net/bluetooth/hci_conn.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI connection handling. */
  26
  27 #include <linux/export.h>
  28
  29 #include <net/bluetooth/bluetooth.h>
  30 #include <net/bluetooth/hci_core.h>
  31
  32 #include "smp.h"
  33 #include "a2mp.h"
  34
  35 struct sco_param {
  36         u16 pkt_type;
  37         u16 max_latency;
  38 };
  39
  40 static const struct sco_param sco_param_cvsd[] = {
  41         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000a }, /* S3 */
  42         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x0007 }, /* S2 */
  43         { EDR_ESCO_MASK | ESCO_EV3,   0x0007 }, /* S1 */
  44         { EDR_ESCO_MASK | ESCO_HV3,   0xffff }, /* D1 */
  45         { EDR_ESCO_MASK | ESCO_HV1,   0xffff }, /* D0 */
  46 };
  47
  48 static const struct sco_param sco_param_wideband[] = {
  49         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000d }, /* T2 */
  50         { EDR_ESCO_MASK | ESCO_EV3,   0x0008 }, /* T1 */
  51 };
  52
  53 static void hci_le_create_connection_cancel(struct hci_conn *conn)
  54 {
  55         hci_send_cmd(conn->hdev, HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL);
  56 }
  57
  58 static void hci_acl_create_connection(struct hci_conn *conn)
  59 {
  60         struct hci_dev *hdev = conn->hdev;
  61         struct inquiry_entry *ie;
  62         struct hci_cp_create_conn cp;
  63
  64         BT_DBG("hcon %p", conn);
  65
  66         conn->state = BT_CONNECT;
  67         conn->out = true;
  68
  69         conn->link_mode = HCI_LM_MASTER;
  70
  71         conn->attempt++;
  72
  73         conn->link_policy = hdev->link_policy;
  74
  75         memset(&cp, 0, sizeof(cp));
  76         bacpy(&cp.bdaddr, &conn->dst);
  77         cp.pscan_rep_mode = 0x02;
  78
  79         ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
  80         if (ie) {
  81                 if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
  82                         cp.pscan_rep_mode = ie->data.pscan_rep_mode;
  83                         cp.pscan_mode     = ie->data.pscan_mode;
  84                         cp.clock_offset   = ie->data.clock_offset |
  85                                             cpu_to_le16(0x8000);
  86                 }
  87
  88                 memcpy(conn->dev_class, ie->data.dev_class, 3);
  89                 if (ie->data.ssp_mode > 0)
  90                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
  91         }
  92
  93         cp.pkt_type = cpu_to_le16(conn->pkt_type);
  94         if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
  95                 cp.role_switch = 0x01;
  96         else
  97                 cp.role_switch = 0x00;
  98
  99         hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
 100 }
 101
 102 static void hci_acl_create_connection_cancel(struct hci_conn *conn)
 103 {
 104         struct hci_cp_create_conn_cancel cp;
 105
 106         BT_DBG("hcon %p", conn);
 107
 108         if (conn->hdev->hci_ver < BLUETOOTH_VER_1_2)
 109                 return;
 110
 111         bacpy(&cp.bdaddr, &conn->dst);
 112         hci_send_cmd(conn->hdev, HCI_OP_CREATE_CONN_CANCEL, sizeof(cp), &cp);
 113 }
 114
 115 static void hci_reject_sco(struct hci_conn *conn)
 116 {
 117         struct hci_cp_reject_sync_conn_req cp;
 118
 119         cp.reason = HCI_ERROR_REMOTE_USER_TERM;
 120         bacpy(&cp.bdaddr, &conn->dst);
 121
 122         hci_send_cmd(conn->hdev, HCI_OP_REJECT_SYNC_CONN_REQ, sizeof(cp), &cp);
 123 }
 124
 125 void hci_disconnect(struct hci_conn *conn, __u8 reason)
 126 {
 127         struct hci_cp_disconnect cp;
 128
 129         BT_DBG("hcon %p", conn);
 130
 131         conn->state = BT_DISCONN;
 132
 133         cp.handle = cpu_to_le16(conn->handle);
 134         cp.reason = reason;
 135         hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp);
 136 }
 137
 138 static void hci_amp_disconn(struct hci_conn *conn, __u8 reason)
 139 {
 140         struct hci_cp_disconn_phy_link cp;
 141
 142         BT_DBG("hcon %p", conn);
 143
 144         conn->state = BT_DISCONN;
 145
 146         cp.phy_handle = HCI_PHY_HANDLE(conn->handle);
 147         cp.reason = reason;
 148         hci_send_cmd(conn->hdev, HCI_OP_DISCONN_PHY_LINK,
 149                      sizeof(cp), &cp);
 150 }
 151
 152 static void hci_add_sco(struct hci_conn *conn, __u16 handle)
 153 {
 154         struct hci_dev *hdev = conn->hdev;
 155         struct hci_cp_add_sco cp;
 156
 157         BT_DBG("hcon %p", conn);
 158
 159         conn->state = BT_CONNECT;
 160         conn->out = true;
 161
 162         conn->attempt++;
 163
 164         cp.handle   = cpu_to_le16(handle);
 165         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 166
 167         hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
 168 }
 169
 170 bool hci_setup_sync(struct hci_conn *conn, __u16 handle)
 171 {
 172         struct hci_dev *hdev = conn->hdev;
 173         struct hci_cp_setup_sync_conn cp;
 174         const struct sco_param *param;
 175
 176         BT_DBG("hcon %p", conn);
 177
 178         conn->state = BT_CONNECT;
 179         conn->out = true;
 180
 181         conn->attempt++;
 182
 183         cp.handle   = cpu_to_le16(handle);
 184
 185         cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
 186         cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
 187         cp.voice_setting  = cpu_to_le16(conn->setting);
 188
 189         switch (conn->setting & SCO_AIRMODE_MASK) {
 190         case SCO_AIRMODE_TRANSP:
 191                 if (conn->attempt > ARRAY_SIZE(sco_param_wideband))
 192                         return false;
 193                 cp.retrans_effort = 0x02;
 194                 param = &sco_param_wideband[conn->attempt - 1];
 195                 break;
 196         case SCO_AIRMODE_CVSD:
 197                 if (conn->attempt > ARRAY_SIZE(sco_param_cvsd))
 198                         return false;
 199                 cp.retrans_effort = 0x01;
 200                 param = &sco_param_cvsd[conn->attempt - 1];
 201                 break;
 202         default:
 203                 return false;
 204         }
 205
 206         cp.pkt_type = __cpu_to_le16(param->pkt_type);
 207         cp.max_latency = __cpu_to_le16(param->max_latency);
 208
 209         if (hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp) < 0)
 210                 return false;
 211
 212         return true;
 213 }
 214
 215 void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max,
 216                         u16 latency, u16 to_multiplier)
 217 {
 218         struct hci_cp_le_conn_update cp;
 219         struct hci_dev *hdev = conn->hdev;
 220
 221         memset(&cp, 0, sizeof(cp));
 222
 223         cp.handle               = cpu_to_le16(conn->handle);
 224         cp.conn_interval_min    = cpu_to_le16(min);
 225         cp.conn_interval_max    = cpu_to_le16(max);
 226         cp.conn_latency         = cpu_to_le16(latency);
 227         cp.supervision_timeout  = cpu_to_le16(to_multiplier);
 228         cp.min_ce_len           = cpu_to_le16(0x0000);
 229         cp.max_ce_len           = cpu_to_le16(0x0000);
 230
 231         hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp);
 232 }
 233
 234 void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __le64 rand,
 235                       __u8 ltk[16])
 236 {
 237         struct hci_dev *hdev = conn->hdev;
 238         struct hci_cp_le_start_enc cp;
 239
 240         BT_DBG("hcon %p", conn);
 241
 242         memset(&cp, 0, sizeof(cp));
 243
 244         cp.handle = cpu_to_le16(conn->handle);
 245         cp.rand = rand;
 246         cp.ediv = ediv;
 247         memcpy(cp.ltk, ltk, sizeof(cp.ltk));
 248
 249         hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp);
 250 }
 251
 252 /* Device _must_ be locked */
 253 void hci_sco_setup(struct hci_conn *conn, __u8 status)
 254 {
 255         struct hci_conn *sco = conn->link;
 256
 257         if (!sco)
 258                 return;
 259
 260         BT_DBG("hcon %p", conn);
 261
 262         if (!status) {
 263                 if (lmp_esco_capable(conn->hdev))
 264                         hci_setup_sync(sco, conn->handle);
 265                 else
 266                         hci_add_sco(sco, conn->handle);
 267         } else {
 268                 hci_proto_connect_cfm(sco, status);
 269                 hci_conn_del(sco);
 270         }
 271 }
 272
 273 static void hci_conn_disconnect(struct hci_conn *conn)
 274 {
 275         __u8 reason = hci_proto_disconn_ind(conn);
 276
 277         switch (conn->type) {
 278         case AMP_LINK:
 279                 hci_amp_disconn(conn, reason);
 280                 break;
 281         default:
 282                 hci_disconnect(conn, reason);
 283                 break;
 284         }
 285 }
 286
 287 static void hci_conn_timeout(struct work_struct *work)
 288 {
 289         struct hci_conn *conn = container_of(work, struct hci_conn,
 290                                              disc_work.work);
 291
 292         BT_DBG("hcon %p state %s", conn, state_to_string(conn->state));
 293
 294         if (atomic_read(&conn->refcnt))
 295                 return;
 296
 297         switch (conn->state) {
 298         case BT_CONNECT:
 299         case BT_CONNECT2:
 300                 if (conn->out) {
 301                         if (conn->type == ACL_LINK)
 302                                 hci_acl_create_connection_cancel(conn);
 303                         else if (conn->type == LE_LINK)
 304                                 hci_le_create_connection_cancel(conn);
 305                 } else if (conn->type == SCO_LINK || conn->type == ESCO_LINK) {
 306                         hci_reject_sco(conn);
 307                 }
 308                 break;
 309         case BT_CONFIG:
 310         case BT_CONNECTED:
 311                 hci_conn_disconnect(conn);
 312                 break;
 313         default:
 314                 conn->state = BT_CLOSED;
 315                 break;
 316         }
 317 }
 318
 319 /* Enter sniff mode */
 320 static void hci_conn_idle(struct work_struct *work)
 321 {
 322         struct hci_conn *conn = container_of(work, struct hci_conn,
 323                                              idle_work.work);
 324         struct hci_dev *hdev = conn->hdev;
 325
 326         BT_DBG("hcon %p mode %d", conn, conn->mode);
 327
 328         if (test_bit(HCI_RAW, &hdev->flags))
 329                 return;
 330
 331         if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn))
 332                 return;
 333
 334         if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF))
 335                 return;
 336
 337         if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
 338                 struct hci_cp_sniff_subrate cp;
 339                 cp.handle             = cpu_to_le16(conn->handle);
 340                 cp.max_latency        = cpu_to_le16(0);
 341                 cp.min_remote_timeout = cpu_to_le16(0);
 342                 cp.min_local_timeout  = cpu_to_le16(0);
 343                 hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
 344         }
 345
 346         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
 347                 struct hci_cp_sniff_mode cp;
 348                 cp.handle       = cpu_to_le16(conn->handle);
 349                 cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
 350                 cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
 351                 cp.attempt      = cpu_to_le16(4);
 352                 cp.timeout      = cpu_to_le16(1);
 353                 hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
 354         }
 355 }
 356
 357 static void hci_conn_auto_accept(struct work_struct *work)
 358 {
 359         struct hci_conn *conn = container_of(work, struct hci_conn,
 360                                              auto_accept_work.work);
 361
 362         hci_send_cmd(conn->hdev, HCI_OP_USER_CONFIRM_REPLY, sizeof(conn->dst),
 363                      &conn->dst);
 364 }
 365
 366 static void le_conn_timeout(struct work_struct *work)
 367 {
 368         struct hci_conn *conn = container_of(work, struct hci_conn,
 369                                              le_conn_timeout.work);
 370         struct hci_dev *hdev = conn->hdev;
 371
 372         BT_DBG("");
 373
 374         /* We could end up here due to having done directed advertising,
 375          * so clean up the state if necessary. This should however only
 376          * happen with broken hardware or if low duty cycle was used
 377          * (which doesn't have a timeout of its own).
 378          */
 379         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
 380                 u8 enable = 0x00;
 381                 hci_send_cmd(hdev, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable),
 382                              &enable);
 383                 hci_le_conn_failed(conn, HCI_ERROR_ADVERTISING_TIMEOUT);
 384                 return;
 385         }
 386
 387         hci_le_create_connection_cancel(conn);
 388 }
 389
 390 struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
 391 {
 392         struct hci_conn *conn;
 393
 394         BT_DBG("%s dst %pMR", hdev->name, dst);
 395
 396         conn = kzalloc(sizeof(struct hci_conn), GFP_KERNEL);
 397         if (!conn)
 398                 return NULL;
 399
 400         bacpy(&conn->dst, dst);
 401         bacpy(&conn->src, &hdev->bdaddr);
 402         conn->hdev  = hdev;
 403         conn->type  = type;
 404         conn->mode  = HCI_CM_ACTIVE;
 405         conn->state = BT_OPEN;
 406         conn->auth_type = HCI_AT_GENERAL_BONDING;
 407         conn->io_capability = hdev->io_capability;
 408         conn->remote_auth = 0xff;
 409         conn->key_type = 0xff;
 410
 411         set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
 412         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
 413
 414         switch (type) {
 415         case ACL_LINK:
 416                 conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
 417                 break;
 418         case LE_LINK:
 419                 /* conn->src should reflect the local identity address */
 420                 hci_copy_identity_address(hdev, &conn->src, &conn->src_type);
 421                 break;
 422         case SCO_LINK:
 423                 if (lmp_esco_capable(hdev))
 424                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
 425                                         (hdev->esco_type & EDR_ESCO_MASK);
 426                 else
 427                         conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
 428                 break;
 429         case ESCO_LINK:
 430                 conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
 431                 break;
 432         }
 433
 434         skb_queue_head_init(&conn->data_q);
 435
 436         INIT_LIST_HEAD(&conn->chan_list);
 437
 438         INIT_DELAYED_WORK(&conn->disc_work, hci_conn_timeout);
 439         INIT_DELAYED_WORK(&conn->auto_accept_work, hci_conn_auto_accept);
 440         INIT_DELAYED_WORK(&conn->idle_work, hci_conn_idle);
 441         INIT_DELAYED_WORK(&conn->le_conn_timeout, le_conn_timeout);
 442
 443         atomic_set(&conn->refcnt, 0);
 444
 445         hci_dev_hold(hdev);
 446
 447         hci_conn_hash_add(hdev, conn);
 448         if (hdev->notify)
 449                 hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
 450
 451         hci_conn_init_sysfs(conn);
 452
 453         return conn;
 454 }
 455
 456 int hci_conn_del(struct hci_conn *conn)
 457 {
 458         struct hci_dev *hdev = conn->hdev;
 459
 460         BT_DBG("%s hcon %p handle %d", hdev->name, conn, conn->handle);
 461
 462         cancel_delayed_work_sync(&conn->disc_work);
 463         cancel_delayed_work_sync(&conn->auto_accept_work);
 464         cancel_delayed_work_sync(&conn->idle_work);
 465
 466         if (conn->type == ACL_LINK) {
 467                 struct hci_conn *sco = conn->link;
 468                 if (sco)
 469                         sco->link = NULL;
 470
 471                 /* Unacked frames */
 472                 hdev->acl_cnt += conn->sent;
 473         } else if (conn->type == LE_LINK) {
 474                 cancel_delayed_work_sync(&conn->le_conn_timeout);
 475
 476                 if (hdev->le_pkts)
 477                         hdev->le_cnt += conn->sent;
 478                 else
 479                         hdev->acl_cnt += conn->sent;
 480         } else {
 481                 struct hci_conn *acl = conn->link;
 482                 if (acl) {
 483                         acl->link = NULL;
 484                         hci_conn_drop(acl);
 485                 }
 486         }
 487
 488         hci_chan_list_flush(conn);
 489
 490         if (conn->amp_mgr)
 491                 amp_mgr_put(conn->amp_mgr);
 492
 493         hci_conn_hash_del(hdev, conn);
 494         if (hdev->notify)
 495                 hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
 496
 497         skb_queue_purge(&conn->data_q);
 498
 499         hci_conn_del_sysfs(conn);
 500
 501         hci_dev_put(hdev);
 502
 503         hci_conn_put(conn);
 504
 505         return 0;
 506 }
 507
 508 struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src)
 509 {
 510         int use_src = bacmp(src, BDADDR_ANY);
 511         struct hci_dev *hdev = NULL, *d;
 512
 513         BT_DBG("%pMR -> %pMR", src, dst);
 514
 515         read_lock(&hci_dev_list_lock);
 516
 517         list_for_each_entry(d, &hci_dev_list, list) {
 518                 if (!test_bit(HCI_UP, &d->flags) ||
 519                     test_bit(HCI_RAW, &d->flags) ||
 520                     test_bit(HCI_USER_CHANNEL, &d->dev_flags) ||
 521                     d->dev_type != HCI_BREDR)
 522                         continue;
 523
 524                 /* Simple routing:
 525                  *   No source address - find interface with bdaddr != dst
 526                  *   Source address    - find interface with bdaddr == src
 527                  */
 528
 529                 if (use_src) {
 530                         if (!bacmp(&d->bdaddr, src)) {
 531                                 hdev = d; break;
 532                         }
 533                 } else {
 534                         if (bacmp(&d->bdaddr, dst)) {
 535                                 hdev = d; break;
 536                         }
 537                 }
 538         }
 539
 540         if (hdev)
 541                 hdev = hci_dev_hold(hdev);
 542
 543         read_unlock(&hci_dev_list_lock);
 544         return hdev;
 545 }
 546 EXPORT_SYMBOL(hci_get_route);
 547
 548 /* This function requires the caller holds hdev->lock */
 549 void hci_le_conn_failed(struct hci_conn *conn, u8 status)
 550 {
 551         struct hci_dev *hdev = conn->hdev;
 552
 553         conn->state = BT_CLOSED;
 554
 555         mgmt_connect_failed(hdev, &conn->dst, conn->type, conn->dst_type,
 556                             status);
 557
 558         hci_proto_connect_cfm(conn, status);
 559
 560         hci_conn_del(conn);
 561
 562         /* Since we may have temporarily stopped the background scanning in
 563          * favor of connection establishment, we should restart it.
 564          */
 565         hci_update_background_scan(hdev);
 566
 567         /* Re-enable advertising in case this was a failed connection
 568          * attempt as a peripheral.
 569          */
 570         mgmt_reenable_advertising(hdev);
 571 }
 572
 573 static void create_le_conn_complete(struct hci_dev *hdev, u8 status)
 574 {
 575         struct hci_conn *conn;
 576
 577         if (status == 0)
 578                 return;
 579
 580         BT_ERR("HCI request failed to create LE connection: status 0x%2.2x",
 581                status);
 582
 583         hci_dev_lock(hdev);
 584
 585         conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
 586         if (!conn)
 587                 goto done;
 588
 589         hci_le_conn_failed(conn, status);
 590
 591 done:
 592         hci_dev_unlock(hdev);
 593 }
 594
 595 static void hci_req_add_le_create_conn(struct hci_request *req,
 596                                        struct hci_conn *conn)
 597 {
 598         struct hci_cp_le_create_conn cp;
 599         struct hci_dev *hdev = conn->hdev;
 600         u8 own_addr_type;
 601
 602         memset(&cp, 0, sizeof(cp));
 603
 604         /* Update random address, but set require_privacy to false so
 605          * that we never connect with an unresolvable address.
 606          */
 607         if (hci_update_random_address(req, false, &own_addr_type))
 608                 return;
 609
 610         /* Save the address type used for this connnection attempt so we able
 611          * to retrieve this information if we need it.
 612          */
 613         conn->src_type = own_addr_type;
 614
 615         cp.scan_interval = cpu_to_le16(hdev->le_scan_interval);
 616         cp.scan_window = cpu_to_le16(hdev->le_scan_window);
 617         bacpy(&cp.peer_addr, &conn->dst);
 618         cp.peer_addr_type = conn->dst_type;
 619         cp.own_address_type = own_addr_type;
 620         cp.conn_interval_min = cpu_to_le16(conn->le_conn_min_interval);
 621         cp.conn_interval_max = cpu_to_le16(conn->le_conn_max_interval);
 622         cp.supervision_timeout = cpu_to_le16(0x002a);
 623         cp.min_ce_len = cpu_to_le16(0x0000);
 624         cp.max_ce_len = cpu_to_le16(0x0000);
 625
 626         hci_req_add(req, HCI_OP_LE_CREATE_CONN, sizeof(cp), &cp);
 627
 628         conn->state = BT_CONNECT;
 629 }
 630
 631 static void hci_req_directed_advertising(struct hci_request *req,
 632                                          struct hci_conn *conn)
 633 {
 634         struct hci_dev *hdev = req->hdev;
 635         struct hci_cp_le_set_adv_param cp;
 636         u8 own_addr_type;
 637         u8 enable;
 638
 639         enable = 0x00;
 640         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
 641
 642         /* Clear the HCI_ADVERTISING bit temporarily so that the
 643          * hci_update_random_address knows that it's safe to go ahead
 644          * and write a new random address. The flag will be set back on
 645          * as soon as the SET_ADV_ENABLE HCI command completes.
 646          */
 647         clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
 648
 649         /* Set require_privacy to false so that the remote device has a
 650          * chance of identifying us.
 651          */
 652         if (hci_update_random_address(req, false, &own_addr_type) < 0)
 653                 return;
 654
 655         memset(&cp, 0, sizeof(cp));
 656         cp.type = LE_ADV_DIRECT_IND;
 657         cp.own_address_type = own_addr_type;
 658         cp.direct_addr_type = conn->dst_type;
 659         bacpy(&cp.direct_addr, &conn->dst);
 660         cp.channel_map = hdev->le_adv_channel_map;
 661
 662         hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
 663
 664         enable = 0x01;
 665         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
 666
 667         conn->state = BT_CONNECT;
 668 }
 669
 670 struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,
 671                                 u8 dst_type, u8 sec_level, u8 auth_type)
 672 {
 673         struct hci_conn_params *params;
 674         struct hci_conn *conn;
 675         struct smp_irk *irk;
 676         struct hci_request req;
 677         int err;
 678
 679         /* Some devices send ATT messages as soon as the physical link is
 680          * established. To be able to handle these ATT messages, the user-
 681          * space first establishes the connection and then starts the pairing
 682          * process.
 683          *
 684          * So if a hci_conn object already exists for the following connection
 685          * attempt, we simply update pending_sec_level and auth_type fields
 686          * and return the object found.
 687          */
 688         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, dst);
 689         if (conn) {
 690                 conn->pending_sec_level = sec_level;
 691                 conn->auth_type = auth_type;
 692                 goto done;
 693         }
 694
 695         /* Since the controller supports only one LE connection attempt at a
 696          * time, we return -EBUSY if there is any connection attempt running.
 697          */
 698         conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
 699         if (conn)
 700                 return ERR_PTR(-EBUSY);
 701
 702         /* When given an identity address with existing identity
 703          * resolving key, the connection needs to be established
 704          * to a resolvable random address.
 705          *
 706          * This uses the cached random resolvable address from
 707          * a previous scan. When no cached address is available,
 708          * try connecting to the identity address instead.
 709          *
 710          * Storing the resolvable random address is required here
 711          * to handle connection failures. The address will later
 712          * be resolved back into the original identity address
 713          * from the connect request.
 714          */
 715         irk = hci_find_irk_by_addr(hdev, dst, dst_type);
 716         if (irk && bacmp(&irk->rpa, BDADDR_ANY)) {
 717                 dst = &irk->rpa;
 718                 dst_type = ADDR_LE_DEV_RANDOM;
 719         }
 720
 721         conn = hci_conn_add(hdev, LE_LINK, dst);
 722         if (!conn)
 723                 return ERR_PTR(-ENOMEM);
 724
 725         conn->dst_type = dst_type;
 726         conn->sec_level = BT_SECURITY_LOW;
 727         conn->pending_sec_level = sec_level;
 728         conn->auth_type = auth_type;
 729
 730         hci_req_init(&req, hdev);
 731
 732         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
 733                 hci_req_directed_advertising(&req, conn);
 734                 goto create_conn;
 735         }
 736
 737         conn->out = true;
 738         conn->link_mode |= HCI_LM_MASTER;
 739
 740         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
 741         if (params) {
 742                 conn->le_conn_min_interval = params->conn_min_interval;
 743                 conn->le_conn_max_interval = params->conn_max_interval;
 744         } else {
 745                 conn->le_conn_min_interval = hdev->le_conn_min_interval;
 746                 conn->le_conn_max_interval = hdev->le_conn_max_interval;
 747         }
 748
 749         /* If controller is scanning, we stop it since some controllers are
 750          * not able to scan and connect at the same time. Also set the
 751          * HCI_LE_SCAN_INTERRUPTED flag so that the command complete
 752          * handler for scan disabling knows to set the correct discovery
 753          * state.
 754          */
 755         if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
 756                 hci_req_add_le_scan_disable(&req);
 757                 set_bit(HCI_LE_SCAN_INTERRUPTED, &hdev->dev_flags);
 758         }
 759
 760         hci_req_add_le_create_conn(&req, conn);
 761
 762 create_conn:
 763         err = hci_req_run(&req, create_le_conn_complete);
 764         if (err) {
 765                 hci_conn_del(conn);
 766                 return ERR_PTR(err);
 767         }
 768
 769 done:
 770         hci_conn_hold(conn);
 771         return conn;
 772 }
 773
 774 struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst,
 775                                  u8 sec_level, u8 auth_type)
 776 {
 777         struct hci_conn *acl;
 778
 779         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 780                 return ERR_PTR(-ENOTSUPP);
 781
 782         acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
 783         if (!acl) {
 784                 acl = hci_conn_add(hdev, ACL_LINK, dst);
 785                 if (!acl)
 786                         return ERR_PTR(-ENOMEM);
 787         }
 788
 789         hci_conn_hold(acl);
 790
 791         if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
 792                 acl->sec_level = BT_SECURITY_LOW;
 793                 acl->pending_sec_level = sec_level;
 794                 acl->auth_type = auth_type;
 795                 hci_acl_create_connection(acl);
 796         }
 797
 798         return acl;
 799 }
 800
 801 struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type, bdaddr_t *dst,
 802                                  __u16 setting)
 803 {
 804         struct hci_conn *acl;
 805         struct hci_conn *sco;
 806
 807         acl = hci_connect_acl(hdev, dst, BT_SECURITY_LOW, HCI_AT_NO_BONDING);
 808         if (IS_ERR(acl))
 809                 return acl;
 810
 811         sco = hci_conn_hash_lookup_ba(hdev, type, dst);
 812         if (!sco) {
 813                 sco = hci_conn_add(hdev, type, dst);
 814                 if (!sco) {
 815                         hci_conn_drop(acl);
 816                         return ERR_PTR(-ENOMEM);
 817                 }
 818         }
 819
 820         acl->link = sco;
 821         sco->link = acl;
 822
 823         hci_conn_hold(sco);
 824
 825         sco->setting = setting;
 826
 827         if (acl->state == BT_CONNECTED &&
 828             (sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
 829                 set_bit(HCI_CONN_POWER_SAVE, &acl->flags);
 830                 hci_conn_enter_active_mode(acl, BT_POWER_FORCE_ACTIVE_ON);
 831
 832                 if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->flags)) {
 833                         /* defer SCO setup until mode change completed */
 834                         set_bit(HCI_CONN_SCO_SETUP_PEND, &acl->flags);
 835                         return sco;
 836                 }
 837
 838                 hci_sco_setup(acl, 0x00);
 839         }
 840
 841         return sco;
 842 }
 843
 844 /* Check link security requirement */
 845 int hci_conn_check_link_mode(struct hci_conn *conn)
 846 {
 847         BT_DBG("hcon %p", conn);
 848
 849         /* In Secure Connections Only mode, it is required that Secure
 850          * Connections is used and the link is encrypted with AES-CCM
 851          * using a P-256 authenticated combination key.
 852          */
 853         if (test_bit(HCI_SC_ONLY, &conn->hdev->flags)) {
 854                 if (!hci_conn_sc_enabled(conn) ||
 855                     !test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
 856                     conn->key_type != HCI_LK_AUTH_COMBINATION_P256)
 857                         return 0;
 858         }
 859
 860         if (hci_conn_ssp_enabled(conn) && !(conn->link_mode & HCI_LM_ENCRYPT))
 861                 return 0;
 862
 863         return 1;
 864 }
 865
 866 /* Authenticate remote device */
 867 static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 868 {
 869         BT_DBG("hcon %p", conn);
 870
 871         if (conn->pending_sec_level > sec_level)
 872                 sec_level = conn->pending_sec_level;
 873
 874         if (sec_level > conn->sec_level)
 875                 conn->pending_sec_level = sec_level;
 876         else if (conn->link_mode & HCI_LM_AUTH)
 877                 return 1;
 878
 879         /* Make sure we preserve an existing MITM requirement*/
 880         auth_type |= (conn->auth_type & 0x01);
 881
 882         conn->auth_type = auth_type;
 883
 884         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
 885                 struct hci_cp_auth_requested cp;
 886
 887                 /* encrypt must be pending if auth is also pending */
 888                 set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
 889
 890                 cp.handle = cpu_to_le16(conn->handle);
 891                 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
 892                              sizeof(cp), &cp);
 893                 if (conn->key_type != 0xff)
 894                         set_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
 895         }
 896
 897         return 0;
 898 }
 899
 900 /* Encrypt the the link */
 901 static void hci_conn_encrypt(struct hci_conn *conn)
 902 {
 903         BT_DBG("hcon %p", conn);
 904
 905         if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
 906                 struct hci_cp_set_conn_encrypt cp;
 907                 cp.handle  = cpu_to_le16(conn->handle);
 908                 cp.encrypt = 0x01;
 909                 hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
 910                              &cp);
 911         }
 912 }
 913
 914 /* Enable security */
 915 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 916 {
 917         BT_DBG("hcon %p", conn);
 918
 919         if (conn->type == LE_LINK)
 920                 return smp_conn_security(conn, sec_level);
 921
 922         /* For sdp we don't need the link key. */
 923         if (sec_level == BT_SECURITY_SDP)
 924                 return 1;
 925
 926         /* For non 2.1 devices and low security level we don't need the link
 927            key. */
 928         if (sec_level == BT_SECURITY_LOW && !hci_conn_ssp_enabled(conn))
 929                 return 1;
 930
 931         /* For other security levels we need the link key. */
 932         if (!(conn->link_mode & HCI_LM_AUTH))
 933                 goto auth;
 934
 935         /* An authenticated FIPS approved combination key has sufficient
 936          * security for security level 4. */
 937         if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256 &&
 938             sec_level == BT_SECURITY_FIPS)
 939                 goto encrypt;
 940
 941         /* An authenticated combination key has sufficient security for
 942            security level 3. */
 943         if ((conn->key_type == HCI_LK_AUTH_COMBINATION_P192 ||
 944              conn->key_type == HCI_LK_AUTH_COMBINATION_P256) &&
 945             sec_level == BT_SECURITY_HIGH)
 946                 goto encrypt;
 947
 948         /* An unauthenticated combination key has sufficient security for
 949            security level 1 and 2. */
 950         if ((conn->key_type == HCI_LK_UNAUTH_COMBINATION_P192 ||
 951              conn->key_type == HCI_LK_UNAUTH_COMBINATION_P256) &&
 952             (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW))
 953                 goto encrypt;
 954
 955         /* A combination key has always sufficient security for the security
 956            levels 1 or 2. High security level requires the combination key
 957            is generated using maximum PIN code length (16).
 958            For pre 2.1 units. */
 959         if (conn->key_type == HCI_LK_COMBINATION &&
 960             (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW ||
 961              conn->pin_length == 16))
 962                 goto encrypt;
 963
 964 auth:
 965         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags))
 966                 return 0;
 967
 968         if (!hci_conn_auth(conn, sec_level, auth_type))
 969                 return 0;
 970
 971 encrypt:
 972         if (conn->link_mode & HCI_LM_ENCRYPT)
 973                 return 1;
 974
 975         hci_conn_encrypt(conn);
 976         return 0;
 977 }
 978 EXPORT_SYMBOL(hci_conn_security);
 979
 980 /* Check secure link requirement */
 981 int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level)
 982 {
 983         BT_DBG("hcon %p", conn);
 984
 985         /* Accept if non-secure or higher security level is required */
 986         if (sec_level != BT_SECURITY_HIGH && sec_level != BT_SECURITY_FIPS)
 987                 return 1;
 988
 989         /* Accept if secure or higher security level is already present */
 990         if (conn->sec_level == BT_SECURITY_HIGH ||
 991             conn->sec_level == BT_SECURITY_FIPS)
 992                 return 1;
 993
 994         /* Reject not secure link */
 995         return 0;
 996 }
 997 EXPORT_SYMBOL(hci_conn_check_secure);
 998
 999 /* Change link key */
1000 int hci_conn_change_link_key(struct hci_conn *conn)
1001 {
1002         BT_DBG("hcon %p", conn);
1003
1004         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
1005                 struct hci_cp_change_conn_link_key cp;
1006                 cp.handle = cpu_to_le16(conn->handle);
1007                 hci_send_cmd(conn->hdev, HCI_OP_CHANGE_CONN_LINK_KEY,
1008                              sizeof(cp), &cp);
1009         }
1010
1011         return 0;
1012 }
1013
1014 /* Switch role */
1015 int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
1016 {
1017         BT_DBG("hcon %p", conn);
1018
1019         if (!role && conn->link_mode & HCI_LM_MASTER)
1020                 return 1;
1021
1022         if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->flags)) {
1023                 struct hci_cp_switch_role cp;
1024                 bacpy(&cp.bdaddr, &conn->dst);
1025                 cp.role = role;
1026                 hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
1027         }
1028
1029         return 0;
1030 }
1031 EXPORT_SYMBOL(hci_conn_switch_role);
1032
1033 /* Enter active mode */
1034 void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
1035 {
1036         struct hci_dev *hdev = conn->hdev;
1037
1038         BT_DBG("hcon %p mode %d", conn, conn->mode);
1039
1040         if (test_bit(HCI_RAW, &hdev->flags))
1041                 return;
1042
1043         if (conn->mode != HCI_CM_SNIFF)
1044                 goto timer;
1045
1046         if (!test_bit(HCI_CONN_POWER_SAVE, &conn->flags) && !force_active)
1047                 goto timer;
1048
1049         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
1050                 struct hci_cp_exit_sniff_mode cp;
1051                 cp.handle = cpu_to_le16(conn->handle);
1052                 hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
1053         }
1054
1055 timer:
1056         if (hdev->idle_timeout > 0)
1057                 queue_delayed_work(hdev->workqueue, &conn->idle_work,
1058                                    msecs_to_jiffies(hdev->idle_timeout));
1059 }
1060
1061 /* Drop all connection on the device */
1062 void hci_conn_hash_flush(struct hci_dev *hdev)
1063 {
1064         struct hci_conn_hash *h = &hdev->conn_hash;
1065         struct hci_conn *c, *n;
1066
1067         BT_DBG("hdev %s", hdev->name);
1068
1069         list_for_each_entry_safe(c, n, &h->list, list) {
1070                 c->state = BT_CLOSED;
1071
1072                 hci_proto_disconn_cfm(c, HCI_ERROR_LOCAL_HOST_TERM);
1073                 hci_conn_del(c);
1074         }
1075 }
1076
1077 /* Check pending connect attempts */
1078 void hci_conn_check_pending(struct hci_dev *hdev)
1079 {
1080         struct hci_conn *conn;
1081
1082         BT_DBG("hdev %s", hdev->name);
1083
1084         hci_dev_lock(hdev);
1085
1086         conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
1087         if (conn)
1088                 hci_acl_create_connection(conn);
1089
1090         hci_dev_unlock(hdev);
1091 }
1092
1093 int hci_get_conn_list(void __user *arg)
1094 {
1095         struct hci_conn *c;
1096         struct hci_conn_list_req req, *cl;
1097         struct hci_conn_info *ci;
1098         struct hci_dev *hdev;
1099         int n = 0, size, err;
1100
1101         if (copy_from_user(&req, arg, sizeof(req)))
1102                 return -EFAULT;
1103
1104         if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
1105                 return -EINVAL;
1106
1107         size = sizeof(req) + req.conn_num * sizeof(*ci);
1108
1109         cl = kmalloc(size, GFP_KERNEL);
1110         if (!cl)
1111                 return -ENOMEM;
1112
1113         hdev = hci_dev_get(req.dev_id);
1114         if (!hdev) {
1115                 kfree(cl);
1116                 return -ENODEV;
1117         }
1118
1119         ci = cl->conn_info;
1120
1121         hci_dev_lock(hdev);
1122         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1123                 bacpy(&(ci + n)->bdaddr, &c->dst);
1124                 (ci + n)->handle = c->handle;
1125                 (ci + n)->type  = c->type;
1126                 (ci + n)->out   = c->out;
1127                 (ci + n)->state = c->state;
1128                 (ci + n)->link_mode = c->link_mode;
1129                 if (++n >= req.conn_num)
1130                         break;
1131         }
1132         hci_dev_unlock(hdev);
1133
1134         cl->dev_id = hdev->id;
1135         cl->conn_num = n;
1136         size = sizeof(req) + n * sizeof(*ci);
1137
1138         hci_dev_put(hdev);
1139
1140         err = copy_to_user(arg, cl, size);
1141         kfree(cl);
1142
1143         return err ? -EFAULT : 0;
1144 }
1145
1146 int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
1147 {
1148         struct hci_conn_info_req req;
1149         struct hci_conn_info ci;
1150         struct hci_conn *conn;
1151         char __user *ptr = arg + sizeof(req);
1152
1153         if (copy_from_user(&req, arg, sizeof(req)))
1154                 return -EFAULT;
1155
1156         hci_dev_lock(hdev);
1157         conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
1158         if (conn) {
1159                 bacpy(&ci.bdaddr, &conn->dst);
1160                 ci.handle = conn->handle;
1161                 ci.type  = conn->type;
1162                 ci.out   = conn->out;
1163                 ci.state = conn->state;
1164                 ci.link_mode = conn->link_mode;
1165         }
1166         hci_dev_unlock(hdev);
1167
1168         if (!conn)
1169                 return -ENOENT;
1170
1171         return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
1172 }
1173
1174 int hci_get_auth_info(struct hci_dev *hdev, void __user *arg)
1175 {
1176         struct hci_auth_info_req req;
1177         struct hci_conn *conn;
1178
1179         if (copy_from_user(&req, arg, sizeof(req)))
1180                 return -EFAULT;
1181
1182         hci_dev_lock(hdev);
1183         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr);
1184         if (conn)
1185                 req.type = conn->auth_type;
1186         hci_dev_unlock(hdev);
1187
1188         if (!conn)
1189                 return -ENOENT;
1190
1191         return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0;
1192 }
1193
1194 struct hci_chan *hci_chan_create(struct hci_conn *conn)
1195 {
1196         struct hci_dev *hdev = conn->hdev;
1197         struct hci_chan *chan;
1198
1199         BT_DBG("%s hcon %p", hdev->name, conn);
1200
1201         chan = kzalloc(sizeof(struct hci_chan), GFP_KERNEL);
1202         if (!chan)
1203                 return NULL;
1204
1205         chan->conn = conn;
1206         skb_queue_head_init(&chan->data_q);
1207         chan->state = BT_CONNECTED;
1208
1209         list_add_rcu(&chan->list, &conn->chan_list);
1210
1211         return chan;
1212 }
1213
1214 void hci_chan_del(struct hci_chan *chan)
1215 {
1216         struct hci_conn *conn = chan->conn;
1217         struct hci_dev *hdev = conn->hdev;
1218
1219         BT_DBG("%s hcon %p chan %p", hdev->name, conn, chan);
1220
1221         list_del_rcu(&chan->list);
1222
1223         synchronize_rcu();
1224
1225         hci_conn_drop(conn);
1226
1227         skb_queue_purge(&chan->data_q);
1228         kfree(chan);
1229 }
1230
1231 void hci_chan_list_flush(struct hci_conn *conn)
1232 {
1233         struct hci_chan *chan, *n;
1234
1235         BT_DBG("hcon %p", conn);
1236
1237         list_for_each_entry_safe(chan, n, &conn->chan_list, list)
1238                 hci_chan_del(chan);
1239 }
1240
1241 static struct hci_chan *__hci_chan_lookup_handle(struct hci_conn *hcon,
1242                                                  __u16 handle)
1243 {
1244         struct hci_chan *hchan;
1245
1246         list_for_each_entry(hchan, &hcon->chan_list, list) {
1247                 if (hchan->handle == handle)
1248                         return hchan;
1249         }
1250
1251         return NULL;
1252 }
1253
1254 struct hci_chan *hci_chan_lookup_handle(struct hci_dev *hdev, __u16 handle)
1255 {
1256         struct hci_conn_hash *h = &hdev->conn_hash;
1257         struct hci_conn *hcon;
1258         struct hci_chan *hchan = NULL;
1259
1260         rcu_read_lock();
1261
1262         list_for_each_entry_rcu(hcon, &h->list, list) {
1263                 hchan = __hci_chan_lookup_handle(hcon, handle);
1264                 if (hchan)
1265                         break;
1266         }
1267
1268         rcu_read_unlock();
1269
1270         return hchan;
1271 }