1/*
   2   BlueZ - Bluetooth protocol stack for Linux
   3   Copyright (C) 2000-2001 Qualcomm Incorporated
   4   Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
   5   Copyright (C) 2010 Google Inc.
   6   Copyright (C) 2011 ProFUSION Embedded Systems
   7   Copyright (c) 2012 Code Aurora Forum.  All rights reserved.
   8
   9   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
  10
  11   This program is free software; you can redistribute it and/or modify
  12   it under the terms of the GNU General Public License version 2 as
  13   published by the Free Software Foundation;
  14
  15   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  16   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  17   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  18   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  19   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  20   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  21   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  22   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  23
  24   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  25   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  26   SOFTWARE IS DISCLAIMED.
  27*/
  28
  29/* Bluetooth L2CAP core. */
  30
  31#include <linux/module.h>
  32
 
 
 
 
 
 
 
 
 
 
 
 
 
 
  33#include <linux/debugfs.h>
 
 
  34#include <linux/crc16.h>
  35#include <linux/filter.h>
 
 
  36
  37#include <net/bluetooth/bluetooth.h>
  38#include <net/bluetooth/hci_core.h>
  39#include <net/bluetooth/l2cap.h>
  40
  41#include "smp.h"
  42
  43#define LE_FLOWCTL_MAX_CREDITS 65535
  44
  45bool disable_ertm;
  46bool enable_ecred = IS_ENABLED(CONFIG_BT_LE_L2CAP_ECRED);
  47
  48static u32 l2cap_feat_mask = L2CAP_FEAT_FIXED_CHAN | L2CAP_FEAT_UCD;
 
  49
  50static LIST_HEAD(chan_list);
  51static DEFINE_RWLOCK(chan_list_lock);
  52
  53static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
  54				       u8 code, u8 ident, u16 dlen, void *data);
  55static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
  56			   void *data);
  57static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size);
  58static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err);
  59
  60static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
  61		     struct sk_buff_head *skbs, u8 event);
  62static void l2cap_retrans_timeout(struct work_struct *work);
  63static void l2cap_monitor_timeout(struct work_struct *work);
  64static void l2cap_ack_timeout(struct work_struct *work);
  65
  66static inline u8 bdaddr_type(u8 link_type, u8 bdaddr_type)
  67{
  68	if (link_type == LE_LINK) {
  69		if (bdaddr_type == ADDR_LE_DEV_PUBLIC)
  70			return BDADDR_LE_PUBLIC;
  71		else
  72			return BDADDR_LE_RANDOM;
  73	}
  74
  75	return BDADDR_BREDR;
  76}
  77
  78static inline u8 bdaddr_src_type(struct hci_conn *hcon)
  79{
  80	return bdaddr_type(hcon->type, hcon->src_type);
  81}
  82
  83static inline u8 bdaddr_dst_type(struct hci_conn *hcon)
  84{
  85	return bdaddr_type(hcon->type, hcon->dst_type);
  86}
  87
  88/* ---- L2CAP channels ---- */
  89
  90static struct l2cap_chan *__l2cap_get_chan_by_dcid(struct l2cap_conn *conn,
  91						   u16 cid)
  92{
  93	struct l2cap_chan *c;
  94
  95	list_for_each_entry(c, &conn->chan_l, list) {
  96		if (c->dcid == cid)
  97			return c;
  98	}
  99	return NULL;
 100}
 101
 102static struct l2cap_chan *__l2cap_get_chan_by_scid(struct l2cap_conn *conn,
 103						   u16 cid)
 104{
 105	struct l2cap_chan *c;
 106
 107	list_for_each_entry(c, &conn->chan_l, list) {
 108		if (c->scid == cid)
 109			return c;
 110	}
 111	return NULL;
 112}
 113
 114/* Find channel with given SCID.
 115 * Returns a reference locked channel.
 116 */
 117static struct l2cap_chan *l2cap_get_chan_by_scid(struct l2cap_conn *conn,
 118						 u16 cid)
 119{
 120	struct l2cap_chan *c;
 121
 122	mutex_lock(&conn->chan_lock);
 123	c = __l2cap_get_chan_by_scid(conn, cid);
 124	if (c) {
 125		/* Only lock if chan reference is not 0 */
 126		c = l2cap_chan_hold_unless_zero(c);
 127		if (c)
 128			l2cap_chan_lock(c);
 129	}
 130	mutex_unlock(&conn->chan_lock);
 131
 132	return c;
 133}
 134
 135/* Find channel with given DCID.
 136 * Returns a reference locked channel.
 137 */
 138static struct l2cap_chan *l2cap_get_chan_by_dcid(struct l2cap_conn *conn,
 139						 u16 cid)
 140{
 141	struct l2cap_chan *c;
 142
 143	mutex_lock(&conn->chan_lock);
 144	c = __l2cap_get_chan_by_dcid(conn, cid);
 145	if (c) {
 146		/* Only lock if chan reference is not 0 */
 147		c = l2cap_chan_hold_unless_zero(c);
 148		if (c)
 149			l2cap_chan_lock(c);
 150	}
 151	mutex_unlock(&conn->chan_lock);
 152
 153	return c;
 154}
 155
 156static struct l2cap_chan *__l2cap_get_chan_by_ident(struct l2cap_conn *conn,
 157						    u8 ident)
 158{
 159	struct l2cap_chan *c;
 160
 161	list_for_each_entry(c, &conn->chan_l, list) {
 162		if (c->ident == ident)
 163			return c;
 164	}
 165	return NULL;
 166}
 167
 168static struct l2cap_chan *__l2cap_global_chan_by_addr(__le16 psm, bdaddr_t *src,
 169						      u8 src_type)
 170{
 171	struct l2cap_chan *c;
 172
 173	list_for_each_entry(c, &chan_list, global_l) {
 174		if (src_type == BDADDR_BREDR && c->src_type != BDADDR_BREDR)
 175			continue;
 176
 177		if (src_type != BDADDR_BREDR && c->src_type == BDADDR_BREDR)
 178			continue;
 179
 180		if (c->sport == psm && !bacmp(&c->src, src))
 181			return c;
 182	}
 183	return NULL;
 184}
 185
 186int l2cap_add_psm(struct l2cap_chan *chan, bdaddr_t *src, __le16 psm)
 187{
 188	int err;
 189
 190	write_lock(&chan_list_lock);
 191
 192	if (psm && __l2cap_global_chan_by_addr(psm, src, chan->src_type)) {
 193		err = -EADDRINUSE;
 194		goto done;
 195	}
 196
 197	if (psm) {
 198		chan->psm = psm;
 199		chan->sport = psm;
 200		err = 0;
 201	} else {
 202		u16 p, start, end, incr;
 203
 204		if (chan->src_type == BDADDR_BREDR) {
 205			start = L2CAP_PSM_DYN_START;
 206			end = L2CAP_PSM_AUTO_END;
 207			incr = 2;
 208		} else {
 209			start = L2CAP_PSM_LE_DYN_START;
 210			end = L2CAP_PSM_LE_DYN_END;
 211			incr = 1;
 212		}
 213
 214		err = -EINVAL;
 215		for (p = start; p <= end; p += incr)
 216			if (!__l2cap_global_chan_by_addr(cpu_to_le16(p), src,
 217							 chan->src_type)) {
 218				chan->psm   = cpu_to_le16(p);
 219				chan->sport = cpu_to_le16(p);
 220				err = 0;
 221				break;
 222			}
 223	}
 224
 225done:
 226	write_unlock(&chan_list_lock);
 227	return err;
 228}
 229EXPORT_SYMBOL_GPL(l2cap_add_psm);
 230
 231int l2cap_add_scid(struct l2cap_chan *chan,  __u16 scid)
 232{
 233	write_lock(&chan_list_lock);
 234
 235	/* Override the defaults (which are for conn-oriented) */
 236	chan->omtu = L2CAP_DEFAULT_MTU;
 237	chan->chan_type = L2CAP_CHAN_FIXED;
 238
 239	chan->scid = scid;
 240
 241	write_unlock(&chan_list_lock);
 242
 243	return 0;
 244}
 245
 246static u16 l2cap_alloc_cid(struct l2cap_conn *conn)
 247{
 248	u16 cid, dyn_end;
 249
 250	if (conn->hcon->type == LE_LINK)
 251		dyn_end = L2CAP_CID_LE_DYN_END;
 252	else
 253		dyn_end = L2CAP_CID_DYN_END;
 254
 255	for (cid = L2CAP_CID_DYN_START; cid <= dyn_end; cid++) {
 256		if (!__l2cap_get_chan_by_scid(conn, cid))
 257			return cid;
 258	}
 259
 260	return 0;
 261}
 262
 263static void l2cap_state_change(struct l2cap_chan *chan, int state)
 264{
 265	BT_DBG("chan %p %s -> %s", chan, state_to_string(chan->state),
 266	       state_to_string(state));
 267
 268	chan->state = state;
 269	chan->ops->state_change(chan, state, 0);
 270}
 271
 272static inline void l2cap_state_change_and_error(struct l2cap_chan *chan,
 273						int state, int err)
 274{
 275	chan->state = state;
 276	chan->ops->state_change(chan, chan->state, err);
 277}
 278
 279static inline void l2cap_chan_set_err(struct l2cap_chan *chan, int err)
 280{
 281	chan->ops->state_change(chan, chan->state, err);
 282}
 283
 284static void __set_retrans_timer(struct l2cap_chan *chan)
 285{
 286	if (!delayed_work_pending(&chan->monitor_timer) &&
 287	    chan->retrans_timeout) {
 288		l2cap_set_timer(chan, &chan->retrans_timer,
 289				msecs_to_jiffies(chan->retrans_timeout));
 290	}
 291}
 292
 293static void __set_monitor_timer(struct l2cap_chan *chan)
 294{
 295	__clear_retrans_timer(chan);
 296	if (chan->monitor_timeout) {
 297		l2cap_set_timer(chan, &chan->monitor_timer,
 298				msecs_to_jiffies(chan->monitor_timeout));
 299	}
 300}
 301
 302static struct sk_buff *l2cap_ertm_seq_in_queue(struct sk_buff_head *head,
 303					       u16 seq)
 304{
 305	struct sk_buff *skb;
 306
 307	skb_queue_walk(head, skb) {
 308		if (bt_cb(skb)->l2cap.txseq == seq)
 309			return skb;
 310	}
 311
 312	return NULL;
 
 
 313}
 314
 315/* ---- L2CAP sequence number lists ---- */
 316
 317/* For ERTM, ordered lists of sequence numbers must be tracked for
 318 * SREJ requests that are received and for frames that are to be
 319 * retransmitted. These seq_list functions implement a singly-linked
 320 * list in an array, where membership in the list can also be checked
 321 * in constant time. Items can also be added to the tail of the list
 322 * and removed from the head in constant time, without further memory
 323 * allocs or frees.
 324 */
 325
 326static int l2cap_seq_list_init(struct l2cap_seq_list *seq_list, u16 size)
 327{
 328	size_t alloc_size, i;
 329
 330	/* Allocated size is a power of 2 to map sequence numbers
 331	 * (which may be up to 14 bits) in to a smaller array that is
 332	 * sized for the negotiated ERTM transmit windows.
 333	 */
 334	alloc_size = roundup_pow_of_two(size);
 335
 336	seq_list->list = kmalloc_array(alloc_size, sizeof(u16), GFP_KERNEL);
 337	if (!seq_list->list)
 338		return -ENOMEM;
 339
 340	seq_list->mask = alloc_size - 1;
 341	seq_list->head = L2CAP_SEQ_LIST_CLEAR;
 342	seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
 343	for (i = 0; i < alloc_size; i++)
 344		seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR;
 345
 346	return 0;
 347}
 348
 349static inline void l2cap_seq_list_free(struct l2cap_seq_list *seq_list)
 350{
 351	kfree(seq_list->list);
 352}
 353
 354static inline bool l2cap_seq_list_contains(struct l2cap_seq_list *seq_list,
 355					   u16 seq)
 356{
 357	/* Constant-time check for list membership */
 358	return seq_list->list[seq & seq_list->mask] != L2CAP_SEQ_LIST_CLEAR;
 359}
 360
 361static inline u16 l2cap_seq_list_pop(struct l2cap_seq_list *seq_list)
 362{
 363	u16 seq = seq_list->head;
 364	u16 mask = seq_list->mask;
 365
 366	seq_list->head = seq_list->list[seq & mask];
 367	seq_list->list[seq & mask] = L2CAP_SEQ_LIST_CLEAR;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 368
 369	if (seq_list->head == L2CAP_SEQ_LIST_TAIL) {
 370		seq_list->head = L2CAP_SEQ_LIST_CLEAR;
 371		seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
 
 
 372	}
 373
 374	return seq;
 375}
 376
 
 
 
 
 
 
 377static void l2cap_seq_list_clear(struct l2cap_seq_list *seq_list)
 378{
 379	u16 i;
 380
 381	if (seq_list->head == L2CAP_SEQ_LIST_CLEAR)
 382		return;
 383
 384	for (i = 0; i <= seq_list->mask; i++)
 385		seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR;
 386
 387	seq_list->head = L2CAP_SEQ_LIST_CLEAR;
 388	seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
 389}
 390
 391static void l2cap_seq_list_append(struct l2cap_seq_list *seq_list, u16 seq)
 392{
 393	u16 mask = seq_list->mask;
 394
 395	/* All appends happen in constant time */
 396
 397	if (seq_list->list[seq & mask] != L2CAP_SEQ_LIST_CLEAR)
 398		return;
 399
 400	if (seq_list->tail == L2CAP_SEQ_LIST_CLEAR)
 401		seq_list->head = seq;
 402	else
 403		seq_list->list[seq_list->tail & mask] = seq;
 404
 405	seq_list->tail = seq;
 406	seq_list->list[seq & mask] = L2CAP_SEQ_LIST_TAIL;
 407}
 408
 409static void l2cap_chan_timeout(struct work_struct *work)
 410{
 411	struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
 412					       chan_timer.work);
 413	struct l2cap_conn *conn = chan->conn;
 414	int reason;
 415
 416	BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
 417
 418	if (!conn)
 419		return;
 420
 421	mutex_lock(&conn->chan_lock);
 422	/* __set_chan_timer() calls l2cap_chan_hold(chan) while scheduling
 423	 * this work. No need to call l2cap_chan_hold(chan) here again.
 424	 */
 425	l2cap_chan_lock(chan);
 426
 427	if (chan->state == BT_CONNECTED || chan->state == BT_CONFIG)
 428		reason = ECONNREFUSED;
 429	else if (chan->state == BT_CONNECT &&
 430		 chan->sec_level != BT_SECURITY_SDP)
 431		reason = ECONNREFUSED;
 432	else
 433		reason = ETIMEDOUT;
 434
 435	l2cap_chan_close(chan, reason);
 436
 437	chan->ops->close(chan);
 438
 439	l2cap_chan_unlock(chan);
 440	l2cap_chan_put(chan);
 441
 
 442	mutex_unlock(&conn->chan_lock);
 
 
 443}
 444
 445struct l2cap_chan *l2cap_chan_create(void)
 446{
 447	struct l2cap_chan *chan;
 448
 449	chan = kzalloc(sizeof(*chan), GFP_ATOMIC);
 450	if (!chan)
 451		return NULL;
 452
 453	skb_queue_head_init(&chan->tx_q);
 454	skb_queue_head_init(&chan->srej_q);
 455	mutex_init(&chan->lock);
 456
 457	/* Set default lock nesting level */
 458	atomic_set(&chan->nesting, L2CAP_NESTING_NORMAL);
 459
 460	/* Available receive buffer space is initially unknown */
 461	chan->rx_avail = -1;
 462
 463	write_lock(&chan_list_lock);
 464	list_add(&chan->global_l, &chan_list);
 465	write_unlock(&chan_list_lock);
 466
 467	INIT_DELAYED_WORK(&chan->chan_timer, l2cap_chan_timeout);
 468	INIT_DELAYED_WORK(&chan->retrans_timer, l2cap_retrans_timeout);
 469	INIT_DELAYED_WORK(&chan->monitor_timer, l2cap_monitor_timeout);
 470	INIT_DELAYED_WORK(&chan->ack_timer, l2cap_ack_timeout);
 471
 472	chan->state = BT_OPEN;
 473
 474	kref_init(&chan->kref);
 475
 476	/* This flag is cleared in l2cap_chan_ready() */
 477	set_bit(CONF_NOT_COMPLETE, &chan->conf_state);
 478
 479	BT_DBG("chan %p", chan);
 480
 481	return chan;
 482}
 483EXPORT_SYMBOL_GPL(l2cap_chan_create);
 484
 485static void l2cap_chan_destroy(struct kref *kref)
 486{
 487	struct l2cap_chan *chan = container_of(kref, struct l2cap_chan, kref);
 488
 489	BT_DBG("chan %p", chan);
 490
 491	write_lock(&chan_list_lock);
 492	list_del(&chan->global_l);
 493	write_unlock(&chan_list_lock);
 494
 495	kfree(chan);
 496}
 497
 498void l2cap_chan_hold(struct l2cap_chan *c)
 499{
 500	BT_DBG("chan %p orig refcnt %u", c, kref_read(&c->kref));
 501
 502	kref_get(&c->kref);
 503}
 504
 505struct l2cap_chan *l2cap_chan_hold_unless_zero(struct l2cap_chan *c)
 506{
 507	BT_DBG("chan %p orig refcnt %u", c, kref_read(&c->kref));
 508
 509	if (!kref_get_unless_zero(&c->kref))
 510		return NULL;
 511
 512	return c;
 513}
 514
 515void l2cap_chan_put(struct l2cap_chan *c)
 516{
 517	BT_DBG("chan %p orig refcnt %u", c, kref_read(&c->kref));
 518
 519	kref_put(&c->kref, l2cap_chan_destroy);
 520}
 521EXPORT_SYMBOL_GPL(l2cap_chan_put);
 522
 523void l2cap_chan_set_defaults(struct l2cap_chan *chan)
 524{
 525	chan->fcs  = L2CAP_FCS_CRC16;
 526	chan->max_tx = L2CAP_DEFAULT_MAX_TX;
 527	chan->tx_win = L2CAP_DEFAULT_TX_WINDOW;
 528	chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
 529	chan->remote_max_tx = chan->max_tx;
 530	chan->remote_tx_win = chan->tx_win;
 531	chan->ack_win = L2CAP_DEFAULT_TX_WINDOW;
 532	chan->sec_level = BT_SECURITY_LOW;
 533	chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
 534	chan->retrans_timeout = L2CAP_DEFAULT_RETRANS_TO;
 535	chan->monitor_timeout = L2CAP_DEFAULT_MONITOR_TO;
 536
 537	chan->conf_state = 0;
 538	set_bit(CONF_NOT_COMPLETE, &chan->conf_state);
 539
 540	set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
 541}
 542EXPORT_SYMBOL_GPL(l2cap_chan_set_defaults);
 543
 544static __u16 l2cap_le_rx_credits(struct l2cap_chan *chan)
 545{
 546	size_t sdu_len = chan->sdu ? chan->sdu->len : 0;
 547
 548	if (chan->mps == 0)
 549		return 0;
 550
 551	/* If we don't know the available space in the receiver buffer, give
 552	 * enough credits for a full packet.
 553	 */
 554	if (chan->rx_avail == -1)
 555		return (chan->imtu / chan->mps) + 1;
 556
 557	/* If we know how much space is available in the receive buffer, give
 558	 * out as many credits as would fill the buffer.
 559	 */
 560	if (chan->rx_avail <= sdu_len)
 561		return 0;
 562
 563	return DIV_ROUND_UP(chan->rx_avail - sdu_len, chan->mps);
 564}
 565
 566static void l2cap_le_flowctl_init(struct l2cap_chan *chan, u16 tx_credits)
 567{
 568	chan->sdu = NULL;
 569	chan->sdu_last_frag = NULL;
 570	chan->sdu_len = 0;
 571	chan->tx_credits = tx_credits;
 572	/* Derive MPS from connection MTU to stop HCI fragmentation */
 573	chan->mps = min_t(u16, chan->imtu, chan->conn->mtu - L2CAP_HDR_SIZE);
 574	chan->rx_credits = l2cap_le_rx_credits(chan);
 575
 576	skb_queue_head_init(&chan->tx_q);
 577}
 578
 579static void l2cap_ecred_init(struct l2cap_chan *chan, u16 tx_credits)
 580{
 581	l2cap_le_flowctl_init(chan, tx_credits);
 582
 583	/* L2CAP implementations shall support a minimum MPS of 64 octets */
 584	if (chan->mps < L2CAP_ECRED_MIN_MPS) {
 585		chan->mps = L2CAP_ECRED_MIN_MPS;
 586		chan->rx_credits = l2cap_le_rx_credits(chan);
 587	}
 588}
 589
 590void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
 591{
 592	BT_DBG("conn %p, psm 0x%2.2x, dcid 0x%4.4x", conn,
 593	       __le16_to_cpu(chan->psm), chan->dcid);
 594
 595	conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
 596
 597	chan->conn = conn;
 598
 599	switch (chan->chan_type) {
 600	case L2CAP_CHAN_CONN_ORIENTED:
 601		/* Alloc CID for connection-oriented socket */
 602		chan->scid = l2cap_alloc_cid(conn);
 603		if (conn->hcon->type == ACL_LINK)
 
 
 
 
 
 604			chan->omtu = L2CAP_DEFAULT_MTU;
 
 605		break;
 606
 607	case L2CAP_CHAN_CONN_LESS:
 608		/* Connectionless socket */
 609		chan->scid = L2CAP_CID_CONN_LESS;
 610		chan->dcid = L2CAP_CID_CONN_LESS;
 611		chan->omtu = L2CAP_DEFAULT_MTU;
 612		break;
 613
 614	case L2CAP_CHAN_FIXED:
 615		/* Caller will set CID and CID specific MTU values */
 616		break;
 617
 618	default:
 619		/* Raw socket can send/recv signalling messages only */
 620		chan->scid = L2CAP_CID_SIGNALING;
 621		chan->dcid = L2CAP_CID_SIGNALING;
 622		chan->omtu = L2CAP_DEFAULT_MTU;
 623	}
 624
 625	chan->local_id		= L2CAP_BESTEFFORT_ID;
 626	chan->local_stype	= L2CAP_SERV_BESTEFFORT;
 627	chan->local_msdu	= L2CAP_DEFAULT_MAX_SDU_SIZE;
 628	chan->local_sdu_itime	= L2CAP_DEFAULT_SDU_ITIME;
 629	chan->local_acc_lat	= L2CAP_DEFAULT_ACC_LAT;
 630	chan->local_flush_to	= L2CAP_EFS_DEFAULT_FLUSH_TO;
 631
 632	l2cap_chan_hold(chan);
 633
 634	/* Only keep a reference for fixed channels if they requested it */
 635	if (chan->chan_type != L2CAP_CHAN_FIXED ||
 636	    test_bit(FLAG_HOLD_HCI_CONN, &chan->flags))
 637		hci_conn_hold(conn->hcon);
 638
 639	/* Append to the list since the order matters for ECRED */
 640	list_add_tail(&chan->list, &conn->chan_l);
 641}
 642
 643void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
 644{
 645	mutex_lock(&conn->chan_lock);
 646	__l2cap_chan_add(conn, chan);
 647	mutex_unlock(&conn->chan_lock);
 648}
 649
 650void l2cap_chan_del(struct l2cap_chan *chan, int err)
 651{
 
 652	struct l2cap_conn *conn = chan->conn;
 
 653
 654	__clear_chan_timer(chan);
 655
 656	BT_DBG("chan %p, conn %p, err %d, state %s", chan, conn, err,
 657	       state_to_string(chan->state));
 658
 659	chan->ops->teardown(chan, err);
 660
 661	if (conn) {
 662		/* Delete from channel list */
 663		list_del(&chan->list);
 664
 665		l2cap_chan_put(chan);
 666
 667		chan->conn = NULL;
 668
 669		/* Reference was only held for non-fixed channels or
 670		 * fixed channels that explicitly requested it using the
 671		 * FLAG_HOLD_HCI_CONN flag.
 672		 */
 673		if (chan->chan_type != L2CAP_CHAN_FIXED ||
 674		    test_bit(FLAG_HOLD_HCI_CONN, &chan->flags))
 675			hci_conn_drop(conn->hcon);
 676	}
 677
 678	if (test_bit(CONF_NOT_COMPLETE, &chan->conf_state))
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 679		return;
 680
 681	switch (chan->mode) {
 682	case L2CAP_MODE_BASIC:
 683		break;
 684
 685	case L2CAP_MODE_LE_FLOWCTL:
 686	case L2CAP_MODE_EXT_FLOWCTL:
 687		skb_queue_purge(&chan->tx_q);
 688		break;
 689
 690	case L2CAP_MODE_ERTM:
 691		__clear_retrans_timer(chan);
 692		__clear_monitor_timer(chan);
 693		__clear_ack_timer(chan);
 694
 695		skb_queue_purge(&chan->srej_q);
 696
 697		l2cap_seq_list_free(&chan->srej_list);
 698		l2cap_seq_list_free(&chan->retrans_list);
 699		fallthrough;
 700
 701	case L2CAP_MODE_STREAMING:
 702		skb_queue_purge(&chan->tx_q);
 703		break;
 704	}
 705}
 706EXPORT_SYMBOL_GPL(l2cap_chan_del);
 707
 708static void __l2cap_chan_list_id(struct l2cap_conn *conn, u16 id,
 709				 l2cap_chan_func_t func, void *data)
 710{
 711	struct l2cap_chan *chan, *l;
 712
 713	list_for_each_entry_safe(chan, l, &conn->chan_l, list) {
 714		if (chan->ident == id)
 715			func(chan, data);
 716	}
 717}
 718
 719static void __l2cap_chan_list(struct l2cap_conn *conn, l2cap_chan_func_t func,
 720			      void *data)
 721{
 722	struct l2cap_chan *chan;
 723
 724	list_for_each_entry(chan, &conn->chan_l, list) {
 725		func(chan, data);
 726	}
 727}
 728
 729void l2cap_chan_list(struct l2cap_conn *conn, l2cap_chan_func_t func,
 730		     void *data)
 731{
 732	if (!conn)
 733		return;
 734
 735	mutex_lock(&conn->chan_lock);
 736	__l2cap_chan_list(conn, func, data);
 737	mutex_unlock(&conn->chan_lock);
 738}
 739
 740EXPORT_SYMBOL_GPL(l2cap_chan_list);
 741
 742static void l2cap_conn_update_id_addr(struct work_struct *work)
 743{
 744	struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
 745					       id_addr_timer.work);
 746	struct hci_conn *hcon = conn->hcon;
 747	struct l2cap_chan *chan;
 748
 749	mutex_lock(&conn->chan_lock);
 
 
 750
 751	list_for_each_entry(chan, &conn->chan_l, list) {
 752		l2cap_chan_lock(chan);
 753		bacpy(&chan->dst, &hcon->dst);
 754		chan->dst_type = bdaddr_dst_type(hcon);
 755		l2cap_chan_unlock(chan);
 756	}
 757
 758	mutex_unlock(&conn->chan_lock);
 759}
 760
 761static void l2cap_chan_le_connect_reject(struct l2cap_chan *chan)
 762{
 763	struct l2cap_conn *conn = chan->conn;
 764	struct l2cap_le_conn_rsp rsp;
 765	u16 result;
 766
 767	if (test_bit(FLAG_DEFER_SETUP, &chan->flags))
 768		result = L2CAP_CR_LE_AUTHORIZATION;
 769	else
 770		result = L2CAP_CR_LE_BAD_PSM;
 771
 772	l2cap_state_change(chan, BT_DISCONN);
 773
 774	rsp.dcid    = cpu_to_le16(chan->scid);
 775	rsp.mtu     = cpu_to_le16(chan->imtu);
 776	rsp.mps     = cpu_to_le16(chan->mps);
 777	rsp.credits = cpu_to_le16(chan->rx_credits);
 778	rsp.result  = cpu_to_le16(result);
 779
 780	l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp),
 781		       &rsp);
 782}
 783
 784static void l2cap_chan_ecred_connect_reject(struct l2cap_chan *chan)
 785{
 786	l2cap_state_change(chan, BT_DISCONN);
 787
 788	__l2cap_ecred_conn_rsp_defer(chan);
 789}
 790
 791static void l2cap_chan_connect_reject(struct l2cap_chan *chan)
 792{
 793	struct l2cap_conn *conn = chan->conn;
 794	struct l2cap_conn_rsp rsp;
 795	u16 result;
 796
 797	if (test_bit(FLAG_DEFER_SETUP, &chan->flags))
 798		result = L2CAP_CR_SEC_BLOCK;
 799	else
 800		result = L2CAP_CR_BAD_PSM;
 801
 802	l2cap_state_change(chan, BT_DISCONN);
 803
 804	rsp.scid   = cpu_to_le16(chan->dcid);
 805	rsp.dcid   = cpu_to_le16(chan->scid);
 806	rsp.result = cpu_to_le16(result);
 807	rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
 808
 809	l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP, sizeof(rsp), &rsp);
 810}
 811
 812void l2cap_chan_close(struct l2cap_chan *chan, int reason)
 813{
 814	struct l2cap_conn *conn = chan->conn;
 
 815
 816	BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
 
 817
 818	switch (chan->state) {
 819	case BT_LISTEN:
 820		chan->ops->teardown(chan, 0);
 
 
 
 
 
 821		break;
 822
 823	case BT_CONNECTED:
 824	case BT_CONFIG:
 825		if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED) {
 826			__set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
 827			l2cap_send_disconn_req(chan, reason);
 
 828		} else
 829			l2cap_chan_del(chan, reason);
 830		break;
 831
 832	case BT_CONNECT2:
 833		if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED) {
 834			if (conn->hcon->type == ACL_LINK)
 835				l2cap_chan_connect_reject(chan);
 836			else if (conn->hcon->type == LE_LINK) {
 837				switch (chan->mode) {
 838				case L2CAP_MODE_LE_FLOWCTL:
 839					l2cap_chan_le_connect_reject(chan);
 840					break;
 841				case L2CAP_MODE_EXT_FLOWCTL:
 842					l2cap_chan_ecred_connect_reject(chan);
 843					return;
 844				}
 845			}
 
 
 
 
 846		}
 847
 848		l2cap_chan_del(chan, reason);
 849		break;
 850
 851	case BT_CONNECT:
 852	case BT_DISCONN:
 853		l2cap_chan_del(chan, reason);
 854		break;
 855
 856	default:
 857		chan->ops->teardown(chan, 0);
 
 
 858		break;
 859	}
 860}
 861EXPORT_SYMBOL(l2cap_chan_close);
 862
 863static inline u8 l2cap_get_auth_type(struct l2cap_chan *chan)
 864{
 865	switch (chan->chan_type) {
 866	case L2CAP_CHAN_RAW:
 867		switch (chan->sec_level) {
 868		case BT_SECURITY_HIGH:
 869		case BT_SECURITY_FIPS:
 870			return HCI_AT_DEDICATED_BONDING_MITM;
 871		case BT_SECURITY_MEDIUM:
 872			return HCI_AT_DEDICATED_BONDING;
 873		default:
 874			return HCI_AT_NO_BONDING;
 875		}
 876		break;
 877	case L2CAP_CHAN_CONN_LESS:
 878		if (chan->psm == cpu_to_le16(L2CAP_PSM_3DSP)) {
 879			if (chan->sec_level == BT_SECURITY_LOW)
 880				chan->sec_level = BT_SECURITY_SDP;
 881		}
 882		if (chan->sec_level == BT_SECURITY_HIGH ||
 883		    chan->sec_level == BT_SECURITY_FIPS)
 884			return HCI_AT_NO_BONDING_MITM;
 885		else
 886			return HCI_AT_NO_BONDING;
 887		break;
 888	case L2CAP_CHAN_CONN_ORIENTED:
 889		if (chan->psm == cpu_to_le16(L2CAP_PSM_SDP)) {
 890			if (chan->sec_level == BT_SECURITY_LOW)
 891				chan->sec_level = BT_SECURITY_SDP;
 892
 893			if (chan->sec_level == BT_SECURITY_HIGH ||
 894			    chan->sec_level == BT_SECURITY_FIPS)
 895				return HCI_AT_NO_BONDING_MITM;
 896			else
 897				return HCI_AT_NO_BONDING;
 898		}
 899		fallthrough;
 900
 901	default:
 902		switch (chan->sec_level) {
 903		case BT_SECURITY_HIGH:
 904		case BT_SECURITY_FIPS:
 905			return HCI_AT_GENERAL_BONDING_MITM;
 906		case BT_SECURITY_MEDIUM:
 907			return HCI_AT_GENERAL_BONDING;
 908		default:
 909			return HCI_AT_NO_BONDING;
 910		}
 911		break;
 912	}
 913}
 914
 915/* Service level security */
 916int l2cap_chan_check_security(struct l2cap_chan *chan, bool initiator)
 917{
 918	struct l2cap_conn *conn = chan->conn;
 919	__u8 auth_type;
 920
 921	if (conn->hcon->type == LE_LINK)
 922		return smp_conn_security(conn->hcon, chan->sec_level);
 923
 924	auth_type = l2cap_get_auth_type(chan);
 925
 926	return hci_conn_security(conn->hcon, chan->sec_level, auth_type,
 927				 initiator);
 928}
 929
 930static u8 l2cap_get_ident(struct l2cap_conn *conn)
 931{
 932	u8 id;
 933
 934	/* Get next available identificator.
 935	 *    1 - 128 are used by kernel.
 936	 *  129 - 199 are reserved.
 937	 *  200 - 254 are used by utilities like l2ping, etc.
 938	 */
 939
 940	mutex_lock(&conn->ident_lock);
 941
 942	if (++conn->tx_ident > 128)
 943		conn->tx_ident = 1;
 944
 945	id = conn->tx_ident;
 946
 947	mutex_unlock(&conn->ident_lock);
 948
 949	return id;
 950}
 951
 952static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
 953			   void *data)
 954{
 955	struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data);
 956	u8 flags;
 957
 958	BT_DBG("code 0x%2.2x", code);
 959
 960	if (!skb)
 961		return;
 962
 963	/* Use NO_FLUSH if supported or we have an LE link (which does
 964	 * not support auto-flushing packets) */
 965	if (lmp_no_flush_capable(conn->hcon->hdev) ||
 966	    conn->hcon->type == LE_LINK)
 967		flags = ACL_START_NO_FLUSH;
 968	else
 969		flags = ACL_START;
 970
 971	bt_cb(skb)->force_active = BT_POWER_FORCE_ACTIVE_ON;
 972	skb->priority = HCI_PRIO_MAX;
 973
 974	hci_send_acl(conn->hchan, skb, flags);
 975}
 976
 977static void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb)
 978{
 979	struct hci_conn *hcon = chan->conn->hcon;
 980	u16 flags;
 981
 982	BT_DBG("chan %p, skb %p len %d priority %u", chan, skb, skb->len,
 983	       skb->priority);
 984
 985	/* Use NO_FLUSH for LE links (where this is the only option) or
 986	 * if the BR/EDR link supports it and flushing has not been
 987	 * explicitly requested (through FLAG_FLUSHABLE).
 988	 */
 989	if (hcon->type == LE_LINK ||
 990	    (!test_bit(FLAG_FLUSHABLE, &chan->flags) &&
 991	     lmp_no_flush_capable(hcon->hdev)))
 992		flags = ACL_START_NO_FLUSH;
 993	else
 994		flags = ACL_START;
 995
 996	bt_cb(skb)->force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
 997	hci_send_acl(chan->conn->hchan, skb, flags);
 998}
 999
1000static void __unpack_enhanced_control(u16 enh, struct l2cap_ctrl *control)
1001{
1002	control->reqseq = (enh & L2CAP_CTRL_REQSEQ) >> L2CAP_CTRL_REQSEQ_SHIFT;
1003	control->final = (enh & L2CAP_CTRL_FINAL) >> L2CAP_CTRL_FINAL_SHIFT;
1004
1005	if (enh & L2CAP_CTRL_FRAME_TYPE) {
1006		/* S-Frame */
1007		control->sframe = 1;
1008		control->poll = (enh & L2CAP_CTRL_POLL) >> L2CAP_CTRL_POLL_SHIFT;
1009		control->super = (enh & L2CAP_CTRL_SUPERVISE) >> L2CAP_CTRL_SUPER_SHIFT;
1010
1011		control->sar = 0;
1012		control->txseq = 0;
1013	} else {
1014		/* I-Frame */
1015		control->sframe = 0;
1016		control->sar = (enh & L2CAP_CTRL_SAR) >> L2CAP_CTRL_SAR_SHIFT;
1017		control->txseq = (enh & L2CAP_CTRL_TXSEQ) >> L2CAP_CTRL_TXSEQ_SHIFT;
1018
1019		control->poll = 0;
1020		control->super = 0;
1021	}
1022}
1023
1024static void __unpack_extended_control(u32 ext, struct l2cap_ctrl *control)
1025{
1026	control->reqseq = (ext & L2CAP_EXT_CTRL_REQSEQ) >> L2CAP_EXT_CTRL_REQSEQ_SHIFT;
1027	control->final = (ext & L2CAP_EXT_CTRL_FINAL) >> L2CAP_EXT_CTRL_FINAL_SHIFT;
1028
1029	if (ext & L2CAP_EXT_CTRL_FRAME_TYPE) {
1030		/* S-Frame */
1031		control->sframe = 1;
1032		control->poll = (ext & L2CAP_EXT_CTRL_POLL) >> L2CAP_EXT_CTRL_POLL_SHIFT;
1033		control->super = (ext & L2CAP_EXT_CTRL_SUPERVISE) >> L2CAP_EXT_CTRL_SUPER_SHIFT;
1034
1035		control->sar = 0;
1036		control->txseq = 0;
1037	} else {
1038		/* I-Frame */
1039		control->sframe = 0;
1040		control->sar = (ext & L2CAP_EXT_CTRL_SAR) >> L2CAP_EXT_CTRL_SAR_SHIFT;
1041		control->txseq = (ext & L2CAP_EXT_CTRL_TXSEQ) >> L2CAP_EXT_CTRL_TXSEQ_SHIFT;
1042
1043		control->poll = 0;
1044		control->super = 0;
1045	}
1046}
1047
1048static inline void __unpack_control(struct l2cap_chan *chan,
1049				    struct sk_buff *skb)
1050{
1051	if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
1052		__unpack_extended_control(get_unaligned_le32(skb->data),
1053					  &bt_cb(skb)->l2cap);
1054		skb_pull(skb, L2CAP_EXT_CTRL_SIZE);
1055	} else {
1056		__unpack_enhanced_control(get_unaligned_le16(skb->data),
1057					  &bt_cb(skb)->l2cap);
1058		skb_pull(skb, L2CAP_ENH_CTRL_SIZE);
1059	}
1060}
1061
1062static u32 __pack_extended_control(struct l2cap_ctrl *control)
1063{
1064	u32 packed;
1065
1066	packed = control->reqseq << L2CAP_EXT_CTRL_REQSEQ_SHIFT;
1067	packed |= control->final << L2CAP_EXT_CTRL_FINAL_SHIFT;
1068
1069	if (control->sframe) {
1070		packed |= control->poll << L2CAP_EXT_CTRL_POLL_SHIFT;
1071		packed |= control->super << L2CAP_EXT_CTRL_SUPER_SHIFT;
1072		packed |= L2CAP_EXT_CTRL_FRAME_TYPE;
1073	} else {
1074		packed |= control->sar << L2CAP_EXT_CTRL_SAR_SHIFT;
1075		packed |= control->txseq << L2CAP_EXT_CTRL_TXSEQ_SHIFT;
1076	}
1077
1078	return packed;
1079}
1080
1081static u16 __pack_enhanced_control(struct l2cap_ctrl *control)
1082{
1083	u16 packed;
1084
1085	packed = control->reqseq << L2CAP_CTRL_REQSEQ_SHIFT;
1086	packed |= control->final << L2CAP_CTRL_FINAL_SHIFT;
1087
1088	if (control->sframe) {
1089		packed |= control->poll << L2CAP_CTRL_POLL_SHIFT;
1090		packed |= control->super << L2CAP_CTRL_SUPER_SHIFT;
1091		packed |= L2CAP_CTRL_FRAME_TYPE;
1092	} else {
1093		packed |= control->sar << L2CAP_CTRL_SAR_SHIFT;
1094		packed |= control->txseq << L2CAP_CTRL_TXSEQ_SHIFT;
1095	}
1096
1097	return packed;
1098}
1099
1100static inline void __pack_control(struct l2cap_chan *chan,
1101				  struct l2cap_ctrl *control,
1102				  struct sk_buff *skb)
1103{
1104	if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
1105		put_unaligned_le32(__pack_extended_control(control),
1106				   skb->data + L2CAP_HDR_SIZE);
1107	} else {
1108		put_unaligned_le16(__pack_enhanced_control(control),
1109				   skb->data + L2CAP_HDR_SIZE);
1110	}
1111}
1112
1113static inline unsigned int __ertm_hdr_size(struct l2cap_chan *chan)
1114{
1115	if (test_bit(FLAG_EXT_CTRL, &chan->flags))
1116		return L2CAP_EXT_HDR_SIZE;
1117	else
1118		return L2CAP_ENH_HDR_SIZE;
1119}
1120
1121static struct sk_buff *l2cap_create_sframe_pdu(struct l2cap_chan *chan,
1122					       u32 control)
1123{
1124	struct sk_buff *skb;
1125	struct l2cap_hdr *lh;
1126	int hlen = __ertm_hdr_size(chan);
 
 
 
 
 
 
 
 
 
1127
1128	if (chan->fcs == L2CAP_FCS_CRC16)
1129		hlen += L2CAP_FCS_SIZE;
1130
1131	skb = bt_skb_alloc(hlen, GFP_KERNEL);
 
 
1132
 
 
 
 
 
 
 
 
 
1133	if (!skb)
1134		return ERR_PTR(-ENOMEM);
1135
1136	lh = skb_put(skb, L2CAP_HDR_SIZE);
1137	lh->len = cpu_to_le16(hlen - L2CAP_HDR_SIZE);
1138	lh->cid = cpu_to_le16(chan->dcid);
1139
1140	if (test_bit(FLAG_EXT_CTRL, &chan->flags))
1141		put_unaligned_le32(control, skb_put(skb, L2CAP_EXT_CTRL_SIZE));
1142	else
1143		put_unaligned_le16(control, skb_put(skb, L2CAP_ENH_CTRL_SIZE));
1144
1145	if (chan->fcs == L2CAP_FCS_CRC16) {
1146		u16 fcs = crc16(0, (u8 *)skb->data, skb->len);
1147		put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
1148	}
1149
1150	skb->priority = HCI_PRIO_MAX;
1151	return skb;
1152}
1153
1154static void l2cap_send_sframe(struct l2cap_chan *chan,
1155			      struct l2cap_ctrl *control)
1156{
1157	struct sk_buff *skb;
1158	u32 control_field;
1159
1160	BT_DBG("chan %p, control %p", chan, control);
1161
1162	if (!control->sframe)
1163		return;
1164
1165	if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state) &&
1166	    !control->poll)
1167		control->final = 1;
1168
1169	if (control->super == L2CAP_SUPER_RR)
1170		clear_bit(CONN_RNR_SENT, &chan->conn_state);
1171	else if (control->super == L2CAP_SUPER_RNR)
1172		set_bit(CONN_RNR_SENT, &chan->conn_state);
 
 
1173
1174	if (control->super != L2CAP_SUPER_SREJ) {
1175		chan->last_acked_seq = control->reqseq;
1176		__clear_ack_timer(chan);
1177	}
1178
1179	BT_DBG("reqseq %d, final %d, poll %d, super %d", control->reqseq,
1180	       control->final, control->poll, control->super);
1181
1182	if (test_bit(FLAG_EXT_CTRL, &chan->flags))
1183		control_field = __pack_extended_control(control);
1184	else
1185		control_field = __pack_enhanced_control(control);
1186
1187	skb = l2cap_create_sframe_pdu(chan, control_field);
1188	if (!IS_ERR(skb))
1189		l2cap_do_send(chan, skb);
1190}
1191
1192static void l2cap_send_rr_or_rnr(struct l2cap_chan *chan, bool poll)
1193{
1194	struct l2cap_ctrl control;
1195
1196	BT_DBG("chan %p, poll %d", chan, poll);
1197
1198	memset(&control, 0, sizeof(control));
1199	control.sframe = 1;
1200	control.poll = poll;
1201
1202	if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state))
1203		control.super = L2CAP_SUPER_RNR;
1204	else
1205		control.super = L2CAP_SUPER_RR;
1206
1207	control.reqseq = chan->buffer_seq;
1208	l2cap_send_sframe(chan, &control);
1209}
1210
1211static inline int __l2cap_no_conn_pending(struct l2cap_chan *chan)
1212{
1213	if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED)
1214		return true;
1215
1216	return !test_bit(CONF_CONNECT_PEND, &chan->conf_state);
1217}
1218
1219void l2cap_send_conn_req(struct l2cap_chan *chan)
1220{
1221	struct l2cap_conn *conn = chan->conn;
1222	struct l2cap_conn_req req;
1223
1224	req.scid = cpu_to_le16(chan->scid);
1225	req.psm  = chan->psm;
1226
1227	chan->ident = l2cap_get_ident(conn);
1228
1229	set_bit(CONF_CONNECT_PEND, &chan->conf_state);
1230
1231	l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ, sizeof(req), &req);
1232}
1233
1234static void l2cap_chan_ready(struct l2cap_chan *chan)
1235{
1236	/* The channel may have already been flagged as connected in
1237	 * case of receiving data before the L2CAP info req/rsp
1238	 * procedure is complete.
1239	 */
1240	if (chan->state == BT_CONNECTED)
1241		return;
1242
1243	/* This clears all conf flags, including CONF_NOT_COMPLETE */
1244	chan->conf_state = 0;
1245	__clear_chan_timer(chan);
1246
1247	switch (chan->mode) {
1248	case L2CAP_MODE_LE_FLOWCTL:
1249	case L2CAP_MODE_EXT_FLOWCTL:
1250		if (!chan->tx_credits)
1251			chan->ops->suspend(chan);
1252		break;
1253	}
1254
1255	chan->state = BT_CONNECTED;
1256
1257	chan->ops->ready(chan);
1258}
1259
1260static void l2cap_le_connect(struct l2cap_chan *chan)
1261{
1262	struct l2cap_conn *conn = chan->conn;
1263	struct l2cap_le_conn_req req;
1264
1265	if (test_and_set_bit(FLAG_LE_CONN_REQ_SENT, &chan->flags))
1266		return;
1267
1268	if (!chan->imtu)
1269		chan->imtu = chan->conn->mtu;
1270
1271	l2cap_le_flowctl_init(chan, 0);
1272
1273	memset(&req, 0, sizeof(req));
1274	req.psm     = chan->psm;
1275	req.scid    = cpu_to_le16(chan->scid);
1276	req.mtu     = cpu_to_le16(chan->imtu);
1277	req.mps     = cpu_to_le16(chan->mps);
1278	req.credits = cpu_to_le16(chan->rx_credits);
1279
1280	chan->ident = l2cap_get_ident(conn);
1281
1282	l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_REQ,
1283		       sizeof(req), &req);
1284}
1285
1286struct l2cap_ecred_conn_data {
1287	struct {
1288		struct l2cap_ecred_conn_req_hdr req;
1289		__le16 scid[5];
1290	} __packed pdu;
1291	struct l2cap_chan *chan;
1292	struct pid *pid;
1293	int count;
1294};
1295
1296static void l2cap_ecred_defer_connect(struct l2cap_chan *chan, void *data)
1297{
1298	struct l2cap_ecred_conn_data *conn = data;
1299	struct pid *pid;
1300
1301	if (chan == conn->chan)
1302		return;
1303
1304	if (!test_and_clear_bit(FLAG_DEFER_SETUP, &chan->flags))
1305		return;
1306
1307	pid = chan->ops->get_peer_pid(chan);
1308
1309	/* Only add deferred channels with the same PID/PSM */
1310	if (conn->pid != pid || chan->psm != conn->chan->psm || chan->ident ||
1311	    chan->mode != L2CAP_MODE_EXT_FLOWCTL || chan->state != BT_CONNECT)
1312		return;
1313
1314	if (test_and_set_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags))
1315		return;
1316
1317	l2cap_ecred_init(chan, 0);
1318
1319	/* Set the same ident so we can match on the rsp */
1320	chan->ident = conn->chan->ident;
1321
1322	/* Include all channels deferred */
1323	conn->pdu.scid[conn->count] = cpu_to_le16(chan->scid);
1324
1325	conn->count++;
1326}
1327
1328static void l2cap_ecred_connect(struct l2cap_chan *chan)
1329{
1330	struct l2cap_conn *conn = chan->conn;
1331	struct l2cap_ecred_conn_data data;
1332
1333	if (test_bit(FLAG_DEFER_SETUP, &chan->flags))
1334		return;
1335
1336	if (test_and_set_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags))
1337		return;
1338
1339	l2cap_ecred_init(chan, 0);
1340
1341	memset(&data, 0, sizeof(data));
1342	data.pdu.req.psm     = chan->psm;
1343	data.pdu.req.mtu     = cpu_to_le16(chan->imtu);
1344	data.pdu.req.mps     = cpu_to_le16(chan->mps);
1345	data.pdu.req.credits = cpu_to_le16(chan->rx_credits);
1346	data.pdu.scid[0]     = cpu_to_le16(chan->scid);
1347
1348	chan->ident = l2cap_get_ident(conn);
 
1349
1350	data.count = 1;
1351	data.chan = chan;
1352	data.pid = chan->ops->get_peer_pid(chan);
1353
1354	__l2cap_chan_list(conn, l2cap_ecred_defer_connect, &data);
 
1355
1356	l2cap_send_cmd(conn, chan->ident, L2CAP_ECRED_CONN_REQ,
1357		       sizeof(data.pdu.req) + data.count * sizeof(__le16),
1358		       &data.pdu);
1359}
1360
1361static void l2cap_le_start(struct l2cap_chan *chan)
1362{
1363	struct l2cap_conn *conn = chan->conn;
1364
1365	if (!smp_conn_security(conn->hcon, chan->sec_level))
1366		return;
1367
1368	if (!chan->psm) {
1369		l2cap_chan_ready(chan);
1370		return;
1371	}
1372
1373	if (chan->state == BT_CONNECT) {
1374		if (chan->mode == L2CAP_MODE_EXT_FLOWCTL)
1375			l2cap_ecred_connect(chan);
1376		else
1377			l2cap_le_connect(chan);
1378	}
1379}
1380
1381static void l2cap_start_connection(struct l2cap_chan *chan)
1382{
1383	if (chan->conn->hcon->type == LE_LINK) {
1384		l2cap_le_start(chan);
1385	} else {
1386		l2cap_send_conn_req(chan);
1387	}
1388}
1389
1390static void l2cap_request_info(struct l2cap_conn *conn)
1391{
1392	struct l2cap_info_req req;
1393
1394	if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
1395		return;
1396
1397	req.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
1398
1399	conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
1400	conn->info_ident = l2cap_get_ident(conn);
1401
1402	schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
1403
1404	l2cap_send_cmd(conn, conn->info_ident, L2CAP_INFO_REQ,
1405		       sizeof(req), &req);
1406}
1407
1408static bool l2cap_check_enc_key_size(struct hci_conn *hcon)
1409{
1410	/* The minimum encryption key size needs to be enforced by the
1411	 * host stack before establishing any L2CAP connections. The
1412	 * specification in theory allows a minimum of 1, but to align
1413	 * BR/EDR and LE transports, a minimum of 7 is chosen.
1414	 *
1415	 * This check might also be called for unencrypted connections
1416	 * that have no key size requirements. Ensure that the link is
1417	 * actually encrypted before enforcing a key size.
1418	 */
1419	int min_key_size = hcon->hdev->min_enc_key_size;
1420
1421	/* On FIPS security level, key size must be 16 bytes */
1422	if (hcon->sec_level == BT_SECURITY_FIPS)
1423		min_key_size = 16;
1424
1425	return (!test_bit(HCI_CONN_ENCRYPT, &hcon->flags) ||
1426		hcon->enc_key_size >= min_key_size);
1427}
1428
1429static void l2cap_do_start(struct l2cap_chan *chan)
1430{
1431	struct l2cap_conn *conn = chan->conn;
1432
1433	if (conn->hcon->type == LE_LINK) {
1434		l2cap_le_start(chan);
1435		return;
1436	}
1437
1438	if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)) {
1439		l2cap_request_info(conn);
1440		return;
1441	}
1442
1443	if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE))
1444		return;
1445
1446	if (!l2cap_chan_check_security(chan, true) ||
1447	    !__l2cap_no_conn_pending(chan))
1448		return;
1449
1450	if (l2cap_check_enc_key_size(conn->hcon))
1451		l2cap_start_connection(chan);
1452	else
1453		__set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
1454}
1455
1456static inline int l2cap_mode_supported(__u8 mode, __u32 feat_mask)
1457{
1458	u32 local_feat_mask = l2cap_feat_mask;
1459	if (!disable_ertm)
1460		local_feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING;
1461
1462	switch (mode) {
1463	case L2CAP_MODE_ERTM:
1464		return L2CAP_FEAT_ERTM & feat_mask & local_feat_mask;
1465	case L2CAP_MODE_STREAMING:
1466		return L2CAP_FEAT_STREAMING & feat_mask & local_feat_mask;
1467	default:
1468		return 0x00;
1469	}
1470}
1471
1472static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err)
1473{
1474	struct l2cap_conn *conn = chan->conn;
1475	struct l2cap_disconn_req req;
1476
1477	if (!conn)
1478		return;
1479
1480	if (chan->mode == L2CAP_MODE_ERTM && chan->state == BT_CONNECTED) {
1481		__clear_retrans_timer(chan);
1482		__clear_monitor_timer(chan);
1483		__clear_ack_timer(chan);
1484	}
1485
1486	req.dcid = cpu_to_le16(chan->dcid);
1487	req.scid = cpu_to_le16(chan->scid);
1488	l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_DISCONN_REQ,
1489		       sizeof(req), &req);
1490
1491	l2cap_state_change_and_error(chan, BT_DISCONN, err);
 
 
 
1492}
1493
1494/* ---- L2CAP connections ---- */
1495static void l2cap_conn_start(struct l2cap_conn *conn)
1496{
1497	struct l2cap_chan *chan, *tmp;
1498
1499	BT_DBG("conn %p", conn);
1500
1501	mutex_lock(&conn->chan_lock);
1502
1503	list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
 
 
1504		l2cap_chan_lock(chan);
1505
1506		if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
1507			l2cap_chan_ready(chan);
1508			l2cap_chan_unlock(chan);
1509			continue;
1510		}
1511
1512		if (chan->state == BT_CONNECT) {
1513			if (!l2cap_chan_check_security(chan, true) ||
1514			    !__l2cap_no_conn_pending(chan)) {
1515				l2cap_chan_unlock(chan);
1516				continue;
1517			}
1518
1519			if (!l2cap_mode_supported(chan->mode, conn->feat_mask)
1520			    && test_bit(CONF_STATE2_DEVICE,
1521					&chan->conf_state)) {
1522				l2cap_chan_close(chan, ECONNRESET);
1523				l2cap_chan_unlock(chan);
1524				continue;
1525			}
1526
1527			if (l2cap_check_enc_key_size(conn->hcon))
1528				l2cap_start_connection(chan);
1529			else
1530				l2cap_chan_close(chan, ECONNREFUSED);
1531
1532		} else if (chan->state == BT_CONNECT2) {
1533			struct l2cap_conn_rsp rsp;
1534			char buf[128];
1535			rsp.scid = cpu_to_le16(chan->dcid);
1536			rsp.dcid = cpu_to_le16(chan->scid);
1537
1538			if (l2cap_chan_check_security(chan, false)) {
1539				if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
 
 
 
1540					rsp.result = cpu_to_le16(L2CAP_CR_PEND);
1541					rsp.status = cpu_to_le16(L2CAP_CS_AUTHOR_PEND);
1542					chan->ops->defer(chan);
 
1543
1544				} else {
1545					l2cap_state_change(chan, BT_CONFIG);
1546					rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
1547					rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
1548				}
 
1549			} else {
1550				rsp.result = cpu_to_le16(L2CAP_CR_PEND);
1551				rsp.status = cpu_to_le16(L2CAP_CS_AUTHEN_PEND);
1552			}
1553
1554			l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
1555				       sizeof(rsp), &rsp);
1556
1557			if (test_bit(CONF_REQ_SENT, &chan->conf_state) ||
1558			    rsp.result != L2CAP_CR_SUCCESS) {
1559				l2cap_chan_unlock(chan);
1560				continue;
1561			}
1562
1563			set_bit(CONF_REQ_SENT, &chan->conf_state);
1564			l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
1565				       l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
1566			chan->num_conf_req++;
1567		}
1568
1569		l2cap_chan_unlock(chan);
1570	}
1571
1572	mutex_unlock(&conn->chan_lock);
1573}
1574
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1575static void l2cap_le_conn_ready(struct l2cap_conn *conn)
1576{
1577	struct hci_conn *hcon = conn->hcon;
1578	struct hci_dev *hdev = hcon->hdev;
1579
1580	BT_DBG("%s conn %p", hdev->name, conn);
1581
1582	/* For outgoing pairing which doesn't necessarily have an
1583	 * associated socket (e.g. mgmt_pair_device).
1584	 */
1585	if (hcon->out)
1586		smp_conn_security(hcon, hcon->pending_sec_level);
1587
1588	/* For LE peripheral connections, make sure the connection interval
1589	 * is in the range of the minimum and maximum interval that has
1590	 * been configured for this connection. If not, then trigger
1591	 * the connection update procedure.
1592	 */
1593	if (hcon->role == HCI_ROLE_SLAVE &&
1594	    (hcon->le_conn_interval < hcon->le_conn_min_interval ||
1595	     hcon->le_conn_interval > hcon->le_conn_max_interval)) {
1596		struct l2cap_conn_param_update_req req;
1597
1598		req.min = cpu_to_le16(hcon->le_conn_min_interval);
1599		req.max = cpu_to_le16(hcon->le_conn_max_interval);
1600		req.latency = cpu_to_le16(hcon->le_conn_latency);
1601		req.to_multiplier = cpu_to_le16(hcon->le_supv_timeout);
1602
1603		l2cap_send_cmd(conn, l2cap_get_ident(conn),
1604			       L2CAP_CONN_PARAM_UPDATE_REQ, sizeof(req), &req);
 
 
1605	}
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1606}
1607
1608static void l2cap_conn_ready(struct l2cap_conn *conn)
1609{
1610	struct l2cap_chan *chan;
1611	struct hci_conn *hcon = conn->hcon;
1612
1613	BT_DBG("conn %p", conn);
1614
1615	if (hcon->type == ACL_LINK)
1616		l2cap_request_info(conn);
 
 
 
1617
1618	mutex_lock(&conn->chan_lock);
1619
1620	list_for_each_entry(chan, &conn->chan_l, list) {
1621
1622		l2cap_chan_lock(chan);
1623
1624		if (hcon->type == LE_LINK) {
1625			l2cap_le_start(chan);
1626		} else if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
1627			if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)
1628				l2cap_chan_ready(chan);
1629		} else if (chan->state == BT_CONNECT) {
 
 
 
 
 
 
 
 
 
1630			l2cap_do_start(chan);
1631		}
1632
1633		l2cap_chan_unlock(chan);
1634	}
1635
1636	mutex_unlock(&conn->chan_lock);
1637
1638	if (hcon->type == LE_LINK)
1639		l2cap_le_conn_ready(conn);
1640
1641	queue_work(hcon->hdev->workqueue, &conn->pending_rx_work);
1642}
1643
1644/* Notify sockets that we cannot guaranty reliability anymore */
1645static void l2cap_conn_unreliable(struct l2cap_conn *conn, int err)
1646{
1647	struct l2cap_chan *chan;
1648
1649	BT_DBG("conn %p", conn);
1650
1651	mutex_lock(&conn->chan_lock);
1652
1653	list_for_each_entry(chan, &conn->chan_l, list) {
1654		if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
1655			l2cap_chan_set_err(chan, err);
1656	}
1657
1658	mutex_unlock(&conn->chan_lock);
1659}
1660
1661static void l2cap_info_timeout(struct work_struct *work)
1662{
1663	struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
1664					       info_timer.work);
1665
1666	conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
1667	conn->info_ident = 0;
1668
1669	l2cap_conn_start(conn);
1670}
1671
1672/*
1673 * l2cap_user
1674 * External modules can register l2cap_user objects on l2cap_conn. The ->probe
1675 * callback is called during registration. The ->remove callback is called
1676 * during unregistration.
1677 * An l2cap_user object can either be explicitly unregistered or when the
1678 * underlying l2cap_conn object is deleted. This guarantees that l2cap->hcon,
1679 * l2cap->hchan, .. are valid as long as the remove callback hasn't been called.
1680 * External modules must own a reference to the l2cap_conn object if they intend
1681 * to call l2cap_unregister_user(). The l2cap_conn object might get destroyed at
1682 * any time if they don't.
1683 */
1684
1685int l2cap_register_user(struct l2cap_conn *conn, struct l2cap_user *user)
1686{
1687	struct hci_dev *hdev = conn->hcon->hdev;
1688	int ret;
1689
1690	/* We need to check whether l2cap_conn is registered. If it is not, we
1691	 * must not register the l2cap_user. l2cap_conn_del() is unregisters
1692	 * l2cap_conn objects, but doesn't provide its own locking. Instead, it
1693	 * relies on the parent hci_conn object to be locked. This itself relies
1694	 * on the hci_dev object to be locked. So we must lock the hci device
1695	 * here, too. */
1696
1697	hci_dev_lock(hdev);
1698
1699	if (!list_empty(&user->list)) {
1700		ret = -EINVAL;
1701		goto out_unlock;
1702	}
1703
1704	/* conn->hchan is NULL after l2cap_conn_del() was called */
1705	if (!conn->hchan) {
1706		ret = -ENODEV;
1707		goto out_unlock;
1708	}
1709
1710	ret = user->probe(conn, user);
1711	if (ret)
1712		goto out_unlock;
1713
1714	list_add(&user->list, &conn->users);
1715	ret = 0;
1716
1717out_unlock:
1718	hci_dev_unlock(hdev);
1719	return ret;
1720}
1721EXPORT_SYMBOL(l2cap_register_user);
1722
1723void l2cap_unregister_user(struct l2cap_conn *conn, struct l2cap_user *user)
1724{
1725	struct hci_dev *hdev = conn->hcon->hdev;
1726
1727	hci_dev_lock(hdev);
1728
1729	if (list_empty(&user->list))
1730		goto out_unlock;
1731
1732	list_del_init(&user->list);
1733	user->remove(conn, user);
1734
1735out_unlock:
1736	hci_dev_unlock(hdev);
1737}
1738EXPORT_SYMBOL(l2cap_unregister_user);
1739
1740static void l2cap_unregister_all_users(struct l2cap_conn *conn)
1741{
1742	struct l2cap_user *user;
1743
1744	while (!list_empty(&conn->users)) {
1745		user = list_first_entry(&conn->users, struct l2cap_user, list);
1746		list_del_init(&user->list);
1747		user->remove(conn, user);
1748	}
1749}
1750
1751static void l2cap_conn_del(struct hci_conn *hcon, int err)
1752{
1753	struct l2cap_conn *conn = hcon->l2cap_data;
1754	struct l2cap_chan *chan, *l;
1755
1756	if (!conn)
1757		return;
1758
1759	BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
1760
1761	kfree_skb(conn->rx_skb);
1762
1763	skb_queue_purge(&conn->pending_rx);
1764
1765	/* We can not call flush_work(&conn->pending_rx_work) here since we
1766	 * might block if we are running on a worker from the same workqueue
1767	 * pending_rx_work is waiting on.
1768	 */
1769	if (work_pending(&conn->pending_rx_work))
1770		cancel_work_sync(&conn->pending_rx_work);
1771
1772	cancel_delayed_work_sync(&conn->id_addr_timer);
1773
1774	l2cap_unregister_all_users(conn);
1775
1776	/* Force the connection to be immediately dropped */
1777	hcon->disc_timeout = 0;
1778
1779	mutex_lock(&conn->chan_lock);
1780
1781	/* Kill channels */
1782	list_for_each_entry_safe(chan, l, &conn->chan_l, list) {
1783		l2cap_chan_hold(chan);
1784		l2cap_chan_lock(chan);
1785
1786		l2cap_chan_del(chan, err);
1787
1788		chan->ops->close(chan);
1789
1790		l2cap_chan_unlock(chan);
 
 
1791		l2cap_chan_put(chan);
1792	}
1793
1794	mutex_unlock(&conn->chan_lock);
1795
1796	hci_chan_del(conn->hchan);
1797
1798	if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
1799		cancel_delayed_work_sync(&conn->info_timer);
1800
 
 
 
 
 
1801	hcon->l2cap_data = NULL;
1802	conn->hchan = NULL;
1803	l2cap_conn_put(conn);
1804}
1805
1806static void l2cap_conn_free(struct kref *ref)
1807{
1808	struct l2cap_conn *conn = container_of(ref, struct l2cap_conn, ref);
 
1809
1810	hci_conn_put(conn->hcon);
1811	kfree(conn);
1812}
1813
1814struct l2cap_conn *l2cap_conn_get(struct l2cap_conn *conn)
1815{
1816	kref_get(&conn->ref);
1817	return conn;
1818}
1819EXPORT_SYMBOL(l2cap_conn_get);
1820
1821void l2cap_conn_put(struct l2cap_conn *conn)
1822{
1823	kref_put(&conn->ref, l2cap_conn_free);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1824}
1825EXPORT_SYMBOL(l2cap_conn_put);
1826
1827/* ---- Socket interface ---- */
1828
1829/* Find socket with psm and source / destination bdaddr.
1830 * Returns closest match.
1831 */
1832static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm,
1833						   bdaddr_t *src,
1834						   bdaddr_t *dst,
1835						   u8 link_type)
1836{
1837	struct l2cap_chan *c, *tmp, *c1 = NULL;
1838
1839	read_lock(&chan_list_lock);
1840
1841	list_for_each_entry_safe(c, tmp, &chan_list, global_l) {
1842		if (state && c->state != state)
1843			continue;
1844
1845		if (link_type == ACL_LINK && c->src_type != BDADDR_BREDR)
1846			continue;
1847
1848		if (link_type == LE_LINK && c->src_type == BDADDR_BREDR)
1849			continue;
1850
1851		if (c->chan_type != L2CAP_CHAN_FIXED && c->psm == psm) {
1852			int src_match, dst_match;
1853			int src_any, dst_any;
1854
1855			/* Exact match. */
1856			src_match = !bacmp(&c->src, src);
1857			dst_match = !bacmp(&c->dst, dst);
1858			if (src_match && dst_match) {
1859				if (!l2cap_chan_hold_unless_zero(c))
1860					continue;
1861
1862				read_unlock(&chan_list_lock);
1863				return c;
1864			}
1865
1866			/* Closest match */
1867			src_any = !bacmp(&c->src, BDADDR_ANY);
1868			dst_any = !bacmp(&c->dst, BDADDR_ANY);
1869			if ((src_match && dst_any) || (src_any && dst_match) ||
1870			    (src_any && dst_any))
1871				c1 = c;
1872		}
1873	}
1874
1875	if (c1)
1876		c1 = l2cap_chan_hold_unless_zero(c1);
1877
1878	read_unlock(&chan_list_lock);
1879
1880	return c1;
1881}
1882
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1883static void l2cap_monitor_timeout(struct work_struct *work)
1884{
1885	struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
1886					       monitor_timer.work);
1887
1888	BT_DBG("chan %p", chan);
1889
1890	l2cap_chan_lock(chan);
1891
1892	if (!chan->conn) {
 
1893		l2cap_chan_unlock(chan);
1894		l2cap_chan_put(chan);
1895		return;
1896	}
1897
1898	l2cap_tx(chan, NULL, NULL, L2CAP_EV_MONITOR_TO);
 
1899
 
1900	l2cap_chan_unlock(chan);
1901	l2cap_chan_put(chan);
1902}
1903
1904static void l2cap_retrans_timeout(struct work_struct *work)
1905{
1906	struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
1907					       retrans_timer.work);
1908
1909	BT_DBG("chan %p", chan);
1910
1911	l2cap_chan_lock(chan);
1912
1913	if (!chan->conn) {
1914		l2cap_chan_unlock(chan);
1915		l2cap_chan_put(chan);
1916		return;
1917	}
 
1918
1919	l2cap_tx(chan, NULL, NULL, L2CAP_EV_RETRANS_TO);
1920	l2cap_chan_unlock(chan);
1921	l2cap_chan_put(chan);
1922}
1923
1924static void l2cap_streaming_send(struct l2cap_chan *chan,
1925				 struct sk_buff_head *skbs)
1926{
1927	struct sk_buff *skb;
1928	struct l2cap_ctrl *control;
1929
1930	BT_DBG("chan %p, skbs %p", chan, skbs);
1931
1932	skb_queue_splice_tail_init(skbs, &chan->tx_q);
1933
1934	while (!skb_queue_empty(&chan->tx_q)) {
 
 
 
1935
1936		skb = skb_dequeue(&chan->tx_q);
 
1937
1938		bt_cb(skb)->l2cap.retries = 1;
1939		control = &bt_cb(skb)->l2cap;
1940
1941		control->reqseq = 0;
1942		control->txseq = chan->next_tx_seq;
 
1943
1944		__pack_control(chan, control, skb);
 
 
 
 
 
 
 
 
 
 
1945
1946		if (chan->fcs == L2CAP_FCS_CRC16) {
1947			u16 fcs = crc16(0, (u8 *) skb->data, skb->len);
1948			put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
 
 
1949		}
1950
1951		l2cap_do_send(chan, skb);
1952
1953		BT_DBG("Sent txseq %u", control->txseq);
1954
1955		chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
1956		chan->frames_sent++;
1957	}
1958}
1959
1960static int l2cap_ertm_send(struct l2cap_chan *chan)
1961{
1962	struct sk_buff *skb, *tx_skb;
1963	struct l2cap_ctrl *control;
1964	int sent = 0;
1965
1966	BT_DBG("chan %p", chan);
1967
1968	if (chan->state != BT_CONNECTED)
1969		return -ENOTCONN;
1970
1971	if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
1972		return 0;
1973
1974	while (chan->tx_send_head &&
1975	       chan->unacked_frames < chan->remote_tx_win &&
1976	       chan->tx_state == L2CAP_TX_STATE_XMIT) {
1977
1978		skb = chan->tx_send_head;
1979
1980		bt_cb(skb)->l2cap.retries = 1;
1981		control = &bt_cb(skb)->l2cap;
1982
1983		if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
1984			control->final = 1;
1985
1986		control->reqseq = chan->buffer_seq;
1987		chan->last_acked_seq = chan->buffer_seq;
1988		control->txseq = chan->next_tx_seq;
1989
1990		__pack_control(chan, control, skb);
 
1991
1992		if (chan->fcs == L2CAP_FCS_CRC16) {
1993			u16 fcs = crc16(0, (u8 *) skb->data, skb->len);
1994			put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
1995		}
 
1996
1997		/* Clone after data has been modified. Data is assumed to be
1998		   read-only (for locking purposes) on cloned sk_buffs.
1999		 */
2000		tx_skb = skb_clone(skb, GFP_KERNEL);
2001
2002		if (!tx_skb)
2003			break;
2004
2005		__set_retrans_timer(chan);
 
2006
2007		chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
2008		chan->unacked_frames++;
2009		chan->frames_sent++;
2010		sent++;
2011
2012		if (skb_queue_is_last(&chan->tx_q, skb))
2013			chan->tx_send_head = NULL;
2014		else
2015			chan->tx_send_head = skb_queue_next(&chan->tx_q, skb);
2016
2017		l2cap_do_send(chan, tx_skb);
2018		BT_DBG("Sent txseq %u", control->txseq);
 
 
 
2019	}
2020
2021	BT_DBG("Sent %d, %u unacked, %u in ERTM queue", sent,
2022	       chan->unacked_frames, skb_queue_len(&chan->tx_q));
2023
2024	return sent;
2025}
2026
2027static void l2cap_ertm_resend(struct l2cap_chan *chan)
2028{
2029	struct l2cap_ctrl control;
2030	struct sk_buff *skb;
2031	struct sk_buff *tx_skb;
2032	u16 seq;
2033
2034	BT_DBG("chan %p", chan);
 
2035
2036	if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
2037		return;
2038
2039	while (chan->retrans_list.head != L2CAP_SEQ_LIST_CLEAR) {
2040		seq = l2cap_seq_list_pop(&chan->retrans_list);
2041
2042		skb = l2cap_ertm_seq_in_queue(&chan->tx_q, seq);
2043		if (!skb) {
2044			BT_DBG("Error: Can't retransmit seq %d, frame missing",
2045			       seq);
2046			continue;
2047		}
2048
2049		bt_cb(skb)->l2cap.retries++;
2050		control = bt_cb(skb)->l2cap;
2051
2052		if (chan->max_tx != 0 &&
2053		    bt_cb(skb)->l2cap.retries > chan->max_tx) {
2054			BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
2055			l2cap_send_disconn_req(chan, ECONNRESET);
2056			l2cap_seq_list_clear(&chan->retrans_list);
2057			break;
2058		}
2059
2060		control.reqseq = chan->buffer_seq;
2061		if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
2062			control.final = 1;
2063		else
2064			control.final = 0;
2065
2066		if (skb_cloned(skb)) {
2067			/* Cloned sk_buffs are read-only, so we need a
2068			 * writeable copy
2069			 */
2070			tx_skb = skb_copy(skb, GFP_KERNEL);
2071		} else {
2072			tx_skb = skb_clone(skb, GFP_KERNEL);
2073		}
2074
2075		if (!tx_skb) {
2076			l2cap_seq_list_clear(&chan->retrans_list);
2077			break;
2078		}
2079
2080		/* Update skb contents */
2081		if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
2082			put_unaligned_le32(__pack_extended_control(&control),
2083					   tx_skb->data + L2CAP_HDR_SIZE);
2084		} else {
2085			put_unaligned_le16(__pack_enhanced_control(&control),
2086					   tx_skb->data + L2CAP_HDR_SIZE);
2087		}
2088
2089		/* Update FCS */
2090		if (chan->fcs == L2CAP_FCS_CRC16) {
2091			u16 fcs = crc16(0, (u8 *) tx_skb->data,
2092					tx_skb->len - L2CAP_FCS_SIZE);
2093			put_unaligned_le16(fcs, skb_tail_pointer(tx_skb) -
2094						L2CAP_FCS_SIZE);
2095		}
2096
2097		l2cap_do_send(chan, tx_skb);
2098
2099		BT_DBG("Resent txseq %d", control.txseq);
 
 
 
 
 
 
 
 
 
 
 
 
 
2100
2101		chan->last_acked_seq = chan->buffer_seq;
 
 
 
2102	}
 
 
2103}
2104
2105static void l2cap_retransmit(struct l2cap_chan *chan,
2106			     struct l2cap_ctrl *control)
2107{
2108	BT_DBG("chan %p, control %p", chan, control);
2109
2110	l2cap_seq_list_append(&chan->retrans_list, control->reqseq);
2111	l2cap_ertm_resend(chan);
 
 
 
 
2112}
2113
2114static void l2cap_retransmit_all(struct l2cap_chan *chan,
2115				 struct l2cap_ctrl *control)
2116{
2117	struct sk_buff *skb;
2118
2119	BT_DBG("chan %p, control %p", chan, control);
2120
2121	if (control->poll)
2122		set_bit(CONN_SEND_FBIT, &chan->conn_state);
2123
2124	l2cap_seq_list_clear(&chan->retrans_list);
2125
2126	if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
 
 
 
2127		return;
 
2128
2129	if (chan->unacked_frames) {
2130		skb_queue_walk(&chan->tx_q, skb) {
2131			if (bt_cb(skb)->l2cap.txseq == control->reqseq ||
2132			    skb == chan->tx_send_head)
2133				break;
2134		}
2135
2136		skb_queue_walk_from(&chan->tx_q, skb) {
2137			if (skb == chan->tx_send_head)
2138				break;
2139
2140			l2cap_seq_list_append(&chan->retrans_list,
2141					      bt_cb(skb)->l2cap.txseq);
2142		}
2143
2144		l2cap_ertm_resend(chan);
2145	}
2146}
2147
2148static void l2cap_send_ack(struct l2cap_chan *chan)
2149{
2150	struct l2cap_ctrl control;
2151	u16 frames_to_ack = __seq_offset(chan, chan->buffer_seq,
2152					 chan->last_acked_seq);
2153	int threshold;
2154
2155	BT_DBG("chan %p last_acked_seq %d buffer_seq %d",
2156	       chan, chan->last_acked_seq, chan->buffer_seq);
2157
2158	memset(&control, 0, sizeof(control));
2159	control.sframe = 1;
 
 
2160
2161	if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&
2162	    chan->rx_state == L2CAP_RX_STATE_RECV) {
2163		__clear_ack_timer(chan);
2164		control.super = L2CAP_SUPER_RNR;
2165		control.reqseq = chan->buffer_seq;
2166		l2cap_send_sframe(chan, &control);
2167	} else {
2168		if (!test_bit(CONN_REMOTE_BUSY, &chan->conn_state)) {
2169			l2cap_ertm_send(chan);
2170			/* If any i-frames were sent, they included an ack */
2171			if (chan->buffer_seq == chan->last_acked_seq)
2172				frames_to_ack = 0;
2173		}
2174
2175		/* Ack now if the window is 3/4ths full.
2176		 * Calculate without mul or div
2177		 */
2178		threshold = chan->ack_win;
2179		threshold += threshold << 1;
2180		threshold >>= 2;
2181
2182		BT_DBG("frames_to_ack %u, threshold %d", frames_to_ack,
2183		       threshold);
2184
2185		if (frames_to_ack >= threshold) {
2186			__clear_ack_timer(chan);
2187			control.super = L2CAP_SUPER_RR;
2188			control.reqseq = chan->buffer_seq;
2189			l2cap_send_sframe(chan, &control);
2190			frames_to_ack = 0;
2191		}
2192
2193		if (frames_to_ack)
2194			__set_ack_timer(chan);
2195	}
2196}
2197
2198static inline int l2cap_skbuff_fromiovec(struct l2cap_chan *chan,
2199					 struct msghdr *msg, int len,
2200					 int count, struct sk_buff *skb)
2201{
2202	struct l2cap_conn *conn = chan->conn;
2203	struct sk_buff **frag;
2204	int sent = 0;
2205
2206	if (!copy_from_iter_full(skb_put(skb, count), count, &msg->msg_iter))
2207		return -EFAULT;
2208
2209	sent += count;
2210	len  -= count;
2211
2212	/* Continuation fragments (no L2CAP header) */
2213	frag = &skb_shinfo(skb)->frag_list;
2214	while (len) {
2215		struct sk_buff *tmp;
2216
2217		count = min_t(unsigned int, conn->mtu, len);
2218
2219		tmp = chan->ops->alloc_skb(chan, 0, count,
2220					   msg->msg_flags & MSG_DONTWAIT);
2221		if (IS_ERR(tmp))
2222			return PTR_ERR(tmp);
2223
2224		*frag = tmp;
2225
2226		if (!copy_from_iter_full(skb_put(*frag, count), count,
2227				   &msg->msg_iter))
2228			return -EFAULT;
2229
 
 
2230		sent += count;
2231		len  -= count;
2232
2233		skb->len += (*frag)->len;
2234		skb->data_len += (*frag)->len;
2235
2236		frag = &(*frag)->next;
2237	}
2238
2239	return sent;
2240}
2241
2242static struct sk_buff *l2cap_create_connless_pdu(struct l2cap_chan *chan,
2243						 struct msghdr *msg, size_t len)
 
2244{
2245	struct l2cap_conn *conn = chan->conn;
2246	struct sk_buff *skb;
2247	int err, count, hlen = L2CAP_HDR_SIZE + L2CAP_PSMLEN_SIZE;
2248	struct l2cap_hdr *lh;
2249
2250	BT_DBG("chan %p psm 0x%2.2x len %zu", chan,
2251	       __le16_to_cpu(chan->psm), len);
2252
2253	count = min_t(unsigned int, (conn->mtu - hlen), len);
2254
2255	skb = chan->ops->alloc_skb(chan, hlen, count,
2256				   msg->msg_flags & MSG_DONTWAIT);
2257	if (IS_ERR(skb))
2258		return skb;
2259
 
 
2260	/* Create L2CAP header */
2261	lh = skb_put(skb, L2CAP_HDR_SIZE);
2262	lh->cid = cpu_to_le16(chan->dcid);
2263	lh->len = cpu_to_le16(len + L2CAP_PSMLEN_SIZE);
2264	put_unaligned(chan->psm, (__le16 *) skb_put(skb, L2CAP_PSMLEN_SIZE));
2265
2266	err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
2267	if (unlikely(err < 0)) {
2268		kfree_skb(skb);
2269		return ERR_PTR(err);
2270	}
2271	return skb;
2272}
2273
2274static struct sk_buff *l2cap_create_basic_pdu(struct l2cap_chan *chan,
2275					      struct msghdr *msg, size_t len)
 
2276{
2277	struct l2cap_conn *conn = chan->conn;
2278	struct sk_buff *skb;
2279	int err, count;
2280	struct l2cap_hdr *lh;
2281
2282	BT_DBG("chan %p len %zu", chan, len);
2283
2284	count = min_t(unsigned int, (conn->mtu - L2CAP_HDR_SIZE), len);
2285
2286	skb = chan->ops->alloc_skb(chan, L2CAP_HDR_SIZE, count,
2287				   msg->msg_flags & MSG_DONTWAIT);
2288	if (IS_ERR(skb))
2289		return skb;
2290
 
 
2291	/* Create L2CAP header */
2292	lh = skb_put(skb, L2CAP_HDR_SIZE);
2293	lh->cid = cpu_to_le16(chan->dcid);
2294	lh->len = cpu_to_le16(len);
2295
2296	err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
2297	if (unlikely(err < 0)) {
2298		kfree_skb(skb);
2299		return ERR_PTR(err);
2300	}
2301	return skb;
2302}
2303
2304static struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan,
2305					       struct msghdr *msg, size_t len,
2306					       u16 sdulen)
2307{
2308	struct l2cap_conn *conn = chan->conn;
2309	struct sk_buff *skb;
2310	int err, count, hlen;
2311	struct l2cap_hdr *lh;
2312
2313	BT_DBG("chan %p len %zu", chan, len);
2314
2315	if (!conn)
2316		return ERR_PTR(-ENOTCONN);
2317
2318	hlen = __ertm_hdr_size(chan);
 
 
 
2319
2320	if (sdulen)
2321		hlen += L2CAP_SDULEN_SIZE;
2322
2323	if (chan->fcs == L2CAP_FCS_CRC16)
2324		hlen += L2CAP_FCS_SIZE;
2325
2326	count = min_t(unsigned int, (conn->mtu - hlen), len);
2327
2328	skb = chan->ops->alloc_skb(chan, hlen, count,
2329				   msg->msg_flags & MSG_DONTWAIT);
2330	if (IS_ERR(skb))
2331		return skb;
2332
2333	/* Create L2CAP header */
2334	lh = skb_put(skb, L2CAP_HDR_SIZE);
2335	lh->cid = cpu_to_le16(chan->dcid);
2336	lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
2337
2338	/* Control header is populated later */
2339	if (test_bit(FLAG_EXT_CTRL, &chan->flags))
2340		put_unaligned_le32(0, skb_put(skb, L2CAP_EXT_CTRL_SIZE));
2341	else
2342		put_unaligned_le16(0, skb_put(skb, L2CAP_ENH_CTRL_SIZE));
2343
2344	if (sdulen)
2345		put_unaligned_le16(sdulen, skb_put(skb, L2CAP_SDULEN_SIZE));
2346
2347	err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
2348	if (unlikely(err < 0)) {
2349		kfree_skb(skb);
2350		return ERR_PTR(err);
2351	}
2352
2353	bt_cb(skb)->l2cap.fcs = chan->fcs;
2354	bt_cb(skb)->l2cap.retries = 0;
 
 
2355	return skb;
2356}
2357
2358static int l2cap_segment_sdu(struct l2cap_chan *chan,
2359			     struct sk_buff_head *seg_queue,
2360			     struct msghdr *msg, size_t len)
2361{
2362	struct sk_buff *skb;
2363	u16 sdu_len;
2364	size_t pdu_len;
 
2365	u8 sar;
2366
2367	BT_DBG("chan %p, msg %p, len %zu", chan, msg, len);
2368
2369	/* It is critical that ERTM PDUs fit in a single HCI fragment,
2370	 * so fragmented skbs are not used.  The HCI layer's handling
2371	 * of fragmented skbs is not compatible with ERTM's queueing.
2372	 */
2373
2374	/* PDU size is derived from the HCI MTU */
2375	pdu_len = chan->conn->mtu;
2376
2377	/* Constrain PDU size for BR/EDR connections */
2378	pdu_len = min_t(size_t, pdu_len, L2CAP_BREDR_MAX_PAYLOAD);
2379
2380	/* Adjust for largest possible L2CAP overhead. */
2381	if (chan->fcs)
2382		pdu_len -= L2CAP_FCS_SIZE;
2383
2384	pdu_len -= __ertm_hdr_size(chan);
2385
2386	/* Remote device may have requested smaller PDUs */
2387	pdu_len = min_t(size_t, pdu_len, chan->remote_mps);
2388
2389	if (len <= pdu_len) {
2390		sar = L2CAP_SAR_UNSEGMENTED;
2391		sdu_len = 0;
2392		pdu_len = len;
2393	} else {
2394		sar = L2CAP_SAR_START;
2395		sdu_len = len;
 
2396	}
2397
2398	while (len > 0) {
2399		skb = l2cap_create_iframe_pdu(chan, msg, pdu_len, sdu_len);
2400
2401		if (IS_ERR(skb)) {
2402			__skb_queue_purge(seg_queue);
2403			return PTR_ERR(skb);
2404		}
2405
2406		bt_cb(skb)->l2cap.sar = sar;
2407		__skb_queue_tail(seg_queue, skb);
2408
2409		len -= pdu_len;
2410		if (sdu_len)
2411			sdu_len = 0;
 
 
2412
2413		if (len <= pdu_len) {
2414			sar = L2CAP_SAR_END;
2415			pdu_len = len;
2416		} else {
2417			sar = L2CAP_SAR_CONTINUE;
2418		}
2419	}
2420
2421	return 0;
2422}
2423
2424static struct sk_buff *l2cap_create_le_flowctl_pdu(struct l2cap_chan *chan,
2425						   struct msghdr *msg,
2426						   size_t len, u16 sdulen)
2427{
2428	struct l2cap_conn *conn = chan->conn;
2429	struct sk_buff *skb;
2430	int err, count, hlen;
2431	struct l2cap_hdr *lh;
2432
2433	BT_DBG("chan %p len %zu", chan, len);
2434
2435	if (!conn)
2436		return ERR_PTR(-ENOTCONN);
2437
2438	hlen = L2CAP_HDR_SIZE;
2439
2440	if (sdulen)
2441		hlen += L2CAP_SDULEN_SIZE;
2442
2443	count = min_t(unsigned int, (conn->mtu - hlen), len);
2444
2445	skb = chan->ops->alloc_skb(chan, hlen, count,
2446				   msg->msg_flags & MSG_DONTWAIT);
2447	if (IS_ERR(skb))
2448		return skb;
2449
2450	/* Create L2CAP header */
2451	lh = skb_put(skb, L2CAP_HDR_SIZE);
2452	lh->cid = cpu_to_le16(chan->dcid);
2453	lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
2454
2455	if (sdulen)
2456		put_unaligned_le16(sdulen, skb_put(skb, L2CAP_SDULEN_SIZE));
2457
2458	err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
2459	if (unlikely(err < 0)) {
2460		kfree_skb(skb);
2461		return ERR_PTR(err);
2462	}
2463
2464	return skb;
2465}
2466
2467static int l2cap_segment_le_sdu(struct l2cap_chan *chan,
2468				struct sk_buff_head *seg_queue,
2469				struct msghdr *msg, size_t len)
2470{
2471	struct sk_buff *skb;
2472	size_t pdu_len;
2473	u16 sdu_len;
2474
2475	BT_DBG("chan %p, msg %p, len %zu", chan, msg, len);
2476
2477	sdu_len = len;
2478	pdu_len = chan->remote_mps - L2CAP_SDULEN_SIZE;
2479
2480	while (len > 0) {
2481		if (len <= pdu_len)
2482			pdu_len = len;
2483
2484		skb = l2cap_create_le_flowctl_pdu(chan, msg, pdu_len, sdu_len);
2485		if (IS_ERR(skb)) {
2486			__skb_queue_purge(seg_queue);
2487			return PTR_ERR(skb);
2488		}
2489
2490		__skb_queue_tail(seg_queue, skb);
2491
2492		len -= pdu_len;
2493
2494		if (sdu_len) {
2495			sdu_len = 0;
2496			pdu_len += L2CAP_SDULEN_SIZE;
2497		}
2498	}
2499
2500	return 0;
2501}
2502
2503static void l2cap_le_flowctl_send(struct l2cap_chan *chan)
2504{
2505	int sent = 0;
2506
2507	BT_DBG("chan %p", chan);
2508
2509	while (chan->tx_credits && !skb_queue_empty(&chan->tx_q)) {
2510		l2cap_do_send(chan, skb_dequeue(&chan->tx_q));
2511		chan->tx_credits--;
2512		sent++;
2513	}
2514
2515	BT_DBG("Sent %d credits %u queued %u", sent, chan->tx_credits,
2516	       skb_queue_len(&chan->tx_q));
2517}
2518
2519int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len)
 
2520{
2521	struct sk_buff *skb;
2522	int err;
2523	struct sk_buff_head seg_queue;
2524
2525	if (!chan->conn)
2526		return -ENOTCONN;
2527
2528	/* Connectionless channel */
2529	if (chan->chan_type == L2CAP_CHAN_CONN_LESS) {
2530		skb = l2cap_create_connless_pdu(chan, msg, len);
2531		if (IS_ERR(skb))
2532			return PTR_ERR(skb);
2533
2534		l2cap_do_send(chan, skb);
2535		return len;
2536	}
2537
2538	switch (chan->mode) {
2539	case L2CAP_MODE_LE_FLOWCTL:
2540	case L2CAP_MODE_EXT_FLOWCTL:
2541		/* Check outgoing MTU */
2542		if (len > chan->omtu)
2543			return -EMSGSIZE;
2544
2545		__skb_queue_head_init(&seg_queue);
2546
2547		err = l2cap_segment_le_sdu(chan, &seg_queue, msg, len);
2548
2549		if (chan->state != BT_CONNECTED) {
2550			__skb_queue_purge(&seg_queue);
2551			err = -ENOTCONN;
2552		}
2553
2554		if (err)
2555			return err;
2556
2557		skb_queue_splice_tail_init(&seg_queue, &chan->tx_q);
2558
2559		l2cap_le_flowctl_send(chan);
2560
2561		if (!chan->tx_credits)
2562			chan->ops->suspend(chan);
2563
2564		err = len;
2565
2566		break;
2567
2568	case L2CAP_MODE_BASIC:
2569		/* Check outgoing MTU */
2570		if (len > chan->omtu)
2571			return -EMSGSIZE;
2572
2573		/* Create a basic PDU */
2574		skb = l2cap_create_basic_pdu(chan, msg, len);
2575		if (IS_ERR(skb))
2576			return PTR_ERR(skb);
2577
2578		l2cap_do_send(chan, skb);
2579		err = len;
2580		break;
2581
2582	case L2CAP_MODE_ERTM:
2583	case L2CAP_MODE_STREAMING:
2584		/* Check outgoing MTU */
2585		if (len > chan->omtu) {
2586			err = -EMSGSIZE;
2587			break;
2588		}
2589
2590		__skb_queue_head_init(&seg_queue);
2591
2592		/* Do segmentation before calling in to the state machine,
2593		 * since it's possible to block while waiting for memory
2594		 * allocation.
2595		 */
2596		err = l2cap_segment_sdu(chan, &seg_queue, msg, len);
2597
 
 
 
 
 
 
 
 
2598		if (err)
2599			break;
2600
 
 
 
 
2601		if (chan->mode == L2CAP_MODE_ERTM)
2602			l2cap_tx(chan, NULL, &seg_queue, L2CAP_EV_DATA_REQUEST);
2603		else
2604			l2cap_streaming_send(chan, &seg_queue);
2605
2606		err = len;
 
2607
2608		/* If the skbs were not queued for sending, they'll still be in
2609		 * seg_queue and need to be purged.
2610		 */
2611		__skb_queue_purge(&seg_queue);
2612		break;
2613
2614	default:
2615		BT_DBG("bad state %1.1x", chan->mode);
2616		err = -EBADFD;
2617	}
2618
2619	return err;
2620}
2621EXPORT_SYMBOL_GPL(l2cap_chan_send);
2622
2623static void l2cap_send_srej(struct l2cap_chan *chan, u16 txseq)
2624{
2625	struct l2cap_ctrl control;
2626	u16 seq;
2627
2628	BT_DBG("chan %p, txseq %u", chan, txseq);
2629
2630	memset(&control, 0, sizeof(control));
2631	control.sframe = 1;
2632	control.super = L2CAP_SUPER_SREJ;
2633
2634	for (seq = chan->expected_tx_seq; seq != txseq;
2635	     seq = __next_seq(chan, seq)) {
2636		if (!l2cap_ertm_seq_in_queue(&chan->srej_q, seq)) {
2637			control.reqseq = seq;
2638			l2cap_send_sframe(chan, &control);
2639			l2cap_seq_list_append(&chan->srej_list, seq);
2640		}
2641	}
2642
2643	chan->expected_tx_seq = __next_seq(chan, txseq);
2644}
2645
2646static void l2cap_send_srej_tail(struct l2cap_chan *chan)
2647{
2648	struct l2cap_ctrl control;
2649
2650	BT_DBG("chan %p", chan);
2651
2652	if (chan->srej_list.tail == L2CAP_SEQ_LIST_CLEAR)
2653		return;
2654
2655	memset(&control, 0, sizeof(control));
2656	control.sframe = 1;
2657	control.super = L2CAP_SUPER_SREJ;
2658	control.reqseq = chan->srej_list.tail;
2659	l2cap_send_sframe(chan, &control);
2660}
2661
2662static void l2cap_send_srej_list(struct l2cap_chan *chan, u16 txseq)
2663{
2664	struct l2cap_ctrl control;
2665	u16 initial_head;
2666	u16 seq;
2667
2668	BT_DBG("chan %p, txseq %u", chan, txseq);
2669
2670	memset(&control, 0, sizeof(control));
2671	control.sframe = 1;
2672	control.super = L2CAP_SUPER_SREJ;
2673
2674	/* Capture initial list head to allow only one pass through the list. */
2675	initial_head = chan->srej_list.head;
2676
2677	do {
2678		seq = l2cap_seq_list_pop(&chan->srej_list);
2679		if (seq == txseq || seq == L2CAP_SEQ_LIST_CLEAR)
2680			break;
2681
2682		control.reqseq = seq;
2683		l2cap_send_sframe(chan, &control);
2684		l2cap_seq_list_append(&chan->srej_list, seq);
2685	} while (chan->srej_list.head != initial_head);
2686}
2687
2688static void l2cap_process_reqseq(struct l2cap_chan *chan, u16 reqseq)
2689{
2690	struct sk_buff *acked_skb;
2691	u16 ackseq;
2692
2693	BT_DBG("chan %p, reqseq %u", chan, reqseq);
2694
2695	if (chan->unacked_frames == 0 || reqseq == chan->expected_ack_seq)
2696		return;
2697
2698	BT_DBG("expected_ack_seq %u, unacked_frames %u",
2699	       chan->expected_ack_seq, chan->unacked_frames);
2700
2701	for (ackseq = chan->expected_ack_seq; ackseq != reqseq;
2702	     ackseq = __next_seq(chan, ackseq)) {
2703
2704		acked_skb = l2cap_ertm_seq_in_queue(&chan->tx_q, ackseq);
2705		if (acked_skb) {
2706			skb_unlink(acked_skb, &chan->tx_q);
2707			kfree_skb(acked_skb);
2708			chan->unacked_frames--;
2709		}
2710	}
2711
2712	chan->expected_ack_seq = reqseq;
2713
2714	if (chan->unacked_frames == 0)
2715		__clear_retrans_timer(chan);
2716
2717	BT_DBG("unacked_frames %u", chan->unacked_frames);
2718}
2719
2720static void l2cap_abort_rx_srej_sent(struct l2cap_chan *chan)
2721{
2722	BT_DBG("chan %p", chan);
2723
2724	chan->expected_tx_seq = chan->buffer_seq;
2725	l2cap_seq_list_clear(&chan->srej_list);
2726	skb_queue_purge(&chan->srej_q);
2727	chan->rx_state = L2CAP_RX_STATE_RECV;
2728}
2729
2730static void l2cap_tx_state_xmit(struct l2cap_chan *chan,
2731				struct l2cap_ctrl *control,
2732				struct sk_buff_head *skbs, u8 event)
2733{
2734	BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,
2735	       event);
2736
2737	switch (event) {
2738	case L2CAP_EV_DATA_REQUEST:
2739		if (chan->tx_send_head == NULL)
2740			chan->tx_send_head = skb_peek(skbs);
2741
2742		skb_queue_splice_tail_init(skbs, &chan->tx_q);
2743		l2cap_ertm_send(chan);
2744		break;
2745	case L2CAP_EV_LOCAL_BUSY_DETECTED:
2746		BT_DBG("Enter LOCAL_BUSY");
2747		set_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2748
2749		if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
2750			/* The SREJ_SENT state must be aborted if we are to
2751			 * enter the LOCAL_BUSY state.
2752			 */
2753			l2cap_abort_rx_srej_sent(chan);
2754		}
2755
2756		l2cap_send_ack(chan);
2757
2758		break;
2759	case L2CAP_EV_LOCAL_BUSY_CLEAR:
2760		BT_DBG("Exit LOCAL_BUSY");
2761		clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2762
2763		if (test_bit(CONN_RNR_SENT, &chan->conn_state)) {
2764			struct l2cap_ctrl local_control;
2765
2766			memset(&local_control, 0, sizeof(local_control));
2767			local_control.sframe = 1;
2768			local_control.super = L2CAP_SUPER_RR;
2769			local_control.poll = 1;
2770			local_control.reqseq = chan->buffer_seq;
2771			l2cap_send_sframe(chan, &local_control);
2772
2773			chan->retry_count = 1;
2774			__set_monitor_timer(chan);
2775			chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2776		}
2777		break;
2778	case L2CAP_EV_RECV_REQSEQ_AND_FBIT:
2779		l2cap_process_reqseq(chan, control->reqseq);
2780		break;
2781	case L2CAP_EV_EXPLICIT_POLL:
2782		l2cap_send_rr_or_rnr(chan, 1);
2783		chan->retry_count = 1;
2784		__set_monitor_timer(chan);
2785		__clear_ack_timer(chan);
2786		chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2787		break;
2788	case L2CAP_EV_RETRANS_TO:
2789		l2cap_send_rr_or_rnr(chan, 1);
2790		chan->retry_count = 1;
2791		__set_monitor_timer(chan);
2792		chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2793		break;
2794	case L2CAP_EV_RECV_FBIT:
2795		/* Nothing to process */
2796		break;
2797	default:
2798		break;
2799	}
2800}
2801
2802static void l2cap_tx_state_wait_f(struct l2cap_chan *chan,
2803				  struct l2cap_ctrl *control,
2804				  struct sk_buff_head *skbs, u8 event)
2805{
2806	BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,
2807	       event);
2808
2809	switch (event) {
2810	case L2CAP_EV_DATA_REQUEST:
2811		if (chan->tx_send_head == NULL)
2812			chan->tx_send_head = skb_peek(skbs);
2813		/* Queue data, but don't send. */
2814		skb_queue_splice_tail_init(skbs, &chan->tx_q);
2815		break;
2816	case L2CAP_EV_LOCAL_BUSY_DETECTED:
2817		BT_DBG("Enter LOCAL_BUSY");
2818		set_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2819
2820		if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
2821			/* The SREJ_SENT state must be aborted if we are to
2822			 * enter the LOCAL_BUSY state.
2823			 */
2824			l2cap_abort_rx_srej_sent(chan);
2825		}
2826
2827		l2cap_send_ack(chan);
2828
2829		break;
2830	case L2CAP_EV_LOCAL_BUSY_CLEAR:
2831		BT_DBG("Exit LOCAL_BUSY");
2832		clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2833
2834		if (test_bit(CONN_RNR_SENT, &chan->conn_state)) {
2835			struct l2cap_ctrl local_control;
2836			memset(&local_control, 0, sizeof(local_control));
2837			local_control.sframe = 1;
2838			local_control.super = L2CAP_SUPER_RR;
2839			local_control.poll = 1;
2840			local_control.reqseq = chan->buffer_seq;
2841			l2cap_send_sframe(chan, &local_control);
2842
2843			chan->retry_count = 1;
2844			__set_monitor_timer(chan);
2845			chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2846		}
2847		break;
2848	case L2CAP_EV_RECV_REQSEQ_AND_FBIT:
2849		l2cap_process_reqseq(chan, control->reqseq);
2850		fallthrough;
2851
2852	case L2CAP_EV_RECV_FBIT:
2853		if (control && control->final) {
2854			__clear_monitor_timer(chan);
2855			if (chan->unacked_frames > 0)
2856				__set_retrans_timer(chan);
2857			chan->retry_count = 0;
2858			chan->tx_state = L2CAP_TX_STATE_XMIT;
2859			BT_DBG("recv fbit tx_state 0x2.2%x", chan->tx_state);
2860		}
2861		break;
2862	case L2CAP_EV_EXPLICIT_POLL:
2863		/* Ignore */
2864		break;
2865	case L2CAP_EV_MONITOR_TO:
2866		if (chan->max_tx == 0 || chan->retry_count < chan->max_tx) {
2867			l2cap_send_rr_or_rnr(chan, 1);
2868			__set_monitor_timer(chan);
2869			chan->retry_count++;
2870		} else {
2871			l2cap_send_disconn_req(chan, ECONNABORTED);
2872		}
2873		break;
2874	default:
2875		break;
2876	}
2877}
2878
2879static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
2880		     struct sk_buff_head *skbs, u8 event)
2881{
2882	BT_DBG("chan %p, control %p, skbs %p, event %d, state %d",
2883	       chan, control, skbs, event, chan->tx_state);
2884
2885	switch (chan->tx_state) {
2886	case L2CAP_TX_STATE_XMIT:
2887		l2cap_tx_state_xmit(chan, control, skbs, event);
2888		break;
2889	case L2CAP_TX_STATE_WAIT_F:
2890		l2cap_tx_state_wait_f(chan, control, skbs, event);
2891		break;
2892	default:
2893		/* Ignore event */
2894		break;
2895	}
2896}
2897
2898static void l2cap_pass_to_tx(struct l2cap_chan *chan,
2899			     struct l2cap_ctrl *control)
2900{
2901	BT_DBG("chan %p, control %p", chan, control);
2902	l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_REQSEQ_AND_FBIT);
2903}
2904
2905static void l2cap_pass_to_tx_fbit(struct l2cap_chan *chan,
2906				  struct l2cap_ctrl *control)
2907{
2908	BT_DBG("chan %p, control %p", chan, control);
2909	l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_FBIT);
2910}
2911
2912/* Copy frame to all raw sockets on that connection */
2913static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb)
2914{
2915	struct sk_buff *nskb;
2916	struct l2cap_chan *chan;
2917
2918	BT_DBG("conn %p", conn);
2919
2920	mutex_lock(&conn->chan_lock);
2921
2922	list_for_each_entry(chan, &conn->chan_l, list) {
 
2923		if (chan->chan_type != L2CAP_CHAN_RAW)
2924			continue;
2925
2926		/* Don't send frame to the channel it came from */
2927		if (bt_cb(skb)->l2cap.chan == chan)
2928			continue;
2929
2930		nskb = skb_clone(skb, GFP_KERNEL);
2931		if (!nskb)
2932			continue;
2933		if (chan->ops->recv(chan, nskb))
 
2934			kfree_skb(nskb);
2935	}
2936
2937	mutex_unlock(&conn->chan_lock);
2938}
2939
2940/* ---- L2CAP signalling commands ---- */
2941static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn, u8 code,
2942				       u8 ident, u16 dlen, void *data)
2943{
2944	struct sk_buff *skb, **frag;
2945	struct l2cap_cmd_hdr *cmd;
2946	struct l2cap_hdr *lh;
2947	int len, count;
2948
2949	BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %u",
2950	       conn, code, ident, dlen);
2951
2952	if (conn->mtu < L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE)
2953		return NULL;
2954
2955	len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen;
2956	count = min_t(unsigned int, conn->mtu, len);
2957
2958	skb = bt_skb_alloc(count, GFP_KERNEL);
2959	if (!skb)
2960		return NULL;
2961
2962	lh = skb_put(skb, L2CAP_HDR_SIZE);
2963	lh->len = cpu_to_le16(L2CAP_CMD_HDR_SIZE + dlen);
2964
2965	if (conn->hcon->type == LE_LINK)
2966		lh->cid = cpu_to_le16(L2CAP_CID_LE_SIGNALING);
2967	else
2968		lh->cid = cpu_to_le16(L2CAP_CID_SIGNALING);
2969
2970	cmd = skb_put(skb, L2CAP_CMD_HDR_SIZE);
2971	cmd->code  = code;
2972	cmd->ident = ident;
2973	cmd->len   = cpu_to_le16(dlen);
2974
2975	if (dlen) {
2976		count -= L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE;
2977		skb_put_data(skb, data, count);
2978		data += count;
2979	}
2980
2981	len -= skb->len;
2982
2983	/* Continuation fragments (no L2CAP header) */
2984	frag = &skb_shinfo(skb)->frag_list;
2985	while (len) {
2986		count = min_t(unsigned int, conn->mtu, len);
2987
2988		*frag = bt_skb_alloc(count, GFP_KERNEL);
2989		if (!*frag)
2990			goto fail;
2991
2992		skb_put_data(*frag, data, count);
2993
2994		len  -= count;
2995		data += count;
2996
2997		frag = &(*frag)->next;
2998	}
2999
3000	return skb;
3001
3002fail:
3003	kfree_skb(skb);
3004	return NULL;
3005}
3006
3007static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen,
3008				     unsigned long *val)
3009{
3010	struct l2cap_conf_opt *opt = *ptr;
3011	int len;
3012
3013	len = L2CAP_CONF_OPT_SIZE + opt->len;
3014	*ptr += len;
3015
3016	*type = opt->type;
3017	*olen = opt->len;
3018
3019	switch (opt->len) {
3020	case 1:
3021		*val = *((u8 *) opt->val);
3022		break;
3023
3024	case 2:
3025		*val = get_unaligned_le16(opt->val);
3026		break;
3027
3028	case 4:
3029		*val = get_unaligned_le32(opt->val);
3030		break;
3031
3032	default:
3033		*val = (unsigned long) opt->val;
3034		break;
3035	}
3036
3037	BT_DBG("type 0x%2.2x len %u val 0x%lx", *type, opt->len, *val);
3038	return len;
3039}
3040
3041static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val, size_t size)
3042{
3043	struct l2cap_conf_opt *opt = *ptr;
3044
3045	BT_DBG("type 0x%2.2x len %u val 0x%lx", type, len, val);
3046
3047	if (size < L2CAP_CONF_OPT_SIZE + len)
3048		return;
3049
3050	opt->type = type;
3051	opt->len  = len;
3052
3053	switch (len) {
3054	case 1:
3055		*((u8 *) opt->val)  = val;
3056		break;
3057
3058	case 2:
3059		put_unaligned_le16(val, opt->val);
3060		break;
3061
3062	case 4:
3063		put_unaligned_le32(val, opt->val);
3064		break;
3065
3066	default:
3067		memcpy(opt->val, (void *) val, len);
3068		break;
3069	}
3070
3071	*ptr += L2CAP_CONF_OPT_SIZE + len;
3072}
3073
3074static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan, size_t size)
3075{
3076	struct l2cap_conf_efs efs;
3077
3078	switch (chan->mode) {
3079	case L2CAP_MODE_ERTM:
3080		efs.id		= chan->local_id;
3081		efs.stype	= chan->local_stype;
3082		efs.msdu	= cpu_to_le16(chan->local_msdu);
3083		efs.sdu_itime	= cpu_to_le32(chan->local_sdu_itime);
3084		efs.acc_lat	= cpu_to_le32(L2CAP_DEFAULT_ACC_LAT);
3085		efs.flush_to	= cpu_to_le32(L2CAP_EFS_DEFAULT_FLUSH_TO);
3086		break;
3087
3088	case L2CAP_MODE_STREAMING:
3089		efs.id		= 1;
3090		efs.stype	= L2CAP_SERV_BESTEFFORT;
3091		efs.msdu	= cpu_to_le16(chan->local_msdu);
3092		efs.sdu_itime	= cpu_to_le32(chan->local_sdu_itime);
3093		efs.acc_lat	= 0;
3094		efs.flush_to	= 0;
3095		break;
3096
3097	default:
3098		return;
3099	}
3100
3101	l2cap_add_conf_opt(ptr, L2CAP_CONF_EFS, sizeof(efs),
3102			   (unsigned long) &efs, size);
3103}
3104
3105static void l2cap_ack_timeout(struct work_struct *work)
3106{
3107	struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
3108					       ack_timer.work);
3109	u16 frames_to_ack;
3110
3111	BT_DBG("chan %p", chan);
3112
3113	l2cap_chan_lock(chan);
3114
3115	frames_to_ack = __seq_offset(chan, chan->buffer_seq,
3116				     chan->last_acked_seq);
3117
3118	if (frames_to_ack)
3119		l2cap_send_rr_or_rnr(chan, 0);
3120
3121	l2cap_chan_unlock(chan);
 
3122	l2cap_chan_put(chan);
3123}
3124
3125int l2cap_ertm_init(struct l2cap_chan *chan)
3126{
3127	int err;
3128
3129	chan->next_tx_seq = 0;
3130	chan->expected_tx_seq = 0;
3131	chan->expected_ack_seq = 0;
3132	chan->unacked_frames = 0;
3133	chan->buffer_seq = 0;
 
3134	chan->frames_sent = 0;
3135	chan->last_acked_seq = 0;
3136	chan->sdu = NULL;
3137	chan->sdu_last_frag = NULL;
3138	chan->sdu_len = 0;
3139
3140	skb_queue_head_init(&chan->tx_q);
3141
3142	if (chan->mode != L2CAP_MODE_ERTM)
3143		return 0;
3144
3145	chan->rx_state = L2CAP_RX_STATE_RECV;
3146	chan->tx_state = L2CAP_TX_STATE_XMIT;
3147
 
 
 
 
3148	skb_queue_head_init(&chan->srej_q);
3149
 
3150	err = l2cap_seq_list_init(&chan->srej_list, chan->tx_win);
3151	if (err < 0)
3152		return err;
3153
3154	err = l2cap_seq_list_init(&chan->retrans_list, chan->remote_tx_win);
3155	if (err < 0)
3156		l2cap_seq_list_free(&chan->srej_list);
3157
3158	return err;
3159}
3160
3161static inline __u8 l2cap_select_mode(__u8 mode, __u16 remote_feat_mask)
3162{
3163	switch (mode) {
3164	case L2CAP_MODE_STREAMING:
3165	case L2CAP_MODE_ERTM:
3166		if (l2cap_mode_supported(mode, remote_feat_mask))
3167			return mode;
3168		fallthrough;
3169	default:
3170		return L2CAP_MODE_BASIC;
3171	}
3172}
3173
3174static inline bool __l2cap_ews_supported(struct l2cap_conn *conn)
3175{
3176	return (conn->feat_mask & L2CAP_FEAT_EXT_WINDOW);
3177}
3178
3179static inline bool __l2cap_efs_supported(struct l2cap_conn *conn)
3180{
3181	return (conn->feat_mask & L2CAP_FEAT_EXT_FLOW);
3182}
3183
3184static void __l2cap_set_ertm_timeouts(struct l2cap_chan *chan,
3185				      struct l2cap_conf_rfc *rfc)
3186{
3187	rfc->retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO);
3188	rfc->monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO);
3189}
3190
3191static inline void l2cap_txwin_setup(struct l2cap_chan *chan)
3192{
3193	if (chan->tx_win > L2CAP_DEFAULT_TX_WINDOW &&
3194	    __l2cap_ews_supported(chan->conn)) {
3195		/* use extended control field */
3196		set_bit(FLAG_EXT_CTRL, &chan->flags);
3197		chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;
3198	} else {
3199		chan->tx_win = min_t(u16, chan->tx_win,
3200				     L2CAP_DEFAULT_TX_WINDOW);
3201		chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
3202	}
3203	chan->ack_win = chan->tx_win;
3204}
3205
3206static void l2cap_mtu_auto(struct l2cap_chan *chan)
3207{
3208	struct hci_conn *conn = chan->conn->hcon;
3209
3210	chan->imtu = L2CAP_DEFAULT_MIN_MTU;
3211
3212	/* The 2-DH1 packet has between 2 and 56 information bytes
3213	 * (including the 2-byte payload header)
3214	 */
3215	if (!(conn->pkt_type & HCI_2DH1))
3216		chan->imtu = 54;
3217
3218	/* The 3-DH1 packet has between 2 and 85 information bytes
3219	 * (including the 2-byte payload header)
3220	 */
3221	if (!(conn->pkt_type & HCI_3DH1))
3222		chan->imtu = 83;
3223
3224	/* The 2-DH3 packet has between 2 and 369 information bytes
3225	 * (including the 2-byte payload header)
3226	 */
3227	if (!(conn->pkt_type & HCI_2DH3))
3228		chan->imtu = 367;
3229
3230	/* The 3-DH3 packet has between 2 and 554 information bytes
3231	 * (including the 2-byte payload header)
3232	 */
3233	if (!(conn->pkt_type & HCI_3DH3))
3234		chan->imtu = 552;
3235
3236	/* The 2-DH5 packet has between 2 and 681 information bytes
3237	 * (including the 2-byte payload header)
3238	 */
3239	if (!(conn->pkt_type & HCI_2DH5))
3240		chan->imtu = 679;
3241
3242	/* The 3-DH5 packet has between 2 and 1023 information bytes
3243	 * (including the 2-byte payload header)
3244	 */
3245	if (!(conn->pkt_type & HCI_3DH5))
3246		chan->imtu = 1021;
3247}
3248
3249static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size)
3250{
3251	struct l2cap_conf_req *req = data;
3252	struct l2cap_conf_rfc rfc = { .mode = chan->mode };
3253	void *ptr = req->data;
3254	void *endptr = data + data_size;
3255	u16 size;
3256
3257	BT_DBG("chan %p", chan);
3258
3259	if (chan->num_conf_req || chan->num_conf_rsp)
3260		goto done;
3261
3262	switch (chan->mode) {
3263	case L2CAP_MODE_STREAMING:
3264	case L2CAP_MODE_ERTM:
3265		if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state))
3266			break;
3267
3268		if (__l2cap_efs_supported(chan->conn))
3269			set_bit(FLAG_EFS_ENABLE, &chan->flags);
3270
3271		fallthrough;
3272	default:
3273		chan->mode = l2cap_select_mode(rfc.mode, chan->conn->feat_mask);
3274		break;
3275	}
3276
3277done:
3278	if (chan->imtu != L2CAP_DEFAULT_MTU) {
3279		if (!chan->imtu)
3280			l2cap_mtu_auto(chan);
3281		l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu,
3282				   endptr - ptr);
3283	}
3284
3285	switch (chan->mode) {
3286	case L2CAP_MODE_BASIC:
3287		if (disable_ertm)
3288			break;
3289
3290		if (!(chan->conn->feat_mask & L2CAP_FEAT_ERTM) &&
3291		    !(chan->conn->feat_mask & L2CAP_FEAT_STREAMING))
3292			break;
3293
3294		rfc.mode            = L2CAP_MODE_BASIC;
3295		rfc.txwin_size      = 0;
3296		rfc.max_transmit    = 0;
3297		rfc.retrans_timeout = 0;
3298		rfc.monitor_timeout = 0;
3299		rfc.max_pdu_size    = 0;
3300
3301		l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3302				   (unsigned long) &rfc, endptr - ptr);
3303		break;
3304
3305	case L2CAP_MODE_ERTM:
3306		rfc.mode            = L2CAP_MODE_ERTM;
3307		rfc.max_transmit    = chan->max_tx;
3308
3309		__l2cap_set_ertm_timeouts(chan, &rfc);
3310
3311		size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -
3312			     L2CAP_EXT_HDR_SIZE - L2CAP_SDULEN_SIZE -
3313			     L2CAP_FCS_SIZE);
 
3314		rfc.max_pdu_size = cpu_to_le16(size);
3315
3316		l2cap_txwin_setup(chan);
3317
3318		rfc.txwin_size = min_t(u16, chan->tx_win,
3319				       L2CAP_DEFAULT_TX_WINDOW);
3320
3321		l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3322				   (unsigned long) &rfc, endptr - ptr);
3323
3324		if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
3325			l2cap_add_opt_efs(&ptr, chan, endptr - ptr);
 
 
 
 
 
 
 
 
 
3326
3327		if (test_bit(FLAG_EXT_CTRL, &chan->flags))
3328			l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
3329					   chan->tx_win, endptr - ptr);
3330
3331		if (chan->conn->feat_mask & L2CAP_FEAT_FCS)
3332			if (chan->fcs == L2CAP_FCS_NONE ||
3333			    test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) {
3334				chan->fcs = L2CAP_FCS_NONE;
3335				l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1,
3336						   chan->fcs, endptr - ptr);
3337			}
3338		break;
3339
3340	case L2CAP_MODE_STREAMING:
3341		l2cap_txwin_setup(chan);
3342		rfc.mode            = L2CAP_MODE_STREAMING;
3343		rfc.txwin_size      = 0;
3344		rfc.max_transmit    = 0;
3345		rfc.retrans_timeout = 0;
3346		rfc.monitor_timeout = 0;
3347
3348		size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -
3349			     L2CAP_EXT_HDR_SIZE - L2CAP_SDULEN_SIZE -
3350			     L2CAP_FCS_SIZE);
 
3351		rfc.max_pdu_size = cpu_to_le16(size);
3352
3353		l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3354				   (unsigned long) &rfc, endptr - ptr);
3355
3356		if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
3357			l2cap_add_opt_efs(&ptr, chan, endptr - ptr);
3358
3359		if (chan->conn->feat_mask & L2CAP_FEAT_FCS)
3360			if (chan->fcs == L2CAP_FCS_NONE ||
3361			    test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) {
3362				chan->fcs = L2CAP_FCS_NONE;
3363				l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1,
3364						   chan->fcs, endptr - ptr);
3365			}
 
3366		break;
3367	}
3368
3369	req->dcid  = cpu_to_le16(chan->dcid);
3370	req->flags = cpu_to_le16(0);
3371
3372	return ptr - data;
3373}
3374
3375static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data_size)
3376{
3377	struct l2cap_conf_rsp *rsp = data;
3378	void *ptr = rsp->data;
3379	void *endptr = data + data_size;
3380	void *req = chan->conf_req;
3381	int len = chan->conf_len;
3382	int type, hint, olen;
3383	unsigned long val;
3384	struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
3385	struct l2cap_conf_efs efs;
3386	u8 remote_efs = 0;
3387	u16 mtu = L2CAP_DEFAULT_MTU;
3388	u16 result = L2CAP_CONF_SUCCESS;
3389	u16 size;
3390
3391	BT_DBG("chan %p", chan);
3392
3393	while (len >= L2CAP_CONF_OPT_SIZE) {
3394		len -= l2cap_get_conf_opt(&req, &type, &olen, &val);
3395		if (len < 0)
3396			break;
3397
3398		hint  = type & L2CAP_CONF_HINT;
3399		type &= L2CAP_CONF_MASK;
3400
3401		switch (type) {
3402		case L2CAP_CONF_MTU:
3403			if (olen != 2)
3404				break;
3405			mtu = val;
3406			break;
3407
3408		case L2CAP_CONF_FLUSH_TO:
3409			if (olen != 2)
3410				break;
3411			chan->flush_to = val;
3412			break;
3413
3414		case L2CAP_CONF_QOS:
3415			break;
3416
3417		case L2CAP_CONF_RFC:
3418			if (olen != sizeof(rfc))
3419				break;
3420			memcpy(&rfc, (void *) val, olen);
3421			break;
3422
3423		case L2CAP_CONF_FCS:
3424			if (olen != 1)
3425				break;
3426			if (val == L2CAP_FCS_NONE)
3427				set_bit(CONF_RECV_NO_FCS, &chan->conf_state);
3428			break;
3429
3430		case L2CAP_CONF_EFS:
3431			if (olen != sizeof(efs))
3432				break;
3433			remote_efs = 1;
3434			memcpy(&efs, (void *) val, olen);
 
3435			break;
3436
3437		case L2CAP_CONF_EWS:
3438			if (olen != 2)
3439				break;
3440			return -ECONNREFUSED;
 
 
 
 
 
3441
3442		default:
3443			if (hint)
3444				break;
 
3445			result = L2CAP_CONF_UNKNOWN;
3446			l2cap_add_conf_opt(&ptr, (u8)type, sizeof(u8), type, endptr - ptr);
3447			break;
3448		}
3449	}
3450
3451	if (chan->num_conf_rsp || chan->num_conf_req > 1)
3452		goto done;
3453
3454	switch (chan->mode) {
3455	case L2CAP_MODE_STREAMING:
3456	case L2CAP_MODE_ERTM:
3457		if (!test_bit(CONF_STATE2_DEVICE, &chan->conf_state)) {
3458			chan->mode = l2cap_select_mode(rfc.mode,
3459						       chan->conn->feat_mask);
3460			break;
3461		}
3462
3463		if (remote_efs) {
3464			if (__l2cap_efs_supported(chan->conn))
3465				set_bit(FLAG_EFS_ENABLE, &chan->flags);
3466			else
3467				return -ECONNREFUSED;
3468		}
3469
3470		if (chan->mode != rfc.mode)
3471			return -ECONNREFUSED;
3472
3473		break;
3474	}
3475
3476done:
3477	if (chan->mode != rfc.mode) {
3478		result = L2CAP_CONF_UNACCEPT;
3479		rfc.mode = chan->mode;
3480
3481		if (chan->num_conf_rsp == 1)
3482			return -ECONNREFUSED;
3483
3484		l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3485				   (unsigned long) &rfc, endptr - ptr);
3486	}
3487
3488	if (result == L2CAP_CONF_SUCCESS) {
3489		/* Configure output options and let the other side know
3490		 * which ones we don't like. */
3491
3492		if (mtu < L2CAP_DEFAULT_MIN_MTU)
3493			result = L2CAP_CONF_UNACCEPT;
3494		else {
3495			chan->omtu = mtu;
3496			set_bit(CONF_MTU_DONE, &chan->conf_state);
3497		}
3498		l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu, endptr - ptr);
3499
3500		if (remote_efs) {
3501			if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
3502			    efs.stype != L2CAP_SERV_NOTRAFIC &&
3503			    efs.stype != chan->local_stype) {
3504
3505				result = L2CAP_CONF_UNACCEPT;
3506
3507				if (chan->num_conf_req >= 1)
3508					return -ECONNREFUSED;
3509
3510				l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
3511						   sizeof(efs),
3512						   (unsigned long) &efs, endptr - ptr);
3513			} else {
3514				/* Send PENDING Conf Rsp */
3515				result = L2CAP_CONF_PENDING;
3516				set_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
3517			}
3518		}
3519
3520		switch (rfc.mode) {
3521		case L2CAP_MODE_BASIC:
3522			chan->fcs = L2CAP_FCS_NONE;
3523			set_bit(CONF_MODE_DONE, &chan->conf_state);
3524			break;
3525
3526		case L2CAP_MODE_ERTM:
3527			if (!test_bit(CONF_EWS_RECV, &chan->conf_state))
3528				chan->remote_tx_win = rfc.txwin_size;
3529			else
3530				rfc.txwin_size = L2CAP_DEFAULT_TX_WINDOW;
3531
3532			chan->remote_max_tx = rfc.max_transmit;
3533
3534			size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
3535				     chan->conn->mtu - L2CAP_EXT_HDR_SIZE -
3536				     L2CAP_SDULEN_SIZE - L2CAP_FCS_SIZE);
 
 
3537			rfc.max_pdu_size = cpu_to_le16(size);
3538			chan->remote_mps = size;
3539
3540			__l2cap_set_ertm_timeouts(chan, &rfc);
 
 
 
3541
3542			set_bit(CONF_MODE_DONE, &chan->conf_state);
3543
3544			l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
3545					   sizeof(rfc), (unsigned long) &rfc, endptr - ptr);
3546
3547			if (remote_efs &&
3548			    test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
3549				chan->remote_id = efs.id;
3550				chan->remote_stype = efs.stype;
3551				chan->remote_msdu = le16_to_cpu(efs.msdu);
3552				chan->remote_flush_to =
3553					le32_to_cpu(efs.flush_to);
3554				chan->remote_acc_lat =
3555					le32_to_cpu(efs.acc_lat);
3556				chan->remote_sdu_itime =
3557					le32_to_cpu(efs.sdu_itime);
3558				l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
3559						   sizeof(efs),
3560						   (unsigned long) &efs, endptr - ptr);
3561			}
3562			break;
3563
3564		case L2CAP_MODE_STREAMING:
3565			size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
3566				     chan->conn->mtu - L2CAP_EXT_HDR_SIZE -
3567				     L2CAP_SDULEN_SIZE - L2CAP_FCS_SIZE);
 
 
3568			rfc.max_pdu_size = cpu_to_le16(size);
3569			chan->remote_mps = size;
3570
3571			set_bit(CONF_MODE_DONE, &chan->conf_state);
3572
3573			l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3574					   (unsigned long) &rfc, endptr - ptr);
3575
3576			break;
3577
3578		default:
3579			result = L2CAP_CONF_UNACCEPT;
3580
3581			memset(&rfc, 0, sizeof(rfc));
3582			rfc.mode = chan->mode;
3583		}
3584
3585		if (result == L2CAP_CONF_SUCCESS)
3586			set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
3587	}
3588	rsp->scid   = cpu_to_le16(chan->dcid);
3589	rsp->result = cpu_to_le16(result);
3590	rsp->flags  = cpu_to_le16(0);
3591
3592	return ptr - data;
3593}
3594
3595static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,
3596				void *data, size_t size, u16 *result)
3597{
3598	struct l2cap_conf_req *req = data;
3599	void *ptr = req->data;
3600	void *endptr = data + size;
3601	int type, olen;
3602	unsigned long val;
3603	struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
3604	struct l2cap_conf_efs efs;
3605
3606	BT_DBG("chan %p, rsp %p, len %d, req %p", chan, rsp, len, data);
3607
3608	while (len >= L2CAP_CONF_OPT_SIZE) {
3609		len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
3610		if (len < 0)
3611			break;
3612
3613		switch (type) {
3614		case L2CAP_CONF_MTU:
3615			if (olen != 2)
3616				break;
3617			if (val < L2CAP_DEFAULT_MIN_MTU) {
3618				*result = L2CAP_CONF_UNACCEPT;
3619				chan->imtu = L2CAP_DEFAULT_MIN_MTU;
3620			} else
3621				chan->imtu = val;
3622			l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu,
3623					   endptr - ptr);
3624			break;
3625
3626		case L2CAP_CONF_FLUSH_TO:
3627			if (olen != 2)
3628				break;
3629			chan->flush_to = val;
3630			l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO, 2,
3631					   chan->flush_to, endptr - ptr);
3632			break;
3633
3634		case L2CAP_CONF_RFC:
3635			if (olen != sizeof(rfc))
3636				break;
3637			memcpy(&rfc, (void *)val, olen);
3638			if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) &&
3639			    rfc.mode != chan->mode)
3640				return -ECONNREFUSED;
 
3641			chan->fcs = 0;
3642			l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3643					   (unsigned long) &rfc, endptr - ptr);
 
3644			break;
3645
3646		case L2CAP_CONF_EWS:
3647			if (olen != 2)
3648				break;
3649			chan->ack_win = min_t(u16, val, chan->ack_win);
3650			l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
3651					   chan->tx_win, endptr - ptr);
3652			break;
3653
3654		case L2CAP_CONF_EFS:
3655			if (olen != sizeof(efs))
3656				break;
3657			memcpy(&efs, (void *)val, olen);
3658			if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
3659			    efs.stype != L2CAP_SERV_NOTRAFIC &&
3660			    efs.stype != chan->local_stype)
3661				return -ECONNREFUSED;
3662			l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs),
3663					   (unsigned long) &efs, endptr - ptr);
3664			break;
3665
3666		case L2CAP_CONF_FCS:
3667			if (olen != 1)
3668				break;
3669			if (*result == L2CAP_CONF_PENDING)
3670				if (val == L2CAP_FCS_NONE)
3671					set_bit(CONF_RECV_NO_FCS,
3672						&chan->conf_state);
3673			break;
3674		}
3675	}
3676
3677	if (chan->mode == L2CAP_MODE_BASIC && chan->mode != rfc.mode)
3678		return -ECONNREFUSED;
3679
3680	chan->mode = rfc.mode;
3681
3682	if (*result == L2CAP_CONF_SUCCESS || *result == L2CAP_CONF_PENDING) {
3683		switch (rfc.mode) {
3684		case L2CAP_MODE_ERTM:
3685			chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
3686			chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
3687			chan->mps    = le16_to_cpu(rfc.max_pdu_size);
3688			if (!test_bit(FLAG_EXT_CTRL, &chan->flags))
3689				chan->ack_win = min_t(u16, chan->ack_win,
3690						      rfc.txwin_size);
3691
3692			if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
3693				chan->local_msdu = le16_to_cpu(efs.msdu);
3694				chan->local_sdu_itime =
3695					le32_to_cpu(efs.sdu_itime);
3696				chan->local_acc_lat = le32_to_cpu(efs.acc_lat);
3697				chan->local_flush_to =
3698					le32_to_cpu(efs.flush_to);
3699			}
3700			break;
3701
3702		case L2CAP_MODE_STREAMING:
3703			chan->mps    = le16_to_cpu(rfc.max_pdu_size);
3704		}
3705	}
3706
3707	req->dcid   = cpu_to_le16(chan->dcid);
3708	req->flags  = cpu_to_le16(0);
3709
3710	return ptr - data;
3711}
3712
3713static int l2cap_build_conf_rsp(struct l2cap_chan *chan, void *data,
3714				u16 result, u16 flags)
3715{
3716	struct l2cap_conf_rsp *rsp = data;
3717	void *ptr = rsp->data;
3718
3719	BT_DBG("chan %p", chan);
3720
3721	rsp->scid   = cpu_to_le16(chan->dcid);
3722	rsp->result = cpu_to_le16(result);
3723	rsp->flags  = cpu_to_le16(flags);
3724
3725	return ptr - data;
3726}
3727
3728void __l2cap_le_connect_rsp_defer(struct l2cap_chan *chan)
3729{
3730	struct l2cap_le_conn_rsp rsp;
3731	struct l2cap_conn *conn = chan->conn;
3732
3733	BT_DBG("chan %p", chan);
3734
3735	rsp.dcid    = cpu_to_le16(chan->scid);
3736	rsp.mtu     = cpu_to_le16(chan->imtu);
3737	rsp.mps     = cpu_to_le16(chan->mps);
3738	rsp.credits = cpu_to_le16(chan->rx_credits);
3739	rsp.result  = cpu_to_le16(L2CAP_CR_LE_SUCCESS);
3740
3741	l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp),
3742		       &rsp);
3743}
3744
3745static void l2cap_ecred_list_defer(struct l2cap_chan *chan, void *data)
3746{
3747	int *result = data;
3748
3749	if (*result || test_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags))
3750		return;
3751
3752	switch (chan->state) {
3753	case BT_CONNECT2:
3754		/* If channel still pending accept add to result */
3755		(*result)++;
3756		return;
3757	case BT_CONNECTED:
3758		return;
3759	default:
3760		/* If not connected or pending accept it has been refused */
3761		*result = -ECONNREFUSED;
3762		return;
3763	}
3764}
3765
3766struct l2cap_ecred_rsp_data {
3767	struct {
3768		struct l2cap_ecred_conn_rsp_hdr rsp;
3769		__le16 scid[L2CAP_ECRED_MAX_CID];
3770	} __packed pdu;
3771	int count;
3772};
3773
3774static void l2cap_ecred_rsp_defer(struct l2cap_chan *chan, void *data)
3775{
3776	struct l2cap_ecred_rsp_data *rsp = data;
3777	struct l2cap_ecred_conn_rsp *rsp_flex =
3778		container_of(&rsp->pdu.rsp, struct l2cap_ecred_conn_rsp, hdr);
3779
3780	/* Check if channel for outgoing connection or if it wasn't deferred
3781	 * since in those cases it must be skipped.
3782	 */
3783	if (test_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags) ||
3784	    !test_and_clear_bit(FLAG_DEFER_SETUP, &chan->flags))
3785		return;
3786
3787	/* Reset ident so only one response is sent */
3788	chan->ident = 0;
3789
3790	/* Include all channels pending with the same ident */
3791	if (!rsp->pdu.rsp.result)
3792		rsp_flex->dcid[rsp->count++] = cpu_to_le16(chan->scid);
3793	else
3794		l2cap_chan_del(chan, ECONNRESET);
3795}
3796
3797void __l2cap_ecred_conn_rsp_defer(struct l2cap_chan *chan)
3798{
3799	struct l2cap_conn *conn = chan->conn;
3800	struct l2cap_ecred_rsp_data data;
3801	u16 id = chan->ident;
3802	int result = 0;
3803
3804	if (!id)
3805		return;
3806
3807	BT_DBG("chan %p id %d", chan, id);
3808
3809	memset(&data, 0, sizeof(data));
3810
3811	data.pdu.rsp.mtu     = cpu_to_le16(chan->imtu);
3812	data.pdu.rsp.mps     = cpu_to_le16(chan->mps);
3813	data.pdu.rsp.credits = cpu_to_le16(chan->rx_credits);
3814	data.pdu.rsp.result  = cpu_to_le16(L2CAP_CR_LE_SUCCESS);
3815
3816	/* Verify that all channels are ready */
3817	__l2cap_chan_list_id(conn, id, l2cap_ecred_list_defer, &result);
3818
3819	if (result > 0)
3820		return;
3821
3822	if (result < 0)
3823		data.pdu.rsp.result = cpu_to_le16(L2CAP_CR_LE_AUTHORIZATION);
3824
3825	/* Build response */
3826	__l2cap_chan_list_id(conn, id, l2cap_ecred_rsp_defer, &data);
3827
3828	l2cap_send_cmd(conn, id, L2CAP_ECRED_CONN_RSP,
3829		       sizeof(data.pdu.rsp) + (data.count * sizeof(__le16)),
3830		       &data.pdu);
3831}
3832
3833void __l2cap_connect_rsp_defer(struct l2cap_chan *chan)
3834{
3835	struct l2cap_conn_rsp rsp;
3836	struct l2cap_conn *conn = chan->conn;
3837	u8 buf[128];
3838	u8 rsp_code;
3839
3840	rsp.scid   = cpu_to_le16(chan->dcid);
3841	rsp.dcid   = cpu_to_le16(chan->scid);
3842	rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
3843	rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
3844	rsp_code = L2CAP_CONN_RSP;
3845
3846	BT_DBG("chan %p rsp_code %u", chan, rsp_code);
3847
3848	l2cap_send_cmd(conn, chan->ident, rsp_code, sizeof(rsp), &rsp);
3849
3850	if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
3851		return;
3852
3853	l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
3854		       l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
3855	chan->num_conf_req++;
3856}
3857
3858static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len)
3859{
3860	int type, olen;
3861	unsigned long val;
3862	/* Use sane default values in case a misbehaving remote device
3863	 * did not send an RFC or extended window size option.
3864	 */
3865	u16 txwin_ext = chan->ack_win;
3866	struct l2cap_conf_rfc rfc = {
3867		.mode = chan->mode,
3868		.retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO),
3869		.monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO),
3870		.max_pdu_size = cpu_to_le16(chan->imtu),
3871		.txwin_size = min_t(u16, chan->ack_win, L2CAP_DEFAULT_TX_WINDOW),
3872	};
3873
3874	BT_DBG("chan %p, rsp %p, len %d", chan, rsp, len);
3875
3876	if ((chan->mode != L2CAP_MODE_ERTM) && (chan->mode != L2CAP_MODE_STREAMING))
3877		return;
3878
3879	while (len >= L2CAP_CONF_OPT_SIZE) {
3880		len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
3881		if (len < 0)
3882			break;
3883
3884		switch (type) {
3885		case L2CAP_CONF_RFC:
3886			if (olen != sizeof(rfc))
3887				break;
3888			memcpy(&rfc, (void *)val, olen);
3889			break;
3890		case L2CAP_CONF_EWS:
3891			if (olen != 2)
3892				break;
3893			txwin_ext = val;
3894			break;
3895		}
 
 
3896	}
3897
 
 
 
 
 
 
 
 
 
 
 
3898	switch (rfc.mode) {
3899	case L2CAP_MODE_ERTM:
3900		chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
3901		chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
3902		chan->mps = le16_to_cpu(rfc.max_pdu_size);
3903		if (test_bit(FLAG_EXT_CTRL, &chan->flags))
3904			chan->ack_win = min_t(u16, chan->ack_win, txwin_ext);
3905		else
3906			chan->ack_win = min_t(u16, chan->ack_win,
3907					      rfc.txwin_size);
3908		break;
3909	case L2CAP_MODE_STREAMING:
3910		chan->mps    = le16_to_cpu(rfc.max_pdu_size);
3911	}
3912}
3913
3914static inline int l2cap_command_rej(struct l2cap_conn *conn,
3915				    struct l2cap_cmd_hdr *cmd, u16 cmd_len,
3916				    u8 *data)
3917{
3918	struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data;
3919
3920	if (cmd_len < sizeof(*rej))
3921		return -EPROTO;
3922
3923	if (rej->reason != L2CAP_REJ_NOT_UNDERSTOOD)
3924		return 0;
3925
3926	if ((conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) &&
3927	    cmd->ident == conn->info_ident) {
3928		cancel_delayed_work(&conn->info_timer);
3929
3930		conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
3931		conn->info_ident = 0;
3932
3933		l2cap_conn_start(conn);
3934	}
3935
3936	return 0;
3937}
3938
3939static void l2cap_connect(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd,
3940			  u8 *data, u8 rsp_code)
3941{
3942	struct l2cap_conn_req *req = (struct l2cap_conn_req *) data;
3943	struct l2cap_conn_rsp rsp;
3944	struct l2cap_chan *chan = NULL, *pchan = NULL;
 
3945	int result, status = L2CAP_CS_NO_INFO;
3946
3947	u16 dcid = 0, scid = __le16_to_cpu(req->scid);
3948	__le16 psm = req->psm;
3949
3950	BT_DBG("psm 0x%2.2x scid 0x%4.4x", __le16_to_cpu(psm), scid);
3951
3952	/* Check if we have socket listening on psm */
3953	pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src,
3954					 &conn->hcon->dst, ACL_LINK);
3955	if (!pchan) {
3956		result = L2CAP_CR_BAD_PSM;
3957		goto response;
3958	}
3959
 
 
3960	mutex_lock(&conn->chan_lock);
3961	l2cap_chan_lock(pchan);
3962
3963	/* Check if the ACL is secure enough (if not SDP) */
3964	if (psm != cpu_to_le16(L2CAP_PSM_SDP) &&
3965	    !hci_conn_check_link_mode(conn->hcon)) {
3966		conn->disc_reason = HCI_ERROR_AUTH_FAILURE;
3967		result = L2CAP_CR_SEC_BLOCK;
3968		goto response;
3969	}
3970
3971	result = L2CAP_CR_NO_MEM;
3972
3973	/* Check for valid dynamic CID range (as per Erratum 3253) */
3974	if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_DYN_END) {
3975		result = L2CAP_CR_INVALID_SCID;
3976		goto response;
3977	}
3978
 
 
 
 
 
 
3979	/* Check if we already have channel with that dcid */
3980	if (__l2cap_get_chan_by_dcid(conn, scid)) {
3981		result = L2CAP_CR_SCID_IN_USE;
 
3982		goto response;
3983	}
3984
3985	chan = pchan->ops->new_connection(pchan);
3986	if (!chan)
3987		goto response;
3988
3989	/* For certain devices (ex: HID mouse), support for authentication,
3990	 * pairing and bonding is optional. For such devices, inorder to avoid
3991	 * the ACL alive for too long after L2CAP disconnection, reset the ACL
3992	 * disc_timeout back to HCI_DISCONN_TIMEOUT during L2CAP connect.
3993	 */
3994	conn->hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
3995
3996	bacpy(&chan->src, &conn->hcon->src);
3997	bacpy(&chan->dst, &conn->hcon->dst);
3998	chan->src_type = bdaddr_src_type(conn->hcon);
3999	chan->dst_type = bdaddr_dst_type(conn->hcon);
4000	chan->psm  = psm;
4001	chan->dcid = scid;
4002
 
 
4003	__l2cap_chan_add(conn, chan);
4004
4005	dcid = chan->scid;
4006
4007	__set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
4008
4009	chan->ident = cmd->ident;
4010
4011	if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) {
4012		if (l2cap_chan_check_security(chan, false)) {
4013			if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
4014				l2cap_state_change(chan, BT_CONNECT2);
4015				result = L2CAP_CR_PEND;
4016				status = L2CAP_CS_AUTHOR_PEND;
4017				chan->ops->defer(chan);
4018			} else {
4019				l2cap_state_change(chan, BT_CONFIG);
4020				result = L2CAP_CR_SUCCESS;
4021				status = L2CAP_CS_NO_INFO;
4022			}
4023		} else {
4024			l2cap_state_change(chan, BT_CONNECT2);
4025			result = L2CAP_CR_PEND;
4026			status = L2CAP_CS_AUTHEN_PEND;
4027		}
4028	} else {
4029		l2cap_state_change(chan, BT_CONNECT2);
4030		result = L2CAP_CR_PEND;
4031		status = L2CAP_CS_NO_INFO;
4032	}
4033
4034response:
 
 
 
 
4035	rsp.scid   = cpu_to_le16(scid);
4036	rsp.dcid   = cpu_to_le16(dcid);
4037	rsp.result = cpu_to_le16(result);
4038	rsp.status = cpu_to_le16(status);
4039	l2cap_send_cmd(conn, cmd->ident, rsp_code, sizeof(rsp), &rsp);
4040
4041	if (!pchan)
4042		return;
4043
4044	if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) {
4045		struct l2cap_info_req info;
4046		info.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
4047
4048		conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
4049		conn->info_ident = l2cap_get_ident(conn);
4050
4051		schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
4052
4053		l2cap_send_cmd(conn, conn->info_ident, L2CAP_INFO_REQ,
4054			       sizeof(info), &info);
4055	}
4056
4057	if (chan && !test_bit(CONF_REQ_SENT, &chan->conf_state) &&
4058	    result == L2CAP_CR_SUCCESS) {
4059		u8 buf[128];
4060		set_bit(CONF_REQ_SENT, &chan->conf_state);
4061		l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
4062			       l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
4063		chan->num_conf_req++;
4064	}
4065
4066	l2cap_chan_unlock(pchan);
4067	mutex_unlock(&conn->chan_lock);
4068	l2cap_chan_put(pchan);
4069}
4070
4071static int l2cap_connect_req(struct l2cap_conn *conn,
4072			     struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
4073{
4074	if (cmd_len < sizeof(struct l2cap_conn_req))
4075		return -EPROTO;
4076
4077	l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP);
4078	return 0;
4079}
4080
4081static int l2cap_connect_create_rsp(struct l2cap_conn *conn,
4082				    struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4083				    u8 *data)
4084{
4085	struct l2cap_conn_rsp *rsp = (struct l2cap_conn_rsp *) data;
4086	u16 scid, dcid, result, status;
4087	struct l2cap_chan *chan;
4088	u8 req[128];
4089	int err;
4090
4091	if (cmd_len < sizeof(*rsp))
4092		return -EPROTO;
4093
4094	scid   = __le16_to_cpu(rsp->scid);
4095	dcid   = __le16_to_cpu(rsp->dcid);
4096	result = __le16_to_cpu(rsp->result);
4097	status = __le16_to_cpu(rsp->status);
4098
4099	if (result == L2CAP_CR_SUCCESS && (dcid < L2CAP_CID_DYN_START ||
4100					   dcid > L2CAP_CID_DYN_END))
4101		return -EPROTO;
4102
4103	BT_DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x",
4104	       dcid, scid, result, status);
4105
4106	mutex_lock(&conn->chan_lock);
4107
4108	if (scid) {
4109		chan = __l2cap_get_chan_by_scid(conn, scid);
4110		if (!chan) {
4111			err = -EBADSLT;
4112			goto unlock;
4113		}
4114	} else {
4115		chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
4116		if (!chan) {
4117			err = -EBADSLT;
4118			goto unlock;
4119		}
4120	}
4121
4122	chan = l2cap_chan_hold_unless_zero(chan);
4123	if (!chan) {
4124		err = -EBADSLT;
4125		goto unlock;
4126	}
4127
4128	err = 0;
4129
4130	l2cap_chan_lock(chan);
4131
4132	switch (result) {
4133	case L2CAP_CR_SUCCESS:
4134		if (__l2cap_get_chan_by_dcid(conn, dcid)) {
4135			err = -EBADSLT;
4136			break;
4137		}
4138
4139		l2cap_state_change(chan, BT_CONFIG);
4140		chan->ident = 0;
4141		chan->dcid = dcid;
4142		clear_bit(CONF_CONNECT_PEND, &chan->conf_state);
4143
4144		if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
4145			break;
4146
4147		l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
4148			       l2cap_build_conf_req(chan, req, sizeof(req)), req);
4149		chan->num_conf_req++;
4150		break;
4151
4152	case L2CAP_CR_PEND:
4153		set_bit(CONF_CONNECT_PEND, &chan->conf_state);
4154		break;
4155
4156	default:
4157		l2cap_chan_del(chan, ECONNREFUSED);
4158		break;
4159	}
4160
4161	l2cap_chan_unlock(chan);
4162	l2cap_chan_put(chan);
4163
4164unlock:
4165	mutex_unlock(&conn->chan_lock);
4166
4167	return err;
4168}
4169
4170static inline void set_default_fcs(struct l2cap_chan *chan)
4171{
4172	/* FCS is enabled only in ERTM or streaming mode, if one or both
4173	 * sides request it.
4174	 */
4175	if (chan->mode != L2CAP_MODE_ERTM && chan->mode != L2CAP_MODE_STREAMING)
4176		chan->fcs = L2CAP_FCS_NONE;
4177	else if (!test_bit(CONF_RECV_NO_FCS, &chan->conf_state))
4178		chan->fcs = L2CAP_FCS_CRC16;
4179}
4180
4181static void l2cap_send_efs_conf_rsp(struct l2cap_chan *chan, void *data,
4182				    u8 ident, u16 flags)
4183{
4184	struct l2cap_conn *conn = chan->conn;
4185
4186	BT_DBG("conn %p chan %p ident %d flags 0x%4.4x", conn, chan, ident,
4187	       flags);
4188
4189	clear_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
4190	set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
4191
4192	l2cap_send_cmd(conn, ident, L2CAP_CONF_RSP,
4193		       l2cap_build_conf_rsp(chan, data,
4194					    L2CAP_CONF_SUCCESS, flags), data);
4195}
4196
4197static void cmd_reject_invalid_cid(struct l2cap_conn *conn, u8 ident,
4198				   u16 scid, u16 dcid)
4199{
4200	struct l2cap_cmd_rej_cid rej;
4201
4202	rej.reason = cpu_to_le16(L2CAP_REJ_INVALID_CID);
4203	rej.scid = __cpu_to_le16(scid);
4204	rej.dcid = __cpu_to_le16(dcid);
4205
4206	l2cap_send_cmd(conn, ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej);
4207}
4208
4209static inline int l2cap_config_req(struct l2cap_conn *conn,
4210				   struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4211				   u8 *data)
4212{
4213	struct l2cap_conf_req *req = (struct l2cap_conf_req *) data;
4214	u16 dcid, flags;
4215	u8 rsp[64];
4216	struct l2cap_chan *chan;
4217	int len, err = 0;
4218
4219	if (cmd_len < sizeof(*req))
4220		return -EPROTO;
4221
4222	dcid  = __le16_to_cpu(req->dcid);
4223	flags = __le16_to_cpu(req->flags);
4224
4225	BT_DBG("dcid 0x%4.4x flags 0x%2.2x", dcid, flags);
4226
4227	chan = l2cap_get_chan_by_scid(conn, dcid);
4228	if (!chan) {
4229		cmd_reject_invalid_cid(conn, cmd->ident, dcid, 0);
4230		return 0;
4231	}
 
 
 
 
 
4232
4233	if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2 &&
4234	    chan->state != BT_CONNECTED) {
4235		cmd_reject_invalid_cid(conn, cmd->ident, chan->scid,
4236				       chan->dcid);
4237		goto unlock;
4238	}
4239
4240	/* Reject if config buffer is too small. */
4241	len = cmd_len - sizeof(*req);
4242	if (chan->conf_len + len > sizeof(chan->conf_req)) {
4243		l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
4244			       l2cap_build_conf_rsp(chan, rsp,
4245			       L2CAP_CONF_REJECT, flags), rsp);
4246		goto unlock;
4247	}
4248
4249	/* Store config. */
4250	memcpy(chan->conf_req + chan->conf_len, req->data, len);
4251	chan->conf_len += len;
4252
4253	if (flags & L2CAP_CONF_FLAG_CONTINUATION) {
4254		/* Incomplete config. Send empty response. */
4255		l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
4256			       l2cap_build_conf_rsp(chan, rsp,
4257			       L2CAP_CONF_SUCCESS, flags), rsp);
4258		goto unlock;
4259	}
4260
4261	/* Complete config. */
4262	len = l2cap_parse_conf_req(chan, rsp, sizeof(rsp));
4263	if (len < 0) {
4264		l2cap_send_disconn_req(chan, ECONNRESET);
4265		goto unlock;
4266	}
4267
4268	chan->ident = cmd->ident;
4269	l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp);
4270	if (chan->num_conf_rsp < L2CAP_CONF_MAX_CONF_RSP)
4271		chan->num_conf_rsp++;
4272
4273	/* Reset config buffer. */
4274	chan->conf_len = 0;
4275
4276	if (!test_bit(CONF_OUTPUT_DONE, &chan->conf_state))
4277		goto unlock;
4278
4279	if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {
4280		set_default_fcs(chan);
4281
 
 
4282		if (chan->mode == L2CAP_MODE_ERTM ||
4283		    chan->mode == L2CAP_MODE_STREAMING)
4284			err = l2cap_ertm_init(chan);
4285
4286		if (err < 0)
4287			l2cap_send_disconn_req(chan, -err);
4288		else
4289			l2cap_chan_ready(chan);
4290
4291		goto unlock;
4292	}
4293
4294	if (!test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) {
4295		u8 buf[64];
4296		l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
4297			       l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
4298		chan->num_conf_req++;
4299	}
4300
4301	/* Got Conf Rsp PENDING from remote side and assume we sent
4302	   Conf Rsp PENDING in the code above */
4303	if (test_bit(CONF_REM_CONF_PEND, &chan->conf_state) &&
4304	    test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
4305
4306		/* check compatibility */
4307
4308		/* Send rsp for BR/EDR channel */
4309		l2cap_send_efs_conf_rsp(chan, rsp, cmd->ident, flags);
 
 
 
 
4310	}
4311
4312unlock:
4313	l2cap_chan_unlock(chan);
4314	l2cap_chan_put(chan);
4315	return err;
4316}
4317
4318static inline int l2cap_config_rsp(struct l2cap_conn *conn,
4319				   struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4320				   u8 *data)
4321{
4322	struct l2cap_conf_rsp *rsp = (struct l2cap_conf_rsp *)data;
4323	u16 scid, flags, result;
4324	struct l2cap_chan *chan;
4325	int len = cmd_len - sizeof(*rsp);
4326	int err = 0;
4327
4328	if (cmd_len < sizeof(*rsp))
4329		return -EPROTO;
4330
4331	scid   = __le16_to_cpu(rsp->scid);
4332	flags  = __le16_to_cpu(rsp->flags);
4333	result = __le16_to_cpu(rsp->result);
4334
4335	BT_DBG("scid 0x%4.4x flags 0x%2.2x result 0x%2.2x len %d", scid, flags,
4336	       result, len);
4337
4338	chan = l2cap_get_chan_by_scid(conn, scid);
4339	if (!chan)
4340		return 0;
4341
4342	switch (result) {
4343	case L2CAP_CONF_SUCCESS:
4344		l2cap_conf_rfc_get(chan, rsp->data, len);
4345		clear_bit(CONF_REM_CONF_PEND, &chan->conf_state);
4346		break;
4347
4348	case L2CAP_CONF_PENDING:
4349		set_bit(CONF_REM_CONF_PEND, &chan->conf_state);
4350
4351		if (test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
4352			char buf[64];
4353
4354			len = l2cap_parse_conf_rsp(chan, rsp->data, len,
4355						   buf, sizeof(buf), &result);
4356			if (len < 0) {
4357				l2cap_send_disconn_req(chan, ECONNRESET);
4358				goto done;
4359			}
4360
4361			l2cap_send_efs_conf_rsp(chan, buf, cmd->ident, 0);
 
 
 
 
 
 
 
4362		}
4363		goto done;
4364
4365	case L2CAP_CONF_UNKNOWN:
4366	case L2CAP_CONF_UNACCEPT:
4367		if (chan->num_conf_rsp <= L2CAP_CONF_MAX_CONF_RSP) {
4368			char req[64];
4369
4370			if (len > sizeof(req) - sizeof(struct l2cap_conf_req)) {
4371				l2cap_send_disconn_req(chan, ECONNRESET);
4372				goto done;
4373			}
4374
4375			/* throw out any old stored conf requests */
4376			result = L2CAP_CONF_SUCCESS;
4377			len = l2cap_parse_conf_rsp(chan, rsp->data, len,
4378						   req, sizeof(req), &result);
4379			if (len < 0) {
4380				l2cap_send_disconn_req(chan, ECONNRESET);
4381				goto done;
4382			}
4383
4384			l2cap_send_cmd(conn, l2cap_get_ident(conn),
4385				       L2CAP_CONF_REQ, len, req);
4386			chan->num_conf_req++;
4387			if (result != L2CAP_CONF_SUCCESS)
4388				goto done;
4389			break;
4390		}
4391		fallthrough;
4392
4393	default:
4394		l2cap_chan_set_err(chan, ECONNRESET);
4395
4396		__set_chan_timer(chan, L2CAP_DISC_REJ_TIMEOUT);
4397		l2cap_send_disconn_req(chan, ECONNRESET);
4398		goto done;
4399	}
4400
4401	if (flags & L2CAP_CONF_FLAG_CONTINUATION)
4402		goto done;
4403
4404	set_bit(CONF_INPUT_DONE, &chan->conf_state);
4405
4406	if (test_bit(CONF_OUTPUT_DONE, &chan->conf_state)) {
4407		set_default_fcs(chan);
4408
 
4409		if (chan->mode == L2CAP_MODE_ERTM ||
4410		    chan->mode == L2CAP_MODE_STREAMING)
4411			err = l2cap_ertm_init(chan);
4412
4413		if (err < 0)
4414			l2cap_send_disconn_req(chan, -err);
4415		else
4416			l2cap_chan_ready(chan);
4417	}
4418
4419done:
4420	l2cap_chan_unlock(chan);
4421	l2cap_chan_put(chan);
4422	return err;
4423}
4424
4425static inline int l2cap_disconnect_req(struct l2cap_conn *conn,
4426				       struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4427				       u8 *data)
4428{
4429	struct l2cap_disconn_req *req = (struct l2cap_disconn_req *) data;
4430	struct l2cap_disconn_rsp rsp;
4431	u16 dcid, scid;
4432	struct l2cap_chan *chan;
4433
4434	if (cmd_len != sizeof(*req))
4435		return -EPROTO;
4436
4437	scid = __le16_to_cpu(req->scid);
4438	dcid = __le16_to_cpu(req->dcid);
4439
4440	BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid);
4441
4442	chan = l2cap_get_chan_by_scid(conn, dcid);
 
 
4443	if (!chan) {
4444		cmd_reject_invalid_cid(conn, cmd->ident, dcid, scid);
4445		return 0;
4446	}
4447
 
 
 
 
4448	rsp.dcid = cpu_to_le16(chan->scid);
4449	rsp.scid = cpu_to_le16(chan->dcid);
4450	l2cap_send_cmd(conn, cmd->ident, L2CAP_DISCONN_RSP, sizeof(rsp), &rsp);
4451
4452	chan->ops->set_shutdown(chan);
 
 
4453
4454	l2cap_chan_unlock(chan);
4455	mutex_lock(&conn->chan_lock);
4456	l2cap_chan_lock(chan);
4457	l2cap_chan_del(chan, ECONNRESET);
4458	mutex_unlock(&conn->chan_lock);
4459
4460	chan->ops->close(chan);
4461
4462	l2cap_chan_unlock(chan);
 
 
4463	l2cap_chan_put(chan);
4464
 
 
4465	return 0;
4466}
4467
4468static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn,
4469				       struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4470				       u8 *data)
4471{
4472	struct l2cap_disconn_rsp *rsp = (struct l2cap_disconn_rsp *) data;
4473	u16 dcid, scid;
4474	struct l2cap_chan *chan;
4475
4476	if (cmd_len != sizeof(*rsp))
4477		return -EPROTO;
4478
4479	scid = __le16_to_cpu(rsp->scid);
4480	dcid = __le16_to_cpu(rsp->dcid);
4481
4482	BT_DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid);
4483
4484	chan = l2cap_get_chan_by_scid(conn, scid);
4485	if (!chan) {
4486		return 0;
4487	}
4488
4489	if (chan->state != BT_DISCONN) {
4490		l2cap_chan_unlock(chan);
4491		l2cap_chan_put(chan);
4492		return 0;
4493	}
4494
4495	l2cap_chan_unlock(chan);
4496	mutex_lock(&conn->chan_lock);
4497	l2cap_chan_lock(chan);
4498	l2cap_chan_del(chan, 0);
4499	mutex_unlock(&conn->chan_lock);
4500
4501	chan->ops->close(chan);
 
4502
4503	l2cap_chan_unlock(chan);
 
 
4504	l2cap_chan_put(chan);
4505
 
 
4506	return 0;
4507}
4508
4509static inline int l2cap_information_req(struct l2cap_conn *conn,
4510					struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4511					u8 *data)
4512{
4513	struct l2cap_info_req *req = (struct l2cap_info_req *) data;
4514	u16 type;
4515
4516	if (cmd_len != sizeof(*req))
4517		return -EPROTO;
4518
4519	type = __le16_to_cpu(req->type);
4520
4521	BT_DBG("type 0x%4.4x", type);
4522
4523	if (type == L2CAP_IT_FEAT_MASK) {
4524		u8 buf[8];
4525		u32 feat_mask = l2cap_feat_mask;
4526		struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
4527		rsp->type   = cpu_to_le16(L2CAP_IT_FEAT_MASK);
4528		rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
4529		if (!disable_ertm)
4530			feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING
4531				| L2CAP_FEAT_FCS;
 
 
 
4532
4533		put_unaligned_le32(feat_mask, rsp->data);
4534		l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(buf),
4535			       buf);
4536	} else if (type == L2CAP_IT_FIXED_CHAN) {
4537		u8 buf[12];
4538		struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
4539
 
 
 
 
 
4540		rsp->type   = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
4541		rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
4542		rsp->data[0] = conn->local_fixed_chan;
4543		memset(rsp->data + 1, 0, 7);
4544		l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(buf),
4545			       buf);
4546	} else {
4547		struct l2cap_info_rsp rsp;
4548		rsp.type   = cpu_to_le16(type);
4549		rsp.result = cpu_to_le16(L2CAP_IR_NOTSUPP);
4550		l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(rsp),
4551			       &rsp);
4552	}
4553
4554	return 0;
4555}
4556
4557static inline int l2cap_information_rsp(struct l2cap_conn *conn,
4558					struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4559					u8 *data)
4560{
4561	struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data;
4562	u16 type, result;
4563
4564	if (cmd_len < sizeof(*rsp))
4565		return -EPROTO;
4566
4567	type   = __le16_to_cpu(rsp->type);
4568	result = __le16_to_cpu(rsp->result);
4569
4570	BT_DBG("type 0x%4.4x result 0x%2.2x", type, result);
4571
4572	/* L2CAP Info req/rsp are unbound to channels, add extra checks */
4573	if (cmd->ident != conn->info_ident ||
4574	    conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)
4575		return 0;
4576
4577	cancel_delayed_work(&conn->info_timer);
4578
4579	if (result != L2CAP_IR_SUCCESS) {
4580		conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
4581		conn->info_ident = 0;
4582
4583		l2cap_conn_start(conn);
4584
4585		return 0;
4586	}
4587
4588	switch (type) {
4589	case L2CAP_IT_FEAT_MASK:
4590		conn->feat_mask = get_unaligned_le32(rsp->data);
4591
4592		if (conn->feat_mask & L2CAP_FEAT_FIXED_CHAN) {
4593			struct l2cap_info_req req;
4594			req.type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
4595
4596			conn->info_ident = l2cap_get_ident(conn);
4597
4598			l2cap_send_cmd(conn, conn->info_ident,
4599				       L2CAP_INFO_REQ, sizeof(req), &req);
4600		} else {
4601			conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
4602			conn->info_ident = 0;
4603
4604			l2cap_conn_start(conn);
4605		}
4606		break;
4607
4608	case L2CAP_IT_FIXED_CHAN:
4609		conn->remote_fixed_chan = rsp->data[0];
4610		conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
4611		conn->info_ident = 0;
4612
4613		l2cap_conn_start(conn);
4614		break;
4615	}
4616
4617	return 0;
4618}
4619
4620static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn,
4621					      struct l2cap_cmd_hdr *cmd,
4622					      u16 cmd_len, u8 *data)
4623{
4624	struct hci_conn *hcon = conn->hcon;
4625	struct l2cap_conn_param_update_req *req;
4626	struct l2cap_conn_param_update_rsp rsp;
4627	u16 min, max, latency, to_multiplier;
4628	int err;
4629
4630	if (hcon->role != HCI_ROLE_MASTER)
4631		return -EINVAL;
4632
4633	if (cmd_len != sizeof(struct l2cap_conn_param_update_req))
4634		return -EPROTO;
4635
4636	req = (struct l2cap_conn_param_update_req *) data;
4637	min		= __le16_to_cpu(req->min);
4638	max		= __le16_to_cpu(req->max);
4639	latency		= __le16_to_cpu(req->latency);
4640	to_multiplier	= __le16_to_cpu(req->to_multiplier);
4641
4642	BT_DBG("min 0x%4.4x max 0x%4.4x latency: 0x%4.4x Timeout: 0x%4.4x",
4643	       min, max, latency, to_multiplier);
4644
4645	memset(&rsp, 0, sizeof(rsp));
4646
4647	err = hci_check_conn_params(min, max, latency, to_multiplier);
4648	if (err)
4649		rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED);
4650	else
4651		rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_ACCEPTED);
4652
4653	l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_PARAM_UPDATE_RSP,
4654		       sizeof(rsp), &rsp);
4655
4656	if (!err) {
4657		u8 store_hint;
4658
4659		store_hint = hci_le_conn_update(hcon, min, max, latency,
4660						to_multiplier);
4661		mgmt_new_conn_param(hcon->hdev, &hcon->dst, hcon->dst_type,
4662				    store_hint, min, max, latency,
4663				    to_multiplier);
4664
4665	}
4666
4667	return 0;
4668}
4669
4670static int l2cap_le_connect_rsp(struct l2cap_conn *conn,
4671				struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4672				u8 *data)
4673{
4674	struct l2cap_le_conn_rsp *rsp = (struct l2cap_le_conn_rsp *) data;
4675	struct hci_conn *hcon = conn->hcon;
4676	u16 dcid, mtu, mps, credits, result;
4677	struct l2cap_chan *chan;
4678	int err, sec_level;
4679
4680	if (cmd_len < sizeof(*rsp))
4681		return -EPROTO;
4682
4683	dcid    = __le16_to_cpu(rsp->dcid);
4684	mtu     = __le16_to_cpu(rsp->mtu);
4685	mps     = __le16_to_cpu(rsp->mps);
4686	credits = __le16_to_cpu(rsp->credits);
4687	result  = __le16_to_cpu(rsp->result);
4688
4689	if (result == L2CAP_CR_LE_SUCCESS && (mtu < 23 || mps < 23 ||
4690					   dcid < L2CAP_CID_DYN_START ||
4691					   dcid > L2CAP_CID_LE_DYN_END))
4692		return -EPROTO;
4693
4694	BT_DBG("dcid 0x%4.4x mtu %u mps %u credits %u result 0x%2.2x",
4695	       dcid, mtu, mps, credits, result);
4696
4697	mutex_lock(&conn->chan_lock);
4698
4699	chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
4700	if (!chan) {
4701		err = -EBADSLT;
4702		goto unlock;
4703	}
4704
4705	err = 0;
4706
4707	l2cap_chan_lock(chan);
4708
4709	switch (result) {
4710	case L2CAP_CR_LE_SUCCESS:
4711		if (__l2cap_get_chan_by_dcid(conn, dcid)) {
4712			err = -EBADSLT;
4713			break;
4714		}
4715
4716		chan->ident = 0;
4717		chan->dcid = dcid;
4718		chan->omtu = mtu;
4719		chan->remote_mps = mps;
4720		chan->tx_credits = credits;
4721		l2cap_chan_ready(chan);
4722		break;
4723
4724	case L2CAP_CR_LE_AUTHENTICATION:
4725	case L2CAP_CR_LE_ENCRYPTION:
4726		/* If we already have MITM protection we can't do
4727		 * anything.
4728		 */
4729		if (hcon->sec_level > BT_SECURITY_MEDIUM) {
4730			l2cap_chan_del(chan, ECONNREFUSED);
4731			break;
4732		}
4733
4734		sec_level = hcon->sec_level + 1;
4735		if (chan->sec_level < sec_level)
4736			chan->sec_level = sec_level;
4737
4738		/* We'll need to send a new Connect Request */
4739		clear_bit(FLAG_LE_CONN_REQ_SENT, &chan->flags);
4740
4741		smp_conn_security(hcon, chan->sec_level);
4742		break;
4743
4744	default:
4745		l2cap_chan_del(chan, ECONNREFUSED);
4746		break;
4747	}
4748
4749	l2cap_chan_unlock(chan);
4750
4751unlock:
4752	mutex_unlock(&conn->chan_lock);
4753
4754	return err;
4755}
4756
4757static inline int l2cap_bredr_sig_cmd(struct l2cap_conn *conn,
4758				      struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4759				      u8 *data)
4760{
4761	int err = 0;
4762
4763	switch (cmd->code) {
4764	case L2CAP_COMMAND_REJ:
4765		l2cap_command_rej(conn, cmd, cmd_len, data);
4766		break;
4767
4768	case L2CAP_CONN_REQ:
4769		err = l2cap_connect_req(conn, cmd, cmd_len, data);
4770		break;
4771
4772	case L2CAP_CONN_RSP:
4773		l2cap_connect_create_rsp(conn, cmd, cmd_len, data);
4774		break;
4775
4776	case L2CAP_CONF_REQ:
4777		err = l2cap_config_req(conn, cmd, cmd_len, data);
4778		break;
4779
4780	case L2CAP_CONF_RSP:
4781		l2cap_config_rsp(conn, cmd, cmd_len, data);
4782		break;
4783
4784	case L2CAP_DISCONN_REQ:
4785		err = l2cap_disconnect_req(conn, cmd, cmd_len, data);
4786		break;
 
 
4787
4788	case L2CAP_DISCONN_RSP:
4789		l2cap_disconnect_rsp(conn, cmd, cmd_len, data);
4790		break;
4791
4792	case L2CAP_ECHO_REQ:
4793		l2cap_send_cmd(conn, cmd->ident, L2CAP_ECHO_RSP, cmd_len, data);
4794		break;
4795
4796	case L2CAP_ECHO_RSP:
4797		break;
4798
4799	case L2CAP_INFO_REQ:
4800		err = l2cap_information_req(conn, cmd, cmd_len, data);
4801		break;
4802
4803	case L2CAP_INFO_RSP:
4804		l2cap_information_rsp(conn, cmd, cmd_len, data);
4805		break;
 
4806
4807	default:
4808		BT_ERR("Unknown BR/EDR signaling command 0x%2.2x", cmd->code);
4809		err = -EINVAL;
4810		break;
4811	}
4812
4813	return err;
 
4814}
4815
4816static int l2cap_le_connect_req(struct l2cap_conn *conn,
4817				struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4818				u8 *data)
4819{
4820	struct l2cap_le_conn_req *req = (struct l2cap_le_conn_req *) data;
4821	struct l2cap_le_conn_rsp rsp;
4822	struct l2cap_chan *chan, *pchan;
4823	u16 dcid, scid, credits, mtu, mps;
4824	__le16 psm;
4825	u8 result;
4826
4827	if (cmd_len != sizeof(*req))
4828		return -EPROTO;
4829
4830	scid = __le16_to_cpu(req->scid);
4831	mtu  = __le16_to_cpu(req->mtu);
4832	mps  = __le16_to_cpu(req->mps);
4833	psm  = req->psm;
4834	dcid = 0;
4835	credits = 0;
4836
4837	if (mtu < 23 || mps < 23)
4838		return -EPROTO;
4839
4840	BT_DBG("psm 0x%2.2x scid 0x%4.4x mtu %u mps %u", __le16_to_cpu(psm),
4841	       scid, mtu, mps);
4842
4843	/* BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 3, Part A
4844	 * page 1059:
4845	 *
4846	 * Valid range: 0x0001-0x00ff
4847	 *
4848	 * Table 4.15: L2CAP_LE_CREDIT_BASED_CONNECTION_REQ SPSM ranges
4849	 */
4850	if (!psm || __le16_to_cpu(psm) > L2CAP_PSM_LE_DYN_END) {
4851		result = L2CAP_CR_LE_BAD_PSM;
4852		chan = NULL;
4853		goto response;
4854	}
4855
4856	/* Check if we have socket listening on psm */
4857	pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src,
4858					 &conn->hcon->dst, LE_LINK);
4859	if (!pchan) {
4860		result = L2CAP_CR_LE_BAD_PSM;
4861		chan = NULL;
4862		goto response;
4863	}
4864
4865	mutex_lock(&conn->chan_lock);
4866	l2cap_chan_lock(pchan);
4867
4868	if (!smp_sufficient_security(conn->hcon, pchan->sec_level,
4869				     SMP_ALLOW_STK)) {
4870		result = L2CAP_CR_LE_AUTHENTICATION;
4871		chan = NULL;
4872		goto response_unlock;
4873	}
4874
4875	/* Check for valid dynamic CID range */
4876	if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_LE_DYN_END) {
4877		result = L2CAP_CR_LE_INVALID_SCID;
4878		chan = NULL;
4879		goto response_unlock;
4880	}
4881
4882	/* Check if we already have channel with that dcid */
4883	if (__l2cap_get_chan_by_dcid(conn, scid)) {
4884		result = L2CAP_CR_LE_SCID_IN_USE;
4885		chan = NULL;
4886		goto response_unlock;
4887	}
4888
4889	chan = pchan->ops->new_connection(pchan);
4890	if (!chan) {
4891		result = L2CAP_CR_LE_NO_MEM;
4892		goto response_unlock;
4893	}
4894
4895	bacpy(&chan->src, &conn->hcon->src);
4896	bacpy(&chan->dst, &conn->hcon->dst);
4897	chan->src_type = bdaddr_src_type(conn->hcon);
4898	chan->dst_type = bdaddr_dst_type(conn->hcon);
4899	chan->psm  = psm;
4900	chan->dcid = scid;
4901	chan->omtu = mtu;
4902	chan->remote_mps = mps;
4903
4904	__l2cap_chan_add(conn, chan);
4905
4906	l2cap_le_flowctl_init(chan, __le16_to_cpu(req->credits));
4907
4908	dcid = chan->scid;
4909	credits = chan->rx_credits;
4910
4911	__set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
4912
4913	chan->ident = cmd->ident;
4914
4915	if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
4916		l2cap_state_change(chan, BT_CONNECT2);
4917		/* The following result value is actually not defined
4918		 * for LE CoC but we use it to let the function know
4919		 * that it should bail out after doing its cleanup
4920		 * instead of sending a response.
4921		 */
4922		result = L2CAP_CR_PEND;
4923		chan->ops->defer(chan);
4924	} else {
4925		l2cap_chan_ready(chan);
4926		result = L2CAP_CR_LE_SUCCESS;
4927	}
4928
4929response_unlock:
4930	l2cap_chan_unlock(pchan);
4931	mutex_unlock(&conn->chan_lock);
4932	l2cap_chan_put(pchan);
4933
4934	if (result == L2CAP_CR_PEND)
4935		return 0;
4936
4937response:
4938	if (chan) {
4939		rsp.mtu = cpu_to_le16(chan->imtu);
4940		rsp.mps = cpu_to_le16(chan->mps);
4941	} else {
4942		rsp.mtu = 0;
4943		rsp.mps = 0;
4944	}
4945
4946	rsp.dcid    = cpu_to_le16(dcid);
4947	rsp.credits = cpu_to_le16(credits);
4948	rsp.result  = cpu_to_le16(result);
4949
4950	l2cap_send_cmd(conn, cmd->ident, L2CAP_LE_CONN_RSP, sizeof(rsp), &rsp);
 
4951
4952	return 0;
4953}
4954
4955static inline int l2cap_le_credits(struct l2cap_conn *conn,
4956				   struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4957				   u8 *data)
4958{
4959	struct l2cap_le_credits *pkt;
4960	struct l2cap_chan *chan;
4961	u16 cid, credits, max_credits;
4962
4963	if (cmd_len != sizeof(*pkt))
4964		return -EPROTO;
4965
4966	pkt = (struct l2cap_le_credits *) data;
4967	cid	= __le16_to_cpu(pkt->cid);
4968	credits	= __le16_to_cpu(pkt->credits);
4969
4970	BT_DBG("cid 0x%4.4x credits 0x%4.4x", cid, credits);
4971
4972	chan = l2cap_get_chan_by_dcid(conn, cid);
4973	if (!chan)
4974		return -EBADSLT;
4975
4976	max_credits = LE_FLOWCTL_MAX_CREDITS - chan->tx_credits;
4977	if (credits > max_credits) {
4978		BT_ERR("LE credits overflow");
4979		l2cap_send_disconn_req(chan, ECONNRESET);
4980
4981		/* Return 0 so that we don't trigger an unnecessary
4982		 * command reject packet.
4983		 */
4984		goto unlock;
4985	}
4986
4987	chan->tx_credits += credits;
4988
4989	/* Resume sending */
4990	l2cap_le_flowctl_send(chan);
4991
4992	if (chan->tx_credits)
4993		chan->ops->resume(chan);
4994
4995unlock:
4996	l2cap_chan_unlock(chan);
4997	l2cap_chan_put(chan);
4998
4999	return 0;
5000}
5001
5002static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn,
5003				       struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5004				       u8 *data)
5005{
5006	struct l2cap_ecred_conn_req *req = (void *) data;
5007	DEFINE_RAW_FLEX(struct l2cap_ecred_conn_rsp, pdu, dcid, L2CAP_ECRED_MAX_CID);
5008	struct l2cap_chan *chan, *pchan;
5009	u16 mtu, mps;
5010	__le16 psm;
5011	u8 result, len = 0;
5012	int i, num_scid;
5013	bool defer = false;
5014
5015	if (!enable_ecred)
5016		return -EINVAL;
5017
5018	if (cmd_len < sizeof(*req) || (cmd_len - sizeof(*req)) % sizeof(u16)) {
5019		result = L2CAP_CR_LE_INVALID_PARAMS;
5020		goto response;
5021	}
5022
5023	cmd_len -= sizeof(*req);
5024	num_scid = cmd_len / sizeof(u16);
5025
5026	if (num_scid > L2CAP_ECRED_MAX_CID) {
5027		result = L2CAP_CR_LE_INVALID_PARAMS;
5028		goto response;
5029	}
5030
5031	mtu  = __le16_to_cpu(req->mtu);
5032	mps  = __le16_to_cpu(req->mps);
5033
5034	if (mtu < L2CAP_ECRED_MIN_MTU || mps < L2CAP_ECRED_MIN_MPS) {
5035		result = L2CAP_CR_LE_UNACCEPT_PARAMS;
5036		goto response;
5037	}
5038
5039	psm  = req->psm;
5040
5041	/* BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 3, Part A
5042	 * page 1059:
5043	 *
5044	 * Valid range: 0x0001-0x00ff
5045	 *
5046	 * Table 4.15: L2CAP_LE_CREDIT_BASED_CONNECTION_REQ SPSM ranges
5047	 */
5048	if (!psm || __le16_to_cpu(psm) > L2CAP_PSM_LE_DYN_END) {
5049		result = L2CAP_CR_LE_BAD_PSM;
5050		goto response;
5051	}
5052
5053	BT_DBG("psm 0x%2.2x mtu %u mps %u", __le16_to_cpu(psm), mtu, mps);
5054
5055	memset(pdu, 0, sizeof(*pdu));
5056
5057	/* Check if we have socket listening on psm */
5058	pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src,
5059					 &conn->hcon->dst, LE_LINK);
5060	if (!pchan) {
5061		result = L2CAP_CR_LE_BAD_PSM;
5062		goto response;
5063	}
5064
5065	mutex_lock(&conn->chan_lock);
5066	l2cap_chan_lock(pchan);
5067
5068	if (!smp_sufficient_security(conn->hcon, pchan->sec_level,
5069				     SMP_ALLOW_STK)) {
5070		result = L2CAP_CR_LE_AUTHENTICATION;
5071		goto unlock;
5072	}
5073
5074	result = L2CAP_CR_LE_SUCCESS;
5075
5076	for (i = 0; i < num_scid; i++) {
5077		u16 scid = __le16_to_cpu(req->scid[i]);
5078
5079		BT_DBG("scid[%d] 0x%4.4x", i, scid);
5080
5081		pdu->dcid[i] = 0x0000;
5082		len += sizeof(*pdu->dcid);
5083
5084		/* Check for valid dynamic CID range */
5085		if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_LE_DYN_END) {
5086			result = L2CAP_CR_LE_INVALID_SCID;
5087			continue;
5088		}
5089
5090		/* Check if we already have channel with that dcid */
5091		if (__l2cap_get_chan_by_dcid(conn, scid)) {
5092			result = L2CAP_CR_LE_SCID_IN_USE;
5093			continue;
5094		}
5095
5096		chan = pchan->ops->new_connection(pchan);
5097		if (!chan) {
5098			result = L2CAP_CR_LE_NO_MEM;
5099			continue;
5100		}
5101
5102		bacpy(&chan->src, &conn->hcon->src);
5103		bacpy(&chan->dst, &conn->hcon->dst);
5104		chan->src_type = bdaddr_src_type(conn->hcon);
5105		chan->dst_type = bdaddr_dst_type(conn->hcon);
5106		chan->psm  = psm;
5107		chan->dcid = scid;
5108		chan->omtu = mtu;
5109		chan->remote_mps = mps;
5110
5111		__l2cap_chan_add(conn, chan);
5112
5113		l2cap_ecred_init(chan, __le16_to_cpu(req->credits));
5114
5115		/* Init response */
5116		if (!pdu->credits) {
5117			pdu->mtu = cpu_to_le16(chan->imtu);
5118			pdu->mps = cpu_to_le16(chan->mps);
5119			pdu->credits = cpu_to_le16(chan->rx_credits);
5120		}
5121
5122		pdu->dcid[i] = cpu_to_le16(chan->scid);
5123
5124		__set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
5125
5126		chan->ident = cmd->ident;
5127		chan->mode = L2CAP_MODE_EXT_FLOWCTL;
5128
5129		if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
5130			l2cap_state_change(chan, BT_CONNECT2);
5131			defer = true;
5132			chan->ops->defer(chan);
5133		} else {
5134			l2cap_chan_ready(chan);
5135		}
5136	}
5137
5138unlock:
5139	l2cap_chan_unlock(pchan);
5140	mutex_unlock(&conn->chan_lock);
5141	l2cap_chan_put(pchan);
5142
5143response:
5144	pdu->result = cpu_to_le16(result);
5145
5146	if (defer)
5147		return 0;
5148
5149	l2cap_send_cmd(conn, cmd->ident, L2CAP_ECRED_CONN_RSP,
5150		       sizeof(*pdu) + len, pdu);
5151
5152	return 0;
5153}
5154
5155static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn,
5156				       struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5157				       u8 *data)
5158{
5159	struct l2cap_ecred_conn_rsp *rsp = (void *) data;
5160	struct hci_conn *hcon = conn->hcon;
5161	u16 mtu, mps, credits, result;
5162	struct l2cap_chan *chan, *tmp;
5163	int err = 0, sec_level;
5164	int i = 0;
5165
5166	if (cmd_len < sizeof(*rsp))
5167		return -EPROTO;
5168
5169	mtu     = __le16_to_cpu(rsp->mtu);
5170	mps     = __le16_to_cpu(rsp->mps);
5171	credits = __le16_to_cpu(rsp->credits);
5172	result  = __le16_to_cpu(rsp->result);
5173
5174	BT_DBG("mtu %u mps %u credits %u result 0x%4.4x", mtu, mps, credits,
5175	       result);
5176
5177	mutex_lock(&conn->chan_lock);
5178
5179	cmd_len -= sizeof(*rsp);
5180
5181	list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
5182		u16 dcid;
5183
5184		if (chan->ident != cmd->ident ||
5185		    chan->mode != L2CAP_MODE_EXT_FLOWCTL ||
5186		    chan->state == BT_CONNECTED)
5187			continue;
5188
5189		l2cap_chan_lock(chan);
5190
5191		/* Check that there is a dcid for each pending channel */
5192		if (cmd_len < sizeof(dcid)) {
5193			l2cap_chan_del(chan, ECONNREFUSED);
5194			l2cap_chan_unlock(chan);
5195			continue;
5196		}
5197
5198		dcid = __le16_to_cpu(rsp->dcid[i++]);
5199		cmd_len -= sizeof(u16);
5200
5201		BT_DBG("dcid[%d] 0x%4.4x", i, dcid);
5202
5203		/* Check if dcid is already in use */
5204		if (dcid && __l2cap_get_chan_by_dcid(conn, dcid)) {
5205			/* If a device receives a
5206			 * L2CAP_CREDIT_BASED_CONNECTION_RSP packet with an
5207			 * already-assigned Destination CID, then both the
5208			 * original channel and the new channel shall be
5209			 * immediately discarded and not used.
5210			 */
5211			l2cap_chan_del(chan, ECONNREFUSED);
5212			l2cap_chan_unlock(chan);
5213			chan = __l2cap_get_chan_by_dcid(conn, dcid);
5214			l2cap_chan_lock(chan);
5215			l2cap_chan_del(chan, ECONNRESET);
5216			l2cap_chan_unlock(chan);
5217			continue;
5218		}
5219
5220		switch (result) {
5221		case L2CAP_CR_LE_AUTHENTICATION:
5222		case L2CAP_CR_LE_ENCRYPTION:
5223			/* If we already have MITM protection we can't do
5224			 * anything.
5225			 */
5226			if (hcon->sec_level > BT_SECURITY_MEDIUM) {
5227				l2cap_chan_del(chan, ECONNREFUSED);
5228				break;
5229			}
5230
5231			sec_level = hcon->sec_level + 1;
5232			if (chan->sec_level < sec_level)
5233				chan->sec_level = sec_level;
5234
5235			/* We'll need to send a new Connect Request */
5236			clear_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags);
5237
5238			smp_conn_security(hcon, chan->sec_level);
5239			break;
5240
5241		case L2CAP_CR_LE_BAD_PSM:
5242			l2cap_chan_del(chan, ECONNREFUSED);
5243			break;
5244
5245		default:
5246			/* If dcid was not set it means channels was refused */
5247			if (!dcid) {
5248				l2cap_chan_del(chan, ECONNREFUSED);
5249				break;
5250			}
5251
5252			chan->ident = 0;
5253			chan->dcid = dcid;
5254			chan->omtu = mtu;
5255			chan->remote_mps = mps;
5256			chan->tx_credits = credits;
5257			l2cap_chan_ready(chan);
5258			break;
5259		}
5260
5261		l2cap_chan_unlock(chan);
5262	}
5263
5264	mutex_unlock(&conn->chan_lock);
5265
5266	return err;
5267}
5268
5269static inline int l2cap_ecred_reconf_req(struct l2cap_conn *conn,
5270					 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5271					 u8 *data)
5272{
5273	struct l2cap_ecred_reconf_req *req = (void *) data;
5274	struct l2cap_ecred_reconf_rsp rsp;
5275	u16 mtu, mps, result;
5276	struct l2cap_chan *chan;
5277	int i, num_scid;
5278
5279	if (!enable_ecred)
5280		return -EINVAL;
5281
5282	if (cmd_len < sizeof(*req) || cmd_len - sizeof(*req) % sizeof(u16)) {
5283		result = L2CAP_CR_LE_INVALID_PARAMS;
5284		goto respond;
5285	}
5286
5287	mtu = __le16_to_cpu(req->mtu);
5288	mps = __le16_to_cpu(req->mps);
5289
5290	BT_DBG("mtu %u mps %u", mtu, mps);
5291
5292	if (mtu < L2CAP_ECRED_MIN_MTU) {
5293		result = L2CAP_RECONF_INVALID_MTU;
5294		goto respond;
5295	}
5296
5297	if (mps < L2CAP_ECRED_MIN_MPS) {
5298		result = L2CAP_RECONF_INVALID_MPS;
5299		goto respond;
5300	}
5301
5302	cmd_len -= sizeof(*req);
5303	num_scid = cmd_len / sizeof(u16);
5304	result = L2CAP_RECONF_SUCCESS;
5305
5306	for (i = 0; i < num_scid; i++) {
5307		u16 scid;
5308
5309		scid = __le16_to_cpu(req->scid[i]);
5310		if (!scid)
5311			return -EPROTO;
5312
5313		chan = __l2cap_get_chan_by_dcid(conn, scid);
5314		if (!chan)
5315			continue;
5316
5317		/* If the MTU value is decreased for any of the included
5318		 * channels, then the receiver shall disconnect all
5319		 * included channels.
5320		 */
5321		if (chan->omtu > mtu) {
5322			BT_ERR("chan %p decreased MTU %u -> %u", chan,
5323			       chan->omtu, mtu);
5324			result = L2CAP_RECONF_INVALID_MTU;
5325		}
5326
5327		chan->omtu = mtu;
5328		chan->remote_mps = mps;
5329	}
5330
5331respond:
5332	rsp.result = cpu_to_le16(result);
5333
5334	l2cap_send_cmd(conn, cmd->ident, L2CAP_ECRED_RECONF_RSP, sizeof(rsp),
5335		       &rsp);
 
5336
5337	return 0;
5338}
5339
5340static inline int l2cap_ecred_reconf_rsp(struct l2cap_conn *conn,
5341					 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5342					 u8 *data)
5343{
5344	struct l2cap_chan *chan, *tmp;
5345	struct l2cap_ecred_conn_rsp *rsp = (void *) data;
5346	u16 result;
 
 
 
 
 
5347
5348	if (cmd_len < sizeof(*rsp))
 
5349		return -EPROTO;
5350
5351	result = __le16_to_cpu(rsp->result);
 
 
 
 
5352
5353	BT_DBG("result 0x%4.4x", rsp->result);
 
5354
5355	if (!result)
5356		return 0;
5357
5358	list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
5359		if (chan->ident != cmd->ident)
5360			continue;
 
 
5361
5362		l2cap_chan_del(chan, ECONNRESET);
5363	}
 
 
 
5364
5365	return 0;
5366}
5367
5368static inline int l2cap_le_command_rej(struct l2cap_conn *conn,
5369				       struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5370				       u8 *data)
5371{
5372	struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data;
5373	struct l2cap_chan *chan;
5374
5375	if (cmd_len < sizeof(*rej))
5376		return -EPROTO;
5377
5378	mutex_lock(&conn->chan_lock);
5379
5380	chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
5381	if (!chan)
5382		goto done;
 
5383
5384	chan = l2cap_chan_hold_unless_zero(chan);
5385	if (!chan)
5386		goto done;
5387
5388	l2cap_chan_lock(chan);
5389	l2cap_chan_del(chan, ECONNREFUSED);
5390	l2cap_chan_unlock(chan);
5391	l2cap_chan_put(chan);
5392
5393done:
5394	mutex_unlock(&conn->chan_lock);
5395	return 0;
5396}
5397
5398static inline int l2cap_le_sig_cmd(struct l2cap_conn *conn,
5399				   struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5400				   u8 *data)
5401{
5402	int err = 0;
5403
5404	switch (cmd->code) {
5405	case L2CAP_COMMAND_REJ:
5406		l2cap_le_command_rej(conn, cmd, cmd_len, data);
5407		break;
5408
5409	case L2CAP_CONN_PARAM_UPDATE_REQ:
5410		err = l2cap_conn_param_update_req(conn, cmd, cmd_len, data);
5411		break;
5412
5413	case L2CAP_CONN_PARAM_UPDATE_RSP:
 
5414		break;
5415
5416	case L2CAP_LE_CONN_RSP:
5417		l2cap_le_connect_rsp(conn, cmd, cmd_len, data);
5418		break;
5419
5420	case L2CAP_LE_CONN_REQ:
5421		err = l2cap_le_connect_req(conn, cmd, cmd_len, data);
5422		break;
5423
5424	case L2CAP_LE_CREDITS:
5425		err = l2cap_le_credits(conn, cmd, cmd_len, data);
5426		break;
5427
5428	case L2CAP_ECRED_CONN_REQ:
5429		err = l2cap_ecred_conn_req(conn, cmd, cmd_len, data);
5430		break;
5431
5432	case L2CAP_ECRED_CONN_RSP:
5433		err = l2cap_ecred_conn_rsp(conn, cmd, cmd_len, data);
5434		break;
5435
5436	case L2CAP_ECRED_RECONF_REQ:
5437		err = l2cap_ecred_reconf_req(conn, cmd, cmd_len, data);
5438		break;
5439
5440	case L2CAP_ECRED_RECONF_RSP:
5441		err = l2cap_ecred_reconf_rsp(conn, cmd, cmd_len, data);
5442		break;
5443
5444	case L2CAP_DISCONN_REQ:
5445		err = l2cap_disconnect_req(conn, cmd, cmd_len, data);
5446		break;
5447
5448	case L2CAP_DISCONN_RSP:
5449		l2cap_disconnect_rsp(conn, cmd, cmd_len, data);
5450		break;
5451
5452	default:
5453		BT_ERR("Unknown LE signaling command 0x%2.2x", cmd->code);
5454		err = -EINVAL;
5455		break;
5456	}
5457
5458	return err;
5459}
5460
5461static inline void l2cap_le_sig_channel(struct l2cap_conn *conn,
5462					struct sk_buff *skb)
5463{
5464	struct hci_conn *hcon = conn->hcon;
5465	struct l2cap_cmd_hdr *cmd;
5466	u16 len;
5467	int err;
5468
5469	if (hcon->type != LE_LINK)
5470		goto drop;
5471
5472	if (skb->len < L2CAP_CMD_HDR_SIZE)
5473		goto drop;
5474
5475	cmd = (void *) skb->data;
5476	skb_pull(skb, L2CAP_CMD_HDR_SIZE);
5477
5478	len = le16_to_cpu(cmd->len);
5479
5480	BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd->code, len, cmd->ident);
5481
5482	if (len != skb->len || !cmd->ident) {
5483		BT_DBG("corrupted command");
5484		goto drop;
5485	}
5486
5487	err = l2cap_le_sig_cmd(conn, cmd, len, skb->data);
5488	if (err) {
5489		struct l2cap_cmd_rej_unk rej;
5490
5491		BT_ERR("Wrong link type (%d)", err);
 
5492
5493		rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
5494		l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ,
5495			       sizeof(rej), &rej);
5496	}
5497
5498drop:
5499	kfree_skb(skb);
5500}
5501
5502static inline void l2cap_sig_send_rej(struct l2cap_conn *conn, u16 ident)
5503{
5504	struct l2cap_cmd_rej_unk rej;
5505
5506	rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
5507	l2cap_send_cmd(conn, ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej);
5508}
5509
5510static inline void l2cap_sig_channel(struct l2cap_conn *conn,
5511				     struct sk_buff *skb)
5512{
5513	struct hci_conn *hcon = conn->hcon;
5514	struct l2cap_cmd_hdr *cmd;
 
5515	int err;
5516
5517	l2cap_raw_recv(conn, skb);
5518
5519	if (hcon->type != ACL_LINK)
5520		goto drop;
5521
5522	while (skb->len >= L2CAP_CMD_HDR_SIZE) {
5523		u16 len;
5524
5525		cmd = (void *) skb->data;
5526		skb_pull(skb, L2CAP_CMD_HDR_SIZE);
5527
5528		len = le16_to_cpu(cmd->len);
5529
5530		BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd->code, len,
5531		       cmd->ident);
5532
5533		if (len > skb->len || !cmd->ident) {
5534			BT_DBG("corrupted command");
5535			l2cap_sig_send_rej(conn, cmd->ident);
5536			skb_pull(skb, len > skb->len ? skb->len : len);
5537			continue;
5538		}
5539
5540		err = l2cap_bredr_sig_cmd(conn, cmd, len, skb->data);
 
 
 
 
5541		if (err) {
 
 
5542			BT_ERR("Wrong link type (%d)", err);
5543			l2cap_sig_send_rej(conn, cmd->ident);
5544		}
5545
5546		skb_pull(skb, len);
5547	}
 
 
5548
5549	if (skb->len > 0) {
5550		BT_DBG("corrupted command");
5551		l2cap_sig_send_rej(conn, 0);
5552	}
5553
5554drop:
5555	kfree_skb(skb);
5556}
5557
5558static int l2cap_check_fcs(struct l2cap_chan *chan,  struct sk_buff *skb)
5559{
5560	u16 our_fcs, rcv_fcs;
5561	int hdr_size;
5562
5563	if (test_bit(FLAG_EXT_CTRL, &chan->flags))
5564		hdr_size = L2CAP_EXT_HDR_SIZE;
5565	else
5566		hdr_size = L2CAP_ENH_HDR_SIZE;
5567
5568	if (chan->fcs == L2CAP_FCS_CRC16) {
5569		skb_trim(skb, skb->len - L2CAP_FCS_SIZE);
5570		rcv_fcs = get_unaligned_le16(skb->data + skb->len);
5571		our_fcs = crc16(0, skb->data - hdr_size, skb->len + hdr_size);
5572
5573		if (our_fcs != rcv_fcs)
5574			return -EBADMSG;
5575	}
5576	return 0;
5577}
5578
5579static void l2cap_send_i_or_rr_or_rnr(struct l2cap_chan *chan)
5580{
5581	struct l2cap_ctrl control;
5582
5583	BT_DBG("chan %p", chan);
5584
5585	memset(&control, 0, sizeof(control));
5586	control.sframe = 1;
5587	control.final = 1;
5588	control.reqseq = chan->buffer_seq;
5589	set_bit(CONN_SEND_FBIT, &chan->conn_state);
5590
5591	if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
5592		control.super = L2CAP_SUPER_RNR;
5593		l2cap_send_sframe(chan, &control);
 
5594	}
5595
5596	if (test_and_clear_bit(CONN_REMOTE_BUSY, &chan->conn_state) &&
5597	    chan->unacked_frames > 0)
5598		__set_retrans_timer(chan);
5599
5600	/* Send pending iframes */
5601	l2cap_ertm_send(chan);
5602
5603	if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&
5604	    test_bit(CONN_SEND_FBIT, &chan->conn_state)) {
5605		/* F-bit wasn't sent in an s-frame or i-frame yet, so
5606		 * send it now.
5607		 */
5608		control.super = L2CAP_SUPER_RR;
5609		l2cap_send_sframe(chan, &control);
5610	}
5611}
5612
5613static void append_skb_frag(struct sk_buff *skb, struct sk_buff *new_frag,
5614			    struct sk_buff **last_frag)
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
5615{
5616	/* skb->len reflects data in skb as well as all fragments
5617	 * skb->data_len reflects only data in fragments
5618	 */
5619	if (!skb_has_frag_list(skb))
5620		skb_shinfo(skb)->frag_list = new_frag;
5621
5622	new_frag->next = NULL;
5623
5624	(*last_frag)->next = new_frag;
5625	*last_frag = new_frag;
5626
5627	skb->len += new_frag->len;
5628	skb->data_len += new_frag->len;
5629	skb->truesize += new_frag->truesize;
5630}
5631
5632static int l2cap_reassemble_sdu(struct l2cap_chan *chan, struct sk_buff *skb,
5633				struct l2cap_ctrl *control)
5634{
5635	int err = -EINVAL;
5636
5637	switch (control->sar) {
5638	case L2CAP_SAR_UNSEGMENTED:
5639		if (chan->sdu)
5640			break;
5641
5642		err = chan->ops->recv(chan, skb);
5643		break;
5644
5645	case L2CAP_SAR_START:
5646		if (chan->sdu)
5647			break;
5648
5649		if (!pskb_may_pull(skb, L2CAP_SDULEN_SIZE))
5650			break;
5651
5652		chan->sdu_len = get_unaligned_le16(skb->data);
5653		skb_pull(skb, L2CAP_SDULEN_SIZE);
5654
5655		if (chan->sdu_len > chan->imtu) {
5656			err = -EMSGSIZE;
5657			break;
5658		}
5659
5660		if (skb->len >= chan->sdu_len)
5661			break;
5662
5663		chan->sdu = skb;
5664		chan->sdu_last_frag = skb;
5665
5666		skb = NULL;
5667		err = 0;
5668		break;
5669
5670	case L2CAP_SAR_CONTINUE:
5671		if (!chan->sdu)
5672			break;
5673
5674		append_skb_frag(chan->sdu, skb,
5675				&chan->sdu_last_frag);
5676		skb = NULL;
5677
5678		if (chan->sdu->len >= chan->sdu_len)
5679			break;
5680
5681		err = 0;
5682		break;
5683
5684	case L2CAP_SAR_END:
5685		if (!chan->sdu)
5686			break;
5687
5688		append_skb_frag(chan->sdu, skb,
5689				&chan->sdu_last_frag);
5690		skb = NULL;
5691
5692		if (chan->sdu->len != chan->sdu_len)
5693			break;
5694
5695		err = chan->ops->recv(chan, chan->sdu);
5696
5697		if (!err) {
5698			/* Reassembly complete */
5699			chan->sdu = NULL;
5700			chan->sdu_last_frag = NULL;
5701			chan->sdu_len = 0;
5702		}
5703		break;
5704	}
5705
5706	if (err) {
5707		kfree_skb(skb);
5708		kfree_skb(chan->sdu);
5709		chan->sdu = NULL;
5710		chan->sdu_last_frag = NULL;
5711		chan->sdu_len = 0;
5712	}
5713
5714	return err;
5715}
5716
5717static int l2cap_resegment(struct l2cap_chan *chan)
5718{
5719	/* Placeholder */
5720	return 0;
5721}
5722
5723void l2cap_chan_busy(struct l2cap_chan *chan, int busy)
5724{
5725	u8 event;
5726
5727	if (chan->mode != L2CAP_MODE_ERTM)
5728		return;
5729
5730	event = busy ? L2CAP_EV_LOCAL_BUSY_DETECTED : L2CAP_EV_LOCAL_BUSY_CLEAR;
5731	l2cap_tx(chan, NULL, NULL, event);
5732}
5733
5734static int l2cap_rx_queued_iframes(struct l2cap_chan *chan)
5735{
5736	int err = 0;
5737	/* Pass sequential frames to l2cap_reassemble_sdu()
5738	 * until a gap is encountered.
5739	 */
5740
5741	BT_DBG("chan %p", chan);
 
5742
5743	while (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
5744		struct sk_buff *skb;
5745		BT_DBG("Searching for skb with txseq %d (queue len %d)",
5746		       chan->buffer_seq, skb_queue_len(&chan->srej_q));
 
5747
5748		skb = l2cap_ertm_seq_in_queue(&chan->srej_q, chan->buffer_seq);
 
5749
5750		if (!skb)
5751			break;
5752
5753		skb_unlink(skb, &chan->srej_q);
5754		chan->buffer_seq = __next_seq(chan, chan->buffer_seq);
5755		err = l2cap_reassemble_sdu(chan, skb, &bt_cb(skb)->l2cap);
5756		if (err)
5757			break;
5758	}
5759
5760	if (skb_queue_empty(&chan->srej_q)) {
5761		chan->rx_state = L2CAP_RX_STATE_RECV;
5762		l2cap_send_ack(chan);
5763	}
5764
5765	return err;
 
 
 
 
 
 
 
5766}
5767
5768static void l2cap_handle_srej(struct l2cap_chan *chan,
5769			      struct l2cap_ctrl *control)
5770{
5771	struct sk_buff *skb;
 
5772
5773	BT_DBG("chan %p, control %p", chan, control);
 
 
5774
5775	if (control->reqseq == chan->next_tx_seq) {
5776		BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq);
5777		l2cap_send_disconn_req(chan, ECONNRESET);
5778		return;
5779	}
5780
5781	skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);
 
 
5782
5783	if (skb == NULL) {
5784		BT_DBG("Seq %d not available for retransmission",
5785		       control->reqseq);
5786		return;
5787	}
5788
5789	if (chan->max_tx != 0 && bt_cb(skb)->l2cap.retries >= chan->max_tx) {
5790		BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
5791		l2cap_send_disconn_req(chan, ECONNRESET);
5792		return;
5793	}
 
5794
5795	clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
5796
5797	if (control->poll) {
5798		l2cap_pass_to_tx(chan, control);
5799
5800		set_bit(CONN_SEND_FBIT, &chan->conn_state);
5801		l2cap_retransmit(chan, control);
5802		l2cap_ertm_send(chan);
5803
5804		if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) {
5805			set_bit(CONN_SREJ_ACT, &chan->conn_state);
5806			chan->srej_save_reqseq = control->reqseq;
5807		}
5808	} else {
5809		l2cap_pass_to_tx_fbit(chan, control);
5810
5811		if (control->final) {
5812			if (chan->srej_save_reqseq != control->reqseq ||
5813			    !test_and_clear_bit(CONN_SREJ_ACT,
5814						&chan->conn_state))
5815				l2cap_retransmit(chan, control);
5816		} else {
5817			l2cap_retransmit(chan, control);
5818			if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) {
5819				set_bit(CONN_SREJ_ACT, &chan->conn_state);
5820				chan->srej_save_reqseq = control->reqseq;
5821			}
5822		}
 
 
 
 
 
5823	}
5824}
5825
5826static void l2cap_handle_rej(struct l2cap_chan *chan,
5827			     struct l2cap_ctrl *control)
5828{
5829	struct sk_buff *skb;
 
5830
5831	BT_DBG("chan %p, control %p", chan, control);
 
 
 
 
5832
5833	if (control->reqseq == chan->next_tx_seq) {
5834		BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq);
5835		l2cap_send_disconn_req(chan, ECONNRESET);
5836		return;
5837	}
5838
5839	skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);
5840
5841	if (chan->max_tx && skb &&
5842	    bt_cb(skb)->l2cap.retries >= chan->max_tx) {
5843		BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
5844		l2cap_send_disconn_req(chan, ECONNRESET);
5845		return;
5846	}
5847
5848	clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
 
5849
5850	l2cap_pass_to_tx(chan, control);
5851
5852	if (control->final) {
5853		if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))
5854			l2cap_retransmit_all(chan, control);
5855	} else {
5856		l2cap_retransmit_all(chan, control);
5857		l2cap_ertm_send(chan);
5858		if (chan->tx_state == L2CAP_TX_STATE_WAIT_F)
5859			set_bit(CONN_REJ_ACT, &chan->conn_state);
5860	}
5861}
5862
5863static u8 l2cap_classify_txseq(struct l2cap_chan *chan, u16 txseq)
5864{
5865	BT_DBG("chan %p, txseq %d", chan, txseq);
 
 
 
 
 
5866
5867	BT_DBG("last_acked_seq %d, expected_tx_seq %d", chan->last_acked_seq,
5868	       chan->expected_tx_seq);
5869
5870	if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
5871		if (__seq_offset(chan, txseq, chan->last_acked_seq) >=
5872		    chan->tx_win) {
5873			/* See notes below regarding "double poll" and
5874			 * invalid packets.
5875			 */
5876			if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) {
5877				BT_DBG("Invalid/Ignore - after SREJ");
5878				return L2CAP_TXSEQ_INVALID_IGNORE;
5879			} else {
5880				BT_DBG("Invalid - in window after SREJ sent");
5881				return L2CAP_TXSEQ_INVALID;
5882			}
5883		}
5884
5885		if (chan->srej_list.head == txseq) {
5886			BT_DBG("Expected SREJ");
5887			return L2CAP_TXSEQ_EXPECTED_SREJ;
5888		}
5889
5890		if (l2cap_ertm_seq_in_queue(&chan->srej_q, txseq)) {
5891			BT_DBG("Duplicate SREJ - txseq already stored");
5892			return L2CAP_TXSEQ_DUPLICATE_SREJ;
5893		}
5894
5895		if (l2cap_seq_list_contains(&chan->srej_list, txseq)) {
5896			BT_DBG("Unexpected SREJ - not requested");
5897			return L2CAP_TXSEQ_UNEXPECTED_SREJ;
5898		}
5899	}
5900
5901	if (chan->expected_tx_seq == txseq) {
5902		if (__seq_offset(chan, txseq, chan->last_acked_seq) >=
5903		    chan->tx_win) {
5904			BT_DBG("Invalid - txseq outside tx window");
5905			return L2CAP_TXSEQ_INVALID;
5906		} else {
5907			BT_DBG("Expected");
5908			return L2CAP_TXSEQ_EXPECTED;
5909		}
5910	}
5911
5912	if (__seq_offset(chan, txseq, chan->last_acked_seq) <
5913	    __seq_offset(chan, chan->expected_tx_seq, chan->last_acked_seq)) {
5914		BT_DBG("Duplicate - expected_tx_seq later than txseq");
5915		return L2CAP_TXSEQ_DUPLICATE;
5916	}
5917
5918	if (__seq_offset(chan, txseq, chan->last_acked_seq) >= chan->tx_win) {
5919		/* A source of invalid packets is a "double poll" condition,
5920		 * where delays cause us to send multiple poll packets.  If
5921		 * the remote stack receives and processes both polls,
5922		 * sequence numbers can wrap around in such a way that a
5923		 * resent frame has a sequence number that looks like new data
5924		 * with a sequence gap.  This would trigger an erroneous SREJ
5925		 * request.
5926		 *
5927		 * Fortunately, this is impossible with a tx window that's
5928		 * less than half of the maximum sequence number, which allows
5929		 * invalid frames to be safely ignored.
5930		 *
5931		 * With tx window sizes greater than half of the tx window
5932		 * maximum, the frame is invalid and cannot be ignored.  This
5933		 * causes a disconnect.
5934		 */
5935
5936		if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) {
5937			BT_DBG("Invalid/Ignore - txseq outside tx window");
5938			return L2CAP_TXSEQ_INVALID_IGNORE;
5939		} else {
5940			BT_DBG("Invalid - txseq outside tx window");
5941			return L2CAP_TXSEQ_INVALID;
5942		}
5943	} else {
5944		BT_DBG("Unexpected - txseq indicates missing frames");
5945		return L2CAP_TXSEQ_UNEXPECTED;
5946	}
5947}
5948
5949static int l2cap_rx_state_recv(struct l2cap_chan *chan,
5950			       struct l2cap_ctrl *control,
5951			       struct sk_buff *skb, u8 event)
5952{
5953	struct l2cap_ctrl local_control;
5954	int err = 0;
5955	bool skb_in_use = false;
5956
5957	BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
5958	       event);
5959
5960	switch (event) {
5961	case L2CAP_EV_RECV_IFRAME:
5962		switch (l2cap_classify_txseq(chan, control->txseq)) {
5963		case L2CAP_TXSEQ_EXPECTED:
5964			l2cap_pass_to_tx(chan, control);
5965
5966			if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
5967				BT_DBG("Busy, discarding expected seq %d",
5968				       control->txseq);
5969				break;
 
 
 
 
5970			}
 
 
5971
5972			chan->expected_tx_seq = __next_seq(chan,
5973							   control->txseq);
5974
5975			chan->buffer_seq = chan->expected_tx_seq;
5976			skb_in_use = true;
5977
5978			/* l2cap_reassemble_sdu may free skb, hence invalidate
5979			 * control, so make a copy in advance to use it after
5980			 * l2cap_reassemble_sdu returns and to avoid the race
5981			 * condition, for example:
5982			 *
5983			 * The current thread calls:
5984			 *   l2cap_reassemble_sdu
5985			 *     chan->ops->recv == l2cap_sock_recv_cb
5986			 *       __sock_queue_rcv_skb
5987			 * Another thread calls:
5988			 *   bt_sock_recvmsg
5989			 *     skb_recv_datagram
5990			 *     skb_free_datagram
5991			 * Then the current thread tries to access control, but
5992			 * it was freed by skb_free_datagram.
5993			 */
5994			local_control = *control;
5995			err = l2cap_reassemble_sdu(chan, skb, control);
5996			if (err)
5997				break;
5998
5999			if (local_control.final) {
6000				if (!test_and_clear_bit(CONN_REJ_ACT,
6001							&chan->conn_state)) {
6002					local_control.final = 0;
6003					l2cap_retransmit_all(chan, &local_control);
6004					l2cap_ertm_send(chan);
6005				}
6006			}
6007
6008			if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state))
6009				l2cap_send_ack(chan);
6010			break;
6011		case L2CAP_TXSEQ_UNEXPECTED:
6012			l2cap_pass_to_tx(chan, control);
6013
6014			/* Can't issue SREJ frames in the local busy state.
6015			 * Drop this frame, it will be seen as missing
6016			 * when local busy is exited.
6017			 */
6018			if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
6019				BT_DBG("Busy, discarding unexpected seq %d",
6020				       control->txseq);
6021				break;
6022			}
 
 
 
 
6023
6024			/* There was a gap in the sequence, so an SREJ
6025			 * must be sent for each missing frame.  The
6026			 * current frame is stored for later use.
6027			 */
6028			skb_queue_tail(&chan->srej_q, skb);
6029			skb_in_use = true;
6030			BT_DBG("Queued %p (queue len %d)", skb,
6031			       skb_queue_len(&chan->srej_q));
6032
6033			clear_bit(CONN_SREJ_ACT, &chan->conn_state);
6034			l2cap_seq_list_clear(&chan->srej_list);
6035			l2cap_send_srej(chan, control->txseq);
6036
6037			chan->rx_state = L2CAP_RX_STATE_SREJ_SENT;
6038			break;
6039		case L2CAP_TXSEQ_DUPLICATE:
6040			l2cap_pass_to_tx(chan, control);
6041			break;
6042		case L2CAP_TXSEQ_INVALID_IGNORE:
6043			break;
6044		case L2CAP_TXSEQ_INVALID:
6045		default:
6046			l2cap_send_disconn_req(chan, ECONNRESET);
6047			break;
6048		}
6049		break;
6050	case L2CAP_EV_RECV_RR:
6051		l2cap_pass_to_tx(chan, control);
6052		if (control->final) {
6053			clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6054
6055			if (!test_and_clear_bit(CONN_REJ_ACT,
6056						&chan->conn_state)) {
6057				control->final = 0;
6058				l2cap_retransmit_all(chan, control);
6059			}
6060
6061			l2cap_ertm_send(chan);
6062		} else if (control->poll) {
6063			l2cap_send_i_or_rr_or_rnr(chan);
6064		} else {
6065			if (test_and_clear_bit(CONN_REMOTE_BUSY,
6066					       &chan->conn_state) &&
6067			    chan->unacked_frames)
6068				__set_retrans_timer(chan);
6069
6070			l2cap_ertm_send(chan);
6071		}
6072		break;
6073	case L2CAP_EV_RECV_RNR:
6074		set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6075		l2cap_pass_to_tx(chan, control);
6076		if (control && control->poll) {
6077			set_bit(CONN_SEND_FBIT, &chan->conn_state);
6078			l2cap_send_rr_or_rnr(chan, 0);
6079		}
6080		__clear_retrans_timer(chan);
6081		l2cap_seq_list_clear(&chan->retrans_list);
6082		break;
6083	case L2CAP_EV_RECV_REJ:
6084		l2cap_handle_rej(chan, control);
6085		break;
6086	case L2CAP_EV_RECV_SREJ:
6087		l2cap_handle_srej(chan, control);
6088		break;
6089	default:
6090		break;
6091	}
 
6092
6093	if (skb && !skb_in_use) {
6094		BT_DBG("Freeing %p", skb);
6095		kfree_skb(skb);
 
 
 
 
 
6096	}
6097
6098	return err;
6099}
6100
6101static int l2cap_rx_state_srej_sent(struct l2cap_chan *chan,
6102				    struct l2cap_ctrl *control,
6103				    struct sk_buff *skb, u8 event)
6104{
6105	int err = 0;
6106	u16 txseq = control->txseq;
6107	bool skb_in_use = false;
6108
6109	BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
6110	       event);
 
 
6111
6112	switch (event) {
6113	case L2CAP_EV_RECV_IFRAME:
6114		switch (l2cap_classify_txseq(chan, txseq)) {
6115		case L2CAP_TXSEQ_EXPECTED:
6116			/* Keep frame for reassembly later */
6117			l2cap_pass_to_tx(chan, control);
6118			skb_queue_tail(&chan->srej_q, skb);
6119			skb_in_use = true;
6120			BT_DBG("Queued %p (queue len %d)", skb,
6121			       skb_queue_len(&chan->srej_q));
6122
6123			chan->expected_tx_seq = __next_seq(chan, txseq);
6124			break;
6125		case L2CAP_TXSEQ_EXPECTED_SREJ:
6126			l2cap_seq_list_pop(&chan->srej_list);
6127
6128			l2cap_pass_to_tx(chan, control);
6129			skb_queue_tail(&chan->srej_q, skb);
6130			skb_in_use = true;
6131			BT_DBG("Queued %p (queue len %d)", skb,
6132			       skb_queue_len(&chan->srej_q));
6133
6134			err = l2cap_rx_queued_iframes(chan);
6135			if (err)
6136				break;
 
 
6137
6138			break;
6139		case L2CAP_TXSEQ_UNEXPECTED:
6140			/* Got a frame that can't be reassembled yet.
6141			 * Save it for later, and send SREJs to cover
6142			 * the missing frames.
6143			 */
6144			skb_queue_tail(&chan->srej_q, skb);
6145			skb_in_use = true;
6146			BT_DBG("Queued %p (queue len %d)", skb,
6147			       skb_queue_len(&chan->srej_q));
6148
6149			l2cap_pass_to_tx(chan, control);
6150			l2cap_send_srej(chan, control->txseq);
6151			break;
6152		case L2CAP_TXSEQ_UNEXPECTED_SREJ:
6153			/* This frame was requested with an SREJ, but
6154			 * some expected retransmitted frames are
6155			 * missing.  Request retransmission of missing
6156			 * SREJ'd frames.
6157			 */
6158			skb_queue_tail(&chan->srej_q, skb);
6159			skb_in_use = true;
6160			BT_DBG("Queued %p (queue len %d)", skb,
6161			       skb_queue_len(&chan->srej_q));
6162
6163			l2cap_pass_to_tx(chan, control);
6164			l2cap_send_srej_list(chan, control->txseq);
6165			break;
6166		case L2CAP_TXSEQ_DUPLICATE_SREJ:
6167			/* We've already queued this frame.  Drop this copy. */
6168			l2cap_pass_to_tx(chan, control);
6169			break;
6170		case L2CAP_TXSEQ_DUPLICATE:
6171			/* Expecting a later sequence number, so this frame
6172			 * was already received.  Ignore it completely.
6173			 */
6174			break;
6175		case L2CAP_TXSEQ_INVALID_IGNORE:
6176			break;
6177		case L2CAP_TXSEQ_INVALID:
6178		default:
6179			l2cap_send_disconn_req(chan, ECONNRESET);
6180			break;
6181		}
6182		break;
6183	case L2CAP_EV_RECV_RR:
6184		l2cap_pass_to_tx(chan, control);
6185		if (control->final) {
6186			clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6187
6188			if (!test_and_clear_bit(CONN_REJ_ACT,
6189						&chan->conn_state)) {
6190				control->final = 0;
6191				l2cap_retransmit_all(chan, control);
6192			}
6193
6194			l2cap_ertm_send(chan);
6195		} else if (control->poll) {
6196			if (test_and_clear_bit(CONN_REMOTE_BUSY,
6197					       &chan->conn_state) &&
6198			    chan->unacked_frames) {
6199				__set_retrans_timer(chan);
6200			}
6201
6202			set_bit(CONN_SEND_FBIT, &chan->conn_state);
6203			l2cap_send_srej_tail(chan);
6204		} else {
6205			if (test_and_clear_bit(CONN_REMOTE_BUSY,
6206					       &chan->conn_state) &&
6207			    chan->unacked_frames)
 
 
6208				__set_retrans_timer(chan);
6209
6210			l2cap_send_ack(chan);
6211		}
6212		break;
6213	case L2CAP_EV_RECV_RNR:
6214		set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6215		l2cap_pass_to_tx(chan, control);
6216		if (control->poll) {
6217			l2cap_send_srej_tail(chan);
6218		} else {
6219			struct l2cap_ctrl rr_control;
6220			memset(&rr_control, 0, sizeof(rr_control));
6221			rr_control.sframe = 1;
6222			rr_control.super = L2CAP_SUPER_RR;
6223			rr_control.reqseq = chan->buffer_seq;
6224			l2cap_send_sframe(chan, &rr_control);
6225		}
6226
6227		break;
6228	case L2CAP_EV_RECV_REJ:
6229		l2cap_handle_rej(chan, control);
6230		break;
6231	case L2CAP_EV_RECV_SREJ:
6232		l2cap_handle_srej(chan, control);
6233		break;
6234	}
6235
6236	if (skb && !skb_in_use) {
6237		BT_DBG("Freeing %p", skb);
6238		kfree_skb(skb);
6239	}
6240
6241	return err;
6242}
6243
6244static int l2cap_finish_move(struct l2cap_chan *chan)
6245{
6246	BT_DBG("chan %p", chan);
6247
6248	chan->rx_state = L2CAP_RX_STATE_RECV;
6249	chan->conn->mtu = chan->conn->hcon->mtu;
 
 
6250
6251	return l2cap_resegment(chan);
 
 
 
 
 
6252}
6253
6254static int l2cap_rx_state_wait_p(struct l2cap_chan *chan,
6255				 struct l2cap_ctrl *control,
6256				 struct sk_buff *skb, u8 event)
6257{
6258	int err;
6259
6260	BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
6261	       event);
6262
6263	if (!control->poll)
6264		return -EPROTO;
6265
6266	l2cap_process_reqseq(chan, control->reqseq);
6267
6268	if (!skb_queue_empty(&chan->tx_q))
6269		chan->tx_send_head = skb_peek(&chan->tx_q);
6270	else
6271		chan->tx_send_head = NULL;
6272
6273	/* Rewind next_tx_seq to the point expected
6274	 * by the receiver.
6275	 */
6276	chan->next_tx_seq = control->reqseq;
6277	chan->unacked_frames = 0;
6278
6279	err = l2cap_finish_move(chan);
6280	if (err)
6281		return err;
6282
6283	set_bit(CONN_SEND_FBIT, &chan->conn_state);
6284	l2cap_send_i_or_rr_or_rnr(chan);
6285
6286	if (event == L2CAP_EV_RECV_IFRAME)
6287		return -EPROTO;
 
 
 
6288
6289	return l2cap_rx_state_recv(chan, control, NULL, event);
 
 
6290}
6291
6292static int l2cap_rx_state_wait_f(struct l2cap_chan *chan,
6293				 struct l2cap_ctrl *control,
6294				 struct sk_buff *skb, u8 event)
6295{
6296	int err;
6297
6298	if (!control->final)
6299		return -EPROTO;
6300
6301	clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6302
6303	chan->rx_state = L2CAP_RX_STATE_RECV;
6304	l2cap_process_reqseq(chan, control->reqseq);
 
6305
6306	if (!skb_queue_empty(&chan->tx_q))
6307		chan->tx_send_head = skb_peek(&chan->tx_q);
6308	else
6309		chan->tx_send_head = NULL;
6310
6311	/* Rewind next_tx_seq to the point expected
6312	 * by the receiver.
6313	 */
6314	chan->next_tx_seq = control->reqseq;
6315	chan->unacked_frames = 0;
6316	chan->conn->mtu = chan->conn->hcon->mtu;
6317
6318	err = l2cap_resegment(chan);
6319
6320	if (!err)
6321		err = l2cap_rx_state_recv(chan, control, skb, event);
6322
6323	return err;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
6324}
6325
6326static bool __valid_reqseq(struct l2cap_chan *chan, u16 reqseq)
6327{
6328	/* Make sure reqseq is for a packet that has been sent but not acked */
6329	u16 unacked;
6330
6331	unacked = __seq_offset(chan, chan->next_tx_seq, chan->expected_ack_seq);
6332	return __seq_offset(chan, chan->next_tx_seq, reqseq) <= unacked;
6333}
6334
6335static int l2cap_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
6336		    struct sk_buff *skb, u8 event)
6337{
6338	int err = 0;
6339
6340	BT_DBG("chan %p, control %p, skb %p, event %d, state %d", chan,
6341	       control, skb, event, chan->rx_state);
6342
6343	if (__valid_reqseq(chan, control->reqseq)) {
6344		switch (chan->rx_state) {
6345		case L2CAP_RX_STATE_RECV:
6346			err = l2cap_rx_state_recv(chan, control, skb, event);
6347			break;
6348		case L2CAP_RX_STATE_SREJ_SENT:
6349			err = l2cap_rx_state_srej_sent(chan, control, skb,
6350						       event);
6351			break;
6352		case L2CAP_RX_STATE_WAIT_P:
6353			err = l2cap_rx_state_wait_p(chan, control, skb, event);
6354			break;
6355		case L2CAP_RX_STATE_WAIT_F:
6356			err = l2cap_rx_state_wait_f(chan, control, skb, event);
6357			break;
6358		default:
6359			/* shut it down */
6360			break;
6361		}
6362	} else {
6363		BT_DBG("Invalid reqseq %d (next_tx_seq %d, expected_ack_seq %d",
6364		       control->reqseq, chan->next_tx_seq,
6365		       chan->expected_ack_seq);
6366		l2cap_send_disconn_req(chan, ECONNRESET);
6367	}
6368
6369	return err;
 
 
 
 
 
6370}
6371
6372static int l2cap_stream_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
6373			   struct sk_buff *skb)
6374{
6375	/* l2cap_reassemble_sdu may free skb, hence invalidate control, so store
6376	 * the txseq field in advance to use it after l2cap_reassemble_sdu
6377	 * returns and to avoid the race condition, for example:
6378	 *
6379	 * The current thread calls:
6380	 *   l2cap_reassemble_sdu
6381	 *     chan->ops->recv == l2cap_sock_recv_cb
6382	 *       __sock_queue_rcv_skb
6383	 * Another thread calls:
6384	 *   bt_sock_recvmsg
6385	 *     skb_recv_datagram
6386	 *     skb_free_datagram
6387	 * Then the current thread tries to access control, but it was freed by
6388	 * skb_free_datagram.
6389	 */
6390	u16 txseq = control->txseq;
6391
6392	BT_DBG("chan %p, control %p, skb %p, state %d", chan, control, skb,
6393	       chan->rx_state);
6394
6395	if (l2cap_classify_txseq(chan, txseq) == L2CAP_TXSEQ_EXPECTED) {
6396		l2cap_pass_to_tx(chan, control);
 
 
 
 
 
6397
6398		BT_DBG("buffer_seq %u->%u", chan->buffer_seq,
6399		       __next_seq(chan, chan->buffer_seq));
 
 
6400
6401		chan->buffer_seq = __next_seq(chan, chan->buffer_seq);
 
 
6402
6403		l2cap_reassemble_sdu(chan, skb, control);
6404	} else {
6405		if (chan->sdu) {
6406			kfree_skb(chan->sdu);
6407			chan->sdu = NULL;
6408		}
6409		chan->sdu_last_frag = NULL;
6410		chan->sdu_len = 0;
6411
6412		if (skb) {
6413			BT_DBG("Freeing %p", skb);
6414			kfree_skb(skb);
6415		}
6416	}
6417
6418	chan->last_acked_seq = txseq;
6419	chan->expected_tx_seq = __next_seq(chan, txseq);
6420
6421	return 0;
6422}
6423
6424static int l2cap_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
6425{
6426	struct l2cap_ctrl *control = &bt_cb(skb)->l2cap;
6427	u16 len;
6428	u8 event;
6429
6430	__unpack_control(chan, skb);
6431
 
 
6432	len = skb->len;
6433
6434	/*
6435	 * We can just drop the corrupted I-frame here.
6436	 * Receiver will miss it and start proper recovery
6437	 * procedures and ask for retransmission.
6438	 */
6439	if (l2cap_check_fcs(chan, skb))
6440		goto drop;
6441
6442	if (!control->sframe && control->sar == L2CAP_SAR_START)
6443		len -= L2CAP_SDULEN_SIZE;
6444
6445	if (chan->fcs == L2CAP_FCS_CRC16)
6446		len -= L2CAP_FCS_SIZE;
6447
6448	if (len > chan->mps) {
6449		l2cap_send_disconn_req(chan, ECONNRESET);
6450		goto drop;
6451	}
6452
6453	if (chan->ops->filter) {
6454		if (chan->ops->filter(chan, skb))
6455			goto drop;
6456	}
6457
6458	if (!control->sframe) {
6459		int err;
6460
6461		BT_DBG("iframe sar %d, reqseq %d, final %d, txseq %d",
6462		       control->sar, control->reqseq, control->final,
6463		       control->txseq);
6464
6465		/* Validate F-bit - F=0 always valid, F=1 only
6466		 * valid in TX WAIT_F
6467		 */
6468		if (control->final && chan->tx_state != L2CAP_TX_STATE_WAIT_F)
6469			goto drop;
6470
6471		if (chan->mode != L2CAP_MODE_STREAMING) {
6472			event = L2CAP_EV_RECV_IFRAME;
6473			err = l2cap_rx(chan, control, skb, event);
6474		} else {
6475			err = l2cap_stream_rx(chan, control, skb);
6476		}
6477
6478		if (err)
6479			l2cap_send_disconn_req(chan, ECONNRESET);
6480	} else {
6481		const u8 rx_func_to_event[4] = {
6482			L2CAP_EV_RECV_RR, L2CAP_EV_RECV_REJ,
6483			L2CAP_EV_RECV_RNR, L2CAP_EV_RECV_SREJ
6484		};
6485
6486		/* Only I-frames are expected in streaming mode */
6487		if (chan->mode == L2CAP_MODE_STREAMING)
6488			goto drop;
6489
6490		BT_DBG("sframe reqseq %d, final %d, poll %d, super %d",
6491		       control->reqseq, control->final, control->poll,
6492		       control->super);
6493
6494		if (len != 0) {
6495			BT_ERR("Trailing bytes: %d in sframe", len);
6496			l2cap_send_disconn_req(chan, ECONNRESET);
6497			goto drop;
6498		}
6499
6500		/* Validate F and P bits */
6501		if (control->final && (control->poll ||
6502				       chan->tx_state != L2CAP_TX_STATE_WAIT_F))
6503			goto drop;
6504
6505		event = rx_func_to_event[control->super];
6506		if (l2cap_rx(chan, control, skb, event))
6507			l2cap_send_disconn_req(chan, ECONNRESET);
6508	}
6509
6510	return 0;
6511
6512drop:
6513	kfree_skb(skb);
6514	return 0;
6515}
6516
6517static void l2cap_chan_le_send_credits(struct l2cap_chan *chan)
6518{
6519	struct l2cap_conn *conn = chan->conn;
6520	struct l2cap_le_credits pkt;
6521	u16 return_credits = l2cap_le_rx_credits(chan);
6522
6523	if (chan->rx_credits >= return_credits)
6524		return;
6525
6526	return_credits -= chan->rx_credits;
6527
6528	BT_DBG("chan %p returning %u credits to sender", chan, return_credits);
6529
6530	chan->rx_credits += return_credits;
6531
6532	pkt.cid     = cpu_to_le16(chan->scid);
6533	pkt.credits = cpu_to_le16(return_credits);
6534
6535	chan->ident = l2cap_get_ident(conn);
6536
6537	l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CREDITS, sizeof(pkt), &pkt);
6538}
6539
6540void l2cap_chan_rx_avail(struct l2cap_chan *chan, ssize_t rx_avail)
6541{
6542	if (chan->rx_avail == rx_avail)
6543		return;
6544
6545	BT_DBG("chan %p has %zd bytes avail for rx", chan, rx_avail);
6546
6547	chan->rx_avail = rx_avail;
6548
6549	if (chan->state == BT_CONNECTED)
6550		l2cap_chan_le_send_credits(chan);
6551}
6552
6553static int l2cap_ecred_recv(struct l2cap_chan *chan, struct sk_buff *skb)
6554{
6555	int err;
6556
6557	BT_DBG("SDU reassemble complete: chan %p skb->len %u", chan, skb->len);
6558
6559	/* Wait recv to confirm reception before updating the credits */
6560	err = chan->ops->recv(chan, skb);
6561
6562	if (err < 0 && chan->rx_avail != -1) {
6563		BT_ERR("Queueing received LE L2CAP data failed");
6564		l2cap_send_disconn_req(chan, ECONNRESET);
6565		return err;
6566	}
6567
6568	/* Update credits whenever an SDU is received */
6569	l2cap_chan_le_send_credits(chan);
6570
6571	return err;
6572}
6573
6574static int l2cap_ecred_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
6575{
6576	int err;
6577
6578	if (!chan->rx_credits) {
6579		BT_ERR("No credits to receive LE L2CAP data");
6580		l2cap_send_disconn_req(chan, ECONNRESET);
6581		return -ENOBUFS;
6582	}
6583
6584	if (chan->imtu < skb->len) {
6585		BT_ERR("Too big LE L2CAP PDU");
6586		return -ENOBUFS;
6587	}
6588
6589	chan->rx_credits--;
6590	BT_DBG("chan %p: rx_credits %u -> %u",
6591	       chan, chan->rx_credits + 1, chan->rx_credits);
6592
6593	/* Update if remote had run out of credits, this should only happens
6594	 * if the remote is not using the entire MPS.
6595	 */
6596	if (!chan->rx_credits)
6597		l2cap_chan_le_send_credits(chan);
6598
6599	err = 0;
6600
6601	if (!chan->sdu) {
6602		u16 sdu_len;
6603
6604		sdu_len = get_unaligned_le16(skb->data);
6605		skb_pull(skb, L2CAP_SDULEN_SIZE);
6606
6607		BT_DBG("Start of new SDU. sdu_len %u skb->len %u imtu %u",
6608		       sdu_len, skb->len, chan->imtu);
6609
6610		if (sdu_len > chan->imtu) {
6611			BT_ERR("Too big LE L2CAP SDU length received");
6612			err = -EMSGSIZE;
6613			goto failed;
6614		}
6615
6616		if (skb->len > sdu_len) {
6617			BT_ERR("Too much LE L2CAP data received");
6618			err = -EINVAL;
6619			goto failed;
6620		}
6621
6622		if (skb->len == sdu_len)
6623			return l2cap_ecred_recv(chan, skb);
6624
6625		chan->sdu = skb;
6626		chan->sdu_len = sdu_len;
6627		chan->sdu_last_frag = skb;
6628
6629		/* Detect if remote is not able to use the selected MPS */
6630		if (skb->len + L2CAP_SDULEN_SIZE < chan->mps) {
6631			u16 mps_len = skb->len + L2CAP_SDULEN_SIZE;
6632
6633			/* Adjust the number of credits */
6634			BT_DBG("chan->mps %u -> %u", chan->mps, mps_len);
6635			chan->mps = mps_len;
6636			l2cap_chan_le_send_credits(chan);
6637		}
6638
6639		return 0;
6640	}
6641
6642	BT_DBG("SDU fragment. chan->sdu->len %u skb->len %u chan->sdu_len %u",
6643	       chan->sdu->len, skb->len, chan->sdu_len);
6644
6645	if (chan->sdu->len + skb->len > chan->sdu_len) {
6646		BT_ERR("Too much LE L2CAP data received");
6647		err = -EINVAL;
6648		goto failed;
6649	}
6650
6651	append_skb_frag(chan->sdu, skb, &chan->sdu_last_frag);
6652	skb = NULL;
6653
6654	if (chan->sdu->len == chan->sdu_len) {
6655		err = l2cap_ecred_recv(chan, chan->sdu);
6656		if (!err) {
6657			chan->sdu = NULL;
6658			chan->sdu_last_frag = NULL;
6659			chan->sdu_len = 0;
6660		}
6661	}
6662
6663failed:
6664	if (err) {
6665		kfree_skb(skb);
6666		kfree_skb(chan->sdu);
6667		chan->sdu = NULL;
6668		chan->sdu_last_frag = NULL;
6669		chan->sdu_len = 0;
6670	}
6671
6672	/* We can't return an error here since we took care of the skb
6673	 * freeing internally. An error return would cause the caller to
6674	 * do a double-free of the skb.
6675	 */
6676	return 0;
6677}
6678
6679static void l2cap_data_channel(struct l2cap_conn *conn, u16 cid,
6680			       struct sk_buff *skb)
6681{
6682	struct l2cap_chan *chan;
 
 
 
6683
6684	chan = l2cap_get_chan_by_scid(conn, cid);
6685	if (!chan) {
6686		BT_DBG("unknown cid 0x%4.4x", cid);
6687		/* Drop packet and return */
6688		kfree_skb(skb);
6689		return;
6690	}
6691
6692	BT_DBG("chan %p, len %d", chan, skb->len);
6693
6694	/* If we receive data on a fixed channel before the info req/rsp
6695	 * procedure is done simply assume that the channel is supported
6696	 * and mark it as ready.
6697	 */
6698	if (chan->chan_type == L2CAP_CHAN_FIXED)
6699		l2cap_chan_ready(chan);
6700
6701	if (chan->state != BT_CONNECTED)
6702		goto drop;
6703
6704	switch (chan->mode) {
6705	case L2CAP_MODE_LE_FLOWCTL:
6706	case L2CAP_MODE_EXT_FLOWCTL:
6707		if (l2cap_ecred_data_rcv(chan, skb) < 0)
6708			goto drop;
6709
6710		goto done;
6711
6712	case L2CAP_MODE_BASIC:
6713		/* If socket recv buffers overflows we drop data here
6714		 * which is *bad* because L2CAP has to be reliable.
6715		 * But we don't have any other choice. L2CAP doesn't
6716		 * provide flow control mechanism. */
6717
6718		if (chan->imtu < skb->len) {
6719			BT_ERR("Dropping L2CAP data: receive buffer overflow");
6720			goto drop;
6721		}
6722
6723		if (!chan->ops->recv(chan, skb))
6724			goto done;
6725		break;
6726
6727	case L2CAP_MODE_ERTM:
 
 
 
 
6728	case L2CAP_MODE_STREAMING:
6729		l2cap_data_rcv(chan, skb);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
6730		goto done;
6731
6732	default:
6733		BT_DBG("chan %p: bad mode 0x%2.2x", chan, chan->mode);
6734		break;
6735	}
6736
6737drop:
6738	kfree_skb(skb);
6739
6740done:
6741	l2cap_chan_unlock(chan);
6742	l2cap_chan_put(chan);
 
6743}
6744
6745static void l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm,
6746				  struct sk_buff *skb)
6747{
6748	struct hci_conn *hcon = conn->hcon;
6749	struct l2cap_chan *chan;
6750
6751	if (hcon->type != ACL_LINK)
6752		goto free_skb;
6753
6754	chan = l2cap_global_chan_by_psm(0, psm, &hcon->src, &hcon->dst,
6755					ACL_LINK);
6756	if (!chan)
6757		goto free_skb;
6758
6759	BT_DBG("chan %p, len %d", chan, skb->len);
6760
6761	l2cap_chan_lock(chan);
6762
6763	if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)
6764		goto drop;
6765
6766	if (chan->imtu < skb->len)
6767		goto drop;
6768
6769	/* Store remote BD_ADDR and PSM for msg_name */
6770	bacpy(&bt_cb(skb)->l2cap.bdaddr, &hcon->dst);
6771	bt_cb(skb)->l2cap.psm = psm;
6772
6773	if (!chan->ops->recv(chan, skb)) {
6774		l2cap_chan_unlock(chan);
6775		l2cap_chan_put(chan);
6776		return;
6777	}
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
6778
6779drop:
6780	l2cap_chan_unlock(chan);
6781	l2cap_chan_put(chan);
6782free_skb:
6783	kfree_skb(skb);
 
 
6784}
6785
6786static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
6787{
6788	struct l2cap_hdr *lh = (void *) skb->data;
6789	struct hci_conn *hcon = conn->hcon;
6790	u16 cid, len;
6791	__le16 psm;
6792
6793	if (hcon->state != BT_CONNECTED) {
6794		BT_DBG("queueing pending rx skb");
6795		skb_queue_tail(&conn->pending_rx, skb);
6796		return;
6797	}
6798
6799	skb_pull(skb, L2CAP_HDR_SIZE);
6800	cid = __le16_to_cpu(lh->cid);
6801	len = __le16_to_cpu(lh->len);
6802
6803	if (len != skb->len) {
6804		kfree_skb(skb);
6805		return;
6806	}
6807
6808	/* Since we can't actively block incoming LE connections we must
6809	 * at least ensure that we ignore incoming data from them.
6810	 */
6811	if (hcon->type == LE_LINK &&
6812	    hci_bdaddr_list_lookup(&hcon->hdev->reject_list, &hcon->dst,
6813				   bdaddr_dst_type(hcon))) {
6814		kfree_skb(skb);
6815		return;
6816	}
6817
6818	BT_DBG("len %d, cid 0x%4.4x", len, cid);
6819
6820	switch (cid) {
 
6821	case L2CAP_CID_SIGNALING:
6822		l2cap_sig_channel(conn, skb);
6823		break;
6824
6825	case L2CAP_CID_CONN_LESS:
6826		psm = get_unaligned((__le16 *) skb->data);
6827		skb_pull(skb, L2CAP_PSMLEN_SIZE);
6828		l2cap_conless_channel(conn, psm, skb);
6829		break;
6830
6831	case L2CAP_CID_LE_SIGNALING:
6832		l2cap_le_sig_channel(conn, skb);
6833		break;
6834
6835	default:
6836		l2cap_data_channel(conn, cid, skb);
 
6837		break;
6838	}
6839}
6840
6841static void process_pending_rx(struct work_struct *work)
6842{
6843	struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
6844					       pending_rx_work);
6845	struct sk_buff *skb;
6846
6847	BT_DBG("");
6848
6849	while ((skb = skb_dequeue(&conn->pending_rx)))
6850		l2cap_recv_frame(conn, skb);
6851}
6852
6853static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon)
6854{
6855	struct l2cap_conn *conn = hcon->l2cap_data;
6856	struct hci_chan *hchan;
6857
6858	if (conn)
6859		return conn;
6860
6861	hchan = hci_chan_create(hcon);
6862	if (!hchan)
6863		return NULL;
6864
6865	conn = kzalloc(sizeof(*conn), GFP_KERNEL);
6866	if (!conn) {
6867		hci_chan_del(hchan);
6868		return NULL;
6869	}
6870
6871	kref_init(&conn->ref);
6872	hcon->l2cap_data = conn;
6873	conn->hcon = hci_conn_get(hcon);
6874	conn->hchan = hchan;
6875
6876	BT_DBG("hcon %p conn %p hchan %p", hcon, conn, hchan);
6877
6878	conn->mtu = hcon->mtu;
6879	conn->feat_mask = 0;
6880
6881	conn->local_fixed_chan = L2CAP_FC_SIG_BREDR | L2CAP_FC_CONNLESS;
6882
6883	if (hci_dev_test_flag(hcon->hdev, HCI_LE_ENABLED) &&
6884	    (bredr_sc_enabled(hcon->hdev) ||
6885	     hci_dev_test_flag(hcon->hdev, HCI_FORCE_BREDR_SMP)))
6886		conn->local_fixed_chan |= L2CAP_FC_SMP_BREDR;
6887
6888	mutex_init(&conn->ident_lock);
6889	mutex_init(&conn->chan_lock);
6890
6891	INIT_LIST_HEAD(&conn->chan_l);
6892	INIT_LIST_HEAD(&conn->users);
6893
6894	INIT_DELAYED_WORK(&conn->info_timer, l2cap_info_timeout);
6895
6896	skb_queue_head_init(&conn->pending_rx);
6897	INIT_WORK(&conn->pending_rx_work, process_pending_rx);
6898	INIT_DELAYED_WORK(&conn->id_addr_timer, l2cap_conn_update_id_addr);
6899
6900	conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
6901
6902	return conn;
6903}
6904
6905static bool is_valid_psm(u16 psm, u8 dst_type)
6906{
6907	if (!psm)
6908		return false;
6909
6910	if (bdaddr_type_is_le(dst_type))
6911		return (psm <= 0x00ff);
6912
6913	/* PSM must be odd and lsb of upper byte must be 0 */
6914	return ((psm & 0x0101) == 0x0001);
6915}
6916
6917struct l2cap_chan_data {
6918	struct l2cap_chan *chan;
6919	struct pid *pid;
6920	int count;
6921};
6922
6923static void l2cap_chan_by_pid(struct l2cap_chan *chan, void *data)
6924{
6925	struct l2cap_chan_data *d = data;
6926	struct pid *pid;
6927
6928	if (chan == d->chan)
6929		return;
6930
6931	if (!test_bit(FLAG_DEFER_SETUP, &chan->flags))
6932		return;
6933
6934	pid = chan->ops->get_peer_pid(chan);
6935
6936	/* Only count deferred channels with the same PID/PSM */
6937	if (d->pid != pid || chan->psm != d->chan->psm || chan->ident ||
6938	    chan->mode != L2CAP_MODE_EXT_FLOWCTL || chan->state != BT_CONNECT)
6939		return;
6940
6941	d->count++;
6942}
6943
6944int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,
6945		       bdaddr_t *dst, u8 dst_type, u16 timeout)
6946{
6947	struct l2cap_conn *conn;
6948	struct hci_conn *hcon;
6949	struct hci_dev *hdev;
6950	int err;
6951
6952	BT_DBG("%pMR -> %pMR (type %u) psm 0x%4.4x mode 0x%2.2x", &chan->src,
6953	       dst, dst_type, __le16_to_cpu(psm), chan->mode);
6954
6955	hdev = hci_get_route(dst, &chan->src, chan->src_type);
6956	if (!hdev)
6957		return -EHOSTUNREACH;
6958
6959	hci_dev_lock(hdev);
6960
6961	if (!is_valid_psm(__le16_to_cpu(psm), dst_type) && !cid &&
6962	    chan->chan_type != L2CAP_CHAN_RAW) {
6963		err = -EINVAL;
6964		goto done;
6965	}
6966
6967	if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED && !psm) {
6968		err = -EINVAL;
6969		goto done;
6970	}
6971
6972	if (chan->chan_type == L2CAP_CHAN_FIXED && !cid) {
6973		err = -EINVAL;
6974		goto done;
6975	}
6976
6977	switch (chan->mode) {
6978	case L2CAP_MODE_BASIC:
6979		break;
6980	case L2CAP_MODE_LE_FLOWCTL:
6981		break;
6982	case L2CAP_MODE_EXT_FLOWCTL:
6983		if (!enable_ecred) {
6984			err = -EOPNOTSUPP;
6985			goto done;
6986		}
6987		break;
6988	case L2CAP_MODE_ERTM:
6989	case L2CAP_MODE_STREAMING:
6990		if (!disable_ertm)
6991			break;
6992		fallthrough;
6993	default:
6994		err = -EOPNOTSUPP;
6995		goto done;
6996	}
6997
6998	switch (chan->state) {
6999	case BT_CONNECT:
7000	case BT_CONNECT2:
7001	case BT_CONFIG:
7002		/* Already connecting */
7003		err = 0;
7004		goto done;
7005
7006	case BT_CONNECTED:
7007		/* Already connected */
7008		err = -EISCONN;
7009		goto done;
7010
7011	case BT_OPEN:
7012	case BT_BOUND:
7013		/* Can connect */
7014		break;
7015
7016	default:
7017		err = -EBADFD;
7018		goto done;
7019	}
7020
7021	/* Set destination address and psm */
7022	bacpy(&chan->dst, dst);
7023	chan->dst_type = dst_type;
7024
7025	chan->psm = psm;
7026	chan->dcid = cid;
7027
7028	if (bdaddr_type_is_le(dst_type)) {
7029		/* Convert from L2CAP channel address type to HCI address type
7030		 */
7031		if (dst_type == BDADDR_LE_PUBLIC)
7032			dst_type = ADDR_LE_DEV_PUBLIC;
7033		else
7034			dst_type = ADDR_LE_DEV_RANDOM;
7035
7036		if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
7037			hcon = hci_connect_le(hdev, dst, dst_type, false,
7038					      chan->sec_level, timeout,
7039					      HCI_ROLE_SLAVE, 0, 0);
7040		else
7041			hcon = hci_connect_le_scan(hdev, dst, dst_type,
7042						   chan->sec_level, timeout,
7043						   CONN_REASON_L2CAP_CHAN);
7044
7045	} else {
7046		u8 auth_type = l2cap_get_auth_type(chan);
7047		hcon = hci_connect_acl(hdev, dst, chan->sec_level, auth_type,
7048				       CONN_REASON_L2CAP_CHAN, timeout);
7049	}
7050
7051	if (IS_ERR(hcon)) {
7052		err = PTR_ERR(hcon);
7053		goto done;
7054	}
7055
7056	conn = l2cap_conn_add(hcon);
7057	if (!conn) {
7058		hci_conn_drop(hcon);
7059		err = -ENOMEM;
7060		goto done;
7061	}
7062
7063	if (chan->mode == L2CAP_MODE_EXT_FLOWCTL) {
7064		struct l2cap_chan_data data;
7065
7066		data.chan = chan;
7067		data.pid = chan->ops->get_peer_pid(chan);
7068		data.count = 1;
7069
7070		l2cap_chan_list(conn, l2cap_chan_by_pid, &data);
7071
7072		/* Check if there isn't too many channels being connected */
7073		if (data.count > L2CAP_ECRED_CONN_SCID_MAX) {
7074			hci_conn_drop(hcon);
7075			err = -EPROTO;
7076			goto done;
7077		}
7078	}
7079
7080	mutex_lock(&conn->chan_lock);
7081	l2cap_chan_lock(chan);
7082
7083	if (cid && __l2cap_get_chan_by_dcid(conn, cid)) {
7084		hci_conn_drop(hcon);
7085		err = -EBUSY;
7086		goto chan_unlock;
7087	}
7088
7089	/* Update source addr of the socket */
7090	bacpy(&chan->src, &hcon->src);
7091	chan->src_type = bdaddr_src_type(hcon);
7092
7093	__l2cap_chan_add(conn, chan);
7094
7095	/* l2cap_chan_add takes its own ref so we can drop this one */
7096	hci_conn_drop(hcon);
7097
7098	l2cap_state_change(chan, BT_CONNECT);
7099	__set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
7100
7101	/* Release chan->sport so that it can be reused by other
7102	 * sockets (as it's only used for listening sockets).
7103	 */
7104	write_lock(&chan_list_lock);
7105	chan->sport = 0;
7106	write_unlock(&chan_list_lock);
7107
7108	if (hcon->state == BT_CONNECTED) {
7109		if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
7110			__clear_chan_timer(chan);
7111			if (l2cap_chan_check_security(chan, true))
7112				l2cap_state_change(chan, BT_CONNECTED);
7113		} else
7114			l2cap_do_start(chan);
7115	}
7116
7117	err = 0;
7118
7119chan_unlock:
7120	l2cap_chan_unlock(chan);
7121	mutex_unlock(&conn->chan_lock);
7122done:
7123	hci_dev_unlock(hdev);
7124	hci_dev_put(hdev);
7125	return err;
7126}
7127EXPORT_SYMBOL_GPL(l2cap_chan_connect);
7128
7129static void l2cap_ecred_reconfigure(struct l2cap_chan *chan)
7130{
7131	struct l2cap_conn *conn = chan->conn;
7132	DEFINE_RAW_FLEX(struct l2cap_ecred_reconf_req, pdu, scid, 1);
7133
7134	pdu->mtu = cpu_to_le16(chan->imtu);
7135	pdu->mps = cpu_to_le16(chan->mps);
7136	pdu->scid[0] = cpu_to_le16(chan->scid);
7137
7138	chan->ident = l2cap_get_ident(conn);
7139
7140	l2cap_send_cmd(conn, chan->ident, L2CAP_ECRED_RECONF_REQ,
7141		       sizeof(pdu), &pdu);
7142}
7143
7144int l2cap_chan_reconfigure(struct l2cap_chan *chan, __u16 mtu)
7145{
7146	if (chan->imtu > mtu)
7147		return -EINVAL;
7148
7149	BT_DBG("chan %p mtu 0x%4.4x", chan, mtu);
7150
7151	chan->imtu = mtu;
7152
7153	l2cap_ecred_reconfigure(chan);
7154
7155	return 0;
7156}
7157
7158/* ---- L2CAP interface with lower layer (HCI) ---- */
7159
7160int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr)
7161{
7162	int exact = 0, lm1 = 0, lm2 = 0;
7163	struct l2cap_chan *c;
7164
7165	BT_DBG("hdev %s, bdaddr %pMR", hdev->name, bdaddr);
7166
7167	/* Find listening sockets and check their link_mode */
7168	read_lock(&chan_list_lock);
7169	list_for_each_entry(c, &chan_list, global_l) {
 
 
7170		if (c->state != BT_LISTEN)
7171			continue;
7172
7173		if (!bacmp(&c->src, &hdev->bdaddr)) {
7174			lm1 |= HCI_LM_ACCEPT;
7175			if (test_bit(FLAG_ROLE_SWITCH, &c->flags))
7176				lm1 |= HCI_LM_MASTER;
7177			exact++;
7178		} else if (!bacmp(&c->src, BDADDR_ANY)) {
7179			lm2 |= HCI_LM_ACCEPT;
7180			if (test_bit(FLAG_ROLE_SWITCH, &c->flags))
7181				lm2 |= HCI_LM_MASTER;
7182		}
7183	}
7184	read_unlock(&chan_list_lock);
7185
7186	return exact ? lm1 : lm2;
7187}
7188
7189/* Find the next fixed channel in BT_LISTEN state, continue iteration
7190 * from an existing channel in the list or from the beginning of the
7191 * global list (by passing NULL as first parameter).
7192 */
7193static struct l2cap_chan *l2cap_global_fixed_chan(struct l2cap_chan *c,
7194						  struct hci_conn *hcon)
7195{
7196	u8 src_type = bdaddr_src_type(hcon);
7197
7198	read_lock(&chan_list_lock);
7199
7200	if (c)
7201		c = list_next_entry(c, global_l);
7202	else
7203		c = list_entry(chan_list.next, typeof(*c), global_l);
7204
7205	list_for_each_entry_from(c, &chan_list, global_l) {
7206		if (c->chan_type != L2CAP_CHAN_FIXED)
7207			continue;
7208		if (c->state != BT_LISTEN)
7209			continue;
7210		if (bacmp(&c->src, &hcon->src) && bacmp(&c->src, BDADDR_ANY))
7211			continue;
7212		if (src_type != c->src_type)
7213			continue;
7214
7215		c = l2cap_chan_hold_unless_zero(c);
7216		read_unlock(&chan_list_lock);
7217		return c;
7218	}
7219
7220	read_unlock(&chan_list_lock);
7221
7222	return NULL;
7223}
7224
7225static bool l2cap_match(struct hci_conn *hcon)
7226{
7227	return hcon->type == ACL_LINK || hcon->type == LE_LINK;
7228}
7229
7230static void l2cap_connect_cfm(struct hci_conn *hcon, u8 status)
7231{
7232	struct hci_dev *hdev = hcon->hdev;
7233	struct l2cap_conn *conn;
7234	struct l2cap_chan *pchan;
7235	u8 dst_type;
7236
7237	BT_DBG("hcon %p bdaddr %pMR status %d", hcon, &hcon->dst, status);
7238
7239	if (status) {
 
 
 
 
7240		l2cap_conn_del(hcon, bt_to_errno(status));
7241		return;
7242	}
7243
7244	conn = l2cap_conn_add(hcon);
7245	if (!conn)
7246		return;
7247
7248	dst_type = bdaddr_dst_type(hcon);
7249
7250	/* If device is blocked, do not create channels for it */
7251	if (hci_bdaddr_list_lookup(&hdev->reject_list, &hcon->dst, dst_type))
7252		return;
7253
7254	/* Find fixed channels and notify them of the new connection. We
7255	 * use multiple individual lookups, continuing each time where
7256	 * we left off, because the list lock would prevent calling the
7257	 * potentially sleeping l2cap_chan_lock() function.
7258	 */
7259	pchan = l2cap_global_fixed_chan(NULL, hcon);
7260	while (pchan) {
7261		struct l2cap_chan *chan, *next;
7262
7263		/* Client fixed channels should override server ones */
7264		if (__l2cap_get_chan_by_dcid(conn, pchan->scid))
7265			goto next;
7266
7267		l2cap_chan_lock(pchan);
7268		chan = pchan->ops->new_connection(pchan);
7269		if (chan) {
7270			bacpy(&chan->src, &hcon->src);
7271			bacpy(&chan->dst, &hcon->dst);
7272			chan->src_type = bdaddr_src_type(hcon);
7273			chan->dst_type = dst_type;
7274
7275			__l2cap_chan_add(conn, chan);
7276		}
7277
7278		l2cap_chan_unlock(pchan);
7279next:
7280		next = l2cap_global_fixed_chan(pchan, hcon);
7281		l2cap_chan_put(pchan);
7282		pchan = next;
7283	}
7284
7285	l2cap_conn_ready(conn);
7286}
7287
7288int l2cap_disconn_ind(struct hci_conn *hcon)
7289{
7290	struct l2cap_conn *conn = hcon->l2cap_data;
7291
7292	BT_DBG("hcon %p", hcon);
7293
7294	if (!conn)
7295		return HCI_ERROR_REMOTE_USER_TERM;
7296	return conn->disc_reason;
7297}
7298
7299static void l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason)
7300{
7301	BT_DBG("hcon %p reason %d", hcon, reason);
7302
7303	l2cap_conn_del(hcon, bt_to_errno(reason));
 
7304}
7305
7306static inline void l2cap_check_encryption(struct l2cap_chan *chan, u8 encrypt)
7307{
7308	if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED)
7309		return;
7310
7311	if (encrypt == 0x00) {
7312		if (chan->sec_level == BT_SECURITY_MEDIUM) {
7313			__set_chan_timer(chan, L2CAP_ENC_TIMEOUT);
7314		} else if (chan->sec_level == BT_SECURITY_HIGH ||
7315			   chan->sec_level == BT_SECURITY_FIPS)
7316			l2cap_chan_close(chan, ECONNREFUSED);
7317	} else {
7318		if (chan->sec_level == BT_SECURITY_MEDIUM)
7319			__clear_chan_timer(chan);
7320	}
7321}
7322
7323static void l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
7324{
7325	struct l2cap_conn *conn = hcon->l2cap_data;
7326	struct l2cap_chan *chan;
7327
7328	if (!conn)
7329		return;
 
 
7330
7331	BT_DBG("conn %p status 0x%2.2x encrypt %u", conn, status, encrypt);
 
 
 
 
7332
7333	mutex_lock(&conn->chan_lock);
7334
7335	list_for_each_entry(chan, &conn->chan_l, list) {
7336		l2cap_chan_lock(chan);
7337
7338		BT_DBG("chan %p scid 0x%4.4x state %s", chan, chan->scid,
7339		       state_to_string(chan->state));
7340
7341		if (!status && encrypt)
7342			chan->sec_level = hcon->sec_level;
 
 
 
7343
7344		if (!__l2cap_no_conn_pending(chan)) {
 
 
 
 
7345			l2cap_chan_unlock(chan);
7346			continue;
7347		}
7348
7349		if (!status && (chan->state == BT_CONNECTED ||
7350				chan->state == BT_CONFIG)) {
7351			chan->ops->resume(chan);
 
 
 
 
7352			l2cap_check_encryption(chan, encrypt);
7353			l2cap_chan_unlock(chan);
7354			continue;
7355		}
7356
7357		if (chan->state == BT_CONNECT) {
7358			if (!status && l2cap_check_enc_key_size(hcon))
7359				l2cap_start_connection(chan);
7360			else
7361				__set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
7362		} else if (chan->state == BT_CONNECT2 &&
7363			   !(chan->mode == L2CAP_MODE_EXT_FLOWCTL ||
7364			     chan->mode == L2CAP_MODE_LE_FLOWCTL)) {
7365			struct l2cap_conn_rsp rsp;
7366			__u16 res, stat;
7367
7368			if (!status && l2cap_check_enc_key_size(hcon)) {
7369				if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
 
 
 
 
7370					res = L2CAP_CR_PEND;
7371					stat = L2CAP_CS_AUTHOR_PEND;
7372					chan->ops->defer(chan);
 
7373				} else {
7374					l2cap_state_change(chan, BT_CONFIG);
7375					res = L2CAP_CR_SUCCESS;
7376					stat = L2CAP_CS_NO_INFO;
7377				}
7378			} else {
7379				l2cap_state_change(chan, BT_DISCONN);
7380				__set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
7381				res = L2CAP_CR_SEC_BLOCK;
7382				stat = L2CAP_CS_NO_INFO;
7383			}
7384
 
 
7385			rsp.scid   = cpu_to_le16(chan->dcid);
7386			rsp.dcid   = cpu_to_le16(chan->scid);
7387			rsp.result = cpu_to_le16(res);
7388			rsp.status = cpu_to_le16(stat);
7389			l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
7390				       sizeof(rsp), &rsp);
7391
7392			if (!test_bit(CONF_REQ_SENT, &chan->conf_state) &&
7393			    res == L2CAP_CR_SUCCESS) {
7394				char buf[128];
7395				set_bit(CONF_REQ_SENT, &chan->conf_state);
7396				l2cap_send_cmd(conn, l2cap_get_ident(conn),
7397					       L2CAP_CONF_REQ,
7398					       l2cap_build_conf_req(chan, buf, sizeof(buf)),
7399					       buf);
7400				chan->num_conf_req++;
7401			}
7402		}
7403
7404		l2cap_chan_unlock(chan);
7405	}
7406
7407	mutex_unlock(&conn->chan_lock);
7408}
7409
7410/* Append fragment into frame respecting the maximum len of rx_skb */
7411static int l2cap_recv_frag(struct l2cap_conn *conn, struct sk_buff *skb,
7412			   u16 len)
7413{
7414	if (!conn->rx_skb) {
7415		/* Allocate skb for the complete frame (with header) */
7416		conn->rx_skb = bt_skb_alloc(len, GFP_KERNEL);
7417		if (!conn->rx_skb)
7418			return -ENOMEM;
7419		/* Init rx_len */
7420		conn->rx_len = len;
7421	}
7422
7423	/* Copy as much as the rx_skb can hold */
7424	len = min_t(u16, len, skb->len);
7425	skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, len), len);
7426	skb_pull(skb, len);
7427	conn->rx_len -= len;
7428
7429	return len;
7430}
7431
7432static int l2cap_recv_len(struct l2cap_conn *conn, struct sk_buff *skb)
7433{
7434	struct sk_buff *rx_skb;
7435	int len;
7436
7437	/* Append just enough to complete the header */
7438	len = l2cap_recv_frag(conn, skb, L2CAP_LEN_SIZE - conn->rx_skb->len);
7439
7440	/* If header could not be read just continue */
7441	if (len < 0 || conn->rx_skb->len < L2CAP_LEN_SIZE)
7442		return len;
7443
7444	rx_skb = conn->rx_skb;
7445	len = get_unaligned_le16(rx_skb->data);
7446
7447	/* Check if rx_skb has enough space to received all fragments */
7448	if (len + (L2CAP_HDR_SIZE - L2CAP_LEN_SIZE) <= skb_tailroom(rx_skb)) {
7449		/* Update expected len */
7450		conn->rx_len = len + (L2CAP_HDR_SIZE - L2CAP_LEN_SIZE);
7451		return L2CAP_LEN_SIZE;
7452	}
7453
7454	/* Reset conn->rx_skb since it will need to be reallocated in order to
7455	 * fit all fragments.
7456	 */
7457	conn->rx_skb = NULL;
7458
7459	/* Reallocates rx_skb using the exact expected length */
7460	len = l2cap_recv_frag(conn, rx_skb,
7461			      len + (L2CAP_HDR_SIZE - L2CAP_LEN_SIZE));
7462	kfree_skb(rx_skb);
7463
7464	return len;
7465}
7466
7467static void l2cap_recv_reset(struct l2cap_conn *conn)
7468{
7469	kfree_skb(conn->rx_skb);
7470	conn->rx_skb = NULL;
7471	conn->rx_len = 0;
7472}
7473
7474void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
7475{
7476	struct l2cap_conn *conn = hcon->l2cap_data;
7477	int len;
7478
7479	if (!conn)
7480		conn = l2cap_conn_add(hcon);
7481
7482	if (!conn)
7483		goto drop;
7484
7485	BT_DBG("conn %p len %u flags 0x%x", conn, skb->len, flags);
 
 
 
 
7486
7487	switch (flags) {
7488	case ACL_START:
7489	case ACL_START_NO_FLUSH:
7490	case ACL_COMPLETE:
7491		if (conn->rx_skb) {
7492			BT_ERR("Unexpected start frame (len %d)", skb->len);
7493			l2cap_recv_reset(conn);
 
 
7494			l2cap_conn_unreliable(conn, ECOMM);
7495		}
7496
7497		/* Start fragment may not contain the L2CAP length so just
7498		 * copy the initial byte when that happens and use conn->mtu as
7499		 * expected length.
7500		 */
7501		if (skb->len < L2CAP_LEN_SIZE) {
7502			l2cap_recv_frag(conn, skb, conn->mtu);
7503			break;
7504		}
7505
7506		len = get_unaligned_le16(skb->data) + L2CAP_HDR_SIZE;
 
7507
7508		if (len == skb->len) {
7509			/* Complete frame received */
7510			l2cap_recv_frame(conn, skb);
7511			return;
7512		}
7513
7514		BT_DBG("Start: total len %d, frag len %u", len, skb->len);
7515
7516		if (skb->len > len) {
7517			BT_ERR("Frame is too long (len %u, expected len %d)",
7518			       skb->len, len);
7519			l2cap_conn_unreliable(conn, ECOMM);
7520			goto drop;
7521		}
7522
7523		/* Append fragment into frame (with header) */
7524		if (l2cap_recv_frag(conn, skb, len) < 0)
 
7525			goto drop;
7526
7527		break;
7528
7529	case ACL_CONT:
7530		BT_DBG("Cont: frag len %u (expecting %u)", skb->len, conn->rx_len);
 
7531
7532		if (!conn->rx_skb) {
7533			BT_ERR("Unexpected continuation frame (len %d)", skb->len);
7534			l2cap_conn_unreliable(conn, ECOMM);
7535			goto drop;
7536		}
7537
7538		/* Complete the L2CAP length if it has not been read */
7539		if (conn->rx_skb->len < L2CAP_LEN_SIZE) {
7540			if (l2cap_recv_len(conn, skb) < 0) {
7541				l2cap_conn_unreliable(conn, ECOMM);
7542				goto drop;
7543			}
7544
7545			/* Header still could not be read just continue */
7546			if (conn->rx_skb->len < L2CAP_LEN_SIZE)
7547				break;
7548		}
7549
7550		if (skb->len > conn->rx_len) {
7551			BT_ERR("Fragment is too long (len %u, expected %u)",
7552			       skb->len, conn->rx_len);
7553			l2cap_recv_reset(conn);
 
 
7554			l2cap_conn_unreliable(conn, ECOMM);
7555			goto drop;
7556		}
7557
7558		/* Append fragment into frame (with header) */
7559		l2cap_recv_frag(conn, skb, skb->len);
 
7560
7561		if (!conn->rx_len) {
7562			/* Complete frame received. l2cap_recv_frame
7563			 * takes ownership of the skb so set the global
7564			 * rx_skb pointer to NULL first.
7565			 */
7566			struct sk_buff *rx_skb = conn->rx_skb;
7567			conn->rx_skb = NULL;
7568			l2cap_recv_frame(conn, rx_skb);
7569		}
7570		break;
7571	}
7572
7573drop:
7574	kfree_skb(skb);
 
7575}
7576
7577static struct hci_cb l2cap_cb = {
7578	.name		= "L2CAP",
7579	.match		= l2cap_match,
7580	.connect_cfm	= l2cap_connect_cfm,
7581	.disconn_cfm	= l2cap_disconn_cfm,
7582	.security_cfm	= l2cap_security_cfm,
7583};
7584
7585static int l2cap_debugfs_show(struct seq_file *f, void *p)
7586{
7587	struct l2cap_chan *c;
7588
7589	read_lock(&chan_list_lock);
7590
7591	list_for_each_entry(c, &chan_list, global_l) {
7592		seq_printf(f, "%pMR (%u) %pMR (%u) %d %d 0x%4.4x 0x%4.4x %d %d %d %d\n",
7593			   &c->src, c->src_type, &c->dst, c->dst_type,
7594			   c->state, __le16_to_cpu(c->psm),
7595			   c->scid, c->dcid, c->imtu, c->omtu,
7596			   c->sec_level, c->mode);
 
 
 
7597	}
7598
7599	read_unlock(&chan_list_lock);
7600
7601	return 0;
7602}
7603
7604DEFINE_SHOW_ATTRIBUTE(l2cap_debugfs);
 
 
 
 
 
 
 
 
 
 
7605
7606static struct dentry *l2cap_debugfs;
7607
7608int __init l2cap_init(void)
7609{
7610	int err;
7611
7612	err = l2cap_init_sockets();
7613	if (err < 0)
7614		return err;
7615
7616	hci_register_cb(&l2cap_cb);
7617
7618	if (IS_ERR_OR_NULL(bt_debugfs))
7619		return 0;
7620
7621	l2cap_debugfs = debugfs_create_file("l2cap", 0444, bt_debugfs,
7622					    NULL, &l2cap_debugfs_fops);
7623
7624	return 0;
7625}
7626
7627void l2cap_exit(void)
7628{
7629	debugfs_remove(l2cap_debugfs);
7630	hci_unregister_cb(&l2cap_cb);
7631	l2cap_cleanup_sockets();
7632}
7633
7634module_param(disable_ertm, bool, 0644);
7635MODULE_PARM_DESC(disable_ertm, "Disable enhanced retransmission mode");
7636
7637module_param(enable_ecred, bool, 0644);
7638MODULE_PARM_DESC(enable_ecred, "Enable enhanced credit flow control mode");