projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Move identity address update behind a workqueue
[deliverable/linux.git] / net / bluetooth / l2cap_core.c
CommitLineData
8e87d142 1/*
1da177e4
LT		 2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
ce5706bd 4 Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
5d8868ff 5 Copyright (C) 2010 Google Inc.
590051de 6 Copyright (C) 2011 ProFUSION Embedded Systems
422e925b 7 Copyright (c) 2012 Code Aurora Forum. All rights reserved.
1da177e4
LT		 8
9 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
10
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License version 2 as
13 published by the Free Software Foundation;
14
15 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
16 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
18 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 19 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
20 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
21 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 22 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
23
8e87d142
YH		 24 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
25 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 26 SOFTWARE IS DISCLAIMED.
27*/
28
bb58f747 29/* Bluetooth L2CAP core. */
1da177e4 30
1da177e4
LT		 31#include <linux/module.h>
32
aef7d97c 33#include <linux/debugfs.h>
fcc203c3 34#include <linux/crc16.h>
1da177e4
LT		 35
36#include <net/bluetooth/bluetooth.h>
37#include <net/bluetooth/hci_core.h>
38#include <net/bluetooth/l2cap.h>
7ef9fbf0 39
ac4b7236 40#include "smp.h"
7024728e 41#include "a2mp.h"
7ef9fbf0 42#include "amp.h"
1da177e4 43
0f1bfe4e
JH		 44#define LE_FLOWCTL_MAX_CREDITS 65535
45
d1de6d46 46bool disable_ertm;
f0709e03 47
547d1032 48static u32 l2cap_feat_mask = L2CAP_FEAT_FIXED_CHAN | L2CAP_FEAT_UCD;
a6801ca9 49static u8 l2cap_fixed_chan[8] = { L2CAP_FC_SIG_BREDR | L2CAP_FC_CONNLESS, };
1da177e4 50
b5ad8b7f
JB		 51static LIST_HEAD(chan_list);
52static DEFINE_RWLOCK(chan_list_lock);
1da177e4 53
f15b8ecf
JH		 54static u16 le_max_credits = L2CAP_LE_MAX_CREDITS;
55static u16 le_default_mps = L2CAP_LE_DEFAULT_MPS;
56
1da177e4 57static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
2d792818 58 u8 code, u8 ident, u16 dlen, void *data);
4519de9a 59static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
2d792818 60 void *data);
710f9b0a 61static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data);
5e4e3972 62static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err);
1da177e4 63
d660366d 64static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
2d792818 65 struct sk_buff_head *skbs, u8 event);
608bcc6d 66
4f1654e0
MH		 67static inline __u8 bdaddr_type(struct hci_conn *hcon, __u8 type)
68{
69 if (hcon->type == LE_LINK) {
70 if (type == ADDR_LE_DEV_PUBLIC)
71 return BDADDR_LE_PUBLIC;
72 else
73 return BDADDR_LE_RANDOM;
74 }
75
76 return BDADDR_BREDR;
77}
78
0139418c 79/* ---- L2CAP channels ---- */
71ba0e56 80
2d792818
GP		 81static struct l2cap_chan *__l2cap_get_chan_by_dcid(struct l2cap_conn *conn,
82 u16 cid)
0139418c 83{
3df91ea2 84 struct l2cap_chan *c;
3d57dc68 85
3df91ea2
AE		 86 list_for_each_entry(c, &conn->chan_l, list) {
87 if (c->dcid == cid)
88 return c;
0139418c 89 }
3df91ea2 90 return NULL;
0139418c
MH		 91}
92
2d792818
GP		 93static struct l2cap_chan *__l2cap_get_chan_by_scid(struct l2cap_conn *conn,
94 u16 cid)
0139418c 95{
3df91ea2 96 struct l2cap_chan *c;
3d57dc68 97
3df91ea2
AE		 98 list_for_each_entry(c, &conn->chan_l, list) {
99 if (c->scid == cid)
100 return c;
0139418c 101 }
3df91ea2 102 return NULL;
0139418c
MH		 103}
104
105/* Find channel with given SCID.
ef191ade 106 * Returns locked channel. */
2d792818
GP		 107static struct l2cap_chan *l2cap_get_chan_by_scid(struct l2cap_conn *conn,
108 u16 cid)
0139418c 109{
48454079 110 struct l2cap_chan *c;
baa7e1fa 111
3df91ea2 112 mutex_lock(&conn->chan_lock);
baa7e1fa 113 c = __l2cap_get_chan_by_scid(conn, cid);
ef191ade
MM		 114 if (c)
115 l2cap_chan_lock(c);
3df91ea2
AE		 116 mutex_unlock(&conn->chan_lock);
117
48454079 118 return c;
0139418c
MH		 119}
120
b1a130b7
MM		 121/* Find channel with given DCID.
122 * Returns locked channel.
123 */
124static struct l2cap_chan *l2cap_get_chan_by_dcid(struct l2cap_conn *conn,
125 u16 cid)
126{
127 struct l2cap_chan *c;
128
129 mutex_lock(&conn->chan_lock);
130 c = __l2cap_get_chan_by_dcid(conn, cid);
131 if (c)
132 l2cap_chan_lock(c);
133 mutex_unlock(&conn->chan_lock);
134
135 return c;
136}
137
2d792818
GP		 138static struct l2cap_chan *__l2cap_get_chan_by_ident(struct l2cap_conn *conn,
139 u8 ident)
0139418c 140{
3df91ea2 141 struct l2cap_chan *c;
3d57dc68 142
3df91ea2
AE		 143 list_for_each_entry(c, &conn->chan_l, list) {
144 if (c->ident == ident)
145 return c;
0139418c 146 }
3df91ea2 147 return NULL;
0139418c
MH		 148}
149
5b155ef9
MM		 150static struct l2cap_chan *l2cap_get_chan_by_ident(struct l2cap_conn *conn,
151 u8 ident)
152{
153 struct l2cap_chan *c;
154
155 mutex_lock(&conn->chan_lock);
156 c = __l2cap_get_chan_by_ident(conn, ident);
157 if (c)
158 l2cap_chan_lock(c);
159 mutex_unlock(&conn->chan_lock);
160
161 return c;
162}
163
23691d75 164static struct l2cap_chan *__l2cap_global_chan_by_addr(__le16 psm, bdaddr_t *src)
9e4425ff 165{
23691d75 166 struct l2cap_chan *c;
9e4425ff 167
23691d75 168 list_for_each_entry(c, &chan_list, global_l) {
7eafc59e 169 if (c->sport == psm && !bacmp(&c->src, src))
250938cb 170 return c;
9e4425ff 171 }
250938cb 172 return NULL;
9e4425ff
GP		 173}
174
175int l2cap_add_psm(struct l2cap_chan *chan, bdaddr_t *src, __le16 psm)
176{
73b2ec18
GP		 177 int err;
178
333055f2 179 write_lock(&chan_list_lock);
9e4425ff 180
23691d75 181 if (psm && __l2cap_global_chan_by_addr(psm, src)) {
73b2ec18
GP		 182 err = -EADDRINUSE;
183 goto done;
9e4425ff
GP		 184 }
185
73b2ec18
GP		 186 if (psm) {
187 chan->psm = psm;
188 chan->sport = psm;
189 err = 0;
190 } else {
191 u16 p;
192
193 err = -EINVAL;
194 for (p = 0x1001; p < 0x1100; p += 2)
23691d75 195 if (!__l2cap_global_chan_by_addr(cpu_to_le16(p), src)) {
73b2ec18
GP		 196 chan->psm = cpu_to_le16(p);
197 chan->sport = cpu_to_le16(p);
198 err = 0;
199 break;
200 }
201 }
9e4425ff 202
73b2ec18 203done:
333055f2 204 write_unlock(&chan_list_lock);
73b2ec18 205 return err;
9e4425ff 206}
6b8d4a6a 207EXPORT_SYMBOL_GPL(l2cap_add_psm);
9e4425ff
GP		 208
209int l2cap_add_scid(struct l2cap_chan *chan, __u16 scid)
210{
333055f2 211 write_lock(&chan_list_lock);
9e4425ff 212
14824308
JH		 213 /* Override the defaults (which are for conn-oriented) */
214 chan->omtu = L2CAP_DEFAULT_MTU;
215 chan->chan_type = L2CAP_CHAN_FIXED;
216
9e4425ff
GP		 217 chan->scid = scid;
218
333055f2 219 write_unlock(&chan_list_lock);
9e4425ff
GP		 220
221 return 0;
222}
223
baa7e1fa 224static u16 l2cap_alloc_cid(struct l2cap_conn *conn)
0139418c 225{
e77af755 226 u16 cid, dyn_end;
0139418c 227
e77af755
JH		 228 if (conn->hcon->type == LE_LINK)
229 dyn_end = L2CAP_CID_LE_DYN_END;
230 else
231 dyn_end = L2CAP_CID_DYN_END;
232
233 for (cid = L2CAP_CID_DYN_START; cid < dyn_end; cid++) {
baa7e1fa 234 if (!__l2cap_get_chan_by_scid(conn, cid))
0139418c
MH		 235 return cid;
236 }
237
238 return 0;
239}
240
f93fa273 241static void l2cap_state_change(struct l2cap_chan *chan, int state)
89bc500e 242{
42d2d87c 243 BT_DBG("chan %p %s -> %s", chan, state_to_string(chan->state),
2d792818 244 state_to_string(state));
badaaa00 245
89bc500e 246 chan->state = state;
53f52121 247 chan->ops->state_change(chan, state, 0);
89bc500e
GP		 248}
249
f8e73017
GP		 250static inline void l2cap_state_change_and_error(struct l2cap_chan *chan,
251 int state, int err)
2e0052e4 252{
f8e73017 253 chan->state = state;
53f52121 254 chan->ops->state_change(chan, chan->state, err);
2e0052e4
AE		 255}
256
257static inline void l2cap_chan_set_err(struct l2cap_chan *chan, int err)
258{
f8e73017 259 chan->ops->state_change(chan, chan->state, err);
2e0052e4
AE		 260}
261
4239d16f
MM		 262static void __set_retrans_timer(struct l2cap_chan *chan)
263{
264 if (!delayed_work_pending(&chan->monitor_timer) &&
265 chan->retrans_timeout) {
266 l2cap_set_timer(chan, &chan->retrans_timer,
267 msecs_to_jiffies(chan->retrans_timeout));
268 }
269}
270
271static void __set_monitor_timer(struct l2cap_chan *chan)
272{
273 __clear_retrans_timer(chan);
274 if (chan->monitor_timeout) {
275 l2cap_set_timer(chan, &chan->monitor_timer,
276 msecs_to_jiffies(chan->monitor_timeout));
277 }
278}
279
608bcc6d
MM		 280static struct sk_buff *l2cap_ertm_seq_in_queue(struct sk_buff_head *head,
281 u16 seq)
282{
283 struct sk_buff *skb;
284
285 skb_queue_walk(head, skb) {
286 if (bt_cb(skb)->control.txseq == seq)
287 return skb;
288 }
289
290 return NULL;
291}
292
3c588192
MM		 293/* ---- L2CAP sequence number lists ---- */
294
295/* For ERTM, ordered lists of sequence numbers must be tracked for
296 * SREJ requests that are received and for frames that are to be
297 * retransmitted. These seq_list functions implement a singly-linked
298 * list in an array, where membership in the list can also be checked
299 * in constant time. Items can also be added to the tail of the list
300 * and removed from the head in constant time, without further memory
301 * allocs or frees.
302 */
303
304static int l2cap_seq_list_init(struct l2cap_seq_list *seq_list, u16 size)
305{
306 size_t alloc_size, i;
307
308 /* Allocated size is a power of 2 to map sequence numbers
309 * (which may be up to 14 bits) in to a smaller array that is
310 * sized for the negotiated ERTM transmit windows.
311 */
312 alloc_size = roundup_pow_of_two(size);
313
314 seq_list->list = kmalloc(sizeof(u16) * alloc_size, GFP_KERNEL);
315 if (!seq_list->list)
316 return -ENOMEM;
317
318 seq_list->mask = alloc_size - 1;
319 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
320 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
321 for (i = 0; i < alloc_size; i++)
322 seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR;
323
324 return 0;
325}
326
327static inline void l2cap_seq_list_free(struct l2cap_seq_list *seq_list)
328{
329 kfree(seq_list->list);
330}
331
332static inline bool l2cap_seq_list_contains(struct l2cap_seq_list *seq_list,
333 u16 seq)
334{
335 /* Constant-time check for list membership */
336 return seq_list->list[seq & seq_list->mask] != L2CAP_SEQ_LIST_CLEAR;
337}
338
03a0c5d6 339static inline u16 l2cap_seq_list_pop(struct l2cap_seq_list *seq_list)
3c588192 340{
03a0c5d6 341 u16 seq = seq_list->head;
3c588192
MM		 342 u16 mask = seq_list->mask;
343
03a0c5d6
JH		 344 seq_list->head = seq_list->list[seq & mask];
345 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_CLEAR;
346
347 if (seq_list->head == L2CAP_SEQ_LIST_TAIL) {
348 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
349 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
3c588192 350 }
3c588192 351
03a0c5d6 352 return seq;
3c588192
MM		 353}
354
355static void l2cap_seq_list_clear(struct l2cap_seq_list *seq_list)
356{
f522ae36 357 u16 i;
3c588192 358
f522ae36
GP		 359 if (seq_list->head == L2CAP_SEQ_LIST_CLEAR)
360 return;
361
362 for (i = 0; i <= seq_list->mask; i++)
363 seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR;
364
365 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
366 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
3c588192
MM		 367}
368
369static void l2cap_seq_list_append(struct l2cap_seq_list *seq_list, u16 seq)
370{
371 u16 mask = seq_list->mask;
372
373 /* All appends happen in constant time */
374
f522ae36
GP		 375 if (seq_list->list[seq & mask] != L2CAP_SEQ_LIST_CLEAR)
376 return;
3c588192 377
f522ae36
GP		 378 if (seq_list->tail == L2CAP_SEQ_LIST_CLEAR)
379 seq_list->head = seq;
380 else
381 seq_list->list[seq_list->tail & mask] = seq;
382
383 seq_list->tail = seq;
384 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_TAIL;
3c588192
MM		 385}
386
721c4181 387static void l2cap_chan_timeout(struct work_struct *work)
ab07801d 388{
721c4181 389 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
2d792818 390 chan_timer.work);
3df91ea2 391 struct l2cap_conn *conn = chan->conn;
ab07801d
GP		 392 int reason;
393
e05dcc32 394 BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
ab07801d 395
3df91ea2 396 mutex_lock(&conn->chan_lock);
6be36555 397 l2cap_chan_lock(chan);
ab07801d 398
89bc500e 399 if (chan->state == BT_CONNECTED || chan->state == BT_CONFIG)
ab07801d 400 reason = ECONNREFUSED;
89bc500e 401 else if (chan->state == BT_CONNECT &&
2d792818 402 chan->sec_level != BT_SECURITY_SDP)
ab07801d
GP		 403 reason = ECONNREFUSED;
404 else
405 reason = ETIMEDOUT;
406
0f852724 407 l2cap_chan_close(chan, reason);
ab07801d 408
6be36555 409 l2cap_chan_unlock(chan);
ab07801d 410
80b98027 411 chan->ops->close(chan);
3df91ea2
AE		 412 mutex_unlock(&conn->chan_lock);
413
371fd835 414 l2cap_chan_put(chan);
ab07801d
GP		 415}
416
eef1d9b6 417struct l2cap_chan *l2cap_chan_create(void)
48454079
GP		 418{
419 struct l2cap_chan *chan;
420
421 chan = kzalloc(sizeof(*chan), GFP_ATOMIC);
422 if (!chan)
423 return NULL;
424
c03b355e
AE		 425 mutex_init(&chan->lock);
426
333055f2 427 write_lock(&chan_list_lock);
23691d75 428 list_add(&chan->global_l, &chan_list);
333055f2 429 write_unlock(&chan_list_lock);
23691d75 430
721c4181 431 INIT_DELAYED_WORK(&chan->chan_timer, l2cap_chan_timeout);
ab07801d 432
89bc500e
GP		 433 chan->state = BT_OPEN;
434
144ad330 435 kref_init(&chan->kref);
71ba0e56 436
2827011f
MM		 437 /* This flag is cleared in l2cap_chan_ready() */
438 set_bit(CONF_NOT_COMPLETE, &chan->conf_state);
439
eef1d9b6 440 BT_DBG("chan %p", chan);
abc545b8 441
48454079
GP		 442 return chan;
443}
6b8d4a6a 444EXPORT_SYMBOL_GPL(l2cap_chan_create);
48454079 445
144ad330 446static void l2cap_chan_destroy(struct kref *kref)
6ff5abbf 447{
144ad330
SS		 448 struct l2cap_chan *chan = container_of(kref, struct l2cap_chan, kref);
449
4af66c69
JK		 450 BT_DBG("chan %p", chan);
451
333055f2 452 write_lock(&chan_list_lock);
23691d75 453 list_del(&chan->global_l);
333055f2 454 write_unlock(&chan_list_lock);
23691d75 455
4af66c69 456 kfree(chan);
6ff5abbf
GP		 457}
458
30648372
JK		 459void l2cap_chan_hold(struct l2cap_chan *c)
460{
144ad330 461 BT_DBG("chan %p orig refcnt %d", c, atomic_read(&c->kref.refcount));
30648372 462
144ad330 463 kref_get(&c->kref);
30648372
JK		 464}
465
466void l2cap_chan_put(struct l2cap_chan *c)
467{
144ad330 468 BT_DBG("chan %p orig refcnt %d", c, atomic_read(&c->kref.refcount));
30648372 469
144ad330 470 kref_put(&c->kref, l2cap_chan_destroy);
30648372 471}
6b8d4a6a 472EXPORT_SYMBOL_GPL(l2cap_chan_put);
30648372 473
bd4b1653
AE		 474void l2cap_chan_set_defaults(struct l2cap_chan *chan)
475{
476 chan->fcs = L2CAP_FCS_CRC16;
477 chan->max_tx = L2CAP_DEFAULT_MAX_TX;
478 chan->tx_win = L2CAP_DEFAULT_TX_WINDOW;
479 chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
6a5e8165
JR		 480 chan->remote_max_tx = chan->max_tx;
481 chan->remote_tx_win = chan->tx_win;
c20f8e35 482 chan->ack_win = L2CAP_DEFAULT_TX_WINDOW;
bd4b1653 483 chan->sec_level = BT_SECURITY_LOW;
6a5e8165
JR		 484 chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
485 chan->retrans_timeout = L2CAP_DEFAULT_RETRANS_TO;
486 chan->monitor_timeout = L2CAP_DEFAULT_MONITOR_TO;
487 chan->conf_state = 0;
bd4b1653
AE		 488
489 set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
490}
6b8d4a6a 491EXPORT_SYMBOL_GPL(l2cap_chan_set_defaults);
bd4b1653 492
0ce43ce6 493static void l2cap_le_flowctl_init(struct l2cap_chan *chan)
38319713 494{
0ce43ce6
JH		 495 chan->sdu = NULL;
496 chan->sdu_last_frag = NULL;
497 chan->sdu_len = 0;
0cd75f7e 498 chan->tx_credits = 0;
f15b8ecf 499 chan->rx_credits = le_max_credits;
d1d79413 500 chan->mps = min_t(u16, chan->imtu, le_default_mps);
0ce43ce6
JH		 501
502 skb_queue_head_init(&chan->tx_q);
38319713
JH		 503}
504
93c3e8f5 505void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
0139418c 506{
af05b30b 507 BT_DBG("conn %p, psm 0x%2.2x, dcid 0x%4.4x", conn,
097db76c 508 __le16_to_cpu(chan->psm), chan->dcid);
0139418c 509
9f5a0d7b 510 conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
2950f21a 511
8c1d787b 512 chan->conn = conn;
0139418c 513
5491120e
AE		 514 switch (chan->chan_type) {
515 case L2CAP_CHAN_CONN_ORIENTED:
21626e62
JH		 516 /* Alloc CID for connection-oriented socket */
517 chan->scid = l2cap_alloc_cid(conn);
518 if (conn->hcon->type == ACL_LINK)
0c1bc5c6 519 chan->omtu = L2CAP_DEFAULT_MTU;
5491120e
AE		 520 break;
521
522 case L2CAP_CHAN_CONN_LESS:
0139418c 523 /* Connectionless socket */
fe4128e0
GP		 524 chan->scid = L2CAP_CID_CONN_LESS;
525 chan->dcid = L2CAP_CID_CONN_LESS;
0c1bc5c6 526 chan->omtu = L2CAP_DEFAULT_MTU;
5491120e
AE		 527 break;
528
2338a7e0
JH		 529 case L2CAP_CHAN_FIXED:
530 /* Caller will set CID and CID specific MTU values */
416fa752
AE		 531 break;
532
5491120e 533 default:
0139418c 534 /* Raw socket can send/recv signalling messages only */
fe4128e0
GP		 535 chan->scid = L2CAP_CID_SIGNALING;
536 chan->dcid = L2CAP_CID_SIGNALING;
0c1bc5c6 537 chan->omtu = L2CAP_DEFAULT_MTU;
0139418c
MH		 538 }
539
8f7975b1
AE		 540 chan->local_id = L2CAP_BESTEFFORT_ID;
541 chan->local_stype = L2CAP_SERV_BESTEFFORT;
542 chan->local_msdu = L2CAP_DEFAULT_MAX_SDU_SIZE;
543 chan->local_sdu_itime = L2CAP_DEFAULT_SDU_ITIME;
544 chan->local_acc_lat = L2CAP_DEFAULT_ACC_LAT;
8936fa6d 545 chan->local_flush_to = L2CAP_EFS_DEFAULT_FLUSH_TO;
8f7975b1 546
371fd835 547 l2cap_chan_hold(chan);
baa7e1fa 548
c16900cf
JH		 549 /* Only keep a reference for fixed channels if they requested it */
550 if (chan->chan_type != L2CAP_CHAN_FIXED ||
551 test_bit(FLAG_HOLD_HCI_CONN, &chan->flags))
552 hci_conn_hold(conn->hcon);
5ee9891d 553
3df91ea2 554 list_add(&chan->list, &conn->chan_l);
643162a8
AE		 555}
556
466f8004 557void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
643162a8
AE		 558{
559 mutex_lock(&conn->chan_lock);
560 __l2cap_chan_add(conn, chan);
3df91ea2 561 mutex_unlock(&conn->chan_lock);
0139418c
MH		 562}
563
466f8004 564void l2cap_chan_del(struct l2cap_chan *chan, int err)
0139418c 565{
8c1d787b 566 struct l2cap_conn *conn = chan->conn;
0139418c 567
c9b66675 568 __clear_chan_timer(chan);
0139418c 569
49208c9c 570 BT_DBG("chan %p, conn %p, err %d", chan, conn, err);
0139418c 571
72847ce0
JH		 572 chan->ops->teardown(chan, err);
573
8e87d142 574 if (conn) {
56f60984 575 struct amp_mgr *mgr = conn->hcon->amp_mgr;
baa7e1fa 576 /* Delete from channel list */
3df91ea2 577 list_del(&chan->list);
3d57dc68 578
371fd835 579 l2cap_chan_put(chan);
baa7e1fa 580
8c1d787b 581 chan->conn = NULL;
3cabbfda 582
c16900cf
JH		 583 /* Reference was only held for non-fixed channels or
584 * fixed channels that explicitly requested it using the
585 * FLAG_HOLD_HCI_CONN flag.
586 */
587 if (chan->chan_type != L2CAP_CHAN_FIXED ||
588 test_bit(FLAG_HOLD_HCI_CONN, &chan->flags))
76a68ba0 589 hci_conn_drop(conn->hcon);
56f60984
AE		 590
591 if (mgr && mgr->bredr_chan == chan)
592 mgr->bredr_chan = NULL;
0139418c
MH		 593 }
594
419e08c1
AE		 595 if (chan->hs_hchan) {
596 struct hci_chan *hs_hchan = chan->hs_hchan;
597
598 BT_DBG("chan %p disconnect hs_hchan %p", chan, hs_hchan);
599 amp_disconnect_logical_link(hs_hchan);
600 }
601
2827011f 602 if (test_bit(CONF_NOT_COMPLETE, &chan->conf_state))
6ff5abbf 603 return;
2ead70b8 604
ee556f66
GP		 605 switch(chan->mode) {
606 case L2CAP_MODE_BASIC:
607 break;
c13ffa62 608
38319713 609 case L2CAP_MODE_LE_FLOWCTL:
177f8f2b 610 skb_queue_purge(&chan->tx_q);
38319713
JH		 611 break;
612
ee556f66 613 case L2CAP_MODE_ERTM:
1a09bcb9
GP		 614 __clear_retrans_timer(chan);
615 __clear_monitor_timer(chan);
616 __clear_ack_timer(chan);
c13ffa62 617
f1c6775b 618 skb_queue_purge(&chan->srej_q);
c13ffa62 619
3c588192
MM		 620 l2cap_seq_list_free(&chan->srej_list);
621 l2cap_seq_list_free(&chan->retrans_list);
ee556f66
GP		 622
623 /* fall through */
624
625 case L2CAP_MODE_STREAMING:
626 skb_queue_purge(&chan->tx_q);
627 break;
c13ffa62 628 }
ee556f66
GP		 629
630 return;
0139418c 631}
6b8d4a6a 632EXPORT_SYMBOL_GPL(l2cap_chan_del);
0139418c 633
f3d82d0c 634static void l2cap_conn_update_id_addr(struct work_struct *work)
387a33e3 635{
f3d82d0c
JH		 636 struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
637 id_addr_update_work);
638 struct hci_conn *hcon = conn->hcon;
387a33e3
JH		 639 struct l2cap_chan *chan;
640
641 mutex_lock(&conn->chan_lock);
642
643 list_for_each_entry(chan, &conn->chan_l, list) {
644 l2cap_chan_lock(chan);
645 bacpy(&chan->dst, &hcon->dst);
646 chan->dst_type = bdaddr_type(hcon, hcon->dst_type);
647 l2cap_chan_unlock(chan);
648 }
649
650 mutex_unlock(&conn->chan_lock);
651}
652
27e2d4c8
JH		 653static void l2cap_chan_le_connect_reject(struct l2cap_chan *chan)
654{
655 struct l2cap_conn *conn = chan->conn;
656 struct l2cap_le_conn_rsp rsp;
657 u16 result;
658
659 if (test_bit(FLAG_DEFER_SETUP, &chan->flags))
660 result = L2CAP_CR_AUTHORIZATION;
661 else
662 result = L2CAP_CR_BAD_PSM;
663
664 l2cap_state_change(chan, BT_DISCONN);
665
666 rsp.dcid = cpu_to_le16(chan->scid);
667 rsp.mtu = cpu_to_le16(chan->imtu);
3916aed8 668 rsp.mps = cpu_to_le16(chan->mps);
0cd75f7e 669 rsp.credits = cpu_to_le16(chan->rx_credits);
27e2d4c8
JH		 670 rsp.result = cpu_to_le16(result);
671
672 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp),
673 &rsp);
674}
675
791d60f7
JH		 676static void l2cap_chan_connect_reject(struct l2cap_chan *chan)
677{
678 struct l2cap_conn *conn = chan->conn;
679 struct l2cap_conn_rsp rsp;
680 u16 result;
681
682 if (test_bit(FLAG_DEFER_SETUP, &chan->flags))
683 result = L2CAP_CR_SEC_BLOCK;
684 else
685 result = L2CAP_CR_BAD_PSM;
686
687 l2cap_state_change(chan, BT_DISCONN);
688
689 rsp.scid = cpu_to_le16(chan->dcid);
690 rsp.dcid = cpu_to_le16(chan->scid);
691 rsp.result = cpu_to_le16(result);
dcf4adbf 692 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
791d60f7
JH		 693
694 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP, sizeof(rsp), &rsp);
695}
696
0f852724 697void l2cap_chan_close(struct l2cap_chan *chan, int reason)
4519de9a
GP		 698{
699 struct l2cap_conn *conn = chan->conn;
4519de9a 700
7eafc59e 701 BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
4519de9a 702
89bc500e 703 switch (chan->state) {
4519de9a 704 case BT_LISTEN:
b699ec0d 705 chan->ops->teardown(chan, 0);
4519de9a
GP		 706 break;
707
708 case BT_CONNECTED:
709 case BT_CONFIG:
7b25c9b3 710 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED) {
8d836d71 711 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
5e4e3972 712 l2cap_send_disconn_req(chan, reason);
4519de9a
GP		 713 } else
714 l2cap_chan_del(chan, reason);
715 break;
716
717 case BT_CONNECT2:
791d60f7
JH		 718 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED) {
719 if (conn->hcon->type == ACL_LINK)
720 l2cap_chan_connect_reject(chan);
27e2d4c8
JH		 721 else if (conn->hcon->type == LE_LINK)
722 l2cap_chan_le_connect_reject(chan);
4519de9a
GP		 723 }
724
725 l2cap_chan_del(chan, reason);
726 break;
727
728 case BT_CONNECT:
729 case BT_DISCONN:
730 l2cap_chan_del(chan, reason);
731 break;
732
733 default:
b699ec0d 734 chan->ops->teardown(chan, 0);
4519de9a
GP		 735 break;
736 }
737}
6b8d4a6a 738EXPORT_SYMBOL(l2cap_chan_close);
4519de9a 739
4343478f 740static inline u8 l2cap_get_auth_type(struct l2cap_chan *chan)
79d554a6 741{
6a974b50
MH		 742 switch (chan->chan_type) {
743 case L2CAP_CHAN_RAW:
4343478f 744 switch (chan->sec_level) {
8556edd3 745 case BT_SECURITY_HIGH:
7d513e92 746 case BT_SECURITY_FIPS:
8556edd3
JH		 747 return HCI_AT_DEDICATED_BONDING_MITM;
748 case BT_SECURITY_MEDIUM:
749 return HCI_AT_DEDICATED_BONDING;
750 default:
751 return HCI_AT_NO_BONDING;
752 }
6a974b50 753 break;
3124b843 754 case L2CAP_CHAN_CONN_LESS:
dcf4adbf 755 if (chan->psm == cpu_to_le16(L2CAP_PSM_3DSP)) {
3124b843
MH		 756 if (chan->sec_level == BT_SECURITY_LOW)
757 chan->sec_level = BT_SECURITY_SDP;
758 }
7d513e92
MH		 759 if (chan->sec_level == BT_SECURITY_HIGH ||
760 chan->sec_level == BT_SECURITY_FIPS)
3124b843
MH		 761 return HCI_AT_NO_BONDING_MITM;
762 else
763 return HCI_AT_NO_BONDING;
764 break;
6a974b50 765 case L2CAP_CHAN_CONN_ORIENTED:
dcf4adbf 766 if (chan->psm == cpu_to_le16(L2CAP_PSM_SDP)) {
6a974b50
MH		 767 if (chan->sec_level == BT_SECURITY_LOW)
768 chan->sec_level = BT_SECURITY_SDP;
0684e5f9 769
7d513e92
MH		 770 if (chan->sec_level == BT_SECURITY_HIGH ||
771 chan->sec_level == BT_SECURITY_FIPS)
6a974b50
MH		 772 return HCI_AT_NO_BONDING_MITM;
773 else
774 return HCI_AT_NO_BONDING;
775 }
776 /* fall through */
777 default:
4343478f 778 switch (chan->sec_level) {
00ae4af9 779 case BT_SECURITY_HIGH:
7d513e92 780 case BT_SECURITY_FIPS:
8556edd3 781 return HCI_AT_GENERAL_BONDING_MITM;
00ae4af9 782 case BT_SECURITY_MEDIUM:
8556edd3 783 return HCI_AT_GENERAL_BONDING;
00ae4af9 784 default:
8556edd3 785 return HCI_AT_NO_BONDING;
00ae4af9 786 }
6a974b50 787 break;
0684e5f9 788 }
8556edd3
JH		 789}
790
791/* Service level security */
e7cafc45 792int l2cap_chan_check_security(struct l2cap_chan *chan, bool initiator)
8556edd3 793{
8c1d787b 794 struct l2cap_conn *conn = chan->conn;
8556edd3
JH		 795 __u8 auth_type;
796
a17de2fe
JH		 797 if (conn->hcon->type == LE_LINK)
798 return smp_conn_security(conn->hcon, chan->sec_level);
799
4343478f 800 auth_type = l2cap_get_auth_type(chan);
79d554a6 801
e7cafc45
JH		 802 return hci_conn_security(conn->hcon, chan->sec_level, auth_type,
803 initiator);
79d554a6
MH		 804}
805
b5ad8b7f 806static u8 l2cap_get_ident(struct l2cap_conn *conn)
4e8402a3
MH		 807{
808 u8 id;
809
810 /* Get next available identificator.
811 * 1 - 128 are used by kernel.
812 * 129 - 199 are reserved.
813 * 200 - 254 are used by utilities like l2ping, etc.
814 */
815
5a54e7c8 816 mutex_lock(&conn->ident_lock);
4e8402a3
MH		 817
818 if (++conn->tx_ident > 128)
819 conn->tx_ident = 1;
820
821 id = conn->tx_ident;
822
5a54e7c8 823 mutex_unlock(&conn->ident_lock);
4e8402a3
MH		 824
825 return id;
826}
827
2d792818
GP		 828static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
829 void *data)
4e8402a3
MH		 830{
831 struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data);
e702112f 832 u8 flags;
4e8402a3
MH		 833
834 BT_DBG("code 0x%2.2x", code);
835
836 if (!skb)
9a9c6a34 837 return;
4e8402a3 838
e702112f
AE		 839 if (lmp_no_flush_capable(conn->hcon->hdev))
840 flags = ACL_START_NO_FLUSH;
841 else
842 flags = ACL_START;
843
14b12d0b 844 bt_cb(skb)->force_active = BT_POWER_FORCE_ACTIVE_ON;
5e59b791 845 skb->priority = HCI_PRIO_MAX;
14b12d0b 846
73d80deb
LAD		 847 hci_send_acl(conn->hchan, skb, flags);
848}
849
02b0fbb9
MM		 850static bool __chan_is_moving(struct l2cap_chan *chan)
851{
852 return chan->move_state != L2CAP_MOVE_STABLE &&
853 chan->move_state != L2CAP_MOVE_WAIT_PREPARE;
854}
855
73d80deb
LAD		 856static void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb)
857{
858 struct hci_conn *hcon = chan->conn->hcon;
859 u16 flags;
860
861 BT_DBG("chan %p, skb %p len %d priority %u", chan, skb, skb->len,
2d792818 862 skb->priority);
73d80deb 863
d5f8a75d
MM		 864 if (chan->hs_hcon && !__chan_is_moving(chan)) {
865 if (chan->hs_hchan)
866 hci_send_acl(chan->hs_hchan, skb, ACL_COMPLETE);
867 else
868 kfree_skb(skb);
869
870 return;
871 }
872
73d80deb 873 if (!test_bit(FLAG_FLUSHABLE, &chan->flags) &&
2d792818 874 lmp_no_flush_capable(hcon->hdev))
73d80deb
LAD		 875 flags = ACL_START_NO_FLUSH;
876 else
877 flags = ACL_START;
14b12d0b 878
73d80deb
LAD		 879 bt_cb(skb)->force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
880 hci_send_acl(chan->conn->hchan, skb, flags);
4e8402a3
MH		 881}
882
b76bbd66
MM		 883static void __unpack_enhanced_control(u16 enh, struct l2cap_ctrl *control)
884{
885 control->reqseq = (enh & L2CAP_CTRL_REQSEQ) >> L2CAP_CTRL_REQSEQ_SHIFT;
886 control->final = (enh & L2CAP_CTRL_FINAL) >> L2CAP_CTRL_FINAL_SHIFT;
887
888 if (enh & L2CAP_CTRL_FRAME_TYPE) {
889 /* S-Frame */
890 control->sframe = 1;
891 control->poll = (enh & L2CAP_CTRL_POLL) >> L2CAP_CTRL_POLL_SHIFT;
892 control->super = (enh & L2CAP_CTRL_SUPERVISE) >> L2CAP_CTRL_SUPER_SHIFT;
893
894 control->sar = 0;
895 control->txseq = 0;
896 } else {
897 /* I-Frame */
898 control->sframe = 0;
899 control->sar = (enh & L2CAP_CTRL_SAR) >> L2CAP_CTRL_SAR_SHIFT;
900 control->txseq = (enh & L2CAP_CTRL_TXSEQ) >> L2CAP_CTRL_TXSEQ_SHIFT;
901
902 control->poll = 0;
903 control->super = 0;
904 }
905}
906
b76bbd66
MM		 907static void __unpack_extended_control(u32 ext, struct l2cap_ctrl *control)
908{
909 control->reqseq = (ext & L2CAP_EXT_CTRL_REQSEQ) >> L2CAP_EXT_CTRL_REQSEQ_SHIFT;
910 control->final = (ext & L2CAP_EXT_CTRL_FINAL) >> L2CAP_EXT_CTRL_FINAL_SHIFT;
911
912 if (ext & L2CAP_EXT_CTRL_FRAME_TYPE) {
913 /* S-Frame */
914 control->sframe = 1;
915 control->poll = (ext & L2CAP_EXT_CTRL_POLL) >> L2CAP_EXT_CTRL_POLL_SHIFT;
916 control->super = (ext & L2CAP_EXT_CTRL_SUPERVISE) >> L2CAP_EXT_CTRL_SUPER_SHIFT;
917
918 control->sar = 0;
919 control->txseq = 0;
920 } else {
921 /* I-Frame */
922 control->sframe = 0;
923 control->sar = (ext & L2CAP_EXT_CTRL_SAR) >> L2CAP_EXT_CTRL_SAR_SHIFT;
924 control->txseq = (ext & L2CAP_EXT_CTRL_TXSEQ) >> L2CAP_EXT_CTRL_TXSEQ_SHIFT;
925
926 control->poll = 0;
927 control->super = 0;
928 }
929}
930
931static inline void __unpack_control(struct l2cap_chan *chan,
932 struct sk_buff *skb)
933{
934 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
935 __unpack_extended_control(get_unaligned_le32(skb->data),
936 &bt_cb(skb)->control);
cec8ab6e 937 skb_pull(skb, L2CAP_EXT_CTRL_SIZE);
b76bbd66
MM		 938 } else {
939 __unpack_enhanced_control(get_unaligned_le16(skb->data),
940 &bt_cb(skb)->control);
cec8ab6e 941 skb_pull(skb, L2CAP_ENH_CTRL_SIZE);
b76bbd66
MM		 942 }
943}
944
b5c6aaed
MM		 945static u32 __pack_extended_control(struct l2cap_ctrl *control)
946{
947 u32 packed;
948
949 packed = control->reqseq << L2CAP_EXT_CTRL_REQSEQ_SHIFT;
950 packed |= control->final << L2CAP_EXT_CTRL_FINAL_SHIFT;
951
952 if (control->sframe) {
953 packed |= control->poll << L2CAP_EXT_CTRL_POLL_SHIFT;
954 packed |= control->super << L2CAP_EXT_CTRL_SUPER_SHIFT;
955 packed |= L2CAP_EXT_CTRL_FRAME_TYPE;
956 } else {
957 packed |= control->sar << L2CAP_EXT_CTRL_SAR_SHIFT;
958 packed |= control->txseq << L2CAP_EXT_CTRL_TXSEQ_SHIFT;
959 }
960
961 return packed;
962}
963
964static u16 __pack_enhanced_control(struct l2cap_ctrl *control)
965{
966 u16 packed;
967
968 packed = control->reqseq << L2CAP_CTRL_REQSEQ_SHIFT;
969 packed |= control->final << L2CAP_CTRL_FINAL_SHIFT;
970
971 if (control->sframe) {
972 packed |= control->poll << L2CAP_CTRL_POLL_SHIFT;
973 packed |= control->super << L2CAP_CTRL_SUPER_SHIFT;
974 packed |= L2CAP_CTRL_FRAME_TYPE;
975 } else {
976 packed |= control->sar << L2CAP_CTRL_SAR_SHIFT;
977 packed |= control->txseq << L2CAP_CTRL_TXSEQ_SHIFT;
978 }
979
980 return packed;
981}
982
b76bbd66
MM		 983static inline void __pack_control(struct l2cap_chan *chan,
984 struct l2cap_ctrl *control,
985 struct sk_buff *skb)
986{
987 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
988 put_unaligned_le32(__pack_extended_control(control),
989 skb->data + L2CAP_HDR_SIZE);
990 } else {
991 put_unaligned_le16(__pack_enhanced_control(control),
992 skb->data + L2CAP_HDR_SIZE);
993 }
994}
995
ba7aa64f
GP		 996static inline unsigned int __ertm_hdr_size(struct l2cap_chan *chan)
997{
998 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
999 return L2CAP_EXT_HDR_SIZE;
1000 else
1001 return L2CAP_ENH_HDR_SIZE;
1002}
1003
a67d7f6f
MM		 1004static struct sk_buff *l2cap_create_sframe_pdu(struct l2cap_chan *chan,
1005 u32 control)
b5c6aaed
MM		 1006{
1007 struct sk_buff *skb;
1008 struct l2cap_hdr *lh;
ba7aa64f 1009 int hlen = __ertm_hdr_size(chan);
b5c6aaed
MM		 1010
1011 if (chan->fcs == L2CAP_FCS_CRC16)
1012 hlen += L2CAP_FCS_SIZE;
1013
a67d7f6f 1014 skb = bt_skb_alloc(hlen, GFP_KERNEL);
b5c6aaed 1015
b5c6aaed 1016 if (!skb)
a67d7f6f 1017 return ERR_PTR(-ENOMEM);
b5c6aaed
MM		 1018
1019 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
1020 lh->len = cpu_to_le16(hlen - L2CAP_HDR_SIZE);
1021 lh->cid = cpu_to_le16(chan->dcid);
1022
a67d7f6f
MM		 1023 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
1024 put_unaligned_le32(control, skb_put(skb, L2CAP_EXT_CTRL_SIZE));
1025 else
1026 put_unaligned_le16(control, skb_put(skb, L2CAP_ENH_CTRL_SIZE));
b5c6aaed
MM		 1027
1028 if (chan->fcs == L2CAP_FCS_CRC16) {
a67d7f6f 1029 u16 fcs = crc16(0, (u8 *)skb->data, skb->len);
b5c6aaed
MM		 1030 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
1031 }
1032
1033 skb->priority = HCI_PRIO_MAX;
a67d7f6f
MM		 1034 return skb;
1035}
1036
1037static void l2cap_send_sframe(struct l2cap_chan *chan,
1038 struct l2cap_ctrl *control)
1039{
1040 struct sk_buff *skb;
1041 u32 control_field;
1042
1043 BT_DBG("chan %p, control %p", chan, control);
1044
1045 if (!control->sframe)
1046 return;
1047
b99e13ad
MM		 1048 if (__chan_is_moving(chan))
1049 return;
1050
a67d7f6f
MM		 1051 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state) &&
1052 !control->poll)
1053 control->final = 1;
1054
1055 if (control->super == L2CAP_SUPER_RR)
1056 clear_bit(CONN_RNR_SENT, &chan->conn_state);
1057 else if (control->super == L2CAP_SUPER_RNR)
1058 set_bit(CONN_RNR_SENT, &chan->conn_state);
1059
1060 if (control->super != L2CAP_SUPER_SREJ) {
1061 chan->last_acked_seq = control->reqseq;
1062 __clear_ack_timer(chan);
1063 }
1064
1065 BT_DBG("reqseq %d, final %d, poll %d, super %d", control->reqseq,
1066 control->final, control->poll, control->super);
1067
1068 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
1069 control_field = __pack_extended_control(control);
1070 else
1071 control_field = __pack_enhanced_control(control);
1072
1073 skb = l2cap_create_sframe_pdu(chan, control_field);
1074 if (!IS_ERR(skb))
1075 l2cap_do_send(chan, skb);
b5c6aaed
MM		 1076}
1077
c9e3d5e0 1078static void l2cap_send_rr_or_rnr(struct l2cap_chan *chan, bool poll)
b5c6aaed 1079{
c9e3d5e0
MM		 1080 struct l2cap_ctrl control;
1081
1082 BT_DBG("chan %p, poll %d", chan, poll);
1083
1084 memset(&control, 0, sizeof(control));
1085 control.sframe = 1;
1086 control.poll = poll;
1087
1088 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state))
1089 control.super = L2CAP_SUPER_RNR;
1090 else
1091 control.super = L2CAP_SUPER_RR;
b5c6aaed 1092
c9e3d5e0
MM		 1093 control.reqseq = chan->buffer_seq;
1094 l2cap_send_sframe(chan, &control);
b5c6aaed
MM		 1095}
1096
b4450035 1097static inline int __l2cap_no_conn_pending(struct l2cap_chan *chan)
e501d055 1098{
5ff6f34d
JH		 1099 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED)
1100 return true;
1101
c1360a1c 1102 return !test_bit(CONF_CONNECT_PEND, &chan->conf_state);
e501d055
AE		 1103}
1104
1df7b17a 1105static bool __amp_capable(struct l2cap_chan *chan)
80d58d0b 1106{
1df7b17a 1107 struct l2cap_conn *conn = chan->conn;
80d58d0b 1108 struct hci_dev *hdev;
1df7b17a
MH		 1109 bool amp_available = false;
1110
1111 if (!conn->hs_enabled)
1112 return false;
1113
1114 if (!(conn->fixed_chan_mask & L2CAP_FC_A2MP))
1115 return false;
80d58d0b
MH		 1116
1117 read_lock(&hci_dev_list_lock);
1df7b17a 1118 list_for_each_entry(hdev, &hci_dev_list, list) {
80d58d0b 1119 if (hdev->amp_type != AMP_TYPE_BREDR &&
1df7b17a
MH		 1120 test_bit(HCI_UP, &hdev->flags)) {
1121 amp_available = true;
1122 break;
1123 }
1124 }
80d58d0b
MH		 1125 read_unlock(&hci_dev_list_lock);
1126
1df7b17a
MH		 1127 if (chan->chan_policy == BT_CHANNEL_POLICY_AMP_PREFERRED)
1128 return amp_available;
848566b3
MH		 1129
1130 return false;
93c3e8f5
AE		 1131}
1132
5ce66b59
AE		 1133static bool l2cap_check_efs(struct l2cap_chan *chan)
1134{
1135 /* Check EFS parameters */
1136 return true;
1137}
1138
2766be48 1139void l2cap_send_conn_req(struct l2cap_chan *chan)
9b27f350
AE		 1140{
1141 struct l2cap_conn *conn = chan->conn;
1142 struct l2cap_conn_req req;
1143
1144 req.scid = cpu_to_le16(chan->scid);
1145 req.psm = chan->psm;
1146
1147 chan->ident = l2cap_get_ident(conn);
1148
1149 set_bit(CONF_CONNECT_PEND, &chan->conf_state);
1150
1151 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ, sizeof(req), &req);
1152}
1153
8eb200bd
MM		 1154static void l2cap_send_create_chan_req(struct l2cap_chan *chan, u8 amp_id)
1155{
1156 struct l2cap_create_chan_req req;
1157 req.scid = cpu_to_le16(chan->scid);
1158 req.psm = chan->psm;
1159 req.amp_id = amp_id;
1160
1161 chan->ident = l2cap_get_ident(chan->conn);
1162
1163 l2cap_send_cmd(chan->conn, chan->ident, L2CAP_CREATE_CHAN_REQ,
1164 sizeof(req), &req);
1165}
1166
02b0fbb9
MM		 1167static void l2cap_move_setup(struct l2cap_chan *chan)
1168{
1169 struct sk_buff *skb;
1170
1171 BT_DBG("chan %p", chan);
1172
1173 if (chan->mode != L2CAP_MODE_ERTM)
1174 return;
1175
1176 __clear_retrans_timer(chan);
1177 __clear_monitor_timer(chan);
1178 __clear_ack_timer(chan);
1179
1180 chan->retry_count = 0;
1181 skb_queue_walk(&chan->tx_q, skb) {
1182 if (bt_cb(skb)->control.retries)
1183 bt_cb(skb)->control.retries = 1;
1184 else
1185 break;
1186 }
1187
1188 chan->expected_tx_seq = chan->buffer_seq;
1189
1190 clear_bit(CONN_REJ_ACT, &chan->conn_state);
1191 clear_bit(CONN_SREJ_ACT, &chan->conn_state);
1192 l2cap_seq_list_clear(&chan->retrans_list);
1193 l2cap_seq_list_clear(&chan->srej_list);
1194 skb_queue_purge(&chan->srej_q);
1195
1196 chan->tx_state = L2CAP_TX_STATE_XMIT;
1197 chan->rx_state = L2CAP_RX_STATE_MOVE;
1198
1199 set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
1200}
1201
5f3847a4
MM		 1202static void l2cap_move_done(struct l2cap_chan *chan)
1203{
1204 u8 move_role = chan->move_role;
1205 BT_DBG("chan %p", chan);
1206
1207 chan->move_state = L2CAP_MOVE_STABLE;
1208 chan->move_role = L2CAP_MOVE_ROLE_NONE;
1209
1210 if (chan->mode != L2CAP_MODE_ERTM)
1211 return;
1212
1213 switch (move_role) {
1214 case L2CAP_MOVE_ROLE_INITIATOR:
1215 l2cap_tx(chan, NULL, NULL, L2CAP_EV_EXPLICIT_POLL);
1216 chan->rx_state = L2CAP_RX_STATE_WAIT_F;
1217 break;
1218 case L2CAP_MOVE_ROLE_RESPONDER:
1219 chan->rx_state = L2CAP_RX_STATE_WAIT_P;
1220 break;
1221 }
1222}
1223
9f0caeb1
VCG		 1224static void l2cap_chan_ready(struct l2cap_chan *chan)
1225{
2827011f 1226 /* This clears all conf flags, including CONF_NOT_COMPLETE */
9f0caeb1
VCG		 1227 chan->conf_state = 0;
1228 __clear_chan_timer(chan);
1229
0ce43ce6
JH		 1230 if (chan->mode == L2CAP_MODE_LE_FLOWCTL && !chan->tx_credits)
1231 chan->ops->suspend(chan);
177f8f2b 1232
54a59aa2 1233 chan->state = BT_CONNECTED;
9f0caeb1 1234
fd83e2c2 1235 chan->ops->ready(chan);
9f0caeb1
VCG		 1236}
1237
f1496dee
JH		 1238static void l2cap_le_connect(struct l2cap_chan *chan)
1239{
1240 struct l2cap_conn *conn = chan->conn;
1241 struct l2cap_le_conn_req req;
1242
595177f3
JH		 1243 if (test_and_set_bit(FLAG_LE_CONN_REQ_SENT, &chan->flags))
1244 return;
1245
f1496dee
JH		 1246 req.psm = chan->psm;
1247 req.scid = cpu_to_le16(chan->scid);
1248 req.mtu = cpu_to_le16(chan->imtu);
3916aed8 1249 req.mps = cpu_to_le16(chan->mps);
0cd75f7e 1250 req.credits = cpu_to_le16(chan->rx_credits);
f1496dee
JH		 1251
1252 chan->ident = l2cap_get_ident(conn);
1253
1254 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_REQ,
1255 sizeof(req), &req);
1256}
1257
1258static void l2cap_le_start(struct l2cap_chan *chan)
1259{
1260 struct l2cap_conn *conn = chan->conn;
1261
1262 if (!smp_conn_security(conn->hcon, chan->sec_level))
1263 return;
1264
1265 if (!chan->psm) {
1266 l2cap_chan_ready(chan);
1267 return;
1268 }
1269
1270 if (chan->state == BT_CONNECT)
1271 l2cap_le_connect(chan);
1272}
1273
93c3e8f5
AE		 1274static void l2cap_start_connection(struct l2cap_chan *chan)
1275{
1276 if (__amp_capable(chan)) {
1277 BT_DBG("chan %p AMP capable: discover AMPs", chan);
1278 a2mp_discover_amp(chan);
f1496dee
JH		 1279 } else if (chan->conn->hcon->type == LE_LINK) {
1280 l2cap_le_start(chan);
93c3e8f5
AE		 1281 } else {
1282 l2cap_send_conn_req(chan);
1283 }
1284}
1285
fc7f8a7e 1286static void l2cap_do_start(struct l2cap_chan *chan)
79d554a6 1287{
8c1d787b 1288 struct l2cap_conn *conn = chan->conn;
79d554a6 1289
9f0caeb1 1290 if (conn->hcon->type == LE_LINK) {
96ac34fb 1291 l2cap_le_start(chan);
9f0caeb1
VCG		 1292 return;
1293 }
1294
79d554a6 1295 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) {
984947dc
MH		 1296 if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE))
1297 return;
1298
e7cafc45 1299 if (l2cap_chan_check_security(chan, true) &&
2d792818 1300 __l2cap_no_conn_pending(chan)) {
93c3e8f5
AE		 1301 l2cap_start_connection(chan);
1302 }
79d554a6
MH		 1303 } else {
1304 struct l2cap_info_req req;
dcf4adbf 1305 req.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
79d554a6
MH		 1306
1307 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
1308 conn->info_ident = l2cap_get_ident(conn);
1309
ba13ccd9 1310 schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
79d554a6 1311
2d792818
GP		 1312 l2cap_send_cmd(conn, conn->info_ident, L2CAP_INFO_REQ,
1313 sizeof(req), &req);
79d554a6
MH		 1314 }
1315}
1316
cf6c2c0b
GP		 1317static inline int l2cap_mode_supported(__u8 mode, __u32 feat_mask)
1318{
1319 u32 local_feat_mask = l2cap_feat_mask;
d1c4a17d 1320 if (!disable_ertm)
cf6c2c0b
GP		 1321 local_feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING;
1322
1323 switch (mode) {
1324 case L2CAP_MODE_ERTM:
1325 return L2CAP_FEAT_ERTM & feat_mask & local_feat_mask;
1326 case L2CAP_MODE_STREAMING:
1327 return L2CAP_FEAT_STREAMING & feat_mask & local_feat_mask;
1328 default:
1329 return 0x00;
1330 }
1331}
1332
5e4e3972 1333static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err)
22121fc9 1334{
5e4e3972 1335 struct l2cap_conn *conn = chan->conn;
22121fc9
GP		 1336 struct l2cap_disconn_req req;
1337
c13ffa62
GP		 1338 if (!conn)
1339 return;
1340
aad3d0e3 1341 if (chan->mode == L2CAP_MODE_ERTM && chan->state == BT_CONNECTED) {
1a09bcb9
GP		 1342 __clear_retrans_timer(chan);
1343 __clear_monitor_timer(chan);
1344 __clear_ack_timer(chan);
c13ffa62
GP		 1345 }
1346
2338a7e0 1347 if (chan->scid == L2CAP_CID_A2MP) {
d117773c 1348 l2cap_state_change(chan, BT_DISCONN);
416fa752
AE		 1349 return;
1350 }
1351
fe4128e0
GP		 1352 req.dcid = cpu_to_le16(chan->dcid);
1353 req.scid = cpu_to_le16(chan->scid);
2d792818
GP		 1354 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_DISCONN_REQ,
1355 sizeof(req), &req);
c13ffa62 1356
f8e73017 1357 l2cap_state_change_and_error(chan, BT_DISCONN, err);
22121fc9
GP		 1358}
1359
1da177e4 1360/* ---- L2CAP connections ---- */
4e8402a3
MH		 1361static void l2cap_conn_start(struct l2cap_conn *conn)
1362{
3df91ea2 1363 struct l2cap_chan *chan, *tmp;
4e8402a3
MH		 1364
1365 BT_DBG("conn %p", conn);
1366
3df91ea2 1367 mutex_lock(&conn->chan_lock);
4e8402a3 1368
3df91ea2 1369 list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
6be36555 1370 l2cap_chan_lock(chan);
4e8402a3 1371
715ec005 1372 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
6be36555 1373 l2cap_chan_unlock(chan);
79d554a6
MH		 1374 continue;
1375 }
1376
89bc500e 1377 if (chan->state == BT_CONNECT) {
e7cafc45 1378 if (!l2cap_chan_check_security(chan, true) ||
2d792818 1379 !__l2cap_no_conn_pending(chan)) {
6be36555 1380 l2cap_chan_unlock(chan);
47731de7
GP		 1381 continue;
1382 }
79d554a6 1383
c1360a1c 1384 if (!l2cap_mode_supported(chan->mode, conn->feat_mask)
2d792818 1385 && test_bit(CONF_STATE2_DEVICE,
c1360a1c 1386 &chan->conf_state)) {
89bc500e 1387 l2cap_chan_close(chan, ECONNRESET);
6be36555 1388 l2cap_chan_unlock(chan);
47731de7 1389 continue;
b1235d79 1390 }
47731de7 1391
93c3e8f5 1392 l2cap_start_connection(chan);
47731de7 1393
89bc500e 1394 } else if (chan->state == BT_CONNECT2) {
79d554a6 1395 struct l2cap_conn_rsp rsp;
e9aeb2dd 1396 char buf[128];
fe4128e0
GP		 1397 rsp.scid = cpu_to_le16(chan->dcid);
1398 rsp.dcid = cpu_to_le16(chan->scid);
79d554a6 1399
e7cafc45 1400 if (l2cap_chan_check_security(chan, false)) {
bdc25783 1401 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
dcf4adbf
JP		 1402 rsp.result = cpu_to_le16(L2CAP_CR_PEND);
1403 rsp.status = cpu_to_le16(L2CAP_CS_AUTHOR_PEND);
2dc4e510 1404 chan->ops->defer(chan);
f66dc81f
MH		 1405
1406 } else {
acdcabf5 1407 l2cap_state_change(chan, BT_CONFIG);
dcf4adbf
JP		 1408 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
1409 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
f66dc81f 1410 }
79d554a6 1411 } else {
dcf4adbf
JP		 1412 rsp.result = cpu_to_le16(L2CAP_CR_PEND);
1413 rsp.status = cpu_to_le16(L2CAP_CS_AUTHEN_PEND);
79d554a6
MH		 1414 }
1415
fc7f8a7e 1416 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
2d792818 1417 sizeof(rsp), &rsp);
e9aeb2dd 1418
c1360a1c 1419 if (test_bit(CONF_REQ_SENT, &chan->conf_state) ||
2d792818 1420 rsp.result != L2CAP_CR_SUCCESS) {
6be36555 1421 l2cap_chan_unlock(chan);
e9aeb2dd
GP		 1422 continue;
1423 }
1424
c1360a1c 1425 set_bit(CONF_REQ_SENT, &chan->conf_state);
e9aeb2dd 1426 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
2d792818 1427 l2cap_build_conf_req(chan, buf), buf);
73ffa904 1428 chan->num_conf_req++;
4e8402a3
MH		 1429 }
1430
6be36555 1431 l2cap_chan_unlock(chan);
4e8402a3
MH		 1432 }
1433
3df91ea2 1434 mutex_unlock(&conn->chan_lock);
4e8402a3
MH		 1435}
1436
b62f328b
VT		 1437static void l2cap_le_conn_ready(struct l2cap_conn *conn)
1438{
cc8dba2b 1439 struct hci_conn *hcon = conn->hcon;
dcc36c16 1440 struct hci_dev *hdev = hcon->hdev;
b62f328b 1441
e760ec12 1442 BT_DBG("%s conn %p", hdev->name, conn);
b62f328b 1443
e760ec12
JH		 1444 /* For outgoing pairing which doesn't necessarily have an
1445 * associated socket (e.g. mgmt_pair_device).
1446 */
1447 if (hcon->out)
1448 smp_conn_security(hcon, hcon->pending_sec_level);
cc8dba2b 1449
80afeb6c
MH		 1450 /* For LE slave connections, make sure the connection interval
1451 * is in the range of the minium and maximum interval that has
1452 * been configured for this connection. If not, then trigger
1453 * the connection update procedure.
1454 */
40bef302 1455 if (hcon->role == HCI_ROLE_SLAVE &&
80afeb6c
MH		 1456 (hcon->le_conn_interval < hcon->le_conn_min_interval ||
1457 hcon->le_conn_interval > hcon->le_conn_max_interval)) {
1458 struct l2cap_conn_param_update_req req;
1459
1460 req.min = cpu_to_le16(hcon->le_conn_min_interval);
1461 req.max = cpu_to_le16(hcon->le_conn_max_interval);
1462 req.latency = cpu_to_le16(hcon->le_conn_latency);
1463 req.to_multiplier = cpu_to_le16(hcon->le_supv_timeout);
1464
1465 l2cap_send_cmd(conn, l2cap_get_ident(conn),
1466 L2CAP_CONN_PARAM_UPDATE_REQ, sizeof(req), &req);
1467 }
b62f328b
VT		 1468}
1469
4e8402a3
MH		 1470static void l2cap_conn_ready(struct l2cap_conn *conn)
1471{
48454079 1472 struct l2cap_chan *chan;
cc110922 1473 struct hci_conn *hcon = conn->hcon;
4e8402a3 1474
79d554a6 1475 BT_DBG("conn %p", conn);
4e8402a3 1476
e760ec12
JH		 1477 mutex_lock(&conn->chan_lock);
1478
3df91ea2 1479 list_for_each_entry(chan, &conn->chan_l, list) {
baa7e1fa 1480
6be36555 1481 l2cap_chan_lock(chan);
4e8402a3 1482
2338a7e0 1483 if (chan->scid == L2CAP_CID_A2MP) {
416fa752
AE		 1484 l2cap_chan_unlock(chan);
1485 continue;
1486 }
1487
cc110922 1488 if (hcon->type == LE_LINK) {
f1496dee 1489 l2cap_le_start(chan);
63128451 1490 } else if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
74e75740 1491 l2cap_chan_ready(chan);
b501d6a1 1492
1c244f79 1493 } else if (chan->state == BT_CONNECT) {
fc7f8a7e 1494 l2cap_do_start(chan);
1c244f79 1495 }
4e8402a3 1496
6be36555 1497 l2cap_chan_unlock(chan);
4e8402a3 1498 }
79d554a6 1499
3df91ea2 1500 mutex_unlock(&conn->chan_lock);
61a939c6 1501
79a05727
JH		 1502 if (hcon->type == LE_LINK)
1503 l2cap_le_conn_ready(conn);
1504
61a939c6 1505 queue_work(hcon->hdev->workqueue, &conn->pending_rx_work);
4e8402a3
MH		 1506}
1507
1508/* Notify sockets that we cannot guaranty reliability anymore */
1509static void l2cap_conn_unreliable(struct l2cap_conn *conn, int err)
1510{
48454079 1511 struct l2cap_chan *chan;
4e8402a3
MH		 1512
1513 BT_DBG("conn %p", conn);
1514
3df91ea2 1515 mutex_lock(&conn->chan_lock);
4e8402a3 1516
3df91ea2 1517 list_for_each_entry(chan, &conn->chan_l, list) {
ecf61bdb 1518 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
1d8b1fd5 1519 l2cap_chan_set_err(chan, err);
4e8402a3
MH		 1520 }
1521
3df91ea2 1522 mutex_unlock(&conn->chan_lock);
4e8402a3
MH		 1523}
1524
f878fcad 1525static void l2cap_info_timeout(struct work_struct *work)
4e8402a3 1526{
f878fcad 1527 struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
2d792818 1528 info_timer.work);
4e8402a3 1529
984947dc 1530 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
e1027a7c 1531 conn->info_ident = 0;
984947dc 1532
4e8402a3
MH		 1533 l2cap_conn_start(conn);
1534}
1535
2c8e1411
DH		 1536/*
1537 * l2cap_user
1538 * External modules can register l2cap_user objects on l2cap_conn. The ->probe
1539 * callback is called during registration. The ->remove callback is called
1540 * during unregistration.
1541 * An l2cap_user object can either be explicitly unregistered or when the
1542 * underlying l2cap_conn object is deleted. This guarantees that l2cap->hcon,
1543 * l2cap->hchan, .. are valid as long as the remove callback hasn't been called.
1544 * External modules must own a reference to the l2cap_conn object if they intend
1545 * to call l2cap_unregister_user(). The l2cap_conn object might get destroyed at
1546 * any time if they don't.
1547 */
1548
1549int l2cap_register_user(struct l2cap_conn *conn, struct l2cap_user *user)
1550{
1551 struct hci_dev *hdev = conn->hcon->hdev;
1552 int ret;
1553
1554 /* We need to check whether l2cap_conn is registered. If it is not, we
1555 * must not register the l2cap_user. l2cap_conn_del() is unregisters
1556 * l2cap_conn objects, but doesn't provide its own locking. Instead, it
1557 * relies on the parent hci_conn object to be locked. This itself relies
1558 * on the hci_dev object to be locked. So we must lock the hci device
1559 * here, too. */
1560
1561 hci_dev_lock(hdev);
1562
1563 if (user->list.next || user->list.prev) {
1564 ret = -EINVAL;
1565 goto out_unlock;
1566 }
1567
1568 /* conn->hchan is NULL after l2cap_conn_del() was called */
1569 if (!conn->hchan) {
1570 ret = -ENODEV;
1571 goto out_unlock;
1572 }
1573
1574 ret = user->probe(conn, user);
1575 if (ret)
1576 goto out_unlock;
1577
1578 list_add(&user->list, &conn->users);
1579 ret = 0;
1580
1581out_unlock:
1582 hci_dev_unlock(hdev);
1583 return ret;
1584}
1585EXPORT_SYMBOL(l2cap_register_user);
1586
1587void l2cap_unregister_user(struct l2cap_conn *conn, struct l2cap_user *user)
1588{
1589 struct hci_dev *hdev = conn->hcon->hdev;
1590
1591 hci_dev_lock(hdev);
1592
1593 if (!user->list.next || !user->list.prev)
1594 goto out_unlock;
1595
1596 list_del(&user->list);
1597 user->list.next = NULL;
1598 user->list.prev = NULL;
1599 user->remove(conn, user);
1600
1601out_unlock:
1602 hci_dev_unlock(hdev);
1603}
1604EXPORT_SYMBOL(l2cap_unregister_user);
1605
1606static void l2cap_unregister_all_users(struct l2cap_conn *conn)
1607{
1608 struct l2cap_user *user;
1609
1610 while (!list_empty(&conn->users)) {
1611 user = list_first_entry(&conn->users, struct l2cap_user, list);
1612 list_del(&user->list);
1613 user->list.next = NULL;
1614 user->list.prev = NULL;
1615 user->remove(conn, user);
1616 }
1617}
1618
5d3de7df
VCG		 1619static void l2cap_conn_del(struct hci_conn *hcon, int err)
1620{
1621 struct l2cap_conn *conn = hcon->l2cap_data;
1622 struct l2cap_chan *chan, *l;
5d3de7df
VCG		 1623
1624 if (!conn)
1625 return;
1626
1627 BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
1628
1629 kfree_skb(conn->rx_skb);
1630
61a939c6 1631 skb_queue_purge(&conn->pending_rx);
7ab56c3a
JT		 1632
1633 /* We can not call flush_work(&conn->pending_rx_work) here since we
1634 * might block if we are running on a worker from the same workqueue
1635 * pending_rx_work is waiting on.
1636 */
1637 if (work_pending(&conn->pending_rx_work))
1638 cancel_work_sync(&conn->pending_rx_work);
61a939c6 1639
f3d82d0c
JH		 1640 if (work_pending(&conn->id_addr_update_work))
1641 cancel_work_sync(&conn->id_addr_update_work);
1642
2c8e1411
DH		 1643 l2cap_unregister_all_users(conn);
1644
e31fb860
JH		 1645 /* Force the connection to be immediately dropped */
1646 hcon->disc_timeout = 0;
1647
3df91ea2
AE		 1648 mutex_lock(&conn->chan_lock);
1649
5d3de7df
VCG		 1650 /* Kill channels */
1651 list_for_each_entry_safe(chan, l, &conn->chan_l, list) {
61d6ef3e 1652 l2cap_chan_hold(chan);
6be36555
AE		 1653 l2cap_chan_lock(chan);
1654
5d3de7df 1655 l2cap_chan_del(chan, err);
6be36555
AE		 1656
1657 l2cap_chan_unlock(chan);
1658
80b98027 1659 chan->ops->close(chan);
61d6ef3e 1660 l2cap_chan_put(chan);
5d3de7df
VCG		 1661 }
1662
3df91ea2
AE		 1663 mutex_unlock(&conn->chan_lock);
1664
73d80deb
LAD		 1665 hci_chan_del(conn->hchan);
1666
5d3de7df 1667 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
127074bf 1668 cancel_delayed_work_sync(&conn->info_timer);
5d3de7df 1669
5d3de7df 1670 hcon->l2cap_data = NULL;
9c903e37
DH		 1671 conn->hchan = NULL;
1672 l2cap_conn_put(conn);
5d3de7df
VCG		 1673}
1674
9c903e37
DH		 1675static void l2cap_conn_free(struct kref *ref)
1676{
1677 struct l2cap_conn *conn = container_of(ref, struct l2cap_conn, ref);
1678
1679 hci_conn_put(conn->hcon);
1680 kfree(conn);
1681}
1682
51bb8457 1683struct l2cap_conn *l2cap_conn_get(struct l2cap_conn *conn)
9c903e37
DH		 1684{
1685 kref_get(&conn->ref);
51bb8457 1686 return conn;
9c903e37
DH		 1687}
1688EXPORT_SYMBOL(l2cap_conn_get);
1689
1690void l2cap_conn_put(struct l2cap_conn *conn)
1691{
1692 kref_put(&conn->ref, l2cap_conn_free);
1693}
1694EXPORT_SYMBOL(l2cap_conn_put);
1695
1da177e4 1696/* ---- Socket interface ---- */
1da177e4 1697
c2287681 1698/* Find socket with psm and source / destination bdaddr.
1da177e4
LT		 1699 * Returns closest match.
1700 */
c2287681
IY		 1701static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm,
1702 bdaddr_t *src,
bf20fd4e
JH		 1703 bdaddr_t *dst,
1704 u8 link_type)
1da177e4 1705{
23691d75 1706 struct l2cap_chan *c, *c1 = NULL;
1da177e4 1707
23691d75 1708 read_lock(&chan_list_lock);
e0f0cb56 1709
23691d75 1710 list_for_each_entry(c, &chan_list, global_l) {
89bc500e 1711 if (state && c->state != state)
1da177e4
LT		 1712 continue;
1713
bf20fd4e
JH		 1714 if (link_type == ACL_LINK && c->src_type != BDADDR_BREDR)
1715 continue;
1716
1717 if (link_type == LE_LINK && c->src_type == BDADDR_BREDR)
1718 continue;
1719
23691d75 1720 if (c->psm == psm) {
c2287681
IY		 1721 int src_match, dst_match;
1722 int src_any, dst_any;
1723
1da177e4 1724 /* Exact match. */
7eafc59e
MH		 1725 src_match = !bacmp(&c->src, src);
1726 dst_match = !bacmp(&c->dst, dst);
c2287681 1727 if (src_match && dst_match) {
a24cce14 1728 l2cap_chan_hold(c);
a7567b20 1729 read_unlock(&chan_list_lock);
23691d75
GP		 1730 return c;
1731 }
1da177e4
LT		 1732
1733 /* Closest match */
7eafc59e
MH		 1734 src_any = !bacmp(&c->src, BDADDR_ANY);
1735 dst_any = !bacmp(&c->dst, BDADDR_ANY);
c2287681
IY		 1736 if ((src_match && dst_any) || (src_any && dst_match) ||
1737 (src_any && dst_any))
23691d75 1738 c1 = c;
1da177e4
LT		 1739 }
1740 }
1da177e4 1741
a24cce14
JH		 1742 if (c1)
1743 l2cap_chan_hold(c1);
1744
23691d75 1745 read_unlock(&chan_list_lock);
e0f0cb56 1746
23691d75 1747 return c1;
1da177e4
LT		 1748}
1749
721c4181 1750static void l2cap_monitor_timeout(struct work_struct *work)
e90bac06 1751{
721c4181 1752 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
4239d16f 1753 monitor_timer.work);
e90bac06 1754
525cd185 1755 BT_DBG("chan %p", chan);
0e98958d 1756
6be36555
AE		 1757 l2cap_chan_lock(chan);
1758
80909e04 1759 if (!chan->conn) {
6be36555 1760 l2cap_chan_unlock(chan);
8d7e1c7f 1761 l2cap_chan_put(chan);
e90bac06
GP		 1762 return;
1763 }
1764
401bb1f7 1765 l2cap_tx(chan, NULL, NULL, L2CAP_EV_MONITOR_TO);
e90bac06 1766
6be36555 1767 l2cap_chan_unlock(chan);
8d7e1c7f 1768 l2cap_chan_put(chan);
e90bac06
GP		 1769}
1770
721c4181 1771static void l2cap_retrans_timeout(struct work_struct *work)
e90bac06 1772{
721c4181 1773 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
4239d16f 1774 retrans_timer.work);
e90bac06 1775
49208c9c 1776 BT_DBG("chan %p", chan);
0e98958d 1777
6be36555
AE		 1778 l2cap_chan_lock(chan);
1779
80909e04
MM		 1780 if (!chan->conn) {
1781 l2cap_chan_unlock(chan);
1782 l2cap_chan_put(chan);
1783 return;
1784 }
6be36555 1785
401bb1f7 1786 l2cap_tx(chan, NULL, NULL, L2CAP_EV_RETRANS_TO);
6be36555 1787 l2cap_chan_unlock(chan);
8d7e1c7f 1788 l2cap_chan_put(chan);
e90bac06
GP		 1789}
1790
d660366d
GP		 1791static void l2cap_streaming_send(struct l2cap_chan *chan,
1792 struct sk_buff_head *skbs)
6840ed07 1793{
ccbb84af 1794 struct sk_buff *skb;
3733937d 1795 struct l2cap_ctrl *control;
6840ed07 1796
3733937d
MM		 1797 BT_DBG("chan %p, skbs %p", chan, skbs);
1798
b99e13ad
MM		 1799 if (__chan_is_moving(chan))
1800 return;
1801
3733937d
MM		 1802 skb_queue_splice_tail_init(skbs, &chan->tx_q);
1803
1804 while (!skb_queue_empty(&chan->tx_q)) {
1805
1806 skb = skb_dequeue(&chan->tx_q);
1807
1808 bt_cb(skb)->control.retries = 1;
1809 control = &bt_cb(skb)->control;
1810
1811 control->reqseq = 0;
1812 control->txseq = chan->next_tx_seq;
1813
1814 __pack_control(chan, control, skb);
6840ed07 1815
47d1ec61 1816 if (chan->fcs == L2CAP_FCS_CRC16) {
3733937d
MM		 1817 u16 fcs = crc16(0, (u8 *) skb->data, skb->len);
1818 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
fcc203c3
GP		 1819 }
1820
4343478f 1821 l2cap_do_send(chan, skb);
6840ed07 1822
b4400672 1823 BT_DBG("Sent txseq %u", control->txseq);
3733937d 1824
836be934 1825 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
3733937d 1826 chan->frames_sent++;
6840ed07 1827 }
6840ed07
GP		 1828}
1829
67c9e840 1830static int l2cap_ertm_send(struct l2cap_chan *chan)
1c2acffb
GP		 1831{
1832 struct sk_buff *skb, *tx_skb;
18a48e76
MM		 1833 struct l2cap_ctrl *control;
1834 int sent = 0;
1835
1836 BT_DBG("chan %p", chan);
1c2acffb 1837
89bc500e 1838 if (chan->state != BT_CONNECTED)
c13ffa62 1839 return -ENOTCONN;
e90bac06 1840
94122bbe
MM		 1841 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
1842 return 0;
1843
b99e13ad
MM		 1844 if (__chan_is_moving(chan))
1845 return 0;
1846
18a48e76
MM		 1847 while (chan->tx_send_head &&
1848 chan->unacked_frames < chan->remote_tx_win &&
1849 chan->tx_state == L2CAP_TX_STATE_XMIT) {
e420aba3 1850
18a48e76 1851 skb = chan->tx_send_head;
e90bac06 1852
18a48e76
MM		 1853 bt_cb(skb)->control.retries = 1;
1854 control = &bt_cb(skb)->control;
95ffa978 1855
e2ab4353 1856 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
18a48e76 1857 control->final = 1;
e2ab4353 1858
18a48e76
MM		 1859 control->reqseq = chan->buffer_seq;
1860 chan->last_acked_seq = chan->buffer_seq;
1861 control->txseq = chan->next_tx_seq;
1c2acffb 1862
18a48e76 1863 __pack_control(chan, control, skb);
e90bac06 1864
47d1ec61 1865 if (chan->fcs == L2CAP_FCS_CRC16) {
18a48e76
MM		 1866 u16 fcs = crc16(0, (u8 *) skb->data, skb->len);
1867 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
fcc203c3
GP		 1868 }
1869
18a48e76
MM		 1870 /* Clone after data has been modified. Data is assumed to be
1871 read-only (for locking purposes) on cloned sk_buffs.
1872 */
1873 tx_skb = skb_clone(skb, GFP_KERNEL);
9a9c6a34 1874
18a48e76
MM		 1875 if (!tx_skb)
1876 break;
1c2acffb 1877
18a48e76 1878 __set_retrans_timer(chan);
836be934
AE		 1879
1880 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
18a48e76 1881 chan->unacked_frames++;
6a026610 1882 chan->frames_sent++;
18a48e76 1883 sent++;
1c2acffb 1884
58d35f87
GP		 1885 if (skb_queue_is_last(&chan->tx_q, skb))
1886 chan->tx_send_head = NULL;
1c2acffb 1887 else
58d35f87 1888 chan->tx_send_head = skb_queue_next(&chan->tx_q, skb);
18a48e76
MM		 1889
1890 l2cap_do_send(chan, tx_skb);
b4400672 1891 BT_DBG("Sent txseq %u", control->txseq);
1c2acffb
GP		 1892 }
1893
b4400672
AE		 1894 BT_DBG("Sent %d, %u unacked, %u in ERTM queue", sent,
1895 chan->unacked_frames, skb_queue_len(&chan->tx_q));
18a48e76
MM		 1896
1897 return sent;
9e917af1
GP		 1898}
1899
e1fbd4c1
MM		 1900static void l2cap_ertm_resend(struct l2cap_chan *chan)
1901{
1902 struct l2cap_ctrl control;
1903 struct sk_buff *skb;
1904 struct sk_buff *tx_skb;
1905 u16 seq;
1906
1907 BT_DBG("chan %p", chan);
1908
1909 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
1910 return;
1911
b99e13ad
MM		 1912 if (__chan_is_moving(chan))
1913 return;
1914
e1fbd4c1
MM		 1915 while (chan->retrans_list.head != L2CAP_SEQ_LIST_CLEAR) {
1916 seq = l2cap_seq_list_pop(&chan->retrans_list);
1917
1918 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, seq);
1919 if (!skb) {
1920 BT_DBG("Error: Can't retransmit seq %d, frame missing",
2d792818 1921 seq);
e1fbd4c1
MM		 1922 continue;
1923 }
1924
1925 bt_cb(skb)->control.retries++;
1926 control = bt_cb(skb)->control;
1927
1928 if (chan->max_tx != 0 &&
1929 bt_cb(skb)->control.retries > chan->max_tx) {
1930 BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
5e4e3972 1931 l2cap_send_disconn_req(chan, ECONNRESET);
e1fbd4c1
MM		 1932 l2cap_seq_list_clear(&chan->retrans_list);
1933 break;
1934 }
1935
1936 control.reqseq = chan->buffer_seq;
1937 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
1938 control.final = 1;
1939 else
1940 control.final = 0;
1941
1942 if (skb_cloned(skb)) {
1943 /* Cloned sk_buffs are read-only, so we need a
1944 * writeable copy
1945 */
8bcde1f2 1946 tx_skb = skb_copy(skb, GFP_KERNEL);
e1fbd4c1 1947 } else {
8bcde1f2 1948 tx_skb = skb_clone(skb, GFP_KERNEL);
e1fbd4c1
MM		 1949 }
1950
1951 if (!tx_skb) {
1952 l2cap_seq_list_clear(&chan->retrans_list);
1953 break;
1954 }
1955
1956 /* Update skb contents */
1957 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
1958 put_unaligned_le32(__pack_extended_control(&control),
1959 tx_skb->data + L2CAP_HDR_SIZE);
1960 } else {
1961 put_unaligned_le16(__pack_enhanced_control(&control),
1962 tx_skb->data + L2CAP_HDR_SIZE);
1963 }
1964
13cac152 1965 /* Update FCS */
e1fbd4c1 1966 if (chan->fcs == L2CAP_FCS_CRC16) {
13cac152
LR		 1967 u16 fcs = crc16(0, (u8 *) tx_skb->data,
1968 tx_skb->len - L2CAP_FCS_SIZE);
1969 put_unaligned_le16(fcs, skb_tail_pointer(tx_skb) -
1970 L2CAP_FCS_SIZE);
e1fbd4c1
MM		 1971 }
1972
1973 l2cap_do_send(chan, tx_skb);
1974
1975 BT_DBG("Resent txseq %d", control.txseq);
1976
1977 chan->last_acked_seq = chan->buffer_seq;
1978 }
1979}
1980
f80842a8
MM		 1981static void l2cap_retransmit(struct l2cap_chan *chan,
1982 struct l2cap_ctrl *control)
1983{
1984 BT_DBG("chan %p, control %p", chan, control);
1985
1986 l2cap_seq_list_append(&chan->retrans_list, control->reqseq);
1987 l2cap_ertm_resend(chan);
1988}
1989
d2a7ac5d
MM		 1990static void l2cap_retransmit_all(struct l2cap_chan *chan,
1991 struct l2cap_ctrl *control)
1992{
e1fbd4c1
MM		 1993 struct sk_buff *skb;
1994
1995 BT_DBG("chan %p, control %p", chan, control);
1996
1997 if (control->poll)
1998 set_bit(CONN_SEND_FBIT, &chan->conn_state);
1999
2000 l2cap_seq_list_clear(&chan->retrans_list);
2001
2002 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
2003 return;
2004
2005 if (chan->unacked_frames) {
2006 skb_queue_walk(&chan->tx_q, skb) {
2007 if (bt_cb(skb)->control.txseq == control->reqseq ||
2d792818 2008 skb == chan->tx_send_head)
e1fbd4c1
MM		 2009 break;
2010 }
2011
2012 skb_queue_walk_from(&chan->tx_q, skb) {
2013 if (skb == chan->tx_send_head)
2014 break;
2015
2016 l2cap_seq_list_append(&chan->retrans_list,
2017 bt_cb(skb)->control.txseq);
2018 }
2019
2020 l2cap_ertm_resend(chan);
2021 }
d2a7ac5d
MM		 2022}
2023
0a0aba42 2024static void l2cap_send_ack(struct l2cap_chan *chan)
9e917af1 2025{
0a0aba42
MM		 2026 struct l2cap_ctrl control;
2027 u16 frames_to_ack = __seq_offset(chan, chan->buffer_seq,
2028 chan->last_acked_seq);
2029 int threshold;
9e917af1 2030
0a0aba42
MM		 2031 BT_DBG("chan %p last_acked_seq %d buffer_seq %d",
2032 chan, chan->last_acked_seq, chan->buffer_seq);
9e917af1 2033
0a0aba42
MM		 2034 memset(&control, 0, sizeof(control));
2035 control.sframe = 1;
dfc909be 2036
0a0aba42
MM		 2037 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&
2038 chan->rx_state == L2CAP_RX_STATE_RECV) {
2039 __clear_ack_timer(chan);
2040 control.super = L2CAP_SUPER_RNR;
2041 control.reqseq = chan->buffer_seq;
2042 l2cap_send_sframe(chan, &control);
2043 } else {
2044 if (!test_bit(CONN_REMOTE_BUSY, &chan->conn_state)) {
2045 l2cap_ertm_send(chan);
2046 /* If any i-frames were sent, they included an ack */
2047 if (chan->buffer_seq == chan->last_acked_seq)
2048 frames_to_ack = 0;
2049 }
dfc909be 2050
c20f8e35 2051 /* Ack now if the window is 3/4ths full.
0a0aba42
MM		 2052 * Calculate without mul or div
2053 */
c20f8e35 2054 threshold = chan->ack_win;
0a0aba42
MM		 2055 threshold += threshold << 1;
2056 threshold >>= 2;
2057
b4400672 2058 BT_DBG("frames_to_ack %u, threshold %d", frames_to_ack,
0a0aba42
MM		 2059 threshold);
2060
2061 if (frames_to_ack >= threshold) {
2062 __clear_ack_timer(chan);
2063 control.super = L2CAP_SUPER_RR;
2064 control.reqseq = chan->buffer_seq;
2065 l2cap_send_sframe(chan, &control);
2066 frames_to_ack = 0;
2067 }
1c2acffb 2068
0a0aba42
MM		 2069 if (frames_to_ack)
2070 __set_ack_timer(chan);
2071 }
b17e73bb
SJ		 2072}
2073
04124681
GP		 2074static inline int l2cap_skbuff_fromiovec(struct l2cap_chan *chan,
2075 struct msghdr *msg, int len,
2076 int count, struct sk_buff *skb)
1c2acffb 2077{
0952a57a 2078 struct l2cap_conn *conn = chan->conn;
1c2acffb 2079 struct sk_buff **frag;
90338947 2080 int sent = 0;
1da177e4 2081
0498878b
JR		 2082 if (chan->ops->memcpy_fromiovec(chan, skb_put(skb, count),
2083 msg->msg_iov, count))
1c2acffb 2084 return -EFAULT;
1da177e4
LT		 2085
2086 sent += count;
2087 len -= count;
2088
2089 /* Continuation fragments (no L2CAP header) */
2090 frag = &skb_shinfo(skb)->frag_list;
2091 while (len) {
fbe00700
GP		 2092 struct sk_buff *tmp;
2093
1da177e4
LT		 2094 count = min_t(unsigned int, conn->mtu, len);
2095
d9fbd02b 2096 tmp = chan->ops->alloc_skb(chan, 0, count,
fbe00700
GP		 2097 msg->msg_flags & MSG_DONTWAIT);
2098 if (IS_ERR(tmp))
2099 return PTR_ERR(tmp);
2100
2101 *frag = tmp;
2f7719ce 2102
0498878b
JR		 2103 if (chan->ops->memcpy_fromiovec(chan, skb_put(*frag, count),
2104 msg->msg_iov, count))
1c2acffb 2105 return -EFAULT;
1da177e4
LT		 2106
2107 sent += count;
2108 len -= count;
2109
2d0ed3d5
GP		 2110 skb->len += (*frag)->len;
2111 skb->data_len += (*frag)->len;
2112
1da177e4
LT		 2113 frag = &(*frag)->next;
2114 }
1da177e4
LT		 2115
2116 return sent;
1c2acffb 2117}
1da177e4 2118
5e59b791 2119static struct sk_buff *l2cap_create_connless_pdu(struct l2cap_chan *chan,
8d46321c 2120 struct msghdr *msg, size_t len)
1c2acffb 2121{
8c1d787b 2122 struct l2cap_conn *conn = chan->conn;
1c2acffb 2123 struct sk_buff *skb;
03a51213 2124 int err, count, hlen = L2CAP_HDR_SIZE + L2CAP_PSMLEN_SIZE;
1c2acffb
GP		 2125 struct l2cap_hdr *lh;
2126
8d46321c
MH		 2127 BT_DBG("chan %p psm 0x%2.2x len %zu", chan,
2128 __le16_to_cpu(chan->psm), len);
1c2acffb
GP		 2129
2130 count = min_t(unsigned int, (conn->mtu - hlen), len);
2f7719ce 2131
d9fbd02b 2132 skb = chan->ops->alloc_skb(chan, hlen, count,
90338947
GP		 2133 msg->msg_flags & MSG_DONTWAIT);
2134 if (IS_ERR(skb))
2135 return skb;
1c2acffb
GP		 2136
2137 /* Create L2CAP header */
2138 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
fe4128e0 2139 lh->cid = cpu_to_le16(chan->dcid);
daf6a78c 2140 lh->len = cpu_to_le16(len + L2CAP_PSMLEN_SIZE);
43b1b8df 2141 put_unaligned(chan->psm, (__le16 *) skb_put(skb, L2CAP_PSMLEN_SIZE));
1c2acffb 2142
0952a57a 2143 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
1c2acffb
GP		 2144 if (unlikely(err < 0)) {
2145 kfree_skb(skb);
2146 return ERR_PTR(err);
2147 }
2148 return skb;
2149}
2150
5e59b791 2151static struct sk_buff *l2cap_create_basic_pdu(struct l2cap_chan *chan,
8d46321c 2152 struct msghdr *msg, size_t len)
1c2acffb 2153{
8c1d787b 2154 struct l2cap_conn *conn = chan->conn;
1c2acffb 2155 struct sk_buff *skb;
f2ba7fae 2156 int err, count;
1c2acffb
GP		 2157 struct l2cap_hdr *lh;
2158
b4400672 2159 BT_DBG("chan %p len %zu", chan, len);
1c2acffb 2160
f2ba7fae 2161 count = min_t(unsigned int, (conn->mtu - L2CAP_HDR_SIZE), len);
2f7719ce 2162
d9fbd02b 2163 skb = chan->ops->alloc_skb(chan, L2CAP_HDR_SIZE, count,
90338947
GP		 2164 msg->msg_flags & MSG_DONTWAIT);
2165 if (IS_ERR(skb))
2166 return skb;
1c2acffb
GP		 2167
2168 /* Create L2CAP header */
2169 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
fe4128e0 2170 lh->cid = cpu_to_le16(chan->dcid);
6ff9b5ef 2171 lh->len = cpu_to_le16(len);
1c2acffb 2172
0952a57a 2173 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
1c2acffb
GP		 2174 if (unlikely(err < 0)) {
2175 kfree_skb(skb);
2176 return ERR_PTR(err);
2177 }
2178 return skb;
2179}
2180
ab0ff76d 2181static struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan,
b4400672
AE		 2182 struct msghdr *msg, size_t len,
2183 u16 sdulen)
1c2acffb 2184{
8c1d787b 2185 struct l2cap_conn *conn = chan->conn;
1c2acffb 2186 struct sk_buff *skb;
e4ca6d98 2187 int err, count, hlen;
1c2acffb
GP		 2188 struct l2cap_hdr *lh;
2189
b4400672 2190 BT_DBG("chan %p len %zu", chan, len);
1c2acffb 2191
0ee0d208
GP		 2192 if (!conn)
2193 return ERR_PTR(-ENOTCONN);
2194
ba7aa64f 2195 hlen = __ertm_hdr_size(chan);
e4ca6d98 2196
c74e560c 2197 if (sdulen)
03a51213 2198 hlen += L2CAP_SDULEN_SIZE;
c74e560c 2199
47d1ec61 2200 if (chan->fcs == L2CAP_FCS_CRC16)
03a51213 2201 hlen += L2CAP_FCS_SIZE;
fcc203c3 2202
1c2acffb 2203 count = min_t(unsigned int, (conn->mtu - hlen), len);
2f7719ce 2204
d9fbd02b 2205 skb = chan->ops->alloc_skb(chan, hlen, count,
90338947
GP		 2206 msg->msg_flags & MSG_DONTWAIT);
2207 if (IS_ERR(skb))
2208 return skb;
1c2acffb
GP		 2209
2210 /* Create L2CAP header */
2211 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
fe4128e0 2212 lh->cid = cpu_to_le16(chan->dcid);
1c2acffb 2213 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
88843ab0 2214
18a48e76
MM		 2215 /* Control header is populated later */
2216 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
2217 put_unaligned_le32(0, skb_put(skb, L2CAP_EXT_CTRL_SIZE));
2218 else
2219 put_unaligned_le16(0, skb_put(skb, L2CAP_ENH_CTRL_SIZE));
88843ab0 2220
c74e560c 2221 if (sdulen)
03a51213 2222 put_unaligned_le16(sdulen, skb_put(skb, L2CAP_SDULEN_SIZE));
1c2acffb 2223
0952a57a 2224 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
1c2acffb
GP		 2225 if (unlikely(err < 0)) {
2226 kfree_skb(skb);
2227 return ERR_PTR(err);
2228 }
e90bac06 2229
18a48e76 2230 bt_cb(skb)->control.fcs = chan->fcs;
3ce3514f 2231 bt_cb(skb)->control.retries = 0;
1c2acffb 2232 return skb;
1da177e4
LT		 2233}
2234
94122bbe
MM		 2235static int l2cap_segment_sdu(struct l2cap_chan *chan,
2236 struct sk_buff_head *seg_queue,
2237 struct msghdr *msg, size_t len)
c74e560c 2238{
c74e560c 2239 struct sk_buff *skb;
94122bbe
MM		 2240 u16 sdu_len;
2241 size_t pdu_len;
94122bbe 2242 u8 sar;
c74e560c 2243
b4400672 2244 BT_DBG("chan %p, msg %p, len %zu", chan, msg, len);
c74e560c 2245
94122bbe
MM		 2246 /* It is critical that ERTM PDUs fit in a single HCI fragment,
2247 * so fragmented skbs are not used. The HCI layer's handling
2248 * of fragmented skbs is not compatible with ERTM's queueing.
2249 */
c74e560c 2250
94122bbe
MM		 2251 /* PDU size is derived from the HCI MTU */
2252 pdu_len = chan->conn->mtu;
c74e560c 2253
a549574d
MM		 2254 /* Constrain PDU size for BR/EDR connections */
2255 if (!chan->hs_hcon)
2256 pdu_len = min_t(size_t, pdu_len, L2CAP_BREDR_MAX_PAYLOAD);
94122bbe
MM		 2257
2258 /* Adjust for largest possible L2CAP overhead. */
35d401df
GP		 2259 if (chan->fcs)
2260 pdu_len -= L2CAP_FCS_SIZE;
2261
ba7aa64f 2262 pdu_len -= __ertm_hdr_size(chan);
94122bbe
MM		 2263
2264 /* Remote device may have requested smaller PDUs */
2265 pdu_len = min_t(size_t, pdu_len, chan->remote_mps);
2266
2267 if (len <= pdu_len) {
2268 sar = L2CAP_SAR_UNSEGMENTED;
2269 sdu_len = 0;
2270 pdu_len = len;
2271 } else {
2272 sar = L2CAP_SAR_START;
2273 sdu_len = len;
94122bbe
MM		 2274 }
2275
2276 while (len > 0) {
2277 skb = l2cap_create_iframe_pdu(chan, msg, pdu_len, sdu_len);
c74e560c 2278
c74e560c 2279 if (IS_ERR(skb)) {
94122bbe 2280 __skb_queue_purge(seg_queue);
c74e560c
GP		 2281 return PTR_ERR(skb);
2282 }
2283
94122bbe
MM		 2284 bt_cb(skb)->control.sar = sar;
2285 __skb_queue_tail(seg_queue, skb);
2286
2287 len -= pdu_len;
069cb270 2288 if (sdu_len)
94122bbe 2289 sdu_len = 0;
94122bbe
MM		 2290
2291 if (len <= pdu_len) {
2292 sar = L2CAP_SAR_END;
2293 pdu_len = len;
2294 } else {
2295 sar = L2CAP_SAR_CONTINUE;
2296 }
c74e560c 2297 }
c74e560c 2298
f0f62799 2299 return 0;
c74e560c
GP		 2300}
2301
177f8f2b
JH		 2302static struct sk_buff *l2cap_create_le_flowctl_pdu(struct l2cap_chan *chan,
2303 struct msghdr *msg,
2304 size_t len, u16 sdulen)
2305{
2306 struct l2cap_conn *conn = chan->conn;
2307 struct sk_buff *skb;
2308 int err, count, hlen;
2309 struct l2cap_hdr *lh;
2310
2311 BT_DBG("chan %p len %zu", chan, len);
2312
2313 if (!conn)
2314 return ERR_PTR(-ENOTCONN);
2315
2316 hlen = L2CAP_HDR_SIZE;
2317
2318 if (sdulen)
2319 hlen += L2CAP_SDULEN_SIZE;
2320
2321 count = min_t(unsigned int, (conn->mtu - hlen), len);
2322
d9fbd02b 2323 skb = chan->ops->alloc_skb(chan, hlen, count,
177f8f2b
JH		 2324 msg->msg_flags & MSG_DONTWAIT);
2325 if (IS_ERR(skb))
2326 return skb;
2327
2328 /* Create L2CAP header */
2329 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
2330 lh->cid = cpu_to_le16(chan->dcid);
2331 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
2332
2333 if (sdulen)
2334 put_unaligned_le16(sdulen, skb_put(skb, L2CAP_SDULEN_SIZE));
2335
2336 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
2337 if (unlikely(err < 0)) {
2338 kfree_skb(skb);
2339 return ERR_PTR(err);
2340 }
2341
2342 return skb;
2343}
2344
2345static int l2cap_segment_le_sdu(struct l2cap_chan *chan,
2346 struct sk_buff_head *seg_queue,
2347 struct msghdr *msg, size_t len)
2348{
2349 struct sk_buff *skb;
2350 size_t pdu_len;
2351 u16 sdu_len;
2352
2353 BT_DBG("chan %p, msg %p, len %zu", chan, msg, len);
2354
177f8f2b 2355 sdu_len = len;
72c6fb91 2356 pdu_len = chan->remote_mps - L2CAP_SDULEN_SIZE;
177f8f2b
JH		 2357
2358 while (len > 0) {
2359 if (len <= pdu_len)
2360 pdu_len = len;
2361
2362 skb = l2cap_create_le_flowctl_pdu(chan, msg, pdu_len, sdu_len);
2363 if (IS_ERR(skb)) {
2364 __skb_queue_purge(seg_queue);
2365 return PTR_ERR(skb);
2366 }
2367
2368 __skb_queue_tail(seg_queue, skb);
2369
2370 len -= pdu_len;
2371
2372 if (sdu_len) {
2373 sdu_len = 0;
2374 pdu_len += L2CAP_SDULEN_SIZE;
2375 }
2376 }
2377
2378 return 0;
2379}
2380
8d46321c 2381int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len)
9a91a04a 2382{
9a91a04a 2383 struct sk_buff *skb;
9a91a04a 2384 int err;
94122bbe 2385 struct sk_buff_head seg_queue;
9a91a04a 2386
31e8ce80
SWK		 2387 if (!chan->conn)
2388 return -ENOTCONN;
2389
9a91a04a 2390 /* Connectionless channel */
715ec005 2391 if (chan->chan_type == L2CAP_CHAN_CONN_LESS) {
8d46321c 2392 skb = l2cap_create_connless_pdu(chan, msg, len);
9a91a04a
GP		 2393 if (IS_ERR(skb))
2394 return PTR_ERR(skb);
2395
ede81a2a
AK		 2396 /* Channel lock is released before requesting new skb and then
2397 * reacquired thus we need to recheck channel state.
2398 */
2399 if (chan->state != BT_CONNECTED) {
2400 kfree_skb(skb);
2401 return -ENOTCONN;
2402 }
2403
9a91a04a
GP		 2404 l2cap_do_send(chan, skb);
2405 return len;
2406 }
2407
2408 switch (chan->mode) {
38319713 2409 case L2CAP_MODE_LE_FLOWCTL:
177f8f2b
JH		 2410 /* Check outgoing MTU */
2411 if (len > chan->omtu)
2412 return -EMSGSIZE;
2413
fad5fc89
JH		 2414 if (!chan->tx_credits)
2415 return -EAGAIN;
2416
177f8f2b
JH		 2417 __skb_queue_head_init(&seg_queue);
2418
2419 err = l2cap_segment_le_sdu(chan, &seg_queue, msg, len);
2420
2421 if (chan->state != BT_CONNECTED) {
2422 __skb_queue_purge(&seg_queue);
2423 err = -ENOTCONN;
2424 }
2425
2426 if (err)
2427 return err;
2428
2429 skb_queue_splice_tail_init(&seg_queue, &chan->tx_q);
2430
2431 while (chan->tx_credits && !skb_queue_empty(&chan->tx_q)) {
2432 l2cap_do_send(chan, skb_dequeue(&chan->tx_q));
2433 chan->tx_credits--;
2434 }
2435
2436 if (!chan->tx_credits)
2437 chan->ops->suspend(chan);
2438
2439 err = len;
2440
2441 break;
2442
fad5fc89 2443 case L2CAP_MODE_BASIC:
9a91a04a
GP		 2444 /* Check outgoing MTU */
2445 if (len > chan->omtu)
2446 return -EMSGSIZE;
2447
2448 /* Create a basic PDU */
8d46321c 2449 skb = l2cap_create_basic_pdu(chan, msg, len);
9a91a04a
GP		 2450 if (IS_ERR(skb))
2451 return PTR_ERR(skb);
2452
ede81a2a
AK		 2453 /* Channel lock is released before requesting new skb and then
2454 * reacquired thus we need to recheck channel state.
2455 */
2456 if (chan->state != BT_CONNECTED) {
2457 kfree_skb(skb);
2458 return -ENOTCONN;
2459 }
2460
9a91a04a
GP		 2461 l2cap_do_send(chan, skb);
2462 err = len;
2463 break;
2464
2465 case L2CAP_MODE_ERTM:
2466 case L2CAP_MODE_STREAMING:
94122bbe
MM		 2467 /* Check outgoing MTU */
2468 if (len > chan->omtu) {
2469 err = -EMSGSIZE;
2470 break;
2471 }
9a91a04a 2472
94122bbe 2473 __skb_queue_head_init(&seg_queue);
9a91a04a 2474
94122bbe
MM		 2475 /* Do segmentation before calling in to the state machine,
2476 * since it's possible to block while waiting for memory
2477 * allocation.
2478 */
2479 err = l2cap_segment_sdu(chan, &seg_queue, msg, len);
9a91a04a 2480
94122bbe
MM		 2481 /* The channel could have been closed while segmenting,
2482 * check that it is still connected.
2483 */
2484 if (chan->state != BT_CONNECTED) {
2485 __skb_queue_purge(&seg_queue);
2486 err = -ENOTCONN;
9a91a04a
GP		 2487 }
2488
94122bbe 2489 if (err)
9a91a04a 2490 break;
9a91a04a 2491
3733937d 2492 if (chan->mode == L2CAP_MODE_ERTM)
d660366d 2493 l2cap_tx(chan, NULL, &seg_queue, L2CAP_EV_DATA_REQUEST);
3733937d 2494 else
d660366d 2495 l2cap_streaming_send(chan, &seg_queue);
9a91a04a 2496
d660366d 2497 err = len;
9a91a04a 2498
94122bbe
MM		 2499 /* If the skbs were not queued for sending, they'll still be in
2500 * seg_queue and need to be purged.
2501 */
2502 __skb_queue_purge(&seg_queue);
9a91a04a
GP		 2503 break;
2504
2505 default:
2506 BT_DBG("bad state %1.1x", chan->mode);
2507 err = -EBADFD;
2508 }
2509
2510 return err;
2511}
6b8d4a6a 2512EXPORT_SYMBOL_GPL(l2cap_chan_send);
9a91a04a 2513
d2a7ac5d
MM		 2514static void l2cap_send_srej(struct l2cap_chan *chan, u16 txseq)
2515{
bed68bde
MM		 2516 struct l2cap_ctrl control;
2517 u16 seq;
2518
b4400672 2519 BT_DBG("chan %p, txseq %u", chan, txseq);
bed68bde
MM		 2520
2521 memset(&control, 0, sizeof(control));
2522 control.sframe = 1;
2523 control.super = L2CAP_SUPER_SREJ;
2524
2525 for (seq = chan->expected_tx_seq; seq != txseq;
2526 seq = __next_seq(chan, seq)) {
2527 if (!l2cap_ertm_seq_in_queue(&chan->srej_q, seq)) {
2528 control.reqseq = seq;
2529 l2cap_send_sframe(chan, &control);
2530 l2cap_seq_list_append(&chan->srej_list, seq);
2531 }
2532 }
2533
2534 chan->expected_tx_seq = __next_seq(chan, txseq);
d2a7ac5d
MM		 2535}
2536
2537static void l2cap_send_srej_tail(struct l2cap_chan *chan)
2538{
bed68bde
MM		 2539 struct l2cap_ctrl control;
2540
2541 BT_DBG("chan %p", chan);
2542
2543 if (chan->srej_list.tail == L2CAP_SEQ_LIST_CLEAR)
2544 return;
2545
2546 memset(&control, 0, sizeof(control));
2547 control.sframe = 1;
2548 control.super = L2CAP_SUPER_SREJ;
2549 control.reqseq = chan->srej_list.tail;
2550 l2cap_send_sframe(chan, &control);
d2a7ac5d
MM		 2551}
2552
2553static void l2cap_send_srej_list(struct l2cap_chan *chan, u16 txseq)
2554{
bed68bde
MM		 2555 struct l2cap_ctrl control;
2556 u16 initial_head;
2557 u16 seq;
2558
b4400672 2559 BT_DBG("chan %p, txseq %u", chan, txseq);
bed68bde
MM		 2560
2561 memset(&control, 0, sizeof(control));
2562 control.sframe = 1;
2563 control.super = L2CAP_SUPER_SREJ;
2564
2565 /* Capture initial list head to allow only one pass through the list. */
2566 initial_head = chan->srej_list.head;
2567
2568 do {
2569 seq = l2cap_seq_list_pop(&chan->srej_list);
2570 if (seq == txseq || seq == L2CAP_SEQ_LIST_CLEAR)
2571 break;
2572
2573 control.reqseq = seq;
2574 l2cap_send_sframe(chan, &control);
2575 l2cap_seq_list_append(&chan->srej_list, seq);
2576 } while (chan->srej_list.head != initial_head);
d2a7ac5d
MM		 2577}
2578
608bcc6d
MM		 2579static void l2cap_process_reqseq(struct l2cap_chan *chan, u16 reqseq)
2580{
2581 struct sk_buff *acked_skb;
2582 u16 ackseq;
2583
b4400672 2584 BT_DBG("chan %p, reqseq %u", chan, reqseq);
608bcc6d
MM		 2585
2586 if (chan->unacked_frames == 0 || reqseq == chan->expected_ack_seq)
2587 return;
2588
b4400672 2589 BT_DBG("expected_ack_seq %u, unacked_frames %u",
608bcc6d
MM		 2590 chan->expected_ack_seq, chan->unacked_frames);
2591
2592 for (ackseq = chan->expected_ack_seq; ackseq != reqseq;
2593 ackseq = __next_seq(chan, ackseq)) {
2594
2595 acked_skb = l2cap_ertm_seq_in_queue(&chan->tx_q, ackseq);
2596 if (acked_skb) {
2597 skb_unlink(acked_skb, &chan->tx_q);
2598 kfree_skb(acked_skb);
2599 chan->unacked_frames--;
2600 }
2601 }
2602
2603 chan->expected_ack_seq = reqseq;
2604
2605 if (chan->unacked_frames == 0)
2606 __clear_retrans_timer(chan);
2607
b4400672 2608 BT_DBG("unacked_frames %u", chan->unacked_frames);
608bcc6d
MM		 2609}
2610
2611static void l2cap_abort_rx_srej_sent(struct l2cap_chan *chan)
2612{
2613 BT_DBG("chan %p", chan);
2614
2615 chan->expected_tx_seq = chan->buffer_seq;
2616 l2cap_seq_list_clear(&chan->srej_list);
2617 skb_queue_purge(&chan->srej_q);
2618 chan->rx_state = L2CAP_RX_STATE_RECV;
2619}
2620
d660366d
GP		 2621static void l2cap_tx_state_xmit(struct l2cap_chan *chan,
2622 struct l2cap_ctrl *control,
2623 struct sk_buff_head *skbs, u8 event)
608bcc6d 2624{
608bcc6d
MM		 2625 BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,
2626 event);
2627
2628 switch (event) {
2629 case L2CAP_EV_DATA_REQUEST:
2630 if (chan->tx_send_head == NULL)
2631 chan->tx_send_head = skb_peek(skbs);
2632
2633 skb_queue_splice_tail_init(skbs, &chan->tx_q);
2634 l2cap_ertm_send(chan);
2635 break;
2636 case L2CAP_EV_LOCAL_BUSY_DETECTED:
2637 BT_DBG("Enter LOCAL_BUSY");
2638 set_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2639
2640 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
2641 /* The SREJ_SENT state must be aborted if we are to
2642 * enter the LOCAL_BUSY state.
2643 */
2644 l2cap_abort_rx_srej_sent(chan);
2645 }
2646
2647 l2cap_send_ack(chan);
2648
2649 break;
2650 case L2CAP_EV_LOCAL_BUSY_CLEAR:
2651 BT_DBG("Exit LOCAL_BUSY");
2652 clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2653
2654 if (test_bit(CONN_RNR_SENT, &chan->conn_state)) {
2655 struct l2cap_ctrl local_control;
2656
2657 memset(&local_control, 0, sizeof(local_control));
2658 local_control.sframe = 1;
2659 local_control.super = L2CAP_SUPER_RR;
2660 local_control.poll = 1;
2661 local_control.reqseq = chan->buffer_seq;
a67d7f6f 2662 l2cap_send_sframe(chan, &local_control);
608bcc6d
MM		 2663
2664 chan->retry_count = 1;
2665 __set_monitor_timer(chan);
2666 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2667 }
2668 break;
2669 case L2CAP_EV_RECV_REQSEQ_AND_FBIT:
2670 l2cap_process_reqseq(chan, control->reqseq);
2671 break;
2672 case L2CAP_EV_EXPLICIT_POLL:
2673 l2cap_send_rr_or_rnr(chan, 1);
2674 chan->retry_count = 1;
2675 __set_monitor_timer(chan);
2676 __clear_ack_timer(chan);
2677 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2678 break;
2679 case L2CAP_EV_RETRANS_TO:
2680 l2cap_send_rr_or_rnr(chan, 1);
2681 chan->retry_count = 1;
2682 __set_monitor_timer(chan);
2683 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2684 break;
2685 case L2CAP_EV_RECV_FBIT:
2686 /* Nothing to process */
2687 break;
2688 default:
2689 break;
2690 }
608bcc6d
MM		 2691}
2692
d660366d
GP		 2693static void l2cap_tx_state_wait_f(struct l2cap_chan *chan,
2694 struct l2cap_ctrl *control,
2695 struct sk_buff_head *skbs, u8 event)
608bcc6d 2696{
608bcc6d
MM		 2697 BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,
2698 event);
2699
2700 switch (event) {
2701 case L2CAP_EV_DATA_REQUEST:
2702 if (chan->tx_send_head == NULL)
2703 chan->tx_send_head = skb_peek(skbs);
2704 /* Queue data, but don't send. */
2705 skb_queue_splice_tail_init(skbs, &chan->tx_q);
2706 break;
2707 case L2CAP_EV_LOCAL_BUSY_DETECTED:
2708 BT_DBG("Enter LOCAL_BUSY");
2709 set_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2710
2711 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
2712 /* The SREJ_SENT state must be aborted if we are to
2713 * enter the LOCAL_BUSY state.
2714 */
2715 l2cap_abort_rx_srej_sent(chan);
2716 }
2717
2718 l2cap_send_ack(chan);
2719
2720 break;
2721 case L2CAP_EV_LOCAL_BUSY_CLEAR:
2722 BT_DBG("Exit LOCAL_BUSY");
2723 clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2724
2725 if (test_bit(CONN_RNR_SENT, &chan->conn_state)) {
2726 struct l2cap_ctrl local_control;
2727 memset(&local_control, 0, sizeof(local_control));
2728 local_control.sframe = 1;
2729 local_control.super = L2CAP_SUPER_RR;
2730 local_control.poll = 1;
2731 local_control.reqseq = chan->buffer_seq;
a67d7f6f 2732 l2cap_send_sframe(chan, &local_control);
608bcc6d
MM		 2733
2734 chan->retry_count = 1;
2735 __set_monitor_timer(chan);
2736 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2737 }
2738 break;
2739 case L2CAP_EV_RECV_REQSEQ_AND_FBIT:
2740 l2cap_process_reqseq(chan, control->reqseq);
2741
2742 /* Fall through */
2743
2744 case L2CAP_EV_RECV_FBIT:
2745 if (control && control->final) {
2746 __clear_monitor_timer(chan);
2747 if (chan->unacked_frames > 0)
2748 __set_retrans_timer(chan);
2749 chan->retry_count = 0;
2750 chan->tx_state = L2CAP_TX_STATE_XMIT;
2751 BT_DBG("recv fbit tx_state 0x2.2%x", chan->tx_state);
2752 }
2753 break;
2754 case L2CAP_EV_EXPLICIT_POLL:
2755 /* Ignore */
2756 break;
2757 case L2CAP_EV_MONITOR_TO:
2758 if (chan->max_tx == 0 || chan->retry_count < chan->max_tx) {
2759 l2cap_send_rr_or_rnr(chan, 1);
2760 __set_monitor_timer(chan);
2761 chan->retry_count++;
2762 } else {
5e4e3972 2763 l2cap_send_disconn_req(chan, ECONNABORTED);
608bcc6d
MM		 2764 }
2765 break;
2766 default:
2767 break;
2768 }
608bcc6d
MM		 2769}
2770
d660366d
GP		 2771static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
2772 struct sk_buff_head *skbs, u8 event)
608bcc6d 2773{
608bcc6d
MM		 2774 BT_DBG("chan %p, control %p, skbs %p, event %d, state %d",
2775 chan, control, skbs, event, chan->tx_state);
2776
2777 switch (chan->tx_state) {
2778 case L2CAP_TX_STATE_XMIT:
d660366d 2779 l2cap_tx_state_xmit(chan, control, skbs, event);
608bcc6d
MM		 2780 break;
2781 case L2CAP_TX_STATE_WAIT_F:
d660366d 2782 l2cap_tx_state_wait_f(chan, control, skbs, event);
608bcc6d
MM		 2783 break;
2784 default:
2785 /* Ignore event */
2786 break;
2787 }
608bcc6d
MM		 2788}
2789
4b51dae9
MM		 2790static void l2cap_pass_to_tx(struct l2cap_chan *chan,
2791 struct l2cap_ctrl *control)
2792{
2793 BT_DBG("chan %p, control %p", chan, control);
401bb1f7 2794 l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_REQSEQ_AND_FBIT);
4b51dae9
MM		 2795}
2796
f80842a8
MM		 2797static void l2cap_pass_to_tx_fbit(struct l2cap_chan *chan,
2798 struct l2cap_ctrl *control)
2799{
2800 BT_DBG("chan %p, control %p", chan, control);
401bb1f7 2801 l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_FBIT);
f80842a8
MM		 2802}
2803
1da177e4
LT		 2804/* Copy frame to all raw sockets on that connection */
2805static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb)
2806{
1da177e4 2807 struct sk_buff *nskb;
48454079 2808 struct l2cap_chan *chan;
1da177e4
LT		 2809
2810 BT_DBG("conn %p", conn);
2811
3df91ea2 2812 mutex_lock(&conn->chan_lock);
3d57dc68 2813
3df91ea2 2814 list_for_each_entry(chan, &conn->chan_l, list) {
715ec005 2815 if (chan->chan_type != L2CAP_CHAN_RAW)
1da177e4
LT		 2816 continue;
2817
7f5396a7
GP		 2818 /* Don't send frame to the channel it came from */
2819 if (bt_cb(skb)->chan == chan)
1da177e4 2820 continue;
7f5396a7 2821
8bcde1f2 2822 nskb = skb_clone(skb, GFP_KERNEL);
af05b30b 2823 if (!nskb)
1da177e4 2824 continue;
80b98027 2825 if (chan->ops->recv(chan, nskb))
1da177e4
LT		 2826 kfree_skb(nskb);
2827 }
3d57dc68 2828
3df91ea2 2829 mutex_unlock(&conn->chan_lock);
1da177e4
LT		 2830}
2831
2832/* ---- L2CAP signalling commands ---- */
b4400672
AE		 2833static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn, u8 code,
2834 u8 ident, u16 dlen, void *data)
1da177e4
LT		 2835{
2836 struct sk_buff *skb, **frag;
2837 struct l2cap_cmd_hdr *cmd;
2838 struct l2cap_hdr *lh;
2839 int len, count;
2840
b4400672
AE		 2841 BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %u",
2842 conn, code, ident, dlen);
1da177e4 2843
300b962e
AL		 2844 if (conn->mtu < L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE)
2845 return NULL;
2846
1da177e4
LT		 2847 len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen;
2848 count = min_t(unsigned int, conn->mtu, len);
2849
8bcde1f2 2850 skb = bt_skb_alloc(count, GFP_KERNEL);
1da177e4
LT		 2851 if (!skb)
2852 return NULL;
2853
2854 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
aca3192c 2855 lh->len = cpu_to_le16(L2CAP_CMD_HDR_SIZE + dlen);
3300d9a9
CT		 2856
2857 if (conn->hcon->type == LE_LINK)
dcf4adbf 2858 lh->cid = cpu_to_le16(L2CAP_CID_LE_SIGNALING);
3300d9a9 2859 else
dcf4adbf 2860 lh->cid = cpu_to_le16(L2CAP_CID_SIGNALING);
1da177e4
LT		 2861
2862 cmd = (struct l2cap_cmd_hdr *) skb_put(skb, L2CAP_CMD_HDR_SIZE);
2863 cmd->code = code;
2864 cmd->ident = ident;
aca3192c 2865 cmd->len = cpu_to_le16(dlen);
1da177e4
LT		 2866
2867 if (dlen) {
2868 count -= L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE;
2869 memcpy(skb_put(skb, count), data, count);
2870 data += count;
2871 }
2872
2873 len -= skb->len;
2874
2875 /* Continuation fragments (no L2CAP header) */
2876 frag = &skb_shinfo(skb)->frag_list;
2877 while (len) {
2878 count = min_t(unsigned int, conn->mtu, len);
2879
8bcde1f2 2880 *frag = bt_skb_alloc(count, GFP_KERNEL);
1da177e4
LT		 2881 if (!*frag)
2882 goto fail;
2883
2884 memcpy(skb_put(*frag, count), data, count);
2885
2886 len -= count;
2887 data += count;
2888
2889 frag = &(*frag)->next;
2890 }
2891
2892 return skb;
2893
2894fail:
2895 kfree_skb(skb);
2896 return NULL;
2897}
2898
2d792818
GP		 2899static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen,
2900 unsigned long *val)
1da177e4
LT		 2901{
2902 struct l2cap_conf_opt *opt = *ptr;
2903 int len;
2904
2905 len = L2CAP_CONF_OPT_SIZE + opt->len;
2906 *ptr += len;
2907
2908 *type = opt->type;
2909 *olen = opt->len;
2910
2911 switch (opt->len) {
2912 case 1:
2913 *val = *((u8 *) opt->val);
2914 break;
2915
2916 case 2:
bfaaeb3e 2917 *val = get_unaligned_le16(opt->val);
1da177e4
LT		 2918 break;
2919
2920 case 4:
bfaaeb3e 2921 *val = get_unaligned_le32(opt->val);
1da177e4
LT		 2922 break;
2923
2924 default:
2925 *val = (unsigned long) opt->val;
2926 break;
2927 }
2928
b4400672 2929 BT_DBG("type 0x%2.2x len %u val 0x%lx", *type, opt->len, *val);
1da177e4
LT		 2930 return len;
2931}
2932
1da177e4
LT		 2933static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val)
2934{
2935 struct l2cap_conf_opt *opt = *ptr;
2936
b4400672 2937 BT_DBG("type 0x%2.2x len %u val 0x%lx", type, len, val);
1da177e4
LT		 2938
2939 opt->type = type;
2940 opt->len = len;
2941
2942 switch (len) {
2943 case 1:
2944 *((u8 *) opt->val) = val;
2945 break;
2946
2947 case 2:
4f8b691c 2948 put_unaligned_le16(val, opt->val);
1da177e4
LT		 2949 break;
2950
2951 case 4:
4f8b691c 2952 put_unaligned_le32(val, opt->val);
1da177e4
LT		 2953 break;
2954
2955 default:
2956 memcpy(opt->val, (void *) val, len);
2957 break;
2958 }
2959
2960 *ptr += L2CAP_CONF_OPT_SIZE + len;
2961}
2962
f89cef09
AE		 2963static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan)
2964{
2965 struct l2cap_conf_efs efs;
2966
1ec918ce 2967 switch (chan->mode) {
f89cef09
AE		 2968 case L2CAP_MODE_ERTM:
2969 efs.id = chan->local_id;
2970 efs.stype = chan->local_stype;
2971 efs.msdu = cpu_to_le16(chan->local_msdu);
2972 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime);
dcf4adbf
JP		 2973 efs.acc_lat = cpu_to_le32(L2CAP_DEFAULT_ACC_LAT);
2974 efs.flush_to = cpu_to_le32(L2CAP_EFS_DEFAULT_FLUSH_TO);
f89cef09
AE		 2975 break;
2976
2977 case L2CAP_MODE_STREAMING:
2978 efs.id = 1;
2979 efs.stype = L2CAP_SERV_BESTEFFORT;
2980 efs.msdu = cpu_to_le16(chan->local_msdu);
2981 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime);
2982 efs.acc_lat = 0;
2983 efs.flush_to = 0;
2984 break;
2985
2986 default:
2987 return;
2988 }
2989
2990 l2cap_add_conf_opt(ptr, L2CAP_CONF_EFS, sizeof(efs),
8936fa6d 2991 (unsigned long) &efs);
f89cef09
AE		 2992}
2993
721c4181 2994static void l2cap_ack_timeout(struct work_struct *work)
c1b4f43b 2995{
721c4181 2996 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
0362520b
MM		 2997 ack_timer.work);
2998 u16 frames_to_ack;
c1b4f43b 2999
2fb9b3d4
GP		 3000 BT_DBG("chan %p", chan);
3001
6be36555
AE		 3002 l2cap_chan_lock(chan);
3003
0362520b
MM		 3004 frames_to_ack = __seq_offset(chan, chan->buffer_seq,
3005 chan->last_acked_seq);
6be36555 3006
0362520b
MM		 3007 if (frames_to_ack)
3008 l2cap_send_rr_or_rnr(chan, 0);
09bfb2ee 3009
0362520b 3010 l2cap_chan_unlock(chan);
09bfb2ee 3011 l2cap_chan_put(chan);
c1b4f43b
GP		 3012}
3013
466f8004 3014int l2cap_ertm_init(struct l2cap_chan *chan)
0565c1c2 3015{
3c588192
MM		 3016 int err;
3017
105bdf9e
MM		 3018 chan->next_tx_seq = 0;
3019 chan->expected_tx_seq = 0;
42e5c802 3020 chan->expected_ack_seq = 0;
6a026610 3021 chan->unacked_frames = 0;
42e5c802 3022 chan->buffer_seq = 0;
6a026610 3023 chan->frames_sent = 0;
105bdf9e
MM		 3024 chan->last_acked_seq = 0;
3025 chan->sdu = NULL;
3026 chan->sdu_last_frag = NULL;
3027 chan->sdu_len = 0;
3028
d34c34fb
MM		 3029 skb_queue_head_init(&chan->tx_q);
3030
6ed971ca
MH		 3031 chan->local_amp_id = AMP_ID_BREDR;
3032 chan->move_id = AMP_ID_BREDR;
08333283
MM		 3033 chan->move_state = L2CAP_MOVE_STABLE;
3034 chan->move_role = L2CAP_MOVE_ROLE_NONE;
3035
105bdf9e
MM		 3036 if (chan->mode != L2CAP_MODE_ERTM)
3037 return 0;
3038
3039 chan->rx_state = L2CAP_RX_STATE_RECV;
3040 chan->tx_state = L2CAP_TX_STATE_XMIT;
0565c1c2 3041
721c4181
GP		 3042 INIT_DELAYED_WORK(&chan->retrans_timer, l2cap_retrans_timeout);
3043 INIT_DELAYED_WORK(&chan->monitor_timer, l2cap_monitor_timeout);
3044 INIT_DELAYED_WORK(&chan->ack_timer, l2cap_ack_timeout);
0565c1c2 3045
f1c6775b 3046 skb_queue_head_init(&chan->srej_q);
1890d36b 3047
3c588192
MM		 3048 err = l2cap_seq_list_init(&chan->srej_list, chan->tx_win);
3049 if (err < 0)
3050 return err;
3051
9dc9affc
MM		 3052 err = l2cap_seq_list_init(&chan->retrans_list, chan->remote_tx_win);
3053 if (err < 0)
3054 l2cap_seq_list_free(&chan->srej_list);
3055
3056 return err;
0565c1c2
GP		 3057}
3058
f2fcfcd6
GP		 3059static inline __u8 l2cap_select_mode(__u8 mode, __u16 remote_feat_mask)
3060{
3061 switch (mode) {
3062 case L2CAP_MODE_STREAMING:
3063 case L2CAP_MODE_ERTM:
3064 if (l2cap_mode_supported(mode, remote_feat_mask))
3065 return mode;
3066 /* fall through */
3067 default:
3068 return L2CAP_MODE_BASIC;
3069 }
3070}
3071
848566b3 3072static inline bool __l2cap_ews_supported(struct l2cap_conn *conn)
6327eb98 3073{
848566b3 3074 return conn->hs_enabled && conn->feat_mask & L2CAP_FEAT_EXT_WINDOW;
6327eb98
AE		 3075}
3076
848566b3 3077static inline bool __l2cap_efs_supported(struct l2cap_conn *conn)
f89cef09 3078{
848566b3 3079 return conn->hs_enabled && conn->feat_mask & L2CAP_FEAT_EXT_FLOW;
f89cef09
AE		 3080}
3081
36c86c85
MM		 3082static void __l2cap_set_ertm_timeouts(struct l2cap_chan *chan,
3083 struct l2cap_conf_rfc *rfc)
3084{
6ed971ca 3085 if (chan->local_amp_id != AMP_ID_BREDR && chan->hs_hcon) {
36c86c85
MM		 3086 u64 ertm_to = chan->hs_hcon->hdev->amp_be_flush_to;
3087
3088 /* Class 1 devices have must have ERTM timeouts
3089 * exceeding the Link Supervision Timeout. The
3090 * default Link Supervision Timeout for AMP
3091 * controllers is 10 seconds.
3092 *
3093 * Class 1 devices use 0xffffffff for their
3094 * best-effort flush timeout, so the clamping logic
3095 * will result in a timeout that meets the above
3096 * requirement. ERTM timeouts are 16-bit values, so
3097 * the maximum timeout is 65.535 seconds.
3098 */
3099
3100 /* Convert timeout to milliseconds and round */
3101 ertm_to = DIV_ROUND_UP_ULL(ertm_to, 1000);
3102
3103 /* This is the recommended formula for class 2 devices
3104 * that start ERTM timers when packets are sent to the
3105 * controller.
3106 */
3107 ertm_to = 3 * ertm_to + 500;
3108
3109 if (ertm_to > 0xffff)
3110 ertm_to = 0xffff;
3111
3112 rfc->retrans_timeout = cpu_to_le16((u16) ertm_to);
3113 rfc->monitor_timeout = rfc->retrans_timeout;
3114 } else {
dcf4adbf
JP		 3115 rfc->retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO);
3116 rfc->monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO);
36c86c85
MM		 3117 }
3118}
3119
6327eb98
AE		 3120static inline void l2cap_txwin_setup(struct l2cap_chan *chan)
3121{
3122 if (chan->tx_win > L2CAP_DEFAULT_TX_WINDOW &&
848566b3 3123 __l2cap_ews_supported(chan->conn)) {
6327eb98
AE		 3124 /* use extended control field */
3125 set_bit(FLAG_EXT_CTRL, &chan->flags);
836be934
AE		 3126 chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;
3127 } else {
6327eb98 3128 chan->tx_win = min_t(u16, chan->tx_win,
2d792818 3129 L2CAP_DEFAULT_TX_WINDOW);
836be934
AE		 3130 chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
3131 }
c20f8e35 3132 chan->ack_win = chan->tx_win;
6327eb98
AE		 3133}
3134
710f9b0a 3135static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data)
1da177e4 3136{
1da177e4 3137 struct l2cap_conf_req *req = data;
0c1bc5c6 3138 struct l2cap_conf_rfc rfc = { .mode = chan->mode };
1da177e4 3139 void *ptr = req->data;
c8f79162 3140 u16 size;
1da177e4 3141
49208c9c 3142 BT_DBG("chan %p", chan);
1da177e4 3143
73ffa904 3144 if (chan->num_conf_req || chan->num_conf_rsp)
f2fcfcd6
GP		 3145 goto done;
3146
0c1bc5c6 3147 switch (chan->mode) {
f2fcfcd6
GP		 3148 case L2CAP_MODE_STREAMING:
3149 case L2CAP_MODE_ERTM:
c1360a1c 3150 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state))
85eb53c6 3151 break;
85eb53c6 3152
848566b3 3153 if (__l2cap_efs_supported(chan->conn))
f89cef09
AE		 3154 set_bit(FLAG_EFS_ENABLE, &chan->flags);
3155
2ba13ed6 3156 /* fall through */
f2fcfcd6 3157 default:
8c1d787b 3158 chan->mode = l2cap_select_mode(rfc.mode, chan->conn->feat_mask);
f2fcfcd6
GP		 3159 break;
3160 }
3161
3162done:
0c1bc5c6
GP		 3163 if (chan->imtu != L2CAP_DEFAULT_MTU)
3164 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu);
7990681c 3165
0c1bc5c6 3166 switch (chan->mode) {
65c7c491 3167 case L2CAP_MODE_BASIC:
6fea7ad1
MH		 3168 if (disable_ertm)
3169 break;
3170
8c1d787b 3171 if (!(chan->conn->feat_mask & L2CAP_FEAT_ERTM) &&
2d792818 3172 !(chan->conn->feat_mask & L2CAP_FEAT_STREAMING))
63406504
GP		 3173 break;
3174
62547752
GP		 3175 rfc.mode = L2CAP_MODE_BASIC;
3176 rfc.txwin_size = 0;
3177 rfc.max_transmit = 0;
3178 rfc.retrans_timeout = 0;
3179 rfc.monitor_timeout = 0;
3180 rfc.max_pdu_size = 0;
3181
63406504 3182 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
2d792818 3183 (unsigned long) &rfc);
65c7c491
MH		 3184 break;
3185
3186 case L2CAP_MODE_ERTM:
3187 rfc.mode = L2CAP_MODE_ERTM;
47d1ec61 3188 rfc.max_transmit = chan->max_tx;
36c86c85
MM		 3189
3190 __l2cap_set_ertm_timeouts(chan, &rfc);
c8f79162
AE		 3191
3192 size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -
2d792818
GP		 3193 L2CAP_EXT_HDR_SIZE - L2CAP_SDULEN_SIZE -
3194 L2CAP_FCS_SIZE);
c8f79162 3195 rfc.max_pdu_size = cpu_to_le16(size);
f2fcfcd6 3196
6327eb98
AE		 3197 l2cap_txwin_setup(chan);
3198
3199 rfc.txwin_size = min_t(u16, chan->tx_win,
2d792818 3200 L2CAP_DEFAULT_TX_WINDOW);
f2fcfcd6 3201
63406504 3202 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
2d792818 3203 (unsigned long) &rfc);
63406504 3204
f89cef09
AE		 3205 if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
3206 l2cap_add_opt_efs(&ptr, chan);
3207
6327eb98
AE		 3208 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
3209 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
2d792818 3210 chan->tx_win);
60918918
AE		 3211
3212 if (chan->conn->feat_mask & L2CAP_FEAT_FCS)
3213 if (chan->fcs == L2CAP_FCS_NONE ||
f2592d3e 3214 test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) {
60918918
AE		 3215 chan->fcs = L2CAP_FCS_NONE;
3216 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1,
3217 chan->fcs);
3218 }
f2fcfcd6
GP		 3219 break;
3220
3221 case L2CAP_MODE_STREAMING:
273759e2 3222 l2cap_txwin_setup(chan);
f2fcfcd6
GP		 3223 rfc.mode = L2CAP_MODE_STREAMING;
3224 rfc.txwin_size = 0;
3225 rfc.max_transmit = 0;
3226 rfc.retrans_timeout = 0;
3227 rfc.monitor_timeout = 0;
c8f79162
AE		 3228
3229 size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -
2d792818
GP		 3230 L2CAP_EXT_HDR_SIZE - L2CAP_SDULEN_SIZE -
3231 L2CAP_FCS_SIZE);
c8f79162 3232 rfc.max_pdu_size = cpu_to_le16(size);
65c7c491 3233
63406504 3234 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
2d792818 3235 (unsigned long) &rfc);
63406504 3236
f89cef09
AE		 3237 if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
3238 l2cap_add_opt_efs(&ptr, chan);
3239
60918918
AE		 3240 if (chan->conn->feat_mask & L2CAP_FEAT_FCS)
3241 if (chan->fcs == L2CAP_FCS_NONE ||
f2592d3e 3242 test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) {
60918918
AE		 3243 chan->fcs = L2CAP_FCS_NONE;
3244 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1,
3245 chan->fcs);
3246 }
65c7c491
MH		 3247 break;
3248 }
1da177e4 3249
fe4128e0 3250 req->dcid = cpu_to_le16(chan->dcid);
dcf4adbf 3251 req->flags = cpu_to_le16(0);
1da177e4
LT		 3252
3253 return ptr - data;
3254}
3255
73ffa904 3256static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data)
1da177e4 3257{
5dee9e7c
MH		 3258 struct l2cap_conf_rsp *rsp = data;
3259 void *ptr = rsp->data;
73ffa904
GP		 3260 void *req = chan->conf_req;
3261 int len = chan->conf_len;
5dee9e7c
MH		 3262 int type, hint, olen;
3263 unsigned long val;
6464f35f 3264 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
42dceae2
AE		 3265 struct l2cap_conf_efs efs;
3266 u8 remote_efs = 0;
861d6882 3267 u16 mtu = L2CAP_DEFAULT_MTU;
5dee9e7c 3268 u16 result = L2CAP_CONF_SUCCESS;
c8f79162 3269 u16 size;
1da177e4 3270
73ffa904 3271 BT_DBG("chan %p", chan);
820ae1b8 3272
5dee9e7c
MH		 3273 while (len >= L2CAP_CONF_OPT_SIZE) {
3274 len -= l2cap_get_conf_opt(&req, &type, &olen, &val);
1da177e4 3275
589d2746 3276 hint = type & L2CAP_CONF_HINT;
47ec1dcd 3277 type &= L2CAP_CONF_MASK;
5dee9e7c
MH		 3278
3279 switch (type) {
3280 case L2CAP_CONF_MTU:
861d6882 3281 mtu = val;
5dee9e7c
MH		 3282 break;
3283
3284 case L2CAP_CONF_FLUSH_TO:
0c1bc5c6 3285 chan->flush_to = val;
5dee9e7c
MH		 3286 break;
3287
3288 case L2CAP_CONF_QOS:
3289 break;
3290
6464f35f
MH		 3291 case L2CAP_CONF_RFC:
3292 if (olen == sizeof(rfc))
3293 memcpy(&rfc, (void *) val, olen);
3294 break;
3295
fcc203c3
GP		 3296 case L2CAP_CONF_FCS:
3297 if (val == L2CAP_FCS_NONE)
f2592d3e 3298 set_bit(CONF_RECV_NO_FCS, &chan->conf_state);
42dceae2 3299 break;
fcc203c3 3300
42dceae2
AE		 3301 case L2CAP_CONF_EFS:
3302 remote_efs = 1;
3303 if (olen == sizeof(efs))
3304 memcpy(&efs, (void *) val, olen);
fcc203c3
GP		 3305 break;
3306
6327eb98 3307 case L2CAP_CONF_EWS:
848566b3 3308 if (!chan->conn->hs_enabled)
6327eb98 3309 return -ECONNREFUSED;
fcc203c3 3310
6327eb98
AE		 3311 set_bit(FLAG_EXT_CTRL, &chan->flags);
3312 set_bit(CONF_EWS_RECV, &chan->conf_state);
836be934 3313 chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;
6327eb98 3314 chan->remote_tx_win = val;
fcc203c3
GP		 3315 break;
3316
5dee9e7c
MH		 3317 default:
3318 if (hint)
3319 break;
3320
3321 result = L2CAP_CONF_UNKNOWN;
3322 *((u8 *) ptr++) = type;
3323 break;
3324 }
3325 }
3326
73ffa904 3327 if (chan->num_conf_rsp || chan->num_conf_req > 1)
f2fcfcd6
GP		 3328 goto done;
3329
0c1bc5c6 3330 switch (chan->mode) {
f2fcfcd6
GP		 3331 case L2CAP_MODE_STREAMING:
3332 case L2CAP_MODE_ERTM:
c1360a1c 3333 if (!test_bit(CONF_STATE2_DEVICE, &chan->conf_state)) {
0c1bc5c6 3334 chan->mode = l2cap_select_mode(rfc.mode,
2d792818 3335 chan->conn->feat_mask);
85eb53c6
GP		 3336 break;
3337 }
3338
42dceae2 3339 if (remote_efs) {
848566b3 3340 if (__l2cap_efs_supported(chan->conn))
42dceae2
AE		 3341 set_bit(FLAG_EFS_ENABLE, &chan->flags);
3342 else
3343 return -ECONNREFUSED;
3344 }
3345
0c1bc5c6 3346 if (chan->mode != rfc.mode)
f2fcfcd6 3347 return -ECONNREFUSED;
742e519b 3348
f2fcfcd6 3349 break;
f2fcfcd6
GP		 3350 }
3351
3352done:
0c1bc5c6 3353 if (chan->mode != rfc.mode) {
f2fcfcd6 3354 result = L2CAP_CONF_UNACCEPT;
0c1bc5c6 3355 rfc.mode = chan->mode;
f2fcfcd6 3356
73ffa904 3357 if (chan->num_conf_rsp == 1)
f2fcfcd6
GP		 3358 return -ECONNREFUSED;
3359
2d792818
GP		 3360 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3361 (unsigned long) &rfc);
f2fcfcd6
GP		 3362 }
3363
5dee9e7c
MH		 3364 if (result == L2CAP_CONF_SUCCESS) {
3365 /* Configure output options and let the other side know
3366 * which ones we don't like. */
3367
f2fcfcd6
GP		 3368 if (mtu < L2CAP_DEFAULT_MIN_MTU)
3369 result = L2CAP_CONF_UNACCEPT;
3370 else {
0c1bc5c6 3371 chan->omtu = mtu;
c1360a1c 3372 set_bit(CONF_MTU_DONE, &chan->conf_state);
f2fcfcd6 3373 }
0c1bc5c6 3374 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu);
6464f35f 3375
42dceae2
AE		 3376 if (remote_efs) {
3377 if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
2d792818
GP		 3378 efs.stype != L2CAP_SERV_NOTRAFIC &&
3379 efs.stype != chan->local_stype) {
42dceae2
AE		 3380
3381 result = L2CAP_CONF_UNACCEPT;
3382
3383 if (chan->num_conf_req >= 1)
3384 return -ECONNREFUSED;
3385
3386 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
2d792818
GP		 3387 sizeof(efs),
3388 (unsigned long) &efs);
0e8b207e 3389 } else {
3e6b3b95 3390 /* Send PENDING Conf Rsp */
0e8b207e
AE		 3391 result = L2CAP_CONF_PENDING;
3392 set_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
42dceae2
AE		 3393 }
3394 }
3395
f2fcfcd6
GP		 3396 switch (rfc.mode) {
3397 case L2CAP_MODE_BASIC:
47d1ec61 3398 chan->fcs = L2CAP_FCS_NONE;
c1360a1c 3399 set_bit(CONF_MODE_DONE, &chan->conf_state);
f2fcfcd6
GP		 3400 break;
3401
3402 case L2CAP_MODE_ERTM:
6327eb98
AE		 3403 if (!test_bit(CONF_EWS_RECV, &chan->conf_state))
3404 chan->remote_tx_win = rfc.txwin_size;
3405 else
3406 rfc.txwin_size = L2CAP_DEFAULT_TX_WINDOW;
86b1b263 3407
2c03a7a4 3408 chan->remote_max_tx = rfc.max_transmit;
1c762159 3409
c8f79162 3410 size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
2d792818
GP		 3411 chan->conn->mtu - L2CAP_EXT_HDR_SIZE -
3412 L2CAP_SDULEN_SIZE - L2CAP_FCS_SIZE);
c8f79162
AE		 3413 rfc.max_pdu_size = cpu_to_le16(size);
3414 chan->remote_mps = size;
f2fcfcd6 3415
36c86c85 3416 __l2cap_set_ertm_timeouts(chan, &rfc);
f2fcfcd6 3417
c1360a1c 3418 set_bit(CONF_MODE_DONE, &chan->conf_state);
68ae6639
GP		 3419
3420 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
2d792818 3421 sizeof(rfc), (unsigned long) &rfc);
68ae6639 3422
42dceae2
AE		 3423 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
3424 chan->remote_id = efs.id;
3425 chan->remote_stype = efs.stype;
3426 chan->remote_msdu = le16_to_cpu(efs.msdu);
3427 chan->remote_flush_to =
2d792818 3428 le32_to_cpu(efs.flush_to);
42dceae2 3429 chan->remote_acc_lat =
2d792818 3430 le32_to_cpu(efs.acc_lat);
42dceae2
AE		 3431 chan->remote_sdu_itime =
3432 le32_to_cpu(efs.sdu_itime);
3433 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
2d792818
GP		 3434 sizeof(efs),
3435 (unsigned long) &efs);
42dceae2 3436 }
f2fcfcd6
GP		 3437 break;
3438
3439 case L2CAP_MODE_STREAMING:
c8f79162 3440 size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
2d792818
GP		 3441 chan->conn->mtu - L2CAP_EXT_HDR_SIZE -
3442 L2CAP_SDULEN_SIZE - L2CAP_FCS_SIZE);
c8f79162
AE		 3443 rfc.max_pdu_size = cpu_to_le16(size);
3444 chan->remote_mps = size;
f2fcfcd6 3445
c1360a1c 3446 set_bit(CONF_MODE_DONE, &chan->conf_state);
68ae6639 3447
2d792818
GP		 3448 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3449 (unsigned long) &rfc);
68ae6639 3450
f2fcfcd6
GP		 3451 break;
3452
3453 default:
5dee9e7c 3454 result = L2CAP_CONF_UNACCEPT;
5dee9e7c 3455
6464f35f 3456 memset(&rfc, 0, sizeof(rfc));
0c1bc5c6 3457 rfc.mode = chan->mode;
f2fcfcd6 3458 }
6464f35f 3459
f2fcfcd6 3460 if (result == L2CAP_CONF_SUCCESS)
c1360a1c 3461 set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
f2fcfcd6 3462 }
fe4128e0 3463 rsp->scid = cpu_to_le16(chan->dcid);
5dee9e7c 3464 rsp->result = cpu_to_le16(result);
dcf4adbf 3465 rsp->flags = cpu_to_le16(0);
5dee9e7c
MH		 3466
3467 return ptr - data;
1da177e4
LT		 3468}
3469
2d792818
GP		 3470static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,
3471 void *data, u16 *result)
f2fcfcd6 3472{
f2fcfcd6
GP		 3473 struct l2cap_conf_req *req = data;
3474 void *ptr = req->data;
3475 int type, olen;
3476 unsigned long val;
36e999a8 3477 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
66af7aaf 3478 struct l2cap_conf_efs efs;
f2fcfcd6 3479
fe4128e0 3480 BT_DBG("chan %p, rsp %p, len %d, req %p", chan, rsp, len, data);
f2fcfcd6
GP		 3481
3482 while (len >= L2CAP_CONF_OPT_SIZE) {
3483 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
3484
3485 switch (type) {
3486 case L2CAP_CONF_MTU:
3487 if (val < L2CAP_DEFAULT_MIN_MTU) {
3488 *result = L2CAP_CONF_UNACCEPT;
0c1bc5c6 3489 chan->imtu = L2CAP_DEFAULT_MIN_MTU;
f2fcfcd6 3490 } else
0c1bc5c6
GP		 3491 chan->imtu = val;
3492 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu);
f2fcfcd6
GP		 3493 break;
3494
3495 case L2CAP_CONF_FLUSH_TO:
0c1bc5c6 3496 chan->flush_to = val;
f2fcfcd6 3497 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO,
2d792818 3498 2, chan->flush_to);
f2fcfcd6
GP		 3499 break;
3500
3501 case L2CAP_CONF_RFC:
3502 if (olen == sizeof(rfc))
3503 memcpy(&rfc, (void *)val, olen);
3504
c1360a1c 3505 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) &&
2d792818 3506 rfc.mode != chan->mode)
f2fcfcd6
GP		 3507 return -ECONNREFUSED;
3508
47d1ec61 3509 chan->fcs = 0;
f2fcfcd6
GP		 3510
3511 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
2d792818 3512 sizeof(rfc), (unsigned long) &rfc);
f2fcfcd6 3513 break;
6327eb98
AE		 3514
3515 case L2CAP_CONF_EWS:
c20f8e35 3516 chan->ack_win = min_t(u16, val, chan->ack_win);
3e6b3b95 3517 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
c20f8e35 3518 chan->tx_win);
6327eb98 3519 break;
66af7aaf
AE		 3520
3521 case L2CAP_CONF_EFS:
3522 if (olen == sizeof(efs))
3523 memcpy(&efs, (void *)val, olen);
3524
3525 if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
2d792818
GP		 3526 efs.stype != L2CAP_SERV_NOTRAFIC &&
3527 efs.stype != chan->local_stype)
66af7aaf
AE		 3528 return -ECONNREFUSED;
3529
2d792818
GP		 3530 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs),
3531 (unsigned long) &efs);
66af7aaf 3532 break;
cbabee78
AE		 3533
3534 case L2CAP_CONF_FCS:
3535 if (*result == L2CAP_CONF_PENDING)
3536 if (val == L2CAP_FCS_NONE)
f2592d3e 3537 set_bit(CONF_RECV_NO_FCS,
cbabee78
AE		 3538 &chan->conf_state);
3539 break;
f2fcfcd6
GP		 3540 }
3541 }
3542
0c1bc5c6 3543 if (chan->mode == L2CAP_MODE_BASIC && chan->mode != rfc.mode)
6c2ea7a8
GP		 3544 return -ECONNREFUSED;
3545
0c1bc5c6 3546 chan->mode = rfc.mode;
6c2ea7a8 3547
0e8b207e 3548 if (*result == L2CAP_CONF_SUCCESS || *result == L2CAP_CONF_PENDING) {
f2fcfcd6
GP		 3549 switch (rfc.mode) {
3550 case L2CAP_MODE_ERTM:
47d1ec61
GP		 3551 chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
3552 chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
3553 chan->mps = le16_to_cpu(rfc.max_pdu_size);
c20f8e35
MM		 3554 if (!test_bit(FLAG_EXT_CTRL, &chan->flags))
3555 chan->ack_win = min_t(u16, chan->ack_win,
3556 rfc.txwin_size);
66af7aaf
AE		 3557
3558 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
3559 chan->local_msdu = le16_to_cpu(efs.msdu);
3560 chan->local_sdu_itime =
2d792818 3561 le32_to_cpu(efs.sdu_itime);
66af7aaf
AE		 3562 chan->local_acc_lat = le32_to_cpu(efs.acc_lat);
3563 chan->local_flush_to =
2d792818 3564 le32_to_cpu(efs.flush_to);
66af7aaf 3565 }
f2fcfcd6 3566 break;
66af7aaf 3567
f2fcfcd6 3568 case L2CAP_MODE_STREAMING:
47d1ec61 3569 chan->mps = le16_to_cpu(rfc.max_pdu_size);
f2fcfcd6
GP		 3570 }
3571 }
3572
fe4128e0 3573 req->dcid = cpu_to_le16(chan->dcid);
dcf4adbf 3574 req->flags = cpu_to_le16(0);
f2fcfcd6
GP		 3575
3576 return ptr - data;
3577}
3578
2d792818
GP		 3579static int l2cap_build_conf_rsp(struct l2cap_chan *chan, void *data,
3580 u16 result, u16 flags)
1da177e4
LT		 3581{
3582 struct l2cap_conf_rsp *rsp = data;
3583 void *ptr = rsp->data;
1da177e4 3584
fe4128e0 3585 BT_DBG("chan %p", chan);
1da177e4 3586
fe4128e0 3587 rsp->scid = cpu_to_le16(chan->dcid);
5dee9e7c 3588 rsp->result = cpu_to_le16(result);
aca3192c 3589 rsp->flags = cpu_to_le16(flags);
1da177e4
LT		 3590
3591 return ptr - data;
3592}
3593
27e2d4c8
JH		 3594void __l2cap_le_connect_rsp_defer(struct l2cap_chan *chan)
3595{
3596 struct l2cap_le_conn_rsp rsp;
3597 struct l2cap_conn *conn = chan->conn;
3598
3599 BT_DBG("chan %p", chan);
3600
3601 rsp.dcid = cpu_to_le16(chan->scid);
3602 rsp.mtu = cpu_to_le16(chan->imtu);
3916aed8 3603 rsp.mps = cpu_to_le16(chan->mps);
0cd75f7e 3604 rsp.credits = cpu_to_le16(chan->rx_credits);
dcf4adbf 3605 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
27e2d4c8
JH		 3606
3607 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp),
3608 &rsp);
3609}
3610
8c1d787b 3611void __l2cap_connect_rsp_defer(struct l2cap_chan *chan)
710f9b0a
GP		 3612{
3613 struct l2cap_conn_rsp rsp;
8c1d787b 3614 struct l2cap_conn *conn = chan->conn;
710f9b0a 3615 u8 buf[128];
439f34ac 3616 u8 rsp_code;
710f9b0a 3617
fe4128e0
GP		 3618 rsp.scid = cpu_to_le16(chan->dcid);
3619 rsp.dcid = cpu_to_le16(chan->scid);
dcf4adbf
JP		 3620 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
3621 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
439f34ac
AE		 3622
3623 if (chan->hs_hcon)
3624 rsp_code = L2CAP_CREATE_CHAN_RSP;
3625 else
3626 rsp_code = L2CAP_CONN_RSP;
3627
3628 BT_DBG("chan %p rsp_code %u", chan, rsp_code);
3629
3630 l2cap_send_cmd(conn, chan->ident, rsp_code, sizeof(rsp), &rsp);
710f9b0a 3631
c1360a1c 3632 if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
710f9b0a
GP		 3633 return;
3634
710f9b0a 3635 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
2d792818 3636 l2cap_build_conf_req(chan, buf), buf);
710f9b0a
GP		 3637 chan->num_conf_req++;
3638}
3639
47d1ec61 3640static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len)
7b1c0049 3641{
7b1c0049
GP		 3642 int type, olen;
3643 unsigned long val;
c20f8e35
MM		 3644 /* Use sane default values in case a misbehaving remote device
3645 * did not send an RFC or extended window size option.
3646 */
3647 u16 txwin_ext = chan->ack_win;
3648 struct l2cap_conf_rfc rfc = {
3649 .mode = chan->mode,
dcf4adbf
JP		 3650 .retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO),
3651 .monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO),
c20f8e35
MM		 3652 .max_pdu_size = cpu_to_le16(chan->imtu),
3653 .txwin_size = min_t(u16, chan->ack_win, L2CAP_DEFAULT_TX_WINDOW),
3654 };
7b1c0049 3655
47d1ec61 3656 BT_DBG("chan %p, rsp %p, len %d", chan, rsp, len);
7b1c0049 3657
0c1bc5c6 3658 if ((chan->mode != L2CAP_MODE_ERTM) && (chan->mode != L2CAP_MODE_STREAMING))
7b1c0049
GP		 3659 return;
3660
3661 while (len >= L2CAP_CONF_OPT_SIZE) {
3662 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
3663
c20f8e35
MM		 3664 switch (type) {
3665 case L2CAP_CONF_RFC:
3666 if (olen == sizeof(rfc))
3667 memcpy(&rfc, (void *)val, olen);
8f321f85 3668 break;
c20f8e35
MM		 3669 case L2CAP_CONF_EWS:
3670 txwin_ext = val;
3671 break;
3672 }
7b1c0049
GP		 3673 }
3674
7b1c0049
GP		 3675 switch (rfc.mode) {
3676 case L2CAP_MODE_ERTM:
47d1ec61
GP		 3677 chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
3678 chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
c20f8e35
MM		 3679 chan->mps = le16_to_cpu(rfc.max_pdu_size);
3680 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
3681 chan->ack_win = min_t(u16, chan->ack_win, txwin_ext);
3682 else
3683 chan->ack_win = min_t(u16, chan->ack_win,
3684 rfc.txwin_size);
7b1c0049
GP		 3685 break;
3686 case L2CAP_MODE_STREAMING:
47d1ec61 3687 chan->mps = le16_to_cpu(rfc.max_pdu_size);
7b1c0049
GP		 3688 }
3689}
3690
2d792818 3691static inline int l2cap_command_rej(struct l2cap_conn *conn,
cb3b3152
JH		 3692 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
3693 u8 *data)
4e8402a3 3694{
e2fd318e 3695 struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data;
4e8402a3 3696
cb3b3152
JH		 3697 if (cmd_len < sizeof(*rej))
3698 return -EPROTO;
3699
e2fd318e 3700 if (rej->reason != L2CAP_REJ_NOT_UNDERSTOOD)
4e8402a3
MH		 3701 return 0;
3702
3703 if ((conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) &&
2d792818 3704 cmd->ident == conn->info_ident) {
17cd3f37 3705 cancel_delayed_work(&conn->info_timer);
984947dc
MH		 3706
3707 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
e1027a7c 3708 conn->info_ident = 0;
984947dc 3709
4e8402a3
MH		 3710 l2cap_conn_start(conn);
3711 }
3712
3713 return 0;
3714}
3715
1700915f
MM		 3716static struct l2cap_chan *l2cap_connect(struct l2cap_conn *conn,
3717 struct l2cap_cmd_hdr *cmd,
3718 u8 *data, u8 rsp_code, u8 amp_id)
1da177e4 3719{
1da177e4
LT		 3720 struct l2cap_conn_req *req = (struct l2cap_conn_req *) data;
3721 struct l2cap_conn_rsp rsp;
23691d75 3722 struct l2cap_chan *chan = NULL, *pchan;
e7c29cb1 3723 int result, status = L2CAP_CS_NO_INFO;
1da177e4
LT		 3724
3725 u16 dcid = 0, scid = __le16_to_cpu(req->scid);
e7c29cb1 3726 __le16 psm = req->psm;
1da177e4 3727
097db76c 3728 BT_DBG("psm 0x%2.2x scid 0x%4.4x", __le16_to_cpu(psm), scid);
1da177e4
LT		 3729
3730 /* Check if we have socket listening on psm */
6f59b904 3731 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src,
bf20fd4e 3732 &conn->hcon->dst, ACL_LINK);
23691d75 3733 if (!pchan) {
1da177e4
LT		 3734 result = L2CAP_CR_BAD_PSM;
3735 goto sendresp;
3736 }
3737
3df91ea2 3738 mutex_lock(&conn->chan_lock);
8ffb9290 3739 l2cap_chan_lock(pchan);
e0f0cb56 3740
e7c29cb1 3741 /* Check if the ACL is secure enough (if not SDP) */
dcf4adbf 3742 if (psm != cpu_to_le16(L2CAP_PSM_SDP) &&
2d792818 3743 !hci_conn_check_link_mode(conn->hcon)) {
9f5a0d7b 3744 conn->disc_reason = HCI_ERROR_AUTH_FAILURE;
e7c29cb1
MH		 3745 result = L2CAP_CR_SEC_BLOCK;
3746 goto response;
3747 }
3748
1da177e4
LT		 3749 result = L2CAP_CR_NO_MEM;
3750
2dfa1003
GP		 3751 /* Check if we already have channel with that dcid */
3752 if (__l2cap_get_chan_by_dcid(conn, scid))
3753 goto response;
3754
80b98027 3755 chan = pchan->ops->new_connection(pchan);
80808e43 3756 if (!chan)
1da177e4
LT		 3757 goto response;
3758
330b6c15
SS		 3759 /* For certain devices (ex: HID mouse), support for authentication,
3760 * pairing and bonding is optional. For such devices, inorder to avoid
3761 * the ACL alive for too long after L2CAP disconnection, reset the ACL
3762 * disc_timeout back to HCI_DISCONN_TIMEOUT during L2CAP connect.
3763 */
3764 conn->hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
3765
7eafc59e
MH		 3766 bacpy(&chan->src, &conn->hcon->src);
3767 bacpy(&chan->dst, &conn->hcon->dst);
4f1654e0
MH		 3768 chan->src_type = bdaddr_type(conn->hcon, conn->hcon->src_type);
3769 chan->dst_type = bdaddr_type(conn->hcon, conn->hcon->dst_type);
fe4128e0
GP		 3770 chan->psm = psm;
3771 chan->dcid = scid;
1700915f 3772 chan->local_amp_id = amp_id;
1da177e4 3773
6be36555 3774 __l2cap_chan_add(conn, chan);
48454079 3775
fe4128e0 3776 dcid = chan->scid;
1da177e4 3777
8d836d71 3778 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
1da177e4 3779
fc7f8a7e 3780 chan->ident = cmd->ident;
1da177e4 3781
984947dc 3782 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) {
e7cafc45 3783 if (l2cap_chan_check_security(chan, false)) {
bdc25783 3784 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
f93fa273 3785 l2cap_state_change(chan, BT_CONNECT2);
f66dc81f
MH		 3786 result = L2CAP_CR_PEND;
3787 status = L2CAP_CS_AUTHOR_PEND;
2dc4e510 3788 chan->ops->defer(chan);
f66dc81f 3789 } else {
1700915f
MM		 3790 /* Force pending result for AMP controllers.
3791 * The connection will succeed after the
3792 * physical link is up.
3793 */
6ed971ca 3794 if (amp_id == AMP_ID_BREDR) {
f93fa273 3795 l2cap_state_change(chan, BT_CONFIG);
1700915f 3796 result = L2CAP_CR_SUCCESS;
6ed971ca 3797 } else {
f93fa273 3798 l2cap_state_change(chan, BT_CONNECT2);
6ed971ca 3799 result = L2CAP_CR_PEND;
1700915f 3800 }
f66dc81f
MH		 3801 status = L2CAP_CS_NO_INFO;
3802 }
79d554a6 3803 } else {
f93fa273 3804 l2cap_state_change(chan, BT_CONNECT2);
79d554a6
MH		 3805 result = L2CAP_CR_PEND;
3806 status = L2CAP_CS_AUTHEN_PEND;
3807 }
3808 } else {
f93fa273 3809 l2cap_state_change(chan, BT_CONNECT2);
79d554a6
MH		 3810 result = L2CAP_CR_PEND;
3811 status = L2CAP_CS_NO_INFO;
1da177e4
LT		 3812 }
3813
1da177e4 3814response:
8ffb9290 3815 l2cap_chan_unlock(pchan);
3df91ea2 3816 mutex_unlock(&conn->chan_lock);
a24cce14 3817 l2cap_chan_put(pchan);
1da177e4
LT		 3818
3819sendresp:
aca3192c
YH		 3820 rsp.scid = cpu_to_le16(scid);
3821 rsp.dcid = cpu_to_le16(dcid);
3822 rsp.result = cpu_to_le16(result);
3823 rsp.status = cpu_to_le16(status);
4c89b6aa 3824 l2cap_send_cmd(conn, cmd->ident, rsp_code, sizeof(rsp), &rsp);
79d554a6
MH		 3825
3826 if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) {
3827 struct l2cap_info_req info;
dcf4adbf 3828 info.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
79d554a6
MH		 3829
3830 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
3831 conn->info_ident = l2cap_get_ident(conn);
3832
ba13ccd9 3833 schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
79d554a6 3834
2d792818
GP		 3835 l2cap_send_cmd(conn, conn->info_ident, L2CAP_INFO_REQ,
3836 sizeof(info), &info);
79d554a6
MH		 3837 }
3838
c1360a1c 3839 if (chan && !test_bit(CONF_REQ_SENT, &chan->conf_state) &&
2d792818 3840 result == L2CAP_CR_SUCCESS) {
e9aeb2dd 3841 u8 buf[128];
c1360a1c 3842 set_bit(CONF_REQ_SENT, &chan->conf_state);
e9aeb2dd 3843 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
2d792818 3844 l2cap_build_conf_req(chan, buf), buf);
73ffa904 3845 chan->num_conf_req++;
e9aeb2dd 3846 }
1700915f
MM		 3847
3848 return chan;
4c89b6aa 3849}
e9aeb2dd 3850
4c89b6aa 3851static int l2cap_connect_req(struct l2cap_conn *conn,
cb3b3152 3852 struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
4c89b6aa 3853{
7b064eda
JK		 3854 struct hci_dev *hdev = conn->hcon->hdev;
3855 struct hci_conn *hcon = conn->hcon;
3856
cb3b3152
JH		 3857 if (cmd_len < sizeof(struct l2cap_conn_req))
3858 return -EPROTO;
3859
7b064eda
JK		 3860 hci_dev_lock(hdev);
3861 if (test_bit(HCI_MGMT, &hdev->dev_flags) &&
3862 !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &hcon->flags))
3863 mgmt_device_connected(hdev, &hcon->dst, hcon->type,
3864 hcon->dst_type, 0, NULL, 0,
3865 hcon->dev_class);
3866 hci_dev_unlock(hdev);
3867
300229f9 3868 l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP, 0);
1da177e4
LT		 3869 return 0;
3870}
3871
5909cf30 3872static int l2cap_connect_create_rsp(struct l2cap_conn *conn,
cb3b3152
JH		 3873 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
3874 u8 *data)
1da177e4
LT		 3875{
3876 struct l2cap_conn_rsp *rsp = (struct l2cap_conn_rsp *) data;
3877 u16 scid, dcid, result, status;
48454079 3878 struct l2cap_chan *chan;
1da177e4 3879 u8 req[128];
3df91ea2 3880 int err;
1da177e4 3881
cb3b3152
JH		 3882 if (cmd_len < sizeof(*rsp))
3883 return -EPROTO;
3884
1da177e4
LT		 3885 scid = __le16_to_cpu(rsp->scid);
3886 dcid = __le16_to_cpu(rsp->dcid);
3887 result = __le16_to_cpu(rsp->result);
3888 status = __le16_to_cpu(rsp->status);
3889
1b009c98 3890 BT_DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x",
2d792818 3891 dcid, scid, result, status);
1da177e4 3892
3df91ea2
AE		 3893 mutex_lock(&conn->chan_lock);
3894
1da177e4 3895 if (scid) {
3df91ea2
AE		 3896 chan = __l2cap_get_chan_by_scid(conn, scid);
3897 if (!chan) {
21870b52 3898 err = -EBADSLT;
3df91ea2
AE		 3899 goto unlock;
3900 }
1da177e4 3901 } else {
3df91ea2
AE		 3902 chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
3903 if (!chan) {
21870b52 3904 err = -EBADSLT;
3df91ea2
AE		 3905 goto unlock;
3906 }
1da177e4
LT		 3907 }
3908
3df91ea2
AE		 3909 err = 0;
3910
6be36555 3911 l2cap_chan_lock(chan);
48454079 3912
1da177e4
LT		 3913 switch (result) {
3914 case L2CAP_CR_SUCCESS:
89bc500e 3915 l2cap_state_change(chan, BT_CONFIG);
fc7f8a7e 3916 chan->ident = 0;
fe4128e0 3917 chan->dcid = dcid;
c1360a1c 3918 clear_bit(CONF_CONNECT_PEND, &chan->conf_state);
6a8d3010 3919
c1360a1c 3920 if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
e9aeb2dd
GP		 3921 break;
3922
1da177e4 3923 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
2d792818 3924 l2cap_build_conf_req(chan, req), req);
73ffa904 3925 chan->num_conf_req++;
1da177e4
LT		 3926 break;
3927
3928 case L2CAP_CR_PEND:
c1360a1c 3929 set_bit(CONF_CONNECT_PEND, &chan->conf_state);
1da177e4
LT		 3930 break;
3931
3932 default:
48454079 3933 l2cap_chan_del(chan, ECONNREFUSED);
1da177e4
LT		 3934 break;
3935 }
3936
6be36555 3937 l2cap_chan_unlock(chan);
3df91ea2
AE		 3938
3939unlock:
3940 mutex_unlock(&conn->chan_lock);
3941
3942 return err;
1da177e4
LT		 3943}
3944
47d1ec61 3945static inline void set_default_fcs(struct l2cap_chan *chan)
8c462b60
MM		 3946{
3947 /* FCS is enabled only in ERTM or streaming mode, if one or both
3948 * sides request it.
3949 */
0c1bc5c6 3950 if (chan->mode != L2CAP_MODE_ERTM && chan->mode != L2CAP_MODE_STREAMING)
47d1ec61 3951 chan->fcs = L2CAP_FCS_NONE;
f2592d3e 3952 else if (!test_bit(CONF_RECV_NO_FCS, &chan->conf_state))
47d1ec61 3953 chan->fcs = L2CAP_FCS_CRC16;
8c462b60
MM		 3954}
3955
29d8a590
AE		 3956static void l2cap_send_efs_conf_rsp(struct l2cap_chan *chan, void *data,
3957 u8 ident, u16 flags)
3958{
3959 struct l2cap_conn *conn = chan->conn;
3960
3961 BT_DBG("conn %p chan %p ident %d flags 0x%4.4x", conn, chan, ident,
3962 flags);
3963
3964 clear_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
3965 set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
3966
3967 l2cap_send_cmd(conn, ident, L2CAP_CONF_RSP,
3968 l2cap_build_conf_rsp(chan, data,
3969 L2CAP_CONF_SUCCESS, flags), data);
3970}
3971
662d652d
JH		 3972static void cmd_reject_invalid_cid(struct l2cap_conn *conn, u8 ident,
3973 u16 scid, u16 dcid)
3974{
3975 struct l2cap_cmd_rej_cid rej;
3976
dcf4adbf 3977 rej.reason = cpu_to_le16(L2CAP_REJ_INVALID_CID);
662d652d
JH		 3978 rej.scid = __cpu_to_le16(scid);
3979 rej.dcid = __cpu_to_le16(dcid);
3980
3981 l2cap_send_cmd(conn, ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej);
3982}
3983
2d792818
GP		 3984static inline int l2cap_config_req(struct l2cap_conn *conn,
3985 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
3986 u8 *data)
1da177e4
LT		 3987{
3988 struct l2cap_conf_req *req = (struct l2cap_conf_req *) data;
3989 u16 dcid, flags;
3990 u8 rsp[64];
48454079 3991 struct l2cap_chan *chan;
3c588192 3992 int len, err = 0;
1da177e4 3993
cb3b3152
JH		 3994 if (cmd_len < sizeof(*req))
3995 return -EPROTO;
3996
1da177e4
LT		 3997 dcid = __le16_to_cpu(req->dcid);
3998 flags = __le16_to_cpu(req->flags);
3999
4000 BT_DBG("dcid 0x%4.4x flags 0x%2.2x", dcid, flags);
4001
baa7e1fa 4002 chan = l2cap_get_chan_by_scid(conn, dcid);
662d652d
JH		 4003 if (!chan) {
4004 cmd_reject_invalid_cid(conn, cmd->ident, dcid, 0);
4005 return 0;
4006 }
1da177e4 4007
033b1142 4008 if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2) {
662d652d
JH		 4009 cmd_reject_invalid_cid(conn, cmd->ident, chan->scid,
4010 chan->dcid);
354f60a9 4011 goto unlock;
df6bd743 4012 }
354f60a9 4013
5dee9e7c 4014 /* Reject if config buffer is too small. */
88219a0f 4015 len = cmd_len - sizeof(*req);
cb3b3152 4016 if (chan->conf_len + len > sizeof(chan->conf_req)) {
5dee9e7c 4017 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
2d792818
GP		 4018 l2cap_build_conf_rsp(chan, rsp,
4019 L2CAP_CONF_REJECT, flags), rsp);
5dee9e7c
MH		 4020 goto unlock;
4021 }
4022
4023 /* Store config. */
73ffa904
GP		 4024 memcpy(chan->conf_req + chan->conf_len, req->data, len);
4025 chan->conf_len += len;
1da177e4 4026
59e54bd1 4027 if (flags & L2CAP_CONF_FLAG_CONTINUATION) {
1da177e4
LT		 4028 /* Incomplete config. Send empty response. */
4029 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
2d792818
GP		 4030 l2cap_build_conf_rsp(chan, rsp,
4031 L2CAP_CONF_SUCCESS, flags), rsp);
1da177e4
LT		 4032 goto unlock;
4033 }
4034
4035 /* Complete config. */
73ffa904 4036 len = l2cap_parse_conf_req(chan, rsp);
f2fcfcd6 4037 if (len < 0) {
5e4e3972 4038 l2cap_send_disconn_req(chan, ECONNRESET);
1da177e4 4039 goto unlock;
f2fcfcd6 4040 }
1da177e4 4041
1500109b 4042 chan->ident = cmd->ident;
5dee9e7c 4043 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp);
73ffa904 4044 chan->num_conf_rsp++;
5dee9e7c 4045
5dee9e7c 4046 /* Reset config buffer. */
73ffa904 4047 chan->conf_len = 0;
5dee9e7c 4048
c1360a1c 4049 if (!test_bit(CONF_OUTPUT_DONE, &chan->conf_state))
876d9484
MH		 4050 goto unlock;
4051
c1360a1c 4052 if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {
47d1ec61 4053 set_default_fcs(chan);
fcc203c3 4054
105bdf9e
MM		 4055 if (chan->mode == L2CAP_MODE_ERTM ||
4056 chan->mode == L2CAP_MODE_STREAMING)
3c588192
MM		 4057 err = l2cap_ertm_init(chan);
4058
4059 if (err < 0)
5e4e3972 4060 l2cap_send_disconn_req(chan, -err);
3c588192
MM		 4061 else
4062 l2cap_chan_ready(chan);
0565c1c2 4063
876d9484
MH		 4064 goto unlock;
4065 }
4066
c1360a1c 4067 if (!test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) {
79d554a6 4068 u8 buf[64];
1da177e4 4069 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
2d792818 4070 l2cap_build_conf_req(chan, buf), buf);
73ffa904 4071 chan->num_conf_req++;
1da177e4
LT		 4072 }
4073
0e8b207e
AE		 4074 /* Got Conf Rsp PENDING from remote side and asume we sent
4075 Conf Rsp PENDING in the code above */
4076 if (test_bit(CONF_REM_CONF_PEND, &chan->conf_state) &&
29d8a590 4077 test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
0e8b207e
AE		 4078
4079 /* check compatibility */
4080
79de886d 4081 /* Send rsp for BR/EDR channel */
f351bc72 4082 if (!chan->hs_hcon)
79de886d
AE		 4083 l2cap_send_efs_conf_rsp(chan, rsp, cmd->ident, flags);
4084 else
4085 chan->ident = cmd->ident;
0e8b207e
AE		 4086 }
4087
1da177e4 4088unlock:
6be36555 4089 l2cap_chan_unlock(chan);
3c588192 4090 return err;
1da177e4
LT		 4091}
4092
2d792818 4093static inline int l2cap_config_rsp(struct l2cap_conn *conn,
cb3b3152
JH		 4094 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4095 u8 *data)
1da177e4
LT		 4096{
4097 struct l2cap_conf_rsp *rsp = (struct l2cap_conf_rsp *)data;
4098 u16 scid, flags, result;
48454079 4099 struct l2cap_chan *chan;
cb3b3152 4100 int len = cmd_len - sizeof(*rsp);
3c588192 4101 int err = 0;
1da177e4 4102
cb3b3152
JH		 4103 if (cmd_len < sizeof(*rsp))
4104 return -EPROTO;
4105
1da177e4
LT		 4106 scid = __le16_to_cpu(rsp->scid);
4107 flags = __le16_to_cpu(rsp->flags);
4108 result = __le16_to_cpu(rsp->result);
4109
61386cba
AE		 4110 BT_DBG("scid 0x%4.4x flags 0x%2.2x result 0x%2.2x len %d", scid, flags,
4111 result, len);
1da177e4 4112
baa7e1fa 4113 chan = l2cap_get_chan_by_scid(conn, scid);
48454079 4114 if (!chan)
1da177e4
LT		 4115 return 0;
4116
4117 switch (result) {
4118 case L2CAP_CONF_SUCCESS:
47d1ec61 4119 l2cap_conf_rfc_get(chan, rsp->data, len);
0e8b207e 4120 clear_bit(CONF_REM_CONF_PEND, &chan->conf_state);
1da177e4
LT		 4121 break;
4122
0e8b207e
AE		 4123 case L2CAP_CONF_PENDING:
4124 set_bit(CONF_REM_CONF_PEND, &chan->conf_state);
4125
4126 if (test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
4127 char buf[64];
4128
4129 len = l2cap_parse_conf_rsp(chan, rsp->data, len,
2d792818 4130 buf, &result);
0e8b207e 4131 if (len < 0) {
5e4e3972 4132 l2cap_send_disconn_req(chan, ECONNRESET);
0e8b207e
AE		 4133 goto done;
4134 }
4135
f351bc72 4136 if (!chan->hs_hcon) {
79de886d
AE		 4137 l2cap_send_efs_conf_rsp(chan, buf, cmd->ident,
4138 0);
5ce66b59
AE		 4139 } else {
4140 if (l2cap_check_efs(chan)) {
4141 amp_create_logical_link(chan);
4142 chan->ident = cmd->ident;
4143 }
4144 }
0e8b207e
AE		 4145 }
4146 goto done;
4147
1da177e4 4148 case L2CAP_CONF_UNACCEPT:
73ffa904 4149 if (chan->num_conf_rsp <= L2CAP_CONF_MAX_CONF_RSP) {
f2fcfcd6
GP		 4150 char req[64];
4151
c2c77ec8 4152 if (len > sizeof(req) - sizeof(struct l2cap_conf_req)) {
5e4e3972 4153 l2cap_send_disconn_req(chan, ECONNRESET);
c2c77ec8
AE		 4154 goto done;
4155 }
4156
f2fcfcd6
GP		 4157 /* throw out any old stored conf requests */
4158 result = L2CAP_CONF_SUCCESS;
b4450035 4159 len = l2cap_parse_conf_rsp(chan, rsp->data, len,
2d792818 4160 req, &result);
f2fcfcd6 4161 if (len < 0) {
5e4e3972 4162 l2cap_send_disconn_req(chan, ECONNRESET);
f2fcfcd6
GP		 4163 goto done;
4164 }
4165
4166 l2cap_send_cmd(conn, l2cap_get_ident(conn),
2d792818 4167 L2CAP_CONF_REQ, len, req);
73ffa904 4168 chan->num_conf_req++;
f2fcfcd6
GP		 4169 if (result != L2CAP_CONF_SUCCESS)
4170 goto done;
4171 break;
1da177e4
LT		 4172 }
4173
8e87d142 4174 default:
6be36555 4175 l2cap_chan_set_err(chan, ECONNRESET);
2e0052e4 4176
ba13ccd9 4177 __set_chan_timer(chan, L2CAP_DISC_REJ_TIMEOUT);
5e4e3972 4178 l2cap_send_disconn_req(chan, ECONNRESET);
1da177e4
LT		 4179 goto done;
4180 }
4181
59e54bd1 4182 if (flags & L2CAP_CONF_FLAG_CONTINUATION)
1da177e4
LT		 4183 goto done;
4184
c1360a1c 4185 set_bit(CONF_INPUT_DONE, &chan->conf_state);
1da177e4 4186
c1360a1c 4187 if (test_bit(CONF_OUTPUT_DONE, &chan->conf_state)) {
47d1ec61 4188 set_default_fcs(chan);
fcc203c3 4189
105bdf9e
MM		 4190 if (chan->mode == L2CAP_MODE_ERTM ||
4191 chan->mode == L2CAP_MODE_STREAMING)
3c588192 4192 err = l2cap_ertm_init(chan);
0565c1c2 4193
3c588192 4194 if (err < 0)
5e4e3972 4195 l2cap_send_disconn_req(chan, -err);
3c588192
MM		 4196 else
4197 l2cap_chan_ready(chan);
1da177e4
LT		 4198 }
4199
4200done:
6be36555 4201 l2cap_chan_unlock(chan);
3c588192 4202 return err;
1da177e4
LT		 4203}
4204
2d792818 4205static inline int l2cap_disconnect_req(struct l2cap_conn *conn,
cb3b3152
JH		 4206 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4207 u8 *data)
1da177e4
LT		 4208{
4209 struct l2cap_disconn_req *req = (struct l2cap_disconn_req *) data;
4210 struct l2cap_disconn_rsp rsp;
4211 u16 dcid, scid;
48454079 4212 struct l2cap_chan *chan;
1da177e4 4213
cb3b3152
JH		 4214 if (cmd_len != sizeof(*req))
4215 return -EPROTO;
4216
1da177e4
LT		 4217 scid = __le16_to_cpu(req->scid);
4218 dcid = __le16_to_cpu(req->dcid);
4219
4220 BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid);
4221
3df91ea2
AE		 4222 mutex_lock(&conn->chan_lock);
4223
4224 chan = __l2cap_get_chan_by_scid(conn, dcid);
4225 if (!chan) {
4226 mutex_unlock(&conn->chan_lock);
662d652d
JH		 4227 cmd_reject_invalid_cid(conn, cmd->ident, dcid, scid);
4228 return 0;
3df91ea2 4229 }
1da177e4 4230
6be36555
AE		 4231 l2cap_chan_lock(chan);
4232
fe4128e0
GP		 4233 rsp.dcid = cpu_to_le16(chan->scid);
4234 rsp.scid = cpu_to_le16(chan->dcid);
1da177e4
LT		 4235 l2cap_send_cmd(conn, cmd->ident, L2CAP_DISCONN_RSP, sizeof(rsp), &rsp);
4236
5ec1bbe5 4237 chan->ops->set_shutdown(chan);
1da177e4 4238
61d6ef3e 4239 l2cap_chan_hold(chan);
48454079 4240 l2cap_chan_del(chan, ECONNRESET);
6be36555
AE		 4241
4242 l2cap_chan_unlock(chan);
1da177e4 4243
80b98027 4244 chan->ops->close(chan);
61d6ef3e 4245 l2cap_chan_put(chan);
3df91ea2
AE		 4246
4247 mutex_unlock(&conn->chan_lock);
4248
1da177e4
LT		 4249 return 0;
4250}
4251
2d792818 4252static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn,
cb3b3152
JH		 4253 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4254 u8 *data)
1da177e4
LT		 4255{
4256 struct l2cap_disconn_rsp *rsp = (struct l2cap_disconn_rsp *) data;
4257 u16 dcid, scid;
48454079 4258 struct l2cap_chan *chan;
1da177e4 4259
cb3b3152
JH		 4260 if (cmd_len != sizeof(*rsp))
4261 return -EPROTO;
4262
1da177e4
LT		 4263 scid = __le16_to_cpu(rsp->scid);
4264 dcid = __le16_to_cpu(rsp->dcid);
4265
4266 BT_DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid);
4267
3df91ea2
AE		 4268 mutex_lock(&conn->chan_lock);
4269
4270 chan = __l2cap_get_chan_by_scid(conn, scid);
4271 if (!chan) {
4272 mutex_unlock(&conn->chan_lock);
1da177e4 4273 return 0;
3df91ea2 4274 }
1da177e4 4275
6be36555 4276 l2cap_chan_lock(chan);
48454079 4277
61d6ef3e 4278 l2cap_chan_hold(chan);
48454079 4279 l2cap_chan_del(chan, 0);
6be36555
AE		 4280
4281 l2cap_chan_unlock(chan);
1da177e4 4282
80b98027 4283 chan->ops->close(chan);
61d6ef3e 4284 l2cap_chan_put(chan);
3df91ea2
AE		 4285
4286 mutex_unlock(&conn->chan_lock);
4287
1da177e4
LT		 4288 return 0;
4289}
4290
2d792818 4291static inline int l2cap_information_req(struct l2cap_conn *conn,
cb3b3152
JH		 4292 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4293 u8 *data)
1da177e4
LT		 4294{
4295 struct l2cap_info_req *req = (struct l2cap_info_req *) data;
1da177e4
LT		 4296 u16 type;
4297
cb3b3152
JH		 4298 if (cmd_len != sizeof(*req))
4299 return -EPROTO;
4300
1da177e4
LT		 4301 type = __le16_to_cpu(req->type);
4302
4303 BT_DBG("type 0x%4.4x", type);
4304
f0709e03
MH		 4305 if (type == L2CAP_IT_FEAT_MASK) {
4306 u8 buf[8];
44dd46de 4307 u32 feat_mask = l2cap_feat_mask;
f0709e03 4308 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
dcf4adbf
JP		 4309 rsp->type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
4310 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
d1c4a17d 4311 if (!disable_ertm)
fcc203c3 4312 feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING
2d792818 4313 | L2CAP_FEAT_FCS;
848566b3 4314 if (conn->hs_enabled)
6327eb98 4315 feat_mask |= L2CAP_FEAT_EXT_FLOW
2d792818 4316 | L2CAP_FEAT_EXT_WINDOW;
a5fd6f30 4317
1b7bf4ed 4318 put_unaligned_le32(feat_mask, rsp->data);
2d792818
GP		 4319 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(buf),
4320 buf);
e1027a7c
MH		 4321 } else if (type == L2CAP_IT_FIXED_CHAN) {
4322 u8 buf[12];
4323 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
50a147cd 4324
848566b3 4325 if (conn->hs_enabled)
50a147cd
MM		 4326 l2cap_fixed_chan[0] |= L2CAP_FC_A2MP;
4327 else
4328 l2cap_fixed_chan[0] &= ~L2CAP_FC_A2MP;
4329
dcf4adbf
JP		 4330 rsp->type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
4331 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
c6337ea6 4332 memcpy(rsp->data, l2cap_fixed_chan, sizeof(l2cap_fixed_chan));
2d792818
GP		 4333 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(buf),
4334 buf);
f0709e03
MH		 4335 } else {
4336 struct l2cap_info_rsp rsp;
4337 rsp.type = cpu_to_le16(type);
dcf4adbf 4338 rsp.result = cpu_to_le16(L2CAP_IR_NOTSUPP);
2d792818
GP		 4339 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(rsp),
4340 &rsp);
f0709e03 4341 }
1da177e4
LT		 4342
4343 return 0;
4344}
4345
2d792818 4346static inline int l2cap_information_rsp(struct l2cap_conn *conn,
cb3b3152
JH		 4347 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4348 u8 *data)
1da177e4
LT		 4349{
4350 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data;
4351 u16 type, result;
4352
3f6fa3d4 4353 if (cmd_len < sizeof(*rsp))
cb3b3152
JH		 4354 return -EPROTO;
4355
1da177e4
LT		 4356 type = __le16_to_cpu(rsp->type);
4357 result = __le16_to_cpu(rsp->result);
4358
4359 BT_DBG("type 0x%4.4x result 0x%2.2x", type, result);
4360
e90165be
AE		 4361 /* L2CAP Info req/rsp are unbound to channels, add extra checks */
4362 if (cmd->ident != conn->info_ident ||
2d792818 4363 conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)
e90165be
AE		 4364 return 0;
4365
17cd3f37 4366 cancel_delayed_work(&conn->info_timer);
4e8402a3 4367
adb08ede
VT		 4368 if (result != L2CAP_IR_SUCCESS) {
4369 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
4370 conn->info_ident = 0;
4371
4372 l2cap_conn_start(conn);
4373
4374 return 0;
4375 }
4376
978c93b9
AE		 4377 switch (type) {
4378 case L2CAP_IT_FEAT_MASK:
83985319 4379 conn->feat_mask = get_unaligned_le32(rsp->data);
4e8402a3 4380
47ec1dcd 4381 if (conn->feat_mask & L2CAP_FEAT_FIXED_CHAN) {
e1027a7c 4382 struct l2cap_info_req req;
dcf4adbf 4383 req.type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
e1027a7c
MH		 4384
4385 conn->info_ident = l2cap_get_ident(conn);
4386
4387 l2cap_send_cmd(conn, conn->info_ident,
2d792818 4388 L2CAP_INFO_REQ, sizeof(req), &req);
e1027a7c
MH		 4389 } else {
4390 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
4391 conn->info_ident = 0;
4392
4393 l2cap_conn_start(conn);
4394 }
978c93b9
AE		 4395 break;
4396
4397 case L2CAP_IT_FIXED_CHAN:
4398 conn->fixed_chan_mask = rsp->data[0];
984947dc 4399 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
e1027a7c 4400 conn->info_ident = 0;
984947dc
MH		 4401
4402 l2cap_conn_start(conn);
978c93b9 4403 break;
984947dc 4404 }
4e8402a3 4405
1da177e4
LT		 4406 return 0;
4407}
4408
1700915f
MM		 4409static int l2cap_create_channel_req(struct l2cap_conn *conn,
4410 struct l2cap_cmd_hdr *cmd,
4411 u16 cmd_len, void *data)
f94ff6ff
MM		 4412{
4413 struct l2cap_create_chan_req *req = data;
6e1df6a6 4414 struct l2cap_create_chan_rsp rsp;
1700915f 4415 struct l2cap_chan *chan;
6e1df6a6 4416 struct hci_dev *hdev;
f94ff6ff
MM		 4417 u16 psm, scid;
4418
4419 if (cmd_len != sizeof(*req))
4420 return -EPROTO;
4421
848566b3 4422 if (!conn->hs_enabled)
f94ff6ff
MM		 4423 return -EINVAL;
4424
4425 psm = le16_to_cpu(req->psm);
4426 scid = le16_to_cpu(req->scid);
4427
ad0ac6ca 4428 BT_DBG("psm 0x%2.2x, scid 0x%4.4x, amp_id %d", psm, scid, req->amp_id);
f94ff6ff 4429
6e1df6a6 4430 /* For controller id 0 make BR/EDR connection */
6ed971ca 4431 if (req->amp_id == AMP_ID_BREDR) {
6e1df6a6
AE		 4432 l2cap_connect(conn, cmd, data, L2CAP_CREATE_CHAN_RSP,
4433 req->amp_id);
4434 return 0;
4435 }
1700915f 4436
6e1df6a6
AE		 4437 /* Validate AMP controller id */
4438 hdev = hci_dev_get(req->amp_id);
4439 if (!hdev)
4440 goto error;
1700915f 4441
6e1df6a6
AE		 4442 if (hdev->dev_type != HCI_AMP || !test_bit(HCI_UP, &hdev->flags)) {
4443 hci_dev_put(hdev);
4444 goto error;
4445 }
1700915f 4446
6e1df6a6
AE		 4447 chan = l2cap_connect(conn, cmd, data, L2CAP_CREATE_CHAN_RSP,
4448 req->amp_id);
4449 if (chan) {
4450 struct amp_mgr *mgr = conn->hcon->amp_mgr;
4451 struct hci_conn *hs_hcon;
1700915f 4452
98e0f7ea
MH		 4453 hs_hcon = hci_conn_hash_lookup_ba(hdev, AMP_LINK,
4454 &conn->hcon->dst);
6e1df6a6
AE		 4455 if (!hs_hcon) {
4456 hci_dev_put(hdev);
662d652d
JH		 4457 cmd_reject_invalid_cid(conn, cmd->ident, chan->scid,
4458 chan->dcid);
4459 return 0;
1700915f
MM		 4460 }
4461
6e1df6a6
AE		 4462 BT_DBG("mgr %p bredr_chan %p hs_hcon %p", mgr, chan, hs_hcon);
4463
6e1df6a6
AE		 4464 mgr->bredr_chan = chan;
4465 chan->hs_hcon = hs_hcon;
fd45bf4c 4466 chan->fcs = L2CAP_FCS_NONE;
6e1df6a6 4467 conn->mtu = hdev->block_mtu;
1700915f 4468 }
f94ff6ff 4469
6e1df6a6 4470 hci_dev_put(hdev);
f94ff6ff
MM		 4471
4472 return 0;
6e1df6a6
AE		 4473
4474error:
4475 rsp.dcid = 0;
4476 rsp.scid = cpu_to_le16(scid);
dcf4adbf
JP		 4477 rsp.result = cpu_to_le16(L2CAP_CR_BAD_AMP);
4478 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
6e1df6a6
AE		 4479
4480 l2cap_send_cmd(conn, cmd->ident, L2CAP_CREATE_CHAN_RSP,
4481 sizeof(rsp), &rsp);
4482
dc280801 4483 return 0;
f94ff6ff
MM		 4484}
4485
8eb200bd
MM		 4486static void l2cap_send_move_chan_req(struct l2cap_chan *chan, u8 dest_amp_id)
4487{
4488 struct l2cap_move_chan_req req;
4489 u8 ident;
4490
4491 BT_DBG("chan %p, dest_amp_id %d", chan, dest_amp_id);
4492
4493 ident = l2cap_get_ident(chan->conn);
4494 chan->ident = ident;
4495
4496 req.icid = cpu_to_le16(chan->scid);
4497 req.dest_amp_id = dest_amp_id;
4498
4499 l2cap_send_cmd(chan->conn, ident, L2CAP_MOVE_CHAN_REQ, sizeof(req),
4500 &req);
4501
4502 __set_chan_timer(chan, L2CAP_MOVE_TIMEOUT);
4503}
4504
1500109b 4505static void l2cap_send_move_chan_rsp(struct l2cap_chan *chan, u16 result)
8d5a04a1
MM		 4506{
4507 struct l2cap_move_chan_rsp rsp;
4508
1500109b 4509 BT_DBG("chan %p, result 0x%4.4x", chan, result);
8d5a04a1 4510
1500109b 4511 rsp.icid = cpu_to_le16(chan->dcid);
8d5a04a1
MM		 4512 rsp.result = cpu_to_le16(result);
4513
1500109b
MM		 4514 l2cap_send_cmd(chan->conn, chan->ident, L2CAP_MOVE_CHAN_RSP,
4515 sizeof(rsp), &rsp);
8d5a04a1
MM		 4516}
4517
5b155ef9 4518static void l2cap_send_move_chan_cfm(struct l2cap_chan *chan, u16 result)
8d5a04a1
MM		 4519{
4520 struct l2cap_move_chan_cfm cfm;
8d5a04a1 4521
5b155ef9 4522 BT_DBG("chan %p, result 0x%4.4x", chan, result);
8d5a04a1 4523
5b155ef9 4524 chan->ident = l2cap_get_ident(chan->conn);
8d5a04a1 4525
5b155ef9 4526 cfm.icid = cpu_to_le16(chan->scid);
8d5a04a1
MM		 4527 cfm.result = cpu_to_le16(result);
4528
5b155ef9
MM		 4529 l2cap_send_cmd(chan->conn, chan->ident, L2CAP_MOVE_CHAN_CFM,
4530 sizeof(cfm), &cfm);
4531
4532 __set_chan_timer(chan, L2CAP_MOVE_TIMEOUT);
4533}
4534
4535static void l2cap_send_move_chan_cfm_icid(struct l2cap_conn *conn, u16 icid)
4536{
4537 struct l2cap_move_chan_cfm cfm;
4538
4539 BT_DBG("conn %p, icid 0x%4.4x", conn, icid);
4540
4541 cfm.icid = cpu_to_le16(icid);
dcf4adbf 4542 cfm.result = cpu_to_le16(L2CAP_MC_UNCONFIRMED);
5b155ef9
MM		 4543
4544 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_MOVE_CHAN_CFM,
4545 sizeof(cfm), &cfm);
8d5a04a1
MM		 4546}
4547
4548static void l2cap_send_move_chan_cfm_rsp(struct l2cap_conn *conn, u8 ident,
ad0ac6ca 4549 u16 icid)
8d5a04a1
MM		 4550{
4551 struct l2cap_move_chan_cfm_rsp rsp;
4552
ad0ac6ca 4553 BT_DBG("icid 0x%4.4x", icid);
8d5a04a1
MM		 4554
4555 rsp.icid = cpu_to_le16(icid);
4556 l2cap_send_cmd(conn, ident, L2CAP_MOVE_CHAN_CFM_RSP, sizeof(rsp), &rsp);
4557}
4558
5f3847a4
MM		 4559static void __release_logical_link(struct l2cap_chan *chan)
4560{
4561 chan->hs_hchan = NULL;
4562 chan->hs_hcon = NULL;
4563
4564 /* Placeholder - release the logical link */
4565}
4566
1500109b
MM		 4567static void l2cap_logical_fail(struct l2cap_chan *chan)
4568{
4569 /* Logical link setup failed */
4570 if (chan->state != BT_CONNECTED) {
4571 /* Create channel failure, disconnect */
5e4e3972 4572 l2cap_send_disconn_req(chan, ECONNRESET);
1500109b
MM		 4573 return;
4574 }
4575
4576 switch (chan->move_role) {
4577 case L2CAP_MOVE_ROLE_RESPONDER:
4578 l2cap_move_done(chan);
4579 l2cap_send_move_chan_rsp(chan, L2CAP_MR_NOT_SUPP);
4580 break;
4581 case L2CAP_MOVE_ROLE_INITIATOR:
4582 if (chan->move_state == L2CAP_MOVE_WAIT_LOGICAL_COMP ||
4583 chan->move_state == L2CAP_MOVE_WAIT_LOGICAL_CFM) {
4584 /* Remote has only sent pending or
4585 * success responses, clean up
4586 */
4587 l2cap_move_done(chan);
4588 }
4589
4590 /* Other amp move states imply that the move
4591 * has already aborted
4592 */
4593 l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);
4594 break;
4595 }
4596}
4597
4598static void l2cap_logical_finish_create(struct l2cap_chan *chan,
4599 struct hci_chan *hchan)
4600{
4601 struct l2cap_conf_rsp rsp;
1500109b 4602
336178a3 4603 chan->hs_hchan = hchan;
1500109b
MM		 4604 chan->hs_hcon->l2cap_data = chan->conn;
4605
35ba9561 4606 l2cap_send_efs_conf_rsp(chan, &rsp, chan->ident, 0);
1500109b
MM		 4607
4608 if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {
fe79c6fe 4609 int err;
1500109b
MM		 4610
4611 set_default_fcs(chan);
4612
4613 err = l2cap_ertm_init(chan);
4614 if (err < 0)
5e4e3972 4615 l2cap_send_disconn_req(chan, -err);
1500109b
MM		 4616 else
4617 l2cap_chan_ready(chan);
4618 }
4619}
4620
4621static void l2cap_logical_finish_move(struct l2cap_chan *chan,
4622 struct hci_chan *hchan)
4623{
4624 chan->hs_hcon = hchan->conn;
4625 chan->hs_hcon->l2cap_data = chan->conn;
4626
4627 BT_DBG("move_state %d", chan->move_state);
4628
4629 switch (chan->move_state) {
4630 case L2CAP_MOVE_WAIT_LOGICAL_COMP:
4631 /* Move confirm will be sent after a success
4632 * response is received
4633 */
4634 chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;
4635 break;
4636 case L2CAP_MOVE_WAIT_LOGICAL_CFM:
4637 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
4638 chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;
4639 } else if (chan->move_role == L2CAP_MOVE_ROLE_INITIATOR) {
4640 chan->move_state = L2CAP_MOVE_WAIT_CONFIRM_RSP;
4641 l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);
4642 } else if (chan->move_role == L2CAP_MOVE_ROLE_RESPONDER) {
4643 chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;
4644 l2cap_send_move_chan_rsp(chan, L2CAP_MR_SUCCESS);
4645 }
4646 break;
4647 default:
4648 /* Move was not in expected state, free the channel */
4649 __release_logical_link(chan);
4650
4651 chan->move_state = L2CAP_MOVE_STABLE;
4652 }
4653}
4654
4655/* Call with chan locked */
27695fb4
AE		 4656void l2cap_logical_cfm(struct l2cap_chan *chan, struct hci_chan *hchan,
4657 u8 status)
5b155ef9 4658{
1500109b
MM		 4659 BT_DBG("chan %p, hchan %p, status %d", chan, hchan, status);
4660
4661 if (status) {
4662 l2cap_logical_fail(chan);
4663 __release_logical_link(chan);
4664 return;
4665 }
4666
4667 if (chan->state != BT_CONNECTED) {
4668 /* Ignore logical link if channel is on BR/EDR */
6ed971ca 4669 if (chan->local_amp_id != AMP_ID_BREDR)
1500109b
MM		 4670 l2cap_logical_finish_create(chan, hchan);
4671 } else {
4672 l2cap_logical_finish_move(chan, hchan);
4673 }
5b155ef9
MM		 4674}
4675
3f7a56c4
MM		 4676void l2cap_move_start(struct l2cap_chan *chan)
4677{
4678 BT_DBG("chan %p", chan);
4679
6ed971ca 4680 if (chan->local_amp_id == AMP_ID_BREDR) {
3f7a56c4
MM		 4681 if (chan->chan_policy != BT_CHANNEL_POLICY_AMP_PREFERRED)
4682 return;
4683 chan->move_role = L2CAP_MOVE_ROLE_INITIATOR;
4684 chan->move_state = L2CAP_MOVE_WAIT_PREPARE;
4685 /* Placeholder - start physical link setup */
4686 } else {
4687 chan->move_role = L2CAP_MOVE_ROLE_INITIATOR;
4688 chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;
4689 chan->move_id = 0;
4690 l2cap_move_setup(chan);
4691 l2cap_send_move_chan_req(chan, 0);
4692 }
4693}
4694
8eb200bd
MM		 4695static void l2cap_do_create(struct l2cap_chan *chan, int result,
4696 u8 local_amp_id, u8 remote_amp_id)
4697{
62748ca1
AE		 4698 BT_DBG("chan %p state %s %u -> %u", chan, state_to_string(chan->state),
4699 local_amp_id, remote_amp_id);
4700
12d6cc60
AE		 4701 chan->fcs = L2CAP_FCS_NONE;
4702
62748ca1
AE		 4703 /* Outgoing channel on AMP */
4704 if (chan->state == BT_CONNECT) {
4705 if (result == L2CAP_CR_SUCCESS) {
4706 chan->local_amp_id = local_amp_id;
4707 l2cap_send_create_chan_req(chan, remote_amp_id);
4708 } else {
4709 /* Revert to BR/EDR connect */
4710 l2cap_send_conn_req(chan);
4711 }
4712
4713 return;
4714 }
4715
4716 /* Incoming channel on AMP */
4717 if (__l2cap_no_conn_pending(chan)) {
8eb200bd
MM		 4718 struct l2cap_conn_rsp rsp;
4719 char buf[128];
4720 rsp.scid = cpu_to_le16(chan->dcid);
4721 rsp.dcid = cpu_to_le16(chan->scid);
4722
8eb200bd
MM		 4723 if (result == L2CAP_CR_SUCCESS) {
4724 /* Send successful response */
dcf4adbf
JP		 4725 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
4726 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
8eb200bd
MM		 4727 } else {
4728 /* Send negative response */
dcf4adbf
JP		 4729 rsp.result = cpu_to_le16(L2CAP_CR_NO_MEM);
4730 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
8eb200bd
MM		 4731 }
4732
4733 l2cap_send_cmd(chan->conn, chan->ident, L2CAP_CREATE_CHAN_RSP,
4734 sizeof(rsp), &rsp);
4735
4736 if (result == L2CAP_CR_SUCCESS) {
f93fa273 4737 l2cap_state_change(chan, BT_CONFIG);
8eb200bd
MM		 4738 set_bit(CONF_REQ_SENT, &chan->conf_state);
4739 l2cap_send_cmd(chan->conn, l2cap_get_ident(chan->conn),
4740 L2CAP_CONF_REQ,
4741 l2cap_build_conf_req(chan, buf), buf);
4742 chan->num_conf_req++;
4743 }
8eb200bd
MM		 4744 }
4745}
4746
4747static void l2cap_do_move_initiate(struct l2cap_chan *chan, u8 local_amp_id,
4748 u8 remote_amp_id)
4749{
4750 l2cap_move_setup(chan);
4751 chan->move_id = local_amp_id;
4752 chan->move_state = L2CAP_MOVE_WAIT_RSP;
4753
4754 l2cap_send_move_chan_req(chan, remote_amp_id);
4755}
4756
4757static void l2cap_do_move_respond(struct l2cap_chan *chan, int result)
4758{
4759 struct hci_chan *hchan = NULL;
4760
4761 /* Placeholder - get hci_chan for logical link */
4762
4763 if (hchan) {
4764 if (hchan->state == BT_CONNECTED) {
4765 /* Logical link is ready to go */
4766 chan->hs_hcon = hchan->conn;
4767 chan->hs_hcon->l2cap_data = chan->conn;
4768 chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;
4769 l2cap_send_move_chan_rsp(chan, L2CAP_MR_SUCCESS);
4770
4771 l2cap_logical_cfm(chan, hchan, L2CAP_MR_SUCCESS);
4772 } else {
4773 /* Wait for logical link to be ready */
4774 chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;
4775 }
4776 } else {
4777 /* Logical link not available */
4778 l2cap_send_move_chan_rsp(chan, L2CAP_MR_NOT_ALLOWED);
4779 }
4780}
4781
4782static void l2cap_do_move_cancel(struct l2cap_chan *chan, int result)
4783{
4784 if (chan->move_role == L2CAP_MOVE_ROLE_RESPONDER) {
4785 u8 rsp_result;
4786 if (result == -EINVAL)
4787 rsp_result = L2CAP_MR_BAD_ID;
4788 else
4789 rsp_result = L2CAP_MR_NOT_ALLOWED;
4790
4791 l2cap_send_move_chan_rsp(chan, rsp_result);
4792 }
4793
4794 chan->move_role = L2CAP_MOVE_ROLE_NONE;
4795 chan->move_state = L2CAP_MOVE_STABLE;
4796
4797 /* Restart data transmission */
4798 l2cap_ertm_send(chan);
4799}
4800
a514b17f
AE		 4801/* Invoke with locked chan */
4802void __l2cap_physical_cfm(struct l2cap_chan *chan, int result)
8eb200bd 4803{
770bfefa 4804 u8 local_amp_id = chan->local_amp_id;
fffadc08 4805 u8 remote_amp_id = chan->remote_amp_id;
770bfefa 4806
8eb200bd
MM		 4807 BT_DBG("chan %p, result %d, local_amp_id %d, remote_amp_id %d",
4808 chan, result, local_amp_id, remote_amp_id);
4809
8eb200bd
MM		 4810 if (chan->state == BT_DISCONN || chan->state == BT_CLOSED) {
4811 l2cap_chan_unlock(chan);
4812 return;
4813 }
4814
4815 if (chan->state != BT_CONNECTED) {
4816 l2cap_do_create(chan, result, local_amp_id, remote_amp_id);
4817 } else if (result != L2CAP_MR_SUCCESS) {
4818 l2cap_do_move_cancel(chan, result);
4819 } else {
4820 switch (chan->move_role) {
4821 case L2CAP_MOVE_ROLE_INITIATOR:
4822 l2cap_do_move_initiate(chan, local_amp_id,
4823 remote_amp_id);
4824 break;
4825 case L2CAP_MOVE_ROLE_RESPONDER:
4826 l2cap_do_move_respond(chan, result);
4827 break;
4828 default:
4829 l2cap_do_move_cancel(chan, result);
4830 break;
4831 }
4832 }
8eb200bd
MM		 4833}
4834
8d5a04a1 4835static inline int l2cap_move_channel_req(struct l2cap_conn *conn,
ad0ac6ca
AE		 4836 struct l2cap_cmd_hdr *cmd,
4837 u16 cmd_len, void *data)
8d5a04a1
MM		 4838{
4839 struct l2cap_move_chan_req *req = data;
1500109b 4840 struct l2cap_move_chan_rsp rsp;
02b0fbb9 4841 struct l2cap_chan *chan;
8d5a04a1
MM		 4842 u16 icid = 0;
4843 u16 result = L2CAP_MR_NOT_ALLOWED;
4844
4845 if (cmd_len != sizeof(*req))
4846 return -EPROTO;
4847
4848 icid = le16_to_cpu(req->icid);
4849
ad0ac6ca 4850 BT_DBG("icid 0x%4.4x, dest_amp_id %d", icid, req->dest_amp_id);
8d5a04a1 4851
848566b3 4852 if (!conn->hs_enabled)
8d5a04a1
MM		 4853 return -EINVAL;
4854
02b0fbb9
MM		 4855 chan = l2cap_get_chan_by_dcid(conn, icid);
4856 if (!chan) {
1500109b 4857 rsp.icid = cpu_to_le16(icid);
dcf4adbf 4858 rsp.result = cpu_to_le16(L2CAP_MR_NOT_ALLOWED);
1500109b
MM		 4859 l2cap_send_cmd(conn, cmd->ident, L2CAP_MOVE_CHAN_RSP,
4860 sizeof(rsp), &rsp);
02b0fbb9
MM		 4861 return 0;
4862 }
4863
1500109b
MM		 4864 chan->ident = cmd->ident;
4865
02b0fbb9
MM		 4866 if (chan->scid < L2CAP_CID_DYN_START ||
4867 chan->chan_policy == BT_CHANNEL_POLICY_BREDR_ONLY ||
4868 (chan->mode != L2CAP_MODE_ERTM &&
4869 chan->mode != L2CAP_MODE_STREAMING)) {
4870 result = L2CAP_MR_NOT_ALLOWED;
4871 goto send_move_response;
4872 }
4873
4874 if (chan->local_amp_id == req->dest_amp_id) {
4875 result = L2CAP_MR_SAME_ID;
4876 goto send_move_response;
4877 }
4878
6ed971ca 4879 if (req->dest_amp_id != AMP_ID_BREDR) {
02b0fbb9
MM		 4880 struct hci_dev *hdev;
4881 hdev = hci_dev_get(req->dest_amp_id);
4882 if (!hdev || hdev->dev_type != HCI_AMP ||
4883 !test_bit(HCI_UP, &hdev->flags)) {
4884 if (hdev)
4885 hci_dev_put(hdev);
4886
4887 result = L2CAP_MR_BAD_ID;
4888 goto send_move_response;
4889 }
4890 hci_dev_put(hdev);
4891 }
4892
4893 /* Detect a move collision. Only send a collision response
4894 * if this side has "lost", otherwise proceed with the move.
4895 * The winner has the larger bd_addr.
4896 */
4897 if ((__chan_is_moving(chan) ||
4898 chan->move_role != L2CAP_MOVE_ROLE_NONE) &&
6f59b904 4899 bacmp(&conn->hcon->src, &conn->hcon->dst) > 0) {
02b0fbb9
MM		 4900 result = L2CAP_MR_COLLISION;
4901 goto send_move_response;
4902 }
4903
02b0fbb9
MM		 4904 chan->move_role = L2CAP_MOVE_ROLE_RESPONDER;
4905 l2cap_move_setup(chan);
4906 chan->move_id = req->dest_amp_id;
4907 icid = chan->dcid;
4908
6ed971ca 4909 if (req->dest_amp_id == AMP_ID_BREDR) {
02b0fbb9
MM		 4910 /* Moving to BR/EDR */
4911 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
4912 chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;
4913 result = L2CAP_MR_PEND;
4914 } else {
4915 chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;
4916 result = L2CAP_MR_SUCCESS;
4917 }
4918 } else {
4919 chan->move_state = L2CAP_MOVE_WAIT_PREPARE;
4920 /* Placeholder - uncomment when amp functions are available */
4921 /*amp_accept_physical(chan, req->dest_amp_id);*/
4922 result = L2CAP_MR_PEND;
4923 }
4924
4925send_move_response:
1500109b 4926 l2cap_send_move_chan_rsp(chan, result);
8d5a04a1 4927
02b0fbb9
MM		 4928 l2cap_chan_unlock(chan);
4929
8d5a04a1
MM		 4930 return 0;
4931}
4932
5b155ef9
MM		 4933static void l2cap_move_continue(struct l2cap_conn *conn, u16 icid, u16 result)
4934{
4935 struct l2cap_chan *chan;
4936 struct hci_chan *hchan = NULL;
4937
4938 chan = l2cap_get_chan_by_scid(conn, icid);
4939 if (!chan) {
4940 l2cap_send_move_chan_cfm_icid(conn, icid);
4941 return;
4942 }
4943
4944 __clear_chan_timer(chan);
4945 if (result == L2CAP_MR_PEND)
4946 __set_chan_timer(chan, L2CAP_MOVE_ERTX_TIMEOUT);
4947
4948 switch (chan->move_state) {
4949 case L2CAP_MOVE_WAIT_LOGICAL_COMP:
4950 /* Move confirm will be sent when logical link
4951 * is complete.
4952 */
4953 chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;
4954 break;
4955 case L2CAP_MOVE_WAIT_RSP_SUCCESS:
4956 if (result == L2CAP_MR_PEND) {
4957 break;
4958 } else if (test_bit(CONN_LOCAL_BUSY,
4959 &chan->conn_state)) {
4960 chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;
4961 } else {
4962 /* Logical link is up or moving to BR/EDR,
4963 * proceed with move
4964 */
4965 chan->move_state = L2CAP_MOVE_WAIT_CONFIRM_RSP;
4966 l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);
4967 }
4968 break;
4969 case L2CAP_MOVE_WAIT_RSP:
4970 /* Moving to AMP */
4971 if (result == L2CAP_MR_SUCCESS) {
4972 /* Remote is ready, send confirm immediately
4973 * after logical link is ready
4974 */
4975 chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;
4976 } else {
4977 /* Both logical link and move success
4978 * are required to confirm
4979 */
4980 chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_COMP;
4981 }
4982
4983 /* Placeholder - get hci_chan for logical link */
4984 if (!hchan) {
4985 /* Logical link not available */
4986 l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);
4987 break;
4988 }
4989
4990 /* If the logical link is not yet connected, do not
4991 * send confirmation.
4992 */
4993 if (hchan->state != BT_CONNECTED)
4994 break;
4995
4996 /* Logical link is already ready to go */
4997
4998 chan->hs_hcon = hchan->conn;
4999 chan->hs_hcon->l2cap_data = chan->conn;
5000
5001 if (result == L2CAP_MR_SUCCESS) {
5002 /* Can confirm now */
5003 l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);
5004 } else {
5005 /* Now only need move success
5006 * to confirm
5007 */
5008 chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;
5009 }
5010
5011 l2cap_logical_cfm(chan, hchan, L2CAP_MR_SUCCESS);
5012 break;
5013 default:
5014 /* Any other amp move state means the move failed. */
5015 chan->move_id = chan->local_amp_id;
5016 l2cap_move_done(chan);
5017 l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);
5018 }
5019
5020 l2cap_chan_unlock(chan);
5021}
5022
5023static void l2cap_move_fail(struct l2cap_conn *conn, u8 ident, u16 icid,
5024 u16 result)
5025{
5026 struct l2cap_chan *chan;
5027
5028 chan = l2cap_get_chan_by_ident(conn, ident);
5029 if (!chan) {
5030 /* Could not locate channel, icid is best guess */
5031 l2cap_send_move_chan_cfm_icid(conn, icid);
5032 return;
5033 }
5034
5035 __clear_chan_timer(chan);
5036
5037 if (chan->move_role == L2CAP_MOVE_ROLE_INITIATOR) {
5038 if (result == L2CAP_MR_COLLISION) {
5039 chan->move_role = L2CAP_MOVE_ROLE_RESPONDER;
5040 } else {
5041 /* Cleanup - cancel move */
5042 chan->move_id = chan->local_amp_id;
5043 l2cap_move_done(chan);
5044 }
5045 }
5046
5047 l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);
5048
5049 l2cap_chan_unlock(chan);
5050}
5051
5052static int l2cap_move_channel_rsp(struct l2cap_conn *conn,
5053 struct l2cap_cmd_hdr *cmd,
5054 u16 cmd_len, void *data)
8d5a04a1
MM		 5055{
5056 struct l2cap_move_chan_rsp *rsp = data;
5057 u16 icid, result;
5058
5059 if (cmd_len != sizeof(*rsp))
5060 return -EPROTO;
5061
5062 icid = le16_to_cpu(rsp->icid);
5063 result = le16_to_cpu(rsp->result);
5064
ad0ac6ca 5065 BT_DBG("icid 0x%4.4x, result 0x%4.4x", icid, result);
8d5a04a1 5066
5b155ef9
MM		 5067 if (result == L2CAP_MR_SUCCESS || result == L2CAP_MR_PEND)
5068 l2cap_move_continue(conn, icid, result);
5069 else
5070 l2cap_move_fail(conn, cmd->ident, icid, result);
8d5a04a1
MM		 5071
5072 return 0;
5073}
5074
5f3847a4
MM		 5075static int l2cap_move_channel_confirm(struct l2cap_conn *conn,
5076 struct l2cap_cmd_hdr *cmd,
5077 u16 cmd_len, void *data)
8d5a04a1
MM		 5078{
5079 struct l2cap_move_chan_cfm *cfm = data;
5f3847a4 5080 struct l2cap_chan *chan;
8d5a04a1
MM		 5081 u16 icid, result;
5082
5083 if (cmd_len != sizeof(*cfm))
5084 return -EPROTO;
5085
5086 icid = le16_to_cpu(cfm->icid);
5087 result = le16_to_cpu(cfm->result);
5088
ad0ac6ca 5089 BT_DBG("icid 0x%4.4x, result 0x%4.4x", icid, result);
8d5a04a1 5090
5f3847a4
MM		 5091 chan = l2cap_get_chan_by_dcid(conn, icid);
5092 if (!chan) {
5093 /* Spec requires a response even if the icid was not found */
5094 l2cap_send_move_chan_cfm_rsp(conn, cmd->ident, icid);
5095 return 0;
5096 }
5097
5098 if (chan->move_state == L2CAP_MOVE_WAIT_CONFIRM) {
5099 if (result == L2CAP_MC_CONFIRMED) {
5100 chan->local_amp_id = chan->move_id;
6ed971ca 5101 if (chan->local_amp_id == AMP_ID_BREDR)
5f3847a4
MM		 5102 __release_logical_link(chan);
5103 } else {
5104 chan->move_id = chan->local_amp_id;
5105 }
5106
5107 l2cap_move_done(chan);
5108 }
5109
8d5a04a1
MM		 5110 l2cap_send_move_chan_cfm_rsp(conn, cmd->ident, icid);
5111
5f3847a4
MM		 5112 l2cap_chan_unlock(chan);
5113
8d5a04a1
MM		 5114 return 0;
5115}
5116
5117static inline int l2cap_move_channel_confirm_rsp(struct l2cap_conn *conn,
ad0ac6ca
AE		 5118 struct l2cap_cmd_hdr *cmd,
5119 u16 cmd_len, void *data)
8d5a04a1
MM		 5120{
5121 struct l2cap_move_chan_cfm_rsp *rsp = data;
3fd71a0a 5122 struct l2cap_chan *chan;
8d5a04a1
MM		 5123 u16 icid;
5124
5125 if (cmd_len != sizeof(*rsp))
5126 return -EPROTO;
5127
5128 icid = le16_to_cpu(rsp->icid);
5129
ad0ac6ca 5130 BT_DBG("icid 0x%4.4x", icid);
8d5a04a1 5131
3fd71a0a
MM		 5132 chan = l2cap_get_chan_by_scid(conn, icid);
5133 if (!chan)
5134 return 0;
5135
5136 __clear_chan_timer(chan);
5137
5138 if (chan->move_state == L2CAP_MOVE_WAIT_CONFIRM_RSP) {
5139 chan->local_amp_id = chan->move_id;
5140
6ed971ca 5141 if (chan->local_amp_id == AMP_ID_BREDR && chan->hs_hchan)
3fd71a0a
MM		 5142 __release_logical_link(chan);
5143
5144 l2cap_move_done(chan);
5145 }
5146
5147 l2cap_chan_unlock(chan);
5148
8d5a04a1
MM		 5149 return 0;
5150}
5151
de73115a 5152static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn,
2d792818 5153 struct l2cap_cmd_hdr *cmd,
203e639e 5154 u16 cmd_len, u8 *data)
de73115a
CT		 5155{
5156 struct hci_conn *hcon = conn->hcon;
5157 struct l2cap_conn_param_update_req *req;
5158 struct l2cap_conn_param_update_rsp rsp;
203e639e 5159 u16 min, max, latency, to_multiplier;
2ce603eb 5160 int err;
de73115a 5161
40bef302 5162 if (hcon->role != HCI_ROLE_MASTER)
de73115a
CT		 5163 return -EINVAL;
5164
de73115a
CT		 5165 if (cmd_len != sizeof(struct l2cap_conn_param_update_req))
5166 return -EPROTO;
5167
5168 req = (struct l2cap_conn_param_update_req *) data;
e2174ca4
GP		 5169 min = __le16_to_cpu(req->min);
5170 max = __le16_to_cpu(req->max);
de73115a
CT		 5171 latency = __le16_to_cpu(req->latency);
5172 to_multiplier = __le16_to_cpu(req->to_multiplier);
5173
5174 BT_DBG("min 0x%4.4x max 0x%4.4x latency: 0x%4.4x Timeout: 0x%4.4x",
2d792818 5175 min, max, latency, to_multiplier);
de73115a
CT		 5176
5177 memset(&rsp, 0, sizeof(rsp));
2ce603eb 5178
d4905f24 5179 err = hci_check_conn_params(min, max, latency, to_multiplier);
2ce603eb 5180 if (err)
dcf4adbf 5181 rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED);
de73115a 5182 else
dcf4adbf 5183 rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_ACCEPTED);
de73115a
CT		 5184
5185 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_PARAM_UPDATE_RSP,
2d792818 5186 sizeof(rsp), &rsp);
de73115a 5187
ffb5a827 5188 if (!err) {
f4869e2a
JH		 5189 u8 store_hint;
5190
5191 store_hint = hci_le_conn_update(hcon, min, max, latency,
5192 to_multiplier);
ffb5a827 5193 mgmt_new_conn_param(hcon->hdev, &hcon->dst, hcon->dst_type,
f4869e2a
JH		 5194 store_hint, min, max, latency,
5195 to_multiplier);
ffb5a827 5196
ffb5a827 5197 }
2ce603eb 5198
de73115a
CT		 5199 return 0;
5200}
5201
f1496dee
JH		 5202static int l2cap_le_connect_rsp(struct l2cap_conn *conn,
5203 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5204 u8 *data)
5205{
5206 struct l2cap_le_conn_rsp *rsp = (struct l2cap_le_conn_rsp *) data;
5207 u16 dcid, mtu, mps, credits, result;
5208 struct l2cap_chan *chan;
5209 int err;
5210
5211 if (cmd_len < sizeof(*rsp))
5212 return -EPROTO;
5213
5214 dcid = __le16_to_cpu(rsp->dcid);
5215 mtu = __le16_to_cpu(rsp->mtu);
5216 mps = __le16_to_cpu(rsp->mps);
5217 credits = __le16_to_cpu(rsp->credits);
5218 result = __le16_to_cpu(rsp->result);
5219
5220 if (result == L2CAP_CR_SUCCESS && (mtu < 23 || mps < 23))
5221 return -EPROTO;
5222
5223 BT_DBG("dcid 0x%4.4x mtu %u mps %u credits %u result 0x%2.2x",
5224 dcid, mtu, mps, credits, result);
5225
5226 mutex_lock(&conn->chan_lock);
5227
5228 chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
5229 if (!chan) {
5230 err = -EBADSLT;
5231 goto unlock;
5232 }
5233
5234 err = 0;
5235
5236 l2cap_chan_lock(chan);
5237
5238 switch (result) {
5239 case L2CAP_CR_SUCCESS:
5240 chan->ident = 0;
5241 chan->dcid = dcid;
5242 chan->omtu = mtu;
5243 chan->remote_mps = mps;
0cd75f7e 5244 chan->tx_credits = credits;
f1496dee
JH		 5245 l2cap_chan_ready(chan);
5246 break;
5247
5248 default:
5249 l2cap_chan_del(chan, ECONNREFUSED);
5250 break;
5251 }
5252
5253 l2cap_chan_unlock(chan);
5254
5255unlock:
5256 mutex_unlock(&conn->chan_lock);
5257
5258 return err;
5259}
5260
3300d9a9 5261static inline int l2cap_bredr_sig_cmd(struct l2cap_conn *conn,
2d792818
GP		 5262 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5263 u8 *data)
3300d9a9
CT		 5264{
5265 int err = 0;
5266
5267 switch (cmd->code) {
5268 case L2CAP_COMMAND_REJ:
cb3b3152 5269 l2cap_command_rej(conn, cmd, cmd_len, data);
3300d9a9
CT		 5270 break;
5271
5272 case L2CAP_CONN_REQ:
cb3b3152 5273 err = l2cap_connect_req(conn, cmd, cmd_len, data);
3300d9a9
CT		 5274 break;
5275
5276 case L2CAP_CONN_RSP:
f5a2598d 5277 case L2CAP_CREATE_CHAN_RSP:
9245e737 5278 l2cap_connect_create_rsp(conn, cmd, cmd_len, data);
3300d9a9
CT		 5279 break;
5280
5281 case L2CAP_CONF_REQ:
5282 err = l2cap_config_req(conn, cmd, cmd_len, data);
5283 break;
5284
5285 case L2CAP_CONF_RSP:
9245e737 5286 l2cap_config_rsp(conn, cmd, cmd_len, data);
3300d9a9
CT		 5287 break;
5288
5289 case L2CAP_DISCONN_REQ:
cb3b3152 5290 err = l2cap_disconnect_req(conn, cmd, cmd_len, data);
3300d9a9
CT		 5291 break;
5292
5293 case L2CAP_DISCONN_RSP:
9245e737 5294 l2cap_disconnect_rsp(conn, cmd, cmd_len, data);
3300d9a9
CT		 5295 break;
5296
5297 case L2CAP_ECHO_REQ:
5298 l2cap_send_cmd(conn, cmd->ident, L2CAP_ECHO_RSP, cmd_len, data);
5299 break;
5300
5301 case L2CAP_ECHO_RSP:
5302 break;
5303
5304 case L2CAP_INFO_REQ:
cb3b3152 5305 err = l2cap_information_req(conn, cmd, cmd_len, data);
3300d9a9
CT		 5306 break;
5307
5308 case L2CAP_INFO_RSP:
9245e737 5309 l2cap_information_rsp(conn, cmd, cmd_len, data);
3300d9a9
CT		 5310 break;
5311
f94ff6ff
MM		 5312 case L2CAP_CREATE_CHAN_REQ:
5313 err = l2cap_create_channel_req(conn, cmd, cmd_len, data);
5314 break;
5315
8d5a04a1
MM		 5316 case L2CAP_MOVE_CHAN_REQ:
5317 err = l2cap_move_channel_req(conn, cmd, cmd_len, data);
5318 break;
5319
5320 case L2CAP_MOVE_CHAN_RSP:
9245e737 5321 l2cap_move_channel_rsp(conn, cmd, cmd_len, data);
8d5a04a1
MM		 5322 break;
5323
5324 case L2CAP_MOVE_CHAN_CFM:
5325 err = l2cap_move_channel_confirm(conn, cmd, cmd_len, data);
5326 break;
5327
5328 case L2CAP_MOVE_CHAN_CFM_RSP:
9245e737 5329 l2cap_move_channel_confirm_rsp(conn, cmd, cmd_len, data);
8d5a04a1
MM		 5330 break;
5331
3300d9a9
CT		 5332 default:
5333 BT_ERR("Unknown BR/EDR signaling command 0x%2.2x", cmd->code);
5334 err = -EINVAL;
5335 break;
5336 }
5337
5338 return err;
5339}
5340
27e2d4c8
JH		 5341static int l2cap_le_connect_req(struct l2cap_conn *conn,
5342 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5343 u8 *data)
5344{
5345 struct l2cap_le_conn_req *req = (struct l2cap_le_conn_req *) data;
5346 struct l2cap_le_conn_rsp rsp;
5347 struct l2cap_chan *chan, *pchan;
0cd75f7e 5348 u16 dcid, scid, credits, mtu, mps;
27e2d4c8
JH		 5349 __le16 psm;
5350 u8 result;
5351
5352 if (cmd_len != sizeof(*req))
5353 return -EPROTO;
5354
5355 scid = __le16_to_cpu(req->scid);
5356 mtu = __le16_to_cpu(req->mtu);
5357 mps = __le16_to_cpu(req->mps);
5358 psm = req->psm;
5359 dcid = 0;
0cd75f7e 5360 credits = 0;
27e2d4c8
JH		 5361
5362 if (mtu < 23 || mps < 23)
5363 return -EPROTO;
5364
5365 BT_DBG("psm 0x%2.2x scid 0x%4.4x mtu %u mps %u", __le16_to_cpu(psm),
5366 scid, mtu, mps);
5367
5368 /* Check if we have socket listening on psm */
5369 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src,
5370 &conn->hcon->dst, LE_LINK);
5371 if (!pchan) {
5372 result = L2CAP_CR_BAD_PSM;
5373 chan = NULL;
5374 goto response;
5375 }
5376
5377 mutex_lock(&conn->chan_lock);
5378 l2cap_chan_lock(pchan);
5379
5380 if (!smp_sufficient_security(conn->hcon, pchan->sec_level)) {
5381 result = L2CAP_CR_AUTHENTICATION;
5382 chan = NULL;
5383 goto response_unlock;
5384 }
5385
5386 /* Check if we already have channel with that dcid */
5387 if (__l2cap_get_chan_by_dcid(conn, scid)) {
5388 result = L2CAP_CR_NO_MEM;
5389 chan = NULL;
5390 goto response_unlock;
5391 }
5392
5393 chan = pchan->ops->new_connection(pchan);
5394 if (!chan) {
5395 result = L2CAP_CR_NO_MEM;
5396 goto response_unlock;
5397 }
5398
0ce43ce6
JH		 5399 l2cap_le_flowctl_init(chan);
5400
27e2d4c8
JH		 5401 bacpy(&chan->src, &conn->hcon->src);
5402 bacpy(&chan->dst, &conn->hcon->dst);
5403 chan->src_type = bdaddr_type(conn->hcon, conn->hcon->src_type);
5404 chan->dst_type = bdaddr_type(conn->hcon, conn->hcon->dst_type);
5405 chan->psm = psm;
5406 chan->dcid = scid;
5407 chan->omtu = mtu;
5408 chan->remote_mps = mps;
0cd75f7e 5409 chan->tx_credits = __le16_to_cpu(req->credits);
27e2d4c8
JH		 5410
5411 __l2cap_chan_add(conn, chan);
5412 dcid = chan->scid;
0cd75f7e 5413 credits = chan->rx_credits;
27e2d4c8
JH		 5414
5415 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
5416
5417 chan->ident = cmd->ident;
5418
5419 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
5420 l2cap_state_change(chan, BT_CONNECT2);
434714dc
JH		 5421 /* The following result value is actually not defined
5422 * for LE CoC but we use it to let the function know
5423 * that it should bail out after doing its cleanup
5424 * instead of sending a response.
5425 */
27e2d4c8
JH		 5426 result = L2CAP_CR_PEND;
5427 chan->ops->defer(chan);
5428 } else {
5429 l2cap_chan_ready(chan);
5430 result = L2CAP_CR_SUCCESS;
5431 }
5432
5433response_unlock:
5434 l2cap_chan_unlock(pchan);
5435 mutex_unlock(&conn->chan_lock);
a24cce14 5436 l2cap_chan_put(pchan);
27e2d4c8
JH		 5437
5438 if (result == L2CAP_CR_PEND)
5439 return 0;
5440
5441response:
5442 if (chan) {
5443 rsp.mtu = cpu_to_le16(chan->imtu);
3916aed8 5444 rsp.mps = cpu_to_le16(chan->mps);
27e2d4c8
JH		 5445 } else {
5446 rsp.mtu = 0;
5447 rsp.mps = 0;
5448 }
5449
5450 rsp.dcid = cpu_to_le16(dcid);
0cd75f7e 5451 rsp.credits = cpu_to_le16(credits);
27e2d4c8
JH		 5452 rsp.result = cpu_to_le16(result);
5453
5454 l2cap_send_cmd(conn, cmd->ident, L2CAP_LE_CONN_RSP, sizeof(rsp), &rsp);
5455
5456 return 0;
5457}
5458
fad5fc89
JH		 5459static inline int l2cap_le_credits(struct l2cap_conn *conn,
5460 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5461 u8 *data)
5462{
5463 struct l2cap_le_credits *pkt;
5464 struct l2cap_chan *chan;
0f1bfe4e 5465 u16 cid, credits, max_credits;
fad5fc89
JH		 5466
5467 if (cmd_len != sizeof(*pkt))
5468 return -EPROTO;
5469
5470 pkt = (struct l2cap_le_credits *) data;
5471 cid = __le16_to_cpu(pkt->cid);
5472 credits = __le16_to_cpu(pkt->credits);
5473
5474 BT_DBG("cid 0x%4.4x credits 0x%4.4x", cid, credits);
5475
5476 chan = l2cap_get_chan_by_dcid(conn, cid);
5477 if (!chan)
5478 return -EBADSLT;
5479
0f1bfe4e
JH		 5480 max_credits = LE_FLOWCTL_MAX_CREDITS - chan->tx_credits;
5481 if (credits > max_credits) {
5482 BT_ERR("LE credits overflow");
5483 l2cap_send_disconn_req(chan, ECONNRESET);
5484
5485 /* Return 0 so that we don't trigger an unnecessary
5486 * command reject packet.
5487 */
5488 return 0;
5489 }
5490
fad5fc89
JH		 5491 chan->tx_credits += credits;
5492
5493 while (chan->tx_credits && !skb_queue_empty(&chan->tx_q)) {
5494 l2cap_do_send(chan, skb_dequeue(&chan->tx_q));
5495 chan->tx_credits--;
5496 }
5497
5498 if (chan->tx_credits)
5499 chan->ops->resume(chan);
5500
5501 l2cap_chan_unlock(chan);
5502
5503 return 0;
5504}
5505
71fb4197
JH		 5506static inline int l2cap_le_command_rej(struct l2cap_conn *conn,
5507 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5508 u8 *data)
5509{
5510 struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data;
5511 struct l2cap_chan *chan;
5512
5513 if (cmd_len < sizeof(*rej))
5514 return -EPROTO;
5515
5516 mutex_lock(&conn->chan_lock);
5517
5518 chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
5519 if (!chan)
5520 goto done;
5521
5522 l2cap_chan_lock(chan);
5523 l2cap_chan_del(chan, ECONNREFUSED);
5524 l2cap_chan_unlock(chan);
5525
5526done:
5527 mutex_unlock(&conn->chan_lock);
5528 return 0;
5529}
5530
3300d9a9 5531static inline int l2cap_le_sig_cmd(struct l2cap_conn *conn,
203e639e
JH		 5532 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5533 u8 *data)
3300d9a9 5534{
b5ecba64
JH		 5535 int err = 0;
5536
3300d9a9
CT		 5537 switch (cmd->code) {
5538 case L2CAP_COMMAND_REJ:
71fb4197 5539 l2cap_le_command_rej(conn, cmd, cmd_len, data);
b5ecba64 5540 break;
3300d9a9
CT		 5541
5542 case L2CAP_CONN_PARAM_UPDATE_REQ:
b5ecba64
JH		 5543 err = l2cap_conn_param_update_req(conn, cmd, cmd_len, data);
5544 break;
3300d9a9
CT		 5545
5546 case L2CAP_CONN_PARAM_UPDATE_RSP:
b5ecba64 5547 break;
3300d9a9 5548
f1496dee
JH		 5549 case L2CAP_LE_CONN_RSP:
5550 l2cap_le_connect_rsp(conn, cmd, cmd_len, data);
b5ecba64 5551 break;
f1496dee 5552
27e2d4c8 5553 case L2CAP_LE_CONN_REQ:
b5ecba64
JH		 5554 err = l2cap_le_connect_req(conn, cmd, cmd_len, data);
5555 break;
27e2d4c8 5556
fad5fc89
JH		 5557 case L2CAP_LE_CREDITS:
5558 err = l2cap_le_credits(conn, cmd, cmd_len, data);
5559 break;
5560
3defe01a 5561 case L2CAP_DISCONN_REQ:
b5ecba64
JH		 5562 err = l2cap_disconnect_req(conn, cmd, cmd_len, data);
5563 break;
3defe01a
JH		 5564
5565 case L2CAP_DISCONN_RSP:
5566 l2cap_disconnect_rsp(conn, cmd, cmd_len, data);
b5ecba64 5567 break;
3defe01a 5568
3300d9a9
CT		 5569 default:
5570 BT_ERR("Unknown LE signaling command 0x%2.2x", cmd->code);
b5ecba64
JH		 5571 err = -EINVAL;
5572 break;
3300d9a9 5573 }
b5ecba64
JH		 5574
5575 return err;
3300d9a9
CT		 5576}
5577
c5623556
JH		 5578static inline void l2cap_le_sig_channel(struct l2cap_conn *conn,
5579 struct sk_buff *skb)
5580{
69c4e4e8 5581 struct hci_conn *hcon = conn->hcon;
4f3e219d
MH		 5582 struct l2cap_cmd_hdr *cmd;
5583 u16 len;
c5623556
JH		 5584 int err;
5585
69c4e4e8 5586 if (hcon->type != LE_LINK)
3b166295 5587 goto drop;
69c4e4e8 5588
4f3e219d
MH		 5589 if (skb->len < L2CAP_CMD_HDR_SIZE)
5590 goto drop;
c5623556 5591
4f3e219d
MH		 5592 cmd = (void *) skb->data;
5593 skb_pull(skb, L2CAP_CMD_HDR_SIZE);
c5623556 5594
4f3e219d 5595 len = le16_to_cpu(cmd->len);
c5623556 5596
4f3e219d 5597 BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd->code, len, cmd->ident);
c5623556 5598
4f3e219d
MH		 5599 if (len != skb->len || !cmd->ident) {
5600 BT_DBG("corrupted command");
5601 goto drop;
5602 }
c5623556 5603
203e639e 5604 err = l2cap_le_sig_cmd(conn, cmd, len, skb->data);
4f3e219d
MH		 5605 if (err) {
5606 struct l2cap_cmd_rej_unk rej;
c5623556 5607
4f3e219d 5608 BT_ERR("Wrong link type (%d)", err);
c5623556 5609
dcf4adbf 5610 rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
4f3e219d
MH		 5611 l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ,
5612 sizeof(rej), &rej);
c5623556
JH		 5613 }
5614
3b166295 5615drop:
c5623556
JH		 5616 kfree_skb(skb);
5617}
5618
3300d9a9 5619static inline void l2cap_sig_channel(struct l2cap_conn *conn,
2d792818 5620 struct sk_buff *skb)
1da177e4 5621{
69c4e4e8 5622 struct hci_conn *hcon = conn->hcon;
1da177e4
LT		 5623 u8 *data = skb->data;
5624 int len = skb->len;
5625 struct l2cap_cmd_hdr cmd;
3300d9a9 5626 int err;
1da177e4
LT		 5627
5628 l2cap_raw_recv(conn, skb);
5629
69c4e4e8 5630 if (hcon->type != ACL_LINK)
3b166295 5631 goto drop;
69c4e4e8 5632
1da177e4 5633 while (len >= L2CAP_CMD_HDR_SIZE) {
88219a0f 5634 u16 cmd_len;
1da177e4
LT		 5635 memcpy(&cmd, data, L2CAP_CMD_HDR_SIZE);
5636 data += L2CAP_CMD_HDR_SIZE;
5637 len -= L2CAP_CMD_HDR_SIZE;
5638
88219a0f 5639 cmd_len = le16_to_cpu(cmd.len);
1da177e4 5640
2d792818
GP		 5641 BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd.code, cmd_len,
5642 cmd.ident);
1da177e4 5643
88219a0f 5644 if (cmd_len > len || !cmd.ident) {
1da177e4
LT		 5645 BT_DBG("corrupted command");
5646 break;
5647 }
5648
c5623556 5649 err = l2cap_bredr_sig_cmd(conn, &cmd, cmd_len, data);
1da177e4 5650 if (err) {
e2fd318e 5651 struct l2cap_cmd_rej_unk rej;
2c6d1a2e
GP		 5652
5653 BT_ERR("Wrong link type (%d)", err);
1da177e4 5654
dcf4adbf 5655 rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
2d792818
GP		 5656 l2cap_send_cmd(conn, cmd.ident, L2CAP_COMMAND_REJ,
5657 sizeof(rej), &rej);
1da177e4
LT		 5658 }
5659
88219a0f
AV		 5660 data += cmd_len;
5661 len -= cmd_len;
1da177e4
LT		 5662 }
5663
3b166295 5664drop:
1da177e4
LT		 5665 kfree_skb(skb);
5666}
5667
47d1ec61 5668static int l2cap_check_fcs(struct l2cap_chan *chan, struct sk_buff *skb)
fcc203c3
GP		 5669{
5670 u16 our_fcs, rcv_fcs;
e4ca6d98
AE		 5671 int hdr_size;
5672
5673 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
5674 hdr_size = L2CAP_EXT_HDR_SIZE;
5675 else
5676 hdr_size = L2CAP_ENH_HDR_SIZE;
fcc203c3 5677
47d1ec61 5678 if (chan->fcs == L2CAP_FCS_CRC16) {
03a51213 5679 skb_trim(skb, skb->len - L2CAP_FCS_SIZE);
fcc203c3
GP		 5680 rcv_fcs = get_unaligned_le16(skb->data + skb->len);
5681 our_fcs = crc16(0, skb->data - hdr_size, skb->len + hdr_size);
5682
5683 if (our_fcs != rcv_fcs)
7a560e5c 5684 return -EBADMSG;
fcc203c3
GP		 5685 }
5686 return 0;
5687}
5688
6ea00485 5689static void l2cap_send_i_or_rr_or_rnr(struct l2cap_chan *chan)
d5392c8f 5690{
e31f7633 5691 struct l2cap_ctrl control;
d5392c8f 5692
e31f7633 5693 BT_DBG("chan %p", chan);
d5392c8f 5694
e31f7633
MM		 5695 memset(&control, 0, sizeof(control));
5696 control.sframe = 1;
5697 control.final = 1;
5698 control.reqseq = chan->buffer_seq;
5699 set_bit(CONN_SEND_FBIT, &chan->conn_state);
d5392c8f 5700
e2ab4353 5701 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
e31f7633
MM		 5702 control.super = L2CAP_SUPER_RNR;
5703 l2cap_send_sframe(chan, &control);
d5392c8f
GP		 5704 }
5705
e31f7633
MM		 5706 if (test_and_clear_bit(CONN_REMOTE_BUSY, &chan->conn_state) &&
5707 chan->unacked_frames > 0)
5708 __set_retrans_timer(chan);
d5392c8f 5709
e31f7633 5710 /* Send pending iframes */
525cd185 5711 l2cap_ertm_send(chan);
d5392c8f 5712
e2ab4353 5713 if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&
e31f7633
MM		 5714 test_bit(CONN_SEND_FBIT, &chan->conn_state)) {
5715 /* F-bit wasn't sent in an s-frame or i-frame yet, so
5716 * send it now.
5717 */
5718 control.super = L2CAP_SUPER_RR;
5719 l2cap_send_sframe(chan, &control);
d5392c8f
GP		 5720 }
5721}
5722
2d792818
GP		 5723static void append_skb_frag(struct sk_buff *skb, struct sk_buff *new_frag,
5724 struct sk_buff **last_frag)
18778a63 5725{
84084a31
MM		 5726 /* skb->len reflects data in skb as well as all fragments
5727 * skb->data_len reflects only data in fragments
5728 */
5729 if (!skb_has_frag_list(skb))
5730 skb_shinfo(skb)->frag_list = new_frag;
5731
5732 new_frag->next = NULL;
5733
5734 (*last_frag)->next = new_frag;
5735 *last_frag = new_frag;
5736
5737 skb->len += new_frag->len;
5738 skb->data_len += new_frag->len;
5739 skb->truesize += new_frag->truesize;
5740}
5741
4b51dae9
MM		 5742static int l2cap_reassemble_sdu(struct l2cap_chan *chan, struct sk_buff *skb,
5743 struct l2cap_ctrl *control)
84084a31
MM		 5744{
5745 int err = -EINVAL;
18778a63 5746
4b51dae9 5747 switch (control->sar) {
7e0ef6ee 5748 case L2CAP_SAR_UNSEGMENTED:
84084a31
MM		 5749 if (chan->sdu)
5750 break;
18778a63 5751
80b98027 5752 err = chan->ops->recv(chan, skb);
84084a31 5753 break;
18778a63 5754
7e0ef6ee 5755 case L2CAP_SAR_START:
84084a31
MM		 5756 if (chan->sdu)
5757 break;
18778a63 5758
6f61fd47 5759 chan->sdu_len = get_unaligned_le16(skb->data);
03a51213 5760 skb_pull(skb, L2CAP_SDULEN_SIZE);
18778a63 5761
84084a31
MM		 5762 if (chan->sdu_len > chan->imtu) {
5763 err = -EMSGSIZE;
5764 break;
5765 }
1890d36b 5766
84084a31
MM		 5767 if (skb->len >= chan->sdu_len)
5768 break;
18778a63 5769
84084a31
MM		 5770 chan->sdu = skb;
5771 chan->sdu_last_frag = skb;
18778a63 5772
84084a31
MM		 5773 skb = NULL;
5774 err = 0;
18778a63
GP		 5775 break;
5776
7e0ef6ee 5777 case L2CAP_SAR_CONTINUE:
6f61fd47 5778 if (!chan->sdu)
84084a31 5779 break;
18778a63 5780
84084a31
MM		 5781 append_skb_frag(chan->sdu, skb,
5782 &chan->sdu_last_frag);
5783 skb = NULL;
18778a63 5784
84084a31
MM		 5785 if (chan->sdu->len >= chan->sdu_len)
5786 break;
4178ba46 5787
84084a31 5788 err = 0;
18778a63
GP		 5789 break;
5790
7e0ef6ee 5791 case L2CAP_SAR_END:
6f61fd47 5792 if (!chan->sdu)
84084a31 5793 break;
18778a63 5794
84084a31
MM		 5795 append_skb_frag(chan->sdu, skb,
5796 &chan->sdu_last_frag);
5797 skb = NULL;
4178ba46 5798
84084a31
MM		 5799 if (chan->sdu->len != chan->sdu_len)
5800 break;
18778a63 5801
80b98027 5802 err = chan->ops->recv(chan, chan->sdu);
1890d36b 5803
84084a31
MM		 5804 if (!err) {
5805 /* Reassembly complete */
5806 chan->sdu = NULL;
5807 chan->sdu_last_frag = NULL;
5808 chan->sdu_len = 0;
1890d36b 5809 }
18778a63
GP		 5810 break;
5811 }
5812
84084a31
MM		 5813 if (err) {
5814 kfree_skb(skb);
5815 kfree_skb(chan->sdu);
5816 chan->sdu = NULL;
5817 chan->sdu_last_frag = NULL;
5818 chan->sdu_len = 0;
5819 }
18778a63 5820
84084a31 5821 return err;
18778a63
GP		 5822}
5823
32b32735
MM		 5824static int l2cap_resegment(struct l2cap_chan *chan)
5825{
5826 /* Placeholder */
5827 return 0;
5828}
5829
61aa4f5b 5830void l2cap_chan_busy(struct l2cap_chan *chan, int busy)
26f880d2 5831{
61aa4f5b 5832 u8 event;
712132eb 5833
61aa4f5b
MM		 5834 if (chan->mode != L2CAP_MODE_ERTM)
5835 return;
712132eb 5836
61aa4f5b 5837 event = busy ? L2CAP_EV_LOCAL_BUSY_DETECTED : L2CAP_EV_LOCAL_BUSY_CLEAR;
401bb1f7 5838 l2cap_tx(chan, NULL, NULL, event);
1890d36b
GP		 5839}
5840
d2a7ac5d
MM		 5841static int l2cap_rx_queued_iframes(struct l2cap_chan *chan)
5842{
63838725
MM		 5843 int err = 0;
5844 /* Pass sequential frames to l2cap_reassemble_sdu()
5845 * until a gap is encountered.
5846 */
5847
5848 BT_DBG("chan %p", chan);
5849
5850 while (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
5851 struct sk_buff *skb;
5852 BT_DBG("Searching for skb with txseq %d (queue len %d)",
5853 chan->buffer_seq, skb_queue_len(&chan->srej_q));
5854
5855 skb = l2cap_ertm_seq_in_queue(&chan->srej_q, chan->buffer_seq);
5856
5857 if (!skb)
5858 break;
5859
5860 skb_unlink(skb, &chan->srej_q);
5861 chan->buffer_seq = __next_seq(chan, chan->buffer_seq);
5862 err = l2cap_reassemble_sdu(chan, skb, &bt_cb(skb)->control);
5863 if (err)
5864 break;
5865 }
5866
5867 if (skb_queue_empty(&chan->srej_q)) {
5868 chan->rx_state = L2CAP_RX_STATE_RECV;
5869 l2cap_send_ack(chan);
5870 }
5871
5872 return err;
d2a7ac5d
MM		 5873}
5874
5875static void l2cap_handle_srej(struct l2cap_chan *chan,
5876 struct l2cap_ctrl *control)
5877{
f80842a8
MM		 5878 struct sk_buff *skb;
5879
5880 BT_DBG("chan %p, control %p", chan, control);
5881
5882 if (control->reqseq == chan->next_tx_seq) {
5883 BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq);
5e4e3972 5884 l2cap_send_disconn_req(chan, ECONNRESET);
f80842a8
MM		 5885 return;
5886 }
5887
5888 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);
5889
5890 if (skb == NULL) {
5891 BT_DBG("Seq %d not available for retransmission",
5892 control->reqseq);
5893 return;
5894 }
5895
5896 if (chan->max_tx != 0 && bt_cb(skb)->control.retries >= chan->max_tx) {
5897 BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
5e4e3972 5898 l2cap_send_disconn_req(chan, ECONNRESET);
f80842a8
MM		 5899 return;
5900 }
5901
5902 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
5903
5904 if (control->poll) {
5905 l2cap_pass_to_tx(chan, control);
5906
5907 set_bit(CONN_SEND_FBIT, &chan->conn_state);
5908 l2cap_retransmit(chan, control);
5909 l2cap_ertm_send(chan);
5910
5911 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) {
5912 set_bit(CONN_SREJ_ACT, &chan->conn_state);
5913 chan->srej_save_reqseq = control->reqseq;
5914 }
5915 } else {
5916 l2cap_pass_to_tx_fbit(chan, control);
5917
5918 if (control->final) {
5919 if (chan->srej_save_reqseq != control->reqseq ||
5920 !test_and_clear_bit(CONN_SREJ_ACT,
5921 &chan->conn_state))
5922 l2cap_retransmit(chan, control);
5923 } else {
5924 l2cap_retransmit(chan, control);
5925 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) {
5926 set_bit(CONN_SREJ_ACT, &chan->conn_state);
5927 chan->srej_save_reqseq = control->reqseq;
5928 }
5929 }
5930 }
d2a7ac5d
MM		 5931}
5932
5933static void l2cap_handle_rej(struct l2cap_chan *chan,
5934 struct l2cap_ctrl *control)
5935{
fcd289df
MM		 5936 struct sk_buff *skb;
5937
5938 BT_DBG("chan %p, control %p", chan, control);
5939
5940 if (control->reqseq == chan->next_tx_seq) {
5941 BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq);
5e4e3972 5942 l2cap_send_disconn_req(chan, ECONNRESET);
fcd289df
MM		 5943 return;
5944 }
5945
5946 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);
5947
5948 if (chan->max_tx && skb &&
5949 bt_cb(skb)->control.retries >= chan->max_tx) {
5950 BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
5e4e3972 5951 l2cap_send_disconn_req(chan, ECONNRESET);
fcd289df
MM		 5952 return;
5953 }
5954
5955 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
5956
5957 l2cap_pass_to_tx(chan, control);
5958
5959 if (control->final) {
5960 if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))
5961 l2cap_retransmit_all(chan, control);
5962 } else {
5963 l2cap_retransmit_all(chan, control);
5964 l2cap_ertm_send(chan);
5965 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F)
5966 set_bit(CONN_REJ_ACT, &chan->conn_state);
5967 }
d2a7ac5d
MM		 5968}
5969
4b51dae9
MM		 5970static u8 l2cap_classify_txseq(struct l2cap_chan *chan, u16 txseq)
5971{
5972 BT_DBG("chan %p, txseq %d", chan, txseq);
5973
5974 BT_DBG("last_acked_seq %d, expected_tx_seq %d", chan->last_acked_seq,
5975 chan->expected_tx_seq);
5976
5977 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
5978 if (__seq_offset(chan, txseq, chan->last_acked_seq) >=
2d792818 5979 chan->tx_win) {
4b51dae9
MM		 5980 /* See notes below regarding "double poll" and
5981 * invalid packets.
5982 */
5983 if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) {
5984 BT_DBG("Invalid/Ignore - after SREJ");
5985 return L2CAP_TXSEQ_INVALID_IGNORE;
5986 } else {
5987 BT_DBG("Invalid - in window after SREJ sent");
5988 return L2CAP_TXSEQ_INVALID;
5989 }
5990 }
5991
5992 if (chan->srej_list.head == txseq) {
5993 BT_DBG("Expected SREJ");
5994 return L2CAP_TXSEQ_EXPECTED_SREJ;
5995 }
5996
5997 if (l2cap_ertm_seq_in_queue(&chan->srej_q, txseq)) {
5998 BT_DBG("Duplicate SREJ - txseq already stored");
5999 return L2CAP_TXSEQ_DUPLICATE_SREJ;
6000 }
6001
6002 if (l2cap_seq_list_contains(&chan->srej_list, txseq)) {
6003 BT_DBG("Unexpected SREJ - not requested");
6004 return L2CAP_TXSEQ_UNEXPECTED_SREJ;
6005 }
6006 }
6007
6008 if (chan->expected_tx_seq == txseq) {
6009 if (__seq_offset(chan, txseq, chan->last_acked_seq) >=
6010 chan->tx_win) {
6011 BT_DBG("Invalid - txseq outside tx window");
6012 return L2CAP_TXSEQ_INVALID;
6013 } else {
6014 BT_DBG("Expected");
6015 return L2CAP_TXSEQ_EXPECTED;
6016 }
6017 }
6018
6019 if (__seq_offset(chan, txseq, chan->last_acked_seq) <
2d792818 6020 __seq_offset(chan, chan->expected_tx_seq, chan->last_acked_seq)) {
4b51dae9
MM		 6021 BT_DBG("Duplicate - expected_tx_seq later than txseq");
6022 return L2CAP_TXSEQ_DUPLICATE;
6023 }
6024
6025 if (__seq_offset(chan, txseq, chan->last_acked_seq) >= chan->tx_win) {
6026 /* A source of invalid packets is a "double poll" condition,
6027 * where delays cause us to send multiple poll packets. If
6028 * the remote stack receives and processes both polls,
6029 * sequence numbers can wrap around in such a way that a
6030 * resent frame has a sequence number that looks like new data
6031 * with a sequence gap. This would trigger an erroneous SREJ
6032 * request.
6033 *
6034 * Fortunately, this is impossible with a tx window that's
6035 * less than half of the maximum sequence number, which allows
6036 * invalid frames to be safely ignored.
6037 *
6038 * With tx window sizes greater than half of the tx window
6039 * maximum, the frame is invalid and cannot be ignored. This
6040 * causes a disconnect.
6041 */
6042
6043 if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) {
6044 BT_DBG("Invalid/Ignore - txseq outside tx window");
6045 return L2CAP_TXSEQ_INVALID_IGNORE;
6046 } else {
6047 BT_DBG("Invalid - txseq outside tx window");
6048 return L2CAP_TXSEQ_INVALID;
6049 }
6050 } else {
6051 BT_DBG("Unexpected - txseq indicates missing frames");
6052 return L2CAP_TXSEQ_UNEXPECTED;
6053 }
6054}
6055
d2a7ac5d
MM		 6056static int l2cap_rx_state_recv(struct l2cap_chan *chan,
6057 struct l2cap_ctrl *control,
6058 struct sk_buff *skb, u8 event)
6059{
6060 int err = 0;
941247f9 6061 bool skb_in_use = false;
d2a7ac5d
MM		 6062
6063 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
6064 event);
6065
6066 switch (event) {
6067 case L2CAP_EV_RECV_IFRAME:
6068 switch (l2cap_classify_txseq(chan, control->txseq)) {
6069 case L2CAP_TXSEQ_EXPECTED:
6070 l2cap_pass_to_tx(chan, control);
6071
6072 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
6073 BT_DBG("Busy, discarding expected seq %d",
6074 control->txseq);
6075 break;
6076 }
6077
6078 chan->expected_tx_seq = __next_seq(chan,
6079 control->txseq);
6080
6081 chan->buffer_seq = chan->expected_tx_seq;
941247f9 6082 skb_in_use = true;
d2a7ac5d
MM		 6083
6084 err = l2cap_reassemble_sdu(chan, skb, control);
6085 if (err)
6086 break;
6087
6088 if (control->final) {
6089 if (!test_and_clear_bit(CONN_REJ_ACT,
6090 &chan->conn_state)) {
6091 control->final = 0;
6092 l2cap_retransmit_all(chan, control);
6093 l2cap_ertm_send(chan);
6094 }
6095 }
6096
6097 if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state))
6098 l2cap_send_ack(chan);
6099 break;
6100 case L2CAP_TXSEQ_UNEXPECTED:
6101 l2cap_pass_to_tx(chan, control);
6102
6103 /* Can't issue SREJ frames in the local busy state.
6104 * Drop this frame, it will be seen as missing
6105 * when local busy is exited.
6106 */
6107 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
6108 BT_DBG("Busy, discarding unexpected seq %d",
6109 control->txseq);
6110 break;
6111 }
6112
6113 /* There was a gap in the sequence, so an SREJ
6114 * must be sent for each missing frame. The
6115 * current frame is stored for later use.
6116 */
6117 skb_queue_tail(&chan->srej_q, skb);
941247f9 6118 skb_in_use = true;
d2a7ac5d
MM		 6119 BT_DBG("Queued %p (queue len %d)", skb,
6120 skb_queue_len(&chan->srej_q));
6121
6122 clear_bit(CONN_SREJ_ACT, &chan->conn_state);
6123 l2cap_seq_list_clear(&chan->srej_list);
6124 l2cap_send_srej(chan, control->txseq);
6125
6126 chan->rx_state = L2CAP_RX_STATE_SREJ_SENT;
6127 break;
6128 case L2CAP_TXSEQ_DUPLICATE:
6129 l2cap_pass_to_tx(chan, control);
6130 break;
6131 case L2CAP_TXSEQ_INVALID_IGNORE:
6132 break;
6133 case L2CAP_TXSEQ_INVALID:
6134 default:
5e4e3972 6135 l2cap_send_disconn_req(chan, ECONNRESET);
d2a7ac5d
MM		 6136 break;
6137 }
6138 break;
6139 case L2CAP_EV_RECV_RR:
6140 l2cap_pass_to_tx(chan, control);
6141 if (control->final) {
6142 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6143
e6a3ee6e
MM		 6144 if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state) &&
6145 !__chan_is_moving(chan)) {
d2a7ac5d
MM		 6146 control->final = 0;
6147 l2cap_retransmit_all(chan, control);
6148 }
6149
6150 l2cap_ertm_send(chan);
6151 } else if (control->poll) {
6152 l2cap_send_i_or_rr_or_rnr(chan);
6153 } else {
6154 if (test_and_clear_bit(CONN_REMOTE_BUSY,
6155 &chan->conn_state) &&
6156 chan->unacked_frames)
6157 __set_retrans_timer(chan);
6158
6159 l2cap_ertm_send(chan);
6160 }
6161 break;
6162 case L2CAP_EV_RECV_RNR:
6163 set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6164 l2cap_pass_to_tx(chan, control);
6165 if (control && control->poll) {
6166 set_bit(CONN_SEND_FBIT, &chan->conn_state);
6167 l2cap_send_rr_or_rnr(chan, 0);
6168 }
6169 __clear_retrans_timer(chan);
6170 l2cap_seq_list_clear(&chan->retrans_list);
6171 break;
6172 case L2CAP_EV_RECV_REJ:
6173 l2cap_handle_rej(chan, control);
6174 break;
6175 case L2CAP_EV_RECV_SREJ:
6176 l2cap_handle_srej(chan, control);
6177 break;
6178 default:
6179 break;
6180 }
6181
6182 if (skb && !skb_in_use) {
6183 BT_DBG("Freeing %p", skb);
6184 kfree_skb(skb);
6185 }
6186
6187 return err;
6188}
6189
6190static int l2cap_rx_state_srej_sent(struct l2cap_chan *chan,
6191 struct l2cap_ctrl *control,
6192 struct sk_buff *skb, u8 event)
6193{
6194 int err = 0;
6195 u16 txseq = control->txseq;
941247f9 6196 bool skb_in_use = false;
d2a7ac5d
MM		 6197
6198 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
6199 event);
6200
6201 switch (event) {
6202 case L2CAP_EV_RECV_IFRAME:
6203 switch (l2cap_classify_txseq(chan, txseq)) {
6204 case L2CAP_TXSEQ_EXPECTED:
6205 /* Keep frame for reassembly later */
6206 l2cap_pass_to_tx(chan, control);
6207 skb_queue_tail(&chan->srej_q, skb);
941247f9 6208 skb_in_use = true;
d2a7ac5d
MM		 6209 BT_DBG("Queued %p (queue len %d)", skb,
6210 skb_queue_len(&chan->srej_q));
6211
6212 chan->expected_tx_seq = __next_seq(chan, txseq);
6213 break;
6214 case L2CAP_TXSEQ_EXPECTED_SREJ:
6215 l2cap_seq_list_pop(&chan->srej_list);
6216
6217 l2cap_pass_to_tx(chan, control);
6218 skb_queue_tail(&chan->srej_q, skb);
941247f9 6219 skb_in_use = true;
d2a7ac5d
MM		 6220 BT_DBG("Queued %p (queue len %d)", skb,
6221 skb_queue_len(&chan->srej_q));
6222
6223 err = l2cap_rx_queued_iframes(chan);
6224 if (err)
6225 break;
6226
6227 break;
6228 case L2CAP_TXSEQ_UNEXPECTED:
6229 /* Got a frame that can't be reassembled yet.
6230 * Save it for later, and send SREJs to cover
6231 * the missing frames.
6232 */
6233 skb_queue_tail(&chan->srej_q, skb);
941247f9 6234 skb_in_use = true;
d2a7ac5d
MM		 6235 BT_DBG("Queued %p (queue len %d)", skb,
6236 skb_queue_len(&chan->srej_q));
6237
6238 l2cap_pass_to_tx(chan, control);
6239 l2cap_send_srej(chan, control->txseq);
6240 break;
6241 case L2CAP_TXSEQ_UNEXPECTED_SREJ:
6242 /* This frame was requested with an SREJ, but
6243 * some expected retransmitted frames are
6244 * missing. Request retransmission of missing
6245 * SREJ'd frames.
6246 */
6247 skb_queue_tail(&chan->srej_q, skb);
941247f9 6248 skb_in_use = true;
d2a7ac5d
MM		 6249 BT_DBG("Queued %p (queue len %d)", skb,
6250 skb_queue_len(&chan->srej_q));
6251
6252 l2cap_pass_to_tx(chan, control);
6253 l2cap_send_srej_list(chan, control->txseq);
6254 break;
6255 case L2CAP_TXSEQ_DUPLICATE_SREJ:
6256 /* We've already queued this frame. Drop this copy. */
6257 l2cap_pass_to_tx(chan, control);
6258 break;
6259 case L2CAP_TXSEQ_DUPLICATE:
6260 /* Expecting a later sequence number, so this frame
6261 * was already received. Ignore it completely.
6262 */
6263 break;
6264 case L2CAP_TXSEQ_INVALID_IGNORE:
6265 break;
6266 case L2CAP_TXSEQ_INVALID:
6267 default:
5e4e3972 6268 l2cap_send_disconn_req(chan, ECONNRESET);
d2a7ac5d
MM		 6269 break;
6270 }
6271 break;
6272 case L2CAP_EV_RECV_RR:
6273 l2cap_pass_to_tx(chan, control);
6274 if (control->final) {
6275 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6276
6277 if (!test_and_clear_bit(CONN_REJ_ACT,
6278 &chan->conn_state)) {
6279 control->final = 0;
6280 l2cap_retransmit_all(chan, control);
6281 }
6282
6283 l2cap_ertm_send(chan);
6284 } else if (control->poll) {
6285 if (test_and_clear_bit(CONN_REMOTE_BUSY,
6286 &chan->conn_state) &&
6287 chan->unacked_frames) {
6288 __set_retrans_timer(chan);
6289 }
6290
6291 set_bit(CONN_SEND_FBIT, &chan->conn_state);
6292 l2cap_send_srej_tail(chan);
6293 } else {
6294 if (test_and_clear_bit(CONN_REMOTE_BUSY,
6295 &chan->conn_state) &&
6296 chan->unacked_frames)
6297 __set_retrans_timer(chan);
6298
6299 l2cap_send_ack(chan);
6300 }
6301 break;
6302 case L2CAP_EV_RECV_RNR:
6303 set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6304 l2cap_pass_to_tx(chan, control);
6305 if (control->poll) {
6306 l2cap_send_srej_tail(chan);
6307 } else {
6308 struct l2cap_ctrl rr_control;
6309 memset(&rr_control, 0, sizeof(rr_control));
6310 rr_control.sframe = 1;
6311 rr_control.super = L2CAP_SUPER_RR;
6312 rr_control.reqseq = chan->buffer_seq;
6313 l2cap_send_sframe(chan, &rr_control);
6314 }
6315
6316 break;
6317 case L2CAP_EV_RECV_REJ:
6318 l2cap_handle_rej(chan, control);
6319 break;
6320 case L2CAP_EV_RECV_SREJ:
6321 l2cap_handle_srej(chan, control);
6322 break;
6323 }
6324
6325 if (skb && !skb_in_use) {
6326 BT_DBG("Freeing %p", skb);
6327 kfree_skb(skb);
6328 }
6329
6330 return err;
6331}
6332
32b32735
MM		 6333static int l2cap_finish_move(struct l2cap_chan *chan)
6334{
6335 BT_DBG("chan %p", chan);
6336
6337 chan->rx_state = L2CAP_RX_STATE_RECV;
6338
6339 if (chan->hs_hcon)
6340 chan->conn->mtu = chan->hs_hcon->hdev->block_mtu;
6341 else
6342 chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu;
6343
6344 return l2cap_resegment(chan);
6345}
6346
6347static int l2cap_rx_state_wait_p(struct l2cap_chan *chan,
6348 struct l2cap_ctrl *control,
6349 struct sk_buff *skb, u8 event)
6350{
6351 int err;
6352
6353 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
6354 event);
6355
6356 if (!control->poll)
6357 return -EPROTO;
6358
6359 l2cap_process_reqseq(chan, control->reqseq);
6360
6361 if (!skb_queue_empty(&chan->tx_q))
6362 chan->tx_send_head = skb_peek(&chan->tx_q);
6363 else
6364 chan->tx_send_head = NULL;
6365
6366 /* Rewind next_tx_seq to the point expected
6367 * by the receiver.
6368 */
6369 chan->next_tx_seq = control->reqseq;
6370 chan->unacked_frames = 0;
6371
6372 err = l2cap_finish_move(chan);
6373 if (err)
6374 return err;
6375
6376 set_bit(CONN_SEND_FBIT, &chan->conn_state);
6377 l2cap_send_i_or_rr_or_rnr(chan);
6378
6379 if (event == L2CAP_EV_RECV_IFRAME)
6380 return -EPROTO;
6381
6382 return l2cap_rx_state_recv(chan, control, NULL, event);
6383}
6384
6385static int l2cap_rx_state_wait_f(struct l2cap_chan *chan,
6386 struct l2cap_ctrl *control,
6387 struct sk_buff *skb, u8 event)
6388{
6389 int err;
6390
6391 if (!control->final)
6392 return -EPROTO;
6393
6394 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6395
6396 chan->rx_state = L2CAP_RX_STATE_RECV;
6397 l2cap_process_reqseq(chan, control->reqseq);
6398
6399 if (!skb_queue_empty(&chan->tx_q))
6400 chan->tx_send_head = skb_peek(&chan->tx_q);
6401 else
6402 chan->tx_send_head = NULL;
6403
6404 /* Rewind next_tx_seq to the point expected
6405 * by the receiver.
6406 */
6407 chan->next_tx_seq = control->reqseq;
6408 chan->unacked_frames = 0;
6409
6410 if (chan->hs_hcon)
6411 chan->conn->mtu = chan->hs_hcon->hdev->block_mtu;
6412 else
6413 chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu;
6414
6415 err = l2cap_resegment(chan);
6416
6417 if (!err)
6418 err = l2cap_rx_state_recv(chan, control, skb, event);
6419
6420 return err;
6421}
6422
d2a7ac5d
MM		 6423static bool __valid_reqseq(struct l2cap_chan *chan, u16 reqseq)
6424{
6425 /* Make sure reqseq is for a packet that has been sent but not acked */
6426 u16 unacked;
6427
6428 unacked = __seq_offset(chan, chan->next_tx_seq, chan->expected_ack_seq);
6429 return __seq_offset(chan, chan->next_tx_seq, reqseq) <= unacked;
6430}
6431
cec8ab6e
MM		 6432static int l2cap_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
6433 struct sk_buff *skb, u8 event)
218bb9df 6434{
d2a7ac5d
MM		 6435 int err = 0;
6436
6437 BT_DBG("chan %p, control %p, skb %p, event %d, state %d", chan,
6438 control, skb, event, chan->rx_state);
6439
6440 if (__valid_reqseq(chan, control->reqseq)) {
6441 switch (chan->rx_state) {
6442 case L2CAP_RX_STATE_RECV:
6443 err = l2cap_rx_state_recv(chan, control, skb, event);
6444 break;
6445 case L2CAP_RX_STATE_SREJ_SENT:
6446 err = l2cap_rx_state_srej_sent(chan, control, skb,
6447 event);
6448 break;
32b32735
MM		 6449 case L2CAP_RX_STATE_WAIT_P:
6450 err = l2cap_rx_state_wait_p(chan, control, skb, event);
6451 break;
6452 case L2CAP_RX_STATE_WAIT_F:
6453 err = l2cap_rx_state_wait_f(chan, control, skb, event);
6454 break;
d2a7ac5d
MM		 6455 default:
6456 /* shut it down */
6457 break;
6458 }
6459 } else {
6460 BT_DBG("Invalid reqseq %d (next_tx_seq %d, expected_ack_seq %d",
6461 control->reqseq, chan->next_tx_seq,
6462 chan->expected_ack_seq);
5e4e3972 6463 l2cap_send_disconn_req(chan, ECONNRESET);
d2a7ac5d
MM		 6464 }
6465
6466 return err;
cec8ab6e
MM		 6467}
6468
6469static int l2cap_stream_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
6470 struct sk_buff *skb)
6471{
4b51dae9
MM		 6472 int err = 0;
6473
6474 BT_DBG("chan %p, control %p, skb %p, state %d", chan, control, skb,
6475 chan->rx_state);
6476
6477 if (l2cap_classify_txseq(chan, control->txseq) ==
6478 L2CAP_TXSEQ_EXPECTED) {
6479 l2cap_pass_to_tx(chan, control);
6480
6481 BT_DBG("buffer_seq %d->%d", chan->buffer_seq,
6482 __next_seq(chan, chan->buffer_seq));
6483
6484 chan->buffer_seq = __next_seq(chan, chan->buffer_seq);
6485
6486 l2cap_reassemble_sdu(chan, skb, control);
6487 } else {
6488 if (chan->sdu) {
6489 kfree_skb(chan->sdu);
6490 chan->sdu = NULL;
6491 }
6492 chan->sdu_last_frag = NULL;
6493 chan->sdu_len = 0;
6494
6495 if (skb) {
6496 BT_DBG("Freeing %p", skb);
6497 kfree_skb(skb);
6498 }
6499 }
6500
6501 chan->last_acked_seq = control->txseq;
6502 chan->expected_tx_seq = __next_seq(chan, control->txseq);
6503
6504 return err;
cec8ab6e
MM		 6505}
6506
6507static int l2cap_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
6508{
6509 struct l2cap_ctrl *control = &bt_cb(skb)->control;
6510 u16 len;
6511 u8 event;
218bb9df 6512
b76bbd66
MM		 6513 __unpack_control(chan, skb);
6514
218bb9df
GP		 6515 len = skb->len;
6516
6517 /*
6518 * We can just drop the corrupted I-frame here.
6519 * Receiver will miss it and start proper recovery
cec8ab6e 6520 * procedures and ask for retransmission.
218bb9df 6521 */
47d1ec61 6522 if (l2cap_check_fcs(chan, skb))
218bb9df
GP		 6523 goto drop;
6524
cec8ab6e 6525 if (!control->sframe && control->sar == L2CAP_SAR_START)
03a51213 6526 len -= L2CAP_SDULEN_SIZE;
218bb9df 6527
47d1ec61 6528 if (chan->fcs == L2CAP_FCS_CRC16)
03a51213 6529 len -= L2CAP_FCS_SIZE;
218bb9df 6530
47d1ec61 6531 if (len > chan->mps) {
5e4e3972 6532 l2cap_send_disconn_req(chan, ECONNRESET);
218bb9df
GP		 6533 goto drop;
6534 }
6535
cec8ab6e
MM		 6536 if (!control->sframe) {
6537 int err;
218bb9df 6538
cec8ab6e
MM		 6539 BT_DBG("iframe sar %d, reqseq %d, final %d, txseq %d",
6540 control->sar, control->reqseq, control->final,
6541 control->txseq);
218bb9df 6542
cec8ab6e
MM		 6543 /* Validate F-bit - F=0 always valid, F=1 only
6544 * valid in TX WAIT_F
6545 */
6546 if (control->final && chan->tx_state != L2CAP_TX_STATE_WAIT_F)
218bb9df 6547 goto drop;
cec8ab6e
MM		 6548
6549 if (chan->mode != L2CAP_MODE_STREAMING) {
6550 event = L2CAP_EV_RECV_IFRAME;
6551 err = l2cap_rx(chan, control, skb, event);
6552 } else {
6553 err = l2cap_stream_rx(chan, control, skb);
218bb9df
GP		 6554 }
6555
cec8ab6e 6556 if (err)
5e4e3972 6557 l2cap_send_disconn_req(chan, ECONNRESET);
218bb9df 6558 } else {
cec8ab6e
MM		 6559 const u8 rx_func_to_event[4] = {
6560 L2CAP_EV_RECV_RR, L2CAP_EV_RECV_REJ,
6561 L2CAP_EV_RECV_RNR, L2CAP_EV_RECV_SREJ
6562 };
6563
6564 /* Only I-frames are expected in streaming mode */
6565 if (chan->mode == L2CAP_MODE_STREAMING)
6566 goto drop;
6567
6568 BT_DBG("sframe reqseq %d, final %d, poll %d, super %d",
6569 control->reqseq, control->final, control->poll,
6570 control->super);
6571
218bb9df 6572 if (len != 0) {
1bb166e6 6573 BT_ERR("Trailing bytes: %d in sframe", len);
5e4e3972 6574 l2cap_send_disconn_req(chan, ECONNRESET);
218bb9df
GP		 6575 goto drop;
6576 }
6577
cec8ab6e
MM		 6578 /* Validate F and P bits */
6579 if (control->final && (control->poll ||
6580 chan->tx_state != L2CAP_TX_STATE_WAIT_F))
6581 goto drop;
6582
6583 event = rx_func_to_event[control->super];
6584 if (l2cap_rx(chan, control, skb, event))
5e4e3972 6585 l2cap_send_disconn_req(chan, ECONNRESET);
218bb9df
GP		 6586 }
6587
6588 return 0;
6589
6590drop:
6591 kfree_skb(skb);
6592 return 0;
6593}
6594
b1c325c2
JH		 6595static void l2cap_chan_le_send_credits(struct l2cap_chan *chan)
6596{
6597 struct l2cap_conn *conn = chan->conn;
6598 struct l2cap_le_credits pkt;
6599 u16 return_credits;
6600
6601 /* We return more credits to the sender only after the amount of
6602 * credits falls below half of the initial amount.
6603 */
f15b8ecf 6604 if (chan->rx_credits >= (le_max_credits + 1) / 2)
b1c325c2
JH		 6605 return;
6606
f15b8ecf 6607 return_credits = le_max_credits - chan->rx_credits;
b1c325c2
JH		 6608
6609 BT_DBG("chan %p returning %u credits to sender", chan, return_credits);
6610
6611 chan->rx_credits += return_credits;
6612
6613 pkt.cid = cpu_to_le16(chan->scid);
6614 pkt.credits = cpu_to_le16(return_credits);
6615
6616 chan->ident = l2cap_get_ident(conn);
6617
6618 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CREDITS, sizeof(pkt), &pkt);
6619}
6620
fad5fc89
JH		 6621static int l2cap_le_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
6622{
aac23bf6
JH		 6623 int err;
6624
6625 if (!chan->rx_credits) {
6626 BT_ERR("No credits to receive LE L2CAP data");
dfd9774c 6627 l2cap_send_disconn_req(chan, ECONNRESET);
fad5fc89 6628 return -ENOBUFS;
aac23bf6 6629 }
fad5fc89 6630
aac23bf6
JH		 6631 if (chan->imtu < skb->len) {
6632 BT_ERR("Too big LE L2CAP PDU");
fad5fc89 6633 return -ENOBUFS;
aac23bf6 6634 }
fad5fc89
JH		 6635
6636 chan->rx_credits--;
6637 BT_DBG("rx_credits %u -> %u", chan->rx_credits + 1, chan->rx_credits);
6638
6639 l2cap_chan_le_send_credits(chan);
6640
aac23bf6
JH		 6641 err = 0;
6642
6643 if (!chan->sdu) {
6644 u16 sdu_len;
6645
6646 sdu_len = get_unaligned_le16(skb->data);
6647 skb_pull(skb, L2CAP_SDULEN_SIZE);
6648
6649 BT_DBG("Start of new SDU. sdu_len %u skb->len %u imtu %u",
6650 sdu_len, skb->len, chan->imtu);
6651
6652 if (sdu_len > chan->imtu) {
6653 BT_ERR("Too big LE L2CAP SDU length received");
6654 err = -EMSGSIZE;
6655 goto failed;
6656 }
6657
6658 if (skb->len > sdu_len) {
6659 BT_ERR("Too much LE L2CAP data received");
6660 err = -EINVAL;
6661 goto failed;
6662 }
6663
6664 if (skb->len == sdu_len)
6665 return chan->ops->recv(chan, skb);
6666
6667 chan->sdu = skb;
6668 chan->sdu_len = sdu_len;
6669 chan->sdu_last_frag = skb;
6670
6671 return 0;
6672 }
6673
6674 BT_DBG("SDU fragment. chan->sdu->len %u skb->len %u chan->sdu_len %u",
6675 chan->sdu->len, skb->len, chan->sdu_len);
6676
6677 if (chan->sdu->len + skb->len > chan->sdu_len) {
6678 BT_ERR("Too much LE L2CAP data received");
6679 err = -EINVAL;
6680 goto failed;
6681 }
6682
6683 append_skb_frag(chan->sdu, skb, &chan->sdu_last_frag);
6684 skb = NULL;
6685
6686 if (chan->sdu->len == chan->sdu_len) {
6687 err = chan->ops->recv(chan, chan->sdu);
6688 if (!err) {
6689 chan->sdu = NULL;
6690 chan->sdu_last_frag = NULL;
6691 chan->sdu_len = 0;
6692 }
6693 }
6694
6695failed:
6696 if (err) {
6697 kfree_skb(skb);
6698 kfree_skb(chan->sdu);
6699 chan->sdu = NULL;
6700 chan->sdu_last_frag = NULL;
6701 chan->sdu_len = 0;
6702 }
6703
6704 /* We can't return an error here since we took care of the skb
6705 * freeing internally. An error return would cause the caller to
6706 * do a double-free of the skb.
6707 */
6708 return 0;
fad5fc89
JH		 6709}
6710
13ca56e0
AE		 6711static void l2cap_data_channel(struct l2cap_conn *conn, u16 cid,
6712 struct sk_buff *skb)
1da177e4 6713{
48454079 6714 struct l2cap_chan *chan;
1da177e4 6715
baa7e1fa 6716 chan = l2cap_get_chan_by_scid(conn, cid);
48454079 6717 if (!chan) {
97e8e89d
AE		 6718 if (cid == L2CAP_CID_A2MP) {
6719 chan = a2mp_channel_create(conn, skb);
6720 if (!chan) {
6721 kfree_skb(skb);
13ca56e0 6722 return;
97e8e89d
AE		 6723 }
6724
6725 l2cap_chan_lock(chan);
6726 } else {
6727 BT_DBG("unknown cid 0x%4.4x", cid);
6728 /* Drop packet and return */
6729 kfree_skb(skb);
13ca56e0 6730 return;
97e8e89d 6731 }
1da177e4
LT		 6732 }
6733
49208c9c 6734 BT_DBG("chan %p, len %d", chan, skb->len);
1da177e4 6735
89bc500e 6736 if (chan->state != BT_CONNECTED)
1da177e4
LT		 6737 goto drop;
6738
0c1bc5c6 6739 switch (chan->mode) {
38319713 6740 case L2CAP_MODE_LE_FLOWCTL:
fad5fc89
JH		 6741 if (l2cap_le_data_rcv(chan, skb) < 0)
6742 goto drop;
6743
6744 goto done;
6745
1c2acffb
GP		 6746 case L2CAP_MODE_BASIC:
6747 /* If socket recv buffers overflows we drop data here
6748 * which is *bad* because L2CAP has to be reliable.
6749 * But we don't have any other choice. L2CAP doesn't
6750 * provide flow control mechanism. */
1da177e4 6751
2c96e03d
SJ		 6752 if (chan->imtu < skb->len) {
6753 BT_ERR("Dropping L2CAP data: receive buffer overflow");
1c2acffb 6754 goto drop;
2c96e03d 6755 }
1da177e4 6756
80b98027 6757 if (!chan->ops->recv(chan, skb))
1c2acffb
GP		 6758 goto done;
6759 break;
6760
6761 case L2CAP_MODE_ERTM:
6840ed07 6762 case L2CAP_MODE_STREAMING:
cec8ab6e 6763 l2cap_data_rcv(chan, skb);
6840ed07
GP		 6764 goto done;
6765
1c2acffb 6766 default:
0c1bc5c6 6767 BT_DBG("chan %p: bad mode 0x%2.2x", chan, chan->mode);
1c2acffb
GP		 6768 break;
6769 }
1da177e4
LT		 6770
6771drop:
6772 kfree_skb(skb);
6773
6774done:
6be36555 6775 l2cap_chan_unlock(chan);
1da177e4
LT		 6776}
6777
84104b24
AE		 6778static void l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm,
6779 struct sk_buff *skb)
1da177e4 6780{
ae4fd2d3 6781 struct hci_conn *hcon = conn->hcon;
23691d75 6782 struct l2cap_chan *chan;
1da177e4 6783
ae4fd2d3 6784 if (hcon->type != ACL_LINK)
a24cce14 6785 goto free_skb;
ae4fd2d3 6786
bf20fd4e
JH		 6787 chan = l2cap_global_chan_by_psm(0, psm, &hcon->src, &hcon->dst,
6788 ACL_LINK);
23691d75 6789 if (!chan)
a24cce14 6790 goto free_skb;
1da177e4 6791
5b4cedaa 6792 BT_DBG("chan %p, len %d", chan, skb->len);
1da177e4 6793
89bc500e 6794 if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)
1da177e4
LT		 6795 goto drop;
6796
e13e21dc 6797 if (chan->imtu < skb->len)
1da177e4
LT		 6798 goto drop;
6799
2edf870d 6800 /* Store remote BD_ADDR and PSM for msg_name */
06ae3314 6801 bacpy(&bt_cb(skb)->bdaddr, &hcon->dst);
2edf870d
MH		 6802 bt_cb(skb)->psm = psm;
6803
a24cce14
JH		 6804 if (!chan->ops->recv(chan, skb)) {
6805 l2cap_chan_put(chan);
84104b24 6806 return;
a24cce14 6807 }
1da177e4
LT		 6808
6809drop:
a24cce14
JH		 6810 l2cap_chan_put(chan);
6811free_skb:
1da177e4 6812 kfree_skb(skb);
1da177e4
LT		 6813}
6814
6815static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
6816{
6817 struct l2cap_hdr *lh = (void *) skb->data;
61a939c6 6818 struct hci_conn *hcon = conn->hcon;
8e036fc3
AV		 6819 u16 cid, len;
6820 __le16 psm;
1da177e4 6821
61a939c6
JH		 6822 if (hcon->state != BT_CONNECTED) {
6823 BT_DBG("queueing pending rx skb");
6824 skb_queue_tail(&conn->pending_rx, skb);
6825 return;
6826 }
6827
1da177e4
LT		 6828 skb_pull(skb, L2CAP_HDR_SIZE);
6829 cid = __le16_to_cpu(lh->cid);
6830 len = __le16_to_cpu(lh->len);
6831
1c2acffb
GP		 6832 if (len != skb->len) {
6833 kfree_skb(skb);
6834 return;
6835 }
6836
9e1d7e15
JH		 6837 /* Since we can't actively block incoming LE connections we must
6838 * at least ensure that we ignore incoming data from them.
6839 */
6840 if (hcon->type == LE_LINK &&
dcc36c16
JH		 6841 hci_bdaddr_list_lookup(&hcon->hdev->blacklist, &hcon->dst,
6842 bdaddr_type(hcon, hcon->dst_type))) {
e493150e
JH		 6843 kfree_skb(skb);
6844 return;
6845 }
6846
1da177e4
LT		 6847 BT_DBG("len %d, cid 0x%4.4x", len, cid);
6848
6849 switch (cid) {
8db4dc46 6850 case L2CAP_CID_SIGNALING:
1da177e4
LT		 6851 l2cap_sig_channel(conn, skb);
6852 break;
6853
8db4dc46 6854 case L2CAP_CID_CONN_LESS:
097db76c 6855 psm = get_unaligned((__le16 *) skb->data);
0181a70f 6856 skb_pull(skb, L2CAP_PSMLEN_SIZE);
1da177e4
LT		 6857 l2cap_conless_channel(conn, psm, skb);
6858 break;
6859
a2877629
MH		 6860 case L2CAP_CID_LE_SIGNALING:
6861 l2cap_le_sig_channel(conn, skb);
6862 break;
6863
1da177e4
LT		 6864 default:
6865 l2cap_data_channel(conn, cid, skb);
6866 break;
6867 }
6868}
6869
61a939c6
JH		 6870static void process_pending_rx(struct work_struct *work)
6871{
6872 struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
6873 pending_rx_work);
6874 struct sk_buff *skb;
6875
6876 BT_DBG("");
6877
6878 while ((skb = skb_dequeue(&conn->pending_rx)))
6879 l2cap_recv_frame(conn, skb);
6880}
6881
162b49e7
JH		 6882static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon)
6883{
6884 struct l2cap_conn *conn = hcon->l2cap_data;
6885 struct hci_chan *hchan;
6886
6887 if (conn)
6888 return conn;
6889
6890 hchan = hci_chan_create(hcon);
6891 if (!hchan)
6892 return NULL;
6893
27f70f3e 6894 conn = kzalloc(sizeof(*conn), GFP_KERNEL);
162b49e7
JH		 6895 if (!conn) {
6896 hci_chan_del(hchan);
6897 return NULL;
6898 }
6899
6900 kref_init(&conn->ref);
6901 hcon->l2cap_data = conn;
51bb8457 6902 conn->hcon = hci_conn_get(hcon);
162b49e7
JH		 6903 conn->hchan = hchan;
6904
6905 BT_DBG("hcon %p conn %p hchan %p", hcon, conn, hchan);
6906
6907 switch (hcon->type) {
6908 case LE_LINK:
6909 if (hcon->hdev->le_mtu) {
6910 conn->mtu = hcon->hdev->le_mtu;
6911 break;
6912 }
6913 /* fall through */
6914 default:
6915 conn->mtu = hcon->hdev->acl_mtu;
6916 break;
6917 }
6918
6919 conn->feat_mask = 0;
6920
6921 if (hcon->type == ACL_LINK)
6922 conn->hs_enabled = test_bit(HCI_HS_ENABLED,
6923 &hcon->hdev->dev_flags);
6924
5a54e7c8 6925 mutex_init(&conn->ident_lock);
162b49e7
JH		 6926 mutex_init(&conn->chan_lock);
6927
6928 INIT_LIST_HEAD(&conn->chan_l);
6929 INIT_LIST_HEAD(&conn->users);
6930
276d8073 6931 INIT_DELAYED_WORK(&conn->info_timer, l2cap_info_timeout);
162b49e7 6932
61a939c6
JH		 6933 skb_queue_head_init(&conn->pending_rx);
6934 INIT_WORK(&conn->pending_rx_work, process_pending_rx);
f3d82d0c 6935 INIT_WORK(&conn->id_addr_update_work, l2cap_conn_update_id_addr);
61a939c6 6936
162b49e7
JH		 6937 conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
6938
6939 return conn;
6940}
6941
6942static bool is_valid_psm(u16 psm, u8 dst_type) {
6943 if (!psm)
6944 return false;
6945
6946 if (bdaddr_type_is_le(dst_type))
6947 return (psm <= 0x00ff);
6948
6949 /* PSM must be odd and lsb of upper byte must be 0 */
6950 return ((psm & 0x0101) == 0x0001);
6951}
6952
6953int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,
6954 bdaddr_t *dst, u8 dst_type)
6955{
6956 struct l2cap_conn *conn;
6957 struct hci_conn *hcon;
6958 struct hci_dev *hdev;
162b49e7
JH		 6959 int err;
6960
6961 BT_DBG("%pMR -> %pMR (type %u) psm 0x%2.2x", &chan->src, dst,
6962 dst_type, __le16_to_cpu(psm));
6963
6964 hdev = hci_get_route(dst, &chan->src);
6965 if (!hdev)
6966 return -EHOSTUNREACH;
6967
6968 hci_dev_lock(hdev);
6969
6970 l2cap_chan_lock(chan);
6971
6972 if (!is_valid_psm(__le16_to_cpu(psm), dst_type) && !cid &&
6973 chan->chan_type != L2CAP_CHAN_RAW) {
6974 err = -EINVAL;
6975 goto done;
6976 }
6977
21626e62
JH		 6978 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED && !psm) {
6979 err = -EINVAL;
6980 goto done;
6981 }
6982
6983 if (chan->chan_type == L2CAP_CHAN_FIXED && !cid) {
162b49e7
JH		 6984 err = -EINVAL;
6985 goto done;
6986 }
6987
6988 switch (chan->mode) {
6989 case L2CAP_MODE_BASIC:
6990 break;
6991 case L2CAP_MODE_LE_FLOWCTL:
6992 l2cap_le_flowctl_init(chan);
6993 break;
6994 case L2CAP_MODE_ERTM:
6995 case L2CAP_MODE_STREAMING:
6996 if (!disable_ertm)
6997 break;
6998 /* fall through */
6999 default:
beb19e4c 7000 err = -EOPNOTSUPP;
162b49e7
JH		 7001 goto done;
7002 }
7003
7004 switch (chan->state) {
7005 case BT_CONNECT:
7006 case BT_CONNECT2:
7007 case BT_CONFIG:
7008 /* Already connecting */
7009 err = 0;
7010 goto done;
7011
7012 case BT_CONNECTED:
7013 /* Already connected */
7014 err = -EISCONN;
7015 goto done;
7016
7017 case BT_OPEN:
7018 case BT_BOUND:
7019 /* Can connect */
7020 break;
7021
7022 default:
7023 err = -EBADFD;
7024 goto done;
7025 }
7026
7027 /* Set destination address and psm */
7028 bacpy(&chan->dst, dst);
7029 chan->dst_type = dst_type;
7030
7031 chan->psm = psm;
7032 chan->dcid = cid;
7033
6f77d8c7 7034 if (bdaddr_type_is_le(dst_type)) {
e804d25d 7035 u8 role;
cdd6275e 7036
6f77d8c7
AG		 7037 /* Convert from L2CAP channel address type to HCI address type
7038 */
7039 if (dst_type == BDADDR_LE_PUBLIC)
7040 dst_type = ADDR_LE_DEV_PUBLIC;
7041 else
7042 dst_type = ADDR_LE_DEV_RANDOM;
7043
e804d25d
JH		 7044 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
7045 role = HCI_ROLE_SLAVE;
7046 else
7047 role = HCI_ROLE_MASTER;
cdd6275e 7048
04a6c589 7049 hcon = hci_connect_le(hdev, dst, dst_type, chan->sec_level,
e804d25d 7050 HCI_LE_CONN_TIMEOUT, role);
6f77d8c7 7051 } else {
d93375a8 7052 u8 auth_type = l2cap_get_auth_type(chan);
04a6c589 7053 hcon = hci_connect_acl(hdev, dst, chan->sec_level, auth_type);
6f77d8c7 7054 }
162b49e7
JH		 7055
7056 if (IS_ERR(hcon)) {
7057 err = PTR_ERR(hcon);
7058 goto done;
7059 }
7060
7061 conn = l2cap_conn_add(hcon);
7062 if (!conn) {
7063 hci_conn_drop(hcon);
7064 err = -ENOMEM;
7065 goto done;
7066 }
7067
7068 if (cid && __l2cap_get_chan_by_dcid(conn, cid)) {
7069 hci_conn_drop(hcon);
7070 err = -EBUSY;
7071 goto done;
7072 }
7073
7074 /* Update source addr of the socket */
7075 bacpy(&chan->src, &hcon->src);
7076 chan->src_type = bdaddr_type(hcon, hcon->src_type);
7077
162b49e7 7078 l2cap_chan_add(conn, chan);
162b49e7
JH		 7079
7080 /* l2cap_chan_add takes its own ref so we can drop this one */
7081 hci_conn_drop(hcon);
7082
7083 l2cap_state_change(chan, BT_CONNECT);
7084 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
7085
61202e4d
JH		 7086 /* Release chan->sport so that it can be reused by other
7087 * sockets (as it's only used for listening sockets).
7088 */
7089 write_lock(&chan_list_lock);
7090 chan->sport = 0;
7091 write_unlock(&chan_list_lock);
7092
162b49e7
JH		 7093 if (hcon->state == BT_CONNECTED) {
7094 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
7095 __clear_chan_timer(chan);
e7cafc45 7096 if (l2cap_chan_check_security(chan, true))
162b49e7
JH		 7097 l2cap_state_change(chan, BT_CONNECTED);
7098 } else
7099 l2cap_do_start(chan);
7100 }
7101
7102 err = 0;
7103
7104done:
7105 l2cap_chan_unlock(chan);
7106 hci_dev_unlock(hdev);
7107 hci_dev_put(hdev);
7108 return err;
7109}
6b8d4a6a 7110EXPORT_SYMBOL_GPL(l2cap_chan_connect);
162b49e7 7111
1da177e4
LT		 7112/* ---- L2CAP interface with lower layer (HCI) ---- */
7113
686ebf28 7114int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr)
1da177e4
LT		 7115{
7116 int exact = 0, lm1 = 0, lm2 = 0;
23691d75 7117 struct l2cap_chan *c;
1da177e4 7118
6ed93dc6 7119 BT_DBG("hdev %s, bdaddr %pMR", hdev->name, bdaddr);
1da177e4
LT		 7120
7121 /* Find listening sockets and check their link_mode */
23691d75
GP		 7122 read_lock(&chan_list_lock);
7123 list_for_each_entry(c, &chan_list, global_l) {
89bc500e 7124 if (c->state != BT_LISTEN)
1da177e4
LT		 7125 continue;
7126
7eafc59e 7127 if (!bacmp(&c->src, &hdev->bdaddr)) {
2af6b9d5 7128 lm1 |= HCI_LM_ACCEPT;
43bd0f32 7129 if (test_bit(FLAG_ROLE_SWITCH, &c->flags))
2af6b9d5 7130 lm1 |= HCI_LM_MASTER;
1da177e4 7131 exact++;
7eafc59e 7132 } else if (!bacmp(&c->src, BDADDR_ANY)) {
2af6b9d5 7133 lm2 |= HCI_LM_ACCEPT;
43bd0f32 7134 if (test_bit(FLAG_ROLE_SWITCH, &c->flags))
2af6b9d5
MH		 7135 lm2 |= HCI_LM_MASTER;
7136 }
1da177e4 7137 }
23691d75 7138 read_unlock(&chan_list_lock);
1da177e4
LT		 7139
7140 return exact ? lm1 : lm2;
7141}
7142
e760ec12
JH		 7143/* Find the next fixed channel in BT_LISTEN state, continue iteration
7144 * from an existing channel in the list or from the beginning of the
7145 * global list (by passing NULL as first parameter).
7146 */
7147static struct l2cap_chan *l2cap_global_fixed_chan(struct l2cap_chan *c,
54a1b626 7148 bdaddr_t *src, u8 link_type)
e760ec12
JH		 7149{
7150 read_lock(&chan_list_lock);
7151
7152 if (c)
7153 c = list_next_entry(c, global_l);
7154 else
7155 c = list_entry(chan_list.next, typeof(*c), global_l);
7156
7157 list_for_each_entry_from(c, &chan_list, global_l) {
7158 if (c->chan_type != L2CAP_CHAN_FIXED)
7159 continue;
7160 if (c->state != BT_LISTEN)
7161 continue;
7162 if (bacmp(&c->src, src) && bacmp(&c->src, BDADDR_ANY))
7163 continue;
54a1b626
JH		 7164 if (link_type == ACL_LINK && c->src_type != BDADDR_BREDR)
7165 continue;
7166 if (link_type == LE_LINK && c->src_type == BDADDR_BREDR)
7167 continue;
e760ec12
JH		 7168
7169 l2cap_chan_hold(c);
7170 read_unlock(&chan_list_lock);
7171 return c;
7172 }
7173
7174 read_unlock(&chan_list_lock);
7175
7176 return NULL;
7177}
7178
9e664631 7179void l2cap_connect_cfm(struct hci_conn *hcon, u8 status)
1da177e4 7180{
e760ec12 7181 struct hci_dev *hdev = hcon->hdev;
0139418c 7182 struct l2cap_conn *conn;
e760ec12
JH		 7183 struct l2cap_chan *pchan;
7184 u8 dst_type;
0139418c 7185
6ed93dc6 7186 BT_DBG("hcon %p bdaddr %pMR status %d", hcon, &hcon->dst, status);
1da177e4 7187
dc0f5088 7188 if (status) {
e175072f 7189 l2cap_conn_del(hcon, bt_to_errno(status));
dc0f5088 7190 return;
ba6fc317 7191 }
dc0f5088
JH		 7192
7193 conn = l2cap_conn_add(hcon);
7194 if (!conn)
7195 return;
7196
e760ec12
JH		 7197 dst_type = bdaddr_type(hcon, hcon->dst_type);
7198
7199 /* If device is blocked, do not create channels for it */
7200 if (hci_bdaddr_list_lookup(&hdev->blacklist, &hcon->dst, dst_type))
7201 return;
7202
7203 /* Find fixed channels and notify them of the new connection. We
7204 * use multiple individual lookups, continuing each time where
7205 * we left off, because the list lock would prevent calling the
7206 * potentially sleeping l2cap_chan_lock() function.
7207 */
54a1b626 7208 pchan = l2cap_global_fixed_chan(NULL, &hdev->bdaddr, hcon->type);
e760ec12
JH		 7209 while (pchan) {
7210 struct l2cap_chan *chan, *next;
7211
7212 /* Client fixed channels should override server ones */
7213 if (__l2cap_get_chan_by_dcid(conn, pchan->scid))
7214 goto next;
7215
7216 l2cap_chan_lock(pchan);
7217 chan = pchan->ops->new_connection(pchan);
7218 if (chan) {
7219 bacpy(&chan->src, &hcon->src);
7220 bacpy(&chan->dst, &hcon->dst);
7221 chan->src_type = bdaddr_type(hcon, hcon->src_type);
7222 chan->dst_type = dst_type;
7223
7224 __l2cap_chan_add(conn, chan);
7225 }
7226
7227 l2cap_chan_unlock(pchan);
7228next:
54a1b626
JH		 7229 next = l2cap_global_fixed_chan(pchan, &hdev->bdaddr,
7230 hcon->type);
e760ec12
JH		 7231 l2cap_chan_put(pchan);
7232 pchan = next;
7233 }
7234
dc0f5088 7235 l2cap_conn_ready(conn);
1da177e4
LT		 7236}
7237
686ebf28 7238int l2cap_disconn_ind(struct hci_conn *hcon)
2950f21a
MH		 7239{
7240 struct l2cap_conn *conn = hcon->l2cap_data;
7241
7242 BT_DBG("hcon %p", hcon);
7243
686ebf28 7244 if (!conn)
9f5a0d7b 7245 return HCI_ERROR_REMOTE_USER_TERM;
2950f21a
MH		 7246 return conn->disc_reason;
7247}
7248
9e664631 7249void l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason)
1da177e4
LT		 7250{
7251 BT_DBG("hcon %p reason %d", hcon, reason);
7252
e175072f 7253 l2cap_conn_del(hcon, bt_to_errno(reason));
1da177e4
LT		 7254}
7255
4343478f 7256static inline void l2cap_check_encryption(struct l2cap_chan *chan, u8 encrypt)
f62e4323 7257{
715ec005 7258 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED)
255c7601
MH		 7259 return;
7260
f62e4323 7261 if (encrypt == 0x00) {
4343478f 7262 if (chan->sec_level == BT_SECURITY_MEDIUM) {
ba13ccd9 7263 __set_chan_timer(chan, L2CAP_ENC_TIMEOUT);
7d513e92
MH		 7264 } else if (chan->sec_level == BT_SECURITY_HIGH ||
7265 chan->sec_level == BT_SECURITY_FIPS)
0f852724 7266 l2cap_chan_close(chan, ECONNREFUSED);
f62e4323 7267 } else {
4343478f 7268 if (chan->sec_level == BT_SECURITY_MEDIUM)
c9b66675 7269 __clear_chan_timer(chan);
f62e4323
MH		 7270 }
7271}
7272
686ebf28 7273int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
1da177e4 7274{
0139418c 7275 struct l2cap_conn *conn = hcon->l2cap_data;
48454079 7276 struct l2cap_chan *chan;
1da177e4 7277
0139418c 7278 if (!conn)
1da177e4 7279 return 0;
0139418c 7280
89d8b407 7281 BT_DBG("conn %p status 0x%2.2x encrypt %u", conn, status, encrypt);
1da177e4 7282
3df91ea2 7283 mutex_lock(&conn->chan_lock);
1da177e4 7284
3df91ea2 7285 list_for_each_entry(chan, &conn->chan_l, list) {
6be36555 7286 l2cap_chan_lock(chan);
1da177e4 7287
89d8b407
AE		 7288 BT_DBG("chan %p scid 0x%4.4x state %s", chan, chan->scid,
7289 state_to_string(chan->state));
f1cb9af5 7290
2338a7e0 7291 if (chan->scid == L2CAP_CID_A2MP) {
78eb2f98
AE		 7292 l2cap_chan_unlock(chan);
7293 continue;
7294 }
7295
191eb398
JH		 7296 if (!status && encrypt)
7297 chan->sec_level = hcon->sec_level;
f1cb9af5 7298
96eff46e 7299 if (!__l2cap_no_conn_pending(chan)) {
6be36555 7300 l2cap_chan_unlock(chan);
6a8d3010
MH		 7301 continue;
7302 }
7303
89bc500e 7304 if (!status && (chan->state == BT_CONNECTED ||
2d792818 7305 chan->state == BT_CONFIG)) {
d97c899b 7306 chan->ops->resume(chan);
4343478f 7307 l2cap_check_encryption(chan, encrypt);
6be36555 7308 l2cap_chan_unlock(chan);
9719f8af
MH		 7309 continue;
7310 }
7311
89bc500e 7312 if (chan->state == BT_CONNECT) {
6d3c15da 7313 if (!status)
93c3e8f5 7314 l2cap_start_connection(chan);
6d3c15da 7315 else
ba13ccd9 7316 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
89bc500e 7317 } else if (chan->state == BT_CONNECT2) {
b1235d79 7318 struct l2cap_conn_rsp rsp;
df3c3931 7319 __u16 res, stat;
1da177e4 7320
b1235d79 7321 if (!status) {
bdc25783 7322 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
df3c3931
JH		 7323 res = L2CAP_CR_PEND;
7324 stat = L2CAP_CS_AUTHOR_PEND;
2dc4e510 7325 chan->ops->defer(chan);
df3c3931 7326 } else {
acdcabf5 7327 l2cap_state_change(chan, BT_CONFIG);
df3c3931
JH		 7328 res = L2CAP_CR_SUCCESS;
7329 stat = L2CAP_CS_NO_INFO;
7330 }
b1235d79 7331 } else {
acdcabf5 7332 l2cap_state_change(chan, BT_DISCONN);
ba13ccd9 7333 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
df3c3931
JH		 7334 res = L2CAP_CR_SEC_BLOCK;
7335 stat = L2CAP_CS_NO_INFO;
b1235d79
MH		 7336 }
7337
fe4128e0
GP		 7338 rsp.scid = cpu_to_le16(chan->dcid);
7339 rsp.dcid = cpu_to_le16(chan->scid);
df3c3931
JH		 7340 rsp.result = cpu_to_le16(res);
7341 rsp.status = cpu_to_le16(stat);
fc7f8a7e 7342 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
2d792818 7343 sizeof(rsp), &rsp);
2d369359
MM		 7344
7345 if (!test_bit(CONF_REQ_SENT, &chan->conf_state) &&
7346 res == L2CAP_CR_SUCCESS) {
7347 char buf[128];
7348 set_bit(CONF_REQ_SENT, &chan->conf_state);
7349 l2cap_send_cmd(conn, l2cap_get_ident(conn),
7350 L2CAP_CONF_REQ,
7351 l2cap_build_conf_req(chan, buf),
7352 buf);
7353 chan->num_conf_req++;
7354 }
b1235d79 7355 }
1da177e4 7356
6be36555 7357 l2cap_chan_unlock(chan);
1da177e4
LT		 7358 }
7359
3df91ea2 7360 mutex_unlock(&conn->chan_lock);
b1235d79 7361
1da177e4
LT		 7362 return 0;
7363}
7364
686ebf28 7365int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
1da177e4
LT		 7366{
7367 struct l2cap_conn *conn = hcon->l2cap_data;
d73a0988
AE		 7368 struct l2cap_hdr *hdr;
7369 int len;
1da177e4 7370
1d13a254
AE		 7371 /* For AMP controller do not create l2cap conn */
7372 if (!conn && hcon->hdev->dev_type != HCI_BREDR)
7373 goto drop;
1da177e4 7374
5a08ecce 7375 if (!conn)
baf43251 7376 conn = l2cap_conn_add(hcon);
5a08ecce
AE		 7377
7378 if (!conn)
1da177e4
LT		 7379 goto drop;
7380
7381 BT_DBG("conn %p len %d flags 0x%x", conn, skb->len, flags);
7382
d73a0988
AE		 7383 switch (flags) {
7384 case ACL_START:
7385 case ACL_START_NO_FLUSH:
7386 case ACL_COMPLETE:
1da177e4
LT		 7387 if (conn->rx_len) {
7388 BT_ERR("Unexpected start frame (len %d)", skb->len);
7389 kfree_skb(conn->rx_skb);
7390 conn->rx_skb = NULL;
7391 conn->rx_len = 0;
7392 l2cap_conn_unreliable(conn, ECOMM);
7393 }
7394
aae7fe22
AE		 7395 /* Start fragment always begin with Basic L2CAP header */
7396 if (skb->len < L2CAP_HDR_SIZE) {
1da177e4
LT		 7397 BT_ERR("Frame is too short (len %d)", skb->len);
7398 l2cap_conn_unreliable(conn, ECOMM);
7399 goto drop;
7400 }
7401
7402 hdr = (struct l2cap_hdr *) skb->data;
7403 len = __le16_to_cpu(hdr->len) + L2CAP_HDR_SIZE;
7404
7405 if (len == skb->len) {
7406 /* Complete frame received */
7407 l2cap_recv_frame(conn, skb);
7408 return 0;
7409 }
7410
7411 BT_DBG("Start: total len %d, frag len %d", len, skb->len);
7412
7413 if (skb->len > len) {
7414 BT_ERR("Frame is too long (len %d, expected len %d)",
2d792818 7415 skb->len, len);
1da177e4
LT		 7416 l2cap_conn_unreliable(conn, ECOMM);
7417 goto drop;
7418 }
7419
7420 /* Allocate skb for the complete frame (with header) */
8bcde1f2 7421 conn->rx_skb = bt_skb_alloc(len, GFP_KERNEL);
af05b30b 7422 if (!conn->rx_skb)
1da177e4
LT		 7423 goto drop;
7424
d626f62b 7425 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
2d792818 7426 skb->len);
1da177e4 7427 conn->rx_len = len - skb->len;
d73a0988
AE		 7428 break;
7429
7430 case ACL_CONT:
1da177e4
LT		 7431 BT_DBG("Cont: frag len %d (expecting %d)", skb->len, conn->rx_len);
7432
7433 if (!conn->rx_len) {
7434 BT_ERR("Unexpected continuation frame (len %d)", skb->len);
7435 l2cap_conn_unreliable(conn, ECOMM);
7436 goto drop;
7437 }
7438
7439 if (skb->len > conn->rx_len) {
7440 BT_ERR("Fragment is too long (len %d, expected %d)",
2d792818 7441 skb->len, conn->rx_len);
1da177e4
LT		 7442 kfree_skb(conn->rx_skb);
7443 conn->rx_skb = NULL;
7444 conn->rx_len = 0;
7445 l2cap_conn_unreliable(conn, ECOMM);
7446 goto drop;
7447 }
7448
d626f62b 7449 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
2d792818 7450 skb->len);
1da177e4
LT		 7451 conn->rx_len -= skb->len;
7452
7453 if (!conn->rx_len) {
c4e5bafa
JH		 7454 /* Complete frame received. l2cap_recv_frame
7455 * takes ownership of the skb so set the global
7456 * rx_skb pointer to NULL first.
7457 */
7458 struct sk_buff *rx_skb = conn->rx_skb;
1da177e4 7459 conn->rx_skb = NULL;
c4e5bafa 7460 l2cap_recv_frame(conn, rx_skb);
1da177e4 7461 }
d73a0988 7462 break;
1da177e4
LT		 7463 }
7464
7465drop:
7466 kfree_skb(skb);
7467 return 0;
7468}
7469
aef7d97c 7470static int l2cap_debugfs_show(struct seq_file *f, void *p)
1da177e4 7471{
23691d75 7472 struct l2cap_chan *c;
1da177e4 7473
333055f2 7474 read_lock(&chan_list_lock);
1da177e4 7475
23691d75 7476 list_for_each_entry(c, &chan_list, global_l) {
fcb73338 7477 seq_printf(f, "%pMR %pMR %d %d 0x%4.4x 0x%4.4x %d %d %d %d\n",
7eafc59e 7478 &c->src, &c->dst,
fcb73338
AE		 7479 c->state, __le16_to_cpu(c->psm),
7480 c->scid, c->dcid, c->imtu, c->omtu,
7481 c->sec_level, c->mode);
61e1b4b7 7482 }
1da177e4 7483
333055f2 7484 read_unlock(&chan_list_lock);
1da177e4 7485
aef7d97c 7486 return 0;
1da177e4
LT		 7487}
7488
aef7d97c
MH		 7489static int l2cap_debugfs_open(struct inode *inode, struct file *file)
7490{
7491 return single_open(file, l2cap_debugfs_show, inode->i_private);
7492}
7493
7494static const struct file_operations l2cap_debugfs_fops = {
7495 .open = l2cap_debugfs_open,
7496 .read = seq_read,
7497 .llseek = seq_lseek,
7498 .release = single_release,
7499};
7500
7501static struct dentry *l2cap_debugfs;
1da177e4 7502
64274518 7503int __init l2cap_init(void)
1da177e4
LT		 7504{
7505 int err;
be9d1227 7506
bb58f747 7507 err = l2cap_init_sockets();
1da177e4
LT		 7508 if (err < 0)
7509 return err;
7510
1120e4bf
MH		 7511 if (IS_ERR_OR_NULL(bt_debugfs))
7512 return 0;
7513
7514 l2cap_debugfs = debugfs_create_file("l2cap", 0444, bt_debugfs,
7515 NULL, &l2cap_debugfs_fops);
1da177e4 7516
40b9397a 7517 debugfs_create_u16("l2cap_le_max_credits", 0644, bt_debugfs,
f15b8ecf 7518 &le_max_credits);
40b9397a 7519 debugfs_create_u16("l2cap_le_default_mps", 0644, bt_debugfs,
f15b8ecf
JH		 7520 &le_default_mps);
7521
1da177e4 7522 return 0;
1da177e4
LT		 7523}
7524
64274518 7525void l2cap_exit(void)
1da177e4 7526{
aef7d97c 7527 debugfs_remove(l2cap_debugfs);
bb58f747 7528 l2cap_cleanup_sockets();
1da177e4
LT		 7529}
7530
d1c4a17d
GP		 7531module_param(disable_ertm, bool, 0644);
7532MODULE_PARM_DESC(disable_ertm, "Disable enhanced retransmission mode");
Linux kernel - Deliverables
This page took 1.607667 seconds and 5 git commands to generate.