1/*
   2   BlueZ - Bluetooth protocol stack for Linux
   3   Copyright (C) 2000-2001 Qualcomm Incorporated
   4   Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
   5   Copyright (C) 2010 Google Inc.
   6   Copyright (C) 2011 ProFUSION Embedded Systems
   7   Copyright (c) 2012 Code Aurora Forum.  All rights reserved.
   8
   9   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
  10
  11   This program is free software; you can redistribute it and/or modify
  12   it under the terms of the GNU General Public License version 2 as
  13   published by the Free Software Foundation;
  14
  15   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  16   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  17   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  18   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  19   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  20   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  21   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  22   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  23
  24   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  25   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  26   SOFTWARE IS DISCLAIMED.
  27*/
  28
  29/* Bluetooth L2CAP core. */
  30
  31#include <linux/module.h>
  32
  33#include <linux/types.h>
  34#include <linux/capability.h>
  35#include <linux/errno.h>
  36#include <linux/kernel.h>
  37#include <linux/sched.h>
  38#include <linux/slab.h>
  39#include <linux/poll.h>
  40#include <linux/fcntl.h>
  41#include <linux/init.h>
  42#include <linux/interrupt.h>
  43#include <linux/socket.h>
  44#include <linux/skbuff.h>
  45#include <linux/list.h>
  46#include <linux/device.h>
  47#include <linux/debugfs.h>
  48#include <linux/seq_file.h>
  49#include <linux/uaccess.h>
  50#include <linux/crc16.h>
  51#include <net/sock.h>
  52
  53#include <asm/unaligned.h>
  54
  55#include <net/bluetooth/bluetooth.h>
  56#include <net/bluetooth/hci_core.h>
  57#include <net/bluetooth/l2cap.h>
  58#include <net/bluetooth/smp.h>
 
 
 
 
 
  59
  60bool disable_ertm;
  61
  62static u32 l2cap_feat_mask = L2CAP_FEAT_FIXED_CHAN;
  63static u8 l2cap_fixed_chan[8] = { L2CAP_FC_L2CAP, };
  64
  65static LIST_HEAD(chan_list);
  66static DEFINE_RWLOCK(chan_list_lock);
  67
 
 
 
  68static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
  69				u8 code, u8 ident, u16 dlen, void *data);
  70static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
  71								void *data);
  72static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data);
  73static void l2cap_send_disconn_req(struct l2cap_conn *conn,
  74				   struct l2cap_chan *chan, int err);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
  75
  76/* ---- L2CAP channels ---- */
  77
  78static struct l2cap_chan *__l2cap_get_chan_by_dcid(struct l2cap_conn *conn, u16 cid)
 
  79{
  80	struct l2cap_chan *c;
  81
  82	list_for_each_entry(c, &conn->chan_l, list) {
  83		if (c->dcid == cid)
  84			return c;
  85	}
  86	return NULL;
  87}
  88
  89static struct l2cap_chan *__l2cap_get_chan_by_scid(struct l2cap_conn *conn, u16 cid)
 
  90{
  91	struct l2cap_chan *c;
  92
  93	list_for_each_entry(c, &conn->chan_l, list) {
  94		if (c->scid == cid)
  95			return c;
  96	}
  97	return NULL;
  98}
  99
 100/* Find channel with given SCID.
 101 * Returns locked channel. */
 102static struct l2cap_chan *l2cap_get_chan_by_scid(struct l2cap_conn *conn, u16 cid)
 
 103{
 104	struct l2cap_chan *c;
 105
 106	mutex_lock(&conn->chan_lock);
 107	c = __l2cap_get_chan_by_scid(conn, cid);
 108	if (c)
 109		l2cap_chan_lock(c);
 110	mutex_unlock(&conn->chan_lock);
 111
 112	return c;
 113}
 114
 115static struct l2cap_chan *__l2cap_get_chan_by_ident(struct l2cap_conn *conn, u8 ident)
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 116{
 117	struct l2cap_chan *c;
 118
 119	list_for_each_entry(c, &conn->chan_l, list) {
 120		if (c->ident == ident)
 121			return c;
 122	}
 123	return NULL;
 124}
 125
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 126static struct l2cap_chan *__l2cap_global_chan_by_addr(__le16 psm, bdaddr_t *src)
 127{
 128	struct l2cap_chan *c;
 129
 130	list_for_each_entry(c, &chan_list, global_l) {
 131		if (c->sport == psm && !bacmp(&bt_sk(c->sk)->src, src))
 132			return c;
 133	}
 134	return NULL;
 135}
 136
 137int l2cap_add_psm(struct l2cap_chan *chan, bdaddr_t *src, __le16 psm)
 138{
 139	int err;
 140
 141	write_lock(&chan_list_lock);
 142
 143	if (psm && __l2cap_global_chan_by_addr(psm, src)) {
 144		err = -EADDRINUSE;
 145		goto done;
 146	}
 147
 148	if (psm) {
 149		chan->psm = psm;
 150		chan->sport = psm;
 151		err = 0;
 152	} else {
 153		u16 p;
 
 
 
 
 
 
 
 
 
 
 154
 155		err = -EINVAL;
 156		for (p = 0x1001; p < 0x1100; p += 2)
 157			if (!__l2cap_global_chan_by_addr(cpu_to_le16(p), src)) {
 158				chan->psm   = cpu_to_le16(p);
 159				chan->sport = cpu_to_le16(p);
 160				err = 0;
 161				break;
 162			}
 163	}
 164
 165done:
 166	write_unlock(&chan_list_lock);
 167	return err;
 168}
 
 169
 170int l2cap_add_scid(struct l2cap_chan *chan,  __u16 scid)
 171{
 172	write_lock(&chan_list_lock);
 173
 
 
 
 
 174	chan->scid = scid;
 175
 176	write_unlock(&chan_list_lock);
 177
 178	return 0;
 179}
 180
 181static u16 l2cap_alloc_cid(struct l2cap_conn *conn)
 182{
 183	u16 cid = L2CAP_CID_DYN_START;
 
 
 
 
 
 184
 185	for (; cid < L2CAP_CID_DYN_END; cid++) {
 186		if (!__l2cap_get_chan_by_scid(conn, cid))
 187			return cid;
 188	}
 189
 190	return 0;
 191}
 192
 193static void __l2cap_state_change(struct l2cap_chan *chan, int state)
 194{
 195	BT_DBG("chan %p %s -> %s", chan, state_to_string(chan->state),
 196						state_to_string(state));
 197
 198	chan->state = state;
 199	chan->ops->state_change(chan->data, state);
 200}
 201
 202static void l2cap_state_change(struct l2cap_chan *chan, int state)
 
 203{
 204	struct sock *sk = chan->sk;
 
 
 205
 206	lock_sock(sk);
 207	__l2cap_state_change(chan, state);
 208	release_sock(sk);
 209}
 210
 211static inline void __l2cap_chan_set_err(struct l2cap_chan *chan, int err)
 212{
 213	struct sock *sk = chan->sk;
 
 
 
 
 
 214
 215	sk->sk_err = err;
 
 
 
 
 
 
 216}
 217
 218static inline void l2cap_chan_set_err(struct l2cap_chan *chan, int err)
 
 219{
 220	struct sock *sk = chan->sk;
 221
 222	lock_sock(sk);
 223	__l2cap_chan_set_err(chan, err);
 224	release_sock(sk);
 
 
 
 225}
 226
 227/* ---- L2CAP sequence number lists ---- */
 228
 229/* For ERTM, ordered lists of sequence numbers must be tracked for
 230 * SREJ requests that are received and for frames that are to be
 231 * retransmitted. These seq_list functions implement a singly-linked
 232 * list in an array, where membership in the list can also be checked
 233 * in constant time. Items can also be added to the tail of the list
 234 * and removed from the head in constant time, without further memory
 235 * allocs or frees.
 236 */
 237
 238static int l2cap_seq_list_init(struct l2cap_seq_list *seq_list, u16 size)
 239{
 240	size_t alloc_size, i;
 241
 242	/* Allocated size is a power of 2 to map sequence numbers
 243	 * (which may be up to 14 bits) in to a smaller array that is
 244	 * sized for the negotiated ERTM transmit windows.
 245	 */
 246	alloc_size = roundup_pow_of_two(size);
 247
 248	seq_list->list = kmalloc(sizeof(u16) * alloc_size, GFP_KERNEL);
 249	if (!seq_list->list)
 250		return -ENOMEM;
 251
 252	seq_list->mask = alloc_size - 1;
 253	seq_list->head = L2CAP_SEQ_LIST_CLEAR;
 254	seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
 255	for (i = 0; i < alloc_size; i++)
 256		seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR;
 257
 258	return 0;
 259}
 260
 261static inline void l2cap_seq_list_free(struct l2cap_seq_list *seq_list)
 262{
 263	kfree(seq_list->list);
 264}
 265
 266static inline bool l2cap_seq_list_contains(struct l2cap_seq_list *seq_list,
 267					   u16 seq)
 268{
 269	/* Constant-time check for list membership */
 270	return seq_list->list[seq & seq_list->mask] != L2CAP_SEQ_LIST_CLEAR;
 271}
 272
 273static u16 l2cap_seq_list_remove(struct l2cap_seq_list *seq_list, u16 seq)
 274{
 
 275	u16 mask = seq_list->mask;
 276
 277	if (seq_list->head == L2CAP_SEQ_LIST_CLEAR) {
 278		/* In case someone tries to pop the head of an empty list */
 279		return L2CAP_SEQ_LIST_CLEAR;
 280	} else if (seq_list->head == seq) {
 281		/* Head can be removed in constant time */
 282		seq_list->head = seq_list->list[seq & mask];
 283		seq_list->list[seq & mask] = L2CAP_SEQ_LIST_CLEAR;
 284
 285		if (seq_list->head == L2CAP_SEQ_LIST_TAIL) {
 286			seq_list->head = L2CAP_SEQ_LIST_CLEAR;
 287			seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
 288		}
 289	} else {
 290		/* Walk the list to find the sequence number */
 291		u16 prev = seq_list->head;
 292		while (seq_list->list[prev & mask] != seq) {
 293			prev = seq_list->list[prev & mask];
 294			if (prev == L2CAP_SEQ_LIST_TAIL)
 295				return L2CAP_SEQ_LIST_CLEAR;
 296		}
 297
 298		/* Unlink the number from the list and clear it */
 299		seq_list->list[prev & mask] = seq_list->list[seq & mask];
 300		seq_list->list[seq & mask] = L2CAP_SEQ_LIST_CLEAR;
 301		if (seq_list->tail == seq)
 302			seq_list->tail = prev;
 303	}
 304	return seq;
 305}
 306
 307static inline u16 l2cap_seq_list_pop(struct l2cap_seq_list *seq_list)
 308{
 309	/* Remove the head in constant time */
 310	return l2cap_seq_list_remove(seq_list, seq_list->head);
 311}
 312
 313static void l2cap_seq_list_clear(struct l2cap_seq_list *seq_list)
 314{
 315	u16 i;
 316
 317	if (seq_list->head == L2CAP_SEQ_LIST_CLEAR)
 318		return;
 319
 320	for (i = 0; i <= seq_list->mask; i++)
 321		seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR;
 322
 323	seq_list->head = L2CAP_SEQ_LIST_CLEAR;
 324	seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
 325}
 326
 327static void l2cap_seq_list_append(struct l2cap_seq_list *seq_list, u16 seq)
 328{
 329	u16 mask = seq_list->mask;
 330
 331	/* All appends happen in constant time */
 332
 333	if (seq_list->list[seq & mask] != L2CAP_SEQ_LIST_CLEAR)
 334		return;
 335
 336	if (seq_list->tail == L2CAP_SEQ_LIST_CLEAR)
 337		seq_list->head = seq;
 338	else
 339		seq_list->list[seq_list->tail & mask] = seq;
 340
 341	seq_list->tail = seq;
 342	seq_list->list[seq & mask] = L2CAP_SEQ_LIST_TAIL;
 343}
 344
 345static void l2cap_chan_timeout(struct work_struct *work)
 346{
 347	struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
 348							chan_timer.work);
 349	struct l2cap_conn *conn = chan->conn;
 350	int reason;
 351
 352	BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
 353
 354	mutex_lock(&conn->chan_lock);
 355	l2cap_chan_lock(chan);
 356
 357	if (chan->state == BT_CONNECTED || chan->state == BT_CONFIG)
 358		reason = ECONNREFUSED;
 359	else if (chan->state == BT_CONNECT &&
 360					chan->sec_level != BT_SECURITY_SDP)
 361		reason = ECONNREFUSED;
 362	else
 363		reason = ETIMEDOUT;
 364
 365	l2cap_chan_close(chan, reason);
 366
 367	l2cap_chan_unlock(chan);
 368
 369	chan->ops->close(chan->data);
 370	mutex_unlock(&conn->chan_lock);
 371
 372	l2cap_chan_put(chan);
 373}
 374
 375struct l2cap_chan *l2cap_chan_create(void)
 376{
 377	struct l2cap_chan *chan;
 378
 379	chan = kzalloc(sizeof(*chan), GFP_ATOMIC);
 380	if (!chan)
 381		return NULL;
 382
 383	mutex_init(&chan->lock);
 384
 
 
 
 385	write_lock(&chan_list_lock);
 386	list_add(&chan->global_l, &chan_list);
 387	write_unlock(&chan_list_lock);
 388
 389	INIT_DELAYED_WORK(&chan->chan_timer, l2cap_chan_timeout);
 390
 391	chan->state = BT_OPEN;
 392
 393	atomic_set(&chan->refcnt, 1);
 
 
 
 394
 395	BT_DBG("chan %p", chan);
 396
 397	return chan;
 398}
 
 399
 400void l2cap_chan_destroy(struct l2cap_chan *chan)
 401{
 
 
 
 
 402	write_lock(&chan_list_lock);
 403	list_del(&chan->global_l);
 404	write_unlock(&chan_list_lock);
 405
 406	l2cap_chan_put(chan);
 
 
 
 
 
 
 
 407}
 408
 
 
 
 
 
 
 
 
 409void l2cap_chan_set_defaults(struct l2cap_chan *chan)
 410{
 411	chan->fcs  = L2CAP_FCS_CRC16;
 412	chan->max_tx = L2CAP_DEFAULT_MAX_TX;
 413	chan->tx_win = L2CAP_DEFAULT_TX_WINDOW;
 414	chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
 
 
 
 415	chan->sec_level = BT_SECURITY_LOW;
 
 
 
 
 416
 417	set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
 418}
 
 
 
 
 
 
 
 
 
 
 
 
 
 419
 420static void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
 421{
 422	BT_DBG("conn %p, psm 0x%2.2x, dcid 0x%4.4x", conn,
 423	       __le16_to_cpu(chan->psm), chan->dcid);
 424
 425	conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
 426
 427	chan->conn = conn;
 428
 429	switch (chan->chan_type) {
 430	case L2CAP_CHAN_CONN_ORIENTED:
 431		if (conn->hcon->type == LE_LINK) {
 432			/* LE connection */
 433			chan->omtu = L2CAP_LE_DEFAULT_MTU;
 434			chan->scid = L2CAP_CID_LE_DATA;
 435			chan->dcid = L2CAP_CID_LE_DATA;
 436		} else {
 437			/* Alloc CID for connection-oriented socket */
 438			chan->scid = l2cap_alloc_cid(conn);
 439			chan->omtu = L2CAP_DEFAULT_MTU;
 440		}
 441		break;
 442
 443	case L2CAP_CHAN_CONN_LESS:
 444		/* Connectionless socket */
 445		chan->scid = L2CAP_CID_CONN_LESS;
 446		chan->dcid = L2CAP_CID_CONN_LESS;
 447		chan->omtu = L2CAP_DEFAULT_MTU;
 448		break;
 449
 
 
 
 
 450	default:
 451		/* Raw socket can send/recv signalling messages only */
 452		chan->scid = L2CAP_CID_SIGNALING;
 453		chan->dcid = L2CAP_CID_SIGNALING;
 454		chan->omtu = L2CAP_DEFAULT_MTU;
 455	}
 456
 457	chan->local_id		= L2CAP_BESTEFFORT_ID;
 458	chan->local_stype	= L2CAP_SERV_BESTEFFORT;
 459	chan->local_msdu	= L2CAP_DEFAULT_MAX_SDU_SIZE;
 460	chan->local_sdu_itime	= L2CAP_DEFAULT_SDU_ITIME;
 461	chan->local_acc_lat	= L2CAP_DEFAULT_ACC_LAT;
 462	chan->local_flush_to	= L2CAP_DEFAULT_FLUSH_TO;
 463
 464	l2cap_chan_hold(chan);
 465
 
 
 
 
 
 466	list_add(&chan->list, &conn->chan_l);
 467}
 468
 469static void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
 470{
 471	mutex_lock(&conn->chan_lock);
 472	__l2cap_chan_add(conn, chan);
 473	mutex_unlock(&conn->chan_lock);
 474}
 475
 476static void l2cap_chan_del(struct l2cap_chan *chan, int err)
 477{
 478	struct sock *sk = chan->sk;
 479	struct l2cap_conn *conn = chan->conn;
 480	struct sock *parent = bt_sk(sk)->parent;
 481
 482	__clear_chan_timer(chan);
 483
 484	BT_DBG("chan %p, conn %p, err %d", chan, conn, err);
 
 
 
 485
 486	if (conn) {
 
 487		/* Delete from channel list */
 488		list_del(&chan->list);
 489
 490		l2cap_chan_put(chan);
 491
 492		chan->conn = NULL;
 493		hci_conn_put(conn->hcon);
 494	}
 495
 496	lock_sock(sk);
 497
 498	__l2cap_state_change(chan, BT_CLOSED);
 499	sock_set_flag(sk, SOCK_ZAPPED);
 
 
 
 
 
 500
 501	if (err)
 502		__l2cap_chan_set_err(chan, err);
 
 503
 504	if (parent) {
 505		bt_accept_unlink(sk);
 506		parent->sk_data_ready(parent, 0);
 507	} else
 508		sk->sk_state_change(sk);
 509
 510	release_sock(sk);
 
 
 511
 512	if (!(test_bit(CONF_OUTPUT_DONE, &chan->conf_state) &&
 513			test_bit(CONF_INPUT_DONE, &chan->conf_state)))
 514		return;
 515
 516	skb_queue_purge(&chan->tx_q);
 
 
 517
 518	if (chan->mode == L2CAP_MODE_ERTM) {
 519		struct srej_list *l, *tmp;
 
 520
 
 521		__clear_retrans_timer(chan);
 522		__clear_monitor_timer(chan);
 523		__clear_ack_timer(chan);
 524
 525		skb_queue_purge(&chan->srej_q);
 526
 527		l2cap_seq_list_free(&chan->srej_list);
 528		l2cap_seq_list_free(&chan->retrans_list);
 529		list_for_each_entry_safe(l, tmp, &chan->srej_l, list) {
 530			list_del(&l->list);
 531			kfree(l);
 532		}
 
 
 533	}
 
 
 534}
 
 535
 536static void l2cap_chan_cleanup_listen(struct sock *parent)
 537{
 538	struct sock *sk;
 539
 540	BT_DBG("parent %p", parent);
 
 541
 542	/* Close not yet accepted channels */
 543	while ((sk = bt_accept_dequeue(parent, NULL))) {
 544		struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 545
 
 546		l2cap_chan_lock(chan);
 547		__clear_chan_timer(chan);
 548		l2cap_chan_close(chan, ECONNRESET);
 549		l2cap_chan_unlock(chan);
 550
 551		chan->ops->close(chan->data);
 552	}
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 553}
 554
 555void l2cap_chan_close(struct l2cap_chan *chan, int reason)
 556{
 557	struct l2cap_conn *conn = chan->conn;
 558	struct sock *sk = chan->sk;
 559
 560	BT_DBG("chan %p state %s sk %p", chan,
 561					state_to_string(chan->state), sk);
 562
 563	switch (chan->state) {
 564	case BT_LISTEN:
 565		lock_sock(sk);
 566		l2cap_chan_cleanup_listen(sk);
 567
 568		__l2cap_state_change(chan, BT_CLOSED);
 569		sock_set_flag(sk, SOCK_ZAPPED);
 570		release_sock(sk);
 571		break;
 572
 573	case BT_CONNECTED:
 574	case BT_CONFIG:
 575		if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED &&
 576					conn->hcon->type == ACL_LINK) {
 577			__set_chan_timer(chan, sk->sk_sndtimeo);
 578			l2cap_send_disconn_req(conn, chan, reason);
 579		} else
 580			l2cap_chan_del(chan, reason);
 581		break;
 582
 583	case BT_CONNECT2:
 584		if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED &&
 585					conn->hcon->type == ACL_LINK) {
 586			struct l2cap_conn_rsp rsp;
 587			__u16 result;
 588
 589			if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))
 590				result = L2CAP_CR_SEC_BLOCK;
 591			else
 592				result = L2CAP_CR_BAD_PSM;
 593			l2cap_state_change(chan, BT_DISCONN);
 594
 595			rsp.scid   = cpu_to_le16(chan->dcid);
 596			rsp.dcid   = cpu_to_le16(chan->scid);
 597			rsp.result = cpu_to_le16(result);
 598			rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
 599			l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
 600							sizeof(rsp), &rsp);
 601		}
 602
 603		l2cap_chan_del(chan, reason);
 604		break;
 605
 606	case BT_CONNECT:
 607	case BT_DISCONN:
 608		l2cap_chan_del(chan, reason);
 609		break;
 610
 611	default:
 612		lock_sock(sk);
 613		sock_set_flag(sk, SOCK_ZAPPED);
 614		release_sock(sk);
 615		break;
 616	}
 617}
 
 618
 619static inline u8 l2cap_get_auth_type(struct l2cap_chan *chan)
 620{
 621	if (chan->chan_type == L2CAP_CHAN_RAW) {
 
 622		switch (chan->sec_level) {
 623		case BT_SECURITY_HIGH:
 
 624			return HCI_AT_DEDICATED_BONDING_MITM;
 625		case BT_SECURITY_MEDIUM:
 626			return HCI_AT_DEDICATED_BONDING;
 627		default:
 628			return HCI_AT_NO_BONDING;
 629		}
 630	} else if (chan->psm == cpu_to_le16(0x0001)) {
 631		if (chan->sec_level == BT_SECURITY_LOW)
 632			chan->sec_level = BT_SECURITY_SDP;
 633
 634		if (chan->sec_level == BT_SECURITY_HIGH)
 
 
 
 635			return HCI_AT_NO_BONDING_MITM;
 636		else
 637			return HCI_AT_NO_BONDING;
 638	} else {
 
 
 
 
 
 
 
 
 
 
 
 
 
 639		switch (chan->sec_level) {
 640		case BT_SECURITY_HIGH:
 
 641			return HCI_AT_GENERAL_BONDING_MITM;
 642		case BT_SECURITY_MEDIUM:
 643			return HCI_AT_GENERAL_BONDING;
 644		default:
 645			return HCI_AT_NO_BONDING;
 646		}
 
 647	}
 648}
 649
 650/* Service level security */
 651int l2cap_chan_check_security(struct l2cap_chan *chan)
 652{
 653	struct l2cap_conn *conn = chan->conn;
 654	__u8 auth_type;
 655
 
 
 
 656	auth_type = l2cap_get_auth_type(chan);
 657
 658	return hci_conn_security(conn->hcon, chan->sec_level, auth_type);
 
 659}
 660
 661static u8 l2cap_get_ident(struct l2cap_conn *conn)
 662{
 663	u8 id;
 664
 665	/* Get next available identificator.
 666	 *    1 - 128 are used by kernel.
 667	 *  129 - 199 are reserved.
 668	 *  200 - 254 are used by utilities like l2ping, etc.
 669	 */
 670
 671	spin_lock(&conn->lock);
 672
 673	if (++conn->tx_ident > 128)
 674		conn->tx_ident = 1;
 675
 676	id = conn->tx_ident;
 677
 678	spin_unlock(&conn->lock);
 679
 680	return id;
 681}
 682
 683static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, void *data)
 
 684{
 685	struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data);
 686	u8 flags;
 687
 688	BT_DBG("code 0x%2.2x", code);
 689
 690	if (!skb)
 691		return;
 692
 693	if (lmp_no_flush_capable(conn->hcon->hdev))
 
 
 
 694		flags = ACL_START_NO_FLUSH;
 695	else
 696		flags = ACL_START;
 697
 698	bt_cb(skb)->force_active = BT_POWER_FORCE_ACTIVE_ON;
 699	skb->priority = HCI_PRIO_MAX;
 700
 701	hci_send_acl(conn->hchan, skb, flags);
 702}
 703
 
 
 
 
 
 
 704static void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb)
 705{
 706	struct hci_conn *hcon = chan->conn->hcon;
 707	u16 flags;
 708
 709	BT_DBG("chan %p, skb %p len %d priority %u", chan, skb, skb->len,
 710							skb->priority);
 711
 712	if (!test_bit(FLAG_FLUSHABLE, &chan->flags) &&
 713					lmp_no_flush_capable(hcon->hdev))
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 714		flags = ACL_START_NO_FLUSH;
 715	else
 716		flags = ACL_START;
 717
 718	bt_cb(skb)->force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
 719	hci_send_acl(chan->conn->hchan, skb, flags);
 720}
 721
 722static void __unpack_enhanced_control(u16 enh, struct l2cap_ctrl *control)
 723{
 724	control->reqseq = (enh & L2CAP_CTRL_REQSEQ) >> L2CAP_CTRL_REQSEQ_SHIFT;
 725	control->final = (enh & L2CAP_CTRL_FINAL) >> L2CAP_CTRL_FINAL_SHIFT;
 726
 727	if (enh & L2CAP_CTRL_FRAME_TYPE) {
 728		/* S-Frame */
 729		control->sframe = 1;
 730		control->poll = (enh & L2CAP_CTRL_POLL) >> L2CAP_CTRL_POLL_SHIFT;
 731		control->super = (enh & L2CAP_CTRL_SUPERVISE) >> L2CAP_CTRL_SUPER_SHIFT;
 732
 733		control->sar = 0;
 734		control->txseq = 0;
 735	} else {
 736		/* I-Frame */
 737		control->sframe = 0;
 738		control->sar = (enh & L2CAP_CTRL_SAR) >> L2CAP_CTRL_SAR_SHIFT;
 739		control->txseq = (enh & L2CAP_CTRL_TXSEQ) >> L2CAP_CTRL_TXSEQ_SHIFT;
 740
 741		control->poll = 0;
 742		control->super = 0;
 743	}
 744}
 745
 746static void __unpack_extended_control(u32 ext, struct l2cap_ctrl *control)
 747{
 748	control->reqseq = (ext & L2CAP_EXT_CTRL_REQSEQ) >> L2CAP_EXT_CTRL_REQSEQ_SHIFT;
 749	control->final = (ext & L2CAP_EXT_CTRL_FINAL) >> L2CAP_EXT_CTRL_FINAL_SHIFT;
 750
 751	if (ext & L2CAP_EXT_CTRL_FRAME_TYPE) {
 752		/* S-Frame */
 753		control->sframe = 1;
 754		control->poll = (ext & L2CAP_EXT_CTRL_POLL) >> L2CAP_EXT_CTRL_POLL_SHIFT;
 755		control->super = (ext & L2CAP_EXT_CTRL_SUPERVISE) >> L2CAP_EXT_CTRL_SUPER_SHIFT;
 756
 757		control->sar = 0;
 758		control->txseq = 0;
 759	} else {
 760		/* I-Frame */
 761		control->sframe = 0;
 762		control->sar = (ext & L2CAP_EXT_CTRL_SAR) >> L2CAP_EXT_CTRL_SAR_SHIFT;
 763		control->txseq = (ext & L2CAP_EXT_CTRL_TXSEQ) >> L2CAP_EXT_CTRL_TXSEQ_SHIFT;
 764
 765		control->poll = 0;
 766		control->super = 0;
 767	}
 768}
 769
 770static inline void __unpack_control(struct l2cap_chan *chan,
 771				    struct sk_buff *skb)
 772{
 773	if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
 774		__unpack_extended_control(get_unaligned_le32(skb->data),
 775					  &bt_cb(skb)->control);
 
 776	} else {
 777		__unpack_enhanced_control(get_unaligned_le16(skb->data),
 778					  &bt_cb(skb)->control);
 
 779	}
 780}
 781
 782static u32 __pack_extended_control(struct l2cap_ctrl *control)
 783{
 784	u32 packed;
 785
 786	packed = control->reqseq << L2CAP_EXT_CTRL_REQSEQ_SHIFT;
 787	packed |= control->final << L2CAP_EXT_CTRL_FINAL_SHIFT;
 788
 789	if (control->sframe) {
 790		packed |= control->poll << L2CAP_EXT_CTRL_POLL_SHIFT;
 791		packed |= control->super << L2CAP_EXT_CTRL_SUPER_SHIFT;
 792		packed |= L2CAP_EXT_CTRL_FRAME_TYPE;
 793	} else {
 794		packed |= control->sar << L2CAP_EXT_CTRL_SAR_SHIFT;
 795		packed |= control->txseq << L2CAP_EXT_CTRL_TXSEQ_SHIFT;
 796	}
 797
 798	return packed;
 799}
 800
 801static u16 __pack_enhanced_control(struct l2cap_ctrl *control)
 802{
 803	u16 packed;
 804
 805	packed = control->reqseq << L2CAP_CTRL_REQSEQ_SHIFT;
 806	packed |= control->final << L2CAP_CTRL_FINAL_SHIFT;
 807
 808	if (control->sframe) {
 809		packed |= control->poll << L2CAP_CTRL_POLL_SHIFT;
 810		packed |= control->super << L2CAP_CTRL_SUPER_SHIFT;
 811		packed |= L2CAP_CTRL_FRAME_TYPE;
 812	} else {
 813		packed |= control->sar << L2CAP_CTRL_SAR_SHIFT;
 814		packed |= control->txseq << L2CAP_CTRL_TXSEQ_SHIFT;
 815	}
 816
 817	return packed;
 818}
 819
 820static inline void __pack_control(struct l2cap_chan *chan,
 821				  struct l2cap_ctrl *control,
 822				  struct sk_buff *skb)
 823{
 824	if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
 825		put_unaligned_le32(__pack_extended_control(control),
 826				   skb->data + L2CAP_HDR_SIZE);
 827	} else {
 828		put_unaligned_le16(__pack_enhanced_control(control),
 829				   skb->data + L2CAP_HDR_SIZE);
 830	}
 831}
 832
 833static inline void l2cap_send_sframe(struct l2cap_chan *chan, u32 control)
 834{
 835	struct sk_buff *skb;
 836	struct l2cap_hdr *lh;
 837	struct l2cap_conn *conn = chan->conn;
 838	int count, hlen;
 839
 840	if (chan->state != BT_CONNECTED)
 841		return;
 842
 843	if (test_bit(FLAG_EXT_CTRL, &chan->flags))
 844		hlen = L2CAP_EXT_HDR_SIZE;
 845	else
 846		hlen = L2CAP_ENH_HDR_SIZE;
 
 
 
 
 
 
 
 
 847
 848	if (chan->fcs == L2CAP_FCS_CRC16)
 849		hlen += L2CAP_FCS_SIZE;
 850
 851	BT_DBG("chan %p, control 0x%8.8x", chan, control);
 852
 853	count = min_t(unsigned int, conn->mtu, hlen);
 854
 855	control |= __set_sframe(chan);
 856
 857	if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
 858		control |= __set_ctrl_final(chan);
 859
 860	if (test_and_clear_bit(CONN_SEND_PBIT, &chan->conn_state))
 861		control |= __set_ctrl_poll(chan);
 862
 863	skb = bt_skb_alloc(count, GFP_ATOMIC);
 864	if (!skb)
 865		return;
 866
 867	lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
 868	lh->len = cpu_to_le16(hlen - L2CAP_HDR_SIZE);
 869	lh->cid = cpu_to_le16(chan->dcid);
 870
 871	__put_control(chan, control, skb_put(skb, __ctrl_size(chan)));
 
 
 
 872
 873	if (chan->fcs == L2CAP_FCS_CRC16) {
 874		u16 fcs = crc16(0, (u8 *)lh, count - L2CAP_FCS_SIZE);
 875		put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
 876	}
 877
 878	skb->priority = HCI_PRIO_MAX;
 879	l2cap_do_send(chan, skb);
 880}
 881
 882static inline void l2cap_send_rr_or_rnr(struct l2cap_chan *chan, u32 control)
 
 883{
 884	if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
 885		control |= __set_ctrl_super(chan, L2CAP_SUPER_RNR);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 886		set_bit(CONN_RNR_SENT, &chan->conn_state);
 887	} else
 888		control |= __set_ctrl_super(chan, L2CAP_SUPER_RR);
 889
 890	control |= __set_reqseq(chan, chan->buffer_seq);
 
 
 
 891
 892	l2cap_send_sframe(chan, control);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 893}
 894
 895static inline int __l2cap_no_conn_pending(struct l2cap_chan *chan)
 896{
 
 
 
 897	return !test_bit(CONF_CONNECT_PEND, &chan->conf_state);
 898}
 899
 900static void l2cap_send_conn_req(struct l2cap_chan *chan)
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 901{
 902	struct l2cap_conn *conn = chan->conn;
 903	struct l2cap_conn_req req;
 904
 905	req.scid = cpu_to_le16(chan->scid);
 906	req.psm  = chan->psm;
 907
 908	chan->ident = l2cap_get_ident(conn);
 909
 910	set_bit(CONF_CONNECT_PEND, &chan->conf_state);
 911
 912	l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ, sizeof(req), &req);
 913}
 914
 915static void l2cap_chan_ready(struct l2cap_chan *chan)
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 916{
 917	struct sock *sk = chan->sk;
 918	struct sock *parent;
 919
 920	lock_sock(sk);
 
 921
 922	parent = bt_sk(sk)->parent;
 
 923
 924	BT_DBG("sk %p, parent %p", sk, parent);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 925
 
 926	chan->conf_state = 0;
 927	__clear_chan_timer(chan);
 928
 929	__l2cap_state_change(chan, BT_CONNECTED);
 930	sk->sk_state_change(sk);
 931
 932	if (parent)
 933		parent->sk_data_ready(parent, 0);
 934
 935	release_sock(sk);
 936}
 937
 938static void l2cap_do_start(struct l2cap_chan *chan)
 939{
 940	struct l2cap_conn *conn = chan->conn;
 
 941
 942	if (conn->hcon->type == LE_LINK) {
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 943		l2cap_chan_ready(chan);
 944		return;
 945	}
 946
 947	if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) {
 948		if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE))
 949			return;
 950
 951		if (l2cap_chan_check_security(chan) &&
 952				__l2cap_no_conn_pending(chan))
 953			l2cap_send_conn_req(chan);
 
 
 
 
 954	} else {
 955		struct l2cap_info_req req;
 956		req.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
 
 957
 958		conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
 959		conn->info_ident = l2cap_get_ident(conn);
 
 960
 961		schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 962
 963		l2cap_send_cmd(conn, conn->info_ident,
 964					L2CAP_INFO_REQ, sizeof(req), &req);
 
 
 
 
 
 
 965	}
 
 
 
 
 
 
 
 966}
 967
 968static inline int l2cap_mode_supported(__u8 mode, __u32 feat_mask)
 969{
 970	u32 local_feat_mask = l2cap_feat_mask;
 971	if (!disable_ertm)
 972		local_feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING;
 973
 974	switch (mode) {
 975	case L2CAP_MODE_ERTM:
 976		return L2CAP_FEAT_ERTM & feat_mask & local_feat_mask;
 977	case L2CAP_MODE_STREAMING:
 978		return L2CAP_FEAT_STREAMING & feat_mask & local_feat_mask;
 979	default:
 980		return 0x00;
 981	}
 982}
 983
 984static void l2cap_send_disconn_req(struct l2cap_conn *conn, struct l2cap_chan *chan, int err)
 985{
 986	struct sock *sk = chan->sk;
 987	struct l2cap_disconn_req req;
 988
 989	if (!conn)
 990		return;
 991
 992	if (chan->mode == L2CAP_MODE_ERTM) {
 993		__clear_retrans_timer(chan);
 994		__clear_monitor_timer(chan);
 995		__clear_ack_timer(chan);
 996	}
 997
 
 
 
 
 
 998	req.dcid = cpu_to_le16(chan->dcid);
 999	req.scid = cpu_to_le16(chan->scid);
1000	l2cap_send_cmd(conn, l2cap_get_ident(conn),
1001			L2CAP_DISCONN_REQ, sizeof(req), &req);
1002
1003	lock_sock(sk);
1004	__l2cap_state_change(chan, BT_DISCONN);
1005	__l2cap_chan_set_err(chan, err);
1006	release_sock(sk);
1007}
1008
1009/* ---- L2CAP connections ---- */
1010static void l2cap_conn_start(struct l2cap_conn *conn)
1011{
1012	struct l2cap_chan *chan, *tmp;
1013
1014	BT_DBG("conn %p", conn);
1015
1016	mutex_lock(&conn->chan_lock);
1017
1018	list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
1019		struct sock *sk = chan->sk;
1020
1021		l2cap_chan_lock(chan);
1022
1023		if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
 
1024			l2cap_chan_unlock(chan);
1025			continue;
1026		}
1027
1028		if (chan->state == BT_CONNECT) {
1029			if (!l2cap_chan_check_security(chan) ||
1030					!__l2cap_no_conn_pending(chan)) {
1031				l2cap_chan_unlock(chan);
1032				continue;
1033			}
1034
1035			if (!l2cap_mode_supported(chan->mode, conn->feat_mask)
1036					&& test_bit(CONF_STATE2_DEVICE,
1037					&chan->conf_state)) {
1038				l2cap_chan_close(chan, ECONNRESET);
1039				l2cap_chan_unlock(chan);
1040				continue;
1041			}
1042
1043			l2cap_send_conn_req(chan);
1044
1045		} else if (chan->state == BT_CONNECT2) {
1046			struct l2cap_conn_rsp rsp;
1047			char buf[128];
1048			rsp.scid = cpu_to_le16(chan->dcid);
1049			rsp.dcid = cpu_to_le16(chan->scid);
1050
1051			if (l2cap_chan_check_security(chan)) {
1052				lock_sock(sk);
1053				if (test_bit(BT_SK_DEFER_SETUP,
1054					     &bt_sk(sk)->flags)) {
1055					struct sock *parent = bt_sk(sk)->parent;
1056					rsp.result = cpu_to_le16(L2CAP_CR_PEND);
1057					rsp.status = cpu_to_le16(L2CAP_CS_AUTHOR_PEND);
1058					if (parent)
1059						parent->sk_data_ready(parent, 0);
1060
1061				} else {
1062					__l2cap_state_change(chan, BT_CONFIG);
1063					rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
1064					rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
1065				}
1066				release_sock(sk);
1067			} else {
1068				rsp.result = cpu_to_le16(L2CAP_CR_PEND);
1069				rsp.status = cpu_to_le16(L2CAP_CS_AUTHEN_PEND);
1070			}
1071
1072			l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
1073							sizeof(rsp), &rsp);
1074
1075			if (test_bit(CONF_REQ_SENT, &chan->conf_state) ||
1076					rsp.result != L2CAP_CR_SUCCESS) {
1077				l2cap_chan_unlock(chan);
1078				continue;
1079			}
1080
1081			set_bit(CONF_REQ_SENT, &chan->conf_state);
1082			l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
1083						l2cap_build_conf_req(chan, buf), buf);
1084			chan->num_conf_req++;
1085		}
1086
1087		l2cap_chan_unlock(chan);
1088	}
1089
1090	mutex_unlock(&conn->chan_lock);
1091}
1092
1093/* Find socket with cid and source/destination bdaddr.
1094 * Returns closest match, locked.
1095 */
1096static struct l2cap_chan *l2cap_global_chan_by_scid(int state, u16 cid,
1097						    bdaddr_t *src,
1098						    bdaddr_t *dst)
1099{
1100	struct l2cap_chan *c, *c1 = NULL;
1101
1102	read_lock(&chan_list_lock);
1103
1104	list_for_each_entry(c, &chan_list, global_l) {
1105		struct sock *sk = c->sk;
1106
1107		if (state && c->state != state)
1108			continue;
1109
1110		if (c->scid == cid) {
1111			int src_match, dst_match;
1112			int src_any, dst_any;
1113
1114			/* Exact match. */
1115			src_match = !bacmp(&bt_sk(sk)->src, src);
1116			dst_match = !bacmp(&bt_sk(sk)->dst, dst);
1117			if (src_match && dst_match) {
1118				read_unlock(&chan_list_lock);
1119				return c;
1120			}
1121
1122			/* Closest match */
1123			src_any = !bacmp(&bt_sk(sk)->src, BDADDR_ANY);
1124			dst_any = !bacmp(&bt_sk(sk)->dst, BDADDR_ANY);
1125			if ((src_match && dst_any) || (src_any && dst_match) ||
1126			    (src_any && dst_any))
1127				c1 = c;
1128		}
1129	}
1130
1131	read_unlock(&chan_list_lock);
1132
1133	return c1;
1134}
1135
1136static void l2cap_le_conn_ready(struct l2cap_conn *conn)
1137{
1138	struct sock *parent, *sk;
1139	struct l2cap_chan *chan, *pchan;
1140
1141	BT_DBG("");
1142
1143	/* Check if we have socket listening on cid */
1144	pchan = l2cap_global_chan_by_scid(BT_LISTEN, L2CAP_CID_LE_DATA,
1145					  conn->src, conn->dst);
1146	if (!pchan)
1147		return;
1148
1149	parent = pchan->sk;
 
 
 
 
1150
1151	lock_sock(parent);
 
 
 
 
 
 
 
 
 
 
 
 
 
1152
1153	/* Check for backlog size */
1154	if (sk_acceptq_is_full(parent)) {
1155		BT_DBG("backlog full %d", parent->sk_ack_backlog);
1156		goto clean;
1157	}
1158
1159	chan = pchan->ops->new_connection(pchan->data);
1160	if (!chan)
1161		goto clean;
1162
1163	sk = chan->sk;
1164
1165	hci_conn_hold(conn->hcon);
1166	conn->hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
1167
1168	bacpy(&bt_sk(sk)->src, conn->src);
1169	bacpy(&bt_sk(sk)->dst, conn->dst);
1170
1171	bt_accept_enqueue(parent, sk);
1172
1173	l2cap_chan_add(conn, chan);
1174
1175	__set_chan_timer(chan, sk->sk_sndtimeo);
1176
1177	__l2cap_state_change(chan, BT_CONNECTED);
1178	parent->sk_data_ready(parent, 0);
1179
1180clean:
1181	release_sock(parent);
1182}
1183
1184static void l2cap_conn_ready(struct l2cap_conn *conn)
1185{
1186	struct l2cap_chan *chan;
1187	struct hci_conn *hcon = conn->hcon;
1188
1189	BT_DBG("conn %p", conn);
1190
1191	if (!hcon->out && hcon->type == LE_LINK)
1192		l2cap_le_conn_ready(conn);
1193
1194	if (hcon->out && hcon->type == LE_LINK)
1195		smp_conn_security(hcon, hcon->pending_sec_level);
1196
1197	mutex_lock(&conn->chan_lock);
1198
1199	list_for_each_entry(chan, &conn->chan_l, list) {
1200
1201		l2cap_chan_lock(chan);
1202
1203		if (hcon->type == LE_LINK) {
1204			if (smp_conn_security(hcon, chan->sec_level))
1205				l2cap_chan_ready(chan);
 
1206
 
 
1207		} else if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
1208			struct sock *sk = chan->sk;
1209			__clear_chan_timer(chan);
1210			lock_sock(sk);
1211			__l2cap_state_change(chan, BT_CONNECTED);
1212			sk->sk_state_change(sk);
1213			release_sock(sk);
1214
1215		} else if (chan->state == BT_CONNECT)
1216			l2cap_do_start(chan);
 
1217
1218		l2cap_chan_unlock(chan);
1219	}
1220
1221	mutex_unlock(&conn->chan_lock);
 
 
 
 
 
1222}
1223
1224/* Notify sockets that we cannot guaranty reliability anymore */
1225static void l2cap_conn_unreliable(struct l2cap_conn *conn, int err)
1226{
1227	struct l2cap_chan *chan;
1228
1229	BT_DBG("conn %p", conn);
1230
1231	mutex_lock(&conn->chan_lock);
1232
1233	list_for_each_entry(chan, &conn->chan_l, list) {
1234		if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
1235			__l2cap_chan_set_err(chan, err);
1236	}
1237
1238	mutex_unlock(&conn->chan_lock);
1239}
1240
1241static void l2cap_info_timeout(struct work_struct *work)
1242{
1243	struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
1244							info_timer.work);
1245
1246	conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
1247	conn->info_ident = 0;
1248
1249	l2cap_conn_start(conn);
1250}
1251
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1252static void l2cap_conn_del(struct hci_conn *hcon, int err)
1253{
1254	struct l2cap_conn *conn = hcon->l2cap_data;
1255	struct l2cap_chan *chan, *l;
1256
1257	if (!conn)
1258		return;
1259
1260	BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
1261
1262	kfree_skb(conn->rx_skb);
1263
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1264	mutex_lock(&conn->chan_lock);
1265
1266	/* Kill channels */
1267	list_for_each_entry_safe(chan, l, &conn->chan_l, list) {
1268		l2cap_chan_hold(chan);
1269		l2cap_chan_lock(chan);
1270
1271		l2cap_chan_del(chan, err);
1272
1273		l2cap_chan_unlock(chan);
1274
1275		chan->ops->close(chan->data);
1276		l2cap_chan_put(chan);
1277	}
1278
1279	mutex_unlock(&conn->chan_lock);
1280
1281	hci_chan_del(conn->hchan);
1282
1283	if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
1284		cancel_delayed_work_sync(&conn->info_timer);
1285
1286	if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags)) {
1287		cancel_delayed_work_sync(&conn->security_timer);
1288		smp_chan_destroy(conn);
1289	}
1290
1291	hcon->l2cap_data = NULL;
1292	kfree(conn);
 
1293}
1294
1295static void security_timeout(struct work_struct *work)
1296{
1297	struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
1298						security_timer.work);
1299
1300	BT_DBG("conn %p", conn);
1301
1302	if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags)) {
1303		smp_chan_destroy(conn);
1304		l2cap_conn_del(conn->hcon, ETIMEDOUT);
1305	}
1306}
1307
1308static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon, u8 status)
1309{
1310	struct l2cap_conn *conn = hcon->l2cap_data;
1311	struct hci_chan *hchan;
1312
1313	if (conn || status)
1314		return conn;
1315
1316	hchan = hci_chan_create(hcon);
1317	if (!hchan)
1318		return NULL;
1319
1320	conn = kzalloc(sizeof(struct l2cap_conn), GFP_ATOMIC);
1321	if (!conn) {
1322		hci_chan_del(hchan);
1323		return NULL;
1324	}
1325
1326	hcon->l2cap_data = conn;
1327	conn->hcon = hcon;
1328	conn->hchan = hchan;
1329
1330	BT_DBG("hcon %p conn %p hchan %p", hcon, conn, hchan);
1331
1332	if (hcon->hdev->le_mtu && hcon->type == LE_LINK)
1333		conn->mtu = hcon->hdev->le_mtu;
1334	else
1335		conn->mtu = hcon->hdev->acl_mtu;
1336
1337	conn->src = &hcon->hdev->bdaddr;
1338	conn->dst = &hcon->dst;
1339
1340	conn->feat_mask = 0;
1341
1342	spin_lock_init(&conn->lock);
1343	mutex_init(&conn->chan_lock);
1344
1345	INIT_LIST_HEAD(&conn->chan_l);
1346
1347	if (hcon->type == LE_LINK)
1348		INIT_DELAYED_WORK(&conn->security_timer, security_timeout);
1349	else
1350		INIT_DELAYED_WORK(&conn->info_timer, l2cap_info_timeout);
1351
1352	conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
1353
1354	return conn;
1355}
 
 
 
 
 
 
 
1356
1357/* ---- Socket interface ---- */
1358
1359/* Find socket with psm and source / destination bdaddr.
1360 * Returns closest match.
1361 */
1362static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm,
1363						   bdaddr_t *src,
1364						   bdaddr_t *dst)
 
1365{
1366	struct l2cap_chan *c, *c1 = NULL;
1367
1368	read_lock(&chan_list_lock);
1369
1370	list_for_each_entry(c, &chan_list, global_l) {
1371		struct sock *sk = c->sk;
1372
1373		if (state && c->state != state)
1374			continue;
1375
 
 
 
 
 
 
1376		if (c->psm == psm) {
1377			int src_match, dst_match;
1378			int src_any, dst_any;
1379
1380			/* Exact match. */
1381			src_match = !bacmp(&bt_sk(sk)->src, src);
1382			dst_match = !bacmp(&bt_sk(sk)->dst, dst);
1383			if (src_match && dst_match) {
 
1384				read_unlock(&chan_list_lock);
1385				return c;
1386			}
1387
1388			/* Closest match */
1389			src_any = !bacmp(&bt_sk(sk)->src, BDADDR_ANY);
1390			dst_any = !bacmp(&bt_sk(sk)->dst, BDADDR_ANY);
1391			if ((src_match && dst_any) || (src_any && dst_match) ||
1392			    (src_any && dst_any))
1393				c1 = c;
1394		}
1395	}
1396
 
 
 
1397	read_unlock(&chan_list_lock);
1398
1399	return c1;
1400}
1401
1402int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,
1403		       bdaddr_t *dst, u8 dst_type)
1404{
1405	struct sock *sk = chan->sk;
1406	bdaddr_t *src = &bt_sk(sk)->src;
1407	struct l2cap_conn *conn;
1408	struct hci_conn *hcon;
1409	struct hci_dev *hdev;
1410	__u8 auth_type;
1411	int err;
1412
1413	BT_DBG("%s -> %s (type %u) psm 0x%2.2x", batostr(src), batostr(dst),
1414	       dst_type, __le16_to_cpu(chan->psm));
1415
1416	hdev = hci_get_route(dst, src);
1417	if (!hdev)
1418		return -EHOSTUNREACH;
1419
1420	hci_dev_lock(hdev);
1421
1422	l2cap_chan_lock(chan);
1423
1424	/* PSM must be odd and lsb of upper byte must be 0 */
1425	if ((__le16_to_cpu(psm) & 0x0101) != 0x0001 && !cid &&
1426					chan->chan_type != L2CAP_CHAN_RAW) {
1427		err = -EINVAL;
1428		goto done;
1429	}
1430
1431	if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED && !(psm || cid)) {
1432		err = -EINVAL;
1433		goto done;
1434	}
1435
1436	switch (chan->mode) {
1437	case L2CAP_MODE_BASIC:
1438		break;
1439	case L2CAP_MODE_ERTM:
1440	case L2CAP_MODE_STREAMING:
1441		if (!disable_ertm)
1442			break;
1443		/* fall through */
1444	default:
1445		err = -ENOTSUPP;
1446		goto done;
1447	}
1448
1449	lock_sock(sk);
1450
1451	switch (sk->sk_state) {
1452	case BT_CONNECT:
1453	case BT_CONNECT2:
1454	case BT_CONFIG:
1455		/* Already connecting */
1456		err = 0;
1457		release_sock(sk);
1458		goto done;
1459
1460	case BT_CONNECTED:
1461		/* Already connected */
1462		err = -EISCONN;
1463		release_sock(sk);
1464		goto done;
1465
1466	case BT_OPEN:
1467	case BT_BOUND:
1468		/* Can connect */
1469		break;
1470
1471	default:
1472		err = -EBADFD;
1473		release_sock(sk);
1474		goto done;
1475	}
1476
1477	/* Set destination address and psm */
1478	bacpy(&bt_sk(sk)->dst, dst);
1479
1480	release_sock(sk);
1481
1482	chan->psm = psm;
1483	chan->dcid = cid;
1484
1485	auth_type = l2cap_get_auth_type(chan);
1486
1487	if (chan->dcid == L2CAP_CID_LE_DATA)
1488		hcon = hci_connect(hdev, LE_LINK, dst, dst_type,
1489				   chan->sec_level, auth_type);
1490	else
1491		hcon = hci_connect(hdev, ACL_LINK, dst, dst_type,
1492				   chan->sec_level, auth_type);
1493
1494	if (IS_ERR(hcon)) {
1495		err = PTR_ERR(hcon);
1496		goto done;
1497	}
1498
1499	conn = l2cap_conn_add(hcon, 0);
1500	if (!conn) {
1501		hci_conn_put(hcon);
1502		err = -ENOMEM;
1503		goto done;
1504	}
1505
1506	if (hcon->type == LE_LINK) {
1507		err = 0;
1508
1509		if (!list_empty(&conn->chan_l)) {
1510			err = -EBUSY;
1511			hci_conn_put(hcon);
1512		}
1513
1514		if (err)
1515			goto done;
1516	}
1517
1518	/* Update source addr of the socket */
1519	bacpy(src, conn->src);
1520
1521	l2cap_chan_unlock(chan);
1522	l2cap_chan_add(conn, chan);
1523	l2cap_chan_lock(chan);
1524
1525	l2cap_state_change(chan, BT_CONNECT);
1526	__set_chan_timer(chan, sk->sk_sndtimeo);
1527
1528	if (hcon->state == BT_CONNECTED) {
1529		if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
1530			__clear_chan_timer(chan);
1531			if (l2cap_chan_check_security(chan))
1532				l2cap_state_change(chan, BT_CONNECTED);
1533		} else
1534			l2cap_do_start(chan);
1535	}
1536
1537	err = 0;
1538
1539done:
1540	l2cap_chan_unlock(chan);
1541	hci_dev_unlock(hdev);
1542	hci_dev_put(hdev);
1543	return err;
1544}
1545
1546int __l2cap_wait_ack(struct sock *sk)
1547{
1548	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1549	DECLARE_WAITQUEUE(wait, current);
1550	int err = 0;
1551	int timeo = HZ/5;
1552
1553	add_wait_queue(sk_sleep(sk), &wait);
1554	set_current_state(TASK_INTERRUPTIBLE);
1555	while (chan->unacked_frames > 0 && chan->conn) {
1556		if (!timeo)
1557			timeo = HZ/5;
1558
1559		if (signal_pending(current)) {
1560			err = sock_intr_errno(timeo);
1561			break;
1562		}
1563
1564		release_sock(sk);
1565		timeo = schedule_timeout(timeo);
1566		lock_sock(sk);
1567		set_current_state(TASK_INTERRUPTIBLE);
1568
1569		err = sock_error(sk);
1570		if (err)
1571			break;
1572	}
1573	set_current_state(TASK_RUNNING);
1574	remove_wait_queue(sk_sleep(sk), &wait);
1575	return err;
1576}
1577
1578static void l2cap_monitor_timeout(struct work_struct *work)
1579{
1580	struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
1581							monitor_timer.work);
1582
1583	BT_DBG("chan %p", chan);
1584
1585	l2cap_chan_lock(chan);
1586
1587	if (chan->retry_count >= chan->remote_max_tx) {
1588		l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED);
1589		l2cap_chan_unlock(chan);
1590		l2cap_chan_put(chan);
1591		return;
1592	}
1593
1594	chan->retry_count++;
1595	__set_monitor_timer(chan);
1596
1597	l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_POLL);
1598	l2cap_chan_unlock(chan);
1599	l2cap_chan_put(chan);
1600}
1601
1602static void l2cap_retrans_timeout(struct work_struct *work)
1603{
1604	struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
1605							retrans_timer.work);
1606
1607	BT_DBG("chan %p", chan);
1608
1609	l2cap_chan_lock(chan);
1610
1611	chan->retry_count = 1;
1612	__set_monitor_timer(chan);
1613
1614	set_bit(CONN_WAIT_F, &chan->conn_state);
1615
1616	l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_POLL);
1617
 
1618	l2cap_chan_unlock(chan);
1619	l2cap_chan_put(chan);
1620}
1621
1622static void l2cap_drop_acked_frames(struct l2cap_chan *chan)
 
1623{
1624	struct sk_buff *skb;
 
1625
1626	while ((skb = skb_peek(&chan->tx_q)) &&
1627			chan->unacked_frames) {
1628		if (bt_cb(skb)->control.txseq == chan->expected_ack_seq)
1629			break;
1630
1631		skb = skb_dequeue(&chan->tx_q);
1632		kfree_skb(skb);
1633
1634		chan->unacked_frames--;
1635	}
1636
1637	if (!chan->unacked_frames)
1638		__clear_retrans_timer(chan);
1639}
1640
1641static void l2cap_streaming_send(struct l2cap_chan *chan)
1642{
1643	struct sk_buff *skb;
1644	u32 control;
1645	u16 fcs;
 
 
1646
1647	while ((skb = skb_dequeue(&chan->tx_q))) {
1648		control = __get_control(chan, skb->data + L2CAP_HDR_SIZE);
1649		control |= __set_txseq(chan, chan->next_tx_seq);
1650		control |= __set_ctrl_sar(chan, bt_cb(skb)->control.sar);
1651		__put_control(chan, control, skb->data + L2CAP_HDR_SIZE);
1652
1653		if (chan->fcs == L2CAP_FCS_CRC16) {
1654			fcs = crc16(0, (u8 *)skb->data,
1655						skb->len - L2CAP_FCS_SIZE);
1656			put_unaligned_le16(fcs,
1657					skb->data + skb->len - L2CAP_FCS_SIZE);
1658		}
1659
1660		l2cap_do_send(chan, skb);
1661
 
 
1662		chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
 
1663	}
1664}
1665
1666static void l2cap_retransmit_one_frame(struct l2cap_chan *chan, u16 tx_seq)
1667{
1668	struct sk_buff *skb, *tx_skb;
1669	u16 fcs;
1670	u32 control;
1671
1672	skb = skb_peek(&chan->tx_q);
1673	if (!skb)
1674		return;
1675
1676	while (bt_cb(skb)->control.txseq != tx_seq) {
1677		if (skb_queue_is_last(&chan->tx_q, skb))
1678			return;
1679
1680		skb = skb_queue_next(&chan->tx_q, skb);
1681	}
1682
1683	if (bt_cb(skb)->control.retries == chan->remote_max_tx &&
1684	    chan->remote_max_tx) {
1685		l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED);
1686		return;
1687	}
 
1688
1689	tx_skb = skb_clone(skb, GFP_ATOMIC);
1690	bt_cb(skb)->control.retries++;
1691
1692	control = __get_control(chan, tx_skb->data + L2CAP_HDR_SIZE);
1693	control &= __get_sar_mask(chan);
1694
1695	if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
1696		control |= __set_ctrl_final(chan);
1697
1698	control |= __set_reqseq(chan, chan->buffer_seq);
1699	control |= __set_txseq(chan, tx_seq);
 
1700
1701	__put_control(chan, control, tx_skb->data + L2CAP_HDR_SIZE);
1702
1703	if (chan->fcs == L2CAP_FCS_CRC16) {
1704		fcs = crc16(0, (u8 *)tx_skb->data,
1705						tx_skb->len - L2CAP_FCS_SIZE);
1706		put_unaligned_le16(fcs,
1707				tx_skb->data + tx_skb->len - L2CAP_FCS_SIZE);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1708	}
1709
1710	l2cap_do_send(chan, tx_skb);
 
 
 
1711}
1712
1713static int l2cap_ertm_send(struct l2cap_chan *chan)
1714{
1715	struct sk_buff *skb, *tx_skb;
1716	u16 fcs;
1717	u32 control;
1718	int nsent = 0;
1719
1720	if (chan->state != BT_CONNECTED)
1721		return -ENOTCONN;
1722
1723	if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
1724		return 0;
1725
1726	while ((skb = chan->tx_send_head) && (!l2cap_tx_window_full(chan))) {
 
1727
1728		if (bt_cb(skb)->control.retries == chan->remote_max_tx &&
1729		    chan->remote_max_tx) {
1730			l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED);
1731			break;
1732		}
1733
1734		tx_skb = skb_clone(skb, GFP_ATOMIC);
 
 
 
 
 
1735
1736		bt_cb(skb)->control.retries++;
 
1737
1738		control = __get_control(chan, tx_skb->data + L2CAP_HDR_SIZE);
1739		control &= __get_sar_mask(chan);
 
 
 
 
 
1740
 
1741		if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
1742			control |= __set_ctrl_final(chan);
 
 
1743
1744		control |= __set_reqseq(chan, chan->buffer_seq);
1745		control |= __set_txseq(chan, chan->next_tx_seq);
1746		control |= __set_ctrl_sar(chan, bt_cb(skb)->control.sar);
 
 
 
 
 
1747
1748		__put_control(chan, control, tx_skb->data + L2CAP_HDR_SIZE);
 
 
 
 
 
 
 
 
 
 
 
 
1749
 
1750		if (chan->fcs == L2CAP_FCS_CRC16) {
1751			fcs = crc16(0, (u8 *)skb->data,
1752						tx_skb->len - L2CAP_FCS_SIZE);
1753			put_unaligned_le16(fcs, skb->data +
1754						tx_skb->len - L2CAP_FCS_SIZE);
1755		}
1756
1757		l2cap_do_send(chan, tx_skb);
1758
1759		__set_retrans_timer(chan);
1760
1761		bt_cb(skb)->control.txseq = chan->next_tx_seq;
1762
1763		chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
1764
1765		if (bt_cb(skb)->control.retries == 1) {
1766			chan->unacked_frames++;
1767
1768			if (!nsent++)
1769				__clear_ack_timer(chan);
1770		}
1771
1772		chan->frames_sent++;
1773
1774		if (skb_queue_is_last(&chan->tx_q, skb))
1775			chan->tx_send_head = NULL;
1776		else
1777			chan->tx_send_head = skb_queue_next(&chan->tx_q, skb);
1778	}
1779
1780	return nsent;
1781}
1782
1783static int l2cap_retransmit_frames(struct l2cap_chan *chan)
 
1784{
1785	int ret;
1786
1787	if (!skb_queue_empty(&chan->tx_q))
1788		chan->tx_send_head = chan->tx_q.next;
1789
1790	chan->next_tx_seq = chan->expected_ack_seq;
1791	ret = l2cap_ertm_send(chan);
1792	return ret;
1793}
1794
1795static void __l2cap_send_ack(struct l2cap_chan *chan)
 
1796{
1797	u32 control = 0;
1798
1799	control |= __set_reqseq(chan, chan->buffer_seq);
1800
1801	if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
1802		control |= __set_ctrl_super(chan, L2CAP_SUPER_RNR);
1803		set_bit(CONN_RNR_SENT, &chan->conn_state);
1804		l2cap_send_sframe(chan, control);
1805		return;
1806	}
1807
1808	if (l2cap_ertm_send(chan) > 0)
1809		return;
1810
1811	control |= __set_ctrl_super(chan, L2CAP_SUPER_RR);
1812	l2cap_send_sframe(chan, control);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1813}
1814
1815static void l2cap_send_ack(struct l2cap_chan *chan)
1816{
1817	__clear_ack_timer(chan);
1818	__l2cap_send_ack(chan);
1819}
 
1820
1821static void l2cap_send_srejtail(struct l2cap_chan *chan)
1822{
1823	struct srej_list *tail;
1824	u32 control;
1825
1826	control = __set_ctrl_super(chan, L2CAP_SUPER_SREJ);
1827	control |= __set_ctrl_final(chan);
1828
1829	tail = list_entry((&chan->srej_l)->prev, struct srej_list, list);
1830	control |= __set_reqseq(chan, tail->tx_seq);
 
 
 
 
 
 
 
 
 
 
 
1831
1832	l2cap_send_sframe(chan, control);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1833}
1834
1835static inline int l2cap_skbuff_fromiovec(struct l2cap_chan *chan,
1836					 struct msghdr *msg, int len,
1837					 int count, struct sk_buff *skb)
1838{
1839	struct l2cap_conn *conn = chan->conn;
1840	struct sk_buff **frag;
1841	int sent = 0;
1842
1843	if (memcpy_fromiovec(skb_put(skb, count), msg->msg_iov, count))
1844		return -EFAULT;
1845
1846	sent += count;
1847	len  -= count;
1848
1849	/* Continuation fragments (no L2CAP header) */
1850	frag = &skb_shinfo(skb)->frag_list;
1851	while (len) {
1852		struct sk_buff *tmp;
1853
1854		count = min_t(unsigned int, conn->mtu, len);
1855
1856		tmp = chan->ops->alloc_skb(chan, count,
1857					   msg->msg_flags & MSG_DONTWAIT);
1858		if (IS_ERR(tmp))
1859			return PTR_ERR(tmp);
1860
1861		*frag = tmp;
1862
1863		if (memcpy_fromiovec(skb_put(*frag, count), msg->msg_iov, count))
 
1864			return -EFAULT;
1865
1866		(*frag)->priority = skb->priority;
1867
1868		sent += count;
1869		len  -= count;
1870
1871		skb->len += (*frag)->len;
1872		skb->data_len += (*frag)->len;
1873
1874		frag = &(*frag)->next;
1875	}
1876
1877	return sent;
1878}
1879
1880static struct sk_buff *l2cap_create_connless_pdu(struct l2cap_chan *chan,
1881						struct msghdr *msg, size_t len,
1882						u32 priority)
1883{
1884	struct l2cap_conn *conn = chan->conn;
1885	struct sk_buff *skb;
1886	int err, count, hlen = L2CAP_HDR_SIZE + L2CAP_PSMLEN_SIZE;
1887	struct l2cap_hdr *lh;
1888
1889	BT_DBG("chan %p len %d priority %u", chan, (int)len, priority);
 
1890
1891	count = min_t(unsigned int, (conn->mtu - hlen), len);
1892
1893	skb = chan->ops->alloc_skb(chan, count + hlen,
1894				   msg->msg_flags & MSG_DONTWAIT);
1895	if (IS_ERR(skb))
1896		return skb;
1897
1898	skb->priority = priority;
1899
1900	/* Create L2CAP header */
1901	lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
1902	lh->cid = cpu_to_le16(chan->dcid);
1903	lh->len = cpu_to_le16(len + L2CAP_PSMLEN_SIZE);
1904	put_unaligned(chan->psm, skb_put(skb, L2CAP_PSMLEN_SIZE));
1905
1906	err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
1907	if (unlikely(err < 0)) {
1908		kfree_skb(skb);
1909		return ERR_PTR(err);
1910	}
1911	return skb;
1912}
1913
1914static struct sk_buff *l2cap_create_basic_pdu(struct l2cap_chan *chan,
1915						struct msghdr *msg, size_t len,
1916						u32 priority)
1917{
1918	struct l2cap_conn *conn = chan->conn;
1919	struct sk_buff *skb;
1920	int err, count;
1921	struct l2cap_hdr *lh;
1922
1923	BT_DBG("chan %p len %d", chan, (int)len);
1924
1925	count = min_t(unsigned int, (conn->mtu - L2CAP_HDR_SIZE), len);
1926
1927	skb = chan->ops->alloc_skb(chan, count + L2CAP_HDR_SIZE,
1928				   msg->msg_flags & MSG_DONTWAIT);
1929	if (IS_ERR(skb))
1930		return skb;
1931
1932	skb->priority = priority;
1933
1934	/* Create L2CAP header */
1935	lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
1936	lh->cid = cpu_to_le16(chan->dcid);
1937	lh->len = cpu_to_le16(len);
1938
1939	err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
1940	if (unlikely(err < 0)) {
1941		kfree_skb(skb);
1942		return ERR_PTR(err);
1943	}
1944	return skb;
1945}
1946
1947static struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan,
1948						struct msghdr *msg, size_t len,
1949						u16 sdulen)
1950{
1951	struct l2cap_conn *conn = chan->conn;
1952	struct sk_buff *skb;
1953	int err, count, hlen;
1954	struct l2cap_hdr *lh;
1955
1956	BT_DBG("chan %p len %d", chan, (int)len);
1957
1958	if (!conn)
1959		return ERR_PTR(-ENOTCONN);
1960
1961	if (test_bit(FLAG_EXT_CTRL, &chan->flags))
1962		hlen = L2CAP_EXT_HDR_SIZE;
1963	else
1964		hlen = L2CAP_ENH_HDR_SIZE;
1965
1966	if (sdulen)
1967		hlen += L2CAP_SDULEN_SIZE;
1968
1969	if (chan->fcs == L2CAP_FCS_CRC16)
1970		hlen += L2CAP_FCS_SIZE;
1971
1972	count = min_t(unsigned int, (conn->mtu - hlen), len);
1973
1974	skb = chan->ops->alloc_skb(chan, count + hlen,
1975				   msg->msg_flags & MSG_DONTWAIT);
1976	if (IS_ERR(skb))
1977		return skb;
1978
1979	/* Create L2CAP header */
1980	lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
1981	lh->cid = cpu_to_le16(chan->dcid);
1982	lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
1983
1984	__put_control(chan, 0, skb_put(skb, __ctrl_size(chan)));
 
 
 
 
1985
1986	if (sdulen)
1987		put_unaligned_le16(sdulen, skb_put(skb, L2CAP_SDULEN_SIZE));
1988
1989	err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
1990	if (unlikely(err < 0)) {
1991		kfree_skb(skb);
1992		return ERR_PTR(err);
1993	}
1994
1995	if (chan->fcs == L2CAP_FCS_CRC16)
1996		put_unaligned_le16(0, skb_put(skb, L2CAP_FCS_SIZE));
1997
1998	bt_cb(skb)->control.retries = 0;
1999	return skb;
2000}
2001
2002static int l2cap_segment_sdu(struct l2cap_chan *chan,
2003			     struct sk_buff_head *seg_queue,
2004			     struct msghdr *msg, size_t len)
2005{
2006	struct sk_buff *skb;
2007	u16 sdu_len;
2008	size_t pdu_len;
2009	int err = 0;
2010	u8 sar;
2011
2012	BT_DBG("chan %p, msg %p, len %d", chan, msg, (int)len);
2013
2014	/* It is critical that ERTM PDUs fit in a single HCI fragment,
2015	 * so fragmented skbs are not used.  The HCI layer's handling
2016	 * of fragmented skbs is not compatible with ERTM's queueing.
2017	 */
2018
2019	/* PDU size is derived from the HCI MTU */
2020	pdu_len = chan->conn->mtu;
2021
2022	pdu_len = min_t(size_t, pdu_len, L2CAP_BREDR_MAX_PAYLOAD);
 
 
2023
2024	/* Adjust for largest possible L2CAP overhead. */
2025	pdu_len -= L2CAP_EXT_HDR_SIZE + L2CAP_FCS_SIZE;
 
 
 
2026
2027	/* Remote device may have requested smaller PDUs */
2028	pdu_len = min_t(size_t, pdu_len, chan->remote_mps);
2029
2030	if (len <= pdu_len) {
2031		sar = L2CAP_SAR_UNSEGMENTED;
2032		sdu_len = 0;
2033		pdu_len = len;
2034	} else {
2035		sar = L2CAP_SAR_START;
2036		sdu_len = len;
2037		pdu_len -= L2CAP_SDULEN_SIZE;
2038	}
2039
2040	while (len > 0) {
2041		skb = l2cap_create_iframe_pdu(chan, msg, pdu_len, sdu_len);
2042
2043		if (IS_ERR(skb)) {
2044			__skb_queue_purge(seg_queue);
2045			return PTR_ERR(skb);
2046		}
2047
2048		bt_cb(skb)->control.sar = sar;
2049		__skb_queue_tail(seg_queue, skb);
2050
2051		len -= pdu_len;
2052		if (sdu_len) {
2053			sdu_len = 0;
2054			pdu_len += L2CAP_SDULEN_SIZE;
2055		}
2056
2057		if (len <= pdu_len) {
2058			sar = L2CAP_SAR_END;
2059			pdu_len = len;
2060		} else {
2061			sar = L2CAP_SAR_CONTINUE;
2062		}
2063	}
2064
2065	return err;
2066}
2067
2068int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len,
2069								u32 priority)
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2070{
2071	struct sk_buff *skb;
2072	int err;
2073	struct sk_buff_head seg_queue;
2074
 
 
 
2075	/* Connectionless channel */
2076	if (chan->chan_type == L2CAP_CHAN_CONN_LESS) {
2077		skb = l2cap_create_connless_pdu(chan, msg, len, priority);
2078		if (IS_ERR(skb))
2079			return PTR_ERR(skb);
2080
 
 
 
 
 
 
 
 
2081		l2cap_do_send(chan, skb);
2082		return len;
2083	}
2084
2085	switch (chan->mode) {
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2086	case L2CAP_MODE_BASIC:
2087		/* Check outgoing MTU */
2088		if (len > chan->omtu)
2089			return -EMSGSIZE;
2090
2091		/* Create a basic PDU */
2092		skb = l2cap_create_basic_pdu(chan, msg, len, priority);
2093		if (IS_ERR(skb))
2094			return PTR_ERR(skb);
2095
 
 
 
 
 
 
 
 
2096		l2cap_do_send(chan, skb);
2097		err = len;
2098		break;
2099
2100	case L2CAP_MODE_ERTM:
2101	case L2CAP_MODE_STREAMING:
2102		/* Check outgoing MTU */
2103		if (len > chan->omtu) {
2104			err = -EMSGSIZE;
2105			break;
2106		}
2107
2108		__skb_queue_head_init(&seg_queue);
2109
2110		/* Do segmentation before calling in to the state machine,
2111		 * since it's possible to block while waiting for memory
2112		 * allocation.
2113		 */
2114		err = l2cap_segment_sdu(chan, &seg_queue, msg, len);
2115
2116		/* The channel could have been closed while segmenting,
2117		 * check that it is still connected.
2118		 */
2119		if (chan->state != BT_CONNECTED) {
2120			__skb_queue_purge(&seg_queue);
2121			err = -ENOTCONN;
2122		}
2123
2124		if (err)
2125			break;
2126
2127		if (chan->mode == L2CAP_MODE_ERTM && chan->tx_send_head == NULL)
2128			chan->tx_send_head = seg_queue.next;
2129		skb_queue_splice_tail_init(&seg_queue, &chan->tx_q);
2130
2131		if (chan->mode == L2CAP_MODE_ERTM)
2132			err = l2cap_ertm_send(chan);
2133		else
2134			l2cap_streaming_send(chan);
2135
2136		if (err >= 0)
2137			err = len;
2138
2139		/* If the skbs were not queued for sending, they'll still be in
2140		 * seg_queue and need to be purged.
2141		 */
2142		__skb_queue_purge(&seg_queue);
2143		break;
2144
2145	default:
2146		BT_DBG("bad state %1.1x", chan->mode);
2147		err = -EBADFD;
2148	}
2149
2150	return err;
2151}
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2152
2153/* Copy frame to all raw sockets on that connection */
2154static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb)
2155{
2156	struct sk_buff *nskb;
2157	struct l2cap_chan *chan;
2158
2159	BT_DBG("conn %p", conn);
2160
2161	mutex_lock(&conn->chan_lock);
2162
2163	list_for_each_entry(chan, &conn->chan_l, list) {
2164		struct sock *sk = chan->sk;
2165		if (chan->chan_type != L2CAP_CHAN_RAW)
2166			continue;
2167
2168		/* Don't send frame to the socket it came from */
2169		if (skb->sk == sk)
2170			continue;
2171		nskb = skb_clone(skb, GFP_ATOMIC);
 
2172		if (!nskb)
2173			continue;
2174
2175		if (chan->ops->recv(chan->data, nskb))
2176			kfree_skb(nskb);
2177	}
2178
2179	mutex_unlock(&conn->chan_lock);
2180}
2181
2182/* ---- L2CAP signalling commands ---- */
2183static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
2184				u8 code, u8 ident, u16 dlen, void *data)
2185{
2186	struct sk_buff *skb, **frag;
2187	struct l2cap_cmd_hdr *cmd;
2188	struct l2cap_hdr *lh;
2189	int len, count;
2190
2191	BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %d",
2192			conn, code, ident, dlen);
 
 
 
2193
2194	len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen;
2195	count = min_t(unsigned int, conn->mtu, len);
2196
2197	skb = bt_skb_alloc(count, GFP_ATOMIC);
2198	if (!skb)
2199		return NULL;
2200
2201	lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
2202	lh->len = cpu_to_le16(L2CAP_CMD_HDR_SIZE + dlen);
2203
2204	if (conn->hcon->type == LE_LINK)
2205		lh->cid = cpu_to_le16(L2CAP_CID_LE_SIGNALING);
2206	else
2207		lh->cid = cpu_to_le16(L2CAP_CID_SIGNALING);
2208
2209	cmd = (struct l2cap_cmd_hdr *) skb_put(skb, L2CAP_CMD_HDR_SIZE);
2210	cmd->code  = code;
2211	cmd->ident = ident;
2212	cmd->len   = cpu_to_le16(dlen);
2213
2214	if (dlen) {
2215		count -= L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE;
2216		memcpy(skb_put(skb, count), data, count);
2217		data += count;
2218	}
2219
2220	len -= skb->len;
2221
2222	/* Continuation fragments (no L2CAP header) */
2223	frag = &skb_shinfo(skb)->frag_list;
2224	while (len) {
2225		count = min_t(unsigned int, conn->mtu, len);
2226
2227		*frag = bt_skb_alloc(count, GFP_ATOMIC);
2228		if (!*frag)
2229			goto fail;
2230
2231		memcpy(skb_put(*frag, count), data, count);
2232
2233		len  -= count;
2234		data += count;
2235
2236		frag = &(*frag)->next;
2237	}
2238
2239	return skb;
2240
2241fail:
2242	kfree_skb(skb);
2243	return NULL;
2244}
2245
2246static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen, unsigned long *val)
 
2247{
2248	struct l2cap_conf_opt *opt = *ptr;
2249	int len;
2250
2251	len = L2CAP_CONF_OPT_SIZE + opt->len;
2252	*ptr += len;
2253
2254	*type = opt->type;
2255	*olen = opt->len;
2256
2257	switch (opt->len) {
2258	case 1:
2259		*val = *((u8 *) opt->val);
2260		break;
2261
2262	case 2:
2263		*val = get_unaligned_le16(opt->val);
2264		break;
2265
2266	case 4:
2267		*val = get_unaligned_le32(opt->val);
2268		break;
2269
2270	default:
2271		*val = (unsigned long) opt->val;
2272		break;
2273	}
2274
2275	BT_DBG("type 0x%2.2x len %d val 0x%lx", *type, opt->len, *val);
2276	return len;
2277}
2278
2279static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val)
2280{
2281	struct l2cap_conf_opt *opt = *ptr;
2282
2283	BT_DBG("type 0x%2.2x len %d val 0x%lx", type, len, val);
2284
2285	opt->type = type;
2286	opt->len  = len;
2287
2288	switch (len) {
2289	case 1:
2290		*((u8 *) opt->val)  = val;
2291		break;
2292
2293	case 2:
2294		put_unaligned_le16(val, opt->val);
2295		break;
2296
2297	case 4:
2298		put_unaligned_le32(val, opt->val);
2299		break;
2300
2301	default:
2302		memcpy(opt->val, (void *) val, len);
2303		break;
2304	}
2305
2306	*ptr += L2CAP_CONF_OPT_SIZE + len;
2307}
2308
2309static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan)
2310{
2311	struct l2cap_conf_efs efs;
2312
2313	switch (chan->mode) {
2314	case L2CAP_MODE_ERTM:
2315		efs.id		= chan->local_id;
2316		efs.stype	= chan->local_stype;
2317		efs.msdu	= cpu_to_le16(chan->local_msdu);
2318		efs.sdu_itime	= cpu_to_le32(chan->local_sdu_itime);
2319		efs.acc_lat	= cpu_to_le32(L2CAP_DEFAULT_ACC_LAT);
2320		efs.flush_to	= cpu_to_le32(L2CAP_DEFAULT_FLUSH_TO);
2321		break;
2322
2323	case L2CAP_MODE_STREAMING:
2324		efs.id		= 1;
2325		efs.stype	= L2CAP_SERV_BESTEFFORT;
2326		efs.msdu	= cpu_to_le16(chan->local_msdu);
2327		efs.sdu_itime	= cpu_to_le32(chan->local_sdu_itime);
2328		efs.acc_lat	= 0;
2329		efs.flush_to	= 0;
2330		break;
2331
2332	default:
2333		return;
2334	}
2335
2336	l2cap_add_conf_opt(ptr, L2CAP_CONF_EFS, sizeof(efs),
2337							(unsigned long) &efs);
2338}
2339
2340static void l2cap_ack_timeout(struct work_struct *work)
2341{
2342	struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
2343							ack_timer.work);
 
2344
2345	BT_DBG("chan %p", chan);
2346
2347	l2cap_chan_lock(chan);
2348
2349	__l2cap_send_ack(chan);
 
2350
2351	l2cap_chan_unlock(chan);
 
2352
 
2353	l2cap_chan_put(chan);
2354}
2355
2356static inline int l2cap_ertm_init(struct l2cap_chan *chan)
2357{
2358	int err;
2359
2360	chan->next_tx_seq = 0;
2361	chan->expected_tx_seq = 0;
2362	chan->expected_ack_seq = 0;
2363	chan->unacked_frames = 0;
2364	chan->buffer_seq = 0;
2365	chan->num_acked = 0;
2366	chan->frames_sent = 0;
2367	chan->last_acked_seq = 0;
2368	chan->sdu = NULL;
2369	chan->sdu_last_frag = NULL;
2370	chan->sdu_len = 0;
2371
2372	skb_queue_head_init(&chan->tx_q);
2373
 
 
 
 
 
2374	if (chan->mode != L2CAP_MODE_ERTM)
2375		return 0;
2376
2377	chan->rx_state = L2CAP_RX_STATE_RECV;
2378	chan->tx_state = L2CAP_TX_STATE_XMIT;
2379
2380	INIT_DELAYED_WORK(&chan->retrans_timer, l2cap_retrans_timeout);
2381	INIT_DELAYED_WORK(&chan->monitor_timer, l2cap_monitor_timeout);
2382	INIT_DELAYED_WORK(&chan->ack_timer, l2cap_ack_timeout);
2383
2384	skb_queue_head_init(&chan->srej_q);
2385
2386	INIT_LIST_HEAD(&chan->srej_l);
2387	err = l2cap_seq_list_init(&chan->srej_list, chan->tx_win);
2388	if (err < 0)
2389		return err;
2390
2391	return l2cap_seq_list_init(&chan->retrans_list, chan->remote_tx_win);
 
 
 
 
2392}
2393
2394static inline __u8 l2cap_select_mode(__u8 mode, __u16 remote_feat_mask)
2395{
2396	switch (mode) {
2397	case L2CAP_MODE_STREAMING:
2398	case L2CAP_MODE_ERTM:
2399		if (l2cap_mode_supported(mode, remote_feat_mask))
2400			return mode;
2401		/* fall through */
2402	default:
2403		return L2CAP_MODE_BASIC;
2404	}
2405}
2406
2407static inline bool __l2cap_ews_supported(struct l2cap_chan *chan)
2408{
2409	return enable_hs && chan->conn->feat_mask & L2CAP_FEAT_EXT_WINDOW;
 
2410}
2411
2412static inline bool __l2cap_efs_supported(struct l2cap_chan *chan)
2413{
2414	return enable_hs && chan->conn->feat_mask & L2CAP_FEAT_EXT_FLOW;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2415}
2416
2417static inline void l2cap_txwin_setup(struct l2cap_chan *chan)
2418{
2419	if (chan->tx_win > L2CAP_DEFAULT_TX_WINDOW &&
2420						__l2cap_ews_supported(chan)) {
2421		/* use extended control field */
2422		set_bit(FLAG_EXT_CTRL, &chan->flags);
2423		chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;
2424	} else {
2425		chan->tx_win = min_t(u16, chan->tx_win,
2426						L2CAP_DEFAULT_TX_WINDOW);
2427		chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
2428	}
 
2429}
2430
2431static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data)
2432{
2433	struct l2cap_conf_req *req = data;
2434	struct l2cap_conf_rfc rfc = { .mode = chan->mode };
2435	void *ptr = req->data;
2436	u16 size;
2437
2438	BT_DBG("chan %p", chan);
2439
2440	if (chan->num_conf_req || chan->num_conf_rsp)
2441		goto done;
2442
2443	switch (chan->mode) {
2444	case L2CAP_MODE_STREAMING:
2445	case L2CAP_MODE_ERTM:
2446		if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state))
2447			break;
2448
2449		if (__l2cap_efs_supported(chan))
2450			set_bit(FLAG_EFS_ENABLE, &chan->flags);
2451
2452		/* fall through */
2453	default:
2454		chan->mode = l2cap_select_mode(rfc.mode, chan->conn->feat_mask);
2455		break;
2456	}
2457
2458done:
2459	if (chan->imtu != L2CAP_DEFAULT_MTU)
2460		l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu);
2461
2462	switch (chan->mode) {
2463	case L2CAP_MODE_BASIC:
 
 
 
2464		if (!(chan->conn->feat_mask & L2CAP_FEAT_ERTM) &&
2465				!(chan->conn->feat_mask & L2CAP_FEAT_STREAMING))
2466			break;
2467
2468		rfc.mode            = L2CAP_MODE_BASIC;
2469		rfc.txwin_size      = 0;
2470		rfc.max_transmit    = 0;
2471		rfc.retrans_timeout = 0;
2472		rfc.monitor_timeout = 0;
2473		rfc.max_pdu_size    = 0;
2474
2475		l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
2476							(unsigned long) &rfc);
2477		break;
2478
2479	case L2CAP_MODE_ERTM:
2480		rfc.mode            = L2CAP_MODE_ERTM;
2481		rfc.max_transmit    = chan->max_tx;
2482		rfc.retrans_timeout = 0;
2483		rfc.monitor_timeout = 0;
2484
2485		size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -
2486						L2CAP_EXT_HDR_SIZE -
2487						L2CAP_SDULEN_SIZE -
2488						L2CAP_FCS_SIZE);
2489		rfc.max_pdu_size = cpu_to_le16(size);
2490
2491		l2cap_txwin_setup(chan);
2492
2493		rfc.txwin_size = min_t(u16, chan->tx_win,
2494						L2CAP_DEFAULT_TX_WINDOW);
2495
2496		l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
2497							(unsigned long) &rfc);
2498
2499		if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
2500			l2cap_add_opt_efs(&ptr, chan);
2501
2502		if (!(chan->conn->feat_mask & L2CAP_FEAT_FCS))
2503			break;
2504
2505		if (chan->fcs == L2CAP_FCS_NONE ||
2506				test_bit(CONF_NO_FCS_RECV, &chan->conf_state)) {
2507			chan->fcs = L2CAP_FCS_NONE;
2508			l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, chan->fcs);
2509		}
2510
2511		if (test_bit(FLAG_EXT_CTRL, &chan->flags))
2512			l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
2513								chan->tx_win);
 
 
 
 
 
 
 
 
2514		break;
2515
2516	case L2CAP_MODE_STREAMING:
 
2517		rfc.mode            = L2CAP_MODE_STREAMING;
2518		rfc.txwin_size      = 0;
2519		rfc.max_transmit    = 0;
2520		rfc.retrans_timeout = 0;
2521		rfc.monitor_timeout = 0;
2522
2523		size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -
2524						L2CAP_EXT_HDR_SIZE -
2525						L2CAP_SDULEN_SIZE -
2526						L2CAP_FCS_SIZE);
2527		rfc.max_pdu_size = cpu_to_le16(size);
2528
2529		l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
2530							(unsigned long) &rfc);
2531
2532		if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
2533			l2cap_add_opt_efs(&ptr, chan);
2534
2535		if (!(chan->conn->feat_mask & L2CAP_FEAT_FCS))
2536			break;
2537
2538		if (chan->fcs == L2CAP_FCS_NONE ||
2539				test_bit(CONF_NO_FCS_RECV, &chan->conf_state)) {
2540			chan->fcs = L2CAP_FCS_NONE;
2541			l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, chan->fcs);
2542		}
2543		break;
2544	}
2545
2546	req->dcid  = cpu_to_le16(chan->dcid);
2547	req->flags = cpu_to_le16(0);
2548
2549	return ptr - data;
2550}
2551
2552static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data)
2553{
2554	struct l2cap_conf_rsp *rsp = data;
2555	void *ptr = rsp->data;
2556	void *req = chan->conf_req;
2557	int len = chan->conf_len;
2558	int type, hint, olen;
2559	unsigned long val;
2560	struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
2561	struct l2cap_conf_efs efs;
2562	u8 remote_efs = 0;
2563	u16 mtu = L2CAP_DEFAULT_MTU;
2564	u16 result = L2CAP_CONF_SUCCESS;
2565	u16 size;
2566
2567	BT_DBG("chan %p", chan);
2568
2569	while (len >= L2CAP_CONF_OPT_SIZE) {
2570		len -= l2cap_get_conf_opt(&req, &type, &olen, &val);
2571
2572		hint  = type & L2CAP_CONF_HINT;
2573		type &= L2CAP_CONF_MASK;
2574
2575		switch (type) {
2576		case L2CAP_CONF_MTU:
2577			mtu = val;
2578			break;
2579
2580		case L2CAP_CONF_FLUSH_TO:
2581			chan->flush_to = val;
2582			break;
2583
2584		case L2CAP_CONF_QOS:
2585			break;
2586
2587		case L2CAP_CONF_RFC:
2588			if (olen == sizeof(rfc))
2589				memcpy(&rfc, (void *) val, olen);
2590			break;
2591
2592		case L2CAP_CONF_FCS:
2593			if (val == L2CAP_FCS_NONE)
2594				set_bit(CONF_NO_FCS_RECV, &chan->conf_state);
2595			break;
2596
2597		case L2CAP_CONF_EFS:
2598			remote_efs = 1;
2599			if (olen == sizeof(efs))
2600				memcpy(&efs, (void *) val, olen);
2601			break;
2602
2603		case L2CAP_CONF_EWS:
2604			if (!enable_hs)
2605				return -ECONNREFUSED;
2606
2607			set_bit(FLAG_EXT_CTRL, &chan->flags);
2608			set_bit(CONF_EWS_RECV, &chan->conf_state);
2609			chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;
2610			chan->remote_tx_win = val;
2611			break;
2612
2613		default:
2614			if (hint)
2615				break;
2616
2617			result = L2CAP_CONF_UNKNOWN;
2618			*((u8 *) ptr++) = type;
2619			break;
2620		}
2621	}
2622
2623	if (chan->num_conf_rsp || chan->num_conf_req > 1)
2624		goto done;
2625
2626	switch (chan->mode) {
2627	case L2CAP_MODE_STREAMING:
2628	case L2CAP_MODE_ERTM:
2629		if (!test_bit(CONF_STATE2_DEVICE, &chan->conf_state)) {
2630			chan->mode = l2cap_select_mode(rfc.mode,
2631					chan->conn->feat_mask);
2632			break;
2633		}
2634
2635		if (remote_efs) {
2636			if (__l2cap_efs_supported(chan))
2637				set_bit(FLAG_EFS_ENABLE, &chan->flags);
2638			else
2639				return -ECONNREFUSED;
2640		}
2641
2642		if (chan->mode != rfc.mode)
2643			return -ECONNREFUSED;
2644
2645		break;
2646	}
2647
2648done:
2649	if (chan->mode != rfc.mode) {
2650		result = L2CAP_CONF_UNACCEPT;
2651		rfc.mode = chan->mode;
2652
2653		if (chan->num_conf_rsp == 1)
2654			return -ECONNREFUSED;
2655
2656		l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
2657					sizeof(rfc), (unsigned long) &rfc);
2658	}
2659
2660	if (result == L2CAP_CONF_SUCCESS) {
2661		/* Configure output options and let the other side know
2662		 * which ones we don't like. */
2663
2664		if (mtu < L2CAP_DEFAULT_MIN_MTU)
2665			result = L2CAP_CONF_UNACCEPT;
2666		else {
2667			chan->omtu = mtu;
2668			set_bit(CONF_MTU_DONE, &chan->conf_state);
2669		}
2670		l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu);
2671
2672		if (remote_efs) {
2673			if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
2674					efs.stype != L2CAP_SERV_NOTRAFIC &&
2675					efs.stype != chan->local_stype) {
2676
2677				result = L2CAP_CONF_UNACCEPT;
2678
2679				if (chan->num_conf_req >= 1)
2680					return -ECONNREFUSED;
2681
2682				l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
2683							sizeof(efs),
2684							(unsigned long) &efs);
2685			} else {
2686				/* Send PENDING Conf Rsp */
2687				result = L2CAP_CONF_PENDING;
2688				set_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
2689			}
2690		}
2691
2692		switch (rfc.mode) {
2693		case L2CAP_MODE_BASIC:
2694			chan->fcs = L2CAP_FCS_NONE;
2695			set_bit(CONF_MODE_DONE, &chan->conf_state);
2696			break;
2697
2698		case L2CAP_MODE_ERTM:
2699			if (!test_bit(CONF_EWS_RECV, &chan->conf_state))
2700				chan->remote_tx_win = rfc.txwin_size;
2701			else
2702				rfc.txwin_size = L2CAP_DEFAULT_TX_WINDOW;
2703
2704			chan->remote_max_tx = rfc.max_transmit;
2705
2706			size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
2707						chan->conn->mtu -
2708						L2CAP_EXT_HDR_SIZE -
2709						L2CAP_SDULEN_SIZE -
2710						L2CAP_FCS_SIZE);
2711			rfc.max_pdu_size = cpu_to_le16(size);
2712			chan->remote_mps = size;
2713
2714			rfc.retrans_timeout =
2715				__constant_cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO);
2716			rfc.monitor_timeout =
2717				__constant_cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO);
2718
2719			set_bit(CONF_MODE_DONE, &chan->conf_state);
2720
2721			l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
2722					sizeof(rfc), (unsigned long) &rfc);
2723
2724			if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
2725				chan->remote_id = efs.id;
2726				chan->remote_stype = efs.stype;
2727				chan->remote_msdu = le16_to_cpu(efs.msdu);
2728				chan->remote_flush_to =
2729						le32_to_cpu(efs.flush_to);
2730				chan->remote_acc_lat =
2731						le32_to_cpu(efs.acc_lat);
2732				chan->remote_sdu_itime =
2733					le32_to_cpu(efs.sdu_itime);
2734				l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
2735					sizeof(efs), (unsigned long) &efs);
 
2736			}
2737			break;
2738
2739		case L2CAP_MODE_STREAMING:
2740			size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
2741						chan->conn->mtu -
2742						L2CAP_EXT_HDR_SIZE -
2743						L2CAP_SDULEN_SIZE -
2744						L2CAP_FCS_SIZE);
2745			rfc.max_pdu_size = cpu_to_le16(size);
2746			chan->remote_mps = size;
2747
2748			set_bit(CONF_MODE_DONE, &chan->conf_state);
2749
2750			l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
2751					sizeof(rfc), (unsigned long) &rfc);
2752
2753			break;
2754
2755		default:
2756			result = L2CAP_CONF_UNACCEPT;
2757
2758			memset(&rfc, 0, sizeof(rfc));
2759			rfc.mode = chan->mode;
2760		}
2761
2762		if (result == L2CAP_CONF_SUCCESS)
2763			set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
2764	}
2765	rsp->scid   = cpu_to_le16(chan->dcid);
2766	rsp->result = cpu_to_le16(result);
2767	rsp->flags  = cpu_to_le16(0x0000);
2768
2769	return ptr - data;
2770}
2771
2772static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len, void *data, u16 *result)
 
2773{
2774	struct l2cap_conf_req *req = data;
2775	void *ptr = req->data;
2776	int type, olen;
2777	unsigned long val;
2778	struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
2779	struct l2cap_conf_efs efs;
2780
2781	BT_DBG("chan %p, rsp %p, len %d, req %p", chan, rsp, len, data);
2782
2783	while (len >= L2CAP_CONF_OPT_SIZE) {
2784		len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
2785
2786		switch (type) {
2787		case L2CAP_CONF_MTU:
2788			if (val < L2CAP_DEFAULT_MIN_MTU) {
2789				*result = L2CAP_CONF_UNACCEPT;
2790				chan->imtu = L2CAP_DEFAULT_MIN_MTU;
2791			} else
2792				chan->imtu = val;
2793			l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu);
2794			break;
2795
2796		case L2CAP_CONF_FLUSH_TO:
2797			chan->flush_to = val;
2798			l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO,
2799							2, chan->flush_to);
2800			break;
2801
2802		case L2CAP_CONF_RFC:
2803			if (olen == sizeof(rfc))
2804				memcpy(&rfc, (void *)val, olen);
2805
2806			if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) &&
2807							rfc.mode != chan->mode)
2808				return -ECONNREFUSED;
2809
2810			chan->fcs = 0;
2811
2812			l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
2813					sizeof(rfc), (unsigned long) &rfc);
2814			break;
2815
2816		case L2CAP_CONF_EWS:
2817			chan->tx_win = min_t(u16, val,
2818						L2CAP_DEFAULT_EXT_WINDOW);
2819			l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
2820							chan->tx_win);
2821			break;
2822
2823		case L2CAP_CONF_EFS:
2824			if (olen == sizeof(efs))
2825				memcpy(&efs, (void *)val, olen);
2826
2827			if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
2828					efs.stype != L2CAP_SERV_NOTRAFIC &&
2829					efs.stype != chan->local_stype)
2830				return -ECONNREFUSED;
2831
2832			l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
2833					sizeof(efs), (unsigned long) &efs);
 
 
 
 
 
 
 
2834			break;
2835		}
2836	}
2837
2838	if (chan->mode == L2CAP_MODE_BASIC && chan->mode != rfc.mode)
2839		return -ECONNREFUSED;
2840
2841	chan->mode = rfc.mode;
2842
2843	if (*result == L2CAP_CONF_SUCCESS || *result == L2CAP_CONF_PENDING) {
2844		switch (rfc.mode) {
2845		case L2CAP_MODE_ERTM:
2846			chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
2847			chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
2848			chan->mps    = le16_to_cpu(rfc.max_pdu_size);
 
 
 
2849
2850			if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
2851				chan->local_msdu = le16_to_cpu(efs.msdu);
2852				chan->local_sdu_itime =
2853						le32_to_cpu(efs.sdu_itime);
2854				chan->local_acc_lat = le32_to_cpu(efs.acc_lat);
2855				chan->local_flush_to =
2856						le32_to_cpu(efs.flush_to);
2857			}
2858			break;
2859
2860		case L2CAP_MODE_STREAMING:
2861			chan->mps    = le16_to_cpu(rfc.max_pdu_size);
2862		}
2863	}
2864
2865	req->dcid   = cpu_to_le16(chan->dcid);
2866	req->flags  = cpu_to_le16(0x0000);
2867
2868	return ptr - data;
2869}
2870
2871static int l2cap_build_conf_rsp(struct l2cap_chan *chan, void *data, u16 result, u16 flags)
 
2872{
2873	struct l2cap_conf_rsp *rsp = data;
2874	void *ptr = rsp->data;
2875
2876	BT_DBG("chan %p", chan);
2877
2878	rsp->scid   = cpu_to_le16(chan->dcid);
2879	rsp->result = cpu_to_le16(result);
2880	rsp->flags  = cpu_to_le16(flags);
2881
2882	return ptr - data;
2883}
2884
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2885void __l2cap_connect_rsp_defer(struct l2cap_chan *chan)
2886{
2887	struct l2cap_conn_rsp rsp;
2888	struct l2cap_conn *conn = chan->conn;
2889	u8 buf[128];
 
2890
2891	rsp.scid   = cpu_to_le16(chan->dcid);
2892	rsp.dcid   = cpu_to_le16(chan->scid);
2893	rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
2894	rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
2895	l2cap_send_cmd(conn, chan->ident,
2896				L2CAP_CONN_RSP, sizeof(rsp), &rsp);
 
 
 
 
 
 
 
2897
2898	if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
2899		return;
2900
2901	l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
2902			l2cap_build_conf_req(chan, buf), buf);
2903	chan->num_conf_req++;
2904}
2905
2906static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len)
2907{
2908	int type, olen;
2909	unsigned long val;
2910	struct l2cap_conf_rfc rfc;
 
 
 
 
 
 
 
 
 
 
2911
2912	BT_DBG("chan %p, rsp %p, len %d", chan, rsp, len);
2913
2914	if ((chan->mode != L2CAP_MODE_ERTM) && (chan->mode != L2CAP_MODE_STREAMING))
2915		return;
2916
2917	while (len >= L2CAP_CONF_OPT_SIZE) {
2918		len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
2919
2920		if (type != L2CAP_CONF_RFC)
2921			continue;
2922
2923		if (olen != sizeof(rfc))
2924			break;
2925
2926		memcpy(&rfc, (void *)val, olen);
2927		goto done;
 
2928	}
2929
2930	/* Use sane default values in case a misbehaving remote device
2931	 * did not send an RFC option.
2932	 */
2933	rfc.mode = chan->mode;
2934	rfc.retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO);
2935	rfc.monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO);
2936	rfc.max_pdu_size = cpu_to_le16(chan->imtu);
2937
2938	BT_ERR("Expected RFC option was not found, using defaults");
2939
2940done:
2941	switch (rfc.mode) {
2942	case L2CAP_MODE_ERTM:
2943		chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
2944		chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
2945		chan->mps    = le16_to_cpu(rfc.max_pdu_size);
 
 
 
 
 
2946		break;
2947	case L2CAP_MODE_STREAMING:
2948		chan->mps    = le16_to_cpu(rfc.max_pdu_size);
2949	}
2950}
2951
2952static inline int l2cap_command_rej(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
 
 
2953{
2954	struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data;
2955
 
 
 
2956	if (rej->reason != L2CAP_REJ_NOT_UNDERSTOOD)
2957		return 0;
2958
2959	if ((conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) &&
2960					cmd->ident == conn->info_ident) {
2961		cancel_delayed_work(&conn->info_timer);
2962
2963		conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
2964		conn->info_ident = 0;
2965
2966		l2cap_conn_start(conn);
2967	}
2968
2969	return 0;
2970}
2971
2972static inline int l2cap_connect_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
 
 
2973{
2974	struct l2cap_conn_req *req = (struct l2cap_conn_req *) data;
2975	struct l2cap_conn_rsp rsp;
2976	struct l2cap_chan *chan = NULL, *pchan;
2977	struct sock *parent, *sk = NULL;
2978	int result, status = L2CAP_CS_NO_INFO;
2979
2980	u16 dcid = 0, scid = __le16_to_cpu(req->scid);
2981	__le16 psm = req->psm;
2982
2983	BT_DBG("psm 0x%2.2x scid 0x%4.4x", __le16_to_cpu(psm), scid);
2984
2985	/* Check if we have socket listening on psm */
2986	pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, conn->src, conn->dst);
 
2987	if (!pchan) {
2988		result = L2CAP_CR_BAD_PSM;
2989		goto sendresp;
2990	}
2991
2992	parent = pchan->sk;
2993
2994	mutex_lock(&conn->chan_lock);
2995	lock_sock(parent);
2996
2997	/* Check if the ACL is secure enough (if not SDP) */
2998	if (psm != cpu_to_le16(0x0001) &&
2999				!hci_conn_check_link_mode(conn->hcon)) {
3000		conn->disc_reason = HCI_ERROR_AUTH_FAILURE;
3001		result = L2CAP_CR_SEC_BLOCK;
3002		goto response;
3003	}
3004
3005	result = L2CAP_CR_NO_MEM;
3006
3007	/* Check for backlog size */
3008	if (sk_acceptq_is_full(parent)) {
3009		BT_DBG("backlog full %d", parent->sk_ack_backlog);
3010		goto response;
3011	}
3012
3013	chan = pchan->ops->new_connection(pchan->data);
3014	if (!chan)
3015		goto response;
3016
3017	sk = chan->sk;
3018
3019	/* Check if we already have channel with that dcid */
3020	if (__l2cap_get_chan_by_dcid(conn, scid)) {
3021		sock_set_flag(sk, SOCK_ZAPPED);
3022		chan->ops->close(chan->data);
3023		goto response;
3024	}
3025
3026	hci_conn_hold(conn->hcon);
3027
3028	bacpy(&bt_sk(sk)->src, conn->src);
3029	bacpy(&bt_sk(sk)->dst, conn->dst);
 
 
3030	chan->psm  = psm;
3031	chan->dcid = scid;
3032
3033	bt_accept_enqueue(parent, sk);
3034
3035	__l2cap_chan_add(conn, chan);
3036
3037	dcid = chan->scid;
3038
3039	__set_chan_timer(chan, sk->sk_sndtimeo);
3040
3041	chan->ident = cmd->ident;
3042
3043	if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) {
3044		if (l2cap_chan_check_security(chan)) {
3045			if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) {
3046				__l2cap_state_change(chan, BT_CONNECT2);
3047				result = L2CAP_CR_PEND;
3048				status = L2CAP_CS_AUTHOR_PEND;
3049				parent->sk_data_ready(parent, 0);
3050			} else {
3051				__l2cap_state_change(chan, BT_CONFIG);
3052				result = L2CAP_CR_SUCCESS;
 
 
 
 
 
 
 
 
 
3053				status = L2CAP_CS_NO_INFO;
3054			}
3055		} else {
3056			__l2cap_state_change(chan, BT_CONNECT2);
3057			result = L2CAP_CR_PEND;
3058			status = L2CAP_CS_AUTHEN_PEND;
3059		}
3060	} else {
3061		__l2cap_state_change(chan, BT_CONNECT2);
3062		result = L2CAP_CR_PEND;
3063		status = L2CAP_CS_NO_INFO;
3064	}
3065
3066response:
3067	release_sock(parent);
3068	mutex_unlock(&conn->chan_lock);
 
3069
3070sendresp:
3071	rsp.scid   = cpu_to_le16(scid);
3072	rsp.dcid   = cpu_to_le16(dcid);
3073	rsp.result = cpu_to_le16(result);
3074	rsp.status = cpu_to_le16(status);
3075	l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_RSP, sizeof(rsp), &rsp);
3076
3077	if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) {
3078		struct l2cap_info_req info;
3079		info.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
3080
3081		conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
3082		conn->info_ident = l2cap_get_ident(conn);
3083
3084		schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
3085
3086		l2cap_send_cmd(conn, conn->info_ident,
3087					L2CAP_INFO_REQ, sizeof(info), &info);
3088	}
3089
3090	if (chan && !test_bit(CONF_REQ_SENT, &chan->conf_state) &&
3091				result == L2CAP_CR_SUCCESS) {
3092		u8 buf[128];
3093		set_bit(CONF_REQ_SENT, &chan->conf_state);
3094		l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
3095					l2cap_build_conf_req(chan, buf), buf);
3096		chan->num_conf_req++;
3097	}
3098
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
3099	return 0;
3100}
3101
3102static inline int l2cap_connect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
 
 
3103{
3104	struct l2cap_conn_rsp *rsp = (struct l2cap_conn_rsp *) data;
3105	u16 scid, dcid, result, status;
3106	struct l2cap_chan *chan;
3107	u8 req[128];
3108	int err;
3109
 
 
 
3110	scid   = __le16_to_cpu(rsp->scid);
3111	dcid   = __le16_to_cpu(rsp->dcid);
3112	result = __le16_to_cpu(rsp->result);
3113	status = __le16_to_cpu(rsp->status);
3114
3115	BT_DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x",
3116						dcid, scid, result, status);
3117
3118	mutex_lock(&conn->chan_lock);
3119
3120	if (scid) {
3121		chan = __l2cap_get_chan_by_scid(conn, scid);
3122		if (!chan) {
3123			err = -EFAULT;
3124			goto unlock;
3125		}
3126	} else {
3127		chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
3128		if (!chan) {
3129			err = -EFAULT;
3130			goto unlock;
3131		}
3132	}
3133
3134	err = 0;
3135
3136	l2cap_chan_lock(chan);
3137
3138	switch (result) {
3139	case L2CAP_CR_SUCCESS:
3140		l2cap_state_change(chan, BT_CONFIG);
3141		chan->ident = 0;
3142		chan->dcid = dcid;
3143		clear_bit(CONF_CONNECT_PEND, &chan->conf_state);
3144
3145		if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
3146			break;
3147
3148		l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
3149					l2cap_build_conf_req(chan, req), req);
3150		chan->num_conf_req++;
3151		break;
3152
3153	case L2CAP_CR_PEND:
3154		set_bit(CONF_CONNECT_PEND, &chan->conf_state);
3155		break;
3156
3157	default:
3158		l2cap_chan_del(chan, ECONNREFUSED);
3159		break;
3160	}
3161
3162	l2cap_chan_unlock(chan);
3163
3164unlock:
3165	mutex_unlock(&conn->chan_lock);
3166
3167	return err;
3168}
3169
3170static inline void set_default_fcs(struct l2cap_chan *chan)
3171{
3172	/* FCS is enabled only in ERTM or streaming mode, if one or both
3173	 * sides request it.
3174	 */
3175	if (chan->mode != L2CAP_MODE_ERTM && chan->mode != L2CAP_MODE_STREAMING)
3176		chan->fcs = L2CAP_FCS_NONE;
3177	else if (!test_bit(CONF_NO_FCS_RECV, &chan->conf_state))
3178		chan->fcs = L2CAP_FCS_CRC16;
3179}
3180
3181static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
3182{
3183	struct l2cap_conf_req *req = (struct l2cap_conf_req *) data;
3184	u16 dcid, flags;
3185	u8 rsp[64];
3186	struct l2cap_chan *chan;
3187	int len, err = 0;
3188
 
 
 
3189	dcid  = __le16_to_cpu(req->dcid);
3190	flags = __le16_to_cpu(req->flags);
3191
3192	BT_DBG("dcid 0x%4.4x flags 0x%2.2x", dcid, flags);
3193
3194	chan = l2cap_get_chan_by_scid(conn, dcid);
3195	if (!chan)
3196		return -ENOENT;
 
 
3197
3198	if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2) {
3199		struct l2cap_cmd_rej_cid rej;
3200
3201		rej.reason = cpu_to_le16(L2CAP_REJ_INVALID_CID);
3202		rej.scid = cpu_to_le16(chan->scid);
3203		rej.dcid = cpu_to_le16(chan->dcid);
3204
3205		l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ,
3206				sizeof(rej), &rej);
3207		goto unlock;
3208	}
3209
3210	/* Reject if config buffer is too small. */
3211	len = cmd_len - sizeof(*req);
3212	if (len < 0 || chan->conf_len + len > sizeof(chan->conf_req)) {
3213		l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
3214				l2cap_build_conf_rsp(chan, rsp,
3215					L2CAP_CONF_REJECT, flags), rsp);
3216		goto unlock;
3217	}
3218
3219	/* Store config. */
3220	memcpy(chan->conf_req + chan->conf_len, req->data, len);
3221	chan->conf_len += len;
3222
3223	if (flags & 0x0001) {
3224		/* Incomplete config. Send empty response. */
3225		l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
3226				l2cap_build_conf_rsp(chan, rsp,
3227					L2CAP_CONF_SUCCESS, 0x0001), rsp);
3228		goto unlock;
3229	}
3230
3231	/* Complete config. */
3232	len = l2cap_parse_conf_req(chan, rsp);
3233	if (len < 0) {
3234		l2cap_send_disconn_req(conn, chan, ECONNRESET);
3235		goto unlock;
3236	}
3237
 
3238	l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp);
3239	chan->num_conf_rsp++;
3240
3241	/* Reset config buffer. */
3242	chan->conf_len = 0;
3243
3244	if (!test_bit(CONF_OUTPUT_DONE, &chan->conf_state))
3245		goto unlock;
3246
3247	if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {
3248		set_default_fcs(chan);
3249
3250		l2cap_state_change(chan, BT_CONNECTED);
3251
3252		if (chan->mode == L2CAP_MODE_ERTM ||
3253		    chan->mode == L2CAP_MODE_STREAMING)
3254			err = l2cap_ertm_init(chan);
3255
3256		if (err < 0)
3257			l2cap_send_disconn_req(chan->conn, chan, -err);
3258		else
3259			l2cap_chan_ready(chan);
3260
3261		goto unlock;
3262	}
3263
3264	if (!test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) {
3265		u8 buf[64];
3266		l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
3267					l2cap_build_conf_req(chan, buf), buf);
3268		chan->num_conf_req++;
3269	}
3270
3271	/* Got Conf Rsp PENDING from remote side and asume we sent
3272	   Conf Rsp PENDING in the code above */
3273	if (test_bit(CONF_REM_CONF_PEND, &chan->conf_state) &&
3274			test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
3275
3276		/* check compatibility */
3277
3278		clear_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
3279		set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
3280
3281		l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
3282					l2cap_build_conf_rsp(chan, rsp,
3283					L2CAP_CONF_SUCCESS, 0x0000), rsp);
3284	}
3285
3286unlock:
3287	l2cap_chan_unlock(chan);
3288	return err;
3289}
3290
3291static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
 
 
3292{
3293	struct l2cap_conf_rsp *rsp = (struct l2cap_conf_rsp *)data;
3294	u16 scid, flags, result;
3295	struct l2cap_chan *chan;
3296	int len = le16_to_cpu(cmd->len) - sizeof(*rsp);
3297	int err = 0;
3298
 
 
 
3299	scid   = __le16_to_cpu(rsp->scid);
3300	flags  = __le16_to_cpu(rsp->flags);
3301	result = __le16_to_cpu(rsp->result);
3302
3303	BT_DBG("scid 0x%4.4x flags 0x%2.2x result 0x%2.2x len %d", scid, flags,
3304	       result, len);
3305
3306	chan = l2cap_get_chan_by_scid(conn, scid);
3307	if (!chan)
3308		return 0;
3309
3310	switch (result) {
3311	case L2CAP_CONF_SUCCESS:
3312		l2cap_conf_rfc_get(chan, rsp->data, len);
3313		clear_bit(CONF_REM_CONF_PEND, &chan->conf_state);
3314		break;
3315
3316	case L2CAP_CONF_PENDING:
3317		set_bit(CONF_REM_CONF_PEND, &chan->conf_state);
3318
3319		if (test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
3320			char buf[64];
3321
3322			len = l2cap_parse_conf_rsp(chan, rsp->data, len,
3323								buf, &result);
3324			if (len < 0) {
3325				l2cap_send_disconn_req(conn, chan, ECONNRESET);
3326				goto done;
3327			}
3328
3329			/* check compatibility */
3330
3331			clear_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
3332			set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
3333
3334			l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
3335						l2cap_build_conf_rsp(chan, buf,
3336						L2CAP_CONF_SUCCESS, 0x0000), buf);
 
3337		}
3338		goto done;
3339
3340	case L2CAP_CONF_UNACCEPT:
3341		if (chan->num_conf_rsp <= L2CAP_CONF_MAX_CONF_RSP) {
3342			char req[64];
3343
3344			if (len > sizeof(req) - sizeof(struct l2cap_conf_req)) {
3345				l2cap_send_disconn_req(conn, chan, ECONNRESET);
3346				goto done;
3347			}
3348
3349			/* throw out any old stored conf requests */
3350			result = L2CAP_CONF_SUCCESS;
3351			len = l2cap_parse_conf_rsp(chan, rsp->data, len,
3352								req, &result);
3353			if (len < 0) {
3354				l2cap_send_disconn_req(conn, chan, ECONNRESET);
3355				goto done;
3356			}
3357
3358			l2cap_send_cmd(conn, l2cap_get_ident(conn),
3359						L2CAP_CONF_REQ, len, req);
3360			chan->num_conf_req++;
3361			if (result != L2CAP_CONF_SUCCESS)
3362				goto done;
3363			break;
3364		}
3365
3366	default:
3367		l2cap_chan_set_err(chan, ECONNRESET);
3368
3369		__set_chan_timer(chan, L2CAP_DISC_REJ_TIMEOUT);
3370		l2cap_send_disconn_req(conn, chan, ECONNRESET);
3371		goto done;
3372	}
3373
3374	if (flags & 0x01)
3375		goto done;
3376
3377	set_bit(CONF_INPUT_DONE, &chan->conf_state);
3378
3379	if (test_bit(CONF_OUTPUT_DONE, &chan->conf_state)) {
3380		set_default_fcs(chan);
3381
3382		l2cap_state_change(chan, BT_CONNECTED);
3383		if (chan->mode == L2CAP_MODE_ERTM ||
3384		    chan->mode == L2CAP_MODE_STREAMING)
3385			err = l2cap_ertm_init(chan);
3386
3387		if (err < 0)
3388			l2cap_send_disconn_req(chan->conn, chan, -err);
3389		else
3390			l2cap_chan_ready(chan);
3391	}
3392
3393done:
3394	l2cap_chan_unlock(chan);
3395	return err;
3396}
3397
3398static inline int l2cap_disconnect_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
 
 
3399{
3400	struct l2cap_disconn_req *req = (struct l2cap_disconn_req *) data;
3401	struct l2cap_disconn_rsp rsp;
3402	u16 dcid, scid;
3403	struct l2cap_chan *chan;
3404	struct sock *sk;
 
 
3405
3406	scid = __le16_to_cpu(req->scid);
3407	dcid = __le16_to_cpu(req->dcid);
3408
3409	BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid);
3410
3411	mutex_lock(&conn->chan_lock);
3412
3413	chan = __l2cap_get_chan_by_scid(conn, dcid);
3414	if (!chan) {
3415		mutex_unlock(&conn->chan_lock);
 
3416		return 0;
3417	}
3418
3419	l2cap_chan_lock(chan);
3420
3421	sk = chan->sk;
3422
3423	rsp.dcid = cpu_to_le16(chan->scid);
3424	rsp.scid = cpu_to_le16(chan->dcid);
3425	l2cap_send_cmd(conn, cmd->ident, L2CAP_DISCONN_RSP, sizeof(rsp), &rsp);
3426
3427	lock_sock(sk);
3428	sk->sk_shutdown = SHUTDOWN_MASK;
3429	release_sock(sk);
3430
3431	l2cap_chan_hold(chan);
3432	l2cap_chan_del(chan, ECONNRESET);
3433
3434	l2cap_chan_unlock(chan);
3435
3436	chan->ops->close(chan->data);
3437	l2cap_chan_put(chan);
3438
3439	mutex_unlock(&conn->chan_lock);
3440
3441	return 0;
3442}
3443
3444static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
 
 
3445{
3446	struct l2cap_disconn_rsp *rsp = (struct l2cap_disconn_rsp *) data;
3447	u16 dcid, scid;
3448	struct l2cap_chan *chan;
3449
 
 
 
3450	scid = __le16_to_cpu(rsp->scid);
3451	dcid = __le16_to_cpu(rsp->dcid);
3452
3453	BT_DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid);
3454
3455	mutex_lock(&conn->chan_lock);
3456
3457	chan = __l2cap_get_chan_by_scid(conn, scid);
3458	if (!chan) {
3459		mutex_unlock(&conn->chan_lock);
3460		return 0;
3461	}
3462
3463	l2cap_chan_lock(chan);
3464
3465	l2cap_chan_hold(chan);
3466	l2cap_chan_del(chan, 0);
3467
3468	l2cap_chan_unlock(chan);
3469
3470	chan->ops->close(chan->data);
3471	l2cap_chan_put(chan);
3472
3473	mutex_unlock(&conn->chan_lock);
3474
3475	return 0;
3476}
3477
3478static inline int l2cap_information_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
 
 
3479{
3480	struct l2cap_info_req *req = (struct l2cap_info_req *) data;
3481	u16 type;
3482
 
 
 
3483	type = __le16_to_cpu(req->type);
3484
3485	BT_DBG("type 0x%4.4x", type);
3486
3487	if (type == L2CAP_IT_FEAT_MASK) {
3488		u8 buf[8];
3489		u32 feat_mask = l2cap_feat_mask;
3490		struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
3491		rsp->type   = cpu_to_le16(L2CAP_IT_FEAT_MASK);
3492		rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
3493		if (!disable_ertm)
3494			feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING
3495							 | L2CAP_FEAT_FCS;
3496		if (enable_hs)
3497			feat_mask |= L2CAP_FEAT_EXT_FLOW
3498						| L2CAP_FEAT_EXT_WINDOW;
3499
3500		put_unaligned_le32(feat_mask, rsp->data);
3501		l2cap_send_cmd(conn, cmd->ident,
3502					L2CAP_INFO_RSP, sizeof(buf), buf);
3503	} else if (type == L2CAP_IT_FIXED_CHAN) {
3504		u8 buf[12];
3505		struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
3506
3507		if (enable_hs)
3508			l2cap_fixed_chan[0] |= L2CAP_FC_A2MP;
3509		else
3510			l2cap_fixed_chan[0] &= ~L2CAP_FC_A2MP;
3511
3512		rsp->type   = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
3513		rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
3514		memcpy(rsp->data, l2cap_fixed_chan, sizeof(l2cap_fixed_chan));
3515		l2cap_send_cmd(conn, cmd->ident,
3516					L2CAP_INFO_RSP, sizeof(buf), buf);
 
3517	} else {
3518		struct l2cap_info_rsp rsp;
3519		rsp.type   = cpu_to_le16(type);
3520		rsp.result = cpu_to_le16(L2CAP_IR_NOTSUPP);
3521		l2cap_send_cmd(conn, cmd->ident,
3522					L2CAP_INFO_RSP, sizeof(rsp), &rsp);
3523	}
3524
3525	return 0;
3526}
3527
3528static inline int l2cap_information_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
 
 
3529{
3530	struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data;
3531	u16 type, result;
3532
 
 
 
3533	type   = __le16_to_cpu(rsp->type);
3534	result = __le16_to_cpu(rsp->result);
3535
3536	BT_DBG("type 0x%4.4x result 0x%2.2x", type, result);
3537
3538	/* L2CAP Info req/rsp are unbound to channels, add extra checks */
3539	if (cmd->ident != conn->info_ident ||
3540			conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)
3541		return 0;
3542
3543	cancel_delayed_work(&conn->info_timer);
3544
3545	if (result != L2CAP_IR_SUCCESS) {
3546		conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
3547		conn->info_ident = 0;
3548
3549		l2cap_conn_start(conn);
3550
3551		return 0;
3552	}
3553
3554	switch (type) {
3555	case L2CAP_IT_FEAT_MASK:
3556		conn->feat_mask = get_unaligned_le32(rsp->data);
3557
3558		if (conn->feat_mask & L2CAP_FEAT_FIXED_CHAN) {
3559			struct l2cap_info_req req;
3560			req.type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
3561
3562			conn->info_ident = l2cap_get_ident(conn);
3563
3564			l2cap_send_cmd(conn, conn->info_ident,
3565					L2CAP_INFO_REQ, sizeof(req), &req);
3566		} else {
3567			conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
3568			conn->info_ident = 0;
3569
3570			l2cap_conn_start(conn);
3571		}
3572		break;
3573
3574	case L2CAP_IT_FIXED_CHAN:
3575		conn->fixed_chan_mask = rsp->data[0];
3576		conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
3577		conn->info_ident = 0;
3578
3579		l2cap_conn_start(conn);
3580		break;
3581	}
3582
3583	return 0;
3584}
3585
3586static inline int l2cap_create_channel_req(struct l2cap_conn *conn,
3587					struct l2cap_cmd_hdr *cmd, u16 cmd_len,
3588					void *data)
3589{
3590	struct l2cap_create_chan_req *req = data;
3591	struct l2cap_create_chan_rsp rsp;
 
 
3592	u16 psm, scid;
3593
3594	if (cmd_len != sizeof(*req))
3595		return -EPROTO;
3596
3597	if (!enable_hs)
3598		return -EINVAL;
3599
3600	psm = le16_to_cpu(req->psm);
3601	scid = le16_to_cpu(req->scid);
3602
3603	BT_DBG("psm %d, scid %d, amp_id %d", psm, scid, req->amp_id);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
3604
3605	/* Placeholder: Always reject */
3606	rsp.dcid = 0;
3607	rsp.scid = cpu_to_le16(scid);
3608	rsp.result = __constant_cpu_to_le16(L2CAP_CR_NO_MEM);
3609	rsp.status = __constant_cpu_to_le16(L2CAP_CS_NO_INFO);
3610
3611	l2cap_send_cmd(conn, cmd->ident, L2CAP_CREATE_CHAN_RSP,
3612		       sizeof(rsp), &rsp);
3613
3614	return 0;
3615}
3616
3617static inline int l2cap_create_channel_rsp(struct l2cap_conn *conn,
3618					struct l2cap_cmd_hdr *cmd, void *data)
3619{
3620	BT_DBG("conn %p", conn);
 
 
 
 
 
 
 
 
 
3621
3622	return l2cap_connect_rsp(conn, cmd, data);
 
 
 
3623}
3624
3625static void l2cap_send_move_chan_rsp(struct l2cap_conn *conn, u8 ident,
3626							u16 icid, u16 result)
3627{
3628	struct l2cap_move_chan_rsp rsp;
3629
3630	BT_DBG("icid %d, result %d", icid, result);
3631
3632	rsp.icid = cpu_to_le16(icid);
3633	rsp.result = cpu_to_le16(result);
3634
3635	l2cap_send_cmd(conn, ident, L2CAP_MOVE_CHAN_RSP, sizeof(rsp), &rsp);
 
3636}
3637
3638static void l2cap_send_move_chan_cfm(struct l2cap_conn *conn,
3639				struct l2cap_chan *chan, u16 icid, u16 result)
3640{
3641	struct l2cap_move_chan_cfm cfm;
3642	u8 ident;
3643
3644	BT_DBG("icid %d, result %d", icid, result);
3645
3646	ident = l2cap_get_ident(conn);
3647	if (chan)
3648		chan->ident = ident;
3649
3650	cfm.icid = cpu_to_le16(icid);
3651	cfm.result = cpu_to_le16(result);
3652
3653	l2cap_send_cmd(conn, ident, L2CAP_MOVE_CHAN_CFM, sizeof(cfm), &cfm);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
3654}
3655
3656static void l2cap_send_move_chan_cfm_rsp(struct l2cap_conn *conn, u8 ident,
3657								u16 icid)
3658{
3659	struct l2cap_move_chan_cfm_rsp rsp;
3660
3661	BT_DBG("icid %d", icid);
3662
3663	rsp.icid = cpu_to_le16(icid);
3664	l2cap_send_cmd(conn, ident, L2CAP_MOVE_CHAN_CFM_RSP, sizeof(rsp), &rsp);
3665}
3666
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
3667static inline int l2cap_move_channel_req(struct l2cap_conn *conn,
3668			struct l2cap_cmd_hdr *cmd, u16 cmd_len, void *data)
 
3669{
3670	struct l2cap_move_chan_req *req = data;
 
 
3671	u16 icid = 0;
3672	u16 result = L2CAP_MR_NOT_ALLOWED;
3673
3674	if (cmd_len != sizeof(*req))
3675		return -EPROTO;
3676
3677	icid = le16_to_cpu(req->icid);
3678
3679	BT_DBG("icid %d, dest_amp_id %d", icid, req->dest_amp_id);
3680
3681	if (!enable_hs)
3682		return -EINVAL;
3683
3684	/* Placeholder: Always refuse */
3685	l2cap_send_move_chan_rsp(conn, cmd->ident, icid, result);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
3686
3687	return 0;
3688}
3689
3690static inline int l2cap_move_channel_rsp(struct l2cap_conn *conn,
3691			struct l2cap_cmd_hdr *cmd, u16 cmd_len, void *data)
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
3692{
3693	struct l2cap_move_chan_rsp *rsp = data;
3694	u16 icid, result;
3695
3696	if (cmd_len != sizeof(*rsp))
3697		return -EPROTO;
3698
3699	icid = le16_to_cpu(rsp->icid);
3700	result = le16_to_cpu(rsp->result);
3701
3702	BT_DBG("icid %d, result %d", icid, result);
3703
3704	/* Placeholder: Always unconfirmed */
3705	l2cap_send_move_chan_cfm(conn, NULL, icid, L2CAP_MC_UNCONFIRMED);
 
 
3706
3707	return 0;
3708}
3709
3710static inline int l2cap_move_channel_confirm(struct l2cap_conn *conn,
3711			struct l2cap_cmd_hdr *cmd, u16 cmd_len, void *data)
 
3712{
3713	struct l2cap_move_chan_cfm *cfm = data;
 
3714	u16 icid, result;
3715
3716	if (cmd_len != sizeof(*cfm))
3717		return -EPROTO;
3718
3719	icid = le16_to_cpu(cfm->icid);
3720	result = le16_to_cpu(cfm->result);
3721
3722	BT_DBG("icid %d, result %d", icid, result);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
3723
3724	l2cap_send_move_chan_cfm_rsp(conn, cmd->ident, icid);
3725
 
 
3726	return 0;
3727}
3728
3729static inline int l2cap_move_channel_confirm_rsp(struct l2cap_conn *conn,
3730			struct l2cap_cmd_hdr *cmd, u16 cmd_len, void *data)
 
3731{
3732	struct l2cap_move_chan_cfm_rsp *rsp = data;
 
3733	u16 icid;
3734
3735	if (cmd_len != sizeof(*rsp))
3736		return -EPROTO;
3737
3738	icid = le16_to_cpu(rsp->icid);
3739
3740	BT_DBG("icid %d", icid);
3741
3742	return 0;
3743}
 
3744
3745static inline int l2cap_check_conn_param(u16 min, u16 max, u16 latency,
3746							u16 to_multiplier)
3747{
3748	u16 max_latency;
3749
3750	if (min > max || min < 6 || max > 3200)
3751		return -EINVAL;
3752
3753	if (to_multiplier < 10 || to_multiplier > 3200)
3754		return -EINVAL;
3755
3756	if (max >= to_multiplier * 8)
3757		return -EINVAL;
3758
3759	max_latency = (to_multiplier * 8 / max) - 1;
3760	if (latency > 499 || latency > max_latency)
3761		return -EINVAL;
3762
3763	return 0;
3764}
3765
3766static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn,
3767					struct l2cap_cmd_hdr *cmd, u8 *data)
 
3768{
3769	struct hci_conn *hcon = conn->hcon;
3770	struct l2cap_conn_param_update_req *req;
3771	struct l2cap_conn_param_update_rsp rsp;
3772	u16 min, max, latency, to_multiplier, cmd_len;
3773	int err;
3774
3775	if (!(hcon->link_mode & HCI_LM_MASTER))
3776		return -EINVAL;
3777
3778	cmd_len = __le16_to_cpu(cmd->len);
3779	if (cmd_len != sizeof(struct l2cap_conn_param_update_req))
3780		return -EPROTO;
3781
3782	req = (struct l2cap_conn_param_update_req *) data;
3783	min		= __le16_to_cpu(req->min);
3784	max		= __le16_to_cpu(req->max);
3785	latency		= __le16_to_cpu(req->latency);
3786	to_multiplier	= __le16_to_cpu(req->to_multiplier);
3787
3788	BT_DBG("min 0x%4.4x max 0x%4.4x latency: 0x%4.4x Timeout: 0x%4.4x",
3789						min, max, latency, to_multiplier);
3790
3791	memset(&rsp, 0, sizeof(rsp));
3792
3793	err = l2cap_check_conn_param(min, max, latency, to_multiplier);
3794	if (err)
3795		rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED);
3796	else
3797		rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_ACCEPTED);
3798
3799	l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_PARAM_UPDATE_RSP,
3800							sizeof(rsp), &rsp);
3801
3802	if (!err)
3803		hci_le_conn_update(hcon, min, max, latency, to_multiplier);
 
 
 
 
 
 
 
 
3804
3805	return 0;
3806}
3807
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
3808static inline int l2cap_bredr_sig_cmd(struct l2cap_conn *conn,
3809			struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
 
3810{
3811	int err = 0;
3812
3813	switch (cmd->code) {
3814	case L2CAP_COMMAND_REJ:
3815		l2cap_command_rej(conn, cmd, data);
3816		break;
3817
3818	case L2CAP_CONN_REQ:
3819		err = l2cap_connect_req(conn, cmd, data);
3820		break;
3821
3822	case L2CAP_CONN_RSP:
3823		err = l2cap_connect_rsp(conn, cmd, data);
 
3824		break;
3825
3826	case L2CAP_CONF_REQ:
3827		err = l2cap_config_req(conn, cmd, cmd_len, data);
3828		break;
3829
3830	case L2CAP_CONF_RSP:
3831		err = l2cap_config_rsp(conn, cmd, data);
3832		break;
3833
3834	case L2CAP_DISCONN_REQ:
3835		err = l2cap_disconnect_req(conn, cmd, data);
3836		break;
3837
3838	case L2CAP_DISCONN_RSP:
3839		err = l2cap_disconnect_rsp(conn, cmd, data);
3840		break;
3841
3842	case L2CAP_ECHO_REQ:
3843		l2cap_send_cmd(conn, cmd->ident, L2CAP_ECHO_RSP, cmd_len, data);
3844		break;
3845
3846	case L2CAP_ECHO_RSP:
3847		break;
3848
3849	case L2CAP_INFO_REQ:
3850		err = l2cap_information_req(conn, cmd, data);
3851		break;
3852
3853	case L2CAP_INFO_RSP:
3854		err = l2cap_information_rsp(conn, cmd, data);
3855		break;
3856
3857	case L2CAP_CREATE_CHAN_REQ:
3858		err = l2cap_create_channel_req(conn, cmd, cmd_len, data);
3859		break;
3860
3861	case L2CAP_CREATE_CHAN_RSP:
3862		err = l2cap_create_channel_rsp(conn, cmd, data);
3863		break;
3864
3865	case L2CAP_MOVE_CHAN_REQ:
3866		err = l2cap_move_channel_req(conn, cmd, cmd_len, data);
3867		break;
3868
3869	case L2CAP_MOVE_CHAN_RSP:
3870		err = l2cap_move_channel_rsp(conn, cmd, cmd_len, data);
3871		break;
3872
3873	case L2CAP_MOVE_CHAN_CFM:
3874		err = l2cap_move_channel_confirm(conn, cmd, cmd_len, data);
3875		break;
3876
3877	case L2CAP_MOVE_CHAN_CFM_RSP:
3878		err = l2cap_move_channel_confirm_rsp(conn, cmd, cmd_len, data);
3879		break;
3880
3881	default:
3882		BT_ERR("Unknown BR/EDR signaling command 0x%2.2x", cmd->code);
3883		err = -EINVAL;
3884		break;
3885	}
3886
3887	return err;
3888}
3889
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
3890static inline int l2cap_le_sig_cmd(struct l2cap_conn *conn,
3891					struct l2cap_cmd_hdr *cmd, u8 *data)
 
3892{
 
 
3893	switch (cmd->code) {
3894	case L2CAP_COMMAND_REJ:
3895		return 0;
 
3896
3897	case L2CAP_CONN_PARAM_UPDATE_REQ:
3898		return l2cap_conn_param_update_req(conn, cmd, data);
 
3899
3900	case L2CAP_CONN_PARAM_UPDATE_RSP:
3901		return 0;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
3902
3903	default:
3904		BT_ERR("Unknown LE signaling command 0x%2.2x", cmd->code);
3905		return -EINVAL;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
3906	}
 
 
 
3907}
3908
3909static inline void l2cap_sig_channel(struct l2cap_conn *conn,
3910							struct sk_buff *skb)
3911{
 
3912	u8 *data = skb->data;
3913	int len = skb->len;
3914	struct l2cap_cmd_hdr cmd;
3915	int err;
3916
3917	l2cap_raw_recv(conn, skb);
3918
 
 
 
3919	while (len >= L2CAP_CMD_HDR_SIZE) {
3920		u16 cmd_len;
3921		memcpy(&cmd, data, L2CAP_CMD_HDR_SIZE);
3922		data += L2CAP_CMD_HDR_SIZE;
3923		len  -= L2CAP_CMD_HDR_SIZE;
3924
3925		cmd_len = le16_to_cpu(cmd.len);
3926
3927		BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd.code, cmd_len, cmd.ident);
 
3928
3929		if (cmd_len > len || !cmd.ident) {
3930			BT_DBG("corrupted command");
3931			break;
3932		}
3933
3934		if (conn->hcon->type == LE_LINK)
3935			err = l2cap_le_sig_cmd(conn, &cmd, data);
3936		else
3937			err = l2cap_bredr_sig_cmd(conn, &cmd, cmd_len, data);
3938
3939		if (err) {
3940			struct l2cap_cmd_rej_unk rej;
3941
3942			BT_ERR("Wrong link type (%d)", err);
3943
3944			/* FIXME: Map err to a valid reason */
3945			rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
3946			l2cap_send_cmd(conn, cmd.ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej);
 
3947		}
3948
3949		data += cmd_len;
3950		len  -= cmd_len;
3951	}
3952
 
3953	kfree_skb(skb);
3954}
3955
3956static int l2cap_check_fcs(struct l2cap_chan *chan,  struct sk_buff *skb)
3957{
3958	u16 our_fcs, rcv_fcs;
3959	int hdr_size;
3960
3961	if (test_bit(FLAG_EXT_CTRL, &chan->flags))
3962		hdr_size = L2CAP_EXT_HDR_SIZE;
3963	else
3964		hdr_size = L2CAP_ENH_HDR_SIZE;
3965
3966	if (chan->fcs == L2CAP_FCS_CRC16) {
3967		skb_trim(skb, skb->len - L2CAP_FCS_SIZE);
3968		rcv_fcs = get_unaligned_le16(skb->data + skb->len);
3969		our_fcs = crc16(0, skb->data - hdr_size, skb->len + hdr_size);
3970
3971		if (our_fcs != rcv_fcs)
3972			return -EBADMSG;
3973	}
3974	return 0;
3975}
3976
3977static inline void l2cap_send_i_or_rr_or_rnr(struct l2cap_chan *chan)
3978{
3979	u32 control = 0;
3980
3981	chan->frames_sent = 0;
3982
3983	control |= __set_reqseq(chan, chan->buffer_seq);
 
 
 
 
3984
3985	if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
3986		control |= __set_ctrl_super(chan, L2CAP_SUPER_RNR);
3987		l2cap_send_sframe(chan, control);
3988		set_bit(CONN_RNR_SENT, &chan->conn_state);
3989	}
3990
3991	if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
3992		l2cap_retransmit_frames(chan);
 
3993
 
3994	l2cap_ertm_send(chan);
3995
3996	if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&
3997			chan->frames_sent == 0) {
3998		control |= __set_ctrl_super(chan, L2CAP_SUPER_RR);
3999		l2cap_send_sframe(chan, control);
4000	}
4001}
4002
4003static int l2cap_add_to_srej_queue(struct l2cap_chan *chan, struct sk_buff *skb, u16 tx_seq, u8 sar)
4004{
4005	struct sk_buff *next_skb;
4006	int tx_seq_offset, next_tx_seq_offset;
4007
4008	bt_cb(skb)->control.txseq = tx_seq;
4009	bt_cb(skb)->control.sar = sar;
4010
4011	next_skb = skb_peek(&chan->srej_q);
4012
4013	tx_seq_offset = __seq_offset(chan, tx_seq, chan->buffer_seq);
4014
4015	while (next_skb) {
4016		if (bt_cb(next_skb)->control.txseq == tx_seq)
4017			return -EINVAL;
4018
4019		next_tx_seq_offset = __seq_offset(chan,
4020			bt_cb(next_skb)->control.txseq, chan->buffer_seq);
4021
4022		if (next_tx_seq_offset > tx_seq_offset) {
4023			__skb_queue_before(&chan->srej_q, next_skb, skb);
4024			return 0;
4025		}
4026
4027		if (skb_queue_is_last(&chan->srej_q, next_skb))
4028			next_skb = NULL;
4029		else
4030			next_skb = skb_queue_next(&chan->srej_q, next_skb);
4031	}
4032
4033	__skb_queue_tail(&chan->srej_q, skb);
4034
4035	return 0;
4036}
4037
4038static void append_skb_frag(struct sk_buff *skb,
4039			struct sk_buff *new_frag, struct sk_buff **last_frag)
4040{
4041	/* skb->len reflects data in skb as well as all fragments
4042	 * skb->data_len reflects only data in fragments
4043	 */
4044	if (!skb_has_frag_list(skb))
4045		skb_shinfo(skb)->frag_list = new_frag;
4046
4047	new_frag->next = NULL;
4048
4049	(*last_frag)->next = new_frag;
4050	*last_frag = new_frag;
4051
4052	skb->len += new_frag->len;
4053	skb->data_len += new_frag->len;
4054	skb->truesize += new_frag->truesize;
4055}
4056
4057static int l2cap_reassemble_sdu(struct l2cap_chan *chan, struct sk_buff *skb, u32 control)
 
4058{
4059	int err = -EINVAL;
4060
4061	switch (__get_ctrl_sar(chan, control)) {
4062	case L2CAP_SAR_UNSEGMENTED:
4063		if (chan->sdu)
4064			break;
4065
4066		err = chan->ops->recv(chan->data, skb);
4067		break;
4068
4069	case L2CAP_SAR_START:
4070		if (chan->sdu)
4071			break;
4072
 
 
 
4073		chan->sdu_len = get_unaligned_le16(skb->data);
4074		skb_pull(skb, L2CAP_SDULEN_SIZE);
4075
4076		if (chan->sdu_len > chan->imtu) {
4077			err = -EMSGSIZE;
4078			break;
4079		}
4080
4081		if (skb->len >= chan->sdu_len)
4082			break;
4083
4084		chan->sdu = skb;
4085		chan->sdu_last_frag = skb;
4086
4087		skb = NULL;
4088		err = 0;
4089		break;
4090
4091	case L2CAP_SAR_CONTINUE:
4092		if (!chan->sdu)
4093			break;
4094
4095		append_skb_frag(chan->sdu, skb,
4096				&chan->sdu_last_frag);
4097		skb = NULL;
4098
4099		if (chan->sdu->len >= chan->sdu_len)
4100			break;
4101
4102		err = 0;
4103		break;
4104
4105	case L2CAP_SAR_END:
4106		if (!chan->sdu)
4107			break;
4108
4109		append_skb_frag(chan->sdu, skb,
4110				&chan->sdu_last_frag);
4111		skb = NULL;
4112
4113		if (chan->sdu->len != chan->sdu_len)
4114			break;
4115
4116		err = chan->ops->recv(chan->data, chan->sdu);
4117
4118		if (!err) {
4119			/* Reassembly complete */
4120			chan->sdu = NULL;
4121			chan->sdu_last_frag = NULL;
4122			chan->sdu_len = 0;
4123		}
4124		break;
4125	}
4126
4127	if (err) {
4128		kfree_skb(skb);
4129		kfree_skb(chan->sdu);
4130		chan->sdu = NULL;
4131		chan->sdu_last_frag = NULL;
4132		chan->sdu_len = 0;
4133	}
4134
4135	return err;
4136}
4137
4138static void l2cap_ertm_enter_local_busy(struct l2cap_chan *chan)
 
 
 
 
 
 
4139{
4140	BT_DBG("chan %p, Enter local busy", chan);
4141
4142	set_bit(CONN_LOCAL_BUSY, &chan->conn_state);
4143	l2cap_seq_list_clear(&chan->srej_list);
4144
4145	__set_ack_timer(chan);
 
4146}
4147
4148static void l2cap_ertm_exit_local_busy(struct l2cap_chan *chan)
4149{
4150	u32 control;
4151
4152	if (!test_bit(CONN_RNR_SENT, &chan->conn_state))
4153		goto done;
4154
4155	control = __set_reqseq(chan, chan->buffer_seq);
4156	control |= __set_ctrl_poll(chan);
4157	control |= __set_ctrl_super(chan, L2CAP_SUPER_RR);
4158	l2cap_send_sframe(chan, control);
4159	chan->retry_count = 1;
4160
4161	__clear_retrans_timer(chan);
4162	__set_monitor_timer(chan);
 
 
4163
4164	set_bit(CONN_WAIT_F, &chan->conn_state);
4165
4166done:
4167	clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);
4168	clear_bit(CONN_RNR_SENT, &chan->conn_state);
4169
4170	BT_DBG("chan %p, Exit local busy", chan);
4171}
 
 
 
 
4172
4173void l2cap_chan_busy(struct l2cap_chan *chan, int busy)
4174{
4175	if (chan->mode == L2CAP_MODE_ERTM) {
4176		if (busy)
4177			l2cap_ertm_enter_local_busy(chan);
4178		else
4179			l2cap_ertm_exit_local_busy(chan);
4180	}
 
 
4181}
4182
4183static void l2cap_check_srej_gap(struct l2cap_chan *chan, u16 tx_seq)
 
4184{
4185	struct sk_buff *skb;
4186	u32 control;
4187
4188	while ((skb = skb_peek(&chan->srej_q)) &&
4189			!test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
4190		int err;
4191
4192		if (bt_cb(skb)->control.txseq != tx_seq)
4193			break;
 
 
 
4194
4195		skb = skb_dequeue(&chan->srej_q);
4196		control = __set_ctrl_sar(chan, bt_cb(skb)->control.sar);
4197		err = l2cap_reassemble_sdu(chan, skb, control);
4198
4199		if (err < 0) {
4200			l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
4201			break;
4202		}
 
4203
4204		chan->buffer_seq_srej = __next_seq(chan, chan->buffer_seq_srej);
4205		tx_seq = __next_seq(chan, tx_seq);
 
 
4206	}
4207}
4208
4209static void l2cap_resend_srejframe(struct l2cap_chan *chan, u16 tx_seq)
4210{
4211	struct srej_list *l, *tmp;
4212	u32 control;
4213
4214	list_for_each_entry_safe(l, tmp, &chan->srej_l, list) {
4215		if (l->tx_seq == tx_seq) {
4216			list_del(&l->list);
4217			kfree(l);
4218			return;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
4219		}
4220		control = __set_ctrl_super(chan, L2CAP_SUPER_SREJ);
4221		control |= __set_reqseq(chan, l->tx_seq);
4222		l2cap_send_sframe(chan, control);
4223		list_del(&l->list);
4224		list_add_tail(&l->list, &chan->srej_l);
4225	}
4226}
4227
4228static int l2cap_send_srejframe(struct l2cap_chan *chan, u16 tx_seq)
 
4229{
4230	struct srej_list *new;
4231	u32 control;
4232
4233	while (tx_seq != chan->expected_tx_seq) {
4234		control = __set_ctrl_super(chan, L2CAP_SUPER_SREJ);
4235		control |= __set_reqseq(chan, chan->expected_tx_seq);
4236		l2cap_seq_list_append(&chan->srej_list, chan->expected_tx_seq);
4237		l2cap_send_sframe(chan, control);
4238
4239		new = kzalloc(sizeof(struct srej_list), GFP_ATOMIC);
4240		if (!new)
4241			return -ENOMEM;
4242
4243		new->tx_seq = chan->expected_tx_seq;
 
 
 
 
4244
4245		chan->expected_tx_seq = __next_seq(chan, chan->expected_tx_seq);
4246
4247		list_add_tail(&new->list, &chan->srej_l);
 
 
 
 
4248	}
4249
4250	chan->expected_tx_seq = __next_seq(chan, chan->expected_tx_seq);
4251
4252	return 0;
 
 
 
 
 
 
 
 
 
 
4253}
4254
4255static inline int l2cap_data_channel_iframe(struct l2cap_chan *chan, u32 rx_control, struct sk_buff *skb)
4256{
4257	u16 tx_seq = __get_txseq(chan, rx_control);
4258	u16 req_seq = __get_reqseq(chan, rx_control);
4259	u8 sar = __get_ctrl_sar(chan, rx_control);
4260	int tx_seq_offset, expected_tx_seq_offset;
4261	int num_to_ack = (chan->tx_win/6) + 1;
4262	int err = 0;
4263
4264	BT_DBG("chan %p len %d tx_seq %d rx_control 0x%8.8x", chan, skb->len,
4265							tx_seq, rx_control);
4266
4267	if (__is_ctrl_final(chan, rx_control) &&
4268			test_bit(CONN_WAIT_F, &chan->conn_state)) {
4269		__clear_monitor_timer(chan);
4270		if (chan->unacked_frames > 0)
4271			__set_retrans_timer(chan);
4272		clear_bit(CONN_WAIT_F, &chan->conn_state);
4273	}
 
 
 
 
 
 
 
4274
4275	chan->expected_ack_seq = req_seq;
4276	l2cap_drop_acked_frames(chan);
 
 
4277
4278	tx_seq_offset = __seq_offset(chan, tx_seq, chan->buffer_seq);
 
 
 
4279
4280	/* invalid tx_seq */
4281	if (tx_seq_offset >= chan->tx_win) {
4282		l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
4283		goto drop;
4284	}
4285
4286	if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
4287		if (!test_bit(CONN_RNR_SENT, &chan->conn_state))
4288			l2cap_send_ack(chan);
4289		goto drop;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
4290	}
 
4291
4292	if (tx_seq == chan->expected_tx_seq)
4293		goto expected;
 
 
 
 
4294
4295	if (test_bit(CONN_SREJ_SENT, &chan->conn_state)) {
4296		struct srej_list *first;
4297
4298		first = list_first_entry(&chan->srej_l,
4299				struct srej_list, list);
4300		if (tx_seq == first->tx_seq) {
4301			l2cap_add_to_srej_queue(chan, skb, tx_seq, sar);
4302			l2cap_check_srej_gap(chan, tx_seq);
4303
4304			list_del(&first->list);
4305			kfree(first);
4306
4307			if (list_empty(&chan->srej_l)) {
4308				chan->buffer_seq = chan->buffer_seq_srej;
4309				clear_bit(CONN_SREJ_SENT, &chan->conn_state);
4310				l2cap_send_ack(chan);
4311				BT_DBG("chan %p, Exit SREJ_SENT", chan);
4312			}
4313		} else {
4314			struct srej_list *l;
4315
4316			/* duplicated tx_seq */
4317			if (l2cap_add_to_srej_queue(chan, skb, tx_seq, sar) < 0)
4318				goto drop;
4319
4320			list_for_each_entry(l, &chan->srej_l, list) {
4321				if (l->tx_seq == tx_seq) {
4322					l2cap_resend_srejframe(chan, tx_seq);
4323					return 0;
 
 
 
 
 
 
 
 
4324				}
4325			}
4326
4327			err = l2cap_send_srejframe(chan, tx_seq);
4328			if (err < 0) {
4329				l2cap_send_disconn_req(chan->conn, chan, -err);
4330				return err;
4331			}
4332		}
4333	} else {
4334		expected_tx_seq_offset = __seq_offset(chan,
4335				chan->expected_tx_seq, chan->buffer_seq);
4336
4337		/* duplicated tx_seq */
4338		if (tx_seq_offset < expected_tx_seq_offset)
4339			goto drop;
 
 
 
 
 
 
4340
4341		set_bit(CONN_SREJ_SENT, &chan->conn_state);
 
 
 
 
 
 
 
4342
4343		BT_DBG("chan %p, Enter SREJ", chan);
 
 
4344
4345		INIT_LIST_HEAD(&chan->srej_l);
4346		chan->buffer_seq_srej = chan->buffer_seq;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
4347
4348		__skb_queue_head_init(&chan->srej_q);
4349		l2cap_add_to_srej_queue(chan, skb, tx_seq, sar);
 
 
 
4350
4351		/* Set P-bit only if there are some I-frames to ack. */
4352		if (__clear_ack_timer(chan))
4353			set_bit(CONN_SEND_PBIT, &chan->conn_state);
 
 
 
 
 
4354
4355		err = l2cap_send_srejframe(chan, tx_seq);
4356		if (err < 0) {
4357			l2cap_send_disconn_req(chan->conn, chan, -err);
4358			return err;
 
 
 
 
 
4359		}
 
 
 
 
 
 
 
 
 
 
 
4360	}
4361	return 0;
4362
4363expected:
4364	chan->expected_tx_seq = __next_seq(chan, chan->expected_tx_seq);
4365
4366	if (test_bit(CONN_SREJ_SENT, &chan->conn_state)) {
4367		bt_cb(skb)->control.txseq = tx_seq;
4368		bt_cb(skb)->control.sar = sar;
4369		__skb_queue_tail(&chan->srej_q, skb);
4370		return 0;
4371	}
4372
4373	err = l2cap_reassemble_sdu(chan, skb, rx_control);
4374	chan->buffer_seq = __next_seq(chan, chan->buffer_seq);
4375
4376	if (err < 0) {
4377		l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
4378		return err;
4379	}
4380
4381	if (__is_ctrl_final(chan, rx_control)) {
4382		if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))
4383			l2cap_retransmit_frames(chan);
4384	}
 
 
 
4385
 
 
4386
4387	chan->num_acked = (chan->num_acked + 1) % num_to_ack;
4388	if (chan->num_acked == num_to_ack - 1)
4389		l2cap_send_ack(chan);
4390	else
4391		__set_ack_timer(chan);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
4392
4393	return 0;
 
 
4394
4395drop:
4396	kfree_skb(skb);
4397	return 0;
4398}
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
4399
4400static inline void l2cap_data_channel_rrframe(struct l2cap_chan *chan, u32 rx_control)
4401{
4402	BT_DBG("chan %p, req_seq %d ctrl 0x%8.8x", chan,
4403				__get_reqseq(chan, rx_control), rx_control);
 
4404
4405	chan->expected_ack_seq = __get_reqseq(chan, rx_control);
4406	l2cap_drop_acked_frames(chan);
 
 
 
 
 
4407
4408	if (__is_ctrl_poll(chan, rx_control)) {
4409		set_bit(CONN_SEND_FBIT, &chan->conn_state);
4410		if (test_bit(CONN_SREJ_SENT, &chan->conn_state)) {
4411			if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state) &&
4412					(chan->unacked_frames > 0))
 
4413				__set_retrans_timer(chan);
4414
4415			clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
4416			l2cap_send_srejtail(chan);
 
 
 
 
 
 
4417		} else {
4418			l2cap_send_i_or_rr_or_rnr(chan);
 
 
 
 
 
4419		}
4420
4421	} else if (__is_ctrl_final(chan, rx_control)) {
4422		clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
 
 
 
 
 
 
4423
4424		if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))
4425			l2cap_retransmit_frames(chan);
 
 
4426
4427	} else {
4428		if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state) &&
4429				(chan->unacked_frames > 0))
4430			__set_retrans_timer(chan);
4431
4432		clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
4433		if (test_bit(CONN_SREJ_SENT, &chan->conn_state))
4434			l2cap_send_ack(chan);
4435		else
4436			l2cap_ertm_send(chan);
4437	}
 
 
 
 
 
 
4438}
4439
4440static inline void l2cap_data_channel_rejframe(struct l2cap_chan *chan, u32 rx_control)
 
 
4441{
4442	u16 tx_seq = __get_reqseq(chan, rx_control);
4443
4444	BT_DBG("chan %p, req_seq %d ctrl 0x%8.8x", chan, tx_seq, rx_control);
 
4445
4446	clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
 
4447
4448	chan->expected_ack_seq = tx_seq;
4449	l2cap_drop_acked_frames(chan);
4450
4451	if (__is_ctrl_final(chan, rx_control)) {
4452		if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))
4453			l2cap_retransmit_frames(chan);
4454	} else {
4455		l2cap_retransmit_frames(chan);
4456
4457		if (test_bit(CONN_WAIT_F, &chan->conn_state))
4458			set_bit(CONN_REJ_ACT, &chan->conn_state);
4459	}
 
 
 
 
 
 
 
 
 
 
 
 
 
 
4460}
4461static inline void l2cap_data_channel_srejframe(struct l2cap_chan *chan, u32 rx_control)
 
 
 
4462{
4463	u16 tx_seq = __get_reqseq(chan, rx_control);
4464
4465	BT_DBG("chan %p, req_seq %d ctrl 0x%8.8x", chan, tx_seq, rx_control);
 
4466
4467	clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
4468
4469	if (__is_ctrl_poll(chan, rx_control)) {
4470		chan->expected_ack_seq = tx_seq;
4471		l2cap_drop_acked_frames(chan);
 
 
 
 
4472
4473		set_bit(CONN_SEND_FBIT, &chan->conn_state);
4474		l2cap_retransmit_one_frame(chan, tx_seq);
 
 
 
4475
4476		l2cap_ertm_send(chan);
 
 
 
4477
4478		if (test_bit(CONN_WAIT_F, &chan->conn_state)) {
4479			chan->srej_save_reqseq = tx_seq;
4480			set_bit(CONN_SREJ_ACT, &chan->conn_state);
4481		}
4482	} else if (__is_ctrl_final(chan, rx_control)) {
4483		if (test_bit(CONN_SREJ_ACT, &chan->conn_state) &&
4484				chan->srej_save_reqseq == tx_seq)
4485			clear_bit(CONN_SREJ_ACT, &chan->conn_state);
4486		else
4487			l2cap_retransmit_one_frame(chan, tx_seq);
4488	} else {
4489		l2cap_retransmit_one_frame(chan, tx_seq);
4490		if (test_bit(CONN_WAIT_F, &chan->conn_state)) {
4491			chan->srej_save_reqseq = tx_seq;
4492			set_bit(CONN_SREJ_ACT, &chan->conn_state);
4493		}
4494	}
4495}
4496
4497static inline void l2cap_data_channel_rnrframe(struct l2cap_chan *chan, u32 rx_control)
4498{
4499	u16 tx_seq = __get_reqseq(chan, rx_control);
4500
4501	BT_DBG("chan %p, req_seq %d ctrl 0x%8.8x", chan, tx_seq, rx_control);
4502
4503	set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
4504	chan->expected_ack_seq = tx_seq;
4505	l2cap_drop_acked_frames(chan);
4506
4507	if (__is_ctrl_poll(chan, rx_control))
4508		set_bit(CONN_SEND_FBIT, &chan->conn_state);
 
 
4509
4510	if (!test_bit(CONN_SREJ_SENT, &chan->conn_state)) {
4511		__clear_retrans_timer(chan);
4512		if (__is_ctrl_poll(chan, rx_control))
4513			l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_FINAL);
4514		return;
4515	}
4516
4517	if (__is_ctrl_poll(chan, rx_control)) {
4518		l2cap_send_srejtail(chan);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
4519	} else {
4520		rx_control = __set_ctrl_super(chan, L2CAP_SUPER_RR);
4521		l2cap_send_sframe(chan, rx_control);
 
 
4522	}
 
 
4523}
4524
4525static inline int l2cap_data_channel_sframe(struct l2cap_chan *chan, u32 rx_control, struct sk_buff *skb)
 
4526{
4527	BT_DBG("chan %p rx_control 0x%8.8x len %d", chan, rx_control, skb->len);
 
4528
4529	if (__is_ctrl_final(chan, rx_control) &&
4530			test_bit(CONN_WAIT_F, &chan->conn_state)) {
4531		__clear_monitor_timer(chan);
4532		if (chan->unacked_frames > 0)
4533			__set_retrans_timer(chan);
4534		clear_bit(CONN_WAIT_F, &chan->conn_state);
4535	}
4536
4537	switch (__get_ctrl_super(chan, rx_control)) {
4538	case L2CAP_SUPER_RR:
4539		l2cap_data_channel_rrframe(chan, rx_control);
4540		break;
4541
4542	case L2CAP_SUPER_REJ:
4543		l2cap_data_channel_rejframe(chan, rx_control);
4544		break;
4545
4546	case L2CAP_SUPER_SREJ:
4547		l2cap_data_channel_srejframe(chan, rx_control);
4548		break;
 
 
 
 
 
4549
4550	case L2CAP_SUPER_RNR:
4551		l2cap_data_channel_rnrframe(chan, rx_control);
4552		break;
 
4553	}
4554
4555	kfree_skb(skb);
 
 
4556	return 0;
4557}
4558
4559static int l2cap_ertm_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
4560{
4561	u32 control;
4562	u16 req_seq;
4563	int len, next_tx_seq_offset, req_seq_offset;
4564
4565	__unpack_control(chan, skb);
4566
4567	control = __get_control(chan, skb->data);
4568	skb_pull(skb, __ctrl_size(chan));
4569	len = skb->len;
4570
4571	/*
4572	 * We can just drop the corrupted I-frame here.
4573	 * Receiver will miss it and start proper recovery
4574	 * procedures and ask retransmission.
4575	 */
4576	if (l2cap_check_fcs(chan, skb))
4577		goto drop;
4578
4579	if (__is_sar_start(chan, control) && !__is_sframe(chan, control))
4580		len -= L2CAP_SDULEN_SIZE;
4581
4582	if (chan->fcs == L2CAP_FCS_CRC16)
4583		len -= L2CAP_FCS_SIZE;
4584
4585	if (len > chan->mps) {
4586		l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
4587		goto drop;
4588	}
4589
4590	req_seq = __get_reqseq(chan, control);
 
 
4591
4592	req_seq_offset = __seq_offset(chan, req_seq, chan->expected_ack_seq);
 
4593
4594	next_tx_seq_offset = __seq_offset(chan, chan->next_tx_seq,
4595						chan->expected_ack_seq);
 
4596
4597	/* check for invalid req-seq */
4598	if (req_seq_offset > next_tx_seq_offset) {
4599		l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
4600		goto drop;
4601	}
4602
4603	if (!__is_sframe(chan, control)) {
4604		if (len < 0) {
4605			l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
4606			goto drop;
 
 
 
 
 
 
4607		}
4608
4609		l2cap_data_channel_iframe(chan, control, skb);
 
4610	} else {
 
 
 
 
 
 
 
 
 
 
 
 
 
4611		if (len != 0) {
4612			BT_ERR("%d", len);
4613			l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
4614			goto drop;
4615		}
4616
4617		l2cap_data_channel_sframe(chan, control, skb);
 
 
 
 
 
 
 
4618	}
4619
4620	return 0;
4621
4622drop:
4623	kfree_skb(skb);
4624	return 0;
4625}
4626
4627static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk_buff *skb)
4628{
4629	struct l2cap_chan *chan;
4630	u32 control;
4631	u16 tx_seq;
4632	int len;
4633
4634	chan = l2cap_get_chan_by_scid(conn, cid);
4635	if (!chan) {
4636		BT_DBG("unknown cid 0x%4.4x", cid);
4637		/* Drop packet and return */
4638		kfree_skb(skb);
4639		return 0;
4640	}
4641
4642	BT_DBG("chan %p, len %d", chan, skb->len);
4643
4644	if (chan->state != BT_CONNECTED)
4645		goto drop;
4646
4647	switch (chan->mode) {
4648	case L2CAP_MODE_BASIC:
4649		/* If socket recv buffers overflows we drop data here
4650		 * which is *bad* because L2CAP has to be reliable.
4651		 * But we don't have any other choice. L2CAP doesn't
4652		 * provide flow control mechanism. */
4653
4654		if (chan->imtu < skb->len)
4655			goto drop;
4656
4657		if (!chan->ops->recv(chan->data, skb))
4658			goto done;
4659		break;
4660
4661	case L2CAP_MODE_ERTM:
4662		l2cap_ertm_data_rcv(chan, skb);
4663
4664		goto done;
 
 
4665
4666	case L2CAP_MODE_STREAMING:
4667		control = __get_control(chan, skb->data);
4668		skb_pull(skb, __ctrl_size(chan));
4669		len = skb->len;
 
4670
4671		if (l2cap_check_fcs(chan, skb))
4672			goto drop;
 
 
4673
4674		if (__is_sar_start(chan, control))
4675			len -= L2CAP_SDULEN_SIZE;
4676
4677		if (chan->fcs == L2CAP_FCS_CRC16)
4678			len -= L2CAP_FCS_SIZE;
4679
4680		if (len > chan->mps || len < 0 || __is_sframe(chan, control))
4681			goto drop;
4682
4683		tx_seq = __get_txseq(chan, control);
 
4684
4685		if (chan->expected_tx_seq != tx_seq) {
4686			/* Frame(s) missing - must discard partial SDU */
4687			kfree_skb(chan->sdu);
4688			chan->sdu = NULL;
4689			chan->sdu_last_frag = NULL;
4690			chan->sdu_len = 0;
4691
4692			/* TODO: Notify userland of missing data */
 
 
 
4693		}
4694
4695		chan->expected_tx_seq = __next_seq(chan, tx_seq);
 
 
 
 
4696
4697		if (l2cap_reassemble_sdu(chan, skb, control) == -EMSGSIZE)
4698			l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
4699
4700		goto done;
 
 
4701
4702	default:
4703		BT_DBG("chan %p: bad mode 0x%2.2x", chan, chan->mode);
4704		break;
4705	}
4706
4707drop:
4708	kfree_skb(skb);
4709
4710done:
4711	l2cap_chan_unlock(chan);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
4712
 
 
 
 
4713	return 0;
4714}
4715
4716static inline int l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm, struct sk_buff *skb)
 
4717{
4718	struct l2cap_chan *chan;
4719
4720	chan = l2cap_global_chan_by_psm(0, psm, conn->src, conn->dst);
4721	if (!chan)
4722		goto drop;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
4723
4724	BT_DBG("chan %p, len %d", chan, skb->len);
4725
4726	if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)
4727		goto drop;
 
 
 
 
4728
4729	if (chan->imtu < skb->len)
4730		goto drop;
4731
4732	if (!chan->ops->recv(chan->data, skb))
4733		return 0;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
4734
4735drop:
4736	kfree_skb(skb);
4737
4738	return 0;
 
4739}
4740
4741static inline int l2cap_att_channel(struct l2cap_conn *conn, u16 cid,
4742				    struct sk_buff *skb)
4743{
 
4744	struct l2cap_chan *chan;
4745
4746	chan = l2cap_global_chan_by_scid(0, cid, conn->src, conn->dst);
 
 
 
 
4747	if (!chan)
4748		goto drop;
4749
4750	BT_DBG("chan %p, len %d", chan, skb->len);
4751
4752	if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)
4753		goto drop;
4754
4755	if (chan->imtu < skb->len)
4756		goto drop;
4757
4758	if (!chan->ops->recv(chan->data, skb))
4759		return 0;
 
 
 
 
 
 
4760
4761drop:
 
 
4762	kfree_skb(skb);
4763
4764	return 0;
4765}
4766
4767static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
4768{
4769	struct l2cap_hdr *lh = (void *) skb->data;
 
4770	u16 cid, len;
4771	__le16 psm;
4772
 
 
 
 
 
 
4773	skb_pull(skb, L2CAP_HDR_SIZE);
4774	cid = __le16_to_cpu(lh->cid);
4775	len = __le16_to_cpu(lh->len);
4776
4777	if (len != skb->len) {
4778		kfree_skb(skb);
4779		return;
4780	}
4781
 
 
 
 
 
 
 
 
 
 
4782	BT_DBG("len %d, cid 0x%4.4x", len, cid);
4783
4784	switch (cid) {
4785	case L2CAP_CID_LE_SIGNALING:
4786	case L2CAP_CID_SIGNALING:
4787		l2cap_sig_channel(conn, skb);
4788		break;
4789
4790	case L2CAP_CID_CONN_LESS:
4791		psm = get_unaligned((__le16 *) skb->data);
4792		skb_pull(skb, 2);
4793		l2cap_conless_channel(conn, psm, skb);
4794		break;
4795
4796	case L2CAP_CID_LE_DATA:
4797		l2cap_att_channel(conn, cid, skb);
4798		break;
4799
4800	case L2CAP_CID_SMP:
4801		if (smp_sig_channel(conn, skb))
4802			l2cap_conn_del(conn->hcon, EACCES);
4803		break;
 
 
 
 
 
 
 
 
 
 
4804
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
4805	default:
4806		l2cap_data_channel(conn, cid, skb);
4807		break;
4808	}
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
4809}
 
4810
4811/* ---- L2CAP interface with lower layer (HCI) ---- */
4812
4813int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr)
4814{
4815	int exact = 0, lm1 = 0, lm2 = 0;
4816	struct l2cap_chan *c;
4817
4818	BT_DBG("hdev %s, bdaddr %s", hdev->name, batostr(bdaddr));
4819
4820	/* Find listening sockets and check their link_mode */
4821	read_lock(&chan_list_lock);
4822	list_for_each_entry(c, &chan_list, global_l) {
4823		struct sock *sk = c->sk;
4824
4825		if (c->state != BT_LISTEN)
4826			continue;
4827
4828		if (!bacmp(&bt_sk(sk)->src, &hdev->bdaddr)) {
4829			lm1 |= HCI_LM_ACCEPT;
4830			if (test_bit(FLAG_ROLE_SWITCH, &c->flags))
4831				lm1 |= HCI_LM_MASTER;
4832			exact++;
4833		} else if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY)) {
4834			lm2 |= HCI_LM_ACCEPT;
4835			if (test_bit(FLAG_ROLE_SWITCH, &c->flags))
4836				lm2 |= HCI_LM_MASTER;
4837		}
4838	}
4839	read_unlock(&chan_list_lock);
4840
4841	return exact ? lm1 : lm2;
4842}
4843
4844int l2cap_connect_cfm(struct hci_conn *hcon, u8 status)
 
 
 
 
 
4845{
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
4846	struct l2cap_conn *conn;
 
 
 
 
 
4847
4848	BT_DBG("hcon %p bdaddr %s status %d", hcon, batostr(&hcon->dst), status);
4849
4850	if (!status) {
4851		conn = l2cap_conn_add(hcon, status);
4852		if (conn)
4853			l2cap_conn_ready(conn);
4854	} else
4855		l2cap_conn_del(hcon, bt_to_errno(status));
 
 
4856
4857	return 0;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
4858}
4859
4860int l2cap_disconn_ind(struct hci_conn *hcon)
4861{
4862	struct l2cap_conn *conn = hcon->l2cap_data;
4863
4864	BT_DBG("hcon %p", hcon);
4865
4866	if (!conn)
4867		return HCI_ERROR_REMOTE_USER_TERM;
4868	return conn->disc_reason;
4869}
4870
4871int l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason)
4872{
 
 
 
4873	BT_DBG("hcon %p reason %d", hcon, reason);
4874
4875	l2cap_conn_del(hcon, bt_to_errno(reason));
4876	return 0;
4877}
4878
4879static inline void l2cap_check_encryption(struct l2cap_chan *chan, u8 encrypt)
4880{
4881	if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED)
4882		return;
4883
4884	if (encrypt == 0x00) {
4885		if (chan->sec_level == BT_SECURITY_MEDIUM) {
4886			__set_chan_timer(chan, L2CAP_ENC_TIMEOUT);
4887		} else if (chan->sec_level == BT_SECURITY_HIGH)
 
4888			l2cap_chan_close(chan, ECONNREFUSED);
4889	} else {
4890		if (chan->sec_level == BT_SECURITY_MEDIUM)
4891			__clear_chan_timer(chan);
4892	}
4893}
4894
4895int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
4896{
4897	struct l2cap_conn *conn = hcon->l2cap_data;
4898	struct l2cap_chan *chan;
4899
4900	if (!conn)
4901		return 0;
4902
4903	BT_DBG("conn %p", conn);
4904
4905	if (hcon->type == LE_LINK) {
4906		if (!status && encrypt)
4907			smp_distribute_keys(conn, 0);
4908		cancel_delayed_work(&conn->security_timer);
4909	}
4910
4911	mutex_lock(&conn->chan_lock);
4912
4913	list_for_each_entry(chan, &conn->chan_l, list) {
4914		l2cap_chan_lock(chan);
4915
4916		BT_DBG("chan->scid %d", chan->scid);
4917
4918		if (chan->scid == L2CAP_CID_LE_DATA) {
4919			if (!status && encrypt) {
4920				chan->sec_level = hcon->sec_level;
4921				l2cap_chan_ready(chan);
4922			}
4923
 
4924			l2cap_chan_unlock(chan);
4925			continue;
4926		}
4927
4928		if (test_bit(CONF_CONNECT_PEND, &chan->conf_state)) {
 
 
 
4929			l2cap_chan_unlock(chan);
4930			continue;
4931		}
4932
4933		if (!status && (chan->state == BT_CONNECTED ||
4934						chan->state == BT_CONFIG)) {
4935			struct sock *sk = chan->sk;
4936
4937			clear_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
4938			sk->sk_state_change(sk);
4939
4940			l2cap_check_encryption(chan, encrypt);
4941			l2cap_chan_unlock(chan);
4942			continue;
4943		}
4944
4945		if (chan->state == BT_CONNECT) {
4946			if (!status) {
4947				l2cap_send_conn_req(chan);
4948			} else {
4949				__set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
4950			}
4951		} else if (chan->state == BT_CONNECT2) {
4952			struct sock *sk = chan->sk;
4953			struct l2cap_conn_rsp rsp;
4954			__u16 res, stat;
4955
4956			lock_sock(sk);
4957
4958			if (!status) {
4959				if (test_bit(BT_SK_DEFER_SETUP,
4960					     &bt_sk(sk)->flags)) {
4961					struct sock *parent = bt_sk(sk)->parent;
4962					res = L2CAP_CR_PEND;
4963					stat = L2CAP_CS_AUTHOR_PEND;
4964					if (parent)
4965						parent->sk_data_ready(parent, 0);
4966				} else {
4967					__l2cap_state_change(chan, BT_CONFIG);
4968					res = L2CAP_CR_SUCCESS;
4969					stat = L2CAP_CS_NO_INFO;
4970				}
4971			} else {
4972				__l2cap_state_change(chan, BT_DISCONN);
4973				__set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
4974				res = L2CAP_CR_SEC_BLOCK;
4975				stat = L2CAP_CS_NO_INFO;
4976			}
4977
4978			release_sock(sk);
4979
4980			rsp.scid   = cpu_to_le16(chan->dcid);
4981			rsp.dcid   = cpu_to_le16(chan->scid);
4982			rsp.result = cpu_to_le16(res);
4983			rsp.status = cpu_to_le16(stat);
4984			l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
4985							sizeof(rsp), &rsp);
 
 
 
 
 
 
 
 
 
 
 
4986		}
4987
4988		l2cap_chan_unlock(chan);
4989	}
4990
4991	mutex_unlock(&conn->chan_lock);
4992
4993	return 0;
4994}
4995
4996int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
4997{
4998	struct l2cap_conn *conn = hcon->l2cap_data;
 
 
 
 
 
 
4999
5000	if (!conn)
5001		conn = l2cap_conn_add(hcon, 0);
5002
5003	if (!conn)
5004		goto drop;
5005
5006	BT_DBG("conn %p len %d flags 0x%x", conn, skb->len, flags);
5007
5008	if (!(flags & ACL_CONT)) {
5009		struct l2cap_hdr *hdr;
5010		int len;
5011
5012		if (conn->rx_len) {
5013			BT_ERR("Unexpected start frame (len %d)", skb->len);
5014			kfree_skb(conn->rx_skb);
5015			conn->rx_skb = NULL;
5016			conn->rx_len = 0;
5017			l2cap_conn_unreliable(conn, ECOMM);
5018		}
5019
5020		/* Start fragment always begin with Basic L2CAP header */
5021		if (skb->len < L2CAP_HDR_SIZE) {
5022			BT_ERR("Frame is too short (len %d)", skb->len);
5023			l2cap_conn_unreliable(conn, ECOMM);
5024			goto drop;
5025		}
5026
5027		hdr = (struct l2cap_hdr *) skb->data;
5028		len = __le16_to_cpu(hdr->len) + L2CAP_HDR_SIZE;
5029
5030		if (len == skb->len) {
5031			/* Complete frame received */
5032			l2cap_recv_frame(conn, skb);
5033			return 0;
5034		}
5035
5036		BT_DBG("Start: total len %d, frag len %d", len, skb->len);
5037
5038		if (skb->len > len) {
5039			BT_ERR("Frame is too long (len %d, expected len %d)",
5040				skb->len, len);
5041			l2cap_conn_unreliable(conn, ECOMM);
5042			goto drop;
5043		}
5044
5045		/* Allocate skb for the complete frame (with header) */
5046		conn->rx_skb = bt_skb_alloc(len, GFP_ATOMIC);
5047		if (!conn->rx_skb)
5048			goto drop;
5049
5050		skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
5051								skb->len);
5052		conn->rx_len = len - skb->len;
5053	} else {
 
 
5054		BT_DBG("Cont: frag len %d (expecting %d)", skb->len, conn->rx_len);
5055
5056		if (!conn->rx_len) {
5057			BT_ERR("Unexpected continuation frame (len %d)", skb->len);
5058			l2cap_conn_unreliable(conn, ECOMM);
5059			goto drop;
5060		}
5061
5062		if (skb->len > conn->rx_len) {
5063			BT_ERR("Fragment is too long (len %d, expected %d)",
5064					skb->len, conn->rx_len);
5065			kfree_skb(conn->rx_skb);
5066			conn->rx_skb = NULL;
5067			conn->rx_len = 0;
5068			l2cap_conn_unreliable(conn, ECOMM);
5069			goto drop;
5070		}
5071
5072		skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
5073								skb->len);
5074		conn->rx_len -= skb->len;
5075
5076		if (!conn->rx_len) {
5077			/* Complete frame received */
5078			l2cap_recv_frame(conn, conn->rx_skb);
 
 
 
5079			conn->rx_skb = NULL;
 
5080		}
 
5081	}
5082
5083drop:
5084	kfree_skb(skb);
5085	return 0;
5086}
5087
 
 
 
 
 
 
 
5088static int l2cap_debugfs_show(struct seq_file *f, void *p)
5089{
5090	struct l2cap_chan *c;
5091
5092	read_lock(&chan_list_lock);
5093
5094	list_for_each_entry(c, &chan_list, global_l) {
5095		struct sock *sk = c->sk;
5096
5097		seq_printf(f, "%s %s %d %d 0x%4.4x 0x%4.4x %d %d %d %d\n",
5098					batostr(&bt_sk(sk)->src),
5099					batostr(&bt_sk(sk)->dst),
5100					c->state, __le16_to_cpu(c->psm),
5101					c->scid, c->dcid, c->imtu, c->omtu,
5102					c->sec_level, c->mode);
5103	}
5104
5105	read_unlock(&chan_list_lock);
5106
5107	return 0;
5108}
5109
5110static int l2cap_debugfs_open(struct inode *inode, struct file *file)
5111{
5112	return single_open(file, l2cap_debugfs_show, inode->i_private);
5113}
5114
5115static const struct file_operations l2cap_debugfs_fops = {
5116	.open		= l2cap_debugfs_open,
5117	.read		= seq_read,
5118	.llseek		= seq_lseek,
5119	.release	= single_release,
5120};
5121
5122static struct dentry *l2cap_debugfs;
5123
5124int __init l2cap_init(void)
5125{
5126	int err;
5127
5128	err = l2cap_init_sockets();
5129	if (err < 0)
5130		return err;
5131
5132	if (bt_debugfs) {
5133		l2cap_debugfs = debugfs_create_file("l2cap", 0444,
5134					bt_debugfs, NULL, &l2cap_debugfs_fops);
5135		if (!l2cap_debugfs)
5136			BT_ERR("Failed to create L2CAP debug file");
5137	}
 
 
 
 
 
 
5138
5139	return 0;
5140}
5141
5142void l2cap_exit(void)
5143{
5144	debugfs_remove(l2cap_debugfs);
 
5145	l2cap_cleanup_sockets();
5146}
5147
5148module_param(disable_ertm, bool, 0644);
5149MODULE_PARM_DESC(disable_ertm, "Disable enhanced retransmission mode");