]> git.proxmox.com Git - mirror_ubuntu-jammy-kernel.git/blame - net/bluetooth/l2cap_core.c
projects / mirror_ubuntu-jammy-kernel.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Merge tag 'block-5.14-2021-08-07' of git://git.kernel.dk/linux-block
[mirror_ubuntu-jammy-kernel.git] / net / bluetooth / l2cap_core.c
CommitLineData
8e87d142 1/*
1da177e4
LT		 2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
ce5706bd 4 Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
5d8868ff 5 Copyright (C) 2010 Google Inc.
590051de 6 Copyright (C) 2011 ProFUSION Embedded Systems
422e925b 7 Copyright (c) 2012 Code Aurora Forum. All rights reserved.
1da177e4
LT		 8
9 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
10
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License version 2 as
13 published by the Free Software Foundation;
14
15 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
16 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
18 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 19 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
20 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
21 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 22 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
23
8e87d142
YH		 24 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
25 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 26 SOFTWARE IS DISCLAIMED.
27*/
28
bb58f747 29/* Bluetooth L2CAP core. */
1da177e4 30
1da177e4
LT		 31#include <linux/module.h>
32
aef7d97c 33#include <linux/debugfs.h>
fcc203c3 34#include <linux/crc16.h>
dbb50887 35#include <linux/filter.h>
1da177e4
LT		 36
37#include <net/bluetooth/bluetooth.h>
38#include <net/bluetooth/hci_core.h>
39#include <net/bluetooth/l2cap.h>
7ef9fbf0 40
ac4b7236 41#include "smp.h"
7024728e 42#include "a2mp.h"
7ef9fbf0 43#include "amp.h"
1da177e4 44
0f1bfe4e
JH		 45#define LE_FLOWCTL_MAX_CREDITS 65535
46
d1de6d46 47bool disable_ertm;
4be5ca67 48bool enable_ecred;
f0709e03 49
547d1032 50static u32 l2cap_feat_mask = L2CAP_FEAT_FIXED_CHAN | L2CAP_FEAT_UCD;
1da177e4 51
b5ad8b7f
JB		 52static LIST_HEAD(chan_list);
53static DEFINE_RWLOCK(chan_list_lock);
1da177e4 54
1da177e4 55static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
2d792818 56 u8 code, u8 ident, u16 dlen, void *data);
4519de9a 57static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
2d792818 58 void *data);
e860d2c9 59static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size);
5e4e3972 60static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err);
1da177e4 61
d660366d 62static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
2d792818 63 struct sk_buff_head *skbs, u8 event);
608bcc6d 64
a250e048 65static inline u8 bdaddr_type(u8 link_type, u8 bdaddr_type)
4f1654e0 66{
a250e048
JH		 67 if (link_type == LE_LINK) {
68 if (bdaddr_type == ADDR_LE_DEV_PUBLIC)
4f1654e0
MH		 69 return BDADDR_LE_PUBLIC;
70 else
71 return BDADDR_LE_RANDOM;
72 }
73
74 return BDADDR_BREDR;
75}
76
a250e048
JH		 77static inline u8 bdaddr_src_type(struct hci_conn *hcon)
78{
79 return bdaddr_type(hcon->type, hcon->src_type);
80}
81
82static inline u8 bdaddr_dst_type(struct hci_conn *hcon)
83{
84 return bdaddr_type(hcon->type, hcon->dst_type);
85}
86
0139418c 87/* ---- L2CAP channels ---- */
71ba0e56 88
2d792818
GP		 89static struct l2cap_chan *__l2cap_get_chan_by_dcid(struct l2cap_conn *conn,
90 u16 cid)
0139418c 91{
3df91ea2 92 struct l2cap_chan *c;
3d57dc68 93
3df91ea2
AE		 94 list_for_each_entry(c, &conn->chan_l, list) {
95 if (c->dcid == cid)
96 return c;
0139418c 97 }
3df91ea2 98 return NULL;
0139418c
MH		 99}
100
2d792818
GP		 101static struct l2cap_chan *__l2cap_get_chan_by_scid(struct l2cap_conn *conn,
102 u16 cid)
0139418c 103{
3df91ea2 104 struct l2cap_chan *c;
3d57dc68 105
3df91ea2
AE		 106 list_for_each_entry(c, &conn->chan_l, list) {
107 if (c->scid == cid)
108 return c;
0139418c 109 }
3df91ea2 110 return NULL;
0139418c
MH		 111}
112
113/* Find channel with given SCID.
ef191ade 114 * Returns locked channel. */
2d792818
GP		 115static struct l2cap_chan *l2cap_get_chan_by_scid(struct l2cap_conn *conn,
116 u16 cid)
0139418c 117{
48454079 118 struct l2cap_chan *c;
baa7e1fa 119
3df91ea2 120 mutex_lock(&conn->chan_lock);
baa7e1fa 121 c = __l2cap_get_chan_by_scid(conn, cid);
ef191ade
MM		 122 if (c)
123 l2cap_chan_lock(c);
3df91ea2
AE		 124 mutex_unlock(&conn->chan_lock);
125
48454079 126 return c;
0139418c
MH		 127}
128
b1a130b7
MM		 129/* Find channel with given DCID.
130 * Returns locked channel.
131 */
132static struct l2cap_chan *l2cap_get_chan_by_dcid(struct l2cap_conn *conn,
133 u16 cid)
134{
135 struct l2cap_chan *c;
136
137 mutex_lock(&conn->chan_lock);
138 c = __l2cap_get_chan_by_dcid(conn, cid);
139 if (c)
140 l2cap_chan_lock(c);
141 mutex_unlock(&conn->chan_lock);
142
143 return c;
144}
145
2d792818
GP		 146static struct l2cap_chan *__l2cap_get_chan_by_ident(struct l2cap_conn *conn,
147 u8 ident)
0139418c 148{
3df91ea2 149 struct l2cap_chan *c;
3d57dc68 150
3df91ea2
AE		 151 list_for_each_entry(c, &conn->chan_l, list) {
152 if (c->ident == ident)
153 return c;
0139418c 154 }
3df91ea2 155 return NULL;
0139418c
MH		 156}
157
5b155ef9
MM		 158static struct l2cap_chan *l2cap_get_chan_by_ident(struct l2cap_conn *conn,
159 u8 ident)
160{
161 struct l2cap_chan *c;
162
163 mutex_lock(&conn->chan_lock);
164 c = __l2cap_get_chan_by_ident(conn, ident);
165 if (c)
166 l2cap_chan_lock(c);
167 mutex_unlock(&conn->chan_lock);
168
169 return c;
170}
171
00f62726
LAD		 172static struct l2cap_chan *__l2cap_global_chan_by_addr(__le16 psm, bdaddr_t *src,
173 u8 src_type)
9e4425ff 174{
23691d75 175 struct l2cap_chan *c;
9e4425ff 176
23691d75 177 list_for_each_entry(c, &chan_list, global_l) {
00f62726
LAD		 178 if (src_type == BDADDR_BREDR && c->src_type != BDADDR_BREDR)
179 continue;
180
181 if (src_type != BDADDR_BREDR && c->src_type == BDADDR_BREDR)
182 continue;
183
7eafc59e 184 if (c->sport == psm && !bacmp(&c->src, src))
250938cb 185 return c;
9e4425ff 186 }
250938cb 187 return NULL;
9e4425ff
GP		 188}
189
190int l2cap_add_psm(struct l2cap_chan *chan, bdaddr_t *src, __le16 psm)
191{
73b2ec18
GP		 192 int err;
193
333055f2 194 write_lock(&chan_list_lock);
9e4425ff 195
00f62726 196 if (psm && __l2cap_global_chan_by_addr(psm, src, chan->src_type)) {
73b2ec18
GP		 197 err = -EADDRINUSE;
198 goto done;
9e4425ff
GP		 199 }
200
73b2ec18
GP		 201 if (psm) {
202 chan->psm = psm;
203 chan->sport = psm;
204 err = 0;
205 } else {
92594a51
JH		 206 u16 p, start, end, incr;
207
208 if (chan->src_type == BDADDR_BREDR) {
209 start = L2CAP_PSM_DYN_START;
210 end = L2CAP_PSM_AUTO_END;
211 incr = 2;
212 } else {
213 start = L2CAP_PSM_LE_DYN_START;
214 end = L2CAP_PSM_LE_DYN_END;
215 incr = 1;
216 }
73b2ec18
GP		 217
218 err = -EINVAL;
92594a51 219 for (p = start; p <= end; p += incr)
00f62726
LAD		 220 if (!__l2cap_global_chan_by_addr(cpu_to_le16(p), src,
221 chan->src_type)) {
73b2ec18
GP		 222 chan->psm = cpu_to_le16(p);
223 chan->sport = cpu_to_le16(p);
224 err = 0;
225 break;
226 }
227 }
9e4425ff 228
73b2ec18 229done:
333055f2 230 write_unlock(&chan_list_lock);
73b2ec18 231 return err;
9e4425ff 232}
6b8d4a6a 233EXPORT_SYMBOL_GPL(l2cap_add_psm);
9e4425ff
GP		 234
235int l2cap_add_scid(struct l2cap_chan *chan, __u16 scid)
236{
333055f2 237 write_lock(&chan_list_lock);
9e4425ff 238
14824308
JH		 239 /* Override the defaults (which are for conn-oriented) */
240 chan->omtu = L2CAP_DEFAULT_MTU;
241 chan->chan_type = L2CAP_CHAN_FIXED;
242
9e4425ff
GP		 243 chan->scid = scid;
244
333055f2 245 write_unlock(&chan_list_lock);
9e4425ff
GP		 246
247 return 0;
248}
249
baa7e1fa 250static u16 l2cap_alloc_cid(struct l2cap_conn *conn)
0139418c 251{
e77af755 252 u16 cid, dyn_end;
0139418c 253
e77af755
JH		 254 if (conn->hcon->type == LE_LINK)
255 dyn_end = L2CAP_CID_LE_DYN_END;
256 else
257 dyn_end = L2CAP_CID_DYN_END;
258
ab0c127f 259 for (cid = L2CAP_CID_DYN_START; cid <= dyn_end; cid++) {
baa7e1fa 260 if (!__l2cap_get_chan_by_scid(conn, cid))
0139418c
MH		 261 return cid;
262 }
263
264 return 0;
265}
266
f93fa273 267static void l2cap_state_change(struct l2cap_chan *chan, int state)
89bc500e 268{
42d2d87c 269 BT_DBG("chan %p %s -> %s", chan, state_to_string(chan->state),
2d792818 270 state_to_string(state));
badaaa00 271
89bc500e 272 chan->state = state;
53f52121 273 chan->ops->state_change(chan, state, 0);
89bc500e
GP		 274}
275
f8e73017
GP		 276static inline void l2cap_state_change_and_error(struct l2cap_chan *chan,
277 int state, int err)
2e0052e4 278{
f8e73017 279 chan->state = state;
53f52121 280 chan->ops->state_change(chan, chan->state, err);
2e0052e4
AE		 281}
282
283static inline void l2cap_chan_set_err(struct l2cap_chan *chan, int err)
284{
f8e73017 285 chan->ops->state_change(chan, chan->state, err);
2e0052e4
AE		 286}
287
4239d16f
MM		 288static void __set_retrans_timer(struct l2cap_chan *chan)
289{
290 if (!delayed_work_pending(&chan->monitor_timer) &&
291 chan->retrans_timeout) {
292 l2cap_set_timer(chan, &chan->retrans_timer,
293 msecs_to_jiffies(chan->retrans_timeout));
294 }
295}
296
297static void __set_monitor_timer(struct l2cap_chan *chan)
298{
299 __clear_retrans_timer(chan);
300 if (chan->monitor_timeout) {
301 l2cap_set_timer(chan, &chan->monitor_timer,
302 msecs_to_jiffies(chan->monitor_timeout));
303 }
304}
305
608bcc6d
MM		 306static struct sk_buff *l2cap_ertm_seq_in_queue(struct sk_buff_head *head,
307 u16 seq)
308{
309 struct sk_buff *skb;
310
311 skb_queue_walk(head, skb) {
a4368ff3 312 if (bt_cb(skb)->l2cap.txseq == seq)
608bcc6d
MM		 313 return skb;
314 }
315
316 return NULL;
317}
318
3c588192
MM		 319/* ---- L2CAP sequence number lists ---- */
320
321/* For ERTM, ordered lists of sequence numbers must be tracked for
322 * SREJ requests that are received and for frames that are to be
323 * retransmitted. These seq_list functions implement a singly-linked
324 * list in an array, where membership in the list can also be checked
325 * in constant time. Items can also be added to the tail of the list
326 * and removed from the head in constant time, without further memory
327 * allocs or frees.
328 */
329
330static int l2cap_seq_list_init(struct l2cap_seq_list *seq_list, u16 size)
331{
332 size_t alloc_size, i;
333
334 /* Allocated size is a power of 2 to map sequence numbers
335 * (which may be up to 14 bits) in to a smaller array that is
336 * sized for the negotiated ERTM transmit windows.
337 */
338 alloc_size = roundup_pow_of_two(size);
339
6da2ec56 340 seq_list->list = kmalloc_array(alloc_size, sizeof(u16), GFP_KERNEL);
3c588192
MM		 341 if (!seq_list->list)
342 return -ENOMEM;
343
344 seq_list->mask = alloc_size - 1;
345 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
346 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
347 for (i = 0; i < alloc_size; i++)
348 seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR;
349
350 return 0;
351}
352
353static inline void l2cap_seq_list_free(struct l2cap_seq_list *seq_list)
354{
355 kfree(seq_list->list);
356}
357
358static inline bool l2cap_seq_list_contains(struct l2cap_seq_list *seq_list,
359 u16 seq)
360{
361 /* Constant-time check for list membership */
362 return seq_list->list[seq & seq_list->mask] != L2CAP_SEQ_LIST_CLEAR;
363}
364
03a0c5d6 365static inline u16 l2cap_seq_list_pop(struct l2cap_seq_list *seq_list)
3c588192 366{
03a0c5d6 367 u16 seq = seq_list->head;
3c588192
MM		 368 u16 mask = seq_list->mask;
369
03a0c5d6
JH		 370 seq_list->head = seq_list->list[seq & mask];
371 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_CLEAR;
372
373 if (seq_list->head == L2CAP_SEQ_LIST_TAIL) {
374 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
375 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
3c588192 376 }
3c588192 377
03a0c5d6 378 return seq;
3c588192
MM		 379}
380
381static void l2cap_seq_list_clear(struct l2cap_seq_list *seq_list)
382{
f522ae36 383 u16 i;
3c588192 384
f522ae36
GP		 385 if (seq_list->head == L2CAP_SEQ_LIST_CLEAR)
386 return;
387
388 for (i = 0; i <= seq_list->mask; i++)
389 seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR;
390
391 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
392 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
3c588192
MM		 393}
394
395static void l2cap_seq_list_append(struct l2cap_seq_list *seq_list, u16 seq)
396{
397 u16 mask = seq_list->mask;
398
399 /* All appends happen in constant time */
400
f522ae36
GP		 401 if (seq_list->list[seq & mask] != L2CAP_SEQ_LIST_CLEAR)
402 return;
3c588192 403
f522ae36
GP		 404 if (seq_list->tail == L2CAP_SEQ_LIST_CLEAR)
405 seq_list->head = seq;
406 else
407 seq_list->list[seq_list->tail & mask] = seq;
408
409 seq_list->tail = seq;
410 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_TAIL;
3c588192
MM		 411}
412
721c4181 413static void l2cap_chan_timeout(struct work_struct *work)
ab07801d 414{
721c4181 415 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
2d792818 416 chan_timer.work);
3df91ea2 417 struct l2cap_conn *conn = chan->conn;
ab07801d
GP		 418 int reason;
419
e05dcc32 420 BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
ab07801d 421
3df91ea2 422 mutex_lock(&conn->chan_lock);
6c08fc89
MM		 423 /* __set_chan_timer() calls l2cap_chan_hold(chan) while scheduling
424 * this work. No need to call l2cap_chan_hold(chan) here again.
425 */
6be36555 426 l2cap_chan_lock(chan);
ab07801d 427
89bc500e 428 if (chan->state == BT_CONNECTED || chan->state == BT_CONFIG)
ab07801d 429 reason = ECONNREFUSED;
89bc500e 430 else if (chan->state == BT_CONNECT &&
2d792818 431 chan->sec_level != BT_SECURITY_SDP)
ab07801d
GP		 432 reason = ECONNREFUSED;
433 else
434 reason = ETIMEDOUT;
435
0f852724 436 l2cap_chan_close(chan, reason);
ab07801d 437
80b98027 438 chan->ops->close(chan);
3df91ea2 439
6c08fc89 440 l2cap_chan_unlock(chan);
371fd835 441 l2cap_chan_put(chan);
6c08fc89
MM		 442
443 mutex_unlock(&conn->chan_lock);
ab07801d
GP		 444}
445
eef1d9b6 446struct l2cap_chan *l2cap_chan_create(void)
48454079
GP		 447{
448 struct l2cap_chan *chan;
449
450 chan = kzalloc(sizeof(*chan), GFP_ATOMIC);
451 if (!chan)
452 return NULL;
453
be859723
TH		 454 skb_queue_head_init(&chan->tx_q);
455 skb_queue_head_init(&chan->srej_q);
c03b355e
AE		 456 mutex_init(&chan->lock);
457
ff714119
JH		 458 /* Set default lock nesting level */
459 atomic_set(&chan->nesting, L2CAP_NESTING_NORMAL);
460
333055f2 461 write_lock(&chan_list_lock);
23691d75 462 list_add(&chan->global_l, &chan_list);
333055f2 463 write_unlock(&chan_list_lock);
23691d75 464
721c4181 465 INIT_DELAYED_WORK(&chan->chan_timer, l2cap_chan_timeout);
ab07801d 466
89bc500e
GP		 467 chan->state = BT_OPEN;
468
144ad330 469 kref_init(&chan->kref);
71ba0e56 470
2827011f
MM		 471 /* This flag is cleared in l2cap_chan_ready() */
472 set_bit(CONF_NOT_COMPLETE, &chan->conf_state);
473
eef1d9b6 474 BT_DBG("chan %p", chan);
abc545b8 475
48454079
GP		 476 return chan;
477}
6b8d4a6a 478EXPORT_SYMBOL_GPL(l2cap_chan_create);
48454079 479
144ad330 480static void l2cap_chan_destroy(struct kref *kref)
6ff5abbf 481{
144ad330
SS		 482 struct l2cap_chan *chan = container_of(kref, struct l2cap_chan, kref);
483
4af66c69
JK		 484 BT_DBG("chan %p", chan);
485
333055f2 486 write_lock(&chan_list_lock);
23691d75 487 list_del(&chan->global_l);
333055f2 488 write_unlock(&chan_list_lock);
23691d75 489
4af66c69 490 kfree(chan);
6ff5abbf
GP		 491}
492
30648372
JK		 493void l2cap_chan_hold(struct l2cap_chan *c)
494{
93917fd2 495 BT_DBG("chan %p orig refcnt %u", c, kref_read(&c->kref));
30648372 496
144ad330 497 kref_get(&c->kref);
30648372
JK		 498}
499
500void l2cap_chan_put(struct l2cap_chan *c)
501{
93917fd2 502 BT_DBG("chan %p orig refcnt %u", c, kref_read(&c->kref));
30648372 503
144ad330 504 kref_put(&c->kref, l2cap_chan_destroy);
30648372 505}
6b8d4a6a 506EXPORT_SYMBOL_GPL(l2cap_chan_put);
30648372 507
bd4b1653
AE		 508void l2cap_chan_set_defaults(struct l2cap_chan *chan)
509{
510 chan->fcs = L2CAP_FCS_CRC16;
511 chan->max_tx = L2CAP_DEFAULT_MAX_TX;
512 chan->tx_win = L2CAP_DEFAULT_TX_WINDOW;
513 chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
6a5e8165
JR		 514 chan->remote_max_tx = chan->max_tx;
515 chan->remote_tx_win = chan->tx_win;
c20f8e35 516 chan->ack_win = L2CAP_DEFAULT_TX_WINDOW;
bd4b1653 517 chan->sec_level = BT_SECURITY_LOW;
6a5e8165
JR		 518 chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
519 chan->retrans_timeout = L2CAP_DEFAULT_RETRANS_TO;
520 chan->monitor_timeout = L2CAP_DEFAULT_MONITOR_TO;
3a9d54b1 521
6a5e8165 522 chan->conf_state = 0;
3a9d54b1 523 set_bit(CONF_NOT_COMPLETE, &chan->conf_state);
bd4b1653
AE		 524
525 set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
526}
6b8d4a6a 527EXPORT_SYMBOL_GPL(l2cap_chan_set_defaults);
bd4b1653 528
ba8f5289 529static void l2cap_le_flowctl_init(struct l2cap_chan *chan, u16 tx_credits)
38319713 530{
0ce43ce6
JH		 531 chan->sdu = NULL;
532 chan->sdu_last_frag = NULL;
533 chan->sdu_len = 0;
ba8f5289 534 chan->tx_credits = tx_credits;
fe149310
LAD		 535 /* Derive MPS from connection MTU to stop HCI fragmentation */
536 chan->mps = min_t(u16, chan->imtu, chan->conn->mtu - L2CAP_HDR_SIZE);
96cd8eaa
LAD		 537 /* Give enough credits for a full packet */
538 chan->rx_credits = (chan->imtu / chan->mps) + 1;
0ce43ce6
JH		 539
540 skb_queue_head_init(&chan->tx_q);
38319713
JH		 541}
542
15f02b91
LAD		 543static void l2cap_ecred_init(struct l2cap_chan *chan, u16 tx_credits)
544{
545 l2cap_le_flowctl_init(chan, tx_credits);
546
547 /* L2CAP implementations shall support a minimum MPS of 64 octets */
548 if (chan->mps < L2CAP_ECRED_MIN_MPS) {
549 chan->mps = L2CAP_ECRED_MIN_MPS;
550 chan->rx_credits = (chan->imtu / chan->mps) + 1;
551 }
552}
553
93c3e8f5 554void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
0139418c 555{
af05b30b 556 BT_DBG("conn %p, psm 0x%2.2x, dcid 0x%4.4x", conn,
097db76c 557 __le16_to_cpu(chan->psm), chan->dcid);
0139418c 558
9f5a0d7b 559 conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
2950f21a 560
8c1d787b 561 chan->conn = conn;
0139418c 562
5491120e
AE		 563 switch (chan->chan_type) {
564 case L2CAP_CHAN_CONN_ORIENTED:
21626e62
JH		 565 /* Alloc CID for connection-oriented socket */
566 chan->scid = l2cap_alloc_cid(conn);
567 if (conn->hcon->type == ACL_LINK)
0c1bc5c6 568 chan->omtu = L2CAP_DEFAULT_MTU;
5491120e
AE		 569 break;
570
571 case L2CAP_CHAN_CONN_LESS:
0139418c 572 /* Connectionless socket */
fe4128e0
GP		 573 chan->scid = L2CAP_CID_CONN_LESS;
574 chan->dcid = L2CAP_CID_CONN_LESS;
0c1bc5c6 575 chan->omtu = L2CAP_DEFAULT_MTU;
5491120e
AE		 576 break;
577
2338a7e0
JH		 578 case L2CAP_CHAN_FIXED:
579 /* Caller will set CID and CID specific MTU values */
416fa752
AE		 580 break;
581
5491120e 582 default:
0139418c 583 /* Raw socket can send/recv signalling messages only */
fe4128e0
GP		 584 chan->scid = L2CAP_CID_SIGNALING;
585 chan->dcid = L2CAP_CID_SIGNALING;
0c1bc5c6 586 chan->omtu = L2CAP_DEFAULT_MTU;
0139418c
MH		 587 }
588
8f7975b1
AE		 589 chan->local_id = L2CAP_BESTEFFORT_ID;
590 chan->local_stype = L2CAP_SERV_BESTEFFORT;
591 chan->local_msdu = L2CAP_DEFAULT_MAX_SDU_SIZE;
592 chan->local_sdu_itime = L2CAP_DEFAULT_SDU_ITIME;
593 chan->local_acc_lat = L2CAP_DEFAULT_ACC_LAT;
8936fa6d 594 chan->local_flush_to = L2CAP_EFS_DEFAULT_FLUSH_TO;
8f7975b1 595
371fd835 596 l2cap_chan_hold(chan);
baa7e1fa 597
c16900cf
JH		 598 /* Only keep a reference for fixed channels if they requested it */
599 if (chan->chan_type != L2CAP_CHAN_FIXED ||
600 test_bit(FLAG_HOLD_HCI_CONN, &chan->flags))
601 hci_conn_hold(conn->hcon);
5ee9891d 602
3df91ea2 603 list_add(&chan->list, &conn->chan_l);
643162a8
AE		 604}
605
466f8004 606void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
643162a8
AE		 607{
608 mutex_lock(&conn->chan_lock);
609 __l2cap_chan_add(conn, chan);
3df91ea2 610 mutex_unlock(&conn->chan_lock);
0139418c
MH		 611}
612
466f8004 613void l2cap_chan_del(struct l2cap_chan *chan, int err)
0139418c 614{
8c1d787b 615 struct l2cap_conn *conn = chan->conn;
0139418c 616
c9b66675 617 __clear_chan_timer(chan);
0139418c 618
49d11741
JH		 619 BT_DBG("chan %p, conn %p, err %d, state %s", chan, conn, err,
620 state_to_string(chan->state));
0139418c 621
72847ce0
JH		 622 chan->ops->teardown(chan, err);
623
8e87d142 624 if (conn) {
56f60984 625 struct amp_mgr *mgr = conn->hcon->amp_mgr;
baa7e1fa 626 /* Delete from channel list */
3df91ea2 627 list_del(&chan->list);
3d57dc68 628
371fd835 629 l2cap_chan_put(chan);
baa7e1fa 630
8c1d787b 631 chan->conn = NULL;
3cabbfda 632
c16900cf
JH		 633 /* Reference was only held for non-fixed channels or
634 * fixed channels that explicitly requested it using the
635 * FLAG_HOLD_HCI_CONN flag.
636 */
637 if (chan->chan_type != L2CAP_CHAN_FIXED ||
638 test_bit(FLAG_HOLD_HCI_CONN, &chan->flags))
76a68ba0 639 hci_conn_drop(conn->hcon);
56f60984
AE		 640
641 if (mgr && mgr->bredr_chan == chan)
642 mgr->bredr_chan = NULL;
0139418c
MH		 643 }
644
419e08c1
AE		 645 if (chan->hs_hchan) {
646 struct hci_chan *hs_hchan = chan->hs_hchan;
647
648 BT_DBG("chan %p disconnect hs_hchan %p", chan, hs_hchan);
649 amp_disconnect_logical_link(hs_hchan);
650 }
651
2827011f 652 if (test_bit(CONF_NOT_COMPLETE, &chan->conf_state))
6ff5abbf 653 return;
2ead70b8 654
149b3f13 655 switch (chan->mode) {
ee556f66
GP		 656 case L2CAP_MODE_BASIC:
657 break;
c13ffa62 658
38319713 659 case L2CAP_MODE_LE_FLOWCTL:
15f02b91 660 case L2CAP_MODE_EXT_FLOWCTL:
177f8f2b 661 skb_queue_purge(&chan->tx_q);
38319713
JH		 662 break;
663
ee556f66 664 case L2CAP_MODE_ERTM:
1a09bcb9
GP		 665 __clear_retrans_timer(chan);
666 __clear_monitor_timer(chan);
667 __clear_ack_timer(chan);
c13ffa62 668
f1c6775b 669 skb_queue_purge(&chan->srej_q);
c13ffa62 670
3c588192
MM		 671 l2cap_seq_list_free(&chan->srej_list);
672 l2cap_seq_list_free(&chan->retrans_list);
19186c7b 673 fallthrough;
ee556f66
GP		 674
675 case L2CAP_MODE_STREAMING:
676 skb_queue_purge(&chan->tx_q);
677 break;
c13ffa62 678 }
0139418c 679}
6b8d4a6a 680EXPORT_SYMBOL_GPL(l2cap_chan_del);
0139418c 681
da49b602
LAD		 682static void __l2cap_chan_list(struct l2cap_conn *conn, l2cap_chan_func_t func,
683 void *data)
684{
685 struct l2cap_chan *chan;
686
687 list_for_each_entry(chan, &conn->chan_l, list) {
688 func(chan, data);
689 }
690}
691
692void l2cap_chan_list(struct l2cap_conn *conn, l2cap_chan_func_t func,
693 void *data)
694{
695 if (!conn)
696 return;
697
698 mutex_lock(&conn->chan_lock);
699 __l2cap_chan_list(conn, func, data);
700 mutex_unlock(&conn->chan_lock);
701}
702
703EXPORT_SYMBOL_GPL(l2cap_chan_list);
704
f3d82d0c 705static void l2cap_conn_update_id_addr(struct work_struct *work)
387a33e3 706{
f3d82d0c
JH		 707 struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
708 id_addr_update_work);
709 struct hci_conn *hcon = conn->hcon;
387a33e3
JH		 710 struct l2cap_chan *chan;
711
712 mutex_lock(&conn->chan_lock);
713
714 list_for_each_entry(chan, &conn->chan_l, list) {
715 l2cap_chan_lock(chan);
716 bacpy(&chan->dst, &hcon->dst);
a250e048 717 chan->dst_type = bdaddr_dst_type(hcon);
387a33e3
JH		 718 l2cap_chan_unlock(chan);
719 }
720
721 mutex_unlock(&conn->chan_lock);
722}
723
27e2d4c8
JH		 724static void l2cap_chan_le_connect_reject(struct l2cap_chan *chan)
725{
726 struct l2cap_conn *conn = chan->conn;
727 struct l2cap_le_conn_rsp rsp;
728 u16 result;
729
730 if (test_bit(FLAG_DEFER_SETUP, &chan->flags))
571f7390 731 result = L2CAP_CR_LE_AUTHORIZATION;
27e2d4c8 732 else
571f7390 733 result = L2CAP_CR_LE_BAD_PSM;
27e2d4c8
JH		 734
735 l2cap_state_change(chan, BT_DISCONN);
736
737 rsp.dcid = cpu_to_le16(chan->scid);
738 rsp.mtu = cpu_to_le16(chan->imtu);
3916aed8 739 rsp.mps = cpu_to_le16(chan->mps);
0cd75f7e 740 rsp.credits = cpu_to_le16(chan->rx_credits);
27e2d4c8
JH		 741 rsp.result = cpu_to_le16(result);
742
743 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp),
744 &rsp);
745}
746
15f02b91
LAD		 747static void l2cap_chan_ecred_connect_reject(struct l2cap_chan *chan)
748{
749 struct l2cap_conn *conn = chan->conn;
750 struct l2cap_ecred_conn_rsp rsp;
751 u16 result;
752
753 if (test_bit(FLAG_DEFER_SETUP, &chan->flags))
754 result = L2CAP_CR_LE_AUTHORIZATION;
755 else
756 result = L2CAP_CR_LE_BAD_PSM;
757
758 l2cap_state_change(chan, BT_DISCONN);
759
760 memset(&rsp, 0, sizeof(rsp));
761
762 rsp.result = cpu_to_le16(result);
763
764 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp),
765 &rsp);
766}
767
791d60f7
JH		 768static void l2cap_chan_connect_reject(struct l2cap_chan *chan)
769{
770 struct l2cap_conn *conn = chan->conn;
771 struct l2cap_conn_rsp rsp;
772 u16 result;
773
774 if (test_bit(FLAG_DEFER_SETUP, &chan->flags))
775 result = L2CAP_CR_SEC_BLOCK;
776 else
777 result = L2CAP_CR_BAD_PSM;
778
779 l2cap_state_change(chan, BT_DISCONN);
780
781 rsp.scid = cpu_to_le16(chan->dcid);
782 rsp.dcid = cpu_to_le16(chan->scid);
783 rsp.result = cpu_to_le16(result);
dcf4adbf 784 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
791d60f7
JH		 785
786 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP, sizeof(rsp), &rsp);
787}
788
0f852724 789void l2cap_chan_close(struct l2cap_chan *chan, int reason)
4519de9a
GP		 790{
791 struct l2cap_conn *conn = chan->conn;
4519de9a 792
7eafc59e 793 BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
4519de9a 794
89bc500e 795 switch (chan->state) {
4519de9a 796 case BT_LISTEN:
b699ec0d 797 chan->ops->teardown(chan, 0);
4519de9a
GP		 798 break;
799
800 case BT_CONNECTED:
801 case BT_CONFIG:
7b25c9b3 802 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED) {
8d836d71 803 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
5e4e3972 804 l2cap_send_disconn_req(chan, reason);
4519de9a
GP		 805 } else
806 l2cap_chan_del(chan, reason);
807 break;
808
809 case BT_CONNECT2:
791d60f7
JH		 810 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED) {
811 if (conn->hcon->type == ACL_LINK)
812 l2cap_chan_connect_reject(chan);
15f02b91
LAD		 813 else if (conn->hcon->type == LE_LINK) {
814 switch (chan->mode) {
815 case L2CAP_MODE_LE_FLOWCTL:
816 l2cap_chan_le_connect_reject(chan);
817 break;
818 case L2CAP_MODE_EXT_FLOWCTL:
819 l2cap_chan_ecred_connect_reject(chan);
820 break;
821 }
822 }
4519de9a
GP		 823 }
824
825 l2cap_chan_del(chan, reason);
826 break;
827
828 case BT_CONNECT:
829 case BT_DISCONN:
830 l2cap_chan_del(chan, reason);
831 break;
832
833 default:
b699ec0d 834 chan->ops->teardown(chan, 0);
4519de9a
GP		 835 break;
836 }
837}
6b8d4a6a 838EXPORT_SYMBOL(l2cap_chan_close);
4519de9a 839
4343478f 840static inline u8 l2cap_get_auth_type(struct l2cap_chan *chan)
79d554a6 841{
6a974b50
MH		 842 switch (chan->chan_type) {
843 case L2CAP_CHAN_RAW:
4343478f 844 switch (chan->sec_level) {
8556edd3 845 case BT_SECURITY_HIGH:
7d513e92 846 case BT_SECURITY_FIPS:
8556edd3
JH		 847 return HCI_AT_DEDICATED_BONDING_MITM;
848 case BT_SECURITY_MEDIUM:
849 return HCI_AT_DEDICATED_BONDING;
850 default:
851 return HCI_AT_NO_BONDING;
852 }
6a974b50 853 break;
3124b843 854 case L2CAP_CHAN_CONN_LESS:
dcf4adbf 855 if (chan->psm == cpu_to_le16(L2CAP_PSM_3DSP)) {
3124b843
MH		 856 if (chan->sec_level == BT_SECURITY_LOW)
857 chan->sec_level = BT_SECURITY_SDP;
858 }
7d513e92
MH		 859 if (chan->sec_level == BT_SECURITY_HIGH ||
860 chan->sec_level == BT_SECURITY_FIPS)
3124b843
MH		 861 return HCI_AT_NO_BONDING_MITM;
862 else
863 return HCI_AT_NO_BONDING;
864 break;
6a974b50 865 case L2CAP_CHAN_CONN_ORIENTED:
dcf4adbf 866 if (chan->psm == cpu_to_le16(L2CAP_PSM_SDP)) {
6a974b50
MH		 867 if (chan->sec_level == BT_SECURITY_LOW)
868 chan->sec_level = BT_SECURITY_SDP;
0684e5f9 869
7d513e92
MH		 870 if (chan->sec_level == BT_SECURITY_HIGH ||
871 chan->sec_level == BT_SECURITY_FIPS)
6a974b50
MH		 872 return HCI_AT_NO_BONDING_MITM;
873 else
874 return HCI_AT_NO_BONDING;
875 }
19186c7b
GS		 876 fallthrough;
877
6a974b50 878 default:
4343478f 879 switch (chan->sec_level) {
00ae4af9 880 case BT_SECURITY_HIGH:
7d513e92 881 case BT_SECURITY_FIPS:
8556edd3 882 return HCI_AT_GENERAL_BONDING_MITM;
00ae4af9 883 case BT_SECURITY_MEDIUM:
8556edd3 884 return HCI_AT_GENERAL_BONDING;
00ae4af9 885 default:
8556edd3 886 return HCI_AT_NO_BONDING;
00ae4af9 887 }
6a974b50 888 break;
0684e5f9 889 }
8556edd3
JH		 890}
891
892/* Service level security */
e7cafc45 893int l2cap_chan_check_security(struct l2cap_chan *chan, bool initiator)
8556edd3 894{
8c1d787b 895 struct l2cap_conn *conn = chan->conn;
8556edd3
JH		 896 __u8 auth_type;
897
a17de2fe
JH		 898 if (conn->hcon->type == LE_LINK)
899 return smp_conn_security(conn->hcon, chan->sec_level);
900
4343478f 901 auth_type = l2cap_get_auth_type(chan);
79d554a6 902
e7cafc45
JH		 903 return hci_conn_security(conn->hcon, chan->sec_level, auth_type,
904 initiator);
79d554a6
MH		 905}
906
b5ad8b7f 907static u8 l2cap_get_ident(struct l2cap_conn *conn)
4e8402a3
MH		 908{
909 u8 id;
910
911 /* Get next available identificator.
912 * 1 - 128 are used by kernel.
913 * 129 - 199 are reserved.
914 * 200 - 254 are used by utilities like l2ping, etc.
915 */
916
5a54e7c8 917 mutex_lock(&conn->ident_lock);
4e8402a3
MH		 918
919 if (++conn->tx_ident > 128)
920 conn->tx_ident = 1;
921
922 id = conn->tx_ident;
923
5a54e7c8 924 mutex_unlock(&conn->ident_lock);
4e8402a3
MH		 925
926 return id;
927}
928
2d792818
GP		 929static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
930 void *data)
4e8402a3
MH		 931{
932 struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data);
e702112f 933 u8 flags;
4e8402a3
MH		 934
935 BT_DBG("code 0x%2.2x", code);
936
937 if (!skb)
9a9c6a34 938 return;
4e8402a3 939
f6af675e
SW		 940 /* Use NO_FLUSH if supported or we have an LE link (which does
941 * not support auto-flushing packets) */
942 if (lmp_no_flush_capable(conn->hcon->hdev) ||
943 conn->hcon->type == LE_LINK)
e702112f
AE		 944 flags = ACL_START_NO_FLUSH;
945 else
946 flags = ACL_START;
947
14b12d0b 948 bt_cb(skb)->force_active = BT_POWER_FORCE_ACTIVE_ON;
5e59b791 949 skb->priority = HCI_PRIO_MAX;
14b12d0b 950
73d80deb
LAD		 951 hci_send_acl(conn->hchan, skb, flags);
952}
953
02b0fbb9
MM		 954static bool __chan_is_moving(struct l2cap_chan *chan)
955{
956 return chan->move_state != L2CAP_MOVE_STABLE &&
957 chan->move_state != L2CAP_MOVE_WAIT_PREPARE;
958}
959
73d80deb
LAD		 960static void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb)
961{
962 struct hci_conn *hcon = chan->conn->hcon;
963 u16 flags;
964
965 BT_DBG("chan %p, skb %p len %d priority %u", chan, skb, skb->len,
2d792818 966 skb->priority);
73d80deb 967
d5f8a75d
MM		 968 if (chan->hs_hcon && !__chan_is_moving(chan)) {
969 if (chan->hs_hchan)
970 hci_send_acl(chan->hs_hchan, skb, ACL_COMPLETE);
971 else
972 kfree_skb(skb);
973
974 return;
975 }
976
f6af675e
SW		 977 /* Use NO_FLUSH for LE links (where this is the only option) or
978 * if the BR/EDR link supports it and flushing has not been
979 * explicitly requested (through FLAG_FLUSHABLE).
980 */
981 if (hcon->type == LE_LINK ||
982 (!test_bit(FLAG_FLUSHABLE, &chan->flags) &&
983 lmp_no_flush_capable(hcon->hdev)))
73d80deb
LAD		 984 flags = ACL_START_NO_FLUSH;
985 else
986 flags = ACL_START;
14b12d0b 987
73d80deb
LAD		 988 bt_cb(skb)->force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
989 hci_send_acl(chan->conn->hchan, skb, flags);
4e8402a3
MH		 990}
991
b76bbd66
MM		 992static void __unpack_enhanced_control(u16 enh, struct l2cap_ctrl *control)
993{
994 control->reqseq = (enh & L2CAP_CTRL_REQSEQ) >> L2CAP_CTRL_REQSEQ_SHIFT;
995 control->final = (enh & L2CAP_CTRL_FINAL) >> L2CAP_CTRL_FINAL_SHIFT;
996
997 if (enh & L2CAP_CTRL_FRAME_TYPE) {
998 /* S-Frame */
999 control->sframe = 1;
1000 control->poll = (enh & L2CAP_CTRL_POLL) >> L2CAP_CTRL_POLL_SHIFT;
1001 control->super = (enh & L2CAP_CTRL_SUPERVISE) >> L2CAP_CTRL_SUPER_SHIFT;
1002
1003 control->sar = 0;
1004 control->txseq = 0;
1005 } else {
1006 /* I-Frame */
1007 control->sframe = 0;
1008 control->sar = (enh & L2CAP_CTRL_SAR) >> L2CAP_CTRL_SAR_SHIFT;
1009 control->txseq = (enh & L2CAP_CTRL_TXSEQ) >> L2CAP_CTRL_TXSEQ_SHIFT;
1010
1011 control->poll = 0;
1012 control->super = 0;
1013 }
1014}
1015
b76bbd66
MM		 1016static void __unpack_extended_control(u32 ext, struct l2cap_ctrl *control)
1017{
1018 control->reqseq = (ext & L2CAP_EXT_CTRL_REQSEQ) >> L2CAP_EXT_CTRL_REQSEQ_SHIFT;
1019 control->final = (ext & L2CAP_EXT_CTRL_FINAL) >> L2CAP_EXT_CTRL_FINAL_SHIFT;
1020
1021 if (ext & L2CAP_EXT_CTRL_FRAME_TYPE) {
1022 /* S-Frame */
1023 control->sframe = 1;
1024 control->poll = (ext & L2CAP_EXT_CTRL_POLL) >> L2CAP_EXT_CTRL_POLL_SHIFT;
1025 control->super = (ext & L2CAP_EXT_CTRL_SUPERVISE) >> L2CAP_EXT_CTRL_SUPER_SHIFT;
1026
1027 control->sar = 0;
1028 control->txseq = 0;
1029 } else {
1030 /* I-Frame */
1031 control->sframe = 0;
1032 control->sar = (ext & L2CAP_EXT_CTRL_SAR) >> L2CAP_EXT_CTRL_SAR_SHIFT;
1033 control->txseq = (ext & L2CAP_EXT_CTRL_TXSEQ) >> L2CAP_EXT_CTRL_TXSEQ_SHIFT;
1034
1035 control->poll = 0;
1036 control->super = 0;
1037 }
1038}
1039
1040static inline void __unpack_control(struct l2cap_chan *chan,
1041 struct sk_buff *skb)
1042{
1043 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
1044 __unpack_extended_control(get_unaligned_le32(skb->data),
a4368ff3 1045 &bt_cb(skb)->l2cap);
cec8ab6e 1046 skb_pull(skb, L2CAP_EXT_CTRL_SIZE);
b76bbd66
MM		 1047 } else {
1048 __unpack_enhanced_control(get_unaligned_le16(skb->data),
a4368ff3 1049 &bt_cb(skb)->l2cap);
cec8ab6e 1050 skb_pull(skb, L2CAP_ENH_CTRL_SIZE);
b76bbd66
MM		 1051 }
1052}
1053
b5c6aaed
MM		 1054static u32 __pack_extended_control(struct l2cap_ctrl *control)
1055{
1056 u32 packed;
1057
1058 packed = control->reqseq << L2CAP_EXT_CTRL_REQSEQ_SHIFT;
1059 packed |= control->final << L2CAP_EXT_CTRL_FINAL_SHIFT;
1060
1061 if (control->sframe) {
1062 packed |= control->poll << L2CAP_EXT_CTRL_POLL_SHIFT;
1063 packed |= control->super << L2CAP_EXT_CTRL_SUPER_SHIFT;
1064 packed |= L2CAP_EXT_CTRL_FRAME_TYPE;
1065 } else {
1066 packed |= control->sar << L2CAP_EXT_CTRL_SAR_SHIFT;
1067 packed |= control->txseq << L2CAP_EXT_CTRL_TXSEQ_SHIFT;
1068 }
1069
1070 return packed;
1071}
1072
1073static u16 __pack_enhanced_control(struct l2cap_ctrl *control)
1074{
1075 u16 packed;
1076
1077 packed = control->reqseq << L2CAP_CTRL_REQSEQ_SHIFT;
1078 packed |= control->final << L2CAP_CTRL_FINAL_SHIFT;
1079
1080 if (control->sframe) {
1081 packed |= control->poll << L2CAP_CTRL_POLL_SHIFT;
1082 packed |= control->super << L2CAP_CTRL_SUPER_SHIFT;
1083 packed |= L2CAP_CTRL_FRAME_TYPE;
1084 } else {
1085 packed |= control->sar << L2CAP_CTRL_SAR_SHIFT;
1086 packed |= control->txseq << L2CAP_CTRL_TXSEQ_SHIFT;
1087 }
1088
1089 return packed;
1090}
1091
b76bbd66
MM		 1092static inline void __pack_control(struct l2cap_chan *chan,
1093 struct l2cap_ctrl *control,
1094 struct sk_buff *skb)
1095{
1096 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
1097 put_unaligned_le32(__pack_extended_control(control),
1098 skb->data + L2CAP_HDR_SIZE);
1099 } else {
1100 put_unaligned_le16(__pack_enhanced_control(control),
1101 skb->data + L2CAP_HDR_SIZE);
1102 }
1103}
1104
ba7aa64f
GP		 1105static inline unsigned int __ertm_hdr_size(struct l2cap_chan *chan)
1106{
1107 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
1108 return L2CAP_EXT_HDR_SIZE;
1109 else
1110 return L2CAP_ENH_HDR_SIZE;
1111}
1112
a67d7f6f
MM		 1113static struct sk_buff *l2cap_create_sframe_pdu(struct l2cap_chan *chan,
1114 u32 control)
b5c6aaed
MM		 1115{
1116 struct sk_buff *skb;
1117 struct l2cap_hdr *lh;
ba7aa64f 1118 int hlen = __ertm_hdr_size(chan);
b5c6aaed
MM		 1119
1120 if (chan->fcs == L2CAP_FCS_CRC16)
1121 hlen += L2CAP_FCS_SIZE;
1122
a67d7f6f 1123 skb = bt_skb_alloc(hlen, GFP_KERNEL);
b5c6aaed 1124
b5c6aaed 1125 if (!skb)
a67d7f6f 1126 return ERR_PTR(-ENOMEM);
b5c6aaed 1127
4df864c1 1128 lh = skb_put(skb, L2CAP_HDR_SIZE);
b5c6aaed
MM		 1129 lh->len = cpu_to_le16(hlen - L2CAP_HDR_SIZE);
1130 lh->cid = cpu_to_le16(chan->dcid);
1131
a67d7f6f
MM		 1132 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
1133 put_unaligned_le32(control, skb_put(skb, L2CAP_EXT_CTRL_SIZE));
1134 else
1135 put_unaligned_le16(control, skb_put(skb, L2CAP_ENH_CTRL_SIZE));
b5c6aaed
MM		 1136
1137 if (chan->fcs == L2CAP_FCS_CRC16) {
a67d7f6f 1138 u16 fcs = crc16(0, (u8 *)skb->data, skb->len);
b5c6aaed
MM		 1139 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
1140 }
1141
1142 skb->priority = HCI_PRIO_MAX;
a67d7f6f
MM		 1143 return skb;
1144}
1145
1146static void l2cap_send_sframe(struct l2cap_chan *chan,
1147 struct l2cap_ctrl *control)
1148{
1149 struct sk_buff *skb;
1150 u32 control_field;
1151
1152 BT_DBG("chan %p, control %p", chan, control);
1153
1154 if (!control->sframe)
1155 return;
1156
b99e13ad
MM		 1157 if (__chan_is_moving(chan))
1158 return;
1159
a67d7f6f
MM		 1160 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state) &&
1161 !control->poll)
1162 control->final = 1;
1163
1164 if (control->super == L2CAP_SUPER_RR)
1165 clear_bit(CONN_RNR_SENT, &chan->conn_state);
1166 else if (control->super == L2CAP_SUPER_RNR)
1167 set_bit(CONN_RNR_SENT, &chan->conn_state);
1168
1169 if (control->super != L2CAP_SUPER_SREJ) {
1170 chan->last_acked_seq = control->reqseq;
1171 __clear_ack_timer(chan);
1172 }
1173
1174 BT_DBG("reqseq %d, final %d, poll %d, super %d", control->reqseq,
1175 control->final, control->poll, control->super);
1176
1177 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
1178 control_field = __pack_extended_control(control);
1179 else
1180 control_field = __pack_enhanced_control(control);
1181
1182 skb = l2cap_create_sframe_pdu(chan, control_field);
1183 if (!IS_ERR(skb))
1184 l2cap_do_send(chan, skb);
b5c6aaed
MM		 1185}
1186
c9e3d5e0 1187static void l2cap_send_rr_or_rnr(struct l2cap_chan *chan, bool poll)
b5c6aaed 1188{
c9e3d5e0
MM		 1189 struct l2cap_ctrl control;
1190
1191 BT_DBG("chan %p, poll %d", chan, poll);
1192
1193 memset(&control, 0, sizeof(control));
1194 control.sframe = 1;
1195 control.poll = poll;
1196
1197 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state))
1198 control.super = L2CAP_SUPER_RNR;
1199 else
1200 control.super = L2CAP_SUPER_RR;
b5c6aaed 1201
c9e3d5e0
MM		 1202 control.reqseq = chan->buffer_seq;
1203 l2cap_send_sframe(chan, &control);
b5c6aaed
MM		 1204}
1205
b4450035 1206static inline int __l2cap_no_conn_pending(struct l2cap_chan *chan)
e501d055 1207{
5ff6f34d
JH		 1208 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED)
1209 return true;
1210
c1360a1c 1211 return !test_bit(CONF_CONNECT_PEND, &chan->conf_state);
e501d055
AE		 1212}
1213
1df7b17a 1214static bool __amp_capable(struct l2cap_chan *chan)
80d58d0b 1215{
1df7b17a 1216 struct l2cap_conn *conn = chan->conn;
80d58d0b 1217 struct hci_dev *hdev;
1df7b17a
MH		 1218 bool amp_available = false;
1219
0bd49fc7 1220 if (!(conn->local_fixed_chan & L2CAP_FC_A2MP))
1df7b17a
MH		 1221 return false;
1222
0bd49fc7 1223 if (!(conn->remote_fixed_chan & L2CAP_FC_A2MP))
1df7b17a 1224 return false;
80d58d0b
MH		 1225
1226 read_lock(&hci_dev_list_lock);
1df7b17a 1227 list_for_each_entry(hdev, &hci_dev_list, list) {
80d58d0b 1228 if (hdev->amp_type != AMP_TYPE_BREDR &&
1df7b17a
MH		 1229 test_bit(HCI_UP, &hdev->flags)) {
1230 amp_available = true;
1231 break;
1232 }
1233 }
80d58d0b
MH		 1234 read_unlock(&hci_dev_list_lock);
1235
1df7b17a
MH		 1236 if (chan->chan_policy == BT_CHANNEL_POLICY_AMP_PREFERRED)
1237 return amp_available;
848566b3
MH		 1238
1239 return false;
93c3e8f5
AE		 1240}
1241
5ce66b59
AE		 1242static bool l2cap_check_efs(struct l2cap_chan *chan)
1243{
1244 /* Check EFS parameters */
1245 return true;
1246}
1247
2766be48 1248void l2cap_send_conn_req(struct l2cap_chan *chan)
9b27f350
AE		 1249{
1250 struct l2cap_conn *conn = chan->conn;
1251 struct l2cap_conn_req req;
1252
1253 req.scid = cpu_to_le16(chan->scid);
1254 req.psm = chan->psm;
1255
1256 chan->ident = l2cap_get_ident(conn);
1257
1258 set_bit(CONF_CONNECT_PEND, &chan->conf_state);
1259
1260 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ, sizeof(req), &req);
1261}
1262
8eb200bd
MM		 1263static void l2cap_send_create_chan_req(struct l2cap_chan *chan, u8 amp_id)
1264{
1265 struct l2cap_create_chan_req req;
1266 req.scid = cpu_to_le16(chan->scid);
1267 req.psm = chan->psm;
1268 req.amp_id = amp_id;
1269
1270 chan->ident = l2cap_get_ident(chan->conn);
1271
1272 l2cap_send_cmd(chan->conn, chan->ident, L2CAP_CREATE_CHAN_REQ,
1273 sizeof(req), &req);
1274}
1275
02b0fbb9
MM		 1276static void l2cap_move_setup(struct l2cap_chan *chan)
1277{
1278 struct sk_buff *skb;
1279
1280 BT_DBG("chan %p", chan);
1281
1282 if (chan->mode != L2CAP_MODE_ERTM)
1283 return;
1284
1285 __clear_retrans_timer(chan);
1286 __clear_monitor_timer(chan);
1287 __clear_ack_timer(chan);
1288
1289 chan->retry_count = 0;
1290 skb_queue_walk(&chan->tx_q, skb) {
a4368ff3
JH		 1291 if (bt_cb(skb)->l2cap.retries)
1292 bt_cb(skb)->l2cap.retries = 1;
02b0fbb9
MM		 1293 else
1294 break;
1295 }
1296
1297 chan->expected_tx_seq = chan->buffer_seq;
1298
1299 clear_bit(CONN_REJ_ACT, &chan->conn_state);
1300 clear_bit(CONN_SREJ_ACT, &chan->conn_state);
1301 l2cap_seq_list_clear(&chan->retrans_list);
1302 l2cap_seq_list_clear(&chan->srej_list);
1303 skb_queue_purge(&chan->srej_q);
1304
1305 chan->tx_state = L2CAP_TX_STATE_XMIT;
1306 chan->rx_state = L2CAP_RX_STATE_MOVE;
1307
1308 set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
1309}
1310
5f3847a4
MM		 1311static void l2cap_move_done(struct l2cap_chan *chan)
1312{
1313 u8 move_role = chan->move_role;
1314 BT_DBG("chan %p", chan);
1315
1316 chan->move_state = L2CAP_MOVE_STABLE;
1317 chan->move_role = L2CAP_MOVE_ROLE_NONE;
1318
1319 if (chan->mode != L2CAP_MODE_ERTM)
1320 return;
1321
1322 switch (move_role) {
1323 case L2CAP_MOVE_ROLE_INITIATOR:
1324 l2cap_tx(chan, NULL, NULL, L2CAP_EV_EXPLICIT_POLL);
1325 chan->rx_state = L2CAP_RX_STATE_WAIT_F;
1326 break;
1327 case L2CAP_MOVE_ROLE_RESPONDER:
1328 chan->rx_state = L2CAP_RX_STATE_WAIT_P;
1329 break;
1330 }
1331}
1332
9f0caeb1
VCG		 1333static void l2cap_chan_ready(struct l2cap_chan *chan)
1334{
315917e0
JH		 1335 /* The channel may have already been flagged as connected in
1336 * case of receiving data before the L2CAP info req/rsp
1337 * procedure is complete.
1338 */
1339 if (chan->state == BT_CONNECTED)
1340 return;
1341
2827011f 1342 /* This clears all conf flags, including CONF_NOT_COMPLETE */
9f0caeb1
VCG		 1343 chan->conf_state = 0;
1344 __clear_chan_timer(chan);
1345
15f02b91
LAD		 1346 switch (chan->mode) {
1347 case L2CAP_MODE_LE_FLOWCTL:
1348 case L2CAP_MODE_EXT_FLOWCTL:
1349 if (!chan->tx_credits)
1350 chan->ops->suspend(chan);
1351 break;
1352 }
177f8f2b 1353
54a59aa2 1354 chan->state = BT_CONNECTED;
9f0caeb1 1355
fd83e2c2 1356 chan->ops->ready(chan);
9f0caeb1
VCG		 1357}
1358
f1496dee
JH		 1359static void l2cap_le_connect(struct l2cap_chan *chan)
1360{
1361 struct l2cap_conn *conn = chan->conn;
1362 struct l2cap_le_conn_req req;
1363
595177f3
JH		 1364 if (test_and_set_bit(FLAG_LE_CONN_REQ_SENT, &chan->flags))
1365 return;
1366
4b6e228e
LAD		 1367 if (!chan->imtu)
1368 chan->imtu = chan->conn->mtu;
1369
ba8f5289 1370 l2cap_le_flowctl_init(chan, 0);
fe149310 1371
f1496dee
JH		 1372 req.psm = chan->psm;
1373 req.scid = cpu_to_le16(chan->scid);
1374 req.mtu = cpu_to_le16(chan->imtu);
3916aed8 1375 req.mps = cpu_to_le16(chan->mps);
0cd75f7e 1376 req.credits = cpu_to_le16(chan->rx_credits);
f1496dee
JH		 1377
1378 chan->ident = l2cap_get_ident(conn);
1379
1380 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_REQ,
1381 sizeof(req), &req);
1382}
1383
da49b602 1384struct l2cap_ecred_conn_data {
15f02b91
LAD		 1385 struct {
1386 struct l2cap_ecred_conn_req req;
da49b602 1387 __le16 scid[5];
15f02b91 1388 } __packed pdu;
da49b602
LAD		 1389 struct l2cap_chan *chan;
1390 struct pid *pid;
1391 int count;
1392};
1393
1394static void l2cap_ecred_defer_connect(struct l2cap_chan *chan, void *data)
1395{
1396 struct l2cap_ecred_conn_data *conn = data;
1397 struct pid *pid;
1398
1399 if (chan == conn->chan)
1400 return;
1401
1402 if (!test_and_clear_bit(FLAG_DEFER_SETUP, &chan->flags))
1403 return;
1404
1405 pid = chan->ops->get_peer_pid(chan);
1406
1407 /* Only add deferred channels with the same PID/PSM */
1408 if (conn->pid != pid || chan->psm != conn->chan->psm || chan->ident ||
1409 chan->mode != L2CAP_MODE_EXT_FLOWCTL || chan->state != BT_CONNECT)
1410 return;
15f02b91
LAD		 1411
1412 if (test_and_set_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags))
1413 return;
1414
1415 l2cap_ecred_init(chan, 0);
1416
da49b602
LAD		 1417 /* Set the same ident so we can match on the rsp */
1418 chan->ident = conn->chan->ident;
1419
1420 /* Include all channels deferred */
1421 conn->pdu.scid[conn->count] = cpu_to_le16(chan->scid);
1422
1423 conn->count++;
1424}
1425
1426static void l2cap_ecred_connect(struct l2cap_chan *chan)
1427{
1428 struct l2cap_conn *conn = chan->conn;
1429 struct l2cap_ecred_conn_data data;
1430
1431 if (test_bit(FLAG_DEFER_SETUP, &chan->flags))
1432 return;
1433
1434 if (test_and_set_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags))
1435 return;
1436
1437 l2cap_ecred_init(chan, 0);
1438
1439 data.pdu.req.psm = chan->psm;
1440 data.pdu.req.mtu = cpu_to_le16(chan->imtu);
1441 data.pdu.req.mps = cpu_to_le16(chan->mps);
1442 data.pdu.req.credits = cpu_to_le16(chan->rx_credits);
1443 data.pdu.scid[0] = cpu_to_le16(chan->scid);
15f02b91
LAD		 1444
1445 chan->ident = l2cap_get_ident(conn);
da49b602
LAD		 1446 data.pid = chan->ops->get_peer_pid(chan);
1447
1448 data.count = 1;
1449 data.chan = chan;
1450 data.pid = chan->ops->get_peer_pid(chan);
1451
1452 __l2cap_chan_list(conn, l2cap_ecred_defer_connect, &data);
15f02b91
LAD		 1453
1454 l2cap_send_cmd(conn, chan->ident, L2CAP_ECRED_CONN_REQ,
da49b602
LAD		 1455 sizeof(data.pdu.req) + data.count * sizeof(__le16),
1456 &data.pdu);
15f02b91
LAD		 1457}
1458
f1496dee
JH		 1459static void l2cap_le_start(struct l2cap_chan *chan)
1460{
1461 struct l2cap_conn *conn = chan->conn;
1462
1463 if (!smp_conn_security(conn->hcon, chan->sec_level))
1464 return;
1465
1466 if (!chan->psm) {
1467 l2cap_chan_ready(chan);
1468 return;
1469 }
1470
15f02b91
LAD		 1471 if (chan->state == BT_CONNECT) {
1472 if (chan->mode == L2CAP_MODE_EXT_FLOWCTL)
1473 l2cap_ecred_connect(chan);
1474 else
1475 l2cap_le_connect(chan);
1476 }
f1496dee
JH		 1477}
1478
93c3e8f5
AE		 1479static void l2cap_start_connection(struct l2cap_chan *chan)
1480{
1481 if (__amp_capable(chan)) {
1482 BT_DBG("chan %p AMP capable: discover AMPs", chan);
1483 a2mp_discover_amp(chan);
f1496dee
JH		 1484 } else if (chan->conn->hcon->type == LE_LINK) {
1485 l2cap_le_start(chan);
93c3e8f5
AE		 1486 } else {
1487 l2cap_send_conn_req(chan);
1488 }
1489}
1490
aeaeb4bb
JH		 1491static void l2cap_request_info(struct l2cap_conn *conn)
1492{
1493 struct l2cap_info_req req;
1494
1495 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
1496 return;
1497
1498 req.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
1499
1500 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
1501 conn->info_ident = l2cap_get_ident(conn);
1502
1503 schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
1504
1505 l2cap_send_cmd(conn, conn->info_ident, L2CAP_INFO_REQ,
1506 sizeof(req), &req);
1507}
1508
693cd8ce
MH		 1509static bool l2cap_check_enc_key_size(struct hci_conn *hcon)
1510{
1511 /* The minimum encryption key size needs to be enforced by the
1512 * host stack before establishing any L2CAP connections. The
1513 * specification in theory allows a minimum of 1, but to align
1514 * BR/EDR and LE transports, a minimum of 7 is chosen.
1515 *
1516 * This check might also be called for unencrypted connections
1517 * that have no key size requirements. Ensure that the link is
1518 * actually encrypted before enforcing a key size.
1519 */
288c0697
AP		 1520 int min_key_size = hcon->hdev->min_enc_key_size;
1521
1522 /* On FIPS security level, key size must be 16 bytes */
1523 if (hcon->sec_level == BT_SECURITY_FIPS)
1524 min_key_size = 16;
1525
693cd8ce 1526 return (!test_bit(HCI_CONN_ENCRYPT, &hcon->flags) ||
288c0697 1527 hcon->enc_key_size >= min_key_size);
693cd8ce
MH		 1528}
1529
fc7f8a7e 1530static void l2cap_do_start(struct l2cap_chan *chan)
79d554a6 1531{
8c1d787b 1532 struct l2cap_conn *conn = chan->conn;
79d554a6 1533
9f0caeb1 1534 if (conn->hcon->type == LE_LINK) {
96ac34fb 1535 l2cap_le_start(chan);
9f0caeb1
VCG		 1536 return;
1537 }
1538
aeaeb4bb
JH		 1539 if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)) {
1540 l2cap_request_info(conn);
1541 return;
1542 }
79d554a6 1543
aeaeb4bb
JH		 1544 if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE))
1545 return;
79d554a6 1546
693cd8ce
MH		 1547 if (!l2cap_chan_check_security(chan, true) ||
1548 !__l2cap_no_conn_pending(chan))
1549 return;
1550
1551 if (l2cap_check_enc_key_size(conn->hcon))
aeaeb4bb 1552 l2cap_start_connection(chan);
693cd8ce
MH		 1553 else
1554 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
79d554a6
MH		 1555}
1556
cf6c2c0b
GP		 1557static inline int l2cap_mode_supported(__u8 mode, __u32 feat_mask)
1558{
1559 u32 local_feat_mask = l2cap_feat_mask;
d1c4a17d 1560 if (!disable_ertm)
cf6c2c0b
GP		 1561 local_feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING;
1562
1563 switch (mode) {
1564 case L2CAP_MODE_ERTM:
1565 return L2CAP_FEAT_ERTM & feat_mask & local_feat_mask;
1566 case L2CAP_MODE_STREAMING:
1567 return L2CAP_FEAT_STREAMING & feat_mask & local_feat_mask;
1568 default:
1569 return 0x00;
1570 }
1571}
1572
5e4e3972 1573static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err)
22121fc9 1574{
5e4e3972 1575 struct l2cap_conn *conn = chan->conn;
22121fc9
GP		 1576 struct l2cap_disconn_req req;
1577
c13ffa62
GP		 1578 if (!conn)
1579 return;
1580
aad3d0e3 1581 if (chan->mode == L2CAP_MODE_ERTM && chan->state == BT_CONNECTED) {
1a09bcb9
GP		 1582 __clear_retrans_timer(chan);
1583 __clear_monitor_timer(chan);
1584 __clear_ack_timer(chan);
c13ffa62
GP		 1585 }
1586
2338a7e0 1587 if (chan->scid == L2CAP_CID_A2MP) {
d117773c 1588 l2cap_state_change(chan, BT_DISCONN);
416fa752
AE		 1589 return;
1590 }
1591
fe4128e0
GP		 1592 req.dcid = cpu_to_le16(chan->dcid);
1593 req.scid = cpu_to_le16(chan->scid);
2d792818
GP		 1594 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_DISCONN_REQ,
1595 sizeof(req), &req);
c13ffa62 1596
f8e73017 1597 l2cap_state_change_and_error(chan, BT_DISCONN, err);
22121fc9
GP		 1598}
1599
1da177e4 1600/* ---- L2CAP connections ---- */
4e8402a3
MH		 1601static void l2cap_conn_start(struct l2cap_conn *conn)
1602{
3df91ea2 1603 struct l2cap_chan *chan, *tmp;
4e8402a3
MH		 1604
1605 BT_DBG("conn %p", conn);
1606
3df91ea2 1607 mutex_lock(&conn->chan_lock);
4e8402a3 1608
3df91ea2 1609 list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
6be36555 1610 l2cap_chan_lock(chan);
4e8402a3 1611
715ec005 1612 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
aeaeb4bb 1613 l2cap_chan_ready(chan);
6be36555 1614 l2cap_chan_unlock(chan);
79d554a6
MH		 1615 continue;
1616 }
1617
89bc500e 1618 if (chan->state == BT_CONNECT) {
e7cafc45 1619 if (!l2cap_chan_check_security(chan, true) ||
2d792818 1620 !__l2cap_no_conn_pending(chan)) {
6be36555 1621 l2cap_chan_unlock(chan);
47731de7
GP		 1622 continue;
1623 }
79d554a6 1624
c1360a1c 1625 if (!l2cap_mode_supported(chan->mode, conn->feat_mask)
2d792818 1626 && test_bit(CONF_STATE2_DEVICE,
c1360a1c 1627 &chan->conf_state)) {
89bc500e 1628 l2cap_chan_close(chan, ECONNRESET);
6be36555 1629 l2cap_chan_unlock(chan);
47731de7 1630 continue;
b1235d79 1631 }
47731de7 1632
693cd8ce
MH		 1633 if (l2cap_check_enc_key_size(conn->hcon))
1634 l2cap_start_connection(chan);
1635 else
1636 l2cap_chan_close(chan, ECONNREFUSED);
47731de7 1637
89bc500e 1638 } else if (chan->state == BT_CONNECT2) {
79d554a6 1639 struct l2cap_conn_rsp rsp;
e9aeb2dd 1640 char buf[128];
fe4128e0
GP		 1641 rsp.scid = cpu_to_le16(chan->dcid);
1642 rsp.dcid = cpu_to_le16(chan->scid);
79d554a6 1643
e7cafc45 1644 if (l2cap_chan_check_security(chan, false)) {
bdc25783 1645 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
dcf4adbf
JP		 1646 rsp.result = cpu_to_le16(L2CAP_CR_PEND);
1647 rsp.status = cpu_to_le16(L2CAP_CS_AUTHOR_PEND);
2dc4e510 1648 chan->ops->defer(chan);
f66dc81f
MH		 1649
1650 } else {
acdcabf5 1651 l2cap_state_change(chan, BT_CONFIG);
dcf4adbf
JP		 1652 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
1653 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
f66dc81f 1654 }
79d554a6 1655 } else {
dcf4adbf
JP		 1656 rsp.result = cpu_to_le16(L2CAP_CR_PEND);
1657 rsp.status = cpu_to_le16(L2CAP_CS_AUTHEN_PEND);
79d554a6
MH		 1658 }
1659
fc7f8a7e 1660 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
2d792818 1661 sizeof(rsp), &rsp);
e9aeb2dd 1662
c1360a1c 1663 if (test_bit(CONF_REQ_SENT, &chan->conf_state) ||
2d792818 1664 rsp.result != L2CAP_CR_SUCCESS) {
6be36555 1665 l2cap_chan_unlock(chan);
e9aeb2dd
GP		 1666 continue;
1667 }
1668
c1360a1c 1669 set_bit(CONF_REQ_SENT, &chan->conf_state);
e9aeb2dd 1670 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
e860d2c9 1671 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
73ffa904 1672 chan->num_conf_req++;
4e8402a3
MH		 1673 }
1674
6be36555 1675 l2cap_chan_unlock(chan);
4e8402a3
MH		 1676 }
1677
3df91ea2 1678 mutex_unlock(&conn->chan_lock);
4e8402a3
MH		 1679}
1680
b62f328b
VT		 1681static void l2cap_le_conn_ready(struct l2cap_conn *conn)
1682{
cc8dba2b 1683 struct hci_conn *hcon = conn->hcon;
dcc36c16 1684 struct hci_dev *hdev = hcon->hdev;
b62f328b 1685
e760ec12 1686 BT_DBG("%s conn %p", hdev->name, conn);
b62f328b 1687
e760ec12
JH		 1688 /* For outgoing pairing which doesn't necessarily have an
1689 * associated socket (e.g. mgmt_pair_device).
1690 */
1691 if (hcon->out)
1692 smp_conn_security(hcon, hcon->pending_sec_level);
cc8dba2b 1693
74be523c 1694 /* For LE peripheral connections, make sure the connection interval
5153ceb9 1695 * is in the range of the minimum and maximum interval that has
80afeb6c
MH		 1696 * been configured for this connection. If not, then trigger
1697 * the connection update procedure.
1698 */
40bef302 1699 if (hcon->role == HCI_ROLE_SLAVE &&
80afeb6c
MH		 1700 (hcon->le_conn_interval < hcon->le_conn_min_interval ||
1701 hcon->le_conn_interval > hcon->le_conn_max_interval)) {
1702 struct l2cap_conn_param_update_req req;
1703
1704 req.min = cpu_to_le16(hcon->le_conn_min_interval);
1705 req.max = cpu_to_le16(hcon->le_conn_max_interval);
1706 req.latency = cpu_to_le16(hcon->le_conn_latency);
1707 req.to_multiplier = cpu_to_le16(hcon->le_supv_timeout);
1708
1709 l2cap_send_cmd(conn, l2cap_get_ident(conn),
1710 L2CAP_CONN_PARAM_UPDATE_REQ, sizeof(req), &req);
1711 }
b62f328b
VT		 1712}
1713
4e8402a3
MH		 1714static void l2cap_conn_ready(struct l2cap_conn *conn)
1715{
48454079 1716 struct l2cap_chan *chan;
cc110922 1717 struct hci_conn *hcon = conn->hcon;
4e8402a3 1718
79d554a6 1719 BT_DBG("conn %p", conn);
4e8402a3 1720
aeaeb4bb
JH		 1721 if (hcon->type == ACL_LINK)
1722 l2cap_request_info(conn);
1723
e760ec12
JH		 1724 mutex_lock(&conn->chan_lock);
1725
3df91ea2 1726 list_for_each_entry(chan, &conn->chan_l, list) {
baa7e1fa 1727
6be36555 1728 l2cap_chan_lock(chan);
4e8402a3 1729
2338a7e0 1730 if (chan->scid == L2CAP_CID_A2MP) {
416fa752
AE		 1731 l2cap_chan_unlock(chan);
1732 continue;
1733 }
1734
cc110922 1735 if (hcon->type == LE_LINK) {
f1496dee 1736 l2cap_le_start(chan);
63128451 1737 } else if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
aeaeb4bb
JH		 1738 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)
1739 l2cap_chan_ready(chan);
1c244f79 1740 } else if (chan->state == BT_CONNECT) {
fc7f8a7e 1741 l2cap_do_start(chan);
1c244f79 1742 }
4e8402a3 1743
6be36555 1744 l2cap_chan_unlock(chan);
4e8402a3 1745 }
79d554a6 1746
3df91ea2 1747 mutex_unlock(&conn->chan_lock);
61a939c6 1748
79a05727
JH		 1749 if (hcon->type == LE_LINK)
1750 l2cap_le_conn_ready(conn);
1751
61a939c6 1752 queue_work(hcon->hdev->workqueue, &conn->pending_rx_work);
4e8402a3
MH		 1753}
1754
1755/* Notify sockets that we cannot guaranty reliability anymore */
1756static void l2cap_conn_unreliable(struct l2cap_conn *conn, int err)
1757{
48454079 1758 struct l2cap_chan *chan;
4e8402a3
MH		 1759
1760 BT_DBG("conn %p", conn);
1761
3df91ea2 1762 mutex_lock(&conn->chan_lock);
4e8402a3 1763
3df91ea2 1764 list_for_each_entry(chan, &conn->chan_l, list) {
ecf61bdb 1765 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
1d8b1fd5 1766 l2cap_chan_set_err(chan, err);
4e8402a3
MH		 1767 }
1768
3df91ea2 1769 mutex_unlock(&conn->chan_lock);
4e8402a3
MH		 1770}
1771
f878fcad 1772static void l2cap_info_timeout(struct work_struct *work)
4e8402a3 1773{
f878fcad 1774 struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
2d792818 1775 info_timer.work);
4e8402a3 1776
984947dc 1777 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
e1027a7c 1778 conn->info_ident = 0;
984947dc 1779
4e8402a3
MH		 1780 l2cap_conn_start(conn);
1781}
1782
2c8e1411
DH		 1783/*
1784 * l2cap_user
1785 * External modules can register l2cap_user objects on l2cap_conn. The ->probe
1786 * callback is called during registration. The ->remove callback is called
1787 * during unregistration.
1788 * An l2cap_user object can either be explicitly unregistered or when the
1789 * underlying l2cap_conn object is deleted. This guarantees that l2cap->hcon,
1790 * l2cap->hchan, .. are valid as long as the remove callback hasn't been called.
1791 * External modules must own a reference to the l2cap_conn object if they intend
1792 * to call l2cap_unregister_user(). The l2cap_conn object might get destroyed at
1793 * any time if they don't.
1794 */
1795
1796int l2cap_register_user(struct l2cap_conn *conn, struct l2cap_user *user)
1797{
1798 struct hci_dev *hdev = conn->hcon->hdev;
1799 int ret;
1800
1801 /* We need to check whether l2cap_conn is registered. If it is not, we
1802 * must not register the l2cap_user. l2cap_conn_del() is unregisters
1803 * l2cap_conn objects, but doesn't provide its own locking. Instead, it
1804 * relies on the parent hci_conn object to be locked. This itself relies
1805 * on the hci_dev object to be locked. So we must lock the hci device
1806 * here, too. */
1807
1808 hci_dev_lock(hdev);
1809
835a6a2f 1810 if (!list_empty(&user->list)) {
2c8e1411
DH		 1811 ret = -EINVAL;
1812 goto out_unlock;
1813 }
1814
1815 /* conn->hchan is NULL after l2cap_conn_del() was called */
1816 if (!conn->hchan) {
1817 ret = -ENODEV;
1818 goto out_unlock;
1819 }
1820
1821 ret = user->probe(conn, user);
1822 if (ret)
1823 goto out_unlock;
1824
1825 list_add(&user->list, &conn->users);
1826 ret = 0;
1827
1828out_unlock:
1829 hci_dev_unlock(hdev);
1830 return ret;
1831}
1832EXPORT_SYMBOL(l2cap_register_user);
1833
1834void l2cap_unregister_user(struct l2cap_conn *conn, struct l2cap_user *user)
1835{
1836 struct hci_dev *hdev = conn->hcon->hdev;
1837
1838 hci_dev_lock(hdev);
1839
835a6a2f 1840 if (list_empty(&user->list))
2c8e1411
DH		 1841 goto out_unlock;
1842
ab944c83 1843 list_del_init(&user->list);
2c8e1411
DH		 1844 user->remove(conn, user);
1845
1846out_unlock:
1847 hci_dev_unlock(hdev);
1848}
1849EXPORT_SYMBOL(l2cap_unregister_user);
1850
1851static void l2cap_unregister_all_users(struct l2cap_conn *conn)
1852{
1853 struct l2cap_user *user;
1854
1855 while (!list_empty(&conn->users)) {
1856 user = list_first_entry(&conn->users, struct l2cap_user, list);
ab944c83 1857 list_del_init(&user->list);
2c8e1411
DH		 1858 user->remove(conn, user);
1859 }
1860}
1861
5d3de7df
VCG		 1862static void l2cap_conn_del(struct hci_conn *hcon, int err)
1863{
1864 struct l2cap_conn *conn = hcon->l2cap_data;
1865 struct l2cap_chan *chan, *l;
5d3de7df
VCG		 1866
1867 if (!conn)
1868 return;
1869
1870 BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
1871
1872 kfree_skb(conn->rx_skb);
1873
61a939c6 1874 skb_queue_purge(&conn->pending_rx);
7ab56c3a
JT		 1875
1876 /* We can not call flush_work(&conn->pending_rx_work) here since we
1877 * might block if we are running on a worker from the same workqueue
1878 * pending_rx_work is waiting on.
1879 */
1880 if (work_pending(&conn->pending_rx_work))
1881 cancel_work_sync(&conn->pending_rx_work);
61a939c6 1882
f3d82d0c
JH		 1883 if (work_pending(&conn->id_addr_update_work))
1884 cancel_work_sync(&conn->id_addr_update_work);
1885
2c8e1411
DH		 1886 l2cap_unregister_all_users(conn);
1887
e31fb860
JH		 1888 /* Force the connection to be immediately dropped */
1889 hcon->disc_timeout = 0;
1890
3df91ea2
AE		 1891 mutex_lock(&conn->chan_lock);
1892
5d3de7df
VCG		 1893 /* Kill channels */
1894 list_for_each_entry_safe(chan, l, &conn->chan_l, list) {
61d6ef3e 1895 l2cap_chan_hold(chan);
6be36555
AE		 1896 l2cap_chan_lock(chan);
1897
5d3de7df 1898 l2cap_chan_del(chan, err);
6be36555 1899
80b98027 1900 chan->ops->close(chan);
6c08fc89
MM		 1901
1902 l2cap_chan_unlock(chan);
61d6ef3e 1903 l2cap_chan_put(chan);
5d3de7df
VCG		 1904 }
1905
3df91ea2
AE		 1906 mutex_unlock(&conn->chan_lock);
1907
73d80deb
LAD		 1908 hci_chan_del(conn->hchan);
1909
5d3de7df 1910 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
127074bf 1911 cancel_delayed_work_sync(&conn->info_timer);
5d3de7df 1912
5d3de7df 1913 hcon->l2cap_data = NULL;
9c903e37
DH		 1914 conn->hchan = NULL;
1915 l2cap_conn_put(conn);
5d3de7df
VCG		 1916}
1917
9c903e37
DH		 1918static void l2cap_conn_free(struct kref *ref)
1919{
1920 struct l2cap_conn *conn = container_of(ref, struct l2cap_conn, ref);
1921
1922 hci_conn_put(conn->hcon);
1923 kfree(conn);
1924}
1925
51bb8457 1926struct l2cap_conn *l2cap_conn_get(struct l2cap_conn *conn)
9c903e37
DH		 1927{
1928 kref_get(&conn->ref);
51bb8457 1929 return conn;
9c903e37
DH		 1930}
1931EXPORT_SYMBOL(l2cap_conn_get);
1932
1933void l2cap_conn_put(struct l2cap_conn *conn)
1934{
1935 kref_put(&conn->ref, l2cap_conn_free);
1936}
1937EXPORT_SYMBOL(l2cap_conn_put);
1938
1da177e4 1939/* ---- Socket interface ---- */
1da177e4 1940
c2287681 1941/* Find socket with psm and source / destination bdaddr.
1da177e4
LT		 1942 * Returns closest match.
1943 */
c2287681
IY		 1944static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm,
1945 bdaddr_t *src,
bf20fd4e
JH		 1946 bdaddr_t *dst,
1947 u8 link_type)
1da177e4 1948{
23691d75 1949 struct l2cap_chan *c, *c1 = NULL;
1da177e4 1950
23691d75 1951 read_lock(&chan_list_lock);
e0f0cb56 1952
23691d75 1953 list_for_each_entry(c, &chan_list, global_l) {
89bc500e 1954 if (state && c->state != state)
1da177e4
LT		 1955 continue;
1956
bf20fd4e
JH		 1957 if (link_type == ACL_LINK && c->src_type != BDADDR_BREDR)
1958 continue;
1959
1960 if (link_type == LE_LINK && c->src_type == BDADDR_BREDR)
1961 continue;
1962
23691d75 1963 if (c->psm == psm) {
c2287681
IY		 1964 int src_match, dst_match;
1965 int src_any, dst_any;
1966
1da177e4 1967 /* Exact match. */
7eafc59e
MH		 1968 src_match = !bacmp(&c->src, src);
1969 dst_match = !bacmp(&c->dst, dst);
c2287681 1970 if (src_match && dst_match) {
a24cce14 1971 l2cap_chan_hold(c);
a7567b20 1972 read_unlock(&chan_list_lock);
23691d75
GP		 1973 return c;
1974 }
1da177e4
LT		 1975
1976 /* Closest match */
7eafc59e
MH		 1977 src_any = !bacmp(&c->src, BDADDR_ANY);
1978 dst_any = !bacmp(&c->dst, BDADDR_ANY);
c2287681
IY		 1979 if ((src_match && dst_any) || (src_any && dst_match) ||
1980 (src_any && dst_any))
23691d75 1981 c1 = c;
1da177e4
LT		 1982 }
1983 }
1da177e4 1984
a24cce14
JH		 1985 if (c1)
1986 l2cap_chan_hold(c1);
1987
23691d75 1988 read_unlock(&chan_list_lock);
e0f0cb56 1989
23691d75 1990 return c1;
1da177e4
LT		 1991}
1992
721c4181 1993static void l2cap_monitor_timeout(struct work_struct *work)
e90bac06 1994{
721c4181 1995 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
4239d16f 1996 monitor_timer.work);
e90bac06 1997
525cd185 1998 BT_DBG("chan %p", chan);
0e98958d 1999
6be36555
AE		 2000 l2cap_chan_lock(chan);
2001
80909e04 2002 if (!chan->conn) {
6be36555 2003 l2cap_chan_unlock(chan);
8d7e1c7f 2004 l2cap_chan_put(chan);
e90bac06
GP		 2005 return;
2006 }
2007
401bb1f7 2008 l2cap_tx(chan, NULL, NULL, L2CAP_EV_MONITOR_TO);
e90bac06 2009
6be36555 2010 l2cap_chan_unlock(chan);
8d7e1c7f 2011 l2cap_chan_put(chan);
e90bac06
GP		 2012}
2013
721c4181 2014static void l2cap_retrans_timeout(struct work_struct *work)
e90bac06 2015{
721c4181 2016 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
4239d16f 2017 retrans_timer.work);
e90bac06 2018
49208c9c 2019 BT_DBG("chan %p", chan);
0e98958d 2020
6be36555
AE		 2021 l2cap_chan_lock(chan);
2022
80909e04
MM		 2023 if (!chan->conn) {
2024 l2cap_chan_unlock(chan);
2025 l2cap_chan_put(chan);
2026 return;
2027 }
6be36555 2028
401bb1f7 2029 l2cap_tx(chan, NULL, NULL, L2CAP_EV_RETRANS_TO);
6be36555 2030 l2cap_chan_unlock(chan);
8d7e1c7f 2031 l2cap_chan_put(chan);
e90bac06
GP		 2032}
2033
d660366d
GP		 2034static void l2cap_streaming_send(struct l2cap_chan *chan,
2035 struct sk_buff_head *skbs)
6840ed07 2036{
ccbb84af 2037 struct sk_buff *skb;
3733937d 2038 struct l2cap_ctrl *control;
6840ed07 2039
3733937d
MM		 2040 BT_DBG("chan %p, skbs %p", chan, skbs);
2041
b99e13ad
MM		 2042 if (__chan_is_moving(chan))
2043 return;
2044
3733937d
MM		 2045 skb_queue_splice_tail_init(skbs, &chan->tx_q);
2046
2047 while (!skb_queue_empty(&chan->tx_q)) {
2048
2049 skb = skb_dequeue(&chan->tx_q);
2050
a4368ff3
JH		 2051 bt_cb(skb)->l2cap.retries = 1;
2052 control = &bt_cb(skb)->l2cap;
3733937d
MM		 2053
2054 control->reqseq = 0;
2055 control->txseq = chan->next_tx_seq;
2056
2057 __pack_control(chan, control, skb);
6840ed07 2058
47d1ec61 2059 if (chan->fcs == L2CAP_FCS_CRC16) {
3733937d
MM		 2060 u16 fcs = crc16(0, (u8 *) skb->data, skb->len);
2061 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
fcc203c3
GP		 2062 }
2063
4343478f 2064 l2cap_do_send(chan, skb);
6840ed07 2065
b4400672 2066 BT_DBG("Sent txseq %u", control->txseq);
3733937d 2067
836be934 2068 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
3733937d 2069 chan->frames_sent++;
6840ed07 2070 }
6840ed07
GP		 2071}
2072
67c9e840 2073static int l2cap_ertm_send(struct l2cap_chan *chan)
1c2acffb
GP		 2074{
2075 struct sk_buff *skb, *tx_skb;
18a48e76
MM		 2076 struct l2cap_ctrl *control;
2077 int sent = 0;
2078
2079 BT_DBG("chan %p", chan);
1c2acffb 2080
89bc500e 2081 if (chan->state != BT_CONNECTED)
c13ffa62 2082 return -ENOTCONN;
e90bac06 2083
94122bbe
MM		 2084 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
2085 return 0;
2086
b99e13ad
MM		 2087 if (__chan_is_moving(chan))
2088 return 0;
2089
18a48e76
MM		 2090 while (chan->tx_send_head &&
2091 chan->unacked_frames < chan->remote_tx_win &&
2092 chan->tx_state == L2CAP_TX_STATE_XMIT) {
e420aba3 2093
18a48e76 2094 skb = chan->tx_send_head;
e90bac06 2095
a4368ff3
JH		 2096 bt_cb(skb)->l2cap.retries = 1;
2097 control = &bt_cb(skb)->l2cap;
95ffa978 2098
e2ab4353 2099 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
18a48e76 2100 control->final = 1;
e2ab4353 2101
18a48e76
MM		 2102 control->reqseq = chan->buffer_seq;
2103 chan->last_acked_seq = chan->buffer_seq;
2104 control->txseq = chan->next_tx_seq;
1c2acffb 2105
18a48e76 2106 __pack_control(chan, control, skb);
e90bac06 2107
47d1ec61 2108 if (chan->fcs == L2CAP_FCS_CRC16) {
18a48e76
MM		 2109 u16 fcs = crc16(0, (u8 *) skb->data, skb->len);
2110 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
fcc203c3
GP		 2111 }
2112
18a48e76
MM		 2113 /* Clone after data has been modified. Data is assumed to be
2114 read-only (for locking purposes) on cloned sk_buffs.
2115 */
2116 tx_skb = skb_clone(skb, GFP_KERNEL);
9a9c6a34 2117
18a48e76
MM		 2118 if (!tx_skb)
2119 break;
1c2acffb 2120
18a48e76 2121 __set_retrans_timer(chan);
836be934
AE		 2122
2123 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
18a48e76 2124 chan->unacked_frames++;
6a026610 2125 chan->frames_sent++;
18a48e76 2126 sent++;
1c2acffb 2127
58d35f87
GP		 2128 if (skb_queue_is_last(&chan->tx_q, skb))
2129 chan->tx_send_head = NULL;
1c2acffb 2130 else
58d35f87 2131 chan->tx_send_head = skb_queue_next(&chan->tx_q, skb);
18a48e76
MM		 2132
2133 l2cap_do_send(chan, tx_skb);
b4400672 2134 BT_DBG("Sent txseq %u", control->txseq);
1c2acffb
GP		 2135 }
2136
b4400672
AE		 2137 BT_DBG("Sent %d, %u unacked, %u in ERTM queue", sent,
2138 chan->unacked_frames, skb_queue_len(&chan->tx_q));
18a48e76
MM		 2139
2140 return sent;
9e917af1
GP		 2141}
2142
e1fbd4c1
MM		 2143static void l2cap_ertm_resend(struct l2cap_chan *chan)
2144{
2145 struct l2cap_ctrl control;
2146 struct sk_buff *skb;
2147 struct sk_buff *tx_skb;
2148 u16 seq;
2149
2150 BT_DBG("chan %p", chan);
2151
2152 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
2153 return;
2154
b99e13ad
MM		 2155 if (__chan_is_moving(chan))
2156 return;
2157
e1fbd4c1
MM		 2158 while (chan->retrans_list.head != L2CAP_SEQ_LIST_CLEAR) {
2159 seq = l2cap_seq_list_pop(&chan->retrans_list);
2160
2161 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, seq);
2162 if (!skb) {
2163 BT_DBG("Error: Can't retransmit seq %d, frame missing",
2d792818 2164 seq);
e1fbd4c1
MM		 2165 continue;
2166 }
2167
a4368ff3
JH		 2168 bt_cb(skb)->l2cap.retries++;
2169 control = bt_cb(skb)->l2cap;
e1fbd4c1
MM		 2170
2171 if (chan->max_tx != 0 &&
a4368ff3 2172 bt_cb(skb)->l2cap.retries > chan->max_tx) {
e1fbd4c1 2173 BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
5e4e3972 2174 l2cap_send_disconn_req(chan, ECONNRESET);
e1fbd4c1
MM		 2175 l2cap_seq_list_clear(&chan->retrans_list);
2176 break;
2177 }
2178
2179 control.reqseq = chan->buffer_seq;
2180 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
2181 control.final = 1;
2182 else
2183 control.final = 0;
2184
2185 if (skb_cloned(skb)) {
2186 /* Cloned sk_buffs are read-only, so we need a
2187 * writeable copy
2188 */
8bcde1f2 2189 tx_skb = skb_copy(skb, GFP_KERNEL);
e1fbd4c1 2190 } else {
8bcde1f2 2191 tx_skb = skb_clone(skb, GFP_KERNEL);
e1fbd4c1
MM		 2192 }
2193
2194 if (!tx_skb) {
2195 l2cap_seq_list_clear(&chan->retrans_list);
2196 break;
2197 }
2198
2199 /* Update skb contents */
2200 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
2201 put_unaligned_le32(__pack_extended_control(&control),
2202 tx_skb->data + L2CAP_HDR_SIZE);
2203 } else {
2204 put_unaligned_le16(__pack_enhanced_control(&control),
2205 tx_skb->data + L2CAP_HDR_SIZE);
2206 }
2207
13cac152 2208 /* Update FCS */
e1fbd4c1 2209 if (chan->fcs == L2CAP_FCS_CRC16) {
13cac152
LR		 2210 u16 fcs = crc16(0, (u8 *) tx_skb->data,
2211 tx_skb->len - L2CAP_FCS_SIZE);
2212 put_unaligned_le16(fcs, skb_tail_pointer(tx_skb) -
2213 L2CAP_FCS_SIZE);
e1fbd4c1
MM		 2214 }
2215
2216 l2cap_do_send(chan, tx_skb);
2217
2218 BT_DBG("Resent txseq %d", control.txseq);
2219
2220 chan->last_acked_seq = chan->buffer_seq;
2221 }
2222}
2223
f80842a8
MM		 2224static void l2cap_retransmit(struct l2cap_chan *chan,
2225 struct l2cap_ctrl *control)
2226{
2227 BT_DBG("chan %p, control %p", chan, control);
2228
2229 l2cap_seq_list_append(&chan->retrans_list, control->reqseq);
2230 l2cap_ertm_resend(chan);
2231}
2232
d2a7ac5d
MM		 2233static void l2cap_retransmit_all(struct l2cap_chan *chan,
2234 struct l2cap_ctrl *control)
2235{
e1fbd4c1
MM		 2236 struct sk_buff *skb;
2237
2238 BT_DBG("chan %p, control %p", chan, control);
2239
2240 if (control->poll)
2241 set_bit(CONN_SEND_FBIT, &chan->conn_state);
2242
2243 l2cap_seq_list_clear(&chan->retrans_list);
2244
2245 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
2246 return;
2247
2248 if (chan->unacked_frames) {
2249 skb_queue_walk(&chan->tx_q, skb) {
a4368ff3 2250 if (bt_cb(skb)->l2cap.txseq == control->reqseq ||
2d792818 2251 skb == chan->tx_send_head)
e1fbd4c1
MM		 2252 break;
2253 }
2254
2255 skb_queue_walk_from(&chan->tx_q, skb) {
2256 if (skb == chan->tx_send_head)
2257 break;
2258
2259 l2cap_seq_list_append(&chan->retrans_list,
a4368ff3 2260 bt_cb(skb)->l2cap.txseq);
e1fbd4c1
MM		 2261 }
2262
2263 l2cap_ertm_resend(chan);
2264 }
d2a7ac5d
MM		 2265}
2266
0a0aba42 2267static void l2cap_send_ack(struct l2cap_chan *chan)
9e917af1 2268{
0a0aba42
MM		 2269 struct l2cap_ctrl control;
2270 u16 frames_to_ack = __seq_offset(chan, chan->buffer_seq,
2271 chan->last_acked_seq);
2272 int threshold;
9e917af1 2273
0a0aba42
MM		 2274 BT_DBG("chan %p last_acked_seq %d buffer_seq %d",
2275 chan, chan->last_acked_seq, chan->buffer_seq);
9e917af1 2276
0a0aba42
MM		 2277 memset(&control, 0, sizeof(control));
2278 control.sframe = 1;
dfc909be 2279
0a0aba42
MM		 2280 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&
2281 chan->rx_state == L2CAP_RX_STATE_RECV) {
2282 __clear_ack_timer(chan);
2283 control.super = L2CAP_SUPER_RNR;
2284 control.reqseq = chan->buffer_seq;
2285 l2cap_send_sframe(chan, &control);
2286 } else {
2287 if (!test_bit(CONN_REMOTE_BUSY, &chan->conn_state)) {
2288 l2cap_ertm_send(chan);
2289 /* If any i-frames were sent, they included an ack */
2290 if (chan->buffer_seq == chan->last_acked_seq)
2291 frames_to_ack = 0;
2292 }
dfc909be 2293
c20f8e35 2294 /* Ack now if the window is 3/4ths full.
0a0aba42
MM		 2295 * Calculate without mul or div
2296 */
c20f8e35 2297 threshold = chan->ack_win;
0a0aba42
MM		 2298 threshold += threshold << 1;
2299 threshold >>= 2;
2300
b4400672 2301 BT_DBG("frames_to_ack %u, threshold %d", frames_to_ack,
0a0aba42
MM		 2302 threshold);
2303
2304 if (frames_to_ack >= threshold) {
2305 __clear_ack_timer(chan);
2306 control.super = L2CAP_SUPER_RR;
2307 control.reqseq = chan->buffer_seq;
2308 l2cap_send_sframe(chan, &control);
2309 frames_to_ack = 0;
2310 }
1c2acffb 2311
0a0aba42
MM		 2312 if (frames_to_ack)
2313 __set_ack_timer(chan);
2314 }
b17e73bb
SJ		 2315}
2316
04124681
GP		 2317static inline int l2cap_skbuff_fromiovec(struct l2cap_chan *chan,
2318 struct msghdr *msg, int len,
2319 int count, struct sk_buff *skb)
1c2acffb 2320{
0952a57a 2321 struct l2cap_conn *conn = chan->conn;
1c2acffb 2322 struct sk_buff **frag;
90338947 2323 int sent = 0;
1da177e4 2324
cbbd26b8 2325 if (!copy_from_iter_full(skb_put(skb, count), count, &msg->msg_iter))
1c2acffb 2326 return -EFAULT;
1da177e4
LT		 2327
2328 sent += count;
2329 len -= count;
2330
2331 /* Continuation fragments (no L2CAP header) */
2332 frag = &skb_shinfo(skb)->frag_list;
2333 while (len) {
fbe00700
GP		 2334 struct sk_buff *tmp;
2335
1da177e4
LT		 2336 count = min_t(unsigned int, conn->mtu, len);
2337
d9fbd02b 2338 tmp = chan->ops->alloc_skb(chan, 0, count,
fbe00700
GP		 2339 msg->msg_flags & MSG_DONTWAIT);
2340 if (IS_ERR(tmp))
2341 return PTR_ERR(tmp);
2342
2343 *frag = tmp;
2f7719ce 2344
cbbd26b8
AV		 2345 if (!copy_from_iter_full(skb_put(*frag, count), count,
2346 &msg->msg_iter))
1c2acffb 2347 return -EFAULT;
1da177e4
LT		 2348
2349 sent += count;
2350 len -= count;
2351
2d0ed3d5
GP		 2352 skb->len += (*frag)->len;
2353 skb->data_len += (*frag)->len;
2354
1da177e4
LT		 2355 frag = &(*frag)->next;
2356 }
1da177e4
LT		 2357
2358 return sent;
1c2acffb 2359}
1da177e4 2360
5e59b791 2361static struct sk_buff *l2cap_create_connless_pdu(struct l2cap_chan *chan,
8d46321c 2362 struct msghdr *msg, size_t len)
1c2acffb 2363{
8c1d787b 2364 struct l2cap_conn *conn = chan->conn;
1c2acffb 2365 struct sk_buff *skb;
03a51213 2366 int err, count, hlen = L2CAP_HDR_SIZE + L2CAP_PSMLEN_SIZE;
1c2acffb
GP		 2367 struct l2cap_hdr *lh;
2368
8d46321c
MH		 2369 BT_DBG("chan %p psm 0x%2.2x len %zu", chan,
2370 __le16_to_cpu(chan->psm), len);
1c2acffb
GP		 2371
2372 count = min_t(unsigned int, (conn->mtu - hlen), len);
2f7719ce 2373
d9fbd02b 2374 skb = chan->ops->alloc_skb(chan, hlen, count,
90338947
GP		 2375 msg->msg_flags & MSG_DONTWAIT);
2376 if (IS_ERR(skb))
2377 return skb;
1c2acffb
GP		 2378
2379 /* Create L2CAP header */
4df864c1 2380 lh = skb_put(skb, L2CAP_HDR_SIZE);
fe4128e0 2381 lh->cid = cpu_to_le16(chan->dcid);
daf6a78c 2382 lh->len = cpu_to_le16(len + L2CAP_PSMLEN_SIZE);
43b1b8df 2383 put_unaligned(chan->psm, (__le16 *) skb_put(skb, L2CAP_PSMLEN_SIZE));
1c2acffb 2384
0952a57a 2385 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
1c2acffb
GP		 2386 if (unlikely(err < 0)) {
2387 kfree_skb(skb);
2388 return ERR_PTR(err);
2389 }
2390 return skb;
2391}
2392
5e59b791 2393static struct sk_buff *l2cap_create_basic_pdu(struct l2cap_chan *chan,
8d46321c 2394 struct msghdr *msg, size_t len)
1c2acffb 2395{
8c1d787b 2396 struct l2cap_conn *conn = chan->conn;
1c2acffb 2397 struct sk_buff *skb;
f2ba7fae 2398 int err, count;
1c2acffb
GP		 2399 struct l2cap_hdr *lh;
2400
b4400672 2401 BT_DBG("chan %p len %zu", chan, len);
1c2acffb 2402
f2ba7fae 2403 count = min_t(unsigned int, (conn->mtu - L2CAP_HDR_SIZE), len);
2f7719ce 2404
d9fbd02b 2405 skb = chan->ops->alloc_skb(chan, L2CAP_HDR_SIZE, count,
90338947
GP		 2406 msg->msg_flags & MSG_DONTWAIT);
2407 if (IS_ERR(skb))
2408 return skb;
1c2acffb
GP		 2409
2410 /* Create L2CAP header */
4df864c1 2411 lh = skb_put(skb, L2CAP_HDR_SIZE);
fe4128e0 2412 lh->cid = cpu_to_le16(chan->dcid);
6ff9b5ef 2413 lh->len = cpu_to_le16(len);
1c2acffb 2414
0952a57a 2415 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
1c2acffb
GP		 2416 if (unlikely(err < 0)) {
2417 kfree_skb(skb);
2418 return ERR_PTR(err);
2419 }
2420 return skb;
2421}
2422
ab0ff76d 2423static struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan,
b4400672
AE		 2424 struct msghdr *msg, size_t len,
2425 u16 sdulen)
1c2acffb 2426{
8c1d787b 2427 struct l2cap_conn *conn = chan->conn;
1c2acffb 2428 struct sk_buff *skb;
e4ca6d98 2429 int err, count, hlen;
1c2acffb
GP		 2430 struct l2cap_hdr *lh;
2431
b4400672 2432 BT_DBG("chan %p len %zu", chan, len);
1c2acffb 2433
0ee0d208
GP		 2434 if (!conn)
2435 return ERR_PTR(-ENOTCONN);
2436
ba7aa64f 2437 hlen = __ertm_hdr_size(chan);
e4ca6d98 2438
c74e560c 2439 if (sdulen)
03a51213 2440 hlen += L2CAP_SDULEN_SIZE;
c74e560c 2441
47d1ec61 2442 if (chan->fcs == L2CAP_FCS_CRC16)
03a51213 2443 hlen += L2CAP_FCS_SIZE;
fcc203c3 2444
1c2acffb 2445 count = min_t(unsigned int, (conn->mtu - hlen), len);
2f7719ce 2446
d9fbd02b 2447 skb = chan->ops->alloc_skb(chan, hlen, count,
90338947
GP		 2448 msg->msg_flags & MSG_DONTWAIT);
2449 if (IS_ERR(skb))
2450 return skb;
1c2acffb
GP		 2451
2452 /* Create L2CAP header */
4df864c1 2453 lh = skb_put(skb, L2CAP_HDR_SIZE);
fe4128e0 2454 lh->cid = cpu_to_le16(chan->dcid);
1c2acffb 2455 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
88843ab0 2456
18a48e76
MM		 2457 /* Control header is populated later */
2458 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
2459 put_unaligned_le32(0, skb_put(skb, L2CAP_EXT_CTRL_SIZE));
2460 else
2461 put_unaligned_le16(0, skb_put(skb, L2CAP_ENH_CTRL_SIZE));
88843ab0 2462
c74e560c 2463 if (sdulen)
03a51213 2464 put_unaligned_le16(sdulen, skb_put(skb, L2CAP_SDULEN_SIZE));
1c2acffb 2465
0952a57a 2466 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
1c2acffb
GP		 2467 if (unlikely(err < 0)) {
2468 kfree_skb(skb);
2469 return ERR_PTR(err);
2470 }
e90bac06 2471
a4368ff3
JH		 2472 bt_cb(skb)->l2cap.fcs = chan->fcs;
2473 bt_cb(skb)->l2cap.retries = 0;
1c2acffb 2474 return skb;
1da177e4
LT		 2475}
2476
94122bbe
MM		 2477static int l2cap_segment_sdu(struct l2cap_chan *chan,
2478 struct sk_buff_head *seg_queue,
2479 struct msghdr *msg, size_t len)
c74e560c 2480{
c74e560c 2481 struct sk_buff *skb;
94122bbe
MM		 2482 u16 sdu_len;
2483 size_t pdu_len;
94122bbe 2484 u8 sar;
c74e560c 2485
b4400672 2486 BT_DBG("chan %p, msg %p, len %zu", chan, msg, len);
c74e560c 2487
94122bbe
MM		 2488 /* It is critical that ERTM PDUs fit in a single HCI fragment,
2489 * so fragmented skbs are not used. The HCI layer's handling
2490 * of fragmented skbs is not compatible with ERTM's queueing.
2491 */
c74e560c 2492
94122bbe
MM		 2493 /* PDU size is derived from the HCI MTU */
2494 pdu_len = chan->conn->mtu;
c74e560c 2495
a549574d
MM		 2496 /* Constrain PDU size for BR/EDR connections */
2497 if (!chan->hs_hcon)
2498 pdu_len = min_t(size_t, pdu_len, L2CAP_BREDR_MAX_PAYLOAD);
94122bbe
MM		 2499
2500 /* Adjust for largest possible L2CAP overhead. */
35d401df
GP		 2501 if (chan->fcs)
2502 pdu_len -= L2CAP_FCS_SIZE;
2503
ba7aa64f 2504 pdu_len -= __ertm_hdr_size(chan);
94122bbe
MM		 2505
2506 /* Remote device may have requested smaller PDUs */
2507 pdu_len = min_t(size_t, pdu_len, chan->remote_mps);
2508
2509 if (len <= pdu_len) {
2510 sar = L2CAP_SAR_UNSEGMENTED;
2511 sdu_len = 0;
2512 pdu_len = len;
2513 } else {
2514 sar = L2CAP_SAR_START;
2515 sdu_len = len;
94122bbe
MM		 2516 }
2517
2518 while (len > 0) {
2519 skb = l2cap_create_iframe_pdu(chan, msg, pdu_len, sdu_len);
c74e560c 2520
c74e560c 2521 if (IS_ERR(skb)) {
94122bbe 2522 __skb_queue_purge(seg_queue);
c74e560c
GP		 2523 return PTR_ERR(skb);
2524 }
2525
a4368ff3 2526 bt_cb(skb)->l2cap.sar = sar;
94122bbe
MM		 2527 __skb_queue_tail(seg_queue, skb);
2528
2529 len -= pdu_len;
069cb270 2530 if (sdu_len)
94122bbe 2531 sdu_len = 0;
94122bbe
MM		 2532
2533 if (len <= pdu_len) {
2534 sar = L2CAP_SAR_END;
2535 pdu_len = len;
2536 } else {
2537 sar = L2CAP_SAR_CONTINUE;
2538 }
c74e560c 2539 }
c74e560c 2540
f0f62799 2541 return 0;
c74e560c
GP		 2542}
2543
177f8f2b
JH		 2544static struct sk_buff *l2cap_create_le_flowctl_pdu(struct l2cap_chan *chan,
2545 struct msghdr *msg,
2546 size_t len, u16 sdulen)
2547{
2548 struct l2cap_conn *conn = chan->conn;
2549 struct sk_buff *skb;
2550 int err, count, hlen;
2551 struct l2cap_hdr *lh;
2552
2553 BT_DBG("chan %p len %zu", chan, len);
2554
2555 if (!conn)
2556 return ERR_PTR(-ENOTCONN);
2557
2558 hlen = L2CAP_HDR_SIZE;
2559
2560 if (sdulen)
2561 hlen += L2CAP_SDULEN_SIZE;
2562
2563 count = min_t(unsigned int, (conn->mtu - hlen), len);
2564
d9fbd02b 2565 skb = chan->ops->alloc_skb(chan, hlen, count,
177f8f2b
JH		 2566 msg->msg_flags & MSG_DONTWAIT);
2567 if (IS_ERR(skb))
2568 return skb;
2569
2570 /* Create L2CAP header */
4df864c1 2571 lh = skb_put(skb, L2CAP_HDR_SIZE);
177f8f2b
JH		 2572 lh->cid = cpu_to_le16(chan->dcid);
2573 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
2574
2575 if (sdulen)
2576 put_unaligned_le16(sdulen, skb_put(skb, L2CAP_SDULEN_SIZE));
2577
2578 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
2579 if (unlikely(err < 0)) {
2580 kfree_skb(skb);
2581 return ERR_PTR(err);
2582 }
2583
2584 return skb;
2585}
2586
2587static int l2cap_segment_le_sdu(struct l2cap_chan *chan,
2588 struct sk_buff_head *seg_queue,
2589 struct msghdr *msg, size_t len)
2590{
2591 struct sk_buff *skb;
2592 size_t pdu_len;
2593 u16 sdu_len;
2594
2595 BT_DBG("chan %p, msg %p, len %zu", chan, msg, len);
2596
177f8f2b 2597 sdu_len = len;
72c6fb91 2598 pdu_len = chan->remote_mps - L2CAP_SDULEN_SIZE;
177f8f2b
JH		 2599
2600 while (len > 0) {
2601 if (len <= pdu_len)
2602 pdu_len = len;
2603
2604 skb = l2cap_create_le_flowctl_pdu(chan, msg, pdu_len, sdu_len);
2605 if (IS_ERR(skb)) {
2606 __skb_queue_purge(seg_queue);
2607 return PTR_ERR(skb);
2608 }
2609
2610 __skb_queue_tail(seg_queue, skb);
2611
2612 len -= pdu_len;
2613
2614 if (sdu_len) {
2615 sdu_len = 0;
2616 pdu_len += L2CAP_SDULEN_SIZE;
2617 }
2618 }
2619
2620 return 0;
2621}
2622
8a505b7f
LAD		 2623static void l2cap_le_flowctl_send(struct l2cap_chan *chan)
2624{
2625 int sent = 0;
2626
2627 BT_DBG("chan %p", chan);
2628
2629 while (chan->tx_credits && !skb_queue_empty(&chan->tx_q)) {
2630 l2cap_do_send(chan, skb_dequeue(&chan->tx_q));
2631 chan->tx_credits--;
2632 sent++;
2633 }
2634
2635 BT_DBG("Sent %d credits %u queued %u", sent, chan->tx_credits,
2636 skb_queue_len(&chan->tx_q));
2637}
2638
8d46321c 2639int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len)
9a91a04a 2640{
9a91a04a 2641 struct sk_buff *skb;
9a91a04a 2642 int err;
94122bbe 2643 struct sk_buff_head seg_queue;
9a91a04a 2644
31e8ce80
SWK		 2645 if (!chan->conn)
2646 return -ENOTCONN;
2647
9a91a04a 2648 /* Connectionless channel */
715ec005 2649 if (chan->chan_type == L2CAP_CHAN_CONN_LESS) {
8d46321c 2650 skb = l2cap_create_connless_pdu(chan, msg, len);
9a91a04a
GP		 2651 if (IS_ERR(skb))
2652 return PTR_ERR(skb);
2653
ede81a2a
AK		 2654 /* Channel lock is released before requesting new skb and then
2655 * reacquired thus we need to recheck channel state.
2656 */
2657 if (chan->state != BT_CONNECTED) {
2658 kfree_skb(skb);
2659 return -ENOTCONN;
2660 }
2661
9a91a04a
GP		 2662 l2cap_do_send(chan, skb);
2663 return len;
2664 }
2665
2666 switch (chan->mode) {
38319713 2667 case L2CAP_MODE_LE_FLOWCTL:
15f02b91 2668 case L2CAP_MODE_EXT_FLOWCTL:
177f8f2b
JH		 2669 /* Check outgoing MTU */
2670 if (len > chan->omtu)
2671 return -EMSGSIZE;
2672
177f8f2b
JH		 2673 __skb_queue_head_init(&seg_queue);
2674
2675 err = l2cap_segment_le_sdu(chan, &seg_queue, msg, len);
2676
2677 if (chan->state != BT_CONNECTED) {
2678 __skb_queue_purge(&seg_queue);
2679 err = -ENOTCONN;
2680 }
2681
2682 if (err)
2683 return err;
2684
2685 skb_queue_splice_tail_init(&seg_queue, &chan->tx_q);
2686
8a505b7f 2687 l2cap_le_flowctl_send(chan);
177f8f2b
JH		 2688
2689 if (!chan->tx_credits)
2690 chan->ops->suspend(chan);
2691
2692 err = len;
2693
2694 break;
2695
fad5fc89 2696 case L2CAP_MODE_BASIC:
9a91a04a
GP		 2697 /* Check outgoing MTU */
2698 if (len > chan->omtu)
2699 return -EMSGSIZE;
2700
2701 /* Create a basic PDU */
8d46321c 2702 skb = l2cap_create_basic_pdu(chan, msg, len);
9a91a04a
GP		 2703 if (IS_ERR(skb))
2704 return PTR_ERR(skb);
2705
ede81a2a
AK		 2706 /* Channel lock is released before requesting new skb and then
2707 * reacquired thus we need to recheck channel state.
2708 */
2709 if (chan->state != BT_CONNECTED) {
2710 kfree_skb(skb);
2711 return -ENOTCONN;
2712 }
2713
9a91a04a
GP		 2714 l2cap_do_send(chan, skb);
2715 err = len;
2716 break;
2717
2718 case L2CAP_MODE_ERTM:
2719 case L2CAP_MODE_STREAMING:
94122bbe
MM		 2720 /* Check outgoing MTU */
2721 if (len > chan->omtu) {
2722 err = -EMSGSIZE;
2723 break;
2724 }
9a91a04a 2725
94122bbe 2726 __skb_queue_head_init(&seg_queue);
9a91a04a 2727
94122bbe
MM		 2728 /* Do segmentation before calling in to the state machine,
2729 * since it's possible to block while waiting for memory
2730 * allocation.
2731 */
2732 err = l2cap_segment_sdu(chan, &seg_queue, msg, len);
9a91a04a 2733
94122bbe
MM		 2734 /* The channel could have been closed while segmenting,
2735 * check that it is still connected.
2736 */
2737 if (chan->state != BT_CONNECTED) {
2738 __skb_queue_purge(&seg_queue);
2739 err = -ENOTCONN;
9a91a04a
GP		 2740 }
2741
94122bbe 2742 if (err)
9a91a04a 2743 break;
9a91a04a 2744
3733937d 2745 if (chan->mode == L2CAP_MODE_ERTM)
d660366d 2746 l2cap_tx(chan, NULL, &seg_queue, L2CAP_EV_DATA_REQUEST);
3733937d 2747 else
d660366d 2748 l2cap_streaming_send(chan, &seg_queue);
9a91a04a 2749
d660366d 2750 err = len;
9a91a04a 2751
94122bbe
MM		 2752 /* If the skbs were not queued for sending, they'll still be in
2753 * seg_queue and need to be purged.
2754 */
2755 __skb_queue_purge(&seg_queue);
9a91a04a
GP		 2756 break;
2757
2758 default:
2759 BT_DBG("bad state %1.1x", chan->mode);
2760 err = -EBADFD;
2761 }
2762
2763 return err;
2764}
6b8d4a6a 2765EXPORT_SYMBOL_GPL(l2cap_chan_send);
9a91a04a 2766
d2a7ac5d
MM		 2767static void l2cap_send_srej(struct l2cap_chan *chan, u16 txseq)
2768{
bed68bde
MM		 2769 struct l2cap_ctrl control;
2770 u16 seq;
2771
b4400672 2772 BT_DBG("chan %p, txseq %u", chan, txseq);
bed68bde
MM		 2773
2774 memset(&control, 0, sizeof(control));
2775 control.sframe = 1;
2776 control.super = L2CAP_SUPER_SREJ;
2777
2778 for (seq = chan->expected_tx_seq; seq != txseq;
2779 seq = __next_seq(chan, seq)) {
2780 if (!l2cap_ertm_seq_in_queue(&chan->srej_q, seq)) {
2781 control.reqseq = seq;
2782 l2cap_send_sframe(chan, &control);
2783 l2cap_seq_list_append(&chan->srej_list, seq);
2784 }
2785 }
2786
2787 chan->expected_tx_seq = __next_seq(chan, txseq);
d2a7ac5d
MM		 2788}
2789
2790static void l2cap_send_srej_tail(struct l2cap_chan *chan)
2791{
bed68bde
MM		 2792 struct l2cap_ctrl control;
2793
2794 BT_DBG("chan %p", chan);
2795
2796 if (chan->srej_list.tail == L2CAP_SEQ_LIST_CLEAR)
2797 return;
2798
2799 memset(&control, 0, sizeof(control));
2800 control.sframe = 1;
2801 control.super = L2CAP_SUPER_SREJ;
2802 control.reqseq = chan->srej_list.tail;
2803 l2cap_send_sframe(chan, &control);
d2a7ac5d
MM		 2804}
2805
2806static void l2cap_send_srej_list(struct l2cap_chan *chan, u16 txseq)
2807{
bed68bde
MM		 2808 struct l2cap_ctrl control;
2809 u16 initial_head;
2810 u16 seq;
2811
b4400672 2812 BT_DBG("chan %p, txseq %u", chan, txseq);
bed68bde
MM		 2813
2814 memset(&control, 0, sizeof(control));
2815 control.sframe = 1;
2816 control.super = L2CAP_SUPER_SREJ;
2817
2818 /* Capture initial list head to allow only one pass through the list. */
2819 initial_head = chan->srej_list.head;
2820
2821 do {
2822 seq = l2cap_seq_list_pop(&chan->srej_list);
2823 if (seq == txseq || seq == L2CAP_SEQ_LIST_CLEAR)
2824 break;
2825
2826 control.reqseq = seq;
2827 l2cap_send_sframe(chan, &control);
2828 l2cap_seq_list_append(&chan->srej_list, seq);
2829 } while (chan->srej_list.head != initial_head);
d2a7ac5d
MM		 2830}
2831
608bcc6d
MM		 2832static void l2cap_process_reqseq(struct l2cap_chan *chan, u16 reqseq)
2833{
2834 struct sk_buff *acked_skb;
2835 u16 ackseq;
2836
b4400672 2837 BT_DBG("chan %p, reqseq %u", chan, reqseq);
608bcc6d
MM		 2838
2839 if (chan->unacked_frames == 0 || reqseq == chan->expected_ack_seq)
2840 return;
2841
b4400672 2842 BT_DBG("expected_ack_seq %u, unacked_frames %u",
608bcc6d
MM		 2843 chan->expected_ack_seq, chan->unacked_frames);
2844
2845 for (ackseq = chan->expected_ack_seq; ackseq != reqseq;
2846 ackseq = __next_seq(chan, ackseq)) {
2847
2848 acked_skb = l2cap_ertm_seq_in_queue(&chan->tx_q, ackseq);
2849 if (acked_skb) {
2850 skb_unlink(acked_skb, &chan->tx_q);
2851 kfree_skb(acked_skb);
2852 chan->unacked_frames--;
2853 }
2854 }
2855
2856 chan->expected_ack_seq = reqseq;
2857
2858 if (chan->unacked_frames == 0)
2859 __clear_retrans_timer(chan);
2860
b4400672 2861 BT_DBG("unacked_frames %u", chan->unacked_frames);
608bcc6d
MM		 2862}
2863
2864static void l2cap_abort_rx_srej_sent(struct l2cap_chan *chan)
2865{
2866 BT_DBG("chan %p", chan);
2867
2868 chan->expected_tx_seq = chan->buffer_seq;
2869 l2cap_seq_list_clear(&chan->srej_list);
2870 skb_queue_purge(&chan->srej_q);
2871 chan->rx_state = L2CAP_RX_STATE_RECV;
2872}
2873
d660366d
GP		 2874static void l2cap_tx_state_xmit(struct l2cap_chan *chan,
2875 struct l2cap_ctrl *control,
2876 struct sk_buff_head *skbs, u8 event)
608bcc6d 2877{
608bcc6d
MM		 2878 BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,
2879 event);
2880
2881 switch (event) {
2882 case L2CAP_EV_DATA_REQUEST:
2883 if (chan->tx_send_head == NULL)
2884 chan->tx_send_head = skb_peek(skbs);
2885
2886 skb_queue_splice_tail_init(skbs, &chan->tx_q);
2887 l2cap_ertm_send(chan);
2888 break;
2889 case L2CAP_EV_LOCAL_BUSY_DETECTED:
2890 BT_DBG("Enter LOCAL_BUSY");
2891 set_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2892
2893 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
2894 /* The SREJ_SENT state must be aborted if we are to
2895 * enter the LOCAL_BUSY state.
2896 */
2897 l2cap_abort_rx_srej_sent(chan);
2898 }
2899
2900 l2cap_send_ack(chan);
2901
2902 break;
2903 case L2CAP_EV_LOCAL_BUSY_CLEAR:
2904 BT_DBG("Exit LOCAL_BUSY");
2905 clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2906
2907 if (test_bit(CONN_RNR_SENT, &chan->conn_state)) {
2908 struct l2cap_ctrl local_control;
2909
2910 memset(&local_control, 0, sizeof(local_control));
2911 local_control.sframe = 1;
2912 local_control.super = L2CAP_SUPER_RR;
2913 local_control.poll = 1;
2914 local_control.reqseq = chan->buffer_seq;
a67d7f6f 2915 l2cap_send_sframe(chan, &local_control);
608bcc6d
MM		 2916
2917 chan->retry_count = 1;
2918 __set_monitor_timer(chan);
2919 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2920 }
2921 break;
2922 case L2CAP_EV_RECV_REQSEQ_AND_FBIT:
2923 l2cap_process_reqseq(chan, control->reqseq);
2924 break;
2925 case L2CAP_EV_EXPLICIT_POLL:
2926 l2cap_send_rr_or_rnr(chan, 1);
2927 chan->retry_count = 1;
2928 __set_monitor_timer(chan);
2929 __clear_ack_timer(chan);
2930 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2931 break;
2932 case L2CAP_EV_RETRANS_TO:
2933 l2cap_send_rr_or_rnr(chan, 1);
2934 chan->retry_count = 1;
2935 __set_monitor_timer(chan);
2936 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2937 break;
2938 case L2CAP_EV_RECV_FBIT:
2939 /* Nothing to process */
2940 break;
2941 default:
2942 break;
2943 }
608bcc6d
MM		 2944}
2945
d660366d
GP		 2946static void l2cap_tx_state_wait_f(struct l2cap_chan *chan,
2947 struct l2cap_ctrl *control,
2948 struct sk_buff_head *skbs, u8 event)
608bcc6d 2949{
608bcc6d
MM		 2950 BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,
2951 event);
2952
2953 switch (event) {
2954 case L2CAP_EV_DATA_REQUEST:
2955 if (chan->tx_send_head == NULL)
2956 chan->tx_send_head = skb_peek(skbs);
2957 /* Queue data, but don't send. */
2958 skb_queue_splice_tail_init(skbs, &chan->tx_q);
2959 break;
2960 case L2CAP_EV_LOCAL_BUSY_DETECTED:
2961 BT_DBG("Enter LOCAL_BUSY");
2962 set_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2963
2964 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
2965 /* The SREJ_SENT state must be aborted if we are to
2966 * enter the LOCAL_BUSY state.
2967 */
2968 l2cap_abort_rx_srej_sent(chan);
2969 }
2970
2971 l2cap_send_ack(chan);
2972
2973 break;
2974 case L2CAP_EV_LOCAL_BUSY_CLEAR:
2975 BT_DBG("Exit LOCAL_BUSY");
2976 clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2977
2978 if (test_bit(CONN_RNR_SENT, &chan->conn_state)) {
2979 struct l2cap_ctrl local_control;
2980 memset(&local_control, 0, sizeof(local_control));
2981 local_control.sframe = 1;
2982 local_control.super = L2CAP_SUPER_RR;
2983 local_control.poll = 1;
2984 local_control.reqseq = chan->buffer_seq;
a67d7f6f 2985 l2cap_send_sframe(chan, &local_control);
608bcc6d
MM		 2986
2987 chan->retry_count = 1;
2988 __set_monitor_timer(chan);
2989 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2990 }
2991 break;
2992 case L2CAP_EV_RECV_REQSEQ_AND_FBIT:
2993 l2cap_process_reqseq(chan, control->reqseq);
19186c7b 2994 fallthrough;
608bcc6d
MM		 2995
2996 case L2CAP_EV_RECV_FBIT:
2997 if (control && control->final) {
2998 __clear_monitor_timer(chan);
2999 if (chan->unacked_frames > 0)
3000 __set_retrans_timer(chan);
3001 chan->retry_count = 0;
3002 chan->tx_state = L2CAP_TX_STATE_XMIT;
3003 BT_DBG("recv fbit tx_state 0x2.2%x", chan->tx_state);
3004 }
3005 break;
3006 case L2CAP_EV_EXPLICIT_POLL:
3007 /* Ignore */
3008 break;
3009 case L2CAP_EV_MONITOR_TO:
3010 if (chan->max_tx == 0 || chan->retry_count < chan->max_tx) {
3011 l2cap_send_rr_or_rnr(chan, 1);
3012 __set_monitor_timer(chan);
3013 chan->retry_count++;
3014 } else {
5e4e3972 3015 l2cap_send_disconn_req(chan, ECONNABORTED);
608bcc6d
MM		 3016 }
3017 break;
3018 default:
3019 break;
3020 }
608bcc6d
MM		 3021}
3022
d660366d
GP		 3023static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
3024 struct sk_buff_head *skbs, u8 event)
608bcc6d 3025{
608bcc6d
MM		 3026 BT_DBG("chan %p, control %p, skbs %p, event %d, state %d",
3027 chan, control, skbs, event, chan->tx_state);
3028
3029 switch (chan->tx_state) {
3030 case L2CAP_TX_STATE_XMIT:
d660366d 3031 l2cap_tx_state_xmit(chan, control, skbs, event);
608bcc6d
MM		 3032 break;
3033 case L2CAP_TX_STATE_WAIT_F:
d660366d 3034 l2cap_tx_state_wait_f(chan, control, skbs, event);
608bcc6d
MM		 3035 break;
3036 default:
3037 /* Ignore event */
3038 break;
3039 }
608bcc6d
MM		 3040}
3041
4b51dae9
MM		 3042static void l2cap_pass_to_tx(struct l2cap_chan *chan,
3043 struct l2cap_ctrl *control)
3044{
3045 BT_DBG("chan %p, control %p", chan, control);
401bb1f7 3046 l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_REQSEQ_AND_FBIT);
4b51dae9
MM		 3047}
3048
f80842a8
MM		 3049static void l2cap_pass_to_tx_fbit(struct l2cap_chan *chan,
3050 struct l2cap_ctrl *control)
3051{
3052 BT_DBG("chan %p, control %p", chan, control);
401bb1f7 3053 l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_FBIT);
f80842a8
MM		 3054}
3055
1da177e4
LT		 3056/* Copy frame to all raw sockets on that connection */
3057static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb)
3058{
1da177e4 3059 struct sk_buff *nskb;
48454079 3060 struct l2cap_chan *chan;
1da177e4
LT		 3061
3062 BT_DBG("conn %p", conn);
3063
3df91ea2 3064 mutex_lock(&conn->chan_lock);
3d57dc68 3065
3df91ea2 3066 list_for_each_entry(chan, &conn->chan_l, list) {
715ec005 3067 if (chan->chan_type != L2CAP_CHAN_RAW)
1da177e4
LT		 3068 continue;
3069
7f5396a7 3070 /* Don't send frame to the channel it came from */
a4368ff3 3071 if (bt_cb(skb)->l2cap.chan == chan)
1da177e4 3072 continue;
7f5396a7 3073
8bcde1f2 3074 nskb = skb_clone(skb, GFP_KERNEL);
af05b30b 3075 if (!nskb)
1da177e4 3076 continue;
80b98027 3077 if (chan->ops->recv(chan, nskb))
1da177e4
LT		 3078 kfree_skb(nskb);
3079 }
3d57dc68 3080
3df91ea2 3081 mutex_unlock(&conn->chan_lock);
1da177e4
LT		 3082}
3083
3084/* ---- L2CAP signalling commands ---- */
b4400672
AE		 3085static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn, u8 code,
3086 u8 ident, u16 dlen, void *data)
1da177e4
LT		 3087{
3088 struct sk_buff *skb, **frag;
3089 struct l2cap_cmd_hdr *cmd;
3090 struct l2cap_hdr *lh;
3091 int len, count;
3092
b4400672
AE		 3093 BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %u",
3094 conn, code, ident, dlen);
1da177e4 3095
300b962e
AL		 3096 if (conn->mtu < L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE)
3097 return NULL;
3098
1da177e4
LT		 3099 len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen;
3100 count = min_t(unsigned int, conn->mtu, len);
3101
8bcde1f2 3102 skb = bt_skb_alloc(count, GFP_KERNEL);
1da177e4
LT		 3103 if (!skb)
3104 return NULL;
3105
4df864c1 3106 lh = skb_put(skb, L2CAP_HDR_SIZE);
aca3192c 3107 lh->len = cpu_to_le16(L2CAP_CMD_HDR_SIZE + dlen);
3300d9a9
CT		 3108
3109 if (conn->hcon->type == LE_LINK)
dcf4adbf 3110 lh->cid = cpu_to_le16(L2CAP_CID_LE_SIGNALING);
3300d9a9 3111 else
dcf4adbf 3112 lh->cid = cpu_to_le16(L2CAP_CID_SIGNALING);
1da177e4 3113
4df864c1 3114 cmd = skb_put(skb, L2CAP_CMD_HDR_SIZE);
1da177e4
LT		 3115 cmd->code = code;
3116 cmd->ident = ident;
aca3192c 3117 cmd->len = cpu_to_le16(dlen);
1da177e4
LT		 3118
3119 if (dlen) {
3120 count -= L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE;
59ae1d12 3121 skb_put_data(skb, data, count);
1da177e4
LT		 3122 data += count;
3123 }
3124
3125 len -= skb->len;
3126
3127 /* Continuation fragments (no L2CAP header) */
3128 frag = &skb_shinfo(skb)->frag_list;
3129 while (len) {
3130 count = min_t(unsigned int, conn->mtu, len);
3131
8bcde1f2 3132 *frag = bt_skb_alloc(count, GFP_KERNEL);
1da177e4
LT		 3133 if (!*frag)
3134 goto fail;
3135
59ae1d12 3136 skb_put_data(*frag, data, count);
1da177e4
LT		 3137
3138 len -= count;
3139 data += count;
3140
3141 frag = &(*frag)->next;
3142 }
3143
3144 return skb;
3145
3146fail:
3147 kfree_skb(skb);
3148 return NULL;
3149}
3150
2d792818
GP		 3151static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen,
3152 unsigned long *val)
1da177e4
LT		 3153{
3154 struct l2cap_conf_opt *opt = *ptr;
3155 int len;
3156
3157 len = L2CAP_CONF_OPT_SIZE + opt->len;
3158 *ptr += len;
3159
3160 *type = opt->type;
3161 *olen = opt->len;
3162
3163 switch (opt->len) {
3164 case 1:
3165 *val = *((u8 *) opt->val);
3166 break;
3167
3168 case 2:
bfaaeb3e 3169 *val = get_unaligned_le16(opt->val);
1da177e4
LT		 3170 break;
3171
3172 case 4:
bfaaeb3e 3173 *val = get_unaligned_le32(opt->val);
1da177e4
LT		 3174 break;
3175
3176 default:
3177 *val = (unsigned long) opt->val;
3178 break;
3179 }
3180
b4400672 3181 BT_DBG("type 0x%2.2x len %u val 0x%lx", *type, opt->len, *val);
1da177e4
LT		 3182 return len;
3183}
3184
e860d2c9 3185static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val, size_t size)
1da177e4
LT		 3186{
3187 struct l2cap_conf_opt *opt = *ptr;
3188
b4400672 3189 BT_DBG("type 0x%2.2x len %u val 0x%lx", type, len, val);
1da177e4 3190
e860d2c9
BS		 3191 if (size < L2CAP_CONF_OPT_SIZE + len)
3192 return;
3193
1da177e4
LT		 3194 opt->type = type;
3195 opt->len = len;
3196
3197 switch (len) {
3198 case 1:
3199 *((u8 *) opt->val) = val;
3200 break;
3201
3202 case 2:
4f8b691c 3203 put_unaligned_le16(val, opt->val);
1da177e4
LT		 3204 break;
3205
3206 case 4:
4f8b691c 3207 put_unaligned_le32(val, opt->val);
1da177e4
LT		 3208 break;
3209
3210 default:
3211 memcpy(opt->val, (void *) val, len);
3212 break;
3213 }
3214
3215 *ptr += L2CAP_CONF_OPT_SIZE + len;
3216}
3217
e860d2c9 3218static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan, size_t size)
f89cef09
AE		 3219{
3220 struct l2cap_conf_efs efs;
3221
1ec918ce 3222 switch (chan->mode) {
f89cef09
AE		 3223 case L2CAP_MODE_ERTM:
3224 efs.id = chan->local_id;
3225 efs.stype = chan->local_stype;
3226 efs.msdu = cpu_to_le16(chan->local_msdu);
3227 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime);
dcf4adbf
JP		 3228 efs.acc_lat = cpu_to_le32(L2CAP_DEFAULT_ACC_LAT);
3229 efs.flush_to = cpu_to_le32(L2CAP_EFS_DEFAULT_FLUSH_TO);
f89cef09
AE		 3230 break;
3231
3232 case L2CAP_MODE_STREAMING:
3233 efs.id = 1;
3234 efs.stype = L2CAP_SERV_BESTEFFORT;
3235 efs.msdu = cpu_to_le16(chan->local_msdu);
3236 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime);
3237 efs.acc_lat = 0;
3238 efs.flush_to = 0;
3239 break;
3240
3241 default:
3242 return;
3243 }
3244
3245 l2cap_add_conf_opt(ptr, L2CAP_CONF_EFS, sizeof(efs),
e860d2c9 3246 (unsigned long) &efs, size);
f89cef09
AE		 3247}
3248
721c4181 3249static void l2cap_ack_timeout(struct work_struct *work)
c1b4f43b 3250{
721c4181 3251 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
0362520b
MM		 3252 ack_timer.work);
3253 u16 frames_to_ack;
c1b4f43b 3254
2fb9b3d4
GP		 3255 BT_DBG("chan %p", chan);
3256
6be36555
AE		 3257 l2cap_chan_lock(chan);
3258
0362520b
MM		 3259 frames_to_ack = __seq_offset(chan, chan->buffer_seq,
3260 chan->last_acked_seq);
6be36555 3261
0362520b
MM		 3262 if (frames_to_ack)
3263 l2cap_send_rr_or_rnr(chan, 0);
09bfb2ee 3264
0362520b 3265 l2cap_chan_unlock(chan);
09bfb2ee 3266 l2cap_chan_put(chan);
c1b4f43b
GP		 3267}
3268
466f8004 3269int l2cap_ertm_init(struct l2cap_chan *chan)
0565c1c2 3270{
3c588192
MM		 3271 int err;
3272
105bdf9e
MM		 3273 chan->next_tx_seq = 0;
3274 chan->expected_tx_seq = 0;
42e5c802 3275 chan->expected_ack_seq = 0;
6a026610 3276 chan->unacked_frames = 0;
42e5c802 3277 chan->buffer_seq = 0;
6a026610 3278 chan->frames_sent = 0;
105bdf9e
MM		 3279 chan->last_acked_seq = 0;
3280 chan->sdu = NULL;
3281 chan->sdu_last_frag = NULL;
3282 chan->sdu_len = 0;
3283
d34c34fb
MM		 3284 skb_queue_head_init(&chan->tx_q);
3285
6ed971ca
MH		 3286 chan->local_amp_id = AMP_ID_BREDR;
3287 chan->move_id = AMP_ID_BREDR;
08333283
MM		 3288 chan->move_state = L2CAP_MOVE_STABLE;
3289 chan->move_role = L2CAP_MOVE_ROLE_NONE;
3290
105bdf9e
MM		 3291 if (chan->mode != L2CAP_MODE_ERTM)
3292 return 0;
3293
3294 chan->rx_state = L2CAP_RX_STATE_RECV;
3295 chan->tx_state = L2CAP_TX_STATE_XMIT;
0565c1c2 3296
721c4181
GP		 3297 INIT_DELAYED_WORK(&chan->retrans_timer, l2cap_retrans_timeout);
3298 INIT_DELAYED_WORK(&chan->monitor_timer, l2cap_monitor_timeout);
3299 INIT_DELAYED_WORK(&chan->ack_timer, l2cap_ack_timeout);
0565c1c2 3300
f1c6775b 3301 skb_queue_head_init(&chan->srej_q);
1890d36b 3302
3c588192
MM		 3303 err = l2cap_seq_list_init(&chan->srej_list, chan->tx_win);
3304 if (err < 0)
3305 return err;
3306
9dc9affc
MM		 3307 err = l2cap_seq_list_init(&chan->retrans_list, chan->remote_tx_win);
3308 if (err < 0)
3309 l2cap_seq_list_free(&chan->srej_list);
3310
3311 return err;
0565c1c2
GP		 3312}
3313
f2fcfcd6
GP		 3314static inline __u8 l2cap_select_mode(__u8 mode, __u16 remote_feat_mask)
3315{
3316 switch (mode) {
3317 case L2CAP_MODE_STREAMING:
3318 case L2CAP_MODE_ERTM:
3319 if (l2cap_mode_supported(mode, remote_feat_mask))
3320 return mode;
19186c7b 3321 fallthrough;
f2fcfcd6
GP		 3322 default:
3323 return L2CAP_MODE_BASIC;
3324 }
3325}
3326
848566b3 3327static inline bool __l2cap_ews_supported(struct l2cap_conn *conn)
6327eb98 3328{
0bd49fc7
JH		 3329 return ((conn->local_fixed_chan & L2CAP_FC_A2MP) &&
3330 (conn->feat_mask & L2CAP_FEAT_EXT_WINDOW));
6327eb98
AE		 3331}
3332
848566b3 3333static inline bool __l2cap_efs_supported(struct l2cap_conn *conn)
f89cef09 3334{
0bd49fc7
JH		 3335 return ((conn->local_fixed_chan & L2CAP_FC_A2MP) &&
3336 (conn->feat_mask & L2CAP_FEAT_EXT_FLOW));
f89cef09
AE		 3337}
3338
36c86c85
MM		 3339static void __l2cap_set_ertm_timeouts(struct l2cap_chan *chan,
3340 struct l2cap_conf_rfc *rfc)
3341{
6ed971ca 3342 if (chan->local_amp_id != AMP_ID_BREDR && chan->hs_hcon) {
36c86c85
MM		 3343 u64 ertm_to = chan->hs_hcon->hdev->amp_be_flush_to;
3344
3345 /* Class 1 devices have must have ERTM timeouts
3346 * exceeding the Link Supervision Timeout. The
3347 * default Link Supervision Timeout for AMP
3348 * controllers is 10 seconds.
3349 *
3350 * Class 1 devices use 0xffffffff for their
3351 * best-effort flush timeout, so the clamping logic
3352 * will result in a timeout that meets the above
3353 * requirement. ERTM timeouts are 16-bit values, so
3354 * the maximum timeout is 65.535 seconds.
3355 */
3356
3357 /* Convert timeout to milliseconds and round */
3358 ertm_to = DIV_ROUND_UP_ULL(ertm_to, 1000);
3359
3360 /* This is the recommended formula for class 2 devices
3361 * that start ERTM timers when packets are sent to the
3362 * controller.
3363 */
3364 ertm_to = 3 * ertm_to + 500;
3365
3366 if (ertm_to > 0xffff)
3367 ertm_to = 0xffff;
3368
3369 rfc->retrans_timeout = cpu_to_le16((u16) ertm_to);
3370 rfc->monitor_timeout = rfc->retrans_timeout;
3371 } else {
dcf4adbf
JP		 3372 rfc->retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO);
3373 rfc->monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO);
36c86c85
MM		 3374 }
3375}
3376
6327eb98
AE		 3377static inline void l2cap_txwin_setup(struct l2cap_chan *chan)
3378{
3379 if (chan->tx_win > L2CAP_DEFAULT_TX_WINDOW &&
848566b3 3380 __l2cap_ews_supported(chan->conn)) {
6327eb98
AE		 3381 /* use extended control field */
3382 set_bit(FLAG_EXT_CTRL, &chan->flags);
836be934
AE		 3383 chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;
3384 } else {
6327eb98 3385 chan->tx_win = min_t(u16, chan->tx_win,
2d792818 3386 L2CAP_DEFAULT_TX_WINDOW);
836be934
AE		 3387 chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
3388 }
c20f8e35 3389 chan->ack_win = chan->tx_win;
6327eb98
AE		 3390}
3391
4b6e228e
LAD		 3392static void l2cap_mtu_auto(struct l2cap_chan *chan)
3393{
3394 struct hci_conn *conn = chan->conn->hcon;
3395
3396 chan->imtu = L2CAP_DEFAULT_MIN_MTU;
3397
3398 /* The 2-DH1 packet has between 2 and 56 information bytes
3399 * (including the 2-byte payload header)
3400 */
3401 if (!(conn->pkt_type & HCI_2DH1))
3402 chan->imtu = 54;
3403
3404 /* The 3-DH1 packet has between 2 and 85 information bytes
3405 * (including the 2-byte payload header)
3406 */
3407 if (!(conn->pkt_type & HCI_3DH1))
3408 chan->imtu = 83;
3409
3410 /* The 2-DH3 packet has between 2 and 369 information bytes
3411 * (including the 2-byte payload header)
3412 */
3413 if (!(conn->pkt_type & HCI_2DH3))
3414 chan->imtu = 367;
3415
3416 /* The 3-DH3 packet has between 2 and 554 information bytes
3417 * (including the 2-byte payload header)
3418 */
3419 if (!(conn->pkt_type & HCI_3DH3))
3420 chan->imtu = 552;
3421
3422 /* The 2-DH5 packet has between 2 and 681 information bytes
3423 * (including the 2-byte payload header)
3424 */
3425 if (!(conn->pkt_type & HCI_2DH5))
3426 chan->imtu = 679;
3427
3428 /* The 3-DH5 packet has between 2 and 1023 information bytes
3429 * (including the 2-byte payload header)
3430 */
3431 if (!(conn->pkt_type & HCI_3DH5))
3432 chan->imtu = 1021;
3433}
3434
e860d2c9 3435static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size)
1da177e4 3436{
1da177e4 3437 struct l2cap_conf_req *req = data;
0c1bc5c6 3438 struct l2cap_conf_rfc rfc = { .mode = chan->mode };
1da177e4 3439 void *ptr = req->data;
e860d2c9 3440 void *endptr = data + data_size;
c8f79162 3441 u16 size;
1da177e4 3442
49208c9c 3443 BT_DBG("chan %p", chan);
1da177e4 3444
73ffa904 3445 if (chan->num_conf_req || chan->num_conf_rsp)
f2fcfcd6
GP		 3446 goto done;
3447
0c1bc5c6 3448 switch (chan->mode) {
f2fcfcd6
GP		 3449 case L2CAP_MODE_STREAMING:
3450 case L2CAP_MODE_ERTM:
c1360a1c 3451 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state))
85eb53c6 3452 break;
85eb53c6 3453
848566b3 3454 if (__l2cap_efs_supported(chan->conn))
f89cef09
AE		 3455 set_bit(FLAG_EFS_ENABLE, &chan->flags);
3456
19186c7b 3457 fallthrough;
f2fcfcd6 3458 default:
8c1d787b 3459 chan->mode = l2cap_select_mode(rfc.mode, chan->conn->feat_mask);
f2fcfcd6
GP		 3460 break;
3461 }
3462
3463done:
4b6e228e
LAD		 3464 if (chan->imtu != L2CAP_DEFAULT_MTU) {
3465 if (!chan->imtu)
3466 l2cap_mtu_auto(chan);
3467 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu,
3468 endptr - ptr);
3469 }
7990681c 3470
0c1bc5c6 3471 switch (chan->mode) {
65c7c491 3472 case L2CAP_MODE_BASIC:
6fea7ad1
MH		 3473 if (disable_ertm)
3474 break;
3475
8c1d787b 3476 if (!(chan->conn->feat_mask & L2CAP_FEAT_ERTM) &&
2d792818 3477 !(chan->conn->feat_mask & L2CAP_FEAT_STREAMING))
63406504
GP		 3478 break;
3479
62547752
GP		 3480 rfc.mode = L2CAP_MODE_BASIC;
3481 rfc.txwin_size = 0;
3482 rfc.max_transmit = 0;
3483 rfc.retrans_timeout = 0;
3484 rfc.monitor_timeout = 0;
3485 rfc.max_pdu_size = 0;
3486
63406504 3487 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
e860d2c9 3488 (unsigned long) &rfc, endptr - ptr);
65c7c491
MH		 3489 break;
3490
3491 case L2CAP_MODE_ERTM:
3492 rfc.mode = L2CAP_MODE_ERTM;
47d1ec61 3493 rfc.max_transmit = chan->max_tx;
36c86c85
MM		 3494
3495 __l2cap_set_ertm_timeouts(chan, &rfc);
c8f79162
AE		 3496
3497 size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -
2d792818
GP		 3498 L2CAP_EXT_HDR_SIZE - L2CAP_SDULEN_SIZE -
3499 L2CAP_FCS_SIZE);
c8f79162 3500 rfc.max_pdu_size = cpu_to_le16(size);
f2fcfcd6 3501
6327eb98
AE		 3502 l2cap_txwin_setup(chan);
3503
3504 rfc.txwin_size = min_t(u16, chan->tx_win,
2d792818 3505 L2CAP_DEFAULT_TX_WINDOW);
f2fcfcd6 3506
63406504 3507 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
e860d2c9 3508 (unsigned long) &rfc, endptr - ptr);
63406504 3509
f89cef09 3510 if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
e860d2c9 3511 l2cap_add_opt_efs(&ptr, chan, endptr - ptr);
f89cef09 3512
6327eb98
AE		 3513 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
3514 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
e860d2c9 3515 chan->tx_win, endptr - ptr);
60918918
AE		 3516
3517 if (chan->conn->feat_mask & L2CAP_FEAT_FCS)
3518 if (chan->fcs == L2CAP_FCS_NONE ||
f2592d3e 3519 test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) {
60918918
AE		 3520 chan->fcs = L2CAP_FCS_NONE;
3521 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1,
e860d2c9 3522 chan->fcs, endptr - ptr);
60918918 3523 }
f2fcfcd6
GP		 3524 break;
3525
3526 case L2CAP_MODE_STREAMING:
273759e2 3527 l2cap_txwin_setup(chan);
f2fcfcd6
GP		 3528 rfc.mode = L2CAP_MODE_STREAMING;
3529 rfc.txwin_size = 0;
3530 rfc.max_transmit = 0;
3531 rfc.retrans_timeout = 0;
3532 rfc.monitor_timeout = 0;
c8f79162
AE		 3533
3534 size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -
2d792818
GP		 3535 L2CAP_EXT_HDR_SIZE - L2CAP_SDULEN_SIZE -
3536 L2CAP_FCS_SIZE);
c8f79162 3537 rfc.max_pdu_size = cpu_to_le16(size);
65c7c491 3538
63406504 3539 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
e860d2c9 3540 (unsigned long) &rfc, endptr - ptr);
63406504 3541
f89cef09 3542 if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
e860d2c9 3543 l2cap_add_opt_efs(&ptr, chan, endptr - ptr);
f89cef09 3544
60918918
AE		 3545 if (chan->conn->feat_mask & L2CAP_FEAT_FCS)
3546 if (chan->fcs == L2CAP_FCS_NONE ||
f2592d3e 3547 test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) {
60918918
AE		 3548 chan->fcs = L2CAP_FCS_NONE;
3549 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1,
e860d2c9 3550 chan->fcs, endptr - ptr);
60918918 3551 }
65c7c491
MH		 3552 break;
3553 }
1da177e4 3554
fe4128e0 3555 req->dcid = cpu_to_le16(chan->dcid);
dcf4adbf 3556 req->flags = cpu_to_le16(0);
1da177e4
LT		 3557
3558 return ptr - data;
3559}
3560
e860d2c9 3561static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data_size)
1da177e4 3562{
5dee9e7c
MH		 3563 struct l2cap_conf_rsp *rsp = data;
3564 void *ptr = rsp->data;
e860d2c9 3565 void *endptr = data + data_size;
73ffa904
GP		 3566 void *req = chan->conf_req;
3567 int len = chan->conf_len;
5dee9e7c
MH		 3568 int type, hint, olen;
3569 unsigned long val;
6464f35f 3570 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
42dceae2
AE		 3571 struct l2cap_conf_efs efs;
3572 u8 remote_efs = 0;
861d6882 3573 u16 mtu = L2CAP_DEFAULT_MTU;
5dee9e7c 3574 u16 result = L2CAP_CONF_SUCCESS;
c8f79162 3575 u16 size;
1da177e4 3576
73ffa904 3577 BT_DBG("chan %p", chan);
820ae1b8 3578
5dee9e7c
MH		 3579 while (len >= L2CAP_CONF_OPT_SIZE) {
3580 len -= l2cap_get_conf_opt(&req, &type, &olen, &val);
7c9cbd0b
MH		 3581 if (len < 0)
3582 break;
1da177e4 3583
589d2746 3584 hint = type & L2CAP_CONF_HINT;
47ec1dcd 3585 type &= L2CAP_CONF_MASK;
5dee9e7c
MH		 3586
3587 switch (type) {
3588 case L2CAP_CONF_MTU:
af3d5d1c
MH		 3589 if (olen != 2)
3590 break;
861d6882 3591 mtu = val;
5dee9e7c
MH		 3592 break;
3593
3594 case L2CAP_CONF_FLUSH_TO:
af3d5d1c
MH		 3595 if (olen != 2)
3596 break;
0c1bc5c6 3597 chan->flush_to = val;
5dee9e7c
MH		 3598 break;
3599
3600 case L2CAP_CONF_QOS:
3601 break;
3602
6464f35f 3603 case L2CAP_CONF_RFC:
af3d5d1c
MH		 3604 if (olen != sizeof(rfc))
3605 break;
3606 memcpy(&rfc, (void *) val, olen);
6464f35f
MH		 3607 break;
3608
fcc203c3 3609 case L2CAP_CONF_FCS:
af3d5d1c
MH		 3610 if (olen != 1)
3611 break;
fcc203c3 3612 if (val == L2CAP_FCS_NONE)
f2592d3e 3613 set_bit(CONF_RECV_NO_FCS, &chan->conf_state);
42dceae2 3614 break;
fcc203c3 3615
42dceae2 3616 case L2CAP_CONF_EFS:
af3d5d1c
MH		 3617 if (olen != sizeof(efs))
3618 break;
3619 remote_efs = 1;
3620 memcpy(&efs, (void *) val, olen);
fcc203c3
GP		 3621 break;
3622
6327eb98 3623 case L2CAP_CONF_EWS:
af3d5d1c
MH		 3624 if (olen != 2)
3625 break;
0bd49fc7 3626 if (!(chan->conn->local_fixed_chan & L2CAP_FC_A2MP))
6327eb98 3627 return -ECONNREFUSED;
6327eb98
AE		 3628 set_bit(FLAG_EXT_CTRL, &chan->flags);
3629 set_bit(CONF_EWS_RECV, &chan->conf_state);
836be934 3630 chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;
6327eb98 3631 chan->remote_tx_win = val;
fcc203c3
GP		 3632 break;
3633
5dee9e7c
MH		 3634 default:
3635 if (hint)
3636 break;
5dee9e7c 3637 result = L2CAP_CONF_UNKNOWN;
5b8ec15d 3638 l2cap_add_conf_opt(&ptr, (u8)type, sizeof(u8), type, endptr - ptr);
5dee9e7c
MH		 3639 break;
3640 }
3641 }
3642
73ffa904 3643 if (chan->num_conf_rsp || chan->num_conf_req > 1)
f2fcfcd6
GP		 3644 goto done;
3645
0c1bc5c6 3646 switch (chan->mode) {
f2fcfcd6
GP		 3647 case L2CAP_MODE_STREAMING:
3648 case L2CAP_MODE_ERTM:
c1360a1c 3649 if (!test_bit(CONF_STATE2_DEVICE, &chan->conf_state)) {
0c1bc5c6 3650 chan->mode = l2cap_select_mode(rfc.mode,
2d792818 3651 chan->conn->feat_mask);
85eb53c6
GP		 3652 break;
3653 }
3654
42dceae2 3655 if (remote_efs) {
848566b3 3656 if (__l2cap_efs_supported(chan->conn))
42dceae2
AE		 3657 set_bit(FLAG_EFS_ENABLE, &chan->flags);
3658 else
3659 return -ECONNREFUSED;
3660 }
3661
0c1bc5c6 3662 if (chan->mode != rfc.mode)
f2fcfcd6 3663 return -ECONNREFUSED;
742e519b 3664
f2fcfcd6 3665 break;
f2fcfcd6
GP		 3666 }
3667
3668done:
0c1bc5c6 3669 if (chan->mode != rfc.mode) {
f2fcfcd6 3670 result = L2CAP_CONF_UNACCEPT;
0c1bc5c6 3671 rfc.mode = chan->mode;
f2fcfcd6 3672
73ffa904 3673 if (chan->num_conf_rsp == 1)
f2fcfcd6
GP		 3674 return -ECONNREFUSED;
3675
2d792818 3676 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
e860d2c9 3677 (unsigned long) &rfc, endptr - ptr);
f2fcfcd6
GP		 3678 }
3679
5dee9e7c
MH		 3680 if (result == L2CAP_CONF_SUCCESS) {
3681 /* Configure output options and let the other side know
3682 * which ones we don't like. */
3683
f2fcfcd6
GP		 3684 if (mtu < L2CAP_DEFAULT_MIN_MTU)
3685 result = L2CAP_CONF_UNACCEPT;
3686 else {
0c1bc5c6 3687 chan->omtu = mtu;
c1360a1c 3688 set_bit(CONF_MTU_DONE, &chan->conf_state);
f2fcfcd6 3689 }
e860d2c9 3690 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu, endptr - ptr);
6464f35f 3691
42dceae2
AE		 3692 if (remote_efs) {
3693 if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
2d792818
GP		 3694 efs.stype != L2CAP_SERV_NOTRAFIC &&
3695 efs.stype != chan->local_stype) {
42dceae2
AE		 3696
3697 result = L2CAP_CONF_UNACCEPT;
3698
3699 if (chan->num_conf_req >= 1)
3700 return -ECONNREFUSED;
3701
3702 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
2d792818 3703 sizeof(efs),
e860d2c9 3704 (unsigned long) &efs, endptr - ptr);
0e8b207e 3705 } else {
3e6b3b95 3706 /* Send PENDING Conf Rsp */
0e8b207e
AE		 3707 result = L2CAP_CONF_PENDING;
3708 set_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
42dceae2
AE		 3709 }
3710 }
3711
f2fcfcd6
GP		 3712 switch (rfc.mode) {
3713 case L2CAP_MODE_BASIC:
47d1ec61 3714 chan->fcs = L2CAP_FCS_NONE;
c1360a1c 3715 set_bit(CONF_MODE_DONE, &chan->conf_state);
f2fcfcd6
GP		 3716 break;
3717
3718 case L2CAP_MODE_ERTM:
6327eb98
AE		 3719 if (!test_bit(CONF_EWS_RECV, &chan->conf_state))
3720 chan->remote_tx_win = rfc.txwin_size;
3721 else
3722 rfc.txwin_size = L2CAP_DEFAULT_TX_WINDOW;
86b1b263 3723
2c03a7a4 3724 chan->remote_max_tx = rfc.max_transmit;
1c762159 3725
c8f79162 3726 size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
2d792818
GP		 3727 chan->conn->mtu - L2CAP_EXT_HDR_SIZE -
3728 L2CAP_SDULEN_SIZE - L2CAP_FCS_SIZE);
c8f79162
AE		 3729 rfc.max_pdu_size = cpu_to_le16(size);
3730 chan->remote_mps = size;
f2fcfcd6 3731
36c86c85 3732 __l2cap_set_ertm_timeouts(chan, &rfc);
f2fcfcd6 3733
c1360a1c 3734 set_bit(CONF_MODE_DONE, &chan->conf_state);
68ae6639
GP		 3735
3736 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
e860d2c9 3737 sizeof(rfc), (unsigned long) &rfc, endptr - ptr);
68ae6639 3738
42dceae2
AE		 3739 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
3740 chan->remote_id = efs.id;
3741 chan->remote_stype = efs.stype;
3742 chan->remote_msdu = le16_to_cpu(efs.msdu);
3743 chan->remote_flush_to =
2d792818 3744 le32_to_cpu(efs.flush_to);
42dceae2 3745 chan->remote_acc_lat =
2d792818 3746 le32_to_cpu(efs.acc_lat);
42dceae2
AE		 3747 chan->remote_sdu_itime =
3748 le32_to_cpu(efs.sdu_itime);
3749 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
2d792818 3750 sizeof(efs),
e860d2c9 3751 (unsigned long) &efs, endptr - ptr);
42dceae2 3752 }
f2fcfcd6
GP		 3753 break;
3754
3755 case L2CAP_MODE_STREAMING:
c8f79162 3756 size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
2d792818
GP		 3757 chan->conn->mtu - L2CAP_EXT_HDR_SIZE -
3758 L2CAP_SDULEN_SIZE - L2CAP_FCS_SIZE);
c8f79162
AE		 3759 rfc.max_pdu_size = cpu_to_le16(size);
3760 chan->remote_mps = size;
f2fcfcd6 3761
c1360a1c 3762 set_bit(CONF_MODE_DONE, &chan->conf_state);
68ae6639 3763
2d792818 3764 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
e860d2c9 3765 (unsigned long) &rfc, endptr - ptr);
68ae6639 3766
f2fcfcd6
GP		 3767 break;
3768
3769 default:
5dee9e7c 3770 result = L2CAP_CONF_UNACCEPT;
5dee9e7c 3771
6464f35f 3772 memset(&rfc, 0, sizeof(rfc));
0c1bc5c6 3773 rfc.mode = chan->mode;
f2fcfcd6 3774 }
6464f35f 3775
f2fcfcd6 3776 if (result == L2CAP_CONF_SUCCESS)
c1360a1c 3777 set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
f2fcfcd6 3778 }
fe4128e0 3779 rsp->scid = cpu_to_le16(chan->dcid);
5dee9e7c 3780 rsp->result = cpu_to_le16(result);
dcf4adbf 3781 rsp->flags = cpu_to_le16(0);
5dee9e7c
MH		 3782
3783 return ptr - data;
1da177e4
LT		 3784}
3785
2d792818 3786static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,
e860d2c9 3787 void *data, size_t size, u16 *result)
f2fcfcd6 3788{
f2fcfcd6
GP		 3789 struct l2cap_conf_req *req = data;
3790 void *ptr = req->data;
e860d2c9 3791 void *endptr = data + size;
f2fcfcd6
GP		 3792 int type, olen;
3793 unsigned long val;
36e999a8 3794 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
66af7aaf 3795 struct l2cap_conf_efs efs;
f2fcfcd6 3796
fe4128e0 3797 BT_DBG("chan %p, rsp %p, len %d, req %p", chan, rsp, len, data);
f2fcfcd6
GP		 3798
3799 while (len >= L2CAP_CONF_OPT_SIZE) {
3800 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
7c9cbd0b
MH		 3801 if (len < 0)
3802 break;
f2fcfcd6
GP		 3803
3804 switch (type) {
3805 case L2CAP_CONF_MTU:
af3d5d1c
MH		 3806 if (olen != 2)
3807 break;
f2fcfcd6
GP		 3808 if (val < L2CAP_DEFAULT_MIN_MTU) {
3809 *result = L2CAP_CONF_UNACCEPT;
0c1bc5c6 3810 chan->imtu = L2CAP_DEFAULT_MIN_MTU;
f2fcfcd6 3811 } else
0c1bc5c6 3812 chan->imtu = val;
af3d5d1c
MH		 3813 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu,
3814 endptr - ptr);
f2fcfcd6
GP		 3815 break;
3816
3817 case L2CAP_CONF_FLUSH_TO:
af3d5d1c
MH		 3818 if (olen != 2)
3819 break;
0c1bc5c6 3820 chan->flush_to = val;
af3d5d1c
MH		 3821 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO, 2,
3822 chan->flush_to, endptr - ptr);
f2fcfcd6
GP		 3823 break;
3824
3825 case L2CAP_CONF_RFC:
af3d5d1c
MH		 3826 if (olen != sizeof(rfc))
3827 break;
3828 memcpy(&rfc, (void *)val, olen);
c1360a1c 3829 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) &&
2d792818 3830 rfc.mode != chan->mode)
f2fcfcd6 3831 return -ECONNREFUSED;
47d1ec61 3832 chan->fcs = 0;
af3d5d1c
MH		 3833 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3834 (unsigned long) &rfc, endptr - ptr);
f2fcfcd6 3835 break;
6327eb98
AE		 3836
3837 case L2CAP_CONF_EWS:
af3d5d1c
MH		 3838 if (olen != 2)
3839 break;
c20f8e35 3840 chan->ack_win = min_t(u16, val, chan->ack_win);
3e6b3b95 3841 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
e860d2c9 3842 chan->tx_win, endptr - ptr);
6327eb98 3843 break;
66af7aaf
AE		 3844
3845 case L2CAP_CONF_EFS:
af3d5d1c
MH		 3846 if (olen != sizeof(efs))
3847 break;
3848 memcpy(&efs, (void *)val, olen);
3849 if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
3850 efs.stype != L2CAP_SERV_NOTRAFIC &&
3851 efs.stype != chan->local_stype)
3852 return -ECONNREFUSED;
3853 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs),
3854 (unsigned long) &efs, endptr - ptr);
66af7aaf 3855 break;
cbabee78
AE		 3856
3857 case L2CAP_CONF_FCS:
af3d5d1c
MH		 3858 if (olen != 1)
3859 break;
cbabee78
AE		 3860 if (*result == L2CAP_CONF_PENDING)
3861 if (val == L2CAP_FCS_NONE)
f2592d3e 3862 set_bit(CONF_RECV_NO_FCS,
cbabee78
AE		 3863 &chan->conf_state);
3864 break;
f2fcfcd6
GP		 3865 }
3866 }
3867
0c1bc5c6 3868 if (chan->mode == L2CAP_MODE_BASIC && chan->mode != rfc.mode)
6c2ea7a8
GP		 3869 return -ECONNREFUSED;
3870
0c1bc5c6 3871 chan->mode = rfc.mode;
6c2ea7a8 3872
0e8b207e 3873 if (*result == L2CAP_CONF_SUCCESS || *result == L2CAP_CONF_PENDING) {
f2fcfcd6
GP		 3874 switch (rfc.mode) {
3875 case L2CAP_MODE_ERTM:
47d1ec61
GP		 3876 chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
3877 chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
3878 chan->mps = le16_to_cpu(rfc.max_pdu_size);
c20f8e35
MM		 3879 if (!test_bit(FLAG_EXT_CTRL, &chan->flags))
3880 chan->ack_win = min_t(u16, chan->ack_win,
3881 rfc.txwin_size);
66af7aaf
AE		 3882
3883 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
3884 chan->local_msdu = le16_to_cpu(efs.msdu);
3885 chan->local_sdu_itime =
2d792818 3886 le32_to_cpu(efs.sdu_itime);
66af7aaf
AE		 3887 chan->local_acc_lat = le32_to_cpu(efs.acc_lat);
3888 chan->local_flush_to =
2d792818 3889 le32_to_cpu(efs.flush_to);
66af7aaf 3890 }
f2fcfcd6 3891 break;
66af7aaf 3892
f2fcfcd6 3893 case L2CAP_MODE_STREAMING:
47d1ec61 3894 chan->mps = le16_to_cpu(rfc.max_pdu_size);
f2fcfcd6
GP		 3895 }
3896 }
3897
fe4128e0 3898 req->dcid = cpu_to_le16(chan->dcid);
dcf4adbf 3899 req->flags = cpu_to_le16(0);
f2fcfcd6
GP		 3900
3901 return ptr - data;
3902}
3903
2d792818
GP		 3904static int l2cap_build_conf_rsp(struct l2cap_chan *chan, void *data,
3905 u16 result, u16 flags)
1da177e4
LT		 3906{
3907 struct l2cap_conf_rsp *rsp = data;
3908 void *ptr = rsp->data;
1da177e4 3909
fe4128e0 3910 BT_DBG("chan %p", chan);
1da177e4 3911
fe4128e0 3912 rsp->scid = cpu_to_le16(chan->dcid);
5dee9e7c 3913 rsp->result = cpu_to_le16(result);
aca3192c 3914 rsp->flags = cpu_to_le16(flags);
1da177e4
LT		 3915
3916 return ptr - data;
3917}
3918
27e2d4c8
JH		 3919void __l2cap_le_connect_rsp_defer(struct l2cap_chan *chan)
3920{
3921 struct l2cap_le_conn_rsp rsp;
3922 struct l2cap_conn *conn = chan->conn;
3923
3924 BT_DBG("chan %p", chan);
3925
3926 rsp.dcid = cpu_to_le16(chan->scid);
3927 rsp.mtu = cpu_to_le16(chan->imtu);
3916aed8 3928 rsp.mps = cpu_to_le16(chan->mps);
0cd75f7e 3929 rsp.credits = cpu_to_le16(chan->rx_credits);
571f7390 3930 rsp.result = cpu_to_le16(L2CAP_CR_LE_SUCCESS);
27e2d4c8
JH		 3931
3932 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp),
3933 &rsp);
3934}
3935
15f02b91
LAD		 3936void __l2cap_ecred_conn_rsp_defer(struct l2cap_chan *chan)
3937{
3938 struct {
3939 struct l2cap_ecred_conn_rsp rsp;
3940 __le16 dcid[5];
3941 } __packed pdu;
3942 struct l2cap_conn *conn = chan->conn;
3943 u16 ident = chan->ident;
3944 int i = 0;
3945
3946 if (!ident)
3947 return;
3948
3949 BT_DBG("chan %p ident %d", chan, ident);
3950
3951 pdu.rsp.mtu = cpu_to_le16(chan->imtu);
3952 pdu.rsp.mps = cpu_to_le16(chan->mps);
3953 pdu.rsp.credits = cpu_to_le16(chan->rx_credits);
3954 pdu.rsp.result = cpu_to_le16(L2CAP_CR_LE_SUCCESS);
3955
3956 mutex_lock(&conn->chan_lock);
3957
3958 list_for_each_entry(chan, &conn->chan_l, list) {
3959 if (chan->ident != ident)
3960 continue;
3961
3962 /* Reset ident so only one response is sent */
3963 chan->ident = 0;
3964
3965 /* Include all channels pending with the same ident */
3966 pdu.dcid[i++] = cpu_to_le16(chan->scid);
3967 }
3968
3969 mutex_unlock(&conn->chan_lock);
3970
3971 l2cap_send_cmd(conn, ident, L2CAP_ECRED_CONN_RSP,
3972 sizeof(pdu.rsp) + i * sizeof(__le16), &pdu);
3973}
3974
8c1d787b 3975void __l2cap_connect_rsp_defer(struct l2cap_chan *chan)
710f9b0a
GP		 3976{
3977 struct l2cap_conn_rsp rsp;
8c1d787b 3978 struct l2cap_conn *conn = chan->conn;
710f9b0a 3979 u8 buf[128];
439f34ac 3980 u8 rsp_code;
710f9b0a 3981
fe4128e0
GP		 3982 rsp.scid = cpu_to_le16(chan->dcid);
3983 rsp.dcid = cpu_to_le16(chan->scid);
dcf4adbf
JP		 3984 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
3985 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
439f34ac
AE		 3986
3987 if (chan->hs_hcon)
3988 rsp_code = L2CAP_CREATE_CHAN_RSP;
3989 else
3990 rsp_code = L2CAP_CONN_RSP;
3991
3992 BT_DBG("chan %p rsp_code %u", chan, rsp_code);
3993
3994 l2cap_send_cmd(conn, chan->ident, rsp_code, sizeof(rsp), &rsp);
710f9b0a 3995
c1360a1c 3996 if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
710f9b0a
GP		 3997 return;
3998
710f9b0a 3999 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
e860d2c9 4000 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
710f9b0a
GP		 4001 chan->num_conf_req++;
4002}
4003
47d1ec61 4004static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len)
7b1c0049 4005{
7b1c0049
GP		 4006 int type, olen;
4007 unsigned long val;
c20f8e35
MM		 4008 /* Use sane default values in case a misbehaving remote device
4009 * did not send an RFC or extended window size option.
4010 */
4011 u16 txwin_ext = chan->ack_win;
4012 struct l2cap_conf_rfc rfc = {
4013 .mode = chan->mode,
dcf4adbf
JP		 4014 .retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO),
4015 .monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO),
c20f8e35
MM		 4016 .max_pdu_size = cpu_to_le16(chan->imtu),
4017 .txwin_size = min_t(u16, chan->ack_win, L2CAP_DEFAULT_TX_WINDOW),
4018 };
7b1c0049 4019
47d1ec61 4020 BT_DBG("chan %p, rsp %p, len %d", chan, rsp, len);
7b1c0049 4021
0c1bc5c6 4022 if ((chan->mode != L2CAP_MODE_ERTM) && (chan->mode != L2CAP_MODE_STREAMING))
7b1c0049
GP		 4023 return;
4024
4025 while (len >= L2CAP_CONF_OPT_SIZE) {
4026 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
7c9cbd0b
MH		 4027 if (len < 0)
4028 break;
7b1c0049 4029
c20f8e35
MM		 4030 switch (type) {
4031 case L2CAP_CONF_RFC:
af3d5d1c
MH		 4032 if (olen != sizeof(rfc))
4033 break;
4034 memcpy(&rfc, (void *)val, olen);
8f321f85 4035 break;
c20f8e35 4036 case L2CAP_CONF_EWS:
af3d5d1c
MH		 4037 if (olen != 2)
4038 break;
c20f8e35
MM		 4039 txwin_ext = val;
4040 break;
4041 }
7b1c0049
GP		 4042 }
4043
7b1c0049
GP		 4044 switch (rfc.mode) {
4045 case L2CAP_MODE_ERTM:
47d1ec61
GP		 4046 chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
4047 chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
c20f8e35
MM		 4048 chan->mps = le16_to_cpu(rfc.max_pdu_size);
4049 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
4050 chan->ack_win = min_t(u16, chan->ack_win, txwin_ext);
4051 else
4052 chan->ack_win = min_t(u16, chan->ack_win,
4053 rfc.txwin_size);
7b1c0049
GP		 4054 break;
4055 case L2CAP_MODE_STREAMING:
47d1ec61 4056 chan->mps = le16_to_cpu(rfc.max_pdu_size);
7b1c0049
GP		 4057 }
4058}
4059
2d792818 4060static inline int l2cap_command_rej(struct l2cap_conn *conn,
cb3b3152
JH		 4061 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4062 u8 *data)
4e8402a3 4063{
e2fd318e 4064 struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data;
4e8402a3 4065
cb3b3152
JH		 4066 if (cmd_len < sizeof(*rej))
4067 return -EPROTO;
4068
e2fd318e 4069 if (rej->reason != L2CAP_REJ_NOT_UNDERSTOOD)
4e8402a3
MH		 4070 return 0;
4071
4072 if ((conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) &&
2d792818 4073 cmd->ident == conn->info_ident) {
17cd3f37 4074 cancel_delayed_work(&conn->info_timer);
984947dc
MH		 4075
4076 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
e1027a7c 4077 conn->info_ident = 0;
984947dc 4078
4e8402a3
MH		 4079 l2cap_conn_start(conn);
4080 }
4081
4082 return 0;
4083}
4084
1700915f
MM		 4085static struct l2cap_chan *l2cap_connect(struct l2cap_conn *conn,
4086 struct l2cap_cmd_hdr *cmd,
4087 u8 *data, u8 rsp_code, u8 amp_id)
1da177e4 4088{
1da177e4
LT		 4089 struct l2cap_conn_req *req = (struct l2cap_conn_req *) data;
4090 struct l2cap_conn_rsp rsp;
23691d75 4091 struct l2cap_chan *chan = NULL, *pchan;
e7c29cb1 4092 int result, status = L2CAP_CS_NO_INFO;
1da177e4
LT		 4093
4094 u16 dcid = 0, scid = __le16_to_cpu(req->scid);
e7c29cb1 4095 __le16 psm = req->psm;
1da177e4 4096
097db76c 4097 BT_DBG("psm 0x%2.2x scid 0x%4.4x", __le16_to_cpu(psm), scid);
1da177e4
LT		 4098
4099 /* Check if we have socket listening on psm */
6f59b904 4100 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src,
bf20fd4e 4101 &conn->hcon->dst, ACL_LINK);
23691d75 4102 if (!pchan) {
1da177e4
LT		 4103 result = L2CAP_CR_BAD_PSM;
4104 goto sendresp;
4105 }
4106
3df91ea2 4107 mutex_lock(&conn->chan_lock);
8ffb9290 4108 l2cap_chan_lock(pchan);
e0f0cb56 4109
e7c29cb1 4110 /* Check if the ACL is secure enough (if not SDP) */
dcf4adbf 4111 if (psm != cpu_to_le16(L2CAP_PSM_SDP) &&
2d792818 4112 !hci_conn_check_link_mode(conn->hcon)) {
9f5a0d7b 4113 conn->disc_reason = HCI_ERROR_AUTH_FAILURE;
e7c29cb1
MH		 4114 result = L2CAP_CR_SEC_BLOCK;
4115 goto response;
4116 }
4117
1da177e4
LT		 4118 result = L2CAP_CR_NO_MEM;
4119
dd1a8f8a
MP		 4120 /* Check for valid dynamic CID range (as per Erratum 3253) */
4121 if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_DYN_END) {
4122 result = L2CAP_CR_INVALID_SCID;
4123 goto response;
4124 }
4125
2dfa1003 4126 /* Check if we already have channel with that dcid */
dd1a8f8a
MP		 4127 if (__l2cap_get_chan_by_dcid(conn, scid)) {
4128 result = L2CAP_CR_SCID_IN_USE;
2dfa1003 4129 goto response;
dd1a8f8a 4130 }
2dfa1003 4131
80b98027 4132 chan = pchan->ops->new_connection(pchan);
80808e43 4133 if (!chan)
1da177e4
LT		 4134 goto response;
4135
330b6c15
SS		 4136 /* For certain devices (ex: HID mouse), support for authentication,
4137 * pairing and bonding is optional. For such devices, inorder to avoid
4138 * the ACL alive for too long after L2CAP disconnection, reset the ACL
4139 * disc_timeout back to HCI_DISCONN_TIMEOUT during L2CAP connect.
4140 */
4141 conn->hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
4142
7eafc59e
MH		 4143 bacpy(&chan->src, &conn->hcon->src);
4144 bacpy(&chan->dst, &conn->hcon->dst);
a250e048
JH		 4145 chan->src_type = bdaddr_src_type(conn->hcon);
4146 chan->dst_type = bdaddr_dst_type(conn->hcon);
fe4128e0
GP		 4147 chan->psm = psm;
4148 chan->dcid = scid;
1700915f 4149 chan->local_amp_id = amp_id;
1da177e4 4150
6be36555 4151 __l2cap_chan_add(conn, chan);
48454079 4152
fe4128e0 4153 dcid = chan->scid;
1da177e4 4154
8d836d71 4155 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
1da177e4 4156
fc7f8a7e 4157 chan->ident = cmd->ident;
1da177e4 4158
984947dc 4159 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) {
e7cafc45 4160 if (l2cap_chan_check_security(chan, false)) {
bdc25783 4161 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
f93fa273 4162 l2cap_state_change(chan, BT_CONNECT2);
f66dc81f
MH		 4163 result = L2CAP_CR_PEND;
4164 status = L2CAP_CS_AUTHOR_PEND;
2dc4e510 4165 chan->ops->defer(chan);
f66dc81f 4166 } else {
1700915f
MM		 4167 /* Force pending result for AMP controllers.
4168 * The connection will succeed after the
4169 * physical link is up.
4170 */
6ed971ca 4171 if (amp_id == AMP_ID_BREDR) {
f93fa273 4172 l2cap_state_change(chan, BT_CONFIG);
1700915f 4173 result = L2CAP_CR_SUCCESS;
6ed971ca 4174 } else {
f93fa273 4175 l2cap_state_change(chan, BT_CONNECT2);
6ed971ca 4176 result = L2CAP_CR_PEND;
1700915f 4177 }
f66dc81f
MH		 4178 status = L2CAP_CS_NO_INFO;
4179 }
79d554a6 4180 } else {
f93fa273 4181 l2cap_state_change(chan, BT_CONNECT2);
79d554a6
MH		 4182 result = L2CAP_CR_PEND;
4183 status = L2CAP_CS_AUTHEN_PEND;
4184 }
4185 } else {
f93fa273 4186 l2cap_state_change(chan, BT_CONNECT2);
79d554a6
MH		 4187 result = L2CAP_CR_PEND;
4188 status = L2CAP_CS_NO_INFO;
1da177e4
LT		 4189 }
4190
1da177e4 4191response:
8ffb9290 4192 l2cap_chan_unlock(pchan);
3df91ea2 4193 mutex_unlock(&conn->chan_lock);
a24cce14 4194 l2cap_chan_put(pchan);
1da177e4
LT		 4195
4196sendresp:
aca3192c
YH		 4197 rsp.scid = cpu_to_le16(scid);
4198 rsp.dcid = cpu_to_le16(dcid);
4199 rsp.result = cpu_to_le16(result);
4200 rsp.status = cpu_to_le16(status);
4c89b6aa 4201 l2cap_send_cmd(conn, cmd->ident, rsp_code, sizeof(rsp), &rsp);
79d554a6
MH		 4202
4203 if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) {
4204 struct l2cap_info_req info;
dcf4adbf 4205 info.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
79d554a6
MH		 4206
4207 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
4208 conn->info_ident = l2cap_get_ident(conn);
4209
ba13ccd9 4210 schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
79d554a6 4211
2d792818
GP		 4212 l2cap_send_cmd(conn, conn->info_ident, L2CAP_INFO_REQ,
4213 sizeof(info), &info);
79d554a6
MH		 4214 }
4215
c1360a1c 4216 if (chan && !test_bit(CONF_REQ_SENT, &chan->conf_state) &&
2d792818 4217 result == L2CAP_CR_SUCCESS) {
e9aeb2dd 4218 u8 buf[128];
c1360a1c 4219 set_bit(CONF_REQ_SENT, &chan->conf_state);
e9aeb2dd 4220 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
e860d2c9 4221 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
73ffa904 4222 chan->num_conf_req++;
e9aeb2dd 4223 }
1700915f
MM		 4224
4225 return chan;
4c89b6aa 4226}
e9aeb2dd 4227
4c89b6aa 4228static int l2cap_connect_req(struct l2cap_conn *conn,
cb3b3152 4229 struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
4c89b6aa 4230{
7b064eda
JK		 4231 struct hci_dev *hdev = conn->hcon->hdev;
4232 struct hci_conn *hcon = conn->hcon;
4233
cb3b3152
JH		 4234 if (cmd_len < sizeof(struct l2cap_conn_req))
4235 return -EPROTO;
4236
7b064eda 4237 hci_dev_lock(hdev);
d7a5a11d 4238 if (hci_dev_test_flag(hdev, HCI_MGMT) &&
7b064eda 4239 !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &hcon->flags))
1c6ed31b 4240 mgmt_device_connected(hdev, hcon, NULL, 0);
7b064eda
JK		 4241 hci_dev_unlock(hdev);
4242
300229f9 4243 l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP, 0);
1da177e4
LT		 4244 return 0;
4245}
4246
5909cf30 4247static int l2cap_connect_create_rsp(struct l2cap_conn *conn,
cb3b3152
JH		 4248 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4249 u8 *data)
1da177e4
LT		 4250{
4251 struct l2cap_conn_rsp *rsp = (struct l2cap_conn_rsp *) data;
4252 u16 scid, dcid, result, status;
48454079 4253 struct l2cap_chan *chan;
1da177e4 4254 u8 req[128];
3df91ea2 4255 int err;
1da177e4 4256
cb3b3152
JH		 4257 if (cmd_len < sizeof(*rsp))
4258 return -EPROTO;
4259
1da177e4
LT		 4260 scid = __le16_to_cpu(rsp->scid);
4261 dcid = __le16_to_cpu(rsp->dcid);
4262 result = __le16_to_cpu(rsp->result);
4263 status = __le16_to_cpu(rsp->status);
4264
1b009c98 4265 BT_DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x",
2d792818 4266 dcid, scid, result, status);
1da177e4 4267
3df91ea2
AE		 4268 mutex_lock(&conn->chan_lock);
4269
1da177e4 4270 if (scid) {
3df91ea2
AE		 4271 chan = __l2cap_get_chan_by_scid(conn, scid);
4272 if (!chan) {
21870b52 4273 err = -EBADSLT;
3df91ea2
AE		 4274 goto unlock;
4275 }
1da177e4 4276 } else {
3df91ea2
AE		 4277 chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
4278 if (!chan) {
21870b52 4279 err = -EBADSLT;
3df91ea2
AE		 4280 goto unlock;
4281 }
1da177e4
LT		 4282 }
4283
3df91ea2
AE		 4284 err = 0;
4285
6be36555 4286 l2cap_chan_lock(chan);
48454079 4287
1da177e4
LT		 4288 switch (result) {
4289 case L2CAP_CR_SUCCESS:
89bc500e 4290 l2cap_state_change(chan, BT_CONFIG);
fc7f8a7e 4291 chan->ident = 0;
fe4128e0 4292 chan->dcid = dcid;
c1360a1c 4293 clear_bit(CONF_CONNECT_PEND, &chan->conf_state);
6a8d3010 4294
c1360a1c 4295 if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
e9aeb2dd
GP		 4296 break;
4297
1da177e4 4298 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
e860d2c9 4299 l2cap_build_conf_req(chan, req, sizeof(req)), req);
73ffa904 4300 chan->num_conf_req++;
1da177e4
LT		 4301 break;
4302
4303 case L2CAP_CR_PEND:
c1360a1c 4304 set_bit(CONF_CONNECT_PEND, &chan->conf_state);
1da177e4
LT		 4305 break;
4306
4307 default:
48454079 4308 l2cap_chan_del(chan, ECONNREFUSED);
1da177e4
LT		 4309 break;
4310 }
4311
6be36555 4312 l2cap_chan_unlock(chan);
3df91ea2
AE		 4313
4314unlock:
4315 mutex_unlock(&conn->chan_lock);
4316
4317 return err;
1da177e4
LT		 4318}
4319
47d1ec61 4320static inline void set_default_fcs(struct l2cap_chan *chan)
8c462b60
MM		 4321{
4322 /* FCS is enabled only in ERTM or streaming mode, if one or both
4323 * sides request it.
4324 */
0c1bc5c6 4325 if (chan->mode != L2CAP_MODE_ERTM && chan->mode != L2CAP_MODE_STREAMING)
47d1ec61 4326 chan->fcs = L2CAP_FCS_NONE;
f2592d3e 4327 else if (!test_bit(CONF_RECV_NO_FCS, &chan->conf_state))
47d1ec61 4328 chan->fcs = L2CAP_FCS_CRC16;
8c462b60
MM		 4329}
4330
29d8a590
AE		 4331static void l2cap_send_efs_conf_rsp(struct l2cap_chan *chan, void *data,
4332 u8 ident, u16 flags)
4333{
4334 struct l2cap_conn *conn = chan->conn;
4335
4336 BT_DBG("conn %p chan %p ident %d flags 0x%4.4x", conn, chan, ident,
4337 flags);
4338
4339 clear_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
4340 set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
4341
4342 l2cap_send_cmd(conn, ident, L2CAP_CONF_RSP,
4343 l2cap_build_conf_rsp(chan, data,
4344 L2CAP_CONF_SUCCESS, flags), data);
4345}
4346
662d652d
JH		 4347static void cmd_reject_invalid_cid(struct l2cap_conn *conn, u8 ident,
4348 u16 scid, u16 dcid)
4349{
4350 struct l2cap_cmd_rej_cid rej;
4351
dcf4adbf 4352 rej.reason = cpu_to_le16(L2CAP_REJ_INVALID_CID);
662d652d
JH		 4353 rej.scid = __cpu_to_le16(scid);
4354 rej.dcid = __cpu_to_le16(dcid);
4355
4356 l2cap_send_cmd(conn, ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej);
4357}
4358
2d792818
GP		 4359static inline int l2cap_config_req(struct l2cap_conn *conn,
4360 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4361 u8 *data)
1da177e4
LT		 4362{
4363 struct l2cap_conf_req *req = (struct l2cap_conf_req *) data;
4364 u16 dcid, flags;
4365 u8 rsp[64];
48454079 4366 struct l2cap_chan *chan;
3c588192 4367 int len, err = 0;
1da177e4 4368
cb3b3152
JH		 4369 if (cmd_len < sizeof(*req))
4370 return -EPROTO;
4371
1da177e4
LT		 4372 dcid = __le16_to_cpu(req->dcid);
4373 flags = __le16_to_cpu(req->flags);
4374
4375 BT_DBG("dcid 0x%4.4x flags 0x%2.2x", dcid, flags);
4376
baa7e1fa 4377 chan = l2cap_get_chan_by_scid(conn, dcid);
662d652d
JH		 4378 if (!chan) {
4379 cmd_reject_invalid_cid(conn, cmd->ident, dcid, 0);
4380 return 0;
4381 }
1da177e4 4382
96298f64
HC		 4383 if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2 &&
4384 chan->state != BT_CONNECTED) {
662d652d
JH		 4385 cmd_reject_invalid_cid(conn, cmd->ident, chan->scid,
4386 chan->dcid);
354f60a9 4387 goto unlock;
df6bd743 4388 }
354f60a9 4389
5dee9e7c 4390 /* Reject if config buffer is too small. */
88219a0f 4391 len = cmd_len - sizeof(*req);
cb3b3152 4392 if (chan->conf_len + len > sizeof(chan->conf_req)) {
5dee9e7c 4393 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
2d792818
GP		 4394 l2cap_build_conf_rsp(chan, rsp,
4395 L2CAP_CONF_REJECT, flags), rsp);
5dee9e7c
MH		 4396 goto unlock;
4397 }
4398
4399 /* Store config. */
73ffa904
GP		 4400 memcpy(chan->conf_req + chan->conf_len, req->data, len);
4401 chan->conf_len += len;
1da177e4 4402
59e54bd1 4403 if (flags & L2CAP_CONF_FLAG_CONTINUATION) {
1da177e4
LT		 4404 /* Incomplete config. Send empty response. */
4405 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
2d792818
GP		 4406 l2cap_build_conf_rsp(chan, rsp,
4407 L2CAP_CONF_SUCCESS, flags), rsp);
1da177e4
LT		 4408 goto unlock;
4409 }
4410
4411 /* Complete config. */
e860d2c9 4412 len = l2cap_parse_conf_req(chan, rsp, sizeof(rsp));
f2fcfcd6 4413 if (len < 0) {
5e4e3972 4414 l2cap_send_disconn_req(chan, ECONNRESET);
1da177e4 4415 goto unlock;
f2fcfcd6 4416 }
1da177e4 4417
1500109b 4418 chan->ident = cmd->ident;
5dee9e7c 4419 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp);
73ffa904 4420 chan->num_conf_rsp++;
5dee9e7c 4421
5dee9e7c 4422 /* Reset config buffer. */
73ffa904 4423 chan->conf_len = 0;
5dee9e7c 4424
c1360a1c 4425 if (!test_bit(CONF_OUTPUT_DONE, &chan->conf_state))
876d9484
MH		 4426 goto unlock;
4427
c1360a1c 4428 if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {
47d1ec61 4429 set_default_fcs(chan);
fcc203c3 4430
105bdf9e
MM		 4431 if (chan->mode == L2CAP_MODE_ERTM ||
4432 chan->mode == L2CAP_MODE_STREAMING)
3c588192
MM		 4433 err = l2cap_ertm_init(chan);
4434
4435 if (err < 0)
5e4e3972 4436 l2cap_send_disconn_req(chan, -err);
3c588192
MM		 4437 else
4438 l2cap_chan_ready(chan);
0565c1c2 4439
876d9484
MH		 4440 goto unlock;
4441 }
4442
c1360a1c 4443 if (!test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) {
79d554a6 4444 u8 buf[64];
1da177e4 4445 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
e860d2c9 4446 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
73ffa904 4447 chan->num_conf_req++;
1da177e4
LT		 4448 }
4449
49c922bb 4450 /* Got Conf Rsp PENDING from remote side and assume we sent
0e8b207e
AE		 4451 Conf Rsp PENDING in the code above */
4452 if (test_bit(CONF_REM_CONF_PEND, &chan->conf_state) &&
29d8a590 4453 test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
0e8b207e
AE		 4454
4455 /* check compatibility */
4456
79de886d 4457 /* Send rsp for BR/EDR channel */
f351bc72 4458 if (!chan->hs_hcon)
79de886d
AE		 4459 l2cap_send_efs_conf_rsp(chan, rsp, cmd->ident, flags);
4460 else
4461 chan->ident = cmd->ident;
0e8b207e
AE		 4462 }
4463
1da177e4 4464unlock:
6be36555 4465 l2cap_chan_unlock(chan);
3c588192 4466 return err;
1da177e4
LT		 4467}
4468
2d792818 4469static inline int l2cap_config_rsp(struct l2cap_conn *conn,
cb3b3152
JH		 4470 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4471 u8 *data)
1da177e4
LT		 4472{
4473 struct l2cap_conf_rsp *rsp = (struct l2cap_conf_rsp *)data;
4474 u16 scid, flags, result;
48454079 4475 struct l2cap_chan *chan;
cb3b3152 4476 int len = cmd_len - sizeof(*rsp);
3c588192 4477 int err = 0;
1da177e4 4478
cb3b3152
JH		 4479 if (cmd_len < sizeof(*rsp))
4480 return -EPROTO;
4481
1da177e4
LT		 4482 scid = __le16_to_cpu(rsp->scid);
4483 flags = __le16_to_cpu(rsp->flags);
4484 result = __le16_to_cpu(rsp->result);
4485
61386cba
AE		 4486 BT_DBG("scid 0x%4.4x flags 0x%2.2x result 0x%2.2x len %d", scid, flags,
4487 result, len);
1da177e4 4488
baa7e1fa 4489 chan = l2cap_get_chan_by_scid(conn, scid);
48454079 4490 if (!chan)
1da177e4
LT		 4491 return 0;
4492
4493 switch (result) {
4494 case L2CAP_CONF_SUCCESS:
47d1ec61 4495 l2cap_conf_rfc_get(chan, rsp->data, len);
0e8b207e 4496 clear_bit(CONF_REM_CONF_PEND, &chan->conf_state);
1da177e4
LT		 4497 break;
4498
0e8b207e
AE		 4499 case L2CAP_CONF_PENDING:
4500 set_bit(CONF_REM_CONF_PEND, &chan->conf_state);
4501
4502 if (test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
4503 char buf[64];
4504
4505 len = l2cap_parse_conf_rsp(chan, rsp->data, len,
e860d2c9 4506 buf, sizeof(buf), &result);
0e8b207e 4507 if (len < 0) {
5e4e3972 4508 l2cap_send_disconn_req(chan, ECONNRESET);
0e8b207e
AE		 4509 goto done;
4510 }
4511
f351bc72 4512 if (!chan->hs_hcon) {
79de886d
AE		 4513 l2cap_send_efs_conf_rsp(chan, buf, cmd->ident,
4514 0);
5ce66b59
AE		 4515 } else {
4516 if (l2cap_check_efs(chan)) {
4517 amp_create_logical_link(chan);
4518 chan->ident = cmd->ident;
4519 }
4520 }
0e8b207e
AE		 4521 }
4522 goto done;
4523
98d2c3e1 4524 case L2CAP_CONF_UNKNOWN:
1da177e4 4525 case L2CAP_CONF_UNACCEPT:
73ffa904 4526 if (chan->num_conf_rsp <= L2CAP_CONF_MAX_CONF_RSP) {
f2fcfcd6
GP		 4527 char req[64];
4528
c2c77ec8 4529 if (len > sizeof(req) - sizeof(struct l2cap_conf_req)) {
5e4e3972 4530 l2cap_send_disconn_req(chan, ECONNRESET);
c2c77ec8
AE		 4531 goto done;
4532 }
4533
f2fcfcd6
GP		 4534 /* throw out any old stored conf requests */
4535 result = L2CAP_CONF_SUCCESS;
b4450035 4536 len = l2cap_parse_conf_rsp(chan, rsp->data, len,
e860d2c9 4537 req, sizeof(req), &result);
f2fcfcd6 4538 if (len < 0) {
5e4e3972 4539 l2cap_send_disconn_req(chan, ECONNRESET);
f2fcfcd6
GP		 4540 goto done;
4541 }
4542
4543 l2cap_send_cmd(conn, l2cap_get_ident(conn),
2d792818 4544 L2CAP_CONF_REQ, len, req);
73ffa904 4545 chan->num_conf_req++;
f2fcfcd6
GP		 4546 if (result != L2CAP_CONF_SUCCESS)
4547 goto done;
4548 break;
1da177e4 4549 }
19186c7b 4550 fallthrough;
1da177e4 4551
8e87d142 4552 default:
6be36555 4553 l2cap_chan_set_err(chan, ECONNRESET);
2e0052e4 4554
ba13ccd9 4555 __set_chan_timer(chan, L2CAP_DISC_REJ_TIMEOUT);
5e4e3972 4556 l2cap_send_disconn_req(chan, ECONNRESET);
1da177e4
LT		 4557 goto done;
4558 }
4559
59e54bd1 4560 if (flags & L2CAP_CONF_FLAG_CONTINUATION)
1da177e4
LT		 4561 goto done;
4562
c1360a1c 4563 set_bit(CONF_INPUT_DONE, &chan->conf_state);
1da177e4 4564
c1360a1c 4565 if (test_bit(CONF_OUTPUT_DONE, &chan->conf_state)) {
47d1ec61 4566 set_default_fcs(chan);
fcc203c3 4567
105bdf9e
MM		 4568 if (chan->mode == L2CAP_MODE_ERTM ||
4569 chan->mode == L2CAP_MODE_STREAMING)
3c588192 4570 err = l2cap_ertm_init(chan);
0565c1c2 4571
3c588192 4572 if (err < 0)
5e4e3972 4573 l2cap_send_disconn_req(chan, -err);
3c588192
MM		 4574 else
4575 l2cap_chan_ready(chan);
1da177e4
LT		 4576 }
4577
4578done:
6be36555 4579 l2cap_chan_unlock(chan);
3c588192 4580 return err;
1da177e4
LT		 4581}
4582
2d792818 4583static inline int l2cap_disconnect_req(struct l2cap_conn *conn,
cb3b3152
JH		 4584 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4585 u8 *data)
1da177e4
LT		 4586{
4587 struct l2cap_disconn_req *req = (struct l2cap_disconn_req *) data;
4588 struct l2cap_disconn_rsp rsp;
4589 u16 dcid, scid;
48454079 4590 struct l2cap_chan *chan;
1da177e4 4591
cb3b3152
JH		 4592 if (cmd_len != sizeof(*req))
4593 return -EPROTO;
4594
1da177e4
LT		 4595 scid = __le16_to_cpu(req->scid);
4596 dcid = __le16_to_cpu(req->dcid);
4597
4598 BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid);
4599
3df91ea2
AE		 4600 mutex_lock(&conn->chan_lock);
4601
4602 chan = __l2cap_get_chan_by_scid(conn, dcid);
4603 if (!chan) {
4604 mutex_unlock(&conn->chan_lock);
662d652d
JH		 4605 cmd_reject_invalid_cid(conn, cmd->ident, dcid, scid);
4606 return 0;
3df91ea2 4607 }
1da177e4 4608
6c08fc89 4609 l2cap_chan_hold(chan);
6be36555
AE		 4610 l2cap_chan_lock(chan);
4611
fe4128e0
GP		 4612 rsp.dcid = cpu_to_le16(chan->scid);
4613 rsp.scid = cpu_to_le16(chan->dcid);
1da177e4
LT		 4614 l2cap_send_cmd(conn, cmd->ident, L2CAP_DISCONN_RSP, sizeof(rsp), &rsp);
4615
5ec1bbe5 4616 chan->ops->set_shutdown(chan);
1da177e4 4617
48454079 4618 l2cap_chan_del(chan, ECONNRESET);
6be36555 4619
80b98027 4620 chan->ops->close(chan);
6c08fc89
MM		 4621
4622 l2cap_chan_unlock(chan);
61d6ef3e 4623 l2cap_chan_put(chan);
3df91ea2
AE		 4624
4625 mutex_unlock(&conn->chan_lock);
4626
1da177e4
LT		 4627 return 0;
4628}
4629
2d792818 4630static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn,
cb3b3152
JH		 4631 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4632 u8 *data)
1da177e4
LT		 4633{
4634 struct l2cap_disconn_rsp *rsp = (struct l2cap_disconn_rsp *) data;
4635 u16 dcid, scid;
48454079 4636 struct l2cap_chan *chan;
1da177e4 4637
cb3b3152
JH		 4638 if (cmd_len != sizeof(*rsp))
4639 return -EPROTO;
4640
1da177e4
LT		 4641 scid = __le16_to_cpu(rsp->scid);
4642 dcid = __le16_to_cpu(rsp->dcid);
4643
4644 BT_DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid);
4645
3df91ea2
AE		 4646 mutex_lock(&conn->chan_lock);
4647
4648 chan = __l2cap_get_chan_by_scid(conn, scid);
4649 if (!chan) {
4650 mutex_unlock(&conn->chan_lock);
1da177e4 4651 return 0;
3df91ea2 4652 }
1da177e4 4653
6c08fc89 4654 l2cap_chan_hold(chan);
6be36555 4655 l2cap_chan_lock(chan);
48454079 4656
28261da8
MK		 4657 if (chan->state != BT_DISCONN) {
4658 l2cap_chan_unlock(chan);
6c08fc89 4659 l2cap_chan_put(chan);
28261da8
MK		 4660 mutex_unlock(&conn->chan_lock);
4661 return 0;
4662 }
4663
48454079 4664 l2cap_chan_del(chan, 0);
6be36555 4665
80b98027 4666 chan->ops->close(chan);
6c08fc89
MM		 4667
4668 l2cap_chan_unlock(chan);
61d6ef3e 4669 l2cap_chan_put(chan);
3df91ea2
AE		 4670
4671 mutex_unlock(&conn->chan_lock);
4672
1da177e4
LT		 4673 return 0;
4674}
4675
2d792818 4676static inline int l2cap_information_req(struct l2cap_conn *conn,
cb3b3152
JH		 4677 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4678 u8 *data)
1da177e4
LT		 4679{
4680 struct l2cap_info_req *req = (struct l2cap_info_req *) data;
1da177e4
LT		 4681 u16 type;
4682
cb3b3152
JH		 4683 if (cmd_len != sizeof(*req))
4684 return -EPROTO;
4685
1da177e4
LT		 4686 type = __le16_to_cpu(req->type);
4687
4688 BT_DBG("type 0x%4.4x", type);
4689
f0709e03
MH		 4690 if (type == L2CAP_IT_FEAT_MASK) {
4691 u8 buf[8];
44dd46de 4692 u32 feat_mask = l2cap_feat_mask;
f0709e03 4693 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
dcf4adbf
JP		 4694 rsp->type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
4695 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
d1c4a17d 4696 if (!disable_ertm)
fcc203c3 4697 feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING
2d792818 4698 | L2CAP_FEAT_FCS;
0bd49fc7 4699 if (conn->local_fixed_chan & L2CAP_FC_A2MP)
6327eb98 4700 feat_mask |= L2CAP_FEAT_EXT_FLOW
2d792818 4701 | L2CAP_FEAT_EXT_WINDOW;
a5fd6f30 4702
1b7bf4ed 4703 put_unaligned_le32(feat_mask, rsp->data);
2d792818
GP		 4704 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(buf),
4705 buf);
e1027a7c
MH		 4706 } else if (type == L2CAP_IT_FIXED_CHAN) {
4707 u8 buf[12];
4708 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
50a147cd 4709
dcf4adbf
JP		 4710 rsp->type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
4711 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
0bd49fc7
JH		 4712 rsp->data[0] = conn->local_fixed_chan;
4713 memset(rsp->data + 1, 0, 7);
2d792818
GP		 4714 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(buf),
4715 buf);
f0709e03
MH		 4716 } else {
4717 struct l2cap_info_rsp rsp;
4718 rsp.type = cpu_to_le16(type);
dcf4adbf 4719 rsp.result = cpu_to_le16(L2CAP_IR_NOTSUPP);
2d792818
GP		 4720 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(rsp),
4721 &rsp);
f0709e03 4722 }
1da177e4
LT		 4723
4724 return 0;
4725}
4726
2d792818 4727static inline int l2cap_information_rsp(struct l2cap_conn *conn,
cb3b3152
JH		 4728 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4729 u8 *data)
1da177e4
LT		 4730{
4731 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data;
4732 u16 type, result;
4733
3f6fa3d4 4734 if (cmd_len < sizeof(*rsp))
cb3b3152
JH		 4735 return -EPROTO;
4736
1da177e4
LT		 4737 type = __le16_to_cpu(rsp->type);
4738 result = __le16_to_cpu(rsp->result);
4739
4740 BT_DBG("type 0x%4.4x result 0x%2.2x", type, result);
4741
e90165be
AE		 4742 /* L2CAP Info req/rsp are unbound to channels, add extra checks */
4743 if (cmd->ident != conn->info_ident ||
2d792818 4744 conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)
e90165be
AE		 4745 return 0;
4746
17cd3f37 4747 cancel_delayed_work(&conn->info_timer);
4e8402a3 4748
adb08ede
VT		 4749 if (result != L2CAP_IR_SUCCESS) {
4750 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
4751 conn->info_ident = 0;
4752
4753 l2cap_conn_start(conn);
4754
4755 return 0;
4756 }
4757
978c93b9
AE		 4758 switch (type) {
4759 case L2CAP_IT_FEAT_MASK:
83985319 4760 conn->feat_mask = get_unaligned_le32(rsp->data);
4e8402a3 4761
47ec1dcd 4762 if (conn->feat_mask & L2CAP_FEAT_FIXED_CHAN) {
e1027a7c 4763 struct l2cap_info_req req;
dcf4adbf 4764 req.type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
e1027a7c
MH		 4765
4766 conn->info_ident = l2cap_get_ident(conn);
4767
4768 l2cap_send_cmd(conn, conn->info_ident,
2d792818 4769 L2CAP_INFO_REQ, sizeof(req), &req);
e1027a7c
MH		 4770 } else {
4771 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
4772 conn->info_ident = 0;
4773
4774 l2cap_conn_start(conn);
4775 }
978c93b9
AE		 4776 break;
4777
4778 case L2CAP_IT_FIXED_CHAN:
0bd49fc7 4779 conn->remote_fixed_chan = rsp->data[0];
984947dc 4780 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
e1027a7c 4781 conn->info_ident = 0;
984947dc
MH		 4782
4783 l2cap_conn_start(conn);
978c93b9 4784 break;
984947dc 4785 }
4e8402a3 4786
1da177e4
LT		 4787 return 0;
4788}
4789
1700915f
MM		 4790static int l2cap_create_channel_req(struct l2cap_conn *conn,
4791 struct l2cap_cmd_hdr *cmd,
4792 u16 cmd_len, void *data)
f94ff6ff
MM		 4793{
4794 struct l2cap_create_chan_req *req = data;
6e1df6a6 4795 struct l2cap_create_chan_rsp rsp;
1700915f 4796 struct l2cap_chan *chan;
6e1df6a6 4797 struct hci_dev *hdev;
f94ff6ff
MM		 4798 u16 psm, scid;
4799
4800 if (cmd_len != sizeof(*req))
4801 return -EPROTO;
4802
0bd49fc7 4803 if (!(conn->local_fixed_chan & L2CAP_FC_A2MP))
f94ff6ff
MM		 4804 return -EINVAL;
4805
4806 psm = le16_to_cpu(req->psm);
4807 scid = le16_to_cpu(req->scid);
4808
ad0ac6ca 4809 BT_DBG("psm 0x%2.2x, scid 0x%4.4x, amp_id %d", psm, scid, req->amp_id);
f94ff6ff 4810
6e1df6a6 4811 /* For controller id 0 make BR/EDR connection */
6ed971ca 4812 if (req->amp_id == AMP_ID_BREDR) {
6e1df6a6
AE		 4813 l2cap_connect(conn, cmd, data, L2CAP_CREATE_CHAN_RSP,
4814 req->amp_id);
4815 return 0;
4816 }
1700915f 4817
6e1df6a6
AE		 4818 /* Validate AMP controller id */
4819 hdev = hci_dev_get(req->amp_id);
4820 if (!hdev)
4821 goto error;
1700915f 4822
6e1df6a6
AE		 4823 if (hdev->dev_type != HCI_AMP || !test_bit(HCI_UP, &hdev->flags)) {
4824 hci_dev_put(hdev);
4825 goto error;
4826 }
1700915f 4827
6e1df6a6
AE		 4828 chan = l2cap_connect(conn, cmd, data, L2CAP_CREATE_CHAN_RSP,
4829 req->amp_id);
4830 if (chan) {
4831 struct amp_mgr *mgr = conn->hcon->amp_mgr;
4832 struct hci_conn *hs_hcon;
1700915f 4833
98e0f7ea
MH		 4834 hs_hcon = hci_conn_hash_lookup_ba(hdev, AMP_LINK,
4835 &conn->hcon->dst);
6e1df6a6
AE		 4836 if (!hs_hcon) {
4837 hci_dev_put(hdev);
662d652d
JH		 4838 cmd_reject_invalid_cid(conn, cmd->ident, chan->scid,
4839 chan->dcid);
4840 return 0;
1700915f
MM		 4841 }
4842
6e1df6a6
AE		 4843 BT_DBG("mgr %p bredr_chan %p hs_hcon %p", mgr, chan, hs_hcon);
4844
6e1df6a6
AE		 4845 mgr->bredr_chan = chan;
4846 chan->hs_hcon = hs_hcon;
fd45bf4c 4847 chan->fcs = L2CAP_FCS_NONE;
6e1df6a6 4848 conn->mtu = hdev->block_mtu;
1700915f 4849 }
f94ff6ff 4850
6e1df6a6 4851 hci_dev_put(hdev);
f94ff6ff
MM		 4852
4853 return 0;
6e1df6a6
AE		 4854
4855error:
4856 rsp.dcid = 0;
4857 rsp.scid = cpu_to_le16(scid);
dcf4adbf
JP		 4858 rsp.result = cpu_to_le16(L2CAP_CR_BAD_AMP);
4859 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
6e1df6a6
AE		 4860
4861 l2cap_send_cmd(conn, cmd->ident, L2CAP_CREATE_CHAN_RSP,
4862 sizeof(rsp), &rsp);
4863
dc280801 4864 return 0;
f94ff6ff
MM		 4865}
4866
8eb200bd
MM		 4867static void l2cap_send_move_chan_req(struct l2cap_chan *chan, u8 dest_amp_id)
4868{
4869 struct l2cap_move_chan_req req;
4870 u8 ident;
4871
4872 BT_DBG("chan %p, dest_amp_id %d", chan, dest_amp_id);
4873
4874 ident = l2cap_get_ident(chan->conn);
4875 chan->ident = ident;
4876
4877 req.icid = cpu_to_le16(chan->scid);
4878 req.dest_amp_id = dest_amp_id;
4879
4880 l2cap_send_cmd(chan->conn, ident, L2CAP_MOVE_CHAN_REQ, sizeof(req),
4881 &req);
4882
4883 __set_chan_timer(chan, L2CAP_MOVE_TIMEOUT);
4884}
4885
1500109b 4886static void l2cap_send_move_chan_rsp(struct l2cap_chan *chan, u16 result)
8d5a04a1
MM		 4887{
4888 struct l2cap_move_chan_rsp rsp;
4889
1500109b 4890 BT_DBG("chan %p, result 0x%4.4x", chan, result);
8d5a04a1 4891
1500109b 4892 rsp.icid = cpu_to_le16(chan->dcid);
8d5a04a1
MM		 4893 rsp.result = cpu_to_le16(result);
4894
1500109b
MM		 4895 l2cap_send_cmd(chan->conn, chan->ident, L2CAP_MOVE_CHAN_RSP,
4896 sizeof(rsp), &rsp);
8d5a04a1
MM		 4897}
4898
5b155ef9 4899static void l2cap_send_move_chan_cfm(struct l2cap_chan *chan, u16 result)
8d5a04a1
MM		 4900{
4901 struct l2cap_move_chan_cfm cfm;
8d5a04a1 4902
5b155ef9 4903 BT_DBG("chan %p, result 0x%4.4x", chan, result);
8d5a04a1 4904
5b155ef9 4905 chan->ident = l2cap_get_ident(chan->conn);
8d5a04a1 4906
5b155ef9 4907 cfm.icid = cpu_to_le16(chan->scid);
8d5a04a1
MM		 4908 cfm.result = cpu_to_le16(result);
4909
5b155ef9
MM		 4910 l2cap_send_cmd(chan->conn, chan->ident, L2CAP_MOVE_CHAN_CFM,
4911 sizeof(cfm), &cfm);
4912
4913 __set_chan_timer(chan, L2CAP_MOVE_TIMEOUT);
4914}
4915
4916static void l2cap_send_move_chan_cfm_icid(struct l2cap_conn *conn, u16 icid)
4917{
4918 struct l2cap_move_chan_cfm cfm;
4919
4920 BT_DBG("conn %p, icid 0x%4.4x", conn, icid);
4921
4922 cfm.icid = cpu_to_le16(icid);
dcf4adbf 4923 cfm.result = cpu_to_le16(L2CAP_MC_UNCONFIRMED);
5b155ef9
MM		 4924
4925 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_MOVE_CHAN_CFM,
4926 sizeof(cfm), &cfm);
8d5a04a1
MM		 4927}
4928
4929static void l2cap_send_move_chan_cfm_rsp(struct l2cap_conn *conn, u8 ident,
ad0ac6ca 4930 u16 icid)
8d5a04a1
MM		 4931{
4932 struct l2cap_move_chan_cfm_rsp rsp;
4933
ad0ac6ca 4934 BT_DBG("icid 0x%4.4x", icid);
8d5a04a1
MM		 4935
4936 rsp.icid = cpu_to_le16(icid);
4937 l2cap_send_cmd(conn, ident, L2CAP_MOVE_CHAN_CFM_RSP, sizeof(rsp), &rsp);
4938}
4939
5f3847a4
MM		 4940static void __release_logical_link(struct l2cap_chan *chan)
4941{
4942 chan->hs_hchan = NULL;
4943 chan->hs_hcon = NULL;
4944
4945 /* Placeholder - release the logical link */
4946}
4947
1500109b
MM		 4948static void l2cap_logical_fail(struct l2cap_chan *chan)
4949{
4950 /* Logical link setup failed */
4951 if (chan->state != BT_CONNECTED) {
4952 /* Create channel failure, disconnect */
5e4e3972 4953 l2cap_send_disconn_req(chan, ECONNRESET);
1500109b
MM		 4954 return;
4955 }
4956
4957 switch (chan->move_role) {
4958 case L2CAP_MOVE_ROLE_RESPONDER:
4959 l2cap_move_done(chan);
4960 l2cap_send_move_chan_rsp(chan, L2CAP_MR_NOT_SUPP);
4961 break;
4962 case L2CAP_MOVE_ROLE_INITIATOR:
4963 if (chan->move_state == L2CAP_MOVE_WAIT_LOGICAL_COMP ||
4964 chan->move_state == L2CAP_MOVE_WAIT_LOGICAL_CFM) {
4965 /* Remote has only sent pending or
4966 * success responses, clean up
4967 */
4968 l2cap_move_done(chan);
4969 }
4970
4971 /* Other amp move states imply that the move
4972 * has already aborted
4973 */
4974 l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);
4975 break;
4976 }
4977}
4978
4979static void l2cap_logical_finish_create(struct l2cap_chan *chan,
4980 struct hci_chan *hchan)
4981{
4982 struct l2cap_conf_rsp rsp;
1500109b 4983
336178a3 4984 chan->hs_hchan = hchan;
1500109b
MM		 4985 chan->hs_hcon->l2cap_data = chan->conn;
4986
35ba9561 4987 l2cap_send_efs_conf_rsp(chan, &rsp, chan->ident, 0);
1500109b
MM		 4988
4989 if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {
fe79c6fe 4990 int err;
1500109b
MM		 4991
4992 set_default_fcs(chan);
4993
4994 err = l2cap_ertm_init(chan);
4995 if (err < 0)
5e4e3972 4996 l2cap_send_disconn_req(chan, -err);
1500109b
MM		 4997 else
4998 l2cap_chan_ready(chan);
4999 }
5000}
5001
5002static void l2cap_logical_finish_move(struct l2cap_chan *chan,
5003 struct hci_chan *hchan)
5004{
5005 chan->hs_hcon = hchan->conn;
5006 chan->hs_hcon->l2cap_data = chan->conn;
5007
5008 BT_DBG("move_state %d", chan->move_state);
5009
5010 switch (chan->move_state) {
5011 case L2CAP_MOVE_WAIT_LOGICAL_COMP:
5012 /* Move confirm will be sent after a success
5013 * response is received
5014 */
5015 chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;
5016 break;
5017 case L2CAP_MOVE_WAIT_LOGICAL_CFM:
5018 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
5019 chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;
5020 } else if (chan->move_role == L2CAP_MOVE_ROLE_INITIATOR) {
5021 chan->move_state = L2CAP_MOVE_WAIT_CONFIRM_RSP;
5022 l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);
5023 } else if (chan->move_role == L2CAP_MOVE_ROLE_RESPONDER) {
5024 chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;
5025 l2cap_send_move_chan_rsp(chan, L2CAP_MR_SUCCESS);
5026 }
5027 break;
5028 default:
5029 /* Move was not in expected state, free the channel */
5030 __release_logical_link(chan);
5031
5032 chan->move_state = L2CAP_MOVE_STABLE;
5033 }
5034}
5035
5036/* Call with chan locked */
27695fb4
AE		 5037void l2cap_logical_cfm(struct l2cap_chan *chan, struct hci_chan *hchan,
5038 u8 status)
5b155ef9 5039{
1500109b
MM		 5040 BT_DBG("chan %p, hchan %p, status %d", chan, hchan, status);
5041
5042 if (status) {
5043 l2cap_logical_fail(chan);
5044 __release_logical_link(chan);
5045 return;
5046 }
5047
5048 if (chan->state != BT_CONNECTED) {
5049 /* Ignore logical link if channel is on BR/EDR */
6ed971ca 5050 if (chan->local_amp_id != AMP_ID_BREDR)
1500109b
MM		 5051 l2cap_logical_finish_create(chan, hchan);
5052 } else {
5053 l2cap_logical_finish_move(chan, hchan);
5054 }
5b155ef9
MM		 5055}
5056
3f7a56c4
MM		 5057void l2cap_move_start(struct l2cap_chan *chan)
5058{
5059 BT_DBG("chan %p", chan);
5060
6ed971ca 5061 if (chan->local_amp_id == AMP_ID_BREDR) {
3f7a56c4
MM		 5062 if (chan->chan_policy != BT_CHANNEL_POLICY_AMP_PREFERRED)
5063 return;
5064 chan->move_role = L2CAP_MOVE_ROLE_INITIATOR;
5065 chan->move_state = L2CAP_MOVE_WAIT_PREPARE;
5066 /* Placeholder - start physical link setup */
5067 } else {
5068 chan->move_role = L2CAP_MOVE_ROLE_INITIATOR;
5069 chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;
5070 chan->move_id = 0;
5071 l2cap_move_setup(chan);
5072 l2cap_send_move_chan_req(chan, 0);
5073 }
5074}
5075
8eb200bd
MM		 5076static void l2cap_do_create(struct l2cap_chan *chan, int result,
5077 u8 local_amp_id, u8 remote_amp_id)
5078{
62748ca1
AE		 5079 BT_DBG("chan %p state %s %u -> %u", chan, state_to_string(chan->state),
5080 local_amp_id, remote_amp_id);
5081
12d6cc60
AE		 5082 chan->fcs = L2CAP_FCS_NONE;
5083
62748ca1
AE		 5084 /* Outgoing channel on AMP */
5085 if (chan->state == BT_CONNECT) {
5086 if (result == L2CAP_CR_SUCCESS) {
5087 chan->local_amp_id = local_amp_id;
5088 l2cap_send_create_chan_req(chan, remote_amp_id);
5089 } else {
5090 /* Revert to BR/EDR connect */
5091 l2cap_send_conn_req(chan);
5092 }
5093
5094 return;
5095 }
5096
5097 /* Incoming channel on AMP */
5098 if (__l2cap_no_conn_pending(chan)) {
8eb200bd
MM		 5099 struct l2cap_conn_rsp rsp;
5100 char buf[128];
5101 rsp.scid = cpu_to_le16(chan->dcid);
5102 rsp.dcid = cpu_to_le16(chan->scid);
5103
8eb200bd
MM		 5104 if (result == L2CAP_CR_SUCCESS) {
5105 /* Send successful response */
dcf4adbf
JP		 5106 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
5107 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
8eb200bd
MM		 5108 } else {
5109 /* Send negative response */
dcf4adbf
JP		 5110 rsp.result = cpu_to_le16(L2CAP_CR_NO_MEM);
5111 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
8eb200bd
MM		 5112 }
5113
5114 l2cap_send_cmd(chan->conn, chan->ident, L2CAP_CREATE_CHAN_RSP,
5115 sizeof(rsp), &rsp);
5116
5117 if (result == L2CAP_CR_SUCCESS) {
f93fa273 5118 l2cap_state_change(chan, BT_CONFIG);
8eb200bd
MM		 5119 set_bit(CONF_REQ_SENT, &chan->conf_state);
5120 l2cap_send_cmd(chan->conn, l2cap_get_ident(chan->conn),
5121 L2CAP_CONF_REQ,
e860d2c9 5122 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
8eb200bd
MM		 5123 chan->num_conf_req++;
5124 }
8eb200bd
MM		 5125 }
5126}
5127
5128static void l2cap_do_move_initiate(struct l2cap_chan *chan, u8 local_amp_id,
5129 u8 remote_amp_id)
5130{
5131 l2cap_move_setup(chan);
5132 chan->move_id = local_amp_id;
5133 chan->move_state = L2CAP_MOVE_WAIT_RSP;
5134
5135 l2cap_send_move_chan_req(chan, remote_amp_id);
5136}
5137
5138static void l2cap_do_move_respond(struct l2cap_chan *chan, int result)
5139{
5140 struct hci_chan *hchan = NULL;
5141
5142 /* Placeholder - get hci_chan for logical link */
5143
5144 if (hchan) {
5145 if (hchan->state == BT_CONNECTED) {
5146 /* Logical link is ready to go */
5147 chan->hs_hcon = hchan->conn;
5148 chan->hs_hcon->l2cap_data = chan->conn;
5149 chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;
5150 l2cap_send_move_chan_rsp(chan, L2CAP_MR_SUCCESS);
5151
5152 l2cap_logical_cfm(chan, hchan, L2CAP_MR_SUCCESS);
5153 } else {
5154 /* Wait for logical link to be ready */
5155 chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;
5156 }
5157 } else {
5158 /* Logical link not available */
5159 l2cap_send_move_chan_rsp(chan, L2CAP_MR_NOT_ALLOWED);
5160 }
5161}
5162
5163static void l2cap_do_move_cancel(struct l2cap_chan *chan, int result)
5164{
5165 if (chan->move_role == L2CAP_MOVE_ROLE_RESPONDER) {
5166 u8 rsp_result;
5167 if (result == -EINVAL)
5168 rsp_result = L2CAP_MR_BAD_ID;
5169 else
5170 rsp_result = L2CAP_MR_NOT_ALLOWED;
5171
5172 l2cap_send_move_chan_rsp(chan, rsp_result);
5173 }
5174
5175 chan->move_role = L2CAP_MOVE_ROLE_NONE;
5176 chan->move_state = L2CAP_MOVE_STABLE;
5177
5178 /* Restart data transmission */
5179 l2cap_ertm_send(chan);
5180}
5181
a514b17f
AE		 5182/* Invoke with locked chan */
5183void __l2cap_physical_cfm(struct l2cap_chan *chan, int result)
8eb200bd 5184{
770bfefa 5185 u8 local_amp_id = chan->local_amp_id;
fffadc08 5186 u8 remote_amp_id = chan->remote_amp_id;
770bfefa 5187
8eb200bd
MM		 5188 BT_DBG("chan %p, result %d, local_amp_id %d, remote_amp_id %d",
5189 chan, result, local_amp_id, remote_amp_id);
5190
df66499a 5191 if (chan->state == BT_DISCONN || chan->state == BT_CLOSED)
8eb200bd 5192 return;
8eb200bd
MM		 5193
5194 if (chan->state != BT_CONNECTED) {
5195 l2cap_do_create(chan, result, local_amp_id, remote_amp_id);
5196 } else if (result != L2CAP_MR_SUCCESS) {
5197 l2cap_do_move_cancel(chan, result);
5198 } else {
5199 switch (chan->move_role) {
5200 case L2CAP_MOVE_ROLE_INITIATOR:
5201 l2cap_do_move_initiate(chan, local_amp_id,
5202 remote_amp_id);
5203 break;
5204 case L2CAP_MOVE_ROLE_RESPONDER:
5205 l2cap_do_move_respond(chan, result);
5206 break;
5207 default:
5208 l2cap_do_move_cancel(chan, result);
5209 break;
5210 }
5211 }
8eb200bd
MM		 5212}
5213
8d5a04a1 5214static inline int l2cap_move_channel_req(struct l2cap_conn *conn,
ad0ac6ca
AE		 5215 struct l2cap_cmd_hdr *cmd,
5216 u16 cmd_len, void *data)
8d5a04a1
MM		 5217{
5218 struct l2cap_move_chan_req *req = data;
1500109b 5219 struct l2cap_move_chan_rsp rsp;
02b0fbb9 5220 struct l2cap_chan *chan;
8d5a04a1
MM		 5221 u16 icid = 0;
5222 u16 result = L2CAP_MR_NOT_ALLOWED;
5223
5224 if (cmd_len != sizeof(*req))
5225 return -EPROTO;
5226
5227 icid = le16_to_cpu(req->icid);
5228
ad0ac6ca 5229 BT_DBG("icid 0x%4.4x, dest_amp_id %d", icid, req->dest_amp_id);
8d5a04a1 5230
0bd49fc7 5231 if (!(conn->local_fixed_chan & L2CAP_FC_A2MP))
8d5a04a1
MM		 5232 return -EINVAL;
5233
02b0fbb9
MM		 5234 chan = l2cap_get_chan_by_dcid(conn, icid);
5235 if (!chan) {
1500109b 5236 rsp.icid = cpu_to_le16(icid);
dcf4adbf 5237 rsp.result = cpu_to_le16(L2CAP_MR_NOT_ALLOWED);
1500109b
MM		 5238 l2cap_send_cmd(conn, cmd->ident, L2CAP_MOVE_CHAN_RSP,
5239 sizeof(rsp), &rsp);
02b0fbb9
MM		 5240 return 0;
5241 }
5242
1500109b
MM		 5243 chan->ident = cmd->ident;
5244
02b0fbb9
MM		 5245 if (chan->scid < L2CAP_CID_DYN_START ||
5246 chan->chan_policy == BT_CHANNEL_POLICY_BREDR_ONLY ||
5247 (chan->mode != L2CAP_MODE_ERTM &&
5248 chan->mode != L2CAP_MODE_STREAMING)) {
5249 result = L2CAP_MR_NOT_ALLOWED;
5250 goto send_move_response;
5251 }
5252
5253 if (chan->local_amp_id == req->dest_amp_id) {
5254 result = L2CAP_MR_SAME_ID;
5255 goto send_move_response;
5256 }
5257
6ed971ca 5258 if (req->dest_amp_id != AMP_ID_BREDR) {
02b0fbb9
MM		 5259 struct hci_dev *hdev;
5260 hdev = hci_dev_get(req->dest_amp_id);
5261 if (!hdev || hdev->dev_type != HCI_AMP ||
5262 !test_bit(HCI_UP, &hdev->flags)) {
5263 if (hdev)
5264 hci_dev_put(hdev);
5265
5266 result = L2CAP_MR_BAD_ID;
5267 goto send_move_response;
5268 }
5269 hci_dev_put(hdev);
5270 }
5271
5272 /* Detect a move collision. Only send a collision response
5273 * if this side has "lost", otherwise proceed with the move.
5274 * The winner has the larger bd_addr.
5275 */
5276 if ((__chan_is_moving(chan) ||
5277 chan->move_role != L2CAP_MOVE_ROLE_NONE) &&
6f59b904 5278 bacmp(&conn->hcon->src, &conn->hcon->dst) > 0) {
02b0fbb9
MM		 5279 result = L2CAP_MR_COLLISION;
5280 goto send_move_response;
5281 }
5282
02b0fbb9
MM		 5283 chan->move_role = L2CAP_MOVE_ROLE_RESPONDER;
5284 l2cap_move_setup(chan);
5285 chan->move_id = req->dest_amp_id;
02b0fbb9 5286
6ed971ca 5287 if (req->dest_amp_id == AMP_ID_BREDR) {
02b0fbb9
MM		 5288 /* Moving to BR/EDR */
5289 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
5290 chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;
5291 result = L2CAP_MR_PEND;
5292 } else {
5293 chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;
5294 result = L2CAP_MR_SUCCESS;
5295 }
5296 } else {
5297 chan->move_state = L2CAP_MOVE_WAIT_PREPARE;
5298 /* Placeholder - uncomment when amp functions are available */
5299 /*amp_accept_physical(chan, req->dest_amp_id);*/
5300 result = L2CAP_MR_PEND;
5301 }
5302
5303send_move_response:
1500109b 5304 l2cap_send_move_chan_rsp(chan, result);
8d5a04a1 5305
02b0fbb9
MM		 5306 l2cap_chan_unlock(chan);
5307
8d5a04a1
MM		 5308 return 0;
5309}
5310
5b155ef9
MM		 5311static void l2cap_move_continue(struct l2cap_conn *conn, u16 icid, u16 result)
5312{
5313 struct l2cap_chan *chan;
5314 struct hci_chan *hchan = NULL;
5315
5316 chan = l2cap_get_chan_by_scid(conn, icid);
5317 if (!chan) {
5318 l2cap_send_move_chan_cfm_icid(conn, icid);
5319 return;
5320 }
5321
5322 __clear_chan_timer(chan);
5323 if (result == L2CAP_MR_PEND)
5324 __set_chan_timer(chan, L2CAP_MOVE_ERTX_TIMEOUT);
5325
5326 switch (chan->move_state) {
5327 case L2CAP_MOVE_WAIT_LOGICAL_COMP:
5328 /* Move confirm will be sent when logical link
5329 * is complete.
5330 */
5331 chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;
5332 break;
5333 case L2CAP_MOVE_WAIT_RSP_SUCCESS:
5334 if (result == L2CAP_MR_PEND) {
5335 break;
5336 } else if (test_bit(CONN_LOCAL_BUSY,
5337 &chan->conn_state)) {
5338 chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;
5339 } else {
5340 /* Logical link is up or moving to BR/EDR,
5341 * proceed with move
5342 */
5343 chan->move_state = L2CAP_MOVE_WAIT_CONFIRM_RSP;
5344 l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);
5345 }
5346 break;
5347 case L2CAP_MOVE_WAIT_RSP:
5348 /* Moving to AMP */
5349 if (result == L2CAP_MR_SUCCESS) {
5350 /* Remote is ready, send confirm immediately
5351 * after logical link is ready
5352 */
5353 chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;
5354 } else {
5355 /* Both logical link and move success
5356 * are required to confirm
5357 */
5358 chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_COMP;
5359 }
5360
5361 /* Placeholder - get hci_chan for logical link */
5362 if (!hchan) {
5363 /* Logical link not available */
5364 l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);
5365 break;
5366 }
5367
5368 /* If the logical link is not yet connected, do not
5369 * send confirmation.
5370 */
5371 if (hchan->state != BT_CONNECTED)
5372 break;
5373
5374 /* Logical link is already ready to go */
5375
5376 chan->hs_hcon = hchan->conn;
5377 chan->hs_hcon->l2cap_data = chan->conn;
5378
5379 if (result == L2CAP_MR_SUCCESS) {
5380 /* Can confirm now */
5381 l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);
5382 } else {
5383 /* Now only need move success
5384 * to confirm
5385 */
5386 chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;
5387 }
5388
5389 l2cap_logical_cfm(chan, hchan, L2CAP_MR_SUCCESS);
5390 break;
5391 default:
5392 /* Any other amp move state means the move failed. */
5393 chan->move_id = chan->local_amp_id;
5394 l2cap_move_done(chan);
5395 l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);
5396 }
5397
5398 l2cap_chan_unlock(chan);
5399}
5400
5401static void l2cap_move_fail(struct l2cap_conn *conn, u8 ident, u16 icid,
5402 u16 result)
5403{
5404 struct l2cap_chan *chan;
5405
5406 chan = l2cap_get_chan_by_ident(conn, ident);
5407 if (!chan) {
5408 /* Could not locate channel, icid is best guess */
5409 l2cap_send_move_chan_cfm_icid(conn, icid);
5410 return;
5411 }
5412
5413 __clear_chan_timer(chan);
5414
5415 if (chan->move_role == L2CAP_MOVE_ROLE_INITIATOR) {
5416 if (result == L2CAP_MR_COLLISION) {
5417 chan->move_role = L2CAP_MOVE_ROLE_RESPONDER;
5418 } else {
5419 /* Cleanup - cancel move */
5420 chan->move_id = chan->local_amp_id;
5421 l2cap_move_done(chan);
5422 }
5423 }
5424
5425 l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);
5426
5427 l2cap_chan_unlock(chan);
5428}
5429
5430static int l2cap_move_channel_rsp(struct l2cap_conn *conn,
5431 struct l2cap_cmd_hdr *cmd,
5432 u16 cmd_len, void *data)
8d5a04a1
MM		 5433{
5434 struct l2cap_move_chan_rsp *rsp = data;
5435 u16 icid, result;
5436
5437 if (cmd_len != sizeof(*rsp))
5438 return -EPROTO;
5439
5440 icid = le16_to_cpu(rsp->icid);
5441 result = le16_to_cpu(rsp->result);
5442
ad0ac6ca 5443 BT_DBG("icid 0x%4.4x, result 0x%4.4x", icid, result);
8d5a04a1 5444
5b155ef9
MM		 5445 if (result == L2CAP_MR_SUCCESS || result == L2CAP_MR_PEND)
5446 l2cap_move_continue(conn, icid, result);
5447 else
5448 l2cap_move_fail(conn, cmd->ident, icid, result);
8d5a04a1
MM		 5449
5450 return 0;
5451}
5452
5f3847a4
MM		 5453static int l2cap_move_channel_confirm(struct l2cap_conn *conn,
5454 struct l2cap_cmd_hdr *cmd,
5455 u16 cmd_len, void *data)
8d5a04a1
MM		 5456{
5457 struct l2cap_move_chan_cfm *cfm = data;
5f3847a4 5458 struct l2cap_chan *chan;
8d5a04a1
MM		 5459 u16 icid, result;
5460
5461 if (cmd_len != sizeof(*cfm))
5462 return -EPROTO;
5463
5464 icid = le16_to_cpu(cfm->icid);
5465 result = le16_to_cpu(cfm->result);
5466
ad0ac6ca 5467 BT_DBG("icid 0x%4.4x, result 0x%4.4x", icid, result);
8d5a04a1 5468
5f3847a4
MM		 5469 chan = l2cap_get_chan_by_dcid(conn, icid);
5470 if (!chan) {
5471 /* Spec requires a response even if the icid was not found */
5472 l2cap_send_move_chan_cfm_rsp(conn, cmd->ident, icid);
5473 return 0;
5474 }
5475
5476 if (chan->move_state == L2CAP_MOVE_WAIT_CONFIRM) {
5477 if (result == L2CAP_MC_CONFIRMED) {
5478 chan->local_amp_id = chan->move_id;
6ed971ca 5479 if (chan->local_amp_id == AMP_ID_BREDR)
5f3847a4
MM		 5480 __release_logical_link(chan);
5481 } else {
5482 chan->move_id = chan->local_amp_id;
5483 }
5484
5485 l2cap_move_done(chan);
5486 }
5487
8d5a04a1
MM		 5488 l2cap_send_move_chan_cfm_rsp(conn, cmd->ident, icid);
5489
5f3847a4
MM		 5490 l2cap_chan_unlock(chan);
5491
8d5a04a1
MM		 5492 return 0;
5493}
5494
5495static inline int l2cap_move_channel_confirm_rsp(struct l2cap_conn *conn,
ad0ac6ca
AE		 5496 struct l2cap_cmd_hdr *cmd,
5497 u16 cmd_len, void *data)
8d5a04a1
MM		 5498{
5499 struct l2cap_move_chan_cfm_rsp *rsp = data;
3fd71a0a 5500 struct l2cap_chan *chan;
8d5a04a1
MM		 5501 u16 icid;
5502
5503 if (cmd_len != sizeof(*rsp))
5504 return -EPROTO;
5505
5506 icid = le16_to_cpu(rsp->icid);
5507
ad0ac6ca 5508 BT_DBG("icid 0x%4.4x", icid);
8d5a04a1 5509
3fd71a0a
MM		 5510 chan = l2cap_get_chan_by_scid(conn, icid);
5511 if (!chan)
5512 return 0;
5513
5514 __clear_chan_timer(chan);
5515
5516 if (chan->move_state == L2CAP_MOVE_WAIT_CONFIRM_RSP) {
5517 chan->local_amp_id = chan->move_id;
5518
6ed971ca 5519 if (chan->local_amp_id == AMP_ID_BREDR && chan->hs_hchan)
3fd71a0a
MM		 5520 __release_logical_link(chan);
5521
5522 l2cap_move_done(chan);
5523 }
5524
5525 l2cap_chan_unlock(chan);
5526
8d5a04a1
MM		 5527 return 0;
5528}
5529
de73115a 5530static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn,
2d792818 5531 struct l2cap_cmd_hdr *cmd,
203e639e 5532 u16 cmd_len, u8 *data)
de73115a
CT		 5533{
5534 struct hci_conn *hcon = conn->hcon;
5535 struct l2cap_conn_param_update_req *req;
5536 struct l2cap_conn_param_update_rsp rsp;
203e639e 5537 u16 min, max, latency, to_multiplier;
2ce603eb 5538 int err;
de73115a 5539
40bef302 5540 if (hcon->role != HCI_ROLE_MASTER)
de73115a
CT		 5541 return -EINVAL;
5542
de73115a
CT		 5543 if (cmd_len != sizeof(struct l2cap_conn_param_update_req))
5544 return -EPROTO;
5545
5546 req = (struct l2cap_conn_param_update_req *) data;
e2174ca4
GP		 5547 min = __le16_to_cpu(req->min);
5548 max = __le16_to_cpu(req->max);
de73115a
CT		 5549 latency = __le16_to_cpu(req->latency);
5550 to_multiplier = __le16_to_cpu(req->to_multiplier);
5551
5552 BT_DBG("min 0x%4.4x max 0x%4.4x latency: 0x%4.4x Timeout: 0x%4.4x",
2d792818 5553 min, max, latency, to_multiplier);
de73115a
CT		 5554
5555 memset(&rsp, 0, sizeof(rsp));
2ce603eb 5556
68d19d7d 5557 err = hci_check_conn_params(min, max, latency, to_multiplier);
2ce603eb 5558 if (err)
dcf4adbf 5559 rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED);
de73115a 5560 else
dcf4adbf 5561 rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_ACCEPTED);
de73115a
CT		 5562
5563 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_PARAM_UPDATE_RSP,
2d792818 5564 sizeof(rsp), &rsp);
de73115a 5565
ffb5a827 5566 if (!err) {
f4869e2a
JH		 5567 u8 store_hint;
5568
5569 store_hint = hci_le_conn_update(hcon, min, max, latency,
5570 to_multiplier);
ffb5a827 5571 mgmt_new_conn_param(hcon->hdev, &hcon->dst, hcon->dst_type,
f4869e2a
JH		 5572 store_hint, min, max, latency,
5573 to_multiplier);
ffb5a827 5574
ffb5a827 5575 }
2ce603eb 5576
de73115a
CT		 5577 return 0;
5578}
5579
f1496dee
JH		 5580static int l2cap_le_connect_rsp(struct l2cap_conn *conn,
5581 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5582 u8 *data)
5583{
5584 struct l2cap_le_conn_rsp *rsp = (struct l2cap_le_conn_rsp *) data;
3e64b7bd 5585 struct hci_conn *hcon = conn->hcon;
f1496dee
JH		 5586 u16 dcid, mtu, mps, credits, result;
5587 struct l2cap_chan *chan;
3e64b7bd 5588 int err, sec_level;
f1496dee
JH		 5589
5590 if (cmd_len < sizeof(*rsp))
5591 return -EPROTO;
5592
5593 dcid = __le16_to_cpu(rsp->dcid);
5594 mtu = __le16_to_cpu(rsp->mtu);
5595 mps = __le16_to_cpu(rsp->mps);
5596 credits = __le16_to_cpu(rsp->credits);
5597 result = __le16_to_cpu(rsp->result);
5598
571f7390 5599 if (result == L2CAP_CR_LE_SUCCESS && (mtu < 23 || mps < 23 ||
40624183
JH		 5600 dcid < L2CAP_CID_DYN_START ||
5601 dcid > L2CAP_CID_LE_DYN_END))
f1496dee
JH		 5602 return -EPROTO;
5603
5604 BT_DBG("dcid 0x%4.4x mtu %u mps %u credits %u result 0x%2.2x",
5605 dcid, mtu, mps, credits, result);
5606
5607 mutex_lock(&conn->chan_lock);
5608
5609 chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
5610 if (!chan) {
5611 err = -EBADSLT;
5612 goto unlock;
5613 }
5614
5615 err = 0;
5616
5617 l2cap_chan_lock(chan);
5618
5619 switch (result) {
571f7390 5620 case L2CAP_CR_LE_SUCCESS:
40624183
JH		 5621 if (__l2cap_get_chan_by_dcid(conn, dcid)) {
5622 err = -EBADSLT;
5623 break;
5624 }
5625
f1496dee
JH		 5626 chan->ident = 0;
5627 chan->dcid = dcid;
5628 chan->omtu = mtu;
5629 chan->remote_mps = mps;
0cd75f7e 5630 chan->tx_credits = credits;
f1496dee
JH		 5631 l2cap_chan_ready(chan);
5632 break;
5633
571f7390
MP		 5634 case L2CAP_CR_LE_AUTHENTICATION:
5635 case L2CAP_CR_LE_ENCRYPTION:
3e64b7bd
JH		 5636 /* If we already have MITM protection we can't do
5637 * anything.
5638 */
5639 if (hcon->sec_level > BT_SECURITY_MEDIUM) {
5640 l2cap_chan_del(chan, ECONNREFUSED);
5641 break;
5642 }
5643
5644 sec_level = hcon->sec_level + 1;
5645 if (chan->sec_level < sec_level)
5646 chan->sec_level = sec_level;
5647
5648 /* We'll need to send a new Connect Request */
5649 clear_bit(FLAG_LE_CONN_REQ_SENT, &chan->flags);
5650
5651 smp_conn_security(hcon, chan->sec_level);
5652 break;
5653
f1496dee
JH		 5654 default:
5655 l2cap_chan_del(chan, ECONNREFUSED);
5656 break;
5657 }
5658
5659 l2cap_chan_unlock(chan);
5660
5661unlock:
5662 mutex_unlock(&conn->chan_lock);
5663
5664 return err;
5665}
5666
3300d9a9 5667static inline int l2cap_bredr_sig_cmd(struct l2cap_conn *conn,
2d792818
GP		 5668 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5669 u8 *data)
3300d9a9
CT		 5670{
5671 int err = 0;
5672
5673 switch (cmd->code) {
5674 case L2CAP_COMMAND_REJ:
cb3b3152 5675 l2cap_command_rej(conn, cmd, cmd_len, data);
3300d9a9
CT		 5676 break;
5677
5678 case L2CAP_CONN_REQ:
cb3b3152 5679 err = l2cap_connect_req(conn, cmd, cmd_len, data);
3300d9a9
CT		 5680 break;
5681
5682 case L2CAP_CONN_RSP:
f5a2598d 5683 case L2CAP_CREATE_CHAN_RSP:
9245e737 5684 l2cap_connect_create_rsp(conn, cmd, cmd_len, data);
3300d9a9
CT		 5685 break;
5686
5687 case L2CAP_CONF_REQ:
5688 err = l2cap_config_req(conn, cmd, cmd_len, data);
5689 break;
5690
5691 case L2CAP_CONF_RSP:
9245e737 5692 l2cap_config_rsp(conn, cmd, cmd_len, data);
3300d9a9
CT		 5693 break;
5694
5695 case L2CAP_DISCONN_REQ:
cb3b3152 5696 err = l2cap_disconnect_req(conn, cmd, cmd_len, data);
3300d9a9
CT		 5697 break;
5698
5699 case L2CAP_DISCONN_RSP:
9245e737 5700 l2cap_disconnect_rsp(conn, cmd, cmd_len, data);
3300d9a9
CT		 5701 break;
5702
5703 case L2CAP_ECHO_REQ:
5704 l2cap_send_cmd(conn, cmd->ident, L2CAP_ECHO_RSP, cmd_len, data);
5705 break;
5706
5707 case L2CAP_ECHO_RSP:
5708 break;
5709
5710 case L2CAP_INFO_REQ:
cb3b3152 5711 err = l2cap_information_req(conn, cmd, cmd_len, data);
3300d9a9
CT		 5712 break;
5713
5714 case L2CAP_INFO_RSP:
9245e737 5715 l2cap_information_rsp(conn, cmd, cmd_len, data);
3300d9a9
CT		 5716 break;
5717
f94ff6ff
MM		 5718 case L2CAP_CREATE_CHAN_REQ:
5719 err = l2cap_create_channel_req(conn, cmd, cmd_len, data);
5720 break;
5721
8d5a04a1
MM		 5722 case L2CAP_MOVE_CHAN_REQ:
5723 err = l2cap_move_channel_req(conn, cmd, cmd_len, data);
5724 break;
5725
5726 case L2CAP_MOVE_CHAN_RSP:
9245e737 5727 l2cap_move_channel_rsp(conn, cmd, cmd_len, data);
8d5a04a1
MM		 5728 break;
5729
5730 case L2CAP_MOVE_CHAN_CFM:
5731 err = l2cap_move_channel_confirm(conn, cmd, cmd_len, data);
5732 break;
5733
5734 case L2CAP_MOVE_CHAN_CFM_RSP:
9245e737 5735 l2cap_move_channel_confirm_rsp(conn, cmd, cmd_len, data);
8d5a04a1
MM		 5736 break;
5737
3300d9a9
CT		 5738 default:
5739 BT_ERR("Unknown BR/EDR signaling command 0x%2.2x", cmd->code);
5740 err = -EINVAL;
5741 break;
5742 }
5743
5744 return err;
5745}
5746
27e2d4c8
JH		 5747static int l2cap_le_connect_req(struct l2cap_conn *conn,
5748 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5749 u8 *data)
5750{
5751 struct l2cap_le_conn_req *req = (struct l2cap_le_conn_req *) data;
5752 struct l2cap_le_conn_rsp rsp;
5753 struct l2cap_chan *chan, *pchan;
0cd75f7e 5754 u16 dcid, scid, credits, mtu, mps;
27e2d4c8
JH		 5755 __le16 psm;
5756 u8 result;
5757
5758 if (cmd_len != sizeof(*req))
5759 return -EPROTO;
5760
5761 scid = __le16_to_cpu(req->scid);
5762 mtu = __le16_to_cpu(req->mtu);
5763 mps = __le16_to_cpu(req->mps);
5764 psm = req->psm;
5765 dcid = 0;
0cd75f7e 5766 credits = 0;
27e2d4c8
JH		 5767
5768 if (mtu < 23 || mps < 23)
5769 return -EPROTO;
5770
5771 BT_DBG("psm 0x%2.2x scid 0x%4.4x mtu %u mps %u", __le16_to_cpu(psm),
5772 scid, mtu, mps);
5773
5774 /* Check if we have socket listening on psm */
5775 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src,
5776 &conn->hcon->dst, LE_LINK);
5777 if (!pchan) {
571f7390 5778 result = L2CAP_CR_LE_BAD_PSM;
27e2d4c8
JH		 5779 chan = NULL;
5780 goto response;
5781 }
5782
5783 mutex_lock(&conn->chan_lock);
5784 l2cap_chan_lock(pchan);
5785
35dc6f83
JH		 5786 if (!smp_sufficient_security(conn->hcon, pchan->sec_level,
5787 SMP_ALLOW_STK)) {
571f7390 5788 result = L2CAP_CR_LE_AUTHENTICATION;
27e2d4c8
JH		 5789 chan = NULL;
5790 goto response_unlock;
5791 }
5792
8a7889cc
JH		 5793 /* Check for valid dynamic CID range */
5794 if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_LE_DYN_END) {
571f7390 5795 result = L2CAP_CR_LE_INVALID_SCID;
8a7889cc
JH		 5796 chan = NULL;
5797 goto response_unlock;
5798 }
5799
27e2d4c8
JH		 5800 /* Check if we already have channel with that dcid */
5801 if (__l2cap_get_chan_by_dcid(conn, scid)) {
571f7390 5802 result = L2CAP_CR_LE_SCID_IN_USE;
27e2d4c8
JH		 5803 chan = NULL;
5804 goto response_unlock;
5805 }
5806
5807 chan = pchan->ops->new_connection(pchan);
5808 if (!chan) {
571f7390 5809 result = L2CAP_CR_LE_NO_MEM;
27e2d4c8
JH		 5810 goto response_unlock;
5811 }
5812
5813 bacpy(&chan->src, &conn->hcon->src);
5814 bacpy(&chan->dst, &conn->hcon->dst);
a250e048
JH		 5815 chan->src_type = bdaddr_src_type(conn->hcon);
5816 chan->dst_type = bdaddr_dst_type(conn->hcon);
27e2d4c8
JH		 5817 chan->psm = psm;
5818 chan->dcid = scid;
5819 chan->omtu = mtu;
5820 chan->remote_mps = mps;
5821
5822 __l2cap_chan_add(conn, chan);
fe149310 5823
ba8f5289 5824 l2cap_le_flowctl_init(chan, __le16_to_cpu(req->credits));
fe149310 5825
27e2d4c8 5826 dcid = chan->scid;
0cd75f7e 5827 credits = chan->rx_credits;
27e2d4c8
JH		 5828
5829 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
5830
5831 chan->ident = cmd->ident;
5832
5833 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
5834 l2cap_state_change(chan, BT_CONNECT2);
434714dc
JH		 5835 /* The following result value is actually not defined
5836 * for LE CoC but we use it to let the function know
5837 * that it should bail out after doing its cleanup
5838 * instead of sending a response.
5839 */
27e2d4c8
JH		 5840 result = L2CAP_CR_PEND;
5841 chan->ops->defer(chan);
5842 } else {
5843 l2cap_chan_ready(chan);
571f7390 5844 result = L2CAP_CR_LE_SUCCESS;
27e2d4c8
JH		 5845 }
5846
5847response_unlock:
5848 l2cap_chan_unlock(pchan);
5849 mutex_unlock(&conn->chan_lock);
a24cce14 5850 l2cap_chan_put(pchan);
27e2d4c8
JH		 5851
5852 if (result == L2CAP_CR_PEND)
5853 return 0;
5854
5855response:
5856 if (chan) {
5857 rsp.mtu = cpu_to_le16(chan->imtu);
3916aed8 5858 rsp.mps = cpu_to_le16(chan->mps);
27e2d4c8
JH		 5859 } else {
5860 rsp.mtu = 0;
5861 rsp.mps = 0;
5862 }
5863
5864 rsp.dcid = cpu_to_le16(dcid);
0cd75f7e 5865 rsp.credits = cpu_to_le16(credits);
27e2d4c8
JH		 5866 rsp.result = cpu_to_le16(result);
5867
5868 l2cap_send_cmd(conn, cmd->ident, L2CAP_LE_CONN_RSP, sizeof(rsp), &rsp);
5869
5870 return 0;
5871}
5872
fad5fc89
JH		 5873static inline int l2cap_le_credits(struct l2cap_conn *conn,
5874 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5875 u8 *data)
5876{
5877 struct l2cap_le_credits *pkt;
5878 struct l2cap_chan *chan;
0f1bfe4e 5879 u16 cid, credits, max_credits;
fad5fc89
JH		 5880
5881 if (cmd_len != sizeof(*pkt))
5882 return -EPROTO;
5883
5884 pkt = (struct l2cap_le_credits *) data;
5885 cid = __le16_to_cpu(pkt->cid);
5886 credits = __le16_to_cpu(pkt->credits);
5887
5888 BT_DBG("cid 0x%4.4x credits 0x%4.4x", cid, credits);
5889
5890 chan = l2cap_get_chan_by_dcid(conn, cid);
5891 if (!chan)
5892 return -EBADSLT;
5893
0f1bfe4e
JH		 5894 max_credits = LE_FLOWCTL_MAX_CREDITS - chan->tx_credits;
5895 if (credits > max_credits) {
5896 BT_ERR("LE credits overflow");
5897 l2cap_send_disconn_req(chan, ECONNRESET);
ee93053d 5898 l2cap_chan_unlock(chan);
0f1bfe4e
JH		 5899
5900 /* Return 0 so that we don't trigger an unnecessary
5901 * command reject packet.
5902 */
5903 return 0;
5904 }
5905
fad5fc89
JH		 5906 chan->tx_credits += credits;
5907
8a505b7f
LAD		 5908 /* Resume sending */
5909 l2cap_le_flowctl_send(chan);
fad5fc89
JH		 5910
5911 if (chan->tx_credits)
5912 chan->ops->resume(chan);
5913
5914 l2cap_chan_unlock(chan);
5915
5916 return 0;
5917}
5918
15f02b91
LAD		 5919static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn,
5920 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5921 u8 *data)
5922{
5923 struct l2cap_ecred_conn_req *req = (void *) data;
5924 struct {
5925 struct l2cap_ecred_conn_rsp rsp;
7cf3b1dd 5926 __le16 dcid[L2CAP_ECRED_MAX_CID];
15f02b91
LAD		 5927 } __packed pdu;
5928 struct l2cap_chan *chan, *pchan;
965995b7 5929 u16 mtu, mps;
15f02b91
LAD		 5930 __le16 psm;
5931 u8 result, len = 0;
5932 int i, num_scid;
5933 bool defer = false;
5934
4be5ca67
LAD		 5935 if (!enable_ecred)
5936 return -EINVAL;
5937
69d67b46 5938 if (cmd_len < sizeof(*req) || (cmd_len - sizeof(*req)) % sizeof(u16)) {
15f02b91
LAD		 5939 result = L2CAP_CR_LE_INVALID_PARAMS;
5940 goto response;
5941 }
5942
7cf3b1dd
LAD		 5943 cmd_len -= sizeof(*req);
5944 num_scid = cmd_len / sizeof(u16);
5945
5946 if (num_scid > ARRAY_SIZE(pdu.dcid)) {
5947 result = L2CAP_CR_LE_INVALID_PARAMS;
5948 goto response;
5949 }
5950
15f02b91
LAD		 5951 mtu = __le16_to_cpu(req->mtu);
5952 mps = __le16_to_cpu(req->mps);
5953
5954 if (mtu < L2CAP_ECRED_MIN_MTU || mps < L2CAP_ECRED_MIN_MPS) {
5955 result = L2CAP_CR_LE_UNACCEPT_PARAMS;
5956 goto response;
5957 }
5958
5959 psm = req->psm;
15f02b91
LAD		 5960
5961 BT_DBG("psm 0x%2.2x mtu %u mps %u", __le16_to_cpu(psm), mtu, mps);
5962
5963 memset(&pdu, 0, sizeof(pdu));
5964
5965 /* Check if we have socket listening on psm */
5966 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src,
5967 &conn->hcon->dst, LE_LINK);
5968 if (!pchan) {
5969 result = L2CAP_CR_LE_BAD_PSM;
5970 goto response;
5971 }
5972
5973 mutex_lock(&conn->chan_lock);
5974 l2cap_chan_lock(pchan);
5975
5976 if (!smp_sufficient_security(conn->hcon, pchan->sec_level,
5977 SMP_ALLOW_STK)) {
5978 result = L2CAP_CR_LE_AUTHENTICATION;
5979 goto unlock;
5980 }
5981
5982 result = L2CAP_CR_LE_SUCCESS;
15f02b91
LAD		 5983
5984 for (i = 0; i < num_scid; i++) {
5985 u16 scid = __le16_to_cpu(req->scid[i]);
5986
5987 BT_DBG("scid[%d] 0x%4.4x", i, scid);
5988
5989 pdu.dcid[i] = 0x0000;
5990 len += sizeof(*pdu.dcid);
5991
5992 /* Check for valid dynamic CID range */
5993 if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_LE_DYN_END) {
5994 result = L2CAP_CR_LE_INVALID_SCID;
5995 continue;
5996 }
5997
5998 /* Check if we already have channel with that dcid */
5999 if (__l2cap_get_chan_by_dcid(conn, scid)) {
6000 result = L2CAP_CR_LE_SCID_IN_USE;
6001 continue;
6002 }
6003
6004 chan = pchan->ops->new_connection(pchan);
6005 if (!chan) {
6006 result = L2CAP_CR_LE_NO_MEM;
6007 continue;
6008 }
6009
6010 bacpy(&chan->src, &conn->hcon->src);
6011 bacpy(&chan->dst, &conn->hcon->dst);
6012 chan->src_type = bdaddr_src_type(conn->hcon);
6013 chan->dst_type = bdaddr_dst_type(conn->hcon);
6014 chan->psm = psm;
6015 chan->dcid = scid;
6016 chan->omtu = mtu;
6017 chan->remote_mps = mps;
6018
6019 __l2cap_chan_add(conn, chan);
6020
6021 l2cap_ecred_init(chan, __le16_to_cpu(req->credits));
6022
6023 /* Init response */
6024 if (!pdu.rsp.credits) {
6025 pdu.rsp.mtu = cpu_to_le16(chan->imtu);
6026 pdu.rsp.mps = cpu_to_le16(chan->mps);
6027 pdu.rsp.credits = cpu_to_le16(chan->rx_credits);
6028 }
6029
6030 pdu.dcid[i] = cpu_to_le16(chan->scid);
6031
6032 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
6033
6034 chan->ident = cmd->ident;
6035
6036 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
6037 l2cap_state_change(chan, BT_CONNECT2);
6038 defer = true;
6039 chan->ops->defer(chan);
6040 } else {
6041 l2cap_chan_ready(chan);
6042 }
6043 }
6044
6045unlock:
6046 l2cap_chan_unlock(pchan);
6047 mutex_unlock(&conn->chan_lock);
6048 l2cap_chan_put(pchan);
6049
6050response:
6051 pdu.rsp.result = cpu_to_le16(result);
6052
6053 if (defer)
6054 return 0;
6055
6056 l2cap_send_cmd(conn, cmd->ident, L2CAP_ECRED_CONN_RSP,
6057 sizeof(pdu.rsp) + len, &pdu);
6058
6059 return 0;
6060}
6061
6062static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn,
6063 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
6064 u8 *data)
6065{
6066 struct l2cap_ecred_conn_rsp *rsp = (void *) data;
6067 struct hci_conn *hcon = conn->hcon;
6068 u16 mtu, mps, credits, result;
de895b43 6069 struct l2cap_chan *chan, *tmp;
15f02b91
LAD		 6070 int err = 0, sec_level;
6071 int i = 0;
6072
6073 if (cmd_len < sizeof(*rsp))
6074 return -EPROTO;
6075
6076 mtu = __le16_to_cpu(rsp->mtu);
6077 mps = __le16_to_cpu(rsp->mps);
6078 credits = __le16_to_cpu(rsp->credits);
6079 result = __le16_to_cpu(rsp->result);
6080
6081 BT_DBG("mtu %u mps %u credits %u result 0x%4.4x", mtu, mps, credits,
6082 result);
6083
6084 mutex_lock(&conn->chan_lock);
6085
6086 cmd_len -= sizeof(*rsp);
6087
de895b43 6088 list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
15f02b91
LAD		 6089 u16 dcid;
6090
6091 if (chan->ident != cmd->ident ||
6092 chan->mode != L2CAP_MODE_EXT_FLOWCTL ||
6093 chan->state == BT_CONNECTED)
6094 continue;
6095
6096 l2cap_chan_lock(chan);
6097
6098 /* Check that there is a dcid for each pending channel */
6099 if (cmd_len < sizeof(dcid)) {
6100 l2cap_chan_del(chan, ECONNREFUSED);
6101 l2cap_chan_unlock(chan);
6102 continue;
6103 }
6104
6105 dcid = __le16_to_cpu(rsp->dcid[i++]);
6106 cmd_len -= sizeof(u16);
6107
6108 BT_DBG("dcid[%d] 0x%4.4x", i, dcid);
6109
6110 /* Check if dcid is already in use */
6111 if (dcid && __l2cap_get_chan_by_dcid(conn, dcid)) {
6112 /* If a device receives a
6113 * L2CAP_CREDIT_BASED_CONNECTION_RSP packet with an
6114 * already-assigned Destination CID, then both the
6115 * original channel and the new channel shall be
6116 * immediately discarded and not used.
6117 */
6118 l2cap_chan_del(chan, ECONNREFUSED);
6119 l2cap_chan_unlock(chan);
6120 chan = __l2cap_get_chan_by_dcid(conn, dcid);
6121 l2cap_chan_lock(chan);
6122 l2cap_chan_del(chan, ECONNRESET);
6123 l2cap_chan_unlock(chan);
6124 continue;
6125 }
6126
6127 switch (result) {
6128 case L2CAP_CR_LE_AUTHENTICATION:
6129 case L2CAP_CR_LE_ENCRYPTION:
6130 /* If we already have MITM protection we can't do
6131 * anything.
6132 */
6133 if (hcon->sec_level > BT_SECURITY_MEDIUM) {
6134 l2cap_chan_del(chan, ECONNREFUSED);
6135 break;
6136 }
6137
6138 sec_level = hcon->sec_level + 1;
6139 if (chan->sec_level < sec_level)
6140 chan->sec_level = sec_level;
6141
6142 /* We'll need to send a new Connect Request */
6143 clear_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags);
6144
6145 smp_conn_security(hcon, chan->sec_level);
6146 break;
6147
6148 case L2CAP_CR_LE_BAD_PSM:
6149 l2cap_chan_del(chan, ECONNREFUSED);
6150 break;
6151
6152 default:
6153 /* If dcid was not set it means channels was refused */
6154 if (!dcid) {
6155 l2cap_chan_del(chan, ECONNREFUSED);
6156 break;
6157 }
6158
6159 chan->ident = 0;
6160 chan->dcid = dcid;
6161 chan->omtu = mtu;
6162 chan->remote_mps = mps;
6163 chan->tx_credits = credits;
6164 l2cap_chan_ready(chan);
6165 break;
6166 }
6167
6168 l2cap_chan_unlock(chan);
6169 }
6170
6171 mutex_unlock(&conn->chan_lock);
6172
6173 return err;
6174}
6175
6176static inline int l2cap_ecred_reconf_req(struct l2cap_conn *conn,
6177 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
6178 u8 *data)
6179{
6180 struct l2cap_ecred_reconf_req *req = (void *) data;
6181 struct l2cap_ecred_reconf_rsp rsp;
6182 u16 mtu, mps, result;
6183 struct l2cap_chan *chan;
6184 int i, num_scid;
6185
4be5ca67
LAD		 6186 if (!enable_ecred)
6187 return -EINVAL;
6188
15f02b91
LAD		 6189 if (cmd_len < sizeof(*req) || cmd_len - sizeof(*req) % sizeof(u16)) {
6190 result = L2CAP_CR_LE_INVALID_PARAMS;
6191 goto respond;
6192 }
6193
6194 mtu = __le16_to_cpu(req->mtu);
6195 mps = __le16_to_cpu(req->mps);
6196
6197 BT_DBG("mtu %u mps %u", mtu, mps);
6198
6199 if (mtu < L2CAP_ECRED_MIN_MTU) {
6200 result = L2CAP_RECONF_INVALID_MTU;
6201 goto respond;
6202 }
6203
6204 if (mps < L2CAP_ECRED_MIN_MPS) {
6205 result = L2CAP_RECONF_INVALID_MPS;
6206 goto respond;
6207 }
6208
6209 cmd_len -= sizeof(*req);
6210 num_scid = cmd_len / sizeof(u16);
6211 result = L2CAP_RECONF_SUCCESS;
6212
6213 for (i = 0; i < num_scid; i++) {
6214 u16 scid;
6215
6216 scid = __le16_to_cpu(req->scid[i]);
6217 if (!scid)
6218 return -EPROTO;
6219
6220 chan = __l2cap_get_chan_by_dcid(conn, scid);
6221 if (!chan)
6222 continue;
6223
6224 /* If the MTU value is decreased for any of the included
6225 * channels, then the receiver shall disconnect all
6226 * included channels.
6227 */
6228 if (chan->omtu > mtu) {
6229 BT_ERR("chan %p decreased MTU %u -> %u", chan,
6230 chan->omtu, mtu);
6231 result = L2CAP_RECONF_INVALID_MTU;
6232 }
6233
6234 chan->omtu = mtu;
6235 chan->remote_mps = mps;
6236 }
6237
6238respond:
6239 rsp.result = cpu_to_le16(result);
6240
6241 l2cap_send_cmd(conn, cmd->ident, L2CAP_ECRED_RECONF_RSP, sizeof(rsp),
6242 &rsp);
6243
6244 return 0;
6245}
6246
6247static inline int l2cap_ecred_reconf_rsp(struct l2cap_conn *conn,
6248 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
6249 u8 *data)
6250{
1fa20d7d 6251 struct l2cap_chan *chan, *tmp;
15f02b91
LAD		 6252 struct l2cap_ecred_conn_rsp *rsp = (void *) data;
6253 u16 result;
6254
6255 if (cmd_len < sizeof(*rsp))
6256 return -EPROTO;
6257
6258 result = __le16_to_cpu(rsp->result);
6259
6260 BT_DBG("result 0x%4.4x", rsp->result);
6261
6262 if (!result)
6263 return 0;
6264
1fa20d7d 6265 list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
15f02b91
LAD		 6266 if (chan->ident != cmd->ident)
6267 continue;
6268
6269 l2cap_chan_del(chan, ECONNRESET);
6270 }
6271
6272 return 0;
6273}
6274
71fb4197
JH		 6275static inline int l2cap_le_command_rej(struct l2cap_conn *conn,
6276 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
6277 u8 *data)
6278{
6279 struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data;
6280 struct l2cap_chan *chan;
6281
6282 if (cmd_len < sizeof(*rej))
6283 return -EPROTO;
6284
6285 mutex_lock(&conn->chan_lock);
6286
6287 chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
6288 if (!chan)
6289 goto done;
6290
6291 l2cap_chan_lock(chan);
6292 l2cap_chan_del(chan, ECONNREFUSED);
6293 l2cap_chan_unlock(chan);
6294
6295done:
6296 mutex_unlock(&conn->chan_lock);
6297 return 0;
6298}
6299
3300d9a9 6300static inline int l2cap_le_sig_cmd(struct l2cap_conn *conn,
203e639e
JH		 6301 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
6302 u8 *data)
3300d9a9 6303{
b5ecba64
JH		 6304 int err = 0;
6305
3300d9a9
CT		 6306 switch (cmd->code) {
6307 case L2CAP_COMMAND_REJ:
71fb4197 6308 l2cap_le_command_rej(conn, cmd, cmd_len, data);
b5ecba64 6309 break;
3300d9a9
CT		 6310
6311 case L2CAP_CONN_PARAM_UPDATE_REQ:
b5ecba64
JH		 6312 err = l2cap_conn_param_update_req(conn, cmd, cmd_len, data);
6313 break;
3300d9a9
CT		 6314
6315 case L2CAP_CONN_PARAM_UPDATE_RSP:
b5ecba64 6316 break;
3300d9a9 6317
f1496dee
JH		 6318 case L2CAP_LE_CONN_RSP:
6319 l2cap_le_connect_rsp(conn, cmd, cmd_len, data);
b5ecba64 6320 break;
f1496dee 6321
27e2d4c8 6322 case L2CAP_LE_CONN_REQ:
b5ecba64
JH		 6323 err = l2cap_le_connect_req(conn, cmd, cmd_len, data);
6324 break;
27e2d4c8 6325
fad5fc89
JH		 6326 case L2CAP_LE_CREDITS:
6327 err = l2cap_le_credits(conn, cmd, cmd_len, data);
6328 break;
6329
15f02b91
LAD		 6330 case L2CAP_ECRED_CONN_REQ:
6331 err = l2cap_ecred_conn_req(conn, cmd, cmd_len, data);
6332 break;
6333
6334 case L2CAP_ECRED_CONN_RSP:
6335 err = l2cap_ecred_conn_rsp(conn, cmd, cmd_len, data);
6336 break;
6337
6338 case L2CAP_ECRED_RECONF_REQ:
6339 err = l2cap_ecred_reconf_req(conn, cmd, cmd_len, data);
6340 break;
6341
6342 case L2CAP_ECRED_RECONF_RSP:
6343 err = l2cap_ecred_reconf_rsp(conn, cmd, cmd_len, data);
6344 break;
6345
3defe01a 6346 case L2CAP_DISCONN_REQ:
b5ecba64
JH		 6347 err = l2cap_disconnect_req(conn, cmd, cmd_len, data);
6348 break;
3defe01a
JH		 6349
6350 case L2CAP_DISCONN_RSP:
6351 l2cap_disconnect_rsp(conn, cmd, cmd_len, data);
b5ecba64 6352 break;
3defe01a 6353
3300d9a9
CT		 6354 default:
6355 BT_ERR("Unknown LE signaling command 0x%2.2x", cmd->code);
b5ecba64
JH		 6356 err = -EINVAL;
6357 break;
3300d9a9 6358 }
b5ecba64
JH		 6359
6360 return err;
3300d9a9
CT		 6361}
6362
c5623556
JH		 6363static inline void l2cap_le_sig_channel(struct l2cap_conn *conn,
6364 struct sk_buff *skb)
6365{
69c4e4e8 6366 struct hci_conn *hcon = conn->hcon;
4f3e219d
MH		 6367 struct l2cap_cmd_hdr *cmd;
6368 u16 len;
c5623556
JH		 6369 int err;
6370
69c4e4e8 6371 if (hcon->type != LE_LINK)
3b166295 6372 goto drop;
69c4e4e8 6373
4f3e219d
MH		 6374 if (skb->len < L2CAP_CMD_HDR_SIZE)
6375 goto drop;
c5623556 6376
4f3e219d
MH		 6377 cmd = (void *) skb->data;
6378 skb_pull(skb, L2CAP_CMD_HDR_SIZE);
c5623556 6379
4f3e219d 6380 len = le16_to_cpu(cmd->len);
c5623556 6381
4f3e219d 6382 BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd->code, len, cmd->ident);
c5623556 6383
4f3e219d
MH		 6384 if (len != skb->len || !cmd->ident) {
6385 BT_DBG("corrupted command");
6386 goto drop;
6387 }
c5623556 6388
203e639e 6389 err = l2cap_le_sig_cmd(conn, cmd, len, skb->data);
4f3e219d
MH		 6390 if (err) {
6391 struct l2cap_cmd_rej_unk rej;
c5623556 6392
4f3e219d 6393 BT_ERR("Wrong link type (%d)", err);
c5623556 6394
dcf4adbf 6395 rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
4f3e219d
MH		 6396 l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ,
6397 sizeof(rej), &rej);
c5623556
JH		 6398 }
6399
3b166295 6400drop:
c5623556
JH		 6401 kfree_skb(skb);
6402}
6403
3300d9a9 6404static inline void l2cap_sig_channel(struct l2cap_conn *conn,
2d792818 6405 struct sk_buff *skb)
1da177e4 6406{
69c4e4e8 6407 struct hci_conn *hcon = conn->hcon;
55cee73e 6408 struct l2cap_cmd_hdr *cmd;
3300d9a9 6409 int err;
1da177e4
LT		 6410
6411 l2cap_raw_recv(conn, skb);
6412
69c4e4e8 6413 if (hcon->type != ACL_LINK)
3b166295 6414 goto drop;
69c4e4e8 6415
55cee73e
LAD		 6416 while (skb->len >= L2CAP_CMD_HDR_SIZE) {
6417 u16 len;
6418
6419 cmd = (void *) skb->data;
6420 skb_pull(skb, L2CAP_CMD_HDR_SIZE);
1da177e4 6421
55cee73e 6422 len = le16_to_cpu(cmd->len);
1da177e4 6423
55cee73e
LAD		 6424 BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd->code, len,
6425 cmd->ident);
1da177e4 6426
55cee73e 6427 if (len > skb->len || !cmd->ident) {
1da177e4
LT		 6428 BT_DBG("corrupted command");
6429 break;
6430 }
6431
55cee73e 6432 err = l2cap_bredr_sig_cmd(conn, cmd, len, skb->data);
1da177e4 6433 if (err) {
e2fd318e 6434 struct l2cap_cmd_rej_unk rej;
2c6d1a2e
GP		 6435
6436 BT_ERR("Wrong link type (%d)", err);
1da177e4 6437
dcf4adbf 6438 rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
55cee73e 6439 l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ,
2d792818 6440 sizeof(rej), &rej);
1da177e4
LT		 6441 }
6442
55cee73e 6443 skb_pull(skb, len);
1da177e4
LT		 6444 }
6445
3b166295 6446drop:
1da177e4
LT		 6447 kfree_skb(skb);
6448}
6449
47d1ec61 6450static int l2cap_check_fcs(struct l2cap_chan *chan, struct sk_buff *skb)
fcc203c3
GP		 6451{
6452 u16 our_fcs, rcv_fcs;
e4ca6d98
AE		 6453 int hdr_size;
6454
6455 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
6456 hdr_size = L2CAP_EXT_HDR_SIZE;
6457 else
6458 hdr_size = L2CAP_ENH_HDR_SIZE;
fcc203c3 6459
47d1ec61 6460 if (chan->fcs == L2CAP_FCS_CRC16) {
03a51213 6461 skb_trim(skb, skb->len - L2CAP_FCS_SIZE);
fcc203c3
GP		 6462 rcv_fcs = get_unaligned_le16(skb->data + skb->len);
6463 our_fcs = crc16(0, skb->data - hdr_size, skb->len + hdr_size);
6464
6465 if (our_fcs != rcv_fcs)
7a560e5c 6466 return -EBADMSG;
fcc203c3
GP		 6467 }
6468 return 0;
6469}
6470
6ea00485 6471static void l2cap_send_i_or_rr_or_rnr(struct l2cap_chan *chan)
d5392c8f 6472{
e31f7633 6473 struct l2cap_ctrl control;
d5392c8f 6474
e31f7633 6475 BT_DBG("chan %p", chan);
d5392c8f 6476
e31f7633
MM		 6477 memset(&control, 0, sizeof(control));
6478 control.sframe = 1;
6479 control.final = 1;
6480 control.reqseq = chan->buffer_seq;
6481 set_bit(CONN_SEND_FBIT, &chan->conn_state);
d5392c8f 6482
e2ab4353 6483 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
e31f7633
MM		 6484 control.super = L2CAP_SUPER_RNR;
6485 l2cap_send_sframe(chan, &control);
d5392c8f
GP		 6486 }
6487
e31f7633
MM		 6488 if (test_and_clear_bit(CONN_REMOTE_BUSY, &chan->conn_state) &&
6489 chan->unacked_frames > 0)
6490 __set_retrans_timer(chan);
d5392c8f 6491
e31f7633 6492 /* Send pending iframes */
525cd185 6493 l2cap_ertm_send(chan);
d5392c8f 6494
e2ab4353 6495 if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&
e31f7633
MM		 6496 test_bit(CONN_SEND_FBIT, &chan->conn_state)) {
6497 /* F-bit wasn't sent in an s-frame or i-frame yet, so
6498 * send it now.
6499 */
6500 control.super = L2CAP_SUPER_RR;
6501 l2cap_send_sframe(chan, &control);
d5392c8f
GP		 6502 }
6503}
6504
2d792818
GP		 6505static void append_skb_frag(struct sk_buff *skb, struct sk_buff *new_frag,
6506 struct sk_buff **last_frag)
18778a63 6507{
84084a31
MM		 6508 /* skb->len reflects data in skb as well as all fragments
6509 * skb->data_len reflects only data in fragments
6510 */
6511 if (!skb_has_frag_list(skb))
6512 skb_shinfo(skb)->frag_list = new_frag;
6513
6514 new_frag->next = NULL;
6515
6516 (*last_frag)->next = new_frag;
6517 *last_frag = new_frag;
6518
6519 skb->len += new_frag->len;
6520 skb->data_len += new_frag->len;
6521 skb->truesize += new_frag->truesize;
6522}
6523
4b51dae9
MM		 6524static int l2cap_reassemble_sdu(struct l2cap_chan *chan, struct sk_buff *skb,
6525 struct l2cap_ctrl *control)
84084a31
MM		 6526{
6527 int err = -EINVAL;
18778a63 6528
4b51dae9 6529 switch (control->sar) {
7e0ef6ee 6530 case L2CAP_SAR_UNSEGMENTED:
84084a31
MM		 6531 if (chan->sdu)
6532 break;
18778a63 6533
80b98027 6534 err = chan->ops->recv(chan, skb);
84084a31 6535 break;
18778a63 6536
7e0ef6ee 6537 case L2CAP_SAR_START:
84084a31
MM		 6538 if (chan->sdu)
6539 break;
18778a63 6540
dbb50887
DB		 6541 if (!pskb_may_pull(skb, L2CAP_SDULEN_SIZE))
6542 break;
6543
6f61fd47 6544 chan->sdu_len = get_unaligned_le16(skb->data);
03a51213 6545 skb_pull(skb, L2CAP_SDULEN_SIZE);
18778a63 6546
84084a31
MM		 6547 if (chan->sdu_len > chan->imtu) {
6548 err = -EMSGSIZE;
6549 break;
6550 }
1890d36b 6551
84084a31
MM		 6552 if (skb->len >= chan->sdu_len)
6553 break;
18778a63 6554
84084a31
MM		 6555 chan->sdu = skb;
6556 chan->sdu_last_frag = skb;
18778a63 6557
84084a31
MM		 6558 skb = NULL;
6559 err = 0;
18778a63
GP		 6560 break;
6561
7e0ef6ee 6562 case L2CAP_SAR_CONTINUE:
6f61fd47 6563 if (!chan->sdu)
84084a31 6564 break;
18778a63 6565
84084a31
MM		 6566 append_skb_frag(chan->sdu, skb,
6567 &chan->sdu_last_frag);
6568 skb = NULL;
18778a63 6569
84084a31
MM		 6570 if (chan->sdu->len >= chan->sdu_len)
6571 break;
4178ba46 6572
84084a31 6573 err = 0;
18778a63
GP		 6574 break;
6575
7e0ef6ee 6576 case L2CAP_SAR_END:
6f61fd47 6577 if (!chan->sdu)
84084a31 6578 break;
18778a63 6579
84084a31
MM		 6580 append_skb_frag(chan->sdu, skb,
6581 &chan->sdu_last_frag);
6582 skb = NULL;
4178ba46 6583
84084a31
MM		 6584 if (chan->sdu->len != chan->sdu_len)
6585 break;
18778a63 6586
80b98027 6587 err = chan->ops->recv(chan, chan->sdu);
1890d36b 6588
84084a31
MM		 6589 if (!err) {
6590 /* Reassembly complete */
6591 chan->sdu = NULL;
6592 chan->sdu_last_frag = NULL;
6593 chan->sdu_len = 0;
1890d36b 6594 }
18778a63
GP		 6595 break;
6596 }
6597
84084a31
MM		 6598 if (err) {
6599 kfree_skb(skb);
6600 kfree_skb(chan->sdu);
6601 chan->sdu = NULL;
6602 chan->sdu_last_frag = NULL;
6603 chan->sdu_len = 0;
6604 }
18778a63 6605
84084a31 6606 return err;
18778a63
GP		 6607}
6608
32b32735
MM		 6609static int l2cap_resegment(struct l2cap_chan *chan)
6610{
6611 /* Placeholder */
6612 return 0;
6613}
6614
61aa4f5b 6615void l2cap_chan_busy(struct l2cap_chan *chan, int busy)
26f880d2 6616{
61aa4f5b 6617 u8 event;
712132eb 6618
61aa4f5b
MM		 6619 if (chan->mode != L2CAP_MODE_ERTM)
6620 return;
712132eb 6621
61aa4f5b 6622 event = busy ? L2CAP_EV_LOCAL_BUSY_DETECTED : L2CAP_EV_LOCAL_BUSY_CLEAR;
401bb1f7 6623 l2cap_tx(chan, NULL, NULL, event);
1890d36b
GP		 6624}
6625
d2a7ac5d
MM		 6626static int l2cap_rx_queued_iframes(struct l2cap_chan *chan)
6627{
63838725
MM		 6628 int err = 0;
6629 /* Pass sequential frames to l2cap_reassemble_sdu()
6630 * until a gap is encountered.
6631 */
6632
6633 BT_DBG("chan %p", chan);
6634
6635 while (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
6636 struct sk_buff *skb;
6637 BT_DBG("Searching for skb with txseq %d (queue len %d)",
6638 chan->buffer_seq, skb_queue_len(&chan->srej_q));
6639
6640 skb = l2cap_ertm_seq_in_queue(&chan->srej_q, chan->buffer_seq);
6641
6642 if (!skb)
6643 break;
6644
6645 skb_unlink(skb, &chan->srej_q);
6646 chan->buffer_seq = __next_seq(chan, chan->buffer_seq);
a4368ff3 6647 err = l2cap_reassemble_sdu(chan, skb, &bt_cb(skb)->l2cap);
63838725
MM		 6648 if (err)
6649 break;
6650 }
6651
6652 if (skb_queue_empty(&chan->srej_q)) {
6653 chan->rx_state = L2CAP_RX_STATE_RECV;
6654 l2cap_send_ack(chan);
6655 }
6656
6657 return err;
d2a7ac5d
MM		 6658}
6659
6660static void l2cap_handle_srej(struct l2cap_chan *chan,
6661 struct l2cap_ctrl *control)
6662{
f80842a8
MM		 6663 struct sk_buff *skb;
6664
6665 BT_DBG("chan %p, control %p", chan, control);
6666
6667 if (control->reqseq == chan->next_tx_seq) {
6668 BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq);
5e4e3972 6669 l2cap_send_disconn_req(chan, ECONNRESET);
f80842a8
MM		 6670 return;
6671 }
6672
6673 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);
6674
6675 if (skb == NULL) {
6676 BT_DBG("Seq %d not available for retransmission",
6677 control->reqseq);
6678 return;
6679 }
6680
a4368ff3 6681 if (chan->max_tx != 0 && bt_cb(skb)->l2cap.retries >= chan->max_tx) {
f80842a8 6682 BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
5e4e3972 6683 l2cap_send_disconn_req(chan, ECONNRESET);
f80842a8
MM		 6684 return;
6685 }
6686
6687 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6688
6689 if (control->poll) {
6690 l2cap_pass_to_tx(chan, control);
6691
6692 set_bit(CONN_SEND_FBIT, &chan->conn_state);
6693 l2cap_retransmit(chan, control);
6694 l2cap_ertm_send(chan);
6695
6696 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) {
6697 set_bit(CONN_SREJ_ACT, &chan->conn_state);
6698 chan->srej_save_reqseq = control->reqseq;
6699 }
6700 } else {
6701 l2cap_pass_to_tx_fbit(chan, control);
6702
6703 if (control->final) {
6704 if (chan->srej_save_reqseq != control->reqseq ||
6705 !test_and_clear_bit(CONN_SREJ_ACT,
6706 &chan->conn_state))
6707 l2cap_retransmit(chan, control);
6708 } else {
6709 l2cap_retransmit(chan, control);
6710 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) {
6711 set_bit(CONN_SREJ_ACT, &chan->conn_state);
6712 chan->srej_save_reqseq = control->reqseq;
6713 }
6714 }
6715 }
d2a7ac5d
MM		 6716}
6717
6718static void l2cap_handle_rej(struct l2cap_chan *chan,
6719 struct l2cap_ctrl *control)
6720{
fcd289df
MM		 6721 struct sk_buff *skb;
6722
6723 BT_DBG("chan %p, control %p", chan, control);
6724
6725 if (control->reqseq == chan->next_tx_seq) {
6726 BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq);
5e4e3972 6727 l2cap_send_disconn_req(chan, ECONNRESET);
fcd289df
MM		 6728 return;
6729 }
6730
6731 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);
6732
6733 if (chan->max_tx && skb &&
a4368ff3 6734 bt_cb(skb)->l2cap.retries >= chan->max_tx) {
fcd289df 6735 BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
5e4e3972 6736 l2cap_send_disconn_req(chan, ECONNRESET);
fcd289df
MM		 6737 return;
6738 }
6739
6740 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6741
6742 l2cap_pass_to_tx(chan, control);
6743
6744 if (control->final) {
6745 if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))
6746 l2cap_retransmit_all(chan, control);
6747 } else {
6748 l2cap_retransmit_all(chan, control);
6749 l2cap_ertm_send(chan);
6750 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F)
6751 set_bit(CONN_REJ_ACT, &chan->conn_state);
6752 }
d2a7ac5d
MM		 6753}
6754
4b51dae9
MM		 6755static u8 l2cap_classify_txseq(struct l2cap_chan *chan, u16 txseq)
6756{
6757 BT_DBG("chan %p, txseq %d", chan, txseq);
6758
6759 BT_DBG("last_acked_seq %d, expected_tx_seq %d", chan->last_acked_seq,
6760 chan->expected_tx_seq);
6761
6762 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
6763 if (__seq_offset(chan, txseq, chan->last_acked_seq) >=
2d792818 6764 chan->tx_win) {
4b51dae9
MM		 6765 /* See notes below regarding "double poll" and
6766 * invalid packets.
6767 */
6768 if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) {
6769 BT_DBG("Invalid/Ignore - after SREJ");
6770 return L2CAP_TXSEQ_INVALID_IGNORE;
6771 } else {
6772 BT_DBG("Invalid - in window after SREJ sent");
6773 return L2CAP_TXSEQ_INVALID;
6774 }
6775 }
6776
6777 if (chan->srej_list.head == txseq) {
6778 BT_DBG("Expected SREJ");
6779 return L2CAP_TXSEQ_EXPECTED_SREJ;
6780 }
6781
6782 if (l2cap_ertm_seq_in_queue(&chan->srej_q, txseq)) {
6783 BT_DBG("Duplicate SREJ - txseq already stored");
6784 return L2CAP_TXSEQ_DUPLICATE_SREJ;
6785 }
6786
6787 if (l2cap_seq_list_contains(&chan->srej_list, txseq)) {
6788 BT_DBG("Unexpected SREJ - not requested");
6789 return L2CAP_TXSEQ_UNEXPECTED_SREJ;
6790 }
6791 }
6792
6793 if (chan->expected_tx_seq == txseq) {
6794 if (__seq_offset(chan, txseq, chan->last_acked_seq) >=
6795 chan->tx_win) {
6796 BT_DBG("Invalid - txseq outside tx window");
6797 return L2CAP_TXSEQ_INVALID;
6798 } else {
6799 BT_DBG("Expected");
6800 return L2CAP_TXSEQ_EXPECTED;
6801 }
6802 }
6803
6804 if (__seq_offset(chan, txseq, chan->last_acked_seq) <
2d792818 6805 __seq_offset(chan, chan->expected_tx_seq, chan->last_acked_seq)) {
4b51dae9
MM		 6806 BT_DBG("Duplicate - expected_tx_seq later than txseq");
6807 return L2CAP_TXSEQ_DUPLICATE;
6808 }
6809
6810 if (__seq_offset(chan, txseq, chan->last_acked_seq) >= chan->tx_win) {
6811 /* A source of invalid packets is a "double poll" condition,
6812 * where delays cause us to send multiple poll packets. If
6813 * the remote stack receives and processes both polls,
6814 * sequence numbers can wrap around in such a way that a
6815 * resent frame has a sequence number that looks like new data
6816 * with a sequence gap. This would trigger an erroneous SREJ
6817 * request.
6818 *
6819 * Fortunately, this is impossible with a tx window that's
6820 * less than half of the maximum sequence number, which allows
6821 * invalid frames to be safely ignored.
6822 *
6823 * With tx window sizes greater than half of the tx window
6824 * maximum, the frame is invalid and cannot be ignored. This
6825 * causes a disconnect.
6826 */
6827
6828 if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) {
6829 BT_DBG("Invalid/Ignore - txseq outside tx window");
6830 return L2CAP_TXSEQ_INVALID_IGNORE;
6831 } else {
6832 BT_DBG("Invalid - txseq outside tx window");
6833 return L2CAP_TXSEQ_INVALID;
6834 }
6835 } else {
6836 BT_DBG("Unexpected - txseq indicates missing frames");
6837 return L2CAP_TXSEQ_UNEXPECTED;
6838 }
6839}
6840
d2a7ac5d
MM		 6841static int l2cap_rx_state_recv(struct l2cap_chan *chan,
6842 struct l2cap_ctrl *control,
6843 struct sk_buff *skb, u8 event)
6844{
6845 int err = 0;
941247f9 6846 bool skb_in_use = false;
d2a7ac5d
MM		 6847
6848 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
6849 event);
6850
6851 switch (event) {
6852 case L2CAP_EV_RECV_IFRAME:
6853 switch (l2cap_classify_txseq(chan, control->txseq)) {
6854 case L2CAP_TXSEQ_EXPECTED:
6855 l2cap_pass_to_tx(chan, control);
6856
6857 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
6858 BT_DBG("Busy, discarding expected seq %d",
6859 control->txseq);
6860 break;
6861 }
6862
6863 chan->expected_tx_seq = __next_seq(chan,
6864 control->txseq);
6865
6866 chan->buffer_seq = chan->expected_tx_seq;
941247f9 6867 skb_in_use = true;
d2a7ac5d
MM		 6868
6869 err = l2cap_reassemble_sdu(chan, skb, control);
6870 if (err)
6871 break;
6872
6873 if (control->final) {
6874 if (!test_and_clear_bit(CONN_REJ_ACT,
6875 &chan->conn_state)) {
6876 control->final = 0;
6877 l2cap_retransmit_all(chan, control);
6878 l2cap_ertm_send(chan);
6879 }
6880 }
6881
6882 if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state))
6883 l2cap_send_ack(chan);
6884 break;
6885 case L2CAP_TXSEQ_UNEXPECTED:
6886 l2cap_pass_to_tx(chan, control);
6887
6888 /* Can't issue SREJ frames in the local busy state.
6889 * Drop this frame, it will be seen as missing
6890 * when local busy is exited.
6891 */
6892 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
6893 BT_DBG("Busy, discarding unexpected seq %d",
6894 control->txseq);
6895 break;
6896 }
6897
6898 /* There was a gap in the sequence, so an SREJ
6899 * must be sent for each missing frame. The
6900 * current frame is stored for later use.
6901 */
6902 skb_queue_tail(&chan->srej_q, skb);
941247f9 6903 skb_in_use = true;
d2a7ac5d
MM		 6904 BT_DBG("Queued %p (queue len %d)", skb,
6905 skb_queue_len(&chan->srej_q));
6906
6907 clear_bit(CONN_SREJ_ACT, &chan->conn_state);
6908 l2cap_seq_list_clear(&chan->srej_list);
6909 l2cap_send_srej(chan, control->txseq);
6910
6911 chan->rx_state = L2CAP_RX_STATE_SREJ_SENT;
6912 break;
6913 case L2CAP_TXSEQ_DUPLICATE:
6914 l2cap_pass_to_tx(chan, control);
6915 break;
6916 case L2CAP_TXSEQ_INVALID_IGNORE:
6917 break;
6918 case L2CAP_TXSEQ_INVALID:
6919 default:
5e4e3972 6920 l2cap_send_disconn_req(chan, ECONNRESET);
d2a7ac5d
MM		 6921 break;
6922 }
6923 break;
6924 case L2CAP_EV_RECV_RR:
6925 l2cap_pass_to_tx(chan, control);
6926 if (control->final) {
6927 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6928
e6a3ee6e
MM		 6929 if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state) &&
6930 !__chan_is_moving(chan)) {
d2a7ac5d
MM		 6931 control->final = 0;
6932 l2cap_retransmit_all(chan, control);
6933 }
6934
6935 l2cap_ertm_send(chan);
6936 } else if (control->poll) {
6937 l2cap_send_i_or_rr_or_rnr(chan);
6938 } else {
6939 if (test_and_clear_bit(CONN_REMOTE_BUSY,
6940 &chan->conn_state) &&
6941 chan->unacked_frames)
6942 __set_retrans_timer(chan);
6943
6944 l2cap_ertm_send(chan);
6945 }
6946 break;
6947 case L2CAP_EV_RECV_RNR:
6948 set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6949 l2cap_pass_to_tx(chan, control);
6950 if (control && control->poll) {
6951 set_bit(CONN_SEND_FBIT, &chan->conn_state);
6952 l2cap_send_rr_or_rnr(chan, 0);
6953 }
6954 __clear_retrans_timer(chan);
6955 l2cap_seq_list_clear(&chan->retrans_list);
6956 break;
6957 case L2CAP_EV_RECV_REJ:
6958 l2cap_handle_rej(chan, control);
6959 break;
6960 case L2CAP_EV_RECV_SREJ:
6961 l2cap_handle_srej(chan, control);
6962 break;
6963 default:
6964 break;
6965 }
6966
6967 if (skb && !skb_in_use) {
6968 BT_DBG("Freeing %p", skb);
6969 kfree_skb(skb);
6970 }
6971
6972 return err;
6973}
6974
6975static int l2cap_rx_state_srej_sent(struct l2cap_chan *chan,
6976 struct l2cap_ctrl *control,
6977 struct sk_buff *skb, u8 event)
6978{
6979 int err = 0;
6980 u16 txseq = control->txseq;
941247f9 6981 bool skb_in_use = false;
d2a7ac5d
MM		 6982
6983 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
6984 event);
6985
6986 switch (event) {
6987 case L2CAP_EV_RECV_IFRAME:
6988 switch (l2cap_classify_txseq(chan, txseq)) {
6989 case L2CAP_TXSEQ_EXPECTED:
6990 /* Keep frame for reassembly later */
6991 l2cap_pass_to_tx(chan, control);
6992 skb_queue_tail(&chan->srej_q, skb);
941247f9 6993 skb_in_use = true;
d2a7ac5d
MM		 6994 BT_DBG("Queued %p (queue len %d)", skb,
6995 skb_queue_len(&chan->srej_q));
6996
6997 chan->expected_tx_seq = __next_seq(chan, txseq);
6998 break;
6999 case L2CAP_TXSEQ_EXPECTED_SREJ:
7000 l2cap_seq_list_pop(&chan->srej_list);
7001
7002 l2cap_pass_to_tx(chan, control);
7003 skb_queue_tail(&chan->srej_q, skb);
941247f9 7004 skb_in_use = true;
d2a7ac5d
MM		 7005 BT_DBG("Queued %p (queue len %d)", skb,
7006 skb_queue_len(&chan->srej_q));
7007
7008 err = l2cap_rx_queued_iframes(chan);
7009 if (err)
7010 break;
7011
7012 break;
7013 case L2CAP_TXSEQ_UNEXPECTED:
7014 /* Got a frame that can't be reassembled yet.
7015 * Save it for later, and send SREJs to cover
7016 * the missing frames.
7017 */
7018 skb_queue_tail(&chan->srej_q, skb);
941247f9 7019 skb_in_use = true;
d2a7ac5d
MM		 7020 BT_DBG("Queued %p (queue len %d)", skb,
7021 skb_queue_len(&chan->srej_q));
7022
7023 l2cap_pass_to_tx(chan, control);
7024 l2cap_send_srej(chan, control->txseq);
7025 break;
7026 case L2CAP_TXSEQ_UNEXPECTED_SREJ:
7027 /* This frame was requested with an SREJ, but
7028 * some expected retransmitted frames are
7029 * missing. Request retransmission of missing
7030 * SREJ'd frames.
7031 */
7032 skb_queue_tail(&chan->srej_q, skb);
941247f9 7033 skb_in_use = true;
d2a7ac5d
MM		 7034 BT_DBG("Queued %p (queue len %d)", skb,
7035 skb_queue_len(&chan->srej_q));
7036
7037 l2cap_pass_to_tx(chan, control);
7038 l2cap_send_srej_list(chan, control->txseq);
7039 break;
7040 case L2CAP_TXSEQ_DUPLICATE_SREJ:
7041 /* We've already queued this frame. Drop this copy. */
7042 l2cap_pass_to_tx(chan, control);
7043 break;
7044 case L2CAP_TXSEQ_DUPLICATE:
7045 /* Expecting a later sequence number, so this frame
7046 * was already received. Ignore it completely.
7047 */
7048 break;
7049 case L2CAP_TXSEQ_INVALID_IGNORE:
7050 break;
7051 case L2CAP_TXSEQ_INVALID:
7052 default:
5e4e3972 7053 l2cap_send_disconn_req(chan, ECONNRESET);
d2a7ac5d
MM		 7054 break;
7055 }
7056 break;
7057 case L2CAP_EV_RECV_RR:
7058 l2cap_pass_to_tx(chan, control);
7059 if (control->final) {
7060 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
7061
7062 if (!test_and_clear_bit(CONN_REJ_ACT,
7063 &chan->conn_state)) {
7064 control->final = 0;
7065 l2cap_retransmit_all(chan, control);
7066 }
7067
7068 l2cap_ertm_send(chan);
7069 } else if (control->poll) {
7070 if (test_and_clear_bit(CONN_REMOTE_BUSY,
7071 &chan->conn_state) &&
7072 chan->unacked_frames) {
7073 __set_retrans_timer(chan);
7074 }
7075
7076 set_bit(CONN_SEND_FBIT, &chan->conn_state);
7077 l2cap_send_srej_tail(chan);
7078 } else {
7079 if (test_and_clear_bit(CONN_REMOTE_BUSY,
7080 &chan->conn_state) &&
7081 chan->unacked_frames)
7082 __set_retrans_timer(chan);
7083
7084 l2cap_send_ack(chan);
7085 }
7086 break;
7087 case L2CAP_EV_RECV_RNR:
7088 set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
7089 l2cap_pass_to_tx(chan, control);
7090 if (control->poll) {
7091 l2cap_send_srej_tail(chan);
7092 } else {
7093 struct l2cap_ctrl rr_control;
7094 memset(&rr_control, 0, sizeof(rr_control));
7095 rr_control.sframe = 1;
7096 rr_control.super = L2CAP_SUPER_RR;
7097 rr_control.reqseq = chan->buffer_seq;
7098 l2cap_send_sframe(chan, &rr_control);
7099 }
7100
7101 break;
7102 case L2CAP_EV_RECV_REJ:
7103 l2cap_handle_rej(chan, control);
7104 break;
7105 case L2CAP_EV_RECV_SREJ:
7106 l2cap_handle_srej(chan, control);
7107 break;
7108 }
7109
7110 if (skb && !skb_in_use) {
7111 BT_DBG("Freeing %p", skb);
7112 kfree_skb(skb);
7113 }
7114
7115 return err;
7116}
7117
32b32735
MM		 7118static int l2cap_finish_move(struct l2cap_chan *chan)
7119{
7120 BT_DBG("chan %p", chan);
7121
7122 chan->rx_state = L2CAP_RX_STATE_RECV;
7123
7124 if (chan->hs_hcon)
7125 chan->conn->mtu = chan->hs_hcon->hdev->block_mtu;
7126 else
7127 chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu;
7128
7129 return l2cap_resegment(chan);
7130}
7131
7132static int l2cap_rx_state_wait_p(struct l2cap_chan *chan,
7133 struct l2cap_ctrl *control,
7134 struct sk_buff *skb, u8 event)
7135{
7136 int err;
7137
7138 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
7139 event);
7140
7141 if (!control->poll)
7142 return -EPROTO;
7143
7144 l2cap_process_reqseq(chan, control->reqseq);
7145
7146 if (!skb_queue_empty(&chan->tx_q))
7147 chan->tx_send_head = skb_peek(&chan->tx_q);
7148 else
7149 chan->tx_send_head = NULL;
7150
7151 /* Rewind next_tx_seq to the point expected
7152 * by the receiver.
7153 */
7154 chan->next_tx_seq = control->reqseq;
7155 chan->unacked_frames = 0;
7156
7157 err = l2cap_finish_move(chan);
7158 if (err)
7159 return err;
7160
7161 set_bit(CONN_SEND_FBIT, &chan->conn_state);
7162 l2cap_send_i_or_rr_or_rnr(chan);
7163
7164 if (event == L2CAP_EV_RECV_IFRAME)
7165 return -EPROTO;
7166
7167 return l2cap_rx_state_recv(chan, control, NULL, event);
7168}
7169
7170static int l2cap_rx_state_wait_f(struct l2cap_chan *chan,
7171 struct l2cap_ctrl *control,
7172 struct sk_buff *skb, u8 event)
7173{
7174 int err;
7175
7176 if (!control->final)
7177 return -EPROTO;
7178
7179 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
7180
7181 chan->rx_state = L2CAP_RX_STATE_RECV;
7182 l2cap_process_reqseq(chan, control->reqseq);
7183
7184 if (!skb_queue_empty(&chan->tx_q))
7185 chan->tx_send_head = skb_peek(&chan->tx_q);
7186 else
7187 chan->tx_send_head = NULL;
7188
7189 /* Rewind next_tx_seq to the point expected
7190 * by the receiver.
7191 */
7192 chan->next_tx_seq = control->reqseq;
7193 chan->unacked_frames = 0;
7194
7195 if (chan->hs_hcon)
7196 chan->conn->mtu = chan->hs_hcon->hdev->block_mtu;
7197 else
7198 chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu;
7199
7200 err = l2cap_resegment(chan);
7201
7202 if (!err)
7203 err = l2cap_rx_state_recv(chan, control, skb, event);
7204
7205 return err;
7206}
7207
d2a7ac5d
MM		 7208static bool __valid_reqseq(struct l2cap_chan *chan, u16 reqseq)
7209{
7210 /* Make sure reqseq is for a packet that has been sent but not acked */
7211 u16 unacked;
7212
7213 unacked = __seq_offset(chan, chan->next_tx_seq, chan->expected_ack_seq);
7214 return __seq_offset(chan, chan->next_tx_seq, reqseq) <= unacked;
7215}
7216
cec8ab6e
MM		 7217static int l2cap_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
7218 struct sk_buff *skb, u8 event)
218bb9df 7219{
d2a7ac5d
MM		 7220 int err = 0;
7221
7222 BT_DBG("chan %p, control %p, skb %p, event %d, state %d", chan,
7223 control, skb, event, chan->rx_state);
7224
7225 if (__valid_reqseq(chan, control->reqseq)) {
7226 switch (chan->rx_state) {
7227 case L2CAP_RX_STATE_RECV:
7228 err = l2cap_rx_state_recv(chan, control, skb, event);
7229 break;
7230 case L2CAP_RX_STATE_SREJ_SENT:
7231 err = l2cap_rx_state_srej_sent(chan, control, skb,
7232 event);
7233 break;
32b32735
MM		 7234 case L2CAP_RX_STATE_WAIT_P:
7235 err = l2cap_rx_state_wait_p(chan, control, skb, event);
7236 break;
7237 case L2CAP_RX_STATE_WAIT_F:
7238 err = l2cap_rx_state_wait_f(chan, control, skb, event);
7239 break;
d2a7ac5d
MM		 7240 default:
7241 /* shut it down */
7242 break;
7243 }
7244 } else {
7245 BT_DBG("Invalid reqseq %d (next_tx_seq %d, expected_ack_seq %d",
7246 control->reqseq, chan->next_tx_seq,
7247 chan->expected_ack_seq);
5e4e3972 7248 l2cap_send_disconn_req(chan, ECONNRESET);
d2a7ac5d
MM		 7249 }
7250
7251 return err;
cec8ab6e
MM		 7252}
7253
7254static int l2cap_stream_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
7255 struct sk_buff *skb)
7256{
4b51dae9
MM		 7257 BT_DBG("chan %p, control %p, skb %p, state %d", chan, control, skb,
7258 chan->rx_state);
7259
7260 if (l2cap_classify_txseq(chan, control->txseq) ==
7261 L2CAP_TXSEQ_EXPECTED) {
7262 l2cap_pass_to_tx(chan, control);
7263
93917fd2 7264 BT_DBG("buffer_seq %u->%u", chan->buffer_seq,
4b51dae9
MM		 7265 __next_seq(chan, chan->buffer_seq));
7266
7267 chan->buffer_seq = __next_seq(chan, chan->buffer_seq);
7268
7269 l2cap_reassemble_sdu(chan, skb, control);
7270 } else {
7271 if (chan->sdu) {
7272 kfree_skb(chan->sdu);
7273 chan->sdu = NULL;
7274 }
7275 chan->sdu_last_frag = NULL;
7276 chan->sdu_len = 0;
7277
7278 if (skb) {
7279 BT_DBG("Freeing %p", skb);
7280 kfree_skb(skb);
7281 }
7282 }
7283
7284 chan->last_acked_seq = control->txseq;
7285 chan->expected_tx_seq = __next_seq(chan, control->txseq);
7286
9a544210 7287 return 0;
cec8ab6e
MM		 7288}
7289
7290static int l2cap_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
7291{
a4368ff3 7292 struct l2cap_ctrl *control = &bt_cb(skb)->l2cap;
cec8ab6e
MM		 7293 u16 len;
7294 u8 event;
218bb9df 7295
b76bbd66
MM		 7296 __unpack_control(chan, skb);
7297
218bb9df
GP		 7298 len = skb->len;
7299
7300 /*
7301 * We can just drop the corrupted I-frame here.
7302 * Receiver will miss it and start proper recovery
cec8ab6e 7303 * procedures and ask for retransmission.
218bb9df 7304 */
47d1ec61 7305 if (l2cap_check_fcs(chan, skb))
218bb9df
GP		 7306 goto drop;
7307
cec8ab6e 7308 if (!control->sframe && control->sar == L2CAP_SAR_START)
03a51213 7309 len -= L2CAP_SDULEN_SIZE;
218bb9df 7310
47d1ec61 7311 if (chan->fcs == L2CAP_FCS_CRC16)
03a51213 7312 len -= L2CAP_FCS_SIZE;
218bb9df 7313
47d1ec61 7314 if (len > chan->mps) {
5e4e3972 7315 l2cap_send_disconn_req(chan, ECONNRESET);
218bb9df
GP		 7316 goto drop;
7317 }
7318
f1942564
LAD		 7319 if (chan->ops->filter) {
7320 if (chan->ops->filter(chan, skb))
7321 goto drop;
7322 }
dbb50887 7323
cec8ab6e
MM		 7324 if (!control->sframe) {
7325 int err;
218bb9df 7326
cec8ab6e
MM		 7327 BT_DBG("iframe sar %d, reqseq %d, final %d, txseq %d",
7328 control->sar, control->reqseq, control->final,
7329 control->txseq);
218bb9df 7330
cec8ab6e
MM		 7331 /* Validate F-bit - F=0 always valid, F=1 only
7332 * valid in TX WAIT_F
7333 */
7334 if (control->final && chan->tx_state != L2CAP_TX_STATE_WAIT_F)
218bb9df 7335 goto drop;
cec8ab6e
MM		 7336
7337 if (chan->mode != L2CAP_MODE_STREAMING) {
7338 event = L2CAP_EV_RECV_IFRAME;
7339 err = l2cap_rx(chan, control, skb, event);
7340 } else {
7341 err = l2cap_stream_rx(chan, control, skb);
218bb9df
GP		 7342 }
7343
cec8ab6e 7344 if (err)
5e4e3972 7345 l2cap_send_disconn_req(chan, ECONNRESET);
218bb9df 7346 } else {
cec8ab6e
MM		 7347 const u8 rx_func_to_event[4] = {
7348 L2CAP_EV_RECV_RR, L2CAP_EV_RECV_REJ,
7349 L2CAP_EV_RECV_RNR, L2CAP_EV_RECV_SREJ
7350 };
7351
7352 /* Only I-frames are expected in streaming mode */
7353 if (chan->mode == L2CAP_MODE_STREAMING)
7354 goto drop;
7355
7356 BT_DBG("sframe reqseq %d, final %d, poll %d, super %d",
7357 control->reqseq, control->final, control->poll,
7358 control->super);
7359
218bb9df 7360 if (len != 0) {
1bb166e6 7361 BT_ERR("Trailing bytes: %d in sframe", len);
5e4e3972 7362 l2cap_send_disconn_req(chan, ECONNRESET);
218bb9df
GP		 7363 goto drop;
7364 }
7365
cec8ab6e
MM		 7366 /* Validate F and P bits */
7367 if (control->final && (control->poll ||
7368 chan->tx_state != L2CAP_TX_STATE_WAIT_F))
7369 goto drop;
7370
7371 event = rx_func_to_event[control->super];
7372 if (l2cap_rx(chan, control, skb, event))
5e4e3972 7373 l2cap_send_disconn_req(chan, ECONNRESET);
218bb9df
GP		 7374 }
7375
7376 return 0;
7377
7378drop:
7379 kfree_skb(skb);
7380 return 0;
7381}
7382
b1c325c2
JH		 7383static void l2cap_chan_le_send_credits(struct l2cap_chan *chan)
7384{
7385 struct l2cap_conn *conn = chan->conn;
7386 struct l2cap_le_credits pkt;
7387 u16 return_credits;
7388
15f02b91 7389 return_credits = (chan->imtu / chan->mps) + 1;
b1c325c2 7390
15f02b91 7391 if (chan->rx_credits >= return_credits)
96cd8eaa 7392 return;
b1c325c2 7393
15f02b91
LAD		 7394 return_credits -= chan->rx_credits;
7395
b1c325c2
JH		 7396 BT_DBG("chan %p returning %u credits to sender", chan, return_credits);
7397
7398 chan->rx_credits += return_credits;
7399
7400 pkt.cid = cpu_to_le16(chan->scid);
7401 pkt.credits = cpu_to_le16(return_credits);
7402
7403 chan->ident = l2cap_get_ident(conn);
7404
7405 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CREDITS, sizeof(pkt), &pkt);
7406}
7407
15f02b91 7408static int l2cap_ecred_recv(struct l2cap_chan *chan, struct sk_buff *skb)
96cd8eaa
LAD		 7409{
7410 int err;
7411
7412 BT_DBG("SDU reassemble complete: chan %p skb->len %u", chan, skb->len);
7413
7414 /* Wait recv to confirm reception before updating the credits */
7415 err = chan->ops->recv(chan, skb);
7416
7417 /* Update credits whenever an SDU is received */
7418 l2cap_chan_le_send_credits(chan);
7419
7420 return err;
7421}
7422
15f02b91 7423static int l2cap_ecred_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
fad5fc89 7424{
aac23bf6
JH		 7425 int err;
7426
7427 if (!chan->rx_credits) {
7428 BT_ERR("No credits to receive LE L2CAP data");
dfd9774c 7429 l2cap_send_disconn_req(chan, ECONNRESET);
fad5fc89 7430 return -ENOBUFS;
aac23bf6 7431 }
fad5fc89 7432
aac23bf6
JH		 7433 if (chan->imtu < skb->len) {
7434 BT_ERR("Too big LE L2CAP PDU");
fad5fc89 7435 return -ENOBUFS;
aac23bf6 7436 }
fad5fc89
JH		 7437
7438 chan->rx_credits--;
7439 BT_DBG("rx_credits %u -> %u", chan->rx_credits + 1, chan->rx_credits);
7440
96cd8eaa
LAD		 7441 /* Update if remote had run out of credits, this should only happens
7442 * if the remote is not using the entire MPS.
7443 */
7444 if (!chan->rx_credits)
7445 l2cap_chan_le_send_credits(chan);
fad5fc89 7446
aac23bf6
JH		 7447 err = 0;
7448
7449 if (!chan->sdu) {
7450 u16 sdu_len;
7451
7452 sdu_len = get_unaligned_le16(skb->data);
7453 skb_pull(skb, L2CAP_SDULEN_SIZE);
7454
7455 BT_DBG("Start of new SDU. sdu_len %u skb->len %u imtu %u",
7456 sdu_len, skb->len, chan->imtu);
7457
7458 if (sdu_len > chan->imtu) {
7459 BT_ERR("Too big LE L2CAP SDU length received");
7460 err = -EMSGSIZE;
7461 goto failed;
7462 }
7463
7464 if (skb->len > sdu_len) {
7465 BT_ERR("Too much LE L2CAP data received");
7466 err = -EINVAL;
7467 goto failed;
7468 }
7469
7470 if (skb->len == sdu_len)
15f02b91 7471 return l2cap_ecred_recv(chan, skb);
aac23bf6
JH		 7472
7473 chan->sdu = skb;
7474 chan->sdu_len = sdu_len;
7475 chan->sdu_last_frag = skb;
7476
a5c3021b
LAD		 7477 /* Detect if remote is not able to use the selected MPS */
7478 if (skb->len + L2CAP_SDULEN_SIZE < chan->mps) {
7479 u16 mps_len = skb->len + L2CAP_SDULEN_SIZE;
7480
7481 /* Adjust the number of credits */
7482 BT_DBG("chan->mps %u -> %u", chan->mps, mps_len);
7483 chan->mps = mps_len;
7484 l2cap_chan_le_send_credits(chan);
7485 }
7486
aac23bf6
JH		 7487 return 0;
7488 }
7489
7490 BT_DBG("SDU fragment. chan->sdu->len %u skb->len %u chan->sdu_len %u",
7491 chan->sdu->len, skb->len, chan->sdu_len);
7492
7493 if (chan->sdu->len + skb->len > chan->sdu_len) {
7494 BT_ERR("Too much LE L2CAP data received");
7495 err = -EINVAL;
7496 goto failed;
7497 }
7498
7499 append_skb_frag(chan->sdu, skb, &chan->sdu_last_frag);
7500 skb = NULL;
7501
7502 if (chan->sdu->len == chan->sdu_len) {
15f02b91 7503 err = l2cap_ecred_recv(chan, chan->sdu);
aac23bf6
JH		 7504 if (!err) {
7505 chan->sdu = NULL;
7506 chan->sdu_last_frag = NULL;
7507 chan->sdu_len = 0;
7508 }
7509 }
7510
7511failed:
7512 if (err) {
7513 kfree_skb(skb);
7514 kfree_skb(chan->sdu);
7515 chan->sdu = NULL;
7516 chan->sdu_last_frag = NULL;
7517 chan->sdu_len = 0;
7518 }
7519
7520 /* We can't return an error here since we took care of the skb
7521 * freeing internally. An error return would cause the caller to
7522 * do a double-free of the skb.
7523 */
7524 return 0;
fad5fc89
JH		 7525}
7526
13ca56e0
AE		 7527static void l2cap_data_channel(struct l2cap_conn *conn, u16 cid,
7528 struct sk_buff *skb)
1da177e4 7529{
48454079 7530 struct l2cap_chan *chan;
1da177e4 7531
baa7e1fa 7532 chan = l2cap_get_chan_by_scid(conn, cid);
48454079 7533 if (!chan) {
97e8e89d
AE		 7534 if (cid == L2CAP_CID_A2MP) {
7535 chan = a2mp_channel_create(conn, skb);
7536 if (!chan) {
7537 kfree_skb(skb);
13ca56e0 7538 return;
97e8e89d
AE		 7539 }
7540
7541 l2cap_chan_lock(chan);
7542 } else {
7543 BT_DBG("unknown cid 0x%4.4x", cid);
7544 /* Drop packet and return */
7545 kfree_skb(skb);
13ca56e0 7546 return;
97e8e89d 7547 }
1da177e4
LT		 7548 }
7549
49208c9c 7550 BT_DBG("chan %p, len %d", chan, skb->len);
1da177e4 7551
315917e0 7552 /* If we receive data on a fixed channel before the info req/rsp
5153ceb9 7553 * procedure is done simply assume that the channel is supported
315917e0
JH		 7554 * and mark it as ready.
7555 */
7556 if (chan->chan_type == L2CAP_CHAN_FIXED)
7557 l2cap_chan_ready(chan);
7558
89bc500e 7559 if (chan->state != BT_CONNECTED)
1da177e4
LT		 7560 goto drop;
7561
0c1bc5c6 7562 switch (chan->mode) {
38319713 7563 case L2CAP_MODE_LE_FLOWCTL:
15f02b91
LAD		 7564 case L2CAP_MODE_EXT_FLOWCTL:
7565 if (l2cap_ecred_data_rcv(chan, skb) < 0)
fad5fc89
JH		 7566 goto drop;
7567
7568 goto done;
7569
1c2acffb
GP		 7570 case L2CAP_MODE_BASIC:
7571 /* If socket recv buffers overflows we drop data here
7572 * which is *bad* because L2CAP has to be reliable.
7573 * But we don't have any other choice. L2CAP doesn't
7574 * provide flow control mechanism. */
1da177e4 7575
2c96e03d
SJ		 7576 if (chan->imtu < skb->len) {
7577 BT_ERR("Dropping L2CAP data: receive buffer overflow");
1c2acffb 7578 goto drop;
2c96e03d 7579 }
1da177e4 7580
80b98027 7581 if (!chan->ops->recv(chan, skb))
1c2acffb
GP		 7582 goto done;
7583 break;
7584
7585 case L2CAP_MODE_ERTM:
6840ed07 7586 case L2CAP_MODE_STREAMING:
cec8ab6e 7587 l2cap_data_rcv(chan, skb);
6840ed07
GP		 7588 goto done;
7589
1c2acffb 7590 default:
0c1bc5c6 7591 BT_DBG("chan %p: bad mode 0x%2.2x", chan, chan->mode);
1c2acffb
GP		 7592 break;
7593 }
1da177e4
LT		 7594
7595drop:
7596 kfree_skb(skb);
7597
7598done:
6be36555 7599 l2cap_chan_unlock(chan);
1da177e4
LT		 7600}
7601
84104b24
AE		 7602static void l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm,
7603 struct sk_buff *skb)
1da177e4 7604{
ae4fd2d3 7605 struct hci_conn *hcon = conn->hcon;
23691d75 7606 struct l2cap_chan *chan;
1da177e4 7607
ae4fd2d3 7608 if (hcon->type != ACL_LINK)
a24cce14 7609 goto free_skb;
ae4fd2d3 7610
bf20fd4e
JH		 7611 chan = l2cap_global_chan_by_psm(0, psm, &hcon->src, &hcon->dst,
7612 ACL_LINK);
23691d75 7613 if (!chan)
a24cce14 7614 goto free_skb;
1da177e4 7615
5b4cedaa 7616 BT_DBG("chan %p, len %d", chan, skb->len);
1da177e4 7617
89bc500e 7618 if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)
1da177e4
LT		 7619 goto drop;
7620
e13e21dc 7621 if (chan->imtu < skb->len)
1da177e4
LT		 7622 goto drop;
7623
2edf870d 7624 /* Store remote BD_ADDR and PSM for msg_name */
a4368ff3
JH		 7625 bacpy(&bt_cb(skb)->l2cap.bdaddr, &hcon->dst);
7626 bt_cb(skb)->l2cap.psm = psm;
2edf870d 7627
a24cce14
JH		 7628 if (!chan->ops->recv(chan, skb)) {
7629 l2cap_chan_put(chan);
84104b24 7630 return;
a24cce14 7631 }
1da177e4
LT		 7632
7633drop:
a24cce14
JH		 7634 l2cap_chan_put(chan);
7635free_skb:
1da177e4 7636 kfree_skb(skb);
1da177e4
LT		 7637}
7638
7639static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
7640{
7641 struct l2cap_hdr *lh = (void *) skb->data;
61a939c6 7642 struct hci_conn *hcon = conn->hcon;
8e036fc3
AV		 7643 u16 cid, len;
7644 __le16 psm;
1da177e4 7645
61a939c6
JH		 7646 if (hcon->state != BT_CONNECTED) {
7647 BT_DBG("queueing pending rx skb");
7648 skb_queue_tail(&conn->pending_rx, skb);
7649 return;
7650 }
7651
1da177e4
LT		 7652 skb_pull(skb, L2CAP_HDR_SIZE);
7653 cid = __le16_to_cpu(lh->cid);
7654 len = __le16_to_cpu(lh->len);
7655
1c2acffb
GP		 7656 if (len != skb->len) {
7657 kfree_skb(skb);
7658 return;
7659 }
7660
9e1d7e15
JH		 7661 /* Since we can't actively block incoming LE connections we must
7662 * at least ensure that we ignore incoming data from them.
7663 */
7664 if (hcon->type == LE_LINK &&
3d4f9c00 7665 hci_bdaddr_list_lookup(&hcon->hdev->reject_list, &hcon->dst,
a250e048 7666 bdaddr_dst_type(hcon))) {
e493150e
JH		 7667 kfree_skb(skb);
7668 return;
7669 }
7670
1da177e4
LT		 7671 BT_DBG("len %d, cid 0x%4.4x", len, cid);
7672
7673 switch (cid) {
8db4dc46 7674 case L2CAP_CID_SIGNALING:
1da177e4
LT		 7675 l2cap_sig_channel(conn, skb);
7676 break;
7677
8db4dc46 7678 case L2CAP_CID_CONN_LESS:
097db76c 7679 psm = get_unaligned((__le16 *) skb->data);
0181a70f 7680 skb_pull(skb, L2CAP_PSMLEN_SIZE);
1da177e4
LT		 7681 l2cap_conless_channel(conn, psm, skb);
7682 break;
7683
a2877629
MH		 7684 case L2CAP_CID_LE_SIGNALING:
7685 l2cap_le_sig_channel(conn, skb);
7686 break;
7687
1da177e4
LT		 7688 default:
7689 l2cap_data_channel(conn, cid, skb);
7690 break;
7691 }
7692}
7693
61a939c6
JH		 7694static void process_pending_rx(struct work_struct *work)
7695{
7696 struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
7697 pending_rx_work);
7698 struct sk_buff *skb;
7699
7700 BT_DBG("");
7701
7702 while ((skb = skb_dequeue(&conn->pending_rx)))
7703 l2cap_recv_frame(conn, skb);
7704}
7705
162b49e7
JH		 7706static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon)
7707{
7708 struct l2cap_conn *conn = hcon->l2cap_data;
7709 struct hci_chan *hchan;
7710
7711 if (conn)
7712 return conn;
7713
7714 hchan = hci_chan_create(hcon);
7715 if (!hchan)
7716 return NULL;
7717
27f70f3e 7718 conn = kzalloc(sizeof(*conn), GFP_KERNEL);
162b49e7
JH		 7719 if (!conn) {
7720 hci_chan_del(hchan);
7721 return NULL;
7722 }
7723
7724 kref_init(&conn->ref);
7725 hcon->l2cap_data = conn;
51bb8457 7726 conn->hcon = hci_conn_get(hcon);
162b49e7
JH		 7727 conn->hchan = hchan;
7728
7729 BT_DBG("hcon %p conn %p hchan %p", hcon, conn, hchan);
7730
7731 switch (hcon->type) {
7732 case LE_LINK:
7733 if (hcon->hdev->le_mtu) {
7734 conn->mtu = hcon->hdev->le_mtu;
7735 break;
7736 }
19186c7b 7737 fallthrough;
162b49e7
JH		 7738 default:
7739 conn->mtu = hcon->hdev->acl_mtu;
7740 break;
7741 }
7742
7743 conn->feat_mask = 0;
7744
0bd49fc7
JH		 7745 conn->local_fixed_chan = L2CAP_FC_SIG_BREDR | L2CAP_FC_CONNLESS;
7746
7747 if (hcon->type == ACL_LINK &&
d7a5a11d 7748 hci_dev_test_flag(hcon->hdev, HCI_HS_ENABLED))
0bd49fc7 7749 conn->local_fixed_chan |= L2CAP_FC_A2MP;
162b49e7 7750
d7a5a11d 7751 if (hci_dev_test_flag(hcon->hdev, HCI_LE_ENABLED) &&
f9be9e86 7752 (bredr_sc_enabled(hcon->hdev) ||
b7cb93e5 7753 hci_dev_test_flag(hcon->hdev, HCI_FORCE_BREDR_SMP)))
b5ae344d
JH		 7754 conn->local_fixed_chan |= L2CAP_FC_SMP_BREDR;
7755
5a54e7c8 7756 mutex_init(&conn->ident_lock);
162b49e7
JH		 7757 mutex_init(&conn->chan_lock);
7758
7759 INIT_LIST_HEAD(&conn->chan_l);
7760 INIT_LIST_HEAD(&conn->users);
7761
276d8073 7762 INIT_DELAYED_WORK(&conn->info_timer, l2cap_info_timeout);
162b49e7 7763
61a939c6
JH		 7764 skb_queue_head_init(&conn->pending_rx);
7765 INIT_WORK(&conn->pending_rx_work, process_pending_rx);
f3d82d0c 7766 INIT_WORK(&conn->id_addr_update_work, l2cap_conn_update_id_addr);
61a939c6 7767
162b49e7
JH		 7768 conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
7769
7770 return conn;
7771}
7772
149b3f13
MY		 7773static bool is_valid_psm(u16 psm, u8 dst_type)
7774{
162b49e7
JH		 7775 if (!psm)
7776 return false;
7777
7778 if (bdaddr_type_is_le(dst_type))
7779 return (psm <= 0x00ff);
7780
7781 /* PSM must be odd and lsb of upper byte must be 0 */
7782 return ((psm & 0x0101) == 0x0001);
7783}
7784
da49b602
LAD		 7785struct l2cap_chan_data {
7786 struct l2cap_chan *chan;
7787 struct pid *pid;
7788 int count;
7789};
7790
7791static void l2cap_chan_by_pid(struct l2cap_chan *chan, void *data)
7792{
7793 struct l2cap_chan_data *d = data;
7794 struct pid *pid;
7795
7796 if (chan == d->chan)
7797 return;
7798
7799 if (!test_bit(FLAG_DEFER_SETUP, &chan->flags))
7800 return;
7801
7802 pid = chan->ops->get_peer_pid(chan);
7803
7804 /* Only count deferred channels with the same PID/PSM */
7805 if (d->pid != pid || chan->psm != d->chan->psm || chan->ident ||
7806 chan->mode != L2CAP_MODE_EXT_FLOWCTL || chan->state != BT_CONNECT)
7807 return;
7808
7809 d->count++;
7810}
7811
162b49e7
JH		 7812int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,
7813 bdaddr_t *dst, u8 dst_type)
7814{
7815 struct l2cap_conn *conn;
7816 struct hci_conn *hcon;
7817 struct hci_dev *hdev;
162b49e7
JH		 7818 int err;
7819
15f02b91
LAD		 7820 BT_DBG("%pMR -> %pMR (type %u) psm 0x%4.4x mode 0x%2.2x", &chan->src,
7821 dst, dst_type, __le16_to_cpu(psm), chan->mode);
162b49e7 7822
39385cb5 7823 hdev = hci_get_route(dst, &chan->src, chan->src_type);
162b49e7
JH		 7824 if (!hdev)
7825 return -EHOSTUNREACH;
7826
7827 hci_dev_lock(hdev);
7828
162b49e7
JH		 7829 if (!is_valid_psm(__le16_to_cpu(psm), dst_type) && !cid &&
7830 chan->chan_type != L2CAP_CHAN_RAW) {
7831 err = -EINVAL;
7832 goto done;
7833 }
7834
21626e62
JH		 7835 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED && !psm) {
7836 err = -EINVAL;
7837 goto done;
7838 }
7839
7840 if (chan->chan_type == L2CAP_CHAN_FIXED && !cid) {
162b49e7
JH		 7841 err = -EINVAL;
7842 goto done;
7843 }
7844
7845 switch (chan->mode) {
7846 case L2CAP_MODE_BASIC:
7847 break;
7848 case L2CAP_MODE_LE_FLOWCTL:
4be5ca67 7849 break;
15f02b91 7850 case L2CAP_MODE_EXT_FLOWCTL:
4be5ca67
LAD		 7851 if (!enable_ecred) {
7852 err = -EOPNOTSUPP;
7853 goto done;
7854 }
162b49e7
JH		 7855 break;
7856 case L2CAP_MODE_ERTM:
7857 case L2CAP_MODE_STREAMING:
7858 if (!disable_ertm)
7859 break;
19186c7b 7860 fallthrough;
162b49e7 7861 default:
beb19e4c 7862 err = -EOPNOTSUPP;
162b49e7
JH		 7863 goto done;
7864 }
7865
7866 switch (chan->state) {
7867 case BT_CONNECT:
7868 case BT_CONNECT2:
7869 case BT_CONFIG:
7870 /* Already connecting */
7871 err = 0;
7872 goto done;
7873
7874 case BT_CONNECTED:
7875 /* Already connected */
7876 err = -EISCONN;
7877 goto done;
7878
7879 case BT_OPEN:
7880 case BT_BOUND:
7881 /* Can connect */
7882 break;
7883
7884 default:
7885 err = -EBADFD;
7886 goto done;
7887 }
7888
7889 /* Set destination address and psm */
7890 bacpy(&chan->dst, dst);
7891 chan->dst_type = dst_type;
7892
7893 chan->psm = psm;
7894 chan->dcid = cid;
7895
6f77d8c7
AG		 7896 if (bdaddr_type_is_le(dst_type)) {
7897 /* Convert from L2CAP channel address type to HCI address type
7898 */
7899 if (dst_type == BDADDR_LE_PUBLIC)
7900 dst_type = ADDR_LE_DEV_PUBLIC;
7901 else
7902 dst_type = ADDR_LE_DEV_RANDOM;
7903
d7a5a11d 7904 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
0ad06aa6
JH		 7905 hcon = hci_connect_le(hdev, dst, dst_type,
7906 chan->sec_level,
7907 HCI_LE_CONN_TIMEOUT,
082f2300 7908 HCI_ROLE_SLAVE, NULL);
e804d25d 7909 else
0ad06aa6
JH		 7910 hcon = hci_connect_le_scan(hdev, dst, dst_type,
7911 chan->sec_level,
76b13996
MM		 7912 HCI_LE_CONN_TIMEOUT,
7913 CONN_REASON_L2CAP_CHAN);
cdd6275e 7914
6f77d8c7 7915 } else {
d93375a8 7916 u8 auth_type = l2cap_get_auth_type(chan);
76b13996
MM		 7917 hcon = hci_connect_acl(hdev, dst, chan->sec_level, auth_type,
7918 CONN_REASON_L2CAP_CHAN);
6f77d8c7 7919 }
162b49e7
JH		 7920
7921 if (IS_ERR(hcon)) {
7922 err = PTR_ERR(hcon);
7923 goto done;
7924 }
7925
7926 conn = l2cap_conn_add(hcon);
7927 if (!conn) {
7928 hci_conn_drop(hcon);
7929 err = -ENOMEM;
7930 goto done;
7931 }
7932
da49b602
LAD		 7933 if (chan->mode == L2CAP_MODE_EXT_FLOWCTL) {
7934 struct l2cap_chan_data data;
7935
7936 data.chan = chan;
7937 data.pid = chan->ops->get_peer_pid(chan);
7938 data.count = 1;
7939
7940 l2cap_chan_list(conn, l2cap_chan_by_pid, &data);
7941
7942 /* Check if there isn't too many channels being connected */
7943 if (data.count > L2CAP_ECRED_CONN_SCID_MAX) {
7944 hci_conn_drop(hcon);
7945 err = -EPROTO;
7946 goto done;
7947 }
7948 }
7949
02e246ae
JH		 7950 mutex_lock(&conn->chan_lock);
7951 l2cap_chan_lock(chan);
7952
162b49e7
JH		 7953 if (cid && __l2cap_get_chan_by_dcid(conn, cid)) {
7954 hci_conn_drop(hcon);
7955 err = -EBUSY;
02e246ae 7956 goto chan_unlock;
162b49e7
JH		 7957 }
7958
7959 /* Update source addr of the socket */
7960 bacpy(&chan->src, &hcon->src);
a250e048 7961 chan->src_type = bdaddr_src_type(hcon);
162b49e7 7962
02e246ae 7963 __l2cap_chan_add(conn, chan);
162b49e7
JH		 7964
7965 /* l2cap_chan_add takes its own ref so we can drop this one */
7966 hci_conn_drop(hcon);
7967
7968 l2cap_state_change(chan, BT_CONNECT);
7969 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
7970
61202e4d
JH		 7971 /* Release chan->sport so that it can be reused by other
7972 * sockets (as it's only used for listening sockets).
7973 */
7974 write_lock(&chan_list_lock);
7975 chan->sport = 0;
7976 write_unlock(&chan_list_lock);
7977
162b49e7
JH		 7978 if (hcon->state == BT_CONNECTED) {
7979 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
7980 __clear_chan_timer(chan);
e7cafc45 7981 if (l2cap_chan_check_security(chan, true))
162b49e7
JH		 7982 l2cap_state_change(chan, BT_CONNECTED);
7983 } else
7984 l2cap_do_start(chan);
7985 }
7986
7987 err = 0;
7988
02e246ae 7989chan_unlock:
162b49e7 7990 l2cap_chan_unlock(chan);
02e246ae
JH		 7991 mutex_unlock(&conn->chan_lock);
7992done:
162b49e7
JH		 7993 hci_dev_unlock(hdev);
7994 hci_dev_put(hdev);
7995 return err;
7996}
6b8d4a6a 7997EXPORT_SYMBOL_GPL(l2cap_chan_connect);
162b49e7 7998
15f02b91
LAD		 7999static void l2cap_ecred_reconfigure(struct l2cap_chan *chan)
8000{
8001 struct l2cap_conn *conn = chan->conn;
8002 struct {
8003 struct l2cap_ecred_reconf_req req;
8004 __le16 scid;
8005 } pdu;
8006
8007 pdu.req.mtu = cpu_to_le16(chan->imtu);
8008 pdu.req.mps = cpu_to_le16(chan->mps);
8009 pdu.scid = cpu_to_le16(chan->scid);
8010
8011 chan->ident = l2cap_get_ident(conn);
8012
8013 l2cap_send_cmd(conn, chan->ident, L2CAP_ECRED_RECONF_REQ,
8014 sizeof(pdu), &pdu);
8015}
8016
8017int l2cap_chan_reconfigure(struct l2cap_chan *chan, __u16 mtu)
8018{
8019 if (chan->imtu > mtu)
8020 return -EINVAL;
8021
8022 BT_DBG("chan %p mtu 0x%4.4x", chan, mtu);
8023
8024 chan->imtu = mtu;
8025
8026 l2cap_ecred_reconfigure(chan);
8027
8028 return 0;
8029}
8030
1da177e4
LT		 8031/* ---- L2CAP interface with lower layer (HCI) ---- */
8032
686ebf28 8033int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr)
1da177e4
LT		 8034{
8035 int exact = 0, lm1 = 0, lm2 = 0;
23691d75 8036 struct l2cap_chan *c;
1da177e4 8037
6ed93dc6 8038 BT_DBG("hdev %s, bdaddr %pMR", hdev->name, bdaddr);
1da177e4
LT		 8039
8040 /* Find listening sockets and check their link_mode */
23691d75
GP		 8041 read_lock(&chan_list_lock);
8042 list_for_each_entry(c, &chan_list, global_l) {
89bc500e 8043 if (c->state != BT_LISTEN)
1da177e4
LT		 8044 continue;
8045
7eafc59e 8046 if (!bacmp(&c->src, &hdev->bdaddr)) {
2af6b9d5 8047 lm1 |= HCI_LM_ACCEPT;
43bd0f32 8048 if (test_bit(FLAG_ROLE_SWITCH, &c->flags))
2af6b9d5 8049 lm1 |= HCI_LM_MASTER;
1da177e4 8050 exact++;
7eafc59e 8051 } else if (!bacmp(&c->src, BDADDR_ANY)) {
2af6b9d5 8052 lm2 |= HCI_LM_ACCEPT;
43bd0f32 8053 if (test_bit(FLAG_ROLE_SWITCH, &c->flags))
2af6b9d5
MH		 8054 lm2 |= HCI_LM_MASTER;
8055 }
1da177e4 8056 }
23691d75 8057 read_unlock(&chan_list_lock);
1da177e4
LT		 8058
8059 return exact ? lm1 : lm2;
8060}
8061
e760ec12
JH		 8062/* Find the next fixed channel in BT_LISTEN state, continue iteration
8063 * from an existing channel in the list or from the beginning of the
8064 * global list (by passing NULL as first parameter).
8065 */
8066static struct l2cap_chan *l2cap_global_fixed_chan(struct l2cap_chan *c,
327a7191 8067 struct hci_conn *hcon)
e760ec12 8068{
327a7191
JH		 8069 u8 src_type = bdaddr_src_type(hcon);
8070
e760ec12
JH		 8071 read_lock(&chan_list_lock);
8072
8073 if (c)
8074 c = list_next_entry(c, global_l);
8075 else
8076 c = list_entry(chan_list.next, typeof(*c), global_l);
8077
8078 list_for_each_entry_from(c, &chan_list, global_l) {
8079 if (c->chan_type != L2CAP_CHAN_FIXED)
8080 continue;
8081 if (c->state != BT_LISTEN)
8082 continue;
327a7191 8083 if (bacmp(&c->src, &hcon->src) && bacmp(&c->src, BDADDR_ANY))
54a1b626 8084 continue;
327a7191 8085 if (src_type != c->src_type)
54a1b626 8086 continue;
e760ec12
JH		 8087
8088 l2cap_chan_hold(c);
8089 read_unlock(&chan_list_lock);
8090 return c;
8091 }
8092
8093 read_unlock(&chan_list_lock);
8094
8095 return NULL;
8096}
8097
539c496d 8098static void l2cap_connect_cfm(struct hci_conn *hcon, u8 status)
1da177e4 8099{
e760ec12 8100 struct hci_dev *hdev = hcon->hdev;
0139418c 8101 struct l2cap_conn *conn;
e760ec12
JH		 8102 struct l2cap_chan *pchan;
8103 u8 dst_type;
0139418c 8104
539c496d
JH		 8105 if (hcon->type != ACL_LINK && hcon->type != LE_LINK)
8106 return;
8107
6ed93dc6 8108 BT_DBG("hcon %p bdaddr %pMR status %d", hcon, &hcon->dst, status);
1da177e4 8109
dc0f5088 8110 if (status) {
e175072f 8111 l2cap_conn_del(hcon, bt_to_errno(status));
dc0f5088 8112 return;
ba6fc317 8113 }
dc0f5088
JH		 8114
8115 conn = l2cap_conn_add(hcon);
8116 if (!conn)
8117 return;
8118
a250e048 8119 dst_type = bdaddr_dst_type(hcon);
e760ec12
JH		 8120
8121 /* If device is blocked, do not create channels for it */
3d4f9c00 8122 if (hci_bdaddr_list_lookup(&hdev->reject_list, &hcon->dst, dst_type))
e760ec12
JH		 8123 return;
8124
8125 /* Find fixed channels and notify them of the new connection. We
8126 * use multiple individual lookups, continuing each time where
8127 * we left off, because the list lock would prevent calling the
8128 * potentially sleeping l2cap_chan_lock() function.
8129 */
327a7191 8130 pchan = l2cap_global_fixed_chan(NULL, hcon);
e760ec12
JH		 8131 while (pchan) {
8132 struct l2cap_chan *chan, *next;
8133
8134 /* Client fixed channels should override server ones */
8135 if (__l2cap_get_chan_by_dcid(conn, pchan->scid))
8136 goto next;
8137
8138 l2cap_chan_lock(pchan);
8139 chan = pchan->ops->new_connection(pchan);
8140 if (chan) {
8141 bacpy(&chan->src, &hcon->src);
8142 bacpy(&chan->dst, &hcon->dst);
a250e048 8143 chan->src_type = bdaddr_src_type(hcon);
e760ec12
JH		 8144 chan->dst_type = dst_type;
8145
8146 __l2cap_chan_add(conn, chan);
8147 }
8148
8149 l2cap_chan_unlock(pchan);
8150next:
327a7191 8151 next = l2cap_global_fixed_chan(pchan, hcon);
e760ec12
JH		 8152 l2cap_chan_put(pchan);
8153 pchan = next;
8154 }
8155
dc0f5088 8156 l2cap_conn_ready(conn);
1da177e4
LT		 8157}
8158
686ebf28 8159int l2cap_disconn_ind(struct hci_conn *hcon)
2950f21a
MH		 8160{
8161 struct l2cap_conn *conn = hcon->l2cap_data;
8162
8163 BT_DBG("hcon %p", hcon);
8164
686ebf28 8165 if (!conn)
9f5a0d7b 8166 return HCI_ERROR_REMOTE_USER_TERM;
2950f21a
MH		 8167 return conn->disc_reason;
8168}
8169
3a6d576b 8170static void l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason)
1da177e4 8171{
3a6d576b
JH		 8172 if (hcon->type != ACL_LINK && hcon->type != LE_LINK)
8173 return;
8174
1da177e4
LT		 8175 BT_DBG("hcon %p reason %d", hcon, reason);
8176
e175072f 8177 l2cap_conn_del(hcon, bt_to_errno(reason));
1da177e4
LT		 8178}
8179
4343478f 8180static inline void l2cap_check_encryption(struct l2cap_chan *chan, u8 encrypt)
f62e4323 8181{
715ec005 8182 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED)
255c7601
MH		 8183 return;
8184
f62e4323 8185 if (encrypt == 0x00) {
4343478f 8186 if (chan->sec_level == BT_SECURITY_MEDIUM) {
ba13ccd9 8187 __set_chan_timer(chan, L2CAP_ENC_TIMEOUT);
7d513e92
MH		 8188 } else if (chan->sec_level == BT_SECURITY_HIGH ||
8189 chan->sec_level == BT_SECURITY_FIPS)
0f852724 8190 l2cap_chan_close(chan, ECONNREFUSED);
f62e4323 8191 } else {
4343478f 8192 if (chan->sec_level == BT_SECURITY_MEDIUM)
c9b66675 8193 __clear_chan_timer(chan);
f62e4323
MH		 8194 }
8195}
8196
354fe804 8197static void l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
1da177e4 8198{
0139418c 8199 struct l2cap_conn *conn = hcon->l2cap_data;
48454079 8200 struct l2cap_chan *chan;
1da177e4 8201
0139418c 8202 if (!conn)
354fe804 8203 return;
0139418c 8204
89d8b407 8205 BT_DBG("conn %p status 0x%2.2x encrypt %u", conn, status, encrypt);
1da177e4 8206
3df91ea2 8207 mutex_lock(&conn->chan_lock);
1da177e4 8208
3df91ea2 8209 list_for_each_entry(chan, &conn->chan_l, list) {
6be36555 8210 l2cap_chan_lock(chan);
1da177e4 8211
89d8b407
AE		 8212 BT_DBG("chan %p scid 0x%4.4x state %s", chan, chan->scid,
8213 state_to_string(chan->state));
f1cb9af5 8214
2338a7e0 8215 if (chan->scid == L2CAP_CID_A2MP) {
78eb2f98
AE		 8216 l2cap_chan_unlock(chan);
8217 continue;
8218 }
8219
191eb398
JH		 8220 if (!status && encrypt)
8221 chan->sec_level = hcon->sec_level;
f1cb9af5 8222
96eff46e 8223 if (!__l2cap_no_conn_pending(chan)) {
6be36555 8224 l2cap_chan_unlock(chan);
6a8d3010
MH		 8225 continue;
8226 }
8227
89bc500e 8228 if (!status && (chan->state == BT_CONNECTED ||
2d792818 8229 chan->state == BT_CONFIG)) {
d97c899b 8230 chan->ops->resume(chan);
4343478f 8231 l2cap_check_encryption(chan, encrypt);
6be36555 8232 l2cap_chan_unlock(chan);
9719f8af
MH		 8233 continue;
8234 }
8235
89bc500e 8236 if (chan->state == BT_CONNECT) {
693cd8ce 8237 if (!status && l2cap_check_enc_key_size(hcon))
93c3e8f5 8238 l2cap_start_connection(chan);
6d3c15da 8239 else
ba13ccd9 8240 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
fa37c1aa 8241 } else if (chan->state == BT_CONNECT2 &&
15f02b91
LAD		 8242 !(chan->mode == L2CAP_MODE_EXT_FLOWCTL ||
8243 chan->mode == L2CAP_MODE_LE_FLOWCTL)) {
b1235d79 8244 struct l2cap_conn_rsp rsp;
df3c3931 8245 __u16 res, stat;
1da177e4 8246
693cd8ce 8247 if (!status && l2cap_check_enc_key_size(hcon)) {
bdc25783 8248 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
df3c3931
JH		 8249 res = L2CAP_CR_PEND;
8250 stat = L2CAP_CS_AUTHOR_PEND;
2dc4e510 8251 chan->ops->defer(chan);
df3c3931 8252 } else {
acdcabf5 8253 l2cap_state_change(chan, BT_CONFIG);
df3c3931
JH		 8254 res = L2CAP_CR_SUCCESS;
8255 stat = L2CAP_CS_NO_INFO;
8256 }
b1235d79 8257 } else {
acdcabf5 8258 l2cap_state_change(chan, BT_DISCONN);
ba13ccd9 8259 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
df3c3931
JH		 8260 res = L2CAP_CR_SEC_BLOCK;
8261 stat = L2CAP_CS_NO_INFO;
b1235d79
MH		 8262 }
8263
fe4128e0
GP		 8264 rsp.scid = cpu_to_le16(chan->dcid);
8265 rsp.dcid = cpu_to_le16(chan->scid);
df3c3931
JH		 8266 rsp.result = cpu_to_le16(res);
8267 rsp.status = cpu_to_le16(stat);
fc7f8a7e 8268 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
2d792818 8269 sizeof(rsp), &rsp);
2d369359
MM		 8270
8271 if (!test_bit(CONF_REQ_SENT, &chan->conf_state) &&
8272 res == L2CAP_CR_SUCCESS) {
8273 char buf[128];
8274 set_bit(CONF_REQ_SENT, &chan->conf_state);
8275 l2cap_send_cmd(conn, l2cap_get_ident(conn),
8276 L2CAP_CONF_REQ,
e860d2c9 8277 l2cap_build_conf_req(chan, buf, sizeof(buf)),
2d369359
MM		 8278 buf);
8279 chan->num_conf_req++;
8280 }
b1235d79 8281 }
1da177e4 8282
6be36555 8283 l2cap_chan_unlock(chan);
1da177e4
LT		 8284 }
8285
3df91ea2 8286 mutex_unlock(&conn->chan_lock);
1da177e4
LT		 8287}
8288
4d7ea8ee
LAD		 8289/* Append fragment into frame respecting the maximum len of rx_skb */
8290static int l2cap_recv_frag(struct l2cap_conn *conn, struct sk_buff *skb,
8291 u16 len)
8292{
8293 if (!conn->rx_skb) {
8294 /* Allocate skb for the complete frame (with header) */
8295 conn->rx_skb = bt_skb_alloc(len, GFP_KERNEL);
8296 if (!conn->rx_skb)
8297 return -ENOMEM;
8298 /* Init rx_len */
8299 conn->rx_len = len;
8300 }
8301
8302 /* Copy as much as the rx_skb can hold */
8303 len = min_t(u16, len, skb->len);
8304 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, len), len);
8305 skb_pull(skb, len);
8306 conn->rx_len -= len;
8307
8308 return len;
8309}
8310
8311static int l2cap_recv_len(struct l2cap_conn *conn, struct sk_buff *skb)
8312{
8313 struct sk_buff *rx_skb;
8314 int len;
8315
8316 /* Append just enough to complete the header */
8317 len = l2cap_recv_frag(conn, skb, L2CAP_LEN_SIZE - conn->rx_skb->len);
8318
8319 /* If header could not be read just continue */
8320 if (len < 0 || conn->rx_skb->len < L2CAP_LEN_SIZE)
8321 return len;
8322
8323 rx_skb = conn->rx_skb;
8324 len = get_unaligned_le16(rx_skb->data);
8325
8326 /* Check if rx_skb has enough space to received all fragments */
8327 if (len + (L2CAP_HDR_SIZE - L2CAP_LEN_SIZE) <= skb_tailroom(rx_skb)) {
8328 /* Update expected len */
8329 conn->rx_len = len + (L2CAP_HDR_SIZE - L2CAP_LEN_SIZE);
8330 return L2CAP_LEN_SIZE;
8331 }
8332
8333 /* Reset conn->rx_skb since it will need to be reallocated in order to
8334 * fit all fragments.
8335 */
8336 conn->rx_skb = NULL;
8337
8338 /* Reallocates rx_skb using the exact expected length */
8339 len = l2cap_recv_frag(conn, rx_skb,
8340 len + (L2CAP_HDR_SIZE - L2CAP_LEN_SIZE));
8341 kfree_skb(rx_skb);
8342
8343 return len;
8344}
8345
8346static void l2cap_recv_reset(struct l2cap_conn *conn)
8347{
8348 kfree_skb(conn->rx_skb);
8349 conn->rx_skb = NULL;
8350 conn->rx_len = 0;
8351}
8352
9b4c3336 8353void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
1da177e4
LT		 8354{
8355 struct l2cap_conn *conn = hcon->l2cap_data;
d73a0988 8356 int len;
1da177e4 8357
1d13a254 8358 /* For AMP controller do not create l2cap conn */
ca8bee5d 8359 if (!conn && hcon->hdev->dev_type != HCI_PRIMARY)
1d13a254 8360 goto drop;
1da177e4 8361
5a08ecce 8362 if (!conn)
baf43251 8363 conn = l2cap_conn_add(hcon);
5a08ecce
AE		 8364
8365 if (!conn)
1da177e4
LT		 8366 goto drop;
8367
93917fd2 8368 BT_DBG("conn %p len %u flags 0x%x", conn, skb->len, flags);
1da177e4 8369
d73a0988
AE		 8370 switch (flags) {
8371 case ACL_START:
8372 case ACL_START_NO_FLUSH:
8373 case ACL_COMPLETE:
4d7ea8ee 8374 if (conn->rx_skb) {
1da177e4 8375 BT_ERR("Unexpected start frame (len %d)", skb->len);
4d7ea8ee 8376 l2cap_recv_reset(conn);
1da177e4
LT		 8377 l2cap_conn_unreliable(conn, ECOMM);
8378 }
8379
4d7ea8ee
LAD		 8380 /* Start fragment may not contain the L2CAP length so just
8381 * copy the initial byte when that happens and use conn->mtu as
8382 * expected length.
8383 */
8384 if (skb->len < L2CAP_LEN_SIZE) {
8385 if (l2cap_recv_frag(conn, skb, conn->mtu) < 0)
8386 goto drop;
8387 return;
1da177e4
LT		 8388 }
8389
4d7ea8ee 8390 len = get_unaligned_le16(skb->data) + L2CAP_HDR_SIZE;
1da177e4
LT		 8391
8392 if (len == skb->len) {
8393 /* Complete frame received */
8394 l2cap_recv_frame(conn, skb);
9b4c3336 8395 return;
1da177e4
LT		 8396 }
8397
93917fd2 8398 BT_DBG("Start: total len %d, frag len %u", len, skb->len);
1da177e4
LT		 8399
8400 if (skb->len > len) {
93917fd2 8401 BT_ERR("Frame is too long (len %u, expected len %d)",
2d792818 8402 skb->len, len);
1da177e4
LT		 8403 l2cap_conn_unreliable(conn, ECOMM);
8404 goto drop;
8405 }
8406
4d7ea8ee
LAD		 8407 /* Append fragment into frame (with header) */
8408 if (l2cap_recv_frag(conn, skb, len) < 0)
1da177e4
LT		 8409 goto drop;
8410
d73a0988
AE		 8411 break;
8412
8413 case ACL_CONT:
93917fd2 8414 BT_DBG("Cont: frag len %u (expecting %u)", skb->len, conn->rx_len);
1da177e4 8415
4d7ea8ee 8416 if (!conn->rx_skb) {
1da177e4
LT		 8417 BT_ERR("Unexpected continuation frame (len %d)", skb->len);
8418 l2cap_conn_unreliable(conn, ECOMM);
8419 goto drop;
8420 }
8421
4d7ea8ee
LAD		 8422 /* Complete the L2CAP length if it has not been read */
8423 if (conn->rx_skb->len < L2CAP_LEN_SIZE) {
8424 if (l2cap_recv_len(conn, skb) < 0) {
8425 l2cap_conn_unreliable(conn, ECOMM);
8426 goto drop;
8427 }
8428
8429 /* Header still could not be read just continue */
8430 if (conn->rx_skb->len < L2CAP_LEN_SIZE)
8431 return;
8432 }
8433
1da177e4 8434 if (skb->len > conn->rx_len) {
93917fd2 8435 BT_ERR("Fragment is too long (len %u, expected %u)",
2d792818 8436 skb->len, conn->rx_len);
4d7ea8ee 8437 l2cap_recv_reset(conn);
1da177e4
LT		 8438 l2cap_conn_unreliable(conn, ECOMM);
8439 goto drop;
8440 }
8441
4d7ea8ee
LAD		 8442 /* Append fragment into frame (with header) */
8443 l2cap_recv_frag(conn, skb, skb->len);
1da177e4
LT		 8444
8445 if (!conn->rx_len) {
c4e5bafa
JH		 8446 /* Complete frame received. l2cap_recv_frame
8447 * takes ownership of the skb so set the global
8448 * rx_skb pointer to NULL first.
8449 */
8450 struct sk_buff *rx_skb = conn->rx_skb;
1da177e4 8451 conn->rx_skb = NULL;
c4e5bafa 8452 l2cap_recv_frame(conn, rx_skb);
1da177e4 8453 }
d73a0988 8454 break;
1da177e4
LT		 8455 }
8456
8457drop:
8458 kfree_skb(skb);
1da177e4
LT		 8459}
8460
354fe804
JH		 8461static struct hci_cb l2cap_cb = {
8462 .name = "L2CAP",
539c496d 8463 .connect_cfm = l2cap_connect_cfm,
3a6d576b 8464 .disconn_cfm = l2cap_disconn_cfm,
354fe804
JH		 8465 .security_cfm = l2cap_security_cfm,
8466};
8467
aef7d97c 8468static int l2cap_debugfs_show(struct seq_file *f, void *p)
1da177e4 8469{
23691d75 8470 struct l2cap_chan *c;
1da177e4 8471
333055f2 8472 read_lock(&chan_list_lock);
1da177e4 8473
23691d75 8474 list_for_each_entry(c, &chan_list, global_l) {
eeb5a067
MH		 8475 seq_printf(f, "%pMR (%u) %pMR (%u) %d %d 0x%4.4x 0x%4.4x %d %d %d %d\n",
8476 &c->src, c->src_type, &c->dst, c->dst_type,
fcb73338
AE		 8477 c->state, __le16_to_cpu(c->psm),
8478 c->scid, c->dcid, c->imtu, c->omtu,
8479 c->sec_level, c->mode);
61e1b4b7 8480 }
1da177e4 8481
333055f2 8482 read_unlock(&chan_list_lock);
1da177e4 8483
aef7d97c 8484 return 0;
1da177e4
LT		 8485}
8486
8e2924e3 8487DEFINE_SHOW_ATTRIBUTE(l2cap_debugfs);
aef7d97c
MH		 8488
8489static struct dentry *l2cap_debugfs;
1da177e4 8490
64274518 8491int __init l2cap_init(void)
1da177e4
LT		 8492{
8493 int err;
be9d1227 8494
bb58f747 8495 err = l2cap_init_sockets();
1da177e4
LT		 8496 if (err < 0)
8497 return err;
8498
354fe804
JH		 8499 hci_register_cb(&l2cap_cb);
8500
1120e4bf
MH		 8501 if (IS_ERR_OR_NULL(bt_debugfs))
8502 return 0;
8503
8504 l2cap_debugfs = debugfs_create_file("l2cap", 0444, bt_debugfs,
8505 NULL, &l2cap_debugfs_fops);
1da177e4 8506
1da177e4 8507 return 0;
1da177e4
LT		 8508}
8509
64274518 8510void l2cap_exit(void)
1da177e4 8511{
aef7d97c 8512 debugfs_remove(l2cap_debugfs);
354fe804 8513 hci_unregister_cb(&l2cap_cb);
bb58f747 8514 l2cap_cleanup_sockets();
1da177e4
LT		 8515}
8516
d1c4a17d
GP		 8517module_param(disable_ertm, bool, 0644);
8518MODULE_PARM_DESC(disable_ertm, "Disable enhanced retransmission mode");
4be5ca67
LAD		 8519
8520module_param(enable_ecred, bool, 0644);
8521MODULE_PARM_DESC(enable_ecred, "Enable enhanced credit flow control mode");
Ubuntu Jammy Linux kernel mirror