[deliverable/linux.git] / net / bluetooth / hci_conn.c

/*
   BlueZ - Bluetooth protocol stack for Linux
   Copyright (C) 2000-2001 Qualcomm Incorporated

   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>

   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License version 2 as
   published by the Free Software Foundation;

   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
   SOFTWARE IS DISCLAIMED.
*/

/* Bluetooth HCI connection handling. */

#include <linux/module.h>

#include <linux/types.h>
#include <linux/errno.h>
#include <linux/kernel.h>
#include <linux/slab.h>
#include <linux/poll.h>
#include <linux/fcntl.h>
#include <linux/init.h>
#include <linux/skbuff.h>
#include <linux/interrupt.h>
#include <linux/notifier.h>
#include <net/sock.h>

#include <asm/system.h>
#include <asm/uaccess.h>
#include <asm/unaligned.h>

#include <net/bluetooth/bluetooth.h>
#include <net/bluetooth/hci_core.h>

void hci_acl_connect(struct hci_conn *conn)
{
	struct hci_dev *hdev = conn->hdev;
	struct inquiry_entry *ie;
	struct hci_cp_create_conn cp;

	BT_DBG("%p", conn);

	conn->state = BT_CONNECT;
	conn->out = 1;

	conn->link_mode = HCI_LM_MASTER;

	conn->attempt++;

	conn->link_policy = hdev->link_policy;

	memset(&cp, 0, sizeof(cp));
	bacpy(&cp.bdaddr, &conn->dst);
	cp.pscan_rep_mode = 0x02;

	if ((ie = hci_inquiry_cache_lookup(hdev, &conn->dst))) {
		if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
			cp.pscan_rep_mode = ie->data.pscan_rep_mode;
			cp.pscan_mode     = ie->data.pscan_mode;
			cp.clock_offset   = ie->data.clock_offset |
							cpu_to_le16(0x8000);
		}

		memcpy(conn->dev_class, ie->data.dev_class, 3);
		conn->ssp_mode = ie->data.ssp_mode;
	}

	cp.pkt_type = cpu_to_le16(conn->pkt_type);
	if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
		cp.role_switch = 0x01;
	else
		cp.role_switch = 0x00;

	hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
}

static void hci_acl_connect_cancel(struct hci_conn *conn)
{
	struct hci_cp_create_conn_cancel cp;

	BT_DBG("%p", conn);

	if (conn->hdev->hci_ver < 2)
		return;

	bacpy(&cp.bdaddr, &conn->dst);
	hci_send_cmd(conn->hdev, HCI_OP_CREATE_CONN_CANCEL, sizeof(cp), &cp);
}

void hci_acl_disconn(struct hci_conn *conn, __u8 reason)
{
	struct hci_cp_disconnect cp;

	BT_DBG("%p", conn);

	conn->state = BT_DISCONN;

	cp.handle = cpu_to_le16(conn->handle);
	cp.reason = reason;
	hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp);
}

void hci_add_sco(struct hci_conn *conn, __u16 handle)
{
	struct hci_dev *hdev = conn->hdev;
	struct hci_cp_add_sco cp;

	BT_DBG("%p", conn);

	conn->state = BT_CONNECT;
	conn->out = 1;

	conn->attempt++;

	cp.handle   = cpu_to_le16(handle);
	cp.pkt_type = cpu_to_le16(conn->pkt_type);

	hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
}

void hci_setup_sync(struct hci_conn *conn, __u16 handle)
{
	struct hci_dev *hdev = conn->hdev;
	struct hci_cp_setup_sync_conn cp;

	BT_DBG("%p", conn);

	conn->state = BT_CONNECT;
	conn->out = 1;

	conn->attempt++;

	cp.handle   = cpu_to_le16(handle);
	cp.pkt_type = cpu_to_le16(conn->pkt_type);

	cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
	cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
	cp.max_latency    = cpu_to_le16(0xffff);
	cp.voice_setting  = cpu_to_le16(hdev->voice_setting);
	cp.retrans_effort = 0xff;

	hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp);
}

static void hci_conn_timeout(unsigned long arg)
{
	struct hci_conn *conn = (void *) arg;
	struct hci_dev *hdev = conn->hdev;
	__u8 reason;

	BT_DBG("conn %p state %d", conn, conn->state);

	if (atomic_read(&conn->refcnt))
		return;

	hci_dev_lock(hdev);

	switch (conn->state) {
	case BT_CONNECT:
	case BT_CONNECT2:
		if (conn->type == ACL_LINK)
			hci_acl_connect_cancel(conn);
		else
			hci_acl_disconn(conn, 0x13);
		break;
	case BT_CONFIG:
	case BT_CONNECTED:
		reason = hci_proto_disconn_ind(conn);
		hci_acl_disconn(conn, reason);
		break;
	default:
		conn->state = BT_CLOSED;
		break;
	}

	hci_dev_unlock(hdev);
}

static void hci_conn_idle(unsigned long arg)
{
	struct hci_conn *conn = (void *) arg;

	BT_DBG("conn %p mode %d", conn, conn->mode);

	hci_conn_enter_sniff_mode(conn);
}

struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
{
	struct hci_conn *conn;

	BT_DBG("%s dst %s", hdev->name, batostr(dst));

	conn = kzalloc(sizeof(struct hci_conn), GFP_ATOMIC);
	if (!conn)
		return NULL;

	bacpy(&conn->dst, dst);
	conn->hdev  = hdev;
	conn->type  = type;
	conn->mode  = HCI_CM_ACTIVE;
	conn->state = BT_OPEN;

	conn->power_save = 1;
	conn->disc_timeout = HCI_DISCONN_TIMEOUT;

	switch (type) {
	case ACL_LINK:
		conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
		break;
	case SCO_LINK:
		if (lmp_esco_capable(hdev))
			conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
					(hdev->esco_type & EDR_ESCO_MASK);
		else
			conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
		break;
	case ESCO_LINK:
		conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
		break;
	}

	skb_queue_head_init(&conn->data_q);

	setup_timer(&conn->disc_timer, hci_conn_timeout, (unsigned long)conn);
	setup_timer(&conn->idle_timer, hci_conn_idle, (unsigned long)conn);

	atomic_set(&conn->refcnt, 0);

	hci_dev_hold(hdev);

	tasklet_disable(&hdev->tx_task);

	hci_conn_hash_add(hdev, conn);
	if (hdev->notify)
		hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);

	tasklet_enable(&hdev->tx_task);

	return conn;
}

int hci_conn_del(struct hci_conn *conn)
{
	struct hci_dev *hdev = conn->hdev;

	BT_DBG("%s conn %p handle %d", hdev->name, conn, conn->handle);

	del_timer(&conn->idle_timer);

	del_timer(&conn->disc_timer);

	if (conn->type == ACL_LINK) {
		struct hci_conn *sco = conn->link;
		if (sco)
			sco->link = NULL;

		/* Unacked frames */
		hdev->acl_cnt += conn->sent;
	} else {
		struct hci_conn *acl = conn->link;
		if (acl) {
			acl->link = NULL;
			hci_conn_put(acl);
		}
	}

	tasklet_disable(&hdev->tx_task);

	hci_conn_hash_del(hdev, conn);
	if (hdev->notify)
		hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);

	tasklet_enable(&hdev->tx_task);

	skb_queue_purge(&conn->data_q);

	hci_conn_del_sysfs(conn);

	return 0;
}

struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src)
{
	int use_src = bacmp(src, BDADDR_ANY);
	struct hci_dev *hdev = NULL;
	struct list_head *p;

	BT_DBG("%s -> %s", batostr(src), batostr(dst));

	read_lock_bh(&hci_dev_list_lock);

	list_for_each(p, &hci_dev_list) {
		struct hci_dev *d = list_entry(p, struct hci_dev, list);

		if (!test_bit(HCI_UP, &d->flags) || test_bit(HCI_RAW, &d->flags))
			continue;

		/* Simple routing:
		 *   No source address - find interface with bdaddr != dst
		 *   Source address    - find interface with bdaddr == src
		 */

		if (use_src) {
			if (!bacmp(&d->bdaddr, src)) {
				hdev = d; break;
			}
		} else {
			if (bacmp(&d->bdaddr, dst)) {
				hdev = d; break;
			}
		}
	}

	if (hdev)
		hdev = hci_dev_hold(hdev);

	read_unlock_bh(&hci_dev_list_lock);
	return hdev;
}
EXPORT_SYMBOL(hci_get_route);

/* Create SCO or ACL connection.
 * Device _must_ be locked */
struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, __u8 sec_level, __u8 auth_type)
{
	struct hci_conn *acl;
	struct hci_conn *sco;

	BT_DBG("%s dst %s", hdev->name, batostr(dst));

	if (!(acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst))) {
		if (!(acl = hci_conn_add(hdev, ACL_LINK, dst)))
			return NULL;
	}

	hci_conn_hold(acl);

	if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
		acl->sec_level = sec_level;
		acl->auth_type = auth_type;
		hci_acl_connect(acl);
	}

	if (type == ACL_LINK)
		return acl;

	if (!(sco = hci_conn_hash_lookup_ba(hdev, type, dst))) {
		if (!(sco = hci_conn_add(hdev, type, dst))) {
			hci_conn_put(acl);
			return NULL;
		}
	}

	acl->link = sco;
	sco->link = acl;

	hci_conn_hold(sco);

	if (acl->state == BT_CONNECTED &&
			(sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
		if (lmp_esco_capable(hdev))
			hci_setup_sync(sco, acl->handle);
		else
			hci_add_sco(sco, acl->handle);
	}

	return sco;
}
EXPORT_SYMBOL(hci_connect);

/* Check link security requirement */
int hci_conn_check_link_mode(struct hci_conn *conn)
{
	BT_DBG("conn %p", conn);

	if (conn->ssp_mode > 0 && conn->hdev->ssp_mode > 0 &&
					!(conn->link_mode & HCI_LM_ENCRYPT))
		return 0;

	return 1;
}
EXPORT_SYMBOL(hci_conn_check_link_mode);

/* Authenticate remote device */
static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
{
	BT_DBG("conn %p", conn);

	if (sec_level > conn->sec_level)
		conn->sec_level = sec_level;
	else if (conn->link_mode & HCI_LM_AUTH)
		return 1;

	conn->auth_type = auth_type;

	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
		struct hci_cp_auth_requested cp;
		cp.handle = cpu_to_le16(conn->handle);
		hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
							sizeof(cp), &cp);
	}

	return 0;
}

/* Enable security */
int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
{
	BT_DBG("conn %p", conn);

	if (sec_level == BT_SECURITY_SDP)
		return 1;

	if (sec_level == BT_SECURITY_LOW) {
		if (conn->ssp_mode > 0 && conn->hdev->ssp_mode > 0)
			return hci_conn_auth(conn, sec_level, auth_type);
		else
			return 1;
	}

	if (conn->link_mode & HCI_LM_ENCRYPT)
		return hci_conn_auth(conn, sec_level, auth_type);

	if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend))
		return 0;

	if (hci_conn_auth(conn, sec_level, auth_type)) {
		struct hci_cp_set_conn_encrypt cp;
		cp.handle  = cpu_to_le16(conn->handle);
		cp.encrypt = 1;
		hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT,
							sizeof(cp), &cp);
	}

	return 0;
}
EXPORT_SYMBOL(hci_conn_security);

/* Change link key */
int hci_conn_change_link_key(struct hci_conn *conn)
{
	BT_DBG("conn %p", conn);

	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
		struct hci_cp_change_conn_link_key cp;
		cp.handle = cpu_to_le16(conn->handle);
		hci_send_cmd(conn->hdev, HCI_OP_CHANGE_CONN_LINK_KEY,
							sizeof(cp), &cp);
	}

	return 0;
}
EXPORT_SYMBOL(hci_conn_change_link_key);

/* Switch role */
int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
{
	BT_DBG("conn %p", conn);

	if (!role && conn->link_mode & HCI_LM_MASTER)
		return 1;

	if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->pend)) {
		struct hci_cp_switch_role cp;
		bacpy(&cp.bdaddr, &conn->dst);
		cp.role = role;
		hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
	}

	return 0;
}
EXPORT_SYMBOL(hci_conn_switch_role);

/* Enter active mode */
void hci_conn_enter_active_mode(struct hci_conn *conn)
{
	struct hci_dev *hdev = conn->hdev;

	BT_DBG("conn %p mode %d", conn, conn->mode);

	if (test_bit(HCI_RAW, &hdev->flags))
		return;

	if (conn->mode != HCI_CM_SNIFF || !conn->power_save)
		goto timer;

	if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
		struct hci_cp_exit_sniff_mode cp;
		cp.handle = cpu_to_le16(conn->handle);
		hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
	}

timer:
	if (hdev->idle_timeout > 0)
		mod_timer(&conn->idle_timer,
			jiffies + msecs_to_jiffies(hdev->idle_timeout));
}

/* Enter sniff mode */
void hci_conn_enter_sniff_mode(struct hci_conn *conn)
{
	struct hci_dev *hdev = conn->hdev;

	BT_DBG("conn %p mode %d", conn, conn->mode);

	if (test_bit(HCI_RAW, &hdev->flags))
		return;

	if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn))
		return;

	if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF))
		return;

	if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
		struct hci_cp_sniff_subrate cp;
		cp.handle             = cpu_to_le16(conn->handle);
		cp.max_latency        = cpu_to_le16(0);
		cp.min_remote_timeout = cpu_to_le16(0);
		cp.min_local_timeout  = cpu_to_le16(0);
		hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
	}

	if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
		struct hci_cp_sniff_mode cp;
		cp.handle       = cpu_to_le16(conn->handle);
		cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
		cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
		cp.attempt      = cpu_to_le16(4);
		cp.timeout      = cpu_to_le16(1);
		hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
	}
}

/* Drop all connection on the device */
void hci_conn_hash_flush(struct hci_dev *hdev)
{
	struct hci_conn_hash *h = &hdev->conn_hash;
	struct list_head *p;

	BT_DBG("hdev %s", hdev->name);

	p = h->list.next;
	while (p != &h->list) {
		struct hci_conn *c;

		c = list_entry(p, struct hci_conn, list);
		p = p->next;

		c->state = BT_CLOSED;

		hci_proto_disconn_cfm(c, 0x16);
		hci_conn_del(c);
	}
}

/* Check pending connect attempts */
void hci_conn_check_pending(struct hci_dev *hdev)
{
	struct hci_conn *conn;

	BT_DBG("hdev %s", hdev->name);

	hci_dev_lock(hdev);

	conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
	if (conn)
		hci_acl_connect(conn);

	hci_dev_unlock(hdev);
}

int hci_get_conn_list(void __user *arg)
{
	struct hci_conn_list_req req, *cl;
	struct hci_conn_info *ci;
	struct hci_dev *hdev;
	struct list_head *p;
	int n = 0, size, err;

	if (copy_from_user(&req, arg, sizeof(req)))
		return -EFAULT;

	if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
		return -EINVAL;

	size = sizeof(req) + req.conn_num * sizeof(*ci);

	if (!(cl = kmalloc(size, GFP_KERNEL)))
		return -ENOMEM;

	if (!(hdev = hci_dev_get(req.dev_id))) {
		kfree(cl);
		return -ENODEV;
	}

	ci = cl->conn_info;

	hci_dev_lock_bh(hdev);
	list_for_each(p, &hdev->conn_hash.list) {
		register struct hci_conn *c;
		c = list_entry(p, struct hci_conn, list);

		bacpy(&(ci + n)->bdaddr, &c->dst);
		(ci + n)->handle = c->handle;
		(ci + n)->type  = c->type;
		(ci + n)->out   = c->out;
		(ci + n)->state = c->state;
		(ci + n)->link_mode = c->link_mode;
		if (++n >= req.conn_num)
			break;
	}
	hci_dev_unlock_bh(hdev);

	cl->dev_id = hdev->id;
	cl->conn_num = n;
	size = sizeof(req) + n * sizeof(*ci);

	hci_dev_put(hdev);

	err = copy_to_user(arg, cl, size);
	kfree(cl);

	return err ? -EFAULT : 0;
}

int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
{
	struct hci_conn_info_req req;
	struct hci_conn_info ci;
	struct hci_conn *conn;
	char __user *ptr = arg + sizeof(req);

	if (copy_from_user(&req, arg, sizeof(req)))
		return -EFAULT;

	hci_dev_lock_bh(hdev);
	conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
	if (conn) {
		bacpy(&ci.bdaddr, &conn->dst);
		ci.handle = conn->handle;
		ci.type  = conn->type;
		ci.out   = conn->out;
		ci.state = conn->state;
		ci.link_mode = conn->link_mode;
	}
	hci_dev_unlock_bh(hdev);

	if (!conn)
		return -ENOENT;

	return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
}

int hci_get_auth_info(struct hci_dev *hdev, void __user *arg)
{
	struct hci_auth_info_req req;
	struct hci_conn *conn;

	if (copy_from_user(&req, arg, sizeof(req)))
		return -EFAULT;

	hci_dev_lock_bh(hdev);
	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr);
	if (conn)
		req.type = conn->auth_type;
	hci_dev_unlock_bh(hdev);

	if (!conn)
		return -ENOENT;

	return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0;
}
Commit	Line	Data
8e87d142	1	/*
1da177e4 LT	2	BlueZ - Bluetooth protocol stack for Linux
	3	Copyright (C) 2000-2001 Qualcomm Incorporated
	4
	5	Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
	6
	7	This program is free software; you can redistribute it and/or modify
	8	it under the terms of the GNU General Public License version 2 as
	9	published by the Free Software Foundation;
	10
	11	THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
	12	OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
	13	FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
	14	IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142 YH	15	CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
	16	WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
	17	ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4 LT	18	OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
1da177e4 LT	19
8e87d142 YH	20	ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
8e87d142 YH	21	COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4 LT	22	SOFTWARE IS DISCLAIMED.
	23	*/
	24
	25	/* Bluetooth HCI connection handling. */
	26
1da177e4 LT	27	#include <linux/module.h>
	28
	29	#include <linux/types.h>
	30	#include <linux/errno.h>
	31	#include <linux/kernel.h>
1da177e4 LT	32	#include <linux/slab.h>
	33	#include <linux/poll.h>
	34	#include <linux/fcntl.h>
	35	#include <linux/init.h>
	36	#include <linux/skbuff.h>
	37	#include <linux/interrupt.h>
	38	#include <linux/notifier.h>
	39	#include <net/sock.h>
	40
	41	#include <asm/system.h>
	42	#include <asm/uaccess.h>
	43	#include <asm/unaligned.h>
	44
	45	#include <net/bluetooth/bluetooth.h>
	46	#include <net/bluetooth/hci_core.h>
	47
4c67bc74	48	void hci_acl_connect(struct hci_conn *conn)
1da177e4 LT	49	{
	50	struct hci_dev *hdev = conn->hdev;
	51	struct inquiry_entry *ie;
	52	struct hci_cp_create_conn cp;
	53
	54	BT_DBG("%p", conn);
	55
	56	conn->state = BT_CONNECT;
a8746417 MH	57	conn->out = 1;
a8746417 MH	58
1da177e4 LT	59	conn->link_mode = HCI_LM_MASTER;
1da177e4 LT	60
4c67bc74 MH	61	conn->attempt++;
4c67bc74 MH	62
e4e8e37c MH	63	conn->link_policy = hdev->link_policy;
e4e8e37c MH	64
1da177e4 LT	65	memset(&cp, 0, sizeof(cp));
	66	bacpy(&cp.bdaddr, &conn->dst);
	67	cp.pscan_rep_mode = 0x02;
	68
41a96212 MH	69	if ((ie = hci_inquiry_cache_lookup(hdev, &conn->dst))) {
	70	if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
	71	cp.pscan_rep_mode = ie->data.pscan_rep_mode;
	72	cp.pscan_mode = ie->data.pscan_mode;
	73	cp.clock_offset = ie->data.clock_offset \|
	74	cpu_to_le16(0x8000);
	75	}
	76
1da177e4	77	memcpy(conn->dev_class, ie->data.dev_class, 3);
41a96212	78	conn->ssp_mode = ie->data.ssp_mode;
1da177e4 LT	79	}
1da177e4 LT	80
a8746417	81	cp.pkt_type = cpu_to_le16(conn->pkt_type);
1da177e4	82	if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
b6a0dc82	83	cp.role_switch = 0x01;
1da177e4	84	else
b6a0dc82	85	cp.role_switch = 0x00;
4c67bc74	86
a9de9248	87	hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
1da177e4 LT	88	}
1da177e4 LT	89
6ac59344 MH	90	static void hci_acl_connect_cancel(struct hci_conn *conn)
	91	{
	92	struct hci_cp_create_conn_cancel cp;
	93
	94	BT_DBG("%p", conn);
	95
	96	if (conn->hdev->hci_ver < 2)
	97	return;
	98
	99	bacpy(&cp.bdaddr, &conn->dst);
a9de9248	100	hci_send_cmd(conn->hdev, HCI_OP_CREATE_CONN_CANCEL, sizeof(cp), &cp);
6ac59344 MH	101	}
6ac59344 MH	102
1da177e4 LT	103	void hci_acl_disconn(struct hci_conn *conn, __u8 reason)
	104	{
	105	struct hci_cp_disconnect cp;
	106
	107	BT_DBG("%p", conn);
	108
	109	conn->state = BT_DISCONN;
	110
aca3192c	111	cp.handle = cpu_to_le16(conn->handle);
1da177e4	112	cp.reason = reason;
a9de9248	113	hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp);
1da177e4 LT	114	}
	115
	116	void hci_add_sco(struct hci_conn *conn, __u16 handle)
	117	{
	118	struct hci_dev *hdev = conn->hdev;
	119	struct hci_cp_add_sco cp;
	120
	121	BT_DBG("%p", conn);
	122
	123	conn->state = BT_CONNECT;
	124	conn->out = 1;
	125
efc7688b MH	126	conn->attempt++;
efc7688b MH	127
aca3192c	128	cp.handle = cpu_to_le16(handle);
a8746417	129	cp.pkt_type = cpu_to_le16(conn->pkt_type);
1da177e4	130
a9de9248	131	hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
1da177e4 LT	132	}
1da177e4 LT	133
b6a0dc82 MH	134	void hci_setup_sync(struct hci_conn *conn, __u16 handle)
	135	{
	136	struct hci_dev *hdev = conn->hdev;
	137	struct hci_cp_setup_sync_conn cp;
	138
	139	BT_DBG("%p", conn);
	140
	141	conn->state = BT_CONNECT;
	142	conn->out = 1;
	143
efc7688b MH	144	conn->attempt++;
efc7688b MH	145
b6a0dc82	146	cp.handle = cpu_to_le16(handle);
a8746417	147	cp.pkt_type = cpu_to_le16(conn->pkt_type);
b6a0dc82 MH	148
	149	cp.tx_bandwidth = cpu_to_le32(0x00001f40);
	150	cp.rx_bandwidth = cpu_to_le32(0x00001f40);
	151	cp.max_latency = cpu_to_le16(0xffff);
	152	cp.voice_setting = cpu_to_le16(hdev->voice_setting);
	153	cp.retrans_effort = 0xff;
	154
	155	hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp);
	156	}
	157
1da177e4 LT	158	static void hci_conn_timeout(unsigned long arg)
1da177e4 LT	159	{
04837f64 MH	160	struct hci_conn conn = (void ) arg;
04837f64 MH	161	struct hci_dev *hdev = conn->hdev;
2950f21a	162	__u8 reason;
1da177e4 LT	163
	164	BT_DBG("conn %p state %d", conn, conn->state);
	165
	166	if (atomic_read(&conn->refcnt))
	167	return;
	168
	169	hci_dev_lock(hdev);
6ac59344 MH	170
	171	switch (conn->state) {
	172	case BT_CONNECT:
769be974	173	case BT_CONNECT2:
b6a0dc82 MH	174	if (conn->type == ACL_LINK)
	175	hci_acl_connect_cancel(conn);
	176	else
	177	hci_acl_disconn(conn, 0x13);
6ac59344	178	break;
769be974	179	case BT_CONFIG:
8e87d142	180	case BT_CONNECTED:
2950f21a MH	181	reason = hci_proto_disconn_ind(conn);
2950f21a MH	182	hci_acl_disconn(conn, reason);
6ac59344 MH	183	break;
6ac59344 MH	184	default:
1da177e4	185	conn->state = BT_CLOSED;
6ac59344 MH	186	break;
	187	}
	188
1da177e4	189	hci_dev_unlock(hdev);
1da177e4 LT	190	}
1da177e4 LT	191
04837f64	192	static void hci_conn_idle(unsigned long arg)
1da177e4	193	{
04837f64 MH	194	struct hci_conn conn = (void ) arg;
	195
	196	BT_DBG("conn %p mode %d", conn, conn->mode);
	197
	198	hci_conn_enter_sniff_mode(conn);
1da177e4 LT	199	}
	200
	201	struct hci_conn hci_conn_add(struct hci_dev hdev, int type, bdaddr_t *dst)
	202	{
	203	struct hci_conn *conn;
	204
	205	BT_DBG("%s dst %s", hdev->name, batostr(dst));
	206
04837f64 MH	207	conn = kzalloc(sizeof(struct hci_conn), GFP_ATOMIC);
04837f64 MH	208	if (!conn)
1da177e4	209	return NULL;
1da177e4 LT	210
1da177e4 LT	211	bacpy(&conn->dst, dst);
a8746417 MH	212	conn->hdev = hdev;
	213	conn->type = type;
	214	conn->mode = HCI_CM_ACTIVE;
	215	conn->state = BT_OPEN;
1da177e4	216
04837f64	217	conn->power_save = 1;
052b30b0	218	conn->disc_timeout = HCI_DISCONN_TIMEOUT;
04837f64	219
a8746417 MH	220	switch (type) {
	221	case ACL_LINK:
	222	conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
	223	break;
	224	case SCO_LINK:
	225	if (lmp_esco_capable(hdev))
efc7688b MH	226	conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) \|
efc7688b MH	227	(hdev->esco_type & EDR_ESCO_MASK);
a8746417 MH	228	else
	229	conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
	230	break;
	231	case ESCO_LINK:
efc7688b	232	conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
a8746417 MH	233	break;
	234	}
	235
1da177e4	236	skb_queue_head_init(&conn->data_q);
04837f64	237
b24b8a24 PE	238	setup_timer(&conn->disc_timer, hci_conn_timeout, (unsigned long)conn);
b24b8a24 PE	239	setup_timer(&conn->idle_timer, hci_conn_idle, (unsigned long)conn);
1da177e4 LT	240
	241	atomic_set(&conn->refcnt, 0);
	242
	243	hci_dev_hold(hdev);
	244
	245	tasklet_disable(&hdev->tx_task);
	246
	247	hci_conn_hash_add(hdev, conn);
	248	if (hdev->notify)
	249	hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
	250
	251	tasklet_enable(&hdev->tx_task);
	252
	253	return conn;
	254	}
	255
	256	int hci_conn_del(struct hci_conn *conn)
	257	{
	258	struct hci_dev *hdev = conn->hdev;
	259
	260	BT_DBG("%s conn %p handle %d", hdev->name, conn, conn->handle);
	261
04837f64 MH	262	del_timer(&conn->idle_timer);
	263
	264	del_timer(&conn->disc_timer);
1da177e4	265
5b7f9909	266	if (conn->type == ACL_LINK) {
1da177e4 LT	267	struct hci_conn *sco = conn->link;
	268	if (sco)
	269	sco->link = NULL;
	270
	271	/* Unacked frames */
	272	hdev->acl_cnt += conn->sent;
5b7f9909 MH	273	} else {
	274	struct hci_conn *acl = conn->link;
	275	if (acl) {
	276	acl->link = NULL;
	277	hci_conn_put(acl);
	278	}
1da177e4 LT	279	}
	280
	281	tasklet_disable(&hdev->tx_task);
7d0db0a3	282
1da177e4 LT	283	hci_conn_hash_del(hdev, conn);
	284	if (hdev->notify)
	285	hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
7d0db0a3	286
1da177e4	287	tasklet_enable(&hdev->tx_task);
7d0db0a3	288
1da177e4	289	skb_queue_purge(&conn->data_q);
1da177e4	290
2ae9a6be DY	291	hci_conn_del_sysfs(conn);
2ae9a6be DY	292
1da177e4 LT	293	return 0;
	294	}
	295
	296	struct hci_dev hci_get_route(bdaddr_t dst, bdaddr_t *src)
	297	{
	298	int use_src = bacmp(src, BDADDR_ANY);
	299	struct hci_dev *hdev = NULL;
	300	struct list_head *p;
	301
	302	BT_DBG("%s -> %s", batostr(src), batostr(dst));
	303
	304	read_lock_bh(&hci_dev_list_lock);
	305
	306	list_for_each(p, &hci_dev_list) {
	307	struct hci_dev *d = list_entry(p, struct hci_dev, list);
	308
	309	if (!test_bit(HCI_UP, &d->flags) \|\| test_bit(HCI_RAW, &d->flags))
	310	continue;
	311
8e87d142	312	/* Simple routing:
1da177e4 LT	313	* No source address - find interface with bdaddr != dst
	314	* Source address - find interface with bdaddr == src
	315	*/
	316
	317	if (use_src) {
	318	if (!bacmp(&d->bdaddr, src)) {
	319	hdev = d; break;
	320	}
	321	} else {
	322	if (bacmp(&d->bdaddr, dst)) {
	323	hdev = d; break;
	324	}
	325	}
	326	}
	327
	328	if (hdev)
	329	hdev = hci_dev_hold(hdev);
	330
	331	read_unlock_bh(&hci_dev_list_lock);
	332	return hdev;
	333	}
	334	EXPORT_SYMBOL(hci_get_route);
	335
	336	/* Create SCO or ACL connection.
	337	* Device _must_ be locked */
8c1b2355	338	struct hci_conn hci_connect(struct hci_dev hdev, int type, bdaddr_t *dst, __u8 sec_level, __u8 auth_type)
1da177e4 LT	339	{
1da177e4 LT	340	struct hci_conn *acl;
5b7f9909	341	struct hci_conn *sco;
1da177e4 LT	342
	343	BT_DBG("%s dst %s", hdev->name, batostr(dst));
	344
	345	if (!(acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst))) {
	346	if (!(acl = hci_conn_add(hdev, ACL_LINK, dst)))
	347	return NULL;
	348	}
	349
	350	hci_conn_hold(acl);
	351
09ab6f4c	352	if (acl->state == BT_OPEN \|\| acl->state == BT_CLOSED) {
8c1b2355	353	acl->sec_level = sec_level;
09ab6f4c	354	acl->auth_type = auth_type;
1da177e4	355	hci_acl_connect(acl);
09ab6f4c	356	}
1da177e4	357
5b7f9909 MH	358	if (type == ACL_LINK)
5b7f9909 MH	359	return acl;
1da177e4	360
5b7f9909 MH	361	if (!(sco = hci_conn_hash_lookup_ba(hdev, type, dst))) {
	362	if (!(sco = hci_conn_add(hdev, type, dst))) {
	363	hci_conn_put(acl);
	364	return NULL;
1da177e4	365	}
5b7f9909	366	}
1da177e4	367
5b7f9909 MH	368	acl->link = sco;
5b7f9909 MH	369	sco->link = acl;
1da177e4	370
5b7f9909	371	hci_conn_hold(sco);
1da177e4	372
5b7f9909	373	if (acl->state == BT_CONNECTED &&
b6a0dc82 MH	374	(sco->state == BT_OPEN \|\| sco->state == BT_CLOSED)) {
	375	if (lmp_esco_capable(hdev))
	376	hci_setup_sync(sco, acl->handle);
	377	else
	378	hci_add_sco(sco, acl->handle);
	379	}
5b7f9909 MH	380
5b7f9909 MH	381	return sco;
1da177e4 LT	382	}
	383	EXPORT_SYMBOL(hci_connect);
	384
e7c29cb1 MH	385	/* Check link security requirement */
	386	int hci_conn_check_link_mode(struct hci_conn *conn)
	387	{
	388	BT_DBG("conn %p", conn);
	389
	390	if (conn->ssp_mode > 0 && conn->hdev->ssp_mode > 0 &&
	391	!(conn->link_mode & HCI_LM_ENCRYPT))
	392	return 0;
	393
	394	return 1;
	395	}
	396	EXPORT_SYMBOL(hci_conn_check_link_mode);
	397
1da177e4	398	/* Authenticate remote device */
0684e5f9	399	static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
1da177e4 LT	400	{
	401	BT_DBG("conn %p", conn);
	402
96a31833	403	if (sec_level > conn->sec_level)
0684e5f9	404	conn->sec_level = sec_level;
96a31833	405	else if (conn->link_mode & HCI_LM_AUTH)
1da177e4 LT	406	return 1;
1da177e4 LT	407
96a31833 MH	408	conn->auth_type = auth_type;
96a31833 MH	409
1da177e4 LT	410	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
1da177e4 LT	411	struct hci_cp_auth_requested cp;
aca3192c	412	cp.handle = cpu_to_le16(conn->handle);
40be492f MH	413	hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
40be492f MH	414	sizeof(cp), &cp);
1da177e4	415	}
8c1b2355	416
1da177e4 LT	417	return 0;
1da177e4 LT	418	}
1da177e4	419
8c1b2355	420	/* Enable security */
0684e5f9	421	int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
1da177e4 LT	422	{
	423	BT_DBG("conn %p", conn);
	424
8c1b2355 MH	425	if (sec_level == BT_SECURITY_SDP)
	426	return 1;
	427
	428	if (sec_level == BT_SECURITY_LOW) {
	429	if (conn->ssp_mode > 0 && conn->hdev->ssp_mode > 0)
0684e5f9	430	return hci_conn_auth(conn, sec_level, auth_type);
8c1b2355 MH	431	else
	432	return 1;
	433	}
	434
1da177e4	435	if (conn->link_mode & HCI_LM_ENCRYPT)
0684e5f9	436	return hci_conn_auth(conn, sec_level, auth_type);
1da177e4 LT	437
	438	if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend))
	439	return 0;
	440
0684e5f9	441	if (hci_conn_auth(conn, sec_level, auth_type)) {
1da177e4	442	struct hci_cp_set_conn_encrypt cp;
aca3192c	443	cp.handle = cpu_to_le16(conn->handle);
8e87d142	444	cp.encrypt = 1;
40be492f MH	445	hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT,
40be492f MH	446	sizeof(cp), &cp);
1da177e4	447	}
8c1b2355	448
1da177e4 LT	449	return 0;
1da177e4 LT	450	}
8c1b2355	451	EXPORT_SYMBOL(hci_conn_security);
1da177e4 LT	452
	453	/* Change link key */
	454	int hci_conn_change_link_key(struct hci_conn *conn)
	455	{
	456	BT_DBG("conn %p", conn);
	457
	458	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
	459	struct hci_cp_change_conn_link_key cp;
aca3192c	460	cp.handle = cpu_to_le16(conn->handle);
40be492f MH	461	hci_send_cmd(conn->hdev, HCI_OP_CHANGE_CONN_LINK_KEY,
40be492f MH	462	sizeof(cp), &cp);
1da177e4	463	}
8c1b2355	464
1da177e4 LT	465	return 0;
	466	}
	467	EXPORT_SYMBOL(hci_conn_change_link_key);
	468
	469	/* Switch role */
8c1b2355	470	int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
1da177e4 LT	471	{
	472	BT_DBG("conn %p", conn);
	473
	474	if (!role && conn->link_mode & HCI_LM_MASTER)
	475	return 1;
	476
	477	if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->pend)) {
	478	struct hci_cp_switch_role cp;
	479	bacpy(&cp.bdaddr, &conn->dst);
	480	cp.role = role;
a9de9248	481	hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
1da177e4	482	}
8c1b2355	483
1da177e4 LT	484	return 0;
	485	}
	486	EXPORT_SYMBOL(hci_conn_switch_role);
	487
04837f64 MH	488	/* Enter active mode */
	489	void hci_conn_enter_active_mode(struct hci_conn *conn)
	490	{
	491	struct hci_dev *hdev = conn->hdev;
	492
	493	BT_DBG("conn %p mode %d", conn, conn->mode);
	494
	495	if (test_bit(HCI_RAW, &hdev->flags))
	496	return;
	497
	498	if (conn->mode != HCI_CM_SNIFF \|\| !conn->power_save)
	499	goto timer;
	500
	501	if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
	502	struct hci_cp_exit_sniff_mode cp;
aca3192c	503	cp.handle = cpu_to_le16(conn->handle);
a9de9248	504	hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
04837f64 MH	505	}
	506
	507	timer:
	508	if (hdev->idle_timeout > 0)
	509	mod_timer(&conn->idle_timer,
	510	jiffies + msecs_to_jiffies(hdev->idle_timeout));
	511	}
	512
	513	/* Enter sniff mode */
	514	void hci_conn_enter_sniff_mode(struct hci_conn *conn)
	515	{
	516	struct hci_dev *hdev = conn->hdev;
	517
	518	BT_DBG("conn %p mode %d", conn, conn->mode);
	519
	520	if (test_bit(HCI_RAW, &hdev->flags))
	521	return;
	522
	523	if (!lmp_sniff_capable(hdev) \|\| !lmp_sniff_capable(conn))
	524	return;
	525
	526	if (conn->mode != HCI_CM_ACTIVE \|\| !(conn->link_policy & HCI_LP_SNIFF))
	527	return;
	528
	529	if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
	530	struct hci_cp_sniff_subrate cp;
aca3192c YH	531	cp.handle = cpu_to_le16(conn->handle);
	532	cp.max_latency = cpu_to_le16(0);
	533	cp.min_remote_timeout = cpu_to_le16(0);
	534	cp.min_local_timeout = cpu_to_le16(0);
a9de9248	535	hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
04837f64 MH	536	}
	537
	538	if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
	539	struct hci_cp_sniff_mode cp;
aca3192c YH	540	cp.handle = cpu_to_le16(conn->handle);
	541	cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
	542	cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
	543	cp.attempt = cpu_to_le16(4);
	544	cp.timeout = cpu_to_le16(1);
a9de9248	545	hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
04837f64 MH	546	}
	547	}
	548
1da177e4 LT	549	/* Drop all connection on the device */
	550	void hci_conn_hash_flush(struct hci_dev *hdev)
	551	{
	552	struct hci_conn_hash *h = &hdev->conn_hash;
	553	struct list_head *p;
	554
	555	BT_DBG("hdev %s", hdev->name);
	556
	557	p = h->list.next;
	558	while (p != &h->list) {
	559	struct hci_conn *c;
	560
	561	c = list_entry(p, struct hci_conn, list);
	562	p = p->next;
	563
	564	c->state = BT_CLOSED;
	565
2950f21a	566	hci_proto_disconn_cfm(c, 0x16);
1da177e4 LT	567	hci_conn_del(c);
	568	}
	569	}
	570
a9de9248 MH	571	/* Check pending connect attempts */
	572	void hci_conn_check_pending(struct hci_dev *hdev)
	573	{
	574	struct hci_conn *conn;
	575
	576	BT_DBG("hdev %s", hdev->name);
	577
	578	hci_dev_lock(hdev);
	579
	580	conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
	581	if (conn)
	582	hci_acl_connect(conn);
	583
	584	hci_dev_unlock(hdev);
	585	}
	586
1da177e4 LT	587	int hci_get_conn_list(void __user *arg)
	588	{
	589	struct hci_conn_list_req req, *cl;
	590	struct hci_conn_info *ci;
	591	struct hci_dev *hdev;
	592	struct list_head *p;
	593	int n = 0, size, err;
	594
	595	if (copy_from_user(&req, arg, sizeof(req)))
	596	return -EFAULT;
	597
	598	if (!req.conn_num \|\| req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
	599	return -EINVAL;
	600
	601	size = sizeof(req) + req.conn_num * sizeof(*ci);
	602
12fe2c58	603	if (!(cl = kmalloc(size, GFP_KERNEL)))
1da177e4 LT	604	return -ENOMEM;
	605
	606	if (!(hdev = hci_dev_get(req.dev_id))) {
	607	kfree(cl);
	608	return -ENODEV;
	609	}
	610
	611	ci = cl->conn_info;
	612
	613	hci_dev_lock_bh(hdev);
	614	list_for_each(p, &hdev->conn_hash.list) {
	615	register struct hci_conn *c;
	616	c = list_entry(p, struct hci_conn, list);
	617
	618	bacpy(&(ci + n)->bdaddr, &c->dst);
	619	(ci + n)->handle = c->handle;
	620	(ci + n)->type = c->type;
	621	(ci + n)->out = c->out;
	622	(ci + n)->state = c->state;
	623	(ci + n)->link_mode = c->link_mode;
	624	if (++n >= req.conn_num)
	625	break;
	626	}
	627	hci_dev_unlock_bh(hdev);
	628
	629	cl->dev_id = hdev->id;
	630	cl->conn_num = n;
	631	size = sizeof(req) + n * sizeof(*ci);
	632
	633	hci_dev_put(hdev);
	634
	635	err = copy_to_user(arg, cl, size);
	636	kfree(cl);
	637
	638	return err ? -EFAULT : 0;
	639	}
	640
	641	int hci_get_conn_info(struct hci_dev hdev, void __user arg)
	642	{
	643	struct hci_conn_info_req req;
	644	struct hci_conn_info ci;
	645	struct hci_conn *conn;
	646	char __user *ptr = arg + sizeof(req);
	647
	648	if (copy_from_user(&req, arg, sizeof(req)))
	649	return -EFAULT;
	650
	651	hci_dev_lock_bh(hdev);
	652	conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
	653	if (conn) {
	654	bacpy(&ci.bdaddr, &conn->dst);
	655	ci.handle = conn->handle;
	656	ci.type = conn->type;
	657	ci.out = conn->out;
	658	ci.state = conn->state;
	659	ci.link_mode = conn->link_mode;
	660	}
	661	hci_dev_unlock_bh(hdev);
	662
	663	if (!conn)
	664	return -ENOENT;
	665
	666	return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
	667	}
40be492f MH	668
	669	int hci_get_auth_info(struct hci_dev hdev, void __user arg)
	670	{
	671	struct hci_auth_info_req req;
	672	struct hci_conn *conn;
	673
	674	if (copy_from_user(&req, arg, sizeof(req)))
	675	return -EFAULT;
	676
	677	hci_dev_lock_bh(hdev);
	678	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr);
	679	if (conn)
	680	req.type = conn->auth_type;
	681	hci_dev_unlock_bh(hdev);
	682
	683	if (!conn)
	684	return -ENOENT;
	685
	686	return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0;
	687	}