1/*
   2   BlueZ - Bluetooth protocol stack for Linux
   3   Copyright (C) 2000-2001 Qualcomm Incorporated
   4   Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
   5   Copyright (C) 2010 Google Inc.
   6   Copyright (C) 2011 ProFUSION Embedded Systems
   7   Copyright (c) 2012 Code Aurora Forum.  All rights reserved.
   8
   9   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
  10
  11   This program is free software; you can redistribute it and/or modify
  12   it under the terms of the GNU General Public License version 2 as
  13   published by the Free Software Foundation;
  14
  15   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  16   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  17   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  18   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  19   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  20   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  21   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  22   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  23
  24   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  25   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  26   SOFTWARE IS DISCLAIMED.
  27*/
  28
  29/* Bluetooth L2CAP core. */
  30
  31#include <linux/module.h>
  32
  33#include <linux/debugfs.h>
  34#include <linux/crc16.h>
  35#include <linux/filter.h>
  36
  37#include <net/bluetooth/bluetooth.h>
  38#include <net/bluetooth/hci_core.h>
  39#include <net/bluetooth/l2cap.h>
  40
  41#include "smp.h"
  42#include "a2mp.h"
  43#include "amp.h"
  44
  45#define LE_FLOWCTL_MAX_CREDITS 65535
  46
  47bool disable_ertm;
 
  48
  49static u32 l2cap_feat_mask = L2CAP_FEAT_FIXED_CHAN | L2CAP_FEAT_UCD;
  50
  51static LIST_HEAD(chan_list);
  52static DEFINE_RWLOCK(chan_list_lock);
  53
  54static u16 le_max_credits = L2CAP_LE_MAX_CREDITS;
  55static u16 le_default_mps = L2CAP_LE_DEFAULT_MPS;
  56
  57static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
  58				       u8 code, u8 ident, u16 dlen, void *data);
  59static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
  60			   void *data);
  61static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data);
  62static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err);
  63
  64static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
  65		     struct sk_buff_head *skbs, u8 event);
 
 
 
  66
  67static inline u8 bdaddr_type(u8 link_type, u8 bdaddr_type)
  68{
  69	if (link_type == LE_LINK) {
  70		if (bdaddr_type == ADDR_LE_DEV_PUBLIC)
  71			return BDADDR_LE_PUBLIC;
  72		else
  73			return BDADDR_LE_RANDOM;
  74	}
  75
  76	return BDADDR_BREDR;
  77}
  78
  79static inline u8 bdaddr_src_type(struct hci_conn *hcon)
  80{
  81	return bdaddr_type(hcon->type, hcon->src_type);
  82}
  83
  84static inline u8 bdaddr_dst_type(struct hci_conn *hcon)
  85{
  86	return bdaddr_type(hcon->type, hcon->dst_type);
  87}
  88
  89/* ---- L2CAP channels ---- */
  90
  91static struct l2cap_chan *__l2cap_get_chan_by_dcid(struct l2cap_conn *conn,
  92						   u16 cid)
  93{
  94	struct l2cap_chan *c;
  95
  96	list_for_each_entry(c, &conn->chan_l, list) {
  97		if (c->dcid == cid)
  98			return c;
  99	}
 100	return NULL;
 101}
 102
 103static struct l2cap_chan *__l2cap_get_chan_by_scid(struct l2cap_conn *conn,
 104						   u16 cid)
 105{
 106	struct l2cap_chan *c;
 107
 108	list_for_each_entry(c, &conn->chan_l, list) {
 109		if (c->scid == cid)
 110			return c;
 111	}
 112	return NULL;
 113}
 114
 115/* Find channel with given SCID.
 116 * Returns locked channel. */
 
 117static struct l2cap_chan *l2cap_get_chan_by_scid(struct l2cap_conn *conn,
 118						 u16 cid)
 119{
 120	struct l2cap_chan *c;
 121
 122	mutex_lock(&conn->chan_lock);
 123	c = __l2cap_get_chan_by_scid(conn, cid);
 124	if (c)
 125		l2cap_chan_lock(c);
 
 
 
 
 126	mutex_unlock(&conn->chan_lock);
 127
 128	return c;
 129}
 130
 131/* Find channel with given DCID.
 132 * Returns locked channel.
 133 */
 134static struct l2cap_chan *l2cap_get_chan_by_dcid(struct l2cap_conn *conn,
 135						 u16 cid)
 136{
 137	struct l2cap_chan *c;
 138
 139	mutex_lock(&conn->chan_lock);
 140	c = __l2cap_get_chan_by_dcid(conn, cid);
 141	if (c)
 142		l2cap_chan_lock(c);
 
 
 
 
 143	mutex_unlock(&conn->chan_lock);
 144
 145	return c;
 146}
 147
 148static struct l2cap_chan *__l2cap_get_chan_by_ident(struct l2cap_conn *conn,
 149						    u8 ident)
 150{
 151	struct l2cap_chan *c;
 152
 153	list_for_each_entry(c, &conn->chan_l, list) {
 154		if (c->ident == ident)
 155			return c;
 156	}
 157	return NULL;
 158}
 159
 160static struct l2cap_chan *l2cap_get_chan_by_ident(struct l2cap_conn *conn,
 161						  u8 ident)
 162{
 163	struct l2cap_chan *c;
 164
 165	mutex_lock(&conn->chan_lock);
 166	c = __l2cap_get_chan_by_ident(conn, ident);
 167	if (c)
 168		l2cap_chan_lock(c);
 169	mutex_unlock(&conn->chan_lock);
 170
 171	return c;
 172}
 173
 174static struct l2cap_chan *__l2cap_global_chan_by_addr(__le16 psm, bdaddr_t *src)
 175{
 176	struct l2cap_chan *c;
 177
 178	list_for_each_entry(c, &chan_list, global_l) {
 179		if (c->sport == psm && !bacmp(&c->src, src))
 180			return c;
 181	}
 182	return NULL;
 183}
 184
 185int l2cap_add_psm(struct l2cap_chan *chan, bdaddr_t *src, __le16 psm)
 186{
 187	int err;
 188
 189	write_lock(&chan_list_lock);
 190
 191	if (psm && __l2cap_global_chan_by_addr(psm, src)) {
 192		err = -EADDRINUSE;
 193		goto done;
 194	}
 195
 196	if (psm) {
 197		chan->psm = psm;
 198		chan->sport = psm;
 199		err = 0;
 200	} else {
 201		u16 p, start, end, incr;
 202
 203		if (chan->src_type == BDADDR_BREDR) {
 204			start = L2CAP_PSM_DYN_START;
 205			end = L2CAP_PSM_AUTO_END;
 206			incr = 2;
 207		} else {
 208			start = L2CAP_PSM_LE_DYN_START;
 209			end = L2CAP_PSM_LE_DYN_END;
 210			incr = 1;
 211		}
 212
 213		err = -EINVAL;
 214		for (p = start; p <= end; p += incr)
 215			if (!__l2cap_global_chan_by_addr(cpu_to_le16(p), src)) {
 
 216				chan->psm   = cpu_to_le16(p);
 217				chan->sport = cpu_to_le16(p);
 218				err = 0;
 219				break;
 220			}
 221	}
 222
 223done:
 224	write_unlock(&chan_list_lock);
 225	return err;
 226}
 227EXPORT_SYMBOL_GPL(l2cap_add_psm);
 228
 229int l2cap_add_scid(struct l2cap_chan *chan,  __u16 scid)
 230{
 231	write_lock(&chan_list_lock);
 232
 233	/* Override the defaults (which are for conn-oriented) */
 234	chan->omtu = L2CAP_DEFAULT_MTU;
 235	chan->chan_type = L2CAP_CHAN_FIXED;
 236
 237	chan->scid = scid;
 238
 239	write_unlock(&chan_list_lock);
 240
 241	return 0;
 242}
 243
 244static u16 l2cap_alloc_cid(struct l2cap_conn *conn)
 245{
 246	u16 cid, dyn_end;
 247
 248	if (conn->hcon->type == LE_LINK)
 249		dyn_end = L2CAP_CID_LE_DYN_END;
 250	else
 251		dyn_end = L2CAP_CID_DYN_END;
 252
 253	for (cid = L2CAP_CID_DYN_START; cid <= dyn_end; cid++) {
 254		if (!__l2cap_get_chan_by_scid(conn, cid))
 255			return cid;
 256	}
 257
 258	return 0;
 259}
 260
 261static void l2cap_state_change(struct l2cap_chan *chan, int state)
 262{
 263	BT_DBG("chan %p %s -> %s", chan, state_to_string(chan->state),
 264	       state_to_string(state));
 265
 266	chan->state = state;
 267	chan->ops->state_change(chan, state, 0);
 268}
 269
 270static inline void l2cap_state_change_and_error(struct l2cap_chan *chan,
 271						int state, int err)
 272{
 273	chan->state = state;
 274	chan->ops->state_change(chan, chan->state, err);
 275}
 276
 277static inline void l2cap_chan_set_err(struct l2cap_chan *chan, int err)
 278{
 279	chan->ops->state_change(chan, chan->state, err);
 280}
 281
 282static void __set_retrans_timer(struct l2cap_chan *chan)
 283{
 284	if (!delayed_work_pending(&chan->monitor_timer) &&
 285	    chan->retrans_timeout) {
 286		l2cap_set_timer(chan, &chan->retrans_timer,
 287				msecs_to_jiffies(chan->retrans_timeout));
 288	}
 289}
 290
 291static void __set_monitor_timer(struct l2cap_chan *chan)
 292{
 293	__clear_retrans_timer(chan);
 294	if (chan->monitor_timeout) {
 295		l2cap_set_timer(chan, &chan->monitor_timer,
 296				msecs_to_jiffies(chan->monitor_timeout));
 297	}
 298}
 299
 300static struct sk_buff *l2cap_ertm_seq_in_queue(struct sk_buff_head *head,
 301					       u16 seq)
 302{
 303	struct sk_buff *skb;
 304
 305	skb_queue_walk(head, skb) {
 306		if (bt_cb(skb)->l2cap.txseq == seq)
 307			return skb;
 308	}
 309
 310	return NULL;
 311}
 312
 313/* ---- L2CAP sequence number lists ---- */
 314
 315/* For ERTM, ordered lists of sequence numbers must be tracked for
 316 * SREJ requests that are received and for frames that are to be
 317 * retransmitted. These seq_list functions implement a singly-linked
 318 * list in an array, where membership in the list can also be checked
 319 * in constant time. Items can also be added to the tail of the list
 320 * and removed from the head in constant time, without further memory
 321 * allocs or frees.
 322 */
 323
 324static int l2cap_seq_list_init(struct l2cap_seq_list *seq_list, u16 size)
 325{
 326	size_t alloc_size, i;
 327
 328	/* Allocated size is a power of 2 to map sequence numbers
 329	 * (which may be up to 14 bits) in to a smaller array that is
 330	 * sized for the negotiated ERTM transmit windows.
 331	 */
 332	alloc_size = roundup_pow_of_two(size);
 333
 334	seq_list->list = kmalloc(sizeof(u16) * alloc_size, GFP_KERNEL);
 335	if (!seq_list->list)
 336		return -ENOMEM;
 337
 338	seq_list->mask = alloc_size - 1;
 339	seq_list->head = L2CAP_SEQ_LIST_CLEAR;
 340	seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
 341	for (i = 0; i < alloc_size; i++)
 342		seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR;
 343
 344	return 0;
 345}
 346
 347static inline void l2cap_seq_list_free(struct l2cap_seq_list *seq_list)
 348{
 349	kfree(seq_list->list);
 350}
 351
 352static inline bool l2cap_seq_list_contains(struct l2cap_seq_list *seq_list,
 353					   u16 seq)
 354{
 355	/* Constant-time check for list membership */
 356	return seq_list->list[seq & seq_list->mask] != L2CAP_SEQ_LIST_CLEAR;
 357}
 358
 359static inline u16 l2cap_seq_list_pop(struct l2cap_seq_list *seq_list)
 360{
 361	u16 seq = seq_list->head;
 362	u16 mask = seq_list->mask;
 363
 364	seq_list->head = seq_list->list[seq & mask];
 365	seq_list->list[seq & mask] = L2CAP_SEQ_LIST_CLEAR;
 366
 367	if (seq_list->head == L2CAP_SEQ_LIST_TAIL) {
 368		seq_list->head = L2CAP_SEQ_LIST_CLEAR;
 369		seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
 370	}
 371
 372	return seq;
 373}
 374
 375static void l2cap_seq_list_clear(struct l2cap_seq_list *seq_list)
 376{
 377	u16 i;
 378
 379	if (seq_list->head == L2CAP_SEQ_LIST_CLEAR)
 380		return;
 381
 382	for (i = 0; i <= seq_list->mask; i++)
 383		seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR;
 384
 385	seq_list->head = L2CAP_SEQ_LIST_CLEAR;
 386	seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
 387}
 388
 389static void l2cap_seq_list_append(struct l2cap_seq_list *seq_list, u16 seq)
 390{
 391	u16 mask = seq_list->mask;
 392
 393	/* All appends happen in constant time */
 394
 395	if (seq_list->list[seq & mask] != L2CAP_SEQ_LIST_CLEAR)
 396		return;
 397
 398	if (seq_list->tail == L2CAP_SEQ_LIST_CLEAR)
 399		seq_list->head = seq;
 400	else
 401		seq_list->list[seq_list->tail & mask] = seq;
 402
 403	seq_list->tail = seq;
 404	seq_list->list[seq & mask] = L2CAP_SEQ_LIST_TAIL;
 405}
 406
 407static void l2cap_chan_timeout(struct work_struct *work)
 408{
 409	struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
 410					       chan_timer.work);
 411	struct l2cap_conn *conn = chan->conn;
 412	int reason;
 413
 414	BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
 415
 
 
 
 416	mutex_lock(&conn->chan_lock);
 
 
 
 417	l2cap_chan_lock(chan);
 418
 419	if (chan->state == BT_CONNECTED || chan->state == BT_CONFIG)
 420		reason = ECONNREFUSED;
 421	else if (chan->state == BT_CONNECT &&
 422		 chan->sec_level != BT_SECURITY_SDP)
 423		reason = ECONNREFUSED;
 424	else
 425		reason = ETIMEDOUT;
 426
 427	l2cap_chan_close(chan, reason);
 428
 429	l2cap_chan_unlock(chan);
 430
 431	chan->ops->close(chan);
 432	mutex_unlock(&conn->chan_lock);
 433
 
 434	l2cap_chan_put(chan);
 
 
 435}
 436
 437struct l2cap_chan *l2cap_chan_create(void)
 438{
 439	struct l2cap_chan *chan;
 440
 441	chan = kzalloc(sizeof(*chan), GFP_ATOMIC);
 442	if (!chan)
 443		return NULL;
 444
 
 
 445	mutex_init(&chan->lock);
 446
 447	/* Set default lock nesting level */
 448	atomic_set(&chan->nesting, L2CAP_NESTING_NORMAL);
 449
 
 
 
 450	write_lock(&chan_list_lock);
 451	list_add(&chan->global_l, &chan_list);
 452	write_unlock(&chan_list_lock);
 453
 454	INIT_DELAYED_WORK(&chan->chan_timer, l2cap_chan_timeout);
 
 
 
 455
 456	chan->state = BT_OPEN;
 457
 458	kref_init(&chan->kref);
 459
 460	/* This flag is cleared in l2cap_chan_ready() */
 461	set_bit(CONF_NOT_COMPLETE, &chan->conf_state);
 462
 463	BT_DBG("chan %p", chan);
 464
 465	return chan;
 466}
 467EXPORT_SYMBOL_GPL(l2cap_chan_create);
 468
 469static void l2cap_chan_destroy(struct kref *kref)
 470{
 471	struct l2cap_chan *chan = container_of(kref, struct l2cap_chan, kref);
 472
 473	BT_DBG("chan %p", chan);
 474
 475	write_lock(&chan_list_lock);
 476	list_del(&chan->global_l);
 477	write_unlock(&chan_list_lock);
 478
 479	kfree(chan);
 480}
 481
 482void l2cap_chan_hold(struct l2cap_chan *c)
 483{
 484	BT_DBG("chan %p orig refcnt %d", c, atomic_read(&c->kref.refcount));
 485
 486	kref_get(&c->kref);
 487}
 488
 
 
 
 
 
 
 
 
 
 
 489void l2cap_chan_put(struct l2cap_chan *c)
 490{
 491	BT_DBG("chan %p orig refcnt %d", c, atomic_read(&c->kref.refcount));
 492
 493	kref_put(&c->kref, l2cap_chan_destroy);
 494}
 495EXPORT_SYMBOL_GPL(l2cap_chan_put);
 496
 497void l2cap_chan_set_defaults(struct l2cap_chan *chan)
 498{
 499	chan->fcs  = L2CAP_FCS_CRC16;
 500	chan->max_tx = L2CAP_DEFAULT_MAX_TX;
 501	chan->tx_win = L2CAP_DEFAULT_TX_WINDOW;
 502	chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
 503	chan->remote_max_tx = chan->max_tx;
 504	chan->remote_tx_win = chan->tx_win;
 505	chan->ack_win = L2CAP_DEFAULT_TX_WINDOW;
 506	chan->sec_level = BT_SECURITY_LOW;
 507	chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
 508	chan->retrans_timeout = L2CAP_DEFAULT_RETRANS_TO;
 509	chan->monitor_timeout = L2CAP_DEFAULT_MONITOR_TO;
 
 510	chan->conf_state = 0;
 
 511
 512	set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
 513}
 514EXPORT_SYMBOL_GPL(l2cap_chan_set_defaults);
 515
 516static void l2cap_le_flowctl_init(struct l2cap_chan *chan)
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 517{
 518	chan->sdu = NULL;
 519	chan->sdu_last_frag = NULL;
 520	chan->sdu_len = 0;
 521	chan->tx_credits = 0;
 522	chan->rx_credits = le_max_credits;
 523	chan->mps = min_t(u16, chan->imtu, le_default_mps);
 
 524
 525	skb_queue_head_init(&chan->tx_q);
 526}
 527
 
 
 
 
 
 
 
 
 
 
 
 528void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
 529{
 530	BT_DBG("conn %p, psm 0x%2.2x, dcid 0x%4.4x", conn,
 531	       __le16_to_cpu(chan->psm), chan->dcid);
 532
 533	conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
 534
 535	chan->conn = conn;
 536
 537	switch (chan->chan_type) {
 538	case L2CAP_CHAN_CONN_ORIENTED:
 539		/* Alloc CID for connection-oriented socket */
 540		chan->scid = l2cap_alloc_cid(conn);
 541		if (conn->hcon->type == ACL_LINK)
 542			chan->omtu = L2CAP_DEFAULT_MTU;
 543		break;
 544
 545	case L2CAP_CHAN_CONN_LESS:
 546		/* Connectionless socket */
 547		chan->scid = L2CAP_CID_CONN_LESS;
 548		chan->dcid = L2CAP_CID_CONN_LESS;
 549		chan->omtu = L2CAP_DEFAULT_MTU;
 550		break;
 551
 552	case L2CAP_CHAN_FIXED:
 553		/* Caller will set CID and CID specific MTU values */
 554		break;
 555
 556	default:
 557		/* Raw socket can send/recv signalling messages only */
 558		chan->scid = L2CAP_CID_SIGNALING;
 559		chan->dcid = L2CAP_CID_SIGNALING;
 560		chan->omtu = L2CAP_DEFAULT_MTU;
 561	}
 562
 563	chan->local_id		= L2CAP_BESTEFFORT_ID;
 564	chan->local_stype	= L2CAP_SERV_BESTEFFORT;
 565	chan->local_msdu	= L2CAP_DEFAULT_MAX_SDU_SIZE;
 566	chan->local_sdu_itime	= L2CAP_DEFAULT_SDU_ITIME;
 567	chan->local_acc_lat	= L2CAP_DEFAULT_ACC_LAT;
 568	chan->local_flush_to	= L2CAP_EFS_DEFAULT_FLUSH_TO;
 569
 570	l2cap_chan_hold(chan);
 571
 572	/* Only keep a reference for fixed channels if they requested it */
 573	if (chan->chan_type != L2CAP_CHAN_FIXED ||
 574	    test_bit(FLAG_HOLD_HCI_CONN, &chan->flags))
 575		hci_conn_hold(conn->hcon);
 576
 577	list_add(&chan->list, &conn->chan_l);
 
 578}
 579
 580void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
 581{
 582	mutex_lock(&conn->chan_lock);
 583	__l2cap_chan_add(conn, chan);
 584	mutex_unlock(&conn->chan_lock);
 585}
 586
 587void l2cap_chan_del(struct l2cap_chan *chan, int err)
 588{
 589	struct l2cap_conn *conn = chan->conn;
 590
 591	__clear_chan_timer(chan);
 592
 593	BT_DBG("chan %p, conn %p, err %d, state %s", chan, conn, err,
 594	       state_to_string(chan->state));
 595
 596	chan->ops->teardown(chan, err);
 597
 598	if (conn) {
 599		struct amp_mgr *mgr = conn->hcon->amp_mgr;
 600		/* Delete from channel list */
 601		list_del(&chan->list);
 602
 603		l2cap_chan_put(chan);
 604
 605		chan->conn = NULL;
 606
 607		/* Reference was only held for non-fixed channels or
 608		 * fixed channels that explicitly requested it using the
 609		 * FLAG_HOLD_HCI_CONN flag.
 610		 */
 611		if (chan->chan_type != L2CAP_CHAN_FIXED ||
 612		    test_bit(FLAG_HOLD_HCI_CONN, &chan->flags))
 613			hci_conn_drop(conn->hcon);
 614
 615		if (mgr && mgr->bredr_chan == chan)
 616			mgr->bredr_chan = NULL;
 617	}
 618
 619	if (chan->hs_hchan) {
 620		struct hci_chan *hs_hchan = chan->hs_hchan;
 621
 622		BT_DBG("chan %p disconnect hs_hchan %p", chan, hs_hchan);
 623		amp_disconnect_logical_link(hs_hchan);
 624	}
 625
 626	if (test_bit(CONF_NOT_COMPLETE, &chan->conf_state))
 627		return;
 628
 629	switch(chan->mode) {
 630	case L2CAP_MODE_BASIC:
 631		break;
 632
 633	case L2CAP_MODE_LE_FLOWCTL:
 
 634		skb_queue_purge(&chan->tx_q);
 635		break;
 636
 637	case L2CAP_MODE_ERTM:
 638		__clear_retrans_timer(chan);
 639		__clear_monitor_timer(chan);
 640		__clear_ack_timer(chan);
 641
 642		skb_queue_purge(&chan->srej_q);
 643
 644		l2cap_seq_list_free(&chan->srej_list);
 645		l2cap_seq_list_free(&chan->retrans_list);
 646
 647		/* fall through */
 648
 649	case L2CAP_MODE_STREAMING:
 650		skb_queue_purge(&chan->tx_q);
 651		break;
 652	}
 653
 654	return;
 655}
 656EXPORT_SYMBOL_GPL(l2cap_chan_del);
 657
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 658static void l2cap_conn_update_id_addr(struct work_struct *work)
 659{
 660	struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
 661					       id_addr_update_work);
 662	struct hci_conn *hcon = conn->hcon;
 663	struct l2cap_chan *chan;
 664
 665	mutex_lock(&conn->chan_lock);
 666
 667	list_for_each_entry(chan, &conn->chan_l, list) {
 668		l2cap_chan_lock(chan);
 669		bacpy(&chan->dst, &hcon->dst);
 670		chan->dst_type = bdaddr_dst_type(hcon);
 671		l2cap_chan_unlock(chan);
 672	}
 673
 674	mutex_unlock(&conn->chan_lock);
 675}
 676
 677static void l2cap_chan_le_connect_reject(struct l2cap_chan *chan)
 678{
 679	struct l2cap_conn *conn = chan->conn;
 680	struct l2cap_le_conn_rsp rsp;
 681	u16 result;
 682
 683	if (test_bit(FLAG_DEFER_SETUP, &chan->flags))
 684		result = L2CAP_CR_AUTHORIZATION;
 685	else
 686		result = L2CAP_CR_BAD_PSM;
 687
 688	l2cap_state_change(chan, BT_DISCONN);
 689
 690	rsp.dcid    = cpu_to_le16(chan->scid);
 691	rsp.mtu     = cpu_to_le16(chan->imtu);
 692	rsp.mps     = cpu_to_le16(chan->mps);
 693	rsp.credits = cpu_to_le16(chan->rx_credits);
 694	rsp.result  = cpu_to_le16(result);
 695
 696	l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp),
 697		       &rsp);
 698}
 699
 
 
 
 
 
 
 
 700static void l2cap_chan_connect_reject(struct l2cap_chan *chan)
 701{
 702	struct l2cap_conn *conn = chan->conn;
 703	struct l2cap_conn_rsp rsp;
 704	u16 result;
 705
 706	if (test_bit(FLAG_DEFER_SETUP, &chan->flags))
 707		result = L2CAP_CR_SEC_BLOCK;
 708	else
 709		result = L2CAP_CR_BAD_PSM;
 710
 711	l2cap_state_change(chan, BT_DISCONN);
 712
 713	rsp.scid   = cpu_to_le16(chan->dcid);
 714	rsp.dcid   = cpu_to_le16(chan->scid);
 715	rsp.result = cpu_to_le16(result);
 716	rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
 717
 718	l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP, sizeof(rsp), &rsp);
 719}
 720
 721void l2cap_chan_close(struct l2cap_chan *chan, int reason)
 722{
 723	struct l2cap_conn *conn = chan->conn;
 724
 725	BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
 726
 727	switch (chan->state) {
 728	case BT_LISTEN:
 729		chan->ops->teardown(chan, 0);
 730		break;
 731
 732	case BT_CONNECTED:
 733	case BT_CONFIG:
 734		if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED) {
 735			__set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
 736			l2cap_send_disconn_req(chan, reason);
 737		} else
 738			l2cap_chan_del(chan, reason);
 739		break;
 740
 741	case BT_CONNECT2:
 742		if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED) {
 743			if (conn->hcon->type == ACL_LINK)
 744				l2cap_chan_connect_reject(chan);
 745			else if (conn->hcon->type == LE_LINK)
 746				l2cap_chan_le_connect_reject(chan);
 
 
 
 
 
 
 
 
 747		}
 748
 749		l2cap_chan_del(chan, reason);
 750		break;
 751
 752	case BT_CONNECT:
 753	case BT_DISCONN:
 754		l2cap_chan_del(chan, reason);
 755		break;
 756
 757	default:
 758		chan->ops->teardown(chan, 0);
 759		break;
 760	}
 761}
 762EXPORT_SYMBOL(l2cap_chan_close);
 763
 764static inline u8 l2cap_get_auth_type(struct l2cap_chan *chan)
 765{
 766	switch (chan->chan_type) {
 767	case L2CAP_CHAN_RAW:
 768		switch (chan->sec_level) {
 769		case BT_SECURITY_HIGH:
 770		case BT_SECURITY_FIPS:
 771			return HCI_AT_DEDICATED_BONDING_MITM;
 772		case BT_SECURITY_MEDIUM:
 773			return HCI_AT_DEDICATED_BONDING;
 774		default:
 775			return HCI_AT_NO_BONDING;
 776		}
 777		break;
 778	case L2CAP_CHAN_CONN_LESS:
 779		if (chan->psm == cpu_to_le16(L2CAP_PSM_3DSP)) {
 780			if (chan->sec_level == BT_SECURITY_LOW)
 781				chan->sec_level = BT_SECURITY_SDP;
 782		}
 783		if (chan->sec_level == BT_SECURITY_HIGH ||
 784		    chan->sec_level == BT_SECURITY_FIPS)
 785			return HCI_AT_NO_BONDING_MITM;
 786		else
 787			return HCI_AT_NO_BONDING;
 788		break;
 789	case L2CAP_CHAN_CONN_ORIENTED:
 790		if (chan->psm == cpu_to_le16(L2CAP_PSM_SDP)) {
 791			if (chan->sec_level == BT_SECURITY_LOW)
 792				chan->sec_level = BT_SECURITY_SDP;
 793
 794			if (chan->sec_level == BT_SECURITY_HIGH ||
 795			    chan->sec_level == BT_SECURITY_FIPS)
 796				return HCI_AT_NO_BONDING_MITM;
 797			else
 798				return HCI_AT_NO_BONDING;
 799		}
 800		/* fall through */
 
 801	default:
 802		switch (chan->sec_level) {
 803		case BT_SECURITY_HIGH:
 804		case BT_SECURITY_FIPS:
 805			return HCI_AT_GENERAL_BONDING_MITM;
 806		case BT_SECURITY_MEDIUM:
 807			return HCI_AT_GENERAL_BONDING;
 808		default:
 809			return HCI_AT_NO_BONDING;
 810		}
 811		break;
 812	}
 813}
 814
 815/* Service level security */
 816int l2cap_chan_check_security(struct l2cap_chan *chan, bool initiator)
 817{
 818	struct l2cap_conn *conn = chan->conn;
 819	__u8 auth_type;
 820
 821	if (conn->hcon->type == LE_LINK)
 822		return smp_conn_security(conn->hcon, chan->sec_level);
 823
 824	auth_type = l2cap_get_auth_type(chan);
 825
 826	return hci_conn_security(conn->hcon, chan->sec_level, auth_type,
 827				 initiator);
 828}
 829
 830static u8 l2cap_get_ident(struct l2cap_conn *conn)
 831{
 832	u8 id;
 833
 834	/* Get next available identificator.
 835	 *    1 - 128 are used by kernel.
 836	 *  129 - 199 are reserved.
 837	 *  200 - 254 are used by utilities like l2ping, etc.
 838	 */
 839
 840	mutex_lock(&conn->ident_lock);
 841
 842	if (++conn->tx_ident > 128)
 843		conn->tx_ident = 1;
 844
 845	id = conn->tx_ident;
 846
 847	mutex_unlock(&conn->ident_lock);
 848
 849	return id;
 850}
 851
 852static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
 853			   void *data)
 854{
 855	struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data);
 856	u8 flags;
 857
 858	BT_DBG("code 0x%2.2x", code);
 859
 860	if (!skb)
 861		return;
 862
 863	/* Use NO_FLUSH if supported or we have an LE link (which does
 864	 * not support auto-flushing packets) */
 865	if (lmp_no_flush_capable(conn->hcon->hdev) ||
 866	    conn->hcon->type == LE_LINK)
 867		flags = ACL_START_NO_FLUSH;
 868	else
 869		flags = ACL_START;
 870
 871	bt_cb(skb)->force_active = BT_POWER_FORCE_ACTIVE_ON;
 872	skb->priority = HCI_PRIO_MAX;
 873
 874	hci_send_acl(conn->hchan, skb, flags);
 875}
 876
 877static bool __chan_is_moving(struct l2cap_chan *chan)
 878{
 879	return chan->move_state != L2CAP_MOVE_STABLE &&
 880	       chan->move_state != L2CAP_MOVE_WAIT_PREPARE;
 881}
 882
 883static void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb)
 884{
 885	struct hci_conn *hcon = chan->conn->hcon;
 886	u16 flags;
 887
 888	BT_DBG("chan %p, skb %p len %d priority %u", chan, skb, skb->len,
 889	       skb->priority);
 890
 891	if (chan->hs_hcon && !__chan_is_moving(chan)) {
 892		if (chan->hs_hchan)
 893			hci_send_acl(chan->hs_hchan, skb, ACL_COMPLETE);
 894		else
 895			kfree_skb(skb);
 896
 897		return;
 898	}
 899
 900	/* Use NO_FLUSH for LE links (where this is the only option) or
 901	 * if the BR/EDR link supports it and flushing has not been
 902	 * explicitly requested (through FLAG_FLUSHABLE).
 903	 */
 904	if (hcon->type == LE_LINK ||
 905	    (!test_bit(FLAG_FLUSHABLE, &chan->flags) &&
 906	     lmp_no_flush_capable(hcon->hdev)))
 907		flags = ACL_START_NO_FLUSH;
 908	else
 909		flags = ACL_START;
 910
 911	bt_cb(skb)->force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
 912	hci_send_acl(chan->conn->hchan, skb, flags);
 913}
 914
 915static void __unpack_enhanced_control(u16 enh, struct l2cap_ctrl *control)
 916{
 917	control->reqseq = (enh & L2CAP_CTRL_REQSEQ) >> L2CAP_CTRL_REQSEQ_SHIFT;
 918	control->final = (enh & L2CAP_CTRL_FINAL) >> L2CAP_CTRL_FINAL_SHIFT;
 919
 920	if (enh & L2CAP_CTRL_FRAME_TYPE) {
 921		/* S-Frame */
 922		control->sframe = 1;
 923		control->poll = (enh & L2CAP_CTRL_POLL) >> L2CAP_CTRL_POLL_SHIFT;
 924		control->super = (enh & L2CAP_CTRL_SUPERVISE) >> L2CAP_CTRL_SUPER_SHIFT;
 925
 926		control->sar = 0;
 927		control->txseq = 0;
 928	} else {
 929		/* I-Frame */
 930		control->sframe = 0;
 931		control->sar = (enh & L2CAP_CTRL_SAR) >> L2CAP_CTRL_SAR_SHIFT;
 932		control->txseq = (enh & L2CAP_CTRL_TXSEQ) >> L2CAP_CTRL_TXSEQ_SHIFT;
 933
 934		control->poll = 0;
 935		control->super = 0;
 936	}
 937}
 938
 939static void __unpack_extended_control(u32 ext, struct l2cap_ctrl *control)
 940{
 941	control->reqseq = (ext & L2CAP_EXT_CTRL_REQSEQ) >> L2CAP_EXT_CTRL_REQSEQ_SHIFT;
 942	control->final = (ext & L2CAP_EXT_CTRL_FINAL) >> L2CAP_EXT_CTRL_FINAL_SHIFT;
 943
 944	if (ext & L2CAP_EXT_CTRL_FRAME_TYPE) {
 945		/* S-Frame */
 946		control->sframe = 1;
 947		control->poll = (ext & L2CAP_EXT_CTRL_POLL) >> L2CAP_EXT_CTRL_POLL_SHIFT;
 948		control->super = (ext & L2CAP_EXT_CTRL_SUPERVISE) >> L2CAP_EXT_CTRL_SUPER_SHIFT;
 949
 950		control->sar = 0;
 951		control->txseq = 0;
 952	} else {
 953		/* I-Frame */
 954		control->sframe = 0;
 955		control->sar = (ext & L2CAP_EXT_CTRL_SAR) >> L2CAP_EXT_CTRL_SAR_SHIFT;
 956		control->txseq = (ext & L2CAP_EXT_CTRL_TXSEQ) >> L2CAP_EXT_CTRL_TXSEQ_SHIFT;
 957
 958		control->poll = 0;
 959		control->super = 0;
 960	}
 961}
 962
 963static inline void __unpack_control(struct l2cap_chan *chan,
 964				    struct sk_buff *skb)
 965{
 966	if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
 967		__unpack_extended_control(get_unaligned_le32(skb->data),
 968					  &bt_cb(skb)->l2cap);
 969		skb_pull(skb, L2CAP_EXT_CTRL_SIZE);
 970	} else {
 971		__unpack_enhanced_control(get_unaligned_le16(skb->data),
 972					  &bt_cb(skb)->l2cap);
 973		skb_pull(skb, L2CAP_ENH_CTRL_SIZE);
 974	}
 975}
 976
 977static u32 __pack_extended_control(struct l2cap_ctrl *control)
 978{
 979	u32 packed;
 980
 981	packed = control->reqseq << L2CAP_EXT_CTRL_REQSEQ_SHIFT;
 982	packed |= control->final << L2CAP_EXT_CTRL_FINAL_SHIFT;
 983
 984	if (control->sframe) {
 985		packed |= control->poll << L2CAP_EXT_CTRL_POLL_SHIFT;
 986		packed |= control->super << L2CAP_EXT_CTRL_SUPER_SHIFT;
 987		packed |= L2CAP_EXT_CTRL_FRAME_TYPE;
 988	} else {
 989		packed |= control->sar << L2CAP_EXT_CTRL_SAR_SHIFT;
 990		packed |= control->txseq << L2CAP_EXT_CTRL_TXSEQ_SHIFT;
 991	}
 992
 993	return packed;
 994}
 995
 996static u16 __pack_enhanced_control(struct l2cap_ctrl *control)
 997{
 998	u16 packed;
 999
1000	packed = control->reqseq << L2CAP_CTRL_REQSEQ_SHIFT;
1001	packed |= control->final << L2CAP_CTRL_FINAL_SHIFT;
1002
1003	if (control->sframe) {
1004		packed |= control->poll << L2CAP_CTRL_POLL_SHIFT;
1005		packed |= control->super << L2CAP_CTRL_SUPER_SHIFT;
1006		packed |= L2CAP_CTRL_FRAME_TYPE;
1007	} else {
1008		packed |= control->sar << L2CAP_CTRL_SAR_SHIFT;
1009		packed |= control->txseq << L2CAP_CTRL_TXSEQ_SHIFT;
1010	}
1011
1012	return packed;
1013}
1014
1015static inline void __pack_control(struct l2cap_chan *chan,
1016				  struct l2cap_ctrl *control,
1017				  struct sk_buff *skb)
1018{
1019	if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
1020		put_unaligned_le32(__pack_extended_control(control),
1021				   skb->data + L2CAP_HDR_SIZE);
1022	} else {
1023		put_unaligned_le16(__pack_enhanced_control(control),
1024				   skb->data + L2CAP_HDR_SIZE);
1025	}
1026}
1027
1028static inline unsigned int __ertm_hdr_size(struct l2cap_chan *chan)
1029{
1030	if (test_bit(FLAG_EXT_CTRL, &chan->flags))
1031		return L2CAP_EXT_HDR_SIZE;
1032	else
1033		return L2CAP_ENH_HDR_SIZE;
1034}
1035
1036static struct sk_buff *l2cap_create_sframe_pdu(struct l2cap_chan *chan,
1037					       u32 control)
1038{
1039	struct sk_buff *skb;
1040	struct l2cap_hdr *lh;
1041	int hlen = __ertm_hdr_size(chan);
1042
1043	if (chan->fcs == L2CAP_FCS_CRC16)
1044		hlen += L2CAP_FCS_SIZE;
1045
1046	skb = bt_skb_alloc(hlen, GFP_KERNEL);
1047
1048	if (!skb)
1049		return ERR_PTR(-ENOMEM);
1050
1051	lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
1052	lh->len = cpu_to_le16(hlen - L2CAP_HDR_SIZE);
1053	lh->cid = cpu_to_le16(chan->dcid);
1054
1055	if (test_bit(FLAG_EXT_CTRL, &chan->flags))
1056		put_unaligned_le32(control, skb_put(skb, L2CAP_EXT_CTRL_SIZE));
1057	else
1058		put_unaligned_le16(control, skb_put(skb, L2CAP_ENH_CTRL_SIZE));
1059
1060	if (chan->fcs == L2CAP_FCS_CRC16) {
1061		u16 fcs = crc16(0, (u8 *)skb->data, skb->len);
1062		put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
1063	}
1064
1065	skb->priority = HCI_PRIO_MAX;
1066	return skb;
1067}
1068
1069static void l2cap_send_sframe(struct l2cap_chan *chan,
1070			      struct l2cap_ctrl *control)
1071{
1072	struct sk_buff *skb;
1073	u32 control_field;
1074
1075	BT_DBG("chan %p, control %p", chan, control);
1076
1077	if (!control->sframe)
1078		return;
1079
1080	if (__chan_is_moving(chan))
1081		return;
1082
1083	if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state) &&
1084	    !control->poll)
1085		control->final = 1;
1086
1087	if (control->super == L2CAP_SUPER_RR)
1088		clear_bit(CONN_RNR_SENT, &chan->conn_state);
1089	else if (control->super == L2CAP_SUPER_RNR)
1090		set_bit(CONN_RNR_SENT, &chan->conn_state);
1091
1092	if (control->super != L2CAP_SUPER_SREJ) {
1093		chan->last_acked_seq = control->reqseq;
1094		__clear_ack_timer(chan);
1095	}
1096
1097	BT_DBG("reqseq %d, final %d, poll %d, super %d", control->reqseq,
1098	       control->final, control->poll, control->super);
1099
1100	if (test_bit(FLAG_EXT_CTRL, &chan->flags))
1101		control_field = __pack_extended_control(control);
1102	else
1103		control_field = __pack_enhanced_control(control);
1104
1105	skb = l2cap_create_sframe_pdu(chan, control_field);
1106	if (!IS_ERR(skb))
1107		l2cap_do_send(chan, skb);
1108}
1109
1110static void l2cap_send_rr_or_rnr(struct l2cap_chan *chan, bool poll)
1111{
1112	struct l2cap_ctrl control;
1113
1114	BT_DBG("chan %p, poll %d", chan, poll);
1115
1116	memset(&control, 0, sizeof(control));
1117	control.sframe = 1;
1118	control.poll = poll;
1119
1120	if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state))
1121		control.super = L2CAP_SUPER_RNR;
1122	else
1123		control.super = L2CAP_SUPER_RR;
1124
1125	control.reqseq = chan->buffer_seq;
1126	l2cap_send_sframe(chan, &control);
1127}
1128
1129static inline int __l2cap_no_conn_pending(struct l2cap_chan *chan)
1130{
1131	if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED)
1132		return true;
1133
1134	return !test_bit(CONF_CONNECT_PEND, &chan->conf_state);
1135}
1136
1137static bool __amp_capable(struct l2cap_chan *chan)
1138{
1139	struct l2cap_conn *conn = chan->conn;
1140	struct hci_dev *hdev;
1141	bool amp_available = false;
1142
1143	if (!(conn->local_fixed_chan & L2CAP_FC_A2MP))
1144		return false;
1145
1146	if (!(conn->remote_fixed_chan & L2CAP_FC_A2MP))
1147		return false;
1148
1149	read_lock(&hci_dev_list_lock);
1150	list_for_each_entry(hdev, &hci_dev_list, list) {
1151		if (hdev->amp_type != AMP_TYPE_BREDR &&
1152		    test_bit(HCI_UP, &hdev->flags)) {
1153			amp_available = true;
1154			break;
1155		}
1156	}
1157	read_unlock(&hci_dev_list_lock);
1158
1159	if (chan->chan_policy == BT_CHANNEL_POLICY_AMP_PREFERRED)
1160		return amp_available;
1161
1162	return false;
1163}
1164
1165static bool l2cap_check_efs(struct l2cap_chan *chan)
1166{
1167	/* Check EFS parameters */
1168	return true;
1169}
1170
1171void l2cap_send_conn_req(struct l2cap_chan *chan)
1172{
1173	struct l2cap_conn *conn = chan->conn;
1174	struct l2cap_conn_req req;
1175
1176	req.scid = cpu_to_le16(chan->scid);
1177	req.psm  = chan->psm;
1178
1179	chan->ident = l2cap_get_ident(conn);
1180
1181	set_bit(CONF_CONNECT_PEND, &chan->conf_state);
1182
1183	l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ, sizeof(req), &req);
1184}
1185
1186static void l2cap_send_create_chan_req(struct l2cap_chan *chan, u8 amp_id)
1187{
1188	struct l2cap_create_chan_req req;
1189	req.scid = cpu_to_le16(chan->scid);
1190	req.psm  = chan->psm;
1191	req.amp_id = amp_id;
1192
1193	chan->ident = l2cap_get_ident(chan->conn);
1194
1195	l2cap_send_cmd(chan->conn, chan->ident, L2CAP_CREATE_CHAN_REQ,
1196		       sizeof(req), &req);
1197}
1198
1199static void l2cap_move_setup(struct l2cap_chan *chan)
1200{
1201	struct sk_buff *skb;
1202
1203	BT_DBG("chan %p", chan);
1204
1205	if (chan->mode != L2CAP_MODE_ERTM)
1206		return;
1207
1208	__clear_retrans_timer(chan);
1209	__clear_monitor_timer(chan);
1210	__clear_ack_timer(chan);
1211
1212	chan->retry_count = 0;
1213	skb_queue_walk(&chan->tx_q, skb) {
1214		if (bt_cb(skb)->l2cap.retries)
1215			bt_cb(skb)->l2cap.retries = 1;
1216		else
1217			break;
1218	}
1219
1220	chan->expected_tx_seq = chan->buffer_seq;
1221
1222	clear_bit(CONN_REJ_ACT, &chan->conn_state);
1223	clear_bit(CONN_SREJ_ACT, &chan->conn_state);
1224	l2cap_seq_list_clear(&chan->retrans_list);
1225	l2cap_seq_list_clear(&chan->srej_list);
1226	skb_queue_purge(&chan->srej_q);
1227
1228	chan->tx_state = L2CAP_TX_STATE_XMIT;
1229	chan->rx_state = L2CAP_RX_STATE_MOVE;
1230
1231	set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
1232}
1233
1234static void l2cap_move_done(struct l2cap_chan *chan)
1235{
1236	u8 move_role = chan->move_role;
1237	BT_DBG("chan %p", chan);
1238
1239	chan->move_state = L2CAP_MOVE_STABLE;
1240	chan->move_role = L2CAP_MOVE_ROLE_NONE;
1241
1242	if (chan->mode != L2CAP_MODE_ERTM)
1243		return;
1244
1245	switch (move_role) {
1246	case L2CAP_MOVE_ROLE_INITIATOR:
1247		l2cap_tx(chan, NULL, NULL, L2CAP_EV_EXPLICIT_POLL);
1248		chan->rx_state = L2CAP_RX_STATE_WAIT_F;
1249		break;
1250	case L2CAP_MOVE_ROLE_RESPONDER:
1251		chan->rx_state = L2CAP_RX_STATE_WAIT_P;
1252		break;
1253	}
1254}
1255
1256static void l2cap_chan_ready(struct l2cap_chan *chan)
1257{
1258	/* The channel may have already been flagged as connected in
1259	 * case of receiving data before the L2CAP info req/rsp
1260	 * procedure is complete.
1261	 */
1262	if (chan->state == BT_CONNECTED)
1263		return;
1264
1265	/* This clears all conf flags, including CONF_NOT_COMPLETE */
1266	chan->conf_state = 0;
1267	__clear_chan_timer(chan);
1268
1269	if (chan->mode == L2CAP_MODE_LE_FLOWCTL && !chan->tx_credits)
1270		chan->ops->suspend(chan);
 
 
 
 
 
1271
1272	chan->state = BT_CONNECTED;
1273
1274	chan->ops->ready(chan);
1275}
1276
1277static void l2cap_le_connect(struct l2cap_chan *chan)
1278{
1279	struct l2cap_conn *conn = chan->conn;
1280	struct l2cap_le_conn_req req;
1281
1282	if (test_and_set_bit(FLAG_LE_CONN_REQ_SENT, &chan->flags))
1283		return;
1284
 
 
 
 
 
 
1285	req.psm     = chan->psm;
1286	req.scid    = cpu_to_le16(chan->scid);
1287	req.mtu     = cpu_to_le16(chan->imtu);
1288	req.mps     = cpu_to_le16(chan->mps);
1289	req.credits = cpu_to_le16(chan->rx_credits);
1290
1291	chan->ident = l2cap_get_ident(conn);
1292
1293	l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_REQ,
1294		       sizeof(req), &req);
1295}
1296
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1297static void l2cap_le_start(struct l2cap_chan *chan)
1298{
1299	struct l2cap_conn *conn = chan->conn;
1300
1301	if (!smp_conn_security(conn->hcon, chan->sec_level))
1302		return;
1303
1304	if (!chan->psm) {
1305		l2cap_chan_ready(chan);
1306		return;
1307	}
1308
1309	if (chan->state == BT_CONNECT)
1310		l2cap_le_connect(chan);
 
 
 
 
1311}
1312
1313static void l2cap_start_connection(struct l2cap_chan *chan)
1314{
1315	if (__amp_capable(chan)) {
1316		BT_DBG("chan %p AMP capable: discover AMPs", chan);
1317		a2mp_discover_amp(chan);
1318	} else if (chan->conn->hcon->type == LE_LINK) {
1319		l2cap_le_start(chan);
1320	} else {
1321		l2cap_send_conn_req(chan);
1322	}
1323}
1324
1325static void l2cap_request_info(struct l2cap_conn *conn)
1326{
1327	struct l2cap_info_req req;
1328
1329	if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
1330		return;
1331
1332	req.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
1333
1334	conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
1335	conn->info_ident = l2cap_get_ident(conn);
1336
1337	schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
1338
1339	l2cap_send_cmd(conn, conn->info_ident, L2CAP_INFO_REQ,
1340		       sizeof(req), &req);
1341}
1342
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1343static void l2cap_do_start(struct l2cap_chan *chan)
1344{
1345	struct l2cap_conn *conn = chan->conn;
1346
1347	if (conn->hcon->type == LE_LINK) {
1348		l2cap_le_start(chan);
1349		return;
1350	}
1351
1352	if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)) {
1353		l2cap_request_info(conn);
1354		return;
1355	}
1356
1357	if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE))
1358		return;
1359
1360	if (l2cap_chan_check_security(chan, true) &&
1361	    __l2cap_no_conn_pending(chan))
 
 
 
1362		l2cap_start_connection(chan);
 
 
1363}
1364
1365static inline int l2cap_mode_supported(__u8 mode, __u32 feat_mask)
1366{
1367	u32 local_feat_mask = l2cap_feat_mask;
1368	if (!disable_ertm)
1369		local_feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING;
1370
1371	switch (mode) {
1372	case L2CAP_MODE_ERTM:
1373		return L2CAP_FEAT_ERTM & feat_mask & local_feat_mask;
1374	case L2CAP_MODE_STREAMING:
1375		return L2CAP_FEAT_STREAMING & feat_mask & local_feat_mask;
1376	default:
1377		return 0x00;
1378	}
1379}
1380
1381static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err)
1382{
1383	struct l2cap_conn *conn = chan->conn;
1384	struct l2cap_disconn_req req;
1385
1386	if (!conn)
1387		return;
1388
1389	if (chan->mode == L2CAP_MODE_ERTM && chan->state == BT_CONNECTED) {
1390		__clear_retrans_timer(chan);
1391		__clear_monitor_timer(chan);
1392		__clear_ack_timer(chan);
1393	}
1394
1395	if (chan->scid == L2CAP_CID_A2MP) {
1396		l2cap_state_change(chan, BT_DISCONN);
1397		return;
1398	}
1399
1400	req.dcid = cpu_to_le16(chan->dcid);
1401	req.scid = cpu_to_le16(chan->scid);
1402	l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_DISCONN_REQ,
1403		       sizeof(req), &req);
1404
1405	l2cap_state_change_and_error(chan, BT_DISCONN, err);
1406}
1407
1408/* ---- L2CAP connections ---- */
1409static void l2cap_conn_start(struct l2cap_conn *conn)
1410{
1411	struct l2cap_chan *chan, *tmp;
1412
1413	BT_DBG("conn %p", conn);
1414
1415	mutex_lock(&conn->chan_lock);
1416
1417	list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
1418		l2cap_chan_lock(chan);
1419
1420		if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
1421			l2cap_chan_ready(chan);
1422			l2cap_chan_unlock(chan);
1423			continue;
1424		}
1425
1426		if (chan->state == BT_CONNECT) {
1427			if (!l2cap_chan_check_security(chan, true) ||
1428			    !__l2cap_no_conn_pending(chan)) {
1429				l2cap_chan_unlock(chan);
1430				continue;
1431			}
1432
1433			if (!l2cap_mode_supported(chan->mode, conn->feat_mask)
1434			    && test_bit(CONF_STATE2_DEVICE,
1435					&chan->conf_state)) {
1436				l2cap_chan_close(chan, ECONNRESET);
1437				l2cap_chan_unlock(chan);
1438				continue;
1439			}
1440
1441			l2cap_start_connection(chan);
 
 
 
1442
1443		} else if (chan->state == BT_CONNECT2) {
1444			struct l2cap_conn_rsp rsp;
1445			char buf[128];
1446			rsp.scid = cpu_to_le16(chan->dcid);
1447			rsp.dcid = cpu_to_le16(chan->scid);
1448
1449			if (l2cap_chan_check_security(chan, false)) {
1450				if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
1451					rsp.result = cpu_to_le16(L2CAP_CR_PEND);
1452					rsp.status = cpu_to_le16(L2CAP_CS_AUTHOR_PEND);
1453					chan->ops->defer(chan);
1454
1455				} else {
1456					l2cap_state_change(chan, BT_CONFIG);
1457					rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
1458					rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
1459				}
1460			} else {
1461				rsp.result = cpu_to_le16(L2CAP_CR_PEND);
1462				rsp.status = cpu_to_le16(L2CAP_CS_AUTHEN_PEND);
1463			}
1464
1465			l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
1466				       sizeof(rsp), &rsp);
1467
1468			if (test_bit(CONF_REQ_SENT, &chan->conf_state) ||
1469			    rsp.result != L2CAP_CR_SUCCESS) {
1470				l2cap_chan_unlock(chan);
1471				continue;
1472			}
1473
1474			set_bit(CONF_REQ_SENT, &chan->conf_state);
1475			l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
1476				       l2cap_build_conf_req(chan, buf), buf);
1477			chan->num_conf_req++;
1478		}
1479
1480		l2cap_chan_unlock(chan);
1481	}
1482
1483	mutex_unlock(&conn->chan_lock);
1484}
1485
1486static void l2cap_le_conn_ready(struct l2cap_conn *conn)
1487{
1488	struct hci_conn *hcon = conn->hcon;
1489	struct hci_dev *hdev = hcon->hdev;
1490
1491	BT_DBG("%s conn %p", hdev->name, conn);
1492
1493	/* For outgoing pairing which doesn't necessarily have an
1494	 * associated socket (e.g. mgmt_pair_device).
1495	 */
1496	if (hcon->out)
1497		smp_conn_security(hcon, hcon->pending_sec_level);
1498
1499	/* For LE slave connections, make sure the connection interval
1500	 * is in the range of the minium and maximum interval that has
1501	 * been configured for this connection. If not, then trigger
1502	 * the connection update procedure.
1503	 */
1504	if (hcon->role == HCI_ROLE_SLAVE &&
1505	    (hcon->le_conn_interval < hcon->le_conn_min_interval ||
1506	     hcon->le_conn_interval > hcon->le_conn_max_interval)) {
1507		struct l2cap_conn_param_update_req req;
1508
1509		req.min = cpu_to_le16(hcon->le_conn_min_interval);
1510		req.max = cpu_to_le16(hcon->le_conn_max_interval);
1511		req.latency = cpu_to_le16(hcon->le_conn_latency);
1512		req.to_multiplier = cpu_to_le16(hcon->le_supv_timeout);
1513
1514		l2cap_send_cmd(conn, l2cap_get_ident(conn),
1515			       L2CAP_CONN_PARAM_UPDATE_REQ, sizeof(req), &req);
1516	}
1517}
1518
1519static void l2cap_conn_ready(struct l2cap_conn *conn)
1520{
1521	struct l2cap_chan *chan;
1522	struct hci_conn *hcon = conn->hcon;
1523
1524	BT_DBG("conn %p", conn);
1525
1526	if (hcon->type == ACL_LINK)
1527		l2cap_request_info(conn);
1528
1529	mutex_lock(&conn->chan_lock);
1530
1531	list_for_each_entry(chan, &conn->chan_l, list) {
1532
1533		l2cap_chan_lock(chan);
1534
1535		if (chan->scid == L2CAP_CID_A2MP) {
1536			l2cap_chan_unlock(chan);
1537			continue;
1538		}
1539
1540		if (hcon->type == LE_LINK) {
1541			l2cap_le_start(chan);
1542		} else if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
1543			if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)
1544				l2cap_chan_ready(chan);
1545		} else if (chan->state == BT_CONNECT) {
1546			l2cap_do_start(chan);
1547		}
1548
1549		l2cap_chan_unlock(chan);
1550	}
1551
1552	mutex_unlock(&conn->chan_lock);
1553
1554	if (hcon->type == LE_LINK)
1555		l2cap_le_conn_ready(conn);
1556
1557	queue_work(hcon->hdev->workqueue, &conn->pending_rx_work);
1558}
1559
1560/* Notify sockets that we cannot guaranty reliability anymore */
1561static void l2cap_conn_unreliable(struct l2cap_conn *conn, int err)
1562{
1563	struct l2cap_chan *chan;
1564
1565	BT_DBG("conn %p", conn);
1566
1567	mutex_lock(&conn->chan_lock);
1568
1569	list_for_each_entry(chan, &conn->chan_l, list) {
1570		if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
1571			l2cap_chan_set_err(chan, err);
1572	}
1573
1574	mutex_unlock(&conn->chan_lock);
1575}
1576
1577static void l2cap_info_timeout(struct work_struct *work)
1578{
1579	struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
1580					       info_timer.work);
1581
1582	conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
1583	conn->info_ident = 0;
1584
1585	l2cap_conn_start(conn);
1586}
1587
1588/*
1589 * l2cap_user
1590 * External modules can register l2cap_user objects on l2cap_conn. The ->probe
1591 * callback is called during registration. The ->remove callback is called
1592 * during unregistration.
1593 * An l2cap_user object can either be explicitly unregistered or when the
1594 * underlying l2cap_conn object is deleted. This guarantees that l2cap->hcon,
1595 * l2cap->hchan, .. are valid as long as the remove callback hasn't been called.
1596 * External modules must own a reference to the l2cap_conn object if they intend
1597 * to call l2cap_unregister_user(). The l2cap_conn object might get destroyed at
1598 * any time if they don't.
1599 */
1600
1601int l2cap_register_user(struct l2cap_conn *conn, struct l2cap_user *user)
1602{
1603	struct hci_dev *hdev = conn->hcon->hdev;
1604	int ret;
1605
1606	/* We need to check whether l2cap_conn is registered. If it is not, we
1607	 * must not register the l2cap_user. l2cap_conn_del() is unregisters
1608	 * l2cap_conn objects, but doesn't provide its own locking. Instead, it
1609	 * relies on the parent hci_conn object to be locked. This itself relies
1610	 * on the hci_dev object to be locked. So we must lock the hci device
1611	 * here, too. */
1612
1613	hci_dev_lock(hdev);
1614
1615	if (!list_empty(&user->list)) {
1616		ret = -EINVAL;
1617		goto out_unlock;
1618	}
1619
1620	/* conn->hchan is NULL after l2cap_conn_del() was called */
1621	if (!conn->hchan) {
1622		ret = -ENODEV;
1623		goto out_unlock;
1624	}
1625
1626	ret = user->probe(conn, user);
1627	if (ret)
1628		goto out_unlock;
1629
1630	list_add(&user->list, &conn->users);
1631	ret = 0;
1632
1633out_unlock:
1634	hci_dev_unlock(hdev);
1635	return ret;
1636}
1637EXPORT_SYMBOL(l2cap_register_user);
1638
1639void l2cap_unregister_user(struct l2cap_conn *conn, struct l2cap_user *user)
1640{
1641	struct hci_dev *hdev = conn->hcon->hdev;
1642
1643	hci_dev_lock(hdev);
1644
1645	if (list_empty(&user->list))
1646		goto out_unlock;
1647
1648	list_del_init(&user->list);
1649	user->remove(conn, user);
1650
1651out_unlock:
1652	hci_dev_unlock(hdev);
1653}
1654EXPORT_SYMBOL(l2cap_unregister_user);
1655
1656static void l2cap_unregister_all_users(struct l2cap_conn *conn)
1657{
1658	struct l2cap_user *user;
1659
1660	while (!list_empty(&conn->users)) {
1661		user = list_first_entry(&conn->users, struct l2cap_user, list);
1662		list_del_init(&user->list);
1663		user->remove(conn, user);
1664	}
1665}
1666
1667static void l2cap_conn_del(struct hci_conn *hcon, int err)
1668{
1669	struct l2cap_conn *conn = hcon->l2cap_data;
1670	struct l2cap_chan *chan, *l;
1671
1672	if (!conn)
1673		return;
1674
1675	BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
1676
1677	kfree_skb(conn->rx_skb);
1678
1679	skb_queue_purge(&conn->pending_rx);
1680
1681	/* We can not call flush_work(&conn->pending_rx_work) here since we
1682	 * might block if we are running on a worker from the same workqueue
1683	 * pending_rx_work is waiting on.
1684	 */
1685	if (work_pending(&conn->pending_rx_work))
1686		cancel_work_sync(&conn->pending_rx_work);
1687
1688	if (work_pending(&conn->id_addr_update_work))
1689		cancel_work_sync(&conn->id_addr_update_work);
1690
1691	l2cap_unregister_all_users(conn);
1692
1693	/* Force the connection to be immediately dropped */
1694	hcon->disc_timeout = 0;
1695
1696	mutex_lock(&conn->chan_lock);
1697
1698	/* Kill channels */
1699	list_for_each_entry_safe(chan, l, &conn->chan_l, list) {
1700		l2cap_chan_hold(chan);
1701		l2cap_chan_lock(chan);
1702
1703		l2cap_chan_del(chan, err);
1704
1705		l2cap_chan_unlock(chan);
1706
1707		chan->ops->close(chan);
 
 
1708		l2cap_chan_put(chan);
1709	}
1710
1711	mutex_unlock(&conn->chan_lock);
1712
1713	hci_chan_del(conn->hchan);
1714
1715	if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
1716		cancel_delayed_work_sync(&conn->info_timer);
1717
1718	hcon->l2cap_data = NULL;
1719	conn->hchan = NULL;
1720	l2cap_conn_put(conn);
1721}
1722
1723static void l2cap_conn_free(struct kref *ref)
1724{
1725	struct l2cap_conn *conn = container_of(ref, struct l2cap_conn, ref);
1726
1727	hci_conn_put(conn->hcon);
1728	kfree(conn);
1729}
1730
1731struct l2cap_conn *l2cap_conn_get(struct l2cap_conn *conn)
1732{
1733	kref_get(&conn->ref);
1734	return conn;
1735}
1736EXPORT_SYMBOL(l2cap_conn_get);
1737
1738void l2cap_conn_put(struct l2cap_conn *conn)
1739{
1740	kref_put(&conn->ref, l2cap_conn_free);
1741}
1742EXPORT_SYMBOL(l2cap_conn_put);
1743
1744/* ---- Socket interface ---- */
1745
1746/* Find socket with psm and source / destination bdaddr.
1747 * Returns closest match.
1748 */
1749static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm,
1750						   bdaddr_t *src,
1751						   bdaddr_t *dst,
1752						   u8 link_type)
1753{
1754	struct l2cap_chan *c, *c1 = NULL;
1755
1756	read_lock(&chan_list_lock);
1757
1758	list_for_each_entry(c, &chan_list, global_l) {
1759		if (state && c->state != state)
1760			continue;
1761
1762		if (link_type == ACL_LINK && c->src_type != BDADDR_BREDR)
1763			continue;
1764
1765		if (link_type == LE_LINK && c->src_type == BDADDR_BREDR)
1766			continue;
1767
1768		if (c->psm == psm) {
1769			int src_match, dst_match;
1770			int src_any, dst_any;
1771
1772			/* Exact match. */
1773			src_match = !bacmp(&c->src, src);
1774			dst_match = !bacmp(&c->dst, dst);
1775			if (src_match && dst_match) {
1776				l2cap_chan_hold(c);
 
 
1777				read_unlock(&chan_list_lock);
1778				return c;
1779			}
1780
1781			/* Closest match */
1782			src_any = !bacmp(&c->src, BDADDR_ANY);
1783			dst_any = !bacmp(&c->dst, BDADDR_ANY);
1784			if ((src_match && dst_any) || (src_any && dst_match) ||
1785			    (src_any && dst_any))
1786				c1 = c;
1787		}
1788	}
1789
1790	if (c1)
1791		l2cap_chan_hold(c1);
1792
1793	read_unlock(&chan_list_lock);
1794
1795	return c1;
1796}
1797
1798static void l2cap_monitor_timeout(struct work_struct *work)
1799{
1800	struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
1801					       monitor_timer.work);
1802
1803	BT_DBG("chan %p", chan);
1804
1805	l2cap_chan_lock(chan);
1806
1807	if (!chan->conn) {
1808		l2cap_chan_unlock(chan);
1809		l2cap_chan_put(chan);
1810		return;
1811	}
1812
1813	l2cap_tx(chan, NULL, NULL, L2CAP_EV_MONITOR_TO);
1814
1815	l2cap_chan_unlock(chan);
1816	l2cap_chan_put(chan);
1817}
1818
1819static void l2cap_retrans_timeout(struct work_struct *work)
1820{
1821	struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
1822					       retrans_timer.work);
1823
1824	BT_DBG("chan %p", chan);
1825
1826	l2cap_chan_lock(chan);
1827
1828	if (!chan->conn) {
1829		l2cap_chan_unlock(chan);
1830		l2cap_chan_put(chan);
1831		return;
1832	}
1833
1834	l2cap_tx(chan, NULL, NULL, L2CAP_EV_RETRANS_TO);
1835	l2cap_chan_unlock(chan);
1836	l2cap_chan_put(chan);
1837}
1838
1839static void l2cap_streaming_send(struct l2cap_chan *chan,
1840				 struct sk_buff_head *skbs)
1841{
1842	struct sk_buff *skb;
1843	struct l2cap_ctrl *control;
1844
1845	BT_DBG("chan %p, skbs %p", chan, skbs);
1846
1847	if (__chan_is_moving(chan))
1848		return;
1849
1850	skb_queue_splice_tail_init(skbs, &chan->tx_q);
1851
1852	while (!skb_queue_empty(&chan->tx_q)) {
1853
1854		skb = skb_dequeue(&chan->tx_q);
1855
1856		bt_cb(skb)->l2cap.retries = 1;
1857		control = &bt_cb(skb)->l2cap;
1858
1859		control->reqseq = 0;
1860		control->txseq = chan->next_tx_seq;
1861
1862		__pack_control(chan, control, skb);
1863
1864		if (chan->fcs == L2CAP_FCS_CRC16) {
1865			u16 fcs = crc16(0, (u8 *) skb->data, skb->len);
1866			put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
1867		}
1868
1869		l2cap_do_send(chan, skb);
1870
1871		BT_DBG("Sent txseq %u", control->txseq);
1872
1873		chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
1874		chan->frames_sent++;
1875	}
1876}
1877
1878static int l2cap_ertm_send(struct l2cap_chan *chan)
1879{
1880	struct sk_buff *skb, *tx_skb;
1881	struct l2cap_ctrl *control;
1882	int sent = 0;
1883
1884	BT_DBG("chan %p", chan);
1885
1886	if (chan->state != BT_CONNECTED)
1887		return -ENOTCONN;
1888
1889	if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
1890		return 0;
1891
1892	if (__chan_is_moving(chan))
1893		return 0;
1894
1895	while (chan->tx_send_head &&
1896	       chan->unacked_frames < chan->remote_tx_win &&
1897	       chan->tx_state == L2CAP_TX_STATE_XMIT) {
1898
1899		skb = chan->tx_send_head;
1900
1901		bt_cb(skb)->l2cap.retries = 1;
1902		control = &bt_cb(skb)->l2cap;
1903
1904		if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
1905			control->final = 1;
1906
1907		control->reqseq = chan->buffer_seq;
1908		chan->last_acked_seq = chan->buffer_seq;
1909		control->txseq = chan->next_tx_seq;
1910
1911		__pack_control(chan, control, skb);
1912
1913		if (chan->fcs == L2CAP_FCS_CRC16) {
1914			u16 fcs = crc16(0, (u8 *) skb->data, skb->len);
1915			put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
1916		}
1917
1918		/* Clone after data has been modified. Data is assumed to be
1919		   read-only (for locking purposes) on cloned sk_buffs.
1920		 */
1921		tx_skb = skb_clone(skb, GFP_KERNEL);
1922
1923		if (!tx_skb)
1924			break;
1925
1926		__set_retrans_timer(chan);
1927
1928		chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
1929		chan->unacked_frames++;
1930		chan->frames_sent++;
1931		sent++;
1932
1933		if (skb_queue_is_last(&chan->tx_q, skb))
1934			chan->tx_send_head = NULL;
1935		else
1936			chan->tx_send_head = skb_queue_next(&chan->tx_q, skb);
1937
1938		l2cap_do_send(chan, tx_skb);
1939		BT_DBG("Sent txseq %u", control->txseq);
1940	}
1941
1942	BT_DBG("Sent %d, %u unacked, %u in ERTM queue", sent,
1943	       chan->unacked_frames, skb_queue_len(&chan->tx_q));
1944
1945	return sent;
1946}
1947
1948static void l2cap_ertm_resend(struct l2cap_chan *chan)
1949{
1950	struct l2cap_ctrl control;
1951	struct sk_buff *skb;
1952	struct sk_buff *tx_skb;
1953	u16 seq;
1954
1955	BT_DBG("chan %p", chan);
1956
1957	if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
1958		return;
1959
1960	if (__chan_is_moving(chan))
1961		return;
1962
1963	while (chan->retrans_list.head != L2CAP_SEQ_LIST_CLEAR) {
1964		seq = l2cap_seq_list_pop(&chan->retrans_list);
1965
1966		skb = l2cap_ertm_seq_in_queue(&chan->tx_q, seq);
1967		if (!skb) {
1968			BT_DBG("Error: Can't retransmit seq %d, frame missing",
1969			       seq);
1970			continue;
1971		}
1972
1973		bt_cb(skb)->l2cap.retries++;
1974		control = bt_cb(skb)->l2cap;
1975
1976		if (chan->max_tx != 0 &&
1977		    bt_cb(skb)->l2cap.retries > chan->max_tx) {
1978			BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
1979			l2cap_send_disconn_req(chan, ECONNRESET);
1980			l2cap_seq_list_clear(&chan->retrans_list);
1981			break;
1982		}
1983
1984		control.reqseq = chan->buffer_seq;
1985		if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
1986			control.final = 1;
1987		else
1988			control.final = 0;
1989
1990		if (skb_cloned(skb)) {
1991			/* Cloned sk_buffs are read-only, so we need a
1992			 * writeable copy
1993			 */
1994			tx_skb = skb_copy(skb, GFP_KERNEL);
1995		} else {
1996			tx_skb = skb_clone(skb, GFP_KERNEL);
1997		}
1998
1999		if (!tx_skb) {
2000			l2cap_seq_list_clear(&chan->retrans_list);
2001			break;
2002		}
2003
2004		/* Update skb contents */
2005		if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
2006			put_unaligned_le32(__pack_extended_control(&control),
2007					   tx_skb->data + L2CAP_HDR_SIZE);
2008		} else {
2009			put_unaligned_le16(__pack_enhanced_control(&control),
2010					   tx_skb->data + L2CAP_HDR_SIZE);
2011		}
2012
2013		/* Update FCS */
2014		if (chan->fcs == L2CAP_FCS_CRC16) {
2015			u16 fcs = crc16(0, (u8 *) tx_skb->data,
2016					tx_skb->len - L2CAP_FCS_SIZE);
2017			put_unaligned_le16(fcs, skb_tail_pointer(tx_skb) -
2018						L2CAP_FCS_SIZE);
2019		}
2020
2021		l2cap_do_send(chan, tx_skb);
2022
2023		BT_DBG("Resent txseq %d", control.txseq);
2024
2025		chan->last_acked_seq = chan->buffer_seq;
2026	}
2027}
2028
2029static void l2cap_retransmit(struct l2cap_chan *chan,
2030			     struct l2cap_ctrl *control)
2031{
2032	BT_DBG("chan %p, control %p", chan, control);
2033
2034	l2cap_seq_list_append(&chan->retrans_list, control->reqseq);
2035	l2cap_ertm_resend(chan);
2036}
2037
2038static void l2cap_retransmit_all(struct l2cap_chan *chan,
2039				 struct l2cap_ctrl *control)
2040{
2041	struct sk_buff *skb;
2042
2043	BT_DBG("chan %p, control %p", chan, control);
2044
2045	if (control->poll)
2046		set_bit(CONN_SEND_FBIT, &chan->conn_state);
2047
2048	l2cap_seq_list_clear(&chan->retrans_list);
2049
2050	if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
2051		return;
2052
2053	if (chan->unacked_frames) {
2054		skb_queue_walk(&chan->tx_q, skb) {
2055			if (bt_cb(skb)->l2cap.txseq == control->reqseq ||
2056			    skb == chan->tx_send_head)
2057				break;
2058		}
2059
2060		skb_queue_walk_from(&chan->tx_q, skb) {
2061			if (skb == chan->tx_send_head)
2062				break;
2063
2064			l2cap_seq_list_append(&chan->retrans_list,
2065					      bt_cb(skb)->l2cap.txseq);
2066		}
2067
2068		l2cap_ertm_resend(chan);
2069	}
2070}
2071
2072static void l2cap_send_ack(struct l2cap_chan *chan)
2073{
2074	struct l2cap_ctrl control;
2075	u16 frames_to_ack = __seq_offset(chan, chan->buffer_seq,
2076					 chan->last_acked_seq);
2077	int threshold;
2078
2079	BT_DBG("chan %p last_acked_seq %d buffer_seq %d",
2080	       chan, chan->last_acked_seq, chan->buffer_seq);
2081
2082	memset(&control, 0, sizeof(control));
2083	control.sframe = 1;
2084
2085	if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&
2086	    chan->rx_state == L2CAP_RX_STATE_RECV) {
2087		__clear_ack_timer(chan);
2088		control.super = L2CAP_SUPER_RNR;
2089		control.reqseq = chan->buffer_seq;
2090		l2cap_send_sframe(chan, &control);
2091	} else {
2092		if (!test_bit(CONN_REMOTE_BUSY, &chan->conn_state)) {
2093			l2cap_ertm_send(chan);
2094			/* If any i-frames were sent, they included an ack */
2095			if (chan->buffer_seq == chan->last_acked_seq)
2096				frames_to_ack = 0;
2097		}
2098
2099		/* Ack now if the window is 3/4ths full.
2100		 * Calculate without mul or div
2101		 */
2102		threshold = chan->ack_win;
2103		threshold += threshold << 1;
2104		threshold >>= 2;
2105
2106		BT_DBG("frames_to_ack %u, threshold %d", frames_to_ack,
2107		       threshold);
2108
2109		if (frames_to_ack >= threshold) {
2110			__clear_ack_timer(chan);
2111			control.super = L2CAP_SUPER_RR;
2112			control.reqseq = chan->buffer_seq;
2113			l2cap_send_sframe(chan, &control);
2114			frames_to_ack = 0;
2115		}
2116
2117		if (frames_to_ack)
2118			__set_ack_timer(chan);
2119	}
2120}
2121
2122static inline int l2cap_skbuff_fromiovec(struct l2cap_chan *chan,
2123					 struct msghdr *msg, int len,
2124					 int count, struct sk_buff *skb)
2125{
2126	struct l2cap_conn *conn = chan->conn;
2127	struct sk_buff **frag;
2128	int sent = 0;
2129
2130	if (!copy_from_iter_full(skb_put(skb, count), count, &msg->msg_iter))
2131		return -EFAULT;
2132
2133	sent += count;
2134	len  -= count;
2135
2136	/* Continuation fragments (no L2CAP header) */
2137	frag = &skb_shinfo(skb)->frag_list;
2138	while (len) {
2139		struct sk_buff *tmp;
2140
2141		count = min_t(unsigned int, conn->mtu, len);
2142
2143		tmp = chan->ops->alloc_skb(chan, 0, count,
2144					   msg->msg_flags & MSG_DONTWAIT);
2145		if (IS_ERR(tmp))
2146			return PTR_ERR(tmp);
2147
2148		*frag = tmp;
2149
2150		if (!copy_from_iter_full(skb_put(*frag, count), count,
2151				   &msg->msg_iter))
2152			return -EFAULT;
2153
2154		sent += count;
2155		len  -= count;
2156
2157		skb->len += (*frag)->len;
2158		skb->data_len += (*frag)->len;
2159
2160		frag = &(*frag)->next;
2161	}
2162
2163	return sent;
2164}
2165
2166static struct sk_buff *l2cap_create_connless_pdu(struct l2cap_chan *chan,
2167						 struct msghdr *msg, size_t len)
2168{
2169	struct l2cap_conn *conn = chan->conn;
2170	struct sk_buff *skb;
2171	int err, count, hlen = L2CAP_HDR_SIZE + L2CAP_PSMLEN_SIZE;
2172	struct l2cap_hdr *lh;
2173
2174	BT_DBG("chan %p psm 0x%2.2x len %zu", chan,
2175	       __le16_to_cpu(chan->psm), len);
2176
2177	count = min_t(unsigned int, (conn->mtu - hlen), len);
2178
2179	skb = chan->ops->alloc_skb(chan, hlen, count,
2180				   msg->msg_flags & MSG_DONTWAIT);
2181	if (IS_ERR(skb))
2182		return skb;
2183
2184	/* Create L2CAP header */
2185	lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
2186	lh->cid = cpu_to_le16(chan->dcid);
2187	lh->len = cpu_to_le16(len + L2CAP_PSMLEN_SIZE);
2188	put_unaligned(chan->psm, (__le16 *) skb_put(skb, L2CAP_PSMLEN_SIZE));
2189
2190	err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
2191	if (unlikely(err < 0)) {
2192		kfree_skb(skb);
2193		return ERR_PTR(err);
2194	}
2195	return skb;
2196}
2197
2198static struct sk_buff *l2cap_create_basic_pdu(struct l2cap_chan *chan,
2199					      struct msghdr *msg, size_t len)
2200{
2201	struct l2cap_conn *conn = chan->conn;
2202	struct sk_buff *skb;
2203	int err, count;
2204	struct l2cap_hdr *lh;
2205
2206	BT_DBG("chan %p len %zu", chan, len);
2207
2208	count = min_t(unsigned int, (conn->mtu - L2CAP_HDR_SIZE), len);
2209
2210	skb = chan->ops->alloc_skb(chan, L2CAP_HDR_SIZE, count,
2211				   msg->msg_flags & MSG_DONTWAIT);
2212	if (IS_ERR(skb))
2213		return skb;
2214
2215	/* Create L2CAP header */
2216	lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
2217	lh->cid = cpu_to_le16(chan->dcid);
2218	lh->len = cpu_to_le16(len);
2219
2220	err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
2221	if (unlikely(err < 0)) {
2222		kfree_skb(skb);
2223		return ERR_PTR(err);
2224	}
2225	return skb;
2226}
2227
2228static struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan,
2229					       struct msghdr *msg, size_t len,
2230					       u16 sdulen)
2231{
2232	struct l2cap_conn *conn = chan->conn;
2233	struct sk_buff *skb;
2234	int err, count, hlen;
2235	struct l2cap_hdr *lh;
2236
2237	BT_DBG("chan %p len %zu", chan, len);
2238
2239	if (!conn)
2240		return ERR_PTR(-ENOTCONN);
2241
2242	hlen = __ertm_hdr_size(chan);
2243
2244	if (sdulen)
2245		hlen += L2CAP_SDULEN_SIZE;
2246
2247	if (chan->fcs == L2CAP_FCS_CRC16)
2248		hlen += L2CAP_FCS_SIZE;
2249
2250	count = min_t(unsigned int, (conn->mtu - hlen), len);
2251
2252	skb = chan->ops->alloc_skb(chan, hlen, count,
2253				   msg->msg_flags & MSG_DONTWAIT);
2254	if (IS_ERR(skb))
2255		return skb;
2256
2257	/* Create L2CAP header */
2258	lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
2259	lh->cid = cpu_to_le16(chan->dcid);
2260	lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
2261
2262	/* Control header is populated later */
2263	if (test_bit(FLAG_EXT_CTRL, &chan->flags))
2264		put_unaligned_le32(0, skb_put(skb, L2CAP_EXT_CTRL_SIZE));
2265	else
2266		put_unaligned_le16(0, skb_put(skb, L2CAP_ENH_CTRL_SIZE));
2267
2268	if (sdulen)
2269		put_unaligned_le16(sdulen, skb_put(skb, L2CAP_SDULEN_SIZE));
2270
2271	err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
2272	if (unlikely(err < 0)) {
2273		kfree_skb(skb);
2274		return ERR_PTR(err);
2275	}
2276
2277	bt_cb(skb)->l2cap.fcs = chan->fcs;
2278	bt_cb(skb)->l2cap.retries = 0;
2279	return skb;
2280}
2281
2282static int l2cap_segment_sdu(struct l2cap_chan *chan,
2283			     struct sk_buff_head *seg_queue,
2284			     struct msghdr *msg, size_t len)
2285{
2286	struct sk_buff *skb;
2287	u16 sdu_len;
2288	size_t pdu_len;
2289	u8 sar;
2290
2291	BT_DBG("chan %p, msg %p, len %zu", chan, msg, len);
2292
2293	/* It is critical that ERTM PDUs fit in a single HCI fragment,
2294	 * so fragmented skbs are not used.  The HCI layer's handling
2295	 * of fragmented skbs is not compatible with ERTM's queueing.
2296	 */
2297
2298	/* PDU size is derived from the HCI MTU */
2299	pdu_len = chan->conn->mtu;
2300
2301	/* Constrain PDU size for BR/EDR connections */
2302	if (!chan->hs_hcon)
2303		pdu_len = min_t(size_t, pdu_len, L2CAP_BREDR_MAX_PAYLOAD);
2304
2305	/* Adjust for largest possible L2CAP overhead. */
2306	if (chan->fcs)
2307		pdu_len -= L2CAP_FCS_SIZE;
2308
2309	pdu_len -= __ertm_hdr_size(chan);
2310
2311	/* Remote device may have requested smaller PDUs */
2312	pdu_len = min_t(size_t, pdu_len, chan->remote_mps);
2313
2314	if (len <= pdu_len) {
2315		sar = L2CAP_SAR_UNSEGMENTED;
2316		sdu_len = 0;
2317		pdu_len = len;
2318	} else {
2319		sar = L2CAP_SAR_START;
2320		sdu_len = len;
2321	}
2322
2323	while (len > 0) {
2324		skb = l2cap_create_iframe_pdu(chan, msg, pdu_len, sdu_len);
2325
2326		if (IS_ERR(skb)) {
2327			__skb_queue_purge(seg_queue);
2328			return PTR_ERR(skb);
2329		}
2330
2331		bt_cb(skb)->l2cap.sar = sar;
2332		__skb_queue_tail(seg_queue, skb);
2333
2334		len -= pdu_len;
2335		if (sdu_len)
2336			sdu_len = 0;
2337
2338		if (len <= pdu_len) {
2339			sar = L2CAP_SAR_END;
2340			pdu_len = len;
2341		} else {
2342			sar = L2CAP_SAR_CONTINUE;
2343		}
2344	}
2345
2346	return 0;
2347}
2348
2349static struct sk_buff *l2cap_create_le_flowctl_pdu(struct l2cap_chan *chan,
2350						   struct msghdr *msg,
2351						   size_t len, u16 sdulen)
2352{
2353	struct l2cap_conn *conn = chan->conn;
2354	struct sk_buff *skb;
2355	int err, count, hlen;
2356	struct l2cap_hdr *lh;
2357
2358	BT_DBG("chan %p len %zu", chan, len);
2359
2360	if (!conn)
2361		return ERR_PTR(-ENOTCONN);
2362
2363	hlen = L2CAP_HDR_SIZE;
2364
2365	if (sdulen)
2366		hlen += L2CAP_SDULEN_SIZE;
2367
2368	count = min_t(unsigned int, (conn->mtu - hlen), len);
2369
2370	skb = chan->ops->alloc_skb(chan, hlen, count,
2371				   msg->msg_flags & MSG_DONTWAIT);
2372	if (IS_ERR(skb))
2373		return skb;
2374
2375	/* Create L2CAP header */
2376	lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
2377	lh->cid = cpu_to_le16(chan->dcid);
2378	lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
2379
2380	if (sdulen)
2381		put_unaligned_le16(sdulen, skb_put(skb, L2CAP_SDULEN_SIZE));
2382
2383	err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
2384	if (unlikely(err < 0)) {
2385		kfree_skb(skb);
2386		return ERR_PTR(err);
2387	}
2388
2389	return skb;
2390}
2391
2392static int l2cap_segment_le_sdu(struct l2cap_chan *chan,
2393				struct sk_buff_head *seg_queue,
2394				struct msghdr *msg, size_t len)
2395{
2396	struct sk_buff *skb;
2397	size_t pdu_len;
2398	u16 sdu_len;
2399
2400	BT_DBG("chan %p, msg %p, len %zu", chan, msg, len);
2401
2402	sdu_len = len;
2403	pdu_len = chan->remote_mps - L2CAP_SDULEN_SIZE;
2404
2405	while (len > 0) {
2406		if (len <= pdu_len)
2407			pdu_len = len;
2408
2409		skb = l2cap_create_le_flowctl_pdu(chan, msg, pdu_len, sdu_len);
2410		if (IS_ERR(skb)) {
2411			__skb_queue_purge(seg_queue);
2412			return PTR_ERR(skb);
2413		}
2414
2415		__skb_queue_tail(seg_queue, skb);
2416
2417		len -= pdu_len;
2418
2419		if (sdu_len) {
2420			sdu_len = 0;
2421			pdu_len += L2CAP_SDULEN_SIZE;
2422		}
2423	}
2424
2425	return 0;
2426}
2427
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2428int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len)
2429{
2430	struct sk_buff *skb;
2431	int err;
2432	struct sk_buff_head seg_queue;
2433
2434	if (!chan->conn)
2435		return -ENOTCONN;
2436
2437	/* Connectionless channel */
2438	if (chan->chan_type == L2CAP_CHAN_CONN_LESS) {
2439		skb = l2cap_create_connless_pdu(chan, msg, len);
2440		if (IS_ERR(skb))
2441			return PTR_ERR(skb);
2442
2443		/* Channel lock is released before requesting new skb and then
2444		 * reacquired thus we need to recheck channel state.
2445		 */
2446		if (chan->state != BT_CONNECTED) {
2447			kfree_skb(skb);
2448			return -ENOTCONN;
2449		}
2450
2451		l2cap_do_send(chan, skb);
2452		return len;
2453	}
2454
2455	switch (chan->mode) {
2456	case L2CAP_MODE_LE_FLOWCTL:
 
2457		/* Check outgoing MTU */
2458		if (len > chan->omtu)
2459			return -EMSGSIZE;
2460
2461		if (!chan->tx_credits)
2462			return -EAGAIN;
2463
2464		__skb_queue_head_init(&seg_queue);
2465
2466		err = l2cap_segment_le_sdu(chan, &seg_queue, msg, len);
2467
2468		if (chan->state != BT_CONNECTED) {
2469			__skb_queue_purge(&seg_queue);
2470			err = -ENOTCONN;
2471		}
2472
2473		if (err)
2474			return err;
2475
2476		skb_queue_splice_tail_init(&seg_queue, &chan->tx_q);
2477
2478		while (chan->tx_credits && !skb_queue_empty(&chan->tx_q)) {
2479			l2cap_do_send(chan, skb_dequeue(&chan->tx_q));
2480			chan->tx_credits--;
2481		}
2482
2483		if (!chan->tx_credits)
2484			chan->ops->suspend(chan);
2485
2486		err = len;
2487
2488		break;
2489
2490	case L2CAP_MODE_BASIC:
2491		/* Check outgoing MTU */
2492		if (len > chan->omtu)
2493			return -EMSGSIZE;
2494
2495		/* Create a basic PDU */
2496		skb = l2cap_create_basic_pdu(chan, msg, len);
2497		if (IS_ERR(skb))
2498			return PTR_ERR(skb);
2499
2500		/* Channel lock is released before requesting new skb and then
2501		 * reacquired thus we need to recheck channel state.
2502		 */
2503		if (chan->state != BT_CONNECTED) {
2504			kfree_skb(skb);
2505			return -ENOTCONN;
2506		}
2507
2508		l2cap_do_send(chan, skb);
2509		err = len;
2510		break;
2511
2512	case L2CAP_MODE_ERTM:
2513	case L2CAP_MODE_STREAMING:
2514		/* Check outgoing MTU */
2515		if (len > chan->omtu) {
2516			err = -EMSGSIZE;
2517			break;
2518		}
2519
2520		__skb_queue_head_init(&seg_queue);
2521
2522		/* Do segmentation before calling in to the state machine,
2523		 * since it's possible to block while waiting for memory
2524		 * allocation.
2525		 */
2526		err = l2cap_segment_sdu(chan, &seg_queue, msg, len);
2527
2528		/* The channel could have been closed while segmenting,
2529		 * check that it is still connected.
2530		 */
2531		if (chan->state != BT_CONNECTED) {
2532			__skb_queue_purge(&seg_queue);
2533			err = -ENOTCONN;
2534		}
2535
2536		if (err)
2537			break;
2538
2539		if (chan->mode == L2CAP_MODE_ERTM)
2540			l2cap_tx(chan, NULL, &seg_queue, L2CAP_EV_DATA_REQUEST);
2541		else
2542			l2cap_streaming_send(chan, &seg_queue);
2543
2544		err = len;
2545
2546		/* If the skbs were not queued for sending, they'll still be in
2547		 * seg_queue and need to be purged.
2548		 */
2549		__skb_queue_purge(&seg_queue);
2550		break;
2551
2552	default:
2553		BT_DBG("bad state %1.1x", chan->mode);
2554		err = -EBADFD;
2555	}
2556
2557	return err;
2558}
2559EXPORT_SYMBOL_GPL(l2cap_chan_send);
2560
2561static void l2cap_send_srej(struct l2cap_chan *chan, u16 txseq)
2562{
2563	struct l2cap_ctrl control;
2564	u16 seq;
2565
2566	BT_DBG("chan %p, txseq %u", chan, txseq);
2567
2568	memset(&control, 0, sizeof(control));
2569	control.sframe = 1;
2570	control.super = L2CAP_SUPER_SREJ;
2571
2572	for (seq = chan->expected_tx_seq; seq != txseq;
2573	     seq = __next_seq(chan, seq)) {
2574		if (!l2cap_ertm_seq_in_queue(&chan->srej_q, seq)) {
2575			control.reqseq = seq;
2576			l2cap_send_sframe(chan, &control);
2577			l2cap_seq_list_append(&chan->srej_list, seq);
2578		}
2579	}
2580
2581	chan->expected_tx_seq = __next_seq(chan, txseq);
2582}
2583
2584static void l2cap_send_srej_tail(struct l2cap_chan *chan)
2585{
2586	struct l2cap_ctrl control;
2587
2588	BT_DBG("chan %p", chan);
2589
2590	if (chan->srej_list.tail == L2CAP_SEQ_LIST_CLEAR)
2591		return;
2592
2593	memset(&control, 0, sizeof(control));
2594	control.sframe = 1;
2595	control.super = L2CAP_SUPER_SREJ;
2596	control.reqseq = chan->srej_list.tail;
2597	l2cap_send_sframe(chan, &control);
2598}
2599
2600static void l2cap_send_srej_list(struct l2cap_chan *chan, u16 txseq)
2601{
2602	struct l2cap_ctrl control;
2603	u16 initial_head;
2604	u16 seq;
2605
2606	BT_DBG("chan %p, txseq %u", chan, txseq);
2607
2608	memset(&control, 0, sizeof(control));
2609	control.sframe = 1;
2610	control.super = L2CAP_SUPER_SREJ;
2611
2612	/* Capture initial list head to allow only one pass through the list. */
2613	initial_head = chan->srej_list.head;
2614
2615	do {
2616		seq = l2cap_seq_list_pop(&chan->srej_list);
2617		if (seq == txseq || seq == L2CAP_SEQ_LIST_CLEAR)
2618			break;
2619
2620		control.reqseq = seq;
2621		l2cap_send_sframe(chan, &control);
2622		l2cap_seq_list_append(&chan->srej_list, seq);
2623	} while (chan->srej_list.head != initial_head);
2624}
2625
2626static void l2cap_process_reqseq(struct l2cap_chan *chan, u16 reqseq)
2627{
2628	struct sk_buff *acked_skb;
2629	u16 ackseq;
2630
2631	BT_DBG("chan %p, reqseq %u", chan, reqseq);
2632
2633	if (chan->unacked_frames == 0 || reqseq == chan->expected_ack_seq)
2634		return;
2635
2636	BT_DBG("expected_ack_seq %u, unacked_frames %u",
2637	       chan->expected_ack_seq, chan->unacked_frames);
2638
2639	for (ackseq = chan->expected_ack_seq; ackseq != reqseq;
2640	     ackseq = __next_seq(chan, ackseq)) {
2641
2642		acked_skb = l2cap_ertm_seq_in_queue(&chan->tx_q, ackseq);
2643		if (acked_skb) {
2644			skb_unlink(acked_skb, &chan->tx_q);
2645			kfree_skb(acked_skb);
2646			chan->unacked_frames--;
2647		}
2648	}
2649
2650	chan->expected_ack_seq = reqseq;
2651
2652	if (chan->unacked_frames == 0)
2653		__clear_retrans_timer(chan);
2654
2655	BT_DBG("unacked_frames %u", chan->unacked_frames);
2656}
2657
2658static void l2cap_abort_rx_srej_sent(struct l2cap_chan *chan)
2659{
2660	BT_DBG("chan %p", chan);
2661
2662	chan->expected_tx_seq = chan->buffer_seq;
2663	l2cap_seq_list_clear(&chan->srej_list);
2664	skb_queue_purge(&chan->srej_q);
2665	chan->rx_state = L2CAP_RX_STATE_RECV;
2666}
2667
2668static void l2cap_tx_state_xmit(struct l2cap_chan *chan,
2669				struct l2cap_ctrl *control,
2670				struct sk_buff_head *skbs, u8 event)
2671{
2672	BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,
2673	       event);
2674
2675	switch (event) {
2676	case L2CAP_EV_DATA_REQUEST:
2677		if (chan->tx_send_head == NULL)
2678			chan->tx_send_head = skb_peek(skbs);
2679
2680		skb_queue_splice_tail_init(skbs, &chan->tx_q);
2681		l2cap_ertm_send(chan);
2682		break;
2683	case L2CAP_EV_LOCAL_BUSY_DETECTED:
2684		BT_DBG("Enter LOCAL_BUSY");
2685		set_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2686
2687		if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
2688			/* The SREJ_SENT state must be aborted if we are to
2689			 * enter the LOCAL_BUSY state.
2690			 */
2691			l2cap_abort_rx_srej_sent(chan);
2692		}
2693
2694		l2cap_send_ack(chan);
2695
2696		break;
2697	case L2CAP_EV_LOCAL_BUSY_CLEAR:
2698		BT_DBG("Exit LOCAL_BUSY");
2699		clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2700
2701		if (test_bit(CONN_RNR_SENT, &chan->conn_state)) {
2702			struct l2cap_ctrl local_control;
2703
2704			memset(&local_control, 0, sizeof(local_control));
2705			local_control.sframe = 1;
2706			local_control.super = L2CAP_SUPER_RR;
2707			local_control.poll = 1;
2708			local_control.reqseq = chan->buffer_seq;
2709			l2cap_send_sframe(chan, &local_control);
2710
2711			chan->retry_count = 1;
2712			__set_monitor_timer(chan);
2713			chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2714		}
2715		break;
2716	case L2CAP_EV_RECV_REQSEQ_AND_FBIT:
2717		l2cap_process_reqseq(chan, control->reqseq);
2718		break;
2719	case L2CAP_EV_EXPLICIT_POLL:
2720		l2cap_send_rr_or_rnr(chan, 1);
2721		chan->retry_count = 1;
2722		__set_monitor_timer(chan);
2723		__clear_ack_timer(chan);
2724		chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2725		break;
2726	case L2CAP_EV_RETRANS_TO:
2727		l2cap_send_rr_or_rnr(chan, 1);
2728		chan->retry_count = 1;
2729		__set_monitor_timer(chan);
2730		chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2731		break;
2732	case L2CAP_EV_RECV_FBIT:
2733		/* Nothing to process */
2734		break;
2735	default:
2736		break;
2737	}
2738}
2739
2740static void l2cap_tx_state_wait_f(struct l2cap_chan *chan,
2741				  struct l2cap_ctrl *control,
2742				  struct sk_buff_head *skbs, u8 event)
2743{
2744	BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,
2745	       event);
2746
2747	switch (event) {
2748	case L2CAP_EV_DATA_REQUEST:
2749		if (chan->tx_send_head == NULL)
2750			chan->tx_send_head = skb_peek(skbs);
2751		/* Queue data, but don't send. */
2752		skb_queue_splice_tail_init(skbs, &chan->tx_q);
2753		break;
2754	case L2CAP_EV_LOCAL_BUSY_DETECTED:
2755		BT_DBG("Enter LOCAL_BUSY");
2756		set_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2757
2758		if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
2759			/* The SREJ_SENT state must be aborted if we are to
2760			 * enter the LOCAL_BUSY state.
2761			 */
2762			l2cap_abort_rx_srej_sent(chan);
2763		}
2764
2765		l2cap_send_ack(chan);
2766
2767		break;
2768	case L2CAP_EV_LOCAL_BUSY_CLEAR:
2769		BT_DBG("Exit LOCAL_BUSY");
2770		clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2771
2772		if (test_bit(CONN_RNR_SENT, &chan->conn_state)) {
2773			struct l2cap_ctrl local_control;
2774			memset(&local_control, 0, sizeof(local_control));
2775			local_control.sframe = 1;
2776			local_control.super = L2CAP_SUPER_RR;
2777			local_control.poll = 1;
2778			local_control.reqseq = chan->buffer_seq;
2779			l2cap_send_sframe(chan, &local_control);
2780
2781			chan->retry_count = 1;
2782			__set_monitor_timer(chan);
2783			chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2784		}
2785		break;
2786	case L2CAP_EV_RECV_REQSEQ_AND_FBIT:
2787		l2cap_process_reqseq(chan, control->reqseq);
2788
2789		/* Fall through */
2790
2791	case L2CAP_EV_RECV_FBIT:
2792		if (control && control->final) {
2793			__clear_monitor_timer(chan);
2794			if (chan->unacked_frames > 0)
2795				__set_retrans_timer(chan);
2796			chan->retry_count = 0;
2797			chan->tx_state = L2CAP_TX_STATE_XMIT;
2798			BT_DBG("recv fbit tx_state 0x2.2%x", chan->tx_state);
2799		}
2800		break;
2801	case L2CAP_EV_EXPLICIT_POLL:
2802		/* Ignore */
2803		break;
2804	case L2CAP_EV_MONITOR_TO:
2805		if (chan->max_tx == 0 || chan->retry_count < chan->max_tx) {
2806			l2cap_send_rr_or_rnr(chan, 1);
2807			__set_monitor_timer(chan);
2808			chan->retry_count++;
2809		} else {
2810			l2cap_send_disconn_req(chan, ECONNABORTED);
2811		}
2812		break;
2813	default:
2814		break;
2815	}
2816}
2817
2818static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
2819		     struct sk_buff_head *skbs, u8 event)
2820{
2821	BT_DBG("chan %p, control %p, skbs %p, event %d, state %d",
2822	       chan, control, skbs, event, chan->tx_state);
2823
2824	switch (chan->tx_state) {
2825	case L2CAP_TX_STATE_XMIT:
2826		l2cap_tx_state_xmit(chan, control, skbs, event);
2827		break;
2828	case L2CAP_TX_STATE_WAIT_F:
2829		l2cap_tx_state_wait_f(chan, control, skbs, event);
2830		break;
2831	default:
2832		/* Ignore event */
2833		break;
2834	}
2835}
2836
2837static void l2cap_pass_to_tx(struct l2cap_chan *chan,
2838			     struct l2cap_ctrl *control)
2839{
2840	BT_DBG("chan %p, control %p", chan, control);
2841	l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_REQSEQ_AND_FBIT);
2842}
2843
2844static void l2cap_pass_to_tx_fbit(struct l2cap_chan *chan,
2845				  struct l2cap_ctrl *control)
2846{
2847	BT_DBG("chan %p, control %p", chan, control);
2848	l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_FBIT);
2849}
2850
2851/* Copy frame to all raw sockets on that connection */
2852static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb)
2853{
2854	struct sk_buff *nskb;
2855	struct l2cap_chan *chan;
2856
2857	BT_DBG("conn %p", conn);
2858
2859	mutex_lock(&conn->chan_lock);
2860
2861	list_for_each_entry(chan, &conn->chan_l, list) {
2862		if (chan->chan_type != L2CAP_CHAN_RAW)
2863			continue;
2864
2865		/* Don't send frame to the channel it came from */
2866		if (bt_cb(skb)->l2cap.chan == chan)
2867			continue;
2868
2869		nskb = skb_clone(skb, GFP_KERNEL);
2870		if (!nskb)
2871			continue;
2872		if (chan->ops->recv(chan, nskb))
2873			kfree_skb(nskb);
2874	}
2875
2876	mutex_unlock(&conn->chan_lock);
2877}
2878
2879/* ---- L2CAP signalling commands ---- */
2880static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn, u8 code,
2881				       u8 ident, u16 dlen, void *data)
2882{
2883	struct sk_buff *skb, **frag;
2884	struct l2cap_cmd_hdr *cmd;
2885	struct l2cap_hdr *lh;
2886	int len, count;
2887
2888	BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %u",
2889	       conn, code, ident, dlen);
2890
2891	if (conn->mtu < L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE)
2892		return NULL;
2893
2894	len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen;
2895	count = min_t(unsigned int, conn->mtu, len);
2896
2897	skb = bt_skb_alloc(count, GFP_KERNEL);
2898	if (!skb)
2899		return NULL;
2900
2901	lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
2902	lh->len = cpu_to_le16(L2CAP_CMD_HDR_SIZE + dlen);
2903
2904	if (conn->hcon->type == LE_LINK)
2905		lh->cid = cpu_to_le16(L2CAP_CID_LE_SIGNALING);
2906	else
2907		lh->cid = cpu_to_le16(L2CAP_CID_SIGNALING);
2908
2909	cmd = (struct l2cap_cmd_hdr *) skb_put(skb, L2CAP_CMD_HDR_SIZE);
2910	cmd->code  = code;
2911	cmd->ident = ident;
2912	cmd->len   = cpu_to_le16(dlen);
2913
2914	if (dlen) {
2915		count -= L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE;
2916		memcpy(skb_put(skb, count), data, count);
2917		data += count;
2918	}
2919
2920	len -= skb->len;
2921
2922	/* Continuation fragments (no L2CAP header) */
2923	frag = &skb_shinfo(skb)->frag_list;
2924	while (len) {
2925		count = min_t(unsigned int, conn->mtu, len);
2926
2927		*frag = bt_skb_alloc(count, GFP_KERNEL);
2928		if (!*frag)
2929			goto fail;
2930
2931		memcpy(skb_put(*frag, count), data, count);
2932
2933		len  -= count;
2934		data += count;
2935
2936		frag = &(*frag)->next;
2937	}
2938
2939	return skb;
2940
2941fail:
2942	kfree_skb(skb);
2943	return NULL;
2944}
2945
2946static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen,
2947				     unsigned long *val)
2948{
2949	struct l2cap_conf_opt *opt = *ptr;
2950	int len;
2951
2952	len = L2CAP_CONF_OPT_SIZE + opt->len;
2953	*ptr += len;
2954
2955	*type = opt->type;
2956	*olen = opt->len;
2957
2958	switch (opt->len) {
2959	case 1:
2960		*val = *((u8 *) opt->val);
2961		break;
2962
2963	case 2:
2964		*val = get_unaligned_le16(opt->val);
2965		break;
2966
2967	case 4:
2968		*val = get_unaligned_le32(opt->val);
2969		break;
2970
2971	default:
2972		*val = (unsigned long) opt->val;
2973		break;
2974	}
2975
2976	BT_DBG("type 0x%2.2x len %u val 0x%lx", *type, opt->len, *val);
2977	return len;
2978}
2979
2980static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val)
2981{
2982	struct l2cap_conf_opt *opt = *ptr;
2983
2984	BT_DBG("type 0x%2.2x len %u val 0x%lx", type, len, val);
2985
 
 
 
2986	opt->type = type;
2987	opt->len  = len;
2988
2989	switch (len) {
2990	case 1:
2991		*((u8 *) opt->val)  = val;
2992		break;
2993
2994	case 2:
2995		put_unaligned_le16(val, opt->val);
2996		break;
2997
2998	case 4:
2999		put_unaligned_le32(val, opt->val);
3000		break;
3001
3002	default:
3003		memcpy(opt->val, (void *) val, len);
3004		break;
3005	}
3006
3007	*ptr += L2CAP_CONF_OPT_SIZE + len;
3008}
3009
3010static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan)
3011{
3012	struct l2cap_conf_efs efs;
3013
3014	switch (chan->mode) {
3015	case L2CAP_MODE_ERTM:
3016		efs.id		= chan->local_id;
3017		efs.stype	= chan->local_stype;
3018		efs.msdu	= cpu_to_le16(chan->local_msdu);
3019		efs.sdu_itime	= cpu_to_le32(chan->local_sdu_itime);
3020		efs.acc_lat	= cpu_to_le32(L2CAP_DEFAULT_ACC_LAT);
3021		efs.flush_to	= cpu_to_le32(L2CAP_EFS_DEFAULT_FLUSH_TO);
3022		break;
3023
3024	case L2CAP_MODE_STREAMING:
3025		efs.id		= 1;
3026		efs.stype	= L2CAP_SERV_BESTEFFORT;
3027		efs.msdu	= cpu_to_le16(chan->local_msdu);
3028		efs.sdu_itime	= cpu_to_le32(chan->local_sdu_itime);
3029		efs.acc_lat	= 0;
3030		efs.flush_to	= 0;
3031		break;
3032
3033	default:
3034		return;
3035	}
3036
3037	l2cap_add_conf_opt(ptr, L2CAP_CONF_EFS, sizeof(efs),
3038			   (unsigned long) &efs);
3039}
3040
3041static void l2cap_ack_timeout(struct work_struct *work)
3042{
3043	struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
3044					       ack_timer.work);
3045	u16 frames_to_ack;
3046
3047	BT_DBG("chan %p", chan);
3048
3049	l2cap_chan_lock(chan);
3050
3051	frames_to_ack = __seq_offset(chan, chan->buffer_seq,
3052				     chan->last_acked_seq);
3053
3054	if (frames_to_ack)
3055		l2cap_send_rr_or_rnr(chan, 0);
3056
3057	l2cap_chan_unlock(chan);
3058	l2cap_chan_put(chan);
3059}
3060
3061int l2cap_ertm_init(struct l2cap_chan *chan)
3062{
3063	int err;
3064
3065	chan->next_tx_seq = 0;
3066	chan->expected_tx_seq = 0;
3067	chan->expected_ack_seq = 0;
3068	chan->unacked_frames = 0;
3069	chan->buffer_seq = 0;
3070	chan->frames_sent = 0;
3071	chan->last_acked_seq = 0;
3072	chan->sdu = NULL;
3073	chan->sdu_last_frag = NULL;
3074	chan->sdu_len = 0;
3075
3076	skb_queue_head_init(&chan->tx_q);
3077
3078	chan->local_amp_id = AMP_ID_BREDR;
3079	chan->move_id = AMP_ID_BREDR;
3080	chan->move_state = L2CAP_MOVE_STABLE;
3081	chan->move_role = L2CAP_MOVE_ROLE_NONE;
3082
3083	if (chan->mode != L2CAP_MODE_ERTM)
3084		return 0;
3085
3086	chan->rx_state = L2CAP_RX_STATE_RECV;
3087	chan->tx_state = L2CAP_TX_STATE_XMIT;
3088
3089	INIT_DELAYED_WORK(&chan->retrans_timer, l2cap_retrans_timeout);
3090	INIT_DELAYED_WORK(&chan->monitor_timer, l2cap_monitor_timeout);
3091	INIT_DELAYED_WORK(&chan->ack_timer, l2cap_ack_timeout);
3092
3093	skb_queue_head_init(&chan->srej_q);
3094
3095	err = l2cap_seq_list_init(&chan->srej_list, chan->tx_win);
3096	if (err < 0)
3097		return err;
3098
3099	err = l2cap_seq_list_init(&chan->retrans_list, chan->remote_tx_win);
3100	if (err < 0)
3101		l2cap_seq_list_free(&chan->srej_list);
3102
3103	return err;
3104}
3105
3106static inline __u8 l2cap_select_mode(__u8 mode, __u16 remote_feat_mask)
3107{
3108	switch (mode) {
3109	case L2CAP_MODE_STREAMING:
3110	case L2CAP_MODE_ERTM:
3111		if (l2cap_mode_supported(mode, remote_feat_mask))
3112			return mode;
3113		/* fall through */
3114	default:
3115		return L2CAP_MODE_BASIC;
3116	}
3117}
3118
3119static inline bool __l2cap_ews_supported(struct l2cap_conn *conn)
3120{
3121	return ((conn->local_fixed_chan & L2CAP_FC_A2MP) &&
3122		(conn->feat_mask & L2CAP_FEAT_EXT_WINDOW));
3123}
3124
3125static inline bool __l2cap_efs_supported(struct l2cap_conn *conn)
3126{
3127	return ((conn->local_fixed_chan & L2CAP_FC_A2MP) &&
3128		(conn->feat_mask & L2CAP_FEAT_EXT_FLOW));
3129}
3130
3131static void __l2cap_set_ertm_timeouts(struct l2cap_chan *chan,
3132				      struct l2cap_conf_rfc *rfc)
3133{
3134	if (chan->local_amp_id != AMP_ID_BREDR && chan->hs_hcon) {
3135		u64 ertm_to = chan->hs_hcon->hdev->amp_be_flush_to;
3136
3137		/* Class 1 devices have must have ERTM timeouts
3138		 * exceeding the Link Supervision Timeout.  The
3139		 * default Link Supervision Timeout for AMP
3140		 * controllers is 10 seconds.
3141		 *
3142		 * Class 1 devices use 0xffffffff for their
3143		 * best-effort flush timeout, so the clamping logic
3144		 * will result in a timeout that meets the above
3145		 * requirement.  ERTM timeouts are 16-bit values, so
3146		 * the maximum timeout is 65.535 seconds.
3147		 */
3148
3149		/* Convert timeout to milliseconds and round */
3150		ertm_to = DIV_ROUND_UP_ULL(ertm_to, 1000);
3151
3152		/* This is the recommended formula for class 2 devices
3153		 * that start ERTM timers when packets are sent to the
3154		 * controller.
3155		 */
3156		ertm_to = 3 * ertm_to + 500;
3157
3158		if (ertm_to > 0xffff)
3159			ertm_to = 0xffff;
3160
3161		rfc->retrans_timeout = cpu_to_le16((u16) ertm_to);
3162		rfc->monitor_timeout = rfc->retrans_timeout;
3163	} else {
3164		rfc->retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO);
3165		rfc->monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO);
3166	}
3167}
3168
3169static inline void l2cap_txwin_setup(struct l2cap_chan *chan)
3170{
3171	if (chan->tx_win > L2CAP_DEFAULT_TX_WINDOW &&
3172	    __l2cap_ews_supported(chan->conn)) {
3173		/* use extended control field */
3174		set_bit(FLAG_EXT_CTRL, &chan->flags);
3175		chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;
3176	} else {
3177		chan->tx_win = min_t(u16, chan->tx_win,
3178				     L2CAP_DEFAULT_TX_WINDOW);
3179		chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
3180	}
3181	chan->ack_win = chan->tx_win;
3182}
3183
3184static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data)
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
3185{
3186	struct l2cap_conf_req *req = data;
3187	struct l2cap_conf_rfc rfc = { .mode = chan->mode };
3188	void *ptr = req->data;
 
3189	u16 size;
3190
3191	BT_DBG("chan %p", chan);
3192
3193	if (chan->num_conf_req || chan->num_conf_rsp)
3194		goto done;
3195
3196	switch (chan->mode) {
3197	case L2CAP_MODE_STREAMING:
3198	case L2CAP_MODE_ERTM:
3199		if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state))
3200			break;
3201
3202		if (__l2cap_efs_supported(chan->conn))
3203			set_bit(FLAG_EFS_ENABLE, &chan->flags);
3204
3205		/* fall through */
3206	default:
3207		chan->mode = l2cap_select_mode(rfc.mode, chan->conn->feat_mask);
3208		break;
3209	}
3210
3211done:
3212	if (chan->imtu != L2CAP_DEFAULT_MTU)
3213		l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu);
 
 
 
 
3214
3215	switch (chan->mode) {
3216	case L2CAP_MODE_BASIC:
3217		if (disable_ertm)
3218			break;
3219
3220		if (!(chan->conn->feat_mask & L2CAP_FEAT_ERTM) &&
3221		    !(chan->conn->feat_mask & L2CAP_FEAT_STREAMING))
3222			break;
3223
3224		rfc.mode            = L2CAP_MODE_BASIC;
3225		rfc.txwin_size      = 0;
3226		rfc.max_transmit    = 0;
3227		rfc.retrans_timeout = 0;
3228		rfc.monitor_timeout = 0;
3229		rfc.max_pdu_size    = 0;
3230
3231		l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3232				   (unsigned long) &rfc);
3233		break;
3234
3235	case L2CAP_MODE_ERTM:
3236		rfc.mode            = L2CAP_MODE_ERTM;
3237		rfc.max_transmit    = chan->max_tx;
3238
3239		__l2cap_set_ertm_timeouts(chan, &rfc);
3240
3241		size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -
3242			     L2CAP_EXT_HDR_SIZE - L2CAP_SDULEN_SIZE -
3243			     L2CAP_FCS_SIZE);
3244		rfc.max_pdu_size = cpu_to_le16(size);
3245
3246		l2cap_txwin_setup(chan);
3247
3248		rfc.txwin_size = min_t(u16, chan->tx_win,
3249				       L2CAP_DEFAULT_TX_WINDOW);
3250
3251		l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3252				   (unsigned long) &rfc);
3253
3254		if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
3255			l2cap_add_opt_efs(&ptr, chan);
3256
3257		if (test_bit(FLAG_EXT_CTRL, &chan->flags))
3258			l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
3259					   chan->tx_win);
3260
3261		if (chan->conn->feat_mask & L2CAP_FEAT_FCS)
3262			if (chan->fcs == L2CAP_FCS_NONE ||
3263			    test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) {
3264				chan->fcs = L2CAP_FCS_NONE;
3265				l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1,
3266						   chan->fcs);
3267			}
3268		break;
3269
3270	case L2CAP_MODE_STREAMING:
3271		l2cap_txwin_setup(chan);
3272		rfc.mode            = L2CAP_MODE_STREAMING;
3273		rfc.txwin_size      = 0;
3274		rfc.max_transmit    = 0;
3275		rfc.retrans_timeout = 0;
3276		rfc.monitor_timeout = 0;
3277
3278		size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -
3279			     L2CAP_EXT_HDR_SIZE - L2CAP_SDULEN_SIZE -
3280			     L2CAP_FCS_SIZE);
3281		rfc.max_pdu_size = cpu_to_le16(size);
3282
3283		l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3284				   (unsigned long) &rfc);
3285
3286		if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
3287			l2cap_add_opt_efs(&ptr, chan);
3288
3289		if (chan->conn->feat_mask & L2CAP_FEAT_FCS)
3290			if (chan->fcs == L2CAP_FCS_NONE ||
3291			    test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) {
3292				chan->fcs = L2CAP_FCS_NONE;
3293				l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1,
3294						   chan->fcs);
3295			}
3296		break;
3297	}
3298
3299	req->dcid  = cpu_to_le16(chan->dcid);
3300	req->flags = cpu_to_le16(0);
3301
3302	return ptr - data;
3303}
3304
3305static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data)
3306{
3307	struct l2cap_conf_rsp *rsp = data;
3308	void *ptr = rsp->data;
 
3309	void *req = chan->conf_req;
3310	int len = chan->conf_len;
3311	int type, hint, olen;
3312	unsigned long val;
3313	struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
3314	struct l2cap_conf_efs efs;
3315	u8 remote_efs = 0;
3316	u16 mtu = L2CAP_DEFAULT_MTU;
3317	u16 result = L2CAP_CONF_SUCCESS;
3318	u16 size;
3319
3320	BT_DBG("chan %p", chan);
3321
3322	while (len >= L2CAP_CONF_OPT_SIZE) {
3323		len -= l2cap_get_conf_opt(&req, &type, &olen, &val);
 
 
3324
3325		hint  = type & L2CAP_CONF_HINT;
3326		type &= L2CAP_CONF_MASK;
3327
3328		switch (type) {
3329		case L2CAP_CONF_MTU:
 
 
3330			mtu = val;
3331			break;
3332
3333		case L2CAP_CONF_FLUSH_TO:
 
 
3334			chan->flush_to = val;
3335			break;
3336
3337		case L2CAP_CONF_QOS:
3338			break;
3339
3340		case L2CAP_CONF_RFC:
3341			if (olen == sizeof(rfc))
3342				memcpy(&rfc, (void *) val, olen);
 
3343			break;
3344
3345		case L2CAP_CONF_FCS:
 
 
3346			if (val == L2CAP_FCS_NONE)
3347				set_bit(CONF_RECV_NO_FCS, &chan->conf_state);
3348			break;
3349
3350		case L2CAP_CONF_EFS:
 
 
3351			remote_efs = 1;
3352			if (olen == sizeof(efs))
3353				memcpy(&efs, (void *) val, olen);
3354			break;
3355
3356		case L2CAP_CONF_EWS:
3357			if (!(chan->conn->local_fixed_chan & L2CAP_FC_A2MP))
3358				return -ECONNREFUSED;
3359
3360			set_bit(FLAG_EXT_CTRL, &chan->flags);
3361			set_bit(CONF_EWS_RECV, &chan->conf_state);
3362			chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;
3363			chan->remote_tx_win = val;
3364			break;
3365
3366		default:
3367			if (hint)
3368				break;
3369
3370			result = L2CAP_CONF_UNKNOWN;
3371			*((u8 *) ptr++) = type;
3372			break;
3373		}
3374	}
3375
3376	if (chan->num_conf_rsp || chan->num_conf_req > 1)
3377		goto done;
3378
3379	switch (chan->mode) {
3380	case L2CAP_MODE_STREAMING:
3381	case L2CAP_MODE_ERTM:
3382		if (!test_bit(CONF_STATE2_DEVICE, &chan->conf_state)) {
3383			chan->mode = l2cap_select_mode(rfc.mode,
3384						       chan->conn->feat_mask);
3385			break;
3386		}
3387
3388		if (remote_efs) {
3389			if (__l2cap_efs_supported(chan->conn))
3390				set_bit(FLAG_EFS_ENABLE, &chan->flags);
3391			else
3392				return -ECONNREFUSED;
3393		}
3394
3395		if (chan->mode != rfc.mode)
3396			return -ECONNREFUSED;
3397
3398		break;
3399	}
3400
3401done:
3402	if (chan->mode != rfc.mode) {
3403		result = L2CAP_CONF_UNACCEPT;
3404		rfc.mode = chan->mode;
3405
3406		if (chan->num_conf_rsp == 1)
3407			return -ECONNREFUSED;
3408
3409		l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3410				   (unsigned long) &rfc);
3411	}
3412
3413	if (result == L2CAP_CONF_SUCCESS) {
3414		/* Configure output options and let the other side know
3415		 * which ones we don't like. */
3416
3417		if (mtu < L2CAP_DEFAULT_MIN_MTU)
3418			result = L2CAP_CONF_UNACCEPT;
3419		else {
3420			chan->omtu = mtu;
3421			set_bit(CONF_MTU_DONE, &chan->conf_state);
3422		}
3423		l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu);
3424
3425		if (remote_efs) {
3426			if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
3427			    efs.stype != L2CAP_SERV_NOTRAFIC &&
3428			    efs.stype != chan->local_stype) {
3429
3430				result = L2CAP_CONF_UNACCEPT;
3431
3432				if (chan->num_conf_req >= 1)
3433					return -ECONNREFUSED;
3434
3435				l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
3436						   sizeof(efs),
3437						   (unsigned long) &efs);
3438			} else {
3439				/* Send PENDING Conf Rsp */
3440				result = L2CAP_CONF_PENDING;
3441				set_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
3442			}
3443		}
3444
3445		switch (rfc.mode) {
3446		case L2CAP_MODE_BASIC:
3447			chan->fcs = L2CAP_FCS_NONE;
3448			set_bit(CONF_MODE_DONE, &chan->conf_state);
3449			break;
3450
3451		case L2CAP_MODE_ERTM:
3452			if (!test_bit(CONF_EWS_RECV, &chan->conf_state))
3453				chan->remote_tx_win = rfc.txwin_size;
3454			else
3455				rfc.txwin_size = L2CAP_DEFAULT_TX_WINDOW;
3456
3457			chan->remote_max_tx = rfc.max_transmit;
3458
3459			size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
3460				     chan->conn->mtu - L2CAP_EXT_HDR_SIZE -
3461				     L2CAP_SDULEN_SIZE - L2CAP_FCS_SIZE);
3462			rfc.max_pdu_size = cpu_to_le16(size);
3463			chan->remote_mps = size;
3464
3465			__l2cap_set_ertm_timeouts(chan, &rfc);
3466
3467			set_bit(CONF_MODE_DONE, &chan->conf_state);
3468
3469			l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
3470					   sizeof(rfc), (unsigned long) &rfc);
3471
3472			if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
 
3473				chan->remote_id = efs.id;
3474				chan->remote_stype = efs.stype;
3475				chan->remote_msdu = le16_to_cpu(efs.msdu);
3476				chan->remote_flush_to =
3477					le32_to_cpu(efs.flush_to);
3478				chan->remote_acc_lat =
3479					le32_to_cpu(efs.acc_lat);
3480				chan->remote_sdu_itime =
3481					le32_to_cpu(efs.sdu_itime);
3482				l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
3483						   sizeof(efs),
3484						   (unsigned long) &efs);
3485			}
3486			break;
3487
3488		case L2CAP_MODE_STREAMING:
3489			size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
3490				     chan->conn->mtu - L2CAP_EXT_HDR_SIZE -
3491				     L2CAP_SDULEN_SIZE - L2CAP_FCS_SIZE);
3492			rfc.max_pdu_size = cpu_to_le16(size);
3493			chan->remote_mps = size;
3494
3495			set_bit(CONF_MODE_DONE, &chan->conf_state);
3496
3497			l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3498					   (unsigned long) &rfc);
3499
3500			break;
3501
3502		default:
3503			result = L2CAP_CONF_UNACCEPT;
3504
3505			memset(&rfc, 0, sizeof(rfc));
3506			rfc.mode = chan->mode;
3507		}
3508
3509		if (result == L2CAP_CONF_SUCCESS)
3510			set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
3511	}
3512	rsp->scid   = cpu_to_le16(chan->dcid);
3513	rsp->result = cpu_to_le16(result);
3514	rsp->flags  = cpu_to_le16(0);
3515
3516	return ptr - data;
3517}
3518
3519static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,
3520				void *data, u16 *result)
3521{
3522	struct l2cap_conf_req *req = data;
3523	void *ptr = req->data;
 
3524	int type, olen;
3525	unsigned long val;
3526	struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
3527	struct l2cap_conf_efs efs;
3528
3529	BT_DBG("chan %p, rsp %p, len %d, req %p", chan, rsp, len, data);
3530
3531	while (len >= L2CAP_CONF_OPT_SIZE) {
3532		len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
 
 
3533
3534		switch (type) {
3535		case L2CAP_CONF_MTU:
 
 
3536			if (val < L2CAP_DEFAULT_MIN_MTU) {
3537				*result = L2CAP_CONF_UNACCEPT;
3538				chan->imtu = L2CAP_DEFAULT_MIN_MTU;
3539			} else
3540				chan->imtu = val;
3541			l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu);
 
3542			break;
3543
3544		case L2CAP_CONF_FLUSH_TO:
 
 
3545			chan->flush_to = val;
3546			l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO,
3547					   2, chan->flush_to);
3548			break;
3549
3550		case L2CAP_CONF_RFC:
3551			if (olen == sizeof(rfc))
3552				memcpy(&rfc, (void *)val, olen);
3553
3554			if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) &&
3555			    rfc.mode != chan->mode)
3556				return -ECONNREFUSED;
3557
3558			chan->fcs = 0;
3559
3560			l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
3561					   sizeof(rfc), (unsigned long) &rfc);
3562			break;
3563
3564		case L2CAP_CONF_EWS:
 
 
3565			chan->ack_win = min_t(u16, val, chan->ack_win);
3566			l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
3567					   chan->tx_win);
3568			break;
3569
3570		case L2CAP_CONF_EFS:
3571			if (olen == sizeof(efs))
3572				memcpy(&efs, (void *)val, olen);
3573
3574			if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
3575			    efs.stype != L2CAP_SERV_NOTRAFIC &&
3576			    efs.stype != chan->local_stype)
3577				return -ECONNREFUSED;
3578
3579			l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs),
3580					   (unsigned long) &efs);
3581			break;
3582
3583		case L2CAP_CONF_FCS:
 
 
3584			if (*result == L2CAP_CONF_PENDING)
3585				if (val == L2CAP_FCS_NONE)
3586					set_bit(CONF_RECV_NO_FCS,
3587						&chan->conf_state);
3588			break;
3589		}
3590	}
3591
3592	if (chan->mode == L2CAP_MODE_BASIC && chan->mode != rfc.mode)
3593		return -ECONNREFUSED;
3594
3595	chan->mode = rfc.mode;
3596
3597	if (*result == L2CAP_CONF_SUCCESS || *result == L2CAP_CONF_PENDING) {
3598		switch (rfc.mode) {
3599		case L2CAP_MODE_ERTM:
3600			chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
3601			chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
3602			chan->mps    = le16_to_cpu(rfc.max_pdu_size);
3603			if (!test_bit(FLAG_EXT_CTRL, &chan->flags))
3604				chan->ack_win = min_t(u16, chan->ack_win,
3605						      rfc.txwin_size);
3606
3607			if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
3608				chan->local_msdu = le16_to_cpu(efs.msdu);
3609				chan->local_sdu_itime =
3610					le32_to_cpu(efs.sdu_itime);
3611				chan->local_acc_lat = le32_to_cpu(efs.acc_lat);
3612				chan->local_flush_to =
3613					le32_to_cpu(efs.flush_to);
3614			}
3615			break;
3616
3617		case L2CAP_MODE_STREAMING:
3618			chan->mps    = le16_to_cpu(rfc.max_pdu_size);
3619		}
3620	}
3621
3622	req->dcid   = cpu_to_le16(chan->dcid);
3623	req->flags  = cpu_to_le16(0);
3624
3625	return ptr - data;
3626}
3627
3628static int l2cap_build_conf_rsp(struct l2cap_chan *chan, void *data,
3629				u16 result, u16 flags)
3630{
3631	struct l2cap_conf_rsp *rsp = data;
3632	void *ptr = rsp->data;
3633
3634	BT_DBG("chan %p", chan);
3635
3636	rsp->scid   = cpu_to_le16(chan->dcid);
3637	rsp->result = cpu_to_le16(result);
3638	rsp->flags  = cpu_to_le16(flags);
3639
3640	return ptr - data;
3641}
3642
3643void __l2cap_le_connect_rsp_defer(struct l2cap_chan *chan)
3644{
3645	struct l2cap_le_conn_rsp rsp;
3646	struct l2cap_conn *conn = chan->conn;
3647
3648	BT_DBG("chan %p", chan);
3649
3650	rsp.dcid    = cpu_to_le16(chan->scid);
3651	rsp.mtu     = cpu_to_le16(chan->imtu);
3652	rsp.mps     = cpu_to_le16(chan->mps);
3653	rsp.credits = cpu_to_le16(chan->rx_credits);
3654	rsp.result  = cpu_to_le16(L2CAP_CR_SUCCESS);
3655
3656	l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp),
3657		       &rsp);
3658}
3659
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
3660void __l2cap_connect_rsp_defer(struct l2cap_chan *chan)
3661{
3662	struct l2cap_conn_rsp rsp;
3663	struct l2cap_conn *conn = chan->conn;
3664	u8 buf[128];
3665	u8 rsp_code;
3666
3667	rsp.scid   = cpu_to_le16(chan->dcid);
3668	rsp.dcid   = cpu_to_le16(chan->scid);
3669	rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
3670	rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
3671
3672	if (chan->hs_hcon)
3673		rsp_code = L2CAP_CREATE_CHAN_RSP;
3674	else
3675		rsp_code = L2CAP_CONN_RSP;
3676
3677	BT_DBG("chan %p rsp_code %u", chan, rsp_code);
3678
3679	l2cap_send_cmd(conn, chan->ident, rsp_code, sizeof(rsp), &rsp);
3680
3681	if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
3682		return;
3683
3684	l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
3685		       l2cap_build_conf_req(chan, buf), buf);
3686	chan->num_conf_req++;
3687}
3688
3689static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len)
3690{
3691	int type, olen;
3692	unsigned long val;
3693	/* Use sane default values in case a misbehaving remote device
3694	 * did not send an RFC or extended window size option.
3695	 */
3696	u16 txwin_ext = chan->ack_win;
3697	struct l2cap_conf_rfc rfc = {
3698		.mode = chan->mode,
3699		.retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO),
3700		.monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO),
3701		.max_pdu_size = cpu_to_le16(chan->imtu),
3702		.txwin_size = min_t(u16, chan->ack_win, L2CAP_DEFAULT_TX_WINDOW),
3703	};
3704
3705	BT_DBG("chan %p, rsp %p, len %d", chan, rsp, len);
3706
3707	if ((chan->mode != L2CAP_MODE_ERTM) && (chan->mode != L2CAP_MODE_STREAMING))
3708		return;
3709
3710	while (len >= L2CAP_CONF_OPT_SIZE) {
3711		len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
 
 
3712
3713		switch (type) {
3714		case L2CAP_CONF_RFC:
3715			if (olen == sizeof(rfc))
3716				memcpy(&rfc, (void *)val, olen);
 
3717			break;
3718		case L2CAP_CONF_EWS:
 
 
3719			txwin_ext = val;
3720			break;
3721		}
3722	}
3723
3724	switch (rfc.mode) {
3725	case L2CAP_MODE_ERTM:
3726		chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
3727		chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
3728		chan->mps = le16_to_cpu(rfc.max_pdu_size);
3729		if (test_bit(FLAG_EXT_CTRL, &chan->flags))
3730			chan->ack_win = min_t(u16, chan->ack_win, txwin_ext);
3731		else
3732			chan->ack_win = min_t(u16, chan->ack_win,
3733					      rfc.txwin_size);
3734		break;
3735	case L2CAP_MODE_STREAMING:
3736		chan->mps    = le16_to_cpu(rfc.max_pdu_size);
3737	}
3738}
3739
3740static inline int l2cap_command_rej(struct l2cap_conn *conn,
3741				    struct l2cap_cmd_hdr *cmd, u16 cmd_len,
3742				    u8 *data)
3743{
3744	struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data;
3745
3746	if (cmd_len < sizeof(*rej))
3747		return -EPROTO;
3748
3749	if (rej->reason != L2CAP_REJ_NOT_UNDERSTOOD)
3750		return 0;
3751
3752	if ((conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) &&
3753	    cmd->ident == conn->info_ident) {
3754		cancel_delayed_work(&conn->info_timer);
3755
3756		conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
3757		conn->info_ident = 0;
3758
3759		l2cap_conn_start(conn);
3760	}
3761
3762	return 0;
3763}
3764
3765static struct l2cap_chan *l2cap_connect(struct l2cap_conn *conn,
3766					struct l2cap_cmd_hdr *cmd,
3767					u8 *data, u8 rsp_code, u8 amp_id)
3768{
3769	struct l2cap_conn_req *req = (struct l2cap_conn_req *) data;
3770	struct l2cap_conn_rsp rsp;
3771	struct l2cap_chan *chan = NULL, *pchan;
3772	int result, status = L2CAP_CS_NO_INFO;
3773
3774	u16 dcid = 0, scid = __le16_to_cpu(req->scid);
3775	__le16 psm = req->psm;
3776
3777	BT_DBG("psm 0x%2.2x scid 0x%4.4x", __le16_to_cpu(psm), scid);
3778
3779	/* Check if we have socket listening on psm */
3780	pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src,
3781					 &conn->hcon->dst, ACL_LINK);
3782	if (!pchan) {
3783		result = L2CAP_CR_BAD_PSM;
3784		goto sendresp;
3785	}
3786
3787	mutex_lock(&conn->chan_lock);
3788	l2cap_chan_lock(pchan);
3789
3790	/* Check if the ACL is secure enough (if not SDP) */
3791	if (psm != cpu_to_le16(L2CAP_PSM_SDP) &&
3792	    !hci_conn_check_link_mode(conn->hcon)) {
3793		conn->disc_reason = HCI_ERROR_AUTH_FAILURE;
3794		result = L2CAP_CR_SEC_BLOCK;
3795		goto response;
3796	}
3797
3798	result = L2CAP_CR_NO_MEM;
3799
 
 
 
 
 
 
3800	/* Check if we already have channel with that dcid */
3801	if (__l2cap_get_chan_by_dcid(conn, scid))
 
3802		goto response;
 
3803
3804	chan = pchan->ops->new_connection(pchan);
3805	if (!chan)
3806		goto response;
3807
3808	/* For certain devices (ex: HID mouse), support for authentication,
3809	 * pairing and bonding is optional. For such devices, inorder to avoid
3810	 * the ACL alive for too long after L2CAP disconnection, reset the ACL
3811	 * disc_timeout back to HCI_DISCONN_TIMEOUT during L2CAP connect.
3812	 */
3813	conn->hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
3814
3815	bacpy(&chan->src, &conn->hcon->src);
3816	bacpy(&chan->dst, &conn->hcon->dst);
3817	chan->src_type = bdaddr_src_type(conn->hcon);
3818	chan->dst_type = bdaddr_dst_type(conn->hcon);
3819	chan->psm  = psm;
3820	chan->dcid = scid;
3821	chan->local_amp_id = amp_id;
3822
3823	__l2cap_chan_add(conn, chan);
3824
3825	dcid = chan->scid;
3826
3827	__set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
3828
3829	chan->ident = cmd->ident;
3830
3831	if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) {
3832		if (l2cap_chan_check_security(chan, false)) {
3833			if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
3834				l2cap_state_change(chan, BT_CONNECT2);
3835				result = L2CAP_CR_PEND;
3836				status = L2CAP_CS_AUTHOR_PEND;
3837				chan->ops->defer(chan);
3838			} else {
3839				/* Force pending result for AMP controllers.
3840				 * The connection will succeed after the
3841				 * physical link is up.
3842				 */
3843				if (amp_id == AMP_ID_BREDR) {
3844					l2cap_state_change(chan, BT_CONFIG);
3845					result = L2CAP_CR_SUCCESS;
3846				} else {
3847					l2cap_state_change(chan, BT_CONNECT2);
3848					result = L2CAP_CR_PEND;
3849				}
3850				status = L2CAP_CS_NO_INFO;
3851			}
3852		} else {
3853			l2cap_state_change(chan, BT_CONNECT2);
3854			result = L2CAP_CR_PEND;
3855			status = L2CAP_CS_AUTHEN_PEND;
3856		}
3857	} else {
3858		l2cap_state_change(chan, BT_CONNECT2);
3859		result = L2CAP_CR_PEND;
3860		status = L2CAP_CS_NO_INFO;
3861	}
3862
3863response:
3864	l2cap_chan_unlock(pchan);
3865	mutex_unlock(&conn->chan_lock);
3866	l2cap_chan_put(pchan);
3867
3868sendresp:
3869	rsp.scid   = cpu_to_le16(scid);
3870	rsp.dcid   = cpu_to_le16(dcid);
3871	rsp.result = cpu_to_le16(result);
3872	rsp.status = cpu_to_le16(status);
3873	l2cap_send_cmd(conn, cmd->ident, rsp_code, sizeof(rsp), &rsp);
3874
 
 
 
3875	if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) {
3876		struct l2cap_info_req info;
3877		info.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
3878
3879		conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
3880		conn->info_ident = l2cap_get_ident(conn);
3881
3882		schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
3883
3884		l2cap_send_cmd(conn, conn->info_ident, L2CAP_INFO_REQ,
3885			       sizeof(info), &info);
3886	}
3887
3888	if (chan && !test_bit(CONF_REQ_SENT, &chan->conf_state) &&
3889	    result == L2CAP_CR_SUCCESS) {
3890		u8 buf[128];
3891		set_bit(CONF_REQ_SENT, &chan->conf_state);
3892		l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
3893			       l2cap_build_conf_req(chan, buf), buf);
3894		chan->num_conf_req++;
3895	}
3896
3897	return chan;
 
 
3898}
3899
3900static int l2cap_connect_req(struct l2cap_conn *conn,
3901			     struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
3902{
3903	struct hci_dev *hdev = conn->hcon->hdev;
3904	struct hci_conn *hcon = conn->hcon;
3905
3906	if (cmd_len < sizeof(struct l2cap_conn_req))
3907		return -EPROTO;
3908
3909	hci_dev_lock(hdev);
3910	if (hci_dev_test_flag(hdev, HCI_MGMT) &&
3911	    !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &hcon->flags))
3912		mgmt_device_connected(hdev, hcon, 0, NULL, 0);
3913	hci_dev_unlock(hdev);
3914
3915	l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP, 0);
3916	return 0;
3917}
3918
3919static int l2cap_connect_create_rsp(struct l2cap_conn *conn,
3920				    struct l2cap_cmd_hdr *cmd, u16 cmd_len,
3921				    u8 *data)
3922{
3923	struct l2cap_conn_rsp *rsp = (struct l2cap_conn_rsp *) data;
3924	u16 scid, dcid, result, status;
3925	struct l2cap_chan *chan;
3926	u8 req[128];
3927	int err;
3928
3929	if (cmd_len < sizeof(*rsp))
3930		return -EPROTO;
3931
3932	scid   = __le16_to_cpu(rsp->scid);
3933	dcid   = __le16_to_cpu(rsp->dcid);
3934	result = __le16_to_cpu(rsp->result);
3935	status = __le16_to_cpu(rsp->status);
3936
 
 
 
 
3937	BT_DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x",
3938	       dcid, scid, result, status);
3939
3940	mutex_lock(&conn->chan_lock);
3941
3942	if (scid) {
3943		chan = __l2cap_get_chan_by_scid(conn, scid);
3944		if (!chan) {
3945			err = -EBADSLT;
3946			goto unlock;
3947		}
3948	} else {
3949		chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
3950		if (!chan) {
3951			err = -EBADSLT;
3952			goto unlock;
3953		}
3954	}
3955
 
 
 
 
 
 
3956	err = 0;
3957
3958	l2cap_chan_lock(chan);
3959
3960	switch (result) {
3961	case L2CAP_CR_SUCCESS:
 
 
 
 
 
3962		l2cap_state_change(chan, BT_CONFIG);
3963		chan->ident = 0;
3964		chan->dcid = dcid;
3965		clear_bit(CONF_CONNECT_PEND, &chan->conf_state);
3966
3967		if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
3968			break;
3969
3970		l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
3971			       l2cap_build_conf_req(chan, req), req);
3972		chan->num_conf_req++;
3973		break;
3974
3975	case L2CAP_CR_PEND:
3976		set_bit(CONF_CONNECT_PEND, &chan->conf_state);
3977		break;
3978
3979	default:
3980		l2cap_chan_del(chan, ECONNREFUSED);
3981		break;
3982	}
3983
3984	l2cap_chan_unlock(chan);
 
3985
3986unlock:
3987	mutex_unlock(&conn->chan_lock);
3988
3989	return err;
3990}
3991
3992static inline void set_default_fcs(struct l2cap_chan *chan)
3993{
3994	/* FCS is enabled only in ERTM or streaming mode, if one or both
3995	 * sides request it.
3996	 */
3997	if (chan->mode != L2CAP_MODE_ERTM && chan->mode != L2CAP_MODE_STREAMING)
3998		chan->fcs = L2CAP_FCS_NONE;
3999	else if (!test_bit(CONF_RECV_NO_FCS, &chan->conf_state))
4000		chan->fcs = L2CAP_FCS_CRC16;
4001}
4002
4003static void l2cap_send_efs_conf_rsp(struct l2cap_chan *chan, void *data,
4004				    u8 ident, u16 flags)
4005{
4006	struct l2cap_conn *conn = chan->conn;
4007
4008	BT_DBG("conn %p chan %p ident %d flags 0x%4.4x", conn, chan, ident,
4009	       flags);
4010
4011	clear_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
4012	set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
4013
4014	l2cap_send_cmd(conn, ident, L2CAP_CONF_RSP,
4015		       l2cap_build_conf_rsp(chan, data,
4016					    L2CAP_CONF_SUCCESS, flags), data);
4017}
4018
4019static void cmd_reject_invalid_cid(struct l2cap_conn *conn, u8 ident,
4020				   u16 scid, u16 dcid)
4021{
4022	struct l2cap_cmd_rej_cid rej;
4023
4024	rej.reason = cpu_to_le16(L2CAP_REJ_INVALID_CID);
4025	rej.scid = __cpu_to_le16(scid);
4026	rej.dcid = __cpu_to_le16(dcid);
4027
4028	l2cap_send_cmd(conn, ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej);
4029}
4030
4031static inline int l2cap_config_req(struct l2cap_conn *conn,
4032				   struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4033				   u8 *data)
4034{
4035	struct l2cap_conf_req *req = (struct l2cap_conf_req *) data;
4036	u16 dcid, flags;
4037	u8 rsp[64];
4038	struct l2cap_chan *chan;
4039	int len, err = 0;
4040
4041	if (cmd_len < sizeof(*req))
4042		return -EPROTO;
4043
4044	dcid  = __le16_to_cpu(req->dcid);
4045	flags = __le16_to_cpu(req->flags);
4046
4047	BT_DBG("dcid 0x%4.4x flags 0x%2.2x", dcid, flags);
4048
4049	chan = l2cap_get_chan_by_scid(conn, dcid);
4050	if (!chan) {
4051		cmd_reject_invalid_cid(conn, cmd->ident, dcid, 0);
4052		return 0;
4053	}
4054
4055	if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2) {
 
4056		cmd_reject_invalid_cid(conn, cmd->ident, chan->scid,
4057				       chan->dcid);
4058		goto unlock;
4059	}
4060
4061	/* Reject if config buffer is too small. */
4062	len = cmd_len - sizeof(*req);
4063	if (chan->conf_len + len > sizeof(chan->conf_req)) {
4064		l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
4065			       l2cap_build_conf_rsp(chan, rsp,
4066			       L2CAP_CONF_REJECT, flags), rsp);
4067		goto unlock;
4068	}
4069
4070	/* Store config. */
4071	memcpy(chan->conf_req + chan->conf_len, req->data, len);
4072	chan->conf_len += len;
4073
4074	if (flags & L2CAP_CONF_FLAG_CONTINUATION) {
4075		/* Incomplete config. Send empty response. */
4076		l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
4077			       l2cap_build_conf_rsp(chan, rsp,
4078			       L2CAP_CONF_SUCCESS, flags), rsp);
4079		goto unlock;
4080	}
4081
4082	/* Complete config. */
4083	len = l2cap_parse_conf_req(chan, rsp);
4084	if (len < 0) {
4085		l2cap_send_disconn_req(chan, ECONNRESET);
4086		goto unlock;
4087	}
4088
4089	chan->ident = cmd->ident;
4090	l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp);
4091	chan->num_conf_rsp++;
 
4092
4093	/* Reset config buffer. */
4094	chan->conf_len = 0;
4095
4096	if (!test_bit(CONF_OUTPUT_DONE, &chan->conf_state))
4097		goto unlock;
4098
4099	if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {
4100		set_default_fcs(chan);
4101
4102		if (chan->mode == L2CAP_MODE_ERTM ||
4103		    chan->mode == L2CAP_MODE_STREAMING)
4104			err = l2cap_ertm_init(chan);
4105
4106		if (err < 0)
4107			l2cap_send_disconn_req(chan, -err);
4108		else
4109			l2cap_chan_ready(chan);
4110
4111		goto unlock;
4112	}
4113
4114	if (!test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) {
4115		u8 buf[64];
4116		l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
4117			       l2cap_build_conf_req(chan, buf), buf);
4118		chan->num_conf_req++;
4119	}
4120
4121	/* Got Conf Rsp PENDING from remote side and assume we sent
4122	   Conf Rsp PENDING in the code above */
4123	if (test_bit(CONF_REM_CONF_PEND, &chan->conf_state) &&
4124	    test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
4125
4126		/* check compatibility */
4127
4128		/* Send rsp for BR/EDR channel */
4129		if (!chan->hs_hcon)
4130			l2cap_send_efs_conf_rsp(chan, rsp, cmd->ident, flags);
4131		else
4132			chan->ident = cmd->ident;
4133	}
4134
4135unlock:
4136	l2cap_chan_unlock(chan);
 
4137	return err;
4138}
4139
4140static inline int l2cap_config_rsp(struct l2cap_conn *conn,
4141				   struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4142				   u8 *data)
4143{
4144	struct l2cap_conf_rsp *rsp = (struct l2cap_conf_rsp *)data;
4145	u16 scid, flags, result;
4146	struct l2cap_chan *chan;
4147	int len = cmd_len - sizeof(*rsp);
4148	int err = 0;
4149
4150	if (cmd_len < sizeof(*rsp))
4151		return -EPROTO;
4152
4153	scid   = __le16_to_cpu(rsp->scid);
4154	flags  = __le16_to_cpu(rsp->flags);
4155	result = __le16_to_cpu(rsp->result);
4156
4157	BT_DBG("scid 0x%4.4x flags 0x%2.2x result 0x%2.2x len %d", scid, flags,
4158	       result, len);
4159
4160	chan = l2cap_get_chan_by_scid(conn, scid);
4161	if (!chan)
4162		return 0;
4163
4164	switch (result) {
4165	case L2CAP_CONF_SUCCESS:
4166		l2cap_conf_rfc_get(chan, rsp->data, len);
4167		clear_bit(CONF_REM_CONF_PEND, &chan->conf_state);
4168		break;
4169
4170	case L2CAP_CONF_PENDING:
4171		set_bit(CONF_REM_CONF_PEND, &chan->conf_state);
4172
4173		if (test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
4174			char buf[64];
4175
4176			len = l2cap_parse_conf_rsp(chan, rsp->data, len,
4177						   buf, &result);
4178			if (len < 0) {
4179				l2cap_send_disconn_req(chan, ECONNRESET);
4180				goto done;
4181			}
4182
4183			if (!chan->hs_hcon) {
4184				l2cap_send_efs_conf_rsp(chan, buf, cmd->ident,
4185							0);
4186			} else {
4187				if (l2cap_check_efs(chan)) {
4188					amp_create_logical_link(chan);
4189					chan->ident = cmd->ident;
4190				}
4191			}
4192		}
4193		goto done;
4194
 
4195	case L2CAP_CONF_UNACCEPT:
4196		if (chan->num_conf_rsp <= L2CAP_CONF_MAX_CONF_RSP) {
4197			char req[64];
4198
4199			if (len > sizeof(req) - sizeof(struct l2cap_conf_req)) {
4200				l2cap_send_disconn_req(chan, ECONNRESET);
4201				goto done;
4202			}
4203
4204			/* throw out any old stored conf requests */
4205			result = L2CAP_CONF_SUCCESS;
4206			len = l2cap_parse_conf_rsp(chan, rsp->data, len,
4207						   req, &result);
4208			if (len < 0) {
4209				l2cap_send_disconn_req(chan, ECONNRESET);
4210				goto done;
4211			}
4212
4213			l2cap_send_cmd(conn, l2cap_get_ident(conn),
4214				       L2CAP_CONF_REQ, len, req);
4215			chan->num_conf_req++;
4216			if (result != L2CAP_CONF_SUCCESS)
4217				goto done;
4218			break;
4219		}
 
4220
4221	default:
4222		l2cap_chan_set_err(chan, ECONNRESET);
4223
4224		__set_chan_timer(chan, L2CAP_DISC_REJ_TIMEOUT);
4225		l2cap_send_disconn_req(chan, ECONNRESET);
4226		goto done;
4227	}
4228
4229	if (flags & L2CAP_CONF_FLAG_CONTINUATION)
4230		goto done;
4231
4232	set_bit(CONF_INPUT_DONE, &chan->conf_state);
4233
4234	if (test_bit(CONF_OUTPUT_DONE, &chan->conf_state)) {
4235		set_default_fcs(chan);
4236
4237		if (chan->mode == L2CAP_MODE_ERTM ||
4238		    chan->mode == L2CAP_MODE_STREAMING)
4239			err = l2cap_ertm_init(chan);
4240
4241		if (err < 0)
4242			l2cap_send_disconn_req(chan, -err);
4243		else
4244			l2cap_chan_ready(chan);
4245	}
4246
4247done:
4248	l2cap_chan_unlock(chan);
 
4249	return err;
4250}
4251
4252static inline int l2cap_disconnect_req(struct l2cap_conn *conn,
4253				       struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4254				       u8 *data)
4255{
4256	struct l2cap_disconn_req *req = (struct l2cap_disconn_req *) data;
4257	struct l2cap_disconn_rsp rsp;
4258	u16 dcid, scid;
4259	struct l2cap_chan *chan;
4260
4261	if (cmd_len != sizeof(*req))
4262		return -EPROTO;
4263
4264	scid = __le16_to_cpu(req->scid);
4265	dcid = __le16_to_cpu(req->dcid);
4266
4267	BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid);
4268
4269	mutex_lock(&conn->chan_lock);
4270
4271	chan = __l2cap_get_chan_by_scid(conn, dcid);
4272	if (!chan) {
4273		mutex_unlock(&conn->chan_lock);
4274		cmd_reject_invalid_cid(conn, cmd->ident, dcid, scid);
4275		return 0;
4276	}
4277
4278	l2cap_chan_lock(chan);
4279
4280	rsp.dcid = cpu_to_le16(chan->scid);
4281	rsp.scid = cpu_to_le16(chan->dcid);
4282	l2cap_send_cmd(conn, cmd->ident, L2CAP_DISCONN_RSP, sizeof(rsp), &rsp);
4283
4284	chan->ops->set_shutdown(chan);
4285
4286	l2cap_chan_hold(chan);
4287	l2cap_chan_del(chan, ECONNRESET);
4288
4289	l2cap_chan_unlock(chan);
 
 
 
 
4290
4291	chan->ops->close(chan);
4292	l2cap_chan_put(chan);
4293
4294	mutex_unlock(&conn->chan_lock);
 
4295
4296	return 0;
4297}
4298
4299static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn,
4300				       struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4301				       u8 *data)
4302{
4303	struct l2cap_disconn_rsp *rsp = (struct l2cap_disconn_rsp *) data;
4304	u16 dcid, scid;
4305	struct l2cap_chan *chan;
4306
4307	if (cmd_len != sizeof(*rsp))
4308		return -EPROTO;
4309
4310	scid = __le16_to_cpu(rsp->scid);
4311	dcid = __le16_to_cpu(rsp->dcid);
4312
4313	BT_DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid);
4314
4315	mutex_lock(&conn->chan_lock);
4316
4317	chan = __l2cap_get_chan_by_scid(conn, scid);
4318	if (!chan) {
4319		mutex_unlock(&conn->chan_lock);
4320		return 0;
4321	}
4322
4323	l2cap_chan_lock(chan);
4324
4325	l2cap_chan_hold(chan);
4326	l2cap_chan_del(chan, 0);
 
4327
4328	l2cap_chan_unlock(chan);
 
 
 
 
4329
4330	chan->ops->close(chan);
4331	l2cap_chan_put(chan);
4332
4333	mutex_unlock(&conn->chan_lock);
 
4334
4335	return 0;
4336}
4337
4338static inline int l2cap_information_req(struct l2cap_conn *conn,
4339					struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4340					u8 *data)
4341{
4342	struct l2cap_info_req *req = (struct l2cap_info_req *) data;
4343	u16 type;
4344
4345	if (cmd_len != sizeof(*req))
4346		return -EPROTO;
4347
4348	type = __le16_to_cpu(req->type);
4349
4350	BT_DBG("type 0x%4.4x", type);
4351
4352	if (type == L2CAP_IT_FEAT_MASK) {
4353		u8 buf[8];
4354		u32 feat_mask = l2cap_feat_mask;
4355		struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
4356		rsp->type   = cpu_to_le16(L2CAP_IT_FEAT_MASK);
4357		rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
4358		if (!disable_ertm)
4359			feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING
4360				| L2CAP_FEAT_FCS;
4361		if (conn->local_fixed_chan & L2CAP_FC_A2MP)
4362			feat_mask |= L2CAP_FEAT_EXT_FLOW
4363				| L2CAP_FEAT_EXT_WINDOW;
4364
4365		put_unaligned_le32(feat_mask, rsp->data);
4366		l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(buf),
4367			       buf);
4368	} else if (type == L2CAP_IT_FIXED_CHAN) {
4369		u8 buf[12];
4370		struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
4371
4372		rsp->type   = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
4373		rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
4374		rsp->data[0] = conn->local_fixed_chan;
4375		memset(rsp->data + 1, 0, 7);
4376		l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(buf),
4377			       buf);
4378	} else {
4379		struct l2cap_info_rsp rsp;
4380		rsp.type   = cpu_to_le16(type);
4381		rsp.result = cpu_to_le16(L2CAP_IR_NOTSUPP);
4382		l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(rsp),
4383			       &rsp);
4384	}
4385
4386	return 0;
4387}
4388
4389static inline int l2cap_information_rsp(struct l2cap_conn *conn,
4390					struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4391					u8 *data)
4392{
4393	struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data;
4394	u16 type, result;
4395
4396	if (cmd_len < sizeof(*rsp))
4397		return -EPROTO;
4398
4399	type   = __le16_to_cpu(rsp->type);
4400	result = __le16_to_cpu(rsp->result);
4401
4402	BT_DBG("type 0x%4.4x result 0x%2.2x", type, result);
4403
4404	/* L2CAP Info req/rsp are unbound to channels, add extra checks */
4405	if (cmd->ident != conn->info_ident ||
4406	    conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)
4407		return 0;
4408
4409	cancel_delayed_work(&conn->info_timer);
4410
4411	if (result != L2CAP_IR_SUCCESS) {
4412		conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
4413		conn->info_ident = 0;
4414
4415		l2cap_conn_start(conn);
4416
4417		return 0;
4418	}
4419
4420	switch (type) {
4421	case L2CAP_IT_FEAT_MASK:
4422		conn->feat_mask = get_unaligned_le32(rsp->data);
4423
4424		if (conn->feat_mask & L2CAP_FEAT_FIXED_CHAN) {
4425			struct l2cap_info_req req;
4426			req.type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
4427
4428			conn->info_ident = l2cap_get_ident(conn);
4429
4430			l2cap_send_cmd(conn, conn->info_ident,
4431				       L2CAP_INFO_REQ, sizeof(req), &req);
4432		} else {
4433			conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
4434			conn->info_ident = 0;
4435
4436			l2cap_conn_start(conn);
4437		}
4438		break;
4439
4440	case L2CAP_IT_FIXED_CHAN:
4441		conn->remote_fixed_chan = rsp->data[0];
4442		conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
4443		conn->info_ident = 0;
4444
4445		l2cap_conn_start(conn);
4446		break;
4447	}
4448
4449	return 0;
4450}
4451
4452static int l2cap_create_channel_req(struct l2cap_conn *conn,
4453				    struct l2cap_cmd_hdr *cmd,
4454				    u16 cmd_len, void *data)
4455{
4456	struct l2cap_create_chan_req *req = data;
4457	struct l2cap_create_chan_rsp rsp;
4458	struct l2cap_chan *chan;
4459	struct hci_dev *hdev;
4460	u16 psm, scid;
4461
4462	if (cmd_len != sizeof(*req))
4463		return -EPROTO;
4464
4465	if (!(conn->local_fixed_chan & L2CAP_FC_A2MP))
4466		return -EINVAL;
4467
4468	psm = le16_to_cpu(req->psm);
4469	scid = le16_to_cpu(req->scid);
4470
4471	BT_DBG("psm 0x%2.2x, scid 0x%4.4x, amp_id %d", psm, scid, req->amp_id);
4472
4473	/* For controller id 0 make BR/EDR connection */
4474	if (req->amp_id == AMP_ID_BREDR) {
4475		l2cap_connect(conn, cmd, data, L2CAP_CREATE_CHAN_RSP,
4476			      req->amp_id);
4477		return 0;
4478	}
4479
4480	/* Validate AMP controller id */
4481	hdev = hci_dev_get(req->amp_id);
4482	if (!hdev)
4483		goto error;
4484
4485	if (hdev->dev_type != HCI_AMP || !test_bit(HCI_UP, &hdev->flags)) {
4486		hci_dev_put(hdev);
4487		goto error;
4488	}
4489
4490	chan = l2cap_connect(conn, cmd, data, L2CAP_CREATE_CHAN_RSP,
4491			     req->amp_id);
4492	if (chan) {
4493		struct amp_mgr *mgr = conn->hcon->amp_mgr;
4494		struct hci_conn *hs_hcon;
4495
4496		hs_hcon = hci_conn_hash_lookup_ba(hdev, AMP_LINK,
4497						  &conn->hcon->dst);
4498		if (!hs_hcon) {
4499			hci_dev_put(hdev);
4500			cmd_reject_invalid_cid(conn, cmd->ident, chan->scid,
4501					       chan->dcid);
4502			return 0;
4503		}
4504
4505		BT_DBG("mgr %p bredr_chan %p hs_hcon %p", mgr, chan, hs_hcon);
4506
4507		mgr->bredr_chan = chan;
4508		chan->hs_hcon = hs_hcon;
4509		chan->fcs = L2CAP_FCS_NONE;
4510		conn->mtu = hdev->block_mtu;
4511	}
4512
4513	hci_dev_put(hdev);
4514
4515	return 0;
4516
4517error:
4518	rsp.dcid = 0;
4519	rsp.scid = cpu_to_le16(scid);
4520	rsp.result = cpu_to_le16(L2CAP_CR_BAD_AMP);
4521	rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
4522
4523	l2cap_send_cmd(conn, cmd->ident, L2CAP_CREATE_CHAN_RSP,
4524		       sizeof(rsp), &rsp);
4525
4526	return 0;
4527}
4528
4529static void l2cap_send_move_chan_req(struct l2cap_chan *chan, u8 dest_amp_id)
4530{
4531	struct l2cap_move_chan_req req;
4532	u8 ident;
4533
4534	BT_DBG("chan %p, dest_amp_id %d", chan, dest_amp_id);
4535
4536	ident = l2cap_get_ident(chan->conn);
4537	chan->ident = ident;
4538
4539	req.icid = cpu_to_le16(chan->scid);
4540	req.dest_amp_id = dest_amp_id;
4541
4542	l2cap_send_cmd(chan->conn, ident, L2CAP_MOVE_CHAN_REQ, sizeof(req),
4543		       &req);
4544
4545	__set_chan_timer(chan, L2CAP_MOVE_TIMEOUT);
4546}
4547
4548static void l2cap_send_move_chan_rsp(struct l2cap_chan *chan, u16 result)
4549{
4550	struct l2cap_move_chan_rsp rsp;
4551
4552	BT_DBG("chan %p, result 0x%4.4x", chan, result);
4553
4554	rsp.icid = cpu_to_le16(chan->dcid);
4555	rsp.result = cpu_to_le16(result);
4556
4557	l2cap_send_cmd(chan->conn, chan->ident, L2CAP_MOVE_CHAN_RSP,
4558		       sizeof(rsp), &rsp);
4559}
4560
4561static void l2cap_send_move_chan_cfm(struct l2cap_chan *chan, u16 result)
4562{
4563	struct l2cap_move_chan_cfm cfm;
4564
4565	BT_DBG("chan %p, result 0x%4.4x", chan, result);
4566
4567	chan->ident = l2cap_get_ident(chan->conn);
4568
4569	cfm.icid = cpu_to_le16(chan->scid);
4570	cfm.result = cpu_to_le16(result);
4571
4572	l2cap_send_cmd(chan->conn, chan->ident, L2CAP_MOVE_CHAN_CFM,
4573		       sizeof(cfm), &cfm);
4574
4575	__set_chan_timer(chan, L2CAP_MOVE_TIMEOUT);
4576}
4577
4578static void l2cap_send_move_chan_cfm_icid(struct l2cap_conn *conn, u16 icid)
4579{
4580	struct l2cap_move_chan_cfm cfm;
4581
4582	BT_DBG("conn %p, icid 0x%4.4x", conn, icid);
4583
4584	cfm.icid = cpu_to_le16(icid);
4585	cfm.result = cpu_to_le16(L2CAP_MC_UNCONFIRMED);
4586
4587	l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_MOVE_CHAN_CFM,
4588		       sizeof(cfm), &cfm);
4589}
4590
4591static void l2cap_send_move_chan_cfm_rsp(struct l2cap_conn *conn, u8 ident,
4592					 u16 icid)
4593{
4594	struct l2cap_move_chan_cfm_rsp rsp;
4595
4596	BT_DBG("icid 0x%4.4x", icid);
4597
4598	rsp.icid = cpu_to_le16(icid);
4599	l2cap_send_cmd(conn, ident, L2CAP_MOVE_CHAN_CFM_RSP, sizeof(rsp), &rsp);
4600}
4601
4602static void __release_logical_link(struct l2cap_chan *chan)
4603{
4604	chan->hs_hchan = NULL;
4605	chan->hs_hcon = NULL;
4606
4607	/* Placeholder - release the logical link */
4608}
4609
4610static void l2cap_logical_fail(struct l2cap_chan *chan)
4611{
4612	/* Logical link setup failed */
4613	if (chan->state != BT_CONNECTED) {
4614		/* Create channel failure, disconnect */
4615		l2cap_send_disconn_req(chan, ECONNRESET);
4616		return;
4617	}
4618
4619	switch (chan->move_role) {
4620	case L2CAP_MOVE_ROLE_RESPONDER:
4621		l2cap_move_done(chan);
4622		l2cap_send_move_chan_rsp(chan, L2CAP_MR_NOT_SUPP);
4623		break;
4624	case L2CAP_MOVE_ROLE_INITIATOR:
4625		if (chan->move_state == L2CAP_MOVE_WAIT_LOGICAL_COMP ||
4626		    chan->move_state == L2CAP_MOVE_WAIT_LOGICAL_CFM) {
4627			/* Remote has only sent pending or
4628			 * success responses, clean up
4629			 */
4630			l2cap_move_done(chan);
4631		}
4632
4633		/* Other amp move states imply that the move
4634		 * has already aborted
4635		 */
4636		l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);
4637		break;
4638	}
4639}
4640
4641static void l2cap_logical_finish_create(struct l2cap_chan *chan,
4642					struct hci_chan *hchan)
4643{
4644	struct l2cap_conf_rsp rsp;
4645
4646	chan->hs_hchan = hchan;
4647	chan->hs_hcon->l2cap_data = chan->conn;
4648
4649	l2cap_send_efs_conf_rsp(chan, &rsp, chan->ident, 0);
4650
4651	if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {
4652		int err;
4653
4654		set_default_fcs(chan);
4655
4656		err = l2cap_ertm_init(chan);
4657		if (err < 0)
4658			l2cap_send_disconn_req(chan, -err);
4659		else
4660			l2cap_chan_ready(chan);
4661	}
4662}
4663
4664static void l2cap_logical_finish_move(struct l2cap_chan *chan,
4665				      struct hci_chan *hchan)
4666{
4667	chan->hs_hcon = hchan->conn;
4668	chan->hs_hcon->l2cap_data = chan->conn;
4669
4670	BT_DBG("move_state %d", chan->move_state);
4671
4672	switch (chan->move_state) {
4673	case L2CAP_MOVE_WAIT_LOGICAL_COMP:
4674		/* Move confirm will be sent after a success
4675		 * response is received
4676		 */
4677		chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;
4678		break;
4679	case L2CAP_MOVE_WAIT_LOGICAL_CFM:
4680		if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
4681			chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;
4682		} else if (chan->move_role == L2CAP_MOVE_ROLE_INITIATOR) {
4683			chan->move_state = L2CAP_MOVE_WAIT_CONFIRM_RSP;
4684			l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);
4685		} else if (chan->move_role == L2CAP_MOVE_ROLE_RESPONDER) {
4686			chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;
4687			l2cap_send_move_chan_rsp(chan, L2CAP_MR_SUCCESS);
4688		}
4689		break;
4690	default:
4691		/* Move was not in expected state, free the channel */
4692		__release_logical_link(chan);
4693
4694		chan->move_state = L2CAP_MOVE_STABLE;
4695	}
4696}
4697
4698/* Call with chan locked */
4699void l2cap_logical_cfm(struct l2cap_chan *chan, struct hci_chan *hchan,
4700		       u8 status)
4701{
4702	BT_DBG("chan %p, hchan %p, status %d", chan, hchan, status);
4703
4704	if (status) {
4705		l2cap_logical_fail(chan);
4706		__release_logical_link(chan);
4707		return;
4708	}
4709
4710	if (chan->state != BT_CONNECTED) {
4711		/* Ignore logical link if channel is on BR/EDR */
4712		if (chan->local_amp_id != AMP_ID_BREDR)
4713			l2cap_logical_finish_create(chan, hchan);
4714	} else {
4715		l2cap_logical_finish_move(chan, hchan);
4716	}
4717}
4718
4719void l2cap_move_start(struct l2cap_chan *chan)
4720{
4721	BT_DBG("chan %p", chan);
4722
4723	if (chan->local_amp_id == AMP_ID_BREDR) {
4724		if (chan->chan_policy != BT_CHANNEL_POLICY_AMP_PREFERRED)
4725			return;
4726		chan->move_role = L2CAP_MOVE_ROLE_INITIATOR;
4727		chan->move_state = L2CAP_MOVE_WAIT_PREPARE;
4728		/* Placeholder - start physical link setup */
4729	} else {
4730		chan->move_role = L2CAP_MOVE_ROLE_INITIATOR;
4731		chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;
4732		chan->move_id = 0;
4733		l2cap_move_setup(chan);
4734		l2cap_send_move_chan_req(chan, 0);
4735	}
4736}
4737
4738static void l2cap_do_create(struct l2cap_chan *chan, int result,
4739			    u8 local_amp_id, u8 remote_amp_id)
4740{
4741	BT_DBG("chan %p state %s %u -> %u", chan, state_to_string(chan->state),
4742	       local_amp_id, remote_amp_id);
4743
4744	chan->fcs = L2CAP_FCS_NONE;
4745
4746	/* Outgoing channel on AMP */
4747	if (chan->state == BT_CONNECT) {
4748		if (result == L2CAP_CR_SUCCESS) {
4749			chan->local_amp_id = local_amp_id;
4750			l2cap_send_create_chan_req(chan, remote_amp_id);
4751		} else {
4752			/* Revert to BR/EDR connect */
4753			l2cap_send_conn_req(chan);
4754		}
4755
4756		return;
4757	}
4758
4759	/* Incoming channel on AMP */
4760	if (__l2cap_no_conn_pending(chan)) {
4761		struct l2cap_conn_rsp rsp;
4762		char buf[128];
4763		rsp.scid = cpu_to_le16(chan->dcid);
4764		rsp.dcid = cpu_to_le16(chan->scid);
4765
4766		if (result == L2CAP_CR_SUCCESS) {
4767			/* Send successful response */
4768			rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
4769			rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
4770		} else {
4771			/* Send negative response */
4772			rsp.result = cpu_to_le16(L2CAP_CR_NO_MEM);
4773			rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
4774		}
4775
4776		l2cap_send_cmd(chan->conn, chan->ident, L2CAP_CREATE_CHAN_RSP,
4777			       sizeof(rsp), &rsp);
4778
4779		if (result == L2CAP_CR_SUCCESS) {
4780			l2cap_state_change(chan, BT_CONFIG);
4781			set_bit(CONF_REQ_SENT, &chan->conf_state);
4782			l2cap_send_cmd(chan->conn, l2cap_get_ident(chan->conn),
4783				       L2CAP_CONF_REQ,
4784				       l2cap_build_conf_req(chan, buf), buf);
4785			chan->num_conf_req++;
4786		}
4787	}
4788}
4789
4790static void l2cap_do_move_initiate(struct l2cap_chan *chan, u8 local_amp_id,
4791				   u8 remote_amp_id)
4792{
4793	l2cap_move_setup(chan);
4794	chan->move_id = local_amp_id;
4795	chan->move_state = L2CAP_MOVE_WAIT_RSP;
4796
4797	l2cap_send_move_chan_req(chan, remote_amp_id);
4798}
4799
4800static void l2cap_do_move_respond(struct l2cap_chan *chan, int result)
4801{
4802	struct hci_chan *hchan = NULL;
4803
4804	/* Placeholder - get hci_chan for logical link */
4805
4806	if (hchan) {
4807		if (hchan->state == BT_CONNECTED) {
4808			/* Logical link is ready to go */
4809			chan->hs_hcon = hchan->conn;
4810			chan->hs_hcon->l2cap_data = chan->conn;
4811			chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;
4812			l2cap_send_move_chan_rsp(chan, L2CAP_MR_SUCCESS);
4813
4814			l2cap_logical_cfm(chan, hchan, L2CAP_MR_SUCCESS);
4815		} else {
4816			/* Wait for logical link to be ready */
4817			chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;
4818		}
4819	} else {
4820		/* Logical link not available */
4821		l2cap_send_move_chan_rsp(chan, L2CAP_MR_NOT_ALLOWED);
4822	}
4823}
4824
4825static void l2cap_do_move_cancel(struct l2cap_chan *chan, int result)
4826{
4827	if (chan->move_role == L2CAP_MOVE_ROLE_RESPONDER) {
4828		u8 rsp_result;
4829		if (result == -EINVAL)
4830			rsp_result = L2CAP_MR_BAD_ID;
4831		else
4832			rsp_result = L2CAP_MR_NOT_ALLOWED;
4833
4834		l2cap_send_move_chan_rsp(chan, rsp_result);
4835	}
4836
4837	chan->move_role = L2CAP_MOVE_ROLE_NONE;
4838	chan->move_state = L2CAP_MOVE_STABLE;
4839
4840	/* Restart data transmission */
4841	l2cap_ertm_send(chan);
4842}
4843
4844/* Invoke with locked chan */
4845void __l2cap_physical_cfm(struct l2cap_chan *chan, int result)
4846{
4847	u8 local_amp_id = chan->local_amp_id;
4848	u8 remote_amp_id = chan->remote_amp_id;
4849
4850	BT_DBG("chan %p, result %d, local_amp_id %d, remote_amp_id %d",
4851	       chan, result, local_amp_id, remote_amp_id);
4852
4853	if (chan->state == BT_DISCONN || chan->state == BT_CLOSED) {
4854		l2cap_chan_unlock(chan);
4855		return;
4856	}
4857
4858	if (chan->state != BT_CONNECTED) {
4859		l2cap_do_create(chan, result, local_amp_id, remote_amp_id);
4860	} else if (result != L2CAP_MR_SUCCESS) {
4861		l2cap_do_move_cancel(chan, result);
4862	} else {
4863		switch (chan->move_role) {
4864		case L2CAP_MOVE_ROLE_INITIATOR:
4865			l2cap_do_move_initiate(chan, local_amp_id,
4866					       remote_amp_id);
4867			break;
4868		case L2CAP_MOVE_ROLE_RESPONDER:
4869			l2cap_do_move_respond(chan, result);
4870			break;
4871		default:
4872			l2cap_do_move_cancel(chan, result);
4873			break;
4874		}
4875	}
4876}
4877
4878static inline int l2cap_move_channel_req(struct l2cap_conn *conn,
4879					 struct l2cap_cmd_hdr *cmd,
4880					 u16 cmd_len, void *data)
4881{
4882	struct l2cap_move_chan_req *req = data;
4883	struct l2cap_move_chan_rsp rsp;
4884	struct l2cap_chan *chan;
4885	u16 icid = 0;
4886	u16 result = L2CAP_MR_NOT_ALLOWED;
4887
4888	if (cmd_len != sizeof(*req))
4889		return -EPROTO;
4890
4891	icid = le16_to_cpu(req->icid);
4892
4893	BT_DBG("icid 0x%4.4x, dest_amp_id %d", icid, req->dest_amp_id);
4894
4895	if (!(conn->local_fixed_chan & L2CAP_FC_A2MP))
4896		return -EINVAL;
4897
4898	chan = l2cap_get_chan_by_dcid(conn, icid);
4899	if (!chan) {
4900		rsp.icid = cpu_to_le16(icid);
4901		rsp.result = cpu_to_le16(L2CAP_MR_NOT_ALLOWED);
4902		l2cap_send_cmd(conn, cmd->ident, L2CAP_MOVE_CHAN_RSP,
4903			       sizeof(rsp), &rsp);
4904		return 0;
4905	}
4906
4907	chan->ident = cmd->ident;
4908
4909	if (chan->scid < L2CAP_CID_DYN_START ||
4910	    chan->chan_policy == BT_CHANNEL_POLICY_BREDR_ONLY ||
4911	    (chan->mode != L2CAP_MODE_ERTM &&
4912	     chan->mode != L2CAP_MODE_STREAMING)) {
4913		result = L2CAP_MR_NOT_ALLOWED;
4914		goto send_move_response;
4915	}
4916
4917	if (chan->local_amp_id == req->dest_amp_id) {
4918		result = L2CAP_MR_SAME_ID;
4919		goto send_move_response;
4920	}
4921
4922	if (req->dest_amp_id != AMP_ID_BREDR) {
4923		struct hci_dev *hdev;
4924		hdev = hci_dev_get(req->dest_amp_id);
4925		if (!hdev || hdev->dev_type != HCI_AMP ||
4926		    !test_bit(HCI_UP, &hdev->flags)) {
4927			if (hdev)
4928				hci_dev_put(hdev);
4929
4930			result = L2CAP_MR_BAD_ID;
4931			goto send_move_response;
4932		}
4933		hci_dev_put(hdev);
4934	}
4935
4936	/* Detect a move collision.  Only send a collision response
4937	 * if this side has "lost", otherwise proceed with the move.
4938	 * The winner has the larger bd_addr.
4939	 */
4940	if ((__chan_is_moving(chan) ||
4941	     chan->move_role != L2CAP_MOVE_ROLE_NONE) &&
4942	    bacmp(&conn->hcon->src, &conn->hcon->dst) > 0) {
4943		result = L2CAP_MR_COLLISION;
4944		goto send_move_response;
4945	}
4946
4947	chan->move_role = L2CAP_MOVE_ROLE_RESPONDER;
4948	l2cap_move_setup(chan);
4949	chan->move_id = req->dest_amp_id;
4950	icid = chan->dcid;
4951
4952	if (req->dest_amp_id == AMP_ID_BREDR) {
4953		/* Moving to BR/EDR */
4954		if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
4955			chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;
4956			result = L2CAP_MR_PEND;
4957		} else {
4958			chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;
4959			result = L2CAP_MR_SUCCESS;
4960		}
4961	} else {
4962		chan->move_state = L2CAP_MOVE_WAIT_PREPARE;
4963		/* Placeholder - uncomment when amp functions are available */
4964		/*amp_accept_physical(chan, req->dest_amp_id);*/
4965		result = L2CAP_MR_PEND;
4966	}
4967
4968send_move_response:
4969	l2cap_send_move_chan_rsp(chan, result);
4970
4971	l2cap_chan_unlock(chan);
4972
4973	return 0;
4974}
4975
4976static void l2cap_move_continue(struct l2cap_conn *conn, u16 icid, u16 result)
4977{
4978	struct l2cap_chan *chan;
4979	struct hci_chan *hchan = NULL;
4980
4981	chan = l2cap_get_chan_by_scid(conn, icid);
4982	if (!chan) {
4983		l2cap_send_move_chan_cfm_icid(conn, icid);
4984		return;
4985	}
4986
4987	__clear_chan_timer(chan);
4988	if (result == L2CAP_MR_PEND)
4989		__set_chan_timer(chan, L2CAP_MOVE_ERTX_TIMEOUT);
4990
4991	switch (chan->move_state) {
4992	case L2CAP_MOVE_WAIT_LOGICAL_COMP:
4993		/* Move confirm will be sent when logical link
4994		 * is complete.
4995		 */
4996		chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;
4997		break;
4998	case L2CAP_MOVE_WAIT_RSP_SUCCESS:
4999		if (result == L2CAP_MR_PEND) {
5000			break;
5001		} else if (test_bit(CONN_LOCAL_BUSY,
5002				    &chan->conn_state)) {
5003			chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;
5004		} else {
5005			/* Logical link is up or moving to BR/EDR,
5006			 * proceed with move
5007			 */
5008			chan->move_state = L2CAP_MOVE_WAIT_CONFIRM_RSP;
5009			l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);
5010		}
5011		break;
5012	case L2CAP_MOVE_WAIT_RSP:
5013		/* Moving to AMP */
5014		if (result == L2CAP_MR_SUCCESS) {
5015			/* Remote is ready, send confirm immediately
5016			 * after logical link is ready
5017			 */
5018			chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;
5019		} else {
5020			/* Both logical link and move success
5021			 * are required to confirm
5022			 */
5023			chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_COMP;
5024		}
5025
5026		/* Placeholder - get hci_chan for logical link */
5027		if (!hchan) {
5028			/* Logical link not available */
5029			l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);
5030			break;
5031		}
5032
5033		/* If the logical link is not yet connected, do not
5034		 * send confirmation.
5035		 */
5036		if (hchan->state != BT_CONNECTED)
5037			break;
5038
5039		/* Logical link is already ready to go */
5040
5041		chan->hs_hcon = hchan->conn;
5042		chan->hs_hcon->l2cap_data = chan->conn;
5043
5044		if (result == L2CAP_MR_SUCCESS) {
5045			/* Can confirm now */
5046			l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);
5047		} else {
5048			/* Now only need move success
5049			 * to confirm
5050			 */
5051			chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;
5052		}
5053
5054		l2cap_logical_cfm(chan, hchan, L2CAP_MR_SUCCESS);
5055		break;
5056	default:
5057		/* Any other amp move state means the move failed. */
5058		chan->move_id = chan->local_amp_id;
5059		l2cap_move_done(chan);
5060		l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);
5061	}
5062
5063	l2cap_chan_unlock(chan);
5064}
5065
5066static void l2cap_move_fail(struct l2cap_conn *conn, u8 ident, u16 icid,
5067			    u16 result)
5068{
5069	struct l2cap_chan *chan;
5070
5071	chan = l2cap_get_chan_by_ident(conn, ident);
5072	if (!chan) {
5073		/* Could not locate channel, icid is best guess */
5074		l2cap_send_move_chan_cfm_icid(conn, icid);
5075		return;
5076	}
5077
5078	__clear_chan_timer(chan);
5079
5080	if (chan->move_role == L2CAP_MOVE_ROLE_INITIATOR) {
5081		if (result == L2CAP_MR_COLLISION) {
5082			chan->move_role = L2CAP_MOVE_ROLE_RESPONDER;
5083		} else {
5084			/* Cleanup - cancel move */
5085			chan->move_id = chan->local_amp_id;
5086			l2cap_move_done(chan);
5087		}
5088	}
5089
5090	l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);
5091
5092	l2cap_chan_unlock(chan);
5093}
5094
5095static int l2cap_move_channel_rsp(struct l2cap_conn *conn,
5096				  struct l2cap_cmd_hdr *cmd,
5097				  u16 cmd_len, void *data)
5098{
5099	struct l2cap_move_chan_rsp *rsp = data;
5100	u16 icid, result;
5101
5102	if (cmd_len != sizeof(*rsp))
5103		return -EPROTO;
5104
5105	icid = le16_to_cpu(rsp->icid);
5106	result = le16_to_cpu(rsp->result);
5107
5108	BT_DBG("icid 0x%4.4x, result 0x%4.4x", icid, result);
5109
5110	if (result == L2CAP_MR_SUCCESS || result == L2CAP_MR_PEND)
5111		l2cap_move_continue(conn, icid, result);
5112	else
5113		l2cap_move_fail(conn, cmd->ident, icid, result);
5114
5115	return 0;
5116}
5117
5118static int l2cap_move_channel_confirm(struct l2cap_conn *conn,
5119				      struct l2cap_cmd_hdr *cmd,
5120				      u16 cmd_len, void *data)
5121{
5122	struct l2cap_move_chan_cfm *cfm = data;
5123	struct l2cap_chan *chan;
5124	u16 icid, result;
5125
5126	if (cmd_len != sizeof(*cfm))
5127		return -EPROTO;
5128
5129	icid = le16_to_cpu(cfm->icid);
5130	result = le16_to_cpu(cfm->result);
5131
5132	BT_DBG("icid 0x%4.4x, result 0x%4.4x", icid, result);
5133
5134	chan = l2cap_get_chan_by_dcid(conn, icid);
5135	if (!chan) {
5136		/* Spec requires a response even if the icid was not found */
5137		l2cap_send_move_chan_cfm_rsp(conn, cmd->ident, icid);
5138		return 0;
5139	}
5140
5141	if (chan->move_state == L2CAP_MOVE_WAIT_CONFIRM) {
5142		if (result == L2CAP_MC_CONFIRMED) {
5143			chan->local_amp_id = chan->move_id;
5144			if (chan->local_amp_id == AMP_ID_BREDR)
5145				__release_logical_link(chan);
5146		} else {
5147			chan->move_id = chan->local_amp_id;
5148		}
5149
5150		l2cap_move_done(chan);
5151	}
5152
5153	l2cap_send_move_chan_cfm_rsp(conn, cmd->ident, icid);
5154
5155	l2cap_chan_unlock(chan);
5156
5157	return 0;
5158}
5159
5160static inline int l2cap_move_channel_confirm_rsp(struct l2cap_conn *conn,
5161						 struct l2cap_cmd_hdr *cmd,
5162						 u16 cmd_len, void *data)
5163{
5164	struct l2cap_move_chan_cfm_rsp *rsp = data;
5165	struct l2cap_chan *chan;
5166	u16 icid;
5167
5168	if (cmd_len != sizeof(*rsp))
5169		return -EPROTO;
5170
5171	icid = le16_to_cpu(rsp->icid);
5172
5173	BT_DBG("icid 0x%4.4x", icid);
5174
5175	chan = l2cap_get_chan_by_scid(conn, icid);
5176	if (!chan)
5177		return 0;
5178
5179	__clear_chan_timer(chan);
5180
5181	if (chan->move_state == L2CAP_MOVE_WAIT_CONFIRM_RSP) {
5182		chan->local_amp_id = chan->move_id;
5183
5184		if (chan->local_amp_id == AMP_ID_BREDR && chan->hs_hchan)
5185			__release_logical_link(chan);
5186
5187		l2cap_move_done(chan);
5188	}
5189
5190	l2cap_chan_unlock(chan);
5191
5192	return 0;
5193}
5194
5195static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn,
5196					      struct l2cap_cmd_hdr *cmd,
5197					      u16 cmd_len, u8 *data)
5198{
5199	struct hci_conn *hcon = conn->hcon;
5200	struct l2cap_conn_param_update_req *req;
5201	struct l2cap_conn_param_update_rsp rsp;
5202	u16 min, max, latency, to_multiplier;
5203	int err;
5204
5205	if (hcon->role != HCI_ROLE_MASTER)
5206		return -EINVAL;
5207
5208	if (cmd_len != sizeof(struct l2cap_conn_param_update_req))
5209		return -EPROTO;
5210
5211	req = (struct l2cap_conn_param_update_req *) data;
5212	min		= __le16_to_cpu(req->min);
5213	max		= __le16_to_cpu(req->max);
5214	latency		= __le16_to_cpu(req->latency);
5215	to_multiplier	= __le16_to_cpu(req->to_multiplier);
5216
5217	BT_DBG("min 0x%4.4x max 0x%4.4x latency: 0x%4.4x Timeout: 0x%4.4x",
5218	       min, max, latency, to_multiplier);
5219
5220	memset(&rsp, 0, sizeof(rsp));
5221
5222	err = hci_check_conn_params(min, max, latency, to_multiplier);
5223	if (err)
5224		rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED);
5225	else
5226		rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_ACCEPTED);
5227
5228	l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_PARAM_UPDATE_RSP,
5229		       sizeof(rsp), &rsp);
5230
5231	if (!err) {
5232		u8 store_hint;
5233
5234		store_hint = hci_le_conn_update(hcon, min, max, latency,
5235						to_multiplier);
5236		mgmt_new_conn_param(hcon->hdev, &hcon->dst, hcon->dst_type,
5237				    store_hint, min, max, latency,
5238				    to_multiplier);
5239
5240	}
5241
5242	return 0;
5243}
5244
5245static int l2cap_le_connect_rsp(struct l2cap_conn *conn,
5246				struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5247				u8 *data)
5248{
5249	struct l2cap_le_conn_rsp *rsp = (struct l2cap_le_conn_rsp *) data;
5250	struct hci_conn *hcon = conn->hcon;
5251	u16 dcid, mtu, mps, credits, result;
5252	struct l2cap_chan *chan;
5253	int err, sec_level;
5254
5255	if (cmd_len < sizeof(*rsp))
5256		return -EPROTO;
5257
5258	dcid    = __le16_to_cpu(rsp->dcid);
5259	mtu     = __le16_to_cpu(rsp->mtu);
5260	mps     = __le16_to_cpu(rsp->mps);
5261	credits = __le16_to_cpu(rsp->credits);
5262	result  = __le16_to_cpu(rsp->result);
5263
5264	if (result == L2CAP_CR_SUCCESS && (mtu < 23 || mps < 23 ||
5265					   dcid < L2CAP_CID_DYN_START ||
5266					   dcid > L2CAP_CID_LE_DYN_END))
5267		return -EPROTO;
5268
5269	BT_DBG("dcid 0x%4.4x mtu %u mps %u credits %u result 0x%2.2x",
5270	       dcid, mtu, mps, credits, result);
5271
5272	mutex_lock(&conn->chan_lock);
5273
5274	chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
5275	if (!chan) {
5276		err = -EBADSLT;
5277		goto unlock;
5278	}
5279
5280	err = 0;
5281
5282	l2cap_chan_lock(chan);
5283
5284	switch (result) {
5285	case L2CAP_CR_SUCCESS:
5286		if (__l2cap_get_chan_by_dcid(conn, dcid)) {
5287			err = -EBADSLT;
5288			break;
5289		}
5290
5291		chan->ident = 0;
5292		chan->dcid = dcid;
5293		chan->omtu = mtu;
5294		chan->remote_mps = mps;
5295		chan->tx_credits = credits;
5296		l2cap_chan_ready(chan);
5297		break;
5298
5299	case L2CAP_CR_AUTHENTICATION:
5300	case L2CAP_CR_ENCRYPTION:
5301		/* If we already have MITM protection we can't do
5302		 * anything.
5303		 */
5304		if (hcon->sec_level > BT_SECURITY_MEDIUM) {
5305			l2cap_chan_del(chan, ECONNREFUSED);
5306			break;
5307		}
5308
5309		sec_level = hcon->sec_level + 1;
5310		if (chan->sec_level < sec_level)
5311			chan->sec_level = sec_level;
5312
5313		/* We'll need to send a new Connect Request */
5314		clear_bit(FLAG_LE_CONN_REQ_SENT, &chan->flags);
5315
5316		smp_conn_security(hcon, chan->sec_level);
5317		break;
5318
5319	default:
5320		l2cap_chan_del(chan, ECONNREFUSED);
5321		break;
5322	}
5323
5324	l2cap_chan_unlock(chan);
5325
5326unlock:
5327	mutex_unlock(&conn->chan_lock);
5328
5329	return err;
5330}
5331
5332static inline int l2cap_bredr_sig_cmd(struct l2cap_conn *conn,
5333				      struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5334				      u8 *data)
5335{
5336	int err = 0;
5337
5338	switch (cmd->code) {
5339	case L2CAP_COMMAND_REJ:
5340		l2cap_command_rej(conn, cmd, cmd_len, data);
5341		break;
5342
5343	case L2CAP_CONN_REQ:
5344		err = l2cap_connect_req(conn, cmd, cmd_len, data);
5345		break;
5346
5347	case L2CAP_CONN_RSP:
5348	case L2CAP_CREATE_CHAN_RSP:
5349		l2cap_connect_create_rsp(conn, cmd, cmd_len, data);
5350		break;
5351
5352	case L2CAP_CONF_REQ:
5353		err = l2cap_config_req(conn, cmd, cmd_len, data);
5354		break;
5355
5356	case L2CAP_CONF_RSP:
5357		l2cap_config_rsp(conn, cmd, cmd_len, data);
5358		break;
5359
5360	case L2CAP_DISCONN_REQ:
5361		err = l2cap_disconnect_req(conn, cmd, cmd_len, data);
5362		break;
5363
5364	case L2CAP_DISCONN_RSP:
5365		l2cap_disconnect_rsp(conn, cmd, cmd_len, data);
5366		break;
5367
5368	case L2CAP_ECHO_REQ:
5369		l2cap_send_cmd(conn, cmd->ident, L2CAP_ECHO_RSP, cmd_len, data);
5370		break;
5371
5372	case L2CAP_ECHO_RSP:
5373		break;
5374
5375	case L2CAP_INFO_REQ:
5376		err = l2cap_information_req(conn, cmd, cmd_len, data);
5377		break;
5378
5379	case L2CAP_INFO_RSP:
5380		l2cap_information_rsp(conn, cmd, cmd_len, data);
5381		break;
5382
5383	case L2CAP_CREATE_CHAN_REQ:
5384		err = l2cap_create_channel_req(conn, cmd, cmd_len, data);
5385		break;
5386
5387	case L2CAP_MOVE_CHAN_REQ:
5388		err = l2cap_move_channel_req(conn, cmd, cmd_len, data);
5389		break;
5390
5391	case L2CAP_MOVE_CHAN_RSP:
5392		l2cap_move_channel_rsp(conn, cmd, cmd_len, data);
5393		break;
5394
5395	case L2CAP_MOVE_CHAN_CFM:
5396		err = l2cap_move_channel_confirm(conn, cmd, cmd_len, data);
5397		break;
5398
5399	case L2CAP_MOVE_CHAN_CFM_RSP:
5400		l2cap_move_channel_confirm_rsp(conn, cmd, cmd_len, data);
5401		break;
5402
5403	default:
5404		BT_ERR("Unknown BR/EDR signaling command 0x%2.2x", cmd->code);
5405		err = -EINVAL;
5406		break;
5407	}
5408
5409	return err;
5410}
5411
5412static int l2cap_le_connect_req(struct l2cap_conn *conn,
5413				struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5414				u8 *data)
5415{
5416	struct l2cap_le_conn_req *req = (struct l2cap_le_conn_req *) data;
5417	struct l2cap_le_conn_rsp rsp;
5418	struct l2cap_chan *chan, *pchan;
5419	u16 dcid, scid, credits, mtu, mps;
5420	__le16 psm;
5421	u8 result;
5422
5423	if (cmd_len != sizeof(*req))
5424		return -EPROTO;
5425
5426	scid = __le16_to_cpu(req->scid);
5427	mtu  = __le16_to_cpu(req->mtu);
5428	mps  = __le16_to_cpu(req->mps);
5429	psm  = req->psm;
5430	dcid = 0;
5431	credits = 0;
5432
5433	if (mtu < 23 || mps < 23)
5434		return -EPROTO;
5435
5436	BT_DBG("psm 0x%2.2x scid 0x%4.4x mtu %u mps %u", __le16_to_cpu(psm),
5437	       scid, mtu, mps);
5438
 
 
 
 
 
 
 
 
 
 
 
 
 
5439	/* Check if we have socket listening on psm */
5440	pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src,
5441					 &conn->hcon->dst, LE_LINK);
5442	if (!pchan) {
5443		result = L2CAP_CR_BAD_PSM;
5444		chan = NULL;
5445		goto response;
5446	}
5447
5448	mutex_lock(&conn->chan_lock);
5449	l2cap_chan_lock(pchan);
5450
5451	if (!smp_sufficient_security(conn->hcon, pchan->sec_level,
5452				     SMP_ALLOW_STK)) {
5453		result = L2CAP_CR_AUTHENTICATION;
5454		chan = NULL;
5455		goto response_unlock;
5456	}
5457
5458	/* Check for valid dynamic CID range */
5459	if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_LE_DYN_END) {
5460		result = L2CAP_CR_INVALID_SCID;
5461		chan = NULL;
5462		goto response_unlock;
5463	}
5464
5465	/* Check if we already have channel with that dcid */
5466	if (__l2cap_get_chan_by_dcid(conn, scid)) {
5467		result = L2CAP_CR_SCID_IN_USE;
5468		chan = NULL;
5469		goto response_unlock;
5470	}
5471
5472	chan = pchan->ops->new_connection(pchan);
5473	if (!chan) {
5474		result = L2CAP_CR_NO_MEM;
5475		goto response_unlock;
5476	}
5477
5478	l2cap_le_flowctl_init(chan);
5479
5480	bacpy(&chan->src, &conn->hcon->src);
5481	bacpy(&chan->dst, &conn->hcon->dst);
5482	chan->src_type = bdaddr_src_type(conn->hcon);
5483	chan->dst_type = bdaddr_dst_type(conn->hcon);
5484	chan->psm  = psm;
5485	chan->dcid = scid;
5486	chan->omtu = mtu;
5487	chan->remote_mps = mps;
5488	chan->tx_credits = __le16_to_cpu(req->credits);
5489
5490	__l2cap_chan_add(conn, chan);
 
 
 
5491	dcid = chan->scid;
5492	credits = chan->rx_credits;
5493
5494	__set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
5495
5496	chan->ident = cmd->ident;
5497
5498	if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
5499		l2cap_state_change(chan, BT_CONNECT2);
5500		/* The following result value is actually not defined
5501		 * for LE CoC but we use it to let the function know
5502		 * that it should bail out after doing its cleanup
5503		 * instead of sending a response.
5504		 */
5505		result = L2CAP_CR_PEND;
5506		chan->ops->defer(chan);
5507	} else {
5508		l2cap_chan_ready(chan);
5509		result = L2CAP_CR_SUCCESS;
5510	}
5511
5512response_unlock:
5513	l2cap_chan_unlock(pchan);
5514	mutex_unlock(&conn->chan_lock);
5515	l2cap_chan_put(pchan);
5516
5517	if (result == L2CAP_CR_PEND)
5518		return 0;
5519
5520response:
5521	if (chan) {
5522		rsp.mtu = cpu_to_le16(chan->imtu);
5523		rsp.mps = cpu_to_le16(chan->mps);
5524	} else {
5525		rsp.mtu = 0;
5526		rsp.mps = 0;
5527	}
5528
5529	rsp.dcid    = cpu_to_le16(dcid);
5530	rsp.credits = cpu_to_le16(credits);
5531	rsp.result  = cpu_to_le16(result);
5532
5533	l2cap_send_cmd(conn, cmd->ident, L2CAP_LE_CONN_RSP, sizeof(rsp), &rsp);
5534
5535	return 0;
5536}
5537
5538static inline int l2cap_le_credits(struct l2cap_conn *conn,
5539				   struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5540				   u8 *data)
5541{
5542	struct l2cap_le_credits *pkt;
5543	struct l2cap_chan *chan;
5544	u16 cid, credits, max_credits;
5545
5546	if (cmd_len != sizeof(*pkt))
5547		return -EPROTO;
5548
5549	pkt = (struct l2cap_le_credits *) data;
5550	cid	= __le16_to_cpu(pkt->cid);
5551	credits	= __le16_to_cpu(pkt->credits);
5552
5553	BT_DBG("cid 0x%4.4x credits 0x%4.4x", cid, credits);
5554
5555	chan = l2cap_get_chan_by_dcid(conn, cid);
5556	if (!chan)
5557		return -EBADSLT;
5558
5559	max_credits = LE_FLOWCTL_MAX_CREDITS - chan->tx_credits;
5560	if (credits > max_credits) {
5561		BT_ERR("LE credits overflow");
5562		l2cap_send_disconn_req(chan, ECONNRESET);
5563		l2cap_chan_unlock(chan);
5564
5565		/* Return 0 so that we don't trigger an unnecessary
5566		 * command reject packet.
5567		 */
5568		return 0;
5569	}
5570
5571	chan->tx_credits += credits;
5572
5573	while (chan->tx_credits && !skb_queue_empty(&chan->tx_q)) {
5574		l2cap_do_send(chan, skb_dequeue(&chan->tx_q));
5575		chan->tx_credits--;
5576	}
5577
5578	if (chan->tx_credits)
5579		chan->ops->resume(chan);
5580
 
5581	l2cap_chan_unlock(chan);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
5582
5583	return 0;
5584}
5585
5586static inline int l2cap_le_command_rej(struct l2cap_conn *conn,
5587				       struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5588				       u8 *data)
5589{
5590	struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data;
5591	struct l2cap_chan *chan;
5592
5593	if (cmd_len < sizeof(*rej))
5594		return -EPROTO;
5595
5596	mutex_lock(&conn->chan_lock);
5597
5598	chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
5599	if (!chan)
5600		goto done;
5601
 
 
 
 
5602	l2cap_chan_lock(chan);
5603	l2cap_chan_del(chan, ECONNREFUSED);
5604	l2cap_chan_unlock(chan);
 
5605
5606done:
5607	mutex_unlock(&conn->chan_lock);
5608	return 0;
5609}
5610
5611static inline int l2cap_le_sig_cmd(struct l2cap_conn *conn,
5612				   struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5613				   u8 *data)
5614{
5615	int err = 0;
5616
5617	switch (cmd->code) {
5618	case L2CAP_COMMAND_REJ:
5619		l2cap_le_command_rej(conn, cmd, cmd_len, data);
5620		break;
5621
5622	case L2CAP_CONN_PARAM_UPDATE_REQ:
5623		err = l2cap_conn_param_update_req(conn, cmd, cmd_len, data);
5624		break;
5625
5626	case L2CAP_CONN_PARAM_UPDATE_RSP:
5627		break;
5628
5629	case L2CAP_LE_CONN_RSP:
5630		l2cap_le_connect_rsp(conn, cmd, cmd_len, data);
5631		break;
5632
5633	case L2CAP_LE_CONN_REQ:
5634		err = l2cap_le_connect_req(conn, cmd, cmd_len, data);
5635		break;
5636
5637	case L2CAP_LE_CREDITS:
5638		err = l2cap_le_credits(conn, cmd, cmd_len, data);
5639		break;
5640
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
5641	case L2CAP_DISCONN_REQ:
5642		err = l2cap_disconnect_req(conn, cmd, cmd_len, data);
5643		break;
5644
5645	case L2CAP_DISCONN_RSP:
5646		l2cap_disconnect_rsp(conn, cmd, cmd_len, data);
5647		break;
5648
5649	default:
5650		BT_ERR("Unknown LE signaling command 0x%2.2x", cmd->code);
5651		err = -EINVAL;
5652		break;
5653	}
5654
5655	return err;
5656}
5657
5658static inline void l2cap_le_sig_channel(struct l2cap_conn *conn,
5659					struct sk_buff *skb)
5660{
5661	struct hci_conn *hcon = conn->hcon;
5662	struct l2cap_cmd_hdr *cmd;
5663	u16 len;
5664	int err;
5665
5666	if (hcon->type != LE_LINK)
5667		goto drop;
5668
5669	if (skb->len < L2CAP_CMD_HDR_SIZE)
5670		goto drop;
5671
5672	cmd = (void *) skb->data;
5673	skb_pull(skb, L2CAP_CMD_HDR_SIZE);
5674
5675	len = le16_to_cpu(cmd->len);
5676
5677	BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd->code, len, cmd->ident);
5678
5679	if (len != skb->len || !cmd->ident) {
5680		BT_DBG("corrupted command");
5681		goto drop;
5682	}
5683
5684	err = l2cap_le_sig_cmd(conn, cmd, len, skb->data);
5685	if (err) {
5686		struct l2cap_cmd_rej_unk rej;
5687
5688		BT_ERR("Wrong link type (%d)", err);
5689
5690		rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
5691		l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ,
5692			       sizeof(rej), &rej);
5693	}
5694
5695drop:
5696	kfree_skb(skb);
5697}
5698
 
 
 
 
 
 
 
 
5699static inline void l2cap_sig_channel(struct l2cap_conn *conn,
5700				     struct sk_buff *skb)
5701{
5702	struct hci_conn *hcon = conn->hcon;
5703	u8 *data = skb->data;
5704	int len = skb->len;
5705	struct l2cap_cmd_hdr cmd;
5706	int err;
5707
5708	l2cap_raw_recv(conn, skb);
5709
5710	if (hcon->type != ACL_LINK)
5711		goto drop;
5712
5713	while (len >= L2CAP_CMD_HDR_SIZE) {
5714		u16 cmd_len;
5715		memcpy(&cmd, data, L2CAP_CMD_HDR_SIZE);
5716		data += L2CAP_CMD_HDR_SIZE;
5717		len  -= L2CAP_CMD_HDR_SIZE;
5718
5719		cmd_len = le16_to_cpu(cmd.len);
5720
5721		BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd.code, cmd_len,
5722		       cmd.ident);
5723
5724		if (cmd_len > len || !cmd.ident) {
5725			BT_DBG("corrupted command");
5726			break;
 
 
5727		}
5728
5729		err = l2cap_bredr_sig_cmd(conn, &cmd, cmd_len, data);
5730		if (err) {
5731			struct l2cap_cmd_rej_unk rej;
5732
5733			BT_ERR("Wrong link type (%d)", err);
5734
5735			rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
5736			l2cap_send_cmd(conn, cmd.ident, L2CAP_COMMAND_REJ,
5737				       sizeof(rej), &rej);
5738		}
5739
5740		data += cmd_len;
5741		len  -= cmd_len;
 
 
 
 
5742	}
5743
5744drop:
5745	kfree_skb(skb);
5746}
5747
5748static int l2cap_check_fcs(struct l2cap_chan *chan,  struct sk_buff *skb)
5749{
5750	u16 our_fcs, rcv_fcs;
5751	int hdr_size;
5752
5753	if (test_bit(FLAG_EXT_CTRL, &chan->flags))
5754		hdr_size = L2CAP_EXT_HDR_SIZE;
5755	else
5756		hdr_size = L2CAP_ENH_HDR_SIZE;
5757
5758	if (chan->fcs == L2CAP_FCS_CRC16) {
5759		skb_trim(skb, skb->len - L2CAP_FCS_SIZE);
5760		rcv_fcs = get_unaligned_le16(skb->data + skb->len);
5761		our_fcs = crc16(0, skb->data - hdr_size, skb->len + hdr_size);
5762
5763		if (our_fcs != rcv_fcs)
5764			return -EBADMSG;
5765	}
5766	return 0;
5767}
5768
5769static void l2cap_send_i_or_rr_or_rnr(struct l2cap_chan *chan)
5770{
5771	struct l2cap_ctrl control;
5772
5773	BT_DBG("chan %p", chan);
5774
5775	memset(&control, 0, sizeof(control));
5776	control.sframe = 1;
5777	control.final = 1;
5778	control.reqseq = chan->buffer_seq;
5779	set_bit(CONN_SEND_FBIT, &chan->conn_state);
5780
5781	if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
5782		control.super = L2CAP_SUPER_RNR;
5783		l2cap_send_sframe(chan, &control);
5784	}
5785
5786	if (test_and_clear_bit(CONN_REMOTE_BUSY, &chan->conn_state) &&
5787	    chan->unacked_frames > 0)
5788		__set_retrans_timer(chan);
5789
5790	/* Send pending iframes */
5791	l2cap_ertm_send(chan);
5792
5793	if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&
5794	    test_bit(CONN_SEND_FBIT, &chan->conn_state)) {
5795		/* F-bit wasn't sent in an s-frame or i-frame yet, so
5796		 * send it now.
5797		 */
5798		control.super = L2CAP_SUPER_RR;
5799		l2cap_send_sframe(chan, &control);
5800	}
5801}
5802
5803static void append_skb_frag(struct sk_buff *skb, struct sk_buff *new_frag,
5804			    struct sk_buff **last_frag)
5805{
5806	/* skb->len reflects data in skb as well as all fragments
5807	 * skb->data_len reflects only data in fragments
5808	 */
5809	if (!skb_has_frag_list(skb))
5810		skb_shinfo(skb)->frag_list = new_frag;
5811
5812	new_frag->next = NULL;
5813
5814	(*last_frag)->next = new_frag;
5815	*last_frag = new_frag;
5816
5817	skb->len += new_frag->len;
5818	skb->data_len += new_frag->len;
5819	skb->truesize += new_frag->truesize;
5820}
5821
5822static int l2cap_reassemble_sdu(struct l2cap_chan *chan, struct sk_buff *skb,
5823				struct l2cap_ctrl *control)
5824{
5825	int err = -EINVAL;
5826
5827	switch (control->sar) {
5828	case L2CAP_SAR_UNSEGMENTED:
5829		if (chan->sdu)
5830			break;
5831
5832		err = chan->ops->recv(chan, skb);
5833		break;
5834
5835	case L2CAP_SAR_START:
5836		if (chan->sdu)
5837			break;
5838
5839		if (!pskb_may_pull(skb, L2CAP_SDULEN_SIZE))
5840			break;
5841
5842		chan->sdu_len = get_unaligned_le16(skb->data);
5843		skb_pull(skb, L2CAP_SDULEN_SIZE);
5844
5845		if (chan->sdu_len > chan->imtu) {
5846			err = -EMSGSIZE;
5847			break;
5848		}
5849
5850		if (skb->len >= chan->sdu_len)
5851			break;
5852
5853		chan->sdu = skb;
5854		chan->sdu_last_frag = skb;
5855
5856		skb = NULL;
5857		err = 0;
5858		break;
5859
5860	case L2CAP_SAR_CONTINUE:
5861		if (!chan->sdu)
5862			break;
5863
5864		append_skb_frag(chan->sdu, skb,
5865				&chan->sdu_last_frag);
5866		skb = NULL;
5867
5868		if (chan->sdu->len >= chan->sdu_len)
5869			break;
5870
5871		err = 0;
5872		break;
5873
5874	case L2CAP_SAR_END:
5875		if (!chan->sdu)
5876			break;
5877
5878		append_skb_frag(chan->sdu, skb,
5879				&chan->sdu_last_frag);
5880		skb = NULL;
5881
5882		if (chan->sdu->len != chan->sdu_len)
5883			break;
5884
5885		err = chan->ops->recv(chan, chan->sdu);
5886
5887		if (!err) {
5888			/* Reassembly complete */
5889			chan->sdu = NULL;
5890			chan->sdu_last_frag = NULL;
5891			chan->sdu_len = 0;
5892		}
5893		break;
5894	}
5895
5896	if (err) {
5897		kfree_skb(skb);
5898		kfree_skb(chan->sdu);
5899		chan->sdu = NULL;
5900		chan->sdu_last_frag = NULL;
5901		chan->sdu_len = 0;
5902	}
5903
5904	return err;
5905}
5906
5907static int l2cap_resegment(struct l2cap_chan *chan)
5908{
5909	/* Placeholder */
5910	return 0;
5911}
5912
5913void l2cap_chan_busy(struct l2cap_chan *chan, int busy)
5914{
5915	u8 event;
5916
5917	if (chan->mode != L2CAP_MODE_ERTM)
5918		return;
5919
5920	event = busy ? L2CAP_EV_LOCAL_BUSY_DETECTED : L2CAP_EV_LOCAL_BUSY_CLEAR;
5921	l2cap_tx(chan, NULL, NULL, event);
5922}
5923
5924static int l2cap_rx_queued_iframes(struct l2cap_chan *chan)
5925{
5926	int err = 0;
5927	/* Pass sequential frames to l2cap_reassemble_sdu()
5928	 * until a gap is encountered.
5929	 */
5930
5931	BT_DBG("chan %p", chan);
5932
5933	while (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
5934		struct sk_buff *skb;
5935		BT_DBG("Searching for skb with txseq %d (queue len %d)",
5936		       chan->buffer_seq, skb_queue_len(&chan->srej_q));
5937
5938		skb = l2cap_ertm_seq_in_queue(&chan->srej_q, chan->buffer_seq);
5939
5940		if (!skb)
5941			break;
5942
5943		skb_unlink(skb, &chan->srej_q);
5944		chan->buffer_seq = __next_seq(chan, chan->buffer_seq);
5945		err = l2cap_reassemble_sdu(chan, skb, &bt_cb(skb)->l2cap);
5946		if (err)
5947			break;
5948	}
5949
5950	if (skb_queue_empty(&chan->srej_q)) {
5951		chan->rx_state = L2CAP_RX_STATE_RECV;
5952		l2cap_send_ack(chan);
5953	}
5954
5955	return err;
5956}
5957
5958static void l2cap_handle_srej(struct l2cap_chan *chan,
5959			      struct l2cap_ctrl *control)
5960{
5961	struct sk_buff *skb;
5962
5963	BT_DBG("chan %p, control %p", chan, control);
5964
5965	if (control->reqseq == chan->next_tx_seq) {
5966		BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq);
5967		l2cap_send_disconn_req(chan, ECONNRESET);
5968		return;
5969	}
5970
5971	skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);
5972
5973	if (skb == NULL) {
5974		BT_DBG("Seq %d not available for retransmission",
5975		       control->reqseq);
5976		return;
5977	}
5978
5979	if (chan->max_tx != 0 && bt_cb(skb)->l2cap.retries >= chan->max_tx) {
5980		BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
5981		l2cap_send_disconn_req(chan, ECONNRESET);
5982		return;
5983	}
5984
5985	clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
5986
5987	if (control->poll) {
5988		l2cap_pass_to_tx(chan, control);
5989
5990		set_bit(CONN_SEND_FBIT, &chan->conn_state);
5991		l2cap_retransmit(chan, control);
5992		l2cap_ertm_send(chan);
5993
5994		if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) {
5995			set_bit(CONN_SREJ_ACT, &chan->conn_state);
5996			chan->srej_save_reqseq = control->reqseq;
5997		}
5998	} else {
5999		l2cap_pass_to_tx_fbit(chan, control);
6000
6001		if (control->final) {
6002			if (chan->srej_save_reqseq != control->reqseq ||
6003			    !test_and_clear_bit(CONN_SREJ_ACT,
6004						&chan->conn_state))
6005				l2cap_retransmit(chan, control);
6006		} else {
6007			l2cap_retransmit(chan, control);
6008			if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) {
6009				set_bit(CONN_SREJ_ACT, &chan->conn_state);
6010				chan->srej_save_reqseq = control->reqseq;
6011			}
6012		}
6013	}
6014}
6015
6016static void l2cap_handle_rej(struct l2cap_chan *chan,
6017			     struct l2cap_ctrl *control)
6018{
6019	struct sk_buff *skb;
6020
6021	BT_DBG("chan %p, control %p", chan, control);
6022
6023	if (control->reqseq == chan->next_tx_seq) {
6024		BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq);
6025		l2cap_send_disconn_req(chan, ECONNRESET);
6026		return;
6027	}
6028
6029	skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);
6030
6031	if (chan->max_tx && skb &&
6032	    bt_cb(skb)->l2cap.retries >= chan->max_tx) {
6033		BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
6034		l2cap_send_disconn_req(chan, ECONNRESET);
6035		return;
6036	}
6037
6038	clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6039
6040	l2cap_pass_to_tx(chan, control);
6041
6042	if (control->final) {
6043		if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))
6044			l2cap_retransmit_all(chan, control);
6045	} else {
6046		l2cap_retransmit_all(chan, control);
6047		l2cap_ertm_send(chan);
6048		if (chan->tx_state == L2CAP_TX_STATE_WAIT_F)
6049			set_bit(CONN_REJ_ACT, &chan->conn_state);
6050	}
6051}
6052
6053static u8 l2cap_classify_txseq(struct l2cap_chan *chan, u16 txseq)
6054{
6055	BT_DBG("chan %p, txseq %d", chan, txseq);
6056
6057	BT_DBG("last_acked_seq %d, expected_tx_seq %d", chan->last_acked_seq,
6058	       chan->expected_tx_seq);
6059
6060	if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
6061		if (__seq_offset(chan, txseq, chan->last_acked_seq) >=
6062		    chan->tx_win) {
6063			/* See notes below regarding "double poll" and
6064			 * invalid packets.
6065			 */
6066			if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) {
6067				BT_DBG("Invalid/Ignore - after SREJ");
6068				return L2CAP_TXSEQ_INVALID_IGNORE;
6069			} else {
6070				BT_DBG("Invalid - in window after SREJ sent");
6071				return L2CAP_TXSEQ_INVALID;
6072			}
6073		}
6074
6075		if (chan->srej_list.head == txseq) {
6076			BT_DBG("Expected SREJ");
6077			return L2CAP_TXSEQ_EXPECTED_SREJ;
6078		}
6079
6080		if (l2cap_ertm_seq_in_queue(&chan->srej_q, txseq)) {
6081			BT_DBG("Duplicate SREJ - txseq already stored");
6082			return L2CAP_TXSEQ_DUPLICATE_SREJ;
6083		}
6084
6085		if (l2cap_seq_list_contains(&chan->srej_list, txseq)) {
6086			BT_DBG("Unexpected SREJ - not requested");
6087			return L2CAP_TXSEQ_UNEXPECTED_SREJ;
6088		}
6089	}
6090
6091	if (chan->expected_tx_seq == txseq) {
6092		if (__seq_offset(chan, txseq, chan->last_acked_seq) >=
6093		    chan->tx_win) {
6094			BT_DBG("Invalid - txseq outside tx window");
6095			return L2CAP_TXSEQ_INVALID;
6096		} else {
6097			BT_DBG("Expected");
6098			return L2CAP_TXSEQ_EXPECTED;
6099		}
6100	}
6101
6102	if (__seq_offset(chan, txseq, chan->last_acked_seq) <
6103	    __seq_offset(chan, chan->expected_tx_seq, chan->last_acked_seq)) {
6104		BT_DBG("Duplicate - expected_tx_seq later than txseq");
6105		return L2CAP_TXSEQ_DUPLICATE;
6106	}
6107
6108	if (__seq_offset(chan, txseq, chan->last_acked_seq) >= chan->tx_win) {
6109		/* A source of invalid packets is a "double poll" condition,
6110		 * where delays cause us to send multiple poll packets.  If
6111		 * the remote stack receives and processes both polls,
6112		 * sequence numbers can wrap around in such a way that a
6113		 * resent frame has a sequence number that looks like new data
6114		 * with a sequence gap.  This would trigger an erroneous SREJ
6115		 * request.
6116		 *
6117		 * Fortunately, this is impossible with a tx window that's
6118		 * less than half of the maximum sequence number, which allows
6119		 * invalid frames to be safely ignored.
6120		 *
6121		 * With tx window sizes greater than half of the tx window
6122		 * maximum, the frame is invalid and cannot be ignored.  This
6123		 * causes a disconnect.
6124		 */
6125
6126		if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) {
6127			BT_DBG("Invalid/Ignore - txseq outside tx window");
6128			return L2CAP_TXSEQ_INVALID_IGNORE;
6129		} else {
6130			BT_DBG("Invalid - txseq outside tx window");
6131			return L2CAP_TXSEQ_INVALID;
6132		}
6133	} else {
6134		BT_DBG("Unexpected - txseq indicates missing frames");
6135		return L2CAP_TXSEQ_UNEXPECTED;
6136	}
6137}
6138
6139static int l2cap_rx_state_recv(struct l2cap_chan *chan,
6140			       struct l2cap_ctrl *control,
6141			       struct sk_buff *skb, u8 event)
6142{
 
6143	int err = 0;
6144	bool skb_in_use = false;
6145
6146	BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
6147	       event);
6148
6149	switch (event) {
6150	case L2CAP_EV_RECV_IFRAME:
6151		switch (l2cap_classify_txseq(chan, control->txseq)) {
6152		case L2CAP_TXSEQ_EXPECTED:
6153			l2cap_pass_to_tx(chan, control);
6154
6155			if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
6156				BT_DBG("Busy, discarding expected seq %d",
6157				       control->txseq);
6158				break;
6159			}
6160
6161			chan->expected_tx_seq = __next_seq(chan,
6162							   control->txseq);
6163
6164			chan->buffer_seq = chan->expected_tx_seq;
6165			skb_in_use = true;
6166
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
6167			err = l2cap_reassemble_sdu(chan, skb, control);
6168			if (err)
6169				break;
6170
6171			if (control->final) {
6172				if (!test_and_clear_bit(CONN_REJ_ACT,
6173							&chan->conn_state)) {
6174					control->final = 0;
6175					l2cap_retransmit_all(chan, control);
6176					l2cap_ertm_send(chan);
6177				}
6178			}
6179
6180			if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state))
6181				l2cap_send_ack(chan);
6182			break;
6183		case L2CAP_TXSEQ_UNEXPECTED:
6184			l2cap_pass_to_tx(chan, control);
6185
6186			/* Can't issue SREJ frames in the local busy state.
6187			 * Drop this frame, it will be seen as missing
6188			 * when local busy is exited.
6189			 */
6190			if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
6191				BT_DBG("Busy, discarding unexpected seq %d",
6192				       control->txseq);
6193				break;
6194			}
6195
6196			/* There was a gap in the sequence, so an SREJ
6197			 * must be sent for each missing frame.  The
6198			 * current frame is stored for later use.
6199			 */
6200			skb_queue_tail(&chan->srej_q, skb);
6201			skb_in_use = true;
6202			BT_DBG("Queued %p (queue len %d)", skb,
6203			       skb_queue_len(&chan->srej_q));
6204
6205			clear_bit(CONN_SREJ_ACT, &chan->conn_state);
6206			l2cap_seq_list_clear(&chan->srej_list);
6207			l2cap_send_srej(chan, control->txseq);
6208
6209			chan->rx_state = L2CAP_RX_STATE_SREJ_SENT;
6210			break;
6211		case L2CAP_TXSEQ_DUPLICATE:
6212			l2cap_pass_to_tx(chan, control);
6213			break;
6214		case L2CAP_TXSEQ_INVALID_IGNORE:
6215			break;
6216		case L2CAP_TXSEQ_INVALID:
6217		default:
6218			l2cap_send_disconn_req(chan, ECONNRESET);
6219			break;
6220		}
6221		break;
6222	case L2CAP_EV_RECV_RR:
6223		l2cap_pass_to_tx(chan, control);
6224		if (control->final) {
6225			clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6226
6227			if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state) &&
6228			    !__chan_is_moving(chan)) {
6229				control->final = 0;
6230				l2cap_retransmit_all(chan, control);
6231			}
6232
6233			l2cap_ertm_send(chan);
6234		} else if (control->poll) {
6235			l2cap_send_i_or_rr_or_rnr(chan);
6236		} else {
6237			if (test_and_clear_bit(CONN_REMOTE_BUSY,
6238					       &chan->conn_state) &&
6239			    chan->unacked_frames)
6240				__set_retrans_timer(chan);
6241
6242			l2cap_ertm_send(chan);
6243		}
6244		break;
6245	case L2CAP_EV_RECV_RNR:
6246		set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6247		l2cap_pass_to_tx(chan, control);
6248		if (control && control->poll) {
6249			set_bit(CONN_SEND_FBIT, &chan->conn_state);
6250			l2cap_send_rr_or_rnr(chan, 0);
6251		}
6252		__clear_retrans_timer(chan);
6253		l2cap_seq_list_clear(&chan->retrans_list);
6254		break;
6255	case L2CAP_EV_RECV_REJ:
6256		l2cap_handle_rej(chan, control);
6257		break;
6258	case L2CAP_EV_RECV_SREJ:
6259		l2cap_handle_srej(chan, control);
6260		break;
6261	default:
6262		break;
6263	}
6264
6265	if (skb && !skb_in_use) {
6266		BT_DBG("Freeing %p", skb);
6267		kfree_skb(skb);
6268	}
6269
6270	return err;
6271}
6272
6273static int l2cap_rx_state_srej_sent(struct l2cap_chan *chan,
6274				    struct l2cap_ctrl *control,
6275				    struct sk_buff *skb, u8 event)
6276{
6277	int err = 0;
6278	u16 txseq = control->txseq;
6279	bool skb_in_use = false;
6280
6281	BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
6282	       event);
6283
6284	switch (event) {
6285	case L2CAP_EV_RECV_IFRAME:
6286		switch (l2cap_classify_txseq(chan, txseq)) {
6287		case L2CAP_TXSEQ_EXPECTED:
6288			/* Keep frame for reassembly later */
6289			l2cap_pass_to_tx(chan, control);
6290			skb_queue_tail(&chan->srej_q, skb);
6291			skb_in_use = true;
6292			BT_DBG("Queued %p (queue len %d)", skb,
6293			       skb_queue_len(&chan->srej_q));
6294
6295			chan->expected_tx_seq = __next_seq(chan, txseq);
6296			break;
6297		case L2CAP_TXSEQ_EXPECTED_SREJ:
6298			l2cap_seq_list_pop(&chan->srej_list);
6299
6300			l2cap_pass_to_tx(chan, control);
6301			skb_queue_tail(&chan->srej_q, skb);
6302			skb_in_use = true;
6303			BT_DBG("Queued %p (queue len %d)", skb,
6304			       skb_queue_len(&chan->srej_q));
6305
6306			err = l2cap_rx_queued_iframes(chan);
6307			if (err)
6308				break;
6309
6310			break;
6311		case L2CAP_TXSEQ_UNEXPECTED:
6312			/* Got a frame that can't be reassembled yet.
6313			 * Save it for later, and send SREJs to cover
6314			 * the missing frames.
6315			 */
6316			skb_queue_tail(&chan->srej_q, skb);
6317			skb_in_use = true;
6318			BT_DBG("Queued %p (queue len %d)", skb,
6319			       skb_queue_len(&chan->srej_q));
6320
6321			l2cap_pass_to_tx(chan, control);
6322			l2cap_send_srej(chan, control->txseq);
6323			break;
6324		case L2CAP_TXSEQ_UNEXPECTED_SREJ:
6325			/* This frame was requested with an SREJ, but
6326			 * some expected retransmitted frames are
6327			 * missing.  Request retransmission of missing
6328			 * SREJ'd frames.
6329			 */
6330			skb_queue_tail(&chan->srej_q, skb);
6331			skb_in_use = true;
6332			BT_DBG("Queued %p (queue len %d)", skb,
6333			       skb_queue_len(&chan->srej_q));
6334
6335			l2cap_pass_to_tx(chan, control);
6336			l2cap_send_srej_list(chan, control->txseq);
6337			break;
6338		case L2CAP_TXSEQ_DUPLICATE_SREJ:
6339			/* We've already queued this frame.  Drop this copy. */
6340			l2cap_pass_to_tx(chan, control);
6341			break;
6342		case L2CAP_TXSEQ_DUPLICATE:
6343			/* Expecting a later sequence number, so this frame
6344			 * was already received.  Ignore it completely.
6345			 */
6346			break;
6347		case L2CAP_TXSEQ_INVALID_IGNORE:
6348			break;
6349		case L2CAP_TXSEQ_INVALID:
6350		default:
6351			l2cap_send_disconn_req(chan, ECONNRESET);
6352			break;
6353		}
6354		break;
6355	case L2CAP_EV_RECV_RR:
6356		l2cap_pass_to_tx(chan, control);
6357		if (control->final) {
6358			clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6359
6360			if (!test_and_clear_bit(CONN_REJ_ACT,
6361						&chan->conn_state)) {
6362				control->final = 0;
6363				l2cap_retransmit_all(chan, control);
6364			}
6365
6366			l2cap_ertm_send(chan);
6367		} else if (control->poll) {
6368			if (test_and_clear_bit(CONN_REMOTE_BUSY,
6369					       &chan->conn_state) &&
6370			    chan->unacked_frames) {
6371				__set_retrans_timer(chan);
6372			}
6373
6374			set_bit(CONN_SEND_FBIT, &chan->conn_state);
6375			l2cap_send_srej_tail(chan);
6376		} else {
6377			if (test_and_clear_bit(CONN_REMOTE_BUSY,
6378					       &chan->conn_state) &&
6379			    chan->unacked_frames)
6380				__set_retrans_timer(chan);
6381
6382			l2cap_send_ack(chan);
6383		}
6384		break;
6385	case L2CAP_EV_RECV_RNR:
6386		set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6387		l2cap_pass_to_tx(chan, control);
6388		if (control->poll) {
6389			l2cap_send_srej_tail(chan);
6390		} else {
6391			struct l2cap_ctrl rr_control;
6392			memset(&rr_control, 0, sizeof(rr_control));
6393			rr_control.sframe = 1;
6394			rr_control.super = L2CAP_SUPER_RR;
6395			rr_control.reqseq = chan->buffer_seq;
6396			l2cap_send_sframe(chan, &rr_control);
6397		}
6398
6399		break;
6400	case L2CAP_EV_RECV_REJ:
6401		l2cap_handle_rej(chan, control);
6402		break;
6403	case L2CAP_EV_RECV_SREJ:
6404		l2cap_handle_srej(chan, control);
6405		break;
6406	}
6407
6408	if (skb && !skb_in_use) {
6409		BT_DBG("Freeing %p", skb);
6410		kfree_skb(skb);
6411	}
6412
6413	return err;
6414}
6415
6416static int l2cap_finish_move(struct l2cap_chan *chan)
6417{
6418	BT_DBG("chan %p", chan);
6419
6420	chan->rx_state = L2CAP_RX_STATE_RECV;
6421
6422	if (chan->hs_hcon)
6423		chan->conn->mtu = chan->hs_hcon->hdev->block_mtu;
6424	else
6425		chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu;
6426
6427	return l2cap_resegment(chan);
6428}
6429
6430static int l2cap_rx_state_wait_p(struct l2cap_chan *chan,
6431				 struct l2cap_ctrl *control,
6432				 struct sk_buff *skb, u8 event)
6433{
6434	int err;
6435
6436	BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
6437	       event);
6438
6439	if (!control->poll)
6440		return -EPROTO;
6441
6442	l2cap_process_reqseq(chan, control->reqseq);
6443
6444	if (!skb_queue_empty(&chan->tx_q))
6445		chan->tx_send_head = skb_peek(&chan->tx_q);
6446	else
6447		chan->tx_send_head = NULL;
6448
6449	/* Rewind next_tx_seq to the point expected
6450	 * by the receiver.
6451	 */
6452	chan->next_tx_seq = control->reqseq;
6453	chan->unacked_frames = 0;
6454
6455	err = l2cap_finish_move(chan);
6456	if (err)
6457		return err;
6458
6459	set_bit(CONN_SEND_FBIT, &chan->conn_state);
6460	l2cap_send_i_or_rr_or_rnr(chan);
6461
6462	if (event == L2CAP_EV_RECV_IFRAME)
6463		return -EPROTO;
6464
6465	return l2cap_rx_state_recv(chan, control, NULL, event);
6466}
6467
6468static int l2cap_rx_state_wait_f(struct l2cap_chan *chan,
6469				 struct l2cap_ctrl *control,
6470				 struct sk_buff *skb, u8 event)
6471{
6472	int err;
6473
6474	if (!control->final)
6475		return -EPROTO;
6476
6477	clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6478
6479	chan->rx_state = L2CAP_RX_STATE_RECV;
6480	l2cap_process_reqseq(chan, control->reqseq);
6481
6482	if (!skb_queue_empty(&chan->tx_q))
6483		chan->tx_send_head = skb_peek(&chan->tx_q);
6484	else
6485		chan->tx_send_head = NULL;
6486
6487	/* Rewind next_tx_seq to the point expected
6488	 * by the receiver.
6489	 */
6490	chan->next_tx_seq = control->reqseq;
6491	chan->unacked_frames = 0;
6492
6493	if (chan->hs_hcon)
6494		chan->conn->mtu = chan->hs_hcon->hdev->block_mtu;
6495	else
6496		chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu;
6497
6498	err = l2cap_resegment(chan);
6499
6500	if (!err)
6501		err = l2cap_rx_state_recv(chan, control, skb, event);
6502
6503	return err;
6504}
6505
6506static bool __valid_reqseq(struct l2cap_chan *chan, u16 reqseq)
6507{
6508	/* Make sure reqseq is for a packet that has been sent but not acked */
6509	u16 unacked;
6510
6511	unacked = __seq_offset(chan, chan->next_tx_seq, chan->expected_ack_seq);
6512	return __seq_offset(chan, chan->next_tx_seq, reqseq) <= unacked;
6513}
6514
6515static int l2cap_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
6516		    struct sk_buff *skb, u8 event)
6517{
6518	int err = 0;
6519
6520	BT_DBG("chan %p, control %p, skb %p, event %d, state %d", chan,
6521	       control, skb, event, chan->rx_state);
6522
6523	if (__valid_reqseq(chan, control->reqseq)) {
6524		switch (chan->rx_state) {
6525		case L2CAP_RX_STATE_RECV:
6526			err = l2cap_rx_state_recv(chan, control, skb, event);
6527			break;
6528		case L2CAP_RX_STATE_SREJ_SENT:
6529			err = l2cap_rx_state_srej_sent(chan, control, skb,
6530						       event);
6531			break;
6532		case L2CAP_RX_STATE_WAIT_P:
6533			err = l2cap_rx_state_wait_p(chan, control, skb, event);
6534			break;
6535		case L2CAP_RX_STATE_WAIT_F:
6536			err = l2cap_rx_state_wait_f(chan, control, skb, event);
6537			break;
6538		default:
6539			/* shut it down */
6540			break;
6541		}
6542	} else {
6543		BT_DBG("Invalid reqseq %d (next_tx_seq %d, expected_ack_seq %d",
6544		       control->reqseq, chan->next_tx_seq,
6545		       chan->expected_ack_seq);
6546		l2cap_send_disconn_req(chan, ECONNRESET);
6547	}
6548
6549	return err;
6550}
6551
6552static int l2cap_stream_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
6553			   struct sk_buff *skb)
6554{
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
6555	BT_DBG("chan %p, control %p, skb %p, state %d", chan, control, skb,
6556	       chan->rx_state);
6557
6558	if (l2cap_classify_txseq(chan, control->txseq) ==
6559	    L2CAP_TXSEQ_EXPECTED) {
6560		l2cap_pass_to_tx(chan, control);
6561
6562		BT_DBG("buffer_seq %d->%d", chan->buffer_seq,
6563		       __next_seq(chan, chan->buffer_seq));
6564
6565		chan->buffer_seq = __next_seq(chan, chan->buffer_seq);
6566
6567		l2cap_reassemble_sdu(chan, skb, control);
6568	} else {
6569		if (chan->sdu) {
6570			kfree_skb(chan->sdu);
6571			chan->sdu = NULL;
6572		}
6573		chan->sdu_last_frag = NULL;
6574		chan->sdu_len = 0;
6575
6576		if (skb) {
6577			BT_DBG("Freeing %p", skb);
6578			kfree_skb(skb);
6579		}
6580	}
6581
6582	chan->last_acked_seq = control->txseq;
6583	chan->expected_tx_seq = __next_seq(chan, control->txseq);
6584
6585	return 0;
6586}
6587
6588static int l2cap_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
6589{
6590	struct l2cap_ctrl *control = &bt_cb(skb)->l2cap;
6591	u16 len;
6592	u8 event;
6593
6594	__unpack_control(chan, skb);
6595
6596	len = skb->len;
6597
6598	/*
6599	 * We can just drop the corrupted I-frame here.
6600	 * Receiver will miss it and start proper recovery
6601	 * procedures and ask for retransmission.
6602	 */
6603	if (l2cap_check_fcs(chan, skb))
6604		goto drop;
6605
6606	if (!control->sframe && control->sar == L2CAP_SAR_START)
6607		len -= L2CAP_SDULEN_SIZE;
6608
6609	if (chan->fcs == L2CAP_FCS_CRC16)
6610		len -= L2CAP_FCS_SIZE;
6611
6612	if (len > chan->mps) {
6613		l2cap_send_disconn_req(chan, ECONNRESET);
6614		goto drop;
6615	}
6616
6617	if ((chan->mode == L2CAP_MODE_ERTM ||
6618	     chan->mode == L2CAP_MODE_STREAMING) && sk_filter(chan->data, skb))
6619		goto drop;
 
6620
6621	if (!control->sframe) {
6622		int err;
6623
6624		BT_DBG("iframe sar %d, reqseq %d, final %d, txseq %d",
6625		       control->sar, control->reqseq, control->final,
6626		       control->txseq);
6627
6628		/* Validate F-bit - F=0 always valid, F=1 only
6629		 * valid in TX WAIT_F
6630		 */
6631		if (control->final && chan->tx_state != L2CAP_TX_STATE_WAIT_F)
6632			goto drop;
6633
6634		if (chan->mode != L2CAP_MODE_STREAMING) {
6635			event = L2CAP_EV_RECV_IFRAME;
6636			err = l2cap_rx(chan, control, skb, event);
6637		} else {
6638			err = l2cap_stream_rx(chan, control, skb);
6639		}
6640
6641		if (err)
6642			l2cap_send_disconn_req(chan, ECONNRESET);
6643	} else {
6644		const u8 rx_func_to_event[4] = {
6645			L2CAP_EV_RECV_RR, L2CAP_EV_RECV_REJ,
6646			L2CAP_EV_RECV_RNR, L2CAP_EV_RECV_SREJ
6647		};
6648
6649		/* Only I-frames are expected in streaming mode */
6650		if (chan->mode == L2CAP_MODE_STREAMING)
6651			goto drop;
6652
6653		BT_DBG("sframe reqseq %d, final %d, poll %d, super %d",
6654		       control->reqseq, control->final, control->poll,
6655		       control->super);
6656
6657		if (len != 0) {
6658			BT_ERR("Trailing bytes: %d in sframe", len);
6659			l2cap_send_disconn_req(chan, ECONNRESET);
6660			goto drop;
6661		}
6662
6663		/* Validate F and P bits */
6664		if (control->final && (control->poll ||
6665				       chan->tx_state != L2CAP_TX_STATE_WAIT_F))
6666			goto drop;
6667
6668		event = rx_func_to_event[control->super];
6669		if (l2cap_rx(chan, control, skb, event))
6670			l2cap_send_disconn_req(chan, ECONNRESET);
6671	}
6672
6673	return 0;
6674
6675drop:
6676	kfree_skb(skb);
6677	return 0;
6678}
6679
6680static void l2cap_chan_le_send_credits(struct l2cap_chan *chan)
6681{
6682	struct l2cap_conn *conn = chan->conn;
6683	struct l2cap_le_credits pkt;
6684	u16 return_credits;
6685
6686	/* We return more credits to the sender only after the amount of
6687	 * credits falls below half of the initial amount.
6688	 */
6689	if (chan->rx_credits >= (le_max_credits + 1) / 2)
6690		return;
6691
6692	return_credits = le_max_credits - chan->rx_credits;
6693
6694	BT_DBG("chan %p returning %u credits to sender", chan, return_credits);
6695
6696	chan->rx_credits += return_credits;
6697
6698	pkt.cid     = cpu_to_le16(chan->scid);
6699	pkt.credits = cpu_to_le16(return_credits);
6700
6701	chan->ident = l2cap_get_ident(conn);
6702
6703	l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CREDITS, sizeof(pkt), &pkt);
6704}
6705
6706static int l2cap_le_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
6707{
6708	int err;
6709
6710	if (!chan->rx_credits) {
6711		BT_ERR("No credits to receive LE L2CAP data");
6712		l2cap_send_disconn_req(chan, ECONNRESET);
6713		return -ENOBUFS;
6714	}
6715
6716	if (chan->imtu < skb->len) {
6717		BT_ERR("Too big LE L2CAP PDU");
6718		return -ENOBUFS;
6719	}
6720
6721	chan->rx_credits--;
6722	BT_DBG("rx_credits %u -> %u", chan->rx_credits + 1, chan->rx_credits);
 
6723
6724	l2cap_chan_le_send_credits(chan);
 
 
 
 
6725
6726	err = 0;
6727
6728	if (!chan->sdu) {
6729		u16 sdu_len;
6730
6731		sdu_len = get_unaligned_le16(skb->data);
6732		skb_pull(skb, L2CAP_SDULEN_SIZE);
6733
6734		BT_DBG("Start of new SDU. sdu_len %u skb->len %u imtu %u",
6735		       sdu_len, skb->len, chan->imtu);
6736
6737		if (sdu_len > chan->imtu) {
6738			BT_ERR("Too big LE L2CAP SDU length received");
6739			err = -EMSGSIZE;
6740			goto failed;
6741		}
6742
6743		if (skb->len > sdu_len) {
6744			BT_ERR("Too much LE L2CAP data received");
6745			err = -EINVAL;
6746			goto failed;
6747		}
6748
6749		if (skb->len == sdu_len)
6750			return chan->ops->recv(chan, skb);
6751
6752		chan->sdu = skb;
6753		chan->sdu_len = sdu_len;
6754		chan->sdu_last_frag = skb;
6755
 
 
 
 
 
 
 
 
 
 
6756		return 0;
6757	}
6758
6759	BT_DBG("SDU fragment. chan->sdu->len %u skb->len %u chan->sdu_len %u",
6760	       chan->sdu->len, skb->len, chan->sdu_len);
6761
6762	if (chan->sdu->len + skb->len > chan->sdu_len) {
6763		BT_ERR("Too much LE L2CAP data received");
6764		err = -EINVAL;
6765		goto failed;
6766	}
6767
6768	append_skb_frag(chan->sdu, skb, &chan->sdu_last_frag);
6769	skb = NULL;
6770
6771	if (chan->sdu->len == chan->sdu_len) {
6772		err = chan->ops->recv(chan, chan->sdu);
6773		if (!err) {
6774			chan->sdu = NULL;
6775			chan->sdu_last_frag = NULL;
6776			chan->sdu_len = 0;
6777		}
6778	}
6779
6780failed:
6781	if (err) {
6782		kfree_skb(skb);
6783		kfree_skb(chan->sdu);
6784		chan->sdu = NULL;
6785		chan->sdu_last_frag = NULL;
6786		chan->sdu_len = 0;
6787	}
6788
6789	/* We can't return an error here since we took care of the skb
6790	 * freeing internally. An error return would cause the caller to
6791	 * do a double-free of the skb.
6792	 */
6793	return 0;
6794}
6795
6796static void l2cap_data_channel(struct l2cap_conn *conn, u16 cid,
6797			       struct sk_buff *skb)
6798{
6799	struct l2cap_chan *chan;
6800
6801	chan = l2cap_get_chan_by_scid(conn, cid);
6802	if (!chan) {
6803		if (cid == L2CAP_CID_A2MP) {
6804			chan = a2mp_channel_create(conn, skb);
6805			if (!chan) {
6806				kfree_skb(skb);
6807				return;
6808			}
6809
6810			l2cap_chan_lock(chan);
6811		} else {
6812			BT_DBG("unknown cid 0x%4.4x", cid);
6813			/* Drop packet and return */
6814			kfree_skb(skb);
6815			return;
6816		}
6817	}
6818
6819	BT_DBG("chan %p, len %d", chan, skb->len);
6820
6821	/* If we receive data on a fixed channel before the info req/rsp
6822	 * procdure is done simply assume that the channel is supported
6823	 * and mark it as ready.
6824	 */
6825	if (chan->chan_type == L2CAP_CHAN_FIXED)
6826		l2cap_chan_ready(chan);
6827
6828	if (chan->state != BT_CONNECTED)
6829		goto drop;
6830
6831	switch (chan->mode) {
6832	case L2CAP_MODE_LE_FLOWCTL:
6833		if (l2cap_le_data_rcv(chan, skb) < 0)
 
6834			goto drop;
6835
6836		goto done;
6837
6838	case L2CAP_MODE_BASIC:
6839		/* If socket recv buffers overflows we drop data here
6840		 * which is *bad* because L2CAP has to be reliable.
6841		 * But we don't have any other choice. L2CAP doesn't
6842		 * provide flow control mechanism. */
6843
6844		if (chan->imtu < skb->len) {
6845			BT_ERR("Dropping L2CAP data: receive buffer overflow");
6846			goto drop;
6847		}
6848
6849		if (!chan->ops->recv(chan, skb))
6850			goto done;
6851		break;
6852
6853	case L2CAP_MODE_ERTM:
6854	case L2CAP_MODE_STREAMING:
6855		l2cap_data_rcv(chan, skb);
6856		goto done;
6857
6858	default:
6859		BT_DBG("chan %p: bad mode 0x%2.2x", chan, chan->mode);
6860		break;
6861	}
6862
6863drop:
6864	kfree_skb(skb);
6865
6866done:
6867	l2cap_chan_unlock(chan);
 
6868}
6869
6870static void l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm,
6871				  struct sk_buff *skb)
6872{
6873	struct hci_conn *hcon = conn->hcon;
6874	struct l2cap_chan *chan;
6875
6876	if (hcon->type != ACL_LINK)
6877		goto free_skb;
6878
6879	chan = l2cap_global_chan_by_psm(0, psm, &hcon->src, &hcon->dst,
6880					ACL_LINK);
6881	if (!chan)
6882		goto free_skb;
6883
6884	BT_DBG("chan %p, len %d", chan, skb->len);
6885
 
 
6886	if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)
6887		goto drop;
6888
6889	if (chan->imtu < skb->len)
6890		goto drop;
6891
6892	/* Store remote BD_ADDR and PSM for msg_name */
6893	bacpy(&bt_cb(skb)->l2cap.bdaddr, &hcon->dst);
6894	bt_cb(skb)->l2cap.psm = psm;
6895
6896	if (!chan->ops->recv(chan, skb)) {
 
6897		l2cap_chan_put(chan);
6898		return;
6899	}
6900
6901drop:
 
6902	l2cap_chan_put(chan);
6903free_skb:
6904	kfree_skb(skb);
6905}
6906
6907static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
6908{
6909	struct l2cap_hdr *lh = (void *) skb->data;
6910	struct hci_conn *hcon = conn->hcon;
6911	u16 cid, len;
6912	__le16 psm;
6913
6914	if (hcon->state != BT_CONNECTED) {
6915		BT_DBG("queueing pending rx skb");
6916		skb_queue_tail(&conn->pending_rx, skb);
6917		return;
6918	}
6919
6920	skb_pull(skb, L2CAP_HDR_SIZE);
6921	cid = __le16_to_cpu(lh->cid);
6922	len = __le16_to_cpu(lh->len);
6923
6924	if (len != skb->len) {
6925		kfree_skb(skb);
6926		return;
6927	}
6928
6929	/* Since we can't actively block incoming LE connections we must
6930	 * at least ensure that we ignore incoming data from them.
6931	 */
6932	if (hcon->type == LE_LINK &&
6933	    hci_bdaddr_list_lookup(&hcon->hdev->blacklist, &hcon->dst,
6934				   bdaddr_dst_type(hcon))) {
6935		kfree_skb(skb);
6936		return;
6937	}
6938
6939	BT_DBG("len %d, cid 0x%4.4x", len, cid);
6940
6941	switch (cid) {
6942	case L2CAP_CID_SIGNALING:
6943		l2cap_sig_channel(conn, skb);
6944		break;
6945
6946	case L2CAP_CID_CONN_LESS:
6947		psm = get_unaligned((__le16 *) skb->data);
6948		skb_pull(skb, L2CAP_PSMLEN_SIZE);
6949		l2cap_conless_channel(conn, psm, skb);
6950		break;
6951
6952	case L2CAP_CID_LE_SIGNALING:
6953		l2cap_le_sig_channel(conn, skb);
6954		break;
6955
6956	default:
6957		l2cap_data_channel(conn, cid, skb);
6958		break;
6959	}
6960}
6961
6962static void process_pending_rx(struct work_struct *work)
6963{
6964	struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
6965					       pending_rx_work);
6966	struct sk_buff *skb;
6967
6968	BT_DBG("");
6969
6970	while ((skb = skb_dequeue(&conn->pending_rx)))
6971		l2cap_recv_frame(conn, skb);
6972}
6973
6974static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon)
6975{
6976	struct l2cap_conn *conn = hcon->l2cap_data;
6977	struct hci_chan *hchan;
6978
6979	if (conn)
6980		return conn;
6981
6982	hchan = hci_chan_create(hcon);
6983	if (!hchan)
6984		return NULL;
6985
6986	conn = kzalloc(sizeof(*conn), GFP_KERNEL);
6987	if (!conn) {
6988		hci_chan_del(hchan);
6989		return NULL;
6990	}
6991
6992	kref_init(&conn->ref);
6993	hcon->l2cap_data = conn;
6994	conn->hcon = hci_conn_get(hcon);
6995	conn->hchan = hchan;
6996
6997	BT_DBG("hcon %p conn %p hchan %p", hcon, conn, hchan);
6998
6999	switch (hcon->type) {
7000	case LE_LINK:
7001		if (hcon->hdev->le_mtu) {
7002			conn->mtu = hcon->hdev->le_mtu;
7003			break;
7004		}
7005		/* fall through */
7006	default:
7007		conn->mtu = hcon->hdev->acl_mtu;
7008		break;
7009	}
7010
7011	conn->feat_mask = 0;
7012
7013	conn->local_fixed_chan = L2CAP_FC_SIG_BREDR | L2CAP_FC_CONNLESS;
7014
7015	if (hcon->type == ACL_LINK &&
7016	    hci_dev_test_flag(hcon->hdev, HCI_HS_ENABLED))
7017		conn->local_fixed_chan |= L2CAP_FC_A2MP;
7018
7019	if (hci_dev_test_flag(hcon->hdev, HCI_LE_ENABLED) &&
7020	    (bredr_sc_enabled(hcon->hdev) ||
7021	     hci_dev_test_flag(hcon->hdev, HCI_FORCE_BREDR_SMP)))
7022		conn->local_fixed_chan |= L2CAP_FC_SMP_BREDR;
7023
7024	mutex_init(&conn->ident_lock);
7025	mutex_init(&conn->chan_lock);
7026
7027	INIT_LIST_HEAD(&conn->chan_l);
7028	INIT_LIST_HEAD(&conn->users);
7029
7030	INIT_DELAYED_WORK(&conn->info_timer, l2cap_info_timeout);
7031
7032	skb_queue_head_init(&conn->pending_rx);
7033	INIT_WORK(&conn->pending_rx_work, process_pending_rx);
7034	INIT_WORK(&conn->id_addr_update_work, l2cap_conn_update_id_addr);
7035
7036	conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
7037
7038	return conn;
7039}
7040
7041static bool is_valid_psm(u16 psm, u8 dst_type) {
 
7042	if (!psm)
7043		return false;
7044
7045	if (bdaddr_type_is_le(dst_type))
7046		return (psm <= 0x00ff);
7047
7048	/* PSM must be odd and lsb of upper byte must be 0 */
7049	return ((psm & 0x0101) == 0x0001);
7050}
7051
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
7052int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,
7053		       bdaddr_t *dst, u8 dst_type)
7054{
7055	struct l2cap_conn *conn;
7056	struct hci_conn *hcon;
7057	struct hci_dev *hdev;
7058	int err;
7059
7060	BT_DBG("%pMR -> %pMR (type %u) psm 0x%2.2x", &chan->src, dst,
7061	       dst_type, __le16_to_cpu(psm));
7062
7063	hdev = hci_get_route(dst, &chan->src, chan->src_type);
7064	if (!hdev)
7065		return -EHOSTUNREACH;
7066
7067	hci_dev_lock(hdev);
7068
7069	if (!is_valid_psm(__le16_to_cpu(psm), dst_type) && !cid &&
7070	    chan->chan_type != L2CAP_CHAN_RAW) {
7071		err = -EINVAL;
7072		goto done;
7073	}
7074
7075	if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED && !psm) {
7076		err = -EINVAL;
7077		goto done;
7078	}
7079
7080	if (chan->chan_type == L2CAP_CHAN_FIXED && !cid) {
7081		err = -EINVAL;
7082		goto done;
7083	}
7084
7085	switch (chan->mode) {
7086	case L2CAP_MODE_BASIC:
7087		break;
7088	case L2CAP_MODE_LE_FLOWCTL:
7089		l2cap_le_flowctl_init(chan);
 
 
 
 
 
7090		break;
7091	case L2CAP_MODE_ERTM:
7092	case L2CAP_MODE_STREAMING:
7093		if (!disable_ertm)
7094			break;
7095		/* fall through */
7096	default:
7097		err = -EOPNOTSUPP;
7098		goto done;
7099	}
7100
7101	switch (chan->state) {
7102	case BT_CONNECT:
7103	case BT_CONNECT2:
7104	case BT_CONFIG:
7105		/* Already connecting */
7106		err = 0;
7107		goto done;
7108
7109	case BT_CONNECTED:
7110		/* Already connected */
7111		err = -EISCONN;
7112		goto done;
7113
7114	case BT_OPEN:
7115	case BT_BOUND:
7116		/* Can connect */
7117		break;
7118
7119	default:
7120		err = -EBADFD;
7121		goto done;
7122	}
7123
7124	/* Set destination address and psm */
7125	bacpy(&chan->dst, dst);
7126	chan->dst_type = dst_type;
7127
7128	chan->psm = psm;
7129	chan->dcid = cid;
7130
7131	if (bdaddr_type_is_le(dst_type)) {
7132		/* Convert from L2CAP channel address type to HCI address type
7133		 */
7134		if (dst_type == BDADDR_LE_PUBLIC)
7135			dst_type = ADDR_LE_DEV_PUBLIC;
7136		else
7137			dst_type = ADDR_LE_DEV_RANDOM;
7138
7139		if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
7140			hcon = hci_connect_le(hdev, dst, dst_type,
7141					      chan->sec_level,
7142					      HCI_LE_CONN_TIMEOUT,
7143					      HCI_ROLE_SLAVE);
7144		else
7145			hcon = hci_connect_le_scan(hdev, dst, dst_type,
7146						   chan->sec_level,
7147						   HCI_LE_CONN_TIMEOUT);
7148
7149	} else {
7150		u8 auth_type = l2cap_get_auth_type(chan);
7151		hcon = hci_connect_acl(hdev, dst, chan->sec_level, auth_type);
 
7152	}
7153
7154	if (IS_ERR(hcon)) {
7155		err = PTR_ERR(hcon);
7156		goto done;
7157	}
7158
7159	conn = l2cap_conn_add(hcon);
7160	if (!conn) {
7161		hci_conn_drop(hcon);
7162		err = -ENOMEM;
7163		goto done;
7164	}
7165
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
7166	mutex_lock(&conn->chan_lock);
7167	l2cap_chan_lock(chan);
7168
7169	if (cid && __l2cap_get_chan_by_dcid(conn, cid)) {
7170		hci_conn_drop(hcon);
7171		err = -EBUSY;
7172		goto chan_unlock;
7173	}
7174
7175	/* Update source addr of the socket */
7176	bacpy(&chan->src, &hcon->src);
7177	chan->src_type = bdaddr_src_type(hcon);
7178
7179	__l2cap_chan_add(conn, chan);
7180
7181	/* l2cap_chan_add takes its own ref so we can drop this one */
7182	hci_conn_drop(hcon);
7183
7184	l2cap_state_change(chan, BT_CONNECT);
7185	__set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
7186
7187	/* Release chan->sport so that it can be reused by other
7188	 * sockets (as it's only used for listening sockets).
7189	 */
7190	write_lock(&chan_list_lock);
7191	chan->sport = 0;
7192	write_unlock(&chan_list_lock);
7193
7194	if (hcon->state == BT_CONNECTED) {
7195		if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
7196			__clear_chan_timer(chan);
7197			if (l2cap_chan_check_security(chan, true))
7198				l2cap_state_change(chan, BT_CONNECTED);
7199		} else
7200			l2cap_do_start(chan);
7201	}
7202
7203	err = 0;
7204
7205chan_unlock:
7206	l2cap_chan_unlock(chan);
7207	mutex_unlock(&conn->chan_lock);
7208done:
7209	hci_dev_unlock(hdev);
7210	hci_dev_put(hdev);
7211	return err;
7212}
7213EXPORT_SYMBOL_GPL(l2cap_chan_connect);
7214
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
7215/* ---- L2CAP interface with lower layer (HCI) ---- */
7216
7217int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr)
7218{
7219	int exact = 0, lm1 = 0, lm2 = 0;
7220	struct l2cap_chan *c;
7221
7222	BT_DBG("hdev %s, bdaddr %pMR", hdev->name, bdaddr);
7223
7224	/* Find listening sockets and check their link_mode */
7225	read_lock(&chan_list_lock);
7226	list_for_each_entry(c, &chan_list, global_l) {
7227		if (c->state != BT_LISTEN)
7228			continue;
7229
7230		if (!bacmp(&c->src, &hdev->bdaddr)) {
7231			lm1 |= HCI_LM_ACCEPT;
7232			if (test_bit(FLAG_ROLE_SWITCH, &c->flags))
7233				lm1 |= HCI_LM_MASTER;
7234			exact++;
7235		} else if (!bacmp(&c->src, BDADDR_ANY)) {
7236			lm2 |= HCI_LM_ACCEPT;
7237			if (test_bit(FLAG_ROLE_SWITCH, &c->flags))
7238				lm2 |= HCI_LM_MASTER;
7239		}
7240	}
7241	read_unlock(&chan_list_lock);
7242
7243	return exact ? lm1 : lm2;
7244}
7245
7246/* Find the next fixed channel in BT_LISTEN state, continue iteration
7247 * from an existing channel in the list or from the beginning of the
7248 * global list (by passing NULL as first parameter).
7249 */
7250static struct l2cap_chan *l2cap_global_fixed_chan(struct l2cap_chan *c,
7251						  struct hci_conn *hcon)
7252{
7253	u8 src_type = bdaddr_src_type(hcon);
7254
7255	read_lock(&chan_list_lock);
7256
7257	if (c)
7258		c = list_next_entry(c, global_l);
7259	else
7260		c = list_entry(chan_list.next, typeof(*c), global_l);
7261
7262	list_for_each_entry_from(c, &chan_list, global_l) {
7263		if (c->chan_type != L2CAP_CHAN_FIXED)
7264			continue;
7265		if (c->state != BT_LISTEN)
7266			continue;
7267		if (bacmp(&c->src, &hcon->src) && bacmp(&c->src, BDADDR_ANY))
7268			continue;
7269		if (src_type != c->src_type)
7270			continue;
7271
7272		l2cap_chan_hold(c);
7273		read_unlock(&chan_list_lock);
7274		return c;
7275	}
7276
7277	read_unlock(&chan_list_lock);
7278
7279	return NULL;
7280}
7281
 
 
 
 
 
7282static void l2cap_connect_cfm(struct hci_conn *hcon, u8 status)
7283{
7284	struct hci_dev *hdev = hcon->hdev;
7285	struct l2cap_conn *conn;
7286	struct l2cap_chan *pchan;
7287	u8 dst_type;
7288
7289	if (hcon->type != ACL_LINK && hcon->type != LE_LINK)
7290		return;
7291
7292	BT_DBG("hcon %p bdaddr %pMR status %d", hcon, &hcon->dst, status);
7293
7294	if (status) {
7295		l2cap_conn_del(hcon, bt_to_errno(status));
7296		return;
7297	}
7298
7299	conn = l2cap_conn_add(hcon);
7300	if (!conn)
7301		return;
7302
7303	dst_type = bdaddr_dst_type(hcon);
7304
7305	/* If device is blocked, do not create channels for it */
7306	if (hci_bdaddr_list_lookup(&hdev->blacklist, &hcon->dst, dst_type))
7307		return;
7308
7309	/* Find fixed channels and notify them of the new connection. We
7310	 * use multiple individual lookups, continuing each time where
7311	 * we left off, because the list lock would prevent calling the
7312	 * potentially sleeping l2cap_chan_lock() function.
7313	 */
7314	pchan = l2cap_global_fixed_chan(NULL, hcon);
7315	while (pchan) {
7316		struct l2cap_chan *chan, *next;
7317
7318		/* Client fixed channels should override server ones */
7319		if (__l2cap_get_chan_by_dcid(conn, pchan->scid))
7320			goto next;
7321
7322		l2cap_chan_lock(pchan);
7323		chan = pchan->ops->new_connection(pchan);
7324		if (chan) {
7325			bacpy(&chan->src, &hcon->src);
7326			bacpy(&chan->dst, &hcon->dst);
7327			chan->src_type = bdaddr_src_type(hcon);
7328			chan->dst_type = dst_type;
7329
7330			__l2cap_chan_add(conn, chan);
7331		}
7332
7333		l2cap_chan_unlock(pchan);
7334next:
7335		next = l2cap_global_fixed_chan(pchan, hcon);
7336		l2cap_chan_put(pchan);
7337		pchan = next;
7338	}
7339
7340	l2cap_conn_ready(conn);
7341}
7342
7343int l2cap_disconn_ind(struct hci_conn *hcon)
7344{
7345	struct l2cap_conn *conn = hcon->l2cap_data;
7346
7347	BT_DBG("hcon %p", hcon);
7348
7349	if (!conn)
7350		return HCI_ERROR_REMOTE_USER_TERM;
7351	return conn->disc_reason;
7352}
7353
7354static void l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason)
7355{
7356	if (hcon->type != ACL_LINK && hcon->type != LE_LINK)
7357		return;
7358
7359	BT_DBG("hcon %p reason %d", hcon, reason);
7360
7361	l2cap_conn_del(hcon, bt_to_errno(reason));
7362}
7363
7364static inline void l2cap_check_encryption(struct l2cap_chan *chan, u8 encrypt)
7365{
7366	if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED)
7367		return;
7368
7369	if (encrypt == 0x00) {
7370		if (chan->sec_level == BT_SECURITY_MEDIUM) {
7371			__set_chan_timer(chan, L2CAP_ENC_TIMEOUT);
7372		} else if (chan->sec_level == BT_SECURITY_HIGH ||
7373			   chan->sec_level == BT_SECURITY_FIPS)
7374			l2cap_chan_close(chan, ECONNREFUSED);
7375	} else {
7376		if (chan->sec_level == BT_SECURITY_MEDIUM)
7377			__clear_chan_timer(chan);
7378	}
7379}
7380
7381static void l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
7382{
7383	struct l2cap_conn *conn = hcon->l2cap_data;
7384	struct l2cap_chan *chan;
7385
7386	if (!conn)
7387		return;
7388
7389	BT_DBG("conn %p status 0x%2.2x encrypt %u", conn, status, encrypt);
7390
7391	mutex_lock(&conn->chan_lock);
7392
7393	list_for_each_entry(chan, &conn->chan_l, list) {
7394		l2cap_chan_lock(chan);
7395
7396		BT_DBG("chan %p scid 0x%4.4x state %s", chan, chan->scid,
7397		       state_to_string(chan->state));
7398
7399		if (chan->scid == L2CAP_CID_A2MP) {
7400			l2cap_chan_unlock(chan);
7401			continue;
7402		}
7403
7404		if (!status && encrypt)
7405			chan->sec_level = hcon->sec_level;
7406
7407		if (!__l2cap_no_conn_pending(chan)) {
7408			l2cap_chan_unlock(chan);
7409			continue;
7410		}
7411
7412		if (!status && (chan->state == BT_CONNECTED ||
7413				chan->state == BT_CONFIG)) {
7414			chan->ops->resume(chan);
7415			l2cap_check_encryption(chan, encrypt);
7416			l2cap_chan_unlock(chan);
7417			continue;
7418		}
7419
7420		if (chan->state == BT_CONNECT) {
7421			if (!status)
7422				l2cap_start_connection(chan);
7423			else
7424				__set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
7425		} else if (chan->state == BT_CONNECT2 &&
7426			   chan->mode != L2CAP_MODE_LE_FLOWCTL) {
 
7427			struct l2cap_conn_rsp rsp;
7428			__u16 res, stat;
7429
7430			if (!status) {
7431				if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
7432					res = L2CAP_CR_PEND;
7433					stat = L2CAP_CS_AUTHOR_PEND;
7434					chan->ops->defer(chan);
7435				} else {
7436					l2cap_state_change(chan, BT_CONFIG);
7437					res = L2CAP_CR_SUCCESS;
7438					stat = L2CAP_CS_NO_INFO;
7439				}
7440			} else {
7441				l2cap_state_change(chan, BT_DISCONN);
7442				__set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
7443				res = L2CAP_CR_SEC_BLOCK;
7444				stat = L2CAP_CS_NO_INFO;
7445			}
7446
7447			rsp.scid   = cpu_to_le16(chan->dcid);
7448			rsp.dcid   = cpu_to_le16(chan->scid);
7449			rsp.result = cpu_to_le16(res);
7450			rsp.status = cpu_to_le16(stat);
7451			l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
7452				       sizeof(rsp), &rsp);
7453
7454			if (!test_bit(CONF_REQ_SENT, &chan->conf_state) &&
7455			    res == L2CAP_CR_SUCCESS) {
7456				char buf[128];
7457				set_bit(CONF_REQ_SENT, &chan->conf_state);
7458				l2cap_send_cmd(conn, l2cap_get_ident(conn),
7459					       L2CAP_CONF_REQ,
7460					       l2cap_build_conf_req(chan, buf),
7461					       buf);
7462				chan->num_conf_req++;
7463			}
7464		}
7465
7466		l2cap_chan_unlock(chan);
7467	}
7468
7469	mutex_unlock(&conn->chan_lock);
7470}
7471
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
7472void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
7473{
7474	struct l2cap_conn *conn = hcon->l2cap_data;
7475	struct l2cap_hdr *hdr;
7476	int len;
7477
7478	/* For AMP controller do not create l2cap conn */
7479	if (!conn && hcon->hdev->dev_type != HCI_PRIMARY)
7480		goto drop;
7481
7482	if (!conn)
7483		conn = l2cap_conn_add(hcon);
7484
7485	if (!conn)
7486		goto drop;
7487
7488	BT_DBG("conn %p len %d flags 0x%x", conn, skb->len, flags);
7489
7490	switch (flags) {
7491	case ACL_START:
7492	case ACL_START_NO_FLUSH:
7493	case ACL_COMPLETE:
7494		if (conn->rx_len) {
7495			BT_ERR("Unexpected start frame (len %d)", skb->len);
7496			kfree_skb(conn->rx_skb);
7497			conn->rx_skb = NULL;
7498			conn->rx_len = 0;
7499			l2cap_conn_unreliable(conn, ECOMM);
7500		}
7501
7502		/* Start fragment always begin with Basic L2CAP header */
7503		if (skb->len < L2CAP_HDR_SIZE) {
7504			BT_ERR("Frame is too short (len %d)", skb->len);
7505			l2cap_conn_unreliable(conn, ECOMM);
7506			goto drop;
 
 
7507		}
7508
7509		hdr = (struct l2cap_hdr *) skb->data;
7510		len = __le16_to_cpu(hdr->len) + L2CAP_HDR_SIZE;
7511
7512		if (len == skb->len) {
7513			/* Complete frame received */
7514			l2cap_recv_frame(conn, skb);
7515			return;
7516		}
7517
7518		BT_DBG("Start: total len %d, frag len %d", len, skb->len);
7519
7520		if (skb->len > len) {
7521			BT_ERR("Frame is too long (len %d, expected len %d)",
7522			       skb->len, len);
7523			l2cap_conn_unreliable(conn, ECOMM);
7524			goto drop;
7525		}
7526
7527		/* Allocate skb for the complete frame (with header) */
7528		conn->rx_skb = bt_skb_alloc(len, GFP_KERNEL);
7529		if (!conn->rx_skb)
7530			goto drop;
7531
7532		skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
7533					  skb->len);
7534		conn->rx_len = len - skb->len;
7535		break;
7536
7537	case ACL_CONT:
7538		BT_DBG("Cont: frag len %d (expecting %d)", skb->len, conn->rx_len);
7539
7540		if (!conn->rx_len) {
7541			BT_ERR("Unexpected continuation frame (len %d)", skb->len);
7542			l2cap_conn_unreliable(conn, ECOMM);
7543			goto drop;
7544		}
7545
 
 
 
 
 
 
 
 
 
 
 
 
7546		if (skb->len > conn->rx_len) {
7547			BT_ERR("Fragment is too long (len %d, expected %d)",
7548			       skb->len, conn->rx_len);
7549			kfree_skb(conn->rx_skb);
7550			conn->rx_skb = NULL;
7551			conn->rx_len = 0;
7552			l2cap_conn_unreliable(conn, ECOMM);
7553			goto drop;
7554		}
7555
7556		skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
7557					  skb->len);
7558		conn->rx_len -= skb->len;
7559
7560		if (!conn->rx_len) {
7561			/* Complete frame received. l2cap_recv_frame
7562			 * takes ownership of the skb so set the global
7563			 * rx_skb pointer to NULL first.
7564			 */
7565			struct sk_buff *rx_skb = conn->rx_skb;
7566			conn->rx_skb = NULL;
7567			l2cap_recv_frame(conn, rx_skb);
7568		}
7569		break;
7570	}
7571
7572drop:
7573	kfree_skb(skb);
7574}
7575
7576static struct hci_cb l2cap_cb = {
7577	.name		= "L2CAP",
 
7578	.connect_cfm	= l2cap_connect_cfm,
7579	.disconn_cfm	= l2cap_disconn_cfm,
7580	.security_cfm	= l2cap_security_cfm,
7581};
7582
7583static int l2cap_debugfs_show(struct seq_file *f, void *p)
7584{
7585	struct l2cap_chan *c;
7586
7587	read_lock(&chan_list_lock);
7588
7589	list_for_each_entry(c, &chan_list, global_l) {
7590		seq_printf(f, "%pMR (%u) %pMR (%u) %d %d 0x%4.4x 0x%4.4x %d %d %d %d\n",
7591			   &c->src, c->src_type, &c->dst, c->dst_type,
7592			   c->state, __le16_to_cpu(c->psm),
7593			   c->scid, c->dcid, c->imtu, c->omtu,
7594			   c->sec_level, c->mode);
7595	}
7596
7597	read_unlock(&chan_list_lock);
7598
7599	return 0;
7600}
7601
7602static int l2cap_debugfs_open(struct inode *inode, struct file *file)
7603{
7604	return single_open(file, l2cap_debugfs_show, inode->i_private);
7605}
7606
7607static const struct file_operations l2cap_debugfs_fops = {
7608	.open		= l2cap_debugfs_open,
7609	.read		= seq_read,
7610	.llseek		= seq_lseek,
7611	.release	= single_release,
7612};
7613
7614static struct dentry *l2cap_debugfs;
7615
7616int __init l2cap_init(void)
7617{
7618	int err;
7619
7620	err = l2cap_init_sockets();
7621	if (err < 0)
7622		return err;
7623
7624	hci_register_cb(&l2cap_cb);
7625
7626	if (IS_ERR_OR_NULL(bt_debugfs))
7627		return 0;
7628
7629	l2cap_debugfs = debugfs_create_file("l2cap", 0444, bt_debugfs,
7630					    NULL, &l2cap_debugfs_fops);
7631
7632	debugfs_create_u16("l2cap_le_max_credits", 0644, bt_debugfs,
7633			   &le_max_credits);
7634	debugfs_create_u16("l2cap_le_default_mps", 0644, bt_debugfs,
7635			   &le_default_mps);
7636
7637	return 0;
7638}
7639
7640void l2cap_exit(void)
7641{
7642	debugfs_remove(l2cap_debugfs);
7643	hci_unregister_cb(&l2cap_cb);
7644	l2cap_cleanup_sockets();
7645}
7646
7647module_param(disable_ertm, bool, 0644);
7648MODULE_PARM_DESC(disable_ertm, "Disable enhanced retransmission mode");