1 /* 2 BlueZ - Bluetooth protocol stack for Linux 3 Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved. 4 5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com> 6 7 This program is free software; you can redistribute it and/or modify 8 it under the terms of the GNU General Public License version 2 as 9 published by the Free Software Foundation; 10 11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 19 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 22 SOFTWARE IS DISCLAIMED. 23 */ 24 25 /* Bluetooth HCI connection handling. */ 26 27 #include <linux/export.h> 28 29 #include <net/bluetooth/bluetooth.h> 30 #include <net/bluetooth/hci_core.h> 31 #include <net/bluetooth/l2cap.h> 32 33 #include "smp.h" 34 #include "a2mp.h" 35 36 struct sco_param { 37 u16 pkt_type; 38 u16 max_latency; 39 u8 retrans_effort; 40 }; 41 42 static const struct sco_param esco_param_cvsd[] = { 43 { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000a, 0x01 }, /* S3 */ 44 { EDR_ESCO_MASK & ~ESCO_2EV3, 0x0007, 0x01 }, /* S2 */ 45 { EDR_ESCO_MASK | ESCO_EV3, 0x0007, 0x01 }, /* S1 */ 46 { EDR_ESCO_MASK | ESCO_HV3, 0xffff, 0x01 }, /* D1 */ 47 { EDR_ESCO_MASK | ESCO_HV1, 0xffff, 0x01 }, /* D0 */ 48 }; 49 50 static const struct sco_param sco_param_cvsd[] = { 51 { EDR_ESCO_MASK | ESCO_HV3, 0xffff, 0xff }, /* D1 */ 52 { EDR_ESCO_MASK | ESCO_HV1, 0xffff, 0xff }, /* D0 */ 53 }; 54 55 static const struct sco_param esco_param_msbc[] = { 56 { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000d, 0x02 }, /* T2 */ 57 { EDR_ESCO_MASK | ESCO_EV3, 0x0008, 0x02 }, /* T1 */ 58 }; 59 60 static void hci_le_create_connection_cancel(struct hci_conn *conn) 61 { 62 hci_send_cmd(conn->hdev, HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL); 63 } 64 65 static void hci_acl_create_connection(struct hci_conn *conn) 66 { 67 struct hci_dev *hdev = conn->hdev; 68 struct inquiry_entry *ie; 69 struct hci_cp_create_conn cp; 70 71 BT_DBG("hcon %p", conn); 72 73 conn->state = BT_CONNECT; 74 conn->out = true; 75 conn->role = HCI_ROLE_MASTER; 76 77 conn->attempt++; 78 79 conn->link_policy = hdev->link_policy; 80 81 memset(&cp, 0, sizeof(cp)); 82 bacpy(&cp.bdaddr, &conn->dst); 83 cp.pscan_rep_mode = 0x02; 84 85 ie = hci_inquiry_cache_lookup(hdev, &conn->dst); 86 if (ie) { 87 if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) { 88 cp.pscan_rep_mode = ie->data.pscan_rep_mode; 89 cp.pscan_mode = ie->data.pscan_mode; 90 cp.clock_offset = ie->data.clock_offset | 91 cpu_to_le16(0x8000); 92 } 93 94 memcpy(conn->dev_class, ie->data.dev_class, 3); 95 if (ie->data.ssp_mode > 0) 96 set_bit(HCI_CONN_SSP_ENABLED, &conn->flags); 97 } 98 99 cp.pkt_type = cpu_to_le16(conn->pkt_type); 100 if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER)) 101 cp.role_switch = 0x01; 102 else 103 cp.role_switch = 0x00; 104 105 hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp); 106 } 107 108 static void hci_acl_create_connection_cancel(struct hci_conn *conn) 109 { 110 struct hci_cp_create_conn_cancel cp; 111 112 BT_DBG("hcon %p", conn); 113 114 if (conn->hdev->hci_ver < BLUETOOTH_VER_1_2) 115 return; 116 117 bacpy(&cp.bdaddr, &conn->dst); 118 hci_send_cmd(conn->hdev, HCI_OP_CREATE_CONN_CANCEL, sizeof(cp), &cp); 119 } 120 121 static void hci_reject_sco(struct hci_conn *conn) 122 { 123 struct hci_cp_reject_sync_conn_req cp; 124 125 cp.reason = HCI_ERROR_REJ_LIMITED_RESOURCES; 126 bacpy(&cp.bdaddr, &conn->dst); 127 128 hci_send_cmd(conn->hdev, HCI_OP_REJECT_SYNC_CONN_REQ, sizeof(cp), &cp); 129 } 130 131 int hci_disconnect(struct hci_conn *conn, __u8 reason) 132 { 133 struct hci_cp_disconnect cp; 134 135 BT_DBG("hcon %p", conn); 136 137 /* When we are master of an established connection and it enters 138 * the disconnect timeout, then go ahead and try to read the 139 * current clock offset. Processing of the result is done 140 * within the event handling and hci_clock_offset_evt function. 141 */ 142 if (conn->type == ACL_LINK && conn->role == HCI_ROLE_MASTER) { 143 struct hci_dev *hdev = conn->hdev; 144 struct hci_cp_read_clock_offset clkoff_cp; 145 146 clkoff_cp.handle = cpu_to_le16(conn->handle); 147 hci_send_cmd(hdev, HCI_OP_READ_CLOCK_OFFSET, sizeof(clkoff_cp), 148 &clkoff_cp); 149 } 150 151 conn->state = BT_DISCONN; 152 153 cp.handle = cpu_to_le16(conn->handle); 154 cp.reason = reason; 155 return hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp); 156 } 157 158 static void hci_amp_disconn(struct hci_conn *conn) 159 { 160 struct hci_cp_disconn_phy_link cp; 161 162 BT_DBG("hcon %p", conn); 163 164 conn->state = BT_DISCONN; 165 166 cp.phy_handle = HCI_PHY_HANDLE(conn->handle); 167 cp.reason = hci_proto_disconn_ind(conn); 168 hci_send_cmd(conn->hdev, HCI_OP_DISCONN_PHY_LINK, 169 sizeof(cp), &cp); 170 } 171 172 static void hci_add_sco(struct hci_conn *conn, __u16 handle) 173 { 174 struct hci_dev *hdev = conn->hdev; 175 struct hci_cp_add_sco cp; 176 177 BT_DBG("hcon %p", conn); 178 179 conn->state = BT_CONNECT; 180 conn->out = true; 181 182 conn->attempt++; 183 184 cp.handle = cpu_to_le16(handle); 185 cp.pkt_type = cpu_to_le16(conn->pkt_type); 186 187 hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp); 188 } 189 190 bool hci_setup_sync(struct hci_conn *conn, __u16 handle) 191 { 192 struct hci_dev *hdev = conn->hdev; 193 struct hci_cp_setup_sync_conn cp; 194 const struct sco_param *param; 195 196 BT_DBG("hcon %p", conn); 197 198 conn->state = BT_CONNECT; 199 conn->out = true; 200 201 conn->attempt++; 202 203 cp.handle = cpu_to_le16(handle); 204 205 cp.tx_bandwidth = cpu_to_le32(0x00001f40); 206 cp.rx_bandwidth = cpu_to_le32(0x00001f40); 207 cp.voice_setting = cpu_to_le16(conn->setting); 208 209 switch (conn->setting & SCO_AIRMODE_MASK) { 210 case SCO_AIRMODE_TRANSP: 211 if (conn->attempt > ARRAY_SIZE(esco_param_msbc)) 212 return false; 213 param = &esco_param_msbc[conn->attempt - 1]; 214 break; 215 case SCO_AIRMODE_CVSD: 216 if (lmp_esco_capable(conn->link)) { 217 if (conn->attempt > ARRAY_SIZE(esco_param_cvsd)) 218 return false; 219 param = &esco_param_cvsd[conn->attempt - 1]; 220 } else { 221 if (conn->attempt > ARRAY_SIZE(sco_param_cvsd)) 222 return false; 223 param = &sco_param_cvsd[conn->attempt - 1]; 224 } 225 break; 226 default: 227 return false; 228 } 229 230 cp.retrans_effort = param->retrans_effort; 231 cp.pkt_type = __cpu_to_le16(param->pkt_type); 232 cp.max_latency = __cpu_to_le16(param->max_latency); 233 234 if (hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp) < 0) 235 return false; 236 237 return true; 238 } 239 240 u8 hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max, u16 latency, 241 u16 to_multiplier) 242 { 243 struct hci_dev *hdev = conn->hdev; 244 struct hci_conn_params *params; 245 struct hci_cp_le_conn_update cp; 246 247 hci_dev_lock(hdev); 248 249 params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type); 250 if (params) { 251 params->conn_min_interval = min; 252 params->conn_max_interval = max; 253 params->conn_latency = latency; 254 params->supervision_timeout = to_multiplier; 255 } 256 257 hci_dev_unlock(hdev); 258 259 memset(&cp, 0, sizeof(cp)); 260 cp.handle = cpu_to_le16(conn->handle); 261 cp.conn_interval_min = cpu_to_le16(min); 262 cp.conn_interval_max = cpu_to_le16(max); 263 cp.conn_latency = cpu_to_le16(latency); 264 cp.supervision_timeout = cpu_to_le16(to_multiplier); 265 cp.min_ce_len = cpu_to_le16(0x0000); 266 cp.max_ce_len = cpu_to_le16(0x0000); 267 268 hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp); 269 270 if (params) 271 return 0x01; 272 273 return 0x00; 274 } 275 276 void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __le64 rand, 277 __u8 ltk[16]) 278 { 279 struct hci_dev *hdev = conn->hdev; 280 struct hci_cp_le_start_enc cp; 281 282 BT_DBG("hcon %p", conn); 283 284 memset(&cp, 0, sizeof(cp)); 285 286 cp.handle = cpu_to_le16(conn->handle); 287 cp.rand = rand; 288 cp.ediv = ediv; 289 memcpy(cp.ltk, ltk, sizeof(cp.ltk)); 290 291 hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp); 292 } 293 294 /* Device _must_ be locked */ 295 void hci_sco_setup(struct hci_conn *conn, __u8 status) 296 { 297 struct hci_conn *sco = conn->link; 298 299 if (!sco) 300 return; 301 302 BT_DBG("hcon %p", conn); 303 304 if (!status) { 305 if (lmp_esco_capable(conn->hdev)) 306 hci_setup_sync(sco, conn->handle); 307 else 308 hci_add_sco(sco, conn->handle); 309 } else { 310 hci_proto_connect_cfm(sco, status); 311 hci_conn_del(sco); 312 } 313 } 314 315 static void hci_conn_timeout(struct work_struct *work) 316 { 317 struct hci_conn *conn = container_of(work, struct hci_conn, 318 disc_work.work); 319 int refcnt = atomic_read(&conn->refcnt); 320 321 BT_DBG("hcon %p state %s", conn, state_to_string(conn->state)); 322 323 WARN_ON(refcnt < 0); 324 325 /* FIXME: It was observed that in pairing failed scenario, refcnt 326 * drops below 0. Probably this is because l2cap_conn_del calls 327 * l2cap_chan_del for each channel, and inside l2cap_chan_del conn is 328 * dropped. After that loop hci_chan_del is called which also drops 329 * conn. For now make sure that ACL is alive if refcnt is higher then 0, 330 * otherwise drop it. 331 */ 332 if (refcnt > 0) 333 return; 334 335 switch (conn->state) { 336 case BT_CONNECT: 337 case BT_CONNECT2: 338 if (conn->out) { 339 if (conn->type == ACL_LINK) 340 hci_acl_create_connection_cancel(conn); 341 else if (conn->type == LE_LINK) 342 hci_le_create_connection_cancel(conn); 343 } else if (conn->type == SCO_LINK || conn->type == ESCO_LINK) { 344 hci_reject_sco(conn); 345 } 346 break; 347 case BT_CONFIG: 348 case BT_CONNECTED: 349 if (conn->type == AMP_LINK) { 350 hci_amp_disconn(conn); 351 } else { 352 __u8 reason = hci_proto_disconn_ind(conn); 353 hci_disconnect(conn, reason); 354 } 355 break; 356 default: 357 conn->state = BT_CLOSED; 358 break; 359 } 360 } 361 362 /* Enter sniff mode */ 363 static void hci_conn_idle(struct work_struct *work) 364 { 365 struct hci_conn *conn = container_of(work, struct hci_conn, 366 idle_work.work); 367 struct hci_dev *hdev = conn->hdev; 368 369 BT_DBG("hcon %p mode %d", conn, conn->mode); 370 371 if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn)) 372 return; 373 374 if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF)) 375 return; 376 377 if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) { 378 struct hci_cp_sniff_subrate cp; 379 cp.handle = cpu_to_le16(conn->handle); 380 cp.max_latency = cpu_to_le16(0); 381 cp.min_remote_timeout = cpu_to_le16(0); 382 cp.min_local_timeout = cpu_to_le16(0); 383 hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp); 384 } 385 386 if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) { 387 struct hci_cp_sniff_mode cp; 388 cp.handle = cpu_to_le16(conn->handle); 389 cp.max_interval = cpu_to_le16(hdev->sniff_max_interval); 390 cp.min_interval = cpu_to_le16(hdev->sniff_min_interval); 391 cp.attempt = cpu_to_le16(4); 392 cp.timeout = cpu_to_le16(1); 393 hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp); 394 } 395 } 396 397 static void hci_conn_auto_accept(struct work_struct *work) 398 { 399 struct hci_conn *conn = container_of(work, struct hci_conn, 400 auto_accept_work.work); 401 402 hci_send_cmd(conn->hdev, HCI_OP_USER_CONFIRM_REPLY, sizeof(conn->dst), 403 &conn->dst); 404 } 405 406 static void le_conn_timeout(struct work_struct *work) 407 { 408 struct hci_conn *conn = container_of(work, struct hci_conn, 409 le_conn_timeout.work); 410 struct hci_dev *hdev = conn->hdev; 411 412 BT_DBG(""); 413 414 /* We could end up here due to having done directed advertising, 415 * so clean up the state if necessary. This should however only 416 * happen with broken hardware or if low duty cycle was used 417 * (which doesn't have a timeout of its own). 418 */ 419 if (conn->role == HCI_ROLE_SLAVE) { 420 u8 enable = 0x00; 421 hci_send_cmd(hdev, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), 422 &enable); 423 hci_le_conn_failed(conn, HCI_ERROR_ADVERTISING_TIMEOUT); 424 return; 425 } 426 427 hci_le_create_connection_cancel(conn); 428 } 429 430 struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst, 431 u8 role) 432 { 433 struct hci_conn *conn; 434 435 BT_DBG("%s dst %pMR", hdev->name, dst); 436 437 conn = kzalloc(sizeof(*conn), GFP_KERNEL); 438 if (!conn) 439 return NULL; 440 441 bacpy(&conn->dst, dst); 442 bacpy(&conn->src, &hdev->bdaddr); 443 conn->hdev = hdev; 444 conn->type = type; 445 conn->role = role; 446 conn->mode = HCI_CM_ACTIVE; 447 conn->state = BT_OPEN; 448 conn->auth_type = HCI_AT_GENERAL_BONDING; 449 conn->io_capability = hdev->io_capability; 450 conn->remote_auth = 0xff; 451 conn->key_type = 0xff; 452 conn->rssi = HCI_RSSI_INVALID; 453 conn->tx_power = HCI_TX_POWER_INVALID; 454 conn->max_tx_power = HCI_TX_POWER_INVALID; 455 456 set_bit(HCI_CONN_POWER_SAVE, &conn->flags); 457 conn->disc_timeout = HCI_DISCONN_TIMEOUT; 458 459 if (conn->role == HCI_ROLE_MASTER) 460 conn->out = true; 461 462 switch (type) { 463 case ACL_LINK: 464 conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK; 465 break; 466 case LE_LINK: 467 /* conn->src should reflect the local identity address */ 468 hci_copy_identity_address(hdev, &conn->src, &conn->src_type); 469 break; 470 case SCO_LINK: 471 if (lmp_esco_capable(hdev)) 472 conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) | 473 (hdev->esco_type & EDR_ESCO_MASK); 474 else 475 conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK; 476 break; 477 case ESCO_LINK: 478 conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK; 479 break; 480 } 481 482 skb_queue_head_init(&conn->data_q); 483 484 INIT_LIST_HEAD(&conn->chan_list); 485 486 INIT_DELAYED_WORK(&conn->disc_work, hci_conn_timeout); 487 INIT_DELAYED_WORK(&conn->auto_accept_work, hci_conn_auto_accept); 488 INIT_DELAYED_WORK(&conn->idle_work, hci_conn_idle); 489 INIT_DELAYED_WORK(&conn->le_conn_timeout, le_conn_timeout); 490 491 atomic_set(&conn->refcnt, 0); 492 493 hci_dev_hold(hdev); 494 495 hci_conn_hash_add(hdev, conn); 496 if (hdev->notify) 497 hdev->notify(hdev, HCI_NOTIFY_CONN_ADD); 498 499 hci_conn_init_sysfs(conn); 500 501 return conn; 502 } 503 504 int hci_conn_del(struct hci_conn *conn) 505 { 506 struct hci_dev *hdev = conn->hdev; 507 508 BT_DBG("%s hcon %p handle %d", hdev->name, conn, conn->handle); 509 510 cancel_delayed_work_sync(&conn->disc_work); 511 cancel_delayed_work_sync(&conn->auto_accept_work); 512 cancel_delayed_work_sync(&conn->idle_work); 513 514 if (conn->type == ACL_LINK) { 515 struct hci_conn *sco = conn->link; 516 if (sco) 517 sco->link = NULL; 518 519 /* Unacked frames */ 520 hdev->acl_cnt += conn->sent; 521 } else if (conn->type == LE_LINK) { 522 cancel_delayed_work(&conn->le_conn_timeout); 523 524 if (hdev->le_pkts) 525 hdev->le_cnt += conn->sent; 526 else 527 hdev->acl_cnt += conn->sent; 528 } else { 529 struct hci_conn *acl = conn->link; 530 if (acl) { 531 acl->link = NULL; 532 hci_conn_drop(acl); 533 } 534 } 535 536 hci_chan_list_flush(conn); 537 538 if (conn->amp_mgr) 539 amp_mgr_put(conn->amp_mgr); 540 541 hci_conn_hash_del(hdev, conn); 542 if (hdev->notify) 543 hdev->notify(hdev, HCI_NOTIFY_CONN_DEL); 544 545 skb_queue_purge(&conn->data_q); 546 547 hci_conn_del_sysfs(conn); 548 549 if (test_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags)) 550 hci_conn_params_del(conn->hdev, &conn->dst, conn->dst_type); 551 552 hci_dev_put(hdev); 553 554 hci_conn_put(conn); 555 556 return 0; 557 } 558 559 struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src) 560 { 561 int use_src = bacmp(src, BDADDR_ANY); 562 struct hci_dev *hdev = NULL, *d; 563 564 BT_DBG("%pMR -> %pMR", src, dst); 565 566 read_lock(&hci_dev_list_lock); 567 568 list_for_each_entry(d, &hci_dev_list, list) { 569 if (!test_bit(HCI_UP, &d->flags) || 570 test_bit(HCI_USER_CHANNEL, &d->dev_flags) || 571 d->dev_type != HCI_BREDR) 572 continue; 573 574 /* Simple routing: 575 * No source address - find interface with bdaddr != dst 576 * Source address - find interface with bdaddr == src 577 */ 578 579 if (use_src) { 580 if (!bacmp(&d->bdaddr, src)) { 581 hdev = d; break; 582 } 583 } else { 584 if (bacmp(&d->bdaddr, dst)) { 585 hdev = d; break; 586 } 587 } 588 } 589 590 if (hdev) 591 hdev = hci_dev_hold(hdev); 592 593 read_unlock(&hci_dev_list_lock); 594 return hdev; 595 } 596 EXPORT_SYMBOL(hci_get_route); 597 598 /* This function requires the caller holds hdev->lock */ 599 void hci_le_conn_failed(struct hci_conn *conn, u8 status) 600 { 601 struct hci_dev *hdev = conn->hdev; 602 struct hci_conn_params *params; 603 604 params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst, 605 conn->dst_type); 606 if (params && params->conn) { 607 hci_conn_drop(params->conn); 608 hci_conn_put(params->conn); 609 params->conn = NULL; 610 } 611 612 conn->state = BT_CLOSED; 613 614 mgmt_connect_failed(hdev, &conn->dst, conn->type, conn->dst_type, 615 status); 616 617 hci_proto_connect_cfm(conn, status); 618 619 hci_conn_del(conn); 620 621 /* Since we may have temporarily stopped the background scanning in 622 * favor of connection establishment, we should restart it. 623 */ 624 hci_update_background_scan(hdev); 625 626 /* Re-enable advertising in case this was a failed connection 627 * attempt as a peripheral. 628 */ 629 mgmt_reenable_advertising(hdev); 630 } 631 632 static void create_le_conn_complete(struct hci_dev *hdev, u8 status) 633 { 634 struct hci_conn *conn; 635 636 if (status == 0) 637 return; 638 639 BT_ERR("HCI request failed to create LE connection: status 0x%2.2x", 640 status); 641 642 hci_dev_lock(hdev); 643 644 conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT); 645 if (!conn) 646 goto done; 647 648 hci_le_conn_failed(conn, status); 649 650 done: 651 hci_dev_unlock(hdev); 652 } 653 654 static void hci_req_add_le_create_conn(struct hci_request *req, 655 struct hci_conn *conn) 656 { 657 struct hci_cp_le_create_conn cp; 658 struct hci_dev *hdev = conn->hdev; 659 u8 own_addr_type; 660 661 memset(&cp, 0, sizeof(cp)); 662 663 /* Update random address, but set require_privacy to false so 664 * that we never connect with an non-resolvable address. 665 */ 666 if (hci_update_random_address(req, false, &own_addr_type)) 667 return; 668 669 cp.scan_interval = cpu_to_le16(hdev->le_scan_interval); 670 cp.scan_window = cpu_to_le16(hdev->le_scan_window); 671 bacpy(&cp.peer_addr, &conn->dst); 672 cp.peer_addr_type = conn->dst_type; 673 cp.own_address_type = own_addr_type; 674 cp.conn_interval_min = cpu_to_le16(conn->le_conn_min_interval); 675 cp.conn_interval_max = cpu_to_le16(conn->le_conn_max_interval); 676 cp.conn_latency = cpu_to_le16(conn->le_conn_latency); 677 cp.supervision_timeout = cpu_to_le16(conn->le_supv_timeout); 678 cp.min_ce_len = cpu_to_le16(0x0000); 679 cp.max_ce_len = cpu_to_le16(0x0000); 680 681 hci_req_add(req, HCI_OP_LE_CREATE_CONN, sizeof(cp), &cp); 682 683 conn->state = BT_CONNECT; 684 } 685 686 static void hci_req_directed_advertising(struct hci_request *req, 687 struct hci_conn *conn) 688 { 689 struct hci_dev *hdev = req->hdev; 690 struct hci_cp_le_set_adv_param cp; 691 u8 own_addr_type; 692 u8 enable; 693 694 /* Clear the HCI_LE_ADV bit temporarily so that the 695 * hci_update_random_address knows that it's safe to go ahead 696 * and write a new random address. The flag will be set back on 697 * as soon as the SET_ADV_ENABLE HCI command completes. 698 */ 699 clear_bit(HCI_LE_ADV, &hdev->dev_flags); 700 701 /* Set require_privacy to false so that the remote device has a 702 * chance of identifying us. 703 */ 704 if (hci_update_random_address(req, false, &own_addr_type) < 0) 705 return; 706 707 memset(&cp, 0, sizeof(cp)); 708 cp.type = LE_ADV_DIRECT_IND; 709 cp.own_address_type = own_addr_type; 710 cp.direct_addr_type = conn->dst_type; 711 bacpy(&cp.direct_addr, &conn->dst); 712 cp.channel_map = hdev->le_adv_channel_map; 713 714 hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp); 715 716 enable = 0x01; 717 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable); 718 719 conn->state = BT_CONNECT; 720 } 721 722 struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst, 723 u8 dst_type, u8 sec_level, u16 conn_timeout, 724 u8 role) 725 { 726 struct hci_conn_params *params; 727 struct hci_conn *conn; 728 struct smp_irk *irk; 729 struct hci_request req; 730 int err; 731 732 /* Some devices send ATT messages as soon as the physical link is 733 * established. To be able to handle these ATT messages, the user- 734 * space first establishes the connection and then starts the pairing 735 * process. 736 * 737 * So if a hci_conn object already exists for the following connection 738 * attempt, we simply update pending_sec_level and auth_type fields 739 * and return the object found. 740 */ 741 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, dst); 742 if (conn) { 743 conn->pending_sec_level = sec_level; 744 goto done; 745 } 746 747 /* Since the controller supports only one LE connection attempt at a 748 * time, we return -EBUSY if there is any connection attempt running. 749 */ 750 conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT); 751 if (conn) 752 return ERR_PTR(-EBUSY); 753 754 /* When given an identity address with existing identity 755 * resolving key, the connection needs to be established 756 * to a resolvable random address. 757 * 758 * This uses the cached random resolvable address from 759 * a previous scan. When no cached address is available, 760 * try connecting to the identity address instead. 761 * 762 * Storing the resolvable random address is required here 763 * to handle connection failures. The address will later 764 * be resolved back into the original identity address 765 * from the connect request. 766 */ 767 irk = hci_find_irk_by_addr(hdev, dst, dst_type); 768 if (irk && bacmp(&irk->rpa, BDADDR_ANY)) { 769 dst = &irk->rpa; 770 dst_type = ADDR_LE_DEV_RANDOM; 771 } 772 773 conn = hci_conn_add(hdev, LE_LINK, dst, role); 774 if (!conn) 775 return ERR_PTR(-ENOMEM); 776 777 conn->dst_type = dst_type; 778 conn->sec_level = BT_SECURITY_LOW; 779 conn->pending_sec_level = sec_level; 780 conn->conn_timeout = conn_timeout; 781 782 hci_req_init(&req, hdev); 783 784 /* Disable advertising if we're active. For master role 785 * connections most controllers will refuse to connect if 786 * advertising is enabled, and for slave role connections we 787 * anyway have to disable it in order to start directed 788 * advertising. 789 */ 790 if (test_bit(HCI_LE_ADV, &hdev->dev_flags)) { 791 u8 enable = 0x00; 792 hci_req_add(&req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), 793 &enable); 794 } 795 796 /* If requested to connect as slave use directed advertising */ 797 if (conn->role == HCI_ROLE_SLAVE) { 798 /* If we're active scanning most controllers are unable 799 * to initiate advertising. Simply reject the attempt. 800 */ 801 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags) && 802 hdev->le_scan_type == LE_SCAN_ACTIVE) { 803 skb_queue_purge(&req.cmd_q); 804 hci_conn_del(conn); 805 return ERR_PTR(-EBUSY); 806 } 807 808 hci_req_directed_advertising(&req, conn); 809 goto create_conn; 810 } 811 812 params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type); 813 if (params) { 814 conn->le_conn_min_interval = params->conn_min_interval; 815 conn->le_conn_max_interval = params->conn_max_interval; 816 conn->le_conn_latency = params->conn_latency; 817 conn->le_supv_timeout = params->supervision_timeout; 818 } else { 819 conn->le_conn_min_interval = hdev->le_conn_min_interval; 820 conn->le_conn_max_interval = hdev->le_conn_max_interval; 821 conn->le_conn_latency = hdev->le_conn_latency; 822 conn->le_supv_timeout = hdev->le_supv_timeout; 823 } 824 825 /* If controller is scanning, we stop it since some controllers are 826 * not able to scan and connect at the same time. Also set the 827 * HCI_LE_SCAN_INTERRUPTED flag so that the command complete 828 * handler for scan disabling knows to set the correct discovery 829 * state. 830 */ 831 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) { 832 hci_req_add_le_scan_disable(&req); 833 set_bit(HCI_LE_SCAN_INTERRUPTED, &hdev->dev_flags); 834 } 835 836 hci_req_add_le_create_conn(&req, conn); 837 838 create_conn: 839 err = hci_req_run(&req, create_le_conn_complete); 840 if (err) { 841 hci_conn_del(conn); 842 return ERR_PTR(err); 843 } 844 845 done: 846 hci_conn_hold(conn); 847 return conn; 848 } 849 850 struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst, 851 u8 sec_level, u8 auth_type) 852 { 853 struct hci_conn *acl; 854 855 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) 856 return ERR_PTR(-EOPNOTSUPP); 857 858 acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst); 859 if (!acl) { 860 acl = hci_conn_add(hdev, ACL_LINK, dst, HCI_ROLE_MASTER); 861 if (!acl) 862 return ERR_PTR(-ENOMEM); 863 } 864 865 hci_conn_hold(acl); 866 867 if (acl->state == BT_OPEN || acl->state == BT_CLOSED) { 868 acl->sec_level = BT_SECURITY_LOW; 869 acl->pending_sec_level = sec_level; 870 acl->auth_type = auth_type; 871 hci_acl_create_connection(acl); 872 } 873 874 return acl; 875 } 876 877 struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type, bdaddr_t *dst, 878 __u16 setting) 879 { 880 struct hci_conn *acl; 881 struct hci_conn *sco; 882 883 acl = hci_connect_acl(hdev, dst, BT_SECURITY_LOW, HCI_AT_NO_BONDING); 884 if (IS_ERR(acl)) 885 return acl; 886 887 sco = hci_conn_hash_lookup_ba(hdev, type, dst); 888 if (!sco) { 889 sco = hci_conn_add(hdev, type, dst, HCI_ROLE_MASTER); 890 if (!sco) { 891 hci_conn_drop(acl); 892 return ERR_PTR(-ENOMEM); 893 } 894 } 895 896 acl->link = sco; 897 sco->link = acl; 898 899 hci_conn_hold(sco); 900 901 sco->setting = setting; 902 903 if (acl->state == BT_CONNECTED && 904 (sco->state == BT_OPEN || sco->state == BT_CLOSED)) { 905 set_bit(HCI_CONN_POWER_SAVE, &acl->flags); 906 hci_conn_enter_active_mode(acl, BT_POWER_FORCE_ACTIVE_ON); 907 908 if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->flags)) { 909 /* defer SCO setup until mode change completed */ 910 set_bit(HCI_CONN_SCO_SETUP_PEND, &acl->flags); 911 return sco; 912 } 913 914 hci_sco_setup(acl, 0x00); 915 } 916 917 return sco; 918 } 919 920 /* Check link security requirement */ 921 int hci_conn_check_link_mode(struct hci_conn *conn) 922 { 923 BT_DBG("hcon %p", conn); 924 925 /* In Secure Connections Only mode, it is required that Secure 926 * Connections is used and the link is encrypted with AES-CCM 927 * using a P-256 authenticated combination key. 928 */ 929 if (test_bit(HCI_SC_ONLY, &conn->hdev->flags)) { 930 if (!hci_conn_sc_enabled(conn) || 931 !test_bit(HCI_CONN_AES_CCM, &conn->flags) || 932 conn->key_type != HCI_LK_AUTH_COMBINATION_P256) 933 return 0; 934 } 935 936 if (hci_conn_ssp_enabled(conn) && 937 !test_bit(HCI_CONN_ENCRYPT, &conn->flags)) 938 return 0; 939 940 return 1; 941 } 942 943 /* Authenticate remote device */ 944 static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type) 945 { 946 BT_DBG("hcon %p", conn); 947 948 if (conn->pending_sec_level > sec_level) 949 sec_level = conn->pending_sec_level; 950 951 if (sec_level > conn->sec_level) 952 conn->pending_sec_level = sec_level; 953 else if (test_bit(HCI_CONN_AUTH, &conn->flags)) 954 return 1; 955 956 /* Make sure we preserve an existing MITM requirement*/ 957 auth_type |= (conn->auth_type & 0x01); 958 959 conn->auth_type = auth_type; 960 961 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) { 962 struct hci_cp_auth_requested cp; 963 964 cp.handle = cpu_to_le16(conn->handle); 965 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED, 966 sizeof(cp), &cp); 967 968 /* If we're already encrypted set the REAUTH_PEND flag, 969 * otherwise set the ENCRYPT_PEND. 970 */ 971 if (test_bit(HCI_CONN_ENCRYPT, &conn->flags)) 972 set_bit(HCI_CONN_REAUTH_PEND, &conn->flags); 973 else 974 set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags); 975 } 976 977 return 0; 978 } 979 980 /* Encrypt the the link */ 981 static void hci_conn_encrypt(struct hci_conn *conn) 982 { 983 BT_DBG("hcon %p", conn); 984 985 if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) { 986 struct hci_cp_set_conn_encrypt cp; 987 cp.handle = cpu_to_le16(conn->handle); 988 cp.encrypt = 0x01; 989 hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp), 990 &cp); 991 } 992 } 993 994 /* Enable security */ 995 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type, 996 bool initiator) 997 { 998 BT_DBG("hcon %p", conn); 999 1000 if (conn->type == LE_LINK) 1001 return smp_conn_security(conn, sec_level); 1002 1003 /* For sdp we don't need the link key. */ 1004 if (sec_level == BT_SECURITY_SDP) 1005 return 1; 1006 1007 /* For non 2.1 devices and low security level we don't need the link 1008 key. */ 1009 if (sec_level == BT_SECURITY_LOW && !hci_conn_ssp_enabled(conn)) 1010 return 1; 1011 1012 /* For other security levels we need the link key. */ 1013 if (!test_bit(HCI_CONN_AUTH, &conn->flags)) 1014 goto auth; 1015 1016 /* An authenticated FIPS approved combination key has sufficient 1017 * security for security level 4. */ 1018 if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256 && 1019 sec_level == BT_SECURITY_FIPS) 1020 goto encrypt; 1021 1022 /* An authenticated combination key has sufficient security for 1023 security level 3. */ 1024 if ((conn->key_type == HCI_LK_AUTH_COMBINATION_P192 || 1025 conn->key_type == HCI_LK_AUTH_COMBINATION_P256) && 1026 sec_level == BT_SECURITY_HIGH) 1027 goto encrypt; 1028 1029 /* An unauthenticated combination key has sufficient security for 1030 security level 1 and 2. */ 1031 if ((conn->key_type == HCI_LK_UNAUTH_COMBINATION_P192 || 1032 conn->key_type == HCI_LK_UNAUTH_COMBINATION_P256) && 1033 (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW)) 1034 goto encrypt; 1035 1036 /* A combination key has always sufficient security for the security 1037 levels 1 or 2. High security level requires the combination key 1038 is generated using maximum PIN code length (16). 1039 For pre 2.1 units. */ 1040 if (conn->key_type == HCI_LK_COMBINATION && 1041 (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW || 1042 conn->pin_length == 16)) 1043 goto encrypt; 1044 1045 auth: 1046 if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) 1047 return 0; 1048 1049 if (initiator) 1050 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags); 1051 1052 if (!hci_conn_auth(conn, sec_level, auth_type)) 1053 return 0; 1054 1055 encrypt: 1056 if (test_bit(HCI_CONN_ENCRYPT, &conn->flags)) 1057 return 1; 1058 1059 hci_conn_encrypt(conn); 1060 return 0; 1061 } 1062 EXPORT_SYMBOL(hci_conn_security); 1063 1064 /* Check secure link requirement */ 1065 int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level) 1066 { 1067 BT_DBG("hcon %p", conn); 1068 1069 /* Accept if non-secure or higher security level is required */ 1070 if (sec_level != BT_SECURITY_HIGH && sec_level != BT_SECURITY_FIPS) 1071 return 1; 1072 1073 /* Accept if secure or higher security level is already present */ 1074 if (conn->sec_level == BT_SECURITY_HIGH || 1075 conn->sec_level == BT_SECURITY_FIPS) 1076 return 1; 1077 1078 /* Reject not secure link */ 1079 return 0; 1080 } 1081 EXPORT_SYMBOL(hci_conn_check_secure); 1082 1083 /* Change link key */ 1084 int hci_conn_change_link_key(struct hci_conn *conn) 1085 { 1086 BT_DBG("hcon %p", conn); 1087 1088 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) { 1089 struct hci_cp_change_conn_link_key cp; 1090 cp.handle = cpu_to_le16(conn->handle); 1091 hci_send_cmd(conn->hdev, HCI_OP_CHANGE_CONN_LINK_KEY, 1092 sizeof(cp), &cp); 1093 } 1094 1095 return 0; 1096 } 1097 1098 /* Switch role */ 1099 int hci_conn_switch_role(struct hci_conn *conn, __u8 role) 1100 { 1101 BT_DBG("hcon %p", conn); 1102 1103 if (role == conn->role) 1104 return 1; 1105 1106 if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->flags)) { 1107 struct hci_cp_switch_role cp; 1108 bacpy(&cp.bdaddr, &conn->dst); 1109 cp.role = role; 1110 hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp); 1111 } 1112 1113 return 0; 1114 } 1115 EXPORT_SYMBOL(hci_conn_switch_role); 1116 1117 /* Enter active mode */ 1118 void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active) 1119 { 1120 struct hci_dev *hdev = conn->hdev; 1121 1122 BT_DBG("hcon %p mode %d", conn, conn->mode); 1123 1124 if (conn->mode != HCI_CM_SNIFF) 1125 goto timer; 1126 1127 if (!test_bit(HCI_CONN_POWER_SAVE, &conn->flags) && !force_active) 1128 goto timer; 1129 1130 if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) { 1131 struct hci_cp_exit_sniff_mode cp; 1132 cp.handle = cpu_to_le16(conn->handle); 1133 hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp); 1134 } 1135 1136 timer: 1137 if (hdev->idle_timeout > 0) 1138 queue_delayed_work(hdev->workqueue, &conn->idle_work, 1139 msecs_to_jiffies(hdev->idle_timeout)); 1140 } 1141 1142 /* Drop all connection on the device */ 1143 void hci_conn_hash_flush(struct hci_dev *hdev) 1144 { 1145 struct hci_conn_hash *h = &hdev->conn_hash; 1146 struct hci_conn *c, *n; 1147 1148 BT_DBG("hdev %s", hdev->name); 1149 1150 list_for_each_entry_safe(c, n, &h->list, list) { 1151 c->state = BT_CLOSED; 1152 1153 hci_proto_disconn_cfm(c, HCI_ERROR_LOCAL_HOST_TERM); 1154 hci_conn_del(c); 1155 } 1156 } 1157 1158 /* Check pending connect attempts */ 1159 void hci_conn_check_pending(struct hci_dev *hdev) 1160 { 1161 struct hci_conn *conn; 1162 1163 BT_DBG("hdev %s", hdev->name); 1164 1165 hci_dev_lock(hdev); 1166 1167 conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2); 1168 if (conn) 1169 hci_acl_create_connection(conn); 1170 1171 hci_dev_unlock(hdev); 1172 } 1173 1174 static u32 get_link_mode(struct hci_conn *conn) 1175 { 1176 u32 link_mode = 0; 1177 1178 if (conn->role == HCI_ROLE_MASTER) 1179 link_mode |= HCI_LM_MASTER; 1180 1181 if (test_bit(HCI_CONN_ENCRYPT, &conn->flags)) 1182 link_mode |= HCI_LM_ENCRYPT; 1183 1184 if (test_bit(HCI_CONN_AUTH, &conn->flags)) 1185 link_mode |= HCI_LM_AUTH; 1186 1187 if (test_bit(HCI_CONN_SECURE, &conn->flags)) 1188 link_mode |= HCI_LM_SECURE; 1189 1190 if (test_bit(HCI_CONN_FIPS, &conn->flags)) 1191 link_mode |= HCI_LM_FIPS; 1192 1193 return link_mode; 1194 } 1195 1196 int hci_get_conn_list(void __user *arg) 1197 { 1198 struct hci_conn *c; 1199 struct hci_conn_list_req req, *cl; 1200 struct hci_conn_info *ci; 1201 struct hci_dev *hdev; 1202 int n = 0, size, err; 1203 1204 if (copy_from_user(&req, arg, sizeof(req))) 1205 return -EFAULT; 1206 1207 if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci)) 1208 return -EINVAL; 1209 1210 size = sizeof(req) + req.conn_num * sizeof(*ci); 1211 1212 cl = kmalloc(size, GFP_KERNEL); 1213 if (!cl) 1214 return -ENOMEM; 1215 1216 hdev = hci_dev_get(req.dev_id); 1217 if (!hdev) { 1218 kfree(cl); 1219 return -ENODEV; 1220 } 1221 1222 ci = cl->conn_info; 1223 1224 hci_dev_lock(hdev); 1225 list_for_each_entry(c, &hdev->conn_hash.list, list) { 1226 bacpy(&(ci + n)->bdaddr, &c->dst); 1227 (ci + n)->handle = c->handle; 1228 (ci + n)->type = c->type; 1229 (ci + n)->out = c->out; 1230 (ci + n)->state = c->state; 1231 (ci + n)->link_mode = get_link_mode(c); 1232 if (++n >= req.conn_num) 1233 break; 1234 } 1235 hci_dev_unlock(hdev); 1236 1237 cl->dev_id = hdev->id; 1238 cl->conn_num = n; 1239 size = sizeof(req) + n * sizeof(*ci); 1240 1241 hci_dev_put(hdev); 1242 1243 err = copy_to_user(arg, cl, size); 1244 kfree(cl); 1245 1246 return err ? -EFAULT : 0; 1247 } 1248 1249 int hci_get_conn_info(struct hci_dev *hdev, void __user *arg) 1250 { 1251 struct hci_conn_info_req req; 1252 struct hci_conn_info ci; 1253 struct hci_conn *conn; 1254 char __user *ptr = arg + sizeof(req); 1255 1256 if (copy_from_user(&req, arg, sizeof(req))) 1257 return -EFAULT; 1258 1259 hci_dev_lock(hdev); 1260 conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr); 1261 if (conn) { 1262 bacpy(&ci.bdaddr, &conn->dst); 1263 ci.handle = conn->handle; 1264 ci.type = conn->type; 1265 ci.out = conn->out; 1266 ci.state = conn->state; 1267 ci.link_mode = get_link_mode(conn); 1268 } 1269 hci_dev_unlock(hdev); 1270 1271 if (!conn) 1272 return -ENOENT; 1273 1274 return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0; 1275 } 1276 1277 int hci_get_auth_info(struct hci_dev *hdev, void __user *arg) 1278 { 1279 struct hci_auth_info_req req; 1280 struct hci_conn *conn; 1281 1282 if (copy_from_user(&req, arg, sizeof(req))) 1283 return -EFAULT; 1284 1285 hci_dev_lock(hdev); 1286 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr); 1287 if (conn) 1288 req.type = conn->auth_type; 1289 hci_dev_unlock(hdev); 1290 1291 if (!conn) 1292 return -ENOENT; 1293 1294 return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0; 1295 } 1296 1297 struct hci_chan *hci_chan_create(struct hci_conn *conn) 1298 { 1299 struct hci_dev *hdev = conn->hdev; 1300 struct hci_chan *chan; 1301 1302 BT_DBG("%s hcon %p", hdev->name, conn); 1303 1304 if (test_bit(HCI_CONN_DROP, &conn->flags)) { 1305 BT_DBG("Refusing to create new hci_chan"); 1306 return NULL; 1307 } 1308 1309 chan = kzalloc(sizeof(*chan), GFP_KERNEL); 1310 if (!chan) 1311 return NULL; 1312 1313 chan->conn = hci_conn_get(conn); 1314 skb_queue_head_init(&chan->data_q); 1315 chan->state = BT_CONNECTED; 1316 1317 list_add_rcu(&chan->list, &conn->chan_list); 1318 1319 return chan; 1320 } 1321 1322 void hci_chan_del(struct hci_chan *chan) 1323 { 1324 struct hci_conn *conn = chan->conn; 1325 struct hci_dev *hdev = conn->hdev; 1326 1327 BT_DBG("%s hcon %p chan %p", hdev->name, conn, chan); 1328 1329 list_del_rcu(&chan->list); 1330 1331 synchronize_rcu(); 1332 1333 /* Prevent new hci_chan's to be created for this hci_conn */ 1334 set_bit(HCI_CONN_DROP, &conn->flags); 1335 1336 hci_conn_put(conn); 1337 1338 skb_queue_purge(&chan->data_q); 1339 kfree(chan); 1340 } 1341 1342 void hci_chan_list_flush(struct hci_conn *conn) 1343 { 1344 struct hci_chan *chan, *n; 1345 1346 BT_DBG("hcon %p", conn); 1347 1348 list_for_each_entry_safe(chan, n, &conn->chan_list, list) 1349 hci_chan_del(chan); 1350 } 1351 1352 static struct hci_chan *__hci_chan_lookup_handle(struct hci_conn *hcon, 1353 __u16 handle) 1354 { 1355 struct hci_chan *hchan; 1356 1357 list_for_each_entry(hchan, &hcon->chan_list, list) { 1358 if (hchan->handle == handle) 1359 return hchan; 1360 } 1361 1362 return NULL; 1363 } 1364 1365 struct hci_chan *hci_chan_lookup_handle(struct hci_dev *hdev, __u16 handle) 1366 { 1367 struct hci_conn_hash *h = &hdev->conn_hash; 1368 struct hci_conn *hcon; 1369 struct hci_chan *hchan = NULL; 1370 1371 rcu_read_lock(); 1372 1373 list_for_each_entry_rcu(hcon, &h->list, list) { 1374 hchan = __hci_chan_lookup_handle(hcon, handle); 1375 if (hchan) 1376 break; 1377 } 1378 1379 rcu_read_unlock(); 1380 1381 return hchan; 1382 } 1383