?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Linux 4.1.18
[linux/fpc-iii.git] / net / bluetooth / hci_conn.c
blobee5e59839b0294a6db0ea95f9f3eda4db0e4c503
1 /*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
4
5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22 SOFTWARE IS DISCLAIMED.
23 */
24
25 /* Bluetooth HCI connection handling. */
26
27 #include <linux/export.h>
28 #include <linux/debugfs.h>
29
30 #include <net/bluetooth/bluetooth.h>
31 #include <net/bluetooth/hci_core.h>
32 #include <net/bluetooth/l2cap.h>
33
34 #include "hci_request.h"
35 #include "smp.h"
36 #include "a2mp.h"
37
38 struct sco_param {
39 u16 pkt_type;
40 u16 max_latency;
41 u8 retrans_effort;
42 };
43
44 static const struct sco_param esco_param_cvsd[] = {
45 { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000a, 0x01 }, /* S3 */
46 { EDR_ESCO_MASK & ~ESCO_2EV3, 0x0007, 0x01 }, /* S2 */
47 { EDR_ESCO_MASK | ESCO_EV3, 0x0007, 0x01 }, /* S1 */
48 { EDR_ESCO_MASK | ESCO_HV3, 0xffff, 0x01 }, /* D1 */
49 { EDR_ESCO_MASK | ESCO_HV1, 0xffff, 0x01 }, /* D0 */
50 };
51
52 static const struct sco_param sco_param_cvsd[] = {
53 { EDR_ESCO_MASK | ESCO_HV3, 0xffff, 0xff }, /* D1 */
54 { EDR_ESCO_MASK | ESCO_HV1, 0xffff, 0xff }, /* D0 */
55 };
56
57 static const struct sco_param esco_param_msbc[] = {
58 { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000d, 0x02 }, /* T2 */
59 { EDR_ESCO_MASK | ESCO_EV3, 0x0008, 0x02 }, /* T1 */
60 };
61
62 static void hci_le_create_connection_cancel(struct hci_conn *conn)
63 {
64 hci_send_cmd(conn->hdev, HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL);
65 }
66
67 static void hci_acl_create_connection(struct hci_conn *conn)
68 {
69 struct hci_dev *hdev = conn->hdev;
70 struct inquiry_entry *ie;
71 struct hci_cp_create_conn cp;
72
73 BT_DBG("hcon %p", conn);
74
75 conn->state = BT_CONNECT;
76 conn->out = true;
77 conn->role = HCI_ROLE_MASTER;
78
79 conn->attempt++;
80
81 conn->link_policy = hdev->link_policy;
82
83 memset(&cp, 0, sizeof(cp));
84 bacpy(&cp.bdaddr, &conn->dst);
85 cp.pscan_rep_mode = 0x02;
86
87 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
88 if (ie) {
89 if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
90 cp.pscan_rep_mode = ie->data.pscan_rep_mode;
91 cp.pscan_mode = ie->data.pscan_mode;
92 cp.clock_offset = ie->data.clock_offset |
93 cpu_to_le16(0x8000);
94 }
95
96 memcpy(conn->dev_class, ie->data.dev_class, 3);
97 if (ie->data.ssp_mode > 0)
98 set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
99 }
100
101 cp.pkt_type = cpu_to_le16(conn->pkt_type);
102 if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
103 cp.role_switch = 0x01;
104 else
105 cp.role_switch = 0x00;
106
107 hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
108 }
109
110 static void hci_acl_create_connection_cancel(struct hci_conn *conn)
111 {
112 struct hci_cp_create_conn_cancel cp;
113
114 BT_DBG("hcon %p", conn);
115
116 if (conn->hdev->hci_ver < BLUETOOTH_VER_1_2)
117 return;
118
119 bacpy(&cp.bdaddr, &conn->dst);
120 hci_send_cmd(conn->hdev, HCI_OP_CREATE_CONN_CANCEL, sizeof(cp), &cp);
121 }
122
123 static void hci_reject_sco(struct hci_conn *conn)
124 {
125 struct hci_cp_reject_sync_conn_req cp;
126
127 cp.reason = HCI_ERROR_REJ_LIMITED_RESOURCES;
128 bacpy(&cp.bdaddr, &conn->dst);
129
130 hci_send_cmd(conn->hdev, HCI_OP_REJECT_SYNC_CONN_REQ, sizeof(cp), &cp);
131 }
132
133 int hci_disconnect(struct hci_conn *conn, __u8 reason)
134 {
135 struct hci_cp_disconnect cp;
136
137 BT_DBG("hcon %p", conn);
138
139 /* When we are master of an established connection and it enters
140 * the disconnect timeout, then go ahead and try to read the
141 * current clock offset. Processing of the result is done
142 * within the event handling and hci_clock_offset_evt function.
143 */
144 if (conn->type == ACL_LINK && conn->role == HCI_ROLE_MASTER) {
145 struct hci_dev *hdev = conn->hdev;
146 struct hci_cp_read_clock_offset clkoff_cp;
147
148 clkoff_cp.handle = cpu_to_le16(conn->handle);
149 hci_send_cmd(hdev, HCI_OP_READ_CLOCK_OFFSET, sizeof(clkoff_cp),
150 &clkoff_cp);
151 }
152
153 conn->state = BT_DISCONN;
154
155 cp.handle = cpu_to_le16(conn->handle);
156 cp.reason = reason;
157 return hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp);
158 }
159
160 static void hci_amp_disconn(struct hci_conn *conn)
161 {
162 struct hci_cp_disconn_phy_link cp;
163
164 BT_DBG("hcon %p", conn);
165
166 conn->state = BT_DISCONN;
167
168 cp.phy_handle = HCI_PHY_HANDLE(conn->handle);
169 cp.reason = hci_proto_disconn_ind(conn);
170 hci_send_cmd(conn->hdev, HCI_OP_DISCONN_PHY_LINK,
171 sizeof(cp), &cp);
172 }
173
174 static void hci_add_sco(struct hci_conn *conn, __u16 handle)
175 {
176 struct hci_dev *hdev = conn->hdev;
177 struct hci_cp_add_sco cp;
178
179 BT_DBG("hcon %p", conn);
180
181 conn->state = BT_CONNECT;
182 conn->out = true;
183
184 conn->attempt++;
185
186 cp.handle = cpu_to_le16(handle);
187 cp.pkt_type = cpu_to_le16(conn->pkt_type);
188
189 hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
190 }
191
192 bool hci_setup_sync(struct hci_conn *conn, __u16 handle)
193 {
194 struct hci_dev *hdev = conn->hdev;
195 struct hci_cp_setup_sync_conn cp;
196 const struct sco_param *param;
197
198 BT_DBG("hcon %p", conn);
199
200 conn->state = BT_CONNECT;
201 conn->out = true;
202
203 conn->attempt++;
204
205 cp.handle = cpu_to_le16(handle);
206
207 cp.tx_bandwidth = cpu_to_le32(0x00001f40);
208 cp.rx_bandwidth = cpu_to_le32(0x00001f40);
209 cp.voice_setting = cpu_to_le16(conn->setting);
210
211 switch (conn->setting & SCO_AIRMODE_MASK) {
212 case SCO_AIRMODE_TRANSP:
213 if (conn->attempt > ARRAY_SIZE(esco_param_msbc))
214 return false;
215 param = &esco_param_msbc[conn->attempt - 1];
216 break;
217 case SCO_AIRMODE_CVSD:
218 if (lmp_esco_capable(conn->link)) {
219 if (conn->attempt > ARRAY_SIZE(esco_param_cvsd))
220 return false;
221 param = &esco_param_cvsd[conn->attempt - 1];
222 } else {
223 if (conn->attempt > ARRAY_SIZE(sco_param_cvsd))
224 return false;
225 param = &sco_param_cvsd[conn->attempt - 1];
226 }
227 break;
228 default:
229 return false;
230 }
231
232 cp.retrans_effort = param->retrans_effort;
233 cp.pkt_type = __cpu_to_le16(param->pkt_type);
234 cp.max_latency = __cpu_to_le16(param->max_latency);
235
236 if (hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp) < 0)
237 return false;
238
239 return true;
240 }
241
242 u8 hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max, u16 latency,
243 u16 to_multiplier)
244 {
245 struct hci_dev *hdev = conn->hdev;
246 struct hci_conn_params *params;
247 struct hci_cp_le_conn_update cp;
248
249 hci_dev_lock(hdev);
250
251 params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
252 if (params) {
253 params->conn_min_interval = min;
254 params->conn_max_interval = max;
255 params->conn_latency = latency;
256 params->supervision_timeout = to_multiplier;
257 }
258
259 hci_dev_unlock(hdev);
260
261 memset(&cp, 0, sizeof(cp));
262 cp.handle = cpu_to_le16(conn->handle);
263 cp.conn_interval_min = cpu_to_le16(min);
264 cp.conn_interval_max = cpu_to_le16(max);
265 cp.conn_latency = cpu_to_le16(latency);
266 cp.supervision_timeout = cpu_to_le16(to_multiplier);
267 cp.min_ce_len = cpu_to_le16(0x0000);
268 cp.max_ce_len = cpu_to_le16(0x0000);
269
270 hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp);
271
272 if (params)
273 return 0x01;
274
275 return 0x00;
276 }
277
278 void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __le64 rand,
279 __u8 ltk[16])
280 {
281 struct hci_dev *hdev = conn->hdev;
282 struct hci_cp_le_start_enc cp;
283
284 BT_DBG("hcon %p", conn);
285
286 memset(&cp, 0, sizeof(cp));
287
288 cp.handle = cpu_to_le16(conn->handle);
289 cp.rand = rand;
290 cp.ediv = ediv;
291 memcpy(cp.ltk, ltk, sizeof(cp.ltk));
292
293 hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp);
294 }
295
296 /* Device _must_ be locked */
297 void hci_sco_setup(struct hci_conn *conn, __u8 status)
298 {
299 struct hci_conn *sco = conn->link;
300
301 if (!sco)
302 return;
303
304 BT_DBG("hcon %p", conn);
305
306 if (!status) {
307 if (lmp_esco_capable(conn->hdev))
308 hci_setup_sync(sco, conn->handle);
309 else
310 hci_add_sco(sco, conn->handle);
311 } else {
312 hci_connect_cfm(sco, status);
313 hci_conn_del(sco);
314 }
315 }
316
317 static void hci_conn_timeout(struct work_struct *work)
318 {
319 struct hci_conn *conn = container_of(work, struct hci_conn,
320 disc_work.work);
321 int refcnt = atomic_read(&conn->refcnt);
322
323 BT_DBG("hcon %p state %s", conn, state_to_string(conn->state));
324
325 WARN_ON(refcnt < 0);
326
327 /* FIXME: It was observed that in pairing failed scenario, refcnt
328 * drops below 0. Probably this is because l2cap_conn_del calls
329 * l2cap_chan_del for each channel, and inside l2cap_chan_del conn is
330 * dropped. After that loop hci_chan_del is called which also drops
331 * conn. For now make sure that ACL is alive if refcnt is higher then 0,
332 * otherwise drop it.
333 */
334 if (refcnt > 0)
335 return;
336
337 switch (conn->state) {
338 case BT_CONNECT:
339 case BT_CONNECT2:
340 if (conn->out) {
341 if (conn->type == ACL_LINK)
342 hci_acl_create_connection_cancel(conn);
343 else if (conn->type == LE_LINK)
344 hci_le_create_connection_cancel(conn);
345 } else if (conn->type == SCO_LINK || conn->type == ESCO_LINK) {
346 hci_reject_sco(conn);
347 }
348 break;
349 case BT_CONFIG:
350 case BT_CONNECTED:
351 if (conn->type == AMP_LINK) {
352 hci_amp_disconn(conn);
353 } else {
354 __u8 reason = hci_proto_disconn_ind(conn);
355 hci_disconnect(conn, reason);
356 }
357 break;
358 default:
359 conn->state = BT_CLOSED;
360 break;
361 }
362 }
363
364 /* Enter sniff mode */
365 static void hci_conn_idle(struct work_struct *work)
366 {
367 struct hci_conn *conn = container_of(work, struct hci_conn,
368 idle_work.work);
369 struct hci_dev *hdev = conn->hdev;
370
371 BT_DBG("hcon %p mode %d", conn, conn->mode);
372
373 if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn))
374 return;
375
376 if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF))
377 return;
378
379 if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
380 struct hci_cp_sniff_subrate cp;
381 cp.handle = cpu_to_le16(conn->handle);
382 cp.max_latency = cpu_to_le16(0);
383 cp.min_remote_timeout = cpu_to_le16(0);
384 cp.min_local_timeout = cpu_to_le16(0);
385 hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
386 }
387
388 if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
389 struct hci_cp_sniff_mode cp;
390 cp.handle = cpu_to_le16(conn->handle);
391 cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
392 cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
393 cp.attempt = cpu_to_le16(4);
394 cp.timeout = cpu_to_le16(1);
395 hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
396 }
397 }
398
399 static void hci_conn_auto_accept(struct work_struct *work)
400 {
401 struct hci_conn *conn = container_of(work, struct hci_conn,
402 auto_accept_work.work);
403
404 hci_send_cmd(conn->hdev, HCI_OP_USER_CONFIRM_REPLY, sizeof(conn->dst),
405 &conn->dst);
406 }
407
408 static void le_conn_timeout(struct work_struct *work)
409 {
410 struct hci_conn *conn = container_of(work, struct hci_conn,
411 le_conn_timeout.work);
412 struct hci_dev *hdev = conn->hdev;
413
414 BT_DBG("");
415
416 /* We could end up here due to having done directed advertising,
417 * so clean up the state if necessary. This should however only
418 * happen with broken hardware or if low duty cycle was used
419 * (which doesn't have a timeout of its own).
420 */
421 if (conn->role == HCI_ROLE_SLAVE) {
422 u8 enable = 0x00;
423 hci_send_cmd(hdev, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable),
424 &enable);
425 hci_le_conn_failed(conn, HCI_ERROR_ADVERTISING_TIMEOUT);
426 return;
427 }
428
429 hci_le_create_connection_cancel(conn);
430 }
431
432 struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst,
433 u8 role)
434 {
435 struct hci_conn *conn;
436
437 BT_DBG("%s dst %pMR", hdev->name, dst);
438
439 conn = kzalloc(sizeof(*conn), GFP_KERNEL);
440 if (!conn)
441 return NULL;
442
443 bacpy(&conn->dst, dst);
444 bacpy(&conn->src, &hdev->bdaddr);
445 conn->hdev = hdev;
446 conn->type = type;
447 conn->role = role;
448 conn->mode = HCI_CM_ACTIVE;
449 conn->state = BT_OPEN;
450 conn->auth_type = HCI_AT_GENERAL_BONDING;
451 conn->io_capability = hdev->io_capability;
452 conn->remote_auth = 0xff;
453 conn->key_type = 0xff;
454 conn->rssi = HCI_RSSI_INVALID;
455 conn->tx_power = HCI_TX_POWER_INVALID;
456 conn->max_tx_power = HCI_TX_POWER_INVALID;
457
458 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
459 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
460
461 if (conn->role == HCI_ROLE_MASTER)
462 conn->out = true;
463
464 switch (type) {
465 case ACL_LINK:
466 conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
467 break;
468 case LE_LINK:
469 /* conn->src should reflect the local identity address */
470 hci_copy_identity_address(hdev, &conn->src, &conn->src_type);
471 break;
472 case SCO_LINK:
473 if (lmp_esco_capable(hdev))
474 conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
475 (hdev->esco_type & EDR_ESCO_MASK);
476 else
477 conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
478 break;
479 case ESCO_LINK:
480 conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
481 break;
482 }
483
484 skb_queue_head_init(&conn->data_q);
485
486 INIT_LIST_HEAD(&conn->chan_list);
487
488 INIT_DELAYED_WORK(&conn->disc_work, hci_conn_timeout);
489 INIT_DELAYED_WORK(&conn->auto_accept_work, hci_conn_auto_accept);
490 INIT_DELAYED_WORK(&conn->idle_work, hci_conn_idle);
491 INIT_DELAYED_WORK(&conn->le_conn_timeout, le_conn_timeout);
492
493 atomic_set(&conn->refcnt, 0);
494
495 hci_dev_hold(hdev);
496
497 hci_conn_hash_add(hdev, conn);
498 if (hdev->notify)
499 hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
500
501 hci_conn_init_sysfs(conn);
502
503 return conn;
504 }
505
506 int hci_conn_del(struct hci_conn *conn)
507 {
508 struct hci_dev *hdev = conn->hdev;
509
510 BT_DBG("%s hcon %p handle %d", hdev->name, conn, conn->handle);
511
512 cancel_delayed_work_sync(&conn->disc_work);
513 cancel_delayed_work_sync(&conn->auto_accept_work);
514 cancel_delayed_work_sync(&conn->idle_work);
515
516 if (conn->type == ACL_LINK) {
517 struct hci_conn *sco = conn->link;
518 if (sco)
519 sco->link = NULL;
520
521 /* Unacked frames */
522 hdev->acl_cnt += conn->sent;
523 } else if (conn->type == LE_LINK) {
524 cancel_delayed_work(&conn->le_conn_timeout);
525
526 if (hdev->le_pkts)
527 hdev->le_cnt += conn->sent;
528 else
529 hdev->acl_cnt += conn->sent;
530 } else {
531 struct hci_conn *acl = conn->link;
532 if (acl) {
533 acl->link = NULL;
534 hci_conn_drop(acl);
535 }
536 }
537
538 hci_chan_list_flush(conn);
539
540 if (conn->amp_mgr)
541 amp_mgr_put(conn->amp_mgr);
542
543 hci_conn_hash_del(hdev, conn);
544 if (hdev->notify)
545 hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
546
547 skb_queue_purge(&conn->data_q);
548
549 hci_conn_del_sysfs(conn);
550
551 debugfs_remove_recursive(conn->debugfs);
552
553 if (test_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags))
554 hci_conn_params_del(conn->hdev, &conn->dst, conn->dst_type);
555
556 hci_dev_put(hdev);
557
558 hci_conn_put(conn);
559
560 return 0;
561 }
562
563 struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src)
564 {
565 int use_src = bacmp(src, BDADDR_ANY);
566 struct hci_dev *hdev = NULL, *d;
567
568 BT_DBG("%pMR -> %pMR", src, dst);
569
570 read_lock(&hci_dev_list_lock);
571
572 list_for_each_entry(d, &hci_dev_list, list) {
573 if (!test_bit(HCI_UP, &d->flags) ||
574 hci_dev_test_flag(d, HCI_USER_CHANNEL) ||
575 d->dev_type != HCI_BREDR)
576 continue;
577
578 /* Simple routing:
579 * No source address - find interface with bdaddr != dst
580 * Source address - find interface with bdaddr == src
581 */
582
583 if (use_src) {
584 if (!bacmp(&d->bdaddr, src)) {
585 hdev = d; break;
586 }
587 } else {
588 if (bacmp(&d->bdaddr, dst)) {
589 hdev = d; break;
590 }
591 }
592 }
593
594 if (hdev)
595 hdev = hci_dev_hold(hdev);
596
597 read_unlock(&hci_dev_list_lock);
598 return hdev;
599 }
600 EXPORT_SYMBOL(hci_get_route);
601
602 /* This function requires the caller holds hdev->lock */
603 void hci_le_conn_failed(struct hci_conn *conn, u8 status)
604 {
605 struct hci_dev *hdev = conn->hdev;
606 struct hci_conn_params *params;
607
608 params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
609 conn->dst_type);
610 if (params && params->conn) {
611 hci_conn_drop(params->conn);
612 hci_conn_put(params->conn);
613 params->conn = NULL;
614 }
615
616 conn->state = BT_CLOSED;
617
618 mgmt_connect_failed(hdev, &conn->dst, conn->type, conn->dst_type,
619 status);
620
621 hci_connect_cfm(conn, status);
622
623 hci_conn_del(conn);
624
625 /* Since we may have temporarily stopped the background scanning in
626 * favor of connection establishment, we should restart it.
627 */
628 hci_update_background_scan(hdev);
629
630 /* Re-enable advertising in case this was a failed connection
631 * attempt as a peripheral.
632 */
633 mgmt_reenable_advertising(hdev);
634 }
635
636 static void create_le_conn_complete(struct hci_dev *hdev, u8 status, u16 opcode)
637 {
638 struct hci_conn *conn;
639
640 if (status == 0)
641 return;
642
643 BT_ERR("HCI request failed to create LE connection: status 0x%2.2x",
644 status);
645
646 hci_dev_lock(hdev);
647
648 conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
649 if (!conn)
650 goto done;
651
652 hci_le_conn_failed(conn, status);
653
654 done:
655 hci_dev_unlock(hdev);
656 }
657
658 static void hci_req_add_le_create_conn(struct hci_request *req,
659 struct hci_conn *conn)
660 {
661 struct hci_cp_le_create_conn cp;
662 struct hci_dev *hdev = conn->hdev;
663 u8 own_addr_type;
664
665 memset(&cp, 0, sizeof(cp));
666
667 /* Update random address, but set require_privacy to false so
668 * that we never connect with an non-resolvable address.
669 */
670 if (hci_update_random_address(req, false, &own_addr_type))
671 return;
672
673 cp.scan_interval = cpu_to_le16(hdev->le_scan_interval);
674 cp.scan_window = cpu_to_le16(hdev->le_scan_window);
675 bacpy(&cp.peer_addr, &conn->dst);
676 cp.peer_addr_type = conn->dst_type;
677 cp.own_address_type = own_addr_type;
678 cp.conn_interval_min = cpu_to_le16(conn->le_conn_min_interval);
679 cp.conn_interval_max = cpu_to_le16(conn->le_conn_max_interval);
680 cp.conn_latency = cpu_to_le16(conn->le_conn_latency);
681 cp.supervision_timeout = cpu_to_le16(conn->le_supv_timeout);
682 cp.min_ce_len = cpu_to_le16(0x0000);
683 cp.max_ce_len = cpu_to_le16(0x0000);
684
685 hci_req_add(req, HCI_OP_LE_CREATE_CONN, sizeof(cp), &cp);
686
687 conn->state = BT_CONNECT;
688 }
689
690 static void hci_req_directed_advertising(struct hci_request *req,
691 struct hci_conn *conn)
692 {
693 struct hci_dev *hdev = req->hdev;
694 struct hci_cp_le_set_adv_param cp;
695 u8 own_addr_type;
696 u8 enable;
697
698 /* Clear the HCI_LE_ADV bit temporarily so that the
699 * hci_update_random_address knows that it's safe to go ahead
700 * and write a new random address. The flag will be set back on
701 * as soon as the SET_ADV_ENABLE HCI command completes.
702 */
703 hci_dev_clear_flag(hdev, HCI_LE_ADV);
704
705 /* Set require_privacy to false so that the remote device has a
706 * chance of identifying us.
707 */
708 if (hci_update_random_address(req, false, &own_addr_type) < 0)
709 return;
710
711 memset(&cp, 0, sizeof(cp));
712 cp.type = LE_ADV_DIRECT_IND;
713 cp.own_address_type = own_addr_type;
714 cp.direct_addr_type = conn->dst_type;
715 bacpy(&cp.direct_addr, &conn->dst);
716 cp.channel_map = hdev->le_adv_channel_map;
717
718 hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
719
720 enable = 0x01;
721 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
722
723 conn->state = BT_CONNECT;
724 }
725
726 struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,
727 u8 dst_type, u8 sec_level, u16 conn_timeout,
728 u8 role)
729 {
730 struct hci_conn_params *params;
731 struct hci_conn *conn;
732 struct smp_irk *irk;
733 struct hci_request req;
734 int err;
735
736 /* Let's make sure that le is enabled.*/
737 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
738 if (lmp_le_capable(hdev))
739 return ERR_PTR(-ECONNREFUSED);
740
741 return ERR_PTR(-EOPNOTSUPP);
742 }
743
744 /* Some devices send ATT messages as soon as the physical link is
745 * established. To be able to handle these ATT messages, the user-
746 * space first establishes the connection and then starts the pairing
747 * process.
748 *
749 * So if a hci_conn object already exists for the following connection
750 * attempt, we simply update pending_sec_level and auth_type fields
751 * and return the object found.
752 */
753 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, dst);
754 if (conn) {
755 conn->pending_sec_level = sec_level;
756 goto done;
757 }
758
759 /* Since the controller supports only one LE connection attempt at a
760 * time, we return -EBUSY if there is any connection attempt running.
761 */
762 conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
763 if (conn)
764 return ERR_PTR(-EBUSY);
765
766 /* When given an identity address with existing identity
767 * resolving key, the connection needs to be established
768 * to a resolvable random address.
769 *
770 * This uses the cached random resolvable address from
771 * a previous scan. When no cached address is available,
772 * try connecting to the identity address instead.
773 *
774 * Storing the resolvable random address is required here
775 * to handle connection failures. The address will later
776 * be resolved back into the original identity address
777 * from the connect request.
778 */
779 irk = hci_find_irk_by_addr(hdev, dst, dst_type);
780 if (irk && bacmp(&irk->rpa, BDADDR_ANY)) {
781 dst = &irk->rpa;
782 dst_type = ADDR_LE_DEV_RANDOM;
783 }
784
785 conn = hci_conn_add(hdev, LE_LINK, dst, role);
786 if (!conn)
787 return ERR_PTR(-ENOMEM);
788
789 conn->dst_type = dst_type;
790 conn->sec_level = BT_SECURITY_LOW;
791 conn->pending_sec_level = sec_level;
792 conn->conn_timeout = conn_timeout;
793
794 hci_req_init(&req, hdev);
795
796 /* Disable advertising if we're active. For master role
797 * connections most controllers will refuse to connect if
798 * advertising is enabled, and for slave role connections we
799 * anyway have to disable it in order to start directed
800 * advertising.
801 */
802 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) {
803 u8 enable = 0x00;
804 hci_req_add(&req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable),
805 &enable);
806 }
807
808 /* If requested to connect as slave use directed advertising */
809 if (conn->role == HCI_ROLE_SLAVE) {
810 /* If we're active scanning most controllers are unable
811 * to initiate advertising. Simply reject the attempt.
812 */
813 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
814 hdev->le_scan_type == LE_SCAN_ACTIVE) {
815 skb_queue_purge(&req.cmd_q);
816 hci_conn_del(conn);
817 return ERR_PTR(-EBUSY);
818 }
819
820 hci_req_directed_advertising(&req, conn);
821 goto create_conn;
822 }
823
824 params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
825 if (params) {
826 conn->le_conn_min_interval = params->conn_min_interval;
827 conn->le_conn_max_interval = params->conn_max_interval;
828 conn->le_conn_latency = params->conn_latency;
829 conn->le_supv_timeout = params->supervision_timeout;
830 } else {
831 conn->le_conn_min_interval = hdev->le_conn_min_interval;
832 conn->le_conn_max_interval = hdev->le_conn_max_interval;
833 conn->le_conn_latency = hdev->le_conn_latency;
834 conn->le_supv_timeout = hdev->le_supv_timeout;
835 }
836
837 /* If controller is scanning, we stop it since some controllers are
838 * not able to scan and connect at the same time. Also set the
839 * HCI_LE_SCAN_INTERRUPTED flag so that the command complete
840 * handler for scan disabling knows to set the correct discovery
841 * state.
842 */
843 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
844 hci_req_add_le_scan_disable(&req);
845 hci_dev_set_flag(hdev, HCI_LE_SCAN_INTERRUPTED);
846 }
847
848 hci_req_add_le_create_conn(&req, conn);
849
850 create_conn:
851 err = hci_req_run(&req, create_le_conn_complete);
852 if (err) {
853 hci_conn_del(conn);
854 return ERR_PTR(err);
855 }
856
857 done:
858 hci_conn_hold(conn);
859 return conn;
860 }
861
862 struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst,
863 u8 sec_level, u8 auth_type)
864 {
865 struct hci_conn *acl;
866
867 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
868 if (lmp_bredr_capable(hdev))
869 return ERR_PTR(-ECONNREFUSED);
870
871 return ERR_PTR(-EOPNOTSUPP);
872 }
873
874 acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
875 if (!acl) {
876 acl = hci_conn_add(hdev, ACL_LINK, dst, HCI_ROLE_MASTER);
877 if (!acl)
878 return ERR_PTR(-ENOMEM);
879 }
880
881 hci_conn_hold(acl);
882
883 if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
884 acl->sec_level = BT_SECURITY_LOW;
885 acl->pending_sec_level = sec_level;
886 acl->auth_type = auth_type;
887 hci_acl_create_connection(acl);
888 }
889
890 return acl;
891 }
892
893 struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type, bdaddr_t *dst,
894 __u16 setting)
895 {
896 struct hci_conn *acl;
897 struct hci_conn *sco;
898
899 acl = hci_connect_acl(hdev, dst, BT_SECURITY_LOW, HCI_AT_NO_BONDING);
900 if (IS_ERR(acl))
901 return acl;
902
903 sco = hci_conn_hash_lookup_ba(hdev, type, dst);
904 if (!sco) {
905 sco = hci_conn_add(hdev, type, dst, HCI_ROLE_MASTER);
906 if (!sco) {
907 hci_conn_drop(acl);
908 return ERR_PTR(-ENOMEM);
909 }
910 }
911
912 acl->link = sco;
913 sco->link = acl;
914
915 hci_conn_hold(sco);
916
917 sco->setting = setting;
918
919 if (acl->state == BT_CONNECTED &&
920 (sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
921 set_bit(HCI_CONN_POWER_SAVE, &acl->flags);
922 hci_conn_enter_active_mode(acl, BT_POWER_FORCE_ACTIVE_ON);
923
924 if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->flags)) {
925 /* defer SCO setup until mode change completed */
926 set_bit(HCI_CONN_SCO_SETUP_PEND, &acl->flags);
927 return sco;
928 }
929
930 hci_sco_setup(acl, 0x00);
931 }
932
933 return sco;
934 }
935
936 /* Check link security requirement */
937 int hci_conn_check_link_mode(struct hci_conn *conn)
938 {
939 BT_DBG("hcon %p", conn);
940
941 /* In Secure Connections Only mode, it is required that Secure
942 * Connections is used and the link is encrypted with AES-CCM
943 * using a P-256 authenticated combination key.
944 */
945 if (hci_dev_test_flag(conn->hdev, HCI_SC_ONLY)) {
946 if (!hci_conn_sc_enabled(conn) ||
947 !test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
948 conn->key_type != HCI_LK_AUTH_COMBINATION_P256)
949 return 0;
950 }
951
952 if (hci_conn_ssp_enabled(conn) &&
953 !test_bit(HCI_CONN_ENCRYPT, &conn->flags))
954 return 0;
955
956 return 1;
957 }
958
959 /* Authenticate remote device */
960 static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
961 {
962 BT_DBG("hcon %p", conn);
963
964 if (conn->pending_sec_level > sec_level)
965 sec_level = conn->pending_sec_level;
966
967 if (sec_level > conn->sec_level)
968 conn->pending_sec_level = sec_level;
969 else if (test_bit(HCI_CONN_AUTH, &conn->flags))
970 return 1;
971
972 /* Make sure we preserve an existing MITM requirement*/
973 auth_type |= (conn->auth_type & 0x01);
974
975 conn->auth_type = auth_type;
976
977 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
978 struct hci_cp_auth_requested cp;
979
980 cp.handle = cpu_to_le16(conn->handle);
981 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
982 sizeof(cp), &cp);
983
984 /* If we're already encrypted set the REAUTH_PEND flag,
985 * otherwise set the ENCRYPT_PEND.
986 */
987 if (test_bit(HCI_CONN_ENCRYPT, &conn->flags))
988 set_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
989 else
990 set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
991 }
992
993 return 0;
994 }
995
996 /* Encrypt the the link */
997 static void hci_conn_encrypt(struct hci_conn *conn)
998 {
999 BT_DBG("hcon %p", conn);
1000
1001 if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
1002 struct hci_cp_set_conn_encrypt cp;
1003 cp.handle = cpu_to_le16(conn->handle);
1004 cp.encrypt = 0x01;
1005 hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
1006 &cp);
1007 }
1008 }
1009
1010 /* Enable security */
1011 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type,
1012 bool initiator)
1013 {
1014 BT_DBG("hcon %p", conn);
1015
1016 if (conn->type == LE_LINK)
1017 return smp_conn_security(conn, sec_level);
1018
1019 /* For sdp we don't need the link key. */
1020 if (sec_level == BT_SECURITY_SDP)
1021 return 1;
1022
1023 /* For non 2.1 devices and low security level we don't need the link
1024 key. */
1025 if (sec_level == BT_SECURITY_LOW && !hci_conn_ssp_enabled(conn))
1026 return 1;
1027
1028 /* For other security levels we need the link key. */
1029 if (!test_bit(HCI_CONN_AUTH, &conn->flags))
1030 goto auth;
1031
1032 /* An authenticated FIPS approved combination key has sufficient
1033 * security for security level 4. */
1034 if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256 &&
1035 sec_level == BT_SECURITY_FIPS)
1036 goto encrypt;
1037
1038 /* An authenticated combination key has sufficient security for
1039 security level 3. */
1040 if ((conn->key_type == HCI_LK_AUTH_COMBINATION_P192 ||
1041 conn->key_type == HCI_LK_AUTH_COMBINATION_P256) &&
1042 sec_level == BT_SECURITY_HIGH)
1043 goto encrypt;
1044
1045 /* An unauthenticated combination key has sufficient security for
1046 security level 1 and 2. */
1047 if ((conn->key_type == HCI_LK_UNAUTH_COMBINATION_P192 ||
1048 conn->key_type == HCI_LK_UNAUTH_COMBINATION_P256) &&
1049 (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW))
1050 goto encrypt;
1051
1052 /* A combination key has always sufficient security for the security
1053 levels 1 or 2. High security level requires the combination key
1054 is generated using maximum PIN code length (16).
1055 For pre 2.1 units. */
1056 if (conn->key_type == HCI_LK_COMBINATION &&
1057 (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW ||
1058 conn->pin_length == 16))
1059 goto encrypt;
1060
1061 auth:
1062 if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags))
1063 return 0;
1064
1065 if (initiator)
1066 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
1067
1068 if (!hci_conn_auth(conn, sec_level, auth_type))
1069 return 0;
1070
1071 encrypt:
1072 if (test_bit(HCI_CONN_ENCRYPT, &conn->flags))
1073 return 1;
1074
1075 hci_conn_encrypt(conn);
1076 return 0;
1077 }
1078 EXPORT_SYMBOL(hci_conn_security);
1079
1080 /* Check secure link requirement */
1081 int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level)
1082 {
1083 BT_DBG("hcon %p", conn);
1084
1085 /* Accept if non-secure or higher security level is required */
1086 if (sec_level != BT_SECURITY_HIGH && sec_level != BT_SECURITY_FIPS)
1087 return 1;
1088
1089 /* Accept if secure or higher security level is already present */
1090 if (conn->sec_level == BT_SECURITY_HIGH ||
1091 conn->sec_level == BT_SECURITY_FIPS)
1092 return 1;
1093
1094 /* Reject not secure link */
1095 return 0;
1096 }
1097 EXPORT_SYMBOL(hci_conn_check_secure);
1098
1099 /* Switch role */
1100 int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
1101 {
1102 BT_DBG("hcon %p", conn);
1103
1104 if (role == conn->role)
1105 return 1;
1106
1107 if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->flags)) {
1108 struct hci_cp_switch_role cp;
1109 bacpy(&cp.bdaddr, &conn->dst);
1110 cp.role = role;
1111 hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
1112 }
1113
1114 return 0;
1115 }
1116 EXPORT_SYMBOL(hci_conn_switch_role);
1117
1118 /* Enter active mode */
1119 void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
1120 {
1121 struct hci_dev *hdev = conn->hdev;
1122
1123 BT_DBG("hcon %p mode %d", conn, conn->mode);
1124
1125 if (conn->mode != HCI_CM_SNIFF)
1126 goto timer;
1127
1128 if (!test_bit(HCI_CONN_POWER_SAVE, &conn->flags) && !force_active)
1129 goto timer;
1130
1131 if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
1132 struct hci_cp_exit_sniff_mode cp;
1133 cp.handle = cpu_to_le16(conn->handle);
1134 hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
1135 }
1136
1137 timer:
1138 if (hdev->idle_timeout > 0)
1139 queue_delayed_work(hdev->workqueue, &conn->idle_work,
1140 msecs_to_jiffies(hdev->idle_timeout));
1141 }
1142
1143 /* Drop all connection on the device */
1144 void hci_conn_hash_flush(struct hci_dev *hdev)
1145 {
1146 struct hci_conn_hash *h = &hdev->conn_hash;
1147 struct hci_conn *c, *n;
1148
1149 BT_DBG("hdev %s", hdev->name);
1150
1151 list_for_each_entry_safe(c, n, &h->list, list) {
1152 c->state = BT_CLOSED;
1153
1154 hci_disconn_cfm(c, HCI_ERROR_LOCAL_HOST_TERM);
1155 hci_conn_del(c);
1156 }
1157 }
1158
1159 /* Check pending connect attempts */
1160 void hci_conn_check_pending(struct hci_dev *hdev)
1161 {
1162 struct hci_conn *conn;
1163
1164 BT_DBG("hdev %s", hdev->name);
1165
1166 hci_dev_lock(hdev);
1167
1168 conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
1169 if (conn)
1170 hci_acl_create_connection(conn);
1171
1172 hci_dev_unlock(hdev);
1173 }
1174
1175 static u32 get_link_mode(struct hci_conn *conn)
1176 {
1177 u32 link_mode = 0;
1178
1179 if (conn->role == HCI_ROLE_MASTER)
1180 link_mode |= HCI_LM_MASTER;
1181
1182 if (test_bit(HCI_CONN_ENCRYPT, &conn->flags))
1183 link_mode |= HCI_LM_ENCRYPT;
1184
1185 if (test_bit(HCI_CONN_AUTH, &conn->flags))
1186 link_mode |= HCI_LM_AUTH;
1187
1188 if (test_bit(HCI_CONN_SECURE, &conn->flags))
1189 link_mode |= HCI_LM_SECURE;
1190
1191 if (test_bit(HCI_CONN_FIPS, &conn->flags))
1192 link_mode |= HCI_LM_FIPS;
1193
1194 return link_mode;
1195 }
1196
1197 int hci_get_conn_list(void __user *arg)
1198 {
1199 struct hci_conn *c;
1200 struct hci_conn_list_req req, *cl;
1201 struct hci_conn_info *ci;
1202 struct hci_dev *hdev;
1203 int n = 0, size, err;
1204
1205 if (copy_from_user(&req, arg, sizeof(req)))
1206 return -EFAULT;
1207
1208 if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
1209 return -EINVAL;
1210
1211 size = sizeof(req) + req.conn_num * sizeof(*ci);
1212
1213 cl = kmalloc(size, GFP_KERNEL);
1214 if (!cl)
1215 return -ENOMEM;
1216
1217 hdev = hci_dev_get(req.dev_id);
1218 if (!hdev) {
1219 kfree(cl);
1220 return -ENODEV;
1221 }
1222
1223 ci = cl->conn_info;
1224
1225 hci_dev_lock(hdev);
1226 list_for_each_entry(c, &hdev->conn_hash.list, list) {
1227 bacpy(&(ci + n)->bdaddr, &c->dst);
1228 (ci + n)->handle = c->handle;
1229 (ci + n)->type = c->type;
1230 (ci + n)->out = c->out;
1231 (ci + n)->state = c->state;
1232 (ci + n)->link_mode = get_link_mode(c);
1233 if (++n >= req.conn_num)
1234 break;
1235 }
1236 hci_dev_unlock(hdev);
1237
1238 cl->dev_id = hdev->id;
1239 cl->conn_num = n;
1240 size = sizeof(req) + n * sizeof(*ci);
1241
1242 hci_dev_put(hdev);
1243
1244 err = copy_to_user(arg, cl, size);
1245 kfree(cl);
1246
1247 return err ? -EFAULT : 0;
1248 }
1249
1250 int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
1251 {
1252 struct hci_conn_info_req req;
1253 struct hci_conn_info ci;
1254 struct hci_conn *conn;
1255 char __user *ptr = arg + sizeof(req);
1256
1257 if (copy_from_user(&req, arg, sizeof(req)))
1258 return -EFAULT;
1259
1260 hci_dev_lock(hdev);
1261 conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
1262 if (conn) {
1263 bacpy(&ci.bdaddr, &conn->dst);
1264 ci.handle = conn->handle;
1265 ci.type = conn->type;
1266 ci.out = conn->out;
1267 ci.state = conn->state;
1268 ci.link_mode = get_link_mode(conn);
1269 }
1270 hci_dev_unlock(hdev);
1271
1272 if (!conn)
1273 return -ENOENT;
1274
1275 return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
1276 }
1277
1278 int hci_get_auth_info(struct hci_dev *hdev, void __user *arg)
1279 {
1280 struct hci_auth_info_req req;
1281 struct hci_conn *conn;
1282
1283 if (copy_from_user(&req, arg, sizeof(req)))
1284 return -EFAULT;
1285
1286 hci_dev_lock(hdev);
1287 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr);
1288 if (conn)
1289 req.type = conn->auth_type;
1290 hci_dev_unlock(hdev);
1291
1292 if (!conn)
1293 return -ENOENT;
1294
1295 return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0;
1296 }
1297
1298 struct hci_chan *hci_chan_create(struct hci_conn *conn)
1299 {
1300 struct hci_dev *hdev = conn->hdev;
1301 struct hci_chan *chan;
1302
1303 BT_DBG("%s hcon %p", hdev->name, conn);
1304
1305 if (test_bit(HCI_CONN_DROP, &conn->flags)) {
1306 BT_DBG("Refusing to create new hci_chan");
1307 return NULL;
1308 }
1309
1310 chan = kzalloc(sizeof(*chan), GFP_KERNEL);
1311 if (!chan)
1312 return NULL;
1313
1314 chan->conn = hci_conn_get(conn);
1315 skb_queue_head_init(&chan->data_q);
1316 chan->state = BT_CONNECTED;
1317
1318 list_add_rcu(&chan->list, &conn->chan_list);
1319
1320 return chan;
1321 }
1322
1323 void hci_chan_del(struct hci_chan *chan)
1324 {
1325 struct hci_conn *conn = chan->conn;
1326 struct hci_dev *hdev = conn->hdev;
1327
1328 BT_DBG("%s hcon %p chan %p", hdev->name, conn, chan);
1329
1330 list_del_rcu(&chan->list);
1331
1332 synchronize_rcu();
1333
1334 /* Prevent new hci_chan's to be created for this hci_conn */
1335 set_bit(HCI_CONN_DROP, &conn->flags);
1336
1337 hci_conn_put(conn);
1338
1339 skb_queue_purge(&chan->data_q);
1340 kfree(chan);
1341 }
1342
1343 void hci_chan_list_flush(struct hci_conn *conn)
1344 {
1345 struct hci_chan *chan, *n;
1346
1347 BT_DBG("hcon %p", conn);
1348
1349 list_for_each_entry_safe(chan, n, &conn->chan_list, list)
1350 hci_chan_del(chan);
1351 }
1352
1353 static struct hci_chan *__hci_chan_lookup_handle(struct hci_conn *hcon,
1354 __u16 handle)
1355 {
1356 struct hci_chan *hchan;
1357
1358 list_for_each_entry(hchan, &hcon->chan_list, list) {
1359 if (hchan->handle == handle)
1360 return hchan;
1361 }
1362
1363 return NULL;
1364 }
1365
1366 struct hci_chan *hci_chan_lookup_handle(struct hci_dev *hdev, __u16 handle)
1367 {
1368 struct hci_conn_hash *h = &hdev->conn_hash;
1369 struct hci_conn *hcon;
1370 struct hci_chan *hchan = NULL;
1371
1372 rcu_read_lock();
1373
1374 list_for_each_entry_rcu(hcon, &h->list, list) {
1375 hchan = __hci_chan_lookup_handle(hcon, handle);
1376 if (hchan)
1377 break;
1378 }
1379
1380 rcu_read_unlock();
1381
1382 return hchan;
1383 }
Linux with added FPC-III support