	617	c = list_entry(p, struct hci_conn, list);
	618
	619	bacpy(&(ci + n)->bdaddr, &c->dst);
	620	(ci + n)->handle = c->handle;
	621	(ci + n)->type = c->type;
	622	(ci + n)->out = c->out;
	623	(ci + n)->state = c->state;
	624	(ci + n)->link_mode = c->link_mode;
	625	if (++n >= req.conn_num)
	626	break;
	627	}
	628	hci_dev_unlock_bh(hdev);
	629
	630	cl->dev_id = hdev->id;
	631	cl->conn_num = n;
	632	size = sizeof(req) + n * sizeof(*ci);
	633
	634	hci_dev_put(hdev);
	635
	636	err = copy_to_user(arg, cl, size);
	637	kfree(cl);
	638
	639	return err ? -EFAULT : 0;
	640	}
	641
	642	int hci_get_conn_info(struct hci_dev hdev, void __user arg)
	643	{
	644	struct hci_conn_info_req req;
	645	struct hci_conn_info ci;
	646	struct hci_conn *conn;
	647	char __user *ptr = arg + sizeof(req);
	648
	649	if (copy_from_user(&req, arg, sizeof(req)))
	650	return -EFAULT;
	651
	652	hci_dev_lock_bh(hdev);
	653	conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
	654	if (conn) {
	655	bacpy(&ci.bdaddr, &conn->dst);
	656	ci.handle = conn->handle;
	657	ci.type = conn->type;
	658	ci.out = conn->out;
	659	ci.state = conn->state;
	660	ci.link_mode = conn->link_mode;
	661	}
	662	hci_dev_unlock_bh(hdev);
	663
	664	if (!conn)
	665	return -ENOENT;
	666
	667	return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
	668	}
40be492f MH	669
	670	int hci_get_auth_info(struct hci_dev hdev, void __user arg)
	671	{
	672	struct hci_auth_info_req req;
	673	struct hci_conn *conn;
	674
	675	if (copy_from_user(&req, arg, sizeof(req)))
	676	return -EFAULT;
	677
	678	hci_dev_lock_bh(hdev);
	679	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr);
	680	if (conn)
	681	req.type = conn->auth_type;
	682	hci_dev_unlock_bh(hdev);
	683
	684	if (!conn)
	685	return -ENOENT;
	686
	687	return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0;
	688	}