hci_conn.c 28.3 KB
Newer Older
1
/*
Linus Torvalds's avatar
Linus Torvalds committed
2
   BlueZ - Bluetooth protocol stack for Linux
3
   Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
Linus Torvalds's avatar
Linus Torvalds committed
4 5 6 7 8 9 10 11 12 13 14

   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>

   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License version 2 as
   published by the Free Software Foundation;

   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 16 17
   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
Linus Torvalds's avatar
Linus Torvalds committed
18 19
   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

20 21
   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
Linus Torvalds's avatar
Linus Torvalds committed
22 23 24 25 26
   SOFTWARE IS DISCLAIMED.
*/

/* Bluetooth HCI connection handling. */

27
#include <linux/export.h>
Linus Torvalds's avatar
Linus Torvalds committed
28 29 30 31

#include <net/bluetooth/bluetooth.h>
#include <net/bluetooth/hci_core.h>

32
#include "smp.h"
33 34
#include "a2mp.h"

35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52
struct sco_param {
	u16 pkt_type;
	u16 max_latency;
};

static const struct sco_param sco_param_cvsd[] = {
	{ EDR_ESCO_MASK & ~ESCO_2EV3, 0x000a }, /* S3 */
	{ EDR_ESCO_MASK & ~ESCO_2EV3, 0x0007 }, /* S2 */
	{ EDR_ESCO_MASK | ESCO_EV3,   0x0007 }, /* S1 */
	{ EDR_ESCO_MASK | ESCO_HV3,   0xffff }, /* D1 */
	{ EDR_ESCO_MASK | ESCO_HV1,   0xffff }, /* D0 */
};

static const struct sco_param sco_param_wideband[] = {
	{ EDR_ESCO_MASK & ~ESCO_2EV3, 0x000d }, /* T2 */
	{ EDR_ESCO_MASK | ESCO_EV3,   0x0008 }, /* T1 */
};

53
static void hci_le_create_connection_cancel(struct hci_conn *conn)
54 55 56 57
{
	hci_send_cmd(conn->hdev, HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL);
}

58
static void hci_acl_create_connection(struct hci_conn *conn)
Linus Torvalds's avatar
Linus Torvalds committed
59 60 61 62 63
{
	struct hci_dev *hdev = conn->hdev;
	struct inquiry_entry *ie;
	struct hci_cp_create_conn cp;

64
	BT_DBG("hcon %p", conn);
Linus Torvalds's avatar
Linus Torvalds committed
65 66

	conn->state = BT_CONNECT;
67
	conn->out = true;
68

Linus Torvalds's avatar
Linus Torvalds committed
69 70
	conn->link_mode = HCI_LM_MASTER;

71 72
	conn->attempt++;

73 74
	conn->link_policy = hdev->link_policy;

Linus Torvalds's avatar
Linus Torvalds committed
75 76 77 78
	memset(&cp, 0, sizeof(cp));
	bacpy(&cp.bdaddr, &conn->dst);
	cp.pscan_rep_mode = 0x02;

79 80
	ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
	if (ie) {
81 82 83 84
		if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
			cp.pscan_rep_mode = ie->data.pscan_rep_mode;
			cp.pscan_mode     = ie->data.pscan_mode;
			cp.clock_offset   = ie->data.clock_offset |
85
					    __constant_cpu_to_le16(0x8000);
86 87
		}

Linus Torvalds's avatar
Linus Torvalds committed
88
		memcpy(conn->dev_class, ie->data.dev_class, 3);
89 90
		if (ie->data.ssp_mode > 0)
			set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
Linus Torvalds's avatar
Linus Torvalds committed
91 92
	}

93
	cp.pkt_type = cpu_to_le16(conn->pkt_type);
Linus Torvalds's avatar
Linus Torvalds committed
94
	if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
95
		cp.role_switch = 0x01;
Linus Torvalds's avatar
Linus Torvalds committed
96
	else
97
		cp.role_switch = 0x00;
98

99
	hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
Linus Torvalds's avatar
Linus Torvalds committed
100 101
}

102
static void hci_acl_create_connection_cancel(struct hci_conn *conn)
103 104 105
{
	struct hci_cp_create_conn_cancel cp;

106
	BT_DBG("hcon %p", conn);
107

108
	if (conn->hdev->hci_ver < BLUETOOTH_VER_1_2)
109 110 111
		return;

	bacpy(&cp.bdaddr, &conn->dst);
112
	hci_send_cmd(conn->hdev, HCI_OP_CREATE_CONN_CANCEL, sizeof(cp), &cp);
113 114
}

115 116 117 118 119 120 121 122 123 124
static void hci_reject_sco(struct hci_conn *conn)
{
	struct hci_cp_reject_sync_conn_req cp;

	cp.reason = HCI_ERROR_REMOTE_USER_TERM;
	bacpy(&cp.bdaddr, &conn->dst);

	hci_send_cmd(conn->hdev, HCI_OP_REJECT_SYNC_CONN_REQ, sizeof(cp), &cp);
}

125
void hci_disconnect(struct hci_conn *conn, __u8 reason)
Linus Torvalds's avatar
Linus Torvalds committed
126 127 128
{
	struct hci_cp_disconnect cp;

129
	BT_DBG("hcon %p", conn);
Linus Torvalds's avatar
Linus Torvalds committed
130 131 132

	conn->state = BT_DISCONN;

133
	cp.handle = cpu_to_le16(conn->handle);
Linus Torvalds's avatar
Linus Torvalds committed
134
	cp.reason = reason;
135
	hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp);
Linus Torvalds's avatar
Linus Torvalds committed
136 137
}

138 139 140 141 142 143 144 145 146 147 148 149 150 151
static void hci_amp_disconn(struct hci_conn *conn, __u8 reason)
{
	struct hci_cp_disconn_phy_link cp;

	BT_DBG("hcon %p", conn);

	conn->state = BT_DISCONN;

	cp.phy_handle = HCI_PHY_HANDLE(conn->handle);
	cp.reason = reason;
	hci_send_cmd(conn->hdev, HCI_OP_DISCONN_PHY_LINK,
		     sizeof(cp), &cp);
}

152
static void hci_add_sco(struct hci_conn *conn, __u16 handle)
Linus Torvalds's avatar
Linus Torvalds committed
153 154 155 156
{
	struct hci_dev *hdev = conn->hdev;
	struct hci_cp_add_sco cp;

157
	BT_DBG("hcon %p", conn);
Linus Torvalds's avatar
Linus Torvalds committed
158 159

	conn->state = BT_CONNECT;
160
	conn->out = true;
Linus Torvalds's avatar
Linus Torvalds committed
161

162 163
	conn->attempt++;

164
	cp.handle   = cpu_to_le16(handle);
165
	cp.pkt_type = cpu_to_le16(conn->pkt_type);
Linus Torvalds's avatar
Linus Torvalds committed
166

167
	hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
Linus Torvalds's avatar
Linus Torvalds committed
168 169
}

170
bool hci_setup_sync(struct hci_conn *conn, __u16 handle)
171 172 173
{
	struct hci_dev *hdev = conn->hdev;
	struct hci_cp_setup_sync_conn cp;
174
	const struct sco_param *param;
175

176
	BT_DBG("hcon %p", conn);
177 178

	conn->state = BT_CONNECT;
179
	conn->out = true;
180

181 182
	conn->attempt++;

183 184
	cp.handle   = cpu_to_le16(handle);

185 186
	cp.tx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
	cp.rx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
187 188 189 190
	cp.voice_setting  = cpu_to_le16(conn->setting);

	switch (conn->setting & SCO_AIRMODE_MASK) {
	case SCO_AIRMODE_TRANSP:
191 192
		if (conn->attempt > ARRAY_SIZE(sco_param_wideband))
			return false;
193
		cp.retrans_effort = 0x02;
194
		param = &sco_param_wideband[conn->attempt - 1];
195 196
		break;
	case SCO_AIRMODE_CVSD:
197 198 199 200
		if (conn->attempt > ARRAY_SIZE(sco_param_cvsd))
			return false;
		cp.retrans_effort = 0x01;
		param = &sco_param_cvsd[conn->attempt - 1];
201
		break;
202 203
	default:
		return false;
204
	}
205

206 207 208 209 210 211 212
	cp.pkt_type = __cpu_to_le16(param->pkt_type);
	cp.max_latency = __cpu_to_le16(param->max_latency);

	if (hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp) < 0)
		return false;

	return true;
213 214
}

215
void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max,
216
			u16 latency, u16 to_multiplier)
217 218 219 220 221 222 223 224 225 226 227
{
	struct hci_cp_le_conn_update cp;
	struct hci_dev *hdev = conn->hdev;

	memset(&cp, 0, sizeof(cp));

	cp.handle		= cpu_to_le16(conn->handle);
	cp.conn_interval_min	= cpu_to_le16(min);
	cp.conn_interval_max	= cpu_to_le16(max);
	cp.conn_latency		= cpu_to_le16(latency);
	cp.supervision_timeout	= cpu_to_le16(to_multiplier);
228 229
	cp.min_ce_len		= __constant_cpu_to_le16(0x0000);
	cp.max_ce_len		= __constant_cpu_to_le16(0x0000);
230 231 232 233

	hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp);
}

234
void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __u8 rand[8],
235
		      __u8 ltk[16])
236 237 238 239
{
	struct hci_dev *hdev = conn->hdev;
	struct hci_cp_le_start_enc cp;

240
	BT_DBG("hcon %p", conn);
241 242 243 244 245 246

	memset(&cp, 0, sizeof(cp));

	cp.handle = cpu_to_le16(conn->handle);
	memcpy(cp.ltk, ltk, sizeof(cp.ltk));
	cp.ediv = ediv;
247
	memcpy(cp.rand, rand, sizeof(cp.rand));
248 249 250 251

	hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp);
}

252 253 254 255 256 257 258 259
/* Device _must_ be locked */
void hci_sco_setup(struct hci_conn *conn, __u8 status)
{
	struct hci_conn *sco = conn->link;

	if (!sco)
		return;

260 261
	BT_DBG("hcon %p", conn);

262 263 264 265 266 267 268 269 270 271 272
	if (!status) {
		if (lmp_esco_capable(conn->hdev))
			hci_setup_sync(sco, conn->handle);
		else
			hci_add_sco(sco, conn->handle);
	} else {
		hci_proto_connect_cfm(sco, status);
		hci_conn_del(sco);
	}
}

273 274 275 276 277 278 279 280
static void hci_conn_disconnect(struct hci_conn *conn)
{
	__u8 reason = hci_proto_disconn_ind(conn);

	switch (conn->type) {
	case AMP_LINK:
		hci_amp_disconn(conn, reason);
		break;
281
	default:
282
		hci_disconnect(conn, reason);
283
		break;
284 285 286
	}
}

287
static void hci_conn_timeout(struct work_struct *work)
Linus Torvalds's avatar
Linus Torvalds committed
288
{
289
	struct hci_conn *conn = container_of(work, struct hci_conn,
290
					     disc_work.work);
Linus Torvalds's avatar
Linus Torvalds committed
291

292
	BT_DBG("hcon %p state %s", conn, state_to_string(conn->state));
Linus Torvalds's avatar
Linus Torvalds committed
293 294 295 296

	if (atomic_read(&conn->refcnt))
		return;

297 298
	switch (conn->state) {
	case BT_CONNECT:
299
	case BT_CONNECT2:
300 301
		if (conn->out) {
			if (conn->type == ACL_LINK)
302
				hci_acl_create_connection_cancel(conn);
303
			else if (conn->type == LE_LINK)
304
				hci_le_create_connection_cancel(conn);
305 306
		} else if (conn->type == SCO_LINK || conn->type == ESCO_LINK) {
			hci_reject_sco(conn);
307
		}
308
		break;
309
	case BT_CONFIG:
310
	case BT_CONNECTED:
311
		hci_conn_disconnect(conn);
312 313
		break;
	default:
Linus Torvalds's avatar
Linus Torvalds committed
314
		conn->state = BT_CLOSED;
315 316
		break;
	}
Linus Torvalds's avatar
Linus Torvalds committed
317 318
}

319
/* Enter sniff mode */
320
static void hci_conn_idle(struct work_struct *work)
321
{
322 323
	struct hci_conn *conn = container_of(work, struct hci_conn,
					     idle_work.work);
324 325
	struct hci_dev *hdev = conn->hdev;

326
	BT_DBG("hcon %p mode %d", conn, conn->mode);
327 328 329 330 331 332 333 334 335 336 337 338 339

	if (test_bit(HCI_RAW, &hdev->flags))
		return;

	if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn))
		return;

	if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF))
		return;

	if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
		struct hci_cp_sniff_subrate cp;
		cp.handle             = cpu_to_le16(conn->handle);
340 341 342
		cp.max_latency        = __constant_cpu_to_le16(0);
		cp.min_remote_timeout = __constant_cpu_to_le16(0);
		cp.min_local_timeout  = __constant_cpu_to_le16(0);
343 344 345
		hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
	}

346
	if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
347 348 349 350
		struct hci_cp_sniff_mode cp;
		cp.handle       = cpu_to_le16(conn->handle);
		cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
		cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
351 352
		cp.attempt      = __constant_cpu_to_le16(4);
		cp.timeout      = __constant_cpu_to_le16(1);
353 354 355 356
		hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
	}
}

357
static void hci_conn_auto_accept(struct work_struct *work)
358
{
359 360
	struct hci_conn *conn = container_of(work, struct hci_conn,
					     auto_accept_work.work);
361

362
	hci_send_cmd(conn->hdev, HCI_OP_USER_CONFIRM_REPLY, sizeof(conn->dst),
363
		     &conn->dst);
364 365
}

Linus Torvalds's avatar
Linus Torvalds committed
366 367 368 369
struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
{
	struct hci_conn *conn;

370
	BT_DBG("%s dst %pMR", hdev->name, dst);
Linus Torvalds's avatar
Linus Torvalds committed
371

372
	conn = kzalloc(sizeof(struct hci_conn), GFP_KERNEL);
373
	if (!conn)
Linus Torvalds's avatar
Linus Torvalds committed
374 375 376
		return NULL;

	bacpy(&conn->dst, dst);
377
	bacpy(&conn->src, &hdev->bdaddr);
378 379 380 381
	conn->hdev  = hdev;
	conn->type  = type;
	conn->mode  = HCI_CM_ACTIVE;
	conn->state = BT_OPEN;
382
	conn->auth_type = HCI_AT_GENERAL_BONDING;
383
	conn->io_capability = hdev->io_capability;
384
	conn->remote_auth = 0xff;
385
	conn->key_type = 0xff;
Linus Torvalds's avatar
Linus Torvalds committed
386

387
	set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
388
	conn->disc_timeout = HCI_DISCONN_TIMEOUT;
389

390 391 392 393 394 395
	switch (type) {
	case ACL_LINK:
		conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
		break;
	case SCO_LINK:
		if (lmp_esco_capable(hdev))
396 397
			conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
					(hdev->esco_type & EDR_ESCO_MASK);
398 399 400 401
		else
			conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
		break;
	case ESCO_LINK:
402
		conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
403 404 405
		break;
	}

Linus Torvalds's avatar
Linus Torvalds committed
406
	skb_queue_head_init(&conn->data_q);
407

408
	INIT_LIST_HEAD(&conn->chan_list);
409

410
	INIT_DELAYED_WORK(&conn->disc_work, hci_conn_timeout);
411
	INIT_DELAYED_WORK(&conn->auto_accept_work, hci_conn_auto_accept);
412
	INIT_DELAYED_WORK(&conn->idle_work, hci_conn_idle);
Linus Torvalds's avatar
Linus Torvalds committed
413 414 415 416 417 418

	atomic_set(&conn->refcnt, 0);

	hci_dev_hold(hdev);

	hci_conn_hash_add(hdev, conn);
419
	if (hdev->notify)
Linus Torvalds's avatar
Linus Torvalds committed
420 421
		hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);

422 423
	hci_conn_init_sysfs(conn);

Linus Torvalds's avatar
Linus Torvalds committed
424 425 426 427 428 429 430
	return conn;
}

int hci_conn_del(struct hci_conn *conn)
{
	struct hci_dev *hdev = conn->hdev;

431
	BT_DBG("%s hcon %p handle %d", hdev->name, conn, conn->handle);
Linus Torvalds's avatar
Linus Torvalds committed
432

433
	cancel_delayed_work_sync(&conn->disc_work);
434
	cancel_delayed_work_sync(&conn->auto_accept_work);
435
	cancel_delayed_work_sync(&conn->idle_work);
436

437
	if (conn->type == ACL_LINK) {
Linus Torvalds's avatar
Linus Torvalds committed
438 439 440 441 442 443
		struct hci_conn *sco = conn->link;
		if (sco)
			sco->link = NULL;

		/* Unacked frames */
		hdev->acl_cnt += conn->sent;
444 445 446 447 448
	} else if (conn->type == LE_LINK) {
		if (hdev->le_pkts)
			hdev->le_cnt += conn->sent;
		else
			hdev->acl_cnt += conn->sent;
449 450 451 452
	} else {
		struct hci_conn *acl = conn->link;
		if (acl) {
			acl->link = NULL;
453
			hci_conn_drop(acl);
454
		}
Linus Torvalds's avatar
Linus Torvalds committed
455 456
	}

457
	hci_chan_list_flush(conn);
458

459 460 461
	if (conn->amp_mgr)
		amp_mgr_put(conn->amp_mgr);

Linus Torvalds's avatar
Linus Torvalds committed
462
	hci_conn_hash_del(hdev, conn);
463
	if (hdev->notify)
Linus Torvalds's avatar
Linus Torvalds committed
464
		hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
465

Linus Torvalds's avatar
Linus Torvalds committed
466 467
	skb_queue_purge(&conn->data_q);

468
	hci_conn_del_sysfs(conn);
469

470 471
	hci_dev_put(hdev);

472
	hci_conn_put(conn);
473

Linus Torvalds's avatar
Linus Torvalds committed
474 475 476 477 478 479
	return 0;
}

struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src)
{
	int use_src = bacmp(src, BDADDR_ANY);
480
	struct hci_dev *hdev = NULL, *d;
Linus Torvalds's avatar
Linus Torvalds committed
481

482
	BT_DBG("%pMR -> %pMR", src, dst);
Linus Torvalds's avatar
Linus Torvalds committed
483

484
	read_lock(&hci_dev_list_lock);
Linus Torvalds's avatar
Linus Torvalds committed
485

486
	list_for_each_entry(d, &hci_dev_list, list) {
487
		if (!test_bit(HCI_UP, &d->flags) ||
488
		    test_bit(HCI_RAW, &d->flags) ||
489
		    test_bit(HCI_USER_CHANNEL, &d->dev_flags) ||
490
		    d->dev_type != HCI_BREDR)
Linus Torvalds's avatar
Linus Torvalds committed
491 492
			continue;

493
		/* Simple routing:
Linus Torvalds's avatar
Linus Torvalds committed
494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511
		 *   No source address - find interface with bdaddr != dst
		 *   Source address    - find interface with bdaddr == src
		 */

		if (use_src) {
			if (!bacmp(&d->bdaddr, src)) {
				hdev = d; break;
			}
		} else {
			if (bacmp(&d->bdaddr, dst)) {
				hdev = d; break;
			}
		}
	}

	if (hdev)
		hdev = hci_dev_hold(hdev);

512
	read_unlock(&hci_dev_list_lock);
Linus Torvalds's avatar
Linus Torvalds committed
513 514 515 516
	return hdev;
}
EXPORT_SYMBOL(hci_get_route);

517 518 519 520 521 522 523 524 525 526 527 528 529 530 531
/* This function requires the caller holds hdev->lock */
static void le_conn_failed(struct hci_conn *conn, u8 status)
{
	struct hci_dev *hdev = conn->hdev;

	conn->state = BT_CLOSED;

	mgmt_connect_failed(hdev, &conn->dst, conn->type, conn->dst_type,
			    status);

	hci_proto_connect_cfm(conn, status);

	hci_conn_del(conn);
}

532 533 534 535 536 537 538 539 540 541 542 543 544 545 546 547
static void create_le_conn_complete(struct hci_dev *hdev, u8 status)
{
	struct hci_conn *conn;

	if (status == 0)
		return;

	BT_ERR("HCI request failed to create LE connection: status 0x%2.2x",
	       status);

	hci_dev_lock(hdev);

	conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
	if (!conn)
		goto done;

548
	le_conn_failed(conn, status);
549 550 551 552 553 554 555 556 557 558

done:
	hci_dev_unlock(hdev);
}

static int hci_create_le_conn(struct hci_conn *conn)
{
	struct hci_dev *hdev = conn->hdev;
	struct hci_cp_le_create_conn cp;
	struct hci_request req;
559
	u8 own_addr_type;
560 561 562 563 564
	int err;

	hci_req_init(&req, hdev);

	memset(&cp, 0, sizeof(cp));
565 566 567 568 569

	err = hci_update_random_address(&req, &own_addr_type);
	if (err < 0)
		return err;

570 571
	conn->src_type = own_addr_type;

572 573
	cp.scan_interval = cpu_to_le16(hdev->le_scan_interval);
	cp.scan_window = cpu_to_le16(hdev->le_scan_window);
574 575
	bacpy(&cp.peer_addr, &conn->dst);
	cp.peer_addr_type = conn->dst_type;
576
	cp.own_address_type = own_addr_type;
577 578
	cp.conn_interval_min = cpu_to_le16(conn->le_conn_min_interval);
	cp.conn_interval_max = cpu_to_le16(conn->le_conn_max_interval);
579 580 581
	cp.supervision_timeout = __constant_cpu_to_le16(0x002a);
	cp.min_ce_len = __constant_cpu_to_le16(0x0000);
	cp.max_ce_len = __constant_cpu_to_le16(0x0000);
582

583 584 585 586 587 588 589 590 591 592 593
	hci_req_add(&req, HCI_OP_LE_CREATE_CONN, sizeof(cp), &cp);

	err = hci_req_run(&req, create_le_conn_complete);
	if (err) {
		hci_conn_del(conn);
		return err;
	}

	return 0;
}

594 595
static struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,
				    u8 dst_type, u8 sec_level, u8 auth_type)
Linus Torvalds's avatar
Linus Torvalds committed
596
{
597
	struct hci_conn_params *params;
598
	struct hci_conn *conn;
599
	struct smp_irk *irk;
600
	int err;
Linus Torvalds's avatar
Linus Torvalds committed
601

602
	if (test_bit(HCI_ADVERTISING, &hdev->flags))
603 604
		return ERR_PTR(-ENOTSUPP);

605 606 607 608 609 610 611 612 613
	/* Some devices send ATT messages as soon as the physical link is
	 * established. To be able to handle these ATT messages, the user-
	 * space first establishes the connection and then starts the pairing
	 * process.
	 *
	 * So if a hci_conn object already exists for the following connection
	 * attempt, we simply update pending_sec_level and auth_type fields
	 * and return the object found.
	 */
614
	conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, dst);
615 616 617 618 619
	if (conn) {
		conn->pending_sec_level = sec_level;
		conn->auth_type = auth_type;
		goto done;
	}
620

621 622 623 624 625 626
	/* Since the controller supports only one LE connection attempt at a
	 * time, we return -EBUSY if there is any connection attempt running.
	 */
	conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
	if (conn)
		return ERR_PTR(-EBUSY);
627

628 629 630 631 632 633
	/* Convert from L2CAP channel address type to HCI address type */
	if (dst_type == BDADDR_LE_PUBLIC)
		dst_type = ADDR_LE_DEV_PUBLIC;
	else
		dst_type = ADDR_LE_DEV_RANDOM;

634 635 636 637 638 639 640 641 642 643 644 645 646
	/* When given an identity address with existing identity
	 * resolving key, the connection needs to be established
	 * to a resolvable random address.
	 *
	 * This uses the cached random resolvable address from
	 * a previous scan. When no cached address is available,
	 * try connecting to the identity address instead.
	 *
	 * Storing the resolvable random address is required here
	 * to handle connection failures. The address will later
	 * be resolved back into the original identity address
	 * from the connect request.
	 */
647 648 649 650 651 652
	irk = hci_find_irk_by_addr(hdev, dst, dst_type);
	if (irk && bacmp(&irk->rpa, BDADDR_ANY)) {
		dst = &irk->rpa;
		dst_type = ADDR_LE_DEV_RANDOM;
	}

653 654 655
	conn = hci_conn_add(hdev, LE_LINK, dst);
	if (!conn)
		return ERR_PTR(-ENOMEM);
656

657
	conn->dst_type = dst_type;
658

659 660 661 662
	conn->state = BT_CONNECT;
	conn->out = true;
	conn->link_mode |= HCI_LM_MASTER;
	conn->sec_level = BT_SECURITY_LOW;
663 664
	conn->pending_sec_level = sec_level;
	conn->auth_type = auth_type;
665 666 667 668 669 670 671 672 673

	params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
	if (params) {
		conn->le_conn_min_interval = params->conn_min_interval;
		conn->le_conn_max_interval = params->conn_max_interval;
	} else {
		conn->le_conn_min_interval = hdev->le_conn_min_interval;
		conn->le_conn_max_interval = hdev->le_conn_max_interval;
	}
674

675 676 677
	err = hci_create_le_conn(conn);
	if (err)
		return ERR_PTR(err);
678

679 680
done:
	hci_conn_hold(conn);
681
	return conn;
682
}
683

684 685
static struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst,
						u8 sec_level, u8 auth_type)
Linus Torvalds's avatar
Linus Torvalds committed
686 687
{
	struct hci_conn *acl;
688

689 690 691
	if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
		return ERR_PTR(-ENOTSUPP);

692 693 694 695
	acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
	if (!acl) {
		acl = hci_conn_add(hdev, ACL_LINK, dst);
		if (!acl)
696
			return ERR_PTR(-ENOMEM);
Linus Torvalds's avatar
Linus Torvalds committed
697 698 699 700
	}

	hci_conn_hold(acl);

701
	if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
702 703
		acl->sec_level = BT_SECURITY_LOW;
		acl->pending_sec_level = sec_level;
704
		acl->auth_type = auth_type;
705
		hci_acl_create_connection(acl);
706
	}
Linus Torvalds's avatar
Linus Torvalds committed
707

708 709 710
	return acl;
}

711 712
struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type, bdaddr_t *dst,
				 __u16 setting)
713 714 715 716
{
	struct hci_conn *acl;
	struct hci_conn *sco;

717
	acl = hci_connect_acl(hdev, dst, BT_SECURITY_LOW, HCI_AT_NO_BONDING);
718
	if (IS_ERR(acl))
719
		return acl;
Linus Torvalds's avatar
Linus Torvalds committed
720

721 722 723 724
	sco = hci_conn_hash_lookup_ba(hdev, type, dst);
	if (!sco) {
		sco = hci_conn_add(hdev, type, dst);
		if (!sco) {
725
			hci_conn_drop(acl);
726
			return ERR_PTR(-ENOMEM);
Linus Torvalds's avatar
Linus Torvalds committed
727
		}
728
	}
Linus Torvalds's avatar
Linus Torvalds committed
729

730 731
	acl->link = sco;
	sco->link = acl;
Linus Torvalds's avatar
Linus Torvalds committed
732

733
	hci_conn_hold(sco);
Linus Torvalds's avatar
Linus Torvalds committed
734

735 736
	sco->setting = setting;

737
	if (acl->state == BT_CONNECTED &&
738
	    (sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
739
		set_bit(HCI_CONN_POWER_SAVE, &acl->flags);
740
		hci_conn_enter_active_mode(acl, BT_POWER_FORCE_ACTIVE_ON);
741

742
		if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->flags)) {
743
			/* defer SCO setup until mode change completed */
744
			set_bit(HCI_CONN_SCO_SETUP_PEND, &acl->flags);
745 746 747 748
			return sco;
		}

		hci_sco_setup(acl, 0x00);
749
	}
750 751

	return sco;
Linus Torvalds's avatar
Linus Torvalds committed
752 753
}

754 755 756 757
/* Create SCO, ACL or LE connection. */
struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst,
			     __u8 dst_type, __u8 sec_level, __u8 auth_type)
{
758
	BT_DBG("%s dst %pMR type 0x%x", hdev->name, dst, type);
759

760 761
	switch (type) {
	case LE_LINK:
762
		return hci_connect_le(hdev, dst, dst_type, sec_level, auth_type);
763
	case ACL_LINK:
764
		return hci_connect_acl(hdev, dst, sec_level, auth_type);
765
	}
766

767
	return ERR_PTR(-EINVAL);
768 769
}

770 771 772
/* Check link security requirement */
int hci_conn_check_link_mode(struct hci_conn *conn)
{
773
	BT_DBG("hcon %p", conn);
774

775
	if (hci_conn_ssp_enabled(conn) && !(conn->link_mode & HCI_LM_ENCRYPT))
776 777 778 779 780
		return 0;

	return 1;
}

Linus Torvalds's avatar
Linus Torvalds committed
781
/* Authenticate remote device */
782
static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
Linus Torvalds's avatar
Linus Torvalds committed
783
{
784
	BT_DBG("hcon %p", conn);
Linus Torvalds's avatar
Linus Torvalds committed
785

786 787 788
	if (conn->pending_sec_level > sec_level)
		sec_level = conn->pending_sec_level;

789
	if (sec_level > conn->sec_level)
790
		conn->pending_sec_level = sec_level;
791
	else if (conn->link_mode & HCI_LM_AUTH)
Linus Torvalds's avatar
Linus Torvalds committed
792 793
		return 1;

794 795 796
	/* Make sure we preserve an existing MITM requirement*/
	auth_type |= (conn->auth_type & 0x01);

797 798
	conn->auth_type = auth_type;

799
	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
Linus Torvalds's avatar
Linus Torvalds committed
800
		struct hci_cp_auth_requested cp;
801 802 803 804

		/* encrypt must be pending if auth is also pending */
		set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);

805
		cp.handle = cpu_to_le16(conn->handle);
806
		hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
807
			     sizeof(cp), &cp);
808
		if (conn->key_type != 0xff)
809
			set_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
Linus Torvalds's avatar
Linus Torvalds committed
810
	}
811

Linus Torvalds's avatar
Linus Torvalds committed
812 813 814
	return 0;
}

815 816 817
/* Encrypt the the link */
static void hci_conn_encrypt(struct hci_conn *conn)
{
818
	BT_DBG("hcon %p", conn);
819

820
	if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
821 822 823 824
		struct hci_cp_set_conn_encrypt cp;
		cp.handle  = cpu_to_le16(conn->handle);
		cp.encrypt = 0x01;
		hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
825
			     &cp);
826 827 828
	}
}

829
/* Enable security */
830
int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
Linus Torvalds's avatar
Linus Torvalds committed
831
{
832
	BT_DBG("hcon %p", conn);
Linus Torvalds's avatar
Linus Torvalds committed
833

834 835 836
	if (conn->type == LE_LINK)
		return smp_conn_security(conn, sec_level);

837
	/* For sdp we don't need the link key. */
838 839 840
	if (sec_level == BT_SECURITY_SDP)
		return 1;

841 842
	/* For non 2.1 devices and low security level we don't need the link
	   key. */
843
	if (sec_level == BT_SECURITY_LOW && !hci_conn_ssp_enabled(conn))
844
		return 1;
845

846 847 848 849
	/* For other security levels we need the link key. */
	if (!(conn->link_mode & HCI_LM_AUTH))
		goto auth;

850 851 852 853 854 855 856 857 858 859 860
	/* An authenticated FIPS approved combination key has sufficient
	 * security for security level 4. */
	if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256 &&
	    sec_level == BT_SECURITY_FIPS)
		goto encrypt;

	/* An authenticated combination key has sufficient security for
	   security level 3. */
	if ((conn->key_type == HCI_LK_AUTH_COMBINATION_P192 ||
	     conn->key_type == HCI_LK_AUTH_COMBINATION_P256) &&
	    sec_level == BT_SECURITY_HIGH)
861 862 863 864
		goto encrypt;

	/* An unauthenticated combination key has sufficient security for
	   security level 1 and 2. */
865 866
	if ((conn->key_type == HCI_LK_UNAUTH_COMBINATION_P192 ||
	     conn->key_type == HCI_LK_UNAUTH_COMBINATION_P256) &&
867
	    (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW))
868 869 870 871 872 873 874
		goto encrypt;

	/* A combination key has always sufficient security for the security
	   levels 1 or 2. High security level requires the combination key
	   is generated using maximum PIN code length (16).
	   For pre 2.1 units. */
	if (conn->key_type == HCI_LK_COMBINATION &&
875 876
	    (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW ||
	     conn->pin_length == 16))
877 878 879
		goto encrypt;

auth:
880
	if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags))
Linus Torvalds's avatar
Linus Torvalds committed
881 882
		return 0;

883 884
	if (!hci_conn_auth(conn, sec_level, auth_type))
		return 0;
885 886 887 888

encrypt:
	if (conn->link_mode & HCI_LM_ENCRYPT)
		return 1;
889

890
	hci_conn_encrypt(conn);
Linus Torvalds's avatar
Linus Torvalds committed
891 892
	return 0;
}
893
EXPORT_SYMBOL(hci_conn_security);
Linus Torvalds's avatar
Linus Torvalds committed
894

895 896 897
/* Check secure link requirement */
int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level)
{
898
	BT_DBG("hcon %p", conn);
899

900 901 902
	/* Accept if non-secure or higher security level is required */
	if (sec_level != BT_SECURITY_HIGH && sec_level != BT_SECURITY_FIPS)
		return 1;
903

904 905 906
	/* Accept if secure or higher security level is already present */
	if (conn->sec_level == BT_SECURITY_HIGH ||
	    conn->sec_level == BT_SECURITY_FIPS)
907 908
		return 1;

909 910
	/* Reject not secure link */
	return 0;
911 912 913
}
EXPORT_SYMBOL(hci_conn_check_secure);

Linus Torvalds's avatar
Linus Torvalds committed
914 915 916
/* Change link key */
int hci_conn_change_link_key(struct hci_conn *conn)
{
917
	BT_DBG("hcon %p", conn);
Linus Torvalds's avatar
Linus Torvalds committed
918

919
	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
Linus Torvalds's avatar
Linus Torvalds committed
920
		struct hci_cp_change_conn_link_key cp;
921
		cp.handle = cpu_to_le16(conn->handle);
922
		hci_send_cmd(conn->hdev, HCI_OP_CHANGE_CONN_LINK_KEY,
923
			     sizeof(cp), &cp);
Linus Torvalds's avatar
Linus Torvalds committed
924
	}
925

Linus Torvalds's avatar
Linus Torvalds committed
926 927 928 929
	return 0;
}

/* Switch role */
930
int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
Linus Torvalds's avatar
Linus Torvalds committed
931
{
932
	BT_DBG("hcon %p", conn);
Linus Torvalds's avatar
Linus Torvalds committed
933 934 935 936

	if (!role && conn->link_mode & HCI_LM_MASTER)
		return 1;

937
	if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->flags)) {
Linus Torvalds's avatar
Linus Torvalds committed
938 939 940
		struct hci_cp_switch_role cp;
		bacpy(&cp.bdaddr, &conn->dst);
		cp.role = role;
941
		hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
Linus Torvalds's avatar
Linus Torvalds committed
942
	}
943

Linus Torvalds's avatar
Linus Torvalds committed
944 945 946 947
	return 0;
}
EXPORT_SYMBOL(hci_conn_switch_role);

948
/* Enter active mode */
949
void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
950 951 952
{
	struct hci_dev *hdev = conn->hdev;

953
	BT_DBG("hcon %p mode %d", conn, conn->mode);
954 955 956 957

	if (test_bit(HCI_RAW, &hdev->flags))
		return;

958 959 960
	if (conn->mode != HCI_CM_SNIFF)
		goto timer;

961
	if (!test_bit(HCI_CONN_POWER_SAVE, &conn->flags) && !force_active)
962 963
		goto timer;

964
	if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
965
		struct hci_cp_exit_sniff_mode cp;
966
		cp.handle = cpu_to_le16(conn->handle);
967
		hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
968 969 970 971
	}

timer:
	if (hdev->idle_timeout > 0)
972 973
		queue_delayed_work(hdev->workqueue, &conn->idle_work,
				   msecs_to_jiffies(hdev->idle_timeout));
974 975
}

Linus Torvalds's avatar
Linus Torvalds committed
976 977 978 979
/* Drop all connection on the device */
void hci_conn_hash_flush(struct hci_dev *hdev)
{
	struct hci_conn_hash *h = &hdev->conn_hash;
980
	struct hci_conn *c, *n;
Linus Torvalds's avatar
Linus Torvalds committed
981 982 983

	BT_DBG("hdev %s", hdev->name);

984
	list_for_each_entry_safe(c, n, &h->list, list) {
Linus Torvalds's avatar
Linus Torvalds committed
985 986
		c->state = BT_CLOSED;

987
		hci_proto_disconn_cfm(c, HCI_ERROR_LOCAL_HOST_TERM);
Linus Torvalds's avatar
Linus Torvalds committed
988 989 990 991
		hci_conn_del(c);
	}
}

992 993 994 995 996 997 998 999 1000 1001 1002
/* Check pending connect attempts */
void hci_conn_check_pending(struct hci_dev *hdev)
{
	struct hci_conn *conn;

	BT_DBG("hdev %s", hdev->name);

	hci_dev_lock(hdev);

	conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
	if (conn)
1003
		hci_acl_create_connection(conn);
1004 1005 1006 1007

	hci_dev_unlock(hdev);
}

Linus Torvalds's avatar
Linus Torvalds committed
1008 1009
int hci_get_conn_list(void __user *arg)
{
1010
	struct hci_conn *c;
Linus Torvalds's avatar
Linus Torvalds committed
1011 1012 1013 1014 1015 1016 1017 1018 1019 1020 1021 1022 1023
	struct hci_conn_list_req req, *cl;
	struct hci_conn_info *ci;
	struct hci_dev *hdev;
	int n = 0, size, err;

	if (copy_from_user(&req, arg, sizeof(req)))
		return -EFAULT;

	if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
		return -EINVAL;

	size = sizeof(req) + req.conn_num * sizeof(*ci);

1024 1025
	cl = kmalloc(size, GFP_KERNEL);
	if (!cl)
Linus Torvalds's avatar
Linus Torvalds committed
1026 1027
		return -ENOMEM;

1028 1029
	hdev = hci_dev_get(req.dev_id);
	if (!hdev) {
Linus Torvalds's avatar
Linus Torvalds committed
1030 1031 1032 1033 1034 1035
		kfree(cl);
		return -ENODEV;
	}

	ci = cl->conn_info;

1036
	hci_dev_lock(hdev);
1037
	list_for_each_entry(c, &hdev->conn_hash.list, list) {
Linus Torvalds's avatar
Linus Torvalds committed
1038 1039 1040 1041 1042 1043 1044 1045 1046
		bacpy(&(ci + n)->bdaddr, &c->dst);
		(ci + n)->handle = c->handle;
		(ci + n)->type  = c->type;
		(ci + n)->out   = c->out;
		(ci + n)->state = c->state;
		(ci + n)->link_mode = c->link_mode;
		if (++n >= req.conn_num)
			break;
	}
1047
	hci_dev_unlock(hdev);
Linus Torvalds's avatar
Linus Torvalds committed
1048 1049 1050 1051 1052 1053 1054 1055 1056 1057 1058 1059 1060 1061 1062 1063 1064 1065 1066 1067 1068 1069 1070

	cl->dev_id = hdev->id;
	cl->conn_num = n;
	size = sizeof(req) + n * sizeof(*ci);

	hci_dev_put(hdev);

	err = copy_to_user(arg, cl, size);
	kfree(cl);

	return err ? -EFAULT : 0;
}

int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
{
	struct hci_conn_info_req req;
	struct hci_conn_info ci;
	struct hci_conn *conn;
	char __user *ptr = arg + sizeof(req);

	if (copy_from_user(&req, arg, sizeof(req)))
		return -EFAULT;

1071
	hci_dev_lock(hdev);
Linus Torvalds's avatar
Linus Torvalds committed
1072 1073 1074 1075 1076 1077 1078 1079 1080
	conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
	if (conn) {
		bacpy(&ci.bdaddr, &conn->dst);
		ci.handle = conn->handle;
		ci.type  = conn->type;
		ci.out   = conn->out;
		ci.state = conn->state;
		ci.link_mode = conn->link_mode;
	}
1081
	hci_dev_unlock(hdev);
Linus Torvalds's avatar
Linus Torvalds committed
1082 1083 1084 1085 1086 1087

	if (!conn)
		return -ENOENT;

	return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
}
1088 1089 1090 1091 1092 1093 1094 1095 1096

int hci_get_auth_info(struct hci_dev *hdev, void __user *arg)
{
	struct hci_auth_info_req req;
	struct hci_conn *conn;

	if (copy_from_user(&req, arg, sizeof(req)))
		return -EFAULT;

1097
	hci_dev_lock(hdev);
1098 1099 1100
	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr);
	if (conn)
		req.type = conn->auth_type;
1101
	hci_dev_unlock(hdev);
1102 1103 1104 1105 1106 1107

	if (!conn)
		return -ENOENT;

	return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0;
}
1108 1109 1110 1111 1112 1113

struct hci_chan *hci_chan_create(struct hci_conn *conn)
{
	struct hci_dev *hdev = conn->hdev;
	struct hci_chan *chan;

1114
	BT_DBG("%s hcon %p", hdev->name, conn);
1115

1116
	chan = kzalloc(sizeof(struct hci_chan), GFP_KERNEL);
1117 1118 1119 1120 1121
	if (!chan)
		return NULL;

	chan->conn = conn;
	skb_queue_head_init(&chan->data_q);
1122
	chan->state = BT_CONNECTED;
1123

1124
	list_add_rcu(&chan->list, &conn->chan_list);
1125 1126 1127 1128

	return chan;
}

1129
void hci_chan_del(struct hci_chan *chan)
1130 1131 1132 1133
{
	struct hci_conn *conn = chan->conn;
	struct hci_dev *hdev = conn->hdev;

1134
	BT_DBG("%s hcon %p chan %p", hdev->name, conn, chan);
1135

1136 1137 1138
	list_del_rcu(&chan->list);

	synchronize_rcu();
1139

1140
	hci_conn_drop(conn);
1141

1142 1143 1144 1145
	skb_queue_purge(&chan->data_q);
	kfree(chan);
}

1146
void hci_chan_list_flush(struct hci_conn *conn)
1147
{
1148
	struct hci_chan *chan, *n;
1149

1150
	BT_DBG("hcon %p", conn);
1151

1152
	list_for_each_entry_safe(chan, n, &conn->chan_list, list)
1153 1154
		hci_chan_del(chan);
}
1155 1156 1157 1158 1159 1160 1161 1162 1163 1164 1165 1166 1167 1168 1169 1170 1171 1172 1173 1174 1175 1176 1177 1178 1179 1180 1181 1182 1183 1184 1185 1186

static struct hci_chan *__hci_chan_lookup_handle(struct hci_conn *hcon,
						 __u16 handle)
{
	struct hci_chan *hchan;

	list_for_each_entry(hchan, &hcon->chan_list, list) {
		if (hchan->handle == handle)
			return hchan;
	}

	return NULL;
}

struct hci_chan *hci_chan_lookup_handle(struct hci_dev *hdev, __u16 handle)
{
	struct hci_conn_hash *h = &hdev->conn_hash;
	struct hci_conn *hcon;
	struct hci_chan *hchan = NULL;

	rcu_read_lock();

	list_for_each_entry_rcu(hcon, &h->list, list) {
		hchan = __hci_chan_lookup_handle(hcon, handle);
		if (hchan)
			break;
	}

	rcu_read_unlock();

	return hchan;
}