projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Merge remote-tracking branch 'selinux/next'
[deliverable/linux.git] / net / bluetooth / l2cap_core.c
CommitLineData
8e87d142 1/*
1da177e4
LT		 2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
ce5706bd 4 Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
5d8868ff 5 Copyright (C) 2010 Google Inc.
590051de 6 Copyright (C) 2011 ProFUSION Embedded Systems
422e925b 7 Copyright (c) 2012 Code Aurora Forum. All rights reserved.
1da177e4
LT		 8
9 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
10
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License version 2 as
13 published by the Free Software Foundation;
14
15 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
16 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
18 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 19 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
20 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
21 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 22 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
23
8e87d142
YH		 24 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
25 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 26 SOFTWARE IS DISCLAIMED.
27*/
28
bb58f747 29/* Bluetooth L2CAP core. */
1da177e4 30
1da177e4
LT		 31#include <linux/module.h>
32
aef7d97c 33#include <linux/debugfs.h>
fcc203c3 34#include <linux/crc16.h>
dbb50887 35#include <linux/filter.h>
1da177e4
LT		 36
37#include <net/bluetooth/bluetooth.h>
38#include <net/bluetooth/hci_core.h>
39#include <net/bluetooth/l2cap.h>
7ef9fbf0 40
ac4b7236 41#include "smp.h"
7024728e 42#include "a2mp.h"
7ef9fbf0 43#include "amp.h"
1da177e4 44
0f1bfe4e
JH		 45#define LE_FLOWCTL_MAX_CREDITS 65535
46
d1de6d46 47bool disable_ertm;
f0709e03 48
547d1032 49static u32 l2cap_feat_mask = L2CAP_FEAT_FIXED_CHAN | L2CAP_FEAT_UCD;
1da177e4 50
b5ad8b7f
JB		 51static LIST_HEAD(chan_list);
52static DEFINE_RWLOCK(chan_list_lock);
1da177e4 53
f15b8ecf
JH		 54static u16 le_max_credits = L2CAP_LE_MAX_CREDITS;
55static u16 le_default_mps = L2CAP_LE_DEFAULT_MPS;
56
1da177e4 57static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
2d792818 58 u8 code, u8 ident, u16 dlen, void *data);
4519de9a 59static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
2d792818 60 void *data);
710f9b0a 61static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data);
5e4e3972 62static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err);
1da177e4 63
d660366d 64static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
2d792818 65 struct sk_buff_head *skbs, u8 event);
608bcc6d 66
a250e048 67static inline u8 bdaddr_type(u8 link_type, u8 bdaddr_type)
4f1654e0 68{
a250e048
JH		 69 if (link_type == LE_LINK) {
70 if (bdaddr_type == ADDR_LE_DEV_PUBLIC)
4f1654e0
MH		 71 return BDADDR_LE_PUBLIC;
72 else
73 return BDADDR_LE_RANDOM;
74 }
75
76 return BDADDR_BREDR;
77}
78
a250e048
JH		 79static inline u8 bdaddr_src_type(struct hci_conn *hcon)
80{
81 return bdaddr_type(hcon->type, hcon->src_type);
82}
83
84static inline u8 bdaddr_dst_type(struct hci_conn *hcon)
85{
86 return bdaddr_type(hcon->type, hcon->dst_type);
87}
88
0139418c 89/* ---- L2CAP channels ---- */
71ba0e56 90
2d792818
GP		 91static struct l2cap_chan *__l2cap_get_chan_by_dcid(struct l2cap_conn *conn,
92 u16 cid)
0139418c 93{
3df91ea2 94 struct l2cap_chan *c;
3d57dc68 95
3df91ea2
AE		 96 list_for_each_entry(c, &conn->chan_l, list) {
97 if (c->dcid == cid)
98 return c;
0139418c 99 }
3df91ea2 100 return NULL;
0139418c
MH		 101}
102
2d792818
GP		 103static struct l2cap_chan *__l2cap_get_chan_by_scid(struct l2cap_conn *conn,
104 u16 cid)
0139418c 105{
3df91ea2 106 struct l2cap_chan *c;
3d57dc68 107
3df91ea2
AE		 108 list_for_each_entry(c, &conn->chan_l, list) {
109 if (c->scid == cid)
110 return c;
0139418c 111 }
3df91ea2 112 return NULL;
0139418c
MH		 113}
114
115/* Find channel with given SCID.
ef191ade 116 * Returns locked channel. */
2d792818
GP		 117static struct l2cap_chan *l2cap_get_chan_by_scid(struct l2cap_conn *conn,
118 u16 cid)
0139418c 119{
48454079 120 struct l2cap_chan *c;
baa7e1fa 121
3df91ea2 122 mutex_lock(&conn->chan_lock);
baa7e1fa 123 c = __l2cap_get_chan_by_scid(conn, cid);
ef191ade
MM		 124 if (c)
125 l2cap_chan_lock(c);
3df91ea2
AE		 126 mutex_unlock(&conn->chan_lock);
127
48454079 128 return c;
0139418c
MH		 129}
130
b1a130b7
MM		 131/* Find channel with given DCID.
132 * Returns locked channel.
133 */
134static struct l2cap_chan *l2cap_get_chan_by_dcid(struct l2cap_conn *conn,
135 u16 cid)
136{
137 struct l2cap_chan *c;
138
139 mutex_lock(&conn->chan_lock);
140 c = __l2cap_get_chan_by_dcid(conn, cid);
141 if (c)
142 l2cap_chan_lock(c);
143 mutex_unlock(&conn->chan_lock);
144
145 return c;
146}
147
2d792818
GP		 148static struct l2cap_chan *__l2cap_get_chan_by_ident(struct l2cap_conn *conn,
149 u8 ident)
0139418c 150{
3df91ea2 151 struct l2cap_chan *c;
3d57dc68 152
3df91ea2
AE		 153 list_for_each_entry(c, &conn->chan_l, list) {
154 if (c->ident == ident)
155 return c;
0139418c 156 }
3df91ea2 157 return NULL;
0139418c
MH		 158}
159
5b155ef9
MM		 160static struct l2cap_chan *l2cap_get_chan_by_ident(struct l2cap_conn *conn,
161 u8 ident)
162{
163 struct l2cap_chan *c;
164
165 mutex_lock(&conn->chan_lock);
166 c = __l2cap_get_chan_by_ident(conn, ident);
167 if (c)
168 l2cap_chan_lock(c);
169 mutex_unlock(&conn->chan_lock);
170
171 return c;
172}
173
23691d75 174static struct l2cap_chan *__l2cap_global_chan_by_addr(__le16 psm, bdaddr_t *src)
9e4425ff 175{
23691d75 176 struct l2cap_chan *c;
9e4425ff 177
23691d75 178 list_for_each_entry(c, &chan_list, global_l) {
7eafc59e 179 if (c->sport == psm && !bacmp(&c->src, src))
250938cb 180 return c;
9e4425ff 181 }
250938cb 182 return NULL;
9e4425ff
GP		 183}
184
185int l2cap_add_psm(struct l2cap_chan *chan, bdaddr_t *src, __le16 psm)
186{
73b2ec18
GP		 187 int err;
188
333055f2 189 write_lock(&chan_list_lock);
9e4425ff 190
23691d75 191 if (psm && __l2cap_global_chan_by_addr(psm, src)) {
73b2ec18
GP		 192 err = -EADDRINUSE;
193 goto done;
9e4425ff
GP		 194 }
195
73b2ec18
GP		 196 if (psm) {
197 chan->psm = psm;
198 chan->sport = psm;
199 err = 0;
200 } else {
92594a51
JH		 201 u16 p, start, end, incr;
202
203 if (chan->src_type == BDADDR_BREDR) {
204 start = L2CAP_PSM_DYN_START;
205 end = L2CAP_PSM_AUTO_END;
206 incr = 2;
207 } else {
208 start = L2CAP_PSM_LE_DYN_START;
209 end = L2CAP_PSM_LE_DYN_END;
210 incr = 1;
211 }
73b2ec18
GP		 212
213 err = -EINVAL;
92594a51 214 for (p = start; p <= end; p += incr)
23691d75 215 if (!__l2cap_global_chan_by_addr(cpu_to_le16(p), src)) {
73b2ec18
GP		 216 chan->psm = cpu_to_le16(p);
217 chan->sport = cpu_to_le16(p);
218 err = 0;
219 break;
220 }
221 }
9e4425ff 222
73b2ec18 223done:
333055f2 224 write_unlock(&chan_list_lock);
73b2ec18 225 return err;
9e4425ff 226}
6b8d4a6a 227EXPORT_SYMBOL_GPL(l2cap_add_psm);
9e4425ff
GP		 228
229int l2cap_add_scid(struct l2cap_chan *chan, __u16 scid)
230{
333055f2 231 write_lock(&chan_list_lock);
9e4425ff 232
14824308
JH		 233 /* Override the defaults (which are for conn-oriented) */
234 chan->omtu = L2CAP_DEFAULT_MTU;
235 chan->chan_type = L2CAP_CHAN_FIXED;
236
9e4425ff
GP		 237 chan->scid = scid;
238
333055f2 239 write_unlock(&chan_list_lock);
9e4425ff
GP		 240
241 return 0;
242}
243
baa7e1fa 244static u16 l2cap_alloc_cid(struct l2cap_conn *conn)
0139418c 245{
e77af755 246 u16 cid, dyn_end;
0139418c 247
e77af755
JH		 248 if (conn->hcon->type == LE_LINK)
249 dyn_end = L2CAP_CID_LE_DYN_END;
250 else
251 dyn_end = L2CAP_CID_DYN_END;
252
ab0c127f 253 for (cid = L2CAP_CID_DYN_START; cid <= dyn_end; cid++) {
baa7e1fa 254 if (!__l2cap_get_chan_by_scid(conn, cid))
0139418c
MH		 255 return cid;
256 }
257
258 return 0;
259}
260
f93fa273 261static void l2cap_state_change(struct l2cap_chan *chan, int state)
89bc500e 262{
42d2d87c 263 BT_DBG("chan %p %s -> %s", chan, state_to_string(chan->state),
2d792818 264 state_to_string(state));
badaaa00 265
89bc500e 266 chan->state = state;
53f52121 267 chan->ops->state_change(chan, state, 0);
89bc500e
GP		 268}
269
f8e73017
GP		 270static inline void l2cap_state_change_and_error(struct l2cap_chan *chan,
271 int state, int err)
2e0052e4 272{
f8e73017 273 chan->state = state;
53f52121 274 chan->ops->state_change(chan, chan->state, err);
2e0052e4
AE		 275}
276
277static inline void l2cap_chan_set_err(struct l2cap_chan *chan, int err)
278{
f8e73017 279 chan->ops->state_change(chan, chan->state, err);
2e0052e4
AE		 280}
281
4239d16f
MM		 282static void __set_retrans_timer(struct l2cap_chan *chan)
283{
284 if (!delayed_work_pending(&chan->monitor_timer) &&
285 chan->retrans_timeout) {
286 l2cap_set_timer(chan, &chan->retrans_timer,
287 msecs_to_jiffies(chan->retrans_timeout));
288 }
289}
290
291static void __set_monitor_timer(struct l2cap_chan *chan)
292{
293 __clear_retrans_timer(chan);
294 if (chan->monitor_timeout) {
295 l2cap_set_timer(chan, &chan->monitor_timer,
296 msecs_to_jiffies(chan->monitor_timeout));
297 }
298}
299
608bcc6d
MM		 300static struct sk_buff *l2cap_ertm_seq_in_queue(struct sk_buff_head *head,
301 u16 seq)
302{
303 struct sk_buff *skb;
304
305 skb_queue_walk(head, skb) {
a4368ff3 306 if (bt_cb(skb)->l2cap.txseq == seq)
608bcc6d
MM		 307 return skb;
308 }
309
310 return NULL;
311}
312
3c588192
MM		 313/* ---- L2CAP sequence number lists ---- */
314
315/* For ERTM, ordered lists of sequence numbers must be tracked for
316 * SREJ requests that are received and for frames that are to be
317 * retransmitted. These seq_list functions implement a singly-linked
318 * list in an array, where membership in the list can also be checked
319 * in constant time. Items can also be added to the tail of the list
320 * and removed from the head in constant time, without further memory
321 * allocs or frees.
322 */
323
324static int l2cap_seq_list_init(struct l2cap_seq_list *seq_list, u16 size)
325{
326 size_t alloc_size, i;
327
328 /* Allocated size is a power of 2 to map sequence numbers
329 * (which may be up to 14 bits) in to a smaller array that is
330 * sized for the negotiated ERTM transmit windows.
331 */
332 alloc_size = roundup_pow_of_two(size);
333
334 seq_list->list = kmalloc(sizeof(u16) * alloc_size, GFP_KERNEL);
335 if (!seq_list->list)
336 return -ENOMEM;
337
338 seq_list->mask = alloc_size - 1;
339 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
340 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
341 for (i = 0; i < alloc_size; i++)
342 seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR;
343
344 return 0;
345}
346
347static inline void l2cap_seq_list_free(struct l2cap_seq_list *seq_list)
348{
349 kfree(seq_list->list);
350}
351
352static inline bool l2cap_seq_list_contains(struct l2cap_seq_list *seq_list,
353 u16 seq)
354{
355 /* Constant-time check for list membership */
356 return seq_list->list[seq & seq_list->mask] != L2CAP_SEQ_LIST_CLEAR;
357}
358
03a0c5d6 359static inline u16 l2cap_seq_list_pop(struct l2cap_seq_list *seq_list)
3c588192 360{
03a0c5d6 361 u16 seq = seq_list->head;
3c588192
MM		 362 u16 mask = seq_list->mask;
363
03a0c5d6
JH		 364 seq_list->head = seq_list->list[seq & mask];
365 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_CLEAR;
366
367 if (seq_list->head == L2CAP_SEQ_LIST_TAIL) {
368 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
369 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
3c588192 370 }
3c588192 371
03a0c5d6 372 return seq;
3c588192
MM		 373}
374
375static void l2cap_seq_list_clear(struct l2cap_seq_list *seq_list)
376{
f522ae36 377 u16 i;
3c588192 378
f522ae36
GP		 379 if (seq_list->head == L2CAP_SEQ_LIST_CLEAR)
380 return;
381
382 for (i = 0; i <= seq_list->mask; i++)
383 seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR;
384
385 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
386 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
3c588192
MM		 387}
388
389static void l2cap_seq_list_append(struct l2cap_seq_list *seq_list, u16 seq)
390{
391 u16 mask = seq_list->mask;
392
393 /* All appends happen in constant time */
394
f522ae36
GP		 395 if (seq_list->list[seq & mask] != L2CAP_SEQ_LIST_CLEAR)
396 return;
3c588192 397
f522ae36
GP		 398 if (seq_list->tail == L2CAP_SEQ_LIST_CLEAR)
399 seq_list->head = seq;
400 else
401 seq_list->list[seq_list->tail & mask] = seq;
402
403 seq_list->tail = seq;
404 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_TAIL;
3c588192
MM		 405}
406
721c4181 407static void l2cap_chan_timeout(struct work_struct *work)
ab07801d 408{
721c4181 409 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
2d792818 410 chan_timer.work);
3df91ea2 411 struct l2cap_conn *conn = chan->conn;
ab07801d
GP		 412 int reason;
413
e05dcc32 414 BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
ab07801d 415
3df91ea2 416 mutex_lock(&conn->chan_lock);
6be36555 417 l2cap_chan_lock(chan);
ab07801d 418
89bc500e 419 if (chan->state == BT_CONNECTED || chan->state == BT_CONFIG)
ab07801d 420 reason = ECONNREFUSED;
89bc500e 421 else if (chan->state == BT_CONNECT &&
2d792818 422 chan->sec_level != BT_SECURITY_SDP)
ab07801d
GP		 423 reason = ECONNREFUSED;
424 else
425 reason = ETIMEDOUT;
426
0f852724 427 l2cap_chan_close(chan, reason);
ab07801d 428
6be36555 429 l2cap_chan_unlock(chan);
ab07801d 430
80b98027 431 chan->ops->close(chan);
3df91ea2
AE		 432 mutex_unlock(&conn->chan_lock);
433
371fd835 434 l2cap_chan_put(chan);
ab07801d
GP		 435}
436
eef1d9b6 437struct l2cap_chan *l2cap_chan_create(void)
48454079
GP		 438{
439 struct l2cap_chan *chan;
440
441 chan = kzalloc(sizeof(*chan), GFP_ATOMIC);
442 if (!chan)
443 return NULL;
444
c03b355e
AE		 445 mutex_init(&chan->lock);
446
ff714119
JH		 447 /* Set default lock nesting level */
448 atomic_set(&chan->nesting, L2CAP_NESTING_NORMAL);
449
333055f2 450 write_lock(&chan_list_lock);
23691d75 451 list_add(&chan->global_l, &chan_list);
333055f2 452 write_unlock(&chan_list_lock);
23691d75 453
721c4181 454 INIT_DELAYED_WORK(&chan->chan_timer, l2cap_chan_timeout);
ab07801d 455
89bc500e
GP		 456 chan->state = BT_OPEN;
457
144ad330 458 kref_init(&chan->kref);
71ba0e56 459
2827011f
MM		 460 /* This flag is cleared in l2cap_chan_ready() */
461 set_bit(CONF_NOT_COMPLETE, &chan->conf_state);
462
eef1d9b6 463 BT_DBG("chan %p", chan);
abc545b8 464
48454079
GP		 465 return chan;
466}
6b8d4a6a 467EXPORT_SYMBOL_GPL(l2cap_chan_create);
48454079 468
144ad330 469static void l2cap_chan_destroy(struct kref *kref)
6ff5abbf 470{
144ad330
SS		 471 struct l2cap_chan *chan = container_of(kref, struct l2cap_chan, kref);
472
4af66c69
JK		 473 BT_DBG("chan %p", chan);
474
333055f2 475 write_lock(&chan_list_lock);
23691d75 476 list_del(&chan->global_l);
333055f2 477 write_unlock(&chan_list_lock);
23691d75 478
4af66c69 479 kfree(chan);
6ff5abbf
GP		 480}
481
30648372
JK		 482void l2cap_chan_hold(struct l2cap_chan *c)
483{
144ad330 484 BT_DBG("chan %p orig refcnt %d", c, atomic_read(&c->kref.refcount));
30648372 485
144ad330 486 kref_get(&c->kref);
30648372
JK		 487}
488
489void l2cap_chan_put(struct l2cap_chan *c)
490{
144ad330 491 BT_DBG("chan %p orig refcnt %d", c, atomic_read(&c->kref.refcount));
30648372 492
144ad330 493 kref_put(&c->kref, l2cap_chan_destroy);
30648372 494}
6b8d4a6a 495EXPORT_SYMBOL_GPL(l2cap_chan_put);
30648372 496
bd4b1653
AE		 497void l2cap_chan_set_defaults(struct l2cap_chan *chan)
498{
499 chan->fcs = L2CAP_FCS_CRC16;
500 chan->max_tx = L2CAP_DEFAULT_MAX_TX;
501 chan->tx_win = L2CAP_DEFAULT_TX_WINDOW;
502 chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
6a5e8165
JR		 503 chan->remote_max_tx = chan->max_tx;
504 chan->remote_tx_win = chan->tx_win;
c20f8e35 505 chan->ack_win = L2CAP_DEFAULT_TX_WINDOW;
bd4b1653 506 chan->sec_level = BT_SECURITY_LOW;
6a5e8165
JR		 507 chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
508 chan->retrans_timeout = L2CAP_DEFAULT_RETRANS_TO;
509 chan->monitor_timeout = L2CAP_DEFAULT_MONITOR_TO;
510 chan->conf_state = 0;
bd4b1653
AE		 511
512 set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
513}
6b8d4a6a 514EXPORT_SYMBOL_GPL(l2cap_chan_set_defaults);
bd4b1653 515
0ce43ce6 516static void l2cap_le_flowctl_init(struct l2cap_chan *chan)
38319713 517{
0ce43ce6
JH		 518 chan->sdu = NULL;
519 chan->sdu_last_frag = NULL;
520 chan->sdu_len = 0;
0cd75f7e 521 chan->tx_credits = 0;
f15b8ecf 522 chan->rx_credits = le_max_credits;
d1d79413 523 chan->mps = min_t(u16, chan->imtu, le_default_mps);
0ce43ce6
JH		 524
525 skb_queue_head_init(&chan->tx_q);
38319713
JH		 526}
527
93c3e8f5 528void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
0139418c 529{
af05b30b 530 BT_DBG("conn %p, psm 0x%2.2x, dcid 0x%4.4x", conn,
097db76c 531 __le16_to_cpu(chan->psm), chan->dcid);
0139418c 532
9f5a0d7b 533 conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
2950f21a 534
8c1d787b 535 chan->conn = conn;
0139418c 536
5491120e
AE		 537 switch (chan->chan_type) {
538 case L2CAP_CHAN_CONN_ORIENTED:
21626e62
JH		 539 /* Alloc CID for connection-oriented socket */
540 chan->scid = l2cap_alloc_cid(conn);
541 if (conn->hcon->type == ACL_LINK)
0c1bc5c6 542 chan->omtu = L2CAP_DEFAULT_MTU;
5491120e
AE		 543 break;
544
545 case L2CAP_CHAN_CONN_LESS:
0139418c 546 /* Connectionless socket */
fe4128e0
GP		 547 chan->scid = L2CAP_CID_CONN_LESS;
548 chan->dcid = L2CAP_CID_CONN_LESS;
0c1bc5c6 549 chan->omtu = L2CAP_DEFAULT_MTU;
5491120e
AE		 550 break;
551
2338a7e0
JH		 552 case L2CAP_CHAN_FIXED:
553 /* Caller will set CID and CID specific MTU values */
416fa752
AE		 554 break;
555
5491120e 556 default:
0139418c 557 /* Raw socket can send/recv signalling messages only */
fe4128e0
GP		 558 chan->scid = L2CAP_CID_SIGNALING;
559 chan->dcid = L2CAP_CID_SIGNALING;
0c1bc5c6 560 chan->omtu = L2CAP_DEFAULT_MTU;
0139418c
MH		 561 }
562
8f7975b1
AE		 563 chan->local_id = L2CAP_BESTEFFORT_ID;
564 chan->local_stype = L2CAP_SERV_BESTEFFORT;
565 chan->local_msdu = L2CAP_DEFAULT_MAX_SDU_SIZE;
566 chan->local_sdu_itime = L2CAP_DEFAULT_SDU_ITIME;
567 chan->local_acc_lat = L2CAP_DEFAULT_ACC_LAT;
8936fa6d 568 chan->local_flush_to = L2CAP_EFS_DEFAULT_FLUSH_TO;
8f7975b1 569
371fd835 570 l2cap_chan_hold(chan);
baa7e1fa 571
c16900cf
JH		 572 /* Only keep a reference for fixed channels if they requested it */
573 if (chan->chan_type != L2CAP_CHAN_FIXED ||
574 test_bit(FLAG_HOLD_HCI_CONN, &chan->flags))
575 hci_conn_hold(conn->hcon);
5ee9891d 576
3df91ea2 577 list_add(&chan->list, &conn->chan_l);
643162a8
AE		 578}
579
466f8004 580void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
643162a8
AE		 581{
582 mutex_lock(&conn->chan_lock);
583 __l2cap_chan_add(conn, chan);
3df91ea2 584 mutex_unlock(&conn->chan_lock);
0139418c
MH		 585}
586
466f8004 587void l2cap_chan_del(struct l2cap_chan *chan, int err)
0139418c 588{
8c1d787b 589 struct l2cap_conn *conn = chan->conn;
0139418c 590
c9b66675 591 __clear_chan_timer(chan);
0139418c 592
49d11741
JH		 593 BT_DBG("chan %p, conn %p, err %d, state %s", chan, conn, err,
594 state_to_string(chan->state));
0139418c 595
72847ce0
JH		 596 chan->ops->teardown(chan, err);
597
8e87d142 598 if (conn) {
56f60984 599 struct amp_mgr *mgr = conn->hcon->amp_mgr;
baa7e1fa 600 /* Delete from channel list */
3df91ea2 601 list_del(&chan->list);
3d57dc68 602
371fd835 603 l2cap_chan_put(chan);
baa7e1fa 604
8c1d787b 605 chan->conn = NULL;
3cabbfda 606
c16900cf
JH		 607 /* Reference was only held for non-fixed channels or
608 * fixed channels that explicitly requested it using the
609 * FLAG_HOLD_HCI_CONN flag.
610 */
611 if (chan->chan_type != L2CAP_CHAN_FIXED ||
612 test_bit(FLAG_HOLD_HCI_CONN, &chan->flags))
76a68ba0 613 hci_conn_drop(conn->hcon);
56f60984
AE		 614
615 if (mgr && mgr->bredr_chan == chan)
616 mgr->bredr_chan = NULL;
0139418c
MH		 617 }
618
419e08c1
AE		 619 if (chan->hs_hchan) {
620 struct hci_chan *hs_hchan = chan->hs_hchan;
621
622 BT_DBG("chan %p disconnect hs_hchan %p", chan, hs_hchan);
623 amp_disconnect_logical_link(hs_hchan);
624 }
625
2827011f 626 if (test_bit(CONF_NOT_COMPLETE, &chan->conf_state))
6ff5abbf 627 return;
2ead70b8 628
ee556f66
GP		 629 switch(chan->mode) {
630 case L2CAP_MODE_BASIC:
631 break;
c13ffa62 632
38319713 633 case L2CAP_MODE_LE_FLOWCTL:
177f8f2b 634 skb_queue_purge(&chan->tx_q);
38319713
JH		 635 break;
636
ee556f66 637 case L2CAP_MODE_ERTM:
1a09bcb9
GP		 638 __clear_retrans_timer(chan);
639 __clear_monitor_timer(chan);
640 __clear_ack_timer(chan);
c13ffa62 641
f1c6775b 642 skb_queue_purge(&chan->srej_q);
c13ffa62 643
3c588192
MM		 644 l2cap_seq_list_free(&chan->srej_list);
645 l2cap_seq_list_free(&chan->retrans_list);
ee556f66
GP		 646
647 /* fall through */
648
649 case L2CAP_MODE_STREAMING:
650 skb_queue_purge(&chan->tx_q);
651 break;
c13ffa62 652 }
ee556f66
GP		 653
654 return;
0139418c 655}
6b8d4a6a 656EXPORT_SYMBOL_GPL(l2cap_chan_del);
0139418c 657
f3d82d0c 658static void l2cap_conn_update_id_addr(struct work_struct *work)
387a33e3 659{
f3d82d0c
JH		 660 struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
661 id_addr_update_work);
662 struct hci_conn *hcon = conn->hcon;
387a33e3
JH		 663 struct l2cap_chan *chan;
664
665 mutex_lock(&conn->chan_lock);
666
667 list_for_each_entry(chan, &conn->chan_l, list) {
668 l2cap_chan_lock(chan);
669 bacpy(&chan->dst, &hcon->dst);
a250e048 670 chan->dst_type = bdaddr_dst_type(hcon);
387a33e3
JH		 671 l2cap_chan_unlock(chan);
672 }
673
674 mutex_unlock(&conn->chan_lock);
675}
676
27e2d4c8
JH		 677static void l2cap_chan_le_connect_reject(struct l2cap_chan *chan)
678{
679 struct l2cap_conn *conn = chan->conn;
680 struct l2cap_le_conn_rsp rsp;
681 u16 result;
682
683 if (test_bit(FLAG_DEFER_SETUP, &chan->flags))
684 result = L2CAP_CR_AUTHORIZATION;
685 else
686 result = L2CAP_CR_BAD_PSM;
687
688 l2cap_state_change(chan, BT_DISCONN);
689
690 rsp.dcid = cpu_to_le16(chan->scid);
691 rsp.mtu = cpu_to_le16(chan->imtu);
3916aed8 692 rsp.mps = cpu_to_le16(chan->mps);
0cd75f7e 693 rsp.credits = cpu_to_le16(chan->rx_credits);
27e2d4c8
JH		 694 rsp.result = cpu_to_le16(result);
695
696 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp),
697 &rsp);
698}
699
791d60f7
JH		 700static void l2cap_chan_connect_reject(struct l2cap_chan *chan)
701{
702 struct l2cap_conn *conn = chan->conn;
703 struct l2cap_conn_rsp rsp;
704 u16 result;
705
706 if (test_bit(FLAG_DEFER_SETUP, &chan->flags))
707 result = L2CAP_CR_SEC_BLOCK;
708 else
709 result = L2CAP_CR_BAD_PSM;
710
711 l2cap_state_change(chan, BT_DISCONN);
712
713 rsp.scid = cpu_to_le16(chan->dcid);
714 rsp.dcid = cpu_to_le16(chan->scid);
715 rsp.result = cpu_to_le16(result);
dcf4adbf 716 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
791d60f7
JH		 717
718 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP, sizeof(rsp), &rsp);
719}
720
0f852724 721void l2cap_chan_close(struct l2cap_chan *chan, int reason)
4519de9a
GP		 722{
723 struct l2cap_conn *conn = chan->conn;
4519de9a 724
7eafc59e 725 BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
4519de9a 726
89bc500e 727 switch (chan->state) {
4519de9a 728 case BT_LISTEN:
b699ec0d 729 chan->ops->teardown(chan, 0);
4519de9a
GP		 730 break;
731
732 case BT_CONNECTED:
733 case BT_CONFIG:
7b25c9b3 734 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED) {
8d836d71 735 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
5e4e3972 736 l2cap_send_disconn_req(chan, reason);
4519de9a
GP		 737 } else
738 l2cap_chan_del(chan, reason);
739 break;
740
741 case BT_CONNECT2:
791d60f7
JH		 742 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED) {
743 if (conn->hcon->type == ACL_LINK)
744 l2cap_chan_connect_reject(chan);
27e2d4c8
JH		 745 else if (conn->hcon->type == LE_LINK)
746 l2cap_chan_le_connect_reject(chan);
4519de9a
GP		 747 }
748
749 l2cap_chan_del(chan, reason);
750 break;
751
752 case BT_CONNECT:
753 case BT_DISCONN:
754 l2cap_chan_del(chan, reason);
755 break;
756
757 default:
b699ec0d 758 chan->ops->teardown(chan, 0);
4519de9a
GP		 759 break;
760 }
761}
6b8d4a6a 762EXPORT_SYMBOL(l2cap_chan_close);
4519de9a 763
4343478f 764static inline u8 l2cap_get_auth_type(struct l2cap_chan *chan)
79d554a6 765{
6a974b50
MH		 766 switch (chan->chan_type) {
767 case L2CAP_CHAN_RAW:
4343478f 768 switch (chan->sec_level) {
8556edd3 769 case BT_SECURITY_HIGH:
7d513e92 770 case BT_SECURITY_FIPS:
8556edd3
JH		 771 return HCI_AT_DEDICATED_BONDING_MITM;
772 case BT_SECURITY_MEDIUM:
773 return HCI_AT_DEDICATED_BONDING;
774 default:
775 return HCI_AT_NO_BONDING;
776 }
6a974b50 777 break;
3124b843 778 case L2CAP_CHAN_CONN_LESS:
dcf4adbf 779 if (chan->psm == cpu_to_le16(L2CAP_PSM_3DSP)) {
3124b843
MH		 780 if (chan->sec_level == BT_SECURITY_LOW)
781 chan->sec_level = BT_SECURITY_SDP;
782 }
7d513e92
MH		 783 if (chan->sec_level == BT_SECURITY_HIGH ||
784 chan->sec_level == BT_SECURITY_FIPS)
3124b843
MH		 785 return HCI_AT_NO_BONDING_MITM;
786 else
787 return HCI_AT_NO_BONDING;
788 break;
6a974b50 789 case L2CAP_CHAN_CONN_ORIENTED:
dcf4adbf 790 if (chan->psm == cpu_to_le16(L2CAP_PSM_SDP)) {
6a974b50
MH		 791 if (chan->sec_level == BT_SECURITY_LOW)
792 chan->sec_level = BT_SECURITY_SDP;
0684e5f9 793
7d513e92
MH		 794 if (chan->sec_level == BT_SECURITY_HIGH ||
795 chan->sec_level == BT_SECURITY_FIPS)
6a974b50
MH		 796 return HCI_AT_NO_BONDING_MITM;
797 else
798 return HCI_AT_NO_BONDING;
799 }
800 /* fall through */
801 default:
4343478f 802 switch (chan->sec_level) {
00ae4af9 803 case BT_SECURITY_HIGH:
7d513e92 804 case BT_SECURITY_FIPS:
8556edd3 805 return HCI_AT_GENERAL_BONDING_MITM;
00ae4af9 806 case BT_SECURITY_MEDIUM:
8556edd3 807 return HCI_AT_GENERAL_BONDING;
00ae4af9 808 default:
8556edd3 809 return HCI_AT_NO_BONDING;
00ae4af9 810 }
6a974b50 811 break;
0684e5f9 812 }
8556edd3
JH		 813}
814
815/* Service level security */
e7cafc45 816int l2cap_chan_check_security(struct l2cap_chan *chan, bool initiator)
8556edd3 817{
8c1d787b 818 struct l2cap_conn *conn = chan->conn;
8556edd3
JH		 819 __u8 auth_type;
820
a17de2fe
JH		 821 if (conn->hcon->type == LE_LINK)
822 return smp_conn_security(conn->hcon, chan->sec_level);
823
4343478f 824 auth_type = l2cap_get_auth_type(chan);
79d554a6 825
e7cafc45
JH		 826 return hci_conn_security(conn->hcon, chan->sec_level, auth_type,
827 initiator);
79d554a6
MH		 828}
829
b5ad8b7f 830static u8 l2cap_get_ident(struct l2cap_conn *conn)
4e8402a3
MH		 831{
832 u8 id;
833
834 /* Get next available identificator.
835 * 1 - 128 are used by kernel.
836 * 129 - 199 are reserved.
837 * 200 - 254 are used by utilities like l2ping, etc.
838 */
839
5a54e7c8 840 mutex_lock(&conn->ident_lock);
4e8402a3
MH		 841
842 if (++conn->tx_ident > 128)
843 conn->tx_ident = 1;
844
845 id = conn->tx_ident;
846
5a54e7c8 847 mutex_unlock(&conn->ident_lock);
4e8402a3
MH		 848
849 return id;
850}
851
2d792818
GP		 852static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
853 void *data)
4e8402a3
MH		 854{
855 struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data);
e702112f 856 u8 flags;
4e8402a3
MH		 857
858 BT_DBG("code 0x%2.2x", code);
859
860 if (!skb)
9a9c6a34 861 return;
4e8402a3 862
f6af675e
SW		 863 /* Use NO_FLUSH if supported or we have an LE link (which does
864 * not support auto-flushing packets) */
865 if (lmp_no_flush_capable(conn->hcon->hdev) ||
866 conn->hcon->type == LE_LINK)
e702112f
AE		 867 flags = ACL_START_NO_FLUSH;
868 else
869 flags = ACL_START;
870
14b12d0b 871 bt_cb(skb)->force_active = BT_POWER_FORCE_ACTIVE_ON;
5e59b791 872 skb->priority = HCI_PRIO_MAX;
14b12d0b 873
73d80deb
LAD		 874 hci_send_acl(conn->hchan, skb, flags);
875}
876
02b0fbb9
MM		 877static bool __chan_is_moving(struct l2cap_chan *chan)
878{
879 return chan->move_state != L2CAP_MOVE_STABLE &&
880 chan->move_state != L2CAP_MOVE_WAIT_PREPARE;
881}
882
73d80deb
LAD		 883static void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb)
884{
885 struct hci_conn *hcon = chan->conn->hcon;
886 u16 flags;
887
888 BT_DBG("chan %p, skb %p len %d priority %u", chan, skb, skb->len,
2d792818 889 skb->priority);
73d80deb 890
d5f8a75d
MM		 891 if (chan->hs_hcon && !__chan_is_moving(chan)) {
892 if (chan->hs_hchan)
893 hci_send_acl(chan->hs_hchan, skb, ACL_COMPLETE);
894 else
895 kfree_skb(skb);
896
897 return;
898 }
899
f6af675e
SW		 900 /* Use NO_FLUSH for LE links (where this is the only option) or
901 * if the BR/EDR link supports it and flushing has not been
902 * explicitly requested (through FLAG_FLUSHABLE).
903 */
904 if (hcon->type == LE_LINK ||
905 (!test_bit(FLAG_FLUSHABLE, &chan->flags) &&
906 lmp_no_flush_capable(hcon->hdev)))
73d80deb
LAD		 907 flags = ACL_START_NO_FLUSH;
908 else
909 flags = ACL_START;
14b12d0b 910
73d80deb
LAD		 911 bt_cb(skb)->force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
912 hci_send_acl(chan->conn->hchan, skb, flags);
4e8402a3
MH		 913}
914
b76bbd66
MM		 915static void __unpack_enhanced_control(u16 enh, struct l2cap_ctrl *control)
916{
917 control->reqseq = (enh & L2CAP_CTRL_REQSEQ) >> L2CAP_CTRL_REQSEQ_SHIFT;
918 control->final = (enh & L2CAP_CTRL_FINAL) >> L2CAP_CTRL_FINAL_SHIFT;
919
920 if (enh & L2CAP_CTRL_FRAME_TYPE) {
921 /* S-Frame */
922 control->sframe = 1;
923 control->poll = (enh & L2CAP_CTRL_POLL) >> L2CAP_CTRL_POLL_SHIFT;
924 control->super = (enh & L2CAP_CTRL_SUPERVISE) >> L2CAP_CTRL_SUPER_SHIFT;
925
926 control->sar = 0;
927 control->txseq = 0;
928 } else {
929 /* I-Frame */
930 control->sframe = 0;
931 control->sar = (enh & L2CAP_CTRL_SAR) >> L2CAP_CTRL_SAR_SHIFT;
932 control->txseq = (enh & L2CAP_CTRL_TXSEQ) >> L2CAP_CTRL_TXSEQ_SHIFT;
933
934 control->poll = 0;
935 control->super = 0;
936 }
937}
938
b76bbd66
MM		 939static void __unpack_extended_control(u32 ext, struct l2cap_ctrl *control)
940{
941 control->reqseq = (ext & L2CAP_EXT_CTRL_REQSEQ) >> L2CAP_EXT_CTRL_REQSEQ_SHIFT;
942 control->final = (ext & L2CAP_EXT_CTRL_FINAL) >> L2CAP_EXT_CTRL_FINAL_SHIFT;
943
944 if (ext & L2CAP_EXT_CTRL_FRAME_TYPE) {
945 /* S-Frame */
946 control->sframe = 1;
947 control->poll = (ext & L2CAP_EXT_CTRL_POLL) >> L2CAP_EXT_CTRL_POLL_SHIFT;
948 control->super = (ext & L2CAP_EXT_CTRL_SUPERVISE) >> L2CAP_EXT_CTRL_SUPER_SHIFT;
949
950 control->sar = 0;
951 control->txseq = 0;
952 } else {
953 /* I-Frame */
954 control->sframe = 0;
955 control->sar = (ext & L2CAP_EXT_CTRL_SAR) >> L2CAP_EXT_CTRL_SAR_SHIFT;
956 control->txseq = (ext & L2CAP_EXT_CTRL_TXSEQ) >> L2CAP_EXT_CTRL_TXSEQ_SHIFT;
957
958 control->poll = 0;
959 control->super = 0;
960 }
961}
962
963static inline void __unpack_control(struct l2cap_chan *chan,
964 struct sk_buff *skb)
965{
966 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
967 __unpack_extended_control(get_unaligned_le32(skb->data),
a4368ff3 968 &bt_cb(skb)->l2cap);
cec8ab6e 969 skb_pull(skb, L2CAP_EXT_CTRL_SIZE);
b76bbd66
MM		 970 } else {
971 __unpack_enhanced_control(get_unaligned_le16(skb->data),
a4368ff3 972 &bt_cb(skb)->l2cap);
cec8ab6e 973 skb_pull(skb, L2CAP_ENH_CTRL_SIZE);
b76bbd66
MM		 974 }
975}
976
b5c6aaed
MM		 977static u32 __pack_extended_control(struct l2cap_ctrl *control)
978{
979 u32 packed;
980
981 packed = control->reqseq << L2CAP_EXT_CTRL_REQSEQ_SHIFT;
982 packed |= control->final << L2CAP_EXT_CTRL_FINAL_SHIFT;
983
984 if (control->sframe) {
985 packed |= control->poll << L2CAP_EXT_CTRL_POLL_SHIFT;
986 packed |= control->super << L2CAP_EXT_CTRL_SUPER_SHIFT;
987 packed |= L2CAP_EXT_CTRL_FRAME_TYPE;
988 } else {
989 packed |= control->sar << L2CAP_EXT_CTRL_SAR_SHIFT;
990 packed |= control->txseq << L2CAP_EXT_CTRL_TXSEQ_SHIFT;
991 }
992
993 return packed;
994}
995
996static u16 __pack_enhanced_control(struct l2cap_ctrl *control)
997{
998 u16 packed;
999
1000 packed = control->reqseq << L2CAP_CTRL_REQSEQ_SHIFT;
1001 packed |= control->final << L2CAP_CTRL_FINAL_SHIFT;
1002
1003 if (control->sframe) {
1004 packed |= control->poll << L2CAP_CTRL_POLL_SHIFT;
1005 packed |= control->super << L2CAP_CTRL_SUPER_SHIFT;
1006 packed |= L2CAP_CTRL_FRAME_TYPE;
1007 } else {
1008 packed |= control->sar << L2CAP_CTRL_SAR_SHIFT;
1009 packed |= control->txseq << L2CAP_CTRL_TXSEQ_SHIFT;
1010 }
1011
1012 return packed;
1013}
1014
b76bbd66
MM		 1015static inline void __pack_control(struct l2cap_chan *chan,
1016 struct l2cap_ctrl *control,
1017 struct sk_buff *skb)
1018{
1019 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
1020 put_unaligned_le32(__pack_extended_control(control),
1021 skb->data + L2CAP_HDR_SIZE);
1022 } else {
1023 put_unaligned_le16(__pack_enhanced_control(control),
1024 skb->data + L2CAP_HDR_SIZE);
1025 }
1026}
1027
ba7aa64f
GP		 1028static inline unsigned int __ertm_hdr_size(struct l2cap_chan *chan)
1029{
1030 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
1031 return L2CAP_EXT_HDR_SIZE;
1032 else
1033 return L2CAP_ENH_HDR_SIZE;
1034}
1035
a67d7f6f
MM		 1036static struct sk_buff *l2cap_create_sframe_pdu(struct l2cap_chan *chan,
1037 u32 control)
b5c6aaed
MM		 1038{
1039 struct sk_buff *skb;
1040 struct l2cap_hdr *lh;
ba7aa64f 1041 int hlen = __ertm_hdr_size(chan);
b5c6aaed
MM		 1042
1043 if (chan->fcs == L2CAP_FCS_CRC16)
1044 hlen += L2CAP_FCS_SIZE;
1045
a67d7f6f 1046 skb = bt_skb_alloc(hlen, GFP_KERNEL);
b5c6aaed 1047
b5c6aaed 1048 if (!skb)
a67d7f6f 1049 return ERR_PTR(-ENOMEM);
b5c6aaed
MM		 1050
1051 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
1052 lh->len = cpu_to_le16(hlen - L2CAP_HDR_SIZE);
1053 lh->cid = cpu_to_le16(chan->dcid);
1054
a67d7f6f
MM		 1055 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
1056 put_unaligned_le32(control, skb_put(skb, L2CAP_EXT_CTRL_SIZE));
1057 else
1058 put_unaligned_le16(control, skb_put(skb, L2CAP_ENH_CTRL_SIZE));
b5c6aaed
MM		 1059
1060 if (chan->fcs == L2CAP_FCS_CRC16) {
a67d7f6f 1061 u16 fcs = crc16(0, (u8 *)skb->data, skb->len);
b5c6aaed
MM		 1062 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
1063 }
1064
1065 skb->priority = HCI_PRIO_MAX;
a67d7f6f
MM		 1066 return skb;
1067}
1068
1069static void l2cap_send_sframe(struct l2cap_chan *chan,
1070 struct l2cap_ctrl *control)
1071{
1072 struct sk_buff *skb;
1073 u32 control_field;
1074
1075 BT_DBG("chan %p, control %p", chan, control);
1076
1077 if (!control->sframe)
1078 return;
1079
b99e13ad
MM		 1080 if (__chan_is_moving(chan))
1081 return;
1082
a67d7f6f
MM		 1083 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state) &&
1084 !control->poll)
1085 control->final = 1;
1086
1087 if (control->super == L2CAP_SUPER_RR)
1088 clear_bit(CONN_RNR_SENT, &chan->conn_state);
1089 else if (control->super == L2CAP_SUPER_RNR)
1090 set_bit(CONN_RNR_SENT, &chan->conn_state);
1091
1092 if (control->super != L2CAP_SUPER_SREJ) {
1093 chan->last_acked_seq = control->reqseq;
1094 __clear_ack_timer(chan);
1095 }
1096
1097 BT_DBG("reqseq %d, final %d, poll %d, super %d", control->reqseq,
1098 control->final, control->poll, control->super);
1099
1100 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
1101 control_field = __pack_extended_control(control);
1102 else
1103 control_field = __pack_enhanced_control(control);
1104
1105 skb = l2cap_create_sframe_pdu(chan, control_field);
1106 if (!IS_ERR(skb))
1107 l2cap_do_send(chan, skb);
b5c6aaed
MM		 1108}
1109
c9e3d5e0 1110static void l2cap_send_rr_or_rnr(struct l2cap_chan *chan, bool poll)
b5c6aaed 1111{
c9e3d5e0
MM		 1112 struct l2cap_ctrl control;
1113
1114 BT_DBG("chan %p, poll %d", chan, poll);
1115
1116 memset(&control, 0, sizeof(control));
1117 control.sframe = 1;
1118 control.poll = poll;
1119
1120 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state))
1121 control.super = L2CAP_SUPER_RNR;
1122 else
1123 control.super = L2CAP_SUPER_RR;
b5c6aaed 1124
c9e3d5e0
MM		 1125 control.reqseq = chan->buffer_seq;
1126 l2cap_send_sframe(chan, &control);
b5c6aaed
MM		 1127}
1128
b4450035 1129static inline int __l2cap_no_conn_pending(struct l2cap_chan *chan)
e501d055 1130{
5ff6f34d
JH		 1131 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED)
1132 return true;
1133
c1360a1c 1134 return !test_bit(CONF_CONNECT_PEND, &chan->conf_state);
e501d055
AE		 1135}
1136
1df7b17a 1137static bool __amp_capable(struct l2cap_chan *chan)
80d58d0b 1138{
1df7b17a 1139 struct l2cap_conn *conn = chan->conn;
80d58d0b 1140 struct hci_dev *hdev;
1df7b17a
MH		 1141 bool amp_available = false;
1142
0bd49fc7 1143 if (!(conn->local_fixed_chan & L2CAP_FC_A2MP))
1df7b17a
MH		 1144 return false;
1145
0bd49fc7 1146 if (!(conn->remote_fixed_chan & L2CAP_FC_A2MP))
1df7b17a 1147 return false;
80d58d0b
MH		 1148
1149 read_lock(&hci_dev_list_lock);
1df7b17a 1150 list_for_each_entry(hdev, &hci_dev_list, list) {
80d58d0b 1151 if (hdev->amp_type != AMP_TYPE_BREDR &&
1df7b17a
MH		 1152 test_bit(HCI_UP, &hdev->flags)) {
1153 amp_available = true;
1154 break;
1155 }
1156 }
80d58d0b
MH		 1157 read_unlock(&hci_dev_list_lock);
1158
1df7b17a
MH		 1159 if (chan->chan_policy == BT_CHANNEL_POLICY_AMP_PREFERRED)
1160 return amp_available;
848566b3
MH		 1161
1162 return false;
93c3e8f5
AE		 1163}
1164
5ce66b59
AE		 1165static bool l2cap_check_efs(struct l2cap_chan *chan)
1166{
1167 /* Check EFS parameters */
1168 return true;
1169}
1170
2766be48 1171void l2cap_send_conn_req(struct l2cap_chan *chan)
9b27f350
AE		 1172{
1173 struct l2cap_conn *conn = chan->conn;
1174 struct l2cap_conn_req req;
1175
1176 req.scid = cpu_to_le16(chan->scid);
1177 req.psm = chan->psm;
1178
1179 chan->ident = l2cap_get_ident(conn);
1180
1181 set_bit(CONF_CONNECT_PEND, &chan->conf_state);
1182
1183 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ, sizeof(req), &req);
1184}
1185
8eb200bd
MM		 1186static void l2cap_send_create_chan_req(struct l2cap_chan *chan, u8 amp_id)
1187{
1188 struct l2cap_create_chan_req req;
1189 req.scid = cpu_to_le16(chan->scid);
1190 req.psm = chan->psm;
1191 req.amp_id = amp_id;
1192
1193 chan->ident = l2cap_get_ident(chan->conn);
1194
1195 l2cap_send_cmd(chan->conn, chan->ident, L2CAP_CREATE_CHAN_REQ,
1196 sizeof(req), &req);
1197}
1198
02b0fbb9
MM		 1199static void l2cap_move_setup(struct l2cap_chan *chan)
1200{
1201 struct sk_buff *skb;
1202
1203 BT_DBG("chan %p", chan);
1204
1205 if (chan->mode != L2CAP_MODE_ERTM)
1206 return;
1207
1208 __clear_retrans_timer(chan);
1209 __clear_monitor_timer(chan);
1210 __clear_ack_timer(chan);
1211
1212 chan->retry_count = 0;
1213 skb_queue_walk(&chan->tx_q, skb) {
a4368ff3
JH		 1214 if (bt_cb(skb)->l2cap.retries)
1215 bt_cb(skb)->l2cap.retries = 1;
02b0fbb9
MM		 1216 else
1217 break;
1218 }
1219
1220 chan->expected_tx_seq = chan->buffer_seq;
1221
1222 clear_bit(CONN_REJ_ACT, &chan->conn_state);
1223 clear_bit(CONN_SREJ_ACT, &chan->conn_state);
1224 l2cap_seq_list_clear(&chan->retrans_list);
1225 l2cap_seq_list_clear(&chan->srej_list);
1226 skb_queue_purge(&chan->srej_q);
1227
1228 chan->tx_state = L2CAP_TX_STATE_XMIT;
1229 chan->rx_state = L2CAP_RX_STATE_MOVE;
1230
1231 set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
1232}
1233
5f3847a4
MM		 1234static void l2cap_move_done(struct l2cap_chan *chan)
1235{
1236 u8 move_role = chan->move_role;
1237 BT_DBG("chan %p", chan);
1238
1239 chan->move_state = L2CAP_MOVE_STABLE;
1240 chan->move_role = L2CAP_MOVE_ROLE_NONE;
1241
1242 if (chan->mode != L2CAP_MODE_ERTM)
1243 return;
1244
1245 switch (move_role) {
1246 case L2CAP_MOVE_ROLE_INITIATOR:
1247 l2cap_tx(chan, NULL, NULL, L2CAP_EV_EXPLICIT_POLL);
1248 chan->rx_state = L2CAP_RX_STATE_WAIT_F;
1249 break;
1250 case L2CAP_MOVE_ROLE_RESPONDER:
1251 chan->rx_state = L2CAP_RX_STATE_WAIT_P;
1252 break;
1253 }
1254}
1255
9f0caeb1
VCG		 1256static void l2cap_chan_ready(struct l2cap_chan *chan)
1257{
315917e0
JH		 1258 /* The channel may have already been flagged as connected in
1259 * case of receiving data before the L2CAP info req/rsp
1260 * procedure is complete.
1261 */
1262 if (chan->state == BT_CONNECTED)
1263 return;
1264
2827011f 1265 /* This clears all conf flags, including CONF_NOT_COMPLETE */
9f0caeb1
VCG		 1266 chan->conf_state = 0;
1267 __clear_chan_timer(chan);
1268
0ce43ce6
JH		 1269 if (chan->mode == L2CAP_MODE_LE_FLOWCTL && !chan->tx_credits)
1270 chan->ops->suspend(chan);
177f8f2b 1271
54a59aa2 1272 chan->state = BT_CONNECTED;
9f0caeb1 1273
fd83e2c2 1274 chan->ops->ready(chan);
9f0caeb1
VCG		 1275}
1276
f1496dee
JH		 1277static void l2cap_le_connect(struct l2cap_chan *chan)
1278{
1279 struct l2cap_conn *conn = chan->conn;
1280 struct l2cap_le_conn_req req;
1281
595177f3
JH		 1282 if (test_and_set_bit(FLAG_LE_CONN_REQ_SENT, &chan->flags))
1283 return;
1284
f1496dee
JH		 1285 req.psm = chan->psm;
1286 req.scid = cpu_to_le16(chan->scid);
1287 req.mtu = cpu_to_le16(chan->imtu);
3916aed8 1288 req.mps = cpu_to_le16(chan->mps);
0cd75f7e 1289 req.credits = cpu_to_le16(chan->rx_credits);
f1496dee
JH		 1290
1291 chan->ident = l2cap_get_ident(conn);
1292
1293 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_REQ,
1294 sizeof(req), &req);
1295}
1296
1297static void l2cap_le_start(struct l2cap_chan *chan)
1298{
1299 struct l2cap_conn *conn = chan->conn;
1300
1301 if (!smp_conn_security(conn->hcon, chan->sec_level))
1302 return;
1303
1304 if (!chan->psm) {
1305 l2cap_chan_ready(chan);
1306 return;
1307 }
1308
1309 if (chan->state == BT_CONNECT)
1310 l2cap_le_connect(chan);
1311}
1312
93c3e8f5
AE		 1313static void l2cap_start_connection(struct l2cap_chan *chan)
1314{
1315 if (__amp_capable(chan)) {
1316 BT_DBG("chan %p AMP capable: discover AMPs", chan);
1317 a2mp_discover_amp(chan);
f1496dee
JH		 1318 } else if (chan->conn->hcon->type == LE_LINK) {
1319 l2cap_le_start(chan);
93c3e8f5
AE		 1320 } else {
1321 l2cap_send_conn_req(chan);
1322 }
1323}
1324
aeaeb4bb
JH		 1325static void l2cap_request_info(struct l2cap_conn *conn)
1326{
1327 struct l2cap_info_req req;
1328
1329 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
1330 return;
1331
1332 req.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
1333
1334 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
1335 conn->info_ident = l2cap_get_ident(conn);
1336
1337 schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
1338
1339 l2cap_send_cmd(conn, conn->info_ident, L2CAP_INFO_REQ,
1340 sizeof(req), &req);
1341}
1342
fc7f8a7e 1343static void l2cap_do_start(struct l2cap_chan *chan)
79d554a6 1344{
8c1d787b 1345 struct l2cap_conn *conn = chan->conn;
79d554a6 1346
9f0caeb1 1347 if (conn->hcon->type == LE_LINK) {
96ac34fb 1348 l2cap_le_start(chan);
9f0caeb1
VCG		 1349 return;
1350 }
1351
aeaeb4bb
JH		 1352 if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)) {
1353 l2cap_request_info(conn);
1354 return;
1355 }
79d554a6 1356
aeaeb4bb
JH		 1357 if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE))
1358 return;
79d554a6 1359
aeaeb4bb
JH		 1360 if (l2cap_chan_check_security(chan, true) &&
1361 __l2cap_no_conn_pending(chan))
1362 l2cap_start_connection(chan);
79d554a6
MH		 1363}
1364
cf6c2c0b
GP		 1365static inline int l2cap_mode_supported(__u8 mode, __u32 feat_mask)
1366{
1367 u32 local_feat_mask = l2cap_feat_mask;
d1c4a17d 1368 if (!disable_ertm)
cf6c2c0b
GP		 1369 local_feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING;
1370
1371 switch (mode) {
1372 case L2CAP_MODE_ERTM:
1373 return L2CAP_FEAT_ERTM & feat_mask & local_feat_mask;
1374 case L2CAP_MODE_STREAMING:
1375 return L2CAP_FEAT_STREAMING & feat_mask & local_feat_mask;
1376 default:
1377 return 0x00;
1378 }
1379}
1380
5e4e3972 1381static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err)
22121fc9 1382{
5e4e3972 1383 struct l2cap_conn *conn = chan->conn;
22121fc9
GP		 1384 struct l2cap_disconn_req req;
1385
c13ffa62
GP		 1386 if (!conn)
1387 return;
1388
aad3d0e3 1389 if (chan->mode == L2CAP_MODE_ERTM && chan->state == BT_CONNECTED) {
1a09bcb9
GP		 1390 __clear_retrans_timer(chan);
1391 __clear_monitor_timer(chan);
1392 __clear_ack_timer(chan);
c13ffa62
GP		 1393 }
1394
2338a7e0 1395 if (chan->scid == L2CAP_CID_A2MP) {
d117773c 1396 l2cap_state_change(chan, BT_DISCONN);
416fa752
AE		 1397 return;
1398 }
1399
fe4128e0
GP		 1400 req.dcid = cpu_to_le16(chan->dcid);
1401 req.scid = cpu_to_le16(chan->scid);
2d792818
GP		 1402 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_DISCONN_REQ,
1403 sizeof(req), &req);
c13ffa62 1404
f8e73017 1405 l2cap_state_change_and_error(chan, BT_DISCONN, err);
22121fc9
GP		 1406}
1407
1da177e4 1408/* ---- L2CAP connections ---- */
4e8402a3
MH		 1409static void l2cap_conn_start(struct l2cap_conn *conn)
1410{
3df91ea2 1411 struct l2cap_chan *chan, *tmp;
4e8402a3
MH		 1412
1413 BT_DBG("conn %p", conn);
1414
3df91ea2 1415 mutex_lock(&conn->chan_lock);
4e8402a3 1416
3df91ea2 1417 list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
6be36555 1418 l2cap_chan_lock(chan);
4e8402a3 1419
715ec005 1420 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
aeaeb4bb 1421 l2cap_chan_ready(chan);
6be36555 1422 l2cap_chan_unlock(chan);
79d554a6
MH		 1423 continue;
1424 }
1425
89bc500e 1426 if (chan->state == BT_CONNECT) {
e7cafc45 1427 if (!l2cap_chan_check_security(chan, true) ||
2d792818 1428 !__l2cap_no_conn_pending(chan)) {
6be36555 1429 l2cap_chan_unlock(chan);
47731de7
GP		 1430 continue;
1431 }
79d554a6 1432
c1360a1c 1433 if (!l2cap_mode_supported(chan->mode, conn->feat_mask)
2d792818 1434 && test_bit(CONF_STATE2_DEVICE,
c1360a1c 1435 &chan->conf_state)) {
89bc500e 1436 l2cap_chan_close(chan, ECONNRESET);
6be36555 1437 l2cap_chan_unlock(chan);
47731de7 1438 continue;
b1235d79 1439 }
47731de7 1440
93c3e8f5 1441 l2cap_start_connection(chan);
47731de7 1442
89bc500e 1443 } else if (chan->state == BT_CONNECT2) {
79d554a6 1444 struct l2cap_conn_rsp rsp;
e9aeb2dd 1445 char buf[128];
fe4128e0
GP		 1446 rsp.scid = cpu_to_le16(chan->dcid);
1447 rsp.dcid = cpu_to_le16(chan->scid);
79d554a6 1448
e7cafc45 1449 if (l2cap_chan_check_security(chan, false)) {
bdc25783 1450 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
dcf4adbf
JP		 1451 rsp.result = cpu_to_le16(L2CAP_CR_PEND);
1452 rsp.status = cpu_to_le16(L2CAP_CS_AUTHOR_PEND);
2dc4e510 1453 chan->ops->defer(chan);
f66dc81f
MH		 1454
1455 } else {
acdcabf5 1456 l2cap_state_change(chan, BT_CONFIG);
dcf4adbf
JP		 1457 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
1458 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
f66dc81f 1459 }
79d554a6 1460 } else {
dcf4adbf
JP		 1461 rsp.result = cpu_to_le16(L2CAP_CR_PEND);
1462 rsp.status = cpu_to_le16(L2CAP_CS_AUTHEN_PEND);
79d554a6
MH		 1463 }
1464
fc7f8a7e 1465 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
2d792818 1466 sizeof(rsp), &rsp);
e9aeb2dd 1467
c1360a1c 1468 if (test_bit(CONF_REQ_SENT, &chan->conf_state) ||
2d792818 1469 rsp.result != L2CAP_CR_SUCCESS) {
6be36555 1470 l2cap_chan_unlock(chan);
e9aeb2dd
GP		 1471 continue;
1472 }
1473
c1360a1c 1474 set_bit(CONF_REQ_SENT, &chan->conf_state);
e9aeb2dd 1475 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
2d792818 1476 l2cap_build_conf_req(chan, buf), buf);
73ffa904 1477 chan->num_conf_req++;
4e8402a3
MH		 1478 }
1479
6be36555 1480 l2cap_chan_unlock(chan);
4e8402a3
MH		 1481 }
1482
3df91ea2 1483 mutex_unlock(&conn->chan_lock);
4e8402a3
MH		 1484}
1485
b62f328b
VT		 1486static void l2cap_le_conn_ready(struct l2cap_conn *conn)
1487{
cc8dba2b 1488 struct hci_conn *hcon = conn->hcon;
dcc36c16 1489 struct hci_dev *hdev = hcon->hdev;
b62f328b 1490
e760ec12 1491 BT_DBG("%s conn %p", hdev->name, conn);
b62f328b 1492
e760ec12
JH		 1493 /* For outgoing pairing which doesn't necessarily have an
1494 * associated socket (e.g. mgmt_pair_device).
1495 */
1496 if (hcon->out)
1497 smp_conn_security(hcon, hcon->pending_sec_level);
cc8dba2b 1498
80afeb6c
MH		 1499 /* For LE slave connections, make sure the connection interval
1500 * is in the range of the minium and maximum interval that has
1501 * been configured for this connection. If not, then trigger
1502 * the connection update procedure.
1503 */
40bef302 1504 if (hcon->role == HCI_ROLE_SLAVE &&
80afeb6c
MH		 1505 (hcon->le_conn_interval < hcon->le_conn_min_interval ||
1506 hcon->le_conn_interval > hcon->le_conn_max_interval)) {
1507 struct l2cap_conn_param_update_req req;
1508
1509 req.min = cpu_to_le16(hcon->le_conn_min_interval);
1510 req.max = cpu_to_le16(hcon->le_conn_max_interval);
1511 req.latency = cpu_to_le16(hcon->le_conn_latency);
1512 req.to_multiplier = cpu_to_le16(hcon->le_supv_timeout);
1513
1514 l2cap_send_cmd(conn, l2cap_get_ident(conn),
1515 L2CAP_CONN_PARAM_UPDATE_REQ, sizeof(req), &req);
1516 }
b62f328b
VT		 1517}
1518
4e8402a3
MH		 1519static void l2cap_conn_ready(struct l2cap_conn *conn)
1520{
48454079 1521 struct l2cap_chan *chan;
cc110922 1522 struct hci_conn *hcon = conn->hcon;
4e8402a3 1523
79d554a6 1524 BT_DBG("conn %p", conn);
4e8402a3 1525
aeaeb4bb
JH		 1526 if (hcon->type == ACL_LINK)
1527 l2cap_request_info(conn);
1528
e760ec12
JH		 1529 mutex_lock(&conn->chan_lock);
1530
3df91ea2 1531 list_for_each_entry(chan, &conn->chan_l, list) {
baa7e1fa 1532
6be36555 1533 l2cap_chan_lock(chan);
4e8402a3 1534
2338a7e0 1535 if (chan->scid == L2CAP_CID_A2MP) {
416fa752
AE		 1536 l2cap_chan_unlock(chan);
1537 continue;
1538 }
1539
cc110922 1540 if (hcon->type == LE_LINK) {
f1496dee 1541 l2cap_le_start(chan);
63128451 1542 } else if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
aeaeb4bb
JH		 1543 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)
1544 l2cap_chan_ready(chan);
1c244f79 1545 } else if (chan->state == BT_CONNECT) {
fc7f8a7e 1546 l2cap_do_start(chan);
1c244f79 1547 }
4e8402a3 1548
6be36555 1549 l2cap_chan_unlock(chan);
4e8402a3 1550 }
79d554a6 1551
3df91ea2 1552 mutex_unlock(&conn->chan_lock);
61a939c6 1553
79a05727
JH		 1554 if (hcon->type == LE_LINK)
1555 l2cap_le_conn_ready(conn);
1556
61a939c6 1557 queue_work(hcon->hdev->workqueue, &conn->pending_rx_work);
4e8402a3
MH		 1558}
1559
1560/* Notify sockets that we cannot guaranty reliability anymore */
1561static void l2cap_conn_unreliable(struct l2cap_conn *conn, int err)
1562{
48454079 1563 struct l2cap_chan *chan;
4e8402a3
MH		 1564
1565 BT_DBG("conn %p", conn);
1566
3df91ea2 1567 mutex_lock(&conn->chan_lock);
4e8402a3 1568
3df91ea2 1569 list_for_each_entry(chan, &conn->chan_l, list) {
ecf61bdb 1570 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
1d8b1fd5 1571 l2cap_chan_set_err(chan, err);
4e8402a3
MH		 1572 }
1573
3df91ea2 1574 mutex_unlock(&conn->chan_lock);
4e8402a3
MH		 1575}
1576
f878fcad 1577static void l2cap_info_timeout(struct work_struct *work)
4e8402a3 1578{
f878fcad 1579 struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
2d792818 1580 info_timer.work);
4e8402a3 1581
984947dc 1582 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
e1027a7c 1583 conn->info_ident = 0;
984947dc 1584
4e8402a3
MH		 1585 l2cap_conn_start(conn);
1586}
1587
2c8e1411
DH		 1588/*
1589 * l2cap_user
1590 * External modules can register l2cap_user objects on l2cap_conn. The ->probe
1591 * callback is called during registration. The ->remove callback is called
1592 * during unregistration.
1593 * An l2cap_user object can either be explicitly unregistered or when the
1594 * underlying l2cap_conn object is deleted. This guarantees that l2cap->hcon,
1595 * l2cap->hchan, .. are valid as long as the remove callback hasn't been called.
1596 * External modules must own a reference to the l2cap_conn object if they intend
1597 * to call l2cap_unregister_user(). The l2cap_conn object might get destroyed at
1598 * any time if they don't.
1599 */
1600
1601int l2cap_register_user(struct l2cap_conn *conn, struct l2cap_user *user)
1602{
1603 struct hci_dev *hdev = conn->hcon->hdev;
1604 int ret;
1605
1606 /* We need to check whether l2cap_conn is registered. If it is not, we
1607 * must not register the l2cap_user. l2cap_conn_del() is unregisters
1608 * l2cap_conn objects, but doesn't provide its own locking. Instead, it
1609 * relies on the parent hci_conn object to be locked. This itself relies
1610 * on the hci_dev object to be locked. So we must lock the hci device
1611 * here, too. */
1612
1613 hci_dev_lock(hdev);
1614
835a6a2f 1615 if (!list_empty(&user->list)) {
2c8e1411
DH		 1616 ret = -EINVAL;
1617 goto out_unlock;
1618 }
1619
1620 /* conn->hchan is NULL after l2cap_conn_del() was called */
1621 if (!conn->hchan) {
1622 ret = -ENODEV;
1623 goto out_unlock;
1624 }
1625
1626 ret = user->probe(conn, user);
1627 if (ret)
1628 goto out_unlock;
1629
1630 list_add(&user->list, &conn->users);
1631 ret = 0;
1632
1633out_unlock:
1634 hci_dev_unlock(hdev);
1635 return ret;
1636}
1637EXPORT_SYMBOL(l2cap_register_user);
1638
1639void l2cap_unregister_user(struct l2cap_conn *conn, struct l2cap_user *user)
1640{
1641 struct hci_dev *hdev = conn->hcon->hdev;
1642
1643 hci_dev_lock(hdev);
1644
835a6a2f 1645 if (list_empty(&user->list))
2c8e1411
DH		 1646 goto out_unlock;
1647
ab944c83 1648 list_del_init(&user->list);
2c8e1411
DH		 1649 user->remove(conn, user);
1650
1651out_unlock:
1652 hci_dev_unlock(hdev);
1653}
1654EXPORT_SYMBOL(l2cap_unregister_user);
1655
1656static void l2cap_unregister_all_users(struct l2cap_conn *conn)
1657{
1658 struct l2cap_user *user;
1659
1660 while (!list_empty(&conn->users)) {
1661 user = list_first_entry(&conn->users, struct l2cap_user, list);
ab944c83 1662 list_del_init(&user->list);
2c8e1411
DH		 1663 user->remove(conn, user);
1664 }
1665}
1666
5d3de7df
VCG		 1667static void l2cap_conn_del(struct hci_conn *hcon, int err)
1668{
1669 struct l2cap_conn *conn = hcon->l2cap_data;
1670 struct l2cap_chan *chan, *l;
5d3de7df
VCG		 1671
1672 if (!conn)
1673 return;
1674
1675 BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
1676
1677 kfree_skb(conn->rx_skb);
1678
61a939c6 1679 skb_queue_purge(&conn->pending_rx);
7ab56c3a
JT		 1680
1681 /* We can not call flush_work(&conn->pending_rx_work) here since we
1682 * might block if we are running on a worker from the same workqueue
1683 * pending_rx_work is waiting on.
1684 */
1685 if (work_pending(&conn->pending_rx_work))
1686 cancel_work_sync(&conn->pending_rx_work);
61a939c6 1687
f3d82d0c
JH		 1688 if (work_pending(&conn->id_addr_update_work))
1689 cancel_work_sync(&conn->id_addr_update_work);
1690
2c8e1411
DH		 1691 l2cap_unregister_all_users(conn);
1692
e31fb860
JH		 1693 /* Force the connection to be immediately dropped */
1694 hcon->disc_timeout = 0;
1695
3df91ea2
AE		 1696 mutex_lock(&conn->chan_lock);
1697
5d3de7df
VCG		 1698 /* Kill channels */
1699 list_for_each_entry_safe(chan, l, &conn->chan_l, list) {
61d6ef3e 1700 l2cap_chan_hold(chan);
6be36555
AE		 1701 l2cap_chan_lock(chan);
1702
5d3de7df 1703 l2cap_chan_del(chan, err);
6be36555
AE		 1704
1705 l2cap_chan_unlock(chan);
1706
80b98027 1707 chan->ops->close(chan);
61d6ef3e 1708 l2cap_chan_put(chan);
5d3de7df
VCG		 1709 }
1710
3df91ea2
AE		 1711 mutex_unlock(&conn->chan_lock);
1712
73d80deb
LAD		 1713 hci_chan_del(conn->hchan);
1714
5d3de7df 1715 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
127074bf 1716 cancel_delayed_work_sync(&conn->info_timer);
5d3de7df 1717
5d3de7df 1718 hcon->l2cap_data = NULL;
9c903e37
DH		 1719 conn->hchan = NULL;
1720 l2cap_conn_put(conn);
5d3de7df
VCG		 1721}
1722
9c903e37
DH		 1723static void l2cap_conn_free(struct kref *ref)
1724{
1725 struct l2cap_conn *conn = container_of(ref, struct l2cap_conn, ref);
1726
1727 hci_conn_put(conn->hcon);
1728 kfree(conn);
1729}
1730
51bb8457 1731struct l2cap_conn *l2cap_conn_get(struct l2cap_conn *conn)
9c903e37
DH		 1732{
1733 kref_get(&conn->ref);
51bb8457 1734 return conn;
9c903e37
DH		 1735}
1736EXPORT_SYMBOL(l2cap_conn_get);
1737
1738void l2cap_conn_put(struct l2cap_conn *conn)
1739{
1740 kref_put(&conn->ref, l2cap_conn_free);
1741}
1742EXPORT_SYMBOL(l2cap_conn_put);
1743
1da177e4 1744/* ---- Socket interface ---- */
1da177e4 1745
c2287681 1746/* Find socket with psm and source / destination bdaddr.
1da177e4
LT		 1747 * Returns closest match.
1748 */
c2287681
IY		 1749static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm,
1750 bdaddr_t *src,
bf20fd4e
JH		 1751 bdaddr_t *dst,
1752 u8 link_type)
1da177e4 1753{
23691d75 1754 struct l2cap_chan *c, *c1 = NULL;
1da177e4 1755
23691d75 1756 read_lock(&chan_list_lock);
e0f0cb56 1757
23691d75 1758 list_for_each_entry(c, &chan_list, global_l) {
89bc500e 1759 if (state && c->state != state)
1da177e4
LT		 1760 continue;
1761
bf20fd4e
JH		 1762 if (link_type == ACL_LINK && c->src_type != BDADDR_BREDR)
1763 continue;
1764
1765 if (link_type == LE_LINK && c->src_type == BDADDR_BREDR)
1766 continue;
1767
23691d75 1768 if (c->psm == psm) {
c2287681
IY		 1769 int src_match, dst_match;
1770 int src_any, dst_any;
1771
1da177e4 1772 /* Exact match. */
7eafc59e
MH		 1773 src_match = !bacmp(&c->src, src);
1774 dst_match = !bacmp(&c->dst, dst);
c2287681 1775 if (src_match && dst_match) {
a24cce14 1776 l2cap_chan_hold(c);
a7567b20 1777 read_unlock(&chan_list_lock);
23691d75
GP		 1778 return c;
1779 }
1da177e4
LT		 1780
1781 /* Closest match */
7eafc59e
MH		 1782 src_any = !bacmp(&c->src, BDADDR_ANY);
1783 dst_any = !bacmp(&c->dst, BDADDR_ANY);
c2287681
IY		 1784 if ((src_match && dst_any) || (src_any && dst_match) ||
1785 (src_any && dst_any))
23691d75 1786 c1 = c;
1da177e4
LT		 1787 }
1788 }
1da177e4 1789
a24cce14
JH		 1790 if (c1)
1791 l2cap_chan_hold(c1);
1792
23691d75 1793 read_unlock(&chan_list_lock);
e0f0cb56 1794
23691d75 1795 return c1;
1da177e4
LT		 1796}
1797
721c4181 1798static void l2cap_monitor_timeout(struct work_struct *work)
e90bac06 1799{
721c4181 1800 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
4239d16f 1801 monitor_timer.work);
e90bac06 1802
525cd185 1803 BT_DBG("chan %p", chan);
0e98958d 1804
6be36555
AE		 1805 l2cap_chan_lock(chan);
1806
80909e04 1807 if (!chan->conn) {
6be36555 1808 l2cap_chan_unlock(chan);
8d7e1c7f 1809 l2cap_chan_put(chan);
e90bac06
GP		 1810 return;
1811 }
1812
401bb1f7 1813 l2cap_tx(chan, NULL, NULL, L2CAP_EV_MONITOR_TO);
e90bac06 1814
6be36555 1815 l2cap_chan_unlock(chan);
8d7e1c7f 1816 l2cap_chan_put(chan);
e90bac06
GP		 1817}
1818
721c4181 1819static void l2cap_retrans_timeout(struct work_struct *work)
e90bac06 1820{
721c4181 1821 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
4239d16f 1822 retrans_timer.work);
e90bac06 1823
49208c9c 1824 BT_DBG("chan %p", chan);
0e98958d 1825
6be36555
AE		 1826 l2cap_chan_lock(chan);
1827
80909e04
MM		 1828 if (!chan->conn) {
1829 l2cap_chan_unlock(chan);
1830 l2cap_chan_put(chan);
1831 return;
1832 }
6be36555 1833
401bb1f7 1834 l2cap_tx(chan, NULL, NULL, L2CAP_EV_RETRANS_TO);
6be36555 1835 l2cap_chan_unlock(chan);
8d7e1c7f 1836 l2cap_chan_put(chan);
e90bac06
GP		 1837}
1838
d660366d
GP		 1839static void l2cap_streaming_send(struct l2cap_chan *chan,
1840 struct sk_buff_head *skbs)
6840ed07 1841{
ccbb84af 1842 struct sk_buff *skb;
3733937d 1843 struct l2cap_ctrl *control;
6840ed07 1844
3733937d
MM		 1845 BT_DBG("chan %p, skbs %p", chan, skbs);
1846
b99e13ad
MM		 1847 if (__chan_is_moving(chan))
1848 return;
1849
3733937d
MM		 1850 skb_queue_splice_tail_init(skbs, &chan->tx_q);
1851
1852 while (!skb_queue_empty(&chan->tx_q)) {
1853
1854 skb = skb_dequeue(&chan->tx_q);
1855
a4368ff3
JH		 1856 bt_cb(skb)->l2cap.retries = 1;
1857 control = &bt_cb(skb)->l2cap;
3733937d
MM		 1858
1859 control->reqseq = 0;
1860 control->txseq = chan->next_tx_seq;
1861
1862 __pack_control(chan, control, skb);
6840ed07 1863
47d1ec61 1864 if (chan->fcs == L2CAP_FCS_CRC16) {
3733937d
MM		 1865 u16 fcs = crc16(0, (u8 *) skb->data, skb->len);
1866 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
fcc203c3
GP		 1867 }
1868
4343478f 1869 l2cap_do_send(chan, skb);
6840ed07 1870
b4400672 1871 BT_DBG("Sent txseq %u", control->txseq);
3733937d 1872
836be934 1873 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
3733937d 1874 chan->frames_sent++;
6840ed07 1875 }
6840ed07
GP		 1876}
1877
67c9e840 1878static int l2cap_ertm_send(struct l2cap_chan *chan)
1c2acffb
GP		 1879{
1880 struct sk_buff *skb, *tx_skb;
18a48e76
MM		 1881 struct l2cap_ctrl *control;
1882 int sent = 0;
1883
1884 BT_DBG("chan %p", chan);
1c2acffb 1885
89bc500e 1886 if (chan->state != BT_CONNECTED)
c13ffa62 1887 return -ENOTCONN;
e90bac06 1888
94122bbe
MM		 1889 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
1890 return 0;
1891
b99e13ad
MM		 1892 if (__chan_is_moving(chan))
1893 return 0;
1894
18a48e76
MM		 1895 while (chan->tx_send_head &&
1896 chan->unacked_frames < chan->remote_tx_win &&
1897 chan->tx_state == L2CAP_TX_STATE_XMIT) {
e420aba3 1898
18a48e76 1899 skb = chan->tx_send_head;
e90bac06 1900
a4368ff3
JH		 1901 bt_cb(skb)->l2cap.retries = 1;
1902 control = &bt_cb(skb)->l2cap;
95ffa978 1903
e2ab4353 1904 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
18a48e76 1905 control->final = 1;
e2ab4353 1906
18a48e76
MM		 1907 control->reqseq = chan->buffer_seq;
1908 chan->last_acked_seq = chan->buffer_seq;
1909 control->txseq = chan->next_tx_seq;
1c2acffb 1910
18a48e76 1911 __pack_control(chan, control, skb);
e90bac06 1912
47d1ec61 1913 if (chan->fcs == L2CAP_FCS_CRC16) {
18a48e76
MM		 1914 u16 fcs = crc16(0, (u8 *) skb->data, skb->len);
1915 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
fcc203c3
GP		 1916 }
1917
18a48e76
MM		 1918 /* Clone after data has been modified. Data is assumed to be
1919 read-only (for locking purposes) on cloned sk_buffs.
1920 */
1921 tx_skb = skb_clone(skb, GFP_KERNEL);
9a9c6a34 1922
18a48e76
MM		 1923 if (!tx_skb)
1924 break;
1c2acffb 1925
18a48e76 1926 __set_retrans_timer(chan);
836be934
AE		 1927
1928 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
18a48e76 1929 chan->unacked_frames++;
6a026610 1930 chan->frames_sent++;
18a48e76 1931 sent++;
1c2acffb 1932
58d35f87
GP		 1933 if (skb_queue_is_last(&chan->tx_q, skb))
1934 chan->tx_send_head = NULL;
1c2acffb 1935 else
58d35f87 1936 chan->tx_send_head = skb_queue_next(&chan->tx_q, skb);
18a48e76
MM		 1937
1938 l2cap_do_send(chan, tx_skb);
b4400672 1939 BT_DBG("Sent txseq %u", control->txseq);
1c2acffb
GP		 1940 }
1941
b4400672
AE		 1942 BT_DBG("Sent %d, %u unacked, %u in ERTM queue", sent,
1943 chan->unacked_frames, skb_queue_len(&chan->tx_q));
18a48e76
MM		 1944
1945 return sent;
9e917af1
GP		 1946}
1947
e1fbd4c1
MM		 1948static void l2cap_ertm_resend(struct l2cap_chan *chan)
1949{
1950 struct l2cap_ctrl control;
1951 struct sk_buff *skb;
1952 struct sk_buff *tx_skb;
1953 u16 seq;
1954
1955 BT_DBG("chan %p", chan);
1956
1957 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
1958 return;
1959
b99e13ad
MM		 1960 if (__chan_is_moving(chan))
1961 return;
1962
e1fbd4c1
MM		 1963 while (chan->retrans_list.head != L2CAP_SEQ_LIST_CLEAR) {
1964 seq = l2cap_seq_list_pop(&chan->retrans_list);
1965
1966 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, seq);
1967 if (!skb) {
1968 BT_DBG("Error: Can't retransmit seq %d, frame missing",
2d792818 1969 seq);
e1fbd4c1
MM		 1970 continue;
1971 }
1972
a4368ff3
JH		 1973 bt_cb(skb)->l2cap.retries++;
1974 control = bt_cb(skb)->l2cap;
e1fbd4c1
MM		 1975
1976 if (chan->max_tx != 0 &&
a4368ff3 1977 bt_cb(skb)->l2cap.retries > chan->max_tx) {
e1fbd4c1 1978 BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
5e4e3972 1979 l2cap_send_disconn_req(chan, ECONNRESET);
e1fbd4c1
MM		 1980 l2cap_seq_list_clear(&chan->retrans_list);
1981 break;
1982 }
1983
1984 control.reqseq = chan->buffer_seq;
1985 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
1986 control.final = 1;
1987 else
1988 control.final = 0;
1989
1990 if (skb_cloned(skb)) {
1991 /* Cloned sk_buffs are read-only, so we need a
1992 * writeable copy
1993 */
8bcde1f2 1994 tx_skb = skb_copy(skb, GFP_KERNEL);
e1fbd4c1 1995 } else {
8bcde1f2 1996 tx_skb = skb_clone(skb, GFP_KERNEL);
e1fbd4c1
MM		 1997 }
1998
1999 if (!tx_skb) {
2000 l2cap_seq_list_clear(&chan->retrans_list);
2001 break;
2002 }
2003
2004 /* Update skb contents */
2005 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
2006 put_unaligned_le32(__pack_extended_control(&control),
2007 tx_skb->data + L2CAP_HDR_SIZE);
2008 } else {
2009 put_unaligned_le16(__pack_enhanced_control(&control),
2010 tx_skb->data + L2CAP_HDR_SIZE);
2011 }
2012
13cac152 2013 /* Update FCS */
e1fbd4c1 2014 if (chan->fcs == L2CAP_FCS_CRC16) {
13cac152
LR		 2015 u16 fcs = crc16(0, (u8 *) tx_skb->data,
2016 tx_skb->len - L2CAP_FCS_SIZE);
2017 put_unaligned_le16(fcs, skb_tail_pointer(tx_skb) -
2018 L2CAP_FCS_SIZE);
e1fbd4c1
MM		 2019 }
2020
2021 l2cap_do_send(chan, tx_skb);
2022
2023 BT_DBG("Resent txseq %d", control.txseq);
2024
2025 chan->last_acked_seq = chan->buffer_seq;
2026 }
2027}
2028
f80842a8
MM		 2029static void l2cap_retransmit(struct l2cap_chan *chan,
2030 struct l2cap_ctrl *control)
2031{
2032 BT_DBG("chan %p, control %p", chan, control);
2033
2034 l2cap_seq_list_append(&chan->retrans_list, control->reqseq);
2035 l2cap_ertm_resend(chan);
2036}
2037
d2a7ac5d
MM		 2038static void l2cap_retransmit_all(struct l2cap_chan *chan,
2039 struct l2cap_ctrl *control)
2040{
e1fbd4c1
MM		 2041 struct sk_buff *skb;
2042
2043 BT_DBG("chan %p, control %p", chan, control);
2044
2045 if (control->poll)
2046 set_bit(CONN_SEND_FBIT, &chan->conn_state);
2047
2048 l2cap_seq_list_clear(&chan->retrans_list);
2049
2050 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
2051 return;
2052
2053 if (chan->unacked_frames) {
2054 skb_queue_walk(&chan->tx_q, skb) {
a4368ff3 2055 if (bt_cb(skb)->l2cap.txseq == control->reqseq ||
2d792818 2056 skb == chan->tx_send_head)
e1fbd4c1
MM		 2057 break;
2058 }
2059
2060 skb_queue_walk_from(&chan->tx_q, skb) {
2061 if (skb == chan->tx_send_head)
2062 break;
2063
2064 l2cap_seq_list_append(&chan->retrans_list,
a4368ff3 2065 bt_cb(skb)->l2cap.txseq);
e1fbd4c1
MM		 2066 }
2067
2068 l2cap_ertm_resend(chan);
2069 }
d2a7ac5d
MM		 2070}
2071
0a0aba42 2072static void l2cap_send_ack(struct l2cap_chan *chan)
9e917af1 2073{
0a0aba42
MM		 2074 struct l2cap_ctrl control;
2075 u16 frames_to_ack = __seq_offset(chan, chan->buffer_seq,
2076 chan->last_acked_seq);
2077 int threshold;
9e917af1 2078
0a0aba42
MM		 2079 BT_DBG("chan %p last_acked_seq %d buffer_seq %d",
2080 chan, chan->last_acked_seq, chan->buffer_seq);
9e917af1 2081
0a0aba42
MM		 2082 memset(&control, 0, sizeof(control));
2083 control.sframe = 1;
dfc909be 2084
0a0aba42
MM		 2085 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&
2086 chan->rx_state == L2CAP_RX_STATE_RECV) {
2087 __clear_ack_timer(chan);
2088 control.super = L2CAP_SUPER_RNR;
2089 control.reqseq = chan->buffer_seq;
2090 l2cap_send_sframe(chan, &control);
2091 } else {
2092 if (!test_bit(CONN_REMOTE_BUSY, &chan->conn_state)) {
2093 l2cap_ertm_send(chan);
2094 /* If any i-frames were sent, they included an ack */
2095 if (chan->buffer_seq == chan->last_acked_seq)
2096 frames_to_ack = 0;
2097 }
dfc909be 2098
c20f8e35 2099 /* Ack now if the window is 3/4ths full.
0a0aba42
MM		 2100 * Calculate without mul or div
2101 */
c20f8e35 2102 threshold = chan->ack_win;
0a0aba42
MM		 2103 threshold += threshold << 1;
2104 threshold >>= 2;
2105
b4400672 2106 BT_DBG("frames_to_ack %u, threshold %d", frames_to_ack,
0a0aba42
MM		 2107 threshold);
2108
2109 if (frames_to_ack >= threshold) {
2110 __clear_ack_timer(chan);
2111 control.super = L2CAP_SUPER_RR;
2112 control.reqseq = chan->buffer_seq;
2113 l2cap_send_sframe(chan, &control);
2114 frames_to_ack = 0;
2115 }
1c2acffb 2116
0a0aba42
MM		 2117 if (frames_to_ack)
2118 __set_ack_timer(chan);
2119 }
b17e73bb
SJ		 2120}
2121
04124681
GP		 2122static inline int l2cap_skbuff_fromiovec(struct l2cap_chan *chan,
2123 struct msghdr *msg, int len,
2124 int count, struct sk_buff *skb)
1c2acffb 2125{
0952a57a 2126 struct l2cap_conn *conn = chan->conn;
1c2acffb 2127 struct sk_buff **frag;
90338947 2128 int sent = 0;
1da177e4 2129
17836394 2130 if (copy_from_iter(skb_put(skb, count), count, &msg->msg_iter) != count)
1c2acffb 2131 return -EFAULT;
1da177e4
LT		 2132
2133 sent += count;
2134 len -= count;
2135
2136 /* Continuation fragments (no L2CAP header) */
2137 frag = &skb_shinfo(skb)->frag_list;
2138 while (len) {
fbe00700
GP		 2139 struct sk_buff *tmp;
2140
1da177e4
LT		 2141 count = min_t(unsigned int, conn->mtu, len);
2142
d9fbd02b 2143 tmp = chan->ops->alloc_skb(chan, 0, count,
fbe00700
GP		 2144 msg->msg_flags & MSG_DONTWAIT);
2145 if (IS_ERR(tmp))
2146 return PTR_ERR(tmp);
2147
2148 *frag = tmp;
2f7719ce 2149
17836394
AV		 2150 if (copy_from_iter(skb_put(*frag, count), count,
2151 &msg->msg_iter) != count)
1c2acffb 2152 return -EFAULT;
1da177e4
LT		 2153
2154 sent += count;
2155 len -= count;
2156
2d0ed3d5
GP		 2157 skb->len += (*frag)->len;
2158 skb->data_len += (*frag)->len;
2159
1da177e4
LT		 2160 frag = &(*frag)->next;
2161 }
1da177e4
LT		 2162
2163 return sent;
1c2acffb 2164}
1da177e4 2165
5e59b791 2166static struct sk_buff *l2cap_create_connless_pdu(struct l2cap_chan *chan,
8d46321c 2167 struct msghdr *msg, size_t len)
1c2acffb 2168{
8c1d787b 2169 struct l2cap_conn *conn = chan->conn;
1c2acffb 2170 struct sk_buff *skb;
03a51213 2171 int err, count, hlen = L2CAP_HDR_SIZE + L2CAP_PSMLEN_SIZE;
1c2acffb
GP		 2172 struct l2cap_hdr *lh;
2173
8d46321c
MH		 2174 BT_DBG("chan %p psm 0x%2.2x len %zu", chan,
2175 __le16_to_cpu(chan->psm), len);
1c2acffb
GP		 2176
2177 count = min_t(unsigned int, (conn->mtu - hlen), len);
2f7719ce 2178
d9fbd02b 2179 skb = chan->ops->alloc_skb(chan, hlen, count,
90338947
GP		 2180 msg->msg_flags & MSG_DONTWAIT);
2181 if (IS_ERR(skb))
2182 return skb;
1c2acffb
GP		 2183
2184 /* Create L2CAP header */
2185 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
fe4128e0 2186 lh->cid = cpu_to_le16(chan->dcid);
daf6a78c 2187 lh->len = cpu_to_le16(len + L2CAP_PSMLEN_SIZE);
43b1b8df 2188 put_unaligned(chan->psm, (__le16 *) skb_put(skb, L2CAP_PSMLEN_SIZE));
1c2acffb 2189
0952a57a 2190 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
1c2acffb
GP		 2191 if (unlikely(err < 0)) {
2192 kfree_skb(skb);
2193 return ERR_PTR(err);
2194 }
2195 return skb;
2196}
2197
5e59b791 2198static struct sk_buff *l2cap_create_basic_pdu(struct l2cap_chan *chan,
8d46321c 2199 struct msghdr *msg, size_t len)
1c2acffb 2200{
8c1d787b 2201 struct l2cap_conn *conn = chan->conn;
1c2acffb 2202 struct sk_buff *skb;
f2ba7fae 2203 int err, count;
1c2acffb
GP		 2204 struct l2cap_hdr *lh;
2205
b4400672 2206 BT_DBG("chan %p len %zu", chan, len);
1c2acffb 2207
f2ba7fae 2208 count = min_t(unsigned int, (conn->mtu - L2CAP_HDR_SIZE), len);
2f7719ce 2209
d9fbd02b 2210 skb = chan->ops->alloc_skb(chan, L2CAP_HDR_SIZE, count,
90338947
GP		 2211 msg->msg_flags & MSG_DONTWAIT);
2212 if (IS_ERR(skb))
2213 return skb;
1c2acffb
GP		 2214
2215 /* Create L2CAP header */
2216 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
fe4128e0 2217 lh->cid = cpu_to_le16(chan->dcid);
6ff9b5ef 2218 lh->len = cpu_to_le16(len);
1c2acffb 2219
0952a57a 2220 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
1c2acffb
GP		 2221 if (unlikely(err < 0)) {
2222 kfree_skb(skb);
2223 return ERR_PTR(err);
2224 }
2225 return skb;
2226}
2227
ab0ff76d 2228static struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan,
b4400672
AE		 2229 struct msghdr *msg, size_t len,
2230 u16 sdulen)
1c2acffb 2231{
8c1d787b 2232 struct l2cap_conn *conn = chan->conn;
1c2acffb 2233 struct sk_buff *skb;
e4ca6d98 2234 int err, count, hlen;
1c2acffb
GP		 2235 struct l2cap_hdr *lh;
2236
b4400672 2237 BT_DBG("chan %p len %zu", chan, len);
1c2acffb 2238
0ee0d208
GP		 2239 if (!conn)
2240 return ERR_PTR(-ENOTCONN);
2241
ba7aa64f 2242 hlen = __ertm_hdr_size(chan);
e4ca6d98 2243
c74e560c 2244 if (sdulen)
03a51213 2245 hlen += L2CAP_SDULEN_SIZE;
c74e560c 2246
47d1ec61 2247 if (chan->fcs == L2CAP_FCS_CRC16)
03a51213 2248 hlen += L2CAP_FCS_SIZE;
fcc203c3 2249
1c2acffb 2250 count = min_t(unsigned int, (conn->mtu - hlen), len);
2f7719ce 2251
d9fbd02b 2252 skb = chan->ops->alloc_skb(chan, hlen, count,
90338947
GP		 2253 msg->msg_flags & MSG_DONTWAIT);
2254 if (IS_ERR(skb))
2255 return skb;
1c2acffb
GP		 2256
2257 /* Create L2CAP header */
2258 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
fe4128e0 2259 lh->cid = cpu_to_le16(chan->dcid);
1c2acffb 2260 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
88843ab0 2261
18a48e76
MM		 2262 /* Control header is populated later */
2263 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
2264 put_unaligned_le32(0, skb_put(skb, L2CAP_EXT_CTRL_SIZE));
2265 else
2266 put_unaligned_le16(0, skb_put(skb, L2CAP_ENH_CTRL_SIZE));
88843ab0 2267
c74e560c 2268 if (sdulen)
03a51213 2269 put_unaligned_le16(sdulen, skb_put(skb, L2CAP_SDULEN_SIZE));
1c2acffb 2270
0952a57a 2271 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
1c2acffb
GP		 2272 if (unlikely(err < 0)) {
2273 kfree_skb(skb);
2274 return ERR_PTR(err);
2275 }
e90bac06 2276
a4368ff3
JH		 2277 bt_cb(skb)->l2cap.fcs = chan->fcs;
2278 bt_cb(skb)->l2cap.retries = 0;
1c2acffb 2279 return skb;
1da177e4
LT		 2280}
2281
94122bbe
MM		 2282static int l2cap_segment_sdu(struct l2cap_chan *chan,
2283 struct sk_buff_head *seg_queue,
2284 struct msghdr *msg, size_t len)
c74e560c 2285{
c74e560c 2286 struct sk_buff *skb;
94122bbe
MM		 2287 u16 sdu_len;
2288 size_t pdu_len;
94122bbe 2289 u8 sar;
c74e560c 2290
b4400672 2291 BT_DBG("chan %p, msg %p, len %zu", chan, msg, len);
c74e560c 2292
94122bbe
MM		 2293 /* It is critical that ERTM PDUs fit in a single HCI fragment,
2294 * so fragmented skbs are not used. The HCI layer's handling
2295 * of fragmented skbs is not compatible with ERTM's queueing.
2296 */
c74e560c 2297
94122bbe
MM		 2298 /* PDU size is derived from the HCI MTU */
2299 pdu_len = chan->conn->mtu;
c74e560c 2300
a549574d
MM		 2301 /* Constrain PDU size for BR/EDR connections */
2302 if (!chan->hs_hcon)
2303 pdu_len = min_t(size_t, pdu_len, L2CAP_BREDR_MAX_PAYLOAD);
94122bbe
MM		 2304
2305 /* Adjust for largest possible L2CAP overhead. */
35d401df
GP		 2306 if (chan->fcs)
2307 pdu_len -= L2CAP_FCS_SIZE;
2308
ba7aa64f 2309 pdu_len -= __ertm_hdr_size(chan);
94122bbe
MM		 2310
2311 /* Remote device may have requested smaller PDUs */
2312 pdu_len = min_t(size_t, pdu_len, chan->remote_mps);
2313
2314 if (len <= pdu_len) {
2315 sar = L2CAP_SAR_UNSEGMENTED;
2316 sdu_len = 0;
2317 pdu_len = len;
2318 } else {
2319 sar = L2CAP_SAR_START;
2320 sdu_len = len;
94122bbe
MM		 2321 }
2322
2323 while (len > 0) {
2324 skb = l2cap_create_iframe_pdu(chan, msg, pdu_len, sdu_len);
c74e560c 2325
c74e560c 2326 if (IS_ERR(skb)) {
94122bbe 2327 __skb_queue_purge(seg_queue);
c74e560c
GP		 2328 return PTR_ERR(skb);
2329 }
2330
a4368ff3 2331 bt_cb(skb)->l2cap.sar = sar;
94122bbe
MM		 2332 __skb_queue_tail(seg_queue, skb);
2333
2334 len -= pdu_len;
069cb270 2335 if (sdu_len)
94122bbe 2336 sdu_len = 0;
94122bbe
MM		 2337
2338 if (len <= pdu_len) {
2339 sar = L2CAP_SAR_END;
2340 pdu_len = len;
2341 } else {
2342 sar = L2CAP_SAR_CONTINUE;
2343 }
c74e560c 2344 }
c74e560c 2345
f0f62799 2346 return 0;
c74e560c
GP		 2347}
2348
177f8f2b
JH		 2349static struct sk_buff *l2cap_create_le_flowctl_pdu(struct l2cap_chan *chan,
2350 struct msghdr *msg,
2351 size_t len, u16 sdulen)
2352{
2353 struct l2cap_conn *conn = chan->conn;
2354 struct sk_buff *skb;
2355 int err, count, hlen;
2356 struct l2cap_hdr *lh;
2357
2358 BT_DBG("chan %p len %zu", chan, len);
2359
2360 if (!conn)
2361 return ERR_PTR(-ENOTCONN);
2362
2363 hlen = L2CAP_HDR_SIZE;
2364
2365 if (sdulen)
2366 hlen += L2CAP_SDULEN_SIZE;
2367
2368 count = min_t(unsigned int, (conn->mtu - hlen), len);
2369
d9fbd02b 2370 skb = chan->ops->alloc_skb(chan, hlen, count,
177f8f2b
JH		 2371 msg->msg_flags & MSG_DONTWAIT);
2372 if (IS_ERR(skb))
2373 return skb;
2374
2375 /* Create L2CAP header */
2376 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
2377 lh->cid = cpu_to_le16(chan->dcid);
2378 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
2379
2380 if (sdulen)
2381 put_unaligned_le16(sdulen, skb_put(skb, L2CAP_SDULEN_SIZE));
2382
2383 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
2384 if (unlikely(err < 0)) {
2385 kfree_skb(skb);
2386 return ERR_PTR(err);
2387 }
2388
2389 return skb;
2390}
2391
2392static int l2cap_segment_le_sdu(struct l2cap_chan *chan,
2393 struct sk_buff_head *seg_queue,
2394 struct msghdr *msg, size_t len)
2395{
2396 struct sk_buff *skb;
2397 size_t pdu_len;
2398 u16 sdu_len;
2399
2400 BT_DBG("chan %p, msg %p, len %zu", chan, msg, len);
2401
177f8f2b 2402 sdu_len = len;
72c6fb91 2403 pdu_len = chan->remote_mps - L2CAP_SDULEN_SIZE;
177f8f2b
JH		 2404
2405 while (len > 0) {
2406 if (len <= pdu_len)
2407 pdu_len = len;
2408
2409 skb = l2cap_create_le_flowctl_pdu(chan, msg, pdu_len, sdu_len);
2410 if (IS_ERR(skb)) {
2411 __skb_queue_purge(seg_queue);
2412 return PTR_ERR(skb);
2413 }
2414
2415 __skb_queue_tail(seg_queue, skb);
2416
2417 len -= pdu_len;
2418
2419 if (sdu_len) {
2420 sdu_len = 0;
2421 pdu_len += L2CAP_SDULEN_SIZE;
2422 }
2423 }
2424
2425 return 0;
2426}
2427
8d46321c 2428int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len)
9a91a04a 2429{
9a91a04a 2430 struct sk_buff *skb;
9a91a04a 2431 int err;
94122bbe 2432 struct sk_buff_head seg_queue;
9a91a04a 2433
31e8ce80
SWK		 2434 if (!chan->conn)
2435 return -ENOTCONN;
2436
9a91a04a 2437 /* Connectionless channel */
715ec005 2438 if (chan->chan_type == L2CAP_CHAN_CONN_LESS) {
8d46321c 2439 skb = l2cap_create_connless_pdu(chan, msg, len);
9a91a04a
GP		 2440 if (IS_ERR(skb))
2441 return PTR_ERR(skb);
2442
ede81a2a
AK		 2443 /* Channel lock is released before requesting new skb and then
2444 * reacquired thus we need to recheck channel state.
2445 */
2446 if (chan->state != BT_CONNECTED) {
2447 kfree_skb(skb);
2448 return -ENOTCONN;
2449 }
2450
9a91a04a
GP		 2451 l2cap_do_send(chan, skb);
2452 return len;
2453 }
2454
2455 switch (chan->mode) {
38319713 2456 case L2CAP_MODE_LE_FLOWCTL:
177f8f2b
JH		 2457 /* Check outgoing MTU */
2458 if (len > chan->omtu)
2459 return -EMSGSIZE;
2460
fad5fc89
JH		 2461 if (!chan->tx_credits)
2462 return -EAGAIN;
2463
177f8f2b
JH		 2464 __skb_queue_head_init(&seg_queue);
2465
2466 err = l2cap_segment_le_sdu(chan, &seg_queue, msg, len);
2467
2468 if (chan->state != BT_CONNECTED) {
2469 __skb_queue_purge(&seg_queue);
2470 err = -ENOTCONN;
2471 }
2472
2473 if (err)
2474 return err;
2475
2476 skb_queue_splice_tail_init(&seg_queue, &chan->tx_q);
2477
2478 while (chan->tx_credits && !skb_queue_empty(&chan->tx_q)) {
2479 l2cap_do_send(chan, skb_dequeue(&chan->tx_q));
2480 chan->tx_credits--;
2481 }
2482
2483 if (!chan->tx_credits)
2484 chan->ops->suspend(chan);
2485
2486 err = len;
2487
2488 break;
2489
fad5fc89 2490 case L2CAP_MODE_BASIC:
9a91a04a
GP		 2491 /* Check outgoing MTU */
2492 if (len > chan->omtu)
2493 return -EMSGSIZE;
2494
2495 /* Create a basic PDU */
8d46321c 2496 skb = l2cap_create_basic_pdu(chan, msg, len);
9a91a04a
GP		 2497 if (IS_ERR(skb))
2498 return PTR_ERR(skb);
2499
ede81a2a
AK		 2500 /* Channel lock is released before requesting new skb and then
2501 * reacquired thus we need to recheck channel state.
2502 */
2503 if (chan->state != BT_CONNECTED) {
2504 kfree_skb(skb);
2505 return -ENOTCONN;
2506 }
2507
9a91a04a
GP		 2508 l2cap_do_send(chan, skb);
2509 err = len;
2510 break;
2511
2512 case L2CAP_MODE_ERTM:
2513 case L2CAP_MODE_STREAMING:
94122bbe
MM		 2514 /* Check outgoing MTU */
2515 if (len > chan->omtu) {
2516 err = -EMSGSIZE;
2517 break;
2518 }
9a91a04a 2519
94122bbe 2520 __skb_queue_head_init(&seg_queue);
9a91a04a 2521
94122bbe
MM		 2522 /* Do segmentation before calling in to the state machine,
2523 * since it's possible to block while waiting for memory
2524 * allocation.
2525 */
2526 err = l2cap_segment_sdu(chan, &seg_queue, msg, len);
9a91a04a 2527
94122bbe
MM		 2528 /* The channel could have been closed while segmenting,
2529 * check that it is still connected.
2530 */
2531 if (chan->state != BT_CONNECTED) {
2532 __skb_queue_purge(&seg_queue);
2533 err = -ENOTCONN;
9a91a04a
GP		 2534 }
2535
94122bbe 2536 if (err)
9a91a04a 2537 break;
9a91a04a 2538
3733937d 2539 if (chan->mode == L2CAP_MODE_ERTM)
d660366d 2540 l2cap_tx(chan, NULL, &seg_queue, L2CAP_EV_DATA_REQUEST);
3733937d 2541 else
d660366d 2542 l2cap_streaming_send(chan, &seg_queue);
9a91a04a 2543
d660366d 2544 err = len;
9a91a04a 2545
94122bbe
MM		 2546 /* If the skbs were not queued for sending, they'll still be in
2547 * seg_queue and need to be purged.
2548 */
2549 __skb_queue_purge(&seg_queue);
9a91a04a
GP		 2550 break;
2551
2552 default:
2553 BT_DBG("bad state %1.1x", chan->mode);
2554 err = -EBADFD;
2555 }
2556
2557 return err;
2558}
6b8d4a6a 2559EXPORT_SYMBOL_GPL(l2cap_chan_send);
9a91a04a 2560
d2a7ac5d
MM		 2561static void l2cap_send_srej(struct l2cap_chan *chan, u16 txseq)
2562{
bed68bde
MM		 2563 struct l2cap_ctrl control;
2564 u16 seq;
2565
b4400672 2566 BT_DBG("chan %p, txseq %u", chan, txseq);
bed68bde
MM		 2567
2568 memset(&control, 0, sizeof(control));
2569 control.sframe = 1;
2570 control.super = L2CAP_SUPER_SREJ;
2571
2572 for (seq = chan->expected_tx_seq; seq != txseq;
2573 seq = __next_seq(chan, seq)) {
2574 if (!l2cap_ertm_seq_in_queue(&chan->srej_q, seq)) {
2575 control.reqseq = seq;
2576 l2cap_send_sframe(chan, &control);
2577 l2cap_seq_list_append(&chan->srej_list, seq);
2578 }
2579 }
2580
2581 chan->expected_tx_seq = __next_seq(chan, txseq);
d2a7ac5d
MM		 2582}
2583
2584static void l2cap_send_srej_tail(struct l2cap_chan *chan)
2585{
bed68bde
MM		 2586 struct l2cap_ctrl control;
2587
2588 BT_DBG("chan %p", chan);
2589
2590 if (chan->srej_list.tail == L2CAP_SEQ_LIST_CLEAR)
2591 return;
2592
2593 memset(&control, 0, sizeof(control));
2594 control.sframe = 1;
2595 control.super = L2CAP_SUPER_SREJ;
2596 control.reqseq = chan->srej_list.tail;
2597 l2cap_send_sframe(chan, &control);
d2a7ac5d
MM		 2598}
2599
2600static void l2cap_send_srej_list(struct l2cap_chan *chan, u16 txseq)
2601{
bed68bde
MM		 2602 struct l2cap_ctrl control;
2603 u16 initial_head;
2604 u16 seq;
2605
b4400672 2606 BT_DBG("chan %p, txseq %u", chan, txseq);
bed68bde
MM		 2607
2608 memset(&control, 0, sizeof(control));
2609 control.sframe = 1;
2610 control.super = L2CAP_SUPER_SREJ;
2611
2612 /* Capture initial list head to allow only one pass through the list. */
2613 initial_head = chan->srej_list.head;
2614
2615 do {
2616 seq = l2cap_seq_list_pop(&chan->srej_list);
2617 if (seq == txseq || seq == L2CAP_SEQ_LIST_CLEAR)
2618 break;
2619
2620 control.reqseq = seq;
2621 l2cap_send_sframe(chan, &control);
2622 l2cap_seq_list_append(&chan->srej_list, seq);
2623 } while (chan->srej_list.head != initial_head);
d2a7ac5d
MM		 2624}
2625
608bcc6d
MM		 2626static void l2cap_process_reqseq(struct l2cap_chan *chan, u16 reqseq)
2627{
2628 struct sk_buff *acked_skb;
2629 u16 ackseq;
2630
b4400672 2631 BT_DBG("chan %p, reqseq %u", chan, reqseq);
608bcc6d
MM		 2632
2633 if (chan->unacked_frames == 0 || reqseq == chan->expected_ack_seq)
2634 return;
2635
b4400672 2636 BT_DBG("expected_ack_seq %u, unacked_frames %u",
608bcc6d
MM		 2637 chan->expected_ack_seq, chan->unacked_frames);
2638
2639 for (ackseq = chan->expected_ack_seq; ackseq != reqseq;
2640 ackseq = __next_seq(chan, ackseq)) {
2641
2642 acked_skb = l2cap_ertm_seq_in_queue(&chan->tx_q, ackseq);
2643 if (acked_skb) {
2644 skb_unlink(acked_skb, &chan->tx_q);
2645 kfree_skb(acked_skb);
2646 chan->unacked_frames--;
2647 }
2648 }
2649
2650 chan->expected_ack_seq = reqseq;
2651
2652 if (chan->unacked_frames == 0)
2653 __clear_retrans_timer(chan);
2654
b4400672 2655 BT_DBG("unacked_frames %u", chan->unacked_frames);
608bcc6d
MM		 2656}
2657
2658static void l2cap_abort_rx_srej_sent(struct l2cap_chan *chan)
2659{
2660 BT_DBG("chan %p", chan);
2661
2662 chan->expected_tx_seq = chan->buffer_seq;
2663 l2cap_seq_list_clear(&chan->srej_list);
2664 skb_queue_purge(&chan->srej_q);
2665 chan->rx_state = L2CAP_RX_STATE_RECV;
2666}
2667
d660366d
GP		 2668static void l2cap_tx_state_xmit(struct l2cap_chan *chan,
2669 struct l2cap_ctrl *control,
2670 struct sk_buff_head *skbs, u8 event)
608bcc6d 2671{
608bcc6d
MM		 2672 BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,
2673 event);
2674
2675 switch (event) {
2676 case L2CAP_EV_DATA_REQUEST:
2677 if (chan->tx_send_head == NULL)
2678 chan->tx_send_head = skb_peek(skbs);
2679
2680 skb_queue_splice_tail_init(skbs, &chan->tx_q);
2681 l2cap_ertm_send(chan);
2682 break;
2683 case L2CAP_EV_LOCAL_BUSY_DETECTED:
2684 BT_DBG("Enter LOCAL_BUSY");
2685 set_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2686
2687 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
2688 /* The SREJ_SENT state must be aborted if we are to
2689 * enter the LOCAL_BUSY state.
2690 */
2691 l2cap_abort_rx_srej_sent(chan);
2692 }
2693
2694 l2cap_send_ack(chan);
2695
2696 break;
2697 case L2CAP_EV_LOCAL_BUSY_CLEAR:
2698 BT_DBG("Exit LOCAL_BUSY");
2699 clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2700
2701 if (test_bit(CONN_RNR_SENT, &chan->conn_state)) {
2702 struct l2cap_ctrl local_control;
2703
2704 memset(&local_control, 0, sizeof(local_control));
2705 local_control.sframe = 1;
2706 local_control.super = L2CAP_SUPER_RR;
2707 local_control.poll = 1;
2708 local_control.reqseq = chan->buffer_seq;
a67d7f6f 2709 l2cap_send_sframe(chan, &local_control);
608bcc6d
MM		 2710
2711 chan->retry_count = 1;
2712 __set_monitor_timer(chan);
2713 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2714 }
2715 break;
2716 case L2CAP_EV_RECV_REQSEQ_AND_FBIT:
2717 l2cap_process_reqseq(chan, control->reqseq);
2718 break;
2719 case L2CAP_EV_EXPLICIT_POLL:
2720 l2cap_send_rr_or_rnr(chan, 1);
2721 chan->retry_count = 1;
2722 __set_monitor_timer(chan);
2723 __clear_ack_timer(chan);
2724 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2725 break;
2726 case L2CAP_EV_RETRANS_TO:
2727 l2cap_send_rr_or_rnr(chan, 1);
2728 chan->retry_count = 1;
2729 __set_monitor_timer(chan);
2730 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2731 break;
2732 case L2CAP_EV_RECV_FBIT:
2733 /* Nothing to process */
2734 break;
2735 default:
2736 break;
2737 }
608bcc6d
MM		 2738}
2739
d660366d
GP		 2740static void l2cap_tx_state_wait_f(struct l2cap_chan *chan,
2741 struct l2cap_ctrl *control,
2742 struct sk_buff_head *skbs, u8 event)
608bcc6d 2743{
608bcc6d
MM		 2744 BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,
2745 event);
2746
2747 switch (event) {
2748 case L2CAP_EV_DATA_REQUEST:
2749 if (chan->tx_send_head == NULL)
2750 chan->tx_send_head = skb_peek(skbs);
2751 /* Queue data, but don't send. */
2752 skb_queue_splice_tail_init(skbs, &chan->tx_q);
2753 break;
2754 case L2CAP_EV_LOCAL_BUSY_DETECTED:
2755 BT_DBG("Enter LOCAL_BUSY");
2756 set_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2757
2758 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
2759 /* The SREJ_SENT state must be aborted if we are to
2760 * enter the LOCAL_BUSY state.
2761 */
2762 l2cap_abort_rx_srej_sent(chan);
2763 }
2764
2765 l2cap_send_ack(chan);
2766
2767 break;
2768 case L2CAP_EV_LOCAL_BUSY_CLEAR:
2769 BT_DBG("Exit LOCAL_BUSY");
2770 clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2771
2772 if (test_bit(CONN_RNR_SENT, &chan->conn_state)) {
2773 struct l2cap_ctrl local_control;
2774 memset(&local_control, 0, sizeof(local_control));
2775 local_control.sframe = 1;
2776 local_control.super = L2CAP_SUPER_RR;
2777 local_control.poll = 1;
2778 local_control.reqseq = chan->buffer_seq;
a67d7f6f 2779 l2cap_send_sframe(chan, &local_control);
608bcc6d
MM		 2780
2781 chan->retry_count = 1;
2782 __set_monitor_timer(chan);
2783 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2784 }
2785 break;
2786 case L2CAP_EV_RECV_REQSEQ_AND_FBIT:
2787 l2cap_process_reqseq(chan, control->reqseq);
2788
2789 /* Fall through */
2790
2791 case L2CAP_EV_RECV_FBIT:
2792 if (control && control->final) {
2793 __clear_monitor_timer(chan);
2794 if (chan->unacked_frames > 0)
2795 __set_retrans_timer(chan);
2796 chan->retry_count = 0;
2797 chan->tx_state = L2CAP_TX_STATE_XMIT;
2798 BT_DBG("recv fbit tx_state 0x2.2%x", chan->tx_state);
2799 }
2800 break;
2801 case L2CAP_EV_EXPLICIT_POLL:
2802 /* Ignore */
2803 break;
2804 case L2CAP_EV_MONITOR_TO:
2805 if (chan->max_tx == 0 || chan->retry_count < chan->max_tx) {
2806 l2cap_send_rr_or_rnr(chan, 1);
2807 __set_monitor_timer(chan);
2808 chan->retry_count++;
2809 } else {
5e4e3972 2810 l2cap_send_disconn_req(chan, ECONNABORTED);
608bcc6d
MM		 2811 }
2812 break;
2813 default:
2814 break;
2815 }
608bcc6d
MM		 2816}
2817
d660366d
GP		 2818static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
2819 struct sk_buff_head *skbs, u8 event)
608bcc6d 2820{
608bcc6d
MM		 2821 BT_DBG("chan %p, control %p, skbs %p, event %d, state %d",
2822 chan, control, skbs, event, chan->tx_state);
2823
2824 switch (chan->tx_state) {
2825 case L2CAP_TX_STATE_XMIT:
d660366d 2826 l2cap_tx_state_xmit(chan, control, skbs, event);
608bcc6d
MM		 2827 break;
2828 case L2CAP_TX_STATE_WAIT_F:
d660366d 2829 l2cap_tx_state_wait_f(chan, control, skbs, event);
608bcc6d
MM		 2830 break;
2831 default:
2832 /* Ignore event */
2833 break;
2834 }
608bcc6d
MM		 2835}
2836
4b51dae9
MM		 2837static void l2cap_pass_to_tx(struct l2cap_chan *chan,
2838 struct l2cap_ctrl *control)
2839{
2840 BT_DBG("chan %p, control %p", chan, control);
401bb1f7 2841 l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_REQSEQ_AND_FBIT);
4b51dae9
MM		 2842}
2843
f80842a8
MM		 2844static void l2cap_pass_to_tx_fbit(struct l2cap_chan *chan,
2845 struct l2cap_ctrl *control)
2846{
2847 BT_DBG("chan %p, control %p", chan, control);
401bb1f7 2848 l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_FBIT);
f80842a8
MM		 2849}
2850
1da177e4
LT		 2851/* Copy frame to all raw sockets on that connection */
2852static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb)
2853{
1da177e4 2854 struct sk_buff *nskb;
48454079 2855 struct l2cap_chan *chan;
1da177e4
LT		 2856
2857 BT_DBG("conn %p", conn);
2858
3df91ea2 2859 mutex_lock(&conn->chan_lock);
3d57dc68 2860
3df91ea2 2861 list_for_each_entry(chan, &conn->chan_l, list) {
715ec005 2862 if (chan->chan_type != L2CAP_CHAN_RAW)
1da177e4
LT		 2863 continue;
2864
7f5396a7 2865 /* Don't send frame to the channel it came from */
a4368ff3 2866 if (bt_cb(skb)->l2cap.chan == chan)
1da177e4 2867 continue;
7f5396a7 2868
8bcde1f2 2869 nskb = skb_clone(skb, GFP_KERNEL);
af05b30b 2870 if (!nskb)
1da177e4 2871 continue;
80b98027 2872 if (chan->ops->recv(chan, nskb))
1da177e4
LT		 2873 kfree_skb(nskb);
2874 }
3d57dc68 2875
3df91ea2 2876 mutex_unlock(&conn->chan_lock);
1da177e4
LT		 2877}
2878
2879/* ---- L2CAP signalling commands ---- */
b4400672
AE		 2880static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn, u8 code,
2881 u8 ident, u16 dlen, void *data)
1da177e4
LT		 2882{
2883 struct sk_buff *skb, **frag;
2884 struct l2cap_cmd_hdr *cmd;
2885 struct l2cap_hdr *lh;
2886 int len, count;
2887
b4400672
AE		 2888 BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %u",
2889 conn, code, ident, dlen);
1da177e4 2890
300b962e
AL		 2891 if (conn->mtu < L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE)
2892 return NULL;
2893
1da177e4
LT		 2894 len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen;
2895 count = min_t(unsigned int, conn->mtu, len);
2896
8bcde1f2 2897 skb = bt_skb_alloc(count, GFP_KERNEL);
1da177e4
LT		 2898 if (!skb)
2899 return NULL;
2900
2901 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
aca3192c 2902 lh->len = cpu_to_le16(L2CAP_CMD_HDR_SIZE + dlen);
3300d9a9
CT		 2903
2904 if (conn->hcon->type == LE_LINK)
dcf4adbf 2905 lh->cid = cpu_to_le16(L2CAP_CID_LE_SIGNALING);
3300d9a9 2906 else
dcf4adbf 2907 lh->cid = cpu_to_le16(L2CAP_CID_SIGNALING);
1da177e4
LT		 2908
2909 cmd = (struct l2cap_cmd_hdr *) skb_put(skb, L2CAP_CMD_HDR_SIZE);
2910 cmd->code = code;
2911 cmd->ident = ident;
aca3192c 2912 cmd->len = cpu_to_le16(dlen);
1da177e4
LT		 2913
2914 if (dlen) {
2915 count -= L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE;
2916 memcpy(skb_put(skb, count), data, count);
2917 data += count;
2918 }
2919
2920 len -= skb->len;
2921
2922 /* Continuation fragments (no L2CAP header) */
2923 frag = &skb_shinfo(skb)->frag_list;
2924 while (len) {
2925 count = min_t(unsigned int, conn->mtu, len);
2926
8bcde1f2 2927 *frag = bt_skb_alloc(count, GFP_KERNEL);
1da177e4
LT		 2928 if (!*frag)
2929 goto fail;
2930
2931 memcpy(skb_put(*frag, count), data, count);
2932
2933 len -= count;
2934 data += count;
2935
2936 frag = &(*frag)->next;
2937 }
2938
2939 return skb;
2940
2941fail:
2942 kfree_skb(skb);
2943 return NULL;
2944}
2945
2d792818
GP		 2946static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen,
2947 unsigned long *val)
1da177e4
LT		 2948{
2949 struct l2cap_conf_opt *opt = *ptr;
2950 int len;
2951
2952 len = L2CAP_CONF_OPT_SIZE + opt->len;
2953 *ptr += len;
2954
2955 *type = opt->type;
2956 *olen = opt->len;
2957
2958 switch (opt->len) {
2959 case 1:
2960 *val = *((u8 *) opt->val);
2961 break;
2962
2963 case 2:
bfaaeb3e 2964 *val = get_unaligned_le16(opt->val);
1da177e4
LT		 2965 break;
2966
2967 case 4:
bfaaeb3e 2968 *val = get_unaligned_le32(opt->val);
1da177e4
LT		 2969 break;
2970
2971 default:
2972 *val = (unsigned long) opt->val;
2973 break;
2974 }
2975
b4400672 2976 BT_DBG("type 0x%2.2x len %u val 0x%lx", *type, opt->len, *val);
1da177e4
LT		 2977 return len;
2978}
2979
1da177e4
LT		 2980static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val)
2981{
2982 struct l2cap_conf_opt *opt = *ptr;
2983
b4400672 2984 BT_DBG("type 0x%2.2x len %u val 0x%lx", type, len, val);
1da177e4
LT		 2985
2986 opt->type = type;
2987 opt->len = len;
2988
2989 switch (len) {
2990 case 1:
2991 *((u8 *) opt->val) = val;
2992 break;
2993
2994 case 2:
4f8b691c 2995 put_unaligned_le16(val, opt->val);
1da177e4
LT		 2996 break;
2997
2998 case 4:
4f8b691c 2999 put_unaligned_le32(val, opt->val);
1da177e4
LT		 3000 break;
3001
3002 default:
3003 memcpy(opt->val, (void *) val, len);
3004 break;
3005 }
3006
3007 *ptr += L2CAP_CONF_OPT_SIZE + len;
3008}
3009
f89cef09
AE		 3010static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan)
3011{
3012 struct l2cap_conf_efs efs;
3013
1ec918ce 3014 switch (chan->mode) {
f89cef09
AE		 3015 case L2CAP_MODE_ERTM:
3016 efs.id = chan->local_id;
3017 efs.stype = chan->local_stype;
3018 efs.msdu = cpu_to_le16(chan->local_msdu);
3019 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime);
dcf4adbf
JP		 3020 efs.acc_lat = cpu_to_le32(L2CAP_DEFAULT_ACC_LAT);
3021 efs.flush_to = cpu_to_le32(L2CAP_EFS_DEFAULT_FLUSH_TO);
f89cef09
AE		 3022 break;
3023
3024 case L2CAP_MODE_STREAMING:
3025 efs.id = 1;
3026 efs.stype = L2CAP_SERV_BESTEFFORT;
3027 efs.msdu = cpu_to_le16(chan->local_msdu);
3028 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime);
3029 efs.acc_lat = 0;
3030 efs.flush_to = 0;
3031 break;
3032
3033 default:
3034 return;
3035 }
3036
3037 l2cap_add_conf_opt(ptr, L2CAP_CONF_EFS, sizeof(efs),
8936fa6d 3038 (unsigned long) &efs);
f89cef09
AE		 3039}
3040
721c4181 3041static void l2cap_ack_timeout(struct work_struct *work)
c1b4f43b 3042{
721c4181 3043 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
0362520b
MM		 3044 ack_timer.work);
3045 u16 frames_to_ack;
c1b4f43b 3046
2fb9b3d4
GP		 3047 BT_DBG("chan %p", chan);
3048
6be36555
AE		 3049 l2cap_chan_lock(chan);
3050
0362520b
MM		 3051 frames_to_ack = __seq_offset(chan, chan->buffer_seq,
3052 chan->last_acked_seq);
6be36555 3053
0362520b
MM		 3054 if (frames_to_ack)
3055 l2cap_send_rr_or_rnr(chan, 0);
09bfb2ee 3056
0362520b 3057 l2cap_chan_unlock(chan);
09bfb2ee 3058 l2cap_chan_put(chan);
c1b4f43b
GP		 3059}
3060
466f8004 3061int l2cap_ertm_init(struct l2cap_chan *chan)
0565c1c2 3062{
3c588192
MM		 3063 int err;
3064
105bdf9e
MM		 3065 chan->next_tx_seq = 0;
3066 chan->expected_tx_seq = 0;
42e5c802 3067 chan->expected_ack_seq = 0;
6a026610 3068 chan->unacked_frames = 0;
42e5c802 3069 chan->buffer_seq = 0;
6a026610 3070 chan->frames_sent = 0;
105bdf9e
MM		 3071 chan->last_acked_seq = 0;
3072 chan->sdu = NULL;
3073 chan->sdu_last_frag = NULL;
3074 chan->sdu_len = 0;
3075
d34c34fb
MM		 3076 skb_queue_head_init(&chan->tx_q);
3077
6ed971ca
MH		 3078 chan->local_amp_id = AMP_ID_BREDR;
3079 chan->move_id = AMP_ID_BREDR;
08333283
MM		 3080 chan->move_state = L2CAP_MOVE_STABLE;
3081 chan->move_role = L2CAP_MOVE_ROLE_NONE;
3082
105bdf9e
MM		 3083 if (chan->mode != L2CAP_MODE_ERTM)
3084 return 0;
3085
3086 chan->rx_state = L2CAP_RX_STATE_RECV;
3087 chan->tx_state = L2CAP_TX_STATE_XMIT;
0565c1c2 3088
721c4181
GP		 3089 INIT_DELAYED_WORK(&chan->retrans_timer, l2cap_retrans_timeout);
3090 INIT_DELAYED_WORK(&chan->monitor_timer, l2cap_monitor_timeout);
3091 INIT_DELAYED_WORK(&chan->ack_timer, l2cap_ack_timeout);
0565c1c2 3092
f1c6775b 3093 skb_queue_head_init(&chan->srej_q);
1890d36b 3094
3c588192
MM		 3095 err = l2cap_seq_list_init(&chan->srej_list, chan->tx_win);
3096 if (err < 0)
3097 return err;
3098
9dc9affc
MM		 3099 err = l2cap_seq_list_init(&chan->retrans_list, chan->remote_tx_win);
3100 if (err < 0)
3101 l2cap_seq_list_free(&chan->srej_list);
3102
3103 return err;
0565c1c2
GP		 3104}
3105
f2fcfcd6
GP		 3106static inline __u8 l2cap_select_mode(__u8 mode, __u16 remote_feat_mask)
3107{
3108 switch (mode) {
3109 case L2CAP_MODE_STREAMING:
3110 case L2CAP_MODE_ERTM:
3111 if (l2cap_mode_supported(mode, remote_feat_mask))
3112 return mode;
3113 /* fall through */
3114 default:
3115 return L2CAP_MODE_BASIC;
3116 }
3117}
3118
848566b3 3119static inline bool __l2cap_ews_supported(struct l2cap_conn *conn)
6327eb98 3120{
0bd49fc7
JH		 3121 return ((conn->local_fixed_chan & L2CAP_FC_A2MP) &&
3122 (conn->feat_mask & L2CAP_FEAT_EXT_WINDOW));
6327eb98
AE		 3123}
3124
848566b3 3125static inline bool __l2cap_efs_supported(struct l2cap_conn *conn)
f89cef09 3126{
0bd49fc7
JH		 3127 return ((conn->local_fixed_chan & L2CAP_FC_A2MP) &&
3128 (conn->feat_mask & L2CAP_FEAT_EXT_FLOW));
f89cef09
AE		 3129}
3130
36c86c85
MM		 3131static void __l2cap_set_ertm_timeouts(struct l2cap_chan *chan,
3132 struct l2cap_conf_rfc *rfc)
3133{
6ed971ca 3134 if (chan->local_amp_id != AMP_ID_BREDR && chan->hs_hcon) {
36c86c85
MM		 3135 u64 ertm_to = chan->hs_hcon->hdev->amp_be_flush_to;
3136
3137 /* Class 1 devices have must have ERTM timeouts
3138 * exceeding the Link Supervision Timeout. The
3139 * default Link Supervision Timeout for AMP
3140 * controllers is 10 seconds.
3141 *
3142 * Class 1 devices use 0xffffffff for their
3143 * best-effort flush timeout, so the clamping logic
3144 * will result in a timeout that meets the above
3145 * requirement. ERTM timeouts are 16-bit values, so
3146 * the maximum timeout is 65.535 seconds.
3147 */
3148
3149 /* Convert timeout to milliseconds and round */
3150 ertm_to = DIV_ROUND_UP_ULL(ertm_to, 1000);
3151
3152 /* This is the recommended formula for class 2 devices
3153 * that start ERTM timers when packets are sent to the
3154 * controller.
3155 */
3156 ertm_to = 3 * ertm_to + 500;
3157
3158 if (ertm_to > 0xffff)
3159 ertm_to = 0xffff;
3160
3161 rfc->retrans_timeout = cpu_to_le16((u16) ertm_to);
3162 rfc->monitor_timeout = rfc->retrans_timeout;
3163 } else {
dcf4adbf
JP		 3164 rfc->retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO);
3165 rfc->monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO);
36c86c85
MM		 3166 }
3167}
3168
6327eb98
AE		 3169static inline void l2cap_txwin_setup(struct l2cap_chan *chan)
3170{
3171 if (chan->tx_win > L2CAP_DEFAULT_TX_WINDOW &&
848566b3 3172 __l2cap_ews_supported(chan->conn)) {
6327eb98
AE		 3173 /* use extended control field */
3174 set_bit(FLAG_EXT_CTRL, &chan->flags);
836be934
AE		 3175 chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;
3176 } else {
6327eb98 3177 chan->tx_win = min_t(u16, chan->tx_win,
2d792818 3178 L2CAP_DEFAULT_TX_WINDOW);
836be934
AE		 3179 chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
3180 }
c20f8e35 3181 chan->ack_win = chan->tx_win;
6327eb98
AE		 3182}
3183
710f9b0a 3184static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data)
1da177e4 3185{
1da177e4 3186 struct l2cap_conf_req *req = data;
0c1bc5c6 3187 struct l2cap_conf_rfc rfc = { .mode = chan->mode };
1da177e4 3188 void *ptr = req->data;
c8f79162 3189 u16 size;
1da177e4 3190
49208c9c 3191 BT_DBG("chan %p", chan);
1da177e4 3192
73ffa904 3193 if (chan->num_conf_req || chan->num_conf_rsp)
f2fcfcd6
GP		 3194 goto done;
3195
0c1bc5c6 3196 switch (chan->mode) {
f2fcfcd6
GP		 3197 case L2CAP_MODE_STREAMING:
3198 case L2CAP_MODE_ERTM:
c1360a1c 3199 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state))
85eb53c6 3200 break;
85eb53c6 3201
848566b3 3202 if (__l2cap_efs_supported(chan->conn))
f89cef09
AE		 3203 set_bit(FLAG_EFS_ENABLE, &chan->flags);
3204
2ba13ed6 3205 /* fall through */
f2fcfcd6 3206 default:
8c1d787b 3207 chan->mode = l2cap_select_mode(rfc.mode, chan->conn->feat_mask);
f2fcfcd6
GP		 3208 break;
3209 }
3210
3211done:
0c1bc5c6
GP		 3212 if (chan->imtu != L2CAP_DEFAULT_MTU)
3213 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu);
7990681c 3214
0c1bc5c6 3215 switch (chan->mode) {
65c7c491 3216 case L2CAP_MODE_BASIC:
6fea7ad1
MH		 3217 if (disable_ertm)
3218 break;
3219
8c1d787b 3220 if (!(chan->conn->feat_mask & L2CAP_FEAT_ERTM) &&
2d792818 3221 !(chan->conn->feat_mask & L2CAP_FEAT_STREAMING))
63406504
GP		 3222 break;
3223
62547752
GP		 3224 rfc.mode = L2CAP_MODE_BASIC;
3225 rfc.txwin_size = 0;
3226 rfc.max_transmit = 0;
3227 rfc.retrans_timeout = 0;
3228 rfc.monitor_timeout = 0;
3229 rfc.max_pdu_size = 0;
3230
63406504 3231 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
2d792818 3232 (unsigned long) &rfc);
65c7c491
MH		 3233 break;
3234
3235 case L2CAP_MODE_ERTM:
3236 rfc.mode = L2CAP_MODE_ERTM;
47d1ec61 3237 rfc.max_transmit = chan->max_tx;
36c86c85
MM		 3238
3239 __l2cap_set_ertm_timeouts(chan, &rfc);
c8f79162
AE		 3240
3241 size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -
2d792818
GP		 3242 L2CAP_EXT_HDR_SIZE - L2CAP_SDULEN_SIZE -
3243 L2CAP_FCS_SIZE);
c8f79162 3244 rfc.max_pdu_size = cpu_to_le16(size);
f2fcfcd6 3245
6327eb98
AE		 3246 l2cap_txwin_setup(chan);
3247
3248 rfc.txwin_size = min_t(u16, chan->tx_win,
2d792818 3249 L2CAP_DEFAULT_TX_WINDOW);
f2fcfcd6 3250
63406504 3251 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
2d792818 3252 (unsigned long) &rfc);
63406504 3253
f89cef09
AE		 3254 if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
3255 l2cap_add_opt_efs(&ptr, chan);
3256
6327eb98
AE		 3257 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
3258 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
2d792818 3259 chan->tx_win);
60918918
AE		 3260
3261 if (chan->conn->feat_mask & L2CAP_FEAT_FCS)
3262 if (chan->fcs == L2CAP_FCS_NONE ||
f2592d3e 3263 test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) {
60918918
AE		 3264 chan->fcs = L2CAP_FCS_NONE;
3265 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1,
3266 chan->fcs);
3267 }
f2fcfcd6
GP		 3268 break;
3269
3270 case L2CAP_MODE_STREAMING:
273759e2 3271 l2cap_txwin_setup(chan);
f2fcfcd6
GP		 3272 rfc.mode = L2CAP_MODE_STREAMING;
3273 rfc.txwin_size = 0;
3274 rfc.max_transmit = 0;
3275 rfc.retrans_timeout = 0;
3276 rfc.monitor_timeout = 0;
c8f79162
AE		 3277
3278 size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -
2d792818
GP		 3279 L2CAP_EXT_HDR_SIZE - L2CAP_SDULEN_SIZE -
3280 L2CAP_FCS_SIZE);
c8f79162 3281 rfc.max_pdu_size = cpu_to_le16(size);
65c7c491 3282
63406504 3283 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
2d792818 3284 (unsigned long) &rfc);
63406504 3285
f89cef09
AE		 3286 if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
3287 l2cap_add_opt_efs(&ptr, chan);
3288
60918918
AE		 3289 if (chan->conn->feat_mask & L2CAP_FEAT_FCS)
3290 if (chan->fcs == L2CAP_FCS_NONE ||
f2592d3e 3291 test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) {
60918918
AE		 3292 chan->fcs = L2CAP_FCS_NONE;
3293 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1,
3294 chan->fcs);
3295 }
65c7c491
MH		 3296 break;
3297 }
1da177e4 3298
fe4128e0 3299 req->dcid = cpu_to_le16(chan->dcid);
dcf4adbf 3300 req->flags = cpu_to_le16(0);
1da177e4
LT		 3301
3302 return ptr - data;
3303}
3304
73ffa904 3305static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data)
1da177e4 3306{
5dee9e7c
MH		 3307 struct l2cap_conf_rsp *rsp = data;
3308 void *ptr = rsp->data;
73ffa904
GP		 3309 void *req = chan->conf_req;
3310 int len = chan->conf_len;
5dee9e7c
MH		 3311 int type, hint, olen;
3312 unsigned long val;
6464f35f 3313 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
42dceae2
AE		 3314 struct l2cap_conf_efs efs;
3315 u8 remote_efs = 0;
861d6882 3316 u16 mtu = L2CAP_DEFAULT_MTU;
5dee9e7c 3317 u16 result = L2CAP_CONF_SUCCESS;
c8f79162 3318 u16 size;
1da177e4 3319
73ffa904 3320 BT_DBG("chan %p", chan);
820ae1b8 3321
5dee9e7c
MH		 3322 while (len >= L2CAP_CONF_OPT_SIZE) {
3323 len -= l2cap_get_conf_opt(&req, &type, &olen, &val);
1da177e4 3324
589d2746 3325 hint = type & L2CAP_CONF_HINT;
47ec1dcd 3326 type &= L2CAP_CONF_MASK;
5dee9e7c
MH		 3327
3328 switch (type) {
3329 case L2CAP_CONF_MTU:
861d6882 3330 mtu = val;
5dee9e7c
MH		 3331 break;
3332
3333 case L2CAP_CONF_FLUSH_TO:
0c1bc5c6 3334 chan->flush_to = val;
5dee9e7c
MH		 3335 break;
3336
3337 case L2CAP_CONF_QOS:
3338 break;
3339
6464f35f
MH		 3340 case L2CAP_CONF_RFC:
3341 if (olen == sizeof(rfc))
3342 memcpy(&rfc, (void *) val, olen);
3343 break;
3344
fcc203c3
GP		 3345 case L2CAP_CONF_FCS:
3346 if (val == L2CAP_FCS_NONE)
f2592d3e 3347 set_bit(CONF_RECV_NO_FCS, &chan->conf_state);
42dceae2 3348 break;
fcc203c3 3349
42dceae2
AE		 3350 case L2CAP_CONF_EFS:
3351 remote_efs = 1;
3352 if (olen == sizeof(efs))
3353 memcpy(&efs, (void *) val, olen);
fcc203c3
GP		 3354 break;
3355
6327eb98 3356 case L2CAP_CONF_EWS:
0bd49fc7 3357 if (!(chan->conn->local_fixed_chan & L2CAP_FC_A2MP))
6327eb98 3358 return -ECONNREFUSED;
fcc203c3 3359
6327eb98
AE		 3360 set_bit(FLAG_EXT_CTRL, &chan->flags);
3361 set_bit(CONF_EWS_RECV, &chan->conf_state);
836be934 3362 chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;
6327eb98 3363 chan->remote_tx_win = val;
fcc203c3
GP		 3364 break;
3365
5dee9e7c
MH		 3366 default:
3367 if (hint)
3368 break;
3369
3370 result = L2CAP_CONF_UNKNOWN;
3371 *((u8 *) ptr++) = type;
3372 break;
3373 }
3374 }
3375
73ffa904 3376 if (chan->num_conf_rsp || chan->num_conf_req > 1)
f2fcfcd6
GP		 3377 goto done;
3378
0c1bc5c6 3379 switch (chan->mode) {
f2fcfcd6
GP		 3380 case L2CAP_MODE_STREAMING:
3381 case L2CAP_MODE_ERTM:
c1360a1c 3382 if (!test_bit(CONF_STATE2_DEVICE, &chan->conf_state)) {
0c1bc5c6 3383 chan->mode = l2cap_select_mode(rfc.mode,
2d792818 3384 chan->conn->feat_mask);
85eb53c6
GP		 3385 break;
3386 }
3387
42dceae2 3388 if (remote_efs) {
848566b3 3389 if (__l2cap_efs_supported(chan->conn))
42dceae2
AE		 3390 set_bit(FLAG_EFS_ENABLE, &chan->flags);
3391 else
3392 return -ECONNREFUSED;
3393 }
3394
0c1bc5c6 3395 if (chan->mode != rfc.mode)
f2fcfcd6 3396 return -ECONNREFUSED;
742e519b 3397
f2fcfcd6 3398 break;
f2fcfcd6
GP		 3399 }
3400
3401done:
0c1bc5c6 3402 if (chan->mode != rfc.mode) {
f2fcfcd6 3403 result = L2CAP_CONF_UNACCEPT;
0c1bc5c6 3404 rfc.mode = chan->mode;
f2fcfcd6 3405
73ffa904 3406 if (chan->num_conf_rsp == 1)
f2fcfcd6
GP		 3407 return -ECONNREFUSED;
3408
2d792818
GP		 3409 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3410 (unsigned long) &rfc);
f2fcfcd6
GP		 3411 }
3412
5dee9e7c
MH		 3413 if (result == L2CAP_CONF_SUCCESS) {
3414 /* Configure output options and let the other side know
3415 * which ones we don't like. */
3416
f2fcfcd6
GP		 3417 if (mtu < L2CAP_DEFAULT_MIN_MTU)
3418 result = L2CAP_CONF_UNACCEPT;
3419 else {
0c1bc5c6 3420 chan->omtu = mtu;
c1360a1c 3421 set_bit(CONF_MTU_DONE, &chan->conf_state);
f2fcfcd6 3422 }
0c1bc5c6 3423 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu);
6464f35f 3424
42dceae2
AE		 3425 if (remote_efs) {
3426 if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
2d792818
GP		 3427 efs.stype != L2CAP_SERV_NOTRAFIC &&
3428 efs.stype != chan->local_stype) {
42dceae2
AE		 3429
3430 result = L2CAP_CONF_UNACCEPT;
3431
3432 if (chan->num_conf_req >= 1)
3433 return -ECONNREFUSED;
3434
3435 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
2d792818
GP		 3436 sizeof(efs),
3437 (unsigned long) &efs);
0e8b207e 3438 } else {
3e6b3b95 3439 /* Send PENDING Conf Rsp */
0e8b207e
AE		 3440 result = L2CAP_CONF_PENDING;
3441 set_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
42dceae2
AE		 3442 }
3443 }
3444
f2fcfcd6
GP		 3445 switch (rfc.mode) {
3446 case L2CAP_MODE_BASIC:
47d1ec61 3447 chan->fcs = L2CAP_FCS_NONE;
c1360a1c 3448 set_bit(CONF_MODE_DONE, &chan->conf_state);
f2fcfcd6
GP		 3449 break;
3450
3451 case L2CAP_MODE_ERTM:
6327eb98
AE		 3452 if (!test_bit(CONF_EWS_RECV, &chan->conf_state))
3453 chan->remote_tx_win = rfc.txwin_size;
3454 else
3455 rfc.txwin_size = L2CAP_DEFAULT_TX_WINDOW;
86b1b263 3456
2c03a7a4 3457 chan->remote_max_tx = rfc.max_transmit;
1c762159 3458
c8f79162 3459 size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
2d792818
GP		 3460 chan->conn->mtu - L2CAP_EXT_HDR_SIZE -
3461 L2CAP_SDULEN_SIZE - L2CAP_FCS_SIZE);
c8f79162
AE		 3462 rfc.max_pdu_size = cpu_to_le16(size);
3463 chan->remote_mps = size;
f2fcfcd6 3464
36c86c85 3465 __l2cap_set_ertm_timeouts(chan, &rfc);
f2fcfcd6 3466
c1360a1c 3467 set_bit(CONF_MODE_DONE, &chan->conf_state);
68ae6639
GP		 3468
3469 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
2d792818 3470 sizeof(rfc), (unsigned long) &rfc);
68ae6639 3471
42dceae2
AE		 3472 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
3473 chan->remote_id = efs.id;
3474 chan->remote_stype = efs.stype;
3475 chan->remote_msdu = le16_to_cpu(efs.msdu);
3476 chan->remote_flush_to =
2d792818 3477 le32_to_cpu(efs.flush_to);
42dceae2 3478 chan->remote_acc_lat =
2d792818 3479 le32_to_cpu(efs.acc_lat);
42dceae2
AE		 3480 chan->remote_sdu_itime =
3481 le32_to_cpu(efs.sdu_itime);
3482 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
2d792818
GP		 3483 sizeof(efs),
3484 (unsigned long) &efs);
42dceae2 3485 }
f2fcfcd6
GP		 3486 break;
3487
3488 case L2CAP_MODE_STREAMING:
c8f79162 3489 size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
2d792818
GP		 3490 chan->conn->mtu - L2CAP_EXT_HDR_SIZE -
3491 L2CAP_SDULEN_SIZE - L2CAP_FCS_SIZE);
c8f79162
AE		 3492 rfc.max_pdu_size = cpu_to_le16(size);
3493 chan->remote_mps = size;
f2fcfcd6 3494
c1360a1c 3495 set_bit(CONF_MODE_DONE, &chan->conf_state);
68ae6639 3496
2d792818
GP		 3497 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3498 (unsigned long) &rfc);
68ae6639 3499
f2fcfcd6
GP		 3500 break;
3501
3502 default:
5dee9e7c 3503 result = L2CAP_CONF_UNACCEPT;
5dee9e7c 3504
6464f35f 3505 memset(&rfc, 0, sizeof(rfc));
0c1bc5c6 3506 rfc.mode = chan->mode;
f2fcfcd6 3507 }
6464f35f 3508
f2fcfcd6 3509 if (result == L2CAP_CONF_SUCCESS)
c1360a1c 3510 set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
f2fcfcd6 3511 }
fe4128e0 3512 rsp->scid = cpu_to_le16(chan->dcid);
5dee9e7c 3513 rsp->result = cpu_to_le16(result);
dcf4adbf 3514 rsp->flags = cpu_to_le16(0);
5dee9e7c
MH		 3515
3516 return ptr - data;
1da177e4
LT		 3517}
3518
2d792818
GP		 3519static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,
3520 void *data, u16 *result)
f2fcfcd6 3521{
f2fcfcd6
GP		 3522 struct l2cap_conf_req *req = data;
3523 void *ptr = req->data;
3524 int type, olen;
3525 unsigned long val;
36e999a8 3526 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
66af7aaf 3527 struct l2cap_conf_efs efs;
f2fcfcd6 3528
fe4128e0 3529 BT_DBG("chan %p, rsp %p, len %d, req %p", chan, rsp, len, data);
f2fcfcd6
GP		 3530
3531 while (len >= L2CAP_CONF_OPT_SIZE) {
3532 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
3533
3534 switch (type) {
3535 case L2CAP_CONF_MTU:
3536 if (val < L2CAP_DEFAULT_MIN_MTU) {
3537 *result = L2CAP_CONF_UNACCEPT;
0c1bc5c6 3538 chan->imtu = L2CAP_DEFAULT_MIN_MTU;
f2fcfcd6 3539 } else
0c1bc5c6
GP		 3540 chan->imtu = val;
3541 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu);
f2fcfcd6
GP		 3542 break;
3543
3544 case L2CAP_CONF_FLUSH_TO:
0c1bc5c6 3545 chan->flush_to = val;
f2fcfcd6 3546 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO,
2d792818 3547 2, chan->flush_to);
f2fcfcd6
GP		 3548 break;
3549
3550 case L2CAP_CONF_RFC:
3551 if (olen == sizeof(rfc))
3552 memcpy(&rfc, (void *)val, olen);
3553
c1360a1c 3554 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) &&
2d792818 3555 rfc.mode != chan->mode)
f2fcfcd6
GP		 3556 return -ECONNREFUSED;
3557
47d1ec61 3558 chan->fcs = 0;
f2fcfcd6
GP		 3559
3560 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
2d792818 3561 sizeof(rfc), (unsigned long) &rfc);
f2fcfcd6 3562 break;
6327eb98
AE		 3563
3564 case L2CAP_CONF_EWS:
c20f8e35 3565 chan->ack_win = min_t(u16, val, chan->ack_win);
3e6b3b95 3566 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
c20f8e35 3567 chan->tx_win);
6327eb98 3568 break;
66af7aaf
AE		 3569
3570 case L2CAP_CONF_EFS:
3571 if (olen == sizeof(efs))
3572 memcpy(&efs, (void *)val, olen);
3573
3574 if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
2d792818
GP		 3575 efs.stype != L2CAP_SERV_NOTRAFIC &&
3576 efs.stype != chan->local_stype)
66af7aaf
AE		 3577 return -ECONNREFUSED;
3578
2d792818
GP		 3579 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs),
3580 (unsigned long) &efs);
66af7aaf 3581 break;
cbabee78
AE		 3582
3583 case L2CAP_CONF_FCS:
3584 if (*result == L2CAP_CONF_PENDING)
3585 if (val == L2CAP_FCS_NONE)
f2592d3e 3586 set_bit(CONF_RECV_NO_FCS,
cbabee78
AE		 3587 &chan->conf_state);
3588 break;
f2fcfcd6
GP		 3589 }
3590 }
3591
0c1bc5c6 3592 if (chan->mode == L2CAP_MODE_BASIC && chan->mode != rfc.mode)
6c2ea7a8
GP		 3593 return -ECONNREFUSED;
3594
0c1bc5c6 3595 chan->mode = rfc.mode;
6c2ea7a8 3596
0e8b207e 3597 if (*result == L2CAP_CONF_SUCCESS || *result == L2CAP_CONF_PENDING) {
f2fcfcd6
GP		 3598 switch (rfc.mode) {
3599 case L2CAP_MODE_ERTM:
47d1ec61
GP		 3600 chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
3601 chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
3602 chan->mps = le16_to_cpu(rfc.max_pdu_size);
c20f8e35
MM		 3603 if (!test_bit(FLAG_EXT_CTRL, &chan->flags))
3604 chan->ack_win = min_t(u16, chan->ack_win,
3605 rfc.txwin_size);
66af7aaf
AE		 3606
3607 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
3608 chan->local_msdu = le16_to_cpu(efs.msdu);
3609 chan->local_sdu_itime =
2d792818 3610 le32_to_cpu(efs.sdu_itime);
66af7aaf
AE		 3611 chan->local_acc_lat = le32_to_cpu(efs.acc_lat);
3612 chan->local_flush_to =
2d792818 3613 le32_to_cpu(efs.flush_to);
66af7aaf 3614 }
f2fcfcd6 3615 break;
66af7aaf 3616
f2fcfcd6 3617 case L2CAP_MODE_STREAMING:
47d1ec61 3618 chan->mps = le16_to_cpu(rfc.max_pdu_size);
f2fcfcd6
GP		 3619 }
3620 }
3621
fe4128e0 3622 req->dcid = cpu_to_le16(chan->dcid);
dcf4adbf 3623 req->flags = cpu_to_le16(0);
f2fcfcd6
GP		 3624
3625 return ptr - data;
3626}
3627
2d792818
GP		 3628static int l2cap_build_conf_rsp(struct l2cap_chan *chan, void *data,
3629 u16 result, u16 flags)
1da177e4
LT		 3630{
3631 struct l2cap_conf_rsp *rsp = data;
3632 void *ptr = rsp->data;
1da177e4 3633
fe4128e0 3634 BT_DBG("chan %p", chan);
1da177e4 3635
fe4128e0 3636 rsp->scid = cpu_to_le16(chan->dcid);
5dee9e7c 3637 rsp->result = cpu_to_le16(result);
aca3192c 3638 rsp->flags = cpu_to_le16(flags);
1da177e4
LT		 3639
3640 return ptr - data;
3641}
3642
27e2d4c8
JH		 3643void __l2cap_le_connect_rsp_defer(struct l2cap_chan *chan)
3644{
3645 struct l2cap_le_conn_rsp rsp;
3646 struct l2cap_conn *conn = chan->conn;
3647
3648 BT_DBG("chan %p", chan);
3649
3650 rsp.dcid = cpu_to_le16(chan->scid);
3651 rsp.mtu = cpu_to_le16(chan->imtu);
3916aed8 3652 rsp.mps = cpu_to_le16(chan->mps);
0cd75f7e 3653 rsp.credits = cpu_to_le16(chan->rx_credits);
dcf4adbf 3654 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
27e2d4c8
JH		 3655
3656 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp),
3657 &rsp);
3658}
3659
8c1d787b 3660void __l2cap_connect_rsp_defer(struct l2cap_chan *chan)
710f9b0a
GP		 3661{
3662 struct l2cap_conn_rsp rsp;
8c1d787b 3663 struct l2cap_conn *conn = chan->conn;
710f9b0a 3664 u8 buf[128];
439f34ac 3665 u8 rsp_code;
710f9b0a 3666
fe4128e0
GP		 3667 rsp.scid = cpu_to_le16(chan->dcid);
3668 rsp.dcid = cpu_to_le16(chan->scid);
dcf4adbf
JP		 3669 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
3670 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
439f34ac
AE		 3671
3672 if (chan->hs_hcon)
3673 rsp_code = L2CAP_CREATE_CHAN_RSP;
3674 else
3675 rsp_code = L2CAP_CONN_RSP;
3676
3677 BT_DBG("chan %p rsp_code %u", chan, rsp_code);
3678
3679 l2cap_send_cmd(conn, chan->ident, rsp_code, sizeof(rsp), &rsp);
710f9b0a 3680
c1360a1c 3681 if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
710f9b0a
GP		 3682 return;
3683
710f9b0a 3684 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
2d792818 3685 l2cap_build_conf_req(chan, buf), buf);
710f9b0a
GP		 3686 chan->num_conf_req++;
3687}
3688
47d1ec61 3689static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len)
7b1c0049 3690{
7b1c0049
GP		 3691 int type, olen;
3692 unsigned long val;
c20f8e35
MM		 3693 /* Use sane default values in case a misbehaving remote device
3694 * did not send an RFC or extended window size option.
3695 */
3696 u16 txwin_ext = chan->ack_win;
3697 struct l2cap_conf_rfc rfc = {
3698 .mode = chan->mode,
dcf4adbf
JP		 3699 .retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO),
3700 .monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO),
c20f8e35
MM		 3701 .max_pdu_size = cpu_to_le16(chan->imtu),
3702 .txwin_size = min_t(u16, chan->ack_win, L2CAP_DEFAULT_TX_WINDOW),
3703 };
7b1c0049 3704
47d1ec61 3705 BT_DBG("chan %p, rsp %p, len %d", chan, rsp, len);
7b1c0049 3706
0c1bc5c6 3707 if ((chan->mode != L2CAP_MODE_ERTM) && (chan->mode != L2CAP_MODE_STREAMING))
7b1c0049
GP		 3708 return;
3709
3710 while (len >= L2CAP_CONF_OPT_SIZE) {
3711 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
3712
c20f8e35
MM		 3713 switch (type) {
3714 case L2CAP_CONF_RFC:
3715 if (olen == sizeof(rfc))
3716 memcpy(&rfc, (void *)val, olen);
8f321f85 3717 break;
c20f8e35
MM		 3718 case L2CAP_CONF_EWS:
3719 txwin_ext = val;
3720 break;
3721 }
7b1c0049
GP		 3722 }
3723
7b1c0049
GP		 3724 switch (rfc.mode) {
3725 case L2CAP_MODE_ERTM:
47d1ec61
GP		 3726 chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
3727 chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
c20f8e35
MM		 3728 chan->mps = le16_to_cpu(rfc.max_pdu_size);
3729 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
3730 chan->ack_win = min_t(u16, chan->ack_win, txwin_ext);
3731 else
3732 chan->ack_win = min_t(u16, chan->ack_win,
3733 rfc.txwin_size);
7b1c0049
GP		 3734 break;
3735 case L2CAP_MODE_STREAMING:
47d1ec61 3736 chan->mps = le16_to_cpu(rfc.max_pdu_size);
7b1c0049
GP		 3737 }
3738}
3739
2d792818 3740static inline int l2cap_command_rej(struct l2cap_conn *conn,
cb3b3152
JH		 3741 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
3742 u8 *data)
4e8402a3 3743{
e2fd318e 3744 struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data;
4e8402a3 3745
cb3b3152
JH		 3746 if (cmd_len < sizeof(*rej))
3747 return -EPROTO;
3748
e2fd318e 3749 if (rej->reason != L2CAP_REJ_NOT_UNDERSTOOD)
4e8402a3
MH		 3750 return 0;
3751
3752 if ((conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) &&
2d792818 3753 cmd->ident == conn->info_ident) {
17cd3f37 3754 cancel_delayed_work(&conn->info_timer);
984947dc
MH		 3755
3756 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
e1027a7c 3757 conn->info_ident = 0;
984947dc 3758
4e8402a3
MH		 3759 l2cap_conn_start(conn);
3760 }
3761
3762 return 0;
3763}
3764
1700915f
MM		 3765static struct l2cap_chan *l2cap_connect(struct l2cap_conn *conn,
3766 struct l2cap_cmd_hdr *cmd,
3767 u8 *data, u8 rsp_code, u8 amp_id)
1da177e4 3768{
1da177e4
LT		 3769 struct l2cap_conn_req *req = (struct l2cap_conn_req *) data;
3770 struct l2cap_conn_rsp rsp;
23691d75 3771 struct l2cap_chan *chan = NULL, *pchan;
e7c29cb1 3772 int result, status = L2CAP_CS_NO_INFO;
1da177e4
LT		 3773
3774 u16 dcid = 0, scid = __le16_to_cpu(req->scid);
e7c29cb1 3775 __le16 psm = req->psm;
1da177e4 3776
097db76c 3777 BT_DBG("psm 0x%2.2x scid 0x%4.4x", __le16_to_cpu(psm), scid);
1da177e4
LT		 3778
3779 /* Check if we have socket listening on psm */
6f59b904 3780 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src,
bf20fd4e 3781 &conn->hcon->dst, ACL_LINK);
23691d75 3782 if (!pchan) {
1da177e4
LT		 3783 result = L2CAP_CR_BAD_PSM;
3784 goto sendresp;
3785 }
3786
3df91ea2 3787 mutex_lock(&conn->chan_lock);
8ffb9290 3788 l2cap_chan_lock(pchan);
e0f0cb56 3789
e7c29cb1 3790 /* Check if the ACL is secure enough (if not SDP) */
dcf4adbf 3791 if (psm != cpu_to_le16(L2CAP_PSM_SDP) &&
2d792818 3792 !hci_conn_check_link_mode(conn->hcon)) {
9f5a0d7b 3793 conn->disc_reason = HCI_ERROR_AUTH_FAILURE;
e7c29cb1
MH		 3794 result = L2CAP_CR_SEC_BLOCK;
3795 goto response;
3796 }
3797
1da177e4
LT		 3798 result = L2CAP_CR_NO_MEM;
3799
2dfa1003
GP		 3800 /* Check if we already have channel with that dcid */
3801 if (__l2cap_get_chan_by_dcid(conn, scid))
3802 goto response;
3803
80b98027 3804 chan = pchan->ops->new_connection(pchan);
80808e43 3805 if (!chan)
1da177e4
LT		 3806 goto response;
3807
330b6c15
SS		 3808 /* For certain devices (ex: HID mouse), support for authentication,
3809 * pairing and bonding is optional. For such devices, inorder to avoid
3810 * the ACL alive for too long after L2CAP disconnection, reset the ACL
3811 * disc_timeout back to HCI_DISCONN_TIMEOUT during L2CAP connect.
3812 */
3813 conn->hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
3814
7eafc59e
MH		 3815 bacpy(&chan->src, &conn->hcon->src);
3816 bacpy(&chan->dst, &conn->hcon->dst);
a250e048
JH		 3817 chan->src_type = bdaddr_src_type(conn->hcon);
3818 chan->dst_type = bdaddr_dst_type(conn->hcon);
fe4128e0
GP		 3819 chan->psm = psm;
3820 chan->dcid = scid;
1700915f 3821 chan->local_amp_id = amp_id;
1da177e4 3822
6be36555 3823 __l2cap_chan_add(conn, chan);
48454079 3824
fe4128e0 3825 dcid = chan->scid;
1da177e4 3826
8d836d71 3827 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
1da177e4 3828
fc7f8a7e 3829 chan->ident = cmd->ident;
1da177e4 3830
984947dc 3831 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) {
e7cafc45 3832 if (l2cap_chan_check_security(chan, false)) {
bdc25783 3833 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
f93fa273 3834 l2cap_state_change(chan, BT_CONNECT2);
f66dc81f
MH		 3835 result = L2CAP_CR_PEND;
3836 status = L2CAP_CS_AUTHOR_PEND;
2dc4e510 3837 chan->ops->defer(chan);
f66dc81f 3838 } else {
1700915f
MM		 3839 /* Force pending result for AMP controllers.
3840 * The connection will succeed after the
3841 * physical link is up.
3842 */
6ed971ca 3843 if (amp_id == AMP_ID_BREDR) {
f93fa273 3844 l2cap_state_change(chan, BT_CONFIG);
1700915f 3845 result = L2CAP_CR_SUCCESS;
6ed971ca 3846 } else {
f93fa273 3847 l2cap_state_change(chan, BT_CONNECT2);
6ed971ca 3848 result = L2CAP_CR_PEND;
1700915f 3849 }
f66dc81f
MH		 3850 status = L2CAP_CS_NO_INFO;
3851 }
79d554a6 3852 } else {
f93fa273 3853 l2cap_state_change(chan, BT_CONNECT2);
79d554a6
MH		 3854 result = L2CAP_CR_PEND;
3855 status = L2CAP_CS_AUTHEN_PEND;
3856 }
3857 } else {
f93fa273 3858 l2cap_state_change(chan, BT_CONNECT2);
79d554a6
MH		 3859 result = L2CAP_CR_PEND;
3860 status = L2CAP_CS_NO_INFO;
1da177e4
LT		 3861 }
3862
1da177e4 3863response:
8ffb9290 3864 l2cap_chan_unlock(pchan);
3df91ea2 3865 mutex_unlock(&conn->chan_lock);
a24cce14 3866 l2cap_chan_put(pchan);
1da177e4
LT		 3867
3868sendresp:
aca3192c
YH		 3869 rsp.scid = cpu_to_le16(scid);
3870 rsp.dcid = cpu_to_le16(dcid);
3871 rsp.result = cpu_to_le16(result);
3872 rsp.status = cpu_to_le16(status);
4c89b6aa 3873 l2cap_send_cmd(conn, cmd->ident, rsp_code, sizeof(rsp), &rsp);
79d554a6
MH		 3874
3875 if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) {
3876 struct l2cap_info_req info;
dcf4adbf 3877 info.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
79d554a6
MH		 3878
3879 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
3880 conn->info_ident = l2cap_get_ident(conn);
3881
ba13ccd9 3882 schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
79d554a6 3883
2d792818
GP		 3884 l2cap_send_cmd(conn, conn->info_ident, L2CAP_INFO_REQ,
3885 sizeof(info), &info);
79d554a6
MH		 3886 }
3887
c1360a1c 3888 if (chan && !test_bit(CONF_REQ_SENT, &chan->conf_state) &&
2d792818 3889 result == L2CAP_CR_SUCCESS) {
e9aeb2dd 3890 u8 buf[128];
c1360a1c 3891 set_bit(CONF_REQ_SENT, &chan->conf_state);
e9aeb2dd 3892 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
2d792818 3893 l2cap_build_conf_req(chan, buf), buf);
73ffa904 3894 chan->num_conf_req++;
e9aeb2dd 3895 }
1700915f
MM		 3896
3897 return chan;
4c89b6aa 3898}
e9aeb2dd 3899
4c89b6aa 3900static int l2cap_connect_req(struct l2cap_conn *conn,
cb3b3152 3901 struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
4c89b6aa 3902{
7b064eda
JK		 3903 struct hci_dev *hdev = conn->hcon->hdev;
3904 struct hci_conn *hcon = conn->hcon;
3905
cb3b3152
JH		 3906 if (cmd_len < sizeof(struct l2cap_conn_req))
3907 return -EPROTO;
3908
7b064eda 3909 hci_dev_lock(hdev);
d7a5a11d 3910 if (hci_dev_test_flag(hdev, HCI_MGMT) &&
7b064eda 3911 !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &hcon->flags))
48ec92fa 3912 mgmt_device_connected(hdev, hcon, 0, NULL, 0);
7b064eda
JK		 3913 hci_dev_unlock(hdev);
3914
300229f9 3915 l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP, 0);
1da177e4
LT		 3916 return 0;
3917}
3918
5909cf30 3919static int l2cap_connect_create_rsp(struct l2cap_conn *conn,
cb3b3152
JH		 3920 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
3921 u8 *data)
1da177e4
LT		 3922{
3923 struct l2cap_conn_rsp *rsp = (struct l2cap_conn_rsp *) data;
3924 u16 scid, dcid, result, status;
48454079 3925 struct l2cap_chan *chan;
1da177e4 3926 u8 req[128];
3df91ea2 3927 int err;
1da177e4 3928
cb3b3152
JH		 3929 if (cmd_len < sizeof(*rsp))
3930 return -EPROTO;
3931
1da177e4
LT		 3932 scid = __le16_to_cpu(rsp->scid);
3933 dcid = __le16_to_cpu(rsp->dcid);
3934 result = __le16_to_cpu(rsp->result);
3935 status = __le16_to_cpu(rsp->status);
3936
1b009c98 3937 BT_DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x",
2d792818 3938 dcid, scid, result, status);
1da177e4 3939
3df91ea2
AE		 3940 mutex_lock(&conn->chan_lock);
3941
1da177e4 3942 if (scid) {
3df91ea2
AE		 3943 chan = __l2cap_get_chan_by_scid(conn, scid);
3944 if (!chan) {
21870b52 3945 err = -EBADSLT;
3df91ea2
AE		 3946 goto unlock;
3947 }
1da177e4 3948 } else {
3df91ea2
AE		 3949 chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
3950 if (!chan) {
21870b52 3951 err = -EBADSLT;
3df91ea2
AE		 3952 goto unlock;
3953 }
1da177e4
LT		 3954 }
3955
3df91ea2
AE		 3956 err = 0;
3957
6be36555 3958 l2cap_chan_lock(chan);
48454079 3959
1da177e4
LT		 3960 switch (result) {
3961 case L2CAP_CR_SUCCESS:
89bc500e 3962 l2cap_state_change(chan, BT_CONFIG);
fc7f8a7e 3963 chan->ident = 0;
fe4128e0 3964 chan->dcid = dcid;
c1360a1c 3965 clear_bit(CONF_CONNECT_PEND, &chan->conf_state);
6a8d3010 3966
c1360a1c 3967 if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
e9aeb2dd
GP		 3968 break;
3969
1da177e4 3970 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
2d792818 3971 l2cap_build_conf_req(chan, req), req);
73ffa904 3972 chan->num_conf_req++;
1da177e4
LT		 3973 break;
3974
3975 case L2CAP_CR_PEND:
c1360a1c 3976 set_bit(CONF_CONNECT_PEND, &chan->conf_state);
1da177e4
LT		 3977 break;
3978
3979 default:
48454079 3980 l2cap_chan_del(chan, ECONNREFUSED);
1da177e4
LT		 3981 break;
3982 }
3983
6be36555 3984 l2cap_chan_unlock(chan);
3df91ea2
AE		 3985
3986unlock:
3987 mutex_unlock(&conn->chan_lock);
3988
3989 return err;
1da177e4
LT		 3990}
3991
47d1ec61 3992static inline void set_default_fcs(struct l2cap_chan *chan)
8c462b60
MM		 3993{
3994 /* FCS is enabled only in ERTM or streaming mode, if one or both
3995 * sides request it.
3996 */
0c1bc5c6 3997 if (chan->mode != L2CAP_MODE_ERTM && chan->mode != L2CAP_MODE_STREAMING)
47d1ec61 3998 chan->fcs = L2CAP_FCS_NONE;
f2592d3e 3999 else if (!test_bit(CONF_RECV_NO_FCS, &chan->conf_state))
47d1ec61 4000 chan->fcs = L2CAP_FCS_CRC16;
8c462b60
MM		 4001}
4002
29d8a590
AE		 4003static void l2cap_send_efs_conf_rsp(struct l2cap_chan *chan, void *data,
4004 u8 ident, u16 flags)
4005{
4006 struct l2cap_conn *conn = chan->conn;
4007
4008 BT_DBG("conn %p chan %p ident %d flags 0x%4.4x", conn, chan, ident,
4009 flags);
4010
4011 clear_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
4012 set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
4013
4014 l2cap_send_cmd(conn, ident, L2CAP_CONF_RSP,
4015 l2cap_build_conf_rsp(chan, data,
4016 L2CAP_CONF_SUCCESS, flags), data);
4017}
4018
662d652d
JH		 4019static void cmd_reject_invalid_cid(struct l2cap_conn *conn, u8 ident,
4020 u16 scid, u16 dcid)
4021{
4022 struct l2cap_cmd_rej_cid rej;
4023
dcf4adbf 4024 rej.reason = cpu_to_le16(L2CAP_REJ_INVALID_CID);
662d652d
JH		 4025 rej.scid = __cpu_to_le16(scid);
4026 rej.dcid = __cpu_to_le16(dcid);
4027
4028 l2cap_send_cmd(conn, ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej);
4029}
4030
2d792818
GP		 4031static inline int l2cap_config_req(struct l2cap_conn *conn,
4032 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4033 u8 *data)
1da177e4
LT		 4034{
4035 struct l2cap_conf_req *req = (struct l2cap_conf_req *) data;
4036 u16 dcid, flags;
4037 u8 rsp[64];
48454079 4038 struct l2cap_chan *chan;
3c588192 4039 int len, err = 0;
1da177e4 4040
cb3b3152
JH		 4041 if (cmd_len < sizeof(*req))
4042 return -EPROTO;
4043
1da177e4
LT		 4044 dcid = __le16_to_cpu(req->dcid);
4045 flags = __le16_to_cpu(req->flags);
4046
4047 BT_DBG("dcid 0x%4.4x flags 0x%2.2x", dcid, flags);
4048
baa7e1fa 4049 chan = l2cap_get_chan_by_scid(conn, dcid);
662d652d
JH		 4050 if (!chan) {
4051 cmd_reject_invalid_cid(conn, cmd->ident, dcid, 0);
4052 return 0;
4053 }
1da177e4 4054
033b1142 4055 if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2) {
662d652d
JH		 4056 cmd_reject_invalid_cid(conn, cmd->ident, chan->scid,
4057 chan->dcid);
354f60a9 4058 goto unlock;
df6bd743 4059 }
354f60a9 4060
5dee9e7c 4061 /* Reject if config buffer is too small. */
88219a0f 4062 len = cmd_len - sizeof(*req);
cb3b3152 4063 if (chan->conf_len + len > sizeof(chan->conf_req)) {
5dee9e7c 4064 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
2d792818
GP		 4065 l2cap_build_conf_rsp(chan, rsp,
4066 L2CAP_CONF_REJECT, flags), rsp);
5dee9e7c
MH		 4067 goto unlock;
4068 }
4069
4070 /* Store config. */
73ffa904
GP		 4071 memcpy(chan->conf_req + chan->conf_len, req->data, len);
4072 chan->conf_len += len;
1da177e4 4073
59e54bd1 4074 if (flags & L2CAP_CONF_FLAG_CONTINUATION) {
1da177e4
LT		 4075 /* Incomplete config. Send empty response. */
4076 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
2d792818
GP		 4077 l2cap_build_conf_rsp(chan, rsp,
4078 L2CAP_CONF_SUCCESS, flags), rsp);
1da177e4
LT		 4079 goto unlock;
4080 }
4081
4082 /* Complete config. */
73ffa904 4083 len = l2cap_parse_conf_req(chan, rsp);
f2fcfcd6 4084 if (len < 0) {
5e4e3972 4085 l2cap_send_disconn_req(chan, ECONNRESET);
1da177e4 4086 goto unlock;
f2fcfcd6 4087 }
1da177e4 4088
1500109b 4089 chan->ident = cmd->ident;
5dee9e7c 4090 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp);
73ffa904 4091 chan->num_conf_rsp++;
5dee9e7c 4092
5dee9e7c 4093 /* Reset config buffer. */
73ffa904 4094 chan->conf_len = 0;
5dee9e7c 4095
c1360a1c 4096 if (!test_bit(CONF_OUTPUT_DONE, &chan->conf_state))
876d9484
MH		 4097 goto unlock;
4098
c1360a1c 4099 if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {
47d1ec61 4100 set_default_fcs(chan);
fcc203c3 4101
105bdf9e
MM		 4102 if (chan->mode == L2CAP_MODE_ERTM ||
4103 chan->mode == L2CAP_MODE_STREAMING)
3c588192
MM		 4104 err = l2cap_ertm_init(chan);
4105
4106 if (err < 0)
5e4e3972 4107 l2cap_send_disconn_req(chan, -err);
3c588192
MM		 4108 else
4109 l2cap_chan_ready(chan);
0565c1c2 4110
876d9484
MH		 4111 goto unlock;
4112 }
4113
c1360a1c 4114 if (!test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) {
79d554a6 4115 u8 buf[64];
1da177e4 4116 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
2d792818 4117 l2cap_build_conf_req(chan, buf), buf);
73ffa904 4118 chan->num_conf_req++;
1da177e4
LT		 4119 }
4120
49c922bb 4121 /* Got Conf Rsp PENDING from remote side and assume we sent
0e8b207e
AE		 4122 Conf Rsp PENDING in the code above */
4123 if (test_bit(CONF_REM_CONF_PEND, &chan->conf_state) &&
29d8a590 4124 test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
0e8b207e
AE		 4125
4126 /* check compatibility */
4127
79de886d 4128 /* Send rsp for BR/EDR channel */
f351bc72 4129 if (!chan->hs_hcon)
79de886d
AE		 4130 l2cap_send_efs_conf_rsp(chan, rsp, cmd->ident, flags);
4131 else
4132 chan->ident = cmd->ident;
0e8b207e
AE		 4133 }
4134
1da177e4 4135unlock:
6be36555 4136 l2cap_chan_unlock(chan);
3c588192 4137 return err;
1da177e4
LT		 4138}
4139
2d792818 4140static inline int l2cap_config_rsp(struct l2cap_conn *conn,
cb3b3152
JH		 4141 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4142 u8 *data)
1da177e4
LT		 4143{
4144 struct l2cap_conf_rsp *rsp = (struct l2cap_conf_rsp *)data;
4145 u16 scid, flags, result;
48454079 4146 struct l2cap_chan *chan;
cb3b3152 4147 int len = cmd_len - sizeof(*rsp);
3c588192 4148 int err = 0;
1da177e4 4149
cb3b3152
JH		 4150 if (cmd_len < sizeof(*rsp))
4151 return -EPROTO;
4152
1da177e4
LT		 4153 scid = __le16_to_cpu(rsp->scid);
4154 flags = __le16_to_cpu(rsp->flags);
4155 result = __le16_to_cpu(rsp->result);
4156
61386cba
AE		 4157 BT_DBG("scid 0x%4.4x flags 0x%2.2x result 0x%2.2x len %d", scid, flags,
4158 result, len);
1da177e4 4159
baa7e1fa 4160 chan = l2cap_get_chan_by_scid(conn, scid);
48454079 4161 if (!chan)
1da177e4
LT		 4162 return 0;
4163
4164 switch (result) {
4165 case L2CAP_CONF_SUCCESS:
47d1ec61 4166 l2cap_conf_rfc_get(chan, rsp->data, len);
0e8b207e 4167 clear_bit(CONF_REM_CONF_PEND, &chan->conf_state);
1da177e4
LT		 4168 break;
4169
0e8b207e
AE		 4170 case L2CAP_CONF_PENDING:
4171 set_bit(CONF_REM_CONF_PEND, &chan->conf_state);
4172
4173 if (test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
4174 char buf[64];
4175
4176 len = l2cap_parse_conf_rsp(chan, rsp->data, len,
2d792818 4177 buf, &result);
0e8b207e 4178 if (len < 0) {
5e4e3972 4179 l2cap_send_disconn_req(chan, ECONNRESET);
0e8b207e
AE		 4180 goto done;
4181 }
4182
f351bc72 4183 if (!chan->hs_hcon) {
79de886d
AE		 4184 l2cap_send_efs_conf_rsp(chan, buf, cmd->ident,
4185 0);
5ce66b59
AE		 4186 } else {
4187 if (l2cap_check_efs(chan)) {
4188 amp_create_logical_link(chan);
4189 chan->ident = cmd->ident;
4190 }
4191 }
0e8b207e
AE		 4192 }
4193 goto done;
4194
1da177e4 4195 case L2CAP_CONF_UNACCEPT:
73ffa904 4196 if (chan->num_conf_rsp <= L2CAP_CONF_MAX_CONF_RSP) {
f2fcfcd6
GP		 4197 char req[64];
4198
c2c77ec8 4199 if (len > sizeof(req) - sizeof(struct l2cap_conf_req)) {
5e4e3972 4200 l2cap_send_disconn_req(chan, ECONNRESET);
c2c77ec8
AE		 4201 goto done;
4202 }
4203
f2fcfcd6
GP		 4204 /* throw out any old stored conf requests */
4205 result = L2CAP_CONF_SUCCESS;
b4450035 4206 len = l2cap_parse_conf_rsp(chan, rsp->data, len,
2d792818 4207 req, &result);
f2fcfcd6 4208 if (len < 0) {
5e4e3972 4209 l2cap_send_disconn_req(chan, ECONNRESET);
f2fcfcd6
GP		 4210 goto done;
4211 }
4212
4213 l2cap_send_cmd(conn, l2cap_get_ident(conn),
2d792818 4214 L2CAP_CONF_REQ, len, req);
73ffa904 4215 chan->num_conf_req++;
f2fcfcd6
GP		 4216 if (result != L2CAP_CONF_SUCCESS)
4217 goto done;
4218 break;
1da177e4
LT		 4219 }
4220
8e87d142 4221 default:
6be36555 4222 l2cap_chan_set_err(chan, ECONNRESET);
2e0052e4 4223
ba13ccd9 4224 __set_chan_timer(chan, L2CAP_DISC_REJ_TIMEOUT);
5e4e3972 4225 l2cap_send_disconn_req(chan, ECONNRESET);
1da177e4
LT		 4226 goto done;
4227 }
4228
59e54bd1 4229 if (flags & L2CAP_CONF_FLAG_CONTINUATION)
1da177e4
LT		 4230 goto done;
4231
c1360a1c 4232 set_bit(CONF_INPUT_DONE, &chan->conf_state);
1da177e4 4233
c1360a1c 4234 if (test_bit(CONF_OUTPUT_DONE, &chan->conf_state)) {
47d1ec61 4235 set_default_fcs(chan);
fcc203c3 4236
105bdf9e
MM		 4237 if (chan->mode == L2CAP_MODE_ERTM ||
4238 chan->mode == L2CAP_MODE_STREAMING)
3c588192 4239 err = l2cap_ertm_init(chan);
0565c1c2 4240
3c588192 4241 if (err < 0)
5e4e3972 4242 l2cap_send_disconn_req(chan, -err);
3c588192
MM		 4243 else
4244 l2cap_chan_ready(chan);
1da177e4
LT		 4245 }
4246
4247done:
6be36555 4248 l2cap_chan_unlock(chan);
3c588192 4249 return err;
1da177e4
LT		 4250}
4251
2d792818 4252static inline int l2cap_disconnect_req(struct l2cap_conn *conn,
cb3b3152
JH		 4253 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4254 u8 *data)
1da177e4
LT		 4255{
4256 struct l2cap_disconn_req *req = (struct l2cap_disconn_req *) data;
4257 struct l2cap_disconn_rsp rsp;
4258 u16 dcid, scid;
48454079 4259 struct l2cap_chan *chan;
1da177e4 4260
cb3b3152
JH		 4261 if (cmd_len != sizeof(*req))
4262 return -EPROTO;
4263
1da177e4
LT		 4264 scid = __le16_to_cpu(req->scid);
4265 dcid = __le16_to_cpu(req->dcid);
4266
4267 BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid);
4268
3df91ea2
AE		 4269 mutex_lock(&conn->chan_lock);
4270
4271 chan = __l2cap_get_chan_by_scid(conn, dcid);
4272 if (!chan) {
4273 mutex_unlock(&conn->chan_lock);
662d652d
JH		 4274 cmd_reject_invalid_cid(conn, cmd->ident, dcid, scid);
4275 return 0;
3df91ea2 4276 }
1da177e4 4277
6be36555
AE		 4278 l2cap_chan_lock(chan);
4279
fe4128e0
GP		 4280 rsp.dcid = cpu_to_le16(chan->scid);
4281 rsp.scid = cpu_to_le16(chan->dcid);
1da177e4
LT		 4282 l2cap_send_cmd(conn, cmd->ident, L2CAP_DISCONN_RSP, sizeof(rsp), &rsp);
4283
5ec1bbe5 4284 chan->ops->set_shutdown(chan);
1da177e4 4285
61d6ef3e 4286 l2cap_chan_hold(chan);
48454079 4287 l2cap_chan_del(chan, ECONNRESET);
6be36555
AE		 4288
4289 l2cap_chan_unlock(chan);
1da177e4 4290
80b98027 4291 chan->ops->close(chan);
61d6ef3e 4292 l2cap_chan_put(chan);
3df91ea2
AE		 4293
4294 mutex_unlock(&conn->chan_lock);
4295
1da177e4
LT		 4296 return 0;
4297}
4298
2d792818 4299static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn,
cb3b3152
JH		 4300 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4301 u8 *data)
1da177e4
LT		 4302{
4303 struct l2cap_disconn_rsp *rsp = (struct l2cap_disconn_rsp *) data;
4304 u16 dcid, scid;
48454079 4305 struct l2cap_chan *chan;
1da177e4 4306
cb3b3152
JH		 4307 if (cmd_len != sizeof(*rsp))
4308 return -EPROTO;
4309
1da177e4
LT		 4310 scid = __le16_to_cpu(rsp->scid);
4311 dcid = __le16_to_cpu(rsp->dcid);
4312
4313 BT_DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid);
4314
3df91ea2
AE		 4315 mutex_lock(&conn->chan_lock);
4316
4317 chan = __l2cap_get_chan_by_scid(conn, scid);
4318 if (!chan) {
4319 mutex_unlock(&conn->chan_lock);
1da177e4 4320 return 0;
3df91ea2 4321 }
1da177e4 4322
6be36555 4323 l2cap_chan_lock(chan);
48454079 4324
61d6ef3e 4325 l2cap_chan_hold(chan);
48454079 4326 l2cap_chan_del(chan, 0);
6be36555
AE		 4327
4328 l2cap_chan_unlock(chan);
1da177e4 4329
80b98027 4330 chan->ops->close(chan);
61d6ef3e 4331 l2cap_chan_put(chan);
3df91ea2
AE		 4332
4333 mutex_unlock(&conn->chan_lock);
4334
1da177e4
LT		 4335 return 0;
4336}
4337
2d792818 4338static inline int l2cap_information_req(struct l2cap_conn *conn,
cb3b3152
JH		 4339 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4340 u8 *data)
1da177e4
LT		 4341{
4342 struct l2cap_info_req *req = (struct l2cap_info_req *) data;
1da177e4
LT		 4343 u16 type;
4344
cb3b3152
JH		 4345 if (cmd_len != sizeof(*req))
4346 return -EPROTO;
4347
1da177e4
LT		 4348 type = __le16_to_cpu(req->type);
4349
4350 BT_DBG("type 0x%4.4x", type);
4351
f0709e03
MH		 4352 if (type == L2CAP_IT_FEAT_MASK) {
4353 u8 buf[8];
44dd46de 4354 u32 feat_mask = l2cap_feat_mask;
f0709e03 4355 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
dcf4adbf
JP		 4356 rsp->type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
4357 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
d1c4a17d 4358 if (!disable_ertm)
fcc203c3 4359 feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING
2d792818 4360 | L2CAP_FEAT_FCS;
0bd49fc7 4361 if (conn->local_fixed_chan & L2CAP_FC_A2MP)
6327eb98 4362 feat_mask |= L2CAP_FEAT_EXT_FLOW
2d792818 4363 | L2CAP_FEAT_EXT_WINDOW;
a5fd6f30 4364
1b7bf4ed 4365 put_unaligned_le32(feat_mask, rsp->data);
2d792818
GP		 4366 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(buf),
4367 buf);
e1027a7c
MH		 4368 } else if (type == L2CAP_IT_FIXED_CHAN) {
4369 u8 buf[12];
4370 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
50a147cd 4371
dcf4adbf
JP		 4372 rsp->type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
4373 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
0bd49fc7
JH		 4374 rsp->data[0] = conn->local_fixed_chan;
4375 memset(rsp->data + 1, 0, 7);
2d792818
GP		 4376 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(buf),
4377 buf);
f0709e03
MH		 4378 } else {
4379 struct l2cap_info_rsp rsp;
4380 rsp.type = cpu_to_le16(type);
dcf4adbf 4381 rsp.result = cpu_to_le16(L2CAP_IR_NOTSUPP);
2d792818
GP		 4382 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(rsp),
4383 &rsp);
f0709e03 4384 }
1da177e4
LT		 4385
4386 return 0;
4387}
4388
2d792818 4389static inline int l2cap_information_rsp(struct l2cap_conn *conn,
cb3b3152
JH		 4390 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4391 u8 *data)
1da177e4
LT		 4392{
4393 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data;
4394 u16 type, result;
4395
3f6fa3d4 4396 if (cmd_len < sizeof(*rsp))
cb3b3152
JH		 4397 return -EPROTO;
4398
1da177e4
LT		 4399 type = __le16_to_cpu(rsp->type);
4400 result = __le16_to_cpu(rsp->result);
4401
4402 BT_DBG("type 0x%4.4x result 0x%2.2x", type, result);
4403
e90165be
AE		 4404 /* L2CAP Info req/rsp are unbound to channels, add extra checks */
4405 if (cmd->ident != conn->info_ident ||
2d792818 4406 conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)
e90165be
AE		 4407 return 0;
4408
17cd3f37 4409 cancel_delayed_work(&conn->info_timer);
4e8402a3 4410
adb08ede
VT		 4411 if (result != L2CAP_IR_SUCCESS) {
4412 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
4413 conn->info_ident = 0;
4414
4415 l2cap_conn_start(conn);
4416
4417 return 0;
4418 }
4419
978c93b9
AE		 4420 switch (type) {
4421 case L2CAP_IT_FEAT_MASK:
83985319 4422 conn->feat_mask = get_unaligned_le32(rsp->data);
4e8402a3 4423
47ec1dcd 4424 if (conn->feat_mask & L2CAP_FEAT_FIXED_CHAN) {
e1027a7c 4425 struct l2cap_info_req req;
dcf4adbf 4426 req.type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
e1027a7c
MH		 4427
4428 conn->info_ident = l2cap_get_ident(conn);
4429
4430 l2cap_send_cmd(conn, conn->info_ident,
2d792818 4431 L2CAP_INFO_REQ, sizeof(req), &req);
e1027a7c
MH		 4432 } else {
4433 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
4434 conn->info_ident = 0;
4435
4436 l2cap_conn_start(conn);
4437 }
978c93b9
AE		 4438 break;
4439
4440 case L2CAP_IT_FIXED_CHAN:
0bd49fc7 4441 conn->remote_fixed_chan = rsp->data[0];
984947dc 4442 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
e1027a7c 4443 conn->info_ident = 0;
984947dc
MH		 4444
4445 l2cap_conn_start(conn);
978c93b9 4446 break;
984947dc 4447 }
4e8402a3 4448
1da177e4
LT		 4449 return 0;
4450}
4451
1700915f
MM		 4452static int l2cap_create_channel_req(struct l2cap_conn *conn,
4453 struct l2cap_cmd_hdr *cmd,
4454 u16 cmd_len, void *data)
f94ff6ff
MM		 4455{
4456 struct l2cap_create_chan_req *req = data;
6e1df6a6 4457 struct l2cap_create_chan_rsp rsp;
1700915f 4458 struct l2cap_chan *chan;
6e1df6a6 4459 struct hci_dev *hdev;
f94ff6ff
MM		 4460 u16 psm, scid;
4461
4462 if (cmd_len != sizeof(*req))
4463 return -EPROTO;
4464
0bd49fc7 4465 if (!(conn->local_fixed_chan & L2CAP_FC_A2MP))
f94ff6ff
MM		 4466 return -EINVAL;
4467
4468 psm = le16_to_cpu(req->psm);
4469 scid = le16_to_cpu(req->scid);
4470
ad0ac6ca 4471 BT_DBG("psm 0x%2.2x, scid 0x%4.4x, amp_id %d", psm, scid, req->amp_id);
f94ff6ff 4472
6e1df6a6 4473 /* For controller id 0 make BR/EDR connection */
6ed971ca 4474 if (req->amp_id == AMP_ID_BREDR) {
6e1df6a6
AE		 4475 l2cap_connect(conn, cmd, data, L2CAP_CREATE_CHAN_RSP,
4476 req->amp_id);
4477 return 0;
4478 }
1700915f 4479
6e1df6a6
AE		 4480 /* Validate AMP controller id */
4481 hdev = hci_dev_get(req->amp_id);
4482 if (!hdev)
4483 goto error;
1700915f 4484
6e1df6a6
AE		 4485 if (hdev->dev_type != HCI_AMP || !test_bit(HCI_UP, &hdev->flags)) {
4486 hci_dev_put(hdev);
4487 goto error;
4488 }
1700915f 4489
6e1df6a6
AE		 4490 chan = l2cap_connect(conn, cmd, data, L2CAP_CREATE_CHAN_RSP,
4491 req->amp_id);
4492 if (chan) {
4493 struct amp_mgr *mgr = conn->hcon->amp_mgr;
4494 struct hci_conn *hs_hcon;
1700915f 4495
98e0f7ea
MH		 4496 hs_hcon = hci_conn_hash_lookup_ba(hdev, AMP_LINK,
4497 &conn->hcon->dst);
6e1df6a6
AE		 4498 if (!hs_hcon) {
4499 hci_dev_put(hdev);
662d652d
JH		 4500 cmd_reject_invalid_cid(conn, cmd->ident, chan->scid,
4501 chan->dcid);
4502 return 0;
1700915f
MM		 4503 }
4504
6e1df6a6
AE		 4505 BT_DBG("mgr %p bredr_chan %p hs_hcon %p", mgr, chan, hs_hcon);
4506
6e1df6a6
AE		 4507 mgr->bredr_chan = chan;
4508 chan->hs_hcon = hs_hcon;
fd45bf4c 4509 chan->fcs = L2CAP_FCS_NONE;
6e1df6a6 4510 conn->mtu = hdev->block_mtu;
1700915f 4511 }
f94ff6ff 4512
6e1df6a6 4513 hci_dev_put(hdev);
f94ff6ff
MM		 4514
4515 return 0;
6e1df6a6
AE		 4516
4517error:
4518 rsp.dcid = 0;
4519 rsp.scid = cpu_to_le16(scid);
dcf4adbf
JP		 4520 rsp.result = cpu_to_le16(L2CAP_CR_BAD_AMP);
4521 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
6e1df6a6
AE		 4522
4523 l2cap_send_cmd(conn, cmd->ident, L2CAP_CREATE_CHAN_RSP,
4524 sizeof(rsp), &rsp);
4525
dc280801 4526 return 0;
f94ff6ff
MM		 4527}
4528
8eb200bd
MM		 4529static void l2cap_send_move_chan_req(struct l2cap_chan *chan, u8 dest_amp_id)
4530{
4531 struct l2cap_move_chan_req req;
4532 u8 ident;
4533
4534 BT_DBG("chan %p, dest_amp_id %d", chan, dest_amp_id);
4535
4536 ident = l2cap_get_ident(chan->conn);
4537 chan->ident = ident;
4538
4539 req.icid = cpu_to_le16(chan->scid);
4540 req.dest_amp_id = dest_amp_id;
4541
4542 l2cap_send_cmd(chan->conn, ident, L2CAP_MOVE_CHAN_REQ, sizeof(req),
4543 &req);
4544
4545 __set_chan_timer(chan, L2CAP_MOVE_TIMEOUT);
4546}
4547
1500109b 4548static void l2cap_send_move_chan_rsp(struct l2cap_chan *chan, u16 result)
8d5a04a1
MM		 4549{
4550 struct l2cap_move_chan_rsp rsp;
4551
1500109b 4552 BT_DBG("chan %p, result 0x%4.4x", chan, result);
8d5a04a1 4553
1500109b 4554 rsp.icid = cpu_to_le16(chan->dcid);
8d5a04a1
MM		 4555 rsp.result = cpu_to_le16(result);
4556
1500109b
MM		 4557 l2cap_send_cmd(chan->conn, chan->ident, L2CAP_MOVE_CHAN_RSP,
4558 sizeof(rsp), &rsp);
8d5a04a1
MM		 4559}
4560
5b155ef9 4561static void l2cap_send_move_chan_cfm(struct l2cap_chan *chan, u16 result)
8d5a04a1
MM		 4562{
4563 struct l2cap_move_chan_cfm cfm;
8d5a04a1 4564
5b155ef9 4565 BT_DBG("chan %p, result 0x%4.4x", chan, result);
8d5a04a1 4566
5b155ef9 4567 chan->ident = l2cap_get_ident(chan->conn);
8d5a04a1 4568
5b155ef9 4569 cfm.icid = cpu_to_le16(chan->scid);
8d5a04a1
MM		 4570 cfm.result = cpu_to_le16(result);
4571
5b155ef9
MM		 4572 l2cap_send_cmd(chan->conn, chan->ident, L2CAP_MOVE_CHAN_CFM,
4573 sizeof(cfm), &cfm);
4574
4575 __set_chan_timer(chan, L2CAP_MOVE_TIMEOUT);
4576}
4577
4578static void l2cap_send_move_chan_cfm_icid(struct l2cap_conn *conn, u16 icid)
4579{
4580 struct l2cap_move_chan_cfm cfm;
4581
4582 BT_DBG("conn %p, icid 0x%4.4x", conn, icid);
4583
4584 cfm.icid = cpu_to_le16(icid);
dcf4adbf 4585 cfm.result = cpu_to_le16(L2CAP_MC_UNCONFIRMED);
5b155ef9
MM		 4586
4587 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_MOVE_CHAN_CFM,
4588 sizeof(cfm), &cfm);
8d5a04a1
MM		 4589}
4590
4591static void l2cap_send_move_chan_cfm_rsp(struct l2cap_conn *conn, u8 ident,
ad0ac6ca 4592 u16 icid)
8d5a04a1
MM		 4593{
4594 struct l2cap_move_chan_cfm_rsp rsp;
4595
ad0ac6ca 4596 BT_DBG("icid 0x%4.4x", icid);
8d5a04a1
MM		 4597
4598 rsp.icid = cpu_to_le16(icid);
4599 l2cap_send_cmd(conn, ident, L2CAP_MOVE_CHAN_CFM_RSP, sizeof(rsp), &rsp);
4600}
4601
5f3847a4
MM		 4602static void __release_logical_link(struct l2cap_chan *chan)
4603{
4604 chan->hs_hchan = NULL;
4605 chan->hs_hcon = NULL;
4606
4607 /* Placeholder - release the logical link */
4608}
4609
1500109b
MM		 4610static void l2cap_logical_fail(struct l2cap_chan *chan)
4611{
4612 /* Logical link setup failed */
4613 if (chan->state != BT_CONNECTED) {
4614 /* Create channel failure, disconnect */
5e4e3972 4615 l2cap_send_disconn_req(chan, ECONNRESET);
1500109b
MM		 4616 return;
4617 }
4618
4619 switch (chan->move_role) {
4620 case L2CAP_MOVE_ROLE_RESPONDER:
4621 l2cap_move_done(chan);
4622 l2cap_send_move_chan_rsp(chan, L2CAP_MR_NOT_SUPP);
4623 break;
4624 case L2CAP_MOVE_ROLE_INITIATOR:
4625 if (chan->move_state == L2CAP_MOVE_WAIT_LOGICAL_COMP ||
4626 chan->move_state == L2CAP_MOVE_WAIT_LOGICAL_CFM) {
4627 /* Remote has only sent pending or
4628 * success responses, clean up
4629 */
4630 l2cap_move_done(chan);
4631 }
4632
4633 /* Other amp move states imply that the move
4634 * has already aborted
4635 */
4636 l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);
4637 break;
4638 }
4639}
4640
4641static void l2cap_logical_finish_create(struct l2cap_chan *chan,
4642 struct hci_chan *hchan)
4643{
4644 struct l2cap_conf_rsp rsp;
1500109b 4645
336178a3 4646 chan->hs_hchan = hchan;
1500109b
MM		 4647 chan->hs_hcon->l2cap_data = chan->conn;
4648
35ba9561 4649 l2cap_send_efs_conf_rsp(chan, &rsp, chan->ident, 0);
1500109b
MM		 4650
4651 if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {
fe79c6fe 4652 int err;
1500109b
MM		 4653
4654 set_default_fcs(chan);
4655
4656 err = l2cap_ertm_init(chan);
4657 if (err < 0)
5e4e3972 4658 l2cap_send_disconn_req(chan, -err);
1500109b
MM		 4659 else
4660 l2cap_chan_ready(chan);
4661 }
4662}
4663
4664static void l2cap_logical_finish_move(struct l2cap_chan *chan,
4665 struct hci_chan *hchan)
4666{
4667 chan->hs_hcon = hchan->conn;
4668 chan->hs_hcon->l2cap_data = chan->conn;
4669
4670 BT_DBG("move_state %d", chan->move_state);
4671
4672 switch (chan->move_state) {
4673 case L2CAP_MOVE_WAIT_LOGICAL_COMP:
4674 /* Move confirm will be sent after a success
4675 * response is received
4676 */
4677 chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;
4678 break;
4679 case L2CAP_MOVE_WAIT_LOGICAL_CFM:
4680 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
4681 chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;
4682 } else if (chan->move_role == L2CAP_MOVE_ROLE_INITIATOR) {
4683 chan->move_state = L2CAP_MOVE_WAIT_CONFIRM_RSP;
4684 l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);
4685 } else if (chan->move_role == L2CAP_MOVE_ROLE_RESPONDER) {
4686 chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;
4687 l2cap_send_move_chan_rsp(chan, L2CAP_MR_SUCCESS);
4688 }
4689 break;
4690 default:
4691 /* Move was not in expected state, free the channel */
4692 __release_logical_link(chan);
4693
4694 chan->move_state = L2CAP_MOVE_STABLE;
4695 }
4696}
4697
4698/* Call with chan locked */
27695fb4
AE		 4699void l2cap_logical_cfm(struct l2cap_chan *chan, struct hci_chan *hchan,
4700 u8 status)
5b155ef9 4701{
1500109b
MM		 4702 BT_DBG("chan %p, hchan %p, status %d", chan, hchan, status);
4703
4704 if (status) {
4705 l2cap_logical_fail(chan);
4706 __release_logical_link(chan);
4707 return;
4708 }
4709
4710 if (chan->state != BT_CONNECTED) {
4711 /* Ignore logical link if channel is on BR/EDR */
6ed971ca 4712 if (chan->local_amp_id != AMP_ID_BREDR)
1500109b
MM		 4713 l2cap_logical_finish_create(chan, hchan);
4714 } else {
4715 l2cap_logical_finish_move(chan, hchan);
4716 }
5b155ef9
MM		 4717}
4718
3f7a56c4
MM		 4719void l2cap_move_start(struct l2cap_chan *chan)
4720{
4721 BT_DBG("chan %p", chan);
4722
6ed971ca 4723 if (chan->local_amp_id == AMP_ID_BREDR) {
3f7a56c4
MM		 4724 if (chan->chan_policy != BT_CHANNEL_POLICY_AMP_PREFERRED)
4725 return;
4726 chan->move_role = L2CAP_MOVE_ROLE_INITIATOR;
4727 chan->move_state = L2CAP_MOVE_WAIT_PREPARE;
4728 /* Placeholder - start physical link setup */
4729 } else {
4730 chan->move_role = L2CAP_MOVE_ROLE_INITIATOR;
4731 chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;
4732 chan->move_id = 0;
4733 l2cap_move_setup(chan);
4734 l2cap_send_move_chan_req(chan, 0);
4735 }
4736}
4737
8eb200bd
MM		 4738static void l2cap_do_create(struct l2cap_chan *chan, int result,
4739 u8 local_amp_id, u8 remote_amp_id)
4740{
62748ca1
AE		 4741 BT_DBG("chan %p state %s %u -> %u", chan, state_to_string(chan->state),
4742 local_amp_id, remote_amp_id);
4743
12d6cc60
AE		 4744 chan->fcs = L2CAP_FCS_NONE;
4745
62748ca1
AE		 4746 /* Outgoing channel on AMP */
4747 if (chan->state == BT_CONNECT) {
4748 if (result == L2CAP_CR_SUCCESS) {
4749 chan->local_amp_id = local_amp_id;
4750 l2cap_send_create_chan_req(chan, remote_amp_id);
4751 } else {
4752 /* Revert to BR/EDR connect */
4753 l2cap_send_conn_req(chan);
4754 }
4755
4756 return;
4757 }
4758
4759 /* Incoming channel on AMP */
4760 if (__l2cap_no_conn_pending(chan)) {
8eb200bd
MM		 4761 struct l2cap_conn_rsp rsp;
4762 char buf[128];
4763 rsp.scid = cpu_to_le16(chan->dcid);
4764 rsp.dcid = cpu_to_le16(chan->scid);
4765
8eb200bd
MM		 4766 if (result == L2CAP_CR_SUCCESS) {
4767 /* Send successful response */
dcf4adbf
JP		 4768 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
4769 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
8eb200bd
MM		 4770 } else {
4771 /* Send negative response */
dcf4adbf
JP		 4772 rsp.result = cpu_to_le16(L2CAP_CR_NO_MEM);
4773 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
8eb200bd
MM		 4774 }
4775
4776 l2cap_send_cmd(chan->conn, chan->ident, L2CAP_CREATE_CHAN_RSP,
4777 sizeof(rsp), &rsp);
4778
4779 if (result == L2CAP_CR_SUCCESS) {
f93fa273 4780 l2cap_state_change(chan, BT_CONFIG);
8eb200bd
MM		 4781 set_bit(CONF_REQ_SENT, &chan->conf_state);
4782 l2cap_send_cmd(chan->conn, l2cap_get_ident(chan->conn),
4783 L2CAP_CONF_REQ,
4784 l2cap_build_conf_req(chan, buf), buf);
4785 chan->num_conf_req++;
4786 }
8eb200bd
MM		 4787 }
4788}
4789
4790static void l2cap_do_move_initiate(struct l2cap_chan *chan, u8 local_amp_id,
4791 u8 remote_amp_id)
4792{
4793 l2cap_move_setup(chan);
4794 chan->move_id = local_amp_id;
4795 chan->move_state = L2CAP_MOVE_WAIT_RSP;
4796
4797 l2cap_send_move_chan_req(chan, remote_amp_id);
4798}
4799
4800static void l2cap_do_move_respond(struct l2cap_chan *chan, int result)
4801{
4802 struct hci_chan *hchan = NULL;
4803
4804 /* Placeholder - get hci_chan for logical link */
4805
4806 if (hchan) {
4807 if (hchan->state == BT_CONNECTED) {
4808 /* Logical link is ready to go */
4809 chan->hs_hcon = hchan->conn;
4810 chan->hs_hcon->l2cap_data = chan->conn;
4811 chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;
4812 l2cap_send_move_chan_rsp(chan, L2CAP_MR_SUCCESS);
4813
4814 l2cap_logical_cfm(chan, hchan, L2CAP_MR_SUCCESS);
4815 } else {
4816 /* Wait for logical link to be ready */
4817 chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;
4818 }
4819 } else {
4820 /* Logical link not available */
4821 l2cap_send_move_chan_rsp(chan, L2CAP_MR_NOT_ALLOWED);
4822 }
4823}
4824
4825static void l2cap_do_move_cancel(struct l2cap_chan *chan, int result)
4826{
4827 if (chan->move_role == L2CAP_MOVE_ROLE_RESPONDER) {
4828 u8 rsp_result;
4829 if (result == -EINVAL)
4830 rsp_result = L2CAP_MR_BAD_ID;
4831 else
4832 rsp_result = L2CAP_MR_NOT_ALLOWED;
4833
4834 l2cap_send_move_chan_rsp(chan, rsp_result);
4835 }
4836
4837 chan->move_role = L2CAP_MOVE_ROLE_NONE;
4838 chan->move_state = L2CAP_MOVE_STABLE;
4839
4840 /* Restart data transmission */
4841 l2cap_ertm_send(chan);
4842}
4843
a514b17f
AE		 4844/* Invoke with locked chan */
4845void __l2cap_physical_cfm(struct l2cap_chan *chan, int result)
8eb200bd 4846{
770bfefa 4847 u8 local_amp_id = chan->local_amp_id;
fffadc08 4848 u8 remote_amp_id = chan->remote_amp_id;
770bfefa 4849
8eb200bd
MM		 4850 BT_DBG("chan %p, result %d, local_amp_id %d, remote_amp_id %d",
4851 chan, result, local_amp_id, remote_amp_id);
4852
8eb200bd
MM		 4853 if (chan->state == BT_DISCONN || chan->state == BT_CLOSED) {
4854 l2cap_chan_unlock(chan);
4855 return;
4856 }
4857
4858 if (chan->state != BT_CONNECTED) {
4859 l2cap_do_create(chan, result, local_amp_id, remote_amp_id);
4860 } else if (result != L2CAP_MR_SUCCESS) {
4861 l2cap_do_move_cancel(chan, result);
4862 } else {
4863 switch (chan->move_role) {
4864 case L2CAP_MOVE_ROLE_INITIATOR:
4865 l2cap_do_move_initiate(chan, local_amp_id,
4866 remote_amp_id);
4867 break;
4868 case L2CAP_MOVE_ROLE_RESPONDER:
4869 l2cap_do_move_respond(chan, result);
4870 break;
4871 default:
4872 l2cap_do_move_cancel(chan, result);
4873 break;
4874 }
4875 }
8eb200bd
MM		 4876}
4877
8d5a04a1 4878static inline int l2cap_move_channel_req(struct l2cap_conn *conn,
ad0ac6ca
AE		 4879 struct l2cap_cmd_hdr *cmd,
4880 u16 cmd_len, void *data)
8d5a04a1
MM		 4881{
4882 struct l2cap_move_chan_req *req = data;
1500109b 4883 struct l2cap_move_chan_rsp rsp;
02b0fbb9 4884 struct l2cap_chan *chan;
8d5a04a1
MM		 4885 u16 icid = 0;
4886 u16 result = L2CAP_MR_NOT_ALLOWED;
4887
4888 if (cmd_len != sizeof(*req))
4889 return -EPROTO;
4890
4891 icid = le16_to_cpu(req->icid);
4892
ad0ac6ca 4893 BT_DBG("icid 0x%4.4x, dest_amp_id %d", icid, req->dest_amp_id);
8d5a04a1 4894
0bd49fc7 4895 if (!(conn->local_fixed_chan & L2CAP_FC_A2MP))
8d5a04a1
MM		 4896 return -EINVAL;
4897
02b0fbb9
MM		 4898 chan = l2cap_get_chan_by_dcid(conn, icid);
4899 if (!chan) {
1500109b 4900 rsp.icid = cpu_to_le16(icid);
dcf4adbf 4901 rsp.result = cpu_to_le16(L2CAP_MR_NOT_ALLOWED);
1500109b
MM		 4902 l2cap_send_cmd(conn, cmd->ident, L2CAP_MOVE_CHAN_RSP,
4903 sizeof(rsp), &rsp);
02b0fbb9
MM		 4904 return 0;
4905 }
4906
1500109b
MM		 4907 chan->ident = cmd->ident;
4908
02b0fbb9
MM		 4909 if (chan->scid < L2CAP_CID_DYN_START ||
4910 chan->chan_policy == BT_CHANNEL_POLICY_BREDR_ONLY ||
4911 (chan->mode != L2CAP_MODE_ERTM &&
4912 chan->mode != L2CAP_MODE_STREAMING)) {
4913 result = L2CAP_MR_NOT_ALLOWED;
4914 goto send_move_response;
4915 }
4916
4917 if (chan->local_amp_id == req->dest_amp_id) {
4918 result = L2CAP_MR_SAME_ID;
4919 goto send_move_response;
4920 }
4921
6ed971ca 4922 if (req->dest_amp_id != AMP_ID_BREDR) {
02b0fbb9
MM		 4923 struct hci_dev *hdev;
4924 hdev = hci_dev_get(req->dest_amp_id);
4925 if (!hdev || hdev->dev_type != HCI_AMP ||
4926 !test_bit(HCI_UP, &hdev->flags)) {
4927 if (hdev)
4928 hci_dev_put(hdev);
4929
4930 result = L2CAP_MR_BAD_ID;
4931 goto send_move_response;
4932 }
4933 hci_dev_put(hdev);
4934 }
4935
4936 /* Detect a move collision. Only send a collision response
4937 * if this side has "lost", otherwise proceed with the move.
4938 * The winner has the larger bd_addr.
4939 */
4940 if ((__chan_is_moving(chan) ||
4941 chan->move_role != L2CAP_MOVE_ROLE_NONE) &&
6f59b904 4942 bacmp(&conn->hcon->src, &conn->hcon->dst) > 0) {
02b0fbb9
MM		 4943 result = L2CAP_MR_COLLISION;
4944 goto send_move_response;
4945 }
4946
02b0fbb9
MM		 4947 chan->move_role = L2CAP_MOVE_ROLE_RESPONDER;
4948 l2cap_move_setup(chan);
4949 chan->move_id = req->dest_amp_id;
4950 icid = chan->dcid;
4951
6ed971ca 4952 if (req->dest_amp_id == AMP_ID_BREDR) {
02b0fbb9
MM		 4953 /* Moving to BR/EDR */
4954 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
4955 chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;
4956 result = L2CAP_MR_PEND;
4957 } else {
4958 chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;
4959 result = L2CAP_MR_SUCCESS;
4960 }
4961 } else {
4962 chan->move_state = L2CAP_MOVE_WAIT_PREPARE;
4963 /* Placeholder - uncomment when amp functions are available */
4964 /*amp_accept_physical(chan, req->dest_amp_id);*/
4965 result = L2CAP_MR_PEND;
4966 }
4967
4968send_move_response:
1500109b 4969 l2cap_send_move_chan_rsp(chan, result);
8d5a04a1 4970
02b0fbb9
MM		 4971 l2cap_chan_unlock(chan);
4972
8d5a04a1
MM		 4973 return 0;
4974}
4975
5b155ef9
MM		 4976static void l2cap_move_continue(struct l2cap_conn *conn, u16 icid, u16 result)
4977{
4978 struct l2cap_chan *chan;
4979 struct hci_chan *hchan = NULL;
4980
4981 chan = l2cap_get_chan_by_scid(conn, icid);
4982 if (!chan) {
4983 l2cap_send_move_chan_cfm_icid(conn, icid);
4984 return;
4985 }
4986
4987 __clear_chan_timer(chan);
4988 if (result == L2CAP_MR_PEND)
4989 __set_chan_timer(chan, L2CAP_MOVE_ERTX_TIMEOUT);
4990
4991 switch (chan->move_state) {
4992 case L2CAP_MOVE_WAIT_LOGICAL_COMP:
4993 /* Move confirm will be sent when logical link
4994 * is complete.
4995 */
4996 chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;
4997 break;
4998 case L2CAP_MOVE_WAIT_RSP_SUCCESS:
4999 if (result == L2CAP_MR_PEND) {
5000 break;
5001 } else if (test_bit(CONN_LOCAL_BUSY,
5002 &chan->conn_state)) {
5003 chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;
5004 } else {
5005 /* Logical link is up or moving to BR/EDR,
5006 * proceed with move
5007 */
5008 chan->move_state = L2CAP_MOVE_WAIT_CONFIRM_RSP;
5009 l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);
5010 }
5011 break;
5012 case L2CAP_MOVE_WAIT_RSP:
5013 /* Moving to AMP */
5014 if (result == L2CAP_MR_SUCCESS) {
5015 /* Remote is ready, send confirm immediately
5016 * after logical link is ready
5017 */
5018 chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;
5019 } else {
5020 /* Both logical link and move success
5021 * are required to confirm
5022 */
5023 chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_COMP;
5024 }
5025
5026 /* Placeholder - get hci_chan for logical link */
5027 if (!hchan) {
5028 /* Logical link not available */
5029 l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);
5030 break;
5031 }
5032
5033 /* If the logical link is not yet connected, do not
5034 * send confirmation.
5035 */
5036 if (hchan->state != BT_CONNECTED)
5037 break;
5038
5039 /* Logical link is already ready to go */
5040
5041 chan->hs_hcon = hchan->conn;
5042 chan->hs_hcon->l2cap_data = chan->conn;
5043
5044 if (result == L2CAP_MR_SUCCESS) {
5045 /* Can confirm now */
5046 l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);
5047 } else {
5048 /* Now only need move success
5049 * to confirm
5050 */
5051 chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;
5052 }
5053
5054 l2cap_logical_cfm(chan, hchan, L2CAP_MR_SUCCESS);
5055 break;
5056 default:
5057 /* Any other amp move state means the move failed. */
5058 chan->move_id = chan->local_amp_id;
5059 l2cap_move_done(chan);
5060 l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);
5061 }
5062
5063 l2cap_chan_unlock(chan);
5064}
5065
5066static void l2cap_move_fail(struct l2cap_conn *conn, u8 ident, u16 icid,
5067 u16 result)
5068{
5069 struct l2cap_chan *chan;
5070
5071 chan = l2cap_get_chan_by_ident(conn, ident);
5072 if (!chan) {
5073 /* Could not locate channel, icid is best guess */
5074 l2cap_send_move_chan_cfm_icid(conn, icid);
5075 return;
5076 }
5077
5078 __clear_chan_timer(chan);
5079
5080 if (chan->move_role == L2CAP_MOVE_ROLE_INITIATOR) {
5081 if (result == L2CAP_MR_COLLISION) {
5082 chan->move_role = L2CAP_MOVE_ROLE_RESPONDER;
5083 } else {
5084 /* Cleanup - cancel move */
5085 chan->move_id = chan->local_amp_id;
5086 l2cap_move_done(chan);
5087 }
5088 }
5089
5090 l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);
5091
5092 l2cap_chan_unlock(chan);
5093}
5094
5095static int l2cap_move_channel_rsp(struct l2cap_conn *conn,
5096 struct l2cap_cmd_hdr *cmd,
5097 u16 cmd_len, void *data)
8d5a04a1
MM		 5098{
5099 struct l2cap_move_chan_rsp *rsp = data;
5100 u16 icid, result;
5101
5102 if (cmd_len != sizeof(*rsp))
5103 return -EPROTO;
5104
5105 icid = le16_to_cpu(rsp->icid);
5106 result = le16_to_cpu(rsp->result);
5107
ad0ac6ca 5108 BT_DBG("icid 0x%4.4x, result 0x%4.4x", icid, result);
8d5a04a1 5109
5b155ef9
MM		 5110 if (result == L2CAP_MR_SUCCESS || result == L2CAP_MR_PEND)
5111 l2cap_move_continue(conn, icid, result);
5112 else
5113 l2cap_move_fail(conn, cmd->ident, icid, result);
8d5a04a1
MM		 5114
5115 return 0;
5116}
5117
5f3847a4
MM		 5118static int l2cap_move_channel_confirm(struct l2cap_conn *conn,
5119 struct l2cap_cmd_hdr *cmd,
5120 u16 cmd_len, void *data)
8d5a04a1
MM		 5121{
5122 struct l2cap_move_chan_cfm *cfm = data;
5f3847a4 5123 struct l2cap_chan *chan;
8d5a04a1
MM		 5124 u16 icid, result;
5125
5126 if (cmd_len != sizeof(*cfm))
5127 return -EPROTO;
5128
5129 icid = le16_to_cpu(cfm->icid);
5130 result = le16_to_cpu(cfm->result);
5131
ad0ac6ca 5132 BT_DBG("icid 0x%4.4x, result 0x%4.4x", icid, result);
8d5a04a1 5133
5f3847a4
MM		 5134 chan = l2cap_get_chan_by_dcid(conn, icid);
5135 if (!chan) {
5136 /* Spec requires a response even if the icid was not found */
5137 l2cap_send_move_chan_cfm_rsp(conn, cmd->ident, icid);
5138 return 0;
5139 }
5140
5141 if (chan->move_state == L2CAP_MOVE_WAIT_CONFIRM) {
5142 if (result == L2CAP_MC_CONFIRMED) {
5143 chan->local_amp_id = chan->move_id;
6ed971ca 5144 if (chan->local_amp_id == AMP_ID_BREDR)
5f3847a4
MM		 5145 __release_logical_link(chan);
5146 } else {
5147 chan->move_id = chan->local_amp_id;
5148 }
5149
5150 l2cap_move_done(chan);
5151 }
5152
8d5a04a1
MM		 5153 l2cap_send_move_chan_cfm_rsp(conn, cmd->ident, icid);
5154
5f3847a4
MM		 5155 l2cap_chan_unlock(chan);
5156
8d5a04a1
MM		 5157 return 0;
5158}
5159
5160static inline int l2cap_move_channel_confirm_rsp(struct l2cap_conn *conn,
ad0ac6ca
AE		 5161 struct l2cap_cmd_hdr *cmd,
5162 u16 cmd_len, void *data)
8d5a04a1
MM		 5163{
5164 struct l2cap_move_chan_cfm_rsp *rsp = data;
3fd71a0a 5165 struct l2cap_chan *chan;
8d5a04a1
MM		 5166 u16 icid;
5167
5168 if (cmd_len != sizeof(*rsp))
5169 return -EPROTO;
5170
5171 icid = le16_to_cpu(rsp->icid);
5172
ad0ac6ca 5173 BT_DBG("icid 0x%4.4x", icid);
8d5a04a1 5174
3fd71a0a
MM		 5175 chan = l2cap_get_chan_by_scid(conn, icid);
5176 if (!chan)
5177 return 0;
5178
5179 __clear_chan_timer(chan);
5180
5181 if (chan->move_state == L2CAP_MOVE_WAIT_CONFIRM_RSP) {
5182 chan->local_amp_id = chan->move_id;
5183
6ed971ca 5184 if (chan->local_amp_id == AMP_ID_BREDR && chan->hs_hchan)
3fd71a0a
MM		 5185 __release_logical_link(chan);
5186
5187 l2cap_move_done(chan);
5188 }
5189
5190 l2cap_chan_unlock(chan);
5191
8d5a04a1
MM		 5192 return 0;
5193}
5194
de73115a 5195static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn,
2d792818 5196 struct l2cap_cmd_hdr *cmd,
203e639e 5197 u16 cmd_len, u8 *data)
de73115a
CT		 5198{
5199 struct hci_conn *hcon = conn->hcon;
5200 struct l2cap_conn_param_update_req *req;
5201 struct l2cap_conn_param_update_rsp rsp;
203e639e 5202 u16 min, max, latency, to_multiplier;
2ce603eb 5203 int err;
de73115a 5204
40bef302 5205 if (hcon->role != HCI_ROLE_MASTER)
de73115a
CT		 5206 return -EINVAL;
5207
de73115a
CT		 5208 if (cmd_len != sizeof(struct l2cap_conn_param_update_req))
5209 return -EPROTO;
5210
5211 req = (struct l2cap_conn_param_update_req *) data;
e2174ca4
GP		 5212 min = __le16_to_cpu(req->min);
5213 max = __le16_to_cpu(req->max);
de73115a
CT		 5214 latency = __le16_to_cpu(req->latency);
5215 to_multiplier = __le16_to_cpu(req->to_multiplier);
5216
5217 BT_DBG("min 0x%4.4x max 0x%4.4x latency: 0x%4.4x Timeout: 0x%4.4x",
2d792818 5218 min, max, latency, to_multiplier);
de73115a
CT		 5219
5220 memset(&rsp, 0, sizeof(rsp));
2ce603eb 5221
d4905f24 5222 err = hci_check_conn_params(min, max, latency, to_multiplier);
2ce603eb 5223 if (err)
dcf4adbf 5224 rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED);
de73115a 5225 else
dcf4adbf 5226 rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_ACCEPTED);
de73115a
CT		 5227
5228 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_PARAM_UPDATE_RSP,
2d792818 5229 sizeof(rsp), &rsp);
de73115a 5230
ffb5a827 5231 if (!err) {
f4869e2a
JH		 5232 u8 store_hint;
5233
5234 store_hint = hci_le_conn_update(hcon, min, max, latency,
5235 to_multiplier);
ffb5a827 5236 mgmt_new_conn_param(hcon->hdev, &hcon->dst, hcon->dst_type,
f4869e2a
JH		 5237 store_hint, min, max, latency,
5238 to_multiplier);
ffb5a827 5239
ffb5a827 5240 }
2ce603eb 5241
de73115a
CT		 5242 return 0;
5243}
5244
f1496dee
JH		 5245static int l2cap_le_connect_rsp(struct l2cap_conn *conn,
5246 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5247 u8 *data)
5248{
5249 struct l2cap_le_conn_rsp *rsp = (struct l2cap_le_conn_rsp *) data;
3e64b7bd 5250 struct hci_conn *hcon = conn->hcon;
f1496dee
JH		 5251 u16 dcid, mtu, mps, credits, result;
5252 struct l2cap_chan *chan;
3e64b7bd 5253 int err, sec_level;
f1496dee
JH		 5254
5255 if (cmd_len < sizeof(*rsp))
5256 return -EPROTO;
5257
5258 dcid = __le16_to_cpu(rsp->dcid);
5259 mtu = __le16_to_cpu(rsp->mtu);
5260 mps = __le16_to_cpu(rsp->mps);
5261 credits = __le16_to_cpu(rsp->credits);
5262 result = __le16_to_cpu(rsp->result);
5263
40624183
JH		 5264 if (result == L2CAP_CR_SUCCESS && (mtu < 23 || mps < 23 ||
5265 dcid < L2CAP_CID_DYN_START ||
5266 dcid > L2CAP_CID_LE_DYN_END))
f1496dee
JH		 5267 return -EPROTO;
5268
5269 BT_DBG("dcid 0x%4.4x mtu %u mps %u credits %u result 0x%2.2x",
5270 dcid, mtu, mps, credits, result);
5271
5272 mutex_lock(&conn->chan_lock);
5273
5274 chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
5275 if (!chan) {
5276 err = -EBADSLT;
5277 goto unlock;
5278 }
5279
5280 err = 0;
5281
5282 l2cap_chan_lock(chan);
5283
5284 switch (result) {
5285 case L2CAP_CR_SUCCESS:
40624183
JH		 5286 if (__l2cap_get_chan_by_dcid(conn, dcid)) {
5287 err = -EBADSLT;
5288 break;
5289 }
5290
f1496dee
JH		 5291 chan->ident = 0;
5292 chan->dcid = dcid;
5293 chan->omtu = mtu;
5294 chan->remote_mps = mps;
0cd75f7e 5295 chan->tx_credits = credits;
f1496dee
JH		 5296 l2cap_chan_ready(chan);
5297 break;
5298
3e64b7bd
JH		 5299 case L2CAP_CR_AUTHENTICATION:
5300 case L2CAP_CR_ENCRYPTION:
5301 /* If we already have MITM protection we can't do
5302 * anything.
5303 */
5304 if (hcon->sec_level > BT_SECURITY_MEDIUM) {
5305 l2cap_chan_del(chan, ECONNREFUSED);
5306 break;
5307 }
5308
5309 sec_level = hcon->sec_level + 1;
5310 if (chan->sec_level < sec_level)
5311 chan->sec_level = sec_level;
5312
5313 /* We'll need to send a new Connect Request */
5314 clear_bit(FLAG_LE_CONN_REQ_SENT, &chan->flags);
5315
5316 smp_conn_security(hcon, chan->sec_level);
5317 break;
5318
f1496dee
JH		 5319 default:
5320 l2cap_chan_del(chan, ECONNREFUSED);
5321 break;
5322 }
5323
5324 l2cap_chan_unlock(chan);
5325
5326unlock:
5327 mutex_unlock(&conn->chan_lock);
5328
5329 return err;
5330}
5331
3300d9a9 5332static inline int l2cap_bredr_sig_cmd(struct l2cap_conn *conn,
2d792818
GP		 5333 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5334 u8 *data)
3300d9a9
CT		 5335{
5336 int err = 0;
5337
5338 switch (cmd->code) {
5339 case L2CAP_COMMAND_REJ:
cb3b3152 5340 l2cap_command_rej(conn, cmd, cmd_len, data);
3300d9a9
CT		 5341 break;
5342
5343 case L2CAP_CONN_REQ:
cb3b3152 5344 err = l2cap_connect_req(conn, cmd, cmd_len, data);
3300d9a9
CT		 5345 break;
5346
5347 case L2CAP_CONN_RSP:
f5a2598d 5348 case L2CAP_CREATE_CHAN_RSP:
9245e737 5349 l2cap_connect_create_rsp(conn, cmd, cmd_len, data);
3300d9a9
CT		 5350 break;
5351
5352 case L2CAP_CONF_REQ:
5353 err = l2cap_config_req(conn, cmd, cmd_len, data);
5354 break;
5355
5356 case L2CAP_CONF_RSP:
9245e737 5357 l2cap_config_rsp(conn, cmd, cmd_len, data);
3300d9a9
CT		 5358 break;
5359
5360 case L2CAP_DISCONN_REQ:
cb3b3152 5361 err = l2cap_disconnect_req(conn, cmd, cmd_len, data);
3300d9a9
CT		 5362 break;
5363
5364 case L2CAP_DISCONN_RSP:
9245e737 5365 l2cap_disconnect_rsp(conn, cmd, cmd_len, data);
3300d9a9
CT		 5366 break;
5367
5368 case L2CAP_ECHO_REQ:
5369 l2cap_send_cmd(conn, cmd->ident, L2CAP_ECHO_RSP, cmd_len, data);
5370 break;
5371
5372 case L2CAP_ECHO_RSP:
5373 break;
5374
5375 case L2CAP_INFO_REQ:
cb3b3152 5376 err = l2cap_information_req(conn, cmd, cmd_len, data);
3300d9a9
CT		 5377 break;
5378
5379 case L2CAP_INFO_RSP:
9245e737 5380 l2cap_information_rsp(conn, cmd, cmd_len, data);
3300d9a9
CT		 5381 break;
5382
f94ff6ff
MM		 5383 case L2CAP_CREATE_CHAN_REQ:
5384 err = l2cap_create_channel_req(conn, cmd, cmd_len, data);
5385 break;
5386
8d5a04a1
MM		 5387 case L2CAP_MOVE_CHAN_REQ:
5388 err = l2cap_move_channel_req(conn, cmd, cmd_len, data);
5389 break;
5390
5391 case L2CAP_MOVE_CHAN_RSP:
9245e737 5392 l2cap_move_channel_rsp(conn, cmd, cmd_len, data);
8d5a04a1
MM		 5393 break;
5394
5395 case L2CAP_MOVE_CHAN_CFM:
5396 err = l2cap_move_channel_confirm(conn, cmd, cmd_len, data);
5397 break;
5398
5399 case L2CAP_MOVE_CHAN_CFM_RSP:
9245e737 5400 l2cap_move_channel_confirm_rsp(conn, cmd, cmd_len, data);
8d5a04a1
MM		 5401 break;
5402
3300d9a9
CT		 5403 default:
5404 BT_ERR("Unknown BR/EDR signaling command 0x%2.2x", cmd->code);
5405 err = -EINVAL;
5406 break;
5407 }
5408
5409 return err;
5410}
5411
27e2d4c8
JH		 5412static int l2cap_le_connect_req(struct l2cap_conn *conn,
5413 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5414 u8 *data)
5415{
5416 struct l2cap_le_conn_req *req = (struct l2cap_le_conn_req *) data;
5417 struct l2cap_le_conn_rsp rsp;
5418 struct l2cap_chan *chan, *pchan;
0cd75f7e 5419 u16 dcid, scid, credits, mtu, mps;
27e2d4c8
JH		 5420 __le16 psm;
5421 u8 result;
5422
5423 if (cmd_len != sizeof(*req))
5424 return -EPROTO;
5425
5426 scid = __le16_to_cpu(req->scid);
5427 mtu = __le16_to_cpu(req->mtu);
5428 mps = __le16_to_cpu(req->mps);
5429 psm = req->psm;
5430 dcid = 0;
0cd75f7e 5431 credits = 0;
27e2d4c8
JH		 5432
5433 if (mtu < 23 || mps < 23)
5434 return -EPROTO;
5435
5436 BT_DBG("psm 0x%2.2x scid 0x%4.4x mtu %u mps %u", __le16_to_cpu(psm),
5437 scid, mtu, mps);
5438
5439 /* Check if we have socket listening on psm */
5440 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src,
5441 &conn->hcon->dst, LE_LINK);
5442 if (!pchan) {
5443 result = L2CAP_CR_BAD_PSM;
5444 chan = NULL;
5445 goto response;
5446 }
5447
5448 mutex_lock(&conn->chan_lock);
5449 l2cap_chan_lock(pchan);
5450
35dc6f83
JH		 5451 if (!smp_sufficient_security(conn->hcon, pchan->sec_level,
5452 SMP_ALLOW_STK)) {
27e2d4c8
JH		 5453 result = L2CAP_CR_AUTHENTICATION;
5454 chan = NULL;
5455 goto response_unlock;
5456 }
5457
8a7889cc
JH		 5458 /* Check for valid dynamic CID range */
5459 if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_LE_DYN_END) {
5460 result = L2CAP_CR_INVALID_SCID;
5461 chan = NULL;
5462 goto response_unlock;
5463 }
5464
27e2d4c8
JH		 5465 /* Check if we already have channel with that dcid */
5466 if (__l2cap_get_chan_by_dcid(conn, scid)) {
8a7889cc 5467 result = L2CAP_CR_SCID_IN_USE;
27e2d4c8
JH		 5468 chan = NULL;
5469 goto response_unlock;
5470 }
5471
5472 chan = pchan->ops->new_connection(pchan);
5473 if (!chan) {
5474 result = L2CAP_CR_NO_MEM;
5475 goto response_unlock;
5476 }
5477
0ce43ce6
JH		 5478 l2cap_le_flowctl_init(chan);
5479
27e2d4c8
JH		 5480 bacpy(&chan->src, &conn->hcon->src);
5481 bacpy(&chan->dst, &conn->hcon->dst);
a250e048
JH		 5482 chan->src_type = bdaddr_src_type(conn->hcon);
5483 chan->dst_type = bdaddr_dst_type(conn->hcon);
27e2d4c8
JH		 5484 chan->psm = psm;
5485 chan->dcid = scid;
5486 chan->omtu = mtu;
5487 chan->remote_mps = mps;
0cd75f7e 5488 chan->tx_credits = __le16_to_cpu(req->credits);
27e2d4c8
JH		 5489
5490 __l2cap_chan_add(conn, chan);
5491 dcid = chan->scid;
0cd75f7e 5492 credits = chan->rx_credits;
27e2d4c8
JH		 5493
5494 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
5495
5496 chan->ident = cmd->ident;
5497
5498 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
5499 l2cap_state_change(chan, BT_CONNECT2);
434714dc
JH		 5500 /* The following result value is actually not defined
5501 * for LE CoC but we use it to let the function know
5502 * that it should bail out after doing its cleanup
5503 * instead of sending a response.
5504 */
27e2d4c8
JH		 5505 result = L2CAP_CR_PEND;
5506 chan->ops->defer(chan);
5507 } else {
5508 l2cap_chan_ready(chan);
5509 result = L2CAP_CR_SUCCESS;
5510 }
5511
5512response_unlock:
5513 l2cap_chan_unlock(pchan);
5514 mutex_unlock(&conn->chan_lock);
a24cce14 5515 l2cap_chan_put(pchan);
27e2d4c8
JH		 5516
5517 if (result == L2CAP_CR_PEND)
5518 return 0;
5519
5520response:
5521 if (chan) {
5522 rsp.mtu = cpu_to_le16(chan->imtu);
3916aed8 5523 rsp.mps = cpu_to_le16(chan->mps);
27e2d4c8
JH		 5524 } else {
5525 rsp.mtu = 0;
5526 rsp.mps = 0;
5527 }
5528
5529 rsp.dcid = cpu_to_le16(dcid);
0cd75f7e 5530 rsp.credits = cpu_to_le16(credits);
27e2d4c8
JH		 5531 rsp.result = cpu_to_le16(result);
5532
5533 l2cap_send_cmd(conn, cmd->ident, L2CAP_LE_CONN_RSP, sizeof(rsp), &rsp);
5534
5535 return 0;
5536}
5537
fad5fc89
JH		 5538static inline int l2cap_le_credits(struct l2cap_conn *conn,
5539 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5540 u8 *data)
5541{
5542 struct l2cap_le_credits *pkt;
5543 struct l2cap_chan *chan;
0f1bfe4e 5544 u16 cid, credits, max_credits;
fad5fc89
JH		 5545
5546 if (cmd_len != sizeof(*pkt))
5547 return -EPROTO;
5548
5549 pkt = (struct l2cap_le_credits *) data;
5550 cid = __le16_to_cpu(pkt->cid);
5551 credits = __le16_to_cpu(pkt->credits);
5552
5553 BT_DBG("cid 0x%4.4x credits 0x%4.4x", cid, credits);
5554
5555 chan = l2cap_get_chan_by_dcid(conn, cid);
5556 if (!chan)
5557 return -EBADSLT;
5558
0f1bfe4e
JH		 5559 max_credits = LE_FLOWCTL_MAX_CREDITS - chan->tx_credits;
5560 if (credits > max_credits) {
5561 BT_ERR("LE credits overflow");
5562 l2cap_send_disconn_req(chan, ECONNRESET);
ee93053d 5563 l2cap_chan_unlock(chan);
0f1bfe4e
JH		 5564
5565 /* Return 0 so that we don't trigger an unnecessary
5566 * command reject packet.
5567 */
5568 return 0;
5569 }
5570
fad5fc89
JH		 5571 chan->tx_credits += credits;
5572
5573 while (chan->tx_credits && !skb_queue_empty(&chan->tx_q)) {
5574 l2cap_do_send(chan, skb_dequeue(&chan->tx_q));
5575 chan->tx_credits--;
5576 }
5577
5578 if (chan->tx_credits)
5579 chan->ops->resume(chan);
5580
5581 l2cap_chan_unlock(chan);
5582
5583 return 0;
5584}
5585
71fb4197
JH		 5586static inline int l2cap_le_command_rej(struct l2cap_conn *conn,
5587 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5588 u8 *data)
5589{
5590 struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data;
5591 struct l2cap_chan *chan;
5592
5593 if (cmd_len < sizeof(*rej))
5594 return -EPROTO;
5595
5596 mutex_lock(&conn->chan_lock);
5597
5598 chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
5599 if (!chan)
5600 goto done;
5601
5602 l2cap_chan_lock(chan);
5603 l2cap_chan_del(chan, ECONNREFUSED);
5604 l2cap_chan_unlock(chan);
5605
5606done:
5607 mutex_unlock(&conn->chan_lock);
5608 return 0;
5609}
5610
3300d9a9 5611static inline int l2cap_le_sig_cmd(struct l2cap_conn *conn,
203e639e
JH		 5612 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5613 u8 *data)
3300d9a9 5614{
b5ecba64
JH		 5615 int err = 0;
5616
3300d9a9
CT		 5617 switch (cmd->code) {
5618 case L2CAP_COMMAND_REJ:
71fb4197 5619 l2cap_le_command_rej(conn, cmd, cmd_len, data);
b5ecba64 5620 break;
3300d9a9
CT		 5621
5622 case L2CAP_CONN_PARAM_UPDATE_REQ:
b5ecba64
JH		 5623 err = l2cap_conn_param_update_req(conn, cmd, cmd_len, data);
5624 break;
3300d9a9
CT		 5625
5626 case L2CAP_CONN_PARAM_UPDATE_RSP:
b5ecba64 5627 break;
3300d9a9 5628
f1496dee
JH		 5629 case L2CAP_LE_CONN_RSP:
5630 l2cap_le_connect_rsp(conn, cmd, cmd_len, data);
b5ecba64 5631 break;
f1496dee 5632
27e2d4c8 5633 case L2CAP_LE_CONN_REQ:
b5ecba64
JH		 5634 err = l2cap_le_connect_req(conn, cmd, cmd_len, data);
5635 break;
27e2d4c8 5636
fad5fc89
JH		 5637 case L2CAP_LE_CREDITS:
5638 err = l2cap_le_credits(conn, cmd, cmd_len, data);
5639 break;
5640
3defe01a 5641 case L2CAP_DISCONN_REQ:
b5ecba64
JH		 5642 err = l2cap_disconnect_req(conn, cmd, cmd_len, data);
5643 break;
3defe01a
JH		 5644
5645 case L2CAP_DISCONN_RSP:
5646 l2cap_disconnect_rsp(conn, cmd, cmd_len, data);
b5ecba64 5647 break;
3defe01a 5648
3300d9a9
CT		 5649 default:
5650 BT_ERR("Unknown LE signaling command 0x%2.2x", cmd->code);
b5ecba64
JH		 5651 err = -EINVAL;
5652 break;
3300d9a9 5653 }
b5ecba64
JH		 5654
5655 return err;
3300d9a9
CT		 5656}
5657
c5623556
JH		 5658static inline void l2cap_le_sig_channel(struct l2cap_conn *conn,
5659 struct sk_buff *skb)
5660{
69c4e4e8 5661 struct hci_conn *hcon = conn->hcon;
4f3e219d
MH		 5662 struct l2cap_cmd_hdr *cmd;
5663 u16 len;
c5623556
JH		 5664 int err;
5665
69c4e4e8 5666 if (hcon->type != LE_LINK)
3b166295 5667 goto drop;
69c4e4e8 5668
4f3e219d
MH		 5669 if (skb->len < L2CAP_CMD_HDR_SIZE)
5670 goto drop;
c5623556 5671
4f3e219d
MH		 5672 cmd = (void *) skb->data;
5673 skb_pull(skb, L2CAP_CMD_HDR_SIZE);
c5623556 5674
4f3e219d 5675 len = le16_to_cpu(cmd->len);
c5623556 5676
4f3e219d 5677 BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd->code, len, cmd->ident);
c5623556 5678
4f3e219d
MH		 5679 if (len != skb->len || !cmd->ident) {
5680 BT_DBG("corrupted command");
5681 goto drop;
5682 }
c5623556 5683
203e639e 5684 err = l2cap_le_sig_cmd(conn, cmd, len, skb->data);
4f3e219d
MH		 5685 if (err) {
5686 struct l2cap_cmd_rej_unk rej;
c5623556 5687
4f3e219d 5688 BT_ERR("Wrong link type (%d)", err);
c5623556 5689
dcf4adbf 5690 rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
4f3e219d
MH		 5691 l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ,
5692 sizeof(rej), &rej);
c5623556
JH		 5693 }
5694
3b166295 5695drop:
c5623556
JH		 5696 kfree_skb(skb);
5697}
5698
3300d9a9 5699static inline void l2cap_sig_channel(struct l2cap_conn *conn,
2d792818 5700 struct sk_buff *skb)
1da177e4 5701{
69c4e4e8 5702 struct hci_conn *hcon = conn->hcon;
1da177e4
LT		 5703 u8 *data = skb->data;
5704 int len = skb->len;
5705 struct l2cap_cmd_hdr cmd;
3300d9a9 5706 int err;
1da177e4
LT		 5707
5708 l2cap_raw_recv(conn, skb);
5709
69c4e4e8 5710 if (hcon->type != ACL_LINK)
3b166295 5711 goto drop;
69c4e4e8 5712
1da177e4 5713 while (len >= L2CAP_CMD_HDR_SIZE) {
88219a0f 5714 u16 cmd_len;
1da177e4
LT		 5715 memcpy(&cmd, data, L2CAP_CMD_HDR_SIZE);
5716 data += L2CAP_CMD_HDR_SIZE;
5717 len -= L2CAP_CMD_HDR_SIZE;
5718
88219a0f 5719 cmd_len = le16_to_cpu(cmd.len);
1da177e4 5720
2d792818
GP		 5721 BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd.code, cmd_len,
5722 cmd.ident);
1da177e4 5723
88219a0f 5724 if (cmd_len > len || !cmd.ident) {
1da177e4
LT		 5725 BT_DBG("corrupted command");
5726 break;
5727 }
5728
c5623556 5729 err = l2cap_bredr_sig_cmd(conn, &cmd, cmd_len, data);
1da177e4 5730 if (err) {
e2fd318e 5731 struct l2cap_cmd_rej_unk rej;
2c6d1a2e
GP		 5732
5733 BT_ERR("Wrong link type (%d)", err);
1da177e4 5734
dcf4adbf 5735 rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
2d792818
GP		 5736 l2cap_send_cmd(conn, cmd.ident, L2CAP_COMMAND_REJ,
5737 sizeof(rej), &rej);
1da177e4
LT		 5738 }
5739
88219a0f
AV		 5740 data += cmd_len;
5741 len -= cmd_len;
1da177e4
LT		 5742 }
5743
3b166295 5744drop:
1da177e4
LT		 5745 kfree_skb(skb);
5746}
5747
47d1ec61 5748static int l2cap_check_fcs(struct l2cap_chan *chan, struct sk_buff *skb)
fcc203c3
GP		 5749{
5750 u16 our_fcs, rcv_fcs;
e4ca6d98
AE		 5751 int hdr_size;
5752
5753 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
5754 hdr_size = L2CAP_EXT_HDR_SIZE;
5755 else
5756 hdr_size = L2CAP_ENH_HDR_SIZE;
fcc203c3 5757
47d1ec61 5758 if (chan->fcs == L2CAP_FCS_CRC16) {
03a51213 5759 skb_trim(skb, skb->len - L2CAP_FCS_SIZE);
fcc203c3
GP		 5760 rcv_fcs = get_unaligned_le16(skb->data + skb->len);
5761 our_fcs = crc16(0, skb->data - hdr_size, skb->len + hdr_size);
5762
5763 if (our_fcs != rcv_fcs)
7a560e5c 5764 return -EBADMSG;
fcc203c3
GP		 5765 }
5766 return 0;
5767}
5768
6ea00485 5769static void l2cap_send_i_or_rr_or_rnr(struct l2cap_chan *chan)
d5392c8f 5770{
e31f7633 5771 struct l2cap_ctrl control;
d5392c8f 5772
e31f7633 5773 BT_DBG("chan %p", chan);
d5392c8f 5774
e31f7633
MM		 5775 memset(&control, 0, sizeof(control));
5776 control.sframe = 1;
5777 control.final = 1;
5778 control.reqseq = chan->buffer_seq;
5779 set_bit(CONN_SEND_FBIT, &chan->conn_state);
d5392c8f 5780
e2ab4353 5781 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
e31f7633
MM		 5782 control.super = L2CAP_SUPER_RNR;
5783 l2cap_send_sframe(chan, &control);
d5392c8f
GP		 5784 }
5785
e31f7633
MM		 5786 if (test_and_clear_bit(CONN_REMOTE_BUSY, &chan->conn_state) &&
5787 chan->unacked_frames > 0)
5788 __set_retrans_timer(chan);
d5392c8f 5789
e31f7633 5790 /* Send pending iframes */
525cd185 5791 l2cap_ertm_send(chan);
d5392c8f 5792
e2ab4353 5793 if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&
e31f7633
MM		 5794 test_bit(CONN_SEND_FBIT, &chan->conn_state)) {
5795 /* F-bit wasn't sent in an s-frame or i-frame yet, so
5796 * send it now.
5797 */
5798 control.super = L2CAP_SUPER_RR;
5799 l2cap_send_sframe(chan, &control);
d5392c8f
GP		 5800 }
5801}
5802
2d792818
GP		 5803static void append_skb_frag(struct sk_buff *skb, struct sk_buff *new_frag,
5804 struct sk_buff **last_frag)
18778a63 5805{
84084a31
MM		 5806 /* skb->len reflects data in skb as well as all fragments
5807 * skb->data_len reflects only data in fragments
5808 */
5809 if (!skb_has_frag_list(skb))
5810 skb_shinfo(skb)->frag_list = new_frag;
5811
5812 new_frag->next = NULL;
5813
5814 (*last_frag)->next = new_frag;
5815 *last_frag = new_frag;
5816
5817 skb->len += new_frag->len;
5818 skb->data_len += new_frag->len;
5819 skb->truesize += new_frag->truesize;
5820}
5821
4b51dae9
MM		 5822static int l2cap_reassemble_sdu(struct l2cap_chan *chan, struct sk_buff *skb,
5823 struct l2cap_ctrl *control)
84084a31
MM		 5824{
5825 int err = -EINVAL;
18778a63 5826
4b51dae9 5827 switch (control->sar) {
7e0ef6ee 5828 case L2CAP_SAR_UNSEGMENTED:
84084a31
MM		 5829 if (chan->sdu)
5830 break;
18778a63 5831
80b98027 5832 err = chan->ops->recv(chan, skb);
84084a31 5833 break;
18778a63 5834
7e0ef6ee 5835 case L2CAP_SAR_START:
84084a31
MM		 5836 if (chan->sdu)
5837 break;
18778a63 5838
dbb50887
DB		 5839 if (!pskb_may_pull(skb, L2CAP_SDULEN_SIZE))
5840 break;
5841
6f61fd47 5842 chan->sdu_len = get_unaligned_le16(skb->data);
03a51213 5843 skb_pull(skb, L2CAP_SDULEN_SIZE);
18778a63 5844
84084a31
MM		 5845 if (chan->sdu_len > chan->imtu) {
5846 err = -EMSGSIZE;
5847 break;
5848 }
1890d36b 5849
84084a31
MM		 5850 if (skb->len >= chan->sdu_len)
5851 break;
18778a63 5852
84084a31
MM		 5853 chan->sdu = skb;
5854 chan->sdu_last_frag = skb;
18778a63 5855
84084a31
MM		 5856 skb = NULL;
5857 err = 0;
18778a63
GP		 5858 break;
5859
7e0ef6ee 5860 case L2CAP_SAR_CONTINUE:
6f61fd47 5861 if (!chan->sdu)
84084a31 5862 break;
18778a63 5863
84084a31
MM		 5864 append_skb_frag(chan->sdu, skb,
5865 &chan->sdu_last_frag);
5866 skb = NULL;
18778a63 5867
84084a31
MM		 5868 if (chan->sdu->len >= chan->sdu_len)
5869 break;
4178ba46 5870
84084a31 5871 err = 0;
18778a63
GP		 5872 break;
5873
7e0ef6ee 5874 case L2CAP_SAR_END:
6f61fd47 5875 if (!chan->sdu)
84084a31 5876 break;
18778a63 5877
84084a31
MM		 5878 append_skb_frag(chan->sdu, skb,
5879 &chan->sdu_last_frag);
5880 skb = NULL;
4178ba46 5881
84084a31
MM		 5882 if (chan->sdu->len != chan->sdu_len)
5883 break;
18778a63 5884
80b98027 5885 err = chan->ops->recv(chan, chan->sdu);
1890d36b 5886
84084a31
MM		 5887 if (!err) {
5888 /* Reassembly complete */
5889 chan->sdu = NULL;
5890 chan->sdu_last_frag = NULL;
5891 chan->sdu_len = 0;
1890d36b 5892 }
18778a63
GP		 5893 break;
5894 }
5895
84084a31
MM		 5896 if (err) {
5897 kfree_skb(skb);
5898 kfree_skb(chan->sdu);
5899 chan->sdu = NULL;
5900 chan->sdu_last_frag = NULL;
5901 chan->sdu_len = 0;
5902 }
18778a63 5903
84084a31 5904 return err;
18778a63
GP		 5905}
5906
32b32735
MM		 5907static int l2cap_resegment(struct l2cap_chan *chan)
5908{
5909 /* Placeholder */
5910 return 0;
5911}
5912
61aa4f5b 5913void l2cap_chan_busy(struct l2cap_chan *chan, int busy)
26f880d2 5914{
61aa4f5b 5915 u8 event;
712132eb 5916
61aa4f5b
MM		 5917 if (chan->mode != L2CAP_MODE_ERTM)
5918 return;
712132eb 5919
61aa4f5b 5920 event = busy ? L2CAP_EV_LOCAL_BUSY_DETECTED : L2CAP_EV_LOCAL_BUSY_CLEAR;
401bb1f7 5921 l2cap_tx(chan, NULL, NULL, event);
1890d36b
GP		 5922}
5923
d2a7ac5d
MM		 5924static int l2cap_rx_queued_iframes(struct l2cap_chan *chan)
5925{
63838725
MM		 5926 int err = 0;
5927 /* Pass sequential frames to l2cap_reassemble_sdu()
5928 * until a gap is encountered.
5929 */
5930
5931 BT_DBG("chan %p", chan);
5932
5933 while (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
5934 struct sk_buff *skb;
5935 BT_DBG("Searching for skb with txseq %d (queue len %d)",
5936 chan->buffer_seq, skb_queue_len(&chan->srej_q));
5937
5938 skb = l2cap_ertm_seq_in_queue(&chan->srej_q, chan->buffer_seq);
5939
5940 if (!skb)
5941 break;
5942
5943 skb_unlink(skb, &chan->srej_q);
5944 chan->buffer_seq = __next_seq(chan, chan->buffer_seq);
a4368ff3 5945 err = l2cap_reassemble_sdu(chan, skb, &bt_cb(skb)->l2cap);
63838725
MM		 5946 if (err)
5947 break;
5948 }
5949
5950 if (skb_queue_empty(&chan->srej_q)) {
5951 chan->rx_state = L2CAP_RX_STATE_RECV;
5952 l2cap_send_ack(chan);
5953 }
5954
5955 return err;
d2a7ac5d
MM		 5956}
5957
5958static void l2cap_handle_srej(struct l2cap_chan *chan,
5959 struct l2cap_ctrl *control)
5960{
f80842a8
MM		 5961 struct sk_buff *skb;
5962
5963 BT_DBG("chan %p, control %p", chan, control);
5964
5965 if (control->reqseq == chan->next_tx_seq) {
5966 BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq);
5e4e3972 5967 l2cap_send_disconn_req(chan, ECONNRESET);
f80842a8
MM		 5968 return;
5969 }
5970
5971 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);
5972
5973 if (skb == NULL) {
5974 BT_DBG("Seq %d not available for retransmission",
5975 control->reqseq);
5976 return;
5977 }
5978
a4368ff3 5979 if (chan->max_tx != 0 && bt_cb(skb)->l2cap.retries >= chan->max_tx) {
f80842a8 5980 BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
5e4e3972 5981 l2cap_send_disconn_req(chan, ECONNRESET);
f80842a8
MM		 5982 return;
5983 }
5984
5985 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
5986
5987 if (control->poll) {
5988 l2cap_pass_to_tx(chan, control);
5989
5990 set_bit(CONN_SEND_FBIT, &chan->conn_state);
5991 l2cap_retransmit(chan, control);
5992 l2cap_ertm_send(chan);
5993
5994 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) {
5995 set_bit(CONN_SREJ_ACT, &chan->conn_state);
5996 chan->srej_save_reqseq = control->reqseq;
5997 }
5998 } else {
5999 l2cap_pass_to_tx_fbit(chan, control);
6000
6001 if (control->final) {
6002 if (chan->srej_save_reqseq != control->reqseq ||
6003 !test_and_clear_bit(CONN_SREJ_ACT,
6004 &chan->conn_state))
6005 l2cap_retransmit(chan, control);
6006 } else {
6007 l2cap_retransmit(chan, control);
6008 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) {
6009 set_bit(CONN_SREJ_ACT, &chan->conn_state);
6010 chan->srej_save_reqseq = control->reqseq;
6011 }
6012 }
6013 }
d2a7ac5d
MM		 6014}
6015
6016static void l2cap_handle_rej(struct l2cap_chan *chan,
6017 struct l2cap_ctrl *control)
6018{
fcd289df
MM		 6019 struct sk_buff *skb;
6020
6021 BT_DBG("chan %p, control %p", chan, control);
6022
6023 if (control->reqseq == chan->next_tx_seq) {
6024 BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq);
5e4e3972 6025 l2cap_send_disconn_req(chan, ECONNRESET);
fcd289df
MM		 6026 return;
6027 }
6028
6029 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);
6030
6031 if (chan->max_tx && skb &&
a4368ff3 6032 bt_cb(skb)->l2cap.retries >= chan->max_tx) {
fcd289df 6033 BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
5e4e3972 6034 l2cap_send_disconn_req(chan, ECONNRESET);
fcd289df
MM		 6035 return;
6036 }
6037
6038 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6039
6040 l2cap_pass_to_tx(chan, control);
6041
6042 if (control->final) {
6043 if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))
6044 l2cap_retransmit_all(chan, control);
6045 } else {
6046 l2cap_retransmit_all(chan, control);
6047 l2cap_ertm_send(chan);
6048 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F)
6049 set_bit(CONN_REJ_ACT, &chan->conn_state);
6050 }
d2a7ac5d
MM		 6051}
6052
4b51dae9
MM		 6053static u8 l2cap_classify_txseq(struct l2cap_chan *chan, u16 txseq)
6054{
6055 BT_DBG("chan %p, txseq %d", chan, txseq);
6056
6057 BT_DBG("last_acked_seq %d, expected_tx_seq %d", chan->last_acked_seq,
6058 chan->expected_tx_seq);
6059
6060 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
6061 if (__seq_offset(chan, txseq, chan->last_acked_seq) >=
2d792818 6062 chan->tx_win) {
4b51dae9
MM		 6063 /* See notes below regarding "double poll" and
6064 * invalid packets.
6065 */
6066 if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) {
6067 BT_DBG("Invalid/Ignore - after SREJ");
6068 return L2CAP_TXSEQ_INVALID_IGNORE;
6069 } else {
6070 BT_DBG("Invalid - in window after SREJ sent");
6071 return L2CAP_TXSEQ_INVALID;
6072 }
6073 }
6074
6075 if (chan->srej_list.head == txseq) {
6076 BT_DBG("Expected SREJ");
6077 return L2CAP_TXSEQ_EXPECTED_SREJ;
6078 }
6079
6080 if (l2cap_ertm_seq_in_queue(&chan->srej_q, txseq)) {
6081 BT_DBG("Duplicate SREJ - txseq already stored");
6082 return L2CAP_TXSEQ_DUPLICATE_SREJ;
6083 }
6084
6085 if (l2cap_seq_list_contains(&chan->srej_list, txseq)) {
6086 BT_DBG("Unexpected SREJ - not requested");
6087 return L2CAP_TXSEQ_UNEXPECTED_SREJ;
6088 }
6089 }
6090
6091 if (chan->expected_tx_seq == txseq) {
6092 if (__seq_offset(chan, txseq, chan->last_acked_seq) >=
6093 chan->tx_win) {
6094 BT_DBG("Invalid - txseq outside tx window");
6095 return L2CAP_TXSEQ_INVALID;
6096 } else {
6097 BT_DBG("Expected");
6098 return L2CAP_TXSEQ_EXPECTED;
6099 }
6100 }
6101
6102 if (__seq_offset(chan, txseq, chan->last_acked_seq) <
2d792818 6103 __seq_offset(chan, chan->expected_tx_seq, chan->last_acked_seq)) {
4b51dae9
MM		 6104 BT_DBG("Duplicate - expected_tx_seq later than txseq");
6105 return L2CAP_TXSEQ_DUPLICATE;
6106 }
6107
6108 if (__seq_offset(chan, txseq, chan->last_acked_seq) >= chan->tx_win) {
6109 /* A source of invalid packets is a "double poll" condition,
6110 * where delays cause us to send multiple poll packets. If
6111 * the remote stack receives and processes both polls,
6112 * sequence numbers can wrap around in such a way that a
6113 * resent frame has a sequence number that looks like new data
6114 * with a sequence gap. This would trigger an erroneous SREJ
6115 * request.
6116 *
6117 * Fortunately, this is impossible with a tx window that's
6118 * less than half of the maximum sequence number, which allows
6119 * invalid frames to be safely ignored.
6120 *
6121 * With tx window sizes greater than half of the tx window
6122 * maximum, the frame is invalid and cannot be ignored. This
6123 * causes a disconnect.
6124 */
6125
6126 if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) {
6127 BT_DBG("Invalid/Ignore - txseq outside tx window");
6128 return L2CAP_TXSEQ_INVALID_IGNORE;
6129 } else {
6130 BT_DBG("Invalid - txseq outside tx window");
6131 return L2CAP_TXSEQ_INVALID;
6132 }
6133 } else {
6134 BT_DBG("Unexpected - txseq indicates missing frames");
6135 return L2CAP_TXSEQ_UNEXPECTED;
6136 }
6137}
6138
d2a7ac5d
MM		 6139static int l2cap_rx_state_recv(struct l2cap_chan *chan,
6140 struct l2cap_ctrl *control,
6141 struct sk_buff *skb, u8 event)
6142{
6143 int err = 0;
941247f9 6144 bool skb_in_use = false;
d2a7ac5d
MM		 6145
6146 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
6147 event);
6148
6149 switch (event) {
6150 case L2CAP_EV_RECV_IFRAME:
6151 switch (l2cap_classify_txseq(chan, control->txseq)) {
6152 case L2CAP_TXSEQ_EXPECTED:
6153 l2cap_pass_to_tx(chan, control);
6154
6155 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
6156 BT_DBG("Busy, discarding expected seq %d",
6157 control->txseq);
6158 break;
6159 }
6160
6161 chan->expected_tx_seq = __next_seq(chan,
6162 control->txseq);
6163
6164 chan->buffer_seq = chan->expected_tx_seq;
941247f9 6165 skb_in_use = true;
d2a7ac5d
MM		 6166
6167 err = l2cap_reassemble_sdu(chan, skb, control);
6168 if (err)
6169 break;
6170
6171 if (control->final) {
6172 if (!test_and_clear_bit(CONN_REJ_ACT,
6173 &chan->conn_state)) {
6174 control->final = 0;
6175 l2cap_retransmit_all(chan, control);
6176 l2cap_ertm_send(chan);
6177 }
6178 }
6179
6180 if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state))
6181 l2cap_send_ack(chan);
6182 break;
6183 case L2CAP_TXSEQ_UNEXPECTED:
6184 l2cap_pass_to_tx(chan, control);
6185
6186 /* Can't issue SREJ frames in the local busy state.
6187 * Drop this frame, it will be seen as missing
6188 * when local busy is exited.
6189 */
6190 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
6191 BT_DBG("Busy, discarding unexpected seq %d",
6192 control->txseq);
6193 break;
6194 }
6195
6196 /* There was a gap in the sequence, so an SREJ
6197 * must be sent for each missing frame. The
6198 * current frame is stored for later use.
6199 */
6200 skb_queue_tail(&chan->srej_q, skb);
941247f9 6201 skb_in_use = true;
d2a7ac5d
MM		 6202 BT_DBG("Queued %p (queue len %d)", skb,
6203 skb_queue_len(&chan->srej_q));
6204
6205 clear_bit(CONN_SREJ_ACT, &chan->conn_state);
6206 l2cap_seq_list_clear(&chan->srej_list);
6207 l2cap_send_srej(chan, control->txseq);
6208
6209 chan->rx_state = L2CAP_RX_STATE_SREJ_SENT;
6210 break;
6211 case L2CAP_TXSEQ_DUPLICATE:
6212 l2cap_pass_to_tx(chan, control);
6213 break;
6214 case L2CAP_TXSEQ_INVALID_IGNORE:
6215 break;
6216 case L2CAP_TXSEQ_INVALID:
6217 default:
5e4e3972 6218 l2cap_send_disconn_req(chan, ECONNRESET);
d2a7ac5d
MM		 6219 break;
6220 }
6221 break;
6222 case L2CAP_EV_RECV_RR:
6223 l2cap_pass_to_tx(chan, control);
6224 if (control->final) {
6225 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6226
e6a3ee6e
MM		 6227 if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state) &&
6228 !__chan_is_moving(chan)) {
d2a7ac5d
MM		 6229 control->final = 0;
6230 l2cap_retransmit_all(chan, control);
6231 }
6232
6233 l2cap_ertm_send(chan);
6234 } else if (control->poll) {
6235 l2cap_send_i_or_rr_or_rnr(chan);
6236 } else {
6237 if (test_and_clear_bit(CONN_REMOTE_BUSY,
6238 &chan->conn_state) &&
6239 chan->unacked_frames)
6240 __set_retrans_timer(chan);
6241
6242 l2cap_ertm_send(chan);
6243 }
6244 break;
6245 case L2CAP_EV_RECV_RNR:
6246 set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6247 l2cap_pass_to_tx(chan, control);
6248 if (control && control->poll) {
6249 set_bit(CONN_SEND_FBIT, &chan->conn_state);
6250 l2cap_send_rr_or_rnr(chan, 0);
6251 }
6252 __clear_retrans_timer(chan);
6253 l2cap_seq_list_clear(&chan->retrans_list);
6254 break;
6255 case L2CAP_EV_RECV_REJ:
6256 l2cap_handle_rej(chan, control);
6257 break;
6258 case L2CAP_EV_RECV_SREJ:
6259 l2cap_handle_srej(chan, control);
6260 break;
6261 default:
6262 break;
6263 }
6264
6265 if (skb && !skb_in_use) {
6266 BT_DBG("Freeing %p", skb);
6267 kfree_skb(skb);
6268 }
6269
6270 return err;
6271}
6272
6273static int l2cap_rx_state_srej_sent(struct l2cap_chan *chan,
6274 struct l2cap_ctrl *control,
6275 struct sk_buff *skb, u8 event)
6276{
6277 int err = 0;
6278 u16 txseq = control->txseq;
941247f9 6279 bool skb_in_use = false;
d2a7ac5d
MM		 6280
6281 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
6282 event);
6283
6284 switch (event) {
6285 case L2CAP_EV_RECV_IFRAME:
6286 switch (l2cap_classify_txseq(chan, txseq)) {
6287 case L2CAP_TXSEQ_EXPECTED:
6288 /* Keep frame for reassembly later */
6289 l2cap_pass_to_tx(chan, control);
6290 skb_queue_tail(&chan->srej_q, skb);
941247f9 6291 skb_in_use = true;
d2a7ac5d
MM		 6292 BT_DBG("Queued %p (queue len %d)", skb,
6293 skb_queue_len(&chan->srej_q));
6294
6295 chan->expected_tx_seq = __next_seq(chan, txseq);
6296 break;
6297 case L2CAP_TXSEQ_EXPECTED_SREJ:
6298 l2cap_seq_list_pop(&chan->srej_list);
6299
6300 l2cap_pass_to_tx(chan, control);
6301 skb_queue_tail(&chan->srej_q, skb);
941247f9 6302 skb_in_use = true;
d2a7ac5d
MM		 6303 BT_DBG("Queued %p (queue len %d)", skb,
6304 skb_queue_len(&chan->srej_q));
6305
6306 err = l2cap_rx_queued_iframes(chan);
6307 if (err)
6308 break;
6309
6310 break;
6311 case L2CAP_TXSEQ_UNEXPECTED:
6312 /* Got a frame that can't be reassembled yet.
6313 * Save it for later, and send SREJs to cover
6314 * the missing frames.
6315 */
6316 skb_queue_tail(&chan->srej_q, skb);
941247f9 6317 skb_in_use = true;
d2a7ac5d
MM		 6318 BT_DBG("Queued %p (queue len %d)", skb,
6319 skb_queue_len(&chan->srej_q));
6320
6321 l2cap_pass_to_tx(chan, control);
6322 l2cap_send_srej(chan, control->txseq);
6323 break;
6324 case L2CAP_TXSEQ_UNEXPECTED_SREJ:
6325 /* This frame was requested with an SREJ, but
6326 * some expected retransmitted frames are
6327 * missing. Request retransmission of missing
6328 * SREJ'd frames.
6329 */
6330 skb_queue_tail(&chan->srej_q, skb);
941247f9 6331 skb_in_use = true;
d2a7ac5d
MM		 6332 BT_DBG("Queued %p (queue len %d)", skb,
6333 skb_queue_len(&chan->srej_q));
6334
6335 l2cap_pass_to_tx(chan, control);
6336 l2cap_send_srej_list(chan, control->txseq);
6337 break;
6338 case L2CAP_TXSEQ_DUPLICATE_SREJ:
6339 /* We've already queued this frame. Drop this copy. */
6340 l2cap_pass_to_tx(chan, control);
6341 break;
6342 case L2CAP_TXSEQ_DUPLICATE:
6343 /* Expecting a later sequence number, so this frame
6344 * was already received. Ignore it completely.
6345 */
6346 break;
6347 case L2CAP_TXSEQ_INVALID_IGNORE:
6348 break;
6349 case L2CAP_TXSEQ_INVALID:
6350 default:
5e4e3972 6351 l2cap_send_disconn_req(chan, ECONNRESET);
d2a7ac5d
MM		 6352 break;
6353 }
6354 break;
6355 case L2CAP_EV_RECV_RR:
6356 l2cap_pass_to_tx(chan, control);
6357 if (control->final) {
6358 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6359
6360 if (!test_and_clear_bit(CONN_REJ_ACT,
6361 &chan->conn_state)) {
6362 control->final = 0;
6363 l2cap_retransmit_all(chan, control);
6364 }
6365
6366 l2cap_ertm_send(chan);
6367 } else if (control->poll) {
6368 if (test_and_clear_bit(CONN_REMOTE_BUSY,
6369 &chan->conn_state) &&
6370 chan->unacked_frames) {
6371 __set_retrans_timer(chan);
6372 }
6373
6374 set_bit(CONN_SEND_FBIT, &chan->conn_state);
6375 l2cap_send_srej_tail(chan);
6376 } else {
6377 if (test_and_clear_bit(CONN_REMOTE_BUSY,
6378 &chan->conn_state) &&
6379 chan->unacked_frames)
6380 __set_retrans_timer(chan);
6381
6382 l2cap_send_ack(chan);
6383 }
6384 break;
6385 case L2CAP_EV_RECV_RNR:
6386 set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6387 l2cap_pass_to_tx(chan, control);
6388 if (control->poll) {
6389 l2cap_send_srej_tail(chan);
6390 } else {
6391 struct l2cap_ctrl rr_control;
6392 memset(&rr_control, 0, sizeof(rr_control));
6393 rr_control.sframe = 1;
6394 rr_control.super = L2CAP_SUPER_RR;
6395 rr_control.reqseq = chan->buffer_seq;
6396 l2cap_send_sframe(chan, &rr_control);
6397 }
6398
6399 break;
6400 case L2CAP_EV_RECV_REJ:
6401 l2cap_handle_rej(chan, control);
6402 break;
6403 case L2CAP_EV_RECV_SREJ:
6404 l2cap_handle_srej(chan, control);
6405 break;
6406 }
6407
6408 if (skb && !skb_in_use) {
6409 BT_DBG("Freeing %p", skb);
6410 kfree_skb(skb);
6411 }
6412
6413 return err;
6414}
6415
32b32735
MM		 6416static int l2cap_finish_move(struct l2cap_chan *chan)
6417{
6418 BT_DBG("chan %p", chan);
6419
6420 chan->rx_state = L2CAP_RX_STATE_RECV;
6421
6422 if (chan->hs_hcon)
6423 chan->conn->mtu = chan->hs_hcon->hdev->block_mtu;
6424 else
6425 chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu;
6426
6427 return l2cap_resegment(chan);
6428}
6429
6430static int l2cap_rx_state_wait_p(struct l2cap_chan *chan,
6431 struct l2cap_ctrl *control,
6432 struct sk_buff *skb, u8 event)
6433{
6434 int err;
6435
6436 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
6437 event);
6438
6439 if (!control->poll)
6440 return -EPROTO;
6441
6442 l2cap_process_reqseq(chan, control->reqseq);
6443
6444 if (!skb_queue_empty(&chan->tx_q))
6445 chan->tx_send_head = skb_peek(&chan->tx_q);
6446 else
6447 chan->tx_send_head = NULL;
6448
6449 /* Rewind next_tx_seq to the point expected
6450 * by the receiver.
6451 */
6452 chan->next_tx_seq = control->reqseq;
6453 chan->unacked_frames = 0;
6454
6455 err = l2cap_finish_move(chan);
6456 if (err)
6457 return err;
6458
6459 set_bit(CONN_SEND_FBIT, &chan->conn_state);
6460 l2cap_send_i_or_rr_or_rnr(chan);
6461
6462 if (event == L2CAP_EV_RECV_IFRAME)
6463 return -EPROTO;
6464
6465 return l2cap_rx_state_recv(chan, control, NULL, event);
6466}
6467
6468static int l2cap_rx_state_wait_f(struct l2cap_chan *chan,
6469 struct l2cap_ctrl *control,
6470 struct sk_buff *skb, u8 event)
6471{
6472 int err;
6473
6474 if (!control->final)
6475 return -EPROTO;
6476
6477 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6478
6479 chan->rx_state = L2CAP_RX_STATE_RECV;
6480 l2cap_process_reqseq(chan, control->reqseq);
6481
6482 if (!skb_queue_empty(&chan->tx_q))
6483 chan->tx_send_head = skb_peek(&chan->tx_q);
6484 else
6485 chan->tx_send_head = NULL;
6486
6487 /* Rewind next_tx_seq to the point expected
6488 * by the receiver.
6489 */
6490 chan->next_tx_seq = control->reqseq;
6491 chan->unacked_frames = 0;
6492
6493 if (chan->hs_hcon)
6494 chan->conn->mtu = chan->hs_hcon->hdev->block_mtu;
6495 else
6496 chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu;
6497
6498 err = l2cap_resegment(chan);
6499
6500 if (!err)
6501 err = l2cap_rx_state_recv(chan, control, skb, event);
6502
6503 return err;
6504}
6505
d2a7ac5d
MM		 6506static bool __valid_reqseq(struct l2cap_chan *chan, u16 reqseq)
6507{
6508 /* Make sure reqseq is for a packet that has been sent but not acked */
6509 u16 unacked;
6510
6511 unacked = __seq_offset(chan, chan->next_tx_seq, chan->expected_ack_seq);
6512 return __seq_offset(chan, chan->next_tx_seq, reqseq) <= unacked;
6513}
6514
cec8ab6e
MM		 6515static int l2cap_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
6516 struct sk_buff *skb, u8 event)
218bb9df 6517{
d2a7ac5d
MM		 6518 int err = 0;
6519
6520 BT_DBG("chan %p, control %p, skb %p, event %d, state %d", chan,
6521 control, skb, event, chan->rx_state);
6522
6523 if (__valid_reqseq(chan, control->reqseq)) {
6524 switch (chan->rx_state) {
6525 case L2CAP_RX_STATE_RECV:
6526 err = l2cap_rx_state_recv(chan, control, skb, event);
6527 break;
6528 case L2CAP_RX_STATE_SREJ_SENT:
6529 err = l2cap_rx_state_srej_sent(chan, control, skb,
6530 event);
6531 break;
32b32735
MM		 6532 case L2CAP_RX_STATE_WAIT_P:
6533 err = l2cap_rx_state_wait_p(chan, control, skb, event);
6534 break;
6535 case L2CAP_RX_STATE_WAIT_F:
6536 err = l2cap_rx_state_wait_f(chan, control, skb, event);
6537 break;
d2a7ac5d
MM		 6538 default:
6539 /* shut it down */
6540 break;
6541 }
6542 } else {
6543 BT_DBG("Invalid reqseq %d (next_tx_seq %d, expected_ack_seq %d",
6544 control->reqseq, chan->next_tx_seq,
6545 chan->expected_ack_seq);
5e4e3972 6546 l2cap_send_disconn_req(chan, ECONNRESET);
d2a7ac5d
MM		 6547 }
6548
6549 return err;
cec8ab6e
MM		 6550}
6551
6552static int l2cap_stream_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
6553 struct sk_buff *skb)
6554{
4b51dae9
MM		 6555 BT_DBG("chan %p, control %p, skb %p, state %d", chan, control, skb,
6556 chan->rx_state);
6557
6558 if (l2cap_classify_txseq(chan, control->txseq) ==
6559 L2CAP_TXSEQ_EXPECTED) {
6560 l2cap_pass_to_tx(chan, control);
6561
6562 BT_DBG("buffer_seq %d->%d", chan->buffer_seq,
6563 __next_seq(chan, chan->buffer_seq));
6564
6565 chan->buffer_seq = __next_seq(chan, chan->buffer_seq);
6566
6567 l2cap_reassemble_sdu(chan, skb, control);
6568 } else {
6569 if (chan->sdu) {
6570 kfree_skb(chan->sdu);
6571 chan->sdu = NULL;
6572 }
6573 chan->sdu_last_frag = NULL;
6574 chan->sdu_len = 0;
6575
6576 if (skb) {
6577 BT_DBG("Freeing %p", skb);
6578 kfree_skb(skb);
6579 }
6580 }
6581
6582 chan->last_acked_seq = control->txseq;
6583 chan->expected_tx_seq = __next_seq(chan, control->txseq);
6584
9a544210 6585 return 0;
cec8ab6e
MM		 6586}
6587
6588static int l2cap_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
6589{
a4368ff3 6590 struct l2cap_ctrl *control = &bt_cb(skb)->l2cap;
cec8ab6e
MM		 6591 u16 len;
6592 u8 event;
218bb9df 6593
b76bbd66
MM		 6594 __unpack_control(chan, skb);
6595
218bb9df
GP		 6596 len = skb->len;
6597
6598 /*
6599 * We can just drop the corrupted I-frame here.
6600 * Receiver will miss it and start proper recovery
cec8ab6e 6601 * procedures and ask for retransmission.
218bb9df 6602 */
47d1ec61 6603 if (l2cap_check_fcs(chan, skb))
218bb9df
GP		 6604 goto drop;
6605
cec8ab6e 6606 if (!control->sframe && control->sar == L2CAP_SAR_START)
03a51213 6607 len -= L2CAP_SDULEN_SIZE;
218bb9df 6608
47d1ec61 6609 if (chan->fcs == L2CAP_FCS_CRC16)
03a51213 6610 len -= L2CAP_FCS_SIZE;
218bb9df 6611
47d1ec61 6612 if (len > chan->mps) {
5e4e3972 6613 l2cap_send_disconn_req(chan, ECONNRESET);
218bb9df
GP		 6614 goto drop;
6615 }
6616
dbb50887
DB		 6617 if ((chan->mode == L2CAP_MODE_ERTM ||
6618 chan->mode == L2CAP_MODE_STREAMING) && sk_filter(chan->data, skb))
6619 goto drop;
6620
cec8ab6e
MM		 6621 if (!control->sframe) {
6622 int err;
218bb9df 6623
cec8ab6e
MM		 6624 BT_DBG("iframe sar %d, reqseq %d, final %d, txseq %d",
6625 control->sar, control->reqseq, control->final,
6626 control->txseq);
218bb9df 6627
cec8ab6e
MM		 6628 /* Validate F-bit - F=0 always valid, F=1 only
6629 * valid in TX WAIT_F
6630 */
6631 if (control->final && chan->tx_state != L2CAP_TX_STATE_WAIT_F)
218bb9df 6632 goto drop;
cec8ab6e
MM		 6633
6634 if (chan->mode != L2CAP_MODE_STREAMING) {
6635 event = L2CAP_EV_RECV_IFRAME;
6636 err = l2cap_rx(chan, control, skb, event);
6637 } else {
6638 err = l2cap_stream_rx(chan, control, skb);
218bb9df
GP		 6639 }
6640
cec8ab6e 6641 if (err)
5e4e3972 6642 l2cap_send_disconn_req(chan, ECONNRESET);
218bb9df 6643 } else {
cec8ab6e
MM		 6644 const u8 rx_func_to_event[4] = {
6645 L2CAP_EV_RECV_RR, L2CAP_EV_RECV_REJ,
6646 L2CAP_EV_RECV_RNR, L2CAP_EV_RECV_SREJ
6647 };
6648
6649 /* Only I-frames are expected in streaming mode */
6650 if (chan->mode == L2CAP_MODE_STREAMING)
6651 goto drop;
6652
6653 BT_DBG("sframe reqseq %d, final %d, poll %d, super %d",
6654 control->reqseq, control->final, control->poll,
6655 control->super);
6656
218bb9df 6657 if (len != 0) {
1bb166e6 6658 BT_ERR("Trailing bytes: %d in sframe", len);
5e4e3972 6659 l2cap_send_disconn_req(chan, ECONNRESET);
218bb9df
GP		 6660 goto drop;
6661 }
6662
cec8ab6e
MM		 6663 /* Validate F and P bits */
6664 if (control->final && (control->poll ||
6665 chan->tx_state != L2CAP_TX_STATE_WAIT_F))
6666 goto drop;
6667
6668 event = rx_func_to_event[control->super];
6669 if (l2cap_rx(chan, control, skb, event))
5e4e3972 6670 l2cap_send_disconn_req(chan, ECONNRESET);
218bb9df
GP		 6671 }
6672
6673 return 0;
6674
6675drop:
6676 kfree_skb(skb);
6677 return 0;
6678}
6679
b1c325c2
JH		 6680static void l2cap_chan_le_send_credits(struct l2cap_chan *chan)
6681{
6682 struct l2cap_conn *conn = chan->conn;
6683 struct l2cap_le_credits pkt;
6684 u16 return_credits;
6685
6686 /* We return more credits to the sender only after the amount of
6687 * credits falls below half of the initial amount.
6688 */
f15b8ecf 6689 if (chan->rx_credits >= (le_max_credits + 1) / 2)
b1c325c2
JH		 6690 return;
6691
f15b8ecf 6692 return_credits = le_max_credits - chan->rx_credits;
b1c325c2
JH		 6693
6694 BT_DBG("chan %p returning %u credits to sender", chan, return_credits);
6695
6696 chan->rx_credits += return_credits;
6697
6698 pkt.cid = cpu_to_le16(chan->scid);
6699 pkt.credits = cpu_to_le16(return_credits);
6700
6701 chan->ident = l2cap_get_ident(conn);
6702
6703 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CREDITS, sizeof(pkt), &pkt);
6704}
6705
fad5fc89
JH		 6706static int l2cap_le_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
6707{
aac23bf6
JH		 6708 int err;
6709
6710 if (!chan->rx_credits) {
6711 BT_ERR("No credits to receive LE L2CAP data");
dfd9774c 6712 l2cap_send_disconn_req(chan, ECONNRESET);
fad5fc89 6713 return -ENOBUFS;
aac23bf6 6714 }
fad5fc89 6715
aac23bf6
JH		 6716 if (chan->imtu < skb->len) {
6717 BT_ERR("Too big LE L2CAP PDU");
fad5fc89 6718 return -ENOBUFS;
aac23bf6 6719 }
fad5fc89
JH		 6720
6721 chan->rx_credits--;
6722 BT_DBG("rx_credits %u -> %u", chan->rx_credits + 1, chan->rx_credits);
6723
6724 l2cap_chan_le_send_credits(chan);
6725
aac23bf6
JH		 6726 err = 0;
6727
6728 if (!chan->sdu) {
6729 u16 sdu_len;
6730
6731 sdu_len = get_unaligned_le16(skb->data);
6732 skb_pull(skb, L2CAP_SDULEN_SIZE);
6733
6734 BT_DBG("Start of new SDU. sdu_len %u skb->len %u imtu %u",
6735 sdu_len, skb->len, chan->imtu);
6736
6737 if (sdu_len > chan->imtu) {
6738 BT_ERR("Too big LE L2CAP SDU length received");
6739 err = -EMSGSIZE;
6740 goto failed;
6741 }
6742
6743 if (skb->len > sdu_len) {
6744 BT_ERR("Too much LE L2CAP data received");
6745 err = -EINVAL;
6746 goto failed;
6747 }
6748
6749 if (skb->len == sdu_len)
6750 return chan->ops->recv(chan, skb);
6751
6752 chan->sdu = skb;
6753 chan->sdu_len = sdu_len;
6754 chan->sdu_last_frag = skb;
6755
6756 return 0;
6757 }
6758
6759 BT_DBG("SDU fragment. chan->sdu->len %u skb->len %u chan->sdu_len %u",
6760 chan->sdu->len, skb->len, chan->sdu_len);
6761
6762 if (chan->sdu->len + skb->len > chan->sdu_len) {
6763 BT_ERR("Too much LE L2CAP data received");
6764 err = -EINVAL;
6765 goto failed;
6766 }
6767
6768 append_skb_frag(chan->sdu, skb, &chan->sdu_last_frag);
6769 skb = NULL;
6770
6771 if (chan->sdu->len == chan->sdu_len) {
6772 err = chan->ops->recv(chan, chan->sdu);
6773 if (!err) {
6774 chan->sdu = NULL;
6775 chan->sdu_last_frag = NULL;
6776 chan->sdu_len = 0;
6777 }
6778 }
6779
6780failed:
6781 if (err) {
6782 kfree_skb(skb);
6783 kfree_skb(chan->sdu);
6784 chan->sdu = NULL;
6785 chan->sdu_last_frag = NULL;
6786 chan->sdu_len = 0;
6787 }
6788
6789 /* We can't return an error here since we took care of the skb
6790 * freeing internally. An error return would cause the caller to
6791 * do a double-free of the skb.
6792 */
6793 return 0;
fad5fc89
JH		 6794}
6795
13ca56e0
AE		 6796static void l2cap_data_channel(struct l2cap_conn *conn, u16 cid,
6797 struct sk_buff *skb)
1da177e4 6798{
48454079 6799 struct l2cap_chan *chan;
1da177e4 6800
baa7e1fa 6801 chan = l2cap_get_chan_by_scid(conn, cid);
48454079 6802 if (!chan) {
97e8e89d
AE		 6803 if (cid == L2CAP_CID_A2MP) {
6804 chan = a2mp_channel_create(conn, skb);
6805 if (!chan) {
6806 kfree_skb(skb);
13ca56e0 6807 return;
97e8e89d
AE		 6808 }
6809
6810 l2cap_chan_lock(chan);
6811 } else {
6812 BT_DBG("unknown cid 0x%4.4x", cid);
6813 /* Drop packet and return */
6814 kfree_skb(skb);
13ca56e0 6815 return;
97e8e89d 6816 }
1da177e4
LT		 6817 }
6818
49208c9c 6819 BT_DBG("chan %p, len %d", chan, skb->len);
1da177e4 6820
315917e0
JH		 6821 /* If we receive data on a fixed channel before the info req/rsp
6822 * procdure is done simply assume that the channel is supported
6823 * and mark it as ready.
6824 */
6825 if (chan->chan_type == L2CAP_CHAN_FIXED)
6826 l2cap_chan_ready(chan);
6827
89bc500e 6828 if (chan->state != BT_CONNECTED)
1da177e4
LT		 6829 goto drop;
6830
0c1bc5c6 6831 switch (chan->mode) {
38319713 6832 case L2CAP_MODE_LE_FLOWCTL:
fad5fc89
JH		 6833 if (l2cap_le_data_rcv(chan, skb) < 0)
6834 goto drop;
6835
6836 goto done;
6837
1c2acffb
GP		 6838 case L2CAP_MODE_BASIC:
6839 /* If socket recv buffers overflows we drop data here
6840 * which is *bad* because L2CAP has to be reliable.
6841 * But we don't have any other choice. L2CAP doesn't
6842 * provide flow control mechanism. */
1da177e4 6843
2c96e03d
SJ		 6844 if (chan->imtu < skb->len) {
6845 BT_ERR("Dropping L2CAP data: receive buffer overflow");
1c2acffb 6846 goto drop;
2c96e03d 6847 }
1da177e4 6848
80b98027 6849 if (!chan->ops->recv(chan, skb))
1c2acffb
GP		 6850 goto done;
6851 break;
6852
6853 case L2CAP_MODE_ERTM:
6840ed07 6854 case L2CAP_MODE_STREAMING:
cec8ab6e 6855 l2cap_data_rcv(chan, skb);
6840ed07
GP		 6856 goto done;
6857
1c2acffb 6858 default:
0c1bc5c6 6859 BT_DBG("chan %p: bad mode 0x%2.2x", chan, chan->mode);
1c2acffb
GP		 6860 break;
6861 }
1da177e4
LT		 6862
6863drop:
6864 kfree_skb(skb);
6865
6866done:
6be36555 6867 l2cap_chan_unlock(chan);
1da177e4
LT		 6868}
6869
84104b24
AE		 6870static void l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm,
6871 struct sk_buff *skb)
1da177e4 6872{
ae4fd2d3 6873 struct hci_conn *hcon = conn->hcon;
23691d75 6874 struct l2cap_chan *chan;
1da177e4 6875
ae4fd2d3 6876 if (hcon->type != ACL_LINK)
a24cce14 6877 goto free_skb;
ae4fd2d3 6878
bf20fd4e
JH		 6879 chan = l2cap_global_chan_by_psm(0, psm, &hcon->src, &hcon->dst,
6880 ACL_LINK);
23691d75 6881 if (!chan)
a24cce14 6882 goto free_skb;
1da177e4 6883
5b4cedaa 6884 BT_DBG("chan %p, len %d", chan, skb->len);
1da177e4 6885
89bc500e 6886 if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)
1da177e4
LT		 6887 goto drop;
6888
e13e21dc 6889 if (chan->imtu < skb->len)
1da177e4
LT		 6890 goto drop;
6891
2edf870d 6892 /* Store remote BD_ADDR and PSM for msg_name */
a4368ff3
JH		 6893 bacpy(&bt_cb(skb)->l2cap.bdaddr, &hcon->dst);
6894 bt_cb(skb)->l2cap.psm = psm;
2edf870d 6895
a24cce14
JH		 6896 if (!chan->ops->recv(chan, skb)) {
6897 l2cap_chan_put(chan);
84104b24 6898 return;
a24cce14 6899 }
1da177e4
LT		 6900
6901drop:
a24cce14
JH		 6902 l2cap_chan_put(chan);
6903free_skb:
1da177e4 6904 kfree_skb(skb);
1da177e4
LT		 6905}
6906
6907static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
6908{
6909 struct l2cap_hdr *lh = (void *) skb->data;
61a939c6 6910 struct hci_conn *hcon = conn->hcon;
8e036fc3
AV		 6911 u16 cid, len;
6912 __le16 psm;
1da177e4 6913
61a939c6
JH		 6914 if (hcon->state != BT_CONNECTED) {
6915 BT_DBG("queueing pending rx skb");
6916 skb_queue_tail(&conn->pending_rx, skb);
6917 return;
6918 }
6919
1da177e4
LT		 6920 skb_pull(skb, L2CAP_HDR_SIZE);
6921 cid = __le16_to_cpu(lh->cid);
6922 len = __le16_to_cpu(lh->len);
6923
1c2acffb
GP		 6924 if (len != skb->len) {
6925 kfree_skb(skb);
6926 return;
6927 }
6928
9e1d7e15
JH		 6929 /* Since we can't actively block incoming LE connections we must
6930 * at least ensure that we ignore incoming data from them.
6931 */
6932 if (hcon->type == LE_LINK &&
dcc36c16 6933 hci_bdaddr_list_lookup(&hcon->hdev->blacklist, &hcon->dst,
a250e048 6934 bdaddr_dst_type(hcon))) {
e493150e
JH		 6935 kfree_skb(skb);
6936 return;
6937 }
6938
1da177e4
LT		 6939 BT_DBG("len %d, cid 0x%4.4x", len, cid);
6940
6941 switch (cid) {
8db4dc46 6942 case L2CAP_CID_SIGNALING:
1da177e4
LT		 6943 l2cap_sig_channel(conn, skb);
6944 break;
6945
8db4dc46 6946 case L2CAP_CID_CONN_LESS:
097db76c 6947 psm = get_unaligned((__le16 *) skb->data);
0181a70f 6948 skb_pull(skb, L2CAP_PSMLEN_SIZE);
1da177e4
LT		 6949 l2cap_conless_channel(conn, psm, skb);
6950 break;
6951
a2877629
MH		 6952 case L2CAP_CID_LE_SIGNALING:
6953 l2cap_le_sig_channel(conn, skb);
6954 break;
6955
1da177e4
LT		 6956 default:
6957 l2cap_data_channel(conn, cid, skb);
6958 break;
6959 }
6960}
6961
61a939c6
JH		 6962static void process_pending_rx(struct work_struct *work)
6963{
6964 struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
6965 pending_rx_work);
6966 struct sk_buff *skb;
6967
6968 BT_DBG("");
6969
6970 while ((skb = skb_dequeue(&conn->pending_rx)))
6971 l2cap_recv_frame(conn, skb);
6972}
6973
162b49e7
JH		 6974static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon)
6975{
6976 struct l2cap_conn *conn = hcon->l2cap_data;
6977 struct hci_chan *hchan;
6978
6979 if (conn)
6980 return conn;
6981
6982 hchan = hci_chan_create(hcon);
6983 if (!hchan)
6984 return NULL;
6985
27f70f3e 6986 conn = kzalloc(sizeof(*conn), GFP_KERNEL);
162b49e7
JH		 6987 if (!conn) {
6988 hci_chan_del(hchan);
6989 return NULL;
6990 }
6991
6992 kref_init(&conn->ref);
6993 hcon->l2cap_data = conn;
51bb8457 6994 conn->hcon = hci_conn_get(hcon);
162b49e7
JH		 6995 conn->hchan = hchan;
6996
6997 BT_DBG("hcon %p conn %p hchan %p", hcon, conn, hchan);
6998
6999 switch (hcon->type) {
7000 case LE_LINK:
7001 if (hcon->hdev->le_mtu) {
7002 conn->mtu = hcon->hdev->le_mtu;
7003 break;
7004 }
7005 /* fall through */
7006 default:
7007 conn->mtu = hcon->hdev->acl_mtu;
7008 break;
7009 }
7010
7011 conn->feat_mask = 0;
7012
0bd49fc7
JH		 7013 conn->local_fixed_chan = L2CAP_FC_SIG_BREDR | L2CAP_FC_CONNLESS;
7014
7015 if (hcon->type == ACL_LINK &&
d7a5a11d 7016 hci_dev_test_flag(hcon->hdev, HCI_HS_ENABLED))
0bd49fc7 7017 conn->local_fixed_chan |= L2CAP_FC_A2MP;
162b49e7 7018
d7a5a11d 7019 if (hci_dev_test_flag(hcon->hdev, HCI_LE_ENABLED) &&
f9be9e86 7020 (bredr_sc_enabled(hcon->hdev) ||
b7cb93e5 7021 hci_dev_test_flag(hcon->hdev, HCI_FORCE_BREDR_SMP)))
b5ae344d
JH		 7022 conn->local_fixed_chan |= L2CAP_FC_SMP_BREDR;
7023
5a54e7c8 7024 mutex_init(&conn->ident_lock);
162b49e7
JH		 7025 mutex_init(&conn->chan_lock);
7026
7027 INIT_LIST_HEAD(&conn->chan_l);
7028 INIT_LIST_HEAD(&conn->users);
7029
276d8073 7030 INIT_DELAYED_WORK(&conn->info_timer, l2cap_info_timeout);
162b49e7 7031
61a939c6
JH		 7032 skb_queue_head_init(&conn->pending_rx);
7033 INIT_WORK(&conn->pending_rx_work, process_pending_rx);
f3d82d0c 7034 INIT_WORK(&conn->id_addr_update_work, l2cap_conn_update_id_addr);
61a939c6 7035
162b49e7
JH		 7036 conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
7037
7038 return conn;
7039}
7040
7041static bool is_valid_psm(u16 psm, u8 dst_type) {
7042 if (!psm)
7043 return false;
7044
7045 if (bdaddr_type_is_le(dst_type))
7046 return (psm <= 0x00ff);
7047
7048 /* PSM must be odd and lsb of upper byte must be 0 */
7049 return ((psm & 0x0101) == 0x0001);
7050}
7051
7052int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,
7053 bdaddr_t *dst, u8 dst_type)
7054{
7055 struct l2cap_conn *conn;
7056 struct hci_conn *hcon;
7057 struct hci_dev *hdev;
162b49e7
JH		 7058 int err;
7059
7060 BT_DBG("%pMR -> %pMR (type %u) psm 0x%2.2x", &chan->src, dst,
7061 dst_type, __le16_to_cpu(psm));
7062
7063 hdev = hci_get_route(dst, &chan->src);
7064 if (!hdev)
7065 return -EHOSTUNREACH;
7066
7067 hci_dev_lock(hdev);
7068
162b49e7
JH		 7069 if (!is_valid_psm(__le16_to_cpu(psm), dst_type) && !cid &&
7070 chan->chan_type != L2CAP_CHAN_RAW) {
7071 err = -EINVAL;
7072 goto done;
7073 }
7074
21626e62
JH		 7075 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED && !psm) {
7076 err = -EINVAL;
7077 goto done;
7078 }
7079
7080 if (chan->chan_type == L2CAP_CHAN_FIXED && !cid) {
162b49e7
JH		 7081 err = -EINVAL;
7082 goto done;
7083 }
7084
7085 switch (chan->mode) {
7086 case L2CAP_MODE_BASIC:
7087 break;
7088 case L2CAP_MODE_LE_FLOWCTL:
7089 l2cap_le_flowctl_init(chan);
7090 break;
7091 case L2CAP_MODE_ERTM:
7092 case L2CAP_MODE_STREAMING:
7093 if (!disable_ertm)
7094 break;
7095 /* fall through */
7096 default:
beb19e4c 7097 err = -EOPNOTSUPP;
162b49e7
JH		 7098 goto done;
7099 }
7100
7101 switch (chan->state) {
7102 case BT_CONNECT:
7103 case BT_CONNECT2:
7104 case BT_CONFIG:
7105 /* Already connecting */
7106 err = 0;
7107 goto done;
7108
7109 case BT_CONNECTED:
7110 /* Already connected */
7111 err = -EISCONN;
7112 goto done;
7113
7114 case BT_OPEN:
7115 case BT_BOUND:
7116 /* Can connect */
7117 break;
7118
7119 default:
7120 err = -EBADFD;
7121 goto done;
7122 }
7123
7124 /* Set destination address and psm */
7125 bacpy(&chan->dst, dst);
7126 chan->dst_type = dst_type;
7127
7128 chan->psm = psm;
7129 chan->dcid = cid;
7130
6f77d8c7
AG		 7131 if (bdaddr_type_is_le(dst_type)) {
7132 /* Convert from L2CAP channel address type to HCI address type
7133 */
7134 if (dst_type == BDADDR_LE_PUBLIC)
7135 dst_type = ADDR_LE_DEV_PUBLIC;
7136 else
7137 dst_type = ADDR_LE_DEV_RANDOM;
7138
d7a5a11d 7139 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
0ad06aa6
JH		 7140 hcon = hci_connect_le(hdev, dst, dst_type,
7141 chan->sec_level,
7142 HCI_LE_CONN_TIMEOUT,
7143 HCI_ROLE_SLAVE);
e804d25d 7144 else
0ad06aa6
JH		 7145 hcon = hci_connect_le_scan(hdev, dst, dst_type,
7146 chan->sec_level,
7147 HCI_LE_CONN_TIMEOUT);
cdd6275e 7148
6f77d8c7 7149 } else {
d93375a8 7150 u8 auth_type = l2cap_get_auth_type(chan);
04a6c589 7151 hcon = hci_connect_acl(hdev, dst, chan->sec_level, auth_type);
6f77d8c7 7152 }
162b49e7
JH		 7153
7154 if (IS_ERR(hcon)) {
7155 err = PTR_ERR(hcon);
7156 goto done;
7157 }
7158
7159 conn = l2cap_conn_add(hcon);
7160 if (!conn) {
7161 hci_conn_drop(hcon);
7162 err = -ENOMEM;
7163 goto done;
7164 }
7165
02e246ae
JH		 7166 mutex_lock(&conn->chan_lock);
7167 l2cap_chan_lock(chan);
7168
162b49e7
JH		 7169 if (cid && __l2cap_get_chan_by_dcid(conn, cid)) {
7170 hci_conn_drop(hcon);
7171 err = -EBUSY;
02e246ae 7172 goto chan_unlock;
162b49e7
JH		 7173 }
7174
7175 /* Update source addr of the socket */
7176 bacpy(&chan->src, &hcon->src);
a250e048 7177 chan->src_type = bdaddr_src_type(hcon);
162b49e7 7178
02e246ae 7179 __l2cap_chan_add(conn, chan);
162b49e7
JH		 7180
7181 /* l2cap_chan_add takes its own ref so we can drop this one */
7182 hci_conn_drop(hcon);
7183
7184 l2cap_state_change(chan, BT_CONNECT);
7185 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
7186
61202e4d
JH		 7187 /* Release chan->sport so that it can be reused by other
7188 * sockets (as it's only used for listening sockets).
7189 */
7190 write_lock(&chan_list_lock);
7191 chan->sport = 0;
7192 write_unlock(&chan_list_lock);
7193
162b49e7
JH		 7194 if (hcon->state == BT_CONNECTED) {
7195 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
7196 __clear_chan_timer(chan);
e7cafc45 7197 if (l2cap_chan_check_security(chan, true))
162b49e7
JH		 7198 l2cap_state_change(chan, BT_CONNECTED);
7199 } else
7200 l2cap_do_start(chan);
7201 }
7202
7203 err = 0;
7204
02e246ae 7205chan_unlock:
162b49e7 7206 l2cap_chan_unlock(chan);
02e246ae
JH		 7207 mutex_unlock(&conn->chan_lock);
7208done:
162b49e7
JH		 7209 hci_dev_unlock(hdev);
7210 hci_dev_put(hdev);
7211 return err;
7212}
6b8d4a6a 7213EXPORT_SYMBOL_GPL(l2cap_chan_connect);
162b49e7 7214
1da177e4
LT		 7215/* ---- L2CAP interface with lower layer (HCI) ---- */
7216
686ebf28 7217int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr)
1da177e4
LT		 7218{
7219 int exact = 0, lm1 = 0, lm2 = 0;
23691d75 7220 struct l2cap_chan *c;
1da177e4 7221
6ed93dc6 7222 BT_DBG("hdev %s, bdaddr %pMR", hdev->name, bdaddr);
1da177e4
LT		 7223
7224 /* Find listening sockets and check their link_mode */
23691d75
GP		 7225 read_lock(&chan_list_lock);
7226 list_for_each_entry(c, &chan_list, global_l) {
89bc500e 7227 if (c->state != BT_LISTEN)
1da177e4
LT		 7228 continue;
7229
7eafc59e 7230 if (!bacmp(&c->src, &hdev->bdaddr)) {
2af6b9d5 7231 lm1 |= HCI_LM_ACCEPT;
43bd0f32 7232 if (test_bit(FLAG_ROLE_SWITCH, &c->flags))
2af6b9d5 7233 lm1 |= HCI_LM_MASTER;
1da177e4 7234 exact++;
7eafc59e 7235 } else if (!bacmp(&c->src, BDADDR_ANY)) {
2af6b9d5 7236 lm2 |= HCI_LM_ACCEPT;
43bd0f32 7237 if (test_bit(FLAG_ROLE_SWITCH, &c->flags))
2af6b9d5
MH		 7238 lm2 |= HCI_LM_MASTER;
7239 }
1da177e4 7240 }
23691d75 7241 read_unlock(&chan_list_lock);
1da177e4
LT		 7242
7243 return exact ? lm1 : lm2;
7244}
7245
e760ec12
JH		 7246/* Find the next fixed channel in BT_LISTEN state, continue iteration
7247 * from an existing channel in the list or from the beginning of the
7248 * global list (by passing NULL as first parameter).
7249 */
7250static struct l2cap_chan *l2cap_global_fixed_chan(struct l2cap_chan *c,
327a7191 7251 struct hci_conn *hcon)
e760ec12 7252{
327a7191
JH		 7253 u8 src_type = bdaddr_src_type(hcon);
7254
e760ec12
JH		 7255 read_lock(&chan_list_lock);
7256
7257 if (c)
7258 c = list_next_entry(c, global_l);
7259 else
7260 c = list_entry(chan_list.next, typeof(*c), global_l);
7261
7262 list_for_each_entry_from(c, &chan_list, global_l) {
7263 if (c->chan_type != L2CAP_CHAN_FIXED)
7264 continue;
7265 if (c->state != BT_LISTEN)
7266 continue;
327a7191 7267 if (bacmp(&c->src, &hcon->src) && bacmp(&c->src, BDADDR_ANY))
54a1b626 7268 continue;
327a7191 7269 if (src_type != c->src_type)
54a1b626 7270 continue;
e760ec12
JH		 7271
7272 l2cap_chan_hold(c);
7273 read_unlock(&chan_list_lock);
7274 return c;
7275 }
7276
7277 read_unlock(&chan_list_lock);
7278
7279 return NULL;
7280}
7281
539c496d 7282static void l2cap_connect_cfm(struct hci_conn *hcon, u8 status)
1da177e4 7283{
e760ec12 7284 struct hci_dev *hdev = hcon->hdev;
0139418c 7285 struct l2cap_conn *conn;
e760ec12
JH		 7286 struct l2cap_chan *pchan;
7287 u8 dst_type;
0139418c 7288
539c496d
JH		 7289 if (hcon->type != ACL_LINK && hcon->type != LE_LINK)
7290 return;
7291
6ed93dc6 7292 BT_DBG("hcon %p bdaddr %pMR status %d", hcon, &hcon->dst, status);
1da177e4 7293
dc0f5088 7294 if (status) {
e175072f 7295 l2cap_conn_del(hcon, bt_to_errno(status));
dc0f5088 7296 return;
ba6fc317 7297 }
dc0f5088
JH		 7298
7299 conn = l2cap_conn_add(hcon);
7300 if (!conn)
7301 return;
7302
a250e048 7303 dst_type = bdaddr_dst_type(hcon);
e760ec12
JH		 7304
7305 /* If device is blocked, do not create channels for it */
7306 if (hci_bdaddr_list_lookup(&hdev->blacklist, &hcon->dst, dst_type))
7307 return;
7308
7309 /* Find fixed channels and notify them of the new connection. We
7310 * use multiple individual lookups, continuing each time where
7311 * we left off, because the list lock would prevent calling the
7312 * potentially sleeping l2cap_chan_lock() function.
7313 */
327a7191 7314 pchan = l2cap_global_fixed_chan(NULL, hcon);
e760ec12
JH		 7315 while (pchan) {
7316 struct l2cap_chan *chan, *next;
7317
7318 /* Client fixed channels should override server ones */
7319 if (__l2cap_get_chan_by_dcid(conn, pchan->scid))
7320 goto next;
7321
7322 l2cap_chan_lock(pchan);
7323 chan = pchan->ops->new_connection(pchan);
7324 if (chan) {
7325 bacpy(&chan->src, &hcon->src);
7326 bacpy(&chan->dst, &hcon->dst);
a250e048 7327 chan->src_type = bdaddr_src_type(hcon);
e760ec12
JH		 7328 chan->dst_type = dst_type;
7329
7330 __l2cap_chan_add(conn, chan);
7331 }
7332
7333 l2cap_chan_unlock(pchan);
7334next:
327a7191 7335 next = l2cap_global_fixed_chan(pchan, hcon);
e760ec12
JH		 7336 l2cap_chan_put(pchan);
7337 pchan = next;
7338 }
7339
dc0f5088 7340 l2cap_conn_ready(conn);
1da177e4
LT		 7341}
7342
686ebf28 7343int l2cap_disconn_ind(struct hci_conn *hcon)
2950f21a
MH		 7344{
7345 struct l2cap_conn *conn = hcon->l2cap_data;
7346
7347 BT_DBG("hcon %p", hcon);
7348
686ebf28 7349 if (!conn)
9f5a0d7b 7350 return HCI_ERROR_REMOTE_USER_TERM;
2950f21a
MH		 7351 return conn->disc_reason;
7352}
7353
3a6d576b 7354static void l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason)
1da177e4 7355{
3a6d576b
JH		 7356 if (hcon->type != ACL_LINK && hcon->type != LE_LINK)
7357 return;
7358
1da177e4
LT		 7359 BT_DBG("hcon %p reason %d", hcon, reason);
7360
e175072f 7361 l2cap_conn_del(hcon, bt_to_errno(reason));
1da177e4
LT		 7362}
7363
4343478f 7364static inline void l2cap_check_encryption(struct l2cap_chan *chan, u8 encrypt)
f62e4323 7365{
715ec005 7366 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED)
255c7601
MH		 7367 return;
7368
f62e4323 7369 if (encrypt == 0x00) {
4343478f 7370 if (chan->sec_level == BT_SECURITY_MEDIUM) {
ba13ccd9 7371 __set_chan_timer(chan, L2CAP_ENC_TIMEOUT);
7d513e92
MH		 7372 } else if (chan->sec_level == BT_SECURITY_HIGH ||
7373 chan->sec_level == BT_SECURITY_FIPS)
0f852724 7374 l2cap_chan_close(chan, ECONNREFUSED);
f62e4323 7375 } else {
4343478f 7376 if (chan->sec_level == BT_SECURITY_MEDIUM)
c9b66675 7377 __clear_chan_timer(chan);
f62e4323
MH		 7378 }
7379}
7380
354fe804 7381static void l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
1da177e4 7382{
0139418c 7383 struct l2cap_conn *conn = hcon->l2cap_data;
48454079 7384 struct l2cap_chan *chan;
1da177e4 7385
0139418c 7386 if (!conn)
354fe804 7387 return;
0139418c 7388
89d8b407 7389 BT_DBG("conn %p status 0x%2.2x encrypt %u", conn, status, encrypt);
1da177e4 7390
3df91ea2 7391 mutex_lock(&conn->chan_lock);
1da177e4 7392
3df91ea2 7393 list_for_each_entry(chan, &conn->chan_l, list) {
6be36555 7394 l2cap_chan_lock(chan);
1da177e4 7395
89d8b407
AE		 7396 BT_DBG("chan %p scid 0x%4.4x state %s", chan, chan->scid,
7397 state_to_string(chan->state));
f1cb9af5 7398
2338a7e0 7399 if (chan->scid == L2CAP_CID_A2MP) {
78eb2f98
AE		 7400 l2cap_chan_unlock(chan);
7401 continue;
7402 }
7403
191eb398
JH		 7404 if (!status && encrypt)
7405 chan->sec_level = hcon->sec_level;
f1cb9af5 7406
96eff46e 7407 if (!__l2cap_no_conn_pending(chan)) {
6be36555 7408 l2cap_chan_unlock(chan);
6a8d3010
MH		 7409 continue;
7410 }
7411
89bc500e 7412 if (!status && (chan->state == BT_CONNECTED ||
2d792818 7413 chan->state == BT_CONFIG)) {
d97c899b 7414 chan->ops->resume(chan);
4343478f 7415 l2cap_check_encryption(chan, encrypt);
6be36555 7416 l2cap_chan_unlock(chan);
9719f8af
MH		 7417 continue;
7418 }
7419
89bc500e 7420 if (chan->state == BT_CONNECT) {
6d3c15da 7421 if (!status)
93c3e8f5 7422 l2cap_start_connection(chan);
6d3c15da 7423 else
ba13ccd9 7424 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
fa37c1aa
JH		 7425 } else if (chan->state == BT_CONNECT2 &&
7426 chan->mode != L2CAP_MODE_LE_FLOWCTL) {
b1235d79 7427 struct l2cap_conn_rsp rsp;
df3c3931 7428 __u16 res, stat;
1da177e4 7429
b1235d79 7430 if (!status) {
bdc25783 7431 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
df3c3931
JH		 7432 res = L2CAP_CR_PEND;
7433 stat = L2CAP_CS_AUTHOR_PEND;
2dc4e510 7434 chan->ops->defer(chan);
df3c3931 7435 } else {
acdcabf5 7436 l2cap_state_change(chan, BT_CONFIG);
df3c3931
JH		 7437 res = L2CAP_CR_SUCCESS;
7438 stat = L2CAP_CS_NO_INFO;
7439 }
b1235d79 7440 } else {
acdcabf5 7441 l2cap_state_change(chan, BT_DISCONN);
ba13ccd9 7442 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
df3c3931
JH		 7443 res = L2CAP_CR_SEC_BLOCK;
7444 stat = L2CAP_CS_NO_INFO;
b1235d79
MH		 7445 }
7446
fe4128e0
GP		 7447 rsp.scid = cpu_to_le16(chan->dcid);
7448 rsp.dcid = cpu_to_le16(chan->scid);
df3c3931
JH		 7449 rsp.result = cpu_to_le16(res);
7450 rsp.status = cpu_to_le16(stat);
fc7f8a7e 7451 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
2d792818 7452 sizeof(rsp), &rsp);
2d369359
MM		 7453
7454 if (!test_bit(CONF_REQ_SENT, &chan->conf_state) &&
7455 res == L2CAP_CR_SUCCESS) {
7456 char buf[128];
7457 set_bit(CONF_REQ_SENT, &chan->conf_state);
7458 l2cap_send_cmd(conn, l2cap_get_ident(conn),
7459 L2CAP_CONF_REQ,
7460 l2cap_build_conf_req(chan, buf),
7461 buf);
7462 chan->num_conf_req++;
7463 }
b1235d79 7464 }
1da177e4 7465
6be36555 7466 l2cap_chan_unlock(chan);
1da177e4
LT		 7467 }
7468
3df91ea2 7469 mutex_unlock(&conn->chan_lock);
1da177e4
LT		 7470}
7471
9b4c3336 7472void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
1da177e4
LT		 7473{
7474 struct l2cap_conn *conn = hcon->l2cap_data;
d73a0988
AE		 7475 struct l2cap_hdr *hdr;
7476 int len;
1da177e4 7477
1d13a254 7478 /* For AMP controller do not create l2cap conn */
ca8bee5d 7479 if (!conn && hcon->hdev->dev_type != HCI_PRIMARY)
1d13a254 7480 goto drop;
1da177e4 7481
5a08ecce 7482 if (!conn)
baf43251 7483 conn = l2cap_conn_add(hcon);
5a08ecce
AE		 7484
7485 if (!conn)
1da177e4
LT		 7486 goto drop;
7487
7488 BT_DBG("conn %p len %d flags 0x%x", conn, skb->len, flags);
7489
d73a0988
AE		 7490 switch (flags) {
7491 case ACL_START:
7492 case ACL_START_NO_FLUSH:
7493 case ACL_COMPLETE:
1da177e4
LT		 7494 if (conn->rx_len) {
7495 BT_ERR("Unexpected start frame (len %d)", skb->len);
7496 kfree_skb(conn->rx_skb);
7497 conn->rx_skb = NULL;
7498 conn->rx_len = 0;
7499 l2cap_conn_unreliable(conn, ECOMM);
7500 }
7501
aae7fe22
AE		 7502 /* Start fragment always begin with Basic L2CAP header */
7503 if (skb->len < L2CAP_HDR_SIZE) {
1da177e4
LT		 7504 BT_ERR("Frame is too short (len %d)", skb->len);
7505 l2cap_conn_unreliable(conn, ECOMM);
7506 goto drop;
7507 }
7508
7509 hdr = (struct l2cap_hdr *) skb->data;
7510 len = __le16_to_cpu(hdr->len) + L2CAP_HDR_SIZE;
7511
7512 if (len == skb->len) {
7513 /* Complete frame received */
7514 l2cap_recv_frame(conn, skb);
9b4c3336 7515 return;
1da177e4
LT		 7516 }
7517
7518 BT_DBG("Start: total len %d, frag len %d", len, skb->len);
7519
7520 if (skb->len > len) {
7521 BT_ERR("Frame is too long (len %d, expected len %d)",
2d792818 7522 skb->len, len);
1da177e4
LT		 7523 l2cap_conn_unreliable(conn, ECOMM);
7524 goto drop;
7525 }
7526
7527 /* Allocate skb for the complete frame (with header) */
8bcde1f2 7528 conn->rx_skb = bt_skb_alloc(len, GFP_KERNEL);
af05b30b 7529 if (!conn->rx_skb)
1da177e4
LT		 7530 goto drop;
7531
d626f62b 7532 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
2d792818 7533 skb->len);
1da177e4 7534 conn->rx_len = len - skb->len;
d73a0988
AE		 7535 break;
7536
7537 case ACL_CONT:
1da177e4
LT		 7538 BT_DBG("Cont: frag len %d (expecting %d)", skb->len, conn->rx_len);
7539
7540 if (!conn->rx_len) {
7541 BT_ERR("Unexpected continuation frame (len %d)", skb->len);
7542 l2cap_conn_unreliable(conn, ECOMM);
7543 goto drop;
7544 }
7545
7546 if (skb->len > conn->rx_len) {
7547 BT_ERR("Fragment is too long (len %d, expected %d)",
2d792818 7548 skb->len, conn->rx_len);
1da177e4
LT		 7549 kfree_skb(conn->rx_skb);
7550 conn->rx_skb = NULL;
7551 conn->rx_len = 0;
7552 l2cap_conn_unreliable(conn, ECOMM);
7553 goto drop;
7554 }
7555
d626f62b 7556 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
2d792818 7557 skb->len);
1da177e4
LT		 7558 conn->rx_len -= skb->len;
7559
7560 if (!conn->rx_len) {
c4e5bafa
JH		 7561 /* Complete frame received. l2cap_recv_frame
7562 * takes ownership of the skb so set the global
7563 * rx_skb pointer to NULL first.
7564 */
7565 struct sk_buff *rx_skb = conn->rx_skb;
1da177e4 7566 conn->rx_skb = NULL;
c4e5bafa 7567 l2cap_recv_frame(conn, rx_skb);
1da177e4 7568 }
d73a0988 7569 break;
1da177e4
LT		 7570 }
7571
7572drop:
7573 kfree_skb(skb);
1da177e4
LT		 7574}
7575
354fe804
JH		 7576static struct hci_cb l2cap_cb = {
7577 .name = "L2CAP",
539c496d 7578 .connect_cfm = l2cap_connect_cfm,
3a6d576b 7579 .disconn_cfm = l2cap_disconn_cfm,
354fe804
JH		 7580 .security_cfm = l2cap_security_cfm,
7581};
7582
aef7d97c 7583static int l2cap_debugfs_show(struct seq_file *f, void *p)
1da177e4 7584{
23691d75 7585 struct l2cap_chan *c;
1da177e4 7586
333055f2 7587 read_lock(&chan_list_lock);
1da177e4 7588
23691d75 7589 list_for_each_entry(c, &chan_list, global_l) {
eeb5a067
MH		 7590 seq_printf(f, "%pMR (%u) %pMR (%u) %d %d 0x%4.4x 0x%4.4x %d %d %d %d\n",
7591 &c->src, c->src_type, &c->dst, c->dst_type,
fcb73338
AE		 7592 c->state, __le16_to_cpu(c->psm),
7593 c->scid, c->dcid, c->imtu, c->omtu,
7594 c->sec_level, c->mode);
61e1b4b7 7595 }
1da177e4 7596
333055f2 7597 read_unlock(&chan_list_lock);
1da177e4 7598
aef7d97c 7599 return 0;
1da177e4
LT		 7600}
7601
aef7d97c
MH		 7602static int l2cap_debugfs_open(struct inode *inode, struct file *file)
7603{
7604 return single_open(file, l2cap_debugfs_show, inode->i_private);
7605}
7606
7607static const struct file_operations l2cap_debugfs_fops = {
7608 .open = l2cap_debugfs_open,
7609 .read = seq_read,
7610 .llseek = seq_lseek,
7611 .release = single_release,
7612};
7613
7614static struct dentry *l2cap_debugfs;
1da177e4 7615
64274518 7616int __init l2cap_init(void)
1da177e4
LT		 7617{
7618 int err;
be9d1227 7619
bb58f747 7620 err = l2cap_init_sockets();
1da177e4
LT		 7621 if (err < 0)
7622 return err;
7623
354fe804
JH		 7624 hci_register_cb(&l2cap_cb);
7625
1120e4bf
MH		 7626 if (IS_ERR_OR_NULL(bt_debugfs))
7627 return 0;
7628
7629 l2cap_debugfs = debugfs_create_file("l2cap", 0444, bt_debugfs,
7630 NULL, &l2cap_debugfs_fops);
1da177e4 7631
40b9397a 7632 debugfs_create_u16("l2cap_le_max_credits", 0644, bt_debugfs,
f15b8ecf 7633 &le_max_credits);
40b9397a 7634 debugfs_create_u16("l2cap_le_default_mps", 0644, bt_debugfs,
f15b8ecf
JH		 7635 &le_default_mps);
7636
1da177e4 7637 return 0;
1da177e4
LT		 7638}
7639
64274518 7640void l2cap_exit(void)
1da177e4 7641{
aef7d97c 7642 debugfs_remove(l2cap_debugfs);
354fe804 7643 hci_unregister_cb(&l2cap_cb);
bb58f747 7644 l2cap_cleanup_sockets();
1da177e4
LT		 7645}
7646
d1c4a17d
GP		 7647module_param(disable_ertm, bool, 0644);
7648MODULE_PARM_DESC(disable_ertm, "Disable enhanced retransmission mode");
Linux kernel - Deliverables
This page took 2.121267 seconds and 5 git commands to generate.