net/bluetooth/hci_conn.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI connection handling. */
  26
  27 #include <linux/export.h>
  28 #include <linux/debugfs.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/l2cap.h>
  33
  34 #include "hci_request.h"
  35 #include "smp.h"
  36 #include "a2mp.h"
  37
  38 struct sco_param {
  39         u16 pkt_type;
  40         u16 max_latency;
  41         u8  retrans_effort;
  42 };
  43 #ifdef CONFIG_TIZEN_WIP
  44 static const struct sco_param esco_param_cvsd[] = {
  45         { (EDR_ESCO_MASK & ~ESCO_2EV3) | SCO_ESCO_MASK | ESCO_EV3 , 0x000a, 0x01 }, /* S3 */
  46         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x0007,   0x01 }, /* S2 */
  47         { EDR_ESCO_MASK | ESCO_EV3,   0x0007,   0x01 }, /* S1 */
  48         { EDR_ESCO_MASK | ESCO_HV3,   0xffff,   0x01 }, /* D1 */
  49         { EDR_ESCO_MASK | ESCO_HV1,   0xffff,   0x01 }, /* D0 */
  50 };
  51
  52 static const struct sco_param esco_param_msbc[] = {
  53         { (EDR_ESCO_MASK & ~ESCO_2EV3) | ESCO_EV3, 0x000d, 0x02 }, /* T2 */
  54         { EDR_ESCO_MASK | ESCO_EV3,   0x0008,   0x02 }, /* T1 */
  55 };
  56 #else
  57
  58 static const struct sco_param esco_param_cvsd[] = {
  59         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000a,   0x01 }, /* S3 */
  60         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x0007,   0x01 }, /* S2 */
  61         { EDR_ESCO_MASK | ESCO_EV3,   0x0007,   0x01 }, /* S1 */
  62         { EDR_ESCO_MASK | ESCO_HV3,   0xffff,   0x01 }, /* D1 */
  63         { EDR_ESCO_MASK | ESCO_HV1,   0xffff,   0x01 }, /* D0 */
  64 };
  65
  66 static const struct sco_param esco_param_msbc[] = {
  67         { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000d,   0x02 }, /* T2 */
  68         { EDR_ESCO_MASK | ESCO_EV3,   0x0008,   0x02 }, /* T1 */
  69 };
  70 #endif
  71
  72 static const struct sco_param sco_param_cvsd[] = {
  73         { EDR_ESCO_MASK | ESCO_HV3,   0xffff,   0xff }, /* D1 */
  74         { EDR_ESCO_MASK | ESCO_HV1,   0xffff,   0xff }, /* D0 */
  75 };
  76
  77 static void hci_le_create_connection_cancel(struct hci_conn *conn)
  78 {
  79         hci_send_cmd(conn->hdev, HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL);
  80 }
  81
  82 static void hci_acl_create_connection(struct hci_conn *conn)
  83 {
  84         struct hci_dev *hdev = conn->hdev;
  85         struct inquiry_entry *ie;
  86         struct hci_cp_create_conn cp;
  87
  88         BT_DBG("hcon %p", conn);
  89
  90         conn->state = BT_CONNECT;
  91         conn->out = true;
  92         conn->role = HCI_ROLE_MASTER;
  93
  94         conn->attempt++;
  95
  96         conn->link_policy = hdev->link_policy;
  97
  98         memset(&cp, 0, sizeof(cp));
  99         bacpy(&cp.bdaddr, &conn->dst);
 100         cp.pscan_rep_mode = 0x02;
 101
 102         ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
 103         if (ie) {
 104                 if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
 105                         cp.pscan_rep_mode = ie->data.pscan_rep_mode;
 106                         cp.pscan_mode     = ie->data.pscan_mode;
 107                         cp.clock_offset   = ie->data.clock_offset |
 108                                             cpu_to_le16(0x8000);
 109                 }
 110
 111                 memcpy(conn->dev_class, ie->data.dev_class, 3);
 112                 if (ie->data.ssp_mode > 0)
 113                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
 114         }
 115
 116         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 117         if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
 118                 cp.role_switch = 0x01;
 119         else
 120                 cp.role_switch = 0x00;
 121
 122         hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
 123 }
 124
 125 static void hci_acl_create_connection_cancel(struct hci_conn *conn)
 126 {
 127         struct hci_cp_create_conn_cancel cp;
 128
 129         BT_DBG("hcon %p", conn);
 130
 131         if (conn->hdev->hci_ver < BLUETOOTH_VER_1_2)
 132                 return;
 133
 134         bacpy(&cp.bdaddr, &conn->dst);
 135         hci_send_cmd(conn->hdev, HCI_OP_CREATE_CONN_CANCEL, sizeof(cp), &cp);
 136 }
 137
 138 static void hci_reject_sco(struct hci_conn *conn)
 139 {
 140         struct hci_cp_reject_sync_conn_req cp;
 141
 142         cp.reason = HCI_ERROR_REJ_LIMITED_RESOURCES;
 143         bacpy(&cp.bdaddr, &conn->dst);
 144
 145         hci_send_cmd(conn->hdev, HCI_OP_REJECT_SYNC_CONN_REQ, sizeof(cp), &cp);
 146 }
 147
 148 int hci_disconnect(struct hci_conn *conn, __u8 reason)
 149 {
 150         struct hci_cp_disconnect cp;
 151
 152         BT_DBG("hcon %p", conn);
 153
 154         /* When we are master of an established connection and it enters
 155          * the disconnect timeout, then go ahead and try to read the
 156          * current clock offset.  Processing of the result is done
 157          * within the event handling and hci_clock_offset_evt function.
 158          */
 159         if (conn->type == ACL_LINK && conn->role == HCI_ROLE_MASTER) {
 160                 struct hci_dev *hdev = conn->hdev;
 161                 struct hci_cp_read_clock_offset clkoff_cp;
 162
 163                 clkoff_cp.handle = cpu_to_le16(conn->handle);
 164                 hci_send_cmd(hdev, HCI_OP_READ_CLOCK_OFFSET, sizeof(clkoff_cp),
 165                              &clkoff_cp);
 166         }
 167
 168         conn->state = BT_DISCONN;
 169
 170         cp.handle = cpu_to_le16(conn->handle);
 171         cp.reason = reason;
 172         return hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp);
 173 }
 174
 175 static void hci_amp_disconn(struct hci_conn *conn)
 176 {
 177         struct hci_cp_disconn_phy_link cp;
 178
 179         BT_DBG("hcon %p", conn);
 180
 181         conn->state = BT_DISCONN;
 182
 183         cp.phy_handle = HCI_PHY_HANDLE(conn->handle);
 184         cp.reason = hci_proto_disconn_ind(conn);
 185         hci_send_cmd(conn->hdev, HCI_OP_DISCONN_PHY_LINK,
 186                      sizeof(cp), &cp);
 187 }
 188
 189 static void hci_add_sco(struct hci_conn *conn, __u16 handle)
 190 {
 191         struct hci_dev *hdev = conn->hdev;
 192         struct hci_cp_add_sco cp;
 193
 194         BT_DBG("hcon %p", conn);
 195
 196         conn->state = BT_CONNECT;
 197         conn->out = true;
 198
 199         conn->attempt++;
 200
 201         cp.handle   = cpu_to_le16(handle);
 202         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 203
 204         hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
 205 }
 206
 207 bool hci_setup_sync(struct hci_conn *conn, __u16 handle)
 208 {
 209         struct hci_dev *hdev = conn->hdev;
 210         struct hci_cp_setup_sync_conn cp;
 211         const struct sco_param *param;
 212
 213         BT_DBG("hcon %p", conn);
 214
 215         conn->state = BT_CONNECT;
 216         conn->out = true;
 217
 218         conn->attempt++;
 219
 220         cp.handle   = cpu_to_le16(handle);
 221
 222         cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
 223         cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
 224         cp.voice_setting  = cpu_to_le16(conn->setting);
 225
 226         switch (conn->setting & SCO_AIRMODE_MASK) {
 227         case SCO_AIRMODE_TRANSP:
 228                 if (conn->attempt > ARRAY_SIZE(esco_param_msbc))
 229                         return false;
 230                 param = &esco_param_msbc[conn->attempt - 1];
 231                 break;
 232         case SCO_AIRMODE_CVSD:
 233                 if (lmp_esco_capable(conn->link)) {
 234                         if (conn->attempt > ARRAY_SIZE(esco_param_cvsd))
 235                                 return false;
 236                         param = &esco_param_cvsd[conn->attempt - 1];
 237                 } else {
 238                         if (conn->attempt > ARRAY_SIZE(sco_param_cvsd))
 239                                 return false;
 240                         param = &sco_param_cvsd[conn->attempt - 1];
 241                 }
 242                 break;
 243         default:
 244                 return false;
 245         }
 246
 247         cp.retrans_effort = param->retrans_effort;
 248         cp.pkt_type = __cpu_to_le16(param->pkt_type);
 249         cp.max_latency = __cpu_to_le16(param->max_latency);
 250
 251         if (hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp) < 0)
 252                 return false;
 253
 254         return true;
 255 }
 256
 257 u8 hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max, u16 latency,
 258                       u16 to_multiplier)
 259 {
 260         struct hci_dev *hdev = conn->hdev;
 261         struct hci_conn_params *params;
 262         struct hci_cp_le_conn_update cp;
 263
 264         hci_dev_lock(hdev);
 265
 266         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
 267         if (params) {
 268                 params->conn_min_interval = min;
 269                 params->conn_max_interval = max;
 270                 params->conn_latency = latency;
 271                 params->supervision_timeout = to_multiplier;
 272         }
 273
 274         hci_dev_unlock(hdev);
 275
 276         memset(&cp, 0, sizeof(cp));
 277         cp.handle               = cpu_to_le16(conn->handle);
 278         cp.conn_interval_min    = cpu_to_le16(min);
 279         cp.conn_interval_max    = cpu_to_le16(max);
 280         cp.conn_latency         = cpu_to_le16(latency);
 281         cp.supervision_timeout  = cpu_to_le16(to_multiplier);
 282         cp.min_ce_len           = cpu_to_le16(0x0000);
 283         cp.max_ce_len           = cpu_to_le16(0x0000);
 284
 285         hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp);
 286
 287         if (params)
 288                 return 0x01;
 289
 290         return 0x00;
 291 }
 292
 293 void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __le64 rand,
 294                       __u8 ltk[16])
 295 {
 296         struct hci_dev *hdev = conn->hdev;
 297         struct hci_cp_le_start_enc cp;
 298
 299         BT_DBG("hcon %p", conn);
 300
 301         memset(&cp, 0, sizeof(cp));
 302
 303         cp.handle = cpu_to_le16(conn->handle);
 304         cp.rand = rand;
 305         cp.ediv = ediv;
 306         memcpy(cp.ltk, ltk, sizeof(cp.ltk));
 307
 308         hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp);
 309 }
 310
 311 /* Device _must_ be locked */
 312 void hci_sco_setup(struct hci_conn *conn, __u8 status)
 313 {
 314         struct hci_conn *sco = conn->link;
 315
 316         if (!sco)
 317                 return;
 318
 319         BT_DBG("hcon %p", conn);
 320
 321         if (!status) {
 322                 if (lmp_esco_capable(conn->hdev))
 323                         hci_setup_sync(sco, conn->handle);
 324                 else
 325                         hci_add_sco(sco, conn->handle);
 326         } else {
 327                 hci_proto_connect_cfm(sco, status);
 328                 hci_conn_del(sco);
 329         }
 330 }
 331
 332 static void hci_conn_timeout(struct work_struct *work)
 333 {
 334         struct hci_conn *conn = container_of(work, struct hci_conn,
 335                                              disc_work.work);
 336         int refcnt = atomic_read(&conn->refcnt);
 337
 338         BT_DBG("hcon %p state %s", conn, state_to_string(conn->state));
 339
 340         WARN_ON(refcnt < 0);
 341
 342         /* FIXME: It was observed that in pairing failed scenario, refcnt
 343          * drops below 0. Probably this is because l2cap_conn_del calls
 344          * l2cap_chan_del for each channel, and inside l2cap_chan_del conn is
 345          * dropped. After that loop hci_chan_del is called which also drops
 346          * conn. For now make sure that ACL is alive if refcnt is higher then 0,
 347          * otherwise drop it.
 348          */
 349         if (refcnt > 0)
 350                 return;
 351
 352         switch (conn->state) {
 353         case BT_CONNECT:
 354         case BT_CONNECT2:
 355                 if (conn->out) {
 356                         if (conn->type == ACL_LINK)
 357                                 hci_acl_create_connection_cancel(conn);
 358 #ifdef CONFIG_TIZEN_WIP
 359                         else if (conn->type == LE_LINK &&
 360                                         bacmp(&conn->dst, BDADDR_ANY))
 361 #else
 362                         else if (conn->type == LE_LINK)
 363 #endif
 364                                 hci_le_create_connection_cancel(conn);
 365                 } else if (conn->type == SCO_LINK || conn->type == ESCO_LINK) {
 366                         hci_reject_sco(conn);
 367                 }
 368                 break;
 369         case BT_CONFIG:
 370         case BT_CONNECTED:
 371                 if (conn->type == AMP_LINK) {
 372                         hci_amp_disconn(conn);
 373                 } else {
 374                         __u8 reason = hci_proto_disconn_ind(conn);
 375                         hci_disconnect(conn, reason);
 376                 }
 377                 break;
 378         default:
 379                 conn->state = BT_CLOSED;
 380                 break;
 381         }
 382 }
 383
 384 /* Enter sniff mode */
 385 static void hci_conn_idle(struct work_struct *work)
 386 {
 387         struct hci_conn *conn = container_of(work, struct hci_conn,
 388                                              idle_work.work);
 389         struct hci_dev *hdev = conn->hdev;
 390
 391         BT_DBG("hcon %p mode %d", conn, conn->mode);
 392
 393         if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn))
 394                 return;
 395
 396         if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF))
 397                 return;
 398
 399         if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
 400                 struct hci_cp_sniff_subrate cp;
 401                 cp.handle             = cpu_to_le16(conn->handle);
 402                 cp.max_latency        = cpu_to_le16(0);
 403                 cp.min_remote_timeout = cpu_to_le16(0);
 404                 cp.min_local_timeout  = cpu_to_le16(0);
 405                 hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
 406         }
 407
 408         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
 409                 struct hci_cp_sniff_mode cp;
 410                 cp.handle       = cpu_to_le16(conn->handle);
 411                 cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
 412                 cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
 413                 cp.attempt      = cpu_to_le16(4);
 414                 cp.timeout      = cpu_to_le16(1);
 415                 hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
 416         }
 417 }
 418
 419 static void hci_conn_auto_accept(struct work_struct *work)
 420 {
 421         struct hci_conn *conn = container_of(work, struct hci_conn,
 422                                              auto_accept_work.work);
 423
 424         hci_send_cmd(conn->hdev, HCI_OP_USER_CONFIRM_REPLY, sizeof(conn->dst),
 425                      &conn->dst);
 426 }
 427
 428 static void le_conn_timeout(struct work_struct *work)
 429 {
 430         struct hci_conn *conn = container_of(work, struct hci_conn,
 431                                              le_conn_timeout.work);
 432         struct hci_dev *hdev = conn->hdev;
 433
 434         BT_DBG("");
 435
 436         /* We could end up here due to having done directed advertising,
 437          * so clean up the state if necessary. This should however only
 438          * happen with broken hardware or if low duty cycle was used
 439          * (which doesn't have a timeout of its own).
 440          */
 441         if (conn->role == HCI_ROLE_SLAVE) {
 442                 u8 enable = 0x00;
 443                 hci_send_cmd(hdev, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable),
 444                              &enable);
 445                 hci_le_conn_failed(conn, HCI_ERROR_ADVERTISING_TIMEOUT);
 446                 return;
 447         }
 448
 449         hci_le_create_connection_cancel(conn);
 450 }
 451
 452 struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst,
 453                               u8 role)
 454 {
 455         struct hci_conn *conn;
 456
 457         BT_DBG("%s dst %pMR", hdev->name, dst);
 458
 459         conn = kzalloc(sizeof(*conn), GFP_KERNEL);
 460         if (!conn)
 461                 return NULL;
 462
 463         bacpy(&conn->dst, dst);
 464         bacpy(&conn->src, &hdev->bdaddr);
 465         conn->hdev  = hdev;
 466         conn->type  = type;
 467         conn->role  = role;
 468         conn->mode  = HCI_CM_ACTIVE;
 469         conn->state = BT_OPEN;
 470         conn->auth_type = HCI_AT_GENERAL_BONDING;
 471         conn->io_capability = hdev->io_capability;
 472         conn->remote_auth = 0xff;
 473         conn->key_type = 0xff;
 474         conn->rssi = HCI_RSSI_INVALID;
 475         conn->tx_power = HCI_TX_POWER_INVALID;
 476         conn->max_tx_power = HCI_TX_POWER_INVALID;
 477
 478 #ifdef CONFIG_TIZEN_WIP
 479         /* enable sniff mode for incoming connection */
 480         conn->link_policy = hdev->link_policy;
 481 #endif
 482
 483         set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
 484         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
 485
 486         if (conn->role == HCI_ROLE_MASTER)
 487                 conn->out = true;
 488
 489         switch (type) {
 490         case ACL_LINK:
 491                 conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
 492                 break;
 493         case LE_LINK:
 494                 /* conn->src should reflect the local identity address */
 495                 hci_copy_identity_address(hdev, &conn->src, &conn->src_type);
 496                 break;
 497         case SCO_LINK:
 498                 if (lmp_esco_capable(hdev))
 499                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
 500                                         (hdev->esco_type & EDR_ESCO_MASK);
 501                 else
 502                         conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
 503                 break;
 504         case ESCO_LINK:
 505                 conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK;
 506                 break;
 507         }
 508
 509         skb_queue_head_init(&conn->data_q);
 510
 511         INIT_LIST_HEAD(&conn->chan_list);
 512
 513         INIT_DELAYED_WORK(&conn->disc_work, hci_conn_timeout);
 514         INIT_DELAYED_WORK(&conn->auto_accept_work, hci_conn_auto_accept);
 515         INIT_DELAYED_WORK(&conn->idle_work, hci_conn_idle);
 516         INIT_DELAYED_WORK(&conn->le_conn_timeout, le_conn_timeout);
 517
 518         atomic_set(&conn->refcnt, 0);
 519
 520         hci_dev_hold(hdev);
 521
 522         hci_conn_hash_add(hdev, conn);
 523         if (hdev->notify)
 524                 hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
 525
 526         hci_conn_init_sysfs(conn);
 527
 528         return conn;
 529 }
 530
 531 int hci_conn_del(struct hci_conn *conn)
 532 {
 533         struct hci_dev *hdev = conn->hdev;
 534
 535         BT_DBG("%s hcon %p handle %d", hdev->name, conn, conn->handle);
 536
 537         cancel_delayed_work_sync(&conn->disc_work);
 538         cancel_delayed_work_sync(&conn->auto_accept_work);
 539         cancel_delayed_work_sync(&conn->idle_work);
 540
 541         if (conn->type == ACL_LINK) {
 542                 struct hci_conn *sco = conn->link;
 543                 if (sco)
 544                         sco->link = NULL;
 545
 546                 /* Unacked frames */
 547                 hdev->acl_cnt += conn->sent;
 548         } else if (conn->type == LE_LINK) {
 549                 cancel_delayed_work(&conn->le_conn_timeout);
 550
 551                 if (hdev->le_pkts)
 552                         hdev->le_cnt += conn->sent;
 553                 else
 554                         hdev->acl_cnt += conn->sent;
 555         } else {
 556                 struct hci_conn *acl = conn->link;
 557                 if (acl) {
 558                         acl->link = NULL;
 559                         hci_conn_drop(acl);
 560                 }
 561         }
 562
 563         hci_chan_list_flush(conn);
 564
 565         if (conn->amp_mgr)
 566                 amp_mgr_put(conn->amp_mgr);
 567
 568         hci_conn_hash_del(hdev, conn);
 569         if (hdev->notify)
 570                 hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
 571
 572         skb_queue_purge(&conn->data_q);
 573
 574         hci_conn_del_sysfs(conn);
 575
 576         debugfs_remove_recursive(conn->debugfs);
 577
 578         if (test_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags))
 579                 hci_conn_params_del(conn->hdev, &conn->dst, conn->dst_type);
 580
 581         hci_dev_put(hdev);
 582
 583         hci_conn_put(conn);
 584
 585         return 0;
 586 }
 587
 588 struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src)
 589 {
 590         int use_src = bacmp(src, BDADDR_ANY);
 591         struct hci_dev *hdev = NULL, *d;
 592
 593         BT_DBG("%pMR -> %pMR", src, dst);
 594
 595         read_lock(&hci_dev_list_lock);
 596
 597         list_for_each_entry(d, &hci_dev_list, list) {
 598                 if (!test_bit(HCI_UP, &d->flags) ||
 599                     test_bit(HCI_USER_CHANNEL, &d->dev_flags) ||
 600                     d->dev_type != HCI_BREDR)
 601                         continue;
 602
 603                 /* Simple routing:
 604                  *   No source address - find interface with bdaddr != dst
 605                  *   Source address    - find interface with bdaddr == src
 606                  */
 607
 608                 if (use_src) {
 609                         if (!bacmp(&d->bdaddr, src)) {
 610                                 hdev = d; break;
 611                         }
 612                 } else {
 613                         if (bacmp(&d->bdaddr, dst)) {
 614                                 hdev = d; break;
 615                         }
 616                 }
 617         }
 618
 619         if (hdev)
 620                 hdev = hci_dev_hold(hdev);
 621
 622         read_unlock(&hci_dev_list_lock);
 623         return hdev;
 624 }
 625 EXPORT_SYMBOL(hci_get_route);
 626
 627 /* This function requires the caller holds hdev->lock */
 628 void hci_le_conn_failed(struct hci_conn *conn, u8 status)
 629 {
 630         struct hci_dev *hdev = conn->hdev;
 631         struct hci_conn_params *params;
 632
 633         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
 634                                            conn->dst_type);
 635         if (params && params->conn) {
 636                 hci_conn_drop(params->conn);
 637                 hci_conn_put(params->conn);
 638                 params->conn = NULL;
 639         }
 640
 641         conn->state = BT_CLOSED;
 642
 643         mgmt_connect_failed(hdev, &conn->dst, conn->type, conn->dst_type,
 644                             status);
 645
 646         hci_proto_connect_cfm(conn, status);
 647
 648         hci_conn_del(conn);
 649
 650         /* Since we may have temporarily stopped the background scanning in
 651          * favor of connection establishment, we should restart it.
 652          */
 653         hci_update_background_scan(hdev);
 654
 655         /* Re-enable advertising in case this was a failed connection
 656          * attempt as a peripheral.
 657          */
 658         mgmt_reenable_advertising(hdev);
 659 }
 660
 661 static void create_le_conn_complete(struct hci_dev *hdev, u8 status, u16 opcode)
 662 {
 663         struct hci_conn *conn;
 664
 665         if (status == 0)
 666                 return;
 667
 668         BT_ERR("HCI request failed to create LE connection: status 0x%2.2x",
 669                status);
 670
 671         hci_dev_lock(hdev);
 672
 673         conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
 674         if (!conn)
 675                 goto done;
 676
 677         hci_le_conn_failed(conn, status);
 678
 679 done:
 680         hci_dev_unlock(hdev);
 681 }
 682
 683 static void hci_req_add_le_create_conn(struct hci_request *req,
 684                                        struct hci_conn *conn)
 685 {
 686         struct hci_cp_le_create_conn cp;
 687         struct hci_dev *hdev = conn->hdev;
 688         u8 own_addr_type;
 689
 690         memset(&cp, 0, sizeof(cp));
 691
 692         /* Update random address, but set require_privacy to false so
 693          * that we never connect with an non-resolvable address.
 694          */
 695         if (hci_update_random_address(req, false, &own_addr_type))
 696                 return;
 697
 698         cp.scan_interval = cpu_to_le16(hdev->le_scan_interval);
 699         cp.scan_window = cpu_to_le16(hdev->le_scan_window);
 700 #ifdef CONFIG_TIZEN_WIP
 701 /* LE auto connect */
 702         if (!bacmp(&conn->dst, BDADDR_ANY))
 703                 cp.filter_policy = 0x1;
 704         else
 705                 bacpy(&cp.peer_addr, &conn->dst);
 706 #else
 707         bacpy(&cp.peer_addr, &conn->dst);
 708 #endif
 709         cp.peer_addr_type = conn->dst_type;
 710         cp.own_address_type = own_addr_type;
 711         cp.conn_interval_min = cpu_to_le16(conn->le_conn_min_interval);
 712         cp.conn_interval_max = cpu_to_le16(conn->le_conn_max_interval);
 713         cp.conn_latency = cpu_to_le16(conn->le_conn_latency);
 714         cp.supervision_timeout = cpu_to_le16(conn->le_supv_timeout);
 715         cp.min_ce_len = cpu_to_le16(0x0000);
 716         cp.max_ce_len = cpu_to_le16(0x0000);
 717
 718         hci_req_add(req, HCI_OP_LE_CREATE_CONN, sizeof(cp), &cp);
 719
 720         conn->state = BT_CONNECT;
 721 }
 722
 723 static void hci_req_directed_advertising(struct hci_request *req,
 724                                          struct hci_conn *conn)
 725 {
 726         struct hci_dev *hdev = req->hdev;
 727         struct hci_cp_le_set_adv_param cp;
 728         u8 own_addr_type;
 729         u8 enable;
 730
 731         /* Clear the HCI_LE_ADV bit temporarily so that the
 732          * hci_update_random_address knows that it's safe to go ahead
 733          * and write a new random address. The flag will be set back on
 734          * as soon as the SET_ADV_ENABLE HCI command completes.
 735          */
 736         clear_bit(HCI_LE_ADV, &hdev->dev_flags);
 737
 738         /* Set require_privacy to false so that the remote device has a
 739          * chance of identifying us.
 740          */
 741         if (hci_update_random_address(req, false, &own_addr_type) < 0)
 742                 return;
 743
 744         memset(&cp, 0, sizeof(cp));
 745         cp.type = LE_ADV_DIRECT_IND;
 746         cp.own_address_type = own_addr_type;
 747         cp.direct_addr_type = conn->dst_type;
 748         bacpy(&cp.direct_addr, &conn->dst);
 749         cp.channel_map = hdev->le_adv_channel_map;
 750
 751         hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
 752
 753         enable = 0x01;
 754         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
 755
 756         conn->state = BT_CONNECT;
 757 }
 758
 759 struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,
 760                                 u8 dst_type, u8 sec_level, u16 conn_timeout,
 761                                 u8 role)
 762 {
 763         struct hci_conn_params *params;
 764         struct hci_conn *conn;
 765         struct smp_irk *irk;
 766         struct hci_request req;
 767         int err;
 768
 769         /* Some devices send ATT messages as soon as the physical link is
 770          * established. To be able to handle these ATT messages, the user-
 771          * space first establishes the connection and then starts the pairing
 772          * process.
 773          *
 774          * So if a hci_conn object already exists for the following connection
 775          * attempt, we simply update pending_sec_level and auth_type fields
 776          * and return the object found.
 777          */
 778         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, dst);
 779         if (conn) {
 780                 conn->pending_sec_level = sec_level;
 781                 goto done;
 782         }
 783
 784         /* Since the controller supports only one LE connection attempt at a
 785          * time, we return -EBUSY if there is any connection attempt running.
 786          */
 787         conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
 788         if (conn)
 789                 return ERR_PTR(-EBUSY);
 790
 791         /* When given an identity address with existing identity
 792          * resolving key, the connection needs to be established
 793          * to a resolvable random address.
 794          *
 795          * This uses the cached random resolvable address from
 796          * a previous scan. When no cached address is available,
 797          * try connecting to the identity address instead.
 798          *
 799          * Storing the resolvable random address is required here
 800          * to handle connection failures. The address will later
 801          * be resolved back into the original identity address
 802          * from the connect request.
 803          */
 804         irk = hci_find_irk_by_addr(hdev, dst, dst_type);
 805         if (irk && bacmp(&irk->rpa, BDADDR_ANY)) {
 806                 dst = &irk->rpa;
 807                 dst_type = ADDR_LE_DEV_RANDOM;
 808         }
 809
 810         conn = hci_conn_add(hdev, LE_LINK, dst, role);
 811         if (!conn)
 812                 return ERR_PTR(-ENOMEM);
 813
 814         conn->dst_type = dst_type;
 815         conn->sec_level = BT_SECURITY_LOW;
 816         conn->pending_sec_level = sec_level;
 817         conn->conn_timeout = conn_timeout;
 818
 819         hci_req_init(&req, hdev);
 820
 821         /* Disable advertising if we're active. For master role
 822          * connections most controllers will refuse to connect if
 823          * advertising is enabled, and for slave role connections we
 824          * anyway have to disable it in order to start directed
 825          * advertising.
 826          */
 827         if (test_bit(HCI_LE_ADV, &hdev->dev_flags)) {
 828                 u8 enable = 0x00;
 829                 hci_req_add(&req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable),
 830                             &enable);
 831         }
 832
 833         /* If requested to connect as slave use directed advertising */
 834         if (conn->role == HCI_ROLE_SLAVE) {
 835                 /* If we're active scanning most controllers are unable
 836                  * to initiate advertising. Simply reject the attempt.
 837                  */
 838                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags) &&
 839                     hdev->le_scan_type == LE_SCAN_ACTIVE) {
 840                         skb_queue_purge(&req.cmd_q);
 841                         hci_conn_del(conn);
 842                         return ERR_PTR(-EBUSY);
 843                 }
 844
 845                 hci_req_directed_advertising(&req, conn);
 846                 goto create_conn;
 847         }
 848
 849         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
 850         if (params) {
 851                 conn->le_conn_min_interval = params->conn_min_interval;
 852                 conn->le_conn_max_interval = params->conn_max_interval;
 853                 conn->le_conn_latency = params->conn_latency;
 854                 conn->le_supv_timeout = params->supervision_timeout;
 855         } else {
 856                 conn->le_conn_min_interval = hdev->le_conn_min_interval;
 857                 conn->le_conn_max_interval = hdev->le_conn_max_interval;
 858                 conn->le_conn_latency = hdev->le_conn_latency;
 859                 conn->le_supv_timeout = hdev->le_supv_timeout;
 860         }
 861
 862         /* If controller is scanning, we stop it since some controllers are
 863          * not able to scan and connect at the same time. Also set the
 864          * HCI_LE_SCAN_INTERRUPTED flag so that the command complete
 865          * handler for scan disabling knows to set the correct discovery
 866          * state.
 867          */
 868         if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
 869                 hci_req_add_le_scan_disable(&req);
 870                 set_bit(HCI_LE_SCAN_INTERRUPTED, &hdev->dev_flags);
 871         }
 872
 873         hci_req_add_le_create_conn(&req, conn);
 874
 875 create_conn:
 876         err = hci_req_run(&req, create_le_conn_complete);
 877         if (err) {
 878                 hci_conn_del(conn);
 879                 return ERR_PTR(err);
 880         }
 881
 882 done:
 883         hci_conn_hold(conn);
 884         return conn;
 885 }
 886
 887 struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst,
 888                                  u8 sec_level, u8 auth_type)
 889 {
 890         struct hci_conn *acl;
 891
 892         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 893                 return ERR_PTR(-EOPNOTSUPP);
 894
 895         acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
 896         if (!acl) {
 897                 acl = hci_conn_add(hdev, ACL_LINK, dst, HCI_ROLE_MASTER);
 898                 if (!acl)
 899                         return ERR_PTR(-ENOMEM);
 900         }
 901
 902         hci_conn_hold(acl);
 903
 904         if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
 905                 acl->sec_level = BT_SECURITY_LOW;
 906                 acl->pending_sec_level = sec_level;
 907                 acl->auth_type = auth_type;
 908                 hci_acl_create_connection(acl);
 909         }
 910
 911         return acl;
 912 }
 913
 914 struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type, bdaddr_t *dst,
 915                                  __u16 setting)
 916 {
 917         struct hci_conn *acl;
 918         struct hci_conn *sco;
 919
 920         acl = hci_connect_acl(hdev, dst, BT_SECURITY_LOW, HCI_AT_NO_BONDING);
 921         if (IS_ERR(acl))
 922                 return acl;
 923
 924         sco = hci_conn_hash_lookup_ba(hdev, type, dst);
 925         if (!sco) {
 926                 sco = hci_conn_add(hdev, type, dst, HCI_ROLE_MASTER);
 927                 if (!sco) {
 928                         hci_conn_drop(acl);
 929                         return ERR_PTR(-ENOMEM);
 930                 }
 931         }
 932
 933         acl->link = sco;
 934         sco->link = acl;
 935
 936         hci_conn_hold(sco);
 937
 938         sco->setting = setting;
 939
 940         if (acl->state == BT_CONNECTED &&
 941             (sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
 942                 set_bit(HCI_CONN_POWER_SAVE, &acl->flags);
 943                 hci_conn_enter_active_mode(acl, BT_POWER_FORCE_ACTIVE_ON);
 944
 945                 if (test_bit(HCI_CONN_MODE_CHANGE_PEND, &acl->flags)) {
 946                         /* defer SCO setup until mode change completed */
 947                         set_bit(HCI_CONN_SCO_SETUP_PEND, &acl->flags);
 948                         return sco;
 949                 }
 950
 951                 hci_sco_setup(acl, 0x00);
 952         }
 953
 954         return sco;
 955 }
 956
 957 /* Check link security requirement */
 958 int hci_conn_check_link_mode(struct hci_conn *conn)
 959 {
 960         BT_DBG("hcon %p", conn);
 961
 962         /* In Secure Connections Only mode, it is required that Secure
 963          * Connections is used and the link is encrypted with AES-CCM
 964          * using a P-256 authenticated combination key.
 965          */
 966         if (test_bit(HCI_SC_ONLY, &conn->hdev->flags)) {
 967                 if (!hci_conn_sc_enabled(conn) ||
 968                     !test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
 969                     conn->key_type != HCI_LK_AUTH_COMBINATION_P256)
 970                         return 0;
 971         }
 972
 973         if (hci_conn_ssp_enabled(conn) &&
 974             !test_bit(HCI_CONN_ENCRYPT, &conn->flags))
 975                 return 0;
 976
 977         return 1;
 978 }
 979
 980 /* Authenticate remote device */
 981 static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 982 {
 983         BT_DBG("hcon %p", conn);
 984
 985         if (conn->pending_sec_level > sec_level)
 986                 sec_level = conn->pending_sec_level;
 987
 988         if (sec_level > conn->sec_level)
 989                 conn->pending_sec_level = sec_level;
 990         else if (test_bit(HCI_CONN_AUTH, &conn->flags))
 991                 return 1;
 992
 993         /* Make sure we preserve an existing MITM requirement*/
 994         auth_type |= (conn->auth_type & 0x01);
 995
 996         conn->auth_type = auth_type;
 997
 998         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
 999                 struct hci_cp_auth_requested cp;
1000
1001                 cp.handle = cpu_to_le16(conn->handle);
1002                 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
1003                              sizeof(cp), &cp);
1004
1005                 /* If we're already encrypted set the REAUTH_PEND flag,
1006                  * otherwise set the ENCRYPT_PEND.
1007                  */
1008                 if (test_bit(HCI_CONN_ENCRYPT, &conn->flags))
1009                         set_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
1010                 else
1011                         set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
1012         }
1013
1014         return 0;
1015 }
1016
1017 /* Encrypt the the link */
1018 static void hci_conn_encrypt(struct hci_conn *conn)
1019 {
1020         BT_DBG("hcon %p", conn);
1021
1022         if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
1023                 struct hci_cp_set_conn_encrypt cp;
1024                 cp.handle  = cpu_to_le16(conn->handle);
1025                 cp.encrypt = 0x01;
1026                 hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
1027                              &cp);
1028         }
1029 }
1030
1031 /* Enable security */
1032 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type,
1033                       bool initiator)
1034 {
1035         BT_DBG("hcon %p", conn);
1036
1037         if (conn->type == LE_LINK)
1038                 return smp_conn_security(conn, sec_level);
1039
1040         /* For sdp we don't need the link key. */
1041         if (sec_level == BT_SECURITY_SDP)
1042                 return 1;
1043
1044         /* For non 2.1 devices and low security level we don't need the link
1045            key. */
1046         if (sec_level == BT_SECURITY_LOW && !hci_conn_ssp_enabled(conn))
1047                 return 1;
1048
1049         /* For other security levels we need the link key. */
1050         if (!test_bit(HCI_CONN_AUTH, &conn->flags))
1051                 goto auth;
1052
1053         /* An authenticated FIPS approved combination key has sufficient
1054          * security for security level 4. */
1055         if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256 &&
1056             sec_level == BT_SECURITY_FIPS)
1057                 goto encrypt;
1058
1059         /* An authenticated combination key has sufficient security for
1060            security level 3. */
1061         if ((conn->key_type == HCI_LK_AUTH_COMBINATION_P192 ||
1062              conn->key_type == HCI_LK_AUTH_COMBINATION_P256) &&
1063             sec_level == BT_SECURITY_HIGH)
1064                 goto encrypt;
1065
1066         /* An unauthenticated combination key has sufficient security for
1067            security level 1 and 2. */
1068         if ((conn->key_type == HCI_LK_UNAUTH_COMBINATION_P192 ||
1069              conn->key_type == HCI_LK_UNAUTH_COMBINATION_P256) &&
1070             (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW))
1071                 goto encrypt;
1072
1073         /* A combination key has always sufficient security for the security
1074            levels 1 or 2. High security level requires the combination key
1075            is generated using maximum PIN code length (16).
1076            For pre 2.1 units. */
1077         if (conn->key_type == HCI_LK_COMBINATION &&
1078             (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW ||
1079              conn->pin_length == 16))
1080                 goto encrypt;
1081
1082 auth:
1083         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags))
1084                 return 0;
1085
1086         if (initiator)
1087                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
1088
1089         if (!hci_conn_auth(conn, sec_level, auth_type))
1090                 return 0;
1091
1092 encrypt:
1093         if (test_bit(HCI_CONN_ENCRYPT, &conn->flags))
1094                 return 1;
1095
1096         hci_conn_encrypt(conn);
1097         return 0;
1098 }
1099 EXPORT_SYMBOL(hci_conn_security);
1100
1101 /* Check secure link requirement */
1102 int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level)
1103 {
1104         BT_DBG("hcon %p", conn);
1105
1106         /* Accept if non-secure or higher security level is required */
1107         if (sec_level != BT_SECURITY_HIGH && sec_level != BT_SECURITY_FIPS)
1108                 return 1;
1109
1110         /* Accept if secure or higher security level is already present */
1111         if (conn->sec_level == BT_SECURITY_HIGH ||
1112             conn->sec_level == BT_SECURITY_FIPS)
1113                 return 1;
1114
1115         /* Reject not secure link */
1116         return 0;
1117 }
1118 EXPORT_SYMBOL(hci_conn_check_secure);
1119 #ifdef CONFIG_TIZEN_WIP
1120 /* Change link key */
1121 int hci_conn_change_link_key(struct hci_conn *conn)
1122 {
1123         BT_DBG("hcon %p", conn);
1124
1125         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
1126                 struct hci_cp_change_conn_link_key cp;
1127                 cp.handle = cpu_to_le16(conn->handle);
1128                 hci_send_cmd(conn->hdev, HCI_OP_CHANGE_CONN_LINK_KEY,
1129                              sizeof(cp), &cp);
1130         }
1131
1132         return 0;
1133 }
1134 #endif
1135 /* Switch role */
1136 int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
1137 {
1138         BT_DBG("hcon %p", conn);
1139
1140         if (role == conn->role)
1141                 return 1;
1142
1143         if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->flags)) {
1144                 struct hci_cp_switch_role cp;
1145                 bacpy(&cp.bdaddr, &conn->dst);
1146                 cp.role = role;
1147                 hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
1148         }
1149
1150         return 0;
1151 }
1152 EXPORT_SYMBOL(hci_conn_switch_role);
1153
1154 #ifdef CONFIG_TIZEN_WIP
1155 /* Change supervision timeout */
1156 int hci_conn_change_supervision_timeout(struct hci_conn *conn, __u16 timeout)
1157 {
1158         struct hci_cp_write_link_supervision_timeout cp;
1159
1160         if (!((get_link_mode(conn)) & HCI_LM_MASTER))
1161                 return 1;
1162
1163         if (conn->handle == 0)
1164                 return 1;
1165
1166         memset(&cp, 0, sizeof(cp));
1167         cp.handle  = cpu_to_le16(conn->handle);
1168         cp.timeout = cpu_to_le16(timeout);
1169
1170         if (hci_send_cmd(conn->hdev, HCI_OP_WRITE_LINK_SUPERVISION_TIMEOUT,
1171                      sizeof(cp), &cp) < 0)
1172                 BT_ERR("HCI_OP_WRITE_LINK_SUPERVISION_TIMEOUT is failed");
1173
1174         return 0;
1175 }
1176
1177 int hci_le_set_data_length(struct hci_conn *conn, u16 tx_octets, u16 tx_time)
1178 {
1179         struct hci_dev *hdev = conn->hdev;
1180         struct hci_conn_params *params;
1181         struct hci_cp_le_set_data_len cp;
1182
1183         hci_dev_lock(hdev);
1184
1185         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
1186         if (params) {
1187                 params->max_tx_octets = tx_octets;
1188                 params->max_tx_time = tx_time;
1189         }
1190
1191         hci_dev_unlock(hdev);
1192
1193         memset(&cp, 0, sizeof(cp));
1194         cp.handle = cpu_to_le16(conn->handle);
1195         cp.tx_len = cpu_to_le16(tx_octets);
1196         cp.tx_time = cpu_to_le16(tx_time);
1197
1198         hci_send_cmd(hdev, HCI_OP_LE_SET_DATA_LEN, sizeof(cp), &cp);
1199
1200         if (params)
1201                 return 0x01;
1202
1203         return 0x00;
1204 }
1205 #endif
1206
1207 /* Enter active mode */
1208 void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
1209 {
1210         struct hci_dev *hdev = conn->hdev;
1211
1212         BT_DBG("hcon %p mode %d", conn, conn->mode);
1213
1214         if (conn->mode != HCI_CM_SNIFF)
1215                 goto timer;
1216
1217         if (!test_bit(HCI_CONN_POWER_SAVE, &conn->flags) && !force_active)
1218                 goto timer;
1219
1220         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
1221                 struct hci_cp_exit_sniff_mode cp;
1222                 cp.handle = cpu_to_le16(conn->handle);
1223                 hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
1224         }
1225
1226 timer:
1227 #ifdef CONFIG_TIZEN_WIP /* Sniff timer cancel */
1228         if (hdev->idle_timeout > 0) {
1229                 cancel_delayed_work(&conn->idle_work);
1230                 queue_delayed_work(hdev->workqueue, &conn->idle_work,
1231                                    msecs_to_jiffies(hdev->idle_timeout));
1232         }
1233 #else
1234         if (hdev->idle_timeout > 0)
1235                 queue_delayed_work(hdev->workqueue, &conn->idle_work,
1236                                    msecs_to_jiffies(hdev->idle_timeout));
1237 #endif /* Sniff timer cancel */
1238 }
1239
1240 /* Drop all connection on the device */
1241 void hci_conn_hash_flush(struct hci_dev *hdev)
1242 {
1243         struct hci_conn_hash *h = &hdev->conn_hash;
1244         struct hci_conn *c, *n;
1245
1246         BT_DBG("hdev %s", hdev->name);
1247
1248         list_for_each_entry_safe(c, n, &h->list, list) {
1249                 c->state = BT_CLOSED;
1250
1251                 hci_proto_disconn_cfm(c, HCI_ERROR_LOCAL_HOST_TERM);
1252                 hci_conn_del(c);
1253         }
1254 }
1255
1256 /* Check pending connect attempts */
1257 void hci_conn_check_pending(struct hci_dev *hdev)
1258 {
1259         struct hci_conn *conn;
1260
1261         BT_DBG("hdev %s", hdev->name);
1262
1263         hci_dev_lock(hdev);
1264
1265         conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
1266         if (conn)
1267                 hci_acl_create_connection(conn);
1268
1269         hci_dev_unlock(hdev);
1270 }
1271
1272 #ifndef CONFIG_TIZEN_WIP
1273 static u32 get_link_mode(struct hci_conn *conn)
1274 #else
1275 u32 get_link_mode(struct hci_conn *conn)
1276 #endif
1277 {
1278         u32 link_mode = 0;
1279
1280         if (conn->role == HCI_ROLE_MASTER)
1281                 link_mode |= HCI_LM_MASTER;
1282
1283         if (test_bit(HCI_CONN_ENCRYPT, &conn->flags))
1284                 link_mode |= HCI_LM_ENCRYPT;
1285
1286         if (test_bit(HCI_CONN_AUTH, &conn->flags))
1287                 link_mode |= HCI_LM_AUTH;
1288
1289         if (test_bit(HCI_CONN_SECURE, &conn->flags))
1290                 link_mode |= HCI_LM_SECURE;
1291
1292         if (test_bit(HCI_CONN_FIPS, &conn->flags))
1293                 link_mode |= HCI_LM_FIPS;
1294
1295         return link_mode;
1296 }
1297
1298 int hci_get_conn_list(void __user *arg)
1299 {
1300         struct hci_conn *c;
1301         struct hci_conn_list_req req, *cl;
1302         struct hci_conn_info *ci;
1303         struct hci_dev *hdev;
1304         int n = 0, size, err;
1305
1306         if (copy_from_user(&req, arg, sizeof(req)))
1307                 return -EFAULT;
1308
1309         if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
1310                 return -EINVAL;
1311
1312         size = sizeof(req) + req.conn_num * sizeof(*ci);
1313
1314         cl = kmalloc(size, GFP_KERNEL);
1315         if (!cl)
1316                 return -ENOMEM;
1317
1318         hdev = hci_dev_get(req.dev_id);
1319         if (!hdev) {
1320                 kfree(cl);
1321                 return -ENODEV;
1322         }
1323
1324         ci = cl->conn_info;
1325
1326         hci_dev_lock(hdev);
1327         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1328                 bacpy(&(ci + n)->bdaddr, &c->dst);
1329                 (ci + n)->handle = c->handle;
1330                 (ci + n)->type  = c->type;
1331                 (ci + n)->out   = c->out;
1332                 (ci + n)->state = c->state;
1333                 (ci + n)->link_mode = get_link_mode(c);
1334                 if (++n >= req.conn_num)
1335                         break;
1336         }
1337         hci_dev_unlock(hdev);
1338
1339         cl->dev_id = hdev->id;
1340         cl->conn_num = n;
1341         size = sizeof(req) + n * sizeof(*ci);
1342
1343         hci_dev_put(hdev);
1344
1345         err = copy_to_user(arg, cl, size);
1346         kfree(cl);
1347
1348         return err ? -EFAULT : 0;
1349 }
1350
1351 int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
1352 {
1353         struct hci_conn_info_req req;
1354         struct hci_conn_info ci;
1355         struct hci_conn *conn;
1356         char __user *ptr = arg + sizeof(req);
1357
1358         if (copy_from_user(&req, arg, sizeof(req)))
1359                 return -EFAULT;
1360
1361         hci_dev_lock(hdev);
1362         conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
1363         if (conn) {
1364                 bacpy(&ci.bdaddr, &conn->dst);
1365                 ci.handle = conn->handle;
1366                 ci.type  = conn->type;
1367                 ci.out   = conn->out;
1368                 ci.state = conn->state;
1369                 ci.link_mode = get_link_mode(conn);
1370         }
1371         hci_dev_unlock(hdev);
1372
1373         if (!conn)
1374                 return -ENOENT;
1375
1376         return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
1377 }
1378
1379 int hci_get_auth_info(struct hci_dev *hdev, void __user *arg)
1380 {
1381         struct hci_auth_info_req req;
1382         struct hci_conn *conn;
1383
1384         if (copy_from_user(&req, arg, sizeof(req)))
1385                 return -EFAULT;
1386
1387         hci_dev_lock(hdev);
1388         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr);
1389         if (conn)
1390                 req.type = conn->auth_type;
1391         hci_dev_unlock(hdev);
1392
1393         if (!conn)
1394                 return -ENOENT;
1395
1396         return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0;
1397 }
1398
1399 struct hci_chan *hci_chan_create(struct hci_conn *conn)
1400 {
1401         struct hci_dev *hdev = conn->hdev;
1402         struct hci_chan *chan;
1403
1404         BT_DBG("%s hcon %p", hdev->name, conn);
1405
1406         if (test_bit(HCI_CONN_DROP, &conn->flags)) {
1407                 BT_DBG("Refusing to create new hci_chan");
1408                 return NULL;
1409         }
1410
1411         chan = kzalloc(sizeof(*chan), GFP_KERNEL);
1412         if (!chan)
1413                 return NULL;
1414
1415         chan->conn = hci_conn_get(conn);
1416         skb_queue_head_init(&chan->data_q);
1417         chan->state = BT_CONNECTED;
1418
1419         list_add_rcu(&chan->list, &conn->chan_list);
1420
1421         return chan;
1422 }
1423
1424 void hci_chan_del(struct hci_chan *chan)
1425 {
1426         struct hci_conn *conn = chan->conn;
1427         struct hci_dev *hdev = conn->hdev;
1428
1429         BT_DBG("%s hcon %p chan %p", hdev->name, conn, chan);
1430
1431         list_del_rcu(&chan->list);
1432
1433         synchronize_rcu();
1434
1435         /* Prevent new hci_chan's to be created for this hci_conn */
1436         set_bit(HCI_CONN_DROP, &conn->flags);
1437
1438         hci_conn_put(conn);
1439
1440         skb_queue_purge(&chan->data_q);
1441         kfree(chan);
1442 }
1443
1444 void hci_chan_list_flush(struct hci_conn *conn)
1445 {
1446         struct hci_chan *chan, *n;
1447
1448         BT_DBG("hcon %p", conn);
1449
1450         list_for_each_entry_safe(chan, n, &conn->chan_list, list)
1451                 hci_chan_del(chan);
1452 }
1453
1454 static struct hci_chan *__hci_chan_lookup_handle(struct hci_conn *hcon,
1455                                                  __u16 handle)
1456 {
1457         struct hci_chan *hchan;
1458
1459         list_for_each_entry(hchan, &hcon->chan_list, list) {
1460                 if (hchan->handle == handle)
1461                         return hchan;
1462         }
1463
1464         return NULL;
1465 }
1466
1467 struct hci_chan *hci_chan_lookup_handle(struct hci_dev *hdev, __u16 handle)
1468 {
1469         struct hci_conn_hash *h = &hdev->conn_hash;
1470         struct hci_conn *hcon;
1471         struct hci_chan *hchan = NULL;
1472
1473         rcu_read_lock();
1474
1475         list_for_each_entry_rcu(hcon, &h->list, list) {
1476                 hchan = __hci_chan_lookup_handle(hcon, handle);
1477                 if (hchan)
1478                         break;
1479         }
1480
1481         rcu_read_unlock();
1482
1483         return hchan;
1484 }