net/bluetooth/hci_conn.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI connection handling. */
  26
  27 #include <linux/export.h>
  28 #include <linux/debugfs.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/l2cap.h>
  33
  34 #include "hci_request.h"
  35 #include "smp.h"
  36 #include "a2mp.h"
  37
  38 struct sco_param {
  39         u16 pkt_type;
  40         u16 max_latency;
  41         u8  retrans_effort;
  42 };
  43
  44 static const struct sco_param esco_param_cvsd[] = {
  45         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000a,   0x01 }, /* S3 */
  46         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x0007,   0x01 }, /* S2 */
  47         { EDR_ESCO_MASK | ESCO_EV3,   0x0007,   0x01 }, /* S1 */
  48         { EDR_ESCO_MASK | ESCO_HV3,   0xffff,   0x01 }, /* D1 */
  49         { EDR_ESCO_MASK | ESCO_HV1,   0xffff,   0x01 }, /* D0 */
  50 };
  51
  52 static const struct sco_param sco_param_cvsd[] = {
  53         { EDR_ESCO_MASK | ESCO_HV3,   0xffff,   0xff }, /* D1 */
  54         { EDR_ESCO_MASK | ESCO_HV1,   0xffff,   0xff }, /* D0 */
  55 };
  56
  57 static const struct sco_param esco_param_msbc[] = {
  58         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000d,   0x02 }, /* T2 */
  59         { EDR_ESCO_MASK | ESCO_EV3,   0x0008,   0x02 }, /* T1 */
  60 };
  61
  62 static void hci_le_create_connection_cancel(struct hci_conn *conn)
  63 {
  64         hci_send_cmd(conn->hdev, HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL);
  65 }
  66
  67 static void hci_acl_create_connection(struct hci_conn *conn)
  68 {
  69         struct hci_dev *hdev = conn->hdev;
  70         struct inquiry_entry *ie;
  71         struct hci_cp_create_conn cp;
  72
  73         BT_DBG("hcon %p", conn);
  74
  75         conn->state = BT_CONNECT;
  76         conn->out = true;
  77         conn->role = HCI_ROLE_MASTER;
  78
  79         conn->attempt++;
  80
  81         conn->link_policy = hdev->link_policy;
  82
  83         memset(&cp, 0, sizeof(cp));
  84         bacpy(&cp.bdaddr, &conn->dst);
  85         cp.pscan_rep_mode = 0x02;
  86
  87         ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
  88         if (ie) {
  89                 if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
  90                         cp.pscan_rep_mode = ie->data.pscan_rep_mode;
  91                         cp.pscan_mode     = ie->data.pscan_mode;
  92                         cp.clock_offset   = ie->data.clock_offset |
  93                                             cpu_to_le16(0x8000);
  94                 }
  95
  96                 memcpy(conn->dev_class, ie->data.dev_class, 3);
  97                 if (ie->data.ssp_mode > 0)
  98                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
  99         }
 100
 101         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 102         if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
 103                 cp.role_switch = 0x01;
 104         else
 105                 cp.role_switch = 0x00;
 106
 107         hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
 108 }
 109
 110 static void hci_acl_create_connection_cancel(struct hci_conn *conn)
 111 {
 112         struct hci_cp_create_conn_cancel cp;
 113
 114         BT_DBG("hcon %p", conn);
 115
 116         if (conn->hdev->hci_ver < BLUETOOTH_VER_1_2)
 117                 return;
 118
 119         bacpy(&cp.bdaddr, &conn->dst);
 120         hci_send_cmd(conn->hdev, HCI_OP_CREATE_CONN_CANCEL, sizeof(cp), &cp);
 121 }
 122
 123 static void hci_reject_sco(struct hci_conn *conn)
 124 {
 125         struct hci_cp_reject_sync_conn_req cp;
 126
 127         cp.reason = HCI_ERROR_REJ_LIMITED_RESOURCES;
 128         bacpy(&cp.bdaddr, &conn->dst);
 129
 130         hci_send_cmd(conn->hdev, HCI_OP_REJECT_SYNC_CONN_REQ, sizeof(cp), &cp);
 131 }
 132
 133 int hci_disconnect(struct hci_conn *conn, __u8 reason)
 134 {
 135         struct hci_cp_disconnect cp;
 136
 137         BT_DBG("hcon %p", conn);
 138
 139         /* When we are master of an established connection and it enters
 140          * the disconnect timeout, then go ahead and try to read the
 141          * current clock offset.  Processing of the result is done
 142          * within the event handling and hci_clock_offset_evt function.
 143          */
 144         if (conn->type == ACL_LINK && conn->role == HCI_ROLE_MASTER) {
 145                 struct hci_dev *hdev = conn->hdev;
 146                 struct hci_cp_read_clock_offset clkoff_cp;
 147
 148                 clkoff_cp.handle = cpu_to_le16(conn->handle);
 149                 hci_send_cmd(hdev, HCI_OP_READ_CLOCK_OFFSET, sizeof(clkoff_cp),
 150                              &clkoff_cp);
 151         }
 152
 153         conn->state = BT_DISCONN;
 154
 155         cp.handle = cpu_to_le16(conn->handle);
 156         cp.reason = reason;
 157         return hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp);
 158 }
 159
 160 static void hci_amp_disconn(struct hci_conn *conn)
 161 {
 162         struct hci_cp_disconn_phy_link cp;
 163
 164         BT_DBG("hcon %p", conn);
 165
 166         conn->state = BT_DISCONN;
 167
 168         cp.phy_handle = HCI_PHY_HANDLE(conn->handle);
 169         cp.reason = hci_proto_disconn_ind(conn);
 170         hci_send_cmd(conn->hdev, HCI_OP_DISCONN_PHY_LINK,
 171                      sizeof(cp), &cp);
 172 }
 173
 174 static void hci_add_sco(struct hci_conn *conn, __u16 handle)
 175 {
 176         struct hci_dev *hdev = conn->hdev;
 177         struct hci_cp_add_sco cp;
 178
 179         BT_DBG("hcon %p", conn);
 180
 181         conn->state = BT_CONNECT;
 182         conn->out = true;
 183
 184         conn->attempt++;
 185
 186         cp.handle   = cpu_to_le16(handle);
 187         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 188
 189         hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
 190 }
 191
 192 bool hci_setup_sync(struct hci_conn *conn, __u16 handle)
 193 {
 194         struct hci_dev *hdev = conn->hdev;
 195         struct hci_cp_setup_sync_conn cp;
 196         const struct sco_param *param;
 197
 198         BT_DBG("hcon %p", conn);
 199
 200         conn->state = BT_CONNECT;
 201         conn->out = true;
 202
 203         conn->attempt++;
 204
 205         cp.handle   = cpu_to_le16(handle);
 206
 207         cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
 208         cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
 209         cp.voice_setting  = cpu_to_le16(conn->setting);
 210
 211         switch (conn->setting & SCO_AIRMODE_MASK) {
 212         case SCO_AIRMODE_TRANSP:
 213                 if (conn->attempt > ARRAY_SIZE(esco_param_msbc))
 214                         return false;
 215                 param = &esco_param_msbc[conn->attempt - 1];
 216                 break;
 217         case SCO_AIRMODE_CVSD:
 218                 if (lmp_esco_capable(conn->link)) {
 219                         if (conn->attempt > ARRAY_SIZE(esco_param_cvsd))
 220                                 return false;
 221                         param = &esco_param_cvsd[conn->attempt - 1];
 222                 } else {
 223                         if (conn->attempt > ARRAY_SIZE(sco_param_cvsd))
 224                                 return false;
 225                         param = &sco_param_cvsd[conn->attempt - 1];
 226                 }
 227                 break;
 228         default:
 229                 return false;
 230         }
 231
 232         cp.retrans_effort = param->retrans_effort;
 233         cp.pkt_type = __cpu_to_le16(param->pkt_type);
 234         cp.max_latency = __cpu_to_le16(param->max_latency);
 235
 236         if (hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp) < 0)
 237                 return false;
 238
 239         return true;
 240 }
 241
 242 u8 hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max, u16 latency,
 243                       u16 to_multiplier)
 244 {
 245         struct hci_dev *hdev = conn->hdev;
 246         struct hci_conn_params *params;
 247         struct hci_cp_le_conn_update cp;
 248
 249         hci_dev_lock(hdev);
 250
 251         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
 252         if (params) {
 253                 params->conn_min_interval = min;
 254                 params->conn_max_interval = max;
 255                 params->conn_latency = latency;
 256                 params->supervision_timeout = to_multiplier;
 257         }
 258
 259         hci_dev_unlock(hdev);
 260
 261         memset(&cp, 0, sizeof(cp));
 262         cp.handle               = cpu_to_le16(conn->handle);
 263         cp.conn_interval_min    = cpu_to_le16(min);
 264         cp.conn_interval_max    = cpu_to_le16(max);
 265         cp.conn_latency         = cpu_to_le16(latency);
 266         cp.supervision_timeout  = cpu_to_le16(to_multiplier);
 267         cp.min_ce_len           = cpu_to_le16(0x0000);
 268         cp.max_ce_len           = cpu_to_le16(0x0000);
 269
 270         hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp);
 271
 272         if (params)
 273                 return 0x01;
 274
 275         return 0x00;
 276 }
 277
 278 void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __le64 rand,
 279                       __u8 ltk[16])
 280 {
 281         struct hci_dev *hdev = conn->hdev;
 282         struct hci_cp_le_start_enc cp;
 283
 284         BT_DBG("hcon %p", conn);
 285
 286         memset(&cp, 0, sizeof(cp));
 287
 288         cp.handle = cpu_to_le16(conn->handle);
 289         cp.rand = rand;
 290         cp.ediv = ediv;
 291         memcpy(cp.ltk, ltk, sizeof(cp.ltk));
 292
 293         hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp);
 294 }
 295
 296 /* Device _must_ be locked */
 297 void hci_sco_setup(struct hci_conn *conn, __u8 status)
 298 {
 299         struct hci_conn *sco = conn->link;
 300
 301         if (!sco)
 302                 return;
 303
 304         BT_DBG("hcon %p", conn);
 305
 306         if (!status) {
 307                 if (lmp_esco_capable(conn->hdev))
 308                         hci_setup_sync(sco, conn->handle);
 309                 else
 310                         hci_add_sco(sco, conn->handle);
 311         } else {
 312                 hci_proto_connect_cfm(sco, status);
 313                 hci_conn_del(sco);
 314         }
 315 }
 316
 317 static void hci_conn_timeout(struct work_struct *work)
 318 {
 319         struct hci_conn *conn = container_of(work, struct hci_conn,
 320                                              disc_work.work);
 321         int refcnt = atomic_read(&conn->refcnt);
 322
 323         BT_DBG("hcon %p state %s", conn, state_to_string(conn->state));
 324
 325         WARN_ON(refcnt < 0);
 326
 327         /* FIXME: It was observed that in pairing failed scenario, refcnt
 328          * drops below 0. Probably this is because l2cap_conn_del calls
 329          * l2cap_chan_del for each channel, and inside l2cap_chan_del conn is
 330          * dropped. After that loop hci_chan_del is called which also drops
 331          * conn. For now make sure that ACL is alive if refcnt is higher then 0,
 332          * otherwise drop it.
 333          */
 334         if (refcnt > 0)
 335                 return;
 336
 337         switch (conn->state) {
 338         case BT_CONNECT:
 339         case BT_CONNECT2:
 340                 if (conn->out) {
 341                         if (conn->type == ACL_LINK)
 342                                 hci_acl_create_connection_cancel(conn);
 343                         else if (conn->type == LE_LINK)
 344                                 hci_le_create_connection_cancel(conn);
 345                 } else if (conn->type == SCO_LINK || conn->type == ESCO_LINK) {
 346                         hci_reject_sco(conn);
 347                 }
 348                 break;
 349         case BT_CONFIG:
 350         case BT_CONNECTED:
 351                 if (conn->type == AMP_LINK) {
 352                         hci_amp_disconn(conn);
 353                 } else {
 354                         __u8 reason = hci_proto_disconn_ind(conn);
 355                         hci_disconnect(conn, reason);
 356                 }
 357                 break;
 358         default:
 359                 conn->state = BT_CLOSED;
 360                 break;
 361         }
 362 }
 363
 364 /* Enter sniff mode */
 365 static void hci_conn_idle(struct work_struct *work)
 366 {
 367         struct hci_conn *conn = container_of(work, struct hci_conn,
 368                                              idle_work.work);
 369         struct hci_dev *hdev = conn->hdev;
 370
 371         BT_DBG("hcon %p mode %d", conn, conn->mode);
 372
 373         if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn))
 374                 return;
 375
 376         if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF))
 377                 return;
 378
 379         if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
 380                 struct hci_cp_sniff_subrate cp;
 381                 cp.handle             = cpu_to_le16(conn->handle);
 382                 cp.max_latency        = cpu_to_le16(0);
 383                 cp.min_remote_timeout = cpu_to_le16(0);
 384                 cp.min_local_timeout  = cpu_to_le16(0);
 385                 hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
 386         }
 387
 388         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
 389                 struct hci_cp_sniff_mode cp;
 390                 cp.handle       = cpu_to_le16(conn->handle);
 391                 cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
 392                 cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
 393                 cp.attempt      = cpu_to_le16(4);
 394                 cp.timeout      = cpu_to_le16(1);
 395                 hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
 396         }
 397 }
 398
 399 static void hci_conn_auto_accept(struct work_struct *work)
 400 {
 401         struct hci_conn *conn = container_of(work, struct hci_conn,
 402                                              auto_accept_work.work);
 403
 404         hci_send_cmd(conn->hdev, HCI_OP_USER_CONFIRM_REPLY, sizeof(conn->dst),
 405                      &conn->dst);
 406 }
 407
 408 static void le_conn_timeout(struct work_struct *work)
 409 {
 410         struct hci_conn *conn = container_of(work, struct hci_conn,
 411                                              le_conn_timeout.work);
 412         struct hci_dev *hdev = conn->hdev;
 413
 414         BT_DBG("");
 415
 416         /* We could end up here due to having done directed advertising,
 417          * so clean up the state if necessary. This should however only
 418          * happen with broken hardware or if low duty cycle was used
 419          * (which doesn't have a timeout of its own).
 420          */
 421         if (conn->role == HCI_ROLE_SLAVE) {
 422                 u8 enable = 0x00;
 423                 hci_send_cmd(hdev, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable),
 424                              &enable);
 425                 hci_le_conn_failed(conn, HCI_ERROR_ADVERTISING_TIMEOUT);
 426                 return;
 427         }
 428
 429         hci_le_create_connection_cancel(conn);
 430 }
 431
 432 struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst,
 433                               u8 role)
 434 {
 435         struct hci_conn *conn;
 436
 437         BT_DBG("%s dst %pMR", hdev->name, dst);
 438
 439         conn = kzalloc(sizeof(*conn), GFP_KERNEL);
 440         if (!conn)
 441                 return NULL;
 442
 443         bacpy(&conn->dst, dst);
 444         bacpy(&conn->src, &hdev->bdaddr);
 445         conn->hdev  = hdev;
 446         conn->type  = type;
 447         conn->role  = role;
 448         conn->mode  = HCI_CM_ACTIVE;
 449         conn->state = BT_OPEN;
 450         conn->auth_type = HCI_AT_GENERAL_BONDING;
 451         conn->io_capability = hdev->io_capability;
 452         conn->remote_auth = 0xff;
 453         conn->key_type = 0xff;
 454         conn->rssi = HCI_RSSI_INVALID;
 455         conn->tx_power = HCI_TX_POWER_INVALID;
 456         conn->max_tx_power = HCI_TX_POWER_INVALID;
 457
 458         set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
 459         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
 460
 461         if (conn->role == HCI_ROLE_MASTER)
 462                 conn->out = true;
 463
 464         switch (type) {
 465         case ACL_LINK:
 466                 conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
 467                 break;
 468         case LE_LINK:
 469                 /* conn->src should reflect the local identity address */
 470                 hci_copy_identity_address(hdev, &conn->src, &conn->src_type);
 471                 break;
 472         case SCO_LINK:
 473                 if (lmp_esco_capable(hdev))
 474                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
 475                                         (hdev->esco_type & EDR_ESCO_MASK);
 476                 else
 477                         conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
 478                 break;
 479         case ESCO_LINK:
 480                 conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
 481                 break;
 482         }
 483
 484         skb_queue_head_init(&conn->data_q);
 485
 486         INIT_LIST_HEAD(&conn->chan_list);
 487
 488         INIT_DELAYED_WORK(&conn->disc_work, hci_conn_timeout);
 489         INIT_DELAYED_WORK(&conn->auto_accept_work, hci_conn_auto_accept);
 490         INIT_DELAYED_WORK(&conn->idle_work, hci_conn_idle);
 491         INIT_DELAYED_WORK(&conn->le_conn_timeout, le_conn_timeout);
 492
 493         atomic_set(&conn->refcnt, 0);
 494
 495         hci_dev_hold(hdev);
 496
 497         hci_conn_hash_add(hdev, conn);
 498         if (hdev->notify)
 499                 hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
 500
 501         hci_conn_init_sysfs(conn);
 502
 503         return conn;
 504 }
 505
 506 int hci_conn_del(struct hci_conn *conn)
 507 {
 508         struct hci_dev *hdev = conn->hdev;
 509
 510         BT_DBG("%s hcon %p handle %d", hdev->name, conn, conn->handle);
 511
 512         cancel_delayed_work_sync(&conn->disc_work);
 513         cancel_delayed_work_sync(&conn->auto_accept_work);
 514         cancel_delayed_work_sync(&conn->idle_work);
 515
 516         if (conn->type == ACL_LINK) {
 517                 struct hci_conn *sco = conn->link;
 518                 if (sco)
 519                         sco->link = NULL;
 520
 521                 /* Unacked frames */
 522                 hdev->acl_cnt += conn->sent;
 523         } else if (conn->type == LE_LINK) {
 524                 cancel_delayed_work(&conn->le_conn_timeout);
 525
 526                 if (hdev->le_pkts)
 527                         hdev->le_cnt += conn->sent;
 528                 else
 529                         hdev->acl_cnt += conn->sent;
 530         } else {
 531                 struct hci_conn *acl = conn->link;
 532                 if (acl) {
 533                         acl->link = NULL;
 534                         hci_conn_drop(acl);
 535                 }
 536         }
 537
 538         hci_chan_list_flush(conn);
 539
 540         if (conn->amp_mgr)
 541                 amp_mgr_put(conn->amp_mgr);
 542
 543         hci_conn_hash_del(hdev, conn);
 544         if (hdev->notify)
 545                 hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
 546
 547         skb_queue_purge(&conn->data_q);
 548
 549         hci_conn_del_sysfs(conn);
 550
 551         debugfs_remove_recursive(conn->debugfs);
 552
 553         if (test_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags))
 554                 hci_conn_params_del(conn->hdev, &conn->dst, conn->dst_type);
 555
 556         hci_dev_put(hdev);
 557
 558         hci_conn_put(conn);
 559
 560         return 0;
 561 }
 562
 563 struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src)
 564 {
 565         int use_src = bacmp(src, BDADDR_ANY);
 566         struct hci_dev *hdev = NULL, *d;
 567
 568         BT_DBG("%pMR -> %pMR", src, dst);
 569
 570         read_lock(&hci_dev_list_lock);
 571
 572         list_for_each_entry(d, &hci_dev_list, list) {
 573                 if (!test_bit(HCI_UP, &d->flags) ||
 574                     test_bit(HCI_USER_CHANNEL, &d->dev_flags) ||
 575                     d->dev_type != HCI_BREDR)
 576                         continue;
 577
 578                 /* Simple routing:
 579                  *   No source address - find interface with bdaddr != dst
 580                  *   Source address    - find interface with bdaddr == src
 581                  */
 582
 583                 if (use_src) {
 584                         if (!bacmp(&d->bdaddr, src)) {
 585                                 hdev = d; break;
 586                         }
 587                 } else {
 588                         if (bacmp(&d->bdaddr, dst)) {
 589                                 hdev = d; break;
 590                         }
 591                 }
 592         }
 593
 594         if (hdev)
 595                 hdev = hci_dev_hold(hdev);
 596
 597         read_unlock(&hci_dev_list_lock);
 598         return hdev;
 599 }
 600 EXPORT_SYMBOL(hci_get_route);
 601
 602 /* This function requires the caller holds hdev->lock */
 603 void hci_le_conn_failed(struct hci_conn *conn, u8 status)
 604 {
 605         struct hci_dev *hdev = conn->hdev;
 606         struct hci_conn_params *params;
 607
 608         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
 609                                            conn->dst_type);
 610         if (params && params->conn) {
 611                 hci_conn_drop(params->conn);
 612                 hci_conn_put(params->conn);
 613                 params->conn = NULL;
 614         }
 615
 616         conn->state = BT_CLOSED;
 617
 618         mgmt_connect_failed(hdev, &conn->dst, conn->type, conn->dst_type,
 619                             status);
 620
 621         hci_proto_connect_cfm(conn, status);
 622
 623         hci_conn_del(conn);
 624
 625         /* Since we may have temporarily stopped the background scanning in
 626          * favor of connection establishment, we should restart it.
 627          */
 628         hci_update_background_scan(hdev);
 629
 630         /* Re-enable advertising in case this was a failed connection
 631          * attempt as a peripheral.
 632          */
 633         mgmt_reenable_advertising(hdev);
 634 }
 635
 636 static void create_le_conn_complete(struct hci_dev *hdev, u8 status)
 637 {
 638         struct hci_conn *conn;
 639
 640         if (status == 0)
 641                 return;
 642
 643         BT_ERR("HCI request failed to create LE connection: status 0x%2.2x",
 644                status);
 645
 646         hci_dev_lock(hdev);
 647
 648         conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
 649         if (!conn)
 650                 goto done;
 651
 652         hci_le_conn_failed(conn, status);
 653
 654 done:
 655         hci_dev_unlock(hdev);
 656 }
 657
 658 static void hci_req_add_le_create_conn(struct hci_request *req,
 659                                        struct hci_conn *conn)
 660 {
 661         struct hci_cp_le_create_conn cp;
 662         struct hci_dev *hdev = conn->hdev;
 663         u8 own_addr_type;
 664
 665         memset(&cp, 0, sizeof(cp));
 666
 667         /* Update random address, but set require_privacy to false so
 668          * that we never connect with an non-resolvable address.
 669          */
 670         if (hci_update_random_address(req, false, &own_addr_type))
 671                 return;
 672
 673         cp.scan_interval = cpu_to_le16(hdev->le_scan_interval);
 674         cp.scan_window = cpu_to_le16(hdev->le_scan_window);
 675         bacpy(&cp.peer_addr, &conn->dst);
 676         cp.peer_addr_type = conn->dst_type;
 677         cp.own_address_type = own_addr_type;
 678         cp.conn_interval_min = cpu_to_le16(conn->le_conn_min_interval);
 679         cp.conn_interval_max = cpu_to_le16(conn->le_conn_max_interval);
 680         cp.conn_latency = cpu_to_le16(conn->le_conn_latency);
 681         cp.supervision_timeout = cpu_to_le16(conn->le_supv_timeout);
 682         cp.min_ce_len = cpu_to_le16(0x0000);
 683         cp.max_ce_len = cpu_to_le16(0x0000);
 684
 685         hci_req_add(req, HCI_OP_LE_CREATE_CONN, sizeof(cp), &cp);
 686
 687         conn->state = BT_CONNECT;
 688 }
 689
 690 static void hci_req_directed_advertising(struct hci_request *req,
 691                                          struct hci_conn *conn)
 692 {
 693         struct hci_dev *hdev = req->hdev;
 694         struct hci_cp_le_set_adv_param cp;
 695         u8 own_addr_type;
 696         u8 enable;
 697
 698         /* Clear the HCI_LE_ADV bit temporarily so that the
 699          * hci_update_random_address knows that it's safe to go ahead
 700          * and write a new random address. The flag will be set back on
 701          * as soon as the SET_ADV_ENABLE HCI command completes.
 702          */
 703         clear_bit(HCI_LE_ADV, &hdev->dev_flags);
 704
 705         /* Set require_privacy to false so that the remote device has a
 706          * chance of identifying us.
 707          */
 708         if (hci_update_random_address(req, false, &own_addr_type) < 0)
 709                 return;
 710
 711         memset(&cp, 0, sizeof(cp));
 712         cp.type = LE_ADV_DIRECT_IND;
 713         cp.own_address_type = own_addr_type;
 714         cp.direct_addr_type = conn->dst_type;
 715         bacpy(&cp.direct_addr, &conn->dst);
 716         cp.channel_map = hdev->le_adv_channel_map;
 717
 718         hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
 719
 720         enable = 0x01;
 721         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
 722
 723         conn->state = BT_CONNECT;
 724 }
 725
 726 struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,
 727                                 u8 dst_type, u8 sec_level, u16 conn_timeout,
 728                                 u8 role)
 729 {
 730         struct hci_conn_params *params;
 731         struct hci_conn *conn;
 732         struct smp_irk *irk;
 733         struct hci_request req;
 734         int err;
 735
 736         /* Some devices send ATT messages as soon as the physical link is
 737          * established. To be able to handle these ATT messages, the user-
 738          * space first establishes the connection and then starts the pairing
 739          * process.
 740          *
 741          * So if a hci_conn object already exists for the following connection
 742          * attempt, we simply update pending_sec_level and auth_type fields
 743          * and return the object found.
 744          */
 745         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, dst);
 746         if (conn) {
 747                 conn->pending_sec_level = sec_level;
 748                 goto done;
 749         }
 750
 751         /* Since the controller supports only one LE connection attempt at a
 752          * time, we return -EBUSY if there is any connection attempt running.
 753          */
 754         conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
 755         if (conn)
 756                 return ERR_PTR(-EBUSY);
 757
 758         /* When given an identity address with existing identity
 759          * resolving key, the connection needs to be established
 760          * to a resolvable random address.
 761          *
 762          * This uses the cached random resolvable address from
 763          * a previous scan. When no cached address is available,
 764          * try connecting to the identity address instead.
 765          *
 766          * Storing the resolvable random address is required here
 767          * to handle connection failures. The address will later
 768          * be resolved back into the original identity address
 769          * from the connect request.
 770          */
 771         irk = hci_find_irk_by_addr(hdev, dst, dst_type);
 772         if (irk && bacmp(&irk->rpa, BDADDR_ANY)) {
 773                 dst = &irk->rpa;
 774                 dst_type = ADDR_LE_DEV_RANDOM;
 775         }
 776
 777         conn = hci_conn_add(hdev, LE_LINK, dst, role);
 778         if (!conn)
 779                 return ERR_PTR(-ENOMEM);
 780
 781         conn->dst_type = dst_type;
 782         conn->sec_level = BT_SECURITY_LOW;
 783         conn->pending_sec_level = sec_level;
 784         conn->conn_timeout = conn_timeout;
 785
 786         hci_req_init(&req, hdev);
 787
 788         /* Disable advertising if we're active. For master role
 789          * connections most controllers will refuse to connect if
 790          * advertising is enabled, and for slave role connections we
 791          * anyway have to disable it in order to start directed
 792          * advertising.
 793          */
 794         if (test_bit(HCI_LE_ADV, &hdev->dev_flags)) {
 795                 u8 enable = 0x00;
 796                 hci_req_add(&req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable),
 797                             &enable);
 798         }
 799
 800         /* If requested to connect as slave use directed advertising */
 801         if (conn->role == HCI_ROLE_SLAVE) {
 802                 /* If we're active scanning most controllers are unable
 803                  * to initiate advertising. Simply reject the attempt.
 804                  */
 805                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags) &&
 806                     hdev->le_scan_type == LE_SCAN_ACTIVE) {
 807                         skb_queue_purge(&req.cmd_q);
 808                         hci_conn_del(conn);
 809                         return ERR_PTR(-EBUSY);
 810                 }
 811
 812                 hci_req_directed_advertising(&req, conn);
 813                 goto create_conn;
 814         }
 815
 816         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
 817         if (params) {
 818                 conn->le_conn_min_interval = params->conn_min_interval;
 819                 conn->le_conn_max_interval = params->conn_max_interval;
 820                 conn->le_conn_latency = params->conn_latency;
 821                 conn->le_supv_timeout = params->supervision_timeout;
 822         } else {
 823                 conn->le_conn_min_interval = hdev->le_conn_min_interval;
 824                 conn->le_conn_max_interval = hdev->le_conn_max_interval;
 825                 conn->le_conn_latency = hdev->le_conn_latency;
 826                 conn->le_supv_timeout = hdev->le_supv_timeout;
 827         }
 828
 829         /* If controller is scanning, we stop it since some controllers are
 830          * not able to scan and connect at the same time. Also set the
 831          * HCI_LE_SCAN_INTERRUPTED flag so that the command complete
 832          * handler for scan disabling knows to set the correct discovery
 833          * state.
 834          */
 835         if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
 836                 hci_req_add_le_scan_disable(&req);
 837                 set_bit(HCI_LE_SCAN_INTERRUPTED, &hdev->dev_flags);
 838         }
 839
 840         hci_req_add_le_create_conn(&req, conn);
 841
 842 create_conn:
 843         err = hci_req_run(&req, create_le_conn_complete);
 844         if (err) {
 845                 hci_conn_del(conn);
 846                 return ERR_PTR(err);
 847         }
 848
 849 done:
 850         hci_conn_hold(conn);
 851         return conn;
 852 }
 853
 854 struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst,
 855                                  u8 sec_level, u8 auth_type)
 856 {
 857         struct hci_conn *acl;
 858
 859         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 860                 return ERR_PTR(-EOPNOTSUPP);
 861
 862         acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
 863         if (!acl) {
 864                 acl = hci_conn_add(hdev, ACL_LINK, dst, HCI_ROLE_MASTER);
 865                 if (!acl)
 866                         return ERR_PTR(-ENOMEM);
 867         }
 868
 869         hci_conn_hold(acl);
 870
 871         if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
 872                 acl->sec_level = BT_SECURITY_LOW;
 873                 acl->pending_sec_level = sec_level;
 874                 acl->auth_type = auth_type;
 875                 hci_acl_create_connection(acl);
 876         }
 877
 878         return acl;
 879 }
 880
 881 struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type, bdaddr_t *dst,
 882                                  __u16 setting)
 883 {
 884         struct hci_conn *acl;
 885         struct hci_conn *sco;
 886
 887         acl = hci_connect_acl(hdev, dst, BT_SECURITY_LOW, HCI_AT_NO_BONDING);
 888         if (IS_ERR(acl))
 889                 return acl;
 890
 891         sco = hci_conn_hash_lookup_ba(hdev, type, dst);
 892         if (!sco) {
 893                 sco = hci_conn_add(hdev, type, dst, HCI_ROLE_MASTER);
 894                 if (!sco) {
 895                         hci_conn_drop(acl);
 896                         return ERR_PTR(-ENOMEM);
 897                 }
 898         }
 899
 900         acl->link = sco;
 901         sco->link = acl;
 902
 903         hci_conn_hold(sco);
 904
 905         sco->setting = setting;
 906
 907         if (acl->state == BT_CONNECTED &&
 908             (sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
 909                 set_bit(HCI_CONN_POWER_SAVE, &acl->flags);
 910                 hci_conn_enter_active_mode(acl, BT_POWER_FORCE_ACTIVE_ON);
 911
 912                 if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->flags)) {
 913                         /* defer SCO setup until mode change completed */
 914                         set_bit(HCI_CONN_SCO_SETUP_PEND, &acl->flags);
 915                         return sco;
 916                 }
 917
 918                 hci_sco_setup(acl, 0x00);
 919         }
 920
 921         return sco;
 922 }
 923
 924 /* Check link security requirement */
 925 int hci_conn_check_link_mode(struct hci_conn *conn)
 926 {
 927         BT_DBG("hcon %p", conn);
 928
 929         /* In Secure Connections Only mode, it is required that Secure
 930          * Connections is used and the link is encrypted with AES-CCM
 931          * using a P-256 authenticated combination key.
 932          */
 933         if (test_bit(HCI_SC_ONLY, &conn->hdev->flags)) {
 934                 if (!hci_conn_sc_enabled(conn) ||
 935                     !test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
 936                     conn->key_type != HCI_LK_AUTH_COMBINATION_P256)
 937                         return 0;
 938         }
 939
 940         if (hci_conn_ssp_enabled(conn) &&
 941             !test_bit(HCI_CONN_ENCRYPT, &conn->flags))
 942                 return 0;
 943
 944         return 1;
 945 }
 946
 947 /* Authenticate remote device */
 948 static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 949 {
 950         BT_DBG("hcon %p", conn);
 951
 952         if (conn->pending_sec_level > sec_level)
 953                 sec_level = conn->pending_sec_level;
 954
 955         if (sec_level > conn->sec_level)
 956                 conn->pending_sec_level = sec_level;
 957         else if (test_bit(HCI_CONN_AUTH, &conn->flags))
 958                 return 1;
 959
 960         /* Make sure we preserve an existing MITM requirement*/
 961         auth_type |= (conn->auth_type & 0x01);
 962
 963         conn->auth_type = auth_type;
 964
 965         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
 966                 struct hci_cp_auth_requested cp;
 967
 968                 cp.handle = cpu_to_le16(conn->handle);
 969                 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
 970                              sizeof(cp), &cp);
 971
 972                 /* If we're already encrypted set the REAUTH_PEND flag,
 973                  * otherwise set the ENCRYPT_PEND.
 974                  */
 975                 if (test_bit(HCI_CONN_ENCRYPT, &conn->flags))
 976                         set_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
 977                 else
 978                         set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
 979         }
 980
 981         return 0;
 982 }
 983
 984 /* Encrypt the the link */
 985 static void hci_conn_encrypt(struct hci_conn *conn)
 986 {
 987         BT_DBG("hcon %p", conn);
 988
 989         if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
 990                 struct hci_cp_set_conn_encrypt cp;
 991                 cp.handle  = cpu_to_le16(conn->handle);
 992                 cp.encrypt = 0x01;
 993                 hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
 994                              &cp);
 995         }
 996 }
 997
 998 /* Enable security */
 999 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type,
1000                       bool initiator)
1001 {
1002         BT_DBG("hcon %p", conn);
1003
1004         if (conn->type == LE_LINK)
1005                 return smp_conn_security(conn, sec_level);
1006
1007         /* For sdp we don't need the link key. */
1008         if (sec_level == BT_SECURITY_SDP)
1009                 return 1;
1010
1011         /* For non 2.1 devices and low security level we don't need the link
1012            key. */
1013         if (sec_level == BT_SECURITY_LOW && !hci_conn_ssp_enabled(conn))
1014                 return 1;
1015
1016         /* For other security levels we need the link key. */
1017         if (!test_bit(HCI_CONN_AUTH, &conn->flags))
1018                 goto auth;
1019
1020         /* An authenticated FIPS approved combination key has sufficient
1021          * security for security level 4. */
1022         if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256 &&
1023             sec_level == BT_SECURITY_FIPS)
1024                 goto encrypt;
1025
1026         /* An authenticated combination key has sufficient security for
1027            security level 3. */
1028         if ((conn->key_type == HCI_LK_AUTH_COMBINATION_P192 ||
1029              conn->key_type == HCI_LK_AUTH_COMBINATION_P256) &&
1030             sec_level == BT_SECURITY_HIGH)
1031                 goto encrypt;
1032
1033         /* An unauthenticated combination key has sufficient security for
1034            security level 1 and 2. */
1035         if ((conn->key_type == HCI_LK_UNAUTH_COMBINATION_P192 ||
1036              conn->key_type == HCI_LK_UNAUTH_COMBINATION_P256) &&
1037             (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW))
1038                 goto encrypt;
1039
1040         /* A combination key has always sufficient security for the security
1041            levels 1 or 2. High security level requires the combination key
1042            is generated using maximum PIN code length (16).
1043            For pre 2.1 units. */
1044         if (conn->key_type == HCI_LK_COMBINATION &&
1045             (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW ||
1046              conn->pin_length == 16))
1047                 goto encrypt;
1048
1049 auth:
1050         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags))
1051                 return 0;
1052
1053         if (initiator)
1054                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
1055
1056         if (!hci_conn_auth(conn, sec_level, auth_type))
1057                 return 0;
1058
1059 encrypt:
1060         if (test_bit(HCI_CONN_ENCRYPT, &conn->flags))
1061                 return 1;
1062
1063         hci_conn_encrypt(conn);
1064         return 0;
1065 }
1066 EXPORT_SYMBOL(hci_conn_security);
1067
1068 /* Check secure link requirement */
1069 int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level)
1070 {
1071         BT_DBG("hcon %p", conn);
1072
1073         /* Accept if non-secure or higher security level is required */
1074         if (sec_level != BT_SECURITY_HIGH && sec_level != BT_SECURITY_FIPS)
1075                 return 1;
1076
1077         /* Accept if secure or higher security level is already present */
1078         if (conn->sec_level == BT_SECURITY_HIGH ||
1079             conn->sec_level == BT_SECURITY_FIPS)
1080                 return 1;
1081
1082         /* Reject not secure link */
1083         return 0;
1084 }
1085 EXPORT_SYMBOL(hci_conn_check_secure);
1086
1087 /* Change link key */
1088 int hci_conn_change_link_key(struct hci_conn *conn)
1089 {
1090         BT_DBG("hcon %p", conn);
1091
1092         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
1093                 struct hci_cp_change_conn_link_key cp;
1094                 cp.handle = cpu_to_le16(conn->handle);
1095                 hci_send_cmd(conn->hdev, HCI_OP_CHANGE_CONN_LINK_KEY,
1096                              sizeof(cp), &cp);
1097         }
1098
1099         return 0;
1100 }
1101
1102 /* Switch role */
1103 int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
1104 {
1105         BT_DBG("hcon %p", conn);
1106
1107         if (role == conn->role)
1108                 return 1;
1109
1110         if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->flags)) {
1111                 struct hci_cp_switch_role cp;
1112                 bacpy(&cp.bdaddr, &conn->dst);
1113                 cp.role = role;
1114                 hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
1115         }
1116
1117         return 0;
1118 }
1119 EXPORT_SYMBOL(hci_conn_switch_role);
1120
1121 /* Enter active mode */
1122 void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
1123 {
1124         struct hci_dev *hdev = conn->hdev;
1125
1126         BT_DBG("hcon %p mode %d", conn, conn->mode);
1127
1128         if (conn->mode != HCI_CM_SNIFF)
1129                 goto timer;
1130
1131         if (!test_bit(HCI_CONN_POWER_SAVE, &conn->flags) && !force_active)
1132                 goto timer;
1133
1134         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
1135                 struct hci_cp_exit_sniff_mode cp;
1136                 cp.handle = cpu_to_le16(conn->handle);
1137                 hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
1138         }
1139
1140 timer:
1141         if (hdev->idle_timeout > 0)
1142                 queue_delayed_work(hdev->workqueue, &conn->idle_work,
1143                                    msecs_to_jiffies(hdev->idle_timeout));
1144 }
1145
1146 /* Drop all connection on the device */
1147 void hci_conn_hash_flush(struct hci_dev *hdev)
1148 {
1149         struct hci_conn_hash *h = &hdev->conn_hash;
1150         struct hci_conn *c, *n;
1151
1152         BT_DBG("hdev %s", hdev->name);
1153
1154         list_for_each_entry_safe(c, n, &h->list, list) {
1155                 c->state = BT_CLOSED;
1156
1157                 hci_proto_disconn_cfm(c, HCI_ERROR_LOCAL_HOST_TERM);
1158                 hci_conn_del(c);
1159         }
1160 }
1161
1162 /* Check pending connect attempts */
1163 void hci_conn_check_pending(struct hci_dev *hdev)
1164 {
1165         struct hci_conn *conn;
1166
1167         BT_DBG("hdev %s", hdev->name);
1168
1169         hci_dev_lock(hdev);
1170
1171         conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
1172         if (conn)
1173                 hci_acl_create_connection(conn);
1174
1175         hci_dev_unlock(hdev);
1176 }
1177
1178 static u32 get_link_mode(struct hci_conn *conn)
1179 {
1180         u32 link_mode = 0;
1181
1182         if (conn->role == HCI_ROLE_MASTER)
1183                 link_mode |= HCI_LM_MASTER;
1184
1185         if (test_bit(HCI_CONN_ENCRYPT, &conn->flags))
1186                 link_mode |= HCI_LM_ENCRYPT;
1187
1188         if (test_bit(HCI_CONN_AUTH, &conn->flags))
1189                 link_mode |= HCI_LM_AUTH;
1190
1191         if (test_bit(HCI_CONN_SECURE, &conn->flags))
1192                 link_mode |= HCI_LM_SECURE;
1193
1194         if (test_bit(HCI_CONN_FIPS, &conn->flags))
1195                 link_mode |= HCI_LM_FIPS;
1196
1197         return link_mode;
1198 }
1199
1200 int hci_get_conn_list(void __user *arg)
1201 {
1202         struct hci_conn *c;
1203         struct hci_conn_list_req req, *cl;
1204         struct hci_conn_info *ci;
1205         struct hci_dev *hdev;
1206         int n = 0, size, err;
1207
1208         if (copy_from_user(&req, arg, sizeof(req)))
1209                 return -EFAULT;
1210
1211         if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
1212                 return -EINVAL;
1213
1214         size = sizeof(req) + req.conn_num * sizeof(*ci);
1215
1216         cl = kmalloc(size, GFP_KERNEL);
1217         if (!cl)
1218                 return -ENOMEM;
1219
1220         hdev = hci_dev_get(req.dev_id);
1221         if (!hdev) {
1222                 kfree(cl);
1223                 return -ENODEV;
1224         }
1225
1226         ci = cl->conn_info;
1227
1228         hci_dev_lock(hdev);
1229         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1230                 bacpy(&(ci + n)->bdaddr, &c->dst);
1231                 (ci + n)->handle = c->handle;
1232                 (ci + n)->type  = c->type;
1233                 (ci + n)->out   = c->out;
1234                 (ci + n)->state = c->state;
1235                 (ci + n)->link_mode = get_link_mode(c);
1236                 if (++n >= req.conn_num)
1237                         break;
1238         }
1239         hci_dev_unlock(hdev);
1240
1241         cl->dev_id = hdev->id;
1242         cl->conn_num = n;
1243         size = sizeof(req) + n * sizeof(*ci);
1244
1245         hci_dev_put(hdev);
1246
1247         err = copy_to_user(arg, cl, size);
1248         kfree(cl);
1249
1250         return err ? -EFAULT : 0;
1251 }
1252
1253 int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
1254 {
1255         struct hci_conn_info_req req;
1256         struct hci_conn_info ci;
1257         struct hci_conn *conn;
1258         char __user *ptr = arg + sizeof(req);
1259
1260         if (copy_from_user(&req, arg, sizeof(req)))
1261                 return -EFAULT;
1262
1263         hci_dev_lock(hdev);
1264         conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
1265         if (conn) {
1266                 bacpy(&ci.bdaddr, &conn->dst);
1267                 ci.handle = conn->handle;
1268                 ci.type  = conn->type;
1269                 ci.out   = conn->out;
1270                 ci.state = conn->state;
1271                 ci.link_mode = get_link_mode(conn);
1272         }
1273         hci_dev_unlock(hdev);
1274
1275         if (!conn)
1276                 return -ENOENT;
1277
1278         return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
1279 }
1280
1281 int hci_get_auth_info(struct hci_dev *hdev, void __user *arg)
1282 {
1283         struct hci_auth_info_req req;
1284         struct hci_conn *conn;
1285
1286         if (copy_from_user(&req, arg, sizeof(req)))
1287                 return -EFAULT;
1288
1289         hci_dev_lock(hdev);
1290         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr);
1291         if (conn)
1292                 req.type = conn->auth_type;
1293         hci_dev_unlock(hdev);
1294
1295         if (!conn)
1296                 return -ENOENT;
1297
1298         return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0;
1299 }
1300
1301 struct hci_chan *hci_chan_create(struct hci_conn *conn)
1302 {
1303         struct hci_dev *hdev = conn->hdev;
1304         struct hci_chan *chan;
1305
1306         BT_DBG("%s hcon %p", hdev->name, conn);
1307
1308         if (test_bit(HCI_CONN_DROP, &conn->flags)) {
1309                 BT_DBG("Refusing to create new hci_chan");
1310                 return NULL;
1311         }
1312
1313         chan = kzalloc(sizeof(*chan), GFP_KERNEL);
1314         if (!chan)
1315                 return NULL;
1316
1317         chan->conn = hci_conn_get(conn);
1318         skb_queue_head_init(&chan->data_q);
1319         chan->state = BT_CONNECTED;
1320
1321         list_add_rcu(&chan->list, &conn->chan_list);
1322
1323         return chan;
1324 }
1325
1326 void hci_chan_del(struct hci_chan *chan)
1327 {
1328         struct hci_conn *conn = chan->conn;
1329         struct hci_dev *hdev = conn->hdev;
1330
1331         BT_DBG("%s hcon %p chan %p", hdev->name, conn, chan);
1332
1333         list_del_rcu(&chan->list);
1334
1335         synchronize_rcu();
1336
1337         /* Prevent new hci_chan's to be created for this hci_conn */
1338         set_bit(HCI_CONN_DROP, &conn->flags);
1339
1340         hci_conn_put(conn);
1341
1342         skb_queue_purge(&chan->data_q);
1343         kfree(chan);
1344 }
1345
1346 void hci_chan_list_flush(struct hci_conn *conn)
1347 {
1348         struct hci_chan *chan, *n;
1349
1350         BT_DBG("hcon %p", conn);
1351
1352         list_for_each_entry_safe(chan, n, &conn->chan_list, list)
1353                 hci_chan_del(chan);
1354 }
1355
1356 static struct hci_chan *__hci_chan_lookup_handle(struct hci_conn *hcon,
1357                                                  __u16 handle)
1358 {
1359         struct hci_chan *hchan;
1360
1361         list_for_each_entry(hchan, &hcon->chan_list, list) {
1362                 if (hchan->handle == handle)
1363                         return hchan;
1364         }
1365
1366         return NULL;
1367 }
1368
1369 struct hci_chan *hci_chan_lookup_handle(struct hci_dev *hdev, __u16 handle)
1370 {
1371         struct hci_conn_hash *h = &hdev->conn_hash;
1372         struct hci_conn *hcon;
1373         struct hci_chan *hchan = NULL;
1374
1375         rcu_read_lock();
1376
1377         list_for_each_entry_rcu(hcon, &h->list, list) {
1378                 hchan = __hci_chan_lookup_handle(hcon, handle);
1379                 if (hchan)
1380                         break;
1381         }
1382
1383         rcu_read_unlock();
1384
1385         return hchan;
1386 }