]> git.proxmox.com Git - mirror_ubuntu-jammy-kernel.git/blob - net/bluetooth/l2cap_core.c
projects / mirror_ubuntu-jammy-kernel.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm
[mirror_ubuntu-jammy-kernel.git] / net / bluetooth / l2cap_core.c
1 /*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
4 Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
5 Copyright (C) 2010 Google Inc.
6 Copyright (C) 2011 ProFUSION Embedded Systems
7 Copyright (c) 2012 Code Aurora Forum. All rights reserved.
8
9 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
10
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License version 2 as
13 published by the Free Software Foundation;
14
15 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
16 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
18 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
19 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
20 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
21 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
22 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
23
24 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
25 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
26 SOFTWARE IS DISCLAIMED.
27 */
28
29 /* Bluetooth L2CAP core. */
30
31 #include <linux/module.h>
32
33 #include <linux/debugfs.h>
34 #include <linux/crc16.h>
35 #include <linux/filter.h>
36
37 #include <net/bluetooth/bluetooth.h>
38 #include <net/bluetooth/hci_core.h>
39 #include <net/bluetooth/l2cap.h>
40
41 #include "smp.h"
42 #include "a2mp.h"
43 #include "amp.h"
44
45 #define LE_FLOWCTL_MAX_CREDITS 65535
46
47 bool disable_ertm;
48 bool enable_ecred;
49
50 static u32 l2cap_feat_mask = L2CAP_FEAT_FIXED_CHAN | L2CAP_FEAT_UCD;
51
52 static LIST_HEAD(chan_list);
53 static DEFINE_RWLOCK(chan_list_lock);
54
55 static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
56 u8 code, u8 ident, u16 dlen, void *data);
57 static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
58 void *data);
59 static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size);
60 static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err);
61
62 static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
63 struct sk_buff_head *skbs, u8 event);
64
65 static inline u8 bdaddr_type(u8 link_type, u8 bdaddr_type)
66 {
67 if (link_type == LE_LINK) {
68 if (bdaddr_type == ADDR_LE_DEV_PUBLIC)
69 return BDADDR_LE_PUBLIC;
70 else
71 return BDADDR_LE_RANDOM;
72 }
73
74 return BDADDR_BREDR;
75 }
76
77 static inline u8 bdaddr_src_type(struct hci_conn *hcon)
78 {
79 return bdaddr_type(hcon->type, hcon->src_type);
80 }
81
82 static inline u8 bdaddr_dst_type(struct hci_conn *hcon)
83 {
84 return bdaddr_type(hcon->type, hcon->dst_type);
85 }
86
87 /* ---- L2CAP channels ---- */
88
89 static struct l2cap_chan *__l2cap_get_chan_by_dcid(struct l2cap_conn *conn,
90 u16 cid)
91 {
92 struct l2cap_chan *c;
93
94 list_for_each_entry(c, &conn->chan_l, list) {
95 if (c->dcid == cid)
96 return c;
97 }
98 return NULL;
99 }
100
101 static struct l2cap_chan *__l2cap_get_chan_by_scid(struct l2cap_conn *conn,
102 u16 cid)
103 {
104 struct l2cap_chan *c;
105
106 list_for_each_entry(c, &conn->chan_l, list) {
107 if (c->scid == cid)
108 return c;
109 }
110 return NULL;
111 }
112
113 /* Find channel with given SCID.
114 * Returns locked channel. */
115 static struct l2cap_chan *l2cap_get_chan_by_scid(struct l2cap_conn *conn,
116 u16 cid)
117 {
118 struct l2cap_chan *c;
119
120 mutex_lock(&conn->chan_lock);
121 c = __l2cap_get_chan_by_scid(conn, cid);
122 if (c)
123 l2cap_chan_lock(c);
124 mutex_unlock(&conn->chan_lock);
125
126 return c;
127 }
128
129 /* Find channel with given DCID.
130 * Returns locked channel.
131 */
132 static struct l2cap_chan *l2cap_get_chan_by_dcid(struct l2cap_conn *conn,
133 u16 cid)
134 {
135 struct l2cap_chan *c;
136
137 mutex_lock(&conn->chan_lock);
138 c = __l2cap_get_chan_by_dcid(conn, cid);
139 if (c)
140 l2cap_chan_lock(c);
141 mutex_unlock(&conn->chan_lock);
142
143 return c;
144 }
145
146 static struct l2cap_chan *__l2cap_get_chan_by_ident(struct l2cap_conn *conn,
147 u8 ident)
148 {
149 struct l2cap_chan *c;
150
151 list_for_each_entry(c, &conn->chan_l, list) {
152 if (c->ident == ident)
153 return c;
154 }
155 return NULL;
156 }
157
158 static struct l2cap_chan *l2cap_get_chan_by_ident(struct l2cap_conn *conn,
159 u8 ident)
160 {
161 struct l2cap_chan *c;
162
163 mutex_lock(&conn->chan_lock);
164 c = __l2cap_get_chan_by_ident(conn, ident);
165 if (c)
166 l2cap_chan_lock(c);
167 mutex_unlock(&conn->chan_lock);
168
169 return c;
170 }
171
172 static struct l2cap_chan *__l2cap_global_chan_by_addr(__le16 psm, bdaddr_t *src,
173 u8 src_type)
174 {
175 struct l2cap_chan *c;
176
177 list_for_each_entry(c, &chan_list, global_l) {
178 if (src_type == BDADDR_BREDR && c->src_type != BDADDR_BREDR)
179 continue;
180
181 if (src_type != BDADDR_BREDR && c->src_type == BDADDR_BREDR)
182 continue;
183
184 if (c->sport == psm && !bacmp(&c->src, src))
185 return c;
186 }
187 return NULL;
188 }
189
190 int l2cap_add_psm(struct l2cap_chan *chan, bdaddr_t *src, __le16 psm)
191 {
192 int err;
193
194 write_lock(&chan_list_lock);
195
196 if (psm && __l2cap_global_chan_by_addr(psm, src, chan->src_type)) {
197 err = -EADDRINUSE;
198 goto done;
199 }
200
201 if (psm) {
202 chan->psm = psm;
203 chan->sport = psm;
204 err = 0;
205 } else {
206 u16 p, start, end, incr;
207
208 if (chan->src_type == BDADDR_BREDR) {
209 start = L2CAP_PSM_DYN_START;
210 end = L2CAP_PSM_AUTO_END;
211 incr = 2;
212 } else {
213 start = L2CAP_PSM_LE_DYN_START;
214 end = L2CAP_PSM_LE_DYN_END;
215 incr = 1;
216 }
217
218 err = -EINVAL;
219 for (p = start; p <= end; p += incr)
220 if (!__l2cap_global_chan_by_addr(cpu_to_le16(p), src,
221 chan->src_type)) {
222 chan->psm = cpu_to_le16(p);
223 chan->sport = cpu_to_le16(p);
224 err = 0;
225 break;
226 }
227 }
228
229 done:
230 write_unlock(&chan_list_lock);
231 return err;
232 }
233 EXPORT_SYMBOL_GPL(l2cap_add_psm);
234
235 int l2cap_add_scid(struct l2cap_chan *chan, __u16 scid)
236 {
237 write_lock(&chan_list_lock);
238
239 /* Override the defaults (which are for conn-oriented) */
240 chan->omtu = L2CAP_DEFAULT_MTU;
241 chan->chan_type = L2CAP_CHAN_FIXED;
242
243 chan->scid = scid;
244
245 write_unlock(&chan_list_lock);
246
247 return 0;
248 }
249
250 static u16 l2cap_alloc_cid(struct l2cap_conn *conn)
251 {
252 u16 cid, dyn_end;
253
254 if (conn->hcon->type == LE_LINK)
255 dyn_end = L2CAP_CID_LE_DYN_END;
256 else
257 dyn_end = L2CAP_CID_DYN_END;
258
259 for (cid = L2CAP_CID_DYN_START; cid <= dyn_end; cid++) {
260 if (!__l2cap_get_chan_by_scid(conn, cid))
261 return cid;
262 }
263
264 return 0;
265 }
266
267 static void l2cap_state_change(struct l2cap_chan *chan, int state)
268 {
269 BT_DBG("chan %p %s -> %s", chan, state_to_string(chan->state),
270 state_to_string(state));
271
272 chan->state = state;
273 chan->ops->state_change(chan, state, 0);
274 }
275
276 static inline void l2cap_state_change_and_error(struct l2cap_chan *chan,
277 int state, int err)
278 {
279 chan->state = state;
280 chan->ops->state_change(chan, chan->state, err);
281 }
282
283 static inline void l2cap_chan_set_err(struct l2cap_chan *chan, int err)
284 {
285 chan->ops->state_change(chan, chan->state, err);
286 }
287
288 static void __set_retrans_timer(struct l2cap_chan *chan)
289 {
290 if (!delayed_work_pending(&chan->monitor_timer) &&
291 chan->retrans_timeout) {
292 l2cap_set_timer(chan, &chan->retrans_timer,
293 msecs_to_jiffies(chan->retrans_timeout));
294 }
295 }
296
297 static void __set_monitor_timer(struct l2cap_chan *chan)
298 {
299 __clear_retrans_timer(chan);
300 if (chan->monitor_timeout) {
301 l2cap_set_timer(chan, &chan->monitor_timer,
302 msecs_to_jiffies(chan->monitor_timeout));
303 }
304 }
305
306 static struct sk_buff *l2cap_ertm_seq_in_queue(struct sk_buff_head *head,
307 u16 seq)
308 {
309 struct sk_buff *skb;
310
311 skb_queue_walk(head, skb) {
312 if (bt_cb(skb)->l2cap.txseq == seq)
313 return skb;
314 }
315
316 return NULL;
317 }
318
319 /* ---- L2CAP sequence number lists ---- */
320
321 /* For ERTM, ordered lists of sequence numbers must be tracked for
322 * SREJ requests that are received and for frames that are to be
323 * retransmitted. These seq_list functions implement a singly-linked
324 * list in an array, where membership in the list can also be checked
325 * in constant time. Items can also be added to the tail of the list
326 * and removed from the head in constant time, without further memory
327 * allocs or frees.
328 */
329
330 static int l2cap_seq_list_init(struct l2cap_seq_list *seq_list, u16 size)
331 {
332 size_t alloc_size, i;
333
334 /* Allocated size is a power of 2 to map sequence numbers
335 * (which may be up to 14 bits) in to a smaller array that is
336 * sized for the negotiated ERTM transmit windows.
337 */
338 alloc_size = roundup_pow_of_two(size);
339
340 seq_list->list = kmalloc_array(alloc_size, sizeof(u16), GFP_KERNEL);
341 if (!seq_list->list)
342 return -ENOMEM;
343
344 seq_list->mask = alloc_size - 1;
345 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
346 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
347 for (i = 0; i < alloc_size; i++)
348 seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR;
349
350 return 0;
351 }
352
353 static inline void l2cap_seq_list_free(struct l2cap_seq_list *seq_list)
354 {
355 kfree(seq_list->list);
356 }
357
358 static inline bool l2cap_seq_list_contains(struct l2cap_seq_list *seq_list,
359 u16 seq)
360 {
361 /* Constant-time check for list membership */
362 return seq_list->list[seq & seq_list->mask] != L2CAP_SEQ_LIST_CLEAR;
363 }
364
365 static inline u16 l2cap_seq_list_pop(struct l2cap_seq_list *seq_list)
366 {
367 u16 seq = seq_list->head;
368 u16 mask = seq_list->mask;
369
370 seq_list->head = seq_list->list[seq & mask];
371 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_CLEAR;
372
373 if (seq_list->head == L2CAP_SEQ_LIST_TAIL) {
374 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
375 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
376 }
377
378 return seq;
379 }
380
381 static void l2cap_seq_list_clear(struct l2cap_seq_list *seq_list)
382 {
383 u16 i;
384
385 if (seq_list->head == L2CAP_SEQ_LIST_CLEAR)
386 return;
387
388 for (i = 0; i <= seq_list->mask; i++)
389 seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR;
390
391 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
392 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
393 }
394
395 static void l2cap_seq_list_append(struct l2cap_seq_list *seq_list, u16 seq)
396 {
397 u16 mask = seq_list->mask;
398
399 /* All appends happen in constant time */
400
401 if (seq_list->list[seq & mask] != L2CAP_SEQ_LIST_CLEAR)
402 return;
403
404 if (seq_list->tail == L2CAP_SEQ_LIST_CLEAR)
405 seq_list->head = seq;
406 else
407 seq_list->list[seq_list->tail & mask] = seq;
408
409 seq_list->tail = seq;
410 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_TAIL;
411 }
412
413 static void l2cap_chan_timeout(struct work_struct *work)
414 {
415 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
416 chan_timer.work);
417 struct l2cap_conn *conn = chan->conn;
418 int reason;
419
420 BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
421
422 mutex_lock(&conn->chan_lock);
423 /* __set_chan_timer() calls l2cap_chan_hold(chan) while scheduling
424 * this work. No need to call l2cap_chan_hold(chan) here again.
425 */
426 l2cap_chan_lock(chan);
427
428 if (chan->state == BT_CONNECTED || chan->state == BT_CONFIG)
429 reason = ECONNREFUSED;
430 else if (chan->state == BT_CONNECT &&
431 chan->sec_level != BT_SECURITY_SDP)
432 reason = ECONNREFUSED;
433 else
434 reason = ETIMEDOUT;
435
436 l2cap_chan_close(chan, reason);
437
438 chan->ops->close(chan);
439
440 l2cap_chan_unlock(chan);
441 l2cap_chan_put(chan);
442
443 mutex_unlock(&conn->chan_lock);
444 }
445
446 struct l2cap_chan *l2cap_chan_create(void)
447 {
448 struct l2cap_chan *chan;
449
450 chan = kzalloc(sizeof(*chan), GFP_ATOMIC);
451 if (!chan)
452 return NULL;
453
454 skb_queue_head_init(&chan->tx_q);
455 skb_queue_head_init(&chan->srej_q);
456 mutex_init(&chan->lock);
457
458 /* Set default lock nesting level */
459 atomic_set(&chan->nesting, L2CAP_NESTING_NORMAL);
460
461 write_lock(&chan_list_lock);
462 list_add(&chan->global_l, &chan_list);
463 write_unlock(&chan_list_lock);
464
465 INIT_DELAYED_WORK(&chan->chan_timer, l2cap_chan_timeout);
466
467 chan->state = BT_OPEN;
468
469 kref_init(&chan->kref);
470
471 /* This flag is cleared in l2cap_chan_ready() */
472 set_bit(CONF_NOT_COMPLETE, &chan->conf_state);
473
474 BT_DBG("chan %p", chan);
475
476 return chan;
477 }
478 EXPORT_SYMBOL_GPL(l2cap_chan_create);
479
480 static void l2cap_chan_destroy(struct kref *kref)
481 {
482 struct l2cap_chan *chan = container_of(kref, struct l2cap_chan, kref);
483
484 BT_DBG("chan %p", chan);
485
486 write_lock(&chan_list_lock);
487 list_del(&chan->global_l);
488 write_unlock(&chan_list_lock);
489
490 kfree(chan);
491 }
492
493 void l2cap_chan_hold(struct l2cap_chan *c)
494 {
495 BT_DBG("chan %p orig refcnt %u", c, kref_read(&c->kref));
496
497 kref_get(&c->kref);
498 }
499
500 void l2cap_chan_put(struct l2cap_chan *c)
501 {
502 BT_DBG("chan %p orig refcnt %u", c, kref_read(&c->kref));
503
504 kref_put(&c->kref, l2cap_chan_destroy);
505 }
506 EXPORT_SYMBOL_GPL(l2cap_chan_put);
507
508 void l2cap_chan_set_defaults(struct l2cap_chan *chan)
509 {
510 chan->fcs = L2CAP_FCS_CRC16;
511 chan->max_tx = L2CAP_DEFAULT_MAX_TX;
512 chan->tx_win = L2CAP_DEFAULT_TX_WINDOW;
513 chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
514 chan->remote_max_tx = chan->max_tx;
515 chan->remote_tx_win = chan->tx_win;
516 chan->ack_win = L2CAP_DEFAULT_TX_WINDOW;
517 chan->sec_level = BT_SECURITY_LOW;
518 chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
519 chan->retrans_timeout = L2CAP_DEFAULT_RETRANS_TO;
520 chan->monitor_timeout = L2CAP_DEFAULT_MONITOR_TO;
521
522 chan->conf_state = 0;
523 set_bit(CONF_NOT_COMPLETE, &chan->conf_state);
524
525 set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
526 }
527 EXPORT_SYMBOL_GPL(l2cap_chan_set_defaults);
528
529 static void l2cap_le_flowctl_init(struct l2cap_chan *chan, u16 tx_credits)
530 {
531 chan->sdu = NULL;
532 chan->sdu_last_frag = NULL;
533 chan->sdu_len = 0;
534 chan->tx_credits = tx_credits;
535 /* Derive MPS from connection MTU to stop HCI fragmentation */
536 chan->mps = min_t(u16, chan->imtu, chan->conn->mtu - L2CAP_HDR_SIZE);
537 /* Give enough credits for a full packet */
538 chan->rx_credits = (chan->imtu / chan->mps) + 1;
539
540 skb_queue_head_init(&chan->tx_q);
541 }
542
543 static void l2cap_ecred_init(struct l2cap_chan *chan, u16 tx_credits)
544 {
545 l2cap_le_flowctl_init(chan, tx_credits);
546
547 /* L2CAP implementations shall support a minimum MPS of 64 octets */
548 if (chan->mps < L2CAP_ECRED_MIN_MPS) {
549 chan->mps = L2CAP_ECRED_MIN_MPS;
550 chan->rx_credits = (chan->imtu / chan->mps) + 1;
551 }
552 }
553
554 void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
555 {
556 BT_DBG("conn %p, psm 0x%2.2x, dcid 0x%4.4x", conn,
557 __le16_to_cpu(chan->psm), chan->dcid);
558
559 conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
560
561 chan->conn = conn;
562
563 switch (chan->chan_type) {
564 case L2CAP_CHAN_CONN_ORIENTED:
565 /* Alloc CID for connection-oriented socket */
566 chan->scid = l2cap_alloc_cid(conn);
567 if (conn->hcon->type == ACL_LINK)
568 chan->omtu = L2CAP_DEFAULT_MTU;
569 break;
570
571 case L2CAP_CHAN_CONN_LESS:
572 /* Connectionless socket */
573 chan->scid = L2CAP_CID_CONN_LESS;
574 chan->dcid = L2CAP_CID_CONN_LESS;
575 chan->omtu = L2CAP_DEFAULT_MTU;
576 break;
577
578 case L2CAP_CHAN_FIXED:
579 /* Caller will set CID and CID specific MTU values */
580 break;
581
582 default:
583 /* Raw socket can send/recv signalling messages only */
584 chan->scid = L2CAP_CID_SIGNALING;
585 chan->dcid = L2CAP_CID_SIGNALING;
586 chan->omtu = L2CAP_DEFAULT_MTU;
587 }
588
589 chan->local_id = L2CAP_BESTEFFORT_ID;
590 chan->local_stype = L2CAP_SERV_BESTEFFORT;
591 chan->local_msdu = L2CAP_DEFAULT_MAX_SDU_SIZE;
592 chan->local_sdu_itime = L2CAP_DEFAULT_SDU_ITIME;
593 chan->local_acc_lat = L2CAP_DEFAULT_ACC_LAT;
594 chan->local_flush_to = L2CAP_EFS_DEFAULT_FLUSH_TO;
595
596 l2cap_chan_hold(chan);
597
598 /* Only keep a reference for fixed channels if they requested it */
599 if (chan->chan_type != L2CAP_CHAN_FIXED ||
600 test_bit(FLAG_HOLD_HCI_CONN, &chan->flags))
601 hci_conn_hold(conn->hcon);
602
603 list_add(&chan->list, &conn->chan_l);
604 }
605
606 void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
607 {
608 mutex_lock(&conn->chan_lock);
609 __l2cap_chan_add(conn, chan);
610 mutex_unlock(&conn->chan_lock);
611 }
612
613 void l2cap_chan_del(struct l2cap_chan *chan, int err)
614 {
615 struct l2cap_conn *conn = chan->conn;
616
617 __clear_chan_timer(chan);
618
619 BT_DBG("chan %p, conn %p, err %d, state %s", chan, conn, err,
620 state_to_string(chan->state));
621
622 chan->ops->teardown(chan, err);
623
624 if (conn) {
625 struct amp_mgr *mgr = conn->hcon->amp_mgr;
626 /* Delete from channel list */
627 list_del(&chan->list);
628
629 l2cap_chan_put(chan);
630
631 chan->conn = NULL;
632
633 /* Reference was only held for non-fixed channels or
634 * fixed channels that explicitly requested it using the
635 * FLAG_HOLD_HCI_CONN flag.
636 */
637 if (chan->chan_type != L2CAP_CHAN_FIXED ||
638 test_bit(FLAG_HOLD_HCI_CONN, &chan->flags))
639 hci_conn_drop(conn->hcon);
640
641 if (mgr && mgr->bredr_chan == chan)
642 mgr->bredr_chan = NULL;
643 }
644
645 if (chan->hs_hchan) {
646 struct hci_chan *hs_hchan = chan->hs_hchan;
647
648 BT_DBG("chan %p disconnect hs_hchan %p", chan, hs_hchan);
649 amp_disconnect_logical_link(hs_hchan);
650 }
651
652 if (test_bit(CONF_NOT_COMPLETE, &chan->conf_state))
653 return;
654
655 switch (chan->mode) {
656 case L2CAP_MODE_BASIC:
657 break;
658
659 case L2CAP_MODE_LE_FLOWCTL:
660 case L2CAP_MODE_EXT_FLOWCTL:
661 skb_queue_purge(&chan->tx_q);
662 break;
663
664 case L2CAP_MODE_ERTM:
665 __clear_retrans_timer(chan);
666 __clear_monitor_timer(chan);
667 __clear_ack_timer(chan);
668
669 skb_queue_purge(&chan->srej_q);
670
671 l2cap_seq_list_free(&chan->srej_list);
672 l2cap_seq_list_free(&chan->retrans_list);
673 fallthrough;
674
675 case L2CAP_MODE_STREAMING:
676 skb_queue_purge(&chan->tx_q);
677 break;
678 }
679 }
680 EXPORT_SYMBOL_GPL(l2cap_chan_del);
681
682 static void __l2cap_chan_list(struct l2cap_conn *conn, l2cap_chan_func_t func,
683 void *data)
684 {
685 struct l2cap_chan *chan;
686
687 list_for_each_entry(chan, &conn->chan_l, list) {
688 func(chan, data);
689 }
690 }
691
692 void l2cap_chan_list(struct l2cap_conn *conn, l2cap_chan_func_t func,
693 void *data)
694 {
695 if (!conn)
696 return;
697
698 mutex_lock(&conn->chan_lock);
699 __l2cap_chan_list(conn, func, data);
700 mutex_unlock(&conn->chan_lock);
701 }
702
703 EXPORT_SYMBOL_GPL(l2cap_chan_list);
704
705 static void l2cap_conn_update_id_addr(struct work_struct *work)
706 {
707 struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
708 id_addr_update_work);
709 struct hci_conn *hcon = conn->hcon;
710 struct l2cap_chan *chan;
711
712 mutex_lock(&conn->chan_lock);
713
714 list_for_each_entry(chan, &conn->chan_l, list) {
715 l2cap_chan_lock(chan);
716 bacpy(&chan->dst, &hcon->dst);
717 chan->dst_type = bdaddr_dst_type(hcon);
718 l2cap_chan_unlock(chan);
719 }
720
721 mutex_unlock(&conn->chan_lock);
722 }
723
724 static void l2cap_chan_le_connect_reject(struct l2cap_chan *chan)
725 {
726 struct l2cap_conn *conn = chan->conn;
727 struct l2cap_le_conn_rsp rsp;
728 u16 result;
729
730 if (test_bit(FLAG_DEFER_SETUP, &chan->flags))
731 result = L2CAP_CR_LE_AUTHORIZATION;
732 else
733 result = L2CAP_CR_LE_BAD_PSM;
734
735 l2cap_state_change(chan, BT_DISCONN);
736
737 rsp.dcid = cpu_to_le16(chan->scid);
738 rsp.mtu = cpu_to_le16(chan->imtu);
739 rsp.mps = cpu_to_le16(chan->mps);
740 rsp.credits = cpu_to_le16(chan->rx_credits);
741 rsp.result = cpu_to_le16(result);
742
743 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp),
744 &rsp);
745 }
746
747 static void l2cap_chan_ecred_connect_reject(struct l2cap_chan *chan)
748 {
749 struct l2cap_conn *conn = chan->conn;
750 struct l2cap_ecred_conn_rsp rsp;
751 u16 result;
752
753 if (test_bit(FLAG_DEFER_SETUP, &chan->flags))
754 result = L2CAP_CR_LE_AUTHORIZATION;
755 else
756 result = L2CAP_CR_LE_BAD_PSM;
757
758 l2cap_state_change(chan, BT_DISCONN);
759
760 memset(&rsp, 0, sizeof(rsp));
761
762 rsp.result = cpu_to_le16(result);
763
764 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp),
765 &rsp);
766 }
767
768 static void l2cap_chan_connect_reject(struct l2cap_chan *chan)
769 {
770 struct l2cap_conn *conn = chan->conn;
771 struct l2cap_conn_rsp rsp;
772 u16 result;
773
774 if (test_bit(FLAG_DEFER_SETUP, &chan->flags))
775 result = L2CAP_CR_SEC_BLOCK;
776 else
777 result = L2CAP_CR_BAD_PSM;
778
779 l2cap_state_change(chan, BT_DISCONN);
780
781 rsp.scid = cpu_to_le16(chan->dcid);
782 rsp.dcid = cpu_to_le16(chan->scid);
783 rsp.result = cpu_to_le16(result);
784 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
785
786 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP, sizeof(rsp), &rsp);
787 }
788
789 void l2cap_chan_close(struct l2cap_chan *chan, int reason)
790 {
791 struct l2cap_conn *conn = chan->conn;
792
793 BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
794
795 switch (chan->state) {
796 case BT_LISTEN:
797 chan->ops->teardown(chan, 0);
798 break;
799
800 case BT_CONNECTED:
801 case BT_CONFIG:
802 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED) {
803 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
804 l2cap_send_disconn_req(chan, reason);
805 } else
806 l2cap_chan_del(chan, reason);
807 break;
808
809 case BT_CONNECT2:
810 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED) {
811 if (conn->hcon->type == ACL_LINK)
812 l2cap_chan_connect_reject(chan);
813 else if (conn->hcon->type == LE_LINK) {
814 switch (chan->mode) {
815 case L2CAP_MODE_LE_FLOWCTL:
816 l2cap_chan_le_connect_reject(chan);
817 break;
818 case L2CAP_MODE_EXT_FLOWCTL:
819 l2cap_chan_ecred_connect_reject(chan);
820 break;
821 }
822 }
823 }
824
825 l2cap_chan_del(chan, reason);
826 break;
827
828 case BT_CONNECT:
829 case BT_DISCONN:
830 l2cap_chan_del(chan, reason);
831 break;
832
833 default:
834 chan->ops->teardown(chan, 0);
835 break;
836 }
837 }
838 EXPORT_SYMBOL(l2cap_chan_close);
839
840 static inline u8 l2cap_get_auth_type(struct l2cap_chan *chan)
841 {
842 switch (chan->chan_type) {
843 case L2CAP_CHAN_RAW:
844 switch (chan->sec_level) {
845 case BT_SECURITY_HIGH:
846 case BT_SECURITY_FIPS:
847 return HCI_AT_DEDICATED_BONDING_MITM;
848 case BT_SECURITY_MEDIUM:
849 return HCI_AT_DEDICATED_BONDING;
850 default:
851 return HCI_AT_NO_BONDING;
852 }
853 break;
854 case L2CAP_CHAN_CONN_LESS:
855 if (chan->psm == cpu_to_le16(L2CAP_PSM_3DSP)) {
856 if (chan->sec_level == BT_SECURITY_LOW)
857 chan->sec_level = BT_SECURITY_SDP;
858 }
859 if (chan->sec_level == BT_SECURITY_HIGH ||
860 chan->sec_level == BT_SECURITY_FIPS)
861 return HCI_AT_NO_BONDING_MITM;
862 else
863 return HCI_AT_NO_BONDING;
864 break;
865 case L2CAP_CHAN_CONN_ORIENTED:
866 if (chan->psm == cpu_to_le16(L2CAP_PSM_SDP)) {
867 if (chan->sec_level == BT_SECURITY_LOW)
868 chan->sec_level = BT_SECURITY_SDP;
869
870 if (chan->sec_level == BT_SECURITY_HIGH ||
871 chan->sec_level == BT_SECURITY_FIPS)
872 return HCI_AT_NO_BONDING_MITM;
873 else
874 return HCI_AT_NO_BONDING;
875 }
876 fallthrough;
877
878 default:
879 switch (chan->sec_level) {
880 case BT_SECURITY_HIGH:
881 case BT_SECURITY_FIPS:
882 return HCI_AT_GENERAL_BONDING_MITM;
883 case BT_SECURITY_MEDIUM:
884 return HCI_AT_GENERAL_BONDING;
885 default:
886 return HCI_AT_NO_BONDING;
887 }
888 break;
889 }
890 }
891
892 /* Service level security */
893 int l2cap_chan_check_security(struct l2cap_chan *chan, bool initiator)
894 {
895 struct l2cap_conn *conn = chan->conn;
896 __u8 auth_type;
897
898 if (conn->hcon->type == LE_LINK)
899 return smp_conn_security(conn->hcon, chan->sec_level);
900
901 auth_type = l2cap_get_auth_type(chan);
902
903 return hci_conn_security(conn->hcon, chan->sec_level, auth_type,
904 initiator);
905 }
906
907 static u8 l2cap_get_ident(struct l2cap_conn *conn)
908 {
909 u8 id;
910
911 /* Get next available identificator.
912 * 1 - 128 are used by kernel.
913 * 129 - 199 are reserved.
914 * 200 - 254 are used by utilities like l2ping, etc.
915 */
916
917 mutex_lock(&conn->ident_lock);
918
919 if (++conn->tx_ident > 128)
920 conn->tx_ident = 1;
921
922 id = conn->tx_ident;
923
924 mutex_unlock(&conn->ident_lock);
925
926 return id;
927 }
928
929 static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
930 void *data)
931 {
932 struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data);
933 u8 flags;
934
935 BT_DBG("code 0x%2.2x", code);
936
937 if (!skb)
938 return;
939
940 /* Use NO_FLUSH if supported or we have an LE link (which does
941 * not support auto-flushing packets) */
942 if (lmp_no_flush_capable(conn->hcon->hdev) ||
943 conn->hcon->type == LE_LINK)
944 flags = ACL_START_NO_FLUSH;
945 else
946 flags = ACL_START;
947
948 bt_cb(skb)->force_active = BT_POWER_FORCE_ACTIVE_ON;
949 skb->priority = HCI_PRIO_MAX;
950
951 hci_send_acl(conn->hchan, skb, flags);
952 }
953
954 static bool __chan_is_moving(struct l2cap_chan *chan)
955 {
956 return chan->move_state != L2CAP_MOVE_STABLE &&
957 chan->move_state != L2CAP_MOVE_WAIT_PREPARE;
958 }
959
960 static void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb)
961 {
962 struct hci_conn *hcon = chan->conn->hcon;
963 u16 flags;
964
965 BT_DBG("chan %p, skb %p len %d priority %u", chan, skb, skb->len,
966 skb->priority);
967
968 if (chan->hs_hcon && !__chan_is_moving(chan)) {
969 if (chan->hs_hchan)
970 hci_send_acl(chan->hs_hchan, skb, ACL_COMPLETE);
971 else
972 kfree_skb(skb);
973
974 return;
975 }
976
977 /* Use NO_FLUSH for LE links (where this is the only option) or
978 * if the BR/EDR link supports it and flushing has not been
979 * explicitly requested (through FLAG_FLUSHABLE).
980 */
981 if (hcon->type == LE_LINK ||
982 (!test_bit(FLAG_FLUSHABLE, &chan->flags) &&
983 lmp_no_flush_capable(hcon->hdev)))
984 flags = ACL_START_NO_FLUSH;
985 else
986 flags = ACL_START;
987
988 bt_cb(skb)->force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
989 hci_send_acl(chan->conn->hchan, skb, flags);
990 }
991
992 static void __unpack_enhanced_control(u16 enh, struct l2cap_ctrl *control)
993 {
994 control->reqseq = (enh & L2CAP_CTRL_REQSEQ) >> L2CAP_CTRL_REQSEQ_SHIFT;
995 control->final = (enh & L2CAP_CTRL_FINAL) >> L2CAP_CTRL_FINAL_SHIFT;
996
997 if (enh & L2CAP_CTRL_FRAME_TYPE) {
998 /* S-Frame */
999 control->sframe = 1;
1000 control->poll = (enh & L2CAP_CTRL_POLL) >> L2CAP_CTRL_POLL_SHIFT;
1001 control->super = (enh & L2CAP_CTRL_SUPERVISE) >> L2CAP_CTRL_SUPER_SHIFT;
1002
1003 control->sar = 0;
1004 control->txseq = 0;
1005 } else {
1006 /* I-Frame */
1007 control->sframe = 0;
1008 control->sar = (enh & L2CAP_CTRL_SAR) >> L2CAP_CTRL_SAR_SHIFT;
1009 control->txseq = (enh & L2CAP_CTRL_TXSEQ) >> L2CAP_CTRL_TXSEQ_SHIFT;
1010
1011 control->poll = 0;
1012 control->super = 0;
1013 }
1014 }
1015
1016 static void __unpack_extended_control(u32 ext, struct l2cap_ctrl *control)
1017 {
1018 control->reqseq = (ext & L2CAP_EXT_CTRL_REQSEQ) >> L2CAP_EXT_CTRL_REQSEQ_SHIFT;
1019 control->final = (ext & L2CAP_EXT_CTRL_FINAL) >> L2CAP_EXT_CTRL_FINAL_SHIFT;
1020
1021 if (ext & L2CAP_EXT_CTRL_FRAME_TYPE) {
1022 /* S-Frame */
1023 control->sframe = 1;
1024 control->poll = (ext & L2CAP_EXT_CTRL_POLL) >> L2CAP_EXT_CTRL_POLL_SHIFT;
1025 control->super = (ext & L2CAP_EXT_CTRL_SUPERVISE) >> L2CAP_EXT_CTRL_SUPER_SHIFT;
1026
1027 control->sar = 0;
1028 control->txseq = 0;
1029 } else {
1030 /* I-Frame */
1031 control->sframe = 0;
1032 control->sar = (ext & L2CAP_EXT_CTRL_SAR) >> L2CAP_EXT_CTRL_SAR_SHIFT;
1033 control->txseq = (ext & L2CAP_EXT_CTRL_TXSEQ) >> L2CAP_EXT_CTRL_TXSEQ_SHIFT;
1034
1035 control->poll = 0;
1036 control->super = 0;
1037 }
1038 }
1039
1040 static inline void __unpack_control(struct l2cap_chan *chan,
1041 struct sk_buff *skb)
1042 {
1043 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
1044 __unpack_extended_control(get_unaligned_le32(skb->data),
1045 &bt_cb(skb)->l2cap);
1046 skb_pull(skb, L2CAP_EXT_CTRL_SIZE);
1047 } else {
1048 __unpack_enhanced_control(get_unaligned_le16(skb->data),
1049 &bt_cb(skb)->l2cap);
1050 skb_pull(skb, L2CAP_ENH_CTRL_SIZE);
1051 }
1052 }
1053
1054 static u32 __pack_extended_control(struct l2cap_ctrl *control)
1055 {
1056 u32 packed;
1057
1058 packed = control->reqseq << L2CAP_EXT_CTRL_REQSEQ_SHIFT;
1059 packed |= control->final << L2CAP_EXT_CTRL_FINAL_SHIFT;
1060
1061 if (control->sframe) {
1062 packed |= control->poll << L2CAP_EXT_CTRL_POLL_SHIFT;
1063 packed |= control->super << L2CAP_EXT_CTRL_SUPER_SHIFT;
1064 packed |= L2CAP_EXT_CTRL_FRAME_TYPE;
1065 } else {
1066 packed |= control->sar << L2CAP_EXT_CTRL_SAR_SHIFT;
1067 packed |= control->txseq << L2CAP_EXT_CTRL_TXSEQ_SHIFT;
1068 }
1069
1070 return packed;
1071 }
1072
1073 static u16 __pack_enhanced_control(struct l2cap_ctrl *control)
1074 {
1075 u16 packed;
1076
1077 packed = control->reqseq << L2CAP_CTRL_REQSEQ_SHIFT;
1078 packed |= control->final << L2CAP_CTRL_FINAL_SHIFT;
1079
1080 if (control->sframe) {
1081 packed |= control->poll << L2CAP_CTRL_POLL_SHIFT;
1082 packed |= control->super << L2CAP_CTRL_SUPER_SHIFT;
1083 packed |= L2CAP_CTRL_FRAME_TYPE;
1084 } else {
1085 packed |= control->sar << L2CAP_CTRL_SAR_SHIFT;
1086 packed |= control->txseq << L2CAP_CTRL_TXSEQ_SHIFT;
1087 }
1088
1089 return packed;
1090 }
1091
1092 static inline void __pack_control(struct l2cap_chan *chan,
1093 struct l2cap_ctrl *control,
1094 struct sk_buff *skb)
1095 {
1096 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
1097 put_unaligned_le32(__pack_extended_control(control),
1098 skb->data + L2CAP_HDR_SIZE);
1099 } else {
1100 put_unaligned_le16(__pack_enhanced_control(control),
1101 skb->data + L2CAP_HDR_SIZE);
1102 }
1103 }
1104
1105 static inline unsigned int __ertm_hdr_size(struct l2cap_chan *chan)
1106 {
1107 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
1108 return L2CAP_EXT_HDR_SIZE;
1109 else
1110 return L2CAP_ENH_HDR_SIZE;
1111 }
1112
1113 static struct sk_buff *l2cap_create_sframe_pdu(struct l2cap_chan *chan,
1114 u32 control)
1115 {
1116 struct sk_buff *skb;
1117 struct l2cap_hdr *lh;
1118 int hlen = __ertm_hdr_size(chan);
1119
1120 if (chan->fcs == L2CAP_FCS_CRC16)
1121 hlen += L2CAP_FCS_SIZE;
1122
1123 skb = bt_skb_alloc(hlen, GFP_KERNEL);
1124
1125 if (!skb)
1126 return ERR_PTR(-ENOMEM);
1127
1128 lh = skb_put(skb, L2CAP_HDR_SIZE);
1129 lh->len = cpu_to_le16(hlen - L2CAP_HDR_SIZE);
1130 lh->cid = cpu_to_le16(chan->dcid);
1131
1132 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
1133 put_unaligned_le32(control, skb_put(skb, L2CAP_EXT_CTRL_SIZE));
1134 else
1135 put_unaligned_le16(control, skb_put(skb, L2CAP_ENH_CTRL_SIZE));
1136
1137 if (chan->fcs == L2CAP_FCS_CRC16) {
1138 u16 fcs = crc16(0, (u8 *)skb->data, skb->len);
1139 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
1140 }
1141
1142 skb->priority = HCI_PRIO_MAX;
1143 return skb;
1144 }
1145
1146 static void l2cap_send_sframe(struct l2cap_chan *chan,
1147 struct l2cap_ctrl *control)
1148 {
1149 struct sk_buff *skb;
1150 u32 control_field;
1151
1152 BT_DBG("chan %p, control %p", chan, control);
1153
1154 if (!control->sframe)
1155 return;
1156
1157 if (__chan_is_moving(chan))
1158 return;
1159
1160 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state) &&
1161 !control->poll)
1162 control->final = 1;
1163
1164 if (control->super == L2CAP_SUPER_RR)
1165 clear_bit(CONN_RNR_SENT, &chan->conn_state);
1166 else if (control->super == L2CAP_SUPER_RNR)
1167 set_bit(CONN_RNR_SENT, &chan->conn_state);
1168
1169 if (control->super != L2CAP_SUPER_SREJ) {
1170 chan->last_acked_seq = control->reqseq;
1171 __clear_ack_timer(chan);
1172 }
1173
1174 BT_DBG("reqseq %d, final %d, poll %d, super %d", control->reqseq,
1175 control->final, control->poll, control->super);
1176
1177 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
1178 control_field = __pack_extended_control(control);
1179 else
1180 control_field = __pack_enhanced_control(control);
1181
1182 skb = l2cap_create_sframe_pdu(chan, control_field);
1183 if (!IS_ERR(skb))
1184 l2cap_do_send(chan, skb);
1185 }
1186
1187 static void l2cap_send_rr_or_rnr(struct l2cap_chan *chan, bool poll)
1188 {
1189 struct l2cap_ctrl control;
1190
1191 BT_DBG("chan %p, poll %d", chan, poll);
1192
1193 memset(&control, 0, sizeof(control));
1194 control.sframe = 1;
1195 control.poll = poll;
1196
1197 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state))
1198 control.super = L2CAP_SUPER_RNR;
1199 else
1200 control.super = L2CAP_SUPER_RR;
1201
1202 control.reqseq = chan->buffer_seq;
1203 l2cap_send_sframe(chan, &control);
1204 }
1205
1206 static inline int __l2cap_no_conn_pending(struct l2cap_chan *chan)
1207 {
1208 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED)
1209 return true;
1210
1211 return !test_bit(CONF_CONNECT_PEND, &chan->conf_state);
1212 }
1213
1214 static bool __amp_capable(struct l2cap_chan *chan)
1215 {
1216 struct l2cap_conn *conn = chan->conn;
1217 struct hci_dev *hdev;
1218 bool amp_available = false;
1219
1220 if (!(conn->local_fixed_chan & L2CAP_FC_A2MP))
1221 return false;
1222
1223 if (!(conn->remote_fixed_chan & L2CAP_FC_A2MP))
1224 return false;
1225
1226 read_lock(&hci_dev_list_lock);
1227 list_for_each_entry(hdev, &hci_dev_list, list) {
1228 if (hdev->amp_type != AMP_TYPE_BREDR &&
1229 test_bit(HCI_UP, &hdev->flags)) {
1230 amp_available = true;
1231 break;
1232 }
1233 }
1234 read_unlock(&hci_dev_list_lock);
1235
1236 if (chan->chan_policy == BT_CHANNEL_POLICY_AMP_PREFERRED)
1237 return amp_available;
1238
1239 return false;
1240 }
1241
1242 static bool l2cap_check_efs(struct l2cap_chan *chan)
1243 {
1244 /* Check EFS parameters */
1245 return true;
1246 }
1247
1248 void l2cap_send_conn_req(struct l2cap_chan *chan)
1249 {
1250 struct l2cap_conn *conn = chan->conn;
1251 struct l2cap_conn_req req;
1252
1253 req.scid = cpu_to_le16(chan->scid);
1254 req.psm = chan->psm;
1255
1256 chan->ident = l2cap_get_ident(conn);
1257
1258 set_bit(CONF_CONNECT_PEND, &chan->conf_state);
1259
1260 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ, sizeof(req), &req);
1261 }
1262
1263 static void l2cap_send_create_chan_req(struct l2cap_chan *chan, u8 amp_id)
1264 {
1265 struct l2cap_create_chan_req req;
1266 req.scid = cpu_to_le16(chan->scid);
1267 req.psm = chan->psm;
1268 req.amp_id = amp_id;
1269
1270 chan->ident = l2cap_get_ident(chan->conn);
1271
1272 l2cap_send_cmd(chan->conn, chan->ident, L2CAP_CREATE_CHAN_REQ,
1273 sizeof(req), &req);
1274 }
1275
1276 static void l2cap_move_setup(struct l2cap_chan *chan)
1277 {
1278 struct sk_buff *skb;
1279
1280 BT_DBG("chan %p", chan);
1281
1282 if (chan->mode != L2CAP_MODE_ERTM)
1283 return;
1284
1285 __clear_retrans_timer(chan);
1286 __clear_monitor_timer(chan);
1287 __clear_ack_timer(chan);
1288
1289 chan->retry_count = 0;
1290 skb_queue_walk(&chan->tx_q, skb) {
1291 if (bt_cb(skb)->l2cap.retries)
1292 bt_cb(skb)->l2cap.retries = 1;
1293 else
1294 break;
1295 }
1296
1297 chan->expected_tx_seq = chan->buffer_seq;
1298
1299 clear_bit(CONN_REJ_ACT, &chan->conn_state);
1300 clear_bit(CONN_SREJ_ACT, &chan->conn_state);
1301 l2cap_seq_list_clear(&chan->retrans_list);
1302 l2cap_seq_list_clear(&chan->srej_list);
1303 skb_queue_purge(&chan->srej_q);
1304
1305 chan->tx_state = L2CAP_TX_STATE_XMIT;
1306 chan->rx_state = L2CAP_RX_STATE_MOVE;
1307
1308 set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
1309 }
1310
1311 static void l2cap_move_done(struct l2cap_chan *chan)
1312 {
1313 u8 move_role = chan->move_role;
1314 BT_DBG("chan %p", chan);
1315
1316 chan->move_state = L2CAP_MOVE_STABLE;
1317 chan->move_role = L2CAP_MOVE_ROLE_NONE;
1318
1319 if (chan->mode != L2CAP_MODE_ERTM)
1320 return;
1321
1322 switch (move_role) {
1323 case L2CAP_MOVE_ROLE_INITIATOR:
1324 l2cap_tx(chan, NULL, NULL, L2CAP_EV_EXPLICIT_POLL);
1325 chan->rx_state = L2CAP_RX_STATE_WAIT_F;
1326 break;
1327 case L2CAP_MOVE_ROLE_RESPONDER:
1328 chan->rx_state = L2CAP_RX_STATE_WAIT_P;
1329 break;
1330 }
1331 }
1332
1333 static void l2cap_chan_ready(struct l2cap_chan *chan)
1334 {
1335 /* The channel may have already been flagged as connected in
1336 * case of receiving data before the L2CAP info req/rsp
1337 * procedure is complete.
1338 */
1339 if (chan->state == BT_CONNECTED)
1340 return;
1341
1342 /* This clears all conf flags, including CONF_NOT_COMPLETE */
1343 chan->conf_state = 0;
1344 __clear_chan_timer(chan);
1345
1346 switch (chan->mode) {
1347 case L2CAP_MODE_LE_FLOWCTL:
1348 case L2CAP_MODE_EXT_FLOWCTL:
1349 if (!chan->tx_credits)
1350 chan->ops->suspend(chan);
1351 break;
1352 }
1353
1354 chan->state = BT_CONNECTED;
1355
1356 chan->ops->ready(chan);
1357 }
1358
1359 static void l2cap_le_connect(struct l2cap_chan *chan)
1360 {
1361 struct l2cap_conn *conn = chan->conn;
1362 struct l2cap_le_conn_req req;
1363
1364 if (test_and_set_bit(FLAG_LE_CONN_REQ_SENT, &chan->flags))
1365 return;
1366
1367 if (!chan->imtu)
1368 chan->imtu = chan->conn->mtu;
1369
1370 l2cap_le_flowctl_init(chan, 0);
1371
1372 req.psm = chan->psm;
1373 req.scid = cpu_to_le16(chan->scid);
1374 req.mtu = cpu_to_le16(chan->imtu);
1375 req.mps = cpu_to_le16(chan->mps);
1376 req.credits = cpu_to_le16(chan->rx_credits);
1377
1378 chan->ident = l2cap_get_ident(conn);
1379
1380 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_REQ,
1381 sizeof(req), &req);
1382 }
1383
1384 struct l2cap_ecred_conn_data {
1385 struct {
1386 struct l2cap_ecred_conn_req req;
1387 __le16 scid[5];
1388 } __packed pdu;
1389 struct l2cap_chan *chan;
1390 struct pid *pid;
1391 int count;
1392 };
1393
1394 static void l2cap_ecred_defer_connect(struct l2cap_chan *chan, void *data)
1395 {
1396 struct l2cap_ecred_conn_data *conn = data;
1397 struct pid *pid;
1398
1399 if (chan == conn->chan)
1400 return;
1401
1402 if (!test_and_clear_bit(FLAG_DEFER_SETUP, &chan->flags))
1403 return;
1404
1405 pid = chan->ops->get_peer_pid(chan);
1406
1407 /* Only add deferred channels with the same PID/PSM */
1408 if (conn->pid != pid || chan->psm != conn->chan->psm || chan->ident ||
1409 chan->mode != L2CAP_MODE_EXT_FLOWCTL || chan->state != BT_CONNECT)
1410 return;
1411
1412 if (test_and_set_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags))
1413 return;
1414
1415 l2cap_ecred_init(chan, 0);
1416
1417 /* Set the same ident so we can match on the rsp */
1418 chan->ident = conn->chan->ident;
1419
1420 /* Include all channels deferred */
1421 conn->pdu.scid[conn->count] = cpu_to_le16(chan->scid);
1422
1423 conn->count++;
1424 }
1425
1426 static void l2cap_ecred_connect(struct l2cap_chan *chan)
1427 {
1428 struct l2cap_conn *conn = chan->conn;
1429 struct l2cap_ecred_conn_data data;
1430
1431 if (test_bit(FLAG_DEFER_SETUP, &chan->flags))
1432 return;
1433
1434 if (test_and_set_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags))
1435 return;
1436
1437 l2cap_ecred_init(chan, 0);
1438
1439 data.pdu.req.psm = chan->psm;
1440 data.pdu.req.mtu = cpu_to_le16(chan->imtu);
1441 data.pdu.req.mps = cpu_to_le16(chan->mps);
1442 data.pdu.req.credits = cpu_to_le16(chan->rx_credits);
1443 data.pdu.scid[0] = cpu_to_le16(chan->scid);
1444
1445 chan->ident = l2cap_get_ident(conn);
1446 data.pid = chan->ops->get_peer_pid(chan);
1447
1448 data.count = 1;
1449 data.chan = chan;
1450 data.pid = chan->ops->get_peer_pid(chan);
1451
1452 __l2cap_chan_list(conn, l2cap_ecred_defer_connect, &data);
1453
1454 l2cap_send_cmd(conn, chan->ident, L2CAP_ECRED_CONN_REQ,
1455 sizeof(data.pdu.req) + data.count * sizeof(__le16),
1456 &data.pdu);
1457 }
1458
1459 static void l2cap_le_start(struct l2cap_chan *chan)
1460 {
1461 struct l2cap_conn *conn = chan->conn;
1462
1463 if (!smp_conn_security(conn->hcon, chan->sec_level))
1464 return;
1465
1466 if (!chan->psm) {
1467 l2cap_chan_ready(chan);
1468 return;
1469 }
1470
1471 if (chan->state == BT_CONNECT) {
1472 if (chan->mode == L2CAP_MODE_EXT_FLOWCTL)
1473 l2cap_ecred_connect(chan);
1474 else
1475 l2cap_le_connect(chan);
1476 }
1477 }
1478
1479 static void l2cap_start_connection(struct l2cap_chan *chan)
1480 {
1481 if (__amp_capable(chan)) {
1482 BT_DBG("chan %p AMP capable: discover AMPs", chan);
1483 a2mp_discover_amp(chan);
1484 } else if (chan->conn->hcon->type == LE_LINK) {
1485 l2cap_le_start(chan);
1486 } else {
1487 l2cap_send_conn_req(chan);
1488 }
1489 }
1490
1491 static void l2cap_request_info(struct l2cap_conn *conn)
1492 {
1493 struct l2cap_info_req req;
1494
1495 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
1496 return;
1497
1498 req.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
1499
1500 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
1501 conn->info_ident = l2cap_get_ident(conn);
1502
1503 schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
1504
1505 l2cap_send_cmd(conn, conn->info_ident, L2CAP_INFO_REQ,
1506 sizeof(req), &req);
1507 }
1508
1509 static bool l2cap_check_enc_key_size(struct hci_conn *hcon)
1510 {
1511 /* The minimum encryption key size needs to be enforced by the
1512 * host stack before establishing any L2CAP connections. The
1513 * specification in theory allows a minimum of 1, but to align
1514 * BR/EDR and LE transports, a minimum of 7 is chosen.
1515 *
1516 * This check might also be called for unencrypted connections
1517 * that have no key size requirements. Ensure that the link is
1518 * actually encrypted before enforcing a key size.
1519 */
1520 int min_key_size = hcon->hdev->min_enc_key_size;
1521
1522 /* On FIPS security level, key size must be 16 bytes */
1523 if (hcon->sec_level == BT_SECURITY_FIPS)
1524 min_key_size = 16;
1525
1526 return (!test_bit(HCI_CONN_ENCRYPT, &hcon->flags) ||
1527 hcon->enc_key_size >= min_key_size);
1528 }
1529
1530 static void l2cap_do_start(struct l2cap_chan *chan)
1531 {
1532 struct l2cap_conn *conn = chan->conn;
1533
1534 if (conn->hcon->type == LE_LINK) {
1535 l2cap_le_start(chan);
1536 return;
1537 }
1538
1539 if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)) {
1540 l2cap_request_info(conn);
1541 return;
1542 }
1543
1544 if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE))
1545 return;
1546
1547 if (!l2cap_chan_check_security(chan, true) ||
1548 !__l2cap_no_conn_pending(chan))
1549 return;
1550
1551 if (l2cap_check_enc_key_size(conn->hcon))
1552 l2cap_start_connection(chan);
1553 else
1554 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
1555 }
1556
1557 static inline int l2cap_mode_supported(__u8 mode, __u32 feat_mask)
1558 {
1559 u32 local_feat_mask = l2cap_feat_mask;
1560 if (!disable_ertm)
1561 local_feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING;
1562
1563 switch (mode) {
1564 case L2CAP_MODE_ERTM:
1565 return L2CAP_FEAT_ERTM & feat_mask & local_feat_mask;
1566 case L2CAP_MODE_STREAMING:
1567 return L2CAP_FEAT_STREAMING & feat_mask & local_feat_mask;
1568 default:
1569 return 0x00;
1570 }
1571 }
1572
1573 static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err)
1574 {
1575 struct l2cap_conn *conn = chan->conn;
1576 struct l2cap_disconn_req req;
1577
1578 if (!conn)
1579 return;
1580
1581 if (chan->mode == L2CAP_MODE_ERTM && chan->state == BT_CONNECTED) {
1582 __clear_retrans_timer(chan);
1583 __clear_monitor_timer(chan);
1584 __clear_ack_timer(chan);
1585 }
1586
1587 if (chan->scid == L2CAP_CID_A2MP) {
1588 l2cap_state_change(chan, BT_DISCONN);
1589 return;
1590 }
1591
1592 req.dcid = cpu_to_le16(chan->dcid);
1593 req.scid = cpu_to_le16(chan->scid);
1594 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_DISCONN_REQ,
1595 sizeof(req), &req);
1596
1597 l2cap_state_change_and_error(chan, BT_DISCONN, err);
1598 }
1599
1600 /* ---- L2CAP connections ---- */
1601 static void l2cap_conn_start(struct l2cap_conn *conn)
1602 {
1603 struct l2cap_chan *chan, *tmp;
1604
1605 BT_DBG("conn %p", conn);
1606
1607 mutex_lock(&conn->chan_lock);
1608
1609 list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
1610 l2cap_chan_lock(chan);
1611
1612 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
1613 l2cap_chan_ready(chan);
1614 l2cap_chan_unlock(chan);
1615 continue;
1616 }
1617
1618 if (chan->state == BT_CONNECT) {
1619 if (!l2cap_chan_check_security(chan, true) ||
1620 !__l2cap_no_conn_pending(chan)) {
1621 l2cap_chan_unlock(chan);
1622 continue;
1623 }
1624
1625 if (!l2cap_mode_supported(chan->mode, conn->feat_mask)
1626 && test_bit(CONF_STATE2_DEVICE,
1627 &chan->conf_state)) {
1628 l2cap_chan_close(chan, ECONNRESET);
1629 l2cap_chan_unlock(chan);
1630 continue;
1631 }
1632
1633 if (l2cap_check_enc_key_size(conn->hcon))
1634 l2cap_start_connection(chan);
1635 else
1636 l2cap_chan_close(chan, ECONNREFUSED);
1637
1638 } else if (chan->state == BT_CONNECT2) {
1639 struct l2cap_conn_rsp rsp;
1640 char buf[128];
1641 rsp.scid = cpu_to_le16(chan->dcid);
1642 rsp.dcid = cpu_to_le16(chan->scid);
1643
1644 if (l2cap_chan_check_security(chan, false)) {
1645 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
1646 rsp.result = cpu_to_le16(L2CAP_CR_PEND);
1647 rsp.status = cpu_to_le16(L2CAP_CS_AUTHOR_PEND);
1648 chan->ops->defer(chan);
1649
1650 } else {
1651 l2cap_state_change(chan, BT_CONFIG);
1652 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
1653 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
1654 }
1655 } else {
1656 rsp.result = cpu_to_le16(L2CAP_CR_PEND);
1657 rsp.status = cpu_to_le16(L2CAP_CS_AUTHEN_PEND);
1658 }
1659
1660 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
1661 sizeof(rsp), &rsp);
1662
1663 if (test_bit(CONF_REQ_SENT, &chan->conf_state) ||
1664 rsp.result != L2CAP_CR_SUCCESS) {
1665 l2cap_chan_unlock(chan);
1666 continue;
1667 }
1668
1669 set_bit(CONF_REQ_SENT, &chan->conf_state);
1670 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
1671 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
1672 chan->num_conf_req++;
1673 }
1674
1675 l2cap_chan_unlock(chan);
1676 }
1677
1678 mutex_unlock(&conn->chan_lock);
1679 }
1680
1681 static void l2cap_le_conn_ready(struct l2cap_conn *conn)
1682 {
1683 struct hci_conn *hcon = conn->hcon;
1684 struct hci_dev *hdev = hcon->hdev;
1685
1686 BT_DBG("%s conn %p", hdev->name, conn);
1687
1688 /* For outgoing pairing which doesn't necessarily have an
1689 * associated socket (e.g. mgmt_pair_device).
1690 */
1691 if (hcon->out)
1692 smp_conn_security(hcon, hcon->pending_sec_level);
1693
1694 /* For LE peripheral connections, make sure the connection interval
1695 * is in the range of the minimum and maximum interval that has
1696 * been configured for this connection. If not, then trigger
1697 * the connection update procedure.
1698 */
1699 if (hcon->role == HCI_ROLE_SLAVE &&
1700 (hcon->le_conn_interval < hcon->le_conn_min_interval ||
1701 hcon->le_conn_interval > hcon->le_conn_max_interval)) {
1702 struct l2cap_conn_param_update_req req;
1703
1704 req.min = cpu_to_le16(hcon->le_conn_min_interval);
1705 req.max = cpu_to_le16(hcon->le_conn_max_interval);
1706 req.latency = cpu_to_le16(hcon->le_conn_latency);
1707 req.to_multiplier = cpu_to_le16(hcon->le_supv_timeout);
1708
1709 l2cap_send_cmd(conn, l2cap_get_ident(conn),
1710 L2CAP_CONN_PARAM_UPDATE_REQ, sizeof(req), &req);
1711 }
1712 }
1713
1714 static void l2cap_conn_ready(struct l2cap_conn *conn)
1715 {
1716 struct l2cap_chan *chan;
1717 struct hci_conn *hcon = conn->hcon;
1718
1719 BT_DBG("conn %p", conn);
1720
1721 if (hcon->type == ACL_LINK)
1722 l2cap_request_info(conn);
1723
1724 mutex_lock(&conn->chan_lock);
1725
1726 list_for_each_entry(chan, &conn->chan_l, list) {
1727
1728 l2cap_chan_lock(chan);
1729
1730 if (chan->scid == L2CAP_CID_A2MP) {
1731 l2cap_chan_unlock(chan);
1732 continue;
1733 }
1734
1735 if (hcon->type == LE_LINK) {
1736 l2cap_le_start(chan);
1737 } else if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
1738 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)
1739 l2cap_chan_ready(chan);
1740 } else if (chan->state == BT_CONNECT) {
1741 l2cap_do_start(chan);
1742 }
1743
1744 l2cap_chan_unlock(chan);
1745 }
1746
1747 mutex_unlock(&conn->chan_lock);
1748
1749 if (hcon->type == LE_LINK)
1750 l2cap_le_conn_ready(conn);
1751
1752 queue_work(hcon->hdev->workqueue, &conn->pending_rx_work);
1753 }
1754
1755 /* Notify sockets that we cannot guaranty reliability anymore */
1756 static void l2cap_conn_unreliable(struct l2cap_conn *conn, int err)
1757 {
1758 struct l2cap_chan *chan;
1759
1760 BT_DBG("conn %p", conn);
1761
1762 mutex_lock(&conn->chan_lock);
1763
1764 list_for_each_entry(chan, &conn->chan_l, list) {
1765 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
1766 l2cap_chan_set_err(chan, err);
1767 }
1768
1769 mutex_unlock(&conn->chan_lock);
1770 }
1771
1772 static void l2cap_info_timeout(struct work_struct *work)
1773 {
1774 struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
1775 info_timer.work);
1776
1777 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
1778 conn->info_ident = 0;
1779
1780 l2cap_conn_start(conn);
1781 }
1782
1783 /*
1784 * l2cap_user
1785 * External modules can register l2cap_user objects on l2cap_conn. The ->probe
1786 * callback is called during registration. The ->remove callback is called
1787 * during unregistration.
1788 * An l2cap_user object can either be explicitly unregistered or when the
1789 * underlying l2cap_conn object is deleted. This guarantees that l2cap->hcon,
1790 * l2cap->hchan, .. are valid as long as the remove callback hasn't been called.
1791 * External modules must own a reference to the l2cap_conn object if they intend
1792 * to call l2cap_unregister_user(). The l2cap_conn object might get destroyed at
1793 * any time if they don't.
1794 */
1795
1796 int l2cap_register_user(struct l2cap_conn *conn, struct l2cap_user *user)
1797 {
1798 struct hci_dev *hdev = conn->hcon->hdev;
1799 int ret;
1800
1801 /* We need to check whether l2cap_conn is registered. If it is not, we
1802 * must not register the l2cap_user. l2cap_conn_del() is unregisters
1803 * l2cap_conn objects, but doesn't provide its own locking. Instead, it
1804 * relies on the parent hci_conn object to be locked. This itself relies
1805 * on the hci_dev object to be locked. So we must lock the hci device
1806 * here, too. */
1807
1808 hci_dev_lock(hdev);
1809
1810 if (!list_empty(&user->list)) {
1811 ret = -EINVAL;
1812 goto out_unlock;
1813 }
1814
1815 /* conn->hchan is NULL after l2cap_conn_del() was called */
1816 if (!conn->hchan) {
1817 ret = -ENODEV;
1818 goto out_unlock;
1819 }
1820
1821 ret = user->probe(conn, user);
1822 if (ret)
1823 goto out_unlock;
1824
1825 list_add(&user->list, &conn->users);
1826 ret = 0;
1827
1828 out_unlock:
1829 hci_dev_unlock(hdev);
1830 return ret;
1831 }
1832 EXPORT_SYMBOL(l2cap_register_user);
1833
1834 void l2cap_unregister_user(struct l2cap_conn *conn, struct l2cap_user *user)
1835 {
1836 struct hci_dev *hdev = conn->hcon->hdev;
1837
1838 hci_dev_lock(hdev);
1839
1840 if (list_empty(&user->list))
1841 goto out_unlock;
1842
1843 list_del_init(&user->list);
1844 user->remove(conn, user);
1845
1846 out_unlock:
1847 hci_dev_unlock(hdev);
1848 }
1849 EXPORT_SYMBOL(l2cap_unregister_user);
1850
1851 static void l2cap_unregister_all_users(struct l2cap_conn *conn)
1852 {
1853 struct l2cap_user *user;
1854
1855 while (!list_empty(&conn->users)) {
1856 user = list_first_entry(&conn->users, struct l2cap_user, list);
1857 list_del_init(&user->list);
1858 user->remove(conn, user);
1859 }
1860 }
1861
1862 static void l2cap_conn_del(struct hci_conn *hcon, int err)
1863 {
1864 struct l2cap_conn *conn = hcon->l2cap_data;
1865 struct l2cap_chan *chan, *l;
1866
1867 if (!conn)
1868 return;
1869
1870 BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
1871
1872 kfree_skb(conn->rx_skb);
1873
1874 skb_queue_purge(&conn->pending_rx);
1875
1876 /* We can not call flush_work(&conn->pending_rx_work) here since we
1877 * might block if we are running on a worker from the same workqueue
1878 * pending_rx_work is waiting on.
1879 */
1880 if (work_pending(&conn->pending_rx_work))
1881 cancel_work_sync(&conn->pending_rx_work);
1882
1883 if (work_pending(&conn->id_addr_update_work))
1884 cancel_work_sync(&conn->id_addr_update_work);
1885
1886 l2cap_unregister_all_users(conn);
1887
1888 /* Force the connection to be immediately dropped */
1889 hcon->disc_timeout = 0;
1890
1891 mutex_lock(&conn->chan_lock);
1892
1893 /* Kill channels */
1894 list_for_each_entry_safe(chan, l, &conn->chan_l, list) {
1895 l2cap_chan_hold(chan);
1896 l2cap_chan_lock(chan);
1897
1898 l2cap_chan_del(chan, err);
1899
1900 chan->ops->close(chan);
1901
1902 l2cap_chan_unlock(chan);
1903 l2cap_chan_put(chan);
1904 }
1905
1906 mutex_unlock(&conn->chan_lock);
1907
1908 hci_chan_del(conn->hchan);
1909
1910 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
1911 cancel_delayed_work_sync(&conn->info_timer);
1912
1913 hcon->l2cap_data = NULL;
1914 conn->hchan = NULL;
1915 l2cap_conn_put(conn);
1916 }
1917
1918 static void l2cap_conn_free(struct kref *ref)
1919 {
1920 struct l2cap_conn *conn = container_of(ref, struct l2cap_conn, ref);
1921
1922 hci_conn_put(conn->hcon);
1923 kfree(conn);
1924 }
1925
1926 struct l2cap_conn *l2cap_conn_get(struct l2cap_conn *conn)
1927 {
1928 kref_get(&conn->ref);
1929 return conn;
1930 }
1931 EXPORT_SYMBOL(l2cap_conn_get);
1932
1933 void l2cap_conn_put(struct l2cap_conn *conn)
1934 {
1935 kref_put(&conn->ref, l2cap_conn_free);
1936 }
1937 EXPORT_SYMBOL(l2cap_conn_put);
1938
1939 /* ---- Socket interface ---- */
1940
1941 /* Find socket with psm and source / destination bdaddr.
1942 * Returns closest match.
1943 */
1944 static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm,
1945 bdaddr_t *src,
1946 bdaddr_t *dst,
1947 u8 link_type)
1948 {
1949 struct l2cap_chan *c, *c1 = NULL;
1950
1951 read_lock(&chan_list_lock);
1952
1953 list_for_each_entry(c, &chan_list, global_l) {
1954 if (state && c->state != state)
1955 continue;
1956
1957 if (link_type == ACL_LINK && c->src_type != BDADDR_BREDR)
1958 continue;
1959
1960 if (link_type == LE_LINK && c->src_type == BDADDR_BREDR)
1961 continue;
1962
1963 if (c->psm == psm) {
1964 int src_match, dst_match;
1965 int src_any, dst_any;
1966
1967 /* Exact match. */
1968 src_match = !bacmp(&c->src, src);
1969 dst_match = !bacmp(&c->dst, dst);
1970 if (src_match && dst_match) {
1971 l2cap_chan_hold(c);
1972 read_unlock(&chan_list_lock);
1973 return c;
1974 }
1975
1976 /* Closest match */
1977 src_any = !bacmp(&c->src, BDADDR_ANY);
1978 dst_any = !bacmp(&c->dst, BDADDR_ANY);
1979 if ((src_match && dst_any) || (src_any && dst_match) ||
1980 (src_any && dst_any))
1981 c1 = c;
1982 }
1983 }
1984
1985 if (c1)
1986 l2cap_chan_hold(c1);
1987
1988 read_unlock(&chan_list_lock);
1989
1990 return c1;
1991 }
1992
1993 static void l2cap_monitor_timeout(struct work_struct *work)
1994 {
1995 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
1996 monitor_timer.work);
1997
1998 BT_DBG("chan %p", chan);
1999
2000 l2cap_chan_lock(chan);
2001
2002 if (!chan->conn) {
2003 l2cap_chan_unlock(chan);
2004 l2cap_chan_put(chan);
2005 return;
2006 }
2007
2008 l2cap_tx(chan, NULL, NULL, L2CAP_EV_MONITOR_TO);
2009
2010 l2cap_chan_unlock(chan);
2011 l2cap_chan_put(chan);
2012 }
2013
2014 static void l2cap_retrans_timeout(struct work_struct *work)
2015 {
2016 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
2017 retrans_timer.work);
2018
2019 BT_DBG("chan %p", chan);
2020
2021 l2cap_chan_lock(chan);
2022
2023 if (!chan->conn) {
2024 l2cap_chan_unlock(chan);
2025 l2cap_chan_put(chan);
2026 return;
2027 }
2028
2029 l2cap_tx(chan, NULL, NULL, L2CAP_EV_RETRANS_TO);
2030 l2cap_chan_unlock(chan);
2031 l2cap_chan_put(chan);
2032 }
2033
2034 static void l2cap_streaming_send(struct l2cap_chan *chan,
2035 struct sk_buff_head *skbs)
2036 {
2037 struct sk_buff *skb;
2038 struct l2cap_ctrl *control;
2039
2040 BT_DBG("chan %p, skbs %p", chan, skbs);
2041
2042 if (__chan_is_moving(chan))
2043 return;
2044
2045 skb_queue_splice_tail_init(skbs, &chan->tx_q);
2046
2047 while (!skb_queue_empty(&chan->tx_q)) {
2048
2049 skb = skb_dequeue(&chan->tx_q);
2050
2051 bt_cb(skb)->l2cap.retries = 1;
2052 control = &bt_cb(skb)->l2cap;
2053
2054 control->reqseq = 0;
2055 control->txseq = chan->next_tx_seq;
2056
2057 __pack_control(chan, control, skb);
2058
2059 if (chan->fcs == L2CAP_FCS_CRC16) {
2060 u16 fcs = crc16(0, (u8 *) skb->data, skb->len);
2061 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
2062 }
2063
2064 l2cap_do_send(chan, skb);
2065
2066 BT_DBG("Sent txseq %u", control->txseq);
2067
2068 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
2069 chan->frames_sent++;
2070 }
2071 }
2072
2073 static int l2cap_ertm_send(struct l2cap_chan *chan)
2074 {
2075 struct sk_buff *skb, *tx_skb;
2076 struct l2cap_ctrl *control;
2077 int sent = 0;
2078
2079 BT_DBG("chan %p", chan);
2080
2081 if (chan->state != BT_CONNECTED)
2082 return -ENOTCONN;
2083
2084 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
2085 return 0;
2086
2087 if (__chan_is_moving(chan))
2088 return 0;
2089
2090 while (chan->tx_send_head &&
2091 chan->unacked_frames < chan->remote_tx_win &&
2092 chan->tx_state == L2CAP_TX_STATE_XMIT) {
2093
2094 skb = chan->tx_send_head;
2095
2096 bt_cb(skb)->l2cap.retries = 1;
2097 control = &bt_cb(skb)->l2cap;
2098
2099 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
2100 control->final = 1;
2101
2102 control->reqseq = chan->buffer_seq;
2103 chan->last_acked_seq = chan->buffer_seq;
2104 control->txseq = chan->next_tx_seq;
2105
2106 __pack_control(chan, control, skb);
2107
2108 if (chan->fcs == L2CAP_FCS_CRC16) {
2109 u16 fcs = crc16(0, (u8 *) skb->data, skb->len);
2110 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
2111 }
2112
2113 /* Clone after data has been modified. Data is assumed to be
2114 read-only (for locking purposes) on cloned sk_buffs.
2115 */
2116 tx_skb = skb_clone(skb, GFP_KERNEL);
2117
2118 if (!tx_skb)
2119 break;
2120
2121 __set_retrans_timer(chan);
2122
2123 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
2124 chan->unacked_frames++;
2125 chan->frames_sent++;
2126 sent++;
2127
2128 if (skb_queue_is_last(&chan->tx_q, skb))
2129 chan->tx_send_head = NULL;
2130 else
2131 chan->tx_send_head = skb_queue_next(&chan->tx_q, skb);
2132
2133 l2cap_do_send(chan, tx_skb);
2134 BT_DBG("Sent txseq %u", control->txseq);
2135 }
2136
2137 BT_DBG("Sent %d, %u unacked, %u in ERTM queue", sent,
2138 chan->unacked_frames, skb_queue_len(&chan->tx_q));
2139
2140 return sent;
2141 }
2142
2143 static void l2cap_ertm_resend(struct l2cap_chan *chan)
2144 {
2145 struct l2cap_ctrl control;
2146 struct sk_buff *skb;
2147 struct sk_buff *tx_skb;
2148 u16 seq;
2149
2150 BT_DBG("chan %p", chan);
2151
2152 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
2153 return;
2154
2155 if (__chan_is_moving(chan))
2156 return;
2157
2158 while (chan->retrans_list.head != L2CAP_SEQ_LIST_CLEAR) {
2159 seq = l2cap_seq_list_pop(&chan->retrans_list);
2160
2161 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, seq);
2162 if (!skb) {
2163 BT_DBG("Error: Can't retransmit seq %d, frame missing",
2164 seq);
2165 continue;
2166 }
2167
2168 bt_cb(skb)->l2cap.retries++;
2169 control = bt_cb(skb)->l2cap;
2170
2171 if (chan->max_tx != 0 &&
2172 bt_cb(skb)->l2cap.retries > chan->max_tx) {
2173 BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
2174 l2cap_send_disconn_req(chan, ECONNRESET);
2175 l2cap_seq_list_clear(&chan->retrans_list);
2176 break;
2177 }
2178
2179 control.reqseq = chan->buffer_seq;
2180 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
2181 control.final = 1;
2182 else
2183 control.final = 0;
2184
2185 if (skb_cloned(skb)) {
2186 /* Cloned sk_buffs are read-only, so we need a
2187 * writeable copy
2188 */
2189 tx_skb = skb_copy(skb, GFP_KERNEL);
2190 } else {
2191 tx_skb = skb_clone(skb, GFP_KERNEL);
2192 }
2193
2194 if (!tx_skb) {
2195 l2cap_seq_list_clear(&chan->retrans_list);
2196 break;
2197 }
2198
2199 /* Update skb contents */
2200 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
2201 put_unaligned_le32(__pack_extended_control(&control),
2202 tx_skb->data + L2CAP_HDR_SIZE);
2203 } else {
2204 put_unaligned_le16(__pack_enhanced_control(&control),
2205 tx_skb->data + L2CAP_HDR_SIZE);
2206 }
2207
2208 /* Update FCS */
2209 if (chan->fcs == L2CAP_FCS_CRC16) {
2210 u16 fcs = crc16(0, (u8 *) tx_skb->data,
2211 tx_skb->len - L2CAP_FCS_SIZE);
2212 put_unaligned_le16(fcs, skb_tail_pointer(tx_skb) -
2213 L2CAP_FCS_SIZE);
2214 }
2215
2216 l2cap_do_send(chan, tx_skb);
2217
2218 BT_DBG("Resent txseq %d", control.txseq);
2219
2220 chan->last_acked_seq = chan->buffer_seq;
2221 }
2222 }
2223
2224 static void l2cap_retransmit(struct l2cap_chan *chan,
2225 struct l2cap_ctrl *control)
2226 {
2227 BT_DBG("chan %p, control %p", chan, control);
2228
2229 l2cap_seq_list_append(&chan->retrans_list, control->reqseq);
2230 l2cap_ertm_resend(chan);
2231 }
2232
2233 static void l2cap_retransmit_all(struct l2cap_chan *chan,
2234 struct l2cap_ctrl *control)
2235 {
2236 struct sk_buff *skb;
2237
2238 BT_DBG("chan %p, control %p", chan, control);
2239
2240 if (control->poll)
2241 set_bit(CONN_SEND_FBIT, &chan->conn_state);
2242
2243 l2cap_seq_list_clear(&chan->retrans_list);
2244
2245 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
2246 return;
2247
2248 if (chan->unacked_frames) {
2249 skb_queue_walk(&chan->tx_q, skb) {
2250 if (bt_cb(skb)->l2cap.txseq == control->reqseq ||
2251 skb == chan->tx_send_head)
2252 break;
2253 }
2254
2255 skb_queue_walk_from(&chan->tx_q, skb) {
2256 if (skb == chan->tx_send_head)
2257 break;
2258
2259 l2cap_seq_list_append(&chan->retrans_list,
2260 bt_cb(skb)->l2cap.txseq);
2261 }
2262
2263 l2cap_ertm_resend(chan);
2264 }
2265 }
2266
2267 static void l2cap_send_ack(struct l2cap_chan *chan)
2268 {
2269 struct l2cap_ctrl control;
2270 u16 frames_to_ack = __seq_offset(chan, chan->buffer_seq,
2271 chan->last_acked_seq);
2272 int threshold;
2273
2274 BT_DBG("chan %p last_acked_seq %d buffer_seq %d",
2275 chan, chan->last_acked_seq, chan->buffer_seq);
2276
2277 memset(&control, 0, sizeof(control));
2278 control.sframe = 1;
2279
2280 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&
2281 chan->rx_state == L2CAP_RX_STATE_RECV) {
2282 __clear_ack_timer(chan);
2283 control.super = L2CAP_SUPER_RNR;
2284 control.reqseq = chan->buffer_seq;
2285 l2cap_send_sframe(chan, &control);
2286 } else {
2287 if (!test_bit(CONN_REMOTE_BUSY, &chan->conn_state)) {
2288 l2cap_ertm_send(chan);
2289 /* If any i-frames were sent, they included an ack */
2290 if (chan->buffer_seq == chan->last_acked_seq)
2291 frames_to_ack = 0;
2292 }
2293
2294 /* Ack now if the window is 3/4ths full.
2295 * Calculate without mul or div
2296 */
2297 threshold = chan->ack_win;
2298 threshold += threshold << 1;
2299 threshold >>= 2;
2300
2301 BT_DBG("frames_to_ack %u, threshold %d", frames_to_ack,
2302 threshold);
2303
2304 if (frames_to_ack >= threshold) {
2305 __clear_ack_timer(chan);
2306 control.super = L2CAP_SUPER_RR;
2307 control.reqseq = chan->buffer_seq;
2308 l2cap_send_sframe(chan, &control);
2309 frames_to_ack = 0;
2310 }
2311
2312 if (frames_to_ack)
2313 __set_ack_timer(chan);
2314 }
2315 }
2316
2317 static inline int l2cap_skbuff_fromiovec(struct l2cap_chan *chan,
2318 struct msghdr *msg, int len,
2319 int count, struct sk_buff *skb)
2320 {
2321 struct l2cap_conn *conn = chan->conn;
2322 struct sk_buff **frag;
2323 int sent = 0;
2324
2325 if (!copy_from_iter_full(skb_put(skb, count), count, &msg->msg_iter))
2326 return -EFAULT;
2327
2328 sent += count;
2329 len -= count;
2330
2331 /* Continuation fragments (no L2CAP header) */
2332 frag = &skb_shinfo(skb)->frag_list;
2333 while (len) {
2334 struct sk_buff *tmp;
2335
2336 count = min_t(unsigned int, conn->mtu, len);
2337
2338 tmp = chan->ops->alloc_skb(chan, 0, count,
2339 msg->msg_flags & MSG_DONTWAIT);
2340 if (IS_ERR(tmp))
2341 return PTR_ERR(tmp);
2342
2343 *frag = tmp;
2344
2345 if (!copy_from_iter_full(skb_put(*frag, count), count,
2346 &msg->msg_iter))
2347 return -EFAULT;
2348
2349 sent += count;
2350 len -= count;
2351
2352 skb->len += (*frag)->len;
2353 skb->data_len += (*frag)->len;
2354
2355 frag = &(*frag)->next;
2356 }
2357
2358 return sent;
2359 }
2360
2361 static struct sk_buff *l2cap_create_connless_pdu(struct l2cap_chan *chan,
2362 struct msghdr *msg, size_t len)
2363 {
2364 struct l2cap_conn *conn = chan->conn;
2365 struct sk_buff *skb;
2366 int err, count, hlen = L2CAP_HDR_SIZE + L2CAP_PSMLEN_SIZE;
2367 struct l2cap_hdr *lh;
2368
2369 BT_DBG("chan %p psm 0x%2.2x len %zu", chan,
2370 __le16_to_cpu(chan->psm), len);
2371
2372 count = min_t(unsigned int, (conn->mtu - hlen), len);
2373
2374 skb = chan->ops->alloc_skb(chan, hlen, count,
2375 msg->msg_flags & MSG_DONTWAIT);
2376 if (IS_ERR(skb))
2377 return skb;
2378
2379 /* Create L2CAP header */
2380 lh = skb_put(skb, L2CAP_HDR_SIZE);
2381 lh->cid = cpu_to_le16(chan->dcid);
2382 lh->len = cpu_to_le16(len + L2CAP_PSMLEN_SIZE);
2383 put_unaligned(chan->psm, (__le16 *) skb_put(skb, L2CAP_PSMLEN_SIZE));
2384
2385 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
2386 if (unlikely(err < 0)) {
2387 kfree_skb(skb);
2388 return ERR_PTR(err);
2389 }
2390 return skb;
2391 }
2392
2393 static struct sk_buff *l2cap_create_basic_pdu(struct l2cap_chan *chan,
2394 struct msghdr *msg, size_t len)
2395 {
2396 struct l2cap_conn *conn = chan->conn;
2397 struct sk_buff *skb;
2398 int err, count;
2399 struct l2cap_hdr *lh;
2400
2401 BT_DBG("chan %p len %zu", chan, len);
2402
2403 count = min_t(unsigned int, (conn->mtu - L2CAP_HDR_SIZE), len);
2404
2405 skb = chan->ops->alloc_skb(chan, L2CAP_HDR_SIZE, count,
2406 msg->msg_flags & MSG_DONTWAIT);
2407 if (IS_ERR(skb))
2408 return skb;
2409
2410 /* Create L2CAP header */
2411 lh = skb_put(skb, L2CAP_HDR_SIZE);
2412 lh->cid = cpu_to_le16(chan->dcid);
2413 lh->len = cpu_to_le16(len);
2414
2415 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
2416 if (unlikely(err < 0)) {
2417 kfree_skb(skb);
2418 return ERR_PTR(err);
2419 }
2420 return skb;
2421 }
2422
2423 static struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan,
2424 struct msghdr *msg, size_t len,
2425 u16 sdulen)
2426 {
2427 struct l2cap_conn *conn = chan->conn;
2428 struct sk_buff *skb;
2429 int err, count, hlen;
2430 struct l2cap_hdr *lh;
2431
2432 BT_DBG("chan %p len %zu", chan, len);
2433
2434 if (!conn)
2435 return ERR_PTR(-ENOTCONN);
2436
2437 hlen = __ertm_hdr_size(chan);
2438
2439 if (sdulen)
2440 hlen += L2CAP_SDULEN_SIZE;
2441
2442 if (chan->fcs == L2CAP_FCS_CRC16)
2443 hlen += L2CAP_FCS_SIZE;
2444
2445 count = min_t(unsigned int, (conn->mtu - hlen), len);
2446
2447 skb = chan->ops->alloc_skb(chan, hlen, count,
2448 msg->msg_flags & MSG_DONTWAIT);
2449 if (IS_ERR(skb))
2450 return skb;
2451
2452 /* Create L2CAP header */
2453 lh = skb_put(skb, L2CAP_HDR_SIZE);
2454 lh->cid = cpu_to_le16(chan->dcid);
2455 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
2456
2457 /* Control header is populated later */
2458 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
2459 put_unaligned_le32(0, skb_put(skb, L2CAP_EXT_CTRL_SIZE));
2460 else
2461 put_unaligned_le16(0, skb_put(skb, L2CAP_ENH_CTRL_SIZE));
2462
2463 if (sdulen)
2464 put_unaligned_le16(sdulen, skb_put(skb, L2CAP_SDULEN_SIZE));
2465
2466 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
2467 if (unlikely(err < 0)) {
2468 kfree_skb(skb);
2469 return ERR_PTR(err);
2470 }
2471
2472 bt_cb(skb)->l2cap.fcs = chan->fcs;
2473 bt_cb(skb)->l2cap.retries = 0;
2474 return skb;
2475 }
2476
2477 static int l2cap_segment_sdu(struct l2cap_chan *chan,
2478 struct sk_buff_head *seg_queue,
2479 struct msghdr *msg, size_t len)
2480 {
2481 struct sk_buff *skb;
2482 u16 sdu_len;
2483 size_t pdu_len;
2484 u8 sar;
2485
2486 BT_DBG("chan %p, msg %p, len %zu", chan, msg, len);
2487
2488 /* It is critical that ERTM PDUs fit in a single HCI fragment,
2489 * so fragmented skbs are not used. The HCI layer's handling
2490 * of fragmented skbs is not compatible with ERTM's queueing.
2491 */
2492
2493 /* PDU size is derived from the HCI MTU */
2494 pdu_len = chan->conn->mtu;
2495
2496 /* Constrain PDU size for BR/EDR connections */
2497 if (!chan->hs_hcon)
2498 pdu_len = min_t(size_t, pdu_len, L2CAP_BREDR_MAX_PAYLOAD);
2499
2500 /* Adjust for largest possible L2CAP overhead. */
2501 if (chan->fcs)
2502 pdu_len -= L2CAP_FCS_SIZE;
2503
2504 pdu_len -= __ertm_hdr_size(chan);
2505
2506 /* Remote device may have requested smaller PDUs */
2507 pdu_len = min_t(size_t, pdu_len, chan->remote_mps);
2508
2509 if (len <= pdu_len) {
2510 sar = L2CAP_SAR_UNSEGMENTED;
2511 sdu_len = 0;
2512 pdu_len = len;
2513 } else {
2514 sar = L2CAP_SAR_START;
2515 sdu_len = len;
2516 }
2517
2518 while (len > 0) {
2519 skb = l2cap_create_iframe_pdu(chan, msg, pdu_len, sdu_len);
2520
2521 if (IS_ERR(skb)) {
2522 __skb_queue_purge(seg_queue);
2523 return PTR_ERR(skb);
2524 }
2525
2526 bt_cb(skb)->l2cap.sar = sar;
2527 __skb_queue_tail(seg_queue, skb);
2528
2529 len -= pdu_len;
2530 if (sdu_len)
2531 sdu_len = 0;
2532
2533 if (len <= pdu_len) {
2534 sar = L2CAP_SAR_END;
2535 pdu_len = len;
2536 } else {
2537 sar = L2CAP_SAR_CONTINUE;
2538 }
2539 }
2540
2541 return 0;
2542 }
2543
2544 static struct sk_buff *l2cap_create_le_flowctl_pdu(struct l2cap_chan *chan,
2545 struct msghdr *msg,
2546 size_t len, u16 sdulen)
2547 {
2548 struct l2cap_conn *conn = chan->conn;
2549 struct sk_buff *skb;
2550 int err, count, hlen;
2551 struct l2cap_hdr *lh;
2552
2553 BT_DBG("chan %p len %zu", chan, len);
2554
2555 if (!conn)
2556 return ERR_PTR(-ENOTCONN);
2557
2558 hlen = L2CAP_HDR_SIZE;
2559
2560 if (sdulen)
2561 hlen += L2CAP_SDULEN_SIZE;
2562
2563 count = min_t(unsigned int, (conn->mtu - hlen), len);
2564
2565 skb = chan->ops->alloc_skb(chan, hlen, count,
2566 msg->msg_flags & MSG_DONTWAIT);
2567 if (IS_ERR(skb))
2568 return skb;
2569
2570 /* Create L2CAP header */
2571 lh = skb_put(skb, L2CAP_HDR_SIZE);
2572 lh->cid = cpu_to_le16(chan->dcid);
2573 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
2574
2575 if (sdulen)
2576 put_unaligned_le16(sdulen, skb_put(skb, L2CAP_SDULEN_SIZE));
2577
2578 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
2579 if (unlikely(err < 0)) {
2580 kfree_skb(skb);
2581 return ERR_PTR(err);
2582 }
2583
2584 return skb;
2585 }
2586
2587 static int l2cap_segment_le_sdu(struct l2cap_chan *chan,
2588 struct sk_buff_head *seg_queue,
2589 struct msghdr *msg, size_t len)
2590 {
2591 struct sk_buff *skb;
2592 size_t pdu_len;
2593 u16 sdu_len;
2594
2595 BT_DBG("chan %p, msg %p, len %zu", chan, msg, len);
2596
2597 sdu_len = len;
2598 pdu_len = chan->remote_mps - L2CAP_SDULEN_SIZE;
2599
2600 while (len > 0) {
2601 if (len <= pdu_len)
2602 pdu_len = len;
2603
2604 skb = l2cap_create_le_flowctl_pdu(chan, msg, pdu_len, sdu_len);
2605 if (IS_ERR(skb)) {
2606 __skb_queue_purge(seg_queue);
2607 return PTR_ERR(skb);
2608 }
2609
2610 __skb_queue_tail(seg_queue, skb);
2611
2612 len -= pdu_len;
2613
2614 if (sdu_len) {
2615 sdu_len = 0;
2616 pdu_len += L2CAP_SDULEN_SIZE;
2617 }
2618 }
2619
2620 return 0;
2621 }
2622
2623 static void l2cap_le_flowctl_send(struct l2cap_chan *chan)
2624 {
2625 int sent = 0;
2626
2627 BT_DBG("chan %p", chan);
2628
2629 while (chan->tx_credits && !skb_queue_empty(&chan->tx_q)) {
2630 l2cap_do_send(chan, skb_dequeue(&chan->tx_q));
2631 chan->tx_credits--;
2632 sent++;
2633 }
2634
2635 BT_DBG("Sent %d credits %u queued %u", sent, chan->tx_credits,
2636 skb_queue_len(&chan->tx_q));
2637 }
2638
2639 int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len)
2640 {
2641 struct sk_buff *skb;
2642 int err;
2643 struct sk_buff_head seg_queue;
2644
2645 if (!chan->conn)
2646 return -ENOTCONN;
2647
2648 /* Connectionless channel */
2649 if (chan->chan_type == L2CAP_CHAN_CONN_LESS) {
2650 skb = l2cap_create_connless_pdu(chan, msg, len);
2651 if (IS_ERR(skb))
2652 return PTR_ERR(skb);
2653
2654 /* Channel lock is released before requesting new skb and then
2655 * reacquired thus we need to recheck channel state.
2656 */
2657 if (chan->state != BT_CONNECTED) {
2658 kfree_skb(skb);
2659 return -ENOTCONN;
2660 }
2661
2662 l2cap_do_send(chan, skb);
2663 return len;
2664 }
2665
2666 switch (chan->mode) {
2667 case L2CAP_MODE_LE_FLOWCTL:
2668 case L2CAP_MODE_EXT_FLOWCTL:
2669 /* Check outgoing MTU */
2670 if (len > chan->omtu)
2671 return -EMSGSIZE;
2672
2673 __skb_queue_head_init(&seg_queue);
2674
2675 err = l2cap_segment_le_sdu(chan, &seg_queue, msg, len);
2676
2677 if (chan->state != BT_CONNECTED) {
2678 __skb_queue_purge(&seg_queue);
2679 err = -ENOTCONN;
2680 }
2681
2682 if (err)
2683 return err;
2684
2685 skb_queue_splice_tail_init(&seg_queue, &chan->tx_q);
2686
2687 l2cap_le_flowctl_send(chan);
2688
2689 if (!chan->tx_credits)
2690 chan->ops->suspend(chan);
2691
2692 err = len;
2693
2694 break;
2695
2696 case L2CAP_MODE_BASIC:
2697 /* Check outgoing MTU */
2698 if (len > chan->omtu)
2699 return -EMSGSIZE;
2700
2701 /* Create a basic PDU */
2702 skb = l2cap_create_basic_pdu(chan, msg, len);
2703 if (IS_ERR(skb))
2704 return PTR_ERR(skb);
2705
2706 /* Channel lock is released before requesting new skb and then
2707 * reacquired thus we need to recheck channel state.
2708 */
2709 if (chan->state != BT_CONNECTED) {
2710 kfree_skb(skb);
2711 return -ENOTCONN;
2712 }
2713
2714 l2cap_do_send(chan, skb);
2715 err = len;
2716 break;
2717
2718 case L2CAP_MODE_ERTM:
2719 case L2CAP_MODE_STREAMING:
2720 /* Check outgoing MTU */
2721 if (len > chan->omtu) {
2722 err = -EMSGSIZE;
2723 break;
2724 }
2725
2726 __skb_queue_head_init(&seg_queue);
2727
2728 /* Do segmentation before calling in to the state machine,
2729 * since it's possible to block while waiting for memory
2730 * allocation.
2731 */
2732 err = l2cap_segment_sdu(chan, &seg_queue, msg, len);
2733
2734 /* The channel could have been closed while segmenting,
2735 * check that it is still connected.
2736 */
2737 if (chan->state != BT_CONNECTED) {
2738 __skb_queue_purge(&seg_queue);
2739 err = -ENOTCONN;
2740 }
2741
2742 if (err)
2743 break;
2744
2745 if (chan->mode == L2CAP_MODE_ERTM)
2746 l2cap_tx(chan, NULL, &seg_queue, L2CAP_EV_DATA_REQUEST);
2747 else
2748 l2cap_streaming_send(chan, &seg_queue);
2749
2750 err = len;
2751
2752 /* If the skbs were not queued for sending, they'll still be in
2753 * seg_queue and need to be purged.
2754 */
2755 __skb_queue_purge(&seg_queue);
2756 break;
2757
2758 default:
2759 BT_DBG("bad state %1.1x", chan->mode);
2760 err = -EBADFD;
2761 }
2762
2763 return err;
2764 }
2765 EXPORT_SYMBOL_GPL(l2cap_chan_send);
2766
2767 static void l2cap_send_srej(struct l2cap_chan *chan, u16 txseq)
2768 {
2769 struct l2cap_ctrl control;
2770 u16 seq;
2771
2772 BT_DBG("chan %p, txseq %u", chan, txseq);
2773
2774 memset(&control, 0, sizeof(control));
2775 control.sframe = 1;
2776 control.super = L2CAP_SUPER_SREJ;
2777
2778 for (seq = chan->expected_tx_seq; seq != txseq;
2779 seq = __next_seq(chan, seq)) {
2780 if (!l2cap_ertm_seq_in_queue(&chan->srej_q, seq)) {
2781 control.reqseq = seq;
2782 l2cap_send_sframe(chan, &control);
2783 l2cap_seq_list_append(&chan->srej_list, seq);
2784 }
2785 }
2786
2787 chan->expected_tx_seq = __next_seq(chan, txseq);
2788 }
2789
2790 static void l2cap_send_srej_tail(struct l2cap_chan *chan)
2791 {
2792 struct l2cap_ctrl control;
2793
2794 BT_DBG("chan %p", chan);
2795
2796 if (chan->srej_list.tail == L2CAP_SEQ_LIST_CLEAR)
2797 return;
2798
2799 memset(&control, 0, sizeof(control));
2800 control.sframe = 1;
2801 control.super = L2CAP_SUPER_SREJ;
2802 control.reqseq = chan->srej_list.tail;
2803 l2cap_send_sframe(chan, &control);
2804 }
2805
2806 static void l2cap_send_srej_list(struct l2cap_chan *chan, u16 txseq)
2807 {
2808 struct l2cap_ctrl control;
2809 u16 initial_head;
2810 u16 seq;
2811
2812 BT_DBG("chan %p, txseq %u", chan, txseq);
2813
2814 memset(&control, 0, sizeof(control));
2815 control.sframe = 1;
2816 control.super = L2CAP_SUPER_SREJ;
2817
2818 /* Capture initial list head to allow only one pass through the list. */
2819 initial_head = chan->srej_list.head;
2820
2821 do {
2822 seq = l2cap_seq_list_pop(&chan->srej_list);
2823 if (seq == txseq || seq == L2CAP_SEQ_LIST_CLEAR)
2824 break;
2825
2826 control.reqseq = seq;
2827 l2cap_send_sframe(chan, &control);
2828 l2cap_seq_list_append(&chan->srej_list, seq);
2829 } while (chan->srej_list.head != initial_head);
2830 }
2831
2832 static void l2cap_process_reqseq(struct l2cap_chan *chan, u16 reqseq)
2833 {
2834 struct sk_buff *acked_skb;
2835 u16 ackseq;
2836
2837 BT_DBG("chan %p, reqseq %u", chan, reqseq);
2838
2839 if (chan->unacked_frames == 0 || reqseq == chan->expected_ack_seq)
2840 return;
2841
2842 BT_DBG("expected_ack_seq %u, unacked_frames %u",
2843 chan->expected_ack_seq, chan->unacked_frames);
2844
2845 for (ackseq = chan->expected_ack_seq; ackseq != reqseq;
2846 ackseq = __next_seq(chan, ackseq)) {
2847
2848 acked_skb = l2cap_ertm_seq_in_queue(&chan->tx_q, ackseq);
2849 if (acked_skb) {
2850 skb_unlink(acked_skb, &chan->tx_q);
2851 kfree_skb(acked_skb);
2852 chan->unacked_frames--;
2853 }
2854 }
2855
2856 chan->expected_ack_seq = reqseq;
2857
2858 if (chan->unacked_frames == 0)
2859 __clear_retrans_timer(chan);
2860
2861 BT_DBG("unacked_frames %u", chan->unacked_frames);
2862 }
2863
2864 static void l2cap_abort_rx_srej_sent(struct l2cap_chan *chan)
2865 {
2866 BT_DBG("chan %p", chan);
2867
2868 chan->expected_tx_seq = chan->buffer_seq;
2869 l2cap_seq_list_clear(&chan->srej_list);
2870 skb_queue_purge(&chan->srej_q);
2871 chan->rx_state = L2CAP_RX_STATE_RECV;
2872 }
2873
2874 static void l2cap_tx_state_xmit(struct l2cap_chan *chan,
2875 struct l2cap_ctrl *control,
2876 struct sk_buff_head *skbs, u8 event)
2877 {
2878 BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,
2879 event);
2880
2881 switch (event) {
2882 case L2CAP_EV_DATA_REQUEST:
2883 if (chan->tx_send_head == NULL)
2884 chan->tx_send_head = skb_peek(skbs);
2885
2886 skb_queue_splice_tail_init(skbs, &chan->tx_q);
2887 l2cap_ertm_send(chan);
2888 break;
2889 case L2CAP_EV_LOCAL_BUSY_DETECTED:
2890 BT_DBG("Enter LOCAL_BUSY");
2891 set_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2892
2893 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
2894 /* The SREJ_SENT state must be aborted if we are to
2895 * enter the LOCAL_BUSY state.
2896 */
2897 l2cap_abort_rx_srej_sent(chan);
2898 }
2899
2900 l2cap_send_ack(chan);
2901
2902 break;
2903 case L2CAP_EV_LOCAL_BUSY_CLEAR:
2904 BT_DBG("Exit LOCAL_BUSY");
2905 clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2906
2907 if (test_bit(CONN_RNR_SENT, &chan->conn_state)) {
2908 struct l2cap_ctrl local_control;
2909
2910 memset(&local_control, 0, sizeof(local_control));
2911 local_control.sframe = 1;
2912 local_control.super = L2CAP_SUPER_RR;
2913 local_control.poll = 1;
2914 local_control.reqseq = chan->buffer_seq;
2915 l2cap_send_sframe(chan, &local_control);
2916
2917 chan->retry_count = 1;
2918 __set_monitor_timer(chan);
2919 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2920 }
2921 break;
2922 case L2CAP_EV_RECV_REQSEQ_AND_FBIT:
2923 l2cap_process_reqseq(chan, control->reqseq);
2924 break;
2925 case L2CAP_EV_EXPLICIT_POLL:
2926 l2cap_send_rr_or_rnr(chan, 1);
2927 chan->retry_count = 1;
2928 __set_monitor_timer(chan);
2929 __clear_ack_timer(chan);
2930 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2931 break;
2932 case L2CAP_EV_RETRANS_TO:
2933 l2cap_send_rr_or_rnr(chan, 1);
2934 chan->retry_count = 1;
2935 __set_monitor_timer(chan);
2936 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2937 break;
2938 case L2CAP_EV_RECV_FBIT:
2939 /* Nothing to process */
2940 break;
2941 default:
2942 break;
2943 }
2944 }
2945
2946 static void l2cap_tx_state_wait_f(struct l2cap_chan *chan,
2947 struct l2cap_ctrl *control,
2948 struct sk_buff_head *skbs, u8 event)
2949 {
2950 BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,
2951 event);
2952
2953 switch (event) {
2954 case L2CAP_EV_DATA_REQUEST:
2955 if (chan->tx_send_head == NULL)
2956 chan->tx_send_head = skb_peek(skbs);
2957 /* Queue data, but don't send. */
2958 skb_queue_splice_tail_init(skbs, &chan->tx_q);
2959 break;
2960 case L2CAP_EV_LOCAL_BUSY_DETECTED:
2961 BT_DBG("Enter LOCAL_BUSY");
2962 set_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2963
2964 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
2965 /* The SREJ_SENT state must be aborted if we are to
2966 * enter the LOCAL_BUSY state.
2967 */
2968 l2cap_abort_rx_srej_sent(chan);
2969 }
2970
2971 l2cap_send_ack(chan);
2972
2973 break;
2974 case L2CAP_EV_LOCAL_BUSY_CLEAR:
2975 BT_DBG("Exit LOCAL_BUSY");
2976 clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2977
2978 if (test_bit(CONN_RNR_SENT, &chan->conn_state)) {
2979 struct l2cap_ctrl local_control;
2980 memset(&local_control, 0, sizeof(local_control));
2981 local_control.sframe = 1;
2982 local_control.super = L2CAP_SUPER_RR;
2983 local_control.poll = 1;
2984 local_control.reqseq = chan->buffer_seq;
2985 l2cap_send_sframe(chan, &local_control);
2986
2987 chan->retry_count = 1;
2988 __set_monitor_timer(chan);
2989 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2990 }
2991 break;
2992 case L2CAP_EV_RECV_REQSEQ_AND_FBIT:
2993 l2cap_process_reqseq(chan, control->reqseq);
2994 fallthrough;
2995
2996 case L2CAP_EV_RECV_FBIT:
2997 if (control && control->final) {
2998 __clear_monitor_timer(chan);
2999 if (chan->unacked_frames > 0)
3000 __set_retrans_timer(chan);
3001 chan->retry_count = 0;
3002 chan->tx_state = L2CAP_TX_STATE_XMIT;
3003 BT_DBG("recv fbit tx_state 0x2.2%x", chan->tx_state);
3004 }
3005 break;
3006 case L2CAP_EV_EXPLICIT_POLL:
3007 /* Ignore */
3008 break;
3009 case L2CAP_EV_MONITOR_TO:
3010 if (chan->max_tx == 0 || chan->retry_count < chan->max_tx) {
3011 l2cap_send_rr_or_rnr(chan, 1);
3012 __set_monitor_timer(chan);
3013 chan->retry_count++;
3014 } else {
3015 l2cap_send_disconn_req(chan, ECONNABORTED);
3016 }
3017 break;
3018 default:
3019 break;
3020 }
3021 }
3022
3023 static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
3024 struct sk_buff_head *skbs, u8 event)
3025 {
3026 BT_DBG("chan %p, control %p, skbs %p, event %d, state %d",
3027 chan, control, skbs, event, chan->tx_state);
3028
3029 switch (chan->tx_state) {
3030 case L2CAP_TX_STATE_XMIT:
3031 l2cap_tx_state_xmit(chan, control, skbs, event);
3032 break;
3033 case L2CAP_TX_STATE_WAIT_F:
3034 l2cap_tx_state_wait_f(chan, control, skbs, event);
3035 break;
3036 default:
3037 /* Ignore event */
3038 break;
3039 }
3040 }
3041
3042 static void l2cap_pass_to_tx(struct l2cap_chan *chan,
3043 struct l2cap_ctrl *control)
3044 {
3045 BT_DBG("chan %p, control %p", chan, control);
3046 l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_REQSEQ_AND_FBIT);
3047 }
3048
3049 static void l2cap_pass_to_tx_fbit(struct l2cap_chan *chan,
3050 struct l2cap_ctrl *control)
3051 {
3052 BT_DBG("chan %p, control %p", chan, control);
3053 l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_FBIT);
3054 }
3055
3056 /* Copy frame to all raw sockets on that connection */
3057 static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb)
3058 {
3059 struct sk_buff *nskb;
3060 struct l2cap_chan *chan;
3061
3062 BT_DBG("conn %p", conn);
3063
3064 mutex_lock(&conn->chan_lock);
3065
3066 list_for_each_entry(chan, &conn->chan_l, list) {
3067 if (chan->chan_type != L2CAP_CHAN_RAW)
3068 continue;
3069
3070 /* Don't send frame to the channel it came from */
3071 if (bt_cb(skb)->l2cap.chan == chan)
3072 continue;
3073
3074 nskb = skb_clone(skb, GFP_KERNEL);
3075 if (!nskb)
3076 continue;
3077 if (chan->ops->recv(chan, nskb))
3078 kfree_skb(nskb);
3079 }
3080
3081 mutex_unlock(&conn->chan_lock);
3082 }
3083
3084 /* ---- L2CAP signalling commands ---- */
3085 static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn, u8 code,
3086 u8 ident, u16 dlen, void *data)
3087 {
3088 struct sk_buff *skb, **frag;
3089 struct l2cap_cmd_hdr *cmd;
3090 struct l2cap_hdr *lh;
3091 int len, count;
3092
3093 BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %u",
3094 conn, code, ident, dlen);
3095
3096 if (conn->mtu < L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE)
3097 return NULL;
3098
3099 len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen;
3100 count = min_t(unsigned int, conn->mtu, len);
3101
3102 skb = bt_skb_alloc(count, GFP_KERNEL);
3103 if (!skb)
3104 return NULL;
3105
3106 lh = skb_put(skb, L2CAP_HDR_SIZE);
3107 lh->len = cpu_to_le16(L2CAP_CMD_HDR_SIZE + dlen);
3108
3109 if (conn->hcon->type == LE_LINK)
3110 lh->cid = cpu_to_le16(L2CAP_CID_LE_SIGNALING);
3111 else
3112 lh->cid = cpu_to_le16(L2CAP_CID_SIGNALING);
3113
3114 cmd = skb_put(skb, L2CAP_CMD_HDR_SIZE);
3115 cmd->code = code;
3116 cmd->ident = ident;
3117 cmd->len = cpu_to_le16(dlen);
3118
3119 if (dlen) {
3120 count -= L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE;
3121 skb_put_data(skb, data, count);
3122 data += count;
3123 }
3124
3125 len -= skb->len;
3126
3127 /* Continuation fragments (no L2CAP header) */
3128 frag = &skb_shinfo(skb)->frag_list;
3129 while (len) {
3130 count = min_t(unsigned int, conn->mtu, len);
3131
3132 *frag = bt_skb_alloc(count, GFP_KERNEL);
3133 if (!*frag)
3134 goto fail;
3135
3136 skb_put_data(*frag, data, count);
3137
3138 len -= count;
3139 data += count;
3140
3141 frag = &(*frag)->next;
3142 }
3143
3144 return skb;
3145
3146 fail:
3147 kfree_skb(skb);
3148 return NULL;
3149 }
3150
3151 static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen,
3152 unsigned long *val)
3153 {
3154 struct l2cap_conf_opt *opt = *ptr;
3155 int len;
3156
3157 len = L2CAP_CONF_OPT_SIZE + opt->len;
3158 *ptr += len;
3159
3160 *type = opt->type;
3161 *olen = opt->len;
3162
3163 switch (opt->len) {
3164 case 1:
3165 *val = *((u8 *) opt->val);
3166 break;
3167
3168 case 2:
3169 *val = get_unaligned_le16(opt->val);
3170 break;
3171
3172 case 4:
3173 *val = get_unaligned_le32(opt->val);
3174 break;
3175
3176 default:
3177 *val = (unsigned long) opt->val;
3178 break;
3179 }
3180
3181 BT_DBG("type 0x%2.2x len %u val 0x%lx", *type, opt->len, *val);
3182 return len;
3183 }
3184
3185 static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val, size_t size)
3186 {
3187 struct l2cap_conf_opt *opt = *ptr;
3188
3189 BT_DBG("type 0x%2.2x len %u val 0x%lx", type, len, val);
3190
3191 if (size < L2CAP_CONF_OPT_SIZE + len)
3192 return;
3193
3194 opt->type = type;
3195 opt->len = len;
3196
3197 switch (len) {
3198 case 1:
3199 *((u8 *) opt->val) = val;
3200 break;
3201
3202 case 2:
3203 put_unaligned_le16(val, opt->val);
3204 break;
3205
3206 case 4:
3207 put_unaligned_le32(val, opt->val);
3208 break;
3209
3210 default:
3211 memcpy(opt->val, (void *) val, len);
3212 break;
3213 }
3214
3215 *ptr += L2CAP_CONF_OPT_SIZE + len;
3216 }
3217
3218 static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan, size_t size)
3219 {
3220 struct l2cap_conf_efs efs;
3221
3222 switch (chan->mode) {
3223 case L2CAP_MODE_ERTM:
3224 efs.id = chan->local_id;
3225 efs.stype = chan->local_stype;
3226 efs.msdu = cpu_to_le16(chan->local_msdu);
3227 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime);
3228 efs.acc_lat = cpu_to_le32(L2CAP_DEFAULT_ACC_LAT);
3229 efs.flush_to = cpu_to_le32(L2CAP_EFS_DEFAULT_FLUSH_TO);
3230 break;
3231
3232 case L2CAP_MODE_STREAMING:
3233 efs.id = 1;
3234 efs.stype = L2CAP_SERV_BESTEFFORT;
3235 efs.msdu = cpu_to_le16(chan->local_msdu);
3236 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime);
3237 efs.acc_lat = 0;
3238 efs.flush_to = 0;
3239 break;
3240
3241 default:
3242 return;
3243 }
3244
3245 l2cap_add_conf_opt(ptr, L2CAP_CONF_EFS, sizeof(efs),
3246 (unsigned long) &efs, size);
3247 }
3248
3249 static void l2cap_ack_timeout(struct work_struct *work)
3250 {
3251 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
3252 ack_timer.work);
3253 u16 frames_to_ack;
3254
3255 BT_DBG("chan %p", chan);
3256
3257 l2cap_chan_lock(chan);
3258
3259 frames_to_ack = __seq_offset(chan, chan->buffer_seq,
3260 chan->last_acked_seq);
3261
3262 if (frames_to_ack)
3263 l2cap_send_rr_or_rnr(chan, 0);
3264
3265 l2cap_chan_unlock(chan);
3266 l2cap_chan_put(chan);
3267 }
3268
3269 int l2cap_ertm_init(struct l2cap_chan *chan)
3270 {
3271 int err;
3272
3273 chan->next_tx_seq = 0;
3274 chan->expected_tx_seq = 0;
3275 chan->expected_ack_seq = 0;
3276 chan->unacked_frames = 0;
3277 chan->buffer_seq = 0;
3278 chan->frames_sent = 0;
3279 chan->last_acked_seq = 0;
3280 chan->sdu = NULL;
3281 chan->sdu_last_frag = NULL;
3282 chan->sdu_len = 0;
3283
3284 skb_queue_head_init(&chan->tx_q);
3285
3286 chan->local_amp_id = AMP_ID_BREDR;
3287 chan->move_id = AMP_ID_BREDR;
3288 chan->move_state = L2CAP_MOVE_STABLE;
3289 chan->move_role = L2CAP_MOVE_ROLE_NONE;
3290
3291 if (chan->mode != L2CAP_MODE_ERTM)
3292 return 0;
3293
3294 chan->rx_state = L2CAP_RX_STATE_RECV;
3295 chan->tx_state = L2CAP_TX_STATE_XMIT;
3296
3297 INIT_DELAYED_WORK(&chan->retrans_timer, l2cap_retrans_timeout);
3298 INIT_DELAYED_WORK(&chan->monitor_timer, l2cap_monitor_timeout);
3299 INIT_DELAYED_WORK(&chan->ack_timer, l2cap_ack_timeout);
3300
3301 skb_queue_head_init(&chan->srej_q);
3302
3303 err = l2cap_seq_list_init(&chan->srej_list, chan->tx_win);
3304 if (err < 0)
3305 return err;
3306
3307 err = l2cap_seq_list_init(&chan->retrans_list, chan->remote_tx_win);
3308 if (err < 0)
3309 l2cap_seq_list_free(&chan->srej_list);
3310
3311 return err;
3312 }
3313
3314 static inline __u8 l2cap_select_mode(__u8 mode, __u16 remote_feat_mask)
3315 {
3316 switch (mode) {
3317 case L2CAP_MODE_STREAMING:
3318 case L2CAP_MODE_ERTM:
3319 if (l2cap_mode_supported(mode, remote_feat_mask))
3320 return mode;
3321 fallthrough;
3322 default:
3323 return L2CAP_MODE_BASIC;
3324 }
3325 }
3326
3327 static inline bool __l2cap_ews_supported(struct l2cap_conn *conn)
3328 {
3329 return ((conn->local_fixed_chan & L2CAP_FC_A2MP) &&
3330 (conn->feat_mask & L2CAP_FEAT_EXT_WINDOW));
3331 }
3332
3333 static inline bool __l2cap_efs_supported(struct l2cap_conn *conn)
3334 {
3335 return ((conn->local_fixed_chan & L2CAP_FC_A2MP) &&
3336 (conn->feat_mask & L2CAP_FEAT_EXT_FLOW));
3337 }
3338
3339 static void __l2cap_set_ertm_timeouts(struct l2cap_chan *chan,
3340 struct l2cap_conf_rfc *rfc)
3341 {
3342 if (chan->local_amp_id != AMP_ID_BREDR && chan->hs_hcon) {
3343 u64 ertm_to = chan->hs_hcon->hdev->amp_be_flush_to;
3344
3345 /* Class 1 devices have must have ERTM timeouts
3346 * exceeding the Link Supervision Timeout. The
3347 * default Link Supervision Timeout for AMP
3348 * controllers is 10 seconds.
3349 *
3350 * Class 1 devices use 0xffffffff for their
3351 * best-effort flush timeout, so the clamping logic
3352 * will result in a timeout that meets the above
3353 * requirement. ERTM timeouts are 16-bit values, so
3354 * the maximum timeout is 65.535 seconds.
3355 */
3356
3357 /* Convert timeout to milliseconds and round */
3358 ertm_to = DIV_ROUND_UP_ULL(ertm_to, 1000);
3359
3360 /* This is the recommended formula for class 2 devices
3361 * that start ERTM timers when packets are sent to the
3362 * controller.
3363 */
3364 ertm_to = 3 * ertm_to + 500;
3365
3366 if (ertm_to > 0xffff)
3367 ertm_to = 0xffff;
3368
3369 rfc->retrans_timeout = cpu_to_le16((u16) ertm_to);
3370 rfc->monitor_timeout = rfc->retrans_timeout;
3371 } else {
3372 rfc->retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO);
3373 rfc->monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO);
3374 }
3375 }
3376
3377 static inline void l2cap_txwin_setup(struct l2cap_chan *chan)
3378 {
3379 if (chan->tx_win > L2CAP_DEFAULT_TX_WINDOW &&
3380 __l2cap_ews_supported(chan->conn)) {
3381 /* use extended control field */
3382 set_bit(FLAG_EXT_CTRL, &chan->flags);
3383 chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;
3384 } else {
3385 chan->tx_win = min_t(u16, chan->tx_win,
3386 L2CAP_DEFAULT_TX_WINDOW);
3387 chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
3388 }
3389 chan->ack_win = chan->tx_win;
3390 }
3391
3392 static void l2cap_mtu_auto(struct l2cap_chan *chan)
3393 {
3394 struct hci_conn *conn = chan->conn->hcon;
3395
3396 chan->imtu = L2CAP_DEFAULT_MIN_MTU;
3397
3398 /* The 2-DH1 packet has between 2 and 56 information bytes
3399 * (including the 2-byte payload header)
3400 */
3401 if (!(conn->pkt_type & HCI_2DH1))
3402 chan->imtu = 54;
3403
3404 /* The 3-DH1 packet has between 2 and 85 information bytes
3405 * (including the 2-byte payload header)
3406 */
3407 if (!(conn->pkt_type & HCI_3DH1))
3408 chan->imtu = 83;
3409
3410 /* The 2-DH3 packet has between 2 and 369 information bytes
3411 * (including the 2-byte payload header)
3412 */
3413 if (!(conn->pkt_type & HCI_2DH3))
3414 chan->imtu = 367;
3415
3416 /* The 3-DH3 packet has between 2 and 554 information bytes
3417 * (including the 2-byte payload header)
3418 */
3419 if (!(conn->pkt_type & HCI_3DH3))
3420 chan->imtu = 552;
3421
3422 /* The 2-DH5 packet has between 2 and 681 information bytes
3423 * (including the 2-byte payload header)
3424 */
3425 if (!(conn->pkt_type & HCI_2DH5))
3426 chan->imtu = 679;
3427
3428 /* The 3-DH5 packet has between 2 and 1023 information bytes
3429 * (including the 2-byte payload header)
3430 */
3431 if (!(conn->pkt_type & HCI_3DH5))
3432 chan->imtu = 1021;
3433 }
3434
3435 static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size)
3436 {
3437 struct l2cap_conf_req *req = data;
3438 struct l2cap_conf_rfc rfc = { .mode = chan->mode };
3439 void *ptr = req->data;
3440 void *endptr = data + data_size;
3441 u16 size;
3442
3443 BT_DBG("chan %p", chan);
3444
3445 if (chan->num_conf_req || chan->num_conf_rsp)
3446 goto done;
3447
3448 switch (chan->mode) {
3449 case L2CAP_MODE_STREAMING:
3450 case L2CAP_MODE_ERTM:
3451 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state))
3452 break;
3453
3454 if (__l2cap_efs_supported(chan->conn))
3455 set_bit(FLAG_EFS_ENABLE, &chan->flags);
3456
3457 fallthrough;
3458 default:
3459 chan->mode = l2cap_select_mode(rfc.mode, chan->conn->feat_mask);
3460 break;
3461 }
3462
3463 done:
3464 if (chan->imtu != L2CAP_DEFAULT_MTU) {
3465 if (!chan->imtu)
3466 l2cap_mtu_auto(chan);
3467 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu,
3468 endptr - ptr);
3469 }
3470
3471 switch (chan->mode) {
3472 case L2CAP_MODE_BASIC:
3473 if (disable_ertm)
3474 break;
3475
3476 if (!(chan->conn->feat_mask & L2CAP_FEAT_ERTM) &&
3477 !(chan->conn->feat_mask & L2CAP_FEAT_STREAMING))
3478 break;
3479
3480 rfc.mode = L2CAP_MODE_BASIC;
3481 rfc.txwin_size = 0;
3482 rfc.max_transmit = 0;
3483 rfc.retrans_timeout = 0;
3484 rfc.monitor_timeout = 0;
3485 rfc.max_pdu_size = 0;
3486
3487 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3488 (unsigned long) &rfc, endptr - ptr);
3489 break;
3490
3491 case L2CAP_MODE_ERTM:
3492 rfc.mode = L2CAP_MODE_ERTM;
3493 rfc.max_transmit = chan->max_tx;
3494
3495 __l2cap_set_ertm_timeouts(chan, &rfc);
3496
3497 size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -
3498 L2CAP_EXT_HDR_SIZE - L2CAP_SDULEN_SIZE -
3499 L2CAP_FCS_SIZE);
3500 rfc.max_pdu_size = cpu_to_le16(size);
3501
3502 l2cap_txwin_setup(chan);
3503
3504 rfc.txwin_size = min_t(u16, chan->tx_win,
3505 L2CAP_DEFAULT_TX_WINDOW);
3506
3507 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3508 (unsigned long) &rfc, endptr - ptr);
3509
3510 if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
3511 l2cap_add_opt_efs(&ptr, chan, endptr - ptr);
3512
3513 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
3514 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
3515 chan->tx_win, endptr - ptr);
3516
3517 if (chan->conn->feat_mask & L2CAP_FEAT_FCS)
3518 if (chan->fcs == L2CAP_FCS_NONE ||
3519 test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) {
3520 chan->fcs = L2CAP_FCS_NONE;
3521 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1,
3522 chan->fcs, endptr - ptr);
3523 }
3524 break;
3525
3526 case L2CAP_MODE_STREAMING:
3527 l2cap_txwin_setup(chan);
3528 rfc.mode = L2CAP_MODE_STREAMING;
3529 rfc.txwin_size = 0;
3530 rfc.max_transmit = 0;
3531 rfc.retrans_timeout = 0;
3532 rfc.monitor_timeout = 0;
3533
3534 size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -
3535 L2CAP_EXT_HDR_SIZE - L2CAP_SDULEN_SIZE -
3536 L2CAP_FCS_SIZE);
3537 rfc.max_pdu_size = cpu_to_le16(size);
3538
3539 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3540 (unsigned long) &rfc, endptr - ptr);
3541
3542 if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
3543 l2cap_add_opt_efs(&ptr, chan, endptr - ptr);
3544
3545 if (chan->conn->feat_mask & L2CAP_FEAT_FCS)
3546 if (chan->fcs == L2CAP_FCS_NONE ||
3547 test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) {
3548 chan->fcs = L2CAP_FCS_NONE;
3549 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1,
3550 chan->fcs, endptr - ptr);
3551 }
3552 break;
3553 }
3554
3555 req->dcid = cpu_to_le16(chan->dcid);
3556 req->flags = cpu_to_le16(0);
3557
3558 return ptr - data;
3559 }
3560
3561 static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data_size)
3562 {
3563 struct l2cap_conf_rsp *rsp = data;
3564 void *ptr = rsp->data;
3565 void *endptr = data + data_size;
3566 void *req = chan->conf_req;
3567 int len = chan->conf_len;
3568 int type, hint, olen;
3569 unsigned long val;
3570 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
3571 struct l2cap_conf_efs efs;
3572 u8 remote_efs = 0;
3573 u16 mtu = L2CAP_DEFAULT_MTU;
3574 u16 result = L2CAP_CONF_SUCCESS;
3575 u16 size;
3576
3577 BT_DBG("chan %p", chan);
3578
3579 while (len >= L2CAP_CONF_OPT_SIZE) {
3580 len -= l2cap_get_conf_opt(&req, &type, &olen, &val);
3581 if (len < 0)
3582 break;
3583
3584 hint = type & L2CAP_CONF_HINT;
3585 type &= L2CAP_CONF_MASK;
3586
3587 switch (type) {
3588 case L2CAP_CONF_MTU:
3589 if (olen != 2)
3590 break;
3591 mtu = val;
3592 break;
3593
3594 case L2CAP_CONF_FLUSH_TO:
3595 if (olen != 2)
3596 break;
3597 chan->flush_to = val;
3598 break;
3599
3600 case L2CAP_CONF_QOS:
3601 break;
3602
3603 case L2CAP_CONF_RFC:
3604 if (olen != sizeof(rfc))
3605 break;
3606 memcpy(&rfc, (void *) val, olen);
3607 break;
3608
3609 case L2CAP_CONF_FCS:
3610 if (olen != 1)
3611 break;
3612 if (val == L2CAP_FCS_NONE)
3613 set_bit(CONF_RECV_NO_FCS, &chan->conf_state);
3614 break;
3615
3616 case L2CAP_CONF_EFS:
3617 if (olen != sizeof(efs))
3618 break;
3619 remote_efs = 1;
3620 memcpy(&efs, (void *) val, olen);
3621 break;
3622
3623 case L2CAP_CONF_EWS:
3624 if (olen != 2)
3625 break;
3626 if (!(chan->conn->local_fixed_chan & L2CAP_FC_A2MP))
3627 return -ECONNREFUSED;
3628 set_bit(FLAG_EXT_CTRL, &chan->flags);
3629 set_bit(CONF_EWS_RECV, &chan->conf_state);
3630 chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;
3631 chan->remote_tx_win = val;
3632 break;
3633
3634 default:
3635 if (hint)
3636 break;
3637 result = L2CAP_CONF_UNKNOWN;
3638 l2cap_add_conf_opt(&ptr, (u8)type, sizeof(u8), type, endptr - ptr);
3639 break;
3640 }
3641 }
3642
3643 if (chan->num_conf_rsp || chan->num_conf_req > 1)
3644 goto done;
3645
3646 switch (chan->mode) {
3647 case L2CAP_MODE_STREAMING:
3648 case L2CAP_MODE_ERTM:
3649 if (!test_bit(CONF_STATE2_DEVICE, &chan->conf_state)) {
3650 chan->mode = l2cap_select_mode(rfc.mode,
3651 chan->conn->feat_mask);
3652 break;
3653 }
3654
3655 if (remote_efs) {
3656 if (__l2cap_efs_supported(chan->conn))
3657 set_bit(FLAG_EFS_ENABLE, &chan->flags);
3658 else
3659 return -ECONNREFUSED;
3660 }
3661
3662 if (chan->mode != rfc.mode)
3663 return -ECONNREFUSED;
3664
3665 break;
3666 }
3667
3668 done:
3669 if (chan->mode != rfc.mode) {
3670 result = L2CAP_CONF_UNACCEPT;
3671 rfc.mode = chan->mode;
3672
3673 if (chan->num_conf_rsp == 1)
3674 return -ECONNREFUSED;
3675
3676 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3677 (unsigned long) &rfc, endptr - ptr);
3678 }
3679
3680 if (result == L2CAP_CONF_SUCCESS) {
3681 /* Configure output options and let the other side know
3682 * which ones we don't like. */
3683
3684 if (mtu < L2CAP_DEFAULT_MIN_MTU)
3685 result = L2CAP_CONF_UNACCEPT;
3686 else {
3687 chan->omtu = mtu;
3688 set_bit(CONF_MTU_DONE, &chan->conf_state);
3689 }
3690 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu, endptr - ptr);
3691
3692 if (remote_efs) {
3693 if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
3694 efs.stype != L2CAP_SERV_NOTRAFIC &&
3695 efs.stype != chan->local_stype) {
3696
3697 result = L2CAP_CONF_UNACCEPT;
3698
3699 if (chan->num_conf_req >= 1)
3700 return -ECONNREFUSED;
3701
3702 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
3703 sizeof(efs),
3704 (unsigned long) &efs, endptr - ptr);
3705 } else {
3706 /* Send PENDING Conf Rsp */
3707 result = L2CAP_CONF_PENDING;
3708 set_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
3709 }
3710 }
3711
3712 switch (rfc.mode) {
3713 case L2CAP_MODE_BASIC:
3714 chan->fcs = L2CAP_FCS_NONE;
3715 set_bit(CONF_MODE_DONE, &chan->conf_state);
3716 break;
3717
3718 case L2CAP_MODE_ERTM:
3719 if (!test_bit(CONF_EWS_RECV, &chan->conf_state))
3720 chan->remote_tx_win = rfc.txwin_size;
3721 else
3722 rfc.txwin_size = L2CAP_DEFAULT_TX_WINDOW;
3723
3724 chan->remote_max_tx = rfc.max_transmit;
3725
3726 size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
3727 chan->conn->mtu - L2CAP_EXT_HDR_SIZE -
3728 L2CAP_SDULEN_SIZE - L2CAP_FCS_SIZE);
3729 rfc.max_pdu_size = cpu_to_le16(size);
3730 chan->remote_mps = size;
3731
3732 __l2cap_set_ertm_timeouts(chan, &rfc);
3733
3734 set_bit(CONF_MODE_DONE, &chan->conf_state);
3735
3736 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
3737 sizeof(rfc), (unsigned long) &rfc, endptr - ptr);
3738
3739 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
3740 chan->remote_id = efs.id;
3741 chan->remote_stype = efs.stype;
3742 chan->remote_msdu = le16_to_cpu(efs.msdu);
3743 chan->remote_flush_to =
3744 le32_to_cpu(efs.flush_to);
3745 chan->remote_acc_lat =
3746 le32_to_cpu(efs.acc_lat);
3747 chan->remote_sdu_itime =
3748 le32_to_cpu(efs.sdu_itime);
3749 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
3750 sizeof(efs),
3751 (unsigned long) &efs, endptr - ptr);
3752 }
3753 break;
3754
3755 case L2CAP_MODE_STREAMING:
3756 size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
3757 chan->conn->mtu - L2CAP_EXT_HDR_SIZE -
3758 L2CAP_SDULEN_SIZE - L2CAP_FCS_SIZE);
3759 rfc.max_pdu_size = cpu_to_le16(size);
3760 chan->remote_mps = size;
3761
3762 set_bit(CONF_MODE_DONE, &chan->conf_state);
3763
3764 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3765 (unsigned long) &rfc, endptr - ptr);
3766
3767 break;
3768
3769 default:
3770 result = L2CAP_CONF_UNACCEPT;
3771
3772 memset(&rfc, 0, sizeof(rfc));
3773 rfc.mode = chan->mode;
3774 }
3775
3776 if (result == L2CAP_CONF_SUCCESS)
3777 set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
3778 }
3779 rsp->scid = cpu_to_le16(chan->dcid);
3780 rsp->result = cpu_to_le16(result);
3781 rsp->flags = cpu_to_le16(0);
3782
3783 return ptr - data;
3784 }
3785
3786 static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,
3787 void *data, size_t size, u16 *result)
3788 {
3789 struct l2cap_conf_req *req = data;
3790 void *ptr = req->data;
3791 void *endptr = data + size;
3792 int type, olen;
3793 unsigned long val;
3794 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
3795 struct l2cap_conf_efs efs;
3796
3797 BT_DBG("chan %p, rsp %p, len %d, req %p", chan, rsp, len, data);
3798
3799 while (len >= L2CAP_CONF_OPT_SIZE) {
3800 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
3801 if (len < 0)
3802 break;
3803
3804 switch (type) {
3805 case L2CAP_CONF_MTU:
3806 if (olen != 2)
3807 break;
3808 if (val < L2CAP_DEFAULT_MIN_MTU) {
3809 *result = L2CAP_CONF_UNACCEPT;
3810 chan->imtu = L2CAP_DEFAULT_MIN_MTU;
3811 } else
3812 chan->imtu = val;
3813 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu,
3814 endptr - ptr);
3815 break;
3816
3817 case L2CAP_CONF_FLUSH_TO:
3818 if (olen != 2)
3819 break;
3820 chan->flush_to = val;
3821 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO, 2,
3822 chan->flush_to, endptr - ptr);
3823 break;
3824
3825 case L2CAP_CONF_RFC:
3826 if (olen != sizeof(rfc))
3827 break;
3828 memcpy(&rfc, (void *)val, olen);
3829 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) &&
3830 rfc.mode != chan->mode)
3831 return -ECONNREFUSED;
3832 chan->fcs = 0;
3833 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3834 (unsigned long) &rfc, endptr - ptr);
3835 break;
3836
3837 case L2CAP_CONF_EWS:
3838 if (olen != 2)
3839 break;
3840 chan->ack_win = min_t(u16, val, chan->ack_win);
3841 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
3842 chan->tx_win, endptr - ptr);
3843 break;
3844
3845 case L2CAP_CONF_EFS:
3846 if (olen != sizeof(efs))
3847 break;
3848 memcpy(&efs, (void *)val, olen);
3849 if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
3850 efs.stype != L2CAP_SERV_NOTRAFIC &&
3851 efs.stype != chan->local_stype)
3852 return -ECONNREFUSED;
3853 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs),
3854 (unsigned long) &efs, endptr - ptr);
3855 break;
3856
3857 case L2CAP_CONF_FCS:
3858 if (olen != 1)
3859 break;
3860 if (*result == L2CAP_CONF_PENDING)
3861 if (val == L2CAP_FCS_NONE)
3862 set_bit(CONF_RECV_NO_FCS,
3863 &chan->conf_state);
3864 break;
3865 }
3866 }
3867
3868 if (chan->mode == L2CAP_MODE_BASIC && chan->mode != rfc.mode)
3869 return -ECONNREFUSED;
3870
3871 chan->mode = rfc.mode;
3872
3873 if (*result == L2CAP_CONF_SUCCESS || *result == L2CAP_CONF_PENDING) {
3874 switch (rfc.mode) {
3875 case L2CAP_MODE_ERTM:
3876 chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
3877 chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
3878 chan->mps = le16_to_cpu(rfc.max_pdu_size);
3879 if (!test_bit(FLAG_EXT_CTRL, &chan->flags))
3880 chan->ack_win = min_t(u16, chan->ack_win,
3881 rfc.txwin_size);
3882
3883 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
3884 chan->local_msdu = le16_to_cpu(efs.msdu);
3885 chan->local_sdu_itime =
3886 le32_to_cpu(efs.sdu_itime);
3887 chan->local_acc_lat = le32_to_cpu(efs.acc_lat);
3888 chan->local_flush_to =
3889 le32_to_cpu(efs.flush_to);
3890 }
3891 break;
3892
3893 case L2CAP_MODE_STREAMING:
3894 chan->mps = le16_to_cpu(rfc.max_pdu_size);
3895 }
3896 }
3897
3898 req->dcid = cpu_to_le16(chan->dcid);
3899 req->flags = cpu_to_le16(0);
3900
3901 return ptr - data;
3902 }
3903
3904 static int l2cap_build_conf_rsp(struct l2cap_chan *chan, void *data,
3905 u16 result, u16 flags)
3906 {
3907 struct l2cap_conf_rsp *rsp = data;
3908 void *ptr = rsp->data;
3909
3910 BT_DBG("chan %p", chan);
3911
3912 rsp->scid = cpu_to_le16(chan->dcid);
3913 rsp->result = cpu_to_le16(result);
3914 rsp->flags = cpu_to_le16(flags);
3915
3916 return ptr - data;
3917 }
3918
3919 void __l2cap_le_connect_rsp_defer(struct l2cap_chan *chan)
3920 {
3921 struct l2cap_le_conn_rsp rsp;
3922 struct l2cap_conn *conn = chan->conn;
3923
3924 BT_DBG("chan %p", chan);
3925
3926 rsp.dcid = cpu_to_le16(chan->scid);
3927 rsp.mtu = cpu_to_le16(chan->imtu);
3928 rsp.mps = cpu_to_le16(chan->mps);
3929 rsp.credits = cpu_to_le16(chan->rx_credits);
3930 rsp.result = cpu_to_le16(L2CAP_CR_LE_SUCCESS);
3931
3932 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp),
3933 &rsp);
3934 }
3935
3936 void __l2cap_ecred_conn_rsp_defer(struct l2cap_chan *chan)
3937 {
3938 struct {
3939 struct l2cap_ecred_conn_rsp rsp;
3940 __le16 dcid[5];
3941 } __packed pdu;
3942 struct l2cap_conn *conn = chan->conn;
3943 u16 ident = chan->ident;
3944 int i = 0;
3945
3946 if (!ident)
3947 return;
3948
3949 BT_DBG("chan %p ident %d", chan, ident);
3950
3951 pdu.rsp.mtu = cpu_to_le16(chan->imtu);
3952 pdu.rsp.mps = cpu_to_le16(chan->mps);
3953 pdu.rsp.credits = cpu_to_le16(chan->rx_credits);
3954 pdu.rsp.result = cpu_to_le16(L2CAP_CR_LE_SUCCESS);
3955
3956 mutex_lock(&conn->chan_lock);
3957
3958 list_for_each_entry(chan, &conn->chan_l, list) {
3959 if (chan->ident != ident)
3960 continue;
3961
3962 /* Reset ident so only one response is sent */
3963 chan->ident = 0;
3964
3965 /* Include all channels pending with the same ident */
3966 pdu.dcid[i++] = cpu_to_le16(chan->scid);
3967 }
3968
3969 mutex_unlock(&conn->chan_lock);
3970
3971 l2cap_send_cmd(conn, ident, L2CAP_ECRED_CONN_RSP,
3972 sizeof(pdu.rsp) + i * sizeof(__le16), &pdu);
3973 }
3974
3975 void __l2cap_connect_rsp_defer(struct l2cap_chan *chan)
3976 {
3977 struct l2cap_conn_rsp rsp;
3978 struct l2cap_conn *conn = chan->conn;
3979 u8 buf[128];
3980 u8 rsp_code;
3981
3982 rsp.scid = cpu_to_le16(chan->dcid);
3983 rsp.dcid = cpu_to_le16(chan->scid);
3984 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
3985 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
3986
3987 if (chan->hs_hcon)
3988 rsp_code = L2CAP_CREATE_CHAN_RSP;
3989 else
3990 rsp_code = L2CAP_CONN_RSP;
3991
3992 BT_DBG("chan %p rsp_code %u", chan, rsp_code);
3993
3994 l2cap_send_cmd(conn, chan->ident, rsp_code, sizeof(rsp), &rsp);
3995
3996 if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
3997 return;
3998
3999 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
4000 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
4001 chan->num_conf_req++;
4002 }
4003
4004 static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len)
4005 {
4006 int type, olen;
4007 unsigned long val;
4008 /* Use sane default values in case a misbehaving remote device
4009 * did not send an RFC or extended window size option.
4010 */
4011 u16 txwin_ext = chan->ack_win;
4012 struct l2cap_conf_rfc rfc = {
4013 .mode = chan->mode,
4014 .retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO),
4015 .monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO),
4016 .max_pdu_size = cpu_to_le16(chan->imtu),
4017 .txwin_size = min_t(u16, chan->ack_win, L2CAP_DEFAULT_TX_WINDOW),
4018 };
4019
4020 BT_DBG("chan %p, rsp %p, len %d", chan, rsp, len);
4021
4022 if ((chan->mode != L2CAP_MODE_ERTM) && (chan->mode != L2CAP_MODE_STREAMING))
4023 return;
4024
4025 while (len >= L2CAP_CONF_OPT_SIZE) {
4026 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
4027 if (len < 0)
4028 break;
4029
4030 switch (type) {
4031 case L2CAP_CONF_RFC:
4032 if (olen != sizeof(rfc))
4033 break;
4034 memcpy(&rfc, (void *)val, olen);
4035 break;
4036 case L2CAP_CONF_EWS:
4037 if (olen != 2)
4038 break;
4039 txwin_ext = val;
4040 break;
4041 }
4042 }
4043
4044 switch (rfc.mode) {
4045 case L2CAP_MODE_ERTM:
4046 chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
4047 chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
4048 chan->mps = le16_to_cpu(rfc.max_pdu_size);
4049 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
4050 chan->ack_win = min_t(u16, chan->ack_win, txwin_ext);
4051 else
4052 chan->ack_win = min_t(u16, chan->ack_win,
4053 rfc.txwin_size);
4054 break;
4055 case L2CAP_MODE_STREAMING:
4056 chan->mps = le16_to_cpu(rfc.max_pdu_size);
4057 }
4058 }
4059
4060 static inline int l2cap_command_rej(struct l2cap_conn *conn,
4061 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4062 u8 *data)
4063 {
4064 struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data;
4065
4066 if (cmd_len < sizeof(*rej))
4067 return -EPROTO;
4068
4069 if (rej->reason != L2CAP_REJ_NOT_UNDERSTOOD)
4070 return 0;
4071
4072 if ((conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) &&
4073 cmd->ident == conn->info_ident) {
4074 cancel_delayed_work(&conn->info_timer);
4075
4076 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
4077 conn->info_ident = 0;
4078
4079 l2cap_conn_start(conn);
4080 }
4081
4082 return 0;
4083 }
4084
4085 static struct l2cap_chan *l2cap_connect(struct l2cap_conn *conn,
4086 struct l2cap_cmd_hdr *cmd,
4087 u8 *data, u8 rsp_code, u8 amp_id)
4088 {
4089 struct l2cap_conn_req *req = (struct l2cap_conn_req *) data;
4090 struct l2cap_conn_rsp rsp;
4091 struct l2cap_chan *chan = NULL, *pchan;
4092 int result, status = L2CAP_CS_NO_INFO;
4093
4094 u16 dcid = 0, scid = __le16_to_cpu(req->scid);
4095 __le16 psm = req->psm;
4096
4097 BT_DBG("psm 0x%2.2x scid 0x%4.4x", __le16_to_cpu(psm), scid);
4098
4099 /* Check if we have socket listening on psm */
4100 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src,
4101 &conn->hcon->dst, ACL_LINK);
4102 if (!pchan) {
4103 result = L2CAP_CR_BAD_PSM;
4104 goto sendresp;
4105 }
4106
4107 mutex_lock(&conn->chan_lock);
4108 l2cap_chan_lock(pchan);
4109
4110 /* Check if the ACL is secure enough (if not SDP) */
4111 if (psm != cpu_to_le16(L2CAP_PSM_SDP) &&
4112 !hci_conn_check_link_mode(conn->hcon)) {
4113 conn->disc_reason = HCI_ERROR_AUTH_FAILURE;
4114 result = L2CAP_CR_SEC_BLOCK;
4115 goto response;
4116 }
4117
4118 result = L2CAP_CR_NO_MEM;
4119
4120 /* Check for valid dynamic CID range (as per Erratum 3253) */
4121 if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_DYN_END) {
4122 result = L2CAP_CR_INVALID_SCID;
4123 goto response;
4124 }
4125
4126 /* Check if we already have channel with that dcid */
4127 if (__l2cap_get_chan_by_dcid(conn, scid)) {
4128 result = L2CAP_CR_SCID_IN_USE;
4129 goto response;
4130 }
4131
4132 chan = pchan->ops->new_connection(pchan);
4133 if (!chan)
4134 goto response;
4135
4136 /* For certain devices (ex: HID mouse), support for authentication,
4137 * pairing and bonding is optional. For such devices, inorder to avoid
4138 * the ACL alive for too long after L2CAP disconnection, reset the ACL
4139 * disc_timeout back to HCI_DISCONN_TIMEOUT during L2CAP connect.
4140 */
4141 conn->hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
4142
4143 bacpy(&chan->src, &conn->hcon->src);
4144 bacpy(&chan->dst, &conn->hcon->dst);
4145 chan->src_type = bdaddr_src_type(conn->hcon);
4146 chan->dst_type = bdaddr_dst_type(conn->hcon);
4147 chan->psm = psm;
4148 chan->dcid = scid;
4149 chan->local_amp_id = amp_id;
4150
4151 __l2cap_chan_add(conn, chan);
4152
4153 dcid = chan->scid;
4154
4155 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
4156
4157 chan->ident = cmd->ident;
4158
4159 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) {
4160 if (l2cap_chan_check_security(chan, false)) {
4161 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
4162 l2cap_state_change(chan, BT_CONNECT2);
4163 result = L2CAP_CR_PEND;
4164 status = L2CAP_CS_AUTHOR_PEND;
4165 chan->ops->defer(chan);
4166 } else {
4167 /* Force pending result for AMP controllers.
4168 * The connection will succeed after the
4169 * physical link is up.
4170 */
4171 if (amp_id == AMP_ID_BREDR) {
4172 l2cap_state_change(chan, BT_CONFIG);
4173 result = L2CAP_CR_SUCCESS;
4174 } else {
4175 l2cap_state_change(chan, BT_CONNECT2);
4176 result = L2CAP_CR_PEND;
4177 }
4178 status = L2CAP_CS_NO_INFO;
4179 }
4180 } else {
4181 l2cap_state_change(chan, BT_CONNECT2);
4182 result = L2CAP_CR_PEND;
4183 status = L2CAP_CS_AUTHEN_PEND;
4184 }
4185 } else {
4186 l2cap_state_change(chan, BT_CONNECT2);
4187 result = L2CAP_CR_PEND;
4188 status = L2CAP_CS_NO_INFO;
4189 }
4190
4191 response:
4192 l2cap_chan_unlock(pchan);
4193 mutex_unlock(&conn->chan_lock);
4194 l2cap_chan_put(pchan);
4195
4196 sendresp:
4197 rsp.scid = cpu_to_le16(scid);
4198 rsp.dcid = cpu_to_le16(dcid);
4199 rsp.result = cpu_to_le16(result);
4200 rsp.status = cpu_to_le16(status);
4201 l2cap_send_cmd(conn, cmd->ident, rsp_code, sizeof(rsp), &rsp);
4202
4203 if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) {
4204 struct l2cap_info_req info;
4205 info.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
4206
4207 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
4208 conn->info_ident = l2cap_get_ident(conn);
4209
4210 schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
4211
4212 l2cap_send_cmd(conn, conn->info_ident, L2CAP_INFO_REQ,
4213 sizeof(info), &info);
4214 }
4215
4216 if (chan && !test_bit(CONF_REQ_SENT, &chan->conf_state) &&
4217 result == L2CAP_CR_SUCCESS) {
4218 u8 buf[128];
4219 set_bit(CONF_REQ_SENT, &chan->conf_state);
4220 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
4221 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
4222 chan->num_conf_req++;
4223 }
4224
4225 return chan;
4226 }
4227
4228 static int l2cap_connect_req(struct l2cap_conn *conn,
4229 struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
4230 {
4231 struct hci_dev *hdev = conn->hcon->hdev;
4232 struct hci_conn *hcon = conn->hcon;
4233
4234 if (cmd_len < sizeof(struct l2cap_conn_req))
4235 return -EPROTO;
4236
4237 hci_dev_lock(hdev);
4238 if (hci_dev_test_flag(hdev, HCI_MGMT) &&
4239 !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &hcon->flags))
4240 mgmt_device_connected(hdev, hcon, NULL, 0);
4241 hci_dev_unlock(hdev);
4242
4243 l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP, 0);
4244 return 0;
4245 }
4246
4247 static int l2cap_connect_create_rsp(struct l2cap_conn *conn,
4248 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4249 u8 *data)
4250 {
4251 struct l2cap_conn_rsp *rsp = (struct l2cap_conn_rsp *) data;
4252 u16 scid, dcid, result, status;
4253 struct l2cap_chan *chan;
4254 u8 req[128];
4255 int err;
4256
4257 if (cmd_len < sizeof(*rsp))
4258 return -EPROTO;
4259
4260 scid = __le16_to_cpu(rsp->scid);
4261 dcid = __le16_to_cpu(rsp->dcid);
4262 result = __le16_to_cpu(rsp->result);
4263 status = __le16_to_cpu(rsp->status);
4264
4265 BT_DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x",
4266 dcid, scid, result, status);
4267
4268 mutex_lock(&conn->chan_lock);
4269
4270 if (scid) {
4271 chan = __l2cap_get_chan_by_scid(conn, scid);
4272 if (!chan) {
4273 err = -EBADSLT;
4274 goto unlock;
4275 }
4276 } else {
4277 chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
4278 if (!chan) {
4279 err = -EBADSLT;
4280 goto unlock;
4281 }
4282 }
4283
4284 err = 0;
4285
4286 l2cap_chan_lock(chan);
4287
4288 switch (result) {
4289 case L2CAP_CR_SUCCESS:
4290 l2cap_state_change(chan, BT_CONFIG);
4291 chan->ident = 0;
4292 chan->dcid = dcid;
4293 clear_bit(CONF_CONNECT_PEND, &chan->conf_state);
4294
4295 if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
4296 break;
4297
4298 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
4299 l2cap_build_conf_req(chan, req, sizeof(req)), req);
4300 chan->num_conf_req++;
4301 break;
4302
4303 case L2CAP_CR_PEND:
4304 set_bit(CONF_CONNECT_PEND, &chan->conf_state);
4305 break;
4306
4307 default:
4308 l2cap_chan_del(chan, ECONNREFUSED);
4309 break;
4310 }
4311
4312 l2cap_chan_unlock(chan);
4313
4314 unlock:
4315 mutex_unlock(&conn->chan_lock);
4316
4317 return err;
4318 }
4319
4320 static inline void set_default_fcs(struct l2cap_chan *chan)
4321 {
4322 /* FCS is enabled only in ERTM or streaming mode, if one or both
4323 * sides request it.
4324 */
4325 if (chan->mode != L2CAP_MODE_ERTM && chan->mode != L2CAP_MODE_STREAMING)
4326 chan->fcs = L2CAP_FCS_NONE;
4327 else if (!test_bit(CONF_RECV_NO_FCS, &chan->conf_state))
4328 chan->fcs = L2CAP_FCS_CRC16;
4329 }
4330
4331 static void l2cap_send_efs_conf_rsp(struct l2cap_chan *chan, void *data,
4332 u8 ident, u16 flags)
4333 {
4334 struct l2cap_conn *conn = chan->conn;
4335
4336 BT_DBG("conn %p chan %p ident %d flags 0x%4.4x", conn, chan, ident,
4337 flags);
4338
4339 clear_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
4340 set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
4341
4342 l2cap_send_cmd(conn, ident, L2CAP_CONF_RSP,
4343 l2cap_build_conf_rsp(chan, data,
4344 L2CAP_CONF_SUCCESS, flags), data);
4345 }
4346
4347 static void cmd_reject_invalid_cid(struct l2cap_conn *conn, u8 ident,
4348 u16 scid, u16 dcid)
4349 {
4350 struct l2cap_cmd_rej_cid rej;
4351
4352 rej.reason = cpu_to_le16(L2CAP_REJ_INVALID_CID);
4353 rej.scid = __cpu_to_le16(scid);
4354 rej.dcid = __cpu_to_le16(dcid);
4355
4356 l2cap_send_cmd(conn, ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej);
4357 }
4358
4359 static inline int l2cap_config_req(struct l2cap_conn *conn,
4360 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4361 u8 *data)
4362 {
4363 struct l2cap_conf_req *req = (struct l2cap_conf_req *) data;
4364 u16 dcid, flags;
4365 u8 rsp[64];
4366 struct l2cap_chan *chan;
4367 int len, err = 0;
4368
4369 if (cmd_len < sizeof(*req))
4370 return -EPROTO;
4371
4372 dcid = __le16_to_cpu(req->dcid);
4373 flags = __le16_to_cpu(req->flags);
4374
4375 BT_DBG("dcid 0x%4.4x flags 0x%2.2x", dcid, flags);
4376
4377 chan = l2cap_get_chan_by_scid(conn, dcid);
4378 if (!chan) {
4379 cmd_reject_invalid_cid(conn, cmd->ident, dcid, 0);
4380 return 0;
4381 }
4382
4383 if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2 &&
4384 chan->state != BT_CONNECTED) {
4385 cmd_reject_invalid_cid(conn, cmd->ident, chan->scid,
4386 chan->dcid);
4387 goto unlock;
4388 }
4389
4390 /* Reject if config buffer is too small. */
4391 len = cmd_len - sizeof(*req);
4392 if (chan->conf_len + len > sizeof(chan->conf_req)) {
4393 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
4394 l2cap_build_conf_rsp(chan, rsp,
4395 L2CAP_CONF_REJECT, flags), rsp);
4396 goto unlock;
4397 }
4398
4399 /* Store config. */
4400 memcpy(chan->conf_req + chan->conf_len, req->data, len);
4401 chan->conf_len += len;
4402
4403 if (flags & L2CAP_CONF_FLAG_CONTINUATION) {
4404 /* Incomplete config. Send empty response. */
4405 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
4406 l2cap_build_conf_rsp(chan, rsp,
4407 L2CAP_CONF_SUCCESS, flags), rsp);
4408 goto unlock;
4409 }
4410
4411 /* Complete config. */
4412 len = l2cap_parse_conf_req(chan, rsp, sizeof(rsp));
4413 if (len < 0) {
4414 l2cap_send_disconn_req(chan, ECONNRESET);
4415 goto unlock;
4416 }
4417
4418 chan->ident = cmd->ident;
4419 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp);
4420 chan->num_conf_rsp++;
4421
4422 /* Reset config buffer. */
4423 chan->conf_len = 0;
4424
4425 if (!test_bit(CONF_OUTPUT_DONE, &chan->conf_state))
4426 goto unlock;
4427
4428 if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {
4429 set_default_fcs(chan);
4430
4431 if (chan->mode == L2CAP_MODE_ERTM ||
4432 chan->mode == L2CAP_MODE_STREAMING)
4433 err = l2cap_ertm_init(chan);
4434
4435 if (err < 0)
4436 l2cap_send_disconn_req(chan, -err);
4437 else
4438 l2cap_chan_ready(chan);
4439
4440 goto unlock;
4441 }
4442
4443 if (!test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) {
4444 u8 buf[64];
4445 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
4446 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
4447 chan->num_conf_req++;
4448 }
4449
4450 /* Got Conf Rsp PENDING from remote side and assume we sent
4451 Conf Rsp PENDING in the code above */
4452 if (test_bit(CONF_REM_CONF_PEND, &chan->conf_state) &&
4453 test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
4454
4455 /* check compatibility */
4456
4457 /* Send rsp for BR/EDR channel */
4458 if (!chan->hs_hcon)
4459 l2cap_send_efs_conf_rsp(chan, rsp, cmd->ident, flags);
4460 else
4461 chan->ident = cmd->ident;
4462 }
4463
4464 unlock:
4465 l2cap_chan_unlock(chan);
4466 return err;
4467 }
4468
4469 static inline int l2cap_config_rsp(struct l2cap_conn *conn,
4470 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4471 u8 *data)
4472 {
4473 struct l2cap_conf_rsp *rsp = (struct l2cap_conf_rsp *)data;
4474 u16 scid, flags, result;
4475 struct l2cap_chan *chan;
4476 int len = cmd_len - sizeof(*rsp);
4477 int err = 0;
4478
4479 if (cmd_len < sizeof(*rsp))
4480 return -EPROTO;
4481
4482 scid = __le16_to_cpu(rsp->scid);
4483 flags = __le16_to_cpu(rsp->flags);
4484 result = __le16_to_cpu(rsp->result);
4485
4486 BT_DBG("scid 0x%4.4x flags 0x%2.2x result 0x%2.2x len %d", scid, flags,
4487 result, len);
4488
4489 chan = l2cap_get_chan_by_scid(conn, scid);
4490 if (!chan)
4491 return 0;
4492
4493 switch (result) {
4494 case L2CAP_CONF_SUCCESS:
4495 l2cap_conf_rfc_get(chan, rsp->data, len);
4496 clear_bit(CONF_REM_CONF_PEND, &chan->conf_state);
4497 break;
4498
4499 case L2CAP_CONF_PENDING:
4500 set_bit(CONF_REM_CONF_PEND, &chan->conf_state);
4501
4502 if (test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
4503 char buf[64];
4504
4505 len = l2cap_parse_conf_rsp(chan, rsp->data, len,
4506 buf, sizeof(buf), &result);
4507 if (len < 0) {
4508 l2cap_send_disconn_req(chan, ECONNRESET);
4509 goto done;
4510 }
4511
4512 if (!chan->hs_hcon) {
4513 l2cap_send_efs_conf_rsp(chan, buf, cmd->ident,
4514 0);
4515 } else {
4516 if (l2cap_check_efs(chan)) {
4517 amp_create_logical_link(chan);
4518 chan->ident = cmd->ident;
4519 }
4520 }
4521 }
4522 goto done;
4523
4524 case L2CAP_CONF_UNKNOWN:
4525 case L2CAP_CONF_UNACCEPT:
4526 if (chan->num_conf_rsp <= L2CAP_CONF_MAX_CONF_RSP) {
4527 char req[64];
4528
4529 if (len > sizeof(req) - sizeof(struct l2cap_conf_req)) {
4530 l2cap_send_disconn_req(chan, ECONNRESET);
4531 goto done;
4532 }
4533
4534 /* throw out any old stored conf requests */
4535 result = L2CAP_CONF_SUCCESS;
4536 len = l2cap_parse_conf_rsp(chan, rsp->data, len,
4537 req, sizeof(req), &result);
4538 if (len < 0) {
4539 l2cap_send_disconn_req(chan, ECONNRESET);
4540 goto done;
4541 }
4542
4543 l2cap_send_cmd(conn, l2cap_get_ident(conn),
4544 L2CAP_CONF_REQ, len, req);
4545 chan->num_conf_req++;
4546 if (result != L2CAP_CONF_SUCCESS)
4547 goto done;
4548 break;
4549 }
4550 fallthrough;
4551
4552 default:
4553 l2cap_chan_set_err(chan, ECONNRESET);
4554
4555 __set_chan_timer(chan, L2CAP_DISC_REJ_TIMEOUT);
4556 l2cap_send_disconn_req(chan, ECONNRESET);
4557 goto done;
4558 }
4559
4560 if (flags & L2CAP_CONF_FLAG_CONTINUATION)
4561 goto done;
4562
4563 set_bit(CONF_INPUT_DONE, &chan->conf_state);
4564
4565 if (test_bit(CONF_OUTPUT_DONE, &chan->conf_state)) {
4566 set_default_fcs(chan);
4567
4568 if (chan->mode == L2CAP_MODE_ERTM ||
4569 chan->mode == L2CAP_MODE_STREAMING)
4570 err = l2cap_ertm_init(chan);
4571
4572 if (err < 0)
4573 l2cap_send_disconn_req(chan, -err);
4574 else
4575 l2cap_chan_ready(chan);
4576 }
4577
4578 done:
4579 l2cap_chan_unlock(chan);
4580 return err;
4581 }
4582
4583 static inline int l2cap_disconnect_req(struct l2cap_conn *conn,
4584 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4585 u8 *data)
4586 {
4587 struct l2cap_disconn_req *req = (struct l2cap_disconn_req *) data;
4588 struct l2cap_disconn_rsp rsp;
4589 u16 dcid, scid;
4590 struct l2cap_chan *chan;
4591
4592 if (cmd_len != sizeof(*req))
4593 return -EPROTO;
4594
4595 scid = __le16_to_cpu(req->scid);
4596 dcid = __le16_to_cpu(req->dcid);
4597
4598 BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid);
4599
4600 mutex_lock(&conn->chan_lock);
4601
4602 chan = __l2cap_get_chan_by_scid(conn, dcid);
4603 if (!chan) {
4604 mutex_unlock(&conn->chan_lock);
4605 cmd_reject_invalid_cid(conn, cmd->ident, dcid, scid);
4606 return 0;
4607 }
4608
4609 l2cap_chan_hold(chan);
4610 l2cap_chan_lock(chan);
4611
4612 rsp.dcid = cpu_to_le16(chan->scid);
4613 rsp.scid = cpu_to_le16(chan->dcid);
4614 l2cap_send_cmd(conn, cmd->ident, L2CAP_DISCONN_RSP, sizeof(rsp), &rsp);
4615
4616 chan->ops->set_shutdown(chan);
4617
4618 l2cap_chan_del(chan, ECONNRESET);
4619
4620 chan->ops->close(chan);
4621
4622 l2cap_chan_unlock(chan);
4623 l2cap_chan_put(chan);
4624
4625 mutex_unlock(&conn->chan_lock);
4626
4627 return 0;
4628 }
4629
4630 static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn,
4631 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4632 u8 *data)
4633 {
4634 struct l2cap_disconn_rsp *rsp = (struct l2cap_disconn_rsp *) data;
4635 u16 dcid, scid;
4636 struct l2cap_chan *chan;
4637
4638 if (cmd_len != sizeof(*rsp))
4639 return -EPROTO;
4640
4641 scid = __le16_to_cpu(rsp->scid);
4642 dcid = __le16_to_cpu(rsp->dcid);
4643
4644 BT_DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid);
4645
4646 mutex_lock(&conn->chan_lock);
4647
4648 chan = __l2cap_get_chan_by_scid(conn, scid);
4649 if (!chan) {
4650 mutex_unlock(&conn->chan_lock);
4651 return 0;
4652 }
4653
4654 l2cap_chan_hold(chan);
4655 l2cap_chan_lock(chan);
4656
4657 if (chan->state != BT_DISCONN) {
4658 l2cap_chan_unlock(chan);
4659 l2cap_chan_put(chan);
4660 mutex_unlock(&conn->chan_lock);
4661 return 0;
4662 }
4663
4664 l2cap_chan_del(chan, 0);
4665
4666 chan->ops->close(chan);
4667
4668 l2cap_chan_unlock(chan);
4669 l2cap_chan_put(chan);
4670
4671 mutex_unlock(&conn->chan_lock);
4672
4673 return 0;
4674 }
4675
4676 static inline int l2cap_information_req(struct l2cap_conn *conn,
4677 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4678 u8 *data)
4679 {
4680 struct l2cap_info_req *req = (struct l2cap_info_req *) data;
4681 u16 type;
4682
4683 if (cmd_len != sizeof(*req))
4684 return -EPROTO;
4685
4686 type = __le16_to_cpu(req->type);
4687
4688 BT_DBG("type 0x%4.4x", type);
4689
4690 if (type == L2CAP_IT_FEAT_MASK) {
4691 u8 buf[8];
4692 u32 feat_mask = l2cap_feat_mask;
4693 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
4694 rsp->type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
4695 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
4696 if (!disable_ertm)
4697 feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING
4698 | L2CAP_FEAT_FCS;
4699 if (conn->local_fixed_chan & L2CAP_FC_A2MP)
4700 feat_mask |= L2CAP_FEAT_EXT_FLOW
4701 | L2CAP_FEAT_EXT_WINDOW;
4702
4703 put_unaligned_le32(feat_mask, rsp->data);
4704 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(buf),
4705 buf);
4706 } else if (type == L2CAP_IT_FIXED_CHAN) {
4707 u8 buf[12];
4708 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
4709
4710 rsp->type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
4711 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
4712 rsp->data[0] = conn->local_fixed_chan;
4713 memset(rsp->data + 1, 0, 7);
4714 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(buf),
4715 buf);
4716 } else {
4717 struct l2cap_info_rsp rsp;
4718 rsp.type = cpu_to_le16(type);
4719 rsp.result = cpu_to_le16(L2CAP_IR_NOTSUPP);
4720 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(rsp),
4721 &rsp);
4722 }
4723
4724 return 0;
4725 }
4726
4727 static inline int l2cap_information_rsp(struct l2cap_conn *conn,
4728 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4729 u8 *data)
4730 {
4731 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data;
4732 u16 type, result;
4733
4734 if (cmd_len < sizeof(*rsp))
4735 return -EPROTO;
4736
4737 type = __le16_to_cpu(rsp->type);
4738 result = __le16_to_cpu(rsp->result);
4739
4740 BT_DBG("type 0x%4.4x result 0x%2.2x", type, result);
4741
4742 /* L2CAP Info req/rsp are unbound to channels, add extra checks */
4743 if (cmd->ident != conn->info_ident ||
4744 conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)
4745 return 0;
4746
4747 cancel_delayed_work(&conn->info_timer);
4748
4749 if (result != L2CAP_IR_SUCCESS) {
4750 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
4751 conn->info_ident = 0;
4752
4753 l2cap_conn_start(conn);
4754
4755 return 0;
4756 }
4757
4758 switch (type) {
4759 case L2CAP_IT_FEAT_MASK:
4760 conn->feat_mask = get_unaligned_le32(rsp->data);
4761
4762 if (conn->feat_mask & L2CAP_FEAT_FIXED_CHAN) {
4763 struct l2cap_info_req req;
4764 req.type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
4765
4766 conn->info_ident = l2cap_get_ident(conn);
4767
4768 l2cap_send_cmd(conn, conn->info_ident,
4769 L2CAP_INFO_REQ, sizeof(req), &req);
4770 } else {
4771 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
4772 conn->info_ident = 0;
4773
4774 l2cap_conn_start(conn);
4775 }
4776 break;
4777
4778 case L2CAP_IT_FIXED_CHAN:
4779 conn->remote_fixed_chan = rsp->data[0];
4780 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
4781 conn->info_ident = 0;
4782
4783 l2cap_conn_start(conn);
4784 break;
4785 }
4786
4787 return 0;
4788 }
4789
4790 static int l2cap_create_channel_req(struct l2cap_conn *conn,
4791 struct l2cap_cmd_hdr *cmd,
4792 u16 cmd_len, void *data)
4793 {
4794 struct l2cap_create_chan_req *req = data;
4795 struct l2cap_create_chan_rsp rsp;
4796 struct l2cap_chan *chan;
4797 struct hci_dev *hdev;
4798 u16 psm, scid;
4799
4800 if (cmd_len != sizeof(*req))
4801 return -EPROTO;
4802
4803 if (!(conn->local_fixed_chan & L2CAP_FC_A2MP))
4804 return -EINVAL;
4805
4806 psm = le16_to_cpu(req->psm);
4807 scid = le16_to_cpu(req->scid);
4808
4809 BT_DBG("psm 0x%2.2x, scid 0x%4.4x, amp_id %d", psm, scid, req->amp_id);
4810
4811 /* For controller id 0 make BR/EDR connection */
4812 if (req->amp_id == AMP_ID_BREDR) {
4813 l2cap_connect(conn, cmd, data, L2CAP_CREATE_CHAN_RSP,
4814 req->amp_id);
4815 return 0;
4816 }
4817
4818 /* Validate AMP controller id */
4819 hdev = hci_dev_get(req->amp_id);
4820 if (!hdev)
4821 goto error;
4822
4823 if (hdev->dev_type != HCI_AMP || !test_bit(HCI_UP, &hdev->flags)) {
4824 hci_dev_put(hdev);
4825 goto error;
4826 }
4827
4828 chan = l2cap_connect(conn, cmd, data, L2CAP_CREATE_CHAN_RSP,
4829 req->amp_id);
4830 if (chan) {
4831 struct amp_mgr *mgr = conn->hcon->amp_mgr;
4832 struct hci_conn *hs_hcon;
4833
4834 hs_hcon = hci_conn_hash_lookup_ba(hdev, AMP_LINK,
4835 &conn->hcon->dst);
4836 if (!hs_hcon) {
4837 hci_dev_put(hdev);
4838 cmd_reject_invalid_cid(conn, cmd->ident, chan->scid,
4839 chan->dcid);
4840 return 0;
4841 }
4842
4843 BT_DBG("mgr %p bredr_chan %p hs_hcon %p", mgr, chan, hs_hcon);
4844
4845 mgr->bredr_chan = chan;
4846 chan->hs_hcon = hs_hcon;
4847 chan->fcs = L2CAP_FCS_NONE;
4848 conn->mtu = hdev->block_mtu;
4849 }
4850
4851 hci_dev_put(hdev);
4852
4853 return 0;
4854
4855 error:
4856 rsp.dcid = 0;
4857 rsp.scid = cpu_to_le16(scid);
4858 rsp.result = cpu_to_le16(L2CAP_CR_BAD_AMP);
4859 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
4860
4861 l2cap_send_cmd(conn, cmd->ident, L2CAP_CREATE_CHAN_RSP,
4862 sizeof(rsp), &rsp);
4863
4864 return 0;
4865 }
4866
4867 static void l2cap_send_move_chan_req(struct l2cap_chan *chan, u8 dest_amp_id)
4868 {
4869 struct l2cap_move_chan_req req;
4870 u8 ident;
4871
4872 BT_DBG("chan %p, dest_amp_id %d", chan, dest_amp_id);
4873
4874 ident = l2cap_get_ident(chan->conn);
4875 chan->ident = ident;
4876
4877 req.icid = cpu_to_le16(chan->scid);
4878 req.dest_amp_id = dest_amp_id;
4879
4880 l2cap_send_cmd(chan->conn, ident, L2CAP_MOVE_CHAN_REQ, sizeof(req),
4881 &req);
4882
4883 __set_chan_timer(chan, L2CAP_MOVE_TIMEOUT);
4884 }
4885
4886 static void l2cap_send_move_chan_rsp(struct l2cap_chan *chan, u16 result)
4887 {
4888 struct l2cap_move_chan_rsp rsp;
4889
4890 BT_DBG("chan %p, result 0x%4.4x", chan, result);
4891
4892 rsp.icid = cpu_to_le16(chan->dcid);
4893 rsp.result = cpu_to_le16(result);
4894
4895 l2cap_send_cmd(chan->conn, chan->ident, L2CAP_MOVE_CHAN_RSP,
4896 sizeof(rsp), &rsp);
4897 }
4898
4899 static void l2cap_send_move_chan_cfm(struct l2cap_chan *chan, u16 result)
4900 {
4901 struct l2cap_move_chan_cfm cfm;
4902
4903 BT_DBG("chan %p, result 0x%4.4x", chan, result);
4904
4905 chan->ident = l2cap_get_ident(chan->conn);
4906
4907 cfm.icid = cpu_to_le16(chan->scid);
4908 cfm.result = cpu_to_le16(result);
4909
4910 l2cap_send_cmd(chan->conn, chan->ident, L2CAP_MOVE_CHAN_CFM,
4911 sizeof(cfm), &cfm);
4912
4913 __set_chan_timer(chan, L2CAP_MOVE_TIMEOUT);
4914 }
4915
4916 static void l2cap_send_move_chan_cfm_icid(struct l2cap_conn *conn, u16 icid)
4917 {
4918 struct l2cap_move_chan_cfm cfm;
4919
4920 BT_DBG("conn %p, icid 0x%4.4x", conn, icid);
4921
4922 cfm.icid = cpu_to_le16(icid);
4923 cfm.result = cpu_to_le16(L2CAP_MC_UNCONFIRMED);
4924
4925 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_MOVE_CHAN_CFM,
4926 sizeof(cfm), &cfm);
4927 }
4928
4929 static void l2cap_send_move_chan_cfm_rsp(struct l2cap_conn *conn, u8 ident,
4930 u16 icid)
4931 {
4932 struct l2cap_move_chan_cfm_rsp rsp;
4933
4934 BT_DBG("icid 0x%4.4x", icid);
4935
4936 rsp.icid = cpu_to_le16(icid);
4937 l2cap_send_cmd(conn, ident, L2CAP_MOVE_CHAN_CFM_RSP, sizeof(rsp), &rsp);
4938 }
4939
4940 static void __release_logical_link(struct l2cap_chan *chan)
4941 {
4942 chan->hs_hchan = NULL;
4943 chan->hs_hcon = NULL;
4944
4945 /* Placeholder - release the logical link */
4946 }
4947
4948 static void l2cap_logical_fail(struct l2cap_chan *chan)
4949 {
4950 /* Logical link setup failed */
4951 if (chan->state != BT_CONNECTED) {
4952 /* Create channel failure, disconnect */
4953 l2cap_send_disconn_req(chan, ECONNRESET);
4954 return;
4955 }
4956
4957 switch (chan->move_role) {
4958 case L2CAP_MOVE_ROLE_RESPONDER:
4959 l2cap_move_done(chan);
4960 l2cap_send_move_chan_rsp(chan, L2CAP_MR_NOT_SUPP);
4961 break;
4962 case L2CAP_MOVE_ROLE_INITIATOR:
4963 if (chan->move_state == L2CAP_MOVE_WAIT_LOGICAL_COMP ||
4964 chan->move_state == L2CAP_MOVE_WAIT_LOGICAL_CFM) {
4965 /* Remote has only sent pending or
4966 * success responses, clean up
4967 */
4968 l2cap_move_done(chan);
4969 }
4970
4971 /* Other amp move states imply that the move
4972 * has already aborted
4973 */
4974 l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);
4975 break;
4976 }
4977 }
4978
4979 static void l2cap_logical_finish_create(struct l2cap_chan *chan,
4980 struct hci_chan *hchan)
4981 {
4982 struct l2cap_conf_rsp rsp;
4983
4984 chan->hs_hchan = hchan;
4985 chan->hs_hcon->l2cap_data = chan->conn;
4986
4987 l2cap_send_efs_conf_rsp(chan, &rsp, chan->ident, 0);
4988
4989 if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {
4990 int err;
4991
4992 set_default_fcs(chan);
4993
4994 err = l2cap_ertm_init(chan);
4995 if (err < 0)
4996 l2cap_send_disconn_req(chan, -err);
4997 else
4998 l2cap_chan_ready(chan);
4999 }
5000 }
5001
5002 static void l2cap_logical_finish_move(struct l2cap_chan *chan,
5003 struct hci_chan *hchan)
5004 {
5005 chan->hs_hcon = hchan->conn;
5006 chan->hs_hcon->l2cap_data = chan->conn;
5007
5008 BT_DBG("move_state %d", chan->move_state);
5009
5010 switch (chan->move_state) {
5011 case L2CAP_MOVE_WAIT_LOGICAL_COMP:
5012 /* Move confirm will be sent after a success
5013 * response is received
5014 */
5015 chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;
5016 break;
5017 case L2CAP_MOVE_WAIT_LOGICAL_CFM:
5018 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
5019 chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;
5020 } else if (chan->move_role == L2CAP_MOVE_ROLE_INITIATOR) {
5021 chan->move_state = L2CAP_MOVE_WAIT_CONFIRM_RSP;
5022 l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);
5023 } else if (chan->move_role == L2CAP_MOVE_ROLE_RESPONDER) {
5024 chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;
5025 l2cap_send_move_chan_rsp(chan, L2CAP_MR_SUCCESS);
5026 }
5027 break;
5028 default:
5029 /* Move was not in expected state, free the channel */
5030 __release_logical_link(chan);
5031
5032 chan->move_state = L2CAP_MOVE_STABLE;
5033 }
5034 }
5035
5036 /* Call with chan locked */
5037 void l2cap_logical_cfm(struct l2cap_chan *chan, struct hci_chan *hchan,
5038 u8 status)
5039 {
5040 BT_DBG("chan %p, hchan %p, status %d", chan, hchan, status);
5041
5042 if (status) {
5043 l2cap_logical_fail(chan);
5044 __release_logical_link(chan);
5045 return;
5046 }
5047
5048 if (chan->state != BT_CONNECTED) {
5049 /* Ignore logical link if channel is on BR/EDR */
5050 if (chan->local_amp_id != AMP_ID_BREDR)
5051 l2cap_logical_finish_create(chan, hchan);
5052 } else {
5053 l2cap_logical_finish_move(chan, hchan);
5054 }
5055 }
5056
5057 void l2cap_move_start(struct l2cap_chan *chan)
5058 {
5059 BT_DBG("chan %p", chan);
5060
5061 if (chan->local_amp_id == AMP_ID_BREDR) {
5062 if (chan->chan_policy != BT_CHANNEL_POLICY_AMP_PREFERRED)
5063 return;
5064 chan->move_role = L2CAP_MOVE_ROLE_INITIATOR;
5065 chan->move_state = L2CAP_MOVE_WAIT_PREPARE;
5066 /* Placeholder - start physical link setup */
5067 } else {
5068 chan->move_role = L2CAP_MOVE_ROLE_INITIATOR;
5069 chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;
5070 chan->move_id = 0;
5071 l2cap_move_setup(chan);
5072 l2cap_send_move_chan_req(chan, 0);
5073 }
5074 }
5075
5076 static void l2cap_do_create(struct l2cap_chan *chan, int result,
5077 u8 local_amp_id, u8 remote_amp_id)
5078 {
5079 BT_DBG("chan %p state %s %u -> %u", chan, state_to_string(chan->state),
5080 local_amp_id, remote_amp_id);
5081
5082 chan->fcs = L2CAP_FCS_NONE;
5083
5084 /* Outgoing channel on AMP */
5085 if (chan->state == BT_CONNECT) {
5086 if (result == L2CAP_CR_SUCCESS) {
5087 chan->local_amp_id = local_amp_id;
5088 l2cap_send_create_chan_req(chan, remote_amp_id);
5089 } else {
5090 /* Revert to BR/EDR connect */
5091 l2cap_send_conn_req(chan);
5092 }
5093
5094 return;
5095 }
5096
5097 /* Incoming channel on AMP */
5098 if (__l2cap_no_conn_pending(chan)) {
5099 struct l2cap_conn_rsp rsp;
5100 char buf[128];
5101 rsp.scid = cpu_to_le16(chan->dcid);
5102 rsp.dcid = cpu_to_le16(chan->scid);
5103
5104 if (result == L2CAP_CR_SUCCESS) {
5105 /* Send successful response */
5106 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
5107 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
5108 } else {
5109 /* Send negative response */
5110 rsp.result = cpu_to_le16(L2CAP_CR_NO_MEM);
5111 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
5112 }
5113
5114 l2cap_send_cmd(chan->conn, chan->ident, L2CAP_CREATE_CHAN_RSP,
5115 sizeof(rsp), &rsp);
5116
5117 if (result == L2CAP_CR_SUCCESS) {
5118 l2cap_state_change(chan, BT_CONFIG);
5119 set_bit(CONF_REQ_SENT, &chan->conf_state);
5120 l2cap_send_cmd(chan->conn, l2cap_get_ident(chan->conn),
5121 L2CAP_CONF_REQ,
5122 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
5123 chan->num_conf_req++;
5124 }
5125 }
5126 }
5127
5128 static void l2cap_do_move_initiate(struct l2cap_chan *chan, u8 local_amp_id,
5129 u8 remote_amp_id)
5130 {
5131 l2cap_move_setup(chan);
5132 chan->move_id = local_amp_id;
5133 chan->move_state = L2CAP_MOVE_WAIT_RSP;
5134
5135 l2cap_send_move_chan_req(chan, remote_amp_id);
5136 }
5137
5138 static void l2cap_do_move_respond(struct l2cap_chan *chan, int result)
5139 {
5140 struct hci_chan *hchan = NULL;
5141
5142 /* Placeholder - get hci_chan for logical link */
5143
5144 if (hchan) {
5145 if (hchan->state == BT_CONNECTED) {
5146 /* Logical link is ready to go */
5147 chan->hs_hcon = hchan->conn;
5148 chan->hs_hcon->l2cap_data = chan->conn;
5149 chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;
5150 l2cap_send_move_chan_rsp(chan, L2CAP_MR_SUCCESS);
5151
5152 l2cap_logical_cfm(chan, hchan, L2CAP_MR_SUCCESS);
5153 } else {
5154 /* Wait for logical link to be ready */
5155 chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;
5156 }
5157 } else {
5158 /* Logical link not available */
5159 l2cap_send_move_chan_rsp(chan, L2CAP_MR_NOT_ALLOWED);
5160 }
5161 }
5162
5163 static void l2cap_do_move_cancel(struct l2cap_chan *chan, int result)
5164 {
5165 if (chan->move_role == L2CAP_MOVE_ROLE_RESPONDER) {
5166 u8 rsp_result;
5167 if (result == -EINVAL)
5168 rsp_result = L2CAP_MR_BAD_ID;
5169 else
5170 rsp_result = L2CAP_MR_NOT_ALLOWED;
5171
5172 l2cap_send_move_chan_rsp(chan, rsp_result);
5173 }
5174
5175 chan->move_role = L2CAP_MOVE_ROLE_NONE;
5176 chan->move_state = L2CAP_MOVE_STABLE;
5177
5178 /* Restart data transmission */
5179 l2cap_ertm_send(chan);
5180 }
5181
5182 /* Invoke with locked chan */
5183 void __l2cap_physical_cfm(struct l2cap_chan *chan, int result)
5184 {
5185 u8 local_amp_id = chan->local_amp_id;
5186 u8 remote_amp_id = chan->remote_amp_id;
5187
5188 BT_DBG("chan %p, result %d, local_amp_id %d, remote_amp_id %d",
5189 chan, result, local_amp_id, remote_amp_id);
5190
5191 if (chan->state == BT_DISCONN || chan->state == BT_CLOSED)
5192 return;
5193
5194 if (chan->state != BT_CONNECTED) {
5195 l2cap_do_create(chan, result, local_amp_id, remote_amp_id);
5196 } else if (result != L2CAP_MR_SUCCESS) {
5197 l2cap_do_move_cancel(chan, result);
5198 } else {
5199 switch (chan->move_role) {
5200 case L2CAP_MOVE_ROLE_INITIATOR:
5201 l2cap_do_move_initiate(chan, local_amp_id,
5202 remote_amp_id);
5203 break;
5204 case L2CAP_MOVE_ROLE_RESPONDER:
5205 l2cap_do_move_respond(chan, result);
5206 break;
5207 default:
5208 l2cap_do_move_cancel(chan, result);
5209 break;
5210 }
5211 }
5212 }
5213
5214 static inline int l2cap_move_channel_req(struct l2cap_conn *conn,
5215 struct l2cap_cmd_hdr *cmd,
5216 u16 cmd_len, void *data)
5217 {
5218 struct l2cap_move_chan_req *req = data;
5219 struct l2cap_move_chan_rsp rsp;
5220 struct l2cap_chan *chan;
5221 u16 icid = 0;
5222 u16 result = L2CAP_MR_NOT_ALLOWED;
5223
5224 if (cmd_len != sizeof(*req))
5225 return -EPROTO;
5226
5227 icid = le16_to_cpu(req->icid);
5228
5229 BT_DBG("icid 0x%4.4x, dest_amp_id %d", icid, req->dest_amp_id);
5230
5231 if (!(conn->local_fixed_chan & L2CAP_FC_A2MP))
5232 return -EINVAL;
5233
5234 chan = l2cap_get_chan_by_dcid(conn, icid);
5235 if (!chan) {
5236 rsp.icid = cpu_to_le16(icid);
5237 rsp.result = cpu_to_le16(L2CAP_MR_NOT_ALLOWED);
5238 l2cap_send_cmd(conn, cmd->ident, L2CAP_MOVE_CHAN_RSP,
5239 sizeof(rsp), &rsp);
5240 return 0;
5241 }
5242
5243 chan->ident = cmd->ident;
5244
5245 if (chan->scid < L2CAP_CID_DYN_START ||
5246 chan->chan_policy == BT_CHANNEL_POLICY_BREDR_ONLY ||
5247 (chan->mode != L2CAP_MODE_ERTM &&
5248 chan->mode != L2CAP_MODE_STREAMING)) {
5249 result = L2CAP_MR_NOT_ALLOWED;
5250 goto send_move_response;
5251 }
5252
5253 if (chan->local_amp_id == req->dest_amp_id) {
5254 result = L2CAP_MR_SAME_ID;
5255 goto send_move_response;
5256 }
5257
5258 if (req->dest_amp_id != AMP_ID_BREDR) {
5259 struct hci_dev *hdev;
5260 hdev = hci_dev_get(req->dest_amp_id);
5261 if (!hdev || hdev->dev_type != HCI_AMP ||
5262 !test_bit(HCI_UP, &hdev->flags)) {
5263 if (hdev)
5264 hci_dev_put(hdev);
5265
5266 result = L2CAP_MR_BAD_ID;
5267 goto send_move_response;
5268 }
5269 hci_dev_put(hdev);
5270 }
5271
5272 /* Detect a move collision. Only send a collision response
5273 * if this side has "lost", otherwise proceed with the move.
5274 * The winner has the larger bd_addr.
5275 */
5276 if ((__chan_is_moving(chan) ||
5277 chan->move_role != L2CAP_MOVE_ROLE_NONE) &&
5278 bacmp(&conn->hcon->src, &conn->hcon->dst) > 0) {
5279 result = L2CAP_MR_COLLISION;
5280 goto send_move_response;
5281 }
5282
5283 chan->move_role = L2CAP_MOVE_ROLE_RESPONDER;
5284 l2cap_move_setup(chan);
5285 chan->move_id = req->dest_amp_id;
5286
5287 if (req->dest_amp_id == AMP_ID_BREDR) {
5288 /* Moving to BR/EDR */
5289 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
5290 chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;
5291 result = L2CAP_MR_PEND;
5292 } else {
5293 chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;
5294 result = L2CAP_MR_SUCCESS;
5295 }
5296 } else {
5297 chan->move_state = L2CAP_MOVE_WAIT_PREPARE;
5298 /* Placeholder - uncomment when amp functions are available */
5299 /*amp_accept_physical(chan, req->dest_amp_id);*/
5300 result = L2CAP_MR_PEND;
5301 }
5302
5303 send_move_response:
5304 l2cap_send_move_chan_rsp(chan, result);
5305
5306 l2cap_chan_unlock(chan);
5307
5308 return 0;
5309 }
5310
5311 static void l2cap_move_continue(struct l2cap_conn *conn, u16 icid, u16 result)
5312 {
5313 struct l2cap_chan *chan;
5314 struct hci_chan *hchan = NULL;
5315
5316 chan = l2cap_get_chan_by_scid(conn, icid);
5317 if (!chan) {
5318 l2cap_send_move_chan_cfm_icid(conn, icid);
5319 return;
5320 }
5321
5322 __clear_chan_timer(chan);
5323 if (result == L2CAP_MR_PEND)
5324 __set_chan_timer(chan, L2CAP_MOVE_ERTX_TIMEOUT);
5325
5326 switch (chan->move_state) {
5327 case L2CAP_MOVE_WAIT_LOGICAL_COMP:
5328 /* Move confirm will be sent when logical link
5329 * is complete.
5330 */
5331 chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;
5332 break;
5333 case L2CAP_MOVE_WAIT_RSP_SUCCESS:
5334 if (result == L2CAP_MR_PEND) {
5335 break;
5336 } else if (test_bit(CONN_LOCAL_BUSY,
5337 &chan->conn_state)) {
5338 chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;
5339 } else {
5340 /* Logical link is up or moving to BR/EDR,
5341 * proceed with move
5342 */
5343 chan->move_state = L2CAP_MOVE_WAIT_CONFIRM_RSP;
5344 l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);
5345 }
5346 break;
5347 case L2CAP_MOVE_WAIT_RSP:
5348 /* Moving to AMP */
5349 if (result == L2CAP_MR_SUCCESS) {
5350 /* Remote is ready, send confirm immediately
5351 * after logical link is ready
5352 */
5353 chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;
5354 } else {
5355 /* Both logical link and move success
5356 * are required to confirm
5357 */
5358 chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_COMP;
5359 }
5360
5361 /* Placeholder - get hci_chan for logical link */
5362 if (!hchan) {
5363 /* Logical link not available */
5364 l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);
5365 break;
5366 }
5367
5368 /* If the logical link is not yet connected, do not
5369 * send confirmation.
5370 */
5371 if (hchan->state != BT_CONNECTED)
5372 break;
5373
5374 /* Logical link is already ready to go */
5375
5376 chan->hs_hcon = hchan->conn;
5377 chan->hs_hcon->l2cap_data = chan->conn;
5378
5379 if (result == L2CAP_MR_SUCCESS) {
5380 /* Can confirm now */
5381 l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);
5382 } else {
5383 /* Now only need move success
5384 * to confirm
5385 */
5386 chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;
5387 }
5388
5389 l2cap_logical_cfm(chan, hchan, L2CAP_MR_SUCCESS);
5390 break;
5391 default:
5392 /* Any other amp move state means the move failed. */
5393 chan->move_id = chan->local_amp_id;
5394 l2cap_move_done(chan);
5395 l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);
5396 }
5397
5398 l2cap_chan_unlock(chan);
5399 }
5400
5401 static void l2cap_move_fail(struct l2cap_conn *conn, u8 ident, u16 icid,
5402 u16 result)
5403 {
5404 struct l2cap_chan *chan;
5405
5406 chan = l2cap_get_chan_by_ident(conn, ident);
5407 if (!chan) {
5408 /* Could not locate channel, icid is best guess */
5409 l2cap_send_move_chan_cfm_icid(conn, icid);
5410 return;
5411 }
5412
5413 __clear_chan_timer(chan);
5414
5415 if (chan->move_role == L2CAP_MOVE_ROLE_INITIATOR) {
5416 if (result == L2CAP_MR_COLLISION) {
5417 chan->move_role = L2CAP_MOVE_ROLE_RESPONDER;
5418 } else {
5419 /* Cleanup - cancel move */
5420 chan->move_id = chan->local_amp_id;
5421 l2cap_move_done(chan);
5422 }
5423 }
5424
5425 l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);
5426
5427 l2cap_chan_unlock(chan);
5428 }
5429
5430 static int l2cap_move_channel_rsp(struct l2cap_conn *conn,
5431 struct l2cap_cmd_hdr *cmd,
5432 u16 cmd_len, void *data)
5433 {
5434 struct l2cap_move_chan_rsp *rsp = data;
5435 u16 icid, result;
5436
5437 if (cmd_len != sizeof(*rsp))
5438 return -EPROTO;
5439
5440 icid = le16_to_cpu(rsp->icid);
5441 result = le16_to_cpu(rsp->result);
5442
5443 BT_DBG("icid 0x%4.4x, result 0x%4.4x", icid, result);
5444
5445 if (result == L2CAP_MR_SUCCESS || result == L2CAP_MR_PEND)
5446 l2cap_move_continue(conn, icid, result);
5447 else
5448 l2cap_move_fail(conn, cmd->ident, icid, result);
5449
5450 return 0;
5451 }
5452
5453 static int l2cap_move_channel_confirm(struct l2cap_conn *conn,
5454 struct l2cap_cmd_hdr *cmd,
5455 u16 cmd_len, void *data)
5456 {
5457 struct l2cap_move_chan_cfm *cfm = data;
5458 struct l2cap_chan *chan;
5459 u16 icid, result;
5460
5461 if (cmd_len != sizeof(*cfm))
5462 return -EPROTO;
5463
5464 icid = le16_to_cpu(cfm->icid);
5465 result = le16_to_cpu(cfm->result);
5466
5467 BT_DBG("icid 0x%4.4x, result 0x%4.4x", icid, result);
5468
5469 chan = l2cap_get_chan_by_dcid(conn, icid);
5470 if (!chan) {
5471 /* Spec requires a response even if the icid was not found */
5472 l2cap_send_move_chan_cfm_rsp(conn, cmd->ident, icid);
5473 return 0;
5474 }
5475
5476 if (chan->move_state == L2CAP_MOVE_WAIT_CONFIRM) {
5477 if (result == L2CAP_MC_CONFIRMED) {
5478 chan->local_amp_id = chan->move_id;
5479 if (chan->local_amp_id == AMP_ID_BREDR)
5480 __release_logical_link(chan);
5481 } else {
5482 chan->move_id = chan->local_amp_id;
5483 }
5484
5485 l2cap_move_done(chan);
5486 }
5487
5488 l2cap_send_move_chan_cfm_rsp(conn, cmd->ident, icid);
5489
5490 l2cap_chan_unlock(chan);
5491
5492 return 0;
5493 }
5494
5495 static inline int l2cap_move_channel_confirm_rsp(struct l2cap_conn *conn,
5496 struct l2cap_cmd_hdr *cmd,
5497 u16 cmd_len, void *data)
5498 {
5499 struct l2cap_move_chan_cfm_rsp *rsp = data;
5500 struct l2cap_chan *chan;
5501 u16 icid;
5502
5503 if (cmd_len != sizeof(*rsp))
5504 return -EPROTO;
5505
5506 icid = le16_to_cpu(rsp->icid);
5507
5508 BT_DBG("icid 0x%4.4x", icid);
5509
5510 chan = l2cap_get_chan_by_scid(conn, icid);
5511 if (!chan)
5512 return 0;
5513
5514 __clear_chan_timer(chan);
5515
5516 if (chan->move_state == L2CAP_MOVE_WAIT_CONFIRM_RSP) {
5517 chan->local_amp_id = chan->move_id;
5518
5519 if (chan->local_amp_id == AMP_ID_BREDR && chan->hs_hchan)
5520 __release_logical_link(chan);
5521
5522 l2cap_move_done(chan);
5523 }
5524
5525 l2cap_chan_unlock(chan);
5526
5527 return 0;
5528 }
5529
5530 static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn,
5531 struct l2cap_cmd_hdr *cmd,
5532 u16 cmd_len, u8 *data)
5533 {
5534 struct hci_conn *hcon = conn->hcon;
5535 struct l2cap_conn_param_update_req *req;
5536 struct l2cap_conn_param_update_rsp rsp;
5537 u16 min, max, latency, to_multiplier;
5538 int err;
5539
5540 if (hcon->role != HCI_ROLE_MASTER)
5541 return -EINVAL;
5542
5543 if (cmd_len != sizeof(struct l2cap_conn_param_update_req))
5544 return -EPROTO;
5545
5546 req = (struct l2cap_conn_param_update_req *) data;
5547 min = __le16_to_cpu(req->min);
5548 max = __le16_to_cpu(req->max);
5549 latency = __le16_to_cpu(req->latency);
5550 to_multiplier = __le16_to_cpu(req->to_multiplier);
5551
5552 BT_DBG("min 0x%4.4x max 0x%4.4x latency: 0x%4.4x Timeout: 0x%4.4x",
5553 min, max, latency, to_multiplier);
5554
5555 memset(&rsp, 0, sizeof(rsp));
5556
5557 err = hci_check_conn_params(min, max, latency, to_multiplier);
5558 if (err)
5559 rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED);
5560 else
5561 rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_ACCEPTED);
5562
5563 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_PARAM_UPDATE_RSP,
5564 sizeof(rsp), &rsp);
5565
5566 if (!err) {
5567 u8 store_hint;
5568
5569 store_hint = hci_le_conn_update(hcon, min, max, latency,
5570 to_multiplier);
5571 mgmt_new_conn_param(hcon->hdev, &hcon->dst, hcon->dst_type,
5572 store_hint, min, max, latency,
5573 to_multiplier);
5574
5575 }
5576
5577 return 0;
5578 }
5579
5580 static int l2cap_le_connect_rsp(struct l2cap_conn *conn,
5581 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5582 u8 *data)
5583 {
5584 struct l2cap_le_conn_rsp *rsp = (struct l2cap_le_conn_rsp *) data;
5585 struct hci_conn *hcon = conn->hcon;
5586 u16 dcid, mtu, mps, credits, result;
5587 struct l2cap_chan *chan;
5588 int err, sec_level;
5589
5590 if (cmd_len < sizeof(*rsp))
5591 return -EPROTO;
5592
5593 dcid = __le16_to_cpu(rsp->dcid);
5594 mtu = __le16_to_cpu(rsp->mtu);
5595 mps = __le16_to_cpu(rsp->mps);
5596 credits = __le16_to_cpu(rsp->credits);
5597 result = __le16_to_cpu(rsp->result);
5598
5599 if (result == L2CAP_CR_LE_SUCCESS && (mtu < 23 || mps < 23 ||
5600 dcid < L2CAP_CID_DYN_START ||
5601 dcid > L2CAP_CID_LE_DYN_END))
5602 return -EPROTO;
5603
5604 BT_DBG("dcid 0x%4.4x mtu %u mps %u credits %u result 0x%2.2x",
5605 dcid, mtu, mps, credits, result);
5606
5607 mutex_lock(&conn->chan_lock);
5608
5609 chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
5610 if (!chan) {
5611 err = -EBADSLT;
5612 goto unlock;
5613 }
5614
5615 err = 0;
5616
5617 l2cap_chan_lock(chan);
5618
5619 switch (result) {
5620 case L2CAP_CR_LE_SUCCESS:
5621 if (__l2cap_get_chan_by_dcid(conn, dcid)) {
5622 err = -EBADSLT;
5623 break;
5624 }
5625
5626 chan->ident = 0;
5627 chan->dcid = dcid;
5628 chan->omtu = mtu;
5629 chan->remote_mps = mps;
5630 chan->tx_credits = credits;
5631 l2cap_chan_ready(chan);
5632 break;
5633
5634 case L2CAP_CR_LE_AUTHENTICATION:
5635 case L2CAP_CR_LE_ENCRYPTION:
5636 /* If we already have MITM protection we can't do
5637 * anything.
5638 */
5639 if (hcon->sec_level > BT_SECURITY_MEDIUM) {
5640 l2cap_chan_del(chan, ECONNREFUSED);
5641 break;
5642 }
5643
5644 sec_level = hcon->sec_level + 1;
5645 if (chan->sec_level < sec_level)
5646 chan->sec_level = sec_level;
5647
5648 /* We'll need to send a new Connect Request */
5649 clear_bit(FLAG_LE_CONN_REQ_SENT, &chan->flags);
5650
5651 smp_conn_security(hcon, chan->sec_level);
5652 break;
5653
5654 default:
5655 l2cap_chan_del(chan, ECONNREFUSED);
5656 break;
5657 }
5658
5659 l2cap_chan_unlock(chan);
5660
5661 unlock:
5662 mutex_unlock(&conn->chan_lock);
5663
5664 return err;
5665 }
5666
5667 static inline int l2cap_bredr_sig_cmd(struct l2cap_conn *conn,
5668 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5669 u8 *data)
5670 {
5671 int err = 0;
5672
5673 switch (cmd->code) {
5674 case L2CAP_COMMAND_REJ:
5675 l2cap_command_rej(conn, cmd, cmd_len, data);
5676 break;
5677
5678 case L2CAP_CONN_REQ:
5679 err = l2cap_connect_req(conn, cmd, cmd_len, data);
5680 break;
5681
5682 case L2CAP_CONN_RSP:
5683 case L2CAP_CREATE_CHAN_RSP:
5684 l2cap_connect_create_rsp(conn, cmd, cmd_len, data);
5685 break;
5686
5687 case L2CAP_CONF_REQ:
5688 err = l2cap_config_req(conn, cmd, cmd_len, data);
5689 break;
5690
5691 case L2CAP_CONF_RSP:
5692 l2cap_config_rsp(conn, cmd, cmd_len, data);
5693 break;
5694
5695 case L2CAP_DISCONN_REQ:
5696 err = l2cap_disconnect_req(conn, cmd, cmd_len, data);
5697 break;
5698
5699 case L2CAP_DISCONN_RSP:
5700 l2cap_disconnect_rsp(conn, cmd, cmd_len, data);
5701 break;
5702
5703 case L2CAP_ECHO_REQ:
5704 l2cap_send_cmd(conn, cmd->ident, L2CAP_ECHO_RSP, cmd_len, data);
5705 break;
5706
5707 case L2CAP_ECHO_RSP:
5708 break;
5709
5710 case L2CAP_INFO_REQ:
5711 err = l2cap_information_req(conn, cmd, cmd_len, data);
5712 break;
5713
5714 case L2CAP_INFO_RSP:
5715 l2cap_information_rsp(conn, cmd, cmd_len, data);
5716 break;
5717
5718 case L2CAP_CREATE_CHAN_REQ:
5719 err = l2cap_create_channel_req(conn, cmd, cmd_len, data);
5720 break;
5721
5722 case L2CAP_MOVE_CHAN_REQ:
5723 err = l2cap_move_channel_req(conn, cmd, cmd_len, data);
5724 break;
5725
5726 case L2CAP_MOVE_CHAN_RSP:
5727 l2cap_move_channel_rsp(conn, cmd, cmd_len, data);
5728 break;
5729
5730 case L2CAP_MOVE_CHAN_CFM:
5731 err = l2cap_move_channel_confirm(conn, cmd, cmd_len, data);
5732 break;
5733
5734 case L2CAP_MOVE_CHAN_CFM_RSP:
5735 l2cap_move_channel_confirm_rsp(conn, cmd, cmd_len, data);
5736 break;
5737
5738 default:
5739 BT_ERR("Unknown BR/EDR signaling command 0x%2.2x", cmd->code);
5740 err = -EINVAL;
5741 break;
5742 }
5743
5744 return err;
5745 }
5746
5747 static int l2cap_le_connect_req(struct l2cap_conn *conn,
5748 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5749 u8 *data)
5750 {
5751 struct l2cap_le_conn_req *req = (struct l2cap_le_conn_req *) data;
5752 struct l2cap_le_conn_rsp rsp;
5753 struct l2cap_chan *chan, *pchan;
5754 u16 dcid, scid, credits, mtu, mps;
5755 __le16 psm;
5756 u8 result;
5757
5758 if (cmd_len != sizeof(*req))
5759 return -EPROTO;
5760
5761 scid = __le16_to_cpu(req->scid);
5762 mtu = __le16_to_cpu(req->mtu);
5763 mps = __le16_to_cpu(req->mps);
5764 psm = req->psm;
5765 dcid = 0;
5766 credits = 0;
5767
5768 if (mtu < 23 || mps < 23)
5769 return -EPROTO;
5770
5771 BT_DBG("psm 0x%2.2x scid 0x%4.4x mtu %u mps %u", __le16_to_cpu(psm),
5772 scid, mtu, mps);
5773
5774 /* Check if we have socket listening on psm */
5775 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src,
5776 &conn->hcon->dst, LE_LINK);
5777 if (!pchan) {
5778 result = L2CAP_CR_LE_BAD_PSM;
5779 chan = NULL;
5780 goto response;
5781 }
5782
5783 mutex_lock(&conn->chan_lock);
5784 l2cap_chan_lock(pchan);
5785
5786 if (!smp_sufficient_security(conn->hcon, pchan->sec_level,
5787 SMP_ALLOW_STK)) {
5788 result = L2CAP_CR_LE_AUTHENTICATION;
5789 chan = NULL;
5790 goto response_unlock;
5791 }
5792
5793 /* Check for valid dynamic CID range */
5794 if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_LE_DYN_END) {
5795 result = L2CAP_CR_LE_INVALID_SCID;
5796 chan = NULL;
5797 goto response_unlock;
5798 }
5799
5800 /* Check if we already have channel with that dcid */
5801 if (__l2cap_get_chan_by_dcid(conn, scid)) {
5802 result = L2CAP_CR_LE_SCID_IN_USE;
5803 chan = NULL;
5804 goto response_unlock;
5805 }
5806
5807 chan = pchan->ops->new_connection(pchan);
5808 if (!chan) {
5809 result = L2CAP_CR_LE_NO_MEM;
5810 goto response_unlock;
5811 }
5812
5813 bacpy(&chan->src, &conn->hcon->src);
5814 bacpy(&chan->dst, &conn->hcon->dst);
5815 chan->src_type = bdaddr_src_type(conn->hcon);
5816 chan->dst_type = bdaddr_dst_type(conn->hcon);
5817 chan->psm = psm;
5818 chan->dcid = scid;
5819 chan->omtu = mtu;
5820 chan->remote_mps = mps;
5821
5822 __l2cap_chan_add(conn, chan);
5823
5824 l2cap_le_flowctl_init(chan, __le16_to_cpu(req->credits));
5825
5826 dcid = chan->scid;
5827 credits = chan->rx_credits;
5828
5829 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
5830
5831 chan->ident = cmd->ident;
5832
5833 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
5834 l2cap_state_change(chan, BT_CONNECT2);
5835 /* The following result value is actually not defined
5836 * for LE CoC but we use it to let the function know
5837 * that it should bail out after doing its cleanup
5838 * instead of sending a response.
5839 */
5840 result = L2CAP_CR_PEND;
5841 chan->ops->defer(chan);
5842 } else {
5843 l2cap_chan_ready(chan);
5844 result = L2CAP_CR_LE_SUCCESS;
5845 }
5846
5847 response_unlock:
5848 l2cap_chan_unlock(pchan);
5849 mutex_unlock(&conn->chan_lock);
5850 l2cap_chan_put(pchan);
5851
5852 if (result == L2CAP_CR_PEND)
5853 return 0;
5854
5855 response:
5856 if (chan) {
5857 rsp.mtu = cpu_to_le16(chan->imtu);
5858 rsp.mps = cpu_to_le16(chan->mps);
5859 } else {
5860 rsp.mtu = 0;
5861 rsp.mps = 0;
5862 }
5863
5864 rsp.dcid = cpu_to_le16(dcid);
5865 rsp.credits = cpu_to_le16(credits);
5866 rsp.result = cpu_to_le16(result);
5867
5868 l2cap_send_cmd(conn, cmd->ident, L2CAP_LE_CONN_RSP, sizeof(rsp), &rsp);
5869
5870 return 0;
5871 }
5872
5873 static inline int l2cap_le_credits(struct l2cap_conn *conn,
5874 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5875 u8 *data)
5876 {
5877 struct l2cap_le_credits *pkt;
5878 struct l2cap_chan *chan;
5879 u16 cid, credits, max_credits;
5880
5881 if (cmd_len != sizeof(*pkt))
5882 return -EPROTO;
5883
5884 pkt = (struct l2cap_le_credits *) data;
5885 cid = __le16_to_cpu(pkt->cid);
5886 credits = __le16_to_cpu(pkt->credits);
5887
5888 BT_DBG("cid 0x%4.4x credits 0x%4.4x", cid, credits);
5889
5890 chan = l2cap_get_chan_by_dcid(conn, cid);
5891 if (!chan)
5892 return -EBADSLT;
5893
5894 max_credits = LE_FLOWCTL_MAX_CREDITS - chan->tx_credits;
5895 if (credits > max_credits) {
5896 BT_ERR("LE credits overflow");
5897 l2cap_send_disconn_req(chan, ECONNRESET);
5898 l2cap_chan_unlock(chan);
5899
5900 /* Return 0 so that we don't trigger an unnecessary
5901 * command reject packet.
5902 */
5903 return 0;
5904 }
5905
5906 chan->tx_credits += credits;
5907
5908 /* Resume sending */
5909 l2cap_le_flowctl_send(chan);
5910
5911 if (chan->tx_credits)
5912 chan->ops->resume(chan);
5913
5914 l2cap_chan_unlock(chan);
5915
5916 return 0;
5917 }
5918
5919 static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn,
5920 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5921 u8 *data)
5922 {
5923 struct l2cap_ecred_conn_req *req = (void *) data;
5924 struct {
5925 struct l2cap_ecred_conn_rsp rsp;
5926 __le16 dcid[L2CAP_ECRED_MAX_CID];
5927 } __packed pdu;
5928 struct l2cap_chan *chan, *pchan;
5929 u16 mtu, mps;
5930 __le16 psm;
5931 u8 result, len = 0;
5932 int i, num_scid;
5933 bool defer = false;
5934
5935 if (!enable_ecred)
5936 return -EINVAL;
5937
5938 if (cmd_len < sizeof(*req) || (cmd_len - sizeof(*req)) % sizeof(u16)) {
5939 result = L2CAP_CR_LE_INVALID_PARAMS;
5940 goto response;
5941 }
5942
5943 cmd_len -= sizeof(*req);
5944 num_scid = cmd_len / sizeof(u16);
5945
5946 if (num_scid > ARRAY_SIZE(pdu.dcid)) {
5947 result = L2CAP_CR_LE_INVALID_PARAMS;
5948 goto response;
5949 }
5950
5951 mtu = __le16_to_cpu(req->mtu);
5952 mps = __le16_to_cpu(req->mps);
5953
5954 if (mtu < L2CAP_ECRED_MIN_MTU || mps < L2CAP_ECRED_MIN_MPS) {
5955 result = L2CAP_CR_LE_UNACCEPT_PARAMS;
5956 goto response;
5957 }
5958
5959 psm = req->psm;
5960
5961 BT_DBG("psm 0x%2.2x mtu %u mps %u", __le16_to_cpu(psm), mtu, mps);
5962
5963 memset(&pdu, 0, sizeof(pdu));
5964
5965 /* Check if we have socket listening on psm */
5966 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src,
5967 &conn->hcon->dst, LE_LINK);
5968 if (!pchan) {
5969 result = L2CAP_CR_LE_BAD_PSM;
5970 goto response;
5971 }
5972
5973 mutex_lock(&conn->chan_lock);
5974 l2cap_chan_lock(pchan);
5975
5976 if (!smp_sufficient_security(conn->hcon, pchan->sec_level,
5977 SMP_ALLOW_STK)) {
5978 result = L2CAP_CR_LE_AUTHENTICATION;
5979 goto unlock;
5980 }
5981
5982 result = L2CAP_CR_LE_SUCCESS;
5983
5984 for (i = 0; i < num_scid; i++) {
5985 u16 scid = __le16_to_cpu(req->scid[i]);
5986
5987 BT_DBG("scid[%d] 0x%4.4x", i, scid);
5988
5989 pdu.dcid[i] = 0x0000;
5990 len += sizeof(*pdu.dcid);
5991
5992 /* Check for valid dynamic CID range */
5993 if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_LE_DYN_END) {
5994 result = L2CAP_CR_LE_INVALID_SCID;
5995 continue;
5996 }
5997
5998 /* Check if we already have channel with that dcid */
5999 if (__l2cap_get_chan_by_dcid(conn, scid)) {
6000 result = L2CAP_CR_LE_SCID_IN_USE;
6001 continue;
6002 }
6003
6004 chan = pchan->ops->new_connection(pchan);
6005 if (!chan) {
6006 result = L2CAP_CR_LE_NO_MEM;
6007 continue;
6008 }
6009
6010 bacpy(&chan->src, &conn->hcon->src);
6011 bacpy(&chan->dst, &conn->hcon->dst);
6012 chan->src_type = bdaddr_src_type(conn->hcon);
6013 chan->dst_type = bdaddr_dst_type(conn->hcon);
6014 chan->psm = psm;
6015 chan->dcid = scid;
6016 chan->omtu = mtu;
6017 chan->remote_mps = mps;
6018
6019 __l2cap_chan_add(conn, chan);
6020
6021 l2cap_ecred_init(chan, __le16_to_cpu(req->credits));
6022
6023 /* Init response */
6024 if (!pdu.rsp.credits) {
6025 pdu.rsp.mtu = cpu_to_le16(chan->imtu);
6026 pdu.rsp.mps = cpu_to_le16(chan->mps);
6027 pdu.rsp.credits = cpu_to_le16(chan->rx_credits);
6028 }
6029
6030 pdu.dcid[i] = cpu_to_le16(chan->scid);
6031
6032 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
6033
6034 chan->ident = cmd->ident;
6035
6036 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
6037 l2cap_state_change(chan, BT_CONNECT2);
6038 defer = true;
6039 chan->ops->defer(chan);
6040 } else {
6041 l2cap_chan_ready(chan);
6042 }
6043 }
6044
6045 unlock:
6046 l2cap_chan_unlock(pchan);
6047 mutex_unlock(&conn->chan_lock);
6048 l2cap_chan_put(pchan);
6049
6050 response:
6051 pdu.rsp.result = cpu_to_le16(result);
6052
6053 if (defer)
6054 return 0;
6055
6056 l2cap_send_cmd(conn, cmd->ident, L2CAP_ECRED_CONN_RSP,
6057 sizeof(pdu.rsp) + len, &pdu);
6058
6059 return 0;
6060 }
6061
6062 static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn,
6063 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
6064 u8 *data)
6065 {
6066 struct l2cap_ecred_conn_rsp *rsp = (void *) data;
6067 struct hci_conn *hcon = conn->hcon;
6068 u16 mtu, mps, credits, result;
6069 struct l2cap_chan *chan, *tmp;
6070 int err = 0, sec_level;
6071 int i = 0;
6072
6073 if (cmd_len < sizeof(*rsp))
6074 return -EPROTO;
6075
6076 mtu = __le16_to_cpu(rsp->mtu);
6077 mps = __le16_to_cpu(rsp->mps);
6078 credits = __le16_to_cpu(rsp->credits);
6079 result = __le16_to_cpu(rsp->result);
6080
6081 BT_DBG("mtu %u mps %u credits %u result 0x%4.4x", mtu, mps, credits,
6082 result);
6083
6084 mutex_lock(&conn->chan_lock);
6085
6086 cmd_len -= sizeof(*rsp);
6087
6088 list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
6089 u16 dcid;
6090
6091 if (chan->ident != cmd->ident ||
6092 chan->mode != L2CAP_MODE_EXT_FLOWCTL ||
6093 chan->state == BT_CONNECTED)
6094 continue;
6095
6096 l2cap_chan_lock(chan);
6097
6098 /* Check that there is a dcid for each pending channel */
6099 if (cmd_len < sizeof(dcid)) {
6100 l2cap_chan_del(chan, ECONNREFUSED);
6101 l2cap_chan_unlock(chan);
6102 continue;
6103 }
6104
6105 dcid = __le16_to_cpu(rsp->dcid[i++]);
6106 cmd_len -= sizeof(u16);
6107
6108 BT_DBG("dcid[%d] 0x%4.4x", i, dcid);
6109
6110 /* Check if dcid is already in use */
6111 if (dcid && __l2cap_get_chan_by_dcid(conn, dcid)) {
6112 /* If a device receives a
6113 * L2CAP_CREDIT_BASED_CONNECTION_RSP packet with an
6114 * already-assigned Destination CID, then both the
6115 * original channel and the new channel shall be
6116 * immediately discarded and not used.
6117 */
6118 l2cap_chan_del(chan, ECONNREFUSED);
6119 l2cap_chan_unlock(chan);
6120 chan = __l2cap_get_chan_by_dcid(conn, dcid);
6121 l2cap_chan_lock(chan);
6122 l2cap_chan_del(chan, ECONNRESET);
6123 l2cap_chan_unlock(chan);
6124 continue;
6125 }
6126
6127 switch (result) {
6128 case L2CAP_CR_LE_AUTHENTICATION:
6129 case L2CAP_CR_LE_ENCRYPTION:
6130 /* If we already have MITM protection we can't do
6131 * anything.
6132 */
6133 if (hcon->sec_level > BT_SECURITY_MEDIUM) {
6134 l2cap_chan_del(chan, ECONNREFUSED);
6135 break;
6136 }
6137
6138 sec_level = hcon->sec_level + 1;
6139 if (chan->sec_level < sec_level)
6140 chan->sec_level = sec_level;
6141
6142 /* We'll need to send a new Connect Request */
6143 clear_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags);
6144
6145 smp_conn_security(hcon, chan->sec_level);
6146 break;
6147
6148 case L2CAP_CR_LE_BAD_PSM:
6149 l2cap_chan_del(chan, ECONNREFUSED);
6150 break;
6151
6152 default:
6153 /* If dcid was not set it means channels was refused */
6154 if (!dcid) {
6155 l2cap_chan_del(chan, ECONNREFUSED);
6156 break;
6157 }
6158
6159 chan->ident = 0;
6160 chan->dcid = dcid;
6161 chan->omtu = mtu;
6162 chan->remote_mps = mps;
6163 chan->tx_credits = credits;
6164 l2cap_chan_ready(chan);
6165 break;
6166 }
6167
6168 l2cap_chan_unlock(chan);
6169 }
6170
6171 mutex_unlock(&conn->chan_lock);
6172
6173 return err;
6174 }
6175
6176 static inline int l2cap_ecred_reconf_req(struct l2cap_conn *conn,
6177 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
6178 u8 *data)
6179 {
6180 struct l2cap_ecred_reconf_req *req = (void *) data;
6181 struct l2cap_ecred_reconf_rsp rsp;
6182 u16 mtu, mps, result;
6183 struct l2cap_chan *chan;
6184 int i, num_scid;
6185
6186 if (!enable_ecred)
6187 return -EINVAL;
6188
6189 if (cmd_len < sizeof(*req) || cmd_len - sizeof(*req) % sizeof(u16)) {
6190 result = L2CAP_CR_LE_INVALID_PARAMS;
6191 goto respond;
6192 }
6193
6194 mtu = __le16_to_cpu(req->mtu);
6195 mps = __le16_to_cpu(req->mps);
6196
6197 BT_DBG("mtu %u mps %u", mtu, mps);
6198
6199 if (mtu < L2CAP_ECRED_MIN_MTU) {
6200 result = L2CAP_RECONF_INVALID_MTU;
6201 goto respond;
6202 }
6203
6204 if (mps < L2CAP_ECRED_MIN_MPS) {
6205 result = L2CAP_RECONF_INVALID_MPS;
6206 goto respond;
6207 }
6208
6209 cmd_len -= sizeof(*req);
6210 num_scid = cmd_len / sizeof(u16);
6211 result = L2CAP_RECONF_SUCCESS;
6212
6213 for (i = 0; i < num_scid; i++) {
6214 u16 scid;
6215
6216 scid = __le16_to_cpu(req->scid[i]);
6217 if (!scid)
6218 return -EPROTO;
6219
6220 chan = __l2cap_get_chan_by_dcid(conn, scid);
6221 if (!chan)
6222 continue;
6223
6224 /* If the MTU value is decreased for any of the included
6225 * channels, then the receiver shall disconnect all
6226 * included channels.
6227 */
6228 if (chan->omtu > mtu) {
6229 BT_ERR("chan %p decreased MTU %u -> %u", chan,
6230 chan->omtu, mtu);
6231 result = L2CAP_RECONF_INVALID_MTU;
6232 }
6233
6234 chan->omtu = mtu;
6235 chan->remote_mps = mps;
6236 }
6237
6238 respond:
6239 rsp.result = cpu_to_le16(result);
6240
6241 l2cap_send_cmd(conn, cmd->ident, L2CAP_ECRED_RECONF_RSP, sizeof(rsp),
6242 &rsp);
6243
6244 return 0;
6245 }
6246
6247 static inline int l2cap_ecred_reconf_rsp(struct l2cap_conn *conn,
6248 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
6249 u8 *data)
6250 {
6251 struct l2cap_chan *chan, *tmp;
6252 struct l2cap_ecred_conn_rsp *rsp = (void *) data;
6253 u16 result;
6254
6255 if (cmd_len < sizeof(*rsp))
6256 return -EPROTO;
6257
6258 result = __le16_to_cpu(rsp->result);
6259
6260 BT_DBG("result 0x%4.4x", rsp->result);
6261
6262 if (!result)
6263 return 0;
6264
6265 list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
6266 if (chan->ident != cmd->ident)
6267 continue;
6268
6269 l2cap_chan_del(chan, ECONNRESET);
6270 }
6271
6272 return 0;
6273 }
6274
6275 static inline int l2cap_le_command_rej(struct l2cap_conn *conn,
6276 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
6277 u8 *data)
6278 {
6279 struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data;
6280 struct l2cap_chan *chan;
6281
6282 if (cmd_len < sizeof(*rej))
6283 return -EPROTO;
6284
6285 mutex_lock(&conn->chan_lock);
6286
6287 chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
6288 if (!chan)
6289 goto done;
6290
6291 l2cap_chan_lock(chan);
6292 l2cap_chan_del(chan, ECONNREFUSED);
6293 l2cap_chan_unlock(chan);
6294
6295 done:
6296 mutex_unlock(&conn->chan_lock);
6297 return 0;
6298 }
6299
6300 static inline int l2cap_le_sig_cmd(struct l2cap_conn *conn,
6301 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
6302 u8 *data)
6303 {
6304 int err = 0;
6305
6306 switch (cmd->code) {
6307 case L2CAP_COMMAND_REJ:
6308 l2cap_le_command_rej(conn, cmd, cmd_len, data);
6309 break;
6310
6311 case L2CAP_CONN_PARAM_UPDATE_REQ:
6312 err = l2cap_conn_param_update_req(conn, cmd, cmd_len, data);
6313 break;
6314
6315 case L2CAP_CONN_PARAM_UPDATE_RSP:
6316 break;
6317
6318 case L2CAP_LE_CONN_RSP:
6319 l2cap_le_connect_rsp(conn, cmd, cmd_len, data);
6320 break;
6321
6322 case L2CAP_LE_CONN_REQ:
6323 err = l2cap_le_connect_req(conn, cmd, cmd_len, data);
6324 break;
6325
6326 case L2CAP_LE_CREDITS:
6327 err = l2cap_le_credits(conn, cmd, cmd_len, data);
6328 break;
6329
6330 case L2CAP_ECRED_CONN_REQ:
6331 err = l2cap_ecred_conn_req(conn, cmd, cmd_len, data);
6332 break;
6333
6334 case L2CAP_ECRED_CONN_RSP:
6335 err = l2cap_ecred_conn_rsp(conn, cmd, cmd_len, data);
6336 break;
6337
6338 case L2CAP_ECRED_RECONF_REQ:
6339 err = l2cap_ecred_reconf_req(conn, cmd, cmd_len, data);
6340 break;
6341
6342 case L2CAP_ECRED_RECONF_RSP:
6343 err = l2cap_ecred_reconf_rsp(conn, cmd, cmd_len, data);
6344 break;
6345
6346 case L2CAP_DISCONN_REQ:
6347 err = l2cap_disconnect_req(conn, cmd, cmd_len, data);
6348 break;
6349
6350 case L2CAP_DISCONN_RSP:
6351 l2cap_disconnect_rsp(conn, cmd, cmd_len, data);
6352 break;
6353
6354 default:
6355 BT_ERR("Unknown LE signaling command 0x%2.2x", cmd->code);
6356 err = -EINVAL;
6357 break;
6358 }
6359
6360 return err;
6361 }
6362
6363 static inline void l2cap_le_sig_channel(struct l2cap_conn *conn,
6364 struct sk_buff *skb)
6365 {
6366 struct hci_conn *hcon = conn->hcon;
6367 struct l2cap_cmd_hdr *cmd;
6368 u16 len;
6369 int err;
6370
6371 if (hcon->type != LE_LINK)
6372 goto drop;
6373
6374 if (skb->len < L2CAP_CMD_HDR_SIZE)
6375 goto drop;
6376
6377 cmd = (void *) skb->data;
6378 skb_pull(skb, L2CAP_CMD_HDR_SIZE);
6379
6380 len = le16_to_cpu(cmd->len);
6381
6382 BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd->code, len, cmd->ident);
6383
6384 if (len != skb->len || !cmd->ident) {
6385 BT_DBG("corrupted command");
6386 goto drop;
6387 }
6388
6389 err = l2cap_le_sig_cmd(conn, cmd, len, skb->data);
6390 if (err) {
6391 struct l2cap_cmd_rej_unk rej;
6392
6393 BT_ERR("Wrong link type (%d)", err);
6394
6395 rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
6396 l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ,
6397 sizeof(rej), &rej);
6398 }
6399
6400 drop:
6401 kfree_skb(skb);
6402 }
6403
6404 static inline void l2cap_sig_channel(struct l2cap_conn *conn,
6405 struct sk_buff *skb)
6406 {
6407 struct hci_conn *hcon = conn->hcon;
6408 struct l2cap_cmd_hdr *cmd;
6409 int err;
6410
6411 l2cap_raw_recv(conn, skb);
6412
6413 if (hcon->type != ACL_LINK)
6414 goto drop;
6415
6416 while (skb->len >= L2CAP_CMD_HDR_SIZE) {
6417 u16 len;
6418
6419 cmd = (void *) skb->data;
6420 skb_pull(skb, L2CAP_CMD_HDR_SIZE);
6421
6422 len = le16_to_cpu(cmd->len);
6423
6424 BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd->code, len,
6425 cmd->ident);
6426
6427 if (len > skb->len || !cmd->ident) {
6428 BT_DBG("corrupted command");
6429 break;
6430 }
6431
6432 err = l2cap_bredr_sig_cmd(conn, cmd, len, skb->data);
6433 if (err) {
6434 struct l2cap_cmd_rej_unk rej;
6435
6436 BT_ERR("Wrong link type (%d)", err);
6437
6438 rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
6439 l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ,
6440 sizeof(rej), &rej);
6441 }
6442
6443 skb_pull(skb, len);
6444 }
6445
6446 drop:
6447 kfree_skb(skb);
6448 }
6449
6450 static int l2cap_check_fcs(struct l2cap_chan *chan, struct sk_buff *skb)
6451 {
6452 u16 our_fcs, rcv_fcs;
6453 int hdr_size;
6454
6455 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
6456 hdr_size = L2CAP_EXT_HDR_SIZE;
6457 else
6458 hdr_size = L2CAP_ENH_HDR_SIZE;
6459
6460 if (chan->fcs == L2CAP_FCS_CRC16) {
6461 skb_trim(skb, skb->len - L2CAP_FCS_SIZE);
6462 rcv_fcs = get_unaligned_le16(skb->data + skb->len);
6463 our_fcs = crc16(0, skb->data - hdr_size, skb->len + hdr_size);
6464
6465 if (our_fcs != rcv_fcs)
6466 return -EBADMSG;
6467 }
6468 return 0;
6469 }
6470
6471 static void l2cap_send_i_or_rr_or_rnr(struct l2cap_chan *chan)
6472 {
6473 struct l2cap_ctrl control;
6474
6475 BT_DBG("chan %p", chan);
6476
6477 memset(&control, 0, sizeof(control));
6478 control.sframe = 1;
6479 control.final = 1;
6480 control.reqseq = chan->buffer_seq;
6481 set_bit(CONN_SEND_FBIT, &chan->conn_state);
6482
6483 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
6484 control.super = L2CAP_SUPER_RNR;
6485 l2cap_send_sframe(chan, &control);
6486 }
6487
6488 if (test_and_clear_bit(CONN_REMOTE_BUSY, &chan->conn_state) &&
6489 chan->unacked_frames > 0)
6490 __set_retrans_timer(chan);
6491
6492 /* Send pending iframes */
6493 l2cap_ertm_send(chan);
6494
6495 if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&
6496 test_bit(CONN_SEND_FBIT, &chan->conn_state)) {
6497 /* F-bit wasn't sent in an s-frame or i-frame yet, so
6498 * send it now.
6499 */
6500 control.super = L2CAP_SUPER_RR;
6501 l2cap_send_sframe(chan, &control);
6502 }
6503 }
6504
6505 static void append_skb_frag(struct sk_buff *skb, struct sk_buff *new_frag,
6506 struct sk_buff **last_frag)
6507 {
6508 /* skb->len reflects data in skb as well as all fragments
6509 * skb->data_len reflects only data in fragments
6510 */
6511 if (!skb_has_frag_list(skb))
6512 skb_shinfo(skb)->frag_list = new_frag;
6513
6514 new_frag->next = NULL;
6515
6516 (*last_frag)->next = new_frag;
6517 *last_frag = new_frag;
6518
6519 skb->len += new_frag->len;
6520 skb->data_len += new_frag->len;
6521 skb->truesize += new_frag->truesize;
6522 }
6523
6524 static int l2cap_reassemble_sdu(struct l2cap_chan *chan, struct sk_buff *skb,
6525 struct l2cap_ctrl *control)
6526 {
6527 int err = -EINVAL;
6528
6529 switch (control->sar) {
6530 case L2CAP_SAR_UNSEGMENTED:
6531 if (chan->sdu)
6532 break;
6533
6534 err = chan->ops->recv(chan, skb);
6535 break;
6536
6537 case L2CAP_SAR_START:
6538 if (chan->sdu)
6539 break;
6540
6541 if (!pskb_may_pull(skb, L2CAP_SDULEN_SIZE))
6542 break;
6543
6544 chan->sdu_len = get_unaligned_le16(skb->data);
6545 skb_pull(skb, L2CAP_SDULEN_SIZE);
6546
6547 if (chan->sdu_len > chan->imtu) {
6548 err = -EMSGSIZE;
6549 break;
6550 }
6551
6552 if (skb->len >= chan->sdu_len)
6553 break;
6554
6555 chan->sdu = skb;
6556 chan->sdu_last_frag = skb;
6557
6558 skb = NULL;
6559 err = 0;
6560 break;
6561
6562 case L2CAP_SAR_CONTINUE:
6563 if (!chan->sdu)
6564 break;
6565
6566 append_skb_frag(chan->sdu, skb,
6567 &chan->sdu_last_frag);
6568 skb = NULL;
6569
6570 if (chan->sdu->len >= chan->sdu_len)
6571 break;
6572
6573 err = 0;
6574 break;
6575
6576 case L2CAP_SAR_END:
6577 if (!chan->sdu)
6578 break;
6579
6580 append_skb_frag(chan->sdu, skb,
6581 &chan->sdu_last_frag);
6582 skb = NULL;
6583
6584 if (chan->sdu->len != chan->sdu_len)
6585 break;
6586
6587 err = chan->ops->recv(chan, chan->sdu);
6588
6589 if (!err) {
6590 /* Reassembly complete */
6591 chan->sdu = NULL;
6592 chan->sdu_last_frag = NULL;
6593 chan->sdu_len = 0;
6594 }
6595 break;
6596 }
6597
6598 if (err) {
6599 kfree_skb(skb);
6600 kfree_skb(chan->sdu);
6601 chan->sdu = NULL;
6602 chan->sdu_last_frag = NULL;
6603 chan->sdu_len = 0;
6604 }
6605
6606 return err;
6607 }
6608
6609 static int l2cap_resegment(struct l2cap_chan *chan)
6610 {
6611 /* Placeholder */
6612 return 0;
6613 }
6614
6615 void l2cap_chan_busy(struct l2cap_chan *chan, int busy)
6616 {
6617 u8 event;
6618
6619 if (chan->mode != L2CAP_MODE_ERTM)
6620 return;
6621
6622 event = busy ? L2CAP_EV_LOCAL_BUSY_DETECTED : L2CAP_EV_LOCAL_BUSY_CLEAR;
6623 l2cap_tx(chan, NULL, NULL, event);
6624 }
6625
6626 static int l2cap_rx_queued_iframes(struct l2cap_chan *chan)
6627 {
6628 int err = 0;
6629 /* Pass sequential frames to l2cap_reassemble_sdu()
6630 * until a gap is encountered.
6631 */
6632
6633 BT_DBG("chan %p", chan);
6634
6635 while (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
6636 struct sk_buff *skb;
6637 BT_DBG("Searching for skb with txseq %d (queue len %d)",
6638 chan->buffer_seq, skb_queue_len(&chan->srej_q));
6639
6640 skb = l2cap_ertm_seq_in_queue(&chan->srej_q, chan->buffer_seq);
6641
6642 if (!skb)
6643 break;
6644
6645 skb_unlink(skb, &chan->srej_q);
6646 chan->buffer_seq = __next_seq(chan, chan->buffer_seq);
6647 err = l2cap_reassemble_sdu(chan, skb, &bt_cb(skb)->l2cap);
6648 if (err)
6649 break;
6650 }
6651
6652 if (skb_queue_empty(&chan->srej_q)) {
6653 chan->rx_state = L2CAP_RX_STATE_RECV;
6654 l2cap_send_ack(chan);
6655 }
6656
6657 return err;
6658 }
6659
6660 static void l2cap_handle_srej(struct l2cap_chan *chan,
6661 struct l2cap_ctrl *control)
6662 {
6663 struct sk_buff *skb;
6664
6665 BT_DBG("chan %p, control %p", chan, control);
6666
6667 if (control->reqseq == chan->next_tx_seq) {
6668 BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq);
6669 l2cap_send_disconn_req(chan, ECONNRESET);
6670 return;
6671 }
6672
6673 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);
6674
6675 if (skb == NULL) {
6676 BT_DBG("Seq %d not available for retransmission",
6677 control->reqseq);
6678 return;
6679 }
6680
6681 if (chan->max_tx != 0 && bt_cb(skb)->l2cap.retries >= chan->max_tx) {
6682 BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
6683 l2cap_send_disconn_req(chan, ECONNRESET);
6684 return;
6685 }
6686
6687 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6688
6689 if (control->poll) {
6690 l2cap_pass_to_tx(chan, control);
6691
6692 set_bit(CONN_SEND_FBIT, &chan->conn_state);
6693 l2cap_retransmit(chan, control);
6694 l2cap_ertm_send(chan);
6695
6696 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) {
6697 set_bit(CONN_SREJ_ACT, &chan->conn_state);
6698 chan->srej_save_reqseq = control->reqseq;
6699 }
6700 } else {
6701 l2cap_pass_to_tx_fbit(chan, control);
6702
6703 if (control->final) {
6704 if (chan->srej_save_reqseq != control->reqseq ||
6705 !test_and_clear_bit(CONN_SREJ_ACT,
6706 &chan->conn_state))
6707 l2cap_retransmit(chan, control);
6708 } else {
6709 l2cap_retransmit(chan, control);
6710 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) {
6711 set_bit(CONN_SREJ_ACT, &chan->conn_state);
6712 chan->srej_save_reqseq = control->reqseq;
6713 }
6714 }
6715 }
6716 }
6717
6718 static void l2cap_handle_rej(struct l2cap_chan *chan,
6719 struct l2cap_ctrl *control)
6720 {
6721 struct sk_buff *skb;
6722
6723 BT_DBG("chan %p, control %p", chan, control);
6724
6725 if (control->reqseq == chan->next_tx_seq) {
6726 BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq);
6727 l2cap_send_disconn_req(chan, ECONNRESET);
6728 return;
6729 }
6730
6731 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);
6732
6733 if (chan->max_tx && skb &&
6734 bt_cb(skb)->l2cap.retries >= chan->max_tx) {
6735 BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
6736 l2cap_send_disconn_req(chan, ECONNRESET);
6737 return;
6738 }
6739
6740 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6741
6742 l2cap_pass_to_tx(chan, control);
6743
6744 if (control->final) {
6745 if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))
6746 l2cap_retransmit_all(chan, control);
6747 } else {
6748 l2cap_retransmit_all(chan, control);
6749 l2cap_ertm_send(chan);
6750 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F)
6751 set_bit(CONN_REJ_ACT, &chan->conn_state);
6752 }
6753 }
6754
6755 static u8 l2cap_classify_txseq(struct l2cap_chan *chan, u16 txseq)
6756 {
6757 BT_DBG("chan %p, txseq %d", chan, txseq);
6758
6759 BT_DBG("last_acked_seq %d, expected_tx_seq %d", chan->last_acked_seq,
6760 chan->expected_tx_seq);
6761
6762 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
6763 if (__seq_offset(chan, txseq, chan->last_acked_seq) >=
6764 chan->tx_win) {
6765 /* See notes below regarding "double poll" and
6766 * invalid packets.
6767 */
6768 if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) {
6769 BT_DBG("Invalid/Ignore - after SREJ");
6770 return L2CAP_TXSEQ_INVALID_IGNORE;
6771 } else {
6772 BT_DBG("Invalid - in window after SREJ sent");
6773 return L2CAP_TXSEQ_INVALID;
6774 }
6775 }
6776
6777 if (chan->srej_list.head == txseq) {
6778 BT_DBG("Expected SREJ");
6779 return L2CAP_TXSEQ_EXPECTED_SREJ;
6780 }
6781
6782 if (l2cap_ertm_seq_in_queue(&chan->srej_q, txseq)) {
6783 BT_DBG("Duplicate SREJ - txseq already stored");
6784 return L2CAP_TXSEQ_DUPLICATE_SREJ;
6785 }
6786
6787 if (l2cap_seq_list_contains(&chan->srej_list, txseq)) {
6788 BT_DBG("Unexpected SREJ - not requested");
6789 return L2CAP_TXSEQ_UNEXPECTED_SREJ;
6790 }
6791 }
6792
6793 if (chan->expected_tx_seq == txseq) {
6794 if (__seq_offset(chan, txseq, chan->last_acked_seq) >=
6795 chan->tx_win) {
6796 BT_DBG("Invalid - txseq outside tx window");
6797 return L2CAP_TXSEQ_INVALID;
6798 } else {
6799 BT_DBG("Expected");
6800 return L2CAP_TXSEQ_EXPECTED;
6801 }
6802 }
6803
6804 if (__seq_offset(chan, txseq, chan->last_acked_seq) <
6805 __seq_offset(chan, chan->expected_tx_seq, chan->last_acked_seq)) {
6806 BT_DBG("Duplicate - expected_tx_seq later than txseq");
6807 return L2CAP_TXSEQ_DUPLICATE;
6808 }
6809
6810 if (__seq_offset(chan, txseq, chan->last_acked_seq) >= chan->tx_win) {
6811 /* A source of invalid packets is a "double poll" condition,
6812 * where delays cause us to send multiple poll packets. If
6813 * the remote stack receives and processes both polls,
6814 * sequence numbers can wrap around in such a way that a
6815 * resent frame has a sequence number that looks like new data
6816 * with a sequence gap. This would trigger an erroneous SREJ
6817 * request.
6818 *
6819 * Fortunately, this is impossible with a tx window that's
6820 * less than half of the maximum sequence number, which allows
6821 * invalid frames to be safely ignored.
6822 *
6823 * With tx window sizes greater than half of the tx window
6824 * maximum, the frame is invalid and cannot be ignored. This
6825 * causes a disconnect.
6826 */
6827
6828 if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) {
6829 BT_DBG("Invalid/Ignore - txseq outside tx window");
6830 return L2CAP_TXSEQ_INVALID_IGNORE;
6831 } else {
6832 BT_DBG("Invalid - txseq outside tx window");
6833 return L2CAP_TXSEQ_INVALID;
6834 }
6835 } else {
6836 BT_DBG("Unexpected - txseq indicates missing frames");
6837 return L2CAP_TXSEQ_UNEXPECTED;
6838 }
6839 }
6840
6841 static int l2cap_rx_state_recv(struct l2cap_chan *chan,
6842 struct l2cap_ctrl *control,
6843 struct sk_buff *skb, u8 event)
6844 {
6845 int err = 0;
6846 bool skb_in_use = false;
6847
6848 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
6849 event);
6850
6851 switch (event) {
6852 case L2CAP_EV_RECV_IFRAME:
6853 switch (l2cap_classify_txseq(chan, control->txseq)) {
6854 case L2CAP_TXSEQ_EXPECTED:
6855 l2cap_pass_to_tx(chan, control);
6856
6857 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
6858 BT_DBG("Busy, discarding expected seq %d",
6859 control->txseq);
6860 break;
6861 }
6862
6863 chan->expected_tx_seq = __next_seq(chan,
6864 control->txseq);
6865
6866 chan->buffer_seq = chan->expected_tx_seq;
6867 skb_in_use = true;
6868
6869 err = l2cap_reassemble_sdu(chan, skb, control);
6870 if (err)
6871 break;
6872
6873 if (control->final) {
6874 if (!test_and_clear_bit(CONN_REJ_ACT,
6875 &chan->conn_state)) {
6876 control->final = 0;
6877 l2cap_retransmit_all(chan, control);
6878 l2cap_ertm_send(chan);
6879 }
6880 }
6881
6882 if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state))
6883 l2cap_send_ack(chan);
6884 break;
6885 case L2CAP_TXSEQ_UNEXPECTED:
6886 l2cap_pass_to_tx(chan, control);
6887
6888 /* Can't issue SREJ frames in the local busy state.
6889 * Drop this frame, it will be seen as missing
6890 * when local busy is exited.
6891 */
6892 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
6893 BT_DBG("Busy, discarding unexpected seq %d",
6894 control->txseq);
6895 break;
6896 }
6897
6898 /* There was a gap in the sequence, so an SREJ
6899 * must be sent for each missing frame. The
6900 * current frame is stored for later use.
6901 */
6902 skb_queue_tail(&chan->srej_q, skb);
6903 skb_in_use = true;
6904 BT_DBG("Queued %p (queue len %d)", skb,
6905 skb_queue_len(&chan->srej_q));
6906
6907 clear_bit(CONN_SREJ_ACT, &chan->conn_state);
6908 l2cap_seq_list_clear(&chan->srej_list);
6909 l2cap_send_srej(chan, control->txseq);
6910
6911 chan->rx_state = L2CAP_RX_STATE_SREJ_SENT;
6912 break;
6913 case L2CAP_TXSEQ_DUPLICATE:
6914 l2cap_pass_to_tx(chan, control);
6915 break;
6916 case L2CAP_TXSEQ_INVALID_IGNORE:
6917 break;
6918 case L2CAP_TXSEQ_INVALID:
6919 default:
6920 l2cap_send_disconn_req(chan, ECONNRESET);
6921 break;
6922 }
6923 break;
6924 case L2CAP_EV_RECV_RR:
6925 l2cap_pass_to_tx(chan, control);
6926 if (control->final) {
6927 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6928
6929 if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state) &&
6930 !__chan_is_moving(chan)) {
6931 control->final = 0;
6932 l2cap_retransmit_all(chan, control);
6933 }
6934
6935 l2cap_ertm_send(chan);
6936 } else if (control->poll) {
6937 l2cap_send_i_or_rr_or_rnr(chan);
6938 } else {
6939 if (test_and_clear_bit(CONN_REMOTE_BUSY,
6940 &chan->conn_state) &&
6941 chan->unacked_frames)
6942 __set_retrans_timer(chan);
6943
6944 l2cap_ertm_send(chan);
6945 }
6946 break;
6947 case L2CAP_EV_RECV_RNR:
6948 set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6949 l2cap_pass_to_tx(chan, control);
6950 if (control && control->poll) {
6951 set_bit(CONN_SEND_FBIT, &chan->conn_state);
6952 l2cap_send_rr_or_rnr(chan, 0);
6953 }
6954 __clear_retrans_timer(chan);
6955 l2cap_seq_list_clear(&chan->retrans_list);
6956 break;
6957 case L2CAP_EV_RECV_REJ:
6958 l2cap_handle_rej(chan, control);
6959 break;
6960 case L2CAP_EV_RECV_SREJ:
6961 l2cap_handle_srej(chan, control);
6962 break;
6963 default:
6964 break;
6965 }
6966
6967 if (skb && !skb_in_use) {
6968 BT_DBG("Freeing %p", skb);
6969 kfree_skb(skb);
6970 }
6971
6972 return err;
6973 }
6974
6975 static int l2cap_rx_state_srej_sent(struct l2cap_chan *chan,
6976 struct l2cap_ctrl *control,
6977 struct sk_buff *skb, u8 event)
6978 {
6979 int err = 0;
6980 u16 txseq = control->txseq;
6981 bool skb_in_use = false;
6982
6983 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
6984 event);
6985
6986 switch (event) {
6987 case L2CAP_EV_RECV_IFRAME:
6988 switch (l2cap_classify_txseq(chan, txseq)) {
6989 case L2CAP_TXSEQ_EXPECTED:
6990 /* Keep frame for reassembly later */
6991 l2cap_pass_to_tx(chan, control);
6992 skb_queue_tail(&chan->srej_q, skb);
6993 skb_in_use = true;
6994 BT_DBG("Queued %p (queue len %d)", skb,
6995 skb_queue_len(&chan->srej_q));
6996
6997 chan->expected_tx_seq = __next_seq(chan, txseq);
6998 break;
6999 case L2CAP_TXSEQ_EXPECTED_SREJ:
7000 l2cap_seq_list_pop(&chan->srej_list);
7001
7002 l2cap_pass_to_tx(chan, control);
7003 skb_queue_tail(&chan->srej_q, skb);
7004 skb_in_use = true;
7005 BT_DBG("Queued %p (queue len %d)", skb,
7006 skb_queue_len(&chan->srej_q));
7007
7008 err = l2cap_rx_queued_iframes(chan);
7009 if (err)
7010 break;
7011
7012 break;
7013 case L2CAP_TXSEQ_UNEXPECTED:
7014 /* Got a frame that can't be reassembled yet.
7015 * Save it for later, and send SREJs to cover
7016 * the missing frames.
7017 */
7018 skb_queue_tail(&chan->srej_q, skb);
7019 skb_in_use = true;
7020 BT_DBG("Queued %p (queue len %d)", skb,
7021 skb_queue_len(&chan->srej_q));
7022
7023 l2cap_pass_to_tx(chan, control);
7024 l2cap_send_srej(chan, control->txseq);
7025 break;
7026 case L2CAP_TXSEQ_UNEXPECTED_SREJ:
7027 /* This frame was requested with an SREJ, but
7028 * some expected retransmitted frames are
7029 * missing. Request retransmission of missing
7030 * SREJ'd frames.
7031 */
7032 skb_queue_tail(&chan->srej_q, skb);
7033 skb_in_use = true;
7034 BT_DBG("Queued %p (queue len %d)", skb,
7035 skb_queue_len(&chan->srej_q));
7036
7037 l2cap_pass_to_tx(chan, control);
7038 l2cap_send_srej_list(chan, control->txseq);
7039 break;
7040 case L2CAP_TXSEQ_DUPLICATE_SREJ:
7041 /* We've already queued this frame. Drop this copy. */
7042 l2cap_pass_to_tx(chan, control);
7043 break;
7044 case L2CAP_TXSEQ_DUPLICATE:
7045 /* Expecting a later sequence number, so this frame
7046 * was already received. Ignore it completely.
7047 */
7048 break;
7049 case L2CAP_TXSEQ_INVALID_IGNORE:
7050 break;
7051 case L2CAP_TXSEQ_INVALID:
7052 default:
7053 l2cap_send_disconn_req(chan, ECONNRESET);
7054 break;
7055 }
7056 break;
7057 case L2CAP_EV_RECV_RR:
7058 l2cap_pass_to_tx(chan, control);
7059 if (control->final) {
7060 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
7061
7062 if (!test_and_clear_bit(CONN_REJ_ACT,
7063 &chan->conn_state)) {
7064 control->final = 0;
7065 l2cap_retransmit_all(chan, control);
7066 }
7067
7068 l2cap_ertm_send(chan);
7069 } else if (control->poll) {
7070 if (test_and_clear_bit(CONN_REMOTE_BUSY,
7071 &chan->conn_state) &&
7072 chan->unacked_frames) {
7073 __set_retrans_timer(chan);
7074 }
7075
7076 set_bit(CONN_SEND_FBIT, &chan->conn_state);
7077 l2cap_send_srej_tail(chan);
7078 } else {
7079 if (test_and_clear_bit(CONN_REMOTE_BUSY,
7080 &chan->conn_state) &&
7081 chan->unacked_frames)
7082 __set_retrans_timer(chan);
7083
7084 l2cap_send_ack(chan);
7085 }
7086 break;
7087 case L2CAP_EV_RECV_RNR:
7088 set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
7089 l2cap_pass_to_tx(chan, control);
7090 if (control->poll) {
7091 l2cap_send_srej_tail(chan);
7092 } else {
7093 struct l2cap_ctrl rr_control;
7094 memset(&rr_control, 0, sizeof(rr_control));
7095 rr_control.sframe = 1;
7096 rr_control.super = L2CAP_SUPER_RR;
7097 rr_control.reqseq = chan->buffer_seq;
7098 l2cap_send_sframe(chan, &rr_control);
7099 }
7100
7101 break;
7102 case L2CAP_EV_RECV_REJ:
7103 l2cap_handle_rej(chan, control);
7104 break;
7105 case L2CAP_EV_RECV_SREJ:
7106 l2cap_handle_srej(chan, control);
7107 break;
7108 }
7109
7110 if (skb && !skb_in_use) {
7111 BT_DBG("Freeing %p", skb);
7112 kfree_skb(skb);
7113 }
7114
7115 return err;
7116 }
7117
7118 static int l2cap_finish_move(struct l2cap_chan *chan)
7119 {
7120 BT_DBG("chan %p", chan);
7121
7122 chan->rx_state = L2CAP_RX_STATE_RECV;
7123
7124 if (chan->hs_hcon)
7125 chan->conn->mtu = chan->hs_hcon->hdev->block_mtu;
7126 else
7127 chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu;
7128
7129 return l2cap_resegment(chan);
7130 }
7131
7132 static int l2cap_rx_state_wait_p(struct l2cap_chan *chan,
7133 struct l2cap_ctrl *control,
7134 struct sk_buff *skb, u8 event)
7135 {
7136 int err;
7137
7138 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
7139 event);
7140
7141 if (!control->poll)
7142 return -EPROTO;
7143
7144 l2cap_process_reqseq(chan, control->reqseq);
7145
7146 if (!skb_queue_empty(&chan->tx_q))
7147 chan->tx_send_head = skb_peek(&chan->tx_q);
7148 else
7149 chan->tx_send_head = NULL;
7150
7151 /* Rewind next_tx_seq to the point expected
7152 * by the receiver.
7153 */
7154 chan->next_tx_seq = control->reqseq;
7155 chan->unacked_frames = 0;
7156
7157 err = l2cap_finish_move(chan);
7158 if (err)
7159 return err;
7160
7161 set_bit(CONN_SEND_FBIT, &chan->conn_state);
7162 l2cap_send_i_or_rr_or_rnr(chan);
7163
7164 if (event == L2CAP_EV_RECV_IFRAME)
7165 return -EPROTO;
7166
7167 return l2cap_rx_state_recv(chan, control, NULL, event);
7168 }
7169
7170 static int l2cap_rx_state_wait_f(struct l2cap_chan *chan,
7171 struct l2cap_ctrl *control,
7172 struct sk_buff *skb, u8 event)
7173 {
7174 int err;
7175
7176 if (!control->final)
7177 return -EPROTO;
7178
7179 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
7180
7181 chan->rx_state = L2CAP_RX_STATE_RECV;
7182 l2cap_process_reqseq(chan, control->reqseq);
7183
7184 if (!skb_queue_empty(&chan->tx_q))
7185 chan->tx_send_head = skb_peek(&chan->tx_q);
7186 else
7187 chan->tx_send_head = NULL;
7188
7189 /* Rewind next_tx_seq to the point expected
7190 * by the receiver.
7191 */
7192 chan->next_tx_seq = control->reqseq;
7193 chan->unacked_frames = 0;
7194
7195 if (chan->hs_hcon)
7196 chan->conn->mtu = chan->hs_hcon->hdev->block_mtu;
7197 else
7198 chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu;
7199
7200 err = l2cap_resegment(chan);
7201
7202 if (!err)
7203 err = l2cap_rx_state_recv(chan, control, skb, event);
7204
7205 return err;
7206 }
7207
7208 static bool __valid_reqseq(struct l2cap_chan *chan, u16 reqseq)
7209 {
7210 /* Make sure reqseq is for a packet that has been sent but not acked */
7211 u16 unacked;
7212
7213 unacked = __seq_offset(chan, chan->next_tx_seq, chan->expected_ack_seq);
7214 return __seq_offset(chan, chan->next_tx_seq, reqseq) <= unacked;
7215 }
7216
7217 static int l2cap_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
7218 struct sk_buff *skb, u8 event)
7219 {
7220 int err = 0;
7221
7222 BT_DBG("chan %p, control %p, skb %p, event %d, state %d", chan,
7223 control, skb, event, chan->rx_state);
7224
7225 if (__valid_reqseq(chan, control->reqseq)) {
7226 switch (chan->rx_state) {
7227 case L2CAP_RX_STATE_RECV:
7228 err = l2cap_rx_state_recv(chan, control, skb, event);
7229 break;
7230 case L2CAP_RX_STATE_SREJ_SENT:
7231 err = l2cap_rx_state_srej_sent(chan, control, skb,
7232 event);
7233 break;
7234 case L2CAP_RX_STATE_WAIT_P:
7235 err = l2cap_rx_state_wait_p(chan, control, skb, event);
7236 break;
7237 case L2CAP_RX_STATE_WAIT_F:
7238 err = l2cap_rx_state_wait_f(chan, control, skb, event);
7239 break;
7240 default:
7241 /* shut it down */
7242 break;
7243 }
7244 } else {
7245 BT_DBG("Invalid reqseq %d (next_tx_seq %d, expected_ack_seq %d",
7246 control->reqseq, chan->next_tx_seq,
7247 chan->expected_ack_seq);
7248 l2cap_send_disconn_req(chan, ECONNRESET);
7249 }
7250
7251 return err;
7252 }
7253
7254 static int l2cap_stream_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
7255 struct sk_buff *skb)
7256 {
7257 BT_DBG("chan %p, control %p, skb %p, state %d", chan, control, skb,
7258 chan->rx_state);
7259
7260 if (l2cap_classify_txseq(chan, control->txseq) ==
7261 L2CAP_TXSEQ_EXPECTED) {
7262 l2cap_pass_to_tx(chan, control);
7263
7264 BT_DBG("buffer_seq %u->%u", chan->buffer_seq,
7265 __next_seq(chan, chan->buffer_seq));
7266
7267 chan->buffer_seq = __next_seq(chan, chan->buffer_seq);
7268
7269 l2cap_reassemble_sdu(chan, skb, control);
7270 } else {
7271 if (chan->sdu) {
7272 kfree_skb(chan->sdu);
7273 chan->sdu = NULL;
7274 }
7275 chan->sdu_last_frag = NULL;
7276 chan->sdu_len = 0;
7277
7278 if (skb) {
7279 BT_DBG("Freeing %p", skb);
7280 kfree_skb(skb);
7281 }
7282 }
7283
7284 chan->last_acked_seq = control->txseq;
7285 chan->expected_tx_seq = __next_seq(chan, control->txseq);
7286
7287 return 0;
7288 }
7289
7290 static int l2cap_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
7291 {
7292 struct l2cap_ctrl *control = &bt_cb(skb)->l2cap;
7293 u16 len;
7294 u8 event;
7295
7296 __unpack_control(chan, skb);
7297
7298 len = skb->len;
7299
7300 /*
7301 * We can just drop the corrupted I-frame here.
7302 * Receiver will miss it and start proper recovery
7303 * procedures and ask for retransmission.
7304 */
7305 if (l2cap_check_fcs(chan, skb))
7306 goto drop;
7307
7308 if (!control->sframe && control->sar == L2CAP_SAR_START)
7309 len -= L2CAP_SDULEN_SIZE;
7310
7311 if (chan->fcs == L2CAP_FCS_CRC16)
7312 len -= L2CAP_FCS_SIZE;
7313
7314 if (len > chan->mps) {
7315 l2cap_send_disconn_req(chan, ECONNRESET);
7316 goto drop;
7317 }
7318
7319 if (chan->ops->filter) {
7320 if (chan->ops->filter(chan, skb))
7321 goto drop;
7322 }
7323
7324 if (!control->sframe) {
7325 int err;
7326
7327 BT_DBG("iframe sar %d, reqseq %d, final %d, txseq %d",
7328 control->sar, control->reqseq, control->final,
7329 control->txseq);
7330
7331 /* Validate F-bit - F=0 always valid, F=1 only
7332 * valid in TX WAIT_F
7333 */
7334 if (control->final && chan->tx_state != L2CAP_TX_STATE_WAIT_F)
7335 goto drop;
7336
7337 if (chan->mode != L2CAP_MODE_STREAMING) {
7338 event = L2CAP_EV_RECV_IFRAME;
7339 err = l2cap_rx(chan, control, skb, event);
7340 } else {
7341 err = l2cap_stream_rx(chan, control, skb);
7342 }
7343
7344 if (err)
7345 l2cap_send_disconn_req(chan, ECONNRESET);
7346 } else {
7347 const u8 rx_func_to_event[4] = {
7348 L2CAP_EV_RECV_RR, L2CAP_EV_RECV_REJ,
7349 L2CAP_EV_RECV_RNR, L2CAP_EV_RECV_SREJ
7350 };
7351
7352 /* Only I-frames are expected in streaming mode */
7353 if (chan->mode == L2CAP_MODE_STREAMING)
7354 goto drop;
7355
7356 BT_DBG("sframe reqseq %d, final %d, poll %d, super %d",
7357 control->reqseq, control->final, control->poll,
7358 control->super);
7359
7360 if (len != 0) {
7361 BT_ERR("Trailing bytes: %d in sframe", len);
7362 l2cap_send_disconn_req(chan, ECONNRESET);
7363 goto drop;
7364 }
7365
7366 /* Validate F and P bits */
7367 if (control->final && (control->poll ||
7368 chan->tx_state != L2CAP_TX_STATE_WAIT_F))
7369 goto drop;
7370
7371 event = rx_func_to_event[control->super];
7372 if (l2cap_rx(chan, control, skb, event))
7373 l2cap_send_disconn_req(chan, ECONNRESET);
7374 }
7375
7376 return 0;
7377
7378 drop:
7379 kfree_skb(skb);
7380 return 0;
7381 }
7382
7383 static void l2cap_chan_le_send_credits(struct l2cap_chan *chan)
7384 {
7385 struct l2cap_conn *conn = chan->conn;
7386 struct l2cap_le_credits pkt;
7387 u16 return_credits;
7388
7389 return_credits = (chan->imtu / chan->mps) + 1;
7390
7391 if (chan->rx_credits >= return_credits)
7392 return;
7393
7394 return_credits -= chan->rx_credits;
7395
7396 BT_DBG("chan %p returning %u credits to sender", chan, return_credits);
7397
7398 chan->rx_credits += return_credits;
7399
7400 pkt.cid = cpu_to_le16(chan->scid);
7401 pkt.credits = cpu_to_le16(return_credits);
7402
7403 chan->ident = l2cap_get_ident(conn);
7404
7405 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CREDITS, sizeof(pkt), &pkt);
7406 }
7407
7408 static int l2cap_ecred_recv(struct l2cap_chan *chan, struct sk_buff *skb)
7409 {
7410 int err;
7411
7412 BT_DBG("SDU reassemble complete: chan %p skb->len %u", chan, skb->len);
7413
7414 /* Wait recv to confirm reception before updating the credits */
7415 err = chan->ops->recv(chan, skb);
7416
7417 /* Update credits whenever an SDU is received */
7418 l2cap_chan_le_send_credits(chan);
7419
7420 return err;
7421 }
7422
7423 static int l2cap_ecred_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
7424 {
7425 int err;
7426
7427 if (!chan->rx_credits) {
7428 BT_ERR("No credits to receive LE L2CAP data");
7429 l2cap_send_disconn_req(chan, ECONNRESET);
7430 return -ENOBUFS;
7431 }
7432
7433 if (chan->imtu < skb->len) {
7434 BT_ERR("Too big LE L2CAP PDU");
7435 return -ENOBUFS;
7436 }
7437
7438 chan->rx_credits--;
7439 BT_DBG("rx_credits %u -> %u", chan->rx_credits + 1, chan->rx_credits);
7440
7441 /* Update if remote had run out of credits, this should only happens
7442 * if the remote is not using the entire MPS.
7443 */
7444 if (!chan->rx_credits)
7445 l2cap_chan_le_send_credits(chan);
7446
7447 err = 0;
7448
7449 if (!chan->sdu) {
7450 u16 sdu_len;
7451
7452 sdu_len = get_unaligned_le16(skb->data);
7453 skb_pull(skb, L2CAP_SDULEN_SIZE);
7454
7455 BT_DBG("Start of new SDU. sdu_len %u skb->len %u imtu %u",
7456 sdu_len, skb->len, chan->imtu);
7457
7458 if (sdu_len > chan->imtu) {
7459 BT_ERR("Too big LE L2CAP SDU length received");
7460 err = -EMSGSIZE;
7461 goto failed;
7462 }
7463
7464 if (skb->len > sdu_len) {
7465 BT_ERR("Too much LE L2CAP data received");
7466 err = -EINVAL;
7467 goto failed;
7468 }
7469
7470 if (skb->len == sdu_len)
7471 return l2cap_ecred_recv(chan, skb);
7472
7473 chan->sdu = skb;
7474 chan->sdu_len = sdu_len;
7475 chan->sdu_last_frag = skb;
7476
7477 /* Detect if remote is not able to use the selected MPS */
7478 if (skb->len + L2CAP_SDULEN_SIZE < chan->mps) {
7479 u16 mps_len = skb->len + L2CAP_SDULEN_SIZE;
7480
7481 /* Adjust the number of credits */
7482 BT_DBG("chan->mps %u -> %u", chan->mps, mps_len);
7483 chan->mps = mps_len;
7484 l2cap_chan_le_send_credits(chan);
7485 }
7486
7487 return 0;
7488 }
7489
7490 BT_DBG("SDU fragment. chan->sdu->len %u skb->len %u chan->sdu_len %u",
7491 chan->sdu->len, skb->len, chan->sdu_len);
7492
7493 if (chan->sdu->len + skb->len > chan->sdu_len) {
7494 BT_ERR("Too much LE L2CAP data received");
7495 err = -EINVAL;
7496 goto failed;
7497 }
7498
7499 append_skb_frag(chan->sdu, skb, &chan->sdu_last_frag);
7500 skb = NULL;
7501
7502 if (chan->sdu->len == chan->sdu_len) {
7503 err = l2cap_ecred_recv(chan, chan->sdu);
7504 if (!err) {
7505 chan->sdu = NULL;
7506 chan->sdu_last_frag = NULL;
7507 chan->sdu_len = 0;
7508 }
7509 }
7510
7511 failed:
7512 if (err) {
7513 kfree_skb(skb);
7514 kfree_skb(chan->sdu);
7515 chan->sdu = NULL;
7516 chan->sdu_last_frag = NULL;
7517 chan->sdu_len = 0;
7518 }
7519
7520 /* We can't return an error here since we took care of the skb
7521 * freeing internally. An error return would cause the caller to
7522 * do a double-free of the skb.
7523 */
7524 return 0;
7525 }
7526
7527 static void l2cap_data_channel(struct l2cap_conn *conn, u16 cid,
7528 struct sk_buff *skb)
7529 {
7530 struct l2cap_chan *chan;
7531
7532 chan = l2cap_get_chan_by_scid(conn, cid);
7533 if (!chan) {
7534 if (cid == L2CAP_CID_A2MP) {
7535 chan = a2mp_channel_create(conn, skb);
7536 if (!chan) {
7537 kfree_skb(skb);
7538 return;
7539 }
7540
7541 l2cap_chan_lock(chan);
7542 } else {
7543 BT_DBG("unknown cid 0x%4.4x", cid);
7544 /* Drop packet and return */
7545 kfree_skb(skb);
7546 return;
7547 }
7548 }
7549
7550 BT_DBG("chan %p, len %d", chan, skb->len);
7551
7552 /* If we receive data on a fixed channel before the info req/rsp
7553 * procedure is done simply assume that the channel is supported
7554 * and mark it as ready.
7555 */
7556 if (chan->chan_type == L2CAP_CHAN_FIXED)
7557 l2cap_chan_ready(chan);
7558
7559 if (chan->state != BT_CONNECTED)
7560 goto drop;
7561
7562 switch (chan->mode) {
7563 case L2CAP_MODE_LE_FLOWCTL:
7564 case L2CAP_MODE_EXT_FLOWCTL:
7565 if (l2cap_ecred_data_rcv(chan, skb) < 0)
7566 goto drop;
7567
7568 goto done;
7569
7570 case L2CAP_MODE_BASIC:
7571 /* If socket recv buffers overflows we drop data here
7572 * which is *bad* because L2CAP has to be reliable.
7573 * But we don't have any other choice. L2CAP doesn't
7574 * provide flow control mechanism. */
7575
7576 if (chan->imtu < skb->len) {
7577 BT_ERR("Dropping L2CAP data: receive buffer overflow");
7578 goto drop;
7579 }
7580
7581 if (!chan->ops->recv(chan, skb))
7582 goto done;
7583 break;
7584
7585 case L2CAP_MODE_ERTM:
7586 case L2CAP_MODE_STREAMING:
7587 l2cap_data_rcv(chan, skb);
7588 goto done;
7589
7590 default:
7591 BT_DBG("chan %p: bad mode 0x%2.2x", chan, chan->mode);
7592 break;
7593 }
7594
7595 drop:
7596 kfree_skb(skb);
7597
7598 done:
7599 l2cap_chan_unlock(chan);
7600 }
7601
7602 static void l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm,
7603 struct sk_buff *skb)
7604 {
7605 struct hci_conn *hcon = conn->hcon;
7606 struct l2cap_chan *chan;
7607
7608 if (hcon->type != ACL_LINK)
7609 goto free_skb;
7610
7611 chan = l2cap_global_chan_by_psm(0, psm, &hcon->src, &hcon->dst,
7612 ACL_LINK);
7613 if (!chan)
7614 goto free_skb;
7615
7616 BT_DBG("chan %p, len %d", chan, skb->len);
7617
7618 if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)
7619 goto drop;
7620
7621 if (chan->imtu < skb->len)
7622 goto drop;
7623
7624 /* Store remote BD_ADDR and PSM for msg_name */
7625 bacpy(&bt_cb(skb)->l2cap.bdaddr, &hcon->dst);
7626 bt_cb(skb)->l2cap.psm = psm;
7627
7628 if (!chan->ops->recv(chan, skb)) {
7629 l2cap_chan_put(chan);
7630 return;
7631 }
7632
7633 drop:
7634 l2cap_chan_put(chan);
7635 free_skb:
7636 kfree_skb(skb);
7637 }
7638
7639 static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
7640 {
7641 struct l2cap_hdr *lh = (void *) skb->data;
7642 struct hci_conn *hcon = conn->hcon;
7643 u16 cid, len;
7644 __le16 psm;
7645
7646 if (hcon->state != BT_CONNECTED) {
7647 BT_DBG("queueing pending rx skb");
7648 skb_queue_tail(&conn->pending_rx, skb);
7649 return;
7650 }
7651
7652 skb_pull(skb, L2CAP_HDR_SIZE);
7653 cid = __le16_to_cpu(lh->cid);
7654 len = __le16_to_cpu(lh->len);
7655
7656 if (len != skb->len) {
7657 kfree_skb(skb);
7658 return;
7659 }
7660
7661 /* Since we can't actively block incoming LE connections we must
7662 * at least ensure that we ignore incoming data from them.
7663 */
7664 if (hcon->type == LE_LINK &&
7665 hci_bdaddr_list_lookup(&hcon->hdev->reject_list, &hcon->dst,
7666 bdaddr_dst_type(hcon))) {
7667 kfree_skb(skb);
7668 return;
7669 }
7670
7671 BT_DBG("len %d, cid 0x%4.4x", len, cid);
7672
7673 switch (cid) {
7674 case L2CAP_CID_SIGNALING:
7675 l2cap_sig_channel(conn, skb);
7676 break;
7677
7678 case L2CAP_CID_CONN_LESS:
7679 psm = get_unaligned((__le16 *) skb->data);
7680 skb_pull(skb, L2CAP_PSMLEN_SIZE);
7681 l2cap_conless_channel(conn, psm, skb);
7682 break;
7683
7684 case L2CAP_CID_LE_SIGNALING:
7685 l2cap_le_sig_channel(conn, skb);
7686 break;
7687
7688 default:
7689 l2cap_data_channel(conn, cid, skb);
7690 break;
7691 }
7692 }
7693
7694 static void process_pending_rx(struct work_struct *work)
7695 {
7696 struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
7697 pending_rx_work);
7698 struct sk_buff *skb;
7699
7700 BT_DBG("");
7701
7702 while ((skb = skb_dequeue(&conn->pending_rx)))
7703 l2cap_recv_frame(conn, skb);
7704 }
7705
7706 static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon)
7707 {
7708 struct l2cap_conn *conn = hcon->l2cap_data;
7709 struct hci_chan *hchan;
7710
7711 if (conn)
7712 return conn;
7713
7714 hchan = hci_chan_create(hcon);
7715 if (!hchan)
7716 return NULL;
7717
7718 conn = kzalloc(sizeof(*conn), GFP_KERNEL);
7719 if (!conn) {
7720 hci_chan_del(hchan);
7721 return NULL;
7722 }
7723
7724 kref_init(&conn->ref);
7725 hcon->l2cap_data = conn;
7726 conn->hcon = hci_conn_get(hcon);
7727 conn->hchan = hchan;
7728
7729 BT_DBG("hcon %p conn %p hchan %p", hcon, conn, hchan);
7730
7731 switch (hcon->type) {
7732 case LE_LINK:
7733 if (hcon->hdev->le_mtu) {
7734 conn->mtu = hcon->hdev->le_mtu;
7735 break;
7736 }
7737 fallthrough;
7738 default:
7739 conn->mtu = hcon->hdev->acl_mtu;
7740 break;
7741 }
7742
7743 conn->feat_mask = 0;
7744
7745 conn->local_fixed_chan = L2CAP_FC_SIG_BREDR | L2CAP_FC_CONNLESS;
7746
7747 if (hcon->type == ACL_LINK &&
7748 hci_dev_test_flag(hcon->hdev, HCI_HS_ENABLED))
7749 conn->local_fixed_chan |= L2CAP_FC_A2MP;
7750
7751 if (hci_dev_test_flag(hcon->hdev, HCI_LE_ENABLED) &&
7752 (bredr_sc_enabled(hcon->hdev) ||
7753 hci_dev_test_flag(hcon->hdev, HCI_FORCE_BREDR_SMP)))
7754 conn->local_fixed_chan |= L2CAP_FC_SMP_BREDR;
7755
7756 mutex_init(&conn->ident_lock);
7757 mutex_init(&conn->chan_lock);
7758
7759 INIT_LIST_HEAD(&conn->chan_l);
7760 INIT_LIST_HEAD(&conn->users);
7761
7762 INIT_DELAYED_WORK(&conn->info_timer, l2cap_info_timeout);
7763
7764 skb_queue_head_init(&conn->pending_rx);
7765 INIT_WORK(&conn->pending_rx_work, process_pending_rx);
7766 INIT_WORK(&conn->id_addr_update_work, l2cap_conn_update_id_addr);
7767
7768 conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
7769
7770 return conn;
7771 }
7772
7773 static bool is_valid_psm(u16 psm, u8 dst_type)
7774 {
7775 if (!psm)
7776 return false;
7777
7778 if (bdaddr_type_is_le(dst_type))
7779 return (psm <= 0x00ff);
7780
7781 /* PSM must be odd and lsb of upper byte must be 0 */
7782 return ((psm & 0x0101) == 0x0001);
7783 }
7784
7785 struct l2cap_chan_data {
7786 struct l2cap_chan *chan;
7787 struct pid *pid;
7788 int count;
7789 };
7790
7791 static void l2cap_chan_by_pid(struct l2cap_chan *chan, void *data)
7792 {
7793 struct l2cap_chan_data *d = data;
7794 struct pid *pid;
7795
7796 if (chan == d->chan)
7797 return;
7798
7799 if (!test_bit(FLAG_DEFER_SETUP, &chan->flags))
7800 return;
7801
7802 pid = chan->ops->get_peer_pid(chan);
7803
7804 /* Only count deferred channels with the same PID/PSM */
7805 if (d->pid != pid || chan->psm != d->chan->psm || chan->ident ||
7806 chan->mode != L2CAP_MODE_EXT_FLOWCTL || chan->state != BT_CONNECT)
7807 return;
7808
7809 d->count++;
7810 }
7811
7812 int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,
7813 bdaddr_t *dst, u8 dst_type)
7814 {
7815 struct l2cap_conn *conn;
7816 struct hci_conn *hcon;
7817 struct hci_dev *hdev;
7818 int err;
7819
7820 BT_DBG("%pMR -> %pMR (type %u) psm 0x%4.4x mode 0x%2.2x", &chan->src,
7821 dst, dst_type, __le16_to_cpu(psm), chan->mode);
7822
7823 hdev = hci_get_route(dst, &chan->src, chan->src_type);
7824 if (!hdev)
7825 return -EHOSTUNREACH;
7826
7827 hci_dev_lock(hdev);
7828
7829 if (!is_valid_psm(__le16_to_cpu(psm), dst_type) && !cid &&
7830 chan->chan_type != L2CAP_CHAN_RAW) {
7831 err = -EINVAL;
7832 goto done;
7833 }
7834
7835 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED && !psm) {
7836 err = -EINVAL;
7837 goto done;
7838 }
7839
7840 if (chan->chan_type == L2CAP_CHAN_FIXED && !cid) {
7841 err = -EINVAL;
7842 goto done;
7843 }
7844
7845 switch (chan->mode) {
7846 case L2CAP_MODE_BASIC:
7847 break;
7848 case L2CAP_MODE_LE_FLOWCTL:
7849 break;
7850 case L2CAP_MODE_EXT_FLOWCTL:
7851 if (!enable_ecred) {
7852 err = -EOPNOTSUPP;
7853 goto done;
7854 }
7855 break;
7856 case L2CAP_MODE_ERTM:
7857 case L2CAP_MODE_STREAMING:
7858 if (!disable_ertm)
7859 break;
7860 fallthrough;
7861 default:
7862 err = -EOPNOTSUPP;
7863 goto done;
7864 }
7865
7866 switch (chan->state) {
7867 case BT_CONNECT:
7868 case BT_CONNECT2:
7869 case BT_CONFIG:
7870 /* Already connecting */
7871 err = 0;
7872 goto done;
7873
7874 case BT_CONNECTED:
7875 /* Already connected */
7876 err = -EISCONN;
7877 goto done;
7878
7879 case BT_OPEN:
7880 case BT_BOUND:
7881 /* Can connect */
7882 break;
7883
7884 default:
7885 err = -EBADFD;
7886 goto done;
7887 }
7888
7889 /* Set destination address and psm */
7890 bacpy(&chan->dst, dst);
7891 chan->dst_type = dst_type;
7892
7893 chan->psm = psm;
7894 chan->dcid = cid;
7895
7896 if (bdaddr_type_is_le(dst_type)) {
7897 /* Convert from L2CAP channel address type to HCI address type
7898 */
7899 if (dst_type == BDADDR_LE_PUBLIC)
7900 dst_type = ADDR_LE_DEV_PUBLIC;
7901 else
7902 dst_type = ADDR_LE_DEV_RANDOM;
7903
7904 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
7905 hcon = hci_connect_le(hdev, dst, dst_type,
7906 chan->sec_level,
7907 HCI_LE_CONN_TIMEOUT,
7908 HCI_ROLE_SLAVE, NULL);
7909 else
7910 hcon = hci_connect_le_scan(hdev, dst, dst_type,
7911 chan->sec_level,
7912 HCI_LE_CONN_TIMEOUT,
7913 CONN_REASON_L2CAP_CHAN);
7914
7915 } else {
7916 u8 auth_type = l2cap_get_auth_type(chan);
7917 hcon = hci_connect_acl(hdev, dst, chan->sec_level, auth_type,
7918 CONN_REASON_L2CAP_CHAN);
7919 }
7920
7921 if (IS_ERR(hcon)) {
7922 err = PTR_ERR(hcon);
7923 goto done;
7924 }
7925
7926 conn = l2cap_conn_add(hcon);
7927 if (!conn) {
7928 hci_conn_drop(hcon);
7929 err = -ENOMEM;
7930 goto done;
7931 }
7932
7933 if (chan->mode == L2CAP_MODE_EXT_FLOWCTL) {
7934 struct l2cap_chan_data data;
7935
7936 data.chan = chan;
7937 data.pid = chan->ops->get_peer_pid(chan);
7938 data.count = 1;
7939
7940 l2cap_chan_list(conn, l2cap_chan_by_pid, &data);
7941
7942 /* Check if there isn't too many channels being connected */
7943 if (data.count > L2CAP_ECRED_CONN_SCID_MAX) {
7944 hci_conn_drop(hcon);
7945 err = -EPROTO;
7946 goto done;
7947 }
7948 }
7949
7950 mutex_lock(&conn->chan_lock);
7951 l2cap_chan_lock(chan);
7952
7953 if (cid && __l2cap_get_chan_by_dcid(conn, cid)) {
7954 hci_conn_drop(hcon);
7955 err = -EBUSY;
7956 goto chan_unlock;
7957 }
7958
7959 /* Update source addr of the socket */
7960 bacpy(&chan->src, &hcon->src);
7961 chan->src_type = bdaddr_src_type(hcon);
7962
7963 __l2cap_chan_add(conn, chan);
7964
7965 /* l2cap_chan_add takes its own ref so we can drop this one */
7966 hci_conn_drop(hcon);
7967
7968 l2cap_state_change(chan, BT_CONNECT);
7969 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
7970
7971 /* Release chan->sport so that it can be reused by other
7972 * sockets (as it's only used for listening sockets).
7973 */
7974 write_lock(&chan_list_lock);
7975 chan->sport = 0;
7976 write_unlock(&chan_list_lock);
7977
7978 if (hcon->state == BT_CONNECTED) {
7979 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
7980 __clear_chan_timer(chan);
7981 if (l2cap_chan_check_security(chan, true))
7982 l2cap_state_change(chan, BT_CONNECTED);
7983 } else
7984 l2cap_do_start(chan);
7985 }
7986
7987 err = 0;
7988
7989 chan_unlock:
7990 l2cap_chan_unlock(chan);
7991 mutex_unlock(&conn->chan_lock);
7992 done:
7993 hci_dev_unlock(hdev);
7994 hci_dev_put(hdev);
7995 return err;
7996 }
7997 EXPORT_SYMBOL_GPL(l2cap_chan_connect);
7998
7999 static void l2cap_ecred_reconfigure(struct l2cap_chan *chan)
8000 {
8001 struct l2cap_conn *conn = chan->conn;
8002 struct {
8003 struct l2cap_ecred_reconf_req req;
8004 __le16 scid;
8005 } pdu;
8006
8007 pdu.req.mtu = cpu_to_le16(chan->imtu);
8008 pdu.req.mps = cpu_to_le16(chan->mps);
8009 pdu.scid = cpu_to_le16(chan->scid);
8010
8011 chan->ident = l2cap_get_ident(conn);
8012
8013 l2cap_send_cmd(conn, chan->ident, L2CAP_ECRED_RECONF_REQ,
8014 sizeof(pdu), &pdu);
8015 }
8016
8017 int l2cap_chan_reconfigure(struct l2cap_chan *chan, __u16 mtu)
8018 {
8019 if (chan->imtu > mtu)
8020 return -EINVAL;
8021
8022 BT_DBG("chan %p mtu 0x%4.4x", chan, mtu);
8023
8024 chan->imtu = mtu;
8025
8026 l2cap_ecred_reconfigure(chan);
8027
8028 return 0;
8029 }
8030
8031 /* ---- L2CAP interface with lower layer (HCI) ---- */
8032
8033 int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr)
8034 {
8035 int exact = 0, lm1 = 0, lm2 = 0;
8036 struct l2cap_chan *c;
8037
8038 BT_DBG("hdev %s, bdaddr %pMR", hdev->name, bdaddr);
8039
8040 /* Find listening sockets and check their link_mode */
8041 read_lock(&chan_list_lock);
8042 list_for_each_entry(c, &chan_list, global_l) {
8043 if (c->state != BT_LISTEN)
8044 continue;
8045
8046 if (!bacmp(&c->src, &hdev->bdaddr)) {
8047 lm1 |= HCI_LM_ACCEPT;
8048 if (test_bit(FLAG_ROLE_SWITCH, &c->flags))
8049 lm1 |= HCI_LM_MASTER;
8050 exact++;
8051 } else if (!bacmp(&c->src, BDADDR_ANY)) {
8052 lm2 |= HCI_LM_ACCEPT;
8053 if (test_bit(FLAG_ROLE_SWITCH, &c->flags))
8054 lm2 |= HCI_LM_MASTER;
8055 }
8056 }
8057 read_unlock(&chan_list_lock);
8058
8059 return exact ? lm1 : lm2;
8060 }
8061
8062 /* Find the next fixed channel in BT_LISTEN state, continue iteration
8063 * from an existing channel in the list or from the beginning of the
8064 * global list (by passing NULL as first parameter).
8065 */
8066 static struct l2cap_chan *l2cap_global_fixed_chan(struct l2cap_chan *c,
8067 struct hci_conn *hcon)
8068 {
8069 u8 src_type = bdaddr_src_type(hcon);
8070
8071 read_lock(&chan_list_lock);
8072
8073 if (c)
8074 c = list_next_entry(c, global_l);
8075 else
8076 c = list_entry(chan_list.next, typeof(*c), global_l);
8077
8078 list_for_each_entry_from(c, &chan_list, global_l) {
8079 if (c->chan_type != L2CAP_CHAN_FIXED)
8080 continue;
8081 if (c->state != BT_LISTEN)
8082 continue;
8083 if (bacmp(&c->src, &hcon->src) && bacmp(&c->src, BDADDR_ANY))
8084 continue;
8085 if (src_type != c->src_type)
8086 continue;
8087
8088 l2cap_chan_hold(c);
8089 read_unlock(&chan_list_lock);
8090 return c;
8091 }
8092
8093 read_unlock(&chan_list_lock);
8094
8095 return NULL;
8096 }
8097
8098 static void l2cap_connect_cfm(struct hci_conn *hcon, u8 status)
8099 {
8100 struct hci_dev *hdev = hcon->hdev;
8101 struct l2cap_conn *conn;
8102 struct l2cap_chan *pchan;
8103 u8 dst_type;
8104
8105 if (hcon->type != ACL_LINK && hcon->type != LE_LINK)
8106 return;
8107
8108 BT_DBG("hcon %p bdaddr %pMR status %d", hcon, &hcon->dst, status);
8109
8110 if (status) {
8111 l2cap_conn_del(hcon, bt_to_errno(status));
8112 return;
8113 }
8114
8115 conn = l2cap_conn_add(hcon);
8116 if (!conn)
8117 return;
8118
8119 dst_type = bdaddr_dst_type(hcon);
8120
8121 /* If device is blocked, do not create channels for it */
8122 if (hci_bdaddr_list_lookup(&hdev->reject_list, &hcon->dst, dst_type))
8123 return;
8124
8125 /* Find fixed channels and notify them of the new connection. We
8126 * use multiple individual lookups, continuing each time where
8127 * we left off, because the list lock would prevent calling the
8128 * potentially sleeping l2cap_chan_lock() function.
8129 */
8130 pchan = l2cap_global_fixed_chan(NULL, hcon);
8131 while (pchan) {
8132 struct l2cap_chan *chan, *next;
8133
8134 /* Client fixed channels should override server ones */
8135 if (__l2cap_get_chan_by_dcid(conn, pchan->scid))
8136 goto next;
8137
8138 l2cap_chan_lock(pchan);
8139 chan = pchan->ops->new_connection(pchan);
8140 if (chan) {
8141 bacpy(&chan->src, &hcon->src);
8142 bacpy(&chan->dst, &hcon->dst);
8143 chan->src_type = bdaddr_src_type(hcon);
8144 chan->dst_type = dst_type;
8145
8146 __l2cap_chan_add(conn, chan);
8147 }
8148
8149 l2cap_chan_unlock(pchan);
8150 next:
8151 next = l2cap_global_fixed_chan(pchan, hcon);
8152 l2cap_chan_put(pchan);
8153 pchan = next;
8154 }
8155
8156 l2cap_conn_ready(conn);
8157 }
8158
8159 int l2cap_disconn_ind(struct hci_conn *hcon)
8160 {
8161 struct l2cap_conn *conn = hcon->l2cap_data;
8162
8163 BT_DBG("hcon %p", hcon);
8164
8165 if (!conn)
8166 return HCI_ERROR_REMOTE_USER_TERM;
8167 return conn->disc_reason;
8168 }
8169
8170 static void l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason)
8171 {
8172 if (hcon->type != ACL_LINK && hcon->type != LE_LINK)
8173 return;
8174
8175 BT_DBG("hcon %p reason %d", hcon, reason);
8176
8177 l2cap_conn_del(hcon, bt_to_errno(reason));
8178 }
8179
8180 static inline void l2cap_check_encryption(struct l2cap_chan *chan, u8 encrypt)
8181 {
8182 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED)
8183 return;
8184
8185 if (encrypt == 0x00) {
8186 if (chan->sec_level == BT_SECURITY_MEDIUM) {
8187 __set_chan_timer(chan, L2CAP_ENC_TIMEOUT);
8188 } else if (chan->sec_level == BT_SECURITY_HIGH ||
8189 chan->sec_level == BT_SECURITY_FIPS)
8190 l2cap_chan_close(chan, ECONNREFUSED);
8191 } else {
8192 if (chan->sec_level == BT_SECURITY_MEDIUM)
8193 __clear_chan_timer(chan);
8194 }
8195 }
8196
8197 static void l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
8198 {
8199 struct l2cap_conn *conn = hcon->l2cap_data;
8200 struct l2cap_chan *chan;
8201
8202 if (!conn)
8203 return;
8204
8205 BT_DBG("conn %p status 0x%2.2x encrypt %u", conn, status, encrypt);
8206
8207 mutex_lock(&conn->chan_lock);
8208
8209 list_for_each_entry(chan, &conn->chan_l, list) {
8210 l2cap_chan_lock(chan);
8211
8212 BT_DBG("chan %p scid 0x%4.4x state %s", chan, chan->scid,
8213 state_to_string(chan->state));
8214
8215 if (chan->scid == L2CAP_CID_A2MP) {
8216 l2cap_chan_unlock(chan);
8217 continue;
8218 }
8219
8220 if (!status && encrypt)
8221 chan->sec_level = hcon->sec_level;
8222
8223 if (!__l2cap_no_conn_pending(chan)) {
8224 l2cap_chan_unlock(chan);
8225 continue;
8226 }
8227
8228 if (!status && (chan->state == BT_CONNECTED ||
8229 chan->state == BT_CONFIG)) {
8230 chan->ops->resume(chan);
8231 l2cap_check_encryption(chan, encrypt);
8232 l2cap_chan_unlock(chan);
8233 continue;
8234 }
8235
8236 if (chan->state == BT_CONNECT) {
8237 if (!status && l2cap_check_enc_key_size(hcon))
8238 l2cap_start_connection(chan);
8239 else
8240 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
8241 } else if (chan->state == BT_CONNECT2 &&
8242 !(chan->mode == L2CAP_MODE_EXT_FLOWCTL ||
8243 chan->mode == L2CAP_MODE_LE_FLOWCTL)) {
8244 struct l2cap_conn_rsp rsp;
8245 __u16 res, stat;
8246
8247 if (!status && l2cap_check_enc_key_size(hcon)) {
8248 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
8249 res = L2CAP_CR_PEND;
8250 stat = L2CAP_CS_AUTHOR_PEND;
8251 chan->ops->defer(chan);
8252 } else {
8253 l2cap_state_change(chan, BT_CONFIG);
8254 res = L2CAP_CR_SUCCESS;
8255 stat = L2CAP_CS_NO_INFO;
8256 }
8257 } else {
8258 l2cap_state_change(chan, BT_DISCONN);
8259 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
8260 res = L2CAP_CR_SEC_BLOCK;
8261 stat = L2CAP_CS_NO_INFO;
8262 }
8263
8264 rsp.scid = cpu_to_le16(chan->dcid);
8265 rsp.dcid = cpu_to_le16(chan->scid);
8266 rsp.result = cpu_to_le16(res);
8267 rsp.status = cpu_to_le16(stat);
8268 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
8269 sizeof(rsp), &rsp);
8270
8271 if (!test_bit(CONF_REQ_SENT, &chan->conf_state) &&
8272 res == L2CAP_CR_SUCCESS) {
8273 char buf[128];
8274 set_bit(CONF_REQ_SENT, &chan->conf_state);
8275 l2cap_send_cmd(conn, l2cap_get_ident(conn),
8276 L2CAP_CONF_REQ,
8277 l2cap_build_conf_req(chan, buf, sizeof(buf)),
8278 buf);
8279 chan->num_conf_req++;
8280 }
8281 }
8282
8283 l2cap_chan_unlock(chan);
8284 }
8285
8286 mutex_unlock(&conn->chan_lock);
8287 }
8288
8289 /* Append fragment into frame respecting the maximum len of rx_skb */
8290 static int l2cap_recv_frag(struct l2cap_conn *conn, struct sk_buff *skb,
8291 u16 len)
8292 {
8293 if (!conn->rx_skb) {
8294 /* Allocate skb for the complete frame (with header) */
8295 conn->rx_skb = bt_skb_alloc(len, GFP_KERNEL);
8296 if (!conn->rx_skb)
8297 return -ENOMEM;
8298 /* Init rx_len */
8299 conn->rx_len = len;
8300 }
8301
8302 /* Copy as much as the rx_skb can hold */
8303 len = min_t(u16, len, skb->len);
8304 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, len), len);
8305 skb_pull(skb, len);
8306 conn->rx_len -= len;
8307
8308 return len;
8309 }
8310
8311 static int l2cap_recv_len(struct l2cap_conn *conn, struct sk_buff *skb)
8312 {
8313 struct sk_buff *rx_skb;
8314 int len;
8315
8316 /* Append just enough to complete the header */
8317 len = l2cap_recv_frag(conn, skb, L2CAP_LEN_SIZE - conn->rx_skb->len);
8318
8319 /* If header could not be read just continue */
8320 if (len < 0 || conn->rx_skb->len < L2CAP_LEN_SIZE)
8321 return len;
8322
8323 rx_skb = conn->rx_skb;
8324 len = get_unaligned_le16(rx_skb->data);
8325
8326 /* Check if rx_skb has enough space to received all fragments */
8327 if (len + (L2CAP_HDR_SIZE - L2CAP_LEN_SIZE) <= skb_tailroom(rx_skb)) {
8328 /* Update expected len */
8329 conn->rx_len = len + (L2CAP_HDR_SIZE - L2CAP_LEN_SIZE);
8330 return L2CAP_LEN_SIZE;
8331 }
8332
8333 /* Reset conn->rx_skb since it will need to be reallocated in order to
8334 * fit all fragments.
8335 */
8336 conn->rx_skb = NULL;
8337
8338 /* Reallocates rx_skb using the exact expected length */
8339 len = l2cap_recv_frag(conn, rx_skb,
8340 len + (L2CAP_HDR_SIZE - L2CAP_LEN_SIZE));
8341 kfree_skb(rx_skb);
8342
8343 return len;
8344 }
8345
8346 static void l2cap_recv_reset(struct l2cap_conn *conn)
8347 {
8348 kfree_skb(conn->rx_skb);
8349 conn->rx_skb = NULL;
8350 conn->rx_len = 0;
8351 }
8352
8353 void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
8354 {
8355 struct l2cap_conn *conn = hcon->l2cap_data;
8356 int len;
8357
8358 /* For AMP controller do not create l2cap conn */
8359 if (!conn && hcon->hdev->dev_type != HCI_PRIMARY)
8360 goto drop;
8361
8362 if (!conn)
8363 conn = l2cap_conn_add(hcon);
8364
8365 if (!conn)
8366 goto drop;
8367
8368 BT_DBG("conn %p len %u flags 0x%x", conn, skb->len, flags);
8369
8370 switch (flags) {
8371 case ACL_START:
8372 case ACL_START_NO_FLUSH:
8373 case ACL_COMPLETE:
8374 if (conn->rx_skb) {
8375 BT_ERR("Unexpected start frame (len %d)", skb->len);
8376 l2cap_recv_reset(conn);
8377 l2cap_conn_unreliable(conn, ECOMM);
8378 }
8379
8380 /* Start fragment may not contain the L2CAP length so just
8381 * copy the initial byte when that happens and use conn->mtu as
8382 * expected length.
8383 */
8384 if (skb->len < L2CAP_LEN_SIZE) {
8385 if (l2cap_recv_frag(conn, skb, conn->mtu) < 0)
8386 goto drop;
8387 return;
8388 }
8389
8390 len = get_unaligned_le16(skb->data) + L2CAP_HDR_SIZE;
8391
8392 if (len == skb->len) {
8393 /* Complete frame received */
8394 l2cap_recv_frame(conn, skb);
8395 return;
8396 }
8397
8398 BT_DBG("Start: total len %d, frag len %u", len, skb->len);
8399
8400 if (skb->len > len) {
8401 BT_ERR("Frame is too long (len %u, expected len %d)",
8402 skb->len, len);
8403 l2cap_conn_unreliable(conn, ECOMM);
8404 goto drop;
8405 }
8406
8407 /* Append fragment into frame (with header) */
8408 if (l2cap_recv_frag(conn, skb, len) < 0)
8409 goto drop;
8410
8411 break;
8412
8413 case ACL_CONT:
8414 BT_DBG("Cont: frag len %u (expecting %u)", skb->len, conn->rx_len);
8415
8416 if (!conn->rx_skb) {
8417 BT_ERR("Unexpected continuation frame (len %d)", skb->len);
8418 l2cap_conn_unreliable(conn, ECOMM);
8419 goto drop;
8420 }
8421
8422 /* Complete the L2CAP length if it has not been read */
8423 if (conn->rx_skb->len < L2CAP_LEN_SIZE) {
8424 if (l2cap_recv_len(conn, skb) < 0) {
8425 l2cap_conn_unreliable(conn, ECOMM);
8426 goto drop;
8427 }
8428
8429 /* Header still could not be read just continue */
8430 if (conn->rx_skb->len < L2CAP_LEN_SIZE)
8431 return;
8432 }
8433
8434 if (skb->len > conn->rx_len) {
8435 BT_ERR("Fragment is too long (len %u, expected %u)",
8436 skb->len, conn->rx_len);
8437 l2cap_recv_reset(conn);
8438 l2cap_conn_unreliable(conn, ECOMM);
8439 goto drop;
8440 }
8441
8442 /* Append fragment into frame (with header) */
8443 l2cap_recv_frag(conn, skb, skb->len);
8444
8445 if (!conn->rx_len) {
8446 /* Complete frame received. l2cap_recv_frame
8447 * takes ownership of the skb so set the global
8448 * rx_skb pointer to NULL first.
8449 */
8450 struct sk_buff *rx_skb = conn->rx_skb;
8451 conn->rx_skb = NULL;
8452 l2cap_recv_frame(conn, rx_skb);
8453 }
8454 break;
8455 }
8456
8457 drop:
8458 kfree_skb(skb);
8459 }
8460
8461 static struct hci_cb l2cap_cb = {
8462 .name = "L2CAP",
8463 .connect_cfm = l2cap_connect_cfm,
8464 .disconn_cfm = l2cap_disconn_cfm,
8465 .security_cfm = l2cap_security_cfm,
8466 };
8467
8468 static int l2cap_debugfs_show(struct seq_file *f, void *p)
8469 {
8470 struct l2cap_chan *c;
8471
8472 read_lock(&chan_list_lock);
8473
8474 list_for_each_entry(c, &chan_list, global_l) {
8475 seq_printf(f, "%pMR (%u) %pMR (%u) %d %d 0x%4.4x 0x%4.4x %d %d %d %d\n",
8476 &c->src, c->src_type, &c->dst, c->dst_type,
8477 c->state, __le16_to_cpu(c->psm),
8478 c->scid, c->dcid, c->imtu, c->omtu,
8479 c->sec_level, c->mode);
8480 }
8481
8482 read_unlock(&chan_list_lock);
8483
8484 return 0;
8485 }
8486
8487 DEFINE_SHOW_ATTRIBUTE(l2cap_debugfs);
8488
8489 static struct dentry *l2cap_debugfs;
8490
8491 int __init l2cap_init(void)
8492 {
8493 int err;
8494
8495 err = l2cap_init_sockets();
8496 if (err < 0)
8497 return err;
8498
8499 hci_register_cb(&l2cap_cb);
8500
8501 if (IS_ERR_OR_NULL(bt_debugfs))
8502 return 0;
8503
8504 l2cap_debugfs = debugfs_create_file("l2cap", 0444, bt_debugfs,
8505 NULL, &l2cap_debugfs_fops);
8506
8507 return 0;
8508 }
8509
8510 void l2cap_exit(void)
8511 {
8512 debugfs_remove(l2cap_debugfs);
8513 hci_unregister_cb(&l2cap_cb);
8514 l2cap_cleanup_sockets();
8515 }
8516
8517 module_param(disable_ertm, bool, 0644);
8518 MODULE_PARM_DESC(disable_ertm, "Disable enhanced retransmission mode");
8519
8520 module_param(enable_ecred, bool, 0644);
8521 MODULE_PARM_DESC(enable_ecred, "Enable enhanced credit flow control mode");
Ubuntu Jammy Linux kernel mirror