[deliverable/linux.git] / net / bluetooth / hci_conn.c

/*
   BlueZ - Bluetooth protocol stack for Linux
   Copyright (C) 2000-2001 Qualcomm Incorporated

   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>

   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License version 2 as
   published by the Free Software Foundation;

   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
   SOFTWARE IS DISCLAIMED.
*/

/* Bluetooth HCI connection handling. */

#include <linux/module.h>

#include <linux/types.h>
#include <linux/errno.h>
#include <linux/kernel.h>
#include <linux/slab.h>
#include <linux/poll.h>
#include <linux/fcntl.h>
#include <linux/init.h>
#include <linux/skbuff.h>
#include <linux/interrupt.h>
#include <linux/notifier.h>
#include <net/sock.h>

#include <asm/system.h>
#include <asm/uaccess.h>
#include <asm/unaligned.h>

#include <net/bluetooth/bluetooth.h>
#include <net/bluetooth/hci_core.h>

#ifndef CONFIG_BT_HCI_CORE_DEBUG
#undef  BT_DBG
#define BT_DBG(D...)
#endif

void hci_acl_connect(struct hci_conn *conn)
{
	struct hci_dev *hdev = conn->hdev;
	struct inquiry_entry *ie;
	struct hci_cp_create_conn cp;

	BT_DBG("%p", conn);

	conn->state = BT_CONNECT;
	conn->out   = 1;
	conn->link_mode = HCI_LM_MASTER;

	conn->attempt++;

	memset(&cp, 0, sizeof(cp));
	bacpy(&cp.bdaddr, &conn->dst);
	cp.pscan_rep_mode = 0x02;

	if ((ie = hci_inquiry_cache_lookup(hdev, &conn->dst)) &&
			inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
		cp.pscan_rep_mode = ie->data.pscan_rep_mode;
		cp.pscan_mode     = ie->data.pscan_mode;
		cp.clock_offset   = ie->data.clock_offset | cpu_to_le16(0x8000);
		memcpy(conn->dev_class, ie->data.dev_class, 3);
	}

	cp.pkt_type = cpu_to_le16(hdev->pkt_type & ACL_PTYPE_MASK);
	if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
		cp.role_switch	= 0x01;
	else
		cp.role_switch	= 0x00;

	hci_send_cmd(hdev, OGF_LINK_CTL, OCF_CREATE_CONN, sizeof(cp), &cp);
}

static void hci_acl_connect_cancel(struct hci_conn *conn)
{
	struct hci_cp_create_conn_cancel cp;

	BT_DBG("%p", conn);

	if (conn->hdev->hci_ver < 2)
		return;

	bacpy(&cp.bdaddr, &conn->dst);
	hci_send_cmd(conn->hdev, OGF_LINK_CTL,
				OCF_CREATE_CONN_CANCEL, sizeof(cp), &cp);
}

void hci_acl_disconn(struct hci_conn *conn, __u8 reason)
{
	struct hci_cp_disconnect cp;

	BT_DBG("%p", conn);

	conn->state = BT_DISCONN;

	cp.handle = cpu_to_le16(conn->handle);
	cp.reason = reason;
	hci_send_cmd(conn->hdev, OGF_LINK_CTL,
				OCF_DISCONNECT, sizeof(cp), &cp);
}

void hci_add_sco(struct hci_conn *conn, __u16 handle)
{
	struct hci_dev *hdev = conn->hdev;
	struct hci_cp_add_sco cp;

	BT_DBG("%p", conn);

	conn->state = BT_CONNECT;
	conn->out = 1;

	cp.handle   = cpu_to_le16(handle);
	cp.pkt_type = cpu_to_le16(hdev->pkt_type & SCO_PTYPE_MASK);

	hci_send_cmd(hdev, OGF_LINK_CTL, OCF_ADD_SCO, sizeof(cp), &cp);
}

static void hci_conn_timeout(unsigned long arg)
{
	struct hci_conn *conn = (void *) arg;
	struct hci_dev *hdev = conn->hdev;

	BT_DBG("conn %p state %d", conn, conn->state);

	if (atomic_read(&conn->refcnt))
		return;

	hci_dev_lock(hdev);

	switch (conn->state) {
	case BT_CONNECT:
		hci_acl_connect_cancel(conn);
		break;
	case BT_CONNECTED:
		hci_acl_disconn(conn, 0x13);
		break;
	default:
		conn->state = BT_CLOSED;
		break;
	}

	hci_dev_unlock(hdev);
}

static void hci_conn_idle(unsigned long arg)
{
	struct hci_conn *conn = (void *) arg;

	BT_DBG("conn %p mode %d", conn, conn->mode);

	hci_conn_enter_sniff_mode(conn);
}

struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
{
	struct hci_conn *conn;

	BT_DBG("%s dst %s", hdev->name, batostr(dst));

	conn = kzalloc(sizeof(struct hci_conn), GFP_ATOMIC);
	if (!conn)
		return NULL;

	bacpy(&conn->dst, dst);
	conn->hdev   = hdev;
	conn->type   = type;
	conn->mode   = HCI_CM_ACTIVE;
	conn->state  = BT_OPEN;

	conn->power_save = 1;

	skb_queue_head_init(&conn->data_q);

	init_timer(&conn->disc_timer);
	conn->disc_timer.function = hci_conn_timeout;
	conn->disc_timer.data = (unsigned long) conn;

	init_timer(&conn->idle_timer);
	conn->idle_timer.function = hci_conn_idle;
	conn->idle_timer.data = (unsigned long) conn;

	atomic_set(&conn->refcnt, 0);

	hci_dev_hold(hdev);

	tasklet_disable(&hdev->tx_task);

	hci_conn_hash_add(hdev, conn);
	if (hdev->notify)
		hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);

	hci_conn_add_sysfs(conn);

	tasklet_enable(&hdev->tx_task);

	return conn;
}

int hci_conn_del(struct hci_conn *conn)
{
	struct hci_dev *hdev = conn->hdev;

	BT_DBG("%s conn %p handle %d", hdev->name, conn, conn->handle);

	del_timer(&conn->idle_timer);

	del_timer(&conn->disc_timer);

	if (conn->type == ACL_LINK) {
		struct hci_conn *sco = conn->link;
		if (sco)
			sco->link = NULL;

		/* Unacked frames */
		hdev->acl_cnt += conn->sent;
	} else {
		struct hci_conn *acl = conn->link;
		if (acl) {
			acl->link = NULL;
			hci_conn_put(acl);
		}
	}

	tasklet_disable(&hdev->tx_task);

	hci_conn_del_sysfs(conn);

	hci_conn_hash_del(hdev, conn);
	if (hdev->notify)
		hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);

	tasklet_enable(&hdev->tx_task);

	skb_queue_purge(&conn->data_q);

	hci_dev_put(hdev);

	/* will free via device release */
	put_device(&conn->dev);

	return 0;
}

struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src)
{
	int use_src = bacmp(src, BDADDR_ANY);
	struct hci_dev *hdev = NULL;
	struct list_head *p;

	BT_DBG("%s -> %s", batostr(src), batostr(dst));

	read_lock_bh(&hci_dev_list_lock);

	list_for_each(p, &hci_dev_list) {
		struct hci_dev *d = list_entry(p, struct hci_dev, list);

		if (!test_bit(HCI_UP, &d->flags) || test_bit(HCI_RAW, &d->flags))
			continue;

		/* Simple routing:
		 *   No source address - find interface with bdaddr != dst
		 *   Source address    - find interface with bdaddr == src
		 */

		if (use_src) {
			if (!bacmp(&d->bdaddr, src)) {
				hdev = d; break;
			}
		} else {
			if (bacmp(&d->bdaddr, dst)) {
				hdev = d; break;
			}
		}
	}

	if (hdev)
		hdev = hci_dev_hold(hdev);

	read_unlock_bh(&hci_dev_list_lock);
	return hdev;
}
EXPORT_SYMBOL(hci_get_route);

/* Create SCO or ACL connection.
 * Device _must_ be locked */
struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst)
{
	struct hci_conn *acl;
	struct hci_conn *sco;

	BT_DBG("%s dst %s", hdev->name, batostr(dst));

	if (!(acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst))) {
		if (!(acl = hci_conn_add(hdev, ACL_LINK, dst)))
			return NULL;
	}

	hci_conn_hold(acl);

	if (acl->state == BT_OPEN || acl->state == BT_CLOSED)
		hci_acl_connect(acl);

	if (type == ACL_LINK)
		return acl;

	if (!(sco = hci_conn_hash_lookup_ba(hdev, type, dst))) {
		if (!(sco = hci_conn_add(hdev, type, dst))) {
			hci_conn_put(acl);
			return NULL;
		}
	}

	acl->link = sco;
	sco->link = acl;

	hci_conn_hold(sco);

	if (acl->state == BT_CONNECTED &&
			(sco->state == BT_OPEN || sco->state == BT_CLOSED))
		hci_add_sco(sco, acl->handle);

	return sco;
}
EXPORT_SYMBOL(hci_connect);

/* Authenticate remote device */
int hci_conn_auth(struct hci_conn *conn)
{
	BT_DBG("conn %p", conn);

	if (conn->link_mode & HCI_LM_AUTH)
		return 1;

	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
		struct hci_cp_auth_requested cp;
		cp.handle = cpu_to_le16(conn->handle);
		hci_send_cmd(conn->hdev, OGF_LINK_CTL, OCF_AUTH_REQUESTED, sizeof(cp), &cp);
	}
	return 0;
}
EXPORT_SYMBOL(hci_conn_auth);

/* Enable encryption */
int hci_conn_encrypt(struct hci_conn *conn)
{
	BT_DBG("conn %p", conn);

	if (conn->link_mode & HCI_LM_ENCRYPT)
		return 1;

	if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend))
		return 0;

	if (hci_conn_auth(conn)) {
		struct hci_cp_set_conn_encrypt cp;
		cp.handle  = cpu_to_le16(conn->handle);
		cp.encrypt = 1;
		hci_send_cmd(conn->hdev, OGF_LINK_CTL, OCF_SET_CONN_ENCRYPT, sizeof(cp), &cp);
	}
	return 0;
}
EXPORT_SYMBOL(hci_conn_encrypt);

/* Change link key */
int hci_conn_change_link_key(struct hci_conn *conn)
{
	BT_DBG("conn %p", conn);

	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
		struct hci_cp_change_conn_link_key cp;
		cp.handle = cpu_to_le16(conn->handle);
		hci_send_cmd(conn->hdev, OGF_LINK_CTL, OCF_CHANGE_CONN_LINK_KEY, sizeof(cp), &cp);
	}
	return 0;
}
EXPORT_SYMBOL(hci_conn_change_link_key);

/* Switch role */
int hci_conn_switch_role(struct hci_conn *conn, uint8_t role)
{
	BT_DBG("conn %p", conn);

	if (!role && conn->link_mode & HCI_LM_MASTER)
		return 1;

	if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->pend)) {
		struct hci_cp_switch_role cp;
		bacpy(&cp.bdaddr, &conn->dst);
		cp.role = role;
		hci_send_cmd(conn->hdev, OGF_LINK_POLICY, OCF_SWITCH_ROLE, sizeof(cp), &cp);
	}
	return 0;
}
EXPORT_SYMBOL(hci_conn_switch_role);

/* Enter active mode */
void hci_conn_enter_active_mode(struct hci_conn *conn)
{
	struct hci_dev *hdev = conn->hdev;

	BT_DBG("conn %p mode %d", conn, conn->mode);

	if (test_bit(HCI_RAW, &hdev->flags))
		return;

	if (conn->mode != HCI_CM_SNIFF || !conn->power_save)
		goto timer;

	if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
		struct hci_cp_exit_sniff_mode cp;
		cp.handle = cpu_to_le16(conn->handle);
		hci_send_cmd(hdev, OGF_LINK_POLICY,
				OCF_EXIT_SNIFF_MODE, sizeof(cp), &cp);
	}

timer:
	if (hdev->idle_timeout > 0)
		mod_timer(&conn->idle_timer,
			jiffies + msecs_to_jiffies(hdev->idle_timeout));
}

/* Enter sniff mode */
void hci_conn_enter_sniff_mode(struct hci_conn *conn)
{
	struct hci_dev *hdev = conn->hdev;

	BT_DBG("conn %p mode %d", conn, conn->mode);

	if (test_bit(HCI_RAW, &hdev->flags))
		return;

	if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn))
		return;

	if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF))
		return;

	if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
		struct hci_cp_sniff_subrate cp;
		cp.handle             = cpu_to_le16(conn->handle);
		cp.max_latency        = cpu_to_le16(0);
		cp.min_remote_timeout = cpu_to_le16(0);
		cp.min_local_timeout  = cpu_to_le16(0);
		hci_send_cmd(hdev, OGF_LINK_POLICY,
				OCF_SNIFF_SUBRATE, sizeof(cp), &cp);
	}

	if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
		struct hci_cp_sniff_mode cp;
		cp.handle       = cpu_to_le16(conn->handle);
		cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
		cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
		cp.attempt      = cpu_to_le16(4);
		cp.timeout      = cpu_to_le16(1);
		hci_send_cmd(hdev, OGF_LINK_POLICY,
				OCF_SNIFF_MODE, sizeof(cp), &cp);
	}
}

/* Drop all connection on the device */
void hci_conn_hash_flush(struct hci_dev *hdev)
{
	struct hci_conn_hash *h = &hdev->conn_hash;
	struct list_head *p;

	BT_DBG("hdev %s", hdev->name);

	p = h->list.next;
	while (p != &h->list) {
		struct hci_conn *c;

		c = list_entry(p, struct hci_conn, list);
		p = p->next;

		c->state = BT_CLOSED;

		hci_proto_disconn_ind(c, 0x16);
		hci_conn_del(c);
	}
}

int hci_get_conn_list(void __user *arg)
{
	struct hci_conn_list_req req, *cl;
	struct hci_conn_info *ci;
	struct hci_dev *hdev;
	struct list_head *p;
	int n = 0, size, err;

	if (copy_from_user(&req, arg, sizeof(req)))
		return -EFAULT;

	if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
		return -EINVAL;

	size = sizeof(req) + req.conn_num * sizeof(*ci);

	if (!(cl = kmalloc(size, GFP_KERNEL)))
		return -ENOMEM;

	if (!(hdev = hci_dev_get(req.dev_id))) {
		kfree(cl);
		return -ENODEV;
	}

	ci = cl->conn_info;

	hci_dev_lock_bh(hdev);
	list_for_each(p, &hdev->conn_hash.list) {
		register struct hci_conn *c;
		c = list_entry(p, struct hci_conn, list);

		bacpy(&(ci + n)->bdaddr, &c->dst);
		(ci + n)->handle = c->handle;
		(ci + n)->type  = c->type;
		(ci + n)->out   = c->out;
		(ci + n)->state = c->state;
		(ci + n)->link_mode = c->link_mode;
		if (++n >= req.conn_num)
			break;
	}
	hci_dev_unlock_bh(hdev);

	cl->dev_id = hdev->id;
	cl->conn_num = n;
	size = sizeof(req) + n * sizeof(*ci);

	hci_dev_put(hdev);

	err = copy_to_user(arg, cl, size);
	kfree(cl);

	return err ? -EFAULT : 0;
}

int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
{
	struct hci_conn_info_req req;
	struct hci_conn_info ci;
	struct hci_conn *conn;
	char __user *ptr = arg + sizeof(req);

	if (copy_from_user(&req, arg, sizeof(req)))
		return -EFAULT;

	hci_dev_lock_bh(hdev);
	conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
	if (conn) {
		bacpy(&ci.bdaddr, &conn->dst);
		ci.handle = conn->handle;
		ci.type  = conn->type;
		ci.out   = conn->out;
		ci.state = conn->state;
		ci.link_mode = conn->link_mode;
	}
	hci_dev_unlock_bh(hdev);

	if (!conn)
		return -ENOENT;

	return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
}
Commit	Line	Data
8e87d142	1	/*
1da177e4 LT	2	BlueZ - Bluetooth protocol stack for Linux
	3	Copyright (C) 2000-2001 Qualcomm Incorporated
	4
	5	Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
	6
	7	This program is free software; you can redistribute it and/or modify
	8	it under the terms of the GNU General Public License version 2 as
	9	published by the Free Software Foundation;
	10
	11	THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
	12	OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
	13	FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
	14	IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142 YH	15	CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
	16	WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
	17	ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4 LT	18	OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
1da177e4 LT	19
8e87d142 YH	20	ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
8e87d142 YH	21	COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4 LT	22	SOFTWARE IS DISCLAIMED.
	23	*/
	24
	25	/* Bluetooth HCI connection handling. */
	26
1da177e4 LT	27	#include <linux/module.h>
	28
	29	#include <linux/types.h>
	30	#include <linux/errno.h>
	31	#include <linux/kernel.h>
1da177e4 LT	32	#include <linux/slab.h>
	33	#include <linux/poll.h>
	34	#include <linux/fcntl.h>
	35	#include <linux/init.h>
	36	#include <linux/skbuff.h>
	37	#include <linux/interrupt.h>
	38	#include <linux/notifier.h>
	39	#include <net/sock.h>
	40
	41	#include <asm/system.h>
	42	#include <asm/uaccess.h>
	43	#include <asm/unaligned.h>
	44
	45	#include <net/bluetooth/bluetooth.h>
	46	#include <net/bluetooth/hci_core.h>
	47
	48	#ifndef CONFIG_BT_HCI_CORE_DEBUG
	49	#undef BT_DBG
	50	#define BT_DBG(D...)
	51	#endif
	52
4c67bc74	53	void hci_acl_connect(struct hci_conn *conn)
1da177e4 LT	54	{
	55	struct hci_dev *hdev = conn->hdev;
	56	struct inquiry_entry *ie;
	57	struct hci_cp_create_conn cp;
	58
	59	BT_DBG("%p", conn);
	60
	61	conn->state = BT_CONNECT;
	62	conn->out = 1;
	63	conn->link_mode = HCI_LM_MASTER;
	64
4c67bc74 MH	65	conn->attempt++;
4c67bc74 MH	66
1da177e4 LT	67	memset(&cp, 0, sizeof(cp));
	68	bacpy(&cp.bdaddr, &conn->dst);
	69	cp.pscan_rep_mode = 0x02;
	70
	71	if ((ie = hci_inquiry_cache_lookup(hdev, &conn->dst)) &&
	72	inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
	73	cp.pscan_rep_mode = ie->data.pscan_rep_mode;
	74	cp.pscan_mode = ie->data.pscan_mode;
aca3192c	75	cp.clock_offset = ie->data.clock_offset \| cpu_to_le16(0x8000);
1da177e4 LT	76	memcpy(conn->dev_class, ie->data.dev_class, 3);
	77	}
	78
aca3192c	79	cp.pkt_type = cpu_to_le16(hdev->pkt_type & ACL_PTYPE_MASK);
1da177e4 LT	80	if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
	81	cp.role_switch = 0x01;
	82	else
	83	cp.role_switch = 0x00;
4c67bc74	84
1da177e4 LT	85	hci_send_cmd(hdev, OGF_LINK_CTL, OCF_CREATE_CONN, sizeof(cp), &cp);
	86	}
	87
6ac59344 MH	88	static void hci_acl_connect_cancel(struct hci_conn *conn)
	89	{
	90	struct hci_cp_create_conn_cancel cp;
	91
	92	BT_DBG("%p", conn);
	93
	94	if (conn->hdev->hci_ver < 2)
	95	return;
	96
	97	bacpy(&cp.bdaddr, &conn->dst);
	98	hci_send_cmd(conn->hdev, OGF_LINK_CTL,
	99	OCF_CREATE_CONN_CANCEL, sizeof(cp), &cp);
	100	}
	101
1da177e4 LT	102	void hci_acl_disconn(struct hci_conn *conn, __u8 reason)
	103	{
	104	struct hci_cp_disconnect cp;
	105
	106	BT_DBG("%p", conn);
	107
	108	conn->state = BT_DISCONN;
	109
aca3192c	110	cp.handle = cpu_to_le16(conn->handle);
1da177e4	111	cp.reason = reason;
6ac59344 MH	112	hci_send_cmd(conn->hdev, OGF_LINK_CTL,
6ac59344 MH	113	OCF_DISCONNECT, sizeof(cp), &cp);
1da177e4 LT	114	}
	115
	116	void hci_add_sco(struct hci_conn *conn, __u16 handle)
	117	{
	118	struct hci_dev *hdev = conn->hdev;
	119	struct hci_cp_add_sco cp;
	120
	121	BT_DBG("%p", conn);
	122
	123	conn->state = BT_CONNECT;
	124	conn->out = 1;
	125
aca3192c	126	cp.handle = cpu_to_le16(handle);
5b7f9909	127	cp.pkt_type = cpu_to_le16(hdev->pkt_type & SCO_PTYPE_MASK);
1da177e4 LT	128
	129	hci_send_cmd(hdev, OGF_LINK_CTL, OCF_ADD_SCO, sizeof(cp), &cp);
	130	}
	131
	132	static void hci_conn_timeout(unsigned long arg)
	133	{
04837f64 MH	134	struct hci_conn conn = (void ) arg;
04837f64 MH	135	struct hci_dev *hdev = conn->hdev;
1da177e4 LT	136
	137	BT_DBG("conn %p state %d", conn, conn->state);
	138
	139	if (atomic_read(&conn->refcnt))
	140	return;
	141
	142	hci_dev_lock(hdev);
6ac59344 MH	143
	144	switch (conn->state) {
	145	case BT_CONNECT:
	146	hci_acl_connect_cancel(conn);
	147	break;
8e87d142	148	case BT_CONNECTED:
1da177e4	149	hci_acl_disconn(conn, 0x13);
6ac59344 MH	150	break;
6ac59344 MH	151	default:
1da177e4	152	conn->state = BT_CLOSED;
6ac59344 MH	153	break;
	154	}
	155
1da177e4	156	hci_dev_unlock(hdev);
1da177e4 LT	157	}
1da177e4 LT	158
04837f64	159	static void hci_conn_idle(unsigned long arg)
1da177e4	160	{
04837f64 MH	161	struct hci_conn conn = (void ) arg;
	162
	163	BT_DBG("conn %p mode %d", conn, conn->mode);
	164
	165	hci_conn_enter_sniff_mode(conn);
1da177e4 LT	166	}
	167
	168	struct hci_conn hci_conn_add(struct hci_dev hdev, int type, bdaddr_t *dst)
	169	{
	170	struct hci_conn *conn;
	171
	172	BT_DBG("%s dst %s", hdev->name, batostr(dst));
	173
04837f64 MH	174	conn = kzalloc(sizeof(struct hci_conn), GFP_ATOMIC);
04837f64 MH	175	if (!conn)
1da177e4	176	return NULL;
1da177e4 LT	177
1da177e4 LT	178	bacpy(&conn->dst, dst);
1da177e4	179	conn->hdev = hdev;
04837f64 MH	180	conn->type = type;
04837f64 MH	181	conn->mode = HCI_CM_ACTIVE;
1da177e4 LT	182	conn->state = BT_OPEN;
1da177e4 LT	183
04837f64 MH	184	conn->power_save = 1;
04837f64 MH	185
1da177e4	186	skb_queue_head_init(&conn->data_q);
04837f64 MH	187
	188	init_timer(&conn->disc_timer);
	189	conn->disc_timer.function = hci_conn_timeout;
	190	conn->disc_timer.data = (unsigned long) conn;
	191
	192	init_timer(&conn->idle_timer);
	193	conn->idle_timer.function = hci_conn_idle;
	194	conn->idle_timer.data = (unsigned long) conn;
1da177e4 LT	195
	196	atomic_set(&conn->refcnt, 0);
	197
	198	hci_dev_hold(hdev);
	199
	200	tasklet_disable(&hdev->tx_task);
	201
	202	hci_conn_hash_add(hdev, conn);
	203	if (hdev->notify)
	204	hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
	205
b219e3ac MH	206	hci_conn_add_sysfs(conn);
b219e3ac MH	207
1da177e4 LT	208	tasklet_enable(&hdev->tx_task);
	209
	210	return conn;
	211	}
	212
	213	int hci_conn_del(struct hci_conn *conn)
	214	{
	215	struct hci_dev *hdev = conn->hdev;
	216
	217	BT_DBG("%s conn %p handle %d", hdev->name, conn, conn->handle);
	218
04837f64 MH	219	del_timer(&conn->idle_timer);
	220
	221	del_timer(&conn->disc_timer);
1da177e4	222
5b7f9909	223	if (conn->type == ACL_LINK) {
1da177e4 LT	224	struct hci_conn *sco = conn->link;
	225	if (sco)
	226	sco->link = NULL;
	227
	228	/* Unacked frames */
	229	hdev->acl_cnt += conn->sent;
5b7f9909 MH	230	} else {
	231	struct hci_conn *acl = conn->link;
	232	if (acl) {
	233	acl->link = NULL;
	234	hci_conn_put(acl);
	235	}
1da177e4 LT	236	}
	237
	238	tasklet_disable(&hdev->tx_task);
	239
b219e3ac MH	240	hci_conn_del_sysfs(conn);
b219e3ac MH	241
1da177e4 LT	242	hci_conn_hash_del(hdev, conn);
	243	if (hdev->notify)
	244	hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
	245
	246	tasklet_enable(&hdev->tx_task);
	247
	248	skb_queue_purge(&conn->data_q);
	249
	250	hci_dev_put(hdev);
	251
b219e3ac MH	252	/* will free via device release */
	253	put_device(&conn->dev);
	254
1da177e4 LT	255	return 0;
	256	}
	257
	258	struct hci_dev hci_get_route(bdaddr_t dst, bdaddr_t *src)
	259	{
	260	int use_src = bacmp(src, BDADDR_ANY);
	261	struct hci_dev *hdev = NULL;
	262	struct list_head *p;
	263
	264	BT_DBG("%s -> %s", batostr(src), batostr(dst));
	265
	266	read_lock_bh(&hci_dev_list_lock);
	267
	268	list_for_each(p, &hci_dev_list) {
	269	struct hci_dev *d = list_entry(p, struct hci_dev, list);
	270
	271	if (!test_bit(HCI_UP, &d->flags) \|\| test_bit(HCI_RAW, &d->flags))
	272	continue;
	273
8e87d142	274	/* Simple routing:
1da177e4 LT	275	* No source address - find interface with bdaddr != dst
	276	* Source address - find interface with bdaddr == src
	277	*/
	278
	279	if (use_src) {
	280	if (!bacmp(&d->bdaddr, src)) {
	281	hdev = d; break;
	282	}
	283	} else {
	284	if (bacmp(&d->bdaddr, dst)) {
	285	hdev = d; break;
	286	}
	287	}
	288	}
	289
	290	if (hdev)
	291	hdev = hci_dev_hold(hdev);
	292
	293	read_unlock_bh(&hci_dev_list_lock);
	294	return hdev;
	295	}
	296	EXPORT_SYMBOL(hci_get_route);
	297
	298	/* Create SCO or ACL connection.
	299	* Device _must_ be locked */
5b7f9909	300	struct hci_conn hci_connect(struct hci_dev hdev, int type, bdaddr_t *dst)
1da177e4 LT	301	{
1da177e4 LT	302	struct hci_conn *acl;
5b7f9909	303	struct hci_conn *sco;
1da177e4 LT	304
	305	BT_DBG("%s dst %s", hdev->name, batostr(dst));
	306
	307	if (!(acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst))) {
	308	if (!(acl = hci_conn_add(hdev, ACL_LINK, dst)))
	309	return NULL;
	310	}
	311
	312	hci_conn_hold(acl);
	313
	314	if (acl->state == BT_OPEN \|\| acl->state == BT_CLOSED)
	315	hci_acl_connect(acl);
	316
5b7f9909 MH	317	if (type == ACL_LINK)
5b7f9909 MH	318	return acl;
1da177e4	319
5b7f9909 MH	320	if (!(sco = hci_conn_hash_lookup_ba(hdev, type, dst))) {
	321	if (!(sco = hci_conn_add(hdev, type, dst))) {
	322	hci_conn_put(acl);
	323	return NULL;
1da177e4	324	}
5b7f9909	325	}
1da177e4	326
5b7f9909 MH	327	acl->link = sco;
5b7f9909 MH	328	sco->link = acl;
1da177e4	329
5b7f9909	330	hci_conn_hold(sco);
1da177e4	331
5b7f9909 MH	332	if (acl->state == BT_CONNECTED &&
	333	(sco->state == BT_OPEN \|\| sco->state == BT_CLOSED))
	334	hci_add_sco(sco, acl->handle);
	335
	336	return sco;
1da177e4 LT	337	}
	338	EXPORT_SYMBOL(hci_connect);
	339
	340	/* Authenticate remote device */
	341	int hci_conn_auth(struct hci_conn *conn)
	342	{
	343	BT_DBG("conn %p", conn);
	344
	345	if (conn->link_mode & HCI_LM_AUTH)
	346	return 1;
	347
	348	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
	349	struct hci_cp_auth_requested cp;
aca3192c	350	cp.handle = cpu_to_le16(conn->handle);
1da177e4 LT	351	hci_send_cmd(conn->hdev, OGF_LINK_CTL, OCF_AUTH_REQUESTED, sizeof(cp), &cp);
	352	}
	353	return 0;
	354	}
	355	EXPORT_SYMBOL(hci_conn_auth);
	356
	357	/* Enable encryption */
	358	int hci_conn_encrypt(struct hci_conn *conn)
	359	{
	360	BT_DBG("conn %p", conn);
	361
	362	if (conn->link_mode & HCI_LM_ENCRYPT)
	363	return 1;
	364
	365	if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend))
	366	return 0;
	367
	368	if (hci_conn_auth(conn)) {
	369	struct hci_cp_set_conn_encrypt cp;
aca3192c	370	cp.handle = cpu_to_le16(conn->handle);
8e87d142	371	cp.encrypt = 1;
1da177e4 LT	372	hci_send_cmd(conn->hdev, OGF_LINK_CTL, OCF_SET_CONN_ENCRYPT, sizeof(cp), &cp);
	373	}
	374	return 0;
	375	}
	376	EXPORT_SYMBOL(hci_conn_encrypt);
	377
	378	/* Change link key */
	379	int hci_conn_change_link_key(struct hci_conn *conn)
	380	{
	381	BT_DBG("conn %p", conn);
	382
	383	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
	384	struct hci_cp_change_conn_link_key cp;
aca3192c	385	cp.handle = cpu_to_le16(conn->handle);
1da177e4 LT	386	hci_send_cmd(conn->hdev, OGF_LINK_CTL, OCF_CHANGE_CONN_LINK_KEY, sizeof(cp), &cp);
	387	}
	388	return 0;
	389	}
	390	EXPORT_SYMBOL(hci_conn_change_link_key);
	391
	392	/* Switch role */
	393	int hci_conn_switch_role(struct hci_conn *conn, uint8_t role)
	394	{
	395	BT_DBG("conn %p", conn);
	396
	397	if (!role && conn->link_mode & HCI_LM_MASTER)
	398	return 1;
	399
	400	if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->pend)) {
	401	struct hci_cp_switch_role cp;
	402	bacpy(&cp.bdaddr, &conn->dst);
	403	cp.role = role;
	404	hci_send_cmd(conn->hdev, OGF_LINK_POLICY, OCF_SWITCH_ROLE, sizeof(cp), &cp);
	405	}
	406	return 0;
	407	}
	408	EXPORT_SYMBOL(hci_conn_switch_role);
	409
04837f64 MH	410	/* Enter active mode */
	411	void hci_conn_enter_active_mode(struct hci_conn *conn)
	412	{
	413	struct hci_dev *hdev = conn->hdev;
	414
	415	BT_DBG("conn %p mode %d", conn, conn->mode);
	416
	417	if (test_bit(HCI_RAW, &hdev->flags))
	418	return;
	419
	420	if (conn->mode != HCI_CM_SNIFF \|\| !conn->power_save)
	421	goto timer;
	422
	423	if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
	424	struct hci_cp_exit_sniff_mode cp;
aca3192c	425	cp.handle = cpu_to_le16(conn->handle);
04837f64 MH	426	hci_send_cmd(hdev, OGF_LINK_POLICY,
	427	OCF_EXIT_SNIFF_MODE, sizeof(cp), &cp);
	428	}
	429
	430	timer:
	431	if (hdev->idle_timeout > 0)
	432	mod_timer(&conn->idle_timer,
	433	jiffies + msecs_to_jiffies(hdev->idle_timeout));
	434	}
	435
	436	/* Enter sniff mode */
	437	void hci_conn_enter_sniff_mode(struct hci_conn *conn)
	438	{
	439	struct hci_dev *hdev = conn->hdev;
	440
	441	BT_DBG("conn %p mode %d", conn, conn->mode);
	442
	443	if (test_bit(HCI_RAW, &hdev->flags))
	444	return;
	445
	446	if (!lmp_sniff_capable(hdev) \|\| !lmp_sniff_capable(conn))
	447	return;
	448
	449	if (conn->mode != HCI_CM_ACTIVE \|\| !(conn->link_policy & HCI_LP_SNIFF))
	450	return;
	451
	452	if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
	453	struct hci_cp_sniff_subrate cp;
aca3192c YH	454	cp.handle = cpu_to_le16(conn->handle);
	455	cp.max_latency = cpu_to_le16(0);
	456	cp.min_remote_timeout = cpu_to_le16(0);
	457	cp.min_local_timeout = cpu_to_le16(0);
04837f64 MH	458	hci_send_cmd(hdev, OGF_LINK_POLICY,
	459	OCF_SNIFF_SUBRATE, sizeof(cp), &cp);
	460	}
	461
	462	if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
	463	struct hci_cp_sniff_mode cp;
aca3192c YH	464	cp.handle = cpu_to_le16(conn->handle);
	465	cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
	466	cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
	467	cp.attempt = cpu_to_le16(4);
	468	cp.timeout = cpu_to_le16(1);
04837f64 MH	469	hci_send_cmd(hdev, OGF_LINK_POLICY,
	470	OCF_SNIFF_MODE, sizeof(cp), &cp);
	471	}
	472	}
	473
1da177e4 LT	474	/* Drop all connection on the device */
	475	void hci_conn_hash_flush(struct hci_dev *hdev)
	476	{
	477	struct hci_conn_hash *h = &hdev->conn_hash;
	478	struct list_head *p;
	479
	480	BT_DBG("hdev %s", hdev->name);
	481
	482	p = h->list.next;
	483	while (p != &h->list) {
	484	struct hci_conn *c;
	485
	486	c = list_entry(p, struct hci_conn, list);
	487	p = p->next;
	488
	489	c->state = BT_CLOSED;
	490
	491	hci_proto_disconn_ind(c, 0x16);
	492	hci_conn_del(c);
	493	}
	494	}
	495
	496	int hci_get_conn_list(void __user *arg)
	497	{
	498	struct hci_conn_list_req req, *cl;
	499	struct hci_conn_info *ci;
	500	struct hci_dev *hdev;
	501	struct list_head *p;
	502	int n = 0, size, err;
	503
	504	if (copy_from_user(&req, arg, sizeof(req)))
	505	return -EFAULT;
	506
	507	if (!req.conn_num \|\| req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
	508	return -EINVAL;
	509
	510	size = sizeof(req) + req.conn_num * sizeof(*ci);
	511
12fe2c58	512	if (!(cl = kmalloc(size, GFP_KERNEL)))
1da177e4 LT	513	return -ENOMEM;
	514
	515	if (!(hdev = hci_dev_get(req.dev_id))) {
	516	kfree(cl);
	517	return -ENODEV;
	518	}
	519
	520	ci = cl->conn_info;
	521
	522	hci_dev_lock_bh(hdev);
	523	list_for_each(p, &hdev->conn_hash.list) {
	524	register struct hci_conn *c;
	525	c = list_entry(p, struct hci_conn, list);
	526
	527	bacpy(&(ci + n)->bdaddr, &c->dst);
	528	(ci + n)->handle = c->handle;
	529	(ci + n)->type = c->type;
	530	(ci + n)->out = c->out;
	531	(ci + n)->state = c->state;
	532	(ci + n)->link_mode = c->link_mode;
	533	if (++n >= req.conn_num)
	534	break;
	535	}
	536	hci_dev_unlock_bh(hdev);
	537
	538	cl->dev_id = hdev->id;
	539	cl->conn_num = n;
	540	size = sizeof(req) + n * sizeof(*ci);
	541
	542	hci_dev_put(hdev);
	543
	544	err = copy_to_user(arg, cl, size);
	545	kfree(cl);
	546
	547	return err ? -EFAULT : 0;
	548	}
	549
	550	int hci_get_conn_info(struct hci_dev hdev, void __user arg)
	551	{
	552	struct hci_conn_info_req req;
	553	struct hci_conn_info ci;
	554	struct hci_conn *conn;
	555	char __user *ptr = arg + sizeof(req);
	556
	557	if (copy_from_user(&req, arg, sizeof(req)))
	558	return -EFAULT;
	559
	560	hci_dev_lock_bh(hdev);
	561	conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
	562	if (conn) {
	563	bacpy(&ci.bdaddr, &conn->dst);
	564	ci.handle = conn->handle;
	565	ci.type = conn->type;
	566	ci.out = conn->out;
	567	ci.state = conn->state;
	568	ci.link_mode = conn->link_mode;
	569	}
	570	hci_dev_unlock_bh(hdev);
	571
	572	if (!conn)
	573	return -ENOENT;
	574
	575	return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
	576	}