2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22 SOFTWARE IS DISCLAIMED.
25 /* Bluetooth HCI connection handling. */
27 #include <linux/export.h>
28 #include <linux/debugfs.h>
30 #include <net/bluetooth/bluetooth.h>
31 #include <net/bluetooth/hci_core.h>
32 #include <net/bluetooth/l2cap.h>
34 #include "hci_request.h"
44 static const struct sco_param esco_param_cvsd
[] = {
45 { EDR_ESCO_MASK
& ~ESCO_2EV3
, 0x000a, 0x01 }, /* S3 */
46 { EDR_ESCO_MASK
& ~ESCO_2EV3
, 0x0007, 0x01 }, /* S2 */
47 { EDR_ESCO_MASK
| ESCO_EV3
, 0x0007, 0x01 }, /* S1 */
48 { EDR_ESCO_MASK
| ESCO_HV3
, 0xffff, 0x01 }, /* D1 */
49 { EDR_ESCO_MASK
| ESCO_HV1
, 0xffff, 0x01 }, /* D0 */
52 static const struct sco_param sco_param_cvsd
[] = {
53 { EDR_ESCO_MASK
| ESCO_HV3
, 0xffff, 0xff }, /* D1 */
54 { EDR_ESCO_MASK
| ESCO_HV1
, 0xffff, 0xff }, /* D0 */
57 static const struct sco_param esco_param_msbc
[] = {
58 { EDR_ESCO_MASK
& ~ESCO_2EV3
, 0x000d, 0x02 }, /* T2 */
59 { EDR_ESCO_MASK
| ESCO_EV3
, 0x0008, 0x02 }, /* T1 */
62 static void hci_le_create_connection_cancel(struct hci_conn
*conn
)
64 hci_send_cmd(conn
->hdev
, HCI_OP_LE_CREATE_CONN_CANCEL
, 0, NULL
);
67 /* This function requires the caller holds hdev->lock */
68 static void hci_connect_le_scan_cleanup(struct hci_conn
*conn
)
70 struct hci_conn_params
*params
;
76 bdaddr_type
= conn
->dst_type
;
78 /* Check if we need to convert to identity address */
79 irk
= hci_get_irk(conn
->hdev
, bdaddr
, bdaddr_type
);
81 bdaddr
= &irk
->bdaddr
;
82 bdaddr_type
= irk
->addr_type
;
85 params
= hci_explicit_connect_lookup(conn
->hdev
, bdaddr
, bdaddr_type
);
89 /* The connection attempt was doing scan for new RPA, and is
90 * in scan phase. If params are not associated with any other
91 * autoconnect action, remove them completely. If they are, just unmark
92 * them as waiting for connection, by clearing explicit_connect field.
94 if (params
->auto_connect
== HCI_AUTO_CONN_EXPLICIT
)
95 hci_conn_params_del(conn
->hdev
, bdaddr
, bdaddr_type
);
97 params
->explicit_connect
= false;
100 /* This function requires the caller holds hdev->lock */
101 static void hci_connect_le_scan_remove(struct hci_conn
*conn
)
103 hci_connect_le_scan_cleanup(conn
);
105 hci_conn_hash_del(conn
->hdev
, conn
);
106 hci_update_background_scan(conn
->hdev
);
109 static void hci_acl_create_connection(struct hci_conn
*conn
)
111 struct hci_dev
*hdev
= conn
->hdev
;
112 struct inquiry_entry
*ie
;
113 struct hci_cp_create_conn cp
;
115 BT_DBG("hcon %p", conn
);
117 conn
->state
= BT_CONNECT
;
119 conn
->role
= HCI_ROLE_MASTER
;
123 conn
->link_policy
= hdev
->link_policy
;
125 memset(&cp
, 0, sizeof(cp
));
126 bacpy(&cp
.bdaddr
, &conn
->dst
);
127 cp
.pscan_rep_mode
= 0x02;
129 ie
= hci_inquiry_cache_lookup(hdev
, &conn
->dst
);
131 if (inquiry_entry_age(ie
) <= INQUIRY_ENTRY_AGE_MAX
) {
132 cp
.pscan_rep_mode
= ie
->data
.pscan_rep_mode
;
133 cp
.pscan_mode
= ie
->data
.pscan_mode
;
134 cp
.clock_offset
= ie
->data
.clock_offset
|
138 memcpy(conn
->dev_class
, ie
->data
.dev_class
, 3);
139 if (ie
->data
.ssp_mode
> 0)
140 set_bit(HCI_CONN_SSP_ENABLED
, &conn
->flags
);
143 cp
.pkt_type
= cpu_to_le16(conn
->pkt_type
);
144 if (lmp_rswitch_capable(hdev
) && !(hdev
->link_mode
& HCI_LM_MASTER
))
145 cp
.role_switch
= 0x01;
147 cp
.role_switch
= 0x00;
149 hci_send_cmd(hdev
, HCI_OP_CREATE_CONN
, sizeof(cp
), &cp
);
152 static void hci_acl_create_connection_cancel(struct hci_conn
*conn
)
154 struct hci_cp_create_conn_cancel cp
;
156 BT_DBG("hcon %p", conn
);
158 if (conn
->hdev
->hci_ver
< BLUETOOTH_VER_1_2
)
161 bacpy(&cp
.bdaddr
, &conn
->dst
);
162 hci_send_cmd(conn
->hdev
, HCI_OP_CREATE_CONN_CANCEL
, sizeof(cp
), &cp
);
165 static void hci_reject_sco(struct hci_conn
*conn
)
167 struct hci_cp_reject_sync_conn_req cp
;
169 cp
.reason
= HCI_ERROR_REJ_LIMITED_RESOURCES
;
170 bacpy(&cp
.bdaddr
, &conn
->dst
);
172 hci_send_cmd(conn
->hdev
, HCI_OP_REJECT_SYNC_CONN_REQ
, sizeof(cp
), &cp
);
175 int hci_disconnect(struct hci_conn
*conn
, __u8 reason
)
177 struct hci_cp_disconnect cp
;
179 BT_DBG("hcon %p", conn
);
181 /* When we are master of an established connection and it enters
182 * the disconnect timeout, then go ahead and try to read the
183 * current clock offset. Processing of the result is done
184 * within the event handling and hci_clock_offset_evt function.
186 if (conn
->type
== ACL_LINK
&& conn
->role
== HCI_ROLE_MASTER
) {
187 struct hci_dev
*hdev
= conn
->hdev
;
188 struct hci_cp_read_clock_offset clkoff_cp
;
190 clkoff_cp
.handle
= cpu_to_le16(conn
->handle
);
191 hci_send_cmd(hdev
, HCI_OP_READ_CLOCK_OFFSET
, sizeof(clkoff_cp
),
195 conn
->state
= BT_DISCONN
;
197 cp
.handle
= cpu_to_le16(conn
->handle
);
199 return hci_send_cmd(conn
->hdev
, HCI_OP_DISCONNECT
, sizeof(cp
), &cp
);
202 static void hci_amp_disconn(struct hci_conn
*conn
)
204 struct hci_cp_disconn_phy_link cp
;
206 BT_DBG("hcon %p", conn
);
208 conn
->state
= BT_DISCONN
;
210 cp
.phy_handle
= HCI_PHY_HANDLE(conn
->handle
);
211 cp
.reason
= hci_proto_disconn_ind(conn
);
212 hci_send_cmd(conn
->hdev
, HCI_OP_DISCONN_PHY_LINK
,
216 static void hci_add_sco(struct hci_conn
*conn
, __u16 handle
)
218 struct hci_dev
*hdev
= conn
->hdev
;
219 struct hci_cp_add_sco cp
;
221 BT_DBG("hcon %p", conn
);
223 conn
->state
= BT_CONNECT
;
228 cp
.handle
= cpu_to_le16(handle
);
229 cp
.pkt_type
= cpu_to_le16(conn
->pkt_type
);
231 hci_send_cmd(hdev
, HCI_OP_ADD_SCO
, sizeof(cp
), &cp
);
234 bool hci_setup_sync(struct hci_conn
*conn
, __u16 handle
)
236 struct hci_dev
*hdev
= conn
->hdev
;
237 struct hci_cp_setup_sync_conn cp
;
238 const struct sco_param
*param
;
240 BT_DBG("hcon %p", conn
);
242 conn
->state
= BT_CONNECT
;
247 cp
.handle
= cpu_to_le16(handle
);
249 cp
.tx_bandwidth
= cpu_to_le32(0x00001f40);
250 cp
.rx_bandwidth
= cpu_to_le32(0x00001f40);
251 cp
.voice_setting
= cpu_to_le16(conn
->setting
);
253 switch (conn
->setting
& SCO_AIRMODE_MASK
) {
254 case SCO_AIRMODE_TRANSP
:
255 if (conn
->attempt
> ARRAY_SIZE(esco_param_msbc
))
257 param
= &esco_param_msbc
[conn
->attempt
- 1];
259 case SCO_AIRMODE_CVSD
:
260 if (lmp_esco_capable(conn
->link
)) {
261 if (conn
->attempt
> ARRAY_SIZE(esco_param_cvsd
))
263 param
= &esco_param_cvsd
[conn
->attempt
- 1];
265 if (conn
->attempt
> ARRAY_SIZE(sco_param_cvsd
))
267 param
= &sco_param_cvsd
[conn
->attempt
- 1];
274 cp
.retrans_effort
= param
->retrans_effort
;
275 cp
.pkt_type
= __cpu_to_le16(param
->pkt_type
);
276 cp
.max_latency
= __cpu_to_le16(param
->max_latency
);
278 if (hci_send_cmd(hdev
, HCI_OP_SETUP_SYNC_CONN
, sizeof(cp
), &cp
) < 0)
284 u8
hci_le_conn_update(struct hci_conn
*conn
, u16 min
, u16 max
, u16 latency
,
287 struct hci_dev
*hdev
= conn
->hdev
;
288 struct hci_conn_params
*params
;
289 struct hci_cp_le_conn_update cp
;
293 params
= hci_conn_params_lookup(hdev
, &conn
->dst
, conn
->dst_type
);
295 params
->conn_min_interval
= min
;
296 params
->conn_max_interval
= max
;
297 params
->conn_latency
= latency
;
298 params
->supervision_timeout
= to_multiplier
;
301 hci_dev_unlock(hdev
);
303 memset(&cp
, 0, sizeof(cp
));
304 cp
.handle
= cpu_to_le16(conn
->handle
);
305 cp
.conn_interval_min
= cpu_to_le16(min
);
306 cp
.conn_interval_max
= cpu_to_le16(max
);
307 cp
.conn_latency
= cpu_to_le16(latency
);
308 cp
.supervision_timeout
= cpu_to_le16(to_multiplier
);
309 cp
.min_ce_len
= cpu_to_le16(0x0000);
310 cp
.max_ce_len
= cpu_to_le16(0x0000);
312 hci_send_cmd(hdev
, HCI_OP_LE_CONN_UPDATE
, sizeof(cp
), &cp
);
320 void hci_le_start_enc(struct hci_conn
*conn
, __le16 ediv
, __le64 rand
,
321 __u8 ltk
[16], __u8 key_size
)
323 struct hci_dev
*hdev
= conn
->hdev
;
324 struct hci_cp_le_start_enc cp
;
326 BT_DBG("hcon %p", conn
);
328 memset(&cp
, 0, sizeof(cp
));
330 cp
.handle
= cpu_to_le16(conn
->handle
);
333 memcpy(cp
.ltk
, ltk
, key_size
);
335 hci_send_cmd(hdev
, HCI_OP_LE_START_ENC
, sizeof(cp
), &cp
);
338 /* Device _must_ be locked */
339 void hci_sco_setup(struct hci_conn
*conn
, __u8 status
)
341 struct hci_conn
*sco
= conn
->link
;
346 BT_DBG("hcon %p", conn
);
349 if (lmp_esco_capable(conn
->hdev
))
350 hci_setup_sync(sco
, conn
->handle
);
352 hci_add_sco(sco
, conn
->handle
);
354 hci_connect_cfm(sco
, status
);
359 static void hci_conn_timeout(struct work_struct
*work
)
361 struct hci_conn
*conn
= container_of(work
, struct hci_conn
,
363 int refcnt
= atomic_read(&conn
->refcnt
);
365 BT_DBG("hcon %p state %s", conn
, state_to_string(conn
->state
));
369 /* FIXME: It was observed that in pairing failed scenario, refcnt
370 * drops below 0. Probably this is because l2cap_conn_del calls
371 * l2cap_chan_del for each channel, and inside l2cap_chan_del conn is
372 * dropped. After that loop hci_chan_del is called which also drops
373 * conn. For now make sure that ACL is alive if refcnt is higher then 0,
379 switch (conn
->state
) {
383 if (conn
->type
== ACL_LINK
)
384 hci_acl_create_connection_cancel(conn
);
385 else if (conn
->type
== LE_LINK
)
386 hci_le_create_connection_cancel(conn
);
387 } else if (conn
->type
== SCO_LINK
|| conn
->type
== ESCO_LINK
) {
388 hci_reject_sco(conn
);
393 if (conn
->type
== AMP_LINK
) {
394 hci_amp_disconn(conn
);
396 __u8 reason
= hci_proto_disconn_ind(conn
);
397 hci_disconnect(conn
, reason
);
401 conn
->state
= BT_CLOSED
;
406 /* Enter sniff mode */
407 static void hci_conn_idle(struct work_struct
*work
)
409 struct hci_conn
*conn
= container_of(work
, struct hci_conn
,
411 struct hci_dev
*hdev
= conn
->hdev
;
413 BT_DBG("hcon %p mode %d", conn
, conn
->mode
);
415 if (!lmp_sniff_capable(hdev
) || !lmp_sniff_capable(conn
))
418 if (conn
->mode
!= HCI_CM_ACTIVE
|| !(conn
->link_policy
& HCI_LP_SNIFF
))
421 if (lmp_sniffsubr_capable(hdev
) && lmp_sniffsubr_capable(conn
)) {
422 struct hci_cp_sniff_subrate cp
;
423 cp
.handle
= cpu_to_le16(conn
->handle
);
424 cp
.max_latency
= cpu_to_le16(0);
425 cp
.min_remote_timeout
= cpu_to_le16(0);
426 cp
.min_local_timeout
= cpu_to_le16(0);
427 hci_send_cmd(hdev
, HCI_OP_SNIFF_SUBRATE
, sizeof(cp
), &cp
);
430 if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND
, &conn
->flags
)) {
431 struct hci_cp_sniff_mode cp
;
432 cp
.handle
= cpu_to_le16(conn
->handle
);
433 cp
.max_interval
= cpu_to_le16(hdev
->sniff_max_interval
);
434 cp
.min_interval
= cpu_to_le16(hdev
->sniff_min_interval
);
435 cp
.attempt
= cpu_to_le16(4);
436 cp
.timeout
= cpu_to_le16(1);
437 hci_send_cmd(hdev
, HCI_OP_SNIFF_MODE
, sizeof(cp
), &cp
);
441 static void hci_conn_auto_accept(struct work_struct
*work
)
443 struct hci_conn
*conn
= container_of(work
, struct hci_conn
,
444 auto_accept_work
.work
);
446 hci_send_cmd(conn
->hdev
, HCI_OP_USER_CONFIRM_REPLY
, sizeof(conn
->dst
),
450 static void le_conn_timeout(struct work_struct
*work
)
452 struct hci_conn
*conn
= container_of(work
, struct hci_conn
,
453 le_conn_timeout
.work
);
454 struct hci_dev
*hdev
= conn
->hdev
;
458 /* We could end up here due to having done directed advertising,
459 * so clean up the state if necessary. This should however only
460 * happen with broken hardware or if low duty cycle was used
461 * (which doesn't have a timeout of its own).
463 if (conn
->role
== HCI_ROLE_SLAVE
) {
465 hci_send_cmd(hdev
, HCI_OP_LE_SET_ADV_ENABLE
, sizeof(enable
),
467 hci_le_conn_failed(conn
, HCI_ERROR_ADVERTISING_TIMEOUT
);
471 hci_le_create_connection_cancel(conn
);
474 struct hci_conn
*hci_conn_add(struct hci_dev
*hdev
, int type
, bdaddr_t
*dst
,
477 struct hci_conn
*conn
;
479 BT_DBG("%s dst %pMR", hdev
->name
, dst
);
481 conn
= kzalloc(sizeof(*conn
), GFP_KERNEL
);
485 bacpy(&conn
->dst
, dst
);
486 bacpy(&conn
->src
, &hdev
->bdaddr
);
490 conn
->mode
= HCI_CM_ACTIVE
;
491 conn
->state
= BT_OPEN
;
492 conn
->auth_type
= HCI_AT_GENERAL_BONDING
;
493 conn
->io_capability
= hdev
->io_capability
;
494 conn
->remote_auth
= 0xff;
495 conn
->key_type
= 0xff;
496 conn
->rssi
= HCI_RSSI_INVALID
;
497 conn
->tx_power
= HCI_TX_POWER_INVALID
;
498 conn
->max_tx_power
= HCI_TX_POWER_INVALID
;
500 set_bit(HCI_CONN_POWER_SAVE
, &conn
->flags
);
501 conn
->disc_timeout
= HCI_DISCONN_TIMEOUT
;
503 if (conn
->role
== HCI_ROLE_MASTER
)
508 conn
->pkt_type
= hdev
->pkt_type
& ACL_PTYPE_MASK
;
511 /* conn->src should reflect the local identity address */
512 hci_copy_identity_address(hdev
, &conn
->src
, &conn
->src_type
);
515 if (lmp_esco_capable(hdev
))
516 conn
->pkt_type
= (hdev
->esco_type
& SCO_ESCO_MASK
) |
517 (hdev
->esco_type
& EDR_ESCO_MASK
);
519 conn
->pkt_type
= hdev
->pkt_type
& SCO_PTYPE_MASK
;
522 conn
->pkt_type
= hdev
->esco_type
& ~EDR_ESCO_MASK
;
526 skb_queue_head_init(&conn
->data_q
);
528 INIT_LIST_HEAD(&conn
->chan_list
);
530 INIT_DELAYED_WORK(&conn
->disc_work
, hci_conn_timeout
);
531 INIT_DELAYED_WORK(&conn
->auto_accept_work
, hci_conn_auto_accept
);
532 INIT_DELAYED_WORK(&conn
->idle_work
, hci_conn_idle
);
533 INIT_DELAYED_WORK(&conn
->le_conn_timeout
, le_conn_timeout
);
535 atomic_set(&conn
->refcnt
, 0);
539 hci_conn_hash_add(hdev
, conn
);
541 hdev
->notify(hdev
, HCI_NOTIFY_CONN_ADD
);
543 hci_conn_init_sysfs(conn
);
548 int hci_conn_del(struct hci_conn
*conn
)
550 struct hci_dev
*hdev
= conn
->hdev
;
552 BT_DBG("%s hcon %p handle %d", hdev
->name
, conn
, conn
->handle
);
554 cancel_delayed_work_sync(&conn
->disc_work
);
555 cancel_delayed_work_sync(&conn
->auto_accept_work
);
556 cancel_delayed_work_sync(&conn
->idle_work
);
558 if (conn
->type
== ACL_LINK
) {
559 struct hci_conn
*sco
= conn
->link
;
564 hdev
->acl_cnt
+= conn
->sent
;
565 } else if (conn
->type
== LE_LINK
) {
566 cancel_delayed_work(&conn
->le_conn_timeout
);
569 hdev
->le_cnt
+= conn
->sent
;
571 hdev
->acl_cnt
+= conn
->sent
;
573 struct hci_conn
*acl
= conn
->link
;
580 hci_chan_list_flush(conn
);
583 amp_mgr_put(conn
->amp_mgr
);
585 hci_conn_hash_del(hdev
, conn
);
587 hdev
->notify(hdev
, HCI_NOTIFY_CONN_DEL
);
589 skb_queue_purge(&conn
->data_q
);
591 hci_conn_del_sysfs(conn
);
593 debugfs_remove_recursive(conn
->debugfs
);
595 if (test_bit(HCI_CONN_PARAM_REMOVAL_PEND
, &conn
->flags
))
596 hci_conn_params_del(conn
->hdev
, &conn
->dst
, conn
->dst_type
);
605 struct hci_dev
*hci_get_route(bdaddr_t
*dst
, bdaddr_t
*src
)
607 int use_src
= bacmp(src
, BDADDR_ANY
);
608 struct hci_dev
*hdev
= NULL
, *d
;
610 BT_DBG("%pMR -> %pMR", src
, dst
);
612 read_lock(&hci_dev_list_lock
);
614 list_for_each_entry(d
, &hci_dev_list
, list
) {
615 if (!test_bit(HCI_UP
, &d
->flags
) ||
616 hci_dev_test_flag(d
, HCI_USER_CHANNEL
) ||
617 d
->dev_type
!= HCI_BREDR
)
621 * No source address - find interface with bdaddr != dst
622 * Source address - find interface with bdaddr == src
626 if (!bacmp(&d
->bdaddr
, src
)) {
630 if (bacmp(&d
->bdaddr
, dst
)) {
637 hdev
= hci_dev_hold(hdev
);
639 read_unlock(&hci_dev_list_lock
);
642 EXPORT_SYMBOL(hci_get_route
);
644 /* This function requires the caller holds hdev->lock */
645 void hci_le_conn_failed(struct hci_conn
*conn
, u8 status
)
647 struct hci_dev
*hdev
= conn
->hdev
;
648 struct hci_conn_params
*params
;
650 params
= hci_pend_le_action_lookup(&hdev
->pend_le_conns
, &conn
->dst
,
652 if (params
&& params
->conn
) {
653 hci_conn_drop(params
->conn
);
654 hci_conn_put(params
->conn
);
658 conn
->state
= BT_CLOSED
;
660 mgmt_connect_failed(hdev
, &conn
->dst
, conn
->type
, conn
->dst_type
,
663 hci_connect_cfm(conn
, status
);
667 /* Since we may have temporarily stopped the background scanning in
668 * favor of connection establishment, we should restart it.
670 hci_update_background_scan(hdev
);
672 /* Re-enable advertising in case this was a failed connection
673 * attempt as a peripheral.
675 mgmt_reenable_advertising(hdev
);
678 static void create_le_conn_complete(struct hci_dev
*hdev
, u8 status
, u16 opcode
)
680 struct hci_conn
*conn
;
685 BT_ERR("HCI request failed to create LE connection: status 0x%2.2x",
690 conn
= hci_lookup_le_connect(hdev
);
694 hci_le_conn_failed(conn
, status
);
697 hci_dev_unlock(hdev
);
700 static void hci_req_add_le_create_conn(struct hci_request
*req
,
701 struct hci_conn
*conn
)
703 struct hci_cp_le_create_conn cp
;
704 struct hci_dev
*hdev
= conn
->hdev
;
707 memset(&cp
, 0, sizeof(cp
));
709 /* Update random address, but set require_privacy to false so
710 * that we never connect with an non-resolvable address.
712 if (hci_update_random_address(req
, false, &own_addr_type
))
715 cp
.scan_interval
= cpu_to_le16(hdev
->le_scan_interval
);
716 cp
.scan_window
= cpu_to_le16(hdev
->le_scan_window
);
717 bacpy(&cp
.peer_addr
, &conn
->dst
);
718 cp
.peer_addr_type
= conn
->dst_type
;
719 cp
.own_address_type
= own_addr_type
;
720 cp
.conn_interval_min
= cpu_to_le16(conn
->le_conn_min_interval
);
721 cp
.conn_interval_max
= cpu_to_le16(conn
->le_conn_max_interval
);
722 cp
.conn_latency
= cpu_to_le16(conn
->le_conn_latency
);
723 cp
.supervision_timeout
= cpu_to_le16(conn
->le_supv_timeout
);
724 cp
.min_ce_len
= cpu_to_le16(0x0000);
725 cp
.max_ce_len
= cpu_to_le16(0x0000);
727 hci_req_add(req
, HCI_OP_LE_CREATE_CONN
, sizeof(cp
), &cp
);
729 conn
->state
= BT_CONNECT
;
732 static void hci_req_directed_advertising(struct hci_request
*req
,
733 struct hci_conn
*conn
)
735 struct hci_dev
*hdev
= req
->hdev
;
736 struct hci_cp_le_set_adv_param cp
;
740 /* Clear the HCI_LE_ADV bit temporarily so that the
741 * hci_update_random_address knows that it's safe to go ahead
742 * and write a new random address. The flag will be set back on
743 * as soon as the SET_ADV_ENABLE HCI command completes.
745 hci_dev_clear_flag(hdev
, HCI_LE_ADV
);
747 /* Set require_privacy to false so that the remote device has a
748 * chance of identifying us.
750 if (hci_update_random_address(req
, false, &own_addr_type
) < 0)
753 memset(&cp
, 0, sizeof(cp
));
754 cp
.type
= LE_ADV_DIRECT_IND
;
755 cp
.own_address_type
= own_addr_type
;
756 cp
.direct_addr_type
= conn
->dst_type
;
757 bacpy(&cp
.direct_addr
, &conn
->dst
);
758 cp
.channel_map
= hdev
->le_adv_channel_map
;
760 hci_req_add(req
, HCI_OP_LE_SET_ADV_PARAM
, sizeof(cp
), &cp
);
763 hci_req_add(req
, HCI_OP_LE_SET_ADV_ENABLE
, sizeof(enable
), &enable
);
765 conn
->state
= BT_CONNECT
;
768 struct hci_conn
*hci_connect_le(struct hci_dev
*hdev
, bdaddr_t
*dst
,
769 u8 dst_type
, u8 sec_level
, u16 conn_timeout
,
772 struct hci_conn_params
*params
;
773 struct hci_conn
*conn
;
775 struct hci_request req
;
778 /* Let's make sure that le is enabled.*/
779 if (!hci_dev_test_flag(hdev
, HCI_LE_ENABLED
)) {
780 if (lmp_le_capable(hdev
))
781 return ERR_PTR(-ECONNREFUSED
);
783 return ERR_PTR(-EOPNOTSUPP
);
786 /* Some devices send ATT messages as soon as the physical link is
787 * established. To be able to handle these ATT messages, the user-
788 * space first establishes the connection and then starts the pairing
791 * So if a hci_conn object already exists for the following connection
792 * attempt, we simply update pending_sec_level and auth_type fields
793 * and return the object found.
795 conn
= hci_conn_hash_lookup_ba(hdev
, LE_LINK
, dst
);
797 conn
->pending_sec_level
= sec_level
;
801 /* Since the controller supports only one LE connection attempt at a
802 * time, we return -EBUSY if there is any connection attempt running.
804 if (hci_lookup_le_connect(hdev
))
805 return ERR_PTR(-EBUSY
);
807 /* When given an identity address with existing identity
808 * resolving key, the connection needs to be established
809 * to a resolvable random address.
811 * This uses the cached random resolvable address from
812 * a previous scan. When no cached address is available,
813 * try connecting to the identity address instead.
815 * Storing the resolvable random address is required here
816 * to handle connection failures. The address will later
817 * be resolved back into the original identity address
818 * from the connect request.
820 irk
= hci_find_irk_by_addr(hdev
, dst
, dst_type
);
821 if (irk
&& bacmp(&irk
->rpa
, BDADDR_ANY
)) {
823 dst_type
= ADDR_LE_DEV_RANDOM
;
826 conn
= hci_conn_add(hdev
, LE_LINK
, dst
, role
);
828 return ERR_PTR(-ENOMEM
);
830 conn
->dst_type
= dst_type
;
831 conn
->sec_level
= BT_SECURITY_LOW
;
832 conn
->pending_sec_level
= sec_level
;
833 conn
->conn_timeout
= conn_timeout
;
835 hci_req_init(&req
, hdev
);
837 /* Disable advertising if we're active. For master role
838 * connections most controllers will refuse to connect if
839 * advertising is enabled, and for slave role connections we
840 * anyway have to disable it in order to start directed
843 if (hci_dev_test_flag(hdev
, HCI_LE_ADV
)) {
845 hci_req_add(&req
, HCI_OP_LE_SET_ADV_ENABLE
, sizeof(enable
),
849 /* If requested to connect as slave use directed advertising */
850 if (conn
->role
== HCI_ROLE_SLAVE
) {
851 /* If we're active scanning most controllers are unable
852 * to initiate advertising. Simply reject the attempt.
854 if (hci_dev_test_flag(hdev
, HCI_LE_SCAN
) &&
855 hdev
->le_scan_type
== LE_SCAN_ACTIVE
) {
856 skb_queue_purge(&req
.cmd_q
);
858 return ERR_PTR(-EBUSY
);
861 hci_req_directed_advertising(&req
, conn
);
865 params
= hci_conn_params_lookup(hdev
, &conn
->dst
, conn
->dst_type
);
867 conn
->le_conn_min_interval
= params
->conn_min_interval
;
868 conn
->le_conn_max_interval
= params
->conn_max_interval
;
869 conn
->le_conn_latency
= params
->conn_latency
;
870 conn
->le_supv_timeout
= params
->supervision_timeout
;
872 conn
->le_conn_min_interval
= hdev
->le_conn_min_interval
;
873 conn
->le_conn_max_interval
= hdev
->le_conn_max_interval
;
874 conn
->le_conn_latency
= hdev
->le_conn_latency
;
875 conn
->le_supv_timeout
= hdev
->le_supv_timeout
;
878 /* If controller is scanning, we stop it since some controllers are
879 * not able to scan and connect at the same time. Also set the
880 * HCI_LE_SCAN_INTERRUPTED flag so that the command complete
881 * handler for scan disabling knows to set the correct discovery
884 if (hci_dev_test_flag(hdev
, HCI_LE_SCAN
)) {
885 hci_req_add_le_scan_disable(&req
);
886 hci_dev_set_flag(hdev
, HCI_LE_SCAN_INTERRUPTED
);
889 hci_req_add_le_create_conn(&req
, conn
);
892 err
= hci_req_run(&req
, create_le_conn_complete
);
903 static void hci_connect_le_scan_complete(struct hci_dev
*hdev
, u8 status
,
906 struct hci_conn
*conn
;
911 BT_ERR("Failed to add device to auto conn whitelist: status 0x%2.2x",
916 conn
= hci_conn_hash_lookup_state(hdev
, LE_LINK
, BT_CONNECT
);
918 hci_le_conn_failed(conn
, status
);
920 hci_dev_unlock(hdev
);
923 static bool is_connected(struct hci_dev
*hdev
, bdaddr_t
*addr
, u8 type
)
925 struct hci_conn
*conn
;
927 conn
= hci_conn_hash_lookup_ba(hdev
, LE_LINK
, addr
);
931 if (conn
->dst_type
!= type
)
934 if (conn
->state
!= BT_CONNECTED
)
940 /* This function requires the caller holds hdev->lock */
941 static int hci_explicit_conn_params_set(struct hci_request
*req
,
942 bdaddr_t
*addr
, u8 addr_type
)
944 struct hci_dev
*hdev
= req
->hdev
;
945 struct hci_conn_params
*params
;
947 if (is_connected(hdev
, addr
, addr_type
))
950 params
= hci_conn_params_add(hdev
, addr
, addr_type
);
954 /* If we created new params, or existing params were marked as disabled,
955 * mark them to be used just once to connect.
957 if (params
->auto_connect
== HCI_AUTO_CONN_DISABLED
) {
958 params
->auto_connect
= HCI_AUTO_CONN_EXPLICIT
;
959 list_del_init(¶ms
->action
);
960 list_add(¶ms
->action
, &hdev
->pend_le_conns
);
963 params
->explicit_connect
= true;
964 __hci_update_background_scan(req
);
966 BT_DBG("addr %pMR (type %u) auto_connect %u", addr
, addr_type
,
967 params
->auto_connect
);
972 /* This function requires the caller holds hdev->lock */
973 struct hci_conn
*hci_connect_le_scan(struct hci_dev
*hdev
, bdaddr_t
*dst
,
974 u8 dst_type
, u8 sec_level
,
975 u16 conn_timeout
, u8 role
)
977 struct hci_conn
*conn
;
978 struct hci_request req
;
981 /* Let's make sure that le is enabled.*/
982 if (!hci_dev_test_flag(hdev
, HCI_LE_ENABLED
)) {
983 if (lmp_le_capable(hdev
))
984 return ERR_PTR(-ECONNREFUSED
);
986 return ERR_PTR(-EOPNOTSUPP
);
989 /* Some devices send ATT messages as soon as the physical link is
990 * established. To be able to handle these ATT messages, the user-
991 * space first establishes the connection and then starts the pairing
994 * So if a hci_conn object already exists for the following connection
995 * attempt, we simply update pending_sec_level and auth_type fields
996 * and return the object found.
998 conn
= hci_conn_hash_lookup_ba(hdev
, LE_LINK
, dst
);
1000 if (conn
->pending_sec_level
< sec_level
)
1001 conn
->pending_sec_level
= sec_level
;
1005 BT_DBG("requesting refresh of dst_addr");
1007 conn
= hci_conn_add(hdev
, LE_LINK
, dst
, role
);
1009 return ERR_PTR(-ENOMEM
);
1011 hci_req_init(&req
, hdev
);
1013 if (hci_explicit_conn_params_set(&req
, dst
, dst_type
) < 0)
1014 return ERR_PTR(-EBUSY
);
1016 conn
->state
= BT_CONNECT
;
1017 set_bit(HCI_CONN_SCANNING
, &conn
->flags
);
1019 err
= hci_req_run(&req
, hci_connect_le_scan_complete
);
1020 if (err
&& err
!= -ENODATA
) {
1022 return ERR_PTR(err
);
1025 conn
->dst_type
= dst_type
;
1026 conn
->sec_level
= BT_SECURITY_LOW
;
1027 conn
->pending_sec_level
= sec_level
;
1028 conn
->conn_timeout
= conn_timeout
;
1031 hci_conn_hold(conn
);
1035 struct hci_conn
*hci_connect_acl(struct hci_dev
*hdev
, bdaddr_t
*dst
,
1036 u8 sec_level
, u8 auth_type
)
1038 struct hci_conn
*acl
;
1040 if (!hci_dev_test_flag(hdev
, HCI_BREDR_ENABLED
)) {
1041 if (lmp_bredr_capable(hdev
))
1042 return ERR_PTR(-ECONNREFUSED
);
1044 return ERR_PTR(-EOPNOTSUPP
);
1047 acl
= hci_conn_hash_lookup_ba(hdev
, ACL_LINK
, dst
);
1049 acl
= hci_conn_add(hdev
, ACL_LINK
, dst
, HCI_ROLE_MASTER
);
1051 return ERR_PTR(-ENOMEM
);
1056 if (acl
->state
== BT_OPEN
|| acl
->state
== BT_CLOSED
) {
1057 acl
->sec_level
= BT_SECURITY_LOW
;
1058 acl
->pending_sec_level
= sec_level
;
1059 acl
->auth_type
= auth_type
;
1060 hci_acl_create_connection(acl
);
1066 struct hci_conn
*hci_connect_sco(struct hci_dev
*hdev
, int type
, bdaddr_t
*dst
,
1069 struct hci_conn
*acl
;
1070 struct hci_conn
*sco
;
1072 acl
= hci_connect_acl(hdev
, dst
, BT_SECURITY_LOW
, HCI_AT_NO_BONDING
);
1076 sco
= hci_conn_hash_lookup_ba(hdev
, type
, dst
);
1078 sco
= hci_conn_add(hdev
, type
, dst
, HCI_ROLE_MASTER
);
1081 return ERR_PTR(-ENOMEM
);
1090 sco
->setting
= setting
;
1092 if (acl
->state
== BT_CONNECTED
&&
1093 (sco
->state
== BT_OPEN
|| sco
->state
== BT_CLOSED
)) {
1094 set_bit(HCI_CONN_POWER_SAVE
, &acl
->flags
);
1095 hci_conn_enter_active_mode(acl
, BT_POWER_FORCE_ACTIVE_ON
);
1097 if (test_bit(HCI_CONN_MODE_CHANGE_PEND
, &acl
->flags
)) {
1098 /* defer SCO setup until mode change completed */
1099 set_bit(HCI_CONN_SCO_SETUP_PEND
, &acl
->flags
);
1103 hci_sco_setup(acl
, 0x00);
1109 /* Check link security requirement */
1110 int hci_conn_check_link_mode(struct hci_conn
*conn
)
1112 BT_DBG("hcon %p", conn
);
1114 /* In Secure Connections Only mode, it is required that Secure
1115 * Connections is used and the link is encrypted with AES-CCM
1116 * using a P-256 authenticated combination key.
1118 if (hci_dev_test_flag(conn
->hdev
, HCI_SC_ONLY
)) {
1119 if (!hci_conn_sc_enabled(conn
) ||
1120 !test_bit(HCI_CONN_AES_CCM
, &conn
->flags
) ||
1121 conn
->key_type
!= HCI_LK_AUTH_COMBINATION_P256
)
1125 if (hci_conn_ssp_enabled(conn
) &&
1126 !test_bit(HCI_CONN_ENCRYPT
, &conn
->flags
))
1132 /* Authenticate remote device */
1133 static int hci_conn_auth(struct hci_conn
*conn
, __u8 sec_level
, __u8 auth_type
)
1135 BT_DBG("hcon %p", conn
);
1137 if (conn
->pending_sec_level
> sec_level
)
1138 sec_level
= conn
->pending_sec_level
;
1140 if (sec_level
> conn
->sec_level
)
1141 conn
->pending_sec_level
= sec_level
;
1142 else if (test_bit(HCI_CONN_AUTH
, &conn
->flags
))
1145 /* Make sure we preserve an existing MITM requirement*/
1146 auth_type
|= (conn
->auth_type
& 0x01);
1148 conn
->auth_type
= auth_type
;
1150 if (!test_and_set_bit(HCI_CONN_AUTH_PEND
, &conn
->flags
)) {
1151 struct hci_cp_auth_requested cp
;
1153 cp
.handle
= cpu_to_le16(conn
->handle
);
1154 hci_send_cmd(conn
->hdev
, HCI_OP_AUTH_REQUESTED
,
1157 /* If we're already encrypted set the REAUTH_PEND flag,
1158 * otherwise set the ENCRYPT_PEND.
1160 if (test_bit(HCI_CONN_ENCRYPT
, &conn
->flags
))
1161 set_bit(HCI_CONN_REAUTH_PEND
, &conn
->flags
);
1163 set_bit(HCI_CONN_ENCRYPT_PEND
, &conn
->flags
);
1169 /* Encrypt the the link */
1170 static void hci_conn_encrypt(struct hci_conn
*conn
)
1172 BT_DBG("hcon %p", conn
);
1174 if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND
, &conn
->flags
)) {
1175 struct hci_cp_set_conn_encrypt cp
;
1176 cp
.handle
= cpu_to_le16(conn
->handle
);
1178 hci_send_cmd(conn
->hdev
, HCI_OP_SET_CONN_ENCRYPT
, sizeof(cp
),
1183 /* Enable security */
1184 int hci_conn_security(struct hci_conn
*conn
, __u8 sec_level
, __u8 auth_type
,
1187 BT_DBG("hcon %p", conn
);
1189 if (conn
->type
== LE_LINK
)
1190 return smp_conn_security(conn
, sec_level
);
1192 /* For sdp we don't need the link key. */
1193 if (sec_level
== BT_SECURITY_SDP
)
1196 /* For non 2.1 devices and low security level we don't need the link
1198 if (sec_level
== BT_SECURITY_LOW
&& !hci_conn_ssp_enabled(conn
))
1201 /* For other security levels we need the link key. */
1202 if (!test_bit(HCI_CONN_AUTH
, &conn
->flags
))
1205 /* An authenticated FIPS approved combination key has sufficient
1206 * security for security level 4. */
1207 if (conn
->key_type
== HCI_LK_AUTH_COMBINATION_P256
&&
1208 sec_level
== BT_SECURITY_FIPS
)
1211 /* An authenticated combination key has sufficient security for
1212 security level 3. */
1213 if ((conn
->key_type
== HCI_LK_AUTH_COMBINATION_P192
||
1214 conn
->key_type
== HCI_LK_AUTH_COMBINATION_P256
) &&
1215 sec_level
== BT_SECURITY_HIGH
)
1218 /* An unauthenticated combination key has sufficient security for
1219 security level 1 and 2. */
1220 if ((conn
->key_type
== HCI_LK_UNAUTH_COMBINATION_P192
||
1221 conn
->key_type
== HCI_LK_UNAUTH_COMBINATION_P256
) &&
1222 (sec_level
== BT_SECURITY_MEDIUM
|| sec_level
== BT_SECURITY_LOW
))
1225 /* A combination key has always sufficient security for the security
1226 levels 1 or 2. High security level requires the combination key
1227 is generated using maximum PIN code length (16).
1228 For pre 2.1 units. */
1229 if (conn
->key_type
== HCI_LK_COMBINATION
&&
1230 (sec_level
== BT_SECURITY_MEDIUM
|| sec_level
== BT_SECURITY_LOW
||
1231 conn
->pin_length
== 16))
1235 if (test_bit(HCI_CONN_ENCRYPT_PEND
, &conn
->flags
))
1239 set_bit(HCI_CONN_AUTH_INITIATOR
, &conn
->flags
);
1241 if (!hci_conn_auth(conn
, sec_level
, auth_type
))
1245 if (test_bit(HCI_CONN_ENCRYPT
, &conn
->flags
))
1248 hci_conn_encrypt(conn
);
1251 EXPORT_SYMBOL(hci_conn_security
);
1253 /* Check secure link requirement */
1254 int hci_conn_check_secure(struct hci_conn
*conn
, __u8 sec_level
)
1256 BT_DBG("hcon %p", conn
);
1258 /* Accept if non-secure or higher security level is required */
1259 if (sec_level
!= BT_SECURITY_HIGH
&& sec_level
!= BT_SECURITY_FIPS
)
1262 /* Accept if secure or higher security level is already present */
1263 if (conn
->sec_level
== BT_SECURITY_HIGH
||
1264 conn
->sec_level
== BT_SECURITY_FIPS
)
1267 /* Reject not secure link */
1270 EXPORT_SYMBOL(hci_conn_check_secure
);
1273 int hci_conn_switch_role(struct hci_conn
*conn
, __u8 role
)
1275 BT_DBG("hcon %p", conn
);
1277 if (role
== conn
->role
)
1280 if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND
, &conn
->flags
)) {
1281 struct hci_cp_switch_role cp
;
1282 bacpy(&cp
.bdaddr
, &conn
->dst
);
1284 hci_send_cmd(conn
->hdev
, HCI_OP_SWITCH_ROLE
, sizeof(cp
), &cp
);
1289 EXPORT_SYMBOL(hci_conn_switch_role
);
1291 /* Enter active mode */
1292 void hci_conn_enter_active_mode(struct hci_conn
*conn
, __u8 force_active
)
1294 struct hci_dev
*hdev
= conn
->hdev
;
1296 BT_DBG("hcon %p mode %d", conn
, conn
->mode
);
1298 if (conn
->mode
!= HCI_CM_SNIFF
)
1301 if (!test_bit(HCI_CONN_POWER_SAVE
, &conn
->flags
) && !force_active
)
1304 if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND
, &conn
->flags
)) {
1305 struct hci_cp_exit_sniff_mode cp
;
1306 cp
.handle
= cpu_to_le16(conn
->handle
);
1307 hci_send_cmd(hdev
, HCI_OP_EXIT_SNIFF_MODE
, sizeof(cp
), &cp
);
1311 if (hdev
->idle_timeout
> 0)
1312 queue_delayed_work(hdev
->workqueue
, &conn
->idle_work
,
1313 msecs_to_jiffies(hdev
->idle_timeout
));
1316 /* Drop all connection on the device */
1317 void hci_conn_hash_flush(struct hci_dev
*hdev
)
1319 struct hci_conn_hash
*h
= &hdev
->conn_hash
;
1320 struct hci_conn
*c
, *n
;
1322 BT_DBG("hdev %s", hdev
->name
);
1324 list_for_each_entry_safe(c
, n
, &h
->list
, list
) {
1325 c
->state
= BT_CLOSED
;
1327 hci_disconn_cfm(c
, HCI_ERROR_LOCAL_HOST_TERM
);
1332 /* Check pending connect attempts */
1333 void hci_conn_check_pending(struct hci_dev
*hdev
)
1335 struct hci_conn
*conn
;
1337 BT_DBG("hdev %s", hdev
->name
);
1341 conn
= hci_conn_hash_lookup_state(hdev
, ACL_LINK
, BT_CONNECT2
);
1343 hci_acl_create_connection(conn
);
1345 hci_dev_unlock(hdev
);
1348 static u32
get_link_mode(struct hci_conn
*conn
)
1352 if (conn
->role
== HCI_ROLE_MASTER
)
1353 link_mode
|= HCI_LM_MASTER
;
1355 if (test_bit(HCI_CONN_ENCRYPT
, &conn
->flags
))
1356 link_mode
|= HCI_LM_ENCRYPT
;
1358 if (test_bit(HCI_CONN_AUTH
, &conn
->flags
))
1359 link_mode
|= HCI_LM_AUTH
;
1361 if (test_bit(HCI_CONN_SECURE
, &conn
->flags
))
1362 link_mode
|= HCI_LM_SECURE
;
1364 if (test_bit(HCI_CONN_FIPS
, &conn
->flags
))
1365 link_mode
|= HCI_LM_FIPS
;
1370 int hci_get_conn_list(void __user
*arg
)
1373 struct hci_conn_list_req req
, *cl
;
1374 struct hci_conn_info
*ci
;
1375 struct hci_dev
*hdev
;
1376 int n
= 0, size
, err
;
1378 if (copy_from_user(&req
, arg
, sizeof(req
)))
1381 if (!req
.conn_num
|| req
.conn_num
> (PAGE_SIZE
* 2) / sizeof(*ci
))
1384 size
= sizeof(req
) + req
.conn_num
* sizeof(*ci
);
1386 cl
= kmalloc(size
, GFP_KERNEL
);
1390 hdev
= hci_dev_get(req
.dev_id
);
1399 list_for_each_entry(c
, &hdev
->conn_hash
.list
, list
) {
1400 bacpy(&(ci
+ n
)->bdaddr
, &c
->dst
);
1401 (ci
+ n
)->handle
= c
->handle
;
1402 (ci
+ n
)->type
= c
->type
;
1403 (ci
+ n
)->out
= c
->out
;
1404 (ci
+ n
)->state
= c
->state
;
1405 (ci
+ n
)->link_mode
= get_link_mode(c
);
1406 if (++n
>= req
.conn_num
)
1409 hci_dev_unlock(hdev
);
1411 cl
->dev_id
= hdev
->id
;
1413 size
= sizeof(req
) + n
* sizeof(*ci
);
1417 err
= copy_to_user(arg
, cl
, size
);
1420 return err
? -EFAULT
: 0;
1423 int hci_get_conn_info(struct hci_dev
*hdev
, void __user
*arg
)
1425 struct hci_conn_info_req req
;
1426 struct hci_conn_info ci
;
1427 struct hci_conn
*conn
;
1428 char __user
*ptr
= arg
+ sizeof(req
);
1430 if (copy_from_user(&req
, arg
, sizeof(req
)))
1434 conn
= hci_conn_hash_lookup_ba(hdev
, req
.type
, &req
.bdaddr
);
1436 bacpy(&ci
.bdaddr
, &conn
->dst
);
1437 ci
.handle
= conn
->handle
;
1438 ci
.type
= conn
->type
;
1440 ci
.state
= conn
->state
;
1441 ci
.link_mode
= get_link_mode(conn
);
1443 hci_dev_unlock(hdev
);
1448 return copy_to_user(ptr
, &ci
, sizeof(ci
)) ? -EFAULT
: 0;
1451 int hci_get_auth_info(struct hci_dev
*hdev
, void __user
*arg
)
1453 struct hci_auth_info_req req
;
1454 struct hci_conn
*conn
;
1456 if (copy_from_user(&req
, arg
, sizeof(req
)))
1460 conn
= hci_conn_hash_lookup_ba(hdev
, ACL_LINK
, &req
.bdaddr
);
1462 req
.type
= conn
->auth_type
;
1463 hci_dev_unlock(hdev
);
1468 return copy_to_user(arg
, &req
, sizeof(req
)) ? -EFAULT
: 0;
1471 struct hci_chan
*hci_chan_create(struct hci_conn
*conn
)
1473 struct hci_dev
*hdev
= conn
->hdev
;
1474 struct hci_chan
*chan
;
1476 BT_DBG("%s hcon %p", hdev
->name
, conn
);
1478 if (test_bit(HCI_CONN_DROP
, &conn
->flags
)) {
1479 BT_DBG("Refusing to create new hci_chan");
1483 chan
= kzalloc(sizeof(*chan
), GFP_KERNEL
);
1487 chan
->conn
= hci_conn_get(conn
);
1488 skb_queue_head_init(&chan
->data_q
);
1489 chan
->state
= BT_CONNECTED
;
1491 list_add_rcu(&chan
->list
, &conn
->chan_list
);
1496 void hci_chan_del(struct hci_chan
*chan
)
1498 struct hci_conn
*conn
= chan
->conn
;
1499 struct hci_dev
*hdev
= conn
->hdev
;
1501 BT_DBG("%s hcon %p chan %p", hdev
->name
, conn
, chan
);
1503 list_del_rcu(&chan
->list
);
1507 /* Prevent new hci_chan's to be created for this hci_conn */
1508 set_bit(HCI_CONN_DROP
, &conn
->flags
);
1512 skb_queue_purge(&chan
->data_q
);
1516 void hci_chan_list_flush(struct hci_conn
*conn
)
1518 struct hci_chan
*chan
, *n
;
1520 BT_DBG("hcon %p", conn
);
1522 list_for_each_entry_safe(chan
, n
, &conn
->chan_list
, list
)
1526 static struct hci_chan
*__hci_chan_lookup_handle(struct hci_conn
*hcon
,
1529 struct hci_chan
*hchan
;
1531 list_for_each_entry(hchan
, &hcon
->chan_list
, list
) {
1532 if (hchan
->handle
== handle
)
1539 struct hci_chan
*hci_chan_lookup_handle(struct hci_dev
*hdev
, __u16 handle
)
1541 struct hci_conn_hash
*h
= &hdev
->conn_hash
;
1542 struct hci_conn
*hcon
;
1543 struct hci_chan
*hchan
= NULL
;
1547 list_for_each_entry_rcu(hcon
, &h
->list
, list
) {
1548 hchan
= __hci_chan_lookup_handle(hcon
, handle
);