net/bluetooth/l2cap_core.c

60 static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
1006 static void __unpack_enhanced_control(u16 enh, struct l2cap_ctrl *control)
1008 	control->reqseq = (enh & L2CAP_CTRL_REQSEQ) >> L2CAP_CTRL_REQSEQ_SHIFT;
1009 	control->final = (enh & L2CAP_CTRL_FINAL) >> L2CAP_CTRL_FINAL_SHIFT;
1013 		control->sframe = 1;
1014 		control->poll = (enh & L2CAP_CTRL_POLL) >> L2CAP_CTRL_POLL_SHIFT;
1015 		control->super = (enh & L2CAP_CTRL_SUPERVISE) >> L2CAP_CTRL_SUPER_SHIFT;
1017 		control->sar = 0;
1018 		control->txseq = 0;
1021 		control->sframe = 0;
1022 		control->sar = (enh & L2CAP_CTRL_SAR) >> L2CAP_CTRL_SAR_SHIFT;
1023 		control->txseq = (enh & L2CAP_CTRL_TXSEQ) >> L2CAP_CTRL_TXSEQ_SHIFT;
1025 		control->poll = 0;
1026 		control->super = 0;
1030 static void __unpack_extended_control(u32 ext, struct l2cap_ctrl *control)
1032 	control->reqseq = (ext & L2CAP_EXT_CTRL_REQSEQ) >> L2CAP_EXT_CTRL_REQSEQ_SHIFT;
1033 	control->final = (ext & L2CAP_EXT_CTRL_FINAL) >> L2CAP_EXT_CTRL_FINAL_SHIFT;
1037 		control->sframe = 1;
1038 		control->poll = (ext & L2CAP_EXT_CTRL_POLL) >> L2CAP_EXT_CTRL_POLL_SHIFT;
1039 		control->super = (ext & L2CAP_EXT_CTRL_SUPERVISE) >> L2CAP_EXT_CTRL_SUPER_SHIFT;
1041 		control->sar = 0;
1042 		control->txseq = 0;
1045 		control->sframe = 0;
1046 		control->sar = (ext & L2CAP_EXT_CTRL_SAR) >> L2CAP_EXT_CTRL_SAR_SHIFT;
1047 		control->txseq = (ext & L2CAP_EXT_CTRL_TXSEQ) >> L2CAP_EXT_CTRL_TXSEQ_SHIFT;
1049 		control->poll = 0;
1050 		control->super = 0;
1068 static u32 __pack_extended_control(struct l2cap_ctrl *control)
1072 	packed = control->reqseq << L2CAP_EXT_CTRL_REQSEQ_SHIFT;
1073 	packed |= control->final << L2CAP_EXT_CTRL_FINAL_SHIFT;
1075 	if (control->sframe) {
1076 		packed |= control->poll << L2CAP_EXT_CTRL_POLL_SHIFT;
1077 		packed |= control->super << L2CAP_EXT_CTRL_SUPER_SHIFT;
1080 		packed |= control->sar << L2CAP_EXT_CTRL_SAR_SHIFT;
1081 		packed |= control->txseq << L2CAP_EXT_CTRL_TXSEQ_SHIFT;
1087 static u16 __pack_enhanced_control(struct l2cap_ctrl *control)
1091 	packed = control->reqseq << L2CAP_CTRL_REQSEQ_SHIFT;
1092 	packed |= control->final << L2CAP_CTRL_FINAL_SHIFT;
1094 	if (control->sframe) {
1095 		packed |= control->poll << L2CAP_CTRL_POLL_SHIFT;
1096 		packed |= control->super << L2CAP_CTRL_SUPER_SHIFT;
1099 		packed |= control->sar << L2CAP_CTRL_SAR_SHIFT;
1100 		packed |= control->txseq << L2CAP_CTRL_TXSEQ_SHIFT;
1107 				  struct l2cap_ctrl *control,
1111 		put_unaligned_le32(__pack_extended_control(control),
1114 		put_unaligned_le16(__pack_enhanced_control(control),
1128 					       u32 control)
1147 		put_unaligned_le32(control, skb_put(skb, L2CAP_EXT_CTRL_SIZE));
1149 		put_unaligned_le16(control, skb_put(skb, L2CAP_ENH_CTRL_SIZE));
1161 			      struct l2cap_ctrl *control)
1166 	BT_DBG("chan %p, control %p", chan, control);
1168 	if (!control->sframe)
1172 	    !control->poll)
1173 		control->final = 1;
1175 	if (control->super == L2CAP_SUPER_RR)
1177 	else if (control->super == L2CAP_SUPER_RNR)
1180 	if (control->super != L2CAP_SUPER_SREJ) {
1181 		chan->last_acked_seq = control->reqseq;
1185 	BT_DBG("reqseq %d, final %d, poll %d, super %d", control->reqseq,
1186 	       control->final, control->poll, control->super);
1189 		control_field = __pack_extended_control(control);
1191 		control_field = __pack_enhanced_control(control);
1200 	struct l2cap_ctrl control;
1204 	memset(&control, 0, sizeof(control));
1205 	control.sframe = 1;
1206 	control.poll = poll;
1209 		control.super = L2CAP_SUPER_RNR;
1211 		control.super = L2CAP_SUPER_RR;
1213 	control.reqseq = chan->buffer_seq;
1214 	l2cap_send_sframe(chan, &control);
1927 	struct l2cap_ctrl *control;
1938 		control = &bt_cb(skb)->l2cap;
1940 		control->reqseq = 0;
1941 		control->txseq = chan->next_tx_seq;
1943 		__pack_control(chan, control, skb);
1952 		BT_DBG("Sent txseq %u", control->txseq);
1962 	struct l2cap_ctrl *control;
1980 		control = &bt_cb(skb)->l2cap;
1983 			control->final = 1;
1985 		control->reqseq = chan->buffer_seq;
1987 		control->txseq = chan->next_tx_seq;
1989 		__pack_control(chan, control, skb);
2017 		BT_DBG("Sent txseq %u", control->txseq);
2028 	struct l2cap_ctrl control;
2049 		control = bt_cb(skb)->l2cap;
2059 		control.reqseq = chan->buffer_seq;
2061 			control.final = 1;
2063 			control.final = 0;
2081 			put_unaligned_le32(__pack_extended_control(&control),
2084 			put_unaligned_le16(__pack_enhanced_control(&control),
2098 		BT_DBG("Resent txseq %d", control.txseq);
2105 			     struct l2cap_ctrl *control)
2107 	BT_DBG("chan %p, control %p", chan, control);
2109 	l2cap_seq_list_append(&chan->retrans_list, control->reqseq);
2114 				 struct l2cap_ctrl *control)
2118 	BT_DBG("chan %p, control %p", chan, control);
2120 	if (control->poll)
2130 			if (bt_cb(skb)->l2cap.txseq == control->reqseq ||
2149 	struct l2cap_ctrl control;
2157 	memset(&control, 0, sizeof(control));
2158 	control.sframe = 1;
2163 		control.super = L2CAP_SUPER_RNR;
2164 		control.reqseq = chan->buffer_seq;
2165 		l2cap_send_sframe(chan, &control);
2186 			control.super = L2CAP_SUPER_RR;
2187 			control.reqseq = chan->buffer_seq;
2188 			l2cap_send_sframe(chan, &control);
2624 	struct l2cap_ctrl control;
2629 	memset(&control, 0, sizeof(control));
2630 	control.sframe = 1;
2631 	control.super = L2CAP_SUPER_SREJ;
2636 			control.reqseq = seq;
2637 			l2cap_send_sframe(chan, &control);
2647 	struct l2cap_ctrl control;
2654 	memset(&control, 0, sizeof(control));
2655 	control.sframe = 1;
2656 	control.super = L2CAP_SUPER_SREJ;
2657 	control.reqseq = chan->srej_list.tail;
2658 	l2cap_send_sframe(chan, &control);
2663 	struct l2cap_ctrl control;
2669 	memset(&control, 0, sizeof(control));
2670 	control.sframe = 1;
2671 	control.super = L2CAP_SUPER_SREJ;
2681 		control.reqseq = seq;
2682 		l2cap_send_sframe(chan, &control);
2730 				struct l2cap_ctrl *control,
2733 	BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,
2778 		l2cap_process_reqseq(chan, control->reqseq);
2802 				  struct l2cap_ctrl *control,
2805 	BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,
2848 		l2cap_process_reqseq(chan, control->reqseq);
2852 		if (control && control->final) {
2878 static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
2881 	BT_DBG("chan %p, control %p, skbs %p, event %d, state %d",
2882 	       chan, control, skbs, event, chan->tx_state);
2886 		l2cap_tx_state_xmit(chan, control, skbs, event);
2889 		l2cap_tx_state_wait_f(chan, control, skbs, event);
2898 			     struct l2cap_ctrl *control)
2900 	BT_DBG("chan %p, control %p", chan, control);
2901 	l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_REQSEQ_AND_FBIT);
2905 				  struct l2cap_ctrl *control)
2907 	BT_DBG("chan %p, control %p", chan, control);
2908 	l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_FBIT);
3190 		/* use extended control field */
5538 	struct l2cap_ctrl control;
5542 	memset(&control, 0, sizeof(control));
5543 	control.sframe = 1;
5544 	control.final = 1;
5545 	control.reqseq = chan->buffer_seq;
5549 		control.super = L2CAP_SUPER_RNR;
5550 		l2cap_send_sframe(chan, &control);
5565 		control.super = L2CAP_SUPER_RR;
5566 		l2cap_send_sframe(chan, &control);
5590 				struct l2cap_ctrl *control)
5594 	switch (control->sar) {
5726 			      struct l2cap_ctrl *control)
5730 	BT_DBG("chan %p, control %p", chan, control);
5732 	if (control->reqseq == chan->next_tx_seq) {
5733 		BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq);
5738 	skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);
5742 		       control->reqseq);
5754 	if (control->poll) {
5755 		l2cap_pass_to_tx(chan, control);
5758 		l2cap_retransmit(chan, control);
5763 			chan->srej_save_reqseq = control->reqseq;
5766 		l2cap_pass_to_tx_fbit(chan, control);
5768 		if (control->final) {
5769 			if (chan->srej_save_reqseq != control->reqseq ||
5772 				l2cap_retransmit(chan, control);
5774 			l2cap_retransmit(chan, control);
5777 				chan->srej_save_reqseq = control->reqseq;
5784 			     struct l2cap_ctrl *control)
5788 	BT_DBG("chan %p, control %p", chan, control);
5790 	if (control->reqseq == chan->next_tx_seq) {
5791 		BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq);
5796 	skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);
5807 	l2cap_pass_to_tx(chan, control);
5809 	if (control->final) {
5811 			l2cap_retransmit_all(chan, control);
5813 		l2cap_retransmit_all(chan, control);
5907 			       struct l2cap_ctrl *control,
5914 	BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
5919 		switch (l2cap_classify_txseq(chan, control->txseq)) {
5921 			l2cap_pass_to_tx(chan, control);
5925 				       control->txseq);
5930 							   control->txseq);
5936 			 * control, so make a copy in advance to use it after
5948 			 * Then the current thread tries to access control, but
5951 			local_control = *control;
5952 			err = l2cap_reassemble_sdu(chan, skb, control);
5969 			l2cap_pass_to_tx(chan, control);
5977 				       control->txseq);
5992 			l2cap_send_srej(chan, control->txseq);
5997 			l2cap_pass_to_tx(chan, control);
6008 		l2cap_pass_to_tx(chan, control);
6009 		if (control->final) {
6014 				control->final = 0;
6015 				l2cap_retransmit_all(chan, control);
6019 		} else if (control->poll) {
6032 		l2cap_pass_to_tx(chan, control);
6033 		if (control && control->poll) {
6041 		l2cap_handle_rej(chan, control);
6044 		l2cap_handle_srej(chan, control);
6059 				    struct l2cap_ctrl *control,
6063 	u16 txseq = control->txseq;
6066 	BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
6074 			l2cap_pass_to_tx(chan, control);
6085 			l2cap_pass_to_tx(chan, control);
6106 			l2cap_pass_to_tx(chan, control);
6107 			l2cap_send_srej(chan, control->txseq);
6120 			l2cap_pass_to_tx(chan, control);
6121 			l2cap_send_srej_list(chan, control->txseq);
6125 			l2cap_pass_to_tx(chan, control);
6141 		l2cap_pass_to_tx(chan, control);
6142 		if (control->final) {
6147 				control->final = 0;
6148 				l2cap_retransmit_all(chan, control);
6152 		} else if (control->poll) {
6172 		l2cap_pass_to_tx(chan, control);
6173 		if (control->poll) {
6186 		l2cap_handle_rej(chan, control);
6189 		l2cap_handle_srej(chan, control);
6212 				 struct l2cap_ctrl *control,
6217 	BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
6220 	if (!control->poll)
6223 	l2cap_process_reqseq(chan, control->reqseq);
6233 	chan->next_tx_seq = control->reqseq;
6246 	return l2cap_rx_state_recv(chan, control, NULL, event);
6250 				 struct l2cap_ctrl *control,
6255 	if (!control->final)
6261 	l2cap_process_reqseq(chan, control->reqseq);
6271 	chan->next_tx_seq = control->reqseq;
6278 		err = l2cap_rx_state_recv(chan, control, skb, event);
6292 static int l2cap_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
6297 	BT_DBG("chan %p, control %p, skb %p, event %d, state %d", chan,
6298 	       control, skb, event, chan->rx_state);
6300 	if (__valid_reqseq(chan, control->reqseq)) {
6303 			err = l2cap_rx_state_recv(chan, control, skb, event);
6306 			err = l2cap_rx_state_srej_sent(chan, control, skb,
6310 			err = l2cap_rx_state_wait_p(chan, control, skb, event);
6313 			err = l2cap_rx_state_wait_f(chan, control, skb, event);
6321 		       control->reqseq, chan->next_tx_seq,
6329 static int l2cap_stream_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
6332 	/* l2cap_reassemble_sdu may free skb, hence invalidate control, so store
6344 	 * Then the current thread tries to access control, but it was freed by
6347 	u16 txseq = control->txseq;
6349 	BT_DBG("chan %p, control %p, skb %p, state %d", chan, control, skb,
6353 		l2cap_pass_to_tx(chan, control);
6360 		l2cap_reassemble_sdu(chan, skb, control);
6383 	struct l2cap_ctrl *control = &bt_cb(skb)->l2cap;
6399 	if (!control->sframe && control->sar == L2CAP_SAR_START)
6415 	if (!control->sframe) {
6419 		       control->sar, control->reqseq, control->final,
6420 		       control->txseq);
6425 		if (control->final && chan->tx_state != L2CAP_TX_STATE_WAIT_F)
6430 			err = l2cap_rx(chan, control, skb, event);
6432 			err = l2cap_stream_rx(chan, control, skb);
6448 		       control->reqseq, control->final, control->poll,
6449 		       control->super);
6458 		if (control->final && (control->poll ||
6462 		event = rx_func_to_event[control->super];
6463 		if (l2cap_rx(chan, control, skb, event))
6673 		 * provide flow control mechanism. */
7633 MODULE_PARM_DESC(enable_ecred, "Enable enhanced credit flow control mode");