kernel/net/bluetooth/hci_conn.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI connection handling. */
  26
  27 #include <linux/export.h>
  28 #include <linux/debugfs.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/l2cap.h>
  33
  34 #include "hci_request.h"
  35 #include "smp.h"
  36 #include "a2mp.h"
  37
  38 struct sco_param {
  39         u16 pkt_type;
  40         u16 max_latency;
  41         u8  retrans_effort;
  42 };
  43
  44 static const struct sco_param esco_param_cvsd[] = {
  45         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000a,   0x01 }, /* S3 */
  46         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x0007,   0x01 }, /* S2 */
  47         { EDR_ESCO_MASK | ESCO_EV3,   0x0007,   0x01 }, /* S1 */
  48         { EDR_ESCO_MASK | ESCO_HV3,   0xffff,   0x01 }, /* D1 */
  49         { EDR_ESCO_MASK | ESCO_HV1,   0xffff,   0x01 }, /* D0 */
  50 };
  51
  52 static const struct sco_param sco_param_cvsd[] = {
  53         { EDR_ESCO_MASK | ESCO_HV3,   0xffff,   0xff }, /* D1 */
  54         { EDR_ESCO_MASK | ESCO_HV1,   0xffff,   0xff }, /* D0 */
  55 };
  56
  57 static const struct sco_param esco_param_msbc[] = {
  58         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000d,   0x02 }, /* T2 */
  59         { EDR_ESCO_MASK | ESCO_EV3,   0x0008,   0x02 }, /* T1 */
  60 };
  61
  62 static void hci_le_create_connection_cancel(struct hci_conn *conn)
  63 {
  64         hci_send_cmd(conn->hdev, HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL);
  65 }
  66
  67 static void hci_acl_create_connection(struct hci_conn *conn)
  68 {
  69         struct hci_dev *hdev = conn->hdev;
  70         struct inquiry_entry *ie;
  71         struct hci_cp_create_conn cp;
  72
  73         BT_DBG("hcon %p", conn);
  74
  75         conn->state = BT_CONNECT;
  76         conn->out = true;
  77         conn->role = HCI_ROLE_MASTER;
  78
  79         conn->attempt++;
  80
  81         conn->link_policy = hdev->link_policy;
  82
  83         memset(&cp, 0, sizeof(cp));
  84         bacpy(&cp.bdaddr, &conn->dst);
  85         cp.pscan_rep_mode = 0x02;
  86
  87         ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
  88         if (ie) {
  89                 if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
  90                         cp.pscan_rep_mode = ie->data.pscan_rep_mode;
  91                         cp.pscan_mode     = ie->data.pscan_mode;
  92                         cp.clock_offset   = ie->data.clock_offset |
  93                                             cpu_to_le16(0x8000);
  94                 }
  95
  96                 memcpy(conn->dev_class, ie->data.dev_class, 3);
  97                 if (ie->data.ssp_mode > 0)
  98                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
  99         }
 100
 101         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 102         if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
 103                 cp.role_switch = 0x01;
 104         else
 105                 cp.role_switch = 0x00;
 106
 107         hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
 108 }
 109
 110 static void hci_acl_create_connection_cancel(struct hci_conn *conn)
 111 {
 112         struct hci_cp_create_conn_cancel cp;
 113
 114         BT_DBG("hcon %p", conn);
 115
 116         if (conn->hdev->hci_ver < BLUETOOTH_VER_1_2)
 117                 return;
 118
 119         bacpy(&cp.bdaddr, &conn->dst);
 120         hci_send_cmd(conn->hdev, HCI_OP_CREATE_CONN_CANCEL, sizeof(cp), &cp);
 121 }
 122
 123 static void hci_reject_sco(struct hci_conn *conn)
 124 {
 125         struct hci_cp_reject_sync_conn_req cp;
 126
 127         cp.reason = HCI_ERROR_REJ_LIMITED_RESOURCES;
 128         bacpy(&cp.bdaddr, &conn->dst);
 129
 130         hci_send_cmd(conn->hdev, HCI_OP_REJECT_SYNC_CONN_REQ, sizeof(cp), &cp);
 131 }
 132
 133 int hci_disconnect(struct hci_conn *conn, __u8 reason)
 134 {
 135         struct hci_cp_disconnect cp;
 136
 137         BT_DBG("hcon %p", conn);
 138
 139         /* When we are master of an established connection and it enters
 140          * the disconnect timeout, then go ahead and try to read the
 141          * current clock offset.  Processing of the result is done
 142          * within the event handling and hci_clock_offset_evt function.
 143          */
 144         if (conn->type == ACL_LINK && conn->role == HCI_ROLE_MASTER) {
 145                 struct hci_dev *hdev = conn->hdev;
 146                 struct hci_cp_read_clock_offset clkoff_cp;
 147
 148                 clkoff_cp.handle = cpu_to_le16(conn->handle);
 149                 hci_send_cmd(hdev, HCI_OP_READ_CLOCK_OFFSET, sizeof(clkoff_cp),
 150                              &clkoff_cp);
 151         }
 152
 153         conn->state = BT_DISCONN;
 154
 155         cp.handle = cpu_to_le16(conn->handle);
 156         cp.reason = reason;
 157         return hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp);
 158 }
 159
 160 static void hci_amp_disconn(struct hci_conn *conn)
 161 {
 162         struct hci_cp_disconn_phy_link cp;
 163
 164         BT_DBG("hcon %p", conn);
 165
 166         conn->state = BT_DISCONN;
 167
 168         cp.phy_handle = HCI_PHY_HANDLE(conn->handle);
 169         cp.reason = hci_proto_disconn_ind(conn);
 170         hci_send_cmd(conn->hdev, HCI_OP_DISCONN_PHY_LINK,
 171                      sizeof(cp), &cp);
 172 }
 173
 174 static void hci_add_sco(struct hci_conn *conn, __u16 handle)
 175 {
 176         struct hci_dev *hdev = conn->hdev;
 177         struct hci_cp_add_sco cp;
 178
 179         BT_DBG("hcon %p", conn);
 180
 181         conn->state = BT_CONNECT;
 182         conn->out = true;
 183
 184         conn->attempt++;
 185
 186         cp.handle   = cpu_to_le16(handle);
 187         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 188
 189         hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
 190 }
 191
 192 bool hci_setup_sync(struct hci_conn *conn, __u16 handle)
 193 {
 194         struct hci_dev *hdev = conn->hdev;
 195         struct hci_cp_setup_sync_conn cp;
 196         const struct sco_param *param;
 197
 198         BT_DBG("hcon %p", conn);
 199
 200         conn->state = BT_CONNECT;
 201         conn->out = true;
 202
 203         conn->attempt++;
 204
 205         cp.handle   = cpu_to_le16(handle);
 206
 207         cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
 208         cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
 209         cp.voice_setting  = cpu_to_le16(conn->setting);
 210
 211         switch (conn->setting & SCO_AIRMODE_MASK) {
 212         case SCO_AIRMODE_TRANSP:
 213                 if (conn->attempt > ARRAY_SIZE(esco_param_msbc))
 214                         return false;
 215                 param = &esco_param_msbc[conn->attempt - 1];
 216                 break;
 217         case SCO_AIRMODE_CVSD:
 218                 if (lmp_esco_capable(conn->link)) {
 219                         if (conn->attempt > ARRAY_SIZE(esco_param_cvsd))
 220                                 return false;
 221                         param = &esco_param_cvsd[conn->attempt - 1];
 222                 } else {
 223                         if (conn->attempt > ARRAY_SIZE(sco_param_cvsd))
 224                                 return false;
 225                         param = &sco_param_cvsd[conn->attempt - 1];
 226                 }
 227                 break;
 228         default:
 229                 return false;
 230         }
 231
 232         cp.retrans_effort = param->retrans_effort;
 233         cp.pkt_type = __cpu_to_le16(param->pkt_type);
 234         cp.max_latency = __cpu_to_le16(param->max_latency);
 235
 236         if (hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp) < 0)
 237                 return false;
 238
 239         return true;
 240 }
 241
 242 u8 hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max, u16 latency,
 243                       u16 to_multiplier)
 244 {
 245         struct hci_dev *hdev = conn->hdev;
 246         struct hci_conn_params *params;
 247         struct hci_cp_le_conn_update cp;
 248
 249         hci_dev_lock(hdev);
 250
 251         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
 252         if (params) {
 253                 params->conn_min_interval = min;
 254                 params->conn_max_interval = max;
 255                 params->conn_latency = latency;
 256                 params->supervision_timeout = to_multiplier;
 257         }
 258
 259         hci_dev_unlock(hdev);
 260
 261         memset(&cp, 0, sizeof(cp));
 262         cp.handle               = cpu_to_le16(conn->handle);
 263         cp.conn_interval_min    = cpu_to_le16(min);
 264         cp.conn_interval_max    = cpu_to_le16(max);
 265         cp.conn_latency         = cpu_to_le16(latency);
 266         cp.supervision_timeout  = cpu_to_le16(to_multiplier);
 267         cp.min_ce_len           = cpu_to_le16(0x0000);
 268         cp.max_ce_len           = cpu_to_le16(0x0000);
 269
 270         hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp);
 271
 272         if (params)
 273                 return 0x01;
 274
 275         return 0x00;
 276 }
 277
 278 void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __le64 rand,
 279                       __u8 ltk[16])
 280 {
 281         struct hci_dev *hdev = conn->hdev;
 282         struct hci_cp_le_start_enc cp;
 283
 284         BT_DBG("hcon %p", conn);
 285
 286         memset(&cp, 0, sizeof(cp));
 287
 288         cp.handle = cpu_to_le16(conn->handle);
 289         cp.rand = rand;
 290         cp.ediv = ediv;
 291         memcpy(cp.ltk, ltk, sizeof(cp.ltk));
 292
 293         hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp);
 294 }
 295
 296 /* Device _must_ be locked */
 297 void hci_sco_setup(struct hci_conn *conn, __u8 status)
 298 {
 299         struct hci_conn *sco = conn->link;
 300
 301         if (!sco)
 302                 return;
 303
 304         BT_DBG("hcon %p", conn);
 305
 306         if (!status) {
 307                 if (lmp_esco_capable(conn->hdev))
 308                         hci_setup_sync(sco, conn->handle);
 309                 else
 310                         hci_add_sco(sco, conn->handle);
 311         } else {
 312                 hci_connect_cfm(sco, status);
 313                 hci_conn_del(sco);
 314         }
 315 }
 316
 317 static void hci_conn_timeout(struct work_struct *work)
 318 {
 319         struct hci_conn *conn = container_of(work, struct hci_conn,
 320                                              disc_work.work);
 321         int refcnt = atomic_read(&conn->refcnt);
 322
 323         BT_DBG("hcon %p state %s", conn, state_to_string(conn->state));
 324
 325         WARN_ON(refcnt < 0);
 326
 327         /* FIXME: It was observed that in pairing failed scenario, refcnt
 328          * drops below 0. Probably this is because l2cap_conn_del calls
 329          * l2cap_chan_del for each channel, and inside l2cap_chan_del conn is
 330          * dropped. After that loop hci_chan_del is called which also drops
 331          * conn. For now make sure that ACL is alive if refcnt is higher then 0,
 332          * otherwise drop it.
 333          */
 334         if (refcnt > 0)
 335                 return;
 336
 337         switch (conn->state) {
 338         case BT_CONNECT:
 339         case BT_CONNECT2:
 340                 if (conn->out) {
 341                         if (conn->type == ACL_LINK)
 342                                 hci_acl_create_connection_cancel(conn);
 343                         else if (conn->type == LE_LINK)
 344                                 hci_le_create_connection_cancel(conn);
 345                 } else if (conn->type == SCO_LINK || conn->type == ESCO_LINK) {
 346                         hci_reject_sco(conn);
 347                 }
 348                 break;
 349         case BT_CONFIG:
 350         case BT_CONNECTED:
 351                 if (conn->type == AMP_LINK) {
 352                         hci_amp_disconn(conn);
 353                 } else {
 354                         __u8 reason = hci_proto_disconn_ind(conn);
 355                         hci_disconnect(conn, reason);
 356                 }
 357                 break;
 358         default:
 359                 conn->state = BT_CLOSED;
 360                 break;
 361         }
 362 }
 363
 364 /* Enter sniff mode */
 365 static void hci_conn_idle(struct work_struct *work)
 366 {
 367         struct hci_conn *conn = container_of(work, struct hci_conn,
 368                                              idle_work.work);
 369         struct hci_dev *hdev = conn->hdev;
 370
 371         BT_DBG("hcon %p mode %d", conn, conn->mode);
 372
 373         if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn))
 374                 return;
 375
 376         if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF))
 377                 return;
 378
 379         if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
 380                 struct hci_cp_sniff_subrate cp;
 381                 cp.handle             = cpu_to_le16(conn->handle);
 382                 cp.max_latency        = cpu_to_le16(0);
 383                 cp.min_remote_timeout = cpu_to_le16(0);
 384                 cp.min_local_timeout  = cpu_to_le16(0);
 385                 hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
 386         }
 387
 388         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
 389                 struct hci_cp_sniff_mode cp;
 390                 cp.handle       = cpu_to_le16(conn->handle);
 391                 cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
 392                 cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
 393                 cp.attempt      = cpu_to_le16(4);
 394                 cp.timeout      = cpu_to_le16(1);
 395                 hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
 396         }
 397 }
 398
 399 static void hci_conn_auto_accept(struct work_struct *work)
 400 {
 401         struct hci_conn *conn = container_of(work, struct hci_conn,
 402                                              auto_accept_work.work);
 403
 404         hci_send_cmd(conn->hdev, HCI_OP_USER_CONFIRM_REPLY, sizeof(conn->dst),
 405                      &conn->dst);
 406 }
 407
 408 static void le_conn_timeout(struct work_struct *work)
 409 {
 410         struct hci_conn *conn = container_of(work, struct hci_conn,
 411                                              le_conn_timeout.work);
 412         struct hci_dev *hdev = conn->hdev;
 413
 414         BT_DBG("");
 415
 416         /* We could end up here due to having done directed advertising,
 417          * so clean up the state if necessary. This should however only
 418          * happen with broken hardware or if low duty cycle was used
 419          * (which doesn't have a timeout of its own).
 420          */
 421         if (conn->role == HCI_ROLE_SLAVE) {
 422                 u8 enable = 0x00;
 423                 hci_send_cmd(hdev, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable),
 424                              &enable);
 425                 hci_le_conn_failed(conn, HCI_ERROR_ADVERTISING_TIMEOUT);
 426                 return;
 427         }
 428
 429         hci_le_create_connection_cancel(conn);
 430 }
 431
 432 struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst,
 433                               u8 role)
 434 {
 435         struct hci_conn *conn;
 436
 437         BT_DBG("%s dst %pMR", hdev->name, dst);
 438
 439         conn = kzalloc(sizeof(*conn), GFP_KERNEL);
 440         if (!conn)
 441                 return NULL;
 442
 443         bacpy(&conn->dst, dst);
 444         bacpy(&conn->src, &hdev->bdaddr);
 445         conn->hdev  = hdev;
 446         conn->type  = type;
 447         conn->role  = role;
 448         conn->mode  = HCI_CM_ACTIVE;
 449         conn->state = BT_OPEN;
 450         conn->auth_type = HCI_AT_GENERAL_BONDING;
 451         conn->io_capability = hdev->io_capability;
 452         conn->remote_auth = 0xff;
 453         conn->key_type = 0xff;
 454         conn->rssi = HCI_RSSI_INVALID;
 455         conn->tx_power = HCI_TX_POWER_INVALID;
 456         conn->max_tx_power = HCI_TX_POWER_INVALID;
 457
 458         set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
 459         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
 460
 461         if (conn->role == HCI_ROLE_MASTER)
 462                 conn->out = true;
 463
 464         switch (type) {
 465         case ACL_LINK:
 466                 conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
 467                 break;
 468         case LE_LINK:
 469                 /* conn->src should reflect the local identity address */
 470                 hci_copy_identity_address(hdev, &conn->src, &conn->src_type);
 471                 break;
 472         case SCO_LINK:
 473                 if (lmp_esco_capable(hdev))
 474                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
 475                                         (hdev->esco_type & EDR_ESCO_MASK);
 476                 else
 477                         conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
 478                 break;
 479         case ESCO_LINK:
 480                 conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
 481                 break;
 482         }
 483
 484         skb_queue_head_init(&conn->data_q);
 485
 486         INIT_LIST_HEAD(&conn->chan_list);
 487
 488         INIT_DELAYED_WORK(&conn->disc_work, hci_conn_timeout);
 489         INIT_DELAYED_WORK(&conn->auto_accept_work, hci_conn_auto_accept);
 490         INIT_DELAYED_WORK(&conn->idle_work, hci_conn_idle);
 491         INIT_DELAYED_WORK(&conn->le_conn_timeout, le_conn_timeout);
 492
 493         atomic_set(&conn->refcnt, 0);
 494
 495         hci_dev_hold(hdev);
 496
 497         hci_conn_hash_add(hdev, conn);
 498         if (hdev->notify)
 499                 hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
 500
 501         hci_conn_init_sysfs(conn);
 502
 503         return conn;
 504 }
 505
 506 int hci_conn_del(struct hci_conn *conn)
 507 {
 508         struct hci_dev *hdev = conn->hdev;
 509
 510         BT_DBG("%s hcon %p handle %d", hdev->name, conn, conn->handle);
 511
 512         cancel_delayed_work_sync(&conn->disc_work);
 513         cancel_delayed_work_sync(&conn->auto_accept_work);
 514         cancel_delayed_work_sync(&conn->idle_work);
 515
 516         if (conn->type == ACL_LINK) {
 517                 struct hci_conn *sco = conn->link;
 518                 if (sco)
 519                         sco->link = NULL;
 520
 521                 /* Unacked frames */
 522                 hdev->acl_cnt += conn->sent;
 523         } else if (conn->type == LE_LINK) {
 524                 cancel_delayed_work(&conn->le_conn_timeout);
 525
 526                 if (hdev->le_pkts)
 527                         hdev->le_cnt += conn->sent;
 528                 else
 529                         hdev->acl_cnt += conn->sent;
 530         } else {
 531                 struct hci_conn *acl = conn->link;
 532                 if (acl) {
 533                         acl->link = NULL;
 534                         hci_conn_drop(acl);
 535                 }
 536         }
 537
 538         hci_chan_list_flush(conn);
 539
 540         if (conn->amp_mgr)
 541                 amp_mgr_put(conn->amp_mgr);
 542
 543         hci_conn_hash_del(hdev, conn);
 544         if (hdev->notify)
 545                 hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
 546
 547         skb_queue_purge(&conn->data_q);
 548
 549         hci_conn_del_sysfs(conn);
 550
 551         debugfs_remove_recursive(conn->debugfs);
 552
 553         if (test_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags))
 554                 hci_conn_params_del(conn->hdev, &conn->dst, conn->dst_type);
 555
 556         hci_dev_put(hdev);
 557
 558         hci_conn_put(conn);
 559
 560         return 0;
 561 }
 562
 563 struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src)
 564 {
 565         int use_src = bacmp(src, BDADDR_ANY);
 566         struct hci_dev *hdev = NULL, *d;
 567
 568         BT_DBG("%pMR -> %pMR", src, dst);
 569
 570         read_lock(&hci_dev_list_lock);
 571
 572         list_for_each_entry(d, &hci_dev_list, list) {
 573                 if (!test_bit(HCI_UP, &d->flags) ||
 574                     hci_dev_test_flag(d, HCI_USER_CHANNEL) ||
 575                     d->dev_type != HCI_BREDR)
 576                         continue;
 577
 578                 /* Simple routing:
 579                  *   No source address - find interface with bdaddr != dst
 580                  *   Source address    - find interface with bdaddr == src
 581                  */
 582
 583                 if (use_src) {
 584                         if (!bacmp(&d->bdaddr, src)) {
 585                                 hdev = d; break;
 586                         }
 587                 } else {
 588                         if (bacmp(&d->bdaddr, dst)) {
 589                                 hdev = d; break;
 590                         }
 591                 }
 592         }
 593
 594         if (hdev)
 595                 hdev = hci_dev_hold(hdev);
 596
 597         read_unlock(&hci_dev_list_lock);
 598         return hdev;
 599 }
 600 EXPORT_SYMBOL(hci_get_route);
 601
 602 /* This function requires the caller holds hdev->lock */
 603 void hci_le_conn_failed(struct hci_conn *conn, u8 status)
 604 {
 605         struct hci_dev *hdev = conn->hdev;
 606         struct hci_conn_params *params;
 607
 608         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
 609                                            conn->dst_type);
 610         if (params && params->conn) {
 611                 hci_conn_drop(params->conn);
 612                 hci_conn_put(params->conn);
 613                 params->conn = NULL;
 614         }
 615
 616         conn->state = BT_CLOSED;
 617
 618         mgmt_connect_failed(hdev, &conn->dst, conn->type, conn->dst_type,
 619                             status);
 620
 621         hci_connect_cfm(conn, status);
 622
 623         hci_conn_del(conn);
 624
 625         /* Since we may have temporarily stopped the background scanning in
 626          * favor of connection establishment, we should restart it.
 627          */
 628         hci_update_background_scan(hdev);
 629
 630         /* Re-enable advertising in case this was a failed connection
 631          * attempt as a peripheral.
 632          */
 633         mgmt_reenable_advertising(hdev);
 634 }
 635
 636 static void create_le_conn_complete(struct hci_dev *hdev, u8 status, u16 opcode)
 637 {
 638         struct hci_conn *conn;
 639
 640         if (status == 0)
 641                 return;
 642
 643         BT_ERR("HCI request failed to create LE connection: status 0x%2.2x",
 644                status);
 645
 646         hci_dev_lock(hdev);
 647
 648         conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
 649         if (!conn)
 650                 goto done;
 651
 652         hci_le_conn_failed(conn, status);
 653
 654 done:
 655         hci_dev_unlock(hdev);
 656 }
 657
 658 static void hci_req_add_le_create_conn(struct hci_request *req,
 659                                        struct hci_conn *conn)
 660 {
 661         struct hci_cp_le_create_conn cp;
 662         struct hci_dev *hdev = conn->hdev;
 663         u8 own_addr_type;
 664
 665         memset(&cp, 0, sizeof(cp));
 666
 667         /* Update random address, but set require_privacy to false so
 668          * that we never connect with an non-resolvable address.
 669          */
 670         if (hci_update_random_address(req, false, &own_addr_type))
 671                 return;
 672
 673         cp.scan_interval = cpu_to_le16(hdev->le_scan_interval);
 674         cp.scan_window = cpu_to_le16(hdev->le_scan_window);
 675         bacpy(&cp.peer_addr, &conn->dst);
 676         cp.peer_addr_type = conn->dst_type;
 677         cp.own_address_type = own_addr_type;
 678         cp.conn_interval_min = cpu_to_le16(conn->le_conn_min_interval);
 679         cp.conn_interval_max = cpu_to_le16(conn->le_conn_max_interval);
 680         cp.conn_latency = cpu_to_le16(conn->le_conn_latency);
 681         cp.supervision_timeout = cpu_to_le16(conn->le_supv_timeout);
 682         cp.min_ce_len = cpu_to_le16(0x0000);
 683         cp.max_ce_len = cpu_to_le16(0x0000);
 684
 685         hci_req_add(req, HCI_OP_LE_CREATE_CONN, sizeof(cp), &cp);
 686
 687         conn->state = BT_CONNECT;
 688 }
 689
 690 static void hci_req_directed_advertising(struct hci_request *req,
 691                                          struct hci_conn *conn)
 692 {
 693         struct hci_dev *hdev = req->hdev;
 694         struct hci_cp_le_set_adv_param cp;
 695         u8 own_addr_type;
 696         u8 enable;
 697
 698         /* Clear the HCI_LE_ADV bit temporarily so that the
 699          * hci_update_random_address knows that it's safe to go ahead
 700          * and write a new random address. The flag will be set back on
 701          * as soon as the SET_ADV_ENABLE HCI command completes.
 702          */
 703         hci_dev_clear_flag(hdev, HCI_LE_ADV);
 704
 705         /* Set require_privacy to false so that the remote device has a
 706          * chance of identifying us.
 707          */
 708         if (hci_update_random_address(req, false, &own_addr_type) < 0)
 709                 return;
 710
 711         memset(&cp, 0, sizeof(cp));
 712         cp.type = LE_ADV_DIRECT_IND;
 713         cp.own_address_type = own_addr_type;
 714         cp.direct_addr_type = conn->dst_type;
 715         bacpy(&cp.direct_addr, &conn->dst);
 716         cp.channel_map = hdev->le_adv_channel_map;
 717
 718         hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
 719
 720         enable = 0x01;
 721         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
 722
 723         conn->state = BT_CONNECT;
 724 }
 725
 726 struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,
 727                                 u8 dst_type, u8 sec_level, u16 conn_timeout,
 728                                 u8 role)
 729 {
 730         struct hci_conn_params *params;
 731         struct hci_conn *conn;
 732         struct smp_irk *irk;
 733         struct hci_request req;
 734         int err;
 735
 736         /* Let's make sure that le is enabled.*/
 737         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
 738                 if (lmp_le_capable(hdev))
 739                         return ERR_PTR(-ECONNREFUSED);
 740
 741                 return ERR_PTR(-EOPNOTSUPP);
 742         }
 743
 744         /* Some devices send ATT messages as soon as the physical link is
 745          * established. To be able to handle these ATT messages, the user-
 746          * space first establishes the connection and then starts the pairing
 747          * process.
 748          *
 749          * So if a hci_conn object already exists for the following connection
 750          * attempt, we simply update pending_sec_level and auth_type fields
 751          * and return the object found.
 752          */
 753         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, dst);
 754         if (conn) {
 755                 conn->pending_sec_level = sec_level;
 756                 goto done;
 757         }
 758
 759         /* Since the controller supports only one LE connection attempt at a
 760          * time, we return -EBUSY if there is any connection attempt running.
 761          */
 762         conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
 763         if (conn)
 764                 return ERR_PTR(-EBUSY);
 765
 766         /* When given an identity address with existing identity
 767          * resolving key, the connection needs to be established
 768          * to a resolvable random address.
 769          *
 770          * This uses the cached random resolvable address from
 771          * a previous scan. When no cached address is available,
 772          * try connecting to the identity address instead.
 773          *
 774          * Storing the resolvable random address is required here
 775          * to handle connection failures. The address will later
 776          * be resolved back into the original identity address
 777          * from the connect request.
 778          */
 779         irk = hci_find_irk_by_addr(hdev, dst, dst_type);
 780         if (irk && bacmp(&irk->rpa, BDADDR_ANY)) {
 781                 dst = &irk->rpa;
 782                 dst_type = ADDR_LE_DEV_RANDOM;
 783         }
 784
 785         conn = hci_conn_add(hdev, LE_LINK, dst, role);
 786         if (!conn)
 787                 return ERR_PTR(-ENOMEM);
 788
 789         conn->dst_type = dst_type;
 790         conn->sec_level = BT_SECURITY_LOW;
 791         conn->pending_sec_level = sec_level;
 792         conn->conn_timeout = conn_timeout;
 793
 794         hci_req_init(&req, hdev);
 795
 796         /* Disable advertising if we're active. For master role
 797          * connections most controllers will refuse to connect if
 798          * advertising is enabled, and for slave role connections we
 799          * anyway have to disable it in order to start directed
 800          * advertising.
 801          */
 802         if (hci_dev_test_flag(hdev, HCI_LE_ADV)) {
 803                 u8 enable = 0x00;
 804                 hci_req_add(&req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable),
 805                             &enable);
 806         }
 807
 808         /* If requested to connect as slave use directed advertising */
 809         if (conn->role == HCI_ROLE_SLAVE) {
 810                 /* If we're active scanning most controllers are unable
 811                  * to initiate advertising. Simply reject the attempt.
 812                  */
 813                 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
 814                     hdev->le_scan_type == LE_SCAN_ACTIVE) {
 815                         skb_queue_purge(&req.cmd_q);
 816                         hci_conn_del(conn);
 817                         return ERR_PTR(-EBUSY);
 818                 }
 819
 820                 hci_req_directed_advertising(&req, conn);
 821                 goto create_conn;
 822         }
 823
 824         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
 825         if (params) {
 826                 conn->le_conn_min_interval = params->conn_min_interval;
 827                 conn->le_conn_max_interval = params->conn_max_interval;
 828                 conn->le_conn_latency = params->conn_latency;
 829                 conn->le_supv_timeout = params->supervision_timeout;
 830         } else {
 831                 conn->le_conn_min_interval = hdev->le_conn_min_interval;
 832                 conn->le_conn_max_interval = hdev->le_conn_max_interval;
 833                 conn->le_conn_latency = hdev->le_conn_latency;
 834                 conn->le_supv_timeout = hdev->le_supv_timeout;
 835         }
 836
 837         /* If controller is scanning, we stop it since some controllers are
 838          * not able to scan and connect at the same time. Also set the
 839          * HCI_LE_SCAN_INTERRUPTED flag so that the command complete
 840          * handler for scan disabling knows to set the correct discovery
 841          * state.
 842          */
 843         if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
 844                 hci_req_add_le_scan_disable(&req);
 845                 hci_dev_set_flag(hdev, HCI_LE_SCAN_INTERRUPTED);
 846         }
 847
 848         hci_req_add_le_create_conn(&req, conn);
 849
 850 create_conn:
 851         err = hci_req_run(&req, create_le_conn_complete);
 852         if (err) {
 853                 hci_conn_del(conn);
 854                 return ERR_PTR(err);
 855         }
 856
 857 done:
 858         hci_conn_hold(conn);
 859         return conn;
 860 }
 861
 862 struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst,
 863                                  u8 sec_level, u8 auth_type)
 864 {
 865         struct hci_conn *acl;
 866
 867         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
 868                 if (lmp_bredr_capable(hdev))
 869                         return ERR_PTR(-ECONNREFUSED);
 870
 871                 return ERR_PTR(-EOPNOTSUPP);
 872         }
 873
 874         acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
 875         if (!acl) {
 876                 acl = hci_conn_add(hdev, ACL_LINK, dst, HCI_ROLE_MASTER);
 877                 if (!acl)
 878                         return ERR_PTR(-ENOMEM);
 879         }
 880
 881         hci_conn_hold(acl);
 882
 883         if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
 884                 acl->sec_level = BT_SECURITY_LOW;
 885                 acl->pending_sec_level = sec_level;
 886                 acl->auth_type = auth_type;
 887                 hci_acl_create_connection(acl);
 888         }
 889
 890         return acl;
 891 }
 892
 893 struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type, bdaddr_t *dst,
 894                                  __u16 setting)
 895 {
 896         struct hci_conn *acl;
 897         struct hci_conn *sco;
 898
 899         acl = hci_connect_acl(hdev, dst, BT_SECURITY_LOW, HCI_AT_NO_BONDING);
 900         if (IS_ERR(acl))
 901                 return acl;
 902
 903         sco = hci_conn_hash_lookup_ba(hdev, type, dst);
 904         if (!sco) {
 905                 sco = hci_conn_add(hdev, type, dst, HCI_ROLE_MASTER);
 906                 if (!sco) {
 907                         hci_conn_drop(acl);
 908                         return ERR_PTR(-ENOMEM);
 909                 }
 910         }
 911
 912         acl->link = sco;
 913         sco->link = acl;
 914
 915         hci_conn_hold(sco);
 916
 917         sco->setting = setting;
 918
 919         if (acl->state == BT_CONNECTED &&
 920             (sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
 921                 set_bit(HCI_CONN_POWER_SAVE, &acl->flags);
 922                 hci_conn_enter_active_mode(acl, BT_POWER_FORCE_ACTIVE_ON);
 923
 924                 if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->flags)) {
 925                         /* defer SCO setup until mode change completed */
 926                         set_bit(HCI_CONN_SCO_SETUP_PEND, &acl->flags);
 927                         return sco;
 928                 }
 929
 930                 hci_sco_setup(acl, 0x00);
 931         }
 932
 933         return sco;
 934 }
 935
 936 /* Check link security requirement */
 937 int hci_conn_check_link_mode(struct hci_conn *conn)
 938 {
 939         BT_DBG("hcon %p", conn);
 940
 941         /* In Secure Connections Only mode, it is required that Secure
 942          * Connections is used and the link is encrypted with AES-CCM
 943          * using a P-256 authenticated combination key.
 944          */
 945         if (hci_dev_test_flag(conn->hdev, HCI_SC_ONLY)) {
 946                 if (!hci_conn_sc_enabled(conn) ||
 947                     !test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
 948                     conn->key_type != HCI_LK_AUTH_COMBINATION_P256)
 949                         return 0;
 950         }
 951
 952         if (hci_conn_ssp_enabled(conn) &&
 953             !test_bit(HCI_CONN_ENCRYPT, &conn->flags))
 954                 return 0;
 955
 956         return 1;
 957 }
 958
 959 /* Authenticate remote device */
 960 static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 961 {
 962         BT_DBG("hcon %p", conn);
 963
 964         if (conn->pending_sec_level > sec_level)
 965                 sec_level = conn->pending_sec_level;
 966
 967         if (sec_level > conn->sec_level)
 968                 conn->pending_sec_level = sec_level;
 969         else if (test_bit(HCI_CONN_AUTH, &conn->flags))
 970                 return 1;
 971
 972         /* Make sure we preserve an existing MITM requirement*/
 973         auth_type |= (conn->auth_type & 0x01);
 974
 975         conn->auth_type = auth_type;
 976
 977         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
 978                 struct hci_cp_auth_requested cp;
 979
 980                 cp.handle = cpu_to_le16(conn->handle);
 981                 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
 982                              sizeof(cp), &cp);
 983
 984                 /* If we're already encrypted set the REAUTH_PEND flag,
 985                  * otherwise set the ENCRYPT_PEND.
 986                  */
 987                 if (test_bit(HCI_CONN_ENCRYPT, &conn->flags))
 988                         set_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
 989                 else
 990                         set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
 991         }
 992
 993         return 0;
 994 }
 995
 996 /* Encrypt the the link */
 997 static void hci_conn_encrypt(struct hci_conn *conn)
 998 {
 999         BT_DBG("hcon %p", conn);
1000
1001         if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
1002                 struct hci_cp_set_conn_encrypt cp;
1003                 cp.handle  = cpu_to_le16(conn->handle);
1004                 cp.encrypt = 0x01;
1005                 hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
1006                              &cp);
1007         }
1008 }
1009
1010 /* Enable security */
1011 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type,
1012                       bool initiator)
1013 {
1014         BT_DBG("hcon %p", conn);
1015
1016         if (conn->type == LE_LINK)
1017                 return smp_conn_security(conn, sec_level);
1018
1019         /* For sdp we don't need the link key. */
1020         if (sec_level == BT_SECURITY_SDP)
1021                 return 1;
1022
1023         /* For non 2.1 devices and low security level we don't need the link
1024            key. */
1025         if (sec_level == BT_SECURITY_LOW && !hci_conn_ssp_enabled(conn))
1026                 return 1;
1027
1028         /* For other security levels we need the link key. */
1029         if (!test_bit(HCI_CONN_AUTH, &conn->flags))
1030                 goto auth;
1031
1032         /* An authenticated FIPS approved combination key has sufficient
1033          * security for security level 4. */
1034         if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256 &&
1035             sec_level == BT_SECURITY_FIPS)
1036                 goto encrypt;
1037
1038         /* An authenticated combination key has sufficient security for
1039            security level 3. */
1040         if ((conn->key_type == HCI_LK_AUTH_COMBINATION_P192 ||
1041              conn->key_type == HCI_LK_AUTH_COMBINATION_P256) &&
1042             sec_level == BT_SECURITY_HIGH)
1043                 goto encrypt;
1044
1045         /* An unauthenticated combination key has sufficient security for
1046            security level 1 and 2. */
1047         if ((conn->key_type == HCI_LK_UNAUTH_COMBINATION_P192 ||
1048              conn->key_type == HCI_LK_UNAUTH_COMBINATION_P256) &&
1049             (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW))
1050                 goto encrypt;
1051
1052         /* A combination key has always sufficient security for the security
1053            levels 1 or 2. High security level requires the combination key
1054            is generated using maximum PIN code length (16).
1055            For pre 2.1 units. */
1056         if (conn->key_type == HCI_LK_COMBINATION &&
1057             (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW ||
1058              conn->pin_length == 16))
1059                 goto encrypt;
1060
1061 auth:
1062         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags))
1063                 return 0;
1064
1065         if (initiator)
1066                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
1067
1068         if (!hci_conn_auth(conn, sec_level, auth_type))
1069                 return 0;
1070
1071 encrypt:
1072         if (test_bit(HCI_CONN_ENCRYPT, &conn->flags))
1073                 return 1;
1074
1075         hci_conn_encrypt(conn);
1076         return 0;
1077 }
1078 EXPORT_SYMBOL(hci_conn_security);
1079
1080 /* Check secure link requirement */
1081 int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level)
1082 {
1083         BT_DBG("hcon %p", conn);
1084
1085         /* Accept if non-secure or higher security level is required */
1086         if (sec_level != BT_SECURITY_HIGH && sec_level != BT_SECURITY_FIPS)
1087                 return 1;
1088
1089         /* Accept if secure or higher security level is already present */
1090         if (conn->sec_level == BT_SECURITY_HIGH ||
1091             conn->sec_level == BT_SECURITY_FIPS)
1092                 return 1;
1093
1094         /* Reject not secure link */
1095         return 0;
1096 }
1097 EXPORT_SYMBOL(hci_conn_check_secure);
1098
1099 /* Switch role */
1100 int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
1101 {
1102         BT_DBG("hcon %p", conn);
1103
1104         if (role == conn->role)
1105                 return 1;
1106
1107         if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->flags)) {
1108                 struct hci_cp_switch_role cp;
1109                 bacpy(&cp.bdaddr, &conn->dst);
1110                 cp.role = role;
1111                 hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
1112         }
1113
1114         return 0;
1115 }
1116 EXPORT_SYMBOL(hci_conn_switch_role);
1117
1118 /* Enter active mode */
1119 void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
1120 {
1121         struct hci_dev *hdev = conn->hdev;
1122
1123         BT_DBG("hcon %p mode %d", conn, conn->mode);
1124
1125         if (conn->mode != HCI_CM_SNIFF)
1126                 goto timer;
1127
1128         if (!test_bit(HCI_CONN_POWER_SAVE, &conn->flags) && !force_active)
1129                 goto timer;
1130
1131         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
1132                 struct hci_cp_exit_sniff_mode cp;
1133                 cp.handle = cpu_to_le16(conn->handle);
1134                 hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
1135         }
1136
1137 timer:
1138         if (hdev->idle_timeout > 0)
1139                 queue_delayed_work(hdev->workqueue, &conn->idle_work,
1140                                    msecs_to_jiffies(hdev->idle_timeout));
1141 }
1142
1143 /* Drop all connection on the device */
1144 void hci_conn_hash_flush(struct hci_dev *hdev)
1145 {
1146         struct hci_conn_hash *h = &hdev->conn_hash;
1147         struct hci_conn *c, *n;
1148
1149         BT_DBG("hdev %s", hdev->name);
1150
1151         list_for_each_entry_safe(c, n, &h->list, list) {
1152                 c->state = BT_CLOSED;
1153
1154                 hci_disconn_cfm(c, HCI_ERROR_LOCAL_HOST_TERM);
1155                 hci_conn_del(c);
1156         }
1157 }
1158
1159 /* Check pending connect attempts */
1160 void hci_conn_check_pending(struct hci_dev *hdev)
1161 {
1162         struct hci_conn *conn;
1163
1164         BT_DBG("hdev %s", hdev->name);
1165
1166         hci_dev_lock(hdev);
1167
1168         conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
1169         if (conn)
1170                 hci_acl_create_connection(conn);
1171
1172         hci_dev_unlock(hdev);
1173 }
1174
1175 static u32 get_link_mode(struct hci_conn *conn)
1176 {
1177         u32 link_mode = 0;
1178
1179         if (conn->role == HCI_ROLE_MASTER)
1180                 link_mode |= HCI_LM_MASTER;
1181
1182         if (test_bit(HCI_CONN_ENCRYPT, &conn->flags))
1183                 link_mode |= HCI_LM_ENCRYPT;
1184
1185         if (test_bit(HCI_CONN_AUTH, &conn->flags))
1186                 link_mode |= HCI_LM_AUTH;
1187
1188         if (test_bit(HCI_CONN_SECURE, &conn->flags))
1189                 link_mode |= HCI_LM_SECURE;
1190
1191         if (test_bit(HCI_CONN_FIPS, &conn->flags))
1192                 link_mode |= HCI_LM_FIPS;
1193
1194         return link_mode;
1195 }
1196
1197 int hci_get_conn_list(void __user *arg)
1198 {
1199         struct hci_conn *c;
1200         struct hci_conn_list_req req, *cl;
1201         struct hci_conn_info *ci;
1202         struct hci_dev *hdev;
1203         int n = 0, size, err;
1204
1205         if (copy_from_user(&req, arg, sizeof(req)))
1206                 return -EFAULT;
1207
1208         if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
1209                 return -EINVAL;
1210
1211         size = sizeof(req) + req.conn_num * sizeof(*ci);
1212
1213         cl = kmalloc(size, GFP_KERNEL);
1214         if (!cl)
1215                 return -ENOMEM;
1216
1217         hdev = hci_dev_get(req.dev_id);
1218         if (!hdev) {
1219                 kfree(cl);
1220                 return -ENODEV;
1221         }
1222
1223         ci = cl->conn_info;
1224
1225         hci_dev_lock(hdev);
1226         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1227                 bacpy(&(ci + n)->bdaddr, &c->dst);
1228                 (ci + n)->handle = c->handle;
1229                 (ci + n)->type  = c->type;
1230                 (ci + n)->out   = c->out;
1231                 (ci + n)->state = c->state;
1232                 (ci + n)->link_mode = get_link_mode(c);
1233                 if (++n >= req.conn_num)
1234                         break;
1235         }
1236         hci_dev_unlock(hdev);
1237
1238         cl->dev_id = hdev->id;
1239         cl->conn_num = n;
1240         size = sizeof(req) + n * sizeof(*ci);
1241
1242         hci_dev_put(hdev);
1243
1244         err = copy_to_user(arg, cl, size);
1245         kfree(cl);
1246
1247         return err ? -EFAULT : 0;
1248 }
1249
1250 int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
1251 {
1252         struct hci_conn_info_req req;
1253         struct hci_conn_info ci;
1254         struct hci_conn *conn;
1255         char __user *ptr = arg + sizeof(req);
1256
1257         if (copy_from_user(&req, arg, sizeof(req)))
1258                 return -EFAULT;
1259
1260         hci_dev_lock(hdev);
1261         conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
1262         if (conn) {
1263                 bacpy(&ci.bdaddr, &conn->dst);
1264                 ci.handle = conn->handle;
1265                 ci.type  = conn->type;
1266                 ci.out   = conn->out;
1267                 ci.state = conn->state;
1268                 ci.link_mode = get_link_mode(conn);
1269         }
1270         hci_dev_unlock(hdev);
1271
1272         if (!conn)
1273                 return -ENOENT;
1274
1275         return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
1276 }
1277
1278 int hci_get_auth_info(struct hci_dev *hdev, void __user *arg)
1279 {
1280         struct hci_auth_info_req req;
1281         struct hci_conn *conn;
1282
1283         if (copy_from_user(&req, arg, sizeof(req)))
1284                 return -EFAULT;
1285
1286         hci_dev_lock(hdev);
1287         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr);
1288         if (conn)
1289                 req.type = conn->auth_type;
1290         hci_dev_unlock(hdev);
1291
1292         if (!conn)
1293                 return -ENOENT;
1294
1295         return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0;
1296 }
1297
1298 struct hci_chan *hci_chan_create(struct hci_conn *conn)
1299 {
1300         struct hci_dev *hdev = conn->hdev;
1301         struct hci_chan *chan;
1302
1303         BT_DBG("%s hcon %p", hdev->name, conn);
1304
1305         if (test_bit(HCI_CONN_DROP, &conn->flags)) {
1306                 BT_DBG("Refusing to create new hci_chan");
1307                 return NULL;
1308         }
1309
1310         chan = kzalloc(sizeof(*chan), GFP_KERNEL);
1311         if (!chan)
1312                 return NULL;
1313
1314         chan->conn = hci_conn_get(conn);
1315         skb_queue_head_init(&chan->data_q);
1316         chan->state = BT_CONNECTED;
1317
1318         list_add_rcu(&chan->list, &conn->chan_list);
1319
1320         return chan;
1321 }
1322
1323 void hci_chan_del(struct hci_chan *chan)
1324 {
1325         struct hci_conn *conn = chan->conn;
1326         struct hci_dev *hdev = conn->hdev;
1327
1328         BT_DBG("%s hcon %p chan %p", hdev->name, conn, chan);
1329
1330         list_del_rcu(&chan->list);
1331
1332         synchronize_rcu();
1333
1334         /* Prevent new hci_chan's to be created for this hci_conn */
1335         set_bit(HCI_CONN_DROP, &conn->flags);
1336
1337         hci_conn_put(conn);
1338
1339         skb_queue_purge(&chan->data_q);
1340         kfree(chan);
1341 }
1342
1343 void hci_chan_list_flush(struct hci_conn *conn)
1344 {
1345         struct hci_chan *chan, *n;
1346
1347         BT_DBG("hcon %p", conn);
1348
1349         list_for_each_entry_safe(chan, n, &conn->chan_list, list)
1350                 hci_chan_del(chan);
1351 }
1352
1353 static struct hci_chan *__hci_chan_lookup_handle(struct hci_conn *hcon,
1354                                                  __u16 handle)
1355 {
1356         struct hci_chan *hchan;
1357
1358         list_for_each_entry(hchan, &hcon->chan_list, list) {
1359                 if (hchan->handle == handle)
1360                         return hchan;
1361         }
1362
1363         return NULL;
1364 }
1365
1366 struct hci_chan *hci_chan_lookup_handle(struct hci_dev *hdev, __u16 handle)
1367 {
1368         struct hci_conn_hash *h = &hdev->conn_hash;
1369         struct hci_conn *hcon;
1370         struct hci_chan *hchan = NULL;
1371
1372         rcu_read_lock();
1373
1374         list_for_each_entry_rcu(hcon, &h->list, list) {
1375                 hchan = __hci_chan_lookup_handle(hcon, handle);
1376                 if (hchan)
1377                         break;
1378         }
1379
1380         rcu_read_unlock();
1381
1382         return hchan;
1383 }