net/bluetooth/hci_conn.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI connection handling. */
  26
  27 #include <linux/export.h>
  28
  29 #include <net/bluetooth/bluetooth.h>
  30 #include <net/bluetooth/hci_core.h>
  31
  32 #include "smp.h"
  33 #include "a2mp.h"
  34
  35 struct sco_param {
  36         u16 pkt_type;
  37         u16 max_latency;
  38 };
  39
  40 static const struct sco_param sco_param_cvsd[] = {
  41         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000a }, /* S3 */
  42         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x0007 }, /* S2 */
  43         { EDR_ESCO_MASK | ESCO_EV3,   0x0007 }, /* S1 */
  44         { EDR_ESCO_MASK | ESCO_HV3,   0xffff }, /* D1 */
  45         { EDR_ESCO_MASK | ESCO_HV1,   0xffff }, /* D0 */
  46 };
  47
  48 static const struct sco_param sco_param_wideband[] = {
  49         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000d }, /* T2 */
  50         { EDR_ESCO_MASK | ESCO_EV3,   0x0008 }, /* T1 */
  51 };
  52
  53 static void hci_le_create_connection_cancel(struct hci_conn *conn)
  54 {
  55         hci_send_cmd(conn->hdev, HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL);
  56 }
  57
  58 static void hci_acl_create_connection(struct hci_conn *conn)
  59 {
  60         struct hci_dev *hdev = conn->hdev;
  61         struct inquiry_entry *ie;
  62         struct hci_cp_create_conn cp;
  63
  64         BT_DBG("hcon %p", conn);
  65
  66         conn->state = BT_CONNECT;
  67         conn->out = true;
  68
  69         conn->link_mode = HCI_LM_MASTER;
  70
  71         conn->attempt++;
  72
  73         conn->link_policy = hdev->link_policy;
  74
  75         memset(&cp, 0, sizeof(cp));
  76         bacpy(&cp.bdaddr, &conn->dst);
  77         cp.pscan_rep_mode = 0x02;
  78
  79         ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
  80         if (ie) {
  81                 if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
  82                         cp.pscan_rep_mode = ie->data.pscan_rep_mode;
  83                         cp.pscan_mode     = ie->data.pscan_mode;
  84                         cp.clock_offset   = ie->data.clock_offset |
  85                                             __constant_cpu_to_le16(0x8000);
  86                 }
  87
  88                 memcpy(conn->dev_class, ie->data.dev_class, 3);
  89                 if (ie->data.ssp_mode > 0)
  90                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
  91         }
  92
  93         cp.pkt_type = cpu_to_le16(conn->pkt_type);
  94         if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
  95                 cp.role_switch = 0x01;
  96         else
  97                 cp.role_switch = 0x00;
  98
  99         hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
 100 }
 101
 102 static void hci_acl_create_connection_cancel(struct hci_conn *conn)
 103 {
 104         struct hci_cp_create_conn_cancel cp;
 105
 106         BT_DBG("hcon %p", conn);
 107
 108         if (conn->hdev->hci_ver < BLUETOOTH_VER_1_2)
 109                 return;
 110
 111         bacpy(&cp.bdaddr, &conn->dst);
 112         hci_send_cmd(conn->hdev, HCI_OP_CREATE_CONN_CANCEL, sizeof(cp), &cp);
 113 }
 114
 115 static void hci_reject_sco(struct hci_conn *conn)
 116 {
 117         struct hci_cp_reject_sync_conn_req cp;
 118
 119         cp.reason = HCI_ERROR_REMOTE_USER_TERM;
 120         bacpy(&cp.bdaddr, &conn->dst);
 121
 122         hci_send_cmd(conn->hdev, HCI_OP_REJECT_SYNC_CONN_REQ, sizeof(cp), &cp);
 123 }
 124
 125 void hci_disconnect(struct hci_conn *conn, __u8 reason)
 126 {
 127         struct hci_cp_disconnect cp;
 128
 129         BT_DBG("hcon %p", conn);
 130
 131         conn->state = BT_DISCONN;
 132
 133         cp.handle = cpu_to_le16(conn->handle);
 134         cp.reason = reason;
 135         hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp);
 136 }
 137
 138 static void hci_amp_disconn(struct hci_conn *conn, __u8 reason)
 139 {
 140         struct hci_cp_disconn_phy_link cp;
 141
 142         BT_DBG("hcon %p", conn);
 143
 144         conn->state = BT_DISCONN;
 145
 146         cp.phy_handle = HCI_PHY_HANDLE(conn->handle);
 147         cp.reason = reason;
 148         hci_send_cmd(conn->hdev, HCI_OP_DISCONN_PHY_LINK,
 149                      sizeof(cp), &cp);
 150 }
 151
 152 static void hci_add_sco(struct hci_conn *conn, __u16 handle)
 153 {
 154         struct hci_dev *hdev = conn->hdev;
 155         struct hci_cp_add_sco cp;
 156
 157         BT_DBG("hcon %p", conn);
 158
 159         conn->state = BT_CONNECT;
 160         conn->out = true;
 161
 162         conn->attempt++;
 163
 164         cp.handle   = cpu_to_le16(handle);
 165         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 166
 167         hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
 168 }
 169
 170 bool hci_setup_sync(struct hci_conn *conn, __u16 handle)
 171 {
 172         struct hci_dev *hdev = conn->hdev;
 173         struct hci_cp_setup_sync_conn cp;
 174         const struct sco_param *param;
 175
 176         BT_DBG("hcon %p", conn);
 177
 178         conn->state = BT_CONNECT;
 179         conn->out = true;
 180
 181         conn->attempt++;
 182
 183         cp.handle   = cpu_to_le16(handle);
 184
 185         cp.tx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
 186         cp.rx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
 187         cp.voice_setting  = cpu_to_le16(conn->setting);
 188
 189         switch (conn->setting & SCO_AIRMODE_MASK) {
 190         case SCO_AIRMODE_TRANSP:
 191                 if (conn->attempt > ARRAY_SIZE(sco_param_wideband))
 192                         return false;
 193                 cp.retrans_effort = 0x02;
 194                 param = &sco_param_wideband[conn->attempt - 1];
 195                 break;
 196         case SCO_AIRMODE_CVSD:
 197                 if (conn->attempt > ARRAY_SIZE(sco_param_cvsd))
 198                         return false;
 199                 cp.retrans_effort = 0x01;
 200                 param = &sco_param_cvsd[conn->attempt - 1];
 201                 break;
 202         default:
 203                 return false;
 204         }
 205
 206         cp.pkt_type = __cpu_to_le16(param->pkt_type);
 207         cp.max_latency = __cpu_to_le16(param->max_latency);
 208
 209         if (hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp) < 0)
 210                 return false;
 211
 212         return true;
 213 }
 214
 215 void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max,
 216                         u16 latency, u16 to_multiplier)
 217 {
 218         struct hci_cp_le_conn_update cp;
 219         struct hci_dev *hdev = conn->hdev;
 220
 221         memset(&cp, 0, sizeof(cp));
 222
 223         cp.handle               = cpu_to_le16(conn->handle);
 224         cp.conn_interval_min    = cpu_to_le16(min);
 225         cp.conn_interval_max    = cpu_to_le16(max);
 226         cp.conn_latency         = cpu_to_le16(latency);
 227         cp.supervision_timeout  = cpu_to_le16(to_multiplier);
 228         cp.min_ce_len           = __constant_cpu_to_le16(0x0000);
 229         cp.max_ce_len           = __constant_cpu_to_le16(0x0000);
 230
 231         hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp);
 232 }
 233
 234 void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __u8 rand[8],
 235                       __u8 ltk[16])
 236 {
 237         struct hci_dev *hdev = conn->hdev;
 238         struct hci_cp_le_start_enc cp;
 239
 240         BT_DBG("hcon %p", conn);
 241
 242         memset(&cp, 0, sizeof(cp));
 243
 244         cp.handle = cpu_to_le16(conn->handle);
 245         memcpy(cp.ltk, ltk, sizeof(cp.ltk));
 246         cp.ediv = ediv;
 247         memcpy(cp.rand, rand, sizeof(cp.rand));
 248
 249         hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp);
 250 }
 251
 252 /* Device _must_ be locked */
 253 void hci_sco_setup(struct hci_conn *conn, __u8 status)
 254 {
 255         struct hci_conn *sco = conn->link;
 256
 257         if (!sco)
 258                 return;
 259
 260         BT_DBG("hcon %p", conn);
 261
 262         if (!status) {
 263                 if (lmp_esco_capable(conn->hdev))
 264                         hci_setup_sync(sco, conn->handle);
 265                 else
 266                         hci_add_sco(sco, conn->handle);
 267         } else {
 268                 hci_proto_connect_cfm(sco, status);
 269                 hci_conn_del(sco);
 270         }
 271 }
 272
 273 static void hci_conn_disconnect(struct hci_conn *conn)
 274 {
 275         __u8 reason = hci_proto_disconn_ind(conn);
 276
 277         switch (conn->type) {
 278         case AMP_LINK:
 279                 hci_amp_disconn(conn, reason);
 280                 break;
 281         default:
 282                 hci_disconnect(conn, reason);
 283                 break;
 284         }
 285 }
 286
 287 static void hci_conn_timeout(struct work_struct *work)
 288 {
 289         struct hci_conn *conn = container_of(work, struct hci_conn,
 290                                              disc_work.work);
 291
 292         BT_DBG("hcon %p state %s", conn, state_to_string(conn->state));
 293
 294         if (atomic_read(&conn->refcnt))
 295                 return;
 296
 297         switch (conn->state) {
 298         case BT_CONNECT:
 299         case BT_CONNECT2:
 300                 if (conn->out) {
 301                         if (conn->type == ACL_LINK)
 302                                 hci_acl_create_connection_cancel(conn);
 303                         else if (conn->type == LE_LINK)
 304                                 hci_le_create_connection_cancel(conn);
 305                 } else if (conn->type == SCO_LINK || conn->type == ESCO_LINK) {
 306                         hci_reject_sco(conn);
 307                 }
 308                 break;
 309         case BT_CONFIG:
 310         case BT_CONNECTED:
 311                 hci_conn_disconnect(conn);
 312                 break;
 313         default:
 314                 conn->state = BT_CLOSED;
 315                 break;
 316         }
 317 }
 318
 319 /* Enter sniff mode */
 320 static void hci_conn_idle(struct work_struct *work)
 321 {
 322         struct hci_conn *conn = container_of(work, struct hci_conn,
 323                                              idle_work.work);
 324         struct hci_dev *hdev = conn->hdev;
 325
 326         BT_DBG("hcon %p mode %d", conn, conn->mode);
 327
 328         if (test_bit(HCI_RAW, &hdev->flags))
 329                 return;
 330
 331         if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn))
 332                 return;
 333
 334         if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF))
 335                 return;
 336
 337         if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
 338                 struct hci_cp_sniff_subrate cp;
 339                 cp.handle             = cpu_to_le16(conn->handle);
 340                 cp.max_latency        = __constant_cpu_to_le16(0);
 341                 cp.min_remote_timeout = __constant_cpu_to_le16(0);
 342                 cp.min_local_timeout  = __constant_cpu_to_le16(0);
 343                 hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
 344         }
 345
 346         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
 347                 struct hci_cp_sniff_mode cp;
 348                 cp.handle       = cpu_to_le16(conn->handle);
 349                 cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
 350                 cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
 351                 cp.attempt      = __constant_cpu_to_le16(4);
 352                 cp.timeout      = __constant_cpu_to_le16(1);
 353                 hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
 354         }
 355 }
 356
 357 static void hci_conn_auto_accept(struct work_struct *work)
 358 {
 359         struct hci_conn *conn = container_of(work, struct hci_conn,
 360                                              auto_accept_work.work);
 361
 362         hci_send_cmd(conn->hdev, HCI_OP_USER_CONFIRM_REPLY, sizeof(conn->dst),
 363                      &conn->dst);
 364 }
 365
 366 struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
 367 {
 368         struct hci_conn *conn;
 369
 370         BT_DBG("%s dst %pMR", hdev->name, dst);
 371
 372         conn = kzalloc(sizeof(struct hci_conn), GFP_KERNEL);
 373         if (!conn)
 374                 return NULL;
 375
 376         bacpy(&conn->dst, dst);
 377         bacpy(&conn->src, &hdev->bdaddr);
 378         conn->hdev  = hdev;
 379         conn->type  = type;
 380         conn->mode  = HCI_CM_ACTIVE;
 381         conn->state = BT_OPEN;
 382         conn->auth_type = HCI_AT_GENERAL_BONDING;
 383         conn->io_capability = hdev->io_capability;
 384         conn->remote_auth = 0xff;
 385         conn->key_type = 0xff;
 386
 387         set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
 388         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
 389
 390         switch (type) {
 391         case ACL_LINK:
 392                 conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
 393                 break;
 394         case SCO_LINK:
 395                 if (lmp_esco_capable(hdev))
 396                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
 397                                         (hdev->esco_type & EDR_ESCO_MASK);
 398                 else
 399                         conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
 400                 break;
 401         case ESCO_LINK:
 402                 conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
 403                 break;
 404         }
 405
 406         skb_queue_head_init(&conn->data_q);
 407
 408         INIT_LIST_HEAD(&conn->chan_list);
 409
 410         INIT_DELAYED_WORK(&conn->disc_work, hci_conn_timeout);
 411         INIT_DELAYED_WORK(&conn->auto_accept_work, hci_conn_auto_accept);
 412         INIT_DELAYED_WORK(&conn->idle_work, hci_conn_idle);
 413
 414         atomic_set(&conn->refcnt, 0);
 415
 416         hci_dev_hold(hdev);
 417
 418         hci_conn_hash_add(hdev, conn);
 419         if (hdev->notify)
 420                 hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
 421
 422         hci_conn_init_sysfs(conn);
 423
 424         return conn;
 425 }
 426
 427 int hci_conn_del(struct hci_conn *conn)
 428 {
 429         struct hci_dev *hdev = conn->hdev;
 430
 431         BT_DBG("%s hcon %p handle %d", hdev->name, conn, conn->handle);
 432
 433         cancel_delayed_work_sync(&conn->disc_work);
 434         cancel_delayed_work_sync(&conn->auto_accept_work);
 435         cancel_delayed_work_sync(&conn->idle_work);
 436
 437         if (conn->type == ACL_LINK) {
 438                 struct hci_conn *sco = conn->link;
 439                 if (sco)
 440                         sco->link = NULL;
 441
 442                 /* Unacked frames */
 443                 hdev->acl_cnt += conn->sent;
 444         } else if (conn->type == LE_LINK) {
 445                 if (hdev->le_pkts)
 446                         hdev->le_cnt += conn->sent;
 447                 else
 448                         hdev->acl_cnt += conn->sent;
 449         } else {
 450                 struct hci_conn *acl = conn->link;
 451                 if (acl) {
 452                         acl->link = NULL;
 453                         hci_conn_drop(acl);
 454                 }
 455         }
 456
 457         hci_chan_list_flush(conn);
 458
 459         if (conn->amp_mgr)
 460                 amp_mgr_put(conn->amp_mgr);
 461
 462         hci_conn_hash_del(hdev, conn);
 463         if (hdev->notify)
 464                 hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
 465
 466         skb_queue_purge(&conn->data_q);
 467
 468         hci_conn_del_sysfs(conn);
 469
 470         hci_dev_put(hdev);
 471
 472         hci_conn_put(conn);
 473
 474         return 0;
 475 }
 476
 477 struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src)
 478 {
 479         int use_src = bacmp(src, BDADDR_ANY);
 480         struct hci_dev *hdev = NULL, *d;
 481
 482         BT_DBG("%pMR -> %pMR", src, dst);
 483
 484         read_lock(&hci_dev_list_lock);
 485
 486         list_for_each_entry(d, &hci_dev_list, list) {
 487                 if (!test_bit(HCI_UP, &d->flags) ||
 488                     test_bit(HCI_RAW, &d->flags) ||
 489                     test_bit(HCI_USER_CHANNEL, &d->dev_flags) ||
 490                     d->dev_type != HCI_BREDR)
 491                         continue;
 492
 493                 /* Simple routing:
 494                  *   No source address - find interface with bdaddr != dst
 495                  *   Source address    - find interface with bdaddr == src
 496                  */
 497
 498                 if (use_src) {
 499                         if (!bacmp(&d->bdaddr, src)) {
 500                                 hdev = d; break;
 501                         }
 502                 } else {
 503                         if (bacmp(&d->bdaddr, dst)) {
 504                                 hdev = d; break;
 505                         }
 506                 }
 507         }
 508
 509         if (hdev)
 510                 hdev = hci_dev_hold(hdev);
 511
 512         read_unlock(&hci_dev_list_lock);
 513         return hdev;
 514 }
 515 EXPORT_SYMBOL(hci_get_route);
 516
 517 /* This function requires the caller holds hdev->lock */
 518 void hci_le_conn_failed(struct hci_conn *conn, u8 status)
 519 {
 520         struct hci_dev *hdev = conn->hdev;
 521
 522         conn->state = BT_CLOSED;
 523
 524         mgmt_connect_failed(hdev, &conn->dst, conn->type, conn->dst_type,
 525                             status);
 526
 527         hci_proto_connect_cfm(conn, status);
 528
 529         hci_conn_del(conn);
 530 }
 531
 532 static void create_le_conn_complete(struct hci_dev *hdev, u8 status)
 533 {
 534         struct hci_conn *conn;
 535
 536         if (status == 0)
 537                 return;
 538
 539         BT_ERR("HCI request failed to create LE connection: status 0x%2.2x",
 540                status);
 541
 542         hci_dev_lock(hdev);
 543
 544         conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
 545         if (!conn)
 546                 goto done;
 547
 548         hci_le_conn_failed(conn, status);
 549
 550 done:
 551         hci_dev_unlock(hdev);
 552 }
 553
 554 static int hci_create_le_conn(struct hci_conn *conn)
 555 {
 556         struct hci_dev *hdev = conn->hdev;
 557         struct hci_cp_le_create_conn cp;
 558         struct hci_request req;
 559         u8 own_addr_type;
 560         int err;
 561
 562         hci_req_init(&req, hdev);
 563
 564         memset(&cp, 0, sizeof(cp));
 565
 566         /* Update random address, but set require_privacy to false so
 567          * that we never connect with an unresolvable address.
 568          */
 569         err = hci_update_random_address(&req, false, &own_addr_type);
 570         if (err < 0)
 571                 return err;
 572
 573         conn->src_type = own_addr_type;
 574
 575         cp.scan_interval = cpu_to_le16(hdev->le_scan_interval);
 576         cp.scan_window = cpu_to_le16(hdev->le_scan_window);
 577         bacpy(&cp.peer_addr, &conn->dst);
 578         cp.peer_addr_type = conn->dst_type;
 579         cp.own_address_type = own_addr_type;
 580         cp.conn_interval_min = cpu_to_le16(conn->le_conn_min_interval);
 581         cp.conn_interval_max = cpu_to_le16(conn->le_conn_max_interval);
 582         cp.supervision_timeout = __constant_cpu_to_le16(0x002a);
 583         cp.min_ce_len = __constant_cpu_to_le16(0x0000);
 584         cp.max_ce_len = __constant_cpu_to_le16(0x0000);
 585
 586         hci_req_add(&req, HCI_OP_LE_CREATE_CONN, sizeof(cp), &cp);
 587
 588         err = hci_req_run(&req, create_le_conn_complete);
 589         if (err) {
 590                 hci_conn_del(conn);
 591                 return err;
 592         }
 593
 594         return 0;
 595 }
 596
 597 static void hci_req_add_le_create_conn(struct hci_request *req,
 598                                        struct hci_conn *conn)
 599 {
 600         struct hci_cp_le_create_conn cp;
 601         struct hci_dev *hdev = conn->hdev;
 602         u8 own_addr_type;
 603
 604         memset(&cp, 0, sizeof(cp));
 605
 606         /* Update random address, but set require_privacy to false so
 607          * that we never connect with an unresolvable address.
 608          */
 609         if (hci_update_random_address(req, false, &own_addr_type))
 610                 return;
 611
 612         /* Save the address type used for this connnection attempt so we able
 613          * to retrieve this information if we need it.
 614          */
 615         conn->src_type = own_addr_type;
 616
 617         cp.scan_interval = cpu_to_le16(hdev->le_scan_interval);
 618         cp.scan_window = cpu_to_le16(hdev->le_scan_window);
 619         bacpy(&cp.peer_addr, &conn->dst);
 620         cp.peer_addr_type = conn->dst_type;
 621         cp.own_address_type = own_addr_type;
 622         cp.conn_interval_min = cpu_to_le16(conn->le_conn_min_interval);
 623         cp.conn_interval_max = cpu_to_le16(conn->le_conn_max_interval);
 624         cp.supervision_timeout = __constant_cpu_to_le16(0x002a);
 625         cp.min_ce_len = __constant_cpu_to_le16(0x0000);
 626         cp.max_ce_len = __constant_cpu_to_le16(0x0000);
 627
 628         hci_req_add(req, HCI_OP_LE_CREATE_CONN, sizeof(cp), &cp);
 629 }
 630
 631 static void stop_scan_complete(struct hci_dev *hdev, u8 status)
 632 {
 633         struct hci_request req;
 634         struct hci_conn *conn;
 635         int err;
 636
 637         conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
 638         if (!conn)
 639                 return;
 640
 641         if (status) {
 642                 BT_DBG("HCI request failed to stop scanning: status 0x%2.2x",
 643                        status);
 644
 645                 hci_dev_lock(hdev);
 646                 hci_le_conn_failed(conn, status);
 647                 hci_dev_unlock(hdev);
 648                 return;
 649         }
 650
 651         /* Since we may have prematurely stopped discovery procedure, we should
 652          * update discovery state.
 653          */
 654         cancel_delayed_work(&hdev->le_scan_disable);
 655         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
 656
 657         hci_req_init(&req, hdev);
 658
 659         hci_req_add_le_create_conn(&req, conn);
 660
 661         err = hci_req_run(&req, create_le_conn_complete);
 662         if (err) {
 663                 hci_dev_lock(hdev);
 664                 hci_le_conn_failed(conn, HCI_ERROR_MEMORY_EXCEEDED);
 665                 hci_dev_unlock(hdev);
 666                 return;
 667         }
 668 }
 669
 670 static struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,
 671                                     u8 dst_type, u8 sec_level, u8 auth_type)
 672 {
 673         struct hci_conn_params *params;
 674         struct hci_conn *conn;
 675         struct smp_irk *irk;
 676         struct hci_request req;
 677         int err;
 678
 679         if (test_bit(HCI_ADVERTISING, &hdev->flags))
 680                 return ERR_PTR(-ENOTSUPP);
 681
 682         /* Some devices send ATT messages as soon as the physical link is
 683          * established. To be able to handle these ATT messages, the user-
 684          * space first establishes the connection and then starts the pairing
 685          * process.
 686          *
 687          * So if a hci_conn object already exists for the following connection
 688          * attempt, we simply update pending_sec_level and auth_type fields
 689          * and return the object found.
 690          */
 691         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, dst);
 692         if (conn) {
 693                 conn->pending_sec_level = sec_level;
 694                 conn->auth_type = auth_type;
 695                 goto done;
 696         }
 697
 698         /* Since the controller supports only one LE connection attempt at a
 699          * time, we return -EBUSY if there is any connection attempt running.
 700          */
 701         conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
 702         if (conn)
 703                 return ERR_PTR(-EBUSY);
 704
 705         /* Convert from L2CAP channel address type to HCI address type */
 706         if (dst_type == BDADDR_LE_PUBLIC)
 707                 dst_type = ADDR_LE_DEV_PUBLIC;
 708         else
 709                 dst_type = ADDR_LE_DEV_RANDOM;
 710
 711         /* When given an identity address with existing identity
 712          * resolving key, the connection needs to be established
 713          * to a resolvable random address.
 714          *
 715          * This uses the cached random resolvable address from
 716          * a previous scan. When no cached address is available,
 717          * try connecting to the identity address instead.
 718          *
 719          * Storing the resolvable random address is required here
 720          * to handle connection failures. The address will later
 721          * be resolved back into the original identity address
 722          * from the connect request.
 723          */
 724         irk = hci_find_irk_by_addr(hdev, dst, dst_type);
 725         if (irk && bacmp(&irk->rpa, BDADDR_ANY)) {
 726                 dst = &irk->rpa;
 727                 dst_type = ADDR_LE_DEV_RANDOM;
 728         }
 729
 730         conn = hci_conn_add(hdev, LE_LINK, dst);
 731         if (!conn)
 732                 return ERR_PTR(-ENOMEM);
 733
 734         conn->dst_type = dst_type;
 735
 736         conn->state = BT_CONNECT;
 737         conn->out = true;
 738         conn->link_mode |= HCI_LM_MASTER;
 739         conn->sec_level = BT_SECURITY_LOW;
 740         conn->pending_sec_level = sec_level;
 741         conn->auth_type = auth_type;
 742
 743         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
 744         if (params) {
 745                 conn->le_conn_min_interval = params->conn_min_interval;
 746                 conn->le_conn_max_interval = params->conn_max_interval;
 747         } else {
 748                 conn->le_conn_min_interval = hdev->le_conn_min_interval;
 749                 conn->le_conn_max_interval = hdev->le_conn_max_interval;
 750         }
 751
 752         hci_req_init(&req, hdev);
 753
 754         /* If controller is scanning, we stop it since some controllers are
 755          * not able to scan and connect at the same time.
 756          */
 757         if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
 758                 hci_req_add_le_scan_disable(&req);
 759                 err = hci_req_run(&req, stop_scan_complete);
 760         } else {
 761                 hci_req_add_le_create_conn(&req, conn);
 762                 err = hci_req_run(&req, create_le_conn_complete);
 763         }
 764
 765         if (err) {
 766                 hci_conn_del(conn);
 767                 return ERR_PTR(err);
 768         }
 769
 770 done:
 771         hci_conn_hold(conn);
 772         return conn;
 773 }
 774
 775 static struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst,
 776                                                 u8 sec_level, u8 auth_type)
 777 {
 778         struct hci_conn *acl;
 779
 780         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 781                 return ERR_PTR(-ENOTSUPP);
 782
 783         acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
 784         if (!acl) {
 785                 acl = hci_conn_add(hdev, ACL_LINK, dst);
 786                 if (!acl)
 787                         return ERR_PTR(-ENOMEM);
 788         }
 789
 790         hci_conn_hold(acl);
 791
 792         if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
 793                 acl->sec_level = BT_SECURITY_LOW;
 794                 acl->pending_sec_level = sec_level;
 795                 acl->auth_type = auth_type;
 796                 hci_acl_create_connection(acl);
 797         }
 798
 799         return acl;
 800 }
 801
 802 struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type, bdaddr_t *dst,
 803                                  __u16 setting)
 804 {
 805         struct hci_conn *acl;
 806         struct hci_conn *sco;
 807
 808         acl = hci_connect_acl(hdev, dst, BT_SECURITY_LOW, HCI_AT_NO_BONDING);
 809         if (IS_ERR(acl))
 810                 return acl;
 811
 812         sco = hci_conn_hash_lookup_ba(hdev, type, dst);
 813         if (!sco) {
 814                 sco = hci_conn_add(hdev, type, dst);
 815                 if (!sco) {
 816                         hci_conn_drop(acl);
 817                         return ERR_PTR(-ENOMEM);
 818                 }
 819         }
 820
 821         acl->link = sco;
 822         sco->link = acl;
 823
 824         hci_conn_hold(sco);
 825
 826         sco->setting = setting;
 827
 828         if (acl->state == BT_CONNECTED &&
 829             (sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
 830                 set_bit(HCI_CONN_POWER_SAVE, &acl->flags);
 831                 hci_conn_enter_active_mode(acl, BT_POWER_FORCE_ACTIVE_ON);
 832
 833                 if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->flags)) {
 834                         /* defer SCO setup until mode change completed */
 835                         set_bit(HCI_CONN_SCO_SETUP_PEND, &acl->flags);
 836                         return sco;
 837                 }
 838
 839                 hci_sco_setup(acl, 0x00);
 840         }
 841
 842         return sco;
 843 }
 844
 845 /* Create SCO, ACL or LE connection. */
 846 struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst,
 847                              __u8 dst_type, __u8 sec_level, __u8 auth_type)
 848 {
 849         BT_DBG("%s dst %pMR type 0x%x", hdev->name, dst, type);
 850
 851         switch (type) {
 852         case LE_LINK:
 853                 return hci_connect_le(hdev, dst, dst_type, sec_level, auth_type);
 854         case ACL_LINK:
 855                 return hci_connect_acl(hdev, dst, sec_level, auth_type);
 856         }
 857
 858         return ERR_PTR(-EINVAL);
 859 }
 860
 861 /* Check link security requirement */
 862 int hci_conn_check_link_mode(struct hci_conn *conn)
 863 {
 864         BT_DBG("hcon %p", conn);
 865
 866         if (hci_conn_ssp_enabled(conn) && !(conn->link_mode & HCI_LM_ENCRYPT))
 867                 return 0;
 868
 869         return 1;
 870 }
 871
 872 /* Authenticate remote device */
 873 static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 874 {
 875         BT_DBG("hcon %p", conn);
 876
 877         if (conn->pending_sec_level > sec_level)
 878                 sec_level = conn->pending_sec_level;
 879
 880         if (sec_level > conn->sec_level)
 881                 conn->pending_sec_level = sec_level;
 882         else if (conn->link_mode & HCI_LM_AUTH)
 883                 return 1;
 884
 885         /* Make sure we preserve an existing MITM requirement*/
 886         auth_type |= (conn->auth_type & 0x01);
 887
 888         conn->auth_type = auth_type;
 889
 890         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
 891                 struct hci_cp_auth_requested cp;
 892
 893                 /* encrypt must be pending if auth is also pending */
 894                 set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
 895
 896                 cp.handle = cpu_to_le16(conn->handle);
 897                 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
 898                              sizeof(cp), &cp);
 899                 if (conn->key_type != 0xff)
 900                         set_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
 901         }
 902
 903         return 0;
 904 }
 905
 906 /* Encrypt the the link */
 907 static void hci_conn_encrypt(struct hci_conn *conn)
 908 {
 909         BT_DBG("hcon %p", conn);
 910
 911         if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
 912                 struct hci_cp_set_conn_encrypt cp;
 913                 cp.handle  = cpu_to_le16(conn->handle);
 914                 cp.encrypt = 0x01;
 915                 hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
 916                              &cp);
 917         }
 918 }
 919
 920 /* Enable security */
 921 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 922 {
 923         BT_DBG("hcon %p", conn);
 924
 925         if (conn->type == LE_LINK)
 926                 return smp_conn_security(conn, sec_level);
 927
 928         /* For sdp we don't need the link key. */
 929         if (sec_level == BT_SECURITY_SDP)
 930                 return 1;
 931
 932         /* For non 2.1 devices and low security level we don't need the link
 933            key. */
 934         if (sec_level == BT_SECURITY_LOW && !hci_conn_ssp_enabled(conn))
 935                 return 1;
 936
 937         /* For other security levels we need the link key. */
 938         if (!(conn->link_mode & HCI_LM_AUTH))
 939                 goto auth;
 940
 941         /* An authenticated FIPS approved combination key has sufficient
 942          * security for security level 4. */
 943         if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256 &&
 944             sec_level == BT_SECURITY_FIPS)
 945                 goto encrypt;
 946
 947         /* An authenticated combination key has sufficient security for
 948            security level 3. */
 949         if ((conn->key_type == HCI_LK_AUTH_COMBINATION_P192 ||
 950              conn->key_type == HCI_LK_AUTH_COMBINATION_P256) &&
 951             sec_level == BT_SECURITY_HIGH)
 952                 goto encrypt;
 953
 954         /* An unauthenticated combination key has sufficient security for
 955            security level 1 and 2. */
 956         if ((conn->key_type == HCI_LK_UNAUTH_COMBINATION_P192 ||
 957              conn->key_type == HCI_LK_UNAUTH_COMBINATION_P256) &&
 958             (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW))
 959                 goto encrypt;
 960
 961         /* A combination key has always sufficient security for the security
 962            levels 1 or 2. High security level requires the combination key
 963            is generated using maximum PIN code length (16).
 964            For pre 2.1 units. */
 965         if (conn->key_type == HCI_LK_COMBINATION &&
 966             (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW ||
 967              conn->pin_length == 16))
 968                 goto encrypt;
 969
 970 auth:
 971         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags))
 972                 return 0;
 973
 974         if (!hci_conn_auth(conn, sec_level, auth_type))
 975                 return 0;
 976
 977 encrypt:
 978         if (conn->link_mode & HCI_LM_ENCRYPT)
 979                 return 1;
 980
 981         hci_conn_encrypt(conn);
 982         return 0;
 983 }
 984 EXPORT_SYMBOL(hci_conn_security);
 985
 986 /* Check secure link requirement */
 987 int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level)
 988 {
 989         BT_DBG("hcon %p", conn);
 990
 991         /* Accept if non-secure or higher security level is required */
 992         if (sec_level != BT_SECURITY_HIGH && sec_level != BT_SECURITY_FIPS)
 993                 return 1;
 994
 995         /* Accept if secure or higher security level is already present */
 996         if (conn->sec_level == BT_SECURITY_HIGH ||
 997             conn->sec_level == BT_SECURITY_FIPS)
 998                 return 1;
 999
1000         /* Reject not secure link */
1001         return 0;
1002 }
1003 EXPORT_SYMBOL(hci_conn_check_secure);
1004
1005 /* Change link key */
1006 int hci_conn_change_link_key(struct hci_conn *conn)
1007 {
1008         BT_DBG("hcon %p", conn);
1009
1010         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
1011                 struct hci_cp_change_conn_link_key cp;
1012                 cp.handle = cpu_to_le16(conn->handle);
1013                 hci_send_cmd(conn->hdev, HCI_OP_CHANGE_CONN_LINK_KEY,
1014                              sizeof(cp), &cp);
1015         }
1016
1017         return 0;
1018 }
1019
1020 /* Switch role */
1021 int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
1022 {
1023         BT_DBG("hcon %p", conn);
1024
1025         if (!role && conn->link_mode & HCI_LM_MASTER)
1026                 return 1;
1027
1028         if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->flags)) {
1029                 struct hci_cp_switch_role cp;
1030                 bacpy(&cp.bdaddr, &conn->dst);
1031                 cp.role = role;
1032                 hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
1033         }
1034
1035         return 0;
1036 }
1037 EXPORT_SYMBOL(hci_conn_switch_role);
1038
1039 /* Enter active mode */
1040 void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
1041 {
1042         struct hci_dev *hdev = conn->hdev;
1043
1044         BT_DBG("hcon %p mode %d", conn, conn->mode);
1045
1046         if (test_bit(HCI_RAW, &hdev->flags))
1047                 return;
1048
1049         if (conn->mode != HCI_CM_SNIFF)
1050                 goto timer;
1051
1052         if (!test_bit(HCI_CONN_POWER_SAVE, &conn->flags) && !force_active)
1053                 goto timer;
1054
1055         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
1056                 struct hci_cp_exit_sniff_mode cp;
1057                 cp.handle = cpu_to_le16(conn->handle);
1058                 hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
1059         }
1060
1061 timer:
1062         if (hdev->idle_timeout > 0)
1063                 queue_delayed_work(hdev->workqueue, &conn->idle_work,
1064                                    msecs_to_jiffies(hdev->idle_timeout));
1065 }
1066
1067 /* Drop all connection on the device */
1068 void hci_conn_hash_flush(struct hci_dev *hdev)
1069 {
1070         struct hci_conn_hash *h = &hdev->conn_hash;
1071         struct hci_conn *c, *n;
1072
1073         BT_DBG("hdev %s", hdev->name);
1074
1075         list_for_each_entry_safe(c, n, &h->list, list) {
1076                 c->state = BT_CLOSED;
1077
1078                 hci_proto_disconn_cfm(c, HCI_ERROR_LOCAL_HOST_TERM);
1079                 hci_conn_del(c);
1080         }
1081 }
1082
1083 /* Check pending connect attempts */
1084 void hci_conn_check_pending(struct hci_dev *hdev)
1085 {
1086         struct hci_conn *conn;
1087
1088         BT_DBG("hdev %s", hdev->name);
1089
1090         hci_dev_lock(hdev);
1091
1092         conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
1093         if (conn)
1094                 hci_acl_create_connection(conn);
1095
1096         hci_dev_unlock(hdev);
1097 }
1098
1099 int hci_get_conn_list(void __user *arg)
1100 {
1101         struct hci_conn *c;
1102         struct hci_conn_list_req req, *cl;
1103         struct hci_conn_info *ci;
1104         struct hci_dev *hdev;
1105         int n = 0, size, err;
1106
1107         if (copy_from_user(&req, arg, sizeof(req)))
1108                 return -EFAULT;
1109
1110         if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
1111                 return -EINVAL;
1112
1113         size = sizeof(req) + req.conn_num * sizeof(*ci);
1114
1115         cl = kmalloc(size, GFP_KERNEL);
1116         if (!cl)
1117                 return -ENOMEM;
1118
1119         hdev = hci_dev_get(req.dev_id);
1120         if (!hdev) {
1121                 kfree(cl);
1122                 return -ENODEV;
1123         }
1124
1125         ci = cl->conn_info;
1126
1127         hci_dev_lock(hdev);
1128         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1129                 bacpy(&(ci + n)->bdaddr, &c->dst);
1130                 (ci + n)->handle = c->handle;
1131                 (ci + n)->type  = c->type;
1132                 (ci + n)->out   = c->out;
1133                 (ci + n)->state = c->state;
1134                 (ci + n)->link_mode = c->link_mode;
1135                 if (++n >= req.conn_num)
1136                         break;
1137         }
1138         hci_dev_unlock(hdev);
1139
1140         cl->dev_id = hdev->id;
1141         cl->conn_num = n;
1142         size = sizeof(req) + n * sizeof(*ci);
1143
1144         hci_dev_put(hdev);
1145
1146         err = copy_to_user(arg, cl, size);
1147         kfree(cl);
1148
1149         return err ? -EFAULT : 0;
1150 }
1151
1152 int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
1153 {
1154         struct hci_conn_info_req req;
1155         struct hci_conn_info ci;
1156         struct hci_conn *conn;
1157         char __user *ptr = arg + sizeof(req);
1158
1159         if (copy_from_user(&req, arg, sizeof(req)))
1160                 return -EFAULT;
1161
1162         hci_dev_lock(hdev);
1163         conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
1164         if (conn) {
1165                 bacpy(&ci.bdaddr, &conn->dst);
1166                 ci.handle = conn->handle;
1167                 ci.type  = conn->type;
1168                 ci.out   = conn->out;
1169                 ci.state = conn->state;
1170                 ci.link_mode = conn->link_mode;
1171         }
1172         hci_dev_unlock(hdev);
1173
1174         if (!conn)
1175                 return -ENOENT;
1176
1177         return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
1178 }
1179
1180 int hci_get_auth_info(struct hci_dev *hdev, void __user *arg)
1181 {
1182         struct hci_auth_info_req req;
1183         struct hci_conn *conn;
1184
1185         if (copy_from_user(&req, arg, sizeof(req)))
1186                 return -EFAULT;
1187
1188         hci_dev_lock(hdev);
1189         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr);
1190         if (conn)
1191                 req.type = conn->auth_type;
1192         hci_dev_unlock(hdev);
1193
1194         if (!conn)
1195                 return -ENOENT;
1196
1197         return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0;
1198 }
1199
1200 struct hci_chan *hci_chan_create(struct hci_conn *conn)
1201 {
1202         struct hci_dev *hdev = conn->hdev;
1203         struct hci_chan *chan;
1204
1205         BT_DBG("%s hcon %p", hdev->name, conn);
1206
1207         chan = kzalloc(sizeof(struct hci_chan), GFP_KERNEL);
1208         if (!chan)
1209                 return NULL;
1210
1211         chan->conn = conn;
1212         skb_queue_head_init(&chan->data_q);
1213         chan->state = BT_CONNECTED;
1214
1215         list_add_rcu(&chan->list, &conn->chan_list);
1216
1217         return chan;
1218 }
1219
1220 void hci_chan_del(struct hci_chan *chan)
1221 {
1222         struct hci_conn *conn = chan->conn;
1223         struct hci_dev *hdev = conn->hdev;
1224
1225         BT_DBG("%s hcon %p chan %p", hdev->name, conn, chan);
1226
1227         list_del_rcu(&chan->list);
1228
1229         synchronize_rcu();
1230
1231         hci_conn_drop(conn);
1232
1233         skb_queue_purge(&chan->data_q);
1234         kfree(chan);
1235 }
1236
1237 void hci_chan_list_flush(struct hci_conn *conn)
1238 {
1239         struct hci_chan *chan, *n;
1240
1241         BT_DBG("hcon %p", conn);
1242
1243         list_for_each_entry_safe(chan, n, &conn->chan_list, list)
1244                 hci_chan_del(chan);
1245 }
1246
1247 static struct hci_chan *__hci_chan_lookup_handle(struct hci_conn *hcon,
1248                                                  __u16 handle)
1249 {
1250         struct hci_chan *hchan;
1251
1252         list_for_each_entry(hchan, &hcon->chan_list, list) {
1253                 if (hchan->handle == handle)
1254                         return hchan;
1255         }
1256
1257         return NULL;
1258 }
1259
1260 struct hci_chan *hci_chan_lookup_handle(struct hci_dev *hdev, __u16 handle)
1261 {
1262         struct hci_conn_hash *h = &hdev->conn_hash;
1263         struct hci_conn *hcon;
1264         struct hci_chan *hchan = NULL;
1265
1266         rcu_read_lock();
1267
1268         list_for_each_entry_rcu(hcon, &h->list, list) {
1269                 hchan = __hci_chan_lookup_handle(hcon, handle);
1270                 if (hchan)
1271                         break;
1272         }
1273
1274         rcu_read_unlock();
1275
1276         return hchan;
1277 }