]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blame - net/bluetooth/l2cap_core.c
projects / mirror_ubuntu-bionic-kernel.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
ipv4: Return EINVAL when ping_group_range sysctl doesn't map to user ns
[mirror_ubuntu-bionic-kernel.git] / net / bluetooth / l2cap_core.c
CommitLineData
8e87d142 1/*
1da177e4
LT		 2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
ce5706bd 4 Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
5d8868ff 5 Copyright (C) 2010 Google Inc.
590051de 6 Copyright (C) 2011 ProFUSION Embedded Systems
422e925b 7 Copyright (c) 2012 Code Aurora Forum. All rights reserved.
1da177e4
LT		 8
9 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
10
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License version 2 as
13 published by the Free Software Foundation;
14
15 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
16 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
18 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 19 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
20 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
21 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 22 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
23
8e87d142
YH		 24 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
25 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 26 SOFTWARE IS DISCLAIMED.
27*/
28
bb58f747 29/* Bluetooth L2CAP core. */
1da177e4 30
1da177e4
LT		 31#include <linux/module.h>
32
aef7d97c 33#include <linux/debugfs.h>
fcc203c3 34#include <linux/crc16.h>
dbb50887 35#include <linux/filter.h>
1da177e4
LT		 36
37#include <net/bluetooth/bluetooth.h>
38#include <net/bluetooth/hci_core.h>
39#include <net/bluetooth/l2cap.h>
7ef9fbf0 40
ac4b7236 41#include "smp.h"
7024728e 42#include "a2mp.h"
7ef9fbf0 43#include "amp.h"
1da177e4 44
0f1bfe4e
JH		 45#define LE_FLOWCTL_MAX_CREDITS 65535
46
d1de6d46 47bool disable_ertm;
f0709e03 48
547d1032 49static u32 l2cap_feat_mask = L2CAP_FEAT_FIXED_CHAN | L2CAP_FEAT_UCD;
1da177e4 50
b5ad8b7f
JB		 51static LIST_HEAD(chan_list);
52static DEFINE_RWLOCK(chan_list_lock);
1da177e4 53
f15b8ecf
JH		 54static u16 le_max_credits = L2CAP_LE_MAX_CREDITS;
55static u16 le_default_mps = L2CAP_LE_DEFAULT_MPS;
56
1da177e4 57static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
2d792818 58 u8 code, u8 ident, u16 dlen, void *data);
4519de9a 59static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
2d792818 60 void *data);
e860d2c9 61static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size);
5e4e3972 62static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err);
1da177e4 63
d660366d 64static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
2d792818 65 struct sk_buff_head *skbs, u8 event);
608bcc6d 66
a250e048 67static inline u8 bdaddr_type(u8 link_type, u8 bdaddr_type)
4f1654e0 68{
a250e048
JH		 69 if (link_type == LE_LINK) {
70 if (bdaddr_type == ADDR_LE_DEV_PUBLIC)
4f1654e0
MH		 71 return BDADDR_LE_PUBLIC;
72 else
73 return BDADDR_LE_RANDOM;
74 }
75
76 return BDADDR_BREDR;
77}
78
a250e048
JH		 79static inline u8 bdaddr_src_type(struct hci_conn *hcon)
80{
81 return bdaddr_type(hcon->type, hcon->src_type);
82}
83
84static inline u8 bdaddr_dst_type(struct hci_conn *hcon)
85{
86 return bdaddr_type(hcon->type, hcon->dst_type);
87}
88
0139418c 89/* ---- L2CAP channels ---- */
71ba0e56 90
2d792818
GP		 91static struct l2cap_chan *__l2cap_get_chan_by_dcid(struct l2cap_conn *conn,
92 u16 cid)
0139418c 93{
3df91ea2 94 struct l2cap_chan *c;
3d57dc68 95
3df91ea2
AE		 96 list_for_each_entry(c, &conn->chan_l, list) {
97 if (c->dcid == cid)
98 return c;
0139418c 99 }
3df91ea2 100 return NULL;
0139418c
MH		 101}
102
2d792818
GP		 103static struct l2cap_chan *__l2cap_get_chan_by_scid(struct l2cap_conn *conn,
104 u16 cid)
0139418c 105{
3df91ea2 106 struct l2cap_chan *c;
3d57dc68 107
3df91ea2
AE		 108 list_for_each_entry(c, &conn->chan_l, list) {
109 if (c->scid == cid)
110 return c;
0139418c 111 }
3df91ea2 112 return NULL;
0139418c
MH		 113}
114
115/* Find channel with given SCID.
ef191ade 116 * Returns locked channel. */
2d792818
GP		 117static struct l2cap_chan *l2cap_get_chan_by_scid(struct l2cap_conn *conn,
118 u16 cid)
0139418c 119{
48454079 120 struct l2cap_chan *c;
baa7e1fa 121
3df91ea2 122 mutex_lock(&conn->chan_lock);
baa7e1fa 123 c = __l2cap_get_chan_by_scid(conn, cid);
ef191ade
MM		 124 if (c)
125 l2cap_chan_lock(c);
3df91ea2
AE		 126 mutex_unlock(&conn->chan_lock);
127
48454079 128 return c;
0139418c
MH		 129}
130
b1a130b7
MM		 131/* Find channel with given DCID.
132 * Returns locked channel.
133 */
134static struct l2cap_chan *l2cap_get_chan_by_dcid(struct l2cap_conn *conn,
135 u16 cid)
136{
137 struct l2cap_chan *c;
138
139 mutex_lock(&conn->chan_lock);
140 c = __l2cap_get_chan_by_dcid(conn, cid);
141 if (c)
142 l2cap_chan_lock(c);
143 mutex_unlock(&conn->chan_lock);
144
145 return c;
146}
147
2d792818
GP		 148static struct l2cap_chan *__l2cap_get_chan_by_ident(struct l2cap_conn *conn,
149 u8 ident)
0139418c 150{
3df91ea2 151 struct l2cap_chan *c;
3d57dc68 152
3df91ea2
AE		 153 list_for_each_entry(c, &conn->chan_l, list) {
154 if (c->ident == ident)
155 return c;
0139418c 156 }
3df91ea2 157 return NULL;
0139418c
MH		 158}
159
5b155ef9
MM		 160static struct l2cap_chan *l2cap_get_chan_by_ident(struct l2cap_conn *conn,
161 u8 ident)
162{
163 struct l2cap_chan *c;
164
165 mutex_lock(&conn->chan_lock);
166 c = __l2cap_get_chan_by_ident(conn, ident);
167 if (c)
168 l2cap_chan_lock(c);
169 mutex_unlock(&conn->chan_lock);
170
171 return c;
172}
173
23691d75 174static struct l2cap_chan *__l2cap_global_chan_by_addr(__le16 psm, bdaddr_t *src)
9e4425ff 175{
23691d75 176 struct l2cap_chan *c;
9e4425ff 177
23691d75 178 list_for_each_entry(c, &chan_list, global_l) {
7eafc59e 179 if (c->sport == psm && !bacmp(&c->src, src))
250938cb 180 return c;
9e4425ff 181 }
250938cb 182 return NULL;
9e4425ff
GP		 183}
184
185int l2cap_add_psm(struct l2cap_chan *chan, bdaddr_t *src, __le16 psm)
186{
73b2ec18
GP		 187 int err;
188
333055f2 189 write_lock(&chan_list_lock);
9e4425ff 190
23691d75 191 if (psm && __l2cap_global_chan_by_addr(psm, src)) {
73b2ec18
GP		 192 err = -EADDRINUSE;
193 goto done;
9e4425ff
GP		 194 }
195
73b2ec18
GP		 196 if (psm) {
197 chan->psm = psm;
198 chan->sport = psm;
199 err = 0;
200 } else {
92594a51
JH		 201 u16 p, start, end, incr;
202
203 if (chan->src_type == BDADDR_BREDR) {
204 start = L2CAP_PSM_DYN_START;
205 end = L2CAP_PSM_AUTO_END;
206 incr = 2;
207 } else {
208 start = L2CAP_PSM_LE_DYN_START;
209 end = L2CAP_PSM_LE_DYN_END;
210 incr = 1;
211 }
73b2ec18
GP		 212
213 err = -EINVAL;
92594a51 214 for (p = start; p <= end; p += incr)
23691d75 215 if (!__l2cap_global_chan_by_addr(cpu_to_le16(p), src)) {
73b2ec18
GP		 216 chan->psm = cpu_to_le16(p);
217 chan->sport = cpu_to_le16(p);
218 err = 0;
219 break;
220 }
221 }
9e4425ff 222
73b2ec18 223done:
333055f2 224 write_unlock(&chan_list_lock);
73b2ec18 225 return err;
9e4425ff 226}
6b8d4a6a 227EXPORT_SYMBOL_GPL(l2cap_add_psm);
9e4425ff
GP		 228
229int l2cap_add_scid(struct l2cap_chan *chan, __u16 scid)
230{
333055f2 231 write_lock(&chan_list_lock);
9e4425ff 232
14824308
JH		 233 /* Override the defaults (which are for conn-oriented) */
234 chan->omtu = L2CAP_DEFAULT_MTU;
235 chan->chan_type = L2CAP_CHAN_FIXED;
236
9e4425ff
GP		 237 chan->scid = scid;
238
333055f2 239 write_unlock(&chan_list_lock);
9e4425ff
GP		 240
241 return 0;
242}
243
baa7e1fa 244static u16 l2cap_alloc_cid(struct l2cap_conn *conn)
0139418c 245{
e77af755 246 u16 cid, dyn_end;
0139418c 247
e77af755
JH		 248 if (conn->hcon->type == LE_LINK)
249 dyn_end = L2CAP_CID_LE_DYN_END;
250 else
251 dyn_end = L2CAP_CID_DYN_END;
252
ab0c127f 253 for (cid = L2CAP_CID_DYN_START; cid <= dyn_end; cid++) {
baa7e1fa 254 if (!__l2cap_get_chan_by_scid(conn, cid))
0139418c
MH		 255 return cid;
256 }
257
258 return 0;
259}
260
f93fa273 261static void l2cap_state_change(struct l2cap_chan *chan, int state)
89bc500e 262{
42d2d87c 263 BT_DBG("chan %p %s -> %s", chan, state_to_string(chan->state),
2d792818 264 state_to_string(state));
badaaa00 265
89bc500e 266 chan->state = state;
53f52121 267 chan->ops->state_change(chan, state, 0);
89bc500e
GP		 268}
269
f8e73017
GP		 270static inline void l2cap_state_change_and_error(struct l2cap_chan *chan,
271 int state, int err)
2e0052e4 272{
f8e73017 273 chan->state = state;
53f52121 274 chan->ops->state_change(chan, chan->state, err);
2e0052e4
AE		 275}
276
277static inline void l2cap_chan_set_err(struct l2cap_chan *chan, int err)
278{
f8e73017 279 chan->ops->state_change(chan, chan->state, err);
2e0052e4
AE		 280}
281
4239d16f
MM		 282static void __set_retrans_timer(struct l2cap_chan *chan)
283{
284 if (!delayed_work_pending(&chan->monitor_timer) &&
285 chan->retrans_timeout) {
286 l2cap_set_timer(chan, &chan->retrans_timer,
287 msecs_to_jiffies(chan->retrans_timeout));
288 }
289}
290
291static void __set_monitor_timer(struct l2cap_chan *chan)
292{
293 __clear_retrans_timer(chan);
294 if (chan->monitor_timeout) {
295 l2cap_set_timer(chan, &chan->monitor_timer,
296 msecs_to_jiffies(chan->monitor_timeout));
297 }
298}
299
608bcc6d
MM		 300static struct sk_buff *l2cap_ertm_seq_in_queue(struct sk_buff_head *head,
301 u16 seq)
302{
303 struct sk_buff *skb;
304
305 skb_queue_walk(head, skb) {
a4368ff3 306 if (bt_cb(skb)->l2cap.txseq == seq)
608bcc6d
MM		 307 return skb;
308 }
309
310 return NULL;
311}
312
3c588192
MM		 313/* ---- L2CAP sequence number lists ---- */
314
315/* For ERTM, ordered lists of sequence numbers must be tracked for
316 * SREJ requests that are received and for frames that are to be
317 * retransmitted. These seq_list functions implement a singly-linked
318 * list in an array, where membership in the list can also be checked
319 * in constant time. Items can also be added to the tail of the list
320 * and removed from the head in constant time, without further memory
321 * allocs or frees.
322 */
323
324static int l2cap_seq_list_init(struct l2cap_seq_list *seq_list, u16 size)
325{
326 size_t alloc_size, i;
327
328 /* Allocated size is a power of 2 to map sequence numbers
329 * (which may be up to 14 bits) in to a smaller array that is
330 * sized for the negotiated ERTM transmit windows.
331 */
332 alloc_size = roundup_pow_of_two(size);
333
334 seq_list->list = kmalloc(sizeof(u16) * alloc_size, GFP_KERNEL);
335 if (!seq_list->list)
336 return -ENOMEM;
337
338 seq_list->mask = alloc_size - 1;
339 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
340 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
341 for (i = 0; i < alloc_size; i++)
342 seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR;
343
344 return 0;
345}
346
347static inline void l2cap_seq_list_free(struct l2cap_seq_list *seq_list)
348{
349 kfree(seq_list->list);
350}
351
352static inline bool l2cap_seq_list_contains(struct l2cap_seq_list *seq_list,
353 u16 seq)
354{
355 /* Constant-time check for list membership */
356 return seq_list->list[seq & seq_list->mask] != L2CAP_SEQ_LIST_CLEAR;
357}
358
03a0c5d6 359static inline u16 l2cap_seq_list_pop(struct l2cap_seq_list *seq_list)
3c588192 360{
03a0c5d6 361 u16 seq = seq_list->head;
3c588192
MM		 362 u16 mask = seq_list->mask;
363
03a0c5d6
JH		 364 seq_list->head = seq_list->list[seq & mask];
365 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_CLEAR;
366
367 if (seq_list->head == L2CAP_SEQ_LIST_TAIL) {
368 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
369 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
3c588192 370 }
3c588192 371
03a0c5d6 372 return seq;
3c588192
MM		 373}
374
375static void l2cap_seq_list_clear(struct l2cap_seq_list *seq_list)
376{
f522ae36 377 u16 i;
3c588192 378
f522ae36
GP		 379 if (seq_list->head == L2CAP_SEQ_LIST_CLEAR)
380 return;
381
382 for (i = 0; i <= seq_list->mask; i++)
383 seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR;
384
385 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
386 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
3c588192
MM		 387}
388
389static void l2cap_seq_list_append(struct l2cap_seq_list *seq_list, u16 seq)
390{
391 u16 mask = seq_list->mask;
392
393 /* All appends happen in constant time */
394
f522ae36
GP		 395 if (seq_list->list[seq & mask] != L2CAP_SEQ_LIST_CLEAR)
396 return;
3c588192 397
f522ae36
GP		 398 if (seq_list->tail == L2CAP_SEQ_LIST_CLEAR)
399 seq_list->head = seq;
400 else
401 seq_list->list[seq_list->tail & mask] = seq;
402
403 seq_list->tail = seq;
404 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_TAIL;
3c588192
MM		 405}
406
721c4181 407static void l2cap_chan_timeout(struct work_struct *work)
ab07801d 408{
721c4181 409 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
2d792818 410 chan_timer.work);
3df91ea2 411 struct l2cap_conn *conn = chan->conn;
ab07801d
GP		 412 int reason;
413
e05dcc32 414 BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
ab07801d 415
3df91ea2 416 mutex_lock(&conn->chan_lock);
6be36555 417 l2cap_chan_lock(chan);
ab07801d 418
89bc500e 419 if (chan->state == BT_CONNECTED || chan->state == BT_CONFIG)
ab07801d 420 reason = ECONNREFUSED;
89bc500e 421 else if (chan->state == BT_CONNECT &&
2d792818 422 chan->sec_level != BT_SECURITY_SDP)
ab07801d
GP		 423 reason = ECONNREFUSED;
424 else
425 reason = ETIMEDOUT;
426
0f852724 427 l2cap_chan_close(chan, reason);
ab07801d 428
6be36555 429 l2cap_chan_unlock(chan);
ab07801d 430
80b98027 431 chan->ops->close(chan);
3df91ea2
AE		 432 mutex_unlock(&conn->chan_lock);
433
371fd835 434 l2cap_chan_put(chan);
ab07801d
GP		 435}
436
eef1d9b6 437struct l2cap_chan *l2cap_chan_create(void)
48454079
GP		 438{
439 struct l2cap_chan *chan;
440
441 chan = kzalloc(sizeof(*chan), GFP_ATOMIC);
442 if (!chan)
443 return NULL;
444
c03b355e
AE		 445 mutex_init(&chan->lock);
446
ff714119
JH		 447 /* Set default lock nesting level */
448 atomic_set(&chan->nesting, L2CAP_NESTING_NORMAL);
449
333055f2 450 write_lock(&chan_list_lock);
23691d75 451 list_add(&chan->global_l, &chan_list);
333055f2 452 write_unlock(&chan_list_lock);
23691d75 453
721c4181 454 INIT_DELAYED_WORK(&chan->chan_timer, l2cap_chan_timeout);
ab07801d 455
89bc500e
GP		 456 chan->state = BT_OPEN;
457
144ad330 458 kref_init(&chan->kref);
71ba0e56 459
2827011f
MM		 460 /* This flag is cleared in l2cap_chan_ready() */
461 set_bit(CONF_NOT_COMPLETE, &chan->conf_state);
462
eef1d9b6 463 BT_DBG("chan %p", chan);
abc545b8 464
48454079
GP		 465 return chan;
466}
6b8d4a6a 467EXPORT_SYMBOL_GPL(l2cap_chan_create);
48454079 468
144ad330 469static void l2cap_chan_destroy(struct kref *kref)
6ff5abbf 470{
144ad330
SS		 471 struct l2cap_chan *chan = container_of(kref, struct l2cap_chan, kref);
472
4af66c69
JK		 473 BT_DBG("chan %p", chan);
474
333055f2 475 write_lock(&chan_list_lock);
23691d75 476 list_del(&chan->global_l);
333055f2 477 write_unlock(&chan_list_lock);
23691d75 478
4af66c69 479 kfree(chan);
6ff5abbf
GP		 480}
481
30648372
JK		 482void l2cap_chan_hold(struct l2cap_chan *c)
483{
2c935bc5 484 BT_DBG("chan %p orig refcnt %d", c, kref_read(&c->kref));
30648372 485
144ad330 486 kref_get(&c->kref);
30648372
JK		 487}
488
489void l2cap_chan_put(struct l2cap_chan *c)
490{
2c935bc5 491 BT_DBG("chan %p orig refcnt %d", c, kref_read(&c->kref));
30648372 492
144ad330 493 kref_put(&c->kref, l2cap_chan_destroy);
30648372 494}
6b8d4a6a 495EXPORT_SYMBOL_GPL(l2cap_chan_put);
30648372 496
bd4b1653
AE		 497void l2cap_chan_set_defaults(struct l2cap_chan *chan)
498{
499 chan->fcs = L2CAP_FCS_CRC16;
500 chan->max_tx = L2CAP_DEFAULT_MAX_TX;
501 chan->tx_win = L2CAP_DEFAULT_TX_WINDOW;
502 chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
6a5e8165
JR		 503 chan->remote_max_tx = chan->max_tx;
504 chan->remote_tx_win = chan->tx_win;
c20f8e35 505 chan->ack_win = L2CAP_DEFAULT_TX_WINDOW;
bd4b1653 506 chan->sec_level = BT_SECURITY_LOW;
6a5e8165
JR		 507 chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
508 chan->retrans_timeout = L2CAP_DEFAULT_RETRANS_TO;
509 chan->monitor_timeout = L2CAP_DEFAULT_MONITOR_TO;
510 chan->conf_state = 0;
bd4b1653
AE		 511
512 set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
513}
6b8d4a6a 514EXPORT_SYMBOL_GPL(l2cap_chan_set_defaults);
bd4b1653 515
0ce43ce6 516static void l2cap_le_flowctl_init(struct l2cap_chan *chan)
38319713 517{
0ce43ce6
JH		 518 chan->sdu = NULL;
519 chan->sdu_last_frag = NULL;
520 chan->sdu_len = 0;
0cd75f7e 521 chan->tx_credits = 0;
f15b8ecf 522 chan->rx_credits = le_max_credits;
d1d79413 523 chan->mps = min_t(u16, chan->imtu, le_default_mps);
0ce43ce6
JH		 524
525 skb_queue_head_init(&chan->tx_q);
38319713
JH		 526}
527
93c3e8f5 528void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
0139418c 529{
af05b30b 530 BT_DBG("conn %p, psm 0x%2.2x, dcid 0x%4.4x", conn,
097db76c 531 __le16_to_cpu(chan->psm), chan->dcid);
0139418c 532
9f5a0d7b 533 conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
2950f21a 534
8c1d787b 535 chan->conn = conn;
0139418c 536
5491120e
AE		 537 switch (chan->chan_type) {
538 case L2CAP_CHAN_CONN_ORIENTED:
21626e62
JH		 539 /* Alloc CID for connection-oriented socket */
540 chan->scid = l2cap_alloc_cid(conn);
541 if (conn->hcon->type == ACL_LINK)
0c1bc5c6 542 chan->omtu = L2CAP_DEFAULT_MTU;
5491120e
AE		 543 break;
544
545 case L2CAP_CHAN_CONN_LESS:
0139418c 546 /* Connectionless socket */
fe4128e0
GP		 547 chan->scid = L2CAP_CID_CONN_LESS;
548 chan->dcid = L2CAP_CID_CONN_LESS;
0c1bc5c6 549 chan->omtu = L2CAP_DEFAULT_MTU;
5491120e
AE		 550 break;
551
2338a7e0
JH		 552 case L2CAP_CHAN_FIXED:
553 /* Caller will set CID and CID specific MTU values */
416fa752
AE		 554 break;
555
5491120e 556 default:
0139418c 557 /* Raw socket can send/recv signalling messages only */
fe4128e0
GP		 558 chan->scid = L2CAP_CID_SIGNALING;
559 chan->dcid = L2CAP_CID_SIGNALING;
0c1bc5c6 560 chan->omtu = L2CAP_DEFAULT_MTU;
0139418c
MH		 561 }
562
8f7975b1
AE		 563 chan->local_id = L2CAP_BESTEFFORT_ID;
564 chan->local_stype = L2CAP_SERV_BESTEFFORT;
565 chan->local_msdu = L2CAP_DEFAULT_MAX_SDU_SIZE;
566 chan->local_sdu_itime = L2CAP_DEFAULT_SDU_ITIME;
567 chan->local_acc_lat = L2CAP_DEFAULT_ACC_LAT;
8936fa6d 568 chan->local_flush_to = L2CAP_EFS_DEFAULT_FLUSH_TO;
8f7975b1 569
371fd835 570 l2cap_chan_hold(chan);
baa7e1fa 571
c16900cf
JH		 572 /* Only keep a reference for fixed channels if they requested it */
573 if (chan->chan_type != L2CAP_CHAN_FIXED ||
574 test_bit(FLAG_HOLD_HCI_CONN, &chan->flags))
575 hci_conn_hold(conn->hcon);
5ee9891d 576
3df91ea2 577 list_add(&chan->list, &conn->chan_l);
643162a8
AE		 578}
579
466f8004 580void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
643162a8
AE		 581{
582 mutex_lock(&conn->chan_lock);
583 __l2cap_chan_add(conn, chan);
3df91ea2 584 mutex_unlock(&conn->chan_lock);
0139418c
MH		 585}
586
466f8004 587void l2cap_chan_del(struct l2cap_chan *chan, int err)
0139418c 588{
8c1d787b 589 struct l2cap_conn *conn = chan->conn;
0139418c 590
c9b66675 591 __clear_chan_timer(chan);
0139418c 592
49d11741
JH		 593 BT_DBG("chan %p, conn %p, err %d, state %s", chan, conn, err,
594 state_to_string(chan->state));
0139418c 595
72847ce0
JH		 596 chan->ops->teardown(chan, err);
597
8e87d142 598 if (conn) {
56f60984 599 struct amp_mgr *mgr = conn->hcon->amp_mgr;
baa7e1fa 600 /* Delete from channel list */
3df91ea2 601 list_del(&chan->list);
3d57dc68 602
371fd835 603 l2cap_chan_put(chan);
baa7e1fa 604
8c1d787b 605 chan->conn = NULL;
3cabbfda 606
c16900cf
JH		 607 /* Reference was only held for non-fixed channels or
608 * fixed channels that explicitly requested it using the
609 * FLAG_HOLD_HCI_CONN flag.
610 */
611 if (chan->chan_type != L2CAP_CHAN_FIXED ||
612 test_bit(FLAG_HOLD_HCI_CONN, &chan->flags))
76a68ba0 613 hci_conn_drop(conn->hcon);
56f60984
AE		 614
615 if (mgr && mgr->bredr_chan == chan)
616 mgr->bredr_chan = NULL;
0139418c
MH		 617 }
618
419e08c1
AE		 619 if (chan->hs_hchan) {
620 struct hci_chan *hs_hchan = chan->hs_hchan;
621
622 BT_DBG("chan %p disconnect hs_hchan %p", chan, hs_hchan);
623 amp_disconnect_logical_link(hs_hchan);
624 }
625
2827011f 626 if (test_bit(CONF_NOT_COMPLETE, &chan->conf_state))
6ff5abbf 627 return;
2ead70b8 628
ee556f66
GP		 629 switch(chan->mode) {
630 case L2CAP_MODE_BASIC:
631 break;
c13ffa62 632
38319713 633 case L2CAP_MODE_LE_FLOWCTL:
177f8f2b 634 skb_queue_purge(&chan->tx_q);
38319713
JH		 635 break;
636
ee556f66 637 case L2CAP_MODE_ERTM:
1a09bcb9
GP		 638 __clear_retrans_timer(chan);
639 __clear_monitor_timer(chan);
640 __clear_ack_timer(chan);
c13ffa62 641
f1c6775b 642 skb_queue_purge(&chan->srej_q);
c13ffa62 643
3c588192
MM		 644 l2cap_seq_list_free(&chan->srej_list);
645 l2cap_seq_list_free(&chan->retrans_list);
ee556f66
GP		 646
647 /* fall through */
648
649 case L2CAP_MODE_STREAMING:
650 skb_queue_purge(&chan->tx_q);
651 break;
c13ffa62 652 }
ee556f66
GP		 653
654 return;
0139418c 655}
6b8d4a6a 656EXPORT_SYMBOL_GPL(l2cap_chan_del);
0139418c 657
f3d82d0c 658static void l2cap_conn_update_id_addr(struct work_struct *work)
387a33e3 659{
f3d82d0c
JH		 660 struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
661 id_addr_update_work);
662 struct hci_conn *hcon = conn->hcon;
387a33e3
JH		 663 struct l2cap_chan *chan;
664
665 mutex_lock(&conn->chan_lock);
666
667 list_for_each_entry(chan, &conn->chan_l, list) {
668 l2cap_chan_lock(chan);
669 bacpy(&chan->dst, &hcon->dst);
a250e048 670 chan->dst_type = bdaddr_dst_type(hcon);
387a33e3
JH		 671 l2cap_chan_unlock(chan);
672 }
673
674 mutex_unlock(&conn->chan_lock);
675}
676
27e2d4c8
JH		 677static void l2cap_chan_le_connect_reject(struct l2cap_chan *chan)
678{
679 struct l2cap_conn *conn = chan->conn;
680 struct l2cap_le_conn_rsp rsp;
681 u16 result;
682
683 if (test_bit(FLAG_DEFER_SETUP, &chan->flags))
684 result = L2CAP_CR_AUTHORIZATION;
685 else
686 result = L2CAP_CR_BAD_PSM;
687
688 l2cap_state_change(chan, BT_DISCONN);
689
690 rsp.dcid = cpu_to_le16(chan->scid);
691 rsp.mtu = cpu_to_le16(chan->imtu);
3916aed8 692 rsp.mps = cpu_to_le16(chan->mps);
0cd75f7e 693 rsp.credits = cpu_to_le16(chan->rx_credits);
27e2d4c8
JH		 694 rsp.result = cpu_to_le16(result);
695
696 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp),
697 &rsp);
698}
699
791d60f7
JH		 700static void l2cap_chan_connect_reject(struct l2cap_chan *chan)
701{
702 struct l2cap_conn *conn = chan->conn;
703 struct l2cap_conn_rsp rsp;
704 u16 result;
705
706 if (test_bit(FLAG_DEFER_SETUP, &chan->flags))
707 result = L2CAP_CR_SEC_BLOCK;
708 else
709 result = L2CAP_CR_BAD_PSM;
710
711 l2cap_state_change(chan, BT_DISCONN);
712
713 rsp.scid = cpu_to_le16(chan->dcid);
714 rsp.dcid = cpu_to_le16(chan->scid);
715 rsp.result = cpu_to_le16(result);
dcf4adbf 716 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
791d60f7
JH		 717
718 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP, sizeof(rsp), &rsp);
719}
720
0f852724 721void l2cap_chan_close(struct l2cap_chan *chan, int reason)
4519de9a
GP		 722{
723 struct l2cap_conn *conn = chan->conn;
4519de9a 724
7eafc59e 725 BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
4519de9a 726
89bc500e 727 switch (chan->state) {
4519de9a 728 case BT_LISTEN:
b699ec0d 729 chan->ops->teardown(chan, 0);
4519de9a
GP		 730 break;
731
732 case BT_CONNECTED:
733 case BT_CONFIG:
7b25c9b3 734 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED) {
8d836d71 735 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
5e4e3972 736 l2cap_send_disconn_req(chan, reason);
4519de9a
GP		 737 } else
738 l2cap_chan_del(chan, reason);
739 break;
740
741 case BT_CONNECT2:
791d60f7
JH		 742 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED) {
743 if (conn->hcon->type == ACL_LINK)
744 l2cap_chan_connect_reject(chan);
27e2d4c8
JH		 745 else if (conn->hcon->type == LE_LINK)
746 l2cap_chan_le_connect_reject(chan);
4519de9a
GP		 747 }
748
749 l2cap_chan_del(chan, reason);
750 break;
751
752 case BT_CONNECT:
753 case BT_DISCONN:
754 l2cap_chan_del(chan, reason);
755 break;
756
757 default:
b699ec0d 758 chan->ops->teardown(chan, 0);
4519de9a
GP		 759 break;
760 }
761}
6b8d4a6a 762EXPORT_SYMBOL(l2cap_chan_close);
4519de9a 763
4343478f 764static inline u8 l2cap_get_auth_type(struct l2cap_chan *chan)
79d554a6 765{
6a974b50
MH		 766 switch (chan->chan_type) {
767 case L2CAP_CHAN_RAW:
4343478f 768 switch (chan->sec_level) {
8556edd3 769 case BT_SECURITY_HIGH:
7d513e92 770 case BT_SECURITY_FIPS:
8556edd3
JH		 771 return HCI_AT_DEDICATED_BONDING_MITM;
772 case BT_SECURITY_MEDIUM:
773 return HCI_AT_DEDICATED_BONDING;
774 default:
775 return HCI_AT_NO_BONDING;
776 }
6a974b50 777 break;
3124b843 778 case L2CAP_CHAN_CONN_LESS:
dcf4adbf 779 if (chan->psm == cpu_to_le16(L2CAP_PSM_3DSP)) {
3124b843
MH		 780 if (chan->sec_level == BT_SECURITY_LOW)
781 chan->sec_level = BT_SECURITY_SDP;
782 }
7d513e92
MH		 783 if (chan->sec_level == BT_SECURITY_HIGH ||
784 chan->sec_level == BT_SECURITY_FIPS)
3124b843
MH		 785 return HCI_AT_NO_BONDING_MITM;
786 else
787 return HCI_AT_NO_BONDING;
788 break;
6a974b50 789 case L2CAP_CHAN_CONN_ORIENTED:
dcf4adbf 790 if (chan->psm == cpu_to_le16(L2CAP_PSM_SDP)) {
6a974b50
MH		 791 if (chan->sec_level == BT_SECURITY_LOW)
792 chan->sec_level = BT_SECURITY_SDP;
0684e5f9 793
7d513e92
MH		 794 if (chan->sec_level == BT_SECURITY_HIGH ||
795 chan->sec_level == BT_SECURITY_FIPS)
6a974b50
MH		 796 return HCI_AT_NO_BONDING_MITM;
797 else
798 return HCI_AT_NO_BONDING;
799 }
800 /* fall through */
801 default:
4343478f 802 switch (chan->sec_level) {
00ae4af9 803 case BT_SECURITY_HIGH:
7d513e92 804 case BT_SECURITY_FIPS:
8556edd3 805 return HCI_AT_GENERAL_BONDING_MITM;
00ae4af9 806 case BT_SECURITY_MEDIUM:
8556edd3 807 return HCI_AT_GENERAL_BONDING;
00ae4af9 808 default:
8556edd3 809 return HCI_AT_NO_BONDING;
00ae4af9 810 }
6a974b50 811 break;
0684e5f9 812 }
8556edd3
JH		 813}
814
815/* Service level security */
e7cafc45 816int l2cap_chan_check_security(struct l2cap_chan *chan, bool initiator)
8556edd3 817{
8c1d787b 818 struct l2cap_conn *conn = chan->conn;
8556edd3
JH		 819 __u8 auth_type;
820
a17de2fe
JH		 821 if (conn->hcon->type == LE_LINK)
822 return smp_conn_security(conn->hcon, chan->sec_level);
823
4343478f 824 auth_type = l2cap_get_auth_type(chan);
79d554a6 825
e7cafc45
JH		 826 return hci_conn_security(conn->hcon, chan->sec_level, auth_type,
827 initiator);
79d554a6
MH		 828}
829
b5ad8b7f 830static u8 l2cap_get_ident(struct l2cap_conn *conn)
4e8402a3
MH		 831{
832 u8 id;
833
834 /* Get next available identificator.
835 * 1 - 128 are used by kernel.
836 * 129 - 199 are reserved.
837 * 200 - 254 are used by utilities like l2ping, etc.
838 */
839
5a54e7c8 840 mutex_lock(&conn->ident_lock);
4e8402a3
MH		 841
842 if (++conn->tx_ident > 128)
843 conn->tx_ident = 1;
844
845 id = conn->tx_ident;
846
5a54e7c8 847 mutex_unlock(&conn->ident_lock);
4e8402a3
MH		 848
849 return id;
850}
851
2d792818
GP		 852static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
853 void *data)
4e8402a3
MH		 854{
855 struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data);
e702112f 856 u8 flags;
4e8402a3
MH		 857
858 BT_DBG("code 0x%2.2x", code);
859
860 if (!skb)
9a9c6a34 861 return;
4e8402a3 862
f6af675e
SW		 863 /* Use NO_FLUSH if supported or we have an LE link (which does
864 * not support auto-flushing packets) */
865 if (lmp_no_flush_capable(conn->hcon->hdev) ||
866 conn->hcon->type == LE_LINK)
e702112f
AE		 867 flags = ACL_START_NO_FLUSH;
868 else
869 flags = ACL_START;
870
14b12d0b 871 bt_cb(skb)->force_active = BT_POWER_FORCE_ACTIVE_ON;
5e59b791 872 skb->priority = HCI_PRIO_MAX;
14b12d0b 873
73d80deb
LAD		 874 hci_send_acl(conn->hchan, skb, flags);
875}
876
02b0fbb9
MM		 877static bool __chan_is_moving(struct l2cap_chan *chan)
878{
879 return chan->move_state != L2CAP_MOVE_STABLE &&
880 chan->move_state != L2CAP_MOVE_WAIT_PREPARE;
881}
882
73d80deb
LAD		 883static void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb)
884{
885 struct hci_conn *hcon = chan->conn->hcon;
886 u16 flags;
887
888 BT_DBG("chan %p, skb %p len %d priority %u", chan, skb, skb->len,
2d792818 889 skb->priority);
73d80deb 890
d5f8a75d
MM		 891 if (chan->hs_hcon && !__chan_is_moving(chan)) {
892 if (chan->hs_hchan)
893 hci_send_acl(chan->hs_hchan, skb, ACL_COMPLETE);
894 else
895 kfree_skb(skb);
896
897 return;
898 }
899
f6af675e
SW		 900 /* Use NO_FLUSH for LE links (where this is the only option) or
901 * if the BR/EDR link supports it and flushing has not been
902 * explicitly requested (through FLAG_FLUSHABLE).
903 */
904 if (hcon->type == LE_LINK ||
905 (!test_bit(FLAG_FLUSHABLE, &chan->flags) &&
906 lmp_no_flush_capable(hcon->hdev)))
73d80deb
LAD		 907 flags = ACL_START_NO_FLUSH;
908 else
909 flags = ACL_START;
14b12d0b 910
73d80deb
LAD		 911 bt_cb(skb)->force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
912 hci_send_acl(chan->conn->hchan, skb, flags);
4e8402a3
MH		 913}
914
b76bbd66
MM		 915static void __unpack_enhanced_control(u16 enh, struct l2cap_ctrl *control)
916{
917 control->reqseq = (enh & L2CAP_CTRL_REQSEQ) >> L2CAP_CTRL_REQSEQ_SHIFT;
918 control->final = (enh & L2CAP_CTRL_FINAL) >> L2CAP_CTRL_FINAL_SHIFT;
919
920 if (enh & L2CAP_CTRL_FRAME_TYPE) {
921 /* S-Frame */
922 control->sframe = 1;
923 control->poll = (enh & L2CAP_CTRL_POLL) >> L2CAP_CTRL_POLL_SHIFT;
924 control->super = (enh & L2CAP_CTRL_SUPERVISE) >> L2CAP_CTRL_SUPER_SHIFT;
925
926 control->sar = 0;
927 control->txseq = 0;
928 } else {
929 /* I-Frame */
930 control->sframe = 0;
931 control->sar = (enh & L2CAP_CTRL_SAR) >> L2CAP_CTRL_SAR_SHIFT;
932 control->txseq = (enh & L2CAP_CTRL_TXSEQ) >> L2CAP_CTRL_TXSEQ_SHIFT;
933
934 control->poll = 0;
935 control->super = 0;
936 }
937}
938
b76bbd66
MM		 939static void __unpack_extended_control(u32 ext, struct l2cap_ctrl *control)
940{
941 control->reqseq = (ext & L2CAP_EXT_CTRL_REQSEQ) >> L2CAP_EXT_CTRL_REQSEQ_SHIFT;
942 control->final = (ext & L2CAP_EXT_CTRL_FINAL) >> L2CAP_EXT_CTRL_FINAL_SHIFT;
943
944 if (ext & L2CAP_EXT_CTRL_FRAME_TYPE) {
945 /* S-Frame */
946 control->sframe = 1;
947 control->poll = (ext & L2CAP_EXT_CTRL_POLL) >> L2CAP_EXT_CTRL_POLL_SHIFT;
948 control->super = (ext & L2CAP_EXT_CTRL_SUPERVISE) >> L2CAP_EXT_CTRL_SUPER_SHIFT;
949
950 control->sar = 0;
951 control->txseq = 0;
952 } else {
953 /* I-Frame */
954 control->sframe = 0;
955 control->sar = (ext & L2CAP_EXT_CTRL_SAR) >> L2CAP_EXT_CTRL_SAR_SHIFT;
956 control->txseq = (ext & L2CAP_EXT_CTRL_TXSEQ) >> L2CAP_EXT_CTRL_TXSEQ_SHIFT;
957
958 control->poll = 0;
959 control->super = 0;
960 }
961}
962
963static inline void __unpack_control(struct l2cap_chan *chan,
964 struct sk_buff *skb)
965{
966 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
967 __unpack_extended_control(get_unaligned_le32(skb->data),
a4368ff3 968 &bt_cb(skb)->l2cap);
cec8ab6e 969 skb_pull(skb, L2CAP_EXT_CTRL_SIZE);
b76bbd66
MM		 970 } else {
971 __unpack_enhanced_control(get_unaligned_le16(skb->data),
a4368ff3 972 &bt_cb(skb)->l2cap);
cec8ab6e 973 skb_pull(skb, L2CAP_ENH_CTRL_SIZE);
b76bbd66
MM		 974 }
975}
976
b5c6aaed
MM		 977static u32 __pack_extended_control(struct l2cap_ctrl *control)
978{
979 u32 packed;
980
981 packed = control->reqseq << L2CAP_EXT_CTRL_REQSEQ_SHIFT;
982 packed |= control->final << L2CAP_EXT_CTRL_FINAL_SHIFT;
983
984 if (control->sframe) {
985 packed |= control->poll << L2CAP_EXT_CTRL_POLL_SHIFT;
986 packed |= control->super << L2CAP_EXT_CTRL_SUPER_SHIFT;
987 packed |= L2CAP_EXT_CTRL_FRAME_TYPE;
988 } else {
989 packed |= control->sar << L2CAP_EXT_CTRL_SAR_SHIFT;
990 packed |= control->txseq << L2CAP_EXT_CTRL_TXSEQ_SHIFT;
991 }
992
993 return packed;
994}
995
996static u16 __pack_enhanced_control(struct l2cap_ctrl *control)
997{
998 u16 packed;
999
1000 packed = control->reqseq << L2CAP_CTRL_REQSEQ_SHIFT;
1001 packed |= control->final << L2CAP_CTRL_FINAL_SHIFT;
1002
1003 if (control->sframe) {
1004 packed |= control->poll << L2CAP_CTRL_POLL_SHIFT;
1005 packed |= control->super << L2CAP_CTRL_SUPER_SHIFT;
1006 packed |= L2CAP_CTRL_FRAME_TYPE;
1007 } else {
1008 packed |= control->sar << L2CAP_CTRL_SAR_SHIFT;
1009 packed |= control->txseq << L2CAP_CTRL_TXSEQ_SHIFT;
1010 }
1011
1012 return packed;
1013}
1014
b76bbd66
MM		 1015static inline void __pack_control(struct l2cap_chan *chan,
1016 struct l2cap_ctrl *control,
1017 struct sk_buff *skb)
1018{
1019 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
1020 put_unaligned_le32(__pack_extended_control(control),
1021 skb->data + L2CAP_HDR_SIZE);
1022 } else {
1023 put_unaligned_le16(__pack_enhanced_control(control),
1024 skb->data + L2CAP_HDR_SIZE);
1025 }
1026}
1027
ba7aa64f
GP		 1028static inline unsigned int __ertm_hdr_size(struct l2cap_chan *chan)
1029{
1030 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
1031 return L2CAP_EXT_HDR_SIZE;
1032 else
1033 return L2CAP_ENH_HDR_SIZE;
1034}
1035
a67d7f6f
MM		 1036static struct sk_buff *l2cap_create_sframe_pdu(struct l2cap_chan *chan,
1037 u32 control)
b5c6aaed
MM		 1038{
1039 struct sk_buff *skb;
1040 struct l2cap_hdr *lh;
ba7aa64f 1041 int hlen = __ertm_hdr_size(chan);
b5c6aaed
MM		 1042
1043 if (chan->fcs == L2CAP_FCS_CRC16)
1044 hlen += L2CAP_FCS_SIZE;
1045
a67d7f6f 1046 skb = bt_skb_alloc(hlen, GFP_KERNEL);
b5c6aaed 1047
b5c6aaed 1048 if (!skb)
a67d7f6f 1049 return ERR_PTR(-ENOMEM);
b5c6aaed 1050
4df864c1 1051 lh = skb_put(skb, L2CAP_HDR_SIZE);
b5c6aaed
MM		 1052 lh->len = cpu_to_le16(hlen - L2CAP_HDR_SIZE);
1053 lh->cid = cpu_to_le16(chan->dcid);
1054
a67d7f6f
MM		 1055 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
1056 put_unaligned_le32(control, skb_put(skb, L2CAP_EXT_CTRL_SIZE));
1057 else
1058 put_unaligned_le16(control, skb_put(skb, L2CAP_ENH_CTRL_SIZE));
b5c6aaed
MM		 1059
1060 if (chan->fcs == L2CAP_FCS_CRC16) {
a67d7f6f 1061 u16 fcs = crc16(0, (u8 *)skb->data, skb->len);
b5c6aaed
MM		 1062 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
1063 }
1064
1065 skb->priority = HCI_PRIO_MAX;
a67d7f6f
MM		 1066 return skb;
1067}
1068
1069static void l2cap_send_sframe(struct l2cap_chan *chan,
1070 struct l2cap_ctrl *control)
1071{
1072 struct sk_buff *skb;
1073 u32 control_field;
1074
1075 BT_DBG("chan %p, control %p", chan, control);
1076
1077 if (!control->sframe)
1078 return;
1079
b99e13ad
MM		 1080 if (__chan_is_moving(chan))
1081 return;
1082
a67d7f6f
MM		 1083 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state) &&
1084 !control->poll)
1085 control->final = 1;
1086
1087 if (control->super == L2CAP_SUPER_RR)
1088 clear_bit(CONN_RNR_SENT, &chan->conn_state);
1089 else if (control->super == L2CAP_SUPER_RNR)
1090 set_bit(CONN_RNR_SENT, &chan->conn_state);
1091
1092 if (control->super != L2CAP_SUPER_SREJ) {
1093 chan->last_acked_seq = control->reqseq;
1094 __clear_ack_timer(chan);
1095 }
1096
1097 BT_DBG("reqseq %d, final %d, poll %d, super %d", control->reqseq,
1098 control->final, control->poll, control->super);
1099
1100 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
1101 control_field = __pack_extended_control(control);
1102 else
1103 control_field = __pack_enhanced_control(control);
1104
1105 skb = l2cap_create_sframe_pdu(chan, control_field);
1106 if (!IS_ERR(skb))
1107 l2cap_do_send(chan, skb);
b5c6aaed
MM		 1108}
1109
c9e3d5e0 1110static void l2cap_send_rr_or_rnr(struct l2cap_chan *chan, bool poll)
b5c6aaed 1111{
c9e3d5e0
MM		 1112 struct l2cap_ctrl control;
1113
1114 BT_DBG("chan %p, poll %d", chan, poll);
1115
1116 memset(&control, 0, sizeof(control));
1117 control.sframe = 1;
1118 control.poll = poll;
1119
1120 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state))
1121 control.super = L2CAP_SUPER_RNR;
1122 else
1123 control.super = L2CAP_SUPER_RR;
b5c6aaed 1124
c9e3d5e0
MM		 1125 control.reqseq = chan->buffer_seq;
1126 l2cap_send_sframe(chan, &control);
b5c6aaed
MM		 1127}
1128
b4450035 1129static inline int __l2cap_no_conn_pending(struct l2cap_chan *chan)
e501d055 1130{
5ff6f34d
JH		 1131 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED)
1132 return true;
1133
c1360a1c 1134 return !test_bit(CONF_CONNECT_PEND, &chan->conf_state);
e501d055
AE		 1135}
1136
1df7b17a 1137static bool __amp_capable(struct l2cap_chan *chan)
80d58d0b 1138{
1df7b17a 1139 struct l2cap_conn *conn = chan->conn;
80d58d0b 1140 struct hci_dev *hdev;
1df7b17a
MH		 1141 bool amp_available = false;
1142
0bd49fc7 1143 if (!(conn->local_fixed_chan & L2CAP_FC_A2MP))
1df7b17a
MH		 1144 return false;
1145
0bd49fc7 1146 if (!(conn->remote_fixed_chan & L2CAP_FC_A2MP))
1df7b17a 1147 return false;
80d58d0b
MH		 1148
1149 read_lock(&hci_dev_list_lock);
1df7b17a 1150 list_for_each_entry(hdev, &hci_dev_list, list) {
80d58d0b 1151 if (hdev->amp_type != AMP_TYPE_BREDR &&
1df7b17a
MH		 1152 test_bit(HCI_UP, &hdev->flags)) {
1153 amp_available = true;
1154 break;
1155 }
1156 }
80d58d0b
MH		 1157 read_unlock(&hci_dev_list_lock);
1158
1df7b17a
MH		 1159 if (chan->chan_policy == BT_CHANNEL_POLICY_AMP_PREFERRED)
1160 return amp_available;
848566b3
MH		 1161
1162 return false;
93c3e8f5
AE		 1163}
1164
5ce66b59
AE		 1165static bool l2cap_check_efs(struct l2cap_chan *chan)
1166{
1167 /* Check EFS parameters */
1168 return true;
1169}
1170
2766be48 1171void l2cap_send_conn_req(struct l2cap_chan *chan)
9b27f350
AE		 1172{
1173 struct l2cap_conn *conn = chan->conn;
1174 struct l2cap_conn_req req;
1175
1176 req.scid = cpu_to_le16(chan->scid);
1177 req.psm = chan->psm;
1178
1179 chan->ident = l2cap_get_ident(conn);
1180
1181 set_bit(CONF_CONNECT_PEND, &chan->conf_state);
1182
1183 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ, sizeof(req), &req);
1184}
1185
8eb200bd
MM		 1186static void l2cap_send_create_chan_req(struct l2cap_chan *chan, u8 amp_id)
1187{
1188 struct l2cap_create_chan_req req;
1189 req.scid = cpu_to_le16(chan->scid);
1190 req.psm = chan->psm;
1191 req.amp_id = amp_id;
1192
1193 chan->ident = l2cap_get_ident(chan->conn);
1194
1195 l2cap_send_cmd(chan->conn, chan->ident, L2CAP_CREATE_CHAN_REQ,
1196 sizeof(req), &req);
1197}
1198
02b0fbb9
MM		 1199static void l2cap_move_setup(struct l2cap_chan *chan)
1200{
1201 struct sk_buff *skb;
1202
1203 BT_DBG("chan %p", chan);
1204
1205 if (chan->mode != L2CAP_MODE_ERTM)
1206 return;
1207
1208 __clear_retrans_timer(chan);
1209 __clear_monitor_timer(chan);
1210 __clear_ack_timer(chan);
1211
1212 chan->retry_count = 0;
1213 skb_queue_walk(&chan->tx_q, skb) {
a4368ff3
JH		 1214 if (bt_cb(skb)->l2cap.retries)
1215 bt_cb(skb)->l2cap.retries = 1;
02b0fbb9
MM		 1216 else
1217 break;
1218 }
1219
1220 chan->expected_tx_seq = chan->buffer_seq;
1221
1222 clear_bit(CONN_REJ_ACT, &chan->conn_state);
1223 clear_bit(CONN_SREJ_ACT, &chan->conn_state);
1224 l2cap_seq_list_clear(&chan->retrans_list);
1225 l2cap_seq_list_clear(&chan->srej_list);
1226 skb_queue_purge(&chan->srej_q);
1227
1228 chan->tx_state = L2CAP_TX_STATE_XMIT;
1229 chan->rx_state = L2CAP_RX_STATE_MOVE;
1230
1231 set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
1232}
1233
5f3847a4
MM		 1234static void l2cap_move_done(struct l2cap_chan *chan)
1235{
1236 u8 move_role = chan->move_role;
1237 BT_DBG("chan %p", chan);
1238
1239 chan->move_state = L2CAP_MOVE_STABLE;
1240 chan->move_role = L2CAP_MOVE_ROLE_NONE;
1241
1242 if (chan->mode != L2CAP_MODE_ERTM)
1243 return;
1244
1245 switch (move_role) {
1246 case L2CAP_MOVE_ROLE_INITIATOR:
1247 l2cap_tx(chan, NULL, NULL, L2CAP_EV_EXPLICIT_POLL);
1248 chan->rx_state = L2CAP_RX_STATE_WAIT_F;
1249 break;
1250 case L2CAP_MOVE_ROLE_RESPONDER:
1251 chan->rx_state = L2CAP_RX_STATE_WAIT_P;
1252 break;
1253 }
1254}
1255
9f0caeb1
VCG		 1256static void l2cap_chan_ready(struct l2cap_chan *chan)
1257{
315917e0
JH		 1258 /* The channel may have already been flagged as connected in
1259 * case of receiving data before the L2CAP info req/rsp
1260 * procedure is complete.
1261 */
1262 if (chan->state == BT_CONNECTED)
1263 return;
1264
2827011f 1265 /* This clears all conf flags, including CONF_NOT_COMPLETE */
9f0caeb1
VCG		 1266 chan->conf_state = 0;
1267 __clear_chan_timer(chan);
1268
0ce43ce6
JH		 1269 if (chan->mode == L2CAP_MODE_LE_FLOWCTL && !chan->tx_credits)
1270 chan->ops->suspend(chan);
177f8f2b 1271
54a59aa2 1272 chan->state = BT_CONNECTED;
9f0caeb1 1273
fd83e2c2 1274 chan->ops->ready(chan);
9f0caeb1
VCG		 1275}
1276
f1496dee
JH		 1277static void l2cap_le_connect(struct l2cap_chan *chan)
1278{
1279 struct l2cap_conn *conn = chan->conn;
1280 struct l2cap_le_conn_req req;
1281
595177f3
JH		 1282 if (test_and_set_bit(FLAG_LE_CONN_REQ_SENT, &chan->flags))
1283 return;
1284
f1496dee
JH		 1285 req.psm = chan->psm;
1286 req.scid = cpu_to_le16(chan->scid);
1287 req.mtu = cpu_to_le16(chan->imtu);
3916aed8 1288 req.mps = cpu_to_le16(chan->mps);
0cd75f7e 1289 req.credits = cpu_to_le16(chan->rx_credits);
f1496dee
JH		 1290
1291 chan->ident = l2cap_get_ident(conn);
1292
1293 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_REQ,
1294 sizeof(req), &req);
1295}
1296
1297static void l2cap_le_start(struct l2cap_chan *chan)
1298{
1299 struct l2cap_conn *conn = chan->conn;
1300
1301 if (!smp_conn_security(conn->hcon, chan->sec_level))
1302 return;
1303
1304 if (!chan->psm) {
1305 l2cap_chan_ready(chan);
1306 return;
1307 }
1308
1309 if (chan->state == BT_CONNECT)
1310 l2cap_le_connect(chan);
1311}
1312
93c3e8f5
AE		 1313static void l2cap_start_connection(struct l2cap_chan *chan)
1314{
1315 if (__amp_capable(chan)) {
1316 BT_DBG("chan %p AMP capable: discover AMPs", chan);
1317 a2mp_discover_amp(chan);
f1496dee
JH		 1318 } else if (chan->conn->hcon->type == LE_LINK) {
1319 l2cap_le_start(chan);
93c3e8f5
AE		 1320 } else {
1321 l2cap_send_conn_req(chan);
1322 }
1323}
1324
aeaeb4bb
JH		 1325static void l2cap_request_info(struct l2cap_conn *conn)
1326{
1327 struct l2cap_info_req req;
1328
1329 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
1330 return;
1331
1332 req.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
1333
1334 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
1335 conn->info_ident = l2cap_get_ident(conn);
1336
1337 schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
1338
1339 l2cap_send_cmd(conn, conn->info_ident, L2CAP_INFO_REQ,
1340 sizeof(req), &req);
1341}
1342
fc7f8a7e 1343static void l2cap_do_start(struct l2cap_chan *chan)
79d554a6 1344{
8c1d787b 1345 struct l2cap_conn *conn = chan->conn;
79d554a6 1346
9f0caeb1 1347 if (conn->hcon->type == LE_LINK) {
96ac34fb 1348 l2cap_le_start(chan);
9f0caeb1
VCG		 1349 return;
1350 }
1351
aeaeb4bb
JH		 1352 if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)) {
1353 l2cap_request_info(conn);
1354 return;
1355 }
79d554a6 1356
aeaeb4bb
JH		 1357 if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE))
1358 return;
79d554a6 1359
aeaeb4bb
JH		 1360 if (l2cap_chan_check_security(chan, true) &&
1361 __l2cap_no_conn_pending(chan))
1362 l2cap_start_connection(chan);
79d554a6
MH		 1363}
1364
cf6c2c0b
GP		 1365static inline int l2cap_mode_supported(__u8 mode, __u32 feat_mask)
1366{
1367 u32 local_feat_mask = l2cap_feat_mask;
d1c4a17d 1368 if (!disable_ertm)
cf6c2c0b
GP		 1369 local_feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING;
1370
1371 switch (mode) {
1372 case L2CAP_MODE_ERTM:
1373 return L2CAP_FEAT_ERTM & feat_mask & local_feat_mask;
1374 case L2CAP_MODE_STREAMING:
1375 return L2CAP_FEAT_STREAMING & feat_mask & local_feat_mask;
1376 default:
1377 return 0x00;
1378 }
1379}
1380
5e4e3972 1381static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err)
22121fc9 1382{
5e4e3972 1383 struct l2cap_conn *conn = chan->conn;
22121fc9
GP		 1384 struct l2cap_disconn_req req;
1385
c13ffa62
GP		 1386 if (!conn)
1387 return;
1388
aad3d0e3 1389 if (chan->mode == L2CAP_MODE_ERTM && chan->state == BT_CONNECTED) {
1a09bcb9
GP		 1390 __clear_retrans_timer(chan);
1391 __clear_monitor_timer(chan);
1392 __clear_ack_timer(chan);
c13ffa62
GP		 1393 }
1394
2338a7e0 1395 if (chan->scid == L2CAP_CID_A2MP) {
d117773c 1396 l2cap_state_change(chan, BT_DISCONN);
416fa752
AE		 1397 return;
1398 }
1399
fe4128e0
GP		 1400 req.dcid = cpu_to_le16(chan->dcid);
1401 req.scid = cpu_to_le16(chan->scid);
2d792818
GP		 1402 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_DISCONN_REQ,
1403 sizeof(req), &req);
c13ffa62 1404
f8e73017 1405 l2cap_state_change_and_error(chan, BT_DISCONN, err);
22121fc9
GP		 1406}
1407
1da177e4 1408/* ---- L2CAP connections ---- */
4e8402a3
MH		 1409static void l2cap_conn_start(struct l2cap_conn *conn)
1410{
3df91ea2 1411 struct l2cap_chan *chan, *tmp;
4e8402a3
MH		 1412
1413 BT_DBG("conn %p", conn);
1414
3df91ea2 1415 mutex_lock(&conn->chan_lock);
4e8402a3 1416
3df91ea2 1417 list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
6be36555 1418 l2cap_chan_lock(chan);
4e8402a3 1419
715ec005 1420 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
aeaeb4bb 1421 l2cap_chan_ready(chan);
6be36555 1422 l2cap_chan_unlock(chan);
79d554a6
MH		 1423 continue;
1424 }
1425
89bc500e 1426 if (chan->state == BT_CONNECT) {
e7cafc45 1427 if (!l2cap_chan_check_security(chan, true) ||
2d792818 1428 !__l2cap_no_conn_pending(chan)) {
6be36555 1429 l2cap_chan_unlock(chan);
47731de7
GP		 1430 continue;
1431 }
79d554a6 1432
c1360a1c 1433 if (!l2cap_mode_supported(chan->mode, conn->feat_mask)
2d792818 1434 && test_bit(CONF_STATE2_DEVICE,
c1360a1c 1435 &chan->conf_state)) {
89bc500e 1436 l2cap_chan_close(chan, ECONNRESET);
6be36555 1437 l2cap_chan_unlock(chan);
47731de7 1438 continue;
b1235d79 1439 }
47731de7 1440
93c3e8f5 1441 l2cap_start_connection(chan);
47731de7 1442
89bc500e 1443 } else if (chan->state == BT_CONNECT2) {
79d554a6 1444 struct l2cap_conn_rsp rsp;
e9aeb2dd 1445 char buf[128];
fe4128e0
GP		 1446 rsp.scid = cpu_to_le16(chan->dcid);
1447 rsp.dcid = cpu_to_le16(chan->scid);
79d554a6 1448
e7cafc45 1449 if (l2cap_chan_check_security(chan, false)) {
bdc25783 1450 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
dcf4adbf
JP		 1451 rsp.result = cpu_to_le16(L2CAP_CR_PEND);
1452 rsp.status = cpu_to_le16(L2CAP_CS_AUTHOR_PEND);
2dc4e510 1453 chan->ops->defer(chan);
f66dc81f
MH		 1454
1455 } else {
acdcabf5 1456 l2cap_state_change(chan, BT_CONFIG);
dcf4adbf
JP		 1457 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
1458 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
f66dc81f 1459 }
79d554a6 1460 } else {
dcf4adbf
JP		 1461 rsp.result = cpu_to_le16(L2CAP_CR_PEND);
1462 rsp.status = cpu_to_le16(L2CAP_CS_AUTHEN_PEND);
79d554a6
MH		 1463 }
1464
fc7f8a7e 1465 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
2d792818 1466 sizeof(rsp), &rsp);
e9aeb2dd 1467
c1360a1c 1468 if (test_bit(CONF_REQ_SENT, &chan->conf_state) ||
2d792818 1469 rsp.result != L2CAP_CR_SUCCESS) {
6be36555 1470 l2cap_chan_unlock(chan);
e9aeb2dd
GP		 1471 continue;
1472 }
1473
c1360a1c 1474 set_bit(CONF_REQ_SENT, &chan->conf_state);
e9aeb2dd 1475 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
e860d2c9 1476 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
73ffa904 1477 chan->num_conf_req++;
4e8402a3
MH		 1478 }
1479
6be36555 1480 l2cap_chan_unlock(chan);
4e8402a3
MH		 1481 }
1482
3df91ea2 1483 mutex_unlock(&conn->chan_lock);
4e8402a3
MH		 1484}
1485
b62f328b
VT		 1486static void l2cap_le_conn_ready(struct l2cap_conn *conn)
1487{
cc8dba2b 1488 struct hci_conn *hcon = conn->hcon;
dcc36c16 1489 struct hci_dev *hdev = hcon->hdev;
b62f328b 1490
e760ec12 1491 BT_DBG("%s conn %p", hdev->name, conn);
b62f328b 1492
e760ec12
JH		 1493 /* For outgoing pairing which doesn't necessarily have an
1494 * associated socket (e.g. mgmt_pair_device).
1495 */
1496 if (hcon->out)
1497 smp_conn_security(hcon, hcon->pending_sec_level);
cc8dba2b 1498
80afeb6c
MH		 1499 /* For LE slave connections, make sure the connection interval
1500 * is in the range of the minium and maximum interval that has
1501 * been configured for this connection. If not, then trigger
1502 * the connection update procedure.
1503 */
40bef302 1504 if (hcon->role == HCI_ROLE_SLAVE &&
80afeb6c
MH		 1505 (hcon->le_conn_interval < hcon->le_conn_min_interval ||
1506 hcon->le_conn_interval > hcon->le_conn_max_interval)) {
1507 struct l2cap_conn_param_update_req req;
1508
1509 req.min = cpu_to_le16(hcon->le_conn_min_interval);
1510 req.max = cpu_to_le16(hcon->le_conn_max_interval);
1511 req.latency = cpu_to_le16(hcon->le_conn_latency);
1512 req.to_multiplier = cpu_to_le16(hcon->le_supv_timeout);
1513
1514 l2cap_send_cmd(conn, l2cap_get_ident(conn),
1515 L2CAP_CONN_PARAM_UPDATE_REQ, sizeof(req), &req);
1516 }
b62f328b
VT		 1517}
1518
4e8402a3
MH		 1519static void l2cap_conn_ready(struct l2cap_conn *conn)
1520{
48454079 1521 struct l2cap_chan *chan;
cc110922 1522 struct hci_conn *hcon = conn->hcon;
4e8402a3 1523
79d554a6 1524 BT_DBG("conn %p", conn);
4e8402a3 1525
aeaeb4bb
JH		 1526 if (hcon->type == ACL_LINK)
1527 l2cap_request_info(conn);
1528
e760ec12
JH		 1529 mutex_lock(&conn->chan_lock);
1530
3df91ea2 1531 list_for_each_entry(chan, &conn->chan_l, list) {
baa7e1fa 1532
6be36555 1533 l2cap_chan_lock(chan);
4e8402a3 1534
2338a7e0 1535 if (chan->scid == L2CAP_CID_A2MP) {
416fa752
AE		 1536 l2cap_chan_unlock(chan);
1537 continue;
1538 }
1539
cc110922 1540 if (hcon->type == LE_LINK) {
f1496dee 1541 l2cap_le_start(chan);
63128451 1542 } else if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
aeaeb4bb
JH		 1543 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)
1544 l2cap_chan_ready(chan);
1c244f79 1545 } else if (chan->state == BT_CONNECT) {
fc7f8a7e 1546 l2cap_do_start(chan);
1c244f79 1547 }
4e8402a3 1548
6be36555 1549 l2cap_chan_unlock(chan);
4e8402a3 1550 }
79d554a6 1551
3df91ea2 1552 mutex_unlock(&conn->chan_lock);
61a939c6 1553
79a05727
JH		 1554 if (hcon->type == LE_LINK)
1555 l2cap_le_conn_ready(conn);
1556
61a939c6 1557 queue_work(hcon->hdev->workqueue, &conn->pending_rx_work);
4e8402a3
MH		 1558}
1559
1560/* Notify sockets that we cannot guaranty reliability anymore */
1561static void l2cap_conn_unreliable(struct l2cap_conn *conn, int err)
1562{
48454079 1563 struct l2cap_chan *chan;
4e8402a3
MH		 1564
1565 BT_DBG("conn %p", conn);
1566
3df91ea2 1567 mutex_lock(&conn->chan_lock);
4e8402a3 1568
3df91ea2 1569 list_for_each_entry(chan, &conn->chan_l, list) {
ecf61bdb 1570 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
1d8b1fd5 1571 l2cap_chan_set_err(chan, err);
4e8402a3
MH		 1572 }
1573
3df91ea2 1574 mutex_unlock(&conn->chan_lock);
4e8402a3
MH		 1575}
1576
f878fcad 1577static void l2cap_info_timeout(struct work_struct *work)
4e8402a3 1578{
f878fcad 1579 struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
2d792818 1580 info_timer.work);
4e8402a3 1581
984947dc 1582 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
e1027a7c 1583 conn->info_ident = 0;
984947dc 1584
4e8402a3
MH		 1585 l2cap_conn_start(conn);
1586}
1587
2c8e1411
DH		 1588/*
1589 * l2cap_user
1590 * External modules can register l2cap_user objects on l2cap_conn. The ->probe
1591 * callback is called during registration. The ->remove callback is called
1592 * during unregistration.
1593 * An l2cap_user object can either be explicitly unregistered or when the
1594 * underlying l2cap_conn object is deleted. This guarantees that l2cap->hcon,
1595 * l2cap->hchan, .. are valid as long as the remove callback hasn't been called.
1596 * External modules must own a reference to the l2cap_conn object if they intend
1597 * to call l2cap_unregister_user(). The l2cap_conn object might get destroyed at
1598 * any time if they don't.
1599 */
1600
1601int l2cap_register_user(struct l2cap_conn *conn, struct l2cap_user *user)
1602{
1603 struct hci_dev *hdev = conn->hcon->hdev;
1604 int ret;
1605
1606 /* We need to check whether l2cap_conn is registered. If it is not, we
1607 * must not register the l2cap_user. l2cap_conn_del() is unregisters
1608 * l2cap_conn objects, but doesn't provide its own locking. Instead, it
1609 * relies on the parent hci_conn object to be locked. This itself relies
1610 * on the hci_dev object to be locked. So we must lock the hci device
1611 * here, too. */
1612
1613 hci_dev_lock(hdev);
1614
835a6a2f 1615 if (!list_empty(&user->list)) {
2c8e1411
DH		 1616 ret = -EINVAL;
1617 goto out_unlock;
1618 }
1619
1620 /* conn->hchan is NULL after l2cap_conn_del() was called */
1621 if (!conn->hchan) {
1622 ret = -ENODEV;
1623 goto out_unlock;
1624 }
1625
1626 ret = user->probe(conn, user);
1627 if (ret)
1628 goto out_unlock;
1629
1630 list_add(&user->list, &conn->users);
1631 ret = 0;
1632
1633out_unlock:
1634 hci_dev_unlock(hdev);
1635 return ret;
1636}
1637EXPORT_SYMBOL(l2cap_register_user);
1638
1639void l2cap_unregister_user(struct l2cap_conn *conn, struct l2cap_user *user)
1640{
1641 struct hci_dev *hdev = conn->hcon->hdev;
1642
1643 hci_dev_lock(hdev);
1644
835a6a2f 1645 if (list_empty(&user->list))
2c8e1411
DH		 1646 goto out_unlock;
1647
ab944c83 1648 list_del_init(&user->list);
2c8e1411
DH		 1649 user->remove(conn, user);
1650
1651out_unlock:
1652 hci_dev_unlock(hdev);
1653}
1654EXPORT_SYMBOL(l2cap_unregister_user);
1655
1656static void l2cap_unregister_all_users(struct l2cap_conn *conn)
1657{
1658 struct l2cap_user *user;
1659
1660 while (!list_empty(&conn->users)) {
1661 user = list_first_entry(&conn->users, struct l2cap_user, list);
ab944c83 1662 list_del_init(&user->list);
2c8e1411
DH		 1663 user->remove(conn, user);
1664 }
1665}
1666
5d3de7df
VCG		 1667static void l2cap_conn_del(struct hci_conn *hcon, int err)
1668{
1669 struct l2cap_conn *conn = hcon->l2cap_data;
1670 struct l2cap_chan *chan, *l;
5d3de7df
VCG		 1671
1672 if (!conn)
1673 return;
1674
1675 BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
1676
1677 kfree_skb(conn->rx_skb);
1678
61a939c6 1679 skb_queue_purge(&conn->pending_rx);
7ab56c3a
JT		 1680
1681 /* We can not call flush_work(&conn->pending_rx_work) here since we
1682 * might block if we are running on a worker from the same workqueue
1683 * pending_rx_work is waiting on.
1684 */
1685 if (work_pending(&conn->pending_rx_work))
1686 cancel_work_sync(&conn->pending_rx_work);
61a939c6 1687
f3d82d0c
JH		 1688 if (work_pending(&conn->id_addr_update_work))
1689 cancel_work_sync(&conn->id_addr_update_work);
1690
2c8e1411
DH		 1691 l2cap_unregister_all_users(conn);
1692
e31fb860
JH		 1693 /* Force the connection to be immediately dropped */
1694 hcon->disc_timeout = 0;
1695
3df91ea2
AE		 1696 mutex_lock(&conn->chan_lock);
1697
5d3de7df
VCG		 1698 /* Kill channels */
1699 list_for_each_entry_safe(chan, l, &conn->chan_l, list) {
61d6ef3e 1700 l2cap_chan_hold(chan);
6be36555
AE		 1701 l2cap_chan_lock(chan);
1702
5d3de7df 1703 l2cap_chan_del(chan, err);
6be36555
AE		 1704
1705 l2cap_chan_unlock(chan);
1706
80b98027 1707 chan->ops->close(chan);
61d6ef3e 1708 l2cap_chan_put(chan);
5d3de7df
VCG		 1709 }
1710
3df91ea2
AE		 1711 mutex_unlock(&conn->chan_lock);
1712
73d80deb
LAD		 1713 hci_chan_del(conn->hchan);
1714
5d3de7df 1715 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
127074bf 1716 cancel_delayed_work_sync(&conn->info_timer);
5d3de7df 1717
5d3de7df 1718 hcon->l2cap_data = NULL;
9c903e37
DH		 1719 conn->hchan = NULL;
1720 l2cap_conn_put(conn);
5d3de7df
VCG		 1721}
1722
9c903e37
DH		 1723static void l2cap_conn_free(struct kref *ref)
1724{
1725 struct l2cap_conn *conn = container_of(ref, struct l2cap_conn, ref);
1726
1727 hci_conn_put(conn->hcon);
1728 kfree(conn);
1729}
1730
51bb8457 1731struct l2cap_conn *l2cap_conn_get(struct l2cap_conn *conn)
9c903e37
DH		 1732{
1733 kref_get(&conn->ref);
51bb8457 1734 return conn;
9c903e37
DH		 1735}
1736EXPORT_SYMBOL(l2cap_conn_get);
1737
1738void l2cap_conn_put(struct l2cap_conn *conn)
1739{
1740 kref_put(&conn->ref, l2cap_conn_free);
1741}
1742EXPORT_SYMBOL(l2cap_conn_put);
1743
1da177e4 1744/* ---- Socket interface ---- */
1da177e4 1745
c2287681 1746/* Find socket with psm and source / destination bdaddr.
1da177e4
LT		 1747 * Returns closest match.
1748 */
c2287681
IY		 1749static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm,
1750 bdaddr_t *src,
bf20fd4e
JH		 1751 bdaddr_t *dst,
1752 u8 link_type)
1da177e4 1753{
23691d75 1754 struct l2cap_chan *c, *c1 = NULL;
1da177e4 1755
23691d75 1756 read_lock(&chan_list_lock);
e0f0cb56 1757
23691d75 1758 list_for_each_entry(c, &chan_list, global_l) {
89bc500e 1759 if (state && c->state != state)
1da177e4
LT		 1760 continue;
1761
bf20fd4e
JH		 1762 if (link_type == ACL_LINK && c->src_type != BDADDR_BREDR)
1763 continue;
1764
1765 if (link_type == LE_LINK && c->src_type == BDADDR_BREDR)
1766 continue;
1767
23691d75 1768 if (c->psm == psm) {
c2287681
IY		 1769 int src_match, dst_match;
1770 int src_any, dst_any;
1771
1da177e4 1772 /* Exact match. */
7eafc59e
MH		 1773 src_match = !bacmp(&c->src, src);
1774 dst_match = !bacmp(&c->dst, dst);
c2287681 1775 if (src_match && dst_match) {
a24cce14 1776 l2cap_chan_hold(c);
a7567b20 1777 read_unlock(&chan_list_lock);
23691d75
GP		 1778 return c;
1779 }
1da177e4
LT		 1780
1781 /* Closest match */
7eafc59e
MH		 1782 src_any = !bacmp(&c->src, BDADDR_ANY);
1783 dst_any = !bacmp(&c->dst, BDADDR_ANY);
c2287681
IY		 1784 if ((src_match && dst_any) || (src_any && dst_match) ||
1785 (src_any && dst_any))
23691d75 1786 c1 = c;
1da177e4
LT		 1787 }
1788 }
1da177e4 1789
a24cce14
JH		 1790 if (c1)
1791 l2cap_chan_hold(c1);
1792
23691d75 1793 read_unlock(&chan_list_lock);
e0f0cb56 1794
23691d75 1795 return c1;
1da177e4
LT		 1796}
1797
721c4181 1798static void l2cap_monitor_timeout(struct work_struct *work)
e90bac06 1799{
721c4181 1800 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
4239d16f 1801 monitor_timer.work);
e90bac06 1802
525cd185 1803 BT_DBG("chan %p", chan);
0e98958d 1804
6be36555
AE		 1805 l2cap_chan_lock(chan);
1806
80909e04 1807 if (!chan->conn) {
6be36555 1808 l2cap_chan_unlock(chan);
8d7e1c7f 1809 l2cap_chan_put(chan);
e90bac06
GP		 1810 return;
1811 }
1812
401bb1f7 1813 l2cap_tx(chan, NULL, NULL, L2CAP_EV_MONITOR_TO);
e90bac06 1814
6be36555 1815 l2cap_chan_unlock(chan);
8d7e1c7f 1816 l2cap_chan_put(chan);
e90bac06
GP		 1817}
1818
721c4181 1819static void l2cap_retrans_timeout(struct work_struct *work)
e90bac06 1820{
721c4181 1821 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
4239d16f 1822 retrans_timer.work);
e90bac06 1823
49208c9c 1824 BT_DBG("chan %p", chan);
0e98958d 1825
6be36555
AE		 1826 l2cap_chan_lock(chan);
1827
80909e04
MM		 1828 if (!chan->conn) {
1829 l2cap_chan_unlock(chan);
1830 l2cap_chan_put(chan);
1831 return;
1832 }
6be36555 1833
401bb1f7 1834 l2cap_tx(chan, NULL, NULL, L2CAP_EV_RETRANS_TO);
6be36555 1835 l2cap_chan_unlock(chan);
8d7e1c7f 1836 l2cap_chan_put(chan);
e90bac06
GP		 1837}
1838
d660366d
GP		 1839static void l2cap_streaming_send(struct l2cap_chan *chan,
1840 struct sk_buff_head *skbs)
6840ed07 1841{
ccbb84af 1842 struct sk_buff *skb;
3733937d 1843 struct l2cap_ctrl *control;
6840ed07 1844
3733937d
MM		 1845 BT_DBG("chan %p, skbs %p", chan, skbs);
1846
b99e13ad
MM		 1847 if (__chan_is_moving(chan))
1848 return;
1849
3733937d
MM		 1850 skb_queue_splice_tail_init(skbs, &chan->tx_q);
1851
1852 while (!skb_queue_empty(&chan->tx_q)) {
1853
1854 skb = skb_dequeue(&chan->tx_q);
1855
a4368ff3
JH		 1856 bt_cb(skb)->l2cap.retries = 1;
1857 control = &bt_cb(skb)->l2cap;
3733937d
MM		 1858
1859 control->reqseq = 0;
1860 control->txseq = chan->next_tx_seq;
1861
1862 __pack_control(chan, control, skb);
6840ed07 1863
47d1ec61 1864 if (chan->fcs == L2CAP_FCS_CRC16) {
3733937d
MM		 1865 u16 fcs = crc16(0, (u8 *) skb->data, skb->len);
1866 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
fcc203c3
GP		 1867 }
1868
4343478f 1869 l2cap_do_send(chan, skb);
6840ed07 1870
b4400672 1871 BT_DBG("Sent txseq %u", control->txseq);
3733937d 1872
836be934 1873 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
3733937d 1874 chan->frames_sent++;
6840ed07 1875 }
6840ed07
GP		 1876}
1877
67c9e840 1878static int l2cap_ertm_send(struct l2cap_chan *chan)
1c2acffb
GP		 1879{
1880 struct sk_buff *skb, *tx_skb;
18a48e76
MM		 1881 struct l2cap_ctrl *control;
1882 int sent = 0;
1883
1884 BT_DBG("chan %p", chan);
1c2acffb 1885
89bc500e 1886 if (chan->state != BT_CONNECTED)
c13ffa62 1887 return -ENOTCONN;
e90bac06 1888
94122bbe
MM		 1889 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
1890 return 0;
1891
b99e13ad
MM		 1892 if (__chan_is_moving(chan))
1893 return 0;
1894
18a48e76
MM		 1895 while (chan->tx_send_head &&
1896 chan->unacked_frames < chan->remote_tx_win &&
1897 chan->tx_state == L2CAP_TX_STATE_XMIT) {
e420aba3 1898
18a48e76 1899 skb = chan->tx_send_head;
e90bac06 1900
a4368ff3
JH		 1901 bt_cb(skb)->l2cap.retries = 1;
1902 control = &bt_cb(skb)->l2cap;
95ffa978 1903
e2ab4353 1904 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
18a48e76 1905 control->final = 1;
e2ab4353 1906
18a48e76
MM		 1907 control->reqseq = chan->buffer_seq;
1908 chan->last_acked_seq = chan->buffer_seq;
1909 control->txseq = chan->next_tx_seq;
1c2acffb 1910
18a48e76 1911 __pack_control(chan, control, skb);
e90bac06 1912
47d1ec61 1913 if (chan->fcs == L2CAP_FCS_CRC16) {
18a48e76
MM		 1914 u16 fcs = crc16(0, (u8 *) skb->data, skb->len);
1915 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
fcc203c3
GP		 1916 }
1917
18a48e76
MM		 1918 /* Clone after data has been modified. Data is assumed to be
1919 read-only (for locking purposes) on cloned sk_buffs.
1920 */
1921 tx_skb = skb_clone(skb, GFP_KERNEL);
9a9c6a34 1922
18a48e76
MM		 1923 if (!tx_skb)
1924 break;
1c2acffb 1925
18a48e76 1926 __set_retrans_timer(chan);
836be934
AE		 1927
1928 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
18a48e76 1929 chan->unacked_frames++;
6a026610 1930 chan->frames_sent++;
18a48e76 1931 sent++;
1c2acffb 1932
58d35f87
GP		 1933 if (skb_queue_is_last(&chan->tx_q, skb))
1934 chan->tx_send_head = NULL;
1c2acffb 1935 else
58d35f87 1936 chan->tx_send_head = skb_queue_next(&chan->tx_q, skb);
18a48e76
MM		 1937
1938 l2cap_do_send(chan, tx_skb);
b4400672 1939 BT_DBG("Sent txseq %u", control->txseq);
1c2acffb
GP		 1940 }
1941
b4400672
AE		 1942 BT_DBG("Sent %d, %u unacked, %u in ERTM queue", sent,
1943 chan->unacked_frames, skb_queue_len(&chan->tx_q));
18a48e76
MM		 1944
1945 return sent;
9e917af1
GP		 1946}
1947
e1fbd4c1
MM		 1948static void l2cap_ertm_resend(struct l2cap_chan *chan)
1949{
1950 struct l2cap_ctrl control;
1951 struct sk_buff *skb;
1952 struct sk_buff *tx_skb;
1953 u16 seq;
1954
1955 BT_DBG("chan %p", chan);
1956
1957 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
1958 return;
1959
b99e13ad
MM		 1960 if (__chan_is_moving(chan))
1961 return;
1962
e1fbd4c1
MM		 1963 while (chan->retrans_list.head != L2CAP_SEQ_LIST_CLEAR) {
1964 seq = l2cap_seq_list_pop(&chan->retrans_list);
1965
1966 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, seq);
1967 if (!skb) {
1968 BT_DBG("Error: Can't retransmit seq %d, frame missing",
2d792818 1969 seq);
e1fbd4c1
MM		 1970 continue;
1971 }
1972
a4368ff3
JH		 1973 bt_cb(skb)->l2cap.retries++;
1974 control = bt_cb(skb)->l2cap;
e1fbd4c1
MM		 1975
1976 if (chan->max_tx != 0 &&
a4368ff3 1977 bt_cb(skb)->l2cap.retries > chan->max_tx) {
e1fbd4c1 1978 BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
5e4e3972 1979 l2cap_send_disconn_req(chan, ECONNRESET);
e1fbd4c1
MM		 1980 l2cap_seq_list_clear(&chan->retrans_list);
1981 break;
1982 }
1983
1984 control.reqseq = chan->buffer_seq;
1985 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
1986 control.final = 1;
1987 else
1988 control.final = 0;
1989
1990 if (skb_cloned(skb)) {
1991 /* Cloned sk_buffs are read-only, so we need a
1992 * writeable copy
1993 */
8bcde1f2 1994 tx_skb = skb_copy(skb, GFP_KERNEL);
e1fbd4c1 1995 } else {
8bcde1f2 1996 tx_skb = skb_clone(skb, GFP_KERNEL);
e1fbd4c1
MM		 1997 }
1998
1999 if (!tx_skb) {
2000 l2cap_seq_list_clear(&chan->retrans_list);
2001 break;
2002 }
2003
2004 /* Update skb contents */
2005 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
2006 put_unaligned_le32(__pack_extended_control(&control),
2007 tx_skb->data + L2CAP_HDR_SIZE);
2008 } else {
2009 put_unaligned_le16(__pack_enhanced_control(&control),
2010 tx_skb->data + L2CAP_HDR_SIZE);
2011 }
2012
13cac152 2013 /* Update FCS */
e1fbd4c1 2014 if (chan->fcs == L2CAP_FCS_CRC16) {
13cac152
LR		 2015 u16 fcs = crc16(0, (u8 *) tx_skb->data,
2016 tx_skb->len - L2CAP_FCS_SIZE);
2017 put_unaligned_le16(fcs, skb_tail_pointer(tx_skb) -
2018 L2CAP_FCS_SIZE);
e1fbd4c1
MM		 2019 }
2020
2021 l2cap_do_send(chan, tx_skb);
2022
2023 BT_DBG("Resent txseq %d", control.txseq);
2024
2025 chan->last_acked_seq = chan->buffer_seq;
2026 }
2027}
2028
f80842a8
MM		 2029static void l2cap_retransmit(struct l2cap_chan *chan,
2030 struct l2cap_ctrl *control)
2031{
2032 BT_DBG("chan %p, control %p", chan, control);
2033
2034 l2cap_seq_list_append(&chan->retrans_list, control->reqseq);
2035 l2cap_ertm_resend(chan);
2036}
2037
d2a7ac5d
MM		 2038static void l2cap_retransmit_all(struct l2cap_chan *chan,
2039 struct l2cap_ctrl *control)
2040{
e1fbd4c1
MM		 2041 struct sk_buff *skb;
2042
2043 BT_DBG("chan %p, control %p", chan, control);
2044
2045 if (control->poll)
2046 set_bit(CONN_SEND_FBIT, &chan->conn_state);
2047
2048 l2cap_seq_list_clear(&chan->retrans_list);
2049
2050 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
2051 return;
2052
2053 if (chan->unacked_frames) {
2054 skb_queue_walk(&chan->tx_q, skb) {
a4368ff3 2055 if (bt_cb(skb)->l2cap.txseq == control->reqseq ||
2d792818 2056 skb == chan->tx_send_head)
e1fbd4c1
MM		 2057 break;
2058 }
2059
2060 skb_queue_walk_from(&chan->tx_q, skb) {
2061 if (skb == chan->tx_send_head)
2062 break;
2063
2064 l2cap_seq_list_append(&chan->retrans_list,
a4368ff3 2065 bt_cb(skb)->l2cap.txseq);
e1fbd4c1
MM		 2066 }
2067
2068 l2cap_ertm_resend(chan);
2069 }
d2a7ac5d
MM		 2070}
2071
0a0aba42 2072static void l2cap_send_ack(struct l2cap_chan *chan)
9e917af1 2073{
0a0aba42
MM		 2074 struct l2cap_ctrl control;
2075 u16 frames_to_ack = __seq_offset(chan, chan->buffer_seq,
2076 chan->last_acked_seq);
2077 int threshold;
9e917af1 2078
0a0aba42
MM		 2079 BT_DBG("chan %p last_acked_seq %d buffer_seq %d",
2080 chan, chan->last_acked_seq, chan->buffer_seq);
9e917af1 2081
0a0aba42
MM		 2082 memset(&control, 0, sizeof(control));
2083 control.sframe = 1;
dfc909be 2084
0a0aba42
MM		 2085 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&
2086 chan->rx_state == L2CAP_RX_STATE_RECV) {
2087 __clear_ack_timer(chan);
2088 control.super = L2CAP_SUPER_RNR;
2089 control.reqseq = chan->buffer_seq;
2090 l2cap_send_sframe(chan, &control);
2091 } else {
2092 if (!test_bit(CONN_REMOTE_BUSY, &chan->conn_state)) {
2093 l2cap_ertm_send(chan);
2094 /* If any i-frames were sent, they included an ack */
2095 if (chan->buffer_seq == chan->last_acked_seq)
2096 frames_to_ack = 0;
2097 }
dfc909be 2098
c20f8e35 2099 /* Ack now if the window is 3/4ths full.
0a0aba42
MM		 2100 * Calculate without mul or div
2101 */
c20f8e35 2102 threshold = chan->ack_win;
0a0aba42
MM		 2103 threshold += threshold << 1;
2104 threshold >>= 2;
2105
b4400672 2106 BT_DBG("frames_to_ack %u, threshold %d", frames_to_ack,
0a0aba42
MM		 2107 threshold);
2108
2109 if (frames_to_ack >= threshold) {
2110 __clear_ack_timer(chan);
2111 control.super = L2CAP_SUPER_RR;
2112 control.reqseq = chan->buffer_seq;
2113 l2cap_send_sframe(chan, &control);
2114 frames_to_ack = 0;
2115 }
1c2acffb 2116
0a0aba42
MM		 2117 if (frames_to_ack)
2118 __set_ack_timer(chan);
2119 }
b17e73bb
SJ		 2120}
2121
04124681
GP		 2122static inline int l2cap_skbuff_fromiovec(struct l2cap_chan *chan,
2123 struct msghdr *msg, int len,
2124 int count, struct sk_buff *skb)
1c2acffb 2125{
0952a57a 2126 struct l2cap_conn *conn = chan->conn;
1c2acffb 2127 struct sk_buff **frag;
90338947 2128 int sent = 0;
1da177e4 2129
cbbd26b8 2130 if (!copy_from_iter_full(skb_put(skb, count), count, &msg->msg_iter))
1c2acffb 2131 return -EFAULT;
1da177e4
LT		 2132
2133 sent += count;
2134 len -= count;
2135
2136 /* Continuation fragments (no L2CAP header) */
2137 frag = &skb_shinfo(skb)->frag_list;
2138 while (len) {
fbe00700
GP		 2139 struct sk_buff *tmp;
2140
1da177e4
LT		 2141 count = min_t(unsigned int, conn->mtu, len);
2142
d9fbd02b 2143 tmp = chan->ops->alloc_skb(chan, 0, count,
fbe00700
GP		 2144 msg->msg_flags & MSG_DONTWAIT);
2145 if (IS_ERR(tmp))
2146 return PTR_ERR(tmp);
2147
2148 *frag = tmp;
2f7719ce 2149
cbbd26b8
AV		 2150 if (!copy_from_iter_full(skb_put(*frag, count), count,
2151 &msg->msg_iter))
1c2acffb 2152 return -EFAULT;
1da177e4
LT		 2153
2154 sent += count;
2155 len -= count;
2156
2d0ed3d5
GP		 2157 skb->len += (*frag)->len;
2158 skb->data_len += (*frag)->len;
2159
1da177e4
LT		 2160 frag = &(*frag)->next;
2161 }
1da177e4
LT		 2162
2163 return sent;
1c2acffb 2164}
1da177e4 2165
5e59b791 2166static struct sk_buff *l2cap_create_connless_pdu(struct l2cap_chan *chan,
8d46321c 2167 struct msghdr *msg, size_t len)
1c2acffb 2168{
8c1d787b 2169 struct l2cap_conn *conn = chan->conn;
1c2acffb 2170 struct sk_buff *skb;
03a51213 2171 int err, count, hlen = L2CAP_HDR_SIZE + L2CAP_PSMLEN_SIZE;
1c2acffb
GP		 2172 struct l2cap_hdr *lh;
2173
8d46321c
MH		 2174 BT_DBG("chan %p psm 0x%2.2x len %zu", chan,
2175 __le16_to_cpu(chan->psm), len);
1c2acffb
GP		 2176
2177 count = min_t(unsigned int, (conn->mtu - hlen), len);
2f7719ce 2178
d9fbd02b 2179 skb = chan->ops->alloc_skb(chan, hlen, count,
90338947
GP		 2180 msg->msg_flags & MSG_DONTWAIT);
2181 if (IS_ERR(skb))
2182 return skb;
1c2acffb
GP		 2183
2184 /* Create L2CAP header */
4df864c1 2185 lh = skb_put(skb, L2CAP_HDR_SIZE);
fe4128e0 2186 lh->cid = cpu_to_le16(chan->dcid);
daf6a78c 2187 lh->len = cpu_to_le16(len + L2CAP_PSMLEN_SIZE);
43b1b8df 2188 put_unaligned(chan->psm, (__le16 *) skb_put(skb, L2CAP_PSMLEN_SIZE));
1c2acffb 2189
0952a57a 2190 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
1c2acffb
GP		 2191 if (unlikely(err < 0)) {
2192 kfree_skb(skb);
2193 return ERR_PTR(err);
2194 }
2195 return skb;
2196}
2197
5e59b791 2198static struct sk_buff *l2cap_create_basic_pdu(struct l2cap_chan *chan,
8d46321c 2199 struct msghdr *msg, size_t len)
1c2acffb 2200{
8c1d787b 2201 struct l2cap_conn *conn = chan->conn;
1c2acffb 2202 struct sk_buff *skb;
f2ba7fae 2203 int err, count;
1c2acffb
GP		 2204 struct l2cap_hdr *lh;
2205
b4400672 2206 BT_DBG("chan %p len %zu", chan, len);
1c2acffb 2207
f2ba7fae 2208 count = min_t(unsigned int, (conn->mtu - L2CAP_HDR_SIZE), len);
2f7719ce 2209
d9fbd02b 2210 skb = chan->ops->alloc_skb(chan, L2CAP_HDR_SIZE, count,
90338947
GP		 2211 msg->msg_flags & MSG_DONTWAIT);
2212 if (IS_ERR(skb))
2213 return skb;
1c2acffb
GP		 2214
2215 /* Create L2CAP header */
4df864c1 2216 lh = skb_put(skb, L2CAP_HDR_SIZE);
fe4128e0 2217 lh->cid = cpu_to_le16(chan->dcid);
6ff9b5ef 2218 lh->len = cpu_to_le16(len);
1c2acffb 2219
0952a57a 2220 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
1c2acffb
GP		 2221 if (unlikely(err < 0)) {
2222 kfree_skb(skb);
2223 return ERR_PTR(err);
2224 }
2225 return skb;
2226}
2227
ab0ff76d 2228static struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan,
b4400672
AE		 2229 struct msghdr *msg, size_t len,
2230 u16 sdulen)
1c2acffb 2231{
8c1d787b 2232 struct l2cap_conn *conn = chan->conn;
1c2acffb 2233 struct sk_buff *skb;
e4ca6d98 2234 int err, count, hlen;
1c2acffb
GP		 2235 struct l2cap_hdr *lh;
2236
b4400672 2237 BT_DBG("chan %p len %zu", chan, len);
1c2acffb 2238
0ee0d208
GP		 2239 if (!conn)
2240 return ERR_PTR(-ENOTCONN);
2241
ba7aa64f 2242 hlen = __ertm_hdr_size(chan);
e4ca6d98 2243
c74e560c 2244 if (sdulen)
03a51213 2245 hlen += L2CAP_SDULEN_SIZE;
c74e560c 2246
47d1ec61 2247 if (chan->fcs == L2CAP_FCS_CRC16)
03a51213 2248 hlen += L2CAP_FCS_SIZE;
fcc203c3 2249
1c2acffb 2250 count = min_t(unsigned int, (conn->mtu - hlen), len);
2f7719ce 2251
d9fbd02b 2252 skb = chan->ops->alloc_skb(chan, hlen, count,
90338947
GP		 2253 msg->msg_flags & MSG_DONTWAIT);
2254 if (IS_ERR(skb))
2255 return skb;
1c2acffb
GP		 2256
2257 /* Create L2CAP header */
4df864c1 2258 lh = skb_put(skb, L2CAP_HDR_SIZE);
fe4128e0 2259 lh->cid = cpu_to_le16(chan->dcid);
1c2acffb 2260 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
88843ab0 2261
18a48e76
MM		 2262 /* Control header is populated later */
2263 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
2264 put_unaligned_le32(0, skb_put(skb, L2CAP_EXT_CTRL_SIZE));
2265 else
2266 put_unaligned_le16(0, skb_put(skb, L2CAP_ENH_CTRL_SIZE));
88843ab0 2267
c74e560c 2268 if (sdulen)
03a51213 2269 put_unaligned_le16(sdulen, skb_put(skb, L2CAP_SDULEN_SIZE));
1c2acffb 2270
0952a57a 2271 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
1c2acffb
GP		 2272 if (unlikely(err < 0)) {
2273 kfree_skb(skb);
2274 return ERR_PTR(err);
2275 }
e90bac06 2276
a4368ff3
JH		 2277 bt_cb(skb)->l2cap.fcs = chan->fcs;
2278 bt_cb(skb)->l2cap.retries = 0;
1c2acffb 2279 return skb;
1da177e4
LT		 2280}
2281
94122bbe
MM		 2282static int l2cap_segment_sdu(struct l2cap_chan *chan,
2283 struct sk_buff_head *seg_queue,
2284 struct msghdr *msg, size_t len)
c74e560c 2285{
c74e560c 2286 struct sk_buff *skb;
94122bbe
MM		 2287 u16 sdu_len;
2288 size_t pdu_len;
94122bbe 2289 u8 sar;
c74e560c 2290
b4400672 2291 BT_DBG("chan %p, msg %p, len %zu", chan, msg, len);
c74e560c 2292
94122bbe
MM		 2293 /* It is critical that ERTM PDUs fit in a single HCI fragment,
2294 * so fragmented skbs are not used. The HCI layer's handling
2295 * of fragmented skbs is not compatible with ERTM's queueing.
2296 */
c74e560c 2297
94122bbe
MM		 2298 /* PDU size is derived from the HCI MTU */
2299 pdu_len = chan->conn->mtu;
c74e560c 2300
a549574d
MM		 2301 /* Constrain PDU size for BR/EDR connections */
2302 if (!chan->hs_hcon)
2303 pdu_len = min_t(size_t, pdu_len, L2CAP_BREDR_MAX_PAYLOAD);
94122bbe
MM		 2304
2305 /* Adjust for largest possible L2CAP overhead. */
35d401df
GP		 2306 if (chan->fcs)
2307 pdu_len -= L2CAP_FCS_SIZE;
2308
ba7aa64f 2309 pdu_len -= __ertm_hdr_size(chan);
94122bbe
MM		 2310
2311 /* Remote device may have requested smaller PDUs */
2312 pdu_len = min_t(size_t, pdu_len, chan->remote_mps);
2313
2314 if (len <= pdu_len) {
2315 sar = L2CAP_SAR_UNSEGMENTED;
2316 sdu_len = 0;
2317 pdu_len = len;
2318 } else {
2319 sar = L2CAP_SAR_START;
2320 sdu_len = len;
94122bbe
MM		 2321 }
2322
2323 while (len > 0) {
2324 skb = l2cap_create_iframe_pdu(chan, msg, pdu_len, sdu_len);
c74e560c 2325
c74e560c 2326 if (IS_ERR(skb)) {
94122bbe 2327 __skb_queue_purge(seg_queue);
c74e560c
GP		 2328 return PTR_ERR(skb);
2329 }
2330
a4368ff3 2331 bt_cb(skb)->l2cap.sar = sar;
94122bbe
MM		 2332 __skb_queue_tail(seg_queue, skb);
2333
2334 len -= pdu_len;
069cb270 2335 if (sdu_len)
94122bbe 2336 sdu_len = 0;
94122bbe
MM		 2337
2338 if (len <= pdu_len) {
2339 sar = L2CAP_SAR_END;
2340 pdu_len = len;
2341 } else {
2342 sar = L2CAP_SAR_CONTINUE;
2343 }
c74e560c 2344 }
c74e560c 2345
f0f62799 2346 return 0;
c74e560c
GP		 2347}
2348
177f8f2b
JH		 2349static struct sk_buff *l2cap_create_le_flowctl_pdu(struct l2cap_chan *chan,
2350 struct msghdr *msg,
2351 size_t len, u16 sdulen)
2352{
2353 struct l2cap_conn *conn = chan->conn;
2354 struct sk_buff *skb;
2355 int err, count, hlen;
2356 struct l2cap_hdr *lh;
2357
2358 BT_DBG("chan %p len %zu", chan, len);
2359
2360 if (!conn)
2361 return ERR_PTR(-ENOTCONN);
2362
2363 hlen = L2CAP_HDR_SIZE;
2364
2365 if (sdulen)
2366 hlen += L2CAP_SDULEN_SIZE;
2367
2368 count = min_t(unsigned int, (conn->mtu - hlen), len);
2369
d9fbd02b 2370 skb = chan->ops->alloc_skb(chan, hlen, count,
177f8f2b
JH		 2371 msg->msg_flags & MSG_DONTWAIT);
2372 if (IS_ERR(skb))
2373 return skb;
2374
2375 /* Create L2CAP header */
4df864c1 2376 lh = skb_put(skb, L2CAP_HDR_SIZE);
177f8f2b
JH		 2377 lh->cid = cpu_to_le16(chan->dcid);
2378 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
2379
2380 if (sdulen)
2381 put_unaligned_le16(sdulen, skb_put(skb, L2CAP_SDULEN_SIZE));
2382
2383 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
2384 if (unlikely(err < 0)) {
2385 kfree_skb(skb);
2386 return ERR_PTR(err);
2387 }
2388
2389 return skb;
2390}
2391
2392static int l2cap_segment_le_sdu(struct l2cap_chan *chan,
2393 struct sk_buff_head *seg_queue,
2394 struct msghdr *msg, size_t len)
2395{
2396 struct sk_buff *skb;
2397 size_t pdu_len;
2398 u16 sdu_len;
2399
2400 BT_DBG("chan %p, msg %p, len %zu", chan, msg, len);
2401
177f8f2b 2402 sdu_len = len;
72c6fb91 2403 pdu_len = chan->remote_mps - L2CAP_SDULEN_SIZE;
177f8f2b
JH		 2404
2405 while (len > 0) {
2406 if (len <= pdu_len)
2407 pdu_len = len;
2408
2409 skb = l2cap_create_le_flowctl_pdu(chan, msg, pdu_len, sdu_len);
2410 if (IS_ERR(skb)) {
2411 __skb_queue_purge(seg_queue);
2412 return PTR_ERR(skb);
2413 }
2414
2415 __skb_queue_tail(seg_queue, skb);
2416
2417 len -= pdu_len;
2418
2419 if (sdu_len) {
2420 sdu_len = 0;
2421 pdu_len += L2CAP_SDULEN_SIZE;
2422 }
2423 }
2424
2425 return 0;
2426}
2427
8a505b7f
LAD		 2428static void l2cap_le_flowctl_send(struct l2cap_chan *chan)
2429{
2430 int sent = 0;
2431
2432 BT_DBG("chan %p", chan);
2433
2434 while (chan->tx_credits && !skb_queue_empty(&chan->tx_q)) {
2435 l2cap_do_send(chan, skb_dequeue(&chan->tx_q));
2436 chan->tx_credits--;
2437 sent++;
2438 }
2439
2440 BT_DBG("Sent %d credits %u queued %u", sent, chan->tx_credits,
2441 skb_queue_len(&chan->tx_q));
2442}
2443
8d46321c 2444int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len)
9a91a04a 2445{
9a91a04a 2446 struct sk_buff *skb;
9a91a04a 2447 int err;
94122bbe 2448 struct sk_buff_head seg_queue;
9a91a04a 2449
31e8ce80
SWK		 2450 if (!chan->conn)
2451 return -ENOTCONN;
2452
9a91a04a 2453 /* Connectionless channel */
715ec005 2454 if (chan->chan_type == L2CAP_CHAN_CONN_LESS) {
8d46321c 2455 skb = l2cap_create_connless_pdu(chan, msg, len);
9a91a04a
GP		 2456 if (IS_ERR(skb))
2457 return PTR_ERR(skb);
2458
ede81a2a
AK		 2459 /* Channel lock is released before requesting new skb and then
2460 * reacquired thus we need to recheck channel state.
2461 */
2462 if (chan->state != BT_CONNECTED) {
2463 kfree_skb(skb);
2464 return -ENOTCONN;
2465 }
2466
9a91a04a
GP		 2467 l2cap_do_send(chan, skb);
2468 return len;
2469 }
2470
2471 switch (chan->mode) {
38319713 2472 case L2CAP_MODE_LE_FLOWCTL:
177f8f2b
JH		 2473 /* Check outgoing MTU */
2474 if (len > chan->omtu)
2475 return -EMSGSIZE;
2476
177f8f2b
JH		 2477 __skb_queue_head_init(&seg_queue);
2478
2479 err = l2cap_segment_le_sdu(chan, &seg_queue, msg, len);
2480
2481 if (chan->state != BT_CONNECTED) {
2482 __skb_queue_purge(&seg_queue);
2483 err = -ENOTCONN;
2484 }
2485
2486 if (err)
2487 return err;
2488
2489 skb_queue_splice_tail_init(&seg_queue, &chan->tx_q);
2490
8a505b7f 2491 l2cap_le_flowctl_send(chan);
177f8f2b
JH		 2492
2493 if (!chan->tx_credits)
2494 chan->ops->suspend(chan);
2495
2496 err = len;
2497
2498 break;
2499
fad5fc89 2500 case L2CAP_MODE_BASIC:
9a91a04a
GP		 2501 /* Check outgoing MTU */
2502 if (len > chan->omtu)
2503 return -EMSGSIZE;
2504
2505 /* Create a basic PDU */
8d46321c 2506 skb = l2cap_create_basic_pdu(chan, msg, len);
9a91a04a
GP		 2507 if (IS_ERR(skb))
2508 return PTR_ERR(skb);
2509
ede81a2a
AK		 2510 /* Channel lock is released before requesting new skb and then
2511 * reacquired thus we need to recheck channel state.
2512 */
2513 if (chan->state != BT_CONNECTED) {
2514 kfree_skb(skb);
2515 return -ENOTCONN;
2516 }
2517
9a91a04a
GP		 2518 l2cap_do_send(chan, skb);
2519 err = len;
2520 break;
2521
2522 case L2CAP_MODE_ERTM:
2523 case L2CAP_MODE_STREAMING:
94122bbe
MM		 2524 /* Check outgoing MTU */
2525 if (len > chan->omtu) {
2526 err = -EMSGSIZE;
2527 break;
2528 }
9a91a04a 2529
94122bbe 2530 __skb_queue_head_init(&seg_queue);
9a91a04a 2531
94122bbe
MM		 2532 /* Do segmentation before calling in to the state machine,
2533 * since it's possible to block while waiting for memory
2534 * allocation.
2535 */
2536 err = l2cap_segment_sdu(chan, &seg_queue, msg, len);
9a91a04a 2537
94122bbe
MM		 2538 /* The channel could have been closed while segmenting,
2539 * check that it is still connected.
2540 */
2541 if (chan->state != BT_CONNECTED) {
2542 __skb_queue_purge(&seg_queue);
2543 err = -ENOTCONN;
9a91a04a
GP		 2544 }
2545
94122bbe 2546 if (err)
9a91a04a 2547 break;
9a91a04a 2548
3733937d 2549 if (chan->mode == L2CAP_MODE_ERTM)
d660366d 2550 l2cap_tx(chan, NULL, &seg_queue, L2CAP_EV_DATA_REQUEST);
3733937d 2551 else
d660366d 2552 l2cap_streaming_send(chan, &seg_queue);
9a91a04a 2553
d660366d 2554 err = len;
9a91a04a 2555
94122bbe
MM		 2556 /* If the skbs were not queued for sending, they'll still be in
2557 * seg_queue and need to be purged.
2558 */
2559 __skb_queue_purge(&seg_queue);
9a91a04a
GP		 2560 break;
2561
2562 default:
2563 BT_DBG("bad state %1.1x", chan->mode);
2564 err = -EBADFD;
2565 }
2566
2567 return err;
2568}
6b8d4a6a 2569EXPORT_SYMBOL_GPL(l2cap_chan_send);
9a91a04a 2570
d2a7ac5d
MM		 2571static void l2cap_send_srej(struct l2cap_chan *chan, u16 txseq)
2572{
bed68bde
MM		 2573 struct l2cap_ctrl control;
2574 u16 seq;
2575
b4400672 2576 BT_DBG("chan %p, txseq %u", chan, txseq);
bed68bde
MM		 2577
2578 memset(&control, 0, sizeof(control));
2579 control.sframe = 1;
2580 control.super = L2CAP_SUPER_SREJ;
2581
2582 for (seq = chan->expected_tx_seq; seq != txseq;
2583 seq = __next_seq(chan, seq)) {
2584 if (!l2cap_ertm_seq_in_queue(&chan->srej_q, seq)) {
2585 control.reqseq = seq;
2586 l2cap_send_sframe(chan, &control);
2587 l2cap_seq_list_append(&chan->srej_list, seq);
2588 }
2589 }
2590
2591 chan->expected_tx_seq = __next_seq(chan, txseq);
d2a7ac5d
MM		 2592}
2593
2594static void l2cap_send_srej_tail(struct l2cap_chan *chan)
2595{
bed68bde
MM		 2596 struct l2cap_ctrl control;
2597
2598 BT_DBG("chan %p", chan);
2599
2600 if (chan->srej_list.tail == L2CAP_SEQ_LIST_CLEAR)
2601 return;
2602
2603 memset(&control, 0, sizeof(control));
2604 control.sframe = 1;
2605 control.super = L2CAP_SUPER_SREJ;
2606 control.reqseq = chan->srej_list.tail;
2607 l2cap_send_sframe(chan, &control);
d2a7ac5d
MM		 2608}
2609
2610static void l2cap_send_srej_list(struct l2cap_chan *chan, u16 txseq)
2611{
bed68bde
MM		 2612 struct l2cap_ctrl control;
2613 u16 initial_head;
2614 u16 seq;
2615
b4400672 2616 BT_DBG("chan %p, txseq %u", chan, txseq);
bed68bde
MM		 2617
2618 memset(&control, 0, sizeof(control));
2619 control.sframe = 1;
2620 control.super = L2CAP_SUPER_SREJ;
2621
2622 /* Capture initial list head to allow only one pass through the list. */
2623 initial_head = chan->srej_list.head;
2624
2625 do {
2626 seq = l2cap_seq_list_pop(&chan->srej_list);
2627 if (seq == txseq || seq == L2CAP_SEQ_LIST_CLEAR)
2628 break;
2629
2630 control.reqseq = seq;
2631 l2cap_send_sframe(chan, &control);
2632 l2cap_seq_list_append(&chan->srej_list, seq);
2633 } while (chan->srej_list.head != initial_head);
d2a7ac5d
MM		 2634}
2635
608bcc6d
MM		 2636static void l2cap_process_reqseq(struct l2cap_chan *chan, u16 reqseq)
2637{
2638 struct sk_buff *acked_skb;
2639 u16 ackseq;
2640
b4400672 2641 BT_DBG("chan %p, reqseq %u", chan, reqseq);
608bcc6d
MM		 2642
2643 if (chan->unacked_frames == 0 || reqseq == chan->expected_ack_seq)
2644 return;
2645
b4400672 2646 BT_DBG("expected_ack_seq %u, unacked_frames %u",
608bcc6d
MM		 2647 chan->expected_ack_seq, chan->unacked_frames);
2648
2649 for (ackseq = chan->expected_ack_seq; ackseq != reqseq;
2650 ackseq = __next_seq(chan, ackseq)) {
2651
2652 acked_skb = l2cap_ertm_seq_in_queue(&chan->tx_q, ackseq);
2653 if (acked_skb) {
2654 skb_unlink(acked_skb, &chan->tx_q);
2655 kfree_skb(acked_skb);
2656 chan->unacked_frames--;
2657 }
2658 }
2659
2660 chan->expected_ack_seq = reqseq;
2661
2662 if (chan->unacked_frames == 0)
2663 __clear_retrans_timer(chan);
2664
b4400672 2665 BT_DBG("unacked_frames %u", chan->unacked_frames);
608bcc6d
MM		 2666}
2667
2668static void l2cap_abort_rx_srej_sent(struct l2cap_chan *chan)
2669{
2670 BT_DBG("chan %p", chan);
2671
2672 chan->expected_tx_seq = chan->buffer_seq;
2673 l2cap_seq_list_clear(&chan->srej_list);
2674 skb_queue_purge(&chan->srej_q);
2675 chan->rx_state = L2CAP_RX_STATE_RECV;
2676}
2677
d660366d
GP		 2678static void l2cap_tx_state_xmit(struct l2cap_chan *chan,
2679 struct l2cap_ctrl *control,
2680 struct sk_buff_head *skbs, u8 event)
608bcc6d 2681{
608bcc6d
MM		 2682 BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,
2683 event);
2684
2685 switch (event) {
2686 case L2CAP_EV_DATA_REQUEST:
2687 if (chan->tx_send_head == NULL)
2688 chan->tx_send_head = skb_peek(skbs);
2689
2690 skb_queue_splice_tail_init(skbs, &chan->tx_q);
2691 l2cap_ertm_send(chan);
2692 break;
2693 case L2CAP_EV_LOCAL_BUSY_DETECTED:
2694 BT_DBG("Enter LOCAL_BUSY");
2695 set_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2696
2697 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
2698 /* The SREJ_SENT state must be aborted if we are to
2699 * enter the LOCAL_BUSY state.
2700 */
2701 l2cap_abort_rx_srej_sent(chan);
2702 }
2703
2704 l2cap_send_ack(chan);
2705
2706 break;
2707 case L2CAP_EV_LOCAL_BUSY_CLEAR:
2708 BT_DBG("Exit LOCAL_BUSY");
2709 clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2710
2711 if (test_bit(CONN_RNR_SENT, &chan->conn_state)) {
2712 struct l2cap_ctrl local_control;
2713
2714 memset(&local_control, 0, sizeof(local_control));
2715 local_control.sframe = 1;
2716 local_control.super = L2CAP_SUPER_RR;
2717 local_control.poll = 1;
2718 local_control.reqseq = chan->buffer_seq;
a67d7f6f 2719 l2cap_send_sframe(chan, &local_control);
608bcc6d
MM		 2720
2721 chan->retry_count = 1;
2722 __set_monitor_timer(chan);
2723 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2724 }
2725 break;
2726 case L2CAP_EV_RECV_REQSEQ_AND_FBIT:
2727 l2cap_process_reqseq(chan, control->reqseq);
2728 break;
2729 case L2CAP_EV_EXPLICIT_POLL:
2730 l2cap_send_rr_or_rnr(chan, 1);
2731 chan->retry_count = 1;
2732 __set_monitor_timer(chan);
2733 __clear_ack_timer(chan);
2734 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2735 break;
2736 case L2CAP_EV_RETRANS_TO:
2737 l2cap_send_rr_or_rnr(chan, 1);
2738 chan->retry_count = 1;
2739 __set_monitor_timer(chan);
2740 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2741 break;
2742 case L2CAP_EV_RECV_FBIT:
2743 /* Nothing to process */
2744 break;
2745 default:
2746 break;
2747 }
608bcc6d
MM		 2748}
2749
d660366d
GP		 2750static void l2cap_tx_state_wait_f(struct l2cap_chan *chan,
2751 struct l2cap_ctrl *control,
2752 struct sk_buff_head *skbs, u8 event)
608bcc6d 2753{
608bcc6d
MM		 2754 BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,
2755 event);
2756
2757 switch (event) {
2758 case L2CAP_EV_DATA_REQUEST:
2759 if (chan->tx_send_head == NULL)
2760 chan->tx_send_head = skb_peek(skbs);
2761 /* Queue data, but don't send. */
2762 skb_queue_splice_tail_init(skbs, &chan->tx_q);
2763 break;
2764 case L2CAP_EV_LOCAL_BUSY_DETECTED:
2765 BT_DBG("Enter LOCAL_BUSY");
2766 set_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2767
2768 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
2769 /* The SREJ_SENT state must be aborted if we are to
2770 * enter the LOCAL_BUSY state.
2771 */
2772 l2cap_abort_rx_srej_sent(chan);
2773 }
2774
2775 l2cap_send_ack(chan);
2776
2777 break;
2778 case L2CAP_EV_LOCAL_BUSY_CLEAR:
2779 BT_DBG("Exit LOCAL_BUSY");
2780 clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2781
2782 if (test_bit(CONN_RNR_SENT, &chan->conn_state)) {
2783 struct l2cap_ctrl local_control;
2784 memset(&local_control, 0, sizeof(local_control));
2785 local_control.sframe = 1;
2786 local_control.super = L2CAP_SUPER_RR;
2787 local_control.poll = 1;
2788 local_control.reqseq = chan->buffer_seq;
a67d7f6f 2789 l2cap_send_sframe(chan, &local_control);
608bcc6d
MM		 2790
2791 chan->retry_count = 1;
2792 __set_monitor_timer(chan);
2793 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2794 }
2795 break;
2796 case L2CAP_EV_RECV_REQSEQ_AND_FBIT:
2797 l2cap_process_reqseq(chan, control->reqseq);
2798
2799 /* Fall through */
2800
2801 case L2CAP_EV_RECV_FBIT:
2802 if (control && control->final) {
2803 __clear_monitor_timer(chan);
2804 if (chan->unacked_frames > 0)
2805 __set_retrans_timer(chan);
2806 chan->retry_count = 0;
2807 chan->tx_state = L2CAP_TX_STATE_XMIT;
2808 BT_DBG("recv fbit tx_state 0x2.2%x", chan->tx_state);
2809 }
2810 break;
2811 case L2CAP_EV_EXPLICIT_POLL:
2812 /* Ignore */
2813 break;
2814 case L2CAP_EV_MONITOR_TO:
2815 if (chan->max_tx == 0 || chan->retry_count < chan->max_tx) {
2816 l2cap_send_rr_or_rnr(chan, 1);
2817 __set_monitor_timer(chan);
2818 chan->retry_count++;
2819 } else {
5e4e3972 2820 l2cap_send_disconn_req(chan, ECONNABORTED);
608bcc6d
MM		 2821 }
2822 break;
2823 default:
2824 break;
2825 }
608bcc6d
MM		 2826}
2827
d660366d
GP		 2828static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
2829 struct sk_buff_head *skbs, u8 event)
608bcc6d 2830{
608bcc6d
MM		 2831 BT_DBG("chan %p, control %p, skbs %p, event %d, state %d",
2832 chan, control, skbs, event, chan->tx_state);
2833
2834 switch (chan->tx_state) {
2835 case L2CAP_TX_STATE_XMIT:
d660366d 2836 l2cap_tx_state_xmit(chan, control, skbs, event);
608bcc6d
MM		 2837 break;
2838 case L2CAP_TX_STATE_WAIT_F:
d660366d 2839 l2cap_tx_state_wait_f(chan, control, skbs, event);
608bcc6d
MM		 2840 break;
2841 default:
2842 /* Ignore event */
2843 break;
2844 }
608bcc6d
MM		 2845}
2846
4b51dae9
MM		 2847static void l2cap_pass_to_tx(struct l2cap_chan *chan,
2848 struct l2cap_ctrl *control)
2849{
2850 BT_DBG("chan %p, control %p", chan, control);
401bb1f7 2851 l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_REQSEQ_AND_FBIT);
4b51dae9
MM		 2852}
2853
f80842a8
MM		 2854static void l2cap_pass_to_tx_fbit(struct l2cap_chan *chan,
2855 struct l2cap_ctrl *control)
2856{
2857 BT_DBG("chan %p, control %p", chan, control);
401bb1f7 2858 l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_FBIT);
f80842a8
MM		 2859}
2860
1da177e4
LT		 2861/* Copy frame to all raw sockets on that connection */
2862static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb)
2863{
1da177e4 2864 struct sk_buff *nskb;
48454079 2865 struct l2cap_chan *chan;
1da177e4
LT		 2866
2867 BT_DBG("conn %p", conn);
2868
3df91ea2 2869 mutex_lock(&conn->chan_lock);
3d57dc68 2870
3df91ea2 2871 list_for_each_entry(chan, &conn->chan_l, list) {
715ec005 2872 if (chan->chan_type != L2CAP_CHAN_RAW)
1da177e4
LT		 2873 continue;
2874
7f5396a7 2875 /* Don't send frame to the channel it came from */
a4368ff3 2876 if (bt_cb(skb)->l2cap.chan == chan)
1da177e4 2877 continue;
7f5396a7 2878
8bcde1f2 2879 nskb = skb_clone(skb, GFP_KERNEL);
af05b30b 2880 if (!nskb)
1da177e4 2881 continue;
80b98027 2882 if (chan->ops->recv(chan, nskb))
1da177e4
LT		 2883 kfree_skb(nskb);
2884 }
3d57dc68 2885
3df91ea2 2886 mutex_unlock(&conn->chan_lock);
1da177e4
LT		 2887}
2888
2889/* ---- L2CAP signalling commands ---- */
b4400672
AE		 2890static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn, u8 code,
2891 u8 ident, u16 dlen, void *data)
1da177e4
LT		 2892{
2893 struct sk_buff *skb, **frag;
2894 struct l2cap_cmd_hdr *cmd;
2895 struct l2cap_hdr *lh;
2896 int len, count;
2897
b4400672
AE		 2898 BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %u",
2899 conn, code, ident, dlen);
1da177e4 2900
300b962e
AL		 2901 if (conn->mtu < L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE)
2902 return NULL;
2903
1da177e4
LT		 2904 len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen;
2905 count = min_t(unsigned int, conn->mtu, len);
2906
8bcde1f2 2907 skb = bt_skb_alloc(count, GFP_KERNEL);
1da177e4
LT		 2908 if (!skb)
2909 return NULL;
2910
4df864c1 2911 lh = skb_put(skb, L2CAP_HDR_SIZE);
aca3192c 2912 lh->len = cpu_to_le16(L2CAP_CMD_HDR_SIZE + dlen);
3300d9a9
CT		 2913
2914 if (conn->hcon->type == LE_LINK)
dcf4adbf 2915 lh->cid = cpu_to_le16(L2CAP_CID_LE_SIGNALING);
3300d9a9 2916 else
dcf4adbf 2917 lh->cid = cpu_to_le16(L2CAP_CID_SIGNALING);
1da177e4 2918
4df864c1 2919 cmd = skb_put(skb, L2CAP_CMD_HDR_SIZE);
1da177e4
LT		 2920 cmd->code = code;
2921 cmd->ident = ident;
aca3192c 2922 cmd->len = cpu_to_le16(dlen);
1da177e4
LT		 2923
2924 if (dlen) {
2925 count -= L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE;
59ae1d12 2926 skb_put_data(skb, data, count);
1da177e4
LT		 2927 data += count;
2928 }
2929
2930 len -= skb->len;
2931
2932 /* Continuation fragments (no L2CAP header) */
2933 frag = &skb_shinfo(skb)->frag_list;
2934 while (len) {
2935 count = min_t(unsigned int, conn->mtu, len);
2936
8bcde1f2 2937 *frag = bt_skb_alloc(count, GFP_KERNEL);
1da177e4
LT		 2938 if (!*frag)
2939 goto fail;
2940
59ae1d12 2941 skb_put_data(*frag, data, count);
1da177e4
LT		 2942
2943 len -= count;
2944 data += count;
2945
2946 frag = &(*frag)->next;
2947 }
2948
2949 return skb;
2950
2951fail:
2952 kfree_skb(skb);
2953 return NULL;
2954}
2955
2d792818
GP		 2956static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen,
2957 unsigned long *val)
1da177e4
LT		 2958{
2959 struct l2cap_conf_opt *opt = *ptr;
2960 int len;
2961
2962 len = L2CAP_CONF_OPT_SIZE + opt->len;
2963 *ptr += len;
2964
2965 *type = opt->type;
2966 *olen = opt->len;
2967
2968 switch (opt->len) {
2969 case 1:
2970 *val = *((u8 *) opt->val);
2971 break;
2972
2973 case 2:
bfaaeb3e 2974 *val = get_unaligned_le16(opt->val);
1da177e4
LT		 2975 break;
2976
2977 case 4:
bfaaeb3e 2978 *val = get_unaligned_le32(opt->val);
1da177e4
LT		 2979 break;
2980
2981 default:
2982 *val = (unsigned long) opt->val;
2983 break;
2984 }
2985
b4400672 2986 BT_DBG("type 0x%2.2x len %u val 0x%lx", *type, opt->len, *val);
1da177e4
LT		 2987 return len;
2988}
2989
e860d2c9 2990static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val, size_t size)
1da177e4
LT		 2991{
2992 struct l2cap_conf_opt *opt = *ptr;
2993
b4400672 2994 BT_DBG("type 0x%2.2x len %u val 0x%lx", type, len, val);
1da177e4 2995
e860d2c9
BS		 2996 if (size < L2CAP_CONF_OPT_SIZE + len)
2997 return;
2998
1da177e4
LT		 2999 opt->type = type;
3000 opt->len = len;
3001
3002 switch (len) {
3003 case 1:
3004 *((u8 *) opt->val) = val;
3005 break;
3006
3007 case 2:
4f8b691c 3008 put_unaligned_le16(val, opt->val);
1da177e4
LT		 3009 break;
3010
3011 case 4:
4f8b691c 3012 put_unaligned_le32(val, opt->val);
1da177e4
LT		 3013 break;
3014
3015 default:
3016 memcpy(opt->val, (void *) val, len);
3017 break;
3018 }
3019
3020 *ptr += L2CAP_CONF_OPT_SIZE + len;
3021}
3022
e860d2c9 3023static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan, size_t size)
f89cef09
AE		 3024{
3025 struct l2cap_conf_efs efs;
3026
1ec918ce 3027 switch (chan->mode) {
f89cef09
AE		 3028 case L2CAP_MODE_ERTM:
3029 efs.id = chan->local_id;
3030 efs.stype = chan->local_stype;
3031 efs.msdu = cpu_to_le16(chan->local_msdu);
3032 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime);
dcf4adbf
JP		 3033 efs.acc_lat = cpu_to_le32(L2CAP_DEFAULT_ACC_LAT);
3034 efs.flush_to = cpu_to_le32(L2CAP_EFS_DEFAULT_FLUSH_TO);
f89cef09
AE		 3035 break;
3036
3037 case L2CAP_MODE_STREAMING:
3038 efs.id = 1;
3039 efs.stype = L2CAP_SERV_BESTEFFORT;
3040 efs.msdu = cpu_to_le16(chan->local_msdu);
3041 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime);
3042 efs.acc_lat = 0;
3043 efs.flush_to = 0;
3044 break;
3045
3046 default:
3047 return;
3048 }
3049
3050 l2cap_add_conf_opt(ptr, L2CAP_CONF_EFS, sizeof(efs),
e860d2c9 3051 (unsigned long) &efs, size);
f89cef09
AE		 3052}
3053
721c4181 3054static void l2cap_ack_timeout(struct work_struct *work)
c1b4f43b 3055{
721c4181 3056 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
0362520b
MM		 3057 ack_timer.work);
3058 u16 frames_to_ack;
c1b4f43b 3059
2fb9b3d4
GP		 3060 BT_DBG("chan %p", chan);
3061
6be36555
AE		 3062 l2cap_chan_lock(chan);
3063
0362520b
MM		 3064 frames_to_ack = __seq_offset(chan, chan->buffer_seq,
3065 chan->last_acked_seq);
6be36555 3066
0362520b
MM		 3067 if (frames_to_ack)
3068 l2cap_send_rr_or_rnr(chan, 0);
09bfb2ee 3069
0362520b 3070 l2cap_chan_unlock(chan);
09bfb2ee 3071 l2cap_chan_put(chan);
c1b4f43b
GP		 3072}
3073
466f8004 3074int l2cap_ertm_init(struct l2cap_chan *chan)
0565c1c2 3075{
3c588192
MM		 3076 int err;
3077
105bdf9e
MM		 3078 chan->next_tx_seq = 0;
3079 chan->expected_tx_seq = 0;
42e5c802 3080 chan->expected_ack_seq = 0;
6a026610 3081 chan->unacked_frames = 0;
42e5c802 3082 chan->buffer_seq = 0;
6a026610 3083 chan->frames_sent = 0;
105bdf9e
MM		 3084 chan->last_acked_seq = 0;
3085 chan->sdu = NULL;
3086 chan->sdu_last_frag = NULL;
3087 chan->sdu_len = 0;
3088
d34c34fb
MM		 3089 skb_queue_head_init(&chan->tx_q);
3090
6ed971ca
MH		 3091 chan->local_amp_id = AMP_ID_BREDR;
3092 chan->move_id = AMP_ID_BREDR;
08333283
MM		 3093 chan->move_state = L2CAP_MOVE_STABLE;
3094 chan->move_role = L2CAP_MOVE_ROLE_NONE;
3095
105bdf9e
MM		 3096 if (chan->mode != L2CAP_MODE_ERTM)
3097 return 0;
3098
3099 chan->rx_state = L2CAP_RX_STATE_RECV;
3100 chan->tx_state = L2CAP_TX_STATE_XMIT;
0565c1c2 3101
721c4181
GP		 3102 INIT_DELAYED_WORK(&chan->retrans_timer, l2cap_retrans_timeout);
3103 INIT_DELAYED_WORK(&chan->monitor_timer, l2cap_monitor_timeout);
3104 INIT_DELAYED_WORK(&chan->ack_timer, l2cap_ack_timeout);
0565c1c2 3105
f1c6775b 3106 skb_queue_head_init(&chan->srej_q);
1890d36b 3107
3c588192
MM		 3108 err = l2cap_seq_list_init(&chan->srej_list, chan->tx_win);
3109 if (err < 0)
3110 return err;
3111
9dc9affc
MM		 3112 err = l2cap_seq_list_init(&chan->retrans_list, chan->remote_tx_win);
3113 if (err < 0)
3114 l2cap_seq_list_free(&chan->srej_list);
3115
3116 return err;
0565c1c2
GP		 3117}
3118
f2fcfcd6
GP		 3119static inline __u8 l2cap_select_mode(__u8 mode, __u16 remote_feat_mask)
3120{
3121 switch (mode) {
3122 case L2CAP_MODE_STREAMING:
3123 case L2CAP_MODE_ERTM:
3124 if (l2cap_mode_supported(mode, remote_feat_mask))
3125 return mode;
3126 /* fall through */
3127 default:
3128 return L2CAP_MODE_BASIC;
3129 }
3130}
3131
848566b3 3132static inline bool __l2cap_ews_supported(struct l2cap_conn *conn)
6327eb98 3133{
0bd49fc7
JH		 3134 return ((conn->local_fixed_chan & L2CAP_FC_A2MP) &&
3135 (conn->feat_mask & L2CAP_FEAT_EXT_WINDOW));
6327eb98
AE		 3136}
3137
848566b3 3138static inline bool __l2cap_efs_supported(struct l2cap_conn *conn)
f89cef09 3139{
0bd49fc7
JH		 3140 return ((conn->local_fixed_chan & L2CAP_FC_A2MP) &&
3141 (conn->feat_mask & L2CAP_FEAT_EXT_FLOW));
f89cef09
AE		 3142}
3143
36c86c85
MM		 3144static void __l2cap_set_ertm_timeouts(struct l2cap_chan *chan,
3145 struct l2cap_conf_rfc *rfc)
3146{
6ed971ca 3147 if (chan->local_amp_id != AMP_ID_BREDR && chan->hs_hcon) {
36c86c85
MM		 3148 u64 ertm_to = chan->hs_hcon->hdev->amp_be_flush_to;
3149
3150 /* Class 1 devices have must have ERTM timeouts
3151 * exceeding the Link Supervision Timeout. The
3152 * default Link Supervision Timeout for AMP
3153 * controllers is 10 seconds.
3154 *
3155 * Class 1 devices use 0xffffffff for their
3156 * best-effort flush timeout, so the clamping logic
3157 * will result in a timeout that meets the above
3158 * requirement. ERTM timeouts are 16-bit values, so
3159 * the maximum timeout is 65.535 seconds.
3160 */
3161
3162 /* Convert timeout to milliseconds and round */
3163 ertm_to = DIV_ROUND_UP_ULL(ertm_to, 1000);
3164
3165 /* This is the recommended formula for class 2 devices
3166 * that start ERTM timers when packets are sent to the
3167 * controller.
3168 */
3169 ertm_to = 3 * ertm_to + 500;
3170
3171 if (ertm_to > 0xffff)
3172 ertm_to = 0xffff;
3173
3174 rfc->retrans_timeout = cpu_to_le16((u16) ertm_to);
3175 rfc->monitor_timeout = rfc->retrans_timeout;
3176 } else {
dcf4adbf
JP		 3177 rfc->retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO);
3178 rfc->monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO);
36c86c85
MM		 3179 }
3180}
3181
6327eb98
AE		 3182static inline void l2cap_txwin_setup(struct l2cap_chan *chan)
3183{
3184 if (chan->tx_win > L2CAP_DEFAULT_TX_WINDOW &&
848566b3 3185 __l2cap_ews_supported(chan->conn)) {
6327eb98
AE		 3186 /* use extended control field */
3187 set_bit(FLAG_EXT_CTRL, &chan->flags);
836be934
AE		 3188 chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;
3189 } else {
6327eb98 3190 chan->tx_win = min_t(u16, chan->tx_win,
2d792818 3191 L2CAP_DEFAULT_TX_WINDOW);
836be934
AE		 3192 chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
3193 }
c20f8e35 3194 chan->ack_win = chan->tx_win;
6327eb98
AE		 3195}
3196
e860d2c9 3197static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size)
1da177e4 3198{
1da177e4 3199 struct l2cap_conf_req *req = data;
0c1bc5c6 3200 struct l2cap_conf_rfc rfc = { .mode = chan->mode };
1da177e4 3201 void *ptr = req->data;
e860d2c9 3202 void *endptr = data + data_size;
c8f79162 3203 u16 size;
1da177e4 3204
49208c9c 3205 BT_DBG("chan %p", chan);
1da177e4 3206
73ffa904 3207 if (chan->num_conf_req || chan->num_conf_rsp)
f2fcfcd6
GP		 3208 goto done;
3209
0c1bc5c6 3210 switch (chan->mode) {
f2fcfcd6
GP		 3211 case L2CAP_MODE_STREAMING:
3212 case L2CAP_MODE_ERTM:
c1360a1c 3213 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state))
85eb53c6 3214 break;
85eb53c6 3215
848566b3 3216 if (__l2cap_efs_supported(chan->conn))
f89cef09
AE		 3217 set_bit(FLAG_EFS_ENABLE, &chan->flags);
3218
2ba13ed6 3219 /* fall through */
f2fcfcd6 3220 default:
8c1d787b 3221 chan->mode = l2cap_select_mode(rfc.mode, chan->conn->feat_mask);
f2fcfcd6
GP		 3222 break;
3223 }
3224
3225done:
0c1bc5c6 3226 if (chan->imtu != L2CAP_DEFAULT_MTU)
e860d2c9 3227 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu, endptr - ptr);
7990681c 3228
0c1bc5c6 3229 switch (chan->mode) {
65c7c491 3230 case L2CAP_MODE_BASIC:
6fea7ad1
MH		 3231 if (disable_ertm)
3232 break;
3233
8c1d787b 3234 if (!(chan->conn->feat_mask & L2CAP_FEAT_ERTM) &&
2d792818 3235 !(chan->conn->feat_mask & L2CAP_FEAT_STREAMING))
63406504
GP		 3236 break;
3237
62547752
GP		 3238 rfc.mode = L2CAP_MODE_BASIC;
3239 rfc.txwin_size = 0;
3240 rfc.max_transmit = 0;
3241 rfc.retrans_timeout = 0;
3242 rfc.monitor_timeout = 0;
3243 rfc.max_pdu_size = 0;
3244
63406504 3245 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
e860d2c9 3246 (unsigned long) &rfc, endptr - ptr);
65c7c491
MH		 3247 break;
3248
3249 case L2CAP_MODE_ERTM:
3250 rfc.mode = L2CAP_MODE_ERTM;
47d1ec61 3251 rfc.max_transmit = chan->max_tx;
36c86c85
MM		 3252
3253 __l2cap_set_ertm_timeouts(chan, &rfc);
c8f79162
AE		 3254
3255 size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -
2d792818
GP		 3256 L2CAP_EXT_HDR_SIZE - L2CAP_SDULEN_SIZE -
3257 L2CAP_FCS_SIZE);
c8f79162 3258 rfc.max_pdu_size = cpu_to_le16(size);
f2fcfcd6 3259
6327eb98
AE		 3260 l2cap_txwin_setup(chan);
3261
3262 rfc.txwin_size = min_t(u16, chan->tx_win,
2d792818 3263 L2CAP_DEFAULT_TX_WINDOW);
f2fcfcd6 3264
63406504 3265 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
e860d2c9 3266 (unsigned long) &rfc, endptr - ptr);
63406504 3267
f89cef09 3268 if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
e860d2c9 3269 l2cap_add_opt_efs(&ptr, chan, endptr - ptr);
f89cef09 3270
6327eb98
AE		 3271 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
3272 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
e860d2c9 3273 chan->tx_win, endptr - ptr);
60918918
AE		 3274
3275 if (chan->conn->feat_mask & L2CAP_FEAT_FCS)
3276 if (chan->fcs == L2CAP_FCS_NONE ||
f2592d3e 3277 test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) {
60918918
AE		 3278 chan->fcs = L2CAP_FCS_NONE;
3279 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1,
e860d2c9 3280 chan->fcs, endptr - ptr);
60918918 3281 }
f2fcfcd6
GP		 3282 break;
3283
3284 case L2CAP_MODE_STREAMING:
273759e2 3285 l2cap_txwin_setup(chan);
f2fcfcd6
GP		 3286 rfc.mode = L2CAP_MODE_STREAMING;
3287 rfc.txwin_size = 0;
3288 rfc.max_transmit = 0;
3289 rfc.retrans_timeout = 0;
3290 rfc.monitor_timeout = 0;
c8f79162
AE		 3291
3292 size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -
2d792818
GP		 3293 L2CAP_EXT_HDR_SIZE - L2CAP_SDULEN_SIZE -
3294 L2CAP_FCS_SIZE);
c8f79162 3295 rfc.max_pdu_size = cpu_to_le16(size);
65c7c491 3296
63406504 3297 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
e860d2c9 3298 (unsigned long) &rfc, endptr - ptr);
63406504 3299
f89cef09 3300 if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
e860d2c9 3301 l2cap_add_opt_efs(&ptr, chan, endptr - ptr);
f89cef09 3302
60918918
AE		 3303 if (chan->conn->feat_mask & L2CAP_FEAT_FCS)
3304 if (chan->fcs == L2CAP_FCS_NONE ||
f2592d3e 3305 test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) {
60918918
AE		 3306 chan->fcs = L2CAP_FCS_NONE;
3307 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1,
e860d2c9 3308 chan->fcs, endptr - ptr);
60918918 3309 }
65c7c491
MH		 3310 break;
3311 }
1da177e4 3312
fe4128e0 3313 req->dcid = cpu_to_le16(chan->dcid);
dcf4adbf 3314 req->flags = cpu_to_le16(0);
1da177e4
LT		 3315
3316 return ptr - data;
3317}
3318
e860d2c9 3319static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data_size)
1da177e4 3320{
5dee9e7c
MH		 3321 struct l2cap_conf_rsp *rsp = data;
3322 void *ptr = rsp->data;
e860d2c9 3323 void *endptr = data + data_size;
73ffa904
GP		 3324 void *req = chan->conf_req;
3325 int len = chan->conf_len;
5dee9e7c
MH		 3326 int type, hint, olen;
3327 unsigned long val;
6464f35f 3328 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
42dceae2
AE		 3329 struct l2cap_conf_efs efs;
3330 u8 remote_efs = 0;
861d6882 3331 u16 mtu = L2CAP_DEFAULT_MTU;
5dee9e7c 3332 u16 result = L2CAP_CONF_SUCCESS;
c8f79162 3333 u16 size;
1da177e4 3334
73ffa904 3335 BT_DBG("chan %p", chan);
820ae1b8 3336
5dee9e7c
MH		 3337 while (len >= L2CAP_CONF_OPT_SIZE) {
3338 len -= l2cap_get_conf_opt(&req, &type, &olen, &val);
1da177e4 3339
589d2746 3340 hint = type & L2CAP_CONF_HINT;
47ec1dcd 3341 type &= L2CAP_CONF_MASK;
5dee9e7c
MH		 3342
3343 switch (type) {
3344 case L2CAP_CONF_MTU:
861d6882 3345 mtu = val;
5dee9e7c
MH		 3346 break;
3347
3348 case L2CAP_CONF_FLUSH_TO:
0c1bc5c6 3349 chan->flush_to = val;
5dee9e7c
MH		 3350 break;
3351
3352 case L2CAP_CONF_QOS:
3353 break;
3354
6464f35f
MH		 3355 case L2CAP_CONF_RFC:
3356 if (olen == sizeof(rfc))
3357 memcpy(&rfc, (void *) val, olen);
3358 break;
3359
fcc203c3
GP		 3360 case L2CAP_CONF_FCS:
3361 if (val == L2CAP_FCS_NONE)
f2592d3e 3362 set_bit(CONF_RECV_NO_FCS, &chan->conf_state);
42dceae2 3363 break;
fcc203c3 3364
42dceae2 3365 case L2CAP_CONF_EFS:
06e7e776
BS		 3366 if (olen == sizeof(efs)) {
3367 remote_efs = 1;
42dceae2 3368 memcpy(&efs, (void *) val, olen);
06e7e776 3369 }
fcc203c3
GP		 3370 break;
3371
6327eb98 3372 case L2CAP_CONF_EWS:
0bd49fc7 3373 if (!(chan->conn->local_fixed_chan & L2CAP_FC_A2MP))
6327eb98 3374 return -ECONNREFUSED;
fcc203c3 3375
6327eb98
AE		 3376 set_bit(FLAG_EXT_CTRL, &chan->flags);
3377 set_bit(CONF_EWS_RECV, &chan->conf_state);
836be934 3378 chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;
6327eb98 3379 chan->remote_tx_win = val;
fcc203c3
GP		 3380 break;
3381
5dee9e7c
MH		 3382 default:
3383 if (hint)
3384 break;
3385
3386 result = L2CAP_CONF_UNKNOWN;
3387 *((u8 *) ptr++) = type;
3388 break;
3389 }
3390 }
3391
73ffa904 3392 if (chan->num_conf_rsp || chan->num_conf_req > 1)
f2fcfcd6
GP		 3393 goto done;
3394
0c1bc5c6 3395 switch (chan->mode) {
f2fcfcd6
GP		 3396 case L2CAP_MODE_STREAMING:
3397 case L2CAP_MODE_ERTM:
c1360a1c 3398 if (!test_bit(CONF_STATE2_DEVICE, &chan->conf_state)) {
0c1bc5c6 3399 chan->mode = l2cap_select_mode(rfc.mode,
2d792818 3400 chan->conn->feat_mask);
85eb53c6
GP		 3401 break;
3402 }
3403
42dceae2 3404 if (remote_efs) {
848566b3 3405 if (__l2cap_efs_supported(chan->conn))
42dceae2
AE		 3406 set_bit(FLAG_EFS_ENABLE, &chan->flags);
3407 else
3408 return -ECONNREFUSED;
3409 }
3410
0c1bc5c6 3411 if (chan->mode != rfc.mode)
f2fcfcd6 3412 return -ECONNREFUSED;
742e519b 3413
f2fcfcd6 3414 break;
f2fcfcd6
GP		 3415 }
3416
3417done:
0c1bc5c6 3418 if (chan->mode != rfc.mode) {
f2fcfcd6 3419 result = L2CAP_CONF_UNACCEPT;
0c1bc5c6 3420 rfc.mode = chan->mode;
f2fcfcd6 3421
73ffa904 3422 if (chan->num_conf_rsp == 1)
f2fcfcd6
GP		 3423 return -ECONNREFUSED;
3424
2d792818 3425 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
e860d2c9 3426 (unsigned long) &rfc, endptr - ptr);
f2fcfcd6
GP		 3427 }
3428
5dee9e7c
MH		 3429 if (result == L2CAP_CONF_SUCCESS) {
3430 /* Configure output options and let the other side know
3431 * which ones we don't like. */
3432
f2fcfcd6
GP		 3433 if (mtu < L2CAP_DEFAULT_MIN_MTU)
3434 result = L2CAP_CONF_UNACCEPT;
3435 else {
0c1bc5c6 3436 chan->omtu = mtu;
c1360a1c 3437 set_bit(CONF_MTU_DONE, &chan->conf_state);
f2fcfcd6 3438 }
e860d2c9 3439 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu, endptr - ptr);
6464f35f 3440
42dceae2
AE		 3441 if (remote_efs) {
3442 if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
2d792818
GP		 3443 efs.stype != L2CAP_SERV_NOTRAFIC &&
3444 efs.stype != chan->local_stype) {
42dceae2
AE		 3445
3446 result = L2CAP_CONF_UNACCEPT;
3447
3448 if (chan->num_conf_req >= 1)
3449 return -ECONNREFUSED;
3450
3451 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
2d792818 3452 sizeof(efs),
e860d2c9 3453 (unsigned long) &efs, endptr - ptr);
0e8b207e 3454 } else {
3e6b3b95 3455 /* Send PENDING Conf Rsp */
0e8b207e
AE		 3456 result = L2CAP_CONF_PENDING;
3457 set_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
42dceae2
AE		 3458 }
3459 }
3460
f2fcfcd6
GP		 3461 switch (rfc.mode) {
3462 case L2CAP_MODE_BASIC:
47d1ec61 3463 chan->fcs = L2CAP_FCS_NONE;
c1360a1c 3464 set_bit(CONF_MODE_DONE, &chan->conf_state);
f2fcfcd6
GP		 3465 break;
3466
3467 case L2CAP_MODE_ERTM:
6327eb98
AE		 3468 if (!test_bit(CONF_EWS_RECV, &chan->conf_state))
3469 chan->remote_tx_win = rfc.txwin_size;
3470 else
3471 rfc.txwin_size = L2CAP_DEFAULT_TX_WINDOW;
86b1b263 3472
2c03a7a4 3473 chan->remote_max_tx = rfc.max_transmit;
1c762159 3474
c8f79162 3475 size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
2d792818
GP		 3476 chan->conn->mtu - L2CAP_EXT_HDR_SIZE -
3477 L2CAP_SDULEN_SIZE - L2CAP_FCS_SIZE);
c8f79162
AE		 3478 rfc.max_pdu_size = cpu_to_le16(size);
3479 chan->remote_mps = size;
f2fcfcd6 3480
36c86c85 3481 __l2cap_set_ertm_timeouts(chan, &rfc);
f2fcfcd6 3482
c1360a1c 3483 set_bit(CONF_MODE_DONE, &chan->conf_state);
68ae6639
GP		 3484
3485 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
e860d2c9 3486 sizeof(rfc), (unsigned long) &rfc, endptr - ptr);
68ae6639 3487
42dceae2
AE		 3488 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
3489 chan->remote_id = efs.id;
3490 chan->remote_stype = efs.stype;
3491 chan->remote_msdu = le16_to_cpu(efs.msdu);
3492 chan->remote_flush_to =
2d792818 3493 le32_to_cpu(efs.flush_to);
42dceae2 3494 chan->remote_acc_lat =
2d792818 3495 le32_to_cpu(efs.acc_lat);
42dceae2
AE		 3496 chan->remote_sdu_itime =
3497 le32_to_cpu(efs.sdu_itime);
3498 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
2d792818 3499 sizeof(efs),
e860d2c9 3500 (unsigned long) &efs, endptr - ptr);
42dceae2 3501 }
f2fcfcd6
GP		 3502 break;
3503
3504 case L2CAP_MODE_STREAMING:
c8f79162 3505 size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
2d792818
GP		 3506 chan->conn->mtu - L2CAP_EXT_HDR_SIZE -
3507 L2CAP_SDULEN_SIZE - L2CAP_FCS_SIZE);
c8f79162
AE		 3508 rfc.max_pdu_size = cpu_to_le16(size);
3509 chan->remote_mps = size;
f2fcfcd6 3510
c1360a1c 3511 set_bit(CONF_MODE_DONE, &chan->conf_state);
68ae6639 3512
2d792818 3513 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
e860d2c9 3514 (unsigned long) &rfc, endptr - ptr);
68ae6639 3515
f2fcfcd6
GP		 3516 break;
3517
3518 default:
5dee9e7c 3519 result = L2CAP_CONF_UNACCEPT;
5dee9e7c 3520
6464f35f 3521 memset(&rfc, 0, sizeof(rfc));
0c1bc5c6 3522 rfc.mode = chan->mode;
f2fcfcd6 3523 }
6464f35f 3524
f2fcfcd6 3525 if (result == L2CAP_CONF_SUCCESS)
c1360a1c 3526 set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
f2fcfcd6 3527 }
fe4128e0 3528 rsp->scid = cpu_to_le16(chan->dcid);
5dee9e7c 3529 rsp->result = cpu_to_le16(result);
dcf4adbf 3530 rsp->flags = cpu_to_le16(0);
5dee9e7c
MH		 3531
3532 return ptr - data;
1da177e4
LT		 3533}
3534
2d792818 3535static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,
e860d2c9 3536 void *data, size_t size, u16 *result)
f2fcfcd6 3537{
f2fcfcd6
GP		 3538 struct l2cap_conf_req *req = data;
3539 void *ptr = req->data;
e860d2c9 3540 void *endptr = data + size;
f2fcfcd6
GP		 3541 int type, olen;
3542 unsigned long val;
36e999a8 3543 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
66af7aaf 3544 struct l2cap_conf_efs efs;
f2fcfcd6 3545
fe4128e0 3546 BT_DBG("chan %p, rsp %p, len %d, req %p", chan, rsp, len, data);
f2fcfcd6
GP		 3547
3548 while (len >= L2CAP_CONF_OPT_SIZE) {
3549 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
3550
3551 switch (type) {
3552 case L2CAP_CONF_MTU:
3553 if (val < L2CAP_DEFAULT_MIN_MTU) {
3554 *result = L2CAP_CONF_UNACCEPT;
0c1bc5c6 3555 chan->imtu = L2CAP_DEFAULT_MIN_MTU;
f2fcfcd6 3556 } else
0c1bc5c6 3557 chan->imtu = val;
e860d2c9 3558 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu, endptr - ptr);
f2fcfcd6
GP		 3559 break;
3560
3561 case L2CAP_CONF_FLUSH_TO:
0c1bc5c6 3562 chan->flush_to = val;
f2fcfcd6 3563 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO,
e860d2c9 3564 2, chan->flush_to, endptr - ptr);
f2fcfcd6
GP		 3565 break;
3566
3567 case L2CAP_CONF_RFC:
3568 if (olen == sizeof(rfc))
3569 memcpy(&rfc, (void *)val, olen);
3570
c1360a1c 3571 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) &&
2d792818 3572 rfc.mode != chan->mode)
f2fcfcd6
GP		 3573 return -ECONNREFUSED;
3574
47d1ec61 3575 chan->fcs = 0;
f2fcfcd6
GP		 3576
3577 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
e860d2c9 3578 sizeof(rfc), (unsigned long) &rfc, endptr - ptr);
f2fcfcd6 3579 break;
6327eb98
AE		 3580
3581 case L2CAP_CONF_EWS:
c20f8e35 3582 chan->ack_win = min_t(u16, val, chan->ack_win);
3e6b3b95 3583 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
e860d2c9 3584 chan->tx_win, endptr - ptr);
6327eb98 3585 break;
66af7aaf
AE		 3586
3587 case L2CAP_CONF_EFS:
06e7e776 3588 if (olen == sizeof(efs)) {
66af7aaf
AE		 3589 memcpy(&efs, (void *)val, olen);
3590
06e7e776
BS		 3591 if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
3592 efs.stype != L2CAP_SERV_NOTRAFIC &&
3593 efs.stype != chan->local_stype)
3594 return -ECONNREFUSED;
66af7aaf 3595
06e7e776
BS		 3596 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs),
3597 (unsigned long) &efs, endptr - ptr);
3598 }
66af7aaf 3599 break;
cbabee78
AE		 3600
3601 case L2CAP_CONF_FCS:
3602 if (*result == L2CAP_CONF_PENDING)
3603 if (val == L2CAP_FCS_NONE)
f2592d3e 3604 set_bit(CONF_RECV_NO_FCS,
cbabee78
AE		 3605 &chan->conf_state);
3606 break;
f2fcfcd6
GP		 3607 }
3608 }
3609
0c1bc5c6 3610 if (chan->mode == L2CAP_MODE_BASIC && chan->mode != rfc.mode)
6c2ea7a8
GP		 3611 return -ECONNREFUSED;
3612
0c1bc5c6 3613 chan->mode = rfc.mode;
6c2ea7a8 3614
0e8b207e 3615 if (*result == L2CAP_CONF_SUCCESS || *result == L2CAP_CONF_PENDING) {
f2fcfcd6
GP		 3616 switch (rfc.mode) {
3617 case L2CAP_MODE_ERTM:
47d1ec61
GP		 3618 chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
3619 chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
3620 chan->mps = le16_to_cpu(rfc.max_pdu_size);
c20f8e35
MM		 3621 if (!test_bit(FLAG_EXT_CTRL, &chan->flags))
3622 chan->ack_win = min_t(u16, chan->ack_win,
3623 rfc.txwin_size);
66af7aaf
AE		 3624
3625 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
3626 chan->local_msdu = le16_to_cpu(efs.msdu);
3627 chan->local_sdu_itime =
2d792818 3628 le32_to_cpu(efs.sdu_itime);
66af7aaf
AE		 3629 chan->local_acc_lat = le32_to_cpu(efs.acc_lat);
3630 chan->local_flush_to =
2d792818 3631 le32_to_cpu(efs.flush_to);
66af7aaf 3632 }
f2fcfcd6 3633 break;
66af7aaf 3634
f2fcfcd6 3635 case L2CAP_MODE_STREAMING:
47d1ec61 3636 chan->mps = le16_to_cpu(rfc.max_pdu_size);
f2fcfcd6
GP		 3637 }
3638 }
3639
fe4128e0 3640 req->dcid = cpu_to_le16(chan->dcid);
dcf4adbf 3641 req->flags = cpu_to_le16(0);
f2fcfcd6
GP		 3642
3643 return ptr - data;
3644}
3645
2d792818
GP		 3646static int l2cap_build_conf_rsp(struct l2cap_chan *chan, void *data,
3647 u16 result, u16 flags)
1da177e4
LT		 3648{
3649 struct l2cap_conf_rsp *rsp = data;
3650 void *ptr = rsp->data;
1da177e4 3651
fe4128e0 3652 BT_DBG("chan %p", chan);
1da177e4 3653
fe4128e0 3654 rsp->scid = cpu_to_le16(chan->dcid);
5dee9e7c 3655 rsp->result = cpu_to_le16(result);
aca3192c 3656 rsp->flags = cpu_to_le16(flags);
1da177e4
LT		 3657
3658 return ptr - data;
3659}
3660
27e2d4c8
JH		 3661void __l2cap_le_connect_rsp_defer(struct l2cap_chan *chan)
3662{
3663 struct l2cap_le_conn_rsp rsp;
3664 struct l2cap_conn *conn = chan->conn;
3665
3666 BT_DBG("chan %p", chan);
3667
3668 rsp.dcid = cpu_to_le16(chan->scid);
3669 rsp.mtu = cpu_to_le16(chan->imtu);
3916aed8 3670 rsp.mps = cpu_to_le16(chan->mps);
0cd75f7e 3671 rsp.credits = cpu_to_le16(chan->rx_credits);
dcf4adbf 3672 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
27e2d4c8
JH		 3673
3674 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp),
3675 &rsp);
3676}
3677
8c1d787b 3678void __l2cap_connect_rsp_defer(struct l2cap_chan *chan)
710f9b0a
GP		 3679{
3680 struct l2cap_conn_rsp rsp;
8c1d787b 3681 struct l2cap_conn *conn = chan->conn;
710f9b0a 3682 u8 buf[128];
439f34ac 3683 u8 rsp_code;
710f9b0a 3684
fe4128e0
GP		 3685 rsp.scid = cpu_to_le16(chan->dcid);
3686 rsp.dcid = cpu_to_le16(chan->scid);
dcf4adbf
JP		 3687 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
3688 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
439f34ac
AE		 3689
3690 if (chan->hs_hcon)
3691 rsp_code = L2CAP_CREATE_CHAN_RSP;
3692 else
3693 rsp_code = L2CAP_CONN_RSP;
3694
3695 BT_DBG("chan %p rsp_code %u", chan, rsp_code);
3696
3697 l2cap_send_cmd(conn, chan->ident, rsp_code, sizeof(rsp), &rsp);
710f9b0a 3698
c1360a1c 3699 if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
710f9b0a
GP		 3700 return;
3701
710f9b0a 3702 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
e860d2c9 3703 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
710f9b0a
GP		 3704 chan->num_conf_req++;
3705}
3706
47d1ec61 3707static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len)
7b1c0049 3708{
7b1c0049
GP		 3709 int type, olen;
3710 unsigned long val;
c20f8e35
MM		 3711 /* Use sane default values in case a misbehaving remote device
3712 * did not send an RFC or extended window size option.
3713 */
3714 u16 txwin_ext = chan->ack_win;
3715 struct l2cap_conf_rfc rfc = {
3716 .mode = chan->mode,
dcf4adbf
JP		 3717 .retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO),
3718 .monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO),
c20f8e35
MM		 3719 .max_pdu_size = cpu_to_le16(chan->imtu),
3720 .txwin_size = min_t(u16, chan->ack_win, L2CAP_DEFAULT_TX_WINDOW),
3721 };
7b1c0049 3722
47d1ec61 3723 BT_DBG("chan %p, rsp %p, len %d", chan, rsp, len);
7b1c0049 3724
0c1bc5c6 3725 if ((chan->mode != L2CAP_MODE_ERTM) && (chan->mode != L2CAP_MODE_STREAMING))
7b1c0049
GP		 3726 return;
3727
3728 while (len >= L2CAP_CONF_OPT_SIZE) {
3729 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
3730
c20f8e35
MM		 3731 switch (type) {
3732 case L2CAP_CONF_RFC:
3733 if (olen == sizeof(rfc))
3734 memcpy(&rfc, (void *)val, olen);
8f321f85 3735 break;
c20f8e35
MM		 3736 case L2CAP_CONF_EWS:
3737 txwin_ext = val;
3738 break;
3739 }
7b1c0049
GP		 3740 }
3741
7b1c0049
GP		 3742 switch (rfc.mode) {
3743 case L2CAP_MODE_ERTM:
47d1ec61
GP		 3744 chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
3745 chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
c20f8e35
MM		 3746 chan->mps = le16_to_cpu(rfc.max_pdu_size);
3747 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
3748 chan->ack_win = min_t(u16, chan->ack_win, txwin_ext);
3749 else
3750 chan->ack_win = min_t(u16, chan->ack_win,
3751 rfc.txwin_size);
7b1c0049
GP		 3752 break;
3753 case L2CAP_MODE_STREAMING:
47d1ec61 3754 chan->mps = le16_to_cpu(rfc.max_pdu_size);
7b1c0049
GP		 3755 }
3756}
3757
2d792818 3758static inline int l2cap_command_rej(struct l2cap_conn *conn,
cb3b3152
JH		 3759 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
3760 u8 *data)
4e8402a3 3761{
e2fd318e 3762 struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data;
4e8402a3 3763
cb3b3152
JH		 3764 if (cmd_len < sizeof(*rej))
3765 return -EPROTO;
3766
e2fd318e 3767 if (rej->reason != L2CAP_REJ_NOT_UNDERSTOOD)
4e8402a3
MH		 3768 return 0;
3769
3770 if ((conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) &&
2d792818 3771 cmd->ident == conn->info_ident) {
17cd3f37 3772 cancel_delayed_work(&conn->info_timer);
984947dc
MH		 3773
3774 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
e1027a7c 3775 conn->info_ident = 0;
984947dc 3776
4e8402a3
MH		 3777 l2cap_conn_start(conn);
3778 }
3779
3780 return 0;
3781}
3782
1700915f
MM		 3783static struct l2cap_chan *l2cap_connect(struct l2cap_conn *conn,
3784 struct l2cap_cmd_hdr *cmd,
3785 u8 *data, u8 rsp_code, u8 amp_id)
1da177e4 3786{
1da177e4
LT		 3787 struct l2cap_conn_req *req = (struct l2cap_conn_req *) data;
3788 struct l2cap_conn_rsp rsp;
23691d75 3789 struct l2cap_chan *chan = NULL, *pchan;
e7c29cb1 3790 int result, status = L2CAP_CS_NO_INFO;
1da177e4
LT		 3791
3792 u16 dcid = 0, scid = __le16_to_cpu(req->scid);
e7c29cb1 3793 __le16 psm = req->psm;
1da177e4 3794
097db76c 3795 BT_DBG("psm 0x%2.2x scid 0x%4.4x", __le16_to_cpu(psm), scid);
1da177e4
LT		 3796
3797 /* Check if we have socket listening on psm */
6f59b904 3798 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src,
bf20fd4e 3799 &conn->hcon->dst, ACL_LINK);
23691d75 3800 if (!pchan) {
1da177e4
LT		 3801 result = L2CAP_CR_BAD_PSM;
3802 goto sendresp;
3803 }
3804
3df91ea2 3805 mutex_lock(&conn->chan_lock);
8ffb9290 3806 l2cap_chan_lock(pchan);
e0f0cb56 3807
e7c29cb1 3808 /* Check if the ACL is secure enough (if not SDP) */
dcf4adbf 3809 if (psm != cpu_to_le16(L2CAP_PSM_SDP) &&
2d792818 3810 !hci_conn_check_link_mode(conn->hcon)) {
9f5a0d7b 3811 conn->disc_reason = HCI_ERROR_AUTH_FAILURE;
e7c29cb1
MH		 3812 result = L2CAP_CR_SEC_BLOCK;
3813 goto response;
3814 }
3815
1da177e4
LT		 3816 result = L2CAP_CR_NO_MEM;
3817
2dfa1003
GP		 3818 /* Check if we already have channel with that dcid */
3819 if (__l2cap_get_chan_by_dcid(conn, scid))
3820 goto response;
3821
80b98027 3822 chan = pchan->ops->new_connection(pchan);
80808e43 3823 if (!chan)
1da177e4
LT		 3824 goto response;
3825
330b6c15
SS		 3826 /* For certain devices (ex: HID mouse), support for authentication,
3827 * pairing and bonding is optional. For such devices, inorder to avoid
3828 * the ACL alive for too long after L2CAP disconnection, reset the ACL
3829 * disc_timeout back to HCI_DISCONN_TIMEOUT during L2CAP connect.
3830 */
3831 conn->hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
3832
7eafc59e
MH		 3833 bacpy(&chan->src, &conn->hcon->src);
3834 bacpy(&chan->dst, &conn->hcon->dst);
a250e048
JH		 3835 chan->src_type = bdaddr_src_type(conn->hcon);
3836 chan->dst_type = bdaddr_dst_type(conn->hcon);
fe4128e0
GP		 3837 chan->psm = psm;
3838 chan->dcid = scid;
1700915f 3839 chan->local_amp_id = amp_id;
1da177e4 3840
6be36555 3841 __l2cap_chan_add(conn, chan);
48454079 3842
fe4128e0 3843 dcid = chan->scid;
1da177e4 3844
8d836d71 3845 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
1da177e4 3846
fc7f8a7e 3847 chan->ident = cmd->ident;
1da177e4 3848
984947dc 3849 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) {
e7cafc45 3850 if (l2cap_chan_check_security(chan, false)) {
bdc25783 3851 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
f93fa273 3852 l2cap_state_change(chan, BT_CONNECT2);
f66dc81f
MH		 3853 result = L2CAP_CR_PEND;
3854 status = L2CAP_CS_AUTHOR_PEND;
2dc4e510 3855 chan->ops->defer(chan);
f66dc81f 3856 } else {
1700915f
MM		 3857 /* Force pending result for AMP controllers.
3858 * The connection will succeed after the
3859 * physical link is up.
3860 */
6ed971ca 3861 if (amp_id == AMP_ID_BREDR) {
f93fa273 3862 l2cap_state_change(chan, BT_CONFIG);
1700915f 3863 result = L2CAP_CR_SUCCESS;
6ed971ca 3864 } else {
f93fa273 3865 l2cap_state_change(chan, BT_CONNECT2);
6ed971ca 3866 result = L2CAP_CR_PEND;
1700915f 3867 }
f66dc81f
MH		 3868 status = L2CAP_CS_NO_INFO;
3869 }
79d554a6 3870 } else {
f93fa273 3871 l2cap_state_change(chan, BT_CONNECT2);
79d554a6
MH		 3872 result = L2CAP_CR_PEND;
3873 status = L2CAP_CS_AUTHEN_PEND;
3874 }
3875 } else {
f93fa273 3876 l2cap_state_change(chan, BT_CONNECT2);
79d554a6
MH		 3877 result = L2CAP_CR_PEND;
3878 status = L2CAP_CS_NO_INFO;
1da177e4
LT		 3879 }
3880
1da177e4 3881response:
8ffb9290 3882 l2cap_chan_unlock(pchan);
3df91ea2 3883 mutex_unlock(&conn->chan_lock);
a24cce14 3884 l2cap_chan_put(pchan);
1da177e4
LT		 3885
3886sendresp:
aca3192c
YH		 3887 rsp.scid = cpu_to_le16(scid);
3888 rsp.dcid = cpu_to_le16(dcid);
3889 rsp.result = cpu_to_le16(result);
3890 rsp.status = cpu_to_le16(status);
4c89b6aa 3891 l2cap_send_cmd(conn, cmd->ident, rsp_code, sizeof(rsp), &rsp);
79d554a6
MH		 3892
3893 if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) {
3894 struct l2cap_info_req info;
dcf4adbf 3895 info.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
79d554a6
MH		 3896
3897 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
3898 conn->info_ident = l2cap_get_ident(conn);
3899
ba13ccd9 3900 schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
79d554a6 3901
2d792818
GP		 3902 l2cap_send_cmd(conn, conn->info_ident, L2CAP_INFO_REQ,
3903 sizeof(info), &info);
79d554a6
MH		 3904 }
3905
c1360a1c 3906 if (chan && !test_bit(CONF_REQ_SENT, &chan->conf_state) &&
2d792818 3907 result == L2CAP_CR_SUCCESS) {
e9aeb2dd 3908 u8 buf[128];
c1360a1c 3909 set_bit(CONF_REQ_SENT, &chan->conf_state);
e9aeb2dd 3910 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
e860d2c9 3911 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
73ffa904 3912 chan->num_conf_req++;
e9aeb2dd 3913 }
1700915f
MM		 3914
3915 return chan;
4c89b6aa 3916}
e9aeb2dd 3917
4c89b6aa 3918static int l2cap_connect_req(struct l2cap_conn *conn,
cb3b3152 3919 struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
4c89b6aa 3920{
7b064eda
JK		 3921 struct hci_dev *hdev = conn->hcon->hdev;
3922 struct hci_conn *hcon = conn->hcon;
3923
cb3b3152
JH		 3924 if (cmd_len < sizeof(struct l2cap_conn_req))
3925 return -EPROTO;
3926
7b064eda 3927 hci_dev_lock(hdev);
d7a5a11d 3928 if (hci_dev_test_flag(hdev, HCI_MGMT) &&
7b064eda 3929 !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &hcon->flags))
48ec92fa 3930 mgmt_device_connected(hdev, hcon, 0, NULL, 0);
7b064eda
JK		 3931 hci_dev_unlock(hdev);
3932
300229f9 3933 l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP, 0);
1da177e4
LT		 3934 return 0;
3935}
3936
5909cf30 3937static int l2cap_connect_create_rsp(struct l2cap_conn *conn,
cb3b3152
JH		 3938 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
3939 u8 *data)
1da177e4
LT		 3940{
3941 struct l2cap_conn_rsp *rsp = (struct l2cap_conn_rsp *) data;
3942 u16 scid, dcid, result, status;
48454079 3943 struct l2cap_chan *chan;
1da177e4 3944 u8 req[128];
3df91ea2 3945 int err;
1da177e4 3946
cb3b3152
JH		 3947 if (cmd_len < sizeof(*rsp))
3948 return -EPROTO;
3949
1da177e4
LT		 3950 scid = __le16_to_cpu(rsp->scid);
3951 dcid = __le16_to_cpu(rsp->dcid);
3952 result = __le16_to_cpu(rsp->result);
3953 status = __le16_to_cpu(rsp->status);
3954
1b009c98 3955 BT_DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x",
2d792818 3956 dcid, scid, result, status);
1da177e4 3957
3df91ea2
AE		 3958 mutex_lock(&conn->chan_lock);
3959
1da177e4 3960 if (scid) {
3df91ea2
AE		 3961 chan = __l2cap_get_chan_by_scid(conn, scid);
3962 if (!chan) {
21870b52 3963 err = -EBADSLT;
3df91ea2
AE		 3964 goto unlock;
3965 }
1da177e4 3966 } else {
3df91ea2
AE		 3967 chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
3968 if (!chan) {
21870b52 3969 err = -EBADSLT;
3df91ea2
AE		 3970 goto unlock;
3971 }
1da177e4
LT		 3972 }
3973
3df91ea2
AE		 3974 err = 0;
3975
6be36555 3976 l2cap_chan_lock(chan);
48454079 3977
1da177e4
LT		 3978 switch (result) {
3979 case L2CAP_CR_SUCCESS:
89bc500e 3980 l2cap_state_change(chan, BT_CONFIG);
fc7f8a7e 3981 chan->ident = 0;
fe4128e0 3982 chan->dcid = dcid;
c1360a1c 3983 clear_bit(CONF_CONNECT_PEND, &chan->conf_state);
6a8d3010 3984
c1360a1c 3985 if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
e9aeb2dd
GP		 3986 break;
3987
1da177e4 3988 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
e860d2c9 3989 l2cap_build_conf_req(chan, req, sizeof(req)), req);
73ffa904 3990 chan->num_conf_req++;
1da177e4
LT		 3991 break;
3992
3993 case L2CAP_CR_PEND:
c1360a1c 3994 set_bit(CONF_CONNECT_PEND, &chan->conf_state);
1da177e4
LT		 3995 break;
3996
3997 default:
48454079 3998 l2cap_chan_del(chan, ECONNREFUSED);
1da177e4
LT		 3999 break;
4000 }
4001
6be36555 4002 l2cap_chan_unlock(chan);
3df91ea2
AE		 4003
4004unlock:
4005 mutex_unlock(&conn->chan_lock);
4006
4007 return err;
1da177e4
LT		 4008}
4009
47d1ec61 4010static inline void set_default_fcs(struct l2cap_chan *chan)
8c462b60
MM		 4011{
4012 /* FCS is enabled only in ERTM or streaming mode, if one or both
4013 * sides request it.
4014 */
0c1bc5c6 4015 if (chan->mode != L2CAP_MODE_ERTM && chan->mode != L2CAP_MODE_STREAMING)
47d1ec61 4016 chan->fcs = L2CAP_FCS_NONE;
f2592d3e 4017 else if (!test_bit(CONF_RECV_NO_FCS, &chan->conf_state))
47d1ec61 4018 chan->fcs = L2CAP_FCS_CRC16;
8c462b60
MM		 4019}
4020
29d8a590
AE		 4021static void l2cap_send_efs_conf_rsp(struct l2cap_chan *chan, void *data,
4022 u8 ident, u16 flags)
4023{
4024 struct l2cap_conn *conn = chan->conn;
4025
4026 BT_DBG("conn %p chan %p ident %d flags 0x%4.4x", conn, chan, ident,
4027 flags);
4028
4029 clear_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
4030 set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
4031
4032 l2cap_send_cmd(conn, ident, L2CAP_CONF_RSP,
4033 l2cap_build_conf_rsp(chan, data,
4034 L2CAP_CONF_SUCCESS, flags), data);
4035}
4036
662d652d
JH		 4037static void cmd_reject_invalid_cid(struct l2cap_conn *conn, u8 ident,
4038 u16 scid, u16 dcid)
4039{
4040 struct l2cap_cmd_rej_cid rej;
4041
dcf4adbf 4042 rej.reason = cpu_to_le16(L2CAP_REJ_INVALID_CID);
662d652d
JH		 4043 rej.scid = __cpu_to_le16(scid);
4044 rej.dcid = __cpu_to_le16(dcid);
4045
4046 l2cap_send_cmd(conn, ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej);
4047}
4048
2d792818
GP		 4049static inline int l2cap_config_req(struct l2cap_conn *conn,
4050 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4051 u8 *data)
1da177e4
LT		 4052{
4053 struct l2cap_conf_req *req = (struct l2cap_conf_req *) data;
4054 u16 dcid, flags;
4055 u8 rsp[64];
48454079 4056 struct l2cap_chan *chan;
3c588192 4057 int len, err = 0;
1da177e4 4058
cb3b3152
JH		 4059 if (cmd_len < sizeof(*req))
4060 return -EPROTO;
4061
1da177e4
LT		 4062 dcid = __le16_to_cpu(req->dcid);
4063 flags = __le16_to_cpu(req->flags);
4064
4065 BT_DBG("dcid 0x%4.4x flags 0x%2.2x", dcid, flags);
4066
baa7e1fa 4067 chan = l2cap_get_chan_by_scid(conn, dcid);
662d652d
JH		 4068 if (!chan) {
4069 cmd_reject_invalid_cid(conn, cmd->ident, dcid, 0);
4070 return 0;
4071 }
1da177e4 4072
033b1142 4073 if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2) {
662d652d
JH		 4074 cmd_reject_invalid_cid(conn, cmd->ident, chan->scid,
4075 chan->dcid);
354f60a9 4076 goto unlock;
df6bd743 4077 }
354f60a9 4078
5dee9e7c 4079 /* Reject if config buffer is too small. */
88219a0f 4080 len = cmd_len - sizeof(*req);
cb3b3152 4081 if (chan->conf_len + len > sizeof(chan->conf_req)) {
5dee9e7c 4082 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
2d792818
GP		 4083 l2cap_build_conf_rsp(chan, rsp,
4084 L2CAP_CONF_REJECT, flags), rsp);
5dee9e7c
MH		 4085 goto unlock;
4086 }
4087
4088 /* Store config. */
73ffa904
GP		 4089 memcpy(chan->conf_req + chan->conf_len, req->data, len);
4090 chan->conf_len += len;
1da177e4 4091
59e54bd1 4092 if (flags & L2CAP_CONF_FLAG_CONTINUATION) {
1da177e4
LT		 4093 /* Incomplete config. Send empty response. */
4094 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
2d792818
GP		 4095 l2cap_build_conf_rsp(chan, rsp,
4096 L2CAP_CONF_SUCCESS, flags), rsp);
1da177e4
LT		 4097 goto unlock;
4098 }
4099
4100 /* Complete config. */
e860d2c9 4101 len = l2cap_parse_conf_req(chan, rsp, sizeof(rsp));
f2fcfcd6 4102 if (len < 0) {
5e4e3972 4103 l2cap_send_disconn_req(chan, ECONNRESET);
1da177e4 4104 goto unlock;
f2fcfcd6 4105 }
1da177e4 4106
1500109b 4107 chan->ident = cmd->ident;
5dee9e7c 4108 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp);
73ffa904 4109 chan->num_conf_rsp++;
5dee9e7c 4110
5dee9e7c 4111 /* Reset config buffer. */
73ffa904 4112 chan->conf_len = 0;
5dee9e7c 4113
c1360a1c 4114 if (!test_bit(CONF_OUTPUT_DONE, &chan->conf_state))
876d9484
MH		 4115 goto unlock;
4116
c1360a1c 4117 if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {
47d1ec61 4118 set_default_fcs(chan);
fcc203c3 4119
105bdf9e
MM		 4120 if (chan->mode == L2CAP_MODE_ERTM ||
4121 chan->mode == L2CAP_MODE_STREAMING)
3c588192
MM		 4122 err = l2cap_ertm_init(chan);
4123
4124 if (err < 0)
5e4e3972 4125 l2cap_send_disconn_req(chan, -err);
3c588192
MM		 4126 else
4127 l2cap_chan_ready(chan);
0565c1c2 4128
876d9484
MH		 4129 goto unlock;
4130 }
4131
c1360a1c 4132 if (!test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) {
79d554a6 4133 u8 buf[64];
1da177e4 4134 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
e860d2c9 4135 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
73ffa904 4136 chan->num_conf_req++;
1da177e4
LT		 4137 }
4138
49c922bb 4139 /* Got Conf Rsp PENDING from remote side and assume we sent
0e8b207e
AE		 4140 Conf Rsp PENDING in the code above */
4141 if (test_bit(CONF_REM_CONF_PEND, &chan->conf_state) &&
29d8a590 4142 test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
0e8b207e
AE		 4143
4144 /* check compatibility */
4145
79de886d 4146 /* Send rsp for BR/EDR channel */
f351bc72 4147 if (!chan->hs_hcon)
79de886d
AE		 4148 l2cap_send_efs_conf_rsp(chan, rsp, cmd->ident, flags);
4149 else
4150 chan->ident = cmd->ident;
0e8b207e
AE		 4151 }
4152
1da177e4 4153unlock:
6be36555 4154 l2cap_chan_unlock(chan);
3c588192 4155 return err;
1da177e4
LT		 4156}
4157
2d792818 4158static inline int l2cap_config_rsp(struct l2cap_conn *conn,
cb3b3152
JH		 4159 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4160 u8 *data)
1da177e4
LT		 4161{
4162 struct l2cap_conf_rsp *rsp = (struct l2cap_conf_rsp *)data;
4163 u16 scid, flags, result;
48454079 4164 struct l2cap_chan *chan;
cb3b3152 4165 int len = cmd_len - sizeof(*rsp);
3c588192 4166 int err = 0;
1da177e4 4167
cb3b3152
JH		 4168 if (cmd_len < sizeof(*rsp))
4169 return -EPROTO;
4170
1da177e4
LT		 4171 scid = __le16_to_cpu(rsp->scid);
4172 flags = __le16_to_cpu(rsp->flags);
4173 result = __le16_to_cpu(rsp->result);
4174
61386cba
AE		 4175 BT_DBG("scid 0x%4.4x flags 0x%2.2x result 0x%2.2x len %d", scid, flags,
4176 result, len);
1da177e4 4177
baa7e1fa 4178 chan = l2cap_get_chan_by_scid(conn, scid);
48454079 4179 if (!chan)
1da177e4
LT		 4180 return 0;
4181
4182 switch (result) {
4183 case L2CAP_CONF_SUCCESS:
47d1ec61 4184 l2cap_conf_rfc_get(chan, rsp->data, len);
0e8b207e 4185 clear_bit(CONF_REM_CONF_PEND, &chan->conf_state);
1da177e4
LT		 4186 break;
4187
0e8b207e
AE		 4188 case L2CAP_CONF_PENDING:
4189 set_bit(CONF_REM_CONF_PEND, &chan->conf_state);
4190
4191 if (test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
4192 char buf[64];
4193
4194 len = l2cap_parse_conf_rsp(chan, rsp->data, len,
e860d2c9 4195 buf, sizeof(buf), &result);
0e8b207e 4196 if (len < 0) {
5e4e3972 4197 l2cap_send_disconn_req(chan, ECONNRESET);
0e8b207e
AE		 4198 goto done;
4199 }
4200
f351bc72 4201 if (!chan->hs_hcon) {
79de886d
AE		 4202 l2cap_send_efs_conf_rsp(chan, buf, cmd->ident,
4203 0);
5ce66b59
AE		 4204 } else {
4205 if (l2cap_check_efs(chan)) {
4206 amp_create_logical_link(chan);
4207 chan->ident = cmd->ident;
4208 }
4209 }
0e8b207e
AE		 4210 }
4211 goto done;
4212
1da177e4 4213 case L2CAP_CONF_UNACCEPT:
73ffa904 4214 if (chan->num_conf_rsp <= L2CAP_CONF_MAX_CONF_RSP) {
f2fcfcd6
GP		 4215 char req[64];
4216
c2c77ec8 4217 if (len > sizeof(req) - sizeof(struct l2cap_conf_req)) {
5e4e3972 4218 l2cap_send_disconn_req(chan, ECONNRESET);
c2c77ec8
AE		 4219 goto done;
4220 }
4221
f2fcfcd6
GP		 4222 /* throw out any old stored conf requests */
4223 result = L2CAP_CONF_SUCCESS;
b4450035 4224 len = l2cap_parse_conf_rsp(chan, rsp->data, len,
e860d2c9 4225 req, sizeof(req), &result);
f2fcfcd6 4226 if (len < 0) {
5e4e3972 4227 l2cap_send_disconn_req(chan, ECONNRESET);
f2fcfcd6
GP		 4228 goto done;
4229 }
4230
4231 l2cap_send_cmd(conn, l2cap_get_ident(conn),
2d792818 4232 L2CAP_CONF_REQ, len, req);
73ffa904 4233 chan->num_conf_req++;
f2fcfcd6
GP		 4234 if (result != L2CAP_CONF_SUCCESS)
4235 goto done;
4236 break;
1da177e4
LT		 4237 }
4238
8e87d142 4239 default:
6be36555 4240 l2cap_chan_set_err(chan, ECONNRESET);
2e0052e4 4241
ba13ccd9 4242 __set_chan_timer(chan, L2CAP_DISC_REJ_TIMEOUT);
5e4e3972 4243 l2cap_send_disconn_req(chan, ECONNRESET);
1da177e4
LT		 4244 goto done;
4245 }
4246
59e54bd1 4247 if (flags & L2CAP_CONF_FLAG_CONTINUATION)
1da177e4
LT		 4248 goto done;
4249
c1360a1c 4250 set_bit(CONF_INPUT_DONE, &chan->conf_state);
1da177e4 4251
c1360a1c 4252 if (test_bit(CONF_OUTPUT_DONE, &chan->conf_state)) {
47d1ec61 4253 set_default_fcs(chan);
fcc203c3 4254
105bdf9e
MM		 4255 if (chan->mode == L2CAP_MODE_ERTM ||
4256 chan->mode == L2CAP_MODE_STREAMING)
3c588192 4257 err = l2cap_ertm_init(chan);
0565c1c2 4258
3c588192 4259 if (err < 0)
5e4e3972 4260 l2cap_send_disconn_req(chan, -err);
3c588192
MM		 4261 else
4262 l2cap_chan_ready(chan);
1da177e4
LT		 4263 }
4264
4265done:
6be36555 4266 l2cap_chan_unlock(chan);
3c588192 4267 return err;
1da177e4
LT		 4268}
4269
2d792818 4270static inline int l2cap_disconnect_req(struct l2cap_conn *conn,
cb3b3152
JH		 4271 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4272 u8 *data)
1da177e4
LT		 4273{
4274 struct l2cap_disconn_req *req = (struct l2cap_disconn_req *) data;
4275 struct l2cap_disconn_rsp rsp;
4276 u16 dcid, scid;
48454079 4277 struct l2cap_chan *chan;
1da177e4 4278
cb3b3152
JH		 4279 if (cmd_len != sizeof(*req))
4280 return -EPROTO;
4281
1da177e4
LT		 4282 scid = __le16_to_cpu(req->scid);
4283 dcid = __le16_to_cpu(req->dcid);
4284
4285 BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid);
4286
3df91ea2
AE		 4287 mutex_lock(&conn->chan_lock);
4288
4289 chan = __l2cap_get_chan_by_scid(conn, dcid);
4290 if (!chan) {
4291 mutex_unlock(&conn->chan_lock);
662d652d
JH		 4292 cmd_reject_invalid_cid(conn, cmd->ident, dcid, scid);
4293 return 0;
3df91ea2 4294 }
1da177e4 4295
6be36555
AE		 4296 l2cap_chan_lock(chan);
4297
fe4128e0
GP		 4298 rsp.dcid = cpu_to_le16(chan->scid);
4299 rsp.scid = cpu_to_le16(chan->dcid);
1da177e4
LT		 4300 l2cap_send_cmd(conn, cmd->ident, L2CAP_DISCONN_RSP, sizeof(rsp), &rsp);
4301
5ec1bbe5 4302 chan->ops->set_shutdown(chan);
1da177e4 4303
61d6ef3e 4304 l2cap_chan_hold(chan);
48454079 4305 l2cap_chan_del(chan, ECONNRESET);
6be36555
AE		 4306
4307 l2cap_chan_unlock(chan);
1da177e4 4308
80b98027 4309 chan->ops->close(chan);
61d6ef3e 4310 l2cap_chan_put(chan);
3df91ea2
AE		 4311
4312 mutex_unlock(&conn->chan_lock);
4313
1da177e4
LT		 4314 return 0;
4315}
4316
2d792818 4317static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn,
cb3b3152
JH		 4318 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4319 u8 *data)
1da177e4
LT		 4320{
4321 struct l2cap_disconn_rsp *rsp = (struct l2cap_disconn_rsp *) data;
4322 u16 dcid, scid;
48454079 4323 struct l2cap_chan *chan;
1da177e4 4324
cb3b3152
JH		 4325 if (cmd_len != sizeof(*rsp))
4326 return -EPROTO;
4327
1da177e4
LT		 4328 scid = __le16_to_cpu(rsp->scid);
4329 dcid = __le16_to_cpu(rsp->dcid);
4330
4331 BT_DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid);
4332
3df91ea2
AE		 4333 mutex_lock(&conn->chan_lock);
4334
4335 chan = __l2cap_get_chan_by_scid(conn, scid);
4336 if (!chan) {
4337 mutex_unlock(&conn->chan_lock);
1da177e4 4338 return 0;
3df91ea2 4339 }
1da177e4 4340
6be36555 4341 l2cap_chan_lock(chan);
48454079 4342
61d6ef3e 4343 l2cap_chan_hold(chan);
48454079 4344 l2cap_chan_del(chan, 0);
6be36555
AE		 4345
4346 l2cap_chan_unlock(chan);
1da177e4 4347
80b98027 4348 chan->ops->close(chan);
61d6ef3e 4349 l2cap_chan_put(chan);
3df91ea2
AE		 4350
4351 mutex_unlock(&conn->chan_lock);
4352
1da177e4
LT		 4353 return 0;
4354}
4355
2d792818 4356static inline int l2cap_information_req(struct l2cap_conn *conn,
cb3b3152
JH		 4357 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4358 u8 *data)
1da177e4
LT		 4359{
4360 struct l2cap_info_req *req = (struct l2cap_info_req *) data;
1da177e4
LT		 4361 u16 type;
4362
cb3b3152
JH		 4363 if (cmd_len != sizeof(*req))
4364 return -EPROTO;
4365
1da177e4
LT		 4366 type = __le16_to_cpu(req->type);
4367
4368 BT_DBG("type 0x%4.4x", type);
4369
f0709e03
MH		 4370 if (type == L2CAP_IT_FEAT_MASK) {
4371 u8 buf[8];
44dd46de 4372 u32 feat_mask = l2cap_feat_mask;
f0709e03 4373 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
dcf4adbf
JP		 4374 rsp->type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
4375 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
d1c4a17d 4376 if (!disable_ertm)
fcc203c3 4377 feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING
2d792818 4378 | L2CAP_FEAT_FCS;
0bd49fc7 4379 if (conn->local_fixed_chan & L2CAP_FC_A2MP)
6327eb98 4380 feat_mask |= L2CAP_FEAT_EXT_FLOW
2d792818 4381 | L2CAP_FEAT_EXT_WINDOW;
a5fd6f30 4382
1b7bf4ed 4383 put_unaligned_le32(feat_mask, rsp->data);
2d792818
GP		 4384 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(buf),
4385 buf);
e1027a7c
MH		 4386 } else if (type == L2CAP_IT_FIXED_CHAN) {
4387 u8 buf[12];
4388 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
50a147cd 4389
dcf4adbf
JP		 4390 rsp->type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
4391 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
0bd49fc7
JH		 4392 rsp->data[0] = conn->local_fixed_chan;
4393 memset(rsp->data + 1, 0, 7);
2d792818
GP		 4394 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(buf),
4395 buf);
f0709e03
MH		 4396 } else {
4397 struct l2cap_info_rsp rsp;
4398 rsp.type = cpu_to_le16(type);
dcf4adbf 4399 rsp.result = cpu_to_le16(L2CAP_IR_NOTSUPP);
2d792818
GP		 4400 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(rsp),
4401 &rsp);
f0709e03 4402 }
1da177e4
LT		 4403
4404 return 0;
4405}
4406
2d792818 4407static inline int l2cap_information_rsp(struct l2cap_conn *conn,
cb3b3152
JH		 4408 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4409 u8 *data)
1da177e4
LT		 4410{
4411 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data;
4412 u16 type, result;
4413
3f6fa3d4 4414 if (cmd_len < sizeof(*rsp))
cb3b3152
JH		 4415 return -EPROTO;
4416
1da177e4
LT		 4417 type = __le16_to_cpu(rsp->type);
4418 result = __le16_to_cpu(rsp->result);
4419
4420 BT_DBG("type 0x%4.4x result 0x%2.2x", type, result);
4421
e90165be
AE		 4422 /* L2CAP Info req/rsp are unbound to channels, add extra checks */
4423 if (cmd->ident != conn->info_ident ||
2d792818 4424 conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)
e90165be
AE		 4425 return 0;
4426
17cd3f37 4427 cancel_delayed_work(&conn->info_timer);
4e8402a3 4428
adb08ede
VT		 4429 if (result != L2CAP_IR_SUCCESS) {
4430 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
4431 conn->info_ident = 0;
4432
4433 l2cap_conn_start(conn);
4434
4435 return 0;
4436 }
4437
978c93b9
AE		 4438 switch (type) {
4439 case L2CAP_IT_FEAT_MASK:
83985319 4440 conn->feat_mask = get_unaligned_le32(rsp->data);
4e8402a3 4441
47ec1dcd 4442 if (conn->feat_mask & L2CAP_FEAT_FIXED_CHAN) {
e1027a7c 4443 struct l2cap_info_req req;
dcf4adbf 4444 req.type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
e1027a7c
MH		 4445
4446 conn->info_ident = l2cap_get_ident(conn);
4447
4448 l2cap_send_cmd(conn, conn->info_ident,
2d792818 4449 L2CAP_INFO_REQ, sizeof(req), &req);
e1027a7c
MH		 4450 } else {
4451 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
4452 conn->info_ident = 0;
4453
4454 l2cap_conn_start(conn);
4455 }
978c93b9
AE		 4456 break;
4457
4458 case L2CAP_IT_FIXED_CHAN:
0bd49fc7 4459 conn->remote_fixed_chan = rsp->data[0];
984947dc 4460 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
e1027a7c 4461 conn->info_ident = 0;
984947dc
MH		 4462
4463 l2cap_conn_start(conn);
978c93b9 4464 break;
984947dc 4465 }
4e8402a3 4466
1da177e4
LT		 4467 return 0;
4468}
4469
1700915f
MM		 4470static int l2cap_create_channel_req(struct l2cap_conn *conn,
4471 struct l2cap_cmd_hdr *cmd,
4472 u16 cmd_len, void *data)
f94ff6ff
MM		 4473{
4474 struct l2cap_create_chan_req *req = data;
6e1df6a6 4475 struct l2cap_create_chan_rsp rsp;
1700915f 4476 struct l2cap_chan *chan;
6e1df6a6 4477 struct hci_dev *hdev;
f94ff6ff
MM		 4478 u16 psm, scid;
4479
4480 if (cmd_len != sizeof(*req))
4481 return -EPROTO;
4482
0bd49fc7 4483 if (!(conn->local_fixed_chan & L2CAP_FC_A2MP))
f94ff6ff
MM		 4484 return -EINVAL;
4485
4486 psm = le16_to_cpu(req->psm);
4487 scid = le16_to_cpu(req->scid);
4488
ad0ac6ca 4489 BT_DBG("psm 0x%2.2x, scid 0x%4.4x, amp_id %d", psm, scid, req->amp_id);
f94ff6ff 4490
6e1df6a6 4491 /* For controller id 0 make BR/EDR connection */
6ed971ca 4492 if (req->amp_id == AMP_ID_BREDR) {
6e1df6a6
AE		 4493 l2cap_connect(conn, cmd, data, L2CAP_CREATE_CHAN_RSP,
4494 req->amp_id);
4495 return 0;
4496 }
1700915f 4497
6e1df6a6
AE		 4498 /* Validate AMP controller id */
4499 hdev = hci_dev_get(req->amp_id);
4500 if (!hdev)
4501 goto error;
1700915f 4502
6e1df6a6
AE		 4503 if (hdev->dev_type != HCI_AMP || !test_bit(HCI_UP, &hdev->flags)) {
4504 hci_dev_put(hdev);
4505 goto error;
4506 }
1700915f 4507
6e1df6a6
AE		 4508 chan = l2cap_connect(conn, cmd, data, L2CAP_CREATE_CHAN_RSP,
4509 req->amp_id);
4510 if (chan) {
4511 struct amp_mgr *mgr = conn->hcon->amp_mgr;
4512 struct hci_conn *hs_hcon;
1700915f 4513
98e0f7ea
MH		 4514 hs_hcon = hci_conn_hash_lookup_ba(hdev, AMP_LINK,
4515 &conn->hcon->dst);
6e1df6a6
AE		 4516 if (!hs_hcon) {
4517 hci_dev_put(hdev);
662d652d
JH		 4518 cmd_reject_invalid_cid(conn, cmd->ident, chan->scid,
4519 chan->dcid);
4520 return 0;
1700915f
MM		 4521 }
4522
6e1df6a6
AE		 4523 BT_DBG("mgr %p bredr_chan %p hs_hcon %p", mgr, chan, hs_hcon);
4524
6e1df6a6
AE		 4525 mgr->bredr_chan = chan;
4526 chan->hs_hcon = hs_hcon;
fd45bf4c 4527 chan->fcs = L2CAP_FCS_NONE;
6e1df6a6 4528 conn->mtu = hdev->block_mtu;
1700915f 4529 }
f94ff6ff 4530
6e1df6a6 4531 hci_dev_put(hdev);
f94ff6ff
MM		 4532
4533 return 0;
6e1df6a6
AE		 4534
4535error:
4536 rsp.dcid = 0;
4537 rsp.scid = cpu_to_le16(scid);
dcf4adbf
JP		 4538 rsp.result = cpu_to_le16(L2CAP_CR_BAD_AMP);
4539 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
6e1df6a6
AE		 4540
4541 l2cap_send_cmd(conn, cmd->ident, L2CAP_CREATE_CHAN_RSP,
4542 sizeof(rsp), &rsp);
4543
dc280801 4544 return 0;
f94ff6ff
MM		 4545}
4546
8eb200bd
MM		 4547static void l2cap_send_move_chan_req(struct l2cap_chan *chan, u8 dest_amp_id)
4548{
4549 struct l2cap_move_chan_req req;
4550 u8 ident;
4551
4552 BT_DBG("chan %p, dest_amp_id %d", chan, dest_amp_id);
4553
4554 ident = l2cap_get_ident(chan->conn);
4555 chan->ident = ident;
4556
4557 req.icid = cpu_to_le16(chan->scid);
4558 req.dest_amp_id = dest_amp_id;
4559
4560 l2cap_send_cmd(chan->conn, ident, L2CAP_MOVE_CHAN_REQ, sizeof(req),
4561 &req);
4562
4563 __set_chan_timer(chan, L2CAP_MOVE_TIMEOUT);
4564}
4565
1500109b 4566static void l2cap_send_move_chan_rsp(struct l2cap_chan *chan, u16 result)
8d5a04a1
MM		 4567{
4568 struct l2cap_move_chan_rsp rsp;
4569
1500109b 4570 BT_DBG("chan %p, result 0x%4.4x", chan, result);
8d5a04a1 4571
1500109b 4572 rsp.icid = cpu_to_le16(chan->dcid);
8d5a04a1
MM		 4573 rsp.result = cpu_to_le16(result);
4574
1500109b
MM		 4575 l2cap_send_cmd(chan->conn, chan->ident, L2CAP_MOVE_CHAN_RSP,
4576 sizeof(rsp), &rsp);
8d5a04a1
MM		 4577}
4578
5b155ef9 4579static void l2cap_send_move_chan_cfm(struct l2cap_chan *chan, u16 result)
8d5a04a1
MM		 4580{
4581 struct l2cap_move_chan_cfm cfm;
8d5a04a1 4582
5b155ef9 4583 BT_DBG("chan %p, result 0x%4.4x", chan, result);
8d5a04a1 4584
5b155ef9 4585 chan->ident = l2cap_get_ident(chan->conn);
8d5a04a1 4586
5b155ef9 4587 cfm.icid = cpu_to_le16(chan->scid);
8d5a04a1
MM		 4588 cfm.result = cpu_to_le16(result);
4589
5b155ef9
MM		 4590 l2cap_send_cmd(chan->conn, chan->ident, L2CAP_MOVE_CHAN_CFM,
4591 sizeof(cfm), &cfm);
4592
4593 __set_chan_timer(chan, L2CAP_MOVE_TIMEOUT);
4594}
4595
4596static void l2cap_send_move_chan_cfm_icid(struct l2cap_conn *conn, u16 icid)
4597{
4598 struct l2cap_move_chan_cfm cfm;
4599
4600 BT_DBG("conn %p, icid 0x%4.4x", conn, icid);
4601
4602 cfm.icid = cpu_to_le16(icid);
dcf4adbf 4603 cfm.result = cpu_to_le16(L2CAP_MC_UNCONFIRMED);
5b155ef9
MM		 4604
4605 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_MOVE_CHAN_CFM,
4606 sizeof(cfm), &cfm);
8d5a04a1
MM		 4607}
4608
4609static void l2cap_send_move_chan_cfm_rsp(struct l2cap_conn *conn, u8 ident,
ad0ac6ca 4610 u16 icid)
8d5a04a1
MM		 4611{
4612 struct l2cap_move_chan_cfm_rsp rsp;
4613
ad0ac6ca 4614 BT_DBG("icid 0x%4.4x", icid);
8d5a04a1
MM		 4615
4616 rsp.icid = cpu_to_le16(icid);
4617 l2cap_send_cmd(conn, ident, L2CAP_MOVE_CHAN_CFM_RSP, sizeof(rsp), &rsp);
4618}
4619
5f3847a4
MM		 4620static void __release_logical_link(struct l2cap_chan *chan)
4621{
4622 chan->hs_hchan = NULL;
4623 chan->hs_hcon = NULL;
4624
4625 /* Placeholder - release the logical link */
4626}
4627
1500109b
MM		 4628static void l2cap_logical_fail(struct l2cap_chan *chan)
4629{
4630 /* Logical link setup failed */
4631 if (chan->state != BT_CONNECTED) {
4632 /* Create channel failure, disconnect */
5e4e3972 4633 l2cap_send_disconn_req(chan, ECONNRESET);
1500109b
MM		 4634 return;
4635 }
4636
4637 switch (chan->move_role) {
4638 case L2CAP_MOVE_ROLE_RESPONDER:
4639 l2cap_move_done(chan);
4640 l2cap_send_move_chan_rsp(chan, L2CAP_MR_NOT_SUPP);
4641 break;
4642 case L2CAP_MOVE_ROLE_INITIATOR:
4643 if (chan->move_state == L2CAP_MOVE_WAIT_LOGICAL_COMP ||
4644 chan->move_state == L2CAP_MOVE_WAIT_LOGICAL_CFM) {
4645 /* Remote has only sent pending or
4646 * success responses, clean up
4647 */
4648 l2cap_move_done(chan);
4649 }
4650
4651 /* Other amp move states imply that the move
4652 * has already aborted
4653 */
4654 l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);
4655 break;
4656 }
4657}
4658
4659static void l2cap_logical_finish_create(struct l2cap_chan *chan,
4660 struct hci_chan *hchan)
4661{
4662 struct l2cap_conf_rsp rsp;
1500109b 4663
336178a3 4664 chan->hs_hchan = hchan;
1500109b
MM		 4665 chan->hs_hcon->l2cap_data = chan->conn;
4666
35ba9561 4667 l2cap_send_efs_conf_rsp(chan, &rsp, chan->ident, 0);
1500109b
MM		 4668
4669 if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {
fe79c6fe 4670 int err;
1500109b
MM		 4671
4672 set_default_fcs(chan);
4673
4674 err = l2cap_ertm_init(chan);
4675 if (err < 0)
5e4e3972 4676 l2cap_send_disconn_req(chan, -err);
1500109b
MM		 4677 else
4678 l2cap_chan_ready(chan);
4679 }
4680}
4681
4682static void l2cap_logical_finish_move(struct l2cap_chan *chan,
4683 struct hci_chan *hchan)
4684{
4685 chan->hs_hcon = hchan->conn;
4686 chan->hs_hcon->l2cap_data = chan->conn;
4687
4688 BT_DBG("move_state %d", chan->move_state);
4689
4690 switch (chan->move_state) {
4691 case L2CAP_MOVE_WAIT_LOGICAL_COMP:
4692 /* Move confirm will be sent after a success
4693 * response is received
4694 */
4695 chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;
4696 break;
4697 case L2CAP_MOVE_WAIT_LOGICAL_CFM:
4698 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
4699 chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;
4700 } else if (chan->move_role == L2CAP_MOVE_ROLE_INITIATOR) {
4701 chan->move_state = L2CAP_MOVE_WAIT_CONFIRM_RSP;
4702 l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);
4703 } else if (chan->move_role == L2CAP_MOVE_ROLE_RESPONDER) {
4704 chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;
4705 l2cap_send_move_chan_rsp(chan, L2CAP_MR_SUCCESS);
4706 }
4707 break;
4708 default:
4709 /* Move was not in expected state, free the channel */
4710 __release_logical_link(chan);
4711
4712 chan->move_state = L2CAP_MOVE_STABLE;
4713 }
4714}
4715
4716/* Call with chan locked */
27695fb4
AE		 4717void l2cap_logical_cfm(struct l2cap_chan *chan, struct hci_chan *hchan,
4718 u8 status)
5b155ef9 4719{
1500109b
MM		 4720 BT_DBG("chan %p, hchan %p, status %d", chan, hchan, status);
4721
4722 if (status) {
4723 l2cap_logical_fail(chan);
4724 __release_logical_link(chan);
4725 return;
4726 }
4727
4728 if (chan->state != BT_CONNECTED) {
4729 /* Ignore logical link if channel is on BR/EDR */
6ed971ca 4730 if (chan->local_amp_id != AMP_ID_BREDR)
1500109b
MM		 4731 l2cap_logical_finish_create(chan, hchan);
4732 } else {
4733 l2cap_logical_finish_move(chan, hchan);
4734 }
5b155ef9
MM		 4735}
4736
3f7a56c4
MM		 4737void l2cap_move_start(struct l2cap_chan *chan)
4738{
4739 BT_DBG("chan %p", chan);
4740
6ed971ca 4741 if (chan->local_amp_id == AMP_ID_BREDR) {
3f7a56c4
MM		 4742 if (chan->chan_policy != BT_CHANNEL_POLICY_AMP_PREFERRED)
4743 return;
4744 chan->move_role = L2CAP_MOVE_ROLE_INITIATOR;
4745 chan->move_state = L2CAP_MOVE_WAIT_PREPARE;
4746 /* Placeholder - start physical link setup */
4747 } else {
4748 chan->move_role = L2CAP_MOVE_ROLE_INITIATOR;
4749 chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;
4750 chan->move_id = 0;
4751 l2cap_move_setup(chan);
4752 l2cap_send_move_chan_req(chan, 0);
4753 }
4754}
4755
8eb200bd
MM		 4756static void l2cap_do_create(struct l2cap_chan *chan, int result,
4757 u8 local_amp_id, u8 remote_amp_id)
4758{
62748ca1
AE		 4759 BT_DBG("chan %p state %s %u -> %u", chan, state_to_string(chan->state),
4760 local_amp_id, remote_amp_id);
4761
12d6cc60
AE		 4762 chan->fcs = L2CAP_FCS_NONE;
4763
62748ca1
AE		 4764 /* Outgoing channel on AMP */
4765 if (chan->state == BT_CONNECT) {
4766 if (result == L2CAP_CR_SUCCESS) {
4767 chan->local_amp_id = local_amp_id;
4768 l2cap_send_create_chan_req(chan, remote_amp_id);
4769 } else {
4770 /* Revert to BR/EDR connect */
4771 l2cap_send_conn_req(chan);
4772 }
4773
4774 return;
4775 }
4776
4777 /* Incoming channel on AMP */
4778 if (__l2cap_no_conn_pending(chan)) {
8eb200bd
MM		 4779 struct l2cap_conn_rsp rsp;
4780 char buf[128];
4781 rsp.scid = cpu_to_le16(chan->dcid);
4782 rsp.dcid = cpu_to_le16(chan->scid);
4783
8eb200bd
MM		 4784 if (result == L2CAP_CR_SUCCESS) {
4785 /* Send successful response */
dcf4adbf
JP		 4786 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
4787 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
8eb200bd
MM		 4788 } else {
4789 /* Send negative response */
dcf4adbf
JP		 4790 rsp.result = cpu_to_le16(L2CAP_CR_NO_MEM);
4791 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
8eb200bd
MM		 4792 }
4793
4794 l2cap_send_cmd(chan->conn, chan->ident, L2CAP_CREATE_CHAN_RSP,
4795 sizeof(rsp), &rsp);
4796
4797 if (result == L2CAP_CR_SUCCESS) {
f93fa273 4798 l2cap_state_change(chan, BT_CONFIG);
8eb200bd
MM		 4799 set_bit(CONF_REQ_SENT, &chan->conf_state);
4800 l2cap_send_cmd(chan->conn, l2cap_get_ident(chan->conn),
4801 L2CAP_CONF_REQ,
e860d2c9 4802 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
8eb200bd
MM		 4803 chan->num_conf_req++;
4804 }
8eb200bd
MM		 4805 }
4806}
4807
4808static void l2cap_do_move_initiate(struct l2cap_chan *chan, u8 local_amp_id,
4809 u8 remote_amp_id)
4810{
4811 l2cap_move_setup(chan);
4812 chan->move_id = local_amp_id;
4813 chan->move_state = L2CAP_MOVE_WAIT_RSP;
4814
4815 l2cap_send_move_chan_req(chan, remote_amp_id);
4816}
4817
4818static void l2cap_do_move_respond(struct l2cap_chan *chan, int result)
4819{
4820 struct hci_chan *hchan = NULL;
4821
4822 /* Placeholder - get hci_chan for logical link */
4823
4824 if (hchan) {
4825 if (hchan->state == BT_CONNECTED) {
4826 /* Logical link is ready to go */
4827 chan->hs_hcon = hchan->conn;
4828 chan->hs_hcon->l2cap_data = chan->conn;
4829 chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;
4830 l2cap_send_move_chan_rsp(chan, L2CAP_MR_SUCCESS);
4831
4832 l2cap_logical_cfm(chan, hchan, L2CAP_MR_SUCCESS);
4833 } else {
4834 /* Wait for logical link to be ready */
4835 chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;
4836 }
4837 } else {
4838 /* Logical link not available */
4839 l2cap_send_move_chan_rsp(chan, L2CAP_MR_NOT_ALLOWED);
4840 }
4841}
4842
4843static void l2cap_do_move_cancel(struct l2cap_chan *chan, int result)
4844{
4845 if (chan->move_role == L2CAP_MOVE_ROLE_RESPONDER) {
4846 u8 rsp_result;
4847 if (result == -EINVAL)
4848 rsp_result = L2CAP_MR_BAD_ID;
4849 else
4850 rsp_result = L2CAP_MR_NOT_ALLOWED;
4851
4852 l2cap_send_move_chan_rsp(chan, rsp_result);
4853 }
4854
4855 chan->move_role = L2CAP_MOVE_ROLE_NONE;
4856 chan->move_state = L2CAP_MOVE_STABLE;
4857
4858 /* Restart data transmission */
4859 l2cap_ertm_send(chan);
4860}
4861
a514b17f
AE		 4862/* Invoke with locked chan */
4863void __l2cap_physical_cfm(struct l2cap_chan *chan, int result)
8eb200bd 4864{
770bfefa 4865 u8 local_amp_id = chan->local_amp_id;
fffadc08 4866 u8 remote_amp_id = chan->remote_amp_id;
770bfefa 4867
8eb200bd
MM		 4868 BT_DBG("chan %p, result %d, local_amp_id %d, remote_amp_id %d",
4869 chan, result, local_amp_id, remote_amp_id);
4870
8eb200bd
MM		 4871 if (chan->state == BT_DISCONN || chan->state == BT_CLOSED) {
4872 l2cap_chan_unlock(chan);
4873 return;
4874 }
4875
4876 if (chan->state != BT_CONNECTED) {
4877 l2cap_do_create(chan, result, local_amp_id, remote_amp_id);
4878 } else if (result != L2CAP_MR_SUCCESS) {
4879 l2cap_do_move_cancel(chan, result);
4880 } else {
4881 switch (chan->move_role) {
4882 case L2CAP_MOVE_ROLE_INITIATOR:
4883 l2cap_do_move_initiate(chan, local_amp_id,
4884 remote_amp_id);
4885 break;
4886 case L2CAP_MOVE_ROLE_RESPONDER:
4887 l2cap_do_move_respond(chan, result);
4888 break;
4889 default:
4890 l2cap_do_move_cancel(chan, result);
4891 break;
4892 }
4893 }
8eb200bd
MM		 4894}
4895
8d5a04a1 4896static inline int l2cap_move_channel_req(struct l2cap_conn *conn,
ad0ac6ca
AE		 4897 struct l2cap_cmd_hdr *cmd,
4898 u16 cmd_len, void *data)
8d5a04a1
MM		 4899{
4900 struct l2cap_move_chan_req *req = data;
1500109b 4901 struct l2cap_move_chan_rsp rsp;
02b0fbb9 4902 struct l2cap_chan *chan;
8d5a04a1
MM		 4903 u16 icid = 0;
4904 u16 result = L2CAP_MR_NOT_ALLOWED;
4905
4906 if (cmd_len != sizeof(*req))
4907 return -EPROTO;
4908
4909 icid = le16_to_cpu(req->icid);
4910
ad0ac6ca 4911 BT_DBG("icid 0x%4.4x, dest_amp_id %d", icid, req->dest_amp_id);
8d5a04a1 4912
0bd49fc7 4913 if (!(conn->local_fixed_chan & L2CAP_FC_A2MP))
8d5a04a1
MM		 4914 return -EINVAL;
4915
02b0fbb9
MM		 4916 chan = l2cap_get_chan_by_dcid(conn, icid);
4917 if (!chan) {
1500109b 4918 rsp.icid = cpu_to_le16(icid);
dcf4adbf 4919 rsp.result = cpu_to_le16(L2CAP_MR_NOT_ALLOWED);
1500109b
MM		 4920 l2cap_send_cmd(conn, cmd->ident, L2CAP_MOVE_CHAN_RSP,
4921 sizeof(rsp), &rsp);
02b0fbb9
MM		 4922 return 0;
4923 }
4924
1500109b
MM		 4925 chan->ident = cmd->ident;
4926
02b0fbb9
MM		 4927 if (chan->scid < L2CAP_CID_DYN_START ||
4928 chan->chan_policy == BT_CHANNEL_POLICY_BREDR_ONLY ||
4929 (chan->mode != L2CAP_MODE_ERTM &&
4930 chan->mode != L2CAP_MODE_STREAMING)) {
4931 result = L2CAP_MR_NOT_ALLOWED;
4932 goto send_move_response;
4933 }
4934
4935 if (chan->local_amp_id == req->dest_amp_id) {
4936 result = L2CAP_MR_SAME_ID;
4937 goto send_move_response;
4938 }
4939
6ed971ca 4940 if (req->dest_amp_id != AMP_ID_BREDR) {
02b0fbb9
MM		 4941 struct hci_dev *hdev;
4942 hdev = hci_dev_get(req->dest_amp_id);
4943 if (!hdev || hdev->dev_type != HCI_AMP ||
4944 !test_bit(HCI_UP, &hdev->flags)) {
4945 if (hdev)
4946 hci_dev_put(hdev);
4947
4948 result = L2CAP_MR_BAD_ID;
4949 goto send_move_response;
4950 }
4951 hci_dev_put(hdev);
4952 }
4953
4954 /* Detect a move collision. Only send a collision response
4955 * if this side has "lost", otherwise proceed with the move.
4956 * The winner has the larger bd_addr.
4957 */
4958 if ((__chan_is_moving(chan) ||
4959 chan->move_role != L2CAP_MOVE_ROLE_NONE) &&
6f59b904 4960 bacmp(&conn->hcon->src, &conn->hcon->dst) > 0) {
02b0fbb9
MM		 4961 result = L2CAP_MR_COLLISION;
4962 goto send_move_response;
4963 }
4964
02b0fbb9
MM		 4965 chan->move_role = L2CAP_MOVE_ROLE_RESPONDER;
4966 l2cap_move_setup(chan);
4967 chan->move_id = req->dest_amp_id;
4968 icid = chan->dcid;
4969
6ed971ca 4970 if (req->dest_amp_id == AMP_ID_BREDR) {
02b0fbb9
MM		 4971 /* Moving to BR/EDR */
4972 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
4973 chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;
4974 result = L2CAP_MR_PEND;
4975 } else {
4976 chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;
4977 result = L2CAP_MR_SUCCESS;
4978 }
4979 } else {
4980 chan->move_state = L2CAP_MOVE_WAIT_PREPARE;
4981 /* Placeholder - uncomment when amp functions are available */
4982 /*amp_accept_physical(chan, req->dest_amp_id);*/
4983 result = L2CAP_MR_PEND;
4984 }
4985
4986send_move_response:
1500109b 4987 l2cap_send_move_chan_rsp(chan, result);
8d5a04a1 4988
02b0fbb9
MM		 4989 l2cap_chan_unlock(chan);
4990
8d5a04a1
MM		 4991 return 0;
4992}
4993
5b155ef9
MM		 4994static void l2cap_move_continue(struct l2cap_conn *conn, u16 icid, u16 result)
4995{
4996 struct l2cap_chan *chan;
4997 struct hci_chan *hchan = NULL;
4998
4999 chan = l2cap_get_chan_by_scid(conn, icid);
5000 if (!chan) {
5001 l2cap_send_move_chan_cfm_icid(conn, icid);
5002 return;
5003 }
5004
5005 __clear_chan_timer(chan);
5006 if (result == L2CAP_MR_PEND)
5007 __set_chan_timer(chan, L2CAP_MOVE_ERTX_TIMEOUT);
5008
5009 switch (chan->move_state) {
5010 case L2CAP_MOVE_WAIT_LOGICAL_COMP:
5011 /* Move confirm will be sent when logical link
5012 * is complete.
5013 */
5014 chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;
5015 break;
5016 case L2CAP_MOVE_WAIT_RSP_SUCCESS:
5017 if (result == L2CAP_MR_PEND) {
5018 break;
5019 } else if (test_bit(CONN_LOCAL_BUSY,
5020 &chan->conn_state)) {
5021 chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;
5022 } else {
5023 /* Logical link is up or moving to BR/EDR,
5024 * proceed with move
5025 */
5026 chan->move_state = L2CAP_MOVE_WAIT_CONFIRM_RSP;
5027 l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);
5028 }
5029 break;
5030 case L2CAP_MOVE_WAIT_RSP:
5031 /* Moving to AMP */
5032 if (result == L2CAP_MR_SUCCESS) {
5033 /* Remote is ready, send confirm immediately
5034 * after logical link is ready
5035 */
5036 chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;
5037 } else {
5038 /* Both logical link and move success
5039 * are required to confirm
5040 */
5041 chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_COMP;
5042 }
5043
5044 /* Placeholder - get hci_chan for logical link */
5045 if (!hchan) {
5046 /* Logical link not available */
5047 l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);
5048 break;
5049 }
5050
5051 /* If the logical link is not yet connected, do not
5052 * send confirmation.
5053 */
5054 if (hchan->state != BT_CONNECTED)
5055 break;
5056
5057 /* Logical link is already ready to go */
5058
5059 chan->hs_hcon = hchan->conn;
5060 chan->hs_hcon->l2cap_data = chan->conn;
5061
5062 if (result == L2CAP_MR_SUCCESS) {
5063 /* Can confirm now */
5064 l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);
5065 } else {
5066 /* Now only need move success
5067 * to confirm
5068 */
5069 chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;
5070 }
5071
5072 l2cap_logical_cfm(chan, hchan, L2CAP_MR_SUCCESS);
5073 break;
5074 default:
5075 /* Any other amp move state means the move failed. */
5076 chan->move_id = chan->local_amp_id;
5077 l2cap_move_done(chan);
5078 l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);
5079 }
5080
5081 l2cap_chan_unlock(chan);
5082}
5083
5084static void l2cap_move_fail(struct l2cap_conn *conn, u8 ident, u16 icid,
5085 u16 result)
5086{
5087 struct l2cap_chan *chan;
5088
5089 chan = l2cap_get_chan_by_ident(conn, ident);
5090 if (!chan) {
5091 /* Could not locate channel, icid is best guess */
5092 l2cap_send_move_chan_cfm_icid(conn, icid);
5093 return;
5094 }
5095
5096 __clear_chan_timer(chan);
5097
5098 if (chan->move_role == L2CAP_MOVE_ROLE_INITIATOR) {
5099 if (result == L2CAP_MR_COLLISION) {
5100 chan->move_role = L2CAP_MOVE_ROLE_RESPONDER;
5101 } else {
5102 /* Cleanup - cancel move */
5103 chan->move_id = chan->local_amp_id;
5104 l2cap_move_done(chan);
5105 }
5106 }
5107
5108 l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);
5109
5110 l2cap_chan_unlock(chan);
5111}
5112
5113static int l2cap_move_channel_rsp(struct l2cap_conn *conn,
5114 struct l2cap_cmd_hdr *cmd,
5115 u16 cmd_len, void *data)
8d5a04a1
MM		 5116{
5117 struct l2cap_move_chan_rsp *rsp = data;
5118 u16 icid, result;
5119
5120 if (cmd_len != sizeof(*rsp))
5121 return -EPROTO;
5122
5123 icid = le16_to_cpu(rsp->icid);
5124 result = le16_to_cpu(rsp->result);
5125
ad0ac6ca 5126 BT_DBG("icid 0x%4.4x, result 0x%4.4x", icid, result);
8d5a04a1 5127
5b155ef9
MM		 5128 if (result == L2CAP_MR_SUCCESS || result == L2CAP_MR_PEND)
5129 l2cap_move_continue(conn, icid, result);
5130 else
5131 l2cap_move_fail(conn, cmd->ident, icid, result);
8d5a04a1
MM		 5132
5133 return 0;
5134}
5135
5f3847a4
MM		 5136static int l2cap_move_channel_confirm(struct l2cap_conn *conn,
5137 struct l2cap_cmd_hdr *cmd,
5138 u16 cmd_len, void *data)
8d5a04a1
MM		 5139{
5140 struct l2cap_move_chan_cfm *cfm = data;
5f3847a4 5141 struct l2cap_chan *chan;
8d5a04a1
MM		 5142 u16 icid, result;
5143
5144 if (cmd_len != sizeof(*cfm))
5145 return -EPROTO;
5146
5147 icid = le16_to_cpu(cfm->icid);
5148 result = le16_to_cpu(cfm->result);
5149
ad0ac6ca 5150 BT_DBG("icid 0x%4.4x, result 0x%4.4x", icid, result);
8d5a04a1 5151
5f3847a4
MM		 5152 chan = l2cap_get_chan_by_dcid(conn, icid);
5153 if (!chan) {
5154 /* Spec requires a response even if the icid was not found */
5155 l2cap_send_move_chan_cfm_rsp(conn, cmd->ident, icid);
5156 return 0;
5157 }
5158
5159 if (chan->move_state == L2CAP_MOVE_WAIT_CONFIRM) {
5160 if (result == L2CAP_MC_CONFIRMED) {
5161 chan->local_amp_id = chan->move_id;
6ed971ca 5162 if (chan->local_amp_id == AMP_ID_BREDR)
5f3847a4
MM		 5163 __release_logical_link(chan);
5164 } else {
5165 chan->move_id = chan->local_amp_id;
5166 }
5167
5168 l2cap_move_done(chan);
5169 }
5170
8d5a04a1
MM		 5171 l2cap_send_move_chan_cfm_rsp(conn, cmd->ident, icid);
5172
5f3847a4
MM		 5173 l2cap_chan_unlock(chan);
5174
8d5a04a1
MM		 5175 return 0;
5176}
5177
5178static inline int l2cap_move_channel_confirm_rsp(struct l2cap_conn *conn,
ad0ac6ca
AE		 5179 struct l2cap_cmd_hdr *cmd,
5180 u16 cmd_len, void *data)
8d5a04a1
MM		 5181{
5182 struct l2cap_move_chan_cfm_rsp *rsp = data;
3fd71a0a 5183 struct l2cap_chan *chan;
8d5a04a1
MM		 5184 u16 icid;
5185
5186 if (cmd_len != sizeof(*rsp))
5187 return -EPROTO;
5188
5189 icid = le16_to_cpu(rsp->icid);
5190
ad0ac6ca 5191 BT_DBG("icid 0x%4.4x", icid);
8d5a04a1 5192
3fd71a0a
MM		 5193 chan = l2cap_get_chan_by_scid(conn, icid);
5194 if (!chan)
5195 return 0;
5196
5197 __clear_chan_timer(chan);
5198
5199 if (chan->move_state == L2CAP_MOVE_WAIT_CONFIRM_RSP) {
5200 chan->local_amp_id = chan->move_id;
5201
6ed971ca 5202 if (chan->local_amp_id == AMP_ID_BREDR && chan->hs_hchan)
3fd71a0a
MM		 5203 __release_logical_link(chan);
5204
5205 l2cap_move_done(chan);
5206 }
5207
5208 l2cap_chan_unlock(chan);
5209
8d5a04a1
MM		 5210 return 0;
5211}
5212
de73115a 5213static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn,
2d792818 5214 struct l2cap_cmd_hdr *cmd,
203e639e 5215 u16 cmd_len, u8 *data)
de73115a
CT		 5216{
5217 struct hci_conn *hcon = conn->hcon;
5218 struct l2cap_conn_param_update_req *req;
5219 struct l2cap_conn_param_update_rsp rsp;
203e639e 5220 u16 min, max, latency, to_multiplier;
2ce603eb 5221 int err;
de73115a 5222
40bef302 5223 if (hcon->role != HCI_ROLE_MASTER)
de73115a
CT		 5224 return -EINVAL;
5225
de73115a
CT		 5226 if (cmd_len != sizeof(struct l2cap_conn_param_update_req))
5227 return -EPROTO;
5228
5229 req = (struct l2cap_conn_param_update_req *) data;
e2174ca4
GP		 5230 min = __le16_to_cpu(req->min);
5231 max = __le16_to_cpu(req->max);
de73115a
CT		 5232 latency = __le16_to_cpu(req->latency);
5233 to_multiplier = __le16_to_cpu(req->to_multiplier);
5234
5235 BT_DBG("min 0x%4.4x max 0x%4.4x latency: 0x%4.4x Timeout: 0x%4.4x",
2d792818 5236 min, max, latency, to_multiplier);
de73115a
CT		 5237
5238 memset(&rsp, 0, sizeof(rsp));
2ce603eb 5239
d4905f24 5240 err = hci_check_conn_params(min, max, latency, to_multiplier);
2ce603eb 5241 if (err)
dcf4adbf 5242 rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED);
de73115a 5243 else
dcf4adbf 5244 rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_ACCEPTED);
de73115a
CT		 5245
5246 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_PARAM_UPDATE_RSP,
2d792818 5247 sizeof(rsp), &rsp);
de73115a 5248
ffb5a827 5249 if (!err) {
f4869e2a
JH		 5250 u8 store_hint;
5251
5252 store_hint = hci_le_conn_update(hcon, min, max, latency,
5253 to_multiplier);
ffb5a827 5254 mgmt_new_conn_param(hcon->hdev, &hcon->dst, hcon->dst_type,
f4869e2a
JH		 5255 store_hint, min, max, latency,
5256 to_multiplier);
ffb5a827 5257
ffb5a827 5258 }
2ce603eb 5259
de73115a
CT		 5260 return 0;
5261}
5262
f1496dee
JH		 5263static int l2cap_le_connect_rsp(struct l2cap_conn *conn,
5264 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5265 u8 *data)
5266{
5267 struct l2cap_le_conn_rsp *rsp = (struct l2cap_le_conn_rsp *) data;
3e64b7bd 5268 struct hci_conn *hcon = conn->hcon;
f1496dee
JH		 5269 u16 dcid, mtu, mps, credits, result;
5270 struct l2cap_chan *chan;
3e64b7bd 5271 int err, sec_level;
f1496dee
JH		 5272
5273 if (cmd_len < sizeof(*rsp))
5274 return -EPROTO;
5275
5276 dcid = __le16_to_cpu(rsp->dcid);
5277 mtu = __le16_to_cpu(rsp->mtu);
5278 mps = __le16_to_cpu(rsp->mps);
5279 credits = __le16_to_cpu(rsp->credits);
5280 result = __le16_to_cpu(rsp->result);
5281
40624183
JH		 5282 if (result == L2CAP_CR_SUCCESS && (mtu < 23 || mps < 23 ||
5283 dcid < L2CAP_CID_DYN_START ||
5284 dcid > L2CAP_CID_LE_DYN_END))
f1496dee
JH		 5285 return -EPROTO;
5286
5287 BT_DBG("dcid 0x%4.4x mtu %u mps %u credits %u result 0x%2.2x",
5288 dcid, mtu, mps, credits, result);
5289
5290 mutex_lock(&conn->chan_lock);
5291
5292 chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
5293 if (!chan) {
5294 err = -EBADSLT;
5295 goto unlock;
5296 }
5297
5298 err = 0;
5299
5300 l2cap_chan_lock(chan);
5301
5302 switch (result) {
5303 case L2CAP_CR_SUCCESS:
40624183
JH		 5304 if (__l2cap_get_chan_by_dcid(conn, dcid)) {
5305 err = -EBADSLT;
5306 break;
5307 }
5308
f1496dee
JH		 5309 chan->ident = 0;
5310 chan->dcid = dcid;
5311 chan->omtu = mtu;
5312 chan->remote_mps = mps;
0cd75f7e 5313 chan->tx_credits = credits;
f1496dee
JH		 5314 l2cap_chan_ready(chan);
5315 break;
5316
3e64b7bd
JH		 5317 case L2CAP_CR_AUTHENTICATION:
5318 case L2CAP_CR_ENCRYPTION:
5319 /* If we already have MITM protection we can't do
5320 * anything.
5321 */
5322 if (hcon->sec_level > BT_SECURITY_MEDIUM) {
5323 l2cap_chan_del(chan, ECONNREFUSED);
5324 break;
5325 }
5326
5327 sec_level = hcon->sec_level + 1;
5328 if (chan->sec_level < sec_level)
5329 chan->sec_level = sec_level;
5330
5331 /* We'll need to send a new Connect Request */
5332 clear_bit(FLAG_LE_CONN_REQ_SENT, &chan->flags);
5333
5334 smp_conn_security(hcon, chan->sec_level);
5335 break;
5336
f1496dee
JH		 5337 default:
5338 l2cap_chan_del(chan, ECONNREFUSED);
5339 break;
5340 }
5341
5342 l2cap_chan_unlock(chan);
5343
5344unlock:
5345 mutex_unlock(&conn->chan_lock);
5346
5347 return err;
5348}
5349
3300d9a9 5350static inline int l2cap_bredr_sig_cmd(struct l2cap_conn *conn,
2d792818
GP		 5351 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5352 u8 *data)
3300d9a9
CT		 5353{
5354 int err = 0;
5355
5356 switch (cmd->code) {
5357 case L2CAP_COMMAND_REJ:
cb3b3152 5358 l2cap_command_rej(conn, cmd, cmd_len, data);
3300d9a9
CT		 5359 break;
5360
5361 case L2CAP_CONN_REQ:
cb3b3152 5362 err = l2cap_connect_req(conn, cmd, cmd_len, data);
3300d9a9
CT		 5363 break;
5364
5365 case L2CAP_CONN_RSP:
f5a2598d 5366 case L2CAP_CREATE_CHAN_RSP:
9245e737 5367 l2cap_connect_create_rsp(conn, cmd, cmd_len, data);
3300d9a9
CT		 5368 break;
5369
5370 case L2CAP_CONF_REQ:
5371 err = l2cap_config_req(conn, cmd, cmd_len, data);
5372 break;
5373
5374 case L2CAP_CONF_RSP:
9245e737 5375 l2cap_config_rsp(conn, cmd, cmd_len, data);
3300d9a9
CT		 5376 break;
5377
5378 case L2CAP_DISCONN_REQ:
cb3b3152 5379 err = l2cap_disconnect_req(conn, cmd, cmd_len, data);
3300d9a9
CT		 5380 break;
5381
5382 case L2CAP_DISCONN_RSP:
9245e737 5383 l2cap_disconnect_rsp(conn, cmd, cmd_len, data);
3300d9a9
CT		 5384 break;
5385
5386 case L2CAP_ECHO_REQ:
5387 l2cap_send_cmd(conn, cmd->ident, L2CAP_ECHO_RSP, cmd_len, data);
5388 break;
5389
5390 case L2CAP_ECHO_RSP:
5391 break;
5392
5393 case L2CAP_INFO_REQ:
cb3b3152 5394 err = l2cap_information_req(conn, cmd, cmd_len, data);
3300d9a9
CT		 5395 break;
5396
5397 case L2CAP_INFO_RSP:
9245e737 5398 l2cap_information_rsp(conn, cmd, cmd_len, data);
3300d9a9
CT		 5399 break;
5400
f94ff6ff
MM		 5401 case L2CAP_CREATE_CHAN_REQ:
5402 err = l2cap_create_channel_req(conn, cmd, cmd_len, data);
5403 break;
5404
8d5a04a1
MM		 5405 case L2CAP_MOVE_CHAN_REQ:
5406 err = l2cap_move_channel_req(conn, cmd, cmd_len, data);
5407 break;
5408
5409 case L2CAP_MOVE_CHAN_RSP:
9245e737 5410 l2cap_move_channel_rsp(conn, cmd, cmd_len, data);
8d5a04a1
MM		 5411 break;
5412
5413 case L2CAP_MOVE_CHAN_CFM:
5414 err = l2cap_move_channel_confirm(conn, cmd, cmd_len, data);
5415 break;
5416
5417 case L2CAP_MOVE_CHAN_CFM_RSP:
9245e737 5418 l2cap_move_channel_confirm_rsp(conn, cmd, cmd_len, data);
8d5a04a1
MM		 5419 break;
5420
3300d9a9
CT		 5421 default:
5422 BT_ERR("Unknown BR/EDR signaling command 0x%2.2x", cmd->code);
5423 err = -EINVAL;
5424 break;
5425 }
5426
5427 return err;
5428}
5429
27e2d4c8
JH		 5430static int l2cap_le_connect_req(struct l2cap_conn *conn,
5431 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5432 u8 *data)
5433{
5434 struct l2cap_le_conn_req *req = (struct l2cap_le_conn_req *) data;
5435 struct l2cap_le_conn_rsp rsp;
5436 struct l2cap_chan *chan, *pchan;
0cd75f7e 5437 u16 dcid, scid, credits, mtu, mps;
27e2d4c8
JH		 5438 __le16 psm;
5439 u8 result;
5440
5441 if (cmd_len != sizeof(*req))
5442 return -EPROTO;
5443
5444 scid = __le16_to_cpu(req->scid);
5445 mtu = __le16_to_cpu(req->mtu);
5446 mps = __le16_to_cpu(req->mps);
5447 psm = req->psm;
5448 dcid = 0;
0cd75f7e 5449 credits = 0;
27e2d4c8
JH		 5450
5451 if (mtu < 23 || mps < 23)
5452 return -EPROTO;
5453
5454 BT_DBG("psm 0x%2.2x scid 0x%4.4x mtu %u mps %u", __le16_to_cpu(psm),
5455 scid, mtu, mps);
5456
5457 /* Check if we have socket listening on psm */
5458 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src,
5459 &conn->hcon->dst, LE_LINK);
5460 if (!pchan) {
5461 result = L2CAP_CR_BAD_PSM;
5462 chan = NULL;
5463 goto response;
5464 }
5465
5466 mutex_lock(&conn->chan_lock);
5467 l2cap_chan_lock(pchan);
5468
35dc6f83
JH		 5469 if (!smp_sufficient_security(conn->hcon, pchan->sec_level,
5470 SMP_ALLOW_STK)) {
27e2d4c8
JH		 5471 result = L2CAP_CR_AUTHENTICATION;
5472 chan = NULL;
5473 goto response_unlock;
5474 }
5475
8a7889cc
JH		 5476 /* Check for valid dynamic CID range */
5477 if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_LE_DYN_END) {
5478 result = L2CAP_CR_INVALID_SCID;
5479 chan = NULL;
5480 goto response_unlock;
5481 }
5482
27e2d4c8
JH		 5483 /* Check if we already have channel with that dcid */
5484 if (__l2cap_get_chan_by_dcid(conn, scid)) {
8a7889cc 5485 result = L2CAP_CR_SCID_IN_USE;
27e2d4c8
JH		 5486 chan = NULL;
5487 goto response_unlock;
5488 }
5489
5490 chan = pchan->ops->new_connection(pchan);
5491 if (!chan) {
5492 result = L2CAP_CR_NO_MEM;
5493 goto response_unlock;
5494 }
5495
0ce43ce6
JH		 5496 l2cap_le_flowctl_init(chan);
5497
27e2d4c8
JH		 5498 bacpy(&chan->src, &conn->hcon->src);
5499 bacpy(&chan->dst, &conn->hcon->dst);
a250e048
JH		 5500 chan->src_type = bdaddr_src_type(conn->hcon);
5501 chan->dst_type = bdaddr_dst_type(conn->hcon);
27e2d4c8
JH		 5502 chan->psm = psm;
5503 chan->dcid = scid;
5504 chan->omtu = mtu;
5505 chan->remote_mps = mps;
0cd75f7e 5506 chan->tx_credits = __le16_to_cpu(req->credits);
27e2d4c8
JH		 5507
5508 __l2cap_chan_add(conn, chan);
5509 dcid = chan->scid;
0cd75f7e 5510 credits = chan->rx_credits;
27e2d4c8
JH		 5511
5512 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
5513
5514 chan->ident = cmd->ident;
5515
5516 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
5517 l2cap_state_change(chan, BT_CONNECT2);
434714dc
JH		 5518 /* The following result value is actually not defined
5519 * for LE CoC but we use it to let the function know
5520 * that it should bail out after doing its cleanup
5521 * instead of sending a response.
5522 */
27e2d4c8
JH		 5523 result = L2CAP_CR_PEND;
5524 chan->ops->defer(chan);
5525 } else {
5526 l2cap_chan_ready(chan);
5527 result = L2CAP_CR_SUCCESS;
5528 }
5529
5530response_unlock:
5531 l2cap_chan_unlock(pchan);
5532 mutex_unlock(&conn->chan_lock);
a24cce14 5533 l2cap_chan_put(pchan);
27e2d4c8
JH		 5534
5535 if (result == L2CAP_CR_PEND)
5536 return 0;
5537
5538response:
5539 if (chan) {
5540 rsp.mtu = cpu_to_le16(chan->imtu);
3916aed8 5541 rsp.mps = cpu_to_le16(chan->mps);
27e2d4c8
JH		 5542 } else {
5543 rsp.mtu = 0;
5544 rsp.mps = 0;
5545 }
5546
5547 rsp.dcid = cpu_to_le16(dcid);
0cd75f7e 5548 rsp.credits = cpu_to_le16(credits);
27e2d4c8
JH		 5549 rsp.result = cpu_to_le16(result);
5550
5551 l2cap_send_cmd(conn, cmd->ident, L2CAP_LE_CONN_RSP, sizeof(rsp), &rsp);
5552
5553 return 0;
5554}
5555
fad5fc89
JH		 5556static inline int l2cap_le_credits(struct l2cap_conn *conn,
5557 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5558 u8 *data)
5559{
5560 struct l2cap_le_credits *pkt;
5561 struct l2cap_chan *chan;
0f1bfe4e 5562 u16 cid, credits, max_credits;
fad5fc89
JH		 5563
5564 if (cmd_len != sizeof(*pkt))
5565 return -EPROTO;
5566
5567 pkt = (struct l2cap_le_credits *) data;
5568 cid = __le16_to_cpu(pkt->cid);
5569 credits = __le16_to_cpu(pkt->credits);
5570
5571 BT_DBG("cid 0x%4.4x credits 0x%4.4x", cid, credits);
5572
5573 chan = l2cap_get_chan_by_dcid(conn, cid);
5574 if (!chan)
5575 return -EBADSLT;
5576
0f1bfe4e
JH		 5577 max_credits = LE_FLOWCTL_MAX_CREDITS - chan->tx_credits;
5578 if (credits > max_credits) {
5579 BT_ERR("LE credits overflow");
5580 l2cap_send_disconn_req(chan, ECONNRESET);
ee93053d 5581 l2cap_chan_unlock(chan);
0f1bfe4e
JH		 5582
5583 /* Return 0 so that we don't trigger an unnecessary
5584 * command reject packet.
5585 */
5586 return 0;
5587 }
5588
fad5fc89
JH		 5589 chan->tx_credits += credits;
5590
8a505b7f
LAD		 5591 /* Resume sending */
5592 l2cap_le_flowctl_send(chan);
fad5fc89
JH		 5593
5594 if (chan->tx_credits)
5595 chan->ops->resume(chan);
5596
5597 l2cap_chan_unlock(chan);
5598
5599 return 0;
5600}
5601
71fb4197
JH		 5602static inline int l2cap_le_command_rej(struct l2cap_conn *conn,
5603 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5604 u8 *data)
5605{
5606 struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data;
5607 struct l2cap_chan *chan;
5608
5609 if (cmd_len < sizeof(*rej))
5610 return -EPROTO;
5611
5612 mutex_lock(&conn->chan_lock);
5613
5614 chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
5615 if (!chan)
5616 goto done;
5617
5618 l2cap_chan_lock(chan);
5619 l2cap_chan_del(chan, ECONNREFUSED);
5620 l2cap_chan_unlock(chan);
5621
5622done:
5623 mutex_unlock(&conn->chan_lock);
5624 return 0;
5625}
5626
3300d9a9 5627static inline int l2cap_le_sig_cmd(struct l2cap_conn *conn,
203e639e
JH		 5628 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5629 u8 *data)
3300d9a9 5630{
b5ecba64
JH		 5631 int err = 0;
5632
3300d9a9
CT		 5633 switch (cmd->code) {
5634 case L2CAP_COMMAND_REJ:
71fb4197 5635 l2cap_le_command_rej(conn, cmd, cmd_len, data);
b5ecba64 5636 break;
3300d9a9
CT		 5637
5638 case L2CAP_CONN_PARAM_UPDATE_REQ:
b5ecba64
JH		 5639 err = l2cap_conn_param_update_req(conn, cmd, cmd_len, data);
5640 break;
3300d9a9
CT		 5641
5642 case L2CAP_CONN_PARAM_UPDATE_RSP:
b5ecba64 5643 break;
3300d9a9 5644
f1496dee
JH		 5645 case L2CAP_LE_CONN_RSP:
5646 l2cap_le_connect_rsp(conn, cmd, cmd_len, data);
b5ecba64 5647 break;
f1496dee 5648
27e2d4c8 5649 case L2CAP_LE_CONN_REQ:
b5ecba64
JH		 5650 err = l2cap_le_connect_req(conn, cmd, cmd_len, data);
5651 break;
27e2d4c8 5652
fad5fc89
JH		 5653 case L2CAP_LE_CREDITS:
5654 err = l2cap_le_credits(conn, cmd, cmd_len, data);
5655 break;
5656
3defe01a 5657 case L2CAP_DISCONN_REQ:
b5ecba64
JH		 5658 err = l2cap_disconnect_req(conn, cmd, cmd_len, data);
5659 break;
3defe01a
JH		 5660
5661 case L2CAP_DISCONN_RSP:
5662 l2cap_disconnect_rsp(conn, cmd, cmd_len, data);
b5ecba64 5663 break;
3defe01a 5664
3300d9a9
CT		 5665 default:
5666 BT_ERR("Unknown LE signaling command 0x%2.2x", cmd->code);
b5ecba64
JH		 5667 err = -EINVAL;
5668 break;
3300d9a9 5669 }
b5ecba64
JH		 5670
5671 return err;
3300d9a9
CT		 5672}
5673
c5623556
JH		 5674static inline void l2cap_le_sig_channel(struct l2cap_conn *conn,
5675 struct sk_buff *skb)
5676{
69c4e4e8 5677 struct hci_conn *hcon = conn->hcon;
4f3e219d
MH		 5678 struct l2cap_cmd_hdr *cmd;
5679 u16 len;
c5623556
JH		 5680 int err;
5681
69c4e4e8 5682 if (hcon->type != LE_LINK)
3b166295 5683 goto drop;
69c4e4e8 5684
4f3e219d
MH		 5685 if (skb->len < L2CAP_CMD_HDR_SIZE)
5686 goto drop;
c5623556 5687
4f3e219d
MH		 5688 cmd = (void *) skb->data;
5689 skb_pull(skb, L2CAP_CMD_HDR_SIZE);
c5623556 5690
4f3e219d 5691 len = le16_to_cpu(cmd->len);
c5623556 5692
4f3e219d 5693 BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd->code, len, cmd->ident);
c5623556 5694
4f3e219d
MH		 5695 if (len != skb->len || !cmd->ident) {
5696 BT_DBG("corrupted command");
5697 goto drop;
5698 }
c5623556 5699
203e639e 5700 err = l2cap_le_sig_cmd(conn, cmd, len, skb->data);
4f3e219d
MH		 5701 if (err) {
5702 struct l2cap_cmd_rej_unk rej;
c5623556 5703
4f3e219d 5704 BT_ERR("Wrong link type (%d)", err);
c5623556 5705
dcf4adbf 5706 rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
4f3e219d
MH		 5707 l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ,
5708 sizeof(rej), &rej);
c5623556
JH		 5709 }
5710
3b166295 5711drop:
c5623556
JH		 5712 kfree_skb(skb);
5713}
5714
3300d9a9 5715static inline void l2cap_sig_channel(struct l2cap_conn *conn,
2d792818 5716 struct sk_buff *skb)
1da177e4 5717{
69c4e4e8 5718 struct hci_conn *hcon = conn->hcon;
1da177e4
LT		 5719 u8 *data = skb->data;
5720 int len = skb->len;
5721 struct l2cap_cmd_hdr cmd;
3300d9a9 5722 int err;
1da177e4
LT		 5723
5724 l2cap_raw_recv(conn, skb);
5725
69c4e4e8 5726 if (hcon->type != ACL_LINK)
3b166295 5727 goto drop;
69c4e4e8 5728
1da177e4 5729 while (len >= L2CAP_CMD_HDR_SIZE) {
88219a0f 5730 u16 cmd_len;
1da177e4
LT		 5731 memcpy(&cmd, data, L2CAP_CMD_HDR_SIZE);
5732 data += L2CAP_CMD_HDR_SIZE;
5733 len -= L2CAP_CMD_HDR_SIZE;
5734
88219a0f 5735 cmd_len = le16_to_cpu(cmd.len);
1da177e4 5736
2d792818
GP		 5737 BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd.code, cmd_len,
5738 cmd.ident);
1da177e4 5739
88219a0f 5740 if (cmd_len > len || !cmd.ident) {
1da177e4
LT		 5741 BT_DBG("corrupted command");
5742 break;
5743 }
5744
c5623556 5745 err = l2cap_bredr_sig_cmd(conn, &cmd, cmd_len, data);
1da177e4 5746 if (err) {
e2fd318e 5747 struct l2cap_cmd_rej_unk rej;
2c6d1a2e
GP		 5748
5749 BT_ERR("Wrong link type (%d)", err);
1da177e4 5750
dcf4adbf 5751 rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
2d792818
GP		 5752 l2cap_send_cmd(conn, cmd.ident, L2CAP_COMMAND_REJ,
5753 sizeof(rej), &rej);
1da177e4
LT		 5754 }
5755
88219a0f
AV		 5756 data += cmd_len;
5757 len -= cmd_len;
1da177e4
LT		 5758 }
5759
3b166295 5760drop:
1da177e4
LT		 5761 kfree_skb(skb);
5762}
5763
47d1ec61 5764static int l2cap_check_fcs(struct l2cap_chan *chan, struct sk_buff *skb)
fcc203c3
GP		 5765{
5766 u16 our_fcs, rcv_fcs;
e4ca6d98
AE		 5767 int hdr_size;
5768
5769 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
5770 hdr_size = L2CAP_EXT_HDR_SIZE;
5771 else
5772 hdr_size = L2CAP_ENH_HDR_SIZE;
fcc203c3 5773
47d1ec61 5774 if (chan->fcs == L2CAP_FCS_CRC16) {
03a51213 5775 skb_trim(skb, skb->len - L2CAP_FCS_SIZE);
fcc203c3
GP		 5776 rcv_fcs = get_unaligned_le16(skb->data + skb->len);
5777 our_fcs = crc16(0, skb->data - hdr_size, skb->len + hdr_size);
5778
5779 if (our_fcs != rcv_fcs)
7a560e5c 5780 return -EBADMSG;
fcc203c3
GP		 5781 }
5782 return 0;
5783}
5784
6ea00485 5785static void l2cap_send_i_or_rr_or_rnr(struct l2cap_chan *chan)
d5392c8f 5786{
e31f7633 5787 struct l2cap_ctrl control;
d5392c8f 5788
e31f7633 5789 BT_DBG("chan %p", chan);
d5392c8f 5790
e31f7633
MM		 5791 memset(&control, 0, sizeof(control));
5792 control.sframe = 1;
5793 control.final = 1;
5794 control.reqseq = chan->buffer_seq;
5795 set_bit(CONN_SEND_FBIT, &chan->conn_state);
d5392c8f 5796
e2ab4353 5797 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
e31f7633
MM		 5798 control.super = L2CAP_SUPER_RNR;
5799 l2cap_send_sframe(chan, &control);
d5392c8f
GP		 5800 }
5801
e31f7633
MM		 5802 if (test_and_clear_bit(CONN_REMOTE_BUSY, &chan->conn_state) &&
5803 chan->unacked_frames > 0)
5804 __set_retrans_timer(chan);
d5392c8f 5805
e31f7633 5806 /* Send pending iframes */
525cd185 5807 l2cap_ertm_send(chan);
d5392c8f 5808
e2ab4353 5809 if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&
e31f7633
MM		 5810 test_bit(CONN_SEND_FBIT, &chan->conn_state)) {
5811 /* F-bit wasn't sent in an s-frame or i-frame yet, so
5812 * send it now.
5813 */
5814 control.super = L2CAP_SUPER_RR;
5815 l2cap_send_sframe(chan, &control);
d5392c8f
GP		 5816 }
5817}
5818
2d792818
GP		 5819static void append_skb_frag(struct sk_buff *skb, struct sk_buff *new_frag,
5820 struct sk_buff **last_frag)
18778a63 5821{
84084a31
MM		 5822 /* skb->len reflects data in skb as well as all fragments
5823 * skb->data_len reflects only data in fragments
5824 */
5825 if (!skb_has_frag_list(skb))
5826 skb_shinfo(skb)->frag_list = new_frag;
5827
5828 new_frag->next = NULL;
5829
5830 (*last_frag)->next = new_frag;
5831 *last_frag = new_frag;
5832
5833 skb->len += new_frag->len;
5834 skb->data_len += new_frag->len;
5835 skb->truesize += new_frag->truesize;
5836}
5837
4b51dae9
MM		 5838static int l2cap_reassemble_sdu(struct l2cap_chan *chan, struct sk_buff *skb,
5839 struct l2cap_ctrl *control)
84084a31
MM		 5840{
5841 int err = -EINVAL;
18778a63 5842
4b51dae9 5843 switch (control->sar) {
7e0ef6ee 5844 case L2CAP_SAR_UNSEGMENTED:
84084a31
MM		 5845 if (chan->sdu)
5846 break;
18778a63 5847
80b98027 5848 err = chan->ops->recv(chan, skb);
84084a31 5849 break;
18778a63 5850
7e0ef6ee 5851 case L2CAP_SAR_START:
84084a31
MM		 5852 if (chan->sdu)
5853 break;
18778a63 5854
dbb50887
DB		 5855 if (!pskb_may_pull(skb, L2CAP_SDULEN_SIZE))
5856 break;
5857
6f61fd47 5858 chan->sdu_len = get_unaligned_le16(skb->data);
03a51213 5859 skb_pull(skb, L2CAP_SDULEN_SIZE);
18778a63 5860
84084a31
MM		 5861 if (chan->sdu_len > chan->imtu) {
5862 err = -EMSGSIZE;
5863 break;
5864 }
1890d36b 5865
84084a31
MM		 5866 if (skb->len >= chan->sdu_len)
5867 break;
18778a63 5868
84084a31
MM		 5869 chan->sdu = skb;
5870 chan->sdu_last_frag = skb;
18778a63 5871
84084a31
MM		 5872 skb = NULL;
5873 err = 0;
18778a63
GP		 5874 break;
5875
7e0ef6ee 5876 case L2CAP_SAR_CONTINUE:
6f61fd47 5877 if (!chan->sdu)
84084a31 5878 break;
18778a63 5879
84084a31
MM		 5880 append_skb_frag(chan->sdu, skb,
5881 &chan->sdu_last_frag);
5882 skb = NULL;
18778a63 5883
84084a31
MM		 5884 if (chan->sdu->len >= chan->sdu_len)
5885 break;
4178ba46 5886
84084a31 5887 err = 0;
18778a63
GP		 5888 break;
5889
7e0ef6ee 5890 case L2CAP_SAR_END:
6f61fd47 5891 if (!chan->sdu)
84084a31 5892 break;
18778a63 5893
84084a31
MM		 5894 append_skb_frag(chan->sdu, skb,
5895 &chan->sdu_last_frag);
5896 skb = NULL;
4178ba46 5897
84084a31
MM		 5898 if (chan->sdu->len != chan->sdu_len)
5899 break;
18778a63 5900
80b98027 5901 err = chan->ops->recv(chan, chan->sdu);
1890d36b 5902
84084a31
MM		 5903 if (!err) {
5904 /* Reassembly complete */
5905 chan->sdu = NULL;
5906 chan->sdu_last_frag = NULL;
5907 chan->sdu_len = 0;
1890d36b 5908 }
18778a63
GP		 5909 break;
5910 }
5911
84084a31
MM		 5912 if (err) {
5913 kfree_skb(skb);
5914 kfree_skb(chan->sdu);
5915 chan->sdu = NULL;
5916 chan->sdu_last_frag = NULL;
5917 chan->sdu_len = 0;
5918 }
18778a63 5919
84084a31 5920 return err;
18778a63
GP		 5921}
5922
32b32735
MM		 5923static int l2cap_resegment(struct l2cap_chan *chan)
5924{
5925 /* Placeholder */
5926 return 0;
5927}
5928
61aa4f5b 5929void l2cap_chan_busy(struct l2cap_chan *chan, int busy)
26f880d2 5930{
61aa4f5b 5931 u8 event;
712132eb 5932
61aa4f5b
MM		 5933 if (chan->mode != L2CAP_MODE_ERTM)
5934 return;
712132eb 5935
61aa4f5b 5936 event = busy ? L2CAP_EV_LOCAL_BUSY_DETECTED : L2CAP_EV_LOCAL_BUSY_CLEAR;
401bb1f7 5937 l2cap_tx(chan, NULL, NULL, event);
1890d36b
GP		 5938}
5939
d2a7ac5d
MM		 5940static int l2cap_rx_queued_iframes(struct l2cap_chan *chan)
5941{
63838725
MM		 5942 int err = 0;
5943 /* Pass sequential frames to l2cap_reassemble_sdu()
5944 * until a gap is encountered.
5945 */
5946
5947 BT_DBG("chan %p", chan);
5948
5949 while (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
5950 struct sk_buff *skb;
5951 BT_DBG("Searching for skb with txseq %d (queue len %d)",
5952 chan->buffer_seq, skb_queue_len(&chan->srej_q));
5953
5954 skb = l2cap_ertm_seq_in_queue(&chan->srej_q, chan->buffer_seq);
5955
5956 if (!skb)
5957 break;
5958
5959 skb_unlink(skb, &chan->srej_q);
5960 chan->buffer_seq = __next_seq(chan, chan->buffer_seq);
a4368ff3 5961 err = l2cap_reassemble_sdu(chan, skb, &bt_cb(skb)->l2cap);
63838725
MM		 5962 if (err)
5963 break;
5964 }
5965
5966 if (skb_queue_empty(&chan->srej_q)) {
5967 chan->rx_state = L2CAP_RX_STATE_RECV;
5968 l2cap_send_ack(chan);
5969 }
5970
5971 return err;
d2a7ac5d
MM		 5972}
5973
5974static void l2cap_handle_srej(struct l2cap_chan *chan,
5975 struct l2cap_ctrl *control)
5976{
f80842a8
MM		 5977 struct sk_buff *skb;
5978
5979 BT_DBG("chan %p, control %p", chan, control);
5980
5981 if (control->reqseq == chan->next_tx_seq) {
5982 BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq);
5e4e3972 5983 l2cap_send_disconn_req(chan, ECONNRESET);
f80842a8
MM		 5984 return;
5985 }
5986
5987 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);
5988
5989 if (skb == NULL) {
5990 BT_DBG("Seq %d not available for retransmission",
5991 control->reqseq);
5992 return;
5993 }
5994
a4368ff3 5995 if (chan->max_tx != 0 && bt_cb(skb)->l2cap.retries >= chan->max_tx) {
f80842a8 5996 BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
5e4e3972 5997 l2cap_send_disconn_req(chan, ECONNRESET);
f80842a8
MM		 5998 return;
5999 }
6000
6001 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6002
6003 if (control->poll) {
6004 l2cap_pass_to_tx(chan, control);
6005
6006 set_bit(CONN_SEND_FBIT, &chan->conn_state);
6007 l2cap_retransmit(chan, control);
6008 l2cap_ertm_send(chan);
6009
6010 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) {
6011 set_bit(CONN_SREJ_ACT, &chan->conn_state);
6012 chan->srej_save_reqseq = control->reqseq;
6013 }
6014 } else {
6015 l2cap_pass_to_tx_fbit(chan, control);
6016
6017 if (control->final) {
6018 if (chan->srej_save_reqseq != control->reqseq ||
6019 !test_and_clear_bit(CONN_SREJ_ACT,
6020 &chan->conn_state))
6021 l2cap_retransmit(chan, control);
6022 } else {
6023 l2cap_retransmit(chan, control);
6024 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) {
6025 set_bit(CONN_SREJ_ACT, &chan->conn_state);
6026 chan->srej_save_reqseq = control->reqseq;
6027 }
6028 }
6029 }
d2a7ac5d
MM		 6030}
6031
6032static void l2cap_handle_rej(struct l2cap_chan *chan,
6033 struct l2cap_ctrl *control)
6034{
fcd289df
MM		 6035 struct sk_buff *skb;
6036
6037 BT_DBG("chan %p, control %p", chan, control);
6038
6039 if (control->reqseq == chan->next_tx_seq) {
6040 BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq);
5e4e3972 6041 l2cap_send_disconn_req(chan, ECONNRESET);
fcd289df
MM		 6042 return;
6043 }
6044
6045 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);
6046
6047 if (chan->max_tx && skb &&
a4368ff3 6048 bt_cb(skb)->l2cap.retries >= chan->max_tx) {
fcd289df 6049 BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
5e4e3972 6050 l2cap_send_disconn_req(chan, ECONNRESET);
fcd289df
MM		 6051 return;
6052 }
6053
6054 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6055
6056 l2cap_pass_to_tx(chan, control);
6057
6058 if (control->final) {
6059 if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))
6060 l2cap_retransmit_all(chan, control);
6061 } else {
6062 l2cap_retransmit_all(chan, control);
6063 l2cap_ertm_send(chan);
6064 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F)
6065 set_bit(CONN_REJ_ACT, &chan->conn_state);
6066 }
d2a7ac5d
MM		 6067}
6068
4b51dae9
MM		 6069static u8 l2cap_classify_txseq(struct l2cap_chan *chan, u16 txseq)
6070{
6071 BT_DBG("chan %p, txseq %d", chan, txseq);
6072
6073 BT_DBG("last_acked_seq %d, expected_tx_seq %d", chan->last_acked_seq,
6074 chan->expected_tx_seq);
6075
6076 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
6077 if (__seq_offset(chan, txseq, chan->last_acked_seq) >=
2d792818 6078 chan->tx_win) {
4b51dae9
MM		 6079 /* See notes below regarding "double poll" and
6080 * invalid packets.
6081 */
6082 if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) {
6083 BT_DBG("Invalid/Ignore - after SREJ");
6084 return L2CAP_TXSEQ_INVALID_IGNORE;
6085 } else {
6086 BT_DBG("Invalid - in window after SREJ sent");
6087 return L2CAP_TXSEQ_INVALID;
6088 }
6089 }
6090
6091 if (chan->srej_list.head == txseq) {
6092 BT_DBG("Expected SREJ");
6093 return L2CAP_TXSEQ_EXPECTED_SREJ;
6094 }
6095
6096 if (l2cap_ertm_seq_in_queue(&chan->srej_q, txseq)) {
6097 BT_DBG("Duplicate SREJ - txseq already stored");
6098 return L2CAP_TXSEQ_DUPLICATE_SREJ;
6099 }
6100
6101 if (l2cap_seq_list_contains(&chan->srej_list, txseq)) {
6102 BT_DBG("Unexpected SREJ - not requested");
6103 return L2CAP_TXSEQ_UNEXPECTED_SREJ;
6104 }
6105 }
6106
6107 if (chan->expected_tx_seq == txseq) {
6108 if (__seq_offset(chan, txseq, chan->last_acked_seq) >=
6109 chan->tx_win) {
6110 BT_DBG("Invalid - txseq outside tx window");
6111 return L2CAP_TXSEQ_INVALID;
6112 } else {
6113 BT_DBG("Expected");
6114 return L2CAP_TXSEQ_EXPECTED;
6115 }
6116 }
6117
6118 if (__seq_offset(chan, txseq, chan->last_acked_seq) <
2d792818 6119 __seq_offset(chan, chan->expected_tx_seq, chan->last_acked_seq)) {
4b51dae9
MM		 6120 BT_DBG("Duplicate - expected_tx_seq later than txseq");
6121 return L2CAP_TXSEQ_DUPLICATE;
6122 }
6123
6124 if (__seq_offset(chan, txseq, chan->last_acked_seq) >= chan->tx_win) {
6125 /* A source of invalid packets is a "double poll" condition,
6126 * where delays cause us to send multiple poll packets. If
6127 * the remote stack receives and processes both polls,
6128 * sequence numbers can wrap around in such a way that a
6129 * resent frame has a sequence number that looks like new data
6130 * with a sequence gap. This would trigger an erroneous SREJ
6131 * request.
6132 *
6133 * Fortunately, this is impossible with a tx window that's
6134 * less than half of the maximum sequence number, which allows
6135 * invalid frames to be safely ignored.
6136 *
6137 * With tx window sizes greater than half of the tx window
6138 * maximum, the frame is invalid and cannot be ignored. This
6139 * causes a disconnect.
6140 */
6141
6142 if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) {
6143 BT_DBG("Invalid/Ignore - txseq outside tx window");
6144 return L2CAP_TXSEQ_INVALID_IGNORE;
6145 } else {
6146 BT_DBG("Invalid - txseq outside tx window");
6147 return L2CAP_TXSEQ_INVALID;
6148 }
6149 } else {
6150 BT_DBG("Unexpected - txseq indicates missing frames");
6151 return L2CAP_TXSEQ_UNEXPECTED;
6152 }
6153}
6154
d2a7ac5d
MM		 6155static int l2cap_rx_state_recv(struct l2cap_chan *chan,
6156 struct l2cap_ctrl *control,
6157 struct sk_buff *skb, u8 event)
6158{
6159 int err = 0;
941247f9 6160 bool skb_in_use = false;
d2a7ac5d
MM		 6161
6162 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
6163 event);
6164
6165 switch (event) {
6166 case L2CAP_EV_RECV_IFRAME:
6167 switch (l2cap_classify_txseq(chan, control->txseq)) {
6168 case L2CAP_TXSEQ_EXPECTED:
6169 l2cap_pass_to_tx(chan, control);
6170
6171 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
6172 BT_DBG("Busy, discarding expected seq %d",
6173 control->txseq);
6174 break;
6175 }
6176
6177 chan->expected_tx_seq = __next_seq(chan,
6178 control->txseq);
6179
6180 chan->buffer_seq = chan->expected_tx_seq;
941247f9 6181 skb_in_use = true;
d2a7ac5d
MM		 6182
6183 err = l2cap_reassemble_sdu(chan, skb, control);
6184 if (err)
6185 break;
6186
6187 if (control->final) {
6188 if (!test_and_clear_bit(CONN_REJ_ACT,
6189 &chan->conn_state)) {
6190 control->final = 0;
6191 l2cap_retransmit_all(chan, control);
6192 l2cap_ertm_send(chan);
6193 }
6194 }
6195
6196 if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state))
6197 l2cap_send_ack(chan);
6198 break;
6199 case L2CAP_TXSEQ_UNEXPECTED:
6200 l2cap_pass_to_tx(chan, control);
6201
6202 /* Can't issue SREJ frames in the local busy state.
6203 * Drop this frame, it will be seen as missing
6204 * when local busy is exited.
6205 */
6206 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
6207 BT_DBG("Busy, discarding unexpected seq %d",
6208 control->txseq);
6209 break;
6210 }
6211
6212 /* There was a gap in the sequence, so an SREJ
6213 * must be sent for each missing frame. The
6214 * current frame is stored for later use.
6215 */
6216 skb_queue_tail(&chan->srej_q, skb);
941247f9 6217 skb_in_use = true;
d2a7ac5d
MM		 6218 BT_DBG("Queued %p (queue len %d)", skb,
6219 skb_queue_len(&chan->srej_q));
6220
6221 clear_bit(CONN_SREJ_ACT, &chan->conn_state);
6222 l2cap_seq_list_clear(&chan->srej_list);
6223 l2cap_send_srej(chan, control->txseq);
6224
6225 chan->rx_state = L2CAP_RX_STATE_SREJ_SENT;
6226 break;
6227 case L2CAP_TXSEQ_DUPLICATE:
6228 l2cap_pass_to_tx(chan, control);
6229 break;
6230 case L2CAP_TXSEQ_INVALID_IGNORE:
6231 break;
6232 case L2CAP_TXSEQ_INVALID:
6233 default:
5e4e3972 6234 l2cap_send_disconn_req(chan, ECONNRESET);
d2a7ac5d
MM		 6235 break;
6236 }
6237 break;
6238 case L2CAP_EV_RECV_RR:
6239 l2cap_pass_to_tx(chan, control);
6240 if (control->final) {
6241 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6242
e6a3ee6e
MM		 6243 if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state) &&
6244 !__chan_is_moving(chan)) {
d2a7ac5d
MM		 6245 control->final = 0;
6246 l2cap_retransmit_all(chan, control);
6247 }
6248
6249 l2cap_ertm_send(chan);
6250 } else if (control->poll) {
6251 l2cap_send_i_or_rr_or_rnr(chan);
6252 } else {
6253 if (test_and_clear_bit(CONN_REMOTE_BUSY,
6254 &chan->conn_state) &&
6255 chan->unacked_frames)
6256 __set_retrans_timer(chan);
6257
6258 l2cap_ertm_send(chan);
6259 }
6260 break;
6261 case L2CAP_EV_RECV_RNR:
6262 set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6263 l2cap_pass_to_tx(chan, control);
6264 if (control && control->poll) {
6265 set_bit(CONN_SEND_FBIT, &chan->conn_state);
6266 l2cap_send_rr_or_rnr(chan, 0);
6267 }
6268 __clear_retrans_timer(chan);
6269 l2cap_seq_list_clear(&chan->retrans_list);
6270 break;
6271 case L2CAP_EV_RECV_REJ:
6272 l2cap_handle_rej(chan, control);
6273 break;
6274 case L2CAP_EV_RECV_SREJ:
6275 l2cap_handle_srej(chan, control);
6276 break;
6277 default:
6278 break;
6279 }
6280
6281 if (skb && !skb_in_use) {
6282 BT_DBG("Freeing %p", skb);
6283 kfree_skb(skb);
6284 }
6285
6286 return err;
6287}
6288
6289static int l2cap_rx_state_srej_sent(struct l2cap_chan *chan,
6290 struct l2cap_ctrl *control,
6291 struct sk_buff *skb, u8 event)
6292{
6293 int err = 0;
6294 u16 txseq = control->txseq;
941247f9 6295 bool skb_in_use = false;
d2a7ac5d
MM		 6296
6297 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
6298 event);
6299
6300 switch (event) {
6301 case L2CAP_EV_RECV_IFRAME:
6302 switch (l2cap_classify_txseq(chan, txseq)) {
6303 case L2CAP_TXSEQ_EXPECTED:
6304 /* Keep frame for reassembly later */
6305 l2cap_pass_to_tx(chan, control);
6306 skb_queue_tail(&chan->srej_q, skb);
941247f9 6307 skb_in_use = true;
d2a7ac5d
MM		 6308 BT_DBG("Queued %p (queue len %d)", skb,
6309 skb_queue_len(&chan->srej_q));
6310
6311 chan->expected_tx_seq = __next_seq(chan, txseq);
6312 break;
6313 case L2CAP_TXSEQ_EXPECTED_SREJ:
6314 l2cap_seq_list_pop(&chan->srej_list);
6315
6316 l2cap_pass_to_tx(chan, control);
6317 skb_queue_tail(&chan->srej_q, skb);
941247f9 6318 skb_in_use = true;
d2a7ac5d
MM		 6319 BT_DBG("Queued %p (queue len %d)", skb,
6320 skb_queue_len(&chan->srej_q));
6321
6322 err = l2cap_rx_queued_iframes(chan);
6323 if (err)
6324 break;
6325
6326 break;
6327 case L2CAP_TXSEQ_UNEXPECTED:
6328 /* Got a frame that can't be reassembled yet.
6329 * Save it for later, and send SREJs to cover
6330 * the missing frames.
6331 */
6332 skb_queue_tail(&chan->srej_q, skb);
941247f9 6333 skb_in_use = true;
d2a7ac5d
MM		 6334 BT_DBG("Queued %p (queue len %d)", skb,
6335 skb_queue_len(&chan->srej_q));
6336
6337 l2cap_pass_to_tx(chan, control);
6338 l2cap_send_srej(chan, control->txseq);
6339 break;
6340 case L2CAP_TXSEQ_UNEXPECTED_SREJ:
6341 /* This frame was requested with an SREJ, but
6342 * some expected retransmitted frames are
6343 * missing. Request retransmission of missing
6344 * SREJ'd frames.
6345 */
6346 skb_queue_tail(&chan->srej_q, skb);
941247f9 6347 skb_in_use = true;
d2a7ac5d
MM		 6348 BT_DBG("Queued %p (queue len %d)", skb,
6349 skb_queue_len(&chan->srej_q));
6350
6351 l2cap_pass_to_tx(chan, control);
6352 l2cap_send_srej_list(chan, control->txseq);
6353 break;
6354 case L2CAP_TXSEQ_DUPLICATE_SREJ:
6355 /* We've already queued this frame. Drop this copy. */
6356 l2cap_pass_to_tx(chan, control);
6357 break;
6358 case L2CAP_TXSEQ_DUPLICATE:
6359 /* Expecting a later sequence number, so this frame
6360 * was already received. Ignore it completely.
6361 */
6362 break;
6363 case L2CAP_TXSEQ_INVALID_IGNORE:
6364 break;
6365 case L2CAP_TXSEQ_INVALID:
6366 default:
5e4e3972 6367 l2cap_send_disconn_req(chan, ECONNRESET);
d2a7ac5d
MM		 6368 break;
6369 }
6370 break;
6371 case L2CAP_EV_RECV_RR:
6372 l2cap_pass_to_tx(chan, control);
6373 if (control->final) {
6374 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6375
6376 if (!test_and_clear_bit(CONN_REJ_ACT,
6377 &chan->conn_state)) {
6378 control->final = 0;
6379 l2cap_retransmit_all(chan, control);
6380 }
6381
6382 l2cap_ertm_send(chan);
6383 } else if (control->poll) {
6384 if (test_and_clear_bit(CONN_REMOTE_BUSY,
6385 &chan->conn_state) &&
6386 chan->unacked_frames) {
6387 __set_retrans_timer(chan);
6388 }
6389
6390 set_bit(CONN_SEND_FBIT, &chan->conn_state);
6391 l2cap_send_srej_tail(chan);
6392 } else {
6393 if (test_and_clear_bit(CONN_REMOTE_BUSY,
6394 &chan->conn_state) &&
6395 chan->unacked_frames)
6396 __set_retrans_timer(chan);
6397
6398 l2cap_send_ack(chan);
6399 }
6400 break;
6401 case L2CAP_EV_RECV_RNR:
6402 set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6403 l2cap_pass_to_tx(chan, control);
6404 if (control->poll) {
6405 l2cap_send_srej_tail(chan);
6406 } else {
6407 struct l2cap_ctrl rr_control;
6408 memset(&rr_control, 0, sizeof(rr_control));
6409 rr_control.sframe = 1;
6410 rr_control.super = L2CAP_SUPER_RR;
6411 rr_control.reqseq = chan->buffer_seq;
6412 l2cap_send_sframe(chan, &rr_control);
6413 }
6414
6415 break;
6416 case L2CAP_EV_RECV_REJ:
6417 l2cap_handle_rej(chan, control);
6418 break;
6419 case L2CAP_EV_RECV_SREJ:
6420 l2cap_handle_srej(chan, control);
6421 break;
6422 }
6423
6424 if (skb && !skb_in_use) {
6425 BT_DBG("Freeing %p", skb);
6426 kfree_skb(skb);
6427 }
6428
6429 return err;
6430}
6431
32b32735
MM		 6432static int l2cap_finish_move(struct l2cap_chan *chan)
6433{
6434 BT_DBG("chan %p", chan);
6435
6436 chan->rx_state = L2CAP_RX_STATE_RECV;
6437
6438 if (chan->hs_hcon)
6439 chan->conn->mtu = chan->hs_hcon->hdev->block_mtu;
6440 else
6441 chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu;
6442
6443 return l2cap_resegment(chan);
6444}
6445
6446static int l2cap_rx_state_wait_p(struct l2cap_chan *chan,
6447 struct l2cap_ctrl *control,
6448 struct sk_buff *skb, u8 event)
6449{
6450 int err;
6451
6452 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
6453 event);
6454
6455 if (!control->poll)
6456 return -EPROTO;
6457
6458 l2cap_process_reqseq(chan, control->reqseq);
6459
6460 if (!skb_queue_empty(&chan->tx_q))
6461 chan->tx_send_head = skb_peek(&chan->tx_q);
6462 else
6463 chan->tx_send_head = NULL;
6464
6465 /* Rewind next_tx_seq to the point expected
6466 * by the receiver.
6467 */
6468 chan->next_tx_seq = control->reqseq;
6469 chan->unacked_frames = 0;
6470
6471 err = l2cap_finish_move(chan);
6472 if (err)
6473 return err;
6474
6475 set_bit(CONN_SEND_FBIT, &chan->conn_state);
6476 l2cap_send_i_or_rr_or_rnr(chan);
6477
6478 if (event == L2CAP_EV_RECV_IFRAME)
6479 return -EPROTO;
6480
6481 return l2cap_rx_state_recv(chan, control, NULL, event);
6482}
6483
6484static int l2cap_rx_state_wait_f(struct l2cap_chan *chan,
6485 struct l2cap_ctrl *control,
6486 struct sk_buff *skb, u8 event)
6487{
6488 int err;
6489
6490 if (!control->final)
6491 return -EPROTO;
6492
6493 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6494
6495 chan->rx_state = L2CAP_RX_STATE_RECV;
6496 l2cap_process_reqseq(chan, control->reqseq);
6497
6498 if (!skb_queue_empty(&chan->tx_q))
6499 chan->tx_send_head = skb_peek(&chan->tx_q);
6500 else
6501 chan->tx_send_head = NULL;
6502
6503 /* Rewind next_tx_seq to the point expected
6504 * by the receiver.
6505 */
6506 chan->next_tx_seq = control->reqseq;
6507 chan->unacked_frames = 0;
6508
6509 if (chan->hs_hcon)
6510 chan->conn->mtu = chan->hs_hcon->hdev->block_mtu;
6511 else
6512 chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu;
6513
6514 err = l2cap_resegment(chan);
6515
6516 if (!err)
6517 err = l2cap_rx_state_recv(chan, control, skb, event);
6518
6519 return err;
6520}
6521
d2a7ac5d
MM		 6522static bool __valid_reqseq(struct l2cap_chan *chan, u16 reqseq)
6523{
6524 /* Make sure reqseq is for a packet that has been sent but not acked */
6525 u16 unacked;
6526
6527 unacked = __seq_offset(chan, chan->next_tx_seq, chan->expected_ack_seq);
6528 return __seq_offset(chan, chan->next_tx_seq, reqseq) <= unacked;
6529}
6530
cec8ab6e
MM		 6531static int l2cap_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
6532 struct sk_buff *skb, u8 event)
218bb9df 6533{
d2a7ac5d
MM		 6534 int err = 0;
6535
6536 BT_DBG("chan %p, control %p, skb %p, event %d, state %d", chan,
6537 control, skb, event, chan->rx_state);
6538
6539 if (__valid_reqseq(chan, control->reqseq)) {
6540 switch (chan->rx_state) {
6541 case L2CAP_RX_STATE_RECV:
6542 err = l2cap_rx_state_recv(chan, control, skb, event);
6543 break;
6544 case L2CAP_RX_STATE_SREJ_SENT:
6545 err = l2cap_rx_state_srej_sent(chan, control, skb,
6546 event);
6547 break;
32b32735
MM		 6548 case L2CAP_RX_STATE_WAIT_P:
6549 err = l2cap_rx_state_wait_p(chan, control, skb, event);
6550 break;
6551 case L2CAP_RX_STATE_WAIT_F:
6552 err = l2cap_rx_state_wait_f(chan, control, skb, event);
6553 break;
d2a7ac5d
MM		 6554 default:
6555 /* shut it down */
6556 break;
6557 }
6558 } else {
6559 BT_DBG("Invalid reqseq %d (next_tx_seq %d, expected_ack_seq %d",
6560 control->reqseq, chan->next_tx_seq,
6561 chan->expected_ack_seq);
5e4e3972 6562 l2cap_send_disconn_req(chan, ECONNRESET);
d2a7ac5d
MM		 6563 }
6564
6565 return err;
cec8ab6e
MM		 6566}
6567
6568static int l2cap_stream_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
6569 struct sk_buff *skb)
6570{
4b51dae9
MM		 6571 BT_DBG("chan %p, control %p, skb %p, state %d", chan, control, skb,
6572 chan->rx_state);
6573
6574 if (l2cap_classify_txseq(chan, control->txseq) ==
6575 L2CAP_TXSEQ_EXPECTED) {
6576 l2cap_pass_to_tx(chan, control);
6577
6578 BT_DBG("buffer_seq %d->%d", chan->buffer_seq,
6579 __next_seq(chan, chan->buffer_seq));
6580
6581 chan->buffer_seq = __next_seq(chan, chan->buffer_seq);
6582
6583 l2cap_reassemble_sdu(chan, skb, control);
6584 } else {
6585 if (chan->sdu) {
6586 kfree_skb(chan->sdu);
6587 chan->sdu = NULL;
6588 }
6589 chan->sdu_last_frag = NULL;
6590 chan->sdu_len = 0;
6591
6592 if (skb) {
6593 BT_DBG("Freeing %p", skb);
6594 kfree_skb(skb);
6595 }
6596 }
6597
6598 chan->last_acked_seq = control->txseq;
6599 chan->expected_tx_seq = __next_seq(chan, control->txseq);
6600
9a544210 6601 return 0;
cec8ab6e
MM		 6602}
6603
6604static int l2cap_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
6605{
a4368ff3 6606 struct l2cap_ctrl *control = &bt_cb(skb)->l2cap;
cec8ab6e
MM		 6607 u16 len;
6608 u8 event;
218bb9df 6609
b76bbd66
MM		 6610 __unpack_control(chan, skb);
6611
218bb9df
GP		 6612 len = skb->len;
6613
6614 /*
6615 * We can just drop the corrupted I-frame here.
6616 * Receiver will miss it and start proper recovery
cec8ab6e 6617 * procedures and ask for retransmission.
218bb9df 6618 */
47d1ec61 6619 if (l2cap_check_fcs(chan, skb))
218bb9df
GP		 6620 goto drop;
6621
cec8ab6e 6622 if (!control->sframe && control->sar == L2CAP_SAR_START)
03a51213 6623 len -= L2CAP_SDULEN_SIZE;
218bb9df 6624
47d1ec61 6625 if (chan->fcs == L2CAP_FCS_CRC16)
03a51213 6626 len -= L2CAP_FCS_SIZE;
218bb9df 6627
47d1ec61 6628 if (len > chan->mps) {
5e4e3972 6629 l2cap_send_disconn_req(chan, ECONNRESET);
218bb9df
GP		 6630 goto drop;
6631 }
6632
dbb50887
DB		 6633 if ((chan->mode == L2CAP_MODE_ERTM ||
6634 chan->mode == L2CAP_MODE_STREAMING) && sk_filter(chan->data, skb))
6635 goto drop;
6636
cec8ab6e
MM		 6637 if (!control->sframe) {
6638 int err;
218bb9df 6639
cec8ab6e
MM		 6640 BT_DBG("iframe sar %d, reqseq %d, final %d, txseq %d",
6641 control->sar, control->reqseq, control->final,
6642 control->txseq);
218bb9df 6643
cec8ab6e
MM		 6644 /* Validate F-bit - F=0 always valid, F=1 only
6645 * valid in TX WAIT_F
6646 */
6647 if (control->final && chan->tx_state != L2CAP_TX_STATE_WAIT_F)
218bb9df 6648 goto drop;
cec8ab6e
MM		 6649
6650 if (chan->mode != L2CAP_MODE_STREAMING) {
6651 event = L2CAP_EV_RECV_IFRAME;
6652 err = l2cap_rx(chan, control, skb, event);
6653 } else {
6654 err = l2cap_stream_rx(chan, control, skb);
218bb9df
GP		 6655 }
6656
cec8ab6e 6657 if (err)
5e4e3972 6658 l2cap_send_disconn_req(chan, ECONNRESET);
218bb9df 6659 } else {
cec8ab6e
MM		 6660 const u8 rx_func_to_event[4] = {
6661 L2CAP_EV_RECV_RR, L2CAP_EV_RECV_REJ,
6662 L2CAP_EV_RECV_RNR, L2CAP_EV_RECV_SREJ
6663 };
6664
6665 /* Only I-frames are expected in streaming mode */
6666 if (chan->mode == L2CAP_MODE_STREAMING)
6667 goto drop;
6668
6669 BT_DBG("sframe reqseq %d, final %d, poll %d, super %d",
6670 control->reqseq, control->final, control->poll,
6671 control->super);
6672
218bb9df 6673 if (len != 0) {
1bb166e6 6674 BT_ERR("Trailing bytes: %d in sframe", len);
5e4e3972 6675 l2cap_send_disconn_req(chan, ECONNRESET);
218bb9df
GP		 6676 goto drop;
6677 }
6678
cec8ab6e
MM		 6679 /* Validate F and P bits */
6680 if (control->final && (control->poll ||
6681 chan->tx_state != L2CAP_TX_STATE_WAIT_F))
6682 goto drop;
6683
6684 event = rx_func_to_event[control->super];
6685 if (l2cap_rx(chan, control, skb, event))
5e4e3972 6686 l2cap_send_disconn_req(chan, ECONNRESET);
218bb9df
GP		 6687 }
6688
6689 return 0;
6690
6691drop:
6692 kfree_skb(skb);
6693 return 0;
6694}
6695
b1c325c2
JH		 6696static void l2cap_chan_le_send_credits(struct l2cap_chan *chan)
6697{
6698 struct l2cap_conn *conn = chan->conn;
6699 struct l2cap_le_credits pkt;
6700 u16 return_credits;
6701
6702 /* We return more credits to the sender only after the amount of
6703 * credits falls below half of the initial amount.
6704 */
f15b8ecf 6705 if (chan->rx_credits >= (le_max_credits + 1) / 2)
b1c325c2
JH		 6706 return;
6707
f15b8ecf 6708 return_credits = le_max_credits - chan->rx_credits;
b1c325c2
JH		 6709
6710 BT_DBG("chan %p returning %u credits to sender", chan, return_credits);
6711
6712 chan->rx_credits += return_credits;
6713
6714 pkt.cid = cpu_to_le16(chan->scid);
6715 pkt.credits = cpu_to_le16(return_credits);
6716
6717 chan->ident = l2cap_get_ident(conn);
6718
6719 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CREDITS, sizeof(pkt), &pkt);
6720}
6721
fad5fc89
JH		 6722static int l2cap_le_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
6723{
aac23bf6
JH		 6724 int err;
6725
6726 if (!chan->rx_credits) {
6727 BT_ERR("No credits to receive LE L2CAP data");
dfd9774c 6728 l2cap_send_disconn_req(chan, ECONNRESET);
fad5fc89 6729 return -ENOBUFS;
aac23bf6 6730 }
fad5fc89 6731
aac23bf6
JH		 6732 if (chan->imtu < skb->len) {
6733 BT_ERR("Too big LE L2CAP PDU");
fad5fc89 6734 return -ENOBUFS;
aac23bf6 6735 }
fad5fc89
JH		 6736
6737 chan->rx_credits--;
6738 BT_DBG("rx_credits %u -> %u", chan->rx_credits + 1, chan->rx_credits);
6739
6740 l2cap_chan_le_send_credits(chan);
6741
aac23bf6
JH		 6742 err = 0;
6743
6744 if (!chan->sdu) {
6745 u16 sdu_len;
6746
6747 sdu_len = get_unaligned_le16(skb->data);
6748 skb_pull(skb, L2CAP_SDULEN_SIZE);
6749
6750 BT_DBG("Start of new SDU. sdu_len %u skb->len %u imtu %u",
6751 sdu_len, skb->len, chan->imtu);
6752
6753 if (sdu_len > chan->imtu) {
6754 BT_ERR("Too big LE L2CAP SDU length received");
6755 err = -EMSGSIZE;
6756 goto failed;
6757 }
6758
6759 if (skb->len > sdu_len) {
6760 BT_ERR("Too much LE L2CAP data received");
6761 err = -EINVAL;
6762 goto failed;
6763 }
6764
6765 if (skb->len == sdu_len)
6766 return chan->ops->recv(chan, skb);
6767
6768 chan->sdu = skb;
6769 chan->sdu_len = sdu_len;
6770 chan->sdu_last_frag = skb;
6771
6772 return 0;
6773 }
6774
6775 BT_DBG("SDU fragment. chan->sdu->len %u skb->len %u chan->sdu_len %u",
6776 chan->sdu->len, skb->len, chan->sdu_len);
6777
6778 if (chan->sdu->len + skb->len > chan->sdu_len) {
6779 BT_ERR("Too much LE L2CAP data received");
6780 err = -EINVAL;
6781 goto failed;
6782 }
6783
6784 append_skb_frag(chan->sdu, skb, &chan->sdu_last_frag);
6785 skb = NULL;
6786
6787 if (chan->sdu->len == chan->sdu_len) {
6788 err = chan->ops->recv(chan, chan->sdu);
6789 if (!err) {
6790 chan->sdu = NULL;
6791 chan->sdu_last_frag = NULL;
6792 chan->sdu_len = 0;
6793 }
6794 }
6795
6796failed:
6797 if (err) {
6798 kfree_skb(skb);
6799 kfree_skb(chan->sdu);
6800 chan->sdu = NULL;
6801 chan->sdu_last_frag = NULL;
6802 chan->sdu_len = 0;
6803 }
6804
6805 /* We can't return an error here since we took care of the skb
6806 * freeing internally. An error return would cause the caller to
6807 * do a double-free of the skb.
6808 */
6809 return 0;
fad5fc89
JH		 6810}
6811
13ca56e0
AE		 6812static void l2cap_data_channel(struct l2cap_conn *conn, u16 cid,
6813 struct sk_buff *skb)
1da177e4 6814{
48454079 6815 struct l2cap_chan *chan;
1da177e4 6816
baa7e1fa 6817 chan = l2cap_get_chan_by_scid(conn, cid);
48454079 6818 if (!chan) {
97e8e89d
AE		 6819 if (cid == L2CAP_CID_A2MP) {
6820 chan = a2mp_channel_create(conn, skb);
6821 if (!chan) {
6822 kfree_skb(skb);
13ca56e0 6823 return;
97e8e89d
AE		 6824 }
6825
6826 l2cap_chan_lock(chan);
6827 } else {
6828 BT_DBG("unknown cid 0x%4.4x", cid);
6829 /* Drop packet and return */
6830 kfree_skb(skb);
13ca56e0 6831 return;
97e8e89d 6832 }
1da177e4
LT		 6833 }
6834
49208c9c 6835 BT_DBG("chan %p, len %d", chan, skb->len);
1da177e4 6836
315917e0
JH		 6837 /* If we receive data on a fixed channel before the info req/rsp
6838 * procdure is done simply assume that the channel is supported
6839 * and mark it as ready.
6840 */
6841 if (chan->chan_type == L2CAP_CHAN_FIXED)
6842 l2cap_chan_ready(chan);
6843
89bc500e 6844 if (chan->state != BT_CONNECTED)
1da177e4
LT		 6845 goto drop;
6846
0c1bc5c6 6847 switch (chan->mode) {
38319713 6848 case L2CAP_MODE_LE_FLOWCTL:
fad5fc89
JH		 6849 if (l2cap_le_data_rcv(chan, skb) < 0)
6850 goto drop;
6851
6852 goto done;
6853
1c2acffb
GP		 6854 case L2CAP_MODE_BASIC:
6855 /* If socket recv buffers overflows we drop data here
6856 * which is *bad* because L2CAP has to be reliable.
6857 * But we don't have any other choice. L2CAP doesn't
6858 * provide flow control mechanism. */
1da177e4 6859
2c96e03d
SJ		 6860 if (chan->imtu < skb->len) {
6861 BT_ERR("Dropping L2CAP data: receive buffer overflow");
1c2acffb 6862 goto drop;
2c96e03d 6863 }
1da177e4 6864
80b98027 6865 if (!chan->ops->recv(chan, skb))
1c2acffb
GP		 6866 goto done;
6867 break;
6868
6869 case L2CAP_MODE_ERTM:
6840ed07 6870 case L2CAP_MODE_STREAMING:
cec8ab6e 6871 l2cap_data_rcv(chan, skb);
6840ed07
GP		 6872 goto done;
6873
1c2acffb 6874 default:
0c1bc5c6 6875 BT_DBG("chan %p: bad mode 0x%2.2x", chan, chan->mode);
1c2acffb
GP		 6876 break;
6877 }
1da177e4
LT		 6878
6879drop:
6880 kfree_skb(skb);
6881
6882done:
6be36555 6883 l2cap_chan_unlock(chan);
1da177e4
LT		 6884}
6885
84104b24
AE		 6886static void l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm,
6887 struct sk_buff *skb)
1da177e4 6888{
ae4fd2d3 6889 struct hci_conn *hcon = conn->hcon;
23691d75 6890 struct l2cap_chan *chan;
1da177e4 6891
ae4fd2d3 6892 if (hcon->type != ACL_LINK)
a24cce14 6893 goto free_skb;
ae4fd2d3 6894
bf20fd4e
JH		 6895 chan = l2cap_global_chan_by_psm(0, psm, &hcon->src, &hcon->dst,
6896 ACL_LINK);
23691d75 6897 if (!chan)
a24cce14 6898 goto free_skb;
1da177e4 6899
5b4cedaa 6900 BT_DBG("chan %p, len %d", chan, skb->len);
1da177e4 6901
89bc500e 6902 if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)
1da177e4
LT		 6903 goto drop;
6904
e13e21dc 6905 if (chan->imtu < skb->len)
1da177e4
LT		 6906 goto drop;
6907
2edf870d 6908 /* Store remote BD_ADDR and PSM for msg_name */
a4368ff3
JH		 6909 bacpy(&bt_cb(skb)->l2cap.bdaddr, &hcon->dst);
6910 bt_cb(skb)->l2cap.psm = psm;
2edf870d 6911
a24cce14
JH		 6912 if (!chan->ops->recv(chan, skb)) {
6913 l2cap_chan_put(chan);
84104b24 6914 return;
a24cce14 6915 }
1da177e4
LT		 6916
6917drop:
a24cce14
JH		 6918 l2cap_chan_put(chan);
6919free_skb:
1da177e4 6920 kfree_skb(skb);
1da177e4
LT		 6921}
6922
6923static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
6924{
6925 struct l2cap_hdr *lh = (void *) skb->data;
61a939c6 6926 struct hci_conn *hcon = conn->hcon;
8e036fc3
AV		 6927 u16 cid, len;
6928 __le16 psm;
1da177e4 6929
61a939c6
JH		 6930 if (hcon->state != BT_CONNECTED) {
6931 BT_DBG("queueing pending rx skb");
6932 skb_queue_tail(&conn->pending_rx, skb);
6933 return;
6934 }
6935
1da177e4
LT		 6936 skb_pull(skb, L2CAP_HDR_SIZE);
6937 cid = __le16_to_cpu(lh->cid);
6938 len = __le16_to_cpu(lh->len);
6939
1c2acffb
GP		 6940 if (len != skb->len) {
6941 kfree_skb(skb);
6942 return;
6943 }
6944
9e1d7e15
JH		 6945 /* Since we can't actively block incoming LE connections we must
6946 * at least ensure that we ignore incoming data from them.
6947 */
6948 if (hcon->type == LE_LINK &&
dcc36c16 6949 hci_bdaddr_list_lookup(&hcon->hdev->blacklist, &hcon->dst,
a250e048 6950 bdaddr_dst_type(hcon))) {
e493150e
JH		 6951 kfree_skb(skb);
6952 return;
6953 }
6954
1da177e4
LT		 6955 BT_DBG("len %d, cid 0x%4.4x", len, cid);
6956
6957 switch (cid) {
8db4dc46 6958 case L2CAP_CID_SIGNALING:
1da177e4
LT		 6959 l2cap_sig_channel(conn, skb);
6960 break;
6961
8db4dc46 6962 case L2CAP_CID_CONN_LESS:
097db76c 6963 psm = get_unaligned((__le16 *) skb->data);
0181a70f 6964 skb_pull(skb, L2CAP_PSMLEN_SIZE);
1da177e4
LT		 6965 l2cap_conless_channel(conn, psm, skb);
6966 break;
6967
a2877629
MH		 6968 case L2CAP_CID_LE_SIGNALING:
6969 l2cap_le_sig_channel(conn, skb);
6970 break;
6971
1da177e4
LT		 6972 default:
6973 l2cap_data_channel(conn, cid, skb);
6974 break;
6975 }
6976}
6977
61a939c6
JH		 6978static void process_pending_rx(struct work_struct *work)
6979{
6980 struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
6981 pending_rx_work);
6982 struct sk_buff *skb;
6983
6984 BT_DBG("");
6985
6986 while ((skb = skb_dequeue(&conn->pending_rx)))
6987 l2cap_recv_frame(conn, skb);
6988}
6989
162b49e7
JH		 6990static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon)
6991{
6992 struct l2cap_conn *conn = hcon->l2cap_data;
6993 struct hci_chan *hchan;
6994
6995 if (conn)
6996 return conn;
6997
6998 hchan = hci_chan_create(hcon);
6999 if (!hchan)
7000 return NULL;
7001
27f70f3e 7002 conn = kzalloc(sizeof(*conn), GFP_KERNEL);
162b49e7
JH		 7003 if (!conn) {
7004 hci_chan_del(hchan);
7005 return NULL;
7006 }
7007
7008 kref_init(&conn->ref);
7009 hcon->l2cap_data = conn;
51bb8457 7010 conn->hcon = hci_conn_get(hcon);
162b49e7
JH		 7011 conn->hchan = hchan;
7012
7013 BT_DBG("hcon %p conn %p hchan %p", hcon, conn, hchan);
7014
7015 switch (hcon->type) {
7016 case LE_LINK:
7017 if (hcon->hdev->le_mtu) {
7018 conn->mtu = hcon->hdev->le_mtu;
7019 break;
7020 }
7021 /* fall through */
7022 default:
7023 conn->mtu = hcon->hdev->acl_mtu;
7024 break;
7025 }
7026
7027 conn->feat_mask = 0;
7028
0bd49fc7
JH		 7029 conn->local_fixed_chan = L2CAP_FC_SIG_BREDR | L2CAP_FC_CONNLESS;
7030
7031 if (hcon->type == ACL_LINK &&
d7a5a11d 7032 hci_dev_test_flag(hcon->hdev, HCI_HS_ENABLED))
0bd49fc7 7033 conn->local_fixed_chan |= L2CAP_FC_A2MP;
162b49e7 7034
d7a5a11d 7035 if (hci_dev_test_flag(hcon->hdev, HCI_LE_ENABLED) &&
f9be9e86 7036 (bredr_sc_enabled(hcon->hdev) ||
b7cb93e5 7037 hci_dev_test_flag(hcon->hdev, HCI_FORCE_BREDR_SMP)))
b5ae344d
JH		 7038 conn->local_fixed_chan |= L2CAP_FC_SMP_BREDR;
7039
5a54e7c8 7040 mutex_init(&conn->ident_lock);
162b49e7
JH		 7041 mutex_init(&conn->chan_lock);
7042
7043 INIT_LIST_HEAD(&conn->chan_l);
7044 INIT_LIST_HEAD(&conn->users);
7045
276d8073 7046 INIT_DELAYED_WORK(&conn->info_timer, l2cap_info_timeout);
162b49e7 7047
61a939c6
JH		 7048 skb_queue_head_init(&conn->pending_rx);
7049 INIT_WORK(&conn->pending_rx_work, process_pending_rx);
f3d82d0c 7050 INIT_WORK(&conn->id_addr_update_work, l2cap_conn_update_id_addr);
61a939c6 7051
162b49e7
JH		 7052 conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
7053
7054 return conn;
7055}
7056
7057static bool is_valid_psm(u16 psm, u8 dst_type) {
7058 if (!psm)
7059 return false;
7060
7061 if (bdaddr_type_is_le(dst_type))
7062 return (psm <= 0x00ff);
7063
7064 /* PSM must be odd and lsb of upper byte must be 0 */
7065 return ((psm & 0x0101) == 0x0001);
7066}
7067
7068int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,
7069 bdaddr_t *dst, u8 dst_type)
7070{
7071 struct l2cap_conn *conn;
7072 struct hci_conn *hcon;
7073 struct hci_dev *hdev;
162b49e7
JH		 7074 int err;
7075
7076 BT_DBG("%pMR -> %pMR (type %u) psm 0x%2.2x", &chan->src, dst,
7077 dst_type, __le16_to_cpu(psm));
7078
39385cb5 7079 hdev = hci_get_route(dst, &chan->src, chan->src_type);
162b49e7
JH		 7080 if (!hdev)
7081 return -EHOSTUNREACH;
7082
7083 hci_dev_lock(hdev);
7084
162b49e7
JH		 7085 if (!is_valid_psm(__le16_to_cpu(psm), dst_type) && !cid &&
7086 chan->chan_type != L2CAP_CHAN_RAW) {
7087 err = -EINVAL;
7088 goto done;
7089 }
7090
21626e62
JH		 7091 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED && !psm) {
7092 err = -EINVAL;
7093 goto done;
7094 }
7095
7096 if (chan->chan_type == L2CAP_CHAN_FIXED && !cid) {
162b49e7
JH		 7097 err = -EINVAL;
7098 goto done;
7099 }
7100
7101 switch (chan->mode) {
7102 case L2CAP_MODE_BASIC:
7103 break;
7104 case L2CAP_MODE_LE_FLOWCTL:
7105 l2cap_le_flowctl_init(chan);
7106 break;
7107 case L2CAP_MODE_ERTM:
7108 case L2CAP_MODE_STREAMING:
7109 if (!disable_ertm)
7110 break;
7111 /* fall through */
7112 default:
beb19e4c 7113 err = -EOPNOTSUPP;
162b49e7
JH		 7114 goto done;
7115 }
7116
7117 switch (chan->state) {
7118 case BT_CONNECT:
7119 case BT_CONNECT2:
7120 case BT_CONFIG:
7121 /* Already connecting */
7122 err = 0;
7123 goto done;
7124
7125 case BT_CONNECTED:
7126 /* Already connected */
7127 err = -EISCONN;
7128 goto done;
7129
7130 case BT_OPEN:
7131 case BT_BOUND:
7132 /* Can connect */
7133 break;
7134
7135 default:
7136 err = -EBADFD;
7137 goto done;
7138 }
7139
7140 /* Set destination address and psm */
7141 bacpy(&chan->dst, dst);
7142 chan->dst_type = dst_type;
7143
7144 chan->psm = psm;
7145 chan->dcid = cid;
7146
6f77d8c7
AG		 7147 if (bdaddr_type_is_le(dst_type)) {
7148 /* Convert from L2CAP channel address type to HCI address type
7149 */
7150 if (dst_type == BDADDR_LE_PUBLIC)
7151 dst_type = ADDR_LE_DEV_PUBLIC;
7152 else
7153 dst_type = ADDR_LE_DEV_RANDOM;
7154
d7a5a11d 7155 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
0ad06aa6
JH		 7156 hcon = hci_connect_le(hdev, dst, dst_type,
7157 chan->sec_level,
7158 HCI_LE_CONN_TIMEOUT,
eb7e6434 7159 HCI_ROLE_SLAVE, NULL);
e804d25d 7160 else
0ad06aa6
JH		 7161 hcon = hci_connect_le_scan(hdev, dst, dst_type,
7162 chan->sec_level,
7163 HCI_LE_CONN_TIMEOUT);
cdd6275e 7164
6f77d8c7 7165 } else {
d93375a8 7166 u8 auth_type = l2cap_get_auth_type(chan);
04a6c589 7167 hcon = hci_connect_acl(hdev, dst, chan->sec_level, auth_type);
6f77d8c7 7168 }
162b49e7
JH		 7169
7170 if (IS_ERR(hcon)) {
7171 err = PTR_ERR(hcon);
7172 goto done;
7173 }
7174
7175 conn = l2cap_conn_add(hcon);
7176 if (!conn) {
7177 hci_conn_drop(hcon);
7178 err = -ENOMEM;
7179 goto done;
7180 }
7181
02e246ae
JH		 7182 mutex_lock(&conn->chan_lock);
7183 l2cap_chan_lock(chan);
7184
162b49e7
JH		 7185 if (cid && __l2cap_get_chan_by_dcid(conn, cid)) {
7186 hci_conn_drop(hcon);
7187 err = -EBUSY;
02e246ae 7188 goto chan_unlock;
162b49e7
JH		 7189 }
7190
7191 /* Update source addr of the socket */
7192 bacpy(&chan->src, &hcon->src);
a250e048 7193 chan->src_type = bdaddr_src_type(hcon);
162b49e7 7194
02e246ae 7195 __l2cap_chan_add(conn, chan);
162b49e7
JH		 7196
7197 /* l2cap_chan_add takes its own ref so we can drop this one */
7198 hci_conn_drop(hcon);
7199
7200 l2cap_state_change(chan, BT_CONNECT);
7201 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
7202
61202e4d
JH		 7203 /* Release chan->sport so that it can be reused by other
7204 * sockets (as it's only used for listening sockets).
7205 */
7206 write_lock(&chan_list_lock);
7207 chan->sport = 0;
7208 write_unlock(&chan_list_lock);
7209
162b49e7
JH		 7210 if (hcon->state == BT_CONNECTED) {
7211 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
7212 __clear_chan_timer(chan);
e7cafc45 7213 if (l2cap_chan_check_security(chan, true))
162b49e7
JH		 7214 l2cap_state_change(chan, BT_CONNECTED);
7215 } else
7216 l2cap_do_start(chan);
7217 }
7218
7219 err = 0;
7220
02e246ae 7221chan_unlock:
162b49e7 7222 l2cap_chan_unlock(chan);
02e246ae
JH		 7223 mutex_unlock(&conn->chan_lock);
7224done:
162b49e7
JH		 7225 hci_dev_unlock(hdev);
7226 hci_dev_put(hdev);
7227 return err;
7228}
6b8d4a6a 7229EXPORT_SYMBOL_GPL(l2cap_chan_connect);
162b49e7 7230
1da177e4
LT		 7231/* ---- L2CAP interface with lower layer (HCI) ---- */
7232
686ebf28 7233int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr)
1da177e4
LT		 7234{
7235 int exact = 0, lm1 = 0, lm2 = 0;
23691d75 7236 struct l2cap_chan *c;
1da177e4 7237
6ed93dc6 7238 BT_DBG("hdev %s, bdaddr %pMR", hdev->name, bdaddr);
1da177e4
LT		 7239
7240 /* Find listening sockets and check their link_mode */
23691d75
GP		 7241 read_lock(&chan_list_lock);
7242 list_for_each_entry(c, &chan_list, global_l) {
89bc500e 7243 if (c->state != BT_LISTEN)
1da177e4
LT		 7244 continue;
7245
7eafc59e 7246 if (!bacmp(&c->src, &hdev->bdaddr)) {
2af6b9d5 7247 lm1 |= HCI_LM_ACCEPT;
43bd0f32 7248 if (test_bit(FLAG_ROLE_SWITCH, &c->flags))
2af6b9d5 7249 lm1 |= HCI_LM_MASTER;
1da177e4 7250 exact++;
7eafc59e 7251 } else if (!bacmp(&c->src, BDADDR_ANY)) {
2af6b9d5 7252 lm2 |= HCI_LM_ACCEPT;
43bd0f32 7253 if (test_bit(FLAG_ROLE_SWITCH, &c->flags))
2af6b9d5
MH		 7254 lm2 |= HCI_LM_MASTER;
7255 }
1da177e4 7256 }
23691d75 7257 read_unlock(&chan_list_lock);
1da177e4
LT		 7258
7259 return exact ? lm1 : lm2;
7260}
7261
e760ec12
JH		 7262/* Find the next fixed channel in BT_LISTEN state, continue iteration
7263 * from an existing channel in the list or from the beginning of the
7264 * global list (by passing NULL as first parameter).
7265 */
7266static struct l2cap_chan *l2cap_global_fixed_chan(struct l2cap_chan *c,
327a7191 7267 struct hci_conn *hcon)
e760ec12 7268{
327a7191
JH		 7269 u8 src_type = bdaddr_src_type(hcon);
7270
e760ec12
JH		 7271 read_lock(&chan_list_lock);
7272
7273 if (c)
7274 c = list_next_entry(c, global_l);
7275 else
7276 c = list_entry(chan_list.next, typeof(*c), global_l);
7277
7278 list_for_each_entry_from(c, &chan_list, global_l) {
7279 if (c->chan_type != L2CAP_CHAN_FIXED)
7280 continue;
7281 if (c->state != BT_LISTEN)
7282 continue;
327a7191 7283 if (bacmp(&c->src, &hcon->src) && bacmp(&c->src, BDADDR_ANY))
54a1b626 7284 continue;
327a7191 7285 if (src_type != c->src_type)
54a1b626 7286 continue;
e760ec12
JH		 7287
7288 l2cap_chan_hold(c);
7289 read_unlock(&chan_list_lock);
7290 return c;
7291 }
7292
7293 read_unlock(&chan_list_lock);
7294
7295 return NULL;
7296}
7297
539c496d 7298static void l2cap_connect_cfm(struct hci_conn *hcon, u8 status)
1da177e4 7299{
e760ec12 7300 struct hci_dev *hdev = hcon->hdev;
0139418c 7301 struct l2cap_conn *conn;
e760ec12
JH		 7302 struct l2cap_chan *pchan;
7303 u8 dst_type;
0139418c 7304
539c496d
JH		 7305 if (hcon->type != ACL_LINK && hcon->type != LE_LINK)
7306 return;
7307
6ed93dc6 7308 BT_DBG("hcon %p bdaddr %pMR status %d", hcon, &hcon->dst, status);
1da177e4 7309
dc0f5088 7310 if (status) {
e175072f 7311 l2cap_conn_del(hcon, bt_to_errno(status));
dc0f5088 7312 return;
ba6fc317 7313 }
dc0f5088
JH		 7314
7315 conn = l2cap_conn_add(hcon);
7316 if (!conn)
7317 return;
7318
a250e048 7319 dst_type = bdaddr_dst_type(hcon);
e760ec12
JH		 7320
7321 /* If device is blocked, do not create channels for it */
7322 if (hci_bdaddr_list_lookup(&hdev->blacklist, &hcon->dst, dst_type))
7323 return;
7324
7325 /* Find fixed channels and notify them of the new connection. We
7326 * use multiple individual lookups, continuing each time where
7327 * we left off, because the list lock would prevent calling the
7328 * potentially sleeping l2cap_chan_lock() function.
7329 */
327a7191 7330 pchan = l2cap_global_fixed_chan(NULL, hcon);
e760ec12
JH		 7331 while (pchan) {
7332 struct l2cap_chan *chan, *next;
7333
7334 /* Client fixed channels should override server ones */
7335 if (__l2cap_get_chan_by_dcid(conn, pchan->scid))
7336 goto next;
7337
7338 l2cap_chan_lock(pchan);
7339 chan = pchan->ops->new_connection(pchan);
7340 if (chan) {
7341 bacpy(&chan->src, &hcon->src);
7342 bacpy(&chan->dst, &hcon->dst);
a250e048 7343 chan->src_type = bdaddr_src_type(hcon);
e760ec12
JH		 7344 chan->dst_type = dst_type;
7345
7346 __l2cap_chan_add(conn, chan);
7347 }
7348
7349 l2cap_chan_unlock(pchan);
7350next:
327a7191 7351 next = l2cap_global_fixed_chan(pchan, hcon);
e760ec12
JH		 7352 l2cap_chan_put(pchan);
7353 pchan = next;
7354 }
7355
dc0f5088 7356 l2cap_conn_ready(conn);
1da177e4
LT		 7357}
7358
686ebf28 7359int l2cap_disconn_ind(struct hci_conn *hcon)
2950f21a
MH		 7360{
7361 struct l2cap_conn *conn = hcon->l2cap_data;
7362
7363 BT_DBG("hcon %p", hcon);
7364
686ebf28 7365 if (!conn)
9f5a0d7b 7366 return HCI_ERROR_REMOTE_USER_TERM;
2950f21a
MH		 7367 return conn->disc_reason;
7368}
7369
3a6d576b 7370static void l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason)
1da177e4 7371{
3a6d576b
JH		 7372 if (hcon->type != ACL_LINK && hcon->type != LE_LINK)
7373 return;
7374
1da177e4
LT		 7375 BT_DBG("hcon %p reason %d", hcon, reason);
7376
e175072f 7377 l2cap_conn_del(hcon, bt_to_errno(reason));
1da177e4
LT		 7378}
7379
4343478f 7380static inline void l2cap_check_encryption(struct l2cap_chan *chan, u8 encrypt)
f62e4323 7381{
715ec005 7382 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED)
255c7601
MH		 7383 return;
7384
f62e4323 7385 if (encrypt == 0x00) {
4343478f 7386 if (chan->sec_level == BT_SECURITY_MEDIUM) {
ba13ccd9 7387 __set_chan_timer(chan, L2CAP_ENC_TIMEOUT);
7d513e92
MH		 7388 } else if (chan->sec_level == BT_SECURITY_HIGH ||
7389 chan->sec_level == BT_SECURITY_FIPS)
0f852724 7390 l2cap_chan_close(chan, ECONNREFUSED);
f62e4323 7391 } else {
4343478f 7392 if (chan->sec_level == BT_SECURITY_MEDIUM)
c9b66675 7393 __clear_chan_timer(chan);
f62e4323
MH		 7394 }
7395}
7396
354fe804 7397static void l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
1da177e4 7398{
0139418c 7399 struct l2cap_conn *conn = hcon->l2cap_data;
48454079 7400 struct l2cap_chan *chan;
1da177e4 7401
0139418c 7402 if (!conn)
354fe804 7403 return;
0139418c 7404
89d8b407 7405 BT_DBG("conn %p status 0x%2.2x encrypt %u", conn, status, encrypt);
1da177e4 7406
3df91ea2 7407 mutex_lock(&conn->chan_lock);
1da177e4 7408
3df91ea2 7409 list_for_each_entry(chan, &conn->chan_l, list) {
6be36555 7410 l2cap_chan_lock(chan);
1da177e4 7411
89d8b407
AE		 7412 BT_DBG("chan %p scid 0x%4.4x state %s", chan, chan->scid,
7413 state_to_string(chan->state));
f1cb9af5 7414
2338a7e0 7415 if (chan->scid == L2CAP_CID_A2MP) {
78eb2f98
AE		 7416 l2cap_chan_unlock(chan);
7417 continue;
7418 }
7419
191eb398
JH		 7420 if (!status && encrypt)
7421 chan->sec_level = hcon->sec_level;
f1cb9af5 7422
96eff46e 7423 if (!__l2cap_no_conn_pending(chan)) {
6be36555 7424 l2cap_chan_unlock(chan);
6a8d3010
MH		 7425 continue;
7426 }
7427
89bc500e 7428 if (!status && (chan->state == BT_CONNECTED ||
2d792818 7429 chan->state == BT_CONFIG)) {
d97c899b 7430 chan->ops->resume(chan);
4343478f 7431 l2cap_check_encryption(chan, encrypt);
6be36555 7432 l2cap_chan_unlock(chan);
9719f8af
MH		 7433 continue;
7434 }
7435
89bc500e 7436 if (chan->state == BT_CONNECT) {
6d3c15da 7437 if (!status)
93c3e8f5 7438 l2cap_start_connection(chan);
6d3c15da 7439 else
ba13ccd9 7440 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
fa37c1aa
JH		 7441 } else if (chan->state == BT_CONNECT2 &&
7442 chan->mode != L2CAP_MODE_LE_FLOWCTL) {
b1235d79 7443 struct l2cap_conn_rsp rsp;
df3c3931 7444 __u16 res, stat;
1da177e4 7445
b1235d79 7446 if (!status) {
bdc25783 7447 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
df3c3931
JH		 7448 res = L2CAP_CR_PEND;
7449 stat = L2CAP_CS_AUTHOR_PEND;
2dc4e510 7450 chan->ops->defer(chan);
df3c3931 7451 } else {
acdcabf5 7452 l2cap_state_change(chan, BT_CONFIG);
df3c3931
JH		 7453 res = L2CAP_CR_SUCCESS;
7454 stat = L2CAP_CS_NO_INFO;
7455 }
b1235d79 7456 } else {
acdcabf5 7457 l2cap_state_change(chan, BT_DISCONN);
ba13ccd9 7458 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
df3c3931
JH		 7459 res = L2CAP_CR_SEC_BLOCK;
7460 stat = L2CAP_CS_NO_INFO;
b1235d79
MH		 7461 }
7462
fe4128e0
GP		 7463 rsp.scid = cpu_to_le16(chan->dcid);
7464 rsp.dcid = cpu_to_le16(chan->scid);
df3c3931
JH		 7465 rsp.result = cpu_to_le16(res);
7466 rsp.status = cpu_to_le16(stat);
fc7f8a7e 7467 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
2d792818 7468 sizeof(rsp), &rsp);
2d369359
MM		 7469
7470 if (!test_bit(CONF_REQ_SENT, &chan->conf_state) &&
7471 res == L2CAP_CR_SUCCESS) {
7472 char buf[128];
7473 set_bit(CONF_REQ_SENT, &chan->conf_state);
7474 l2cap_send_cmd(conn, l2cap_get_ident(conn),
7475 L2CAP_CONF_REQ,
e860d2c9 7476 l2cap_build_conf_req(chan, buf, sizeof(buf)),
2d369359
MM		 7477 buf);
7478 chan->num_conf_req++;
7479 }
b1235d79 7480 }
1da177e4 7481
6be36555 7482 l2cap_chan_unlock(chan);
1da177e4
LT		 7483 }
7484
3df91ea2 7485 mutex_unlock(&conn->chan_lock);
1da177e4
LT		 7486}
7487
9b4c3336 7488void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
1da177e4
LT		 7489{
7490 struct l2cap_conn *conn = hcon->l2cap_data;
d73a0988
AE		 7491 struct l2cap_hdr *hdr;
7492 int len;
1da177e4 7493
1d13a254 7494 /* For AMP controller do not create l2cap conn */
ca8bee5d 7495 if (!conn && hcon->hdev->dev_type != HCI_PRIMARY)
1d13a254 7496 goto drop;
1da177e4 7497
5a08ecce 7498 if (!conn)
baf43251 7499 conn = l2cap_conn_add(hcon);
5a08ecce
AE		 7500
7501 if (!conn)
1da177e4
LT		 7502 goto drop;
7503
7504 BT_DBG("conn %p len %d flags 0x%x", conn, skb->len, flags);
7505
d73a0988
AE		 7506 switch (flags) {
7507 case ACL_START:
7508 case ACL_START_NO_FLUSH:
7509 case ACL_COMPLETE:
1da177e4
LT		 7510 if (conn->rx_len) {
7511 BT_ERR("Unexpected start frame (len %d)", skb->len);
7512 kfree_skb(conn->rx_skb);
7513 conn->rx_skb = NULL;
7514 conn->rx_len = 0;
7515 l2cap_conn_unreliable(conn, ECOMM);
7516 }
7517
aae7fe22
AE		 7518 /* Start fragment always begin with Basic L2CAP header */
7519 if (skb->len < L2CAP_HDR_SIZE) {
1da177e4
LT		 7520 BT_ERR("Frame is too short (len %d)", skb->len);
7521 l2cap_conn_unreliable(conn, ECOMM);
7522 goto drop;
7523 }
7524
7525 hdr = (struct l2cap_hdr *) skb->data;
7526 len = __le16_to_cpu(hdr->len) + L2CAP_HDR_SIZE;
7527
7528 if (len == skb->len) {
7529 /* Complete frame received */
7530 l2cap_recv_frame(conn, skb);
9b4c3336 7531 return;
1da177e4
LT		 7532 }
7533
7534 BT_DBG("Start: total len %d, frag len %d", len, skb->len);
7535
7536 if (skb->len > len) {
7537 BT_ERR("Frame is too long (len %d, expected len %d)",
2d792818 7538 skb->len, len);
1da177e4
LT		 7539 l2cap_conn_unreliable(conn, ECOMM);
7540 goto drop;
7541 }
7542
7543 /* Allocate skb for the complete frame (with header) */
8bcde1f2 7544 conn->rx_skb = bt_skb_alloc(len, GFP_KERNEL);
af05b30b 7545 if (!conn->rx_skb)
1da177e4
LT		 7546 goto drop;
7547
d626f62b 7548 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
2d792818 7549 skb->len);
1da177e4 7550 conn->rx_len = len - skb->len;
d73a0988
AE		 7551 break;
7552
7553 case ACL_CONT:
1da177e4
LT		 7554 BT_DBG("Cont: frag len %d (expecting %d)", skb->len, conn->rx_len);
7555
7556 if (!conn->rx_len) {
7557 BT_ERR("Unexpected continuation frame (len %d)", skb->len);
7558 l2cap_conn_unreliable(conn, ECOMM);
7559 goto drop;
7560 }
7561
7562 if (skb->len > conn->rx_len) {
7563 BT_ERR("Fragment is too long (len %d, expected %d)",
2d792818 7564 skb->len, conn->rx_len);
1da177e4
LT		 7565 kfree_skb(conn->rx_skb);
7566 conn->rx_skb = NULL;
7567 conn->rx_len = 0;
7568 l2cap_conn_unreliable(conn, ECOMM);
7569 goto drop;
7570 }
7571
d626f62b 7572 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
2d792818 7573 skb->len);
1da177e4
LT		 7574 conn->rx_len -= skb->len;
7575
7576 if (!conn->rx_len) {
c4e5bafa
JH		 7577 /* Complete frame received. l2cap_recv_frame
7578 * takes ownership of the skb so set the global
7579 * rx_skb pointer to NULL first.
7580 */
7581 struct sk_buff *rx_skb = conn->rx_skb;
1da177e4 7582 conn->rx_skb = NULL;
c4e5bafa 7583 l2cap_recv_frame(conn, rx_skb);
1da177e4 7584 }
d73a0988 7585 break;
1da177e4
LT		 7586 }
7587
7588drop:
7589 kfree_skb(skb);
1da177e4
LT		 7590}
7591
354fe804
JH		 7592static struct hci_cb l2cap_cb = {
7593 .name = "L2CAP",
539c496d 7594 .connect_cfm = l2cap_connect_cfm,
3a6d576b 7595 .disconn_cfm = l2cap_disconn_cfm,
354fe804
JH		 7596 .security_cfm = l2cap_security_cfm,
7597};
7598
aef7d97c 7599static int l2cap_debugfs_show(struct seq_file *f, void *p)
1da177e4 7600{
23691d75 7601 struct l2cap_chan *c;
1da177e4 7602
333055f2 7603 read_lock(&chan_list_lock);
1da177e4 7604
23691d75 7605 list_for_each_entry(c, &chan_list, global_l) {
eeb5a067
MH		 7606 seq_printf(f, "%pMR (%u) %pMR (%u) %d %d 0x%4.4x 0x%4.4x %d %d %d %d\n",
7607 &c->src, c->src_type, &c->dst, c->dst_type,
fcb73338
AE		 7608 c->state, __le16_to_cpu(c->psm),
7609 c->scid, c->dcid, c->imtu, c->omtu,
7610 c->sec_level, c->mode);
61e1b4b7 7611 }
1da177e4 7612
333055f2 7613 read_unlock(&chan_list_lock);
1da177e4 7614
aef7d97c 7615 return 0;
1da177e4
LT		 7616}
7617
aef7d97c
MH		 7618static int l2cap_debugfs_open(struct inode *inode, struct file *file)
7619{
7620 return single_open(file, l2cap_debugfs_show, inode->i_private);
7621}
7622
7623static const struct file_operations l2cap_debugfs_fops = {
7624 .open = l2cap_debugfs_open,
7625 .read = seq_read,
7626 .llseek = seq_lseek,
7627 .release = single_release,
7628};
7629
7630static struct dentry *l2cap_debugfs;
1da177e4 7631
64274518 7632int __init l2cap_init(void)
1da177e4
LT		 7633{
7634 int err;
be9d1227 7635
bb58f747 7636 err = l2cap_init_sockets();
1da177e4
LT		 7637 if (err < 0)
7638 return err;
7639
354fe804
JH		 7640 hci_register_cb(&l2cap_cb);
7641
1120e4bf
MH		 7642 if (IS_ERR_OR_NULL(bt_debugfs))
7643 return 0;
7644
7645 l2cap_debugfs = debugfs_create_file("l2cap", 0444, bt_debugfs,
7646 NULL, &l2cap_debugfs_fops);
1da177e4 7647
40b9397a 7648 debugfs_create_u16("l2cap_le_max_credits", 0644, bt_debugfs,
f15b8ecf 7649 &le_max_credits);
40b9397a 7650 debugfs_create_u16("l2cap_le_default_mps", 0644, bt_debugfs,
f15b8ecf
JH		 7651 &le_default_mps);
7652
1da177e4 7653 return 0;
1da177e4
LT		 7654}
7655
64274518 7656void l2cap_exit(void)
1da177e4 7657{
aef7d97c 7658 debugfs_remove(l2cap_debugfs);
354fe804 7659 hci_unregister_cb(&l2cap_cb);
bb58f747 7660 l2cap_cleanup_sockets();
1da177e4
LT		 7661}
7662
d1c4a17d
GP		 7663module_param(disable_ertm, bool, 0644);
7664MODULE_PARM_DESC(disable_ertm, "Disable enhanced retransmission mode");
ubuntu-bionic-kernel mirror