1 /* 2 BlueZ - Bluetooth protocol stack for Linux 3 Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved. 4 5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com> 6 7 This program is free software; you can redistribute it and/or modify 8 it under the terms of the GNU General Public License version 2 as 9 published by the Free Software Foundation; 10 11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 19 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 22 SOFTWARE IS DISCLAIMED. 23 */ 24 25 /* Bluetooth HCI connection handling. */ 26 27 #include <linux/module.h> 28 29 #include <linux/types.h> 30 #include <linux/errno.h> 31 #include <linux/kernel.h> 32 #include <linux/slab.h> 33 #include <linux/poll.h> 34 #include <linux/fcntl.h> 35 #include <linux/init.h> 36 #include <linux/skbuff.h> 37 #include <linux/interrupt.h> 38 #include <linux/notifier.h> 39 #include <net/sock.h> 40 41 #include <asm/system.h> 42 #include <linux/uaccess.h> 43 #include <asm/unaligned.h> 44 45 #include <net/bluetooth/bluetooth.h> 46 #include <net/bluetooth/hci_core.h> 47 48 static void hci_le_connect(struct hci_conn *conn) 49 { 50 struct hci_dev *hdev = conn->hdev; 51 struct hci_cp_le_create_conn cp; 52 53 conn->state = BT_CONNECT; 54 conn->out = 1; 55 conn->link_mode |= HCI_LM_MASTER; 56 57 memset(&cp, 0, sizeof(cp)); 58 cp.scan_interval = cpu_to_le16(0x0004); 59 cp.scan_window = cpu_to_le16(0x0004); 60 bacpy(&cp.peer_addr, &conn->dst); 61 cp.conn_interval_min = cpu_to_le16(0x0008); 62 cp.conn_interval_max = cpu_to_le16(0x0100); 63 cp.supervision_timeout = cpu_to_le16(0x0064); 64 cp.min_ce_len = cpu_to_le16(0x0001); 65 cp.max_ce_len = cpu_to_le16(0x0001); 66 67 hci_send_cmd(hdev, HCI_OP_LE_CREATE_CONN, sizeof(cp), &cp); 68 } 69 70 static void hci_le_connect_cancel(struct hci_conn *conn) 71 { 72 hci_send_cmd(conn->hdev, HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL); 73 } 74 75 void hci_acl_connect(struct hci_conn *conn) 76 { 77 struct hci_dev *hdev = conn->hdev; 78 struct inquiry_entry *ie; 79 struct hci_cp_create_conn cp; 80 81 BT_DBG("%p", conn); 82 83 conn->state = BT_CONNECT; 84 conn->out = 1; 85 86 conn->link_mode = HCI_LM_MASTER; 87 88 conn->attempt++; 89 90 conn->link_policy = hdev->link_policy; 91 92 memset(&cp, 0, sizeof(cp)); 93 bacpy(&cp.bdaddr, &conn->dst); 94 cp.pscan_rep_mode = 0x02; 95 96 ie = hci_inquiry_cache_lookup(hdev, &conn->dst); 97 if (ie) { 98 if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) { 99 cp.pscan_rep_mode = ie->data.pscan_rep_mode; 100 cp.pscan_mode = ie->data.pscan_mode; 101 cp.clock_offset = ie->data.clock_offset | 102 cpu_to_le16(0x8000); 103 } 104 105 memcpy(conn->dev_class, ie->data.dev_class, 3); 106 conn->ssp_mode = ie->data.ssp_mode; 107 } 108 109 cp.pkt_type = cpu_to_le16(conn->pkt_type); 110 if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER)) 111 cp.role_switch = 0x01; 112 else 113 cp.role_switch = 0x00; 114 115 hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp); 116 } 117 118 static void hci_acl_connect_cancel(struct hci_conn *conn) 119 { 120 struct hci_cp_create_conn_cancel cp; 121 122 BT_DBG("%p", conn); 123 124 if (conn->hdev->hci_ver < 2) 125 return; 126 127 bacpy(&cp.bdaddr, &conn->dst); 128 hci_send_cmd(conn->hdev, HCI_OP_CREATE_CONN_CANCEL, sizeof(cp), &cp); 129 } 130 131 void hci_acl_disconn(struct hci_conn *conn, __u8 reason) 132 { 133 struct hci_cp_disconnect cp; 134 135 BT_DBG("%p", conn); 136 137 conn->state = BT_DISCONN; 138 139 cp.handle = cpu_to_le16(conn->handle); 140 cp.reason = reason; 141 hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp); 142 } 143 144 void hci_add_sco(struct hci_conn *conn, __u16 handle) 145 { 146 struct hci_dev *hdev = conn->hdev; 147 struct hci_cp_add_sco cp; 148 149 BT_DBG("%p", conn); 150 151 conn->state = BT_CONNECT; 152 conn->out = 1; 153 154 conn->attempt++; 155 156 cp.handle = cpu_to_le16(handle); 157 cp.pkt_type = cpu_to_le16(conn->pkt_type); 158 159 hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp); 160 } 161 162 void hci_setup_sync(struct hci_conn *conn, __u16 handle) 163 { 164 struct hci_dev *hdev = conn->hdev; 165 struct hci_cp_setup_sync_conn cp; 166 167 BT_DBG("%p", conn); 168 169 conn->state = BT_CONNECT; 170 conn->out = 1; 171 172 conn->attempt++; 173 174 cp.handle = cpu_to_le16(handle); 175 cp.pkt_type = cpu_to_le16(conn->pkt_type); 176 177 cp.tx_bandwidth = cpu_to_le32(0x00001f40); 178 cp.rx_bandwidth = cpu_to_le32(0x00001f40); 179 cp.max_latency = cpu_to_le16(0xffff); 180 cp.voice_setting = cpu_to_le16(hdev->voice_setting); 181 cp.retrans_effort = 0xff; 182 183 hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp); 184 } 185 186 void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max, 187 u16 latency, u16 to_multiplier) 188 { 189 struct hci_cp_le_conn_update cp; 190 struct hci_dev *hdev = conn->hdev; 191 192 memset(&cp, 0, sizeof(cp)); 193 194 cp.handle = cpu_to_le16(conn->handle); 195 cp.conn_interval_min = cpu_to_le16(min); 196 cp.conn_interval_max = cpu_to_le16(max); 197 cp.conn_latency = cpu_to_le16(latency); 198 cp.supervision_timeout = cpu_to_le16(to_multiplier); 199 cp.min_ce_len = cpu_to_le16(0x0001); 200 cp.max_ce_len = cpu_to_le16(0x0001); 201 202 hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp); 203 } 204 EXPORT_SYMBOL(hci_le_conn_update); 205 206 /* Device _must_ be locked */ 207 void hci_sco_setup(struct hci_conn *conn, __u8 status) 208 { 209 struct hci_conn *sco = conn->link; 210 211 BT_DBG("%p", conn); 212 213 if (!sco) 214 return; 215 216 if (!status) { 217 if (lmp_esco_capable(conn->hdev)) 218 hci_setup_sync(sco, conn->handle); 219 else 220 hci_add_sco(sco, conn->handle); 221 } else { 222 hci_proto_connect_cfm(sco, status); 223 hci_conn_del(sco); 224 } 225 } 226 227 static void hci_conn_timeout(unsigned long arg) 228 { 229 struct hci_conn *conn = (void *) arg; 230 struct hci_dev *hdev = conn->hdev; 231 __u8 reason; 232 233 BT_DBG("conn %p state %d", conn, conn->state); 234 235 if (atomic_read(&conn->refcnt)) 236 return; 237 238 hci_dev_lock(hdev); 239 240 switch (conn->state) { 241 case BT_CONNECT: 242 case BT_CONNECT2: 243 if (conn->out) { 244 if (conn->type == ACL_LINK) 245 hci_acl_connect_cancel(conn); 246 else if (conn->type == LE_LINK) 247 hci_le_connect_cancel(conn); 248 } 249 break; 250 case BT_CONFIG: 251 case BT_CONNECTED: 252 reason = hci_proto_disconn_ind(conn); 253 hci_acl_disconn(conn, reason); 254 break; 255 default: 256 conn->state = BT_CLOSED; 257 break; 258 } 259 260 hci_dev_unlock(hdev); 261 } 262 263 static void hci_conn_idle(unsigned long arg) 264 { 265 struct hci_conn *conn = (void *) arg; 266 267 BT_DBG("conn %p mode %d", conn, conn->mode); 268 269 hci_conn_enter_sniff_mode(conn); 270 } 271 272 struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst) 273 { 274 struct hci_conn *conn; 275 276 BT_DBG("%s dst %s", hdev->name, batostr(dst)); 277 278 conn = kzalloc(sizeof(struct hci_conn), GFP_ATOMIC); 279 if (!conn) 280 return NULL; 281 282 bacpy(&conn->dst, dst); 283 conn->hdev = hdev; 284 conn->type = type; 285 conn->mode = HCI_CM_ACTIVE; 286 conn->state = BT_OPEN; 287 conn->auth_type = HCI_AT_GENERAL_BONDING; 288 conn->io_capability = hdev->io_capability; 289 conn->remote_auth = 0xff; 290 291 conn->power_save = 1; 292 conn->disc_timeout = HCI_DISCONN_TIMEOUT; 293 294 switch (type) { 295 case ACL_LINK: 296 conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK; 297 break; 298 case SCO_LINK: 299 if (lmp_esco_capable(hdev)) 300 conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) | 301 (hdev->esco_type & EDR_ESCO_MASK); 302 else 303 conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK; 304 break; 305 case ESCO_LINK: 306 conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK; 307 break; 308 } 309 310 skb_queue_head_init(&conn->data_q); 311 312 setup_timer(&conn->disc_timer, hci_conn_timeout, (unsigned long)conn); 313 setup_timer(&conn->idle_timer, hci_conn_idle, (unsigned long)conn); 314 315 atomic_set(&conn->refcnt, 0); 316 317 hci_dev_hold(hdev); 318 319 tasklet_disable(&hdev->tx_task); 320 321 hci_conn_hash_add(hdev, conn); 322 if (hdev->notify) 323 hdev->notify(hdev, HCI_NOTIFY_CONN_ADD); 324 325 atomic_set(&conn->devref, 0); 326 327 hci_conn_init_sysfs(conn); 328 329 tasklet_enable(&hdev->tx_task); 330 331 return conn; 332 } 333 334 int hci_conn_del(struct hci_conn *conn) 335 { 336 struct hci_dev *hdev = conn->hdev; 337 338 BT_DBG("%s conn %p handle %d", hdev->name, conn, conn->handle); 339 340 del_timer(&conn->idle_timer); 341 342 del_timer(&conn->disc_timer); 343 344 if (conn->type == ACL_LINK) { 345 struct hci_conn *sco = conn->link; 346 if (sco) 347 sco->link = NULL; 348 349 /* Unacked frames */ 350 hdev->acl_cnt += conn->sent; 351 } else if (conn->type == LE_LINK) { 352 if (hdev->le_pkts) 353 hdev->le_cnt += conn->sent; 354 else 355 hdev->acl_cnt += conn->sent; 356 } else { 357 struct hci_conn *acl = conn->link; 358 if (acl) { 359 acl->link = NULL; 360 hci_conn_put(acl); 361 } 362 } 363 364 tasklet_disable(&hdev->tx_task); 365 366 hci_conn_hash_del(hdev, conn); 367 if (hdev->notify) 368 hdev->notify(hdev, HCI_NOTIFY_CONN_DEL); 369 370 tasklet_enable(&hdev->tx_task); 371 372 skb_queue_purge(&conn->data_q); 373 374 hci_conn_put_device(conn); 375 376 hci_dev_put(hdev); 377 378 return 0; 379 } 380 381 struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src) 382 { 383 int use_src = bacmp(src, BDADDR_ANY); 384 struct hci_dev *hdev = NULL; 385 struct list_head *p; 386 387 BT_DBG("%s -> %s", batostr(src), batostr(dst)); 388 389 read_lock_bh(&hci_dev_list_lock); 390 391 list_for_each(p, &hci_dev_list) { 392 struct hci_dev *d = list_entry(p, struct hci_dev, list); 393 394 if (!test_bit(HCI_UP, &d->flags) || test_bit(HCI_RAW, &d->flags)) 395 continue; 396 397 /* Simple routing: 398 * No source address - find interface with bdaddr != dst 399 * Source address - find interface with bdaddr == src 400 */ 401 402 if (use_src) { 403 if (!bacmp(&d->bdaddr, src)) { 404 hdev = d; break; 405 } 406 } else { 407 if (bacmp(&d->bdaddr, dst)) { 408 hdev = d; break; 409 } 410 } 411 } 412 413 if (hdev) 414 hdev = hci_dev_hold(hdev); 415 416 read_unlock_bh(&hci_dev_list_lock); 417 return hdev; 418 } 419 EXPORT_SYMBOL(hci_get_route); 420 421 /* Create SCO, ACL or LE connection. 422 * Device _must_ be locked */ 423 struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, __u8 sec_level, __u8 auth_type) 424 { 425 struct hci_conn *acl; 426 struct hci_conn *sco; 427 struct hci_conn *le; 428 429 BT_DBG("%s dst %s", hdev->name, batostr(dst)); 430 431 if (type == LE_LINK) { 432 le = hci_conn_hash_lookup_ba(hdev, LE_LINK, dst); 433 if (le) 434 return ERR_PTR(-EBUSY); 435 le = hci_conn_add(hdev, LE_LINK, dst); 436 if (!le) 437 return ERR_PTR(-ENOMEM); 438 if (le->state == BT_OPEN) 439 hci_le_connect(le); 440 441 hci_conn_hold(le); 442 443 return le; 444 } 445 446 acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst); 447 if (!acl) { 448 acl = hci_conn_add(hdev, ACL_LINK, dst); 449 if (!acl) 450 return NULL; 451 } 452 453 hci_conn_hold(acl); 454 455 if (acl->state == BT_OPEN || acl->state == BT_CLOSED) { 456 acl->sec_level = BT_SECURITY_LOW; 457 acl->pending_sec_level = sec_level; 458 acl->auth_type = auth_type; 459 hci_acl_connect(acl); 460 } 461 462 if (type == ACL_LINK) 463 return acl; 464 465 sco = hci_conn_hash_lookup_ba(hdev, type, dst); 466 if (!sco) { 467 sco = hci_conn_add(hdev, type, dst); 468 if (!sco) { 469 hci_conn_put(acl); 470 return NULL; 471 } 472 } 473 474 acl->link = sco; 475 sco->link = acl; 476 477 hci_conn_hold(sco); 478 479 if (acl->state == BT_CONNECTED && 480 (sco->state == BT_OPEN || sco->state == BT_CLOSED)) { 481 acl->power_save = 1; 482 hci_conn_enter_active_mode(acl); 483 484 if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->pend)) { 485 /* defer SCO setup until mode change completed */ 486 set_bit(HCI_CONN_SCO_SETUP_PEND, &acl->pend); 487 return sco; 488 } 489 490 hci_sco_setup(acl, 0x00); 491 } 492 493 return sco; 494 } 495 EXPORT_SYMBOL(hci_connect); 496 497 /* Check link security requirement */ 498 int hci_conn_check_link_mode(struct hci_conn *conn) 499 { 500 BT_DBG("conn %p", conn); 501 502 if (conn->ssp_mode > 0 && conn->hdev->ssp_mode > 0 && 503 !(conn->link_mode & HCI_LM_ENCRYPT)) 504 return 0; 505 506 return 1; 507 } 508 EXPORT_SYMBOL(hci_conn_check_link_mode); 509 510 /* Authenticate remote device */ 511 static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type) 512 { 513 BT_DBG("conn %p", conn); 514 515 if (conn->pending_sec_level > sec_level) 516 sec_level = conn->pending_sec_level; 517 518 if (sec_level > conn->sec_level) 519 conn->pending_sec_level = sec_level; 520 else if (conn->link_mode & HCI_LM_AUTH) 521 return 1; 522 523 /* Make sure we preserve an existing MITM requirement*/ 524 auth_type |= (conn->auth_type & 0x01); 525 526 conn->auth_type = auth_type; 527 528 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) { 529 struct hci_cp_auth_requested cp; 530 cp.handle = cpu_to_le16(conn->handle); 531 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED, 532 sizeof(cp), &cp); 533 } 534 535 return 0; 536 } 537 538 /* Enable security */ 539 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type) 540 { 541 BT_DBG("conn %p", conn); 542 543 if (sec_level == BT_SECURITY_SDP) 544 return 1; 545 546 if (sec_level == BT_SECURITY_LOW && 547 (!conn->ssp_mode || !conn->hdev->ssp_mode)) 548 return 1; 549 550 if (conn->link_mode & HCI_LM_ENCRYPT) 551 return hci_conn_auth(conn, sec_level, auth_type); 552 553 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend)) 554 return 0; 555 556 if (hci_conn_auth(conn, sec_level, auth_type)) { 557 struct hci_cp_set_conn_encrypt cp; 558 cp.handle = cpu_to_le16(conn->handle); 559 cp.encrypt = 1; 560 hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, 561 sizeof(cp), &cp); 562 } 563 564 return 0; 565 } 566 EXPORT_SYMBOL(hci_conn_security); 567 568 /* Change link key */ 569 int hci_conn_change_link_key(struct hci_conn *conn) 570 { 571 BT_DBG("conn %p", conn); 572 573 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) { 574 struct hci_cp_change_conn_link_key cp; 575 cp.handle = cpu_to_le16(conn->handle); 576 hci_send_cmd(conn->hdev, HCI_OP_CHANGE_CONN_LINK_KEY, 577 sizeof(cp), &cp); 578 } 579 580 return 0; 581 } 582 EXPORT_SYMBOL(hci_conn_change_link_key); 583 584 /* Switch role */ 585 int hci_conn_switch_role(struct hci_conn *conn, __u8 role) 586 { 587 BT_DBG("conn %p", conn); 588 589 if (!role && conn->link_mode & HCI_LM_MASTER) 590 return 1; 591 592 if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->pend)) { 593 struct hci_cp_switch_role cp; 594 bacpy(&cp.bdaddr, &conn->dst); 595 cp.role = role; 596 hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp); 597 } 598 599 return 0; 600 } 601 EXPORT_SYMBOL(hci_conn_switch_role); 602 603 /* Enter active mode */ 604 void hci_conn_enter_active_mode(struct hci_conn *conn) 605 { 606 struct hci_dev *hdev = conn->hdev; 607 608 BT_DBG("conn %p mode %d", conn, conn->mode); 609 610 if (test_bit(HCI_RAW, &hdev->flags)) 611 return; 612 613 if (conn->mode != HCI_CM_SNIFF || !conn->power_save) 614 goto timer; 615 616 if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) { 617 struct hci_cp_exit_sniff_mode cp; 618 cp.handle = cpu_to_le16(conn->handle); 619 hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp); 620 } 621 622 timer: 623 if (hdev->idle_timeout > 0) 624 mod_timer(&conn->idle_timer, 625 jiffies + msecs_to_jiffies(hdev->idle_timeout)); 626 } 627 628 /* Enter sniff mode */ 629 void hci_conn_enter_sniff_mode(struct hci_conn *conn) 630 { 631 struct hci_dev *hdev = conn->hdev; 632 633 BT_DBG("conn %p mode %d", conn, conn->mode); 634 635 if (test_bit(HCI_RAW, &hdev->flags)) 636 return; 637 638 if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn)) 639 return; 640 641 if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF)) 642 return; 643 644 if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) { 645 struct hci_cp_sniff_subrate cp; 646 cp.handle = cpu_to_le16(conn->handle); 647 cp.max_latency = cpu_to_le16(0); 648 cp.min_remote_timeout = cpu_to_le16(0); 649 cp.min_local_timeout = cpu_to_le16(0); 650 hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp); 651 } 652 653 if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) { 654 struct hci_cp_sniff_mode cp; 655 cp.handle = cpu_to_le16(conn->handle); 656 cp.max_interval = cpu_to_le16(hdev->sniff_max_interval); 657 cp.min_interval = cpu_to_le16(hdev->sniff_min_interval); 658 cp.attempt = cpu_to_le16(4); 659 cp.timeout = cpu_to_le16(1); 660 hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp); 661 } 662 } 663 664 /* Drop all connection on the device */ 665 void hci_conn_hash_flush(struct hci_dev *hdev) 666 { 667 struct hci_conn_hash *h = &hdev->conn_hash; 668 struct list_head *p; 669 670 BT_DBG("hdev %s", hdev->name); 671 672 p = h->list.next; 673 while (p != &h->list) { 674 struct hci_conn *c; 675 676 c = list_entry(p, struct hci_conn, list); 677 p = p->next; 678 679 c->state = BT_CLOSED; 680 681 hci_proto_disconn_cfm(c, 0x16); 682 hci_conn_del(c); 683 } 684 } 685 686 /* Check pending connect attempts */ 687 void hci_conn_check_pending(struct hci_dev *hdev) 688 { 689 struct hci_conn *conn; 690 691 BT_DBG("hdev %s", hdev->name); 692 693 hci_dev_lock(hdev); 694 695 conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2); 696 if (conn) 697 hci_acl_connect(conn); 698 699 hci_dev_unlock(hdev); 700 } 701 702 void hci_conn_hold_device(struct hci_conn *conn) 703 { 704 atomic_inc(&conn->devref); 705 } 706 EXPORT_SYMBOL(hci_conn_hold_device); 707 708 void hci_conn_put_device(struct hci_conn *conn) 709 { 710 if (atomic_dec_and_test(&conn->devref)) 711 hci_conn_del_sysfs(conn); 712 } 713 EXPORT_SYMBOL(hci_conn_put_device); 714 715 int hci_get_conn_list(void __user *arg) 716 { 717 struct hci_conn_list_req req, *cl; 718 struct hci_conn_info *ci; 719 struct hci_dev *hdev; 720 struct list_head *p; 721 int n = 0, size, err; 722 723 if (copy_from_user(&req, arg, sizeof(req))) 724 return -EFAULT; 725 726 if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci)) 727 return -EINVAL; 728 729 size = sizeof(req) + req.conn_num * sizeof(*ci); 730 731 cl = kmalloc(size, GFP_KERNEL); 732 if (!cl) 733 return -ENOMEM; 734 735 hdev = hci_dev_get(req.dev_id); 736 if (!hdev) { 737 kfree(cl); 738 return -ENODEV; 739 } 740 741 ci = cl->conn_info; 742 743 hci_dev_lock_bh(hdev); 744 list_for_each(p, &hdev->conn_hash.list) { 745 register struct hci_conn *c; 746 c = list_entry(p, struct hci_conn, list); 747 748 bacpy(&(ci + n)->bdaddr, &c->dst); 749 (ci + n)->handle = c->handle; 750 (ci + n)->type = c->type; 751 (ci + n)->out = c->out; 752 (ci + n)->state = c->state; 753 (ci + n)->link_mode = c->link_mode; 754 if (++n >= req.conn_num) 755 break; 756 } 757 hci_dev_unlock_bh(hdev); 758 759 cl->dev_id = hdev->id; 760 cl->conn_num = n; 761 size = sizeof(req) + n * sizeof(*ci); 762 763 hci_dev_put(hdev); 764 765 err = copy_to_user(arg, cl, size); 766 kfree(cl); 767 768 return err ? -EFAULT : 0; 769 } 770 771 int hci_get_conn_info(struct hci_dev *hdev, void __user *arg) 772 { 773 struct hci_conn_info_req req; 774 struct hci_conn_info ci; 775 struct hci_conn *conn; 776 char __user *ptr = arg + sizeof(req); 777 778 if (copy_from_user(&req, arg, sizeof(req))) 779 return -EFAULT; 780 781 hci_dev_lock_bh(hdev); 782 conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr); 783 if (conn) { 784 bacpy(&ci.bdaddr, &conn->dst); 785 ci.handle = conn->handle; 786 ci.type = conn->type; 787 ci.out = conn->out; 788 ci.state = conn->state; 789 ci.link_mode = conn->link_mode; 790 } 791 hci_dev_unlock_bh(hdev); 792 793 if (!conn) 794 return -ENOENT; 795 796 return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0; 797 } 798 799 int hci_get_auth_info(struct hci_dev *hdev, void __user *arg) 800 { 801 struct hci_auth_info_req req; 802 struct hci_conn *conn; 803 804 if (copy_from_user(&req, arg, sizeof(req))) 805 return -EFAULT; 806 807 hci_dev_lock_bh(hdev); 808 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr); 809 if (conn) 810 req.type = conn->auth_type; 811 hci_dev_unlock_bh(hdev); 812 813 if (!conn) 814 return -ENOENT; 815 816 return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0; 817 } 818